xmrig | d8925362c984b199253295727850caa3cf03326f3e3aed96221080ed0601e425

Analysis

max time kernel
150s
max time network
142s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
22/05/2024, 04:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

1d69ad23a77fbaca9e98d6c4dcdd0700_NeikiAnalytics.exe
Size

2.9MB
MD5

1d69ad23a77fbaca9e98d6c4dcdd0700
SHA1

e3943deed57ad803f220511384baa982df155ab2
SHA256

d8925362c984b199253295727850caa3cf03326f3e3aed96221080ed0601e425
SHA512

1cbfb401c5da222c6a8099a7a8b8e3f320dea7f2ea8ae57d477c15c95197fabbe69f0f07f4642d064444da6bec53d2a4f2682c5da64caee995ba2dd5021bcc2d
SSDEEP

49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkyW10/wKV7hjSeg:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2Rs

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral1/memory/1844-1-0x000000013F500000-0x000000013F8F6000-memory.dmp	xmrig
behavioral1/files/0x000a000000012286-3.dat	xmrig
behavioral1/memory/2156-9-0x000000013F5D0000-0x000000013F9C6000-memory.dmp	xmrig
behavioral1/files/0x0036000000015fef-13.dat	xmrig
behavioral1/files/0x0008000000016581-12.dat	xmrig
behavioral1/files/0x000d00000000549e-30.dat	xmrig
behavioral1/files/0x0008000000016a8a-35.dat	xmrig
behavioral1/files/0x0007000000016c52-40.dat	xmrig
behavioral1/files/0x0007000000016c6f-46.dat	xmrig
behavioral1/files/0x0008000000016dd1-55.dat	xmrig
behavioral1/files/0x0006000000016de3-66.dat	xmrig
behavioral1/files/0x0006000000017577-91.dat	xmrig
behavioral1/files/0x000d000000018673-98.dat	xmrig
behavioral1/memory/2692-108-0x000000013F0B0000-0x000000013F4A6000-memory.dmp	xmrig
behavioral1/memory/2516-114-0x000000013F950000-0x000000013FD46000-memory.dmp	xmrig
behavioral1/memory/1844-115-0x000000013F070000-0x000000013F466000-memory.dmp	xmrig
behavioral1/files/0x00060000000190da-162.dat	xmrig
behavioral1/files/0x0005000000019428-184.dat	xmrig
behavioral1/files/0x0005000000019447-188.dat	xmrig
behavioral1/files/0x00050000000193e5-176.dat	xmrig
behavioral1/files/0x0005000000019358-169.dat	xmrig
behavioral1/files/0x0006000000018bd9-155.dat	xmrig
behavioral1/files/0x00050000000187b3-148.dat	xmrig
behavioral1/files/0x0005000000018797-141.dat	xmrig
behavioral1/memory/2636-134-0x000000013FD10000-0x0000000140106000-memory.dmp	xmrig
behavioral1/memory/2128-132-0x000000013FC20000-0x0000000140016000-memory.dmp	xmrig
behavioral1/files/0x0005000000018723-131.dat	xmrig
behavioral1/memory/2676-112-0x000000013FB90000-0x000000013FF86000-memory.dmp	xmrig
behavioral1/memory/1232-110-0x000000013FED0000-0x00000001402C6000-memory.dmp	xmrig
behavioral1/files/0x000500000001870f-107.dat	xmrig
behavioral1/files/0x00060000000173f6-84.dat	xmrig
behavioral1/files/0x0006000000017223-76.dat	xmrig
behavioral1/files/0x0006000000016ddc-60.dat	xmrig
behavioral1/files/0x0008000000016cc1-51.dat	xmrig
behavioral1/memory/2720-21-0x000000013F8C0000-0x000000013FCB6000-memory.dmp	xmrig
behavioral1/files/0x00060000000173ca-79.dat	xmrig
behavioral1/files/0x00060000000171d7-72.dat	xmrig
behavioral1/files/0x000500000001870e-100.dat	xmrig
behavioral1/files/0x0006000000018bed-157.dat	xmrig
behavioral1/files/0x0005000000019314-164.dat	xmrig
behavioral1/files/0x00050000000193d9-171.dat	xmrig
behavioral1/files/0x00050000000193ff-178.dat	xmrig
behavioral1/files/0x000500000001942b-185.dat	xmrig
behavioral1/files/0x0006000000018b86-150.dat	xmrig
behavioral1/files/0x000500000001879e-143.dat	xmrig
behavioral1/files/0x0005000000018784-136.dat	xmrig
behavioral1/memory/1944-126-0x000000013F4A0000-0x000000013F896000-memory.dmp	xmrig
behavioral1/memory/2060-123-0x000000013F4E0000-0x000000013F8D6000-memory.dmp	xmrig
behavioral1/memory/3060-121-0x000000013F760000-0x000000013FB56000-memory.dmp	xmrig
behavioral1/memory/1844-120-0x0000000003530000-0x0000000003926000-memory.dmp	xmrig
behavioral1/memory/2576-119-0x000000013F070000-0x000000013F466000-memory.dmp	xmrig
behavioral1/files/0x000500000001871f-116.dat	xmrig
behavioral1/files/0x0014000000018668-93.dat	xmrig
behavioral1/files/0x00060000000173f9-86.dat	xmrig
behavioral1/memory/2720-5514-0x000000013F8C0000-0x000000013FCB6000-memory.dmp	xmrig
behavioral1/memory/2156-5883-0x000000013F5D0000-0x000000013F9C6000-memory.dmp	xmrig
behavioral1/memory/2516-6014-0x000000013F950000-0x000000013FD46000-memory.dmp	xmrig
behavioral1/memory/3060-6017-0x000000013F760000-0x000000013FB56000-memory.dmp	xmrig
behavioral1/memory/1944-6030-0x000000013F4A0000-0x000000013F896000-memory.dmp	xmrig
behavioral1/memory/2576-6016-0x000000013F070000-0x000000013F466000-memory.dmp	xmrig
behavioral1/memory/2692-6013-0x000000013F0B0000-0x000000013F4A6000-memory.dmp	xmrig
behavioral1/memory/2128-6033-0x000000013FC20000-0x0000000140016000-memory.dmp	xmrig
behavioral1/memory/2060-6019-0x000000013F4E0000-0x000000013F8D6000-memory.dmp	xmrig
behavioral1/memory/1232-6015-0x000000013FED0000-0x00000001402C6000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
1052	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
2156	dViXFYA.exe
2720	eYozcqh.exe
2636	QySnFzU.exe
2692	cSYJPbD.exe
1232	OIoyaXf.exe
2676	OUQOJGM.exe
2516	BlljsWL.exe
2576	kPMcZQE.exe
3060	yrNdiDU.exe
2060	UQOQGTu.exe
1944	CBaSGKv.exe
2128	QNycfbS.exe
3048	hpzpEIP.exe
2896	xGeDYca.exe
744	TOGJxSb.exe
2772	HHsrHVR.exe
1300	bvhpSUN.exe
1120	kZFKwuk.exe
800	RmwQBWY.exe
1764	RVnucNg.exe
2120	KUiiTWj.exe
2496	McifMXT.exe
2968	ZrqNgTn.exe
2340	IFNsZWT.exe
1076	qJanJwx.exe
2472	ovpCliE.exe
2308	bPbZwNc.exe
2304	mOiLWHM.exe
1280	zPKeXFu.exe
1608	kGzXxpC.exe
1620	FpEFxaJ.exe
896	EAAaMRd.exe
2476	idsIGwk.exe
1116	EkvkYzO.exe
2396	auSNvID.exe
1128	mejQYXZ.exe
872	koNlNaO.exe
2412	xgGCOKa.exe
1600	jjBcllB.exe
2836	JMoEEJw.exe
2960	wJsAamu.exe
2824	kKTmeYM.exe
2560	kHKtNEB.exe
2292	wGJBwVc.exe
1648	bNOIlgG.exe
2788	PJtmuoQ.exe
324	wyRQxkF.exe
1312	KrFDxJk.exe
2300	QoZXqbA.exe
1968	wCVkXyq.exe
2352	UyqUkpy.exe
1724	nEgAbtX.exe
2528	zxWCkKP.exe
2620	BNVCmwm.exe
3092	DILNpnT.exe
3124	CSgxvdF.exe
3156	UMMgZTi.exe
3200	aqEfeKK.exe
3784	lppfSfW.exe
3816	LFTtUlE.exe
3848	mLJqrey.exe
3880	afZyZJv.exe
3912	bnqgGsv.exe
3944	kUhXIWq.exe

Loads dropped DLL 64 IoCs

pid	Process
1844	1d69ad23a77fbaca9e98d6c4dcdd0700_NeikiAnalytics.exe
1844	1d69ad23a77fbaca9e98d6c4dcdd0700_NeikiAnalytics.exe
1844	1d69ad23a77fbaca9e98d6c4dcdd0700_NeikiAnalytics.exe
1844	1d69ad23a77fbaca9e98d6c4dcdd0700_NeikiAnalytics.exe
1844	1d69ad23a77fbaca9e98d6c4dcdd0700_NeikiAnalytics.exe
1844	1d69ad23a77fbaca9e98d6c4dcdd0700_NeikiAnalytics.exe
1844	1d69ad23a77fbaca9e98d6c4dcdd0700_NeikiAnalytics.exe
1844	1d69ad23a77fbaca9e98d6c4dcdd0700_NeikiAnalytics.exe
1844	1d69ad23a77fbaca9e98d6c4dcdd0700_NeikiAnalytics.exe
1844	1d69ad23a77fbaca9e98d6c4dcdd0700_NeikiAnalytics.exe
1844	1d69ad23a77fbaca9e98d6c4dcdd0700_NeikiAnalytics.exe
1844	1d69ad23a77fbaca9e98d6c4dcdd0700_NeikiAnalytics.exe
1844	1d69ad23a77fbaca9e98d6c4dcdd0700_NeikiAnalytics.exe
1844	1d69ad23a77fbaca9e98d6c4dcdd0700_NeikiAnalytics.exe
1844	1d69ad23a77fbaca9e98d6c4dcdd0700_NeikiAnalytics.exe
1844	1d69ad23a77fbaca9e98d6c4dcdd0700_NeikiAnalytics.exe
1844	1d69ad23a77fbaca9e98d6c4dcdd0700_NeikiAnalytics.exe
1844	1d69ad23a77fbaca9e98d6c4dcdd0700_NeikiAnalytics.exe
1844	1d69ad23a77fbaca9e98d6c4dcdd0700_NeikiAnalytics.exe
1844	1d69ad23a77fbaca9e98d6c4dcdd0700_NeikiAnalytics.exe
1844	1d69ad23a77fbaca9e98d6c4dcdd0700_NeikiAnalytics.exe
1844	1d69ad23a77fbaca9e98d6c4dcdd0700_NeikiAnalytics.exe
1844	1d69ad23a77fbaca9e98d6c4dcdd0700_NeikiAnalytics.exe
1844	1d69ad23a77fbaca9e98d6c4dcdd0700_NeikiAnalytics.exe
1844	1d69ad23a77fbaca9e98d6c4dcdd0700_NeikiAnalytics.exe
1844	1d69ad23a77fbaca9e98d6c4dcdd0700_NeikiAnalytics.exe
1844	1d69ad23a77fbaca9e98d6c4dcdd0700_NeikiAnalytics.exe
1844	1d69ad23a77fbaca9e98d6c4dcdd0700_NeikiAnalytics.exe
1844	1d69ad23a77fbaca9e98d6c4dcdd0700_NeikiAnalytics.exe
1844	1d69ad23a77fbaca9e98d6c4dcdd0700_NeikiAnalytics.exe
1844	1d69ad23a77fbaca9e98d6c4dcdd0700_NeikiAnalytics.exe
1844	1d69ad23a77fbaca9e98d6c4dcdd0700_NeikiAnalytics.exe
1844	1d69ad23a77fbaca9e98d6c4dcdd0700_NeikiAnalytics.exe
1844	1d69ad23a77fbaca9e98d6c4dcdd0700_NeikiAnalytics.exe
1844	1d69ad23a77fbaca9e98d6c4dcdd0700_NeikiAnalytics.exe
1844	1d69ad23a77fbaca9e98d6c4dcdd0700_NeikiAnalytics.exe
1844	1d69ad23a77fbaca9e98d6c4dcdd0700_NeikiAnalytics.exe
1844	1d69ad23a77fbaca9e98d6c4dcdd0700_NeikiAnalytics.exe
1844	1d69ad23a77fbaca9e98d6c4dcdd0700_NeikiAnalytics.exe
1844	1d69ad23a77fbaca9e98d6c4dcdd0700_NeikiAnalytics.exe
1844	1d69ad23a77fbaca9e98d6c4dcdd0700_NeikiAnalytics.exe
1844	1d69ad23a77fbaca9e98d6c4dcdd0700_NeikiAnalytics.exe
1844	1d69ad23a77fbaca9e98d6c4dcdd0700_NeikiAnalytics.exe
1844	1d69ad23a77fbaca9e98d6c4dcdd0700_NeikiAnalytics.exe
1844	1d69ad23a77fbaca9e98d6c4dcdd0700_NeikiAnalytics.exe
1844	1d69ad23a77fbaca9e98d6c4dcdd0700_NeikiAnalytics.exe
1844	1d69ad23a77fbaca9e98d6c4dcdd0700_NeikiAnalytics.exe
1844	1d69ad23a77fbaca9e98d6c4dcdd0700_NeikiAnalytics.exe
1844	1d69ad23a77fbaca9e98d6c4dcdd0700_NeikiAnalytics.exe
1844	1d69ad23a77fbaca9e98d6c4dcdd0700_NeikiAnalytics.exe
1844	1d69ad23a77fbaca9e98d6c4dcdd0700_NeikiAnalytics.exe
1844	1d69ad23a77fbaca9e98d6c4dcdd0700_NeikiAnalytics.exe
1844	1d69ad23a77fbaca9e98d6c4dcdd0700_NeikiAnalytics.exe
1844	1d69ad23a77fbaca9e98d6c4dcdd0700_NeikiAnalytics.exe
1844	1d69ad23a77fbaca9e98d6c4dcdd0700_NeikiAnalytics.exe
1844	1d69ad23a77fbaca9e98d6c4dcdd0700_NeikiAnalytics.exe
1844	1d69ad23a77fbaca9e98d6c4dcdd0700_NeikiAnalytics.exe
1844	1d69ad23a77fbaca9e98d6c4dcdd0700_NeikiAnalytics.exe
1844	1d69ad23a77fbaca9e98d6c4dcdd0700_NeikiAnalytics.exe
1844	1d69ad23a77fbaca9e98d6c4dcdd0700_NeikiAnalytics.exe
1844	1d69ad23a77fbaca9e98d6c4dcdd0700_NeikiAnalytics.exe
1844	1d69ad23a77fbaca9e98d6c4dcdd0700_NeikiAnalytics.exe
1844	1d69ad23a77fbaca9e98d6c4dcdd0700_NeikiAnalytics.exe
1844	1d69ad23a77fbaca9e98d6c4dcdd0700_NeikiAnalytics.exe

UPX packed file 63 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1844-1-0x000000013F500000-0x000000013F8F6000-memory.dmp	upx
behavioral1/files/0x000a000000012286-3.dat	upx
behavioral1/memory/2156-9-0x000000013F5D0000-0x000000013F9C6000-memory.dmp	upx
behavioral1/files/0x0036000000015fef-13.dat	upx
behavioral1/files/0x0008000000016581-12.dat	upx
behavioral1/files/0x000d00000000549e-30.dat	upx
behavioral1/files/0x0008000000016a8a-35.dat	upx
behavioral1/files/0x0007000000016c52-40.dat	upx
behavioral1/files/0x0007000000016c6f-46.dat	upx
behavioral1/files/0x0008000000016dd1-55.dat	upx
behavioral1/files/0x0006000000016de3-66.dat	upx
behavioral1/files/0x0006000000017577-91.dat	upx
behavioral1/files/0x000d000000018673-98.dat	upx
behavioral1/memory/2692-108-0x000000013F0B0000-0x000000013F4A6000-memory.dmp	upx
behavioral1/memory/2516-114-0x000000013F950000-0x000000013FD46000-memory.dmp	upx
behavioral1/files/0x00060000000190da-162.dat	upx
behavioral1/files/0x0005000000019428-184.dat	upx
behavioral1/files/0x0005000000019447-188.dat	upx
behavioral1/files/0x00050000000193e5-176.dat	upx
behavioral1/files/0x0005000000019358-169.dat	upx
behavioral1/files/0x0006000000018bd9-155.dat	upx
behavioral1/files/0x00050000000187b3-148.dat	upx
behavioral1/files/0x0005000000018797-141.dat	upx
behavioral1/memory/2636-134-0x000000013FD10000-0x0000000140106000-memory.dmp	upx
behavioral1/memory/2128-132-0x000000013FC20000-0x0000000140016000-memory.dmp	upx
behavioral1/files/0x0005000000018723-131.dat	upx
behavioral1/memory/2676-112-0x000000013FB90000-0x000000013FF86000-memory.dmp	upx
behavioral1/memory/1232-110-0x000000013FED0000-0x00000001402C6000-memory.dmp	upx
behavioral1/files/0x000500000001870f-107.dat	upx
behavioral1/files/0x00060000000173f6-84.dat	upx
behavioral1/files/0x0006000000017223-76.dat	upx
behavioral1/files/0x0006000000016ddc-60.dat	upx
behavioral1/files/0x0008000000016cc1-51.dat	upx
behavioral1/memory/2720-21-0x000000013F8C0000-0x000000013FCB6000-memory.dmp	upx
behavioral1/files/0x00060000000173ca-79.dat	upx
behavioral1/files/0x00060000000171d7-72.dat	upx
behavioral1/files/0x000500000001870e-100.dat	upx
behavioral1/files/0x0006000000018bed-157.dat	upx
behavioral1/files/0x0005000000019314-164.dat	upx
behavioral1/files/0x00050000000193d9-171.dat	upx
behavioral1/files/0x00050000000193ff-178.dat	upx
behavioral1/files/0x000500000001942b-185.dat	upx
behavioral1/files/0x0006000000018b86-150.dat	upx
behavioral1/files/0x000500000001879e-143.dat	upx
behavioral1/files/0x0005000000018784-136.dat	upx
behavioral1/memory/1944-126-0x000000013F4A0000-0x000000013F896000-memory.dmp	upx
behavioral1/memory/2060-123-0x000000013F4E0000-0x000000013F8D6000-memory.dmp	upx
behavioral1/memory/3060-121-0x000000013F760000-0x000000013FB56000-memory.dmp	upx
behavioral1/memory/2576-119-0x000000013F070000-0x000000013F466000-memory.dmp	upx
behavioral1/files/0x000500000001871f-116.dat	upx
behavioral1/files/0x0014000000018668-93.dat	upx
behavioral1/files/0x00060000000173f9-86.dat	upx
behavioral1/memory/2720-5514-0x000000013F8C0000-0x000000013FCB6000-memory.dmp	upx
behavioral1/memory/2156-5883-0x000000013F5D0000-0x000000013F9C6000-memory.dmp	upx
behavioral1/memory/2516-6014-0x000000013F950000-0x000000013FD46000-memory.dmp	upx
behavioral1/memory/3060-6017-0x000000013F760000-0x000000013FB56000-memory.dmp	upx
behavioral1/memory/1944-6030-0x000000013F4A0000-0x000000013F896000-memory.dmp	upx
behavioral1/memory/2576-6016-0x000000013F070000-0x000000013F466000-memory.dmp	upx
behavioral1/memory/2692-6013-0x000000013F0B0000-0x000000013F4A6000-memory.dmp	upx
behavioral1/memory/2128-6033-0x000000013FC20000-0x0000000140016000-memory.dmp	upx
behavioral1/memory/2060-6019-0x000000013F4E0000-0x000000013F8D6000-memory.dmp	upx
behavioral1/memory/1232-6015-0x000000013FED0000-0x00000001402C6000-memory.dmp	upx
behavioral1/memory/2128-6478-0x000000013FC20000-0x0000000140016000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\LIIxDij.exe	1d69ad23a77fbaca9e98d6c4dcdd0700_NeikiAnalytics.exe
File created	C:\Windows\System\TICYylS.exe	1d69ad23a77fbaca9e98d6c4dcdd0700_NeikiAnalytics.exe
File created	C:\Windows\System\DhCSxLl.exe	1d69ad23a77fbaca9e98d6c4dcdd0700_NeikiAnalytics.exe
File created	C:\Windows\System\ROeUuJh.exe	1d69ad23a77fbaca9e98d6c4dcdd0700_NeikiAnalytics.exe
File created	C:\Windows\System\urwoxLG.exe	1d69ad23a77fbaca9e98d6c4dcdd0700_NeikiAnalytics.exe
File created	C:\Windows\System\hIvwEAZ.exe	1d69ad23a77fbaca9e98d6c4dcdd0700_NeikiAnalytics.exe
File created	C:\Windows\System\DUsuhFJ.exe	1d69ad23a77fbaca9e98d6c4dcdd0700_NeikiAnalytics.exe
File created	C:\Windows\System\UZNHyQp.exe	1d69ad23a77fbaca9e98d6c4dcdd0700_NeikiAnalytics.exe
File created	C:\Windows\System\tUesdvq.exe	1d69ad23a77fbaca9e98d6c4dcdd0700_NeikiAnalytics.exe
File created	C:\Windows\System\KwjJoxV.exe	1d69ad23a77fbaca9e98d6c4dcdd0700_NeikiAnalytics.exe
File created	C:\Windows\System\aQiCIqx.exe	1d69ad23a77fbaca9e98d6c4dcdd0700_NeikiAnalytics.exe
File created	C:\Windows\System\EUxWPeH.exe	1d69ad23a77fbaca9e98d6c4dcdd0700_NeikiAnalytics.exe
File created	C:\Windows\System\BuqEHim.exe	1d69ad23a77fbaca9e98d6c4dcdd0700_NeikiAnalytics.exe
File created	C:\Windows\System\AopiEYV.exe	1d69ad23a77fbaca9e98d6c4dcdd0700_NeikiAnalytics.exe
File created	C:\Windows\System\mPHnVsv.exe	1d69ad23a77fbaca9e98d6c4dcdd0700_NeikiAnalytics.exe
File created	C:\Windows\System\lgruNiX.exe	1d69ad23a77fbaca9e98d6c4dcdd0700_NeikiAnalytics.exe
File created	C:\Windows\System\efBIhxk.exe	1d69ad23a77fbaca9e98d6c4dcdd0700_NeikiAnalytics.exe
File created	C:\Windows\System\RCVsEgd.exe	1d69ad23a77fbaca9e98d6c4dcdd0700_NeikiAnalytics.exe
File created	C:\Windows\System\DILNpnT.exe	1d69ad23a77fbaca9e98d6c4dcdd0700_NeikiAnalytics.exe
File created	C:\Windows\System\OyNeFhq.exe	1d69ad23a77fbaca9e98d6c4dcdd0700_NeikiAnalytics.exe
File created	C:\Windows\System\FqpXqho.exe	1d69ad23a77fbaca9e98d6c4dcdd0700_NeikiAnalytics.exe
File created	C:\Windows\System\VNFopDO.exe	1d69ad23a77fbaca9e98d6c4dcdd0700_NeikiAnalytics.exe
File created	C:\Windows\System\mIzMcRb.exe	1d69ad23a77fbaca9e98d6c4dcdd0700_NeikiAnalytics.exe
File created	C:\Windows\System\OJIrCpA.exe	1d69ad23a77fbaca9e98d6c4dcdd0700_NeikiAnalytics.exe
File created	C:\Windows\System\aNCuCWV.exe	1d69ad23a77fbaca9e98d6c4dcdd0700_NeikiAnalytics.exe
File created	C:\Windows\System\GGdtiRP.exe	1d69ad23a77fbaca9e98d6c4dcdd0700_NeikiAnalytics.exe
File created	C:\Windows\System\hOMKvbw.exe	1d69ad23a77fbaca9e98d6c4dcdd0700_NeikiAnalytics.exe
File created	C:\Windows\System\mlxUfOO.exe	1d69ad23a77fbaca9e98d6c4dcdd0700_NeikiAnalytics.exe
File created	C:\Windows\System\EqEAfoJ.exe	1d69ad23a77fbaca9e98d6c4dcdd0700_NeikiAnalytics.exe
File created	C:\Windows\System\nWLcrEB.exe	1d69ad23a77fbaca9e98d6c4dcdd0700_NeikiAnalytics.exe
File created	C:\Windows\System\HczOlnr.exe	1d69ad23a77fbaca9e98d6c4dcdd0700_NeikiAnalytics.exe
File created	C:\Windows\System\xzuRXnB.exe	1d69ad23a77fbaca9e98d6c4dcdd0700_NeikiAnalytics.exe
File created	C:\Windows\System\GOtGwat.exe	1d69ad23a77fbaca9e98d6c4dcdd0700_NeikiAnalytics.exe
File created	C:\Windows\System\iQPPNtI.exe	1d69ad23a77fbaca9e98d6c4dcdd0700_NeikiAnalytics.exe
File created	C:\Windows\System\wJsAamu.exe	1d69ad23a77fbaca9e98d6c4dcdd0700_NeikiAnalytics.exe
File created	C:\Windows\System\QIfeMgD.exe	1d69ad23a77fbaca9e98d6c4dcdd0700_NeikiAnalytics.exe
File created	C:\Windows\System\WERvnyN.exe	1d69ad23a77fbaca9e98d6c4dcdd0700_NeikiAnalytics.exe
File created	C:\Windows\System\piJJSot.exe	1d69ad23a77fbaca9e98d6c4dcdd0700_NeikiAnalytics.exe
File created	C:\Windows\System\YxlURkT.exe	1d69ad23a77fbaca9e98d6c4dcdd0700_NeikiAnalytics.exe
File created	C:\Windows\System\myhjRDJ.exe	1d69ad23a77fbaca9e98d6c4dcdd0700_NeikiAnalytics.exe
File created	C:\Windows\System\xGeDYca.exe	1d69ad23a77fbaca9e98d6c4dcdd0700_NeikiAnalytics.exe
File created	C:\Windows\System\vtedEFP.exe	1d69ad23a77fbaca9e98d6c4dcdd0700_NeikiAnalytics.exe
File created	C:\Windows\System\NTcVzca.exe	1d69ad23a77fbaca9e98d6c4dcdd0700_NeikiAnalytics.exe
File created	C:\Windows\System\gEmNffB.exe	1d69ad23a77fbaca9e98d6c4dcdd0700_NeikiAnalytics.exe
File created	C:\Windows\System\NWzwCbb.exe	1d69ad23a77fbaca9e98d6c4dcdd0700_NeikiAnalytics.exe
File created	C:\Windows\System\MlKuQOi.exe	1d69ad23a77fbaca9e98d6c4dcdd0700_NeikiAnalytics.exe
File created	C:\Windows\System\gwXuhrM.exe	1d69ad23a77fbaca9e98d6c4dcdd0700_NeikiAnalytics.exe
File created	C:\Windows\System\XxetZOg.exe	1d69ad23a77fbaca9e98d6c4dcdd0700_NeikiAnalytics.exe
File created	C:\Windows\System\RkowGXe.exe	1d69ad23a77fbaca9e98d6c4dcdd0700_NeikiAnalytics.exe
File created	C:\Windows\System\RbwhIXk.exe	1d69ad23a77fbaca9e98d6c4dcdd0700_NeikiAnalytics.exe
File created	C:\Windows\System\mPGqfOx.exe	1d69ad23a77fbaca9e98d6c4dcdd0700_NeikiAnalytics.exe
File created	C:\Windows\System\dfBcPqm.exe	1d69ad23a77fbaca9e98d6c4dcdd0700_NeikiAnalytics.exe
File created	C:\Windows\System\FuXLDjE.exe	1d69ad23a77fbaca9e98d6c4dcdd0700_NeikiAnalytics.exe
File created	C:\Windows\System\JFXKveA.exe	1d69ad23a77fbaca9e98d6c4dcdd0700_NeikiAnalytics.exe
File created	C:\Windows\System\ICEhjrm.exe	1d69ad23a77fbaca9e98d6c4dcdd0700_NeikiAnalytics.exe
File created	C:\Windows\System\juQTMMh.exe	1d69ad23a77fbaca9e98d6c4dcdd0700_NeikiAnalytics.exe
File created	C:\Windows\System\rUuoNiu.exe	1d69ad23a77fbaca9e98d6c4dcdd0700_NeikiAnalytics.exe
File created	C:\Windows\System\oTyOMRN.exe	1d69ad23a77fbaca9e98d6c4dcdd0700_NeikiAnalytics.exe
File created	C:\Windows\System\mnbKsUD.exe	1d69ad23a77fbaca9e98d6c4dcdd0700_NeikiAnalytics.exe
File created	C:\Windows\System\bTzvBuC.exe	1d69ad23a77fbaca9e98d6c4dcdd0700_NeikiAnalytics.exe
File created	C:\Windows\System\UvOBKXJ.exe	1d69ad23a77fbaca9e98d6c4dcdd0700_NeikiAnalytics.exe
File created	C:\Windows\System\QGzmHVH.exe	1d69ad23a77fbaca9e98d6c4dcdd0700_NeikiAnalytics.exe
File created	C:\Windows\System\SuhXNWH.exe	1d69ad23a77fbaca9e98d6c4dcdd0700_NeikiAnalytics.exe
File created	C:\Windows\System\QxHhsDa.exe	1d69ad23a77fbaca9e98d6c4dcdd0700_NeikiAnalytics.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1052	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	1844	1d69ad23a77fbaca9e98d6c4dcdd0700_NeikiAnalytics.exe
Token: SeLockMemoryPrivilege	1844	1d69ad23a77fbaca9e98d6c4dcdd0700_NeikiAnalytics.exe
Token: SeDebugPrivilege	1052	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1844 wrote to memory of 1052	1844	1d69ad23a77fbaca9e98d6c4dcdd0700_NeikiAnalytics.exe	29
PID 1844 wrote to memory of 1052	1844	1d69ad23a77fbaca9e98d6c4dcdd0700_NeikiAnalytics.exe	29
PID 1844 wrote to memory of 1052	1844	1d69ad23a77fbaca9e98d6c4dcdd0700_NeikiAnalytics.exe	29
PID 1844 wrote to memory of 2156	1844	1d69ad23a77fbaca9e98d6c4dcdd0700_NeikiAnalytics.exe	30
PID 1844 wrote to memory of 2156	1844	1d69ad23a77fbaca9e98d6c4dcdd0700_NeikiAnalytics.exe	30
PID 1844 wrote to memory of 2156	1844	1d69ad23a77fbaca9e98d6c4dcdd0700_NeikiAnalytics.exe	30
PID 1844 wrote to memory of 2720	1844	1d69ad23a77fbaca9e98d6c4dcdd0700_NeikiAnalytics.exe	31
PID 1844 wrote to memory of 2720	1844	1d69ad23a77fbaca9e98d6c4dcdd0700_NeikiAnalytics.exe	31
PID 1844 wrote to memory of 2720	1844	1d69ad23a77fbaca9e98d6c4dcdd0700_NeikiAnalytics.exe	31
PID 1844 wrote to memory of 2636	1844	1d69ad23a77fbaca9e98d6c4dcdd0700_NeikiAnalytics.exe	32
PID 1844 wrote to memory of 2636	1844	1d69ad23a77fbaca9e98d6c4dcdd0700_NeikiAnalytics.exe	32
PID 1844 wrote to memory of 2636	1844	1d69ad23a77fbaca9e98d6c4dcdd0700_NeikiAnalytics.exe	32
PID 1844 wrote to memory of 2692	1844	1d69ad23a77fbaca9e98d6c4dcdd0700_NeikiAnalytics.exe	33
PID 1844 wrote to memory of 2692	1844	1d69ad23a77fbaca9e98d6c4dcdd0700_NeikiAnalytics.exe	33
PID 1844 wrote to memory of 2692	1844	1d69ad23a77fbaca9e98d6c4dcdd0700_NeikiAnalytics.exe	33
PID 1844 wrote to memory of 1232	1844	1d69ad23a77fbaca9e98d6c4dcdd0700_NeikiAnalytics.exe	34
PID 1844 wrote to memory of 1232	1844	1d69ad23a77fbaca9e98d6c4dcdd0700_NeikiAnalytics.exe	34
PID 1844 wrote to memory of 1232	1844	1d69ad23a77fbaca9e98d6c4dcdd0700_NeikiAnalytics.exe	34
PID 1844 wrote to memory of 2676	1844	1d69ad23a77fbaca9e98d6c4dcdd0700_NeikiAnalytics.exe	35
PID 1844 wrote to memory of 2676	1844	1d69ad23a77fbaca9e98d6c4dcdd0700_NeikiAnalytics.exe	35
PID 1844 wrote to memory of 2676	1844	1d69ad23a77fbaca9e98d6c4dcdd0700_NeikiAnalytics.exe	35
PID 1844 wrote to memory of 2516	1844	1d69ad23a77fbaca9e98d6c4dcdd0700_NeikiAnalytics.exe	36
PID 1844 wrote to memory of 2516	1844	1d69ad23a77fbaca9e98d6c4dcdd0700_NeikiAnalytics.exe	36
PID 1844 wrote to memory of 2516	1844	1d69ad23a77fbaca9e98d6c4dcdd0700_NeikiAnalytics.exe	36
PID 1844 wrote to memory of 2576	1844	1d69ad23a77fbaca9e98d6c4dcdd0700_NeikiAnalytics.exe	37
PID 1844 wrote to memory of 2576	1844	1d69ad23a77fbaca9e98d6c4dcdd0700_NeikiAnalytics.exe	37
PID 1844 wrote to memory of 2576	1844	1d69ad23a77fbaca9e98d6c4dcdd0700_NeikiAnalytics.exe	37
PID 1844 wrote to memory of 3060	1844	1d69ad23a77fbaca9e98d6c4dcdd0700_NeikiAnalytics.exe	38
PID 1844 wrote to memory of 3060	1844	1d69ad23a77fbaca9e98d6c4dcdd0700_NeikiAnalytics.exe	38
PID 1844 wrote to memory of 3060	1844	1d69ad23a77fbaca9e98d6c4dcdd0700_NeikiAnalytics.exe	38
PID 1844 wrote to memory of 2060	1844	1d69ad23a77fbaca9e98d6c4dcdd0700_NeikiAnalytics.exe	39
PID 1844 wrote to memory of 2060	1844	1d69ad23a77fbaca9e98d6c4dcdd0700_NeikiAnalytics.exe	39
PID 1844 wrote to memory of 2060	1844	1d69ad23a77fbaca9e98d6c4dcdd0700_NeikiAnalytics.exe	39
PID 1844 wrote to memory of 1944	1844	1d69ad23a77fbaca9e98d6c4dcdd0700_NeikiAnalytics.exe	40
PID 1844 wrote to memory of 1944	1844	1d69ad23a77fbaca9e98d6c4dcdd0700_NeikiAnalytics.exe	40
PID 1844 wrote to memory of 1944	1844	1d69ad23a77fbaca9e98d6c4dcdd0700_NeikiAnalytics.exe	40
PID 1844 wrote to memory of 2128	1844	1d69ad23a77fbaca9e98d6c4dcdd0700_NeikiAnalytics.exe	41
PID 1844 wrote to memory of 2128	1844	1d69ad23a77fbaca9e98d6c4dcdd0700_NeikiAnalytics.exe	41
PID 1844 wrote to memory of 2128	1844	1d69ad23a77fbaca9e98d6c4dcdd0700_NeikiAnalytics.exe	41
PID 1844 wrote to memory of 3048	1844	1d69ad23a77fbaca9e98d6c4dcdd0700_NeikiAnalytics.exe	42
PID 1844 wrote to memory of 3048	1844	1d69ad23a77fbaca9e98d6c4dcdd0700_NeikiAnalytics.exe	42
PID 1844 wrote to memory of 3048	1844	1d69ad23a77fbaca9e98d6c4dcdd0700_NeikiAnalytics.exe	42
PID 1844 wrote to memory of 1436	1844	1d69ad23a77fbaca9e98d6c4dcdd0700_NeikiAnalytics.exe	43
PID 1844 wrote to memory of 1436	1844	1d69ad23a77fbaca9e98d6c4dcdd0700_NeikiAnalytics.exe	43
PID 1844 wrote to memory of 1436	1844	1d69ad23a77fbaca9e98d6c4dcdd0700_NeikiAnalytics.exe	43
PID 1844 wrote to memory of 2896	1844	1d69ad23a77fbaca9e98d6c4dcdd0700_NeikiAnalytics.exe	44
PID 1844 wrote to memory of 2896	1844	1d69ad23a77fbaca9e98d6c4dcdd0700_NeikiAnalytics.exe	44
PID 1844 wrote to memory of 2896	1844	1d69ad23a77fbaca9e98d6c4dcdd0700_NeikiAnalytics.exe	44
PID 1844 wrote to memory of 1948	1844	1d69ad23a77fbaca9e98d6c4dcdd0700_NeikiAnalytics.exe	45
PID 1844 wrote to memory of 1948	1844	1d69ad23a77fbaca9e98d6c4dcdd0700_NeikiAnalytics.exe	45
PID 1844 wrote to memory of 1948	1844	1d69ad23a77fbaca9e98d6c4dcdd0700_NeikiAnalytics.exe	45
PID 1844 wrote to memory of 744	1844	1d69ad23a77fbaca9e98d6c4dcdd0700_NeikiAnalytics.exe	46
PID 1844 wrote to memory of 744	1844	1d69ad23a77fbaca9e98d6c4dcdd0700_NeikiAnalytics.exe	46
PID 1844 wrote to memory of 744	1844	1d69ad23a77fbaca9e98d6c4dcdd0700_NeikiAnalytics.exe	46
PID 1844 wrote to memory of 2688	1844	1d69ad23a77fbaca9e98d6c4dcdd0700_NeikiAnalytics.exe	47
PID 1844 wrote to memory of 2688	1844	1d69ad23a77fbaca9e98d6c4dcdd0700_NeikiAnalytics.exe	47
PID 1844 wrote to memory of 2688	1844	1d69ad23a77fbaca9e98d6c4dcdd0700_NeikiAnalytics.exe	47
PID 1844 wrote to memory of 2772	1844	1d69ad23a77fbaca9e98d6c4dcdd0700_NeikiAnalytics.exe	48
PID 1844 wrote to memory of 2772	1844	1d69ad23a77fbaca9e98d6c4dcdd0700_NeikiAnalytics.exe	48
PID 1844 wrote to memory of 2772	1844	1d69ad23a77fbaca9e98d6c4dcdd0700_NeikiAnalytics.exe	48
PID 1844 wrote to memory of 1256	1844	1d69ad23a77fbaca9e98d6c4dcdd0700_NeikiAnalytics.exe	49
PID 1844 wrote to memory of 1256	1844	1d69ad23a77fbaca9e98d6c4dcdd0700_NeikiAnalytics.exe	49
PID 1844 wrote to memory of 1256	1844	1d69ad23a77fbaca9e98d6c4dcdd0700_NeikiAnalytics.exe	49
PID 1844 wrote to memory of 1300	1844	1d69ad23a77fbaca9e98d6c4dcdd0700_NeikiAnalytics.exe	50

C:\Users\Admin\AppData\Local\Temp\1d69ad23a77fbaca9e98d6c4dcdd0700_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\1d69ad23a77fbaca9e98d6c4dcdd0700_NeikiAnalytics.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1844
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1052
- C:\Windows\System\dViXFYA.exe
  C:\Windows\System\dViXFYA.exe
  2⤵
  - Executes dropped EXE
  PID:2156
- C:\Windows\System\eYozcqh.exe
  C:\Windows\System\eYozcqh.exe
  2⤵
  - Executes dropped EXE
  PID:2720
- C:\Windows\System\QySnFzU.exe
  C:\Windows\System\QySnFzU.exe
  2⤵
  - Executes dropped EXE
  PID:2636
- C:\Windows\System\cSYJPbD.exe
  C:\Windows\System\cSYJPbD.exe
  2⤵
  - Executes dropped EXE
  PID:2692
- C:\Windows\System\OIoyaXf.exe
  C:\Windows\System\OIoyaXf.exe
  2⤵
  - Executes dropped EXE
  PID:1232
- C:\Windows\System\OUQOJGM.exe
  C:\Windows\System\OUQOJGM.exe
  2⤵
  - Executes dropped EXE
  PID:2676
- C:\Windows\System\BlljsWL.exe
  C:\Windows\System\BlljsWL.exe
  2⤵
  - Executes dropped EXE
  PID:2516
- C:\Windows\System\kPMcZQE.exe
  C:\Windows\System\kPMcZQE.exe
  2⤵
  - Executes dropped EXE
  PID:2576
- C:\Windows\System\yrNdiDU.exe
  C:\Windows\System\yrNdiDU.exe
  2⤵
  - Executes dropped EXE
  PID:3060
- C:\Windows\System\UQOQGTu.exe
  C:\Windows\System\UQOQGTu.exe
  2⤵
  - Executes dropped EXE
  PID:2060
- C:\Windows\System\CBaSGKv.exe
  C:\Windows\System\CBaSGKv.exe
  2⤵
  - Executes dropped EXE
  PID:1944
- C:\Windows\System\QNycfbS.exe
  C:\Windows\System\QNycfbS.exe
  2⤵
  - Executes dropped EXE
  PID:2128
- C:\Windows\System\hpzpEIP.exe
  C:\Windows\System\hpzpEIP.exe
  2⤵
  - Executes dropped EXE
  PID:3048
- C:\Windows\System\fDPhkUn.exe
  C:\Windows\System\fDPhkUn.exe
  2⤵
  PID:1436
- C:\Windows\System\xGeDYca.exe
  C:\Windows\System\xGeDYca.exe
  2⤵
  - Executes dropped EXE
  PID:2896
- C:\Windows\System\OgmuBmd.exe
  C:\Windows\System\OgmuBmd.exe
  2⤵
  PID:1948
- C:\Windows\System\TOGJxSb.exe
  C:\Windows\System\TOGJxSb.exe
  2⤵
  - Executes dropped EXE
  PID:744
- C:\Windows\System\BEEMYYF.exe
  C:\Windows\System\BEEMYYF.exe
  2⤵
  PID:2688
- C:\Windows\System\HHsrHVR.exe
  C:\Windows\System\HHsrHVR.exe
  2⤵
  - Executes dropped EXE
  PID:2772
- C:\Windows\System\kHTFEWW.exe
  C:\Windows\System\kHTFEWW.exe
  2⤵
  PID:1256
- C:\Windows\System\bvhpSUN.exe
  C:\Windows\System\bvhpSUN.exe
  2⤵
  - Executes dropped EXE
  PID:1300
- C:\Windows\System\lmGMlMd.exe
  C:\Windows\System\lmGMlMd.exe
  2⤵
  PID:2928
- C:\Windows\System\kZFKwuk.exe
  C:\Windows\System\kZFKwuk.exe
  2⤵
  - Executes dropped EXE
  PID:1120
- C:\Windows\System\jCLZYJO.exe
  C:\Windows\System\jCLZYJO.exe
  2⤵
  PID:1736
- C:\Windows\System\RmwQBWY.exe
  C:\Windows\System\RmwQBWY.exe
  2⤵
  - Executes dropped EXE
  PID:800
- C:\Windows\System\FJnoKaA.exe
  C:\Windows\System\FJnoKaA.exe
  2⤵
  PID:856
- C:\Windows\System\RVnucNg.exe
  C:\Windows\System\RVnucNg.exe
  2⤵
  - Executes dropped EXE
  PID:1764
- C:\Windows\System\SdZzFRR.exe
  C:\Windows\System\SdZzFRR.exe
  2⤵
  PID:2052
- C:\Windows\System\KUiiTWj.exe
  C:\Windows\System\KUiiTWj.exe
  2⤵
  - Executes dropped EXE
  PID:2120
- C:\Windows\System\jYTbxXe.exe
  C:\Windows\System\jYTbxXe.exe
  2⤵
  PID:2976
- C:\Windows\System\McifMXT.exe
  C:\Windows\System\McifMXT.exe
  2⤵
  - Executes dropped EXE
  PID:2496
- C:\Windows\System\puBkMzT.exe
  C:\Windows\System\puBkMzT.exe
  2⤵
  PID:2320
- C:\Windows\System\ZrqNgTn.exe
  C:\Windows\System\ZrqNgTn.exe
  2⤵
  - Executes dropped EXE
  PID:2968
- C:\Windows\System\zDJfsin.exe
  C:\Windows\System\zDJfsin.exe
  2⤵
  PID:1628
- C:\Windows\System\IFNsZWT.exe
  C:\Windows\System\IFNsZWT.exe
  2⤵
  - Executes dropped EXE
  PID:2340
- C:\Windows\System\zrVzUiZ.exe
  C:\Windows\System\zrVzUiZ.exe
  2⤵
  PID:524
- C:\Windows\System\qJanJwx.exe
  C:\Windows\System\qJanJwx.exe
  2⤵
  - Executes dropped EXE
  PID:1076
- C:\Windows\System\SogkyER.exe
  C:\Windows\System\SogkyER.exe
  2⤵
  PID:2484
- C:\Windows\System\ovpCliE.exe
  C:\Windows\System\ovpCliE.exe
  2⤵
  - Executes dropped EXE
  PID:2472
- C:\Windows\System\wVJamvj.exe
  C:\Windows\System\wVJamvj.exe
  2⤵
  PID:2316
- C:\Windows\System\bPbZwNc.exe
  C:\Windows\System\bPbZwNc.exe
  2⤵
  - Executes dropped EXE
  PID:2308
- C:\Windows\System\vChykFM.exe
  C:\Windows\System\vChykFM.exe
  2⤵
  PID:1688
- C:\Windows\System\mOiLWHM.exe
  C:\Windows\System\mOiLWHM.exe
  2⤵
  - Executes dropped EXE
  PID:2304
- C:\Windows\System\CcxWRoV.exe
  C:\Windows\System\CcxWRoV.exe
  2⤵
  PID:1548
- C:\Windows\System\zPKeXFu.exe
  C:\Windows\System\zPKeXFu.exe
  2⤵
  - Executes dropped EXE
  PID:1280
- C:\Windows\System\mWkygCm.exe
  C:\Windows\System\mWkygCm.exe
  2⤵
  PID:1976
- C:\Windows\System\kGzXxpC.exe
  C:\Windows\System\kGzXxpC.exe
  2⤵
  - Executes dropped EXE
  PID:1608
- C:\Windows\System\wZiDbjK.exe
  C:\Windows\System\wZiDbjK.exe
  2⤵
  PID:2980
- C:\Windows\System\FpEFxaJ.exe
  C:\Windows\System\FpEFxaJ.exe
  2⤵
  - Executes dropped EXE
  PID:1620
- C:\Windows\System\qMdWTDm.exe
  C:\Windows\System\qMdWTDm.exe
  2⤵
  PID:1984
- C:\Windows\System\EAAaMRd.exe
  C:\Windows\System\EAAaMRd.exe
  2⤵
  - Executes dropped EXE
  PID:896
- C:\Windows\System\TpcqPDF.exe
  C:\Windows\System\TpcqPDF.exe
  2⤵
  PID:1504
- C:\Windows\System\idsIGwk.exe
  C:\Windows\System\idsIGwk.exe
  2⤵
  - Executes dropped EXE
  PID:2476
- C:\Windows\System\XDJdSMR.exe
  C:\Windows\System\XDJdSMR.exe
  2⤵
  PID:1580
- C:\Windows\System\EkvkYzO.exe
  C:\Windows\System\EkvkYzO.exe
  2⤵
  - Executes dropped EXE
  PID:1116
- C:\Windows\System\ElwNojJ.exe
  C:\Windows\System\ElwNojJ.exe
  2⤵
  PID:1860
- C:\Windows\System\auSNvID.exe
  C:\Windows\System\auSNvID.exe
  2⤵
  - Executes dropped EXE
  PID:2396
- C:\Windows\System\SHWCDxO.exe
  C:\Windows\System\SHWCDxO.exe
  2⤵
  PID:2964
- C:\Windows\System\mejQYXZ.exe
  C:\Windows\System\mejQYXZ.exe
  2⤵
  - Executes dropped EXE
  PID:1128
- C:\Windows\System\fWYBUaw.exe
  C:\Windows\System\fWYBUaw.exe
  2⤵
  PID:1684
- C:\Windows\System\koNlNaO.exe
  C:\Windows\System\koNlNaO.exe
  2⤵
  - Executes dropped EXE
  PID:872
- C:\Windows\System\MAhiBSk.exe
  C:\Windows\System\MAhiBSk.exe
  2⤵
  PID:1728
- C:\Windows\System\xgGCOKa.exe
  C:\Windows\System\xgGCOKa.exe
  2⤵
  - Executes dropped EXE
  PID:2412
- C:\Windows\System\RQhyayV.exe
  C:\Windows\System\RQhyayV.exe
  2⤵
  PID:2416
- C:\Windows\System\jjBcllB.exe
  C:\Windows\System\jjBcllB.exe
  2⤵
  - Executes dropped EXE
  PID:1600
- C:\Windows\System\CJbVfMV.exe
  C:\Windows\System\CJbVfMV.exe
  2⤵
  PID:1716
- C:\Windows\System\JMoEEJw.exe
  C:\Windows\System\JMoEEJw.exe
  2⤵
  - Executes dropped EXE
  PID:2836
- C:\Windows\System\FtpqgxA.exe
  C:\Windows\System\FtpqgxA.exe
  2⤵
  PID:2592
- C:\Windows\System\wJsAamu.exe
  C:\Windows\System\wJsAamu.exe
  2⤵
  - Executes dropped EXE
  PID:2960
- C:\Windows\System\QmjcJbK.exe
  C:\Windows\System\QmjcJbK.exe
  2⤵
  PID:2972
- C:\Windows\System\kKTmeYM.exe
  C:\Windows\System\kKTmeYM.exe
  2⤵
  - Executes dropped EXE
  PID:2824
- C:\Windows\System\RVpDoeM.exe
  C:\Windows\System\RVpDoeM.exe
  2⤵
  PID:2628
- C:\Windows\System\kHKtNEB.exe
  C:\Windows\System\kHKtNEB.exe
  2⤵
  - Executes dropped EXE
  PID:2560
- C:\Windows\System\uhYByzY.exe
  C:\Windows\System\uhYByzY.exe
  2⤵
  PID:2532
- C:\Windows\System\wGJBwVc.exe
  C:\Windows\System\wGJBwVc.exe
  2⤵
  - Executes dropped EXE
  PID:2292
- C:\Windows\System\KXHHMFg.exe
  C:\Windows\System\KXHHMFg.exe
  2⤵
  PID:3044
- C:\Windows\System\bNOIlgG.exe
  C:\Windows\System\bNOIlgG.exe
  2⤵
  - Executes dropped EXE
  PID:1648
- C:\Windows\System\ordShQT.exe
  C:\Windows\System\ordShQT.exe
  2⤵
  PID:1552
- C:\Windows\System\PJtmuoQ.exe
  C:\Windows\System\PJtmuoQ.exe
  2⤵
  - Executes dropped EXE
  PID:2788
- C:\Windows\System\hTONMPg.exe
  C:\Windows\System\hTONMPg.exe
  2⤵
  PID:1324
- C:\Windows\System\wyRQxkF.exe
  C:\Windows\System\wyRQxkF.exe
  2⤵
  - Executes dropped EXE
  PID:324
- C:\Windows\System\gaYLLel.exe
  C:\Windows\System\gaYLLel.exe
  2⤵
  PID:1528
- C:\Windows\System\KrFDxJk.exe
  C:\Windows\System\KrFDxJk.exe
  2⤵
  - Executes dropped EXE
  PID:1312
- C:\Windows\System\SiuajnS.exe
  C:\Windows\System\SiuajnS.exe
  2⤵
  PID:1624
- C:\Windows\System\QoZXqbA.exe
  C:\Windows\System\QoZXqbA.exe
  2⤵
  - Executes dropped EXE
  PID:2300
- C:\Windows\System\afahQeo.exe
  C:\Windows\System\afahQeo.exe
  2⤵
  PID:1656
- C:\Windows\System\wCVkXyq.exe
  C:\Windows\System\wCVkXyq.exe
  2⤵
  - Executes dropped EXE
  PID:1968
- C:\Windows\System\rFZCvaQ.exe
  C:\Windows\System\rFZCvaQ.exe
  2⤵
  PID:2280
- C:\Windows\System\UyqUkpy.exe
  C:\Windows\System\UyqUkpy.exe
  2⤵
  - Executes dropped EXE
  PID:2352
- C:\Windows\System\EQXnrCZ.exe
  C:\Windows\System\EQXnrCZ.exe
  2⤵
  PID:1748
- C:\Windows\System\nEgAbtX.exe
  C:\Windows\System\nEgAbtX.exe
  2⤵
  - Executes dropped EXE
  PID:1724
- C:\Windows\System\YCktiMY.exe
  C:\Windows\System\YCktiMY.exe
  2⤵
  PID:2712
- C:\Windows\System\zxWCkKP.exe
  C:\Windows\System\zxWCkKP.exe
  2⤵
  - Executes dropped EXE
  PID:2528
- C:\Windows\System\JAOjnBd.exe
  C:\Windows\System\JAOjnBd.exe
  2⤵
  PID:2108
- C:\Windows\System\BNVCmwm.exe
  C:\Windows\System\BNVCmwm.exe
  2⤵
  - Executes dropped EXE
  PID:2620
- C:\Windows\System\rBdoWXz.exe
  C:\Windows\System\rBdoWXz.exe
  2⤵
  PID:3076
- C:\Windows\System\DILNpnT.exe
  C:\Windows\System\DILNpnT.exe
  2⤵
  - Executes dropped EXE
  PID:3092
- C:\Windows\System\QUAalxr.exe
  C:\Windows\System\QUAalxr.exe
  2⤵
  PID:3108
- C:\Windows\System\CSgxvdF.exe
  C:\Windows\System\CSgxvdF.exe
  2⤵
  - Executes dropped EXE
  PID:3124
- C:\Windows\System\UZxPOoW.exe
  C:\Windows\System\UZxPOoW.exe
  2⤵
  PID:3140
- C:\Windows\System\UMMgZTi.exe
  C:\Windows\System\UMMgZTi.exe
  2⤵
  - Executes dropped EXE
  PID:3156
- C:\Windows\System\URCaDZz.exe
  C:\Windows\System\URCaDZz.exe
  2⤵
  PID:3172
- C:\Windows\System\aqEfeKK.exe
  C:\Windows\System\aqEfeKK.exe
  2⤵
  - Executes dropped EXE
  PID:3200
- C:\Windows\System\mKzKECc.exe
  C:\Windows\System\mKzKECc.exe
  2⤵
  PID:3220
- C:\Windows\System\lppfSfW.exe
  C:\Windows\System\lppfSfW.exe
  2⤵
  - Executes dropped EXE
  PID:3784
- C:\Windows\System\pVJdIsG.exe
  C:\Windows\System\pVJdIsG.exe
  2⤵
  PID:3800
- C:\Windows\System\LFTtUlE.exe
  C:\Windows\System\LFTtUlE.exe
  2⤵
  - Executes dropped EXE
  PID:3816
- C:\Windows\System\nWkuBsN.exe
  C:\Windows\System\nWkuBsN.exe
  2⤵
  PID:3832
- C:\Windows\System\mLJqrey.exe
  C:\Windows\System\mLJqrey.exe
  2⤵
  - Executes dropped EXE
  PID:3848
- C:\Windows\System\SzWspgd.exe
  C:\Windows\System\SzWspgd.exe
  2⤵
  PID:3864
- C:\Windows\System\afZyZJv.exe
  C:\Windows\System\afZyZJv.exe
  2⤵
  - Executes dropped EXE
  PID:3880
- C:\Windows\System\SmApOPo.exe
  C:\Windows\System\SmApOPo.exe
  2⤵
  PID:3896
- C:\Windows\System\bnqgGsv.exe
  C:\Windows\System\bnqgGsv.exe
  2⤵
  - Executes dropped EXE
  PID:3912
- C:\Windows\System\LyZyIdr.exe
  C:\Windows\System\LyZyIdr.exe
  2⤵
  PID:3928
- C:\Windows\System\kUhXIWq.exe
  C:\Windows\System\kUhXIWq.exe
  2⤵
  - Executes dropped EXE
  PID:3944
- C:\Windows\System\ZfeeHUB.exe
  C:\Windows\System\ZfeeHUB.exe
  2⤵
  PID:3960
- C:\Windows\System\yBGoWFq.exe
  C:\Windows\System\yBGoWFq.exe
  2⤵
  PID:3976
- C:\Windows\System\UbQBqmh.exe
  C:\Windows\System\UbQBqmh.exe
  2⤵
  PID:3992
- C:\Windows\System\mevMKFX.exe
  C:\Windows\System\mevMKFX.exe
  2⤵
  PID:4008
- C:\Windows\System\qAiuixr.exe
  C:\Windows\System\qAiuixr.exe
  2⤵
  PID:4024
- C:\Windows\System\TbKbuJD.exe
  C:\Windows\System\TbKbuJD.exe
  2⤵
  PID:4040
- C:\Windows\System\IsQTlIb.exe
  C:\Windows\System\IsQTlIb.exe
  2⤵
  PID:4056
- C:\Windows\System\YbeMnyX.exe
  C:\Windows\System\YbeMnyX.exe
  2⤵
  PID:4072
- C:\Windows\System\AAUVxPN.exe
  C:\Windows\System\AAUVxPN.exe
  2⤵
  PID:4088
- C:\Windows\System\rRhxJqb.exe
  C:\Windows\System\rRhxJqb.exe
  2⤵
  PID:2328
- C:\Windows\System\DAFkino.exe
  C:\Windows\System\DAFkino.exe
  2⤵
  PID:1932
- C:\Windows\System\fUwkhTp.exe
  C:\Windows\System\fUwkhTp.exe
  2⤵
  PID:3036
- C:\Windows\System\GxHhtpf.exe
  C:\Windows\System\GxHhtpf.exe
  2⤵
  PID:3100
- C:\Windows\System\uyxosKK.exe
  C:\Windows\System\uyxosKK.exe
  2⤵
  PID:3136
- C:\Windows\System\MGlMzEe.exe
  C:\Windows\System\MGlMzEe.exe
  2⤵
  PID:3168
- C:\Windows\System\ddXTZVG.exe
  C:\Windows\System\ddXTZVG.exe
  2⤵
  PID:2272
- C:\Windows\System\taYNHzA.exe
  C:\Windows\System\taYNHzA.exe
  2⤵
  PID:3212
- C:\Windows\System\JOXTvsX.exe
  C:\Windows\System\JOXTvsX.exe
  2⤵
  PID:3796
- C:\Windows\System\XiUNXEF.exe
  C:\Windows\System\XiUNXEF.exe
  2⤵
  PID:3856
- C:\Windows\System\dCzALqU.exe
  C:\Windows\System\dCzALqU.exe
  2⤵
  PID:3888
- C:\Windows\System\ESKEgiu.exe
  C:\Windows\System\ESKEgiu.exe
  2⤵
  PID:3924
- C:\Windows\System\INZYCkY.exe
  C:\Windows\System\INZYCkY.exe
  2⤵
  PID:2580
- C:\Windows\System\zmSCHIV.exe
  C:\Windows\System\zmSCHIV.exe
  2⤵
  PID:3988
- C:\Windows\System\PwcFeCz.exe
  C:\Windows\System\PwcFeCz.exe
  2⤵
  PID:4048
- C:\Windows\System\UKrlnOR.exe
  C:\Windows\System\UKrlnOR.exe
  2⤵
  PID:736
- C:\Windows\System\LFZgvOS.exe
  C:\Windows\System\LFZgvOS.exe
  2⤵
  PID:4112
- C:\Windows\System\CePRolI.exe
  C:\Windows\System\CePRolI.exe
  2⤵
  PID:4128
- C:\Windows\System\eNWREQd.exe
  C:\Windows\System\eNWREQd.exe
  2⤵
  PID:4144
- C:\Windows\System\jeKphix.exe
  C:\Windows\System\jeKphix.exe
  2⤵
  PID:4160
- C:\Windows\System\uIhLDye.exe
  C:\Windows\System\uIhLDye.exe
  2⤵
  PID:4176
- C:\Windows\System\eQAATqQ.exe
  C:\Windows\System\eQAATqQ.exe
  2⤵
  PID:4192
- C:\Windows\System\fkOVbHS.exe
  C:\Windows\System\fkOVbHS.exe
  2⤵
  PID:4208
- C:\Windows\System\IArickR.exe
  C:\Windows\System\IArickR.exe
  2⤵
  PID:4224
- C:\Windows\System\ouQjiXp.exe
  C:\Windows\System\ouQjiXp.exe
  2⤵
  PID:4240
- C:\Windows\System\fqjhqor.exe
  C:\Windows\System\fqjhqor.exe
  2⤵
  PID:4256
- C:\Windows\System\EZamZCt.exe
  C:\Windows\System\EZamZCt.exe
  2⤵
  PID:4272
- C:\Windows\System\WzvnPOX.exe
  C:\Windows\System\WzvnPOX.exe
  2⤵
  PID:4288
- C:\Windows\System\MsDWiMI.exe
  C:\Windows\System\MsDWiMI.exe
  2⤵
  PID:4304
- C:\Windows\System\xDjrJcs.exe
  C:\Windows\System\xDjrJcs.exe
  2⤵
  PID:4320
- C:\Windows\System\krBGryg.exe
  C:\Windows\System\krBGryg.exe
  2⤵
  PID:4336
- C:\Windows\System\PMJTWkP.exe
  C:\Windows\System\PMJTWkP.exe
  2⤵
  PID:4352
- C:\Windows\System\XWmnXvt.exe
  C:\Windows\System\XWmnXvt.exe
  2⤵
  PID:4368
- C:\Windows\System\beiCbgn.exe
  C:\Windows\System\beiCbgn.exe
  2⤵
  PID:4384
- C:\Windows\System\rEeYrWM.exe
  C:\Windows\System\rEeYrWM.exe
  2⤵
  PID:4400
- C:\Windows\System\bQIBWMs.exe
  C:\Windows\System\bQIBWMs.exe
  2⤵
  PID:4416
- C:\Windows\System\bqCxlQE.exe
  C:\Windows\System\bqCxlQE.exe
  2⤵
  PID:4432
- C:\Windows\System\btLWbqR.exe
  C:\Windows\System\btLWbqR.exe
  2⤵
  PID:4448
- C:\Windows\System\nAZsZvL.exe
  C:\Windows\System\nAZsZvL.exe
  2⤵
  PID:4464
- C:\Windows\System\hRKanqO.exe
  C:\Windows\System\hRKanqO.exe
  2⤵
  PID:4480
- C:\Windows\System\EPhavoy.exe
  C:\Windows\System\EPhavoy.exe
  2⤵
  PID:4496
- C:\Windows\System\DQlneuN.exe
  C:\Windows\System\DQlneuN.exe
  2⤵
  PID:4512
- C:\Windows\System\NiguSSA.exe
  C:\Windows\System\NiguSSA.exe
  2⤵
  PID:4528
- C:\Windows\System\DsnXOza.exe
  C:\Windows\System\DsnXOza.exe
  2⤵
  PID:4544
- C:\Windows\System\OUlrCWM.exe
  C:\Windows\System\OUlrCWM.exe
  2⤵
  PID:4560
- C:\Windows\System\VctZZxF.exe
  C:\Windows\System\VctZZxF.exe
  2⤵
  PID:4576
- C:\Windows\System\KJwDGJt.exe
  C:\Windows\System\KJwDGJt.exe
  2⤵
  PID:4592
- C:\Windows\System\kTcSTPH.exe
  C:\Windows\System\kTcSTPH.exe
  2⤵
  PID:4608
- C:\Windows\System\PPUWvlr.exe
  C:\Windows\System\PPUWvlr.exe
  2⤵
  PID:4624
- C:\Windows\System\KTBRYKX.exe
  C:\Windows\System\KTBRYKX.exe
  2⤵
  PID:4640
- C:\Windows\System\NvUVfRN.exe
  C:\Windows\System\NvUVfRN.exe
  2⤵
  PID:4656
- C:\Windows\System\DsZovJH.exe
  C:\Windows\System\DsZovJH.exe
  2⤵
  PID:4672
- C:\Windows\System\ewWipdw.exe
  C:\Windows\System\ewWipdw.exe
  2⤵
  PID:4688
- C:\Windows\System\OQRrTyH.exe
  C:\Windows\System\OQRrTyH.exe
  2⤵
  PID:4704
- C:\Windows\System\vBGJgYY.exe
  C:\Windows\System\vBGJgYY.exe
  2⤵
  PID:4720
- C:\Windows\System\TMWuhJs.exe
  C:\Windows\System\TMWuhJs.exe
  2⤵
  PID:4736
- C:\Windows\System\aISDSdi.exe
  C:\Windows\System\aISDSdi.exe
  2⤵
  PID:4752
- C:\Windows\System\KUgtxts.exe
  C:\Windows\System\KUgtxts.exe
  2⤵
  PID:4768
- C:\Windows\System\JXxrTAn.exe
  C:\Windows\System\JXxrTAn.exe
  2⤵
  PID:4784
- C:\Windows\System\uWDFQtj.exe
  C:\Windows\System\uWDFQtj.exe
  2⤵
  PID:4800
- C:\Windows\System\tGPTvCP.exe
  C:\Windows\System\tGPTvCP.exe
  2⤵
  PID:4816
- C:\Windows\System\NKhxHSE.exe
  C:\Windows\System\NKhxHSE.exe
  2⤵
  PID:2920
- C:\Windows\System\HEFRzrH.exe
  C:\Windows\System\HEFRzrH.exe
  2⤵
  PID:2956
- C:\Windows\System\BYJQIRK.exe
  C:\Windows\System\BYJQIRK.exe
  2⤵
  PID:1244
- C:\Windows\System\guUzBhC.exe
  C:\Windows\System\guUzBhC.exe
  2⤵
  PID:2848
- C:\Windows\System\DLKoazN.exe
  C:\Windows\System\DLKoazN.exe
  2⤵
  PID:3428
- C:\Windows\System\xWLZQgf.exe
  C:\Windows\System\xWLZQgf.exe
  2⤵
  PID:4364
- C:\Windows\System\ZqsEElX.exe
  C:\Windows\System\ZqsEElX.exe
  2⤵
  PID:4268
- C:\Windows\System\Couzhqy.exe
  C:\Windows\System\Couzhqy.exe
  2⤵
  PID:4140
- C:\Windows\System\lTYAPvY.exe
  C:\Windows\System\lTYAPvY.exe
  2⤵
  PID:3860
- C:\Windows\System\XzYuBDV.exe
  C:\Windows\System\XzYuBDV.exe
  2⤵
  PID:2604
- C:\Windows\System\PVsEJZE.exe
  C:\Windows\System\PVsEJZE.exe
  2⤵
  PID:4004
- C:\Windows\System\ZnhoQoR.exe
  C:\Windows\System\ZnhoQoR.exe
  2⤵
  PID:3876
- C:\Windows\System\WgyOshC.exe
  C:\Windows\System\WgyOshC.exe
  2⤵
  PID:3184
- C:\Windows\System\iEUpjEU.exe
  C:\Windows\System\iEUpjEU.exe
  2⤵
  PID:2752
- C:\Windows\System\CorRRQN.exe
  C:\Windows\System\CorRRQN.exe
  2⤵
  PID:1908
- C:\Windows\System\EKKWGdw.exe
  C:\Windows\System\EKKWGdw.exe
  2⤵
  PID:3052
- C:\Windows\System\yEcJEsn.exe
  C:\Windows\System\yEcJEsn.exe
  2⤵
  PID:2820
- C:\Windows\System\GdqeVaT.exe
  C:\Windows\System\GdqeVaT.exe
  2⤵
  PID:2208
- C:\Windows\System\EQHXVYh.exe
  C:\Windows\System\EQHXVYh.exe
  2⤵
  PID:2952
- C:\Windows\System\qRDhueZ.exe
  C:\Windows\System\qRDhueZ.exe
  2⤵
  PID:1960
- C:\Windows\System\QKYDDdI.exe
  C:\Windows\System\QKYDDdI.exe
  2⤵
  PID:2356
- C:\Windows\System\VoIAcZO.exe
  C:\Windows\System\VoIAcZO.exe
  2⤵
  PID:2068
- C:\Windows\System\DmVDljz.exe
  C:\Windows\System\DmVDljz.exe
  2⤵
  PID:1400
- C:\Windows\System\hkPRkbI.exe
  C:\Windows\System\hkPRkbI.exe
  2⤵
  PID:788
- C:\Windows\System\PWrJDrs.exe
  C:\Windows\System\PWrJDrs.exe
  2⤵
  PID:740
- C:\Windows\System\PgjXOHV.exe
  C:\Windows\System\PgjXOHV.exe
  2⤵
  PID:2760
- C:\Windows\System\GfyOnwI.exe
  C:\Windows\System\GfyOnwI.exe
  2⤵
  PID:1616
- C:\Windows\System\vbqzGCU.exe
  C:\Windows\System\vbqzGCU.exe
  2⤵
  PID:1820
- C:\Windows\System\VjCUmPe.exe
  C:\Windows\System\VjCUmPe.exe
  2⤵
  PID:2768
- C:\Windows\System\RTkblOq.exe
  C:\Windows\System\RTkblOq.exe
  2⤵
  PID:2260
- C:\Windows\System\AuMqEPs.exe
  C:\Windows\System\AuMqEPs.exe
  2⤵
  PID:2044
- C:\Windows\System\sAdcerl.exe
  C:\Windows\System\sAdcerl.exe
  2⤵
  PID:3240
- C:\Windows\System\xjnAbpI.exe
  C:\Windows\System\xjnAbpI.exe
  2⤵
  PID:3260
- C:\Windows\System\DmZhvqH.exe
  C:\Windows\System\DmZhvqH.exe
  2⤵
  PID:3276
- C:\Windows\System\aWfwdbi.exe
  C:\Windows\System\aWfwdbi.exe
  2⤵
  PID:3292
- C:\Windows\System\uLBaiPh.exe
  C:\Windows\System\uLBaiPh.exe
  2⤵
  PID:3308
- C:\Windows\System\VFMcKWF.exe
  C:\Windows\System\VFMcKWF.exe
  2⤵
  PID:3324
- C:\Windows\System\dOktPrO.exe
  C:\Windows\System\dOktPrO.exe
  2⤵
  PID:3340
- C:\Windows\System\WMnqCgO.exe
  C:\Windows\System\WMnqCgO.exe
  2⤵
  PID:3356
- C:\Windows\System\HjffExo.exe
  C:\Windows\System\HjffExo.exe
  2⤵
  PID:3372
- C:\Windows\System\FitjKdw.exe
  C:\Windows\System\FitjKdw.exe
  2⤵
  PID:3388
- C:\Windows\System\DxboQGX.exe
  C:\Windows\System\DxboQGX.exe
  2⤵
  PID:3404
- C:\Windows\System\PDNEiMi.exe
  C:\Windows\System\PDNEiMi.exe
  2⤵
  PID:4296
- C:\Windows\System\vWRloPb.exe
  C:\Windows\System\vWRloPb.exe
  2⤵
  PID:4200
- C:\Windows\System\qKHqIoH.exe
  C:\Windows\System\qKHqIoH.exe
  2⤵
  PID:4020
- C:\Windows\System\AVeVxWW.exe
  C:\Windows\System\AVeVxWW.exe
  2⤵
  PID:2544
- C:\Windows\System\GKoNJue.exe
  C:\Windows\System\GKoNJue.exe
  2⤵
  PID:4064
- C:\Windows\System\EOzHFKp.exe
  C:\Windows\System\EOzHFKp.exe
  2⤵
  PID:3936
- C:\Windows\System\MccCvTC.exe
  C:\Windows\System\MccCvTC.exe
  2⤵
  PID:3808
- C:\Windows\System\HoETmAw.exe
  C:\Windows\System\HoETmAw.exe
  2⤵
  PID:3116
- C:\Windows\System\VNFopDO.exe
  C:\Windows\System\VNFopDO.exe
  2⤵
  PID:556
- C:\Windows\System\bjeQYKC.exe
  C:\Windows\System\bjeQYKC.exe
  2⤵
  PID:1448
- C:\Windows\System\ywulNRp.exe
  C:\Windows\System\ywulNRp.exe
  2⤵
  PID:2124
- C:\Windows\System\FNBqluC.exe
  C:\Windows\System\FNBqluC.exe
  2⤵
  PID:1568
- C:\Windows\System\OROAcBc.exe
  C:\Windows\System\OROAcBc.exe
  2⤵
  PID:2176
- C:\Windows\System\xEbLnrB.exe
  C:\Windows\System\xEbLnrB.exe
  2⤵
  PID:4584
- C:\Windows\System\oeQNVpr.exe
  C:\Windows\System\oeQNVpr.exe
  2⤵
  PID:4648
- C:\Windows\System\cSaYlpU.exe
  C:\Windows\System\cSaYlpU.exe
  2⤵
  PID:4716
- C:\Windows\System\uSjBaOy.exe
  C:\Windows\System\uSjBaOy.exe
  2⤵
  PID:4780
- C:\Windows\System\nDLGLyX.exe
  C:\Windows\System\nDLGLyX.exe
  2⤵
  PID:1200
- C:\Windows\System\ZsdPnjK.exe
  C:\Windows\System\ZsdPnjK.exe
  2⤵
  PID:1992
- C:\Windows\System\RBQluKz.exe
  C:\Windows\System\RBQluKz.exe
  2⤵
  PID:4900
- C:\Windows\System\pNxwLMd.exe
  C:\Windows\System\pNxwLMd.exe
  2⤵
  PID:4924
- C:\Windows\System\wPKvzDq.exe
  C:\Windows\System\wPKvzDq.exe
  2⤵
  PID:4944
- C:\Windows\System\EjPJVpM.exe
  C:\Windows\System\EjPJVpM.exe
  2⤵
  PID:4960
- C:\Windows\System\mKHjvaB.exe
  C:\Windows\System\mKHjvaB.exe
  2⤵
  PID:4976
- C:\Windows\System\fSYDaLW.exe
  C:\Windows\System\fSYDaLW.exe
  2⤵
  PID:4992
- C:\Windows\System\szbmDdG.exe
  C:\Windows\System\szbmDdG.exe
  2⤵
  PID:5016
- C:\Windows\System\MQwIksg.exe
  C:\Windows\System\MQwIksg.exe
  2⤵
  PID:5040
- C:\Windows\System\PbJGxyB.exe
  C:\Windows\System\PbJGxyB.exe
  2⤵
  PID:5060
- C:\Windows\System\TIpAVkx.exe
  C:\Windows\System\TIpAVkx.exe
  2⤵
  PID:5076
- C:\Windows\System\OHSJRrO.exe
  C:\Windows\System\OHSJRrO.exe
  2⤵
  PID:112
- C:\Windows\System\QYyGIHg.exe
  C:\Windows\System\QYyGIHg.exe
  2⤵
  PID:1668
- C:\Windows\System\koaaTsO.exe
  C:\Windows\System\koaaTsO.exe
  2⤵
  PID:2656
- C:\Windows\System\BamFFLf.exe
  C:\Windows\System\BamFFLf.exe
  2⤵
  PID:4552
- C:\Windows\System\zYQxuHF.exe
  C:\Windows\System\zYQxuHF.exe
  2⤵
  PID:4488
- C:\Windows\System\VFaBHew.exe
  C:\Windows\System\VFaBHew.exe
  2⤵
  PID:2076
- C:\Windows\System\PjPdNPM.exe
  C:\Windows\System\PjPdNPM.exe
  2⤵
  PID:4300
- C:\Windows\System\navMmYC.exe
  C:\Windows\System\navMmYC.exe
  2⤵
  PID:4172
- C:\Windows\System\cFgLtbn.exe
  C:\Windows\System\cFgLtbn.exe
  2⤵
  PID:4036
- C:\Windows\System\ZdNNyWT.exe
  C:\Windows\System\ZdNNyWT.exe
  2⤵
  PID:3252
- C:\Windows\System\jiQkdXx.exe
  C:\Windows\System\jiQkdXx.exe
  2⤵
  PID:3088
- C:\Windows\System\YPazSid.exe
  C:\Windows\System\YPazSid.exe
  2⤵
  PID:2808
- C:\Windows\System\UZNHyQp.exe
  C:\Windows\System\UZNHyQp.exe
  2⤵
  PID:1396
- C:\Windows\System\XBWJsyb.exe
  C:\Windows\System\XBWJsyb.exe
  2⤵
  PID:1372
- C:\Windows\System\ppQZWRX.exe
  C:\Windows\System\ppQZWRX.exe
  2⤵
  PID:1856
- C:\Windows\System\JxQSPCz.exe
  C:\Windows\System\JxQSPCz.exe
  2⤵
  PID:2500
- C:\Windows\System\JufWsls.exe
  C:\Windows\System\JufWsls.exe
  2⤵
  PID:2172
- C:\Windows\System\OkaYhLq.exe
  C:\Windows\System\OkaYhLq.exe
  2⤵
  PID:824
- C:\Windows\System\KJrPWZx.exe
  C:\Windows\System\KJrPWZx.exe
  2⤵
  PID:1792
- C:\Windows\System\edeANxG.exe
  C:\Windows\System\edeANxG.exe
  2⤵
  PID:3256
- C:\Windows\System\wkkdAys.exe
  C:\Windows\System\wkkdAys.exe
  2⤵
  PID:3288
- C:\Windows\System\EmiKtVM.exe
  C:\Windows\System\EmiKtVM.exe
  2⤵
  PID:3320
- C:\Windows\System\nSgHQCU.exe
  C:\Windows\System\nSgHQCU.exe
  2⤵
  PID:3352
- C:\Windows\System\IBdidPG.exe
  C:\Windows\System\IBdidPG.exe
  2⤵
  PID:3368
- C:\Windows\System\VbhGZOW.exe
  C:\Windows\System\VbhGZOW.exe
  2⤵
  PID:4360
- C:\Windows\System\kiiaSXy.exe
  C:\Windows\System\kiiaSXy.exe
  2⤵
  PID:4104
- C:\Windows\System\oehSYUE.exe
  C:\Windows\System\oehSYUE.exe
  2⤵
  PID:3792
- C:\Windows\System\qBTQanY.exe
  C:\Windows\System\qBTQanY.exe
  2⤵
  PID:3840
- C:\Windows\System\rcgdVdy.exe
  C:\Windows\System\rcgdVdy.exe
  2⤵
  PID:2400
- C:\Windows\System\QXjdYxv.exe
  C:\Windows\System\QXjdYxv.exe
  2⤵
  PID:2140
- C:\Windows\System\MxlRNRU.exe
  C:\Windows\System\MxlRNRU.exe
  2⤵
  PID:1692
- C:\Windows\System\zvWJOqv.exe
  C:\Windows\System\zvWJOqv.exe
  2⤵
  PID:1972
- C:\Windows\System\DalRtiX.exe
  C:\Windows\System\DalRtiX.exe
  2⤵
  PID:4712
- C:\Windows\System\iLHNJLd.exe
  C:\Windows\System\iLHNJLd.exe
  2⤵
  PID:1776
- C:\Windows\System\BDoBswp.exe
  C:\Windows\System\BDoBswp.exe
  2⤵
  PID:4920
- C:\Windows\System\RXOFIyl.exe
  C:\Windows\System\RXOFIyl.exe
  2⤵
  PID:4956
- C:\Windows\System\deNZXwm.exe
  C:\Windows\System\deNZXwm.exe
  2⤵
  PID:4988
- C:\Windows\System\uxWFJVY.exe
  C:\Windows\System\uxWFJVY.exe
  2⤵
  PID:5036
- C:\Windows\System\MKSLWOM.exe
  C:\Windows\System\MKSLWOM.exe
  2⤵
  PID:5072
- C:\Windows\System\kckdgPk.exe
  C:\Windows\System\kckdgPk.exe
  2⤵
  PID:2072
- C:\Windows\System\XSqWbhS.exe
  C:\Windows\System\XSqWbhS.exe
  2⤵
  PID:4556
- C:\Windows\System\dHHhhoF.exe
  C:\Windows\System\dHHhhoF.exe
  2⤵
  PID:2860
- C:\Windows\System\ksssWoN.exe
  C:\Windows\System\ksssWoN.exe
  2⤵
  PID:2880
- C:\Windows\System\vOFSdLA.exe
  C:\Windows\System\vOFSdLA.exe
  2⤵
  PID:3908
- C:\Windows\System\Gnsvqdr.exe
  C:\Windows\System\Gnsvqdr.exe
  2⤵
  PID:1036
- C:\Windows\System\AEpwynP.exe
  C:\Windows\System\AEpwynP.exe
  2⤵
  PID:1404
- C:\Windows\System\NNTLtGP.exe
  C:\Windows\System\NNTLtGP.exe
  2⤵
  PID:1496
- C:\Windows\System\MPTdOjn.exe
  C:\Windows\System\MPTdOjn.exe
  2⤵
  PID:2036
- C:\Windows\System\RZNAExu.exe
  C:\Windows\System\RZNAExu.exe
  2⤵
  PID:3248
- C:\Windows\System\AcqJBuq.exe
  C:\Windows\System\AcqJBuq.exe
  2⤵
  PID:3272
- C:\Windows\System\YyygrkB.exe
  C:\Windows\System\YyygrkB.exe
  2⤵
  PID:3384
- C:\Windows\System\anDvRDY.exe
  C:\Windows\System\anDvRDY.exe
  2⤵
  PID:2736
- C:\Windows\System\sjveUKO.exe
  C:\Windows\System\sjveUKO.exe
  2⤵
  PID:3968
- C:\Windows\System\gyBBPNM.exe
  C:\Windows\System\gyBBPNM.exe
  2⤵
  PID:1864
- C:\Windows\System\FKRPQou.exe
  C:\Windows\System\FKRPQou.exe
  2⤵
  PID:4620
- C:\Windows\System\mYaVupA.exe
  C:\Windows\System\mYaVupA.exe
  2⤵
  PID:1788
- C:\Windows\System\DvaZFQx.exe
  C:\Windows\System\DvaZFQx.exe
  2⤵
  PID:4896
- C:\Windows\System\msgOxPx.exe
  C:\Windows\System\msgOxPx.exe
  2⤵
  PID:5012
- C:\Windows\System\zLVmwDY.exe
  C:\Windows\System\zLVmwDY.exe
  2⤵
  PID:5056
- C:\Windows\System\heFMexW.exe
  C:\Windows\System\heFMexW.exe
  2⤵
  PID:4492
- C:\Windows\System\ycGLtoU.exe
  C:\Windows\System\ycGLtoU.exe
  2⤵
  PID:4068
- C:\Windows\System\qnkbhRg.exe
  C:\Windows\System\qnkbhRg.exe
  2⤵
  PID:1592
- C:\Windows\System\LZoOksn.exe
  C:\Windows\System\LZoOksn.exe
  2⤵
  PID:1696
- C:\Windows\System\oBWuyxI.exe
  C:\Windows\System\oBWuyxI.exe
  2⤵
  PID:3316
- C:\Windows\System\TdTnskR.exe
  C:\Windows\System\TdTnskR.exe
  2⤵
  PID:3400
- C:\Windows\System\GOzkCNa.exe
  C:\Windows\System\GOzkCNa.exe
  2⤵
  PID:3148
- C:\Windows\System\IuLQVut.exe
  C:\Windows\System\IuLQVut.exe
  2⤵
  PID:4776
- C:\Windows\System\ExOmItS.exe
  C:\Windows\System\ExOmItS.exe
  2⤵
  PID:4972
- C:\Windows\System\wmmQlfW.exe
  C:\Windows\System\wmmQlfW.exe
  2⤵
  PID:5128
- C:\Windows\System\CnEIRsl.exe
  C:\Windows\System\CnEIRsl.exe
  2⤵
  PID:5144
- C:\Windows\System\lxbldpP.exe
  C:\Windows\System\lxbldpP.exe
  2⤵
  PID:5160
- C:\Windows\System\ebfwwux.exe
  C:\Windows\System\ebfwwux.exe
  2⤵
  PID:5176
- C:\Windows\System\OhgoekB.exe
  C:\Windows\System\OhgoekB.exe
  2⤵
  PID:5192
- C:\Windows\System\ZXqawmQ.exe
  C:\Windows\System\ZXqawmQ.exe
  2⤵
  PID:5208
- C:\Windows\System\WIyLtvt.exe
  C:\Windows\System\WIyLtvt.exe
  2⤵
  PID:5224
- C:\Windows\System\YhaiBvB.exe
  C:\Windows\System\YhaiBvB.exe
  2⤵
  PID:5240
- C:\Windows\System\EFHXGpC.exe
  C:\Windows\System\EFHXGpC.exe
  2⤵
  PID:5256
- C:\Windows\System\TdxtfSD.exe
  C:\Windows\System\TdxtfSD.exe
  2⤵
  PID:5272
- C:\Windows\System\JoFdsqo.exe
  C:\Windows\System\JoFdsqo.exe
  2⤵
  PID:5288
- C:\Windows\System\idPCRYR.exe
  C:\Windows\System\idPCRYR.exe
  2⤵
  PID:5304
- C:\Windows\System\ZPVOyXZ.exe
  C:\Windows\System\ZPVOyXZ.exe
  2⤵
  PID:5320
- C:\Windows\System\DzBceFt.exe
  C:\Windows\System\DzBceFt.exe
  2⤵
  PID:5336
- C:\Windows\System\nSTQCxH.exe
  C:\Windows\System\nSTQCxH.exe
  2⤵
  PID:5352
- C:\Windows\System\qZwOmXw.exe
  C:\Windows\System\qZwOmXw.exe
  2⤵
  PID:5368
- C:\Windows\System\XWOEdxm.exe
  C:\Windows\System\XWOEdxm.exe
  2⤵
  PID:5384
- C:\Windows\System\kDoIfkC.exe
  C:\Windows\System\kDoIfkC.exe
  2⤵
  PID:5400
- C:\Windows\System\tgyOJzN.exe
  C:\Windows\System\tgyOJzN.exe
  2⤵
  PID:5416
- C:\Windows\System\TLesHNa.exe
  C:\Windows\System\TLesHNa.exe
  2⤵
  PID:5432
- C:\Windows\System\ibiSrBW.exe
  C:\Windows\System\ibiSrBW.exe
  2⤵
  PID:5448
- C:\Windows\System\FucxaMm.exe
  C:\Windows\System\FucxaMm.exe
  2⤵
  PID:5464
- C:\Windows\System\hSlwpcq.exe
  C:\Windows\System\hSlwpcq.exe
  2⤵
  PID:5480
- C:\Windows\System\jGwbana.exe
  C:\Windows\System\jGwbana.exe
  2⤵
  PID:5496
- C:\Windows\System\TSeSlMt.exe
  C:\Windows\System\TSeSlMt.exe
  2⤵
  PID:5512
- C:\Windows\System\EYUyMzY.exe
  C:\Windows\System\EYUyMzY.exe
  2⤵
  PID:5528
- C:\Windows\System\YrigiXh.exe
  C:\Windows\System\YrigiXh.exe
  2⤵
  PID:5544
- C:\Windows\System\LbJKvlZ.exe
  C:\Windows\System\LbJKvlZ.exe
  2⤵
  PID:5560
- C:\Windows\System\EyhWlTj.exe
  C:\Windows\System\EyhWlTj.exe
  2⤵
  PID:5576
- C:\Windows\System\SowMpjM.exe
  C:\Windows\System\SowMpjM.exe
  2⤵
  PID:5592
- C:\Windows\System\yJNfkfx.exe
  C:\Windows\System\yJNfkfx.exe
  2⤵
  PID:5608
- C:\Windows\System\oVUdsgA.exe
  C:\Windows\System\oVUdsgA.exe
  2⤵
  PID:5624
- C:\Windows\System\NpxaKzm.exe
  C:\Windows\System\NpxaKzm.exe
  2⤵
  PID:5640
- C:\Windows\System\fzOnYDp.exe
  C:\Windows\System\fzOnYDp.exe
  2⤵
  PID:5656
- C:\Windows\System\YNfLOzB.exe
  C:\Windows\System\YNfLOzB.exe
  2⤵
  PID:5672
- C:\Windows\System\Zlrtwuw.exe
  C:\Windows\System\Zlrtwuw.exe
  2⤵
  PID:5688
- C:\Windows\System\HgbQIYa.exe
  C:\Windows\System\HgbQIYa.exe
  2⤵
  PID:5704
- C:\Windows\System\lDSYYEZ.exe
  C:\Windows\System\lDSYYEZ.exe
  2⤵
  PID:5720
- C:\Windows\System\rXTiGDI.exe
  C:\Windows\System\rXTiGDI.exe
  2⤵
  PID:5740
- C:\Windows\System\aJJnPjG.exe
  C:\Windows\System\aJJnPjG.exe
  2⤵
  PID:5756
- C:\Windows\System\sEdnQCZ.exe
  C:\Windows\System\sEdnQCZ.exe
  2⤵
  PID:5772
- C:\Windows\System\apqidqA.exe
  C:\Windows\System\apqidqA.exe
  2⤵
  PID:5788
- C:\Windows\System\mLYnPHb.exe
  C:\Windows\System\mLYnPHb.exe
  2⤵
  PID:5804
- C:\Windows\System\xorrQUf.exe
  C:\Windows\System\xorrQUf.exe
  2⤵
  PID:5820
- C:\Windows\System\RgJMIXC.exe
  C:\Windows\System\RgJMIXC.exe
  2⤵
  PID:5836
- C:\Windows\System\PPpNJBG.exe
  C:\Windows\System\PPpNJBG.exe
  2⤵
  PID:5852
- C:\Windows\System\SzyRmOo.exe
  C:\Windows\System\SzyRmOo.exe
  2⤵
  PID:5868
- C:\Windows\System\GyvkoEa.exe
  C:\Windows\System\GyvkoEa.exe
  2⤵
  PID:5884
- C:\Windows\System\LCjHrQz.exe
  C:\Windows\System\LCjHrQz.exe
  2⤵
  PID:5900
- C:\Windows\System\MjGCeoC.exe
  C:\Windows\System\MjGCeoC.exe
  2⤵
  PID:5916
- C:\Windows\System\xIALNbN.exe
  C:\Windows\System\xIALNbN.exe
  2⤵
  PID:5932
- C:\Windows\System\jHefnAR.exe
  C:\Windows\System\jHefnAR.exe
  2⤵
  PID:5948
- C:\Windows\System\zclTCpz.exe
  C:\Windows\System\zclTCpz.exe
  2⤵
  PID:5964
- C:\Windows\System\imQUReX.exe
  C:\Windows\System\imQUReX.exe
  2⤵
  PID:5980
- C:\Windows\System\qtqCqmZ.exe
  C:\Windows\System\qtqCqmZ.exe
  2⤵
  PID:5996
- C:\Windows\System\kdPBqzS.exe
  C:\Windows\System\kdPBqzS.exe
  2⤵
  PID:6012
- C:\Windows\System\jhxAzBE.exe
  C:\Windows\System\jhxAzBE.exe
  2⤵
  PID:6028
- C:\Windows\System\YJmlRxP.exe
  C:\Windows\System\YJmlRxP.exe
  2⤵
  PID:6044
- C:\Windows\System\jmAUHls.exe
  C:\Windows\System\jmAUHls.exe
  2⤵
  PID:6060
- C:\Windows\System\jbqFfcB.exe
  C:\Windows\System\jbqFfcB.exe
  2⤵
  PID:6076
- C:\Windows\System\ExuLlpI.exe
  C:\Windows\System\ExuLlpI.exe
  2⤵
  PID:6092
- C:\Windows\System\bnpwMCS.exe
  C:\Windows\System\bnpwMCS.exe
  2⤵
  PID:6108
- C:\Windows\System\KMveXjh.exe
  C:\Windows\System\KMveXjh.exe
  2⤵
  PID:6124
- C:\Windows\System\nbzaKLh.exe
  C:\Windows\System\nbzaKLh.exe
  2⤵
  PID:6140
- C:\Windows\System\MwLfVJx.exe
  C:\Windows\System\MwLfVJx.exe
  2⤵
  PID:2488
- C:\Windows\System\zcftCOy.exe
  C:\Windows\System\zcftCOy.exe
  2⤵
  PID:4456
- C:\Windows\System\guZXZce.exe
  C:\Windows\System\guZXZce.exe
  2⤵
  PID:2632
- C:\Windows\System\YBCxSvd.exe
  C:\Windows\System\YBCxSvd.exe
  2⤵
  PID:4912
- C:\Windows\System\vsWjxRo.exe
  C:\Windows\System\vsWjxRo.exe
  2⤵
  PID:5136
- C:\Windows\System\QUWkrYH.exe
  C:\Windows\System\QUWkrYH.exe
  2⤵
  PID:5152
- C:\Windows\System\deDIKBm.exe
  C:\Windows\System\deDIKBm.exe
  2⤵
  PID:5172
- C:\Windows\System\plHtvxh.exe
  C:\Windows\System\plHtvxh.exe
  2⤵
  PID:5204
- C:\Windows\System\GmcPeXR.exe
  C:\Windows\System\GmcPeXR.exe
  2⤵
  PID:5236
- C:\Windows\System\fMrlCnm.exe
  C:\Windows\System\fMrlCnm.exe
  2⤵
  PID:5252
- C:\Windows\System\qNIpgvE.exe
  C:\Windows\System\qNIpgvE.exe
  2⤵
  PID:5284
- C:\Windows\System\SdROkHU.exe
  C:\Windows\System\SdROkHU.exe
  2⤵
  PID:5316
- C:\Windows\System\JBwJStB.exe
  C:\Windows\System\JBwJStB.exe
  2⤵
  PID:5360
- C:\Windows\System\oVftFGS.exe
  C:\Windows\System\oVftFGS.exe
  2⤵
  PID:5376
- C:\Windows\System\vXDhuXv.exe
  C:\Windows\System\vXDhuXv.exe
  2⤵
  PID:5396
- C:\Windows\System\KzEeCca.exe
  C:\Windows\System\KzEeCca.exe
  2⤵
  PID:5412
- C:\Windows\System\qUIMMCt.exe
  C:\Windows\System\qUIMMCt.exe
  2⤵
  PID:5444
- C:\Windows\System\wqIITKU.exe
  C:\Windows\System\wqIITKU.exe
  2⤵
  PID:5476
- C:\Windows\System\QfCwJcq.exe
  C:\Windows\System\QfCwJcq.exe
  2⤵
  PID:5508
- C:\Windows\System\tfyidVM.exe
  C:\Windows\System\tfyidVM.exe
  2⤵
  PID:5540
- C:\Windows\System\cOlRTpX.exe
  C:\Windows\System\cOlRTpX.exe
  2⤵
  PID:5572
- C:\Windows\System\ZRrRqOz.exe
  C:\Windows\System\ZRrRqOz.exe
  2⤵
  PID:5616
- C:\Windows\System\TlsufvF.exe
  C:\Windows\System\TlsufvF.exe
  2⤵
  PID:5636
- C:\Windows\System\kePCZbH.exe
  C:\Windows\System\kePCZbH.exe
  2⤵
  PID:5668
- C:\Windows\System\hjBsWeZ.exe
  C:\Windows\System\hjBsWeZ.exe
  2⤵
  PID:5700
- C:\Windows\System\luXlvqN.exe
  C:\Windows\System\luXlvqN.exe
  2⤵
  PID:5732
- C:\Windows\System\ErSWuUW.exe
  C:\Windows\System\ErSWuUW.exe
  2⤵
  PID:5768
- C:\Windows\System\RDjbVXk.exe
  C:\Windows\System\RDjbVXk.exe
  2⤵
  PID:5800
- C:\Windows\System\mVqSDoK.exe
  C:\Windows\System\mVqSDoK.exe
  2⤵
  PID:5828
- C:\Windows\System\YmFMaAU.exe
  C:\Windows\System\YmFMaAU.exe
  2⤵
  PID:5848
- C:\Windows\System\pftWRpe.exe
  C:\Windows\System\pftWRpe.exe
  2⤵
  PID:5880
- C:\Windows\System\MekFzqO.exe
  C:\Windows\System\MekFzqO.exe
  2⤵
  PID:5896
- C:\Windows\System\QtpAVBA.exe
  C:\Windows\System\QtpAVBA.exe
  2⤵
  PID:5940
- C:\Windows\System\IvApWYy.exe
  C:\Windows\System\IvApWYy.exe
  2⤵
  PID:5972
- C:\Windows\System\BamPdAF.exe
  C:\Windows\System\BamPdAF.exe
  2⤵
  PID:5988
- C:\Windows\System\AgjHdMh.exe
  C:\Windows\System\AgjHdMh.exe
  2⤵
  PID:6020
- C:\Windows\System\DcFFXgG.exe
  C:\Windows\System\DcFFXgG.exe
  2⤵
  PID:6052
- C:\Windows\System\crYtfRb.exe
  C:\Windows\System\crYtfRb.exe
  2⤵
  PID:6084
- C:\Windows\System\AHShgEs.exe
  C:\Windows\System\AHShgEs.exe
  2⤵
  PID:6116
- C:\Windows\System\GiIbwTn.exe
  C:\Windows\System\GiIbwTn.exe
  2⤵
  PID:4684
- C:\Windows\System\sIvIDuB.exe
  C:\Windows\System\sIvIDuB.exe
  2⤵
  PID:3032
- C:\Windows\System\QFcXqJQ.exe
  C:\Windows\System\QFcXqJQ.exe
  2⤵
  PID:4136
- C:\Windows\System\XLxuYsX.exe
  C:\Windows\System\XLxuYsX.exe
  2⤵
  PID:1556
- C:\Windows\System\Uunfrax.exe
  C:\Windows\System\Uunfrax.exe
  2⤵
  PID:5188
- C:\Windows\System\miLXyGG.exe
  C:\Windows\System\miLXyGG.exe
  2⤵
  PID:5232
- C:\Windows\System\xRnDmaw.exe
  C:\Windows\System\xRnDmaw.exe
  2⤵
  PID:2908
- C:\Windows\System\YwJcpVE.exe
  C:\Windows\System\YwJcpVE.exe
  2⤵
  PID:2200
- C:\Windows\System\jfeskOE.exe
  C:\Windows\System\jfeskOE.exe
  2⤵
  PID:5296
- C:\Windows\System\cqaehsV.exe
  C:\Windows\System\cqaehsV.exe
  2⤵
  PID:2312
- C:\Windows\System\cxkqUDk.exe
  C:\Windows\System\cxkqUDk.exe
  2⤵
  PID:5424
- C:\Windows\System\qlIzEpM.exe
  C:\Windows\System\qlIzEpM.exe
  2⤵
  PID:5488
- C:\Windows\System\lyDKDhH.exe
  C:\Windows\System\lyDKDhH.exe
  2⤵
  PID:5520
- C:\Windows\System\rYhQufl.exe
  C:\Windows\System\rYhQufl.exe
  2⤵
  PID:5604
- C:\Windows\System\aoALpUP.exe
  C:\Windows\System\aoALpUP.exe
  2⤵
  PID:5680
- C:\Windows\System\APDkRLP.exe
  C:\Windows\System\APDkRLP.exe
  2⤵
  PID:5712
- C:\Windows\System\gBjdbtB.exe
  C:\Windows\System\gBjdbtB.exe
  2⤵
  PID:5812
- C:\Windows\System\vDjiGId.exe
  C:\Windows\System\vDjiGId.exe
  2⤵
  PID:2224
- C:\Windows\System\GoWKryt.exe
  C:\Windows\System\GoWKryt.exe
  2⤵
  PID:5924
- C:\Windows\System\nBXyLPN.exe
  C:\Windows\System\nBXyLPN.exe
  2⤵
  PID:5536
- C:\Windows\System\BlCENND.exe
  C:\Windows\System\BlCENND.exe
  2⤵
  PID:6136
- C:\Windows\System\yHSzFPX.exe
  C:\Windows\System\yHSzFPX.exe
  2⤵
  PID:5200
- C:\Windows\System\fliBLBz.exe
  C:\Windows\System\fliBLBz.exe
  2⤵
  PID:6148
- C:\Windows\System\biIaGqH.exe
  C:\Windows\System\biIaGqH.exe
  2⤵
  PID:6164
- C:\Windows\System\ruqZbps.exe
  C:\Windows\System\ruqZbps.exe
  2⤵
  PID:6180
- C:\Windows\System\mBtwVuy.exe
  C:\Windows\System\mBtwVuy.exe
  2⤵
  PID:6196
- C:\Windows\System\svImZbK.exe
  C:\Windows\System\svImZbK.exe
  2⤵
  PID:6236
- C:\Windows\System\DAdYXiA.exe
  C:\Windows\System\DAdYXiA.exe
  2⤵
  PID:6252
- C:\Windows\System\MkBztFL.exe
  C:\Windows\System\MkBztFL.exe
  2⤵
  PID:6268
- C:\Windows\System\qORWEfi.exe
  C:\Windows\System\qORWEfi.exe
  2⤵
  PID:6284
- C:\Windows\System\yWqrjdQ.exe
  C:\Windows\System\yWqrjdQ.exe
  2⤵
  PID:6300
- C:\Windows\System\CQMmbkV.exe
  C:\Windows\System\CQMmbkV.exe
  2⤵
  PID:6316
- C:\Windows\System\HjzfLcE.exe
  C:\Windows\System\HjzfLcE.exe
  2⤵
  PID:6332
- C:\Windows\System\geZVsIK.exe
  C:\Windows\System\geZVsIK.exe
  2⤵
  PID:6348
- C:\Windows\System\gJpcyUk.exe
  C:\Windows\System\gJpcyUk.exe
  2⤵
  PID:6364
- C:\Windows\System\IRMrqIg.exe
  C:\Windows\System\IRMrqIg.exe
  2⤵
  PID:6380
- C:\Windows\System\ppnJrZg.exe
  C:\Windows\System\ppnJrZg.exe
  2⤵
  PID:6396
- C:\Windows\System\LaoYWoA.exe
  C:\Windows\System\LaoYWoA.exe
  2⤵
  PID:6412
- C:\Windows\System\XoFnsIg.exe
  C:\Windows\System\XoFnsIg.exe
  2⤵
  PID:6428
- C:\Windows\System\pwSJMbo.exe
  C:\Windows\System\pwSJMbo.exe
  2⤵
  PID:6444
- C:\Windows\System\rLBCYZX.exe
  C:\Windows\System\rLBCYZX.exe
  2⤵
  PID:6460
- C:\Windows\System\KNNVvhP.exe
  C:\Windows\System\KNNVvhP.exe
  2⤵
  PID:6476
- C:\Windows\System\dzdDOFB.exe
  C:\Windows\System\dzdDOFB.exe
  2⤵
  PID:6492
- C:\Windows\System\wdjdcwe.exe
  C:\Windows\System\wdjdcwe.exe
  2⤵
  PID:6508
- C:\Windows\System\liChJHH.exe
  C:\Windows\System\liChJHH.exe
  2⤵
  PID:6524
- C:\Windows\System\XOOsisK.exe
  C:\Windows\System\XOOsisK.exe
  2⤵
  PID:6540
- C:\Windows\System\gppLPTu.exe
  C:\Windows\System\gppLPTu.exe
  2⤵
  PID:6556
- C:\Windows\System\hBHKmLb.exe
  C:\Windows\System\hBHKmLb.exe
  2⤵
  PID:6572
- C:\Windows\System\yXczezE.exe
  C:\Windows\System\yXczezE.exe
  2⤵
  PID:6588
- C:\Windows\System\iJmzQjX.exe
  C:\Windows\System\iJmzQjX.exe
  2⤵
  PID:6604
- C:\Windows\System\euDgFJN.exe
  C:\Windows\System\euDgFJN.exe
  2⤵
  PID:6620
- C:\Windows\System\dkbQkKj.exe
  C:\Windows\System\dkbQkKj.exe
  2⤵
  PID:6636
- C:\Windows\System\HTdNYYx.exe
  C:\Windows\System\HTdNYYx.exe
  2⤵
  PID:6652
- C:\Windows\System\FTFVIRY.exe
  C:\Windows\System\FTFVIRY.exe
  2⤵
  PID:6668
- C:\Windows\System\AnOGPge.exe
  C:\Windows\System\AnOGPge.exe
  2⤵
  PID:6684
- C:\Windows\System\jFaWLdp.exe
  C:\Windows\System\jFaWLdp.exe
  2⤵
  PID:6700
- C:\Windows\System\gAqjptB.exe
  C:\Windows\System\gAqjptB.exe
  2⤵
  PID:6716
- C:\Windows\System\eNEUetI.exe
  C:\Windows\System\eNEUetI.exe
  2⤵
  PID:6732
- C:\Windows\System\WtIFvyS.exe
  C:\Windows\System\WtIFvyS.exe
  2⤵
  PID:6748
- C:\Windows\System\XWOOOQG.exe
  C:\Windows\System\XWOOOQG.exe
  2⤵
  PID:6764
- C:\Windows\System\KKqWCbz.exe
  C:\Windows\System\KKqWCbz.exe
  2⤵
  PID:6780
- C:\Windows\System\wyZeQfW.exe
  C:\Windows\System\wyZeQfW.exe
  2⤵
  PID:6796
- C:\Windows\System\BuKbjcG.exe
  C:\Windows\System\BuKbjcG.exe
  2⤵
  PID:6812
- C:\Windows\System\EvxBZza.exe
  C:\Windows\System\EvxBZza.exe
  2⤵
  PID:6828
- C:\Windows\System\qZsbcXg.exe
  C:\Windows\System\qZsbcXg.exe
  2⤵
  PID:6848
- C:\Windows\System\qxraTQb.exe
  C:\Windows\System\qxraTQb.exe
  2⤵
  PID:6864
- C:\Windows\System\jvnQeYZ.exe
  C:\Windows\System\jvnQeYZ.exe
  2⤵
  PID:6880
- C:\Windows\System\FJdcodW.exe
  C:\Windows\System\FJdcodW.exe
  2⤵
  PID:6896
- C:\Windows\System\SUjLLfx.exe
  C:\Windows\System\SUjLLfx.exe
  2⤵
  PID:6912
- C:\Windows\System\flbAjAN.exe
  C:\Windows\System\flbAjAN.exe
  2⤵
  PID:6928
- C:\Windows\System\pcAaLWb.exe
  C:\Windows\System\pcAaLWb.exe
  2⤵
  PID:6944
- C:\Windows\System\XSUjQyD.exe
  C:\Windows\System\XSUjQyD.exe
  2⤵
  PID:6960
- C:\Windows\System\AmKksPF.exe
  C:\Windows\System\AmKksPF.exe
  2⤵
  PID:6976
- C:\Windows\System\wWdOdCt.exe
  C:\Windows\System\wWdOdCt.exe
  2⤵
  PID:6992
- C:\Windows\System\ltQNMtN.exe
  C:\Windows\System\ltQNMtN.exe
  2⤵
  PID:7008
- C:\Windows\System\ssiuyIW.exe
  C:\Windows\System\ssiuyIW.exe
  2⤵
  PID:7024
- C:\Windows\System\nliGtkT.exe
  C:\Windows\System\nliGtkT.exe
  2⤵
  PID:7040
- C:\Windows\System\UxCUAUL.exe
  C:\Windows\System\UxCUAUL.exe
  2⤵
  PID:7056
- C:\Windows\System\kmkzyEV.exe
  C:\Windows\System\kmkzyEV.exe
  2⤵
  PID:7072
- C:\Windows\System\lxoOETf.exe
  C:\Windows\System\lxoOETf.exe
  2⤵
  PID:7088
- C:\Windows\System\cENAgvw.exe
  C:\Windows\System\cENAgvw.exe
  2⤵
  PID:7104
- C:\Windows\System\FcIieJc.exe
  C:\Windows\System\FcIieJc.exe
  2⤵
  PID:7120
- C:\Windows\System\axjWQTY.exe
  C:\Windows\System\axjWQTY.exe
  2⤵
  PID:7136
- C:\Windows\System\gSCDvhJ.exe
  C:\Windows\System\gSCDvhJ.exe
  2⤵
  PID:7152
- C:\Windows\System\OLaFMkP.exe
  C:\Windows\System\OLaFMkP.exe
  2⤵
  PID:5408
- C:\Windows\System\lDIGHEx.exe
  C:\Windows\System\lDIGHEx.exe
  2⤵
  PID:5648
- C:\Windows\System\UCqXrmi.exe
  C:\Windows\System\UCqXrmi.exe
  2⤵
  PID:5864
- C:\Windows\System\SADPWjr.exe
  C:\Windows\System\SADPWjr.exe
  2⤵
  PID:6056
- C:\Windows\System\kcuDWgK.exe
  C:\Windows\System\kcuDWgK.exe
  2⤵
  PID:5312
- C:\Windows\System\HflWpFU.exe
  C:\Windows\System\HflWpFU.exe
  2⤵
  PID:5976
- C:\Windows\System\CcDWPdq.exe
  C:\Windows\System\CcDWPdq.exe
  2⤵
  PID:6104
- C:\Windows\System\YMGNztO.exe
  C:\Windows\System\YMGNztO.exe
  2⤵
  PID:5140
- C:\Windows\System\YKYyliW.exe
  C:\Windows\System\YKYyliW.exe
  2⤵
  PID:5280
- C:\Windows\System\llKQlcn.exe
  C:\Windows\System\llKQlcn.exe
  2⤵
  PID:5456
- C:\Windows\System\HsCYzfa.exe
  C:\Windows\System\HsCYzfa.exe
  2⤵
  PID:5748
- C:\Windows\System\tiRAWCi.exe
  C:\Windows\System\tiRAWCi.exe
  2⤵
  PID:3024
- C:\Windows\System\GXoDSSn.exe
  C:\Windows\System\GXoDSSn.exe
  2⤵
  PID:2588
- C:\Windows\System\svWcJCo.exe
  C:\Windows\System\svWcJCo.exe
  2⤵
  PID:6156
- C:\Windows\System\yMaqqlO.exe
  C:\Windows\System\yMaqqlO.exe
  2⤵
  PID:756
- C:\Windows\System\WWHlzRL.exe
  C:\Windows\System\WWHlzRL.exe
  2⤵
  PID:6216
- C:\Windows\System\mFQcTkT.exe
  C:\Windows\System\mFQcTkT.exe
  2⤵
  PID:6260
- C:\Windows\System\xVjNMqE.exe
  C:\Windows\System\xVjNMqE.exe
  2⤵
  PID:6324
- C:\Windows\System\QOeWMQB.exe
  C:\Windows\System\QOeWMQB.exe
  2⤵
  PID:6388
- C:\Windows\System\ulBpiub.exe
  C:\Windows\System\ulBpiub.exe
  2⤵
  PID:6484
- C:\Windows\System\dpolYXY.exe
  C:\Windows\System\dpolYXY.exe
  2⤵
  PID:6548
- C:\Windows\System\efyXvzt.exe
  C:\Windows\System\efyXvzt.exe
  2⤵
  PID:6612
- C:\Windows\System\ObouXUu.exe
  C:\Windows\System\ObouXUu.exe
  2⤵
  PID:6648
- C:\Windows\System\AxVqZFq.exe
  C:\Windows\System\AxVqZFq.exe
  2⤵
  PID:320
- C:\Windows\System\LRWaQzM.exe
  C:\Windows\System\LRWaQzM.exe
  2⤵
  PID:6308
- C:\Windows\System\CZApwQC.exe
  C:\Windows\System\CZApwQC.exe
  2⤵
  PID:6372
- C:\Windows\System\hRSKYGr.exe
  C:\Windows\System\hRSKYGr.exe
  2⤵
  PID:6440
- C:\Windows\System\lBejdmS.exe
  C:\Windows\System\lBejdmS.exe
  2⤵
  PID:6504
- C:\Windows\System\lfWERsZ.exe
  C:\Windows\System\lfWERsZ.exe
  2⤵
  PID:664
- C:\Windows\System\RWovidr.exe
  C:\Windows\System\RWovidr.exe
  2⤵
  PID:6632
- C:\Windows\System\rRZOBxZ.exe
  C:\Windows\System\rRZOBxZ.exe
  2⤵
  PID:6696
- C:\Windows\System\OshkZkH.exe
  C:\Windows\System\OshkZkH.exe
  2⤵
  PID:6760
- C:\Windows\System\mHepPiU.exe
  C:\Windows\System\mHepPiU.exe
  2⤵
  PID:6792
- C:\Windows\System\QyuokfC.exe
  C:\Windows\System\QyuokfC.exe
  2⤵
  PID:6888
- C:\Windows\System\HByURiO.exe
  C:\Windows\System\HByURiO.exe
  2⤵
  PID:6920
- C:\Windows\System\EwtIRHd.exe
  C:\Windows\System\EwtIRHd.exe
  2⤵
  PID:6988
- C:\Windows\System\RdlhpLm.exe
  C:\Windows\System\RdlhpLm.exe
  2⤵
  PID:7052
- C:\Windows\System\ydOcHCl.exe
  C:\Windows\System\ydOcHCl.exe
  2⤵
  PID:6772
- C:\Windows\System\RNVgiES.exe
  C:\Windows\System\RNVgiES.exe
  2⤵
  PID:6836
- C:\Windows\System\VLQhaJK.exe
  C:\Windows\System\VLQhaJK.exe
  2⤵
  PID:6904
- C:\Windows\System\ukgaIRA.exe
  C:\Windows\System\ukgaIRA.exe
  2⤵
  PID:6968
- C:\Windows\System\VSfdlnB.exe
  C:\Windows\System\VSfdlnB.exe
  2⤵
  PID:7064
- C:\Windows\System\BmbaQeH.exe
  C:\Windows\System\BmbaQeH.exe
  2⤵
  PID:7128
- C:\Windows\System\DnUzUwZ.exe
  C:\Windows\System\DnUzUwZ.exe
  2⤵
  PID:7164
- C:\Windows\System\zCGFyHY.exe
  C:\Windows\System\zCGFyHY.exe
  2⤵
  PID:7144
- C:\Windows\System\cpIinDu.exe
  C:\Windows\System\cpIinDu.exe
  2⤵
  PID:6008
- C:\Windows\System\HzprRPF.exe
  C:\Windows\System\HzprRPF.exe
  2⤵
  PID:5344
- C:\Windows\System\IOGyLiB.exe
  C:\Windows\System\IOGyLiB.exe
  2⤵
  PID:1640
- C:\Windows\System\WCOJbWS.exe
  C:\Windows\System\WCOJbWS.exe
  2⤵
  PID:6296
- C:\Windows\System\SbguCOA.exe
  C:\Windows\System\SbguCOA.exe
  2⤵
  PID:6456
- C:\Windows\System\sLqdJfw.exe
  C:\Windows\System\sLqdJfw.exe
  2⤵
  PID:6584
- C:\Windows\System\errgVqi.exe
  C:\Windows\System\errgVqi.exe
  2⤵
  PID:6344
- C:\Windows\System\yAAuuhC.exe
  C:\Windows\System\yAAuuhC.exe
  2⤵
  PID:2756
- C:\Windows\System\HaPbZzP.exe
  C:\Windows\System\HaPbZzP.exe
  2⤵
  PID:6600
- C:\Windows\System\rkyHnsZ.exe
  C:\Windows\System\rkyHnsZ.exe
  2⤵
  PID:6756
- C:\Windows\System\zxRAHLk.exe
  C:\Windows\System\zxRAHLk.exe
  2⤵
  PID:6040
- C:\Windows\System\TpunTpV.exe
  C:\Windows\System\TpunTpV.exe
  2⤵
  PID:532
- C:\Windows\System\NdVLNqQ.exe
  C:\Windows\System\NdVLNqQ.exe
  2⤵
  PID:6516
- C:\Windows\System\UsbAYGR.exe
  C:\Windows\System\UsbAYGR.exe
  2⤵
  PID:6280
- C:\Windows\System\dnASroZ.exe
  C:\Windows\System\dnASroZ.exe
  2⤵
  PID:6564
- C:\Windows\System\NJUKLZi.exe
  C:\Windows\System\NJUKLZi.exe
  2⤵
  PID:676
- C:\Windows\System\GedTiVR.exe
  C:\Windows\System\GedTiVR.exe
  2⤵
  PID:6984
- C:\Windows\System\KleaDJF.exe
  C:\Windows\System\KleaDJF.exe
  2⤵
  PID:7004
- C:\Windows\System\CVMDBvF.exe
  C:\Windows\System\CVMDBvF.exe
  2⤵
  PID:7112
- C:\Windows\System\xphzjZt.exe
  C:\Windows\System\xphzjZt.exe
  2⤵
  PID:5876
- C:\Windows\System\ROTroKz.exe
  C:\Windows\System\ROTroKz.exe
  2⤵
  PID:7048
- C:\Windows\System\tIySDJC.exe
  C:\Windows\System\tIySDJC.exe
  2⤵
  PID:6940
- C:\Windows\System\EXDNjqE.exe
  C:\Windows\System\EXDNjqE.exe
  2⤵
  PID:6712
- C:\Windows\System\dAMBrLj.exe
  C:\Windows\System\dAMBrLj.exe
  2⤵
  PID:6856
- C:\Windows\System\CBiJaaw.exe
  C:\Windows\System\CBiJaaw.exe
  2⤵
  PID:6232
- C:\Windows\System\ljLVkLJ.exe
  C:\Windows\System\ljLVkLJ.exe
  2⤵
  PID:7100
- C:\Windows\System\knNFfoY.exe
  C:\Windows\System\knNFfoY.exe
  2⤵
  PID:6212
- C:\Windows\System\BwmDRBH.exe
  C:\Windows\System\BwmDRBH.exe
  2⤵
  PID:6188
- C:\Windows\System\dydZMuM.exe
  C:\Windows\System\dydZMuM.exe
  2⤵
  PID:5728
- C:\Windows\System\iepRQsu.exe
  C:\Windows\System\iepRQsu.exe
  2⤵
  PID:6408
- C:\Windows\System\DExAMfA.exe
  C:\Windows\System\DExAMfA.exe
  2⤵
  PID:6436
- C:\Windows\System\RCqjQkN.exe
  C:\Windows\System\RCqjQkN.exe
  2⤵
  PID:1928
- C:\Windows\System\aoGUkHE.exe
  C:\Windows\System\aoGUkHE.exe
  2⤵
  PID:5960
- C:\Windows\System\opMHULI.exe
  C:\Windows\System\opMHULI.exe
  2⤵
  PID:6952
- C:\Windows\System\hWPCnmq.exe
  C:\Windows\System\hWPCnmq.exe
  2⤵
  PID:6936
- C:\Windows\System\KtxIreT.exe
  C:\Windows\System\KtxIreT.exe
  2⤵
  PID:6580
- C:\Windows\System\DxHexpS.exe
  C:\Windows\System\DxHexpS.exe
  2⤵
  PID:5664
- C:\Windows\System\tBfzoXO.exe
  C:\Windows\System\tBfzoXO.exe
  2⤵
  PID:7020
- C:\Windows\System\abDyhik.exe
  C:\Windows\System\abDyhik.exe
  2⤵
  PID:6728
- C:\Windows\System\bdErQIh.exe
  C:\Windows\System\bdErQIh.exe
  2⤵
  PID:7036
- C:\Windows\System\EpGzvyO.exe
  C:\Windows\System\EpGzvyO.exe
  2⤵
  PID:804
- C:\Windows\System\ktNgsju.exe
  C:\Windows\System\ktNgsju.exe
  2⤵
  PID:5816
- C:\Windows\System\hTytxam.exe
  C:\Windows\System\hTytxam.exe
  2⤵
  PID:6876
- C:\Windows\System\xkBgFuO.exe
  C:\Windows\System\xkBgFuO.exe
  2⤵
  PID:7096
- C:\Windows\System\aesyIQp.exe
  C:\Windows\System\aesyIQp.exe
  2⤵
  PID:7116
- C:\Windows\System\tJkVCLh.exe
  C:\Windows\System\tJkVCLh.exe
  2⤵
  PID:6892
- C:\Windows\System\EhwBpyq.exe
  C:\Windows\System\EhwBpyq.exe
  2⤵
  PID:468
- C:\Windows\System\oZGYksZ.exe
  C:\Windows\System\oZGYksZ.exe
  2⤵
  PID:6276
- C:\Windows\System\IEVMQJB.exe
  C:\Windows\System\IEVMQJB.exe
  2⤵
  PID:7180
- C:\Windows\System\WGZCAgp.exe
  C:\Windows\System\WGZCAgp.exe
  2⤵
  PID:7196
- C:\Windows\System\ciSEczf.exe
  C:\Windows\System\ciSEczf.exe
  2⤵
  PID:7212
- C:\Windows\System\dvzlKSZ.exe
  C:\Windows\System\dvzlKSZ.exe
  2⤵
  PID:7228
- C:\Windows\System\kPoVSss.exe
  C:\Windows\System\kPoVSss.exe
  2⤵
  PID:7244
- C:\Windows\System\Vzqcfyr.exe
  C:\Windows\System\Vzqcfyr.exe
  2⤵
  PID:7260
- C:\Windows\System\zWVOsbT.exe
  C:\Windows\System\zWVOsbT.exe
  2⤵
  PID:7276
- C:\Windows\System\LQiiQmU.exe
  C:\Windows\System\LQiiQmU.exe
  2⤵
  PID:7292
- C:\Windows\System\NFJuQOw.exe
  C:\Windows\System\NFJuQOw.exe
  2⤵
  PID:7308
- C:\Windows\System\crQvcmR.exe
  C:\Windows\System\crQvcmR.exe
  2⤵
  PID:7324
- C:\Windows\System\QHEyxKZ.exe
  C:\Windows\System\QHEyxKZ.exe
  2⤵
  PID:7340
- C:\Windows\System\xiaPLdN.exe
  C:\Windows\System\xiaPLdN.exe
  2⤵
  PID:7356
- C:\Windows\System\rxGcXXM.exe
  C:\Windows\System\rxGcXXM.exe
  2⤵
  PID:7372
- C:\Windows\System\THAWNla.exe
  C:\Windows\System\THAWNla.exe
  2⤵
  PID:7388
- C:\Windows\System\hfihnjS.exe
  C:\Windows\System\hfihnjS.exe
  2⤵
  PID:7404
- C:\Windows\System\gilbLQo.exe
  C:\Windows\System\gilbLQo.exe
  2⤵
  PID:7420
- C:\Windows\System\XiwyQFb.exe
  C:\Windows\System\XiwyQFb.exe
  2⤵
  PID:7436
- C:\Windows\System\otEyOTU.exe
  C:\Windows\System\otEyOTU.exe
  2⤵
  PID:7452
- C:\Windows\System\XtlysDI.exe
  C:\Windows\System\XtlysDI.exe
  2⤵
  PID:7468
- C:\Windows\System\RQBkECF.exe
  C:\Windows\System\RQBkECF.exe
  2⤵
  PID:7484
- C:\Windows\System\FTnGsBz.exe
  C:\Windows\System\FTnGsBz.exe
  2⤵
  PID:7500
- C:\Windows\System\yyWqsXf.exe
  C:\Windows\System\yyWqsXf.exe
  2⤵
  PID:7516
- C:\Windows\System\nkpOKUA.exe
  C:\Windows\System\nkpOKUA.exe
  2⤵
  PID:7532
- C:\Windows\System\tPfoyau.exe
  C:\Windows\System\tPfoyau.exe
  2⤵
  PID:7548
- C:\Windows\System\laicmdu.exe
  C:\Windows\System\laicmdu.exe
  2⤵
  PID:7564
- C:\Windows\System\BVtQRbK.exe
  C:\Windows\System\BVtQRbK.exe
  2⤵
  PID:7580
- C:\Windows\System\eEflWqZ.exe
  C:\Windows\System\eEflWqZ.exe
  2⤵
  PID:7596
- C:\Windows\System\KwxdKho.exe
  C:\Windows\System\KwxdKho.exe
  2⤵
  PID:7612
- C:\Windows\System\IzmeZcV.exe
  C:\Windows\System\IzmeZcV.exe
  2⤵
  PID:7628
- C:\Windows\System\naLOnqi.exe
  C:\Windows\System\naLOnqi.exe
  2⤵
  PID:7644
- C:\Windows\System\jpMXfER.exe
  C:\Windows\System\jpMXfER.exe
  2⤵
  PID:7660
- C:\Windows\System\iElsFoh.exe
  C:\Windows\System\iElsFoh.exe
  2⤵
  PID:7676
- C:\Windows\System\CoawXKb.exe
  C:\Windows\System\CoawXKb.exe
  2⤵
  PID:7692
- C:\Windows\System\WnCMFGX.exe
  C:\Windows\System\WnCMFGX.exe
  2⤵
  PID:7708
- C:\Windows\System\lyTjayF.exe
  C:\Windows\System\lyTjayF.exe
  2⤵
  PID:7724
- C:\Windows\System\PDQyUFU.exe
  C:\Windows\System\PDQyUFU.exe
  2⤵
  PID:7740
- C:\Windows\System\VaJEnLV.exe
  C:\Windows\System\VaJEnLV.exe
  2⤵
  PID:7756
- C:\Windows\System\oeSyvyw.exe
  C:\Windows\System\oeSyvyw.exe
  2⤵
  PID:7776
- C:\Windows\System\hdikkLn.exe
  C:\Windows\System\hdikkLn.exe
  2⤵
  PID:7792
- C:\Windows\System\feYdPlR.exe
  C:\Windows\System\feYdPlR.exe
  2⤵
  PID:7808
- C:\Windows\System\xbaRkZG.exe
  C:\Windows\System\xbaRkZG.exe
  2⤵
  PID:7824
- C:\Windows\System\MgxHrZd.exe
  C:\Windows\System\MgxHrZd.exe
  2⤵
  PID:7840
- C:\Windows\System\tTtEQzh.exe
  C:\Windows\System\tTtEQzh.exe
  2⤵
  PID:7856
- C:\Windows\System\qPkcCCa.exe
  C:\Windows\System\qPkcCCa.exe
  2⤵
  PID:7872
- C:\Windows\System\tCtxSkF.exe
  C:\Windows\System\tCtxSkF.exe
  2⤵
  PID:7888
- C:\Windows\System\MccYayj.exe
  C:\Windows\System\MccYayj.exe
  2⤵
  PID:7904
- C:\Windows\System\ISZVcJg.exe
  C:\Windows\System\ISZVcJg.exe
  2⤵
  PID:7920
- C:\Windows\System\sSqqMzX.exe
  C:\Windows\System\sSqqMzX.exe
  2⤵
  PID:7936
- C:\Windows\System\bFpNPGu.exe
  C:\Windows\System\bFpNPGu.exe
  2⤵
  PID:7952
- C:\Windows\System\PQYXpoJ.exe
  C:\Windows\System\PQYXpoJ.exe
  2⤵
  PID:7968
- C:\Windows\System\dbIWZDo.exe
  C:\Windows\System\dbIWZDo.exe
  2⤵
  PID:7984
- C:\Windows\System\kxKlRaJ.exe
  C:\Windows\System\kxKlRaJ.exe
  2⤵
  PID:8000
- C:\Windows\System\mcolcDV.exe
  C:\Windows\System\mcolcDV.exe
  2⤵
  PID:8016
- C:\Windows\System\HAoctce.exe
  C:\Windows\System\HAoctce.exe
  2⤵
  PID:8032
- C:\Windows\System\YsxcoRW.exe
  C:\Windows\System\YsxcoRW.exe
  2⤵
  PID:8048
- C:\Windows\System\KIPAJid.exe
  C:\Windows\System\KIPAJid.exe
  2⤵
  PID:8064
- C:\Windows\System\NLmrATI.exe
  C:\Windows\System\NLmrATI.exe
  2⤵
  PID:8080
- C:\Windows\System\CAfRWuj.exe
  C:\Windows\System\CAfRWuj.exe
  2⤵
  PID:8100
- C:\Windows\System\OvsYPrF.exe
  C:\Windows\System\OvsYPrF.exe
  2⤵
  PID:8116
- C:\Windows\System\FkMqiuC.exe
  C:\Windows\System\FkMqiuC.exe
  2⤵
  PID:8132
- C:\Windows\System\Oteizwc.exe
  C:\Windows\System\Oteizwc.exe
  2⤵
  PID:8148
- C:\Windows\System\PuUeVCV.exe
  C:\Windows\System\PuUeVCV.exe
  2⤵
  PID:8164
- C:\Windows\System\leBJixw.exe
  C:\Windows\System\leBJixw.exe
  2⤵
  PID:8180
- C:\Windows\System\YpAqNcZ.exe
  C:\Windows\System\YpAqNcZ.exe
  2⤵
  PID:7176
- C:\Windows\System\NeejUIk.exe
  C:\Windows\System\NeejUIk.exe
  2⤵
  PID:7204
- C:\Windows\System\QkijFrA.exe
  C:\Windows\System\QkijFrA.exe
  2⤵
  PID:6616
- C:\Windows\System\XnELyRr.exe
  C:\Windows\System\XnELyRr.exe
  2⤵
  PID:7220
- C:\Windows\System\aTHPLJz.exe
  C:\Windows\System\aTHPLJz.exe
  2⤵
  PID:7284
- C:\Windows\System\sboRPSS.exe
  C:\Windows\System\sboRPSS.exe
  2⤵
  PID:7364
- C:\Windows\System\ilulrgG.exe
  C:\Windows\System\ilulrgG.exe
  2⤵
  PID:7432
- C:\Windows\System\lYjGnlD.exe
  C:\Windows\System\lYjGnlD.exe
  2⤵
  PID:7348
- C:\Windows\System\FxduqBN.exe
  C:\Windows\System\FxduqBN.exe
  2⤵
  PID:7524
- C:\Windows\System\OJylKoo.exe
  C:\Windows\System\OJylKoo.exe
  2⤵
  PID:7556
- C:\Windows\System\bDNhsEE.exe
  C:\Windows\System\bDNhsEE.exe
  2⤵
  PID:7480
- C:\Windows\System\sZJaSTB.exe
  C:\Windows\System\sZJaSTB.exe
  2⤵
  PID:7476
- C:\Windows\System\zhoFCHt.exe
  C:\Windows\System\zhoFCHt.exe
  2⤵
  PID:7572
- C:\Windows\System\itXZVrP.exe
  C:\Windows\System\itXZVrP.exe
  2⤵
  PID:7624
- C:\Windows\System\QnRzbDe.exe
  C:\Windows\System\QnRzbDe.exe
  2⤵
  PID:7688
- C:\Windows\System\ZUrFvIR.exe
  C:\Windows\System\ZUrFvIR.exe
  2⤵
  PID:7752
- C:\Windows\System\CjqzfcE.exe
  C:\Windows\System\CjqzfcE.exe
  2⤵
  PID:7788
- C:\Windows\System\OPLsiJd.exe
  C:\Windows\System\OPLsiJd.exe
  2⤵
  PID:7880
- C:\Windows\System\xywoDer.exe
  C:\Windows\System\xywoDer.exe
  2⤵
  PID:7732
- C:\Windows\System\ztBWkNT.exe
  C:\Windows\System\ztBWkNT.exe
  2⤵
  PID:7736
- C:\Windows\System\XjcolVt.exe
  C:\Windows\System\XjcolVt.exe
  2⤵
  PID:7768
- C:\Windows\System\ARLhYMh.exe
  C:\Windows\System\ARLhYMh.exe
  2⤵
  PID:7836
- C:\Windows\System\qlrQvVf.exe
  C:\Windows\System\qlrQvVf.exe
  2⤵
  PID:7928
- C:\Windows\System\SubVXPv.exe
  C:\Windows\System\SubVXPv.exe
  2⤵
  PID:8044
- C:\Windows\System\IYIttUe.exe
  C:\Windows\System\IYIttUe.exe
  2⤵
  PID:8028
- C:\Windows\System\BWrczWD.exe
  C:\Windows\System\BWrczWD.exe
  2⤵
  PID:8108
- C:\Windows\System\wcWZNPp.exe
  C:\Windows\System\wcWZNPp.exe
  2⤵
  PID:8176
- C:\Windows\System\eFplwJi.exe
  C:\Windows\System\eFplwJi.exe
  2⤵
  PID:7508
- C:\Windows\System\vEcwZSx.exe
  C:\Windows\System\vEcwZSx.exe
  2⤵
  PID:7720
- C:\Windows\System\WXEffmF.exe
  C:\Windows\System\WXEffmF.exe
  2⤵
  PID:7852
- C:\Windows\System\xsluOMY.exe
  C:\Windows\System\xsluOMY.exe
  2⤵
  PID:7948
- C:\Windows\System\MDcsAiu.exe
  C:\Windows\System\MDcsAiu.exe
  2⤵
  PID:7992
- C:\Windows\System\BFboJSC.exe
  C:\Windows\System\BFboJSC.exe
  2⤵
  PID:8040
- C:\Windows\System\gOvXBeD.exe
  C:\Windows\System\gOvXBeD.exe
  2⤵
  PID:7240
- C:\Windows\System\kWkCurM.exe
  C:\Windows\System\kWkCurM.exe
  2⤵
  PID:7332
- C:\Windows\System\ERsBtAY.exe
  C:\Windows\System\ERsBtAY.exe
  2⤵
  PID:7444
- C:\Windows\System\DSefMqx.exe
  C:\Windows\System\DSefMqx.exe
  2⤵
  PID:7464
- C:\Windows\System\lJToqtG.exe
  C:\Windows\System\lJToqtG.exe
  2⤵
  PID:7976
- C:\Windows\System\egZMFls.exe
  C:\Windows\System\egZMFls.exe
  2⤵
  PID:8124
- C:\Windows\System\EoNshCL.exe
  C:\Windows\System\EoNshCL.exe
  2⤵
  PID:7172
- C:\Windows\System\piJJSot.exe
  C:\Windows\System\piJJSot.exe
  2⤵
  PID:7256
- C:\Windows\System\JaubDWF.exe
  C:\Windows\System\JaubDWF.exe
  2⤵
  PID:7352
- C:\Windows\System\YcksgHz.exe
  C:\Windows\System\YcksgHz.exe
  2⤵
  PID:7428
- C:\Windows\System\fCEOZKf.exe
  C:\Windows\System\fCEOZKf.exe
  2⤵
  PID:8204
- C:\Windows\System\ppSHvla.exe
  C:\Windows\System\ppSHvla.exe
  2⤵
  PID:8220
- C:\Windows\System\SbHsTSO.exe
  C:\Windows\System\SbHsTSO.exe
  2⤵
  PID:8236
- C:\Windows\System\MOHjYzC.exe
  C:\Windows\System\MOHjYzC.exe
  2⤵
  PID:8252
- C:\Windows\System\rkUrUxB.exe
  C:\Windows\System\rkUrUxB.exe
  2⤵
  PID:8268
- C:\Windows\System\xxUdfRt.exe
  C:\Windows\System\xxUdfRt.exe
  2⤵
  PID:8284
- C:\Windows\System\LiJTrjN.exe
  C:\Windows\System\LiJTrjN.exe
  2⤵
  PID:8308
- C:\Windows\System\SaRXUhC.exe
  C:\Windows\System\SaRXUhC.exe
  2⤵
  PID:8348
- C:\Windows\System\RTnNqND.exe
  C:\Windows\System\RTnNqND.exe
  2⤵
  PID:8364
- C:\Windows\System\JWukGoA.exe
  C:\Windows\System\JWukGoA.exe
  2⤵
  PID:8380
- C:\Windows\System\OOgEaGP.exe
  C:\Windows\System\OOgEaGP.exe
  2⤵
  PID:8396
- C:\Windows\System\hbgjemr.exe
  C:\Windows\System\hbgjemr.exe
  2⤵
  PID:8412
- C:\Windows\System\xCjwcGO.exe
  C:\Windows\System\xCjwcGO.exe
  2⤵
  PID:8428
- C:\Windows\System\ShSJycF.exe
  C:\Windows\System\ShSJycF.exe
  2⤵
  PID:8456
- C:\Windows\System\AGWZiPw.exe
  C:\Windows\System\AGWZiPw.exe
  2⤵
  PID:8472
- C:\Windows\System\iCzxsda.exe
  C:\Windows\System\iCzxsda.exe
  2⤵
  PID:8488
- C:\Windows\System\kifGksI.exe
  C:\Windows\System\kifGksI.exe
  2⤵
  PID:8504
- C:\Windows\System\zwvmzFo.exe
  C:\Windows\System\zwvmzFo.exe
  2⤵
  PID:8520
- C:\Windows\System\XCtZssm.exe
  C:\Windows\System\XCtZssm.exe
  2⤵
  PID:8536
- C:\Windows\System\wuRYpwr.exe
  C:\Windows\System\wuRYpwr.exe
  2⤵
  PID:8552
- C:\Windows\System\xKTFbyw.exe
  C:\Windows\System\xKTFbyw.exe
  2⤵
  PID:8568
- C:\Windows\System\MrrcEdE.exe
  C:\Windows\System\MrrcEdE.exe
  2⤵
  PID:8584
- C:\Windows\System\cEaaQEA.exe
  C:\Windows\System\cEaaQEA.exe
  2⤵
  PID:8600
- C:\Windows\System\IpEGJfr.exe
  C:\Windows\System\IpEGJfr.exe
  2⤵
  PID:8616
- C:\Windows\System\zxrhDvO.exe
  C:\Windows\System\zxrhDvO.exe
  2⤵
  PID:8632
- C:\Windows\System\mfwycNO.exe
  C:\Windows\System\mfwycNO.exe
  2⤵
  PID:8648
- C:\Windows\System\BMONXEL.exe
  C:\Windows\System\BMONXEL.exe
  2⤵
  PID:8664
- C:\Windows\System\VXZXaNa.exe
  C:\Windows\System\VXZXaNa.exe
  2⤵
  PID:8680
- C:\Windows\System\yLGzvKw.exe
  C:\Windows\System\yLGzvKw.exe
  2⤵
  PID:8696
- C:\Windows\System\YEVtKQS.exe
  C:\Windows\System\YEVtKQS.exe
  2⤵
  PID:8712
- C:\Windows\System\WFMUFgm.exe
  C:\Windows\System\WFMUFgm.exe
  2⤵
  PID:8728
- C:\Windows\System\AKXFPrz.exe
  C:\Windows\System\AKXFPrz.exe
  2⤵
  PID:8744
- C:\Windows\System\owsiFwX.exe
  C:\Windows\System\owsiFwX.exe
  2⤵
  PID:8760
- C:\Windows\System\PkWsWHK.exe
  C:\Windows\System\PkWsWHK.exe
  2⤵
  PID:8776
- C:\Windows\System\FcSGtHx.exe
  C:\Windows\System\FcSGtHx.exe
  2⤵
  PID:8792
- C:\Windows\System\czmlmTI.exe
  C:\Windows\System\czmlmTI.exe
  2⤵
  PID:8808
- C:\Windows\System\HYgFzEx.exe
  C:\Windows\System\HYgFzEx.exe
  2⤵
  PID:8824
- C:\Windows\System\dPNfBdY.exe
  C:\Windows\System\dPNfBdY.exe
  2⤵
  PID:8840
- C:\Windows\System\DgKTQwt.exe
  C:\Windows\System\DgKTQwt.exe
  2⤵
  PID:8856
- C:\Windows\System\GAapdeK.exe
  C:\Windows\System\GAapdeK.exe
  2⤵
  PID:8872
- C:\Windows\System\HgzpSmN.exe
  C:\Windows\System\HgzpSmN.exe
  2⤵
  PID:8892
- C:\Windows\System\DdmRUPE.exe
  C:\Windows\System\DdmRUPE.exe
  2⤵
  PID:8908
- C:\Windows\System\kldLojb.exe
  C:\Windows\System\kldLojb.exe
  2⤵
  PID:8924
- C:\Windows\System\pkrEzFV.exe
  C:\Windows\System\pkrEzFV.exe
  2⤵
  PID:8940
- C:\Windows\System\tostRps.exe
  C:\Windows\System\tostRps.exe
  2⤵
  PID:8956
- C:\Windows\System\MgKBTSC.exe
  C:\Windows\System\MgKBTSC.exe
  2⤵
  PID:8972
- C:\Windows\System\ketUZgh.exe
  C:\Windows\System\ketUZgh.exe
  2⤵
  PID:8988
- C:\Windows\System\LBtFnWp.exe
  C:\Windows\System\LBtFnWp.exe
  2⤵
  PID:9004
- C:\Windows\System\SsSBQMD.exe
  C:\Windows\System\SsSBQMD.exe
  2⤵
  PID:9020
- C:\Windows\System\friBRqE.exe
  C:\Windows\System\friBRqE.exe
  2⤵
  PID:9036
- C:\Windows\System\WZoEUwm.exe
  C:\Windows\System\WZoEUwm.exe
  2⤵
  PID:9052
- C:\Windows\System\pvQOKRV.exe
  C:\Windows\System\pvQOKRV.exe
  2⤵
  PID:9068
- C:\Windows\System\LGDfKmc.exe
  C:\Windows\System\LGDfKmc.exe
  2⤵
  PID:9084
- C:\Windows\System\HkDcAdE.exe
  C:\Windows\System\HkDcAdE.exe
  2⤵
  PID:9100
- C:\Windows\System\lcPvTDI.exe
  C:\Windows\System\lcPvTDI.exe
  2⤵
  PID:9116
- C:\Windows\System\JEzSpBF.exe
  C:\Windows\System\JEzSpBF.exe
  2⤵
  PID:9132
- C:\Windows\System\rummXbj.exe
  C:\Windows\System\rummXbj.exe
  2⤵
  PID:9148
- C:\Windows\System\yocoxyv.exe
  C:\Windows\System\yocoxyv.exe
  2⤵
  PID:9164
- C:\Windows\System\bNEkfvf.exe
  C:\Windows\System\bNEkfvf.exe
  2⤵
  PID:9180
- C:\Windows\System\ueAOHrN.exe
  C:\Windows\System\ueAOHrN.exe
  2⤵
  PID:9196
- C:\Windows\System\SGLaEEK.exe
  C:\Windows\System\SGLaEEK.exe
  2⤵
  PID:9212
- C:\Windows\System\wwMfAby.exe
  C:\Windows\System\wwMfAby.exe
  2⤵
  PID:7996
- C:\Windows\System\BANVaVS.exe
  C:\Windows\System\BANVaVS.exe
  2⤵
  PID:7192
- C:\Windows\System\RZZhFiO.exe
  C:\Windows\System\RZZhFiO.exe
  2⤵
  PID:8088
- C:\Windows\System\GDfjsKT.exe
  C:\Windows\System\GDfjsKT.exe
  2⤵
  PID:7912
- C:\Windows\System\mUXPtCw.exe
  C:\Windows\System\mUXPtCw.exe
  2⤵
  PID:7748
- C:\Windows\System\IzuDnQK.exe
  C:\Windows\System\IzuDnQK.exe
  2⤵
  PID:7576
- C:\Windows\System\LpVgfCv.exe
  C:\Windows\System\LpVgfCv.exe
  2⤵
  PID:7964
- C:\Windows\System\hjnvBcM.exe
  C:\Windows\System\hjnvBcM.exe
  2⤵
  PID:7320
- C:\Windows\System\eVHyhAG.exe
  C:\Windows\System\eVHyhAG.exe
  2⤵
  PID:7252
- C:\Windows\System\WDwvHSW.exe
  C:\Windows\System\WDwvHSW.exe
  2⤵
  PID:6840
- C:\Windows\System\KBsZGjP.exe
  C:\Windows\System\KBsZGjP.exe
  2⤵
  PID:7640
- C:\Windows\System\OpcEied.exe
  C:\Windows\System\OpcEied.exe
  2⤵
  PID:7544
- C:\Windows\System\hqKgFYB.exe
  C:\Windows\System\hqKgFYB.exe
  2⤵
  PID:8264
- C:\Windows\System\eRIiuJB.exe
  C:\Windows\System\eRIiuJB.exe
  2⤵
  PID:8244
- C:\Windows\System\puYPJHW.exe
  C:\Windows\System\puYPJHW.exe
  2⤵
  PID:8296
- C:\Windows\System\hTMdwxE.exe
  C:\Windows\System\hTMdwxE.exe
  2⤵
  PID:8360
- C:\Windows\System\KXMwpSg.exe
  C:\Windows\System\KXMwpSg.exe
  2⤵
  PID:8420
- C:\Windows\System\qMxQUBl.exe
  C:\Windows\System\qMxQUBl.exe
  2⤵
  PID:8332
- C:\Windows\System\dmcAoxC.exe
  C:\Windows\System\dmcAoxC.exe
  2⤵
  PID:8344
- C:\Windows\System\DuJWUSb.exe
  C:\Windows\System\DuJWUSb.exe
  2⤵
  PID:8464
- C:\Windows\System\RHJECFH.exe
  C:\Windows\System\RHJECFH.exe
  2⤵
  PID:8372
- C:\Windows\System\xFynBAE.exe
  C:\Windows\System\xFynBAE.exe
  2⤵
  PID:8512
- C:\Windows\System\gaxUdzi.exe
  C:\Windows\System\gaxUdzi.exe
  2⤵
  PID:8532
- C:\Windows\System\YGYrJpi.exe
  C:\Windows\System\YGYrJpi.exe
  2⤵
  PID:8548
- C:\Windows\System\troRvyQ.exe
  C:\Windows\System\troRvyQ.exe
  2⤵
  PID:8576
- C:\Windows\System\quWXoXe.exe
  C:\Windows\System\quWXoXe.exe
  2⤵
  PID:8660
- C:\Windows\System\YgxcImh.exe
  C:\Windows\System\YgxcImh.exe
  2⤵
  PID:8692
- C:\Windows\System\LZoCWiM.exe
  C:\Windows\System\LZoCWiM.exe
  2⤵
  PID:8752
- C:\Windows\System\oIwipgo.exe
  C:\Windows\System\oIwipgo.exe
  2⤵
  PID:7764
- C:\Windows\System\OYBslOb.exe
  C:\Windows\System\OYBslOb.exe
  2⤵
  PID:8644
- C:\Windows\System\LlcSbLk.exe
  C:\Windows\System\LlcSbLk.exe
  2⤵
  PID:8772
- C:\Windows\System\dWcFssT.exe
  C:\Windows\System\dWcFssT.exe
  2⤵
  PID:8880
- C:\Windows\System\TFnHdDe.exe
  C:\Windows\System\TFnHdDe.exe
  2⤵
  PID:8704
- C:\Windows\System\JepxVLO.exe
  C:\Windows\System\JepxVLO.exe
  2⤵
  PID:8768
- C:\Windows\System\FWHxJJh.exe
  C:\Windows\System\FWHxJJh.exe
  2⤵
  PID:8836
- C:\Windows\System\xWdVsqq.exe
  C:\Windows\System\xWdVsqq.exe
  2⤵
  PID:8948
- C:\Windows\System\evTUGJF.exe
  C:\Windows\System\evTUGJF.exe
  2⤵
  PID:9012
- C:\Windows\System\NgqWYDT.exe
  C:\Windows\System\NgqWYDT.exe
  2⤵
  PID:9076
- C:\Windows\System\GAmpBhY.exe
  C:\Windows\System\GAmpBhY.exe
  2⤵
  PID:9064
- C:\Windows\System\BchTIFj.exe
  C:\Windows\System\BchTIFj.exe
  2⤵
  PID:9140
- C:\Windows\System\cNxOmGT.exe
  C:\Windows\System\cNxOmGT.exe
  2⤵
  PID:9092
- C:\Windows\System\XFlDigL.exe
  C:\Windows\System\XFlDigL.exe
  2⤵
  PID:9000
- C:\Windows\System\dtiRGJx.exe
  C:\Windows\System\dtiRGJx.exe
  2⤵
  PID:9176
- C:\Windows\System\Fxiqjgm.exe
  C:\Windows\System\Fxiqjgm.exe
  2⤵
  PID:8172
- C:\Windows\System\KAAUiGP.exe
  C:\Windows\System\KAAUiGP.exe
  2⤵
  PID:8188
- C:\Windows\System\FQJRtCV.exe
  C:\Windows\System\FQJRtCV.exe
  2⤵
  PID:7804
- C:\Windows\System\WvTEXPM.exe
  C:\Windows\System\WvTEXPM.exe
  2⤵
  PID:9160
- C:\Windows\System\aBtuINi.exe
  C:\Windows\System\aBtuINi.exe
  2⤵
  PID:8076
- C:\Windows\System\JOKgscF.exe
  C:\Windows\System\JOKgscF.exe
  2⤵
  PID:8008
- C:\Windows\System\lzWxcRG.exe
  C:\Windows\System\lzWxcRG.exe
  2⤵
  PID:8196
- C:\Windows\System\cINntxg.exe
  C:\Windows\System\cINntxg.exe
  2⤵
  PID:8356
- C:\Windows\System\LGYLLIL.exe
  C:\Windows\System\LGYLLIL.exe
  2⤵
  PID:8408
- C:\Windows\System\trQCqkw.exe
  C:\Windows\System\trQCqkw.exe
  2⤵
  PID:8496
- C:\Windows\System\OBGrDGp.exe
  C:\Windows\System\OBGrDGp.exe
  2⤵
  PID:8328
- C:\Windows\System\IVFoiDL.exe
  C:\Windows\System\IVFoiDL.exe
  2⤵
  PID:8392
- C:\Windows\System\ZkeDAQZ.exe
  C:\Windows\System\ZkeDAQZ.exe
  2⤵
  PID:8560
- C:\Windows\System\vtVaFAl.exe
  C:\Windows\System\vtVaFAl.exe
  2⤵
  PID:8724
- C:\Windows\System\ceLFCvj.exe
  C:\Windows\System\ceLFCvj.exe
  2⤵
  PID:8480
- C:\Windows\System\odtazvZ.exe
  C:\Windows\System\odtazvZ.exe
  2⤵
  PID:8788
- C:\Windows\System\ImGXoZK.exe
  C:\Windows\System\ImGXoZK.exe
  2⤵
  PID:8852
- C:\Windows\System\MrWnvUH.exe
  C:\Windows\System\MrWnvUH.exe
  2⤵
  PID:8920
- C:\Windows\System\YQuGONj.exe
  C:\Windows\System\YQuGONj.exe
  2⤵
  PID:8820
- C:\Windows\System\KUXaeik.exe
  C:\Windows\System\KUXaeik.exe
  2⤵
  PID:9044
- C:\Windows\System\DZRgrbV.exe
  C:\Windows\System\DZRgrbV.exe
  2⤵
  PID:8984
- C:\Windows\System\wglRsmO.exe
  C:\Windows\System\wglRsmO.exe
  2⤵
  PID:8968
- C:\Windows\System\fqAhKap.exe
  C:\Windows\System\fqAhKap.exe
  2⤵
  PID:9032
- C:\Windows\System\qNYQkkI.exe
  C:\Windows\System\qNYQkkI.exe
  2⤵
  PID:7400
- C:\Windows\System\FexHOlX.exe
  C:\Windows\System\FexHOlX.exe
  2⤵
  PID:8160
- C:\Windows\System\qPoMoNU.exe
  C:\Windows\System\qPoMoNU.exe
  2⤵
  PID:8304
- C:\Windows\System\utnEFPt.exe
  C:\Windows\System\utnEFPt.exe
  2⤵
  PID:8376
- C:\Windows\System\NLDmHDF.exe
  C:\Windows\System\NLDmHDF.exe
  2⤵
  PID:8280
- C:\Windows\System\qNCHSAJ.exe
  C:\Windows\System\qNCHSAJ.exe
  2⤵
  PID:9188
- C:\Windows\System\vIgyVrT.exe
  C:\Windows\System\vIgyVrT.exe
  2⤵
  PID:8212
- C:\Windows\System\TEbDAUc.exe
  C:\Windows\System\TEbDAUc.exe
  2⤵
  PID:9192
- C:\Windows\System\LTBLTVP.exe
  C:\Windows\System\LTBLTVP.exe
  2⤵
  PID:8804
- C:\Windows\System\LRSBIwC.exe
  C:\Windows\System\LRSBIwC.exe
  2⤵
  PID:9028
- C:\Windows\System\DLepQvj.exe
  C:\Windows\System\DLepQvj.exe
  2⤵
  PID:8736
- C:\Windows\System\wKLrxMW.exe
  C:\Windows\System\wKLrxMW.exe
  2⤵
  PID:8904
- C:\Windows\System\wKTAbqy.exe
  C:\Windows\System\wKTAbqy.exe
  2⤵
  PID:8128
- C:\Windows\System\TxRWFiD.exe
  C:\Windows\System\TxRWFiD.exe
  2⤵
  PID:8260
- C:\Windows\System\XsTfHkf.exe
  C:\Windows\System\XsTfHkf.exe
  2⤵
  PID:8740
- C:\Windows\System\TrUYfRI.exe
  C:\Windows\System\TrUYfRI.exe
  2⤵
  PID:7512
- C:\Windows\System\ywXSagd.exe
  C:\Windows\System\ywXSagd.exe
  2⤵
  PID:8200
- C:\Windows\System\GJnvijp.exe
  C:\Windows\System\GJnvijp.exe
  2⤵
  PID:7704
- C:\Windows\System\ZjTWNcQ.exe
  C:\Windows\System\ZjTWNcQ.exe
  2⤵
  PID:8624
- C:\Windows\System\gOYgroq.exe
  C:\Windows\System\gOYgroq.exe
  2⤵
  PID:9220
- C:\Windows\System\KbpshZP.exe
  C:\Windows\System\KbpshZP.exe
  2⤵
  PID:9236
- C:\Windows\System\Njgxrad.exe
  C:\Windows\System\Njgxrad.exe
  2⤵
  PID:9252
- C:\Windows\System\nGSWcvq.exe
  C:\Windows\System\nGSWcvq.exe
  2⤵
  PID:9268
- C:\Windows\System\DtZhBsK.exe
  C:\Windows\System\DtZhBsK.exe
  2⤵
  PID:9284
- C:\Windows\System\thrBdus.exe
  C:\Windows\System\thrBdus.exe
  2⤵
  PID:9300
- C:\Windows\System\jIDOERD.exe
  C:\Windows\System\jIDOERD.exe
  2⤵
  PID:9316
- C:\Windows\System\lFfbAdP.exe
  C:\Windows\System\lFfbAdP.exe
  2⤵
  PID:9332
- C:\Windows\System\hiSiaYv.exe
  C:\Windows\System\hiSiaYv.exe
  2⤵
  PID:9348
- C:\Windows\System\PcKmEcg.exe
  C:\Windows\System\PcKmEcg.exe
  2⤵
  PID:9364
- C:\Windows\System\TtScVxk.exe
  C:\Windows\System\TtScVxk.exe
  2⤵
  PID:9380
- C:\Windows\System\nhKVmKe.exe
  C:\Windows\System\nhKVmKe.exe
  2⤵
  PID:9396
- C:\Windows\System\imOYJPf.exe
  C:\Windows\System\imOYJPf.exe
  2⤵
  PID:9412
- C:\Windows\System\KxMoVYr.exe
  C:\Windows\System\KxMoVYr.exe
  2⤵
  PID:9428
- C:\Windows\System\anDvZHY.exe
  C:\Windows\System\anDvZHY.exe
  2⤵
  PID:9444
- C:\Windows\System\nSbabCV.exe
  C:\Windows\System\nSbabCV.exe
  2⤵
  PID:9460
- C:\Windows\System\yLUpVjN.exe
  C:\Windows\System\yLUpVjN.exe
  2⤵
  PID:9476
- C:\Windows\System\fUNhNVp.exe
  C:\Windows\System\fUNhNVp.exe
  2⤵
  PID:9492
- C:\Windows\System\ZFWWONK.exe
  C:\Windows\System\ZFWWONK.exe
  2⤵
  PID:9508
- C:\Windows\System\MkLoyPZ.exe
  C:\Windows\System\MkLoyPZ.exe
  2⤵
  PID:9524
- C:\Windows\System\xbUUKmi.exe
  C:\Windows\System\xbUUKmi.exe
  2⤵
  PID:9540
- C:\Windows\System\kvccShL.exe
  C:\Windows\System\kvccShL.exe
  2⤵
  PID:9556
- C:\Windows\System\uYInySo.exe
  C:\Windows\System\uYInySo.exe
  2⤵
  PID:9572
- C:\Windows\System\MPJbObl.exe
  C:\Windows\System\MPJbObl.exe
  2⤵
  PID:9588
- C:\Windows\System\uEamGpu.exe
  C:\Windows\System\uEamGpu.exe
  2⤵
  PID:9604
- C:\Windows\System\GSGFFTq.exe
  C:\Windows\System\GSGFFTq.exe
  2⤵
  PID:9620
- C:\Windows\System\VrWFgca.exe
  C:\Windows\System\VrWFgca.exe
  2⤵
  PID:9636
- C:\Windows\System\yKoKHeA.exe
  C:\Windows\System\yKoKHeA.exe
  2⤵
  PID:9652
- C:\Windows\System\hIHrPYv.exe
  C:\Windows\System\hIHrPYv.exe
  2⤵
  PID:9668
- C:\Windows\System\UZrdZFX.exe
  C:\Windows\System\UZrdZFX.exe
  2⤵
  PID:9684
- C:\Windows\System\dSLxJHz.exe
  C:\Windows\System\dSLxJHz.exe
  2⤵
  PID:9700
- C:\Windows\System\ObdtvkC.exe
  C:\Windows\System\ObdtvkC.exe
  2⤵
  PID:9716
- C:\Windows\System\DYJSJVN.exe
  C:\Windows\System\DYJSJVN.exe
  2⤵
  PID:9732
- C:\Windows\System\WYvXjIC.exe
  C:\Windows\System\WYvXjIC.exe
  2⤵
  PID:9748
- C:\Windows\System\uPoBXkC.exe
  C:\Windows\System\uPoBXkC.exe
  2⤵
  PID:9764
- C:\Windows\System\DNsohLB.exe
  C:\Windows\System\DNsohLB.exe
  2⤵
  PID:9780
- C:\Windows\System\mVqjyZY.exe
  C:\Windows\System\mVqjyZY.exe
  2⤵
  PID:9796
- C:\Windows\System\bDItkxd.exe
  C:\Windows\System\bDItkxd.exe
  2⤵
  PID:9812
- C:\Windows\System\NXvjHAI.exe
  C:\Windows\System\NXvjHAI.exe
  2⤵
  PID:9828
- C:\Windows\System\gaTWuUh.exe
  C:\Windows\System\gaTWuUh.exe
  2⤵
  PID:9844
- C:\Windows\System\fRSrgjf.exe
  C:\Windows\System\fRSrgjf.exe
  2⤵
  PID:9860
- C:\Windows\System\fHNqpEJ.exe
  C:\Windows\System\fHNqpEJ.exe
  2⤵
  PID:9876
- C:\Windows\System\qQzwOhn.exe
  C:\Windows\System\qQzwOhn.exe
  2⤵
  PID:9892
- C:\Windows\System\YfDybpC.exe
  C:\Windows\System\YfDybpC.exe
  2⤵
  PID:9908
- C:\Windows\System\fBjeyiZ.exe
  C:\Windows\System\fBjeyiZ.exe
  2⤵
  PID:9924
- C:\Windows\System\UjoDVTe.exe
  C:\Windows\System\UjoDVTe.exe
  2⤵
  PID:9940
- C:\Windows\System\xTsziZX.exe
  C:\Windows\System\xTsziZX.exe
  2⤵
  PID:9956
- C:\Windows\System\BOdGPTV.exe
  C:\Windows\System\BOdGPTV.exe
  2⤵
  PID:9972
- C:\Windows\System\RNuhFNd.exe
  C:\Windows\System\RNuhFNd.exe
  2⤵
  PID:9988
- C:\Windows\System\VSwtryN.exe
  C:\Windows\System\VSwtryN.exe
  2⤵
  PID:10004
- C:\Windows\System\dwsZYvz.exe
  C:\Windows\System\dwsZYvz.exe
  2⤵
  PID:10024
- C:\Windows\System\dZvComz.exe
  C:\Windows\System\dZvComz.exe
  2⤵
  PID:10040
- C:\Windows\System\aBldWPY.exe
  C:\Windows\System\aBldWPY.exe
  2⤵
  PID:10056
- C:\Windows\System\QiboWvP.exe
  C:\Windows\System\QiboWvP.exe
  2⤵
  PID:10072
- C:\Windows\System\aXCGVKP.exe
  C:\Windows\System\aXCGVKP.exe
  2⤵
  PID:10088
- C:\Windows\System\MbNGUjX.exe
  C:\Windows\System\MbNGUjX.exe
  2⤵
  PID:10104
- C:\Windows\System\hGvITTf.exe
  C:\Windows\System\hGvITTf.exe
  2⤵
  PID:10120
- C:\Windows\System\ZhjSXII.exe
  C:\Windows\System\ZhjSXII.exe
  2⤵
  PID:10136
- C:\Windows\System\crFpLVD.exe
  C:\Windows\System\crFpLVD.exe
  2⤵
  PID:10152
- C:\Windows\System\NznpvjS.exe
  C:\Windows\System\NznpvjS.exe
  2⤵
  PID:10168
- C:\Windows\System\eZmRnTs.exe
  C:\Windows\System\eZmRnTs.exe
  2⤵
  PID:10184
- C:\Windows\System\XBcAggD.exe
  C:\Windows\System\XBcAggD.exe
  2⤵
  PID:10200
- C:\Windows\System\WVYWHNX.exe
  C:\Windows\System\WVYWHNX.exe
  2⤵
  PID:10216
- C:\Windows\System\nHcJQJX.exe
  C:\Windows\System\nHcJQJX.exe
  2⤵
  PID:10232
- C:\Windows\System\XWUxJoj.exe
  C:\Windows\System\XWUxJoj.exe
  2⤵
  PID:9244
- C:\Windows\System\DQIFrJJ.exe
  C:\Windows\System\DQIFrJJ.exe
  2⤵
  PID:9308
- C:\Windows\System\twxNOZa.exe
  C:\Windows\System\twxNOZa.exe
  2⤵
  PID:9372
- C:\Windows\System\deaBXgN.exe
  C:\Windows\System\deaBXgN.exe
  2⤵
  PID:9436
- C:\Windows\System\aHBIrPE.exe
  C:\Windows\System\aHBIrPE.exe
  2⤵
  PID:9500
- C:\Windows\System\mtDiRKh.exe
  C:\Windows\System\mtDiRKh.exe
  2⤵
  PID:9208
- C:\Windows\System\IxTxhgt.exe
  C:\Windows\System\IxTxhgt.exe
  2⤵
  PID:9536
- C:\Windows\System\sKCRaoX.exe
  C:\Windows\System\sKCRaoX.exe
  2⤵
  PID:9392
- C:\Windows\System\LShDZWL.exe
  C:\Windows\System\LShDZWL.exe
  2⤵
  PID:9452
- C:\Windows\System\uSMPVCh.exe
  C:\Windows\System\uSMPVCh.exe
  2⤵
  PID:9516
- C:\Windows\System\gMTQrQq.exe
  C:\Windows\System\gMTQrQq.exe
  2⤵
  PID:9580
- C:\Windows\System\YmLlWBK.exe
  C:\Windows\System\YmLlWBK.exe
  2⤵
  PID:8596
- C:\Windows\System\WPOfBqy.exe
  C:\Windows\System\WPOfBqy.exe
  2⤵
  PID:9632
- C:\Windows\System\RWrPQSI.exe
  C:\Windows\System\RWrPQSI.exe
  2⤵
  PID:9692
- C:\Windows\System\IdjnhRG.exe
  C:\Windows\System\IdjnhRG.exe
  2⤵
  PID:9756
- C:\Windows\System\QpgsBAn.exe
  C:\Windows\System\QpgsBAn.exe
  2⤵
  PID:9820
- C:\Windows\System\LsjDxca.exe
  C:\Windows\System\LsjDxca.exe
  2⤵
  PID:9296
- C:\Windows\System\nhdTNHU.exe
  C:\Windows\System\nhdTNHU.exe
  2⤵
  PID:9232
- C:\Windows\System\fOWCIPj.exe
  C:\Windows\System\fOWCIPj.exe
  2⤵
  PID:9708
- C:\Windows\System\QGCBscM.exe
  C:\Windows\System\QGCBscM.exe
  2⤵
  PID:9772
- C:\Windows\System\ysyemXX.exe
  C:\Windows\System\ysyemXX.exe
  2⤵
  PID:9900
- C:\Windows\System\XwjCNdY.exe
  C:\Windows\System\XwjCNdY.exe
  2⤵
  PID:9836
- C:\Windows\System\NxSIxfg.exe
  C:\Windows\System\NxSIxfg.exe
  2⤵
  PID:9916
- C:\Windows\System\oFWXWrc.exe
  C:\Windows\System\oFWXWrc.exe
  2⤵
  PID:9680
- C:\Windows\System\YbNdVYb.exe
  C:\Windows\System\YbNdVYb.exe
  2⤵
  PID:9984
- C:\Windows\System\paVgiJQ.exe
  C:\Windows\System\paVgiJQ.exe
  2⤵
  PID:10048
- C:\Windows\System\bZzgAwD.exe
  C:\Windows\System\bZzgAwD.exe
  2⤵
  PID:9904
- C:\Windows\System\woQHFRa.exe
  C:\Windows\System\woQHFRa.exe
  2⤵
  PID:10116
- C:\Windows\System\vMnvbtP.exe
  C:\Windows\System\vMnvbtP.exe
  2⤵
  PID:9936
- C:\Windows\System\yMLmPZV.exe
  C:\Windows\System\yMLmPZV.exe
  2⤵
  PID:10000
- C:\Windows\System\LDVVZHf.exe
  C:\Windows\System\LDVVZHf.exe
  2⤵
  PID:10128
- C:\Windows\System\KDDNBKp.exe
  C:\Windows\System\KDDNBKp.exe
  2⤵
  PID:10180
- C:\Windows\System\kceYCnM.exe
  C:\Windows\System\kceYCnM.exe
  2⤵
  PID:7700
- C:\Windows\System\WXUvMLj.exe
  C:\Windows\System\WXUvMLj.exe
  2⤵
  PID:10160
- C:\Windows\System\xGePKaO.exe
  C:\Windows\System\xGePKaO.exe
  2⤵
  PID:10224
- C:\Windows\System\TChlMiR.exe
  C:\Windows\System\TChlMiR.exe
  2⤵
  PID:9404
- C:\Windows\System\XjdWOJG.exe
  C:\Windows\System\XjdWOJG.exe
  2⤵
  PID:7396
- C:\Windows\System\PDQTDPh.exe
  C:\Windows\System\PDQTDPh.exe
  2⤵
  PID:9548
- C:\Windows\System\OXvqhre.exe
  C:\Windows\System\OXvqhre.exe
  2⤵
  PID:9600
- C:\Windows\System\zgUntas.exe
  C:\Windows\System\zgUntas.exe
  2⤵
  PID:9628
- C:\Windows\System\CErIdxr.exe
  C:\Windows\System\CErIdxr.exe
  2⤵
  PID:9852
- C:\Windows\System\YhbUtcn.exe
  C:\Windows\System\YhbUtcn.exe
  2⤵
  PID:9324
- C:\Windows\System\MnoRrNa.exe
  C:\Windows\System\MnoRrNa.exe
  2⤵
  PID:9484
- C:\Windows\System\xPPiERB.exe
  C:\Windows\System\xPPiERB.exe
  2⤵
  PID:9792
- C:\Windows\System\PExbvXP.exe
  C:\Windows\System\PExbvXP.exe
  2⤵
  PID:9808
- C:\Windows\System\fWyQeGr.exe
  C:\Windows\System\fWyQeGr.exe
  2⤵
  PID:9744
- C:\Windows\System\JLYNVcr.exe
  C:\Windows\System\JLYNVcr.exe
  2⤵
  PID:9968
- C:\Windows\System\PFZBLmk.exe
  C:\Windows\System\PFZBLmk.exe
  2⤵
  PID:10096
- C:\Windows\System\sXqEBQc.exe
  C:\Windows\System\sXqEBQc.exe
  2⤵
  PID:10192
- C:\Windows\System\wxGqfYv.exe
  C:\Windows\System\wxGqfYv.exe
  2⤵
  PID:1564
- C:\Windows\System\zHKbqgP.exe
  C:\Windows\System\zHKbqgP.exe
  2⤵
  PID:9488
- C:\Windows\System\YofNtVD.exe
  C:\Windows\System\YofNtVD.exe
  2⤵
  PID:9952
- C:\Windows\System\tLXQMJq.exe
  C:\Windows\System\tLXQMJq.exe
  2⤵
  PID:10016
- C:\Windows\System\CITUkRT.exe
  C:\Windows\System\CITUkRT.exe
  2⤵
  PID:10176
- C:\Windows\System\YPYNNzo.exe
  C:\Windows\System\YPYNNzo.exe
  2⤵
  PID:9280
- C:\Windows\System\YkYyIql.exe
  C:\Windows\System\YkYyIql.exe
  2⤵
  PID:9856
- C:\Windows\System\wTprAPk.exe
  C:\Windows\System\wTprAPk.exe
  2⤵
  PID:9868
- C:\Windows\System\ZxFNbHz.exe
  C:\Windows\System\ZxFNbHz.exe
  2⤵
  PID:10212
- C:\Windows\System\rliVFTm.exe
  C:\Windows\System\rliVFTm.exe
  2⤵
  PID:10148
- C:\Windows\System\fYphadE.exe
  C:\Windows\System\fYphadE.exe
  2⤵
  PID:9676
- C:\Windows\System\wAknjfK.exe
  C:\Windows\System\wAknjfK.exe
  2⤵
  PID:10112
- C:\Windows\System\BvisEId.exe
  C:\Windows\System\BvisEId.exe
  2⤵
  PID:9964
- C:\Windows\System\XEKcriE.exe
  C:\Windows\System\XEKcriE.exe
  2⤵
  PID:9740
- C:\Windows\System\QjhagIX.exe
  C:\Windows\System\QjhagIX.exe
  2⤵
  PID:9616
- C:\Windows\System\mgGARVU.exe
  C:\Windows\System\mgGARVU.exe
  2⤵
  PID:10244
- C:\Windows\System\nNPQIul.exe
  C:\Windows\System\nNPQIul.exe
  2⤵
  PID:10260
- C:\Windows\System\AxcOGnw.exe
  C:\Windows\System\AxcOGnw.exe
  2⤵
  PID:10276
- C:\Windows\System\YFkTNFv.exe
  C:\Windows\System\YFkTNFv.exe
  2⤵
  PID:10292
- C:\Windows\System\EGYAuEv.exe
  C:\Windows\System\EGYAuEv.exe
  2⤵
  PID:10308
- C:\Windows\System\MigqjiX.exe
  C:\Windows\System\MigqjiX.exe
  2⤵
  PID:10324
- C:\Windows\System\SLdsoKi.exe
  C:\Windows\System\SLdsoKi.exe
  2⤵
  PID:10340
- C:\Windows\System\nShwyFt.exe
  C:\Windows\System\nShwyFt.exe
  2⤵
  PID:10356
- C:\Windows\System\bspXrsj.exe
  C:\Windows\System\bspXrsj.exe
  2⤵
  PID:10372
- C:\Windows\System\EFKivbc.exe
  C:\Windows\System\EFKivbc.exe
  2⤵
  PID:10388
- C:\Windows\System\zvVyhhu.exe
  C:\Windows\System\zvVyhhu.exe
  2⤵
  PID:10404
- C:\Windows\System\JmSRFRh.exe
  C:\Windows\System\JmSRFRh.exe
  2⤵
  PID:10420
- C:\Windows\System\xomXTaT.exe
  C:\Windows\System\xomXTaT.exe
  2⤵
  PID:10436
- C:\Windows\System\bFUAqNN.exe
  C:\Windows\System\bFUAqNN.exe
  2⤵
  PID:10452
- C:\Windows\System\DxkwDPz.exe
  C:\Windows\System\DxkwDPz.exe
  2⤵
  PID:10468
- C:\Windows\System\CAIgLdL.exe
  C:\Windows\System\CAIgLdL.exe
  2⤵
  PID:10484
- C:\Windows\System\ZIJQwEO.exe
  C:\Windows\System\ZIJQwEO.exe
  2⤵
  PID:10500
- C:\Windows\System\ZOLuKYE.exe
  C:\Windows\System\ZOLuKYE.exe
  2⤵
  PID:10516
- C:\Windows\System\ZHKMbHS.exe
  C:\Windows\System\ZHKMbHS.exe
  2⤵
  PID:10532
- C:\Windows\System\xLLRdFu.exe
  C:\Windows\System\xLLRdFu.exe
  2⤵
  PID:10548
- C:\Windows\System\yesxqtV.exe
  C:\Windows\System\yesxqtV.exe
  2⤵
  PID:10564
- C:\Windows\System\rDfMehe.exe
  C:\Windows\System\rDfMehe.exe
  2⤵
  PID:10580
- C:\Windows\System\EpnrVhF.exe
  C:\Windows\System\EpnrVhF.exe
  2⤵
  PID:10596
- C:\Windows\System\zgDZuIs.exe
  C:\Windows\System\zgDZuIs.exe
  2⤵
  PID:10612
- C:\Windows\System\HXqIzLT.exe
  C:\Windows\System\HXqIzLT.exe
  2⤵
  PID:10628
- C:\Windows\System\iOogplJ.exe
  C:\Windows\System\iOogplJ.exe
  2⤵
  PID:10644
- C:\Windows\System\AwClACL.exe
  C:\Windows\System\AwClACL.exe
  2⤵
  PID:10660
- C:\Windows\System\KYdbRTw.exe
  C:\Windows\System\KYdbRTw.exe
  2⤵
  PID:10680
- C:\Windows\System\BZbQPIQ.exe
  C:\Windows\System\BZbQPIQ.exe
  2⤵
  PID:10696
- C:\Windows\System\YuQGFMT.exe
  C:\Windows\System\YuQGFMT.exe
  2⤵
  PID:10712
- C:\Windows\System\OTvRcfe.exe
  C:\Windows\System\OTvRcfe.exe
  2⤵
  PID:10728
- C:\Windows\System\VofCTeK.exe
  C:\Windows\System\VofCTeK.exe
  2⤵
  PID:10744
- C:\Windows\System\CLYBpqO.exe
  C:\Windows\System\CLYBpqO.exe
  2⤵
  PID:10760
- C:\Windows\System\dKRgvsy.exe
  C:\Windows\System\dKRgvsy.exe
  2⤵
  PID:10776
- C:\Windows\System\LlMfGrv.exe
  C:\Windows\System\LlMfGrv.exe
  2⤵
  PID:10792
- C:\Windows\System\FmHVqtx.exe
  C:\Windows\System\FmHVqtx.exe
  2⤵
  PID:10808
- C:\Windows\System\CGMXrnO.exe
  C:\Windows\System\CGMXrnO.exe
  2⤵
  PID:10824
- C:\Windows\System\jmatlJs.exe
  C:\Windows\System\jmatlJs.exe
  2⤵
  PID:10840

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\BlljsWL.exe

Filesize
2.9MB

MD5
2843d8eed6e103a8a620d2f786cb2f83

SHA1
18307720bd8ae1ccaa10264e0e090a86ca9dbd56

SHA256
6ea7c51ce7912c220031dc33e30df9fad8008d1a8b7a6d6bda6020cee987645b

SHA512
d05374016ed7eaa6072e1200b9eb20fe10eab78ac914fd8dc75927f8872e4fcc63a8d3267d22caf25489863ef8c48fdfed11d1bb3096ab402f419406e417e390

Download Submit
C:\Windows\system\CBaSGKv.exe

Filesize
2.9MB

MD5
a4f55a71fdb2a6fa5f24a5fc2b4c5b91

SHA1
2eca72d3d35da81b369774ba4be3b8bc3362145c

SHA256
26010781d4e30b98845fa545e1707170771080cceb0a5aeebfe4d1d0b9bc59a1

SHA512
d586fe83e5dd4b7fe87150888f0c26917b33c64d8eaa762279df694dbcd0314314ede83710f9611c21d7c1e8dbbe3c0da94ebaf1bf49260b0d02c9651f8ee16b

Download Submit
C:\Windows\system\HHsrHVR.exe

Filesize
2.9MB

MD5
a107d52c75fe256653a31a9a8bbf0ef1

SHA1
613afa37785d879a14790c954eba1c5af6f2cb52

SHA256
5f4f218f9f992644ea67d29df2e3eb7064511dda913c7265f1a8fb2f81510bfd

SHA512
a760cc2d547c6fe1e1b57bde0969b985e7f2dec38fe683ffc4b1e1e7b7a211bc1c6cd4932b4d1aa1d8d9de8fd154867f80c7e65e8110779da485aa9f4f1845db

Download Submit
C:\Windows\system\IFNsZWT.exe

Filesize
2.9MB

MD5
91e00e06b52ec5422574a14bd589ec93

SHA1
b93f455155732c757e063cc5d6de955d24654303

SHA256
f89fae6cdfa19a8a5f86c4f4d6ef33e62d88d4cb1e9c0ac4ea3d422a429462e3

SHA512
e69bc8d9ccfc22e00526dbeae64f36b4280023bfa78abb8d8a7843de19bb9a4c4cf7fec58c86d95836cb1da6e9d596c5d3898826154ce441259e58c1de9dfa66

Download Submit
C:\Windows\system\KUiiTWj.exe

Filesize
2.9MB

MD5
09d611c7d3567105bb380b95c9686c14

SHA1
80afc3fb5afe73da4567c7d036f33babddcb4a4a

SHA256
9676df639c38499294afaef31ce9444fe260312a1ed4c61f4f09a220b71b19df

SHA512
cc6b7f80e3d9137ee6a66e2325a3a48a02f35b5a199b229aa5be406669e86875c70da10f8b374f7e926767a878c986db86618a4205c3f8dc9f90e7e82a7ba594

Download Submit
C:\Windows\system\McifMXT.exe

Filesize
2.9MB

MD5
035c378eb5667da2a42b80ece297fcff

SHA1
d0a001e499a9e96a904c3b175bcc22bb5716518b

SHA256
7fc6fd844166fdfb4707e7bb565e1ae0ce591d9bdff0ec5080c1fd5e401d86b5

SHA512
7ae05659bdb06d1bf41dde4a73b8ec3f706ecd17d1ab4fc599c877234467a787637bcce7185f81316a830ed616c62729d4b0b58f802b9a867070cd1448341628

Download Submit
C:\Windows\system\OIoyaXf.exe

Filesize
2.9MB

MD5
9e5f09cae49aa1e3368aa8c02d422553

SHA1
33cca7d661b4803dbeece063ca088705035075f8

SHA256
a5d1e47b9f1fddd13f74bf4e81b5fdc9b584ad6bf7a5e03fba27d66a63ca26a6

SHA512
9f52e15f94edfd97ab6f73304414abec8998e886fdd6a4c11dc8cc9a2ce124c62d5960994909ee62ce21787a6b2e5ecbbd1de6ab5f6d30331965b2dd9bf427d3

Download Submit
C:\Windows\system\OUQOJGM.exe

Filesize
2.9MB

MD5
3f122e3e217734d651450f418fc433de

SHA1
a0c848e2ffa818649d13bca9a971ffa6999b5aea

SHA256
2077e76a9a17bcd29ea9ab672a48eef595b7b483865ef047f48589b949efaf5e

SHA512
8ac9487054c8189ef85cb66cfeb779f5dc99357d38144fca74d8bdf5d0257b28ec07f68851c0394d588258b8cb6411a6c4cd2bc982df618c7075f32f7b912b66

Download Submit
C:\Windows\system\QNycfbS.exe

Filesize
2.9MB

MD5
80b7a2d5679d788d5a6f1806a7c425b3

SHA1
ac6e67a2631cae64aa442051c2b237f5e3209b9a

SHA256
f7f3a35a33937fe3e15a0a0546908aab959894e1c684baa3152af31e986a3fb6

SHA512
c31244d231e33f9c9383ef60067ec3de3c3418d05a9f83c10f36dfd2585165db225350cc9c37616859a97b952eb4cb9bb7f87c30e6e13d8773c9ff53822fed0e

Download Submit
C:\Windows\system\QySnFzU.exe

Filesize
2.9MB

MD5
b11057d4ca0b4e417a72f1019db2ae1d

SHA1
a78039fcdf69963b9aaf10ba164e308adde2caa3

SHA256
9ef8353d52c5c27e16a732eb43ac21cddf5534b7e5566e5b5ffbfa530d0baca5

SHA512
079899d5bf5722dd6347d3c077e674bdeac9e211af391601c2e6674e9bb28906761ad2db60bd36e1aeb29a8ad904236e48d9cc99df1192d89cab3919494f26c0

Download Submit
C:\Windows\system\RVnucNg.exe

Filesize
2.9MB

MD5
32744fcd2cd2261e555cc631a7893b55

SHA1
4eacf4b30750caa6ab02541e1c9a852d1ad0d42b

SHA256
989ce4cf1c699649ba715aaf7c100e9ec060653734b5135fabcee1dea0f827eb

SHA512
ddaa2110b6505b7f25b967b706642352689c6f90323374b266e645a123e79c5ec3e81b646bba0af476c4aee8faf779cc124c48352370aea988b1e94b3603a661

Download Submit
C:\Windows\system\RmwQBWY.exe

Filesize
2.9MB

MD5
a1acbd9719403a1b4eb130501b9f67ad

SHA1
9fa9594bad506471c861276744f7f5ba30a3cd46

SHA256
73031766a4c8b928798de4b3204a240468f2e14610596557ad6a4f81002e1953

SHA512
10a9bb92f49496c64f90371dfbfd6950e8d7e6771858a85790c07b0ffdb23fe77724fc016c84b01934041f70c1db9f25bf966a62e2ac4dc5f5e8840676a5036b

Download Submit
C:\Windows\system\TOGJxSb.exe

Filesize
2.9MB

MD5
ce6aceceb70b0e40c265baafefd9ded2

SHA1
6a19011888a289b2f815534d9b7654dd685aaf42

SHA256
92f1700460ba6a684484c6a41d97e7baf2620db698d43f8b54126489e9e73e05

SHA512
2eaf6edd57f1a6ad47a85ebc5eaa35e43c3d8a7cf69ed166005094c58fcb9edbddde0085adfd99db867ecf2d42675151bd7b0d034476f52eb8b21378ba6ce9d8

Download Submit
C:\Windows\system\UQOQGTu.exe

Filesize
2.9MB

MD5
ec489d0c98f3084af26668403e679866

SHA1
672ff3257694333bfcce0c34d095d638e1c533ab

SHA256
b793b3c595a70e4cc9f5c83c008a3af45429558719386449717a16b907ba07c1

SHA512
78ea064725a8f74b7db82f89228e14abb1306ecd66a56a825a0f900a3f83857cbab12acb32c2b914e3597f624579f262647c1346769e093757d7883dcb2e901d

Download Submit
C:\Windows\system\ZrqNgTn.exe

Filesize
2.9MB

MD5
23cc041144e59e5b638fd3c705ed88e7

SHA1
278e486ad45db2a4ba3b4ea48916cc304c593d8c

SHA256
d1a4b5a30a1c9c5169bbca41f1eb3643210ea7fe38262c2ab609ac3711384b63

SHA512
bd28faa68f8a6250915a5ca4b3e22800ea85b80c2f564e079411cf3dc56c4461e9932d7d8b1ba2e7d881578e1c7564ceabeadd595f8d228663a47dc71fdbf084

Download Submit
C:\Windows\system\bvhpSUN.exe

Filesize
2.9MB

MD5
9a24657721943e77d40e44425c8148cd

SHA1
1eb5052132881d97f298827229a7a71d24004a1d

SHA256
6d606b80560c64b6c187e610b6172c8119a1a97bf02cc9e3997571b137b2c548

SHA512
a0dce46bd8bc47eca80c8bceec30ec65fedcd9db12b63df26752a728dc526e658582ed3c8cdc7fd561cca3ff40e21942edc26f6e04fec10e0a3a92442a201e39

Download Submit
C:\Windows\system\cSYJPbD.exe

Filesize
2.9MB

MD5
e90e85359fc9c4c62392a5881e648a11

SHA1
96e472b6c471e115fcf8e24256b89d4546d048be

SHA256
5b3f33be9024700452bd111ab5cb7b38930b1b39a6b91a84cfc32a801b8be70f

SHA512
f646374d9b6e2e9bc18daa16edfb39b03fe6ef3d52129d00d9c48d1e52ed1c6759d8703456434dcd41d892d4e0a7bf6e8395c33f892bfc89f0edd605cda5f72f

Download Submit
C:\Windows\system\eYozcqh.exe

Filesize
2.9MB

MD5
0d3e078e4882306cce984afddbb3dfb2

SHA1
33d328acfa98c94e11cad72a84c2417dfee2bca9

SHA256
240293a0c64822e1df379729b7e41e4c4a6ad8a769cf026ed45229b37da2d5bd

SHA512
b75eb558b66fc3373df3b992099e1b4e1b6cc45b3b110709394df07037dbcdfcc7d8284a6880c067493156669d376c7ffc3f2c22dd6c971b74a4dea823c9cfb6

Download Submit
C:\Windows\system\hpzpEIP.exe

Filesize
2.9MB

MD5
212da19b6ae398c627862eace155b1ef

SHA1
a5287d30ed6133b7bc1ff2adc164f48ee802c6c6

SHA256
fd90937d3ca47f3662a09d93f2069cf1b9b05bf536ecc7d83eed4b268632d10f

SHA512
f3a728b7fe2433df5f37157a2a823be6bfd0ab788550cb7d845c3dc530389214c983ca2963270491f019bf8ad0698660eb8ae821b337313689c38a7cdec0ab0c

Download Submit
C:\Windows\system\kPMcZQE.exe

Filesize
2.9MB

MD5
dfbd03e96fca9663ea188c7f7f5c6b51

SHA1
5d239fab551280312aafa21fa6406052fbea71d4

SHA256
9a265590477725df8b32f17eb37e2dfd2e09b096c6b63c2e72fe0dd0a3fe20ba

SHA512
a63bfb28908cc9be797e251f341c4fcbc450555f02922cee4228e87c16a30f98fb54b62674e39d5f9a83468c7b4ef71b8e5cf370fe95f6d6bdb0facf8b0d395c

Download Submit
C:\Windows\system\kZFKwuk.exe

Filesize
2.9MB

MD5
e4e11a5def6e27debdd87956458d0ba6

SHA1
0b9f37257c6cd0767abd39f117ea235376831bb5

SHA256
ae2fd14e190a5d42390518836a6a3a5c8266a7a3a7982820c32cf8baf1cd3751

SHA512
4dbc49359cec04d3f3f026c774fe854a7aad86c205170cb11b54063431c9c2958495502f6cbeb7e30a592c32b9037bf281a7fc87f7bbd7969904f940311d9c80

Download Submit
C:\Windows\system\qJanJwx.exe

Filesize
2.9MB

MD5
3e7ec283505840d39099e930e3a473e7

SHA1
94e711a61c7ce9b57ec98cbb440a4131b8f7199b

SHA256
cfcdc174bb1367e321760e05394ede4e54e81b5826d550ae3640b439e4fc3199

SHA512
4a6c96d21cdd72ac7f551e3368a7a427972a0e1a28f4be0a75d0d92ae4bcfe531c3aa8bf85f3a82c5a2909b4943005cd38806d8a9fc49ad3d8f3ca333ff7909e

Download Submit
C:\Windows\system\xGeDYca.exe

Filesize
2.9MB

MD5
370dc1c36bc51089c31cdf4f81d09fae

SHA1
cd4dd07d964d1f46da21a673ecbb51c81de8feae

SHA256
47b5f1ec7f8c0348657f35f9583a7fe0837037e3431ba634ee6030229ae4c4b1

SHA512
e4c306fbccb1ec16403d00966eb23af20e21dc5b2e12e6c0d38b8c84e0681488e4f009deb7a65a4f8067358cfd2d68d71e75a78d7570618df09c4ddb0a902d1e

Download Submit
C:\Windows\system\yrNdiDU.exe

Filesize
2.9MB

MD5
b41b22277dff8d35f2890f74f64ef75d

SHA1
ed0839fdd015fa3bd861a59a740e92f7a22655ea

SHA256
e84d2635091d96487eeba4ab397fbd6ecf0b2b2676c8079f414857fd39b829eb

SHA512
b5286efe7d9b5333b04897432d70504207baf58237e0707b9bd8b056a7b40f54a9fb4c6832ce3d7aad4d6e32d6229261e7257034a7044754bdeca65a0d9ba65f

Download Submit
\Windows\system\BEEMYYF.exe

Filesize
2.9MB

MD5
b8648113b3d13568e315b9e95f03379d

SHA1
8ee3e9d67099aa809b3d6fac66d0f37a4df16891

SHA256
24b1b07b490c9cfb7eb26d3d09453eb946054c300fe1bfce64f3ae7fd1920601

SHA512
aee77102b4629ff7d8efbe52af585ba427e7caf0a4a1ef7b23d54ad601fbc913312f3ea352544c001ac39c04d6b3512dd41e6d0f4c5f571bafc1cce4e215e324

Download Submit
\Windows\system\FJnoKaA.exe

Filesize
2.9MB

MD5
c9d94a673849f948c153c3cb7266da46

SHA1
9def12fe1f1825132a072342b81040109f0aa476

SHA256
6aee521b0b898ab6614e9d3a76498eeea4f16e4a9fde82abcd6b4d13fff28ae2

SHA512
813c24a7b4ef5d63b60b3e0b9bfa3384a60d9382e861da6777982c1b56a133783c41f986d3e26dd54453493a56b233201cb11b07477128ad3204222a43fc5d36

Download Submit
\Windows\system\OgmuBmd.exe

Filesize
2.9MB

MD5
47ed6a45ecb1013b7f145a6761ca1cc8

SHA1
aa8fbfe185477ab403be81a6d4449d00f9e49d76

SHA256
8cf55ba7075134e9d9891e2db1fbfc157314fcd8169ab4864de6c1832670fb06

SHA512
30ef3885b9a3e6af4270cdb3bbf43fb1225c407f34cbab025d2b5fcf9dd9e378fab8977ca81bc4aa60430b08857fef81b1435122f098a7a325a493ed8847ccee

Download Submit
\Windows\system\SdZzFRR.exe

Filesize
2.9MB

MD5
897e41a35903de082c68a4cab4cb6090

SHA1
59074341ca5cc188e196361c491c146699fd49c7

SHA256
a1cd35f7149b161284dba2c05aa570b1c1029beb3c041a4b4c6dec14aaa42b1b

SHA512
2831db66320d9bcc43bf1feb5cf53e9877bf01bc228332b8571a7318e9d56781bf03170165327c4bb57cb2bbee79d0f367c441eb36837a3813ca36a469f02fe7

Download Submit
\Windows\system\SogkyER.exe

Filesize
2.9MB

MD5
38b426834f9600229c8d226c8f43b463

SHA1
0507dcceb4ac56d589d54e997a3bcb8662bdae0d

SHA256
266e752d5d8808880717ecc0a1afa1a902efcf6160a0a5b2d883b066343ca506

SHA512
af07f3cf2ce510bdfb26dab6354a9d613a09857d476ee271d963db1fe239a1f15566bbb22ecbf58234d1c2eb1677ca5b36eb18c54b03df3e0afcad16b43ce24d

Download Submit
\Windows\system\dViXFYA.exe

Filesize
2.9MB

MD5
0a9514ae177467fdf3db0405167a8dfa

SHA1
f63c735f3e9d291b7e0b1aebde1c3bcf87569190

SHA256
811073578f1a303ca049641cca3fa6f4f984c5e8691622d12a876bbb2365585e

SHA512
2b5f9e2a78e74b44cf7a79851e4eb8d00ad0d6b6bee77f90e43ac1f1cff11a1b7df1ddcd1d2de6fd581c55136c29ecd319f3220c31b41a400ebf7757c1ba4ccf

Download Submit
\Windows\system\fDPhkUn.exe

Filesize
2.9MB

MD5
d7cc3679523c3cb3ba2aa6179effc0d3

SHA1
7af5ea6fde7c76d19ed2b7067f0095d087c2faec

SHA256
d0ad81d6a96a72f98b4f55b244df46dbd65978cb060613a313d77611be595d7b

SHA512
2303e5953395a3d374c6aa273a4e1fd219bad423f2fe4d5243de0c93effc5cd4519fbe44d928e55fa9e557c9139b701dfda375abb557da8b4759fab313d5ae4f

Download Submit
\Windows\system\jCLZYJO.exe

Filesize
2.9MB

MD5
949da5076cec667614438ff7dc4b5f07

SHA1
56771bc8825632d6d140b4d2deec7dba51adf634

SHA256
6dd3c0e1967d7a43caf0356afadd9d01c2eef64f5309adb35487fb8e8bf37d84

SHA512
bbf23ddf2efe8fbebd9518bb3b4fb8dca77a0c6a5a5548e0ca904eb66f3e48880a5aa801f4ea7abb3d2bc210be88e9436b1c1a52a23b5abb0cd0e4079a617f09

Download Submit
\Windows\system\jYTbxXe.exe

Filesize
2.9MB

MD5
36328de6dbbbef29f7c6b4b6d9935ffb

SHA1
6f32f950d38f187da2070390b0b0402deb3443b4

SHA256
971abc6b93a87b3432bdf74cf772ac67e77641c701f84952150ee6fe9fdf602a

SHA512
68f9f0a0260edbceb4cd2fa14b25d0cce9a9c7344046ede56774a0228a0fd3e401ad6947a855337d7a2e83b8cfb1be9c83ccf947455510769c1a105b853a273b

Download Submit
\Windows\system\kHTFEWW.exe

Filesize
2.9MB

MD5
93c3afc37f3714f7773a8140e4057600

SHA1
b3319a58b4b13fedfccde3a5bc1c7a3140fe019e

SHA256
8b2448ffb19e7c654d4217a5f6e57e7b342230975f072113b91eb62ea27e189f

SHA512
faa97d4d3c736c4f6202937826d9c5ab23de1baad0e3f83911b812c89b25afa8aa53d48e5f58b5bd5ed4aa186edfed86b72b774b554107a078b8c9796e0679c8

Download Submit
\Windows\system\lmGMlMd.exe

Filesize
2.9MB

MD5
67df4b2824acd8577f54586639a494d6

SHA1
4bf8e4be04d04191514a06d9ca4cfd00066a5951

SHA256
afac23f173a240b86884380c26b2c7da3c3abd29cffa096342b5ef9ed80754d0

SHA512
b74eba6a726fb7a56f52ccc93250f047268938c232824e5e01f2fadae0b20ee28b2f949d1091b05611ac2ff706206d5c1b68797ba037689933d0fb6d73f93219

Download Submit
\Windows\system\ovpCliE.exe

Filesize
2.9MB

MD5
1d018a80ac9640e41776b6579c9fcf93

SHA1
6e93a0a7d0fd2153c30f83055e5cf9cb55fe1aff

SHA256
9083e719950972ac1819ba5573cb827d6f4fda5a4611bf01cb7b8388d137fc96

SHA512
e05c9b2ab86713424a5b01bed1c8d5599f05d81562d888eea095640ac6105f38e4712c27fc613433c7023901a116dd3ed582e2957821e87904169b23db444faf

Download Submit
\Windows\system\puBkMzT.exe

Filesize
2.9MB

MD5
4287c56fdd6932be95a0512a28c93d8f

SHA1
c2b3978af47b908f995f599a31eb21e2cbea6cae

SHA256
11d4385feebb73ca128cc4fee208e41e777e3521d5573594b2fcc776c41d70b0

SHA512
5ae0745e00193d25004c02d256e051b822698eb4633fbec4d55bc4632f3ef08dd2e48dec757fffac54dc26dca3a09ad14e136ec4cda95c2e86709b6cdb311ae4

Download Submit
\Windows\system\zDJfsin.exe

Filesize
2.9MB

MD5
6f38bf172552c3a4b4675865fbbf10b1

SHA1
44dfd1546c7d31a91686e2e23f21208b1f50bc47

SHA256
23cb675250fb271bb03bc3741eb000a152a81668f646926204d7a8951ae888f4

SHA512
6424553588cbed5f4b579a59d10558b41b13a831edddfa21cb23d2b2fd9da3590a04f637041820fd0ca1caf6eecf1bbb79d0538e2ba5cdbace2c93ee4abf7776

Download Submit
\Windows\system\zrVzUiZ.exe

Filesize
2.9MB

MD5
b4a005ea2eeb1bae7ee4fa26a2bf868f

SHA1
61248c973fb7bbd294290bb94d17225da7ad46ab

SHA256
4f4a34f0dc472fa02e47032f3513390fe290d84eb9bfc0614f1ae7fef6a21324

SHA512
3f1f98544be4a8950b29f26a68d7047b14616a1f25f47bd6cfe56c4f815a37cf36108d8516cc7e53e816b9d600139d088a3a975527364189ea0dd5baa0f69265

Download Submit
memory/1052-69-0x0000000002340000-0x0000000002348000-memory.dmp

Filesize
32KB

Download
memory/1052-106-0x000007FEF55B0000-0x000007FEF5F4D000-memory.dmp

Filesize
9.6MB

Download
memory/1052-133-0x000007FEF55B0000-0x000007FEF5F4D000-memory.dmp

Filesize
9.6MB

Download
memory/1052-579-0x000007FEF55B0000-0x000007FEF5F4D000-memory.dmp

Filesize
9.6MB

Download
memory/1052-65-0x000000001B7A0000-0x000000001BA82000-memory.dmp

Filesize
2.9MB

Download
memory/1052-22-0x0000000002E70000-0x0000000002EF0000-memory.dmp

Filesize
512KB

Download
memory/1052-23-0x000007FEF586E000-0x000007FEF586F000-memory.dmp

Filesize
4KB

Download
memory/1052-125-0x000007FEF55B0000-0x000007FEF5F4D000-memory.dmp

Filesize
9.6MB

Download
memory/1232-110-0x000000013FED0000-0x00000001402C6000-memory.dmp

Filesize
4.0MB

Download
memory/1232-6015-0x000000013FED0000-0x00000001402C6000-memory.dmp

Filesize
4.0MB

Download
memory/1844-113-0x000000013F950000-0x000000013FD46000-memory.dmp

Filesize
4.0MB

Download
memory/1844-6010-0x0000000003080000-0x0000000003476000-memory.dmp

Filesize
4.0MB

Download
memory/1844-109-0x000000013FED0000-0x00000001402C6000-memory.dmp

Filesize
4.0MB

Download
memory/1844-6029-0x0000000003530000-0x0000000003926000-memory.dmp

Filesize
4.0MB

Download
memory/1844-4355-0x0000000003080000-0x0000000003476000-memory.dmp

Filesize
4.0MB

Download
memory/1844-0-0x00000000000F0000-0x0000000000100000-memory.dmp

Filesize
64KB

Download
memory/1844-135-0x000000013F0B0000-0x000000013F4A6000-memory.dmp

Filesize
4.0MB

Download
memory/1844-1-0x000000013F500000-0x000000013F8F6000-memory.dmp

Filesize
4.0MB

Download
memory/1844-115-0x000000013F070000-0x000000013F466000-memory.dmp

Filesize
4.0MB

Download
memory/1844-8-0x0000000003080000-0x0000000003476000-memory.dmp

Filesize
4.0MB

Download
memory/1844-111-0x000000013FB90000-0x000000013FF86000-memory.dmp

Filesize
4.0MB

Download
memory/1844-127-0x000000013FC20000-0x0000000140016000-memory.dmp

Filesize
4.0MB

Download
memory/1844-26-0x000000013FD10000-0x0000000140106000-memory.dmp

Filesize
4.0MB

Download
memory/1844-120-0x0000000003530000-0x0000000003926000-memory.dmp

Filesize
4.0MB

Download
memory/1844-124-0x0000000003530000-0x0000000003926000-memory.dmp

Filesize
4.0MB

Download
memory/1844-122-0x0000000003530000-0x0000000003926000-memory.dmp

Filesize
4.0MB

Download
memory/1944-126-0x000000013F4A0000-0x000000013F896000-memory.dmp

Filesize
4.0MB

Download
memory/1944-6030-0x000000013F4A0000-0x000000013F896000-memory.dmp

Filesize
4.0MB

Download
memory/2060-123-0x000000013F4E0000-0x000000013F8D6000-memory.dmp

Filesize
4.0MB

Download
memory/2060-6019-0x000000013F4E0000-0x000000013F8D6000-memory.dmp

Filesize
4.0MB

Download
memory/2128-6033-0x000000013FC20000-0x0000000140016000-memory.dmp

Filesize
4.0MB

Download
memory/2128-132-0x000000013FC20000-0x0000000140016000-memory.dmp

Filesize
4.0MB

Download
memory/2128-6478-0x000000013FC20000-0x0000000140016000-memory.dmp

Filesize
4.0MB

Download
memory/2156-9-0x000000013F5D0000-0x000000013F9C6000-memory.dmp

Filesize
4.0MB

Download
memory/2156-5883-0x000000013F5D0000-0x000000013F9C6000-memory.dmp

Filesize
4.0MB

Download
memory/2516-6014-0x000000013F950000-0x000000013FD46000-memory.dmp

Filesize
4.0MB

Download
memory/2516-114-0x000000013F950000-0x000000013FD46000-memory.dmp

Filesize
4.0MB

Download
memory/2576-119-0x000000013F070000-0x000000013F466000-memory.dmp

Filesize
4.0MB

Download
memory/2576-6016-0x000000013F070000-0x000000013F466000-memory.dmp

Filesize
4.0MB

Download
memory/2636-134-0x000000013FD10000-0x0000000140106000-memory.dmp

Filesize
4.0MB

Download
memory/2676-112-0x000000013FB90000-0x000000013FF86000-memory.dmp

Filesize
4.0MB

Download
memory/2692-6013-0x000000013F0B0000-0x000000013F4A6000-memory.dmp

Filesize
4.0MB

Download
memory/2692-108-0x000000013F0B0000-0x000000013F4A6000-memory.dmp

Filesize
4.0MB

Download
memory/2720-5965-0x000000013F8C0000-0x000000013FCB6000-memory.dmp

Filesize
4.0MB

Download
memory/2720-5514-0x000000013F8C0000-0x000000013FCB6000-memory.dmp

Filesize
4.0MB

Download
memory/2720-21-0x000000013F8C0000-0x000000013FCB6000-memory.dmp

Filesize
4.0MB

Download
memory/3060-6017-0x000000013F760000-0x000000013FB56000-memory.dmp

Filesize
4.0MB

Download
memory/3060-121-0x000000013F760000-0x000000013FB56000-memory.dmp

Filesize
4.0MB

Download