xmrig | 22433c259717f1acbf203d5da7e46f10aeb890e2e341322aa25ce4ed1bc5a057

Analysis

max time kernel
150s
max time network
143s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
16/05/2024, 07:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bc2e4a97b3198ba269a537d866121df0_NeikiAnalytics.exe
Size

1.9MB
MD5

bc2e4a97b3198ba269a537d866121df0
SHA1

c9b5f59aaffe11bad1a20b659fcbceac62b66f9e
SHA256

22433c259717f1acbf203d5da7e46f10aeb890e2e341322aa25ce4ed1bc5a057
SHA512

2c9578f03e1269571382f5f71f01764a9427bc8a558688eacd534cec057b86370ebe9dd7477ef03152ac783641c8b685882925fa2036e1757bf9504fec1ed36e
SSDEEP

49152:Lz071uv4BPMkibTIA5lCx7kvRWa4pXY21UMeL:NABM

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 20 IoCs

miner

resource	yara_rule
behavioral1/memory/2500-85-0x000000013F900000-0x000000013FCF2000-memory.dmp	xmrig
behavioral1/memory/2552-89-0x000000013F5A0000-0x000000013F992000-memory.dmp	xmrig
behavioral1/memory/2496-91-0x000000013FEE0000-0x00000001402D2000-memory.dmp	xmrig
behavioral1/memory/2136-103-0x000000013FB80000-0x000000013FF72000-memory.dmp	xmrig
behavioral1/memory/2808-82-0x000000013F800000-0x000000013FBF2000-memory.dmp	xmrig
behavioral1/memory/2692-81-0x000000013FAE0000-0x000000013FED2000-memory.dmp	xmrig
behavioral1/memory/2164-101-0x000000013F520000-0x000000013F912000-memory.dmp	xmrig
behavioral1/memory/1988-99-0x000000013F540000-0x000000013F932000-memory.dmp	xmrig
behavioral1/memory/2632-94-0x000000013FB30000-0x000000013FF22000-memory.dmp	xmrig
behavioral1/memory/1732-88-0x000000013F800000-0x000000013FBF2000-memory.dmp	xmrig
behavioral1/memory/2812-23-0x000000013F860000-0x000000013FC52000-memory.dmp	xmrig
behavioral1/memory/2136-5014-0x000000013FB80000-0x000000013FF72000-memory.dmp	xmrig
behavioral1/memory/2808-5023-0x000000013F800000-0x000000013FBF2000-memory.dmp	xmrig
behavioral1/memory/2496-5016-0x000000013FEE0000-0x00000001402D2000-memory.dmp	xmrig
behavioral1/memory/2164-5143-0x000000013F520000-0x000000013F912000-memory.dmp	xmrig
behavioral1/memory/2812-5161-0x000000013F860000-0x000000013FC52000-memory.dmp	xmrig
behavioral1/memory/2692-5221-0x000000013FAE0000-0x000000013FED2000-memory.dmp	xmrig
behavioral1/memory/2740-5220-0x000000013F7E0000-0x000000013FBD2000-memory.dmp	xmrig
behavioral1/memory/1732-5219-0x000000013F800000-0x000000013FBF2000-memory.dmp	xmrig
behavioral1/memory/2500-5374-0x000000013F900000-0x000000013FCF2000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
2216	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
2740	MQKPrlI.exe
2812	tjymfsM.exe
2692	YWXBiza.exe
2808	FnDIhSB.exe
2500	qQoURtB.exe
1732	UqOUpMd.exe
2552	mkkkGOR.exe
2496	riUaUnI.exe
2632	eKPyfDD.exe
1988	uUAvXqg.exe
2164	UfogOVV.exe
2136	BOlhQpj.exe
1376	KuIKHEf.exe
1020	ZbmvCNh.exe
1456	sGCwNOB.exe
956	ynhvFmJ.exe
884	IEULYbU.exe
2372	SSmfcnZ.exe
2104	xNWCOKO.exe
2564	MCHnDjw.exe
1284	SsJiRVC.exe
2040	JUNbfgz.exe
2912	iZChVRU.exe
2228	UOzKjdr.exe
1064	clbRsul.exe
1788	yJgwEjX.exe
1712	RfWzMCt.exe
352	AyZUrGk.exe
2000	TtxlNtq.exe
1244	uKtYAcl.exe
692	ASaRJzU.exe
280	euhsAzV.exe
800	dJiHyzh.exe
1480	IeiUxZh.exe
2320	TrPEdEg.exe
1952	RqZesjg.exe
2860	vYdPPTd.exe
988	PIViihm.exe
2800	RaKNgOR.exe
2036	IUAOVTy.exe
1672	WUZzqUF.exe
1540	coDiyZT.exe
2668	PCxrgwl.exe
2712	eldeAdl.exe
836	VqLRecK.exe
2988	mVLVNmt.exe
2208	lVVHmKr.exe
2480	VvKGEDK.exe
2376	zFELgMK.exe
1208	zwuccWg.exe
2120	NZfVxwi.exe
1296	ZiohVmL.exe
860	cuWDziT.exe
2128	nLaXDmY.exe
2220	zLYIOTw.exe
2476	BlteEZt.exe
2708	fPaCKMT.exe
1572	iXNfEmL.exe
2868	PNcNmRZ.exe
2888	CrmrEbU.exe
3092	VtrbdgJ.exe
3124	fpukrQa.exe
3156	OXYiUnS.exe
3188	pZUXMyN.exe

Loads dropped DLL 64 IoCs

pid	Process
2212	bc2e4a97b3198ba269a537d866121df0_NeikiAnalytics.exe
2212	bc2e4a97b3198ba269a537d866121df0_NeikiAnalytics.exe
2212	bc2e4a97b3198ba269a537d866121df0_NeikiAnalytics.exe
2212	bc2e4a97b3198ba269a537d866121df0_NeikiAnalytics.exe
2212	bc2e4a97b3198ba269a537d866121df0_NeikiAnalytics.exe
2212	bc2e4a97b3198ba269a537d866121df0_NeikiAnalytics.exe
2212	bc2e4a97b3198ba269a537d866121df0_NeikiAnalytics.exe
2212	bc2e4a97b3198ba269a537d866121df0_NeikiAnalytics.exe
2212	bc2e4a97b3198ba269a537d866121df0_NeikiAnalytics.exe
2212	bc2e4a97b3198ba269a537d866121df0_NeikiAnalytics.exe
2212	bc2e4a97b3198ba269a537d866121df0_NeikiAnalytics.exe
2212	bc2e4a97b3198ba269a537d866121df0_NeikiAnalytics.exe
2212	bc2e4a97b3198ba269a537d866121df0_NeikiAnalytics.exe
2212	bc2e4a97b3198ba269a537d866121df0_NeikiAnalytics.exe
2212	bc2e4a97b3198ba269a537d866121df0_NeikiAnalytics.exe
2212	bc2e4a97b3198ba269a537d866121df0_NeikiAnalytics.exe
2212	bc2e4a97b3198ba269a537d866121df0_NeikiAnalytics.exe
2212	bc2e4a97b3198ba269a537d866121df0_NeikiAnalytics.exe
2212	bc2e4a97b3198ba269a537d866121df0_NeikiAnalytics.exe
2212	bc2e4a97b3198ba269a537d866121df0_NeikiAnalytics.exe
2212	bc2e4a97b3198ba269a537d866121df0_NeikiAnalytics.exe
2212	bc2e4a97b3198ba269a537d866121df0_NeikiAnalytics.exe
2212	bc2e4a97b3198ba269a537d866121df0_NeikiAnalytics.exe
2212	bc2e4a97b3198ba269a537d866121df0_NeikiAnalytics.exe
2212	bc2e4a97b3198ba269a537d866121df0_NeikiAnalytics.exe
2212	bc2e4a97b3198ba269a537d866121df0_NeikiAnalytics.exe
2212	bc2e4a97b3198ba269a537d866121df0_NeikiAnalytics.exe
2212	bc2e4a97b3198ba269a537d866121df0_NeikiAnalytics.exe
2212	bc2e4a97b3198ba269a537d866121df0_NeikiAnalytics.exe
2212	bc2e4a97b3198ba269a537d866121df0_NeikiAnalytics.exe
2212	bc2e4a97b3198ba269a537d866121df0_NeikiAnalytics.exe
2212	bc2e4a97b3198ba269a537d866121df0_NeikiAnalytics.exe
2212	bc2e4a97b3198ba269a537d866121df0_NeikiAnalytics.exe
2212	bc2e4a97b3198ba269a537d866121df0_NeikiAnalytics.exe
2212	bc2e4a97b3198ba269a537d866121df0_NeikiAnalytics.exe
2212	bc2e4a97b3198ba269a537d866121df0_NeikiAnalytics.exe
2212	bc2e4a97b3198ba269a537d866121df0_NeikiAnalytics.exe
2212	bc2e4a97b3198ba269a537d866121df0_NeikiAnalytics.exe
2212	bc2e4a97b3198ba269a537d866121df0_NeikiAnalytics.exe
2212	bc2e4a97b3198ba269a537d866121df0_NeikiAnalytics.exe
2212	bc2e4a97b3198ba269a537d866121df0_NeikiAnalytics.exe
2212	bc2e4a97b3198ba269a537d866121df0_NeikiAnalytics.exe
2212	bc2e4a97b3198ba269a537d866121df0_NeikiAnalytics.exe
2212	bc2e4a97b3198ba269a537d866121df0_NeikiAnalytics.exe
2212	bc2e4a97b3198ba269a537d866121df0_NeikiAnalytics.exe
2212	bc2e4a97b3198ba269a537d866121df0_NeikiAnalytics.exe
2212	bc2e4a97b3198ba269a537d866121df0_NeikiAnalytics.exe
2212	bc2e4a97b3198ba269a537d866121df0_NeikiAnalytics.exe
2212	bc2e4a97b3198ba269a537d866121df0_NeikiAnalytics.exe
2212	bc2e4a97b3198ba269a537d866121df0_NeikiAnalytics.exe
2212	bc2e4a97b3198ba269a537d866121df0_NeikiAnalytics.exe
2212	bc2e4a97b3198ba269a537d866121df0_NeikiAnalytics.exe
2212	bc2e4a97b3198ba269a537d866121df0_NeikiAnalytics.exe
2212	bc2e4a97b3198ba269a537d866121df0_NeikiAnalytics.exe
2212	bc2e4a97b3198ba269a537d866121df0_NeikiAnalytics.exe
2212	bc2e4a97b3198ba269a537d866121df0_NeikiAnalytics.exe
2212	bc2e4a97b3198ba269a537d866121df0_NeikiAnalytics.exe
2212	bc2e4a97b3198ba269a537d866121df0_NeikiAnalytics.exe
2212	bc2e4a97b3198ba269a537d866121df0_NeikiAnalytics.exe
2212	bc2e4a97b3198ba269a537d866121df0_NeikiAnalytics.exe
2212	bc2e4a97b3198ba269a537d866121df0_NeikiAnalytics.exe
2212	bc2e4a97b3198ba269a537d866121df0_NeikiAnalytics.exe
2212	bc2e4a97b3198ba269a537d866121df0_NeikiAnalytics.exe
2212	bc2e4a97b3198ba269a537d866121df0_NeikiAnalytics.exe

UPX packed file 57 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2212-0-0x000000013F7E0000-0x000000013FBD2000-memory.dmp	upx
behavioral1/files/0x000b00000001225d-6.dat	upx
behavioral1/memory/2740-8-0x000000013F7E0000-0x000000013FBD2000-memory.dmp	upx
behavioral1/files/0x0036000000015d42-16.dat	upx
behavioral1/files/0x0008000000015f54-11.dat	upx
behavioral1/files/0x00090000000165d4-39.dat	upx
behavioral1/files/0x00070000000162cc-43.dat	upx
behavioral1/files/0x0006000000016d44-53.dat	upx
behavioral1/files/0x0006000000016d55-64.dat	upx
behavioral1/files/0x0006000000016d6c-71.dat	upx
behavioral1/files/0x0007000000016d3b-48.dat	upx
behavioral1/memory/2500-85-0x000000013F900000-0x000000013FCF2000-memory.dmp	upx
behavioral1/memory/2552-89-0x000000013F5A0000-0x000000013F992000-memory.dmp	upx
behavioral1/memory/2496-91-0x000000013FEE0000-0x00000001402D2000-memory.dmp	upx
behavioral1/files/0x0006000000016d78-97.dat	upx
behavioral1/memory/2136-103-0x000000013FB80000-0x000000013FF72000-memory.dmp	upx
behavioral1/files/0x0006000000016d70-105.dat	upx
behavioral1/files/0x0006000000016da0-111.dat	upx
behavioral1/files/0x0006000000016dc8-125.dat	upx
behavioral1/files/0x00060000000171ba-136.dat	upx
behavioral1/files/0x00060000000175e8-163.dat	upx
behavioral1/files/0x0006000000016db2-117.dat	upx
behavioral1/files/0x00060000000175f4-165.dat	upx
behavioral1/files/0x0006000000017568-157.dat	upx
behavioral1/files/0x00060000000173d3-150.dat	upx
behavioral1/files/0x0006000000016dd1-130.dat	upx
behavioral1/files/0x0005000000018784-186.dat	upx
behavioral1/files/0x0005000000018711-179.dat	upx
behavioral1/files/0x0005000000018701-172.dat	upx
behavioral1/files/0x000600000001720f-142.dat	upx
behavioral1/files/0x000500000001878b-191.dat	upx
behavioral1/files/0x000500000001873a-184.dat	upx
behavioral1/files/0x000500000001870d-177.dat	upx
behavioral1/files/0x00050000000186ff-170.dat	upx
behavioral1/files/0x00060000000173d6-156.dat	upx
behavioral1/files/0x00060000000173b4-147.dat	upx
behavioral1/files/0x0036000000015d72-115.dat	upx
behavioral1/memory/2808-82-0x000000013F800000-0x000000013FBF2000-memory.dmp	upx
behavioral1/memory/2692-81-0x000000013FAE0000-0x000000013FED2000-memory.dmp	upx
behavioral1/files/0x0006000000016d68-69.dat	upx
behavioral1/files/0x0006000000016d4c-59.dat	upx
behavioral1/memory/2164-101-0x000000013F520000-0x000000013F912000-memory.dmp	upx
behavioral1/memory/1988-99-0x000000013F540000-0x000000013F932000-memory.dmp	upx
behavioral1/memory/2632-94-0x000000013FB30000-0x000000013FF22000-memory.dmp	upx
behavioral1/memory/1732-88-0x000000013F800000-0x000000013FBF2000-memory.dmp	upx
behavioral1/files/0x000f000000003683-28.dat	upx
behavioral1/files/0x0008000000016133-34.dat	upx
behavioral1/memory/2812-23-0x000000013F860000-0x000000013FC52000-memory.dmp	upx
behavioral1/memory/2136-5014-0x000000013FB80000-0x000000013FF72000-memory.dmp	upx
behavioral1/memory/2808-5023-0x000000013F800000-0x000000013FBF2000-memory.dmp	upx
behavioral1/memory/2496-5016-0x000000013FEE0000-0x00000001402D2000-memory.dmp	upx
behavioral1/memory/2164-5143-0x000000013F520000-0x000000013F912000-memory.dmp	upx
behavioral1/memory/2812-5161-0x000000013F860000-0x000000013FC52000-memory.dmp	upx
behavioral1/memory/2692-5221-0x000000013FAE0000-0x000000013FED2000-memory.dmp	upx
behavioral1/memory/2740-5220-0x000000013F7E0000-0x000000013FBD2000-memory.dmp	upx
behavioral1/memory/1732-5219-0x000000013F800000-0x000000013FBF2000-memory.dmp	upx
behavioral1/memory/2500-5374-0x000000013F900000-0x000000013FCF2000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\lTWBDeO.exe	bc2e4a97b3198ba269a537d866121df0_NeikiAnalytics.exe
File created	C:\Windows\System\zMAZNtU.exe	bc2e4a97b3198ba269a537d866121df0_NeikiAnalytics.exe
File created	C:\Windows\System\HGNUsyE.exe	bc2e4a97b3198ba269a537d866121df0_NeikiAnalytics.exe
File created	C:\Windows\System\hXVzODG.exe	bc2e4a97b3198ba269a537d866121df0_NeikiAnalytics.exe
File created	C:\Windows\System\GKKFgyi.exe	bc2e4a97b3198ba269a537d866121df0_NeikiAnalytics.exe
File created	C:\Windows\System\vaCUUPp.exe	bc2e4a97b3198ba269a537d866121df0_NeikiAnalytics.exe
File created	C:\Windows\System\MOQAEJb.exe	bc2e4a97b3198ba269a537d866121df0_NeikiAnalytics.exe
File created	C:\Windows\System\EAsAtYO.exe	bc2e4a97b3198ba269a537d866121df0_NeikiAnalytics.exe
File created	C:\Windows\System\DcwWgnC.exe	bc2e4a97b3198ba269a537d866121df0_NeikiAnalytics.exe
File created	C:\Windows\System\tmKHLMf.exe	bc2e4a97b3198ba269a537d866121df0_NeikiAnalytics.exe
File created	C:\Windows\System\AbTJIwZ.exe	bc2e4a97b3198ba269a537d866121df0_NeikiAnalytics.exe
File created	C:\Windows\System\bvhloyh.exe	bc2e4a97b3198ba269a537d866121df0_NeikiAnalytics.exe
File created	C:\Windows\System\MzDkTeg.exe	bc2e4a97b3198ba269a537d866121df0_NeikiAnalytics.exe
File created	C:\Windows\System\lLaPnqM.exe	bc2e4a97b3198ba269a537d866121df0_NeikiAnalytics.exe
File created	C:\Windows\System\SiOhILU.exe	bc2e4a97b3198ba269a537d866121df0_NeikiAnalytics.exe
File created	C:\Windows\System\LZjUFfX.exe	bc2e4a97b3198ba269a537d866121df0_NeikiAnalytics.exe
File created	C:\Windows\System\PupJLhM.exe	bc2e4a97b3198ba269a537d866121df0_NeikiAnalytics.exe
File created	C:\Windows\System\gTLERXQ.exe	bc2e4a97b3198ba269a537d866121df0_NeikiAnalytics.exe
File created	C:\Windows\System\gJNPWDw.exe	bc2e4a97b3198ba269a537d866121df0_NeikiAnalytics.exe
File created	C:\Windows\System\mFUXyuC.exe	bc2e4a97b3198ba269a537d866121df0_NeikiAnalytics.exe
File created	C:\Windows\System\iXMZbZS.exe	bc2e4a97b3198ba269a537d866121df0_NeikiAnalytics.exe
File created	C:\Windows\System\QuecGWx.exe	bc2e4a97b3198ba269a537d866121df0_NeikiAnalytics.exe
File created	C:\Windows\System\hPzSBZW.exe	bc2e4a97b3198ba269a537d866121df0_NeikiAnalytics.exe
File created	C:\Windows\System\oJfsgrP.exe	bc2e4a97b3198ba269a537d866121df0_NeikiAnalytics.exe
File created	C:\Windows\System\KgYWRfw.exe	bc2e4a97b3198ba269a537d866121df0_NeikiAnalytics.exe
File created	C:\Windows\System\JwXJKMW.exe	bc2e4a97b3198ba269a537d866121df0_NeikiAnalytics.exe
File created	C:\Windows\System\IZRSsZk.exe	bc2e4a97b3198ba269a537d866121df0_NeikiAnalytics.exe
File created	C:\Windows\System\SfXrMoC.exe	bc2e4a97b3198ba269a537d866121df0_NeikiAnalytics.exe
File created	C:\Windows\System\iIWhESh.exe	bc2e4a97b3198ba269a537d866121df0_NeikiAnalytics.exe
File created	C:\Windows\System\qznRxJD.exe	bc2e4a97b3198ba269a537d866121df0_NeikiAnalytics.exe
File created	C:\Windows\System\lBpgTiB.exe	bc2e4a97b3198ba269a537d866121df0_NeikiAnalytics.exe
File created	C:\Windows\System\RqHIJoD.exe	bc2e4a97b3198ba269a537d866121df0_NeikiAnalytics.exe
File created	C:\Windows\System\qzBBmiE.exe	bc2e4a97b3198ba269a537d866121df0_NeikiAnalytics.exe
File created	C:\Windows\System\pzbeJho.exe	bc2e4a97b3198ba269a537d866121df0_NeikiAnalytics.exe
File created	C:\Windows\System\hVZySNW.exe	bc2e4a97b3198ba269a537d866121df0_NeikiAnalytics.exe
File created	C:\Windows\System\TUncVju.exe	bc2e4a97b3198ba269a537d866121df0_NeikiAnalytics.exe
File created	C:\Windows\System\zGSDscf.exe	bc2e4a97b3198ba269a537d866121df0_NeikiAnalytics.exe
File created	C:\Windows\System\hrdEZOW.exe	bc2e4a97b3198ba269a537d866121df0_NeikiAnalytics.exe
File created	C:\Windows\System\yLDJuPH.exe	bc2e4a97b3198ba269a537d866121df0_NeikiAnalytics.exe
File created	C:\Windows\System\PLWVmYG.exe	bc2e4a97b3198ba269a537d866121df0_NeikiAnalytics.exe
File created	C:\Windows\System\fPDOGaa.exe	bc2e4a97b3198ba269a537d866121df0_NeikiAnalytics.exe
File created	C:\Windows\System\XIKoNLi.exe	bc2e4a97b3198ba269a537d866121df0_NeikiAnalytics.exe
File created	C:\Windows\System\NNlAWTA.exe	bc2e4a97b3198ba269a537d866121df0_NeikiAnalytics.exe
File created	C:\Windows\System\sbqPUQL.exe	bc2e4a97b3198ba269a537d866121df0_NeikiAnalytics.exe
File created	C:\Windows\System\iRSHszf.exe	bc2e4a97b3198ba269a537d866121df0_NeikiAnalytics.exe
File created	C:\Windows\System\oqPfrwQ.exe	bc2e4a97b3198ba269a537d866121df0_NeikiAnalytics.exe
File created	C:\Windows\System\WMcWpAd.exe	bc2e4a97b3198ba269a537d866121df0_NeikiAnalytics.exe
File created	C:\Windows\System\UgGfNyj.exe	bc2e4a97b3198ba269a537d866121df0_NeikiAnalytics.exe
File created	C:\Windows\System\dHhfVyE.exe	bc2e4a97b3198ba269a537d866121df0_NeikiAnalytics.exe
File created	C:\Windows\System\JhhFxkd.exe	bc2e4a97b3198ba269a537d866121df0_NeikiAnalytics.exe
File created	C:\Windows\System\UwAYOEj.exe	bc2e4a97b3198ba269a537d866121df0_NeikiAnalytics.exe
File created	C:\Windows\System\XsnWPqh.exe	bc2e4a97b3198ba269a537d866121df0_NeikiAnalytics.exe
File created	C:\Windows\System\WViMvfl.exe	bc2e4a97b3198ba269a537d866121df0_NeikiAnalytics.exe
File created	C:\Windows\System\cEymYpX.exe	bc2e4a97b3198ba269a537d866121df0_NeikiAnalytics.exe
File created	C:\Windows\System\COMRpvK.exe	bc2e4a97b3198ba269a537d866121df0_NeikiAnalytics.exe
File created	C:\Windows\System\fITrXUQ.exe	bc2e4a97b3198ba269a537d866121df0_NeikiAnalytics.exe
File created	C:\Windows\System\lXBvyKr.exe	bc2e4a97b3198ba269a537d866121df0_NeikiAnalytics.exe
File created	C:\Windows\System\wkxszpc.exe	bc2e4a97b3198ba269a537d866121df0_NeikiAnalytics.exe
File created	C:\Windows\System\xwRsHjY.exe	bc2e4a97b3198ba269a537d866121df0_NeikiAnalytics.exe
File created	C:\Windows\System\mPemWqx.exe	bc2e4a97b3198ba269a537d866121df0_NeikiAnalytics.exe
File created	C:\Windows\System\PpAMlIV.exe	bc2e4a97b3198ba269a537d866121df0_NeikiAnalytics.exe
File created	C:\Windows\System\XAORpGR.exe	bc2e4a97b3198ba269a537d866121df0_NeikiAnalytics.exe
File created	C:\Windows\System\nCudlnK.exe	bc2e4a97b3198ba269a537d866121df0_NeikiAnalytics.exe
File created	C:\Windows\System\YJFYfPa.exe	bc2e4a97b3198ba269a537d866121df0_NeikiAnalytics.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2216	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2212	bc2e4a97b3198ba269a537d866121df0_NeikiAnalytics.exe
Token: SeLockMemoryPrivilege	2212	bc2e4a97b3198ba269a537d866121df0_NeikiAnalytics.exe
Token: SeDebugPrivilege	2216	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2212 wrote to memory of 2216	2212	bc2e4a97b3198ba269a537d866121df0_NeikiAnalytics.exe	29
PID 2212 wrote to memory of 2216	2212	bc2e4a97b3198ba269a537d866121df0_NeikiAnalytics.exe	29
PID 2212 wrote to memory of 2216	2212	bc2e4a97b3198ba269a537d866121df0_NeikiAnalytics.exe	29
PID 2212 wrote to memory of 2740	2212	bc2e4a97b3198ba269a537d866121df0_NeikiAnalytics.exe	30
PID 2212 wrote to memory of 2740	2212	bc2e4a97b3198ba269a537d866121df0_NeikiAnalytics.exe	30
PID 2212 wrote to memory of 2740	2212	bc2e4a97b3198ba269a537d866121df0_NeikiAnalytics.exe	30
PID 2212 wrote to memory of 2812	2212	bc2e4a97b3198ba269a537d866121df0_NeikiAnalytics.exe	31
PID 2212 wrote to memory of 2812	2212	bc2e4a97b3198ba269a537d866121df0_NeikiAnalytics.exe	31
PID 2212 wrote to memory of 2812	2212	bc2e4a97b3198ba269a537d866121df0_NeikiAnalytics.exe	31
PID 2212 wrote to memory of 2692	2212	bc2e4a97b3198ba269a537d866121df0_NeikiAnalytics.exe	32
PID 2212 wrote to memory of 2692	2212	bc2e4a97b3198ba269a537d866121df0_NeikiAnalytics.exe	32
PID 2212 wrote to memory of 2692	2212	bc2e4a97b3198ba269a537d866121df0_NeikiAnalytics.exe	32
PID 2212 wrote to memory of 2808	2212	bc2e4a97b3198ba269a537d866121df0_NeikiAnalytics.exe	33
PID 2212 wrote to memory of 2808	2212	bc2e4a97b3198ba269a537d866121df0_NeikiAnalytics.exe	33
PID 2212 wrote to memory of 2808	2212	bc2e4a97b3198ba269a537d866121df0_NeikiAnalytics.exe	33
PID 2212 wrote to memory of 2500	2212	bc2e4a97b3198ba269a537d866121df0_NeikiAnalytics.exe	34
PID 2212 wrote to memory of 2500	2212	bc2e4a97b3198ba269a537d866121df0_NeikiAnalytics.exe	34
PID 2212 wrote to memory of 2500	2212	bc2e4a97b3198ba269a537d866121df0_NeikiAnalytics.exe	34
PID 2212 wrote to memory of 2552	2212	bc2e4a97b3198ba269a537d866121df0_NeikiAnalytics.exe	35
PID 2212 wrote to memory of 2552	2212	bc2e4a97b3198ba269a537d866121df0_NeikiAnalytics.exe	35
PID 2212 wrote to memory of 2552	2212	bc2e4a97b3198ba269a537d866121df0_NeikiAnalytics.exe	35
PID 2212 wrote to memory of 1732	2212	bc2e4a97b3198ba269a537d866121df0_NeikiAnalytics.exe	36
PID 2212 wrote to memory of 1732	2212	bc2e4a97b3198ba269a537d866121df0_NeikiAnalytics.exe	36
PID 2212 wrote to memory of 1732	2212	bc2e4a97b3198ba269a537d866121df0_NeikiAnalytics.exe	36
PID 2212 wrote to memory of 2496	2212	bc2e4a97b3198ba269a537d866121df0_NeikiAnalytics.exe	37
PID 2212 wrote to memory of 2496	2212	bc2e4a97b3198ba269a537d866121df0_NeikiAnalytics.exe	37
PID 2212 wrote to memory of 2496	2212	bc2e4a97b3198ba269a537d866121df0_NeikiAnalytics.exe	37
PID 2212 wrote to memory of 2632	2212	bc2e4a97b3198ba269a537d866121df0_NeikiAnalytics.exe	38
PID 2212 wrote to memory of 2632	2212	bc2e4a97b3198ba269a537d866121df0_NeikiAnalytics.exe	38
PID 2212 wrote to memory of 2632	2212	bc2e4a97b3198ba269a537d866121df0_NeikiAnalytics.exe	38
PID 2212 wrote to memory of 1988	2212	bc2e4a97b3198ba269a537d866121df0_NeikiAnalytics.exe	39
PID 2212 wrote to memory of 1988	2212	bc2e4a97b3198ba269a537d866121df0_NeikiAnalytics.exe	39
PID 2212 wrote to memory of 1988	2212	bc2e4a97b3198ba269a537d866121df0_NeikiAnalytics.exe	39
PID 2212 wrote to memory of 2164	2212	bc2e4a97b3198ba269a537d866121df0_NeikiAnalytics.exe	40
PID 2212 wrote to memory of 2164	2212	bc2e4a97b3198ba269a537d866121df0_NeikiAnalytics.exe	40
PID 2212 wrote to memory of 2164	2212	bc2e4a97b3198ba269a537d866121df0_NeikiAnalytics.exe	40
PID 2212 wrote to memory of 2136	2212	bc2e4a97b3198ba269a537d866121df0_NeikiAnalytics.exe	41
PID 2212 wrote to memory of 2136	2212	bc2e4a97b3198ba269a537d866121df0_NeikiAnalytics.exe	41
PID 2212 wrote to memory of 2136	2212	bc2e4a97b3198ba269a537d866121df0_NeikiAnalytics.exe	41
PID 2212 wrote to memory of 1376	2212	bc2e4a97b3198ba269a537d866121df0_NeikiAnalytics.exe	42
PID 2212 wrote to memory of 1376	2212	bc2e4a97b3198ba269a537d866121df0_NeikiAnalytics.exe	42
PID 2212 wrote to memory of 1376	2212	bc2e4a97b3198ba269a537d866121df0_NeikiAnalytics.exe	42
PID 2212 wrote to memory of 1456	2212	bc2e4a97b3198ba269a537d866121df0_NeikiAnalytics.exe	43
PID 2212 wrote to memory of 1456	2212	bc2e4a97b3198ba269a537d866121df0_NeikiAnalytics.exe	43
PID 2212 wrote to memory of 1456	2212	bc2e4a97b3198ba269a537d866121df0_NeikiAnalytics.exe	43
PID 2212 wrote to memory of 1020	2212	bc2e4a97b3198ba269a537d866121df0_NeikiAnalytics.exe	44
PID 2212 wrote to memory of 1020	2212	bc2e4a97b3198ba269a537d866121df0_NeikiAnalytics.exe	44
PID 2212 wrote to memory of 1020	2212	bc2e4a97b3198ba269a537d866121df0_NeikiAnalytics.exe	44
PID 2212 wrote to memory of 956	2212	bc2e4a97b3198ba269a537d866121df0_NeikiAnalytics.exe	45
PID 2212 wrote to memory of 956	2212	bc2e4a97b3198ba269a537d866121df0_NeikiAnalytics.exe	45
PID 2212 wrote to memory of 956	2212	bc2e4a97b3198ba269a537d866121df0_NeikiAnalytics.exe	45
PID 2212 wrote to memory of 884	2212	bc2e4a97b3198ba269a537d866121df0_NeikiAnalytics.exe	46
PID 2212 wrote to memory of 884	2212	bc2e4a97b3198ba269a537d866121df0_NeikiAnalytics.exe	46
PID 2212 wrote to memory of 884	2212	bc2e4a97b3198ba269a537d866121df0_NeikiAnalytics.exe	46
PID 2212 wrote to memory of 2372	2212	bc2e4a97b3198ba269a537d866121df0_NeikiAnalytics.exe	47
PID 2212 wrote to memory of 2372	2212	bc2e4a97b3198ba269a537d866121df0_NeikiAnalytics.exe	47
PID 2212 wrote to memory of 2372	2212	bc2e4a97b3198ba269a537d866121df0_NeikiAnalytics.exe	47
PID 2212 wrote to memory of 2104	2212	bc2e4a97b3198ba269a537d866121df0_NeikiAnalytics.exe	48
PID 2212 wrote to memory of 2104	2212	bc2e4a97b3198ba269a537d866121df0_NeikiAnalytics.exe	48
PID 2212 wrote to memory of 2104	2212	bc2e4a97b3198ba269a537d866121df0_NeikiAnalytics.exe	48
PID 2212 wrote to memory of 2564	2212	bc2e4a97b3198ba269a537d866121df0_NeikiAnalytics.exe	49
PID 2212 wrote to memory of 2564	2212	bc2e4a97b3198ba269a537d866121df0_NeikiAnalytics.exe	49
PID 2212 wrote to memory of 2564	2212	bc2e4a97b3198ba269a537d866121df0_NeikiAnalytics.exe	49
PID 2212 wrote to memory of 1284	2212	bc2e4a97b3198ba269a537d866121df0_NeikiAnalytics.exe	50

C:\Users\Admin\AppData\Local\Temp\bc2e4a97b3198ba269a537d866121df0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\bc2e4a97b3198ba269a537d866121df0_NeikiAnalytics.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2212
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2216
- C:\Windows\System\MQKPrlI.exe
  C:\Windows\System\MQKPrlI.exe
  2⤵
  - Executes dropped EXE
  PID:2740
- C:\Windows\System\tjymfsM.exe
  C:\Windows\System\tjymfsM.exe
  2⤵
  - Executes dropped EXE
  PID:2812
- C:\Windows\System\YWXBiza.exe
  C:\Windows\System\YWXBiza.exe
  2⤵
  - Executes dropped EXE
  PID:2692
- C:\Windows\System\FnDIhSB.exe
  C:\Windows\System\FnDIhSB.exe
  2⤵
  - Executes dropped EXE
  PID:2808
- C:\Windows\System\qQoURtB.exe
  C:\Windows\System\qQoURtB.exe
  2⤵
  - Executes dropped EXE
  PID:2500
- C:\Windows\System\mkkkGOR.exe
  C:\Windows\System\mkkkGOR.exe
  2⤵
  - Executes dropped EXE
  PID:2552
- C:\Windows\System\UqOUpMd.exe
  C:\Windows\System\UqOUpMd.exe
  2⤵
  - Executes dropped EXE
  PID:1732
- C:\Windows\System\riUaUnI.exe
  C:\Windows\System\riUaUnI.exe
  2⤵
  - Executes dropped EXE
  PID:2496
- C:\Windows\System\eKPyfDD.exe
  C:\Windows\System\eKPyfDD.exe
  2⤵
  - Executes dropped EXE
  PID:2632
- C:\Windows\System\uUAvXqg.exe
  C:\Windows\System\uUAvXqg.exe
  2⤵
  - Executes dropped EXE
  PID:1988
- C:\Windows\System\UfogOVV.exe
  C:\Windows\System\UfogOVV.exe
  2⤵
  - Executes dropped EXE
  PID:2164
- C:\Windows\System\BOlhQpj.exe
  C:\Windows\System\BOlhQpj.exe
  2⤵
  - Executes dropped EXE
  PID:2136
- C:\Windows\System\KuIKHEf.exe
  C:\Windows\System\KuIKHEf.exe
  2⤵
  - Executes dropped EXE
  PID:1376
- C:\Windows\System\sGCwNOB.exe
  C:\Windows\System\sGCwNOB.exe
  2⤵
  - Executes dropped EXE
  PID:1456
- C:\Windows\System\ZbmvCNh.exe
  C:\Windows\System\ZbmvCNh.exe
  2⤵
  - Executes dropped EXE
  PID:1020
- C:\Windows\System\ynhvFmJ.exe
  C:\Windows\System\ynhvFmJ.exe
  2⤵
  - Executes dropped EXE
  PID:956
- C:\Windows\System\IEULYbU.exe
  C:\Windows\System\IEULYbU.exe
  2⤵
  - Executes dropped EXE
  PID:884
- C:\Windows\System\SSmfcnZ.exe
  C:\Windows\System\SSmfcnZ.exe
  2⤵
  - Executes dropped EXE
  PID:2372
- C:\Windows\System\xNWCOKO.exe
  C:\Windows\System\xNWCOKO.exe
  2⤵
  - Executes dropped EXE
  PID:2104
- C:\Windows\System\MCHnDjw.exe
  C:\Windows\System\MCHnDjw.exe
  2⤵
  - Executes dropped EXE
  PID:2564
- C:\Windows\System\SsJiRVC.exe
  C:\Windows\System\SsJiRVC.exe
  2⤵
  - Executes dropped EXE
  PID:1284
- C:\Windows\System\JUNbfgz.exe
  C:\Windows\System\JUNbfgz.exe
  2⤵
  - Executes dropped EXE
  PID:2040
- C:\Windows\System\iZChVRU.exe
  C:\Windows\System\iZChVRU.exe
  2⤵
  - Executes dropped EXE
  PID:2912
- C:\Windows\System\WGigOvx.exe
  C:\Windows\System\WGigOvx.exe
  2⤵
  PID:2412
- C:\Windows\System\UOzKjdr.exe
  C:\Windows\System\UOzKjdr.exe
  2⤵
  - Executes dropped EXE
  PID:2228
- C:\Windows\System\pcMAhqF.exe
  C:\Windows\System\pcMAhqF.exe
  2⤵
  PID:2880
- C:\Windows\System\clbRsul.exe
  C:\Windows\System\clbRsul.exe
  2⤵
  - Executes dropped EXE
  PID:1064
- C:\Windows\System\HMGajBq.exe
  C:\Windows\System\HMGajBq.exe
  2⤵
  PID:1408
- C:\Windows\System\yJgwEjX.exe
  C:\Windows\System\yJgwEjX.exe
  2⤵
  - Executes dropped EXE
  PID:1788
- C:\Windows\System\SnpCXpr.exe
  C:\Windows\System\SnpCXpr.exe
  2⤵
  PID:1740
- C:\Windows\System\RfWzMCt.exe
  C:\Windows\System\RfWzMCt.exe
  2⤵
  - Executes dropped EXE
  PID:1712
- C:\Windows\System\ftURxsi.exe
  C:\Windows\System\ftURxsi.exe
  2⤵
  PID:3068
- C:\Windows\System\AyZUrGk.exe
  C:\Windows\System\AyZUrGk.exe
  2⤵
  - Executes dropped EXE
  PID:352
- C:\Windows\System\grmHEsL.exe
  C:\Windows\System\grmHEsL.exe
  2⤵
  PID:2424
- C:\Windows\System\TtxlNtq.exe
  C:\Windows\System\TtxlNtq.exe
  2⤵
  - Executes dropped EXE
  PID:2000
- C:\Windows\System\vtxuYkj.exe
  C:\Windows\System\vtxuYkj.exe
  2⤵
  PID:768
- C:\Windows\System\uKtYAcl.exe
  C:\Windows\System\uKtYAcl.exe
  2⤵
  - Executes dropped EXE
  PID:1244
- C:\Windows\System\wdQGLWd.exe
  C:\Windows\System\wdQGLWd.exe
  2⤵
  PID:1224
- C:\Windows\System\ASaRJzU.exe
  C:\Windows\System\ASaRJzU.exe
  2⤵
  - Executes dropped EXE
  PID:692
- C:\Windows\System\elZuoTN.exe
  C:\Windows\System\elZuoTN.exe
  2⤵
  PID:1560
- C:\Windows\System\euhsAzV.exe
  C:\Windows\System\euhsAzV.exe
  2⤵
  - Executes dropped EXE
  PID:280
- C:\Windows\System\acvZidf.exe
  C:\Windows\System\acvZidf.exe
  2⤵
  PID:336
- C:\Windows\System\dJiHyzh.exe
  C:\Windows\System\dJiHyzh.exe
  2⤵
  - Executes dropped EXE
  PID:800
- C:\Windows\System\iuVMBDJ.exe
  C:\Windows\System\iuVMBDJ.exe
  2⤵
  PID:908
- C:\Windows\System\IeiUxZh.exe
  C:\Windows\System\IeiUxZh.exe
  2⤵
  - Executes dropped EXE
  PID:1480
- C:\Windows\System\eIKHpop.exe
  C:\Windows\System\eIKHpop.exe
  2⤵
  PID:3000
- C:\Windows\System\TrPEdEg.exe
  C:\Windows\System\TrPEdEg.exe
  2⤵
  - Executes dropped EXE
  PID:2320
- C:\Windows\System\rafTLen.exe
  C:\Windows\System\rafTLen.exe
  2⤵
  PID:2820
- C:\Windows\System\RqZesjg.exe
  C:\Windows\System\RqZesjg.exe
  2⤵
  - Executes dropped EXE
  PID:1952
- C:\Windows\System\pOnZdYz.exe
  C:\Windows\System\pOnZdYz.exe
  2⤵
  PID:788
- C:\Windows\System\vYdPPTd.exe
  C:\Windows\System\vYdPPTd.exe
  2⤵
  - Executes dropped EXE
  PID:2860
- C:\Windows\System\ABAxjRP.exe
  C:\Windows\System\ABAxjRP.exe
  2⤵
  PID:2804
- C:\Windows\System\PIViihm.exe
  C:\Windows\System\PIViihm.exe
  2⤵
  - Executes dropped EXE
  PID:988
- C:\Windows\System\rJufMin.exe
  C:\Windows\System\rJufMin.exe
  2⤵
  PID:1720
- C:\Windows\System\RaKNgOR.exe
  C:\Windows\System\RaKNgOR.exe
  2⤵
  - Executes dropped EXE
  PID:2800
- C:\Windows\System\aMrIDdU.exe
  C:\Windows\System\aMrIDdU.exe
  2⤵
  PID:2380
- C:\Windows\System\IUAOVTy.exe
  C:\Windows\System\IUAOVTy.exe
  2⤵
  - Executes dropped EXE
  PID:2036
- C:\Windows\System\nhYtNZH.exe
  C:\Windows\System\nhYtNZH.exe
  2⤵
  PID:108
- C:\Windows\System\WUZzqUF.exe
  C:\Windows\System\WUZzqUF.exe
  2⤵
  - Executes dropped EXE
  PID:1672
- C:\Windows\System\lyEPxgF.exe
  C:\Windows\System\lyEPxgF.exe
  2⤵
  PID:1544
- C:\Windows\System\coDiyZT.exe
  C:\Windows\System\coDiyZT.exe
  2⤵
  - Executes dropped EXE
  PID:1540
- C:\Windows\System\MtOsteK.exe
  C:\Windows\System\MtOsteK.exe
  2⤵
  PID:872
- C:\Windows\System\PCxrgwl.exe
  C:\Windows\System\PCxrgwl.exe
  2⤵
  - Executes dropped EXE
  PID:2668
- C:\Windows\System\CTjMeqI.exe
  C:\Windows\System\CTjMeqI.exe
  2⤵
  PID:2472
- C:\Windows\System\eldeAdl.exe
  C:\Windows\System\eldeAdl.exe
  2⤵
  - Executes dropped EXE
  PID:2712
- C:\Windows\System\xaQZrNs.exe
  C:\Windows\System\xaQZrNs.exe
  2⤵
  PID:2248
- C:\Windows\System\VqLRecK.exe
  C:\Windows\System\VqLRecK.exe
  2⤵
  - Executes dropped EXE
  PID:836
- C:\Windows\System\TbtbxlG.exe
  C:\Windows\System\TbtbxlG.exe
  2⤵
  PID:2520
- C:\Windows\System\mVLVNmt.exe
  C:\Windows\System\mVLVNmt.exe
  2⤵
  - Executes dropped EXE
  PID:2988
- C:\Windows\System\zGglOHz.exe
  C:\Windows\System\zGglOHz.exe
  2⤵
  PID:1684
- C:\Windows\System\lVVHmKr.exe
  C:\Windows\System\lVVHmKr.exe
  2⤵
  - Executes dropped EXE
  PID:2208
- C:\Windows\System\hURsIKx.exe
  C:\Windows\System\hURsIKx.exe
  2⤵
  PID:2536
- C:\Windows\System\VvKGEDK.exe
  C:\Windows\System\VvKGEDK.exe
  2⤵
  - Executes dropped EXE
  PID:2480
- C:\Windows\System\yTZlkRB.exe
  C:\Windows\System\yTZlkRB.exe
  2⤵
  PID:1620
- C:\Windows\System\zFELgMK.exe
  C:\Windows\System\zFELgMK.exe
  2⤵
  - Executes dropped EXE
  PID:2376
- C:\Windows\System\YNANCHQ.exe
  C:\Windows\System\YNANCHQ.exe
  2⤵
  PID:888
- C:\Windows\System\zwuccWg.exe
  C:\Windows\System\zwuccWg.exe
  2⤵
  - Executes dropped EXE
  PID:1208
- C:\Windows\System\PDwBcpX.exe
  C:\Windows\System\PDwBcpX.exe
  2⤵
  PID:580
- C:\Windows\System\NZfVxwi.exe
  C:\Windows\System\NZfVxwi.exe
  2⤵
  - Executes dropped EXE
  PID:2120
- C:\Windows\System\wxnZVJR.exe
  C:\Windows\System\wxnZVJR.exe
  2⤵
  PID:2824
- C:\Windows\System\ZiohVmL.exe
  C:\Windows\System\ZiohVmL.exe
  2⤵
  - Executes dropped EXE
  PID:1296
- C:\Windows\System\BRbUPlx.exe
  C:\Windows\System\BRbUPlx.exe
  2⤵
  PID:808
- C:\Windows\System\cuWDziT.exe
  C:\Windows\System\cuWDziT.exe
  2⤵
  - Executes dropped EXE
  PID:860
- C:\Windows\System\upcvEHq.exe
  C:\Windows\System\upcvEHq.exe
  2⤵
  PID:1708
- C:\Windows\System\nLaXDmY.exe
  C:\Windows\System\nLaXDmY.exe
  2⤵
  - Executes dropped EXE
  PID:2128
- C:\Windows\System\QXmHRMb.exe
  C:\Windows\System\QXmHRMb.exe
  2⤵
  PID:2736
- C:\Windows\System\zLYIOTw.exe
  C:\Windows\System\zLYIOTw.exe
  2⤵
  - Executes dropped EXE
  PID:2220
- C:\Windows\System\bXVfmTs.exe
  C:\Windows\System\bXVfmTs.exe
  2⤵
  PID:1520
- C:\Windows\System\BlteEZt.exe
  C:\Windows\System\BlteEZt.exe
  2⤵
  - Executes dropped EXE
  PID:2476
- C:\Windows\System\BPYxSQl.exe
  C:\Windows\System\BPYxSQl.exe
  2⤵
  PID:660
- C:\Windows\System\fPaCKMT.exe
  C:\Windows\System\fPaCKMT.exe
  2⤵
  - Executes dropped EXE
  PID:2708
- C:\Windows\System\pWPiNzi.exe
  C:\Windows\System\pWPiNzi.exe
  2⤵
  PID:1216
- C:\Windows\System\iXNfEmL.exe
  C:\Windows\System\iXNfEmL.exe
  2⤵
  - Executes dropped EXE
  PID:1572
- C:\Windows\System\FKCrRRR.exe
  C:\Windows\System\FKCrRRR.exe
  2⤵
  PID:2764
- C:\Windows\System\PNcNmRZ.exe
  C:\Windows\System\PNcNmRZ.exe
  2⤵
  - Executes dropped EXE
  PID:2868
- C:\Windows\System\nWPLsQc.exe
  C:\Windows\System\nWPLsQc.exe
  2⤵
  PID:2960
- C:\Windows\System\CrmrEbU.exe
  C:\Windows\System\CrmrEbU.exe
  2⤵
  - Executes dropped EXE
  PID:2888
- C:\Windows\System\jjcLUWL.exe
  C:\Windows\System\jjcLUWL.exe
  2⤵
  PID:3076
- C:\Windows\System\VtrbdgJ.exe
  C:\Windows\System\VtrbdgJ.exe
  2⤵
  - Executes dropped EXE
  PID:3092
- C:\Windows\System\nVwVULr.exe
  C:\Windows\System\nVwVULr.exe
  2⤵
  PID:3108
- C:\Windows\System\fpukrQa.exe
  C:\Windows\System\fpukrQa.exe
  2⤵
  - Executes dropped EXE
  PID:3124
- C:\Windows\System\jXxCGnV.exe
  C:\Windows\System\jXxCGnV.exe
  2⤵
  PID:3140
- C:\Windows\System\OXYiUnS.exe
  C:\Windows\System\OXYiUnS.exe
  2⤵
  - Executes dropped EXE
  PID:3156
- C:\Windows\System\gbscNHx.exe
  C:\Windows\System\gbscNHx.exe
  2⤵
  PID:3172
- C:\Windows\System\pZUXMyN.exe
  C:\Windows\System\pZUXMyN.exe
  2⤵
  - Executes dropped EXE
  PID:3188
- C:\Windows\System\kJMStPu.exe
  C:\Windows\System\kJMStPu.exe
  2⤵
  PID:3204
- C:\Windows\System\qmltneQ.exe
  C:\Windows\System\qmltneQ.exe
  2⤵
  PID:3220
- C:\Windows\System\izfWwEu.exe
  C:\Windows\System\izfWwEu.exe
  2⤵
  PID:3236
- C:\Windows\System\wxvbqod.exe
  C:\Windows\System\wxvbqod.exe
  2⤵
  PID:3280
- C:\Windows\System\OPsmeqQ.exe
  C:\Windows\System\OPsmeqQ.exe
  2⤵
  PID:3308
- C:\Windows\System\uxpDIMI.exe
  C:\Windows\System\uxpDIMI.exe
  2⤵
  PID:3324
- C:\Windows\System\HbWgSNh.exe
  C:\Windows\System\HbWgSNh.exe
  2⤵
  PID:3340
- C:\Windows\System\wMnEVTO.exe
  C:\Windows\System\wMnEVTO.exe
  2⤵
  PID:3356
- C:\Windows\System\oheONoW.exe
  C:\Windows\System\oheONoW.exe
  2⤵
  PID:3372
- C:\Windows\System\FxTBxRt.exe
  C:\Windows\System\FxTBxRt.exe
  2⤵
  PID:3388
- C:\Windows\System\MDLVotH.exe
  C:\Windows\System\MDLVotH.exe
  2⤵
  PID:3404
- C:\Windows\System\PZWWrmx.exe
  C:\Windows\System\PZWWrmx.exe
  2⤵
  PID:3420
- C:\Windows\System\BrZHmze.exe
  C:\Windows\System\BrZHmze.exe
  2⤵
  PID:3436
- C:\Windows\System\XFfWjXy.exe
  C:\Windows\System\XFfWjXy.exe
  2⤵
  PID:3460
- C:\Windows\System\apsgLXe.exe
  C:\Windows\System\apsgLXe.exe
  2⤵
  PID:3480
- C:\Windows\System\vJVMchI.exe
  C:\Windows\System\vJVMchI.exe
  2⤵
  PID:3496
- C:\Windows\System\FnkEUuA.exe
  C:\Windows\System\FnkEUuA.exe
  2⤵
  PID:3512
- C:\Windows\System\riwLjRX.exe
  C:\Windows\System\riwLjRX.exe
  2⤵
  PID:3704
- C:\Windows\System\jFkltdR.exe
  C:\Windows\System\jFkltdR.exe
  2⤵
  PID:3720
- C:\Windows\System\rGVnPKO.exe
  C:\Windows\System\rGVnPKO.exe
  2⤵
  PID:3736
- C:\Windows\System\bZGLCFw.exe
  C:\Windows\System\bZGLCFw.exe
  2⤵
  PID:3752
- C:\Windows\System\IYlVKDq.exe
  C:\Windows\System\IYlVKDq.exe
  2⤵
  PID:3768
- C:\Windows\System\kizFvez.exe
  C:\Windows\System\kizFvez.exe
  2⤵
  PID:3784
- C:\Windows\System\fdzRxvn.exe
  C:\Windows\System\fdzRxvn.exe
  2⤵
  PID:3800
- C:\Windows\System\EzwWksA.exe
  C:\Windows\System\EzwWksA.exe
  2⤵
  PID:3816
- C:\Windows\System\eqUofAF.exe
  C:\Windows\System\eqUofAF.exe
  2⤵
  PID:3832
- C:\Windows\System\VWRmBco.exe
  C:\Windows\System\VWRmBco.exe
  2⤵
  PID:3852
- C:\Windows\System\SfoceWk.exe
  C:\Windows\System\SfoceWk.exe
  2⤵
  PID:3876
- C:\Windows\System\FXCGJyR.exe
  C:\Windows\System\FXCGJyR.exe
  2⤵
  PID:3904
- C:\Windows\System\oQfGCBV.exe
  C:\Windows\System\oQfGCBV.exe
  2⤵
  PID:3928
- C:\Windows\System\mjKcuII.exe
  C:\Windows\System\mjKcuII.exe
  2⤵
  PID:3948
- C:\Windows\System\lsfSeQC.exe
  C:\Windows\System\lsfSeQC.exe
  2⤵
  PID:3968
- C:\Windows\System\aTuQVXx.exe
  C:\Windows\System\aTuQVXx.exe
  2⤵
  PID:3984
- C:\Windows\System\adzojTe.exe
  C:\Windows\System\adzojTe.exe
  2⤵
  PID:2316
- C:\Windows\System\oohtoeN.exe
  C:\Windows\System\oohtoeN.exe
  2⤵
  PID:2044
- C:\Windows\System\LQhAnHf.exe
  C:\Windows\System\LQhAnHf.exe
  2⤵
  PID:3396
- C:\Windows\System\IfRaSem.exe
  C:\Windows\System\IfRaSem.exe
  2⤵
  PID:2336
- C:\Windows\System\OWaQMoo.exe
  C:\Windows\System\OWaQMoo.exe
  2⤵
  PID:3712
- C:\Windows\System\RNaBSzD.exe
  C:\Windows\System\RNaBSzD.exe
  2⤵
  PID:3776
- C:\Windows\System\zPILEbb.exe
  C:\Windows\System\zPILEbb.exe
  2⤵
  PID:3840
- C:\Windows\System\jhYvQeL.exe
  C:\Windows\System\jhYvQeL.exe
  2⤵
  PID:3896
- C:\Windows\System\mIvtKOq.exe
  C:\Windows\System\mIvtKOq.exe
  2⤵
  PID:4136
- C:\Windows\System\xjwPtEs.exe
  C:\Windows\System\xjwPtEs.exe
  2⤵
  PID:4152
- C:\Windows\System\tDsvnjF.exe
  C:\Windows\System\tDsvnjF.exe
  2⤵
  PID:4168
- C:\Windows\System\BJWnjOb.exe
  C:\Windows\System\BJWnjOb.exe
  2⤵
  PID:4184
- C:\Windows\System\ygEfqSB.exe
  C:\Windows\System\ygEfqSB.exe
  2⤵
  PID:4224
- C:\Windows\System\LtYxLDK.exe
  C:\Windows\System\LtYxLDK.exe
  2⤵
  PID:4240
- C:\Windows\System\dHhfVyE.exe
  C:\Windows\System\dHhfVyE.exe
  2⤵
  PID:4260
- C:\Windows\System\dcEPoFI.exe
  C:\Windows\System\dcEPoFI.exe
  2⤵
  PID:4276
- C:\Windows\System\SztKiVu.exe
  C:\Windows\System\SztKiVu.exe
  2⤵
  PID:4292
- C:\Windows\System\QWvCLqW.exe
  C:\Windows\System\QWvCLqW.exe
  2⤵
  PID:4308
- C:\Windows\System\ZauleZd.exe
  C:\Windows\System\ZauleZd.exe
  2⤵
  PID:4328
- C:\Windows\System\WQGYLGn.exe
  C:\Windows\System\WQGYLGn.exe
  2⤵
  PID:4344
- C:\Windows\System\jXdWgUh.exe
  C:\Windows\System\jXdWgUh.exe
  2⤵
  PID:4360
- C:\Windows\System\WAPPkLQ.exe
  C:\Windows\System\WAPPkLQ.exe
  2⤵
  PID:4376
- C:\Windows\System\hbtKBNw.exe
  C:\Windows\System\hbtKBNw.exe
  2⤵
  PID:4396
- C:\Windows\System\DZJeODm.exe
  C:\Windows\System\DZJeODm.exe
  2⤵
  PID:4412
- C:\Windows\System\yyajsdz.exe
  C:\Windows\System\yyajsdz.exe
  2⤵
  PID:4428
- C:\Windows\System\VciFgUf.exe
  C:\Windows\System\VciFgUf.exe
  2⤵
  PID:4468
- C:\Windows\System\ZKKCfcb.exe
  C:\Windows\System\ZKKCfcb.exe
  2⤵
  PID:4496
- C:\Windows\System\UjovVmW.exe
  C:\Windows\System\UjovVmW.exe
  2⤵
  PID:4512
- C:\Windows\System\GgxTOkE.exe
  C:\Windows\System\GgxTOkE.exe
  2⤵
  PID:4528
- C:\Windows\System\ZLXlXnf.exe
  C:\Windows\System\ZLXlXnf.exe
  2⤵
  PID:4548
- C:\Windows\System\eHkhLZR.exe
  C:\Windows\System\eHkhLZR.exe
  2⤵
  PID:4564
- C:\Windows\System\SoWxxpG.exe
  C:\Windows\System\SoWxxpG.exe
  2⤵
  PID:4580
- C:\Windows\System\bVJhlPh.exe
  C:\Windows\System\bVJhlPh.exe
  2⤵
  PID:4596
- C:\Windows\System\PkroIxU.exe
  C:\Windows\System\PkroIxU.exe
  2⤵
  PID:4612
- C:\Windows\System\kSwgKfU.exe
  C:\Windows\System\kSwgKfU.exe
  2⤵
  PID:4628
- C:\Windows\System\YBURqqD.exe
  C:\Windows\System\YBURqqD.exe
  2⤵
  PID:4644
- C:\Windows\System\uhWFPJc.exe
  C:\Windows\System\uhWFPJc.exe
  2⤵
  PID:4660
- C:\Windows\System\eiETqjV.exe
  C:\Windows\System\eiETqjV.exe
  2⤵
  PID:4676
- C:\Windows\System\aQUOAQc.exe
  C:\Windows\System\aQUOAQc.exe
  2⤵
  PID:4692
- C:\Windows\System\CSaGPbn.exe
  C:\Windows\System\CSaGPbn.exe
  2⤵
  PID:4724
- C:\Windows\System\LsaowSP.exe
  C:\Windows\System\LsaowSP.exe
  2⤵
  PID:4740
- C:\Windows\System\WIwuFPT.exe
  C:\Windows\System\WIwuFPT.exe
  2⤵
  PID:4760
- C:\Windows\System\CYQpyGL.exe
  C:\Windows\System\CYQpyGL.exe
  2⤵
  PID:4776
- C:\Windows\System\MtavgRI.exe
  C:\Windows\System\MtavgRI.exe
  2⤵
  PID:4792
- C:\Windows\System\uDDwJRv.exe
  C:\Windows\System\uDDwJRv.exe
  2⤵
  PID:4808
- C:\Windows\System\ykGWRdD.exe
  C:\Windows\System\ykGWRdD.exe
  2⤵
  PID:4824
- C:\Windows\System\HYsCnVc.exe
  C:\Windows\System\HYsCnVc.exe
  2⤵
  PID:4840
- C:\Windows\System\OSdWNjl.exe
  C:\Windows\System\OSdWNjl.exe
  2⤵
  PID:4856
- C:\Windows\System\PMrexus.exe
  C:\Windows\System\PMrexus.exe
  2⤵
  PID:4872
- C:\Windows\System\kALLUee.exe
  C:\Windows\System\kALLUee.exe
  2⤵
  PID:4888
- C:\Windows\System\GKhFqXI.exe
  C:\Windows\System\GKhFqXI.exe
  2⤵
  PID:4904
- C:\Windows\System\RdlGeQG.exe
  C:\Windows\System\RdlGeQG.exe
  2⤵
  PID:4924
- C:\Windows\System\SmjOYzU.exe
  C:\Windows\System\SmjOYzU.exe
  2⤵
  PID:4940
- C:\Windows\System\BPTNSUx.exe
  C:\Windows\System\BPTNSUx.exe
  2⤵
  PID:4956
- C:\Windows\System\QQztyRG.exe
  C:\Windows\System\QQztyRG.exe
  2⤵
  PID:4972
- C:\Windows\System\jBoyzvO.exe
  C:\Windows\System\jBoyzvO.exe
  2⤵
  PID:4988
- C:\Windows\System\jAhmuHy.exe
  C:\Windows\System\jAhmuHy.exe
  2⤵
  PID:5084
- C:\Windows\System\KFzhVFb.exe
  C:\Windows\System\KFzhVFb.exe
  2⤵
  PID:5100
- C:\Windows\System\lmFhNBe.exe
  C:\Windows\System\lmFhNBe.exe
  2⤵
  PID:5116
- C:\Windows\System\ZPDPAtw.exe
  C:\Windows\System\ZPDPAtw.exe
  2⤵
  PID:1640
- C:\Windows\System\ZOLKihj.exe
  C:\Windows\System\ZOLKihj.exe
  2⤵
  PID:4176
- C:\Windows\System\IXQSldW.exe
  C:\Windows\System\IXQSldW.exe
  2⤵
  PID:2196
- C:\Windows\System\qnDTeKG.exe
  C:\Windows\System\qnDTeKG.exe
  2⤵
  PID:2444
- C:\Windows\System\RkQepoL.exe
  C:\Windows\System\RkQepoL.exe
  2⤵
  PID:944
- C:\Windows\System\xOUnkIl.exe
  C:\Windows\System\xOUnkIl.exe
  2⤵
  PID:2884
- C:\Windows\System\myBxtKH.exe
  C:\Windows\System\myBxtKH.exe
  2⤵
  PID:1780
- C:\Windows\System\XdISjnd.exe
  C:\Windows\System\XdISjnd.exe
  2⤵
  PID:4300
- C:\Windows\System\XflTwsm.exe
  C:\Windows\System\XflTwsm.exe
  2⤵
  PID:2020
- C:\Windows\System\pSwDCui.exe
  C:\Windows\System\pSwDCui.exe
  2⤵
  PID:1316
- C:\Windows\System\yuhzWll.exe
  C:\Windows\System\yuhzWll.exe
  2⤵
  PID:764
- C:\Windows\System\LjmKsFg.exe
  C:\Windows\System\LjmKsFg.exe
  2⤵
  PID:3640
- C:\Windows\System\xaeceCH.exe
  C:\Windows\System\xaeceCH.exe
  2⤵
  PID:3624
- C:\Windows\System\IHcifRU.exe
  C:\Windows\System\IHcifRU.exe
  2⤵
  PID:3608
- C:\Windows\System\uQqotGq.exe
  C:\Windows\System\uQqotGq.exe
  2⤵
  PID:3592
- C:\Windows\System\uNSoBTY.exe
  C:\Windows\System\uNSoBTY.exe
  2⤵
  PID:3576
- C:\Windows\System\buoTBNZ.exe
  C:\Windows\System\buoTBNZ.exe
  2⤵
  PID:3560
- C:\Windows\System\OTXrGTf.exe
  C:\Windows\System\OTXrGTf.exe
  2⤵
  PID:3656
- C:\Windows\System\MloAqiG.exe
  C:\Windows\System\MloAqiG.exe
  2⤵
  PID:3672
- C:\Windows\System\ewXDmVA.exe
  C:\Windows\System\ewXDmVA.exe
  2⤵
  PID:4404
- C:\Windows\System\EFlEwdy.exe
  C:\Windows\System\EFlEwdy.exe
  2⤵
  PID:2572
- C:\Windows\System\wAIMcVt.exe
  C:\Windows\System\wAIMcVt.exe
  2⤵
  PID:3696
- C:\Windows\System\SKxqAOD.exe
  C:\Windows\System\SKxqAOD.exe
  2⤵
  PID:3916
- C:\Windows\System\TGDUmDq.exe
  C:\Windows\System\TGDUmDq.exe
  2⤵
  PID:3960
- C:\Windows\System\oVoRRci.exe
  C:\Windows\System\oVoRRci.exe
  2⤵
  PID:4004
- C:\Windows\System\AQRwVJx.exe
  C:\Windows\System\AQRwVJx.exe
  2⤵
  PID:3508
- C:\Windows\System\lLnmhpL.exe
  C:\Windows\System\lLnmhpL.exe
  2⤵
  PID:3976
- C:\Windows\System\tmGdloR.exe
  C:\Windows\System\tmGdloR.exe
  2⤵
  PID:4192
- C:\Windows\System\GXUKKbf.exe
  C:\Windows\System\GXUKKbf.exe
  2⤵
  PID:2360
- C:\Windows\System\ngJlsqv.exe
  C:\Windows\System\ngJlsqv.exe
  2⤵
  PID:2172
- C:\Windows\System\gNWUfFk.exe
  C:\Windows\System\gNWUfFk.exe
  2⤵
  PID:3912
- C:\Windows\System\izsvdiB.exe
  C:\Windows\System\izsvdiB.exe
  2⤵
  PID:3824
- C:\Windows\System\DrakwiL.exe
  C:\Windows\System\DrakwiL.exe
  2⤵
  PID:3760
- C:\Windows\System\gEVBkbn.exe
  C:\Windows\System\gEVBkbn.exe
  2⤵
  PID:3552
- C:\Windows\System\avPwwuo.exe
  C:\Windows\System\avPwwuo.exe
  2⤵
  PID:3448
- C:\Windows\System\twXMJay.exe
  C:\Windows\System\twXMJay.exe
  2⤵
  PID:3380
- C:\Windows\System\jQAasNK.exe
  C:\Windows\System\jQAasNK.exe
  2⤵
  PID:3316
- C:\Windows\System\DAisVYp.exe
  C:\Windows\System\DAisVYp.exe
  2⤵
  PID:2936
- C:\Windows\System\hHaPPrq.exe
  C:\Windows\System\hHaPPrq.exe
  2⤵
  PID:2592
- C:\Windows\System\QPiULht.exe
  C:\Windows\System\QPiULht.exe
  2⤵
  PID:2464
- C:\Windows\System\IKrwxaT.exe
  C:\Windows\System\IKrwxaT.exe
  2⤵
  PID:1500
- C:\Windows\System\zBNYFXA.exe
  C:\Windows\System\zBNYFXA.exe
  2⤵
  PID:1696
- C:\Windows\System\BlsMdEL.exe
  C:\Windows\System\BlsMdEL.exe
  2⤵
  PID:2648
- C:\Windows\System\McTlEXD.exe
  C:\Windows\System\McTlEXD.exe
  2⤵
  PID:2664
- C:\Windows\System\kbSsSZn.exe
  C:\Windows\System\kbSsSZn.exe
  2⤵
  PID:2084
- C:\Windows\System\tXxeqPc.exe
  C:\Windows\System\tXxeqPc.exe
  2⤵
  PID:1188
- C:\Windows\System\WRniJuE.exe
  C:\Windows\System\WRniJuE.exe
  2⤵
  PID:2420
- C:\Windows\System\dkzybhX.exe
  C:\Windows\System\dkzybhX.exe
  2⤵
  PID:3084
- C:\Windows\System\hNCHxlc.exe
  C:\Windows\System\hNCHxlc.exe
  2⤵
  PID:3148
- C:\Windows\System\cEhNPwt.exe
  C:\Windows\System\cEhNPwt.exe
  2⤵
  PID:3212
- C:\Windows\System\uwMvtZL.exe
  C:\Windows\System\uwMvtZL.exe
  2⤵
  PID:4444
- C:\Windows\System\FjShaOk.exe
  C:\Windows\System\FjShaOk.exe
  2⤵
  PID:4216
- C:\Windows\System\rqexQqY.exe
  C:\Windows\System\rqexQqY.exe
  2⤵
  PID:4464
- C:\Windows\System\MMrXCFs.exe
  C:\Windows\System\MMrXCFs.exe
  2⤵
  PID:4544
- C:\Windows\System\yVhhblH.exe
  C:\Windows\System\yVhhblH.exe
  2⤵
  PID:4604
- C:\Windows\System\pXhqmio.exe
  C:\Windows\System\pXhqmio.exe
  2⤵
  PID:4672
- C:\Windows\System\oUiyptG.exe
  C:\Windows\System\oUiyptG.exe
  2⤵
  PID:4716
- C:\Windows\System\KCQoxpn.exe
  C:\Windows\System\KCQoxpn.exe
  2⤵
  PID:4700
- C:\Windows\System\ZZrjKuh.exe
  C:\Windows\System\ZZrjKuh.exe
  2⤵
  PID:4788
- C:\Windows\System\MnCkuRF.exe
  C:\Windows\System\MnCkuRF.exe
  2⤵
  PID:4852
- C:\Windows\System\eYkTcsO.exe
  C:\Windows\System\eYkTcsO.exe
  2⤵
  PID:4916
- C:\Windows\System\kHLJfee.exe
  C:\Windows\System\kHLJfee.exe
  2⤵
  PID:4980
- C:\Windows\System\AWVZAsW.exe
  C:\Windows\System\AWVZAsW.exe
  2⤵
  PID:4384
- C:\Windows\System\kujwqbi.exe
  C:\Windows\System\kujwqbi.exe
  2⤵
  PID:628
- C:\Windows\System\KHKkOif.exe
  C:\Windows\System\KHKkOif.exe
  2⤵
  PID:4984
- C:\Windows\System\osOJayG.exe
  C:\Windows\System\osOJayG.exe
  2⤵
  PID:4488
- C:\Windows\System\osaWelC.exe
  C:\Windows\System\osaWelC.exe
  2⤵
  PID:2180
- C:\Windows\System\meWYvVr.exe
  C:\Windows\System\meWYvVr.exe
  2⤵
  PID:4804
- C:\Windows\System\ETKbSQr.exe
  C:\Windows\System\ETKbSQr.exe
  2⤵
  PID:4868
- C:\Windows\System\LXpoTMW.exe
  C:\Windows\System\LXpoTMW.exe
  2⤵
  PID:4920
- C:\Windows\System\BzjVSDZ.exe
  C:\Windows\System\BzjVSDZ.exe
  2⤵
  PID:4768
- C:\Windows\System\KPoidPS.exe
  C:\Windows\System\KPoidPS.exe
  2⤵
  PID:4684
- C:\Windows\System\HRnYqPK.exe
  C:\Windows\System\HRnYqPK.exe
  2⤵
  PID:4620
- C:\Windows\System\JOFqUUR.exe
  C:\Windows\System\JOFqUUR.exe
  2⤵
  PID:4556
- C:\Windows\System\KAtjjFV.exe
  C:\Windows\System\KAtjjFV.exe
  2⤵
  PID:5044
- C:\Windows\System\xLfkTMm.exe
  C:\Windows\System\xLfkTMm.exe
  2⤵
  PID:1532
- C:\Windows\System\rBFjCez.exe
  C:\Windows\System\rBFjCez.exe
  2⤵
  PID:5092
- C:\Windows\System\dvatFrB.exe
  C:\Windows\System\dvatFrB.exe
  2⤵
  PID:2748
- C:\Windows\System\cgDwNey.exe
  C:\Windows\System\cgDwNey.exe
  2⤵
  PID:3680
- C:\Windows\System\jblYwCt.exe
  C:\Windows\System\jblYwCt.exe
  2⤵
  PID:3568
- C:\Windows\System\DiijeRC.exe
  C:\Windows\System\DiijeRC.exe
  2⤵
  PID:4340
- C:\Windows\System\ICtfGYp.exe
  C:\Windows\System\ICtfGYp.exe
  2⤵
  PID:2856
- C:\Windows\System\rJZSjhp.exe
  C:\Windows\System\rJZSjhp.exe
  2⤵
  PID:3596
- C:\Windows\System\hJhgLQQ.exe
  C:\Windows\System\hJhgLQQ.exe
  2⤵
  PID:4324
- C:\Windows\System\rwHWBgq.exe
  C:\Windows\System\rwHWBgq.exe
  2⤵
  PID:3812
- C:\Windows\System\mGULbwa.exe
  C:\Windows\System\mGULbwa.exe
  2⤵
  PID:1956
- C:\Windows\System\dJnrZXx.exe
  C:\Windows\System\dJnrZXx.exe
  2⤵
  PID:3488
- C:\Windows\System\usVSjMJ.exe
  C:\Windows\System\usVSjMJ.exe
  2⤵
  PID:2072
- C:\Windows\System\gVsTCfi.exe
  C:\Windows\System\gVsTCfi.exe
  2⤵
  PID:2788
- C:\Windows\System\TILiiLG.exe
  C:\Windows\System\TILiiLG.exe
  2⤵
  PID:1624
- C:\Windows\System\HDQDZnU.exe
  C:\Windows\System\HDQDZnU.exe
  2⤵
  PID:3244
- C:\Windows\System\nInpxcT.exe
  C:\Windows\System\nInpxcT.exe
  2⤵
  PID:4572
- C:\Windows\System\RTONUqL.exe
  C:\Windows\System\RTONUqL.exe
  2⤵
  PID:4756
- C:\Windows\System\rUdptCq.exe
  C:\Windows\System\rUdptCq.exe
  2⤵
  PID:4420
- C:\Windows\System\VGIsuAZ.exe
  C:\Windows\System\VGIsuAZ.exe
  2⤵
  PID:4520
- C:\Windows\System\KuKxxMT.exe
  C:\Windows\System\KuKxxMT.exe
  2⤵
  PID:4624
- C:\Windows\System\rCzhSIZ.exe
  C:\Windows\System\rCzhSIZ.exe
  2⤵
  PID:5048
- C:\Windows\System\jSbPajy.exe
  C:\Windows\System\jSbPajy.exe
  2⤵
  PID:5076
- C:\Windows\System\fZEWhsM.exe
  C:\Windows\System\fZEWhsM.exe
  2⤵
  PID:3120
- C:\Windows\System\NQpLfzD.exe
  C:\Windows\System\NQpLfzD.exe
  2⤵
  PID:5164
- C:\Windows\System\AJaNUZE.exe
  C:\Windows\System\AJaNUZE.exe
  2⤵
  PID:5180
- C:\Windows\System\DowQrQY.exe
  C:\Windows\System\DowQrQY.exe
  2⤵
  PID:5196
- C:\Windows\System\iiQdZfY.exe
  C:\Windows\System\iiQdZfY.exe
  2⤵
  PID:5212
- C:\Windows\System\fSwhJZR.exe
  C:\Windows\System\fSwhJZR.exe
  2⤵
  PID:5228
- C:\Windows\System\JGMYJkI.exe
  C:\Windows\System\JGMYJkI.exe
  2⤵
  PID:5248
- C:\Windows\System\KYrfPCF.exe
  C:\Windows\System\KYrfPCF.exe
  2⤵
  PID:5276
- C:\Windows\System\LtIbgow.exe
  C:\Windows\System\LtIbgow.exe
  2⤵
  PID:5312
- C:\Windows\System\hbRHfiD.exe
  C:\Windows\System\hbRHfiD.exe
  2⤵
  PID:5328
- C:\Windows\System\CeLJnem.exe
  C:\Windows\System\CeLJnem.exe
  2⤵
  PID:5344
- C:\Windows\System\WAeKdqQ.exe
  C:\Windows\System\WAeKdqQ.exe
  2⤵
  PID:5360
- C:\Windows\System\fFirRqi.exe
  C:\Windows\System\fFirRqi.exe
  2⤵
  PID:5376
- C:\Windows\System\LNCclwG.exe
  C:\Windows\System\LNCclwG.exe
  2⤵
  PID:5392
- C:\Windows\System\MBwjOVo.exe
  C:\Windows\System\MBwjOVo.exe
  2⤵
  PID:5408
- C:\Windows\System\ORuvksY.exe
  C:\Windows\System\ORuvksY.exe
  2⤵
  PID:5424
- C:\Windows\System\eELauth.exe
  C:\Windows\System\eELauth.exe
  2⤵
  PID:5440
- C:\Windows\System\htjIoUc.exe
  C:\Windows\System\htjIoUc.exe
  2⤵
  PID:5456
- C:\Windows\System\wvILEBh.exe
  C:\Windows\System\wvILEBh.exe
  2⤵
  PID:5476
- C:\Windows\System\cwsyoAq.exe
  C:\Windows\System\cwsyoAq.exe
  2⤵
  PID:5492
- C:\Windows\System\qxWnxZZ.exe
  C:\Windows\System\qxWnxZZ.exe
  2⤵
  PID:5508
- C:\Windows\System\TpBZoNO.exe
  C:\Windows\System\TpBZoNO.exe
  2⤵
  PID:5524
- C:\Windows\System\QBuBRri.exe
  C:\Windows\System\QBuBRri.exe
  2⤵
  PID:5540
- C:\Windows\System\AiXWCPb.exe
  C:\Windows\System\AiXWCPb.exe
  2⤵
  PID:5556
- C:\Windows\System\eLxmdPw.exe
  C:\Windows\System\eLxmdPw.exe
  2⤵
  PID:5572
- C:\Windows\System\JIYIyaZ.exe
  C:\Windows\System\JIYIyaZ.exe
  2⤵
  PID:5588
- C:\Windows\System\lkmHOdZ.exe
  C:\Windows\System\lkmHOdZ.exe
  2⤵
  PID:5604
- C:\Windows\System\QjRGNrs.exe
  C:\Windows\System\QjRGNrs.exe
  2⤵
  PID:5620
- C:\Windows\System\rDdwfjq.exe
  C:\Windows\System\rDdwfjq.exe
  2⤵
  PID:5636
- C:\Windows\System\OLxFwUo.exe
  C:\Windows\System\OLxFwUo.exe
  2⤵
  PID:5652
- C:\Windows\System\RRNhsEo.exe
  C:\Windows\System\RRNhsEo.exe
  2⤵
  PID:5668
- C:\Windows\System\cckJasq.exe
  C:\Windows\System\cckJasq.exe
  2⤵
  PID:5684
- C:\Windows\System\dqJUdFN.exe
  C:\Windows\System\dqJUdFN.exe
  2⤵
  PID:5700
- C:\Windows\System\awzkrBZ.exe
  C:\Windows\System\awzkrBZ.exe
  2⤵
  PID:5716
- C:\Windows\System\XWBtNgr.exe
  C:\Windows\System\XWBtNgr.exe
  2⤵
  PID:5732
- C:\Windows\System\tuLLHom.exe
  C:\Windows\System\tuLLHom.exe
  2⤵
  PID:5748
- C:\Windows\System\KzYWKxc.exe
  C:\Windows\System\KzYWKxc.exe
  2⤵
  PID:5764
- C:\Windows\System\qnRcwhl.exe
  C:\Windows\System\qnRcwhl.exe
  2⤵
  PID:5780
- C:\Windows\System\NHneTLj.exe
  C:\Windows\System\NHneTLj.exe
  2⤵
  PID:5796
- C:\Windows\System\bwgpOgR.exe
  C:\Windows\System\bwgpOgR.exe
  2⤵
  PID:5812
- C:\Windows\System\vTVNptT.exe
  C:\Windows\System\vTVNptT.exe
  2⤵
  PID:5828
- C:\Windows\System\IdWjeIg.exe
  C:\Windows\System\IdWjeIg.exe
  2⤵
  PID:5844
- C:\Windows\System\oIURAoU.exe
  C:\Windows\System\oIURAoU.exe
  2⤵
  PID:5860
- C:\Windows\System\GRRWNkI.exe
  C:\Windows\System\GRRWNkI.exe
  2⤵
  PID:5876
- C:\Windows\System\tLjRFWh.exe
  C:\Windows\System\tLjRFWh.exe
  2⤵
  PID:5892
- C:\Windows\System\LfBedkq.exe
  C:\Windows\System\LfBedkq.exe
  2⤵
  PID:5908
- C:\Windows\System\UdBnfON.exe
  C:\Windows\System\UdBnfON.exe
  2⤵
  PID:5924
- C:\Windows\System\rMdSdas.exe
  C:\Windows\System\rMdSdas.exe
  2⤵
  PID:5940
- C:\Windows\System\jeOKpyf.exe
  C:\Windows\System\jeOKpyf.exe
  2⤵
  PID:5956
- C:\Windows\System\ZwEZTxR.exe
  C:\Windows\System\ZwEZTxR.exe
  2⤵
  PID:5972
- C:\Windows\System\afZXoWh.exe
  C:\Windows\System\afZXoWh.exe
  2⤵
  PID:5988
- C:\Windows\System\YixFwuJ.exe
  C:\Windows\System\YixFwuJ.exe
  2⤵
  PID:6004
- C:\Windows\System\JzeDVGn.exe
  C:\Windows\System\JzeDVGn.exe
  2⤵
  PID:6020
- C:\Windows\System\kewmacX.exe
  C:\Windows\System\kewmacX.exe
  2⤵
  PID:6036
- C:\Windows\System\VUssvgq.exe
  C:\Windows\System\VUssvgq.exe
  2⤵
  PID:6052
- C:\Windows\System\rXwgfSY.exe
  C:\Windows\System\rXwgfSY.exe
  2⤵
  PID:6068
- C:\Windows\System\VtVNOzd.exe
  C:\Windows\System\VtVNOzd.exe
  2⤵
  PID:6084
- C:\Windows\System\rteYVKh.exe
  C:\Windows\System\rteYVKh.exe
  2⤵
  PID:6100
- C:\Windows\System\DTmaHYp.exe
  C:\Windows\System\DTmaHYp.exe
  2⤵
  PID:6116
- C:\Windows\System\fseEkxM.exe
  C:\Windows\System\fseEkxM.exe
  2⤵
  PID:6132
- C:\Windows\System\PqGnlkP.exe
  C:\Windows\System\PqGnlkP.exe
  2⤵
  PID:5172
- C:\Windows\System\DCZVuVn.exe
  C:\Windows\System\DCZVuVn.exe
  2⤵
  PID:4968
- C:\Windows\System\dYfrMWr.exe
  C:\Windows\System\dYfrMWr.exe
  2⤵
  PID:4336
- C:\Windows\System\EQgwbDW.exe
  C:\Windows\System\EQgwbDW.exe
  2⤵
  PID:3792
- C:\Windows\System\HDddptO.exe
  C:\Windows\System\HDddptO.exe
  2⤵
  PID:3116
- C:\Windows\System\eoCRhOB.exe
  C:\Windows\System\eoCRhOB.exe
  2⤵
  PID:5236
- C:\Windows\System\UXaCJgg.exe
  C:\Windows\System\UXaCJgg.exe
  2⤵
  PID:5288
- C:\Windows\System\PuWiKfZ.exe
  C:\Windows\System\PuWiKfZ.exe
  2⤵
  PID:5304
- C:\Windows\System\zvczAwQ.exe
  C:\Windows\System\zvczAwQ.exe
  2⤵
  PID:5368
- C:\Windows\System\CmXEtlY.exe
  C:\Windows\System\CmXEtlY.exe
  2⤵
  PID:5432
- C:\Windows\System\MlQrEmd.exe
  C:\Windows\System\MlQrEmd.exe
  2⤵
  PID:5472
- C:\Windows\System\jqDqsen.exe
  C:\Windows\System\jqDqsen.exe
  2⤵
  PID:5568
- C:\Windows\System\xbBNCbI.exe
  C:\Windows\System\xbBNCbI.exe
  2⤵
  PID:5564
- C:\Windows\System\bluyVDv.exe
  C:\Windows\System\bluyVDv.exe
  2⤵
  PID:5664
- C:\Windows\System\HeZTBaH.exe
  C:\Windows\System\HeZTBaH.exe
  2⤵
  PID:5728
- C:\Windows\System\TOncNdP.exe
  C:\Windows\System\TOncNdP.exe
  2⤵
  PID:5792
- C:\Windows\System\CIzTlLo.exe
  C:\Windows\System\CIzTlLo.exe
  2⤵
  PID:5856
- C:\Windows\System\FQuhECg.exe
  C:\Windows\System\FQuhECg.exe
  2⤵
  PID:5920
- C:\Windows\System\kQxTbbd.exe
  C:\Windows\System\kQxTbbd.exe
  2⤵
  PID:5984
- C:\Windows\System\SVmBFlD.exe
  C:\Windows\System\SVmBFlD.exe
  2⤵
  PID:6016
- C:\Windows\System\xmObZIK.exe
  C:\Windows\System\xmObZIK.exe
  2⤵
  PID:6076
- C:\Windows\System\mOuTiDZ.exe
  C:\Windows\System\mOuTiDZ.exe
  2⤵
  PID:6140
- C:\Windows\System\FxqLuLi.exe
  C:\Windows\System\FxqLuLi.exe
  2⤵
  PID:5244
- C:\Windows\System\HSJXvOj.exe
  C:\Windows\System\HSJXvOj.exe
  2⤵
  PID:6152
- C:\Windows\System\DpReQuc.exe
  C:\Windows\System\DpReQuc.exe
  2⤵
  PID:6168
- C:\Windows\System\lcauobL.exe
  C:\Windows\System\lcauobL.exe
  2⤵
  PID:6184
- C:\Windows\System\WCVRzeO.exe
  C:\Windows\System\WCVRzeO.exe
  2⤵
  PID:6200
- C:\Windows\System\nlNAyTz.exe
  C:\Windows\System\nlNAyTz.exe
  2⤵
  PID:6216
- C:\Windows\System\SvWYYDK.exe
  C:\Windows\System\SvWYYDK.exe
  2⤵
  PID:6232
- C:\Windows\System\TtYPqsK.exe
  C:\Windows\System\TtYPqsK.exe
  2⤵
  PID:6248
- C:\Windows\System\vZkleNL.exe
  C:\Windows\System\vZkleNL.exe
  2⤵
  PID:6264
- C:\Windows\System\UIMSRPF.exe
  C:\Windows\System\UIMSRPF.exe
  2⤵
  PID:6280
- C:\Windows\System\xevolLy.exe
  C:\Windows\System\xevolLy.exe
  2⤵
  PID:6296
- C:\Windows\System\oSQdhhm.exe
  C:\Windows\System\oSQdhhm.exe
  2⤵
  PID:6312
- C:\Windows\System\aPdiNbU.exe
  C:\Windows\System\aPdiNbU.exe
  2⤵
  PID:6328
- C:\Windows\System\VbYhNQC.exe
  C:\Windows\System\VbYhNQC.exe
  2⤵
  PID:6344
- C:\Windows\System\tBxMtkH.exe
  C:\Windows\System\tBxMtkH.exe
  2⤵
  PID:6360
- C:\Windows\System\ZFTdDPT.exe
  C:\Windows\System\ZFTdDPT.exe
  2⤵
  PID:6376
- C:\Windows\System\tjFVdOc.exe
  C:\Windows\System\tjFVdOc.exe
  2⤵
  PID:6392
- C:\Windows\System\autJlGB.exe
  C:\Windows\System\autJlGB.exe
  2⤵
  PID:6408
- C:\Windows\System\BqsCSQg.exe
  C:\Windows\System\BqsCSQg.exe
  2⤵
  PID:6424
- C:\Windows\System\AbCxNrz.exe
  C:\Windows\System\AbCxNrz.exe
  2⤵
  PID:6440
- C:\Windows\System\BwrzjFZ.exe
  C:\Windows\System\BwrzjFZ.exe
  2⤵
  PID:6456
- C:\Windows\System\vOGoLBh.exe
  C:\Windows\System\vOGoLBh.exe
  2⤵
  PID:6472
- C:\Windows\System\ujKmiPU.exe
  C:\Windows\System\ujKmiPU.exe
  2⤵
  PID:6492
- C:\Windows\System\lrUFEaW.exe
  C:\Windows\System\lrUFEaW.exe
  2⤵
  PID:6508
- C:\Windows\System\RolMDuh.exe
  C:\Windows\System\RolMDuh.exe
  2⤵
  PID:6524
- C:\Windows\System\fncFacV.exe
  C:\Windows\System\fncFacV.exe
  2⤵
  PID:6540
- C:\Windows\System\eWNWIkC.exe
  C:\Windows\System\eWNWIkC.exe
  2⤵
  PID:6556
- C:\Windows\System\zEdCvNJ.exe
  C:\Windows\System\zEdCvNJ.exe
  2⤵
  PID:6572
- C:\Windows\System\HQQfHsQ.exe
  C:\Windows\System\HQQfHsQ.exe
  2⤵
  PID:6588
- C:\Windows\System\UWcyESY.exe
  C:\Windows\System\UWcyESY.exe
  2⤵
  PID:6604
- C:\Windows\System\ilwggiH.exe
  C:\Windows\System\ilwggiH.exe
  2⤵
  PID:6620
- C:\Windows\System\fPDOGaa.exe
  C:\Windows\System\fPDOGaa.exe
  2⤵
  PID:6636
- C:\Windows\System\sIUmFrr.exe
  C:\Windows\System\sIUmFrr.exe
  2⤵
  PID:6652
- C:\Windows\System\ByTdygs.exe
  C:\Windows\System\ByTdygs.exe
  2⤵
  PID:6668
- C:\Windows\System\jodoVti.exe
  C:\Windows\System\jodoVti.exe
  2⤵
  PID:6692
- C:\Windows\System\FmQoyww.exe
  C:\Windows\System\FmQoyww.exe
  2⤵
  PID:6708
- C:\Windows\System\AvWKkBW.exe
  C:\Windows\System\AvWKkBW.exe
  2⤵
  PID:6724
- C:\Windows\System\hWTanmS.exe
  C:\Windows\System\hWTanmS.exe
  2⤵
  PID:6756
- C:\Windows\System\jXIWVLX.exe
  C:\Windows\System\jXIWVLX.exe
  2⤵
  PID:6772
- C:\Windows\System\BdnQQsU.exe
  C:\Windows\System\BdnQQsU.exe
  2⤵
  PID:6788
- C:\Windows\System\ZtOlTWD.exe
  C:\Windows\System\ZtOlTWD.exe
  2⤵
  PID:6804
- C:\Windows\System\rqPgtPk.exe
  C:\Windows\System\rqPgtPk.exe
  2⤵
  PID:6844
- C:\Windows\System\MuqTjpe.exe
  C:\Windows\System\MuqTjpe.exe
  2⤵
  PID:6912
- C:\Windows\System\CrcclFp.exe
  C:\Windows\System\CrcclFp.exe
  2⤵
  PID:6928
- C:\Windows\System\ElBENJj.exe
  C:\Windows\System\ElBENJj.exe
  2⤵
  PID:6944
- C:\Windows\System\PFEyYhv.exe
  C:\Windows\System\PFEyYhv.exe
  2⤵
  PID:6960
- C:\Windows\System\bvLWyNX.exe
  C:\Windows\System\bvLWyNX.exe
  2⤵
  PID:6976
- C:\Windows\System\GuxsbaU.exe
  C:\Windows\System\GuxsbaU.exe
  2⤵
  PID:6992
- C:\Windows\System\dGCKgKL.exe
  C:\Windows\System\dGCKgKL.exe
  2⤵
  PID:7008
- C:\Windows\System\CQoLSZN.exe
  C:\Windows\System\CQoLSZN.exe
  2⤵
  PID:7024
- C:\Windows\System\TobCmSc.exe
  C:\Windows\System\TobCmSc.exe
  2⤵
  PID:7040
- C:\Windows\System\MrjerZJ.exe
  C:\Windows\System\MrjerZJ.exe
  2⤵
  PID:7056
- C:\Windows\System\IvrvSab.exe
  C:\Windows\System\IvrvSab.exe
  2⤵
  PID:7072
- C:\Windows\System\WLKZZrS.exe
  C:\Windows\System\WLKZZrS.exe
  2⤵
  PID:7088
- C:\Windows\System\fGqUZKj.exe
  C:\Windows\System\fGqUZKj.exe
  2⤵
  PID:7104
- C:\Windows\System\HOVZnNQ.exe
  C:\Windows\System\HOVZnNQ.exe
  2⤵
  PID:7120
- C:\Windows\System\sjLnZRP.exe
  C:\Windows\System\sjLnZRP.exe
  2⤵
  PID:7136
- C:\Windows\System\DdQsEjk.exe
  C:\Windows\System\DdQsEjk.exe
  2⤵
  PID:7152
- C:\Windows\System\uCOEkFn.exe
  C:\Windows\System\uCOEkFn.exe
  2⤵
  PID:6044
- C:\Windows\System\vnmsZeQ.exe
  C:\Windows\System\vnmsZeQ.exe
  2⤵
  PID:5468
- C:\Windows\System\uKpPnqS.exe
  C:\Windows\System\uKpPnqS.exe
  2⤵
  PID:6048
- C:\Windows\System\AnUHKvz.exe
  C:\Windows\System\AnUHKvz.exe
  2⤵
  PID:5952
- C:\Windows\System\MSvyaye.exe
  C:\Windows\System\MSvyaye.exe
  2⤵
  PID:2544
- C:\Windows\System\ITMGDXT.exe
  C:\Windows\System\ITMGDXT.exe
  2⤵
  PID:6196
- C:\Windows\System\JhhFxkd.exe
  C:\Windows\System\JhhFxkd.exe
  2⤵
  PID:6260
- C:\Windows\System\jdPiArj.exe
  C:\Windows\System\jdPiArj.exe
  2⤵
  PID:6324
- C:\Windows\System\yTWclQj.exe
  C:\Windows\System\yTWclQj.exe
  2⤵
  PID:6416
- C:\Windows\System\WYIpBET.exe
  C:\Windows\System\WYIpBET.exe
  2⤵
  PID:6480
- C:\Windows\System\yqGMyGv.exe
  C:\Windows\System\yqGMyGv.exe
  2⤵
  PID:6520
- C:\Windows\System\YLyiGfn.exe
  C:\Windows\System\YLyiGfn.exe
  2⤵
  PID:6584
- C:\Windows\System\BMhwiyK.exe
  C:\Windows\System\BMhwiyK.exe
  2⤵
  PID:6648
- C:\Windows\System\XRHPNzn.exe
  C:\Windows\System\XRHPNzn.exe
  2⤵
  PID:6688
- C:\Windows\System\hzyhDUo.exe
  C:\Windows\System\hzyhDUo.exe
  2⤵
  PID:6764
- C:\Windows\System\risffXx.exe
  C:\Windows\System\risffXx.exe
  2⤵
  PID:6852
- C:\Windows\System\YJMkfpb.exe
  C:\Windows\System\YJMkfpb.exe
  2⤵
  PID:6868
- C:\Windows\System\yGsCSkG.exe
  C:\Windows\System\yGsCSkG.exe
  2⤵
  PID:6884
- C:\Windows\System\YzhcujO.exe
  C:\Windows\System\YzhcujO.exe
  2⤵
  PID:6900
- C:\Windows\System\tyLNTQv.exe
  C:\Windows\System\tyLNTQv.exe
  2⤵
  PID:6940
- C:\Windows\System\VWZzTpz.exe
  C:\Windows\System\VWZzTpz.exe
  2⤵
  PID:6968
- C:\Windows\System\hVZySNW.exe
  C:\Windows\System\hVZySNW.exe
  2⤵
  PID:7032
- C:\Windows\System\nhlsPYl.exe
  C:\Windows\System\nhlsPYl.exe
  2⤵
  PID:7068
- C:\Windows\System\rsIxVEy.exe
  C:\Windows\System\rsIxVEy.exe
  2⤵
  PID:7132
- C:\Windows\System\RBeHWwA.exe
  C:\Windows\System\RBeHWwA.exe
  2⤵
  PID:2672
- C:\Windows\System\XdEzcfA.exe
  C:\Windows\System\XdEzcfA.exe
  2⤵
  PID:2460
- C:\Windows\System\WDNNsrH.exe
  C:\Windows\System\WDNNsrH.exe
  2⤵
  PID:4212
- C:\Windows\System\EiuvMaS.exe
  C:\Windows\System\EiuvMaS.exe
  2⤵
  PID:4708
- C:\Windows\System\isEELpY.exe
  C:\Windows\System\isEELpY.exe
  2⤵
  PID:5824
- C:\Windows\System\MTggesu.exe
  C:\Windows\System\MTggesu.exe
  2⤵
  PID:4588
- C:\Windows\System\iixmwHo.exe
  C:\Windows\System\iixmwHo.exe
  2⤵
  PID:1960
- C:\Windows\System\rXruNMG.exe
  C:\Windows\System\rXruNMG.exe
  2⤵
  PID:1992
- C:\Windows\System\ermePTP.exe
  C:\Windows\System\ermePTP.exe
  2⤵
  PID:4884
- C:\Windows\System\CJCQrVu.exe
  C:\Windows\System\CJCQrVu.exe
  2⤵
  PID:5056
- C:\Windows\System\UlZMrXb.exe
  C:\Windows\System\UlZMrXb.exe
  2⤵
  PID:5136
- C:\Windows\System\vitiPfM.exe
  C:\Windows\System\vitiPfM.exe
  2⤵
  PID:5152
- C:\Windows\System\IlukGGm.exe
  C:\Windows\System\IlukGGm.exe
  2⤵
  PID:3872
- C:\Windows\System\qlMDpxo.exe
  C:\Windows\System\qlMDpxo.exe
  2⤵
  PID:5256
- C:\Windows\System\WqrzjgP.exe
  C:\Windows\System\WqrzjgP.exe
  2⤵
  PID:5272
- C:\Windows\System\GztniYl.exe
  C:\Windows\System\GztniYl.exe
  2⤵
  PID:5356
- C:\Windows\System\DAuEJKF.exe
  C:\Windows\System\DAuEJKF.exe
  2⤵
  PID:5420
- C:\Windows\System\fnIIwmH.exe
  C:\Windows\System\fnIIwmH.exe
  2⤵
  PID:5488
- C:\Windows\System\lpmYoog.exe
  C:\Windows\System\lpmYoog.exe
  2⤵
  PID:5552
- C:\Windows\System\NXGUvHF.exe
  C:\Windows\System\NXGUvHF.exe
  2⤵
  PID:5616
- C:\Windows\System\kHmNtlt.exe
  C:\Windows\System\kHmNtlt.exe
  2⤵
  PID:5680
- C:\Windows\System\YBgoXcP.exe
  C:\Windows\System\YBgoXcP.exe
  2⤵
  PID:5744
- C:\Windows\System\iYXOGym.exe
  C:\Windows\System\iYXOGym.exe
  2⤵
  PID:5808
- C:\Windows\System\uZpLIUX.exe
  C:\Windows\System\uZpLIUX.exe
  2⤵
  PID:5872
- C:\Windows\System\RcUbhfN.exe
  C:\Windows\System\RcUbhfN.exe
  2⤵
  PID:5936
- C:\Windows\System\CVUdtQj.exe
  C:\Windows\System\CVUdtQj.exe
  2⤵
  PID:6000
- C:\Windows\System\xuROiGG.exe
  C:\Windows\System\xuROiGG.exe
  2⤵
  PID:3992
- C:\Windows\System\nRuwkEo.exe
  C:\Windows\System\nRuwkEo.exe
  2⤵
  PID:5300
- C:\Windows\System\eQWyFwa.exe
  C:\Windows\System\eQWyFwa.exe
  2⤵
  PID:5532
- C:\Windows\System\HsnckjP.exe
  C:\Windows\System\HsnckjP.exe
  2⤵
  PID:6228
- C:\Windows\System\UCTzRrd.exe
  C:\Windows\System\UCTzRrd.exe
  2⤵
  PID:5916
- C:\Windows\System\NQISNTY.exe
  C:\Windows\System\NQISNTY.exe
  2⤵
  PID:6356
- C:\Windows\System\UEZwjVU.exe
  C:\Windows\System\UEZwjVU.exe
  2⤵
  PID:6340
- C:\Windows\System\fdvSWzx.exe
  C:\Windows\System\fdvSWzx.exe
  2⤵
  PID:6404
- C:\Windows\System\KNICIrm.exe
  C:\Windows\System\KNICIrm.exe
  2⤵
  PID:6468
- C:\Windows\System\GHsVuuR.exe
  C:\Windows\System\GHsVuuR.exe
  2⤵
  PID:6564
- C:\Windows\System\kWQiljs.exe
  C:\Windows\System\kWQiljs.exe
  2⤵
  PID:6628
- C:\Windows\System\ESfopse.exe
  C:\Windows\System\ESfopse.exe
  2⤵
  PID:6700
- C:\Windows\System\EdaeDzB.exe
  C:\Windows\System\EdaeDzB.exe
  2⤵
  PID:6748
- C:\Windows\System\cNaGnsD.exe
  C:\Windows\System\cNaGnsD.exe
  2⤵
  PID:6816
- C:\Windows\System\UrsxmRm.exe
  C:\Windows\System\UrsxmRm.exe
  2⤵
  PID:6832
- C:\Windows\System\oXDiUib.exe
  C:\Windows\System\oXDiUib.exe
  2⤵
  PID:6924
- C:\Windows\System\ZXvgfps.exe
  C:\Windows\System\ZXvgfps.exe
  2⤵
  PID:6988
- C:\Windows\System\ApZJTGP.exe
  C:\Windows\System\ApZJTGP.exe
  2⤵
  PID:6616
- C:\Windows\System\qGLjEzU.exe
  C:\Windows\System\qGLjEzU.exe
  2⤵
  PID:7064
- C:\Windows\System\lKkJkUK.exe
  C:\Windows\System\lKkJkUK.exe
  2⤵
  PID:6892
- C:\Windows\System\cdtZXIG.exe
  C:\Windows\System\cdtZXIG.exe
  2⤵
  PID:2008
- C:\Windows\System\JJRzzHt.exe
  C:\Windows\System\JJRzzHt.exe
  2⤵
  PID:2356
- C:\Windows\System\PtOLfPO.exe
  C:\Windows\System\PtOLfPO.exe
  2⤵
  PID:4460
- C:\Windows\System\HeXSIMu.exe
  C:\Windows\System\HeXSIMu.exe
  2⤵
  PID:5188
- C:\Windows\System\vaCUUPp.exe
  C:\Windows\System\vaCUUPp.exe
  2⤵
  PID:5416
- C:\Windows\System\jEmVVhV.exe
  C:\Windows\System\jEmVVhV.exe
  2⤵
  PID:5676
- C:\Windows\System\gGwiFQF.exe
  C:\Windows\System\gGwiFQF.exe
  2⤵
  PID:5932
- C:\Windows\System\NcRnjft.exe
  C:\Windows\System\NcRnjft.exe
  2⤵
  PID:5504
- C:\Windows\System\WnFPyGH.exe
  C:\Windows\System\WnFPyGH.exe
  2⤵
  PID:6336
- C:\Windows\System\qSMHayT.exe
  C:\Windows\System\qSMHayT.exe
  2⤵
  PID:4820
- C:\Windows\System\kPwIBbd.exe
  C:\Windows\System\kPwIBbd.exe
  2⤵
  PID:5008
- C:\Windows\System\DyAyJro.exe
  C:\Windows\System\DyAyJro.exe
  2⤵
  PID:3844
- C:\Windows\System\kXjdHkE.exe
  C:\Windows\System\kXjdHkE.exe
  2⤵
  PID:6064
- C:\Windows\System\KDhVKqx.exe
  C:\Windows\System\KDhVKqx.exe
  2⤵
  PID:4476
- C:\Windows\System\gLaoLGS.exe
  C:\Windows\System\gLaoLGS.exe
  2⤵
  PID:5336
- C:\Windows\System\TImgRtu.exe
  C:\Windows\System\TImgRtu.exe
  2⤵
  PID:6208
- C:\Windows\System\VzukDts.exe
  C:\Windows\System\VzukDts.exe
  2⤵
  PID:6240
- C:\Windows\System\IqXaexy.exe
  C:\Windows\System\IqXaexy.exe
  2⤵
  PID:2752
- C:\Windows\System\renPFyR.exe
  C:\Windows\System\renPFyR.exe
  2⤵
  PID:468
- C:\Windows\System\hzfYkbr.exe
  C:\Windows\System\hzfYkbr.exe
  2⤵
  PID:3528
- C:\Windows\System\tWxfgjq.exe
  C:\Windows\System\tWxfgjq.exe
  2⤵
  PID:3612
- C:\Windows\System\zidmkpP.exe
  C:\Windows\System\zidmkpP.exe
  2⤵
  PID:3660
- C:\Windows\System\FOOJPay.exe
  C:\Windows\System\FOOJPay.exe
  2⤵
  PID:3688
- C:\Windows\System\QPUvAAV.exe
  C:\Windows\System\QPUvAAV.exe
  2⤵
  PID:3228
- C:\Windows\System\GFSRCbu.exe
  C:\Windows\System\GFSRCbu.exe
  2⤵
  PID:1492
- C:\Windows\System\HLgRqyl.exe
  C:\Windows\System\HLgRqyl.exe
  2⤵
  PID:3728
- C:\Windows\System\uYJzKHJ.exe
  C:\Windows\System\uYJzKHJ.exe
  2⤵
  PID:4256
- C:\Windows\System\ZVzJxhP.exe
  C:\Windows\System\ZVzJxhP.exe
  2⤵
  PID:1984
- C:\Windows\System\WGgknoj.exe
  C:\Windows\System\WGgknoj.exe
  2⤵
  PID:2028
- C:\Windows\System\PRNmhBt.exe
  C:\Windows\System\PRNmhBt.exe
  2⤵
  PID:3060
- C:\Windows\System\CRmShgf.exe
  C:\Windows\System\CRmShgf.exe
  2⤵
  PID:4848
- C:\Windows\System\MOQAEJb.exe
  C:\Windows\System\MOQAEJb.exe
  2⤵
  PID:4480
- C:\Windows\System\bBzuzLy.exe
  C:\Windows\System\bBzuzLy.exe
  2⤵
  PID:7052
- C:\Windows\System\LuAkMsc.exe
  C:\Windows\System\LuAkMsc.exe
  2⤵
  PID:7116
- C:\Windows\System\cbNpMcm.exe
  C:\Windows\System\cbNpMcm.exe
  2⤵
  PID:5724
- C:\Windows\System\vthGwIt.exe
  C:\Windows\System\vthGwIt.exe
  2⤵
  PID:6164
- C:\Windows\System\LRuOoUK.exe
  C:\Windows\System\LRuOoUK.exe
  2⤵
  PID:6448
- C:\Windows\System\mUuPWRh.exe
  C:\Windows\System\mUuPWRh.exe
  2⤵
  PID:6680
- C:\Windows\System\xzKzjLJ.exe
  C:\Windows\System\xzKzjLJ.exe
  2⤵
  PID:6876
- C:\Windows\System\IfSEiVT.exe
  C:\Windows\System\IfSEiVT.exe
  2⤵
  PID:7100
- C:\Windows\System\XogJxyx.exe
  C:\Windows\System\XogJxyx.exe
  2⤵
  PID:4704
- C:\Windows\System\NNAcwgB.exe
  C:\Windows\System\NNAcwgB.exe
  2⤵
  PID:4836
- C:\Windows\System\JtJHiOl.exe
  C:\Windows\System\JtJHiOl.exe
  2⤵
  PID:5324
- C:\Windows\System\RloTnGv.exe
  C:\Windows\System\RloTnGv.exe
  2⤵
  PID:5612
- C:\Windows\System\khxPikf.exe
  C:\Windows\System\khxPikf.exe
  2⤵
  PID:5968
- C:\Windows\System\pEHeYNK.exe
  C:\Windows\System\pEHeYNK.exe
  2⤵
  PID:5788
- C:\Windows\System\FCdElnF.exe
  C:\Windows\System\FCdElnF.exe
  2⤵
  PID:6400
- C:\Windows\System\xhHfRiD.exe
  C:\Windows\System\xhHfRiD.exe
  2⤵
  PID:6660
- C:\Windows\System\oIcbbkC.exe
  C:\Windows\System\oIcbbkC.exe
  2⤵
  PID:6956
- C:\Windows\System\gZrHVXJ.exe
  C:\Windows\System\gZrHVXJ.exe
  2⤵
  PID:6920
- C:\Windows\System\DTZzkZS.exe
  C:\Windows\System\DTZzkZS.exe
  2⤵
  PID:2640
- C:\Windows\System\QIkvsMf.exe
  C:\Windows\System\QIkvsMf.exe
  2⤵
  PID:4800
- C:\Windows\System\ulwmSJp.exe
  C:\Windows\System\ulwmSJp.exe
  2⤵
  PID:4456
- C:\Windows\System\fbNceVF.exe
  C:\Windows\System\fbNceVF.exe
  2⤵
  PID:5804
- C:\Windows\System\FnbBMkE.exe
  C:\Windows\System\FnbBMkE.exe
  2⤵
  PID:5548
- C:\Windows\System\TxPrjIQ.exe
  C:\Windows\System\TxPrjIQ.exe
  2⤵
  PID:1972
- C:\Windows\System\EZODuZa.exe
  C:\Windows\System\EZODuZa.exe
  2⤵
  PID:2608
- C:\Windows\System\zOlKlAa.exe
  C:\Windows\System\zOlKlAa.exe
  2⤵
  PID:2620
- C:\Windows\System\wnBWJVr.exe
  C:\Windows\System\wnBWJVr.exe
  2⤵
  PID:2524
- C:\Windows\System\tJtpNVF.exe
  C:\Windows\System\tJtpNVF.exe
  2⤵
  PID:2348
- C:\Windows\System\uDsRzaS.exe
  C:\Windows\System\uDsRzaS.exe
  2⤵
  PID:1588
- C:\Windows\System\FKEHzLI.exe
  C:\Windows\System\FKEHzLI.exe
  2⤵
  PID:6744
- C:\Windows\System\kbhqkzx.exe
  C:\Windows\System\kbhqkzx.exe
  2⤵
  PID:1692
- C:\Windows\System\nMPENnV.exe
  C:\Windows\System\nMPENnV.exe
  2⤵
  PID:6012
- C:\Windows\System\oTePNjW.exe
  C:\Windows\System\oTePNjW.exe
  2⤵
  PID:6244
- C:\Windows\System\kCoiouu.exe
  C:\Windows\System\kCoiouu.exe
  2⤵
  PID:4272
- C:\Windows\System\tOduAMj.exe
  C:\Windows\System\tOduAMj.exe
  2⤵
  PID:2076
- C:\Windows\System\wYStUnn.exe
  C:\Windows\System\wYStUnn.exe
  2⤵
  PID:4372
- C:\Windows\System\PkZwyub.exe
  C:\Windows\System\PkZwyub.exe
  2⤵
  PID:3860
- C:\Windows\System\Lwgrxkj.exe
  C:\Windows\System\Lwgrxkj.exe
  2⤵
  PID:4164
- C:\Windows\System\rOMvOmG.exe
  C:\Windows\System\rOMvOmG.exe
  2⤵
  PID:1868
- C:\Windows\System\JSBjmtr.exe
  C:\Windows\System\JSBjmtr.exe
  2⤵
  PID:2344
- C:\Windows\System\nbZbXjI.exe
  C:\Windows\System\nbZbXjI.exe
  2⤵
  PID:2784
- C:\Windows\System\xuBxjUs.exe
  C:\Windows\System\xuBxjUs.exe
  2⤵
  PID:4352
- C:\Windows\System\eELUivX.exe
  C:\Windows\System\eELUivX.exe
  2⤵
  PID:6736
- C:\Windows\System\YQJMKRi.exe
  C:\Windows\System\YQJMKRi.exe
  2⤵
  PID:5628
- C:\Windows\System\yWrPECP.exe
  C:\Windows\System\yWrPECP.exe
  2⤵
  PID:6796
- C:\Windows\System\sgJdItT.exe
  C:\Windows\System\sgJdItT.exe
  2⤵
  PID:6580
- C:\Windows\System\jKgOIqP.exe
  C:\Windows\System\jKgOIqP.exe
  2⤵
  PID:7004
- C:\Windows\System\OSqVUuW.exe
  C:\Windows\System\OSqVUuW.exe
  2⤵
  PID:4864
- C:\Windows\System\mDgzkFC.exe
  C:\Windows\System\mDgzkFC.exe
  2⤵
  PID:5220
- C:\Windows\System\cxsaNVN.exe
  C:\Windows\System\cxsaNVN.exe
  2⤵
  PID:5452
- C:\Windows\System\HnnMwBr.exe
  C:\Windows\System\HnnMwBr.exe
  2⤵
  PID:1616
- C:\Windows\System\OnqbySx.exe
  C:\Windows\System\OnqbySx.exe
  2⤵
  PID:6840
- C:\Windows\System\VloJvPe.exe
  C:\Windows\System\VloJvPe.exe
  2⤵
  PID:5904
- C:\Windows\System\DdrCAOF.exe
  C:\Windows\System\DdrCAOF.exe
  2⤵
  PID:6464
- C:\Windows\System\XOBcwbs.exe
  C:\Windows\System\XOBcwbs.exe
  2⤵
  PID:6096
- C:\Windows\System\aSVWNEq.exe
  C:\Windows\System\aSVWNEq.exe
  2⤵
  PID:6124
- C:\Windows\System\mFUXyuC.exe
  C:\Windows\System\mFUXyuC.exe
  2⤵
  PID:6596
- C:\Windows\System\TpxuMMC.exe
  C:\Windows\System\TpxuMMC.exe
  2⤵
  PID:6176
- C:\Windows\System\JoYdQkf.exe
  C:\Windows\System\JoYdQkf.exe
  2⤵
  PID:6112
- C:\Windows\System\ApdnIne.exe
  C:\Windows\System\ApdnIne.exe
  2⤵
  PID:6828
- C:\Windows\System\mWfJapg.exe
  C:\Windows\System\mWfJapg.exe
  2⤵
  PID:4484
- C:\Windows\System\JIQKHky.exe
  C:\Windows\System\JIQKHky.exe
  2⤵
  PID:1608
- C:\Windows\System\YzhalOr.exe
  C:\Windows\System\YzhalOr.exe
  2⤵
  PID:2236
- C:\Windows\System\OOuJLqO.exe
  C:\Windows\System\OOuJLqO.exe
  2⤵
  PID:3584
- C:\Windows\System\tGkwdSf.exe
  C:\Windows\System\tGkwdSf.exe
  2⤵
  PID:3664
- C:\Windows\System\zabOTDG.exe
  C:\Windows\System\zabOTDG.exe
  2⤵
  PID:7112
- C:\Windows\System\vizunDC.exe
  C:\Windows\System\vizunDC.exe
  2⤵
  PID:3180
- C:\Windows\System\gMeDVkd.exe
  C:\Windows\System\gMeDVkd.exe
  2⤵
  PID:6812
- C:\Windows\System\bBPIYdx.exe
  C:\Windows\System\bBPIYdx.exe
  2⤵
  PID:2724
- C:\Windows\System\dcyJxtF.exe
  C:\Windows\System\dcyJxtF.exe
  2⤵
  PID:6824
- C:\Windows\System\GRSiWsw.exe
  C:\Windows\System\GRSiWsw.exe
  2⤵
  PID:6504
- C:\Windows\System\uxwUQPw.exe
  C:\Windows\System\uxwUQPw.exe
  2⤵
  PID:6292
- C:\Windows\System\oBTOnJe.exe
  C:\Windows\System\oBTOnJe.exe
  2⤵
  PID:1604
- C:\Windows\System\rWTfhER.exe
  C:\Windows\System\rWTfhER.exe
  2⤵
  PID:2716
- C:\Windows\System\iOpLbGa.exe
  C:\Windows\System\iOpLbGa.exe
  2⤵
  PID:5584
- C:\Windows\System\sVKwfDN.exe
  C:\Windows\System\sVKwfDN.exe
  2⤵
  PID:6936
- C:\Windows\System\sTnJbTw.exe
  C:\Windows\System\sTnJbTw.exe
  2⤵
  PID:2452
- C:\Windows\System\sfyVQOd.exe
  C:\Windows\System\sfyVQOd.exe
  2⤵
  PID:6108
- C:\Windows\System\UFpkbYl.exe
  C:\Windows\System\UFpkbYl.exe
  2⤵
  PID:7000
- C:\Windows\System\icqSxFY.exe
  C:\Windows\System\icqSxFY.exe
  2⤵
  PID:6308
- C:\Windows\System\rmaBLnl.exe
  C:\Windows\System\rmaBLnl.exe
  2⤵
  PID:1368
- C:\Windows\System\ursmffx.exe
  C:\Windows\System\ursmffx.exe
  2⤵
  PID:6320
- C:\Windows\System\LBMGdqM.exe
  C:\Windows\System\LBMGdqM.exe
  2⤵
  PID:3348
- C:\Windows\System\eMFLCZM.exe
  C:\Windows\System\eMFLCZM.exe
  2⤵
  PID:6600
- C:\Windows\System\XRSWogN.exe
  C:\Windows\System\XRSWogN.exe
  2⤵
  PID:7176
- C:\Windows\System\PlcfiOp.exe
  C:\Windows\System\PlcfiOp.exe
  2⤵
  PID:7192
- C:\Windows\System\ddqDUbq.exe
  C:\Windows\System\ddqDUbq.exe
  2⤵
  PID:7208
- C:\Windows\System\cEymYpX.exe
  C:\Windows\System\cEymYpX.exe
  2⤵
  PID:7224
- C:\Windows\System\wdGuvtm.exe
  C:\Windows\System\wdGuvtm.exe
  2⤵
  PID:7240
- C:\Windows\System\HxIlsPK.exe
  C:\Windows\System\HxIlsPK.exe
  2⤵
  PID:7256
- C:\Windows\System\RudDbLL.exe
  C:\Windows\System\RudDbLL.exe
  2⤵
  PID:7272
- C:\Windows\System\WYDOHfF.exe
  C:\Windows\System\WYDOHfF.exe
  2⤵
  PID:7288
- C:\Windows\System\ReoZSMF.exe
  C:\Windows\System\ReoZSMF.exe
  2⤵
  PID:7304
- C:\Windows\System\MqalOga.exe
  C:\Windows\System\MqalOga.exe
  2⤵
  PID:7320
- C:\Windows\System\SSvnFSg.exe
  C:\Windows\System\SSvnFSg.exe
  2⤵
  PID:7336
- C:\Windows\System\qyhAJKE.exe
  C:\Windows\System\qyhAJKE.exe
  2⤵
  PID:7352
- C:\Windows\System\mmbDOdx.exe
  C:\Windows\System\mmbDOdx.exe
  2⤵
  PID:7368
- C:\Windows\System\ykYkGJR.exe
  C:\Windows\System\ykYkGJR.exe
  2⤵
  PID:7384
- C:\Windows\System\NevpEJA.exe
  C:\Windows\System\NevpEJA.exe
  2⤵
  PID:7400
- C:\Windows\System\IkNjGBf.exe
  C:\Windows\System\IkNjGBf.exe
  2⤵
  PID:7416
- C:\Windows\System\fJGELpK.exe
  C:\Windows\System\fJGELpK.exe
  2⤵
  PID:7432
- C:\Windows\System\gXYmYQh.exe
  C:\Windows\System\gXYmYQh.exe
  2⤵
  PID:7448
- C:\Windows\System\dOAdouS.exe
  C:\Windows\System\dOAdouS.exe
  2⤵
  PID:7464
- C:\Windows\System\ynkjUfy.exe
  C:\Windows\System\ynkjUfy.exe
  2⤵
  PID:7480
- C:\Windows\System\jpZqlst.exe
  C:\Windows\System\jpZqlst.exe
  2⤵
  PID:7496
- C:\Windows\System\vsqByRU.exe
  C:\Windows\System\vsqByRU.exe
  2⤵
  PID:7512
- C:\Windows\System\CUMkvwK.exe
  C:\Windows\System\CUMkvwK.exe
  2⤵
  PID:7528
- C:\Windows\System\QfWYxWR.exe
  C:\Windows\System\QfWYxWR.exe
  2⤵
  PID:7544
- C:\Windows\System\VsKhohm.exe
  C:\Windows\System\VsKhohm.exe
  2⤵
  PID:7560
- C:\Windows\System\sQDlVAW.exe
  C:\Windows\System\sQDlVAW.exe
  2⤵
  PID:7576
- C:\Windows\System\hNqLzNz.exe
  C:\Windows\System\hNqLzNz.exe
  2⤵
  PID:7592
- C:\Windows\System\LHAuuvv.exe
  C:\Windows\System\LHAuuvv.exe
  2⤵
  PID:7608
- C:\Windows\System\vQmQroq.exe
  C:\Windows\System\vQmQroq.exe
  2⤵
  PID:7624
- C:\Windows\System\IGMsZEu.exe
  C:\Windows\System\IGMsZEu.exe
  2⤵
  PID:7640
- C:\Windows\System\cvVNLEJ.exe
  C:\Windows\System\cvVNLEJ.exe
  2⤵
  PID:7656
- C:\Windows\System\LcKQlIt.exe
  C:\Windows\System\LcKQlIt.exe
  2⤵
  PID:7672
- C:\Windows\System\XiazTdO.exe
  C:\Windows\System\XiazTdO.exe
  2⤵
  PID:7688
- C:\Windows\System\yjfxcTg.exe
  C:\Windows\System\yjfxcTg.exe
  2⤵
  PID:7704
- C:\Windows\System\OTBtLqD.exe
  C:\Windows\System\OTBtLqD.exe
  2⤵
  PID:7720
- C:\Windows\System\uYeVCWH.exe
  C:\Windows\System\uYeVCWH.exe
  2⤵
  PID:7736
- C:\Windows\System\eeznIYt.exe
  C:\Windows\System\eeznIYt.exe
  2⤵
  PID:7756
- C:\Windows\System\aEvSkJe.exe
  C:\Windows\System\aEvSkJe.exe
  2⤵
  PID:7784
- C:\Windows\System\dPceGmG.exe
  C:\Windows\System\dPceGmG.exe
  2⤵
  PID:7800
- C:\Windows\System\XKwbVpr.exe
  C:\Windows\System\XKwbVpr.exe
  2⤵
  PID:7816
- C:\Windows\System\gdHqVAy.exe
  C:\Windows\System\gdHqVAy.exe
  2⤵
  PID:7832
- C:\Windows\System\ROuXMIo.exe
  C:\Windows\System\ROuXMIo.exe
  2⤵
  PID:7848
- C:\Windows\System\mWyZbne.exe
  C:\Windows\System\mWyZbne.exe
  2⤵
  PID:7864
- C:\Windows\System\jJXHRoS.exe
  C:\Windows\System\jJXHRoS.exe
  2⤵
  PID:7880
- C:\Windows\System\NPhLcMz.exe
  C:\Windows\System\NPhLcMz.exe
  2⤵
  PID:7896
- C:\Windows\System\XebfsoD.exe
  C:\Windows\System\XebfsoD.exe
  2⤵
  PID:7912
- C:\Windows\System\IvMzBvg.exe
  C:\Windows\System\IvMzBvg.exe
  2⤵
  PID:7940
- C:\Windows\System\MooJAMw.exe
  C:\Windows\System\MooJAMw.exe
  2⤵
  PID:7956
- C:\Windows\System\IMgKfPk.exe
  C:\Windows\System\IMgKfPk.exe
  2⤵
  PID:7972
- C:\Windows\System\JKwIMNG.exe
  C:\Windows\System\JKwIMNG.exe
  2⤵
  PID:7988
- C:\Windows\System\mwzTLkV.exe
  C:\Windows\System\mwzTLkV.exe
  2⤵
  PID:8004
- C:\Windows\System\yyQEKul.exe
  C:\Windows\System\yyQEKul.exe
  2⤵
  PID:8020
- C:\Windows\System\RPdKqDV.exe
  C:\Windows\System\RPdKqDV.exe
  2⤵
  PID:8036
- C:\Windows\System\xsbUdKQ.exe
  C:\Windows\System\xsbUdKQ.exe
  2⤵
  PID:8052
- C:\Windows\System\MaXLEAX.exe
  C:\Windows\System\MaXLEAX.exe
  2⤵
  PID:8068
- C:\Windows\System\SfXrMoC.exe
  C:\Windows\System\SfXrMoC.exe
  2⤵
  PID:8084
- C:\Windows\System\SlrnHLJ.exe
  C:\Windows\System\SlrnHLJ.exe
  2⤵
  PID:8100
- C:\Windows\System\hksvHEs.exe
  C:\Windows\System\hksvHEs.exe
  2⤵
  PID:8116
- C:\Windows\System\jGGGTpR.exe
  C:\Windows\System\jGGGTpR.exe
  2⤵
  PID:8132
- C:\Windows\System\APUeRll.exe
  C:\Windows\System\APUeRll.exe
  2⤵
  PID:8148
- C:\Windows\System\VaAJRar.exe
  C:\Windows\System\VaAJRar.exe
  2⤵
  PID:8164
- C:\Windows\System\YmJHKhj.exe
  C:\Windows\System\YmJHKhj.exe
  2⤵
  PID:8180
- C:\Windows\System\hPmJdQy.exe
  C:\Windows\System\hPmJdQy.exe
  2⤵
  PID:7188
- C:\Windows\System\TmIZHMQ.exe
  C:\Windows\System\TmIZHMQ.exe
  2⤵
  PID:5052
- C:\Windows\System\GsXTpNl.exe
  C:\Windows\System\GsXTpNl.exe
  2⤵
  PID:7284
- C:\Windows\System\kPhjawS.exe
  C:\Windows\System\kPhjawS.exe
  2⤵
  PID:7348
- C:\Windows\System\VAGPden.exe
  C:\Windows\System\VAGPden.exe
  2⤵
  PID:7412
- C:\Windows\System\COMRpvK.exe
  C:\Windows\System\COMRpvK.exe
  2⤵
  PID:7172
- C:\Windows\System\bjzLiNE.exe
  C:\Windows\System\bjzLiNE.exe
  2⤵
  PID:7476
- C:\Windows\System\CooWVdG.exe
  C:\Windows\System\CooWVdG.exe
  2⤵
  PID:7508
- C:\Windows\System\oJzQUxh.exe
  C:\Windows\System\oJzQUxh.exe
  2⤵
  PID:7296
- C:\Windows\System\KgeWXEQ.exe
  C:\Windows\System\KgeWXEQ.exe
  2⤵
  PID:7604
- C:\Windows\System\SZueIYV.exe
  C:\Windows\System\SZueIYV.exe
  2⤵
  PID:7636
- C:\Windows\System\kybARzB.exe
  C:\Windows\System\kybARzB.exe
  2⤵
  PID:7424
- C:\Windows\System\TtCTcda.exe
  C:\Windows\System\TtCTcda.exe
  2⤵
  PID:7696
- C:\Windows\System\UzhfxXR.exe
  C:\Windows\System\UzhfxXR.exe
  2⤵
  PID:7524
- C:\Windows\System\JmYiMiW.exe
  C:\Windows\System\JmYiMiW.exe
  2⤵
  PID:7460
- C:\Windows\System\sgUTxWH.exe
  C:\Windows\System\sgUTxWH.exe
  2⤵
  PID:7588
- C:\Windows\System\uhfMdMS.exe
  C:\Windows\System\uhfMdMS.exe
  2⤵
  PID:7680
- C:\Windows\System\ksiuKqt.exe
  C:\Windows\System\ksiuKqt.exe
  2⤵
  PID:7520
- C:\Windows\System\muWwAOq.exe
  C:\Windows\System\muWwAOq.exe
  2⤵
  PID:7752
- C:\Windows\System\QSogmRw.exe
  C:\Windows\System\QSogmRw.exe
  2⤵
  PID:7780
- C:\Windows\System\PTplsmp.exe
  C:\Windows\System\PTplsmp.exe
  2⤵
  PID:7844
- C:\Windows\System\oYNIRTS.exe
  C:\Windows\System\oYNIRTS.exe
  2⤵
  PID:7904
- C:\Windows\System\cwumpnw.exe
  C:\Windows\System\cwumpnw.exe
  2⤵
  PID:7828
- C:\Windows\System\BTMbypq.exe
  C:\Windows\System\BTMbypq.exe
  2⤵
  PID:7856
- C:\Windows\System\ETIBbWx.exe
  C:\Windows\System\ETIBbWx.exe
  2⤵
  PID:7936
- C:\Windows\System\gndWlOs.exe
  C:\Windows\System\gndWlOs.exe
  2⤵
  PID:7996
- C:\Windows\System\ROYDHWW.exe
  C:\Windows\System\ROYDHWW.exe
  2⤵
  PID:8000
- C:\Windows\System\SzpGqxu.exe
  C:\Windows\System\SzpGqxu.exe
  2⤵
  PID:8032
- C:\Windows\System\wuhODYe.exe
  C:\Windows\System\wuhODYe.exe
  2⤵
  PID:8112
- C:\Windows\System\mEhcQmZ.exe
  C:\Windows\System\mEhcQmZ.exe
  2⤵
  PID:8172
- C:\Windows\System\brxfzGp.exe
  C:\Windows\System\brxfzGp.exe
  2⤵
  PID:8108
- C:\Windows\System\EDeMQeF.exe
  C:\Windows\System\EDeMQeF.exe
  2⤵
  PID:8124
- C:\Windows\System\fWCmxJw.exe
  C:\Windows\System\fWCmxJw.exe
  2⤵
  PID:8188
- C:\Windows\System\MGmjyNQ.exe
  C:\Windows\System\MGmjyNQ.exe
  2⤵
  PID:7376
- C:\Windows\System\Dmrxdwr.exe
  C:\Windows\System\Dmrxdwr.exe
  2⤵
  PID:3384
- C:\Windows\System\FwyRUVA.exe
  C:\Windows\System\FwyRUVA.exe
  2⤵
  PID:7768
- C:\Windows\System\cUxcHAR.exe
  C:\Windows\System\cUxcHAR.exe
  2⤵
  PID:7264
- C:\Windows\System\vVdRfZF.exe
  C:\Windows\System\vVdRfZF.exe
  2⤵
  PID:7232
- C:\Windows\System\ZAmtUVH.exe
  C:\Windows\System\ZAmtUVH.exe
  2⤵
  PID:7540
- C:\Windows\System\FclYqJl.exe
  C:\Windows\System\FclYqJl.exe
  2⤵
  PID:7556
- C:\Windows\System\XRojzRW.exe
  C:\Windows\System\XRojzRW.exe
  2⤵
  PID:7236
- C:\Windows\System\NsPaUOL.exe
  C:\Windows\System\NsPaUOL.exe
  2⤵
  PID:7668
- C:\Windows\System\LDjjwIc.exe
  C:\Windows\System\LDjjwIc.exe
  2⤵
  PID:7632
- C:\Windows\System\CXODhVX.exe
  C:\Windows\System\CXODhVX.exe
  2⤵
  PID:7456
- C:\Windows\System\nmbJLHU.exe
  C:\Windows\System\nmbJLHU.exe
  2⤵
  PID:7840
- C:\Windows\System\xPTwfUD.exe
  C:\Windows\System\xPTwfUD.exe
  2⤵
  PID:7380
- C:\Windows\System\ySrJRJe.exe
  C:\Windows\System\ySrJRJe.exe
  2⤵
  PID:7968
- C:\Windows\System\HgwJKOz.exe
  C:\Windows\System\HgwJKOz.exe
  2⤵
  PID:8076
- C:\Windows\System\aIogPMG.exe
  C:\Windows\System\aIogPMG.exe
  2⤵
  PID:8156
- C:\Windows\System\oZjGoru.exe
  C:\Windows\System\oZjGoru.exe
  2⤵
  PID:2052
- C:\Windows\System\jurAaCo.exe
  C:\Windows\System\jurAaCo.exe
  2⤵
  PID:1452
- C:\Windows\System\wYcbKrk.exe
  C:\Windows\System\wYcbKrk.exe
  2⤵
  PID:7220
- C:\Windows\System\qwUDOnZ.exe
  C:\Windows\System\qwUDOnZ.exe
  2⤵
  PID:7908
- C:\Windows\System\UWLtXur.exe
  C:\Windows\System\UWLtXur.exe
  2⤵
  PID:7572
- C:\Windows\System\VnRjjYM.exe
  C:\Windows\System\VnRjjYM.exe
  2⤵
  PID:7792
- C:\Windows\System\TgDjact.exe
  C:\Windows\System\TgDjact.exe
  2⤵
  PID:1580
- C:\Windows\System\oZcsAmR.exe
  C:\Windows\System\oZcsAmR.exe
  2⤵
  PID:7048
- C:\Windows\System\Upakrfy.exe
  C:\Windows\System\Upakrfy.exe
  2⤵
  PID:8044
- C:\Windows\System\mqqFOoE.exe
  C:\Windows\System\mqqFOoE.exe
  2⤵
  PID:7332
- C:\Windows\System\YVpCCYA.exe
  C:\Windows\System\YVpCCYA.exe
  2⤵
  PID:7392
- C:\Windows\System\RnfGIRj.exe
  C:\Windows\System\RnfGIRj.exe
  2⤵
  PID:7396
- C:\Windows\System\HlIVZDK.exe
  C:\Windows\System\HlIVZDK.exe
  2⤵
  PID:8012
- C:\Windows\System\cjbzIkX.exe
  C:\Windows\System\cjbzIkX.exe
  2⤵
  PID:8196
- C:\Windows\System\xibybjY.exe
  C:\Windows\System\xibybjY.exe
  2⤵
  PID:8212
- C:\Windows\System\ZbOEVMh.exe
  C:\Windows\System\ZbOEVMh.exe
  2⤵
  PID:8228
- C:\Windows\System\XEqqAPq.exe
  C:\Windows\System\XEqqAPq.exe
  2⤵
  PID:8244
- C:\Windows\System\jJfXxWG.exe
  C:\Windows\System\jJfXxWG.exe
  2⤵
  PID:8260
- C:\Windows\System\KMlvRro.exe
  C:\Windows\System\KMlvRro.exe
  2⤵
  PID:8276
- C:\Windows\System\JUmxoIP.exe
  C:\Windows\System\JUmxoIP.exe
  2⤵
  PID:8292
- C:\Windows\System\KKQEZbX.exe
  C:\Windows\System\KKQEZbX.exe
  2⤵
  PID:8312
- C:\Windows\System\aJASugV.exe
  C:\Windows\System\aJASugV.exe
  2⤵
  PID:8328
- C:\Windows\System\wBhkrns.exe
  C:\Windows\System\wBhkrns.exe
  2⤵
  PID:8344
- C:\Windows\System\BabONBn.exe
  C:\Windows\System\BabONBn.exe
  2⤵
  PID:8360
- C:\Windows\System\CQGUApd.exe
  C:\Windows\System\CQGUApd.exe
  2⤵
  PID:8376
- C:\Windows\System\zSLfnMu.exe
  C:\Windows\System\zSLfnMu.exe
  2⤵
  PID:8392
- C:\Windows\System\GUOOEbY.exe
  C:\Windows\System\GUOOEbY.exe
  2⤵
  PID:8408
- C:\Windows\System\celtdin.exe
  C:\Windows\System\celtdin.exe
  2⤵
  PID:8424
- C:\Windows\System\HHcfptq.exe
  C:\Windows\System\HHcfptq.exe
  2⤵
  PID:8440
- C:\Windows\System\TjvvsLS.exe
  C:\Windows\System\TjvvsLS.exe
  2⤵
  PID:8456
- C:\Windows\System\FENRPbQ.exe
  C:\Windows\System\FENRPbQ.exe
  2⤵
  PID:8472
- C:\Windows\System\FrmzZYg.exe
  C:\Windows\System\FrmzZYg.exe
  2⤵
  PID:8500
- C:\Windows\System\ACjMfbO.exe
  C:\Windows\System\ACjMfbO.exe
  2⤵
  PID:8516
- C:\Windows\System\tqYZcze.exe
  C:\Windows\System\tqYZcze.exe
  2⤵
  PID:8532
- C:\Windows\System\ZnZfEDg.exe
  C:\Windows\System\ZnZfEDg.exe
  2⤵
  PID:8548
- C:\Windows\System\dCjICQO.exe
  C:\Windows\System\dCjICQO.exe
  2⤵
  PID:8564
- C:\Windows\System\tzxkDkS.exe
  C:\Windows\System\tzxkDkS.exe
  2⤵
  PID:8580
- C:\Windows\System\MAwVPql.exe
  C:\Windows\System\MAwVPql.exe
  2⤵
  PID:8596
- C:\Windows\System\zPnjUAz.exe
  C:\Windows\System\zPnjUAz.exe
  2⤵
  PID:8612
- C:\Windows\System\vmmhbNJ.exe
  C:\Windows\System\vmmhbNJ.exe
  2⤵
  PID:8628
- C:\Windows\System\QFDebhV.exe
  C:\Windows\System\QFDebhV.exe
  2⤵
  PID:8644
- C:\Windows\System\gSdNHUu.exe
  C:\Windows\System\gSdNHUu.exe
  2⤵
  PID:8660
- C:\Windows\System\KNFSbsy.exe
  C:\Windows\System\KNFSbsy.exe
  2⤵
  PID:8676
- C:\Windows\System\tAAcxRr.exe
  C:\Windows\System\tAAcxRr.exe
  2⤵
  PID:8692
- C:\Windows\System\eIpuRjL.exe
  C:\Windows\System\eIpuRjL.exe
  2⤵
  PID:8708
- C:\Windows\System\fawoJbT.exe
  C:\Windows\System\fawoJbT.exe
  2⤵
  PID:8724
- C:\Windows\System\PWgDPYs.exe
  C:\Windows\System\PWgDPYs.exe
  2⤵
  PID:8740
- C:\Windows\System\UUNIrPb.exe
  C:\Windows\System\UUNIrPb.exe
  2⤵
  PID:8808
- C:\Windows\System\xBAoJBW.exe
  C:\Windows\System\xBAoJBW.exe
  2⤵
  PID:8824
- C:\Windows\System\ISCssQE.exe
  C:\Windows\System\ISCssQE.exe
  2⤵
  PID:8876
- C:\Windows\System\bdUxfRw.exe
  C:\Windows\System\bdUxfRw.exe
  2⤵
  PID:8892
- C:\Windows\System\Vfuhdye.exe
  C:\Windows\System\Vfuhdye.exe
  2⤵
  PID:8912
- C:\Windows\System\VhrMjxT.exe
  C:\Windows\System\VhrMjxT.exe
  2⤵
  PID:8928
- C:\Windows\System\DLGFFmH.exe
  C:\Windows\System\DLGFFmH.exe
  2⤵
  PID:8944
- C:\Windows\System\ztAvVAf.exe
  C:\Windows\System\ztAvVAf.exe
  2⤵
  PID:8964
- C:\Windows\System\XWuVsCq.exe
  C:\Windows\System\XWuVsCq.exe
  2⤵
  PID:8980
- C:\Windows\System\SQHjEKO.exe
  C:\Windows\System\SQHjEKO.exe
  2⤵
  PID:8996
- C:\Windows\System\kopMaZT.exe
  C:\Windows\System\kopMaZT.exe
  2⤵
  PID:9012
- C:\Windows\System\xGkMioK.exe
  C:\Windows\System\xGkMioK.exe
  2⤵
  PID:9032
- C:\Windows\System\wckotyI.exe
  C:\Windows\System\wckotyI.exe
  2⤵
  PID:9052
- C:\Windows\System\VptqEMA.exe
  C:\Windows\System\VptqEMA.exe
  2⤵
  PID:9068
- C:\Windows\System\yVikfJj.exe
  C:\Windows\System\yVikfJj.exe
  2⤵
  PID:9084
- C:\Windows\System\CYReCGB.exe
  C:\Windows\System\CYReCGB.exe
  2⤵
  PID:9100
- C:\Windows\System\KEGNJmQ.exe
  C:\Windows\System\KEGNJmQ.exe
  2⤵
  PID:9116
- C:\Windows\System\jIyFyZu.exe
  C:\Windows\System\jIyFyZu.exe
  2⤵
  PID:9132
- C:\Windows\System\YIdWous.exe
  C:\Windows\System\YIdWous.exe
  2⤵
  PID:9148
- C:\Windows\System\LmHGAmG.exe
  C:\Windows\System\LmHGAmG.exe
  2⤵
  PID:9164
- C:\Windows\System\pxeRPNk.exe
  C:\Windows\System\pxeRPNk.exe
  2⤵
  PID:9180
- C:\Windows\System\TpEhgrq.exe
  C:\Windows\System\TpEhgrq.exe
  2⤵
  PID:9196
- C:\Windows\System\sTcHhgR.exe
  C:\Windows\System\sTcHhgR.exe
  2⤵
  PID:9212
- C:\Windows\System\wYIckJh.exe
  C:\Windows\System\wYIckJh.exe
  2⤵
  PID:7488
- C:\Windows\System\CqEUoKf.exe
  C:\Windows\System\CqEUoKf.exe
  2⤵
  PID:2872
- C:\Windows\System\xRxAsCh.exe
  C:\Windows\System\xRxAsCh.exe
  2⤵
  PID:7204
- C:\Windows\System\vCgjtmK.exe
  C:\Windows\System\vCgjtmK.exe
  2⤵
  PID:7268
- C:\Windows\System\ARwMpps.exe
  C:\Windows\System\ARwMpps.exe
  2⤵
  PID:7932
- C:\Windows\System\SilAbIX.exe
  C:\Windows\System\SilAbIX.exe
  2⤵
  PID:8252
- C:\Windows\System\YbbhESF.exe
  C:\Windows\System\YbbhESF.exe
  2⤵
  PID:8300
- C:\Windows\System\VlzvBkK.exe
  C:\Windows\System\VlzvBkK.exe
  2⤵
  PID:8308
- C:\Windows\System\eElHpsE.exe
  C:\Windows\System\eElHpsE.exe
  2⤵
  PID:8404
- C:\Windows\System\WrwUBQZ.exe
  C:\Windows\System\WrwUBQZ.exe
  2⤵
  PID:8320
- C:\Windows\System\owCwMZr.exe
  C:\Windows\System\owCwMZr.exe
  2⤵
  PID:8384
- C:\Windows\System\JeiriRw.exe
  C:\Windows\System\JeiriRw.exe
  2⤵
  PID:8352
- C:\Windows\System\vHMrwLy.exe
  C:\Windows\System\vHMrwLy.exe
  2⤵
  PID:8416
- C:\Windows\System\EGLORZB.exe
  C:\Windows\System\EGLORZB.exe
  2⤵
  PID:8508
- C:\Windows\System\UWfsFfH.exe
  C:\Windows\System\UWfsFfH.exe
  2⤵
  PID:8540
- C:\Windows\System\pNqTAaN.exe
  C:\Windows\System\pNqTAaN.exe
  2⤵
  PID:8604
- C:\Windows\System\mySxLPR.exe
  C:\Windows\System\mySxLPR.exe
  2⤵
  PID:8668
- C:\Windows\System\jbLTaqJ.exe
  C:\Windows\System\jbLTaqJ.exe
  2⤵
  PID:8732
- C:\Windows\System\qfKIrwF.exe
  C:\Windows\System\qfKIrwF.exe
  2⤵
  PID:8560
- C:\Windows\System\DHqhVqr.exe
  C:\Windows\System\DHqhVqr.exe
  2⤵
  PID:8592
- C:\Windows\System\iKMNPgT.exe
  C:\Windows\System\iKMNPgT.exe
  2⤵
  PID:8656
- C:\Windows\System\lYlwHzC.exe
  C:\Windows\System\lYlwHzC.exe
  2⤵
  PID:8720
- C:\Windows\System\fmubosb.exe
  C:\Windows\System\fmubosb.exe
  2⤵
  PID:8760
- C:\Windows\System\BdeVdqB.exe
  C:\Windows\System\BdeVdqB.exe
  2⤵
  PID:8780
- C:\Windows\System\GSfhJqg.exe
  C:\Windows\System\GSfhJqg.exe
  2⤵
  PID:8816
- C:\Windows\System\WBjuIYb.exe
  C:\Windows\System\WBjuIYb.exe
  2⤵
  PID:8832
- C:\Windows\System\blckOWK.exe
  C:\Windows\System\blckOWK.exe
  2⤵
  PID:8920
- C:\Windows\System\XgdVNyL.exe
  C:\Windows\System\XgdVNyL.exe
  2⤵
  PID:8960
- C:\Windows\System\bAGWOOd.exe
  C:\Windows\System\bAGWOOd.exe
  2⤵
  PID:9020
- C:\Windows\System\maNhJGW.exe
  C:\Windows\System\maNhJGW.exe
  2⤵
  PID:8840
- C:\Windows\System\PuIVANT.exe
  C:\Windows\System\PuIVANT.exe
  2⤵
  PID:8856
- C:\Windows\System\fZaSKwy.exe
  C:\Windows\System\fZaSKwy.exe
  2⤵
  PID:8872
- C:\Windows\System\oASWbue.exe
  C:\Windows\System\oASWbue.exe
  2⤵
  PID:9124
- C:\Windows\System\fHDSPxy.exe
  C:\Windows\System\fHDSPxy.exe
  2⤵
  PID:8940
- C:\Windows\System\zbLVWLh.exe
  C:\Windows\System\zbLVWLh.exe
  2⤵
  PID:8972
- C:\Windows\System\cFAPJKs.exe
  C:\Windows\System\cFAPJKs.exe
  2⤵
  PID:8904
- C:\Windows\System\DXPfUPz.exe
  C:\Windows\System\DXPfUPz.exe
  2⤵
  PID:9140
- C:\Windows\System\jXEjpmb.exe
  C:\Windows\System\jXEjpmb.exe
  2⤵
  PID:8060
- C:\Windows\System\ombLasB.exe
  C:\Windows\System\ombLasB.exe
  2⤵
  PID:7428
- C:\Windows\System\fjwjxPz.exe
  C:\Windows\System\fjwjxPz.exe
  2⤵
  PID:9144
- C:\Windows\System\GCHfJol.exe
  C:\Windows\System\GCHfJol.exe
  2⤵
  PID:9172
- C:\Windows\System\CtrNIOf.exe
  C:\Windows\System\CtrNIOf.exe
  2⤵
  PID:7796
- C:\Windows\System\dldQhRS.exe
  C:\Windows\System\dldQhRS.exe
  2⤵
  PID:8272
- C:\Windows\System\bAbaihS.exe
  C:\Windows\System\bAbaihS.exe
  2⤵
  PID:8288
- C:\Windows\System\aEMNFRc.exe
  C:\Windows\System\aEMNFRc.exe
  2⤵
  PID:8368
- C:\Windows\System\izrkFOy.exe
  C:\Windows\System\izrkFOy.exe
  2⤵
  PID:8448
- C:\Windows\System\ShrAPyW.exe
  C:\Windows\System\ShrAPyW.exe
  2⤵
  PID:8388
- C:\Windows\System\ufGrLhi.exe
  C:\Windows\System\ufGrLhi.exe
  2⤵
  PID:8480
- C:\Windows\System\NAjNOif.exe
  C:\Windows\System\NAjNOif.exe
  2⤵
  PID:8544
- C:\Windows\System\sGyiBvn.exe
  C:\Windows\System\sGyiBvn.exe
  2⤵
  PID:8524
- C:\Windows\System\cZvCyZL.exe
  C:\Windows\System\cZvCyZL.exe
  2⤵
  PID:8652
- C:\Windows\System\usuhIjG.exe
  C:\Windows\System\usuhIjG.exe
  2⤵
  PID:8792
- C:\Windows\System\BCZBizu.exe
  C:\Windows\System\BCZBizu.exe
  2⤵
  PID:8860
- C:\Windows\System\ouqlUla.exe
  C:\Windows\System\ouqlUla.exe
  2⤵
  PID:8820
- C:\Windows\System\KpqkVRm.exe
  C:\Windows\System\KpqkVRm.exe
  2⤵
  PID:8688
- C:\Windows\System\tCZqgYf.exe
  C:\Windows\System\tCZqgYf.exe
  2⤵
  PID:8952
- C:\Windows\System\xQbVoBZ.exe
  C:\Windows\System\xQbVoBZ.exe
  2⤵
  PID:9092
- C:\Windows\System\wCaHqOc.exe
  C:\Windows\System\wCaHqOc.exe
  2⤵
  PID:8864
- C:\Windows\System\mPemWqx.exe
  C:\Windows\System\mPemWqx.exe
  2⤵
  PID:8908
- C:\Windows\System\usZlWoG.exe
  C:\Windows\System\usZlWoG.exe
  2⤵
  PID:8092
- C:\Windows\System\xahROBE.exe
  C:\Windows\System\xahROBE.exe
  2⤵
  PID:8220
- C:\Windows\System\YcgpVfZ.exe
  C:\Windows\System\YcgpVfZ.exe
  2⤵
  PID:8356
- C:\Windows\System\ETsGZGR.exe
  C:\Windows\System\ETsGZGR.exe
  2⤵
  PID:8556
- C:\Windows\System\kxJxqAI.exe
  C:\Windows\System\kxJxqAI.exe
  2⤵
  PID:8800
- C:\Windows\System\VGOUslc.exe
  C:\Windows\System\VGOUslc.exe
  2⤵
  PID:9044
- C:\Windows\System\qIKNcDa.exe
  C:\Windows\System\qIKNcDa.exe
  2⤵
  PID:9188
- C:\Windows\System\LmpJaQq.exe
  C:\Windows\System\LmpJaQq.exe
  2⤵
  PID:7860
- C:\Windows\System\iRcJUNG.exe
  C:\Windows\System\iRcJUNG.exe
  2⤵
  PID:8764
- C:\Windows\System\yUGTHCB.exe
  C:\Windows\System\yUGTHCB.exe
  2⤵
  PID:9156
- C:\Windows\System\vtPwjun.exe
  C:\Windows\System\vtPwjun.exe
  2⤵
  PID:9004
- C:\Windows\System\nDtxvpc.exe
  C:\Windows\System\nDtxvpc.exe
  2⤵
  PID:8588
- C:\Windows\System\LYTlooH.exe
  C:\Windows\System\LYTlooH.exe
  2⤵
  PID:8236
- C:\Windows\System\bSQDJIG.exe
  C:\Windows\System\bSQDJIG.exe
  2⤵
  PID:8852
- C:\Windows\System\dxqbAKh.exe
  C:\Windows\System\dxqbAKh.exe
  2⤵
  PID:9112
- C:\Windows\System\sVOghqP.exe
  C:\Windows\System\sVOghqP.exe
  2⤵
  PID:8768
- C:\Windows\System\NDLMFNu.exe
  C:\Windows\System\NDLMFNu.exe
  2⤵
  PID:9228
- C:\Windows\System\AiCjKYZ.exe
  C:\Windows\System\AiCjKYZ.exe
  2⤵
  PID:9244
- C:\Windows\System\PwZQAVy.exe
  C:\Windows\System\PwZQAVy.exe
  2⤵
  PID:9260
- C:\Windows\System\jZxoMJp.exe
  C:\Windows\System\jZxoMJp.exe
  2⤵
  PID:9276
- C:\Windows\System\bKdKfjr.exe
  C:\Windows\System\bKdKfjr.exe
  2⤵
  PID:9292
- C:\Windows\System\kJkQlLA.exe
  C:\Windows\System\kJkQlLA.exe
  2⤵
  PID:9308
- C:\Windows\System\PjZNLMc.exe
  C:\Windows\System\PjZNLMc.exe
  2⤵
  PID:9324
- C:\Windows\System\hafOcHs.exe
  C:\Windows\System\hafOcHs.exe
  2⤵
  PID:9340
- C:\Windows\System\YTMWOIk.exe
  C:\Windows\System\YTMWOIk.exe
  2⤵
  PID:9356
- C:\Windows\System\XmVstOv.exe
  C:\Windows\System\XmVstOv.exe
  2⤵
  PID:9376
- C:\Windows\System\VzRanPY.exe
  C:\Windows\System\VzRanPY.exe
  2⤵
  PID:9392
- C:\Windows\System\VwqmDYx.exe
  C:\Windows\System\VwqmDYx.exe
  2⤵
  PID:9408
- C:\Windows\System\GYpOgJe.exe
  C:\Windows\System\GYpOgJe.exe
  2⤵
  PID:9428
- C:\Windows\System\KRNjahl.exe
  C:\Windows\System\KRNjahl.exe
  2⤵
  PID:9448
- C:\Windows\System\YNPCPKm.exe
  C:\Windows\System\YNPCPKm.exe
  2⤵
  PID:9464
- C:\Windows\System\JpKqrpo.exe
  C:\Windows\System\JpKqrpo.exe
  2⤵
  PID:9480
- C:\Windows\System\iqhaRag.exe
  C:\Windows\System\iqhaRag.exe
  2⤵
  PID:9496
- C:\Windows\System\MAlpXnq.exe
  C:\Windows\System\MAlpXnq.exe
  2⤵
  PID:9512
- C:\Windows\System\znEoWbA.exe
  C:\Windows\System\znEoWbA.exe
  2⤵
  PID:9528
- C:\Windows\System\KUtVkQk.exe
  C:\Windows\System\KUtVkQk.exe
  2⤵
  PID:9544
- C:\Windows\System\WLFErMk.exe
  C:\Windows\System\WLFErMk.exe
  2⤵
  PID:9560
- C:\Windows\System\ZGaOooA.exe
  C:\Windows\System\ZGaOooA.exe
  2⤵
  PID:9576
- C:\Windows\System\CsTivTj.exe
  C:\Windows\System\CsTivTj.exe
  2⤵
  PID:9592
- C:\Windows\System\amfJLoj.exe
  C:\Windows\System\amfJLoj.exe
  2⤵
  PID:9608
- C:\Windows\System\iIWhESh.exe
  C:\Windows\System\iIWhESh.exe
  2⤵
  PID:9624
- C:\Windows\System\hnJUoTI.exe
  C:\Windows\System\hnJUoTI.exe
  2⤵
  PID:9640
- C:\Windows\System\wQdoCNS.exe
  C:\Windows\System\wQdoCNS.exe
  2⤵
  PID:9656
- C:\Windows\System\AUcZzmZ.exe
  C:\Windows\System\AUcZzmZ.exe
  2⤵
  PID:9672
- C:\Windows\System\KkZRGHW.exe
  C:\Windows\System\KkZRGHW.exe
  2⤵
  PID:9688
- C:\Windows\System\drOSUAY.exe
  C:\Windows\System\drOSUAY.exe
  2⤵
  PID:9704
- C:\Windows\System\VhQCVbw.exe
  C:\Windows\System\VhQCVbw.exe
  2⤵
  PID:9720
- C:\Windows\System\gPgxnvZ.exe
  C:\Windows\System\gPgxnvZ.exe
  2⤵
  PID:9736
- C:\Windows\System\oeoBsfR.exe
  C:\Windows\System\oeoBsfR.exe
  2⤵
  PID:9752
- C:\Windows\System\KjTFjzx.exe
  C:\Windows\System\KjTFjzx.exe
  2⤵
  PID:9768
- C:\Windows\System\TAhZiSY.exe
  C:\Windows\System\TAhZiSY.exe
  2⤵
  PID:9784
- C:\Windows\System\gjqjiEe.exe
  C:\Windows\System\gjqjiEe.exe
  2⤵
  PID:9800
- C:\Windows\System\cZTIQYr.exe
  C:\Windows\System\cZTIQYr.exe
  2⤵
  PID:9816
- C:\Windows\System\nbDxojV.exe
  C:\Windows\System\nbDxojV.exe
  2⤵
  PID:9832
- C:\Windows\System\uGmcBuJ.exe
  C:\Windows\System\uGmcBuJ.exe
  2⤵
  PID:9848
- C:\Windows\System\ZWdPZPT.exe
  C:\Windows\System\ZWdPZPT.exe
  2⤵
  PID:9864
- C:\Windows\System\iDNHlWy.exe
  C:\Windows\System\iDNHlWy.exe
  2⤵
  PID:9880
- C:\Windows\System\XclRasf.exe
  C:\Windows\System\XclRasf.exe
  2⤵
  PID:9896
- C:\Windows\System\QiBAYuz.exe
  C:\Windows\System\QiBAYuz.exe
  2⤵
  PID:9912
- C:\Windows\System\lJaaWAh.exe
  C:\Windows\System\lJaaWAh.exe
  2⤵
  PID:9928
- C:\Windows\System\kItSBii.exe
  C:\Windows\System\kItSBii.exe
  2⤵
  PID:9944
- C:\Windows\System\zRhyTbk.exe
  C:\Windows\System\zRhyTbk.exe
  2⤵
  PID:9960
- C:\Windows\System\jRGcfaH.exe
  C:\Windows\System\jRGcfaH.exe
  2⤵
  PID:9976
- C:\Windows\System\BUyhITr.exe
  C:\Windows\System\BUyhITr.exe
  2⤵
  PID:9992
- C:\Windows\System\CowXwin.exe
  C:\Windows\System\CowXwin.exe
  2⤵
  PID:10008
- C:\Windows\System\ExmYHzo.exe
  C:\Windows\System\ExmYHzo.exe
  2⤵
  PID:10024
- C:\Windows\System\DXALwjl.exe
  C:\Windows\System\DXALwjl.exe
  2⤵
  PID:10040
- C:\Windows\System\qYXvRxt.exe
  C:\Windows\System\qYXvRxt.exe
  2⤵
  PID:10056
- C:\Windows\System\HEqVHWC.exe
  C:\Windows\System\HEqVHWC.exe
  2⤵
  PID:10072
- C:\Windows\System\SxMlmsu.exe
  C:\Windows\System\SxMlmsu.exe
  2⤵
  PID:10088
- C:\Windows\System\fEbezde.exe
  C:\Windows\System\fEbezde.exe
  2⤵
  PID:10104
- C:\Windows\System\fIFVmVt.exe
  C:\Windows\System\fIFVmVt.exe
  2⤵
  PID:10120
- C:\Windows\System\mbTsWqW.exe
  C:\Windows\System\mbTsWqW.exe
  2⤵
  PID:10136
- C:\Windows\System\BiLStFT.exe
  C:\Windows\System\BiLStFT.exe
  2⤵
  PID:10152
- C:\Windows\System\gmuLZfJ.exe
  C:\Windows\System\gmuLZfJ.exe
  2⤵
  PID:10168
- C:\Windows\System\HmtpdqI.exe
  C:\Windows\System\HmtpdqI.exe
  2⤵
  PID:10184
- C:\Windows\System\kQIaATg.exe
  C:\Windows\System\kQIaATg.exe
  2⤵
  PID:10200
- C:\Windows\System\rGcMXjT.exe
  C:\Windows\System\rGcMXjT.exe
  2⤵
  PID:10216
- C:\Windows\System\KrGDDhy.exe
  C:\Windows\System\KrGDDhy.exe
  2⤵
  PID:10232
- C:\Windows\System\LzKLUyB.exe
  C:\Windows\System\LzKLUyB.exe
  2⤵
  PID:8576
- C:\Windows\System\ieyUdxJ.exe
  C:\Windows\System\ieyUdxJ.exe
  2⤵
  PID:9268
- C:\Windows\System\QBWvEWF.exe
  C:\Windows\System\QBWvEWF.exe
  2⤵
  PID:9304
- C:\Windows\System\qgjQctZ.exe
  C:\Windows\System\qgjQctZ.exe
  2⤵
  PID:9336
- C:\Windows\System\EXhLEgP.exe
  C:\Windows\System\EXhLEgP.exe
  2⤵
  PID:9288
- C:\Windows\System\pwckgfM.exe
  C:\Windows\System\pwckgfM.exe
  2⤵
  PID:9352
- C:\Windows\System\GJOFEWa.exe
  C:\Windows\System\GJOFEWa.exe
  2⤵
  PID:8496
- C:\Windows\System\VWxDjME.exe
  C:\Windows\System\VWxDjME.exe
  2⤵
  PID:9316
- C:\Windows\System\PKImuph.exe
  C:\Windows\System\PKImuph.exe
  2⤵
  PID:9372
- C:\Windows\System\HuVrEQT.exe
  C:\Windows\System\HuVrEQT.exe
  2⤵
  PID:9420
- C:\Windows\System\quwqHho.exe
  C:\Windows\System\quwqHho.exe
  2⤵
  PID:9444
- C:\Windows\System\xbGiAmZ.exe
  C:\Windows\System\xbGiAmZ.exe
  2⤵
  PID:9476
- C:\Windows\System\VNpbRxc.exe
  C:\Windows\System\VNpbRxc.exe
  2⤵
  PID:9540
- C:\Windows\System\vBlVIrS.exe
  C:\Windows\System\vBlVIrS.exe
  2⤵
  PID:9604
- C:\Windows\System\vRYPkPG.exe
  C:\Windows\System\vRYPkPG.exe
  2⤵
  PID:9664
- C:\Windows\System\kNehOFn.exe
  C:\Windows\System\kNehOFn.exe
  2⤵
  PID:9492
- C:\Windows\System\UHpOhXB.exe
  C:\Windows\System\UHpOhXB.exe
  2⤵
  PID:9616
- C:\Windows\System\nsjKskL.exe
  C:\Windows\System\nsjKskL.exe
  2⤵
  PID:9520
- C:\Windows\System\aOnEoIv.exe
  C:\Windows\System\aOnEoIv.exe
  2⤵
  PID:9588
- C:\Windows\System\YtblkbN.exe
  C:\Windows\System\YtblkbN.exe
  2⤵
  PID:9760
- C:\Windows\System\IAdywxq.exe
  C:\Windows\System\IAdywxq.exe
  2⤵
  PID:9744
- C:\Windows\System\VHhxuYa.exe
  C:\Windows\System\VHhxuYa.exe
  2⤵
  PID:9828
- C:\Windows\System\VhDdHsx.exe
  C:\Windows\System\VhDdHsx.exe
  2⤵
  PID:9812
- C:\Windows\System\tkhLKlt.exe
  C:\Windows\System\tkhLKlt.exe
  2⤵
  PID:9844
- C:\Windows\System\VbLMetw.exe
  C:\Windows\System\VbLMetw.exe
  2⤵
  PID:9924
- C:\Windows\System\hOCQGXA.exe
  C:\Windows\System\hOCQGXA.exe
  2⤵
  PID:9936
- C:\Windows\System\iXMZbZS.exe
  C:\Windows\System\iXMZbZS.exe
  2⤵
  PID:9984
- C:\Windows\System\xxKwZgj.exe
  C:\Windows\System\xxKwZgj.exe
  2⤵
  PID:9972
- C:\Windows\System\BRsjLKN.exe
  C:\Windows\System\BRsjLKN.exe
  2⤵
  PID:10048
- C:\Windows\System\VbqApGY.exe
  C:\Windows\System\VbqApGY.exe
  2⤵
  PID:10064
- C:\Windows\System\DdqKYzf.exe
  C:\Windows\System\DdqKYzf.exe
  2⤵
  PID:10096
- C:\Windows\System\fYTYqsJ.exe
  C:\Windows\System\fYTYqsJ.exe
  2⤵
  PID:10144
- C:\Windows\System\IJbFfpf.exe
  C:\Windows\System\IJbFfpf.exe
  2⤵
  PID:10132
- C:\Windows\System\iTiPlDI.exe
  C:\Windows\System\iTiPlDI.exe
  2⤵
  PID:10160
- C:\Windows\System\JYsVxeH.exe
  C:\Windows\System\JYsVxeH.exe
  2⤵
  PID:8700
- C:\Windows\System\DjMFZZt.exe
  C:\Windows\System\DjMFZZt.exe
  2⤵
  PID:9224
- C:\Windows\System\vxHrtIK.exe
  C:\Windows\System\vxHrtIK.exe
  2⤵
  PID:9384
- C:\Windows\System\VIluGas.exe
  C:\Windows\System\VIluGas.exe
  2⤵
  PID:9508
- C:\Windows\System\EQEIUzP.exe
  C:\Windows\System\EQEIUzP.exe
  2⤵
  PID:8788
- C:\Windows\System\rgziFuP.exe
  C:\Windows\System\rgziFuP.exe
  2⤵
  PID:10228
- C:\Windows\System\BFGyuwW.exe
  C:\Windows\System\BFGyuwW.exe
  2⤵
  PID:7444
- C:\Windows\System\kCjQaKi.exe
  C:\Windows\System\kCjQaKi.exe
  2⤵
  PID:9416
- C:\Windows\System\TpUamCs.exe
  C:\Windows\System\TpUamCs.exe
  2⤵
  PID:9572
- C:\Windows\System\kudhrjj.exe
  C:\Windows\System\kudhrjj.exe
  2⤵
  PID:9700
- C:\Windows\System\doksSMk.exe
  C:\Windows\System\doksSMk.exe
  2⤵
  PID:9712
- C:\Windows\System\nDmoZgj.exe
  C:\Windows\System\nDmoZgj.exe
  2⤵
  PID:9732
- C:\Windows\System\ZkYJMNa.exe
  C:\Windows\System\ZkYJMNa.exe
  2⤵
  PID:9920
- C:\Windows\System\EWEWYsc.exe
  C:\Windows\System\EWEWYsc.exe
  2⤵
  PID:10004
- C:\Windows\System\LyPOneX.exe
  C:\Windows\System\LyPOneX.exe
  2⤵
  PID:10068
- C:\Windows\System\IiWixOq.exe
  C:\Windows\System\IiWixOq.exe
  2⤵
  PID:8640
- C:\Windows\System\hcRjnFU.exe
  C:\Windows\System\hcRjnFU.exe
  2⤵
  PID:9368
- C:\Windows\System\FoTvpDL.exe
  C:\Windows\System\FoTvpDL.exe
  2⤵
  PID:9860
- C:\Windows\System\aVcTlOt.exe
  C:\Windows\System\aVcTlOt.exe
  2⤵
  PID:9904
- C:\Windows\System\RgwjnQH.exe
  C:\Windows\System\RgwjnQH.exe
  2⤵
  PID:1516
- C:\Windows\System\CkDtCqy.exe
  C:\Windows\System\CkDtCqy.exe
  2⤵
  PID:9300
- C:\Windows\System\ynHPuMi.exe
  C:\Windows\System\ynHPuMi.exe
  2⤵
  PID:10196
- C:\Windows\System\EraqbNM.exe
  C:\Windows\System\EraqbNM.exe
  2⤵
  PID:9568
- C:\Windows\System\xgFyIXL.exe
  C:\Windows\System\xgFyIXL.exe
  2⤵
  PID:9584
- C:\Windows\System\WjmhOdB.exe
  C:\Windows\System\WjmhOdB.exe
  2⤵
  PID:9764
- C:\Windows\System\NgGbhIt.exe
  C:\Windows\System\NgGbhIt.exe
  2⤵
  PID:9796
- C:\Windows\System\ZFktQAs.exe
  C:\Windows\System\ZFktQAs.exe
  2⤵
  PID:10176
- C:\Windows\System\ldaoyKT.exe
  C:\Windows\System\ldaoyKT.exe
  2⤵
  PID:9824
- C:\Windows\System\TywkXuH.exe
  C:\Windows\System\TywkXuH.exe
  2⤵
  PID:9284
- C:\Windows\System\IEIGOxU.exe
  C:\Windows\System\IEIGOxU.exe
  2⤵
  PID:10020
- C:\Windows\System\KaEgExe.exe
  C:\Windows\System\KaEgExe.exe
  2⤵
  PID:9040
- C:\Windows\System\tgkxgTN.exe
  C:\Windows\System\tgkxgTN.exe
  2⤵
  PID:10244
- C:\Windows\System\tmFDmOt.exe
  C:\Windows\System\tmFDmOt.exe
  2⤵
  PID:10260
- C:\Windows\System\MZyDhjL.exe
  C:\Windows\System\MZyDhjL.exe
  2⤵
  PID:10276
- C:\Windows\System\WUQbzwd.exe
  C:\Windows\System\WUQbzwd.exe
  2⤵
  PID:10292
- C:\Windows\System\yTgjTjz.exe
  C:\Windows\System\yTgjTjz.exe
  2⤵
  PID:10308
- C:\Windows\System\LPVwRcH.exe
  C:\Windows\System\LPVwRcH.exe
  2⤵
  PID:10324
- C:\Windows\System\QMsdfsJ.exe
  C:\Windows\System\QMsdfsJ.exe
  2⤵
  PID:10340
- C:\Windows\System\CIewWtt.exe
  C:\Windows\System\CIewWtt.exe
  2⤵
  PID:10356
- C:\Windows\System\cccdpdF.exe
  C:\Windows\System\cccdpdF.exe
  2⤵
  PID:10372
- C:\Windows\System\XxatsJy.exe
  C:\Windows\System\XxatsJy.exe
  2⤵
  PID:10388
- C:\Windows\System\wcQgrgo.exe
  C:\Windows\System\wcQgrgo.exe
  2⤵
  PID:10404
- C:\Windows\System\OlWTbEj.exe
  C:\Windows\System\OlWTbEj.exe
  2⤵
  PID:10420
- C:\Windows\System\USaieMB.exe
  C:\Windows\System\USaieMB.exe
  2⤵
  PID:10436
- C:\Windows\System\CmXZQsh.exe
  C:\Windows\System\CmXZQsh.exe
  2⤵
  PID:10452
- C:\Windows\System\avHZNiP.exe
  C:\Windows\System\avHZNiP.exe
  2⤵
  PID:10468
- C:\Windows\System\qplgdYR.exe
  C:\Windows\System\qplgdYR.exe
  2⤵
  PID:10484
- C:\Windows\System\hEQDfel.exe
  C:\Windows\System\hEQDfel.exe
  2⤵
  PID:10500

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\AyZUrGk.exe

Filesize
1.9MB

MD5
ec195af0621feb70298d801c8948b5ea

SHA1
d2f3a2a6066df483c9a4918d88fe2cb844cca4df

SHA256
5f413789e9c92876b9f8cbd58de1c1fef11f9e053674b57bd58a56303b90fbb5

SHA512
60979a361c300087de51ecad39bf212d061807e3c5cd1acee3c1ab071db55ff79a74a338795615498abbdc09144fa53e08413e95f37a032d15f6d4b7a27c136d

Download Submit
C:\Windows\system\BOlhQpj.exe

Filesize
1.9MB

MD5
b7c0e22569ef1778143e102665f5eb8e

SHA1
dfd800b6fba2389dc5a10e58a27c40b8e3232e12

SHA256
32dae8305b256f12a312e1c38f80275e2e65378ef3055fae02c5707c7fbf2ce5

SHA512
45383dc5776a30a61adfb12a5ff6a2bfb3de952a8dccfc14fdb44130cb0fb0c3b509432fa5ec0771f5bdcbbd25588e05adbe244a81b34b5ceda412f81fbc3466

Download Submit
C:\Windows\system\FnDIhSB.exe

Filesize
1.9MB

MD5
36c430097e9779dce560f2c3432f4141

SHA1
f068d1c8ce774bd4a18a46ce723709c846774312

SHA256
8eaf724f90c15c95d6b652980b0becf0e1e67661fce65cbc6eafda25e1a1f225

SHA512
bcc607c07b6b83e31c3bd792d543f918fa9a7148a2a15db4eb6aa7b166c54becec06ad6d0f690d712cd2650a8d1b655c00df7611569591a47ac67a8b3969863d

Download Submit
C:\Windows\system\IEULYbU.exe

Filesize
1.9MB

MD5
de7cb2ad8bc49bb2e61e31aabe6179a3

SHA1
70a8a60d0d37b4bf13c1a335f80cd6d4e1cbf7e0

SHA256
1de9a5e5c37de6852f39ef54137e6d59ca1dfb8fc656b8296a7b47699d4e3e9e

SHA512
fb7ea6b5f457d96c0a1ccd77ebe42ba8a39d35b559086a49371bd8f8f0653b236e828e5603624efe9b9a0aa8ef10d86dd623c32a320a312083cec0a7cf85400f

Download Submit
C:\Windows\system\JUNbfgz.exe

Filesize
1.9MB

MD5
9d148a0a92fecaf8e5d9c6147abe40ce

SHA1
1b3f1151dddf435a84afea69cb05bf9704af6c04

SHA256
a70ea5744991908974d8892307017b17f7af777f71d8d560363cc744af084f38

SHA512
96a983101af69a552b7669db9f09ee0c0d9eb6e806561916e0addee73a36a531545bc4dbaae78607dcba856d0fceb5d8078387c5c3bb2637c3a46c22b80686d2

Download Submit
C:\Windows\system\MCHnDjw.exe

Filesize
1.9MB

MD5
34174bc0ad4c379f3910471bf21ea64b

SHA1
1bdc557a66dc05120790974e87117f9b76ed443f

SHA256
bf01d9647e75dfe0ecc9ac261c7634bf3aefa9355947a62cb5b889537bf9991e

SHA512
e98d8f7d5989b613a1e82168e66eae67bc975b9caab19ef336160d870a15afe3cbb6581d9835f44d8485281215d552e381ae4192967827789f8ea3a40a8f8175

Download Submit
C:\Windows\system\MQKPrlI.exe

Filesize
1.9MB

MD5
5d1ee42c83232d23501355e5e7a490fe

SHA1
0c270587f40811098b65033f6470f288bea877e7

SHA256
79993fbe6f27419c6499865c111566c7f45d737a7ea77dd8ffc45063b98f0819

SHA512
e1942fc4e45d7b9f33bebd4f50eacae4c79072ea08ff50d22264d19547bc976f7aef84929a793150434f88f8ad9b5745e01884814b4f21c3dbbcf89174c1e5ac

Download Submit
C:\Windows\system\RfWzMCt.exe

Filesize
1.9MB

MD5
1d95bd6ea6cff740db6957544b6c15b4

SHA1
94f9d5b10cc320ce127ff0ffe24482f6343011d1

SHA256
5375df957e24af31365df41c119fe6fc429c6227f3c734130fc10f4902188efc

SHA512
84e03fee955fbc5b794e5d72eb2674a3106d6efe3884ece0cbb6454c09a52910fdaab8a7be8e7debd10979cc5e9ff0bd071af23e2898c07b0ad0a8f504543069

Download Submit
C:\Windows\system\SsJiRVC.exe

Filesize
1.9MB

MD5
d9421f01f4216226e23d0f03ed29d432

SHA1
1b61ef2d3be0c48169c5e7f9b91fe7638080ab34

SHA256
1320e48e6c53dac714976c1f6a8e36dcf9944ec2e8984c080cdd08f237ecb220

SHA512
01e17e61ef74d023c3c19086399ee7255327a6a25d02ccc40b82a550aecc4de45883e5acdf68e32b1d135be8bbdb871f3e4cfd69a294e94238cf523257494576

Download Submit
C:\Windows\system\TtxlNtq.exe

Filesize
1.9MB

MD5
6b1da3ed08d70edd76eaae99213538fc

SHA1
aac1431e8925571a832ba3de34b8077c4b71bd0f

SHA256
c751cf9bf93998180fdd6fc5a294e9ab6c014daaf0b273bde761070c61662254

SHA512
8d666fd82a9a9fe676fb1337a0d9f18bbe7e970d9a2b9eb46983c3cde8ae919db7a16730dbcb0944da154add5fa39fe00a6d3e0367fcbf60f87a9ba367e78811

Download Submit
C:\Windows\system\UOzKjdr.exe

Filesize
1.9MB

MD5
cb8a7e39c418378d254c24249e6f97a3

SHA1
b9bb87d26d0c76a5263b6c679caf5e9140f805db

SHA256
4a5605e05c155ac0148a6323e6b8d6acdf49b6eceabd14e92d05a9c43c481547

SHA512
75f380f1e9520af196fd05171b9a6a1b9b58052ae4860a9646fa80d3d04b981e7e5ce86614af2717b66495f1f1381fbc6719c18eecc75a9de73a7b52524c1ce3

Download Submit
C:\Windows\system\UfogOVV.exe

Filesize
1.9MB

MD5
a81341d88968be2e52008bd1ec7bf854

SHA1
7bfceabe0cf4160a043d1e4578910599a1c9ca32

SHA256
67455e348270ec116011a45bb03ba44acaaf9f679ddd3af4f3a7e3a6b736ff7c

SHA512
329c48dd9a3105d117eec5f1f3bd4f6f503cdaf3cc95132cfd8ad16fe120157c79194f34e28d3024aaed2e3f5a2fd4dc54b6d47cf96b9a08fdb8021159248013

Download Submit
C:\Windows\system\YWXBiza.exe

Filesize
1.9MB

MD5
978090af049e5e2b5b337ed8025b2bdf

SHA1
6e727509de6704c21e82a88db6f8881913859d95

SHA256
a8faedf243d574f7d4db7838944329f265f375c0a8f479038bb0bc1e6edbace6

SHA512
5e796c430d8afd1e0ae754fcaba3690995f2b5e49d2b047f391642c175ae35260f42a92e458dc3111fa88f5e8eac28d2ac43ae7cc7aafaeac039168a9ea12c15

Download Submit
C:\Windows\system\ZbmvCNh.exe

Filesize
1.9MB

MD5
6311d80d0da8bfa8b6e64ea69eb8de9c

SHA1
b003c7b459b1f4f0f1592b41f11d7e8d23f7baa8

SHA256
fdcd10e2aee9ab9fb63c9e463b3310be960447278738e61f175bfdec9223c971

SHA512
c01d9f0f60b999298ca0b12836d5053902147ed09d082f3e9f05f59e0fe1f744115295abce56e974eab81cd5c8b01a619d5e6f1d0b4e422a257b9718f98c62ad

Download Submit
C:\Windows\system\clbRsul.exe

Filesize
1.9MB

MD5
4b57901146af1a3a0b63e6d1e215a0ea

SHA1
5df3bbdc8caf30c75b93b249b41ed1b0c23f1cbc

SHA256
ef971f9e9ce52e4ec11302cb28113b6b88061da2707c7bc90941ae8689649ae5

SHA512
6c7b35f8d9b819c759aa7a40057ad2da18c7e3c0ba7e26748f4e869f5f4adc4bd354b9d54d35ff8ad0b7aa30f847879cdd046a55e8ea2efcd4ed4e3b0587b699

Download Submit
C:\Windows\system\eKPyfDD.exe

Filesize
1.9MB

MD5
186032e1269db21873df25cbe3078171

SHA1
87ff0cb3c393a9462b79d65906d72721c384e2ee

SHA256
6bd26c1da369d799ec7b5cc2d7fe30c6c9b7514c96d4ae5d5b36294f90c1ef84

SHA512
f3f03993347c21205090da0a0e8e2482bf2ff19a5dfb48ad1bc157f1b62b91663bef45bf6c272e232062e86cfd7574a647090206f7273478240c9b58a99f637e

Download Submit
C:\Windows\system\iZChVRU.exe

Filesize
1.9MB

MD5
87192ea0df66e959ddb220ce1a04f4e5

SHA1
1caefd2afa8fad2ec9753ebba341ec40c3ea7dc5

SHA256
dac6a07f9d919ffbcc62fca1e966b03e2dbe3fea4aee9e0b39d5516bae6b238e

SHA512
00ce193dd372ca061b7e612c93b9bf0616f179ab18d2073e6274e14ff9c7b7af74dca5fc2e326a0617d4712e9044d81329a4fe7601d62544b2bed06ae87aad26

Download Submit
C:\Windows\system\mkkkGOR.exe

Filesize
1.9MB

MD5
256383ac14459b8eea563fea5d30af2c

SHA1
323e269db1372b5bd2ed9c9dd3cef7520a44ceda

SHA256
99e7dbc327ce5e5a6fe10eecd7dbb6ebf1abcdf58f9134331a5180e97cc9715c

SHA512
44c3680479a0c51c4ef51d5a7045ab280ce7bb281d126d9cd20eefc52099e61778a371300a3ef50d633ccc761a7ce522dbbb0ee97a68a3714ed66dfc9c7d4608

Download Submit
C:\Windows\system\qQoURtB.exe

Filesize
1.9MB

MD5
135c9a0cda22ce8249a4c5712778bcb0

SHA1
f59bc7d80f81c819297e3abe07be35aec69488dc

SHA256
8d0cb65a59a880dd9d950d1f85108851bde70272445d5fd4ec626f12afc99c69

SHA512
367154baedfa3a96ef93dedbbbb9cf4222f6d71989109d946339506a685ba90d70dd1f878ade7a12901496f9a33df86798b032b3f3819787eb45ab6f50aee593

Download Submit
C:\Windows\system\riUaUnI.exe

Filesize
1.9MB

MD5
4b5f0ee25db87671d9004e201d499dd2

SHA1
26e4e39b71230e16975cbd66461c2bfee2d3e52e

SHA256
5cd2b9be803a3fc6535eae3c27d51d50f4ac954f5c97661f6d098010786c2171

SHA512
b1176618416ae71462d5d4d0fe3597ac9859f0b1cc88b248bc845a56a022cc19fb76a96fbf87a94186e0582c0fe95478fde8008c271eabcf4fb9c395e115460b

Download Submit
C:\Windows\system\sGCwNOB.exe

Filesize
1.9MB

MD5
50907cb8e4cf1038d2e021cc996e2f48

SHA1
74ba15d1ddc7f00814b96d5203e7d4cf046ab3db

SHA256
d18415263b8ec85914d0236a0d1dd20abd94193f43311a9dd64b4be4be559c22

SHA512
de6d31afa872c9f6d2266301d61a9388f27cd3c3b0d986a45dd691b16ec22208a5d38514a15332a3c7fa595307c8723696a4e1583b59bdb720db29d1d1aee3f0

Download Submit
C:\Windows\system\sbeorsu.exe

Filesize
8B

MD5
3989110bf28e1752d8354fc44aee0a5a

SHA1
2d341ede84fcdf1393cbc1c69b98173c16076de5

SHA256
ebec1be56406b8ccda98c6ae40713b17ab0e77787c03fa110b421dcd4ed20236

SHA512
05d90fae41717bc7686b0f44550f09d1b8636af054b5f3ca56692a92791caee36e681dc16ad6673b593b02851b240971a152f999e8c1a1c5d0d92fad9fcf82a2

Download Submit
C:\Windows\system\tjymfsM.exe

Filesize
1.9MB

MD5
b29daa4421504038bf88cc844148e120

SHA1
41efc9893569d2a2ddc98152f72a5ce69dbffc4a

SHA256
a21c20dba0ee08ddba9322d76113a5df1f4e751dc5f9e948a0687f7f3fe5307c

SHA512
ebb0e90ad599172bc1453cbcfce869023f13e2f02136fe661123843a9de822232ee98f06253d030adf39eb985605b1f458affe18560de6bc7f7bb72d29bd2548

Download Submit
C:\Windows\system\uUAvXqg.exe

Filesize
1.9MB

MD5
2a7dcb652916e2b55d0db4feb29384d5

SHA1
34e8be04f9e6b54abe16cdb2feb72a9764fc4022

SHA256
fd1c5609ae8c257df71677812d89357fd7514148c4e95debf92750d86eed69d5

SHA512
d946e57ac74f5d9d63d1a5463ea62335a79062b0244af92e0540510c902671aaef14183f0f5ed7a25ac1d5e04ad8e3e7fee3bff52075005dc6bde4e6174ae0fb

Download Submit
C:\Windows\system\xNWCOKO.exe

Filesize
1.9MB

MD5
12fb7cf1a2d55722893acf032abb8cb5

SHA1
ac0e9bf0521918720720225896255ea5c591f3c1

SHA256
af65eff3b7b56248f204555f2a6049a65377c5a715c50171e124b3119c5e5325

SHA512
0674d0c39f7e22e6e08b67932ae05f74f34dcfbf611ccd799de08fcc4d4e89dd9803e404dba408bcd0bea45ebb5afe8f01d85ad6c1a750b12d1a243717988d33

Download Submit
C:\Windows\system\yJgwEjX.exe

Filesize
1.9MB

MD5
03acfcf3c07495103f20b39a79787418

SHA1
387148687b277e93bedd28d67f9008e0ceb74ab1

SHA256
35ccbd07506d14e010b0404c1cf3fb75bf446dfaac2da17c308d30341cbe8dfc

SHA512
619f53f388324cc8dc513b4c8856076cfe14c8326a7f79741814d682c8e1af9a91e21f9bb5e963a4ae0e675dcd913d6c9f266c1d7acff3e73af0ef8191900d01

Download Submit
C:\Windows\system\ynhvFmJ.exe

Filesize
1.9MB

MD5
e3201029f0ed25f6500f920d11bc7a18

SHA1
382933c4bcde7e83a64b8a06f8b93efe02f63a59

SHA256
6c186417a3588003176831792a4e1f9a8c4adaec41eca8048510b503c79ebda4

SHA512
c53679138e30188d1a4718547e6b1cee7a4dd59fe95ab60f21dd4ece6c00d4412ff6233aa0d047070f16309b1a873b19e7eaa5ecd3fee642304099c59307c455

Download Submit
\Windows\system\HMGajBq.exe

Filesize
1.9MB

MD5
39ee05bcbc71a797c30bbdb8e9fe9e88

SHA1
e6ef3754fbf4b905211b90bcd4e438268f853ed7

SHA256
576cd96ff04f94e3b914e51a3caed5b8414a5394103ec0c2d1d6e2b6a7fe5fd3

SHA512
490dfe67e0a4c445a045b0e0e43bddfeee06cac5266bbbc0e18f570b815684fa18abaecbfc170cdf2c775acfb7046cc01bb7890c2fe4d3f0266f84bcd398fe9d

Download Submit
\Windows\system\KuIKHEf.exe

Filesize
1.9MB

MD5
f55200b8c06e5c43da823acc2329287c

SHA1
24e8fad8964ff48b29b6f011b314d7d1ba5b5d41

SHA256
c94179df84c8784b0f9abf62a239141e93a07f993f9d730f5d76c8805e11499d

SHA512
41e41ef92929ef0b15844d32ee5bdf8345b56a9ddc55285bccd657c125e90b5c67c437a13ce3e739f3d70da922a2cea6d150f7b9e9105ea1fccd42efb9b924d0

Download Submit
\Windows\system\SSmfcnZ.exe

Filesize
1.9MB

MD5
e3187ba3c93173e2202e1fc41b480bcb

SHA1
b70ffc45269d2fdee57748cdb2f64844db405f7c

SHA256
53b035a1acc634983a7e96f57c1de7c5cad44b1c8129698631032befa45cfec8

SHA512
ee7ad2994cb35f74daba1944d8bbddcb63325c113ad9a311e9041b58dc5ec7f46380551c9d4ac86eb6c836fd196716d05bfe859b9df30ed5aeed08ccf4b456c8

Download Submit
\Windows\system\SnpCXpr.exe

Filesize
1.9MB

MD5
08bd591a2d51c02f7774ab6cbd3e4842

SHA1
3b05fdce8713c627991855a7dd02d7f7a77f7773

SHA256
888bcf226c49a861cfdd286d8deb8c29c3cbf5e2525c98d6ee0b242caebf6f2d

SHA512
7aea6869401fcbafaeca1ed3b51170192b0d1cd10002491ad8a7e2debcb32d6043f9e6729b570ea5c7f589962cd88eb72144d78bbb11cea979d40b9a34e9daaf

Download Submit
\Windows\system\UqOUpMd.exe

Filesize
1.9MB

MD5
478fa8b32eef150df7b100ba9306119d

SHA1
c0bc752961f2f7b8b6385b79809b34304466858b

SHA256
9a4acb214d53622be4634eb05bee0f28e4076ddc38a4a1547d75db1d714e58ce

SHA512
a96c8d91ae6747872d4a2970b1bc67e22c0c213fe7c0fc75f6a4cf65d015c46bd3d2d4ff3ea780bb0b75150b13fa92c2ad0c4334b6b5a524e5d7ff1653d01392

Download Submit
\Windows\system\WGigOvx.exe

Filesize
1.9MB

MD5
bb35e4c5ade50879d3c7429ff6e9832b

SHA1
50aef6504fbe980aca8fa19aafd0e087afe86ca6

SHA256
a7490e1ebd027a470ec2b5b95fd8af10e06f7b0feb5f96241b561b694f020764

SHA512
48456342b4c8367d16ba101a9851ca9c58c7117fd88aea18a595a8136cf3a534995f8485de24c53bf17d8049fa5421e3c98d29ef16c9a3e568d0191d3040c8be

Download Submit
\Windows\system\ftURxsi.exe

Filesize
1.9MB

MD5
26ac4da5d05a3e08ad209ca0f53d4915

SHA1
e9e83e6880bac5ad93d56754f28f878af80afbb0

SHA256
9f1e5af487280b9406d33eaa1486af5cc4224b3b346b6955c539f5f5ef2497af

SHA512
ffb0133b30f9fe6aca3e9c2c5dbbb0033e3e2202cba3be2640aac41be98e0ad5d8f670eec6c5fe9b827ce673323d3db23c2fb03a98a84eeb2192f3743c1f7078

Download Submit
\Windows\system\grmHEsL.exe

Filesize
1.9MB

MD5
e5ec3ef496ca5294d87d0db65edb95af

SHA1
30254ed3f81fa2a6749c2dee3e33c342fc855a37

SHA256
edbbec939c9b29f50538a194ebb58fa4be6b218e6136369a4f440be2099f879d

SHA512
0a54acea197c66c7f27cc020ea98ad425eeb7c660b819aab2073e54c688b88fc46282391014d462e383138b1038f2235eaa3caeb026bb138297dc1cb8315859e

Download Submit
\Windows\system\pcMAhqF.exe

Filesize
1.9MB

MD5
78d080b650a095380282847734e059cc

SHA1
3168192bb877dd565c84c34aaeddf532a38965bb

SHA256
85c82cb38967a2779a8ef5016137c87b566cae9a0f4f281041a4da68ce9bebd3

SHA512
a0e41f6e059452a927f0b08522ac3ae137ddbd6c9db9293fae98f579b1ce0f4cbc84987f65fb2b8417a7959a458c8f0f54b4b8bba28eae0a06c62f9d07cdc610

Download Submit
memory/1732-88-0x000000013F800000-0x000000013FBF2000-memory.dmp

Filesize
3.9MB

Download
memory/1732-5219-0x000000013F800000-0x000000013FBF2000-memory.dmp

Filesize
3.9MB

Download
memory/1988-99-0x000000013F540000-0x000000013F932000-memory.dmp

Filesize
3.9MB

Download
memory/2136-103-0x000000013FB80000-0x000000013FF72000-memory.dmp

Filesize
3.9MB

Download
memory/2136-5014-0x000000013FB80000-0x000000013FF72000-memory.dmp

Filesize
3.9MB

Download
memory/2164-101-0x000000013F520000-0x000000013F912000-memory.dmp

Filesize
3.9MB

Download
memory/2164-5143-0x000000013F520000-0x000000013F912000-memory.dmp

Filesize
3.9MB

Download
memory/2212-87-0x00000000033A0000-0x0000000003792000-memory.dmp

Filesize
3.9MB

Download
memory/2212-102-0x00000000033A0000-0x0000000003792000-memory.dmp

Filesize
3.9MB

Download
memory/2212-80-0x0000000003000000-0x00000000033F2000-memory.dmp

Filesize
3.9MB

Download
memory/2212-21-0x0000000003000000-0x00000000033F2000-memory.dmp

Filesize
3.9MB

Download
memory/2212-100-0x00000000033A0000-0x0000000003792000-memory.dmp

Filesize
3.9MB

Download
memory/2212-104-0x0000000003000000-0x00000000033F2000-memory.dmp

Filesize
3.9MB

Download
memory/2212-0-0x000000013F7E0000-0x000000013FBD2000-memory.dmp

Filesize
3.9MB

Download
memory/2212-7-0x0000000003000000-0x00000000033F2000-memory.dmp

Filesize
3.9MB

Download
memory/2212-86-0x0000000003000000-0x00000000033F2000-memory.dmp

Filesize
3.9MB

Download
memory/2212-84-0x0000000003000000-0x00000000033F2000-memory.dmp

Filesize
3.9MB

Download
memory/2212-98-0x00000000033A0000-0x0000000003792000-memory.dmp

Filesize
3.9MB

Download
memory/2212-1-0x0000000000080000-0x0000000000090000-memory.dmp

Filesize
64KB

Download
memory/2212-93-0x00000000033A0000-0x0000000003792000-memory.dmp

Filesize
3.9MB

Download
memory/2212-90-0x000000013FEE0000-0x00000001402D2000-memory.dmp

Filesize
3.9MB

Download
memory/2216-135-0x000000001B740000-0x000000001BA22000-memory.dmp

Filesize
2.9MB

Download
memory/2216-143-0x0000000002820000-0x0000000002828000-memory.dmp

Filesize
32KB

Download
memory/2216-24-0x000007FEF62CE000-0x000007FEF62CF000-memory.dmp

Filesize
4KB

Download
memory/2216-78-0x000007FEF6010000-0x000007FEF69AD000-memory.dmp

Filesize
9.6MB

Download
memory/2216-1311-0x000007FEF6010000-0x000007FEF69AD000-memory.dmp

Filesize
9.6MB

Download
memory/2496-5016-0x000000013FEE0000-0x00000001402D2000-memory.dmp

Filesize
3.9MB

Download
memory/2496-91-0x000000013FEE0000-0x00000001402D2000-memory.dmp

Filesize
3.9MB

Download
memory/2500-85-0x000000013F900000-0x000000013FCF2000-memory.dmp

Filesize
3.9MB

Download
memory/2500-5374-0x000000013F900000-0x000000013FCF2000-memory.dmp

Filesize
3.9MB

Download
memory/2552-89-0x000000013F5A0000-0x000000013F992000-memory.dmp

Filesize
3.9MB

Download
memory/2632-94-0x000000013FB30000-0x000000013FF22000-memory.dmp

Filesize
3.9MB

Download
memory/2692-81-0x000000013FAE0000-0x000000013FED2000-memory.dmp

Filesize
3.9MB

Download
memory/2692-5221-0x000000013FAE0000-0x000000013FED2000-memory.dmp

Filesize
3.9MB

Download
memory/2740-8-0x000000013F7E0000-0x000000013FBD2000-memory.dmp

Filesize
3.9MB

Download
memory/2740-5220-0x000000013F7E0000-0x000000013FBD2000-memory.dmp

Filesize
3.9MB

Download
memory/2808-5023-0x000000013F800000-0x000000013FBF2000-memory.dmp

Filesize
3.9MB

Download
memory/2808-82-0x000000013F800000-0x000000013FBF2000-memory.dmp

Filesize
3.9MB

Download
memory/2812-23-0x000000013F860000-0x000000013FC52000-memory.dmp

Filesize
3.9MB

Download
memory/2812-5161-0x000000013F860000-0x000000013FC52000-memory.dmp

Filesize
3.9MB

Download