xmrig | 50714ae9f9ac9f5be4a93273fd332b076b9ad352df0ac31419f03218f427362e

Analysis

max time kernel
149s
max time network
155s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
27-06-2024 04:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

50714ae9f9ac9f5be4a93273fd332b076b9ad352df0ac31419f03218f427362e_NeikiAnalytics.exe
Size

1.9MB
MD5

07c428c9e735b1fa22effd49200e8a10
SHA1

caa14924570962e1fa0f85a9c04f2ed4657edf3b
SHA256

50714ae9f9ac9f5be4a93273fd332b076b9ad352df0ac31419f03218f427362e
SHA512

bad66ebb2ccb66b691b1f976ff578d2e9d2a8e65302db9cbd96645b87bd9676eb79728fbceb687adea5ba9d0ea472bf984bf656a2e5835d124fbf1541fcb1f0b
SSDEEP

24576:zv3/fTLF671TilQFG4P5PmK/lzapbU4w2DyA7lO1eANsT4Z8+8KYECFj1oqZoc1j:Lz071uv4BPm6lgVJUwD+83FhZ35wgHT9

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 26 IoCs

miner

resource	yara_rule
behavioral1/memory/1304-23-0x000000013FF50000-0x0000000140342000-memory.dmp	xmrig
behavioral1/memory/2728-208-0x000000013FF60000-0x0000000140352000-memory.dmp	xmrig
behavioral1/memory/2112-207-0x000000013F840000-0x000000013FC32000-memory.dmp	xmrig
behavioral1/memory/2912-206-0x0000000003440000-0x0000000003832000-memory.dmp	xmrig
behavioral1/memory/1148-205-0x000000013F800000-0x000000013FBF2000-memory.dmp	xmrig
behavioral1/memory/2516-203-0x000000013FC60000-0x0000000140052000-memory.dmp	xmrig
behavioral1/memory/2520-201-0x000000013F1C0000-0x000000013F5B2000-memory.dmp	xmrig
behavioral1/memory/2920-196-0x000000013F620000-0x000000013FA12000-memory.dmp	xmrig
behavioral1/memory/2780-189-0x000000013F740000-0x000000013FB32000-memory.dmp	xmrig
behavioral1/memory/2592-182-0x000000013F820000-0x000000013FC12000-memory.dmp	xmrig
behavioral1/memory/2912-181-0x0000000002C20000-0x0000000003012000-memory.dmp	xmrig
behavioral1/memory/2480-179-0x000000013F540000-0x000000013F932000-memory.dmp	xmrig
behavioral1/memory/3020-22-0x000000013F670000-0x000000013FA62000-memory.dmp	xmrig
behavioral1/memory/2428-13-0x000000013F960000-0x000000013FD52000-memory.dmp	xmrig
behavioral1/memory/2428-1879-0x000000013F960000-0x000000013FD52000-memory.dmp	xmrig
behavioral1/memory/3020-1880-0x000000013F670000-0x000000013FA62000-memory.dmp	xmrig
behavioral1/memory/1304-1881-0x000000013FF50000-0x0000000140342000-memory.dmp	xmrig
behavioral1/memory/2480-1884-0x000000013F540000-0x000000013F932000-memory.dmp	xmrig
behavioral1/memory/2780-1883-0x000000013F740000-0x000000013FB32000-memory.dmp	xmrig
behavioral1/memory/2728-1882-0x000000013FF60000-0x0000000140352000-memory.dmp	xmrig
behavioral1/memory/2592-1885-0x000000013F820000-0x000000013FC12000-memory.dmp	xmrig
behavioral1/memory/2520-1886-0x000000013F1C0000-0x000000013F5B2000-memory.dmp	xmrig
behavioral1/memory/2516-1887-0x000000013FC60000-0x0000000140052000-memory.dmp	xmrig
behavioral1/memory/2112-1888-0x000000013F840000-0x000000013FC32000-memory.dmp	xmrig
behavioral1/memory/2920-1890-0x000000013F620000-0x000000013FA12000-memory.dmp	xmrig
behavioral1/memory/1148-1889-0x000000013F800000-0x000000013FBF2000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
1944	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
2428	gztNPlu.exe
1304	tNlxsba.exe
3020	WjZteJd.exe
2728	wrsvvps.exe
2480	oastmZO.exe
2592	GvCFRMc.exe
2780	ZrdRvwc.exe
2920	GOJSHkW.exe
2520	fPhxXOF.exe
2516	faVAkrA.exe
1148	qKIOMeN.exe
2112	TBfYKUE.exe
972	fcdwaOK.exe
2456	hHaKKkw.exe
1808	KCrsdkr.exe
1308	ZAZTvwt.exe
2544	RrcLhpp.exe
2656	NETXaWI.exe
1960	wmpHYNq.exe
1788	FYEoasm.exe
1820	Nwmsfra.exe
1828	EjQvnaW.exe
2424	UVLOJoO.exe
2192	NMgshgY.exe
2152	zzuLVSi.exe
1720	KCMWver.exe
836	UdixNMQ.exe
2280	lzDIUpq.exe
1188	WTzAiPV.exe
2840	DKPCJrK.exe
660	zlgGYmB.exe
2124	YqCKvUw.exe
1300	YbrTsEd.exe
824	GEFsBor.exe
1780	bYvMJRm.exe
1004	VDWdcRF.exe
1648	wEpiFVM.exe
360	XNDNDCX.exe
1244	TUboIhM.exe
600	qDrnBHy.exe
3068	pEFONcP.exe
1708	wTEivsH.exe
1248	JVGVEAw.exe
2028	bFPjolU.exe
1764	BibpejI.exe
1676	mszKzAT.exe
2968	ZMmsGSE.exe
1364	ScuxaaW.exe
2996	NilYRYw.exe
1696	nKPBEiK.exe
2748	gQxeVvt.exe
2908	JhyXEoD.exe
2632	suNhMcf.exe
2692	hvXbnEA.exe
2508	SRzITaJ.exe
2640	jtOcDvr.exe
1108	epCOPUE.exe
1996	CBMJYjn.exe
948	PnQRixv.exe
1372	qYDQGqF.exe
2672	zJdclgH.exe
2768	WSqdaXm.exe
2868	vHpBsNv.exe
1644	katiMnr.exe

Loads dropped DLL 64 IoCs

pid	Process
2912	50714ae9f9ac9f5be4a93273fd332b076b9ad352df0ac31419f03218f427362e_NeikiAnalytics.exe
2912	50714ae9f9ac9f5be4a93273fd332b076b9ad352df0ac31419f03218f427362e_NeikiAnalytics.exe
2912	50714ae9f9ac9f5be4a93273fd332b076b9ad352df0ac31419f03218f427362e_NeikiAnalytics.exe
2912	50714ae9f9ac9f5be4a93273fd332b076b9ad352df0ac31419f03218f427362e_NeikiAnalytics.exe
2912	50714ae9f9ac9f5be4a93273fd332b076b9ad352df0ac31419f03218f427362e_NeikiAnalytics.exe
2912	50714ae9f9ac9f5be4a93273fd332b076b9ad352df0ac31419f03218f427362e_NeikiAnalytics.exe
2912	50714ae9f9ac9f5be4a93273fd332b076b9ad352df0ac31419f03218f427362e_NeikiAnalytics.exe
2912	50714ae9f9ac9f5be4a93273fd332b076b9ad352df0ac31419f03218f427362e_NeikiAnalytics.exe
2912	50714ae9f9ac9f5be4a93273fd332b076b9ad352df0ac31419f03218f427362e_NeikiAnalytics.exe
2912	50714ae9f9ac9f5be4a93273fd332b076b9ad352df0ac31419f03218f427362e_NeikiAnalytics.exe
2912	50714ae9f9ac9f5be4a93273fd332b076b9ad352df0ac31419f03218f427362e_NeikiAnalytics.exe
2912	50714ae9f9ac9f5be4a93273fd332b076b9ad352df0ac31419f03218f427362e_NeikiAnalytics.exe
2912	50714ae9f9ac9f5be4a93273fd332b076b9ad352df0ac31419f03218f427362e_NeikiAnalytics.exe
2912	50714ae9f9ac9f5be4a93273fd332b076b9ad352df0ac31419f03218f427362e_NeikiAnalytics.exe
2912	50714ae9f9ac9f5be4a93273fd332b076b9ad352df0ac31419f03218f427362e_NeikiAnalytics.exe
2912	50714ae9f9ac9f5be4a93273fd332b076b9ad352df0ac31419f03218f427362e_NeikiAnalytics.exe
2912	50714ae9f9ac9f5be4a93273fd332b076b9ad352df0ac31419f03218f427362e_NeikiAnalytics.exe
2912	50714ae9f9ac9f5be4a93273fd332b076b9ad352df0ac31419f03218f427362e_NeikiAnalytics.exe
2912	50714ae9f9ac9f5be4a93273fd332b076b9ad352df0ac31419f03218f427362e_NeikiAnalytics.exe
2912	50714ae9f9ac9f5be4a93273fd332b076b9ad352df0ac31419f03218f427362e_NeikiAnalytics.exe
2912	50714ae9f9ac9f5be4a93273fd332b076b9ad352df0ac31419f03218f427362e_NeikiAnalytics.exe
2912	50714ae9f9ac9f5be4a93273fd332b076b9ad352df0ac31419f03218f427362e_NeikiAnalytics.exe
2912	50714ae9f9ac9f5be4a93273fd332b076b9ad352df0ac31419f03218f427362e_NeikiAnalytics.exe
2912	50714ae9f9ac9f5be4a93273fd332b076b9ad352df0ac31419f03218f427362e_NeikiAnalytics.exe
2912	50714ae9f9ac9f5be4a93273fd332b076b9ad352df0ac31419f03218f427362e_NeikiAnalytics.exe
2912	50714ae9f9ac9f5be4a93273fd332b076b9ad352df0ac31419f03218f427362e_NeikiAnalytics.exe
2912	50714ae9f9ac9f5be4a93273fd332b076b9ad352df0ac31419f03218f427362e_NeikiAnalytics.exe
2912	50714ae9f9ac9f5be4a93273fd332b076b9ad352df0ac31419f03218f427362e_NeikiAnalytics.exe
2912	50714ae9f9ac9f5be4a93273fd332b076b9ad352df0ac31419f03218f427362e_NeikiAnalytics.exe
2912	50714ae9f9ac9f5be4a93273fd332b076b9ad352df0ac31419f03218f427362e_NeikiAnalytics.exe
2912	50714ae9f9ac9f5be4a93273fd332b076b9ad352df0ac31419f03218f427362e_NeikiAnalytics.exe
2912	50714ae9f9ac9f5be4a93273fd332b076b9ad352df0ac31419f03218f427362e_NeikiAnalytics.exe
2912	50714ae9f9ac9f5be4a93273fd332b076b9ad352df0ac31419f03218f427362e_NeikiAnalytics.exe
2912	50714ae9f9ac9f5be4a93273fd332b076b9ad352df0ac31419f03218f427362e_NeikiAnalytics.exe
2912	50714ae9f9ac9f5be4a93273fd332b076b9ad352df0ac31419f03218f427362e_NeikiAnalytics.exe
2912	50714ae9f9ac9f5be4a93273fd332b076b9ad352df0ac31419f03218f427362e_NeikiAnalytics.exe
2912	50714ae9f9ac9f5be4a93273fd332b076b9ad352df0ac31419f03218f427362e_NeikiAnalytics.exe
2912	50714ae9f9ac9f5be4a93273fd332b076b9ad352df0ac31419f03218f427362e_NeikiAnalytics.exe
2912	50714ae9f9ac9f5be4a93273fd332b076b9ad352df0ac31419f03218f427362e_NeikiAnalytics.exe
2912	50714ae9f9ac9f5be4a93273fd332b076b9ad352df0ac31419f03218f427362e_NeikiAnalytics.exe
2912	50714ae9f9ac9f5be4a93273fd332b076b9ad352df0ac31419f03218f427362e_NeikiAnalytics.exe
2912	50714ae9f9ac9f5be4a93273fd332b076b9ad352df0ac31419f03218f427362e_NeikiAnalytics.exe
2912	50714ae9f9ac9f5be4a93273fd332b076b9ad352df0ac31419f03218f427362e_NeikiAnalytics.exe
2912	50714ae9f9ac9f5be4a93273fd332b076b9ad352df0ac31419f03218f427362e_NeikiAnalytics.exe
2912	50714ae9f9ac9f5be4a93273fd332b076b9ad352df0ac31419f03218f427362e_NeikiAnalytics.exe
2912	50714ae9f9ac9f5be4a93273fd332b076b9ad352df0ac31419f03218f427362e_NeikiAnalytics.exe
2912	50714ae9f9ac9f5be4a93273fd332b076b9ad352df0ac31419f03218f427362e_NeikiAnalytics.exe
2912	50714ae9f9ac9f5be4a93273fd332b076b9ad352df0ac31419f03218f427362e_NeikiAnalytics.exe
2912	50714ae9f9ac9f5be4a93273fd332b076b9ad352df0ac31419f03218f427362e_NeikiAnalytics.exe
2912	50714ae9f9ac9f5be4a93273fd332b076b9ad352df0ac31419f03218f427362e_NeikiAnalytics.exe
2912	50714ae9f9ac9f5be4a93273fd332b076b9ad352df0ac31419f03218f427362e_NeikiAnalytics.exe
2912	50714ae9f9ac9f5be4a93273fd332b076b9ad352df0ac31419f03218f427362e_NeikiAnalytics.exe
2912	50714ae9f9ac9f5be4a93273fd332b076b9ad352df0ac31419f03218f427362e_NeikiAnalytics.exe
2912	50714ae9f9ac9f5be4a93273fd332b076b9ad352df0ac31419f03218f427362e_NeikiAnalytics.exe
2912	50714ae9f9ac9f5be4a93273fd332b076b9ad352df0ac31419f03218f427362e_NeikiAnalytics.exe
2912	50714ae9f9ac9f5be4a93273fd332b076b9ad352df0ac31419f03218f427362e_NeikiAnalytics.exe
2912	50714ae9f9ac9f5be4a93273fd332b076b9ad352df0ac31419f03218f427362e_NeikiAnalytics.exe
2912	50714ae9f9ac9f5be4a93273fd332b076b9ad352df0ac31419f03218f427362e_NeikiAnalytics.exe
2912	50714ae9f9ac9f5be4a93273fd332b076b9ad352df0ac31419f03218f427362e_NeikiAnalytics.exe
2912	50714ae9f9ac9f5be4a93273fd332b076b9ad352df0ac31419f03218f427362e_NeikiAnalytics.exe
2912	50714ae9f9ac9f5be4a93273fd332b076b9ad352df0ac31419f03218f427362e_NeikiAnalytics.exe
2912	50714ae9f9ac9f5be4a93273fd332b076b9ad352df0ac31419f03218f427362e_NeikiAnalytics.exe
2912	50714ae9f9ac9f5be4a93273fd332b076b9ad352df0ac31419f03218f427362e_NeikiAnalytics.exe
2912	50714ae9f9ac9f5be4a93273fd332b076b9ad352df0ac31419f03218f427362e_NeikiAnalytics.exe

UPX packed file 57 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2912-1-0x000000013F5C0000-0x000000013F9B2000-memory.dmp	upx
behavioral1/files/0x000f000000012286-3.dat	upx
behavioral1/memory/1304-23-0x000000013FF50000-0x0000000140342000-memory.dmp	upx
behavioral1/files/0x0008000000016ce4-24.dat	upx
behavioral1/files/0x0007000000016cfe-35.dat	upx
behavioral1/files/0x0008000000016d0f-40.dat	upx
behavioral1/files/0x0005000000018735-62.dat	upx
behavioral1/files/0x0006000000018b21-67.dat	upx
behavioral1/files/0x0006000000018b63-72.dat	upx
behavioral1/files/0x0005000000019215-92.dat	upx
behavioral1/files/0x000500000001934b-122.dat	upx
behavioral1/files/0x0005000000019442-140.dat	upx
behavioral1/files/0x00050000000194a6-164.dat	upx
behavioral1/files/0x000500000001949b-172.dat	upx
behavioral1/files/0x00050000000194a7-167.dat	upx
behavioral1/memory/2728-208-0x000000013FF60000-0x0000000140352000-memory.dmp	upx
behavioral1/memory/2112-207-0x000000013F840000-0x000000013FC32000-memory.dmp	upx
behavioral1/memory/1148-205-0x000000013F800000-0x000000013FBF2000-memory.dmp	upx
behavioral1/memory/2516-203-0x000000013FC60000-0x0000000140052000-memory.dmp	upx
behavioral1/memory/2520-201-0x000000013F1C0000-0x000000013F5B2000-memory.dmp	upx
behavioral1/memory/2920-196-0x000000013F620000-0x000000013FA12000-memory.dmp	upx
behavioral1/memory/2780-189-0x000000013F740000-0x000000013FB32000-memory.dmp	upx
behavioral1/memory/2592-182-0x000000013F820000-0x000000013FC12000-memory.dmp	upx
behavioral1/memory/2480-179-0x000000013F540000-0x000000013F932000-memory.dmp	upx
behavioral1/files/0x000500000001945e-159.dat	upx
behavioral1/files/0x0005000000019487-157.dat	upx
behavioral1/files/0x0005000000019450-148.dat	upx
behavioral1/files/0x00050000000193fb-132.dat	upx
behavioral1/files/0x000500000001942d-137.dat	upx
behavioral1/files/0x0005000000019375-127.dat	upx
behavioral1/files/0x000500000001933f-117.dat	upx
behavioral1/files/0x0005000000019309-112.dat	upx
behavioral1/files/0x00050000000192d3-102.dat	upx
behavioral1/files/0x00050000000192f9-107.dat	upx
behavioral1/files/0x000500000001921d-97.dat	upx
behavioral1/files/0x0006000000018b7d-82.dat	upx
behavioral1/files/0x0006000000018bf9-87.dat	upx
behavioral1/files/0x0006000000018b79-77.dat	upx
behavioral1/files/0x000500000001872a-57.dat	upx
behavioral1/files/0x0008000000016d3c-52.dat	upx
behavioral1/files/0x0008000000016d2b-48.dat	upx
behavioral1/memory/3020-22-0x000000013F670000-0x000000013FA62000-memory.dmp	upx
behavioral1/files/0x0023000000016c76-17.dat	upx
behavioral1/files/0x0023000000016c2a-16.dat	upx
behavioral1/memory/2428-13-0x000000013F960000-0x000000013FD52000-memory.dmp	upx
behavioral1/memory/2428-1879-0x000000013F960000-0x000000013FD52000-memory.dmp	upx
behavioral1/memory/3020-1880-0x000000013F670000-0x000000013FA62000-memory.dmp	upx
behavioral1/memory/1304-1881-0x000000013FF50000-0x0000000140342000-memory.dmp	upx
behavioral1/memory/2480-1884-0x000000013F540000-0x000000013F932000-memory.dmp	upx
behavioral1/memory/2780-1883-0x000000013F740000-0x000000013FB32000-memory.dmp	upx
behavioral1/memory/2728-1882-0x000000013FF60000-0x0000000140352000-memory.dmp	upx
behavioral1/memory/2592-1885-0x000000013F820000-0x000000013FC12000-memory.dmp	upx
behavioral1/memory/2520-1886-0x000000013F1C0000-0x000000013F5B2000-memory.dmp	upx
behavioral1/memory/2516-1887-0x000000013FC60000-0x0000000140052000-memory.dmp	upx
behavioral1/memory/2112-1888-0x000000013F840000-0x000000013FC32000-memory.dmp	upx
behavioral1/memory/2920-1890-0x000000013F620000-0x000000013FA12000-memory.dmp	upx
behavioral1/memory/1148-1889-0x000000013F800000-0x000000013FBF2000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\vxYaJGM.exe	50714ae9f9ac9f5be4a93273fd332b076b9ad352df0ac31419f03218f427362e_NeikiAnalytics.exe
File created	C:\Windows\System\tsnBJnC.exe	50714ae9f9ac9f5be4a93273fd332b076b9ad352df0ac31419f03218f427362e_NeikiAnalytics.exe
File created	C:\Windows\System\rZuPtge.exe	50714ae9f9ac9f5be4a93273fd332b076b9ad352df0ac31419f03218f427362e_NeikiAnalytics.exe
File created	C:\Windows\System\ofghKdi.exe	50714ae9f9ac9f5be4a93273fd332b076b9ad352df0ac31419f03218f427362e_NeikiAnalytics.exe
File created	C:\Windows\System\PYPeigt.exe	50714ae9f9ac9f5be4a93273fd332b076b9ad352df0ac31419f03218f427362e_NeikiAnalytics.exe
File created	C:\Windows\System\CjvvKWU.exe	50714ae9f9ac9f5be4a93273fd332b076b9ad352df0ac31419f03218f427362e_NeikiAnalytics.exe
File created	C:\Windows\System\LANNfck.exe	50714ae9f9ac9f5be4a93273fd332b076b9ad352df0ac31419f03218f427362e_NeikiAnalytics.exe
File created	C:\Windows\System\IvYaZEj.exe	50714ae9f9ac9f5be4a93273fd332b076b9ad352df0ac31419f03218f427362e_NeikiAnalytics.exe
File created	C:\Windows\System\IudenNX.exe	50714ae9f9ac9f5be4a93273fd332b076b9ad352df0ac31419f03218f427362e_NeikiAnalytics.exe
File created	C:\Windows\System\keOjdHS.exe	50714ae9f9ac9f5be4a93273fd332b076b9ad352df0ac31419f03218f427362e_NeikiAnalytics.exe
File created	C:\Windows\System\YjmeSJH.exe	50714ae9f9ac9f5be4a93273fd332b076b9ad352df0ac31419f03218f427362e_NeikiAnalytics.exe
File created	C:\Windows\System\UojTjXb.exe	50714ae9f9ac9f5be4a93273fd332b076b9ad352df0ac31419f03218f427362e_NeikiAnalytics.exe
File created	C:\Windows\System\OoNyXDH.exe	50714ae9f9ac9f5be4a93273fd332b076b9ad352df0ac31419f03218f427362e_NeikiAnalytics.exe
File created	C:\Windows\System\UNycsrz.exe	50714ae9f9ac9f5be4a93273fd332b076b9ad352df0ac31419f03218f427362e_NeikiAnalytics.exe
File created	C:\Windows\System\qKzxfER.exe	50714ae9f9ac9f5be4a93273fd332b076b9ad352df0ac31419f03218f427362e_NeikiAnalytics.exe
File created	C:\Windows\System\WUWHCYN.exe	50714ae9f9ac9f5be4a93273fd332b076b9ad352df0ac31419f03218f427362e_NeikiAnalytics.exe
File created	C:\Windows\System\nUfsxqB.exe	50714ae9f9ac9f5be4a93273fd332b076b9ad352df0ac31419f03218f427362e_NeikiAnalytics.exe
File created	C:\Windows\System\lfePEhf.exe	50714ae9f9ac9f5be4a93273fd332b076b9ad352df0ac31419f03218f427362e_NeikiAnalytics.exe
File created	C:\Windows\System\uVdbDau.exe	50714ae9f9ac9f5be4a93273fd332b076b9ad352df0ac31419f03218f427362e_NeikiAnalytics.exe
File created	C:\Windows\System\XkrjBHZ.exe	50714ae9f9ac9f5be4a93273fd332b076b9ad352df0ac31419f03218f427362e_NeikiAnalytics.exe
File created	C:\Windows\System\WQvmaqC.exe	50714ae9f9ac9f5be4a93273fd332b076b9ad352df0ac31419f03218f427362e_NeikiAnalytics.exe
File created	C:\Windows\System\UrsRDKg.exe	50714ae9f9ac9f5be4a93273fd332b076b9ad352df0ac31419f03218f427362e_NeikiAnalytics.exe
File created	C:\Windows\System\JIDDrRl.exe	50714ae9f9ac9f5be4a93273fd332b076b9ad352df0ac31419f03218f427362e_NeikiAnalytics.exe
File created	C:\Windows\System\MZKYbsE.exe	50714ae9f9ac9f5be4a93273fd332b076b9ad352df0ac31419f03218f427362e_NeikiAnalytics.exe
File created	C:\Windows\System\iyHKwKD.exe	50714ae9f9ac9f5be4a93273fd332b076b9ad352df0ac31419f03218f427362e_NeikiAnalytics.exe
File created	C:\Windows\System\bsJrDDI.exe	50714ae9f9ac9f5be4a93273fd332b076b9ad352df0ac31419f03218f427362e_NeikiAnalytics.exe
File created	C:\Windows\System\WOTGRdp.exe	50714ae9f9ac9f5be4a93273fd332b076b9ad352df0ac31419f03218f427362e_NeikiAnalytics.exe
File created	C:\Windows\System\beLtVqF.exe	50714ae9f9ac9f5be4a93273fd332b076b9ad352df0ac31419f03218f427362e_NeikiAnalytics.exe
File created	C:\Windows\System\wIPgCVk.exe	50714ae9f9ac9f5be4a93273fd332b076b9ad352df0ac31419f03218f427362e_NeikiAnalytics.exe
File created	C:\Windows\System\rxinubC.exe	50714ae9f9ac9f5be4a93273fd332b076b9ad352df0ac31419f03218f427362e_NeikiAnalytics.exe
File created	C:\Windows\System\eVucTZa.exe	50714ae9f9ac9f5be4a93273fd332b076b9ad352df0ac31419f03218f427362e_NeikiAnalytics.exe
File created	C:\Windows\System\lGrxAoa.exe	50714ae9f9ac9f5be4a93273fd332b076b9ad352df0ac31419f03218f427362e_NeikiAnalytics.exe
File created	C:\Windows\System\EBXquXV.exe	50714ae9f9ac9f5be4a93273fd332b076b9ad352df0ac31419f03218f427362e_NeikiAnalytics.exe
File created	C:\Windows\System\ZpfceVI.exe	50714ae9f9ac9f5be4a93273fd332b076b9ad352df0ac31419f03218f427362e_NeikiAnalytics.exe
File created	C:\Windows\System\qmFQqeu.exe	50714ae9f9ac9f5be4a93273fd332b076b9ad352df0ac31419f03218f427362e_NeikiAnalytics.exe
File created	C:\Windows\System\JvZsXWU.exe	50714ae9f9ac9f5be4a93273fd332b076b9ad352df0ac31419f03218f427362e_NeikiAnalytics.exe
File created	C:\Windows\System\trovTZJ.exe	50714ae9f9ac9f5be4a93273fd332b076b9ad352df0ac31419f03218f427362e_NeikiAnalytics.exe
File created	C:\Windows\System\azJHTte.exe	50714ae9f9ac9f5be4a93273fd332b076b9ad352df0ac31419f03218f427362e_NeikiAnalytics.exe
File created	C:\Windows\System\LwFwvPn.exe	50714ae9f9ac9f5be4a93273fd332b076b9ad352df0ac31419f03218f427362e_NeikiAnalytics.exe
File created	C:\Windows\System\NyFXmMc.exe	50714ae9f9ac9f5be4a93273fd332b076b9ad352df0ac31419f03218f427362e_NeikiAnalytics.exe
File created	C:\Windows\System\KRGxIaN.exe	50714ae9f9ac9f5be4a93273fd332b076b9ad352df0ac31419f03218f427362e_NeikiAnalytics.exe
File created	C:\Windows\System\kDlXnNV.exe	50714ae9f9ac9f5be4a93273fd332b076b9ad352df0ac31419f03218f427362e_NeikiAnalytics.exe
File created	C:\Windows\System\oSziIuV.exe	50714ae9f9ac9f5be4a93273fd332b076b9ad352df0ac31419f03218f427362e_NeikiAnalytics.exe
File created	C:\Windows\System\tKKArfH.exe	50714ae9f9ac9f5be4a93273fd332b076b9ad352df0ac31419f03218f427362e_NeikiAnalytics.exe
File created	C:\Windows\System\wfmDMFY.exe	50714ae9f9ac9f5be4a93273fd332b076b9ad352df0ac31419f03218f427362e_NeikiAnalytics.exe
File created	C:\Windows\System\TQkwJgV.exe	50714ae9f9ac9f5be4a93273fd332b076b9ad352df0ac31419f03218f427362e_NeikiAnalytics.exe
File created	C:\Windows\System\UHZnVbS.exe	50714ae9f9ac9f5be4a93273fd332b076b9ad352df0ac31419f03218f427362e_NeikiAnalytics.exe
File created	C:\Windows\System\McFGXEZ.exe	50714ae9f9ac9f5be4a93273fd332b076b9ad352df0ac31419f03218f427362e_NeikiAnalytics.exe
File created	C:\Windows\System\mulnwEg.exe	50714ae9f9ac9f5be4a93273fd332b076b9ad352df0ac31419f03218f427362e_NeikiAnalytics.exe
File created	C:\Windows\System\YYCKFmy.exe	50714ae9f9ac9f5be4a93273fd332b076b9ad352df0ac31419f03218f427362e_NeikiAnalytics.exe
File created	C:\Windows\System\RQEymyf.exe	50714ae9f9ac9f5be4a93273fd332b076b9ad352df0ac31419f03218f427362e_NeikiAnalytics.exe
File created	C:\Windows\System\Rfydxoc.exe	50714ae9f9ac9f5be4a93273fd332b076b9ad352df0ac31419f03218f427362e_NeikiAnalytics.exe
File created	C:\Windows\System\TioQgik.exe	50714ae9f9ac9f5be4a93273fd332b076b9ad352df0ac31419f03218f427362e_NeikiAnalytics.exe
File created	C:\Windows\System\NETXaWI.exe	50714ae9f9ac9f5be4a93273fd332b076b9ad352df0ac31419f03218f427362e_NeikiAnalytics.exe
File created	C:\Windows\System\ubrJICv.exe	50714ae9f9ac9f5be4a93273fd332b076b9ad352df0ac31419f03218f427362e_NeikiAnalytics.exe
File created	C:\Windows\System\fodplDs.exe	50714ae9f9ac9f5be4a93273fd332b076b9ad352df0ac31419f03218f427362e_NeikiAnalytics.exe
File created	C:\Windows\System\lmZgKal.exe	50714ae9f9ac9f5be4a93273fd332b076b9ad352df0ac31419f03218f427362e_NeikiAnalytics.exe
File created	C:\Windows\System\HvdNwAr.exe	50714ae9f9ac9f5be4a93273fd332b076b9ad352df0ac31419f03218f427362e_NeikiAnalytics.exe
File created	C:\Windows\System\ovxKdRu.exe	50714ae9f9ac9f5be4a93273fd332b076b9ad352df0ac31419f03218f427362e_NeikiAnalytics.exe
File created	C:\Windows\System\kGOvotZ.exe	50714ae9f9ac9f5be4a93273fd332b076b9ad352df0ac31419f03218f427362e_NeikiAnalytics.exe
File created	C:\Windows\System\oJuKUKV.exe	50714ae9f9ac9f5be4a93273fd332b076b9ad352df0ac31419f03218f427362e_NeikiAnalytics.exe
File created	C:\Windows\System\VVgVInm.exe	50714ae9f9ac9f5be4a93273fd332b076b9ad352df0ac31419f03218f427362e_NeikiAnalytics.exe
File created	C:\Windows\System\aDqXOLL.exe	50714ae9f9ac9f5be4a93273fd332b076b9ad352df0ac31419f03218f427362e_NeikiAnalytics.exe
File created	C:\Windows\System\AdQqsRv.exe	50714ae9f9ac9f5be4a93273fd332b076b9ad352df0ac31419f03218f427362e_NeikiAnalytics.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1944	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2912	50714ae9f9ac9f5be4a93273fd332b076b9ad352df0ac31419f03218f427362e_NeikiAnalytics.exe
Token: SeLockMemoryPrivilege	2912	50714ae9f9ac9f5be4a93273fd332b076b9ad352df0ac31419f03218f427362e_NeikiAnalytics.exe
Token: SeDebugPrivilege	1944	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2912 wrote to memory of 1944	2912	50714ae9f9ac9f5be4a93273fd332b076b9ad352df0ac31419f03218f427362e_NeikiAnalytics.exe	29
PID 2912 wrote to memory of 1944	2912	50714ae9f9ac9f5be4a93273fd332b076b9ad352df0ac31419f03218f427362e_NeikiAnalytics.exe	29
PID 2912 wrote to memory of 1944	2912	50714ae9f9ac9f5be4a93273fd332b076b9ad352df0ac31419f03218f427362e_NeikiAnalytics.exe	29
PID 2912 wrote to memory of 2428	2912	50714ae9f9ac9f5be4a93273fd332b076b9ad352df0ac31419f03218f427362e_NeikiAnalytics.exe	30
PID 2912 wrote to memory of 2428	2912	50714ae9f9ac9f5be4a93273fd332b076b9ad352df0ac31419f03218f427362e_NeikiAnalytics.exe	30
PID 2912 wrote to memory of 2428	2912	50714ae9f9ac9f5be4a93273fd332b076b9ad352df0ac31419f03218f427362e_NeikiAnalytics.exe	30
PID 2912 wrote to memory of 1304	2912	50714ae9f9ac9f5be4a93273fd332b076b9ad352df0ac31419f03218f427362e_NeikiAnalytics.exe	31
PID 2912 wrote to memory of 1304	2912	50714ae9f9ac9f5be4a93273fd332b076b9ad352df0ac31419f03218f427362e_NeikiAnalytics.exe	31
PID 2912 wrote to memory of 1304	2912	50714ae9f9ac9f5be4a93273fd332b076b9ad352df0ac31419f03218f427362e_NeikiAnalytics.exe	31
PID 2912 wrote to memory of 3020	2912	50714ae9f9ac9f5be4a93273fd332b076b9ad352df0ac31419f03218f427362e_NeikiAnalytics.exe	32
PID 2912 wrote to memory of 3020	2912	50714ae9f9ac9f5be4a93273fd332b076b9ad352df0ac31419f03218f427362e_NeikiAnalytics.exe	32
PID 2912 wrote to memory of 3020	2912	50714ae9f9ac9f5be4a93273fd332b076b9ad352df0ac31419f03218f427362e_NeikiAnalytics.exe	32
PID 2912 wrote to memory of 2728	2912	50714ae9f9ac9f5be4a93273fd332b076b9ad352df0ac31419f03218f427362e_NeikiAnalytics.exe	33
PID 2912 wrote to memory of 2728	2912	50714ae9f9ac9f5be4a93273fd332b076b9ad352df0ac31419f03218f427362e_NeikiAnalytics.exe	33
PID 2912 wrote to memory of 2728	2912	50714ae9f9ac9f5be4a93273fd332b076b9ad352df0ac31419f03218f427362e_NeikiAnalytics.exe	33
PID 2912 wrote to memory of 2480	2912	50714ae9f9ac9f5be4a93273fd332b076b9ad352df0ac31419f03218f427362e_NeikiAnalytics.exe	34
PID 2912 wrote to memory of 2480	2912	50714ae9f9ac9f5be4a93273fd332b076b9ad352df0ac31419f03218f427362e_NeikiAnalytics.exe	34
PID 2912 wrote to memory of 2480	2912	50714ae9f9ac9f5be4a93273fd332b076b9ad352df0ac31419f03218f427362e_NeikiAnalytics.exe	34
PID 2912 wrote to memory of 2592	2912	50714ae9f9ac9f5be4a93273fd332b076b9ad352df0ac31419f03218f427362e_NeikiAnalytics.exe	35
PID 2912 wrote to memory of 2592	2912	50714ae9f9ac9f5be4a93273fd332b076b9ad352df0ac31419f03218f427362e_NeikiAnalytics.exe	35
PID 2912 wrote to memory of 2592	2912	50714ae9f9ac9f5be4a93273fd332b076b9ad352df0ac31419f03218f427362e_NeikiAnalytics.exe	35
PID 2912 wrote to memory of 2780	2912	50714ae9f9ac9f5be4a93273fd332b076b9ad352df0ac31419f03218f427362e_NeikiAnalytics.exe	36
PID 2912 wrote to memory of 2780	2912	50714ae9f9ac9f5be4a93273fd332b076b9ad352df0ac31419f03218f427362e_NeikiAnalytics.exe	36
PID 2912 wrote to memory of 2780	2912	50714ae9f9ac9f5be4a93273fd332b076b9ad352df0ac31419f03218f427362e_NeikiAnalytics.exe	36
PID 2912 wrote to memory of 2920	2912	50714ae9f9ac9f5be4a93273fd332b076b9ad352df0ac31419f03218f427362e_NeikiAnalytics.exe	37
PID 2912 wrote to memory of 2920	2912	50714ae9f9ac9f5be4a93273fd332b076b9ad352df0ac31419f03218f427362e_NeikiAnalytics.exe	37
PID 2912 wrote to memory of 2920	2912	50714ae9f9ac9f5be4a93273fd332b076b9ad352df0ac31419f03218f427362e_NeikiAnalytics.exe	37
PID 2912 wrote to memory of 2520	2912	50714ae9f9ac9f5be4a93273fd332b076b9ad352df0ac31419f03218f427362e_NeikiAnalytics.exe	38
PID 2912 wrote to memory of 2520	2912	50714ae9f9ac9f5be4a93273fd332b076b9ad352df0ac31419f03218f427362e_NeikiAnalytics.exe	38
PID 2912 wrote to memory of 2520	2912	50714ae9f9ac9f5be4a93273fd332b076b9ad352df0ac31419f03218f427362e_NeikiAnalytics.exe	38
PID 2912 wrote to memory of 2516	2912	50714ae9f9ac9f5be4a93273fd332b076b9ad352df0ac31419f03218f427362e_NeikiAnalytics.exe	39
PID 2912 wrote to memory of 2516	2912	50714ae9f9ac9f5be4a93273fd332b076b9ad352df0ac31419f03218f427362e_NeikiAnalytics.exe	39
PID 2912 wrote to memory of 2516	2912	50714ae9f9ac9f5be4a93273fd332b076b9ad352df0ac31419f03218f427362e_NeikiAnalytics.exe	39
PID 2912 wrote to memory of 1148	2912	50714ae9f9ac9f5be4a93273fd332b076b9ad352df0ac31419f03218f427362e_NeikiAnalytics.exe	40
PID 2912 wrote to memory of 1148	2912	50714ae9f9ac9f5be4a93273fd332b076b9ad352df0ac31419f03218f427362e_NeikiAnalytics.exe	40
PID 2912 wrote to memory of 1148	2912	50714ae9f9ac9f5be4a93273fd332b076b9ad352df0ac31419f03218f427362e_NeikiAnalytics.exe	40
PID 2912 wrote to memory of 2112	2912	50714ae9f9ac9f5be4a93273fd332b076b9ad352df0ac31419f03218f427362e_NeikiAnalytics.exe	41
PID 2912 wrote to memory of 2112	2912	50714ae9f9ac9f5be4a93273fd332b076b9ad352df0ac31419f03218f427362e_NeikiAnalytics.exe	41
PID 2912 wrote to memory of 2112	2912	50714ae9f9ac9f5be4a93273fd332b076b9ad352df0ac31419f03218f427362e_NeikiAnalytics.exe	41
PID 2912 wrote to memory of 972	2912	50714ae9f9ac9f5be4a93273fd332b076b9ad352df0ac31419f03218f427362e_NeikiAnalytics.exe	42
PID 2912 wrote to memory of 972	2912	50714ae9f9ac9f5be4a93273fd332b076b9ad352df0ac31419f03218f427362e_NeikiAnalytics.exe	42
PID 2912 wrote to memory of 972	2912	50714ae9f9ac9f5be4a93273fd332b076b9ad352df0ac31419f03218f427362e_NeikiAnalytics.exe	42
PID 2912 wrote to memory of 2456	2912	50714ae9f9ac9f5be4a93273fd332b076b9ad352df0ac31419f03218f427362e_NeikiAnalytics.exe	43
PID 2912 wrote to memory of 2456	2912	50714ae9f9ac9f5be4a93273fd332b076b9ad352df0ac31419f03218f427362e_NeikiAnalytics.exe	43
PID 2912 wrote to memory of 2456	2912	50714ae9f9ac9f5be4a93273fd332b076b9ad352df0ac31419f03218f427362e_NeikiAnalytics.exe	43
PID 2912 wrote to memory of 1808	2912	50714ae9f9ac9f5be4a93273fd332b076b9ad352df0ac31419f03218f427362e_NeikiAnalytics.exe	44
PID 2912 wrote to memory of 1808	2912	50714ae9f9ac9f5be4a93273fd332b076b9ad352df0ac31419f03218f427362e_NeikiAnalytics.exe	44
PID 2912 wrote to memory of 1808	2912	50714ae9f9ac9f5be4a93273fd332b076b9ad352df0ac31419f03218f427362e_NeikiAnalytics.exe	44
PID 2912 wrote to memory of 1308	2912	50714ae9f9ac9f5be4a93273fd332b076b9ad352df0ac31419f03218f427362e_NeikiAnalytics.exe	45
PID 2912 wrote to memory of 1308	2912	50714ae9f9ac9f5be4a93273fd332b076b9ad352df0ac31419f03218f427362e_NeikiAnalytics.exe	45
PID 2912 wrote to memory of 1308	2912	50714ae9f9ac9f5be4a93273fd332b076b9ad352df0ac31419f03218f427362e_NeikiAnalytics.exe	45
PID 2912 wrote to memory of 2544	2912	50714ae9f9ac9f5be4a93273fd332b076b9ad352df0ac31419f03218f427362e_NeikiAnalytics.exe	46
PID 2912 wrote to memory of 2544	2912	50714ae9f9ac9f5be4a93273fd332b076b9ad352df0ac31419f03218f427362e_NeikiAnalytics.exe	46
PID 2912 wrote to memory of 2544	2912	50714ae9f9ac9f5be4a93273fd332b076b9ad352df0ac31419f03218f427362e_NeikiAnalytics.exe	46
PID 2912 wrote to memory of 2656	2912	50714ae9f9ac9f5be4a93273fd332b076b9ad352df0ac31419f03218f427362e_NeikiAnalytics.exe	47
PID 2912 wrote to memory of 2656	2912	50714ae9f9ac9f5be4a93273fd332b076b9ad352df0ac31419f03218f427362e_NeikiAnalytics.exe	47
PID 2912 wrote to memory of 2656	2912	50714ae9f9ac9f5be4a93273fd332b076b9ad352df0ac31419f03218f427362e_NeikiAnalytics.exe	47
PID 2912 wrote to memory of 1960	2912	50714ae9f9ac9f5be4a93273fd332b076b9ad352df0ac31419f03218f427362e_NeikiAnalytics.exe	48
PID 2912 wrote to memory of 1960	2912	50714ae9f9ac9f5be4a93273fd332b076b9ad352df0ac31419f03218f427362e_NeikiAnalytics.exe	48
PID 2912 wrote to memory of 1960	2912	50714ae9f9ac9f5be4a93273fd332b076b9ad352df0ac31419f03218f427362e_NeikiAnalytics.exe	48
PID 2912 wrote to memory of 1788	2912	50714ae9f9ac9f5be4a93273fd332b076b9ad352df0ac31419f03218f427362e_NeikiAnalytics.exe	49
PID 2912 wrote to memory of 1788	2912	50714ae9f9ac9f5be4a93273fd332b076b9ad352df0ac31419f03218f427362e_NeikiAnalytics.exe	49
PID 2912 wrote to memory of 1788	2912	50714ae9f9ac9f5be4a93273fd332b076b9ad352df0ac31419f03218f427362e_NeikiAnalytics.exe	49
PID 2912 wrote to memory of 1820	2912	50714ae9f9ac9f5be4a93273fd332b076b9ad352df0ac31419f03218f427362e_NeikiAnalytics.exe	50

C:\Users\Admin\AppData\Local\Temp\50714ae9f9ac9f5be4a93273fd332b076b9ad352df0ac31419f03218f427362e_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\50714ae9f9ac9f5be4a93273fd332b076b9ad352df0ac31419f03218f427362e_NeikiAnalytics.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2912
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1944
- C:\Windows\System\gztNPlu.exe
  C:\Windows\System\gztNPlu.exe
  2⤵
  - Executes dropped EXE
  PID:2428
- C:\Windows\System\tNlxsba.exe
  C:\Windows\System\tNlxsba.exe
  2⤵
  - Executes dropped EXE
  PID:1304
- C:\Windows\System\WjZteJd.exe
  C:\Windows\System\WjZteJd.exe
  2⤵
  - Executes dropped EXE
  PID:3020
- C:\Windows\System\wrsvvps.exe
  C:\Windows\System\wrsvvps.exe
  2⤵
  - Executes dropped EXE
  PID:2728
- C:\Windows\System\oastmZO.exe
  C:\Windows\System\oastmZO.exe
  2⤵
  - Executes dropped EXE
  PID:2480
- C:\Windows\System\GvCFRMc.exe
  C:\Windows\System\GvCFRMc.exe
  2⤵
  - Executes dropped EXE
  PID:2592
- C:\Windows\System\ZrdRvwc.exe
  C:\Windows\System\ZrdRvwc.exe
  2⤵
  - Executes dropped EXE
  PID:2780
- C:\Windows\System\GOJSHkW.exe
  C:\Windows\System\GOJSHkW.exe
  2⤵
  - Executes dropped EXE
  PID:2920
- C:\Windows\System\fPhxXOF.exe
  C:\Windows\System\fPhxXOF.exe
  2⤵
  - Executes dropped EXE
  PID:2520
- C:\Windows\System\faVAkrA.exe
  C:\Windows\System\faVAkrA.exe
  2⤵
  - Executes dropped EXE
  PID:2516
- C:\Windows\System\qKIOMeN.exe
  C:\Windows\System\qKIOMeN.exe
  2⤵
  - Executes dropped EXE
  PID:1148
- C:\Windows\System\TBfYKUE.exe
  C:\Windows\System\TBfYKUE.exe
  2⤵
  - Executes dropped EXE
  PID:2112
- C:\Windows\System\fcdwaOK.exe
  C:\Windows\System\fcdwaOK.exe
  2⤵
  - Executes dropped EXE
  PID:972
- C:\Windows\System\hHaKKkw.exe
  C:\Windows\System\hHaKKkw.exe
  2⤵
  - Executes dropped EXE
  PID:2456
- C:\Windows\System\KCrsdkr.exe
  C:\Windows\System\KCrsdkr.exe
  2⤵
  - Executes dropped EXE
  PID:1808
- C:\Windows\System\ZAZTvwt.exe
  C:\Windows\System\ZAZTvwt.exe
  2⤵
  - Executes dropped EXE
  PID:1308
- C:\Windows\System\RrcLhpp.exe
  C:\Windows\System\RrcLhpp.exe
  2⤵
  - Executes dropped EXE
  PID:2544
- C:\Windows\System\NETXaWI.exe
  C:\Windows\System\NETXaWI.exe
  2⤵
  - Executes dropped EXE
  PID:2656
- C:\Windows\System\wmpHYNq.exe
  C:\Windows\System\wmpHYNq.exe
  2⤵
  - Executes dropped EXE
  PID:1960
- C:\Windows\System\FYEoasm.exe
  C:\Windows\System\FYEoasm.exe
  2⤵
  - Executes dropped EXE
  PID:1788
- C:\Windows\System\Nwmsfra.exe
  C:\Windows\System\Nwmsfra.exe
  2⤵
  - Executes dropped EXE
  PID:1820
- C:\Windows\System\EjQvnaW.exe
  C:\Windows\System\EjQvnaW.exe
  2⤵
  - Executes dropped EXE
  PID:1828
- C:\Windows\System\UVLOJoO.exe
  C:\Windows\System\UVLOJoO.exe
  2⤵
  - Executes dropped EXE
  PID:2424
- C:\Windows\System\NMgshgY.exe
  C:\Windows\System\NMgshgY.exe
  2⤵
  - Executes dropped EXE
  PID:2192
- C:\Windows\System\zzuLVSi.exe
  C:\Windows\System\zzuLVSi.exe
  2⤵
  - Executes dropped EXE
  PID:2152
- C:\Windows\System\KCMWver.exe
  C:\Windows\System\KCMWver.exe
  2⤵
  - Executes dropped EXE
  PID:1720
- C:\Windows\System\UdixNMQ.exe
  C:\Windows\System\UdixNMQ.exe
  2⤵
  - Executes dropped EXE
  PID:836
- C:\Windows\System\WTzAiPV.exe
  C:\Windows\System\WTzAiPV.exe
  2⤵
  - Executes dropped EXE
  PID:1188
- C:\Windows\System\lzDIUpq.exe
  C:\Windows\System\lzDIUpq.exe
  2⤵
  - Executes dropped EXE
  PID:2280
- C:\Windows\System\zlgGYmB.exe
  C:\Windows\System\zlgGYmB.exe
  2⤵
  - Executes dropped EXE
  PID:660
- C:\Windows\System\DKPCJrK.exe
  C:\Windows\System\DKPCJrK.exe
  2⤵
  - Executes dropped EXE
  PID:2840
- C:\Windows\System\YqCKvUw.exe
  C:\Windows\System\YqCKvUw.exe
  2⤵
  - Executes dropped EXE
  PID:2124
- C:\Windows\System\YbrTsEd.exe
  C:\Windows\System\YbrTsEd.exe
  2⤵
  - Executes dropped EXE
  PID:1300
- C:\Windows\System\VDWdcRF.exe
  C:\Windows\System\VDWdcRF.exe
  2⤵
  - Executes dropped EXE
  PID:1004
- C:\Windows\System\GEFsBor.exe
  C:\Windows\System\GEFsBor.exe
  2⤵
  - Executes dropped EXE
  PID:824
- C:\Windows\System\wEpiFVM.exe
  C:\Windows\System\wEpiFVM.exe
  2⤵
  - Executes dropped EXE
  PID:1648
- C:\Windows\System\bYvMJRm.exe
  C:\Windows\System\bYvMJRm.exe
  2⤵
  - Executes dropped EXE
  PID:1780
- C:\Windows\System\XNDNDCX.exe
  C:\Windows\System\XNDNDCX.exe
  2⤵
  - Executes dropped EXE
  PID:360
- C:\Windows\System\TUboIhM.exe
  C:\Windows\System\TUboIhM.exe
  2⤵
  - Executes dropped EXE
  PID:1244
- C:\Windows\System\qDrnBHy.exe
  C:\Windows\System\qDrnBHy.exe
  2⤵
  - Executes dropped EXE
  PID:600
- C:\Windows\System\pEFONcP.exe
  C:\Windows\System\pEFONcP.exe
  2⤵
  - Executes dropped EXE
  PID:3068
- C:\Windows\System\wTEivsH.exe
  C:\Windows\System\wTEivsH.exe
  2⤵
  - Executes dropped EXE
  PID:1708
- C:\Windows\System\JVGVEAw.exe
  C:\Windows\System\JVGVEAw.exe
  2⤵
  - Executes dropped EXE
  PID:1248
- C:\Windows\System\bFPjolU.exe
  C:\Windows\System\bFPjolU.exe
  2⤵
  - Executes dropped EXE
  PID:2028
- C:\Windows\System\BibpejI.exe
  C:\Windows\System\BibpejI.exe
  2⤵
  - Executes dropped EXE
  PID:1764
- C:\Windows\System\mszKzAT.exe
  C:\Windows\System\mszKzAT.exe
  2⤵
  - Executes dropped EXE
  PID:1676
- C:\Windows\System\ZMmsGSE.exe
  C:\Windows\System\ZMmsGSE.exe
  2⤵
  - Executes dropped EXE
  PID:2968
- C:\Windows\System\ScuxaaW.exe
  C:\Windows\System\ScuxaaW.exe
  2⤵
  - Executes dropped EXE
  PID:1364
- C:\Windows\System\NilYRYw.exe
  C:\Windows\System\NilYRYw.exe
  2⤵
  - Executes dropped EXE
  PID:2996
- C:\Windows\System\nKPBEiK.exe
  C:\Windows\System\nKPBEiK.exe
  2⤵
  - Executes dropped EXE
  PID:1696
- C:\Windows\System\gQxeVvt.exe
  C:\Windows\System\gQxeVvt.exe
  2⤵
  - Executes dropped EXE
  PID:2748
- C:\Windows\System\JhyXEoD.exe
  C:\Windows\System\JhyXEoD.exe
  2⤵
  - Executes dropped EXE
  PID:2908
- C:\Windows\System\suNhMcf.exe
  C:\Windows\System\suNhMcf.exe
  2⤵
  - Executes dropped EXE
  PID:2632
- C:\Windows\System\hvXbnEA.exe
  C:\Windows\System\hvXbnEA.exe
  2⤵
  - Executes dropped EXE
  PID:2692
- C:\Windows\System\SRzITaJ.exe
  C:\Windows\System\SRzITaJ.exe
  2⤵
  - Executes dropped EXE
  PID:2508
- C:\Windows\System\jtOcDvr.exe
  C:\Windows\System\jtOcDvr.exe
  2⤵
  - Executes dropped EXE
  PID:2640
- C:\Windows\System\epCOPUE.exe
  C:\Windows\System\epCOPUE.exe
  2⤵
  - Executes dropped EXE
  PID:1108
- C:\Windows\System\CBMJYjn.exe
  C:\Windows\System\CBMJYjn.exe
  2⤵
  - Executes dropped EXE
  PID:1996
- C:\Windows\System\PnQRixv.exe
  C:\Windows\System\PnQRixv.exe
  2⤵
  - Executes dropped EXE
  PID:948
- C:\Windows\System\qYDQGqF.exe
  C:\Windows\System\qYDQGqF.exe
  2⤵
  - Executes dropped EXE
  PID:1372
- C:\Windows\System\zJdclgH.exe
  C:\Windows\System\zJdclgH.exe
  2⤵
  - Executes dropped EXE
  PID:2672
- C:\Windows\System\WSqdaXm.exe
  C:\Windows\System\WSqdaXm.exe
  2⤵
  - Executes dropped EXE
  PID:2768
- C:\Windows\System\vHpBsNv.exe
  C:\Windows\System\vHpBsNv.exe
  2⤵
  - Executes dropped EXE
  PID:2868
- C:\Windows\System\katiMnr.exe
  C:\Windows\System\katiMnr.exe
  2⤵
  - Executes dropped EXE
  PID:1644
- C:\Windows\System\RWEYHFU.exe
  C:\Windows\System\RWEYHFU.exe
  2⤵
  PID:936
- C:\Windows\System\iCOevbg.exe
  C:\Windows\System\iCOevbg.exe
  2⤵
  PID:1728
- C:\Windows\System\wbktKrN.exe
  C:\Windows\System\wbktKrN.exe
  2⤵
  PID:512
- C:\Windows\System\AvSnNeR.exe
  C:\Windows\System\AvSnNeR.exe
  2⤵
  PID:1468
- C:\Windows\System\fDtfyFR.exe
  C:\Windows\System\fDtfyFR.exe
  2⤵
  PID:2524
- C:\Windows\System\KRGxIaN.exe
  C:\Windows\System\KRGxIaN.exe
  2⤵
  PID:2688
- C:\Windows\System\fCMNeXj.exe
  C:\Windows\System\fCMNeXj.exe
  2⤵
  PID:1264
- C:\Windows\System\vALwKLo.exe
  C:\Windows\System\vALwKLo.exe
  2⤵
  PID:2388
- C:\Windows\System\mUWorNe.exe
  C:\Windows\System\mUWorNe.exe
  2⤵
  PID:2260
- C:\Windows\System\YFpzazU.exe
  C:\Windows\System\YFpzazU.exe
  2⤵
  PID:1576
- C:\Windows\System\WonldAK.exe
  C:\Windows\System\WonldAK.exe
  2⤵
  PID:3016
- C:\Windows\System\DipDvWe.exe
  C:\Windows\System\DipDvWe.exe
  2⤵
  PID:2444
- C:\Windows\System\uitPFxF.exe
  C:\Windows\System\uitPFxF.exe
  2⤵
  PID:2712
- C:\Windows\System\FagxYPL.exe
  C:\Windows\System\FagxYPL.exe
  2⤵
  PID:384
- C:\Windows\System\gAeGbjD.exe
  C:\Windows\System\gAeGbjD.exe
  2⤵
  PID:924
- C:\Windows\System\CjByQsB.exe
  C:\Windows\System\CjByQsB.exe
  2⤵
  PID:584
- C:\Windows\System\gWnPtvs.exe
  C:\Windows\System\gWnPtvs.exe
  2⤵
  PID:2032
- C:\Windows\System\dLVjOYK.exe
  C:\Windows\System\dLVjOYK.exe
  2⤵
  PID:1680
- C:\Windows\System\zSCdDPF.exe
  C:\Windows\System\zSCdDPF.exe
  2⤵
  PID:1856
- C:\Windows\System\OekKCQq.exe
  C:\Windows\System\OekKCQq.exe
  2⤵
  PID:2120
- C:\Windows\System\GGGsKGV.exe
  C:\Windows\System\GGGsKGV.exe
  2⤵
  PID:2944
- C:\Windows\System\SRwzImD.exe
  C:\Windows\System\SRwzImD.exe
  2⤵
  PID:2980
- C:\Windows\System\mdHvxyX.exe
  C:\Windows\System\mdHvxyX.exe
  2⤵
  PID:1488
- C:\Windows\System\MJLpLHn.exe
  C:\Windows\System\MJLpLHn.exe
  2⤵
  PID:1744
- C:\Windows\System\KJQMZtY.exe
  C:\Windows\System\KJQMZtY.exe
  2⤵
  PID:2100
- C:\Windows\System\IVyxOwq.exe
  C:\Windows\System\IVyxOwq.exe
  2⤵
  PID:2828
- C:\Windows\System\MbfkPgv.exe
  C:\Windows\System\MbfkPgv.exe
  2⤵
  PID:740
- C:\Windows\System\ZpfceVI.exe
  C:\Windows\System\ZpfceVI.exe
  2⤵
  PID:2772
- C:\Windows\System\MPArjAW.exe
  C:\Windows\System\MPArjAW.exe
  2⤵
  PID:1616
- C:\Windows\System\DtSKZoS.exe
  C:\Windows\System\DtSKZoS.exe
  2⤵
  PID:520
- C:\Windows\System\UAqElhn.exe
  C:\Windows\System\UAqElhn.exe
  2⤵
  PID:2788
- C:\Windows\System\uXCjKMk.exe
  C:\Windows\System\uXCjKMk.exe
  2⤵
  PID:616
- C:\Windows\System\QHHxQfe.exe
  C:\Windows\System\QHHxQfe.exe
  2⤵
  PID:568
- C:\Windows\System\qOyRNFW.exe
  C:\Windows\System\qOyRNFW.exe
  2⤵
  PID:2588
- C:\Windows\System\Izegjmj.exe
  C:\Windows\System\Izegjmj.exe
  2⤵
  PID:820
- C:\Windows\System\fBOUrcp.exe
  C:\Windows\System\fBOUrcp.exe
  2⤵
  PID:2148
- C:\Windows\System\IWZXVTz.exe
  C:\Windows\System\IWZXVTz.exe
  2⤵
  PID:2440
- C:\Windows\System\GJYMiXP.exe
  C:\Windows\System\GJYMiXP.exe
  2⤵
  PID:1336
- C:\Windows\System\DWiciVR.exe
  C:\Windows\System\DWiciVR.exe
  2⤵
  PID:1440
- C:\Windows\System\XtAZxtL.exe
  C:\Windows\System\XtAZxtL.exe
  2⤵
  PID:1416
- C:\Windows\System\pITiMcd.exe
  C:\Windows\System\pITiMcd.exe
  2⤵
  PID:968
- C:\Windows\System\UHZnVbS.exe
  C:\Windows\System\UHZnVbS.exe
  2⤵
  PID:1524
- C:\Windows\System\vgqmoQH.exe
  C:\Windows\System\vgqmoQH.exe
  2⤵
  PID:1528
- C:\Windows\System\AauKeBW.exe
  C:\Windows\System\AauKeBW.exe
  2⤵
  PID:1964
- C:\Windows\System\lHSUzuK.exe
  C:\Windows\System\lHSUzuK.exe
  2⤵
  PID:1932
- C:\Windows\System\XDdBjFv.exe
  C:\Windows\System\XDdBjFv.exe
  2⤵
  PID:2612
- C:\Windows\System\iJYkIoM.exe
  C:\Windows\System\iJYkIoM.exe
  2⤵
  PID:1288
- C:\Windows\System\AYTKeUt.exe
  C:\Windows\System\AYTKeUt.exe
  2⤵
  PID:2556
- C:\Windows\System\TnezsqB.exe
  C:\Windows\System\TnezsqB.exe
  2⤵
  PID:1592
- C:\Windows\System\PnjMVjk.exe
  C:\Windows\System\PnjMVjk.exe
  2⤵
  PID:1704
- C:\Windows\System\DgVHVEk.exe
  C:\Windows\System\DgVHVEk.exe
  2⤵
  PID:2864
- C:\Windows\System\logjYUG.exe
  C:\Windows\System\logjYUG.exe
  2⤵
  PID:2372
- C:\Windows\System\DNyynGQ.exe
  C:\Windows\System\DNyynGQ.exe
  2⤵
  PID:1732
- C:\Windows\System\aPdNBzI.exe
  C:\Windows\System\aPdNBzI.exe
  2⤵
  PID:2196
- C:\Windows\System\ZcHKhhn.exe
  C:\Windows\System\ZcHKhhn.exe
  2⤵
  PID:2932
- C:\Windows\System\PqTVLHG.exe
  C:\Windows\System\PqTVLHG.exe
  2⤵
  PID:1628
- C:\Windows\System\GydTdnv.exe
  C:\Windows\System\GydTdnv.exe
  2⤵
  PID:2624
- C:\Windows\System\aRWOasT.exe
  C:\Windows\System\aRWOasT.exe
  2⤵
  PID:2972
- C:\Windows\System\EeSOTPv.exe
  C:\Windows\System\EeSOTPv.exe
  2⤵
  PID:1036
- C:\Windows\System\beLtVqF.exe
  C:\Windows\System\beLtVqF.exe
  2⤵
  PID:472
- C:\Windows\System\OpUupHX.exe
  C:\Windows\System\OpUupHX.exe
  2⤵
  PID:1792
- C:\Windows\System\QSQBevs.exe
  C:\Windows\System\QSQBevs.exe
  2⤵
  PID:1252
- C:\Windows\System\nYyaVyr.exe
  C:\Windows\System\nYyaVyr.exe
  2⤵
  PID:2200
- C:\Windows\System\hwxEHlR.exe
  C:\Windows\System\hwxEHlR.exe
  2⤵
  PID:2500
- C:\Windows\System\wIWtsDc.exe
  C:\Windows\System\wIWtsDc.exe
  2⤵
  PID:1832
- C:\Windows\System\kUtROzp.exe
  C:\Windows\System\kUtROzp.exe
  2⤵
  PID:828
- C:\Windows\System\CpQxCph.exe
  C:\Windows\System\CpQxCph.exe
  2⤵
  PID:2716
- C:\Windows\System\HHAYosM.exe
  C:\Windows\System\HHAYosM.exe
  2⤵
  PID:1604
- C:\Windows\System\GJXstBc.exe
  C:\Windows\System\GJXstBc.exe
  2⤵
  PID:2256
- C:\Windows\System\PvyayJA.exe
  C:\Windows\System\PvyayJA.exe
  2⤵
  PID:2816
- C:\Windows\System\TZiyWrB.exe
  C:\Windows\System\TZiyWrB.exe
  2⤵
  PID:2764
- C:\Windows\System\oJuKUKV.exe
  C:\Windows\System\oJuKUKV.exe
  2⤵
  PID:2820
- C:\Windows\System\TMUEUGx.exe
  C:\Windows\System\TMUEUGx.exe
  2⤵
  PID:2176
- C:\Windows\System\KLWKzUc.exe
  C:\Windows\System\KLWKzUc.exe
  2⤵
  PID:2600
- C:\Windows\System\eFjvpCW.exe
  C:\Windows\System\eFjvpCW.exe
  2⤵
  PID:2076
- C:\Windows\System\tzIDDfF.exe
  C:\Windows\System\tzIDDfF.exe
  2⤵
  PID:1584
- C:\Windows\System\WybWXnw.exe
  C:\Windows\System\WybWXnw.exe
  2⤵
  PID:2696
- C:\Windows\System\QMBJKdY.exe
  C:\Windows\System\QMBJKdY.exe
  2⤵
  PID:2844
- C:\Windows\System\cCGwVVd.exe
  C:\Windows\System\cCGwVVd.exe
  2⤵
  PID:2380
- C:\Windows\System\CUvUEBV.exe
  C:\Windows\System\CUvUEBV.exe
  2⤵
  PID:3052
- C:\Windows\System\uQCYUgU.exe
  C:\Windows\System\uQCYUgU.exe
  2⤵
  PID:928
- C:\Windows\System\uksBMRk.exe
  C:\Windows\System\uksBMRk.exe
  2⤵
  PID:2188
- C:\Windows\System\mhllUIQ.exe
  C:\Windows\System\mhllUIQ.exe
  2⤵
  PID:2416
- C:\Windows\System\lgZZSvD.exe
  C:\Windows\System\lgZZSvD.exe
  2⤵
  PID:1980
- C:\Windows\System\ryITXCX.exe
  C:\Windows\System\ryITXCX.exe
  2⤵
  PID:1028
- C:\Windows\System\qHXwawX.exe
  C:\Windows\System\qHXwawX.exe
  2⤵
  PID:1800
- C:\Windows\System\KAbZVGe.exe
  C:\Windows\System\KAbZVGe.exe
  2⤵
  PID:1776
- C:\Windows\System\owuiszd.exe
  C:\Windows\System\owuiszd.exe
  2⤵
  PID:2404
- C:\Windows\System\XCHuHCo.exe
  C:\Windows\System\XCHuHCo.exe
  2⤵
  PID:2376
- C:\Windows\System\qdkUMfU.exe
  C:\Windows\System\qdkUMfU.exe
  2⤵
  PID:1624
- C:\Windows\System\McFGXEZ.exe
  C:\Windows\System\McFGXEZ.exe
  2⤵
  PID:2608
- C:\Windows\System\HHqqTNV.exe
  C:\Windows\System\HHqqTNV.exe
  2⤵
  PID:2852
- C:\Windows\System\LOGUxMx.exe
  C:\Windows\System\LOGUxMx.exe
  2⤵
  PID:2936
- C:\Windows\System\VRQLrBI.exe
  C:\Windows\System\VRQLrBI.exe
  2⤵
  PID:2248
- C:\Windows\System\XmlzDNG.exe
  C:\Windows\System\XmlzDNG.exe
  2⤵
  PID:1688
- C:\Windows\System\NCbqhBk.exe
  C:\Windows\System\NCbqhBk.exe
  2⤵
  PID:752
- C:\Windows\System\TQkwJgV.exe
  C:\Windows\System\TQkwJgV.exe
  2⤵
  PID:3012
- C:\Windows\System\srTYtdD.exe
  C:\Windows\System\srTYtdD.exe
  2⤵
  PID:2620
- C:\Windows\System\KUJPMkD.exe
  C:\Windows\System\KUJPMkD.exe
  2⤵
  PID:2860
- C:\Windows\System\dDSrnFa.exe
  C:\Windows\System\dDSrnFa.exe
  2⤵
  PID:2928
- C:\Windows\System\yhsqzxX.exe
  C:\Windows\System\yhsqzxX.exe
  2⤵
  PID:892
- C:\Windows\System\PBCLdll.exe
  C:\Windows\System\PBCLdll.exe
  2⤵
  PID:2204
- C:\Windows\System\tpcJsSn.exe
  C:\Windows\System\tpcJsSn.exe
  2⤵
  PID:1700
- C:\Windows\System\oAWOoAo.exe
  C:\Windows\System\oAWOoAo.exe
  2⤵
  PID:2604
- C:\Windows\System\okYbbDx.exe
  C:\Windows\System\okYbbDx.exe
  2⤵
  PID:2676
- C:\Windows\System\oZPIZBE.exe
  C:\Windows\System\oZPIZBE.exe
  2⤵
  PID:2140
- C:\Windows\System\pOPaXYh.exe
  C:\Windows\System\pOPaXYh.exe
  2⤵
  PID:3124
- C:\Windows\System\bnIHCOb.exe
  C:\Windows\System\bnIHCOb.exe
  2⤵
  PID:3144
- C:\Windows\System\BLzGepp.exe
  C:\Windows\System\BLzGepp.exe
  2⤵
  PID:3160
- C:\Windows\System\XGOtfHV.exe
  C:\Windows\System\XGOtfHV.exe
  2⤵
  PID:3176
- C:\Windows\System\mNRuiNh.exe
  C:\Windows\System\mNRuiNh.exe
  2⤵
  PID:3192
- C:\Windows\System\PuSlBfi.exe
  C:\Windows\System\PuSlBfi.exe
  2⤵
  PID:3208
- C:\Windows\System\VrTuVdk.exe
  C:\Windows\System\VrTuVdk.exe
  2⤵
  PID:3228
- C:\Windows\System\FDtSkMa.exe
  C:\Windows\System\FDtSkMa.exe
  2⤵
  PID:3244
- C:\Windows\System\mJGrnBu.exe
  C:\Windows\System\mJGrnBu.exe
  2⤵
  PID:3260
- C:\Windows\System\ogSNgqW.exe
  C:\Windows\System\ogSNgqW.exe
  2⤵
  PID:3276
- C:\Windows\System\mulnwEg.exe
  C:\Windows\System\mulnwEg.exe
  2⤵
  PID:3292
- C:\Windows\System\ajGFLUD.exe
  C:\Windows\System\ajGFLUD.exe
  2⤵
  PID:3308
- C:\Windows\System\eoWUIqK.exe
  C:\Windows\System\eoWUIqK.exe
  2⤵
  PID:3384
- C:\Windows\System\LsdEtvk.exe
  C:\Windows\System\LsdEtvk.exe
  2⤵
  PID:3404
- C:\Windows\System\YgviddQ.exe
  C:\Windows\System\YgviddQ.exe
  2⤵
  PID:3420
- C:\Windows\System\vbiiboz.exe
  C:\Windows\System\vbiiboz.exe
  2⤵
  PID:3456
- C:\Windows\System\bHNBKZc.exe
  C:\Windows\System\bHNBKZc.exe
  2⤵
  PID:3472
- C:\Windows\System\uBOXsDu.exe
  C:\Windows\System\uBOXsDu.exe
  2⤵
  PID:3496
- C:\Windows\System\VrVDQLa.exe
  C:\Windows\System\VrVDQLa.exe
  2⤵
  PID:3512
- C:\Windows\System\LemzmJL.exe
  C:\Windows\System\LemzmJL.exe
  2⤵
  PID:3528
- C:\Windows\System\JIDDrRl.exe
  C:\Windows\System\JIDDrRl.exe
  2⤵
  PID:3544
- C:\Windows\System\GEbOgof.exe
  C:\Windows\System\GEbOgof.exe
  2⤵
  PID:3564
- C:\Windows\System\OjgmRHt.exe
  C:\Windows\System\OjgmRHt.exe
  2⤵
  PID:3580
- C:\Windows\System\uUJgjDd.exe
  C:\Windows\System\uUJgjDd.exe
  2⤵
  PID:3596
- C:\Windows\System\MhGUAzg.exe
  C:\Windows\System\MhGUAzg.exe
  2⤵
  PID:3616
- C:\Windows\System\UTyegIA.exe
  C:\Windows\System\UTyegIA.exe
  2⤵
  PID:3632
- C:\Windows\System\WKfJiJK.exe
  C:\Windows\System\WKfJiJK.exe
  2⤵
  PID:3648
- C:\Windows\System\MNRcFPF.exe
  C:\Windows\System\MNRcFPF.exe
  2⤵
  PID:3668
- C:\Windows\System\nLUIvCo.exe
  C:\Windows\System\nLUIvCo.exe
  2⤵
  PID:3684
- C:\Windows\System\BsHecly.exe
  C:\Windows\System\BsHecly.exe
  2⤵
  PID:3704
- C:\Windows\System\fxxyiKZ.exe
  C:\Windows\System\fxxyiKZ.exe
  2⤵
  PID:3720
- C:\Windows\System\lWpkrMs.exe
  C:\Windows\System\lWpkrMs.exe
  2⤵
  PID:3780
- C:\Windows\System\eoGlHMX.exe
  C:\Windows\System\eoGlHMX.exe
  2⤵
  PID:3796
- C:\Windows\System\eUmNxee.exe
  C:\Windows\System\eUmNxee.exe
  2⤵
  PID:3812
- C:\Windows\System\jlKcsaC.exe
  C:\Windows\System\jlKcsaC.exe
  2⤵
  PID:3828
- C:\Windows\System\GreWUQH.exe
  C:\Windows\System\GreWUQH.exe
  2⤵
  PID:3844
- C:\Windows\System\IxNYEYp.exe
  C:\Windows\System\IxNYEYp.exe
  2⤵
  PID:3860
- C:\Windows\System\EfWxGxV.exe
  C:\Windows\System\EfWxGxV.exe
  2⤵
  PID:3876
- C:\Windows\System\rHketTW.exe
  C:\Windows\System\rHketTW.exe
  2⤵
  PID:3892
- C:\Windows\System\oTMntKR.exe
  C:\Windows\System\oTMntKR.exe
  2⤵
  PID:3912
- C:\Windows\System\CmNNPJq.exe
  C:\Windows\System\CmNNPJq.exe
  2⤵
  PID:3928
- C:\Windows\System\fKcaTQa.exe
  C:\Windows\System\fKcaTQa.exe
  2⤵
  PID:3944
- C:\Windows\System\JsnpnyG.exe
  C:\Windows\System\JsnpnyG.exe
  2⤵
  PID:3964
- C:\Windows\System\dFWHEAk.exe
  C:\Windows\System\dFWHEAk.exe
  2⤵
  PID:3980
- C:\Windows\System\xsaMGIT.exe
  C:\Windows\System\xsaMGIT.exe
  2⤵
  PID:4000
- C:\Windows\System\VVgVInm.exe
  C:\Windows\System\VVgVInm.exe
  2⤵
  PID:4016
- C:\Windows\System\agokNdG.exe
  C:\Windows\System\agokNdG.exe
  2⤵
  PID:4032
- C:\Windows\System\BMViglF.exe
  C:\Windows\System\BMViglF.exe
  2⤵
  PID:4048
- C:\Windows\System\xmxLlQj.exe
  C:\Windows\System\xmxLlQj.exe
  2⤵
  PID:4068
- C:\Windows\System\kKRgRfw.exe
  C:\Windows\System\kKRgRfw.exe
  2⤵
  PID:4084
- C:\Windows\System\vXypVoQ.exe
  C:\Windows\System\vXypVoQ.exe
  2⤵
  PID:2576
- C:\Windows\System\GtehWJE.exe
  C:\Windows\System\GtehWJE.exe
  2⤵
  PID:2756
- C:\Windows\System\VJgTRrG.exe
  C:\Windows\System\VJgTRrG.exe
  2⤵
  PID:684
- C:\Windows\System\EKWFqpw.exe
  C:\Windows\System\EKWFqpw.exe
  2⤵
  PID:2584
- C:\Windows\System\AFMYLEl.exe
  C:\Windows\System\AFMYLEl.exe
  2⤵
  PID:624
- C:\Windows\System\fbuavxA.exe
  C:\Windows\System\fbuavxA.exe
  2⤵
  PID:3172
- C:\Windows\System\dnKmbiS.exe
  C:\Windows\System\dnKmbiS.exe
  2⤵
  PID:3240
- C:\Windows\System\VZyEXtW.exe
  C:\Windows\System\VZyEXtW.exe
  2⤵
  PID:3252
- C:\Windows\System\oXhEILU.exe
  C:\Windows\System\oXhEILU.exe
  2⤵
  PID:3152
- C:\Windows\System\fdrIYeo.exe
  C:\Windows\System\fdrIYeo.exe
  2⤵
  PID:3344
- C:\Windows\System\dEiwbKH.exe
  C:\Windows\System\dEiwbKH.exe
  2⤵
  PID:3364
- C:\Windows\System\ySqChDh.exe
  C:\Windows\System\ySqChDh.exe
  2⤵
  PID:3396
- C:\Windows\System\pZdNnzm.exe
  C:\Windows\System\pZdNnzm.exe
  2⤵
  PID:3436
- C:\Windows\System\VGXDcEV.exe
  C:\Windows\System\VGXDcEV.exe
  2⤵
  PID:3464
- C:\Windows\System\wKDhgkH.exe
  C:\Windows\System\wKDhgkH.exe
  2⤵
  PID:3488
- C:\Windows\System\BUeZCaA.exe
  C:\Windows\System\BUeZCaA.exe
  2⤵
  PID:3504
- C:\Windows\System\iIJsgrf.exe
  C:\Windows\System\iIJsgrf.exe
  2⤵
  PID:3628
- C:\Windows\System\yJKDUwQ.exe
  C:\Windows\System\yJKDUwQ.exe
  2⤵
  PID:3604
- C:\Windows\System\JCRMuLb.exe
  C:\Windows\System\JCRMuLb.exe
  2⤵
  PID:3644
- C:\Windows\System\jrWEXVY.exe
  C:\Windows\System\jrWEXVY.exe
  2⤵
  PID:3728
- C:\Windows\System\kAnTevp.exe
  C:\Windows\System\kAnTevp.exe
  2⤵
  PID:3560
- C:\Windows\System\ihxzqeH.exe
  C:\Windows\System\ihxzqeH.exe
  2⤵
  PID:3664
- C:\Windows\System\aBOycHp.exe
  C:\Windows\System\aBOycHp.exe
  2⤵
  PID:3740
- C:\Windows\System\BEwsaaU.exe
  C:\Windows\System\BEwsaaU.exe
  2⤵
  PID:3884
- C:\Windows\System\Xtdnrmw.exe
  C:\Windows\System\Xtdnrmw.exe
  2⤵
  PID:3824
- C:\Windows\System\QALOmDf.exe
  C:\Windows\System\QALOmDf.exe
  2⤵
  PID:3900
- C:\Windows\System\CwNEfNn.exe
  C:\Windows\System\CwNEfNn.exe
  2⤵
  PID:3888
- C:\Windows\System\AAKvOHl.exe
  C:\Windows\System\AAKvOHl.exe
  2⤵
  PID:3956
- C:\Windows\System\dVUtNZv.exe
  C:\Windows\System\dVUtNZv.exe
  2⤵
  PID:4028
- C:\Windows\System\QbPWTxz.exe
  C:\Windows\System\QbPWTxz.exe
  2⤵
  PID:3268
- C:\Windows\System\KbFUIbY.exe
  C:\Windows\System\KbFUIbY.exe
  2⤵
  PID:1596
- C:\Windows\System\kTZqIqu.exe
  C:\Windows\System\kTZqIqu.exe
  2⤵
  PID:3940
- C:\Windows\System\ZDUXOPt.exe
  C:\Windows\System\ZDUXOPt.exe
  2⤵
  PID:4076
- C:\Windows\System\aqMybdg.exe
  C:\Windows\System\aqMybdg.exe
  2⤵
  PID:1324
- C:\Windows\System\PxEihmw.exe
  C:\Windows\System\PxEihmw.exe
  2⤵
  PID:3084
- C:\Windows\System\YuzCVSA.exe
  C:\Windows\System\YuzCVSA.exe
  2⤵
  PID:3092
- C:\Windows\System\LqCVjih.exe
  C:\Windows\System\LqCVjih.exe
  2⤵
  PID:3540
- C:\Windows\System\JPTqfEm.exe
  C:\Windows\System\JPTqfEm.exe
  2⤵
  PID:3480
- C:\Windows\System\IzdmtqE.exe
  C:\Windows\System\IzdmtqE.exe
  2⤵
  PID:3340
- C:\Windows\System\gbwJcST.exe
  C:\Windows\System\gbwJcST.exe
  2⤵
  PID:3612
- C:\Windows\System\ztxAmpE.exe
  C:\Windows\System\ztxAmpE.exe
  2⤵
  PID:3412
- C:\Windows\System\TvPjZDj.exe
  C:\Windows\System\TvPjZDj.exe
  2⤵
  PID:3552
- C:\Windows\System\kOiXEac.exe
  C:\Windows\System\kOiXEac.exe
  2⤵
  PID:3808
- C:\Windows\System\LFmuPIm.exe
  C:\Windows\System\LFmuPIm.exe
  2⤵
  PID:3988
- C:\Windows\System\ipplEPX.exe
  C:\Windows\System\ipplEPX.exe
  2⤵
  PID:3872
- C:\Windows\System\MsOhFlw.exe
  C:\Windows\System\MsOhFlw.exe
  2⤵
  PID:1460
- C:\Windows\System\DAipPqO.exe
  C:\Windows\System\DAipPqO.exe
  2⤵
  PID:3236
- C:\Windows\System\VikTbHh.exe
  C:\Windows\System\VikTbHh.exe
  2⤵
  PID:3976
- C:\Windows\System\ANgpPxY.exe
  C:\Windows\System\ANgpPxY.exe
  2⤵
  PID:3096
- C:\Windows\System\GWnEsOD.exe
  C:\Windows\System\GWnEsOD.exe
  2⤵
  PID:3316
- C:\Windows\System\ubrJICv.exe
  C:\Windows\System\ubrJICv.exe
  2⤵
  PID:3716
- C:\Windows\System\apbJfCg.exe
  C:\Windows\System\apbJfCg.exe
  2⤵
  PID:3624
- C:\Windows\System\CGKZusi.exe
  C:\Windows\System\CGKZusi.exe
  2⤵
  PID:3336
- C:\Windows\System\eoKQgcG.exe
  C:\Windows\System\eoKQgcG.exe
  2⤵
  PID:3592
- C:\Windows\System\vgLHizU.exe
  C:\Windows\System\vgLHizU.exe
  2⤵
  PID:3792
- C:\Windows\System\rAYvIjD.exe
  C:\Windows\System\rAYvIjD.exe
  2⤵
  PID:3432
- C:\Windows\System\YdsvyjI.exe
  C:\Windows\System\YdsvyjI.exe
  2⤵
  PID:3908
- C:\Windows\System\vnVGzmH.exe
  C:\Windows\System\vnVGzmH.exe
  2⤵
  PID:3220
- C:\Windows\System\LANNfck.exe
  C:\Windows\System\LANNfck.exe
  2⤵
  PID:1852
- C:\Windows\System\CtPrjLQ.exe
  C:\Windows\System\CtPrjLQ.exe
  2⤵
  PID:3112
- C:\Windows\System\JdmkvWC.exe
  C:\Windows\System\JdmkvWC.exe
  2⤵
  PID:3760
- C:\Windows\System\wdLWPgv.exe
  C:\Windows\System\wdLWPgv.exe
  2⤵
  PID:3520
- C:\Windows\System\mqaEHYB.exe
  C:\Windows\System\mqaEHYB.exe
  2⤵
  PID:3368
- C:\Windows\System\vogsTUk.exe
  C:\Windows\System\vogsTUk.exe
  2⤵
  PID:1796
- C:\Windows\System\cuclsgT.exe
  C:\Windows\System\cuclsgT.exe
  2⤵
  PID:3852
- C:\Windows\System\CpLUyOu.exe
  C:\Windows\System\CpLUyOu.exe
  2⤵
  PID:3224
- C:\Windows\System\yAjQIfU.exe
  C:\Windows\System\yAjQIfU.exe
  2⤵
  PID:3776
- C:\Windows\System\gBOTxyj.exe
  C:\Windows\System\gBOTxyj.exe
  2⤵
  PID:3700
- C:\Windows\System\QSYuxhH.exe
  C:\Windows\System\QSYuxhH.exe
  2⤵
  PID:3952
- C:\Windows\System\ykvUwGY.exe
  C:\Windows\System\ykvUwGY.exe
  2⤵
  PID:3640
- C:\Windows\System\lBYPVdt.exe
  C:\Windows\System\lBYPVdt.exe
  2⤵
  PID:3324
- C:\Windows\System\wbNRkKD.exe
  C:\Windows\System\wbNRkKD.exe
  2⤵
  PID:4128
- C:\Windows\System\bfXxrJo.exe
  C:\Windows\System\bfXxrJo.exe
  2⤵
  PID:4148
- C:\Windows\System\JNXyVFl.exe
  C:\Windows\System\JNXyVFl.exe
  2⤵
  PID:4164
- C:\Windows\System\MPIIbzc.exe
  C:\Windows\System\MPIIbzc.exe
  2⤵
  PID:4180
- C:\Windows\System\VugJNyl.exe
  C:\Windows\System\VugJNyl.exe
  2⤵
  PID:4204
- C:\Windows\System\dmJdgZN.exe
  C:\Windows\System\dmJdgZN.exe
  2⤵
  PID:4220
- C:\Windows\System\PQZeqjL.exe
  C:\Windows\System\PQZeqjL.exe
  2⤵
  PID:4236
- C:\Windows\System\sUHHsAN.exe
  C:\Windows\System\sUHHsAN.exe
  2⤵
  PID:4256
- C:\Windows\System\mxnwawA.exe
  C:\Windows\System\mxnwawA.exe
  2⤵
  PID:4272
- C:\Windows\System\AXJBdyw.exe
  C:\Windows\System\AXJBdyw.exe
  2⤵
  PID:4288
- C:\Windows\System\AwPhOPh.exe
  C:\Windows\System\AwPhOPh.exe
  2⤵
  PID:4304
- C:\Windows\System\uOScqUs.exe
  C:\Windows\System\uOScqUs.exe
  2⤵
  PID:4344
- C:\Windows\System\ztkSbIp.exe
  C:\Windows\System\ztkSbIp.exe
  2⤵
  PID:4360
- C:\Windows\System\jhSofnU.exe
  C:\Windows\System\jhSofnU.exe
  2⤵
  PID:4376
- C:\Windows\System\VqegHjs.exe
  C:\Windows\System\VqegHjs.exe
  2⤵
  PID:4392
- C:\Windows\System\LXOMMwG.exe
  C:\Windows\System\LXOMMwG.exe
  2⤵
  PID:4408
- C:\Windows\System\ZQhzfQv.exe
  C:\Windows\System\ZQhzfQv.exe
  2⤵
  PID:4424
- C:\Windows\System\cPfVRwk.exe
  C:\Windows\System\cPfVRwk.exe
  2⤵
  PID:4440
- C:\Windows\System\dEjoRhI.exe
  C:\Windows\System\dEjoRhI.exe
  2⤵
  PID:4456
- C:\Windows\System\hIslGCa.exe
  C:\Windows\System\hIslGCa.exe
  2⤵
  PID:4472
- C:\Windows\System\yHExuHS.exe
  C:\Windows\System\yHExuHS.exe
  2⤵
  PID:4488
- C:\Windows\System\RHCiGPT.exe
  C:\Windows\System\RHCiGPT.exe
  2⤵
  PID:4504
- C:\Windows\System\SdqYBqK.exe
  C:\Windows\System\SdqYBqK.exe
  2⤵
  PID:4520
- C:\Windows\System\ywnSNmv.exe
  C:\Windows\System\ywnSNmv.exe
  2⤵
  PID:4536
- C:\Windows\System\cdPWZgq.exe
  C:\Windows\System\cdPWZgq.exe
  2⤵
  PID:4552
- C:\Windows\System\yRlvuTL.exe
  C:\Windows\System\yRlvuTL.exe
  2⤵
  PID:4568
- C:\Windows\System\TmFyZLa.exe
  C:\Windows\System\TmFyZLa.exe
  2⤵
  PID:4584
- C:\Windows\System\vxYaJGM.exe
  C:\Windows\System\vxYaJGM.exe
  2⤵
  PID:4616
- C:\Windows\System\aykZzhp.exe
  C:\Windows\System\aykZzhp.exe
  2⤵
  PID:4636
- C:\Windows\System\atQBeiF.exe
  C:\Windows\System\atQBeiF.exe
  2⤵
  PID:4652
- C:\Windows\System\RoibRwi.exe
  C:\Windows\System\RoibRwi.exe
  2⤵
  PID:4700
- C:\Windows\System\EYfTUMW.exe
  C:\Windows\System\EYfTUMW.exe
  2⤵
  PID:4716
- C:\Windows\System\qHpBhbS.exe
  C:\Windows\System\qHpBhbS.exe
  2⤵
  PID:4740
- C:\Windows\System\oSMXNpW.exe
  C:\Windows\System\oSMXNpW.exe
  2⤵
  PID:4756
- C:\Windows\System\ByqnqEv.exe
  C:\Windows\System\ByqnqEv.exe
  2⤵
  PID:4780
- C:\Windows\System\BZcPGxq.exe
  C:\Windows\System\BZcPGxq.exe
  2⤵
  PID:4796
- C:\Windows\System\esCEMfi.exe
  C:\Windows\System\esCEMfi.exe
  2⤵
  PID:4812
- C:\Windows\System\TWJFrnf.exe
  C:\Windows\System\TWJFrnf.exe
  2⤵
  PID:4828
- C:\Windows\System\cbldSqr.exe
  C:\Windows\System\cbldSqr.exe
  2⤵
  PID:4844
- C:\Windows\System\BLHxjxO.exe
  C:\Windows\System\BLHxjxO.exe
  2⤵
  PID:4868
- C:\Windows\System\vHtDyah.exe
  C:\Windows\System\vHtDyah.exe
  2⤵
  PID:4884
- C:\Windows\System\KAKytch.exe
  C:\Windows\System\KAKytch.exe
  2⤵
  PID:4900
- C:\Windows\System\tVLXTmV.exe
  C:\Windows\System\tVLXTmV.exe
  2⤵
  PID:4928
- C:\Windows\System\OatrISm.exe
  C:\Windows\System\OatrISm.exe
  2⤵
  PID:4948
- C:\Windows\System\owexCLT.exe
  C:\Windows\System\owexCLT.exe
  2⤵
  PID:4976
- C:\Windows\System\sNndsLb.exe
  C:\Windows\System\sNndsLb.exe
  2⤵
  PID:4996
- C:\Windows\System\kTqbyNf.exe
  C:\Windows\System\kTqbyNf.exe
  2⤵
  PID:5028
- C:\Windows\System\QFXxPIO.exe
  C:\Windows\System\QFXxPIO.exe
  2⤵
  PID:5052
- C:\Windows\System\qKzxfER.exe
  C:\Windows\System\qKzxfER.exe
  2⤵
  PID:5068
- C:\Windows\System\bzzvMDp.exe
  C:\Windows\System\bzzvMDp.exe
  2⤵
  PID:5084
- C:\Windows\System\nCnvLHn.exe
  C:\Windows\System\nCnvLHn.exe
  2⤵
  PID:5100
- C:\Windows\System\rQDSpaA.exe
  C:\Windows\System\rQDSpaA.exe
  2⤵
  PID:5116
- C:\Windows\System\QuQZgrt.exe
  C:\Windows\System\QuQZgrt.exe
  2⤵
  PID:4064
- C:\Windows\System\ivbyytr.exe
  C:\Windows\System\ivbyytr.exe
  2⤵
  PID:4120
- C:\Windows\System\MtDWwTA.exe
  C:\Windows\System\MtDWwTA.exe
  2⤵
  PID:4156
- C:\Windows\System\UlVnbQi.exe
  C:\Windows\System\UlVnbQi.exe
  2⤵
  PID:4296
- C:\Windows\System\AaGtmCd.exe
  C:\Windows\System\AaGtmCd.exe
  2⤵
  PID:4172
- C:\Windows\System\FrfwFEh.exe
  C:\Windows\System\FrfwFEh.exe
  2⤵
  PID:4244
- C:\Windows\System\pFQdmxl.exe
  C:\Windows\System\pFQdmxl.exe
  2⤵
  PID:4312
- C:\Windows\System\FeRCTKY.exe
  C:\Windows\System\FeRCTKY.exe
  2⤵
  PID:4316
- C:\Windows\System\JzFgPfW.exe
  C:\Windows\System\JzFgPfW.exe
  2⤵
  PID:4388
- C:\Windows\System\GHnQMxz.exe
  C:\Windows\System\GHnQMxz.exe
  2⤵
  PID:4320
- C:\Windows\System\WUJEQnP.exe
  C:\Windows\System\WUJEQnP.exe
  2⤵
  PID:4404
- C:\Windows\System\xEQoeIT.exe
  C:\Windows\System\xEQoeIT.exe
  2⤵
  PID:4432
- C:\Windows\System\SRwUlWR.exe
  C:\Windows\System\SRwUlWR.exe
  2⤵
  PID:4468
- C:\Windows\System\qVUJtkD.exe
  C:\Windows\System\qVUJtkD.exe
  2⤵
  PID:4496
- C:\Windows\System\qyHRBWY.exe
  C:\Windows\System\qyHRBWY.exe
  2⤵
  PID:4528
- C:\Windows\System\KaBczDP.exe
  C:\Windows\System\KaBczDP.exe
  2⤵
  PID:4580
- C:\Windows\System\cYHrcqx.exe
  C:\Windows\System\cYHrcqx.exe
  2⤵
  PID:4532
- C:\Windows\System\nCFhZSu.exe
  C:\Windows\System\nCFhZSu.exe
  2⤵
  PID:4604
- C:\Windows\System\FNAsaOw.exe
  C:\Windows\System\FNAsaOw.exe
  2⤵
  PID:4668
- C:\Windows\System\ggukLUa.exe
  C:\Windows\System\ggukLUa.exe
  2⤵
  PID:4684
- C:\Windows\System\hbosrMF.exe
  C:\Windows\System\hbosrMF.exe
  2⤵
  PID:4688
- C:\Windows\System\iFTAEZO.exe
  C:\Windows\System\iFTAEZO.exe
  2⤵
  PID:4728
- C:\Windows\System\oXXlUgE.exe
  C:\Windows\System\oXXlUgE.exe
  2⤵
  PID:4772
- C:\Windows\System\uzusqrq.exe
  C:\Windows\System\uzusqrq.exe
  2⤵
  PID:4776
- C:\Windows\System\gCkmqrZ.exe
  C:\Windows\System\gCkmqrZ.exe
  2⤵
  PID:1836
- C:\Windows\System\sSRjlyE.exe
  C:\Windows\System\sSRjlyE.exe
  2⤵
  PID:4876
- C:\Windows\System\UcAfulA.exe
  C:\Windows\System\UcAfulA.exe
  2⤵
  PID:4896
- C:\Windows\System\tTtumeo.exe
  C:\Windows\System\tTtumeo.exe
  2⤵
  PID:4792
- C:\Windows\System\XFuFiAI.exe
  C:\Windows\System\XFuFiAI.exe
  2⤵
  PID:4892
- C:\Windows\System\JnjLijE.exe
  C:\Windows\System\JnjLijE.exe
  2⤵
  PID:4936
- C:\Windows\System\hoYnNQb.exe
  C:\Windows\System\hoYnNQb.exe
  2⤵
  PID:4944
- C:\Windows\System\vYGLHRi.exe
  C:\Windows\System\vYGLHRi.exe
  2⤵
  PID:4992
- C:\Windows\System\cDzacbL.exe
  C:\Windows\System\cDzacbL.exe
  2⤵
  PID:5020
- C:\Windows\System\PZnHDbN.exe
  C:\Windows\System\PZnHDbN.exe
  2⤵
  PID:5036
- C:\Windows\System\EBXquXV.exe
  C:\Windows\System\EBXquXV.exe
  2⤵
  PID:5096
- C:\Windows\System\GMPXAIe.exe
  C:\Windows\System\GMPXAIe.exe
  2⤵
  PID:3100
- C:\Windows\System\roVwODB.exe
  C:\Windows\System\roVwODB.exe
  2⤵
  PID:4108
- C:\Windows\System\sFnxpXW.exe
  C:\Windows\System\sFnxpXW.exe
  2⤵
  PID:2796
- C:\Windows\System\PKuPzEC.exe
  C:\Windows\System\PKuPzEC.exe
  2⤵
  PID:4196
- C:\Windows\System\pSUHgDn.exe
  C:\Windows\System\pSUHgDn.exe
  2⤵
  PID:4268
- C:\Windows\System\RMzIBoF.exe
  C:\Windows\System\RMzIBoF.exe
  2⤵
  PID:4384
- C:\Windows\System\EENWtRI.exe
  C:\Windows\System\EENWtRI.exe
  2⤵
  PID:4252
- C:\Windows\System\FaDXStp.exe
  C:\Windows\System\FaDXStp.exe
  2⤵
  PID:4136
- C:\Windows\System\ButfKHV.exe
  C:\Windows\System\ButfKHV.exe
  2⤵
  PID:4436
- C:\Windows\System\ozCKHag.exe
  C:\Windows\System\ozCKHag.exe
  2⤵
  PID:4560
- C:\Windows\System\CFBYDyf.exe
  C:\Windows\System\CFBYDyf.exe
  2⤵
  PID:1380
- C:\Windows\System\NkYRrUh.exe
  C:\Windows\System\NkYRrUh.exe
  2⤵
  PID:4624
- C:\Windows\System\MoFgpWS.exe
  C:\Windows\System\MoFgpWS.exe
  2⤵
  PID:4696
- C:\Windows\System\Wdoqoiy.exe
  C:\Windows\System\Wdoqoiy.exe
  2⤵
  PID:4632
- C:\Windows\System\XzdOPoN.exe
  C:\Windows\System\XzdOPoN.exe
  2⤵
  PID:4612
- C:\Windows\System\dRRVaOd.exe
  C:\Windows\System\dRRVaOd.exe
  2⤵
  PID:4836
- C:\Windows\System\YEDYJDJ.exe
  C:\Windows\System\YEDYJDJ.exe
  2⤵
  PID:4956
- C:\Windows\System\oBivtHr.exe
  C:\Windows\System\oBivtHr.exe
  2⤵
  PID:4852
- C:\Windows\System\tsnBJnC.exe
  C:\Windows\System\tsnBJnC.exe
  2⤵
  PID:5016
- C:\Windows\System\qVGAgsk.exe
  C:\Windows\System\qVGAgsk.exe
  2⤵
  PID:5092
- C:\Windows\System\pZfbdIH.exe
  C:\Windows\System\pZfbdIH.exe
  2⤵
  PID:3856
- C:\Windows\System\ESGXdcl.exe
  C:\Windows\System\ESGXdcl.exe
  2⤵
  PID:5108
- C:\Windows\System\IwQaOAa.exe
  C:\Windows\System\IwQaOAa.exe
  2⤵
  PID:4188
- C:\Windows\System\EYUqDfo.exe
  C:\Windows\System\EYUqDfo.exe
  2⤵
  PID:4280
- C:\Windows\System\ixQOeGf.exe
  C:\Windows\System\ixQOeGf.exe
  2⤵
  PID:4336
- C:\Windows\System\wAdBhbB.exe
  C:\Windows\System\wAdBhbB.exe
  2⤵
  PID:4548
- C:\Windows\System\XwHOILn.exe
  C:\Windows\System\XwHOILn.exe
  2⤵
  PID:4768
- C:\Windows\System\GMdxrVV.exe
  C:\Windows\System\GMdxrVV.exe
  2⤵
  PID:4416
- C:\Windows\System\tAplcXt.exe
  C:\Windows\System\tAplcXt.exe
  2⤵
  PID:4752
- C:\Windows\System\nOqpgvS.exe
  C:\Windows\System\nOqpgvS.exe
  2⤵
  PID:4856
- C:\Windows\System\pdgIOui.exe
  C:\Windows\System\pdgIOui.exe
  2⤵
  PID:4924
- C:\Windows\System\pmZWNCk.exe
  C:\Windows\System\pmZWNCk.exe
  2⤵
  PID:5064
- C:\Windows\System\PJmGWhz.exe
  C:\Windows\System\PJmGWhz.exe
  2⤵
  PID:4232
- C:\Windows\System\VpELObR.exe
  C:\Windows\System\VpELObR.exe
  2⤵
  PID:4512
- C:\Windows\System\Xagydsn.exe
  C:\Windows\System\Xagydsn.exe
  2⤵
  PID:4788
- C:\Windows\System\KVZjGvu.exe
  C:\Windows\System\KVZjGvu.exe
  2⤵
  PID:4908
- C:\Windows\System\DVOeneR.exe
  C:\Windows\System\DVOeneR.exe
  2⤵
  PID:4824
- C:\Windows\System\nyIFIoU.exe
  C:\Windows\System\nyIFIoU.exe
  2⤵
  PID:5044
- C:\Windows\System\XIugMTY.exe
  C:\Windows\System\XIugMTY.exe
  2⤵
  PID:4200
- C:\Windows\System\umFYOfP.exe
  C:\Windows\System\umFYOfP.exe
  2⤵
  PID:4176
- C:\Windows\System\WqyYdqu.exe
  C:\Windows\System\WqyYdqu.exe
  2⤵
  PID:4860
- C:\Windows\System\jkKIDnW.exe
  C:\Windows\System\jkKIDnW.exe
  2⤵
  PID:5128
- C:\Windows\System\qmFQqeu.exe
  C:\Windows\System\qmFQqeu.exe
  2⤵
  PID:5144
- C:\Windows\System\CeTVDNF.exe
  C:\Windows\System\CeTVDNF.exe
  2⤵
  PID:5160
- C:\Windows\System\jhOegdA.exe
  C:\Windows\System\jhOegdA.exe
  2⤵
  PID:5176
- C:\Windows\System\sxXVxRB.exe
  C:\Windows\System\sxXVxRB.exe
  2⤵
  PID:5192
- C:\Windows\System\tbhCrNc.exe
  C:\Windows\System\tbhCrNc.exe
  2⤵
  PID:5208
- C:\Windows\System\kAVlloM.exe
  C:\Windows\System\kAVlloM.exe
  2⤵
  PID:5224
- C:\Windows\System\JyKNERT.exe
  C:\Windows\System\JyKNERT.exe
  2⤵
  PID:5240
- C:\Windows\System\fodplDs.exe
  C:\Windows\System\fodplDs.exe
  2⤵
  PID:5256
- C:\Windows\System\ZNmzlta.exe
  C:\Windows\System\ZNmzlta.exe
  2⤵
  PID:5272
- C:\Windows\System\rCeyzrY.exe
  C:\Windows\System\rCeyzrY.exe
  2⤵
  PID:5288
- C:\Windows\System\xchePkB.exe
  C:\Windows\System\xchePkB.exe
  2⤵
  PID:5308
- C:\Windows\System\KRNuvOe.exe
  C:\Windows\System\KRNuvOe.exe
  2⤵
  PID:5324
- C:\Windows\System\czMfoGV.exe
  C:\Windows\System\czMfoGV.exe
  2⤵
  PID:5340
- C:\Windows\System\kwZuIrF.exe
  C:\Windows\System\kwZuIrF.exe
  2⤵
  PID:5356
- C:\Windows\System\jtZKbcR.exe
  C:\Windows\System\jtZKbcR.exe
  2⤵
  PID:5372
- C:\Windows\System\sxmTpyb.exe
  C:\Windows\System\sxmTpyb.exe
  2⤵
  PID:5388
- C:\Windows\System\MsoIlZz.exe
  C:\Windows\System\MsoIlZz.exe
  2⤵
  PID:5404
- C:\Windows\System\HBnjGao.exe
  C:\Windows\System\HBnjGao.exe
  2⤵
  PID:5420
- C:\Windows\System\zgAqoHA.exe
  C:\Windows\System\zgAqoHA.exe
  2⤵
  PID:5436
- C:\Windows\System\zSIKigk.exe
  C:\Windows\System\zSIKigk.exe
  2⤵
  PID:5452
- C:\Windows\System\QnPqCpJ.exe
  C:\Windows\System\QnPqCpJ.exe
  2⤵
  PID:5468
- C:\Windows\System\HvZGpUf.exe
  C:\Windows\System\HvZGpUf.exe
  2⤵
  PID:5484
- C:\Windows\System\jVVPOXx.exe
  C:\Windows\System\jVVPOXx.exe
  2⤵
  PID:5500
- C:\Windows\System\VuLmQlJ.exe
  C:\Windows\System\VuLmQlJ.exe
  2⤵
  PID:5516
- C:\Windows\System\aDqXOLL.exe
  C:\Windows\System\aDqXOLL.exe
  2⤵
  PID:5532
- C:\Windows\System\JaWteuk.exe
  C:\Windows\System\JaWteuk.exe
  2⤵
  PID:5548
- C:\Windows\System\KbrVBHL.exe
  C:\Windows\System\KbrVBHL.exe
  2⤵
  PID:5564
- C:\Windows\System\VIIqRXx.exe
  C:\Windows\System\VIIqRXx.exe
  2⤵
  PID:5580
- C:\Windows\System\AvOoJWI.exe
  C:\Windows\System\AvOoJWI.exe
  2⤵
  PID:5596
- C:\Windows\System\yHaHhWU.exe
  C:\Windows\System\yHaHhWU.exe
  2⤵
  PID:5612
- C:\Windows\System\ObKOuGH.exe
  C:\Windows\System\ObKOuGH.exe
  2⤵
  PID:5628
- C:\Windows\System\DPKRtnz.exe
  C:\Windows\System\DPKRtnz.exe
  2⤵
  PID:5644
- C:\Windows\System\UrsRDKg.exe
  C:\Windows\System\UrsRDKg.exe
  2⤵
  PID:5660
- C:\Windows\System\MHCjxTs.exe
  C:\Windows\System\MHCjxTs.exe
  2⤵
  PID:5676
- C:\Windows\System\yYFHEtf.exe
  C:\Windows\System\yYFHEtf.exe
  2⤵
  PID:5692
- C:\Windows\System\mIMvPWS.exe
  C:\Windows\System\mIMvPWS.exe
  2⤵
  PID:5708
- C:\Windows\System\pwxcLcg.exe
  C:\Windows\System\pwxcLcg.exe
  2⤵
  PID:5724
- C:\Windows\System\uFGfoMM.exe
  C:\Windows\System\uFGfoMM.exe
  2⤵
  PID:5740
- C:\Windows\System\bwDCJiA.exe
  C:\Windows\System\bwDCJiA.exe
  2⤵
  PID:5756
- C:\Windows\System\faSxBzj.exe
  C:\Windows\System\faSxBzj.exe
  2⤵
  PID:5772
- C:\Windows\System\cvRfoCv.exe
  C:\Windows\System\cvRfoCv.exe
  2⤵
  PID:5788
- C:\Windows\System\KUCRNIp.exe
  C:\Windows\System\KUCRNIp.exe
  2⤵
  PID:5804
- C:\Windows\System\josvmQF.exe
  C:\Windows\System\josvmQF.exe
  2⤵
  PID:5820
- C:\Windows\System\guYNVxD.exe
  C:\Windows\System\guYNVxD.exe
  2⤵
  PID:5836
- C:\Windows\System\jsBVJTy.exe
  C:\Windows\System\jsBVJTy.exe
  2⤵
  PID:5852
- C:\Windows\System\wIPgCVk.exe
  C:\Windows\System\wIPgCVk.exe
  2⤵
  PID:5868
- C:\Windows\System\gqbWMcg.exe
  C:\Windows\System\gqbWMcg.exe
  2⤵
  PID:5884
- C:\Windows\System\IvYaZEj.exe
  C:\Windows\System\IvYaZEj.exe
  2⤵
  PID:5900
- C:\Windows\System\kjhNigI.exe
  C:\Windows\System\kjhNigI.exe
  2⤵
  PID:5916
- C:\Windows\System\gnurMSF.exe
  C:\Windows\System\gnurMSF.exe
  2⤵
  PID:5932
- C:\Windows\System\DsOozZc.exe
  C:\Windows\System\DsOozZc.exe
  2⤵
  PID:5948
- C:\Windows\System\eoiJagi.exe
  C:\Windows\System\eoiJagi.exe
  2⤵
  PID:5964
- C:\Windows\System\XboDGNu.exe
  C:\Windows\System\XboDGNu.exe
  2⤵
  PID:5980
- C:\Windows\System\PVEUfRV.exe
  C:\Windows\System\PVEUfRV.exe
  2⤵
  PID:5996
- C:\Windows\System\KYosbiA.exe
  C:\Windows\System\KYosbiA.exe
  2⤵
  PID:6012
- C:\Windows\System\wwWOqaW.exe
  C:\Windows\System\wwWOqaW.exe
  2⤵
  PID:6028
- C:\Windows\System\ZjyHAoJ.exe
  C:\Windows\System\ZjyHAoJ.exe
  2⤵
  PID:6044
- C:\Windows\System\tahdQjl.exe
  C:\Windows\System\tahdQjl.exe
  2⤵
  PID:6060
- C:\Windows\System\rosDkRk.exe
  C:\Windows\System\rosDkRk.exe
  2⤵
  PID:6076
- C:\Windows\System\FHGEENy.exe
  C:\Windows\System\FHGEENy.exe
  2⤵
  PID:6096
- C:\Windows\System\fJsgMbr.exe
  C:\Windows\System\fJsgMbr.exe
  2⤵
  PID:6112
- C:\Windows\System\kCGPnIO.exe
  C:\Windows\System\kCGPnIO.exe
  2⤵
  PID:6128
- C:\Windows\System\IudenNX.exe
  C:\Windows\System\IudenNX.exe
  2⤵
  PID:5060
- C:\Windows\System\emdFdjk.exe
  C:\Windows\System\emdFdjk.exe
  2⤵
  PID:4284
- C:\Windows\System\nsRjNVZ.exe
  C:\Windows\System\nsRjNVZ.exe
  2⤵
  PID:5080
- C:\Windows\System\QnfSdqD.exe
  C:\Windows\System\QnfSdqD.exe
  2⤵
  PID:5220
- C:\Windows\System\ScfddVy.exe
  C:\Windows\System\ScfddVy.exe
  2⤵
  PID:5232
- C:\Windows\System\UbytSIg.exe
  C:\Windows\System\UbytSIg.exe
  2⤵
  PID:5236
- C:\Windows\System\QYYBqyU.exe
  C:\Windows\System\QYYBqyU.exe
  2⤵
  PID:5300
- C:\Windows\System\fpIxKQY.exe
  C:\Windows\System\fpIxKQY.exe
  2⤵
  PID:5352
- C:\Windows\System\OiDMMCL.exe
  C:\Windows\System\OiDMMCL.exe
  2⤵
  PID:5332
- C:\Windows\System\EKesXTY.exe
  C:\Windows\System\EKesXTY.exe
  2⤵
  PID:5396
- C:\Windows\System\BffRiUn.exe
  C:\Windows\System\BffRiUn.exe
  2⤵
  PID:5432
- C:\Windows\System\MmRcuoa.exe
  C:\Windows\System\MmRcuoa.exe
  2⤵
  PID:5480
- C:\Windows\System\mJsVRrO.exe
  C:\Windows\System\mJsVRrO.exe
  2⤵
  PID:5492
- C:\Windows\System\cucurZh.exe
  C:\Windows\System\cucurZh.exe
  2⤵
  PID:5576
- C:\Windows\System\Slzonwx.exe
  C:\Windows\System\Slzonwx.exe
  2⤵
  PID:5528
- C:\Windows\System\UDvvAFp.exe
  C:\Windows\System\UDvvAFp.exe
  2⤵
  PID:5588
- C:\Windows\System\SiqSDeS.exe
  C:\Windows\System\SiqSDeS.exe
  2⤵
  PID:3444
- C:\Windows\System\ohSCpSD.exe
  C:\Windows\System\ohSCpSD.exe
  2⤵
  PID:5672
- C:\Windows\System\vMbtjMZ.exe
  C:\Windows\System\vMbtjMZ.exe
  2⤵
  PID:5736
- C:\Windows\System\IyrZrZa.exe
  C:\Windows\System\IyrZrZa.exe
  2⤵
  PID:5800
- C:\Windows\System\GxNLpKY.exe
  C:\Windows\System\GxNLpKY.exe
  2⤵
  PID:5656
- C:\Windows\System\LjrBZck.exe
  C:\Windows\System\LjrBZck.exe
  2⤵
  PID:5720
- C:\Windows\System\bZbqsKG.exe
  C:\Windows\System\bZbqsKG.exe
  2⤵
  PID:5780
- C:\Windows\System\HctCrJV.exe
  C:\Windows\System\HctCrJV.exe
  2⤵
  PID:5864
- C:\Windows\System\YxcDPVb.exe
  C:\Windows\System\YxcDPVb.exe
  2⤵
  PID:5848
- C:\Windows\System\VpACjlL.exe
  C:\Windows\System\VpACjlL.exe
  2⤵
  PID:5912
- C:\Windows\System\kTLAeUN.exe
  C:\Windows\System\kTLAeUN.exe
  2⤵
  PID:5960
- C:\Windows\System\CzWgKbX.exe
  C:\Windows\System\CzWgKbX.exe
  2⤵
  PID:6024
- C:\Windows\System\mEjwVcM.exe
  C:\Windows\System\mEjwVcM.exe
  2⤵
  PID:6056
- C:\Windows\System\lDOHQjx.exe
  C:\Windows\System\lDOHQjx.exe
  2⤵
  PID:6072
- C:\Windows\System\zPOgFxd.exe
  C:\Windows\System\zPOgFxd.exe
  2⤵
  PID:6008
- C:\Windows\System\TOiBUff.exe
  C:\Windows\System\TOiBUff.exe
  2⤵
  PID:6124
- C:\Windows\System\cyEhqNA.exe
  C:\Windows\System\cyEhqNA.exe
  2⤵
  PID:6136
- C:\Windows\System\GUiIIFs.exe
  C:\Windows\System\GUiIIFs.exe
  2⤵
  PID:4960
- C:\Windows\System\jykttrp.exe
  C:\Windows\System\jykttrp.exe
  2⤵
  PID:5216
- C:\Windows\System\uKzHfnN.exe
  C:\Windows\System\uKzHfnN.exe
  2⤵
  PID:5172
- C:\Windows\System\mTaKgqe.exe
  C:\Windows\System\mTaKgqe.exe
  2⤵
  PID:5320
- C:\Windows\System\OylrxZo.exe
  C:\Windows\System\OylrxZo.exe
  2⤵
  PID:5416
- C:\Windows\System\upcDoGw.exe
  C:\Windows\System\upcDoGw.exe
  2⤵
  PID:5460
- C:\Windows\System\AXetpBq.exe
  C:\Windows\System\AXetpBq.exe
  2⤵
  PID:5136
- C:\Windows\System\vJKfhpa.exe
  C:\Windows\System\vJKfhpa.exe
  2⤵
  PID:5448
- C:\Windows\System\tgHoyYA.exe
  C:\Windows\System\tgHoyYA.exe
  2⤵
  PID:5512
- C:\Windows\System\QwQVSen.exe
  C:\Windows\System\QwQVSen.exe
  2⤵
  PID:5668
- C:\Windows\System\JvZsXWU.exe
  C:\Windows\System\JvZsXWU.exe
  2⤵
  PID:5768
- C:\Windows\System\wvlssaB.exe
  C:\Windows\System\wvlssaB.exe
  2⤵
  PID:5828
- C:\Windows\System\IcoVZDp.exe
  C:\Windows\System\IcoVZDp.exe
  2⤵
  PID:5860
- C:\Windows\System\pndolFA.exe
  C:\Windows\System\pndolFA.exe
  2⤵
  PID:5908
- C:\Windows\System\spUywjv.exe
  C:\Windows\System\spUywjv.exe
  2⤵
  PID:6020
- C:\Windows\System\nFzyROJ.exe
  C:\Windows\System\nFzyROJ.exe
  2⤵
  PID:5928
- C:\Windows\System\rZuPtge.exe
  C:\Windows\System\rZuPtge.exe
  2⤵
  PID:6084
- C:\Windows\System\FAFjIkA.exe
  C:\Windows\System\FAFjIkA.exe
  2⤵
  PID:4340
- C:\Windows\System\MyAraFS.exe
  C:\Windows\System\MyAraFS.exe
  2⤵
  PID:5152
- C:\Windows\System\zBMRrag.exe
  C:\Windows\System\zBMRrag.exe
  2⤵
  PID:5264
- C:\Windows\System\WknwjUq.exe
  C:\Windows\System\WknwjUq.exe
  2⤵
  PID:5496
- C:\Windows\System\ElUMfzI.exe
  C:\Windows\System\ElUMfzI.exe
  2⤵
  PID:5556
- C:\Windows\System\EfUJVMw.exe
  C:\Windows\System\EfUJVMw.exe
  2⤵
  PID:5752
- C:\Windows\System\uFgcLSo.exe
  C:\Windows\System\uFgcLSo.exe
  2⤵
  PID:5976
- C:\Windows\System\BWXGrDM.exe
  C:\Windows\System\BWXGrDM.exe
  2⤵
  PID:5364
- C:\Windows\System\cPKAddy.exe
  C:\Windows\System\cPKAddy.exe
  2⤵
  PID:5944
- C:\Windows\System\wCFlhsB.exe
  C:\Windows\System\wCFlhsB.exe
  2⤵
  PID:6092
- C:\Windows\System\SocwpJM.exe
  C:\Windows\System\SocwpJM.exe
  2⤵
  PID:5368
- C:\Windows\System\PrlaOrr.exe
  C:\Windows\System\PrlaOrr.exe
  2⤵
  PID:5796
- C:\Windows\System\hfLCZRD.exe
  C:\Windows\System\hfLCZRD.exe
  2⤵
  PID:5428
- C:\Windows\System\FcStjhk.exe
  C:\Windows\System\FcStjhk.exe
  2⤵
  PID:6052
- C:\Windows\System\yvSUbgZ.exe
  C:\Windows\System\yvSUbgZ.exe
  2⤵
  PID:5380
- C:\Windows\System\rxazlpb.exe
  C:\Windows\System\rxazlpb.exe
  2⤵
  PID:6148
- C:\Windows\System\MZKYbsE.exe
  C:\Windows\System\MZKYbsE.exe
  2⤵
  PID:6164
- C:\Windows\System\BIWwUVW.exe
  C:\Windows\System\BIWwUVW.exe
  2⤵
  PID:6180
- C:\Windows\System\XwjdvbS.exe
  C:\Windows\System\XwjdvbS.exe
  2⤵
  PID:6196
- C:\Windows\System\VwCJgMv.exe
  C:\Windows\System\VwCJgMv.exe
  2⤵
  PID:6212
- C:\Windows\System\DqTRRlx.exe
  C:\Windows\System\DqTRRlx.exe
  2⤵
  PID:6228
- C:\Windows\System\LAYICTI.exe
  C:\Windows\System\LAYICTI.exe
  2⤵
  PID:6244
- C:\Windows\System\AcPLnWD.exe
  C:\Windows\System\AcPLnWD.exe
  2⤵
  PID:6264
- C:\Windows\System\HYKbKSW.exe
  C:\Windows\System\HYKbKSW.exe
  2⤵
  PID:6280
- C:\Windows\System\tHdvJEj.exe
  C:\Windows\System\tHdvJEj.exe
  2⤵
  PID:6300
- C:\Windows\System\cNQfCHe.exe
  C:\Windows\System\cNQfCHe.exe
  2⤵
  PID:6316
- C:\Windows\System\BnvZYYJ.exe
  C:\Windows\System\BnvZYYJ.exe
  2⤵
  PID:6332
- C:\Windows\System\TVQQGJZ.exe
  C:\Windows\System\TVQQGJZ.exe
  2⤵
  PID:6348
- C:\Windows\System\LmtWPtN.exe
  C:\Windows\System\LmtWPtN.exe
  2⤵
  PID:6364
- C:\Windows\System\NXaMcnE.exe
  C:\Windows\System\NXaMcnE.exe
  2⤵
  PID:6380
- C:\Windows\System\NUmNRwW.exe
  C:\Windows\System\NUmNRwW.exe
  2⤵
  PID:6400
- C:\Windows\System\mWWCNlN.exe
  C:\Windows\System\mWWCNlN.exe
  2⤵
  PID:6416
- C:\Windows\System\iKjkwOQ.exe
  C:\Windows\System\iKjkwOQ.exe
  2⤵
  PID:6436
- C:\Windows\System\keOjdHS.exe
  C:\Windows\System\keOjdHS.exe
  2⤵
  PID:6452
- C:\Windows\System\XdacMIZ.exe
  C:\Windows\System\XdacMIZ.exe
  2⤵
  PID:6468
- C:\Windows\System\TWjoTRb.exe
  C:\Windows\System\TWjoTRb.exe
  2⤵
  PID:6488
- C:\Windows\System\drrzUAZ.exe
  C:\Windows\System\drrzUAZ.exe
  2⤵
  PID:6508
- C:\Windows\System\TjeBUOL.exe
  C:\Windows\System\TjeBUOL.exe
  2⤵
  PID:6524
- C:\Windows\System\DfMdmwy.exe
  C:\Windows\System\DfMdmwy.exe
  2⤵
  PID:6540
- C:\Windows\System\AEFzSPW.exe
  C:\Windows\System\AEFzSPW.exe
  2⤵
  PID:6556
- C:\Windows\System\YeeoZoC.exe
  C:\Windows\System\YeeoZoC.exe
  2⤵
  PID:6572
- C:\Windows\System\izOFCSQ.exe
  C:\Windows\System\izOFCSQ.exe
  2⤵
  PID:6588
- C:\Windows\System\oCdIjgX.exe
  C:\Windows\System\oCdIjgX.exe
  2⤵
  PID:6608
- C:\Windows\System\SDGPByB.exe
  C:\Windows\System\SDGPByB.exe
  2⤵
  PID:6628
- C:\Windows\System\JCOgnaV.exe
  C:\Windows\System\JCOgnaV.exe
  2⤵
  PID:6644
- C:\Windows\System\iHQHEkR.exe
  C:\Windows\System\iHQHEkR.exe
  2⤵
  PID:6664
- C:\Windows\System\yTHGDoJ.exe
  C:\Windows\System\yTHGDoJ.exe
  2⤵
  PID:6680
- C:\Windows\System\WRuBHvq.exe
  C:\Windows\System\WRuBHvq.exe
  2⤵
  PID:6696
- C:\Windows\System\fEKcKXl.exe
  C:\Windows\System\fEKcKXl.exe
  2⤵
  PID:6712
- C:\Windows\System\ChYoCtT.exe
  C:\Windows\System\ChYoCtT.exe
  2⤵
  PID:6728
- C:\Windows\System\lfePEhf.exe
  C:\Windows\System\lfePEhf.exe
  2⤵
  PID:6744
- C:\Windows\System\AdQqsRv.exe
  C:\Windows\System\AdQqsRv.exe
  2⤵
  PID:6760
- C:\Windows\System\yKzjZSK.exe
  C:\Windows\System\yKzjZSK.exe
  2⤵
  PID:6776
- C:\Windows\System\SzSNQKn.exe
  C:\Windows\System\SzSNQKn.exe
  2⤵
  PID:6796
- C:\Windows\System\HoyXPHU.exe
  C:\Windows\System\HoyXPHU.exe
  2⤵
  PID:6812
- C:\Windows\System\iOKMLEu.exe
  C:\Windows\System\iOKMLEu.exe
  2⤵
  PID:6828
- C:\Windows\System\YjmeSJH.exe
  C:\Windows\System\YjmeSJH.exe
  2⤵
  PID:6848
- C:\Windows\System\yDHDdrc.exe
  C:\Windows\System\yDHDdrc.exe
  2⤵
  PID:6864
- C:\Windows\System\njerraf.exe
  C:\Windows\System\njerraf.exe
  2⤵
  PID:6880
- C:\Windows\System\dAxZroS.exe
  C:\Windows\System\dAxZroS.exe
  2⤵
  PID:6896
- C:\Windows\System\pbtlpIo.exe
  C:\Windows\System\pbtlpIo.exe
  2⤵
  PID:6912
- C:\Windows\System\yFWSUtT.exe
  C:\Windows\System\yFWSUtT.exe
  2⤵
  PID:6928
- C:\Windows\System\HHVoFwJ.exe
  C:\Windows\System\HHVoFwJ.exe
  2⤵
  PID:6944
- C:\Windows\System\lwHaBeC.exe
  C:\Windows\System\lwHaBeC.exe
  2⤵
  PID:6960
- C:\Windows\System\vvegHFU.exe
  C:\Windows\System\vvegHFU.exe
  2⤵
  PID:6976
- C:\Windows\System\PsQQsBl.exe
  C:\Windows\System\PsQQsBl.exe
  2⤵
  PID:6992
- C:\Windows\System\KBInUdn.exe
  C:\Windows\System\KBInUdn.exe
  2⤵
  PID:7008
- C:\Windows\System\ySnynFZ.exe
  C:\Windows\System\ySnynFZ.exe
  2⤵
  PID:7024
- C:\Windows\System\XjUNZag.exe
  C:\Windows\System\XjUNZag.exe
  2⤵
  PID:7044
- C:\Windows\System\frvWtvU.exe
  C:\Windows\System\frvWtvU.exe
  2⤵
  PID:7060
- C:\Windows\System\GUNctXs.exe
  C:\Windows\System\GUNctXs.exe
  2⤵
  PID:7076
- C:\Windows\System\JBzsMeA.exe
  C:\Windows\System\JBzsMeA.exe
  2⤵
  PID:7092
- C:\Windows\System\gxQbhdj.exe
  C:\Windows\System\gxQbhdj.exe
  2⤵
  PID:7108
- C:\Windows\System\pHZmAYy.exe
  C:\Windows\System\pHZmAYy.exe
  2⤵
  PID:7124
- C:\Windows\System\IXNHHQa.exe
  C:\Windows\System\IXNHHQa.exe
  2⤵
  PID:7140
- C:\Windows\System\vYhECER.exe
  C:\Windows\System\vYhECER.exe
  2⤵
  PID:7160
- C:\Windows\System\isdNKFC.exe
  C:\Windows\System\isdNKFC.exe
  2⤵
  PID:6188
- C:\Windows\System\YYCKFmy.exe
  C:\Windows\System\YYCKFmy.exe
  2⤵
  PID:6172
- C:\Windows\System\lTsCyTm.exe
  C:\Windows\System\lTsCyTm.exe
  2⤵
  PID:5716
- C:\Windows\System\vzgOMNw.exe
  C:\Windows\System\vzgOMNw.exe
  2⤵
  PID:6276
- C:\Windows\System\OfgJIyi.exe
  C:\Windows\System\OfgJIyi.exe
  2⤵
  PID:6340
- C:\Windows\System\YRILXDT.exe
  C:\Windows\System\YRILXDT.exe
  2⤵
  PID:6252
- C:\Windows\System\UTKzqgH.exe
  C:\Windows\System\UTKzqgH.exe
  2⤵
  PID:6292
- C:\Windows\System\uSzPVkZ.exe
  C:\Windows\System\uSzPVkZ.exe
  2⤵
  PID:6408
- C:\Windows\System\gTqCpyA.exe
  C:\Windows\System\gTqCpyA.exe
  2⤵
  PID:6424
- C:\Windows\System\ExSCtyH.exe
  C:\Windows\System\ExSCtyH.exe
  2⤵
  PID:6396
- C:\Windows\System\jhMMUTH.exe
  C:\Windows\System\jhMMUTH.exe
  2⤵
  PID:6480
- C:\Windows\System\lmZgKal.exe
  C:\Windows\System\lmZgKal.exe
  2⤵
  PID:6516
- C:\Windows\System\CdlXSvX.exe
  C:\Windows\System\CdlXSvX.exe
  2⤵
  PID:6584
- C:\Windows\System\DdjMzlL.exe
  C:\Windows\System\DdjMzlL.exe
  2⤵
  PID:6532
- C:\Windows\System\MECOHEC.exe
  C:\Windows\System\MECOHEC.exe
  2⤵
  PID:6652
- C:\Windows\System\OWSpTsY.exe
  C:\Windows\System\OWSpTsY.exe
  2⤵
  PID:6692
- C:\Windows\System\LEfZQHM.exe
  C:\Windows\System\LEfZQHM.exe
  2⤵
  PID:6752
- C:\Windows\System\vynERRT.exe
  C:\Windows\System\vynERRT.exe
  2⤵
  PID:6564
- C:\Windows\System\hdWrpOa.exe
  C:\Windows\System\hdWrpOa.exe
  2⤵
  PID:6600
- C:\Windows\System\fvtQeuZ.exe
  C:\Windows\System\fvtQeuZ.exe
  2⤵
  PID:6860
- C:\Windows\System\SCZGbtG.exe
  C:\Windows\System\SCZGbtG.exe
  2⤵
  PID:6892
- C:\Windows\System\qjArMbo.exe
  C:\Windows\System\qjArMbo.exe
  2⤵
  PID:6740
- C:\Windows\System\vOTHrkA.exe
  C:\Windows\System\vOTHrkA.exe
  2⤵
  PID:6804
- C:\Windows\System\ArBhUFD.exe
  C:\Windows\System\ArBhUFD.exe
  2⤵
  PID:6836
- C:\Windows\System\SmzRnRJ.exe
  C:\Windows\System\SmzRnRJ.exe
  2⤵
  PID:6972
- C:\Windows\System\QTWXjHg.exe
  C:\Windows\System\QTWXjHg.exe
  2⤵
  PID:6988
- C:\Windows\System\NnzPczP.exe
  C:\Windows\System\NnzPczP.exe
  2⤵
  PID:7000
- C:\Windows\System\FPWdunb.exe
  C:\Windows\System\FPWdunb.exe
  2⤵
  PID:7084
- C:\Windows\System\IbHDOhq.exe
  C:\Windows\System\IbHDOhq.exe
  2⤵
  PID:7148
- C:\Windows\System\sgZGnHz.exe
  C:\Windows\System\sgZGnHz.exe
  2⤵
  PID:6156
- C:\Windows\System\ZDMSVSI.exe
  C:\Windows\System\ZDMSVSI.exe
  2⤵
  PID:7032
- C:\Windows\System\EajqRts.exe
  C:\Windows\System\EajqRts.exe
  2⤵
  PID:7068
- C:\Windows\System\lOqSghC.exe
  C:\Windows\System\lOqSghC.exe
  2⤵
  PID:6068
- C:\Windows\System\wHsHwRX.exe
  C:\Windows\System\wHsHwRX.exe
  2⤵
  PID:6160
- C:\Windows\System\NypDsTe.exe
  C:\Windows\System\NypDsTe.exe
  2⤵
  PID:6208
- C:\Windows\System\uVdbDau.exe
  C:\Windows\System\uVdbDau.exe
  2⤵
  PID:6328
- C:\Windows\System\frxCWUJ.exe
  C:\Windows\System\frxCWUJ.exe
  2⤵
  PID:6448
- C:\Windows\System\RQEymyf.exe
  C:\Windows\System\RQEymyf.exe
  2⤵
  PID:6376
- C:\Windows\System\HeFlpzh.exe
  C:\Windows\System\HeFlpzh.exe
  2⤵
  PID:6536
- C:\Windows\System\ezwRrMJ.exe
  C:\Windows\System\ezwRrMJ.exe
  2⤵
  PID:6552
- C:\Windows\System\kUdVHQG.exe
  C:\Windows\System\kUdVHQG.exe
  2⤵
  PID:6724
- C:\Windows\System\FyFFGDw.exe
  C:\Windows\System\FyFFGDw.exe
  2⤵
  PID:6672
- C:\Windows\System\EOMWnWp.exe
  C:\Windows\System\EOMWnWp.exe
  2⤵
  PID:6952
- C:\Windows\System\RICZxxH.exe
  C:\Windows\System\RICZxxH.exe
  2⤵
  PID:6596
- C:\Windows\System\BgkqpBa.exe
  C:\Windows\System\BgkqpBa.exe
  2⤵
  PID:6936
- C:\Windows\System\WjGAoBy.exe
  C:\Windows\System\WjGAoBy.exe
  2⤵
  PID:5992
- C:\Windows\System\IaSXqZK.exe
  C:\Windows\System\IaSXqZK.exe
  2⤵
  PID:6808
- C:\Windows\System\jqEoEdv.exe
  C:\Windows\System\jqEoEdv.exe
  2⤵
  PID:6820
- C:\Windows\System\ImVrKaF.exe
  C:\Windows\System\ImVrKaF.exe
  2⤵
  PID:6968
- C:\Windows\System\cLOVXnm.exe
  C:\Windows\System\cLOVXnm.exe
  2⤵
  PID:6636
- C:\Windows\System\zKVJvGJ.exe
  C:\Windows\System\zKVJvGJ.exe
  2⤵
  PID:5412
- C:\Windows\System\trovTZJ.exe
  C:\Windows\System\trovTZJ.exe
  2⤵
  PID:7136
- C:\Windows\System\lsJEyGM.exe
  C:\Windows\System\lsJEyGM.exe
  2⤵
  PID:6432
- C:\Windows\System\JfxHfMd.exe
  C:\Windows\System\JfxHfMd.exe
  2⤵
  PID:6372
- C:\Windows\System\zapelGS.exe
  C:\Windows\System\zapelGS.exe
  2⤵
  PID:6840
- C:\Windows\System\fCPXlWQ.exe
  C:\Windows\System\fCPXlWQ.exe
  2⤵
  PID:7056
- C:\Windows\System\puTEXUp.exe
  C:\Windows\System\puTEXUp.exe
  2⤵
  PID:6676
- C:\Windows\System\KdrdwPX.exe
  C:\Windows\System\KdrdwPX.exe
  2⤵
  PID:6708
- C:\Windows\System\UhIceUH.exe
  C:\Windows\System\UhIceUH.exe
  2⤵
  PID:6260
- C:\Windows\System\QMsayrC.exe
  C:\Windows\System\QMsayrC.exe
  2⤵
  PID:5156
- C:\Windows\System\gEXiIaA.exe
  C:\Windows\System\gEXiIaA.exe
  2⤵
  PID:6548
- C:\Windows\System\kcEcPmO.exe
  C:\Windows\System\kcEcPmO.exe
  2⤵
  PID:6360
- C:\Windows\System\IihvuNe.exe
  C:\Windows\System\IihvuNe.exe
  2⤵
  PID:6736
- C:\Windows\System\XEgleaC.exe
  C:\Windows\System\XEgleaC.exe
  2⤵
  PID:6224
- C:\Windows\System\SKKywvh.exe
  C:\Windows\System\SKKywvh.exe
  2⤵
  PID:6924
- C:\Windows\System\vTtKaHU.exe
  C:\Windows\System\vTtKaHU.exe
  2⤵
  PID:6872
- C:\Windows\System\wSIKQXX.exe
  C:\Windows\System\wSIKQXX.exe
  2⤵
  PID:6844
- C:\Windows\System\KaJHFkn.exe
  C:\Windows\System\KaJHFkn.exe
  2⤵
  PID:6624
- C:\Windows\System\dwNVvRT.exe
  C:\Windows\System\dwNVvRT.exe
  2⤵
  PID:6204
- C:\Windows\System\veroHiS.exe
  C:\Windows\System\veroHiS.exe
  2⤵
  PID:7288
- C:\Windows\System\vLeZtCi.exe
  C:\Windows\System\vLeZtCi.exe
  2⤵
  PID:7388
- C:\Windows\System\lDGllrf.exe
  C:\Windows\System\lDGllrf.exe
  2⤵
  PID:7488
- C:\Windows\System\kEYEdFR.exe
  C:\Windows\System\kEYEdFR.exe
  2⤵
  PID:7504
- C:\Windows\System\OhljHWq.exe
  C:\Windows\System\OhljHWq.exe
  2⤵
  PID:7524
- C:\Windows\System\ucqpwsH.exe
  C:\Windows\System\ucqpwsH.exe
  2⤵
  PID:7540
- C:\Windows\System\hMoKSBf.exe
  C:\Windows\System\hMoKSBf.exe
  2⤵
  PID:7556
- C:\Windows\System\TFXyHnK.exe
  C:\Windows\System\TFXyHnK.exe
  2⤵
  PID:7572
- C:\Windows\System\QJtJYoa.exe
  C:\Windows\System\QJtJYoa.exe
  2⤵
  PID:7596
- C:\Windows\System\hxIcuhI.exe
  C:\Windows\System\hxIcuhI.exe
  2⤵
  PID:7616
- C:\Windows\System\XhKiDwH.exe
  C:\Windows\System\XhKiDwH.exe
  2⤵
  PID:7632
- C:\Windows\System\RywutEU.exe
  C:\Windows\System\RywutEU.exe
  2⤵
  PID:7648
- C:\Windows\System\xvmnSza.exe
  C:\Windows\System\xvmnSza.exe
  2⤵
  PID:7664
- C:\Windows\System\enFoJQC.exe
  C:\Windows\System\enFoJQC.exe
  2⤵
  PID:7680
- C:\Windows\System\jAQmfEy.exe
  C:\Windows\System\jAQmfEy.exe
  2⤵
  PID:7696
- C:\Windows\System\bpRMZUb.exe
  C:\Windows\System\bpRMZUb.exe
  2⤵
  PID:7712
- C:\Windows\System\LtiojNT.exe
  C:\Windows\System\LtiojNT.exe
  2⤵
  PID:7728
- C:\Windows\System\JzHuGCJ.exe
  C:\Windows\System\JzHuGCJ.exe
  2⤵
  PID:7744
- C:\Windows\System\NQylwIM.exe
  C:\Windows\System\NQylwIM.exe
  2⤵
  PID:7912
- C:\Windows\System\GCCUhdd.exe
  C:\Windows\System\GCCUhdd.exe
  2⤵
  PID:7928
- C:\Windows\System\RxzzFak.exe
  C:\Windows\System\RxzzFak.exe
  2⤵
  PID:7944
- C:\Windows\System\yuCgCuu.exe
  C:\Windows\System\yuCgCuu.exe
  2⤵
  PID:7964
- C:\Windows\System\sVNVSav.exe
  C:\Windows\System\sVNVSav.exe
  2⤵
  PID:7980
- C:\Windows\System\NBQtkCP.exe
  C:\Windows\System\NBQtkCP.exe
  2⤵
  PID:8008
- C:\Windows\System\ppKsIyr.exe
  C:\Windows\System\ppKsIyr.exe
  2⤵
  PID:8096
- C:\Windows\System\mTicwFi.exe
  C:\Windows\System\mTicwFi.exe
  2⤵
  PID:8112
- C:\Windows\System\cZpJXiE.exe
  C:\Windows\System\cZpJXiE.exe
  2⤵
  PID:7176
- C:\Windows\System\MMlbWmt.exe
  C:\Windows\System\MMlbWmt.exe
  2⤵
  PID:7312
- C:\Windows\System\hjATzuD.exe
  C:\Windows\System\hjATzuD.exe
  2⤵
  PID:7248
- C:\Windows\System\EOMiADf.exe
  C:\Windows\System\EOMiADf.exe
  2⤵
  PID:7268
- C:\Windows\System\ANKsJpA.exe
  C:\Windows\System\ANKsJpA.exe
  2⤵
  PID:7396
- C:\Windows\System\eXkFOEJ.exe
  C:\Windows\System\eXkFOEJ.exe
  2⤵
  PID:7412
- C:\Windows\System\zSUcHyl.exe
  C:\Windows\System\zSUcHyl.exe
  2⤵
  PID:7428
- C:\Windows\System\MTeWokr.exe
  C:\Windows\System\MTeWokr.exe
  2⤵
  PID:7532
- C:\Windows\System\xhbDSNo.exe
  C:\Windows\System\xhbDSNo.exe
  2⤵
  PID:7720
- C:\Windows\System\duRUjFh.exe
  C:\Windows\System\duRUjFh.exe
  2⤵
  PID:7704
- C:\Windows\System\yCDpypX.exe
  C:\Windows\System\yCDpypX.exe
  2⤵
  PID:7612
- C:\Windows\System\mCxMYld.exe
  C:\Windows\System\mCxMYld.exe
  2⤵
  PID:7708
- C:\Windows\System\vUtFDpK.exe
  C:\Windows\System\vUtFDpK.exe
  2⤵
  PID:7764
- C:\Windows\System\QXvqIqm.exe
  C:\Windows\System\QXvqIqm.exe
  2⤵
  PID:7216
- C:\Windows\System\hyOgWFv.exe
  C:\Windows\System\hyOgWFv.exe
  2⤵
  PID:7808
- C:\Windows\System\xbkynfU.exe
  C:\Windows\System\xbkynfU.exe
  2⤵
  PID:7952
- C:\Windows\System\iacSoaw.exe
  C:\Windows\System\iacSoaw.exe
  2⤵
  PID:8028
- C:\Windows\System\SPcQhVQ.exe
  C:\Windows\System\SPcQhVQ.exe
  2⤵
  PID:8036
- C:\Windows\System\UUKuUxE.exe
  C:\Windows\System\UUKuUxE.exe
  2⤵
  PID:8052
- C:\Windows\System\sCJMkzt.exe
  C:\Windows\System\sCJMkzt.exe
  2⤵
  PID:8104
- C:\Windows\System\csBTnnD.exe
  C:\Windows\System\csBTnnD.exe
  2⤵
  PID:8056
- C:\Windows\System\JHBmHmX.exe
  C:\Windows\System\JHBmHmX.exe
  2⤵
  PID:8120
- C:\Windows\System\nvJrrJw.exe
  C:\Windows\System\nvJrrJw.exe
  2⤵
  PID:8132
- C:\Windows\System\xpyPGTn.exe
  C:\Windows\System\xpyPGTn.exe
  2⤵
  PID:8184
- C:\Windows\System\asugKwY.exe
  C:\Windows\System\asugKwY.exe
  2⤵
  PID:7356
- C:\Windows\System\qVAQpOK.exe
  C:\Windows\System\qVAQpOK.exe
  2⤵
  PID:7372
- C:\Windows\System\xYRWWNS.exe
  C:\Windows\System\xYRWWNS.exe
  2⤵
  PID:7240
- C:\Windows\System\yYYmlDS.exe
  C:\Windows\System\yYYmlDS.exe
  2⤵
  PID:8152
- C:\Windows\System\JSUcVPE.exe
  C:\Windows\System\JSUcVPE.exe
  2⤵
  PID:7188
- C:\Windows\System\aELkDeX.exe
  C:\Windows\System\aELkDeX.exe
  2⤵
  PID:7456
- C:\Windows\System\fGpwFwz.exe
  C:\Windows\System\fGpwFwz.exe
  2⤵
  PID:7300
- C:\Windows\System\TaYpoTe.exe
  C:\Windows\System\TaYpoTe.exe
  2⤵
  PID:7304
- C:\Windows\System\UojTjXb.exe
  C:\Windows\System\UojTjXb.exe
  2⤵
  PID:7628
- C:\Windows\System\PTxSZJS.exe
  C:\Windows\System\PTxSZJS.exe
  2⤵
  PID:7476
- C:\Windows\System\IayhIuL.exe
  C:\Windows\System\IayhIuL.exe
  2⤵
  PID:7320
- C:\Windows\System\MdJsqwL.exe
  C:\Windows\System\MdJsqwL.exe
  2⤵
  PID:7548
- C:\Windows\System\krmQMAt.exe
  C:\Windows\System\krmQMAt.exe
  2⤵
  PID:7592
- C:\Windows\System\HvdNwAr.exe
  C:\Windows\System\HvdNwAr.exe
  2⤵
  PID:8060
- C:\Windows\System\czBFNfX.exe
  C:\Windows\System\czBFNfX.exe
  2⤵
  PID:7640
- C:\Windows\System\YGTOgPJ.exe
  C:\Windows\System\YGTOgPJ.exe
  2⤵
  PID:7244
- C:\Windows\System\WSevizP.exe
  C:\Windows\System\WSevizP.exe
  2⤵
  PID:7180
- C:\Windows\System\syWkOZl.exe
  C:\Windows\System\syWkOZl.exe
  2⤵
  PID:7692
- C:\Windows\System\GAGlaKG.exe
  C:\Windows\System\GAGlaKG.exe
  2⤵
  PID:7404
- C:\Windows\System\wGvsjyi.exe
  C:\Windows\System\wGvsjyi.exe
  2⤵
  PID:7220
- C:\Windows\System\ZQexSft.exe
  C:\Windows\System\ZQexSft.exe
  2⤵
  PID:7828
- C:\Windows\System\YpKPuCi.exe
  C:\Windows\System\YpKPuCi.exe
  2⤵
  PID:7848
- C:\Windows\System\QzRsfNz.exe
  C:\Windows\System\QzRsfNz.exe
  2⤵
  PID:7868
- C:\Windows\System\LWTZenh.exe
  C:\Windows\System\LWTZenh.exe
  2⤵
  PID:7232
- C:\Windows\System\WDhTrnS.exe
  C:\Windows\System\WDhTrnS.exe
  2⤵
  PID:7796
- C:\Windows\System\suXFltc.exe
  C:\Windows\System\suXFltc.exe
  2⤵
  PID:7988
- C:\Windows\System\zwZofbp.exe
  C:\Windows\System\zwZofbp.exe
  2⤵
  PID:7756
- C:\Windows\System\dBXqSBJ.exe
  C:\Windows\System\dBXqSBJ.exe
  2⤵
  PID:7768
- C:\Windows\System\YlSRZvA.exe
  C:\Windows\System\YlSRZvA.exe
  2⤵
  PID:7956
- C:\Windows\System\yysOiJA.exe
  C:\Windows\System\yysOiJA.exe
  2⤵
  PID:2060
- C:\Windows\System\DLPDeqX.exe
  C:\Windows\System\DLPDeqX.exe
  2⤵
  PID:2992
- C:\Windows\System\vMauWzM.exe
  C:\Windows\System\vMauWzM.exe
  2⤵
  PID:8024
- C:\Windows\System\zbIhpFP.exe
  C:\Windows\System\zbIhpFP.exe
  2⤵
  PID:8084
- C:\Windows\System\gbxZSvS.exe
  C:\Windows\System\gbxZSvS.exe
  2⤵
  PID:8172
- C:\Windows\System\pCMvYNN.exe
  C:\Windows\System\pCMvYNN.exe
  2⤵
  PID:8124
- C:\Windows\System\ENxIHai.exe
  C:\Windows\System\ENxIHai.exe
  2⤵
  PID:7308
- C:\Windows\System\dqFOpWO.exe
  C:\Windows\System\dqFOpWO.exe
  2⤵
  PID:8136
- C:\Windows\System\FurFvPx.exe
  C:\Windows\System\FurFvPx.exe
  2⤵
  PID:8156
- C:\Windows\System\jarkcEX.exe
  C:\Windows\System\jarkcEX.exe
  2⤵
  PID:8076
- C:\Windows\System\tibuldF.exe
  C:\Windows\System\tibuldF.exe
  2⤵
  PID:7624
- C:\Windows\System\mZMIiyk.exe
  C:\Windows\System\mZMIiyk.exe
  2⤵
  PID:7896
- C:\Windows\System\cgQezXy.exe
  C:\Windows\System\cgQezXy.exe
  2⤵
  PID:7840
- C:\Windows\System\xKAyhyb.exe
  C:\Windows\System\xKAyhyb.exe
  2⤵
  PID:7440
- C:\Windows\System\hDSeiaX.exe
  C:\Windows\System\hDSeiaX.exe
  2⤵
  PID:7892
- C:\Windows\System\RVhQGig.exe
  C:\Windows\System\RVhQGig.exe
  2⤵
  PID:7324
- C:\Windows\System\qqQRzVg.exe
  C:\Windows\System\qqQRzVg.exe
  2⤵
  PID:7352
- C:\Windows\System\KGfsNAT.exe
  C:\Windows\System\KGfsNAT.exe
  2⤵
  PID:7444
- C:\Windows\System\vByGckd.exe
  C:\Windows\System\vByGckd.exe
  2⤵
  PID:7408
- C:\Windows\System\tvYDSvf.exe
  C:\Windows\System\tvYDSvf.exe
  2⤵
  PID:7284
- C:\Windows\System\thDSOLO.exe
  C:\Windows\System\thDSOLO.exe
  2⤵
  PID:7876
- C:\Windows\System\IMQzEBX.exe
  C:\Windows\System\IMQzEBX.exe
  2⤵
  PID:7804
- C:\Windows\System\uNHbDJU.exe
  C:\Windows\System\uNHbDJU.exe
  2⤵
  PID:8760
- C:\Windows\System\KfRVcZv.exe
  C:\Windows\System\KfRVcZv.exe
  2⤵
  PID:8776
- C:\Windows\System\ANyBbIx.exe
  C:\Windows\System\ANyBbIx.exe
  2⤵
  PID:8800
- C:\Windows\System\shqLVRA.exe
  C:\Windows\System\shqLVRA.exe
  2⤵
  PID:8820
- C:\Windows\System\iWruuwt.exe
  C:\Windows\System\iWruuwt.exe
  2⤵
  PID:8844
- C:\Windows\System\tdneJcS.exe
  C:\Windows\System\tdneJcS.exe
  2⤵
  PID:8860
- C:\Windows\System\OoNyXDH.exe
  C:\Windows\System\OoNyXDH.exe
  2⤵
  PID:8876
- C:\Windows\System\KlhybPO.exe
  C:\Windows\System\KlhybPO.exe
  2⤵
  PID:8892
- C:\Windows\System\gtHJfIm.exe
  C:\Windows\System\gtHJfIm.exe
  2⤵
  PID:8908
- C:\Windows\System\juZfnJP.exe
  C:\Windows\System\juZfnJP.exe
  2⤵
  PID:8924
- C:\Windows\System\Zgdohye.exe
  C:\Windows\System\Zgdohye.exe
  2⤵
  PID:8940
- C:\Windows\System\zlmCdYJ.exe
  C:\Windows\System\zlmCdYJ.exe
  2⤵
  PID:8960
- C:\Windows\System\dnRJKax.exe
  C:\Windows\System\dnRJKax.exe
  2⤵
  PID:9108
- C:\Windows\System\jPjeNek.exe
  C:\Windows\System\jPjeNek.exe
  2⤵
  PID:9124
- C:\Windows\System\QGMbZHh.exe
  C:\Windows\System\QGMbZHh.exe
  2⤵
  PID:8332
- C:\Windows\System\qfbWQcz.exe
  C:\Windows\System\qfbWQcz.exe
  2⤵
  PID:8724
- C:\Windows\System\GCTpxQT.exe
  C:\Windows\System\GCTpxQT.exe
  2⤵
  PID:7960
- C:\Windows\System\PCdADRC.exe
  C:\Windows\System\PCdADRC.exe
  2⤵
  PID:7864
- C:\Windows\System\xmUTppi.exe
  C:\Windows\System\xmUTppi.exe
  2⤵
  PID:7856
- C:\Windows\System\seFwMBa.exe
  C:\Windows\System\seFwMBa.exe
  2⤵
  PID:8148
- C:\Windows\System\ViwlKaC.exe
  C:\Windows\System\ViwlKaC.exe
  2⤵
  PID:1756
- C:\Windows\System\fyuYjeb.exe
  C:\Windows\System\fyuYjeb.exe
  2⤵
  PID:7588
- C:\Windows\System\xUeIfez.exe
  C:\Windows\System\xUeIfez.exe
  2⤵
  PID:8756
- C:\Windows\System\soCXLGZ.exe
  C:\Windows\System\soCXLGZ.exe
  2⤵
  PID:8788
- C:\Windows\System\AsqilEB.exe
  C:\Windows\System\AsqilEB.exe
  2⤵
  PID:8836
- C:\Windows\System\HsSIREp.exe
  C:\Windows\System\HsSIREp.exe
  2⤵
  PID:8872
- C:\Windows\System\gfvNOWR.exe
  C:\Windows\System\gfvNOWR.exe
  2⤵
  PID:8840
- C:\Windows\System\nPqGlnC.exe
  C:\Windows\System\nPqGlnC.exe
  2⤵
  PID:8256
- C:\Windows\System\PoXHciz.exe
  C:\Windows\System\PoXHciz.exe
  2⤵
  PID:8288
- C:\Windows\System\mCFwhFv.exe
  C:\Windows\System\mCFwhFv.exe
  2⤵
  PID:8308
- C:\Windows\System\TPgMvHg.exe
  C:\Windows\System\TPgMvHg.exe
  2⤵
  PID:8364
- C:\Windows\System\eQqMsZm.exe
  C:\Windows\System\eQqMsZm.exe
  2⤵
  PID:8416
- C:\Windows\System\ckHCrrc.exe
  C:\Windows\System\ckHCrrc.exe
  2⤵
  PID:8428
- C:\Windows\System\elUPdWg.exe
  C:\Windows\System\elUPdWg.exe
  2⤵
  PID:8452
- C:\Windows\System\ntDcoiV.exe
  C:\Windows\System\ntDcoiV.exe
  2⤵
  PID:8468
- C:\Windows\System\tKKArfH.exe
  C:\Windows\System\tKKArfH.exe
  2⤵
  PID:8484
- C:\Windows\System\qRFmJAN.exe
  C:\Windows\System\qRFmJAN.exe
  2⤵
  PID:8500
- C:\Windows\System\DrxKKwK.exe
  C:\Windows\System\DrxKKwK.exe
  2⤵
  PID:8516
- C:\Windows\System\xfXPohw.exe
  C:\Windows\System\xfXPohw.exe
  2⤵
  PID:8536
- C:\Windows\System\SmZHwQx.exe
  C:\Windows\System\SmZHwQx.exe
  2⤵
  PID:8556
- C:\Windows\System\iUtYgTh.exe
  C:\Windows\System\iUtYgTh.exe
  2⤵
  PID:8588
- C:\Windows\System\QLmFnkH.exe
  C:\Windows\System\QLmFnkH.exe
  2⤵
  PID:8632
- C:\Windows\System\LcitfAr.exe
  C:\Windows\System\LcitfAr.exe
  2⤵
  PID:8628
- C:\Windows\System\KExpHgD.exe
  C:\Windows\System\KExpHgD.exe
  2⤵
  PID:8660
- C:\Windows\System\ktjjnAR.exe
  C:\Windows\System\ktjjnAR.exe
  2⤵
  PID:8696
- C:\Windows\System\HzZEVkK.exe
  C:\Windows\System\HzZEVkK.exe
  2⤵
  PID:8712
- C:\Windows\System\mYrWFpy.exe
  C:\Windows\System\mYrWFpy.exe
  2⤵
  PID:8732
- C:\Windows\System\SVVVdVs.exe
  C:\Windows\System\SVVVdVs.exe
  2⤵
  PID:8748
- C:\Windows\System\rxinubC.exe
  C:\Windows\System\rxinubC.exe
  2⤵
  PID:9004
- C:\Windows\System\rzFlVzQ.exe
  C:\Windows\System\rzFlVzQ.exe
  2⤵
  PID:9016
- C:\Windows\System\EgUtwkI.exe
  C:\Windows\System\EgUtwkI.exe
  2⤵
  PID:9120
- C:\Windows\System\xntStpH.exe
  C:\Windows\System\xntStpH.exe
  2⤵
  PID:9008
- C:\Windows\System\yZGllrW.exe
  C:\Windows\System\yZGllrW.exe
  2⤵
  PID:9060
- C:\Windows\System\kloAyBT.exe
  C:\Windows\System\kloAyBT.exe
  2⤵
  PID:9080
- C:\Windows\System\OsqsRRT.exe
  C:\Windows\System\OsqsRRT.exe
  2⤵
  PID:9088
- C:\Windows\System\hEoXIIz.exe
  C:\Windows\System\hEoXIIz.exe
  2⤵
  PID:9140
- C:\Windows\System\LrxoGIW.exe
  C:\Windows\System\LrxoGIW.exe
  2⤵
  PID:8356
- C:\Windows\System\lNvHRgt.exe
  C:\Windows\System\lNvHRgt.exe
  2⤵
  PID:8376
- C:\Windows\System\fSuRMke.exe
  C:\Windows\System\fSuRMke.exe
  2⤵
  PID:860
- C:\Windows\System\XRbSbUC.exe
  C:\Windows\System\XRbSbUC.exe
  2⤵
  PID:8768
- C:\Windows\System\bBCwZsI.exe
  C:\Windows\System\bBCwZsI.exe
  2⤵
  PID:8016
- C:\Windows\System\ehaQMZO.exe
  C:\Windows\System\ehaQMZO.exe
  2⤵
  PID:7760
- C:\Windows\System\DYfrcAo.exe
  C:\Windows\System\DYfrcAo.exe
  2⤵
  PID:1212
- C:\Windows\System\mnuEjje.exe
  C:\Windows\System\mnuEjje.exe
  2⤵
  PID:8612
- C:\Windows\System\wdDEqtL.exe
  C:\Windows\System\wdDEqtL.exe
  2⤵
  PID:8664
- C:\Windows\System\xHeddmO.exe
  C:\Windows\System\xHeddmO.exe
  2⤵
  PID:8224
- C:\Windows\System\ldRVUFV.exe
  C:\Windows\System\ldRVUFV.exe
  2⤵
  PID:8316
- C:\Windows\System\wGeYhvY.exe
  C:\Windows\System\wGeYhvY.exe
  2⤵
  PID:9180
- C:\Windows\System\deNDJIX.exe
  C:\Windows\System\deNDJIX.exe
  2⤵
  PID:9196
- C:\Windows\System\FxMHoyQ.exe
  C:\Windows\System\FxMHoyQ.exe
  2⤵
  PID:3060
- C:\Windows\System\cCyttKi.exe
  C:\Windows\System\cCyttKi.exe
  2⤵
  PID:3032
- C:\Windows\System\ScBlGVy.exe
  C:\Windows\System\ScBlGVy.exe
  2⤵
  PID:7256
- C:\Windows\System\khHGVKV.exe
  C:\Windows\System\khHGVKV.exe
  2⤵
  PID:8852
- C:\Windows\System\VtQoDiQ.exe
  C:\Windows\System\VtQoDiQ.exe
  2⤵
  PID:8920
- C:\Windows\System\WtQSAFb.exe
  C:\Windows\System\WtQSAFb.exe
  2⤵
  PID:8404
- C:\Windows\System\GcMZLFI.exe
  C:\Windows\System\GcMZLFI.exe
  2⤵
  PID:8048
- C:\Windows\System\PyzLuGn.exe
  C:\Windows\System\PyzLuGn.exe
  2⤵
  PID:7208
- C:\Windows\System\Ufczvum.exe
  C:\Windows\System\Ufczvum.exe
  2⤵
  PID:8176
- C:\Windows\System\XFMkSUc.exe
  C:\Windows\System\XFMkSUc.exe
  2⤵
  PID:8220
- C:\Windows\System\ASWEEcV.exe
  C:\Windows\System\ASWEEcV.exe
  2⤵
  PID:9156
- C:\Windows\System\sIfNjZz.exe
  C:\Windows\System\sIfNjZz.exe
  2⤵
  PID:2252
- C:\Windows\System\fPfZsJm.exe
  C:\Windows\System\fPfZsJm.exe
  2⤵
  PID:3024
- C:\Windows\System\dhbSVNi.exe
  C:\Windows\System\dhbSVNi.exe
  2⤵
  PID:2832
- C:\Windows\System\WIISHfS.exe
  C:\Windows\System\WIISHfS.exe
  2⤵
  PID:8252
- C:\Windows\System\skUFyem.exe
  C:\Windows\System\skUFyem.exe
  2⤵
  PID:8292
- C:\Windows\System\cnOyMIP.exe
  C:\Windows\System\cnOyMIP.exe
  2⤵
  PID:7780
- C:\Windows\System\SRaNNJu.exe
  C:\Windows\System\SRaNNJu.exe
  2⤵
  PID:7792
- C:\Windows\System\TnSmSzl.exe
  C:\Windows\System\TnSmSzl.exe
  2⤵
  PID:7568
- C:\Windows\System\ALPHUHG.exe
  C:\Windows\System\ALPHUHG.exe
  2⤵
  PID:8196
- C:\Windows\System\lKwoTGN.exe
  C:\Windows\System\lKwoTGN.exe
  2⤵
  PID:8300
- C:\Windows\System\LLuvXul.exe
  C:\Windows\System\LLuvXul.exe
  2⤵
  PID:8400
- C:\Windows\System\HiyqRUb.exe
  C:\Windows\System\HiyqRUb.exe
  2⤵
  PID:8284
- C:\Windows\System\CmEVqAt.exe
  C:\Windows\System\CmEVqAt.exe
  2⤵
  PID:8412
- C:\Windows\System\BUdeSxF.exe
  C:\Windows\System\BUdeSxF.exe
  2⤵
  PID:916
- C:\Windows\System\EMMzPEG.exe
  C:\Windows\System\EMMzPEG.exe
  2⤵
  PID:8448
- C:\Windows\System\ijMObac.exe
  C:\Windows\System\ijMObac.exe
  2⤵
  PID:8480
- C:\Windows\System\TDufvzm.exe
  C:\Windows\System\TDufvzm.exe
  2⤵
  PID:8512
- C:\Windows\System\rFcYkMY.exe
  C:\Windows\System\rFcYkMY.exe
  2⤵
  PID:8492
- C:\Windows\System\cbUqFuT.exe
  C:\Windows\System\cbUqFuT.exe
  2⤵
  PID:8564
- C:\Windows\System\TAHqHbd.exe
  C:\Windows\System\TAHqHbd.exe
  2⤵
  PID:8604
- C:\Windows\System\cHuWNvi.exe
  C:\Windows\System\cHuWNvi.exe
  2⤵
  PID:8684
- C:\Windows\System\fWEzrDE.exe
  C:\Windows\System\fWEzrDE.exe
  2⤵
  PID:8716
- C:\Windows\System\vgWiToC.exe
  C:\Windows\System\vgWiToC.exe
  2⤵
  PID:8992
- C:\Windows\System\NznBgpT.exe
  C:\Windows\System\NznBgpT.exe
  2⤵
  PID:2300
- C:\Windows\System\BwiLSiy.exe
  C:\Windows\System\BwiLSiy.exe
  2⤵
  PID:2116
- C:\Windows\System\BFnJMUX.exe
  C:\Windows\System\BFnJMUX.exe
  2⤵
  PID:9212
- C:\Windows\System\FWeYQlY.exe
  C:\Windows\System\FWeYQlY.exe
  2⤵
  PID:2092
- C:\Windows\System\xdBvKeA.exe
  C:\Windows\System\xdBvKeA.exe
  2⤵
  PID:1640
- C:\Windows\System\rARJqZY.exe
  C:\Windows\System\rARJqZY.exe
  2⤵
  PID:7816
- C:\Windows\System\KAGWXOi.exe
  C:\Windows\System\KAGWXOi.exe
  2⤵
  PID:8200
- C:\Windows\System\TtYkOgO.exe
  C:\Windows\System\TtYkOgO.exe
  2⤵
  PID:1140
- C:\Windows\System\ScYLjNr.exe
  C:\Windows\System\ScYLjNr.exe
  2⤵
  PID:8744
- C:\Windows\System\uvlyKsx.exe
  C:\Windows\System\uvlyKsx.exe
  2⤵
  PID:8180
- C:\Windows\System\bovANEq.exe
  C:\Windows\System\bovANEq.exe
  2⤵
  PID:8168
- C:\Windows\System\caFOQDs.exe
  C:\Windows\System\caFOQDs.exe
  2⤵
  PID:956
- C:\Windows\System\VqpCvVA.exe
  C:\Windows\System\VqpCvVA.exe
  2⤵
  PID:7976
- C:\Windows\System\pxNnmLu.exe
  C:\Windows\System\pxNnmLu.exe
  2⤵
  PID:8936
- C:\Windows\System\GpvVovg.exe
  C:\Windows\System\GpvVovg.exe
  2⤵
  PID:8508
- C:\Windows\System\sfKloFS.exe
  C:\Windows\System\sfKloFS.exe
  2⤵
  PID:8524
- C:\Windows\System\fCKxiYa.exe
  C:\Windows\System\fCKxiYa.exe
  2⤵
  PID:8984
- C:\Windows\System\GffyYxp.exe
  C:\Windows\System\GffyYxp.exe
  2⤵
  PID:8372
- C:\Windows\System\OZDFHps.exe
  C:\Windows\System\OZDFHps.exe
  2⤵
  PID:7820
- C:\Windows\System\jKUHDSX.exe
  C:\Windows\System\jKUHDSX.exe
  2⤵
  PID:8592
- C:\Windows\System\UXKpQpn.exe
  C:\Windows\System\UXKpQpn.exe
  2⤵
  PID:7580
- C:\Windows\System\kLOKyCi.exe
  C:\Windows\System\kLOKyCi.exe
  2⤵
  PID:8884
- C:\Windows\System\kUkccuW.exe
  C:\Windows\System\kUkccuW.exe
  2⤵
  PID:2164
- C:\Windows\System\OKXfjsc.exe
  C:\Windows\System\OKXfjsc.exe
  2⤵
  PID:6704
- C:\Windows\System\kFkWHlx.exe
  C:\Windows\System\kFkWHlx.exe
  2⤵
  PID:8248
- C:\Windows\System\IGAcrFZ.exe
  C:\Windows\System\IGAcrFZ.exe
  2⤵
  PID:8348
- C:\Windows\System\kDXHCpv.exe
  C:\Windows\System\kDXHCpv.exe
  2⤵
  PID:8600
- C:\Windows\System\KBAtmoD.exe
  C:\Windows\System\KBAtmoD.exe
  2⤵
  PID:8932
- C:\Windows\System\MIwrIJX.exe
  C:\Windows\System\MIwrIJX.exe
  2⤵
  PID:8708
- C:\Windows\System\iyHKwKD.exe
  C:\Windows\System\iyHKwKD.exe
  2⤵
  PID:8340
- C:\Windows\System\JPSPaBN.exe
  C:\Windows\System\JPSPaBN.exe
  2⤵
  PID:8676
- C:\Windows\System\jKAOFoA.exe
  C:\Windows\System\jKAOFoA.exe
  2⤵
  PID:3036
- C:\Windows\System\wjVimda.exe
  C:\Windows\System\wjVimda.exe
  2⤵
  PID:8392
- C:\Windows\System\xqgXKjz.exe
  C:\Windows\System\xqgXKjz.exe
  2⤵
  PID:8576
- C:\Windows\System\VRrjNSP.exe
  C:\Windows\System\VRrjNSP.exe
  2⤵
  PID:8216
- C:\Windows\System\GqDScXl.exe
  C:\Windows\System\GqDScXl.exe
  2⤵
  PID:9148
- C:\Windows\System\yELGwqJ.exe
  C:\Windows\System\yELGwqJ.exe
  2⤵
  PID:1692
- C:\Windows\System\QRsSasz.exe
  C:\Windows\System\QRsSasz.exe
  2⤵
  PID:9052
- C:\Windows\System\tRbTVak.exe
  C:\Windows\System\tRbTVak.exe
  2⤵
  PID:8068
- C:\Windows\System\aXhrxKC.exe
  C:\Windows\System\aXhrxKC.exe
  2⤵
  PID:8240
- C:\Windows\System\CKZHpBi.exe
  C:\Windows\System\CKZHpBi.exe
  2⤵
  PID:8272
- C:\Windows\System\zBwUNuy.exe
  C:\Windows\System\zBwUNuy.exe
  2⤵
  PID:1032
- C:\Windows\System\JclomUg.exe
  C:\Windows\System\JclomUg.exe
  2⤵
  PID:9076
- C:\Windows\System\QdOyGah.exe
  C:\Windows\System\QdOyGah.exe
  2⤵
  PID:9204
- C:\Windows\System\sgBTlFF.exe
  C:\Windows\System\sgBTlFF.exe
  2⤵
  PID:8952
- C:\Windows\System\ziYNLZx.exe
  C:\Windows\System\ziYNLZx.exe
  2⤵
  PID:2084
- C:\Windows\System\pFbPXeM.exe
  C:\Windows\System\pFbPXeM.exe
  2⤵
  PID:8888
- C:\Windows\System\ovxKdRu.exe
  C:\Windows\System\ovxKdRu.exe
  2⤵
  PID:4968
- C:\Windows\System\czNnFay.exe
  C:\Windows\System\czNnFay.exe
  2⤵
  PID:9236
- C:\Windows\System\hIyLmOG.exe
  C:\Windows\System\hIyLmOG.exe
  2⤵
  PID:9260
- C:\Windows\System\RnwJNmK.exe
  C:\Windows\System\RnwJNmK.exe
  2⤵
  PID:9276
- C:\Windows\System\hrPOVxP.exe
  C:\Windows\System\hrPOVxP.exe
  2⤵
  PID:9312
- C:\Windows\System\AjAgbAw.exe
  C:\Windows\System\AjAgbAw.exe
  2⤵
  PID:9360
- C:\Windows\System\Ncljlgw.exe
  C:\Windows\System\Ncljlgw.exe
  2⤵
  PID:9376
- C:\Windows\System\JjzYmdf.exe
  C:\Windows\System\JjzYmdf.exe
  2⤵
  PID:9392
- C:\Windows\System\GcNoxOI.exe
  C:\Windows\System\GcNoxOI.exe
  2⤵
  PID:9408
- C:\Windows\System\FxmwFVs.exe
  C:\Windows\System\FxmwFVs.exe
  2⤵
  PID:9424
- C:\Windows\System\vgerSXQ.exe
  C:\Windows\System\vgerSXQ.exe
  2⤵
  PID:9440
- C:\Windows\System\zRdWYQp.exe
  C:\Windows\System\zRdWYQp.exe
  2⤵
  PID:9456
- C:\Windows\System\bcgxjQg.exe
  C:\Windows\System\bcgxjQg.exe
  2⤵
  PID:9504
- C:\Windows\System\dnpPJfy.exe
  C:\Windows\System\dnpPJfy.exe
  2⤵
  PID:9520
- C:\Windows\System\kGOvotZ.exe
  C:\Windows\System\kGOvotZ.exe
  2⤵
  PID:9536
- C:\Windows\System\gESGCxd.exe
  C:\Windows\System\gESGCxd.exe
  2⤵
  PID:9552
- C:\Windows\System\aHHLpHs.exe
  C:\Windows\System\aHHLpHs.exe
  2⤵
  PID:9568
- C:\Windows\System\PcUwIpD.exe
  C:\Windows\System\PcUwIpD.exe
  2⤵
  PID:9584
- C:\Windows\System\ofghKdi.exe
  C:\Windows\System\ofghKdi.exe
  2⤵
  PID:9600
- C:\Windows\System\IeESaPF.exe
  C:\Windows\System\IeESaPF.exe
  2⤵
  PID:9616
- C:\Windows\System\qzkIqrT.exe
  C:\Windows\System\qzkIqrT.exe
  2⤵
  PID:9632
- C:\Windows\System\pJwEoDW.exe
  C:\Windows\System\pJwEoDW.exe
  2⤵
  PID:9652
- C:\Windows\System\Rfydxoc.exe
  C:\Windows\System\Rfydxoc.exe
  2⤵
  PID:9668
- C:\Windows\System\abGAMoh.exe
  C:\Windows\System\abGAMoh.exe
  2⤵
  PID:9688
- C:\Windows\System\hPDlNEK.exe
  C:\Windows\System\hPDlNEK.exe
  2⤵
  PID:9704
- C:\Windows\System\UcHrSUw.exe
  C:\Windows\System\UcHrSUw.exe
  2⤵
  PID:9720
- C:\Windows\System\lmJBwKs.exe
  C:\Windows\System\lmJBwKs.exe
  2⤵
  PID:9736
- C:\Windows\System\jOAnJYg.exe
  C:\Windows\System\jOAnJYg.exe
  2⤵
  PID:9752
- C:\Windows\System\iAmeyDJ.exe
  C:\Windows\System\iAmeyDJ.exe
  2⤵
  PID:9768
- C:\Windows\System\hvrZNph.exe
  C:\Windows\System\hvrZNph.exe
  2⤵
  PID:9784
- C:\Windows\System\qGuLvFb.exe
  C:\Windows\System\qGuLvFb.exe
  2⤵
  PID:9800
- C:\Windows\System\fLyOhUk.exe
  C:\Windows\System\fLyOhUk.exe
  2⤵
  PID:9816
- C:\Windows\System\uVzJRxd.exe
  C:\Windows\System\uVzJRxd.exe
  2⤵
  PID:9832
- C:\Windows\System\bLDFxWu.exe
  C:\Windows\System\bLDFxWu.exe
  2⤵
  PID:9848
- C:\Windows\System\mGLURnX.exe
  C:\Windows\System\mGLURnX.exe
  2⤵
  PID:9864
- C:\Windows\System\mEdhuMY.exe
  C:\Windows\System\mEdhuMY.exe
  2⤵
  PID:9880
- C:\Windows\System\OChXkip.exe
  C:\Windows\System\OChXkip.exe
  2⤵
  PID:9900
- C:\Windows\System\ZvmLvVH.exe
  C:\Windows\System\ZvmLvVH.exe
  2⤵
  PID:9916
- C:\Windows\System\wlfxnvm.exe
  C:\Windows\System\wlfxnvm.exe
  2⤵
  PID:9936
- C:\Windows\System\uFaPbAt.exe
  C:\Windows\System\uFaPbAt.exe
  2⤵
  PID:9952
- C:\Windows\System\KyZuZjk.exe
  C:\Windows\System\KyZuZjk.exe
  2⤵
  PID:9972
- C:\Windows\System\IsdUEKJ.exe
  C:\Windows\System\IsdUEKJ.exe
  2⤵
  PID:9988
- C:\Windows\System\QGXovNL.exe
  C:\Windows\System\QGXovNL.exe
  2⤵
  PID:10004
- C:\Windows\System\tIjhZqN.exe
  C:\Windows\System\tIjhZqN.exe
  2⤵
  PID:10020
- C:\Windows\System\sVGClxq.exe
  C:\Windows\System\sVGClxq.exe
  2⤵
  PID:10040
- C:\Windows\System\plfOqPO.exe
  C:\Windows\System\plfOqPO.exe
  2⤵
  PID:10056
- C:\Windows\System\yiVlMXQ.exe
  C:\Windows\System\yiVlMXQ.exe
  2⤵
  PID:10072
- C:\Windows\System\WQzWWYu.exe
  C:\Windows\System\WQzWWYu.exe
  2⤵
  PID:10088
- C:\Windows\System\OUYYpPK.exe
  C:\Windows\System\OUYYpPK.exe
  2⤵
  PID:10104
- C:\Windows\System\mSkMegV.exe
  C:\Windows\System\mSkMegV.exe
  2⤵
  PID:10120
- C:\Windows\System\uOHGKJF.exe
  C:\Windows\System\uOHGKJF.exe
  2⤵
  PID:10136
- C:\Windows\System\bsJrDDI.exe
  C:\Windows\System\bsJrDDI.exe
  2⤵
  PID:10152
- C:\Windows\System\hHmfwaJ.exe
  C:\Windows\System\hHmfwaJ.exe
  2⤵
  PID:10168
- C:\Windows\System\ynwzPsm.exe
  C:\Windows\System\ynwzPsm.exe
  2⤵
  PID:10184
- C:\Windows\System\joKfIlo.exe
  C:\Windows\System\joKfIlo.exe
  2⤵
  PID:10200
- C:\Windows\System\oSziIuV.exe
  C:\Windows\System\oSziIuV.exe
  2⤵
  PID:10220
- C:\Windows\System\TPcmojb.exe
  C:\Windows\System\TPcmojb.exe
  2⤵
  PID:8072
- C:\Windows\System\qRcvKxw.exe
  C:\Windows\System\qRcvKxw.exe
  2⤵
  PID:8772
- C:\Windows\System\SPceAHI.exe
  C:\Windows\System\SPceAHI.exe
  2⤵
  PID:1516
- C:\Windows\System\dZmwwon.exe
  C:\Windows\System\dZmwwon.exe
  2⤵
  PID:9244
- C:\Windows\System\WVUIwug.exe
  C:\Windows\System\WVUIwug.exe
  2⤵
  PID:9308
- C:\Windows\System\QbTLeLU.exe
  C:\Windows\System\QbTLeLU.exe
  2⤵
  PID:9304
- C:\Windows\System\PMUPYOg.exe
  C:\Windows\System\PMUPYOg.exe
  2⤵
  PID:9104
- C:\Windows\System\geBPRTw.exe
  C:\Windows\System\geBPRTw.exe
  2⤵
  PID:7348
- C:\Windows\System\rENWAZo.exe
  C:\Windows\System\rENWAZo.exe
  2⤵
  PID:8648
- C:\Windows\System\QuABMDt.exe
  C:\Windows\System\QuABMDt.exe
  2⤵
  PID:8916
- C:\Windows\System\LgeGWyu.exe
  C:\Windows\System\LgeGWyu.exe
  2⤵
  PID:9036
- C:\Windows\System\lNxnAER.exe
  C:\Windows\System\lNxnAER.exe
  2⤵
  PID:9228
- C:\Windows\System\hUpmLnW.exe
  C:\Windows\System\hUpmLnW.exe
  2⤵
  PID:9328
- C:\Windows\System\hHvSEQs.exe
  C:\Windows\System\hHvSEQs.exe
  2⤵
  PID:9352
- C:\Windows\System\FOpPZRN.exe
  C:\Windows\System\FOpPZRN.exe
  2⤵
  PID:9356
- C:\Windows\System\yNuVRNw.exe
  C:\Windows\System\yNuVRNw.exe
  2⤵
  PID:9400
- C:\Windows\System\QpPterC.exe
  C:\Windows\System\QpPterC.exe
  2⤵
  PID:9472
- C:\Windows\System\XkrjBHZ.exe
  C:\Windows\System\XkrjBHZ.exe
  2⤵
  PID:9480
- C:\Windows\System\YOYmLXd.exe
  C:\Windows\System\YOYmLXd.exe
  2⤵
  PID:9500
- C:\Windows\System\lSpNoeM.exe
  C:\Windows\System\lSpNoeM.exe
  2⤵
  PID:9528
- C:\Windows\System\hrNlKkG.exe
  C:\Windows\System\hrNlKkG.exe
  2⤵
  PID:9608
- C:\Windows\System\UldvDQv.exe
  C:\Windows\System\UldvDQv.exe
  2⤵
  PID:9624
- C:\Windows\System\kgNZBgt.exe
  C:\Windows\System\kgNZBgt.exe
  2⤵
  PID:9628
- C:\Windows\System\FLVtjYW.exe
  C:\Windows\System\FLVtjYW.exe
  2⤵
  PID:9664
- C:\Windows\System\ahmwduy.exe
  C:\Windows\System\ahmwduy.exe
  2⤵
  PID:9716
- C:\Windows\System\YyZtVqs.exe
  C:\Windows\System\YyZtVqs.exe
  2⤵
  PID:9728
- C:\Windows\System\oMXOddt.exe
  C:\Windows\System\oMXOddt.exe
  2⤵
  PID:9808
- C:\Windows\System\CwkZswg.exe
  C:\Windows\System\CwkZswg.exe
  2⤵
  PID:9792
- C:\Windows\System\igveNUU.exe
  C:\Windows\System\igveNUU.exe
  2⤵
  PID:9872
- C:\Windows\System\WjDUlgf.exe
  C:\Windows\System\WjDUlgf.exe
  2⤵
  PID:9828
- C:\Windows\System\GqTuoaa.exe
  C:\Windows\System\GqTuoaa.exe
  2⤵
  PID:9912
- C:\Windows\System\nxHpvGk.exe
  C:\Windows\System\nxHpvGk.exe
  2⤵
  PID:9896
- C:\Windows\System\PYPeigt.exe
  C:\Windows\System\PYPeigt.exe
  2⤵
  PID:9928
- C:\Windows\System\mPNgmJP.exe
  C:\Windows\System\mPNgmJP.exe
  2⤵
  PID:9964
- C:\Windows\System\QLYnVPO.exe
  C:\Windows\System\QLYnVPO.exe
  2⤵
  PID:10016
- C:\Windows\System\tLBHttl.exe
  C:\Windows\System\tLBHttl.exe
  2⤵
  PID:10052
- C:\Windows\System\zGaOkmH.exe
  C:\Windows\System\zGaOkmH.exe
  2⤵
  PID:10080
- C:\Windows\System\PniPAVu.exe
  C:\Windows\System\PniPAVu.exe
  2⤵
  PID:10116

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\DKPCJrK.exe

Filesize
1.9MB

MD5
fdf7d5a8dd256b7ca8f9efe197eb0835

SHA1
54c2cc23f2bcd3b03b1bb11b09ad60ded0598cd8

SHA256
4f067d3195b31daa8bf69eaca4ec121343a0d7cc7059e63391627fd1e3a341d8

SHA512
d0a00f6ad4c94d8d440b9f5541ecc4ec2cf042bfc6ea79e9975b37ca8a3ec96ebb45183985130bd72d3ac5a4a32f83b85eddffa3096620849739b574c0233432

Download Submit
C:\Windows\system\EjQvnaW.exe

Filesize
1.9MB

MD5
9c51156027a551852f61680bef2782b0

SHA1
ba03cc0ce1e9bfaf257228908049f7fea946862e

SHA256
0d221ac62894141bd5ed0c0f7cd9bb7f0a4dc47c1a6d3e9088186cf0ed58c134

SHA512
af87497a4e94a31224cdee9a0dd95af52053c585fe23506f5f604f04f77772c10e347f6b67c2c14d16e4c87a88f3bbb52e600b8dac9475791aad28c9ad8b8d2b

Download Submit
C:\Windows\system\FYEoasm.exe

Filesize
1.9MB

MD5
62f4c388f4110e39a011b9fe2865f1fe

SHA1
1bd780b55a2e6356d35f8cb1eda95ba3db215350

SHA256
a45962440c6389fcb76455bd6d07e866afd419acbbfb82a3984df22b7151ce7f

SHA512
aca57667257d374106386fd771c854f253b94689ca83bc79acc8490df68c9f167bc283dc61960cac765e985af3e15335ad818f4625619211ef90dbdc5afd805a

Download Submit
C:\Windows\system\GOJSHkW.exe

Filesize
1.9MB

MD5
2d1964d147e09ed2e93832e1f0ecd498

SHA1
04d4a94c0e908149ea4248597b89d8f288c150ff

SHA256
64c68b9f9ffee21bea3420d198a6c663d4ff7240de7ff6a2abbc03e72796e827

SHA512
7691d90fad206f83a31375a109c1f901386ca863eef59a0a54412735cfadc3f3a815c3f3d83d0a38bcbf82498095a43bda474555004128e56e361cf2918d861d

Download Submit
C:\Windows\system\KCrsdkr.exe

Filesize
1.9MB

MD5
e4018bc5f57fc1ccef40056a680a0738

SHA1
aba8a62f7acf53bf4458a0614874620d78bae658

SHA256
bf30f9a048048e15f0f4bb661057c797ea4f1101e09ad04507be981ebbf117ad

SHA512
ba38943417be45805bb79fbb57a583c6e9cbf8e1a093f3189dc752b02d0d6553e6f64033ab025e17deb3f8e0c5bbb5cbf70055794fa9ebeeba94e91c228483cb

Download Submit
C:\Windows\system\NETXaWI.exe

Filesize
1.9MB

MD5
cfcd40c9ba3fea205cd24e8a978f0800

SHA1
980ef338c86b674f9f96bbea49ee7de0f13df203

SHA256
fb74b61b5332b882a35fcb2d0bddf3d7d621a2d9e8b5001800d24d42e7d2ce36

SHA512
707f5448ad1db2d306bb13740a4ccefae42a3fb9b1414a9e1bdcd28cdc2506f3d62b0309f26a4176f2918694a59a2962188962f2b36a890769693366bd82fa6d

Download Submit
C:\Windows\system\NMgshgY.exe

Filesize
1.9MB

MD5
3f9f46b680914a354ce9175b40a4291f

SHA1
a4e4b48753eff6ffab0a8ba09b642756393bb36c

SHA256
f362e18d33c23549ffa60875e09ee7e5a0a2f68963a371c2cb2bd218f99d2507

SHA512
3922dac77ef028e33443dd684ac2f5eb289b90302c786c4d6679b9087879451dd5b8de33be416c00d76241a417e23dc20a956c42d125dec8ca84dbb8e5791771

Download Submit
C:\Windows\system\Nwmsfra.exe

Filesize
1.9MB

MD5
10796c35c760196675575bc0b4542094

SHA1
3df1ac2e75e6ab8d14baeb42d8e412eac562d243

SHA256
ba88ebc143b2022b5c4ff02cc2f9bba65b9b1fcdad52d56b51ae3acc67074ab2

SHA512
25949090fb5d783ab7cf34b180985f3d604dd54d45f4d56af9c7f526df66e5dc9c04f84402e31218d5712097c4ca34b60a150799257b680a9dd1ab077c2ead3f

Download Submit
C:\Windows\system\RrcLhpp.exe

Filesize
1.9MB

MD5
b2d29d06fa97dbc75a347bcac68e22a0

SHA1
7b72aa679382bced8afa7cbebcd3f3cbeb2499e7

SHA256
008925fbd43faab4076d1eb3e750198d2c418605e5b57c1dae58841628a0abdd

SHA512
22e92983ef2f7a125b80fa1aaeea676c031bc06a04167faa5f345b715d4f7c22be44a229e63aabda0d3134484802b52531361c1ef67321e3fa22a16c7cd56f2d

Download Submit
C:\Windows\system\TBfYKUE.exe

Filesize
1.9MB

MD5
d57217529a0d7623b87e1bd5a258d2c4

SHA1
3aae5a333d8cea662e55ad2e48dfb91c2c2805cd

SHA256
0d89c78cee2c41e40cef288693f1096a66bd63fbd056159e007b1b9254108637

SHA512
5e4fc7797e68553b95171099608571de48bca546c5896cc38753a5fb600d6e4618a482bcea3edd9ace9e2fb50570858128eac18878edde2a3d9f419d745d8ccf

Download Submit
C:\Windows\system\UVLOJoO.exe

Filesize
1.9MB

MD5
66a95dff71934476f995714667919c8a

SHA1
9fd4ba7a373e7d9369e99779ee9dc8044190bc99

SHA256
a44270c01df7f7e43787c8340464221870819359d53813983da6cab8fec4566a

SHA512
55d450a3951ca8ae3f2ecc65b403f0f9e7c14f910d58114a20d98d02f59c009b0f0977286b12671fa45fbd456b89e0fd2847ce0d5d5af0d954fad290c1bdd8ed

Download Submit
C:\Windows\system\UdixNMQ.exe

Filesize
1.9MB

MD5
f74cc716fba71a8fe8d0997a74d6ae25

SHA1
45970c1c05c563cff00801d2b8e34c95e5666e2a

SHA256
4c40a764ed2f7ced57ee001ec0d8add097cb577af9f28aebf12b5c51c818af3a

SHA512
49f5438a4d11132d89d61cb903a58806d9ab2ea7a270b9a2d6903e254c523e4cf7ea9c587b745ffa392728af6e63854e8a893a4f6da9c186958a0a04adb95e92

Download Submit
C:\Windows\system\WTzAiPV.exe

Filesize
1.9MB

MD5
2dcd06338133f48c71cb7af9e704c672

SHA1
417c01190514e9b5c3455b992df253d7608c42a8

SHA256
bec15bc801f7bcb52c89f8a735ecbff44955e2a08caeda073ec7d993b93ccd47

SHA512
d941dd07b2aa6789b4b7e6090f4f65771c788a76b042e15a4d58cced05cf4aaa35ad7ffebfdbe4e97c247aa522801885d4eac1c2d04dcd111f16e74f86c5c795

Download Submit
C:\Windows\system\WjZteJd.exe

Filesize
1.9MB

MD5
c269fdcae5647397d6ea5bc1b5e17656

SHA1
7913c7b892616cb725eccb22b6719e546247ab6c

SHA256
0d8a11a68edf7414868989a16e0b7240b1b7d0aba4849a5472afb2fa813f0f8d

SHA512
529d23d0aefd78c84722e52339cd2aa3498b4785e6b9f4dbf00ee2071ac248a3dd8a39fe54fae09c4965b907203dc17896a454dd2a572a4b6f7e0c58ebc47237

Download Submit
C:\Windows\system\ZAZTvwt.exe

Filesize
1.9MB

MD5
ba0af007f8d02fd0c27bd46faa19f6b0

SHA1
88688d83c8ecb4f940d4aae9c0bd3fcc15ea1fd2

SHA256
0245f8c773088e03a692f2fba40f39849a86cdf7d78592fa3c2075004093881a

SHA512
7b06ee6c874f7e12dfcf02f11d59a2020c1782aa2aef0a5ccdfafddc1a84313cb2f67caa488d63977d7af5db6808f550d53d9697053c689484f617eb041ae1ff

Download Submit
C:\Windows\system\ZrdRvwc.exe

Filesize
1.9MB

MD5
b4b25b1dbad77ba120bae471ef7f2545

SHA1
84d25e9428eedf85ce1975cb9c4c459b07efe69f

SHA256
cadb70d994769a2c88323dbf7d32f2959b0bdb9ca9b52867288f25d823419c1c

SHA512
08a76a9c14527bdf79ae837144681b8da644755c5eef673733d2912cb6177a28681a22a1be3f4b431962ccf0507e7bd646d615d70546912b427142488b4f268a

Download Submit
C:\Windows\system\fPhxXOF.exe

Filesize
1.9MB

MD5
46565312c7e15796ee0d65fc114d74ef

SHA1
0483de1fee00774d8766eba2acba2e2147ff0dfd

SHA256
0a17ee8800c938dc8be4ec651740f3fb9f0b6d8182958e3d38dad0e260a8bf77

SHA512
1cc4c040566034e785048a11e7f0e89ce1881ebaca03650f6ef96b013489138acac347530b3d03d050196f0a1f43e4487e030a8795d291e8fed34bdfc63b3ca8

Download Submit
C:\Windows\system\faVAkrA.exe

Filesize
1.9MB

MD5
090083571bb1e085854c75a8db1a26d3

SHA1
d5a3085a854eb12a788dda10b3b0a0210681c57c

SHA256
dc3b71b7cd2df50f6f23541b7981170f3036e9136bdeb4a1a0220970704cb9b9

SHA512
298f8922a225a13be2ae5110442cb6ab78c658707d6943e6529a9362001d35ed20867bb24f8ec451380f74e0940e73bdfe440e5f1caabde874fb73ce9fecd6a0

Download Submit
C:\Windows\system\fcdwaOK.exe

Filesize
1.9MB

MD5
b9c3a4ec06ff7770cdec373c89934fe7

SHA1
8d4fb69bd1f5a60756d708d6a6cf9baaa2e6a37c

SHA256
43171664abd498f3925951b5b6ebefa4ca8b752f7f9e56aec6a8391525004409

SHA512
1626feae306bcae0aa74130f9b75b899b2aedbe93c87846c2f74306eeea1402c24ca1bbe0ed043f58b2fd12b4051c42c7eec4dc8862fe17f8afcd7b0cfe6edad

Download Submit
C:\Windows\system\hHaKKkw.exe

Filesize
1.9MB

MD5
e3e66fbb1e60d617688b639c00c6d1c3

SHA1
d7d626870b6f18dfe19df5de691857e886840858

SHA256
2e92b374ca5e0a35e6e43e671e6554ca89deed5d6616d8fe32d5485d53ef9c17

SHA512
c7ebff5ee2b404ea5dfa11f7d074e1c46800b7d7529cb001089a77fef7a2087e86a8a3304280160a73424dd5534d45899b5330dcdb387c9c79cc8085ef191587

Download Submit
C:\Windows\system\lzDIUpq.exe

Filesize
1.9MB

MD5
3841bad1ace1ee97fb04e47b70802c67

SHA1
7affe53465f90005645e09c124af95ba3ec030e9

SHA256
2d84fba96d9750e7c356250d78535525c287e58499437e937e96e84c65e91ebd

SHA512
092f349728744fc0c19e17c61a8400f801dd56c6f5c17b99236031aa55eb407f0b3789869f4bc096f3cf22580686a25c1e528bf873d5a74cfcb0a7cd41fffef2

Download Submit
C:\Windows\system\qKIOMeN.exe

Filesize
1.9MB

MD5
41cf4a51d95ddace95503d886eb14543

SHA1
7308f8de524e52a8e881ab39294fd723886cbacb

SHA256
b124e7f27186356192eceec557c6105aa52927a2206145eb9fae491f4e8f1900

SHA512
2cbcba91d4e7ab4607d6a2be1108c182f7fffade008673de5e40b7a536f8728bfe212ca3d31c8af1d09f27a7dad2ef6a162ff6d90c55468316f6460b0b8095a4

Download Submit
C:\Windows\system\tNlxsba.exe

Filesize
1.9MB

MD5
e50d9a07d9e8e0368b9ac6bc423e95b1

SHA1
c0fc24d170ca7f195633be5421597c93de7220bc

SHA256
5e716fe63bbad3d0c3413652d6f2d276393459b021fa22a74090df6af17ec264

SHA512
ee7d54685e4ed42e08d58ab7421c4277b743d2365140d9b6702206e02e253bfc6bd0da85611b4c1c09420fb398b0f18b26ed903ff24601dfc1065b6d9f90c7b8

Download Submit
C:\Windows\system\wmpHYNq.exe

Filesize
1.9MB

MD5
7290c3f2fa0123289ad676d1acc6ab2a

SHA1
b3c2e632768a2a45a415b70baeb6a07760d6c10f

SHA256
fbf064cc84775efd3b3be3f233fcede4c65471cee1694b07279df423a9c42886

SHA512
fb4e80e9cbbea42d320e01a4b9f65b830468fd6dab9ab6a2e87362104389101c15260ec1d5afab8fdaad4534736aa91f5beaecfd6baa9238852c7c35a2294c70

Download Submit
C:\Windows\system\zlgGYmB.exe

Filesize
1.9MB

MD5
e48c98388643ad0ebd7516d2c76631d7

SHA1
d05f74062a23c14384ea31c5d929e1e18549d1b0

SHA256
9543208d2b25ebc27cbf2a6cdd6e9552c65108ffd50ef7271dee5fda5c3e4866

SHA512
65e915d2fccac06dc50ae5769fe8f261431a512306b575676181a059c39645a1a67d56146a791f95ca991b4f4d8428ee408c044eac0ce8621ad8ac088d7ced9b

Download Submit
C:\Windows\system\zzuLVSi.exe

Filesize
1.9MB

MD5
3a8be0abbd5b7c30be08f7980d99282e

SHA1
a7fafd76ae041e6e5d87a0baa2a8156ff63f6e1d

SHA256
f980b7a3c1eb63963ff6b2e765a90a6f0a35f7653c4236495855f5862a656ad8

SHA512
d53515f79591edaa92e871bcad7b7d53b311b605780a13b8094def1571f4fc5a349c58793ba34113ff1387c5829cbc8f9387139a50bc288c85209ba4bd94a348

Download Submit
\Windows\system\GvCFRMc.exe

Filesize
1.9MB

MD5
d15e7b9a0c7558a29ae212c0c0ae2bf5

SHA1
8d9a9ae78bbfabb3f47c16104df4cdbf16571119

SHA256
0a6a9cf7963d69220b81543ad3a940d4f008b1aff1c6bee9239e10eda4155271

SHA512
847bf1dd18d01e92b04321badb495b53d770f1cffc21bc646c9744be971a8415bb570fcc2f96091248aecea5b4f486a6e4879c73ac9648b2ebfce5b5b1c6acaf

Download Submit
\Windows\system\KCMWver.exe

Filesize
1.9MB

MD5
579705c58a02839693e820f3315c9d90

SHA1
0e2d21bac9753a4da0ca5df2495ddc11ba1f3235

SHA256
ea3b93da32b521e8f391371cd1fa134429085551a576f11f1eaa20d40ef20d23

SHA512
3679e2e4e2088098bb5b067b83da3fdd9889a05f7d1e4a4db8276b1311f13d233048a8767634ca933e9f394c14b565b55763df3c5cd2d5b31493d63249f07bc5

Download Submit
\Windows\system\YqCKvUw.exe

Filesize
1.9MB

MD5
fa1aff351c34065ca1c5a3a63462b723

SHA1
9e23fee2765810f06892a083f2740a06de8f61aa

SHA256
df061374660053c4b6c6bbaf32522deb1f271fc79b40c889f801c78df0669aa9

SHA512
a927f90193b8ebf71e88edd5988c4df99a3a0ca1fcb875b0fedfbb734c92f8f523a6f463388a4bf8889ecfcdc15207183aad4164dcded6e17d9c576bf74c9d00

Download Submit
\Windows\system\gztNPlu.exe

Filesize
1.9MB

MD5
b90537b455f19106f720c5921bdd54f2

SHA1
9776ef5b5c2ccb27d98e06208fed776601faa661

SHA256
b23f2a4894c85d7aa0699e0212cc5df98a8b00ee147fecb7b38d5cc5216764d9

SHA512
3b0fa406a6995ab9f461376b191cb735864815b27517e0ac2d6422ea8494dfd68953678ffa520ab92a098872fcf5357b1f64cc73cacf92acf2ab5979b818081a

Download Submit
\Windows\system\oastmZO.exe

Filesize
1.9MB

MD5
61e87f1ae968eac9452bb88f310ff244

SHA1
3a254a683f0140e7104d0a95d46fdd4007531254

SHA256
318c9f3dea0623c3cdcd5891bfdd2a938c3fb71f91bfbc373beab708d0cbf183

SHA512
7eea35a419c4274e8c228ca2f0a52c1fe1257b8a79fb95d6218d54dc3551fdd965c9a42f4355012205f2a78b6a95763744eba20feba488dc0baa3b73623c7abd

Download Submit
\Windows\system\wrsvvps.exe

Filesize
1.9MB

MD5
f18fee5047f689b49c3c75737ebb3161

SHA1
2865f5a15e8448f7c3841d7721de8cd2e1622357

SHA256
a0813decdac6479466dfda2b005e3561376cb2fe4cc79c0b7906de13d744efd9

SHA512
d09f41382abfd1e88d04a63b0585bb9b5c12963ae92a5221d24eb0e2e80e18d057a5dc2a4f677fc022ef265056625c18e34d7318e45f42c09d139d2c34393682

Download Submit
memory/1148-1889-0x000000013F800000-0x000000013FBF2000-memory.dmp

Filesize
3.9MB

Download
memory/1148-205-0x000000013F800000-0x000000013FBF2000-memory.dmp

Filesize
3.9MB

Download
memory/1304-1881-0x000000013FF50000-0x0000000140342000-memory.dmp

Filesize
3.9MB

Download
memory/1304-23-0x000000013FF50000-0x0000000140342000-memory.dmp

Filesize
3.9MB

Download
memory/1944-142-0x000000001B450000-0x000000001B732000-memory.dmp

Filesize
2.9MB

Download
memory/1944-145-0x0000000001EC0000-0x0000000001EC8000-memory.dmp

Filesize
32KB

Download
memory/1944-174-0x000007FEF4D90000-0x000007FEF572D000-memory.dmp

Filesize
9.6MB

Download
memory/1944-32-0x000007FEF504E000-0x000007FEF504F000-memory.dmp

Filesize
4KB

Download
memory/1944-248-0x000007FEF4D90000-0x000007FEF572D000-memory.dmp

Filesize
9.6MB

Download
memory/2112-207-0x000000013F840000-0x000000013FC32000-memory.dmp

Filesize
3.9MB

Download
memory/2112-1888-0x000000013F840000-0x000000013FC32000-memory.dmp

Filesize
3.9MB

Download
memory/2428-13-0x000000013F960000-0x000000013FD52000-memory.dmp

Filesize
3.9MB

Download
memory/2428-1879-0x000000013F960000-0x000000013FD52000-memory.dmp

Filesize
3.9MB

Download
memory/2480-179-0x000000013F540000-0x000000013F932000-memory.dmp

Filesize
3.9MB

Download
memory/2480-1884-0x000000013F540000-0x000000013F932000-memory.dmp

Filesize
3.9MB

Download
memory/2516-203-0x000000013FC60000-0x0000000140052000-memory.dmp

Filesize
3.9MB

Download
memory/2516-1887-0x000000013FC60000-0x0000000140052000-memory.dmp

Filesize
3.9MB

Download
memory/2520-201-0x000000013F1C0000-0x000000013F5B2000-memory.dmp

Filesize
3.9MB

Download
memory/2520-1886-0x000000013F1C0000-0x000000013F5B2000-memory.dmp

Filesize
3.9MB

Download
memory/2592-1885-0x000000013F820000-0x000000013FC12000-memory.dmp

Filesize
3.9MB

Download
memory/2592-182-0x000000013F820000-0x000000013FC12000-memory.dmp

Filesize
3.9MB

Download
memory/2728-208-0x000000013FF60000-0x0000000140352000-memory.dmp

Filesize
3.9MB

Download
memory/2728-1882-0x000000013FF60000-0x0000000140352000-memory.dmp

Filesize
3.9MB

Download
memory/2780-1883-0x000000013F740000-0x000000013FB32000-memory.dmp

Filesize
3.9MB

Download
memory/2780-189-0x000000013F740000-0x000000013FB32000-memory.dmp

Filesize
3.9MB

Download
memory/2912-11-0x0000000002C20000-0x0000000003012000-memory.dmp

Filesize
3.9MB

Download
memory/2912-19-0x000000013FF50000-0x0000000140342000-memory.dmp

Filesize
3.9MB

Download
memory/2912-186-0x0000000002C20000-0x0000000003012000-memory.dmp

Filesize
3.9MB

Download
memory/2912-190-0x0000000002C20000-0x0000000003012000-memory.dmp

Filesize
3.9MB

Download
memory/2912-202-0x000000013FC60000-0x0000000140052000-memory.dmp

Filesize
3.9MB

Download
memory/2912-199-0x000000013F1C0000-0x000000013F5B2000-memory.dmp

Filesize
3.9MB

Download
memory/2912-1-0x000000013F5C0000-0x000000013F9B2000-memory.dmp

Filesize
3.9MB

Download
memory/2912-175-0x0000000002C20000-0x0000000003012000-memory.dmp

Filesize
3.9MB

Download
memory/2912-204-0x0000000003440000-0x0000000003832000-memory.dmp

Filesize
3.9MB

Download
memory/2912-21-0x0000000002C20000-0x0000000003012000-memory.dmp

Filesize
3.9MB

Download
memory/2912-0-0x00000000002F0000-0x0000000000300000-memory.dmp

Filesize
64KB

Download
memory/2912-31-0x000000013FF60000-0x0000000140352000-memory.dmp

Filesize
3.9MB

Download
memory/2912-181-0x0000000002C20000-0x0000000003012000-memory.dmp

Filesize
3.9MB

Download
memory/2912-206-0x0000000003440000-0x0000000003832000-memory.dmp

Filesize
3.9MB

Download
memory/2920-1890-0x000000013F620000-0x000000013FA12000-memory.dmp

Filesize
3.9MB

Download
memory/2920-196-0x000000013F620000-0x000000013FA12000-memory.dmp

Filesize
3.9MB

Download
memory/3020-1880-0x000000013F670000-0x000000013FA62000-memory.dmp

Filesize
3.9MB

Download
memory/3020-22-0x000000013F670000-0x000000013FA62000-memory.dmp

Filesize
3.9MB

Download