xmrig | 41f2d59470d3bc6cc42ab12e58444554b00e450db4180f6a29cfcc2cecf94129

Analysis

max time kernel
147s
max time network
152s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
28/05/2024, 12:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

431a817a43658d7123aab89b6febea90_NeikiAnalytics.exe
Size

1.3MB
MD5

431a817a43658d7123aab89b6febea90
SHA1

a1ba7c1d1442d803f79e2f34814f910bb3a457d4
SHA256

41f2d59470d3bc6cc42ab12e58444554b00e450db4180f6a29cfcc2cecf94129
SHA512

f3d9dd356773ff775c534e38de00a6763d68e5eeb99c2d3837190bd71417bb5267a4ed18a7d804b790cc406152fe02fc1605f0d4112e9cc2df267476fa2edea4
SSDEEP

24576:zv3/fTLF671TilQFG4P5PMkyW1HU/ek5Qk7SW4hIQ37iWLs2Yuzff9TS:Lz071uv4BPMkyW10/wKe6Ww5WdTS

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 23 IoCs

miner

resource	yara_rule
behavioral1/memory/2884-9-0x000000013F140000-0x000000013F532000-memory.dmp	xmrig
behavioral1/memory/2416-99-0x000000013F580000-0x000000013F972000-memory.dmp	xmrig
behavioral1/memory/2392-86-0x000000013FCA0000-0x0000000140092000-memory.dmp	xmrig
behavioral1/memory/2860-84-0x000000013FD80000-0x0000000140172000-memory.dmp	xmrig
behavioral1/memory/2548-82-0x000000013FE80000-0x0000000140272000-memory.dmp	xmrig
behavioral1/memory/2552-80-0x000000013F470000-0x000000013F862000-memory.dmp	xmrig
behavioral1/memory/1664-111-0x000000013F700000-0x000000013FAF2000-memory.dmp	xmrig
behavioral1/memory/572-110-0x000000013FAC0000-0x000000013FEB2000-memory.dmp	xmrig
behavioral1/memory/112-108-0x000000013F450000-0x000000013F842000-memory.dmp	xmrig
behavioral1/memory/1572-105-0x000000013F6C0000-0x000000013FAB2000-memory.dmp	xmrig
behavioral1/memory/2448-91-0x000000013F400000-0x000000013F7F2000-memory.dmp	xmrig
behavioral1/memory/2416-1874-0x000000013F580000-0x000000013F972000-memory.dmp	xmrig
behavioral1/memory/2532-2402-0x000000013F470000-0x000000013F862000-memory.dmp	xmrig
behavioral1/memory/2884-2403-0x000000013F140000-0x000000013F532000-memory.dmp	xmrig
behavioral1/memory/2552-2410-0x000000013F470000-0x000000013F862000-memory.dmp	xmrig
behavioral1/memory/1664-2412-0x000000013F700000-0x000000013FAF2000-memory.dmp	xmrig
behavioral1/memory/2548-2411-0x000000013FE80000-0x0000000140272000-memory.dmp	xmrig
behavioral1/memory/2448-2409-0x000000013F400000-0x000000013F7F2000-memory.dmp	xmrig
behavioral1/memory/1572-2408-0x000000013F6C0000-0x000000013FAB2000-memory.dmp	xmrig
behavioral1/memory/572-2407-0x000000013FAC0000-0x000000013FEB2000-memory.dmp	xmrig
behavioral1/memory/2392-2406-0x000000013FCA0000-0x0000000140092000-memory.dmp	xmrig
behavioral1/memory/2860-2405-0x000000013FD80000-0x0000000140172000-memory.dmp	xmrig
behavioral1/memory/112-2404-0x000000013F450000-0x000000013F842000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
2068	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
2884	oZrUGag.exe
2532	PQwjRCt.exe
2552	ahjJkqN.exe
2548	EORQroO.exe
2860	CLNYrwl.exe
2392	syKwHwl.exe
2448	FFrSRfP.exe
2416	ktcTcEQ.exe
1572	jJHHpZv.exe
112	Vcxypqj.exe
572	VzNcLIN.exe
1664	EpBnLnb.exe
764	kQbxYOf.exe
908	ZdUnuto.exe
2444	mGCVTJD.exe
1612	jfGWkwk.exe
2672	vQsjyZr.exe
2296	oXLpWLi.exe
1712	zuReTGk.exe
2620	Dlejsue.exe
2272	hGnBPdZ.exe
1568	KQUyWeg.exe
1292	IZlaknb.exe
1236	pINSOQC.exe
2708	fOXWPGc.exe
2568	jSIljWS.exe
476	mNEJQff.exe
2228	aXNzIKB.exe
1084	BaNPwuK.exe
1896	UbTDEul.exe
1904	OeUEnsS.exe
1112	QESnCnk.exe
704	UDBMCcn.exe
1460	LkQbasx.exe
1332	kvtGBsz.exe
1140	aMnVJNw.exe
1820	tdxJNuB.exe
1232	JObmtcR.exe
1736	RDOcCdm.exe
912	GbPIzkh.exe
1976	FRCNCLp.exe
872	ywpCYgY.exe
1464	svojdzW.exe
1396	peCEOFU.exe
1980	BKqfsjz.exe
1632	XmPNjUi.exe
312	UIEGYtx.exe
576	zbCvkKk.exe
2268	jmhPzGf.exe
1692	YvWCzlU.exe
2136	vpPtyVx.exe
2960	aoTdoMh.exe
1484	eIYnLat.exe
1520	PsSIYpk.exe
2576	qMhIAqs.exe
2752	nKPRCTB.exe
2572	emwdZKW.exe
2864	anHEAsi.exe
2440	YAFomyF.exe
108	HwpTcut.exe
2352	uXPSALH.exe
1760	nWnxPhn.exe
288	LWqHgxl.exe
2988	nQbmqHy.exe

Loads dropped DLL 64 IoCs

pid	Process
2740	431a817a43658d7123aab89b6febea90_NeikiAnalytics.exe
2740	431a817a43658d7123aab89b6febea90_NeikiAnalytics.exe
2740	431a817a43658d7123aab89b6febea90_NeikiAnalytics.exe
2740	431a817a43658d7123aab89b6febea90_NeikiAnalytics.exe
2740	431a817a43658d7123aab89b6febea90_NeikiAnalytics.exe
2740	431a817a43658d7123aab89b6febea90_NeikiAnalytics.exe
2740	431a817a43658d7123aab89b6febea90_NeikiAnalytics.exe
2740	431a817a43658d7123aab89b6febea90_NeikiAnalytics.exe
2740	431a817a43658d7123aab89b6febea90_NeikiAnalytics.exe
2740	431a817a43658d7123aab89b6febea90_NeikiAnalytics.exe
2740	431a817a43658d7123aab89b6febea90_NeikiAnalytics.exe
2740	431a817a43658d7123aab89b6febea90_NeikiAnalytics.exe
2740	431a817a43658d7123aab89b6febea90_NeikiAnalytics.exe
2740	431a817a43658d7123aab89b6febea90_NeikiAnalytics.exe
2740	431a817a43658d7123aab89b6febea90_NeikiAnalytics.exe
2740	431a817a43658d7123aab89b6febea90_NeikiAnalytics.exe
2740	431a817a43658d7123aab89b6febea90_NeikiAnalytics.exe
2740	431a817a43658d7123aab89b6febea90_NeikiAnalytics.exe
2740	431a817a43658d7123aab89b6febea90_NeikiAnalytics.exe
2740	431a817a43658d7123aab89b6febea90_NeikiAnalytics.exe
2740	431a817a43658d7123aab89b6febea90_NeikiAnalytics.exe
2740	431a817a43658d7123aab89b6febea90_NeikiAnalytics.exe
2740	431a817a43658d7123aab89b6febea90_NeikiAnalytics.exe
2740	431a817a43658d7123aab89b6febea90_NeikiAnalytics.exe
2740	431a817a43658d7123aab89b6febea90_NeikiAnalytics.exe
2740	431a817a43658d7123aab89b6febea90_NeikiAnalytics.exe
2740	431a817a43658d7123aab89b6febea90_NeikiAnalytics.exe
2740	431a817a43658d7123aab89b6febea90_NeikiAnalytics.exe
2740	431a817a43658d7123aab89b6febea90_NeikiAnalytics.exe
2740	431a817a43658d7123aab89b6febea90_NeikiAnalytics.exe
2740	431a817a43658d7123aab89b6febea90_NeikiAnalytics.exe
2740	431a817a43658d7123aab89b6febea90_NeikiAnalytics.exe
2740	431a817a43658d7123aab89b6febea90_NeikiAnalytics.exe
2740	431a817a43658d7123aab89b6febea90_NeikiAnalytics.exe
2740	431a817a43658d7123aab89b6febea90_NeikiAnalytics.exe
2740	431a817a43658d7123aab89b6febea90_NeikiAnalytics.exe
2740	431a817a43658d7123aab89b6febea90_NeikiAnalytics.exe
2740	431a817a43658d7123aab89b6febea90_NeikiAnalytics.exe
2740	431a817a43658d7123aab89b6febea90_NeikiAnalytics.exe
2740	431a817a43658d7123aab89b6febea90_NeikiAnalytics.exe
2740	431a817a43658d7123aab89b6febea90_NeikiAnalytics.exe
2740	431a817a43658d7123aab89b6febea90_NeikiAnalytics.exe
2740	431a817a43658d7123aab89b6febea90_NeikiAnalytics.exe
2740	431a817a43658d7123aab89b6febea90_NeikiAnalytics.exe
2740	431a817a43658d7123aab89b6febea90_NeikiAnalytics.exe
2740	431a817a43658d7123aab89b6febea90_NeikiAnalytics.exe
2740	431a817a43658d7123aab89b6febea90_NeikiAnalytics.exe
2740	431a817a43658d7123aab89b6febea90_NeikiAnalytics.exe
2740	431a817a43658d7123aab89b6febea90_NeikiAnalytics.exe
2740	431a817a43658d7123aab89b6febea90_NeikiAnalytics.exe
2740	431a817a43658d7123aab89b6febea90_NeikiAnalytics.exe
2740	431a817a43658d7123aab89b6febea90_NeikiAnalytics.exe
2740	431a817a43658d7123aab89b6febea90_NeikiAnalytics.exe
2740	431a817a43658d7123aab89b6febea90_NeikiAnalytics.exe
2740	431a817a43658d7123aab89b6febea90_NeikiAnalytics.exe
2740	431a817a43658d7123aab89b6febea90_NeikiAnalytics.exe
2740	431a817a43658d7123aab89b6febea90_NeikiAnalytics.exe
2740	431a817a43658d7123aab89b6febea90_NeikiAnalytics.exe
2740	431a817a43658d7123aab89b6febea90_NeikiAnalytics.exe
2740	431a817a43658d7123aab89b6febea90_NeikiAnalytics.exe
2740	431a817a43658d7123aab89b6febea90_NeikiAnalytics.exe
2740	431a817a43658d7123aab89b6febea90_NeikiAnalytics.exe
2740	431a817a43658d7123aab89b6febea90_NeikiAnalytics.exe
2740	431a817a43658d7123aab89b6febea90_NeikiAnalytics.exe

UPX packed file 57 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2740-0-0x000000013FC50000-0x0000000140042000-memory.dmp	upx
behavioral1/files/0x000b0000000155e2-3.dat	upx
behavioral1/memory/2884-9-0x000000013F140000-0x000000013F532000-memory.dmp	upx
behavioral1/files/0x0024000000015c3c-17.dat	upx
behavioral1/files/0x000f0000000006fd-22.dat	upx
behavioral1/memory/2532-19-0x000000013F470000-0x000000013F862000-memory.dmp	upx
behavioral1/files/0x0008000000015c87-30.dat	upx
behavioral1/files/0x0007000000015cb9-31.dat	upx
behavioral1/files/0x0008000000015e02-35.dat	upx
behavioral1/files/0x00050000000186a0-49.dat	upx
behavioral1/files/0x0006000000018b15-61.dat	upx
behavioral1/files/0x0006000000018b37-68.dat	upx
behavioral1/files/0x0006000000018b73-119.dat	upx
behavioral1/files/0x00050000000192f4-140.dat	upx
behavioral1/files/0x0005000000019333-148.dat	upx
behavioral1/files/0x000500000001931b-146.dat	upx
behavioral1/files/0x00050000000192c9-138.dat	upx
behavioral1/files/0x000500000001939b-174.dat	upx
behavioral1/files/0x0005000000019377-171.dat	upx
behavioral1/files/0x000500000001946b-193.dat	upx
behavioral1/files/0x00050000000193b0-184.dat	upx
behavioral1/files/0x0005000000019410-188.dat	upx
behavioral1/files/0x0005000000019368-168.dat	upx
behavioral1/files/0x0006000000018d06-134.dat	upx
behavioral1/files/0x0006000000018ba2-130.dat	upx
behavioral1/files/0x0014000000015c52-126.dat	upx
behavioral1/files/0x0006000000018b4a-118.dat	upx
behavioral1/files/0x0006000000018b96-123.dat	upx
behavioral1/memory/2416-99-0x000000013F580000-0x000000013F972000-memory.dmp	upx
behavioral1/memory/2392-86-0x000000013FCA0000-0x0000000140092000-memory.dmp	upx
behavioral1/memory/2860-84-0x000000013FD80000-0x0000000140172000-memory.dmp	upx
behavioral1/memory/2548-82-0x000000013FE80000-0x0000000140272000-memory.dmp	upx
behavioral1/memory/2552-80-0x000000013F470000-0x000000013F862000-memory.dmp	upx
behavioral1/memory/1664-111-0x000000013F700000-0x000000013FAF2000-memory.dmp	upx
behavioral1/memory/572-110-0x000000013FAC0000-0x000000013FEB2000-memory.dmp	upx
behavioral1/memory/112-108-0x000000013F450000-0x000000013F842000-memory.dmp	upx
behavioral1/files/0x0006000000018b6a-106.dat	upx
behavioral1/memory/1572-105-0x000000013F6C0000-0x000000013FAB2000-memory.dmp	upx
behavioral1/memory/2448-91-0x000000013F400000-0x000000013F7F2000-memory.dmp	upx
behavioral1/files/0x0006000000018b42-90.dat	upx
behavioral1/files/0x0006000000018b33-66.dat	upx
behavioral1/files/0x0006000000018ae8-57.dat	upx
behavioral1/files/0x0006000000018ae2-53.dat	upx
behavioral1/files/0x0005000000018698-45.dat	upx
behavioral1/files/0x00070000000165ae-41.dat	upx
behavioral1/memory/2416-1874-0x000000013F580000-0x000000013F972000-memory.dmp	upx
behavioral1/memory/2532-2402-0x000000013F470000-0x000000013F862000-memory.dmp	upx
behavioral1/memory/2884-2403-0x000000013F140000-0x000000013F532000-memory.dmp	upx
behavioral1/memory/2552-2410-0x000000013F470000-0x000000013F862000-memory.dmp	upx
behavioral1/memory/1664-2412-0x000000013F700000-0x000000013FAF2000-memory.dmp	upx
behavioral1/memory/2548-2411-0x000000013FE80000-0x0000000140272000-memory.dmp	upx
behavioral1/memory/2448-2409-0x000000013F400000-0x000000013F7F2000-memory.dmp	upx
behavioral1/memory/1572-2408-0x000000013F6C0000-0x000000013FAB2000-memory.dmp	upx
behavioral1/memory/572-2407-0x000000013FAC0000-0x000000013FEB2000-memory.dmp	upx
behavioral1/memory/2392-2406-0x000000013FCA0000-0x0000000140092000-memory.dmp	upx
behavioral1/memory/2860-2405-0x000000013FD80000-0x0000000140172000-memory.dmp	upx
behavioral1/memory/112-2404-0x000000013F450000-0x000000013F842000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\mXJzSTi.exe	431a817a43658d7123aab89b6febea90_NeikiAnalytics.exe
File created	C:\Windows\System\FgOqRtJ.exe	431a817a43658d7123aab89b6febea90_NeikiAnalytics.exe
File created	C:\Windows\System\msGQluW.exe	431a817a43658d7123aab89b6febea90_NeikiAnalytics.exe
File created	C:\Windows\System\kHhgAyn.exe	431a817a43658d7123aab89b6febea90_NeikiAnalytics.exe
File created	C:\Windows\System\rmcnTWW.exe	431a817a43658d7123aab89b6febea90_NeikiAnalytics.exe
File created	C:\Windows\System\BNLjZJT.exe	431a817a43658d7123aab89b6febea90_NeikiAnalytics.exe
File created	C:\Windows\System\OuXZMFC.exe	431a817a43658d7123aab89b6febea90_NeikiAnalytics.exe
File created	C:\Windows\System\iskJvJG.exe	431a817a43658d7123aab89b6febea90_NeikiAnalytics.exe
File created	C:\Windows\System\iRkznZG.exe	431a817a43658d7123aab89b6febea90_NeikiAnalytics.exe
File created	C:\Windows\System\UaMbXJG.exe	431a817a43658d7123aab89b6febea90_NeikiAnalytics.exe
File created	C:\Windows\System\akSbkqI.exe	431a817a43658d7123aab89b6febea90_NeikiAnalytics.exe
File created	C:\Windows\System\QrEvrLy.exe	431a817a43658d7123aab89b6febea90_NeikiAnalytics.exe
File created	C:\Windows\System\LARQcpf.exe	431a817a43658d7123aab89b6febea90_NeikiAnalytics.exe
File created	C:\Windows\System\RTBepaA.exe	431a817a43658d7123aab89b6febea90_NeikiAnalytics.exe
File created	C:\Windows\System\LkQbasx.exe	431a817a43658d7123aab89b6febea90_NeikiAnalytics.exe
File created	C:\Windows\System\PzsRnFL.exe	431a817a43658d7123aab89b6febea90_NeikiAnalytics.exe
File created	C:\Windows\System\MxOrNgZ.exe	431a817a43658d7123aab89b6febea90_NeikiAnalytics.exe
File created	C:\Windows\System\aOrUzSh.exe	431a817a43658d7123aab89b6febea90_NeikiAnalytics.exe
File created	C:\Windows\System\ZCFBBKD.exe	431a817a43658d7123aab89b6febea90_NeikiAnalytics.exe
File created	C:\Windows\System\GxIGviK.exe	431a817a43658d7123aab89b6febea90_NeikiAnalytics.exe
File created	C:\Windows\System\UKAxliL.exe	431a817a43658d7123aab89b6febea90_NeikiAnalytics.exe
File created	C:\Windows\System\GCqYjSm.exe	431a817a43658d7123aab89b6febea90_NeikiAnalytics.exe
File created	C:\Windows\System\mceXIxW.exe	431a817a43658d7123aab89b6febea90_NeikiAnalytics.exe
File created	C:\Windows\System\uQjecej.exe	431a817a43658d7123aab89b6febea90_NeikiAnalytics.exe
File created	C:\Windows\System\tCrdTbU.exe	431a817a43658d7123aab89b6febea90_NeikiAnalytics.exe
File created	C:\Windows\System\zEcisGL.exe	431a817a43658d7123aab89b6febea90_NeikiAnalytics.exe
File created	C:\Windows\System\jfGWkwk.exe	431a817a43658d7123aab89b6febea90_NeikiAnalytics.exe
File created	C:\Windows\System\hGnBPdZ.exe	431a817a43658d7123aab89b6febea90_NeikiAnalytics.exe
File created	C:\Windows\System\yHUhFPO.exe	431a817a43658d7123aab89b6febea90_NeikiAnalytics.exe
File created	C:\Windows\System\XcABYSf.exe	431a817a43658d7123aab89b6febea90_NeikiAnalytics.exe
File created	C:\Windows\System\xVOvSez.exe	431a817a43658d7123aab89b6febea90_NeikiAnalytics.exe
File created	C:\Windows\System\xQopOuV.exe	431a817a43658d7123aab89b6febea90_NeikiAnalytics.exe
File created	C:\Windows\System\ZRgCCqP.exe	431a817a43658d7123aab89b6febea90_NeikiAnalytics.exe
File created	C:\Windows\System\SPIxZPC.exe	431a817a43658d7123aab89b6febea90_NeikiAnalytics.exe
File created	C:\Windows\System\dBlJIfX.exe	431a817a43658d7123aab89b6febea90_NeikiAnalytics.exe
File created	C:\Windows\System\yOsEJkp.exe	431a817a43658d7123aab89b6febea90_NeikiAnalytics.exe
File created	C:\Windows\System\MTBxTsq.exe	431a817a43658d7123aab89b6febea90_NeikiAnalytics.exe
File created	C:\Windows\System\ILeDzWx.exe	431a817a43658d7123aab89b6febea90_NeikiAnalytics.exe
File created	C:\Windows\System\CauDuMY.exe	431a817a43658d7123aab89b6febea90_NeikiAnalytics.exe
File created	C:\Windows\System\fLBjNOn.exe	431a817a43658d7123aab89b6febea90_NeikiAnalytics.exe
File created	C:\Windows\System\iqUcqyC.exe	431a817a43658d7123aab89b6febea90_NeikiAnalytics.exe
File created	C:\Windows\System\nzqGnGZ.exe	431a817a43658d7123aab89b6febea90_NeikiAnalytics.exe
File created	C:\Windows\System\AqQtuUW.exe	431a817a43658d7123aab89b6febea90_NeikiAnalytics.exe
File created	C:\Windows\System\reWMway.exe	431a817a43658d7123aab89b6febea90_NeikiAnalytics.exe
File created	C:\Windows\System\XYKGTjR.exe	431a817a43658d7123aab89b6febea90_NeikiAnalytics.exe
File created	C:\Windows\System\gZQxmGo.exe	431a817a43658d7123aab89b6febea90_NeikiAnalytics.exe
File created	C:\Windows\System\XPHhvgx.exe	431a817a43658d7123aab89b6febea90_NeikiAnalytics.exe
File created	C:\Windows\System\pTeyozu.exe	431a817a43658d7123aab89b6febea90_NeikiAnalytics.exe
File created	C:\Windows\System\cUDiUve.exe	431a817a43658d7123aab89b6febea90_NeikiAnalytics.exe
File created	C:\Windows\System\tMhGcnd.exe	431a817a43658d7123aab89b6febea90_NeikiAnalytics.exe
File created	C:\Windows\System\FfLysjf.exe	431a817a43658d7123aab89b6febea90_NeikiAnalytics.exe
File created	C:\Windows\System\hwOinmg.exe	431a817a43658d7123aab89b6febea90_NeikiAnalytics.exe
File created	C:\Windows\System\peCEOFU.exe	431a817a43658d7123aab89b6febea90_NeikiAnalytics.exe
File created	C:\Windows\System\CjKMeXJ.exe	431a817a43658d7123aab89b6febea90_NeikiAnalytics.exe
File created	C:\Windows\System\gKAhovo.exe	431a817a43658d7123aab89b6febea90_NeikiAnalytics.exe
File created	C:\Windows\System\BuUkkRa.exe	431a817a43658d7123aab89b6febea90_NeikiAnalytics.exe
File created	C:\Windows\System\pzWsTnQ.exe	431a817a43658d7123aab89b6febea90_NeikiAnalytics.exe
File created	C:\Windows\System\arPGDkf.exe	431a817a43658d7123aab89b6febea90_NeikiAnalytics.exe
File created	C:\Windows\System\yBNLJNE.exe	431a817a43658d7123aab89b6febea90_NeikiAnalytics.exe
File created	C:\Windows\System\kAJLKYW.exe	431a817a43658d7123aab89b6febea90_NeikiAnalytics.exe
File created	C:\Windows\System\ijwSRBO.exe	431a817a43658d7123aab89b6febea90_NeikiAnalytics.exe
File created	C:\Windows\System\tGayJDL.exe	431a817a43658d7123aab89b6febea90_NeikiAnalytics.exe
File created	C:\Windows\System\LtODYIz.exe	431a817a43658d7123aab89b6febea90_NeikiAnalytics.exe
File created	C:\Windows\System\ocKiGFP.exe	431a817a43658d7123aab89b6febea90_NeikiAnalytics.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2068	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2740	431a817a43658d7123aab89b6febea90_NeikiAnalytics.exe
Token: SeLockMemoryPrivilege	2740	431a817a43658d7123aab89b6febea90_NeikiAnalytics.exe
Token: SeDebugPrivilege	2068	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2740 wrote to memory of 2068	2740	431a817a43658d7123aab89b6febea90_NeikiAnalytics.exe	29
PID 2740 wrote to memory of 2068	2740	431a817a43658d7123aab89b6febea90_NeikiAnalytics.exe	29
PID 2740 wrote to memory of 2068	2740	431a817a43658d7123aab89b6febea90_NeikiAnalytics.exe	29
PID 2740 wrote to memory of 2884	2740	431a817a43658d7123aab89b6febea90_NeikiAnalytics.exe	30
PID 2740 wrote to memory of 2884	2740	431a817a43658d7123aab89b6febea90_NeikiAnalytics.exe	30
PID 2740 wrote to memory of 2884	2740	431a817a43658d7123aab89b6febea90_NeikiAnalytics.exe	30
PID 2740 wrote to memory of 2532	2740	431a817a43658d7123aab89b6febea90_NeikiAnalytics.exe	31
PID 2740 wrote to memory of 2532	2740	431a817a43658d7123aab89b6febea90_NeikiAnalytics.exe	31
PID 2740 wrote to memory of 2532	2740	431a817a43658d7123aab89b6febea90_NeikiAnalytics.exe	31
PID 2740 wrote to memory of 2552	2740	431a817a43658d7123aab89b6febea90_NeikiAnalytics.exe	32
PID 2740 wrote to memory of 2552	2740	431a817a43658d7123aab89b6febea90_NeikiAnalytics.exe	32
PID 2740 wrote to memory of 2552	2740	431a817a43658d7123aab89b6febea90_NeikiAnalytics.exe	32
PID 2740 wrote to memory of 2548	2740	431a817a43658d7123aab89b6febea90_NeikiAnalytics.exe	33
PID 2740 wrote to memory of 2548	2740	431a817a43658d7123aab89b6febea90_NeikiAnalytics.exe	33
PID 2740 wrote to memory of 2548	2740	431a817a43658d7123aab89b6febea90_NeikiAnalytics.exe	33
PID 2740 wrote to memory of 2860	2740	431a817a43658d7123aab89b6febea90_NeikiAnalytics.exe	34
PID 2740 wrote to memory of 2860	2740	431a817a43658d7123aab89b6febea90_NeikiAnalytics.exe	34
PID 2740 wrote to memory of 2860	2740	431a817a43658d7123aab89b6febea90_NeikiAnalytics.exe	34
PID 2740 wrote to memory of 2392	2740	431a817a43658d7123aab89b6febea90_NeikiAnalytics.exe	35
PID 2740 wrote to memory of 2392	2740	431a817a43658d7123aab89b6febea90_NeikiAnalytics.exe	35
PID 2740 wrote to memory of 2392	2740	431a817a43658d7123aab89b6febea90_NeikiAnalytics.exe	35
PID 2740 wrote to memory of 2448	2740	431a817a43658d7123aab89b6febea90_NeikiAnalytics.exe	36
PID 2740 wrote to memory of 2448	2740	431a817a43658d7123aab89b6febea90_NeikiAnalytics.exe	36
PID 2740 wrote to memory of 2448	2740	431a817a43658d7123aab89b6febea90_NeikiAnalytics.exe	36
PID 2740 wrote to memory of 2416	2740	431a817a43658d7123aab89b6febea90_NeikiAnalytics.exe	37
PID 2740 wrote to memory of 2416	2740	431a817a43658d7123aab89b6febea90_NeikiAnalytics.exe	37
PID 2740 wrote to memory of 2416	2740	431a817a43658d7123aab89b6febea90_NeikiAnalytics.exe	37
PID 2740 wrote to memory of 1572	2740	431a817a43658d7123aab89b6febea90_NeikiAnalytics.exe	38
PID 2740 wrote to memory of 1572	2740	431a817a43658d7123aab89b6febea90_NeikiAnalytics.exe	38
PID 2740 wrote to memory of 1572	2740	431a817a43658d7123aab89b6febea90_NeikiAnalytics.exe	38
PID 2740 wrote to memory of 112	2740	431a817a43658d7123aab89b6febea90_NeikiAnalytics.exe	39
PID 2740 wrote to memory of 112	2740	431a817a43658d7123aab89b6febea90_NeikiAnalytics.exe	39
PID 2740 wrote to memory of 112	2740	431a817a43658d7123aab89b6febea90_NeikiAnalytics.exe	39
PID 2740 wrote to memory of 572	2740	431a817a43658d7123aab89b6febea90_NeikiAnalytics.exe	40
PID 2740 wrote to memory of 572	2740	431a817a43658d7123aab89b6febea90_NeikiAnalytics.exe	40
PID 2740 wrote to memory of 572	2740	431a817a43658d7123aab89b6febea90_NeikiAnalytics.exe	40
PID 2740 wrote to memory of 1664	2740	431a817a43658d7123aab89b6febea90_NeikiAnalytics.exe	41
PID 2740 wrote to memory of 1664	2740	431a817a43658d7123aab89b6febea90_NeikiAnalytics.exe	41
PID 2740 wrote to memory of 1664	2740	431a817a43658d7123aab89b6febea90_NeikiAnalytics.exe	41
PID 2740 wrote to memory of 764	2740	431a817a43658d7123aab89b6febea90_NeikiAnalytics.exe	42
PID 2740 wrote to memory of 764	2740	431a817a43658d7123aab89b6febea90_NeikiAnalytics.exe	42
PID 2740 wrote to memory of 764	2740	431a817a43658d7123aab89b6febea90_NeikiAnalytics.exe	42
PID 2740 wrote to memory of 908	2740	431a817a43658d7123aab89b6febea90_NeikiAnalytics.exe	43
PID 2740 wrote to memory of 908	2740	431a817a43658d7123aab89b6febea90_NeikiAnalytics.exe	43
PID 2740 wrote to memory of 908	2740	431a817a43658d7123aab89b6febea90_NeikiAnalytics.exe	43
PID 2740 wrote to memory of 2444	2740	431a817a43658d7123aab89b6febea90_NeikiAnalytics.exe	44
PID 2740 wrote to memory of 2444	2740	431a817a43658d7123aab89b6febea90_NeikiAnalytics.exe	44
PID 2740 wrote to memory of 2444	2740	431a817a43658d7123aab89b6febea90_NeikiAnalytics.exe	44
PID 2740 wrote to memory of 2672	2740	431a817a43658d7123aab89b6febea90_NeikiAnalytics.exe	45
PID 2740 wrote to memory of 2672	2740	431a817a43658d7123aab89b6febea90_NeikiAnalytics.exe	45
PID 2740 wrote to memory of 2672	2740	431a817a43658d7123aab89b6febea90_NeikiAnalytics.exe	45
PID 2740 wrote to memory of 1612	2740	431a817a43658d7123aab89b6febea90_NeikiAnalytics.exe	46
PID 2740 wrote to memory of 1612	2740	431a817a43658d7123aab89b6febea90_NeikiAnalytics.exe	46
PID 2740 wrote to memory of 1612	2740	431a817a43658d7123aab89b6febea90_NeikiAnalytics.exe	46
PID 2740 wrote to memory of 2296	2740	431a817a43658d7123aab89b6febea90_NeikiAnalytics.exe	47
PID 2740 wrote to memory of 2296	2740	431a817a43658d7123aab89b6febea90_NeikiAnalytics.exe	47
PID 2740 wrote to memory of 2296	2740	431a817a43658d7123aab89b6febea90_NeikiAnalytics.exe	47
PID 2740 wrote to memory of 1712	2740	431a817a43658d7123aab89b6febea90_NeikiAnalytics.exe	48
PID 2740 wrote to memory of 1712	2740	431a817a43658d7123aab89b6febea90_NeikiAnalytics.exe	48
PID 2740 wrote to memory of 1712	2740	431a817a43658d7123aab89b6febea90_NeikiAnalytics.exe	48
PID 2740 wrote to memory of 2620	2740	431a817a43658d7123aab89b6febea90_NeikiAnalytics.exe	49
PID 2740 wrote to memory of 2620	2740	431a817a43658d7123aab89b6febea90_NeikiAnalytics.exe	49
PID 2740 wrote to memory of 2620	2740	431a817a43658d7123aab89b6febea90_NeikiAnalytics.exe	49
PID 2740 wrote to memory of 2272	2740	431a817a43658d7123aab89b6febea90_NeikiAnalytics.exe	50

C:\Users\Admin\AppData\Local\Temp\431a817a43658d7123aab89b6febea90_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\431a817a43658d7123aab89b6febea90_NeikiAnalytics.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2740
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2068
- C:\Windows\System\oZrUGag.exe
  C:\Windows\System\oZrUGag.exe
  2⤵
  - Executes dropped EXE
  PID:2884
- C:\Windows\System\PQwjRCt.exe
  C:\Windows\System\PQwjRCt.exe
  2⤵
  - Executes dropped EXE
  PID:2532
- C:\Windows\System\ahjJkqN.exe
  C:\Windows\System\ahjJkqN.exe
  2⤵
  - Executes dropped EXE
  PID:2552
- C:\Windows\System\EORQroO.exe
  C:\Windows\System\EORQroO.exe
  2⤵
  - Executes dropped EXE
  PID:2548
- C:\Windows\System\CLNYrwl.exe
  C:\Windows\System\CLNYrwl.exe
  2⤵
  - Executes dropped EXE
  PID:2860
- C:\Windows\System\syKwHwl.exe
  C:\Windows\System\syKwHwl.exe
  2⤵
  - Executes dropped EXE
  PID:2392
- C:\Windows\System\FFrSRfP.exe
  C:\Windows\System\FFrSRfP.exe
  2⤵
  - Executes dropped EXE
  PID:2448
- C:\Windows\System\ktcTcEQ.exe
  C:\Windows\System\ktcTcEQ.exe
  2⤵
  - Executes dropped EXE
  PID:2416
- C:\Windows\System\jJHHpZv.exe
  C:\Windows\System\jJHHpZv.exe
  2⤵
  - Executes dropped EXE
  PID:1572
- C:\Windows\System\Vcxypqj.exe
  C:\Windows\System\Vcxypqj.exe
  2⤵
  - Executes dropped EXE
  PID:112
- C:\Windows\System\VzNcLIN.exe
  C:\Windows\System\VzNcLIN.exe
  2⤵
  - Executes dropped EXE
  PID:572
- C:\Windows\System\EpBnLnb.exe
  C:\Windows\System\EpBnLnb.exe
  2⤵
  - Executes dropped EXE
  PID:1664
- C:\Windows\System\kQbxYOf.exe
  C:\Windows\System\kQbxYOf.exe
  2⤵
  - Executes dropped EXE
  PID:764
- C:\Windows\System\ZdUnuto.exe
  C:\Windows\System\ZdUnuto.exe
  2⤵
  - Executes dropped EXE
  PID:908
- C:\Windows\System\mGCVTJD.exe
  C:\Windows\System\mGCVTJD.exe
  2⤵
  - Executes dropped EXE
  PID:2444
- C:\Windows\System\vQsjyZr.exe
  C:\Windows\System\vQsjyZr.exe
  2⤵
  - Executes dropped EXE
  PID:2672
- C:\Windows\System\jfGWkwk.exe
  C:\Windows\System\jfGWkwk.exe
  2⤵
  - Executes dropped EXE
  PID:1612
- C:\Windows\System\oXLpWLi.exe
  C:\Windows\System\oXLpWLi.exe
  2⤵
  - Executes dropped EXE
  PID:2296
- C:\Windows\System\zuReTGk.exe
  C:\Windows\System\zuReTGk.exe
  2⤵
  - Executes dropped EXE
  PID:1712
- C:\Windows\System\Dlejsue.exe
  C:\Windows\System\Dlejsue.exe
  2⤵
  - Executes dropped EXE
  PID:2620
- C:\Windows\System\hGnBPdZ.exe
  C:\Windows\System\hGnBPdZ.exe
  2⤵
  - Executes dropped EXE
  PID:2272
- C:\Windows\System\KQUyWeg.exe
  C:\Windows\System\KQUyWeg.exe
  2⤵
  - Executes dropped EXE
  PID:1568
- C:\Windows\System\IZlaknb.exe
  C:\Windows\System\IZlaknb.exe
  2⤵
  - Executes dropped EXE
  PID:1292
- C:\Windows\System\pINSOQC.exe
  C:\Windows\System\pINSOQC.exe
  2⤵
  - Executes dropped EXE
  PID:1236
- C:\Windows\System\fOXWPGc.exe
  C:\Windows\System\fOXWPGc.exe
  2⤵
  - Executes dropped EXE
  PID:2708
- C:\Windows\System\jSIljWS.exe
  C:\Windows\System\jSIljWS.exe
  2⤵
  - Executes dropped EXE
  PID:2568
- C:\Windows\System\mNEJQff.exe
  C:\Windows\System\mNEJQff.exe
  2⤵
  - Executes dropped EXE
  PID:476
- C:\Windows\System\aXNzIKB.exe
  C:\Windows\System\aXNzIKB.exe
  2⤵
  - Executes dropped EXE
  PID:2228
- C:\Windows\System\BaNPwuK.exe
  C:\Windows\System\BaNPwuK.exe
  2⤵
  - Executes dropped EXE
  PID:1084
- C:\Windows\System\UbTDEul.exe
  C:\Windows\System\UbTDEul.exe
  2⤵
  - Executes dropped EXE
  PID:1896
- C:\Windows\System\OeUEnsS.exe
  C:\Windows\System\OeUEnsS.exe
  2⤵
  - Executes dropped EXE
  PID:1904
- C:\Windows\System\QESnCnk.exe
  C:\Windows\System\QESnCnk.exe
  2⤵
  - Executes dropped EXE
  PID:1112
- C:\Windows\System\UDBMCcn.exe
  C:\Windows\System\UDBMCcn.exe
  2⤵
  - Executes dropped EXE
  PID:704
- C:\Windows\System\LkQbasx.exe
  C:\Windows\System\LkQbasx.exe
  2⤵
  - Executes dropped EXE
  PID:1460
- C:\Windows\System\kvtGBsz.exe
  C:\Windows\System\kvtGBsz.exe
  2⤵
  - Executes dropped EXE
  PID:1332
- C:\Windows\System\aMnVJNw.exe
  C:\Windows\System\aMnVJNw.exe
  2⤵
  - Executes dropped EXE
  PID:1140
- C:\Windows\System\tdxJNuB.exe
  C:\Windows\System\tdxJNuB.exe
  2⤵
  - Executes dropped EXE
  PID:1820
- C:\Windows\System\JObmtcR.exe
  C:\Windows\System\JObmtcR.exe
  2⤵
  - Executes dropped EXE
  PID:1232
- C:\Windows\System\RDOcCdm.exe
  C:\Windows\System\RDOcCdm.exe
  2⤵
  - Executes dropped EXE
  PID:1736
- C:\Windows\System\GbPIzkh.exe
  C:\Windows\System\GbPIzkh.exe
  2⤵
  - Executes dropped EXE
  PID:912
- C:\Windows\System\FRCNCLp.exe
  C:\Windows\System\FRCNCLp.exe
  2⤵
  - Executes dropped EXE
  PID:1976
- C:\Windows\System\ywpCYgY.exe
  C:\Windows\System\ywpCYgY.exe
  2⤵
  - Executes dropped EXE
  PID:872
- C:\Windows\System\svojdzW.exe
  C:\Windows\System\svojdzW.exe
  2⤵
  - Executes dropped EXE
  PID:1464
- C:\Windows\System\peCEOFU.exe
  C:\Windows\System\peCEOFU.exe
  2⤵
  - Executes dropped EXE
  PID:1396
- C:\Windows\System\BKqfsjz.exe
  C:\Windows\System\BKqfsjz.exe
  2⤵
  - Executes dropped EXE
  PID:1980
- C:\Windows\System\XmPNjUi.exe
  C:\Windows\System\XmPNjUi.exe
  2⤵
  - Executes dropped EXE
  PID:1632
- C:\Windows\System\UIEGYtx.exe
  C:\Windows\System\UIEGYtx.exe
  2⤵
  - Executes dropped EXE
  PID:312
- C:\Windows\System\zbCvkKk.exe
  C:\Windows\System\zbCvkKk.exe
  2⤵
  - Executes dropped EXE
  PID:576
- C:\Windows\System\jmhPzGf.exe
  C:\Windows\System\jmhPzGf.exe
  2⤵
  - Executes dropped EXE
  PID:2268
- C:\Windows\System\YvWCzlU.exe
  C:\Windows\System\YvWCzlU.exe
  2⤵
  - Executes dropped EXE
  PID:1692
- C:\Windows\System\vpPtyVx.exe
  C:\Windows\System\vpPtyVx.exe
  2⤵
  - Executes dropped EXE
  PID:2136
- C:\Windows\System\aoTdoMh.exe
  C:\Windows\System\aoTdoMh.exe
  2⤵
  - Executes dropped EXE
  PID:2960
- C:\Windows\System\eIYnLat.exe
  C:\Windows\System\eIYnLat.exe
  2⤵
  - Executes dropped EXE
  PID:1484
- C:\Windows\System\PsSIYpk.exe
  C:\Windows\System\PsSIYpk.exe
  2⤵
  - Executes dropped EXE
  PID:1520
- C:\Windows\System\qMhIAqs.exe
  C:\Windows\System\qMhIAqs.exe
  2⤵
  - Executes dropped EXE
  PID:2576
- C:\Windows\System\nKPRCTB.exe
  C:\Windows\System\nKPRCTB.exe
  2⤵
  - Executes dropped EXE
  PID:2752
- C:\Windows\System\emwdZKW.exe
  C:\Windows\System\emwdZKW.exe
  2⤵
  - Executes dropped EXE
  PID:2572
- C:\Windows\System\YAFomyF.exe
  C:\Windows\System\YAFomyF.exe
  2⤵
  - Executes dropped EXE
  PID:2440
- C:\Windows\System\anHEAsi.exe
  C:\Windows\System\anHEAsi.exe
  2⤵
  - Executes dropped EXE
  PID:2864
- C:\Windows\System\HwpTcut.exe
  C:\Windows\System\HwpTcut.exe
  2⤵
  - Executes dropped EXE
  PID:108
- C:\Windows\System\uXPSALH.exe
  C:\Windows\System\uXPSALH.exe
  2⤵
  - Executes dropped EXE
  PID:2352
- C:\Windows\System\LWqHgxl.exe
  C:\Windows\System\LWqHgxl.exe
  2⤵
  - Executes dropped EXE
  PID:288
- C:\Windows\System\nWnxPhn.exe
  C:\Windows\System\nWnxPhn.exe
  2⤵
  - Executes dropped EXE
  PID:1760
- C:\Windows\System\drRECbd.exe
  C:\Windows\System\drRECbd.exe
  2⤵
  PID:2544
- C:\Windows\System\nQbmqHy.exe
  C:\Windows\System\nQbmqHy.exe
  2⤵
  - Executes dropped EXE
  PID:2988
- C:\Windows\System\zhUeAqd.exe
  C:\Windows\System\zhUeAqd.exe
  2⤵
  PID:2332
- C:\Windows\System\MPKSXOm.exe
  C:\Windows\System\MPKSXOm.exe
  2⤵
  PID:2276
- C:\Windows\System\UlqsNvf.exe
  C:\Windows\System\UlqsNvf.exe
  2⤵
  PID:2176
- C:\Windows\System\YPlxgvB.exe
  C:\Windows\System\YPlxgvB.exe
  2⤵
  PID:308
- C:\Windows\System\qMrBcBu.exe
  C:\Windows\System\qMrBcBu.exe
  2⤵
  PID:1340
- C:\Windows\System\JPUCwzU.exe
  C:\Windows\System\JPUCwzU.exe
  2⤵
  PID:840
- C:\Windows\System\vYUufCp.exe
  C:\Windows\System\vYUufCp.exe
  2⤵
  PID:952
- C:\Windows\System\dhWkxLN.exe
  C:\Windows\System\dhWkxLN.exe
  2⤵
  PID:2004
- C:\Windows\System\tGayJDL.exe
  C:\Windows\System\tGayJDL.exe
  2⤵
  PID:552
- C:\Windows\System\MCKEwYS.exe
  C:\Windows\System\MCKEwYS.exe
  2⤵
  PID:2208
- C:\Windows\System\hBehdOH.exe
  C:\Windows\System\hBehdOH.exe
  2⤵
  PID:956
- C:\Windows\System\XJpkdAP.exe
  C:\Windows\System\XJpkdAP.exe
  2⤵
  PID:2304
- C:\Windows\System\aHuSaxK.exe
  C:\Windows\System\aHuSaxK.exe
  2⤵
  PID:2380
- C:\Windows\System\rfQeYgM.exe
  C:\Windows\System\rfQeYgM.exe
  2⤵
  PID:1964
- C:\Windows\System\JNhsRwK.exe
  C:\Windows\System\JNhsRwK.exe
  2⤵
  PID:2192
- C:\Windows\System\MZeGebn.exe
  C:\Windows\System\MZeGebn.exe
  2⤵
  PID:2396
- C:\Windows\System\SGQBcQk.exe
  C:\Windows\System\SGQBcQk.exe
  2⤵
  PID:1220
- C:\Windows\System\tRbpQBg.exe
  C:\Windows\System\tRbpQBg.exe
  2⤵
  PID:1312
- C:\Windows\System\TdqTexC.exe
  C:\Windows\System\TdqTexC.exe
  2⤵
  PID:984
- C:\Windows\System\xhLKxkW.exe
  C:\Windows\System\xhLKxkW.exe
  2⤵
  PID:1032
- C:\Windows\System\yZipdkq.exe
  C:\Windows\System\yZipdkq.exe
  2⤵
  PID:1248
- C:\Windows\System\yHUhFPO.exe
  C:\Windows\System\yHUhFPO.exe
  2⤵
  PID:3024
- C:\Windows\System\eBeKwnk.exe
  C:\Windows\System\eBeKwnk.exe
  2⤵
  PID:1956
- C:\Windows\System\ZrHxiqZ.exe
  C:\Windows\System\ZrHxiqZ.exe
  2⤵
  PID:2736
- C:\Windows\System\BOAGWsE.exe
  C:\Windows\System\BOAGWsE.exe
  2⤵
  PID:2788
- C:\Windows\System\cvQvhBn.exe
  C:\Windows\System\cvQvhBn.exe
  2⤵
  PID:2072
- C:\Windows\System\ZkRVZJT.exe
  C:\Windows\System\ZkRVZJT.exe
  2⤵
  PID:2012
- C:\Windows\System\OkYDwZo.exe
  C:\Windows\System\OkYDwZo.exe
  2⤵
  PID:2080
- C:\Windows\System\nCAOfZZ.exe
  C:\Windows\System\nCAOfZZ.exe
  2⤵
  PID:3028
- C:\Windows\System\onDbleM.exe
  C:\Windows\System\onDbleM.exe
  2⤵
  PID:2060
- C:\Windows\System\vfvHWKE.exe
  C:\Windows\System\vfvHWKE.exe
  2⤵
  PID:344
- C:\Windows\System\cjEpYDt.exe
  C:\Windows\System\cjEpYDt.exe
  2⤵
  PID:2744
- C:\Windows\System\svUVcgS.exe
  C:\Windows\System\svUVcgS.exe
  2⤵
  PID:2356
- C:\Windows\System\cBDCoMh.exe
  C:\Windows\System\cBDCoMh.exe
  2⤵
  PID:2632
- C:\Windows\System\PEYzZje.exe
  C:\Windows\System\PEYzZje.exe
  2⤵
  PID:2596
- C:\Windows\System\zGXDXDQ.exe
  C:\Windows\System\zGXDXDQ.exe
  2⤵
  PID:2560
- C:\Windows\System\nVXOELT.exe
  C:\Windows\System\nVXOELT.exe
  2⤵
  PID:2100
- C:\Windows\System\wgBwpOm.exe
  C:\Windows\System\wgBwpOm.exe
  2⤵
  PID:2680
- C:\Windows\System\bUomyCX.exe
  C:\Windows\System\bUomyCX.exe
  2⤵
  PID:2608
- C:\Windows\System\XxamSZi.exe
  C:\Windows\System\XxamSZi.exe
  2⤵
  PID:1908
- C:\Windows\System\xaFWUSf.exe
  C:\Windows\System\xaFWUSf.exe
  2⤵
  PID:1812
- C:\Windows\System\ryEAspS.exe
  C:\Windows\System\ryEAspS.exe
  2⤵
  PID:1280
- C:\Windows\System\dthKRUe.exe
  C:\Windows\System\dthKRUe.exe
  2⤵
  PID:1428
- C:\Windows\System\xZEJchN.exe
  C:\Windows\System\xZEJchN.exe
  2⤵
  PID:2164
- C:\Windows\System\mYrZbMK.exe
  C:\Windows\System\mYrZbMK.exe
  2⤵
  PID:2412
- C:\Windows\System\eLelCzm.exe
  C:\Windows\System\eLelCzm.exe
  2⤵
  PID:852
- C:\Windows\System\hZxJLXS.exe
  C:\Windows\System\hZxJLXS.exe
  2⤵
  PID:1752
- C:\Windows\System\QFQtPbB.exe
  C:\Windows\System\QFQtPbB.exe
  2⤵
  PID:816
- C:\Windows\System\XcABYSf.exe
  C:\Windows\System\XcABYSf.exe
  2⤵
  PID:2664
- C:\Windows\System\qDNnRQC.exe
  C:\Windows\System\qDNnRQC.exe
  2⤵
  PID:1608
- C:\Windows\System\evaMjOS.exe
  C:\Windows\System\evaMjOS.exe
  2⤵
  PID:2236
- C:\Windows\System\hjbgtvl.exe
  C:\Windows\System\hjbgtvl.exe
  2⤵
  PID:2292
- C:\Windows\System\fvDCFmr.exe
  C:\Windows\System\fvDCFmr.exe
  2⤵
  PID:2188
- C:\Windows\System\nKtLlma.exe
  C:\Windows\System\nKtLlma.exe
  2⤵
  PID:1300
- C:\Windows\System\OKVkDCU.exe
  C:\Windows\System\OKVkDCU.exe
  2⤵
  PID:2916
- C:\Windows\System\emxNTXy.exe
  C:\Windows\System\emxNTXy.exe
  2⤵
  PID:1636
- C:\Windows\System\mJfiOCD.exe
  C:\Windows\System\mJfiOCD.exe
  2⤵
  PID:1900
- C:\Windows\System\sGdTFDS.exe
  C:\Windows\System\sGdTFDS.exe
  2⤵
  PID:1644
- C:\Windows\System\BQtAdVm.exe
  C:\Windows\System\BQtAdVm.exe
  2⤵
  PID:3004
- C:\Windows\System\JwLBKlX.exe
  C:\Windows\System\JwLBKlX.exe
  2⤵
  PID:1968
- C:\Windows\System\RIYhyVD.exe
  C:\Windows\System\RIYhyVD.exe
  2⤵
  PID:1160
- C:\Windows\System\CAGqDhJ.exe
  C:\Windows\System\CAGqDhJ.exe
  2⤵
  PID:856
- C:\Windows\System\YWEdLkI.exe
  C:\Windows\System\YWEdLkI.exe
  2⤵
  PID:1732
- C:\Windows\System\oRpcyEw.exe
  C:\Windows\System\oRpcyEw.exe
  2⤵
  PID:2648
- C:\Windows\System\aHFYCqw.exe
  C:\Windows\System\aHFYCqw.exe
  2⤵
  PID:2224
- C:\Windows\System\NnhVhWh.exe
  C:\Windows\System\NnhVhWh.exe
  2⤵
  PID:888
- C:\Windows\System\CjKMeXJ.exe
  C:\Windows\System\CjKMeXJ.exe
  2⤵
  PID:2200
- C:\Windows\System\qxNwiGg.exe
  C:\Windows\System\qxNwiGg.exe
  2⤵
  PID:2428
- C:\Windows\System\FNCrNOw.exe
  C:\Windows\System\FNCrNOw.exe
  2⤵
  PID:2580
- C:\Windows\System\OvcWmZG.exe
  C:\Windows\System\OvcWmZG.exe
  2⤵
  PID:2692
- C:\Windows\System\ZwNoorf.exe
  C:\Windows\System\ZwNoorf.exe
  2⤵
  PID:2172
- C:\Windows\System\yQzBgJB.exe
  C:\Windows\System\yQzBgJB.exe
  2⤵
  PID:2504
- C:\Windows\System\EkgXOfJ.exe
  C:\Windows\System\EkgXOfJ.exe
  2⤵
  PID:2820
- C:\Windows\System\vSIbDAm.exe
  C:\Windows\System\vSIbDAm.exe
  2⤵
  PID:1864
- C:\Windows\System\QozrsrI.exe
  C:\Windows\System\QozrsrI.exe
  2⤵
  PID:2676
- C:\Windows\System\ZmUBwxa.exe
  C:\Windows\System\ZmUBwxa.exe
  2⤵
  PID:948
- C:\Windows\System\wBsJOCs.exe
  C:\Windows\System\wBsJOCs.exe
  2⤵
  PID:1744
- C:\Windows\System\mceXIxW.exe
  C:\Windows\System\mceXIxW.exe
  2⤵
  PID:1952
- C:\Windows\System\TkvTBXE.exe
  C:\Windows\System\TkvTBXE.exe
  2⤵
  PID:1932
- C:\Windows\System\rmcnTWW.exe
  C:\Windows\System\rmcnTWW.exe
  2⤵
  PID:2196
- C:\Windows\System\DKObIVw.exe
  C:\Windows\System\DKObIVw.exe
  2⤵
  PID:1028
- C:\Windows\System\WJtGWUH.exe
  C:\Windows\System\WJtGWUH.exe
  2⤵
  PID:2660
- C:\Windows\System\MxkvLSb.exe
  C:\Windows\System\MxkvLSb.exe
  2⤵
  PID:1064
- C:\Windows\System\UQoksDR.exe
  C:\Windows\System\UQoksDR.exe
  2⤵
  PID:1772
- C:\Windows\System\vBSZwot.exe
  C:\Windows\System\vBSZwot.exe
  2⤵
  PID:2616
- C:\Windows\System\hJiUnUS.exe
  C:\Windows\System\hJiUnUS.exe
  2⤵
  PID:1444
- C:\Windows\System\KMsczQc.exe
  C:\Windows\System\KMsczQc.exe
  2⤵
  PID:1972
- C:\Windows\System\cPOuMUi.exe
  C:\Windows\System\cPOuMUi.exe
  2⤵
  PID:588
- C:\Windows\System\rUYZHSx.exe
  C:\Windows\System\rUYZHSx.exe
  2⤵
  PID:2040
- C:\Windows\System\WfAXYWu.exe
  C:\Windows\System\WfAXYWu.exe
  2⤵
  PID:528
- C:\Windows\System\mQrmzEO.exe
  C:\Windows\System\mQrmzEO.exe
  2⤵
  PID:540
- C:\Windows\System\iYLBcHM.exe
  C:\Windows\System\iYLBcHM.exe
  2⤵
  PID:1512
- C:\Windows\System\LsXkaid.exe
  C:\Windows\System\LsXkaid.exe
  2⤵
  PID:2592
- C:\Windows\System\tctGTFS.exe
  C:\Windows\System\tctGTFS.exe
  2⤵
  PID:1072
- C:\Windows\System\RngOgIX.exe
  C:\Windows\System\RngOgIX.exe
  2⤵
  PID:2508
- C:\Windows\System\eCdlhLX.exe
  C:\Windows\System\eCdlhLX.exe
  2⤵
  PID:1640
- C:\Windows\System\VztChPH.exe
  C:\Windows\System\VztChPH.exe
  2⤵
  PID:2088
- C:\Windows\System\fDzIwsJ.exe
  C:\Windows\System\fDzIwsJ.exe
  2⤵
  PID:280
- C:\Windows\System\BIvhwxI.exe
  C:\Windows\System\BIvhwxI.exe
  2⤵
  PID:2180
- C:\Windows\System\pZmnJwC.exe
  C:\Windows\System\pZmnJwC.exe
  2⤵
  PID:2464
- C:\Windows\System\svRNfal.exe
  C:\Windows\System\svRNfal.exe
  2⤵
  PID:1872
- C:\Windows\System\YpOsjAG.exe
  C:\Windows\System\YpOsjAG.exe
  2⤵
  PID:848
- C:\Windows\System\fLBjNOn.exe
  C:\Windows\System\fLBjNOn.exe
  2⤵
  PID:1688
- C:\Windows\System\qzRnhYw.exe
  C:\Windows\System\qzRnhYw.exe
  2⤵
  PID:2524
- C:\Windows\System\MdJVeAt.exe
  C:\Windows\System\MdJVeAt.exe
  2⤵
  PID:584
- C:\Windows\System\SzEsTCy.exe
  C:\Windows\System\SzEsTCy.exe
  2⤵
  PID:2284
- C:\Windows\System\aEjEfZd.exe
  C:\Windows\System\aEjEfZd.exe
  2⤵
  PID:1200
- C:\Windows\System\hoTtVeJ.exe
  C:\Windows\System\hoTtVeJ.exe
  2⤵
  PID:800
- C:\Windows\System\zhNMiCW.exe
  C:\Windows\System\zhNMiCW.exe
  2⤵
  PID:3080
- C:\Windows\System\FlPcwij.exe
  C:\Windows\System\FlPcwij.exe
  2⤵
  PID:3096
- C:\Windows\System\PcZldzQ.exe
  C:\Windows\System\PcZldzQ.exe
  2⤵
  PID:3112
- C:\Windows\System\joKjjlJ.exe
  C:\Windows\System\joKjjlJ.exe
  2⤵
  PID:3132
- C:\Windows\System\SnuCviV.exe
  C:\Windows\System\SnuCviV.exe
  2⤵
  PID:3148
- C:\Windows\System\iqUcqyC.exe
  C:\Windows\System\iqUcqyC.exe
  2⤵
  PID:3224
- C:\Windows\System\EQMuGZL.exe
  C:\Windows\System\EQMuGZL.exe
  2⤵
  PID:3240
- C:\Windows\System\cTeIuLn.exe
  C:\Windows\System\cTeIuLn.exe
  2⤵
  PID:3256
- C:\Windows\System\NxWzCYm.exe
  C:\Windows\System\NxWzCYm.exe
  2⤵
  PID:3272
- C:\Windows\System\pwgfifQ.exe
  C:\Windows\System\pwgfifQ.exe
  2⤵
  PID:3288
- C:\Windows\System\IfXBRDu.exe
  C:\Windows\System\IfXBRDu.exe
  2⤵
  PID:3304
- C:\Windows\System\YBBOZxi.exe
  C:\Windows\System\YBBOZxi.exe
  2⤵
  PID:3320
- C:\Windows\System\IrtqEBT.exe
  C:\Windows\System\IrtqEBT.exe
  2⤵
  PID:3336
- C:\Windows\System\NCEAYCM.exe
  C:\Windows\System\NCEAYCM.exe
  2⤵
  PID:3356
- C:\Windows\System\VnduWdX.exe
  C:\Windows\System\VnduWdX.exe
  2⤵
  PID:3376
- C:\Windows\System\jHuCyjs.exe
  C:\Windows\System\jHuCyjs.exe
  2⤵
  PID:3428
- C:\Windows\System\MCETpOF.exe
  C:\Windows\System\MCETpOF.exe
  2⤵
  PID:3444
- C:\Windows\System\fSbrziw.exe
  C:\Windows\System\fSbrziw.exe
  2⤵
  PID:3460
- C:\Windows\System\CDcNmgu.exe
  C:\Windows\System\CDcNmgu.exe
  2⤵
  PID:3520
- C:\Windows\System\TGOHNzS.exe
  C:\Windows\System\TGOHNzS.exe
  2⤵
  PID:3540
- C:\Windows\System\JduXZYK.exe
  C:\Windows\System\JduXZYK.exe
  2⤵
  PID:3560
- C:\Windows\System\mktGgNO.exe
  C:\Windows\System\mktGgNO.exe
  2⤵
  PID:3580
- C:\Windows\System\FQwwrYT.exe
  C:\Windows\System\FQwwrYT.exe
  2⤵
  PID:3596
- C:\Windows\System\QlWFpwZ.exe
  C:\Windows\System\QlWFpwZ.exe
  2⤵
  PID:3612
- C:\Windows\System\rlgVdYG.exe
  C:\Windows\System\rlgVdYG.exe
  2⤵
  PID:3628
- C:\Windows\System\dHrWszd.exe
  C:\Windows\System\dHrWszd.exe
  2⤵
  PID:3644
- C:\Windows\System\MWubajV.exe
  C:\Windows\System\MWubajV.exe
  2⤵
  PID:3668
- C:\Windows\System\oaPaTlt.exe
  C:\Windows\System\oaPaTlt.exe
  2⤵
  PID:3704
- C:\Windows\System\uEbLBlr.exe
  C:\Windows\System\uEbLBlr.exe
  2⤵
  PID:3720
- C:\Windows\System\pUfHsbV.exe
  C:\Windows\System\pUfHsbV.exe
  2⤵
  PID:3736
- C:\Windows\System\smymSEx.exe
  C:\Windows\System\smymSEx.exe
  2⤵
  PID:3752
- C:\Windows\System\TMTRcqE.exe
  C:\Windows\System\TMTRcqE.exe
  2⤵
  PID:3776
- C:\Windows\System\gtglpgy.exe
  C:\Windows\System\gtglpgy.exe
  2⤵
  PID:3800
- C:\Windows\System\SXKsnGs.exe
  C:\Windows\System\SXKsnGs.exe
  2⤵
  PID:3820
- C:\Windows\System\okZEHQx.exe
  C:\Windows\System\okZEHQx.exe
  2⤵
  PID:3836
- C:\Windows\System\DvGztjG.exe
  C:\Windows\System\DvGztjG.exe
  2⤵
  PID:3852
- C:\Windows\System\srELpAw.exe
  C:\Windows\System\srELpAw.exe
  2⤵
  PID:3868
- C:\Windows\System\UmQCtiQ.exe
  C:\Windows\System\UmQCtiQ.exe
  2⤵
  PID:3888
- C:\Windows\System\Xwprozt.exe
  C:\Windows\System\Xwprozt.exe
  2⤵
  PID:3904
- C:\Windows\System\qYZkRAX.exe
  C:\Windows\System\qYZkRAX.exe
  2⤵
  PID:3920
- C:\Windows\System\llAFOsV.exe
  C:\Windows\System\llAFOsV.exe
  2⤵
  PID:3940
- C:\Windows\System\mOPzvtX.exe
  C:\Windows\System\mOPzvtX.exe
  2⤵
  PID:3984
- C:\Windows\System\ScuhgxA.exe
  C:\Windows\System\ScuhgxA.exe
  2⤵
  PID:4000
- C:\Windows\System\oiHquDk.exe
  C:\Windows\System\oiHquDk.exe
  2⤵
  PID:4016
- C:\Windows\System\JDdyFuZ.exe
  C:\Windows\System\JDdyFuZ.exe
  2⤵
  PID:4032
- C:\Windows\System\rDchoXX.exe
  C:\Windows\System\rDchoXX.exe
  2⤵
  PID:4048
- C:\Windows\System\pbDgMdB.exe
  C:\Windows\System\pbDgMdB.exe
  2⤵
  PID:4068
- C:\Windows\System\aZYljlD.exe
  C:\Windows\System\aZYljlD.exe
  2⤵
  PID:4084
- C:\Windows\System\JSAHffF.exe
  C:\Windows\System\JSAHffF.exe
  2⤵
  PID:2556
- C:\Windows\System\KbpdoIm.exe
  C:\Windows\System\KbpdoIm.exe
  2⤵
  PID:2144
- C:\Windows\System\zcLPgWo.exe
  C:\Windows\System\zcLPgWo.exe
  2⤵
  PID:828
- C:\Windows\System\dwhhmwS.exe
  C:\Windows\System\dwhhmwS.exe
  2⤵
  PID:2084
- C:\Windows\System\yZXIStB.exe
  C:\Windows\System\yZXIStB.exe
  2⤵
  PID:3108
- C:\Windows\System\aKXcGak.exe
  C:\Windows\System\aKXcGak.exe
  2⤵
  PID:3264
- C:\Windows\System\CTxAmBL.exe
  C:\Windows\System\CTxAmBL.exe
  2⤵
  PID:3364
- C:\Windows\System\XYqpSDf.exe
  C:\Windows\System\XYqpSDf.exe
  2⤵
  PID:3172
- C:\Windows\System\WlXlBLv.exe
  C:\Windows\System\WlXlBLv.exe
  2⤵
  PID:2980
- C:\Windows\System\xcGUdff.exe
  C:\Windows\System\xcGUdff.exe
  2⤵
  PID:1948
- C:\Windows\System\nzqGnGZ.exe
  C:\Windows\System\nzqGnGZ.exe
  2⤵
  PID:3216
- C:\Windows\System\TpmcsMi.exe
  C:\Windows\System\TpmcsMi.exe
  2⤵
  PID:3436
- C:\Windows\System\vtKxOIa.exe
  C:\Windows\System\vtKxOIa.exe
  2⤵
  PID:3484
- C:\Windows\System\AVBNtGM.exe
  C:\Windows\System\AVBNtGM.exe
  2⤵
  PID:3496
- C:\Windows\System\KtbTpjF.exe
  C:\Windows\System\KtbTpjF.exe
  2⤵
  PID:3188
- C:\Windows\System\humsMGT.exe
  C:\Windows\System\humsMGT.exe
  2⤵
  PID:3120
- C:\Windows\System\BNLjZJT.exe
  C:\Windows\System\BNLjZJT.exe
  2⤵
  PID:3284
- C:\Windows\System\GOmbmuu.exe
  C:\Windows\System\GOmbmuu.exe
  2⤵
  PID:3392
- C:\Windows\System\IhpDDyj.exe
  C:\Windows\System\IhpDDyj.exe
  2⤵
  PID:3456
- C:\Windows\System\UiPuatl.exe
  C:\Windows\System\UiPuatl.exe
  2⤵
  PID:3472
- C:\Windows\System\tOVRLtd.exe
  C:\Windows\System\tOVRLtd.exe
  2⤵
  PID:3512
- C:\Windows\System\tpniMTw.exe
  C:\Windows\System\tpniMTw.exe
  2⤵
  PID:3588
- C:\Windows\System\wcQEQNt.exe
  C:\Windows\System\wcQEQNt.exe
  2⤵
  PID:3624
- C:\Windows\System\Tshtbqx.exe
  C:\Windows\System\Tshtbqx.exe
  2⤵
  PID:3652
- C:\Windows\System\AqQtuUW.exe
  C:\Windows\System\AqQtuUW.exe
  2⤵
  PID:3640
- C:\Windows\System\RMSSfGH.exe
  C:\Windows\System\RMSSfGH.exe
  2⤵
  PID:3700
- C:\Windows\System\FOOYVzS.exe
  C:\Windows\System\FOOYVzS.exe
  2⤵
  PID:3712
- C:\Windows\System\PYouLka.exe
  C:\Windows\System\PYouLka.exe
  2⤵
  PID:3732
- C:\Windows\System\CnsQvjm.exe
  C:\Windows\System\CnsQvjm.exe
  2⤵
  PID:3772
- C:\Windows\System\WrHndAg.exe
  C:\Windows\System\WrHndAg.exe
  2⤵
  PID:3812
- C:\Windows\System\PSfzfft.exe
  C:\Windows\System\PSfzfft.exe
  2⤵
  PID:3860
- C:\Windows\System\lyjVrMR.exe
  C:\Windows\System\lyjVrMR.exe
  2⤵
  PID:3900
- C:\Windows\System\ZXjyiIZ.exe
  C:\Windows\System\ZXjyiIZ.exe
  2⤵
  PID:3968
- C:\Windows\System\CzfgPov.exe
  C:\Windows\System\CzfgPov.exe
  2⤵
  PID:3844
- C:\Windows\System\wlAHWHW.exe
  C:\Windows\System\wlAHWHW.exe
  2⤵
  PID:3952
- C:\Windows\System\HZBFEmO.exe
  C:\Windows\System\HZBFEmO.exe
  2⤵
  PID:3976
- C:\Windows\System\cpoJhCu.exe
  C:\Windows\System\cpoJhCu.exe
  2⤵
  PID:4024
- C:\Windows\System\nmNllzb.exe
  C:\Windows\System\nmNllzb.exe
  2⤵
  PID:4012
- C:\Windows\System\eApQzeC.exe
  C:\Windows\System\eApQzeC.exe
  2⤵
  PID:4044
- C:\Windows\System\uBIknht.exe
  C:\Windows\System\uBIknht.exe
  2⤵
  PID:1508
- C:\Windows\System\VgdTpcl.exe
  C:\Windows\System\VgdTpcl.exe
  2⤵
  PID:3332
- C:\Windows\System\deJaBLM.exe
  C:\Windows\System\deJaBLM.exe
  2⤵
  PID:1180
- C:\Windows\System\xQopOuV.exe
  C:\Windows\System\xQopOuV.exe
  2⤵
  PID:3468
- C:\Windows\System\okloqhx.exe
  C:\Windows\System\okloqhx.exe
  2⤵
  PID:3420
- C:\Windows\System\ptyYlri.exe
  C:\Windows\System\ptyYlri.exe
  2⤵
  PID:3168
- C:\Windows\System\fOGmyAm.exe
  C:\Windows\System\fOGmyAm.exe
  2⤵
  PID:3408
- C:\Windows\System\OPngQXr.exe
  C:\Windows\System\OPngQXr.exe
  2⤵
  PID:3248
- C:\Windows\System\FIyitxE.exe
  C:\Windows\System\FIyitxE.exe
  2⤵
  PID:3532
- C:\Windows\System\ldKobAB.exe
  C:\Windows\System\ldKobAB.exe
  2⤵
  PID:3660
- C:\Windows\System\QSgtDxq.exe
  C:\Windows\System\QSgtDxq.exe
  2⤵
  PID:3568
- C:\Windows\System\ZwrTKFY.exe
  C:\Windows\System\ZwrTKFY.exe
  2⤵
  PID:3696
- C:\Windows\System\wqCgBdi.exe
  C:\Windows\System\wqCgBdi.exe
  2⤵
  PID:3572
- C:\Windows\System\BRDJovu.exe
  C:\Windows\System\BRDJovu.exe
  2⤵
  PID:3608
- C:\Windows\System\ocEgaKE.exe
  C:\Windows\System\ocEgaKE.exe
  2⤵
  PID:3832
- C:\Windows\System\fqxAoVb.exe
  C:\Windows\System\fqxAoVb.exe
  2⤵
  PID:3992
- C:\Windows\System\dCXDcJc.exe
  C:\Windows\System\dCXDcJc.exe
  2⤵
  PID:1264
- C:\Windows\System\GoNocKp.exe
  C:\Windows\System\GoNocKp.exe
  2⤵
  PID:3788
- C:\Windows\System\ZWGDIcB.exe
  C:\Windows\System\ZWGDIcB.exe
  2⤵
  PID:2076
- C:\Windows\System\SBljnZJ.exe
  C:\Windows\System\SBljnZJ.exe
  2⤵
  PID:3896
- C:\Windows\System\uQjecej.exe
  C:\Windows\System\uQjecej.exe
  2⤵
  PID:616
- C:\Windows\System\unGlxuU.exe
  C:\Windows\System\unGlxuU.exe
  2⤵
  PID:4060
- C:\Windows\System\IhiuJSH.exe
  C:\Windows\System\IhiuJSH.exe
  2⤵
  PID:1660
- C:\Windows\System\mVPFwnB.exe
  C:\Windows\System\mVPFwnB.exe
  2⤵
  PID:1888
- C:\Windows\System\OSgLnpN.exe
  C:\Windows\System\OSgLnpN.exe
  2⤵
  PID:1920
- C:\Windows\System\ZCFBBKD.exe
  C:\Windows\System\ZCFBBKD.exe
  2⤵
  PID:3452
- C:\Windows\System\ipwomBZ.exe
  C:\Windows\System\ipwomBZ.exe
  2⤵
  PID:3680
- C:\Windows\System\dGGCUiI.exe
  C:\Windows\System\dGGCUiI.exe
  2⤵
  PID:3676
- C:\Windows\System\GxIGviK.exe
  C:\Windows\System\GxIGviK.exe
  2⤵
  PID:4064
- C:\Windows\System\CjhdWfD.exe
  C:\Windows\System\CjhdWfD.exe
  2⤵
  PID:3876
- C:\Windows\System\pzsmBAq.exe
  C:\Windows\System\pzsmBAq.exe
  2⤵
  PID:1472
- C:\Windows\System\YQNSVhm.exe
  C:\Windows\System\YQNSVhm.exe
  2⤵
  PID:3480
- C:\Windows\System\EJaVwJK.exe
  C:\Windows\System\EJaVwJK.exe
  2⤵
  PID:3352
- C:\Windows\System\BtKtbFm.exe
  C:\Windows\System\BtKtbFm.exe
  2⤵
  PID:3576
- C:\Windows\System\FztUGzJ.exe
  C:\Windows\System\FztUGzJ.exe
  2⤵
  PID:3948
- C:\Windows\System\qQQCxJr.exe
  C:\Windows\System\qQQCxJr.exe
  2⤵
  PID:3864
- C:\Windows\System\SaxpOdx.exe
  C:\Windows\System\SaxpOdx.exe
  2⤵
  PID:1480
- C:\Windows\System\FOIkTXt.exe
  C:\Windows\System\FOIkTXt.exe
  2⤵
  PID:3412
- C:\Windows\System\agPVgpM.exe
  C:\Windows\System\agPVgpM.exe
  2⤵
  PID:3768
- C:\Windows\System\biemGOV.exe
  C:\Windows\System\biemGOV.exe
  2⤵
  PID:1928
- C:\Windows\System\xoqFAZV.exe
  C:\Windows\System\xoqFAZV.exe
  2⤵
  PID:3404
- C:\Windows\System\uYDTUZh.exe
  C:\Windows\System\uYDTUZh.exe
  2⤵
  PID:3912
- C:\Windows\System\tPAKvnt.exe
  C:\Windows\System\tPAKvnt.exe
  2⤵
  PID:1436
- C:\Windows\System\cKeogBC.exe
  C:\Windows\System\cKeogBC.exe
  2⤵
  PID:3140
- C:\Windows\System\HLmdUFa.exe
  C:\Windows\System\HLmdUFa.exe
  2⤵
  PID:1620
- C:\Windows\System\XDsOFnw.exe
  C:\Windows\System\XDsOFnw.exe
  2⤵
  PID:3504
- C:\Windows\System\baPTUwe.exe
  C:\Windows\System\baPTUwe.exe
  2⤵
  PID:3208
- C:\Windows\System\FgznHig.exe
  C:\Windows\System\FgznHig.exe
  2⤵
  PID:3604
- C:\Windows\System\ZqGpXMl.exe
  C:\Windows\System\ZqGpXMl.exe
  2⤵
  PID:3344
- C:\Windows\System\JywndAy.exe
  C:\Windows\System\JywndAy.exe
  2⤵
  PID:1748
- C:\Windows\System\nPGhXpD.exe
  C:\Windows\System\nPGhXpD.exe
  2⤵
  PID:4100
- C:\Windows\System\XFVtGHt.exe
  C:\Windows\System\XFVtGHt.exe
  2⤵
  PID:4116
- C:\Windows\System\wmFKIlz.exe
  C:\Windows\System\wmFKIlz.exe
  2⤵
  PID:4144
- C:\Windows\System\nbgtzAs.exe
  C:\Windows\System\nbgtzAs.exe
  2⤵
  PID:4164
- C:\Windows\System\HhuUQlL.exe
  C:\Windows\System\HhuUQlL.exe
  2⤵
  PID:4184
- C:\Windows\System\azvNftX.exe
  C:\Windows\System\azvNftX.exe
  2⤵
  PID:4200
- C:\Windows\System\uWkWKgv.exe
  C:\Windows\System\uWkWKgv.exe
  2⤵
  PID:4216
- C:\Windows\System\ovtNwkk.exe
  C:\Windows\System\ovtNwkk.exe
  2⤵
  PID:4232
- C:\Windows\System\GTdlecY.exe
  C:\Windows\System\GTdlecY.exe
  2⤵
  PID:4248
- C:\Windows\System\CXebgRV.exe
  C:\Windows\System\CXebgRV.exe
  2⤵
  PID:4264
- C:\Windows\System\VAXgfrO.exe
  C:\Windows\System\VAXgfrO.exe
  2⤵
  PID:4284
- C:\Windows\System\maHlgnN.exe
  C:\Windows\System\maHlgnN.exe
  2⤵
  PID:4300
- C:\Windows\System\QJSCrdJ.exe
  C:\Windows\System\QJSCrdJ.exe
  2⤵
  PID:4320
- C:\Windows\System\tnJtPWK.exe
  C:\Windows\System\tnJtPWK.exe
  2⤵
  PID:4356
- C:\Windows\System\LGfxpBb.exe
  C:\Windows\System\LGfxpBb.exe
  2⤵
  PID:4372
- C:\Windows\System\aegdNcA.exe
  C:\Windows\System\aegdNcA.exe
  2⤵
  PID:4388
- C:\Windows\System\zBhbLkM.exe
  C:\Windows\System\zBhbLkM.exe
  2⤵
  PID:4404
- C:\Windows\System\ioPFQVk.exe
  C:\Windows\System\ioPFQVk.exe
  2⤵
  PID:4428
- C:\Windows\System\hkyBEzf.exe
  C:\Windows\System\hkyBEzf.exe
  2⤵
  PID:4444
- C:\Windows\System\GnuEYIh.exe
  C:\Windows\System\GnuEYIh.exe
  2⤵
  PID:4460
- C:\Windows\System\VyuLSJO.exe
  C:\Windows\System\VyuLSJO.exe
  2⤵
  PID:4476
- C:\Windows\System\GPMXxGi.exe
  C:\Windows\System\GPMXxGi.exe
  2⤵
  PID:4492
- C:\Windows\System\qtSGloq.exe
  C:\Windows\System\qtSGloq.exe
  2⤵
  PID:4516
- C:\Windows\System\EkkYqMF.exe
  C:\Windows\System\EkkYqMF.exe
  2⤵
  PID:4572
- C:\Windows\System\EUxOKRl.exe
  C:\Windows\System\EUxOKRl.exe
  2⤵
  PID:4588
- C:\Windows\System\OuXZMFC.exe
  C:\Windows\System\OuXZMFC.exe
  2⤵
  PID:4604
- C:\Windows\System\ItsIypE.exe
  C:\Windows\System\ItsIypE.exe
  2⤵
  PID:4620
- C:\Windows\System\JgjNhcK.exe
  C:\Windows\System\JgjNhcK.exe
  2⤵
  PID:4636
- C:\Windows\System\BswoZeS.exe
  C:\Windows\System\BswoZeS.exe
  2⤵
  PID:4652
- C:\Windows\System\dbfgQVO.exe
  C:\Windows\System\dbfgQVO.exe
  2⤵
  PID:4668
- C:\Windows\System\LARQcpf.exe
  C:\Windows\System\LARQcpf.exe
  2⤵
  PID:4684
- C:\Windows\System\geZcaxp.exe
  C:\Windows\System\geZcaxp.exe
  2⤵
  PID:4700
- C:\Windows\System\yNnmItf.exe
  C:\Windows\System\yNnmItf.exe
  2⤵
  PID:4716
- C:\Windows\System\pOxXPsy.exe
  C:\Windows\System\pOxXPsy.exe
  2⤵
  PID:4736
- C:\Windows\System\SNyjhEW.exe
  C:\Windows\System\SNyjhEW.exe
  2⤵
  PID:4764
- C:\Windows\System\PoBjSFZ.exe
  C:\Windows\System\PoBjSFZ.exe
  2⤵
  PID:4780
- C:\Windows\System\UsUgFFO.exe
  C:\Windows\System\UsUgFFO.exe
  2⤵
  PID:4796
- C:\Windows\System\smVbgya.exe
  C:\Windows\System\smVbgya.exe
  2⤵
  PID:4812
- C:\Windows\System\dRGftER.exe
  C:\Windows\System\dRGftER.exe
  2⤵
  PID:4828
- C:\Windows\System\KFkgWWN.exe
  C:\Windows\System\KFkgWWN.exe
  2⤵
  PID:4844
- C:\Windows\System\ffGLOLK.exe
  C:\Windows\System\ffGLOLK.exe
  2⤵
  PID:4864
- C:\Windows\System\bBRbXSa.exe
  C:\Windows\System\bBRbXSa.exe
  2⤵
  PID:4880
- C:\Windows\System\pWBHEuW.exe
  C:\Windows\System\pWBHEuW.exe
  2⤵
  PID:4896
- C:\Windows\System\OLYQXDr.exe
  C:\Windows\System\OLYQXDr.exe
  2⤵
  PID:4912
- C:\Windows\System\vRlWPpe.exe
  C:\Windows\System\vRlWPpe.exe
  2⤵
  PID:4928
- C:\Windows\System\LhgBfHC.exe
  C:\Windows\System\LhgBfHC.exe
  2⤵
  PID:4944
- C:\Windows\System\pzWsTnQ.exe
  C:\Windows\System\pzWsTnQ.exe
  2⤵
  PID:4988
- C:\Windows\System\vFdRMtu.exe
  C:\Windows\System\vFdRMtu.exe
  2⤵
  PID:5020
- C:\Windows\System\mszNLpD.exe
  C:\Windows\System\mszNLpD.exe
  2⤵
  PID:5040
- C:\Windows\System\xnfRKqX.exe
  C:\Windows\System\xnfRKqX.exe
  2⤵
  PID:5056
- C:\Windows\System\aOkXoTR.exe
  C:\Windows\System\aOkXoTR.exe
  2⤵
  PID:5112
- C:\Windows\System\WZWVOGu.exe
  C:\Windows\System\WZWVOGu.exe
  2⤵
  PID:4008
- C:\Windows\System\zkNftMr.exe
  C:\Windows\System\zkNftMr.exe
  2⤵
  PID:4132
- C:\Windows\System\ZikhLXu.exe
  C:\Windows\System\ZikhLXu.exe
  2⤵
  PID:4212
- C:\Windows\System\AvnnOro.exe
  C:\Windows\System\AvnnOro.exe
  2⤵
  PID:4244
- C:\Windows\System\bvNLmqn.exe
  C:\Windows\System\bvNLmqn.exe
  2⤵
  PID:4224
- C:\Windows\System\BqgpXBU.exe
  C:\Windows\System\BqgpXBU.exe
  2⤵
  PID:4292
- C:\Windows\System\ZRgCCqP.exe
  C:\Windows\System\ZRgCCqP.exe
  2⤵
  PID:4316
- C:\Windows\System\HnQrSHj.exe
  C:\Windows\System\HnQrSHj.exe
  2⤵
  PID:4352
- C:\Windows\System\RxMeYIy.exe
  C:\Windows\System\RxMeYIy.exe
  2⤵
  PID:4452
- C:\Windows\System\pgvCGLx.exe
  C:\Windows\System\pgvCGLx.exe
  2⤵
  PID:4524
- C:\Windows\System\QehxkwT.exe
  C:\Windows\System\QehxkwT.exe
  2⤵
  PID:4436
- C:\Windows\System\uVmfkOn.exe
  C:\Windows\System\uVmfkOn.exe
  2⤵
  PID:4472
- C:\Windows\System\UKAxliL.exe
  C:\Windows\System\UKAxliL.exe
  2⤵
  PID:4536
- C:\Windows\System\yuNZbaw.exe
  C:\Windows\System\yuNZbaw.exe
  2⤵
  PID:3400
- C:\Windows\System\MpRVhlD.exe
  C:\Windows\System\MpRVhlD.exe
  2⤵
  PID:4568
- C:\Windows\System\DTVLZad.exe
  C:\Windows\System\DTVLZad.exe
  2⤵
  PID:4632
- C:\Windows\System\PBoXScV.exe
  C:\Windows\System\PBoXScV.exe
  2⤵
  PID:4696
- C:\Windows\System\wljYkJB.exe
  C:\Windows\System\wljYkJB.exe
  2⤵
  PID:4732
- C:\Windows\System\HguDLZa.exe
  C:\Windows\System\HguDLZa.exe
  2⤵
  PID:4616
- C:\Windows\System\XYKGTjR.exe
  C:\Windows\System\XYKGTjR.exe
  2⤵
  PID:4776
- C:\Windows\System\AeRPtMx.exe
  C:\Windows\System\AeRPtMx.exe
  2⤵
  PID:4836
- C:\Windows\System\IynCgQI.exe
  C:\Windows\System\IynCgQI.exe
  2⤵
  PID:4908
- C:\Windows\System\DjIhDSH.exe
  C:\Windows\System\DjIhDSH.exe
  2⤵
  PID:4748
- C:\Windows\System\luLPpVG.exe
  C:\Windows\System\luLPpVG.exe
  2⤵
  PID:4752
- C:\Windows\System\sQqPDna.exe
  C:\Windows\System\sQqPDna.exe
  2⤵
  PID:4852
- C:\Windows\System\AdUyHxz.exe
  C:\Windows\System\AdUyHxz.exe
  2⤵
  PID:4892
- C:\Windows\System\uiXZvee.exe
  C:\Windows\System\uiXZvee.exe
  2⤵
  PID:4972
- C:\Windows\System\PBWxmUg.exe
  C:\Windows\System\PBWxmUg.exe
  2⤵
  PID:4984
- C:\Windows\System\UTKTEKw.exe
  C:\Windows\System\UTKTEKw.exe
  2⤵
  PID:5008
- C:\Windows\System\jajTzep.exe
  C:\Windows\System\jajTzep.exe
  2⤵
  PID:5072
- C:\Windows\System\blqvjCl.exe
  C:\Windows\System\blqvjCl.exe
  2⤵
  PID:5064
- C:\Windows\System\wsmXWOd.exe
  C:\Windows\System\wsmXWOd.exe
  2⤵
  PID:5088
- C:\Windows\System\MhvCvti.exe
  C:\Windows\System\MhvCvti.exe
  2⤵
  PID:3368
- C:\Windows\System\KKLOkpV.exe
  C:\Windows\System\KKLOkpV.exe
  2⤵
  PID:4276
- C:\Windows\System\XjKCWDZ.exe
  C:\Windows\System\XjKCWDZ.exe
  2⤵
  PID:3556
- C:\Windows\System\PLLwySf.exe
  C:\Windows\System\PLLwySf.exe
  2⤵
  PID:4240
- C:\Windows\System\cmgkomK.exe
  C:\Windows\System\cmgkomK.exe
  2⤵
  PID:4416
- C:\Windows\System\NRBfYRV.exe
  C:\Windows\System\NRBfYRV.exe
  2⤵
  PID:4504
- C:\Windows\System\yGroaMW.exe
  C:\Windows\System\yGroaMW.exe
  2⤵
  PID:4560
- C:\Windows\System\RXexeRh.exe
  C:\Windows\System\RXexeRh.exe
  2⤵
  PID:4692
- C:\Windows\System\IhfADRp.exe
  C:\Windows\System\IhfADRp.exe
  2⤵
  PID:4584
- C:\Windows\System\topKCqn.exe
  C:\Windows\System\topKCqn.exe
  2⤵
  PID:4808
- C:\Windows\System\VLUVkSC.exe
  C:\Windows\System\VLUVkSC.exe
  2⤵
  PID:4788
- C:\Windows\System\AQBHmIJ.exe
  C:\Windows\System\AQBHmIJ.exe
  2⤵
  PID:4708
- C:\Windows\System\PzsRnFL.exe
  C:\Windows\System\PzsRnFL.exe
  2⤵
  PID:4820
- C:\Windows\System\UjomoaS.exe
  C:\Windows\System\UjomoaS.exe
  2⤵
  PID:5036
- C:\Windows\System\QeRupWd.exe
  C:\Windows\System\QeRupWd.exe
  2⤵
  PID:4128
- C:\Windows\System\XubfuGS.exe
  C:\Windows\System\XubfuGS.exe
  2⤵
  PID:5000
- C:\Windows\System\TanCOrA.exe
  C:\Windows\System\TanCOrA.exe
  2⤵
  PID:5076
- C:\Windows\System\pgHIxnb.exe
  C:\Windows\System\pgHIxnb.exe
  2⤵
  PID:4260
- C:\Windows\System\seNNgSH.exe
  C:\Windows\System\seNNgSH.exe
  2⤵
  PID:4328
- C:\Windows\System\gKAhovo.exe
  C:\Windows\System\gKAhovo.exe
  2⤵
  PID:5084
- C:\Windows\System\dctHnXX.exe
  C:\Windows\System\dctHnXX.exe
  2⤵
  PID:4400
- C:\Windows\System\lwzevWz.exe
  C:\Windows\System\lwzevWz.exe
  2⤵
  PID:4364
- C:\Windows\System\QGdGjdT.exe
  C:\Windows\System\QGdGjdT.exe
  2⤵
  PID:4488
- C:\Windows\System\xxBEsmz.exe
  C:\Windows\System\xxBEsmz.exe
  2⤵
  PID:4724
- C:\Windows\System\SPIxZPC.exe
  C:\Windows\System\SPIxZPC.exe
  2⤵
  PID:4772
- C:\Windows\System\FMHxGth.exe
  C:\Windows\System\FMHxGth.exe
  2⤵
  PID:4956
- C:\Windows\System\opqrcGv.exe
  C:\Windows\System\opqrcGv.exe
  2⤵
  PID:4980
- C:\Windows\System\aaEApHg.exe
  C:\Windows\System\aaEApHg.exe
  2⤵
  PID:4556
- C:\Windows\System\mUixRRz.exe
  C:\Windows\System\mUixRRz.exe
  2⤵
  PID:5028
- C:\Windows\System\ElXCUbG.exe
  C:\Windows\System\ElXCUbG.exe
  2⤵
  PID:5132
- C:\Windows\System\guXHwbV.exe
  C:\Windows\System\guXHwbV.exe
  2⤵
  PID:5148
- C:\Windows\System\cxNsWXx.exe
  C:\Windows\System\cxNsWXx.exe
  2⤵
  PID:5164
- C:\Windows\System\oEtQPUb.exe
  C:\Windows\System\oEtQPUb.exe
  2⤵
  PID:5184
- C:\Windows\System\tpIHnNx.exe
  C:\Windows\System\tpIHnNx.exe
  2⤵
  PID:5200
- C:\Windows\System\pVsXMQb.exe
  C:\Windows\System\pVsXMQb.exe
  2⤵
  PID:5220
- C:\Windows\System\mzosikr.exe
  C:\Windows\System\mzosikr.exe
  2⤵
  PID:5236
- C:\Windows\System\TQvbowK.exe
  C:\Windows\System\TQvbowK.exe
  2⤵
  PID:5256
- C:\Windows\System\zAvEkdt.exe
  C:\Windows\System\zAvEkdt.exe
  2⤵
  PID:5272
- C:\Windows\System\tdKzxzv.exe
  C:\Windows\System\tdKzxzv.exe
  2⤵
  PID:5288
- C:\Windows\System\BnxSwyJ.exe
  C:\Windows\System\BnxSwyJ.exe
  2⤵
  PID:5308
- C:\Windows\System\rQdLlYj.exe
  C:\Windows\System\rQdLlYj.exe
  2⤵
  PID:5328
- C:\Windows\System\nTUbJeY.exe
  C:\Windows\System\nTUbJeY.exe
  2⤵
  PID:5344
- C:\Windows\System\RQNQirT.exe
  C:\Windows\System\RQNQirT.exe
  2⤵
  PID:5360
- C:\Windows\System\gBkbqmQ.exe
  C:\Windows\System\gBkbqmQ.exe
  2⤵
  PID:5376
- C:\Windows\System\oUNPwYp.exe
  C:\Windows\System\oUNPwYp.exe
  2⤵
  PID:5400
- C:\Windows\System\DvTofAZ.exe
  C:\Windows\System\DvTofAZ.exe
  2⤵
  PID:5416
- C:\Windows\System\MPKnufX.exe
  C:\Windows\System\MPKnufX.exe
  2⤵
  PID:5432
- C:\Windows\System\XvUjeFP.exe
  C:\Windows\System\XvUjeFP.exe
  2⤵
  PID:5452
- C:\Windows\System\fApMKEf.exe
  C:\Windows\System\fApMKEf.exe
  2⤵
  PID:5468
- C:\Windows\System\UZgaqpm.exe
  C:\Windows\System\UZgaqpm.exe
  2⤵
  PID:5484
- C:\Windows\System\iskJvJG.exe
  C:\Windows\System\iskJvJG.exe
  2⤵
  PID:5500
- C:\Windows\System\XvwPRRN.exe
  C:\Windows\System\XvwPRRN.exe
  2⤵
  PID:5520
- C:\Windows\System\WMcuZRV.exe
  C:\Windows\System\WMcuZRV.exe
  2⤵
  PID:5536
- C:\Windows\System\nkaTSWu.exe
  C:\Windows\System\nkaTSWu.exe
  2⤵
  PID:5552
- C:\Windows\System\cQuhkrP.exe
  C:\Windows\System\cQuhkrP.exe
  2⤵
  PID:5568
- C:\Windows\System\ijbivwL.exe
  C:\Windows\System\ijbivwL.exe
  2⤵
  PID:5584
- C:\Windows\System\dbCnxeW.exe
  C:\Windows\System\dbCnxeW.exe
  2⤵
  PID:5600
- C:\Windows\System\sjmwVcf.exe
  C:\Windows\System\sjmwVcf.exe
  2⤵
  PID:5620
- C:\Windows\System\oDwSyLr.exe
  C:\Windows\System\oDwSyLr.exe
  2⤵
  PID:5636
- C:\Windows\System\QolmgSk.exe
  C:\Windows\System\QolmgSk.exe
  2⤵
  PID:5652
- C:\Windows\System\UDmVPhh.exe
  C:\Windows\System\UDmVPhh.exe
  2⤵
  PID:5668
- C:\Windows\System\BuUkkRa.exe
  C:\Windows\System\BuUkkRa.exe
  2⤵
  PID:5684
- C:\Windows\System\YqaHMnt.exe
  C:\Windows\System\YqaHMnt.exe
  2⤵
  PID:5700
- C:\Windows\System\UqQMgKD.exe
  C:\Windows\System\UqQMgKD.exe
  2⤵
  PID:5720
- C:\Windows\System\RSQatop.exe
  C:\Windows\System\RSQatop.exe
  2⤵
  PID:5736
- C:\Windows\System\XsEXfAK.exe
  C:\Windows\System\XsEXfAK.exe
  2⤵
  PID:5756
- C:\Windows\System\OqIJWZN.exe
  C:\Windows\System\OqIJWZN.exe
  2⤵
  PID:5772
- C:\Windows\System\XOpcIDT.exe
  C:\Windows\System\XOpcIDT.exe
  2⤵
  PID:5792
- C:\Windows\System\iDuIlBL.exe
  C:\Windows\System\iDuIlBL.exe
  2⤵
  PID:5808
- C:\Windows\System\AFvdCzy.exe
  C:\Windows\System\AFvdCzy.exe
  2⤵
  PID:5824
- C:\Windows\System\FCvajiR.exe
  C:\Windows\System\FCvajiR.exe
  2⤵
  PID:5840
- C:\Windows\System\vgRauCY.exe
  C:\Windows\System\vgRauCY.exe
  2⤵
  PID:5856
- C:\Windows\System\gKsAXZn.exe
  C:\Windows\System\gKsAXZn.exe
  2⤵
  PID:5872
- C:\Windows\System\cSOuIsD.exe
  C:\Windows\System\cSOuIsD.exe
  2⤵
  PID:5888
- C:\Windows\System\nKcGfji.exe
  C:\Windows\System\nKcGfji.exe
  2⤵
  PID:5904
- C:\Windows\System\RhEwZCB.exe
  C:\Windows\System\RhEwZCB.exe
  2⤵
  PID:5924
- C:\Windows\System\kfdtgeZ.exe
  C:\Windows\System\kfdtgeZ.exe
  2⤵
  PID:5940
- C:\Windows\System\kgXZTkR.exe
  C:\Windows\System\kgXZTkR.exe
  2⤵
  PID:5956
- C:\Windows\System\emWnEkW.exe
  C:\Windows\System\emWnEkW.exe
  2⤵
  PID:5972
- C:\Windows\System\uVLUSJD.exe
  C:\Windows\System\uVLUSJD.exe
  2⤵
  PID:5988
- C:\Windows\System\HuvMugS.exe
  C:\Windows\System\HuvMugS.exe
  2⤵
  PID:6004
- C:\Windows\System\sFaXQPX.exe
  C:\Windows\System\sFaXQPX.exe
  2⤵
  PID:6020
- C:\Windows\System\xOczMfV.exe
  C:\Windows\System\xOczMfV.exe
  2⤵
  PID:6036
- C:\Windows\System\OjvWRYB.exe
  C:\Windows\System\OjvWRYB.exe
  2⤵
  PID:6056
- C:\Windows\System\iOZeERb.exe
  C:\Windows\System\iOZeERb.exe
  2⤵
  PID:6076
- C:\Windows\System\xgSGTPV.exe
  C:\Windows\System\xgSGTPV.exe
  2⤵
  PID:6092
- C:\Windows\System\snWrZvX.exe
  C:\Windows\System\snWrZvX.exe
  2⤵
  PID:6108
- C:\Windows\System\LcchTkc.exe
  C:\Windows\System\LcchTkc.exe
  2⤵
  PID:6124
- C:\Windows\System\VtEguSj.exe
  C:\Windows\System\VtEguSj.exe
  2⤵
  PID:6140
- C:\Windows\System\TbSmqIe.exe
  C:\Windows\System\TbSmqIe.exe
  2⤵
  PID:5176
- C:\Windows\System\HomOtuM.exe
  C:\Windows\System\HomOtuM.exe
  2⤵
  PID:4544
- C:\Windows\System\uOOrMrM.exe
  C:\Windows\System\uOOrMrM.exe
  2⤵
  PID:5068
- C:\Windows\System\WCOGqjE.exe
  C:\Windows\System\WCOGqjE.exe
  2⤵
  PID:5140
- C:\Windows\System\sVleAvd.exe
  C:\Windows\System\sVleAvd.exe
  2⤵
  PID:5212
- C:\Windows\System\miHqMLD.exe
  C:\Windows\System\miHqMLD.exe
  2⤵
  PID:5252
- C:\Windows\System\zbEijDy.exe
  C:\Windows\System\zbEijDy.exe
  2⤵
  PID:5156
- C:\Windows\System\tVsFhla.exe
  C:\Windows\System\tVsFhla.exe
  2⤵
  PID:5268
- C:\Windows\System\FnnNLay.exe
  C:\Windows\System\FnnNLay.exe
  2⤵
  PID:5316
- C:\Windows\System\TAzKMmZ.exe
  C:\Windows\System\TAzKMmZ.exe
  2⤵
  PID:5356
- C:\Windows\System\NRaDXhk.exe
  C:\Windows\System\NRaDXhk.exe
  2⤵
  PID:5396
- C:\Windows\System\MxOrNgZ.exe
  C:\Windows\System\MxOrNgZ.exe
  2⤵
  PID:5304
- C:\Windows\System\zuFEoBl.exe
  C:\Windows\System\zuFEoBl.exe
  2⤵
  PID:4412
- C:\Windows\System\oyJpPCN.exe
  C:\Windows\System\oyJpPCN.exe
  2⤵
  PID:5412
- C:\Windows\System\gZQxmGo.exe
  C:\Windows\System\gZQxmGo.exe
  2⤵
  PID:5476
- C:\Windows\System\AoazQQC.exe
  C:\Windows\System\AoazQQC.exe
  2⤵
  PID:5560
- C:\Windows\System\EwSyyUh.exe
  C:\Windows\System\EwSyyUh.exe
  2⤵
  PID:5592
- C:\Windows\System\PdAnfzf.exe
  C:\Windows\System\PdAnfzf.exe
  2⤵
  PID:5576
- C:\Windows\System\lziNjys.exe
  C:\Windows\System\lziNjys.exe
  2⤵
  PID:5612
- C:\Windows\System\iGOCSUT.exe
  C:\Windows\System\iGOCSUT.exe
  2⤵
  PID:5692
- C:\Windows\System\ywfYGnW.exe
  C:\Windows\System\ywfYGnW.exe
  2⤵
  PID:5648
- C:\Windows\System\RqbWgAe.exe
  C:\Windows\System\RqbWgAe.exe
  2⤵
  PID:5708
- C:\Windows\System\NWJYSlu.exe
  C:\Windows\System\NWJYSlu.exe
  2⤵
  PID:5768
- C:\Windows\System\TUzqbvl.exe
  C:\Windows\System\TUzqbvl.exe
  2⤵
  PID:5832
- C:\Windows\System\fHdhJPB.exe
  C:\Windows\System\fHdhJPB.exe
  2⤵
  PID:5784
- C:\Windows\System\mXJzSTi.exe
  C:\Windows\System\mXJzSTi.exe
  2⤵
  PID:5864
- C:\Windows\System\wSDbIOQ.exe
  C:\Windows\System\wSDbIOQ.exe
  2⤵
  PID:5848
- C:\Windows\System\NZlBGIH.exe
  C:\Windows\System\NZlBGIH.exe
  2⤵
  PID:5968
- C:\Windows\System\oqtdwRE.exe
  C:\Windows\System\oqtdwRE.exe
  2⤵
  PID:6032
- C:\Windows\System\omJfLWG.exe
  C:\Windows\System\omJfLWG.exe
  2⤵
  PID:5884
- C:\Windows\System\tQwJkdx.exe
  C:\Windows\System\tQwJkdx.exe
  2⤵
  PID:5916
- C:\Windows\System\ysSNwZF.exe
  C:\Windows\System\ysSNwZF.exe
  2⤵
  PID:6136
- C:\Windows\System\HFRjQPe.exe
  C:\Windows\System\HFRjQPe.exe
  2⤵
  PID:6016
- C:\Windows\System\LcgblqZ.exe
  C:\Windows\System\LcgblqZ.exe
  2⤵
  PID:4380
- C:\Windows\System\IViGkfT.exe
  C:\Windows\System\IViGkfT.exe
  2⤵
  PID:5952
- C:\Windows\System\pLhrmJe.exe
  C:\Windows\System\pLhrmJe.exe
  2⤵
  PID:5172
- C:\Windows\System\MCwRoBg.exe
  C:\Windows\System\MCwRoBg.exe
  2⤵
  PID:4756
- C:\Windows\System\UJKWPub.exe
  C:\Windows\System\UJKWPub.exe
  2⤵
  PID:6116
- C:\Windows\System\vghOFXi.exe
  C:\Windows\System\vghOFXi.exe
  2⤵
  PID:5144
- C:\Windows\System\ObukIik.exe
  C:\Windows\System\ObukIik.exe
  2⤵
  PID:5280
- C:\Windows\System\jXSCXim.exe
  C:\Windows\System\jXSCXim.exe
  2⤵
  PID:5300
- C:\Windows\System\XfskuIR.exe
  C:\Windows\System\XfskuIR.exe
  2⤵
  PID:5528
- C:\Windows\System\bCLuQbu.exe
  C:\Windows\System\bCLuQbu.exe
  2⤵
  PID:5392
- C:\Windows\System\yvvMaNt.exe
  C:\Windows\System\yvvMaNt.exe
  2⤵
  PID:5532
- C:\Windows\System\gEYewHL.exe
  C:\Windows\System\gEYewHL.exe
  2⤵
  PID:5660
- C:\Windows\System\RfBOpPP.exe
  C:\Windows\System\RfBOpPP.exe
  2⤵
  PID:5732
- C:\Windows\System\fwwjdRX.exe
  C:\Windows\System\fwwjdRX.exe
  2⤵
  PID:5816
- C:\Windows\System\LtODYIz.exe
  C:\Windows\System\LtODYIz.exe
  2⤵
  PID:5512
- C:\Windows\System\ThAQvpV.exe
  C:\Windows\System\ThAQvpV.exe
  2⤵
  PID:6072
- C:\Windows\System\epWfGSi.exe
  C:\Windows\System\epWfGSi.exe
  2⤵
  PID:5608
- C:\Windows\System\ufBDHnY.exe
  C:\Windows\System\ufBDHnY.exe
  2⤵
  PID:5836
- C:\Windows\System\vmolcJb.exe
  C:\Windows\System\vmolcJb.exe
  2⤵
  PID:5676
- C:\Windows\System\hoAhCgB.exe
  C:\Windows\System\hoAhCgB.exe
  2⤵
  PID:6068
- C:\Windows\System\AzYZZIW.exe
  C:\Windows\System\AzYZZIW.exe
  2⤵
  PID:6088
- C:\Windows\System\XESVitI.exe
  C:\Windows\System\XESVitI.exe
  2⤵
  PID:4940
- C:\Windows\System\zuivlMn.exe
  C:\Windows\System\zuivlMn.exe
  2⤵
  PID:4904
- C:\Windows\System\cPusIHt.exe
  C:\Windows\System\cPusIHt.exe
  2⤵
  PID:6000
- C:\Windows\System\gcChbtY.exe
  C:\Windows\System\gcChbtY.exe
  2⤵
  PID:6084
- C:\Windows\System\UFSdbFR.exe
  C:\Windows\System\UFSdbFR.exe
  2⤵
  PID:3160
- C:\Windows\System\kLYxYQf.exe
  C:\Windows\System\kLYxYQf.exe
  2⤵
  PID:6188
- C:\Windows\System\jXbNHMz.exe
  C:\Windows\System\jXbNHMz.exe
  2⤵
  PID:6352
- C:\Windows\System\kqDuVQR.exe
  C:\Windows\System\kqDuVQR.exe
  2⤵
  PID:6456
- C:\Windows\System\XSNCmfi.exe
  C:\Windows\System\XSNCmfi.exe
  2⤵
  PID:6472
- C:\Windows\System\kEZRkPn.exe
  C:\Windows\System\kEZRkPn.exe
  2⤵
  PID:6488
- C:\Windows\System\gJVsoGm.exe
  C:\Windows\System\gJVsoGm.exe
  2⤵
  PID:6504
- C:\Windows\System\cCNlWXe.exe
  C:\Windows\System\cCNlWXe.exe
  2⤵
  PID:6520
- C:\Windows\System\pgoLUmt.exe
  C:\Windows\System\pgoLUmt.exe
  2⤵
  PID:6536
- C:\Windows\System\EzMmSRZ.exe
  C:\Windows\System\EzMmSRZ.exe
  2⤵
  PID:6552
- C:\Windows\System\GwSnQEp.exe
  C:\Windows\System\GwSnQEp.exe
  2⤵
  PID:6572
- C:\Windows\System\kcvDRLD.exe
  C:\Windows\System\kcvDRLD.exe
  2⤵
  PID:6592
- C:\Windows\System\gdrUMtP.exe
  C:\Windows\System\gdrUMtP.exe
  2⤵
  PID:6608
- C:\Windows\System\xzggJxn.exe
  C:\Windows\System\xzggJxn.exe
  2⤵
  PID:6624
- C:\Windows\System\qTHKUWp.exe
  C:\Windows\System\qTHKUWp.exe
  2⤵
  PID:6640
- C:\Windows\System\iJsOQWU.exe
  C:\Windows\System\iJsOQWU.exe
  2⤵
  PID:6660
- C:\Windows\System\LQUECAo.exe
  C:\Windows\System\LQUECAo.exe
  2⤵
  PID:6800
- C:\Windows\System\agRLWMh.exe
  C:\Windows\System\agRLWMh.exe
  2⤵
  PID:6828
- C:\Windows\System\ELpsbfD.exe
  C:\Windows\System\ELpsbfD.exe
  2⤵
  PID:6852
- C:\Windows\System\fMJOORm.exe
  C:\Windows\System\fMJOORm.exe
  2⤵
  PID:6868
- C:\Windows\System\RjyMvHr.exe
  C:\Windows\System\RjyMvHr.exe
  2⤵
  PID:6884
- C:\Windows\System\sZwogif.exe
  C:\Windows\System\sZwogif.exe
  2⤵
  PID:6900
- C:\Windows\System\dNFkoVJ.exe
  C:\Windows\System\dNFkoVJ.exe
  2⤵
  PID:6916
- C:\Windows\System\vlieLZo.exe
  C:\Windows\System\vlieLZo.exe
  2⤵
  PID:6980
- C:\Windows\System\iBdtNYC.exe
  C:\Windows\System\iBdtNYC.exe
  2⤵
  PID:7000
- C:\Windows\System\CLhohhO.exe
  C:\Windows\System\CLhohhO.exe
  2⤵
  PID:7016
- C:\Windows\System\OgWENHF.exe
  C:\Windows\System\OgWENHF.exe
  2⤵
  PID:7032
- C:\Windows\System\BqFQUYn.exe
  C:\Windows\System\BqFQUYn.exe
  2⤵
  PID:7048
- C:\Windows\System\QYNBymu.exe
  C:\Windows\System\QYNBymu.exe
  2⤵
  PID:7064
- C:\Windows\System\jlxfrkx.exe
  C:\Windows\System\jlxfrkx.exe
  2⤵
  PID:7080
- C:\Windows\System\CubbWtf.exe
  C:\Windows\System\CubbWtf.exe
  2⤵
  PID:7096
- C:\Windows\System\gtEppSr.exe
  C:\Windows\System\gtEppSr.exe
  2⤵
  PID:7124
- C:\Windows\System\ALroyGq.exe
  C:\Windows\System\ALroyGq.exe
  2⤵
  PID:6148
- C:\Windows\System\WmCFOsJ.exe
  C:\Windows\System\WmCFOsJ.exe
  2⤵
  PID:6168
- C:\Windows\System\jGeTypG.exe
  C:\Windows\System\jGeTypG.exe
  2⤵
  PID:6176
- C:\Windows\System\UOxMPpo.exe
  C:\Windows\System\UOxMPpo.exe
  2⤵
  PID:6220
- C:\Windows\System\tzNMBGQ.exe
  C:\Windows\System\tzNMBGQ.exe
  2⤵
  PID:6428
- C:\Windows\System\ftbFZmO.exe
  C:\Windows\System\ftbFZmO.exe
  2⤵
  PID:6484
- C:\Windows\System\ONNRZZH.exe
  C:\Windows\System\ONNRZZH.exe
  2⤵
  PID:6284
- C:\Windows\System\AseUoKv.exe
  C:\Windows\System\AseUoKv.exe
  2⤵
  PID:6656
- C:\Windows\System\vbLzFwE.exe
  C:\Windows\System\vbLzFwE.exe
  2⤵
  PID:6600
- C:\Windows\System\YxDuEmZ.exe
  C:\Windows\System\YxDuEmZ.exe
  2⤵
  PID:6740
- C:\Windows\System\cUDiUve.exe
  C:\Windows\System\cUDiUve.exe
  2⤵
  PID:6764
- C:\Windows\System\sKHSHNA.exe
  C:\Windows\System\sKHSHNA.exe
  2⤵
  PID:6692
- C:\Windows\System\HhhQGFC.exe
  C:\Windows\System\HhhQGFC.exe
  2⤵
  PID:6700
- C:\Windows\System\OVYVMYw.exe
  C:\Windows\System\OVYVMYw.exe
  2⤵
  PID:6848
- C:\Windows\System\UfAcmkM.exe
  C:\Windows\System\UfAcmkM.exe
  2⤵
  PID:6928
- C:\Windows\System\tQbvekW.exe
  C:\Windows\System\tQbvekW.exe
  2⤵
  PID:6992
- C:\Windows\System\TzaeWqH.exe
  C:\Windows\System\TzaeWqH.exe
  2⤵
  PID:7028
- C:\Windows\System\kGHsruv.exe
  C:\Windows\System\kGHsruv.exe
  2⤵
  PID:6944
- C:\Windows\System\OGIkqLh.exe
  C:\Windows\System\OGIkqLh.exe
  2⤵
  PID:6968
- C:\Windows\System\wOqQFkD.exe
  C:\Windows\System\wOqQFkD.exe
  2⤵
  PID:7104
- C:\Windows\System\JzxkEsW.exe
  C:\Windows\System\JzxkEsW.exe
  2⤵
  PID:6156
- C:\Windows\System\VVUEnSO.exe
  C:\Windows\System\VVUEnSO.exe
  2⤵
  PID:6240
- C:\Windows\System\eFHFtWW.exe
  C:\Windows\System\eFHFtWW.exe
  2⤵
  PID:6196
- C:\Windows\System\GynIsqU.exe
  C:\Windows\System\GynIsqU.exe
  2⤵
  PID:6256
- C:\Windows\System\zeCgpnm.exe
  C:\Windows\System\zeCgpnm.exe
  2⤵
  PID:6364
- C:\Windows\System\jhPekMS.exe
  C:\Windows\System\jhPekMS.exe
  2⤵
  PID:7136
- C:\Windows\System\kIgVRct.exe
  C:\Windows\System\kIgVRct.exe
  2⤵
  PID:5128
- C:\Windows\System\mtuuQAF.exe
  C:\Windows\System\mtuuQAF.exe
  2⤵
  PID:6376
- C:\Windows\System\NOjiibW.exe
  C:\Windows\System\NOjiibW.exe
  2⤵
  PID:6248
- C:\Windows\System\CUXlpHX.exe
  C:\Windows\System\CUXlpHX.exe
  2⤵
  PID:7156
- C:\Windows\System\bHmDWDC.exe
  C:\Windows\System\bHmDWDC.exe
  2⤵
  PID:6400
- C:\Windows\System\dmSDldb.exe
  C:\Windows\System\dmSDldb.exe
  2⤵
  PID:6712
- C:\Windows\System\OVWZctg.exe
  C:\Windows\System\OVWZctg.exe
  2⤵
  PID:6784
- C:\Windows\System\IvSIjgL.exe
  C:\Windows\System\IvSIjgL.exe
  2⤵
  PID:6896
- C:\Windows\System\zBDtKTy.exe
  C:\Windows\System\zBDtKTy.exe
  2⤵
  PID:6908
- C:\Windows\System\UCJcWgu.exe
  C:\Windows\System\UCJcWgu.exe
  2⤵
  PID:6932
- C:\Windows\System\ITJzdfp.exe
  C:\Windows\System\ITJzdfp.exe
  2⤵
  PID:7040
- C:\Windows\System\awetvIy.exe
  C:\Windows\System\awetvIy.exe
  2⤵
  PID:6164
- C:\Windows\System\BXFdsvV.exe
  C:\Windows\System\BXFdsvV.exe
  2⤵
  PID:7092
- C:\Windows\System\mYCIeGw.exe
  C:\Windows\System\mYCIeGw.exe
  2⤵
  PID:6244
- C:\Windows\System\NeMqGAO.exe
  C:\Windows\System\NeMqGAO.exe
  2⤵
  PID:6408
- C:\Windows\System\wPJiidY.exe
  C:\Windows\System\wPJiidY.exe
  2⤵
  PID:6952
- C:\Windows\System\GCqYjSm.exe
  C:\Windows\System\GCqYjSm.exe
  2⤵
  PID:6420
- C:\Windows\System\uftPwVZ.exe
  C:\Windows\System\uftPwVZ.exe
  2⤵
  PID:6380
- C:\Windows\System\nlzChAm.exe
  C:\Windows\System\nlzChAm.exe
  2⤵
  PID:6044
- C:\Windows\System\ZmdJGsX.exe
  C:\Windows\System\ZmdJGsX.exe
  2⤵
  PID:6960
- C:\Windows\System\iMoootT.exe
  C:\Windows\System\iMoootT.exe
  2⤵
  PID:7112
- C:\Windows\System\LJARILH.exe
  C:\Windows\System\LJARILH.exe
  2⤵
  PID:7164
- C:\Windows\System\YEjQjLa.exe
  C:\Windows\System\YEjQjLa.exe
  2⤵
  PID:6544
- C:\Windows\System\WTuHvSm.exe
  C:\Windows\System\WTuHvSm.exe
  2⤵
  PID:1564
- C:\Windows\System\TvoXrKR.exe
  C:\Windows\System\TvoXrKR.exe
  2⤵
  PID:6672
- C:\Windows\System\CjxJOvh.exe
  C:\Windows\System\CjxJOvh.exe
  2⤵
  PID:6336
- C:\Windows\System\ggCoIdT.exe
  C:\Windows\System\ggCoIdT.exe
  2⤵
  PID:6444
- C:\Windows\System\RHLkiEL.exe
  C:\Windows\System\RHLkiEL.exe
  2⤵
  PID:6300
- C:\Windows\System\mfEvsNz.exe
  C:\Windows\System\mfEvsNz.exe
  2⤵
  PID:6200
- C:\Windows\System\MkGdoPa.exe
  C:\Windows\System\MkGdoPa.exe
  2⤵
  PID:6280
- C:\Windows\System\GRUXYOX.exe
  C:\Windows\System\GRUXYOX.exe
  2⤵
  PID:6332
- C:\Windows\System\nzeaWvl.exe
  C:\Windows\System\nzeaWvl.exe
  2⤵
  PID:6648
- C:\Windows\System\gzUIHkz.exe
  C:\Windows\System\gzUIHkz.exe
  2⤵
  PID:6752
- C:\Windows\System\gjDYtnI.exe
  C:\Windows\System\gjDYtnI.exe
  2⤵
  PID:6768
- C:\Windows\System\VhMuxkW.exe
  C:\Windows\System\VhMuxkW.exe
  2⤵
  PID:7144
- C:\Windows\System\ejkqEdU.exe
  C:\Windows\System\ejkqEdU.exe
  2⤵
  PID:1668
- C:\Windows\System\hiKnEJb.exe
  C:\Windows\System\hiKnEJb.exe
  2⤵
  PID:6580
- C:\Windows\System\nOKsUCo.exe
  C:\Windows\System\nOKsUCo.exe
  2⤵
  PID:6548
- C:\Windows\System\HyPQFOO.exe
  C:\Windows\System\HyPQFOO.exe
  2⤵
  PID:7044
- C:\Windows\System\VikkxJM.exe
  C:\Windows\System\VikkxJM.exe
  2⤵
  PID:6956
- C:\Windows\System\PihsfCi.exe
  C:\Windows\System\PihsfCi.exe
  2⤵
  PID:6268
- C:\Windows\System\IOZeFHE.exe
  C:\Windows\System\IOZeFHE.exe
  2⤵
  PID:6588
- C:\Windows\System\nhkrWYv.exe
  C:\Windows\System\nhkrWYv.exe
  2⤵
  PID:6824
- C:\Windows\System\LMxTzLe.exe
  C:\Windows\System\LMxTzLe.exe
  2⤵
  PID:6988
- C:\Windows\System\sSNNQaj.exe
  C:\Windows\System\sSNNQaj.exe
  2⤵
  PID:6792
- C:\Windows\System\nDfByjO.exe
  C:\Windows\System\nDfByjO.exe
  2⤵
  PID:6452
- C:\Windows\System\qiQjkjT.exe
  C:\Windows\System\qiQjkjT.exe
  2⤵
  PID:6448
- C:\Windows\System\NXDQtND.exe
  C:\Windows\System\NXDQtND.exe
  2⤵
  PID:6388
- C:\Windows\System\KmgzrZJ.exe
  C:\Windows\System\KmgzrZJ.exe
  2⤵
  PID:6320
- C:\Windows\System\jXpFlDA.exe
  C:\Windows\System\jXpFlDA.exe
  2⤵
  PID:6348
- C:\Windows\System\kVjKmdq.exe
  C:\Windows\System\kVjKmdq.exe
  2⤵
  PID:1992
- C:\Windows\System\ChjXTcI.exe
  C:\Windows\System\ChjXTcI.exe
  2⤵
  PID:6384
- C:\Windows\System\vQnzaUR.exe
  C:\Windows\System\vQnzaUR.exe
  2⤵
  PID:6560
- C:\Windows\System\BckTCtI.exe
  C:\Windows\System\BckTCtI.exe
  2⤵
  PID:6292
- C:\Windows\System\OxlFFMj.exe
  C:\Windows\System\OxlFFMj.exe
  2⤵
  PID:6424
- C:\Windows\System\TIptsku.exe
  C:\Windows\System\TIptsku.exe
  2⤵
  PID:6212
- C:\Windows\System\iUiebIv.exe
  C:\Windows\System\iUiebIv.exe
  2⤵
  PID:6636
- C:\Windows\System\GidMefi.exe
  C:\Windows\System\GidMefi.exe
  2⤵
  PID:6324
- C:\Windows\System\EBFeulG.exe
  C:\Windows\System\EBFeulG.exe
  2⤵
  PID:6412
- C:\Windows\System\HyffIAw.exe
  C:\Windows\System\HyffIAw.exe
  2⤵
  PID:2996
- C:\Windows\System\JmWPwVG.exe
  C:\Windows\System\JmWPwVG.exe
  2⤵
  PID:7184
- C:\Windows\System\JnyRicW.exe
  C:\Windows\System\JnyRicW.exe
  2⤵
  PID:7200
- C:\Windows\System\DCUreCK.exe
  C:\Windows\System\DCUreCK.exe
  2⤵
  PID:7216
- C:\Windows\System\FawmMhW.exe
  C:\Windows\System\FawmMhW.exe
  2⤵
  PID:7232
- C:\Windows\System\pCTBHWv.exe
  C:\Windows\System\pCTBHWv.exe
  2⤵
  PID:7252
- C:\Windows\System\LZdxoWv.exe
  C:\Windows\System\LZdxoWv.exe
  2⤵
  PID:7268
- C:\Windows\System\RfHDdOV.exe
  C:\Windows\System\RfHDdOV.exe
  2⤵
  PID:7284
- C:\Windows\System\VzYFXCJ.exe
  C:\Windows\System\VzYFXCJ.exe
  2⤵
  PID:7300
- C:\Windows\System\WDrwNhK.exe
  C:\Windows\System\WDrwNhK.exe
  2⤵
  PID:7316
- C:\Windows\System\PPVucZj.exe
  C:\Windows\System\PPVucZj.exe
  2⤵
  PID:7332
- C:\Windows\System\jOCkFYK.exe
  C:\Windows\System\jOCkFYK.exe
  2⤵
  PID:7348
- C:\Windows\System\FKecbWc.exe
  C:\Windows\System\FKecbWc.exe
  2⤵
  PID:7364
- C:\Windows\System\gmyRJuB.exe
  C:\Windows\System\gmyRJuB.exe
  2⤵
  PID:7380
- C:\Windows\System\MHkHsoy.exe
  C:\Windows\System\MHkHsoy.exe
  2⤵
  PID:7396
- C:\Windows\System\zXvEIME.exe
  C:\Windows\System\zXvEIME.exe
  2⤵
  PID:7412
- C:\Windows\System\xBIOYQr.exe
  C:\Windows\System\xBIOYQr.exe
  2⤵
  PID:7428
- C:\Windows\System\JKRcxgm.exe
  C:\Windows\System\JKRcxgm.exe
  2⤵
  PID:7444
- C:\Windows\System\dsezydP.exe
  C:\Windows\System\dsezydP.exe
  2⤵
  PID:7460
- C:\Windows\System\QSYLulp.exe
  C:\Windows\System\QSYLulp.exe
  2⤵
  PID:7476
- C:\Windows\System\eShfOer.exe
  C:\Windows\System\eShfOer.exe
  2⤵
  PID:7492
- C:\Windows\System\ncBtDZn.exe
  C:\Windows\System\ncBtDZn.exe
  2⤵
  PID:7508
- C:\Windows\System\fbHstiG.exe
  C:\Windows\System\fbHstiG.exe
  2⤵
  PID:7524
- C:\Windows\System\fVHARoE.exe
  C:\Windows\System\fVHARoE.exe
  2⤵
  PID:7540
- C:\Windows\System\lqelSSS.exe
  C:\Windows\System\lqelSSS.exe
  2⤵
  PID:7556
- C:\Windows\System\dBlJIfX.exe
  C:\Windows\System\dBlJIfX.exe
  2⤵
  PID:7572
- C:\Windows\System\GhrQfhX.exe
  C:\Windows\System\GhrQfhX.exe
  2⤵
  PID:7588
- C:\Windows\System\RcHNJtD.exe
  C:\Windows\System\RcHNJtD.exe
  2⤵
  PID:7604
- C:\Windows\System\MheQXwn.exe
  C:\Windows\System\MheQXwn.exe
  2⤵
  PID:7620
- C:\Windows\System\oKCvBeI.exe
  C:\Windows\System\oKCvBeI.exe
  2⤵
  PID:7636
- C:\Windows\System\crCOYok.exe
  C:\Windows\System\crCOYok.exe
  2⤵
  PID:7652
- C:\Windows\System\wzRzMgU.exe
  C:\Windows\System\wzRzMgU.exe
  2⤵
  PID:7668
- C:\Windows\System\pLCWqRW.exe
  C:\Windows\System\pLCWqRW.exe
  2⤵
  PID:7684
- C:\Windows\System\KXntaIQ.exe
  C:\Windows\System\KXntaIQ.exe
  2⤵
  PID:7700
- C:\Windows\System\fWpkkLc.exe
  C:\Windows\System\fWpkkLc.exe
  2⤵
  PID:7716
- C:\Windows\System\qaIMFnj.exe
  C:\Windows\System\qaIMFnj.exe
  2⤵
  PID:7732
- C:\Windows\System\quXZMmJ.exe
  C:\Windows\System\quXZMmJ.exe
  2⤵
  PID:7748
- C:\Windows\System\npEIxOH.exe
  C:\Windows\System\npEIxOH.exe
  2⤵
  PID:7764
- C:\Windows\System\vVGOMVG.exe
  C:\Windows\System\vVGOMVG.exe
  2⤵
  PID:7780
- C:\Windows\System\sKhbNbX.exe
  C:\Windows\System\sKhbNbX.exe
  2⤵
  PID:7796
- C:\Windows\System\AXUPeZy.exe
  C:\Windows\System\AXUPeZy.exe
  2⤵
  PID:7812
- C:\Windows\System\MXGdZtC.exe
  C:\Windows\System\MXGdZtC.exe
  2⤵
  PID:7828
- C:\Windows\System\QHuGGnr.exe
  C:\Windows\System\QHuGGnr.exe
  2⤵
  PID:7844
- C:\Windows\System\WxgidQY.exe
  C:\Windows\System\WxgidQY.exe
  2⤵
  PID:7860
- C:\Windows\System\FMmzkLv.exe
  C:\Windows\System\FMmzkLv.exe
  2⤵
  PID:7876
- C:\Windows\System\ZtbmAod.exe
  C:\Windows\System\ZtbmAod.exe
  2⤵
  PID:7892
- C:\Windows\System\QwKvMnH.exe
  C:\Windows\System\QwKvMnH.exe
  2⤵
  PID:7908
- C:\Windows\System\rvGSSgK.exe
  C:\Windows\System\rvGSSgK.exe
  2⤵
  PID:7924
- C:\Windows\System\vYLIfyY.exe
  C:\Windows\System\vYLIfyY.exe
  2⤵
  PID:7940
- C:\Windows\System\rsGfMVO.exe
  C:\Windows\System\rsGfMVO.exe
  2⤵
  PID:7956
- C:\Windows\System\AxaqsxB.exe
  C:\Windows\System\AxaqsxB.exe
  2⤵
  PID:7972
- C:\Windows\System\tWmxFSK.exe
  C:\Windows\System\tWmxFSK.exe
  2⤵
  PID:7988
- C:\Windows\System\HQifrUe.exe
  C:\Windows\System\HQifrUe.exe
  2⤵
  PID:8004
- C:\Windows\System\yzUgGpV.exe
  C:\Windows\System\yzUgGpV.exe
  2⤵
  PID:8020
- C:\Windows\System\CBHxFgv.exe
  C:\Windows\System\CBHxFgv.exe
  2⤵
  PID:8036
- C:\Windows\System\nhgUGtP.exe
  C:\Windows\System\nhgUGtP.exe
  2⤵
  PID:8052
- C:\Windows\System\CRLbrYa.exe
  C:\Windows\System\CRLbrYa.exe
  2⤵
  PID:8068
- C:\Windows\System\XPHhvgx.exe
  C:\Windows\System\XPHhvgx.exe
  2⤵
  PID:8088
- C:\Windows\System\ewEKZAi.exe
  C:\Windows\System\ewEKZAi.exe
  2⤵
  PID:8104
- C:\Windows\System\dNZdeBF.exe
  C:\Windows\System\dNZdeBF.exe
  2⤵
  PID:8120
- C:\Windows\System\vaSpgvy.exe
  C:\Windows\System\vaSpgvy.exe
  2⤵
  PID:8136
- C:\Windows\System\vYPkfDa.exe
  C:\Windows\System\vYPkfDa.exe
  2⤵
  PID:8152
- C:\Windows\System\JukaVWn.exe
  C:\Windows\System\JukaVWn.exe
  2⤵
  PID:8168
- C:\Windows\System\KavDdPH.exe
  C:\Windows\System\KavDdPH.exe
  2⤵
  PID:8184
- C:\Windows\System\tEfQGkk.exe
  C:\Windows\System\tEfQGkk.exe
  2⤵
  PID:6820
- C:\Windows\System\DoeYgIo.exe
  C:\Windows\System\DoeYgIo.exe
  2⤵
  PID:5340
- C:\Windows\System\czUOgyA.exe
  C:\Windows\System\czUOgyA.exe
  2⤵
  PID:6708
- C:\Windows\System\KEahMxl.exe
  C:\Windows\System\KEahMxl.exe
  2⤵
  PID:6316
- C:\Windows\System\xTXTzaf.exe
  C:\Windows\System\xTXTzaf.exe
  2⤵
  PID:6360
- C:\Windows\System\LENhdBl.exe
  C:\Windows\System\LENhdBl.exe
  2⤵
  PID:6184
- C:\Windows\System\UusHyIz.exe
  C:\Windows\System\UusHyIz.exe
  2⤵
  PID:6344
- C:\Windows\System\ePFQIFg.exe
  C:\Windows\System\ePFQIFg.exe
  2⤵
  PID:6568
- C:\Windows\System\oPazWru.exe
  C:\Windows\System\oPazWru.exe
  2⤵
  PID:6296
- C:\Windows\System\YxhvWGk.exe
  C:\Windows\System\YxhvWGk.exe
  2⤵
  PID:6760
- C:\Windows\System\HLvgivf.exe
  C:\Windows\System\HLvgivf.exe
  2⤵
  PID:7224
- C:\Windows\System\sXfhJqW.exe
  C:\Windows\System\sXfhJqW.exe
  2⤵
  PID:7208
- C:\Windows\System\AMkDOAi.exe
  C:\Windows\System\AMkDOAi.exe
  2⤵
  PID:7292
- C:\Windows\System\bOgNvzi.exe
  C:\Windows\System\bOgNvzi.exe
  2⤵
  PID:7328
- C:\Windows\System\blnpheA.exe
  C:\Windows\System\blnpheA.exe
  2⤵
  PID:7312
- C:\Windows\System\vOEuuao.exe
  C:\Windows\System\vOEuuao.exe
  2⤵
  PID:7388
- C:\Windows\System\arPGDkf.exe
  C:\Windows\System\arPGDkf.exe
  2⤵
  PID:7452
- C:\Windows\System\pTeyozu.exe
  C:\Windows\System\pTeyozu.exe
  2⤵
  PID:7436
- C:\Windows\System\nMZCmqH.exe
  C:\Windows\System\nMZCmqH.exe
  2⤵
  PID:7612
- C:\Windows\System\mqkeXOK.exe
  C:\Windows\System\mqkeXOK.exe
  2⤵
  PID:7648
- C:\Windows\System\pBnQdES.exe
  C:\Windows\System\pBnQdES.exe
  2⤵
  PID:7680
- C:\Windows\System\FgOqRtJ.exe
  C:\Windows\System\FgOqRtJ.exe
  2⤵
  PID:7712
- C:\Windows\System\ITNAvfq.exe
  C:\Windows\System\ITNAvfq.exe
  2⤵
  PID:7728
- C:\Windows\System\NANyRJw.exe
  C:\Windows\System\NANyRJw.exe
  2⤵
  PID:7692
- C:\Windows\System\pDwHOHo.exe
  C:\Windows\System\pDwHOHo.exe
  2⤵
  PID:7868
- C:\Windows\System\EAzrDUq.exe
  C:\Windows\System\EAzrDUq.exe
  2⤵
  PID:7888
- C:\Windows\System\yAoEWvs.exe
  C:\Windows\System\yAoEWvs.exe
  2⤵
  PID:7920
- C:\Windows\System\evTRdqz.exe
  C:\Windows\System\evTRdqz.exe
  2⤵
  PID:8012
- C:\Windows\System\ACMwTYh.exe
  C:\Windows\System\ACMwTYh.exe
  2⤵
  PID:8048
- C:\Windows\System\uwafAHb.exe
  C:\Windows\System\uwafAHb.exe
  2⤵
  PID:8100
- C:\Windows\System\XAjKIBE.exe
  C:\Windows\System\XAjKIBE.exe
  2⤵
  PID:8112
- C:\Windows\System\SafqgVJ.exe
  C:\Windows\System\SafqgVJ.exe
  2⤵
  PID:6584
- C:\Windows\System\JPiGnlo.exe
  C:\Windows\System\JPiGnlo.exe
  2⤵
  PID:8144
- C:\Windows\System\KEswiKL.exe
  C:\Windows\System\KEswiKL.exe
  2⤵
  PID:6464
- C:\Windows\System\skaXzcz.exe
  C:\Windows\System\skaXzcz.exe
  2⤵
  PID:7360
- C:\Windows\System\tMhGcnd.exe
  C:\Windows\System\tMhGcnd.exe
  2⤵
  PID:7372
- C:\Windows\System\msGQluW.exe
  C:\Windows\System\msGQluW.exe
  2⤵
  PID:7740
- C:\Windows\System\kiuFTKn.exe
  C:\Windows\System\kiuFTKn.exe
  2⤵
  PID:7632
- C:\Windows\System\qECzFnY.exe
  C:\Windows\System\qECzFnY.exe
  2⤵
  PID:7824
- C:\Windows\System\YtBsPQU.exe
  C:\Windows\System\YtBsPQU.exe
  2⤵
  PID:8044
- C:\Windows\System\vXsKuYO.exe
  C:\Windows\System\vXsKuYO.exe
  2⤵
  PID:6276
- C:\Windows\System\upqhzcc.exe
  C:\Windows\System\upqhzcc.exe
  2⤵
  PID:8032
- C:\Windows\System\LOBdLxB.exe
  C:\Windows\System\LOBdLxB.exe
  2⤵
  PID:7532
- C:\Windows\System\xJJucSC.exe
  C:\Windows\System\xJJucSC.exe
  2⤵
  PID:7468
- C:\Windows\System\zqmjvaw.exe
  C:\Windows\System\zqmjvaw.exe
  2⤵
  PID:1600
- C:\Windows\System\waEMQrK.exe
  C:\Windows\System\waEMQrK.exe
  2⤵
  PID:7760
- C:\Windows\System\iGQOiDk.exe
  C:\Windows\System\iGQOiDk.exe
  2⤵
  PID:7008
- C:\Windows\System\ocKiGFP.exe
  C:\Windows\System\ocKiGFP.exe
  2⤵
  PID:6440
- C:\Windows\System\PgeHshW.exe
  C:\Windows\System\PgeHshW.exe
  2⤵
  PID:6480
- C:\Windows\System\QPHbadr.exe
  C:\Windows\System\QPHbadr.exe
  2⤵
  PID:7356
- C:\Windows\System\yOsEJkp.exe
  C:\Windows\System\yOsEJkp.exe
  2⤵
  PID:7676
- C:\Windows\System\MTBxTsq.exe
  C:\Windows\System\MTBxTsq.exe
  2⤵
  PID:7808
- C:\Windows\System\bogGQBa.exe
  C:\Windows\System\bogGQBa.exe
  2⤵
  PID:7836
- C:\Windows\System\wjmppVJ.exe
  C:\Windows\System\wjmppVJ.exe
  2⤵
  PID:976
- C:\Windows\System\ldeMGIQ.exe
  C:\Windows\System\ldeMGIQ.exe
  2⤵
  PID:7856
- C:\Windows\System\ILfPGHl.exe
  C:\Windows\System\ILfPGHl.exe
  2⤵
  PID:8196
- C:\Windows\System\FfLysjf.exe
  C:\Windows\System\FfLysjf.exe
  2⤵
  PID:8212
- C:\Windows\System\uGTIvXb.exe
  C:\Windows\System\uGTIvXb.exe
  2⤵
  PID:8232
- C:\Windows\System\pSPiTbB.exe
  C:\Windows\System\pSPiTbB.exe
  2⤵
  PID:8248
- C:\Windows\System\QViYxue.exe
  C:\Windows\System\QViYxue.exe
  2⤵
  PID:8268
- C:\Windows\System\WKeWHMi.exe
  C:\Windows\System\WKeWHMi.exe
  2⤵
  PID:8284
- C:\Windows\System\WIOSgeq.exe
  C:\Windows\System\WIOSgeq.exe
  2⤵
  PID:8304
- C:\Windows\System\ugwuBoz.exe
  C:\Windows\System\ugwuBoz.exe
  2⤵
  PID:8320
- C:\Windows\System\cDklHqx.exe
  C:\Windows\System\cDklHqx.exe
  2⤵
  PID:8340
- C:\Windows\System\bjXjuQv.exe
  C:\Windows\System\bjXjuQv.exe
  2⤵
  PID:8356
- C:\Windows\System\xrvWWWF.exe
  C:\Windows\System\xrvWWWF.exe
  2⤵
  PID:8376
- C:\Windows\System\yBNLJNE.exe
  C:\Windows\System\yBNLJNE.exe
  2⤵
  PID:8392
- C:\Windows\System\ayppXzX.exe
  C:\Windows\System\ayppXzX.exe
  2⤵
  PID:8412
- C:\Windows\System\iKOsqJQ.exe
  C:\Windows\System\iKOsqJQ.exe
  2⤵
  PID:8428
- C:\Windows\System\HZlOKJz.exe
  C:\Windows\System\HZlOKJz.exe
  2⤵
  PID:8444
- C:\Windows\System\JAMOtVl.exe
  C:\Windows\System\JAMOtVl.exe
  2⤵
  PID:8460
- C:\Windows\System\KyWJOKc.exe
  C:\Windows\System\KyWJOKc.exe
  2⤵
  PID:8476
- C:\Windows\System\KAgvvAR.exe
  C:\Windows\System\KAgvvAR.exe
  2⤵
  PID:8504
- C:\Windows\System\yrgwZfh.exe
  C:\Windows\System\yrgwZfh.exe
  2⤵
  PID:8520
- C:\Windows\System\EarXzSY.exe
  C:\Windows\System\EarXzSY.exe
  2⤵
  PID:8536
- C:\Windows\System\BipQWok.exe
  C:\Windows\System\BipQWok.exe
  2⤵
  PID:8552
- C:\Windows\System\Rqurkss.exe
  C:\Windows\System\Rqurkss.exe
  2⤵
  PID:8568
- C:\Windows\System\PisZOZi.exe
  C:\Windows\System\PisZOZi.exe
  2⤵
  PID:8588
- C:\Windows\System\CILVrch.exe
  C:\Windows\System\CILVrch.exe
  2⤵
  PID:8604
- C:\Windows\System\hcEbUhF.exe
  C:\Windows\System\hcEbUhF.exe
  2⤵
  PID:8624
- C:\Windows\System\ILeDzWx.exe
  C:\Windows\System\ILeDzWx.exe
  2⤵
  PID:8640
- C:\Windows\System\RkYNNCk.exe
  C:\Windows\System\RkYNNCk.exe
  2⤵
  PID:8660
- C:\Windows\System\myjONTr.exe
  C:\Windows\System\myjONTr.exe
  2⤵
  PID:9056
- C:\Windows\System\FkNbCdS.exe
  C:\Windows\System\FkNbCdS.exe
  2⤵
  PID:9116
- C:\Windows\System\BmEFELC.exe
  C:\Windows\System\BmEFELC.exe
  2⤵
  PID:9160
- C:\Windows\System\yIhMQCU.exe
  C:\Windows\System\yIhMQCU.exe
  2⤵
  PID:9180
- C:\Windows\System\JeJirvg.exe
  C:\Windows\System\JeJirvg.exe
  2⤵
  PID:9200
- C:\Windows\System\smiJsDb.exe
  C:\Windows\System\smiJsDb.exe
  2⤵
  PID:6436
- C:\Windows\System\YVLGhYk.exe
  C:\Windows\System\YVLGhYk.exe
  2⤵
  PID:7852
- C:\Windows\System\roScrow.exe
  C:\Windows\System\roScrow.exe
  2⤵
  PID:8228
- C:\Windows\System\QCAEpYR.exe
  C:\Windows\System\QCAEpYR.exe
  2⤵
  PID:8296
- C:\Windows\System\HmgOfKJ.exe
  C:\Windows\System\HmgOfKJ.exe
  2⤵
  PID:8336
- C:\Windows\System\hyRZOlw.exe
  C:\Windows\System\hyRZOlw.exe
  2⤵
  PID:8472
- C:\Windows\System\ZNtXGlL.exe
  C:\Windows\System\ZNtXGlL.exe
  2⤵
  PID:8548
- C:\Windows\System\oPZTNYY.exe
  C:\Windows\System\oPZTNYY.exe
  2⤵
  PID:8128
- C:\Windows\System\pkDmkyz.exe
  C:\Windows\System\pkDmkyz.exe
  2⤵
  PID:2248
- C:\Windows\System\spOxOgI.exe
  C:\Windows\System\spOxOgI.exe
  2⤵
  PID:1272
- C:\Windows\System\uWgeHsi.exe
  C:\Windows\System\uWgeHsi.exe
  2⤵
  PID:7884
- C:\Windows\System\uwWjuGa.exe
  C:\Windows\System\uwWjuGa.exe
  2⤵
  PID:8364
- C:\Windows\System\gzWfRLa.exe
  C:\Windows\System\gzWfRLa.exe
  2⤵
  PID:8408
- C:\Windows\System\MWnPmkf.exe
  C:\Windows\System\MWnPmkf.exe
  2⤵
  PID:8616
- C:\Windows\System\vHshMKs.exe
  C:\Windows\System\vHshMKs.exe
  2⤵
  PID:8656
- C:\Windows\System\kcOZTPA.exe
  C:\Windows\System\kcOZTPA.exe
  2⤵
  PID:6668
- C:\Windows\System\aQDSixy.exe
  C:\Windows\System\aQDSixy.exe
  2⤵
  PID:7504
- C:\Windows\System\lxwHQfE.exe
  C:\Windows\System\lxwHQfE.exe
  2⤵
  PID:7548
- C:\Windows\System\QobAemw.exe
  C:\Windows\System\QobAemw.exe
  2⤵
  PID:7180
- C:\Windows\System\bBXrJxR.exe
  C:\Windows\System\bBXrJxR.exe
  2⤵
  PID:8180
- C:\Windows\System\TnLMobS.exe
  C:\Windows\System\TnLMobS.exe
  2⤵
  PID:7296
- C:\Windows\System\azcbOCc.exe
  C:\Windows\System\azcbOCc.exe
  2⤵
  PID:7840
- C:\Windows\System\SrYXEkX.exe
  C:\Windows\System\SrYXEkX.exe
  2⤵
  PID:8204
- C:\Windows\System\FmGWkvR.exe
  C:\Windows\System\FmGWkvR.exe
  2⤵
  PID:8276
- C:\Windows\System\zAlaOPA.exe
  C:\Windows\System\zAlaOPA.exe
  2⤵
  PID:8348
- C:\Windows\System\WSKPYDd.exe
  C:\Windows\System\WSKPYDd.exe
  2⤵
  PID:8388
- C:\Windows\System\OLNaNfH.exe
  C:\Windows\System\OLNaNfH.exe
  2⤵
  PID:8484
- C:\Windows\System\yiFRyoi.exe
  C:\Windows\System\yiFRyoi.exe
  2⤵
  PID:8944
- C:\Windows\System\iRkznZG.exe
  C:\Windows\System\iRkznZG.exe
  2⤵
  PID:8960
- C:\Windows\System\MDgpMen.exe
  C:\Windows\System\MDgpMen.exe
  2⤵
  PID:8980
- C:\Windows\System\bqPPzrC.exe
  C:\Windows\System\bqPPzrC.exe
  2⤵
  PID:8988
- C:\Windows\System\Pydpobv.exe
  C:\Windows\System\Pydpobv.exe
  2⤵
  PID:9012
- C:\Windows\System\qdNRpFf.exe
  C:\Windows\System\qdNRpFf.exe
  2⤵
  PID:9028
- C:\Windows\System\UaMbXJG.exe
  C:\Windows\System\UaMbXJG.exe
  2⤵
  PID:9044
- C:\Windows\System\NPAeQYU.exe
  C:\Windows\System\NPAeQYU.exe
  2⤵
  PID:9064
- C:\Windows\System\Grommgh.exe
  C:\Windows\System\Grommgh.exe
  2⤵
  PID:9104
- C:\Windows\System\WffpBth.exe
  C:\Windows\System\WffpBth.exe
  2⤵
  PID:9212
- C:\Windows\System\iaYCTZz.exe
  C:\Windows\System\iaYCTZz.exe
  2⤵
  PID:7980
- C:\Windows\System\DroMnXi.exe
  C:\Windows\System\DroMnXi.exe
  2⤵
  PID:8652
- C:\Windows\System\YLYdUlq.exe
  C:\Windows\System\YLYdUlq.exe
  2⤵
  PID:7904
- C:\Windows\System\YXoOoun.exe
  C:\Windows\System\YXoOoun.exe
  2⤵
  PID:6304
- C:\Windows\System\wvLIwCk.exe
  C:\Windows\System\wvLIwCk.exe
  2⤵
  PID:9188
- C:\Windows\System\evUTeLx.exe
  C:\Windows\System\evUTeLx.exe
  2⤵
  PID:1824
- C:\Windows\System\JwgBiWf.exe
  C:\Windows\System\JwgBiWf.exe
  2⤵
  PID:7500
- C:\Windows\System\hShCNXH.exe
  C:\Windows\System\hShCNXH.exe
  2⤵
  PID:9148
- C:\Windows\System\thixclx.exe
  C:\Windows\System\thixclx.exe
  2⤵
  PID:7344
- C:\Windows\System\thfiAWu.exe
  C:\Windows\System\thfiAWu.exe
  2⤵
  PID:7568
- C:\Windows\System\NvBjbdv.exe
  C:\Windows\System\NvBjbdv.exe
  2⤵
  PID:8468
- C:\Windows\System\OEOLZUY.exe
  C:\Windows\System\OEOLZUY.exe
  2⤵
  PID:7484
- C:\Windows\System\wKQWRcz.exe
  C:\Windows\System\wKQWRcz.exe
  2⤵
  PID:8612
- C:\Windows\System\zbDwBax.exe
  C:\Windows\System\zbDwBax.exe
  2⤵
  PID:1176
- C:\Windows\System\rQKmsmW.exe
  C:\Windows\System\rQKmsmW.exe
  2⤵
  PID:8240
- C:\Windows\System\BSEudgC.exe
  C:\Windows\System\BSEudgC.exe
  2⤵
  PID:7600
- C:\Windows\System\TaRPzJf.exe
  C:\Windows\System\TaRPzJf.exe
  2⤵
  PID:7240
- C:\Windows\System\VAfdTAM.exe
  C:\Windows\System\VAfdTAM.exe
  2⤵
  PID:8452
- C:\Windows\System\QwIfqIE.exe
  C:\Windows\System\QwIfqIE.exe
  2⤵
  PID:2260
- C:\Windows\System\piWlFZm.exe
  C:\Windows\System\piWlFZm.exe
  2⤵
  PID:9004
- C:\Windows\System\dTiPFDq.exe
  C:\Windows\System\dTiPFDq.exe
  2⤵
  PID:9084
- C:\Windows\System\ADWCfIB.exe
  C:\Windows\System\ADWCfIB.exe
  2⤵
  PID:8560
- C:\Windows\System\yorJYqQ.exe
  C:\Windows\System\yorJYqQ.exe
  2⤵
  PID:8632
- C:\Windows\System\uvPCvIp.exe
  C:\Windows\System\uvPCvIp.exe
  2⤵
  PID:8684
- C:\Windows\System\DzfSmXL.exe
  C:\Windows\System\DzfSmXL.exe
  2⤵
  PID:8700
- C:\Windows\System\oHsdmtb.exe
  C:\Windows\System\oHsdmtb.exe
  2⤵
  PID:8728
- C:\Windows\System\BlYmdCJ.exe
  C:\Windows\System\BlYmdCJ.exe
  2⤵
  PID:8748
- C:\Windows\System\FbFHrWc.exe
  C:\Windows\System\FbFHrWc.exe
  2⤵
  PID:8756
- C:\Windows\System\uZKMtDO.exe
  C:\Windows\System\uZKMtDO.exe
  2⤵
  PID:8772
- C:\Windows\System\uBpbpIE.exe
  C:\Windows\System\uBpbpIE.exe
  2⤵
  PID:8784
- C:\Windows\System\kDnjTZj.exe
  C:\Windows\System\kDnjTZj.exe
  2⤵
  PID:8800
- C:\Windows\System\jmOiCVi.exe
  C:\Windows\System\jmOiCVi.exe
  2⤵
  PID:8820
- C:\Windows\System\EqEyRnT.exe
  C:\Windows\System\EqEyRnT.exe
  2⤵
  PID:8836
- C:\Windows\System\DZeogYv.exe
  C:\Windows\System\DZeogYv.exe
  2⤵
  PID:8716
- C:\Windows\System\xqQrcmq.exe
  C:\Windows\System\xqQrcmq.exe
  2⤵
  PID:8860
- C:\Windows\System\eGeabNt.exe
  C:\Windows\System\eGeabNt.exe
  2⤵
  PID:8876
- C:\Windows\System\HgrxKGH.exe
  C:\Windows\System\HgrxKGH.exe
  2⤵
  PID:8892
- C:\Windows\System\hVyyloS.exe
  C:\Windows\System\hVyyloS.exe
  2⤵
  PID:8908
- C:\Windows\System\aoBaBFz.exe
  C:\Windows\System\aoBaBFz.exe
  2⤵
  PID:8924
- C:\Windows\System\HXEWvpN.exe
  C:\Windows\System\HXEWvpN.exe
  2⤵
  PID:8940
- C:\Windows\System\UGPqqaZ.exe
  C:\Windows\System\UGPqqaZ.exe
  2⤵
  PID:8952
- C:\Windows\System\bmAVNMJ.exe
  C:\Windows\System\bmAVNMJ.exe
  2⤵
  PID:9176
- C:\Windows\System\OmTtHLe.exe
  C:\Windows\System\OmTtHLe.exe
  2⤵
  PID:2984
- C:\Windows\System\OGUncEl.exe
  C:\Windows\System\OGUncEl.exe
  2⤵
  PID:7952
- C:\Windows\System\abSLvYC.exe
  C:\Windows\System\abSLvYC.exe
  2⤵
  PID:5108
- C:\Windows\System\pUYwLbz.exe
  C:\Windows\System\pUYwLbz.exe
  2⤵
  PID:9208
- C:\Windows\System\xDfuytd.exe
  C:\Windows\System\xDfuytd.exe
  2⤵
  PID:8544
- C:\Windows\System\tZChBfY.exe
  C:\Windows\System\tZChBfY.exe
  2⤵
  PID:7520
- C:\Windows\System\zPpiksJ.exe
  C:\Windows\System\zPpiksJ.exe
  2⤵
  PID:9132
- C:\Windows\System\EMKBYxB.exe
  C:\Windows\System\EMKBYxB.exe
  2⤵
  PID:8264
- C:\Windows\System\LbRSxBj.exe
  C:\Windows\System\LbRSxBj.exe
  2⤵
  PID:932
- C:\Windows\System\vvGldml.exe
  C:\Windows\System\vvGldml.exe
  2⤵
  PID:8332
- C:\Windows\System\YKyyQgM.exe
  C:\Windows\System\YKyyQgM.exe
  2⤵
  PID:9144
- C:\Windows\System\bwQmOgF.exe
  C:\Windows\System\bwQmOgF.exe
  2⤵
  PID:6500
- C:\Windows\System\zdsXnWX.exe
  C:\Windows\System\zdsXnWX.exe
  2⤵
  PID:4112
- C:\Windows\System\nlNMoJA.exe
  C:\Windows\System\nlNMoJA.exe
  2⤵
  PID:9036
- C:\Windows\System\LJPoBVY.exe
  C:\Windows\System\LJPoBVY.exe
  2⤵
  PID:7744
- C:\Windows\System\cdHMFWo.exe
  C:\Windows\System\cdHMFWo.exe
  2⤵
  PID:8696
- C:\Windows\System\ZDGYNqO.exe
  C:\Windows\System\ZDGYNqO.exe
  2⤵
  PID:8736
- C:\Windows\System\mdigQVS.exe
  C:\Windows\System\mdigQVS.exe
  2⤵
  PID:8804
- C:\Windows\System\OuFGUKU.exe
  C:\Windows\System\OuFGUKU.exe
  2⤵
  PID:8532
- C:\Windows\System\XQFamdH.exe
  C:\Windows\System\XQFamdH.exe
  2⤵
  PID:8832
- C:\Windows\System\VAYRweJ.exe
  C:\Windows\System\VAYRweJ.exe
  2⤵
  PID:8912
- C:\Windows\System\wuFbrUM.exe
  C:\Windows\System\wuFbrUM.exe
  2⤵
  PID:8680
- C:\Windows\System\bFpTiAI.exe
  C:\Windows\System\bFpTiAI.exe
  2⤵
  PID:8972
- C:\Windows\System\BJtGfNX.exe
  C:\Windows\System\BJtGfNX.exe
  2⤵
  PID:8840
- C:\Windows\System\ZYxhjVn.exe
  C:\Windows\System\ZYxhjVn.exe
  2⤵
  PID:8904
- C:\Windows\System\GxuARnp.exe
  C:\Windows\System\GxuARnp.exe
  2⤵
  PID:5100
- C:\Windows\System\AgJjHkU.exe
  C:\Windows\System\AgJjHkU.exe
  2⤵
  PID:7552
- C:\Windows\System\bdeCMvP.exe
  C:\Windows\System\bdeCMvP.exe
  2⤵
  PID:8292
- C:\Windows\System\SlSePfo.exe
  C:\Windows\System\SlSePfo.exe
  2⤵
  PID:8936
- C:\Windows\System\vTRCnfW.exe
  C:\Windows\System\vTRCnfW.exe
  2⤵
  PID:9172
- C:\Windows\System\lXSieSs.exe
  C:\Windows\System\lXSieSs.exe
  2⤵
  PID:8016
- C:\Windows\System\cUVXUMq.exe
  C:\Windows\System\cUVXUMq.exe
  2⤵
  PID:8404
- C:\Windows\System\hvGvJcj.exe
  C:\Windows\System\hvGvJcj.exe
  2⤵
  PID:7424
- C:\Windows\System\xNEkSDJ.exe
  C:\Windows\System\xNEkSDJ.exe
  2⤵
  PID:8764
- C:\Windows\System\tJXqWTY.exe
  C:\Windows\System\tJXqWTY.exe
  2⤵
  PID:8760
- C:\Windows\System\lsGdfVL.exe
  C:\Windows\System\lsGdfVL.exe
  2⤵
  PID:8456
- C:\Windows\System\kJghpPc.exe
  C:\Windows\System\kJghpPc.exe
  2⤵
  PID:8676
- C:\Windows\System\QfXJlwV.exe
  C:\Windows\System\QfXJlwV.exe
  2⤵
  PID:8868
- C:\Windows\System\XuEmMTv.exe
  C:\Windows\System\XuEmMTv.exe
  2⤵
  PID:8900
- C:\Windows\System\QOcVhgm.exe
  C:\Windows\System\QOcVhgm.exe
  2⤵
  PID:8932
- C:\Windows\System\mylXogW.exe
  C:\Windows\System\mylXogW.exe
  2⤵
  PID:9140
- C:\Windows\System\iyzPOzk.exe
  C:\Windows\System\iyzPOzk.exe
  2⤵
  PID:8316
- C:\Windows\System\JZyVlsW.exe
  C:\Windows\System\JZyVlsW.exe
  2⤵
  PID:8788
- C:\Windows\System\PbhuXFd.exe
  C:\Windows\System\PbhuXFd.exe
  2⤵
  PID:8992
- C:\Windows\System\sBZdTqW.exe
  C:\Windows\System\sBZdTqW.exe
  2⤵
  PID:3492
- C:\Windows\System\YrJIBJH.exe
  C:\Windows\System\YrJIBJH.exe
  2⤵
  PID:1884
- C:\Windows\System\vrVPgUV.exe
  C:\Windows\System\vrVPgUV.exe
  2⤵
  PID:8732
- C:\Windows\System\PAhrDob.exe
  C:\Windows\System\PAhrDob.exe
  2⤵
  PID:8740
- C:\Windows\System\EZdIoEp.exe
  C:\Windows\System\EZdIoEp.exe
  2⤵
  PID:8668
- C:\Windows\System\EfraOzB.exe
  C:\Windows\System\EfraOzB.exe
  2⤵
  PID:9224
- C:\Windows\System\lxawKyU.exe
  C:\Windows\System\lxawKyU.exe
  2⤵
  PID:9240
- C:\Windows\System\kHhgAyn.exe
  C:\Windows\System\kHhgAyn.exe
  2⤵
  PID:9256
- C:\Windows\System\dLoTEvZ.exe
  C:\Windows\System\dLoTEvZ.exe
  2⤵
  PID:9272
- C:\Windows\System\mTQwGXO.exe
  C:\Windows\System\mTQwGXO.exe
  2⤵
  PID:9288
- C:\Windows\System\wcrfAHL.exe
  C:\Windows\System\wcrfAHL.exe
  2⤵
  PID:9304
- C:\Windows\System\CdSEdtF.exe
  C:\Windows\System\CdSEdtF.exe
  2⤵
  PID:9320
- C:\Windows\System\iTTAlUT.exe
  C:\Windows\System\iTTAlUT.exe
  2⤵
  PID:9336
- C:\Windows\System\FyIGmBc.exe
  C:\Windows\System\FyIGmBc.exe
  2⤵
  PID:9352
- C:\Windows\System\FMdDAcg.exe
  C:\Windows\System\FMdDAcg.exe
  2⤵
  PID:9368
- C:\Windows\System\IBUsyMq.exe
  C:\Windows\System\IBUsyMq.exe
  2⤵
  PID:9384
- C:\Windows\System\UiKaUhj.exe
  C:\Windows\System\UiKaUhj.exe
  2⤵
  PID:9400
- C:\Windows\System\ZZHLOGI.exe
  C:\Windows\System\ZZHLOGI.exe
  2⤵
  PID:9416
- C:\Windows\System\tGGZaWw.exe
  C:\Windows\System\tGGZaWw.exe
  2⤵
  PID:9432
- C:\Windows\System\VZaWyjf.exe
  C:\Windows\System\VZaWyjf.exe
  2⤵
  PID:9448
- C:\Windows\System\kJloNNk.exe
  C:\Windows\System\kJloNNk.exe
  2⤵
  PID:9464
- C:\Windows\System\ffgxNfg.exe
  C:\Windows\System\ffgxNfg.exe
  2⤵
  PID:9480
- C:\Windows\System\AbgYshW.exe
  C:\Windows\System\AbgYshW.exe
  2⤵
  PID:9496
- C:\Windows\System\CauDuMY.exe
  C:\Windows\System\CauDuMY.exe
  2⤵
  PID:9512
- C:\Windows\System\IwWFyfd.exe
  C:\Windows\System\IwWFyfd.exe
  2⤵
  PID:9528
- C:\Windows\System\vJJHsmB.exe
  C:\Windows\System\vJJHsmB.exe
  2⤵
  PID:9544
- C:\Windows\System\WyBqdiz.exe
  C:\Windows\System\WyBqdiz.exe
  2⤵
  PID:9560
- C:\Windows\System\lzOjrsj.exe
  C:\Windows\System\lzOjrsj.exe
  2⤵
  PID:9576
- C:\Windows\System\pJIXjeF.exe
  C:\Windows\System\pJIXjeF.exe
  2⤵
  PID:9592
- C:\Windows\System\VNjpQaD.exe
  C:\Windows\System\VNjpQaD.exe
  2⤵
  PID:9608
- C:\Windows\System\LaLDXwN.exe
  C:\Windows\System\LaLDXwN.exe
  2⤵
  PID:9624
- C:\Windows\System\sXvhVFK.exe
  C:\Windows\System\sXvhVFK.exe
  2⤵
  PID:9640
- C:\Windows\System\GQuoXIl.exe
  C:\Windows\System\GQuoXIl.exe
  2⤵
  PID:9656
- C:\Windows\System\NapanwN.exe
  C:\Windows\System\NapanwN.exe
  2⤵
  PID:9684
- C:\Windows\System\IPAvclm.exe
  C:\Windows\System\IPAvclm.exe
  2⤵
  PID:9700
- C:\Windows\System\OSVKiem.exe
  C:\Windows\System\OSVKiem.exe
  2⤵
  PID:9720
- C:\Windows\System\rGuFXbH.exe
  C:\Windows\System\rGuFXbH.exe
  2⤵
  PID:9736
- C:\Windows\System\wBtOqyW.exe
  C:\Windows\System\wBtOqyW.exe
  2⤵
  PID:9756
- C:\Windows\System\FXMHbbN.exe
  C:\Windows\System\FXMHbbN.exe
  2⤵
  PID:9772
- C:\Windows\System\tHvcuyy.exe
  C:\Windows\System\tHvcuyy.exe
  2⤵
  PID:9788
- C:\Windows\System\AzCJdFZ.exe
  C:\Windows\System\AzCJdFZ.exe
  2⤵
  PID:9804
- C:\Windows\System\aOrUzSh.exe
  C:\Windows\System\aOrUzSh.exe
  2⤵
  PID:9820
- C:\Windows\System\iPVQEUm.exe
  C:\Windows\System\iPVQEUm.exe
  2⤵
  PID:9836
- C:\Windows\System\lCdRugA.exe
  C:\Windows\System\lCdRugA.exe
  2⤵
  PID:9852
- C:\Windows\System\edbgpwn.exe
  C:\Windows\System\edbgpwn.exe
  2⤵
  PID:9868
- C:\Windows\System\effSmuN.exe
  C:\Windows\System\effSmuN.exe
  2⤵
  PID:9884
- C:\Windows\System\RnvZkFj.exe
  C:\Windows\System\RnvZkFj.exe
  2⤵
  PID:9900
- C:\Windows\System\EUYMXWU.exe
  C:\Windows\System\EUYMXWU.exe
  2⤵
  PID:9916
- C:\Windows\System\ApXojaB.exe
  C:\Windows\System\ApXojaB.exe
  2⤵
  PID:9932
- C:\Windows\System\ahuEgOz.exe
  C:\Windows\System\ahuEgOz.exe
  2⤵
  PID:9948
- C:\Windows\System\sAAjgYv.exe
  C:\Windows\System\sAAjgYv.exe
  2⤵
  PID:9964
- C:\Windows\System\sCZXBMC.exe
  C:\Windows\System\sCZXBMC.exe
  2⤵
  PID:9980
- C:\Windows\System\YEoxyed.exe
  C:\Windows\System\YEoxyed.exe
  2⤵
  PID:9996
- C:\Windows\System\hqpuMML.exe
  C:\Windows\System\hqpuMML.exe
  2⤵
  PID:10012
- C:\Windows\System\GpclnFv.exe
  C:\Windows\System\GpclnFv.exe
  2⤵
  PID:10028
- C:\Windows\System\tCrdTbU.exe
  C:\Windows\System\tCrdTbU.exe
  2⤵
  PID:10044
- C:\Windows\System\GyQEuxv.exe
  C:\Windows\System\GyQEuxv.exe
  2⤵
  PID:10060
- C:\Windows\System\UuWDbqo.exe
  C:\Windows\System\UuWDbqo.exe
  2⤵
  PID:10076
- C:\Windows\System\dZtGiOL.exe
  C:\Windows\System\dZtGiOL.exe
  2⤵
  PID:10092
- C:\Windows\System\ajQumNQ.exe
  C:\Windows\System\ajQumNQ.exe
  2⤵
  PID:10108
- C:\Windows\System\YcDNiXH.exe
  C:\Windows\System\YcDNiXH.exe
  2⤵
  PID:10124
- C:\Windows\System\pmKZGiP.exe
  C:\Windows\System\pmKZGiP.exe
  2⤵
  PID:10140
- C:\Windows\System\NszJmwc.exe
  C:\Windows\System\NszJmwc.exe
  2⤵
  PID:10156
- C:\Windows\System\FkNAABs.exe
  C:\Windows\System\FkNAABs.exe
  2⤵
  PID:10176
- C:\Windows\System\IxGxhXQ.exe
  C:\Windows\System\IxGxhXQ.exe
  2⤵
  PID:10192
- C:\Windows\System\VwcrdSj.exe
  C:\Windows\System\VwcrdSj.exe
  2⤵
  PID:10208
- C:\Windows\System\taSMifL.exe
  C:\Windows\System\taSMifL.exe
  2⤵
  PID:10224
- C:\Windows\System\kVcxxVM.exe
  C:\Windows\System\kVcxxVM.exe
  2⤵
  PID:9072
- C:\Windows\System\UvqkZZb.exe
  C:\Windows\System\UvqkZZb.exe
  2⤵
  PID:9100
- C:\Windows\System\FeMxkwD.exe
  C:\Windows\System\FeMxkwD.exe
  2⤵
  PID:9268
- C:\Windows\System\XveiFUz.exe
  C:\Windows\System\XveiFUz.exe
  2⤵
  PID:9328
- C:\Windows\System\JvtjZMw.exe
  C:\Windows\System\JvtjZMw.exe
  2⤵
  PID:9280
- C:\Windows\System\oqwTOrR.exe
  C:\Windows\System\oqwTOrR.exe
  2⤵
  PID:9364
- C:\Windows\System\qSfIlNg.exe
  C:\Windows\System\qSfIlNg.exe
  2⤵
  PID:9396
- C:\Windows\System\iafAqjD.exe
  C:\Windows\System\iafAqjD.exe
  2⤵
  PID:9376
- C:\Windows\System\ejRQKiy.exe
  C:\Windows\System\ejRQKiy.exe
  2⤵
  PID:9460
- C:\Windows\System\npPoXtm.exe
  C:\Windows\System\npPoXtm.exe
  2⤵
  PID:9472
- C:\Windows\System\VREKsus.exe
  C:\Windows\System\VREKsus.exe
  2⤵
  PID:9476
- C:\Windows\System\DRvsMcU.exe
  C:\Windows\System\DRvsMcU.exe
  2⤵
  PID:9504
- C:\Windows\System\SyfYXbo.exe
  C:\Windows\System\SyfYXbo.exe
  2⤵
  PID:9556
- C:\Windows\System\ngKqiHN.exe
  C:\Windows\System\ngKqiHN.exe
  2⤵
  PID:9568
- C:\Windows\System\UfmOcvU.exe
  C:\Windows\System\UfmOcvU.exe
  2⤵
  PID:9536
- C:\Windows\System\oAHoJfD.exe
  C:\Windows\System\oAHoJfD.exe
  2⤵
  PID:9648
- C:\Windows\System\VjAbmbm.exe
  C:\Windows\System\VjAbmbm.exe
  2⤵
  PID:9096
- C:\Windows\System\VQPxkfo.exe
  C:\Windows\System\VQPxkfo.exe
  2⤵
  PID:9692
- C:\Windows\System\uDybqAQ.exe
  C:\Windows\System\uDybqAQ.exe
  2⤵
  PID:9764
- C:\Windows\System\UYGoDgU.exe
  C:\Windows\System\UYGoDgU.exe
  2⤵
  PID:9716
- C:\Windows\System\TtcXKjB.exe
  C:\Windows\System\TtcXKjB.exe
  2⤵
  PID:9796
- C:\Windows\System\ygzEzFr.exe
  C:\Windows\System\ygzEzFr.exe
  2⤵
  PID:9812
- C:\Windows\System\EalMFcl.exe
  C:\Windows\System\EalMFcl.exe
  2⤵
  PID:9860
- C:\Windows\System\zBMuqOC.exe
  C:\Windows\System\zBMuqOC.exe
  2⤵
  PID:9924

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\Dlejsue.exe

Filesize
1.3MB

MD5
ed29e1d9b70973d45791fa0c05b977a8

SHA1
2eb63dc94acdee007ebfa4a8e63ce38d41ca3c67

SHA256
dca82aa545e7d81bcd2301a98e4d0efbbd242da92d4aebcb48d4110fd74fb7b6

SHA512
2817815b046884e876118c2bbedf7bb8f671a4090d6b87a05771960e4a1062b1fd04ed1da3b4ca83efa9417d8208f3d550a0de14e56ff6844fc6e40c9d79e031

Download Submit
C:\Windows\system\EORQroO.exe

Filesize
1.3MB

MD5
398639f6d8e9d6b63014d45e4625a0b7

SHA1
ba40d8777d265484ec9833c894a88565d1a5da13

SHA256
9db68536c6b1d79c464f6b434d19b5e506d50b1d12775ccf34e54b5d6880de4a

SHA512
80dc5bff2f6b79c53361b4911c9127755f4dff9f1de2e71e77aa3808843c37189bb47bd864c428ed45527be3622150f60c6d247489420ffad051e3dc927ba819

Download Submit
C:\Windows\system\EpBnLnb.exe

Filesize
1.3MB

MD5
ec62b3ad408516e825a7ed0eec28e5ea

SHA1
600f743779d275ef44f8ef2f5415b722a5528932

SHA256
162056b59191ed6bb513d5bb8267472b89f25a56bde735fe7c4e750844417241

SHA512
c6e4f40dd1e39ef3d0421a38f49fbaa6c32f576eb75e323b2d0a55804180557f3bc7755d397ab27a508613d6cb119a1cc7cd5b32c8608fa7b248e8680a5b9dbb

Download Submit
C:\Windows\system\FFrSRfP.exe

Filesize
1.3MB

MD5
ce5ddca53668a0312096b4e7de79af79

SHA1
66e153a1fd217cad76f90d4c850170e98455a1fa

SHA256
4feaabb83959a566da3829d1b68c95fa0241de0c6a24fa6c4d98013aa78950f6

SHA512
05fa6f203aa47cc09402eb53f2159c0c105a095d35500c9ac5504dccf5f5bb7956483feb5abfdc8ce34cb069ddbb29f59ce53a894d64b06916634b9125c20372

Download Submit
C:\Windows\system\IZlaknb.exe

Filesize
1.3MB

MD5
2c9647cb4a59aba7851fc37c69313902

SHA1
eed8bb18bec46fb0981c4e2e0bf9ef3412b4263e

SHA256
91255cf6f99865444a53fc8b43a0ac733af38ce2518a6a723a09c4085e0468a7

SHA512
a4692adf1705287a394e0f6271a9a3d00d9c9c7c433aedd349e5994f191e2e32d2e08b7cfd87e0a9f6387ba818ea198ca404366529f9e2205dc5de9f711c5a28

Download Submit
C:\Windows\system\KQUyWeg.exe

Filesize
1.3MB

MD5
ba33c75193eec13e898fd8ec3d51abbc

SHA1
bbce544a8b6c10312024cab05d6460a15d4d0a6a

SHA256
409d79b645e542ed3b29656828bd222792d937191bd50e0a29a70f1a92d50a3f

SHA512
900d2a9d76a432a057f16ab347c0193c21535204c1d3c8ade679067a06b002d4433e50ad3a3a3a9921c1ea8b483019e46bea2de76f0a7d95aa4439a76affa414

Download Submit
C:\Windows\system\OeUEnsS.exe

Filesize
1.3MB

MD5
2b74f15d7284c71ab18f2c320e5b7f77

SHA1
0dee251bfb0f3a46d9d6d9ec0a0d7c86569d07d7

SHA256
00adfc192b47f6650a63691693cc41a405bd1131467a3bea1ab35df9a6dcdb65

SHA512
b2d2cbae4a89063f8861ae237ccd77c3c6d0dadf5966ed456a0ff46f501df610d8465d6bb67da20a0b04d18d8f42cb0ebc7a86575305568fb8eb4dc60c2db0ab

Download Submit
C:\Windows\system\PQwjRCt.exe

Filesize
1.3MB

MD5
1b5126aac81a63580cdb0b439f29a77c

SHA1
9e20d8e3cdc0634f38c861bef644c36589a5d59c

SHA256
6d7e18b3c4be6412f560f7adcafcc3b75631693d34b0e711991673ba9881d6dd

SHA512
42af8e532e10467763e161749713527b25b8d2313158cdc6fa070c6293960bced6fab1773468957df50345e2b29667f969a5166da53198dd51dd2f195f9dc0a4

Download Submit
C:\Windows\system\QESnCnk.exe

Filesize
1.3MB

MD5
1e656463ecfd5215835de844d80ae39b

SHA1
c9383002b8cd2a22ca1e600ab01e44480f418242

SHA256
e36f22392432601e9054e8e1b26a28ce2420ba230e5d806a98bfccf910cdc4a8

SHA512
53242259762c285f8ae77e48232abcf17112b4e2daa1935dade4d6b40af64288c80143dd6cd6cb76aeac41510914254129270082319c1248a5a3d50a252a6442

Download Submit
C:\Windows\system\UbTDEul.exe

Filesize
1.3MB

MD5
49b527579dfc8f2e1dc67b2cc47fd066

SHA1
488cd7046c26bd3937fb246a972a5d45f91883cb

SHA256
7e53b25a171b2bc32965a580d76a8ac155306d54706e4edef2034cdde1d27038

SHA512
e62abeecea43ef86c4e02c854a6ece0d9d2f0b1df240999e0bb2a386bc5546fb66b98840c85258d73223782c0cd869b2b4af773335201f043bcbc92c514d12f3

Download Submit
C:\Windows\system\Vcxypqj.exe

Filesize
1.3MB

MD5
45c1bc4e4c32f1fc0e786af2adf52e8d

SHA1
d63ec07fb338713cc6e81b2e3f84726b663e1dea

SHA256
869a9b92424ef5f9d4a91c0184ce1f65a99a9c9e784639d1260dba924a0ece23

SHA512
7e06b9d74f30c08d6bad2771a080665c2f9ba32a59e7afa4f75bf8154866fa0424a09fa49302770d1f86f43aac39ab36c10020d9ebeec42eac6901ec4178df27

Download Submit
C:\Windows\system\VzNcLIN.exe

Filesize
1.3MB

MD5
48412c4b9d2e6963b90d58d3d6b214f5

SHA1
2ca24efe2df66b3e6470e366aba891e7767a8908

SHA256
9faaba5c002eafeed6ce9cdb0b3cddf8277b6e7622c8ea1496d7e4acf1b98f54

SHA512
00688a9c876b9230ee684029d460d6070a0fa95ac43b0190396d10cb8a53fa920bb5f8950aa34c1371bb2dd4334dd265ff6e343a2b2a301e400b4742c745218f

Download Submit
C:\Windows\system\fOXWPGc.exe

Filesize
1.3MB

MD5
85d7eeb9569ddaa2d12969f495aa1e85

SHA1
62f438acbb8c048682fb1248531847e3c1427ba8

SHA256
6e6f44d5991eb7bcdef5a7cf0ecd7ad583d828bb10c64c25c60b67d4e27b8310

SHA512
c91b777b5a44a49fe44e7749b99fc2e3ed21bb98dae15cbe16be791e1de237059d91bb1922efdabc63d475513ef7c1e80023a7ee047c092f387f13d88e04163b

Download Submit
C:\Windows\system\hGnBPdZ.exe

Filesize
1.3MB

MD5
1ae5e8512cfb67eecc8e2ed7893c90bf

SHA1
6ba6ea532238f3de2c79e40fd6f2fe72212ddd38

SHA256
fd03798bb1e83c468487ca50f53b98d5ea6fc3c915f8daa2754528729005fb4a

SHA512
f36b416cf69160530305836979312d0d50a20b130ebce8e0497a365971cdb299d8e2b30afe8874325b62ce6ae80c15086662e20ef198d06ba2f643b803d14447

Download Submit
C:\Windows\system\jJHHpZv.exe

Filesize
1.3MB

MD5
833cae57c9101d62964e0d6a4e3ca430

SHA1
2638896f7c0fb94d80aa35b705dffc41bd2f8f0f

SHA256
9c116c91176baeb14f6ca964376e832885eed3296f18ff98107dd7450090fea6

SHA512
9ecaf73c51814f9505c1d27dfd37228ae93121a13b10a48611f11c20fb8d92b63c3a147ecdd469fd2fe59cde9e489b063ebdd48a3df928ae8954cc4e655470b0

Download Submit
C:\Windows\system\jfGWkwk.exe

Filesize
1.3MB

MD5
57885b0301c423c402e85ba671027e0b

SHA1
dfbf003f001e97f6d1998acf65107c30348906b1

SHA256
896fd4c71ae171cc3e1fcc3ea375936e1d3a177f8ab8cedbf042375cbad7f987

SHA512
c292eed23086aee195a6824833be018d953984bb6c4b9ed314a609784120749f8b1f5c177371f6280001ad5bdedbd3158fea5b845ab843d7887e26a2d738b4bc

Download Submit
C:\Windows\system\kQbxYOf.exe

Filesize
1.3MB

MD5
1d096f6553d2f8b65f584f8d29b3f475

SHA1
1ae3840c701dad48b9cf4d4d31cb9e4099dfa76f

SHA256
df1f4280d07bf0767203c79d33817c58dec36b29e3bf006b80953ee7450815b9

SHA512
5ab64ac9e14f9e935cdee6067c6cb250151d2deaf8eff06cdb77edaade27469e34112c79d493aa3c257857e248d25f16ef79ee14458d1a4c18d217fddec0d7ae

Download Submit
C:\Windows\system\ktcTcEQ.exe

Filesize
1.3MB

MD5
b2f723bc5bd59d59e9ba8327810e1633

SHA1
dc52af8e012289ac48599b653423fddef1b7c6f3

SHA256
4edef4a47cfa2ed368920a14f068145c7c504409dfb4edeec93f53a67e51e95d

SHA512
8221bc9cfe62188651f2a5092cb1da5b9e319a3b16d689f34f5ef8bccc11088e547d14b4ffb8b747ed2804751d1cc8e9002a5a2ace9e9a5315f99a265bf903d4

Download Submit
C:\Windows\system\mGCVTJD.exe

Filesize
1.3MB

MD5
e1e9a17d4bdc11a6b7d1b1274f8febca

SHA1
909cb86864f245cc8ff779a4402951a626aace7e

SHA256
128388ff9b82097a68a11df877bee0911100ea9367b46d06d9ef021f5e6a26f0

SHA512
2b3c45169e325b0b596a5d74b6bcd3efc377396e5d11c69df6f2cdff835231a47b3ec9b530eccae0673e2b077561071331cc3935c00d20d85d177c285b3158ad

Download Submit
C:\Windows\system\mNEJQff.exe

Filesize
1.3MB

MD5
160cac5f98256440faa8b2a4d393f663

SHA1
b94e2399d0288afb9f2016ead432cd7442919bb5

SHA256
abdb8a0085805ddb492957d6b63619202d89837c7f8b1b9c8aede453c1544cf7

SHA512
6812b59d1e8cc04801fc335e3fa08c617c1423452d9a72edb700d2d23cbf2bcca4e1ff241e9988389c535d0d61ce4debb34dc08d4f5975fce143e9982d6ae7db

Download Submit
C:\Windows\system\oXLpWLi.exe

Filesize
1.3MB

MD5
d36fdbc17a1a615aa2bf3049e3b0e0c4

SHA1
1c8c2c7334c0ff3506238148491aad50dad2361d

SHA256
1ba07e0c9c94154a8d9abb91c5f18c7e1586997ae5894e7e834a1eed94f4b3c1

SHA512
e73b3debfefdd55693aa16754f59dc29ad8b31a21b75be6b9e9a691e2f5934d83ee92b6f0e37cbec4a77c89596426753826cf45a90178d0fe3dee79345bdec22

Download Submit
C:\Windows\system\vQsjyZr.exe

Filesize
1.3MB

MD5
82256f928666353a6f83c1864f245aef

SHA1
a5514d5d0946db266ce70f1e98eb7021624dd906

SHA256
8fa8e0f925be43db94bb8e08a2d1cedacffd1dc5af2e9f597fcd42d6cf9339e4

SHA512
ae8501aa0c0d30ceed86af81dcf0cf2f0b40f2bea8733710c8d30acbc90709b311bf332848b92343e8e111602ca4bc8d419621da746c209518e1e2f7a82d3d34

Download Submit
C:\Windows\system\zuReTGk.exe

Filesize
1.3MB

MD5
6e4bdede1f42774c0ce1ba1c0a3a0385

SHA1
581ab4274c7191914cd466932534b2065b806f96

SHA256
1bf802e1fb0955be9cf1384906439049041e5e7fd9450272a55c6077a3877630

SHA512
84d8c49be7163f7b3fdbe139a8197eca33a6e77ab618bc72f0f7f8ae5eaeb309ac3e7af8eeda4643063cef2bd8949afe28e96d637549baff63c054b387773850

Download Submit
\Windows\system\BaNPwuK.exe

Filesize
1.3MB

MD5
8cfbe978de8c2ee837b2fd3dd1ad5398

SHA1
7b9346e569cd0a6df26c8791f8fe34f9328bb63c

SHA256
6c0c79ad80d1926ea08882cea2ef93c89638aa139d3d8a0daf3cd5619a655500

SHA512
2986d29d32749a4b32b5c93451202c3f17adf64affd84849b329054b88b579e435b292120e873dde006053a6f31bedb5d5e0ef456c2311de291b42efda91309e

Download Submit
\Windows\system\CLNYrwl.exe

Filesize
1.3MB

MD5
1ae310813fe298aadabc870a44b3220f

SHA1
03fd4302007be4a09a6275b02f7a4fcd9e6e1245

SHA256
3dbc8b47dfc2ac09d04e4054bf2e8cf01338b9d50d969d50e7fbe4100877ed7f

SHA512
13d7c7f77618e719e30a0b78d07bfc3587150cfa21d7ed5735899619079f9523adb49163c588674e841c9d23ee35d2c0d3fa749e50c44e4efe844093fc7c7917

Download Submit
\Windows\system\ZdUnuto.exe

Filesize
1.3MB

MD5
f7110955f4ef7b41f36945d653429744

SHA1
07b9345744306e2a2ba908f33f65b7fa033c5bd0

SHA256
e677eef24f9ad02a0c45c49788274f5d2ca5f7bb30f4bff405f7b77b9320e09b

SHA512
fee6f576d6e6bc632907375a46b8c456af06593749ed5c40c414cc4a257440ec9fde2257247549c4b249fe723828dece35e28788d54c3699624758961effb087

Download Submit
\Windows\system\aXNzIKB.exe

Filesize
1.3MB

MD5
d7423bbb321797a6f2997e6afd63bd1a

SHA1
2ee611d0d3575c6cd368d5969e01181ba99f29f4

SHA256
6479599f9b88425ea633651a284e28f806842ffb41280d20ae140889eb2aea1e

SHA512
15461c459d613724b78d94ec9b4b773c77276b01538bb088e88f097909fe5f2b0b32706926b6aaa25a945f3f9da03b16fa88346bbabcb4364c2d5d0b1752715c

Download Submit
\Windows\system\ahjJkqN.exe

Filesize
1.3MB

MD5
c8c6d6da242666f791b389bab8f7f98e

SHA1
e28f29315098ef387fa64233ed494ccb5cdce048

SHA256
63fa828eff2676e09f7da7a03d81c275094eb8e9e49d5831fc114f4b0072341f

SHA512
5908b9b011ecfa12f26ada89d75ab325bf643ee84c293c378ea7dc8f8a9452ffd1b7a581eeeecb52d73af46bba24fcd0f40e03ae38971d4cc94cd15a78f05ed7

Download Submit
\Windows\system\jSIljWS.exe

Filesize
1.3MB

MD5
df724d591a633c401fce358323189a93

SHA1
b1413a0822d35ea2fc7fcbd96cfea3fe84744dbb

SHA256
fdc94b02aaa92d0aa276da44467d6f15c065795fc73fdb6b2ef34c268cd2d257

SHA512
b25b37511cf9c6ea90d96a815413b8e536a9a5b53d386f290622f6a486c2117f9b91038c425d0ed4a6aae8cf418400c8fd5ebc338f6c52731c7da5e614428cdb

Download Submit
\Windows\system\oZrUGag.exe

Filesize
1.3MB

MD5
118ebf2e597daabe20ad1428927accf4

SHA1
8dcaf9ba68c7560dfa1b95e0ab08c2806d7c9c87

SHA256
c22a6e0ec4b25b3009e96726d53bc74ef3970884fc81e7f78c6ed50d8c3176a9

SHA512
37ad1741ff4d43077693d4f816cdd2006793835cd6cfa1a9c9162ca96f0612a8fc073b3cf2c6fe70edeb21bc9ab1d2a6dc15bf972c3d8adea4d6be1ab80b2d8d

Download Submit
\Windows\system\pINSOQC.exe

Filesize
1.3MB

MD5
2eebba16fda2ed1edc17b0bd5e03230d

SHA1
ebfdfd9fb19b032d22ff9dbd117e367e8b6c0e65

SHA256
434cd70aa44c187004bd09afcc4ef6dfee21bf43ec56fdb42c2bf6262b70b0ee

SHA512
6531597db77bb473ae59f716a1958ce829ffac3c1be59d902d8486d2a9b5e257e4ef0588e075830d2a7cff4cfbbffbf4a71607b5075f84e328b05191dd202143

Download Submit
\Windows\system\syKwHwl.exe

Filesize
1.3MB

MD5
5534fc8976b89be75b5c7c08b9cdb0be

SHA1
c9a18ba744a35e9a3e5da2ea96f34f15e4664d14

SHA256
7abd2dbf48b5bdae547480f2d294fca68c11251fa345ddd89c12033611008859

SHA512
efabece55ca6f4e393527f46db97563ed0505c20ff03dff2f035122f4ec9c0336586c35003653d3470ec5c71f66b8a50d37f1e06b62637231dd57960a41707cb

Download Submit
memory/112-108-0x000000013F450000-0x000000013F842000-memory.dmp

Filesize
3.9MB

Download
memory/112-2404-0x000000013F450000-0x000000013F842000-memory.dmp

Filesize
3.9MB

Download
memory/572-110-0x000000013FAC0000-0x000000013FEB2000-memory.dmp

Filesize
3.9MB

Download
memory/572-2407-0x000000013FAC0000-0x000000013FEB2000-memory.dmp

Filesize
3.9MB

Download
memory/1572-105-0x000000013F6C0000-0x000000013FAB2000-memory.dmp

Filesize
3.9MB

Download
memory/1572-2408-0x000000013F6C0000-0x000000013FAB2000-memory.dmp

Filesize
3.9MB

Download
memory/1664-2412-0x000000013F700000-0x000000013FAF2000-memory.dmp

Filesize
3.9MB

Download
memory/1664-111-0x000000013F700000-0x000000013FAF2000-memory.dmp

Filesize
3.9MB

Download
memory/2068-21-0x000007FEF632E000-0x000007FEF632F000-memory.dmp

Filesize
4KB

Download
memory/2068-20-0x00000000025D0000-0x0000000002650000-memory.dmp

Filesize
512KB

Download
memory/2068-117-0x0000000002570000-0x0000000002578000-memory.dmp

Filesize
32KB

Download
memory/2068-288-0x000007FEF6070000-0x000007FEF6A0D000-memory.dmp

Filesize
9.6MB

Download
memory/2068-63-0x000000001B280000-0x000000001B562000-memory.dmp

Filesize
2.9MB

Download
memory/2068-72-0x000007FEF6070000-0x000007FEF6A0D000-memory.dmp

Filesize
9.6MB

Download
memory/2068-112-0x000007FEF6070000-0x000007FEF6A0D000-memory.dmp

Filesize
9.6MB

Download
memory/2392-86-0x000000013FCA0000-0x0000000140092000-memory.dmp

Filesize
3.9MB

Download
memory/2392-2406-0x000000013FCA0000-0x0000000140092000-memory.dmp

Filesize
3.9MB

Download
memory/2416-99-0x000000013F580000-0x000000013F972000-memory.dmp

Filesize
3.9MB

Download
memory/2416-1874-0x000000013F580000-0x000000013F972000-memory.dmp

Filesize
3.9MB

Download
memory/2448-2409-0x000000013F400000-0x000000013F7F2000-memory.dmp

Filesize
3.9MB

Download
memory/2448-91-0x000000013F400000-0x000000013F7F2000-memory.dmp

Filesize
3.9MB

Download
memory/2532-19-0x000000013F470000-0x000000013F862000-memory.dmp

Filesize
3.9MB

Download
memory/2532-2402-0x000000013F470000-0x000000013F862000-memory.dmp

Filesize
3.9MB

Download
memory/2548-2411-0x000000013FE80000-0x0000000140272000-memory.dmp

Filesize
3.9MB

Download
memory/2548-82-0x000000013FE80000-0x0000000140272000-memory.dmp

Filesize
3.9MB

Download
memory/2552-80-0x000000013F470000-0x000000013F862000-memory.dmp

Filesize
3.9MB

Download
memory/2552-2410-0x000000013F470000-0x000000013F862000-memory.dmp

Filesize
3.9MB

Download
memory/2740-0-0x000000013FC50000-0x0000000140042000-memory.dmp

Filesize
3.9MB

Download
memory/2740-8-0x000000013F140000-0x000000013F532000-memory.dmp

Filesize
3.9MB

Download
memory/2740-98-0x000000013F580000-0x000000013F972000-memory.dmp

Filesize
3.9MB

Download
memory/2740-79-0x000000013F470000-0x000000013F862000-memory.dmp

Filesize
3.9MB

Download
memory/2740-100-0x000000013F6C0000-0x000000013FAB2000-memory.dmp

Filesize
3.9MB

Download
memory/2740-1-0x00000000001F0000-0x0000000000200000-memory.dmp

Filesize
64KB

Download
memory/2740-88-0x000000013F400000-0x000000013F7F2000-memory.dmp

Filesize
3.9MB

Download
memory/2740-85-0x0000000002EF0000-0x00000000032E2000-memory.dmp

Filesize
3.9MB

Download
memory/2740-83-0x0000000002EF0000-0x00000000032E2000-memory.dmp

Filesize
3.9MB

Download
memory/2740-18-0x000000013F470000-0x000000013F862000-memory.dmp

Filesize
3.9MB

Download
memory/2740-81-0x0000000002EF0000-0x00000000032E2000-memory.dmp

Filesize
3.9MB

Download
memory/2740-107-0x000000013F450000-0x000000013F842000-memory.dmp

Filesize
3.9MB

Download
memory/2740-109-0x0000000002EF0000-0x00000000032E2000-memory.dmp

Filesize
3.9MB

Download
memory/2860-2405-0x000000013FD80000-0x0000000140172000-memory.dmp

Filesize
3.9MB

Download
memory/2860-84-0x000000013FD80000-0x0000000140172000-memory.dmp

Filesize
3.9MB

Download
memory/2884-2403-0x000000013F140000-0x000000013F532000-memory.dmp

Filesize
3.9MB

Download
memory/2884-9-0x000000013F140000-0x000000013F532000-memory.dmp

Filesize
3.9MB

Download