xmrig | e78c71ec9c29cf725d26cb88c1a6ba23d7ddf41b254fbb282264b1c56148e4ec

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
15-05-2024 23:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

54c425ba96686c0ab10c9eeb3d8381d0_NeikiAnalytics.exe
Size

2.8MB
MD5

54c425ba96686c0ab10c9eeb3d8381d0
SHA1

ee8d10db98949f6eae7edfbb4f7a3a0c34465867
SHA256

e78c71ec9c29cf725d26cb88c1a6ba23d7ddf41b254fbb282264b1c56148e4ec
SHA512

94175f8257c411529984ca7a16d8dc6bc131177f1afbb29b959c45de91d2acb94ed56bb7cc51b6ee4dad672682ef2de86c602f7264d8e9bada7dace55d1c610d
SSDEEP

49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0IlnASEx/Rk/:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2Rz

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 63 IoCs

miner

resource	yara_rule
behavioral1/memory/2476-0-0x000000013FA90000-0x000000013FE86000-memory.dmp	xmrig
behavioral1/files/0x000b000000015bb9-6.dat	xmrig
behavioral1/memory/3012-8-0x000000013FB30000-0x000000013FF26000-memory.dmp	xmrig
behavioral1/files/0x0007000000015cdb-11.dat	xmrig
behavioral1/files/0x0008000000015cf7-33.dat	xmrig
behavioral1/files/0x0007000000015d06-37.dat	xmrig
behavioral1/files/0x0006000000016c7a-52.dat	xmrig
behavioral1/files/0x0006000000016cc9-62.dat	xmrig
behavioral1/files/0x0006000000016cc9-60.dat	xmrig
behavioral1/files/0x0006000000016ced-72.dat	xmrig
behavioral1/files/0x0006000000016d0e-92.dat	xmrig
behavioral1/files/0x0006000000016d3b-112.dat	xmrig
behavioral1/files/0x0006000000016d27-107.dat	xmrig
behavioral1/files/0x0006000000016d67-132.dat	xmrig
behavioral1/files/0x0006000000017458-153.dat	xmrig
behavioral1/files/0x0006000000016d40-119.dat	xmrig
behavioral1/memory/2492-288-0x000000013FA80000-0x000000013FE76000-memory.dmp	xmrig
behavioral1/memory/2408-372-0x000000013FCB0000-0x00000001400A6000-memory.dmp	xmrig
behavioral1/memory/2908-377-0x000000013FDE0000-0x00000001401D6000-memory.dmp	xmrig
behavioral1/memory/760-424-0x000000013F050000-0x000000013F446000-memory.dmp	xmrig
behavioral1/memory/2152-375-0x000000013F0C0000-0x000000013F4B6000-memory.dmp	xmrig
behavioral1/memory/2500-370-0x000000013F080000-0x000000013F476000-memory.dmp	xmrig
behavioral1/memory/2524-368-0x000000013F9F0000-0x000000013FDE6000-memory.dmp	xmrig
behavioral1/memory/2772-366-0x000000013F0C0000-0x000000013F4B6000-memory.dmp	xmrig
behavioral1/memory/2704-364-0x000000013FCE0000-0x00000001400D6000-memory.dmp	xmrig
behavioral1/memory/2584-285-0x000000013F7C0000-0x000000013FBB6000-memory.dmp	xmrig
behavioral1/files/0x0009000000018648-162.dat	xmrig
behavioral1/files/0x0006000000017465-155.dat	xmrig
behavioral1/files/0x0006000000017387-148.dat	xmrig
behavioral1/files/0x0006000000017185-141.dat	xmrig
behavioral1/files/0x0006000000016d4b-127.dat	xmrig
behavioral1/files/0x0031000000018649-167.dat	xmrig
behavioral1/files/0x0031000000018649-165.dat	xmrig
behavioral1/files/0x0006000000017474-160.dat	xmrig
behavioral1/files/0x0006000000017384-147.dat	xmrig
behavioral1/files/0x0006000000017060-137.dat	xmrig
behavioral1/files/0x0006000000016d44-120.dat	xmrig
behavioral1/files/0x0006000000016d1f-102.dat	xmrig
behavioral1/files/0x0006000000016d1f-100.dat	xmrig
behavioral1/files/0x0006000000016d06-87.dat	xmrig
behavioral1/files/0x0006000000016d06-85.dat	xmrig
behavioral1/files/0x0006000000016cfe-82.dat	xmrig
behavioral1/files/0x0006000000016cf5-75.dat	xmrig
behavioral1/files/0x0006000000016ced-70.dat	xmrig
behavioral1/files/0x0006000000016ce1-67.dat	xmrig
behavioral1/files/0x0006000000016cab-55.dat	xmrig
behavioral1/files/0x0007000000016c2e-47.dat	xmrig
behavioral1/files/0x0008000000015d6e-43.dat	xmrig
behavioral1/files/0x001400000000549e-28.dat	xmrig
behavioral1/files/0x0038000000015ca5-12.dat	xmrig
behavioral1/memory/3012-4951-0x000000013FB30000-0x000000013FF26000-memory.dmp	xmrig
behavioral1/memory/3012-4952-0x000000013FB30000-0x000000013FF26000-memory.dmp	xmrig
behavioral1/memory/2584-4953-0x000000013F7C0000-0x000000013FBB6000-memory.dmp	xmrig
behavioral1/memory/2492-4954-0x000000013FA80000-0x000000013FE76000-memory.dmp	xmrig
behavioral1/memory/2704-4955-0x000000013FCE0000-0x00000001400D6000-memory.dmp	xmrig
behavioral1/memory/2772-4956-0x000000013F0C0000-0x000000013F4B6000-memory.dmp	xmrig
behavioral1/memory/2524-4957-0x000000013F9F0000-0x000000013FDE6000-memory.dmp	xmrig
behavioral1/memory/2500-4958-0x000000013F080000-0x000000013F476000-memory.dmp	xmrig
behavioral1/memory/2408-4959-0x000000013FCB0000-0x00000001400A6000-memory.dmp	xmrig
behavioral1/memory/760-4962-0x000000013F050000-0x000000013F446000-memory.dmp	xmrig
behavioral1/memory/2908-4961-0x000000013FDE0000-0x00000001401D6000-memory.dmp	xmrig
behavioral1/memory/2152-4960-0x000000013F0C0000-0x000000013F4B6000-memory.dmp	xmrig
behavioral1/memory/2656-4963-0x000000013FE30000-0x0000000140226000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
2572	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
3012	adqWZsQ.exe
2584	ABcQfpg.exe
2492	GpAWmFJ.exe
2704	iGLCaTJ.exe
2772	GrhuIBv.exe
2524	htpxduv.exe
2500	geeHHDE.exe
2408	HybSgSu.exe
2152	FNClqkh.exe
2908	jvcspfu.exe
760	OHkNcXJ.exe
2656	riITcaF.exe
2660	rdeGiIr.exe
2732	yqHZBEx.exe
2764	kPyreuc.exe
2128	OWiIfbG.exe
280	jkiMEsC.exe
340	vRtcyzq.exe
1660	pmbhwOm.exe
852	YsvWNXz.exe
848	IBlciVz.exe
2640	rAGuyUF.exe
2028	lSPeVxw.exe
1672	FFBkVQO.exe
2876	CqHHiwc.exe
1988	AegnXVD.exe
1644	wBhDzYR.exe
560	wtHCFmP.exe
1384	EbpPsAl.exe
1772	GZGoQRy.exe
2364	ZdnTTwP.exe
1916	dyABklh.exe
1160	khfsTLA.exe
2104	YqmtDrq.exe
2840	XaWuOYF.exe
1500	wckvcBC.exe
964	sgtDsth.exe
768	pWcCsYK.exe
1936	IWFuQSx.exe
900	mGVviYi.exe
2812	pXeROyR.exe
1524	lIcrtgP.exe
2020	YNmjZJq.exe
2648	Kpzurvq.exe
1260	WbomVcX.exe
1340	JfnvvZI.exe
1896	ulpKdti.exe
1608	CLQDDnS.exe
1776	GVeGErd.exe
592	YpVAgfL.exe
2032	FXLsQAR.exe
1392	YqcpDnO.exe
2784	KiPFIce.exe
1052	uJfKkNN.exe
2340	YEHbaZS.exe
1096	NgPaMyk.exe
2976	tcgmmEg.exe
1720	AsQIDlR.exe
2988	ORSdHEk.exe
984	SbICzMf.exe
1688	aKywbfD.exe
968	YygCuwW.exe
1892	EixKwRx.exe
2080	CTKPpxx.exe

Loads dropped DLL 64 IoCs

pid	Process
2476	54c425ba96686c0ab10c9eeb3d8381d0_NeikiAnalytics.exe
2476	54c425ba96686c0ab10c9eeb3d8381d0_NeikiAnalytics.exe
2476	54c425ba96686c0ab10c9eeb3d8381d0_NeikiAnalytics.exe
2476	54c425ba96686c0ab10c9eeb3d8381d0_NeikiAnalytics.exe
2476	54c425ba96686c0ab10c9eeb3d8381d0_NeikiAnalytics.exe
2476	54c425ba96686c0ab10c9eeb3d8381d0_NeikiAnalytics.exe
2476	54c425ba96686c0ab10c9eeb3d8381d0_NeikiAnalytics.exe
2476	54c425ba96686c0ab10c9eeb3d8381d0_NeikiAnalytics.exe
2476	54c425ba96686c0ab10c9eeb3d8381d0_NeikiAnalytics.exe
2476	54c425ba96686c0ab10c9eeb3d8381d0_NeikiAnalytics.exe
2476	54c425ba96686c0ab10c9eeb3d8381d0_NeikiAnalytics.exe
2476	54c425ba96686c0ab10c9eeb3d8381d0_NeikiAnalytics.exe
2476	54c425ba96686c0ab10c9eeb3d8381d0_NeikiAnalytics.exe
2476	54c425ba96686c0ab10c9eeb3d8381d0_NeikiAnalytics.exe
2476	54c425ba96686c0ab10c9eeb3d8381d0_NeikiAnalytics.exe
2476	54c425ba96686c0ab10c9eeb3d8381d0_NeikiAnalytics.exe
2476	54c425ba96686c0ab10c9eeb3d8381d0_NeikiAnalytics.exe
2476	54c425ba96686c0ab10c9eeb3d8381d0_NeikiAnalytics.exe
2476	54c425ba96686c0ab10c9eeb3d8381d0_NeikiAnalytics.exe
2476	54c425ba96686c0ab10c9eeb3d8381d0_NeikiAnalytics.exe
2476	54c425ba96686c0ab10c9eeb3d8381d0_NeikiAnalytics.exe
2476	54c425ba96686c0ab10c9eeb3d8381d0_NeikiAnalytics.exe
2476	54c425ba96686c0ab10c9eeb3d8381d0_NeikiAnalytics.exe
2476	54c425ba96686c0ab10c9eeb3d8381d0_NeikiAnalytics.exe
2476	54c425ba96686c0ab10c9eeb3d8381d0_NeikiAnalytics.exe
2476	54c425ba96686c0ab10c9eeb3d8381d0_NeikiAnalytics.exe
2476	54c425ba96686c0ab10c9eeb3d8381d0_NeikiAnalytics.exe
2476	54c425ba96686c0ab10c9eeb3d8381d0_NeikiAnalytics.exe
2476	54c425ba96686c0ab10c9eeb3d8381d0_NeikiAnalytics.exe
2476	54c425ba96686c0ab10c9eeb3d8381d0_NeikiAnalytics.exe
2476	54c425ba96686c0ab10c9eeb3d8381d0_NeikiAnalytics.exe
2476	54c425ba96686c0ab10c9eeb3d8381d0_NeikiAnalytics.exe
2476	54c425ba96686c0ab10c9eeb3d8381d0_NeikiAnalytics.exe
2476	54c425ba96686c0ab10c9eeb3d8381d0_NeikiAnalytics.exe
2476	54c425ba96686c0ab10c9eeb3d8381d0_NeikiAnalytics.exe
2476	54c425ba96686c0ab10c9eeb3d8381d0_NeikiAnalytics.exe
2476	54c425ba96686c0ab10c9eeb3d8381d0_NeikiAnalytics.exe
2476	54c425ba96686c0ab10c9eeb3d8381d0_NeikiAnalytics.exe
2476	54c425ba96686c0ab10c9eeb3d8381d0_NeikiAnalytics.exe
2476	54c425ba96686c0ab10c9eeb3d8381d0_NeikiAnalytics.exe
2476	54c425ba96686c0ab10c9eeb3d8381d0_NeikiAnalytics.exe
2476	54c425ba96686c0ab10c9eeb3d8381d0_NeikiAnalytics.exe
2476	54c425ba96686c0ab10c9eeb3d8381d0_NeikiAnalytics.exe
2476	54c425ba96686c0ab10c9eeb3d8381d0_NeikiAnalytics.exe
2476	54c425ba96686c0ab10c9eeb3d8381d0_NeikiAnalytics.exe
2476	54c425ba96686c0ab10c9eeb3d8381d0_NeikiAnalytics.exe
2476	54c425ba96686c0ab10c9eeb3d8381d0_NeikiAnalytics.exe
2476	54c425ba96686c0ab10c9eeb3d8381d0_NeikiAnalytics.exe
2476	54c425ba96686c0ab10c9eeb3d8381d0_NeikiAnalytics.exe
2476	54c425ba96686c0ab10c9eeb3d8381d0_NeikiAnalytics.exe
2476	54c425ba96686c0ab10c9eeb3d8381d0_NeikiAnalytics.exe
2476	54c425ba96686c0ab10c9eeb3d8381d0_NeikiAnalytics.exe
2476	54c425ba96686c0ab10c9eeb3d8381d0_NeikiAnalytics.exe
2476	54c425ba96686c0ab10c9eeb3d8381d0_NeikiAnalytics.exe
2476	54c425ba96686c0ab10c9eeb3d8381d0_NeikiAnalytics.exe
2476	54c425ba96686c0ab10c9eeb3d8381d0_NeikiAnalytics.exe
2476	54c425ba96686c0ab10c9eeb3d8381d0_NeikiAnalytics.exe
2476	54c425ba96686c0ab10c9eeb3d8381d0_NeikiAnalytics.exe
2476	54c425ba96686c0ab10c9eeb3d8381d0_NeikiAnalytics.exe
2476	54c425ba96686c0ab10c9eeb3d8381d0_NeikiAnalytics.exe
2476	54c425ba96686c0ab10c9eeb3d8381d0_NeikiAnalytics.exe
2476	54c425ba96686c0ab10c9eeb3d8381d0_NeikiAnalytics.exe
2476	54c425ba96686c0ab10c9eeb3d8381d0_NeikiAnalytics.exe
2476	54c425ba96686c0ab10c9eeb3d8381d0_NeikiAnalytics.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2476-0-0x000000013FA90000-0x000000013FE86000-memory.dmp	upx
behavioral1/files/0x000b000000015bb9-6.dat	upx
behavioral1/memory/3012-8-0x000000013FB30000-0x000000013FF26000-memory.dmp	upx
behavioral1/files/0x0007000000015cdb-11.dat	upx
behavioral1/files/0x0008000000015cf7-33.dat	upx
behavioral1/files/0x0007000000015d06-37.dat	upx
behavioral1/files/0x0006000000016c7a-52.dat	upx
behavioral1/files/0x0006000000016cc9-62.dat	upx
behavioral1/files/0x0006000000016cc9-60.dat	upx
behavioral1/files/0x0006000000016ced-72.dat	upx
behavioral1/files/0x0006000000016d0e-92.dat	upx
behavioral1/files/0x0006000000016d3b-112.dat	upx
behavioral1/files/0x0006000000016d27-107.dat	upx
behavioral1/files/0x0006000000016d67-132.dat	upx
behavioral1/files/0x0006000000017458-153.dat	upx
behavioral1/files/0x0006000000016d40-119.dat	upx
behavioral1/memory/2492-288-0x000000013FA80000-0x000000013FE76000-memory.dmp	upx
behavioral1/memory/2408-372-0x000000013FCB0000-0x00000001400A6000-memory.dmp	upx
behavioral1/memory/2908-377-0x000000013FDE0000-0x00000001401D6000-memory.dmp	upx
behavioral1/memory/2656-426-0x000000013FE30000-0x0000000140226000-memory.dmp	upx
behavioral1/memory/760-424-0x000000013F050000-0x000000013F446000-memory.dmp	upx
behavioral1/memory/2152-375-0x000000013F0C0000-0x000000013F4B6000-memory.dmp	upx
behavioral1/memory/2500-370-0x000000013F080000-0x000000013F476000-memory.dmp	upx
behavioral1/memory/2524-368-0x000000013F9F0000-0x000000013FDE6000-memory.dmp	upx
behavioral1/memory/2772-366-0x000000013F0C0000-0x000000013F4B6000-memory.dmp	upx
behavioral1/memory/2704-364-0x000000013FCE0000-0x00000001400D6000-memory.dmp	upx
behavioral1/memory/2584-285-0x000000013F7C0000-0x000000013FBB6000-memory.dmp	upx
behavioral1/files/0x0009000000018648-162.dat	upx
behavioral1/files/0x0006000000017465-155.dat	upx
behavioral1/files/0x0006000000017387-148.dat	upx
behavioral1/files/0x0006000000017185-141.dat	upx
behavioral1/files/0x0006000000016d4b-127.dat	upx
behavioral1/files/0x0031000000018649-167.dat	upx
behavioral1/files/0x0031000000018649-165.dat	upx
behavioral1/files/0x0006000000017474-160.dat	upx
behavioral1/files/0x0006000000017384-147.dat	upx
behavioral1/files/0x0006000000017060-137.dat	upx
behavioral1/files/0x0006000000016d44-120.dat	upx
behavioral1/files/0x0006000000016d1f-102.dat	upx
behavioral1/files/0x0006000000016d1f-100.dat	upx
behavioral1/files/0x0006000000016d06-87.dat	upx
behavioral1/files/0x0006000000016d06-85.dat	upx
behavioral1/files/0x0006000000016cfe-82.dat	upx
behavioral1/files/0x0006000000016cf5-75.dat	upx
behavioral1/files/0x0006000000016ced-70.dat	upx
behavioral1/files/0x0006000000016ce1-67.dat	upx
behavioral1/files/0x0006000000016cab-55.dat	upx
behavioral1/files/0x0007000000016c2e-47.dat	upx
behavioral1/files/0x0008000000015d6e-43.dat	upx
behavioral1/files/0x001400000000549e-28.dat	upx
behavioral1/files/0x0038000000015ca5-12.dat	upx
behavioral1/memory/3012-4951-0x000000013FB30000-0x000000013FF26000-memory.dmp	upx
behavioral1/memory/3012-4952-0x000000013FB30000-0x000000013FF26000-memory.dmp	upx
behavioral1/memory/2584-4953-0x000000013F7C0000-0x000000013FBB6000-memory.dmp	upx
behavioral1/memory/2492-4954-0x000000013FA80000-0x000000013FE76000-memory.dmp	upx
behavioral1/memory/2704-4955-0x000000013FCE0000-0x00000001400D6000-memory.dmp	upx
behavioral1/memory/2772-4956-0x000000013F0C0000-0x000000013F4B6000-memory.dmp	upx
behavioral1/memory/2524-4957-0x000000013F9F0000-0x000000013FDE6000-memory.dmp	upx
behavioral1/memory/2500-4958-0x000000013F080000-0x000000013F476000-memory.dmp	upx
behavioral1/memory/2408-4959-0x000000013FCB0000-0x00000001400A6000-memory.dmp	upx
behavioral1/memory/760-4962-0x000000013F050000-0x000000013F446000-memory.dmp	upx
behavioral1/memory/2908-4961-0x000000013FDE0000-0x00000001401D6000-memory.dmp	upx
behavioral1/memory/2152-4960-0x000000013F0C0000-0x000000013F4B6000-memory.dmp	upx
behavioral1/memory/2656-4963-0x000000013FE30000-0x0000000140226000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\cgoVHwb.exe	54c425ba96686c0ab10c9eeb3d8381d0_NeikiAnalytics.exe
File created	C:\Windows\System\JJeISfD.exe	54c425ba96686c0ab10c9eeb3d8381d0_NeikiAnalytics.exe
File created	C:\Windows\System\zmigxls.exe	54c425ba96686c0ab10c9eeb3d8381d0_NeikiAnalytics.exe
File created	C:\Windows\System\aORWJRo.exe	54c425ba96686c0ab10c9eeb3d8381d0_NeikiAnalytics.exe
File created	C:\Windows\System\xofYnTY.exe	54c425ba96686c0ab10c9eeb3d8381d0_NeikiAnalytics.exe
File created	C:\Windows\System\wKExwod.exe	54c425ba96686c0ab10c9eeb3d8381d0_NeikiAnalytics.exe
File created	C:\Windows\System\heKHBVv.exe	54c425ba96686c0ab10c9eeb3d8381d0_NeikiAnalytics.exe
File created	C:\Windows\System\VRKCQoC.exe	54c425ba96686c0ab10c9eeb3d8381d0_NeikiAnalytics.exe
File created	C:\Windows\System\EuKAnzh.exe	54c425ba96686c0ab10c9eeb3d8381d0_NeikiAnalytics.exe
File created	C:\Windows\System\zKkpMpc.exe	54c425ba96686c0ab10c9eeb3d8381d0_NeikiAnalytics.exe
File created	C:\Windows\System\cZjKYOe.exe	54c425ba96686c0ab10c9eeb3d8381d0_NeikiAnalytics.exe
File created	C:\Windows\System\odtNtuV.exe	54c425ba96686c0ab10c9eeb3d8381d0_NeikiAnalytics.exe
File created	C:\Windows\System\vQvkHDl.exe	54c425ba96686c0ab10c9eeb3d8381d0_NeikiAnalytics.exe
File created	C:\Windows\System\dRobQmK.exe	54c425ba96686c0ab10c9eeb3d8381d0_NeikiAnalytics.exe
File created	C:\Windows\System\NPNMaYy.exe	54c425ba96686c0ab10c9eeb3d8381d0_NeikiAnalytics.exe
File created	C:\Windows\System\mIaKzkq.exe	54c425ba96686c0ab10c9eeb3d8381d0_NeikiAnalytics.exe
File created	C:\Windows\System\YvAyRfG.exe	54c425ba96686c0ab10c9eeb3d8381d0_NeikiAnalytics.exe
File created	C:\Windows\System\IZNKrGA.exe	54c425ba96686c0ab10c9eeb3d8381d0_NeikiAnalytics.exe
File created	C:\Windows\System\MJCSxBK.exe	54c425ba96686c0ab10c9eeb3d8381d0_NeikiAnalytics.exe
File created	C:\Windows\System\sAiceZo.exe	54c425ba96686c0ab10c9eeb3d8381d0_NeikiAnalytics.exe
File created	C:\Windows\System\EEFZLoI.exe	54c425ba96686c0ab10c9eeb3d8381d0_NeikiAnalytics.exe
File created	C:\Windows\System\YMavsuQ.exe	54c425ba96686c0ab10c9eeb3d8381d0_NeikiAnalytics.exe
File created	C:\Windows\System\hMDubBG.exe	54c425ba96686c0ab10c9eeb3d8381d0_NeikiAnalytics.exe
File created	C:\Windows\System\dbcBGMM.exe	54c425ba96686c0ab10c9eeb3d8381d0_NeikiAnalytics.exe
File created	C:\Windows\System\LrHPfiQ.exe	54c425ba96686c0ab10c9eeb3d8381d0_NeikiAnalytics.exe
File created	C:\Windows\System\HpBWfNK.exe	54c425ba96686c0ab10c9eeb3d8381d0_NeikiAnalytics.exe
File created	C:\Windows\System\ZXviidn.exe	54c425ba96686c0ab10c9eeb3d8381d0_NeikiAnalytics.exe
File created	C:\Windows\System\tdimxAO.exe	54c425ba96686c0ab10c9eeb3d8381d0_NeikiAnalytics.exe
File created	C:\Windows\System\QlCAolu.exe	54c425ba96686c0ab10c9eeb3d8381d0_NeikiAnalytics.exe
File created	C:\Windows\System\jvcspfu.exe	54c425ba96686c0ab10c9eeb3d8381d0_NeikiAnalytics.exe
File created	C:\Windows\System\mpLtbin.exe	54c425ba96686c0ab10c9eeb3d8381d0_NeikiAnalytics.exe
File created	C:\Windows\System\pAaSUzp.exe	54c425ba96686c0ab10c9eeb3d8381d0_NeikiAnalytics.exe
File created	C:\Windows\System\INnRleq.exe	54c425ba96686c0ab10c9eeb3d8381d0_NeikiAnalytics.exe
File created	C:\Windows\System\UwMwzcR.exe	54c425ba96686c0ab10c9eeb3d8381d0_NeikiAnalytics.exe
File created	C:\Windows\System\mzYmJUy.exe	54c425ba96686c0ab10c9eeb3d8381d0_NeikiAnalytics.exe
File created	C:\Windows\System\GtVfnTi.exe	54c425ba96686c0ab10c9eeb3d8381d0_NeikiAnalytics.exe
File created	C:\Windows\System\jZXCNSW.exe	54c425ba96686c0ab10c9eeb3d8381d0_NeikiAnalytics.exe
File created	C:\Windows\System\HmmkyOO.exe	54c425ba96686c0ab10c9eeb3d8381d0_NeikiAnalytics.exe
File created	C:\Windows\System\KogDCfB.exe	54c425ba96686c0ab10c9eeb3d8381d0_NeikiAnalytics.exe
File created	C:\Windows\System\gafJdUL.exe	54c425ba96686c0ab10c9eeb3d8381d0_NeikiAnalytics.exe
File created	C:\Windows\System\MxTjUId.exe	54c425ba96686c0ab10c9eeb3d8381d0_NeikiAnalytics.exe
File created	C:\Windows\System\TAbZTBG.exe	54c425ba96686c0ab10c9eeb3d8381d0_NeikiAnalytics.exe
File created	C:\Windows\System\rKhxhsV.exe	54c425ba96686c0ab10c9eeb3d8381d0_NeikiAnalytics.exe
File created	C:\Windows\System\kWDIunY.exe	54c425ba96686c0ab10c9eeb3d8381d0_NeikiAnalytics.exe
File created	C:\Windows\System\rhynrtY.exe	54c425ba96686c0ab10c9eeb3d8381d0_NeikiAnalytics.exe
File created	C:\Windows\System\FQYzfzp.exe	54c425ba96686c0ab10c9eeb3d8381d0_NeikiAnalytics.exe
File created	C:\Windows\System\mzJDHVE.exe	54c425ba96686c0ab10c9eeb3d8381d0_NeikiAnalytics.exe
File created	C:\Windows\System\HybSgSu.exe	54c425ba96686c0ab10c9eeb3d8381d0_NeikiAnalytics.exe
File created	C:\Windows\System\JXeZear.exe	54c425ba96686c0ab10c9eeb3d8381d0_NeikiAnalytics.exe
File created	C:\Windows\System\XxLoiWX.exe	54c425ba96686c0ab10c9eeb3d8381d0_NeikiAnalytics.exe
File created	C:\Windows\System\abVGLWq.exe	54c425ba96686c0ab10c9eeb3d8381d0_NeikiAnalytics.exe
File created	C:\Windows\System\OugBPla.exe	54c425ba96686c0ab10c9eeb3d8381d0_NeikiAnalytics.exe
File created	C:\Windows\System\xcGrbLK.exe	54c425ba96686c0ab10c9eeb3d8381d0_NeikiAnalytics.exe
File created	C:\Windows\System\OFkEUjb.exe	54c425ba96686c0ab10c9eeb3d8381d0_NeikiAnalytics.exe
File created	C:\Windows\System\rSiKfSn.exe	54c425ba96686c0ab10c9eeb3d8381d0_NeikiAnalytics.exe
File created	C:\Windows\System\gPMDxBd.exe	54c425ba96686c0ab10c9eeb3d8381d0_NeikiAnalytics.exe
File created	C:\Windows\System\WsInXQH.exe	54c425ba96686c0ab10c9eeb3d8381d0_NeikiAnalytics.exe
File created	C:\Windows\System\pTrwZZU.exe	54c425ba96686c0ab10c9eeb3d8381d0_NeikiAnalytics.exe
File created	C:\Windows\System\GZIJIuw.exe	54c425ba96686c0ab10c9eeb3d8381d0_NeikiAnalytics.exe
File created	C:\Windows\System\VtNGVYX.exe	54c425ba96686c0ab10c9eeb3d8381d0_NeikiAnalytics.exe
File created	C:\Windows\System\kYJYdJk.exe	54c425ba96686c0ab10c9eeb3d8381d0_NeikiAnalytics.exe
File created	C:\Windows\System\Jipsacm.exe	54c425ba96686c0ab10c9eeb3d8381d0_NeikiAnalytics.exe
File created	C:\Windows\System\zgTwYZm.exe	54c425ba96686c0ab10c9eeb3d8381d0_NeikiAnalytics.exe
File created	C:\Windows\System\UgLqrVW.exe	54c425ba96686c0ab10c9eeb3d8381d0_NeikiAnalytics.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2572	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2476	54c425ba96686c0ab10c9eeb3d8381d0_NeikiAnalytics.exe
Token: SeDebugPrivilege	2572	powershell.exe
Token: SeLockMemoryPrivilege	2476	54c425ba96686c0ab10c9eeb3d8381d0_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2476 wrote to memory of 2572	2476	54c425ba96686c0ab10c9eeb3d8381d0_NeikiAnalytics.exe	29
PID 2476 wrote to memory of 2572	2476	54c425ba96686c0ab10c9eeb3d8381d0_NeikiAnalytics.exe	29
PID 2476 wrote to memory of 2572	2476	54c425ba96686c0ab10c9eeb3d8381d0_NeikiAnalytics.exe	29
PID 2476 wrote to memory of 3012	2476	54c425ba96686c0ab10c9eeb3d8381d0_NeikiAnalytics.exe	30
PID 2476 wrote to memory of 3012	2476	54c425ba96686c0ab10c9eeb3d8381d0_NeikiAnalytics.exe	30
PID 2476 wrote to memory of 3012	2476	54c425ba96686c0ab10c9eeb3d8381d0_NeikiAnalytics.exe	30
PID 2476 wrote to memory of 2584	2476	54c425ba96686c0ab10c9eeb3d8381d0_NeikiAnalytics.exe	31
PID 2476 wrote to memory of 2584	2476	54c425ba96686c0ab10c9eeb3d8381d0_NeikiAnalytics.exe	31
PID 2476 wrote to memory of 2584	2476	54c425ba96686c0ab10c9eeb3d8381d0_NeikiAnalytics.exe	31
PID 2476 wrote to memory of 2492	2476	54c425ba96686c0ab10c9eeb3d8381d0_NeikiAnalytics.exe	32
PID 2476 wrote to memory of 2492	2476	54c425ba96686c0ab10c9eeb3d8381d0_NeikiAnalytics.exe	32
PID 2476 wrote to memory of 2492	2476	54c425ba96686c0ab10c9eeb3d8381d0_NeikiAnalytics.exe	32
PID 2476 wrote to memory of 2704	2476	54c425ba96686c0ab10c9eeb3d8381d0_NeikiAnalytics.exe	33
PID 2476 wrote to memory of 2704	2476	54c425ba96686c0ab10c9eeb3d8381d0_NeikiAnalytics.exe	33
PID 2476 wrote to memory of 2704	2476	54c425ba96686c0ab10c9eeb3d8381d0_NeikiAnalytics.exe	33
PID 2476 wrote to memory of 2772	2476	54c425ba96686c0ab10c9eeb3d8381d0_NeikiAnalytics.exe	34
PID 2476 wrote to memory of 2772	2476	54c425ba96686c0ab10c9eeb3d8381d0_NeikiAnalytics.exe	34
PID 2476 wrote to memory of 2772	2476	54c425ba96686c0ab10c9eeb3d8381d0_NeikiAnalytics.exe	34
PID 2476 wrote to memory of 2524	2476	54c425ba96686c0ab10c9eeb3d8381d0_NeikiAnalytics.exe	35
PID 2476 wrote to memory of 2524	2476	54c425ba96686c0ab10c9eeb3d8381d0_NeikiAnalytics.exe	35
PID 2476 wrote to memory of 2524	2476	54c425ba96686c0ab10c9eeb3d8381d0_NeikiAnalytics.exe	35
PID 2476 wrote to memory of 2500	2476	54c425ba96686c0ab10c9eeb3d8381d0_NeikiAnalytics.exe	36
PID 2476 wrote to memory of 2500	2476	54c425ba96686c0ab10c9eeb3d8381d0_NeikiAnalytics.exe	36
PID 2476 wrote to memory of 2500	2476	54c425ba96686c0ab10c9eeb3d8381d0_NeikiAnalytics.exe	36
PID 2476 wrote to memory of 2408	2476	54c425ba96686c0ab10c9eeb3d8381d0_NeikiAnalytics.exe	37
PID 2476 wrote to memory of 2408	2476	54c425ba96686c0ab10c9eeb3d8381d0_NeikiAnalytics.exe	37
PID 2476 wrote to memory of 2408	2476	54c425ba96686c0ab10c9eeb3d8381d0_NeikiAnalytics.exe	37
PID 2476 wrote to memory of 2152	2476	54c425ba96686c0ab10c9eeb3d8381d0_NeikiAnalytics.exe	38
PID 2476 wrote to memory of 2152	2476	54c425ba96686c0ab10c9eeb3d8381d0_NeikiAnalytics.exe	38
PID 2476 wrote to memory of 2152	2476	54c425ba96686c0ab10c9eeb3d8381d0_NeikiAnalytics.exe	38
PID 2476 wrote to memory of 2908	2476	54c425ba96686c0ab10c9eeb3d8381d0_NeikiAnalytics.exe	39
PID 2476 wrote to memory of 2908	2476	54c425ba96686c0ab10c9eeb3d8381d0_NeikiAnalytics.exe	39
PID 2476 wrote to memory of 2908	2476	54c425ba96686c0ab10c9eeb3d8381d0_NeikiAnalytics.exe	39
PID 2476 wrote to memory of 760	2476	54c425ba96686c0ab10c9eeb3d8381d0_NeikiAnalytics.exe	40
PID 2476 wrote to memory of 760	2476	54c425ba96686c0ab10c9eeb3d8381d0_NeikiAnalytics.exe	40
PID 2476 wrote to memory of 760	2476	54c425ba96686c0ab10c9eeb3d8381d0_NeikiAnalytics.exe	40
PID 2476 wrote to memory of 2656	2476	54c425ba96686c0ab10c9eeb3d8381d0_NeikiAnalytics.exe	41
PID 2476 wrote to memory of 2656	2476	54c425ba96686c0ab10c9eeb3d8381d0_NeikiAnalytics.exe	41
PID 2476 wrote to memory of 2656	2476	54c425ba96686c0ab10c9eeb3d8381d0_NeikiAnalytics.exe	41
PID 2476 wrote to memory of 2660	2476	54c425ba96686c0ab10c9eeb3d8381d0_NeikiAnalytics.exe	42
PID 2476 wrote to memory of 2660	2476	54c425ba96686c0ab10c9eeb3d8381d0_NeikiAnalytics.exe	42
PID 2476 wrote to memory of 2660	2476	54c425ba96686c0ab10c9eeb3d8381d0_NeikiAnalytics.exe	42
PID 2476 wrote to memory of 2732	2476	54c425ba96686c0ab10c9eeb3d8381d0_NeikiAnalytics.exe	43
PID 2476 wrote to memory of 2732	2476	54c425ba96686c0ab10c9eeb3d8381d0_NeikiAnalytics.exe	43
PID 2476 wrote to memory of 2732	2476	54c425ba96686c0ab10c9eeb3d8381d0_NeikiAnalytics.exe	43
PID 2476 wrote to memory of 2764	2476	54c425ba96686c0ab10c9eeb3d8381d0_NeikiAnalytics.exe	44
PID 2476 wrote to memory of 2764	2476	54c425ba96686c0ab10c9eeb3d8381d0_NeikiAnalytics.exe	44
PID 2476 wrote to memory of 2764	2476	54c425ba96686c0ab10c9eeb3d8381d0_NeikiAnalytics.exe	44
PID 2476 wrote to memory of 2128	2476	54c425ba96686c0ab10c9eeb3d8381d0_NeikiAnalytics.exe	45
PID 2476 wrote to memory of 2128	2476	54c425ba96686c0ab10c9eeb3d8381d0_NeikiAnalytics.exe	45
PID 2476 wrote to memory of 2128	2476	54c425ba96686c0ab10c9eeb3d8381d0_NeikiAnalytics.exe	45
PID 2476 wrote to memory of 280	2476	54c425ba96686c0ab10c9eeb3d8381d0_NeikiAnalytics.exe	46
PID 2476 wrote to memory of 280	2476	54c425ba96686c0ab10c9eeb3d8381d0_NeikiAnalytics.exe	46
PID 2476 wrote to memory of 280	2476	54c425ba96686c0ab10c9eeb3d8381d0_NeikiAnalytics.exe	46
PID 2476 wrote to memory of 340	2476	54c425ba96686c0ab10c9eeb3d8381d0_NeikiAnalytics.exe	47
PID 2476 wrote to memory of 340	2476	54c425ba96686c0ab10c9eeb3d8381d0_NeikiAnalytics.exe	47
PID 2476 wrote to memory of 340	2476	54c425ba96686c0ab10c9eeb3d8381d0_NeikiAnalytics.exe	47
PID 2476 wrote to memory of 1660	2476	54c425ba96686c0ab10c9eeb3d8381d0_NeikiAnalytics.exe	48
PID 2476 wrote to memory of 1660	2476	54c425ba96686c0ab10c9eeb3d8381d0_NeikiAnalytics.exe	48
PID 2476 wrote to memory of 1660	2476	54c425ba96686c0ab10c9eeb3d8381d0_NeikiAnalytics.exe	48
PID 2476 wrote to memory of 852	2476	54c425ba96686c0ab10c9eeb3d8381d0_NeikiAnalytics.exe	49
PID 2476 wrote to memory of 852	2476	54c425ba96686c0ab10c9eeb3d8381d0_NeikiAnalytics.exe	49
PID 2476 wrote to memory of 852	2476	54c425ba96686c0ab10c9eeb3d8381d0_NeikiAnalytics.exe	49
PID 2476 wrote to memory of 848	2476	54c425ba96686c0ab10c9eeb3d8381d0_NeikiAnalytics.exe	50

C:\Users\Admin\AppData\Local\Temp\54c425ba96686c0ab10c9eeb3d8381d0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\54c425ba96686c0ab10c9eeb3d8381d0_NeikiAnalytics.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2476
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2572
- C:\Windows\System\adqWZsQ.exe
  C:\Windows\System\adqWZsQ.exe
  2⤵
  - Executes dropped EXE
  PID:3012
- C:\Windows\System\ABcQfpg.exe
  C:\Windows\System\ABcQfpg.exe
  2⤵
  - Executes dropped EXE
  PID:2584
- C:\Windows\System\GpAWmFJ.exe
  C:\Windows\System\GpAWmFJ.exe
  2⤵
  - Executes dropped EXE
  PID:2492
- C:\Windows\System\iGLCaTJ.exe
  C:\Windows\System\iGLCaTJ.exe
  2⤵
  - Executes dropped EXE
  PID:2704
- C:\Windows\System\GrhuIBv.exe
  C:\Windows\System\GrhuIBv.exe
  2⤵
  - Executes dropped EXE
  PID:2772
- C:\Windows\System\htpxduv.exe
  C:\Windows\System\htpxduv.exe
  2⤵
  - Executes dropped EXE
  PID:2524
- C:\Windows\System\geeHHDE.exe
  C:\Windows\System\geeHHDE.exe
  2⤵
  - Executes dropped EXE
  PID:2500
- C:\Windows\System\HybSgSu.exe
  C:\Windows\System\HybSgSu.exe
  2⤵
  - Executes dropped EXE
  PID:2408
- C:\Windows\System\FNClqkh.exe
  C:\Windows\System\FNClqkh.exe
  2⤵
  - Executes dropped EXE
  PID:2152
- C:\Windows\System\jvcspfu.exe
  C:\Windows\System\jvcspfu.exe
  2⤵
  - Executes dropped EXE
  PID:2908
- C:\Windows\System\OHkNcXJ.exe
  C:\Windows\System\OHkNcXJ.exe
  2⤵
  - Executes dropped EXE
  PID:760
- C:\Windows\System\riITcaF.exe
  C:\Windows\System\riITcaF.exe
  2⤵
  - Executes dropped EXE
  PID:2656
- C:\Windows\System\rdeGiIr.exe
  C:\Windows\System\rdeGiIr.exe
  2⤵
  - Executes dropped EXE
  PID:2660
- C:\Windows\System\yqHZBEx.exe
  C:\Windows\System\yqHZBEx.exe
  2⤵
  - Executes dropped EXE
  PID:2732
- C:\Windows\System\kPyreuc.exe
  C:\Windows\System\kPyreuc.exe
  2⤵
  - Executes dropped EXE
  PID:2764
- C:\Windows\System\OWiIfbG.exe
  C:\Windows\System\OWiIfbG.exe
  2⤵
  - Executes dropped EXE
  PID:2128
- C:\Windows\System\jkiMEsC.exe
  C:\Windows\System\jkiMEsC.exe
  2⤵
  - Executes dropped EXE
  PID:280
- C:\Windows\System\vRtcyzq.exe
  C:\Windows\System\vRtcyzq.exe
  2⤵
  - Executes dropped EXE
  PID:340
- C:\Windows\System\pmbhwOm.exe
  C:\Windows\System\pmbhwOm.exe
  2⤵
  - Executes dropped EXE
  PID:1660
- C:\Windows\System\YsvWNXz.exe
  C:\Windows\System\YsvWNXz.exe
  2⤵
  - Executes dropped EXE
  PID:852
- C:\Windows\System\IBlciVz.exe
  C:\Windows\System\IBlciVz.exe
  2⤵
  - Executes dropped EXE
  PID:848
- C:\Windows\System\rAGuyUF.exe
  C:\Windows\System\rAGuyUF.exe
  2⤵
  - Executes dropped EXE
  PID:2640
- C:\Windows\System\lSPeVxw.exe
  C:\Windows\System\lSPeVxw.exe
  2⤵
  - Executes dropped EXE
  PID:2028
- C:\Windows\System\YNmjZJq.exe
  C:\Windows\System\YNmjZJq.exe
  2⤵
  - Executes dropped EXE
  PID:2020
- C:\Windows\System\FFBkVQO.exe
  C:\Windows\System\FFBkVQO.exe
  2⤵
  - Executes dropped EXE
  PID:1672
- C:\Windows\System\JfnvvZI.exe
  C:\Windows\System\JfnvvZI.exe
  2⤵
  - Executes dropped EXE
  PID:1340
- C:\Windows\System\CqHHiwc.exe
  C:\Windows\System\CqHHiwc.exe
  2⤵
  - Executes dropped EXE
  PID:2876
- C:\Windows\System\ulpKdti.exe
  C:\Windows\System\ulpKdti.exe
  2⤵
  - Executes dropped EXE
  PID:1896
- C:\Windows\System\AegnXVD.exe
  C:\Windows\System\AegnXVD.exe
  2⤵
  - Executes dropped EXE
  PID:1988
- C:\Windows\System\CLQDDnS.exe
  C:\Windows\System\CLQDDnS.exe
  2⤵
  - Executes dropped EXE
  PID:1608
- C:\Windows\System\wBhDzYR.exe
  C:\Windows\System\wBhDzYR.exe
  2⤵
  - Executes dropped EXE
  PID:1644
- C:\Windows\System\YpVAgfL.exe
  C:\Windows\System\YpVAgfL.exe
  2⤵
  - Executes dropped EXE
  PID:592
- C:\Windows\System\wtHCFmP.exe
  C:\Windows\System\wtHCFmP.exe
  2⤵
  - Executes dropped EXE
  PID:560
- C:\Windows\System\YqcpDnO.exe
  C:\Windows\System\YqcpDnO.exe
  2⤵
  - Executes dropped EXE
  PID:1392
- C:\Windows\System\EbpPsAl.exe
  C:\Windows\System\EbpPsAl.exe
  2⤵
  - Executes dropped EXE
  PID:1384
- C:\Windows\System\KiPFIce.exe
  C:\Windows\System\KiPFIce.exe
  2⤵
  - Executes dropped EXE
  PID:2784
- C:\Windows\System\GZGoQRy.exe
  C:\Windows\System\GZGoQRy.exe
  2⤵
  - Executes dropped EXE
  PID:1772
- C:\Windows\System\NgPaMyk.exe
  C:\Windows\System\NgPaMyk.exe
  2⤵
  - Executes dropped EXE
  PID:1096
- C:\Windows\System\ZdnTTwP.exe
  C:\Windows\System\ZdnTTwP.exe
  2⤵
  - Executes dropped EXE
  PID:2364
- C:\Windows\System\tcgmmEg.exe
  C:\Windows\System\tcgmmEg.exe
  2⤵
  - Executes dropped EXE
  PID:2976
- C:\Windows\System\dyABklh.exe
  C:\Windows\System\dyABklh.exe
  2⤵
  - Executes dropped EXE
  PID:1916
- C:\Windows\System\AsQIDlR.exe
  C:\Windows\System\AsQIDlR.exe
  2⤵
  - Executes dropped EXE
  PID:1720
- C:\Windows\System\khfsTLA.exe
  C:\Windows\System\khfsTLA.exe
  2⤵
  - Executes dropped EXE
  PID:1160
- C:\Windows\System\ORSdHEk.exe
  C:\Windows\System\ORSdHEk.exe
  2⤵
  - Executes dropped EXE
  PID:2988
- C:\Windows\System\YqmtDrq.exe
  C:\Windows\System\YqmtDrq.exe
  2⤵
  - Executes dropped EXE
  PID:2104
- C:\Windows\System\SbICzMf.exe
  C:\Windows\System\SbICzMf.exe
  2⤵
  - Executes dropped EXE
  PID:984
- C:\Windows\System\XaWuOYF.exe
  C:\Windows\System\XaWuOYF.exe
  2⤵
  - Executes dropped EXE
  PID:2840
- C:\Windows\System\aKywbfD.exe
  C:\Windows\System\aKywbfD.exe
  2⤵
  - Executes dropped EXE
  PID:1688
- C:\Windows\System\wckvcBC.exe
  C:\Windows\System\wckvcBC.exe
  2⤵
  - Executes dropped EXE
  PID:1500
- C:\Windows\System\YygCuwW.exe
  C:\Windows\System\YygCuwW.exe
  2⤵
  - Executes dropped EXE
  PID:968
- C:\Windows\System\sgtDsth.exe
  C:\Windows\System\sgtDsth.exe
  2⤵
  - Executes dropped EXE
  PID:964
- C:\Windows\System\EixKwRx.exe
  C:\Windows\System\EixKwRx.exe
  2⤵
  - Executes dropped EXE
  PID:1892
- C:\Windows\System\pWcCsYK.exe
  C:\Windows\System\pWcCsYK.exe
  2⤵
  - Executes dropped EXE
  PID:768
- C:\Windows\System\CTKPpxx.exe
  C:\Windows\System\CTKPpxx.exe
  2⤵
  - Executes dropped EXE
  PID:2080
- C:\Windows\System\IWFuQSx.exe
  C:\Windows\System\IWFuQSx.exe
  2⤵
  - Executes dropped EXE
  PID:1936
- C:\Windows\System\ugkNrGW.exe
  C:\Windows\System\ugkNrGW.exe
  2⤵
  PID:2312
- C:\Windows\System\mGVviYi.exe
  C:\Windows\System\mGVviYi.exe
  2⤵
  - Executes dropped EXE
  PID:900
- C:\Windows\System\XGTHtwB.exe
  C:\Windows\System\XGTHtwB.exe
  2⤵
  PID:888
- C:\Windows\System\pXeROyR.exe
  C:\Windows\System\pXeROyR.exe
  2⤵
  - Executes dropped EXE
  PID:2812
- C:\Windows\System\BgVvwyd.exe
  C:\Windows\System\BgVvwyd.exe
  2⤵
  PID:2012
- C:\Windows\System\lIcrtgP.exe
  C:\Windows\System\lIcrtgP.exe
  2⤵
  - Executes dropped EXE
  PID:1524
- C:\Windows\System\IxhtLou.exe
  C:\Windows\System\IxhtLou.exe
  2⤵
  PID:2712
- C:\Windows\System\Kpzurvq.exe
  C:\Windows\System\Kpzurvq.exe
  2⤵
  - Executes dropped EXE
  PID:2648
- C:\Windows\System\qUWpulk.exe
  C:\Windows\System\qUWpulk.exe
  2⤵
  PID:2636
- C:\Windows\System\WbomVcX.exe
  C:\Windows\System\WbomVcX.exe
  2⤵
  - Executes dropped EXE
  PID:1260
- C:\Windows\System\NIggMtY.exe
  C:\Windows\System\NIggMtY.exe
  2⤵
  PID:1832
- C:\Windows\System\GVeGErd.exe
  C:\Windows\System\GVeGErd.exe
  2⤵
  - Executes dropped EXE
  PID:1776
- C:\Windows\System\ySOBbKU.exe
  C:\Windows\System\ySOBbKU.exe
  2⤵
  PID:1600
- C:\Windows\System\FXLsQAR.exe
  C:\Windows\System\FXLsQAR.exe
  2⤵
  - Executes dropped EXE
  PID:2032
- C:\Windows\System\VppIgkQ.exe
  C:\Windows\System\VppIgkQ.exe
  2⤵
  PID:2044
- C:\Windows\System\uJfKkNN.exe
  C:\Windows\System\uJfKkNN.exe
  2⤵
  - Executes dropped EXE
  PID:1052
- C:\Windows\System\eqAYfQo.exe
  C:\Windows\System\eqAYfQo.exe
  2⤵
  PID:1904
- C:\Windows\System\YEHbaZS.exe
  C:\Windows\System\YEHbaZS.exe
  2⤵
  - Executes dropped EXE
  PID:2340
- C:\Windows\System\wztATzO.exe
  C:\Windows\System\wztATzO.exe
  2⤵
  PID:2300
- C:\Windows\System\fbNFXtb.exe
  C:\Windows\System\fbNFXtb.exe
  2⤵
  PID:3176
- C:\Windows\System\YufQemr.exe
  C:\Windows\System\YufQemr.exe
  2⤵
  PID:3192
- C:\Windows\System\SVejvyZ.exe
  C:\Windows\System\SVejvyZ.exe
  2⤵
  PID:3208
- C:\Windows\System\YryJaDG.exe
  C:\Windows\System\YryJaDG.exe
  2⤵
  PID:3224
- C:\Windows\System\TBdfBqd.exe
  C:\Windows\System\TBdfBqd.exe
  2⤵
  PID:3240
- C:\Windows\System\vdksRXr.exe
  C:\Windows\System\vdksRXr.exe
  2⤵
  PID:3256
- C:\Windows\System\kRIJbaH.exe
  C:\Windows\System\kRIJbaH.exe
  2⤵
  PID:3272
- C:\Windows\System\DKaxZvg.exe
  C:\Windows\System\DKaxZvg.exe
  2⤵
  PID:3288
- C:\Windows\System\xeZjPqC.exe
  C:\Windows\System\xeZjPqC.exe
  2⤵
  PID:3304
- C:\Windows\System\bNQRKXR.exe
  C:\Windows\System\bNQRKXR.exe
  2⤵
  PID:3324
- C:\Windows\System\TmoRIcq.exe
  C:\Windows\System\TmoRIcq.exe
  2⤵
  PID:3340
- C:\Windows\System\kQXjrNb.exe
  C:\Windows\System\kQXjrNb.exe
  2⤵
  PID:3372
- C:\Windows\System\pWjIJCA.exe
  C:\Windows\System\pWjIJCA.exe
  2⤵
  PID:3388
- C:\Windows\System\wEJyXIS.exe
  C:\Windows\System\wEJyXIS.exe
  2⤵
  PID:3404
- C:\Windows\System\Stomrch.exe
  C:\Windows\System\Stomrch.exe
  2⤵
  PID:3420
- C:\Windows\System\pmaFPOe.exe
  C:\Windows\System\pmaFPOe.exe
  2⤵
  PID:3436
- C:\Windows\System\GOTwFQs.exe
  C:\Windows\System\GOTwFQs.exe
  2⤵
  PID:3452
- C:\Windows\System\RfKuWEe.exe
  C:\Windows\System\RfKuWEe.exe
  2⤵
  PID:3468
- C:\Windows\System\hsygyIH.exe
  C:\Windows\System\hsygyIH.exe
  2⤵
  PID:3488
- C:\Windows\System\GlsKsdt.exe
  C:\Windows\System\GlsKsdt.exe
  2⤵
  PID:3508
- C:\Windows\System\xQQdQfD.exe
  C:\Windows\System\xQQdQfD.exe
  2⤵
  PID:3616
- C:\Windows\System\fUTbgnV.exe
  C:\Windows\System\fUTbgnV.exe
  2⤵
  PID:3700
- C:\Windows\System\oAcjXUH.exe
  C:\Windows\System\oAcjXUH.exe
  2⤵
  PID:3716
- C:\Windows\System\XsMMrmf.exe
  C:\Windows\System\XsMMrmf.exe
  2⤵
  PID:3732
- C:\Windows\System\WVkmBWG.exe
  C:\Windows\System\WVkmBWG.exe
  2⤵
  PID:3748
- C:\Windows\System\abVGLWq.exe
  C:\Windows\System\abVGLWq.exe
  2⤵
  PID:3764
- C:\Windows\System\wmfvNiM.exe
  C:\Windows\System\wmfvNiM.exe
  2⤵
  PID:3780
- C:\Windows\System\hWDOswN.exe
  C:\Windows\System\hWDOswN.exe
  2⤵
  PID:3796
- C:\Windows\System\yzeKwan.exe
  C:\Windows\System\yzeKwan.exe
  2⤵
  PID:3812
- C:\Windows\System\NTasjKH.exe
  C:\Windows\System\NTasjKH.exe
  2⤵
  PID:3828
- C:\Windows\System\fZiXDCs.exe
  C:\Windows\System\fZiXDCs.exe
  2⤵
  PID:3844
- C:\Windows\System\JwTVplg.exe
  C:\Windows\System\JwTVplg.exe
  2⤵
  PID:3860
- C:\Windows\System\ROTxUSR.exe
  C:\Windows\System\ROTxUSR.exe
  2⤵
  PID:3876
- C:\Windows\System\NVvuJYs.exe
  C:\Windows\System\NVvuJYs.exe
  2⤵
  PID:3896
- C:\Windows\System\hAOQjkp.exe
  C:\Windows\System\hAOQjkp.exe
  2⤵
  PID:3920
- C:\Windows\System\jTkCwHv.exe
  C:\Windows\System\jTkCwHv.exe
  2⤵
  PID:3936
- C:\Windows\System\XiRQbHT.exe
  C:\Windows\System\XiRQbHT.exe
  2⤵
  PID:3956
- C:\Windows\System\vRPdKBM.exe
  C:\Windows\System\vRPdKBM.exe
  2⤵
  PID:3976
- C:\Windows\System\mfaLsqH.exe
  C:\Windows\System\mfaLsqH.exe
  2⤵
  PID:3996
- C:\Windows\System\VSOygjJ.exe
  C:\Windows\System\VSOygjJ.exe
  2⤵
  PID:4016
- C:\Windows\System\avUZlxz.exe
  C:\Windows\System\avUZlxz.exe
  2⤵
  PID:4052
- C:\Windows\System\lJWXXTL.exe
  C:\Windows\System\lJWXXTL.exe
  2⤵
  PID:3004
- C:\Windows\System\EEFZLoI.exe
  C:\Windows\System\EEFZLoI.exe
  2⤵
  PID:2000
- C:\Windows\System\wRyVcgr.exe
  C:\Windows\System\wRyVcgr.exe
  2⤵
  PID:1840
- C:\Windows\System\sWRAsgr.exe
  C:\Windows\System\sWRAsgr.exe
  2⤵
  PID:2024
- C:\Windows\System\YNbLsFb.exe
  C:\Windows\System\YNbLsFb.exe
  2⤵
  PID:2088
- C:\Windows\System\SBxAtkc.exe
  C:\Windows\System\SBxAtkc.exe
  2⤵
  PID:536
- C:\Windows\System\TqlKaqX.exe
  C:\Windows\System\TqlKaqX.exe
  2⤵
  PID:3252
- C:\Windows\System\tjEXKLd.exe
  C:\Windows\System\tjEXKLd.exe
  2⤵
  PID:3316
- C:\Windows\System\jFQQqxE.exe
  C:\Windows\System\jFQQqxE.exe
  2⤵
  PID:3356
- C:\Windows\System\EYdnfFJ.exe
  C:\Windows\System\EYdnfFJ.exe
  2⤵
  PID:788
- C:\Windows\System\gTuogPg.exe
  C:\Windows\System\gTuogPg.exe
  2⤵
  PID:1584
- C:\Windows\System\wVtCpgA.exe
  C:\Windows\System\wVtCpgA.exe
  2⤵
  PID:2084
- C:\Windows\System\IJTNHjB.exe
  C:\Windows\System\IJTNHjB.exe
  2⤵
  PID:3368
- C:\Windows\System\vTYdlRo.exe
  C:\Windows\System\vTYdlRo.exe
  2⤵
  PID:1624
- C:\Windows\System\WNYPnDb.exe
  C:\Windows\System\WNYPnDb.exe
  2⤵
  PID:1180
- C:\Windows\System\SmiFcAE.exe
  C:\Windows\System\SmiFcAE.exe
  2⤵
  PID:1496
- C:\Windows\System\HEUwMbT.exe
  C:\Windows\System\HEUwMbT.exe
  2⤵
  PID:2568
- C:\Windows\System\DpKsOCS.exe
  C:\Windows\System\DpKsOCS.exe
  2⤵
  PID:1844
- C:\Windows\System\WBFaWRi.exe
  C:\Windows\System\WBFaWRi.exe
  2⤵
  PID:3504
- C:\Windows\System\NXAuMcM.exe
  C:\Windows\System\NXAuMcM.exe
  2⤵
  PID:3476
- C:\Windows\System\ADnFLqt.exe
  C:\Windows\System\ADnFLqt.exe
  2⤵
  PID:920
- C:\Windows\System\oqGxaOP.exe
  C:\Windows\System\oqGxaOP.exe
  2⤵
  PID:1236
- C:\Windows\System\ckureVM.exe
  C:\Windows\System\ckureVM.exe
  2⤵
  PID:1252
- C:\Windows\System\cJsbJSn.exe
  C:\Windows\System\cJsbJSn.exe
  2⤵
  PID:2488
- C:\Windows\System\yWZxQzF.exe
  C:\Windows\System\yWZxQzF.exe
  2⤵
  PID:3128
- C:\Windows\System\kJnhlKq.exe
  C:\Windows\System\kJnhlKq.exe
  2⤵
  PID:3148
- C:\Windows\System\EDLBUvQ.exe
  C:\Windows\System\EDLBUvQ.exe
  2⤵
  PID:2948
- C:\Windows\System\sDSrnwv.exe
  C:\Windows\System\sDSrnwv.exe
  2⤵
  PID:908
- C:\Windows\System\ZYvuBPe.exe
  C:\Windows\System\ZYvuBPe.exe
  2⤵
  PID:1680
- C:\Windows\System\qyRnhtE.exe
  C:\Windows\System\qyRnhtE.exe
  2⤵
  PID:2984
- C:\Windows\System\GtvwvSI.exe
  C:\Windows\System\GtvwvSI.exe
  2⤵
  PID:1900
- C:\Windows\System\BzIYjyF.exe
  C:\Windows\System\BzIYjyF.exe
  2⤵
  PID:3600
- C:\Windows\System\sVtUPYc.exe
  C:\Windows\System\sVtUPYc.exe
  2⤵
  PID:3300
- C:\Windows\System\zRbtEVj.exe
  C:\Windows\System\zRbtEVj.exe
  2⤵
  PID:3384
- C:\Windows\System\PLjfIvh.exe
  C:\Windows\System\PLjfIvh.exe
  2⤵
  PID:3444
- C:\Windows\System\vFpnRkg.exe
  C:\Windows\System\vFpnRkg.exe
  2⤵
  PID:3268
- C:\Windows\System\MvtLOGA.exe
  C:\Windows\System\MvtLOGA.exe
  2⤵
  PID:3200
- C:\Windows\System\NIdfyRp.exe
  C:\Windows\System\NIdfyRp.exe
  2⤵
  PID:3528
- C:\Windows\System\JXeZear.exe
  C:\Windows\System\JXeZear.exe
  2⤵
  PID:3556
- C:\Windows\System\SybXuuv.exe
  C:\Windows\System\SybXuuv.exe
  2⤵
  PID:2516
- C:\Windows\System\GHOrTZa.exe
  C:\Windows\System\GHOrTZa.exe
  2⤵
  PID:2528
- C:\Windows\System\mvfjDBt.exe
  C:\Windows\System\mvfjDBt.exe
  2⤵
  PID:3000
- C:\Windows\System\gOjJYRd.exe
  C:\Windows\System\gOjJYRd.exe
  2⤵
  PID:3740
- C:\Windows\System\nJOHUXe.exe
  C:\Windows\System\nJOHUXe.exe
  2⤵
  PID:3904
- C:\Windows\System\ZNXxOCh.exe
  C:\Windows\System\ZNXxOCh.exe
  2⤵
  PID:3772
- C:\Windows\System\WWLRtzU.exe
  C:\Windows\System\WWLRtzU.exe
  2⤵
  PID:3984
- C:\Windows\System\yDNhBEj.exe
  C:\Windows\System\yDNhBEj.exe
  2⤵
  PID:3968
- C:\Windows\System\cZYToXX.exe
  C:\Windows\System\cZYToXX.exe
  2⤵
  PID:4012
- C:\Windows\System\pEKXOdx.exe
  C:\Windows\System\pEKXOdx.exe
  2⤵
  PID:4060
- C:\Windows\System\eIUEktY.exe
  C:\Windows\System\eIUEktY.exe
  2⤵
  PID:4080
- C:\Windows\System\HTKrFKW.exe
  C:\Windows\System\HTKrFKW.exe
  2⤵
  PID:1964
- C:\Windows\System\EVgdkNc.exe
  C:\Windows\System\EVgdkNc.exe
  2⤵
  PID:4044
- C:\Windows\System\dORvHMB.exe
  C:\Windows\System\dORvHMB.exe
  2⤵
  PID:2280
- C:\Windows\System\PbHiXUA.exe
  C:\Windows\System\PbHiXUA.exe
  2⤵
  PID:3248
- C:\Windows\System\iivENhe.exe
  C:\Windows\System\iivENhe.exe
  2⤵
  PID:1864
- C:\Windows\System\mYYLiMM.exe
  C:\Windows\System\mYYLiMM.exe
  2⤵
  PID:3116
- C:\Windows\System\zxecbGd.exe
  C:\Windows\System\zxecbGd.exe
  2⤵
  PID:3232
- C:\Windows\System\ZsTGJQA.exe
  C:\Windows\System\ZsTGJQA.exe
  2⤵
  PID:3416
- C:\Windows\System\CrTuFwT.exe
  C:\Windows\System\CrTuFwT.exe
  2⤵
  PID:3532
- C:\Windows\System\cNpSTXd.exe
  C:\Windows\System\cNpSTXd.exe
  2⤵
  PID:3708
- C:\Windows\System\YJNnnZi.exe
  C:\Windows\System\YJNnnZi.exe
  2⤵
  PID:4024
- C:\Windows\System\tNKykXA.exe
  C:\Windows\System\tNKykXA.exe
  2⤵
  PID:3728
- C:\Windows\System\mDHfNKm.exe
  C:\Windows\System\mDHfNKm.exe
  2⤵
  PID:3820
- C:\Windows\System\vzDtsNj.exe
  C:\Windows\System\vzDtsNj.exe
  2⤵
  PID:3884
- C:\Windows\System\ujdgaLG.exe
  C:\Windows\System\ujdgaLG.exe
  2⤵
  PID:3868
- C:\Windows\System\zHGBPLp.exe
  C:\Windows\System\zHGBPLp.exe
  2⤵
  PID:1616
- C:\Windows\System\MuNQKhu.exe
  C:\Windows\System\MuNQKhu.exe
  2⤵
  PID:2272
- C:\Windows\System\UkBHDmm.exe
  C:\Windows\System\UkBHDmm.exe
  2⤵
  PID:2692
- C:\Windows\System\ufLDSny.exe
  C:\Windows\System\ufLDSny.exe
  2⤵
  PID:480
- C:\Windows\System\IcTezOi.exe
  C:\Windows\System\IcTezOi.exe
  2⤵
  PID:4104
- C:\Windows\System\yvDyCUn.exe
  C:\Windows\System\yvDyCUn.exe
  2⤵
  PID:4124
- C:\Windows\System\NIfQbnD.exe
  C:\Windows\System\NIfQbnD.exe
  2⤵
  PID:4144
- C:\Windows\System\bVZADyS.exe
  C:\Windows\System\bVZADyS.exe
  2⤵
  PID:4160
- C:\Windows\System\jybFjSh.exe
  C:\Windows\System\jybFjSh.exe
  2⤵
  PID:4180
- C:\Windows\System\BfOLIHO.exe
  C:\Windows\System\BfOLIHO.exe
  2⤵
  PID:4196
- C:\Windows\System\nwnCfnj.exe
  C:\Windows\System\nwnCfnj.exe
  2⤵
  PID:4212
- C:\Windows\System\mCNbtHB.exe
  C:\Windows\System\mCNbtHB.exe
  2⤵
  PID:4228
- C:\Windows\System\GvnBZDA.exe
  C:\Windows\System\GvnBZDA.exe
  2⤵
  PID:4244
- C:\Windows\System\vyCbggM.exe
  C:\Windows\System\vyCbggM.exe
  2⤵
  PID:4260
- C:\Windows\System\CMyBllG.exe
  C:\Windows\System\CMyBllG.exe
  2⤵
  PID:4276
- C:\Windows\System\DGEzQtY.exe
  C:\Windows\System\DGEzQtY.exe
  2⤵
  PID:4292
- C:\Windows\System\dztbiXC.exe
  C:\Windows\System\dztbiXC.exe
  2⤵
  PID:4312
- C:\Windows\System\lzqBUyQ.exe
  C:\Windows\System\lzqBUyQ.exe
  2⤵
  PID:4328
- C:\Windows\System\bIrRonH.exe
  C:\Windows\System\bIrRonH.exe
  2⤵
  PID:4352
- C:\Windows\System\eFejCrw.exe
  C:\Windows\System\eFejCrw.exe
  2⤵
  PID:4368
- C:\Windows\System\bssYpJW.exe
  C:\Windows\System\bssYpJW.exe
  2⤵
  PID:4388
- C:\Windows\System\JDZXfzx.exe
  C:\Windows\System\JDZXfzx.exe
  2⤵
  PID:4404
- C:\Windows\System\FXPnseS.exe
  C:\Windows\System\FXPnseS.exe
  2⤵
  PID:4424
- C:\Windows\System\TRGOiBU.exe
  C:\Windows\System\TRGOiBU.exe
  2⤵
  PID:4444
- C:\Windows\System\TTUSKqm.exe
  C:\Windows\System\TTUSKqm.exe
  2⤵
  PID:4460
- C:\Windows\System\lyvWgky.exe
  C:\Windows\System\lyvWgky.exe
  2⤵
  PID:4480
- C:\Windows\System\zciYRmt.exe
  C:\Windows\System\zciYRmt.exe
  2⤵
  PID:4500
- C:\Windows\System\KBnmrtw.exe
  C:\Windows\System\KBnmrtw.exe
  2⤵
  PID:4540
- C:\Windows\System\fJBdWRb.exe
  C:\Windows\System\fJBdWRb.exe
  2⤵
  PID:4560
- C:\Windows\System\EBiAyon.exe
  C:\Windows\System\EBiAyon.exe
  2⤵
  PID:4580
- C:\Windows\System\wJrjhFf.exe
  C:\Windows\System\wJrjhFf.exe
  2⤵
  PID:4600
- C:\Windows\System\HBHvfyL.exe
  C:\Windows\System\HBHvfyL.exe
  2⤵
  PID:4620
- C:\Windows\System\CAeKZaw.exe
  C:\Windows\System\CAeKZaw.exe
  2⤵
  PID:4648
- C:\Windows\System\bVdkwbs.exe
  C:\Windows\System\bVdkwbs.exe
  2⤵
  PID:4668
- C:\Windows\System\jzZZoHl.exe
  C:\Windows\System\jzZZoHl.exe
  2⤵
  PID:4684
- C:\Windows\System\QfBejwp.exe
  C:\Windows\System\QfBejwp.exe
  2⤵
  PID:4704
- C:\Windows\System\CeZQEbe.exe
  C:\Windows\System\CeZQEbe.exe
  2⤵
  PID:4724
- C:\Windows\System\QIvyyFa.exe
  C:\Windows\System\QIvyyFa.exe
  2⤵
  PID:4740
- C:\Windows\System\yoEIYMx.exe
  C:\Windows\System\yoEIYMx.exe
  2⤵
  PID:4760
- C:\Windows\System\BbMjwek.exe
  C:\Windows\System\BbMjwek.exe
  2⤵
  PID:4780
- C:\Windows\System\aLWwqxH.exe
  C:\Windows\System\aLWwqxH.exe
  2⤵
  PID:4800
- C:\Windows\System\QuAtEZK.exe
  C:\Windows\System\QuAtEZK.exe
  2⤵
  PID:4816
- C:\Windows\System\XCvdEch.exe
  C:\Windows\System\XCvdEch.exe
  2⤵
  PID:4836
- C:\Windows\System\vzvIhsc.exe
  C:\Windows\System\vzvIhsc.exe
  2⤵
  PID:4852
- C:\Windows\System\CjWSCUN.exe
  C:\Windows\System\CjWSCUN.exe
  2⤵
  PID:4872
- C:\Windows\System\svSMJlu.exe
  C:\Windows\System\svSMJlu.exe
  2⤵
  PID:4892
- C:\Windows\System\FFkKoiy.exe
  C:\Windows\System\FFkKoiy.exe
  2⤵
  PID:4912
- C:\Windows\System\VHNEIpa.exe
  C:\Windows\System\VHNEIpa.exe
  2⤵
  PID:4932
- C:\Windows\System\IrmfVjn.exe
  C:\Windows\System\IrmfVjn.exe
  2⤵
  PID:4948
- C:\Windows\System\TXrfBaJ.exe
  C:\Windows\System\TXrfBaJ.exe
  2⤵
  PID:4968
- C:\Windows\System\gJktgWp.exe
  C:\Windows\System\gJktgWp.exe
  2⤵
  PID:4988
- C:\Windows\System\NDRIkoV.exe
  C:\Windows\System\NDRIkoV.exe
  2⤵
  PID:5004
- C:\Windows\System\MoOEaYw.exe
  C:\Windows\System\MoOEaYw.exe
  2⤵
  PID:5024
- C:\Windows\System\elsOCRa.exe
  C:\Windows\System\elsOCRa.exe
  2⤵
  PID:5044
- C:\Windows\System\fXRYaaT.exe
  C:\Windows\System\fXRYaaT.exe
  2⤵
  PID:5064
- C:\Windows\System\CbMJxNa.exe
  C:\Windows\System\CbMJxNa.exe
  2⤵
  PID:5080
- C:\Windows\System\pQBikDM.exe
  C:\Windows\System\pQBikDM.exe
  2⤵
  PID:5100
- C:\Windows\System\aGkjySv.exe
  C:\Windows\System\aGkjySv.exe
  2⤵
  PID:5116
- C:\Windows\System\cHxcTZj.exe
  C:\Windows\System\cHxcTZj.exe
  2⤵
  PID:2708
- C:\Windows\System\FuvIixg.exe
  C:\Windows\System\FuvIixg.exe
  2⤵
  PID:3172
- C:\Windows\System\mCdOLKr.exe
  C:\Windows\System\mCdOLKr.exe
  2⤵
  PID:2788
- C:\Windows\System\uVSHngS.exe
  C:\Windows\System\uVSHngS.exe
  2⤵
  PID:1636
- C:\Windows\System\YISDZzq.exe
  C:\Windows\System\YISDZzq.exe
  2⤵
  PID:3808
- C:\Windows\System\aoLJEQu.exe
  C:\Windows\System\aoLJEQu.exe
  2⤵
  PID:4072
- C:\Windows\System\qIUwhqM.exe
  C:\Windows\System\qIUwhqM.exe
  2⤵
  PID:2336
- C:\Windows\System\hyPuoPt.exe
  C:\Windows\System\hyPuoPt.exe
  2⤵
  PID:1728
- C:\Windows\System\HRTdiCd.exe
  C:\Windows\System\HRTdiCd.exe
  2⤵
  PID:3692
- C:\Windows\System\DWjtpck.exe
  C:\Windows\System\DWjtpck.exe
  2⤵
  PID:3888
- C:\Windows\System\jycrZwN.exe
  C:\Windows\System\jycrZwN.exe
  2⤵
  PID:2216
- C:\Windows\System\xOOhrRW.exe
  C:\Windows\System\xOOhrRW.exe
  2⤵
  PID:4136
- C:\Windows\System\BPaWjCw.exe
  C:\Windows\System\BPaWjCw.exe
  2⤵
  PID:4172
- C:\Windows\System\olgovoS.exe
  C:\Windows\System\olgovoS.exe
  2⤵
  PID:4300
- C:\Windows\System\UoGFEuj.exe
  C:\Windows\System\UoGFEuj.exe
  2⤵
  PID:4376
- C:\Windows\System\rXdOTsN.exe
  C:\Windows\System\rXdOTsN.exe
  2⤵
  PID:4412
- C:\Windows\System\cWrGFOr.exe
  C:\Windows\System\cWrGFOr.exe
  2⤵
  PID:4492
- C:\Windows\System\MwQkJLr.exe
  C:\Windows\System\MwQkJLr.exe
  2⤵
  PID:1476
- C:\Windows\System\CCgFcOW.exe
  C:\Windows\System\CCgFcOW.exe
  2⤵
  PID:4556
- C:\Windows\System\HVDtutE.exe
  C:\Windows\System\HVDtutE.exe
  2⤵
  PID:4628
- C:\Windows\System\RozbcMP.exe
  C:\Windows\System\RozbcMP.exe
  2⤵
  PID:4676
- C:\Windows\System\oTbqFEc.exe
  C:\Windows\System\oTbqFEc.exe
  2⤵
  PID:4712
- C:\Windows\System\vmNHMfc.exe
  C:\Windows\System\vmNHMfc.exe
  2⤵
  PID:4272
- C:\Windows\System\qxfbCoO.exe
  C:\Windows\System\qxfbCoO.exe
  2⤵
  PID:4092
- C:\Windows\System\lIQFAkW.exe
  C:\Windows\System\lIQFAkW.exe
  2⤵
  PID:4828
- C:\Windows\System\vwtENfC.exe
  C:\Windows\System\vwtENfC.exe
  2⤵
  PID:4864
- C:\Windows\System\DcRWMNY.exe
  C:\Windows\System\DcRWMNY.exe
  2⤵
  PID:4900
- C:\Windows\System\JWglpXA.exe
  C:\Windows\System\JWglpXA.exe
  2⤵
  PID:4548
- C:\Windows\System\ZXiRMpv.exe
  C:\Windows\System\ZXiRMpv.exe
  2⤵
  PID:5020
- C:\Windows\System\kvakcAo.exe
  C:\Windows\System\kvakcAo.exe
  2⤵
  PID:4756
- C:\Windows\System\dKiNcpE.exe
  C:\Windows\System\dKiNcpE.exe
  2⤵
  PID:2776
- C:\Windows\System\ghFGRGZ.exe
  C:\Windows\System\ghFGRGZ.exe
  2⤵
  PID:3336
- C:\Windows\System\fktQPik.exe
  C:\Windows\System\fktQPik.exe
  2⤵
  PID:4132
- C:\Windows\System\CyosLTZ.exe
  C:\Windows\System\CyosLTZ.exe
  2⤵
  PID:5016
- C:\Windows\System\MoLfTqt.exe
  C:\Windows\System\MoLfTqt.exe
  2⤵
  PID:5060
- C:\Windows\System\CNFrvBB.exe
  C:\Windows\System\CNFrvBB.exe
  2⤵
  PID:5132
- C:\Windows\System\bpbAgbr.exe
  C:\Windows\System\bpbAgbr.exe
  2⤵
  PID:5148
- C:\Windows\System\DwVyoNL.exe
  C:\Windows\System\DwVyoNL.exe
  2⤵
  PID:5172
- C:\Windows\System\wpiywiK.exe
  C:\Windows\System\wpiywiK.exe
  2⤵
  PID:5192
- C:\Windows\System\lDiIrjE.exe
  C:\Windows\System\lDiIrjE.exe
  2⤵
  PID:5208
- C:\Windows\System\UYlEOnj.exe
  C:\Windows\System\UYlEOnj.exe
  2⤵
  PID:5228
- C:\Windows\System\DZOLJRE.exe
  C:\Windows\System\DZOLJRE.exe
  2⤵
  PID:5244
- C:\Windows\System\sEbaaOH.exe
  C:\Windows\System\sEbaaOH.exe
  2⤵
  PID:5260
- C:\Windows\System\rXUqAkd.exe
  C:\Windows\System\rXUqAkd.exe
  2⤵
  PID:5288
- C:\Windows\System\VnSAsdl.exe
  C:\Windows\System\VnSAsdl.exe
  2⤵
  PID:5316
- C:\Windows\System\BuVXApV.exe
  C:\Windows\System\BuVXApV.exe
  2⤵
  PID:5348
- C:\Windows\System\aQxcWRj.exe
  C:\Windows\System\aQxcWRj.exe
  2⤵
  PID:5380
- C:\Windows\System\iJRYfaD.exe
  C:\Windows\System\iJRYfaD.exe
  2⤵
  PID:5412
- C:\Windows\System\ZBCkbSp.exe
  C:\Windows\System\ZBCkbSp.exe
  2⤵
  PID:5432
- C:\Windows\System\ZGPOaxe.exe
  C:\Windows\System\ZGPOaxe.exe
  2⤵
  PID:5448
- C:\Windows\System\rYvMfNr.exe
  C:\Windows\System\rYvMfNr.exe
  2⤵
  PID:5468
- C:\Windows\System\vwQCuhn.exe
  C:\Windows\System\vwQCuhn.exe
  2⤵
  PID:5484
- C:\Windows\System\mntkqFU.exe
  C:\Windows\System\mntkqFU.exe
  2⤵
  PID:5504
- C:\Windows\System\zVkFWrj.exe
  C:\Windows\System\zVkFWrj.exe
  2⤵
  PID:5520
- C:\Windows\System\KXEhXto.exe
  C:\Windows\System\KXEhXto.exe
  2⤵
  PID:5540
- C:\Windows\System\FqaEIHI.exe
  C:\Windows\System\FqaEIHI.exe
  2⤵
  PID:5560
- C:\Windows\System\StDQYrv.exe
  C:\Windows\System\StDQYrv.exe
  2⤵
  PID:5576
- C:\Windows\System\MlkczbN.exe
  C:\Windows\System\MlkczbN.exe
  2⤵
  PID:5596
- C:\Windows\System\nAULpcq.exe
  C:\Windows\System\nAULpcq.exe
  2⤵
  PID:5616
- C:\Windows\System\mRpJmHl.exe
  C:\Windows\System\mRpJmHl.exe
  2⤵
  PID:5636
- C:\Windows\System\LrHPfiQ.exe
  C:\Windows\System\LrHPfiQ.exe
  2⤵
  PID:5652
- C:\Windows\System\yZpemVs.exe
  C:\Windows\System\yZpemVs.exe
  2⤵
  PID:5668
- C:\Windows\System\RRvAleI.exe
  C:\Windows\System\RRvAleI.exe
  2⤵
  PID:5692
- C:\Windows\System\IIHHqAF.exe
  C:\Windows\System\IIHHqAF.exe
  2⤵
  PID:5712
- C:\Windows\System\BZPruva.exe
  C:\Windows\System\BZPruva.exe
  2⤵
  PID:5732
- C:\Windows\System\WtCEaNk.exe
  C:\Windows\System\WtCEaNk.exe
  2⤵
  PID:5748
- C:\Windows\System\dbyOGyq.exe
  C:\Windows\System\dbyOGyq.exe
  2⤵
  PID:5772
- C:\Windows\System\WFNtuoV.exe
  C:\Windows\System\WFNtuoV.exe
  2⤵
  PID:5796
- C:\Windows\System\ZaGvXJP.exe
  C:\Windows\System\ZaGvXJP.exe
  2⤵
  PID:5812
- C:\Windows\System\fEUiGhK.exe
  C:\Windows\System\fEUiGhK.exe
  2⤵
  PID:5832
- C:\Windows\System\Alihxfu.exe
  C:\Windows\System\Alihxfu.exe
  2⤵
  PID:5848
- C:\Windows\System\sxDJpSF.exe
  C:\Windows\System\sxDJpSF.exe
  2⤵
  PID:5868
- C:\Windows\System\bmbUZHZ.exe
  C:\Windows\System\bmbUZHZ.exe
  2⤵
  PID:5916
- C:\Windows\System\NudlGtd.exe
  C:\Windows\System\NudlGtd.exe
  2⤵
  PID:5932
- C:\Windows\System\JTQxvoc.exe
  C:\Windows\System\JTQxvoc.exe
  2⤵
  PID:5948
- C:\Windows\System\IVZyRBD.exe
  C:\Windows\System\IVZyRBD.exe
  2⤵
  PID:5964
- C:\Windows\System\kGCrngM.exe
  C:\Windows\System\kGCrngM.exe
  2⤵
  PID:5980
- C:\Windows\System\DrvRzTG.exe
  C:\Windows\System\DrvRzTG.exe
  2⤵
  PID:5996
- C:\Windows\System\GkysndB.exe
  C:\Windows\System\GkysndB.exe
  2⤵
  PID:6016
- C:\Windows\System\baXKqOQ.exe
  C:\Windows\System\baXKqOQ.exe
  2⤵
  PID:6036
- C:\Windows\System\qzuuOjT.exe
  C:\Windows\System\qzuuOjT.exe
  2⤵
  PID:6052
- C:\Windows\System\xciiXCg.exe
  C:\Windows\System\xciiXCg.exe
  2⤵
  PID:6072
- C:\Windows\System\hEdVXiU.exe
  C:\Windows\System\hEdVXiU.exe
  2⤵
  PID:6088
- C:\Windows\System\LISamFS.exe
  C:\Windows\System\LISamFS.exe
  2⤵
  PID:6108
- C:\Windows\System\HcQwRGi.exe
  C:\Windows\System\HcQwRGi.exe
  2⤵
  PID:6124
- C:\Windows\System\ePchIAu.exe
  C:\Windows\System\ePchIAu.exe
  2⤵
  PID:2672
- C:\Windows\System\cLetTal.exe
  C:\Windows\System\cLetTal.exe
  2⤵
  PID:3400
- C:\Windows\System\UOViPDF.exe
  C:\Windows\System\UOViPDF.exe
  2⤵
  PID:4348
- C:\Windows\System\aAFowjG.exe
  C:\Windows\System\aAFowjG.exe
  2⤵
  PID:5056
- C:\Windows\System\ExOWLGm.exe
  C:\Windows\System\ExOWLGm.exe
  2⤵
  PID:4636
- C:\Windows\System\YAIZvWA.exe
  C:\Windows\System\YAIZvWA.exe
  2⤵
  PID:4752
- C:\Windows\System\IfAmBbH.exe
  C:\Windows\System\IfAmBbH.exe
  2⤵
  PID:3352
- C:\Windows\System\dQidKXD.exe
  C:\Windows\System\dQidKXD.exe
  2⤵
  PID:5304
- C:\Windows\System\YgUJZNY.exe
  C:\Windows\System\YgUJZNY.exe
  2⤵
  PID:5356
- C:\Windows\System\SGwCful.exe
  C:\Windows\System\SGwCful.exe
  2⤵
  PID:5372
- C:\Windows\System\VOqWJBt.exe
  C:\Windows\System\VOqWJBt.exe
  2⤵
  PID:5456
- C:\Windows\System\VfqMAjj.exe
  C:\Windows\System\VfqMAjj.exe
  2⤵
  PID:5496
- C:\Windows\System\vtZsLHt.exe
  C:\Windows\System\vtZsLHt.exe
  2⤵
  PID:5536
- C:\Windows\System\MCcIMVV.exe
  C:\Windows\System\MCcIMVV.exe
  2⤵
  PID:5256
- C:\Windows\System\sDAcBSx.exe
  C:\Windows\System\sDAcBSx.exe
  2⤵
  PID:5612
- C:\Windows\System\OqDfBlS.exe
  C:\Windows\System\OqDfBlS.exe
  2⤵
  PID:5680
- C:\Windows\System\NhdlnRw.exe
  C:\Windows\System\NhdlnRw.exe
  2⤵
  PID:276
- C:\Windows\System\KnjENlg.exe
  C:\Windows\System\KnjENlg.exe
  2⤵
  PID:452
- C:\Windows\System\pgGpmJN.exe
  C:\Windows\System\pgGpmJN.exe
  2⤵
  PID:5688
- C:\Windows\System\DoreZUF.exe
  C:\Windows\System\DoreZUF.exe
  2⤵
  PID:3948
- C:\Windows\System\SwnOxQj.exe
  C:\Windows\System\SwnOxQj.exe
  2⤵
  PID:3788
- C:\Windows\System\kMkcXGo.exe
  C:\Windows\System\kMkcXGo.exe
  2⤵
  PID:3524
- C:\Windows\System\VTqAnpV.exe
  C:\Windows\System\VTqAnpV.exe
  2⤵
  PID:4924
- C:\Windows\System\obouZtY.exe
  C:\Windows\System\obouZtY.exe
  2⤵
  PID:4116
- C:\Windows\System\TwhkoII.exe
  C:\Windows\System\TwhkoII.exe
  2⤵
  PID:4188
- C:\Windows\System\NrgxEvF.exe
  C:\Windows\System\NrgxEvF.exe
  2⤵
  PID:4252
- C:\Windows\System\xUjfuho.exe
  C:\Windows\System\xUjfuho.exe
  2⤵
  PID:4324
- C:\Windows\System\YggCeJS.exe
  C:\Windows\System\YggCeJS.exe
  2⤵
  PID:4400
- C:\Windows\System\eqtCkuG.exe
  C:\Windows\System\eqtCkuG.exe
  2⤵
  PID:4468
- C:\Windows\System\mIaKzkq.exe
  C:\Windows\System\mIaKzkq.exe
  2⤵
  PID:4512
- C:\Windows\System\gafJdUL.exe
  C:\Windows\System\gafJdUL.exe
  2⤵
  PID:4524
- C:\Windows\System\ayfgNzk.exe
  C:\Windows\System\ayfgNzk.exe
  2⤵
  PID:4572
- C:\Windows\System\qXsCkJd.exe
  C:\Windows\System\qXsCkJd.exe
  2⤵
  PID:4616
- C:\Windows\System\LofgTyE.exe
  C:\Windows\System\LofgTyE.exe
  2⤵
  PID:4692
- C:\Windows\System\YEExnVz.exe
  C:\Windows\System\YEExnVz.exe
  2⤵
  PID:4736
- C:\Windows\System\BoVUzCB.exe
  C:\Windows\System\BoVUzCB.exe
  2⤵
  PID:4808
- C:\Windows\System\fUpOTqW.exe
  C:\Windows\System\fUpOTqW.exe
  2⤵
  PID:4880
- C:\Windows\System\jgVBDKT.exe
  C:\Windows\System\jgVBDKT.exe
  2⤵
  PID:4928
- C:\Windows\System\FijzucK.exe
  C:\Windows\System\FijzucK.exe
  2⤵
  PID:2056
- C:\Windows\System\PQJFGyb.exe
  C:\Windows\System\PQJFGyb.exe
  2⤵
  PID:5128
- C:\Windows\System\RVlIXZD.exe
  C:\Windows\System\RVlIXZD.exe
  2⤵
  PID:5200
- C:\Windows\System\ogGMzDu.exe
  C:\Windows\System\ogGMzDu.exe
  2⤵
  PID:5272
- C:\Windows\System\fhGIyAj.exe
  C:\Windows\System\fhGIyAj.exe
  2⤵
  PID:5332
- C:\Windows\System\XlfRRLe.exe
  C:\Windows\System\XlfRRLe.exe
  2⤵
  PID:5388
- C:\Windows\System\yoJpcrv.exe
  C:\Windows\System\yoJpcrv.exe
  2⤵
  PID:5404
- C:\Windows\System\BSHCYjC.exe
  C:\Windows\System\BSHCYjC.exe
  2⤵
  PID:5476
- C:\Windows\System\ilxlbQz.exe
  C:\Windows\System\ilxlbQz.exe
  2⤵
  PID:5548
- C:\Windows\System\mpLtbin.exe
  C:\Windows\System\mpLtbin.exe
  2⤵
  PID:5624
- C:\Windows\System\qLkbbMf.exe
  C:\Windows\System\qLkbbMf.exe
  2⤵
  PID:5700
- C:\Windows\System\KTREKIT.exe
  C:\Windows\System\KTREKIT.exe
  2⤵
  PID:5780
- C:\Windows\System\wbacOvS.exe
  C:\Windows\System\wbacOvS.exe
  2⤵
  PID:5820
- C:\Windows\System\UGXjDNO.exe
  C:\Windows\System\UGXjDNO.exe
  2⤵
  PID:5860
- C:\Windows\System\NfKTdsN.exe
  C:\Windows\System\NfKTdsN.exe
  2⤵
  PID:5928
- C:\Windows\System\vLyjQdE.exe
  C:\Windows\System\vLyjQdE.exe
  2⤵
  PID:5992
- C:\Windows\System\yFGlZof.exe
  C:\Windows\System\yFGlZof.exe
  2⤵
  PID:6068
- C:\Windows\System\ujfxeeu.exe
  C:\Windows\System\ujfxeeu.exe
  2⤵
  PID:5088
- C:\Windows\System\cgoVHwb.exe
  C:\Windows\System\cgoVHwb.exe
  2⤵
  PID:4748
- C:\Windows\System\ztpUYfA.exe
  C:\Windows\System\ztpUYfA.exe
  2⤵
  PID:2576
- C:\Windows\System\NjSFddc.exe
  C:\Windows\System\NjSFddc.exe
  2⤵
  PID:5144
- C:\Windows\System\qAzjrdI.exe
  C:\Windows\System\qAzjrdI.exe
  2⤵
  PID:5220
- C:\Windows\System\CwKDKUY.exe
  C:\Windows\System\CwKDKUY.exe
  2⤵
  PID:3380
- C:\Windows\System\gaHxNXn.exe
  C:\Windows\System\gaHxNXn.exe
  2⤵
  PID:5608
- C:\Windows\System\HxRcoLE.exe
  C:\Windows\System\HxRcoLE.exe
  2⤵
  PID:2904
- C:\Windows\System\SCGXrgz.exe
  C:\Windows\System\SCGXrgz.exe
  2⤵
  PID:3220
- C:\Windows\System\aaEggtk.exe
  C:\Windows\System\aaEggtk.exe
  2⤵
  PID:5300
- C:\Windows\System\lZPKgFg.exe
  C:\Windows\System\lZPKgFg.exe
  2⤵
  PID:5568
- C:\Windows\System\ciXtcIZ.exe
  C:\Windows\System\ciXtcIZ.exe
  2⤵
  PID:3792
- C:\Windows\System\QGUUDKb.exe
  C:\Windows\System\QGUUDKb.exe
  2⤵
  PID:4284
- C:\Windows\System\JGnnCYd.exe
  C:\Windows\System\JGnnCYd.exe
  2⤵
  PID:4152
- C:\Windows\System\nHOcFQs.exe
  C:\Windows\System\nHOcFQs.exe
  2⤵
  PID:4320
- C:\Windows\System\UcQMCef.exe
  C:\Windows\System\UcQMCef.exe
  2⤵
  PID:4396
- C:\Windows\System\MmTnicG.exe
  C:\Windows\System\MmTnicG.exe
  2⤵
  PID:4508
- C:\Windows\System\ZwsbBmJ.exe
  C:\Windows\System\ZwsbBmJ.exe
  2⤵
  PID:4568
- C:\Windows\System\PDcBUrU.exe
  C:\Windows\System\PDcBUrU.exe
  2⤵
  PID:4732
- C:\Windows\System\znyDFuJ.exe
  C:\Windows\System\znyDFuJ.exe
  2⤵
  PID:4888
- C:\Windows\System\Yxutlxn.exe
  C:\Windows\System\Yxutlxn.exe
  2⤵
  PID:4068
- C:\Windows\System\jRLeyTP.exe
  C:\Windows\System\jRLeyTP.exe
  2⤵
  PID:5032
- C:\Windows\System\dXnrUsZ.exe
  C:\Windows\System\dXnrUsZ.exe
  2⤵
  PID:5112
- C:\Windows\System\WHocdhk.exe
  C:\Windows\System\WHocdhk.exe
  2⤵
  PID:1468
- C:\Windows\System\snZUAlH.exe
  C:\Windows\System\snZUAlH.exe
  2⤵
  PID:5724
- C:\Windows\System\JeYxzTh.exe
  C:\Windows\System\JeYxzTh.exe
  2⤵
  PID:5760
- C:\Windows\System\AmNAvDY.exe
  C:\Windows\System\AmNAvDY.exe
  2⤵
  PID:5880
- C:\Windows\System\mzYmJUy.exe
  C:\Windows\System\mzYmJUy.exe
  2⤵
  PID:5908
- C:\Windows\System\znXpPTE.exe
  C:\Windows\System\znXpPTE.exe
  2⤵
  PID:5976
- C:\Windows\System\tDlPOLr.exe
  C:\Windows\System\tDlPOLr.exe
  2⤵
  PID:5808
- C:\Windows\System\qcfukEX.exe
  C:\Windows\System\qcfukEX.exe
  2⤵
  PID:3332
- C:\Windows\System\jcoVgql.exe
  C:\Windows\System\jcoVgql.exe
  2⤵
  PID:1444
- C:\Windows\System\CEThoIx.exe
  C:\Windows\System\CEThoIx.exe
  2⤵
  PID:4384
- C:\Windows\System\yhrUEpT.exe
  C:\Windows\System\yhrUEpT.exe
  2⤵
  PID:4680
- C:\Windows\System\UGhlgxq.exe
  C:\Windows\System\UGhlgxq.exe
  2⤵
  PID:4832
- C:\Windows\System\RVwzcFL.exe
  C:\Windows\System\RVwzcFL.exe
  2⤵
  PID:4940
- C:\Windows\System\lWJNpGj.exe
  C:\Windows\System\lWJNpGj.exe
  2⤵
  PID:5000
- C:\Windows\System\eXvDwxN.exe
  C:\Windows\System\eXvDwxN.exe
  2⤵
  PID:4344
- C:\Windows\System\DGEcYUR.exe
  C:\Windows\System\DGEcYUR.exe
  2⤵
  PID:5236
- C:\Windows\System\qyyPpKZ.exe
  C:\Windows\System\qyyPpKZ.exe
  2⤵
  PID:5284
- C:\Windows\System\uWtJeUX.exe
  C:\Windows\System\uWtJeUX.exe
  2⤵
  PID:5516
- C:\Windows\System\XYgkVNz.exe
  C:\Windows\System\XYgkVNz.exe
  2⤵
  PID:5788
- C:\Windows\System\cSbOtOX.exe
  C:\Windows\System\cSbOtOX.exe
  2⤵
  PID:5792
- C:\Windows\System\wapqmEw.exe
  C:\Windows\System\wapqmEw.exe
  2⤵
  PID:808
- C:\Windows\System\yCRoqqw.exe
  C:\Windows\System\yCRoqqw.exe
  2⤵
  PID:4640
- C:\Windows\System\loOqNQr.exe
  C:\Windows\System\loOqNQr.exe
  2⤵
  PID:764
- C:\Windows\System\pSMIZEO.exe
  C:\Windows\System\pSMIZEO.exe
  2⤵
  PID:5592
- C:\Windows\System\QtGrptq.exe
  C:\Windows\System\QtGrptq.exe
  2⤵
  PID:3204
- C:\Windows\System\iXwcyJR.exe
  C:\Windows\System\iXwcyJR.exe
  2⤵
  PID:2608
- C:\Windows\System\VRKCQoC.exe
  C:\Windows\System\VRKCQoC.exe
  2⤵
  PID:2224
- C:\Windows\System\zYFGDUP.exe
  C:\Windows\System\zYFGDUP.exe
  2⤵
  PID:4436
- C:\Windows\System\oVnwlBB.exe
  C:\Windows\System\oVnwlBB.exe
  2⤵
  PID:4536
- C:\Windows\System\YZHgobT.exe
  C:\Windows\System\YZHgobT.exe
  2⤵
  PID:5828
- C:\Windows\System\FktgPcQ.exe
  C:\Windows\System\FktgPcQ.exe
  2⤵
  PID:4772
- C:\Windows\System\HpBWfNK.exe
  C:\Windows\System\HpBWfNK.exe
  2⤵
  PID:5892
- C:\Windows\System\pDJnysH.exe
  C:\Windows\System\pDJnysH.exe
  2⤵
  PID:5988
- C:\Windows\System\aJYlUqy.exe
  C:\Windows\System\aJYlUqy.exe
  2⤵
  PID:4476
- C:\Windows\System\qaCJREt.exe
  C:\Windows\System\qaCJREt.exe
  2⤵
  PID:5012
- C:\Windows\System\wHxVtDq.exe
  C:\Windows\System\wHxVtDq.exe
  2⤵
  PID:4664
- C:\Windows\System\WsInXQH.exe
  C:\Windows\System\WsInXQH.exe
  2⤵
  PID:3168
- C:\Windows\System\vxUOFgn.exe
  C:\Windows\System\vxUOFgn.exe
  2⤵
  PID:6008
- C:\Windows\System\GNtvxWT.exe
  C:\Windows\System\GNtvxWT.exe
  2⤵
  PID:4868
- C:\Windows\System\EyHIRnA.exe
  C:\Windows\System\EyHIRnA.exe
  2⤵
  PID:5036
- C:\Windows\System\MTiPXeC.exe
  C:\Windows\System\MTiPXeC.exe
  2⤵
  PID:4008
- C:\Windows\System\ApEOySb.exe
  C:\Windows\System\ApEOySb.exe
  2⤵
  PID:5840
- C:\Windows\System\exrmudU.exe
  C:\Windows\System\exrmudU.exe
  2⤵
  PID:6104
- C:\Windows\System\IvCbnlj.exe
  C:\Windows\System\IvCbnlj.exe
  2⤵
  PID:4496
- C:\Windows\System\RsJlkZF.exe
  C:\Windows\System\RsJlkZF.exe
  2⤵
  PID:2352
- C:\Windows\System\MfXkYAq.exe
  C:\Windows\System\MfXkYAq.exe
  2⤵
  PID:4908
- C:\Windows\System\PayqnNO.exe
  C:\Windows\System\PayqnNO.exe
  2⤵
  PID:4796
- C:\Windows\System\uehJzBq.exe
  C:\Windows\System\uehJzBq.exe
  2⤵
  PID:5164
- C:\Windows\System\yrQxzBT.exe
  C:\Windows\System\yrQxzBT.exe
  2⤵
  PID:5400
- C:\Windows\System\UMkYLJo.exe
  C:\Windows\System\UMkYLJo.exe
  2⤵
  PID:5340
- C:\Windows\System\oIvsjLz.exe
  C:\Windows\System\oIvsjLz.exe
  2⤵
  PID:6032
- C:\Windows\System\iclhOKm.exe
  C:\Windows\System\iclhOKm.exe
  2⤵
  PID:5556
- C:\Windows\System\hVTAlWa.exe
  C:\Windows\System\hVTAlWa.exe
  2⤵
  PID:5296
- C:\Windows\System\nAJgqaR.exe
  C:\Windows\System\nAJgqaR.exe
  2⤵
  PID:5744
- C:\Windows\System\BFkejJH.exe
  C:\Windows\System\BFkejJH.exe
  2⤵
  PID:5092
- C:\Windows\System\EBDnjbJ.exe
  C:\Windows\System\EBDnjbJ.exe
  2⤵
  PID:2588
- C:\Windows\System\zrFhBcH.exe
  C:\Windows\System\zrFhBcH.exe
  2⤵
  PID:5764
- C:\Windows\System\DZkbzIU.exe
  C:\Windows\System\DZkbzIU.exe
  2⤵
  PID:5924
- C:\Windows\System\QAPdqhu.exe
  C:\Windows\System\QAPdqhu.exe
  2⤵
  PID:6116
- C:\Windows\System\UBnuTMW.exe
  C:\Windows\System\UBnuTMW.exe
  2⤵
  PID:6120
- C:\Windows\System\HDwwQHW.exe
  C:\Windows\System\HDwwQHW.exe
  2⤵
  PID:2792
- C:\Windows\System\ZmpqRVw.exe
  C:\Windows\System\ZmpqRVw.exe
  2⤵
  PID:5676
- C:\Windows\System\qeNjOyI.exe
  C:\Windows\System\qeNjOyI.exe
  2⤵
  PID:1448
- C:\Windows\System\QPFtMpx.exe
  C:\Windows\System\QPFtMpx.exe
  2⤵
  PID:5604
- C:\Windows\System\XTBlLYN.exe
  C:\Windows\System\XTBlLYN.exe
  2⤵
  PID:3432
- C:\Windows\System\mOGAYhf.exe
  C:\Windows\System\mOGAYhf.exe
  2⤵
  PID:5216
- C:\Windows\System\CyNQutj.exe
  C:\Windows\System\CyNQutj.exe
  2⤵
  PID:6080
- C:\Windows\System\qaLLKsv.exe
  C:\Windows\System\qaLLKsv.exe
  2⤵
  PID:1292
- C:\Windows\System\tetjksP.exe
  C:\Windows\System\tetjksP.exe
  2⤵
  PID:4236
- C:\Windows\System\tmGEkPo.exe
  C:\Windows\System\tmGEkPo.exe
  2⤵
  PID:4040
- C:\Windows\System\DIwHNlz.exe
  C:\Windows\System\DIwHNlz.exe
  2⤵
  PID:3912
- C:\Windows\System\hXRndaZ.exe
  C:\Windows\System\hXRndaZ.exe
  2⤵
  PID:5960
- C:\Windows\System\tinnKSf.exe
  C:\Windows\System\tinnKSf.exe
  2⤵
  PID:2820
- C:\Windows\System\ArOrtaq.exe
  C:\Windows\System\ArOrtaq.exe
  2⤵
  PID:5660
- C:\Windows\System\rdwhjff.exe
  C:\Windows\System\rdwhjff.exe
  2⤵
  PID:4860
- C:\Windows\System\LLKjhCK.exe
  C:\Windows\System\LLKjhCK.exe
  2⤵
  PID:5740
- C:\Windows\System\IOQHXuG.exe
  C:\Windows\System\IOQHXuG.exe
  2⤵
  PID:6156
- C:\Windows\System\jjYgzTx.exe
  C:\Windows\System\jjYgzTx.exe
  2⤵
  PID:6176
- C:\Windows\System\juNPiMW.exe
  C:\Windows\System\juNPiMW.exe
  2⤵
  PID:6208
- C:\Windows\System\RgFKEUk.exe
  C:\Windows\System\RgFKEUk.exe
  2⤵
  PID:6224
- C:\Windows\System\bOezbUa.exe
  C:\Windows\System\bOezbUa.exe
  2⤵
  PID:6240
- C:\Windows\System\yXAFJRJ.exe
  C:\Windows\System\yXAFJRJ.exe
  2⤵
  PID:6260
- C:\Windows\System\hAGNyWG.exe
  C:\Windows\System\hAGNyWG.exe
  2⤵
  PID:6276
- C:\Windows\System\gZPuUJB.exe
  C:\Windows\System\gZPuUJB.exe
  2⤵
  PID:6300
- C:\Windows\System\qHRXBUk.exe
  C:\Windows\System\qHRXBUk.exe
  2⤵
  PID:6316
- C:\Windows\System\ggkkNfo.exe
  C:\Windows\System\ggkkNfo.exe
  2⤵
  PID:6336
- C:\Windows\System\gBMwgky.exe
  C:\Windows\System\gBMwgky.exe
  2⤵
  PID:6352
- C:\Windows\System\lQezOwJ.exe
  C:\Windows\System\lQezOwJ.exe
  2⤵
  PID:6372
- C:\Windows\System\LsVQdIV.exe
  C:\Windows\System\LsVQdIV.exe
  2⤵
  PID:6404
- C:\Windows\System\ljwZZHe.exe
  C:\Windows\System\ljwZZHe.exe
  2⤵
  PID:6420
- C:\Windows\System\KkHfQzu.exe
  C:\Windows\System\KkHfQzu.exe
  2⤵
  PID:6440
- C:\Windows\System\ycNeZvG.exe
  C:\Windows\System\ycNeZvG.exe
  2⤵
  PID:6460
- C:\Windows\System\HoWFEnQ.exe
  C:\Windows\System\HoWFEnQ.exe
  2⤵
  PID:6476
- C:\Windows\System\uQRnOFU.exe
  C:\Windows\System\uQRnOFU.exe
  2⤵
  PID:6496
- C:\Windows\System\RaeWYlt.exe
  C:\Windows\System\RaeWYlt.exe
  2⤵
  PID:6520
- C:\Windows\System\buzCQQP.exe
  C:\Windows\System\buzCQQP.exe
  2⤵
  PID:6544
- C:\Windows\System\siucvuq.exe
  C:\Windows\System\siucvuq.exe
  2⤵
  PID:6560
- C:\Windows\System\VLWcTpT.exe
  C:\Windows\System\VLWcTpT.exe
  2⤵
  PID:6600
- C:\Windows\System\IEqmtBP.exe
  C:\Windows\System\IEqmtBP.exe
  2⤵
  PID:6616
- C:\Windows\System\dUyVCCw.exe
  C:\Windows\System\dUyVCCw.exe
  2⤵
  PID:6636
- C:\Windows\System\eNgOrWF.exe
  C:\Windows\System\eNgOrWF.exe
  2⤵
  PID:6652
- C:\Windows\System\wTBByEV.exe
  C:\Windows\System\wTBByEV.exe
  2⤵
  PID:6680
- C:\Windows\System\eRAqzgb.exe
  C:\Windows\System\eRAqzgb.exe
  2⤵
  PID:6696
- C:\Windows\System\mhLuZGq.exe
  C:\Windows\System\mhLuZGq.exe
  2⤵
  PID:6712
- C:\Windows\System\uusKGUj.exe
  C:\Windows\System\uusKGUj.exe
  2⤵
  PID:6732
- C:\Windows\System\aTmJziu.exe
  C:\Windows\System\aTmJziu.exe
  2⤵
  PID:6752
- C:\Windows\System\qJSXtIC.exe
  C:\Windows\System\qJSXtIC.exe
  2⤵
  PID:6772
- C:\Windows\System\dinIHhI.exe
  C:\Windows\System\dinIHhI.exe
  2⤵
  PID:6788
- C:\Windows\System\elmxWyK.exe
  C:\Windows\System\elmxWyK.exe
  2⤵
  PID:6808
- C:\Windows\System\HyRAkcI.exe
  C:\Windows\System\HyRAkcI.exe
  2⤵
  PID:6828
- C:\Windows\System\DtXLVxm.exe
  C:\Windows\System\DtXLVxm.exe
  2⤵
  PID:6844
- C:\Windows\System\hhVZRRD.exe
  C:\Windows\System\hhVZRRD.exe
  2⤵
  PID:6864
- C:\Windows\System\VewoAiG.exe
  C:\Windows\System\VewoAiG.exe
  2⤵
  PID:6888
- C:\Windows\System\NUDbphn.exe
  C:\Windows\System\NUDbphn.exe
  2⤵
  PID:6908
- C:\Windows\System\rWUPSOK.exe
  C:\Windows\System\rWUPSOK.exe
  2⤵
  PID:6932
- C:\Windows\System\uYwSanv.exe
  C:\Windows\System\uYwSanv.exe
  2⤵
  PID:6960
- C:\Windows\System\EHajlEz.exe
  C:\Windows\System\EHajlEz.exe
  2⤵
  PID:6976
- C:\Windows\System\JttMkgj.exe
  C:\Windows\System\JttMkgj.exe
  2⤵
  PID:6996
- C:\Windows\System\xlCfJCf.exe
  C:\Windows\System\xlCfJCf.exe
  2⤵
  PID:7016
- C:\Windows\System\LWKCscO.exe
  C:\Windows\System\LWKCscO.exe
  2⤵
  PID:7036
- C:\Windows\System\tTmwGNd.exe
  C:\Windows\System\tTmwGNd.exe
  2⤵
  PID:7052
- C:\Windows\System\aBmWiwk.exe
  C:\Windows\System\aBmWiwk.exe
  2⤵
  PID:7068
- C:\Windows\System\UqVCypN.exe
  C:\Windows\System\UqVCypN.exe
  2⤵
  PID:7092
- C:\Windows\System\MxIaXXT.exe
  C:\Windows\System\MxIaXXT.exe
  2⤵
  PID:7112
- C:\Windows\System\BpRJvKE.exe
  C:\Windows\System\BpRJvKE.exe
  2⤵
  PID:7128
- C:\Windows\System\UfOfFxy.exe
  C:\Windows\System\UfOfFxy.exe
  2⤵
  PID:7164
- C:\Windows\System\tochIof.exe
  C:\Windows\System\tochIof.exe
  2⤵
  PID:5312
- C:\Windows\System\MmGTwHG.exe
  C:\Windows\System\MmGTwHG.exe
  2⤵
  PID:5896
- C:\Windows\System\MMiECiZ.exe
  C:\Windows\System\MMiECiZ.exe
  2⤵
  PID:6216
- C:\Windows\System\AatpefO.exe
  C:\Windows\System\AatpefO.exe
  2⤵
  PID:6288
- C:\Windows\System\FCVgwlF.exe
  C:\Windows\System\FCVgwlF.exe
  2⤵
  PID:6284
- C:\Windows\System\LXpHctk.exe
  C:\Windows\System\LXpHctk.exe
  2⤵
  PID:6360
- C:\Windows\System\aoMMaVG.exe
  C:\Windows\System\aoMMaVG.exe
  2⤵
  PID:5444
- C:\Windows\System\lHsHaDU.exe
  C:\Windows\System\lHsHaDU.exe
  2⤵
  PID:1460
- C:\Windows\System\lujQyHB.exe
  C:\Windows\System\lujQyHB.exe
  2⤵
  PID:3964
- C:\Windows\System\CwqaNGZ.exe
  C:\Windows\System\CwqaNGZ.exe
  2⤵
  PID:3804
- C:\Windows\System\XxLrnFT.exe
  C:\Windows\System\XxLrnFT.exe
  2⤵
  PID:5160
- C:\Windows\System\iKTvQTY.exe
  C:\Windows\System\iKTvQTY.exe
  2⤵
  PID:1940
- C:\Windows\System\aUIGKaD.exe
  C:\Windows\System\aUIGKaD.exe
  2⤵
  PID:6412
- C:\Windows\System\pQLrUyk.exe
  C:\Windows\System\pQLrUyk.exe
  2⤵
  PID:6456
- C:\Windows\System\MxTjUId.exe
  C:\Windows\System\MxTjUId.exe
  2⤵
  PID:6528
- C:\Windows\System\coCiNaE.exe
  C:\Windows\System\coCiNaE.exe
  2⤵
  PID:6188
- C:\Windows\System\HJIlJCC.exe
  C:\Windows\System\HJIlJCC.exe
  2⤵
  PID:3856
- C:\Windows\System\ZtAJPit.exe
  C:\Windows\System\ZtAJPit.exe
  2⤵
  PID:1560
- C:\Windows\System\DknxvYC.exe
  C:\Windows\System\DknxvYC.exe
  2⤵
  PID:5532
- C:\Windows\System\lCrLJQV.exe
  C:\Windows\System\lCrLJQV.exe
  2⤵
  PID:2548
- C:\Windows\System\uzqTWoO.exe
  C:\Windows\System\uzqTWoO.exe
  2⤵
  PID:2520
- C:\Windows\System\UeUsUrY.exe
  C:\Windows\System\UeUsUrY.exe
  2⤵
  PID:6236
- C:\Windows\System\GqfMbKO.exe
  C:\Windows\System\GqfMbKO.exe
  2⤵
  PID:6344
- C:\Windows\System\YkpwfZQ.exe
  C:\Windows\System\YkpwfZQ.exe
  2⤵
  PID:6384
- C:\Windows\System\lUHUpcP.exe
  C:\Windows\System\lUHUpcP.exe
  2⤵
  PID:6436
- C:\Windows\System\ywOycFh.exe
  C:\Windows\System\ywOycFh.exe
  2⤵
  PID:6508
- C:\Windows\System\FNBMOTq.exe
  C:\Windows\System\FNBMOTq.exe
  2⤵
  PID:6552
- C:\Windows\System\PHQVUMl.exe
  C:\Windows\System\PHQVUMl.exe
  2⤵
  PID:6668
- C:\Windows\System\FSSBXDW.exe
  C:\Windows\System\FSSBXDW.exe
  2⤵
  PID:6704
- C:\Windows\System\YCGNMSk.exe
  C:\Windows\System\YCGNMSk.exe
  2⤵
  PID:6608
- C:\Windows\System\ASsiniE.exe
  C:\Windows\System\ASsiniE.exe
  2⤵
  PID:6632
- C:\Windows\System\JeVJoki.exe
  C:\Windows\System\JeVJoki.exe
  2⤵
  PID:6824
- C:\Windows\System\wpfRLkT.exe
  C:\Windows\System\wpfRLkT.exe
  2⤵
  PID:6896
- C:\Windows\System\gvDnuRg.exe
  C:\Windows\System\gvDnuRg.exe
  2⤵
  PID:6724
- C:\Windows\System\ueAmRbn.exe
  C:\Windows\System\ueAmRbn.exe
  2⤵
  PID:6940
- C:\Windows\System\RZZIsnX.exe
  C:\Windows\System\RZZIsnX.exe
  2⤵
  PID:6836
- C:\Windows\System\IMNQqXG.exe
  C:\Windows\System\IMNQqXG.exe
  2⤵
  PID:6884
- C:\Windows\System\WGDuYUZ.exe
  C:\Windows\System\WGDuYUZ.exe
  2⤵
  PID:6952
- C:\Windows\System\PoeRbWg.exe
  C:\Windows\System\PoeRbWg.exe
  2⤵
  PID:6968
- C:\Windows\System\PQAkvpg.exe
  C:\Windows\System\PQAkvpg.exe
  2⤵
  PID:7028
- C:\Windows\System\NRXbXRz.exe
  C:\Windows\System\NRXbXRz.exe
  2⤵
  PID:7044
- C:\Windows\System\aqVlJyM.exe
  C:\Windows\System\aqVlJyM.exe
  2⤵
  PID:7088
- C:\Windows\System\PWmvTEz.exe
  C:\Windows\System\PWmvTEz.exe
  2⤵
  PID:7104
- C:\Windows\System\gvAuudY.exe
  C:\Windows\System\gvAuudY.exe
  2⤵
  PID:7124
- C:\Windows\System\jAyEETF.exe
  C:\Windows\System\jAyEETF.exe
  2⤵
  PID:7140
- C:\Windows\System\VOlnExU.exe
  C:\Windows\System\VOlnExU.exe
  2⤵
  PID:6220
- C:\Windows\System\BceFbNc.exe
  C:\Windows\System\BceFbNc.exe
  2⤵
  PID:6140
- C:\Windows\System\gAbhoBT.exe
  C:\Windows\System\gAbhoBT.exe
  2⤵
  PID:6536
- C:\Windows\System\nNhexRe.exe
  C:\Windows\System\nNhexRe.exe
  2⤵
  PID:6148
- C:\Windows\System\hUgRSdb.exe
  C:\Windows\System\hUgRSdb.exe
  2⤵
  PID:6388
- C:\Windows\System\LvBVSSz.exe
  C:\Windows\System\LvBVSSz.exe
  2⤵
  PID:6628
- C:\Windows\System\zFLwcEw.exe
  C:\Windows\System\zFLwcEw.exe
  2⤵
  PID:6816
- C:\Windows\System\seUfQzi.exe
  C:\Windows\System\seUfQzi.exe
  2⤵
  PID:6764
- C:\Windows\System\mhrsLya.exe
  C:\Windows\System\mhrsLya.exe
  2⤵
  PID:6920
- C:\Windows\System\hhDiBId.exe
  C:\Windows\System\hhDiBId.exe
  2⤵
  PID:7008
- C:\Windows\System\jpIcqyx.exe
  C:\Windows\System\jpIcqyx.exe
  2⤵
  PID:7076
- C:\Windows\System\wepKxVS.exe
  C:\Windows\System\wepKxVS.exe
  2⤵
  PID:6252
- C:\Windows\System\nqkVxxU.exe
  C:\Windows\System\nqkVxxU.exe
  2⤵
  PID:6200
- C:\Windows\System\LQgNJNV.exe
  C:\Windows\System\LQgNJNV.exe
  2⤵
  PID:6232
- C:\Windows\System\NCNrDGK.exe
  C:\Windows\System\NCNrDGK.exe
  2⤵
  PID:6804
- C:\Windows\System\mcaUlmr.exe
  C:\Windows\System\mcaUlmr.exe
  2⤵
  PID:6328
- C:\Windows\System\QZJLmxO.exe
  C:\Windows\System\QZJLmxO.exe
  2⤵
  PID:7184
- C:\Windows\System\MnlhhOG.exe
  C:\Windows\System\MnlhhOG.exe
  2⤵
  PID:7204
- C:\Windows\System\UyKPpzc.exe
  C:\Windows\System\UyKPpzc.exe
  2⤵
  PID:7220
- C:\Windows\System\UIIavdR.exe
  C:\Windows\System\UIIavdR.exe
  2⤵
  PID:7240
- C:\Windows\System\KpFZfKQ.exe
  C:\Windows\System\KpFZfKQ.exe
  2⤵
  PID:7264
- C:\Windows\System\IXYinjM.exe
  C:\Windows\System\IXYinjM.exe
  2⤵
  PID:7280
- C:\Windows\System\xIwpyBb.exe
  C:\Windows\System\xIwpyBb.exe
  2⤵
  PID:7300
- C:\Windows\System\ZskLSWA.exe
  C:\Windows\System\ZskLSWA.exe
  2⤵
  PID:7320
- C:\Windows\System\fShqHwg.exe
  C:\Windows\System\fShqHwg.exe
  2⤵
  PID:7340
- C:\Windows\System\QBWtsjR.exe
  C:\Windows\System\QBWtsjR.exe
  2⤵
  PID:7356
- C:\Windows\System\CwtPjFh.exe
  C:\Windows\System\CwtPjFh.exe
  2⤵
  PID:7376
- C:\Windows\System\eSLcxjV.exe
  C:\Windows\System\eSLcxjV.exe
  2⤵
  PID:7392
- C:\Windows\System\NRuItzV.exe
  C:\Windows\System\NRuItzV.exe
  2⤵
  PID:7408
- C:\Windows\System\QCHucXT.exe
  C:\Windows\System\QCHucXT.exe
  2⤵
  PID:7428
- C:\Windows\System\XbXaoXm.exe
  C:\Windows\System\XbXaoXm.exe
  2⤵
  PID:7448
- C:\Windows\System\mTSnIGw.exe
  C:\Windows\System\mTSnIGw.exe
  2⤵
  PID:7468
- C:\Windows\System\bPlNoBJ.exe
  C:\Windows\System\bPlNoBJ.exe
  2⤵
  PID:7484
- C:\Windows\System\VwsfWLS.exe
  C:\Windows\System\VwsfWLS.exe
  2⤵
  PID:7504
- C:\Windows\System\NbLBPaD.exe
  C:\Windows\System\NbLBPaD.exe
  2⤵
  PID:7524
- C:\Windows\System\mKEymPR.exe
  C:\Windows\System\mKEymPR.exe
  2⤵
  PID:7540
- C:\Windows\System\yZKvaOu.exe
  C:\Windows\System\yZKvaOu.exe
  2⤵
  PID:7560
- C:\Windows\System\kjgdAsA.exe
  C:\Windows\System\kjgdAsA.exe
  2⤵
  PID:7576
- C:\Windows\System\ElbsbPU.exe
  C:\Windows\System\ElbsbPU.exe
  2⤵
  PID:7596
- C:\Windows\System\jhxFzbK.exe
  C:\Windows\System\jhxFzbK.exe
  2⤵
  PID:7636
- C:\Windows\System\EwBIzIX.exe
  C:\Windows\System\EwBIzIX.exe
  2⤵
  PID:7656
- C:\Windows\System\slIVkIw.exe
  C:\Windows\System\slIVkIw.exe
  2⤵
  PID:7672
- C:\Windows\System\ajJABAx.exe
  C:\Windows\System\ajJABAx.exe
  2⤵
  PID:7692
- C:\Windows\System\TzyaccP.exe
  C:\Windows\System\TzyaccP.exe
  2⤵
  PID:7708
- C:\Windows\System\pAaSUzp.exe
  C:\Windows\System\pAaSUzp.exe
  2⤵
  PID:7728
- C:\Windows\System\TCNGxhW.exe
  C:\Windows\System\TCNGxhW.exe
  2⤵
  PID:7744
- C:\Windows\System\aNpvewP.exe
  C:\Windows\System\aNpvewP.exe
  2⤵
  PID:7764
- C:\Windows\System\uIIDrhk.exe
  C:\Windows\System\uIIDrhk.exe
  2⤵
  PID:7784
- C:\Windows\System\WJrlpYt.exe
  C:\Windows\System\WJrlpYt.exe
  2⤵
  PID:7804
- C:\Windows\System\yMFHuLI.exe
  C:\Windows\System\yMFHuLI.exe
  2⤵
  PID:7820
- C:\Windows\System\SPUYBYc.exe
  C:\Windows\System\SPUYBYc.exe
  2⤵
  PID:7840
- C:\Windows\System\ixBvXbV.exe
  C:\Windows\System\ixBvXbV.exe
  2⤵
  PID:7860
- C:\Windows\System\zfJrfeO.exe
  C:\Windows\System\zfJrfeO.exe
  2⤵
  PID:7880
- C:\Windows\System\oPizoMv.exe
  C:\Windows\System\oPizoMv.exe
  2⤵
  PID:7956
- C:\Windows\System\sRIPPgK.exe
  C:\Windows\System\sRIPPgK.exe
  2⤵
  PID:7984
- C:\Windows\System\xsrueDl.exe
  C:\Windows\System\xsrueDl.exe
  2⤵
  PID:8000
- C:\Windows\System\bFoaIJg.exe
  C:\Windows\System\bFoaIJg.exe
  2⤵
  PID:8020
- C:\Windows\System\ibEIDvH.exe
  C:\Windows\System\ibEIDvH.exe
  2⤵
  PID:8040
- C:\Windows\System\TkqXIMz.exe
  C:\Windows\System\TkqXIMz.exe
  2⤵
  PID:8060
- C:\Windows\System\VXQhoFo.exe
  C:\Windows\System\VXQhoFo.exe
  2⤵
  PID:8084
- C:\Windows\System\LLlnBXS.exe
  C:\Windows\System\LLlnBXS.exe
  2⤵
  PID:8104
- C:\Windows\System\UOkXqci.exe
  C:\Windows\System\UOkXqci.exe
  2⤵
  PID:8124
- C:\Windows\System\RFAVXzd.exe
  C:\Windows\System\RFAVXzd.exe
  2⤵
  PID:8140
- C:\Windows\System\nqmpuww.exe
  C:\Windows\System\nqmpuww.exe
  2⤵
  PID:8160
- C:\Windows\System\MfYwwMG.exe
  C:\Windows\System\MfYwwMG.exe
  2⤵
  PID:8184
- C:\Windows\System\hyltpJL.exe
  C:\Windows\System\hyltpJL.exe
  2⤵
  PID:7180
- C:\Windows\System\nZmODgz.exe
  C:\Windows\System\nZmODgz.exe
  2⤵
  PID:7248
- C:\Windows\System\SGfcfbU.exe
  C:\Windows\System\SGfcfbU.exe
  2⤵
  PID:7332
- C:\Windows\System\oyNqTbg.exe
  C:\Windows\System\oyNqTbg.exe
  2⤵
  PID:7404
- C:\Windows\System\xYnkTCj.exe
  C:\Windows\System\xYnkTCj.exe
  2⤵
  PID:7520
- C:\Windows\System\DjAHhOp.exe
  C:\Windows\System\DjAHhOp.exe
  2⤵
  PID:7588
- C:\Windows\System\viDXidm.exe
  C:\Windows\System\viDXidm.exe
  2⤵
  PID:1432
- C:\Windows\System\ZzfCrhs.exe
  C:\Windows\System\ZzfCrhs.exe
  2⤵
  PID:6296
- C:\Windows\System\LVvhcZf.exe
  C:\Windows\System\LVvhcZf.exe
  2⤵
  PID:7652
- C:\Windows\System\YgpFTuB.exe
  C:\Windows\System\YgpFTuB.exe
  2⤵
  PID:7720
- C:\Windows\System\MMgDzwI.exe
  C:\Windows\System\MMgDzwI.exe
  2⤵
  PID:7796
- C:\Windows\System\VqAIOoX.exe
  C:\Windows\System\VqAIOoX.exe
  2⤵
  PID:7832
- C:\Windows\System\pTrwZZU.exe
  C:\Windows\System\pTrwZZU.exe
  2⤵
  PID:7964
- C:\Windows\System\XgsdRsg.exe
  C:\Windows\System\XgsdRsg.exe
  2⤵
  PID:6796
- C:\Windows\System\lltusIv.exe
  C:\Windows\System\lltusIv.exe
  2⤵
  PID:6948
- C:\Windows\System\APOfBzg.exe
  C:\Windows\System\APOfBzg.exe
  2⤵
  PID:8012
- C:\Windows\System\FRTfISs.exe
  C:\Windows\System\FRTfISs.exe
  2⤵
  PID:8048
- C:\Windows\System\OVsNAZO.exe
  C:\Windows\System\OVsNAZO.exe
  2⤵
  PID:6568
- C:\Windows\System\ScwFRBe.exe
  C:\Windows\System\ScwFRBe.exe
  2⤵
  PID:4776
- C:\Windows\System\eGDISOf.exe
  C:\Windows\System\eGDISOf.exe
  2⤵
  PID:6272
- C:\Windows\System\sSfuxjt.exe
  C:\Windows\System\sSfuxjt.exe
  2⤵
  PID:6400
- C:\Windows\System\ZyjrXyX.exe
  C:\Windows\System\ZyjrXyX.exe
  2⤵
  PID:6592
- C:\Windows\System\vZRnwbw.exe
  C:\Windows\System\vZRnwbw.exe
  2⤵
  PID:6784
- C:\Windows\System\UNdSjri.exe
  C:\Windows\System\UNdSjri.exe
  2⤵
  PID:6856
- C:\Windows\System\XSbGpOg.exe
  C:\Windows\System\XSbGpOg.exe
  2⤵
  PID:7100
- C:\Windows\System\dgQaTMe.exe
  C:\Windows\System\dgQaTMe.exe
  2⤵
  PID:6132
- C:\Windows\System\LCouJak.exe
  C:\Windows\System\LCouJak.exe
  2⤵
  PID:6504
- C:\Windows\System\JikWdYe.exe
  C:\Windows\System\JikWdYe.exe
  2⤵
  PID:6744
- C:\Windows\System\gvAXkIF.exe
  C:\Windows\System\gvAXkIF.exe
  2⤵
  PID:6944
- C:\Windows\System\wJNiRPd.exe
  C:\Windows\System\wJNiRPd.exe
  2⤵
  PID:5168
- C:\Windows\System\ssrwyMJ.exe
  C:\Windows\System\ssrwyMJ.exe
  2⤵
  PID:1592
- C:\Windows\System\FDMpyAt.exe
  C:\Windows\System\FDMpyAt.exe
  2⤵
  PID:7228
- C:\Windows\System\UqIXLPb.exe
  C:\Windows\System\UqIXLPb.exe
  2⤵
  PID:6060
- C:\Windows\System\lVSQAHi.exe
  C:\Windows\System\lVSQAHi.exe
  2⤵
  PID:7604
- C:\Windows\System\ebAIkju.exe
  C:\Windows\System\ebAIkju.exe
  2⤵
  PID:7620
- C:\Windows\System\RlnWxyP.exe
  C:\Windows\System\RlnWxyP.exe
  2⤵
  PID:7664
- C:\Windows\System\TbCzjjl.exe
  C:\Windows\System\TbCzjjl.exe
  2⤵
  PID:7704
- C:\Windows\System\vOgmDUS.exe
  C:\Windows\System\vOgmDUS.exe
  2⤵
  PID:7776
- C:\Windows\System\HeXWOXP.exe
  C:\Windows\System\HeXWOXP.exe
  2⤵
  PID:7848
- C:\Windows\System\bWzKTJc.exe
  C:\Windows\System\bWzKTJc.exe
  2⤵
  PID:7888
- C:\Windows\System\rXXeSoX.exe
  C:\Windows\System\rXXeSoX.exe
  2⤵
  PID:7908
- C:\Windows\System\leshisX.exe
  C:\Windows\System\leshisX.exe
  2⤵
  PID:7924
- C:\Windows\System\oYpeheS.exe
  C:\Windows\System\oYpeheS.exe
  2⤵
  PID:7940
- C:\Windows\System\qrrNdaG.exe
  C:\Windows\System\qrrNdaG.exe
  2⤵
  PID:7992
- C:\Windows\System\JRyjSap.exe
  C:\Windows\System\JRyjSap.exe
  2⤵
  PID:8068
- C:\Windows\System\kwDKhbQ.exe
  C:\Windows\System\kwDKhbQ.exe
  2⤵
  PID:8112
- C:\Windows\System\kwImmHp.exe
  C:\Windows\System\kwImmHp.exe
  2⤵
  PID:8168
- C:\Windows\System\vqVIDxc.exe
  C:\Windows\System\vqVIDxc.exe
  2⤵
  PID:7212
- C:\Windows\System\tplIsYh.exe
  C:\Windows\System\tplIsYh.exe
  2⤵
  PID:7372
- C:\Windows\System\FvSsiFn.exe
  C:\Windows\System\FvSsiFn.exe
  2⤵
  PID:7368
- C:\Windows\System\geoHpVl.exe
  C:\Windows\System\geoHpVl.exe
  2⤵
  PID:7556
- C:\Windows\System\AuvkflB.exe
  C:\Windows\System\AuvkflB.exe
  2⤵
  PID:7476
- C:\Windows\System\GhhmyjW.exe
  C:\Windows\System\GhhmyjW.exe
  2⤵
  PID:6292
- C:\Windows\System\SOcMnRL.exe
  C:\Windows\System\SOcMnRL.exe
  2⤵
  PID:7828
- C:\Windows\System\EnkMeTx.exe
  C:\Windows\System\EnkMeTx.exe
  2⤵
  PID:6904
- C:\Windows\System\nJenxlK.exe
  C:\Windows\System\nJenxlK.exe
  2⤵
  PID:6992
- C:\Windows\System\PBgwCpv.exe
  C:\Windows\System\PBgwCpv.exe
  2⤵
  PID:8008
- C:\Windows\System\sMGHYfX.exe
  C:\Windows\System\sMGHYfX.exe
  2⤵
  PID:8056
- C:\Windows\System\rmISTUV.exe
  C:\Windows\System\rmISTUV.exe
  2⤵
  PID:7440
- C:\Windows\System\WyJlsuB.exe
  C:\Windows\System\WyJlsuB.exe
  2⤵
  PID:7516
- C:\Windows\System\URcBqPr.exe
  C:\Windows\System\URcBqPr.exe
  2⤵
  PID:6172
- C:\Windows\System\eHHnuYY.exe
  C:\Windows\System\eHHnuYY.exe
  2⤵
  PID:7760
- C:\Windows\System\nbgiUKo.exe
  C:\Windows\System\nbgiUKo.exe
  2⤵
  PID:6876
- C:\Windows\System\oaTzUlD.exe
  C:\Windows\System\oaTzUlD.exe
  2⤵
  PID:7080
- C:\Windows\System\jEKhhte.exe
  C:\Windows\System\jEKhhte.exe
  2⤵
  PID:1516
- C:\Windows\System\PFtsivH.exe
  C:\Windows\System\PFtsivH.exe
  2⤵
  PID:7156
- C:\Windows\System\BdxnCFQ.exe
  C:\Windows\System\BdxnCFQ.exe
  2⤵
  PID:7236
- C:\Windows\System\TLFDMyC.exe
  C:\Windows\System\TLFDMyC.exe
  2⤵
  PID:7308
- C:\Windows\System\vmFGcsl.exe
  C:\Windows\System\vmFGcsl.exe
  2⤵
  PID:7200
- C:\Windows\System\sSFEnDP.exe
  C:\Windows\System\sSFEnDP.exe
  2⤵
  PID:7456
- C:\Windows\System\DJkXknc.exe
  C:\Windows\System\DJkXknc.exe
  2⤵
  PID:2304
- C:\Windows\System\EufFTzE.exe
  C:\Windows\System\EufFTzE.exe
  2⤵
  PID:7700
- C:\Windows\System\ftOlojm.exe
  C:\Windows\System\ftOlojm.exe
  2⤵
  PID:7632
- C:\Windows\System\SaZFZfx.exe
  C:\Windows\System\SaZFZfx.exe
  2⤵
  PID:7916
- C:\Windows\System\uzYPWiQ.exe
  C:\Windows\System\uzYPWiQ.exe
  2⤵
  PID:8080
- C:\Windows\System\UsvImHW.exe
  C:\Windows\System\UsvImHW.exe
  2⤵
  PID:8120
- C:\Windows\System\yePKOve.exe
  C:\Windows\System\yePKOve.exe
  2⤵
  PID:7328
- C:\Windows\System\IUIydtw.exe
  C:\Windows\System\IUIydtw.exe
  2⤵
  PID:7644
- C:\Windows\System\HJnFrfH.exe
  C:\Windows\System\HJnFrfH.exe
  2⤵
  PID:7216
- C:\Windows\System\jutBKTF.exe
  C:\Windows\System\jutBKTF.exe
  2⤵
  PID:8032
- C:\Windows\System\flbIJZk.exe
  C:\Windows\System\flbIJZk.exe
  2⤵
  PID:6364
- C:\Windows\System\GHqWbhd.exe
  C:\Windows\System\GHqWbhd.exe
  2⤵
  PID:7872
- C:\Windows\System\ECdynpp.exe
  C:\Windows\System\ECdynpp.exe
  2⤵
  PID:6368
- C:\Windows\System\PnoDgba.exe
  C:\Windows\System\PnoDgba.exe
  2⤵
  PID:4208
- C:\Windows\System\DXijRSF.exe
  C:\Windows\System\DXijRSF.exe
  2⤵
  PID:5440
- C:\Windows\System\qFTbaeF.exe
  C:\Windows\System\qFTbaeF.exe
  2⤵
  PID:3916
- C:\Windows\System\XWtHOXI.exe
  C:\Windows\System\XWtHOXI.exe
  2⤵
  PID:6516
- C:\Windows\System\kaFpSFM.exe
  C:\Windows\System\kaFpSFM.exe
  2⤵
  PID:4920
- C:\Windows\System\ZpuEWXw.exe
  C:\Windows\System\ZpuEWXw.exe
  2⤵
  PID:6860
- C:\Windows\System\hnpJXQg.exe
  C:\Windows\System\hnpJXQg.exe
  2⤵
  PID:7752
- C:\Windows\System\gnJeGdq.exe
  C:\Windows\System\gnJeGdq.exe
  2⤵
  PID:7312
- C:\Windows\System\idUNIcn.exe
  C:\Windows\System\idUNIcn.exe
  2⤵
  PID:7352
- C:\Windows\System\JyapJMl.exe
  C:\Windows\System\JyapJMl.exe
  2⤵
  PID:7416
- C:\Windows\System\dnHgtKQ.exe
  C:\Windows\System\dnHgtKQ.exe
  2⤵
  PID:7420
- C:\Windows\System\cFmeEyo.exe
  C:\Windows\System\cFmeEyo.exe
  2⤵
  PID:7892
- C:\Windows\System\iIsjatL.exe
  C:\Windows\System\iIsjatL.exe
  2⤵
  PID:580
- C:\Windows\System\tHmzIYE.exe
  C:\Windows\System\tHmzIYE.exe
  2⤵
  PID:7952
- C:\Windows\System\uvQwZlX.exe
  C:\Windows\System\uvQwZlX.exe
  2⤵
  PID:7012
- C:\Windows\System\JmJQoGW.exe
  C:\Windows\System\JmJQoGW.exe
  2⤵
  PID:8028
- C:\Windows\System\qHqADTy.exe
  C:\Windows\System\qHqADTy.exe
  2⤵
  PID:6740
- C:\Windows\System\vYAjTxh.exe
  C:\Windows\System\vYAjTxh.exe
  2⤵
  PID:7976
- C:\Windows\System\ZcxqsZS.exe
  C:\Windows\System\ZcxqsZS.exe
  2⤵
  PID:7444
- C:\Windows\System\cuIgmRF.exe
  C:\Windows\System\cuIgmRF.exe
  2⤵
  PID:5844
- C:\Windows\System\WyeSdYI.exe
  C:\Windows\System\WyeSdYI.exe
  2⤵
  PID:2744
- C:\Windows\System\ghBgvgq.exe
  C:\Windows\System\ghBgvgq.exe
  2⤵
  PID:6432
- C:\Windows\System\GkBNbaB.exe
  C:\Windows\System\GkBNbaB.exe
  2⤵
  PID:2448
- C:\Windows\System\QxOxnTM.exe
  C:\Windows\System\QxOxnTM.exe
  2⤵
  PID:3660
- C:\Windows\System\stUoxvT.exe
  C:\Windows\System\stUoxvT.exe
  2⤵
  PID:7196
- C:\Windows\System\mBIBRuy.exe
  C:\Windows\System\mBIBRuy.exe
  2⤵
  PID:1976
- C:\Windows\System\pAZsyeX.exe
  C:\Windows\System\pAZsyeX.exe
  2⤵
  PID:7500
- C:\Windows\System\gLooQDs.exe
  C:\Windows\System\gLooQDs.exe
  2⤵
  PID:7772
- C:\Windows\System\wHEJzVS.exe
  C:\Windows\System\wHEJzVS.exe
  2⤵
  PID:7592
- C:\Windows\System\CBXBJzT.exe
  C:\Windows\System\CBXBJzT.exe
  2⤵
  PID:2628
- C:\Windows\System\VDznXwS.exe
  C:\Windows\System\VDznXwS.exe
  2⤵
  PID:6312
- C:\Windows\System\iwHNoSX.exe
  C:\Windows\System\iwHNoSX.exe
  2⤵
  PID:2068
- C:\Windows\System\iULhAcV.exe
  C:\Windows\System\iULhAcV.exe
  2⤵
  PID:1884
- C:\Windows\System\gAFvEOv.exe
  C:\Windows\System\gAFvEOv.exe
  2⤵
  PID:2940
- C:\Windows\System\IctfEsD.exe
  C:\Windows\System\IctfEsD.exe
  2⤵
  PID:7400
- C:\Windows\System\ApnKlRq.exe
  C:\Windows\System\ApnKlRq.exe
  2⤵
  PID:4612
- C:\Windows\System\LGhzAxz.exe
  C:\Windows\System\LGhzAxz.exe
  2⤵
  PID:2616
- C:\Windows\System\xOLXdIo.exe
  C:\Windows\System\xOLXdIo.exe
  2⤵
  PID:3632
- C:\Windows\System\AmNqEAX.exe
  C:\Windows\System\AmNqEAX.exe
  2⤵
  PID:7424
- C:\Windows\System\WKupfuc.exe
  C:\Windows\System\WKupfuc.exe
  2⤵
  PID:2844
- C:\Windows\System\uxjgDFx.exe
  C:\Windows\System\uxjgDFx.exe
  2⤵
  PID:3648
- C:\Windows\System\pIXVIpL.exe
  C:\Windows\System\pIXVIpL.exe
  2⤵
  PID:7336
- C:\Windows\System\KSwiScS.exe
  C:\Windows\System\KSwiScS.exe
  2⤵
  PID:7968
- C:\Windows\System\CjdTmlY.exe
  C:\Windows\System\CjdTmlY.exe
  2⤵
  PID:7856
- C:\Windows\System\fJuEDmm.exe
  C:\Windows\System\fJuEDmm.exe
  2⤵
  PID:7572
- C:\Windows\System\HMdlujW.exe
  C:\Windows\System\HMdlujW.exe
  2⤵
  PID:8200
- C:\Windows\System\BcKZhAv.exe
  C:\Windows\System\BcKZhAv.exe
  2⤵
  PID:8220
- C:\Windows\System\cUBdzCw.exe
  C:\Windows\System\cUBdzCw.exe
  2⤵
  PID:8236
- C:\Windows\System\djDHsax.exe
  C:\Windows\System\djDHsax.exe
  2⤵
  PID:8252
- C:\Windows\System\gmnFoKa.exe
  C:\Windows\System\gmnFoKa.exe
  2⤵
  PID:8272
- C:\Windows\System\EuKAnzh.exe
  C:\Windows\System\EuKAnzh.exe
  2⤵
  PID:8292
- C:\Windows\System\JHMzFTu.exe
  C:\Windows\System\JHMzFTu.exe
  2⤵
  PID:8308
- C:\Windows\System\njoeSIg.exe
  C:\Windows\System\njoeSIg.exe
  2⤵
  PID:8324
- C:\Windows\System\dPrYqjK.exe
  C:\Windows\System\dPrYqjK.exe
  2⤵
  PID:8340
- C:\Windows\System\SnAdmRV.exe
  C:\Windows\System\SnAdmRV.exe
  2⤵
  PID:8356
- C:\Windows\System\ZDZwvuT.exe
  C:\Windows\System\ZDZwvuT.exe
  2⤵
  PID:8372
- C:\Windows\System\RGhrOEC.exe
  C:\Windows\System\RGhrOEC.exe
  2⤵
  PID:8388
- C:\Windows\System\jGDxmVb.exe
  C:\Windows\System\jGDxmVb.exe
  2⤵
  PID:8420
- C:\Windows\System\mJpxvha.exe
  C:\Windows\System\mJpxvha.exe
  2⤵
  PID:8444
- C:\Windows\System\OYDrBXT.exe
  C:\Windows\System\OYDrBXT.exe
  2⤵
  PID:8464
- C:\Windows\System\KezkdTw.exe
  C:\Windows\System\KezkdTw.exe
  2⤵
  PID:8500
- C:\Windows\System\nUDZDUE.exe
  C:\Windows\System\nUDZDUE.exe
  2⤵
  PID:8516
- C:\Windows\System\bIJnqml.exe
  C:\Windows\System\bIJnqml.exe
  2⤵
  PID:8536
- C:\Windows\System\aAihgvr.exe
  C:\Windows\System\aAihgvr.exe
  2⤵
  PID:8552
- C:\Windows\System\SDfxeNV.exe
  C:\Windows\System\SDfxeNV.exe
  2⤵
  PID:8568
- C:\Windows\System\HVyzvQI.exe
  C:\Windows\System\HVyzvQI.exe
  2⤵
  PID:8584
- C:\Windows\System\SewpitW.exe
  C:\Windows\System\SewpitW.exe
  2⤵
  PID:8600
- C:\Windows\System\clPrXLl.exe
  C:\Windows\System\clPrXLl.exe
  2⤵
  PID:8616
- C:\Windows\System\bIvqmCn.exe
  C:\Windows\System\bIvqmCn.exe
  2⤵
  PID:8632
- C:\Windows\System\MQICTUZ.exe
  C:\Windows\System\MQICTUZ.exe
  2⤵
  PID:8648
- C:\Windows\System\cRSxvGT.exe
  C:\Windows\System\cRSxvGT.exe
  2⤵
  PID:8664
- C:\Windows\System\gmXAWjT.exe
  C:\Windows\System\gmXAWjT.exe
  2⤵
  PID:8680
- C:\Windows\System\ODwHXMR.exe
  C:\Windows\System\ODwHXMR.exe
  2⤵
  PID:8696
- C:\Windows\System\wigGoEw.exe
  C:\Windows\System\wigGoEw.exe
  2⤵
  PID:8712
- C:\Windows\System\lvhVyHx.exe
  C:\Windows\System\lvhVyHx.exe
  2⤵
  PID:8728
- C:\Windows\System\dBIfJqe.exe
  C:\Windows\System\dBIfJqe.exe
  2⤵
  PID:8744
- C:\Windows\System\bSkzPGc.exe
  C:\Windows\System\bSkzPGc.exe
  2⤵
  PID:8760
- C:\Windows\System\MPzUwXO.exe
  C:\Windows\System\MPzUwXO.exe
  2⤵
  PID:8832
- C:\Windows\System\IEIDxoA.exe
  C:\Windows\System\IEIDxoA.exe
  2⤵
  PID:8856
- C:\Windows\System\LOTfGIJ.exe
  C:\Windows\System\LOTfGIJ.exe
  2⤵
  PID:8880
- C:\Windows\System\sNULdOQ.exe
  C:\Windows\System\sNULdOQ.exe
  2⤵
  PID:8900
- C:\Windows\System\yODWFCT.exe
  C:\Windows\System\yODWFCT.exe
  2⤵
  PID:8924
- C:\Windows\System\bSnhPZJ.exe
  C:\Windows\System\bSnhPZJ.exe
  2⤵
  PID:8948
- C:\Windows\System\uCLTRDX.exe
  C:\Windows\System\uCLTRDX.exe
  2⤵
  PID:8964
- C:\Windows\System\UfJJUDT.exe
  C:\Windows\System\UfJJUDT.exe
  2⤵
  PID:8984
- C:\Windows\System\ChuWTyi.exe
  C:\Windows\System\ChuWTyi.exe
  2⤵
  PID:9020
- C:\Windows\System\VplCQMA.exe
  C:\Windows\System\VplCQMA.exe
  2⤵
  PID:9036
- C:\Windows\System\kwbVecU.exe
  C:\Windows\System\kwbVecU.exe
  2⤵
  PID:9052
- C:\Windows\System\zObotMy.exe
  C:\Windows\System\zObotMy.exe
  2⤵
  PID:9068
- C:\Windows\System\DGqaJxa.exe
  C:\Windows\System\DGqaJxa.exe
  2⤵
  PID:9084
- C:\Windows\System\KRYcAbF.exe
  C:\Windows\System\KRYcAbF.exe
  2⤵
  PID:9100
- C:\Windows\System\ueJWakf.exe
  C:\Windows\System\ueJWakf.exe
  2⤵
  PID:9116
- C:\Windows\System\RlXgFxz.exe
  C:\Windows\System\RlXgFxz.exe
  2⤵
  PID:9132
- C:\Windows\System\ZnrPePx.exe
  C:\Windows\System\ZnrPePx.exe
  2⤵
  PID:9148
- C:\Windows\System\jpKCbzL.exe
  C:\Windows\System\jpKCbzL.exe
  2⤵
  PID:8228
- C:\Windows\System\fHTxNGQ.exe
  C:\Windows\System\fHTxNGQ.exe
  2⤵
  PID:3628
- C:\Windows\System\FmVlcVd.exe
  C:\Windows\System\FmVlcVd.exe
  2⤵
  PID:3680
- C:\Windows\System\ltZBtgj.exe
  C:\Windows\System\ltZBtgj.exe
  2⤵
  PID:8304
- C:\Windows\System\iHCgTPB.exe
  C:\Windows\System\iHCgTPB.exe
  2⤵
  PID:8400
- C:\Windows\System\ubxEIYD.exe
  C:\Windows\System\ubxEIYD.exe
  2⤵
  PID:2800
- C:\Windows\System\eIRdNre.exe
  C:\Windows\System\eIRdNre.exe
  2⤵
  PID:8244
- C:\Windows\System\NmwjUIp.exe
  C:\Windows\System\NmwjUIp.exe
  2⤵
  PID:8316
- C:\Windows\System\JcHigGo.exe
  C:\Windows\System\JcHigGo.exe
  2⤵
  PID:8456
- C:\Windows\System\YvAyRfG.exe
  C:\Windows\System\YvAyRfG.exe
  2⤵
  PID:8436
- C:\Windows\System\hbraWOd.exe
  C:\Windows\System\hbraWOd.exe
  2⤵
  PID:8472
- C:\Windows\System\ocMXwaR.exe
  C:\Windows\System\ocMXwaR.exe
  2⤵
  PID:8488
- C:\Windows\System\ynhEEjC.exe
  C:\Windows\System\ynhEEjC.exe
  2⤵
  PID:8532
- C:\Windows\System\OugBPla.exe
  C:\Windows\System\OugBPla.exe
  2⤵
  PID:8692
- C:\Windows\System\BqDcPTh.exe
  C:\Windows\System\BqDcPTh.exe
  2⤵
  PID:2716
- C:\Windows\System\EIoGiiG.exe
  C:\Windows\System\EIoGiiG.exe
  2⤵
  PID:8576
- C:\Windows\System\cGWSvFR.exe
  C:\Windows\System\cGWSvFR.exe
  2⤵
  PID:8672
- C:\Windows\System\yklwBWN.exe
  C:\Windows\System\yklwBWN.exe
  2⤵
  PID:8736
- C:\Windows\System\Imlosfg.exe
  C:\Windows\System\Imlosfg.exe
  2⤵
  PID:2936
- C:\Windows\System\FzXeFGV.exe
  C:\Windows\System\FzXeFGV.exe
  2⤵
  PID:8840
- C:\Windows\System\ooddBbZ.exe
  C:\Windows\System\ooddBbZ.exe
  2⤵
  PID:384
- C:\Windows\System\gwCTGAE.exe
  C:\Windows\System\gwCTGAE.exe
  2⤵
  PID:8804
- C:\Windows\System\BkeeeNB.exe
  C:\Windows\System\BkeeeNB.exe
  2⤵
  PID:8824
- C:\Windows\System\UBLwJzG.exe
  C:\Windows\System\UBLwJzG.exe
  2⤵
  PID:8876
- C:\Windows\System\HgViCES.exe
  C:\Windows\System\HgViCES.exe
  2⤵
  PID:8932
- C:\Windows\System\HhSwZeM.exe
  C:\Windows\System\HhSwZeM.exe
  2⤵
  PID:9028
- C:\Windows\System\LulXlWC.exe
  C:\Windows\System\LulXlWC.exe
  2⤵
  PID:9092
- C:\Windows\System\IsnLmmG.exe
  C:\Windows\System\IsnLmmG.exe
  2⤵
  PID:8896
- C:\Windows\System\nCuWqMn.exe
  C:\Windows\System\nCuWqMn.exe
  2⤵
  PID:8960
- C:\Windows\System\SyqaLpp.exe
  C:\Windows\System\SyqaLpp.exe
  2⤵
  PID:9004
- C:\Windows\System\tfzmmaW.exe
  C:\Windows\System\tfzmmaW.exe
  2⤵
  PID:9080
- C:\Windows\System\VTBjUsw.exe
  C:\Windows\System\VTBjUsw.exe
  2⤵
  PID:8912
- C:\Windows\System\yoMAAAy.exe
  C:\Windows\System\yoMAAAy.exe
  2⤵
  PID:9176
- C:\Windows\System\jMcSulD.exe
  C:\Windows\System\jMcSulD.exe
  2⤵
  PID:9192
- C:\Windows\System\HthUYQa.exe
  C:\Windows\System\HthUYQa.exe
  2⤵
  PID:9196
- C:\Windows\System\poahSCV.exe
  C:\Windows\System\poahSCV.exe
  2⤵
  PID:7688
- C:\Windows\System\xAOdEXa.exe
  C:\Windows\System\xAOdEXa.exe
  2⤵
  PID:1612
- C:\Windows\System\DcwgsEb.exe
  C:\Windows\System\DcwgsEb.exe
  2⤵
  PID:8336
- C:\Windows\System\rLwNnKW.exe
  C:\Windows\System\rLwNnKW.exe
  2⤵
  PID:8212
- C:\Windows\System\wdlzbXm.exe
  C:\Windows\System\wdlzbXm.exe
  2⤵
  PID:8216
- C:\Windows\System\XGdFOUS.exe
  C:\Windows\System\XGdFOUS.exe
  2⤵
  PID:8440
- C:\Windows\System\IORoGfC.exe
  C:\Windows\System\IORoGfC.exe
  2⤵
  PID:8484
- C:\Windows\System\ndauBZU.exe
  C:\Windows\System\ndauBZU.exe
  2⤵
  PID:8752
- C:\Windows\System\UPLJYeO.exe
  C:\Windows\System\UPLJYeO.exe
  2⤵
  PID:8612
- C:\Windows\System\NktzIkZ.exe
  C:\Windows\System\NktzIkZ.exe
  2⤵
  PID:8820
- C:\Windows\System\ccZYiuC.exe
  C:\Windows\System\ccZYiuC.exe
  2⤵
  PID:8660
- C:\Windows\System\ftQqqVw.exe
  C:\Windows\System\ftQqqVw.exe
  2⤵
  PID:8624
- C:\Windows\System\sOnIoSp.exe
  C:\Windows\System\sOnIoSp.exe
  2⤵
  PID:8548
- C:\Windows\System\MPvutkm.exe
  C:\Windows\System\MPvutkm.exe
  2⤵
  PID:9140
- C:\Windows\System\BblcJGm.exe
  C:\Windows\System\BblcJGm.exe
  2⤵
  PID:9016
- C:\Windows\System\IZNKrGA.exe
  C:\Windows\System\IZNKrGA.exe
  2⤵
  PID:2036
- C:\Windows\System\RxDOBOo.exe
  C:\Windows\System\RxDOBOo.exe
  2⤵
  PID:2196
- C:\Windows\System\ZKmJAsm.exe
  C:\Windows\System\ZKmJAsm.exe
  2⤵
  PID:9184
- C:\Windows\System\HgpVDzp.exe
  C:\Windows\System\HgpVDzp.exe
  2⤵
  PID:8196
- C:\Windows\System\CuBVhFo.exe
  C:\Windows\System\CuBVhFo.exe
  2⤵
  PID:8800
- C:\Windows\System\SAVDLBi.exe
  C:\Windows\System\SAVDLBi.exe
  2⤵
  PID:8708
- C:\Windows\System\NpkTcIY.exe
  C:\Windows\System\NpkTcIY.exe
  2⤵
  PID:8980
- C:\Windows\System\MEgAYPL.exe
  C:\Windows\System\MEgAYPL.exe
  2⤵
  PID:7348
- C:\Windows\System\JLwsAzM.exe
  C:\Windows\System\JLwsAzM.exe
  2⤵
  PID:9144
- C:\Windows\System\vAhImTI.exe
  C:\Windows\System\vAhImTI.exe
  2⤵
  PID:7932
- C:\Windows\System\LkTnIsh.exe
  C:\Windows\System\LkTnIsh.exe
  2⤵
  PID:8096
- C:\Windows\System\ZcWhMKu.exe
  C:\Windows\System\ZcWhMKu.exe
  2⤵
  PID:7716
- C:\Windows\System\dRbhcHi.exe
  C:\Windows\System\dRbhcHi.exe
  2⤵
  PID:3644
- C:\Windows\System\myDkzcw.exe
  C:\Windows\System\myDkzcw.exe
  2⤵
  PID:8280
- C:\Windows\System\fjTyLEf.exe
  C:\Windows\System\fjTyLEf.exe
  2⤵
  PID:8352
- C:\Windows\System\gHbPENM.exe
  C:\Windows\System\gHbPENM.exe
  2⤵
  PID:8528
- C:\Windows\System\XaOqTrh.exe
  C:\Windows\System\XaOqTrh.exe
  2⤵
  PID:8460
- C:\Windows\System\hKazDVl.exe
  C:\Windows\System\hKazDVl.exe
  2⤵
  PID:2208
- C:\Windows\System\rvAbIda.exe
  C:\Windows\System\rvAbIda.exe
  2⤵
  PID:1784
- C:\Windows\System\WXxWmcZ.exe
  C:\Windows\System\WXxWmcZ.exe
  2⤵
  PID:3100
- C:\Windows\System\VEVZftb.exe
  C:\Windows\System\VEVZftb.exe
  2⤵
  PID:8940
- C:\Windows\System\aBQDORq.exe
  C:\Windows\System\aBQDORq.exe
  2⤵
  PID:9096
- C:\Windows\System\XEDijxO.exe
  C:\Windows\System\XEDijxO.exe
  2⤵
  PID:9160
- C:\Windows\System\udHuBvu.exe
  C:\Windows\System\udHuBvu.exe
  2⤵
  PID:8956
- C:\Windows\System\IcLdowa.exe
  C:\Windows\System\IcLdowa.exe
  2⤵
  PID:8364
- C:\Windows\System\MCRzNau.exe
  C:\Windows\System\MCRzNau.exe
  2⤵
  PID:8592
- C:\Windows\System\WkeUDCd.exe
  C:\Windows\System\WkeUDCd.exe
  2⤵
  PID:4032
- C:\Windows\System\bFKOHOH.exe
  C:\Windows\System\bFKOHOH.exe
  2⤵
  PID:8976
- C:\Windows\System\YQMJNeB.exe
  C:\Windows\System\YQMJNeB.exe
  2⤵
  PID:1984
- C:\Windows\System\vzRuWuz.exe
  C:\Windows\System\vzRuWuz.exe
  2⤵
  PID:8852
- C:\Windows\System\RIkEFEP.exe
  C:\Windows\System\RIkEFEP.exe
  2⤵
  PID:1304
- C:\Windows\System\cKFOqFS.exe
  C:\Windows\System\cKFOqFS.exe
  2⤵
  PID:9156
- C:\Windows\System\tMkdDlI.exe
  C:\Windows\System\tMkdDlI.exe
  2⤵
  PID:8724
- C:\Windows\System\dVjGjyL.exe
  C:\Windows\System\dVjGjyL.exe
  2⤵
  PID:8768
- C:\Windows\System\zKkpMpc.exe
  C:\Windows\System\zKkpMpc.exe
  2⤵
  PID:9012
- C:\Windows\System\iEbkKGf.exe
  C:\Windows\System\iEbkKGf.exe
  2⤵
  PID:8232
- C:\Windows\System\nHMPAUa.exe
  C:\Windows\System\nHMPAUa.exe
  2⤵
  PID:8892
- C:\Windows\System\tyGQrtf.exe
  C:\Windows\System\tyGQrtf.exe
  2⤵
  PID:2824
- C:\Windows\System\OrJPCsI.exe
  C:\Windows\System\OrJPCsI.exe
  2⤵
  PID:8608
- C:\Windows\System\tfQSWWM.exe
  C:\Windows\System\tfQSWWM.exe
  2⤵
  PID:9228
- C:\Windows\System\QCIHgBw.exe
  C:\Windows\System\QCIHgBw.exe
  2⤵
  PID:9244
- C:\Windows\System\crJiRKY.exe
  C:\Windows\System\crJiRKY.exe
  2⤵
  PID:9260
- C:\Windows\System\LhfiPuL.exe
  C:\Windows\System\LhfiPuL.exe
  2⤵
  PID:9276
- C:\Windows\System\YLsgBjX.exe
  C:\Windows\System\YLsgBjX.exe
  2⤵
  PID:9296
- C:\Windows\System\PFTDEcn.exe
  C:\Windows\System\PFTDEcn.exe
  2⤵
  PID:9316
- C:\Windows\System\UUNIBNW.exe
  C:\Windows\System\UUNIBNW.exe
  2⤵
  PID:9332
- C:\Windows\System\ufFCejP.exe
  C:\Windows\System\ufFCejP.exe
  2⤵
  PID:9364
- C:\Windows\System\INnRleq.exe
  C:\Windows\System\INnRleq.exe
  2⤵
  PID:9380
- C:\Windows\System\lPJrJdT.exe
  C:\Windows\System\lPJrJdT.exe
  2⤵
  PID:9396
- C:\Windows\System\wIPZTCp.exe
  C:\Windows\System\wIPZTCp.exe
  2⤵
  PID:9472
- C:\Windows\System\NGIrINp.exe
  C:\Windows\System\NGIrINp.exe
  2⤵
  PID:9488
- C:\Windows\System\DicYoqp.exe
  C:\Windows\System\DicYoqp.exe
  2⤵
  PID:9504
- C:\Windows\System\ZXviidn.exe
  C:\Windows\System\ZXviidn.exe
  2⤵
  PID:9524
- C:\Windows\System\zWAlTXx.exe
  C:\Windows\System\zWAlTXx.exe
  2⤵
  PID:9540
- C:\Windows\System\ZeqAVMm.exe
  C:\Windows\System\ZeqAVMm.exe
  2⤵
  PID:9560
- C:\Windows\System\svYGhDD.exe
  C:\Windows\System\svYGhDD.exe
  2⤵
  PID:9576
- C:\Windows\System\NdSlXnD.exe
  C:\Windows\System\NdSlXnD.exe
  2⤵
  PID:9592
- C:\Windows\System\vNqDeoG.exe
  C:\Windows\System\vNqDeoG.exe
  2⤵
  PID:9612
- C:\Windows\System\UbJAwYo.exe
  C:\Windows\System\UbJAwYo.exe
  2⤵
  PID:9632
- C:\Windows\System\AWEOPUy.exe
  C:\Windows\System\AWEOPUy.exe
  2⤵
  PID:9652
- C:\Windows\System\PSxDfEO.exe
  C:\Windows\System\PSxDfEO.exe
  2⤵
  PID:9668
- C:\Windows\System\xVVVobc.exe
  C:\Windows\System\xVVVobc.exe
  2⤵
  PID:9688
- C:\Windows\System\aORWJRo.exe
  C:\Windows\System\aORWJRo.exe
  2⤵
  PID:9704
- C:\Windows\System\LZQHCay.exe
  C:\Windows\System\LZQHCay.exe
  2⤵
  PID:9724
- C:\Windows\System\GZIJIuw.exe
  C:\Windows\System\GZIJIuw.exe
  2⤵
  PID:9744
- C:\Windows\System\bJLFaqI.exe
  C:\Windows\System\bJLFaqI.exe
  2⤵
  PID:9768
- C:\Windows\System\ejxQSOi.exe
  C:\Windows\System\ejxQSOi.exe
  2⤵
  PID:9796
- C:\Windows\System\ByxXKbp.exe
  C:\Windows\System\ByxXKbp.exe
  2⤵
  PID:9828
- C:\Windows\System\oVOYvOD.exe
  C:\Windows\System\oVOYvOD.exe
  2⤵
  PID:9852
- C:\Windows\System\EvfFXxI.exe
  C:\Windows\System\EvfFXxI.exe
  2⤵
  PID:9872
- C:\Windows\System\LEpzEZc.exe
  C:\Windows\System\LEpzEZc.exe
  2⤵
  PID:9892
- C:\Windows\System\UlilrOE.exe
  C:\Windows\System\UlilrOE.exe
  2⤵
  PID:9912
- C:\Windows\System\ESgkfuM.exe
  C:\Windows\System\ESgkfuM.exe
  2⤵
  PID:9940
- C:\Windows\System\HgJFuNJ.exe
  C:\Windows\System\HgJFuNJ.exe
  2⤵
  PID:9956
- C:\Windows\System\DbHvWEg.exe
  C:\Windows\System\DbHvWEg.exe
  2⤵
  PID:9980
- C:\Windows\System\yJYQKlO.exe
  C:\Windows\System\yJYQKlO.exe
  2⤵
  PID:9996
- C:\Windows\System\dijMZxI.exe
  C:\Windows\System\dijMZxI.exe
  2⤵
  PID:10020
- C:\Windows\System\oDhmoSw.exe
  C:\Windows\System\oDhmoSw.exe
  2⤵
  PID:10036
- C:\Windows\System\ccIFrtN.exe
  C:\Windows\System\ccIFrtN.exe
  2⤵
  PID:10060
- C:\Windows\System\hxocATT.exe
  C:\Windows\System\hxocATT.exe
  2⤵
  PID:10080
- C:\Windows\System\GmmIeGO.exe
  C:\Windows\System\GmmIeGO.exe
  2⤵
  PID:10100
- C:\Windows\System\lNPmDJT.exe
  C:\Windows\System\lNPmDJT.exe
  2⤵
  PID:10116
- C:\Windows\System\hxaILqS.exe
  C:\Windows\System\hxaILqS.exe
  2⤵
  PID:10132
- C:\Windows\System\bGYldZf.exe
  C:\Windows\System\bGYldZf.exe
  2⤵
  PID:10148
- C:\Windows\System\AwKznCE.exe
  C:\Windows\System\AwKznCE.exe
  2⤵
  PID:10164
- C:\Windows\System\BLWfbfh.exe
  C:\Windows\System\BLWfbfh.exe
  2⤵
  PID:10180
- C:\Windows\System\ggytmxk.exe
  C:\Windows\System\ggytmxk.exe
  2⤵
  PID:10196
- C:\Windows\System\fpWTOrd.exe
  C:\Windows\System\fpWTOrd.exe
  2⤵
  PID:10212
- C:\Windows\System\GMZcqvk.exe
  C:\Windows\System\GMZcqvk.exe
  2⤵
  PID:10232
- C:\Windows\System\TAbZTBG.exe
  C:\Windows\System\TAbZTBG.exe
  2⤵
  PID:9204
- C:\Windows\System\BboFMzn.exe
  C:\Windows\System\BboFMzn.exe
  2⤵
  PID:3108
- C:\Windows\System\HLHYoRi.exe
  C:\Windows\System\HLHYoRi.exe
  2⤵
  PID:9308
- C:\Windows\System\FLJBUQJ.exe
  C:\Windows\System\FLJBUQJ.exe
  2⤵
  PID:9352
- C:\Windows\System\rJkrRwF.exe
  C:\Windows\System\rJkrRwF.exe
  2⤵
  PID:9128
- C:\Windows\System\kkNNyoJ.exe
  C:\Windows\System\kkNNyoJ.exe
  2⤵
  PID:8944
- C:\Windows\System\WZCeLzt.exe
  C:\Windows\System\WZCeLzt.exe
  2⤵
  PID:9252
- C:\Windows\System\XFDSuJo.exe
  C:\Windows\System\XFDSuJo.exe
  2⤵
  PID:9324
- C:\Windows\System\mAzUzVQ.exe
  C:\Windows\System\mAzUzVQ.exe
  2⤵
  PID:9412
- C:\Windows\System\GObrZLh.exe
  C:\Windows\System\GObrZLh.exe
  2⤵
  PID:9404
- C:\Windows\System\EzrMSKL.exe
  C:\Windows\System\EzrMSKL.exe
  2⤵
  PID:9432
- C:\Windows\System\VnHjjSd.exe
  C:\Windows\System\VnHjjSd.exe
  2⤵
  PID:9448
- C:\Windows\System\rKrMofY.exe
  C:\Windows\System\rKrMofY.exe
  2⤵
  PID:9588
- C:\Windows\System\HWUwKFX.exe
  C:\Windows\System\HWUwKFX.exe
  2⤵
  PID:9660
- C:\Windows\System\mrbyjYD.exe
  C:\Windows\System\mrbyjYD.exe
  2⤵
  PID:9740
- C:\Windows\System\SdNHvWB.exe
  C:\Windows\System\SdNHvWB.exe
  2⤵
  PID:1684
- C:\Windows\System\UjuEVpQ.exe
  C:\Windows\System\UjuEVpQ.exe
  2⤵
  PID:9680
- C:\Windows\System\nFynxgF.exe
  C:\Windows\System\nFynxgF.exe
  2⤵
  PID:9764
- C:\Windows\System\wQYPqTF.exe
  C:\Windows\System\wQYPqTF.exe
  2⤵
  PID:9608
- C:\Windows\System\UsMdARG.exe
  C:\Windows\System\UsMdARG.exe
  2⤵
  PID:9716
- C:\Windows\System\VtNGVYX.exe
  C:\Windows\System\VtNGVYX.exe
  2⤵
  PID:9760
- C:\Windows\System\glUEbXh.exe
  C:\Windows\System\glUEbXh.exe
  2⤵
  PID:9812
- C:\Windows\System\oTSzuKU.exe
  C:\Windows\System\oTSzuKU.exe
  2⤵
  PID:9820
- C:\Windows\System\NlFbWrg.exe
  C:\Windows\System\NlFbWrg.exe
  2⤵
  PID:9868
- C:\Windows\System\GdRAKWT.exe
  C:\Windows\System\GdRAKWT.exe
  2⤵
  PID:9904
- C:\Windows\System\PaaPthu.exe
  C:\Windows\System\PaaPthu.exe
  2⤵
  PID:9952
- C:\Windows\System\JLCJgSg.exe
  C:\Windows\System\JLCJgSg.exe
  2⤵
  PID:9992
- C:\Windows\System\EkWVHLT.exe
  C:\Windows\System\EkWVHLT.exe
  2⤵
  PID:10028
- C:\Windows\System\mKyzTIL.exe
  C:\Windows\System\mKyzTIL.exe
  2⤵
  PID:10052
- C:\Windows\System\UOWYUYv.exe
  C:\Windows\System\UOWYUYv.exe
  2⤵
  PID:10076
- C:\Windows\System\LQUTxSw.exe
  C:\Windows\System\LQUTxSw.exe
  2⤵
  PID:10124
- C:\Windows\System\KZhExrb.exe
  C:\Windows\System\KZhExrb.exe
  2⤵
  PID:10220
- C:\Windows\System\GYyWpRt.exe
  C:\Windows\System\GYyWpRt.exe
  2⤵
  PID:8284
- C:\Windows\System\zShTafZ.exe
  C:\Windows\System\zShTafZ.exe
  2⤵
  PID:9348
- C:\Windows\System\LXGAvHb.exe
  C:\Windows\System\LXGAvHb.exe
  2⤵
  PID:9288
- C:\Windows\System\zjnhtaf.exe
  C:\Windows\System\zjnhtaf.exe
  2⤵
  PID:9392
- C:\Windows\System\hOiNHlw.exe
  C:\Windows\System\hOiNHlw.exe
  2⤵
  PID:10176
- C:\Windows\System\KIpeYAj.exe
  C:\Windows\System\KIpeYAj.exe
  2⤵
  PID:9304
- C:\Windows\System\sdUopaU.exe
  C:\Windows\System\sdUopaU.exe
  2⤵
  PID:9424
- C:\Windows\System\RMaBlEh.exe
  C:\Windows\System\RMaBlEh.exe
  2⤵
  PID:10208
- C:\Windows\System\lnEetAS.exe
  C:\Windows\System\lnEetAS.exe
  2⤵
  PID:8844
- C:\Windows\System\rKhxhsV.exe
  C:\Windows\System\rKhxhsV.exe
  2⤵
  PID:9408
- C:\Windows\System\MbgqQJh.exe
  C:\Windows\System\MbgqQJh.exe
  2⤵
  PID:9516
- C:\Windows\System\pVfNXmK.exe
  C:\Windows\System\pVfNXmK.exe
  2⤵
  PID:9628
- C:\Windows\System\HhDLuvp.exe
  C:\Windows\System\HhDLuvp.exe
  2⤵
  PID:9496
- C:\Windows\System\iiZUILB.exe
  C:\Windows\System\iiZUILB.exe
  2⤵
  PID:9792
- C:\Windows\System\vDRwfcA.exe
  C:\Windows\System\vDRwfcA.exe
  2⤵
  PID:9700
- C:\Windows\System\VtTwFnU.exe
  C:\Windows\System\VtTwFnU.exe
  2⤵
  PID:9752
- C:\Windows\System\LopsPuB.exe
  C:\Windows\System\LopsPuB.exe
  2⤵
  PID:9844
- C:\Windows\System\vMAFtGy.exe
  C:\Windows\System\vMAFtGy.exe
  2⤵
  PID:9848
- C:\Windows\System\VdOCvxL.exe
  C:\Windows\System\VdOCvxL.exe
  2⤵
  PID:10012
- C:\Windows\System\drkFcZI.exe
  C:\Windows\System\drkFcZI.exe
  2⤵
  PID:10072
- C:\Windows\System\snVoAhI.exe
  C:\Windows\System\snVoAhI.exe
  2⤵
  PID:9344
- C:\Windows\System\fbmZSMf.exe
  C:\Windows\System\fbmZSMf.exe
  2⤵
  PID:9272
- C:\Windows\System\dPyuaBU.exe
  C:\Windows\System\dPyuaBU.exe
  2⤵
  PID:9428
- C:\Windows\System\GkBFNSU.exe
  C:\Windows\System\GkBFNSU.exe
  2⤵
  PID:9648
- C:\Windows\System\JFtnYUW.exe
  C:\Windows\System\JFtnYUW.exe
  2⤵
  PID:9860
- C:\Windows\System\BjBkvWM.exe
  C:\Windows\System\BjBkvWM.exe
  2⤵
  PID:9224
- C:\Windows\System\CZGzmLj.exe
  C:\Windows\System\CZGzmLj.exe
  2⤵
  PID:9512
- C:\Windows\System\GuDgNZj.exe
  C:\Windows\System\GuDgNZj.exe
  2⤵
  PID:9836
- C:\Windows\System\GtjTZXY.exe
  C:\Windows\System\GtjTZXY.exe
  2⤵
  PID:3684
- C:\Windows\System\tbbpUCf.exe
  C:\Windows\System\tbbpUCf.exe
  2⤵
  PID:9900
- C:\Windows\System\IFGqBGT.exe
  C:\Windows\System\IFGqBGT.exe
  2⤵
  PID:9736
- C:\Windows\System\FAhHPXq.exe
  C:\Windows\System\FAhHPXq.exe
  2⤵
  PID:10228
- C:\Windows\System\lgFVsDc.exe
  C:\Windows\System\lgFVsDc.exe
  2⤵
  PID:9816
- C:\Windows\System\AjLdHQI.exe
  C:\Windows\System\AjLdHQI.exe
  2⤵
  PID:9888
- C:\Windows\System\MbeGcEF.exe
  C:\Windows\System\MbeGcEF.exe
  2⤵
  PID:10160
- C:\Windows\System\jPonJGr.exe
  C:\Windows\System\jPonJGr.exe
  2⤵
  PID:9240
- C:\Windows\System\qqPoEun.exe
  C:\Windows\System\qqPoEun.exe
  2⤵
  PID:9220

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\ABcQfpg.exe

Filesize
2.8MB

MD5
051536f2174dceb01f65ad9f0188b120

SHA1
1ff92e06f463a6dd8cfdef85ea4a11fddb096a6e

SHA256
cae268e56ebcf7225b8775d1b8eaa43b30903a972e2a9cb872777c5a843c061e

SHA512
0eef6844408499fd3a31840abe25ade9681b7bd5c834e2678f37cfd430d6f52b84344a16a1e14ef1df08e75f63d44f720a485328ba3ec2ded146b7ba98ffa661

Download Submit
C:\Windows\system\AegnXVD.exe

Filesize
2.8MB

MD5
fc7418a74e6959631583b66c41548c39

SHA1
1a3a1d878f17c6a8f9b1b67766af46f58775ab1a

SHA256
be1a15f03d1165e668418ddc2b6d0a14a86e3f30f20cd15ab160cddfcf8aa905

SHA512
7b68cd371e46bd65d2fdb3bdefcd438c8bb7624dfc170459acf30ddb6524e4ca34aa110b04f1a2a9106010769aa4121d6fd2fb2c482e2d850a90691a6b8edc39

Download Submit
C:\Windows\system\EbpPsAl.exe

Filesize
2.8MB

MD5
1f2938e594cf034d2e61cb8cfb072d0b

SHA1
43c7dcb7c143cf70890493ea5a4f4e50be131f73

SHA256
27fbab0e42c6d5288f593a247dcc57cda9cfd26068f675db5510a1c9aee9892f

SHA512
8c2139704497a9f88217959fe6ed3c7bfc44de873ab5b7a78a50819d7b71e8ccedb420e9778cc782a4cfc33959975154eabc8a83ba5239dd61261cb014d4942f

Download Submit
C:\Windows\system\FFBkVQO.exe

Filesize
2.7MB

MD5
a7991c2d3fd708e700dd0536273961dd

SHA1
fe3195959c51fac86c2802e2432acefe6832e17d

SHA256
93e7e718b130770ba99ed4763ad7c3521e12c2c3a7d98f47326e2e41952b93bc

SHA512
832ae06bc72c2d1c6ad00925cf06b740b55321bcb545b78b66c77e47d5fa09d132017440ca65efdbe4fd57be455c4c2dcf31cd02081df96be99926b4aa9ff416

Download Submit
C:\Windows\system\FNClqkh.exe

Filesize
2.8MB

MD5
b7ad0652b2700e7f9f691baf281e8c11

SHA1
e685f42e58eb218f836cef4b35b95af97cc01983

SHA256
6cd9ef32398b4be9508807b0ec5c46a5a7dccac66a4811c50dbb156d4f615c8d

SHA512
9eb75416392e3b8b68c25a5c9c07d8e870bc1846276ba75c1aae42ffd351c56d2db86c93922c13ee88963710a228dde2df0958d069149f050ee51df40a01b4c9

Download Submit
C:\Windows\system\GpAWmFJ.exe

Filesize
2.8MB

MD5
6ec93481840e435f15ba0a4e4cb972f8

SHA1
09a1ba820bf65fa63a2d27f1dfe6c15f0d20d745

SHA256
d32db4579c68778588940db8bd57a68c86f23514069bd49b6de1e64d027f223e

SHA512
46ad5f32543d8b76a4fe3f5e4f1d7028c666a3ce39d82a3e5d366690f85a09df32f8aa3ad204ee250b75f827e8d4be06527fa9362b34ff19ef4654d013d3d92c

Download Submit
C:\Windows\system\GrhuIBv.exe

Filesize
2.8MB

MD5
248e917c3116e826b97944fdacff8313

SHA1
d1f8030ca286a4fc35aa9329dc2990e4a956d023

SHA256
cfd15a54b11af0d14b1c035ee51118416be8c96a1457fb1699cae0c46c3539b2

SHA512
1ccaaa5ba0805247769d31dd9cbc5d8824d5113911ff2b4a68583735972ffd8f82e907fde8aebcde49f8c6f7d07a6555b3f6adc4722c2897dd358cbc1e92d648

Download Submit
C:\Windows\system\HybSgSu.exe

Filesize
2.8MB

MD5
ba0b238b4ed4f173b8b8ca2bfe6c8778

SHA1
b675f434f06299f95f7e238352318c79a69b8a7e

SHA256
f27b91caefd2823cb0e132fe080c6adf3e624acd9756b4ffdb0143c23166ae20

SHA512
9bea8f5fbb7787f87e81424ee2746858fb629f33ee9ad63d6989eff19e45b53f2a98cceb934b5a0528990eb673717e7503772f4c096f6d7805411645c6074c02

Download Submit
C:\Windows\system\IBlciVz.exe

Filesize
2.8MB

MD5
543d7230c9039594ec02e29d4081c9fb

SHA1
cb1f2f373aa0f4dd70ea3a8301f119460da16847

SHA256
7b5c3bf562cc02d03bba3442816807d2c63d71b00720037751465fd1bef8c9d7

SHA512
7976faa039a4adba3ba4b187237e1b8d4c3b8871b0be889e7c207861bfa4b14ba4e4fd9d40d9b91a8ff7fcbf021b31db96eabdeb076885033d47805c33af298c

Download Submit
C:\Windows\system\OHkNcXJ.exe

Filesize
2.5MB

MD5
2b45deeedd5a1206da775de7d5420c1d

SHA1
0e47670dbafaf5799583d24e92b4e9ddcd7ca4d0

SHA256
4e4ed7ef38291fa534f440f9f14bcae9ca043bc64e13b99e4818fea993996127

SHA512
6c0b872608a6505883fd341e84b5a2c5b2fcc9db3c9bdf212f3f3e8c84acbf43621929be590e9f1e496200d4a55720f45ccca01df8ceb3fb38bc105b709fadd0

Download Submit
C:\Windows\system\OWiIfbG.exe

Filesize
2.4MB

MD5
948d768b73f2170c76a42a830375df5b

SHA1
aaa53dcade2126a8727c91165a465dc04c091582

SHA256
3bbc770785377ea33c1b4683e6494cc69a8fd7c7d1f03a8a795dc65c7a5e8b13

SHA512
a3904fd5d0aa1a7af81c8538ce33f257a40d501ab3f2831bf4aeff057be524fa832c0ff1e5e95fa11d14e36de4c53cbd23c67113defa5c4a5e7d758a825b05f3

Download Submit
C:\Windows\system\YsvWNXz.exe

Filesize
2.8MB

MD5
13a11cccbcf88e060412e322c317a23d

SHA1
43da99bea4733e34b4541c77687c9666fa260f19

SHA256
f28f9ea6397832770e372d87e63431c24c717536d7b1a8c479bdd6fd6b4aad37

SHA512
50cf9ede7fb60a8ab5222a67549072bb2dc75e3ebc5353b42e81f4278e31c1c77bb7f3ad68d83f784c8472bc3ac3587ea6b10e2d8ffc6c76113f526f5282954e

Download Submit
C:\Windows\system\adqWZsQ.exe

Filesize
2.8MB

MD5
c0a4c8e562de776c52f0b370a26bae83

SHA1
335372f45319b8eac86304e1250cfcbcf922c1c3

SHA256
5f1ea385e07b87b712845855d8588eaae0bb8c4a49945025bb0ecb1ecd7e09a0

SHA512
6dbcfb37a9b95ed464a132b974011678899260c5b3c297157d9a7abebfba9f3eaf93540c6cc3c15dbdee2431ddeb493e7488b83a34416a749ad44dd27e5b1760

Download Submit
C:\Windows\system\geeHHDE.exe

Filesize
2.8MB

MD5
69e5fdff85b3e329f222fbe7346c377b

SHA1
31ff1272a639b9723ad1a04f2eb68a96e285c0cd

SHA256
3457acd300f6102a929a27a6066468efe3eae48ee6fa4d57ec5298f55ce2948e

SHA512
148b1b8d76f3ba2bc1231726b4508310d4ed83d6b4d521a05b20e42612c96e6c41cdcdbac35677c5ddc220d79c1d9f0232bb5bdd51eab7b58ab1662daada473e

Download Submit
C:\Windows\system\htpxduv.exe

Filesize
2.8MB

MD5
67101e883db45610f3956c2b8761add4

SHA1
7f74cd78e15e7c9cfbc4ffb962d809a3557f4e34

SHA256
f34e900503a6b4b370e5612472ee8c78d4a96db830516d0fd66fedc10e8992cb

SHA512
e75f77cbeb8c35dd6717927d88685298ca2de36f27e1d50a4f6edb9d816cf80a4b788272856b57fc4bf4c8f28ca09df41851b3823128245506ffdf28cbbbe655

Download Submit
C:\Windows\system\iGLCaTJ.exe

Filesize
2.8MB

MD5
65f64aef02f775a73f693bc698b481d0

SHA1
b30ba125d5570ff8c13c90baf28b3b9171e61001

SHA256
a1b138c544fc21a201807c520e11c0d8a5bafbb5ee300c0c2ab71189021a1750

SHA512
546d794e49136f287ec1742e64b6256a5e977c9202de0da0752cc0f31220562b18cdcb46a5478344567b6a8a2a6b34468d46f6eab362dd344bc78ea03e8e65fe

Download Submit
C:\Windows\system\jkiMEsC.exe

Filesize
2.8MB

MD5
285e1060e98bf84703877f455d342f94

SHA1
4524311e4879154fde79809a1699dd0f80a9c160

SHA256
6172566593a50eac95417fa5e960376e76acc3a9dc8744c4829d4c3b305580f3

SHA512
b2200663290aba6c5934a2ad1f23aeecba83c0a4abe90b74c256b103c7376e8b0a8cd7748ee30be88f4215b2ec885cfff2ff4b2cef1551fb815bea300489054a

Download Submit
C:\Windows\system\kPyreuc.exe

Filesize
2.8MB

MD5
a781e825e741a701f286e27e8b2d8ffa

SHA1
4c4ef326d2ceb91b36b057e7e3d9288f943f5c67

SHA256
300141e99f34e960f4af18bfa0fdf02fc114659bc7eec2a86b8bd6353581e052

SHA512
4946325d349b2ce54fd541a0dd7df8710037cf0273d3cc1bb06da6fb39fc89d3fbc294c974081543618dcbe17306f9d8cea6f9ee011b371c626812490319c0e4

Download Submit
C:\Windows\system\pmbhwOm.exe

Filesize
2.6MB

MD5
818c606d1da7784c05529c51cfac5de5

SHA1
3807fd8fd723449642c2404f4ad4aa6d1a48186c

SHA256
0b24c710cefb3150760fafdf1dc716eabbab0ad55d7f331e317df1cd419d5503

SHA512
95d4934f00394fcb61c4de186a2d607f6bbbbf56b504d32082fe70b8c901f05278f4882fc4a7f9a86aba85b964cd66c8275b79a24bfeeb0da695e24e5cf1fc2e

Download Submit
C:\Windows\system\rAGuyUF.exe

Filesize
2.8MB

MD5
b77f083afaf36a3caf37185f142cd35c

SHA1
63deac32243566c1a82f4e643b45a3fc229b0d89

SHA256
f768476ba645ab64a672ae09525b6d237acec1f38c0244341fcde06f2fbd480a

SHA512
57e7704bd3f178cc09e2fe7857bcb2c27915485f86f2c8295a89b79bcb938b7bc988decba632555d165339feace2b993139e248e3c8c746518fe233e5530a068

Download Submit
C:\Windows\system\rdeGiIr.exe

Filesize
1.5MB

MD5
ce7069685850a0ff9a6ed404fb6546f3

SHA1
fd92b42a34b882910139a5a48d9fbf260d4207aa

SHA256
dbcd846f674679f4baea2ed5b6ef9501763545b12c4658984e9ecac30c093cff

SHA512
e6da9299ed2532a8259e68b2872dcc5f698e73aa1175626c805585ea3eaf879d67f909c82fdd01bf5916d8d8c8595add5b778fa3638f94f91f8eee63812de5db

Download Submit
C:\Windows\system\riITcaF.exe

Filesize
2.8MB

MD5
afe3664dd7fd0266cce54bc9b39485cc

SHA1
a7f40cfcefad8beaef42db4861b03dd7c03d6779

SHA256
c750890703b9549ce3147f7123d8e7f36b0f3480854da5cbb06a9cc76e7a7f62

SHA512
4c08a32b93bdbf97d2f520f3b513b4af5321797e2dd174d1a99b37689a89ef82a25428140e1ce86aaba5e723a8db5fb3ccbbf9c3818ba6133491e91d6453cf5b

Download Submit
C:\Windows\system\wBhDzYR.exe

Filesize
2.8MB

MD5
17c9adc128eb6b730d279dfacf8df77b

SHA1
c18ada3244fa1b29449ec9022f991808828da119

SHA256
d161a7b7d9706542f07bbe9c063c3ac37c7bda8ca3200579ab994f72a95e1c94

SHA512
d12bf644d6afe21fe84b1e29b89b6ccd392ebf1e65e72666abef6b53687f35a7b81dbc71164c9df248fcd619e4b4ec09b7c24d7e1d26732734c003010cd1f17c

Download Submit
C:\Windows\system\wtHCFmP.exe

Filesize
2.8MB

MD5
34a8dc17e2d08b272ab2e40f1a527aa0

SHA1
49a8b38e7d213401d160cf5faad05890e9c35f3b

SHA256
131d3f14d18e6fac7ef53fb429f89b5e56fabdf550a7f5e17212002c860a6af1

SHA512
513098c323dc6d8cef4a9efd966ea593e9e1814549143212ba93d49088e6408ab9421c92e92541b61e0b07c3af90c56a5e2fcc778e5c2ea30c779a6be13c5eff

Download Submit
\Windows\system\CLQDDnS.exe

Filesize
1.2MB

MD5
7f8e0a6822531fc1039d8a6bce159083

SHA1
47f95f1a7a9eaabad4c50ffd816906e278c8681b

SHA256
7a9b71aff99bdc53b469fe135d78fffcb8e850e481cd5dafb394f3135a4b110a

SHA512
3e01ce51d419b5de20cca0c3752b0e65c3202aa31ad07946000247de428decb271df4d7e3c87c55d789b045bebf11c9d1f77094a55f7186c779e72c45cd12ea4

Download Submit
\Windows\system\CqHHiwc.exe

Filesize
2.8MB

MD5
9b6ecbe9a9333e6fe6229bbb04f3f1b4

SHA1
bbb28f6bf7b4dd3112d8364862372d3e0c1e5f36

SHA256
7269b4c6eb66fb2a4c0e2a5e0640370c07df3dca82229a3635c4faa5476571ac

SHA512
c8e20e0223c3030582a04fc9d2b86de21dc5109a40c111453f32d21c339dbbdc9ee45cd327b1a4d459c528c02a561766d3a6069fe9baefcc0912e71058a8995c

Download Submit
\Windows\system\EbpPsAl.exe

Filesize
1.7MB

MD5
66a081e0f135e381465890b44b4b272f

SHA1
f2ad0faa8e736aaf9fd73fb96d7a1c38b1e84da3

SHA256
6e82f0891ed3c78cfc713a2f5b01d87bedf8771230b760d90a9f5806a8392ec8

SHA512
63b4a33d737f4431a70ca2f2c7af835c9e1ea1bbf3bb3ae1686d43aba7508241cd04d4db619def8df5b9dd4f33d0dd4f7c905c5a904c8473f9d9da558c3a50be

Download Submit
\Windows\system\OHkNcXJ.exe

Filesize
2.4MB

MD5
b00eae5bae79251740777859b2cdf659

SHA1
04f20d294db29e61bec72b9b9b62a324fe4dfe44

SHA256
3fe6e6b3e183fc826de6c5e437ad9b2f9575052c27171e378cd2bf1b9dfcc78c

SHA512
c8fb10c9675eaf6fdd73c3f3ee5bb2621ffe59691f85547d6ec54637907726a31ce9df77644a15a4517ab629e76910b3a1cd8ea6638b4fc3890b91a4bb063c72

Download Submit
\Windows\system\OWiIfbG.exe

Filesize
1.8MB

MD5
b23a38d7cf157978ef2b792dc63ab0d1

SHA1
0864858b1504c85110a73ed402bc86123955bd13

SHA256
e822984c8f3f7ae2b4bffba9ceef34f4161c0e68454182000ee79d3fd7aeaced

SHA512
143a7df4f2dd1189149e92476dc557691b3abd6019ba908f37e7fc9eaf852770f51de37b76a64f47d3b6c7396656403c27a12147dc2640c3a5f7605a215c035b

Download Submit
\Windows\system\YNmjZJq.exe

Filesize
2.8MB

MD5
6225cb71bc7f3ddeccefbbb75c2f806a

SHA1
2d063919f76bebaec64f234f4c973cb1ddac144c

SHA256
a9d560b7d552c91c75524aa771b0927325f74dd5d50a2506cbb183dc67915e58

SHA512
fff5543e99e7cc412941f890143dce68a3bca06c246df679f90fa33bf19d28551b4d40f8ce71dae05d8c1ec466972a1bd6e10f36c8640d64374cfe2d7f44edd0

Download Submit
\Windows\system\YpVAgfL.exe

Filesize
1.9MB

MD5
cbcaa51d6f0323cf9fcfa6488e215f3c

SHA1
628ad0ee2a0d7793358f48f23061ff5f77d85855

SHA256
cd35f99f8c30df37c96a571ebafdac395b1c934accce104b64d04120ba9875e9

SHA512
006c8dbc39acc5fbc053ac48e144d968027eb11f14ee057f8b322bdbb5239608f665dcd5fc387026adf565351799311423b0c75016a4d67119f58320612cfee5

Download Submit
\Windows\system\YqcpDnO.exe

Filesize
2.8MB

MD5
0805e467014bdf6128225df45eae6a5a

SHA1
25eb2d0498367a5075f10f15aaa0c66d5b7aef37

SHA256
39166e3d580187700cb31ace569815628d086943cd6ce5b931ff810b8b77f153

SHA512
0d2c8d30e320b409810907264c65242e6a7402b5f91b1055bd1b94b2651b79afddadbb7b66f5f70a756a85d428452ea642eb6b29f1f844c361079a013d364b7d

Download Submit
\Windows\system\jvcspfu.exe

Filesize
2.8MB

MD5
a8f0e80c45ef2a458815054fd51b2d70

SHA1
9ad787f4ebb7e4673853e87d5860b5c04aec75ff

SHA256
9eda7818e9f033e891ea1fd0b0ee3f0d5e0356130e53103d741b024bdecae824

SHA512
67475ecf825357bb4c06c0accb068bf8e08d467d2f7fe232a20c803be9329d0d68d6dfa5309843900d408e8067b7b5f700db8a9c17ab6c093e402a7d7799df7e

Download Submit
\Windows\system\lSPeVxw.exe

Filesize
1.6MB

MD5
a4691b8e216cd611961da759b17ddf59

SHA1
58ad5f80132b11e7448194f826277c3d74552e19

SHA256
b5b196c78d296637ec4ebd7e2de6fe4c02d677cdd9368770a826d2b95dbfd3f3

SHA512
cfd7205c2cdc9378023b28107a5d3c149d4c7311c329b24b35cce017085e62dfee07a6d0773fee431fa72fb19373098afe10237442d4338094e561d8f6b4189f

Download Submit
\Windows\system\pmbhwOm.exe

Filesize
2.8MB

MD5
9b8e7662c2163bd5c84f011343347d1e

SHA1
9ecbf949d3b83cdc7d69b8a5aeca053171aa8ed5

SHA256
d4a10851b8cac89cb55791a876e288db6d131c64e9fe73015c9f4e0aa30e9035

SHA512
e41cfb29488ac7db52f977c21c649e498a3e068092156a06ad3a6007e9162d96dfc1b572cb6d0bdce78546beed3f739b5d8e7a77be3ad997909833ee74180bd2

Download Submit
\Windows\system\rdeGiIr.exe

Filesize
2.8MB

MD5
caed3a9b289eed5cf2882d75cc2b7e0f

SHA1
83bb84b9c2a85248d3eb3cb57796cac5515d8981

SHA256
2c946f0334b86e10afb85c2b8a87c5821ff7d34fd36d03e0b70a1979683b38ed

SHA512
2a524162f337af57a9f17adef21364c5213684370b664535a03160ca5d38f203bb99b76e6fbc5f5ff8a294bf77efeb5e492a7d48fbd5efee28ee0bca02bb8df3

Download Submit
\Windows\system\ulpKdti.exe

Filesize
2.1MB

MD5
7e77a83bac5b64127c3968dcf9d11952

SHA1
d67ce3f5d446d8450b88a9634b35c169f7286e71

SHA256
8781a039cffa0eadbf16aedbde0d02988e6cce7523b7bb09676ee8fcdd69b7d7

SHA512
742292871371c96c134ff219aefb6f193c19078c10b47280f77fae938bfcd02248c85f4fcc75a43b679f1ba7e981a37f2d5a084c0174b1ed4d2540cd9ce4e3f8

Download Submit
\Windows\system\yqHZBEx.exe

Filesize
2.6MB

MD5
4a0c91b468731da0d9c5633859b78fbb

SHA1
f7d40f556ab85a12e3a2fe5770b9ea44e8e8c260

SHA256
cde532a0c2e33f5b6d9f3284dec03e6d3fb998a24e8d8269c59a2005077971a7

SHA512
dc20479f7df95951db9a02f47b7c61fb913fc433b73aff39cea6d83b6f2b1c407277e9d77184b3b90a27a4d5775c08e0e2cf86cf142550bf01a903c7c079d6e3

Download Submit
memory/760-424-0x000000013F050000-0x000000013F446000-memory.dmp

Filesize
4.0MB

Download
memory/760-4962-0x000000013F050000-0x000000013F446000-memory.dmp

Filesize
4.0MB

Download
memory/2152-375-0x000000013F0C0000-0x000000013F4B6000-memory.dmp

Filesize
4.0MB

Download
memory/2152-4960-0x000000013F0C0000-0x000000013F4B6000-memory.dmp

Filesize
4.0MB

Download
memory/2408-4959-0x000000013FCB0000-0x00000001400A6000-memory.dmp

Filesize
4.0MB

Download
memory/2408-372-0x000000013FCB0000-0x00000001400A6000-memory.dmp

Filesize
4.0MB

Download
memory/2476-425-0x0000000002F90000-0x0000000003386000-memory.dmp

Filesize
4.0MB

Download
memory/2476-0-0x000000013FA90000-0x000000013FE86000-memory.dmp

Filesize
4.0MB

Download
memory/2476-408-0x000000013F050000-0x000000013F446000-memory.dmp

Filesize
4.0MB

Download
memory/2476-367-0x0000000002F90000-0x0000000003386000-memory.dmp

Filesize
4.0MB

Download
memory/2476-286-0x0000000002F90000-0x0000000003386000-memory.dmp

Filesize
4.0MB

Download
memory/2476-369-0x000000013F080000-0x000000013F476000-memory.dmp

Filesize
4.0MB

Download
memory/2476-365-0x000000013F0C0000-0x000000013F4B6000-memory.dmp

Filesize
4.0MB

Download
memory/2476-376-0x0000000002F90000-0x0000000003386000-memory.dmp

Filesize
4.0MB

Download
memory/2476-373-0x000000013F0C0000-0x000000013F4B6000-memory.dmp

Filesize
4.0MB

Download
memory/2476-363-0x0000000002F90000-0x0000000003386000-memory.dmp

Filesize
4.0MB

Download
memory/2476-20-0x0000000002F90000-0x0000000003386000-memory.dmp

Filesize
4.0MB

Download
memory/2476-7-0x0000000002F90000-0x0000000003386000-memory.dmp

Filesize
4.0MB

Download
memory/2476-371-0x0000000002F90000-0x0000000003386000-memory.dmp

Filesize
4.0MB

Download
memory/2476-1-0x00000000002F0000-0x0000000000300000-memory.dmp

Filesize
64KB

Download
memory/2492-288-0x000000013FA80000-0x000000013FE76000-memory.dmp

Filesize
4.0MB

Download
memory/2492-4954-0x000000013FA80000-0x000000013FE76000-memory.dmp

Filesize
4.0MB

Download
memory/2500-4958-0x000000013F080000-0x000000013F476000-memory.dmp

Filesize
4.0MB

Download
memory/2500-370-0x000000013F080000-0x000000013F476000-memory.dmp

Filesize
4.0MB

Download
memory/2524-368-0x000000013F9F0000-0x000000013FDE6000-memory.dmp

Filesize
4.0MB

Download
memory/2524-4957-0x000000013F9F0000-0x000000013FDE6000-memory.dmp

Filesize
4.0MB

Download
memory/2572-374-0x000007FEF5EB0000-0x000007FEF684D000-memory.dmp

Filesize
9.6MB

Download
memory/2572-362-0x000007FEF5EB0000-0x000007FEF684D000-memory.dmp

Filesize
9.6MB

Download
memory/2572-287-0x0000000002BF0000-0x0000000002C70000-memory.dmp

Filesize
512KB

Download
memory/2572-125-0x0000000001F40000-0x0000000001F48000-memory.dmp

Filesize
32KB

Download
memory/2572-289-0x000007FEF616E000-0x000007FEF616F000-memory.dmp

Filesize
4KB

Download
memory/2572-115-0x000000001B660000-0x000000001B942000-memory.dmp

Filesize
2.9MB

Download
memory/2584-4953-0x000000013F7C0000-0x000000013FBB6000-memory.dmp

Filesize
4.0MB

Download
memory/2584-285-0x000000013F7C0000-0x000000013FBB6000-memory.dmp

Filesize
4.0MB

Download
memory/2656-4963-0x000000013FE30000-0x0000000140226000-memory.dmp

Filesize
4.0MB

Download
memory/2656-426-0x000000013FE30000-0x0000000140226000-memory.dmp

Filesize
4.0MB

Download
memory/2704-364-0x000000013FCE0000-0x00000001400D6000-memory.dmp

Filesize
4.0MB

Download
memory/2704-4955-0x000000013FCE0000-0x00000001400D6000-memory.dmp

Filesize
4.0MB

Download
memory/2772-4956-0x000000013F0C0000-0x000000013F4B6000-memory.dmp

Filesize
4.0MB

Download
memory/2772-366-0x000000013F0C0000-0x000000013F4B6000-memory.dmp

Filesize
4.0MB

Download
memory/2908-377-0x000000013FDE0000-0x00000001401D6000-memory.dmp

Filesize
4.0MB

Download
memory/2908-4961-0x000000013FDE0000-0x00000001401D6000-memory.dmp

Filesize
4.0MB

Download
memory/3012-4951-0x000000013FB30000-0x000000013FF26000-memory.dmp

Filesize
4.0MB

Download
memory/3012-8-0x000000013FB30000-0x000000013FF26000-memory.dmp

Filesize
4.0MB

Download
memory/3012-4952-0x000000013FB30000-0x000000013FF26000-memory.dmp

Filesize
4.0MB

Download