xmrig | 3254a031aac87dd4d83966fde3376adec32266afe5a52dcdf986e0cd023333d3

Analysis

max time kernel
150s
max time network
143s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
21/05/2024, 10:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3254a031aac87dd4d83966fde3376adec32266afe5a52dcdf986e0cd023333d3_NeikiAnalytics.exe
Size

2.9MB
MD5

c8ede464aa2b49b950e387a11c6df4f0
SHA1

fb1ac5ffa2c603ee86429c59035b7e3097cf4a06
SHA256

3254a031aac87dd4d83966fde3376adec32266afe5a52dcdf986e0cd023333d3
SHA512

cd696637b9270598dc2dcfa9c0df122bf1a6d9a983919420306e14fd2354255d9d5941332a480b932a41e108e97c3d58884c15c493cea653a6dcb00c2c749bb4
SSDEEP

49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hjGhql0lQGQK5BKrh:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2RW

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 60 IoCs

miner

resource	yara_rule
behavioral1/memory/2404-2-0x000000013F420000-0x000000013F816000-memory.dmp	xmrig
behavioral1/files/0x000a00000001431c-6.dat	xmrig
behavioral1/files/0x0036000000014502-8.dat	xmrig
behavioral1/files/0x0007000000014702-16.dat	xmrig
behavioral1/files/0x001800000000558a-36.dat	xmrig
behavioral1/files/0x000700000001480e-22.dat	xmrig
behavioral1/memory/868-44-0x000000013FFF0000-0x00000001403E6000-memory.dmp	xmrig
behavioral1/memory/2404-50-0x0000000003380000-0x0000000003776000-memory.dmp	xmrig
behavioral1/memory/760-46-0x000000013FAA0000-0x000000013FE96000-memory.dmp	xmrig
behavioral1/files/0x0008000000014b36-49.dat	xmrig
behavioral1/files/0x000a000000014b10-42.dat	xmrig
behavioral1/memory/2624-39-0x000000013F900000-0x000000013FCF6000-memory.dmp	xmrig
behavioral1/memory/2404-10-0x0000000002F60000-0x0000000003356000-memory.dmp	xmrig
behavioral1/memory/2320-9-0x000000013FFB0000-0x00000001403A6000-memory.dmp	xmrig
behavioral1/memory/2608-19-0x000000013FD20000-0x0000000140116000-memory.dmp	xmrig
behavioral1/memory/2476-56-0x000000013F6C0000-0x000000013FAB6000-memory.dmp	xmrig
behavioral1/files/0x0007000000015c5a-65.dat	xmrig
behavioral1/memory/2320-67-0x000000013FFB0000-0x00000001403A6000-memory.dmp	xmrig
behavioral1/memory/3024-75-0x000000013FCE0000-0x00000001400D6000-memory.dmp	xmrig
behavioral1/memory/2404-88-0x000000013F9D0000-0x000000013FDC6000-memory.dmp	xmrig
behavioral1/files/0x0035000000014588-90.dat	xmrig
behavioral1/memory/2796-89-0x000000013FB20000-0x000000013FF16000-memory.dmp	xmrig
behavioral1/files/0x0006000000015cbd-107.dat	xmrig
behavioral1/files/0x0006000000015cf5-122.dat	xmrig
behavioral1/files/0x00060000000165f0-169.dat	xmrig
behavioral1/files/0x0006000000016476-164.dat	xmrig
behavioral1/files/0x00060000000161b3-157.dat	xmrig
behavioral1/files/0x0006000000015fa7-150.dat	xmrig
behavioral1/files/0x0006000000015e6d-143.dat	xmrig
behavioral1/files/0x0006000000015d4c-136.dat	xmrig
behavioral1/files/0x0006000000015d24-129.dat	xmrig
behavioral1/files/0x0006000000015cd9-115.dat	xmrig
behavioral1/memory/2636-93-0x000000013F9E0000-0x000000013FDD6000-memory.dmp	xmrig
behavioral1/memory/2608-92-0x000000013FD20000-0x0000000140116000-memory.dmp	xmrig
behavioral1/files/0x0006000000015cb0-91.dat	xmrig
behavioral1/files/0x0006000000015cce-110.dat	xmrig
behavioral1/files/0x0006000000015c93-101.dat	xmrig
behavioral1/files/0x0006000000015ce3-117.dat	xmrig
behavioral1/files/0x0006000000015c6f-99.dat	xmrig
behavioral1/files/0x0006000000015e09-138.dat	xmrig
behavioral1/files/0x0006000000015d0c-124.dat	xmrig
behavioral1/files/0x00060000000162c9-159.dat	xmrig
behavioral1/files/0x00060000000160cc-152.dat	xmrig
behavioral1/memory/2560-293-0x000000013F320000-0x000000013F716000-memory.dmp	xmrig
behavioral1/files/0x0006000000015f3c-145.dat	xmrig
behavioral1/files/0x0006000000015d44-190.dat	xmrig
behavioral1/files/0x0006000000016813-173.dat	xmrig
behavioral1/files/0x000600000001654a-166.dat	xmrig
behavioral1/files/0x0006000000016a6f-193.dat	xmrig
behavioral1/memory/2900-85-0x000000013F9D0000-0x000000013FDC6000-memory.dmp	xmrig
behavioral1/files/0x0006000000015c9c-83.dat	xmrig
behavioral1/files/0x0006000000015c85-82.dat	xmrig
behavioral1/memory/2404-66-0x000000013F420000-0x000000013F816000-memory.dmp	xmrig
behavioral1/memory/2404-4011-0x000000013FCE0000-0x00000001400D6000-memory.dmp	xmrig
behavioral1/memory/2404-5457-0x000000013F9D0000-0x000000013FDC6000-memory.dmp	xmrig
behavioral1/memory/2796-5459-0x000000013FB20000-0x000000013FF16000-memory.dmp	xmrig
behavioral1/memory/2320-7625-0x000000013FFB0000-0x00000001403A6000-memory.dmp	xmrig
behavioral1/memory/868-7627-0x000000013FFF0000-0x00000001403E6000-memory.dmp	xmrig
behavioral1/memory/2796-8007-0x000000013FB20000-0x000000013FF16000-memory.dmp	xmrig
behavioral1/memory/2900-8005-0x000000013F9D0000-0x000000013FDC6000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
320	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
2320	HkLwZiw.exe
2608	djZdEmr.exe
2560	cQFlBCj.exe
2624	oGTxpTN.exe
868	SZaCPWG.exe
760	pLugexj.exe
2476	JaswqSL.exe
3024	rJUdXvA.exe
2796	sPhBrNd.exe
2900	qCiKymm.exe
2636	AiLtjED.exe
2864	cdpHhsu.exe
2876	AWqebSz.exe
3052	ZkAEWDH.exe
700	WGrxwAs.exe
2440	ApCXKJw.exe
1984	KKVfjtI.exe
1572	INgoWJk.exe
2564	dKBCtWj.exe
1332	GTJnxda.exe
888	sPlJScT.exe
2240	WnCmDyI.exe
856	aNlOEkL.exe
2160	HjHonhy.exe
2452	nEUnKUl.exe
2792	BNDpFHr.exe
1580	YrBBrhQ.exe
1548	UrhTUCE.exe
2140	DfOFrce.exe
276	DVehhqv.exe
1776	LWZHWHF.exe
1612	dmrdIxb.exe
1644	JiBsHjK.exe
920	XLlfJNp.exe
1704	dDrPiCd.exe
1952	KmdenRk.exe
1972	hMtAnkg.exe
2980	nuDftku.exe
1752	hckNTgM.exe
2236	RlAVKSH.exe
3056	SmXeBFz.exe
1232	HFGpJQy.exe
1816	zYvtQwu.exe
336	pnLqMFK.exe
988	QhDpDCv.exe
1564	dVbPfFl.exe
2984	DUYDAuB.exe
2492	PJnbWdK.exe
2528	sngPlKp.exe
2692	uGGKBTs.exe
1948	ZmnCaXa.exe
1756	GkgNsMg.exe
1660	AqKmSlB.exe
1360	duDQPph.exe
1868	ObSleMM.exe
1852	RwVdGKs.exe
1248	UyrOrVc.exe
1700	opIyXDT.exe
1976	cOUesgo.exe
984	uJFpjQZ.exe
1304	Fklvgfc.exe
2012	LrkUlBR.exe
2976	lOYLSPM.exe
2600	LaxdPQx.exe

Loads dropped DLL 64 IoCs

pid	Process
2404	3254a031aac87dd4d83966fde3376adec32266afe5a52dcdf986e0cd023333d3_NeikiAnalytics.exe
2404	3254a031aac87dd4d83966fde3376adec32266afe5a52dcdf986e0cd023333d3_NeikiAnalytics.exe
2404	3254a031aac87dd4d83966fde3376adec32266afe5a52dcdf986e0cd023333d3_NeikiAnalytics.exe
2404	3254a031aac87dd4d83966fde3376adec32266afe5a52dcdf986e0cd023333d3_NeikiAnalytics.exe
2404	3254a031aac87dd4d83966fde3376adec32266afe5a52dcdf986e0cd023333d3_NeikiAnalytics.exe
2404	3254a031aac87dd4d83966fde3376adec32266afe5a52dcdf986e0cd023333d3_NeikiAnalytics.exe
2404	3254a031aac87dd4d83966fde3376adec32266afe5a52dcdf986e0cd023333d3_NeikiAnalytics.exe
2404	3254a031aac87dd4d83966fde3376adec32266afe5a52dcdf986e0cd023333d3_NeikiAnalytics.exe
2404	3254a031aac87dd4d83966fde3376adec32266afe5a52dcdf986e0cd023333d3_NeikiAnalytics.exe
2404	3254a031aac87dd4d83966fde3376adec32266afe5a52dcdf986e0cd023333d3_NeikiAnalytics.exe
2404	3254a031aac87dd4d83966fde3376adec32266afe5a52dcdf986e0cd023333d3_NeikiAnalytics.exe
2404	3254a031aac87dd4d83966fde3376adec32266afe5a52dcdf986e0cd023333d3_NeikiAnalytics.exe
2404	3254a031aac87dd4d83966fde3376adec32266afe5a52dcdf986e0cd023333d3_NeikiAnalytics.exe
2404	3254a031aac87dd4d83966fde3376adec32266afe5a52dcdf986e0cd023333d3_NeikiAnalytics.exe
2404	3254a031aac87dd4d83966fde3376adec32266afe5a52dcdf986e0cd023333d3_NeikiAnalytics.exe
2404	3254a031aac87dd4d83966fde3376adec32266afe5a52dcdf986e0cd023333d3_NeikiAnalytics.exe
2404	3254a031aac87dd4d83966fde3376adec32266afe5a52dcdf986e0cd023333d3_NeikiAnalytics.exe
2404	3254a031aac87dd4d83966fde3376adec32266afe5a52dcdf986e0cd023333d3_NeikiAnalytics.exe
2404	3254a031aac87dd4d83966fde3376adec32266afe5a52dcdf986e0cd023333d3_NeikiAnalytics.exe
2404	3254a031aac87dd4d83966fde3376adec32266afe5a52dcdf986e0cd023333d3_NeikiAnalytics.exe
2404	3254a031aac87dd4d83966fde3376adec32266afe5a52dcdf986e0cd023333d3_NeikiAnalytics.exe
2404	3254a031aac87dd4d83966fde3376adec32266afe5a52dcdf986e0cd023333d3_NeikiAnalytics.exe
2404	3254a031aac87dd4d83966fde3376adec32266afe5a52dcdf986e0cd023333d3_NeikiAnalytics.exe
2404	3254a031aac87dd4d83966fde3376adec32266afe5a52dcdf986e0cd023333d3_NeikiAnalytics.exe
2404	3254a031aac87dd4d83966fde3376adec32266afe5a52dcdf986e0cd023333d3_NeikiAnalytics.exe
2404	3254a031aac87dd4d83966fde3376adec32266afe5a52dcdf986e0cd023333d3_NeikiAnalytics.exe
2404	3254a031aac87dd4d83966fde3376adec32266afe5a52dcdf986e0cd023333d3_NeikiAnalytics.exe
2404	3254a031aac87dd4d83966fde3376adec32266afe5a52dcdf986e0cd023333d3_NeikiAnalytics.exe
2404	3254a031aac87dd4d83966fde3376adec32266afe5a52dcdf986e0cd023333d3_NeikiAnalytics.exe
2404	3254a031aac87dd4d83966fde3376adec32266afe5a52dcdf986e0cd023333d3_NeikiAnalytics.exe
2404	3254a031aac87dd4d83966fde3376adec32266afe5a52dcdf986e0cd023333d3_NeikiAnalytics.exe
2404	3254a031aac87dd4d83966fde3376adec32266afe5a52dcdf986e0cd023333d3_NeikiAnalytics.exe
2404	3254a031aac87dd4d83966fde3376adec32266afe5a52dcdf986e0cd023333d3_NeikiAnalytics.exe
2404	3254a031aac87dd4d83966fde3376adec32266afe5a52dcdf986e0cd023333d3_NeikiAnalytics.exe
2404	3254a031aac87dd4d83966fde3376adec32266afe5a52dcdf986e0cd023333d3_NeikiAnalytics.exe
2404	3254a031aac87dd4d83966fde3376adec32266afe5a52dcdf986e0cd023333d3_NeikiAnalytics.exe
2404	3254a031aac87dd4d83966fde3376adec32266afe5a52dcdf986e0cd023333d3_NeikiAnalytics.exe
2404	3254a031aac87dd4d83966fde3376adec32266afe5a52dcdf986e0cd023333d3_NeikiAnalytics.exe
2404	3254a031aac87dd4d83966fde3376adec32266afe5a52dcdf986e0cd023333d3_NeikiAnalytics.exe
2404	3254a031aac87dd4d83966fde3376adec32266afe5a52dcdf986e0cd023333d3_NeikiAnalytics.exe
2404	3254a031aac87dd4d83966fde3376adec32266afe5a52dcdf986e0cd023333d3_NeikiAnalytics.exe
2404	3254a031aac87dd4d83966fde3376adec32266afe5a52dcdf986e0cd023333d3_NeikiAnalytics.exe
2404	3254a031aac87dd4d83966fde3376adec32266afe5a52dcdf986e0cd023333d3_NeikiAnalytics.exe
2404	3254a031aac87dd4d83966fde3376adec32266afe5a52dcdf986e0cd023333d3_NeikiAnalytics.exe
2404	3254a031aac87dd4d83966fde3376adec32266afe5a52dcdf986e0cd023333d3_NeikiAnalytics.exe
2404	3254a031aac87dd4d83966fde3376adec32266afe5a52dcdf986e0cd023333d3_NeikiAnalytics.exe
2404	3254a031aac87dd4d83966fde3376adec32266afe5a52dcdf986e0cd023333d3_NeikiAnalytics.exe
2404	3254a031aac87dd4d83966fde3376adec32266afe5a52dcdf986e0cd023333d3_NeikiAnalytics.exe
2404	3254a031aac87dd4d83966fde3376adec32266afe5a52dcdf986e0cd023333d3_NeikiAnalytics.exe
2404	3254a031aac87dd4d83966fde3376adec32266afe5a52dcdf986e0cd023333d3_NeikiAnalytics.exe
2404	3254a031aac87dd4d83966fde3376adec32266afe5a52dcdf986e0cd023333d3_NeikiAnalytics.exe
2404	3254a031aac87dd4d83966fde3376adec32266afe5a52dcdf986e0cd023333d3_NeikiAnalytics.exe
2404	3254a031aac87dd4d83966fde3376adec32266afe5a52dcdf986e0cd023333d3_NeikiAnalytics.exe
2404	3254a031aac87dd4d83966fde3376adec32266afe5a52dcdf986e0cd023333d3_NeikiAnalytics.exe
2404	3254a031aac87dd4d83966fde3376adec32266afe5a52dcdf986e0cd023333d3_NeikiAnalytics.exe
2404	3254a031aac87dd4d83966fde3376adec32266afe5a52dcdf986e0cd023333d3_NeikiAnalytics.exe
2404	3254a031aac87dd4d83966fde3376adec32266afe5a52dcdf986e0cd023333d3_NeikiAnalytics.exe
2404	3254a031aac87dd4d83966fde3376adec32266afe5a52dcdf986e0cd023333d3_NeikiAnalytics.exe
2404	3254a031aac87dd4d83966fde3376adec32266afe5a52dcdf986e0cd023333d3_NeikiAnalytics.exe
2404	3254a031aac87dd4d83966fde3376adec32266afe5a52dcdf986e0cd023333d3_NeikiAnalytics.exe
2404	3254a031aac87dd4d83966fde3376adec32266afe5a52dcdf986e0cd023333d3_NeikiAnalytics.exe
2404	3254a031aac87dd4d83966fde3376adec32266afe5a52dcdf986e0cd023333d3_NeikiAnalytics.exe
2404	3254a031aac87dd4d83966fde3376adec32266afe5a52dcdf986e0cd023333d3_NeikiAnalytics.exe
2404	3254a031aac87dd4d83966fde3376adec32266afe5a52dcdf986e0cd023333d3_NeikiAnalytics.exe

UPX packed file 57 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2404-2-0x000000013F420000-0x000000013F816000-memory.dmp	upx
behavioral1/files/0x000a00000001431c-6.dat	upx
behavioral1/files/0x0036000000014502-8.dat	upx
behavioral1/files/0x0007000000014702-16.dat	upx
behavioral1/files/0x001800000000558a-36.dat	upx
behavioral1/files/0x000700000001480e-22.dat	upx
behavioral1/memory/868-44-0x000000013FFF0000-0x00000001403E6000-memory.dmp	upx
behavioral1/memory/2404-50-0x0000000003380000-0x0000000003776000-memory.dmp	upx
behavioral1/memory/760-46-0x000000013FAA0000-0x000000013FE96000-memory.dmp	upx
behavioral1/files/0x0008000000014b36-49.dat	upx
behavioral1/files/0x000a000000014b10-42.dat	upx
behavioral1/memory/2624-39-0x000000013F900000-0x000000013FCF6000-memory.dmp	upx
behavioral1/memory/2404-10-0x0000000002F60000-0x0000000003356000-memory.dmp	upx
behavioral1/memory/2320-9-0x000000013FFB0000-0x00000001403A6000-memory.dmp	upx
behavioral1/memory/2608-19-0x000000013FD20000-0x0000000140116000-memory.dmp	upx
behavioral1/memory/2476-56-0x000000013F6C0000-0x000000013FAB6000-memory.dmp	upx
behavioral1/files/0x0007000000015c5a-65.dat	upx
behavioral1/memory/2320-67-0x000000013FFB0000-0x00000001403A6000-memory.dmp	upx
behavioral1/memory/3024-75-0x000000013FCE0000-0x00000001400D6000-memory.dmp	upx
behavioral1/files/0x0035000000014588-90.dat	upx
behavioral1/memory/2796-89-0x000000013FB20000-0x000000013FF16000-memory.dmp	upx
behavioral1/files/0x0006000000015cbd-107.dat	upx
behavioral1/files/0x0006000000015cf5-122.dat	upx
behavioral1/files/0x00060000000165f0-169.dat	upx
behavioral1/files/0x0006000000016476-164.dat	upx
behavioral1/files/0x00060000000161b3-157.dat	upx
behavioral1/files/0x0006000000015fa7-150.dat	upx
behavioral1/files/0x0006000000015e6d-143.dat	upx
behavioral1/files/0x0006000000015d4c-136.dat	upx
behavioral1/files/0x0006000000015d24-129.dat	upx
behavioral1/files/0x0006000000015cd9-115.dat	upx
behavioral1/memory/2636-93-0x000000013F9E0000-0x000000013FDD6000-memory.dmp	upx
behavioral1/memory/2608-92-0x000000013FD20000-0x0000000140116000-memory.dmp	upx
behavioral1/files/0x0006000000015cb0-91.dat	upx
behavioral1/files/0x0006000000015cce-110.dat	upx
behavioral1/files/0x0006000000015c93-101.dat	upx
behavioral1/files/0x0006000000015ce3-117.dat	upx
behavioral1/files/0x0006000000015c6f-99.dat	upx
behavioral1/files/0x0006000000015e09-138.dat	upx
behavioral1/files/0x0006000000015d0c-124.dat	upx
behavioral1/files/0x00060000000162c9-159.dat	upx
behavioral1/files/0x00060000000160cc-152.dat	upx
behavioral1/memory/2560-293-0x000000013F320000-0x000000013F716000-memory.dmp	upx
behavioral1/files/0x0006000000015f3c-145.dat	upx
behavioral1/files/0x0006000000015d44-190.dat	upx
behavioral1/files/0x0006000000016813-173.dat	upx
behavioral1/files/0x000600000001654a-166.dat	upx
behavioral1/files/0x0006000000016a6f-193.dat	upx
behavioral1/memory/2900-85-0x000000013F9D0000-0x000000013FDC6000-memory.dmp	upx
behavioral1/files/0x0006000000015c9c-83.dat	upx
behavioral1/files/0x0006000000015c85-82.dat	upx
behavioral1/memory/2404-66-0x000000013F420000-0x000000013F816000-memory.dmp	upx
behavioral1/memory/2796-5459-0x000000013FB20000-0x000000013FF16000-memory.dmp	upx
behavioral1/memory/2320-7625-0x000000013FFB0000-0x00000001403A6000-memory.dmp	upx
behavioral1/memory/868-7627-0x000000013FFF0000-0x00000001403E6000-memory.dmp	upx
behavioral1/memory/2796-8007-0x000000013FB20000-0x000000013FF16000-memory.dmp	upx
behavioral1/memory/2900-8005-0x000000013F9D0000-0x000000013FDC6000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\ckSySlN.exe	3254a031aac87dd4d83966fde3376adec32266afe5a52dcdf986e0cd023333d3_NeikiAnalytics.exe
File created	C:\Windows\System\mKjHwpv.exe	3254a031aac87dd4d83966fde3376adec32266afe5a52dcdf986e0cd023333d3_NeikiAnalytics.exe
File created	C:\Windows\System\YMzDNEM.exe	3254a031aac87dd4d83966fde3376adec32266afe5a52dcdf986e0cd023333d3_NeikiAnalytics.exe
File created	C:\Windows\System\sdUFDcK.exe	3254a031aac87dd4d83966fde3376adec32266afe5a52dcdf986e0cd023333d3_NeikiAnalytics.exe
File created	C:\Windows\System\BFIlUBy.exe	3254a031aac87dd4d83966fde3376adec32266afe5a52dcdf986e0cd023333d3_NeikiAnalytics.exe
File created	C:\Windows\System\GcSenuZ.exe	3254a031aac87dd4d83966fde3376adec32266afe5a52dcdf986e0cd023333d3_NeikiAnalytics.exe
File created	C:\Windows\System\IuTaRIh.exe	3254a031aac87dd4d83966fde3376adec32266afe5a52dcdf986e0cd023333d3_NeikiAnalytics.exe
File created	C:\Windows\System\RldhQUh.exe	3254a031aac87dd4d83966fde3376adec32266afe5a52dcdf986e0cd023333d3_NeikiAnalytics.exe
File created	C:\Windows\System\iNbNPcF.exe	3254a031aac87dd4d83966fde3376adec32266afe5a52dcdf986e0cd023333d3_NeikiAnalytics.exe
File created	C:\Windows\System\kWazbiC.exe	3254a031aac87dd4d83966fde3376adec32266afe5a52dcdf986e0cd023333d3_NeikiAnalytics.exe
File created	C:\Windows\System\ByoMZgp.exe	3254a031aac87dd4d83966fde3376adec32266afe5a52dcdf986e0cd023333d3_NeikiAnalytics.exe
File created	C:\Windows\System\wPcaLGv.exe	3254a031aac87dd4d83966fde3376adec32266afe5a52dcdf986e0cd023333d3_NeikiAnalytics.exe
File created	C:\Windows\System\pFVbsIt.exe	3254a031aac87dd4d83966fde3376adec32266afe5a52dcdf986e0cd023333d3_NeikiAnalytics.exe
File created	C:\Windows\System\GTIAZsK.exe	3254a031aac87dd4d83966fde3376adec32266afe5a52dcdf986e0cd023333d3_NeikiAnalytics.exe
File created	C:\Windows\System\HItpata.exe	3254a031aac87dd4d83966fde3376adec32266afe5a52dcdf986e0cd023333d3_NeikiAnalytics.exe
File created	C:\Windows\System\pCzEpvJ.exe	3254a031aac87dd4d83966fde3376adec32266afe5a52dcdf986e0cd023333d3_NeikiAnalytics.exe
File created	C:\Windows\System\BBXnMIY.exe	3254a031aac87dd4d83966fde3376adec32266afe5a52dcdf986e0cd023333d3_NeikiAnalytics.exe
File created	C:\Windows\System\yVuQQva.exe	3254a031aac87dd4d83966fde3376adec32266afe5a52dcdf986e0cd023333d3_NeikiAnalytics.exe
File created	C:\Windows\System\GhxRYYG.exe	3254a031aac87dd4d83966fde3376adec32266afe5a52dcdf986e0cd023333d3_NeikiAnalytics.exe
File created	C:\Windows\System\QfIuPZf.exe	3254a031aac87dd4d83966fde3376adec32266afe5a52dcdf986e0cd023333d3_NeikiAnalytics.exe
File created	C:\Windows\System\qHxkWGA.exe	3254a031aac87dd4d83966fde3376adec32266afe5a52dcdf986e0cd023333d3_NeikiAnalytics.exe
File created	C:\Windows\System\bjPjUYG.exe	3254a031aac87dd4d83966fde3376adec32266afe5a52dcdf986e0cd023333d3_NeikiAnalytics.exe
File created	C:\Windows\System\xknCMfB.exe	3254a031aac87dd4d83966fde3376adec32266afe5a52dcdf986e0cd023333d3_NeikiAnalytics.exe
File created	C:\Windows\System\zQTJryR.exe	3254a031aac87dd4d83966fde3376adec32266afe5a52dcdf986e0cd023333d3_NeikiAnalytics.exe
File created	C:\Windows\System\LjoahPk.exe	3254a031aac87dd4d83966fde3376adec32266afe5a52dcdf986e0cd023333d3_NeikiAnalytics.exe
File created	C:\Windows\System\bagumCk.exe	3254a031aac87dd4d83966fde3376adec32266afe5a52dcdf986e0cd023333d3_NeikiAnalytics.exe
File created	C:\Windows\System\DmUkenx.exe	3254a031aac87dd4d83966fde3376adec32266afe5a52dcdf986e0cd023333d3_NeikiAnalytics.exe
File created	C:\Windows\System\SiUSnBE.exe	3254a031aac87dd4d83966fde3376adec32266afe5a52dcdf986e0cd023333d3_NeikiAnalytics.exe
File created	C:\Windows\System\VyFzoUO.exe	3254a031aac87dd4d83966fde3376adec32266afe5a52dcdf986e0cd023333d3_NeikiAnalytics.exe
File created	C:\Windows\System\ynSSSWs.exe	3254a031aac87dd4d83966fde3376adec32266afe5a52dcdf986e0cd023333d3_NeikiAnalytics.exe
File created	C:\Windows\System\YMfgCEw.exe	3254a031aac87dd4d83966fde3376adec32266afe5a52dcdf986e0cd023333d3_NeikiAnalytics.exe
File created	C:\Windows\System\elyMIzp.exe	3254a031aac87dd4d83966fde3376adec32266afe5a52dcdf986e0cd023333d3_NeikiAnalytics.exe
File created	C:\Windows\System\YAbqQBZ.exe	3254a031aac87dd4d83966fde3376adec32266afe5a52dcdf986e0cd023333d3_NeikiAnalytics.exe
File created	C:\Windows\System\xTTtppm.exe	3254a031aac87dd4d83966fde3376adec32266afe5a52dcdf986e0cd023333d3_NeikiAnalytics.exe
File created	C:\Windows\System\FqsKEBn.exe	3254a031aac87dd4d83966fde3376adec32266afe5a52dcdf986e0cd023333d3_NeikiAnalytics.exe
File created	C:\Windows\System\pWDaRsy.exe	3254a031aac87dd4d83966fde3376adec32266afe5a52dcdf986e0cd023333d3_NeikiAnalytics.exe
File created	C:\Windows\System\WPpyPJB.exe	3254a031aac87dd4d83966fde3376adec32266afe5a52dcdf986e0cd023333d3_NeikiAnalytics.exe
File created	C:\Windows\System\IzEmYkX.exe	3254a031aac87dd4d83966fde3376adec32266afe5a52dcdf986e0cd023333d3_NeikiAnalytics.exe
File created	C:\Windows\System\hETupxv.exe	3254a031aac87dd4d83966fde3376adec32266afe5a52dcdf986e0cd023333d3_NeikiAnalytics.exe
File created	C:\Windows\System\rHVPGyq.exe	3254a031aac87dd4d83966fde3376adec32266afe5a52dcdf986e0cd023333d3_NeikiAnalytics.exe
File created	C:\Windows\System\eyHOccH.exe	3254a031aac87dd4d83966fde3376adec32266afe5a52dcdf986e0cd023333d3_NeikiAnalytics.exe
File created	C:\Windows\System\BUKUEOV.exe	3254a031aac87dd4d83966fde3376adec32266afe5a52dcdf986e0cd023333d3_NeikiAnalytics.exe
File created	C:\Windows\System\SwbMyZo.exe	3254a031aac87dd4d83966fde3376adec32266afe5a52dcdf986e0cd023333d3_NeikiAnalytics.exe
File created	C:\Windows\System\yZQxQPY.exe	3254a031aac87dd4d83966fde3376adec32266afe5a52dcdf986e0cd023333d3_NeikiAnalytics.exe
File created	C:\Windows\System\RjSPfNU.exe	3254a031aac87dd4d83966fde3376adec32266afe5a52dcdf986e0cd023333d3_NeikiAnalytics.exe
File created	C:\Windows\System\fBtSnzQ.exe	3254a031aac87dd4d83966fde3376adec32266afe5a52dcdf986e0cd023333d3_NeikiAnalytics.exe
File created	C:\Windows\System\URLvXcq.exe	3254a031aac87dd4d83966fde3376adec32266afe5a52dcdf986e0cd023333d3_NeikiAnalytics.exe
File created	C:\Windows\System\pxRqsOE.exe	3254a031aac87dd4d83966fde3376adec32266afe5a52dcdf986e0cd023333d3_NeikiAnalytics.exe
File created	C:\Windows\System\TKLyNkG.exe	3254a031aac87dd4d83966fde3376adec32266afe5a52dcdf986e0cd023333d3_NeikiAnalytics.exe
File created	C:\Windows\System\GTJnxda.exe	3254a031aac87dd4d83966fde3376adec32266afe5a52dcdf986e0cd023333d3_NeikiAnalytics.exe
File created	C:\Windows\System\GsvknpZ.exe	3254a031aac87dd4d83966fde3376adec32266afe5a52dcdf986e0cd023333d3_NeikiAnalytics.exe
File created	C:\Windows\System\uzIQCyO.exe	3254a031aac87dd4d83966fde3376adec32266afe5a52dcdf986e0cd023333d3_NeikiAnalytics.exe
File created	C:\Windows\System\iFLYmDt.exe	3254a031aac87dd4d83966fde3376adec32266afe5a52dcdf986e0cd023333d3_NeikiAnalytics.exe
File created	C:\Windows\System\MpXdjci.exe	3254a031aac87dd4d83966fde3376adec32266afe5a52dcdf986e0cd023333d3_NeikiAnalytics.exe
File created	C:\Windows\System\QsgWCKb.exe	3254a031aac87dd4d83966fde3376adec32266afe5a52dcdf986e0cd023333d3_NeikiAnalytics.exe
File created	C:\Windows\System\KSJjJNl.exe	3254a031aac87dd4d83966fde3376adec32266afe5a52dcdf986e0cd023333d3_NeikiAnalytics.exe
File created	C:\Windows\System\QzPdgza.exe	3254a031aac87dd4d83966fde3376adec32266afe5a52dcdf986e0cd023333d3_NeikiAnalytics.exe
File created	C:\Windows\System\gKnqZYf.exe	3254a031aac87dd4d83966fde3376adec32266afe5a52dcdf986e0cd023333d3_NeikiAnalytics.exe
File created	C:\Windows\System\zcejEnQ.exe	3254a031aac87dd4d83966fde3376adec32266afe5a52dcdf986e0cd023333d3_NeikiAnalytics.exe
File created	C:\Windows\System\TzbTiEv.exe	3254a031aac87dd4d83966fde3376adec32266afe5a52dcdf986e0cd023333d3_NeikiAnalytics.exe
File created	C:\Windows\System\BJAlaqW.exe	3254a031aac87dd4d83966fde3376adec32266afe5a52dcdf986e0cd023333d3_NeikiAnalytics.exe
File created	C:\Windows\System\foCgASf.exe	3254a031aac87dd4d83966fde3376adec32266afe5a52dcdf986e0cd023333d3_NeikiAnalytics.exe
File created	C:\Windows\System\oyunvsE.exe	3254a031aac87dd4d83966fde3376adec32266afe5a52dcdf986e0cd023333d3_NeikiAnalytics.exe
File created	C:\Windows\System\RlFzEFE.exe	3254a031aac87dd4d83966fde3376adec32266afe5a52dcdf986e0cd023333d3_NeikiAnalytics.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
320	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2404	3254a031aac87dd4d83966fde3376adec32266afe5a52dcdf986e0cd023333d3_NeikiAnalytics.exe
Token: SeLockMemoryPrivilege	2404	3254a031aac87dd4d83966fde3376adec32266afe5a52dcdf986e0cd023333d3_NeikiAnalytics.exe
Token: SeDebugPrivilege	320	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2404 wrote to memory of 320	2404	3254a031aac87dd4d83966fde3376adec32266afe5a52dcdf986e0cd023333d3_NeikiAnalytics.exe	29
PID 2404 wrote to memory of 320	2404	3254a031aac87dd4d83966fde3376adec32266afe5a52dcdf986e0cd023333d3_NeikiAnalytics.exe	29
PID 2404 wrote to memory of 320	2404	3254a031aac87dd4d83966fde3376adec32266afe5a52dcdf986e0cd023333d3_NeikiAnalytics.exe	29
PID 2404 wrote to memory of 2320	2404	3254a031aac87dd4d83966fde3376adec32266afe5a52dcdf986e0cd023333d3_NeikiAnalytics.exe	30
PID 2404 wrote to memory of 2320	2404	3254a031aac87dd4d83966fde3376adec32266afe5a52dcdf986e0cd023333d3_NeikiAnalytics.exe	30
PID 2404 wrote to memory of 2320	2404	3254a031aac87dd4d83966fde3376adec32266afe5a52dcdf986e0cd023333d3_NeikiAnalytics.exe	30
PID 2404 wrote to memory of 2560	2404	3254a031aac87dd4d83966fde3376adec32266afe5a52dcdf986e0cd023333d3_NeikiAnalytics.exe	31
PID 2404 wrote to memory of 2560	2404	3254a031aac87dd4d83966fde3376adec32266afe5a52dcdf986e0cd023333d3_NeikiAnalytics.exe	31
PID 2404 wrote to memory of 2560	2404	3254a031aac87dd4d83966fde3376adec32266afe5a52dcdf986e0cd023333d3_NeikiAnalytics.exe	31
PID 2404 wrote to memory of 2608	2404	3254a031aac87dd4d83966fde3376adec32266afe5a52dcdf986e0cd023333d3_NeikiAnalytics.exe	32
PID 2404 wrote to memory of 2608	2404	3254a031aac87dd4d83966fde3376adec32266afe5a52dcdf986e0cd023333d3_NeikiAnalytics.exe	32
PID 2404 wrote to memory of 2608	2404	3254a031aac87dd4d83966fde3376adec32266afe5a52dcdf986e0cd023333d3_NeikiAnalytics.exe	32
PID 2404 wrote to memory of 2624	2404	3254a031aac87dd4d83966fde3376adec32266afe5a52dcdf986e0cd023333d3_NeikiAnalytics.exe	33
PID 2404 wrote to memory of 2624	2404	3254a031aac87dd4d83966fde3376adec32266afe5a52dcdf986e0cd023333d3_NeikiAnalytics.exe	33
PID 2404 wrote to memory of 2624	2404	3254a031aac87dd4d83966fde3376adec32266afe5a52dcdf986e0cd023333d3_NeikiAnalytics.exe	33
PID 2404 wrote to memory of 868	2404	3254a031aac87dd4d83966fde3376adec32266afe5a52dcdf986e0cd023333d3_NeikiAnalytics.exe	34
PID 2404 wrote to memory of 868	2404	3254a031aac87dd4d83966fde3376adec32266afe5a52dcdf986e0cd023333d3_NeikiAnalytics.exe	34
PID 2404 wrote to memory of 868	2404	3254a031aac87dd4d83966fde3376adec32266afe5a52dcdf986e0cd023333d3_NeikiAnalytics.exe	34
PID 2404 wrote to memory of 760	2404	3254a031aac87dd4d83966fde3376adec32266afe5a52dcdf986e0cd023333d3_NeikiAnalytics.exe	35
PID 2404 wrote to memory of 760	2404	3254a031aac87dd4d83966fde3376adec32266afe5a52dcdf986e0cd023333d3_NeikiAnalytics.exe	35
PID 2404 wrote to memory of 760	2404	3254a031aac87dd4d83966fde3376adec32266afe5a52dcdf986e0cd023333d3_NeikiAnalytics.exe	35
PID 2404 wrote to memory of 2476	2404	3254a031aac87dd4d83966fde3376adec32266afe5a52dcdf986e0cd023333d3_NeikiAnalytics.exe	36
PID 2404 wrote to memory of 2476	2404	3254a031aac87dd4d83966fde3376adec32266afe5a52dcdf986e0cd023333d3_NeikiAnalytics.exe	36
PID 2404 wrote to memory of 2476	2404	3254a031aac87dd4d83966fde3376adec32266afe5a52dcdf986e0cd023333d3_NeikiAnalytics.exe	36
PID 2404 wrote to memory of 2636	2404	3254a031aac87dd4d83966fde3376adec32266afe5a52dcdf986e0cd023333d3_NeikiAnalytics.exe	37
PID 2404 wrote to memory of 2636	2404	3254a031aac87dd4d83966fde3376adec32266afe5a52dcdf986e0cd023333d3_NeikiAnalytics.exe	37
PID 2404 wrote to memory of 2636	2404	3254a031aac87dd4d83966fde3376adec32266afe5a52dcdf986e0cd023333d3_NeikiAnalytics.exe	37
PID 2404 wrote to memory of 3024	2404	3254a031aac87dd4d83966fde3376adec32266afe5a52dcdf986e0cd023333d3_NeikiAnalytics.exe	38
PID 2404 wrote to memory of 3024	2404	3254a031aac87dd4d83966fde3376adec32266afe5a52dcdf986e0cd023333d3_NeikiAnalytics.exe	38
PID 2404 wrote to memory of 3024	2404	3254a031aac87dd4d83966fde3376adec32266afe5a52dcdf986e0cd023333d3_NeikiAnalytics.exe	38
PID 2404 wrote to memory of 2864	2404	3254a031aac87dd4d83966fde3376adec32266afe5a52dcdf986e0cd023333d3_NeikiAnalytics.exe	39
PID 2404 wrote to memory of 2864	2404	3254a031aac87dd4d83966fde3376adec32266afe5a52dcdf986e0cd023333d3_NeikiAnalytics.exe	39
PID 2404 wrote to memory of 2864	2404	3254a031aac87dd4d83966fde3376adec32266afe5a52dcdf986e0cd023333d3_NeikiAnalytics.exe	39
PID 2404 wrote to memory of 2796	2404	3254a031aac87dd4d83966fde3376adec32266afe5a52dcdf986e0cd023333d3_NeikiAnalytics.exe	40
PID 2404 wrote to memory of 2796	2404	3254a031aac87dd4d83966fde3376adec32266afe5a52dcdf986e0cd023333d3_NeikiAnalytics.exe	40
PID 2404 wrote to memory of 2796	2404	3254a031aac87dd4d83966fde3376adec32266afe5a52dcdf986e0cd023333d3_NeikiAnalytics.exe	40
PID 2404 wrote to memory of 2876	2404	3254a031aac87dd4d83966fde3376adec32266afe5a52dcdf986e0cd023333d3_NeikiAnalytics.exe	41
PID 2404 wrote to memory of 2876	2404	3254a031aac87dd4d83966fde3376adec32266afe5a52dcdf986e0cd023333d3_NeikiAnalytics.exe	41
PID 2404 wrote to memory of 2876	2404	3254a031aac87dd4d83966fde3376adec32266afe5a52dcdf986e0cd023333d3_NeikiAnalytics.exe	41
PID 2404 wrote to memory of 2900	2404	3254a031aac87dd4d83966fde3376adec32266afe5a52dcdf986e0cd023333d3_NeikiAnalytics.exe	42
PID 2404 wrote to memory of 2900	2404	3254a031aac87dd4d83966fde3376adec32266afe5a52dcdf986e0cd023333d3_NeikiAnalytics.exe	42
PID 2404 wrote to memory of 2900	2404	3254a031aac87dd4d83966fde3376adec32266afe5a52dcdf986e0cd023333d3_NeikiAnalytics.exe	42
PID 2404 wrote to memory of 3052	2404	3254a031aac87dd4d83966fde3376adec32266afe5a52dcdf986e0cd023333d3_NeikiAnalytics.exe	43
PID 2404 wrote to memory of 3052	2404	3254a031aac87dd4d83966fde3376adec32266afe5a52dcdf986e0cd023333d3_NeikiAnalytics.exe	43
PID 2404 wrote to memory of 3052	2404	3254a031aac87dd4d83966fde3376adec32266afe5a52dcdf986e0cd023333d3_NeikiAnalytics.exe	43
PID 2404 wrote to memory of 700	2404	3254a031aac87dd4d83966fde3376adec32266afe5a52dcdf986e0cd023333d3_NeikiAnalytics.exe	44
PID 2404 wrote to memory of 700	2404	3254a031aac87dd4d83966fde3376adec32266afe5a52dcdf986e0cd023333d3_NeikiAnalytics.exe	44
PID 2404 wrote to memory of 700	2404	3254a031aac87dd4d83966fde3376adec32266afe5a52dcdf986e0cd023333d3_NeikiAnalytics.exe	44
PID 2404 wrote to memory of 2452	2404	3254a031aac87dd4d83966fde3376adec32266afe5a52dcdf986e0cd023333d3_NeikiAnalytics.exe	45
PID 2404 wrote to memory of 2452	2404	3254a031aac87dd4d83966fde3376adec32266afe5a52dcdf986e0cd023333d3_NeikiAnalytics.exe	45
PID 2404 wrote to memory of 2452	2404	3254a031aac87dd4d83966fde3376adec32266afe5a52dcdf986e0cd023333d3_NeikiAnalytics.exe	45
PID 2404 wrote to memory of 2440	2404	3254a031aac87dd4d83966fde3376adec32266afe5a52dcdf986e0cd023333d3_NeikiAnalytics.exe	46
PID 2404 wrote to memory of 2440	2404	3254a031aac87dd4d83966fde3376adec32266afe5a52dcdf986e0cd023333d3_NeikiAnalytics.exe	46
PID 2404 wrote to memory of 2440	2404	3254a031aac87dd4d83966fde3376adec32266afe5a52dcdf986e0cd023333d3_NeikiAnalytics.exe	46
PID 2404 wrote to memory of 2792	2404	3254a031aac87dd4d83966fde3376adec32266afe5a52dcdf986e0cd023333d3_NeikiAnalytics.exe	47
PID 2404 wrote to memory of 2792	2404	3254a031aac87dd4d83966fde3376adec32266afe5a52dcdf986e0cd023333d3_NeikiAnalytics.exe	47
PID 2404 wrote to memory of 2792	2404	3254a031aac87dd4d83966fde3376adec32266afe5a52dcdf986e0cd023333d3_NeikiAnalytics.exe	47
PID 2404 wrote to memory of 1984	2404	3254a031aac87dd4d83966fde3376adec32266afe5a52dcdf986e0cd023333d3_NeikiAnalytics.exe	48
PID 2404 wrote to memory of 1984	2404	3254a031aac87dd4d83966fde3376adec32266afe5a52dcdf986e0cd023333d3_NeikiAnalytics.exe	48
PID 2404 wrote to memory of 1984	2404	3254a031aac87dd4d83966fde3376adec32266afe5a52dcdf986e0cd023333d3_NeikiAnalytics.exe	48
PID 2404 wrote to memory of 1580	2404	3254a031aac87dd4d83966fde3376adec32266afe5a52dcdf986e0cd023333d3_NeikiAnalytics.exe	49
PID 2404 wrote to memory of 1580	2404	3254a031aac87dd4d83966fde3376adec32266afe5a52dcdf986e0cd023333d3_NeikiAnalytics.exe	49
PID 2404 wrote to memory of 1580	2404	3254a031aac87dd4d83966fde3376adec32266afe5a52dcdf986e0cd023333d3_NeikiAnalytics.exe	49
PID 2404 wrote to memory of 1572	2404	3254a031aac87dd4d83966fde3376adec32266afe5a52dcdf986e0cd023333d3_NeikiAnalytics.exe	50

C:\Users\Admin\AppData\Local\Temp\3254a031aac87dd4d83966fde3376adec32266afe5a52dcdf986e0cd023333d3_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\3254a031aac87dd4d83966fde3376adec32266afe5a52dcdf986e0cd023333d3_NeikiAnalytics.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2404
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:320
- C:\Windows\System\HkLwZiw.exe
  C:\Windows\System\HkLwZiw.exe
  2⤵
  - Executes dropped EXE
  PID:2320
- C:\Windows\System\cQFlBCj.exe
  C:\Windows\System\cQFlBCj.exe
  2⤵
  - Executes dropped EXE
  PID:2560
- C:\Windows\System\djZdEmr.exe
  C:\Windows\System\djZdEmr.exe
  2⤵
  - Executes dropped EXE
  PID:2608
- C:\Windows\System\oGTxpTN.exe
  C:\Windows\System\oGTxpTN.exe
  2⤵
  - Executes dropped EXE
  PID:2624
- C:\Windows\System\SZaCPWG.exe
  C:\Windows\System\SZaCPWG.exe
  2⤵
  - Executes dropped EXE
  PID:868
- C:\Windows\System\pLugexj.exe
  C:\Windows\System\pLugexj.exe
  2⤵
  - Executes dropped EXE
  PID:760
- C:\Windows\System\JaswqSL.exe
  C:\Windows\System\JaswqSL.exe
  2⤵
  - Executes dropped EXE
  PID:2476
- C:\Windows\System\AiLtjED.exe
  C:\Windows\System\AiLtjED.exe
  2⤵
  - Executes dropped EXE
  PID:2636
- C:\Windows\System\rJUdXvA.exe
  C:\Windows\System\rJUdXvA.exe
  2⤵
  - Executes dropped EXE
  PID:3024
- C:\Windows\System\cdpHhsu.exe
  C:\Windows\System\cdpHhsu.exe
  2⤵
  - Executes dropped EXE
  PID:2864
- C:\Windows\System\sPhBrNd.exe
  C:\Windows\System\sPhBrNd.exe
  2⤵
  - Executes dropped EXE
  PID:2796
- C:\Windows\System\AWqebSz.exe
  C:\Windows\System\AWqebSz.exe
  2⤵
  - Executes dropped EXE
  PID:2876
- C:\Windows\System\qCiKymm.exe
  C:\Windows\System\qCiKymm.exe
  2⤵
  - Executes dropped EXE
  PID:2900
- C:\Windows\System\ZkAEWDH.exe
  C:\Windows\System\ZkAEWDH.exe
  2⤵
  - Executes dropped EXE
  PID:3052
- C:\Windows\System\WGrxwAs.exe
  C:\Windows\System\WGrxwAs.exe
  2⤵
  - Executes dropped EXE
  PID:700
- C:\Windows\System\nEUnKUl.exe
  C:\Windows\System\nEUnKUl.exe
  2⤵
  - Executes dropped EXE
  PID:2452
- C:\Windows\System\ApCXKJw.exe
  C:\Windows\System\ApCXKJw.exe
  2⤵
  - Executes dropped EXE
  PID:2440
- C:\Windows\System\BNDpFHr.exe
  C:\Windows\System\BNDpFHr.exe
  2⤵
  - Executes dropped EXE
  PID:2792
- C:\Windows\System\KKVfjtI.exe
  C:\Windows\System\KKVfjtI.exe
  2⤵
  - Executes dropped EXE
  PID:1984
- C:\Windows\System\YrBBrhQ.exe
  C:\Windows\System\YrBBrhQ.exe
  2⤵
  - Executes dropped EXE
  PID:1580
- C:\Windows\System\INgoWJk.exe
  C:\Windows\System\INgoWJk.exe
  2⤵
  - Executes dropped EXE
  PID:1572
- C:\Windows\System\UrhTUCE.exe
  C:\Windows\System\UrhTUCE.exe
  2⤵
  - Executes dropped EXE
  PID:1548
- C:\Windows\System\dKBCtWj.exe
  C:\Windows\System\dKBCtWj.exe
  2⤵
  - Executes dropped EXE
  PID:2564
- C:\Windows\System\SmXeBFz.exe
  C:\Windows\System\SmXeBFz.exe
  2⤵
  - Executes dropped EXE
  PID:3056
- C:\Windows\System\GTJnxda.exe
  C:\Windows\System\GTJnxda.exe
  2⤵
  - Executes dropped EXE
  PID:1332
- C:\Windows\System\HFGpJQy.exe
  C:\Windows\System\HFGpJQy.exe
  2⤵
  - Executes dropped EXE
  PID:1232
- C:\Windows\System\sPlJScT.exe
  C:\Windows\System\sPlJScT.exe
  2⤵
  - Executes dropped EXE
  PID:888
- C:\Windows\System\zYvtQwu.exe
  C:\Windows\System\zYvtQwu.exe
  2⤵
  - Executes dropped EXE
  PID:1816
- C:\Windows\System\WnCmDyI.exe
  C:\Windows\System\WnCmDyI.exe
  2⤵
  - Executes dropped EXE
  PID:2240
- C:\Windows\System\pnLqMFK.exe
  C:\Windows\System\pnLqMFK.exe
  2⤵
  - Executes dropped EXE
  PID:336
- C:\Windows\System\aNlOEkL.exe
  C:\Windows\System\aNlOEkL.exe
  2⤵
  - Executes dropped EXE
  PID:856
- C:\Windows\System\QhDpDCv.exe
  C:\Windows\System\QhDpDCv.exe
  2⤵
  - Executes dropped EXE
  PID:988
- C:\Windows\System\HjHonhy.exe
  C:\Windows\System\HjHonhy.exe
  2⤵
  - Executes dropped EXE
  PID:2160
- C:\Windows\System\DUYDAuB.exe
  C:\Windows\System\DUYDAuB.exe
  2⤵
  - Executes dropped EXE
  PID:2984
- C:\Windows\System\DfOFrce.exe
  C:\Windows\System\DfOFrce.exe
  2⤵
  - Executes dropped EXE
  PID:2140
- C:\Windows\System\GkgNsMg.exe
  C:\Windows\System\GkgNsMg.exe
  2⤵
  - Executes dropped EXE
  PID:1756
- C:\Windows\System\DVehhqv.exe
  C:\Windows\System\DVehhqv.exe
  2⤵
  - Executes dropped EXE
  PID:276
- C:\Windows\System\AqKmSlB.exe
  C:\Windows\System\AqKmSlB.exe
  2⤵
  - Executes dropped EXE
  PID:1660
- C:\Windows\System\LWZHWHF.exe
  C:\Windows\System\LWZHWHF.exe
  2⤵
  - Executes dropped EXE
  PID:1776
- C:\Windows\System\duDQPph.exe
  C:\Windows\System\duDQPph.exe
  2⤵
  - Executes dropped EXE
  PID:1360
- C:\Windows\System\dmrdIxb.exe
  C:\Windows\System\dmrdIxb.exe
  2⤵
  - Executes dropped EXE
  PID:1612
- C:\Windows\System\ObSleMM.exe
  C:\Windows\System\ObSleMM.exe
  2⤵
  - Executes dropped EXE
  PID:1868
- C:\Windows\System\JiBsHjK.exe
  C:\Windows\System\JiBsHjK.exe
  2⤵
  - Executes dropped EXE
  PID:1644
- C:\Windows\System\RwVdGKs.exe
  C:\Windows\System\RwVdGKs.exe
  2⤵
  - Executes dropped EXE
  PID:1852
- C:\Windows\System\XLlfJNp.exe
  C:\Windows\System\XLlfJNp.exe
  2⤵
  - Executes dropped EXE
  PID:920
- C:\Windows\System\UyrOrVc.exe
  C:\Windows\System\UyrOrVc.exe
  2⤵
  - Executes dropped EXE
  PID:1248
- C:\Windows\System\dDrPiCd.exe
  C:\Windows\System\dDrPiCd.exe
  2⤵
  - Executes dropped EXE
  PID:1704
- C:\Windows\System\opIyXDT.exe
  C:\Windows\System\opIyXDT.exe
  2⤵
  - Executes dropped EXE
  PID:1700
- C:\Windows\System\KmdenRk.exe
  C:\Windows\System\KmdenRk.exe
  2⤵
  - Executes dropped EXE
  PID:1952
- C:\Windows\System\cOUesgo.exe
  C:\Windows\System\cOUesgo.exe
  2⤵
  - Executes dropped EXE
  PID:1976
- C:\Windows\System\hMtAnkg.exe
  C:\Windows\System\hMtAnkg.exe
  2⤵
  - Executes dropped EXE
  PID:1972
- C:\Windows\System\uJFpjQZ.exe
  C:\Windows\System\uJFpjQZ.exe
  2⤵
  - Executes dropped EXE
  PID:984
- C:\Windows\System\nuDftku.exe
  C:\Windows\System\nuDftku.exe
  2⤵
  - Executes dropped EXE
  PID:2980
- C:\Windows\System\Fklvgfc.exe
  C:\Windows\System\Fklvgfc.exe
  2⤵
  - Executes dropped EXE
  PID:1304
- C:\Windows\System\hckNTgM.exe
  C:\Windows\System\hckNTgM.exe
  2⤵
  - Executes dropped EXE
  PID:1752
- C:\Windows\System\LrkUlBR.exe
  C:\Windows\System\LrkUlBR.exe
  2⤵
  - Executes dropped EXE
  PID:2012
- C:\Windows\System\RlAVKSH.exe
  C:\Windows\System\RlAVKSH.exe
  2⤵
  - Executes dropped EXE
  PID:2236
- C:\Windows\System\lOYLSPM.exe
  C:\Windows\System\lOYLSPM.exe
  2⤵
  - Executes dropped EXE
  PID:2976
- C:\Windows\System\dVbPfFl.exe
  C:\Windows\System\dVbPfFl.exe
  2⤵
  - Executes dropped EXE
  PID:1564
- C:\Windows\System\LaxdPQx.exe
  C:\Windows\System\LaxdPQx.exe
  2⤵
  - Executes dropped EXE
  PID:2600
- C:\Windows\System\PJnbWdK.exe
  C:\Windows\System\PJnbWdK.exe
  2⤵
  - Executes dropped EXE
  PID:2492
- C:\Windows\System\qHHOEYG.exe
  C:\Windows\System\qHHOEYG.exe
  2⤵
  PID:2640
- C:\Windows\System\sngPlKp.exe
  C:\Windows\System\sngPlKp.exe
  2⤵
  - Executes dropped EXE
  PID:2528
- C:\Windows\System\XuqXuAq.exe
  C:\Windows\System\XuqXuAq.exe
  2⤵
  PID:2852
- C:\Windows\System\uGGKBTs.exe
  C:\Windows\System\uGGKBTs.exe
  2⤵
  - Executes dropped EXE
  PID:2692
- C:\Windows\System\HLXmAIf.exe
  C:\Windows\System\HLXmAIf.exe
  2⤵
  PID:1296
- C:\Windows\System\ZmnCaXa.exe
  C:\Windows\System\ZmnCaXa.exe
  2⤵
  - Executes dropped EXE
  PID:1948
- C:\Windows\System\HHTjMse.exe
  C:\Windows\System\HHTjMse.exe
  2⤵
  PID:1684
- C:\Windows\System\IusoyFG.exe
  C:\Windows\System\IusoyFG.exe
  2⤵
  PID:596
- C:\Windows\System\KuiODcn.exe
  C:\Windows\System\KuiODcn.exe
  2⤵
  PID:2888
- C:\Windows\System\EdNYSal.exe
  C:\Windows\System\EdNYSal.exe
  2⤵
  PID:816
- C:\Windows\System\kTUNpte.exe
  C:\Windows\System\kTUNpte.exe
  2⤵
  PID:2112
- C:\Windows\System\wBzIyOv.exe
  C:\Windows\System\wBzIyOv.exe
  2⤵
  PID:960
- C:\Windows\System\etTyALj.exe
  C:\Windows\System\etTyALj.exe
  2⤵
  PID:936
- C:\Windows\System\iPkgbSn.exe
  C:\Windows\System\iPkgbSn.exe
  2⤵
  PID:2336
- C:\Windows\System\YmNxwEU.exe
  C:\Windows\System\YmNxwEU.exe
  2⤵
  PID:1784
- C:\Windows\System\ZbsUJlI.exe
  C:\Windows\System\ZbsUJlI.exe
  2⤵
  PID:844
- C:\Windows\System\AIxyCeh.exe
  C:\Windows\System\AIxyCeh.exe
  2⤵
  PID:1588
- C:\Windows\System\OmHuKgr.exe
  C:\Windows\System\OmHuKgr.exe
  2⤵
  PID:2212
- C:\Windows\System\HJIrPbq.exe
  C:\Windows\System\HJIrPbq.exe
  2⤵
  PID:2668
- C:\Windows\System\rgAJrRR.exe
  C:\Windows\System\rgAJrRR.exe
  2⤵
  PID:2896
- C:\Windows\System\qLWTqss.exe
  C:\Windows\System\qLWTqss.exe
  2⤵
  PID:2592
- C:\Windows\System\WzmFaie.exe
  C:\Windows\System\WzmFaie.exe
  2⤵
  PID:1796
- C:\Windows\System\KcXtiPc.exe
  C:\Windows\System\KcXtiPc.exe
  2⤵
  PID:544
- C:\Windows\System\PKGLiJp.exe
  C:\Windows\System\PKGLiJp.exe
  2⤵
  PID:1932
- C:\Windows\System\BnSYvhJ.exe
  C:\Windows\System\BnSYvhJ.exe
  2⤵
  PID:1664
- C:\Windows\System\WDofLbL.exe
  C:\Windows\System\WDofLbL.exe
  2⤵
  PID:2448
- C:\Windows\System\ozsUZUk.exe
  C:\Windows\System\ozsUZUk.exe
  2⤵
  PID:1320
- C:\Windows\System\CqeYTJe.exe
  C:\Windows\System\CqeYTJe.exe
  2⤵
  PID:1044
- C:\Windows\System\syVkbKl.exe
  C:\Windows\System\syVkbKl.exe
  2⤵
  PID:2484
- C:\Windows\System\cPhrJFH.exe
  C:\Windows\System\cPhrJFH.exe
  2⤵
  PID:2296
- C:\Windows\System\NGDZzrJ.exe
  C:\Windows\System\NGDZzrJ.exe
  2⤵
  PID:1604
- C:\Windows\System\WwZKsDL.exe
  C:\Windows\System\WwZKsDL.exe
  2⤵
  PID:908
- C:\Windows\System\ROZYnGB.exe
  C:\Windows\System\ROZYnGB.exe
  2⤵
  PID:2716
- C:\Windows\System\nhteTcb.exe
  C:\Windows\System\nhteTcb.exe
  2⤵
  PID:2728
- C:\Windows\System\EQTqBOb.exe
  C:\Windows\System\EQTqBOb.exe
  2⤵
  PID:708
- C:\Windows\System\NdznPYR.exe
  C:\Windows\System\NdznPYR.exe
  2⤵
  PID:2656
- C:\Windows\System\TMBWNnZ.exe
  C:\Windows\System\TMBWNnZ.exe
  2⤵
  PID:2756
- C:\Windows\System\czkcnwO.exe
  C:\Windows\System\czkcnwO.exe
  2⤵
  PID:2056
- C:\Windows\System\VXmoRyg.exe
  C:\Windows\System\VXmoRyg.exe
  2⤵
  PID:1960
- C:\Windows\System\EOGSkmR.exe
  C:\Windows\System\EOGSkmR.exe
  2⤵
  PID:1836
- C:\Windows\System\wGNoxGF.exe
  C:\Windows\System\wGNoxGF.exe
  2⤵
  PID:2836
- C:\Windows\System\MDrfVfA.exe
  C:\Windows\System\MDrfVfA.exe
  2⤵
  PID:2776
- C:\Windows\System\GFLBnYl.exe
  C:\Windows\System\GFLBnYl.exe
  2⤵
  PID:2096
- C:\Windows\System\AsngGbw.exe
  C:\Windows\System\AsngGbw.exe
  2⤵
  PID:1056
- C:\Windows\System\AaINpEv.exe
  C:\Windows\System\AaINpEv.exe
  2⤵
  PID:2700
- C:\Windows\System\dddkOBn.exe
  C:\Windows\System\dddkOBn.exe
  2⤵
  PID:1048
- C:\Windows\System\KGonlzX.exe
  C:\Windows\System\KGonlzX.exe
  2⤵
  PID:2784
- C:\Windows\System\TGqPWuT.exe
  C:\Windows\System\TGqPWuT.exe
  2⤵
  PID:1268
- C:\Windows\System\UNjWCIj.exe
  C:\Windows\System\UNjWCIj.exe
  2⤵
  PID:1800
- C:\Windows\System\tnBdEjD.exe
  C:\Windows\System\tnBdEjD.exe
  2⤵
  PID:1780
- C:\Windows\System\HxRGVqm.exe
  C:\Windows\System\HxRGVqm.exe
  2⤵
  PID:1100
- C:\Windows\System\BZRhBvM.exe
  C:\Windows\System\BZRhBvM.exe
  2⤵
  PID:1956
- C:\Windows\System\umirinl.exe
  C:\Windows\System\umirinl.exe
  2⤵
  PID:3036
- C:\Windows\System\JKZgPwW.exe
  C:\Windows\System\JKZgPwW.exe
  2⤵
  PID:2164
- C:\Windows\System\sqKxjHc.exe
  C:\Windows\System\sqKxjHc.exe
  2⤵
  PID:1368
- C:\Windows\System\RpatZRl.exe
  C:\Windows\System\RpatZRl.exe
  2⤵
  PID:2544
- C:\Windows\System\iskJwcU.exe
  C:\Windows\System\iskJwcU.exe
  2⤵
  PID:1648
- C:\Windows\System\EAjhQNh.exe
  C:\Windows\System\EAjhQNh.exe
  2⤵
  PID:2948
- C:\Windows\System\SidgfrG.exe
  C:\Windows\System\SidgfrG.exe
  2⤵
  PID:3020
- C:\Windows\System\KGxsnNl.exe
  C:\Windows\System\KGxsnNl.exe
  2⤵
  PID:2924
- C:\Windows\System\Bvshwha.exe
  C:\Windows\System\Bvshwha.exe
  2⤵
  PID:2764
- C:\Windows\System\YFQiVzH.exe
  C:\Windows\System\YFQiVzH.exe
  2⤵
  PID:3000
- C:\Windows\System\PntERVt.exe
  C:\Windows\System\PntERVt.exe
  2⤵
  PID:840
- C:\Windows\System\TIFldtC.exe
  C:\Windows\System\TIFldtC.exe
  2⤵
  PID:1592
- C:\Windows\System\EMdINoD.exe
  C:\Windows\System\EMdINoD.exe
  2⤵
  PID:1484
- C:\Windows\System\NoeUNUY.exe
  C:\Windows\System\NoeUNUY.exe
  2⤵
  PID:1496
- C:\Windows\System\WBiQlNI.exe
  C:\Windows\System\WBiQlNI.exe
  2⤵
  PID:2348
- C:\Windows\System\wwUuqHS.exe
  C:\Windows\System\wwUuqHS.exe
  2⤵
  PID:2508
- C:\Windows\System\EsgbjLr.exe
  C:\Windows\System\EsgbjLr.exe
  2⤵
  PID:884
- C:\Windows\System\LjUHoCK.exe
  C:\Windows\System\LjUHoCK.exe
  2⤵
  PID:1540
- C:\Windows\System\iilveHZ.exe
  C:\Windows\System\iilveHZ.exe
  2⤵
  PID:3076
- C:\Windows\System\AfJhpec.exe
  C:\Windows\System\AfJhpec.exe
  2⤵
  PID:3092
- C:\Windows\System\FygVaGS.exe
  C:\Windows\System\FygVaGS.exe
  2⤵
  PID:3108
- C:\Windows\System\HZPrcWm.exe
  C:\Windows\System\HZPrcWm.exe
  2⤵
  PID:3124
- C:\Windows\System\fcAxLqe.exe
  C:\Windows\System\fcAxLqe.exe
  2⤵
  PID:3140
- C:\Windows\System\lyzmrTV.exe
  C:\Windows\System\lyzmrTV.exe
  2⤵
  PID:3160
- C:\Windows\System\ecOSXLA.exe
  C:\Windows\System\ecOSXLA.exe
  2⤵
  PID:3176
- C:\Windows\System\JqFYGxN.exe
  C:\Windows\System\JqFYGxN.exe
  2⤵
  PID:3204
- C:\Windows\System\cityuoU.exe
  C:\Windows\System\cityuoU.exe
  2⤵
  PID:3220
- C:\Windows\System\lspjQNn.exe
  C:\Windows\System\lspjQNn.exe
  2⤵
  PID:3236
- C:\Windows\System\OauKENK.exe
  C:\Windows\System\OauKENK.exe
  2⤵
  PID:3252
- C:\Windows\System\GWgwBLJ.exe
  C:\Windows\System\GWgwBLJ.exe
  2⤵
  PID:3316
- C:\Windows\System\YNyPcsX.exe
  C:\Windows\System\YNyPcsX.exe
  2⤵
  PID:3336
- C:\Windows\System\mQzJGVg.exe
  C:\Windows\System\mQzJGVg.exe
  2⤵
  PID:3352
- C:\Windows\System\IRsGmFJ.exe
  C:\Windows\System\IRsGmFJ.exe
  2⤵
  PID:3372
- C:\Windows\System\LyyuAVl.exe
  C:\Windows\System\LyyuAVl.exe
  2⤵
  PID:3388
- C:\Windows\System\cGzyfEm.exe
  C:\Windows\System\cGzyfEm.exe
  2⤵
  PID:3404
- C:\Windows\System\jtPRZHi.exe
  C:\Windows\System\jtPRZHi.exe
  2⤵
  PID:3424
- C:\Windows\System\OUgfQLk.exe
  C:\Windows\System\OUgfQLk.exe
  2⤵
  PID:3444
- C:\Windows\System\Ptjnjnl.exe
  C:\Windows\System\Ptjnjnl.exe
  2⤵
  PID:3460
- C:\Windows\System\oIZSZEN.exe
  C:\Windows\System\oIZSZEN.exe
  2⤵
  PID:3548
- C:\Windows\System\FlimiLG.exe
  C:\Windows\System\FlimiLG.exe
  2⤵
  PID:3616
- C:\Windows\System\iymPYVZ.exe
  C:\Windows\System\iymPYVZ.exe
  2⤵
  PID:3632
- C:\Windows\System\BbwaXTY.exe
  C:\Windows\System\BbwaXTY.exe
  2⤵
  PID:3652
- C:\Windows\System\mlUKIsW.exe
  C:\Windows\System\mlUKIsW.exe
  2⤵
  PID:3668
- C:\Windows\System\XdOXNxb.exe
  C:\Windows\System\XdOXNxb.exe
  2⤵
  PID:3688
- C:\Windows\System\hlvJnxk.exe
  C:\Windows\System\hlvJnxk.exe
  2⤵
  PID:3704
- C:\Windows\System\UzyYgOh.exe
  C:\Windows\System\UzyYgOh.exe
  2⤵
  PID:3720
- C:\Windows\System\qXZDcgt.exe
  C:\Windows\System\qXZDcgt.exe
  2⤵
  PID:3736
- C:\Windows\System\qgQACxL.exe
  C:\Windows\System\qgQACxL.exe
  2⤵
  PID:3752
- C:\Windows\System\xDCpCJJ.exe
  C:\Windows\System\xDCpCJJ.exe
  2⤵
  PID:3768
- C:\Windows\System\DKEsjVq.exe
  C:\Windows\System\DKEsjVq.exe
  2⤵
  PID:3784
- C:\Windows\System\QmuVDHO.exe
  C:\Windows\System\QmuVDHO.exe
  2⤵
  PID:3800
- C:\Windows\System\DmUkenx.exe
  C:\Windows\System\DmUkenx.exe
  2⤵
  PID:3816
- C:\Windows\System\LiZxcBz.exe
  C:\Windows\System\LiZxcBz.exe
  2⤵
  PID:3832
- C:\Windows\System\xuJxCuW.exe
  C:\Windows\System\xuJxCuW.exe
  2⤵
  PID:3848
- C:\Windows\System\ubHDLwO.exe
  C:\Windows\System\ubHDLwO.exe
  2⤵
  PID:3864
- C:\Windows\System\foPMSQT.exe
  C:\Windows\System\foPMSQT.exe
  2⤵
  PID:3884
- C:\Windows\System\rZlZjMX.exe
  C:\Windows\System\rZlZjMX.exe
  2⤵
  PID:3900
- C:\Windows\System\PgcoppL.exe
  C:\Windows\System\PgcoppL.exe
  2⤵
  PID:3916
- C:\Windows\System\EOAnDDg.exe
  C:\Windows\System\EOAnDDg.exe
  2⤵
  PID:3936
- C:\Windows\System\LZuYrZD.exe
  C:\Windows\System\LZuYrZD.exe
  2⤵
  PID:3952
- C:\Windows\System\wBNWzWO.exe
  C:\Windows\System\wBNWzWO.exe
  2⤵
  PID:3972
- C:\Windows\System\lMUcsTM.exe
  C:\Windows\System\lMUcsTM.exe
  2⤵
  PID:3988
- C:\Windows\System\zcFGaPl.exe
  C:\Windows\System\zcFGaPl.exe
  2⤵
  PID:4004
- C:\Windows\System\MZmetcO.exe
  C:\Windows\System\MZmetcO.exe
  2⤵
  PID:4024
- C:\Windows\System\FYvQljj.exe
  C:\Windows\System\FYvQljj.exe
  2⤵
  PID:4040
- C:\Windows\System\ULEEzxt.exe
  C:\Windows\System\ULEEzxt.exe
  2⤵
  PID:4060
- C:\Windows\System\utIQBqV.exe
  C:\Windows\System\utIQBqV.exe
  2⤵
  PID:4076
- C:\Windows\System\AEUTIzI.exe
  C:\Windows\System\AEUTIzI.exe
  2⤵
  PID:3040
- C:\Windows\System\nmYlRHz.exe
  C:\Windows\System\nmYlRHz.exe
  2⤵
  PID:2628
- C:\Windows\System\PVOcTRJ.exe
  C:\Windows\System\PVOcTRJ.exe
  2⤵
  PID:1876
- C:\Windows\System\PwpcQus.exe
  C:\Windows\System\PwpcQus.exe
  2⤵
  PID:1672
- C:\Windows\System\rbSCxvV.exe
  C:\Windows\System\rbSCxvV.exe
  2⤵
  PID:1052
- C:\Windows\System\yyHIdlA.exe
  C:\Windows\System\yyHIdlA.exe
  2⤵
  PID:3104
- C:\Windows\System\AZddfJS.exe
  C:\Windows\System\AZddfJS.exe
  2⤵
  PID:2844
- C:\Windows\System\OwuMkes.exe
  C:\Windows\System\OwuMkes.exe
  2⤵
  PID:640
- C:\Windows\System\pqVgPJO.exe
  C:\Windows\System\pqVgPJO.exe
  2⤵
  PID:1688
- C:\Windows\System\WeMLkcL.exe
  C:\Windows\System\WeMLkcL.exe
  2⤵
  PID:1444
- C:\Windows\System\GDlXTUy.exe
  C:\Windows\System\GDlXTUy.exe
  2⤵
  PID:3216
- C:\Windows\System\GLeqyvk.exe
  C:\Windows\System\GLeqyvk.exe
  2⤵
  PID:1924
- C:\Windows\System\JgQhWyg.exe
  C:\Windows\System\JgQhWyg.exe
  2⤵
  PID:1288
- C:\Windows\System\WBXsSPM.exe
  C:\Windows\System\WBXsSPM.exe
  2⤵
  PID:1968
- C:\Windows\System\HEwhKBm.exe
  C:\Windows\System\HEwhKBm.exe
  2⤵
  PID:2324
- C:\Windows\System\BCqJVFX.exe
  C:\Windows\System\BCqJVFX.exe
  2⤵
  PID:304
- C:\Windows\System\mapyTUB.exe
  C:\Windows\System\mapyTUB.exe
  2⤵
  PID:3524
- C:\Windows\System\BLizbLE.exe
  C:\Windows\System\BLizbLE.exe
  2⤵
  PID:3156
- C:\Windows\System\lyucTUF.exe
  C:\Windows\System\lyucTUF.exe
  2⤵
  PID:3192
- C:\Windows\System\XzTpJNH.exe
  C:\Windows\System\XzTpJNH.exe
  2⤵
  PID:3260
- C:\Windows\System\qkfqGIN.exe
  C:\Windows\System\qkfqGIN.exe
  2⤵
  PID:3280
- C:\Windows\System\wGVixoq.exe
  C:\Windows\System\wGVixoq.exe
  2⤵
  PID:3296
- C:\Windows\System\ygtkdZl.exe
  C:\Windows\System\ygtkdZl.exe
  2⤵
  PID:3312
- C:\Windows\System\DsVSKsL.exe
  C:\Windows\System\DsVSKsL.exe
  2⤵
  PID:3412
- C:\Windows\System\qoMCKmu.exe
  C:\Windows\System\qoMCKmu.exe
  2⤵
  PID:1712
- C:\Windows\System\LIYsbnC.exe
  C:\Windows\System\LIYsbnC.exe
  2⤵
  PID:1632
- C:\Windows\System\KoFNSZF.exe
  C:\Windows\System\KoFNSZF.exe
  2⤵
  PID:2052
- C:\Windows\System\DrXblVA.exe
  C:\Windows\System\DrXblVA.exe
  2⤵
  PID:2964
- C:\Windows\System\shjjqEe.exe
  C:\Windows\System\shjjqEe.exe
  2⤵
  PID:3572
- C:\Windows\System\cZclHjH.exe
  C:\Windows\System\cZclHjH.exe
  2⤵
  PID:3608
- C:\Windows\System\XxogJMg.exe
  C:\Windows\System\XxogJMg.exe
  2⤵
  PID:3648
- C:\Windows\System\qazmtxO.exe
  C:\Windows\System\qazmtxO.exe
  2⤵
  PID:3712
- C:\Windows\System\VXCboKk.exe
  C:\Windows\System\VXCboKk.exe
  2⤵
  PID:3808
- C:\Windows\System\yfWIeci.exe
  C:\Windows\System\yfWIeci.exe
  2⤵
  PID:3872
- C:\Windows\System\TZCoZqG.exe
  C:\Windows\System\TZCoZqG.exe
  2⤵
  PID:3948
- C:\Windows\System\tjYgkpz.exe
  C:\Windows\System\tjYgkpz.exe
  2⤵
  PID:4012
- C:\Windows\System\QVszjMU.exe
  C:\Windows\System\QVszjMU.exe
  2⤵
  PID:4056
- C:\Windows\System\yxiRhSF.exe
  C:\Windows\System\yxiRhSF.exe
  2⤵
  PID:2800
- C:\Windows\System\lSyJpOV.exe
  C:\Windows\System\lSyJpOV.exe
  2⤵
  PID:3172
- C:\Windows\System\jdhmCcG.exe
  C:\Windows\System\jdhmCcG.exe
  2⤵
  PID:3796
- C:\Windows\System\mcKQxhA.exe
  C:\Windows\System\mcKQxhA.exe
  2⤵
  PID:3960
- C:\Windows\System\puaPwsR.exe
  C:\Windows\System\puaPwsR.exe
  2⤵
  PID:3996
- C:\Windows\System\QSwcaMm.exe
  C:\Windows\System\QSwcaMm.exe
  2⤵
  PID:4072
- C:\Windows\System\RwZsFeO.exe
  C:\Windows\System\RwZsFeO.exe
  2⤵
  PID:3100
- C:\Windows\System\UIasCCI.exe
  C:\Windows\System\UIasCCI.exe
  2⤵
  PID:2436
- C:\Windows\System\chUcerH.exe
  C:\Windows\System\chUcerH.exe
  2⤵
  PID:1600
- C:\Windows\System\ABDbKru.exe
  C:\Windows\System\ABDbKru.exe
  2⤵
  PID:3828
- C:\Windows\System\OHKwTbA.exe
  C:\Windows\System\OHKwTbA.exe
  2⤵
  PID:3984
- C:\Windows\System\sldtAll.exe
  C:\Windows\System\sldtAll.exe
  2⤵
  PID:4052
- C:\Windows\System\CoZruMo.exe
  C:\Windows\System\CoZruMo.exe
  2⤵
  PID:500
- C:\Windows\System\hGoRAYf.exe
  C:\Windows\System\hGoRAYf.exe
  2⤵
  PID:3468
- C:\Windows\System\iYspueD.exe
  C:\Windows\System\iYspueD.exe
  2⤵
  PID:3488
- C:\Windows\System\SNLfrgo.exe
  C:\Windows\System\SNLfrgo.exe
  2⤵
  PID:3228
- C:\Windows\System\fXJEhKj.exe
  C:\Windows\System\fXJEhKj.exe
  2⤵
  PID:1144
- C:\Windows\System\jSxkgFB.exe
  C:\Windows\System\jSxkgFB.exe
  2⤵
  PID:3120
- C:\Windows\System\hCwthrQ.exe
  C:\Windows\System\hCwthrQ.exe
  2⤵
  PID:3696
- C:\Windows\System\eaZoLou.exe
  C:\Windows\System\eaZoLou.exe
  2⤵
  PID:3184
- C:\Windows\System\zqPPFwm.exe
  C:\Windows\System\zqPPFwm.exe
  2⤵
  PID:3420
- C:\Windows\System\gDQWanY.exe
  C:\Windows\System\gDQWanY.exe
  2⤵
  PID:2176
- C:\Windows\System\hjnGelR.exe
  C:\Windows\System\hjnGelR.exe
  2⤵
  PID:3644
- C:\Windows\System\ubwJmtb.exe
  C:\Windows\System\ubwJmtb.exe
  2⤵
  PID:3944
- C:\Windows\System\Byrhbgx.exe
  C:\Windows\System\Byrhbgx.exe
  2⤵
  PID:3928
- C:\Windows\System\YoODHrJ.exe
  C:\Windows\System\YoODHrJ.exe
  2⤵
  PID:3628
- C:\Windows\System\DpiIgIt.exe
  C:\Windows\System\DpiIgIt.exe
  2⤵
  PID:3776
- C:\Windows\System\ZeBWPzl.exe
  C:\Windows\System\ZeBWPzl.exe
  2⤵
  PID:4020
- C:\Windows\System\bJdfYOY.exe
  C:\Windows\System\bJdfYOY.exe
  2⤵
  PID:3168
- C:\Windows\System\tzeswrH.exe
  C:\Windows\System\tzeswrH.exe
  2⤵
  PID:3924
- C:\Windows\System\hBjQtJi.exe
  C:\Windows\System\hBjQtJi.exe
  2⤵
  PID:2920
- C:\Windows\System\nmzZdAt.exe
  C:\Windows\System\nmzZdAt.exe
  2⤵
  PID:4112
- C:\Windows\System\VNszmWi.exe
  C:\Windows\System\VNszmWi.exe
  2⤵
  PID:4132
- C:\Windows\System\arorJBp.exe
  C:\Windows\System\arorJBp.exe
  2⤵
  PID:4152
- C:\Windows\System\FPYTleh.exe
  C:\Windows\System\FPYTleh.exe
  2⤵
  PID:4168
- C:\Windows\System\ZrFLifL.exe
  C:\Windows\System\ZrFLifL.exe
  2⤵
  PID:4184
- C:\Windows\System\zdXRMGG.exe
  C:\Windows\System\zdXRMGG.exe
  2⤵
  PID:4204
- C:\Windows\System\KSRoive.exe
  C:\Windows\System\KSRoive.exe
  2⤵
  PID:4220
- C:\Windows\System\coQzgiU.exe
  C:\Windows\System\coQzgiU.exe
  2⤵
  PID:4240
- C:\Windows\System\SRMNeVz.exe
  C:\Windows\System\SRMNeVz.exe
  2⤵
  PID:4260
- C:\Windows\System\udhRMFp.exe
  C:\Windows\System\udhRMFp.exe
  2⤵
  PID:4276
- C:\Windows\System\BUCXrCb.exe
  C:\Windows\System\BUCXrCb.exe
  2⤵
  PID:4296
- C:\Windows\System\rTtWBPU.exe
  C:\Windows\System\rTtWBPU.exe
  2⤵
  PID:4316
- C:\Windows\System\JhjEFqM.exe
  C:\Windows\System\JhjEFqM.exe
  2⤵
  PID:4336
- C:\Windows\System\MxoflAo.exe
  C:\Windows\System\MxoflAo.exe
  2⤵
  PID:4356
- C:\Windows\System\LBBMUuP.exe
  C:\Windows\System\LBBMUuP.exe
  2⤵
  PID:4384
- C:\Windows\System\IakBKlU.exe
  C:\Windows\System\IakBKlU.exe
  2⤵
  PID:4412
- C:\Windows\System\CjskmYs.exe
  C:\Windows\System\CjskmYs.exe
  2⤵
  PID:4432
- C:\Windows\System\LEulraJ.exe
  C:\Windows\System\LEulraJ.exe
  2⤵
  PID:4452
- C:\Windows\System\ElswHFc.exe
  C:\Windows\System\ElswHFc.exe
  2⤵
  PID:4556
- C:\Windows\System\GPyjIzo.exe
  C:\Windows\System\GPyjIzo.exe
  2⤵
  PID:4612
- C:\Windows\System\tbSUVgr.exe
  C:\Windows\System\tbSUVgr.exe
  2⤵
  PID:4628
- C:\Windows\System\EMuZMEQ.exe
  C:\Windows\System\EMuZMEQ.exe
  2⤵
  PID:4644
- C:\Windows\System\BPLroGw.exe
  C:\Windows\System\BPLroGw.exe
  2⤵
  PID:4660
- C:\Windows\System\UlDgVvX.exe
  C:\Windows\System\UlDgVvX.exe
  2⤵
  PID:4676
- C:\Windows\System\CLDbEuG.exe
  C:\Windows\System\CLDbEuG.exe
  2⤵
  PID:4692
- C:\Windows\System\tRrBrPC.exe
  C:\Windows\System\tRrBrPC.exe
  2⤵
  PID:4708
- C:\Windows\System\cvtarBU.exe
  C:\Windows\System\cvtarBU.exe
  2⤵
  PID:4724
- C:\Windows\System\rynspQJ.exe
  C:\Windows\System\rynspQJ.exe
  2⤵
  PID:4744
- C:\Windows\System\JZsCrWi.exe
  C:\Windows\System\JZsCrWi.exe
  2⤵
  PID:4760
- C:\Windows\System\WqJfFlL.exe
  C:\Windows\System\WqJfFlL.exe
  2⤵
  PID:4776
- C:\Windows\System\LCfMAAN.exe
  C:\Windows\System\LCfMAAN.exe
  2⤵
  PID:4792
- C:\Windows\System\cWKCPfV.exe
  C:\Windows\System\cWKCPfV.exe
  2⤵
  PID:4860
- C:\Windows\System\KvGJGFQ.exe
  C:\Windows\System\KvGJGFQ.exe
  2⤵
  PID:4876
- C:\Windows\System\wnlcKfm.exe
  C:\Windows\System\wnlcKfm.exe
  2⤵
  PID:4892
- C:\Windows\System\tszIOyr.exe
  C:\Windows\System\tszIOyr.exe
  2⤵
  PID:4908
- C:\Windows\System\kqDMucB.exe
  C:\Windows\System\kqDMucB.exe
  2⤵
  PID:4924
- C:\Windows\System\fvFpllx.exe
  C:\Windows\System\fvFpllx.exe
  2⤵
  PID:4948
- C:\Windows\System\skagrKZ.exe
  C:\Windows\System\skagrKZ.exe
  2⤵
  PID:4964
- C:\Windows\System\YOmqmZm.exe
  C:\Windows\System\YOmqmZm.exe
  2⤵
  PID:4984
- C:\Windows\System\ihRCmiV.exe
  C:\Windows\System\ihRCmiV.exe
  2⤵
  PID:5000
- C:\Windows\System\VSwifaX.exe
  C:\Windows\System\VSwifaX.exe
  2⤵
  PID:5020
- C:\Windows\System\dTerGbA.exe
  C:\Windows\System\dTerGbA.exe
  2⤵
  PID:5036
- C:\Windows\System\mLFvluD.exe
  C:\Windows\System\mLFvluD.exe
  2⤵
  PID:5052
- C:\Windows\System\AcXyUmE.exe
  C:\Windows\System\AcXyUmE.exe
  2⤵
  PID:5072
- C:\Windows\System\WfRPeUR.exe
  C:\Windows\System\WfRPeUR.exe
  2⤵
  PID:5088
- C:\Windows\System\JraoZqv.exe
  C:\Windows\System\JraoZqv.exe
  2⤵
  PID:5108
- C:\Windows\System\ZzDHYha.exe
  C:\Windows\System\ZzDHYha.exe
  2⤵
  PID:3780
- C:\Windows\System\pJVohYw.exe
  C:\Windows\System\pJVohYw.exe
  2⤵
  PID:3856
- C:\Windows\System\MigRioc.exe
  C:\Windows\System\MigRioc.exe
  2⤵
  PID:4104
- C:\Windows\System\VgcwKNg.exe
  C:\Windows\System\VgcwKNg.exe
  2⤵
  PID:4176
- C:\Windows\System\waKwySj.exe
  C:\Windows\System\waKwySj.exe
  2⤵
  PID:4248
- C:\Windows\System\ijtKWxS.exe
  C:\Windows\System\ijtKWxS.exe
  2⤵
  PID:4284
- C:\Windows\System\meSZfpj.exe
  C:\Windows\System\meSZfpj.exe
  2⤵
  PID:1252
- C:\Windows\System\egqqwpi.exe
  C:\Windows\System\egqqwpi.exe
  2⤵
  PID:4368
- C:\Windows\System\AKwmBCa.exe
  C:\Windows\System\AKwmBCa.exe
  2⤵
  PID:4420
- C:\Windows\System\sQYzSEN.exe
  C:\Windows\System\sQYzSEN.exe
  2⤵
  PID:4464
- C:\Windows\System\gKnqZYf.exe
  C:\Windows\System\gKnqZYf.exe
  2⤵
  PID:2968
- C:\Windows\System\HkpLdCk.exe
  C:\Windows\System\HkpLdCk.exe
  2⤵
  PID:4496
- C:\Windows\System\OrqLyvW.exe
  C:\Windows\System\OrqLyvW.exe
  2⤵
  PID:4512
- C:\Windows\System\AJBvJlA.exe
  C:\Windows\System\AJBvJlA.exe
  2⤵
  PID:4532
- C:\Windows\System\HDcAGHV.exe
  C:\Windows\System\HDcAGHV.exe
  2⤵
  PID:3132
- C:\Windows\System\jxeIxEw.exe
  C:\Windows\System\jxeIxEw.exe
  2⤵
  PID:3200
- C:\Windows\System\rqfvSxo.exe
  C:\Windows\System\rqfvSxo.exe
  2⤵
  PID:3348
- C:\Windows\System\xpcoeah.exe
  C:\Windows\System\xpcoeah.exe
  2⤵
  PID:620
- C:\Windows\System\LGyHeUj.exe
  C:\Windows\System\LGyHeUj.exe
  2⤵
  PID:3624
- C:\Windows\System\yvdqaEV.exe
  C:\Windows\System\yvdqaEV.exe
  2⤵
  PID:3844
- C:\Windows\System\WdCHeay.exe
  C:\Windows\System\WdCHeay.exe
  2⤵
  PID:4092
- C:\Windows\System\EvewEhJ.exe
  C:\Windows\System\EvewEhJ.exe
  2⤵
  PID:3964
- C:\Windows\System\TbvJLOJ.exe
  C:\Windows\System\TbvJLOJ.exe
  2⤵
  PID:2596
- C:\Windows\System\YqnJGDr.exe
  C:\Windows\System\YqnJGDr.exe
  2⤵
  PID:4088
- C:\Windows\System\OLqLuGJ.exe
  C:\Windows\System\OLqLuGJ.exe
  2⤵
  PID:3472
- C:\Windows\System\IwQwdep.exe
  C:\Windows\System\IwQwdep.exe
  2⤵
  PID:3508
- C:\Windows\System\rDAUZym.exe
  C:\Windows\System\rDAUZym.exe
  2⤵
  PID:3500
- C:\Windows\System\cImbhPM.exe
  C:\Windows\System\cImbhPM.exe
  2⤵
  PID:3504
- C:\Windows\System\wwfpkbM.exe
  C:\Windows\System\wwfpkbM.exe
  2⤵
  PID:4048
- C:\Windows\System\lloAsUT.exe
  C:\Windows\System\lloAsUT.exe
  2⤵
  PID:2588
- C:\Windows\System\qDEFbOm.exe
  C:\Windows\System\qDEFbOm.exe
  2⤵
  PID:3324
- C:\Windows\System\TdXwloS.exe
  C:\Windows\System\TdXwloS.exe
  2⤵
  PID:4128
- C:\Windows\System\tMABfak.exe
  C:\Windows\System\tMABfak.exe
  2⤵
  PID:4200
- C:\Windows\System\IowJXuD.exe
  C:\Windows\System\IowJXuD.exe
  2⤵
  PID:4268
- C:\Windows\System\rXtwUfV.exe
  C:\Windows\System\rXtwUfV.exe
  2⤵
  PID:4344
- C:\Windows\System\kUuloys.exe
  C:\Windows\System\kUuloys.exe
  2⤵
  PID:4396
- C:\Windows\System\gamUqgx.exe
  C:\Windows\System\gamUqgx.exe
  2⤵
  PID:4440
- C:\Windows\System\QXDazlo.exe
  C:\Windows\System\QXDazlo.exe
  2⤵
  PID:2768
- C:\Windows\System\GxqXSPj.exe
  C:\Windows\System\GxqXSPj.exe
  2⤵
  PID:4652
- C:\Windows\System\hxJnaVh.exe
  C:\Windows\System\hxJnaVh.exe
  2⤵
  PID:4720
- C:\Windows\System\APqooeC.exe
  C:\Windows\System\APqooeC.exe
  2⤵
  PID:4788
- C:\Windows\System\CGSQlrt.exe
  C:\Windows\System\CGSQlrt.exe
  2⤵
  PID:4588
- C:\Windows\System\ciYZYby.exe
  C:\Windows\System\ciYZYby.exe
  2⤵
  PID:4704
- C:\Windows\System\YTQQmYt.exe
  C:\Windows\System\YTQQmYt.exe
  2⤵
  PID:4772
- C:\Windows\System\CUpnfbx.exe
  C:\Windows\System\CUpnfbx.exe
  2⤵
  PID:4820
- C:\Windows\System\rPowTHn.exe
  C:\Windows\System\rPowTHn.exe
  2⤵
  PID:4844
- C:\Windows\System\qhFFOzl.exe
  C:\Windows\System\qhFFOzl.exe
  2⤵
  PID:4884
- C:\Windows\System\CjcdXMC.exe
  C:\Windows\System\CjcdXMC.exe
  2⤵
  PID:4904
- C:\Windows\System\fsXKRag.exe
  C:\Windows\System\fsXKRag.exe
  2⤵
  PID:5008
- C:\Windows\System\FbOgCPZ.exe
  C:\Windows\System\FbOgCPZ.exe
  2⤵
  PID:5048
- C:\Windows\System\EBgeWZr.exe
  C:\Windows\System\EBgeWZr.exe
  2⤵
  PID:3328
- C:\Windows\System\fAXfeSE.exe
  C:\Windows\System\fAXfeSE.exe
  2⤵
  PID:2604
- C:\Windows\System\oBunLri.exe
  C:\Windows\System\oBunLri.exe
  2⤵
  PID:4292
- C:\Windows\System\wwRwAva.exe
  C:\Windows\System\wwRwAva.exe
  2⤵
  PID:4480
- C:\Windows\System\RdiVZWv.exe
  C:\Windows\System\RdiVZWv.exe
  2⤵
  PID:4544
- C:\Windows\System\fbePkHP.exe
  C:\Windows\System\fbePkHP.exe
  2⤵
  PID:1192
- C:\Windows\System\gIRzrVg.exe
  C:\Windows\System\gIRzrVg.exe
  2⤵
  PID:3008
- C:\Windows\System\NJrfXLU.exe
  C:\Windows\System\NJrfXLU.exe
  2⤵
  PID:3728
- C:\Windows\System\uAnNuRl.exe
  C:\Windows\System\uAnNuRl.exe
  2⤵
  PID:3440
- C:\Windows\System\znKPmMT.exe
  C:\Windows\System\znKPmMT.exe
  2⤵
  PID:4304
- C:\Windows\System\aPxfkKl.exe
  C:\Windows\System\aPxfkKl.exe
  2⤵
  PID:4404
- C:\Windows\System\OvcxvUq.exe
  C:\Windows\System\OvcxvUq.exe
  2⤵
  PID:4916
- C:\Windows\System\VlPkDYn.exe
  C:\Windows\System\VlPkDYn.exe
  2⤵
  PID:4992
- C:\Windows\System\YfkPmoZ.exe
  C:\Windows\System\YfkPmoZ.exe
  2⤵
  PID:5064
- C:\Windows\System\oBHIhxo.exe
  C:\Windows\System\oBHIhxo.exe
  2⤵
  PID:5104
- C:\Windows\System\BwQCgsX.exe
  C:\Windows\System\BwQCgsX.exe
  2⤵
  PID:4256
- C:\Windows\System\CpmUfeT.exe
  C:\Windows\System\CpmUfeT.exe
  2⤵
  PID:4364
- C:\Windows\System\xophghq.exe
  C:\Windows\System\xophghq.exe
  2⤵
  PID:2696
- C:\Windows\System\nGEIQhO.exe
  C:\Windows\System\nGEIQhO.exe
  2⤵
  PID:4784
- C:\Windows\System\WyXUcqP.exe
  C:\Windows\System\WyXUcqP.exe
  2⤵
  PID:4636
- C:\Windows\System\HaqifHM.exe
  C:\Windows\System\HaqifHM.exe
  2⤵
  PID:4804
- C:\Windows\System\VLFHhhQ.exe
  C:\Windows\System\VLFHhhQ.exe
  2⤵
  PID:4856
- C:\Windows\System\CqRLigL.exe
  C:\Windows\System\CqRLigL.exe
  2⤵
  PID:5124
- C:\Windows\System\lVYzOgX.exe
  C:\Windows\System\lVYzOgX.exe
  2⤵
  PID:5144
- C:\Windows\System\GpGhSjy.exe
  C:\Windows\System\GpGhSjy.exe
  2⤵
  PID:5160
- C:\Windows\System\HshUKFw.exe
  C:\Windows\System\HshUKFw.exe
  2⤵
  PID:5184
- C:\Windows\System\lSJrgjL.exe
  C:\Windows\System\lSJrgjL.exe
  2⤵
  PID:5204
- C:\Windows\System\NjBcjtZ.exe
  C:\Windows\System\NjBcjtZ.exe
  2⤵
  PID:5224
- C:\Windows\System\XDCXopT.exe
  C:\Windows\System\XDCXopT.exe
  2⤵
  PID:5240
- C:\Windows\System\CrnaLhv.exe
  C:\Windows\System\CrnaLhv.exe
  2⤵
  PID:5256
- C:\Windows\System\YnEUmWE.exe
  C:\Windows\System\YnEUmWE.exe
  2⤵
  PID:5276
- C:\Windows\System\mAoZLAk.exe
  C:\Windows\System\mAoZLAk.exe
  2⤵
  PID:5296
- C:\Windows\System\bIxDdXj.exe
  C:\Windows\System\bIxDdXj.exe
  2⤵
  PID:5316
- C:\Windows\System\AgPRCbt.exe
  C:\Windows\System\AgPRCbt.exe
  2⤵
  PID:5336
- C:\Windows\System\XBOSbsH.exe
  C:\Windows\System\XBOSbsH.exe
  2⤵
  PID:5352
- C:\Windows\System\uzRfBUI.exe
  C:\Windows\System\uzRfBUI.exe
  2⤵
  PID:5372
- C:\Windows\System\WXzMVyD.exe
  C:\Windows\System\WXzMVyD.exe
  2⤵
  PID:5392
- C:\Windows\System\tYfbesf.exe
  C:\Windows\System\tYfbesf.exe
  2⤵
  PID:5412
- C:\Windows\System\OxftVfe.exe
  C:\Windows\System\OxftVfe.exe
  2⤵
  PID:5432
- C:\Windows\System\NrYOCcS.exe
  C:\Windows\System\NrYOCcS.exe
  2⤵
  PID:5448
- C:\Windows\System\UqpdhCb.exe
  C:\Windows\System\UqpdhCb.exe
  2⤵
  PID:5464
- C:\Windows\System\DeNobju.exe
  C:\Windows\System\DeNobju.exe
  2⤵
  PID:5488
- C:\Windows\System\tKjjVmy.exe
  C:\Windows\System\tKjjVmy.exe
  2⤵
  PID:5508
- C:\Windows\System\SBoNYwN.exe
  C:\Windows\System\SBoNYwN.exe
  2⤵
  PID:5532
- C:\Windows\System\UQgDgvq.exe
  C:\Windows\System\UQgDgvq.exe
  2⤵
  PID:5552
- C:\Windows\System\VVbUzWM.exe
  C:\Windows\System\VVbUzWM.exe
  2⤵
  PID:5572
- C:\Windows\System\eNlYbqn.exe
  C:\Windows\System\eNlYbqn.exe
  2⤵
  PID:5588
- C:\Windows\System\UdiSDJJ.exe
  C:\Windows\System\UdiSDJJ.exe
  2⤵
  PID:5608
- C:\Windows\System\CJPjXdO.exe
  C:\Windows\System\CJPjXdO.exe
  2⤵
  PID:5628
- C:\Windows\System\bYEOpKR.exe
  C:\Windows\System\bYEOpKR.exe
  2⤵
  PID:5644
- C:\Windows\System\KBuYDDS.exe
  C:\Windows\System\KBuYDDS.exe
  2⤵
  PID:5664
- C:\Windows\System\qAlQwOa.exe
  C:\Windows\System\qAlQwOa.exe
  2⤵
  PID:5684
- C:\Windows\System\FWVykXJ.exe
  C:\Windows\System\FWVykXJ.exe
  2⤵
  PID:5700
- C:\Windows\System\ijlPmoI.exe
  C:\Windows\System\ijlPmoI.exe
  2⤵
  PID:5720
- C:\Windows\System\CEJbGSG.exe
  C:\Windows\System\CEJbGSG.exe
  2⤵
  PID:5740
- C:\Windows\System\dbidJst.exe
  C:\Windows\System\dbidJst.exe
  2⤵
  PID:5756
- C:\Windows\System\iPpemLv.exe
  C:\Windows\System\iPpemLv.exe
  2⤵
  PID:5772
- C:\Windows\System\EJYblip.exe
  C:\Windows\System\EJYblip.exe
  2⤵
  PID:5788
- C:\Windows\System\OQnNIKC.exe
  C:\Windows\System\OQnNIKC.exe
  2⤵
  PID:5804
- C:\Windows\System\IqaiiUw.exe
  C:\Windows\System\IqaiiUw.exe
  2⤵
  PID:5832
- C:\Windows\System\hRsfIRN.exe
  C:\Windows\System\hRsfIRN.exe
  2⤵
  PID:5876
- C:\Windows\System\hFYMyGQ.exe
  C:\Windows\System\hFYMyGQ.exe
  2⤵
  PID:5896
- C:\Windows\System\CHBikak.exe
  C:\Windows\System\CHBikak.exe
  2⤵
  PID:5912
- C:\Windows\System\fcBmkno.exe
  C:\Windows\System\fcBmkno.exe
  2⤵
  PID:5932
- C:\Windows\System\VZHBEwp.exe
  C:\Windows\System\VZHBEwp.exe
  2⤵
  PID:6036
- C:\Windows\System\sJDbSya.exe
  C:\Windows\System\sJDbSya.exe
  2⤵
  PID:6052
- C:\Windows\System\UtESkGN.exe
  C:\Windows\System\UtESkGN.exe
  2⤵
  PID:6068
- C:\Windows\System\QYZGDcy.exe
  C:\Windows\System\QYZGDcy.exe
  2⤵
  PID:6088
- C:\Windows\System\lSSDIFp.exe
  C:\Windows\System\lSSDIFp.exe
  2⤵
  PID:6108
- C:\Windows\System\pDrIvrc.exe
  C:\Windows\System\pDrIvrc.exe
  2⤵
  PID:6128
- C:\Windows\System\TOUhKst.exe
  C:\Windows\System\TOUhKst.exe
  2⤵
  PID:4212
- C:\Windows\System\twbNIVf.exe
  C:\Windows\System\twbNIVf.exe
  2⤵
  PID:3044
- C:\Windows\System\KAPnzPB.exe
  C:\Windows\System\KAPnzPB.exe
  2⤵
  PID:2184
- C:\Windows\System\Tzdipiu.exe
  C:\Windows\System\Tzdipiu.exe
  2⤵
  PID:5096
- C:\Windows\System\UjwTTTE.exe
  C:\Windows\System\UjwTTTE.exe
  2⤵
  PID:4940
- C:\Windows\System\bHCDkqz.exe
  C:\Windows\System\bHCDkqz.exe
  2⤵
  PID:4672
- C:\Windows\System\vNMKcWN.exe
  C:\Windows\System\vNMKcWN.exe
  2⤵
  PID:2748
- C:\Windows\System\SMyAIoa.exe
  C:\Windows\System\SMyAIoa.exe
  2⤵
  PID:5196
- C:\Windows\System\TMkaURU.exe
  C:\Windows\System\TMkaURU.exe
  2⤵
  PID:5272
- C:\Windows\System\GjiAOJC.exe
  C:\Windows\System\GjiAOJC.exe
  2⤵
  PID:4960
- C:\Windows\System\LNcVhUV.exe
  C:\Windows\System\LNcVhUV.exe
  2⤵
  PID:5380
- C:\Windows\System\qvZhUGE.exe
  C:\Windows\System\qvZhUGE.exe
  2⤵
  PID:5456
- C:\Windows\System\MlCguVJ.exe
  C:\Windows\System\MlCguVJ.exe
  2⤵
  PID:4488
- C:\Windows\System\iOtdTjf.exe
  C:\Windows\System\iOtdTjf.exe
  2⤵
  PID:1516
- C:\Windows\System\fhVbqSG.exe
  C:\Windows\System\fhVbqSG.exe
  2⤵
  PID:5544
- C:\Windows\System\YEBjgTF.exe
  C:\Windows\System\YEBjgTF.exe
  2⤵
  PID:5620
- C:\Windows\System\kkaDpRm.exe
  C:\Windows\System\kkaDpRm.exe
  2⤵
  PID:5660
- C:\Windows\System\XgicGRA.exe
  C:\Windows\System\XgicGRA.exe
  2⤵
  PID:5736
- C:\Windows\System\nqpnoxj.exe
  C:\Windows\System\nqpnoxj.exe
  2⤵
  PID:5908
- C:\Windows\System\IbZCXKo.exe
  C:\Windows\System\IbZCXKo.exe
  2⤵
  PID:5976
- C:\Windows\System\yvbHDdY.exe
  C:\Windows\System\yvbHDdY.exe
  2⤵
  PID:5996
- C:\Windows\System\RfNQfQI.exe
  C:\Windows\System\RfNQfQI.exe
  2⤵
  PID:5952
- C:\Windows\System\tDXeOQV.exe
  C:\Windows\System\tDXeOQV.exe
  2⤵
  PID:6000
- C:\Windows\System\BBefflY.exe
  C:\Windows\System\BBefflY.exe
  2⤵
  PID:6096
- C:\Windows\System\ZweDIKy.exe
  C:\Windows\System\ZweDIKy.exe
  2⤵
  PID:6140
- C:\Windows\System\RbyNrrt.exe
  C:\Windows\System\RbyNrrt.exe
  2⤵
  PID:3436
- C:\Windows\System\TmgBWmO.exe
  C:\Windows\System\TmgBWmO.exe
  2⤵
  PID:4976
- C:\Windows\System\sIhIOsa.exe
  C:\Windows\System\sIhIOsa.exe
  2⤵
  PID:2760
- C:\Windows\System\SNlNXrI.exe
  C:\Windows\System\SNlNXrI.exe
  2⤵
  PID:5348
- C:\Windows\System\YZgArlF.exe
  C:\Windows\System\YZgArlF.exe
  2⤵
  PID:5500
- C:\Windows\System\KVmwOTy.exe
  C:\Windows\System\KVmwOTy.exe
  2⤵
  PID:2536
- C:\Windows\System\tmMrzgB.exe
  C:\Windows\System\tmMrzgB.exe
  2⤵
  PID:3792
- C:\Windows\System\hUoYoQT.exe
  C:\Windows\System\hUoYoQT.exe
  2⤵
  PID:3232
- C:\Windows\System\wWiEKyc.exe
  C:\Windows\System\wWiEKyc.exe
  2⤵
  PID:4124
- C:\Windows\System\AWDwyKj.exe
  C:\Windows\System\AWDwyKj.exe
  2⤵
  PID:5656
- C:\Windows\System\DzPGsTK.exe
  C:\Windows\System\DzPGsTK.exe
  2⤵
  PID:4352
- C:\Windows\System\LPhxpuF.exe
  C:\Windows\System\LPhxpuF.exe
  2⤵
  PID:4688
- C:\Windows\System\bJUjZHt.exe
  C:\Windows\System\bJUjZHt.exe
  2⤵
  PID:2928
- C:\Windows\System\sQehdZq.exe
  C:\Windows\System\sQehdZq.exe
  2⤵
  PID:4576
- C:\Windows\System\LTQXaMs.exe
  C:\Windows\System\LTQXaMs.exe
  2⤵
  PID:4768
- C:\Windows\System\PXGSdJU.exe
  C:\Windows\System\PXGSdJU.exe
  2⤵
  PID:4832
- C:\Windows\System\vFHejMM.exe
  C:\Windows\System\vFHejMM.exe
  2⤵
  PID:1316
- C:\Windows\System\eLKHdSU.exe
  C:\Windows\System\eLKHdSU.exe
  2⤵
  PID:5872
- C:\Windows\System\DLCWOsR.exe
  C:\Windows\System\DLCWOsR.exe
  2⤵
  PID:5812
- C:\Windows\System\JQkklHf.exe
  C:\Windows\System\JQkklHf.exe
  2⤵
  PID:2620
- C:\Windows\System\sOEAyuH.exe
  C:\Windows\System\sOEAyuH.exe
  2⤵
  PID:3292
- C:\Windows\System\FafCRZT.exe
  C:\Windows\System\FafCRZT.exe
  2⤵
  PID:4192
- C:\Windows\System\umRGoza.exe
  C:\Windows\System\umRGoza.exe
  2⤵
  PID:5060
- C:\Windows\System\UetEpoV.exe
  C:\Windows\System\UetEpoV.exe
  2⤵
  PID:4484
- C:\Windows\System\TGCxoxh.exe
  C:\Windows\System\TGCxoxh.exe
  2⤵
  PID:2704
- C:\Windows\System\bczEJLI.exe
  C:\Windows\System\bczEJLI.exe
  2⤵
  PID:5172
- C:\Windows\System\fCffUth.exe
  C:\Windows\System\fCffUth.exe
  2⤵
  PID:5220
- C:\Windows\System\ozQYkCY.exe
  C:\Windows\System\ozQYkCY.exe
  2⤵
  PID:5252
- C:\Windows\System\oqZaHlX.exe
  C:\Windows\System\oqZaHlX.exe
  2⤵
  PID:5364
- C:\Windows\System\WMeSCZB.exe
  C:\Windows\System\WMeSCZB.exe
  2⤵
  PID:5888
- C:\Windows\System\gghmucN.exe
  C:\Windows\System\gghmucN.exe
  2⤵
  PID:5404
- C:\Windows\System\BHXYAqI.exe
  C:\Windows\System\BHXYAqI.exe
  2⤵
  PID:6048
- C:\Windows\System\HYjNaRt.exe
  C:\Windows\System\HYjNaRt.exe
  2⤵
  PID:5476
- C:\Windows\System\PGnWXam.exe
  C:\Windows\System\PGnWXam.exe
  2⤵
  PID:5524
- C:\Windows\System\fgZCqSl.exe
  C:\Windows\System\fgZCqSl.exe
  2⤵
  PID:5596
- C:\Windows\System\GJICMxc.exe
  C:\Windows\System\GJICMxc.exe
  2⤵
  PID:5672
- C:\Windows\System\okoWIxl.exe
  C:\Windows\System\okoWIxl.exe
  2⤵
  PID:5708
- C:\Windows\System\qmgwXNN.exe
  C:\Windows\System\qmgwXNN.exe
  2⤵
  PID:5816
- C:\Windows\System\LhoHTKM.exe
  C:\Windows\System\LhoHTKM.exe
  2⤵
  PID:6116
- C:\Windows\System\KyUOLzQ.exe
  C:\Windows\System\KyUOLzQ.exe
  2⤵
  PID:4520
- C:\Windows\System\vaDzYIs.exe
  C:\Windows\System\vaDzYIs.exe
  2⤵
  PID:3088
- C:\Windows\System\yRPrScQ.exe
  C:\Windows\System\yRPrScQ.exe
  2⤵
  PID:5692
- C:\Windows\System\cSyCXWp.exe
  C:\Windows\System\cSyCXWp.exe
  2⤵
  PID:5960
- C:\Windows\System\PGBXtqb.exe
  C:\Windows\System\PGBXtqb.exe
  2⤵
  PID:5992
- C:\Windows\System\oIhvWXr.exe
  C:\Windows\System\oIhvWXr.exe
  2⤵
  PID:6008
- C:\Windows\System\GNjkdxT.exe
  C:\Windows\System\GNjkdxT.exe
  2⤵
  PID:6060
- C:\Windows\System\kOZbkPl.exe
  C:\Windows\System\kOZbkPl.exe
  2⤵
  PID:6104
- C:\Windows\System\Gxhfpvr.exe
  C:\Windows\System\Gxhfpvr.exe
  2⤵
  PID:4944
- C:\Windows\System\aUufcrJ.exe
  C:\Windows\System\aUufcrJ.exe
  2⤵
  PID:2500
- C:\Windows\System\pjvpJtN.exe
  C:\Windows\System\pjvpJtN.exe
  2⤵
  PID:5268
- C:\Windows\System\eeXRRIj.exe
  C:\Windows\System\eeXRRIj.exe
  2⤵
  PID:3684
- C:\Windows\System\uUWZzuJ.exe
  C:\Windows\System\uUWZzuJ.exe
  2⤵
  PID:4572
- C:\Windows\System\dLUMJnl.exe
  C:\Windows\System\dLUMJnl.exe
  2⤵
  PID:5844
- C:\Windows\System\QOStZmw.exe
  C:\Windows\System\QOStZmw.exe
  2⤵
  PID:5116
- C:\Windows\System\NluJlOA.exe
  C:\Windows\System\NluJlOA.exe
  2⤵
  PID:3400
- C:\Windows\System\CDxqpRp.exe
  C:\Windows\System\CDxqpRp.exe
  2⤵
  PID:5016
- C:\Windows\System\wnDRpkb.exe
  C:\Windows\System\wnDRpkb.exe
  2⤵
  PID:5168
- C:\Windows\System\AUKOoWO.exe
  C:\Windows\System\AUKOoWO.exe
  2⤵
  PID:5884
- C:\Windows\System\fujnknp.exe
  C:\Windows\System\fujnknp.exe
  2⤵
  PID:3968
- C:\Windows\System\QkHTErr.exe
  C:\Windows\System\QkHTErr.exe
  2⤵
  PID:5444
- C:\Windows\System\lDWtdrT.exe
  C:\Windows\System\lDWtdrT.exe
  2⤵
  PID:5768
- C:\Windows\System\INmFLcT.exe
  C:\Windows\System\INmFLcT.exe
  2⤵
  PID:5640
- C:\Windows\System\IFxJEAI.exe
  C:\Windows\System\IFxJEAI.exe
  2⤵
  PID:5780
- C:\Windows\System\urscLqO.exe
  C:\Windows\System\urscLqO.exe
  2⤵
  PID:4508
- C:\Windows\System\KwfiHsh.exe
  C:\Windows\System\KwfiHsh.exe
  2⤵
  PID:3276
- C:\Windows\System\yZQxQPY.exe
  C:\Windows\System\yZQxQPY.exe
  2⤵
  PID:4756
- C:\Windows\System\BzZwBhv.exe
  C:\Windows\System\BzZwBhv.exe
  2⤵
  PID:5192
- C:\Windows\System\TErtnHS.exe
  C:\Windows\System\TErtnHS.exe
  2⤵
  PID:4840
- C:\Windows\System\NBIkKGR.exe
  C:\Windows\System\NBIkKGR.exe
  2⤵
  PID:5940
- C:\Windows\System\JrMfrOl.exe
  C:\Windows\System\JrMfrOl.exe
  2⤵
  PID:5472
- C:\Windows\System\BmqhGXi.exe
  C:\Windows\System\BmqhGXi.exe
  2⤵
  PID:3264
- C:\Windows\System\sYLmCYR.exe
  C:\Windows\System\sYLmCYR.exe
  2⤵
  PID:4608
- C:\Windows\System\tcSiuOe.exe
  C:\Windows\System\tcSiuOe.exe
  2⤵
  PID:5328
- C:\Windows\System\EYmBiJh.exe
  C:\Windows\System\EYmBiJh.exe
  2⤵
  PID:5924
- C:\Windows\System\qLUPcFh.exe
  C:\Windows\System\qLUPcFh.exe
  2⤵
  PID:5680
- C:\Windows\System\jEtLRzl.exe
  C:\Windows\System\jEtLRzl.exe
  2⤵
  PID:2952
- C:\Windows\System\ArhAQNc.exe
  C:\Windows\System\ArhAQNc.exe
  2⤵
  PID:3512
- C:\Windows\System\ufLrNIv.exe
  C:\Windows\System\ufLrNIv.exe
  2⤵
  PID:3520
- C:\Windows\System\EeRvnVW.exe
  C:\Windows\System\EeRvnVW.exe
  2⤵
  PID:1616
- C:\Windows\System\oSvpEnp.exe
  C:\Windows\System\oSvpEnp.exe
  2⤵
  PID:5580
- C:\Windows\System\XlXzjto.exe
  C:\Windows\System\XlXzjto.exe
  2⤵
  PID:5972
- C:\Windows\System\EXhCzbm.exe
  C:\Windows\System\EXhCzbm.exe
  2⤵
  PID:2248
- C:\Windows\System\tpVOKnK.exe
  C:\Windows\System\tpVOKnK.exe
  2⤵
  PID:4448
- C:\Windows\System\WBeVWEu.exe
  C:\Windows\System\WBeVWEu.exe
  2⤵
  PID:4148
- C:\Windows\System\RqfBipf.exe
  C:\Windows\System\RqfBipf.exe
  2⤵
  PID:3288
- C:\Windows\System\PNEdpwd.exe
  C:\Windows\System\PNEdpwd.exe
  2⤵
  PID:6024
- C:\Windows\System\qWyDzcD.exe
  C:\Windows\System\qWyDzcD.exe
  2⤵
  PID:1720
- C:\Windows\System\qKBjGyO.exe
  C:\Windows\System\qKBjGyO.exe
  2⤵
  PID:5400
- C:\Windows\System\WogWjkK.exe
  C:\Windows\System\WogWjkK.exe
  2⤵
  PID:4232
- C:\Windows\System\LXmdRtP.exe
  C:\Windows\System\LXmdRtP.exe
  2⤵
  PID:5636
- C:\Windows\System\mykSXhG.exe
  C:\Windows\System\mykSXhG.exe
  2⤵
  PID:6080
- C:\Windows\System\TqTakAb.exe
  C:\Windows\System\TqTakAb.exe
  2⤵
  PID:5028
- C:\Windows\System\LWEAxNB.exe
  C:\Windows\System\LWEAxNB.exe
  2⤵
  PID:5828
- C:\Windows\System\MGzNnBa.exe
  C:\Windows\System\MGzNnBa.exe
  2⤵
  PID:5180
- C:\Windows\System\aEaSZVs.exe
  C:\Windows\System\aEaSZVs.exe
  2⤵
  PID:5216
- C:\Windows\System\XUikuNu.exe
  C:\Windows\System\XUikuNu.exe
  2⤵
  PID:5968
- C:\Windows\System\dbHcYgG.exe
  C:\Windows\System\dbHcYgG.exe
  2⤵
  PID:5852
- C:\Windows\System\vIAZZnN.exe
  C:\Windows\System\vIAZZnN.exe
  2⤵
  PID:1436
- C:\Windows\System\TXHFJkE.exe
  C:\Windows\System\TXHFJkE.exe
  2⤵
  PID:5584
- C:\Windows\System\RbvhECh.exe
  C:\Windows\System\RbvhECh.exe
  2⤵
  PID:5840
- C:\Windows\System\XKtAulu.exe
  C:\Windows\System\XKtAulu.exe
  2⤵
  PID:5516
- C:\Windows\System\KNBVRew.exe
  C:\Windows\System\KNBVRew.exe
  2⤵
  PID:5264
- C:\Windows\System\JTuUIJO.exe
  C:\Windows\System\JTuUIJO.exe
  2⤵
  PID:1860
- C:\Windows\System\VOsUxEW.exe
  C:\Windows\System\VOsUxEW.exe
  2⤵
  PID:5988
- C:\Windows\System\mHktwYM.exe
  C:\Windows\System\mHktwYM.exe
  2⤵
  PID:6124
- C:\Windows\System\hTsFGEm.exe
  C:\Windows\System\hTsFGEm.exe
  2⤵
  PID:5360
- C:\Windows\System\YnmOGqK.exe
  C:\Windows\System\YnmOGqK.exe
  2⤵
  PID:5920
- C:\Windows\System\PIlsGVj.exe
  C:\Windows\System\PIlsGVj.exe
  2⤵
  PID:5324
- C:\Windows\System\oOQAiGt.exe
  C:\Windows\System\oOQAiGt.exe
  2⤵
  PID:5084
- C:\Windows\System\ewtqxIa.exe
  C:\Windows\System\ewtqxIa.exe
  2⤵
  PID:4476
- C:\Windows\System\JakNmGH.exe
  C:\Windows\System\JakNmGH.exe
  2⤵
  PID:5944
- C:\Windows\System\sKriblh.exe
  C:\Windows\System\sKriblh.exe
  2⤵
  PID:5140
- C:\Windows\System\ylVupyy.exe
  C:\Windows\System\ylVupyy.exe
  2⤵
  PID:5388
- C:\Windows\System\hhfPHdb.exe
  C:\Windows\System\hhfPHdb.exe
  2⤵
  PID:804
- C:\Windows\System\abwGhzz.exe
  C:\Windows\System\abwGhzz.exe
  2⤵
  PID:4120
- C:\Windows\System\SFYBMYJ.exe
  C:\Windows\System\SFYBMYJ.exe
  2⤵
  PID:2432
- C:\Windows\System\IdIBDqW.exe
  C:\Windows\System\IdIBDqW.exe
  2⤵
  PID:5292
- C:\Windows\System\yjxePrr.exe
  C:\Windows\System\yjxePrr.exe
  2⤵
  PID:6032
- C:\Windows\System\LUnoHzG.exe
  C:\Windows\System\LUnoHzG.exe
  2⤵
  PID:2956
- C:\Windows\System\IHniuUJ.exe
  C:\Windows\System\IHniuUJ.exe
  2⤵
  PID:2004
- C:\Windows\System\VBSCrbS.exe
  C:\Windows\System\VBSCrbS.exe
  2⤵
  PID:2356
- C:\Windows\System\kkzAlGZ.exe
  C:\Windows\System\kkzAlGZ.exe
  2⤵
  PID:5568
- C:\Windows\System\gfHBoOy.exe
  C:\Windows\System\gfHBoOy.exe
  2⤵
  PID:2832
- C:\Windows\System\hoJcaLl.exe
  C:\Windows\System\hoJcaLl.exe
  2⤵
  PID:5752
- C:\Windows\System\UELQwwc.exe
  C:\Windows\System\UELQwwc.exe
  2⤵
  PID:4472
- C:\Windows\System\lzQkktv.exe
  C:\Windows\System\lzQkktv.exe
  2⤵
  PID:6148
- C:\Windows\System\qJAOzKG.exe
  C:\Windows\System\qJAOzKG.exe
  2⤵
  PID:6164
- C:\Windows\System\SLHcrwq.exe
  C:\Windows\System\SLHcrwq.exe
  2⤵
  PID:6188
- C:\Windows\System\whvmqRj.exe
  C:\Windows\System\whvmqRj.exe
  2⤵
  PID:6208
- C:\Windows\System\gmpPwkI.exe
  C:\Windows\System\gmpPwkI.exe
  2⤵
  PID:6232
- C:\Windows\System\UhnjwoN.exe
  C:\Windows\System\UhnjwoN.exe
  2⤵
  PID:6248
- C:\Windows\System\xejsfYF.exe
  C:\Windows\System\xejsfYF.exe
  2⤵
  PID:6264
- C:\Windows\System\yhpZcJY.exe
  C:\Windows\System\yhpZcJY.exe
  2⤵
  PID:6292
- C:\Windows\System\FLYaDJt.exe
  C:\Windows\System\FLYaDJt.exe
  2⤵
  PID:6308
- C:\Windows\System\kHNBClS.exe
  C:\Windows\System\kHNBClS.exe
  2⤵
  PID:6332
- C:\Windows\System\CxFJRvf.exe
  C:\Windows\System\CxFJRvf.exe
  2⤵
  PID:6348
- C:\Windows\System\XwVgtDe.exe
  C:\Windows\System\XwVgtDe.exe
  2⤵
  PID:6376
- C:\Windows\System\TmRsaTK.exe
  C:\Windows\System\TmRsaTK.exe
  2⤵
  PID:6396
- C:\Windows\System\uvXhAgK.exe
  C:\Windows\System\uvXhAgK.exe
  2⤵
  PID:6412
- C:\Windows\System\AkJNcBd.exe
  C:\Windows\System\AkJNcBd.exe
  2⤵
  PID:6460
- C:\Windows\System\YdqftaK.exe
  C:\Windows\System\YdqftaK.exe
  2⤵
  PID:6480
- C:\Windows\System\KKGRhVo.exe
  C:\Windows\System\KKGRhVo.exe
  2⤵
  PID:6504
- C:\Windows\System\mifRdNX.exe
  C:\Windows\System\mifRdNX.exe
  2⤵
  PID:6528
- C:\Windows\System\wyqbSks.exe
  C:\Windows\System\wyqbSks.exe
  2⤵
  PID:6544
- C:\Windows\System\hvJPWeR.exe
  C:\Windows\System\hvJPWeR.exe
  2⤵
  PID:6572
- C:\Windows\System\LEZXACK.exe
  C:\Windows\System\LEZXACK.exe
  2⤵
  PID:6592
- C:\Windows\System\BegjSGE.exe
  C:\Windows\System\BegjSGE.exe
  2⤵
  PID:6616
- C:\Windows\System\JymKazk.exe
  C:\Windows\System\JymKazk.exe
  2⤵
  PID:6640
- C:\Windows\System\GOjJUgx.exe
  C:\Windows\System\GOjJUgx.exe
  2⤵
  PID:6664
- C:\Windows\System\WMDQijp.exe
  C:\Windows\System\WMDQijp.exe
  2⤵
  PID:6684
- C:\Windows\System\lbIeohO.exe
  C:\Windows\System\lbIeohO.exe
  2⤵
  PID:6708
- C:\Windows\System\MWmxNnq.exe
  C:\Windows\System\MWmxNnq.exe
  2⤵
  PID:6728
- C:\Windows\System\LeZzaMT.exe
  C:\Windows\System\LeZzaMT.exe
  2⤵
  PID:6752
- C:\Windows\System\jztXQzM.exe
  C:\Windows\System\jztXQzM.exe
  2⤵
  PID:6772
- C:\Windows\System\EZEKBmE.exe
  C:\Windows\System\EZEKBmE.exe
  2⤵
  PID:6796
- C:\Windows\System\IzBoDay.exe
  C:\Windows\System\IzBoDay.exe
  2⤵
  PID:6816
- C:\Windows\System\qkPBSsR.exe
  C:\Windows\System\qkPBSsR.exe
  2⤵
  PID:6836
- C:\Windows\System\gbGpQLE.exe
  C:\Windows\System\gbGpQLE.exe
  2⤵
  PID:6860
- C:\Windows\System\khofZRC.exe
  C:\Windows\System\khofZRC.exe
  2⤵
  PID:6876
- C:\Windows\System\FCRyGjT.exe
  C:\Windows\System\FCRyGjT.exe
  2⤵
  PID:6896
- C:\Windows\System\sVuiNos.exe
  C:\Windows\System\sVuiNos.exe
  2⤵
  PID:6916
- C:\Windows\System\IPdaffq.exe
  C:\Windows\System\IPdaffq.exe
  2⤵
  PID:6932
- C:\Windows\System\hxfpwkk.exe
  C:\Windows\System\hxfpwkk.exe
  2⤵
  PID:6960
- C:\Windows\System\GhxRYYG.exe
  C:\Windows\System\GhxRYYG.exe
  2⤵
  PID:6984
- C:\Windows\System\mhqRGRW.exe
  C:\Windows\System\mhqRGRW.exe
  2⤵
  PID:7004
- C:\Windows\System\iLRmQQF.exe
  C:\Windows\System\iLRmQQF.exe
  2⤵
  PID:7024
- C:\Windows\System\OLtoMOL.exe
  C:\Windows\System\OLtoMOL.exe
  2⤵
  PID:7040
- C:\Windows\System\fQOxZFX.exe
  C:\Windows\System\fQOxZFX.exe
  2⤵
  PID:7060
- C:\Windows\System\TrtnTOa.exe
  C:\Windows\System\TrtnTOa.exe
  2⤵
  PID:7080
- C:\Windows\System\YqZOboG.exe
  C:\Windows\System\YqZOboG.exe
  2⤵
  PID:7096
- C:\Windows\System\oIcBEkX.exe
  C:\Windows\System\oIcBEkX.exe
  2⤵
  PID:7120
- C:\Windows\System\makMIqn.exe
  C:\Windows\System\makMIqn.exe
  2⤵
  PID:7136
- C:\Windows\System\INskAJG.exe
  C:\Windows\System\INskAJG.exe
  2⤵
  PID:7164
- C:\Windows\System\gqGIBRq.exe
  C:\Windows\System\gqGIBRq.exe
  2⤵
  PID:6172
- C:\Windows\System\yagMJPL.exe
  C:\Windows\System\yagMJPL.exe
  2⤵
  PID:6220
- C:\Windows\System\GxmiTZN.exe
  C:\Windows\System\GxmiTZN.exe
  2⤵
  PID:6260
- C:\Windows\System\dRPQmiW.exe
  C:\Windows\System\dRPQmiW.exe
  2⤵
  PID:4236
- C:\Windows\System\eYbqSQh.exe
  C:\Windows\System\eYbqSQh.exe
  2⤵
  PID:6320
- C:\Windows\System\AEYqxkT.exe
  C:\Windows\System\AEYqxkT.exe
  2⤵
  PID:6196
- C:\Windows\System\zlGupXH.exe
  C:\Windows\System\zlGupXH.exe
  2⤵
  PID:6244
- C:\Windows\System\noAYwoW.exe
  C:\Windows\System\noAYwoW.exe
  2⤵
  PID:6280
- C:\Windows\System\OzwPFZS.exe
  C:\Windows\System\OzwPFZS.exe
  2⤵
  PID:6384
- C:\Windows\System\kUFKPbG.exe
  C:\Windows\System\kUFKPbG.exe
  2⤵
  PID:6356
- C:\Windows\System\RoHYuOR.exe
  C:\Windows\System\RoHYuOR.exe
  2⤵
  PID:6420
- C:\Windows\System\VCJDyYa.exe
  C:\Windows\System\VCJDyYa.exe
  2⤵
  PID:6444
- C:\Windows\System\UsIwEBW.exe
  C:\Windows\System\UsIwEBW.exe
  2⤵
  PID:6436
- C:\Windows\System\GgHvYqk.exe
  C:\Windows\System\GgHvYqk.exe
  2⤵
  PID:6540
- C:\Windows\System\KnTYrMR.exe
  C:\Windows\System\KnTYrMR.exe
  2⤵
  PID:6628
- C:\Windows\System\nrhKhVo.exe
  C:\Windows\System\nrhKhVo.exe
  2⤵
  PID:6676
- C:\Windows\System\EHwvFzX.exe
  C:\Windows\System\EHwvFzX.exe
  2⤵
  PID:6720
- C:\Windows\System\MfkNIgD.exe
  C:\Windows\System\MfkNIgD.exe
  2⤵
  PID:6600
- C:\Windows\System\WYnFidE.exe
  C:\Windows\System\WYnFidE.exe
  2⤵
  PID:6516
- C:\Windows\System\wFxDJbF.exe
  C:\Windows\System\wFxDJbF.exe
  2⤵
  PID:6524
- C:\Windows\System\joqrCkj.exe
  C:\Windows\System\joqrCkj.exe
  2⤵
  PID:6476
- C:\Windows\System\tLVzrYr.exe
  C:\Windows\System\tLVzrYr.exe
  2⤵
  PID:6784
- C:\Windows\System\JLWcCWc.exe
  C:\Windows\System\JLWcCWc.exe
  2⤵
  PID:6848
- C:\Windows\System\jiqwHEN.exe
  C:\Windows\System\jiqwHEN.exe
  2⤵
  PID:6652
- C:\Windows\System\ujHufWS.exe
  C:\Windows\System\ujHufWS.exe
  2⤵
  PID:6692
- C:\Windows\System\POUYdqQ.exe
  C:\Windows\System\POUYdqQ.exe
  2⤵
  PID:6748
- C:\Windows\System\kbBPapr.exe
  C:\Windows\System\kbBPapr.exe
  2⤵
  PID:6868
- C:\Windows\System\rILWxdh.exe
  C:\Windows\System\rILWxdh.exe
  2⤵
  PID:6872
- C:\Windows\System\KaFKZcm.exe
  C:\Windows\System\KaFKZcm.exe
  2⤵
  PID:6976
- C:\Windows\System\UhVjIMD.exe
  C:\Windows\System\UhVjIMD.exe
  2⤵
  PID:7012
- C:\Windows\System\EnXQowl.exe
  C:\Windows\System\EnXQowl.exe
  2⤵
  PID:7056
- C:\Windows\System\AlcQfjm.exe
  C:\Windows\System\AlcQfjm.exe
  2⤵
  PID:7068
- C:\Windows\System\DnpUNCq.exe
  C:\Windows\System\DnpUNCq.exe
  2⤵
  PID:7072
- C:\Windows\System\ijRSxEj.exe
  C:\Windows\System\ijRSxEj.exe
  2⤵
  PID:7152
- C:\Windows\System\DXIfUEO.exe
  C:\Windows\System\DXIfUEO.exe
  2⤵
  PID:5652
- C:\Windows\System\AUuYhBK.exe
  C:\Windows\System\AUuYhBK.exe
  2⤵
  PID:4580
- C:\Windows\System\daBBaJI.exe
  C:\Windows\System\daBBaJI.exe
  2⤵
  PID:6456
- C:\Windows\System\KaBglXP.exe
  C:\Windows\System\KaBglXP.exe
  2⤵
  PID:6584
- C:\Windows\System\NeEqTrw.exe
  C:\Windows\System\NeEqTrw.exe
  2⤵
  PID:6588
- C:\Windows\System\nULXPNm.exe
  C:\Windows\System\nULXPNm.exe
  2⤵
  PID:6472
- C:\Windows\System\vlkoKYE.exe
  C:\Windows\System\vlkoKYE.exe
  2⤵
  PID:6856
- C:\Windows\System\MGaPTFc.exe
  C:\Windows\System\MGaPTFc.exe
  2⤵
  PID:6424
- C:\Windows\System\UQAkJPN.exe
  C:\Windows\System\UQAkJPN.exe
  2⤵
  PID:6944
- C:\Windows\System\RTFMQKN.exe
  C:\Windows\System\RTFMQKN.exe
  2⤵
  PID:6564
- C:\Windows\System\fHdkcQc.exe
  C:\Windows\System\fHdkcQc.exe
  2⤵
  PID:7132
- C:\Windows\System\vwfmaQm.exe
  C:\Windows\System\vwfmaQm.exe
  2⤵
  PID:6340
- C:\Windows\System\zkKLGmq.exe
  C:\Windows\System\zkKLGmq.exe
  2⤵
  PID:6276
- C:\Windows\System\lfQvvik.exe
  C:\Windows\System\lfQvvik.exe
  2⤵
  PID:6536
- C:\Windows\System\VDfUIiq.exe
  C:\Windows\System\VDfUIiq.exe
  2⤵
  PID:6552
- C:\Windows\System\ynWfqAj.exe
  C:\Windows\System\ynWfqAj.exe
  2⤵
  PID:6724
- C:\Windows\System\PeVrPcS.exe
  C:\Windows\System\PeVrPcS.exe
  2⤵
  PID:6812
- C:\Windows\System\IDIJaVu.exe
  C:\Windows\System\IDIJaVu.exe
  2⤵
  PID:6496
- C:\Windows\System\kneKMPj.exe
  C:\Windows\System\kneKMPj.exe
  2⤵
  PID:6908
- C:\Windows\System\FyxxiMx.exe
  C:\Windows\System\FyxxiMx.exe
  2⤵
  PID:6844
- C:\Windows\System\BltVHjg.exe
  C:\Windows\System\BltVHjg.exe
  2⤵
  PID:6924
- C:\Windows\System\ddPEwvN.exe
  C:\Windows\System\ddPEwvN.exe
  2⤵
  PID:6804
- C:\Windows\System\dszAxHC.exe
  C:\Windows\System\dszAxHC.exe
  2⤵
  PID:7104
- C:\Windows\System\bkkRJLj.exe
  C:\Windows\System\bkkRJLj.exe
  2⤵
  PID:6256
- C:\Windows\System\ZnbUnUr.exe
  C:\Windows\System\ZnbUnUr.exe
  2⤵
  PID:6288
- C:\Windows\System\GzYliMU.exe
  C:\Windows\System\GzYliMU.exe
  2⤵
  PID:6740
- C:\Windows\System\bCvobmx.exe
  C:\Windows\System\bCvobmx.exe
  2⤵
  PID:6636
- C:\Windows\System\PdepxyQ.exe
  C:\Windows\System\PdepxyQ.exe
  2⤵
  PID:6304
- C:\Windows\System\imxFccU.exe
  C:\Windows\System\imxFccU.exe
  2⤵
  PID:6996
- C:\Windows\System\oVsiPXe.exe
  C:\Windows\System\oVsiPXe.exe
  2⤵
  PID:6904
- C:\Windows\System\UrOLUPO.exe
  C:\Windows\System\UrOLUPO.exe
  2⤵
  PID:6968
- C:\Windows\System\PcdyiUS.exe
  C:\Windows\System\PcdyiUS.exe
  2⤵
  PID:5312
- C:\Windows\System\gllZdtg.exe
  C:\Windows\System\gllZdtg.exe
  2⤵
  PID:6832
- C:\Windows\System\BkPrDnw.exe
  C:\Windows\System\BkPrDnw.exe
  2⤵
  PID:6328
- C:\Windows\System\OZwkTaN.exe
  C:\Windows\System\OZwkTaN.exe
  2⤵
  PID:6948
- C:\Windows\System\MoOvQdg.exe
  C:\Windows\System\MoOvQdg.exe
  2⤵
  PID:6452
- C:\Windows\System\WBePFbQ.exe
  C:\Windows\System\WBePFbQ.exe
  2⤵
  PID:6892
- C:\Windows\System\GgddilM.exe
  C:\Windows\System\GgddilM.exe
  2⤵
  PID:6660
- C:\Windows\System\AyZZLxP.exe
  C:\Windows\System\AyZZLxP.exe
  2⤵
  PID:7116
- C:\Windows\System\pljScSy.exe
  C:\Windows\System\pljScSy.exe
  2⤵
  PID:6360
- C:\Windows\System\iOnVjcv.exe
  C:\Windows\System\iOnVjcv.exe
  2⤵
  PID:7184
- C:\Windows\System\qDpYYuy.exe
  C:\Windows\System\qDpYYuy.exe
  2⤵
  PID:7208
- C:\Windows\System\sVSZJzl.exe
  C:\Windows\System\sVSZJzl.exe
  2⤵
  PID:7224
- C:\Windows\System\yUUxgfb.exe
  C:\Windows\System\yUUxgfb.exe
  2⤵
  PID:7244
- C:\Windows\System\OxrhcKN.exe
  C:\Windows\System\OxrhcKN.exe
  2⤵
  PID:7264
- C:\Windows\System\OyIxQRe.exe
  C:\Windows\System\OyIxQRe.exe
  2⤵
  PID:7280
- C:\Windows\System\UnvHGij.exe
  C:\Windows\System\UnvHGij.exe
  2⤵
  PID:7296
- C:\Windows\System\aGdmOkH.exe
  C:\Windows\System\aGdmOkH.exe
  2⤵
  PID:7316
- C:\Windows\System\hOvkGSc.exe
  C:\Windows\System\hOvkGSc.exe
  2⤵
  PID:7336
- C:\Windows\System\dbCksnv.exe
  C:\Windows\System\dbCksnv.exe
  2⤵
  PID:7360
- C:\Windows\System\svpeNLl.exe
  C:\Windows\System\svpeNLl.exe
  2⤵
  PID:7380
- C:\Windows\System\gHJjlYi.exe
  C:\Windows\System\gHJjlYi.exe
  2⤵
  PID:7404
- C:\Windows\System\CAskFKE.exe
  C:\Windows\System\CAskFKE.exe
  2⤵
  PID:7428
- C:\Windows\System\HdsuHON.exe
  C:\Windows\System\HdsuHON.exe
  2⤵
  PID:7444
- C:\Windows\System\NuRhTLI.exe
  C:\Windows\System\NuRhTLI.exe
  2⤵
  PID:7464
- C:\Windows\System\CFHYUud.exe
  C:\Windows\System\CFHYUud.exe
  2⤵
  PID:7484
- C:\Windows\System\qvdDkOq.exe
  C:\Windows\System\qvdDkOq.exe
  2⤵
  PID:7504
- C:\Windows\System\ojEEQoS.exe
  C:\Windows\System\ojEEQoS.exe
  2⤵
  PID:7528
- C:\Windows\System\EGZRBYw.exe
  C:\Windows\System\EGZRBYw.exe
  2⤵
  PID:7544
- C:\Windows\System\XHKhMqB.exe
  C:\Windows\System\XHKhMqB.exe
  2⤵
  PID:7568
- C:\Windows\System\JsnCKBr.exe
  C:\Windows\System\JsnCKBr.exe
  2⤵
  PID:7588
- C:\Windows\System\UeDfDal.exe
  C:\Windows\System\UeDfDal.exe
  2⤵
  PID:7612
- C:\Windows\System\NQdiEdR.exe
  C:\Windows\System\NQdiEdR.exe
  2⤵
  PID:7632
- C:\Windows\System\XtcwXLN.exe
  C:\Windows\System\XtcwXLN.exe
  2⤵
  PID:7648
- C:\Windows\System\jmkJRky.exe
  C:\Windows\System\jmkJRky.exe
  2⤵
  PID:7668
- C:\Windows\System\NNhpgVU.exe
  C:\Windows\System\NNhpgVU.exe
  2⤵
  PID:7688
- C:\Windows\System\TpPOpPi.exe
  C:\Windows\System\TpPOpPi.exe
  2⤵
  PID:7712
- C:\Windows\System\stkcoCq.exe
  C:\Windows\System\stkcoCq.exe
  2⤵
  PID:7728
- C:\Windows\System\OdebHrM.exe
  C:\Windows\System\OdebHrM.exe
  2⤵
  PID:7752
- C:\Windows\System\PTUgMix.exe
  C:\Windows\System\PTUgMix.exe
  2⤵
  PID:7792
- C:\Windows\System\FWBjlWx.exe
  C:\Windows\System\FWBjlWx.exe
  2⤵
  PID:7816
- C:\Windows\System\LldezsA.exe
  C:\Windows\System\LldezsA.exe
  2⤵
  PID:7832
- C:\Windows\System\ZPmiXSC.exe
  C:\Windows\System\ZPmiXSC.exe
  2⤵
  PID:7848
- C:\Windows\System\tuXSZcY.exe
  C:\Windows\System\tuXSZcY.exe
  2⤵
  PID:7864
- C:\Windows\System\jpdfdwn.exe
  C:\Windows\System\jpdfdwn.exe
  2⤵
  PID:7880
- C:\Windows\System\odwOEwh.exe
  C:\Windows\System\odwOEwh.exe
  2⤵
  PID:7896
- C:\Windows\System\nvZphmS.exe
  C:\Windows\System\nvZphmS.exe
  2⤵
  PID:7912
- C:\Windows\System\Qktkrcd.exe
  C:\Windows\System\Qktkrcd.exe
  2⤵
  PID:7928
- C:\Windows\System\gPQTdVB.exe
  C:\Windows\System\gPQTdVB.exe
  2⤵
  PID:7944
- C:\Windows\System\bjtqVGK.exe
  C:\Windows\System\bjtqVGK.exe
  2⤵
  PID:7960
- C:\Windows\System\YnWZuQk.exe
  C:\Windows\System\YnWZuQk.exe
  2⤵
  PID:7976
- C:\Windows\System\fzIsGDh.exe
  C:\Windows\System\fzIsGDh.exe
  2⤵
  PID:7992
- C:\Windows\System\gZlzeVu.exe
  C:\Windows\System\gZlzeVu.exe
  2⤵
  PID:8008
- C:\Windows\System\uebVUZe.exe
  C:\Windows\System\uebVUZe.exe
  2⤵
  PID:8028
- C:\Windows\System\RNIFSjm.exe
  C:\Windows\System\RNIFSjm.exe
  2⤵
  PID:8052
- C:\Windows\System\nSukDwC.exe
  C:\Windows\System\nSukDwC.exe
  2⤵
  PID:8072
- C:\Windows\System\RRcObrv.exe
  C:\Windows\System\RRcObrv.exe
  2⤵
  PID:8136
- C:\Windows\System\MBodfPl.exe
  C:\Windows\System\MBodfPl.exe
  2⤵
  PID:8152
- C:\Windows\System\TPGNajZ.exe
  C:\Windows\System\TPGNajZ.exe
  2⤵
  PID:8168
- C:\Windows\System\mFyrVkT.exe
  C:\Windows\System\mFyrVkT.exe
  2⤵
  PID:8184
- C:\Windows\System\qHWtocG.exe
  C:\Windows\System\qHWtocG.exe
  2⤵
  PID:6512
- C:\Windows\System\TIZJvqu.exe
  C:\Windows\System\TIZJvqu.exe
  2⤵
  PID:6700
- C:\Windows\System\wuJZJrK.exe
  C:\Windows\System\wuJZJrK.exe
  2⤵
  PID:7252
- C:\Windows\System\HvtnEYQ.exe
  C:\Windows\System\HvtnEYQ.exe
  2⤵
  PID:7324
- C:\Windows\System\qbkFIPH.exe
  C:\Windows\System\qbkFIPH.exe
  2⤵
  PID:7372
- C:\Windows\System\jyuFxMQ.exe
  C:\Windows\System\jyuFxMQ.exe
  2⤵
  PID:7416
- C:\Windows\System\VSNvAMC.exe
  C:\Windows\System\VSNvAMC.exe
  2⤵
  PID:7452
- C:\Windows\System\rTyubKy.exe
  C:\Windows\System\rTyubKy.exe
  2⤵
  PID:7496
- C:\Windows\System\NiRANTT.exe
  C:\Windows\System\NiRANTT.exe
  2⤵
  PID:7580
- C:\Windows\System\GaXkvQF.exe
  C:\Windows\System\GaXkvQF.exe
  2⤵
  PID:7628
- C:\Windows\System\XfYgIEj.exe
  C:\Windows\System\XfYgIEj.exe
  2⤵
  PID:7436
- C:\Windows\System\AVukuxJ.exe
  C:\Windows\System\AVukuxJ.exe
  2⤵
  PID:7476
- C:\Windows\System\XhMvMJn.exe
  C:\Windows\System\XhMvMJn.exe
  2⤵
  PID:7744
- C:\Windows\System\uPaVjVz.exe
  C:\Windows\System\uPaVjVz.exe
  2⤵
  PID:7560
- C:\Windows\System\GFvTJkA.exe
  C:\Windows\System\GFvTJkA.exe
  2⤵
  PID:6792
- C:\Windows\System\tCxZxoz.exe
  C:\Windows\System\tCxZxoz.exe
  2⤵
  PID:6672
- C:\Windows\System\vMJOTdP.exe
  C:\Windows\System\vMJOTdP.exe
  2⤵
  PID:7472
- C:\Windows\System\wfdjjZi.exe
  C:\Windows\System\wfdjjZi.exe
  2⤵
  PID:7272
- C:\Windows\System\HeFNsOS.exe
  C:\Windows\System\HeFNsOS.exe
  2⤵
  PID:7312
- C:\Windows\System\ULrzgHj.exe
  C:\Windows\System\ULrzgHj.exe
  2⤵
  PID:7392
- C:\Windows\System\yepuunc.exe
  C:\Windows\System\yepuunc.exe
  2⤵
  PID:7708
- C:\Windows\System\bqTtKcW.exe
  C:\Windows\System\bqTtKcW.exe
  2⤵
  PID:7520
- C:\Windows\System\MRgSbSY.exe
  C:\Windows\System\MRgSbSY.exe
  2⤵
  PID:7780
- C:\Windows\System\JFudmof.exe
  C:\Windows\System\JFudmof.exe
  2⤵
  PID:7676
- C:\Windows\System\OObOGRZ.exe
  C:\Windows\System\OObOGRZ.exe
  2⤵
  PID:7772
- C:\Windows\System\DPbvPqe.exe
  C:\Windows\System\DPbvPqe.exe
  2⤵
  PID:7788
- C:\Windows\System\ZzEMUON.exe
  C:\Windows\System\ZzEMUON.exe
  2⤵
  PID:7904
- C:\Windows\System\DgzWpnI.exe
  C:\Windows\System\DgzWpnI.exe
  2⤵
  PID:8096
- C:\Windows\System\mIRlmuy.exe
  C:\Windows\System\mIRlmuy.exe
  2⤵
  PID:8112
- C:\Windows\System\AlnfuNA.exe
  C:\Windows\System\AlnfuNA.exe
  2⤵
  PID:7956
- C:\Windows\System\LLWKYPv.exe
  C:\Windows\System\LLWKYPv.exe
  2⤵
  PID:8060
- C:\Windows\System\EtHuqof.exe
  C:\Windows\System\EtHuqof.exe
  2⤵
  PID:8132
- C:\Windows\System\zkifrnZ.exe
  C:\Windows\System\zkifrnZ.exe
  2⤵
  PID:8160
- C:\Windows\System\IYVbjMs.exe
  C:\Windows\System\IYVbjMs.exe
  2⤵
  PID:7216
- C:\Windows\System\jmfZlOR.exe
  C:\Windows\System\jmfZlOR.exe
  2⤵
  PID:6780
- C:\Windows\System\XYnZhFz.exe
  C:\Windows\System\XYnZhFz.exe
  2⤵
  PID:7576
- C:\Windows\System\evVNzRI.exe
  C:\Windows\System\evVNzRI.exe
  2⤵
  PID:7660
- C:\Windows\System\nwAhDIz.exe
  C:\Windows\System\nwAhDIz.exe
  2⤵
  PID:7344
- C:\Windows\System\KlIxnCJ.exe
  C:\Windows\System\KlIxnCJ.exe
  2⤵
  PID:6980
- C:\Windows\System\TZLuyCG.exe
  C:\Windows\System\TZLuyCG.exe
  2⤵
  PID:7308
- C:\Windows\System\sBguGvi.exe
  C:\Windows\System\sBguGvi.exe
  2⤵
  PID:7596
- C:\Windows\System\lUuNTxi.exe
  C:\Windows\System\lUuNTxi.exe
  2⤵
  PID:7764
- C:\Windows\System\OzxAmNl.exe
  C:\Windows\System\OzxAmNl.exe
  2⤵
  PID:7768
- C:\Windows\System\nfCCXGn.exe
  C:\Windows\System\nfCCXGn.exe
  2⤵
  PID:2396
- C:\Windows\System\CaMLYNS.exe
  C:\Windows\System\CaMLYNS.exe
  2⤵
  PID:7420
- C:\Windows\System\pSgjkin.exe
  C:\Windows\System\pSgjkin.exe
  2⤵
  PID:7088
- C:\Windows\System\NypdCcW.exe
  C:\Windows\System\NypdCcW.exe
  2⤵
  PID:7804
- C:\Windows\System\aVnXnLb.exe
  C:\Windows\System\aVnXnLb.exe
  2⤵
  PID:7968
- C:\Windows\System\aZqEgPJ.exe
  C:\Windows\System\aZqEgPJ.exe
  2⤵
  PID:7288
- C:\Windows\System\iqwKpZJ.exe
  C:\Windows\System\iqwKpZJ.exe
  2⤵
  PID:7556
- C:\Windows\System\tWrcPQn.exe
  C:\Windows\System\tWrcPQn.exe
  2⤵
  PID:7388
- C:\Windows\System\SpCHYsC.exe
  C:\Windows\System\SpCHYsC.exe
  2⤵
  PID:7644
- C:\Windows\System\BBXLcaU.exe
  C:\Windows\System\BBXLcaU.exe
  2⤵
  PID:8000
- C:\Windows\System\YPNCmrP.exe
  C:\Windows\System\YPNCmrP.exe
  2⤵
  PID:8048
- C:\Windows\System\FgreCTY.exe
  C:\Windows\System\FgreCTY.exe
  2⤵
  PID:8004
- C:\Windows\System\DzLvCKk.exe
  C:\Windows\System\DzLvCKk.exe
  2⤵
  PID:7920
- C:\Windows\System\LjAjFnX.exe
  C:\Windows\System\LjAjFnX.exe
  2⤵
  PID:7924
- C:\Windows\System\NNCpCQk.exe
  C:\Windows\System\NNCpCQk.exe
  2⤵
  PID:8068
- C:\Windows\System\fEpRcUx.exe
  C:\Windows\System\fEpRcUx.exe
  2⤵
  PID:7664
- C:\Windows\System\RMIfcFi.exe
  C:\Windows\System\RMIfcFi.exe
  2⤵
  PID:7552
- C:\Windows\System\SdEQMpq.exe
  C:\Windows\System\SdEQMpq.exe
  2⤵
  PID:8124
- C:\Windows\System\UcxPAyy.exe
  C:\Windows\System\UcxPAyy.exe
  2⤵
  PID:6364
- C:\Windows\System\wkhwbhd.exe
  C:\Windows\System\wkhwbhd.exe
  2⤵
  PID:8040
- C:\Windows\System\IHmZTYy.exe
  C:\Windows\System\IHmZTYy.exe
  2⤵
  PID:7328
- C:\Windows\System\ASpbGtm.exe
  C:\Windows\System\ASpbGtm.exe
  2⤵
  PID:8044
- C:\Windows\System\hCsWkLh.exe
  C:\Windows\System\hCsWkLh.exe
  2⤵
  PID:7824
- C:\Windows\System\fYwKJHw.exe
  C:\Windows\System\fYwKJHw.exe
  2⤵
  PID:7704
- C:\Windows\System\WtXJGMF.exe
  C:\Windows\System\WtXJGMF.exe
  2⤵
  PID:7200
- C:\Windows\System\FKkQqHl.exe
  C:\Windows\System\FKkQqHl.exe
  2⤵
  PID:7740
- C:\Windows\System\jyEvpHB.exe
  C:\Windows\System\jyEvpHB.exe
  2⤵
  PID:6180
- C:\Windows\System\uQNiRWW.exe
  C:\Windows\System\uQNiRWW.exe
  2⤵
  PID:7240
- C:\Windows\System\aYjqniR.exe
  C:\Windows\System\aYjqniR.exe
  2⤵
  PID:7516
- C:\Windows\System\ABomRIJ.exe
  C:\Windows\System\ABomRIJ.exe
  2⤵
  PID:7952
- C:\Windows\System\ZgCVhsP.exe
  C:\Windows\System\ZgCVhsP.exe
  2⤵
  PID:8180
- C:\Windows\System\ZJldIfK.exe
  C:\Windows\System\ZJldIfK.exe
  2⤵
  PID:8020
- C:\Windows\System\NIUBHEU.exe
  C:\Windows\System\NIUBHEU.exe
  2⤵
  PID:7492
- C:\Windows\System\IeudVzp.exe
  C:\Windows\System\IeudVzp.exe
  2⤵
  PID:8108
- C:\Windows\System\uKSJnfI.exe
  C:\Windows\System\uKSJnfI.exe
  2⤵
  PID:4828
- C:\Windows\System\aKdsuEH.exe
  C:\Windows\System\aKdsuEH.exe
  2⤵
  PID:8204
- C:\Windows\System\NMbLSks.exe
  C:\Windows\System\NMbLSks.exe
  2⤵
  PID:8220
- C:\Windows\System\OsBcPdM.exe
  C:\Windows\System\OsBcPdM.exe
  2⤵
  PID:8240
- C:\Windows\System\jRMdKQa.exe
  C:\Windows\System\jRMdKQa.exe
  2⤵
  PID:8292
- C:\Windows\System\CfmWUif.exe
  C:\Windows\System\CfmWUif.exe
  2⤵
  PID:8312
- C:\Windows\System\SVfvihC.exe
  C:\Windows\System\SVfvihC.exe
  2⤵
  PID:8328
- C:\Windows\System\dYhGtci.exe
  C:\Windows\System\dYhGtci.exe
  2⤵
  PID:8344
- C:\Windows\System\ELhLQbv.exe
  C:\Windows\System\ELhLQbv.exe
  2⤵
  PID:8360
- C:\Windows\System\fFqOSZG.exe
  C:\Windows\System\fFqOSZG.exe
  2⤵
  PID:8380
- C:\Windows\System\lfUfUem.exe
  C:\Windows\System\lfUfUem.exe
  2⤵
  PID:8396
- C:\Windows\System\foKRsaI.exe
  C:\Windows\System\foKRsaI.exe
  2⤵
  PID:8412
- C:\Windows\System\xmEPlle.exe
  C:\Windows\System\xmEPlle.exe
  2⤵
  PID:8428
- C:\Windows\System\SyXsugO.exe
  C:\Windows\System\SyXsugO.exe
  2⤵
  PID:8444
- C:\Windows\System\jJeEdTh.exe
  C:\Windows\System\jJeEdTh.exe
  2⤵
  PID:8460
- C:\Windows\System\hKsJFKs.exe
  C:\Windows\System\hKsJFKs.exe
  2⤵
  PID:8476
- C:\Windows\System\GTIAZsK.exe
  C:\Windows\System\GTIAZsK.exe
  2⤵
  PID:8492
- C:\Windows\System\oxvOaCv.exe
  C:\Windows\System\oxvOaCv.exe
  2⤵
  PID:8512
- C:\Windows\System\wvolYVJ.exe
  C:\Windows\System\wvolYVJ.exe
  2⤵
  PID:8528
- C:\Windows\System\BfbqGJI.exe
  C:\Windows\System\BfbqGJI.exe
  2⤵
  PID:8544
- C:\Windows\System\CDapVHX.exe
  C:\Windows\System\CDapVHX.exe
  2⤵
  PID:8560
- C:\Windows\System\LWdobpr.exe
  C:\Windows\System\LWdobpr.exe
  2⤵
  PID:8576
- C:\Windows\System\eTXMYfz.exe
  C:\Windows\System\eTXMYfz.exe
  2⤵
  PID:8592
- C:\Windows\System\TWfTuZk.exe
  C:\Windows\System\TWfTuZk.exe
  2⤵
  PID:8608
- C:\Windows\System\bBcUzBa.exe
  C:\Windows\System\bBcUzBa.exe
  2⤵
  PID:8624
- C:\Windows\System\oyNIWIa.exe
  C:\Windows\System\oyNIWIa.exe
  2⤵
  PID:8640
- C:\Windows\System\scQEgsB.exe
  C:\Windows\System\scQEgsB.exe
  2⤵
  PID:8656
- C:\Windows\System\JPrztzo.exe
  C:\Windows\System\JPrztzo.exe
  2⤵
  PID:8676
- C:\Windows\System\npTGiFS.exe
  C:\Windows\System\npTGiFS.exe
  2⤵
  PID:8696
- C:\Windows\System\TJsVJwC.exe
  C:\Windows\System\TJsVJwC.exe
  2⤵
  PID:8712
- C:\Windows\System\rIoaLNo.exe
  C:\Windows\System\rIoaLNo.exe
  2⤵
  PID:8732
- C:\Windows\System\stxrLGk.exe
  C:\Windows\System\stxrLGk.exe
  2⤵
  PID:8752
- C:\Windows\System\zAweIvh.exe
  C:\Windows\System\zAweIvh.exe
  2⤵
  PID:8860
- C:\Windows\System\BfZPTNl.exe
  C:\Windows\System\BfZPTNl.exe
  2⤵
  PID:8876
- C:\Windows\System\xjrNMgz.exe
  C:\Windows\System\xjrNMgz.exe
  2⤵
  PID:8892
- C:\Windows\System\NlsAJBF.exe
  C:\Windows\System\NlsAJBF.exe
  2⤵
  PID:8908
- C:\Windows\System\idqXZON.exe
  C:\Windows\System\idqXZON.exe
  2⤵
  PID:8924
- C:\Windows\System\xIcntXl.exe
  C:\Windows\System\xIcntXl.exe
  2⤵
  PID:8940
- C:\Windows\System\HXMomYQ.exe
  C:\Windows\System\HXMomYQ.exe
  2⤵
  PID:8956
- C:\Windows\System\TjgvAJJ.exe
  C:\Windows\System\TjgvAJJ.exe
  2⤵
  PID:8980
- C:\Windows\System\NhKUMoY.exe
  C:\Windows\System\NhKUMoY.exe
  2⤵
  PID:8996
- C:\Windows\System\KnBFMyE.exe
  C:\Windows\System\KnBFMyE.exe
  2⤵
  PID:9024
- C:\Windows\System\MVArqDF.exe
  C:\Windows\System\MVArqDF.exe
  2⤵
  PID:9040
- C:\Windows\System\CHTlaEb.exe
  C:\Windows\System\CHTlaEb.exe
  2⤵
  PID:9056
- C:\Windows\System\JsttHvn.exe
  C:\Windows\System\JsttHvn.exe
  2⤵
  PID:9072
- C:\Windows\System\ymxpqXc.exe
  C:\Windows\System\ymxpqXc.exe
  2⤵
  PID:9092
- C:\Windows\System\CPYwfdE.exe
  C:\Windows\System\CPYwfdE.exe
  2⤵
  PID:9112
- C:\Windows\System\dbKuEnR.exe
  C:\Windows\System\dbKuEnR.exe
  2⤵
  PID:9128
- C:\Windows\System\kUWfhQZ.exe
  C:\Windows\System\kUWfhQZ.exe
  2⤵
  PID:9144
- C:\Windows\System\JOFmFus.exe
  C:\Windows\System\JOFmFus.exe
  2⤵
  PID:9160
- C:\Windows\System\EoBQxeW.exe
  C:\Windows\System\EoBQxeW.exe
  2⤵
  PID:9180
- C:\Windows\System\JlpITFR.exe
  C:\Windows\System\JlpITFR.exe
  2⤵
  PID:9204
- C:\Windows\System\IERusNQ.exe
  C:\Windows\System\IERusNQ.exe
  2⤵
  PID:8196
- C:\Windows\System\UWtDNIf.exe
  C:\Windows\System\UWtDNIf.exe
  2⤵
  PID:7440
- C:\Windows\System\FRdqeAY.exe
  C:\Windows\System\FRdqeAY.exe
  2⤵
  PID:7724
- C:\Windows\System\pUnrpIH.exe
  C:\Windows\System\pUnrpIH.exe
  2⤵
  PID:7840
- C:\Windows\System\abLjblg.exe
  C:\Windows\System\abLjblg.exe
  2⤵
  PID:7684
- C:\Windows\System\GDKPPQp.exe
  C:\Windows\System\GDKPPQp.exe
  2⤵
  PID:8252
- C:\Windows\System\fMnBrWg.exe
  C:\Windows\System\fMnBrWg.exe
  2⤵
  PID:8320
- C:\Windows\System\jdqTzvk.exe
  C:\Windows\System\jdqTzvk.exe
  2⤵
  PID:8404
- C:\Windows\System\OysWcpO.exe
  C:\Windows\System\OysWcpO.exe
  2⤵
  PID:8468
- C:\Windows\System\RqpmXmK.exe
  C:\Windows\System\RqpmXmK.exe
  2⤵
  PID:8372
- C:\Windows\System\HHXRGXq.exe
  C:\Windows\System\HHXRGXq.exe
  2⤵
  PID:8536
- C:\Windows\System\LTrnGmz.exe
  C:\Windows\System\LTrnGmz.exe
  2⤵
  PID:8600
- C:\Windows\System\VjufefT.exe
  C:\Windows\System\VjufefT.exe
  2⤵
  PID:8556
- C:\Windows\System\qvGbUzx.exe
  C:\Windows\System\qvGbUzx.exe
  2⤵
  PID:8668
- C:\Windows\System\zKrUvZe.exe
  C:\Windows\System\zKrUvZe.exe
  2⤵
  PID:8524
- C:\Windows\System\dwVsNNb.exe
  C:\Windows\System\dwVsNNb.exe
  2⤵
  PID:8708
- C:\Windows\System\jSKDgIz.exe
  C:\Windows\System\jSKDgIz.exe
  2⤵
  PID:8652
- C:\Windows\System\aGOjoAB.exe
  C:\Windows\System\aGOjoAB.exe
  2⤵
  PID:8744
- C:\Windows\System\DgPZtOY.exe
  C:\Windows\System\DgPZtOY.exe
  2⤵
  PID:8776
- C:\Windows\System\XlYtAfc.exe
  C:\Windows\System\XlYtAfc.exe
  2⤵
  PID:8792
- C:\Windows\System\EJjaHRK.exe
  C:\Windows\System\EJjaHRK.exe
  2⤵
  PID:8808
- C:\Windows\System\haQwXnW.exe
  C:\Windows\System\haQwXnW.exe
  2⤵
  PID:8824
- C:\Windows\System\QHscRxv.exe
  C:\Windows\System\QHscRxv.exe
  2⤵
  PID:8856
- C:\Windows\System\UKGiwLC.exe
  C:\Windows\System\UKGiwLC.exe
  2⤵
  PID:8932
- C:\Windows\System\kLIvuGL.exe
  C:\Windows\System\kLIvuGL.exe
  2⤵
  PID:8976
- C:\Windows\System\UfoEETc.exe
  C:\Windows\System\UfoEETc.exe
  2⤵
  PID:9012
- C:\Windows\System\uTagmOg.exe
  C:\Windows\System\uTagmOg.exe
  2⤵
  PID:9004
- C:\Windows\System\dyGJnHr.exe
  C:\Windows\System\dyGJnHr.exe
  2⤵
  PID:9016
- C:\Windows\System\ANWrhln.exe
  C:\Windows\System\ANWrhln.exe
  2⤵
  PID:9080
- C:\Windows\System\JINYJFm.exe
  C:\Windows\System\JINYJFm.exe
  2⤵
  PID:9124
- C:\Windows\System\DzZbmXP.exe
  C:\Windows\System\DzZbmXP.exe
  2⤵
  PID:9176
- C:\Windows\System\KPKYbve.exe
  C:\Windows\System\KPKYbve.exe
  2⤵
  PID:8236
- C:\Windows\System\CrPooMG.exe
  C:\Windows\System\CrPooMG.exe
  2⤵
  PID:8092
- C:\Windows\System\dlFrIJa.exe
  C:\Windows\System\dlFrIJa.exe
  2⤵
  PID:7808
- C:\Windows\System\MHPOloC.exe
  C:\Windows\System\MHPOloC.exe
  2⤵
  PID:7536
- C:\Windows\System\joryUHd.exe
  C:\Windows\System\joryUHd.exe
  2⤵
  PID:8264
- C:\Windows\System\OehJqhR.exe
  C:\Windows\System\OehJqhR.exe
  2⤵
  PID:8304
- C:\Windows\System\PHWMARK.exe
  C:\Windows\System\PHWMARK.exe
  2⤵
  PID:8356
- C:\Windows\System\VOQZpIV.exe
  C:\Windows\System\VOQZpIV.exe
  2⤵
  PID:8568
- C:\Windows\System\KJeyCfF.exe
  C:\Windows\System\KJeyCfF.exe
  2⤵
  PID:8584
- C:\Windows\System\SuDbATn.exe
  C:\Windows\System\SuDbATn.exe
  2⤵
  PID:8692
- C:\Windows\System\GFtDMtI.exe
  C:\Windows\System\GFtDMtI.exe
  2⤵
  PID:8604
- C:\Windows\System\WObNVTL.exe
  C:\Windows\System\WObNVTL.exe
  2⤵
  PID:8728
- C:\Windows\System\XrBTFve.exe
  C:\Windows\System\XrBTFve.exe
  2⤵
  PID:8764
- C:\Windows\System\ZfZYVYd.exe
  C:\Windows\System\ZfZYVYd.exe
  2⤵
  PID:8788
- C:\Windows\System\hdhbqSq.exe
  C:\Windows\System\hdhbqSq.exe
  2⤵
  PID:8820
- C:\Windows\System\axpucJH.exe
  C:\Windows\System\axpucJH.exe
  2⤵
  PID:8804
- C:\Windows\System\fCKxLOY.exe
  C:\Windows\System\fCKxLOY.exe
  2⤵
  PID:9196
- C:\Windows\System\nAXHytG.exe
  C:\Windows\System\nAXHytG.exe
  2⤵
  PID:8920
- C:\Windows\System\ShDSubL.exe
  C:\Windows\System\ShDSubL.exe
  2⤵
  PID:9036
- C:\Windows\System\NDHbjeO.exe
  C:\Windows\System\NDHbjeO.exe
  2⤵
  PID:9104
- C:\Windows\System\TMBOvwp.exe
  C:\Windows\System\TMBOvwp.exe
  2⤵
  PID:9088
- C:\Windows\System\hcrZUjv.exe
  C:\Windows\System\hcrZUjv.exe
  2⤵
  PID:9136
- C:\Windows\System\mPQOIvx.exe
  C:\Windows\System\mPQOIvx.exe
  2⤵
  PID:6560
- C:\Windows\System\AXgalEJ.exe
  C:\Windows\System\AXgalEJ.exe
  2⤵
  PID:8248
- C:\Windows\System\Jozktje.exe
  C:\Windows\System\Jozktje.exe
  2⤵
  PID:8268
- C:\Windows\System\XlOdIYi.exe
  C:\Windows\System\XlOdIYi.exe
  2⤵
  PID:9212
- C:\Windows\System\jkohAyU.exe
  C:\Windows\System\jkohAyU.exe
  2⤵
  PID:8272
- C:\Windows\System\TgknzzV.exe
  C:\Windows\System\TgknzzV.exe
  2⤵
  PID:1560
- C:\Windows\System\GtXYNrg.exe
  C:\Windows\System\GtXYNrg.exe
  2⤵
  PID:8484
- C:\Windows\System\HKoVBlP.exe
  C:\Windows\System\HKoVBlP.exe
  2⤵
  PID:8388
- C:\Windows\System\ZWNhuCC.exe
  C:\Windows\System\ZWNhuCC.exe
  2⤵
  PID:8828
- C:\Windows\System\BYzLiND.exe
  C:\Windows\System\BYzLiND.exe
  2⤵
  PID:9192
- C:\Windows\System\rCqXYgD.exe
  C:\Windows\System\rCqXYgD.exe
  2⤵
  PID:8988
- C:\Windows\System\VEAesUU.exe
  C:\Windows\System\VEAesUU.exe
  2⤵
  PID:8648
- C:\Windows\System\mnNwcXi.exe
  C:\Windows\System\mnNwcXi.exe
  2⤵
  PID:8420
- C:\Windows\System\LOccAWP.exe
  C:\Windows\System\LOccAWP.exe
  2⤵
  PID:8228
- C:\Windows\System\oOhZbLi.exe
  C:\Windows\System\oOhZbLi.exe
  2⤵
  PID:9032
- C:\Windows\System\OdWdWvR.exe
  C:\Windows\System\OdWdWvR.exe
  2⤵
  PID:7700
- C:\Windows\System\KjsDTYe.exe
  C:\Windows\System\KjsDTYe.exe
  2⤵
  PID:8664
- C:\Windows\System\GcakWEU.exe
  C:\Windows\System\GcakWEU.exe
  2⤵
  PID:8352
- C:\Windows\System\iqOtOmn.exe
  C:\Windows\System\iqOtOmn.exe
  2⤵
  PID:8768
- C:\Windows\System\AWpXJrJ.exe
  C:\Windows\System\AWpXJrJ.exe
  2⤵
  PID:8508
- C:\Windows\System\qyPPZLy.exe
  C:\Windows\System\qyPPZLy.exe
  2⤵
  PID:9140
- C:\Windows\System\UMSOzYr.exe
  C:\Windows\System\UMSOzYr.exe
  2⤵
  PID:9100
- C:\Windows\System\fWjZKSq.exe
  C:\Windows\System\fWjZKSq.exe
  2⤵
  PID:8904
- C:\Windows\System\VkfICXF.exe
  C:\Windows\System\VkfICXF.exe
  2⤵
  PID:8300
- C:\Windows\System\BqFozJx.exe
  C:\Windows\System\BqFozJx.exe
  2⤵
  PID:7076
- C:\Windows\System\bzvyQwd.exe
  C:\Windows\System\bzvyQwd.exe
  2⤵
  PID:8844
- C:\Windows\System\LeJKwAB.exe
  C:\Windows\System\LeJKwAB.exe
  2⤵
  PID:8872
- C:\Windows\System\SLWGuCA.exe
  C:\Windows\System\SLWGuCA.exe
  2⤵
  PID:9052
- C:\Windows\System\glFQPeQ.exe
  C:\Windows\System\glFQPeQ.exe
  2⤵
  PID:9224
- C:\Windows\System\scwBObl.exe
  C:\Windows\System\scwBObl.exe
  2⤵
  PID:9240
- C:\Windows\System\xCOFTDX.exe
  C:\Windows\System\xCOFTDX.exe
  2⤵
  PID:9264
- C:\Windows\System\stnEwyZ.exe
  C:\Windows\System\stnEwyZ.exe
  2⤵
  PID:9280
- C:\Windows\System\XZngysd.exe
  C:\Windows\System\XZngysd.exe
  2⤵
  PID:9296
- C:\Windows\System\cKYtmVQ.exe
  C:\Windows\System\cKYtmVQ.exe
  2⤵
  PID:9312
- C:\Windows\System\UVbJKKm.exe
  C:\Windows\System\UVbJKKm.exe
  2⤵
  PID:9328
- C:\Windows\System\tRnHyHI.exe
  C:\Windows\System\tRnHyHI.exe
  2⤵
  PID:9344
- C:\Windows\System\AgMMSDG.exe
  C:\Windows\System\AgMMSDG.exe
  2⤵
  PID:9360
- C:\Windows\System\VuuWltf.exe
  C:\Windows\System\VuuWltf.exe
  2⤵
  PID:9380
- C:\Windows\System\OtWhBiD.exe
  C:\Windows\System\OtWhBiD.exe
  2⤵
  PID:9400
- C:\Windows\System\dlsIUOK.exe
  C:\Windows\System\dlsIUOK.exe
  2⤵
  PID:9416
- C:\Windows\System\FwoZuXr.exe
  C:\Windows\System\FwoZuXr.exe
  2⤵
  PID:9432
- C:\Windows\System\PzcCLfa.exe
  C:\Windows\System\PzcCLfa.exe
  2⤵
  PID:9448
- C:\Windows\System\PARwmLz.exe
  C:\Windows\System\PARwmLz.exe
  2⤵
  PID:9464
- C:\Windows\System\sxmiamT.exe
  C:\Windows\System\sxmiamT.exe
  2⤵
  PID:9484
- C:\Windows\System\AQUmVOq.exe
  C:\Windows\System\AQUmVOq.exe
  2⤵
  PID:9500
- C:\Windows\System\mhwtPwL.exe
  C:\Windows\System\mhwtPwL.exe
  2⤵
  PID:9520
- C:\Windows\System\QRCxKXm.exe
  C:\Windows\System\QRCxKXm.exe
  2⤵
  PID:9536
- C:\Windows\System\xVqcmYx.exe
  C:\Windows\System\xVqcmYx.exe
  2⤵
  PID:9552
- C:\Windows\System\tmEDutV.exe
  C:\Windows\System\tmEDutV.exe
  2⤵
  PID:9568
- C:\Windows\System\JrqXSkR.exe
  C:\Windows\System\JrqXSkR.exe
  2⤵
  PID:9584
- C:\Windows\System\yhCsYZl.exe
  C:\Windows\System\yhCsYZl.exe
  2⤵
  PID:9600
- C:\Windows\System\cKdZddN.exe
  C:\Windows\System\cKdZddN.exe
  2⤵
  PID:9616
- C:\Windows\System\qtZkmiP.exe
  C:\Windows\System\qtZkmiP.exe
  2⤵
  PID:9632
- C:\Windows\System\Idbdcga.exe
  C:\Windows\System\Idbdcga.exe
  2⤵
  PID:9648
- C:\Windows\System\YQszjpJ.exe
  C:\Windows\System\YQszjpJ.exe
  2⤵
  PID:9664
- C:\Windows\System\qvSDoPE.exe
  C:\Windows\System\qvSDoPE.exe
  2⤵
  PID:9680
- C:\Windows\System\UtWJuZe.exe
  C:\Windows\System\UtWJuZe.exe
  2⤵
  PID:9696
- C:\Windows\System\hRtoZQI.exe
  C:\Windows\System\hRtoZQI.exe
  2⤵
  PID:9716
- C:\Windows\System\JlJgAaZ.exe
  C:\Windows\System\JlJgAaZ.exe
  2⤵
  PID:9740
- C:\Windows\System\nanABRU.exe
  C:\Windows\System\nanABRU.exe
  2⤵
  PID:9756
- C:\Windows\System\VOddrQq.exe
  C:\Windows\System\VOddrQq.exe
  2⤵
  PID:9772
- C:\Windows\System\OkLoFgu.exe
  C:\Windows\System\OkLoFgu.exe
  2⤵
  PID:9792
- C:\Windows\System\NYkaekz.exe
  C:\Windows\System\NYkaekz.exe
  2⤵
  PID:9828
- C:\Windows\System\FgoHayo.exe
  C:\Windows\System\FgoHayo.exe
  2⤵
  PID:9852
- C:\Windows\System\mUftxki.exe
  C:\Windows\System\mUftxki.exe
  2⤵
  PID:9872
- C:\Windows\System\gQbeoLf.exe
  C:\Windows\System\gQbeoLf.exe
  2⤵
  PID:9924
- C:\Windows\System\LCciyKc.exe
  C:\Windows\System\LCciyKc.exe
  2⤵
  PID:9968
- C:\Windows\System\DSelhym.exe
  C:\Windows\System\DSelhym.exe
  2⤵
  PID:9984
- C:\Windows\System\ewFCJDx.exe
  C:\Windows\System\ewFCJDx.exe
  2⤵
  PID:10000
- C:\Windows\System\kyVMBxN.exe
  C:\Windows\System\kyVMBxN.exe
  2⤵
  PID:10020
- C:\Windows\System\tGCaZQM.exe
  C:\Windows\System\tGCaZQM.exe
  2⤵
  PID:10036
- C:\Windows\System\OQuVylI.exe
  C:\Windows\System\OQuVylI.exe
  2⤵
  PID:10052
- C:\Windows\System\daanHSv.exe
  C:\Windows\System\daanHSv.exe
  2⤵
  PID:10068
- C:\Windows\System\Ynnxchc.exe
  C:\Windows\System\Ynnxchc.exe
  2⤵
  PID:10084
- C:\Windows\System\YDjQQiD.exe
  C:\Windows\System\YDjQQiD.exe
  2⤵
  PID:10100
- C:\Windows\System\AkfTEhJ.exe
  C:\Windows\System\AkfTEhJ.exe
  2⤵
  PID:10120
- C:\Windows\System\KHPxHeO.exe
  C:\Windows\System\KHPxHeO.exe
  2⤵
  PID:10140
- C:\Windows\System\dEQFPYb.exe
  C:\Windows\System\dEQFPYb.exe
  2⤵
  PID:10156
- C:\Windows\System\YDeIYnB.exe
  C:\Windows\System\YDeIYnB.exe
  2⤵
  PID:10172
- C:\Windows\System\ktahrDl.exe
  C:\Windows\System\ktahrDl.exe
  2⤵
  PID:10188
- C:\Windows\System\CduUBbj.exe
  C:\Windows\System\CduUBbj.exe
  2⤵
  PID:10204
- C:\Windows\System\afrkNDB.exe
  C:\Windows\System\afrkNDB.exe
  2⤵
  PID:10220
- C:\Windows\System\kgKerUI.exe
  C:\Windows\System\kgKerUI.exe
  2⤵
  PID:8688
- C:\Windows\System\IhRgHCx.exe
  C:\Windows\System\IhRgHCx.exe
  2⤵
  PID:8456
- C:\Windows\System\lpMZLRb.exe
  C:\Windows\System\lpMZLRb.exe
  2⤵
  PID:9236
- C:\Windows\System\IOWylJq.exe
  C:\Windows\System\IOWylJq.exe
  2⤵
  PID:9308
- C:\Windows\System\ZRVnqDx.exe
  C:\Windows\System\ZRVnqDx.exe
  2⤵
  PID:9372
- C:\Windows\System\QflrPON.exe
  C:\Windows\System\QflrPON.exe
  2⤵
  PID:9220
- C:\Windows\System\YKgDICY.exe
  C:\Windows\System\YKgDICY.exe
  2⤵
  PID:9412
- C:\Windows\System\ozhckHN.exe
  C:\Windows\System\ozhckHN.exe
  2⤵
  PID:9424
- C:\Windows\System\pJjbFuK.exe
  C:\Windows\System\pJjbFuK.exe
  2⤵
  PID:9476
- C:\Windows\System\qWNxQwa.exe
  C:\Windows\System\qWNxQwa.exe
  2⤵
  PID:9492
- C:\Windows\System\EPOReqz.exe
  C:\Windows\System\EPOReqz.exe
  2⤵
  PID:9496
- C:\Windows\System\FFiPxas.exe
  C:\Windows\System\FFiPxas.exe
  2⤵
  PID:9560
- C:\Windows\System\OVylqQz.exe
  C:\Windows\System\OVylqQz.exe
  2⤵
  PID:9624
- C:\Windows\System\AJHXCCt.exe
  C:\Windows\System\AJHXCCt.exe
  2⤵
  PID:9688
- C:\Windows\System\pViWmUH.exe
  C:\Windows\System\pViWmUH.exe
  2⤵
  PID:9736
- C:\Windows\System\NhGTLmO.exe
  C:\Windows\System\NhGTLmO.exe
  2⤵
  PID:9768
- C:\Windows\System\gqQatZY.exe
  C:\Windows\System\gqQatZY.exe
  2⤵
  PID:9576
- C:\Windows\System\YlITfRq.exe
  C:\Windows\System\YlITfRq.exe
  2⤵
  PID:9644
- C:\Windows\System\hYjpHEp.exe
  C:\Windows\System\hYjpHEp.exe
  2⤵
  PID:9712
- C:\Windows\System\neDOOGw.exe
  C:\Windows\System\neDOOGw.exe
  2⤵
  PID:9788
- C:\Windows\System\SwoljFQ.exe
  C:\Windows\System\SwoljFQ.exe
  2⤵
  PID:9812
- C:\Windows\System\Wmbvkak.exe
  C:\Windows\System\Wmbvkak.exe
  2⤵
  PID:9836

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\AWqebSz.exe

Filesize
2.9MB

MD5
5e589296dee6ab2737481f48d29075fc

SHA1
567635b66cd9f437d13ac3b381017301b8d1c28d

SHA256
3eb46b5ff2133138032e41d4aad6b13417adefda5356bfc76cc96c20859190ba

SHA512
027f58f75bcb4f1ef872f09368668e0c068af16b659f360f21dde5ff02218eab37553dc7d1c8749616578dc6d858783d18ea7b4a4ade31019f6df5eb0265c11a

Download Submit
C:\Windows\system\AiLtjED.exe

Filesize
2.9MB

MD5
641d0096be0bad45f18ede43e658acaf

SHA1
df9c5a090cf25d1bbe13efa657bd9398d594bda9

SHA256
dadf813d22cd22bc720d34b2e4a94d3598b526a198d0e0cfe34f5bf1007565f9

SHA512
91b8f70cd27cfd8d8a66611af8729f9e87f2037dfbedfb8376bcbec300e370c107bf40978e6d7a11fcde6cd8e6451f0462c553046fcf6f917cdc8f23efa522d3

Download Submit
C:\Windows\system\ApCXKJw.exe

Filesize
2.9MB

MD5
1fc8273c6b7c90a01304a2e6dabf7865

SHA1
8344d592d24dc58262c460bd44402295392e9c50

SHA256
d55a7303cc11871abc46e2564e686d772b306a841c0645897c73f50aebed6e78

SHA512
177de62ce40ba8e01958c4d24c6f7bce895b34d15fc30f0744084a5fc26ac15df9801087fdba212cbfe94e066a2f0e4610cbdf647d2aec06b7d78a6442b2a259

Download Submit
C:\Windows\system\DfOFrce.exe

Filesize
2.9MB

MD5
b71bdc748cd3112d3ff98da7774f5276

SHA1
382b1ca85af8b9bae5fe25a991f57ec346fb4b58

SHA256
31e3449ef5d595aaae063fac134bb687eead12c484df91ccb6d5835166e7bd9b

SHA512
e72bc0352b229c33360764e7dc3621fb34c9ff0088eaf8d177ed54744ca34cbde221ab02e07808d9e41840a2182ca571b430ffd611cfc8b87f8610ed64168ec0

Download Submit
C:\Windows\system\GTJnxda.exe

Filesize
2.9MB

MD5
0ff3fdea23c4e61535b26e37f1f928fd

SHA1
d56c3396c393784e66546f3e01e0bc3867fbc775

SHA256
cf72c3258cf3b178fb8acaf93b62d64eda79f505e3320698c578fb2068d94151

SHA512
76bca66eb2f2efa4e8effb729eacda07f8e21f4fc44a876ae3d3656a60b4aea122329ef2413bb191c5cdea83a3f63f8f7cfacf22bba6aa0805f2ab941948f57c

Download Submit
C:\Windows\system\HkLwZiw.exe

Filesize
2.9MB

MD5
c5fbb0ccc3e78ec70794478c2f6bea34

SHA1
127be8338e1fc4567f741c980fcbc8ec50ca6fd0

SHA256
a7dabc08cf53d8794733aa9bff876289d5372b1d488a7bd82f6afc66c7bdc45b

SHA512
3632fffcb2b5d7909cc32b5f4c7e7543a573ce45876935b3e9ad2c1e05f710edbb0e4c9a7b34487a2ac6bb86e03286824960fd7922c922194c7f2eb3028bda08

Download Submit
C:\Windows\system\INgoWJk.exe

Filesize
2.9MB

MD5
372f8a31f53793cbae5b99124248b7cc

SHA1
de014affddbb53afa4c3b82252e735193a5d585f

SHA256
c308976fee45201d7141e9cb511aeed76933851891f48ba239713c06ddf96389

SHA512
c46a6f029c52b2f27195c01208d6145cf5cd051abea7d38f3a819c2d5d672c3d427d79e7293aca40a55c820b2e0ad70fd01903d771e027313a4e19f1c34a298f

Download Submit
C:\Windows\system\KKVfjtI.exe

Filesize
2.9MB

MD5
b6de325c064171d96f03132275048b01

SHA1
9d5edcfd14265533cbc3fda250550a0a75ffd8fd

SHA256
9a90dcaadab95206c524b93596ec52557ddb69426d8d652a5ada0dbf20ce2291

SHA512
4a5b34cc2433410fb3e9508ae80454556ed31daf53b6f6b16bd8d57bf60b4b7f5e4c68e715b815a12b82cba53368319d922011d7ea3a8aa7a5c752ec90d28590

Download Submit
C:\Windows\system\RMEhlDd.exe

Filesize
8B

MD5
f784b25815939eae756df140ec88bcce

SHA1
959f992ef3b023dc7011c892ef46609e93e446e0

SHA256
b07841838fb38c8a648dce4081c46e746b7428b7dd7a7af6337f780fa28df267

SHA512
d5eae32a5e30d2ab87f7e6f15452bb24385399c780ce67a1cb32fbbe5926efc5a7eeebcaf183f72d069f30884e841fbb8be09ab0434efbd78c17d304e8b87e92

Download Submit
C:\Windows\system\SZaCPWG.exe

Filesize
2.9MB

MD5
4bd8798ee7d87a6649c5f324cdc71ede

SHA1
bdb51949c1ecb4283c2c5b6d01bb03f5ae075a0f

SHA256
cb0ab7c743b30f8051d21c1efb355ad7bba27567cf23eca33188538afe9fd8d9

SHA512
390be4f26bf64478da94518010009a2c0856f728df986a48d23724d961fac33a92f0c1c6777c55ac45b028d341803bd5f2a0fb91deb332fd28cd57fd2f0eaf5a

Download Submit
C:\Windows\system\UrhTUCE.exe

Filesize
2.9MB

MD5
63a1adcb535afb064cd6a1a444886793

SHA1
d4c08636babbb849b3a6e6f320cc53a5dbad9221

SHA256
1798166b59409d05cf530ea4e5bf744db3915069f39d22a12cb5efb2a7c863ac

SHA512
dce1e6ea0249d7e9127068d64008e5d554c9e628c2f24aa9f2d25d9cb6b6bf9972c2454622cecaebf4e292b755b733a8e75f1b6d1f6dddcd40e90a2a923b306b

Download Submit
C:\Windows\system\WGrxwAs.exe

Filesize
2.9MB

MD5
de300a1c71b9d81c1ed9021637651df5

SHA1
1d1360703a8bede411fef3aa177daee292ba9155

SHA256
0d327b834d1aa2a2ced715ce1aba2c9ead120e9ddd62f65d66fc34decf77e5b1

SHA512
6c1da7f588b6ac5997146df27f0ef75866305ca8e655732d136e83fe2d621a642acfcab371882a7cf3ecf390e731010b9e02c8a0257d0486f4178ad0c2de6eb5

Download Submit
C:\Windows\system\WnCmDyI.exe

Filesize
2.9MB

MD5
3105a36886eba3a643091926d2d281b9

SHA1
7e0b09f18624595910395f62f1b079ce1b95c278

SHA256
ee5db69917cf26ed326101dc1e5e121aafeea0118cc3a754c0fecc9891827b7f

SHA512
ac0630cb09fe5ef011cb7fa471273f6dd9442e1842051ad91e1a27140aeed75ce3ae4e78566d1e1de7ce7cd3893e0a60d3ac359aef1818ad8f01cd19ab81e423

Download Submit
C:\Windows\system\aNlOEkL.exe

Filesize
2.9MB

MD5
a993e402575bc7726fbdee5bd9e0126e

SHA1
dd1e3d02ec476032b66523df0b67256840301e7a

SHA256
06276ec8dbce0d41ba894ac92f4112270f0d660d32e9f63eb2de1c31df260f2f

SHA512
90a0f281c3336527f5125c669b6527f98269c707171ad1fdb5a7b53e9c659132ba45e27d6f416bb579acd31a0113a93865d6cc15d86c1ab8cc19e7fd249f9371

Download Submit
C:\Windows\system\cdpHhsu.exe

Filesize
2.9MB

MD5
3ede6610c35abac5f6042b4d670b92ff

SHA1
6f9baa7fd2a6c216462490fd36966c908c2d2775

SHA256
75a9862aac723fa2dfca81bf2cc7d8487752b1faa204aefe492a2c3ceca86e4f

SHA512
90239879755fc20335e4e0eb2595c1e7e0148e303b57736c8a259432956ee19419891baf8b33f30aae3b3873802ab0eb63d908d9e1c6d09e9a47a3536b296209

Download Submit
C:\Windows\system\dKBCtWj.exe

Filesize
2.9MB

MD5
a506baa99f6964b6e873bc420cf3d40b

SHA1
4039e06b54fd8d877413526d5f31732629bd09f7

SHA256
6ab9e980422334d6c6fe4c4b2cd99c19832b14f0303375fb0118e8b7b296bc7d

SHA512
9d354d3007a4f836e78240d7c74e1609ef8fc972736fa26499d7743c27efc0b32d203e53c814377e5d6098e7b2dbbbbc2ffbeecafd97c33d3447f60480a45648

Download Submit
C:\Windows\system\djZdEmr.exe

Filesize
2.9MB

MD5
da6cca05ed5cb0ffcda905024e737c12

SHA1
3bbcd21d63a3c3e32737eb6f31d509fc9e4f9349

SHA256
ec74ebaa22dc4d2918d1aa9b4c1c96234c90e3599abd22caeed4b99dc47804f7

SHA512
f18ac212c87782230a61435c9d4d57ebc20968453882a836f78ef65ab41790967cfb43c99a5d3577fc4cde8f9a50315e64050b925728bf4853040fe2fe574ca8

Download Submit
C:\Windows\system\pLugexj.exe

Filesize
2.9MB

MD5
836e25b7c300a180723f1052a7e60feb

SHA1
60c93ce482d9417955a6b126941c4ab650ade4f6

SHA256
3babf9c24d05c6505394b6c780486ccf58e76060d251c027a17e9819f5ac8dfc

SHA512
20eb0aedb78f58ebc6e93049bf10d957caf996a6a095099e42dfcebdc01aba1e8ae9c97b11f2f7c75aa85a46072e446e722e2fc7d683c9ebf2f1d59732ae2dce

Download Submit
C:\Windows\system\qCiKymm.exe

Filesize
2.9MB

MD5
567c5e4d1d0c5ce57ab97877bbc0cf41

SHA1
9125e5dd528e1bf1a04e891e773f31bead0a8136

SHA256
ef8c62eef4b123e4907388b9d98ee0e84220f91a9f7c756fff5c5616c6fb2194

SHA512
9a6cd097bdbd8f8f1b3c8a0d97d1326177fdedabea62f2d619c1f3858419a870b826cfe3f13a93a07ae2a502e63da3bf3762bfcea0342edfb969ca87c35a4340

Download Submit
C:\Windows\system\rJUdXvA.exe

Filesize
2.9MB

MD5
81dcfe0001f740efcb283d3133ddd5ac

SHA1
586c1740442d044d3300e74524544cd4a86ad531

SHA256
20cc590e3dbc605386c625ec54085276649bad6d708364a9a30233d779e6c37f

SHA512
723cd9681c7982dc055b493ba44b6ff336a633b3759943f3c060e2beffa60a645d9feff9fd24e673ba324e3aed9c9aa91638322fdeae140ede38d66e638bdd07

Download Submit
C:\Windows\system\sPhBrNd.exe

Filesize
2.9MB

MD5
a85c128257fb0cd27f506a864aa29b9e

SHA1
5a20125f1f39ea356e17304bde954de992277ec0

SHA256
129ea9a5896f077ddebbc5594d4720fddcc30377b664873f1a15ff5e4281b594

SHA512
f00f7bb29198b97dc6216973c1c06676598adef2afb6ea06e04ecbc59b283db1dadbe5ecf4605182d3c92390061ce4edd6e005e71e2804592b0deb8b3b0dc9b7

Download Submit
C:\Windows\system\sPlJScT.exe

Filesize
2.9MB

MD5
d2f9aa7d3181a406af06840ee1dc6c03

SHA1
29985eba9ca4bc054b8ba8bb272f996a1a43c085

SHA256
fdf1c76fe5d8343c51bc2c285771379bb71ef452ffc698513d3e920d2875a37e

SHA512
f0a90558c3175fdeb8aa34bb6ed908e3389e551edb291fc548fe9c502c58142de0e0dcbab59040f6bdebd2de78b4da15c97c798ce273811f4f7260fb10bde56a

Download Submit
C:\Windows\system\wOticuJ.exe

Filesize
18B

MD5
562e1f503f9323ecdf03b75b8a046b84

SHA1
819970a3f333749dc5e6e81782e1214d8b97ac28

SHA256
e23de23d7273616e0f1e3fc9b3934e7ed5d8a6076756d487ea7f187fda90660f

SHA512
74b6d236f47cf7a927c00b106c5fd7982d548a0e5ea341f95506555fbf8b16a4bde57f5a2fdac9da7b5971549864df49221603298ec7d8d9df3d972894c2713f

Download Submit
\Windows\system\BNDpFHr.exe

Filesize
2.9MB

MD5
276cecfbeffacb2de826c758b316c942

SHA1
d5f1d7aa4fc106fa1bde3cb0676c1e44b87cd5b0

SHA256
13b5d36f2658a6601a5f0e7a8e27def1128d2b41c279ef464df622a0dc5b5521

SHA512
9ab57b8e0799934a3d89bd8ef48e0ac5b7024c57ce46d6b9d0adc7f471d5538784a4a6258c44963c558743af69bb9f65d00e50208fedd059d97f840f4fff4514

Download Submit
\Windows\system\DUYDAuB.exe

Filesize
2.9MB

MD5
9cfb4c37e06b47f1ed001d59fdfcc44d

SHA1
391c29872a2fc12a781f6896314acf4e3fe8d971

SHA256
fe0db5e2892c106ffbfce5286527f31631e3b621ef2d6ee7963a129325b9fd70

SHA512
b03744d7793bc02ca59e67683e66a295a52ab62c803b6dd453ff531d0adb423fa0330dcef032163686f811e0c01f0462d5e404b4adaaaf65ec044525345d64d8

Download Submit
\Windows\system\HFGpJQy.exe

Filesize
2.9MB

MD5
47e93310bc8b9785eb92a02fdfe072b3

SHA1
97789e73bd74146983bc2c74d3f47d239e05eb03

SHA256
265dc12fa9ca66961852c8ec2c0802ca0bcc9c2ba518ed5b51fa7ce45efad1a0

SHA512
a2867e99613c768ac62c757dd869d9ed679f8edcfee9726dd926ac3135a869e15b586c7bc7b13c301eb5ce8ac5a5e38a9d2ff85cc3232cd956755e980148fd1b

Download Submit
\Windows\system\HjHonhy.exe

Filesize
2.9MB

MD5
f13f2d3d55a23af688dc85d3a860032b

SHA1
152c7a4dcc12e856a5c0eafa5425a7301de3b3aa

SHA256
e177cdaf61f9fd6cb06986194a2bdb1557f147b1bbd8e93b7525e5a3ba31b281

SHA512
8864db7ea42cfda9966e26ab9420302b176c6e7ff6e6fb2ae811605998b6889a3464144fd2c83e32d57b1c495c2894afd6ad8ca4108fa189b06ea5fdf29afb07

Download Submit
\Windows\system\JaswqSL.exe

Filesize
2.9MB

MD5
931fdc8cc8df942e56b67947fc5a5dc5

SHA1
94d0eee208d672e471fede9eace036c1dc5ca0b8

SHA256
3b3551c4aab22e49454b88996f20e9c6a63a1d46bd0e749b4c21047147b9aa00

SHA512
90c6e5c9597a5fcf0fa8bfa8269b41a500a46fc4cf7d0982b911bfbb3867bf825d03986067aefa5a2eb55d654426bca7e90850454ff6ef3a27a77439b58916d1

Download Submit
\Windows\system\QhDpDCv.exe

Filesize
2.9MB

MD5
b1c0643185d4bed1bd02ea8115b537b0

SHA1
5328705a1d83ffd85322af760b4d1c7550b6337c

SHA256
a2f67ca17fdd0ce5af75f2f6991011b6b4ddd75acf332550687926fe64354640

SHA512
d99343c4148c95f1d6c201569ba9a19af79de7ec0bead2121c720e78fc8b274843b28dc77156524c7e428a74b26b12134234bfb947f17c890dacc17768f9554d

Download Submit
\Windows\system\SmXeBFz.exe

Filesize
2.9MB

MD5
9eb0d59a8a00c7ffc0a7154d4d1e68de

SHA1
3b911d7ac95c8680353831cc5ce8b26b02325d40

SHA256
5f98398366129d28f95a3aa8d800915e71c3120b32d66487966a69c844131dd8

SHA512
56661980fdb546c8cda8f1ede66bc55f77764e18d389039c0bccc6c3a02991505cc22767eeb3e0b2f27e2fe437bb11a79d68ff16273ab37f0380ccc3b1cd7c14

Download Submit
\Windows\system\YrBBrhQ.exe

Filesize
2.9MB

MD5
39e0f9652f6fcf5c48d7662735178f0d

SHA1
d0bbe782716769bf5b22391c4d3aa5694a7317ed

SHA256
1c833c0295ae9e96cf4d09f919bbd16ad7a444800ca040e0d9cf4b13fb3a0d31

SHA512
72347bb40f709e190cd8770003c7a77f80f4950128b4df4fd18cd76517440316db5ea8ce7168ca993210b0619d2c90cbe713198d7c8824b32431b4ac272eaf5f

Download Submit
\Windows\system\ZkAEWDH.exe

Filesize
2.9MB

MD5
d2d5eaaa940fa3e87cf054200ea58175

SHA1
b8ba55f5d3219616518982f8bca6b8770d49ec13

SHA256
645ac433d87a342248957001afd7bbc06587dfbaa3ccec518071456df44f123d

SHA512
2946b05849f93d8e8227590af01092fcb8fd3de913bf728ede84b1558a1099692cd3e3cd989d52a6369e12b41b795faf23d527a45dd9db256c0eb416416a7784

Download Submit
\Windows\system\cQFlBCj.exe

Filesize
2.9MB

MD5
d0c834e263faa0e8414e5e646c1cd4d4

SHA1
01862499126d29eaa8e84ec522c88d2ac9d3d557

SHA256
f23e69917ea7212c2369822c1600a2b167e6fce4b6e32dfbf0c9b993978ebcbe

SHA512
d35c14e7c944e64894a406b8df0f0a3c1e113f8460eefab20e2705edc62aa13cdb7ac63e9d2ab66742d5e09ce31e8dfe20963e51aeda2c96635893b723b116c6

Download Submit
\Windows\system\nEUnKUl.exe

Filesize
2.9MB

MD5
2cf0fd9f6831f89813842fa1f5695f9b

SHA1
1b877535bd850aeb71b6341a1677ce682c911681

SHA256
df5fdc8694373c8d999da3438b21dd3f27a24b8bd5c8a9e2a3d717dd9dd97656

SHA512
5ebc1c22caa6ce34ccd4c6e75292344dd962bb422fb113ce9517fd53909d043f3176942b0454c4918b1a11f9756749401db2e94fe346ac4e2606870f8b60091a

Download Submit
\Windows\system\oGTxpTN.exe

Filesize
2.9MB

MD5
d5dd3eb72a76646b5886015926674904

SHA1
15387889a82acc257c9b34b1f310ac325ca26dd9

SHA256
cfe72ec5723cbff305f631925439f7591f60b814a1f8b27ec1ecef2ce8d66637

SHA512
c215442e6ebc02cf9efbbc8b5494003cb97584859be6ae7c920d3e14ed6c5b0ddf9d0d3b8a53f3747bab5ea8f2fd2ee85479719055e6093dcfdec778093456fd

Download Submit
\Windows\system\pnLqMFK.exe

Filesize
2.9MB

MD5
734d252ec0ad65dda830ab28e7b17f75

SHA1
d66b841313ce9a3c681e8836eacd0f2082aeb22f

SHA256
c08c3b703aa1d595ac9eab40d837c3c21851af96cc50aeb3a06e40ae4bb75b6c

SHA512
8c2582153e43fbf5ce519bce325fc608183fdbe68c1aa1a18141aecb7867c8c7ad36bd0fcf8772fb8a4c8951986e56ca0ff5852ed6a42c6f240afacdebd48fb0

Download Submit
\Windows\system\zYvtQwu.exe

Filesize
2.9MB

MD5
60bdf4cb4cf4034aaa49a6ba022fcd5c

SHA1
6ab7e76a3c80ccf28281a1df467308fedd26b748

SHA256
ae700944607b603afa53164532863d3d8eb9a394af93bd5a026341411cd3eda5

SHA512
a447f6cf93442f97f931cb7d7975e3096c5cdf468865ebb1aa91e69fee3870d2fc4a83d462e841633c8d3262a347b3468ae823e51437448ae59f06bfaf076ffa

Download Submit
memory/320-51-0x000000001B570000-0x000000001B852000-memory.dmp

Filesize
2.9MB

Download
memory/320-47-0x000007FEF566E000-0x000007FEF566F000-memory.dmp

Filesize
4KB

Download
memory/320-60-0x00000000020D0000-0x00000000020D8000-memory.dmp

Filesize
32KB

Download
memory/320-32-0x0000000002A20000-0x0000000002AA0000-memory.dmp

Filesize
512KB

Download
memory/760-46-0x000000013FAA0000-0x000000013FE96000-memory.dmp

Filesize
4.0MB

Download
memory/868-44-0x000000013FFF0000-0x00000001403E6000-memory.dmp

Filesize
4.0MB

Download
memory/868-7627-0x000000013FFF0000-0x00000001403E6000-memory.dmp

Filesize
4.0MB

Download
memory/2320-7625-0x000000013FFB0000-0x00000001403A6000-memory.dmp

Filesize
4.0MB

Download
memory/2320-67-0x000000013FFB0000-0x00000001403A6000-memory.dmp

Filesize
4.0MB

Download
memory/2320-9-0x000000013FFB0000-0x00000001403A6000-memory.dmp

Filesize
4.0MB

Download
memory/2404-0-0x00000000000F0000-0x0000000000100000-memory.dmp

Filesize
64KB

Download
memory/2404-17-0x000000013FD20000-0x0000000140116000-memory.dmp

Filesize
4.0MB

Download
memory/2404-2-0x000000013F420000-0x000000013F816000-memory.dmp

Filesize
4.0MB

Download
memory/2404-50-0x0000000003380000-0x0000000003776000-memory.dmp

Filesize
4.0MB

Download
memory/2404-5457-0x000000013F9D0000-0x000000013FDC6000-memory.dmp

Filesize
4.0MB

Download
memory/2404-88-0x000000013F9D0000-0x000000013FDC6000-memory.dmp

Filesize
4.0MB

Download
memory/2404-5452-0x0000000003380000-0x0000000003776000-memory.dmp

Filesize
4.0MB

Download
memory/2404-87-0x0000000003380000-0x0000000003776000-memory.dmp

Filesize
4.0MB

Download
memory/2404-31-0x000000013F900000-0x000000013FCF6000-memory.dmp

Filesize
4.0MB

Download
memory/2404-10-0x0000000002F60000-0x0000000003356000-memory.dmp

Filesize
4.0MB

Download
memory/2404-84-0x000000013FB20000-0x000000013FF16000-memory.dmp

Filesize
4.0MB

Download
memory/2404-7-0x000000013FFB0000-0x00000001403A6000-memory.dmp

Filesize
4.0MB

Download
memory/2404-4011-0x000000013FCE0000-0x00000001400D6000-memory.dmp

Filesize
4.0MB

Download
memory/2404-86-0x0000000003380000-0x0000000003776000-memory.dmp

Filesize
4.0MB

Download
memory/2404-2475-0x0000000003380000-0x0000000003776000-memory.dmp

Filesize
4.0MB

Download
memory/2404-48-0x000000013FFF0000-0x00000001403E6000-memory.dmp

Filesize
4.0MB

Download
memory/2404-62-0x000000013F9E0000-0x000000013FDD6000-memory.dmp

Filesize
4.0MB

Download
memory/2404-66-0x000000013F420000-0x000000013F816000-memory.dmp

Filesize
4.0MB

Download
memory/2476-56-0x000000013F6C0000-0x000000013FAB6000-memory.dmp

Filesize
4.0MB

Download
memory/2560-293-0x000000013F320000-0x000000013F716000-memory.dmp

Filesize
4.0MB

Download
memory/2608-92-0x000000013FD20000-0x0000000140116000-memory.dmp

Filesize
4.0MB

Download
memory/2608-19-0x000000013FD20000-0x0000000140116000-memory.dmp

Filesize
4.0MB

Download
memory/2624-39-0x000000013F900000-0x000000013FCF6000-memory.dmp

Filesize
4.0MB

Download
memory/2636-93-0x000000013F9E0000-0x000000013FDD6000-memory.dmp

Filesize
4.0MB

Download
memory/2796-5459-0x000000013FB20000-0x000000013FF16000-memory.dmp

Filesize
4.0MB

Download
memory/2796-89-0x000000013FB20000-0x000000013FF16000-memory.dmp

Filesize
4.0MB

Download
memory/2796-8007-0x000000013FB20000-0x000000013FF16000-memory.dmp

Filesize
4.0MB

Download
memory/2900-85-0x000000013F9D0000-0x000000013FDC6000-memory.dmp

Filesize
4.0MB

Download
memory/2900-8005-0x000000013F9D0000-0x000000013FDC6000-memory.dmp

Filesize
4.0MB

Download
memory/3024-75-0x000000013FCE0000-0x00000001400D6000-memory.dmp

Filesize
4.0MB

Download