xmrig | 38ee67befa7640a43001c087eb267085e115db8a2cb18d14852f9d082b3aa1d8

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
18/05/2024, 17:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
119fc765b0cd46c9be3e8c972ce3e3e0_NeikiAnalytics.exe
Size 2.8MB
Sample240518-vncmsaea63
SHA256 38ee67befa7640a43001c087eb267085e115db8a2cb18d14852f9d082b3aa1d8
MD5 119fc765b0cd46c9be3e8c972ce3e3e0
SHA1 ac5f4597ceaffa8b42f9d02dfae939284670a61a
SHA512 37d3643bb1e1a4fd1f4558b93d5861e07c1f4f1b20c92625f1bcc6a0ac32c2c4d920de38426b6371119031698f743ea8ae9fbe73dd9d6864871987431c071b66
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0IEFToChvL/:71ONtyBeSFkXV1etEKLlWUTOfeiRA2RA
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral1/memory/2740-1-0x000000013F580000-0x000000013F976000-memory.dmp	xmrig
behavioral1/files/0x0038000000014388-7.dat	xmrig
behavioral1/files/0x000e00000001214d-6.dat	xmrig
behavioral1/files/0x000800000001451c-26.dat	xmrig
behavioral1/files/0x000f000000003683-31.dat	xmrig
behavioral1/files/0x0008000000014733-36.dat	xmrig
behavioral1/files/0x0007000000015cb7-55.dat	xmrig
behavioral1/files/0x0006000000015cea-75.dat	xmrig
behavioral1/files/0x0006000000015cfd-87.dat	xmrig
behavioral1/memory/2588-92-0x000000013F740000-0x000000013FB36000-memory.dmp	xmrig
behavioral1/files/0x0006000000015d13-107.dat	xmrig
behavioral1/memory/2360-113-0x000000013F1F0000-0x000000013F5E6000-memory.dmp	xmrig
behavioral1/memory/760-123-0x000000013FCE0000-0x00000001400D6000-memory.dmp	xmrig
behavioral1/files/0x0006000000015f54-139.dat	xmrig
behavioral1/files/0x00060000000162cc-152.dat	xmrig
behavioral1/files/0x0006000000016572-159.dat	xmrig
behavioral1/files/0x0006000000016c4a-173.dat	xmrig
behavioral1/files/0x0006000000016c67-178.dat	xmrig
behavioral1/files/0x0006000000016824-166.dat	xmrig
behavioral1/files/0x0006000000015cf3-78.dat	xmrig
behavioral1/files/0x0006000000016cde-187.dat	xmrig
behavioral1/files/0x00060000000160f3-145.dat	xmrig
behavioral1/files/0x0006000000015d97-132.dat	xmrig
behavioral1/files/0x0006000000015d42-131.dat	xmrig
behavioral1/memory/1876-115-0x000000013FE50000-0x0000000140246000-memory.dmp	xmrig
behavioral1/memory/2528-110-0x000000013F780000-0x000000013FB76000-memory.dmp	xmrig
behavioral1/files/0x0006000000015ce2-70.dat	xmrig
behavioral1/files/0x0006000000015cd6-65.dat	xmrig
behavioral1/files/0x0006000000015cbf-60.dat	xmrig
behavioral1/files/0x0008000000014b18-51.dat	xmrig
behavioral1/files/0x0007000000014856-46.dat	xmrig
behavioral1/files/0x000700000001473e-40.dat	xmrig
behavioral1/memory/2604-19-0x000000013F9F0000-0x000000013FDE6000-memory.dmp	xmrig
behavioral1/memory/2052-14-0x000000013F940000-0x000000013FD36000-memory.dmp	xmrig
behavioral1/files/0x0006000000015d09-94.dat	xmrig
behavioral1/memory/3004-97-0x000000013F550000-0x000000013F946000-memory.dmp	xmrig
behavioral1/files/0x0006000000016d05-189.dat	xmrig
behavioral1/files/0x0006000000016caf-182.dat	xmrig
behavioral1/files/0x0006000000016c5d-175.dat	xmrig
behavioral1/files/0x0006000000016a7d-168.dat	xmrig
behavioral1/files/0x00060000000165d4-161.dat	xmrig
behavioral1/files/0x0006000000016448-154.dat	xmrig
behavioral1/files/0x0006000000016133-147.dat	xmrig
behavioral1/files/0x0006000000015fd4-140.dat	xmrig
behavioral1/files/0x0006000000015de5-133.dat	xmrig
behavioral1/files/0x0006000000015d72-124.dat	xmrig
behavioral1/files/0x0006000000015d20-117.dat	xmrig
behavioral1/memory/2468-105-0x000000013F8D0000-0x000000013FCC6000-memory.dmp	xmrig
behavioral1/memory/2512-103-0x000000013FC20000-0x0000000140016000-memory.dmp	xmrig
behavioral1/memory/2676-101-0x000000013FDE0000-0x00000001401D6000-memory.dmp	xmrig
behavioral1/memory/2724-99-0x000000013F340000-0x000000013F736000-memory.dmp	xmrig
behavioral1/memory/2740-2450-0x000000013F580000-0x000000013F976000-memory.dmp	xmrig
behavioral1/memory/2052-4904-0x000000013F940000-0x000000013FD36000-memory.dmp	xmrig
behavioral1/memory/2604-4905-0x000000013F9F0000-0x000000013FDE6000-memory.dmp	xmrig
behavioral1/memory/2588-4906-0x000000013F740000-0x000000013FB36000-memory.dmp	xmrig
behavioral1/memory/2724-4907-0x000000013F340000-0x000000013F736000-memory.dmp	xmrig
behavioral1/memory/3004-4908-0x000000013F550000-0x000000013F946000-memory.dmp	xmrig
behavioral1/memory/2676-4909-0x000000013FDE0000-0x00000001401D6000-memory.dmp	xmrig
behavioral1/memory/2512-4910-0x000000013FC20000-0x0000000140016000-memory.dmp	xmrig
behavioral1/memory/2468-4911-0x000000013F8D0000-0x000000013FCC6000-memory.dmp	xmrig
behavioral1/memory/2360-4914-0x000000013F1F0000-0x000000013F5E6000-memory.dmp	xmrig
behavioral1/memory/1876-4915-0x000000013FE50000-0x0000000140246000-memory.dmp	xmrig
behavioral1/memory/760-4913-0x000000013FCE0000-0x00000001400D6000-memory.dmp	xmrig
behavioral1/memory/2528-4912-0x000000013F780000-0x000000013FB76000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
2160	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
2052	WYruXVA.exe
2604	jjxlgnx.exe
2588	JXUwoSL.exe
3004	bcshbnE.exe
2724	SdoQxIq.exe
2676	hRBxKPw.exe
2512	gYrfJUL.exe
2468	LYjYRyv.exe
2528	UHqxUoE.exe
2360	iPeUvIK.exe
1876	koEBYub.exe
760	XiUALPN.exe
812	gTYtkue.exe
2524	AMIQefE.exe
2552	pNYISDE.exe
1668	gUERjTf.exe
1764	SrJdirp.exe
496	dJFXqQm.exe
2820	yhIMopQ.exe
2216	GDcUyZM.exe
2236	jdRIIuY.exe
2864	lflwdVO.exe
2036	YpZJIBh.exe
1140	rRCWajl.exe
1096	xrgeoiv.exe
1068	egISzCx.exe
2428	xKolmsf.exe
2092	cctUybm.exe
300	GnMVTAJ.exe
1552	BmSEtnX.exe
1348	TRAHvuO.exe
1628	aEmyrzf.exe
2188	LBSJKgU.exe
560	NTEjgYi.exe
2264	BBNFKpk.exe
772	akpIziJ.exe
1076	NSzgewa.exe
1732	TXfnytz.exe
468	vYIcRGb.exe
1124	AGbjwUb.exe
1588	eLeicyW.exe
3040	USEJtjX.exe
2472	VecesHC.exe
2764	ZloRviS.exe
2496	OcgsfVK.exe
2936	RYVRLgW.exe
2808	vqwdovT.exe
2108	HRUMAnL.exe
2444	dJanRDr.exe
1756	xuloTwP.exe
2424	aViykOq.exe
892	leLnSVd.exe
1148	GDwarQV.exe
1592	yNwSOzC.exe
3080	HSVnuav.exe
3112	hFXogam.exe
3144	vuYSlbe.exe
3176	fLDvbYg.exe
3208	BBUvUNm.exe
3240	PGeQESQ.exe
3272	oswEIdC.exe
3304	YzVDihm.exe
3336	pwhRbyP.exe
3368	aEbRCWC.exe

Loads dropped DLL 64 IoCs

pid	Process
2740	119fc765b0cd46c9be3e8c972ce3e3e0_NeikiAnalytics.exe
2740	119fc765b0cd46c9be3e8c972ce3e3e0_NeikiAnalytics.exe
2740	119fc765b0cd46c9be3e8c972ce3e3e0_NeikiAnalytics.exe
2740	119fc765b0cd46c9be3e8c972ce3e3e0_NeikiAnalytics.exe
2740	119fc765b0cd46c9be3e8c972ce3e3e0_NeikiAnalytics.exe
2740	119fc765b0cd46c9be3e8c972ce3e3e0_NeikiAnalytics.exe
2740	119fc765b0cd46c9be3e8c972ce3e3e0_NeikiAnalytics.exe
2740	119fc765b0cd46c9be3e8c972ce3e3e0_NeikiAnalytics.exe
2740	119fc765b0cd46c9be3e8c972ce3e3e0_NeikiAnalytics.exe
2740	119fc765b0cd46c9be3e8c972ce3e3e0_NeikiAnalytics.exe
2740	119fc765b0cd46c9be3e8c972ce3e3e0_NeikiAnalytics.exe
2740	119fc765b0cd46c9be3e8c972ce3e3e0_NeikiAnalytics.exe
2740	119fc765b0cd46c9be3e8c972ce3e3e0_NeikiAnalytics.exe
2740	119fc765b0cd46c9be3e8c972ce3e3e0_NeikiAnalytics.exe
2740	119fc765b0cd46c9be3e8c972ce3e3e0_NeikiAnalytics.exe
2740	119fc765b0cd46c9be3e8c972ce3e3e0_NeikiAnalytics.exe
2740	119fc765b0cd46c9be3e8c972ce3e3e0_NeikiAnalytics.exe
2740	119fc765b0cd46c9be3e8c972ce3e3e0_NeikiAnalytics.exe
2740	119fc765b0cd46c9be3e8c972ce3e3e0_NeikiAnalytics.exe
2740	119fc765b0cd46c9be3e8c972ce3e3e0_NeikiAnalytics.exe
2740	119fc765b0cd46c9be3e8c972ce3e3e0_NeikiAnalytics.exe
2740	119fc765b0cd46c9be3e8c972ce3e3e0_NeikiAnalytics.exe
2740	119fc765b0cd46c9be3e8c972ce3e3e0_NeikiAnalytics.exe
2740	119fc765b0cd46c9be3e8c972ce3e3e0_NeikiAnalytics.exe
2740	119fc765b0cd46c9be3e8c972ce3e3e0_NeikiAnalytics.exe
2740	119fc765b0cd46c9be3e8c972ce3e3e0_NeikiAnalytics.exe
2740	119fc765b0cd46c9be3e8c972ce3e3e0_NeikiAnalytics.exe
2740	119fc765b0cd46c9be3e8c972ce3e3e0_NeikiAnalytics.exe
2740	119fc765b0cd46c9be3e8c972ce3e3e0_NeikiAnalytics.exe
2740	119fc765b0cd46c9be3e8c972ce3e3e0_NeikiAnalytics.exe
2740	119fc765b0cd46c9be3e8c972ce3e3e0_NeikiAnalytics.exe
2740	119fc765b0cd46c9be3e8c972ce3e3e0_NeikiAnalytics.exe
2740	119fc765b0cd46c9be3e8c972ce3e3e0_NeikiAnalytics.exe
2740	119fc765b0cd46c9be3e8c972ce3e3e0_NeikiAnalytics.exe
2740	119fc765b0cd46c9be3e8c972ce3e3e0_NeikiAnalytics.exe
2740	119fc765b0cd46c9be3e8c972ce3e3e0_NeikiAnalytics.exe
2740	119fc765b0cd46c9be3e8c972ce3e3e0_NeikiAnalytics.exe
2740	119fc765b0cd46c9be3e8c972ce3e3e0_NeikiAnalytics.exe
2740	119fc765b0cd46c9be3e8c972ce3e3e0_NeikiAnalytics.exe
2740	119fc765b0cd46c9be3e8c972ce3e3e0_NeikiAnalytics.exe
2740	119fc765b0cd46c9be3e8c972ce3e3e0_NeikiAnalytics.exe
2740	119fc765b0cd46c9be3e8c972ce3e3e0_NeikiAnalytics.exe
2740	119fc765b0cd46c9be3e8c972ce3e3e0_NeikiAnalytics.exe
2740	119fc765b0cd46c9be3e8c972ce3e3e0_NeikiAnalytics.exe
2740	119fc765b0cd46c9be3e8c972ce3e3e0_NeikiAnalytics.exe
2740	119fc765b0cd46c9be3e8c972ce3e3e0_NeikiAnalytics.exe
2740	119fc765b0cd46c9be3e8c972ce3e3e0_NeikiAnalytics.exe
2740	119fc765b0cd46c9be3e8c972ce3e3e0_NeikiAnalytics.exe
2740	119fc765b0cd46c9be3e8c972ce3e3e0_NeikiAnalytics.exe
2740	119fc765b0cd46c9be3e8c972ce3e3e0_NeikiAnalytics.exe
2740	119fc765b0cd46c9be3e8c972ce3e3e0_NeikiAnalytics.exe
2740	119fc765b0cd46c9be3e8c972ce3e3e0_NeikiAnalytics.exe
2740	119fc765b0cd46c9be3e8c972ce3e3e0_NeikiAnalytics.exe
2740	119fc765b0cd46c9be3e8c972ce3e3e0_NeikiAnalytics.exe
2740	119fc765b0cd46c9be3e8c972ce3e3e0_NeikiAnalytics.exe
2740	119fc765b0cd46c9be3e8c972ce3e3e0_NeikiAnalytics.exe
2740	119fc765b0cd46c9be3e8c972ce3e3e0_NeikiAnalytics.exe
2740	119fc765b0cd46c9be3e8c972ce3e3e0_NeikiAnalytics.exe
2740	119fc765b0cd46c9be3e8c972ce3e3e0_NeikiAnalytics.exe
2740	119fc765b0cd46c9be3e8c972ce3e3e0_NeikiAnalytics.exe
2740	119fc765b0cd46c9be3e8c972ce3e3e0_NeikiAnalytics.exe
2740	119fc765b0cd46c9be3e8c972ce3e3e0_NeikiAnalytics.exe
2740	119fc765b0cd46c9be3e8c972ce3e3e0_NeikiAnalytics.exe
2740	119fc765b0cd46c9be3e8c972ce3e3e0_NeikiAnalytics.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2740-1-0x000000013F580000-0x000000013F976000-memory.dmp	upx
behavioral1/files/0x0038000000014388-7.dat	upx
behavioral1/files/0x000e00000001214d-6.dat	upx
behavioral1/files/0x000800000001451c-26.dat	upx
behavioral1/files/0x000f000000003683-31.dat	upx
behavioral1/files/0x0008000000014733-36.dat	upx
behavioral1/files/0x0007000000015cb7-55.dat	upx
behavioral1/files/0x0006000000015cea-75.dat	upx
behavioral1/files/0x0006000000015cfd-87.dat	upx
behavioral1/memory/2588-92-0x000000013F740000-0x000000013FB36000-memory.dmp	upx
behavioral1/files/0x0006000000015d13-107.dat	upx
behavioral1/memory/2360-113-0x000000013F1F0000-0x000000013F5E6000-memory.dmp	upx
behavioral1/memory/760-123-0x000000013FCE0000-0x00000001400D6000-memory.dmp	upx
behavioral1/files/0x0006000000015f54-139.dat	upx
behavioral1/files/0x00060000000162cc-152.dat	upx
behavioral1/files/0x0006000000016572-159.dat	upx
behavioral1/files/0x0006000000016c4a-173.dat	upx
behavioral1/files/0x0006000000016c67-178.dat	upx
behavioral1/files/0x0006000000016824-166.dat	upx
behavioral1/files/0x0006000000015cf3-78.dat	upx
behavioral1/files/0x0006000000016cde-187.dat	upx
behavioral1/files/0x00060000000160f3-145.dat	upx
behavioral1/files/0x0006000000015d97-132.dat	upx
behavioral1/files/0x0006000000015d42-131.dat	upx
behavioral1/memory/1876-115-0x000000013FE50000-0x0000000140246000-memory.dmp	upx
behavioral1/memory/2528-110-0x000000013F780000-0x000000013FB76000-memory.dmp	upx
behavioral1/files/0x0006000000015ce2-70.dat	upx
behavioral1/files/0x0006000000015cd6-65.dat	upx
behavioral1/files/0x0006000000015cbf-60.dat	upx
behavioral1/files/0x0008000000014b18-51.dat	upx
behavioral1/files/0x0007000000014856-46.dat	upx
behavioral1/files/0x000700000001473e-40.dat	upx
behavioral1/memory/2604-19-0x000000013F9F0000-0x000000013FDE6000-memory.dmp	upx
behavioral1/memory/2052-14-0x000000013F940000-0x000000013FD36000-memory.dmp	upx
behavioral1/files/0x0006000000015d09-94.dat	upx
behavioral1/memory/3004-97-0x000000013F550000-0x000000013F946000-memory.dmp	upx
behavioral1/files/0x0006000000016d05-189.dat	upx
behavioral1/files/0x0006000000016caf-182.dat	upx
behavioral1/files/0x0006000000016c5d-175.dat	upx
behavioral1/files/0x0006000000016a7d-168.dat	upx
behavioral1/files/0x00060000000165d4-161.dat	upx
behavioral1/files/0x0006000000016448-154.dat	upx
behavioral1/files/0x0006000000016133-147.dat	upx
behavioral1/files/0x0006000000015fd4-140.dat	upx
behavioral1/files/0x0006000000015de5-133.dat	upx
behavioral1/files/0x0006000000015d72-124.dat	upx
behavioral1/files/0x0006000000015d20-117.dat	upx
behavioral1/memory/2468-105-0x000000013F8D0000-0x000000013FCC6000-memory.dmp	upx
behavioral1/memory/2512-103-0x000000013FC20000-0x0000000140016000-memory.dmp	upx
behavioral1/memory/2676-101-0x000000013FDE0000-0x00000001401D6000-memory.dmp	upx
behavioral1/memory/2724-99-0x000000013F340000-0x000000013F736000-memory.dmp	upx
behavioral1/memory/2740-2450-0x000000013F580000-0x000000013F976000-memory.dmp	upx
behavioral1/memory/2052-4904-0x000000013F940000-0x000000013FD36000-memory.dmp	upx
behavioral1/memory/2604-4905-0x000000013F9F0000-0x000000013FDE6000-memory.dmp	upx
behavioral1/memory/2588-4906-0x000000013F740000-0x000000013FB36000-memory.dmp	upx
behavioral1/memory/2724-4907-0x000000013F340000-0x000000013F736000-memory.dmp	upx
behavioral1/memory/3004-4908-0x000000013F550000-0x000000013F946000-memory.dmp	upx
behavioral1/memory/2676-4909-0x000000013FDE0000-0x00000001401D6000-memory.dmp	upx
behavioral1/memory/2512-4910-0x000000013FC20000-0x0000000140016000-memory.dmp	upx
behavioral1/memory/2468-4911-0x000000013F8D0000-0x000000013FCC6000-memory.dmp	upx
behavioral1/memory/2360-4914-0x000000013F1F0000-0x000000013F5E6000-memory.dmp	upx
behavioral1/memory/1876-4915-0x000000013FE50000-0x0000000140246000-memory.dmp	upx
behavioral1/memory/760-4913-0x000000013FCE0000-0x00000001400D6000-memory.dmp	upx
behavioral1/memory/2528-4912-0x000000013F780000-0x000000013FB76000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\meDknAw.exe	119fc765b0cd46c9be3e8c972ce3e3e0_NeikiAnalytics.exe
File created	C:\Windows\System\rSNrNde.exe	119fc765b0cd46c9be3e8c972ce3e3e0_NeikiAnalytics.exe
File created	C:\Windows\System\EmoUAwi.exe	119fc765b0cd46c9be3e8c972ce3e3e0_NeikiAnalytics.exe
File created	C:\Windows\System\rjqOuHA.exe	119fc765b0cd46c9be3e8c972ce3e3e0_NeikiAnalytics.exe
File created	C:\Windows\System\mzbndHo.exe	119fc765b0cd46c9be3e8c972ce3e3e0_NeikiAnalytics.exe
File created	C:\Windows\System\zKBKDaB.exe	119fc765b0cd46c9be3e8c972ce3e3e0_NeikiAnalytics.exe
File created	C:\Windows\System\MNEWCPD.exe	119fc765b0cd46c9be3e8c972ce3e3e0_NeikiAnalytics.exe
File created	C:\Windows\System\NxKWNVN.exe	119fc765b0cd46c9be3e8c972ce3e3e0_NeikiAnalytics.exe
File created	C:\Windows\System\TCIiLCx.exe	119fc765b0cd46c9be3e8c972ce3e3e0_NeikiAnalytics.exe
File created	C:\Windows\System\HRUMAnL.exe	119fc765b0cd46c9be3e8c972ce3e3e0_NeikiAnalytics.exe
File created	C:\Windows\System\ugujMXJ.exe	119fc765b0cd46c9be3e8c972ce3e3e0_NeikiAnalytics.exe
File created	C:\Windows\System\GsRhGLR.exe	119fc765b0cd46c9be3e8c972ce3e3e0_NeikiAnalytics.exe
File created	C:\Windows\System\xhGwCed.exe	119fc765b0cd46c9be3e8c972ce3e3e0_NeikiAnalytics.exe
File created	C:\Windows\System\oBcFiyP.exe	119fc765b0cd46c9be3e8c972ce3e3e0_NeikiAnalytics.exe
File created	C:\Windows\System\GGtWACp.exe	119fc765b0cd46c9be3e8c972ce3e3e0_NeikiAnalytics.exe
File created	C:\Windows\System\JbnLKuG.exe	119fc765b0cd46c9be3e8c972ce3e3e0_NeikiAnalytics.exe
File created	C:\Windows\System\bQNBlFV.exe	119fc765b0cd46c9be3e8c972ce3e3e0_NeikiAnalytics.exe
File created	C:\Windows\System\bVQRLqN.exe	119fc765b0cd46c9be3e8c972ce3e3e0_NeikiAnalytics.exe
File created	C:\Windows\System\dQKHzGU.exe	119fc765b0cd46c9be3e8c972ce3e3e0_NeikiAnalytics.exe
File created	C:\Windows\System\MzIfxYX.exe	119fc765b0cd46c9be3e8c972ce3e3e0_NeikiAnalytics.exe
File created	C:\Windows\System\JZyhXhs.exe	119fc765b0cd46c9be3e8c972ce3e3e0_NeikiAnalytics.exe
File created	C:\Windows\System\YNLUfPN.exe	119fc765b0cd46c9be3e8c972ce3e3e0_NeikiAnalytics.exe
File created	C:\Windows\System\ugudAhk.exe	119fc765b0cd46c9be3e8c972ce3e3e0_NeikiAnalytics.exe
File created	C:\Windows\System\QRYCTaA.exe	119fc765b0cd46c9be3e8c972ce3e3e0_NeikiAnalytics.exe
File created	C:\Windows\System\eeUQuQD.exe	119fc765b0cd46c9be3e8c972ce3e3e0_NeikiAnalytics.exe
File created	C:\Windows\System\haBiuyP.exe	119fc765b0cd46c9be3e8c972ce3e3e0_NeikiAnalytics.exe
File created	C:\Windows\System\BwkiVFm.exe	119fc765b0cd46c9be3e8c972ce3e3e0_NeikiAnalytics.exe
File created	C:\Windows\System\KJiFWaa.exe	119fc765b0cd46c9be3e8c972ce3e3e0_NeikiAnalytics.exe
File created	C:\Windows\System\XabYOFL.exe	119fc765b0cd46c9be3e8c972ce3e3e0_NeikiAnalytics.exe
File created	C:\Windows\System\RGRYNOz.exe	119fc765b0cd46c9be3e8c972ce3e3e0_NeikiAnalytics.exe
File created	C:\Windows\System\dKfpJQK.exe	119fc765b0cd46c9be3e8c972ce3e3e0_NeikiAnalytics.exe
File created	C:\Windows\System\qhXFmna.exe	119fc765b0cd46c9be3e8c972ce3e3e0_NeikiAnalytics.exe
File created	C:\Windows\System\QreGMaK.exe	119fc765b0cd46c9be3e8c972ce3e3e0_NeikiAnalytics.exe
File created	C:\Windows\System\jzcxYRa.exe	119fc765b0cd46c9be3e8c972ce3e3e0_NeikiAnalytics.exe
File created	C:\Windows\System\RZeHjRl.exe	119fc765b0cd46c9be3e8c972ce3e3e0_NeikiAnalytics.exe
File created	C:\Windows\System\tOpTdhm.exe	119fc765b0cd46c9be3e8c972ce3e3e0_NeikiAnalytics.exe
File created	C:\Windows\System\PWYDkeh.exe	119fc765b0cd46c9be3e8c972ce3e3e0_NeikiAnalytics.exe
File created	C:\Windows\System\hLIeSFZ.exe	119fc765b0cd46c9be3e8c972ce3e3e0_NeikiAnalytics.exe
File created	C:\Windows\System\iqmjIxO.exe	119fc765b0cd46c9be3e8c972ce3e3e0_NeikiAnalytics.exe
File created	C:\Windows\System\jVWSsFK.exe	119fc765b0cd46c9be3e8c972ce3e3e0_NeikiAnalytics.exe
File created	C:\Windows\System\HENDfsx.exe	119fc765b0cd46c9be3e8c972ce3e3e0_NeikiAnalytics.exe
File created	C:\Windows\System\OUYJkOS.exe	119fc765b0cd46c9be3e8c972ce3e3e0_NeikiAnalytics.exe
File created	C:\Windows\System\qgpogMh.exe	119fc765b0cd46c9be3e8c972ce3e3e0_NeikiAnalytics.exe
File created	C:\Windows\System\mMzLrEY.exe	119fc765b0cd46c9be3e8c972ce3e3e0_NeikiAnalytics.exe
File created	C:\Windows\System\AcLkSZl.exe	119fc765b0cd46c9be3e8c972ce3e3e0_NeikiAnalytics.exe
File created	C:\Windows\System\kIlwuVP.exe	119fc765b0cd46c9be3e8c972ce3e3e0_NeikiAnalytics.exe
File created	C:\Windows\System\caApWHq.exe	119fc765b0cd46c9be3e8c972ce3e3e0_NeikiAnalytics.exe
File created	C:\Windows\System\tuMrLtb.exe	119fc765b0cd46c9be3e8c972ce3e3e0_NeikiAnalytics.exe
File created	C:\Windows\System\yNoFKPv.exe	119fc765b0cd46c9be3e8c972ce3e3e0_NeikiAnalytics.exe
File created	C:\Windows\System\btlVfsy.exe	119fc765b0cd46c9be3e8c972ce3e3e0_NeikiAnalytics.exe
File created	C:\Windows\System\KtEessK.exe	119fc765b0cd46c9be3e8c972ce3e3e0_NeikiAnalytics.exe
File created	C:\Windows\System\dtZFQFK.exe	119fc765b0cd46c9be3e8c972ce3e3e0_NeikiAnalytics.exe
File created	C:\Windows\System\vVKOksN.exe	119fc765b0cd46c9be3e8c972ce3e3e0_NeikiAnalytics.exe
File created	C:\Windows\System\fXmpGir.exe	119fc765b0cd46c9be3e8c972ce3e3e0_NeikiAnalytics.exe
File created	C:\Windows\System\ScmNEmp.exe	119fc765b0cd46c9be3e8c972ce3e3e0_NeikiAnalytics.exe
File created	C:\Windows\System\ExzoPVI.exe	119fc765b0cd46c9be3e8c972ce3e3e0_NeikiAnalytics.exe
File created	C:\Windows\System\urOWqvm.exe	119fc765b0cd46c9be3e8c972ce3e3e0_NeikiAnalytics.exe
File created	C:\Windows\System\VBNrjwN.exe	119fc765b0cd46c9be3e8c972ce3e3e0_NeikiAnalytics.exe
File created	C:\Windows\System\bOVbUBi.exe	119fc765b0cd46c9be3e8c972ce3e3e0_NeikiAnalytics.exe
File created	C:\Windows\System\Dhofywm.exe	119fc765b0cd46c9be3e8c972ce3e3e0_NeikiAnalytics.exe
File created	C:\Windows\System\dYDTEip.exe	119fc765b0cd46c9be3e8c972ce3e3e0_NeikiAnalytics.exe
File created	C:\Windows\System\oFfslvI.exe	119fc765b0cd46c9be3e8c972ce3e3e0_NeikiAnalytics.exe
File created	C:\Windows\System\AySCBAl.exe	119fc765b0cd46c9be3e8c972ce3e3e0_NeikiAnalytics.exe
File created	C:\Windows\System\DdJfMOv.exe	119fc765b0cd46c9be3e8c972ce3e3e0_NeikiAnalytics.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2160	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2740	119fc765b0cd46c9be3e8c972ce3e3e0_NeikiAnalytics.exe
Token: SeDebugPrivilege	2160	powershell.exe
Token: SeLockMemoryPrivilege	2740	119fc765b0cd46c9be3e8c972ce3e3e0_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2740 wrote to memory of 2160	2740	119fc765b0cd46c9be3e8c972ce3e3e0_NeikiAnalytics.exe	29
PID 2740 wrote to memory of 2160	2740	119fc765b0cd46c9be3e8c972ce3e3e0_NeikiAnalytics.exe	29
PID 2740 wrote to memory of 2160	2740	119fc765b0cd46c9be3e8c972ce3e3e0_NeikiAnalytics.exe	29
PID 2740 wrote to memory of 2052	2740	119fc765b0cd46c9be3e8c972ce3e3e0_NeikiAnalytics.exe	30
PID 2740 wrote to memory of 2052	2740	119fc765b0cd46c9be3e8c972ce3e3e0_NeikiAnalytics.exe	30
PID 2740 wrote to memory of 2052	2740	119fc765b0cd46c9be3e8c972ce3e3e0_NeikiAnalytics.exe	30
PID 2740 wrote to memory of 2604	2740	119fc765b0cd46c9be3e8c972ce3e3e0_NeikiAnalytics.exe	31
PID 2740 wrote to memory of 2604	2740	119fc765b0cd46c9be3e8c972ce3e3e0_NeikiAnalytics.exe	31
PID 2740 wrote to memory of 2604	2740	119fc765b0cd46c9be3e8c972ce3e3e0_NeikiAnalytics.exe	31
PID 2740 wrote to memory of 2588	2740	119fc765b0cd46c9be3e8c972ce3e3e0_NeikiAnalytics.exe	32
PID 2740 wrote to memory of 2588	2740	119fc765b0cd46c9be3e8c972ce3e3e0_NeikiAnalytics.exe	32
PID 2740 wrote to memory of 2588	2740	119fc765b0cd46c9be3e8c972ce3e3e0_NeikiAnalytics.exe	32
PID 2740 wrote to memory of 3004	2740	119fc765b0cd46c9be3e8c972ce3e3e0_NeikiAnalytics.exe	33
PID 2740 wrote to memory of 3004	2740	119fc765b0cd46c9be3e8c972ce3e3e0_NeikiAnalytics.exe	33
PID 2740 wrote to memory of 3004	2740	119fc765b0cd46c9be3e8c972ce3e3e0_NeikiAnalytics.exe	33
PID 2740 wrote to memory of 2724	2740	119fc765b0cd46c9be3e8c972ce3e3e0_NeikiAnalytics.exe	34
PID 2740 wrote to memory of 2724	2740	119fc765b0cd46c9be3e8c972ce3e3e0_NeikiAnalytics.exe	34
PID 2740 wrote to memory of 2724	2740	119fc765b0cd46c9be3e8c972ce3e3e0_NeikiAnalytics.exe	34
PID 2740 wrote to memory of 2676	2740	119fc765b0cd46c9be3e8c972ce3e3e0_NeikiAnalytics.exe	35
PID 2740 wrote to memory of 2676	2740	119fc765b0cd46c9be3e8c972ce3e3e0_NeikiAnalytics.exe	35
PID 2740 wrote to memory of 2676	2740	119fc765b0cd46c9be3e8c972ce3e3e0_NeikiAnalytics.exe	35
PID 2740 wrote to memory of 2512	2740	119fc765b0cd46c9be3e8c972ce3e3e0_NeikiAnalytics.exe	36
PID 2740 wrote to memory of 2512	2740	119fc765b0cd46c9be3e8c972ce3e3e0_NeikiAnalytics.exe	36
PID 2740 wrote to memory of 2512	2740	119fc765b0cd46c9be3e8c972ce3e3e0_NeikiAnalytics.exe	36
PID 2740 wrote to memory of 2468	2740	119fc765b0cd46c9be3e8c972ce3e3e0_NeikiAnalytics.exe	37
PID 2740 wrote to memory of 2468	2740	119fc765b0cd46c9be3e8c972ce3e3e0_NeikiAnalytics.exe	37
PID 2740 wrote to memory of 2468	2740	119fc765b0cd46c9be3e8c972ce3e3e0_NeikiAnalytics.exe	37
PID 2740 wrote to memory of 2528	2740	119fc765b0cd46c9be3e8c972ce3e3e0_NeikiAnalytics.exe	38
PID 2740 wrote to memory of 2528	2740	119fc765b0cd46c9be3e8c972ce3e3e0_NeikiAnalytics.exe	38
PID 2740 wrote to memory of 2528	2740	119fc765b0cd46c9be3e8c972ce3e3e0_NeikiAnalytics.exe	38
PID 2740 wrote to memory of 2360	2740	119fc765b0cd46c9be3e8c972ce3e3e0_NeikiAnalytics.exe	39
PID 2740 wrote to memory of 2360	2740	119fc765b0cd46c9be3e8c972ce3e3e0_NeikiAnalytics.exe	39
PID 2740 wrote to memory of 2360	2740	119fc765b0cd46c9be3e8c972ce3e3e0_NeikiAnalytics.exe	39
PID 2740 wrote to memory of 1876	2740	119fc765b0cd46c9be3e8c972ce3e3e0_NeikiAnalytics.exe	40
PID 2740 wrote to memory of 1876	2740	119fc765b0cd46c9be3e8c972ce3e3e0_NeikiAnalytics.exe	40
PID 2740 wrote to memory of 1876	2740	119fc765b0cd46c9be3e8c972ce3e3e0_NeikiAnalytics.exe	40
PID 2740 wrote to memory of 760	2740	119fc765b0cd46c9be3e8c972ce3e3e0_NeikiAnalytics.exe	41
PID 2740 wrote to memory of 760	2740	119fc765b0cd46c9be3e8c972ce3e3e0_NeikiAnalytics.exe	41
PID 2740 wrote to memory of 760	2740	119fc765b0cd46c9be3e8c972ce3e3e0_NeikiAnalytics.exe	41
PID 2740 wrote to memory of 812	2740	119fc765b0cd46c9be3e8c972ce3e3e0_NeikiAnalytics.exe	42
PID 2740 wrote to memory of 812	2740	119fc765b0cd46c9be3e8c972ce3e3e0_NeikiAnalytics.exe	42
PID 2740 wrote to memory of 812	2740	119fc765b0cd46c9be3e8c972ce3e3e0_NeikiAnalytics.exe	42
PID 2740 wrote to memory of 2524	2740	119fc765b0cd46c9be3e8c972ce3e3e0_NeikiAnalytics.exe	43
PID 2740 wrote to memory of 2524	2740	119fc765b0cd46c9be3e8c972ce3e3e0_NeikiAnalytics.exe	43
PID 2740 wrote to memory of 2524	2740	119fc765b0cd46c9be3e8c972ce3e3e0_NeikiAnalytics.exe	43
PID 2740 wrote to memory of 2552	2740	119fc765b0cd46c9be3e8c972ce3e3e0_NeikiAnalytics.exe	44
PID 2740 wrote to memory of 2552	2740	119fc765b0cd46c9be3e8c972ce3e3e0_NeikiAnalytics.exe	44
PID 2740 wrote to memory of 2552	2740	119fc765b0cd46c9be3e8c972ce3e3e0_NeikiAnalytics.exe	44
PID 2740 wrote to memory of 2152	2740	119fc765b0cd46c9be3e8c972ce3e3e0_NeikiAnalytics.exe	45
PID 2740 wrote to memory of 2152	2740	119fc765b0cd46c9be3e8c972ce3e3e0_NeikiAnalytics.exe	45
PID 2740 wrote to memory of 2152	2740	119fc765b0cd46c9be3e8c972ce3e3e0_NeikiAnalytics.exe	45
PID 2740 wrote to memory of 1668	2740	119fc765b0cd46c9be3e8c972ce3e3e0_NeikiAnalytics.exe	46
PID 2740 wrote to memory of 1668	2740	119fc765b0cd46c9be3e8c972ce3e3e0_NeikiAnalytics.exe	46
PID 2740 wrote to memory of 1668	2740	119fc765b0cd46c9be3e8c972ce3e3e0_NeikiAnalytics.exe	46
PID 2740 wrote to memory of 1980	2740	119fc765b0cd46c9be3e8c972ce3e3e0_NeikiAnalytics.exe	47
PID 2740 wrote to memory of 1980	2740	119fc765b0cd46c9be3e8c972ce3e3e0_NeikiAnalytics.exe	47
PID 2740 wrote to memory of 1980	2740	119fc765b0cd46c9be3e8c972ce3e3e0_NeikiAnalytics.exe	47
PID 2740 wrote to memory of 1764	2740	119fc765b0cd46c9be3e8c972ce3e3e0_NeikiAnalytics.exe	48
PID 2740 wrote to memory of 1764	2740	119fc765b0cd46c9be3e8c972ce3e3e0_NeikiAnalytics.exe	48
PID 2740 wrote to memory of 1764	2740	119fc765b0cd46c9be3e8c972ce3e3e0_NeikiAnalytics.exe	48
PID 2740 wrote to memory of 2804	2740	119fc765b0cd46c9be3e8c972ce3e3e0_NeikiAnalytics.exe	49
PID 2740 wrote to memory of 2804	2740	119fc765b0cd46c9be3e8c972ce3e3e0_NeikiAnalytics.exe	49
PID 2740 wrote to memory of 2804	2740	119fc765b0cd46c9be3e8c972ce3e3e0_NeikiAnalytics.exe	49
PID 2740 wrote to memory of 496	2740	119fc765b0cd46c9be3e8c972ce3e3e0_NeikiAnalytics.exe	50

C:\Users\Admin\AppData\Local\Temp\119fc765b0cd46c9be3e8c972ce3e3e0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\119fc765b0cd46c9be3e8c972ce3e3e0_NeikiAnalytics.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2740
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2160
- C:\Windows\System\WYruXVA.exe
  C:\Windows\System\WYruXVA.exe
  2⤵
  - Executes dropped EXE
  PID:2052
- C:\Windows\System\jjxlgnx.exe
  C:\Windows\System\jjxlgnx.exe
  2⤵
  - Executes dropped EXE
  PID:2604
- C:\Windows\System\JXUwoSL.exe
  C:\Windows\System\JXUwoSL.exe
  2⤵
  - Executes dropped EXE
  PID:2588
- C:\Windows\System\bcshbnE.exe
  C:\Windows\System\bcshbnE.exe
  2⤵
  - Executes dropped EXE
  PID:3004
- C:\Windows\System\SdoQxIq.exe
  C:\Windows\System\SdoQxIq.exe
  2⤵
  - Executes dropped EXE
  PID:2724
- C:\Windows\System\hRBxKPw.exe
  C:\Windows\System\hRBxKPw.exe
  2⤵
  - Executes dropped EXE
  PID:2676
- C:\Windows\System\gYrfJUL.exe
  C:\Windows\System\gYrfJUL.exe
  2⤵
  - Executes dropped EXE
  PID:2512
- C:\Windows\System\LYjYRyv.exe
  C:\Windows\System\LYjYRyv.exe
  2⤵
  - Executes dropped EXE
  PID:2468
- C:\Windows\System\UHqxUoE.exe
  C:\Windows\System\UHqxUoE.exe
  2⤵
  - Executes dropped EXE
  PID:2528
- C:\Windows\System\iPeUvIK.exe
  C:\Windows\System\iPeUvIK.exe
  2⤵
  - Executes dropped EXE
  PID:2360
- C:\Windows\System\koEBYub.exe
  C:\Windows\System\koEBYub.exe
  2⤵
  - Executes dropped EXE
  PID:1876
- C:\Windows\System\XiUALPN.exe
  C:\Windows\System\XiUALPN.exe
  2⤵
  - Executes dropped EXE
  PID:760
- C:\Windows\System\gTYtkue.exe
  C:\Windows\System\gTYtkue.exe
  2⤵
  - Executes dropped EXE
  PID:812
- C:\Windows\System\AMIQefE.exe
  C:\Windows\System\AMIQefE.exe
  2⤵
  - Executes dropped EXE
  PID:2524
- C:\Windows\System\pNYISDE.exe
  C:\Windows\System\pNYISDE.exe
  2⤵
  - Executes dropped EXE
  PID:2552
- C:\Windows\System\vVKOksN.exe
  C:\Windows\System\vVKOksN.exe
  2⤵
  PID:2152
- C:\Windows\System\gUERjTf.exe
  C:\Windows\System\gUERjTf.exe
  2⤵
  - Executes dropped EXE
  PID:1668
- C:\Windows\System\GyufLux.exe
  C:\Windows\System\GyufLux.exe
  2⤵
  PID:1980
- C:\Windows\System\SrJdirp.exe
  C:\Windows\System\SrJdirp.exe
  2⤵
  - Executes dropped EXE
  PID:1764
- C:\Windows\System\IRrMTQr.exe
  C:\Windows\System\IRrMTQr.exe
  2⤵
  PID:2804
- C:\Windows\System\dJFXqQm.exe
  C:\Windows\System\dJFXqQm.exe
  2⤵
  - Executes dropped EXE
  PID:496
- C:\Windows\System\EaDGtdH.exe
  C:\Windows\System\EaDGtdH.exe
  2⤵
  PID:2356
- C:\Windows\System\yhIMopQ.exe
  C:\Windows\System\yhIMopQ.exe
  2⤵
  - Executes dropped EXE
  PID:2820
- C:\Windows\System\bUXXUGO.exe
  C:\Windows\System\bUXXUGO.exe
  2⤵
  PID:1512
- C:\Windows\System\GDcUyZM.exe
  C:\Windows\System\GDcUyZM.exe
  2⤵
  - Executes dropped EXE
  PID:2216
- C:\Windows\System\bixECTZ.exe
  C:\Windows\System\bixECTZ.exe
  2⤵
  PID:2084
- C:\Windows\System\jdRIIuY.exe
  C:\Windows\System\jdRIIuY.exe
  2⤵
  - Executes dropped EXE
  PID:2236
- C:\Windows\System\mssrZSE.exe
  C:\Windows\System\mssrZSE.exe
  2⤵
  PID:1676
- C:\Windows\System\lflwdVO.exe
  C:\Windows\System\lflwdVO.exe
  2⤵
  - Executes dropped EXE
  PID:2864
- C:\Windows\System\cSXwRAI.exe
  C:\Windows\System\cSXwRAI.exe
  2⤵
  PID:2776
- C:\Windows\System\YpZJIBh.exe
  C:\Windows\System\YpZJIBh.exe
  2⤵
  - Executes dropped EXE
  PID:2036
- C:\Windows\System\uCpUDHi.exe
  C:\Windows\System\uCpUDHi.exe
  2⤵
  PID:380
- C:\Windows\System\rRCWajl.exe
  C:\Windows\System\rRCWajl.exe
  2⤵
  - Executes dropped EXE
  PID:1140
- C:\Windows\System\QbPpTca.exe
  C:\Windows\System\QbPpTca.exe
  2⤵
  PID:1484
- C:\Windows\System\xrgeoiv.exe
  C:\Windows\System\xrgeoiv.exe
  2⤵
  - Executes dropped EXE
  PID:1096
- C:\Windows\System\YHpGMat.exe
  C:\Windows\System\YHpGMat.exe
  2⤵
  PID:2796
- C:\Windows\System\egISzCx.exe
  C:\Windows\System\egISzCx.exe
  2⤵
  - Executes dropped EXE
  PID:1068
- C:\Windows\System\vVdEbnt.exe
  C:\Windows\System\vVdEbnt.exe
  2⤵
  PID:2336
- C:\Windows\System\xKolmsf.exe
  C:\Windows\System\xKolmsf.exe
  2⤵
  - Executes dropped EXE
  PID:2428
- C:\Windows\System\TRInnfe.exe
  C:\Windows\System\TRInnfe.exe
  2⤵
  PID:1228
- C:\Windows\System\cctUybm.exe
  C:\Windows\System\cctUybm.exe
  2⤵
  - Executes dropped EXE
  PID:2092
- C:\Windows\System\pBtBqiG.exe
  C:\Windows\System\pBtBqiG.exe
  2⤵
  PID:3016
- C:\Windows\System\GnMVTAJ.exe
  C:\Windows\System\GnMVTAJ.exe
  2⤵
  - Executes dropped EXE
  PID:300
- C:\Windows\System\HLgcHNq.exe
  C:\Windows\System\HLgcHNq.exe
  2⤵
  PID:1336
- C:\Windows\System\BmSEtnX.exe
  C:\Windows\System\BmSEtnX.exe
  2⤵
  - Executes dropped EXE
  PID:1552
- C:\Windows\System\oxbgBBR.exe
  C:\Windows\System\oxbgBBR.exe
  2⤵
  PID:1652
- C:\Windows\System\TRAHvuO.exe
  C:\Windows\System\TRAHvuO.exe
  2⤵
  - Executes dropped EXE
  PID:1348
- C:\Windows\System\MpMgcQD.exe
  C:\Windows\System\MpMgcQD.exe
  2⤵
  PID:1088
- C:\Windows\System\aEmyrzf.exe
  C:\Windows\System\aEmyrzf.exe
  2⤵
  - Executes dropped EXE
  PID:1628
- C:\Windows\System\QQoWanb.exe
  C:\Windows\System\QQoWanb.exe
  2⤵
  PID:1004
- C:\Windows\System\LBSJKgU.exe
  C:\Windows\System\LBSJKgU.exe
  2⤵
  - Executes dropped EXE
  PID:2188
- C:\Windows\System\zAnGqRp.exe
  C:\Windows\System\zAnGqRp.exe
  2⤵
  PID:660
- C:\Windows\System\NTEjgYi.exe
  C:\Windows\System\NTEjgYi.exe
  2⤵
  - Executes dropped EXE
  PID:560
- C:\Windows\System\kxlBPWE.exe
  C:\Windows\System\kxlBPWE.exe
  2⤵
  PID:1244
- C:\Windows\System\BBNFKpk.exe
  C:\Windows\System\BBNFKpk.exe
  2⤵
  - Executes dropped EXE
  PID:2264
- C:\Windows\System\BSQKHWN.exe
  C:\Windows\System\BSQKHWN.exe
  2⤵
  PID:624
- C:\Windows\System\akpIziJ.exe
  C:\Windows\System\akpIziJ.exe
  2⤵
  - Executes dropped EXE
  PID:772
- C:\Windows\System\xCuRnQd.exe
  C:\Windows\System\xCuRnQd.exe
  2⤵
  PID:2332
- C:\Windows\System\NSzgewa.exe
  C:\Windows\System\NSzgewa.exe
  2⤵
  - Executes dropped EXE
  PID:1076
- C:\Windows\System\WVcPoZL.exe
  C:\Windows\System\WVcPoZL.exe
  2⤵
  PID:2296
- C:\Windows\System\TXfnytz.exe
  C:\Windows\System\TXfnytz.exe
  2⤵
  - Executes dropped EXE
  PID:1732
- C:\Windows\System\GZNOpai.exe
  C:\Windows\System\GZNOpai.exe
  2⤵
  PID:884
- C:\Windows\System\vYIcRGb.exe
  C:\Windows\System\vYIcRGb.exe
  2⤵
  - Executes dropped EXE
  PID:468
- C:\Windows\System\SNPSbwN.exe
  C:\Windows\System\SNPSbwN.exe
  2⤵
  PID:2908
- C:\Windows\System\AGbjwUb.exe
  C:\Windows\System\AGbjwUb.exe
  2⤵
  - Executes dropped EXE
  PID:1124
- C:\Windows\System\vEhFwBC.exe
  C:\Windows\System\vEhFwBC.exe
  2⤵
  PID:2988
- C:\Windows\System\eLeicyW.exe
  C:\Windows\System\eLeicyW.exe
  2⤵
  - Executes dropped EXE
  PID:1588
- C:\Windows\System\BJcAgkn.exe
  C:\Windows\System\BJcAgkn.exe
  2⤵
  PID:1700
- C:\Windows\System\USEJtjX.exe
  C:\Windows\System\USEJtjX.exe
  2⤵
  - Executes dropped EXE
  PID:3040
- C:\Windows\System\msDXmmL.exe
  C:\Windows\System\msDXmmL.exe
  2⤵
  PID:2680
- C:\Windows\System\VecesHC.exe
  C:\Windows\System\VecesHC.exe
  2⤵
  - Executes dropped EXE
  PID:2472
- C:\Windows\System\IylxRSa.exe
  C:\Windows\System\IylxRSa.exe
  2⤵
  PID:2620
- C:\Windows\System\ZloRviS.exe
  C:\Windows\System\ZloRviS.exe
  2⤵
  - Executes dropped EXE
  PID:2764
- C:\Windows\System\YrCYHor.exe
  C:\Windows\System\YrCYHor.exe
  2⤵
  PID:2392
- C:\Windows\System\OcgsfVK.exe
  C:\Windows\System\OcgsfVK.exe
  2⤵
  - Executes dropped EXE
  PID:2496
- C:\Windows\System\WOJPgZH.exe
  C:\Windows\System\WOJPgZH.exe
  2⤵
  PID:2632
- C:\Windows\System\RYVRLgW.exe
  C:\Windows\System\RYVRLgW.exe
  2⤵
  - Executes dropped EXE
  PID:2936
- C:\Windows\System\yTmVwcQ.exe
  C:\Windows\System\yTmVwcQ.exe
  2⤵
  PID:1420
- C:\Windows\System\vqwdovT.exe
  C:\Windows\System\vqwdovT.exe
  2⤵
  - Executes dropped EXE
  PID:2808
- C:\Windows\System\UecfDhp.exe
  C:\Windows\System\UecfDhp.exe
  2⤵
  PID:316
- C:\Windows\System\HRUMAnL.exe
  C:\Windows\System\HRUMAnL.exe
  2⤵
  - Executes dropped EXE
  PID:2108
- C:\Windows\System\KAUEVxG.exe
  C:\Windows\System\KAUEVxG.exe
  2⤵
  PID:2300
- C:\Windows\System\dJanRDr.exe
  C:\Windows\System\dJanRDr.exe
  2⤵
  - Executes dropped EXE
  PID:2444
- C:\Windows\System\FQoORQS.exe
  C:\Windows\System\FQoORQS.exe
  2⤵
  PID:584
- C:\Windows\System\xuloTwP.exe
  C:\Windows\System\xuloTwP.exe
  2⤵
  - Executes dropped EXE
  PID:1756
- C:\Windows\System\ueoSOoM.exe
  C:\Windows\System\ueoSOoM.exe
  2⤵
  PID:3064
- C:\Windows\System\aViykOq.exe
  C:\Windows\System\aViykOq.exe
  2⤵
  - Executes dropped EXE
  PID:2424
- C:\Windows\System\UnruPbp.exe
  C:\Windows\System\UnruPbp.exe
  2⤵
  PID:2556
- C:\Windows\System\leLnSVd.exe
  C:\Windows\System\leLnSVd.exe
  2⤵
  - Executes dropped EXE
  PID:892
- C:\Windows\System\FsDiOIb.exe
  C:\Windows\System\FsDiOIb.exe
  2⤵
  PID:1884
- C:\Windows\System\GDwarQV.exe
  C:\Windows\System\GDwarQV.exe
  2⤵
  - Executes dropped EXE
  PID:1148
- C:\Windows\System\XNBRjJo.exe
  C:\Windows\System\XNBRjJo.exe
  2⤵
  PID:2904
- C:\Windows\System\yNwSOzC.exe
  C:\Windows\System\yNwSOzC.exe
  2⤵
  - Executes dropped EXE
  PID:1592
- C:\Windows\System\gbhPnjb.exe
  C:\Windows\System\gbhPnjb.exe
  2⤵
  PID:1720
- C:\Windows\System\HSVnuav.exe
  C:\Windows\System\HSVnuav.exe
  2⤵
  - Executes dropped EXE
  PID:3080
- C:\Windows\System\tmkpnAO.exe
  C:\Windows\System\tmkpnAO.exe
  2⤵
  PID:3096
- C:\Windows\System\hFXogam.exe
  C:\Windows\System\hFXogam.exe
  2⤵
  - Executes dropped EXE
  PID:3112
- C:\Windows\System\pgFyKmp.exe
  C:\Windows\System\pgFyKmp.exe
  2⤵
  PID:3128
- C:\Windows\System\vuYSlbe.exe
  C:\Windows\System\vuYSlbe.exe
  2⤵
  - Executes dropped EXE
  PID:3144
- C:\Windows\System\KfKemSC.exe
  C:\Windows\System\KfKemSC.exe
  2⤵
  PID:3160
- C:\Windows\System\fLDvbYg.exe
  C:\Windows\System\fLDvbYg.exe
  2⤵
  - Executes dropped EXE
  PID:3176
- C:\Windows\System\hTTThte.exe
  C:\Windows\System\hTTThte.exe
  2⤵
  PID:3192
- C:\Windows\System\BBUvUNm.exe
  C:\Windows\System\BBUvUNm.exe
  2⤵
  - Executes dropped EXE
  PID:3208
- C:\Windows\System\WqcCugw.exe
  C:\Windows\System\WqcCugw.exe
  2⤵
  PID:3224
- C:\Windows\System\PGeQESQ.exe
  C:\Windows\System\PGeQESQ.exe
  2⤵
  - Executes dropped EXE
  PID:3240
- C:\Windows\System\SGwIHXg.exe
  C:\Windows\System\SGwIHXg.exe
  2⤵
  PID:3256
- C:\Windows\System\oswEIdC.exe
  C:\Windows\System\oswEIdC.exe
  2⤵
  - Executes dropped EXE
  PID:3272
- C:\Windows\System\JHUWgQL.exe
  C:\Windows\System\JHUWgQL.exe
  2⤵
  PID:3288
- C:\Windows\System\YzVDihm.exe
  C:\Windows\System\YzVDihm.exe
  2⤵
  - Executes dropped EXE
  PID:3304
- C:\Windows\System\FtkLyvl.exe
  C:\Windows\System\FtkLyvl.exe
  2⤵
  PID:3320
- C:\Windows\System\pwhRbyP.exe
  C:\Windows\System\pwhRbyP.exe
  2⤵
  - Executes dropped EXE
  PID:3336
- C:\Windows\System\AjeAIjQ.exe
  C:\Windows\System\AjeAIjQ.exe
  2⤵
  PID:3352
- C:\Windows\System\aEbRCWC.exe
  C:\Windows\System\aEbRCWC.exe
  2⤵
  - Executes dropped EXE
  PID:3368
- C:\Windows\System\NFcKzaX.exe
  C:\Windows\System\NFcKzaX.exe
  2⤵
  PID:3384
- C:\Windows\System\wfSQwwB.exe
  C:\Windows\System\wfSQwwB.exe
  2⤵
  PID:3400
- C:\Windows\System\QGFMRtO.exe
  C:\Windows\System\QGFMRtO.exe
  2⤵
  PID:3416
- C:\Windows\System\pWkURKg.exe
  C:\Windows\System\pWkURKg.exe
  2⤵
  PID:3432
- C:\Windows\System\vTTdWAX.exe
  C:\Windows\System\vTTdWAX.exe
  2⤵
  PID:3448
- C:\Windows\System\YhyFxce.exe
  C:\Windows\System\YhyFxce.exe
  2⤵
  PID:3464
- C:\Windows\System\jYafEsA.exe
  C:\Windows\System\jYafEsA.exe
  2⤵
  PID:3480
- C:\Windows\System\Pnfyurl.exe
  C:\Windows\System\Pnfyurl.exe
  2⤵
  PID:3496
- C:\Windows\System\bFVoEcM.exe
  C:\Windows\System\bFVoEcM.exe
  2⤵
  PID:3512
- C:\Windows\System\bFOGGEc.exe
  C:\Windows\System\bFOGGEc.exe
  2⤵
  PID:3528
- C:\Windows\System\KatkiKg.exe
  C:\Windows\System\KatkiKg.exe
  2⤵
  PID:3544
- C:\Windows\System\qxQoCUX.exe
  C:\Windows\System\qxQoCUX.exe
  2⤵
  PID:3560
- C:\Windows\System\laWHHeB.exe
  C:\Windows\System\laWHHeB.exe
  2⤵
  PID:3576
- C:\Windows\System\XEJzFeP.exe
  C:\Windows\System\XEJzFeP.exe
  2⤵
  PID:3592
- C:\Windows\System\dvdzTDR.exe
  C:\Windows\System\dvdzTDR.exe
  2⤵
  PID:3608
- C:\Windows\System\TEalcKa.exe
  C:\Windows\System\TEalcKa.exe
  2⤵
  PID:3624
- C:\Windows\System\azaJlIE.exe
  C:\Windows\System\azaJlIE.exe
  2⤵
  PID:3640
- C:\Windows\System\itvTcPk.exe
  C:\Windows\System\itvTcPk.exe
  2⤵
  PID:3656
- C:\Windows\System\LvmoPoO.exe
  C:\Windows\System\LvmoPoO.exe
  2⤵
  PID:3672
- C:\Windows\System\snbYpDr.exe
  C:\Windows\System\snbYpDr.exe
  2⤵
  PID:3688
- C:\Windows\System\IkGHWfh.exe
  C:\Windows\System\IkGHWfh.exe
  2⤵
  PID:3704
- C:\Windows\System\sJzDtBZ.exe
  C:\Windows\System\sJzDtBZ.exe
  2⤵
  PID:3720
- C:\Windows\System\BLGhvbr.exe
  C:\Windows\System\BLGhvbr.exe
  2⤵
  PID:3736
- C:\Windows\System\yAAApbT.exe
  C:\Windows\System\yAAApbT.exe
  2⤵
  PID:3752
- C:\Windows\System\pylzpQF.exe
  C:\Windows\System\pylzpQF.exe
  2⤵
  PID:3768
- C:\Windows\System\zfUnQtj.exe
  C:\Windows\System\zfUnQtj.exe
  2⤵
  PID:3784
- C:\Windows\System\yuUARCU.exe
  C:\Windows\System\yuUARCU.exe
  2⤵
  PID:3800
- C:\Windows\System\eYOZPSU.exe
  C:\Windows\System\eYOZPSU.exe
  2⤵
  PID:3816
- C:\Windows\System\RDKXozB.exe
  C:\Windows\System\RDKXozB.exe
  2⤵
  PID:3832
- C:\Windows\System\ysXDmar.exe
  C:\Windows\System\ysXDmar.exe
  2⤵
  PID:3848
- C:\Windows\System\bVRrDvn.exe
  C:\Windows\System\bVRrDvn.exe
  2⤵
  PID:3864
- C:\Windows\System\XbyMsSB.exe
  C:\Windows\System\XbyMsSB.exe
  2⤵
  PID:3880
- C:\Windows\System\tcHmkZx.exe
  C:\Windows\System\tcHmkZx.exe
  2⤵
  PID:3896
- C:\Windows\System\DScIafo.exe
  C:\Windows\System\DScIafo.exe
  2⤵
  PID:3912
- C:\Windows\System\OMXRSDi.exe
  C:\Windows\System\OMXRSDi.exe
  2⤵
  PID:3928
- C:\Windows\System\Qmqltxe.exe
  C:\Windows\System\Qmqltxe.exe
  2⤵
  PID:3944
- C:\Windows\System\ZCiTmSx.exe
  C:\Windows\System\ZCiTmSx.exe
  2⤵
  PID:3960
- C:\Windows\System\HJtqWqU.exe
  C:\Windows\System\HJtqWqU.exe
  2⤵
  PID:3976
- C:\Windows\System\twaFvNu.exe
  C:\Windows\System\twaFvNu.exe
  2⤵
  PID:3992
- C:\Windows\System\EmoUAwi.exe
  C:\Windows\System\EmoUAwi.exe
  2⤵
  PID:4008
- C:\Windows\System\rEGlfPM.exe
  C:\Windows\System\rEGlfPM.exe
  2⤵
  PID:4024
- C:\Windows\System\UwjsXyQ.exe
  C:\Windows\System\UwjsXyQ.exe
  2⤵
  PID:4040
- C:\Windows\System\KmMEEsF.exe
  C:\Windows\System\KmMEEsF.exe
  2⤵
  PID:4056
- C:\Windows\System\bOScljt.exe
  C:\Windows\System\bOScljt.exe
  2⤵
  PID:4072
- C:\Windows\System\GwBkBQb.exe
  C:\Windows\System\GwBkBQb.exe
  2⤵
  PID:4088
- C:\Windows\System\HQErzSY.exe
  C:\Windows\System\HQErzSY.exe
  2⤵
  PID:2252
- C:\Windows\System\TZHhMyM.exe
  C:\Windows\System\TZHhMyM.exe
  2⤵
  PID:1504
- C:\Windows\System\Uhrbufn.exe
  C:\Windows\System\Uhrbufn.exe
  2⤵
  PID:2432
- C:\Windows\System\mLccpOn.exe
  C:\Windows\System\mLccpOn.exe
  2⤵
  PID:696
- C:\Windows\System\xwslpMy.exe
  C:\Windows\System\xwslpMy.exe
  2⤵
  PID:2672
- C:\Windows\System\BHJXCmA.exe
  C:\Windows\System\BHJXCmA.exe
  2⤵
  PID:3120
- C:\Windows\System\LdzyguY.exe
  C:\Windows\System\LdzyguY.exe
  2⤵
  PID:3184
- C:\Windows\System\nRTXrOy.exe
  C:\Windows\System\nRTXrOy.exe
  2⤵
  PID:3248
- C:\Windows\System\iIzDpUs.exe
  C:\Windows\System\iIzDpUs.exe
  2⤵
  PID:3312
- C:\Windows\System\gqgcSlb.exe
  C:\Windows\System\gqgcSlb.exe
  2⤵
  PID:3376
- C:\Windows\System\aSthFAJ.exe
  C:\Windows\System\aSthFAJ.exe
  2⤵
  PID:3440
- C:\Windows\System\nuwnxCP.exe
  C:\Windows\System\nuwnxCP.exe
  2⤵
  PID:3504
- C:\Windows\System\hoQKBHc.exe
  C:\Windows\System\hoQKBHc.exe
  2⤵
  PID:3568
- C:\Windows\System\kERSXKl.exe
  C:\Windows\System\kERSXKl.exe
  2⤵
  PID:3632
- C:\Windows\System\XmIRxHH.exe
  C:\Windows\System\XmIRxHH.exe
  2⤵
  PID:3696
- C:\Windows\System\iVfpCMS.exe
  C:\Windows\System\iVfpCMS.exe
  2⤵
  PID:3732
- C:\Windows\System\RZVkRMd.exe
  C:\Windows\System\RZVkRMd.exe
  2⤵
  PID:3792
- C:\Windows\System\TTPfMMH.exe
  C:\Windows\System\TTPfMMH.exe
  2⤵
  PID:3856
- C:\Windows\System\LgeOXwe.exe
  C:\Windows\System\LgeOXwe.exe
  2⤵
  PID:3920
- C:\Windows\System\SdBhBzV.exe
  C:\Windows\System\SdBhBzV.exe
  2⤵
  PID:3984
- C:\Windows\System\LTKPnEA.exe
  C:\Windows\System\LTKPnEA.exe
  2⤵
  PID:1728
- C:\Windows\System\vMWNMfw.exe
  C:\Windows\System\vMWNMfw.exe
  2⤵
  PID:4084
- C:\Windows\System\YndAYdo.exe
  C:\Windows\System\YndAYdo.exe
  2⤵
  PID:4112
- C:\Windows\System\eyzkbiO.exe
  C:\Windows\System\eyzkbiO.exe
  2⤵
  PID:4128
- C:\Windows\System\fhgzPwo.exe
  C:\Windows\System\fhgzPwo.exe
  2⤵
  PID:4144
- C:\Windows\System\NsQbLOQ.exe
  C:\Windows\System\NsQbLOQ.exe
  2⤵
  PID:4160
- C:\Windows\System\pEiRore.exe
  C:\Windows\System\pEiRore.exe
  2⤵
  PID:4176
- C:\Windows\System\xXviGdJ.exe
  C:\Windows\System\xXviGdJ.exe
  2⤵
  PID:4192
- C:\Windows\System\lndziYY.exe
  C:\Windows\System\lndziYY.exe
  2⤵
  PID:4208
- C:\Windows\System\XLbOaeY.exe
  C:\Windows\System\XLbOaeY.exe
  2⤵
  PID:4224
- C:\Windows\System\gxsLXUd.exe
  C:\Windows\System\gxsLXUd.exe
  2⤵
  PID:4240
- C:\Windows\System\FbZLYUZ.exe
  C:\Windows\System\FbZLYUZ.exe
  2⤵
  PID:4256
- C:\Windows\System\gooHntD.exe
  C:\Windows\System\gooHntD.exe
  2⤵
  PID:4272
- C:\Windows\System\TPUYhvo.exe
  C:\Windows\System\TPUYhvo.exe
  2⤵
  PID:4288
- C:\Windows\System\fSnKnjB.exe
  C:\Windows\System\fSnKnjB.exe
  2⤵
  PID:4304
- C:\Windows\System\ZCDQrDZ.exe
  C:\Windows\System\ZCDQrDZ.exe
  2⤵
  PID:4320
- C:\Windows\System\muhYepk.exe
  C:\Windows\System\muhYepk.exe
  2⤵
  PID:4336
- C:\Windows\System\PqSyRbK.exe
  C:\Windows\System\PqSyRbK.exe
  2⤵
  PID:4352
- C:\Windows\System\wOToLMN.exe
  C:\Windows\System\wOToLMN.exe
  2⤵
  PID:4368
- C:\Windows\System\HtLctoc.exe
  C:\Windows\System\HtLctoc.exe
  2⤵
  PID:4384
- C:\Windows\System\bNYyKGc.exe
  C:\Windows\System\bNYyKGc.exe
  2⤵
  PID:4400
- C:\Windows\System\sWkuVZC.exe
  C:\Windows\System\sWkuVZC.exe
  2⤵
  PID:4416
- C:\Windows\System\EXOfGSp.exe
  C:\Windows\System\EXOfGSp.exe
  2⤵
  PID:4432
- C:\Windows\System\FvxWIpu.exe
  C:\Windows\System\FvxWIpu.exe
  2⤵
  PID:4448
- C:\Windows\System\MkYBOxb.exe
  C:\Windows\System\MkYBOxb.exe
  2⤵
  PID:4464
- C:\Windows\System\QLhzwxS.exe
  C:\Windows\System\QLhzwxS.exe
  2⤵
  PID:4480
- C:\Windows\System\evrxUtp.exe
  C:\Windows\System\evrxUtp.exe
  2⤵
  PID:4496
- C:\Windows\System\hjUbgOe.exe
  C:\Windows\System\hjUbgOe.exe
  2⤵
  PID:4512
- C:\Windows\System\WWEUyAC.exe
  C:\Windows\System\WWEUyAC.exe
  2⤵
  PID:4528
- C:\Windows\System\qDDSkxY.exe
  C:\Windows\System\qDDSkxY.exe
  2⤵
  PID:4544
- C:\Windows\System\MuqSrzm.exe
  C:\Windows\System\MuqSrzm.exe
  2⤵
  PID:4560
- C:\Windows\System\HXWjQuP.exe
  C:\Windows\System\HXWjQuP.exe
  2⤵
  PID:4576
- C:\Windows\System\cGGdkoO.exe
  C:\Windows\System\cGGdkoO.exe
  2⤵
  PID:4592
- C:\Windows\System\VlBvWAt.exe
  C:\Windows\System\VlBvWAt.exe
  2⤵
  PID:4608
- C:\Windows\System\nliKNSb.exe
  C:\Windows\System\nliKNSb.exe
  2⤵
  PID:4624
- C:\Windows\System\OHTOFDO.exe
  C:\Windows\System\OHTOFDO.exe
  2⤵
  PID:4640
- C:\Windows\System\YavDvMa.exe
  C:\Windows\System\YavDvMa.exe
  2⤵
  PID:4656
- C:\Windows\System\oImjEcu.exe
  C:\Windows\System\oImjEcu.exe
  2⤵
  PID:4672
- C:\Windows\System\ZXSCmVL.exe
  C:\Windows\System\ZXSCmVL.exe
  2⤵
  PID:4688
- C:\Windows\System\gHMCJaS.exe
  C:\Windows\System\gHMCJaS.exe
  2⤵
  PID:4704
- C:\Windows\System\FPalAQI.exe
  C:\Windows\System\FPalAQI.exe
  2⤵
  PID:4720
- C:\Windows\System\CQOtUte.exe
  C:\Windows\System\CQOtUte.exe
  2⤵
  PID:4736
- C:\Windows\System\bBxmoPS.exe
  C:\Windows\System\bBxmoPS.exe
  2⤵
  PID:4752
- C:\Windows\System\UxDWFQH.exe
  C:\Windows\System\UxDWFQH.exe
  2⤵
  PID:4768
- C:\Windows\System\JrsQPoq.exe
  C:\Windows\System\JrsQPoq.exe
  2⤵
  PID:4784
- C:\Windows\System\EPaWqAg.exe
  C:\Windows\System\EPaWqAg.exe
  2⤵
  PID:4800
- C:\Windows\System\JqVtHCQ.exe
  C:\Windows\System\JqVtHCQ.exe
  2⤵
  PID:4816
- C:\Windows\System\aITJaBf.exe
  C:\Windows\System\aITJaBf.exe
  2⤵
  PID:4832
- C:\Windows\System\BgUMtWV.exe
  C:\Windows\System\BgUMtWV.exe
  2⤵
  PID:4848
- C:\Windows\System\dAuVucN.exe
  C:\Windows\System\dAuVucN.exe
  2⤵
  PID:4864
- C:\Windows\System\XBLaSuP.exe
  C:\Windows\System\XBLaSuP.exe
  2⤵
  PID:4880
- C:\Windows\System\icOyLNr.exe
  C:\Windows\System\icOyLNr.exe
  2⤵
  PID:4896
- C:\Windows\System\swvEJOr.exe
  C:\Windows\System\swvEJOr.exe
  2⤵
  PID:4912
- C:\Windows\System\ZYzmEvR.exe
  C:\Windows\System\ZYzmEvR.exe
  2⤵
  PID:4928
- C:\Windows\System\jBjPWpb.exe
  C:\Windows\System\jBjPWpb.exe
  2⤵
  PID:4944
- C:\Windows\System\mdPiNRd.exe
  C:\Windows\System\mdPiNRd.exe
  2⤵
  PID:4960
- C:\Windows\System\szhIESQ.exe
  C:\Windows\System\szhIESQ.exe
  2⤵
  PID:4976
- C:\Windows\System\AFdvqvz.exe
  C:\Windows\System\AFdvqvz.exe
  2⤵
  PID:4992
- C:\Windows\System\oYTqdWu.exe
  C:\Windows\System\oYTqdWu.exe
  2⤵
  PID:5008
- C:\Windows\System\VecTCUP.exe
  C:\Windows\System\VecTCUP.exe
  2⤵
  PID:5024
- C:\Windows\System\ldTJnZX.exe
  C:\Windows\System\ldTJnZX.exe
  2⤵
  PID:5040
- C:\Windows\System\RfqLGkB.exe
  C:\Windows\System\RfqLGkB.exe
  2⤵
  PID:5056
- C:\Windows\System\IhfQYsN.exe
  C:\Windows\System\IhfQYsN.exe
  2⤵
  PID:5072
- C:\Windows\System\efuEvUe.exe
  C:\Windows\System\efuEvUe.exe
  2⤵
  PID:5088
- C:\Windows\System\qKiqkVl.exe
  C:\Windows\System\qKiqkVl.exe
  2⤵
  PID:5104
- C:\Windows\System\WXEjNTp.exe
  C:\Windows\System\WXEjNTp.exe
  2⤵
  PID:2824
- C:\Windows\System\CvKVUoD.exe
  C:\Windows\System\CvKVUoD.exe
  2⤵
  PID:3088
- C:\Windows\System\rRtDjeJ.exe
  C:\Windows\System\rRtDjeJ.exe
  2⤵
  PID:3344
- C:\Windows\System\HvVDQMW.exe
  C:\Windows\System\HvVDQMW.exe
  2⤵
  PID:3600
- C:\Windows\System\lLivepH.exe
  C:\Windows\System\lLivepH.exe
  2⤵
  PID:3824
- C:\Windows\System\AZoqmCr.exe
  C:\Windows\System\AZoqmCr.exe
  2⤵
  PID:4052
- C:\Windows\System\BHWLsSd.exe
  C:\Windows\System\BHWLsSd.exe
  2⤵
  PID:4152
- C:\Windows\System\BnEIwha.exe
  C:\Windows\System\BnEIwha.exe
  2⤵
  PID:4188
- C:\Windows\System\JqYGiAl.exe
  C:\Windows\System\JqYGiAl.exe
  2⤵
  PID:4252
- C:\Windows\System\WfBLJcc.exe
  C:\Windows\System\WfBLJcc.exe
  2⤵
  PID:4312
- C:\Windows\System\LqLMoul.exe
  C:\Windows\System\LqLMoul.exe
  2⤵
  PID:4376
- C:\Windows\System\eFSuVbu.exe
  C:\Windows\System\eFSuVbu.exe
  2⤵
  PID:4440
- C:\Windows\System\sWogMkZ.exe
  C:\Windows\System\sWogMkZ.exe
  2⤵
  PID:4504
- C:\Windows\System\wGCwiiU.exe
  C:\Windows\System\wGCwiiU.exe
  2⤵
  PID:5048
- C:\Windows\System\eyAzScg.exe
  C:\Windows\System\eyAzScg.exe
  2⤵
  PID:5084
- C:\Windows\System\wRDwJLm.exe
  C:\Windows\System\wRDwJLm.exe
  2⤵
  PID:3216
- C:\Windows\System\UNoZigp.exe
  C:\Windows\System\UNoZigp.exe
  2⤵
  PID:4120
- C:\Windows\System\rjijSuI.exe
  C:\Windows\System\rjijSuI.exe
  2⤵
  PID:4344
- C:\Windows\System\TyvbQGQ.exe
  C:\Windows\System\TyvbQGQ.exe
  2⤵
  PID:1424
- C:\Windows\System\cVkuahf.exe
  C:\Windows\System\cVkuahf.exe
  2⤵
  PID:1784
- C:\Windows\System\LEmFtXf.exe
  C:\Windows\System\LEmFtXf.exe
  2⤵
  PID:1616
- C:\Windows\System\gHrBWRP.exe
  C:\Windows\System\gHrBWRP.exe
  2⤵
  PID:1952
- C:\Windows\System\wngQQLh.exe
  C:\Windows\System\wngQQLh.exe
  2⤵
  PID:2224
- C:\Windows\System\ThVfNCU.exe
  C:\Windows\System\ThVfNCU.exe
  2⤵
  PID:1892
- C:\Windows\System\rVYPLTE.exe
  C:\Windows\System\rVYPLTE.exe
  2⤵
  PID:344
- C:\Windows\System\ZIUYvAv.exe
  C:\Windows\System\ZIUYvAv.exe
  2⤵
  PID:1976
- C:\Windows\System\vlLdLOu.exe
  C:\Windows\System\vlLdLOu.exe
  2⤵
  PID:304
- C:\Windows\System\vynZFoK.exe
  C:\Windows\System\vynZFoK.exe
  2⤵
  PID:2768
- C:\Windows\System\DvmtWoa.exe
  C:\Windows\System\DvmtWoa.exe
  2⤵
  PID:2816
- C:\Windows\System\DKtRljD.exe
  C:\Windows\System\DKtRljD.exe
  2⤵
  PID:3700
- C:\Windows\System\dVhsacW.exe
  C:\Windows\System\dVhsacW.exe
  2⤵
  PID:2916
- C:\Windows\System\EoMpTdD.exe
  C:\Windows\System\EoMpTdD.exe
  2⤵
  PID:372
- C:\Windows\System\JiMBNMN.exe
  C:\Windows\System\JiMBNMN.exe
  2⤵
  PID:284
- C:\Windows\System\luXWhID.exe
  C:\Windows\System\luXWhID.exe
  2⤵
  PID:1900
- C:\Windows\System\HsWTLXf.exe
  C:\Windows\System\HsWTLXf.exe
  2⤵
  PID:5132
- C:\Windows\System\fzTJEJs.exe
  C:\Windows\System\fzTJEJs.exe
  2⤵
  PID:5148
- C:\Windows\System\Wfetyzn.exe
  C:\Windows\System\Wfetyzn.exe
  2⤵
  PID:5164
- C:\Windows\System\rQLaPlA.exe
  C:\Windows\System\rQLaPlA.exe
  2⤵
  PID:5180
- C:\Windows\System\EhnQkmO.exe
  C:\Windows\System\EhnQkmO.exe
  2⤵
  PID:5196
- C:\Windows\System\xgpVnrL.exe
  C:\Windows\System\xgpVnrL.exe
  2⤵
  PID:5212
- C:\Windows\System\bHJkwMT.exe
  C:\Windows\System\bHJkwMT.exe
  2⤵
  PID:5228
- C:\Windows\System\CnoPlvZ.exe
  C:\Windows\System\CnoPlvZ.exe
  2⤵
  PID:5244
- C:\Windows\System\gggWhyX.exe
  C:\Windows\System\gggWhyX.exe
  2⤵
  PID:5260
- C:\Windows\System\rqyrihE.exe
  C:\Windows\System\rqyrihE.exe
  2⤵
  PID:5276
- C:\Windows\System\pHdCKrK.exe
  C:\Windows\System\pHdCKrK.exe
  2⤵
  PID:5292
- C:\Windows\System\LkRHvxl.exe
  C:\Windows\System\LkRHvxl.exe
  2⤵
  PID:5308
- C:\Windows\System\BAaxHiZ.exe
  C:\Windows\System\BAaxHiZ.exe
  2⤵
  PID:5324
- C:\Windows\System\dbYiWsC.exe
  C:\Windows\System\dbYiWsC.exe
  2⤵
  PID:5340
- C:\Windows\System\jtVxxcv.exe
  C:\Windows\System\jtVxxcv.exe
  2⤵
  PID:5356
- C:\Windows\System\NMuBWlE.exe
  C:\Windows\System\NMuBWlE.exe
  2⤵
  PID:5372
- C:\Windows\System\bYOSrDZ.exe
  C:\Windows\System\bYOSrDZ.exe
  2⤵
  PID:5388
- C:\Windows\System\vlaoUPv.exe
  C:\Windows\System\vlaoUPv.exe
  2⤵
  PID:5404
- C:\Windows\System\RmzcWFl.exe
  C:\Windows\System\RmzcWFl.exe
  2⤵
  PID:5420
- C:\Windows\System\hKqgOlx.exe
  C:\Windows\System\hKqgOlx.exe
  2⤵
  PID:5436
- C:\Windows\System\ZCPEhFh.exe
  C:\Windows\System\ZCPEhFh.exe
  2⤵
  PID:5452
- C:\Windows\System\fdJdoRP.exe
  C:\Windows\System\fdJdoRP.exe
  2⤵
  PID:5468
- C:\Windows\System\NPEzgCx.exe
  C:\Windows\System\NPEzgCx.exe
  2⤵
  PID:5484
- C:\Windows\System\xIKXOCM.exe
  C:\Windows\System\xIKXOCM.exe
  2⤵
  PID:5500
- C:\Windows\System\NzDwIyQ.exe
  C:\Windows\System\NzDwIyQ.exe
  2⤵
  PID:5516
- C:\Windows\System\fHHUMdB.exe
  C:\Windows\System\fHHUMdB.exe
  2⤵
  PID:5532
- C:\Windows\System\GMseJtd.exe
  C:\Windows\System\GMseJtd.exe
  2⤵
  PID:5548
- C:\Windows\System\LTvFoHM.exe
  C:\Windows\System\LTvFoHM.exe
  2⤵
  PID:5564
- C:\Windows\System\lcXKDNw.exe
  C:\Windows\System\lcXKDNw.exe
  2⤵
  PID:5580
- C:\Windows\System\PfOAyvZ.exe
  C:\Windows\System\PfOAyvZ.exe
  2⤵
  PID:5596
- C:\Windows\System\PrdCCCz.exe
  C:\Windows\System\PrdCCCz.exe
  2⤵
  PID:5612
- C:\Windows\System\TqbJsIL.exe
  C:\Windows\System\TqbJsIL.exe
  2⤵
  PID:5628
- C:\Windows\System\JtNNPZY.exe
  C:\Windows\System\JtNNPZY.exe
  2⤵
  PID:5644
- C:\Windows\System\dIMZMeE.exe
  C:\Windows\System\dIMZMeE.exe
  2⤵
  PID:5660
- C:\Windows\System\RZQHDlr.exe
  C:\Windows\System\RZQHDlr.exe
  2⤵
  PID:5676
- C:\Windows\System\wyghKno.exe
  C:\Windows\System\wyghKno.exe
  2⤵
  PID:5692
- C:\Windows\System\sStokwy.exe
  C:\Windows\System\sStokwy.exe
  2⤵
  PID:5708
- C:\Windows\System\FOMRbrq.exe
  C:\Windows\System\FOMRbrq.exe
  2⤵
  PID:5724
- C:\Windows\System\thKAppK.exe
  C:\Windows\System\thKAppK.exe
  2⤵
  PID:5740
- C:\Windows\System\egneQpa.exe
  C:\Windows\System\egneQpa.exe
  2⤵
  PID:5756
- C:\Windows\System\xEbTHmZ.exe
  C:\Windows\System\xEbTHmZ.exe
  2⤵
  PID:5772
- C:\Windows\System\pbhmyze.exe
  C:\Windows\System\pbhmyze.exe
  2⤵
  PID:5788
- C:\Windows\System\YbjIImV.exe
  C:\Windows\System\YbjIImV.exe
  2⤵
  PID:5804
- C:\Windows\System\eVnHTgE.exe
  C:\Windows\System\eVnHTgE.exe
  2⤵
  PID:5820
- C:\Windows\System\fWxVmRp.exe
  C:\Windows\System\fWxVmRp.exe
  2⤵
  PID:5836
- C:\Windows\System\tbRldCe.exe
  C:\Windows\System\tbRldCe.exe
  2⤵
  PID:5852
- C:\Windows\System\qVgyfkh.exe
  C:\Windows\System\qVgyfkh.exe
  2⤵
  PID:5868
- C:\Windows\System\VPySiMm.exe
  C:\Windows\System\VPySiMm.exe
  2⤵
  PID:5884
- C:\Windows\System\AAEQNMr.exe
  C:\Windows\System\AAEQNMr.exe
  2⤵
  PID:5900
- C:\Windows\System\WSlwRDW.exe
  C:\Windows\System\WSlwRDW.exe
  2⤵
  PID:5916
- C:\Windows\System\stcVaCK.exe
  C:\Windows\System\stcVaCK.exe
  2⤵
  PID:5932
- C:\Windows\System\gANIplu.exe
  C:\Windows\System\gANIplu.exe
  2⤵
  PID:5948
- C:\Windows\System\aWsOBNq.exe
  C:\Windows\System\aWsOBNq.exe
  2⤵
  PID:5964
- C:\Windows\System\eHZYWUA.exe
  C:\Windows\System\eHZYWUA.exe
  2⤵
  PID:5980
- C:\Windows\System\mvhdQDe.exe
  C:\Windows\System\mvhdQDe.exe
  2⤵
  PID:5996
- C:\Windows\System\kkNPyIw.exe
  C:\Windows\System\kkNPyIw.exe
  2⤵
  PID:6012
- C:\Windows\System\FSCgVuH.exe
  C:\Windows\System\FSCgVuH.exe
  2⤵
  PID:6028
- C:\Windows\System\pRghczq.exe
  C:\Windows\System\pRghczq.exe
  2⤵
  PID:6044
- C:\Windows\System\gOQkNYL.exe
  C:\Windows\System\gOQkNYL.exe
  2⤵
  PID:6060
- C:\Windows\System\myxqjlg.exe
  C:\Windows\System\myxqjlg.exe
  2⤵
  PID:7468
- C:\Windows\System\BpAMEak.exe
  C:\Windows\System\BpAMEak.exe
  2⤵
  PID:7500
- C:\Windows\System\PxSpjrd.exe
  C:\Windows\System\PxSpjrd.exe
  2⤵
  PID:7528
- C:\Windows\System\PgqiTzo.exe
  C:\Windows\System\PgqiTzo.exe
  2⤵
  PID:7564
- C:\Windows\System\GKYFGWo.exe
  C:\Windows\System\GKYFGWo.exe
  2⤵
  PID:7592
- C:\Windows\System\FGDNshk.exe
  C:\Windows\System\FGDNshk.exe
  2⤵
  PID:7640
- C:\Windows\System\MCFJQYa.exe
  C:\Windows\System\MCFJQYa.exe
  2⤵
  PID:7672
- C:\Windows\System\bEiSFvj.exe
  C:\Windows\System\bEiSFvj.exe
  2⤵
  PID:7728
- C:\Windows\System\BmSHHzd.exe
  C:\Windows\System\BmSHHzd.exe
  2⤵
  PID:7768
- C:\Windows\System\vteJMmB.exe
  C:\Windows\System\vteJMmB.exe
  2⤵
  PID:7800
- C:\Windows\System\RFwCOrN.exe
  C:\Windows\System\RFwCOrN.exe
  2⤵
  PID:7816
- C:\Windows\System\diPxaqs.exe
  C:\Windows\System\diPxaqs.exe
  2⤵
  PID:7832
- C:\Windows\System\EnIEPYO.exe
  C:\Windows\System\EnIEPYO.exe
  2⤵
  PID:7848
- C:\Windows\System\NjnjsTv.exe
  C:\Windows\System\NjnjsTv.exe
  2⤵
  PID:7864
- C:\Windows\System\eGDAkla.exe
  C:\Windows\System\eGDAkla.exe
  2⤵
  PID:7884
- C:\Windows\System\Rycdiju.exe
  C:\Windows\System\Rycdiju.exe
  2⤵
  PID:7900
- C:\Windows\System\NCrIWqT.exe
  C:\Windows\System\NCrIWqT.exe
  2⤵
  PID:7920
- C:\Windows\System\PXZGyvN.exe
  C:\Windows\System\PXZGyvN.exe
  2⤵
  PID:7936
- C:\Windows\System\gQYEZry.exe
  C:\Windows\System\gQYEZry.exe
  2⤵
  PID:7952
- C:\Windows\System\ZvmbfQZ.exe
  C:\Windows\System\ZvmbfQZ.exe
  2⤵
  PID:7972
- C:\Windows\System\TCKDXez.exe
  C:\Windows\System\TCKDXez.exe
  2⤵
  PID:7988
- C:\Windows\System\RAtTesW.exe
  C:\Windows\System\RAtTesW.exe
  2⤵
  PID:8004
- C:\Windows\System\QKWcXqK.exe
  C:\Windows\System\QKWcXqK.exe
  2⤵
  PID:8020
- C:\Windows\System\ERDtJYQ.exe
  C:\Windows\System\ERDtJYQ.exe
  2⤵
  PID:8036
- C:\Windows\System\UHUycjQ.exe
  C:\Windows\System\UHUycjQ.exe
  2⤵
  PID:8052
- C:\Windows\System\zOHeDyb.exe
  C:\Windows\System\zOHeDyb.exe
  2⤵
  PID:8072
- C:\Windows\System\iphrEdc.exe
  C:\Windows\System\iphrEdc.exe
  2⤵
  PID:8100
- C:\Windows\System\nZwfCUj.exe
  C:\Windows\System\nZwfCUj.exe
  2⤵
  PID:8128
- C:\Windows\System\pvpooCD.exe
  C:\Windows\System\pvpooCD.exe
  2⤵
  PID:8156
- C:\Windows\System\maUSqLx.exe
  C:\Windows\System\maUSqLx.exe
  2⤵
  PID:8188
- C:\Windows\System\aRNgwvP.exe
  C:\Windows\System\aRNgwvP.exe
  2⤵
  PID:7632
- C:\Windows\System\ehaExXm.exe
  C:\Windows\System\ehaExXm.exe
  2⤵
  PID:7828
- C:\Windows\System\fZkDvhY.exe
  C:\Windows\System\fZkDvhY.exe
  2⤵
  PID:7968
- C:\Windows\System\jHIRUMl.exe
  C:\Windows\System\jHIRUMl.exe
  2⤵
  PID:1040
- C:\Windows\System\sHWqQNX.exe
  C:\Windows\System\sHWqQNX.exe
  2⤵
  PID:2564
- C:\Windows\System\BDoUCUN.exe
  C:\Windows\System\BDoUCUN.exe
  2⤵
  PID:7824
- C:\Windows\System\onwEGdu.exe
  C:\Windows\System\onwEGdu.exe
  2⤵
  PID:8164
- C:\Windows\System\YJDnCeL.exe
  C:\Windows\System\YJDnCeL.exe
  2⤵
  PID:8028
- C:\Windows\System\gXucfDK.exe
  C:\Windows\System\gXucfDK.exe
  2⤵
  PID:8204
- C:\Windows\System\gGKuddK.exe
  C:\Windows\System\gGKuddK.exe
  2⤵
  PID:8220
- C:\Windows\System\WIiVqyK.exe
  C:\Windows\System\WIiVqyK.exe
  2⤵
  PID:8236
- C:\Windows\System\LTzVVjK.exe
  C:\Windows\System\LTzVVjK.exe
  2⤵
  PID:8272
- C:\Windows\System\oQjFvVk.exe
  C:\Windows\System\oQjFvVk.exe
  2⤵
  PID:8308
- C:\Windows\System\ScjvDUb.exe
  C:\Windows\System\ScjvDUb.exe
  2⤵
  PID:8360
- C:\Windows\System\OUYJkOS.exe
  C:\Windows\System\OUYJkOS.exe
  2⤵
  PID:8392
- C:\Windows\System\IfEDicx.exe
  C:\Windows\System\IfEDicx.exe
  2⤵
  PID:8432
- C:\Windows\System\JNjDOiO.exe
  C:\Windows\System\JNjDOiO.exe
  2⤵
  PID:8460
- C:\Windows\System\PLGrJsO.exe
  C:\Windows\System\PLGrJsO.exe
  2⤵
  PID:8476
- C:\Windows\System\JSiRUID.exe
  C:\Windows\System\JSiRUID.exe
  2⤵
  PID:8492
- C:\Windows\System\TsKXrCI.exe
  C:\Windows\System\TsKXrCI.exe
  2⤵
  PID:8508
- C:\Windows\System\iwTgKVA.exe
  C:\Windows\System\iwTgKVA.exe
  2⤵
  PID:8524
- C:\Windows\System\NFWFnvd.exe
  C:\Windows\System\NFWFnvd.exe
  2⤵
  PID:8540
- C:\Windows\System\PyuALDz.exe
  C:\Windows\System\PyuALDz.exe
  2⤵
  PID:8556
- C:\Windows\System\afomOke.exe
  C:\Windows\System\afomOke.exe
  2⤵
  PID:8572
- C:\Windows\System\BkBcPnB.exe
  C:\Windows\System\BkBcPnB.exe
  2⤵
  PID:8604
- C:\Windows\System\hYeAYVj.exe
  C:\Windows\System\hYeAYVj.exe
  2⤵
  PID:8624
- C:\Windows\System\CtaRzpw.exe
  C:\Windows\System\CtaRzpw.exe
  2⤵
  PID:8640
- C:\Windows\System\AjYUXgZ.exe
  C:\Windows\System\AjYUXgZ.exe
  2⤵
  PID:8656
- C:\Windows\System\rdBVXSG.exe
  C:\Windows\System\rdBVXSG.exe
  2⤵
  PID:8672
- C:\Windows\System\rhUhlyw.exe
  C:\Windows\System\rhUhlyw.exe
  2⤵
  PID:8696
- C:\Windows\System\BiWOjxa.exe
  C:\Windows\System\BiWOjxa.exe
  2⤵
  PID:8744
- C:\Windows\System\BhaRWIs.exe
  C:\Windows\System\BhaRWIs.exe
  2⤵
  PID:8764
- C:\Windows\System\ZyLRydy.exe
  C:\Windows\System\ZyLRydy.exe
  2⤵
  PID:8780
- C:\Windows\System\sYaGKom.exe
  C:\Windows\System\sYaGKom.exe
  2⤵
  PID:8800
- C:\Windows\System\TCspXSq.exe
  C:\Windows\System\TCspXSq.exe
  2⤵
  PID:8816
- C:\Windows\System\dQLgMkP.exe
  C:\Windows\System\dQLgMkP.exe
  2⤵
  PID:8932
- C:\Windows\System\uMUpBVG.exe
  C:\Windows\System\uMUpBVG.exe
  2⤵
  PID:8960
- C:\Windows\System\pXaEJwU.exe
  C:\Windows\System\pXaEJwU.exe
  2⤵
  PID:9008
- C:\Windows\System\OYdVdZI.exe
  C:\Windows\System\OYdVdZI.exe
  2⤵
  PID:9044
- C:\Windows\System\JxDNwJl.exe
  C:\Windows\System\JxDNwJl.exe
  2⤵
  PID:9076
- C:\Windows\System\JgZTWWF.exe
  C:\Windows\System\JgZTWWF.exe
  2⤵
  PID:9128
- C:\Windows\System\EjmrZMR.exe
  C:\Windows\System\EjmrZMR.exe
  2⤵
  PID:8612
- C:\Windows\System\BdraukK.exe
  C:\Windows\System\BdraukK.exe
  2⤵
  PID:8684
- C:\Windows\System\ZIpNWzW.exe
  C:\Windows\System\ZIpNWzW.exe
  2⤵
  PID:2040
- C:\Windows\System\zcEePPw.exe
  C:\Windows\System\zcEePPw.exe
  2⤵
  PID:632
- C:\Windows\System\UGjLAjJ.exe
  C:\Windows\System\UGjLAjJ.exe
  2⤵
  PID:1332
- C:\Windows\System\xuzUeql.exe
  C:\Windows\System\xuzUeql.exe
  2⤵
  PID:5252
- C:\Windows\System\nyLbhbj.exe
  C:\Windows\System\nyLbhbj.exe
  2⤵
  PID:5508
- C:\Windows\System\rjqOuHA.exe
  C:\Windows\System\rjqOuHA.exe
  2⤵
  PID:2648
- C:\Windows\System\HvElQAQ.exe
  C:\Windows\System\HvElQAQ.exe
  2⤵
  PID:5928
- C:\Windows\System\dFnKVqd.exe
  C:\Windows\System\dFnKVqd.exe
  2⤵
  PID:844
- C:\Windows\System\tlIWONb.exe
  C:\Windows\System\tlIWONb.exe
  2⤵
  PID:6156
- C:\Windows\System\DMUqMbL.exe
  C:\Windows\System\DMUqMbL.exe
  2⤵
  PID:6232
- C:\Windows\System\tOpTdhm.exe
  C:\Windows\System\tOpTdhm.exe
  2⤵
  PID:6260
- C:\Windows\System\oyqxFbQ.exe
  C:\Windows\System\oyqxFbQ.exe
  2⤵
  PID:6276
- C:\Windows\System\AZuCMjf.exe
  C:\Windows\System\AZuCMjf.exe
  2⤵
  PID:6300
- C:\Windows\System\NopKovt.exe
  C:\Windows\System\NopKovt.exe
  2⤵
  PID:6316
- C:\Windows\System\DIMWmsA.exe
  C:\Windows\System\DIMWmsA.exe
  2⤵
  PID:6356
- C:\Windows\System\RgndSoK.exe
  C:\Windows\System\RgndSoK.exe
  2⤵
  PID:6552
- C:\Windows\System\QBbMurM.exe
  C:\Windows\System\QBbMurM.exe
  2⤵
  PID:6596
- C:\Windows\System\nPGDOKu.exe
  C:\Windows\System\nPGDOKu.exe
  2⤵
  PID:7932
- C:\Windows\System\LkqWSAp.exe
  C:\Windows\System\LkqWSAp.exe
  2⤵
  PID:8380
- C:\Windows\System\oZIhbvR.exe
  C:\Windows\System\oZIhbvR.exe
  2⤵
  PID:8484
- C:\Windows\System\lUjNGWm.exe
  C:\Windows\System\lUjNGWm.exe
  2⤵
  PID:8552
- C:\Windows\System\yMNawEF.exe
  C:\Windows\System\yMNawEF.exe
  2⤵
  PID:8592
- C:\Windows\System\SoceqyC.exe
  C:\Windows\System\SoceqyC.exe
  2⤵
  PID:8636
- C:\Windows\System\lkQeFJv.exe
  C:\Windows\System\lkQeFJv.exe
  2⤵
  PID:8196
- C:\Windows\System\AeFijjr.exe
  C:\Windows\System\AeFijjr.exe
  2⤵
  PID:8068
- C:\Windows\System\AuOLwQb.exe
  C:\Windows\System\AuOLwQb.exe
  2⤵
  PID:8140
- C:\Windows\System\AIsylRz.exe
  C:\Windows\System\AIsylRz.exe
  2⤵
  PID:8048
- C:\Windows\System\vXBbZKa.exe
  C:\Windows\System\vXBbZKa.exe
  2⤵
  PID:7984
- C:\Windows\System\ASnkveb.exe
  C:\Windows\System\ASnkveb.exe
  2⤵
  PID:7912
- C:\Windows\System\LSREWiN.exe
  C:\Windows\System\LSREWiN.exe
  2⤵
  PID:7844
- C:\Windows\System\ixoZfWr.exe
  C:\Windows\System\ixoZfWr.exe
  2⤵
  PID:8688
- C:\Windows\System\IrOjIhL.exe
  C:\Windows\System\IrOjIhL.exe
  2⤵
  PID:7580
- C:\Windows\System\pjSyPWo.exe
  C:\Windows\System\pjSyPWo.exe
  2⤵
  PID:7508
- C:\Windows\System\esvApPw.exe
  C:\Windows\System\esvApPw.exe
  2⤵
  PID:6036
- C:\Windows\System\ncOMsWM.exe
  C:\Windows\System\ncOMsWM.exe
  2⤵
  PID:5972
- C:\Windows\System\kCpfOAJ.exe
  C:\Windows\System\kCpfOAJ.exe
  2⤵
  PID:5880
- C:\Windows\System\drIRjdx.exe
  C:\Windows\System\drIRjdx.exe
  2⤵
  PID:5816
- C:\Windows\System\GYHWBbT.exe
  C:\Windows\System\GYHWBbT.exe
  2⤵
  PID:5748
- C:\Windows\System\JqiGjzl.exe
  C:\Windows\System\JqiGjzl.exe
  2⤵
  PID:5656
- C:\Windows\System\qXzYQjj.exe
  C:\Windows\System\qXzYQjj.exe
  2⤵
  PID:5556
- C:\Windows\System\qdHBmsR.exe
  C:\Windows\System\qdHBmsR.exe
  2⤵
  PID:5492
- C:\Windows\System\isGYUhl.exe
  C:\Windows\System\isGYUhl.exe
  2⤵
  PID:5428
- C:\Windows\System\dGLNVgp.exe
  C:\Windows\System\dGLNVgp.exe
  2⤵
  PID:5364
- C:\Windows\System\PYjuuKB.exe
  C:\Windows\System\PYjuuKB.exe
  2⤵
  PID:5272
- C:\Windows\System\hyimZDG.exe
  C:\Windows\System\hyimZDG.exe
  2⤵
  PID:5208
- C:\Windows\System\ZifJsmF.exe
  C:\Windows\System\ZifJsmF.exe
  2⤵
  PID:5144
- C:\Windows\System\lKkfTpL.exe
  C:\Windows\System\lKkfTpL.exe
  2⤵
  PID:2448
- C:\Windows\System\RfsLNfW.exe
  C:\Windows\System\RfsLNfW.exe
  2⤵
  PID:4424
- C:\Windows\System\MPAFPjK.exe
  C:\Windows\System\MPAFPjK.exe
  2⤵
  PID:1476
- C:\Windows\System\UZqyOla.exe
  C:\Windows\System\UZqyOla.exe
  2⤵
  PID:1984
- C:\Windows\System\Rluelgq.exe
  C:\Windows\System\Rluelgq.exe
  2⤵
  PID:5116
- C:\Windows\System\dHwMJSr.exe
  C:\Windows\System\dHwMJSr.exe
  2⤵
  PID:4412
- C:\Windows\System\eYAXmZG.exe
  C:\Windows\System\eYAXmZG.exe
  2⤵
  PID:4184
- C:\Windows\System\hPYIahz.exe
  C:\Windows\System\hPYIahz.exe
  2⤵
  PID:3472
- C:\Windows\System\nsJMDVT.exe
  C:\Windows\System\nsJMDVT.exe
  2⤵
  PID:5096
- C:\Windows\System\ZXERDaw.exe
  C:\Windows\System\ZXERDaw.exe
  2⤵
  PID:5004
- C:\Windows\System\rBWkdDZ.exe
  C:\Windows\System\rBWkdDZ.exe
  2⤵
  PID:4908
- C:\Windows\System\LqPNzJp.exe
  C:\Windows\System\LqPNzJp.exe
  2⤵
  PID:4844
- C:\Windows\System\MOcrBMo.exe
  C:\Windows\System\MOcrBMo.exe
  2⤵
  PID:4780
- C:\Windows\System\hGegcQy.exe
  C:\Windows\System\hGegcQy.exe
  2⤵
  PID:4716
- C:\Windows\System\ipwqkNL.exe
  C:\Windows\System\ipwqkNL.exe
  2⤵
  PID:4652
- C:\Windows\System\nAIfwXH.exe
  C:\Windows\System\nAIfwXH.exe
  2⤵
  PID:4588
- C:\Windows\System\gmOobBV.exe
  C:\Windows\System\gmOobBV.exe
  2⤵
  PID:4524
- C:\Windows\System\HobvAoY.exe
  C:\Windows\System\HobvAoY.exe
  2⤵
  PID:4360
- C:\Windows\System\OhoqFMM.exe
  C:\Windows\System\OhoqFMM.exe
  2⤵
  PID:4296
- C:\Windows\System\ppkxRcF.exe
  C:\Windows\System\ppkxRcF.exe
  2⤵
  PID:4204
- C:\Windows\System\gfZawfO.exe
  C:\Windows\System\gfZawfO.exe
  2⤵
  PID:4140
- C:\Windows\System\hUmtuYi.exe
  C:\Windows\System\hUmtuYi.exe
  2⤵
  PID:4020
- C:\Windows\System\SWCDCaz.exe
  C:\Windows\System\SWCDCaz.exe
  2⤵
  PID:2220
- C:\Windows\System\pkeqWDm.exe
  C:\Windows\System\pkeqWDm.exe
  2⤵
  PID:3540
- C:\Windows\System\hHvYHRN.exe
  C:\Windows\System\hHvYHRN.exe
  2⤵
  PID:3284
- C:\Windows\System\eslyuwu.exe
  C:\Windows\System\eslyuwu.exe
  2⤵
  PID:1776
- C:\Windows\System\pBjFDzT.exe
  C:\Windows\System\pBjFDzT.exe
  2⤵
  PID:2484
- C:\Windows\System\sbdLJDa.exe
  C:\Windows\System\sbdLJDa.exe
  2⤵
  PID:4004
- C:\Windows\System\ZBzclmM.exe
  C:\Windows\System\ZBzclmM.exe
  2⤵
  PID:3940
- C:\Windows\System\kYDzrZw.exe
  C:\Windows\System\kYDzrZw.exe
  2⤵
  PID:3872
- C:\Windows\System\QikrJVZ.exe
  C:\Windows\System\QikrJVZ.exe
  2⤵
  PID:3808
- C:\Windows\System\AySCBAl.exe
  C:\Windows\System\AySCBAl.exe
  2⤵
  PID:3716
- C:\Windows\System\sdgvMQn.exe
  C:\Windows\System\sdgvMQn.exe
  2⤵
  PID:3648
- C:\Windows\System\OulmXbR.exe
  C:\Windows\System\OulmXbR.exe
  2⤵
  PID:3556
- C:\Windows\System\gunVasa.exe
  C:\Windows\System\gunVasa.exe
  2⤵
  PID:3492
- C:\Windows\System\fdKUFDL.exe
  C:\Windows\System\fdKUFDL.exe
  2⤵
  PID:3424
- C:\Windows\System\fUbeenT.exe
  C:\Windows\System\fUbeenT.exe
  2⤵
  PID:3328
- C:\Windows\System\yBYBDJp.exe
  C:\Windows\System\yBYBDJp.exe
  2⤵
  PID:3264
- C:\Windows\System\IUFPOsP.exe
  C:\Windows\System\IUFPOsP.exe
  2⤵
  PID:3200
- C:\Windows\System\PTYJOTL.exe
  C:\Windows\System\PTYJOTL.exe
  2⤵
  PID:3136
- C:\Windows\System\wVXwQBI.exe
  C:\Windows\System\wVXwQBI.exe
  2⤵
  PID:2636
- C:\Windows\System\ngafWcL.exe
  C:\Windows\System\ngafWcL.exe
  2⤵
  PID:2204
- C:\Windows\System\EGTMGCk.exe
  C:\Windows\System\EGTMGCk.exe
  2⤵
  PID:2948
- C:\Windows\System\rUHRJfx.exe
  C:\Windows\System\rUHRJfx.exe
  2⤵
  PID:2120
- C:\Windows\System\QdnnTwB.exe
  C:\Windows\System\QdnnTwB.exe
  2⤵
  PID:2924
- C:\Windows\System\qxeCKUd.exe
  C:\Windows\System\qxeCKUd.exe
  2⤵
  PID:2488
- C:\Windows\System\WcmWcpi.exe
  C:\Windows\System\WcmWcpi.exe
  2⤵
  PID:1704
- C:\Windows\System\MeGzHIf.exe
  C:\Windows\System\MeGzHIf.exe
  2⤵
  PID:2248
- C:\Windows\System\kDqLjwi.exe
  C:\Windows\System\kDqLjwi.exe
  2⤵
  PID:8756
- C:\Windows\System\sSpzOiR.exe
  C:\Windows\System\sSpzOiR.exe
  2⤵
  PID:9168
- C:\Windows\System\GGaSmWM.exe
  C:\Windows\System\GGaSmWM.exe
  2⤵
  PID:9192
- C:\Windows\System\HfKEvXX.exe
  C:\Windows\System\HfKEvXX.exe
  2⤵
  PID:9212
- C:\Windows\System\qNXuIHy.exe
  C:\Windows\System\qNXuIHy.exe
  2⤵
  PID:8256
- C:\Windows\System\unDZVDd.exe
  C:\Windows\System\unDZVDd.exe
  2⤵
  PID:8328
- C:\Windows\System\WciZEVV.exe
  C:\Windows\System\WciZEVV.exe
  2⤵
  PID:1908
- C:\Windows\System\QMFvbjn.exe
  C:\Windows\System\QMFvbjn.exe
  2⤵
  PID:8500
- C:\Windows\System\DbFdXmb.exe
  C:\Windows\System\DbFdXmb.exe
  2⤵
  PID:2516
- C:\Windows\System\Ddugzcf.exe
  C:\Windows\System\Ddugzcf.exe
  2⤵
  PID:8680
- C:\Windows\System\sklGCLt.exe
  C:\Windows\System\sklGCLt.exe
  2⤵
  PID:4520
- C:\Windows\System\dWEXDmL.exe
  C:\Windows\System\dWEXDmL.exe
  2⤵
  PID:2504
- C:\Windows\System\eUJvnwR.exe
  C:\Windows\System\eUJvnwR.exe
  2⤵
  PID:2112
- C:\Windows\System\uUvslCl.exe
  C:\Windows\System\uUvslCl.exe
  2⤵
  PID:2940
- C:\Windows\System\qeqcsgZ.exe
  C:\Windows\System\qeqcsgZ.exe
  2⤵
  PID:824
- C:\Windows\System\OVSHwUU.exe
  C:\Windows\System\OVSHwUU.exe
  2⤵
  PID:2080
- C:\Windows\System\YCDZEGA.exe
  C:\Windows\System\YCDZEGA.exe
  2⤵
  PID:5320
- C:\Windows\System\NaVvJAR.exe
  C:\Windows\System\NaVvJAR.exe
  2⤵
  PID:5384
- C:\Windows\System\YlECHHi.exe
  C:\Windows\System\YlECHHi.exe
  2⤵
  PID:5316
- C:\Windows\System\kLvuRlM.exe
  C:\Windows\System\kLvuRlM.exe
  2⤵
  PID:1468
- C:\Windows\System\txRRIlt.exe
  C:\Windows\System\txRRIlt.exe
  2⤵
  PID:6152
- C:\Windows\System\tDdaLwe.exe
  C:\Windows\System\tDdaLwe.exe
  2⤵
  PID:1640
- C:\Windows\System\YktPagL.exe
  C:\Windows\System\YktPagL.exe
  2⤵
  PID:2368
- C:\Windows\System\nNTASjL.exe
  C:\Windows\System\nNTASjL.exe
  2⤵
  PID:5156
- C:\Windows\System\lTrOeCy.exe
  C:\Windows\System\lTrOeCy.exe
  2⤵
  PID:6240
- C:\Windows\System\IpHLqsB.exe
  C:\Windows\System\IpHLqsB.exe
  2⤵
  PID:5220
- C:\Windows\System\hJyvrbx.exe
  C:\Windows\System\hJyvrbx.exe
  2⤵
  PID:5576
- C:\Windows\System\wrBcvQy.exe
  C:\Windows\System\wrBcvQy.exe
  2⤵
  PID:5640
- C:\Windows\System\deUlJSk.exe
  C:\Windows\System\deUlJSk.exe
  2⤵
  PID:5732
- C:\Windows\System\TtMihJJ.exe
  C:\Windows\System\TtMihJJ.exe
  2⤵
  PID:6296
- C:\Windows\System\QRUpinw.exe
  C:\Windows\System\QRUpinw.exe
  2⤵
  PID:6324
- C:\Windows\System\nIMUxyK.exe
  C:\Windows\System\nIMUxyK.exe
  2⤵
  PID:6344
- C:\Windows\System\rTvwtXn.exe
  C:\Windows\System\rTvwtXn.exe
  2⤵
  PID:6168
- C:\Windows\System\NjsaaWJ.exe
  C:\Windows\System\NjsaaWJ.exe
  2⤵
  PID:6184
- C:\Windows\System\XSrGIjN.exe
  C:\Windows\System\XSrGIjN.exe
  2⤵
  PID:6200
- C:\Windows\System\OmLAAOF.exe
  C:\Windows\System\OmLAAOF.exe
  2⤵
  PID:6272
- C:\Windows\System\KEJjAxz.exe
  C:\Windows\System\KEJjAxz.exe
  2⤵
  PID:6580
- C:\Windows\System\gseMPEp.exe
  C:\Windows\System\gseMPEp.exe
  2⤵
  PID:6576
- C:\Windows\System\WPPSvrX.exe
  C:\Windows\System\WPPSvrX.exe
  2⤵
  PID:6376
- C:\Windows\System\QytoCLF.exe
  C:\Windows\System\QytoCLF.exe
  2⤵
  PID:6428
- C:\Windows\System\yebyLKH.exe
  C:\Windows\System\yebyLKH.exe
  2⤵
  PID:6432
- C:\Windows\System\wQmLzFk.exe
  C:\Windows\System\wQmLzFk.exe
  2⤵
  PID:6448
- C:\Windows\System\NnjYlOu.exe
  C:\Windows\System\NnjYlOu.exe
  2⤵
  PID:6476
- C:\Windows\System\oMdsXYc.exe
  C:\Windows\System\oMdsXYc.exe
  2⤵
  PID:6496
- C:\Windows\System\vxCaYBH.exe
  C:\Windows\System\vxCaYBH.exe
  2⤵
  PID:6516
- C:\Windows\System\HuHVvPZ.exe
  C:\Windows\System\HuHVvPZ.exe
  2⤵
  PID:6532
- C:\Windows\System\xVplFie.exe
  C:\Windows\System\xVplFie.exe
  2⤵
  PID:8600
- C:\Windows\System\UexUdjg.exe
  C:\Windows\System\UexUdjg.exe
  2⤵
  PID:8112
- C:\Windows\System\ZJwvDRr.exe
  C:\Windows\System\ZJwvDRr.exe
  2⤵
  PID:7948
- C:\Windows\System\xRZRfxr.exe
  C:\Windows\System\xRZRfxr.exe
  2⤵
  PID:7880
- C:\Windows\System\DSHeTjO.exe
  C:\Windows\System\DSHeTjO.exe
  2⤵
  PID:2200
- C:\Windows\System\fUPweBy.exe
  C:\Windows\System\fUPweBy.exe
  2⤵
  PID:8280
- C:\Windows\System\hYVHAZW.exe
  C:\Windows\System\hYVHAZW.exe
  2⤵
  PID:8752
- C:\Windows\System\jgUktDK.exe
  C:\Windows\System\jgUktDK.exe
  2⤵
  PID:8588
- C:\Windows\System\tYcttRh.exe
  C:\Windows\System\tYcttRh.exe
  2⤵
  PID:8228
- C:\Windows\System\hjAqbBO.exe
  C:\Windows\System\hjAqbBO.exe
  2⤵
  PID:8012
- C:\Windows\System\OaylDZU.exe
  C:\Windows\System\OaylDZU.exe
  2⤵
  PID:7872
- C:\Windows\System\ysWeORv.exe
  C:\Windows\System\ysWeORv.exe
  2⤵
  PID:7648
- C:\Windows\System\jywFGOX.exe
  C:\Windows\System\jywFGOX.exe
  2⤵
  PID:5396
- C:\Windows\System\hbnhzsF.exe
  C:\Windows\System\hbnhzsF.exe
  2⤵
  PID:2748
- C:\Windows\System\JvRhsCn.exe
  C:\Windows\System\JvRhsCn.exe
  2⤵
  PID:5172
- C:\Windows\System\AmbgLGS.exe
  C:\Windows\System\AmbgLGS.exe
  2⤵
  PID:4812
- C:\Windows\System\gquCkmC.exe
  C:\Windows\System\gquCkmC.exe
  2⤵
  PID:4300
- C:\Windows\System\KGmDkNC.exe
  C:\Windows\System\KGmDkNC.exe
  2⤵
  PID:3888
- C:\Windows\System\YDRKRmz.exe
  C:\Windows\System\YDRKRmz.exe
  2⤵
  PID:3972
- C:\Windows\System\lONoXlK.exe
  C:\Windows\System\lONoXlK.exe
  2⤵
  PID:3392
- C:\Windows\System\qsdNbKm.exe
  C:\Windows\System\qsdNbKm.exe
  2⤵
  PID:5780
- C:\Windows\System\gVarvvn.exe
  C:\Windows\System\gVarvvn.exe
  2⤵
  PID:3204
- C:\Windows\System\SfeuELn.exe
  C:\Windows\System\SfeuELn.exe
  2⤵
  PID:1768
- C:\Windows\System\DfsDkeH.exe
  C:\Windows\System\DfsDkeH.exe
  2⤵
  PID:8760
- C:\Windows\System\dtOKPHi.exe
  C:\Windows\System\dtOKPHi.exe
  2⤵
  PID:5592
- C:\Windows\System\gcdlkOf.exe
  C:\Windows\System\gcdlkOf.exe
  2⤵
  PID:2136
- C:\Windows\System\fXlTjyi.exe
  C:\Windows\System\fXlTjyi.exe
  2⤵
  PID:4872
- C:\Windows\System\eHomdhH.exe
  C:\Windows\System\eHomdhH.exe
  2⤵
  PID:3296
- C:\Windows\System\RWCTeOq.exe
  C:\Windows\System\RWCTeOq.exe
  2⤵
  PID:604
- C:\Windows\System\rqHSArs.exe
  C:\Windows\System\rqHSArs.exe
  2⤵
  PID:2520
- C:\Windows\System\lOaCwip.exe
  C:\Windows\System\lOaCwip.exe
  2⤵
  PID:4968
- C:\Windows\System\ZXDtObo.exe
  C:\Windows\System\ZXDtObo.exe
  2⤵
  PID:3156
- C:\Windows\System\cqMLyYB.exe
  C:\Windows\System\cqMLyYB.exe
  2⤵
  PID:4232
- C:\Windows\System\YQNgvME.exe
  C:\Windows\System\YQNgvME.exe
  2⤵
  PID:4620
- C:\Windows\System\KdRzJjg.exe
  C:\Windows\System\KdRzJjg.exe
  2⤵
  PID:5036
- C:\Windows\System\yRktdHX.exe
  C:\Windows\System\yRktdHX.exe
  2⤵
  PID:4536
- C:\Windows\System\HWYbREz.exe
  C:\Windows\System\HWYbREz.exe
  2⤵
  PID:4936
- C:\Windows\System\voseKFs.exe
  C:\Windows\System\voseKFs.exe
  2⤵
  PID:2008
- C:\Windows\System\JRftKUf.exe
  C:\Windows\System\JRftKUf.exe
  2⤵
  PID:8724
- C:\Windows\System\cdTAbWH.exe
  C:\Windows\System\cdTAbWH.exe
  2⤵
  PID:8792
- C:\Windows\System\DEvZwys.exe
  C:\Windows\System\DEvZwys.exe
  2⤵
  PID:8924
- C:\Windows\System\VXxGVdv.exe
  C:\Windows\System\VXxGVdv.exe
  2⤵
  PID:8980
- C:\Windows\System\PBunOBT.exe
  C:\Windows\System\PBunOBT.exe
  2⤵
  PID:8984
- C:\Windows\System\YsMXcdX.exe
  C:\Windows\System\YsMXcdX.exe
  2⤵
  PID:9000
- C:\Windows\System\esBiWUr.exe
  C:\Windows\System\esBiWUr.exe
  2⤵
  PID:1724
- C:\Windows\System\sGIiPdR.exe
  C:\Windows\System\sGIiPdR.exe
  2⤵
  PID:2088
- C:\Windows\System\zWWIcDV.exe
  C:\Windows\System\zWWIcDV.exe
  2⤵
  PID:9064
- C:\Windows\System\pwRgXZP.exe
  C:\Windows\System\pwRgXZP.exe
  2⤵
  PID:8944
- C:\Windows\System\bBtSsjS.exe
  C:\Windows\System\bBtSsjS.exe
  2⤵
  PID:9016
- C:\Windows\System\DsHvuEk.exe
  C:\Windows\System\DsHvuEk.exe
  2⤵
  PID:9148
- C:\Windows\System\pbvEZlf.exe
  C:\Windows\System\pbvEZlf.exe
  2⤵
  PID:9040
- C:\Windows\System\cMjSibX.exe
  C:\Windows\System\cMjSibX.exe
  2⤵
  PID:1852
- C:\Windows\System\LMrddlc.exe
  C:\Windows\System\LMrddlc.exe
  2⤵
  PID:2668
- C:\Windows\System\RBDLYQb.exe
  C:\Windows\System\RBDLYQb.exe
  2⤵
  PID:9180
- C:\Windows\System\sWnSXVF.exe
  C:\Windows\System\sWnSXVF.exe
  2⤵
  PID:8420
- C:\Windows\System\zzqEhvr.exe
  C:\Windows\System\zzqEhvr.exe
  2⤵
  PID:4460
- C:\Windows\System\IJuKyGM.exe
  C:\Windows\System\IJuKyGM.exe
  2⤵
  PID:2196
- C:\Windows\System\kdjXNBz.exe
  C:\Windows\System\kdjXNBz.exe
  2⤵
  PID:5480
- C:\Windows\System\ijTQUpA.exe
  C:\Windows\System\ijTQUpA.exe
  2⤵
  PID:5896
- C:\Windows\System\UpEWmUW.exe
  C:\Windows\System\UpEWmUW.exe
  2⤵
  PID:2968
- C:\Windows\System\olKndWu.exe
  C:\Windows\System\olKndWu.exe
  2⤵
  PID:1748
- C:\Windows\System\IQaEWuv.exe
  C:\Windows\System\IQaEWuv.exe
  2⤵
  PID:2592
- C:\Windows\System\qucbvfp.exe
  C:\Windows\System\qucbvfp.exe
  2⤵
  PID:9200
- C:\Windows\System\lmvOZid.exe
  C:\Windows\System\lmvOZid.exe
  2⤵
  PID:8332
- C:\Windows\System\XPRdZVQ.exe
  C:\Windows\System\XPRdZVQ.exe
  2⤵
  PID:8648
- C:\Windows\System\lFqToIY.exe
  C:\Windows\System\lFqToIY.exe
  2⤵
  PID:6024
- C:\Windows\System\UzRvDnm.exe
  C:\Windows\System\UzRvDnm.exe
  2⤵
  PID:6288
- C:\Windows\System\MFTVXBy.exe
  C:\Windows\System\MFTVXBy.exe
  2⤵
  PID:3456
- C:\Windows\System\mkoGZOx.exe
  C:\Windows\System\mkoGZOx.exe
  2⤵
  PID:5128
- C:\Windows\System\SPMYvDn.exe
  C:\Windows\System\SPMYvDn.exe
  2⤵
  PID:5800
- C:\Windows\System\AtGDShI.exe
  C:\Windows\System\AtGDShI.exe
  2⤵
  PID:5988
- C:\Windows\System\HSfgjuD.exe
  C:\Windows\System\HSfgjuD.exe
  2⤵
  PID:6292
- C:\Windows\System\msqSzoG.exe
  C:\Windows\System\msqSzoG.exe
  2⤵
  PID:6180
- C:\Windows\System\EczVACg.exe
  C:\Windows\System\EczVACg.exe
  2⤵
  PID:6224
- C:\Windows\System\PVNfntX.exe
  C:\Windows\System\PVNfntX.exe
  2⤵
  PID:6564
- C:\Windows\System\HRkCOin.exe
  C:\Windows\System\HRkCOin.exe
  2⤵
  PID:6308
- C:\Windows\System\awaFIrU.exe
  C:\Windows\System\awaFIrU.exe
  2⤵
  PID:6588
- C:\Windows\System\zWMiSEH.exe
  C:\Windows\System\zWMiSEH.exe
  2⤵
  PID:6420
- C:\Windows\System\jOARZaB.exe
  C:\Windows\System\jOARZaB.exe
  2⤵
  PID:8368
- C:\Windows\System\RaReZqt.exe
  C:\Windows\System\RaReZqt.exe
  2⤵
  PID:8084
- C:\Windows\System\zttHYCe.exe
  C:\Windows\System\zttHYCe.exe
  2⤵
  PID:7612
- C:\Windows\System\ejPszcJ.exe
  C:\Windows\System\ejPszcJ.exe
  2⤵
  PID:6524
- C:\Windows\System\UyvPbFW.exe
  C:\Windows\System\UyvPbFW.exe
  2⤵
  PID:5844
- C:\Windows\System\HfkDrcQ.exe
  C:\Windows\System\HfkDrcQ.exe
  2⤵
  PID:2132
- C:\Windows\System\lcAREjm.exe
  C:\Windows\System\lcAREjm.exe
  2⤵
  PID:5976
- C:\Windows\System\TpSNXPu.exe
  C:\Windows\System\TpSNXPu.exe
  2⤵
  PID:8016
- C:\Windows\System\nxbEGhx.exe
  C:\Windows\System\nxbEGhx.exe
  2⤵
  PID:5240
- C:\Windows\System\fJukleU.exe
  C:\Windows\System\fJukleU.exe
  2⤵
  PID:5940
- C:\Windows\System\BnkRywa.exe
  C:\Windows\System\BnkRywa.exe
  2⤵
  PID:1864
- C:\Windows\System\YBTqYvQ.exe
  C:\Windows\System\YBTqYvQ.exe
  2⤵
  PID:2156
- C:\Windows\System\XlBdlmg.exe
  C:\Windows\System\XlBdlmg.exe
  2⤵
  PID:5784
- C:\Windows\System\qiPquLT.exe
  C:\Windows\System\qiPquLT.exe
  2⤵
  PID:4556
- C:\Windows\System\hfQIwCK.exe
  C:\Windows\System\hfQIwCK.exe
  2⤵
  PID:4168
- C:\Windows\System\YmeURhv.exe
  C:\Windows\System\YmeURhv.exe
  2⤵
  PID:3408
- C:\Windows\System\YRxDwzu.exe
  C:\Windows\System\YRxDwzu.exe
  2⤵
  PID:3364
- C:\Windows\System\TswOYgk.exe
  C:\Windows\System\TswOYgk.exe
  2⤵
  PID:2596
- C:\Windows\System\jbwcLml.exe
  C:\Windows\System\jbwcLml.exe
  2⤵
  PID:3748
- C:\Windows\System\YVxmiLA.exe
  C:\Windows\System\YVxmiLA.exe
  2⤵
  PID:5624
- C:\Windows\System\AbMtLle.exe
  C:\Windows\System\AbMtLle.exe
  2⤵
  PID:3524
- C:\Windows\System\EJhwkJe.exe
  C:\Windows\System\EJhwkJe.exe
  2⤵
  PID:5304
- C:\Windows\System\FupHTdj.exe
  C:\Windows\System\FupHTdj.exe
  2⤵
  PID:4036
- C:\Windows\System\GIZBERS.exe
  C:\Windows\System\GIZBERS.exe
  2⤵
  PID:4616
- C:\Windows\System\eDnPbNS.exe
  C:\Windows\System\eDnPbNS.exe
  2⤵
  PID:2928
- C:\Windows\System\WmlptBC.exe
  C:\Windows\System\WmlptBC.exe
  2⤵
  PID:4108
- C:\Windows\System\jJUAGjO.exe
  C:\Windows\System\jJUAGjO.exe
  2⤵
  PID:8732
- C:\Windows\System\dSxWvtk.exe
  C:\Windows\System\dSxWvtk.exe
  2⤵
  PID:8796
- C:\Windows\System\jZtkzfe.exe
  C:\Windows\System\jZtkzfe.exe
  2⤵
  PID:8704
- C:\Windows\System\JrrENop.exe
  C:\Windows\System\JrrENop.exe
  2⤵
  PID:1432
- C:\Windows\System\CxdEudf.exe
  C:\Windows\System\CxdEudf.exe
  2⤵
  PID:352
- C:\Windows\System\asHsxyK.exe
  C:\Windows\System\asHsxyK.exe
  2⤵
  PID:3332
- C:\Windows\System\VvasCfh.exe
  C:\Windows\System\VvasCfh.exe
  2⤵
  PID:9204
- C:\Windows\System\dhHCSPI.exe
  C:\Windows\System\dhHCSPI.exe
  2⤵
  PID:2376
- C:\Windows\System\rGVIArs.exe
  C:\Windows\System\rGVIArs.exe
  2⤵
  PID:8988
- C:\Windows\System\NynLhhb.exe
  C:\Windows\System\NynLhhb.exe
  2⤵
  PID:5892
- C:\Windows\System\KFQwCER.exe
  C:\Windows\System\KFQwCER.exe
  2⤵
  PID:3028
- C:\Windows\System\JhRDavV.exe
  C:\Windows\System\JhRDavV.exe
  2⤵
  PID:572
- C:\Windows\System\ZCqkzNG.exe
  C:\Windows\System\ZCqkzNG.exe
  2⤵
  PID:8812
- C:\Windows\System\sKXOFTW.exe
  C:\Windows\System\sKXOFTW.exe
  2⤵
  PID:5924
- C:\Windows\System\oMjrpRP.exe
  C:\Windows\System\oMjrpRP.exe
  2⤵
  PID:5544
- C:\Windows\System\JReDALr.exe
  C:\Windows\System\JReDALr.exe
  2⤵
  PID:5572
- C:\Windows\System\SHAQkNd.exe
  C:\Windows\System\SHAQkNd.exe
  2⤵
  PID:8320
- C:\Windows\System\dwaUjlm.exe
  C:\Windows\System\dwaUjlm.exe
  2⤵
  PID:6164
- C:\Windows\System\NfnOOTX.exe
  C:\Windows\System\NfnOOTX.exe
  2⤵
  PID:5636
- C:\Windows\System\EaRPxKw.exe
  C:\Windows\System\EaRPxKw.exe
  2⤵
  PID:668
- C:\Windows\System\mxShlOd.exe
  C:\Windows\System\mxShlOd.exe
  2⤵
  PID:6216
- C:\Windows\System\irnQmsF.exe
  C:\Windows\System\irnQmsF.exe
  2⤵
  PID:6332
- C:\Windows\System\WbYxpbT.exe
  C:\Windows\System\WbYxpbT.exe
  2⤵
  PID:6268
- C:\Windows\System\WgoPnKy.exe
  C:\Windows\System\WgoPnKy.exe
  2⤵
  PID:5832
- C:\Windows\System\yviTXjG.exe
  C:\Windows\System\yviTXjG.exe
  2⤵
  PID:6548
- C:\Windows\System\HCdAioY.exe
  C:\Windows\System\HCdAioY.exe
  2⤵
  PID:8548
- C:\Windows\System\HkCqQxv.exe
  C:\Windows\System\HkCqQxv.exe
  2⤵
  PID:7516
- C:\Windows\System\lJfXNdB.exe
  C:\Windows\System\lJfXNdB.exe
  2⤵
  PID:5496
- C:\Windows\System\LNkaEpK.exe
  C:\Windows\System\LNkaEpK.exe
  2⤵
  PID:6488
- C:\Windows\System\rMJjKez.exe
  C:\Windows\System\rMJjKez.exe
  2⤵
  PID:4476
- C:\Windows\System\EXtHPkH.exe
  C:\Windows\System\EXtHPkH.exe
  2⤵
  PID:8232
- C:\Windows\System\LKjrrph.exe
  C:\Windows\System\LKjrrph.exe
  2⤵
  PID:1252
- C:\Windows\System\BdesIuc.exe
  C:\Windows\System\BdesIuc.exe
  2⤵
  PID:1284
- C:\Windows\System\ddPpkZr.exe
  C:\Windows\System\ddPpkZr.exe
  2⤵
  PID:4680
- C:\Windows\System\Xqnvtyj.exe
  C:\Windows\System\Xqnvtyj.exe
  2⤵
  PID:2184
- C:\Windows\System\ReAEQIz.exe
  C:\Windows\System\ReAEQIz.exe
  2⤵
  PID:3668
- C:\Windows\System\LAjmvRs.exe
  C:\Windows\System\LAjmvRs.exe
  2⤵
  PID:9176
- C:\Windows\System\vjNKHmD.exe
  C:\Windows\System\vjNKHmD.exe
  2⤵
  PID:3876
- C:\Windows\System\WKZawhg.exe
  C:\Windows\System\WKZawhg.exe
  2⤵
  PID:8808
- C:\Windows\System\tgOkltO.exe
  C:\Windows\System\tgOkltO.exe
  2⤵
  PID:1212
- C:\Windows\System\MpKzipm.exe
  C:\Windows\System\MpKzipm.exe
  2⤵
  PID:4284
- C:\Windows\System\qNjweOc.exe
  C:\Windows\System\qNjweOc.exe
  2⤵
  PID:5020
- C:\Windows\System\WrWdqgI.exe
  C:\Windows\System\WrWdqgI.exe
  2⤵
  PID:1992
- C:\Windows\System\agALONC.exe
  C:\Windows\System\agALONC.exe
  2⤵
  PID:5432
- C:\Windows\System\bCwoHFs.exe
  C:\Windows\System\bCwoHFs.exe
  2⤵
  PID:8928
- C:\Windows\System\SIGQhEr.exe
  C:\Windows\System\SIGQhEr.exe
  2⤵
  PID:2144
- C:\Windows\System\mjjDkVW.exe
  C:\Windows\System\mjjDkVW.exe
  2⤵
  PID:9124
- C:\Windows\System\PiYlfXv.exe
  C:\Windows\System\PiYlfXv.exe
  2⤵
  PID:8244
- C:\Windows\System\CtdWAcD.exe
  C:\Windows\System\CtdWAcD.exe
  2⤵
  PID:444
- C:\Windows\System\qKfDMPM.exe
  C:\Windows\System\qKfDMPM.exe
  2⤵
  PID:2756
- C:\Windows\System\GnNfgAk.exe
  C:\Windows\System\GnNfgAk.exe
  2⤵
  PID:920
- C:\Windows\System\vSdvrxX.exe
  C:\Windows\System\vSdvrxX.exe
  2⤵
  PID:5160
- C:\Windows\System\VKhMjbQ.exe
  C:\Windows\System\VKhMjbQ.exe
  2⤵
  PID:6572
- C:\Windows\System\sPsmYsP.exe
  C:\Windows\System\sPsmYsP.exe
  2⤵
  PID:8468
- C:\Windows\System\FsKmYTK.exe
  C:\Windows\System\FsKmYTK.exe
  2⤵
  PID:5188
- C:\Windows\System\gEoHbuL.exe
  C:\Windows\System\gEoHbuL.exe
  2⤵
  PID:872
- C:\Windows\System\axqXPUh.exe
  C:\Windows\System\axqXPUh.exe
  2⤵
  PID:2956
- C:\Windows\System\wVzZIAE.exe
  C:\Windows\System\wVzZIAE.exe
  2⤵
  PID:6020
- C:\Windows\System\kveSTYF.exe
  C:\Windows\System\kveSTYF.exe
  2⤵
  PID:4328
- C:\Windows\System\XdxJCBF.exe
  C:\Windows\System\XdxJCBF.exe
  2⤵
  PID:8824
- C:\Windows\System\mEBfbrp.exe
  C:\Windows\System\mEBfbrp.exe
  2⤵
  PID:4876
- C:\Windows\System\vbOpXTC.exe
  C:\Windows\System\vbOpXTC.exe
  2⤵
  PID:2116
- C:\Windows\System\tBZjsNg.exe
  C:\Windows\System\tBZjsNg.exe
  2⤵
  PID:9088
- C:\Windows\System\bqHVXNj.exe
  C:\Windows\System\bqHVXNj.exe
  2⤵
  PID:3000
- C:\Windows\System\weDJXGg.exe
  C:\Windows\System\weDJXGg.exe
  2⤵
  PID:2888
- C:\Windows\System\eNzjNrx.exe
  C:\Windows\System\eNzjNrx.exe
  2⤵
  PID:8520
- C:\Windows\System\PckcRTs.exe
  C:\Windows\System\PckcRTs.exe
  2⤵
  PID:2416
- C:\Windows\System\DftThOE.exe
  C:\Windows\System\DftThOE.exe
  2⤵
  PID:3068
- C:\Windows\System\VNVmjDC.exe
  C:\Windows\System\VNVmjDC.exe
  2⤵
  PID:2168
- C:\Windows\System\kcmyQwm.exe
  C:\Windows\System\kcmyQwm.exe
  2⤵
  PID:268
- C:\Windows\System\RttmfZS.exe
  C:\Windows\System\RttmfZS.exe
  2⤵
  PID:5192
- C:\Windows\System\tEAwSFm.exe
  C:\Windows\System\tEAwSFm.exe
  2⤵
  PID:9224
- C:\Windows\System\EobMYsq.exe
  C:\Windows\System\EobMYsq.exe
  2⤵
  PID:9256
- C:\Windows\System\AEGJTkK.exe
  C:\Windows\System\AEGJTkK.exe
  2⤵
  PID:9288
- C:\Windows\System\yqNHIcK.exe
  C:\Windows\System\yqNHIcK.exe
  2⤵
  PID:9304
- C:\Windows\System\eOBylBj.exe
  C:\Windows\System\eOBylBj.exe
  2⤵
  PID:9364
- C:\Windows\System\PWWvyVZ.exe
  C:\Windows\System\PWWvyVZ.exe
  2⤵
  PID:9380
- C:\Windows\System\jSbYjzM.exe
  C:\Windows\System\jSbYjzM.exe
  2⤵
  PID:9408
- C:\Windows\System\dPahyGA.exe
  C:\Windows\System\dPahyGA.exe
  2⤵
  PID:9424
- C:\Windows\System\FRuJxMQ.exe
  C:\Windows\System\FRuJxMQ.exe
  2⤵
  PID:9440
- C:\Windows\System\yqzLaKZ.exe
  C:\Windows\System\yqzLaKZ.exe
  2⤵
  PID:9456
- C:\Windows\System\rzzfgJA.exe
  C:\Windows\System\rzzfgJA.exe
  2⤵
  PID:9476
- C:\Windows\System\IVrjeDI.exe
  C:\Windows\System\IVrjeDI.exe
  2⤵
  PID:9496
- C:\Windows\System\aUotTTa.exe
  C:\Windows\System\aUotTTa.exe
  2⤵
  PID:9516
- C:\Windows\System\GvGTnbC.exe
  C:\Windows\System\GvGTnbC.exe
  2⤵
  PID:9532
- C:\Windows\System\UcHQjvZ.exe
  C:\Windows\System\UcHQjvZ.exe
  2⤵
  PID:9548
- C:\Windows\System\IJaElqi.exe
  C:\Windows\System\IJaElqi.exe
  2⤵
  PID:9564
- C:\Windows\System\fuxXWKG.exe
  C:\Windows\System\fuxXWKG.exe
  2⤵
  PID:9580
- C:\Windows\System\HjdqxQc.exe
  C:\Windows\System\HjdqxQc.exe
  2⤵
  PID:9596
- C:\Windows\System\mnSGbnU.exe
  C:\Windows\System\mnSGbnU.exe
  2⤵
  PID:9652
- C:\Windows\System\JwCJiUS.exe
  C:\Windows\System\JwCJiUS.exe
  2⤵
  PID:9668
- C:\Windows\System\XSCXbWE.exe
  C:\Windows\System\XSCXbWE.exe
  2⤵
  PID:9684
- C:\Windows\System\URhaxOI.exe
  C:\Windows\System\URhaxOI.exe
  2⤵
  PID:9700
- C:\Windows\System\goOKVOk.exe
  C:\Windows\System\goOKVOk.exe
  2⤵
  PID:9716
- C:\Windows\System\NBqGjCO.exe
  C:\Windows\System\NBqGjCO.exe
  2⤵
  PID:9732
- C:\Windows\System\ZdzRMtV.exe
  C:\Windows\System\ZdzRMtV.exe
  2⤵
  PID:9748
- C:\Windows\System\dbUUFPK.exe
  C:\Windows\System\dbUUFPK.exe
  2⤵
  PID:9796
- C:\Windows\System\urGrbLt.exe
  C:\Windows\System\urGrbLt.exe
  2⤵
  PID:9812
- C:\Windows\System\yCbTXoF.exe
  C:\Windows\System\yCbTXoF.exe
  2⤵
  PID:9828
- C:\Windows\System\HYyIKmn.exe
  C:\Windows\System\HYyIKmn.exe
  2⤵
  PID:9844
- C:\Windows\System\YvNymvJ.exe
  C:\Windows\System\YvNymvJ.exe
  2⤵
  PID:9864
- C:\Windows\System\DDaNEAi.exe
  C:\Windows\System\DDaNEAi.exe
  2⤵
  PID:9880
- C:\Windows\System\LaNhvbK.exe
  C:\Windows\System\LaNhvbK.exe
  2⤵
  PID:9896
- C:\Windows\System\QlkJaiW.exe
  C:\Windows\System\QlkJaiW.exe
  2⤵
  PID:9912
- C:\Windows\System\ixxrHyC.exe
  C:\Windows\System\ixxrHyC.exe
  2⤵
  PID:9928
- C:\Windows\System\rDRoYKv.exe
  C:\Windows\System\rDRoYKv.exe
  2⤵
  PID:9944
- C:\Windows\System\AgBivQP.exe
  C:\Windows\System\AgBivQP.exe
  2⤵
  PID:9996
- C:\Windows\System\mGDtZgc.exe
  C:\Windows\System\mGDtZgc.exe
  2⤵
  PID:10016
- C:\Windows\System\twDKWUg.exe
  C:\Windows\System\twDKWUg.exe
  2⤵
  PID:10032
- C:\Windows\System\rtGpwCK.exe
  C:\Windows\System\rtGpwCK.exe
  2⤵
  PID:10048
- C:\Windows\System\JHcQdYU.exe
  C:\Windows\System\JHcQdYU.exe
  2⤵
  PID:10064
- C:\Windows\System\xGexWYc.exe
  C:\Windows\System\xGexWYc.exe
  2⤵
  PID:10084
- C:\Windows\System\gszQpyg.exe
  C:\Windows\System\gszQpyg.exe
  2⤵
  PID:10100
- C:\Windows\System\lseyzuV.exe
  C:\Windows\System\lseyzuV.exe
  2⤵
  PID:10124
- C:\Windows\System\omZoUde.exe
  C:\Windows\System\omZoUde.exe
  2⤵
  PID:10140
- C:\Windows\System\JeFOutP.exe
  C:\Windows\System\JeFOutP.exe
  2⤵
  PID:10156
- C:\Windows\System\noXkrcg.exe
  C:\Windows\System\noXkrcg.exe
  2⤵
  PID:10200
- C:\Windows\System\voDfIHW.exe
  C:\Windows\System\voDfIHW.exe
  2⤵
  PID:10216
- C:\Windows\System\rIBCalH.exe
  C:\Windows\System\rIBCalH.exe
  2⤵
  PID:10232
- C:\Windows\System\UyxbuNU.exe
  C:\Windows\System\UyxbuNU.exe
  2⤵
  PID:6384
- C:\Windows\System\zgTbSDN.exe
  C:\Windows\System\zgTbSDN.exe
  2⤵
  PID:3076
- C:\Windows\System\uDHnsNg.exe
  C:\Windows\System\uDHnsNg.exe
  2⤵
  PID:4748
- C:\Windows\System\DOhPIvQ.exe
  C:\Windows\System\DOhPIvQ.exe
  2⤵
  PID:864
- C:\Windows\System\UKuTDEo.exe
  C:\Windows\System\UKuTDEo.exe
  2⤵
  PID:6528
- C:\Windows\System\iBebohV.exe
  C:\Windows\System\iBebohV.exe
  2⤵
  PID:8972
- C:\Windows\System\ncrrPJl.exe
  C:\Windows\System\ncrrPJl.exe
  2⤵
  PID:2480
- C:\Windows\System\BXNIrYP.exe
  C:\Windows\System\BXNIrYP.exe
  2⤵
  PID:8996
- C:\Windows\System\ToBemJO.exe
  C:\Windows\System\ToBemJO.exe
  2⤵
  PID:8292
- C:\Windows\System\XUwsKIC.exe
  C:\Windows\System\XUwsKIC.exe
  2⤵
  PID:6284
- C:\Windows\System\QqehdgJ.exe
  C:\Windows\System\QqehdgJ.exe
  2⤵
  PID:1672
- C:\Windows\System\lhfEQDr.exe
  C:\Windows\System\lhfEQDr.exe
  2⤵
  PID:3812
- C:\Windows\System\CzIzUPC.exe
  C:\Windows\System\CzIzUPC.exe
  2⤵
  PID:9232
- C:\Windows\System\sTNQZZK.exe
  C:\Windows\System\sTNQZZK.exe
  2⤵
  PID:9276
- C:\Windows\System\VwBgoSz.exe
  C:\Windows\System\VwBgoSz.exe
  2⤵
  PID:9296
- C:\Windows\System\qPJWjmq.exe
  C:\Windows\System\qPJWjmq.exe
  2⤵
  PID:9324
- C:\Windows\System\LOSdjUC.exe
  C:\Windows\System\LOSdjUC.exe
  2⤵
  PID:9336
- C:\Windows\System\WLzxnNM.exe
  C:\Windows\System\WLzxnNM.exe
  2⤵
  PID:9372
- C:\Windows\System\gevtpqR.exe
  C:\Windows\System\gevtpqR.exe
  2⤵
  PID:9432
- C:\Windows\System\ZJmCLoU.exe
  C:\Windows\System\ZJmCLoU.exe
  2⤵
  PID:9468
- C:\Windows\System\hQDPHax.exe
  C:\Windows\System\hQDPHax.exe
  2⤵
  PID:9508
- C:\Windows\System\AoReHKe.exe
  C:\Windows\System\AoReHKe.exe
  2⤵
  PID:9452
- C:\Windows\System\cBQJbTo.exe
  C:\Windows\System\cBQJbTo.exe
  2⤵
  PID:9604
- C:\Windows\System\britDfi.exe
  C:\Windows\System\britDfi.exe
  2⤵
  PID:9544
- C:\Windows\System\xQOEvGc.exe
  C:\Windows\System\xQOEvGc.exe
  2⤵
  PID:9616
- C:\Windows\System\mpZYChK.exe
  C:\Windows\System\mpZYChK.exe
  2⤵
  PID:9636
- C:\Windows\System\vwHnInf.exe
  C:\Windows\System\vwHnInf.exe
  2⤵
  PID:9664
- C:\Windows\System\lmfwWfX.exe
  C:\Windows\System\lmfwWfX.exe
  2⤵
  PID:9724
- C:\Windows\System\YzYhYKt.exe
  C:\Windows\System\YzYhYKt.exe
  2⤵
  PID:9764
- C:\Windows\System\HkSRFRN.exe
  C:\Windows\System\HkSRFRN.exe
  2⤵
  PID:9784
- C:\Windows\System\xokYZvH.exe
  C:\Windows\System\xokYZvH.exe
  2⤵
  PID:9808
- C:\Windows\System\uXKhpIZ.exe
  C:\Windows\System\uXKhpIZ.exe
  2⤵
  PID:9888
- C:\Windows\System\uKqLfLE.exe
  C:\Windows\System\uKqLfLE.exe
  2⤵
  PID:9892
- C:\Windows\System\ArDXSPG.exe
  C:\Windows\System\ArDXSPG.exe
  2⤵
  PID:9956
- C:\Windows\System\uNWeHpM.exe
  C:\Windows\System\uNWeHpM.exe
  2⤵
  PID:9904
- C:\Windows\System\myPkdML.exe
  C:\Windows\System\myPkdML.exe
  2⤵
  PID:9976
- C:\Windows\System\SruYbDj.exe
  C:\Windows\System\SruYbDj.exe
  2⤵
  PID:9872
- C:\Windows\System\oflNCaR.exe
  C:\Windows\System\oflNCaR.exe
  2⤵
  PID:10008
- C:\Windows\System\ImgdOSE.exe
  C:\Windows\System\ImgdOSE.exe
  2⤵
  PID:10040
- C:\Windows\System\nnJeuuF.exe
  C:\Windows\System\nnJeuuF.exe
  2⤵
  PID:10080
- C:\Windows\System\HivHemT.exe
  C:\Windows\System\HivHemT.exe
  2⤵
  PID:10112
- C:\Windows\System\SesFEaY.exe
  C:\Windows\System\SesFEaY.exe
  2⤵
  PID:10152
- C:\Windows\System\pijKVsE.exe
  C:\Windows\System\pijKVsE.exe
  2⤵
  PID:10164
- C:\Windows\System\cFabjyq.exe
  C:\Windows\System\cFabjyq.exe
  2⤵
  PID:10188
- C:\Windows\System\LPrFTiQ.exe
  C:\Windows\System\LPrFTiQ.exe
  2⤵
  PID:5608
- C:\Windows\System\MJXxPlh.exe
  C:\Windows\System\MJXxPlh.exe
  2⤵
  PID:6508
- C:\Windows\System\xKPNjiG.exe
  C:\Windows\System\xKPNjiG.exe
  2⤵
  PID:5460
- C:\Windows\System\YSaCEDd.exe
  C:\Windows\System\YSaCEDd.exe
  2⤵
  PID:1516
- C:\Windows\System\OZuWbTH.exe
  C:\Windows\System\OZuWbTH.exe
  2⤵
  PID:1904
- C:\Windows\System\lquaMim.exe
  C:\Windows\System\lquaMim.exe
  2⤵
  PID:6068
- C:\Windows\System\KilTpFC.exe
  C:\Windows\System\KilTpFC.exe
  2⤵
  PID:9136
- C:\Windows\System\pzcCkNt.exe
  C:\Windows\System\pzcCkNt.exe
  2⤵
  PID:9284
- C:\Windows\System\nRQROeu.exe
  C:\Windows\System\nRQROeu.exe
  2⤵
  PID:9416
- C:\Windows\System\BcXlfPP.exe
  C:\Windows\System\BcXlfPP.exe
  2⤵
  PID:9320
- C:\Windows\System\UBjTYJD.exe
  C:\Windows\System\UBjTYJD.exe
  2⤵
  PID:9420
- C:\Windows\System\qXMTwuW.exe
  C:\Windows\System\qXMTwuW.exe
  2⤵
  PID:9512
- C:\Windows\System\egoRKqm.exe
  C:\Windows\System\egoRKqm.exe
  2⤵
  PID:9608
- C:\Windows\System\wEcDJzZ.exe
  C:\Windows\System\wEcDJzZ.exe
  2⤵
  PID:9660
- C:\Windows\System\dTGXcTa.exe
  C:\Windows\System\dTGXcTa.exe
  2⤵
  PID:9464
- C:\Windows\System\pthhxsW.exe
  C:\Windows\System\pthhxsW.exe
  2⤵
  PID:9524
- C:\Windows\System\oDjnxUv.exe
  C:\Windows\System\oDjnxUv.exe
  2⤵
  PID:9676
- C:\Windows\System\NsZroiS.exe
  C:\Windows\System\NsZroiS.exe
  2⤵
  PID:9744
- C:\Windows\System\qHXdcnA.exe
  C:\Windows\System\qHXdcnA.exe
  2⤵
  PID:9780
- C:\Windows\System\eBqcQGz.exe
  C:\Windows\System\eBqcQGz.exe
  2⤵
  PID:9968
- C:\Windows\System\fEezssf.exe
  C:\Windows\System\fEezssf.exe
  2⤵
  PID:9980
- C:\Windows\System\KWdMkml.exe
  C:\Windows\System\KWdMkml.exe
  2⤵
  PID:9824
- C:\Windows\System\pFOKkHQ.exe
  C:\Windows\System\pFOKkHQ.exe
  2⤵
  PID:10148
- C:\Windows\System\GboMWvM.exe
  C:\Windows\System\GboMWvM.exe
  2⤵
  PID:10172
- C:\Windows\System\uUlTneb.exe
  C:\Windows\System\uUlTneb.exe
  2⤵
  PID:9984
- C:\Windows\System\ttvGOxb.exe
  C:\Windows\System\ttvGOxb.exe
  2⤵
  PID:10056
- C:\Windows\System\vnwydbN.exe
  C:\Windows\System\vnwydbN.exe
  2⤵
  PID:10196
- C:\Windows\System\RenHume.exe
  C:\Windows\System\RenHume.exe
  2⤵
  PID:6472
- C:\Windows\System\yIfmzqw.exe
  C:\Windows\System\yIfmzqw.exe
  2⤵
  PID:9104
- C:\Windows\System\mvLIlsg.exe
  C:\Windows\System\mvLIlsg.exe
  2⤵
  PID:8456
- C:\Windows\System\oSBylou.exe
  C:\Windows\System\oSBylou.exe
  2⤵
  PID:8472
- C:\Windows\System\bZaUUrp.exe
  C:\Windows\System\bZaUUrp.exe
  2⤵
  PID:2660
- C:\Windows\System\fYqhuCw.exe
  C:\Windows\System\fYqhuCw.exe
  2⤵
  PID:1560
- C:\Windows\System\Jxtttkx.exe
  C:\Windows\System\Jxtttkx.exe
  2⤵
  PID:9576
- C:\Windows\System\ChUhdJD.exe
  C:\Windows\System\ChUhdJD.exe
  2⤵
  PID:9708
- C:\Windows\System\BiEfKqz.exe
  C:\Windows\System\BiEfKqz.exe
  2⤵
  PID:9804
- C:\Windows\System\hLEdSXh.exe
  C:\Windows\System\hLEdSXh.exe
  2⤵
  PID:9680
- C:\Windows\System\yOxsGUy.exe
  C:\Windows\System\yOxsGUy.exe
  2⤵
  PID:9856
- C:\Windows\System\VpCSauE.exe
  C:\Windows\System\VpCSauE.exe
  2⤵
  PID:9908
- C:\Windows\System\ErXwbBl.exe
  C:\Windows\System\ErXwbBl.exe
  2⤵
  PID:10116
- C:\Windows\System\RvjyYtr.exe
  C:\Windows\System\RvjyYtr.exe
  2⤵
  PID:10132
- C:\Windows\System\kpVgYHm.exe
  C:\Windows\System\kpVgYHm.exe
  2⤵
  PID:2164
- C:\Windows\System\oOcPHEC.exe
  C:\Windows\System\oOcPHEC.exe
  2⤵
  PID:8956
- C:\Windows\System\ibxyGyU.exe
  C:\Windows\System\ibxyGyU.exe
  2⤵
  PID:5064
- C:\Windows\System\gZuadUW.exe
  C:\Windows\System\gZuadUW.exe
  2⤵
  PID:1568
- C:\Windows\System\MNEWCPD.exe
  C:\Windows\System\MNEWCPD.exe
  2⤵
  PID:9504
- C:\Windows\System\XRgUrzO.exe
  C:\Windows\System\XRgUrzO.exe
  2⤵
  PID:9488
- C:\Windows\System\uuDhUAA.exe
  C:\Windows\System\uuDhUAA.exe
  2⤵
  PID:9792
- C:\Windows\System\QefWsAz.exe
  C:\Windows\System\QefWsAz.exe
  2⤵
  PID:9344
- C:\Windows\System\iYaWFvW.exe
  C:\Windows\System\iYaWFvW.exe
  2⤵
  PID:5908
- C:\Windows\System\JGKTNvD.exe
  C:\Windows\System\JGKTNvD.exe
  2⤵
  PID:9036
- C:\Windows\System\lWwAJIn.exe
  C:\Windows\System\lWwAJIn.exe
  2⤵
  PID:6444
- C:\Windows\System\hYPLhAE.exe
  C:\Windows\System\hYPLhAE.exe
  2⤵
  PID:10212
- C:\Windows\System\bdriKsR.exe
  C:\Windows\System\bdriKsR.exe
  2⤵
  PID:9316
- C:\Windows\System\zvkEXxU.exe
  C:\Windows\System\zvkEXxU.exe
  2⤵
  PID:9556
- C:\Windows\System\HTYamUa.exe
  C:\Windows\System\HTYamUa.exe
  2⤵
  PID:10060
- C:\Windows\System\SlsXHOu.exe
  C:\Windows\System\SlsXHOu.exe
  2⤵
  PID:9528
- C:\Windows\System\rEGkpMZ.exe
  C:\Windows\System\rEGkpMZ.exe
  2⤵
  PID:10072
- C:\Windows\System\frNLUDN.exe
  C:\Windows\System\frNLUDN.exe
  2⤵
  PID:9404
- C:\Windows\System\jfiAQVE.exe
  C:\Windows\System\jfiAQVE.exe
  2⤵
  PID:10244
- C:\Windows\System\QajdZbk.exe
  C:\Windows\System\QajdZbk.exe
  2⤵
  PID:10260
- C:\Windows\System\sJycXAG.exe
  C:\Windows\System\sJycXAG.exe
  2⤵
  PID:10284
- C:\Windows\System\lxuHuDT.exe
  C:\Windows\System\lxuHuDT.exe
  2⤵
  PID:10300
- C:\Windows\System\WalzoZJ.exe
  C:\Windows\System\WalzoZJ.exe
  2⤵
  PID:10320
- C:\Windows\System\sStAXlg.exe
  C:\Windows\System\sStAXlg.exe
  2⤵
  PID:10364
- C:\Windows\System\TShMVFu.exe
  C:\Windows\System\TShMVFu.exe
  2⤵
  PID:10380
- C:\Windows\System\zbUIfid.exe
  C:\Windows\System\zbUIfid.exe
  2⤵
  PID:10396
- C:\Windows\System\zbWEJyw.exe
  C:\Windows\System\zbWEJyw.exe
  2⤵
  PID:10412
- C:\Windows\System\YPkPOwr.exe
  C:\Windows\System\YPkPOwr.exe
  2⤵
  PID:10428
- C:\Windows\System\BDdVkkO.exe
  C:\Windows\System\BDdVkkO.exe
  2⤵
  PID:10444
- C:\Windows\System\eFTvSPh.exe
  C:\Windows\System\eFTvSPh.exe
  2⤵
  PID:10464
- C:\Windows\System\torbLSt.exe
  C:\Windows\System\torbLSt.exe
  2⤵
  PID:10484
- C:\Windows\System\ioPqLTM.exe
  C:\Windows\System\ioPqLTM.exe
  2⤵
  PID:10504
- C:\Windows\System\dWvORWz.exe
  C:\Windows\System\dWvORWz.exe
  2⤵
  PID:10520
- C:\Windows\System\wkjkJwi.exe
  C:\Windows\System\wkjkJwi.exe
  2⤵
  PID:10568
- C:\Windows\System\LbOXnDU.exe
  C:\Windows\System\LbOXnDU.exe
  2⤵
  PID:10588
- C:\Windows\System\nAmpAcU.exe
  C:\Windows\System\nAmpAcU.exe
  2⤵
  PID:10608
- C:\Windows\System\MIGFJGW.exe
  C:\Windows\System\MIGFJGW.exe
  2⤵
  PID:10624
- C:\Windows\System\auZqtvn.exe
  C:\Windows\System\auZqtvn.exe
  2⤵
  PID:10640
- C:\Windows\System\JyhFHXp.exe
  C:\Windows\System\JyhFHXp.exe
  2⤵
  PID:10656
- C:\Windows\System\cErtCJo.exe
  C:\Windows\System\cErtCJo.exe
  2⤵
  PID:10672
- C:\Windows\System\qIwefUe.exe
  C:\Windows\System\qIwefUe.exe
  2⤵
  PID:10688
- C:\Windows\System\nZypSLj.exe
  C:\Windows\System\nZypSLj.exe
  2⤵
  PID:10704
- C:\Windows\System\WrBAcOs.exe
  C:\Windows\System\WrBAcOs.exe
  2⤵
  PID:10724
- C:\Windows\System\prTaSUE.exe
  C:\Windows\System\prTaSUE.exe
  2⤵
  PID:10744
- C:\Windows\System\RGSEOvF.exe
  C:\Windows\System\RGSEOvF.exe
  2⤵
  PID:10760
- C:\Windows\System\dDvSDJc.exe
  C:\Windows\System\dDvSDJc.exe
  2⤵
  PID:10776
- C:\Windows\System\IzTwVTa.exe
  C:\Windows\System\IzTwVTa.exe
  2⤵
  PID:10792
- C:\Windows\System\QmDdHjj.exe
  C:\Windows\System\QmDdHjj.exe
  2⤵
  PID:10848
- C:\Windows\System\oPYBqIr.exe
  C:\Windows\System\oPYBqIr.exe
  2⤵
  PID:10864
- C:\Windows\System\GmOAzPE.exe
  C:\Windows\System\GmOAzPE.exe
  2⤵
  PID:10884
- C:\Windows\System\rePUMCR.exe
  C:\Windows\System\rePUMCR.exe
  2⤵
  PID:10904
- C:\Windows\System\UEFZQIc.exe
  C:\Windows\System\UEFZQIc.exe
  2⤵
  PID:10936
- C:\Windows\System\TTkiYEq.exe
  C:\Windows\System\TTkiYEq.exe
  2⤵
  PID:10952
- C:\Windows\System\cslonrv.exe
  C:\Windows\System\cslonrv.exe
  2⤵
  PID:10968
- C:\Windows\System\AASAGMN.exe
  C:\Windows\System\AASAGMN.exe
  2⤵
  PID:10996
- C:\Windows\System\sqRNkkT.exe
  C:\Windows\System\sqRNkkT.exe
  2⤵
  PID:11012
- C:\Windows\System\qUdyNsF.exe
  C:\Windows\System\qUdyNsF.exe
  2⤵
  PID:11028
- C:\Windows\System\pybaIJp.exe
  C:\Windows\System\pybaIJp.exe
  2⤵
  PID:11044
- C:\Windows\System\cmViJIs.exe
  C:\Windows\System\cmViJIs.exe
  2⤵
  PID:11060
- C:\Windows\System\CbWCxjJ.exe
  C:\Windows\System\CbWCxjJ.exe
  2⤵
  PID:11076
- C:\Windows\System\WupZjmV.exe
  C:\Windows\System\WupZjmV.exe
  2⤵
  PID:11092
- C:\Windows\System\fFsBNJA.exe
  C:\Windows\System\fFsBNJA.exe
  2⤵
  PID:11112
- C:\Windows\System\NEMCYPE.exe
  C:\Windows\System\NEMCYPE.exe
  2⤵
  PID:11128
- C:\Windows\System\SjVywTe.exe
  C:\Windows\System\SjVywTe.exe
  2⤵
  PID:11148
- C:\Windows\System\bdhNbxI.exe
  C:\Windows\System\bdhNbxI.exe
  2⤵
  PID:11164
- C:\Windows\System\wuJIZJj.exe
  C:\Windows\System\wuJIZJj.exe
  2⤵
  PID:11184
- C:\Windows\System\yMyRxEO.exe
  C:\Windows\System\yMyRxEO.exe
  2⤵
  PID:11200
- C:\Windows\System\ipyjFPC.exe
  C:\Windows\System\ipyjFPC.exe
  2⤵
  PID:11216
- C:\Windows\System\HpKLxcI.exe
  C:\Windows\System\HpKLxcI.exe
  2⤵
  PID:11232
- C:\Windows\System\huMwSqd.exe
  C:\Windows\System\huMwSqd.exe
  2⤵
  PID:11248
- C:\Windows\System\BwENehT.exe
  C:\Windows\System\BwENehT.exe
  2⤵
  PID:10256
- C:\Windows\System\dSxZrBO.exe
  C:\Windows\System\dSxZrBO.exe
  2⤵
  PID:10296
- C:\Windows\System\QjiDOyF.exe
  C:\Windows\System\QjiDOyF.exe
  2⤵
  PID:10276
- C:\Windows\System\ADTFFQW.exe
  C:\Windows\System\ADTFFQW.exe
  2⤵
  PID:10316
- C:\Windows\System\eiNQPnC.exe
  C:\Windows\System\eiNQPnC.exe
  2⤵
  PID:10348
- C:\Windows\System\vtQqPKS.exe
  C:\Windows\System\vtQqPKS.exe
  2⤵
  PID:10376
- C:\Windows\System\bvgqZtP.exe
  C:\Windows\System\bvgqZtP.exe
  2⤵
  PID:10424
- C:\Windows\System\SePzqnx.exe
  C:\Windows\System\SePzqnx.exe
  2⤵
  PID:10460
- C:\Windows\System\GCaMfEv.exe
  C:\Windows\System\GCaMfEv.exe
  2⤵
  PID:10472
- C:\Windows\System\MAVMSEN.exe
  C:\Windows\System\MAVMSEN.exe
  2⤵
  PID:10500
- C:\Windows\System\tfnTFyy.exe
  C:\Windows\System\tfnTFyy.exe
  2⤵
  PID:10516
- C:\Windows\System\qPvFThB.exe
  C:\Windows\System\qPvFThB.exe
  2⤵
  PID:10544
- C:\Windows\System\vXKfJWf.exe
  C:\Windows\System\vXKfJWf.exe
  2⤵
  PID:10584
- C:\Windows\System\kxUbpRL.exe
  C:\Windows\System\kxUbpRL.exe
  2⤵
  PID:10620
- C:\Windows\System\rBGlMso.exe
  C:\Windows\System\rBGlMso.exe
  2⤵
  PID:10712
- C:\Windows\System\NswSqJi.exe
  C:\Windows\System\NswSqJi.exe
  2⤵
  PID:10736
- C:\Windows\System\GCBaWRe.exe
  C:\Windows\System\GCBaWRe.exe
  2⤵
  PID:10680
- C:\Windows\System\juSYWiZ.exe
  C:\Windows\System\juSYWiZ.exe
  2⤵
  PID:10772
- C:\Windows\System\RpArZtO.exe
  C:\Windows\System\RpArZtO.exe
  2⤵
  PID:10784
- C:\Windows\System\gSdCwmG.exe
  C:\Windows\System\gSdCwmG.exe
  2⤵
  PID:10812
- C:\Windows\System\vFEsFwf.exe
  C:\Windows\System\vFEsFwf.exe
  2⤵
  PID:10836
- C:\Windows\System\QvOviTI.exe
  C:\Windows\System\QvOviTI.exe
  2⤵
  PID:10856
- C:\Windows\System\GdKnflS.exe
  C:\Windows\System\GdKnflS.exe
  2⤵
  PID:10892
- C:\Windows\System\GxTZBko.exe
  C:\Windows\System\GxTZBko.exe
  2⤵
  PID:10916
- C:\Windows\System\wYOOvgG.exe
  C:\Windows\System\wYOOvgG.exe
  2⤵
  PID:10960
- C:\Windows\System\tIQdbiL.exe
  C:\Windows\System\tIQdbiL.exe
  2⤵
  PID:11068
- C:\Windows\System\MjnskWu.exe
  C:\Windows\System\MjnskWu.exe
  2⤵
  PID:10988
- C:\Windows\System\vxENrQk.exe
  C:\Windows\System\vxENrQk.exe
  2⤵
  PID:11172
- C:\Windows\System\ihGkSqn.exe
  C:\Windows\System\ihGkSqn.exe
  2⤵
  PID:11212
- C:\Windows\System\fsBsSnP.exe
  C:\Windows\System\fsBsSnP.exe
  2⤵
  PID:10136
- C:\Windows\System\qJDoTkT.exe
  C:\Windows\System\qJDoTkT.exe
  2⤵
  PID:10992
- C:\Windows\System\kaGallg.exe
  C:\Windows\System\kaGallg.exe
  2⤵
  PID:11020
- C:\Windows\System\AyGJWjZ.exe
  C:\Windows\System\AyGJWjZ.exe
  2⤵
  PID:11136
- C:\Windows\System\KyllnVd.exe
  C:\Windows\System\KyllnVd.exe
  2⤵
  PID:11160
- C:\Windows\System\WlOxGPQ.exe
  C:\Windows\System\WlOxGPQ.exe
  2⤵
  PID:10180
- C:\Windows\System\ARZuagE.exe
  C:\Windows\System\ARZuagE.exe
  2⤵
  PID:10192
- C:\Windows\System\HxvdgIt.exe
  C:\Windows\System\HxvdgIt.exe
  2⤵
  PID:8740
- C:\Windows\System\uWgdpwX.exe
  C:\Windows\System\uWgdpwX.exe
  2⤵
  PID:10356
- C:\Windows\System\VyRJHuC.exe
  C:\Windows\System\VyRJHuC.exe
  2⤵
  PID:10404
- C:\Windows\System\OPFgKVZ.exe
  C:\Windows\System\OPFgKVZ.exe
  2⤵
  PID:10552
- C:\Windows\System\tSTkhwK.exe
  C:\Windows\System\tSTkhwK.exe
  2⤵
  PID:10340
- C:\Windows\System\sJjcBiW.exe
  C:\Windows\System\sJjcBiW.exe
  2⤵
  PID:10408
- C:\Windows\System\FAJzGFx.exe
  C:\Windows\System\FAJzGFx.exe
  2⤵
  PID:10636
- C:\Windows\System\bzclffJ.exe
  C:\Windows\System\bzclffJ.exe
  2⤵
  PID:10532
- C:\Windows\System\aWySFtR.exe
  C:\Windows\System\aWySFtR.exe
  2⤵
  PID:10768
- C:\Windows\System\ayQpryB.exe
  C:\Windows\System\ayQpryB.exe
  2⤵
  PID:10732
- C:\Windows\System\RXktpVw.exe
  C:\Windows\System\RXktpVw.exe
  2⤵
  PID:10820
- C:\Windows\System\VKjrhIZ.exe
  C:\Windows\System\VKjrhIZ.exe
  2⤵
  PID:10824
- C:\Windows\System\MhdnoSz.exe
  C:\Windows\System\MhdnoSz.exe
  2⤵
  PID:10844
- C:\Windows\System\XETysNm.exe
  C:\Windows\System\XETysNm.exe
  2⤵
  PID:10920
- C:\Windows\System\KvtjrwA.exe
  C:\Windows\System\KvtjrwA.exe
  2⤵
  PID:11036
- C:\Windows\System\cNumDNs.exe
  C:\Windows\System\cNumDNs.exe
  2⤵
  PID:11140
- C:\Windows\System\kmgvSBB.exe
  C:\Windows\System\kmgvSBB.exe
  2⤵
  PID:11244
- C:\Windows\System\OpASaAw.exe
  C:\Windows\System\OpASaAw.exe
  2⤵
  PID:10980
- C:\Windows\System\MeonfKr.exe
  C:\Windows\System\MeonfKr.exe
  2⤵
  PID:11124
- C:\Windows\System\PZzaYPj.exe
  C:\Windows\System\PZzaYPj.exe
  2⤵
  PID:11228
- C:\Windows\System\KAhYDdN.exe
  C:\Windows\System\KAhYDdN.exe
  2⤵
  PID:11084
- C:\Windows\System\MrZALAY.exe
  C:\Windows\System\MrZALAY.exe
  2⤵
  PID:10328
- C:\Windows\System\CQZHKHb.exe
  C:\Windows\System\CQZHKHb.exe
  2⤵
  PID:10372
- C:\Windows\System\KFdYsfd.exe
  C:\Windows\System\KFdYsfd.exe
  2⤵
  PID:10272
- C:\Windows\System\XNRRGgZ.exe
  C:\Windows\System\XNRRGgZ.exe
  2⤵
  PID:10420
- C:\Windows\System\kMDImyB.exe
  C:\Windows\System\kMDImyB.exe
  2⤵
  PID:10632
- C:\Windows\System\PXmBbLi.exe
  C:\Windows\System\PXmBbLi.exe
  2⤵
  PID:10648
- C:\Windows\System\nUGdjwk.exe
  C:\Windows\System\nUGdjwk.exe
  2⤵
  PID:10696
- C:\Windows\System\opIlGfV.exe
  C:\Windows\System\opIlGfV.exe
  2⤵
  PID:10720
- C:\Windows\System\TCgOeYc.exe
  C:\Windows\System\TCgOeYc.exe
  2⤵
  PID:11180
- C:\Windows\System\GovjclG.exe
  C:\Windows\System\GovjclG.exe
  2⤵
  PID:10832
- C:\Windows\System\SngsfRy.exe
  C:\Windows\System\SngsfRy.exe
  2⤵
  PID:11056
- C:\Windows\System\Eavvgsp.exe
  C:\Windows\System\Eavvgsp.exe
  2⤵
  PID:9728
- C:\Windows\System\sdxNzRa.exe
  C:\Windows\System\sdxNzRa.exe
  2⤵
  PID:10496
- C:\Windows\System\ItgIbUO.exe
  C:\Windows\System\ItgIbUO.exe
  2⤵
  PID:11104
- C:\Windows\System\GtpsDBl.exe
  C:\Windows\System\GtpsDBl.exe
  2⤵
  PID:10548
- C:\Windows\System\kQXqOKH.exe
  C:\Windows\System\kQXqOKH.exe
  2⤵
  PID:10308
- C:\Windows\System\WjMKIEF.exe
  C:\Windows\System\WjMKIEF.exe
  2⤵
  PID:10600
- C:\Windows\System\OdkByNJ.exe
  C:\Windows\System\OdkByNJ.exe
  2⤵
  PID:11004
- C:\Windows\System\TpcinHH.exe
  C:\Windows\System\TpcinHH.exe
  2⤵
  PID:10752
- C:\Windows\System\dkXgmmi.exe
  C:\Windows\System\dkXgmmi.exe
  2⤵
  PID:10876
- C:\Windows\System\XmoMiEf.exe
  C:\Windows\System\XmoMiEf.exe
  2⤵
  PID:10392
- C:\Windows\System\cVVrlDq.exe
  C:\Windows\System\cVVrlDq.exe
  2⤵
  PID:10788
- C:\Windows\System\cJXuhli.exe
  C:\Windows\System\cJXuhli.exe
  2⤵
  PID:11280
- C:\Windows\System\OdotdZp.exe
  C:\Windows\System\OdotdZp.exe
  2⤵
  PID:11300
- C:\Windows\System\qzFawKe.exe
  C:\Windows\System\qzFawKe.exe
  2⤵
  PID:11328
- C:\Windows\System\nmqxFlM.exe
  C:\Windows\System\nmqxFlM.exe
  2⤵
  PID:11344
- C:\Windows\System\kBToGah.exe
  C:\Windows\System\kBToGah.exe
  2⤵
  PID:11360
- C:\Windows\System\cIQRcMy.exe
  C:\Windows\System\cIQRcMy.exe
  2⤵
  PID:11376
- C:\Windows\System\EbQLQKc.exe
  C:\Windows\System\EbQLQKc.exe
  2⤵
  PID:11392
- C:\Windows\System\ckmiZVT.exe
  C:\Windows\System\ckmiZVT.exe
  2⤵
  PID:11412
- C:\Windows\System\IqKsMzw.exe
  C:\Windows\System\IqKsMzw.exe
  2⤵
  PID:11432
- C:\Windows\System\eLleIWK.exe
  C:\Windows\System\eLleIWK.exe
  2⤵
  PID:11448
- C:\Windows\System\CowWlop.exe
  C:\Windows\System\CowWlop.exe
  2⤵
  PID:11464
- C:\Windows\System\iTfdYvv.exe
  C:\Windows\System\iTfdYvv.exe
  2⤵
  PID:11480
- C:\Windows\System\tVlNfQX.exe
  C:\Windows\System\tVlNfQX.exe
  2⤵
  PID:11500
- C:\Windows\System\uOIQnHt.exe
  C:\Windows\System\uOIQnHt.exe
  2⤵
  PID:11516
- C:\Windows\System\BCHLCPY.exe
  C:\Windows\System\BCHLCPY.exe
  2⤵
  PID:11544
- C:\Windows\System\kGCtlFI.exe
  C:\Windows\System\kGCtlFI.exe
  2⤵
  PID:11560

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

GDcUyZM.exe

Path C:\Windows\system\GDcUyZM.exe
Size 2.8MB
SHA256 255e076dfd3c2d17bb27b625447679c4fdb121506ed51e1350168714aab2f7d0
MD5 a5a619b05206fce31e754c8768300e35
SHA1 de51f7dd37fd3b3c1c8c601a0822b96ff9d129f0
SHA512 fa7ac6573bda562f771c89ab05fcd0eb13851cbc453f209db2eae30ed447975b06e92881ab35b72f862bc353cbcdbe0e5bb36246be8d8e3e278bcf98185be675
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0IEFToChvL0:71ONtyBeSFkXV1etEKLlWUTOfeiRA2Rr
MD5 SHA1 SHA512 SSDEEP

Submit Download

JXUwoSL.exe

Path C:\Windows\system\JXUwoSL.exe
Size 2.8MB
SHA256 1bade15ade6b1fa4467d338a378a4b2a58674275eb253e3b03814a2eab3783f9
MD5 e341a7ff2ab4183725795a368fc43a61
SHA1 8e51522d5d289f8c8e6db2036ad2e59951bde4a2
SHA512 feec1a2fd1e60d6c420a803f02fd26f3057f42e10e819192a6c3c978e5e0f84b819ce7d820a82a0bfd3886cfdeaf250f71047e2b303455b2ff932815c19dfec5
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0IEFToChvLC:71ONtyBeSFkXV1etEKLlWUTOfeiRA2Rp
MD5 SHA1 SHA512 SSDEEP

Submit Download

LYjYRyv.exe

Path C:\Windows\system\LYjYRyv.exe
Size 2.8MB
SHA256 4f9b789e473fca76a744aaac4392d03f6fc4a91ff592d61bae8015af73f0ef8d
MD5 2a99fe50e47fd943033e997d3723a0bc
SHA1 31afe9697d36cefea1c406897b863e07b03dc1e9
SHA512 d12505e7a48e5f75a9bc408085bd32d70cdac7aa96ecbf307c161d3d982f7a2ea943255cc79517f9478d8a05b37f593e5badcc663be5ddade10495c3697e59f7
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0IEFToChvLj:71ONtyBeSFkXV1etEKLlWUTOfeiRA2RS
MD5 SHA1 SHA512 SSDEEP

Submit Download

SdoQxIq.exe

Path C:\Windows\system\SdoQxIq.exe
Size 2.8MB
SHA256 92eb9c403273ed3fd83d9c7c41aa345d30fce7e661462a8ee949b4d065d4a727
MD5 06233508819458ee1c75920e6762c4d5
SHA1 39c446cbbe516d042a1eda6ca407dcc293b4ddd5
SHA512 d1c500f5d7e9370d3510f9464e9c7590e2de56dda6fc1cf107961237cf2fb9fac04c2fb528deda9a12b7375a4f977765ffac445fb475851a5a0a73474e9c08ab
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0IEFToChvLi:71ONtyBeSFkXV1etEKLlWUTOfeiRA2Rt
MD5 SHA1 SHA512 SSDEEP

Submit Download

SrJdirp.exe

Path C:\Windows\system\SrJdirp.exe
Size 2.8MB
SHA256 d896cde3636410e10dde22740ee841a53cdf983cd1e29d49d5c4d11f59707ff3
MD5 da1f995d60e0f0a4386f998ef599f4c3
SHA1 9e818e951a1f0a2e74a650b32115d3d331ba6ff1
SHA512 448c1b71526ddece541fa403f43038a1cfaa141963781d0c3777ca419fd573e400af9052cb3d4c5fe4e8fcca0405787213da7b233228d029db0e6550160826db
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0IEFToChvLP:71ONtyBeSFkXV1etEKLlWUTOfeiRA2Rw
MD5 SHA1 SHA512 SSDEEP

Submit Download

UHqxUoE.exe

Path C:\Windows\system\UHqxUoE.exe
Size 2.8MB
SHA256 cdaab66c610fbab571dfac363e8cdad614690a6a34bbde0bd6fe5375ecb5fb47
MD5 4359fae756c2efc06910a6cce6fcc11d
SHA1 ce5dedad5f559b2dbe909f6ef59e426039f85373
SHA512 9340ba856a3486f497729662ae5d17c3cd2dbf6612d66fc1523e01df8f937b0007fb07cfd432ee4ffbd311a267e25f173a0ccb7b43b3afc587c8a4a2f2f1332f
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0IEFToChvLn:71ONtyBeSFkXV1etEKLlWUTOfeiRA2Rs
MD5 SHA1 SHA512 SSDEEP

Submit Download

WYruXVA.exe

Path C:\Windows\system\WYruXVA.exe
Size 2.8MB
SHA256 02ad22531cc7fbc3bee00ef1fb9219349ddd5cd55177a07e9d31924c4bd53a79
MD5 b835ae1e765feb4cb708a669b625808c
SHA1 df1d4b928b8fb4fe38a5140ac9e94f7f8c71717a
SHA512 4317c5cbf06a8b978a9616b7f2885749ee8a75546349f437c77cf5a5fe06132d52c04e72947527a0c4e7b076e15c4a0ced17f5cc70bec09b0589f1af3b27efca
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0IEFToChvLY:71ONtyBeSFkXV1etEKLlWUTOfeiRA2Rf
MD5 SHA1 SHA512 SSDEEP

Submit Download

XiUALPN.exe

Path C:\Windows\system\XiUALPN.exe
Size 2.8MB
SHA256 cfdaecbd5009cd46bd44cb44268c6ef254a5af8b07ef51bce2de653e5415e59b
MD5 b25d2fcd7de6ed24afd1cdf684d8d62f
SHA1 8168ea5558ae0db53540dcd64909f7537b37171d
SHA512 7440dc01ee1f8ed3246d1e3ecaa1ce5ca5b4712352b65ebc028612f25a0f252f7f4ac6e518267e0634c102e6d9acdef6639e0c0b6186ba02e74fb3d05216bba2
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0IEFToChvLm:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R/
MD5 SHA1 SHA512 SSDEEP

Submit Download

YpZJIBh.exe

Path C:\Windows\system\YpZJIBh.exe
Size 2.8MB
SHA256 a0e0a764b962dded9bea4bed276201e8247837a753084b134422aa944dd6a792
MD5 2ff573352be0091d75598f75c24fd491
SHA1 fc08909c3fa44c74b714ff866c351a9eea1a170c
SHA512 bb1b6e10bb746909bfc114c7e7aae653fbec417b15a728ce244a739bae413936dc822b02c755da986a9865fb0726613428d2383a01b5dcef68495d5fd138d26d
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0IEFToChvLF:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R6
MD5 SHA1 SHA512 SSDEEP

Submit Download

bcshbnE.exe

Path C:\Windows\system\bcshbnE.exe
Size 2.8MB
SHA256 6e23c963db9692f681c933005307354563295c626acb9d1facaf7b60febfe443
MD5 5e0e72352caa068bc5926c6474a50d62
SHA1 62d1d36270be32c0141356d0df85f2fc48bd2e02
SHA512 16f0e89f2027a626ec170c55fafb688b35f392dd6680333279c5b918318f8855bd65357a49f8aa7e71570bb657895504010b289a318a7adaf018e610d15d83bf
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0IEFToChvLi:71ONtyBeSFkXV1etEKLlWUTOfeiRA2RL
MD5 SHA1 SHA512 SSDEEP

Submit Download

dJFXqQm.exe

Path C:\Windows\system\dJFXqQm.exe
Size 2.8MB
SHA256 3fd8a608bdc49b6b2dc8cd2528006009e0c49fdbce339ea8b82d458875fd8613
MD5 eec93dee7e4c4421c4022cf5adbe05ee
SHA1 496d3fcfafc2276efabdb838777881b1a4b4b8db
SHA512 5729b34ee37a0220f65363db98c161668bbf802699b23a15762142686c45fb5c0d15bf88f5a209e5625ac29e6b082c1cafc6612e75091b91e9ce6f26a412c5c9
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0IEFToChvL5:71ONtyBeSFkXV1etEKLlWUTOfeiRA2Ru
MD5 SHA1 SHA512 SSDEEP

Submit Download

egISzCx.exe

Path C:\Windows\system\egISzCx.exe
Size 2.8MB
SHA256 d38f8992dc7f77a1fe8db68f2f47cc3c06a40a2d69c042e4b50ada090e42a2ff
MD5 0faf344e79cecae86bdfab4773a57661
SHA1 59bab60a9c663178fcd1e86a69849fee693b2194
SHA512 4ce241346621fa346924063b97067215b5c3b40bb81e3a0c4d00de96e9dbcc3728f39f06abf700e4991b5991d86c5e32ec6f33350c31822913f1b25c95ffde3f
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0IEFToChvL8:71ONtyBeSFkXV1etEKLlWUTOfeiRA2Rz
MD5 SHA1 SHA512 SSDEEP

Submit Download

gTYtkue.exe

Path C:\Windows\system\gTYtkue.exe
Size 2.8MB
SHA256 ed62b8f8761e64d89259ecc149270cff65e1773974287b4b5576fdeb44bd5c3a
MD5 166c9e1dc59153a3a00e30ec120e30c6
SHA1 82c809de28330cec46aab63e141c908d4ae2941f
SHA512 d0cc685e5582d8c69c3100a7fdb75c7924b025c78f20ff9236b33fc30e5318b3308ddbb4445d12129f91210d30a2a1a6ad509960d8abb7803b70f6db23598e35
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0IEFToChvLK:71ONtyBeSFkXV1etEKLlWUTOfeiRA2Rd
MD5 SHA1 SHA512 SSDEEP

Submit Download

gYrfJUL.exe

Path C:\Windows\system\gYrfJUL.exe
Size 2.8MB
SHA256 7b35500f934a145e78a5bff52e435f7a65097123bd08c23f2ab51fe9a3fa3adf
MD5 7374f4604e6126c8929702f8b8a71070
SHA1 8f9d5b6e8539f320a138526a4ec6dacb864bf7cb
SHA512 8d02cf8ea67c684e164171b006fc816787e56c3edc673bafe5ab6a85c66304b3a10bf19ea68bde80c66ffb91382bb91356227585dd886f096b4ba1183bc7d4a6
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0IEFToChvLk:71ONtyBeSFkXV1etEKLlWUTOfeiRA2RT
MD5 SHA1 SHA512 SSDEEP

Submit Download

hRBxKPw.exe

Path C:\Windows\system\hRBxKPw.exe
Size 2.8MB
SHA256 5d6ea2957fc55d99d9605f04ef913a8e4c4236bd7668976e7bde09cf616e433d
MD5 c5576e834fe2f313fb6944557390bcaf
SHA1 5b820325df1b72f3875a125e3a3da3a3eca98351
SHA512 bb05c0992df7a7102e4f902b5254c2cfe61f85c3f2255124304e09c7e8df8cda39071cefc0d3b8e8fed78f2d8625dabf2d2d5de79ad9034340bcb2ebd0623b7e
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0IEFToChvLH:71ONtyBeSFkXV1etEKLlWUTOfeiRA2RW
MD5 SHA1 SHA512 SSDEEP

Submit Download

iPeUvIK.exe

Path C:\Windows\system\iPeUvIK.exe
Size 2.8MB
SHA256 84d55dff2ca9c362425c294bbc8dbf23e238997ed72f5b61553f16be50f869e0
MD5 2822dc0ad0b9848e1e4c3c6951f1ecc6
SHA1 327550734631b0db069d0b58ad12383d48d8d99b
SHA512 b1f3987065c97f2fb21d8387cb8f5904f10e2a7d2bf5c88a1711a10f4989145addd9031aedb1ab74f18c3720257e5eb859d1e2d59f7f2fb83b8b2b450aca3fd4
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0IEFToChvLl:71ONtyBeSFkXV1etEKLlWUTOfeiRA2RI
MD5 SHA1 SHA512 SSDEEP

Submit Download

jdRIIuY.exe

Path C:\Windows\system\jdRIIuY.exe
Size 2.8MB
SHA256 dbfc5a6aa1de2a25484f3c7f191273b0dbe13cbf10dedaf0867aac70a9cb5b70
MD5 0ed86b74d18357192d97230b7a5cf230
SHA1 4f303e895f88e1dedb1a96f28665229cbf36263d
SHA512 60847c77b91fb79c8e53697890a343ec7ef7f1b813c60a5253d16b0f05229bfb141f6e757d1f3f600e0f6cd7add3675a1b4c5c67307310445959d3a8b929f59a
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0IEFToChvLP:71ONtyBeSFkXV1etEKLlWUTOfeiRA2RI
MD5 SHA1 SHA512 SSDEEP

Submit Download

koEBYub.exe

Path C:\Windows\system\koEBYub.exe
Size 2.8MB
SHA256 35991049c83d027d3d32bbb93b9fb9165b9f28a509841af8c32e27af8c2387cf
MD5 4a431d877ec05bf533e523d623121349
SHA1 6ac080efb8b471e24f4f43382b1a6e3f0b8f3953
SHA512 34b1f010f9e780eef7794769dd9415cc0bfde29d6959c8cc6d2a851705ef7658a049406a20a0889ba5186998d9d94d21f5ccc73578b8d8f2bf3aba8e49f49e4b
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0IEFToChvLf:71ONtyBeSFkXV1etEKLlWUTOfeiRA2RE
MD5 SHA1 SHA512 SSDEEP

Submit Download

lflwdVO.exe

Path C:\Windows\system\lflwdVO.exe
Size 2.8MB
SHA256 ffee16d0f3aa1bf526d0ab1a0de88d38bba334eb13f6673acc8786428f414701
MD5 e457b57a8689111fa5aef1419fd536c1
SHA1 cf8033695f738544b6c978537057758df1eb39a1
SHA512 221c83342f3527baf4b6fb48a5f93ef20948f3af9e528b5abb30ad873b0a9ebe34cd206c134ca9f267380c5c786d8ccb9055a447b1e1decf5da044543e125768
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0IEFToChvLc:71ONtyBeSFkXV1etEKLlWUTOfeiRA2RX
MD5 SHA1 SHA512 SSDEEP

Submit Download

pNYISDE.exe

Path C:\Windows\system\pNYISDE.exe
Size 2.8MB
SHA256 efc27cc7ebd6626f0d9d5d7f72c15c6e6153002e1cb57901a35e7bebf9e2ca76
MD5 07e5ec8b7d61fbdf380403dc40d61884
SHA1 152d89b256f150ed96c55e114e3344041356cdc7
SHA512 8068733262e2842aecb8824d87702fc02e555cbb43df7acac83c5ff3f3af2b97ae97c746f6565ef18427ce5294e05e70c6e261b5def3859e9013d9cc34560ce9
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0IEFToChvL3:71ONtyBeSFkXV1etEKLlWUTOfeiRA2RE
MD5 SHA1 SHA512 SSDEEP

Submit Download

rRCWajl.exe

Path C:\Windows\system\rRCWajl.exe
Size 2.8MB
SHA256 64052d63aabd27205e36d3494ae69f1aa85163e7ad79405efe2ef9e3c6c95ac9
MD5 d838ef7b6d24f320b3146923e31cc0b5
SHA1 746b797face6250cb25042a8300ae160325933c0
SHA512 03e5c9b7036d59c93961e21644b61f4133dcf67f9935384b60b186f7c69cc981ffeb527273944e2ecf13ec09d0ee11db9f8958947c5b9a2bc833e436285c9e83
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0IEFToChvLz:71ONtyBeSFkXV1etEKLlWUTOfeiRA2RU
MD5 SHA1 SHA512 SSDEEP

Submit Download

yhIMopQ.exe

Path C:\Windows\system\yhIMopQ.exe
Size 2.8MB
SHA256 8583fd470a3267e57b2e5e483ad82e8741bf857cad10a97f20eadbca9da01f91
MD5 ee3c631d14fe73ea151bc8fece22da52
SHA1 82dadeacfdc102472d4b849cd7adbd662df7a56a
SHA512 aac9f20b0b8f5b5ad0efffe684290e3b59b421e95bb4d8d9c1cdd5cde1593ef917b37dc9df9a49ae06f7388c4d681aa08d8ce0d48f9755303c6ad1afc16fe035
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0IEFToChvLL:71ONtyBeSFkXV1etEKLlWUTOfeiRA2Rs
MD5 SHA1 SHA512 SSDEEP

Submit Download

AMIQefE.exe

Path \Windows\system\AMIQefE.exe
Size 2.8MB
SHA256 4d60722dd56352ad6106b3da7803f457c910ad0c2561b1a2200ec6682ae5f224
MD5 4e64d540bb3225616bd97edb37e3fdc1
SHA1 0d400a83c170f3351c2419bcd09b566c121ac28f
SHA512 b9a3f42697d5e983a70e45fea8bed5a86a0eeec4320163be1c57ee69b9152e94c84f2b8dfd78f47f53f9736083a913f2d84c47b5d4a0eb0ba5825b0bfad30f45
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0IEFToChvLv:71ONtyBeSFkXV1etEKLlWUTOfeiRA2Ry
MD5 SHA1 SHA512 SSDEEP

Submit Download

EaDGtdH.exe

Path \Windows\system\EaDGtdH.exe
Size 2.8MB
SHA256 235d714bf695a1a7b7affbb7734f62d35e4ccb54338db1b8871b5e62d0379057
MD5 565f21a2e4521fa4baf386028acd4d0e
SHA1 857f60fca0ffa8f0e44570e6f3b184dfab5fb004
SHA512 78ea26f19b6c856115a39c202f668d51ce9b1f44755d5270cbb15f65ec77be4104869f8fffb717617121c224648b99d1fb7abf41edcf6919eca73fc3f0481bdd
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0IEFToChvL8:71ONtyBeSFkXV1etEKLlWUTOfeiRA2RF
MD5 SHA1 SHA512 SSDEEP

Submit Download

GyufLux.exe

Path \Windows\system\GyufLux.exe
Size 2.8MB
SHA256 97cd5733da1ae14b05df057ff9fcf70a468253a14a50f1020142c222976c14b2
MD5 d9a43398546dd916d6c4bd8e7886e1ed
SHA1 dea1d5273227a6840119088736c648a87690a007
SHA512 a370db48a688bbdd9bcee00695d0b0c4a385a88fffff3a58b4a1a8d93a23fa8281830138f5bd3778e2167a7bcc1381d93ce5f526cce04810afd3d9cedeea7c39
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0IEFToChvL+:71ONtyBeSFkXV1etEKLlWUTOfeiRA2RT
MD5 SHA1 SHA512 SSDEEP

Submit Download

IRrMTQr.exe

Path \Windows\system\IRrMTQr.exe
Size 2.8MB
SHA256 616323ced36d434a3eb3e2f4b937fd6a10219d19065eba4f65d705ec3e6d4790
MD5 6e5b442d5fce5ca4fbac8a7a81676ac5
SHA1 976351f63d522d6a4d84f724a15f446c6846cfd6
SHA512 2a61fd51ad0a7fbac867f13737c518169842f3176a9fa001a969dc3673408dc707edcba9776ed38b956a29517bf0177756e052b42f49be2cb06eb0fe935e7f64
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0IEFToChvLZ:71ONtyBeSFkXV1etEKLlWUTOfeiRA2Rk
MD5 SHA1 SHA512 SSDEEP

Submit Download

QbPpTca.exe

Path \Windows\system\QbPpTca.exe
Size 2.8MB
SHA256 f5b6d19546c142f7c203411e083ead9d59e44816378f747498e52d6a73eae15a
MD5 6b0a5b23f0d2a1961652bdde33797e3a
SHA1 89cc779e451f73b41d4bb941568afa79bd242051
SHA512 d4eaf006378f78f818f97a39fb8f6d2b8d6ba198aa3fc72d802a97eee438e294b17c88550fe50d0fcf9ee0dc7b3bbec2f1001e1a6bd9e3d37180910528399b9a
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0IEFToChvLv:71ONtyBeSFkXV1etEKLlWUTOfeiRA2RS
MD5 SHA1 SHA512 SSDEEP

Submit Download

YHpGMat.exe

Path \Windows\system\YHpGMat.exe
Size 2.8MB
SHA256 07a35dc9ac235b8fbf7702799b4508c795925d4708f3ebbd47490f57440e2a51
MD5 b685c9e57a1fe1653a341dd1a906edd0
SHA1 5c03315c2139643564e07dd3a46403c69b9119f9
SHA512 238c536aa0476c83bef71f2502adf369aaafe89c2e4a9df483ed2a507a2bb9ba29ed6d193ccfa9f7766f660db1ba236f0455cc0b8a48387389d3d43c46b6cf09
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0IEFToChvLg:71ONtyBeSFkXV1etEKLlWUTOfeiRA2RF
MD5 SHA1 SHA512 SSDEEP

Submit Download

bUXXUGO.exe

Path \Windows\system\bUXXUGO.exe
Size 2.8MB
SHA256 a39e0f107685f0aaeeffa953e0685d04d21e60296682246923b71d5134b3b2e1
MD5 53149bba24a5b64f72240846691c5c2c
SHA1 53188a5ce7d5d3e253bbfeb1472c908378750278
SHA512 a9673694c026de0a06dfd6d0a9208a692af25c19d065ae2c21da65d9d974dcfc2cb1fea142db4aab6c96ead29e07f70e2da7f39ae525b611ecb83b3047e1409a
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0IEFToChvLb:71ONtyBeSFkXV1etEKLlWUTOfeiRA2Ru
MD5 SHA1 SHA512 SSDEEP

Submit Download

bixECTZ.exe

Path \Windows\system\bixECTZ.exe
Size 2.8MB
SHA256 5290dcc9cfd88118f998a9853cb3c7aef4d16ca87b6e824eade7e12c76c7af89
MD5 cd2d147d21ccbe6fec3ec25b8d28a20e
SHA1 fd4d6001427f0b7c0b550be00f6dc5156d659806
SHA512 f2c3655c1399b6b3e1f9de7bfaa2f6932011d65169831639cb877a3e02ba85ce7bbe196548d8192f5ca56736aaa300ad86bc428e958093f9049511f75d41a2a0
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0IEFToChvLV:71ONtyBeSFkXV1etEKLlWUTOfeiRA2RQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

cSXwRAI.exe

Path \Windows\system\cSXwRAI.exe
Size 2.8MB
SHA256 722e77be15d1c7262c1451dfbee29d92267607e49f1b17e457cbf58f4746c710
MD5 66205085652160e0da18afa914c6d0c7
SHA1 39551aac5054852b7751403a3e872959bb5d1e14
SHA512 42f2d04434e9ac2f76898107cd883c1103c5ab5a393285931c2529939ef21ca81daa599439527a00e4c04190f9352f24f20f65ded131fa69774d0a6da9f035b9
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0IEFToChvLF:71ONtyBeSFkXV1etEKLlWUTOfeiRA2Rs
MD5 SHA1 SHA512 SSDEEP

Submit Download

gUERjTf.exe

Path \Windows\system\gUERjTf.exe
Size 2.8MB
SHA256 a09dbddab66b302dcdccd3b7ecfb944c197f37319eb264187c631004320bca1e
MD5 e3e152bd3814592bc6e0702655185d70
SHA1 ba363a86274498d9c8466a1198dcf887fe4b71db
SHA512 968d503f3fb025e622a9c7ea527ad619151a5fce5657ed05691a7fd33cc72c5baaa1897779567fb811f6facee0bd428452180405e4cd88ced35b4c2be5d80f0c
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0IEFToChvLt:71ONtyBeSFkXV1etEKLlWUTOfeiRA2Ru
MD5 SHA1 SHA512 SSDEEP

Submit Download

jjxlgnx.exe

Path \Windows\system\jjxlgnx.exe
Size 2.8MB
SHA256 257d14c60e3cd98ed768de158a3962558fb48f17b091e62718e3e8f88b96add1
MD5 7d9fd6efaeb28251cff75b39fc964383
SHA1 3de95b57d15765cb2e24a838def7864adceaeaf3
SHA512 90dcf62245583954b1fae1a6b73f4736b0d8d510d21c00024919e79306e6af4d6fc9f0b7dced1c3ac121a0fcaa1b2c133ccabbbd316bcb466364710708e4457a
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0IEFToChvLU:71ONtyBeSFkXV1etEKLlWUTOfeiRA2RJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

mssrZSE.exe

Path \Windows\system\mssrZSE.exe
Size 2.8MB
SHA256 dd28f1304b3122e44d019b709e4db641a80970302023276cc11bdacb5b7f8367
MD5 184e90eaa5773a19b9e065833f7bfe21
SHA1 f0a9e731902736bd5bb816261e772e46af824b76
SHA512 d0a0b10d485c7c1ba8d76d41c657ea0968d341ea471f8fc498c8a79b575534c1586bd0a1db618d32e017cd77593a9d2a49ead929fcf5d8ba7796f9a71bdde614
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0IEFToChvLb:71ONtyBeSFkXV1etEKLlWUTOfeiRA2RC
MD5 SHA1 SHA512 SSDEEP

Submit Download

uCpUDHi.exe

Path \Windows\system\uCpUDHi.exe
Size 2.8MB
SHA256 8b0c599cb7d8f809e4405c96ed5eddce19d77ecf4b99aaba7d08ee34e48e5607
MD5 b0d526aa71573b3f1dbd2e6726f1b606
SHA1 3790e631f5850db84c6a78ba50f9ec9e58f1193a
SHA512 e9e107425c87e6188c6ada0d32aabcf1723497af90f3ebb5b01fdb85a3e2ca0eb68cfb55c9600aeaec7ea112e43c7fd799e394f0f9327d2b6cce9a9699dd265a
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0IEFToChvL2:71ONtyBeSFkXV1etEKLlWUTOfeiRA2RT
MD5 SHA1 SHA512 SSDEEP

Submit Download

vVKOksN.exe

Path \Windows\system\vVKOksN.exe
Size 2.8MB
SHA256 9806209270ea17a3ba2515f312eaa0defd41e9dcdb38ba6e8ec241a6dbe6ac16
MD5 c5945ea193a534b854478a6cb32f6fd5
SHA1 7eeb169efa2743856b38e997504f5245c6cf2d3c
SHA512 7555561edcae5495999b0f575530547beb3d4f4f08f5de9a1df2050c1e2b00167fdb5b39efb5be5bedd0613f395a0814810c6ced52f97538e11fe25b32ac53e5
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0IEFToChvLI:71ONtyBeSFkXV1etEKLlWUTOfeiRA2RB
MD5 SHA1 SHA512 SSDEEP

Submit Download

vVdEbnt.exe

Path \Windows\system\vVdEbnt.exe
Size 2.8MB
SHA256 7e69f8e9cc153decf8dcdbbcaf9f445878b5b0731634c20ed7f1e9befaa58895
MD5 1da473d64af2a3a9920c1c995da9c886
SHA1 dbe92d39579619dfb937e95baa82495f49188621
SHA512 0ad38c0a8993b4c44baf39ae030401490c4845e50ce8f94e9361b91b0ad035847e52a4a35c9318ff093f235a45d75e063b4f82c1d5f293130faaecd4915bdc5f
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0IEFToChvLF:71ONtyBeSFkXV1etEKLlWUTOfeiRA2Rc
MD5 SHA1 SHA512 SSDEEP

Submit Download

xrgeoiv.exe

Path \Windows\system\xrgeoiv.exe
Size 2.8MB
SHA256 81ca8225640364fc18cc3b7890face1a310a845acad5a5a0b35ecec05d654066
MD5 fcf1bd1bd5ab28d8d6503241dc182d0c
SHA1 bbb45ca3c6d6d9833c0b95bd8511bb6e4f5fb64d
SHA512 ed7b12c3657d22420d234bd5597c79179d76b88cf1cdf56bef136ac0a82621d46d94533fd1e7b2031a3944991ad26e8cf7d8a3e45ebd0abdaf26f512bb052b3b
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0IEFToChvL5:71ONtyBeSFkXV1etEKLlWUTOfeiRA2Ri
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/760-123-0x000000013FCE0000-0x00000001400D6000-memory.dmp

Download

memory/760-4913-0x000000013FCE0000-0x00000001400D6000-memory.dmp

Download

memory/1876-115-0x000000013FE50000-0x0000000140246000-memory.dmp

Download

memory/1876-4915-0x000000013FE50000-0x0000000140246000-memory.dmp

Download

memory/2052-14-0x000000013F940000-0x000000013FD36000-memory.dmp

Download

memory/2052-4904-0x000000013F940000-0x000000013FD36000-memory.dmp

Download

memory/2160-20-0x0000000002C80000-0x0000000002D00000-memory.dmp

Download

memory/2160-81-0x000000001B600000-0x000000001B8E2000-memory.dmp

Download

memory/2160-83-0x0000000002340000-0x0000000002348000-memory.dmp

Download

memory/2160-91-0x000007FEF5DD0000-0x000007FEF676D000-memory.dmp

Download

memory/2160-1613-0x000007FEF5DD0000-0x000007FEF676D000-memory.dmp

Download

memory/2160-21-0x000007FEF608E000-0x000007FEF608F000-memory.dmp

Download

memory/2160-90-0x000007FEF5DD0000-0x000007FEF676D000-memory.dmp

Download

memory/2360-113-0x000000013F1F0000-0x000000013F5E6000-memory.dmp

Download

memory/2360-4914-0x000000013F1F0000-0x000000013F5E6000-memory.dmp

Download

memory/2468-4911-0x000000013F8D0000-0x000000013FCC6000-memory.dmp

Download

memory/2468-105-0x000000013F8D0000-0x000000013FCC6000-memory.dmp

Download

memory/2512-4910-0x000000013FC20000-0x0000000140016000-memory.dmp

Download

memory/2512-103-0x000000013FC20000-0x0000000140016000-memory.dmp

Download

memory/2528-110-0x000000013F780000-0x000000013FB76000-memory.dmp

Download

memory/2528-4912-0x000000013F780000-0x000000013FB76000-memory.dmp

Download

memory/2588-92-0x000000013F740000-0x000000013FB36000-memory.dmp

Download

memory/2588-4906-0x000000013F740000-0x000000013FB36000-memory.dmp

Download

memory/2604-19-0x000000013F9F0000-0x000000013FDE6000-memory.dmp

Download

memory/2604-4905-0x000000013F9F0000-0x000000013FDE6000-memory.dmp

Download

memory/2676-101-0x000000013FDE0000-0x00000001401D6000-memory.dmp

Download

memory/2676-4909-0x000000013FDE0000-0x00000001401D6000-memory.dmp

Download

memory/2724-4907-0x000000013F340000-0x000000013F736000-memory.dmp

Download

memory/2724-99-0x000000013F340000-0x000000013F736000-memory.dmp

Download

memory/2740-2451-0x0000000003120000-0x0000000003516000-memory.dmp

Download

memory/2740-104-0x0000000003120000-0x0000000003516000-memory.dmp

Download

memory/2740-11-0x0000000003120000-0x0000000003516000-memory.dmp

Download

memory/2740-1-0x000000013F580000-0x000000013F976000-memory.dmp

Download

memory/2740-2450-0x000000013F580000-0x000000013F976000-memory.dmp

Download

memory/2740-116-0x000000013FCE0000-0x00000001400D6000-memory.dmp

Download

memory/2740-2828-0x0000000003120000-0x0000000003516000-memory.dmp

Download

memory/2740-3269-0x0000000003120000-0x0000000003516000-memory.dmp

Download

memory/2740-100-0x000000013FDE0000-0x00000001401D6000-memory.dmp

Download

memory/2740-102-0x000000013FC20000-0x0000000140016000-memory.dmp

Download

memory/2740-111-0x0000000003120000-0x0000000003516000-memory.dmp

Download

memory/2740-106-0x0000000003120000-0x0000000003516000-memory.dmp

Download

memory/2740-129-0x0000000003120000-0x0000000003516000-memory.dmp

Download

memory/2740-93-0x0000000003120000-0x0000000003516000-memory.dmp

Download

memory/2740-98-0x0000000003120000-0x0000000003516000-memory.dmp

Download

memory/2740-0-0x00000000001F0000-0x0000000000200000-memory.dmp

Download

memory/2740-114-0x000000013FE50000-0x0000000140246000-memory.dmp

Download

memory/2740-22-0x000000013F9F0000-0x000000013FDE6000-memory.dmp

Download

memory/3004-97-0x000000013F550000-0x000000013F946000-memory.dmp

Download

memory/3004-4908-0x000000013F550000-0x000000013F946000-memory.dmp

Download