xmrig | 81a48b0e5b7a88d9cbf0512312fb2ea7979d35f5e23b99c3348ba7a791f72528

Analysis

max time kernel
122s
max time network
118s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
27/06/2024, 11:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

81a48b0e5b7a88d9cbf0512312fb2ea7979d35f5e23b99c3348ba7a791f72528_NeikiAnalytics.exe
Size

1.9MB
MD5

2cd3e551bf0f4134c651e4863cabb790
SHA1

181cc0014ff768432611e7e2d6378c79273d216a
SHA256

81a48b0e5b7a88d9cbf0512312fb2ea7979d35f5e23b99c3348ba7a791f72528
SHA512

0fe6d021dee0e878e028b008bdfac0c44e4f009fa1c3fa0d94384930d954c5fc9ca9381b57086e089d76c85ed6d74fe8d9c6e587679b2ca8ea4d3daa5f3b39d6
SSDEEP

24576:zv3/fTLF671TilQFG4P5PMkipBh8tGxHIBWGlTqTmo6OZXbPbPIdkq8T91EQQsA1:Lz071uv4BPMkiFGlvETbvpEy6g0

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 21 IoCs

miner

resource	yara_rule
behavioral1/memory/2504-191-0x000000013F2A0000-0x000000013F692000-memory.dmp	xmrig
behavioral1/memory/2492-188-0x000000013F1E0000-0x000000013F5D2000-memory.dmp	xmrig
behavioral1/memory/2660-186-0x000000013F5C0000-0x000000013F9B2000-memory.dmp	xmrig
behavioral1/memory/2436-184-0x000000013F540000-0x000000013F932000-memory.dmp	xmrig
behavioral1/memory/924-181-0x000000013FD90000-0x0000000140182000-memory.dmp	xmrig
behavioral1/memory/2468-179-0x000000013F900000-0x000000013FCF2000-memory.dmp	xmrig
behavioral1/memory/2596-177-0x000000013F440000-0x000000013F832000-memory.dmp	xmrig
behavioral1/memory/2440-175-0x000000013FED0000-0x00000001402C2000-memory.dmp	xmrig
behavioral1/memory/2616-26-0x000000013F700000-0x000000013FAF2000-memory.dmp	xmrig
behavioral1/memory/2580-25-0x000000013FB50000-0x000000013FF42000-memory.dmp	xmrig
behavioral1/memory/1704-23-0x000000013FB50000-0x000000013FF42000-memory.dmp	xmrig
behavioral1/memory/2176-22-0x000000013FC50000-0x0000000140042000-memory.dmp	xmrig
behavioral1/memory/2580-4921-0x000000013FB50000-0x000000013FF42000-memory.dmp	xmrig
behavioral1/memory/2468-4931-0x000000013F900000-0x000000013FCF2000-memory.dmp	xmrig
behavioral1/memory/2660-4937-0x000000013F5C0000-0x000000013F9B2000-memory.dmp	xmrig
behavioral1/memory/924-4936-0x000000013FD90000-0x0000000140182000-memory.dmp	xmrig
behavioral1/memory/2440-4935-0x000000013FED0000-0x00000001402C2000-memory.dmp	xmrig
behavioral1/memory/2492-4934-0x000000013F1E0000-0x000000013F5D2000-memory.dmp	xmrig
behavioral1/memory/2436-4933-0x000000013F540000-0x000000013F932000-memory.dmp	xmrig
behavioral1/memory/2596-4932-0x000000013F440000-0x000000013F832000-memory.dmp	xmrig
behavioral1/memory/1704-5845-0x000000013F030000-0x000000013F422000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
2008	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
2176	TXOgtuz.exe
2580	VdmueaH.exe
2616	gUmyAdZ.exe
2440	fTRTNGx.exe
2596	zqjrcrk.exe
2468	sjHxMPL.exe
924	iotvtha.exe
2436	lUixwEx.exe
2660	ZEBfmJp.exe
2492	pOcMMeT.exe
2504	nrCbBry.exe
1596	peUrfts.exe
2828	uQPAHGc.exe
2960	zLpWdDK.exe
2976	zSZdPgZ.exe
2772	nxYFSxj.exe
784	TjJXcKQ.exe
2696	WzUxwTr.exe
2988	dBliajx.exe
2780	kVXnGEw.exe
2672	dflaYFH.exe
1828	pzuTiwt.exe
1680	ikuPoWd.exe
888	xtXNhqs.exe
2020	KvmYraF.exe
2752	ZXpOERk.exe
1592	PAHSxHT.exe
2320	KOanhvE.exe
836	CzVjZnv.exe
1200	uAuGEAN.exe
1648	zHiEekn.exe
1652	MUQujQN.exe
1548	BwegQzk.exe
1940	PssvPTf.exe
1944	EWRcFtL.exe
2808	inCYsMB.exe
1992	xvJZlZS.exe
1960	eTkqSxI.exe
3044	BiceChA.exe
2860	PZIaOqs.exe
912	ILgMAKK.exe
1952	kozwnqQ.exe
1604	LTeUEXz.exe
2012	UDhTLvQ.exe
2652	qnMQdTV.exe
2732	SUSxLii.exe
2232	GQhYsIe.exe
716	UPCprJu.exe
2824	wdJHFaF.exe
2432	nxhaHxH.exe
2604	SzoJMfY.exe
2936	gjYrlDK.exe
2420	YBPJBbq.exe
2684	MMXYRbs.exe
2876	IcobfIL.exe
612	kuTdhtR.exe
684	qcIhiTI.exe
1392	FACNGPL.exe
2160	XVMNbvL.exe
1220	CprcWtN.exe
1312	nNcvqfs.exe
780	umeGCaU.exe
2932	lUWZYHL.exe
1508	bhNGeis.exe

Loads dropped DLL 64 IoCs

pid	Process
1704	81a48b0e5b7a88d9cbf0512312fb2ea7979d35f5e23b99c3348ba7a791f72528_NeikiAnalytics.exe
1704	81a48b0e5b7a88d9cbf0512312fb2ea7979d35f5e23b99c3348ba7a791f72528_NeikiAnalytics.exe
1704	81a48b0e5b7a88d9cbf0512312fb2ea7979d35f5e23b99c3348ba7a791f72528_NeikiAnalytics.exe
1704	81a48b0e5b7a88d9cbf0512312fb2ea7979d35f5e23b99c3348ba7a791f72528_NeikiAnalytics.exe
1704	81a48b0e5b7a88d9cbf0512312fb2ea7979d35f5e23b99c3348ba7a791f72528_NeikiAnalytics.exe
1704	81a48b0e5b7a88d9cbf0512312fb2ea7979d35f5e23b99c3348ba7a791f72528_NeikiAnalytics.exe
1704	81a48b0e5b7a88d9cbf0512312fb2ea7979d35f5e23b99c3348ba7a791f72528_NeikiAnalytics.exe
1704	81a48b0e5b7a88d9cbf0512312fb2ea7979d35f5e23b99c3348ba7a791f72528_NeikiAnalytics.exe
1704	81a48b0e5b7a88d9cbf0512312fb2ea7979d35f5e23b99c3348ba7a791f72528_NeikiAnalytics.exe
1704	81a48b0e5b7a88d9cbf0512312fb2ea7979d35f5e23b99c3348ba7a791f72528_NeikiAnalytics.exe
1704	81a48b0e5b7a88d9cbf0512312fb2ea7979d35f5e23b99c3348ba7a791f72528_NeikiAnalytics.exe
1704	81a48b0e5b7a88d9cbf0512312fb2ea7979d35f5e23b99c3348ba7a791f72528_NeikiAnalytics.exe
1704	81a48b0e5b7a88d9cbf0512312fb2ea7979d35f5e23b99c3348ba7a791f72528_NeikiAnalytics.exe
1704	81a48b0e5b7a88d9cbf0512312fb2ea7979d35f5e23b99c3348ba7a791f72528_NeikiAnalytics.exe
1704	81a48b0e5b7a88d9cbf0512312fb2ea7979d35f5e23b99c3348ba7a791f72528_NeikiAnalytics.exe
1704	81a48b0e5b7a88d9cbf0512312fb2ea7979d35f5e23b99c3348ba7a791f72528_NeikiAnalytics.exe
1704	81a48b0e5b7a88d9cbf0512312fb2ea7979d35f5e23b99c3348ba7a791f72528_NeikiAnalytics.exe
1704	81a48b0e5b7a88d9cbf0512312fb2ea7979d35f5e23b99c3348ba7a791f72528_NeikiAnalytics.exe
1704	81a48b0e5b7a88d9cbf0512312fb2ea7979d35f5e23b99c3348ba7a791f72528_NeikiAnalytics.exe
1704	81a48b0e5b7a88d9cbf0512312fb2ea7979d35f5e23b99c3348ba7a791f72528_NeikiAnalytics.exe
1704	81a48b0e5b7a88d9cbf0512312fb2ea7979d35f5e23b99c3348ba7a791f72528_NeikiAnalytics.exe
1704	81a48b0e5b7a88d9cbf0512312fb2ea7979d35f5e23b99c3348ba7a791f72528_NeikiAnalytics.exe
1704	81a48b0e5b7a88d9cbf0512312fb2ea7979d35f5e23b99c3348ba7a791f72528_NeikiAnalytics.exe
1704	81a48b0e5b7a88d9cbf0512312fb2ea7979d35f5e23b99c3348ba7a791f72528_NeikiAnalytics.exe
1704	81a48b0e5b7a88d9cbf0512312fb2ea7979d35f5e23b99c3348ba7a791f72528_NeikiAnalytics.exe
1704	81a48b0e5b7a88d9cbf0512312fb2ea7979d35f5e23b99c3348ba7a791f72528_NeikiAnalytics.exe
1704	81a48b0e5b7a88d9cbf0512312fb2ea7979d35f5e23b99c3348ba7a791f72528_NeikiAnalytics.exe
1704	81a48b0e5b7a88d9cbf0512312fb2ea7979d35f5e23b99c3348ba7a791f72528_NeikiAnalytics.exe
1704	81a48b0e5b7a88d9cbf0512312fb2ea7979d35f5e23b99c3348ba7a791f72528_NeikiAnalytics.exe
1704	81a48b0e5b7a88d9cbf0512312fb2ea7979d35f5e23b99c3348ba7a791f72528_NeikiAnalytics.exe
1704	81a48b0e5b7a88d9cbf0512312fb2ea7979d35f5e23b99c3348ba7a791f72528_NeikiAnalytics.exe
1704	81a48b0e5b7a88d9cbf0512312fb2ea7979d35f5e23b99c3348ba7a791f72528_NeikiAnalytics.exe
1704	81a48b0e5b7a88d9cbf0512312fb2ea7979d35f5e23b99c3348ba7a791f72528_NeikiAnalytics.exe
1704	81a48b0e5b7a88d9cbf0512312fb2ea7979d35f5e23b99c3348ba7a791f72528_NeikiAnalytics.exe
1704	81a48b0e5b7a88d9cbf0512312fb2ea7979d35f5e23b99c3348ba7a791f72528_NeikiAnalytics.exe
1704	81a48b0e5b7a88d9cbf0512312fb2ea7979d35f5e23b99c3348ba7a791f72528_NeikiAnalytics.exe
1704	81a48b0e5b7a88d9cbf0512312fb2ea7979d35f5e23b99c3348ba7a791f72528_NeikiAnalytics.exe
1704	81a48b0e5b7a88d9cbf0512312fb2ea7979d35f5e23b99c3348ba7a791f72528_NeikiAnalytics.exe
1704	81a48b0e5b7a88d9cbf0512312fb2ea7979d35f5e23b99c3348ba7a791f72528_NeikiAnalytics.exe
1704	81a48b0e5b7a88d9cbf0512312fb2ea7979d35f5e23b99c3348ba7a791f72528_NeikiAnalytics.exe
1704	81a48b0e5b7a88d9cbf0512312fb2ea7979d35f5e23b99c3348ba7a791f72528_NeikiAnalytics.exe
1704	81a48b0e5b7a88d9cbf0512312fb2ea7979d35f5e23b99c3348ba7a791f72528_NeikiAnalytics.exe
1704	81a48b0e5b7a88d9cbf0512312fb2ea7979d35f5e23b99c3348ba7a791f72528_NeikiAnalytics.exe
1704	81a48b0e5b7a88d9cbf0512312fb2ea7979d35f5e23b99c3348ba7a791f72528_NeikiAnalytics.exe
1704	81a48b0e5b7a88d9cbf0512312fb2ea7979d35f5e23b99c3348ba7a791f72528_NeikiAnalytics.exe
1704	81a48b0e5b7a88d9cbf0512312fb2ea7979d35f5e23b99c3348ba7a791f72528_NeikiAnalytics.exe
1704	81a48b0e5b7a88d9cbf0512312fb2ea7979d35f5e23b99c3348ba7a791f72528_NeikiAnalytics.exe
1704	81a48b0e5b7a88d9cbf0512312fb2ea7979d35f5e23b99c3348ba7a791f72528_NeikiAnalytics.exe
1704	81a48b0e5b7a88d9cbf0512312fb2ea7979d35f5e23b99c3348ba7a791f72528_NeikiAnalytics.exe
1704	81a48b0e5b7a88d9cbf0512312fb2ea7979d35f5e23b99c3348ba7a791f72528_NeikiAnalytics.exe
1704	81a48b0e5b7a88d9cbf0512312fb2ea7979d35f5e23b99c3348ba7a791f72528_NeikiAnalytics.exe
1704	81a48b0e5b7a88d9cbf0512312fb2ea7979d35f5e23b99c3348ba7a791f72528_NeikiAnalytics.exe
1704	81a48b0e5b7a88d9cbf0512312fb2ea7979d35f5e23b99c3348ba7a791f72528_NeikiAnalytics.exe
1704	81a48b0e5b7a88d9cbf0512312fb2ea7979d35f5e23b99c3348ba7a791f72528_NeikiAnalytics.exe
1704	81a48b0e5b7a88d9cbf0512312fb2ea7979d35f5e23b99c3348ba7a791f72528_NeikiAnalytics.exe
1704	81a48b0e5b7a88d9cbf0512312fb2ea7979d35f5e23b99c3348ba7a791f72528_NeikiAnalytics.exe
1704	81a48b0e5b7a88d9cbf0512312fb2ea7979d35f5e23b99c3348ba7a791f72528_NeikiAnalytics.exe
1704	81a48b0e5b7a88d9cbf0512312fb2ea7979d35f5e23b99c3348ba7a791f72528_NeikiAnalytics.exe
1704	81a48b0e5b7a88d9cbf0512312fb2ea7979d35f5e23b99c3348ba7a791f72528_NeikiAnalytics.exe
1704	81a48b0e5b7a88d9cbf0512312fb2ea7979d35f5e23b99c3348ba7a791f72528_NeikiAnalytics.exe
1704	81a48b0e5b7a88d9cbf0512312fb2ea7979d35f5e23b99c3348ba7a791f72528_NeikiAnalytics.exe
1704	81a48b0e5b7a88d9cbf0512312fb2ea7979d35f5e23b99c3348ba7a791f72528_NeikiAnalytics.exe
1704	81a48b0e5b7a88d9cbf0512312fb2ea7979d35f5e23b99c3348ba7a791f72528_NeikiAnalytics.exe
1704	81a48b0e5b7a88d9cbf0512312fb2ea7979d35f5e23b99c3348ba7a791f72528_NeikiAnalytics.exe

UPX packed file 53 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1704-0-0x000000013F030000-0x000000013F422000-memory.dmp	upx
behavioral1/files/0x000d000000012342-6.dat	upx
behavioral1/files/0x0008000000014e51-14.dat	upx
behavioral1/files/0x0034000000014aa2-7.dat	upx
behavioral1/files/0x0007000000015659-44.dat	upx
behavioral1/files/0x0006000000015d67-51.dat	upx
behavioral1/files/0x0006000000015d6f-70.dat	upx
behavioral1/files/0x0006000000015d9b-76.dat	upx
behavioral1/files/0x0006000000015eaf-117.dat	upx
behavioral1/files/0x0006000000016c63-153.dat	upx
behavioral1/files/0x0006000000016cb7-167.dat	upx
behavioral1/files/0x0006000000016ce4-170.dat	upx
behavioral1/memory/2504-191-0x000000013F2A0000-0x000000013F692000-memory.dmp	upx
behavioral1/memory/2492-188-0x000000013F1E0000-0x000000013F5D2000-memory.dmp	upx
behavioral1/memory/2660-186-0x000000013F5C0000-0x000000013F9B2000-memory.dmp	upx
behavioral1/memory/2436-184-0x000000013F540000-0x000000013F932000-memory.dmp	upx
behavioral1/memory/924-181-0x000000013FD90000-0x0000000140182000-memory.dmp	upx
behavioral1/memory/2468-179-0x000000013F900000-0x000000013FCF2000-memory.dmp	upx
behavioral1/memory/2596-177-0x000000013F440000-0x000000013F832000-memory.dmp	upx
behavioral1/memory/2440-175-0x000000013FED0000-0x00000001402C2000-memory.dmp	upx
behavioral1/files/0x0034000000014b27-162.dat	upx
behavioral1/files/0x0006000000016c6b-158.dat	upx
behavioral1/files/0x0006000000016a9a-151.dat	upx
behavioral1/files/0x000600000001661c-149.dat	upx
behavioral1/files/0x00060000000164b2-147.dat	upx
behavioral1/files/0x00060000000161e7-145.dat	upx
behavioral1/files/0x0006000000016843-132.dat	upx
behavioral1/files/0x0006000000015fe9-127.dat	upx
behavioral1/files/0x0006000000015d87-89.dat	upx
behavioral1/files/0x0006000000016c4a-137.dat	upx
behavioral1/files/0x000900000001566b-60.dat	upx
behavioral1/files/0x0006000000016572-120.dat	upx
behavioral1/files/0x000600000001630b-110.dat	upx
behavioral1/files/0x0006000000016117-102.dat	upx
behavioral1/files/0x0006000000015f6d-92.dat	upx
behavioral1/files/0x0006000000015e3a-81.dat	upx
behavioral1/files/0x0008000000015653-42.dat	upx
behavioral1/files/0x0006000000015d8f-75.dat	upx
behavioral1/files/0x0006000000015d79-64.dat	upx
behavioral1/files/0x0007000000014f71-33.dat	upx
behavioral1/files/0x0007000000004e76-37.dat	upx
behavioral1/memory/2616-26-0x000000013F700000-0x000000013FAF2000-memory.dmp	upx
behavioral1/memory/2580-25-0x000000013FB50000-0x000000013FF42000-memory.dmp	upx
behavioral1/memory/2176-22-0x000000013FC50000-0x0000000140042000-memory.dmp	upx
behavioral1/memory/2580-4921-0x000000013FB50000-0x000000013FF42000-memory.dmp	upx
behavioral1/memory/2468-4931-0x000000013F900000-0x000000013FCF2000-memory.dmp	upx
behavioral1/memory/2660-4937-0x000000013F5C0000-0x000000013F9B2000-memory.dmp	upx
behavioral1/memory/924-4936-0x000000013FD90000-0x0000000140182000-memory.dmp	upx
behavioral1/memory/2440-4935-0x000000013FED0000-0x00000001402C2000-memory.dmp	upx
behavioral1/memory/2492-4934-0x000000013F1E0000-0x000000013F5D2000-memory.dmp	upx
behavioral1/memory/2436-4933-0x000000013F540000-0x000000013F932000-memory.dmp	upx
behavioral1/memory/2596-4932-0x000000013F440000-0x000000013F832000-memory.dmp	upx
behavioral1/memory/1704-5845-0x000000013F030000-0x000000013F422000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\BJQYolF.exe	81a48b0e5b7a88d9cbf0512312fb2ea7979d35f5e23b99c3348ba7a791f72528_NeikiAnalytics.exe
File created	C:\Windows\System\PKVflkY.exe	81a48b0e5b7a88d9cbf0512312fb2ea7979d35f5e23b99c3348ba7a791f72528_NeikiAnalytics.exe
File created	C:\Windows\System\KTtWXKz.exe	81a48b0e5b7a88d9cbf0512312fb2ea7979d35f5e23b99c3348ba7a791f72528_NeikiAnalytics.exe
File created	C:\Windows\System\VudjKqk.exe	81a48b0e5b7a88d9cbf0512312fb2ea7979d35f5e23b99c3348ba7a791f72528_NeikiAnalytics.exe
File created	C:\Windows\System\YdwMnGC.exe	81a48b0e5b7a88d9cbf0512312fb2ea7979d35f5e23b99c3348ba7a791f72528_NeikiAnalytics.exe
File created	C:\Windows\System\EpjtFMt.exe	81a48b0e5b7a88d9cbf0512312fb2ea7979d35f5e23b99c3348ba7a791f72528_NeikiAnalytics.exe
File created	C:\Windows\System\LRbHxlk.exe	81a48b0e5b7a88d9cbf0512312fb2ea7979d35f5e23b99c3348ba7a791f72528_NeikiAnalytics.exe
File created	C:\Windows\System\yOSgMdl.exe	81a48b0e5b7a88d9cbf0512312fb2ea7979d35f5e23b99c3348ba7a791f72528_NeikiAnalytics.exe
File created	C:\Windows\System\oNVgHyK.exe	81a48b0e5b7a88d9cbf0512312fb2ea7979d35f5e23b99c3348ba7a791f72528_NeikiAnalytics.exe
File created	C:\Windows\System\SOwddPq.exe	81a48b0e5b7a88d9cbf0512312fb2ea7979d35f5e23b99c3348ba7a791f72528_NeikiAnalytics.exe
File created	C:\Windows\System\coZeyqa.exe	81a48b0e5b7a88d9cbf0512312fb2ea7979d35f5e23b99c3348ba7a791f72528_NeikiAnalytics.exe
File created	C:\Windows\System\HYYLQHD.exe	81a48b0e5b7a88d9cbf0512312fb2ea7979d35f5e23b99c3348ba7a791f72528_NeikiAnalytics.exe
File created	C:\Windows\System\RVjAwMq.exe	81a48b0e5b7a88d9cbf0512312fb2ea7979d35f5e23b99c3348ba7a791f72528_NeikiAnalytics.exe
File created	C:\Windows\System\TeZdUkF.exe	81a48b0e5b7a88d9cbf0512312fb2ea7979d35f5e23b99c3348ba7a791f72528_NeikiAnalytics.exe
File created	C:\Windows\System\DVNHsbs.exe	81a48b0e5b7a88d9cbf0512312fb2ea7979d35f5e23b99c3348ba7a791f72528_NeikiAnalytics.exe
File created	C:\Windows\System\lYMRsHo.exe	81a48b0e5b7a88d9cbf0512312fb2ea7979d35f5e23b99c3348ba7a791f72528_NeikiAnalytics.exe
File created	C:\Windows\System\iPUObvG.exe	81a48b0e5b7a88d9cbf0512312fb2ea7979d35f5e23b99c3348ba7a791f72528_NeikiAnalytics.exe
File created	C:\Windows\System\oAsgdVf.exe	81a48b0e5b7a88d9cbf0512312fb2ea7979d35f5e23b99c3348ba7a791f72528_NeikiAnalytics.exe
File created	C:\Windows\System\JVgjAgl.exe	81a48b0e5b7a88d9cbf0512312fb2ea7979d35f5e23b99c3348ba7a791f72528_NeikiAnalytics.exe
File created	C:\Windows\System\OpkHzUZ.exe	81a48b0e5b7a88d9cbf0512312fb2ea7979d35f5e23b99c3348ba7a791f72528_NeikiAnalytics.exe
File created	C:\Windows\System\mCIqpQb.exe	81a48b0e5b7a88d9cbf0512312fb2ea7979d35f5e23b99c3348ba7a791f72528_NeikiAnalytics.exe
File created	C:\Windows\System\rRFzicC.exe	81a48b0e5b7a88d9cbf0512312fb2ea7979d35f5e23b99c3348ba7a791f72528_NeikiAnalytics.exe
File created	C:\Windows\System\htBQfla.exe	81a48b0e5b7a88d9cbf0512312fb2ea7979d35f5e23b99c3348ba7a791f72528_NeikiAnalytics.exe
File created	C:\Windows\System\TIIVifT.exe	81a48b0e5b7a88d9cbf0512312fb2ea7979d35f5e23b99c3348ba7a791f72528_NeikiAnalytics.exe
File created	C:\Windows\System\eQjfABf.exe	81a48b0e5b7a88d9cbf0512312fb2ea7979d35f5e23b99c3348ba7a791f72528_NeikiAnalytics.exe
File created	C:\Windows\System\jNwpsEt.exe	81a48b0e5b7a88d9cbf0512312fb2ea7979d35f5e23b99c3348ba7a791f72528_NeikiAnalytics.exe
File created	C:\Windows\System\pYqhbmt.exe	81a48b0e5b7a88d9cbf0512312fb2ea7979d35f5e23b99c3348ba7a791f72528_NeikiAnalytics.exe
File created	C:\Windows\System\YuTqwYe.exe	81a48b0e5b7a88d9cbf0512312fb2ea7979d35f5e23b99c3348ba7a791f72528_NeikiAnalytics.exe
File created	C:\Windows\System\MBZoRBh.exe	81a48b0e5b7a88d9cbf0512312fb2ea7979d35f5e23b99c3348ba7a791f72528_NeikiAnalytics.exe
File created	C:\Windows\System\dflaYFH.exe	81a48b0e5b7a88d9cbf0512312fb2ea7979d35f5e23b99c3348ba7a791f72528_NeikiAnalytics.exe
File created	C:\Windows\System\eotLfLK.exe	81a48b0e5b7a88d9cbf0512312fb2ea7979d35f5e23b99c3348ba7a791f72528_NeikiAnalytics.exe
File created	C:\Windows\System\srmCqul.exe	81a48b0e5b7a88d9cbf0512312fb2ea7979d35f5e23b99c3348ba7a791f72528_NeikiAnalytics.exe
File created	C:\Windows\System\MRJejWv.exe	81a48b0e5b7a88d9cbf0512312fb2ea7979d35f5e23b99c3348ba7a791f72528_NeikiAnalytics.exe
File created	C:\Windows\System\HenXMBA.exe	81a48b0e5b7a88d9cbf0512312fb2ea7979d35f5e23b99c3348ba7a791f72528_NeikiAnalytics.exe
File created	C:\Windows\System\JtBBhHc.exe	81a48b0e5b7a88d9cbf0512312fb2ea7979d35f5e23b99c3348ba7a791f72528_NeikiAnalytics.exe
File created	C:\Windows\System\yXcjgzi.exe	81a48b0e5b7a88d9cbf0512312fb2ea7979d35f5e23b99c3348ba7a791f72528_NeikiAnalytics.exe
File created	C:\Windows\System\PkxRtez.exe	81a48b0e5b7a88d9cbf0512312fb2ea7979d35f5e23b99c3348ba7a791f72528_NeikiAnalytics.exe
File created	C:\Windows\System\RYHGQfD.exe	81a48b0e5b7a88d9cbf0512312fb2ea7979d35f5e23b99c3348ba7a791f72528_NeikiAnalytics.exe
File created	C:\Windows\System\BAXMAdN.exe	81a48b0e5b7a88d9cbf0512312fb2ea7979d35f5e23b99c3348ba7a791f72528_NeikiAnalytics.exe
File created	C:\Windows\System\rqJmmRJ.exe	81a48b0e5b7a88d9cbf0512312fb2ea7979d35f5e23b99c3348ba7a791f72528_NeikiAnalytics.exe
File created	C:\Windows\System\aGqsotk.exe	81a48b0e5b7a88d9cbf0512312fb2ea7979d35f5e23b99c3348ba7a791f72528_NeikiAnalytics.exe
File created	C:\Windows\System\CEmzoRK.exe	81a48b0e5b7a88d9cbf0512312fb2ea7979d35f5e23b99c3348ba7a791f72528_NeikiAnalytics.exe
File created	C:\Windows\System\oHdixAD.exe	81a48b0e5b7a88d9cbf0512312fb2ea7979d35f5e23b99c3348ba7a791f72528_NeikiAnalytics.exe
File created	C:\Windows\System\UzMAHsA.exe	81a48b0e5b7a88d9cbf0512312fb2ea7979d35f5e23b99c3348ba7a791f72528_NeikiAnalytics.exe
File created	C:\Windows\System\CwoUITu.exe	81a48b0e5b7a88d9cbf0512312fb2ea7979d35f5e23b99c3348ba7a791f72528_NeikiAnalytics.exe
File created	C:\Windows\System\pARyESv.exe	81a48b0e5b7a88d9cbf0512312fb2ea7979d35f5e23b99c3348ba7a791f72528_NeikiAnalytics.exe
File created	C:\Windows\System\ElDcyDU.exe	81a48b0e5b7a88d9cbf0512312fb2ea7979d35f5e23b99c3348ba7a791f72528_NeikiAnalytics.exe
File created	C:\Windows\System\UImxhlQ.exe	81a48b0e5b7a88d9cbf0512312fb2ea7979d35f5e23b99c3348ba7a791f72528_NeikiAnalytics.exe
File created	C:\Windows\System\Okgizbs.exe	81a48b0e5b7a88d9cbf0512312fb2ea7979d35f5e23b99c3348ba7a791f72528_NeikiAnalytics.exe
File created	C:\Windows\System\fgkTaIb.exe	81a48b0e5b7a88d9cbf0512312fb2ea7979d35f5e23b99c3348ba7a791f72528_NeikiAnalytics.exe
File created	C:\Windows\System\GTLQKyz.exe	81a48b0e5b7a88d9cbf0512312fb2ea7979d35f5e23b99c3348ba7a791f72528_NeikiAnalytics.exe
File created	C:\Windows\System\OkNWmVi.exe	81a48b0e5b7a88d9cbf0512312fb2ea7979d35f5e23b99c3348ba7a791f72528_NeikiAnalytics.exe
File created	C:\Windows\System\HZaDiWA.exe	81a48b0e5b7a88d9cbf0512312fb2ea7979d35f5e23b99c3348ba7a791f72528_NeikiAnalytics.exe
File created	C:\Windows\System\rsQDDut.exe	81a48b0e5b7a88d9cbf0512312fb2ea7979d35f5e23b99c3348ba7a791f72528_NeikiAnalytics.exe
File created	C:\Windows\System\IgRmoNf.exe	81a48b0e5b7a88d9cbf0512312fb2ea7979d35f5e23b99c3348ba7a791f72528_NeikiAnalytics.exe
File created	C:\Windows\System\viXdpLs.exe	81a48b0e5b7a88d9cbf0512312fb2ea7979d35f5e23b99c3348ba7a791f72528_NeikiAnalytics.exe
File created	C:\Windows\System\IYIjwea.exe	81a48b0e5b7a88d9cbf0512312fb2ea7979d35f5e23b99c3348ba7a791f72528_NeikiAnalytics.exe
File created	C:\Windows\System\XQjqXOO.exe	81a48b0e5b7a88d9cbf0512312fb2ea7979d35f5e23b99c3348ba7a791f72528_NeikiAnalytics.exe
File created	C:\Windows\System\DgIHLdi.exe	81a48b0e5b7a88d9cbf0512312fb2ea7979d35f5e23b99c3348ba7a791f72528_NeikiAnalytics.exe
File created	C:\Windows\System\gJrcGIS.exe	81a48b0e5b7a88d9cbf0512312fb2ea7979d35f5e23b99c3348ba7a791f72528_NeikiAnalytics.exe
File created	C:\Windows\System\TtJIpLJ.exe	81a48b0e5b7a88d9cbf0512312fb2ea7979d35f5e23b99c3348ba7a791f72528_NeikiAnalytics.exe
File created	C:\Windows\System\UNnrbFV.exe	81a48b0e5b7a88d9cbf0512312fb2ea7979d35f5e23b99c3348ba7a791f72528_NeikiAnalytics.exe
File created	C:\Windows\System\Sqwfaop.exe	81a48b0e5b7a88d9cbf0512312fb2ea7979d35f5e23b99c3348ba7a791f72528_NeikiAnalytics.exe
File created	C:\Windows\System\eLPPHvO.exe	81a48b0e5b7a88d9cbf0512312fb2ea7979d35f5e23b99c3348ba7a791f72528_NeikiAnalytics.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2008	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	1704	81a48b0e5b7a88d9cbf0512312fb2ea7979d35f5e23b99c3348ba7a791f72528_NeikiAnalytics.exe
Token: SeLockMemoryPrivilege	1704	81a48b0e5b7a88d9cbf0512312fb2ea7979d35f5e23b99c3348ba7a791f72528_NeikiAnalytics.exe
Token: SeDebugPrivilege	2008	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1704 wrote to memory of 2008	1704	81a48b0e5b7a88d9cbf0512312fb2ea7979d35f5e23b99c3348ba7a791f72528_NeikiAnalytics.exe	29
PID 1704 wrote to memory of 2008	1704	81a48b0e5b7a88d9cbf0512312fb2ea7979d35f5e23b99c3348ba7a791f72528_NeikiAnalytics.exe	29
PID 1704 wrote to memory of 2008	1704	81a48b0e5b7a88d9cbf0512312fb2ea7979d35f5e23b99c3348ba7a791f72528_NeikiAnalytics.exe	29
PID 1704 wrote to memory of 2176	1704	81a48b0e5b7a88d9cbf0512312fb2ea7979d35f5e23b99c3348ba7a791f72528_NeikiAnalytics.exe	30
PID 1704 wrote to memory of 2176	1704	81a48b0e5b7a88d9cbf0512312fb2ea7979d35f5e23b99c3348ba7a791f72528_NeikiAnalytics.exe	30
PID 1704 wrote to memory of 2176	1704	81a48b0e5b7a88d9cbf0512312fb2ea7979d35f5e23b99c3348ba7a791f72528_NeikiAnalytics.exe	30
PID 1704 wrote to memory of 2616	1704	81a48b0e5b7a88d9cbf0512312fb2ea7979d35f5e23b99c3348ba7a791f72528_NeikiAnalytics.exe	31
PID 1704 wrote to memory of 2616	1704	81a48b0e5b7a88d9cbf0512312fb2ea7979d35f5e23b99c3348ba7a791f72528_NeikiAnalytics.exe	31
PID 1704 wrote to memory of 2616	1704	81a48b0e5b7a88d9cbf0512312fb2ea7979d35f5e23b99c3348ba7a791f72528_NeikiAnalytics.exe	31
PID 1704 wrote to memory of 2580	1704	81a48b0e5b7a88d9cbf0512312fb2ea7979d35f5e23b99c3348ba7a791f72528_NeikiAnalytics.exe	32
PID 1704 wrote to memory of 2580	1704	81a48b0e5b7a88d9cbf0512312fb2ea7979d35f5e23b99c3348ba7a791f72528_NeikiAnalytics.exe	32
PID 1704 wrote to memory of 2580	1704	81a48b0e5b7a88d9cbf0512312fb2ea7979d35f5e23b99c3348ba7a791f72528_NeikiAnalytics.exe	32
PID 1704 wrote to memory of 2440	1704	81a48b0e5b7a88d9cbf0512312fb2ea7979d35f5e23b99c3348ba7a791f72528_NeikiAnalytics.exe	33
PID 1704 wrote to memory of 2440	1704	81a48b0e5b7a88d9cbf0512312fb2ea7979d35f5e23b99c3348ba7a791f72528_NeikiAnalytics.exe	33
PID 1704 wrote to memory of 2440	1704	81a48b0e5b7a88d9cbf0512312fb2ea7979d35f5e23b99c3348ba7a791f72528_NeikiAnalytics.exe	33
PID 1704 wrote to memory of 2596	1704	81a48b0e5b7a88d9cbf0512312fb2ea7979d35f5e23b99c3348ba7a791f72528_NeikiAnalytics.exe	34
PID 1704 wrote to memory of 2596	1704	81a48b0e5b7a88d9cbf0512312fb2ea7979d35f5e23b99c3348ba7a791f72528_NeikiAnalytics.exe	34
PID 1704 wrote to memory of 2596	1704	81a48b0e5b7a88d9cbf0512312fb2ea7979d35f5e23b99c3348ba7a791f72528_NeikiAnalytics.exe	34
PID 1704 wrote to memory of 2468	1704	81a48b0e5b7a88d9cbf0512312fb2ea7979d35f5e23b99c3348ba7a791f72528_NeikiAnalytics.exe	35
PID 1704 wrote to memory of 2468	1704	81a48b0e5b7a88d9cbf0512312fb2ea7979d35f5e23b99c3348ba7a791f72528_NeikiAnalytics.exe	35
PID 1704 wrote to memory of 2468	1704	81a48b0e5b7a88d9cbf0512312fb2ea7979d35f5e23b99c3348ba7a791f72528_NeikiAnalytics.exe	35
PID 1704 wrote to memory of 924	1704	81a48b0e5b7a88d9cbf0512312fb2ea7979d35f5e23b99c3348ba7a791f72528_NeikiAnalytics.exe	36
PID 1704 wrote to memory of 924	1704	81a48b0e5b7a88d9cbf0512312fb2ea7979d35f5e23b99c3348ba7a791f72528_NeikiAnalytics.exe	36
PID 1704 wrote to memory of 924	1704	81a48b0e5b7a88d9cbf0512312fb2ea7979d35f5e23b99c3348ba7a791f72528_NeikiAnalytics.exe	36
PID 1704 wrote to memory of 2660	1704	81a48b0e5b7a88d9cbf0512312fb2ea7979d35f5e23b99c3348ba7a791f72528_NeikiAnalytics.exe	37
PID 1704 wrote to memory of 2660	1704	81a48b0e5b7a88d9cbf0512312fb2ea7979d35f5e23b99c3348ba7a791f72528_NeikiAnalytics.exe	37
PID 1704 wrote to memory of 2660	1704	81a48b0e5b7a88d9cbf0512312fb2ea7979d35f5e23b99c3348ba7a791f72528_NeikiAnalytics.exe	37
PID 1704 wrote to memory of 2436	1704	81a48b0e5b7a88d9cbf0512312fb2ea7979d35f5e23b99c3348ba7a791f72528_NeikiAnalytics.exe	38
PID 1704 wrote to memory of 2436	1704	81a48b0e5b7a88d9cbf0512312fb2ea7979d35f5e23b99c3348ba7a791f72528_NeikiAnalytics.exe	38
PID 1704 wrote to memory of 2436	1704	81a48b0e5b7a88d9cbf0512312fb2ea7979d35f5e23b99c3348ba7a791f72528_NeikiAnalytics.exe	38
PID 1704 wrote to memory of 2504	1704	81a48b0e5b7a88d9cbf0512312fb2ea7979d35f5e23b99c3348ba7a791f72528_NeikiAnalytics.exe	39
PID 1704 wrote to memory of 2504	1704	81a48b0e5b7a88d9cbf0512312fb2ea7979d35f5e23b99c3348ba7a791f72528_NeikiAnalytics.exe	39
PID 1704 wrote to memory of 2504	1704	81a48b0e5b7a88d9cbf0512312fb2ea7979d35f5e23b99c3348ba7a791f72528_NeikiAnalytics.exe	39
PID 1704 wrote to memory of 2492	1704	81a48b0e5b7a88d9cbf0512312fb2ea7979d35f5e23b99c3348ba7a791f72528_NeikiAnalytics.exe	40
PID 1704 wrote to memory of 2492	1704	81a48b0e5b7a88d9cbf0512312fb2ea7979d35f5e23b99c3348ba7a791f72528_NeikiAnalytics.exe	40
PID 1704 wrote to memory of 2492	1704	81a48b0e5b7a88d9cbf0512312fb2ea7979d35f5e23b99c3348ba7a791f72528_NeikiAnalytics.exe	40
PID 1704 wrote to memory of 2960	1704	81a48b0e5b7a88d9cbf0512312fb2ea7979d35f5e23b99c3348ba7a791f72528_NeikiAnalytics.exe	41
PID 1704 wrote to memory of 2960	1704	81a48b0e5b7a88d9cbf0512312fb2ea7979d35f5e23b99c3348ba7a791f72528_NeikiAnalytics.exe	41
PID 1704 wrote to memory of 2960	1704	81a48b0e5b7a88d9cbf0512312fb2ea7979d35f5e23b99c3348ba7a791f72528_NeikiAnalytics.exe	41
PID 1704 wrote to memory of 1596	1704	81a48b0e5b7a88d9cbf0512312fb2ea7979d35f5e23b99c3348ba7a791f72528_NeikiAnalytics.exe	42
PID 1704 wrote to memory of 1596	1704	81a48b0e5b7a88d9cbf0512312fb2ea7979d35f5e23b99c3348ba7a791f72528_NeikiAnalytics.exe	42
PID 1704 wrote to memory of 1596	1704	81a48b0e5b7a88d9cbf0512312fb2ea7979d35f5e23b99c3348ba7a791f72528_NeikiAnalytics.exe	42
PID 1704 wrote to memory of 2772	1704	81a48b0e5b7a88d9cbf0512312fb2ea7979d35f5e23b99c3348ba7a791f72528_NeikiAnalytics.exe	43
PID 1704 wrote to memory of 2772	1704	81a48b0e5b7a88d9cbf0512312fb2ea7979d35f5e23b99c3348ba7a791f72528_NeikiAnalytics.exe	43
PID 1704 wrote to memory of 2772	1704	81a48b0e5b7a88d9cbf0512312fb2ea7979d35f5e23b99c3348ba7a791f72528_NeikiAnalytics.exe	43
PID 1704 wrote to memory of 2828	1704	81a48b0e5b7a88d9cbf0512312fb2ea7979d35f5e23b99c3348ba7a791f72528_NeikiAnalytics.exe	44
PID 1704 wrote to memory of 2828	1704	81a48b0e5b7a88d9cbf0512312fb2ea7979d35f5e23b99c3348ba7a791f72528_NeikiAnalytics.exe	44
PID 1704 wrote to memory of 2828	1704	81a48b0e5b7a88d9cbf0512312fb2ea7979d35f5e23b99c3348ba7a791f72528_NeikiAnalytics.exe	44
PID 1704 wrote to memory of 2988	1704	81a48b0e5b7a88d9cbf0512312fb2ea7979d35f5e23b99c3348ba7a791f72528_NeikiAnalytics.exe	45
PID 1704 wrote to memory of 2988	1704	81a48b0e5b7a88d9cbf0512312fb2ea7979d35f5e23b99c3348ba7a791f72528_NeikiAnalytics.exe	45
PID 1704 wrote to memory of 2988	1704	81a48b0e5b7a88d9cbf0512312fb2ea7979d35f5e23b99c3348ba7a791f72528_NeikiAnalytics.exe	45
PID 1704 wrote to memory of 2976	1704	81a48b0e5b7a88d9cbf0512312fb2ea7979d35f5e23b99c3348ba7a791f72528_NeikiAnalytics.exe	46
PID 1704 wrote to memory of 2976	1704	81a48b0e5b7a88d9cbf0512312fb2ea7979d35f5e23b99c3348ba7a791f72528_NeikiAnalytics.exe	46
PID 1704 wrote to memory of 2976	1704	81a48b0e5b7a88d9cbf0512312fb2ea7979d35f5e23b99c3348ba7a791f72528_NeikiAnalytics.exe	46
PID 1704 wrote to memory of 2672	1704	81a48b0e5b7a88d9cbf0512312fb2ea7979d35f5e23b99c3348ba7a791f72528_NeikiAnalytics.exe	47
PID 1704 wrote to memory of 2672	1704	81a48b0e5b7a88d9cbf0512312fb2ea7979d35f5e23b99c3348ba7a791f72528_NeikiAnalytics.exe	47
PID 1704 wrote to memory of 2672	1704	81a48b0e5b7a88d9cbf0512312fb2ea7979d35f5e23b99c3348ba7a791f72528_NeikiAnalytics.exe	47
PID 1704 wrote to memory of 784	1704	81a48b0e5b7a88d9cbf0512312fb2ea7979d35f5e23b99c3348ba7a791f72528_NeikiAnalytics.exe	48
PID 1704 wrote to memory of 784	1704	81a48b0e5b7a88d9cbf0512312fb2ea7979d35f5e23b99c3348ba7a791f72528_NeikiAnalytics.exe	48
PID 1704 wrote to memory of 784	1704	81a48b0e5b7a88d9cbf0512312fb2ea7979d35f5e23b99c3348ba7a791f72528_NeikiAnalytics.exe	48
PID 1704 wrote to memory of 888	1704	81a48b0e5b7a88d9cbf0512312fb2ea7979d35f5e23b99c3348ba7a791f72528_NeikiAnalytics.exe	49
PID 1704 wrote to memory of 888	1704	81a48b0e5b7a88d9cbf0512312fb2ea7979d35f5e23b99c3348ba7a791f72528_NeikiAnalytics.exe	49
PID 1704 wrote to memory of 888	1704	81a48b0e5b7a88d9cbf0512312fb2ea7979d35f5e23b99c3348ba7a791f72528_NeikiAnalytics.exe	49
PID 1704 wrote to memory of 2696	1704	81a48b0e5b7a88d9cbf0512312fb2ea7979d35f5e23b99c3348ba7a791f72528_NeikiAnalytics.exe	50

C:\Users\Admin\AppData\Local\Temp\81a48b0e5b7a88d9cbf0512312fb2ea7979d35f5e23b99c3348ba7a791f72528_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\81a48b0e5b7a88d9cbf0512312fb2ea7979d35f5e23b99c3348ba7a791f72528_NeikiAnalytics.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1704
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2008
- C:\Windows\System\TXOgtuz.exe
  C:\Windows\System\TXOgtuz.exe
  2⤵
  - Executes dropped EXE
  PID:2176
- C:\Windows\System\gUmyAdZ.exe
  C:\Windows\System\gUmyAdZ.exe
  2⤵
  - Executes dropped EXE
  PID:2616
- C:\Windows\System\VdmueaH.exe
  C:\Windows\System\VdmueaH.exe
  2⤵
  - Executes dropped EXE
  PID:2580
- C:\Windows\System\fTRTNGx.exe
  C:\Windows\System\fTRTNGx.exe
  2⤵
  - Executes dropped EXE
  PID:2440
- C:\Windows\System\zqjrcrk.exe
  C:\Windows\System\zqjrcrk.exe
  2⤵
  - Executes dropped EXE
  PID:2596
- C:\Windows\System\sjHxMPL.exe
  C:\Windows\System\sjHxMPL.exe
  2⤵
  - Executes dropped EXE
  PID:2468
- C:\Windows\System\iotvtha.exe
  C:\Windows\System\iotvtha.exe
  2⤵
  - Executes dropped EXE
  PID:924
- C:\Windows\System\ZEBfmJp.exe
  C:\Windows\System\ZEBfmJp.exe
  2⤵
  - Executes dropped EXE
  PID:2660
- C:\Windows\System\lUixwEx.exe
  C:\Windows\System\lUixwEx.exe
  2⤵
  - Executes dropped EXE
  PID:2436
- C:\Windows\System\nrCbBry.exe
  C:\Windows\System\nrCbBry.exe
  2⤵
  - Executes dropped EXE
  PID:2504
- C:\Windows\System\pOcMMeT.exe
  C:\Windows\System\pOcMMeT.exe
  2⤵
  - Executes dropped EXE
  PID:2492
- C:\Windows\System\zLpWdDK.exe
  C:\Windows\System\zLpWdDK.exe
  2⤵
  - Executes dropped EXE
  PID:2960
- C:\Windows\System\peUrfts.exe
  C:\Windows\System\peUrfts.exe
  2⤵
  - Executes dropped EXE
  PID:1596
- C:\Windows\System\nxYFSxj.exe
  C:\Windows\System\nxYFSxj.exe
  2⤵
  - Executes dropped EXE
  PID:2772
- C:\Windows\System\uQPAHGc.exe
  C:\Windows\System\uQPAHGc.exe
  2⤵
  - Executes dropped EXE
  PID:2828
- C:\Windows\System\dBliajx.exe
  C:\Windows\System\dBliajx.exe
  2⤵
  - Executes dropped EXE
  PID:2988
- C:\Windows\System\zSZdPgZ.exe
  C:\Windows\System\zSZdPgZ.exe
  2⤵
  - Executes dropped EXE
  PID:2976
- C:\Windows\System\dflaYFH.exe
  C:\Windows\System\dflaYFH.exe
  2⤵
  - Executes dropped EXE
  PID:2672
- C:\Windows\System\TjJXcKQ.exe
  C:\Windows\System\TjJXcKQ.exe
  2⤵
  - Executes dropped EXE
  PID:784
- C:\Windows\System\xtXNhqs.exe
  C:\Windows\System\xtXNhqs.exe
  2⤵
  - Executes dropped EXE
  PID:888
- C:\Windows\System\WzUxwTr.exe
  C:\Windows\System\WzUxwTr.exe
  2⤵
  - Executes dropped EXE
  PID:2696
- C:\Windows\System\KvmYraF.exe
  C:\Windows\System\KvmYraF.exe
  2⤵
  - Executes dropped EXE
  PID:2020
- C:\Windows\System\kVXnGEw.exe
  C:\Windows\System\kVXnGEw.exe
  2⤵
  - Executes dropped EXE
  PID:2780
- C:\Windows\System\ZXpOERk.exe
  C:\Windows\System\ZXpOERk.exe
  2⤵
  - Executes dropped EXE
  PID:2752
- C:\Windows\System\pzuTiwt.exe
  C:\Windows\System\pzuTiwt.exe
  2⤵
  - Executes dropped EXE
  PID:1828
- C:\Windows\System\PAHSxHT.exe
  C:\Windows\System\PAHSxHT.exe
  2⤵
  - Executes dropped EXE
  PID:1592
- C:\Windows\System\ikuPoWd.exe
  C:\Windows\System\ikuPoWd.exe
  2⤵
  - Executes dropped EXE
  PID:1680
- C:\Windows\System\KOanhvE.exe
  C:\Windows\System\KOanhvE.exe
  2⤵
  - Executes dropped EXE
  PID:2320
- C:\Windows\System\CzVjZnv.exe
  C:\Windows\System\CzVjZnv.exe
  2⤵
  - Executes dropped EXE
  PID:836
- C:\Windows\System\uAuGEAN.exe
  C:\Windows\System\uAuGEAN.exe
  2⤵
  - Executes dropped EXE
  PID:1200
- C:\Windows\System\zHiEekn.exe
  C:\Windows\System\zHiEekn.exe
  2⤵
  - Executes dropped EXE
  PID:1648
- C:\Windows\System\MUQujQN.exe
  C:\Windows\System\MUQujQN.exe
  2⤵
  - Executes dropped EXE
  PID:1652
- C:\Windows\System\BwegQzk.exe
  C:\Windows\System\BwegQzk.exe
  2⤵
  - Executes dropped EXE
  PID:1548
- C:\Windows\System\ubxcvhG.exe
  C:\Windows\System\ubxcvhG.exe
  2⤵
  PID:1564
- C:\Windows\System\PssvPTf.exe
  C:\Windows\System\PssvPTf.exe
  2⤵
  - Executes dropped EXE
  PID:1940
- C:\Windows\System\YltnRMY.exe
  C:\Windows\System\YltnRMY.exe
  2⤵
  PID:1172
- C:\Windows\System\EWRcFtL.exe
  C:\Windows\System\EWRcFtL.exe
  2⤵
  - Executes dropped EXE
  PID:1944
- C:\Windows\System\baaIoDM.exe
  C:\Windows\System\baaIoDM.exe
  2⤵
  PID:1880
- C:\Windows\System\inCYsMB.exe
  C:\Windows\System\inCYsMB.exe
  2⤵
  - Executes dropped EXE
  PID:2808
- C:\Windows\System\XwhOdpr.exe
  C:\Windows\System\XwhOdpr.exe
  2⤵
  PID:1012
- C:\Windows\System\xvJZlZS.exe
  C:\Windows\System\xvJZlZS.exe
  2⤵
  - Executes dropped EXE
  PID:1992
- C:\Windows\System\eVUUyvc.exe
  C:\Windows\System\eVUUyvc.exe
  2⤵
  PID:1404
- C:\Windows\System\eTkqSxI.exe
  C:\Windows\System\eTkqSxI.exe
  2⤵
  - Executes dropped EXE
  PID:1960
- C:\Windows\System\MFXeVKz.exe
  C:\Windows\System\MFXeVKz.exe
  2⤵
  PID:1100
- C:\Windows\System\BiceChA.exe
  C:\Windows\System\BiceChA.exe
  2⤵
  - Executes dropped EXE
  PID:3044
- C:\Windows\System\ykbKdEM.exe
  C:\Windows\System\ykbKdEM.exe
  2⤵
  PID:1008
- C:\Windows\System\PZIaOqs.exe
  C:\Windows\System\PZIaOqs.exe
  2⤵
  - Executes dropped EXE
  PID:2860
- C:\Windows\System\cLFKbmU.exe
  C:\Windows\System\cLFKbmU.exe
  2⤵
  PID:1356
- C:\Windows\System\ILgMAKK.exe
  C:\Windows\System\ILgMAKK.exe
  2⤵
  - Executes dropped EXE
  PID:912
- C:\Windows\System\hTjVfrT.exe
  C:\Windows\System\hTjVfrT.exe
  2⤵
  PID:1756
- C:\Windows\System\kozwnqQ.exe
  C:\Windows\System\kozwnqQ.exe
  2⤵
  - Executes dropped EXE
  PID:1952
- C:\Windows\System\jjOVdAI.exe
  C:\Windows\System\jjOVdAI.exe
  2⤵
  PID:1272
- C:\Windows\System\LTeUEXz.exe
  C:\Windows\System\LTeUEXz.exe
  2⤵
  - Executes dropped EXE
  PID:1604
- C:\Windows\System\NmrShKK.exe
  C:\Windows\System\NmrShKK.exe
  2⤵
  PID:1608
- C:\Windows\System\UDhTLvQ.exe
  C:\Windows\System\UDhTLvQ.exe
  2⤵
  - Executes dropped EXE
  PID:2012
- C:\Windows\System\JPhYsvm.exe
  C:\Windows\System\JPhYsvm.exe
  2⤵
  PID:900
- C:\Windows\System\qnMQdTV.exe
  C:\Windows\System\qnMQdTV.exe
  2⤵
  - Executes dropped EXE
  PID:2652
- C:\Windows\System\tBcQIrF.exe
  C:\Windows\System\tBcQIrF.exe
  2⤵
  PID:3064
- C:\Windows\System\SUSxLii.exe
  C:\Windows\System\SUSxLii.exe
  2⤵
  - Executes dropped EXE
  PID:2732
- C:\Windows\System\VNcVYlB.exe
  C:\Windows\System\VNcVYlB.exe
  2⤵
  PID:2452
- C:\Windows\System\GQhYsIe.exe
  C:\Windows\System\GQhYsIe.exe
  2⤵
  - Executes dropped EXE
  PID:2232
- C:\Windows\System\DrDGsLg.exe
  C:\Windows\System\DrDGsLg.exe
  2⤵
  PID:2800
- C:\Windows\System\UPCprJu.exe
  C:\Windows\System\UPCprJu.exe
  2⤵
  - Executes dropped EXE
  PID:716
- C:\Windows\System\fqAQiAu.exe
  C:\Windows\System\fqAQiAu.exe
  2⤵
  PID:1964
- C:\Windows\System\wdJHFaF.exe
  C:\Windows\System\wdJHFaF.exe
  2⤵
  - Executes dropped EXE
  PID:2824
- C:\Windows\System\JojDkJO.exe
  C:\Windows\System\JojDkJO.exe
  2⤵
  PID:2676
- C:\Windows\System\nxhaHxH.exe
  C:\Windows\System\nxhaHxH.exe
  2⤵
  - Executes dropped EXE
  PID:2432
- C:\Windows\System\TOQmjrC.exe
  C:\Windows\System\TOQmjrC.exe
  2⤵
  PID:1836
- C:\Windows\System\SzoJMfY.exe
  C:\Windows\System\SzoJMfY.exe
  2⤵
  - Executes dropped EXE
  PID:2604
- C:\Windows\System\blvFyNc.exe
  C:\Windows\System\blvFyNc.exe
  2⤵
  PID:1176
- C:\Windows\System\gjYrlDK.exe
  C:\Windows\System\gjYrlDK.exe
  2⤵
  - Executes dropped EXE
  PID:2936
- C:\Windows\System\anHlBDz.exe
  C:\Windows\System\anHlBDz.exe
  2⤵
  PID:2520
- C:\Windows\System\YBPJBbq.exe
  C:\Windows\System\YBPJBbq.exe
  2⤵
  - Executes dropped EXE
  PID:2420
- C:\Windows\System\cGmDYvf.exe
  C:\Windows\System\cGmDYvf.exe
  2⤵
  PID:788
- C:\Windows\System\MMXYRbs.exe
  C:\Windows\System\MMXYRbs.exe
  2⤵
  - Executes dropped EXE
  PID:2684
- C:\Windows\System\iQYVZuf.exe
  C:\Windows\System\iQYVZuf.exe
  2⤵
  PID:400
- C:\Windows\System\IcobfIL.exe
  C:\Windows\System\IcobfIL.exe
  2⤵
  - Executes dropped EXE
  PID:2876
- C:\Windows\System\HYqwTlu.exe
  C:\Windows\System\HYqwTlu.exe
  2⤵
  PID:1292
- C:\Windows\System\kuTdhtR.exe
  C:\Windows\System\kuTdhtR.exe
  2⤵
  - Executes dropped EXE
  PID:612
- C:\Windows\System\VUJtvrV.exe
  C:\Windows\System\VUJtvrV.exe
  2⤵
  PID:2612
- C:\Windows\System\qcIhiTI.exe
  C:\Windows\System\qcIhiTI.exe
  2⤵
  - Executes dropped EXE
  PID:684
- C:\Windows\System\VmPBIWF.exe
  C:\Windows\System\VmPBIWF.exe
  2⤵
  PID:1692
- C:\Windows\System\FACNGPL.exe
  C:\Windows\System\FACNGPL.exe
  2⤵
  - Executes dropped EXE
  PID:1392
- C:\Windows\System\VrLrNqQ.exe
  C:\Windows\System\VrLrNqQ.exe
  2⤵
  PID:2892
- C:\Windows\System\XVMNbvL.exe
  C:\Windows\System\XVMNbvL.exe
  2⤵
  - Executes dropped EXE
  PID:2160
- C:\Windows\System\wVaVEqT.exe
  C:\Windows\System\wVaVEqT.exe
  2⤵
  PID:2848
- C:\Windows\System\CprcWtN.exe
  C:\Windows\System\CprcWtN.exe
  2⤵
  - Executes dropped EXE
  PID:1220
- C:\Windows\System\gcXfvhL.exe
  C:\Windows\System\gcXfvhL.exe
  2⤵
  PID:2004
- C:\Windows\System\nNcvqfs.exe
  C:\Windows\System\nNcvqfs.exe
  2⤵
  - Executes dropped EXE
  PID:1312
- C:\Windows\System\lugCkVO.exe
  C:\Windows\System\lugCkVO.exe
  2⤵
  PID:2600
- C:\Windows\System\umeGCaU.exe
  C:\Windows\System\umeGCaU.exe
  2⤵
  - Executes dropped EXE
  PID:780
- C:\Windows\System\WkqrShT.exe
  C:\Windows\System\WkqrShT.exe
  2⤵
  PID:1144
- C:\Windows\System\lUWZYHL.exe
  C:\Windows\System\lUWZYHL.exe
  2⤵
  - Executes dropped EXE
  PID:2932
- C:\Windows\System\CsNOOLy.exe
  C:\Windows\System\CsNOOLy.exe
  2⤵
  PID:320
- C:\Windows\System\bhNGeis.exe
  C:\Windows\System\bhNGeis.exe
  2⤵
  - Executes dropped EXE
  PID:1508
- C:\Windows\System\WhXTSYx.exe
  C:\Windows\System\WhXTSYx.exe
  2⤵
  PID:1824
- C:\Windows\System\BRDyFWN.exe
  C:\Windows\System\BRDyFWN.exe
  2⤵
  PID:3088
- C:\Windows\System\rKocYJj.exe
  C:\Windows\System\rKocYJj.exe
  2⤵
  PID:3104
- C:\Windows\System\xzFLGOX.exe
  C:\Windows\System\xzFLGOX.exe
  2⤵
  PID:3120
- C:\Windows\System\AfNZEHU.exe
  C:\Windows\System\AfNZEHU.exe
  2⤵
  PID:3136
- C:\Windows\System\FYiTxPo.exe
  C:\Windows\System\FYiTxPo.exe
  2⤵
  PID:3152
- C:\Windows\System\FOwmDko.exe
  C:\Windows\System\FOwmDko.exe
  2⤵
  PID:3168
- C:\Windows\System\WhpgKbp.exe
  C:\Windows\System\WhpgKbp.exe
  2⤵
  PID:3184
- C:\Windows\System\MJqPxwh.exe
  C:\Windows\System\MJqPxwh.exe
  2⤵
  PID:3200
- C:\Windows\System\pbqxEVI.exe
  C:\Windows\System\pbqxEVI.exe
  2⤵
  PID:3216
- C:\Windows\System\hiNJUlX.exe
  C:\Windows\System\hiNJUlX.exe
  2⤵
  PID:3232
- C:\Windows\System\ImceyBb.exe
  C:\Windows\System\ImceyBb.exe
  2⤵
  PID:3248
- C:\Windows\System\FyuuHCG.exe
  C:\Windows\System\FyuuHCG.exe
  2⤵
  PID:3264
- C:\Windows\System\lbTOKfD.exe
  C:\Windows\System\lbTOKfD.exe
  2⤵
  PID:3280
- C:\Windows\System\rLAatEk.exe
  C:\Windows\System\rLAatEk.exe
  2⤵
  PID:3296
- C:\Windows\System\RNiGYkX.exe
  C:\Windows\System\RNiGYkX.exe
  2⤵
  PID:3312
- C:\Windows\System\afSvnxm.exe
  C:\Windows\System\afSvnxm.exe
  2⤵
  PID:3332
- C:\Windows\System\zHVDYkz.exe
  C:\Windows\System\zHVDYkz.exe
  2⤵
  PID:3348
- C:\Windows\System\ahbswQR.exe
  C:\Windows\System\ahbswQR.exe
  2⤵
  PID:3364
- C:\Windows\System\nfzpyTH.exe
  C:\Windows\System\nfzpyTH.exe
  2⤵
  PID:3488
- C:\Windows\System\jndNpsi.exe
  C:\Windows\System\jndNpsi.exe
  2⤵
  PID:3516
- C:\Windows\System\GenlmRg.exe
  C:\Windows\System\GenlmRg.exe
  2⤵
  PID:3532
- C:\Windows\System\nKtdjtC.exe
  C:\Windows\System\nKtdjtC.exe
  2⤵
  PID:3548
- C:\Windows\System\niZFlWK.exe
  C:\Windows\System\niZFlWK.exe
  2⤵
  PID:3564
- C:\Windows\System\lDuoYKo.exe
  C:\Windows\System\lDuoYKo.exe
  2⤵
  PID:3580
- C:\Windows\System\ZIbZgbN.exe
  C:\Windows\System\ZIbZgbN.exe
  2⤵
  PID:3596
- C:\Windows\System\hhidmHF.exe
  C:\Windows\System\hhidmHF.exe
  2⤵
  PID:3612
- C:\Windows\System\MvHhYoi.exe
  C:\Windows\System\MvHhYoi.exe
  2⤵
  PID:3628
- C:\Windows\System\hbwKTwl.exe
  C:\Windows\System\hbwKTwl.exe
  2⤵
  PID:3644
- C:\Windows\System\ZcgCsAG.exe
  C:\Windows\System\ZcgCsAG.exe
  2⤵
  PID:3660
- C:\Windows\System\NrVTwPO.exe
  C:\Windows\System\NrVTwPO.exe
  2⤵
  PID:3684
- C:\Windows\System\gTwmYtW.exe
  C:\Windows\System\gTwmYtW.exe
  2⤵
  PID:3700
- C:\Windows\System\zQduNTo.exe
  C:\Windows\System\zQduNTo.exe
  2⤵
  PID:3716
- C:\Windows\System\zAQgmEt.exe
  C:\Windows\System\zAQgmEt.exe
  2⤵
  PID:3732
- C:\Windows\System\TOprXlL.exe
  C:\Windows\System\TOprXlL.exe
  2⤵
  PID:3748
- C:\Windows\System\VHpmTrD.exe
  C:\Windows\System\VHpmTrD.exe
  2⤵
  PID:3764
- C:\Windows\System\iaSnylV.exe
  C:\Windows\System\iaSnylV.exe
  2⤵
  PID:3800
- C:\Windows\System\FqHuvyP.exe
  C:\Windows\System\FqHuvyP.exe
  2⤵
  PID:3816
- C:\Windows\System\BTLmVAv.exe
  C:\Windows\System\BTLmVAv.exe
  2⤵
  PID:3832
- C:\Windows\System\sOLPNgT.exe
  C:\Windows\System\sOLPNgT.exe
  2⤵
  PID:3848
- C:\Windows\System\HECaCWk.exe
  C:\Windows\System\HECaCWk.exe
  2⤵
  PID:3864
- C:\Windows\System\RdRxipt.exe
  C:\Windows\System\RdRxipt.exe
  2⤵
  PID:3880
- C:\Windows\System\mQsqJUv.exe
  C:\Windows\System\mQsqJUv.exe
  2⤵
  PID:3896
- C:\Windows\System\wJkyhVs.exe
  C:\Windows\System\wJkyhVs.exe
  2⤵
  PID:3912
- C:\Windows\System\ENSlWTT.exe
  C:\Windows\System\ENSlWTT.exe
  2⤵
  PID:3928
- C:\Windows\System\YoaiFuW.exe
  C:\Windows\System\YoaiFuW.exe
  2⤵
  PID:3944
- C:\Windows\System\uaTAdaT.exe
  C:\Windows\System\uaTAdaT.exe
  2⤵
  PID:3960
- C:\Windows\System\xtGYXvb.exe
  C:\Windows\System\xtGYXvb.exe
  2⤵
  PID:3976
- C:\Windows\System\OJjnHbt.exe
  C:\Windows\System\OJjnHbt.exe
  2⤵
  PID:3992
- C:\Windows\System\ETqeCwY.exe
  C:\Windows\System\ETqeCwY.exe
  2⤵
  PID:4008
- C:\Windows\System\qnObSwn.exe
  C:\Windows\System\qnObSwn.exe
  2⤵
  PID:4024
- C:\Windows\System\NiZhvlG.exe
  C:\Windows\System\NiZhvlG.exe
  2⤵
  PID:2940
- C:\Windows\System\hALKJJN.exe
  C:\Windows\System\hALKJJN.exe
  2⤵
  PID:308
- C:\Windows\System\dtmYUTh.exe
  C:\Windows\System\dtmYUTh.exe
  2⤵
  PID:3128
- C:\Windows\System\JTVOyQT.exe
  C:\Windows\System\JTVOyQT.exe
  2⤵
  PID:796
- C:\Windows\System\ywWKGBj.exe
  C:\Windows\System\ywWKGBj.exe
  2⤵
  PID:2544
- C:\Windows\System\ssLrUkJ.exe
  C:\Windows\System\ssLrUkJ.exe
  2⤵
  PID:2856
- C:\Windows\System\USbBDHI.exe
  C:\Windows\System\USbBDHI.exe
  2⤵
  PID:3192
- C:\Windows\System\LzPgSQs.exe
  C:\Windows\System\LzPgSQs.exe
  2⤵
  PID:3260
- C:\Windows\System\qSsYuqW.exe
  C:\Windows\System\qSsYuqW.exe
  2⤵
  PID:1956
- C:\Windows\System\rSqcPhQ.exe
  C:\Windows\System\rSqcPhQ.exe
  2⤵
  PID:3356
- C:\Windows\System\MrYDByT.exe
  C:\Windows\System\MrYDByT.exe
  2⤵
  PID:3512
- C:\Windows\System\wQfPYAQ.exe
  C:\Windows\System\wQfPYAQ.exe
  2⤵
  PID:3572
- C:\Windows\System\HcRpwyn.exe
  C:\Windows\System\HcRpwyn.exe
  2⤵
  PID:3636
- C:\Windows\System\FwESxlx.exe
  C:\Windows\System\FwESxlx.exe
  2⤵
  PID:3676
- C:\Windows\System\zerZifw.exe
  C:\Windows\System\zerZifw.exe
  2⤵
  PID:3740
- C:\Windows\System\pYyvctY.exe
  C:\Windows\System\pYyvctY.exe
  2⤵
  PID:3784
- C:\Windows\System\PAIyOQn.exe
  C:\Windows\System\PAIyOQn.exe
  2⤵
  PID:3824
- C:\Windows\System\etScbsh.exe
  C:\Windows\System\etScbsh.exe
  2⤵
  PID:3888
- C:\Windows\System\yAFCfdY.exe
  C:\Windows\System\yAFCfdY.exe
  2⤵
  PID:3952
- C:\Windows\System\iOdOamm.exe
  C:\Windows\System\iOdOamm.exe
  2⤵
  PID:4016
- C:\Windows\System\EITloNv.exe
  C:\Windows\System\EITloNv.exe
  2⤵
  PID:1568
- C:\Windows\System\NJUUkvi.exe
  C:\Windows\System\NJUUkvi.exe
  2⤵
  PID:2736
- C:\Windows\System\MDbaPDD.exe
  C:\Windows\System\MDbaPDD.exe
  2⤵
  PID:2416
- C:\Windows\System\akbxBcF.exe
  C:\Windows\System\akbxBcF.exe
  2⤵
  PID:3112
- C:\Windows\System\OoSiBFN.exe
  C:\Windows\System\OoSiBFN.exe
  2⤵
  PID:4112
- C:\Windows\System\gHEbSEO.exe
  C:\Windows\System\gHEbSEO.exe
  2⤵
  PID:4128
- C:\Windows\System\WSIEKWd.exe
  C:\Windows\System\WSIEKWd.exe
  2⤵
  PID:4144
- C:\Windows\System\fueeFXO.exe
  C:\Windows\System\fueeFXO.exe
  2⤵
  PID:4164
- C:\Windows\System\tabjiJY.exe
  C:\Windows\System\tabjiJY.exe
  2⤵
  PID:4180
- C:\Windows\System\ZeEmynE.exe
  C:\Windows\System\ZeEmynE.exe
  2⤵
  PID:4196
- C:\Windows\System\YURSgzb.exe
  C:\Windows\System\YURSgzb.exe
  2⤵
  PID:4212
- C:\Windows\System\HBRuAZb.exe
  C:\Windows\System\HBRuAZb.exe
  2⤵
  PID:4228
- C:\Windows\System\WFchJAm.exe
  C:\Windows\System\WFchJAm.exe
  2⤵
  PID:4244
- C:\Windows\System\qzHTSee.exe
  C:\Windows\System\qzHTSee.exe
  2⤵
  PID:4260
- C:\Windows\System\CXxKrDw.exe
  C:\Windows\System\CXxKrDw.exe
  2⤵
  PID:4276
- C:\Windows\System\qyGYBOY.exe
  C:\Windows\System\qyGYBOY.exe
  2⤵
  PID:4296
- C:\Windows\System\cesnHLp.exe
  C:\Windows\System\cesnHLp.exe
  2⤵
  PID:4312
- C:\Windows\System\OSUgLSK.exe
  C:\Windows\System\OSUgLSK.exe
  2⤵
  PID:4328
- C:\Windows\System\YKloEQq.exe
  C:\Windows\System\YKloEQq.exe
  2⤵
  PID:4344
- C:\Windows\System\maqhncZ.exe
  C:\Windows\System\maqhncZ.exe
  2⤵
  PID:4368
- C:\Windows\System\XkyJPCL.exe
  C:\Windows\System\XkyJPCL.exe
  2⤵
  PID:4384
- C:\Windows\System\AdPgqxD.exe
  C:\Windows\System\AdPgqxD.exe
  2⤵
  PID:4400
- C:\Windows\System\wlhHvrZ.exe
  C:\Windows\System\wlhHvrZ.exe
  2⤵
  PID:4416
- C:\Windows\System\wLDlhlJ.exe
  C:\Windows\System\wLDlhlJ.exe
  2⤵
  PID:4432
- C:\Windows\System\DQhbiYv.exe
  C:\Windows\System\DQhbiYv.exe
  2⤵
  PID:4448
- C:\Windows\System\hwXnCNh.exe
  C:\Windows\System\hwXnCNh.exe
  2⤵
  PID:4464
- C:\Windows\System\NqSajAy.exe
  C:\Windows\System\NqSajAy.exe
  2⤵
  PID:4484
- C:\Windows\System\WjiNkBs.exe
  C:\Windows\System\WjiNkBs.exe
  2⤵
  PID:4500
- C:\Windows\System\cHXJRNb.exe
  C:\Windows\System\cHXJRNb.exe
  2⤵
  PID:4516
- C:\Windows\System\jKwFOlh.exe
  C:\Windows\System\jKwFOlh.exe
  2⤵
  PID:4532
- C:\Windows\System\BuTbMup.exe
  C:\Windows\System\BuTbMup.exe
  2⤵
  PID:4548
- C:\Windows\System\pFGYkWg.exe
  C:\Windows\System\pFGYkWg.exe
  2⤵
  PID:4564
- C:\Windows\System\IQBRxSq.exe
  C:\Windows\System\IQBRxSq.exe
  2⤵
  PID:4584
- C:\Windows\System\sOTyTxN.exe
  C:\Windows\System\sOTyTxN.exe
  2⤵
  PID:4600
- C:\Windows\System\NWuvsoy.exe
  C:\Windows\System\NWuvsoy.exe
  2⤵
  PID:4616
- C:\Windows\System\VHjkkgn.exe
  C:\Windows\System\VHjkkgn.exe
  2⤵
  PID:4636
- C:\Windows\System\JrOvjnU.exe
  C:\Windows\System\JrOvjnU.exe
  2⤵
  PID:4652
- C:\Windows\System\BuUHotE.exe
  C:\Windows\System\BuUHotE.exe
  2⤵
  PID:4668
- C:\Windows\System\BqFgNtA.exe
  C:\Windows\System\BqFgNtA.exe
  2⤵
  PID:4684
- C:\Windows\System\cBYlgKy.exe
  C:\Windows\System\cBYlgKy.exe
  2⤵
  PID:4700
- C:\Windows\System\IzlseaP.exe
  C:\Windows\System\IzlseaP.exe
  2⤵
  PID:4716
- C:\Windows\System\rlyoFQQ.exe
  C:\Windows\System\rlyoFQQ.exe
  2⤵
  PID:4740
- C:\Windows\System\oWFUunO.exe
  C:\Windows\System\oWFUunO.exe
  2⤵
  PID:4756
- C:\Windows\System\YCSFqdR.exe
  C:\Windows\System\YCSFqdR.exe
  2⤵
  PID:4772
- C:\Windows\System\YDpNDeU.exe
  C:\Windows\System\YDpNDeU.exe
  2⤵
  PID:4788
- C:\Windows\System\vKfCSeM.exe
  C:\Windows\System\vKfCSeM.exe
  2⤵
  PID:4804
- C:\Windows\System\zohmhHo.exe
  C:\Windows\System\zohmhHo.exe
  2⤵
  PID:4820
- C:\Windows\System\QqkAYEM.exe
  C:\Windows\System\QqkAYEM.exe
  2⤵
  PID:4836
- C:\Windows\System\xoupPXg.exe
  C:\Windows\System\xoupPXg.exe
  2⤵
  PID:4852
- C:\Windows\System\lNJqIAn.exe
  C:\Windows\System\lNJqIAn.exe
  2⤵
  PID:4868
- C:\Windows\System\QgdUJOq.exe
  C:\Windows\System\QgdUJOq.exe
  2⤵
  PID:4884
- C:\Windows\System\yyEeKqh.exe
  C:\Windows\System\yyEeKqh.exe
  2⤵
  PID:4900
- C:\Windows\System\HNgJhSI.exe
  C:\Windows\System\HNgJhSI.exe
  2⤵
  PID:4916
- C:\Windows\System\oJInFUS.exe
  C:\Windows\System\oJInFUS.exe
  2⤵
  PID:4932
- C:\Windows\System\IccQNOe.exe
  C:\Windows\System\IccQNOe.exe
  2⤵
  PID:4948
- C:\Windows\System\hQhhXnw.exe
  C:\Windows\System\hQhhXnw.exe
  2⤵
  PID:4964
- C:\Windows\System\dOXlWQf.exe
  C:\Windows\System\dOXlWQf.exe
  2⤵
  PID:4980
- C:\Windows\System\xRPZeVN.exe
  C:\Windows\System\xRPZeVN.exe
  2⤵
  PID:5000
- C:\Windows\System\tecZvfE.exe
  C:\Windows\System\tecZvfE.exe
  2⤵
  PID:5016
- C:\Windows\System\ILxtqhw.exe
  C:\Windows\System\ILxtqhw.exe
  2⤵
  PID:5032
- C:\Windows\System\SMFRqqC.exe
  C:\Windows\System\SMFRqqC.exe
  2⤵
  PID:5048
- C:\Windows\System\SztZXzN.exe
  C:\Windows\System\SztZXzN.exe
  2⤵
  PID:5064
- C:\Windows\System\EqqYorl.exe
  C:\Windows\System\EqqYorl.exe
  2⤵
  PID:5080
- C:\Windows\System\GWSSJnZ.exe
  C:\Windows\System\GWSSJnZ.exe
  2⤵
  PID:5096
- C:\Windows\System\wDFcjMH.exe
  C:\Windows\System\wDFcjMH.exe
  2⤵
  PID:5116
- C:\Windows\System\bnEIGxC.exe
  C:\Windows\System\bnEIGxC.exe
  2⤵
  PID:3176
- C:\Windows\System\RAIkHbd.exe
  C:\Windows\System\RAIkHbd.exe
  2⤵
  PID:1700
- C:\Windows\System\HdHFDKO.exe
  C:\Windows\System\HdHFDKO.exe
  2⤵
  PID:3276
- C:\Windows\System\RIVpKlv.exe
  C:\Windows\System\RIVpKlv.exe
  2⤵
  PID:2804
- C:\Windows\System\esqZagI.exe
  C:\Windows\System\esqZagI.exe
  2⤵
  PID:2536
- C:\Windows\System\PQadMBb.exe
  C:\Windows\System\PQadMBb.exe
  2⤵
  PID:1636
- C:\Windows\System\StOoeoO.exe
  C:\Windows\System\StOoeoO.exe
  2⤵
  PID:3224
- C:\Windows\System\LmgROTz.exe
  C:\Windows\System\LmgROTz.exe
  2⤵
  PID:3328
- C:\Windows\System\FWxVYiq.exe
  C:\Windows\System\FWxVYiq.exe
  2⤵
  PID:3672
- C:\Windows\System\klprxNP.exe
  C:\Windows\System\klprxNP.exe
  2⤵
  PID:3856
- C:\Windows\System\NDBXSDw.exe
  C:\Windows\System\NDBXSDw.exe
  2⤵
  PID:3988
- C:\Windows\System\vxUgOyo.exe
  C:\Windows\System\vxUgOyo.exe
  2⤵
  PID:3084
- C:\Windows\System\nHYOPGI.exe
  C:\Windows\System\nHYOPGI.exe
  2⤵
  PID:4156
- C:\Windows\System\qLOCGpY.exe
  C:\Windows\System\qLOCGpY.exe
  2⤵
  PID:4224
- C:\Windows\System\ZiPpURs.exe
  C:\Windows\System\ZiPpURs.exe
  2⤵
  PID:4288
- C:\Windows\System\Ymjjuii.exe
  C:\Windows\System\Ymjjuii.exe
  2⤵
  PID:4352
- C:\Windows\System\DyBWYGA.exe
  C:\Windows\System\DyBWYGA.exe
  2⤵
  PID:4392
- C:\Windows\System\prynogd.exe
  C:\Windows\System\prynogd.exe
  2⤵
  PID:4456
- C:\Windows\System\LWbETQB.exe
  C:\Windows\System\LWbETQB.exe
  2⤵
  PID:4524
- C:\Windows\System\OcfAugP.exe
  C:\Windows\System\OcfAugP.exe
  2⤵
  PID:4592
- C:\Windows\System\Wkufqlm.exe
  C:\Windows\System\Wkufqlm.exe
  2⤵
  PID:3724
- C:\Windows\System\sRwAArM.exe
  C:\Windows\System\sRwAArM.exe
  2⤵
  PID:3760
- C:\Windows\System\fvtraaO.exe
  C:\Windows\System\fvtraaO.exe
  2⤵
  PID:3844
- C:\Windows\System\oYZGgSm.exe
  C:\Windows\System\oYZGgSm.exe
  2⤵
  PID:3904
- C:\Windows\System\iWKMvsn.exe
  C:\Windows\System\iWKMvsn.exe
  2⤵
  PID:3968
- C:\Windows\System\uVcoBfa.exe
  C:\Windows\System\uVcoBfa.exe
  2⤵
  PID:4800
- C:\Windows\System\FRcPvmw.exe
  C:\Windows\System\FRcPvmw.exe
  2⤵
  PID:4832
- C:\Windows\System\Duejpoa.exe
  C:\Windows\System\Duejpoa.exe
  2⤵
  PID:4896
- C:\Windows\System\PyVcDzg.exe
  C:\Windows\System\PyVcDzg.exe
  2⤵
  PID:4960
- C:\Windows\System\BBgSRfX.exe
  C:\Windows\System\BBgSRfX.exe
  2⤵
  PID:5088
- C:\Windows\System\MXtTouy.exe
  C:\Windows\System\MXtTouy.exe
  2⤵
  PID:2656
- C:\Windows\System\hHfEvfO.exe
  C:\Windows\System\hHfEvfO.exe
  2⤵
  PID:3668
- C:\Windows\System\CXKKCky.exe
  C:\Windows\System\CXKKCky.exe
  2⤵
  PID:3472
- C:\Windows\System\geqheBg.exe
  C:\Windows\System\geqheBg.exe
  2⤵
  PID:4284
- C:\Windows\System\gNglWxH.exe
  C:\Windows\System\gNglWxH.exe
  2⤵
  PID:4496
- C:\Windows\System\OQOAIqI.exe
  C:\Windows\System\OQOAIqI.exe
  2⤵
  PID:4692
- C:\Windows\System\kcuFSKS.exe
  C:\Windows\System\kcuFSKS.exe
  2⤵
  PID:4736
- C:\Windows\System\CLmdxsG.exe
  C:\Windows\System\CLmdxsG.exe
  2⤵
  PID:3340
- C:\Windows\System\IkwvfQG.exe
  C:\Windows\System\IkwvfQG.exe
  2⤵
  PID:3380
- C:\Windows\System\GOzRqAE.exe
  C:\Windows\System\GOzRqAE.exe
  2⤵
  PID:3392
- C:\Windows\System\RWAAydo.exe
  C:\Windows\System\RWAAydo.exe
  2⤵
  PID:4060
- C:\Windows\System\MxGfskO.exe
  C:\Windows\System\MxGfskO.exe
  2⤵
  PID:3412
- C:\Windows\System\WfkaKyW.exe
  C:\Windows\System\WfkaKyW.exe
  2⤵
  PID:3428
- C:\Windows\System\xqbDFbq.exe
  C:\Windows\System\xqbDFbq.exe
  2⤵
  PID:3444
- C:\Windows\System\PguDIRR.exe
  C:\Windows\System\PguDIRR.exe
  2⤵
  PID:3468
- C:\Windows\System\BkTMjza.exe
  C:\Windows\System\BkTMjza.exe
  2⤵
  PID:2776
- C:\Windows\System\iMLYzuW.exe
  C:\Windows\System\iMLYzuW.exe
  2⤵
  PID:4764
- C:\Windows\System\nEIdEYO.exe
  C:\Windows\System\nEIdEYO.exe
  2⤵
  PID:1816
- C:\Windows\System\OsEBeIg.exe
  C:\Windows\System\OsEBeIg.exe
  2⤵
  PID:2036
- C:\Windows\System\OVyckHm.exe
  C:\Windows\System\OVyckHm.exe
  2⤵
  PID:3592
- C:\Windows\System\pryDplf.exe
  C:\Windows\System\pryDplf.exe
  2⤵
  PID:4628
- C:\Windows\System\odFZqGG.exe
  C:\Windows\System\odFZqGG.exe
  2⤵
  PID:3812
- C:\Windows\System\zjTHboG.exe
  C:\Windows\System\zjTHboG.exe
  2⤵
  PID:4988
- C:\Windows\System\dDSwEKU.exe
  C:\Windows\System\dDSwEKU.exe
  2⤵
  PID:896
- C:\Windows\System\RAywutO.exe
  C:\Windows\System\RAywutO.exe
  2⤵
  PID:3244
- C:\Windows\System\tlqyRMV.exe
  C:\Windows\System\tlqyRMV.exe
  2⤵
  PID:4152
- C:\Windows\System\tYoHxqA.exe
  C:\Windows\System\tYoHxqA.exe
  2⤵
  PID:4724
- C:\Windows\System\BbHHWwS.exe
  C:\Windows\System\BbHHWwS.exe
  2⤵
  PID:3604
- C:\Windows\System\blmTbak.exe
  C:\Windows\System\blmTbak.exe
  2⤵
  PID:5128
- C:\Windows\System\CdHicNh.exe
  C:\Windows\System\CdHicNh.exe
  2⤵
  PID:5144
- C:\Windows\System\VtQDQxe.exe
  C:\Windows\System\VtQDQxe.exe
  2⤵
  PID:5164
- C:\Windows\System\rClRfFZ.exe
  C:\Windows\System\rClRfFZ.exe
  2⤵
  PID:5180
- C:\Windows\System\YvSMmaO.exe
  C:\Windows\System\YvSMmaO.exe
  2⤵
  PID:5196
- C:\Windows\System\TuXXHWU.exe
  C:\Windows\System\TuXXHWU.exe
  2⤵
  PID:5212
- C:\Windows\System\mnBHuJn.exe
  C:\Windows\System\mnBHuJn.exe
  2⤵
  PID:5228
- C:\Windows\System\htUTIqo.exe
  C:\Windows\System\htUTIqo.exe
  2⤵
  PID:5244
- C:\Windows\System\UvhkxlA.exe
  C:\Windows\System\UvhkxlA.exe
  2⤵
  PID:5264
- C:\Windows\System\lRGHudV.exe
  C:\Windows\System\lRGHudV.exe
  2⤵
  PID:5288
- C:\Windows\System\TFvIjWb.exe
  C:\Windows\System\TFvIjWb.exe
  2⤵
  PID:5304
- C:\Windows\System\MziSgsF.exe
  C:\Windows\System\MziSgsF.exe
  2⤵
  PID:5320
- C:\Windows\System\MsSGjCj.exe
  C:\Windows\System\MsSGjCj.exe
  2⤵
  PID:5336
- C:\Windows\System\RfgtOAL.exe
  C:\Windows\System\RfgtOAL.exe
  2⤵
  PID:5356
- C:\Windows\System\JpPbUhH.exe
  C:\Windows\System\JpPbUhH.exe
  2⤵
  PID:5372
- C:\Windows\System\DGdAiNu.exe
  C:\Windows\System\DGdAiNu.exe
  2⤵
  PID:5388
- C:\Windows\System\vnWkacR.exe
  C:\Windows\System\vnWkacR.exe
  2⤵
  PID:5404
- C:\Windows\System\AvMnCDa.exe
  C:\Windows\System\AvMnCDa.exe
  2⤵
  PID:5420
- C:\Windows\System\bTJSBAP.exe
  C:\Windows\System\bTJSBAP.exe
  2⤵
  PID:5436
- C:\Windows\System\TYwwYTM.exe
  C:\Windows\System\TYwwYTM.exe
  2⤵
  PID:5452
- C:\Windows\System\CmgDTTG.exe
  C:\Windows\System\CmgDTTG.exe
  2⤵
  PID:5468
- C:\Windows\System\HeRQWjt.exe
  C:\Windows\System\HeRQWjt.exe
  2⤵
  PID:5488
- C:\Windows\System\sxSYUGZ.exe
  C:\Windows\System\sxSYUGZ.exe
  2⤵
  PID:5504
- C:\Windows\System\MlYEJCR.exe
  C:\Windows\System\MlYEJCR.exe
  2⤵
  PID:5552
- C:\Windows\System\JZGjNFs.exe
  C:\Windows\System\JZGjNFs.exe
  2⤵
  PID:5568
- C:\Windows\System\BhRWCiq.exe
  C:\Windows\System\BhRWCiq.exe
  2⤵
  PID:5584
- C:\Windows\System\SyAvLub.exe
  C:\Windows\System\SyAvLub.exe
  2⤵
  PID:5600
- C:\Windows\System\tLULNHv.exe
  C:\Windows\System\tLULNHv.exe
  2⤵
  PID:5616
- C:\Windows\System\YvqvLok.exe
  C:\Windows\System\YvqvLok.exe
  2⤵
  PID:5636
- C:\Windows\System\gRhmzdz.exe
  C:\Windows\System\gRhmzdz.exe
  2⤵
  PID:5656
- C:\Windows\System\pmUDufI.exe
  C:\Windows\System\pmUDufI.exe
  2⤵
  PID:5672
- C:\Windows\System\ZEhwYDu.exe
  C:\Windows\System\ZEhwYDu.exe
  2⤵
  PID:5688
- C:\Windows\System\IijcmWs.exe
  C:\Windows\System\IijcmWs.exe
  2⤵
  PID:5704
- C:\Windows\System\zOYAVuZ.exe
  C:\Windows\System\zOYAVuZ.exe
  2⤵
  PID:5720
- C:\Windows\System\ZquIcYT.exe
  C:\Windows\System\ZquIcYT.exe
  2⤵
  PID:5736
- C:\Windows\System\iKIhXHp.exe
  C:\Windows\System\iKIhXHp.exe
  2⤵
  PID:5752
- C:\Windows\System\iZDARsG.exe
  C:\Windows\System\iZDARsG.exe
  2⤵
  PID:5768
- C:\Windows\System\yOsJVKc.exe
  C:\Windows\System\yOsJVKc.exe
  2⤵
  PID:5784
- C:\Windows\System\xKuJTfC.exe
  C:\Windows\System\xKuJTfC.exe
  2⤵
  PID:5800
- C:\Windows\System\FzSpRBg.exe
  C:\Windows\System\FzSpRBg.exe
  2⤵
  PID:5820
- C:\Windows\System\IAqdXKW.exe
  C:\Windows\System\IAqdXKW.exe
  2⤵
  PID:5892
- C:\Windows\System\UzMAHsA.exe
  C:\Windows\System\UzMAHsA.exe
  2⤵
  PID:5908
- C:\Windows\System\blrdRln.exe
  C:\Windows\System\blrdRln.exe
  2⤵
  PID:5928
- C:\Windows\System\otdNKPv.exe
  C:\Windows\System\otdNKPv.exe
  2⤵
  PID:5944
- C:\Windows\System\yDEeLQc.exe
  C:\Windows\System\yDEeLQc.exe
  2⤵
  PID:5960
- C:\Windows\System\LFZTaYg.exe
  C:\Windows\System\LFZTaYg.exe
  2⤵
  PID:5976
- C:\Windows\System\MaGgeCy.exe
  C:\Windows\System\MaGgeCy.exe
  2⤵
  PID:5992
- C:\Windows\System\mEQDVvD.exe
  C:\Windows\System\mEQDVvD.exe
  2⤵
  PID:6008
- C:\Windows\System\VWINgMH.exe
  C:\Windows\System\VWINgMH.exe
  2⤵
  PID:6024
- C:\Windows\System\KbjRCJY.exe
  C:\Windows\System\KbjRCJY.exe
  2⤵
  PID:6040
- C:\Windows\System\mutiqSP.exe
  C:\Windows\System\mutiqSP.exe
  2⤵
  PID:6060
- C:\Windows\System\VfFgFIv.exe
  C:\Windows\System\VfFgFIv.exe
  2⤵
  PID:6076
- C:\Windows\System\yeBYbXr.exe
  C:\Windows\System\yeBYbXr.exe
  2⤵
  PID:3712
- C:\Windows\System\jsfDzWt.exe
  C:\Windows\System\jsfDzWt.exe
  2⤵
  PID:3924
- C:\Windows\System\AOYWEol.exe
  C:\Windows\System\AOYWEol.exe
  2⤵
  PID:2252
- C:\Windows\System\rDztzyr.exe
  C:\Windows\System\rDztzyr.exe
  2⤵
  PID:4176
- C:\Windows\System\tvuXzgw.exe
  C:\Windows\System\tvuXzgw.exe
  2⤵
  PID:4268
- C:\Windows\System\GwwRevX.exe
  C:\Windows\System\GwwRevX.exe
  2⤵
  PID:4340
- C:\Windows\System\dhlEqXs.exe
  C:\Windows\System\dhlEqXs.exe
  2⤵
  PID:4412
- C:\Windows\System\WYhbSCj.exe
  C:\Windows\System\WYhbSCj.exe
  2⤵
  PID:4476
- C:\Windows\System\QErdywp.exe
  C:\Windows\System\QErdywp.exe
  2⤵
  PID:4572
- C:\Windows\System\UMkFILR.exe
  C:\Windows\System\UMkFILR.exe
  2⤵
  PID:4612
- C:\Windows\System\aNCoHzy.exe
  C:\Windows\System\aNCoHzy.exe
  2⤵
  PID:4712
- C:\Windows\System\PIDVJUu.exe
  C:\Windows\System\PIDVJUu.exe
  2⤵
  PID:4752
- C:\Windows\System\rEocDWE.exe
  C:\Windows\System\rEocDWE.exe
  2⤵
  PID:4816
- C:\Windows\System\KFvvIrQ.exe
  C:\Windows\System\KFvvIrQ.exe
  2⤵
  PID:4876
- C:\Windows\System\HjTJZJc.exe
  C:\Windows\System\HjTJZJc.exe
  2⤵
  PID:3452
- C:\Windows\System\zAtVdMM.exe
  C:\Windows\System\zAtVdMM.exe
  2⤵
  PID:1812
- C:\Windows\System\KrTfKXt.exe
  C:\Windows\System\KrTfKXt.exe
  2⤵
  PID:3148
- C:\Windows\System\lREgnWz.exe
  C:\Windows\System\lREgnWz.exe
  2⤵
  PID:3464
- C:\Windows\System\JJAapor.exe
  C:\Windows\System\JJAapor.exe
  2⤵
  PID:5364
- C:\Windows\System\AxAolzM.exe
  C:\Windows\System\AxAolzM.exe
  2⤵
  PID:5400
- C:\Windows\System\Hkotlcl.exe
  C:\Windows\System\Hkotlcl.exe
  2⤵
  PID:5160
- C:\Windows\System\ZpQdZyG.exe
  C:\Windows\System\ZpQdZyG.exe
  2⤵
  PID:5220
- C:\Windows\System\rbFMUas.exe
  C:\Windows\System\rbFMUas.exe
  2⤵
  PID:5224
- C:\Windows\System\DNIiTTe.exe
  C:\Windows\System\DNIiTTe.exe
  2⤵
  PID:5300
- C:\Windows\System\QveumbR.exe
  C:\Windows\System\QveumbR.exe
  2⤵
  PID:5496
- C:\Windows\System\RUMCeHx.exe
  C:\Windows\System\RUMCeHx.exe
  2⤵
  PID:2164
- C:\Windows\System\OZKnHsn.exe
  C:\Windows\System\OZKnHsn.exe
  2⤵
  PID:1656
- C:\Windows\System\UDofAsO.exe
  C:\Windows\System\UDofAsO.exe
  2⤵
  PID:1612
- C:\Windows\System\adYHeGG.exe
  C:\Windows\System\adYHeGG.exe
  2⤵
  PID:1808
- C:\Windows\System\VfjoERf.exe
  C:\Windows\System\VfjoERf.exe
  2⤵
  PID:1460
- C:\Windows\System\VPSPDAJ.exe
  C:\Windows\System\VPSPDAJ.exe
  2⤵
  PID:336
- C:\Windows\System\BAnGVhs.exe
  C:\Windows\System\BAnGVhs.exe
  2⤵
  PID:3040
- C:\Windows\System\CnYeLKZ.exe
  C:\Windows\System\CnYeLKZ.exe
  2⤵
  PID:2980
- C:\Windows\System\pagmGnS.exe
  C:\Windows\System\pagmGnS.exe
  2⤵
  PID:2564
- C:\Windows\System\axmdqrW.exe
  C:\Windows\System\axmdqrW.exe
  2⤵
  PID:1516
- C:\Windows\System\abFBCXb.exe
  C:\Windows\System\abFBCXb.exe
  2⤵
  PID:284
- C:\Windows\System\TZrUyGv.exe
  C:\Windows\System\TZrUyGv.exe
  2⤵
  PID:2644
- C:\Windows\System\eBxbixZ.exe
  C:\Windows\System\eBxbixZ.exe
  2⤵
  PID:4064
- C:\Windows\System\ilikgym.exe
  C:\Windows\System\ilikgym.exe
  2⤵
  PID:4084
- C:\Windows\System\rzmebnh.exe
  C:\Windows\System\rzmebnh.exe
  2⤵
  PID:2056
- C:\Windows\System\sPvEugF.exe
  C:\Windows\System\sPvEugF.exe
  2⤵
  PID:1728
- C:\Windows\System\DuVDreN.exe
  C:\Windows\System\DuVDreN.exe
  2⤵
  PID:2868
- C:\Windows\System\cYHyvKI.exe
  C:\Windows\System\cYHyvKI.exe
  2⤵
  PID:2620
- C:\Windows\System\jbbpzWt.exe
  C:\Windows\System\jbbpzWt.exe
  2⤵
  PID:5544
- C:\Windows\System\UpotHjE.exe
  C:\Windows\System\UpotHjE.exe
  2⤵
  PID:3096
- C:\Windows\System\olegDFz.exe
  C:\Windows\System\olegDFz.exe
  2⤵
  PID:2516
- C:\Windows\System\uuruFzN.exe
  C:\Windows\System\uuruFzN.exe
  2⤵
  PID:2380
- C:\Windows\System\QuBaRHu.exe
  C:\Windows\System\QuBaRHu.exe
  2⤵
  PID:1876
- C:\Windows\System\WchtGYn.exe
  C:\Windows\System\WchtGYn.exe
  2⤵
  PID:1128
- C:\Windows\System\xpliDLE.exe
  C:\Windows\System\xpliDLE.exe
  2⤵
  PID:3320
- C:\Windows\System\tYIbvel.exe
  C:\Windows\System\tYIbvel.exe
  2⤵
  PID:3504
- C:\Windows\System\lYyaJrx.exe
  C:\Windows\System\lYyaJrx.exe
  2⤵
  PID:4944
- C:\Windows\System\xGCQHHo.exe
  C:\Windows\System\xGCQHHo.exe
  2⤵
  PID:5012
- C:\Windows\System\isnDJvr.exe
  C:\Windows\System\isnDJvr.exe
  2⤵
  PID:5076
- C:\Windows\System\XeQxQnR.exe
  C:\Windows\System\XeQxQnR.exe
  2⤵
  PID:3212
- C:\Windows\System\bCacrqA.exe
  C:\Windows\System\bCacrqA.exe
  2⤵
  PID:1632
- C:\Windows\System\gnYCLSL.exe
  C:\Windows\System\gnYCLSL.exe
  2⤵
  PID:3776
- C:\Windows\System\CUvSPiA.exe
  C:\Windows\System\CUvSPiA.exe
  2⤵
  PID:4220
- C:\Windows\System\jLnikHt.exe
  C:\Windows\System\jLnikHt.exe
  2⤵
  PID:4428
- C:\Windows\System\avdBsoy.exe
  C:\Windows\System\avdBsoy.exe
  2⤵
  PID:3756
- C:\Windows\System\IIeoUWf.exe
  C:\Windows\System\IIeoUWf.exe
  2⤵
  PID:4004
- C:\Windows\System\MqQOOvp.exe
  C:\Windows\System\MqQOOvp.exe
  2⤵
  PID:5056
- C:\Windows\System\wNsBpxr.exe
  C:\Windows\System\wNsBpxr.exe
  2⤵
  PID:3540
- C:\Windows\System\JTCLxEd.exe
  C:\Windows\System\JTCLxEd.exe
  2⤵
  PID:4664
- C:\Windows\System\VBTSjVd.exe
  C:\Windows\System\VBTSjVd.exe
  2⤵
  PID:3388
- C:\Windows\System\ZYBmxeS.exe
  C:\Windows\System\ZYBmxeS.exe
  2⤵
  PID:4032
- C:\Windows\System\XeTLLRa.exe
  C:\Windows\System\XeTLLRa.exe
  2⤵
  PID:5172
- C:\Windows\System\aRkfLfF.exe
  C:\Windows\System\aRkfLfF.exe
  2⤵
  PID:5208
- C:\Windows\System\eETaXnw.exe
  C:\Windows\System\eETaXnw.exe
  2⤵
  PID:5564
- C:\Windows\System\NERrhPU.exe
  C:\Windows\System\NERrhPU.exe
  2⤵
  PID:5284
- C:\Windows\System\BYfGqIX.exe
  C:\Windows\System\BYfGqIX.exe
  2⤵
  PID:5352
- C:\Windows\System\gjBpOit.exe
  C:\Windows\System\gjBpOit.exe
  2⤵
  PID:5728
- C:\Windows\System\dosubZq.exe
  C:\Windows\System\dosubZq.exe
  2⤵
  PID:5792
- C:\Windows\System\SXFgkbC.exe
  C:\Windows\System\SXFgkbC.exe
  2⤵
  PID:5832
- C:\Windows\System\bQeZIAN.exe
  C:\Windows\System\bQeZIAN.exe
  2⤵
  PID:5856
- C:\Windows\System\cZeZAKT.exe
  C:\Windows\System\cZeZAKT.exe
  2⤵
  PID:5868
- C:\Windows\System\cSYLpfj.exe
  C:\Windows\System\cSYLpfj.exe
  2⤵
  PID:5580
- C:\Windows\System\HaZvEyC.exe
  C:\Windows\System\HaZvEyC.exe
  2⤵
  PID:5680
- C:\Windows\System\DhqxjuR.exe
  C:\Windows\System\DhqxjuR.exe
  2⤵
  PID:5744
- C:\Windows\System\DArEuCf.exe
  C:\Windows\System\DArEuCf.exe
  2⤵
  PID:5548
- C:\Windows\System\FsqXwOR.exe
  C:\Windows\System\FsqXwOR.exe
  2⤵
  PID:1932
- C:\Windows\System\CsJKEwk.exe
  C:\Windows\System\CsJKEwk.exe
  2⤵
  PID:5988
- C:\Windows\System\RlpfeLa.exe
  C:\Windows\System\RlpfeLa.exe
  2⤵
  PID:636
- C:\Windows\System\liQNPNm.exe
  C:\Windows\System\liQNPNm.exe
  2⤵
  PID:2140
- C:\Windows\System\SbxSgfF.exe
  C:\Windows\System\SbxSgfF.exe
  2⤵
  PID:856
- C:\Windows\System\doMhvKT.exe
  C:\Windows\System\doMhvKT.exe
  2⤵
  PID:1224
- C:\Windows\System\EwNFKYz.exe
  C:\Windows\System\EwNFKYz.exe
  2⤵
  PID:6036
- C:\Windows\System\dVzxVCv.exe
  C:\Windows\System\dVzxVCv.exe
  2⤵
  PID:5900
- C:\Windows\System\XaufoGG.exe
  C:\Windows\System\XaufoGG.exe
  2⤵
  PID:5904
- C:\Windows\System\HRHbLMF.exe
  C:\Windows\System\HRHbLMF.exe
  2⤵
  PID:6096
- C:\Windows\System\ksrXIHr.exe
  C:\Windows\System\ksrXIHr.exe
  2⤵
  PID:6124
- C:\Windows\System\swrzron.exe
  C:\Windows\System\swrzron.exe
  2⤵
  PID:6032
- C:\Windows\System\yOtmoMK.exe
  C:\Windows\System\yOtmoMK.exe
  2⤵
  PID:3708
- C:\Windows\System\bNPgBLc.exe
  C:\Windows\System\bNPgBLc.exe
  2⤵
  PID:2556
- C:\Windows\System\KnLRCaX.exe
  C:\Windows\System\KnLRCaX.exe
  2⤵
  PID:4108
- C:\Windows\System\fmgHcgD.exe
  C:\Windows\System\fmgHcgD.exe
  2⤵
  PID:4208
- C:\Windows\System\oYvzcge.exe
  C:\Windows\System\oYvzcge.exe
  2⤵
  PID:4240
- C:\Windows\System\BelBrUI.exe
  C:\Windows\System\BelBrUI.exe
  2⤵
  PID:4308
- C:\Windows\System\lkLqPbm.exe
  C:\Windows\System\lkLqPbm.exe
  2⤵
  PID:4408
- C:\Windows\System\Pdhwoxn.exe
  C:\Windows\System\Pdhwoxn.exe
  2⤵
  PID:4512
- C:\Windows\System\WPFpJfB.exe
  C:\Windows\System\WPFpJfB.exe
  2⤵
  PID:4056
- C:\Windows\System\DiyTEjE.exe
  C:\Windows\System\DiyTEjE.exe
  2⤵
  PID:4848
- C:\Windows\System\bbwfqYm.exe
  C:\Windows\System\bbwfqYm.exe
  2⤵
  PID:3456
- C:\Windows\System\NSODlTv.exe
  C:\Windows\System\NSODlTv.exe
  2⤵
  PID:5396
- C:\Windows\System\yHrPRre.exe
  C:\Windows\System\yHrPRre.exe
  2⤵
  PID:5460
- C:\Windows\System\obppIGh.exe
  C:\Windows\System\obppIGh.exe
  2⤵
  PID:4052
- C:\Windows\System\wEvkjxo.exe
  C:\Windows\System\wEvkjxo.exe
  2⤵
  PID:2640
- C:\Windows\System\rnjMDnx.exe
  C:\Windows\System\rnjMDnx.exe
  2⤵
  PID:2744
- C:\Windows\System\NCDoerj.exe
  C:\Windows\System\NCDoerj.exe
  2⤵
  PID:1796
- C:\Windows\System\NtvjvcZ.exe
  C:\Windows\System\NtvjvcZ.exe
  2⤵
  PID:5260
- C:\Windows\System\OnwYfQc.exe
  C:\Windows\System\OnwYfQc.exe
  2⤵
  PID:5464
- C:\Windows\System\fDDvBUv.exe
  C:\Windows\System\fDDvBUv.exe
  2⤵
  PID:2904
- C:\Windows\System\VfDQkGv.exe
  C:\Windows\System\VfDQkGv.exe
  2⤵
  PID:2488
- C:\Windows\System\vJOwmOS.exe
  C:\Windows\System\vJOwmOS.exe
  2⤵
  PID:1660
- C:\Windows\System\prADueV.exe
  C:\Windows\System\prADueV.exe
  2⤵
  PID:4072
- C:\Windows\System\whaMRnQ.exe
  C:\Windows\System\whaMRnQ.exe
  2⤵
  PID:1332
- C:\Windows\System\eeYHNkH.exe
  C:\Windows\System\eeYHNkH.exe
  2⤵
  PID:2900
- C:\Windows\System\ywUAKti.exe
  C:\Windows\System\ywUAKti.exe
  2⤵
  PID:5500
- C:\Windows\System\iUxXMak.exe
  C:\Windows\System\iUxXMak.exe
  2⤵
  PID:2716
- C:\Windows\System\ipYLaep.exe
  C:\Windows\System\ipYLaep.exe
  2⤵
  PID:2724
- C:\Windows\System\IuEMAqc.exe
  C:\Windows\System\IuEMAqc.exe
  2⤵
  PID:2688
- C:\Windows\System\sHpyMer.exe
  C:\Windows\System\sHpyMer.exe
  2⤵
  PID:4976
- C:\Windows\System\vPBIxgb.exe
  C:\Windows\System\vPBIxgb.exe
  2⤵
  PID:3324
- C:\Windows\System\xOKrPXa.exe
  C:\Windows\System\xOKrPXa.exe
  2⤵
  PID:4324
- C:\Windows\System\orRrbTn.exe
  C:\Windows\System\orRrbTn.exe
  2⤵
  PID:4000
- C:\Windows\System\WTfeIVm.exe
  C:\Windows\System\WTfeIVm.exe
  2⤵
  PID:3164
- C:\Windows\System\srSeEmJ.exe
  C:\Windows\System\srSeEmJ.exe
  2⤵
  PID:4632
- C:\Windows\System\pSQyjdl.exe
  C:\Windows\System\pSQyjdl.exe
  2⤵
  PID:828
- C:\Windows\System\mTZJYOI.exe
  C:\Windows\System\mTZJYOI.exe
  2⤵
  PID:2816
- C:\Windows\System\DdGBZNh.exe
  C:\Windows\System\DdGBZNh.exe
  2⤵
  PID:3404
- C:\Windows\System\qEnCuxa.exe
  C:\Windows\System\qEnCuxa.exe
  2⤵
  PID:3440
- C:\Windows\System\RLUPjzi.exe
  C:\Windows\System\RLUPjzi.exe
  2⤵
  PID:3408
- C:\Windows\System\nPScWqB.exe
  C:\Windows\System\nPScWqB.exe
  2⤵
  PID:4732
- C:\Windows\System\wPfVKsN.exe
  C:\Windows\System\wPfVKsN.exe
  2⤵
  PID:3272
- C:\Windows\System\MfFpSmU.exe
  C:\Windows\System\MfFpSmU.exe
  2⤵
  PID:5176
- C:\Windows\System\CooKpfO.exe
  C:\Windows\System\CooKpfO.exe
  2⤵
  PID:5344
- C:\Windows\System\cdoxUNZ.exe
  C:\Windows\System\cdoxUNZ.exe
  2⤵
  PID:5484
- C:\Windows\System\nSLBZOU.exe
  C:\Windows\System\nSLBZOU.exe
  2⤵
  PID:5444
- C:\Windows\System\JpHUAhD.exe
  C:\Windows\System\JpHUAhD.exe
  2⤵
  PID:5632
- C:\Windows\System\UHICcGm.exe
  C:\Windows\System\UHICcGm.exe
  2⤵
  PID:5700
- C:\Windows\System\FGVKiwK.exe
  C:\Windows\System\FGVKiwK.exe
  2⤵
  PID:5764
- C:\Windows\System\tiISpBo.exe
  C:\Windows\System\tiISpBo.exe
  2⤵
  PID:5848
- C:\Windows\System\aYUieWf.exe
  C:\Windows\System\aYUieWf.exe
  2⤵
  PID:1104
- C:\Windows\System\oCOrZFi.exe
  C:\Windows\System\oCOrZFi.exe
  2⤵
  PID:5540
- C:\Windows\System\jsawaDP.exe
  C:\Windows\System\jsawaDP.exe
  2⤵
  PID:5644
- C:\Windows\System\RfdZWQi.exe
  C:\Windows\System\RfdZWQi.exe
  2⤵
  PID:5652
- C:\Windows\System\VogYiWx.exe
  C:\Windows\System\VogYiWx.exe
  2⤵
  PID:5776
- C:\Windows\System\VHrwKmW.exe
  C:\Windows\System\VHrwKmW.exe
  2⤵
  PID:5920
- C:\Windows\System\VYXKeyZ.exe
  C:\Windows\System\VYXKeyZ.exe
  2⤵
  PID:6048
- C:\Windows\System\vQmtSTj.exe
  C:\Windows\System\vQmtSTj.exe
  2⤵
  PID:2588
- C:\Windows\System\RqezMII.exe
  C:\Windows\System\RqezMII.exe
  2⤵
  PID:276
- C:\Windows\System\ZzQPhJf.exe
  C:\Windows\System\ZzQPhJf.exe
  2⤵
  PID:6072
- C:\Windows\System\UKtVcAU.exe
  C:\Windows\System\UKtVcAU.exe
  2⤵
  PID:6132
- C:\Windows\System\IafuxrO.exe
  C:\Windows\System\IafuxrO.exe
  2⤵
  PID:2880
- C:\Windows\System\edKzgiz.exe
  C:\Windows\System\edKzgiz.exe
  2⤵
  PID:4380
- C:\Windows\System\mJxcPmP.exe
  C:\Windows\System\mJxcPmP.exe
  2⤵
  PID:1788
- C:\Windows\System\SELvIpi.exe
  C:\Windows\System\SELvIpi.exe
  2⤵
  PID:1260
- C:\Windows\System\SVgsIhJ.exe
  C:\Windows\System\SVgsIhJ.exe
  2⤵
  PID:3624
- C:\Windows\System\yMvUGyv.exe
  C:\Windows\System\yMvUGyv.exe
  2⤵
  PID:2472
- C:\Windows\System\SpHgKip.exe
  C:\Windows\System\SpHgKip.exe
  2⤵
  PID:1644
- C:\Windows\System\pQDANLQ.exe
  C:\Windows\System\pQDANLQ.exe
  2⤵
  PID:6000
- C:\Windows\System\oXHCZkL.exe
  C:\Windows\System\oXHCZkL.exe
  2⤵
  PID:4140
- C:\Windows\System\NtStHLy.exe
  C:\Windows\System\NtStHLy.exe
  2⤵
  PID:4472
- C:\Windows\System\vLFovxA.exe
  C:\Windows\System\vLFovxA.exe
  2⤵
  PID:1768
- C:\Windows\System\yElhHcj.exe
  C:\Windows\System\yElhHcj.exe
  2⤵
  PID:1716
- C:\Windows\System\QuRGAOy.exe
  C:\Windows\System\QuRGAOy.exe
  2⤵
  PID:5416
- C:\Windows\System\PWVvJkn.exe
  C:\Windows\System\PWVvJkn.exe
  2⤵
  PID:2920
- C:\Windows\System\fOzoRAg.exe
  C:\Windows\System\fOzoRAg.exe
  2⤵
  PID:4192
- C:\Windows\System\TYPWQEK.exe
  C:\Windows\System\TYPWQEK.exe
  2⤵
  PID:2324
- C:\Windows\System\LsgUATf.exe
  C:\Windows\System\LsgUATf.exe
  2⤵
  PID:5624
- C:\Windows\System\EvZpCUg.exe
  C:\Windows\System\EvZpCUg.exe
  2⤵
  PID:2484
- C:\Windows\System\iqoDQeX.exe
  C:\Windows\System\iqoDQeX.exe
  2⤵
  PID:2028
- C:\Windows\System\TJDeoox.exe
  C:\Windows\System\TJDeoox.exe
  2⤵
  PID:5236
- C:\Windows\System\XExGefL.exe
  C:\Windows\System\XExGefL.exe
  2⤵
  PID:5852
- C:\Windows\System\srMUuyR.exe
  C:\Windows\System\srMUuyR.exe
  2⤵
  PID:5888
- C:\Windows\System\amPjHYI.exe
  C:\Windows\System\amPjHYI.exe
  2⤵
  PID:5760
- C:\Windows\System\jdwoKWL.exe
  C:\Windows\System\jdwoKWL.exe
  2⤵
  PID:6116
- C:\Windows\System\TwGsaLR.exe
  C:\Windows\System\TwGsaLR.exe
  2⤵
  PID:5432
- C:\Windows\System\hgBHnBM.exe
  C:\Windows\System\hgBHnBM.exe
  2⤵
  PID:2188
- C:\Windows\System\ZKZsSlZ.exe
  C:\Windows\System\ZKZsSlZ.exe
  2⤵
  PID:4336
- C:\Windows\System\ksjkuVJ.exe
  C:\Windows\System\ksjkuVJ.exe
  2⤵
  PID:4784
- C:\Windows\System\NhOqFsM.exe
  C:\Windows\System\NhOqFsM.exe
  2⤵
  PID:1112
- C:\Windows\System\wGdSRzV.exe
  C:\Windows\System\wGdSRzV.exe
  2⤵
  PID:2608
- C:\Windows\System\WmzxYlR.exe
  C:\Windows\System\WmzxYlR.exe
  2⤵
  PID:5696
- C:\Windows\System\DmOauYb.exe
  C:\Windows\System\DmOauYb.exe
  2⤵
  PID:5840
- C:\Windows\System\gCawiwn.exe
  C:\Windows\System\gCawiwn.exe
  2⤵
  PID:5716
- C:\Windows\System\ktcckNF.exe
  C:\Windows\System\ktcckNF.exe
  2⤵
  PID:5332
- C:\Windows\System\fxevCBg.exe
  C:\Windows\System\fxevCBg.exe
  2⤵
  PID:4748
- C:\Windows\System\RtOEJFX.exe
  C:\Windows\System\RtOEJFX.exe
  2⤵
  PID:5972
- C:\Windows\System\JnHONbO.exe
  C:\Windows\System\JnHONbO.exe
  2⤵
  PID:5924
- C:\Windows\System\reYUYuE.exe
  C:\Windows\System\reYUYuE.exe
  2⤵
  PID:5152
- C:\Windows\System\GzjQJJW.exe
  C:\Windows\System\GzjQJJW.exe
  2⤵
  PID:2236
- C:\Windows\System\beOlaRR.exe
  C:\Windows\System\beOlaRR.exe
  2⤵
  PID:2312
- C:\Windows\System\rNvWoGK.exe
  C:\Windows\System\rNvWoGK.exe
  2⤵
  PID:3480
- C:\Windows\System\mUMxPiG.exe
  C:\Windows\System\mUMxPiG.exe
  2⤵
  PID:4040
- C:\Windows\System\dhYrAwU.exe
  C:\Windows\System\dhYrAwU.exe
  2⤵
  PID:5952
- C:\Windows\System\xNDGXps.exe
  C:\Windows\System\xNDGXps.exe
  2⤵
  PID:2792
- C:\Windows\System\wUjqGNp.exe
  C:\Windows\System\wUjqGNp.exe
  2⤵
  PID:4172
- C:\Windows\System\RFSBDHL.exe
  C:\Windows\System\RFSBDHL.exe
  2⤵
  PID:3496
- C:\Windows\System\JkcqurQ.exe
  C:\Windows\System\JkcqurQ.exe
  2⤵
  PID:2628
- C:\Windows\System\jxUtqjh.exe
  C:\Windows\System\jxUtqjh.exe
  2⤵
  PID:936
- C:\Windows\System\SJUXiix.exe
  C:\Windows\System\SJUXiix.exe
  2⤵
  PID:5984
- C:\Windows\System\wRaeeiU.exe
  C:\Windows\System\wRaeeiU.exe
  2⤵
  PID:3652
- C:\Windows\System\eQCotwH.exe
  C:\Windows\System\eQCotwH.exe
  2⤵
  PID:6160
- C:\Windows\System\rIdodZN.exe
  C:\Windows\System\rIdodZN.exe
  2⤵
  PID:6176
- C:\Windows\System\TItQmYJ.exe
  C:\Windows\System\TItQmYJ.exe
  2⤵
  PID:6192
- C:\Windows\System\YmyMhcG.exe
  C:\Windows\System\YmyMhcG.exe
  2⤵
  PID:6208
- C:\Windows\System\dHbsLvw.exe
  C:\Windows\System\dHbsLvw.exe
  2⤵
  PID:6228
- C:\Windows\System\QVtqNOj.exe
  C:\Windows\System\QVtqNOj.exe
  2⤵
  PID:6244
- C:\Windows\System\azplcCK.exe
  C:\Windows\System\azplcCK.exe
  2⤵
  PID:6260
- C:\Windows\System\asPrVCI.exe
  C:\Windows\System\asPrVCI.exe
  2⤵
  PID:6276
- C:\Windows\System\zJisBhA.exe
  C:\Windows\System\zJisBhA.exe
  2⤵
  PID:6292
- C:\Windows\System\lbjlKJN.exe
  C:\Windows\System\lbjlKJN.exe
  2⤵
  PID:6308
- C:\Windows\System\NOdDhsL.exe
  C:\Windows\System\NOdDhsL.exe
  2⤵
  PID:6324
- C:\Windows\System\gsePzvh.exe
  C:\Windows\System\gsePzvh.exe
  2⤵
  PID:6340
- C:\Windows\System\FHmcwpv.exe
  C:\Windows\System\FHmcwpv.exe
  2⤵
  PID:6356
- C:\Windows\System\kRAgMTz.exe
  C:\Windows\System\kRAgMTz.exe
  2⤵
  PID:6372
- C:\Windows\System\ILxOIIx.exe
  C:\Windows\System\ILxOIIx.exe
  2⤵
  PID:6388
- C:\Windows\System\ZYDZvpz.exe
  C:\Windows\System\ZYDZvpz.exe
  2⤵
  PID:6404
- C:\Windows\System\XLHKrvo.exe
  C:\Windows\System\XLHKrvo.exe
  2⤵
  PID:6420
- C:\Windows\System\XVmEjvF.exe
  C:\Windows\System\XVmEjvF.exe
  2⤵
  PID:6436
- C:\Windows\System\hnbribp.exe
  C:\Windows\System\hnbribp.exe
  2⤵
  PID:6456
- C:\Windows\System\cUGtaZt.exe
  C:\Windows\System\cUGtaZt.exe
  2⤵
  PID:6472
- C:\Windows\System\uzEDfJE.exe
  C:\Windows\System\uzEDfJE.exe
  2⤵
  PID:6488
- C:\Windows\System\oBqLblI.exe
  C:\Windows\System\oBqLblI.exe
  2⤵
  PID:6504
- C:\Windows\System\RfonLGB.exe
  C:\Windows\System\RfonLGB.exe
  2⤵
  PID:6520
- C:\Windows\System\NkqbZMy.exe
  C:\Windows\System\NkqbZMy.exe
  2⤵
  PID:6536
- C:\Windows\System\pxdtGgz.exe
  C:\Windows\System\pxdtGgz.exe
  2⤵
  PID:6552
- C:\Windows\System\OnrUMpV.exe
  C:\Windows\System\OnrUMpV.exe
  2⤵
  PID:6568
- C:\Windows\System\CgOBrlo.exe
  C:\Windows\System\CgOBrlo.exe
  2⤵
  PID:6584
- C:\Windows\System\WByfMuz.exe
  C:\Windows\System\WByfMuz.exe
  2⤵
  PID:6600
- C:\Windows\System\DRqMIst.exe
  C:\Windows\System\DRqMIst.exe
  2⤵
  PID:6616
- C:\Windows\System\PhjKFvv.exe
  C:\Windows\System\PhjKFvv.exe
  2⤵
  PID:6632
- C:\Windows\System\itfoObm.exe
  C:\Windows\System\itfoObm.exe
  2⤵
  PID:6648
- C:\Windows\System\NTNlPUf.exe
  C:\Windows\System\NTNlPUf.exe
  2⤵
  PID:6664
- C:\Windows\System\IdwzprS.exe
  C:\Windows\System\IdwzprS.exe
  2⤵
  PID:6680
- C:\Windows\System\lOdotFA.exe
  C:\Windows\System\lOdotFA.exe
  2⤵
  PID:6696
- C:\Windows\System\RhAjMKI.exe
  C:\Windows\System\RhAjMKI.exe
  2⤵
  PID:6712
- C:\Windows\System\JELUmQL.exe
  C:\Windows\System\JELUmQL.exe
  2⤵
  PID:6728
- C:\Windows\System\VoJWUlM.exe
  C:\Windows\System\VoJWUlM.exe
  2⤵
  PID:6744
- C:\Windows\System\DMdIRkO.exe
  C:\Windows\System\DMdIRkO.exe
  2⤵
  PID:6760
- C:\Windows\System\qQmVWWZ.exe
  C:\Windows\System\qQmVWWZ.exe
  2⤵
  PID:6776
- C:\Windows\System\DgIHLdi.exe
  C:\Windows\System\DgIHLdi.exe
  2⤵
  PID:6792
- C:\Windows\System\ofcgLtn.exe
  C:\Windows\System\ofcgLtn.exe
  2⤵
  PID:6812
- C:\Windows\System\WkUNhyy.exe
  C:\Windows\System\WkUNhyy.exe
  2⤵
  PID:6828
- C:\Windows\System\GMimjLG.exe
  C:\Windows\System\GMimjLG.exe
  2⤵
  PID:6844
- C:\Windows\System\RkVqWzA.exe
  C:\Windows\System\RkVqWzA.exe
  2⤵
  PID:6860
- C:\Windows\System\OhotYdp.exe
  C:\Windows\System\OhotYdp.exe
  2⤵
  PID:6876
- C:\Windows\System\MZhGVoM.exe
  C:\Windows\System\MZhGVoM.exe
  2⤵
  PID:6892
- C:\Windows\System\fBGihQQ.exe
  C:\Windows\System\fBGihQQ.exe
  2⤵
  PID:6908
- C:\Windows\System\BZpkajG.exe
  C:\Windows\System\BZpkajG.exe
  2⤵
  PID:6924
- C:\Windows\System\fxqPnIY.exe
  C:\Windows\System\fxqPnIY.exe
  2⤵
  PID:6940
- C:\Windows\System\WoQMCDW.exe
  C:\Windows\System\WoQMCDW.exe
  2⤵
  PID:6956
- C:\Windows\System\tEhEgtS.exe
  C:\Windows\System\tEhEgtS.exe
  2⤵
  PID:6972
- C:\Windows\System\ZQSLRjU.exe
  C:\Windows\System\ZQSLRjU.exe
  2⤵
  PID:6988
- C:\Windows\System\UmwthOm.exe
  C:\Windows\System\UmwthOm.exe
  2⤵
  PID:7004
- C:\Windows\System\SxTiIqo.exe
  C:\Windows\System\SxTiIqo.exe
  2⤵
  PID:7020
- C:\Windows\System\ayogJUE.exe
  C:\Windows\System\ayogJUE.exe
  2⤵
  PID:7036
- C:\Windows\System\CqvzCmi.exe
  C:\Windows\System\CqvzCmi.exe
  2⤵
  PID:7052
- C:\Windows\System\JzQBWEQ.exe
  C:\Windows\System\JzQBWEQ.exe
  2⤵
  PID:7068
- C:\Windows\System\UhpGfBs.exe
  C:\Windows\System\UhpGfBs.exe
  2⤵
  PID:7084
- C:\Windows\System\ATVSRal.exe
  C:\Windows\System\ATVSRal.exe
  2⤵
  PID:7100
- C:\Windows\System\OYuucDH.exe
  C:\Windows\System\OYuucDH.exe
  2⤵
  PID:7116
- C:\Windows\System\ltCyOgI.exe
  C:\Windows\System\ltCyOgI.exe
  2⤵
  PID:7132
- C:\Windows\System\ESjewvf.exe
  C:\Windows\System\ESjewvf.exe
  2⤵
  PID:7148
- C:\Windows\System\sAoGwVD.exe
  C:\Windows\System\sAoGwVD.exe
  2⤵
  PID:7164
- C:\Windows\System\nvDoakO.exe
  C:\Windows\System\nvDoakO.exe
  2⤵
  PID:6184
- C:\Windows\System\LqITLEN.exe
  C:\Windows\System\LqITLEN.exe
  2⤵
  PID:6224
- C:\Windows\System\JtJpQqL.exe
  C:\Windows\System\JtJpQqL.exe
  2⤵
  PID:6288
- C:\Windows\System\KQfppXm.exe
  C:\Windows\System\KQfppXm.exe
  2⤵
  PID:6352
- C:\Windows\System\ARPzhMb.exe
  C:\Windows\System\ARPzhMb.exe
  2⤵
  PID:6416
- C:\Windows\System\fxSZwCG.exe
  C:\Windows\System\fxSZwCG.exe
  2⤵
  PID:6484
- C:\Windows\System\QuEKYog.exe
  C:\Windows\System\QuEKYog.exe
  2⤵
  PID:6516
- C:\Windows\System\HuVzmGP.exe
  C:\Windows\System\HuVzmGP.exe
  2⤵
  PID:6580
- C:\Windows\System\YTtuGSn.exe
  C:\Windows\System\YTtuGSn.exe
  2⤵
  PID:6612
- C:\Windows\System\suFFZOL.exe
  C:\Windows\System\suFFZOL.exe
  2⤵
  PID:6676
- C:\Windows\System\qMRgUNk.exe
  C:\Windows\System\qMRgUNk.exe
  2⤵
  PID:6740
- C:\Windows\System\EzWBitv.exe
  C:\Windows\System\EzWBitv.exe
  2⤵
  PID:6808
- C:\Windows\System\KKRnbEh.exe
  C:\Windows\System\KKRnbEh.exe
  2⤵
  PID:6872
- C:\Windows\System\uVSoasz.exe
  C:\Windows\System\uVSoasz.exe
  2⤵
  PID:6932
- C:\Windows\System\zVmAVYA.exe
  C:\Windows\System\zVmAVYA.exe
  2⤵
  PID:6364
- C:\Windows\System\ikYIfst.exe
  C:\Windows\System\ikYIfst.exe
  2⤵
  PID:7032
- C:\Windows\System\AVZKwNC.exe
  C:\Windows\System\AVZKwNC.exe
  2⤵
  PID:5664
- C:\Windows\System\nsNKLxu.exe
  C:\Windows\System\nsNKLxu.exe
  2⤵
  PID:6624
- C:\Windows\System\BDvgFeR.exe
  C:\Windows\System\BDvgFeR.exe
  2⤵
  PID:5876
- C:\Windows\System\FEcJrlZ.exe
  C:\Windows\System\FEcJrlZ.exe
  2⤵
  PID:1792
- C:\Windows\System\ZNqKPSJ.exe
  C:\Windows\System\ZNqKPSJ.exe
  2⤵
  PID:6336
- C:\Windows\System\uIqxysW.exe
  C:\Windows\System\uIqxysW.exe
  2⤵
  PID:6532
- C:\Windows\System\zioGWRm.exe
  C:\Windows\System\zioGWRm.exe
  2⤵
  PID:5448
- C:\Windows\System\ZQwZaiH.exe
  C:\Windows\System\ZQwZaiH.exe
  2⤵
  PID:3892
- C:\Windows\System\WVoReVl.exe
  C:\Windows\System\WVoReVl.exe
  2⤵
  PID:4908
- C:\Windows\System\JcxvuJH.exe
  C:\Windows\System\JcxvuJH.exe
  2⤵
  PID:6088
- C:\Windows\System\rLCWcPi.exe
  C:\Windows\System\rLCWcPi.exe
  2⤵
  PID:5592
- C:\Windows\System\pEUOpIW.exe
  C:\Windows\System\pEUOpIW.exe
  2⤵
  PID:6240
- C:\Windows\System\cAHtsKM.exe
  C:\Windows\System\cAHtsKM.exe
  2⤵
  PID:6304
- C:\Windows\System\HZzDRha.exe
  C:\Windows\System\HZzDRha.exe
  2⤵
  PID:6400
- C:\Windows\System\NdaQNwd.exe
  C:\Windows\System\NdaQNwd.exe
  2⤵
  PID:6468
- C:\Windows\System\LHVuklb.exe
  C:\Windows\System\LHVuklb.exe
  2⤵
  PID:6596
- C:\Windows\System\vaXkvPP.exe
  C:\Windows\System\vaXkvPP.exe
  2⤵
  PID:6720
- C:\Windows\System\oNbNvCD.exe
  C:\Windows\System\oNbNvCD.exe
  2⤵
  PID:6784
- C:\Windows\System\otNNVPS.exe
  C:\Windows\System\otNNVPS.exe
  2⤵
  PID:6824
- C:\Windows\System\ZYqMtJV.exe
  C:\Windows\System\ZYqMtJV.exe
  2⤵
  PID:6888
- C:\Windows\System\dpCiurT.exe
  C:\Windows\System\dpCiurT.exe
  2⤵
  PID:6952
- C:\Windows\System\GARsAew.exe
  C:\Windows\System\GARsAew.exe
  2⤵
  PID:7016
- C:\Windows\System\KXFmxRm.exe
  C:\Windows\System\KXFmxRm.exe
  2⤵
  PID:7080
- C:\Windows\System\AvuLXbs.exe
  C:\Windows\System\AvuLXbs.exe
  2⤵
  PID:7156
- C:\Windows\System\tqYZahR.exe
  C:\Windows\System\tqYZahR.exe
  2⤵
  PID:6320
- C:\Windows\System\DFaNdjr.exe
  C:\Windows\System\DFaNdjr.exe
  2⤵
  PID:6548
- C:\Windows\System\VLLFHcv.exe
  C:\Windows\System\VLLFHcv.exe
  2⤵
  PID:6772
- C:\Windows\System\Dqshzyn.exe
  C:\Windows\System\Dqshzyn.exe
  2⤵
  PID:7000
- C:\Windows\System\MyUrUho.exe
  C:\Windows\System\MyUrUho.exe
  2⤵
  PID:5864
- C:\Windows\System\EOXlboB.exe
  C:\Windows\System\EOXlboB.exe
  2⤵
  PID:6528
- C:\Windows\System\cBTLcrK.exe
  C:\Windows\System\cBTLcrK.exe
  2⤵
  PID:5384
- C:\Windows\System\ZNvqIDw.exe
  C:\Windows\System\ZNvqIDw.exe
  2⤵
  PID:6368
- C:\Windows\System\frIDbQb.exe
  C:\Windows\System\frIDbQb.exe
  2⤵
  PID:2464
- C:\Windows\System\eVJpgqB.exe
  C:\Windows\System\eVJpgqB.exe
  2⤵
  PID:6856
- C:\Windows\System\keQwxCN.exe
  C:\Windows\System\keQwxCN.exe
  2⤵
  PID:7012
- C:\Windows\System\dAlJTDi.exe
  C:\Windows\System\dAlJTDi.exe
  2⤵
  PID:6156
- C:\Windows\System\BrrHmzj.exe
  C:\Windows\System\BrrHmzj.exe
  2⤵
  PID:6412
- C:\Windows\System\LofhbXe.exe
  C:\Windows\System\LofhbXe.exe
  2⤵
  PID:6736
- C:\Windows\System\fIjsDxt.exe
  C:\Windows\System\fIjsDxt.exe
  2⤵
  PID:6660
- C:\Windows\System\TeFzCdP.exe
  C:\Windows\System\TeFzCdP.exe
  2⤵
  PID:2972
- C:\Windows\System\raIQYnF.exe
  C:\Windows\System\raIQYnF.exe
  2⤵
  PID:6432
- C:\Windows\System\TCvEYqF.exe
  C:\Windows\System\TCvEYqF.exe
  2⤵
  PID:6840
- C:\Windows\System\PmFmGEb.exe
  C:\Windows\System\PmFmGEb.exe
  2⤵
  PID:6692
- C:\Windows\System\hcklSDw.exe
  C:\Windows\System\hcklSDw.exe
  2⤵
  PID:1724
- C:\Windows\System\pPzhCoR.exe
  C:\Windows\System\pPzhCoR.exe
  2⤵
  PID:6300
- C:\Windows\System\txtkcQd.exe
  C:\Windows\System\txtkcQd.exe
  2⤵
  PID:6820
- C:\Windows\System\zTXsUJu.exe
  C:\Windows\System\zTXsUJu.exe
  2⤵
  PID:6560
- C:\Windows\System\IsoOzaO.exe
  C:\Windows\System\IsoOzaO.exe
  2⤵
  PID:6256
- C:\Windows\System\DqplaJW.exe
  C:\Windows\System\DqplaJW.exe
  2⤵
  PID:6272
- C:\Windows\System\HjaDFaI.exe
  C:\Windows\System\HjaDFaI.exe
  2⤵
  PID:6500
- C:\Windows\System\IDESovd.exe
  C:\Windows\System\IDESovd.exe
  2⤵
  PID:6480
- C:\Windows\System\JSHZTDz.exe
  C:\Windows\System\JSHZTDz.exe
  2⤵
  PID:6688
- C:\Windows\System\TcYEZPa.exe
  C:\Windows\System\TcYEZPa.exe
  2⤵
  PID:7096
- C:\Windows\System\NCapbdc.exe
  C:\Windows\System\NCapbdc.exe
  2⤵
  PID:5008
- C:\Windows\System\mvOmAfv.exe
  C:\Windows\System\mvOmAfv.exe
  2⤵
  PID:5316
- C:\Windows\System\qSwNyxy.exe
  C:\Windows\System\qSwNyxy.exe
  2⤵
  PID:2956
- C:\Windows\System\OUgEqyh.exe
  C:\Windows\System\OUgEqyh.exe
  2⤵
  PID:7144
- C:\Windows\System\AvrPpCb.exe
  C:\Windows\System\AvrPpCb.exe
  2⤵
  PID:7184
- C:\Windows\System\nMgNigX.exe
  C:\Windows\System\nMgNigX.exe
  2⤵
  PID:7200
- C:\Windows\System\HepSCuf.exe
  C:\Windows\System\HepSCuf.exe
  2⤵
  PID:7216
- C:\Windows\System\fMJZvyC.exe
  C:\Windows\System\fMJZvyC.exe
  2⤵
  PID:7232
- C:\Windows\System\LJksGUW.exe
  C:\Windows\System\LJksGUW.exe
  2⤵
  PID:7248
- C:\Windows\System\QNMqaQr.exe
  C:\Windows\System\QNMqaQr.exe
  2⤵
  PID:7268
- C:\Windows\System\zSCealL.exe
  C:\Windows\System\zSCealL.exe
  2⤵
  PID:7284
- C:\Windows\System\QocrkcB.exe
  C:\Windows\System\QocrkcB.exe
  2⤵
  PID:7300
- C:\Windows\System\pSKOAuK.exe
  C:\Windows\System\pSKOAuK.exe
  2⤵
  PID:7316
- C:\Windows\System\TcyrJQf.exe
  C:\Windows\System\TcyrJQf.exe
  2⤵
  PID:7332
- C:\Windows\System\ibTujvl.exe
  C:\Windows\System\ibTujvl.exe
  2⤵
  PID:7348
- C:\Windows\System\FSdZJQm.exe
  C:\Windows\System\FSdZJQm.exe
  2⤵
  PID:7364
- C:\Windows\System\mmlbIfP.exe
  C:\Windows\System\mmlbIfP.exe
  2⤵
  PID:7380
- C:\Windows\System\LjvvpbZ.exe
  C:\Windows\System\LjvvpbZ.exe
  2⤵
  PID:7396
- C:\Windows\System\DJNJKEE.exe
  C:\Windows\System\DJNJKEE.exe
  2⤵
  PID:7412
- C:\Windows\System\bUsdSes.exe
  C:\Windows\System\bUsdSes.exe
  2⤵
  PID:7428
- C:\Windows\System\JGEfrXx.exe
  C:\Windows\System\JGEfrXx.exe
  2⤵
  PID:7444
- C:\Windows\System\oCDrOYr.exe
  C:\Windows\System\oCDrOYr.exe
  2⤵
  PID:7460
- C:\Windows\System\FqgLqLT.exe
  C:\Windows\System\FqgLqLT.exe
  2⤵
  PID:7476
- C:\Windows\System\AbbUQcm.exe
  C:\Windows\System\AbbUQcm.exe
  2⤵
  PID:7492
- C:\Windows\System\nAlpdeK.exe
  C:\Windows\System\nAlpdeK.exe
  2⤵
  PID:7508
- C:\Windows\System\umtvLPB.exe
  C:\Windows\System\umtvLPB.exe
  2⤵
  PID:7524
- C:\Windows\System\HcfEjBN.exe
  C:\Windows\System\HcfEjBN.exe
  2⤵
  PID:7540
- C:\Windows\System\JPSmWjR.exe
  C:\Windows\System\JPSmWjR.exe
  2⤵
  PID:7556
- C:\Windows\System\HFrUpTZ.exe
  C:\Windows\System\HFrUpTZ.exe
  2⤵
  PID:7572
- C:\Windows\System\TrOMDUD.exe
  C:\Windows\System\TrOMDUD.exe
  2⤵
  PID:7588
- C:\Windows\System\UpRIgcx.exe
  C:\Windows\System\UpRIgcx.exe
  2⤵
  PID:7604
- C:\Windows\System\zehRfcB.exe
  C:\Windows\System\zehRfcB.exe
  2⤵
  PID:7620
- C:\Windows\System\mpGWnTD.exe
  C:\Windows\System\mpGWnTD.exe
  2⤵
  PID:7636
- C:\Windows\System\geuRNTc.exe
  C:\Windows\System\geuRNTc.exe
  2⤵
  PID:7652
- C:\Windows\System\UftKZbE.exe
  C:\Windows\System\UftKZbE.exe
  2⤵
  PID:7668
- C:\Windows\System\fJiOLVf.exe
  C:\Windows\System\fJiOLVf.exe
  2⤵
  PID:7684
- C:\Windows\System\gqwYIHg.exe
  C:\Windows\System\gqwYIHg.exe
  2⤵
  PID:7700
- C:\Windows\System\ZLLMsdY.exe
  C:\Windows\System\ZLLMsdY.exe
  2⤵
  PID:7716
- C:\Windows\System\YCYoKFl.exe
  C:\Windows\System\YCYoKFl.exe
  2⤵
  PID:7732
- C:\Windows\System\SUTGrVv.exe
  C:\Windows\System\SUTGrVv.exe
  2⤵
  PID:7748
- C:\Windows\System\tpIQAMo.exe
  C:\Windows\System\tpIQAMo.exe
  2⤵
  PID:7764
- C:\Windows\System\uJBNTzZ.exe
  C:\Windows\System\uJBNTzZ.exe
  2⤵
  PID:7780
- C:\Windows\System\JcmXsjo.exe
  C:\Windows\System\JcmXsjo.exe
  2⤵
  PID:7796
- C:\Windows\System\tQJBmqn.exe
  C:\Windows\System\tQJBmqn.exe
  2⤵
  PID:7812
- C:\Windows\System\QAdYtaE.exe
  C:\Windows\System\QAdYtaE.exe
  2⤵
  PID:7828
- C:\Windows\System\mCmWfEU.exe
  C:\Windows\System\mCmWfEU.exe
  2⤵
  PID:7844
- C:\Windows\System\SFuWbRq.exe
  C:\Windows\System\SFuWbRq.exe
  2⤵
  PID:7860
- C:\Windows\System\sysoAxb.exe
  C:\Windows\System\sysoAxb.exe
  2⤵
  PID:7932
- C:\Windows\System\eLUMsUR.exe
  C:\Windows\System\eLUMsUR.exe
  2⤵
  PID:8064
- C:\Windows\System\ffrXGer.exe
  C:\Windows\System\ffrXGer.exe
  2⤵
  PID:8080
- C:\Windows\System\rXdjUQh.exe
  C:\Windows\System\rXdjUQh.exe
  2⤵
  PID:8096
- C:\Windows\System\BgTkhkT.exe
  C:\Windows\System\BgTkhkT.exe
  2⤵
  PID:8112
- C:\Windows\System\TIWQzeU.exe
  C:\Windows\System\TIWQzeU.exe
  2⤵
  PID:8128
- C:\Windows\System\DSrpvEq.exe
  C:\Windows\System\DSrpvEq.exe
  2⤵
  PID:8148
- C:\Windows\System\HjNjGkH.exe
  C:\Windows\System\HjNjGkH.exe
  2⤵
  PID:8164
- C:\Windows\System\OnvkFro.exe
  C:\Windows\System\OnvkFro.exe
  2⤵
  PID:8184
- C:\Windows\System\GTauCZx.exe
  C:\Windows\System\GTauCZx.exe
  2⤵
  PID:6152
- C:\Windows\System\VkhTzND.exe
  C:\Windows\System\VkhTzND.exe
  2⤵
  PID:6804
- C:\Windows\System\TLoXKds.exe
  C:\Windows\System\TLoXKds.exe
  2⤵
  PID:7240
- C:\Windows\System\YwdFoXb.exe
  C:\Windows\System\YwdFoXb.exe
  2⤵
  PID:7308
- C:\Windows\System\BFnMkCK.exe
  C:\Windows\System\BFnMkCK.exe
  2⤵
  PID:7344
- C:\Windows\System\ggMtYpS.exe
  C:\Windows\System\ggMtYpS.exe
  2⤵
  PID:7408
- C:\Windows\System\tqBYDaL.exe
  C:\Windows\System\tqBYDaL.exe
  2⤵
  PID:6756
- C:\Windows\System\xnBpuLy.exe
  C:\Windows\System\xnBpuLy.exe
  2⤵
  PID:7224
- C:\Windows\System\ZNcQBkx.exe
  C:\Windows\System\ZNcQBkx.exe
  2⤵
  PID:7388
- C:\Windows\System\fQoARVb.exe
  C:\Windows\System\fQoARVb.exe
  2⤵
  PID:6448
- C:\Windows\System\LKfUmND.exe
  C:\Windows\System\LKfUmND.exe
  2⤵
  PID:7484
- C:\Windows\System\tHhFsuS.exe
  C:\Windows\System\tHhFsuS.exe
  2⤵
  PID:7392
- C:\Windows\System\GxxKyvi.exe
  C:\Windows\System\GxxKyvi.exe
  2⤵
  PID:7264
- C:\Windows\System\pNVyWoq.exe
  C:\Windows\System\pNVyWoq.exe
  2⤵
  PID:7328
- C:\Windows\System\nGBuMDS.exe
  C:\Windows\System\nGBuMDS.exe
  2⤵
  PID:7760
- C:\Windows\System\qqvEsjp.exe
  C:\Windows\System\qqvEsjp.exe
  2⤵
  PID:7456
- C:\Windows\System\tzXCxEd.exe
  C:\Windows\System\tzXCxEd.exe
  2⤵
  PID:7712
- C:\Windows\System\QNyMEek.exe
  C:\Windows\System\QNyMEek.exe
  2⤵
  PID:7552
- C:\Windows\System\LQghLJH.exe
  C:\Windows\System\LQghLJH.exe
  2⤵
  PID:7776
- C:\Windows\System\xGGOvwn.exe
  C:\Windows\System\xGGOvwn.exe
  2⤵
  PID:7744
- C:\Windows\System\OUXUepY.exe
  C:\Windows\System\OUXUepY.exe
  2⤵
  PID:7836
- C:\Windows\System\WXvVUum.exe
  C:\Windows\System\WXvVUum.exe
  2⤵
  PID:7880
- C:\Windows\System\TYDKBmM.exe
  C:\Windows\System\TYDKBmM.exe
  2⤵
  PID:7892
- C:\Windows\System\PTDQXVB.exe
  C:\Windows\System\PTDQXVB.exe
  2⤵
  PID:7900
- C:\Windows\System\MmqnIiQ.exe
  C:\Windows\System\MmqnIiQ.exe
  2⤵
  PID:7916
- C:\Windows\System\HwZtwQW.exe
  C:\Windows\System\HwZtwQW.exe
  2⤵
  PID:7968
- C:\Windows\System\tBtCeYy.exe
  C:\Windows\System\tBtCeYy.exe
  2⤵
  PID:8032
- C:\Windows\System\tWppgXX.exe
  C:\Windows\System\tWppgXX.exe
  2⤵
  PID:7964
- C:\Windows\System\fhinIUh.exe
  C:\Windows\System\fhinIUh.exe
  2⤵
  PID:7992
- C:\Windows\System\HvZvCCo.exe
  C:\Windows\System\HvZvCCo.exe
  2⤵
  PID:8012
- C:\Windows\System\RrOLNqc.exe
  C:\Windows\System\RrOLNqc.exe
  2⤵
  PID:8028
- C:\Windows\System\LOPBdhr.exe
  C:\Windows\System\LOPBdhr.exe
  2⤵
  PID:8052
- C:\Windows\System\wNIvfve.exe
  C:\Windows\System\wNIvfve.exe
  2⤵
  PID:8108
- C:\Windows\System\lbAuFcr.exe
  C:\Windows\System\lbAuFcr.exe
  2⤵
  PID:8172
- C:\Windows\System\FOUUrLG.exe
  C:\Windows\System\FOUUrLG.exe
  2⤵
  PID:8176
- C:\Windows\System\YmyEXmn.exe
  C:\Windows\System\YmyEXmn.exe
  2⤵
  PID:7404
- C:\Windows\System\ZBioYbS.exe
  C:\Windows\System\ZBioYbS.exe
  2⤵
  PID:7424
- C:\Windows\System\bWBfbFd.exe
  C:\Windows\System\bWBfbFd.exe
  2⤵
  PID:8140
- C:\Windows\System\pZhLRgV.exe
  C:\Windows\System\pZhLRgV.exe
  2⤵
  PID:8156
- C:\Windows\System\UfotkjE.exe
  C:\Windows\System\UfotkjE.exe
  2⤵
  PID:7944
- C:\Windows\System\ktEaQwC.exe
  C:\Windows\System\ktEaQwC.exe
  2⤵
  PID:1580
- C:\Windows\System\oylqGsL.exe
  C:\Windows\System\oylqGsL.exe
  2⤵
  PID:7468
- C:\Windows\System\fXsWzpJ.exe
  C:\Windows\System\fXsWzpJ.exe
  2⤵
  PID:7600
- C:\Windows\System\mDubTJA.exe
  C:\Windows\System\mDubTJA.exe
  2⤵
  PID:7660
- C:\Windows\System\XAewveg.exe
  C:\Windows\System\XAewveg.exe
  2⤵
  PID:7724
- C:\Windows\System\pOBuTrB.exe
  C:\Windows\System\pOBuTrB.exe
  2⤵
  PID:6788
- C:\Windows\System\uDgVEMx.exe
  C:\Windows\System\uDgVEMx.exe
  2⤵
  PID:7756
- C:\Windows\System\yimharW.exe
  C:\Windows\System\yimharW.exe
  2⤵
  PID:7584
- C:\Windows\System\IzGuloH.exe
  C:\Windows\System\IzGuloH.exe
  2⤵
  PID:7884
- C:\Windows\System\stbkfWK.exe
  C:\Windows\System\stbkfWK.exe
  2⤵
  PID:7988
- C:\Windows\System\MsWxdGz.exe
  C:\Windows\System\MsWxdGz.exe
  2⤵
  PID:8020
- C:\Windows\System\QWjmUIU.exe
  C:\Windows\System\QWjmUIU.exe
  2⤵
  PID:7324
- C:\Windows\System\AwrwbAV.exe
  C:\Windows\System\AwrwbAV.exe
  2⤵
  PID:7740
- C:\Windows\System\toFsLuK.exe
  C:\Windows\System\toFsLuK.exe
  2⤵
  PID:7876
- C:\Windows\System\QxJunEJ.exe
  C:\Windows\System\QxJunEJ.exe
  2⤵
  PID:7956
- C:\Windows\System\pBIeyFw.exe
  C:\Windows\System\pBIeyFw.exe
  2⤵
  PID:8008
- C:\Windows\System\tweCAdI.exe
  C:\Windows\System\tweCAdI.exe
  2⤵
  PID:8072
- C:\Windows\System\eeHMjdC.exe
  C:\Windows\System\eeHMjdC.exe
  2⤵
  PID:8076
- C:\Windows\System\lwEtyKM.exe
  C:\Windows\System\lwEtyKM.exe
  2⤵
  PID:7420
- C:\Windows\System\YJzAhxm.exe
  C:\Windows\System\YJzAhxm.exe
  2⤵
  PID:7192
- C:\Windows\System\TjhZOgg.exe
  C:\Windows\System\TjhZOgg.exe
  2⤵
  PID:7180
- C:\Windows\System\PNCKnrE.exe
  C:\Windows\System\PNCKnrE.exe
  2⤵
  PID:7564
- C:\Windows\System\FtblcZa.exe
  C:\Windows\System\FtblcZa.exe
  2⤵
  PID:6904
- C:\Windows\System\eWaBkdl.exe
  C:\Windows\System\eWaBkdl.exe
  2⤵
  PID:6384
- C:\Windows\System\PfAPWKh.exe
  C:\Windows\System\PfAPWKh.exe
  2⤵
  PID:7912
- C:\Windows\System\OtQkcXy.exe
  C:\Windows\System\OtQkcXy.exe
  2⤵
  PID:7664
- C:\Windows\System\FvIhVDr.exe
  C:\Windows\System\FvIhVDr.exe
  2⤵
  PID:7824
- C:\Windows\System\xwGMEpD.exe
  C:\Windows\System\xwGMEpD.exe
  2⤵
  PID:7260
- C:\Windows\System\SzzOXZJ.exe
  C:\Windows\System\SzzOXZJ.exe
  2⤵
  PID:4996
- C:\Windows\System\cyVTiaf.exe
  C:\Windows\System\cyVTiaf.exe
  2⤵
  PID:7984
- C:\Windows\System\SNALqSb.exe
  C:\Windows\System\SNALqSb.exe
  2⤵
  PID:8208
- C:\Windows\System\lOZIUpc.exe
  C:\Windows\System\lOZIUpc.exe
  2⤵
  PID:8224
- C:\Windows\System\MqHGNTy.exe
  C:\Windows\System\MqHGNTy.exe
  2⤵
  PID:8240
- C:\Windows\System\iiOXiRq.exe
  C:\Windows\System\iiOXiRq.exe
  2⤵
  PID:8256
- C:\Windows\System\bCiBqwN.exe
  C:\Windows\System\bCiBqwN.exe
  2⤵
  PID:8272
- C:\Windows\System\UUsVmOY.exe
  C:\Windows\System\UUsVmOY.exe
  2⤵
  PID:8288
- C:\Windows\System\HXuOYza.exe
  C:\Windows\System\HXuOYza.exe
  2⤵
  PID:8304
- C:\Windows\System\kNIlsvc.exe
  C:\Windows\System\kNIlsvc.exe
  2⤵
  PID:8320
- C:\Windows\System\DBXteIk.exe
  C:\Windows\System\DBXteIk.exe
  2⤵
  PID:8336
- C:\Windows\System\HAaYRKu.exe
  C:\Windows\System\HAaYRKu.exe
  2⤵
  PID:8352
- C:\Windows\System\IEoMLYw.exe
  C:\Windows\System\IEoMLYw.exe
  2⤵
  PID:8368
- C:\Windows\System\mtfgeJS.exe
  C:\Windows\System\mtfgeJS.exe
  2⤵
  PID:8384
- C:\Windows\System\ZNxCgbo.exe
  C:\Windows\System\ZNxCgbo.exe
  2⤵
  PID:8400
- C:\Windows\System\yhRNYgl.exe
  C:\Windows\System\yhRNYgl.exe
  2⤵
  PID:8416
- C:\Windows\System\pmkyFqr.exe
  C:\Windows\System\pmkyFqr.exe
  2⤵
  PID:8432
- C:\Windows\System\BkhuKhc.exe
  C:\Windows\System\BkhuKhc.exe
  2⤵
  PID:8448
- C:\Windows\System\tGRBlgL.exe
  C:\Windows\System\tGRBlgL.exe
  2⤵
  PID:8464
- C:\Windows\System\scVJGUB.exe
  C:\Windows\System\scVJGUB.exe
  2⤵
  PID:8480
- C:\Windows\System\KtVnnxd.exe
  C:\Windows\System\KtVnnxd.exe
  2⤵
  PID:8496
- C:\Windows\System\NaqwtCk.exe
  C:\Windows\System\NaqwtCk.exe
  2⤵
  PID:8512
- C:\Windows\System\cOoYCSO.exe
  C:\Windows\System\cOoYCSO.exe
  2⤵
  PID:8528
- C:\Windows\System\QlsAxUd.exe
  C:\Windows\System\QlsAxUd.exe
  2⤵
  PID:8544
- C:\Windows\System\XfZxOTO.exe
  C:\Windows\System\XfZxOTO.exe
  2⤵
  PID:8560
- C:\Windows\System\tGlbpck.exe
  C:\Windows\System\tGlbpck.exe
  2⤵
  PID:8576
- C:\Windows\System\ddNafZp.exe
  C:\Windows\System\ddNafZp.exe
  2⤵
  PID:8592
- C:\Windows\System\QGiWjbQ.exe
  C:\Windows\System\QGiWjbQ.exe
  2⤵
  PID:8608
- C:\Windows\System\SYaXosF.exe
  C:\Windows\System\SYaXosF.exe
  2⤵
  PID:8624
- C:\Windows\System\wAyDsPT.exe
  C:\Windows\System\wAyDsPT.exe
  2⤵
  PID:8640
- C:\Windows\System\KsSxTHD.exe
  C:\Windows\System\KsSxTHD.exe
  2⤵
  PID:8656
- C:\Windows\System\TjNkfmB.exe
  C:\Windows\System\TjNkfmB.exe
  2⤵
  PID:8672
- C:\Windows\System\JNsYkQX.exe
  C:\Windows\System\JNsYkQX.exe
  2⤵
  PID:8688
- C:\Windows\System\vIhBDPe.exe
  C:\Windows\System\vIhBDPe.exe
  2⤵
  PID:8708
- C:\Windows\System\mKnVeXR.exe
  C:\Windows\System\mKnVeXR.exe
  2⤵
  PID:8724
- C:\Windows\System\rIWyCFl.exe
  C:\Windows\System\rIWyCFl.exe
  2⤵
  PID:8740
- C:\Windows\System\CXFOMNJ.exe
  C:\Windows\System\CXFOMNJ.exe
  2⤵
  PID:8756
- C:\Windows\System\CBZXIfs.exe
  C:\Windows\System\CBZXIfs.exe
  2⤵
  PID:8772
- C:\Windows\System\gLynuMc.exe
  C:\Windows\System\gLynuMc.exe
  2⤵
  PID:8788
- C:\Windows\System\OHPzJxF.exe
  C:\Windows\System\OHPzJxF.exe
  2⤵
  PID:8804
- C:\Windows\System\SSnJbSQ.exe
  C:\Windows\System\SSnJbSQ.exe
  2⤵
  PID:8820
- C:\Windows\System\SicTltt.exe
  C:\Windows\System\SicTltt.exe
  2⤵
  PID:8836
- C:\Windows\System\VLrWxXe.exe
  C:\Windows\System\VLrWxXe.exe
  2⤵
  PID:8852
- C:\Windows\System\VFUqiTX.exe
  C:\Windows\System\VFUqiTX.exe
  2⤵
  PID:8868
- C:\Windows\System\DimXnoB.exe
  C:\Windows\System\DimXnoB.exe
  2⤵
  PID:8884
- C:\Windows\System\HVogQrN.exe
  C:\Windows\System\HVogQrN.exe
  2⤵
  PID:8900
- C:\Windows\System\OgtQern.exe
  C:\Windows\System\OgtQern.exe
  2⤵
  PID:8916
- C:\Windows\System\gPHXMhf.exe
  C:\Windows\System\gPHXMhf.exe
  2⤵
  PID:8932
- C:\Windows\System\LcaquUT.exe
  C:\Windows\System\LcaquUT.exe
  2⤵
  PID:8948
- C:\Windows\System\VImdSRr.exe
  C:\Windows\System\VImdSRr.exe
  2⤵
  PID:8964
- C:\Windows\System\CnGtxGD.exe
  C:\Windows\System\CnGtxGD.exe
  2⤵
  PID:8980
- C:\Windows\System\ucYSVXo.exe
  C:\Windows\System\ucYSVXo.exe
  2⤵
  PID:8996
- C:\Windows\System\mohrWaL.exe
  C:\Windows\System\mohrWaL.exe
  2⤵
  PID:9012
- C:\Windows\System\TOCFnqQ.exe
  C:\Windows\System\TOCFnqQ.exe
  2⤵
  PID:9028
- C:\Windows\System\ONoPapE.exe
  C:\Windows\System\ONoPapE.exe
  2⤵
  PID:9044
- C:\Windows\System\azQiXSc.exe
  C:\Windows\System\azQiXSc.exe
  2⤵
  PID:9060
- C:\Windows\System\hiPLrEL.exe
  C:\Windows\System\hiPLrEL.exe
  2⤵
  PID:9076
- C:\Windows\System\MFfXWnq.exe
  C:\Windows\System\MFfXWnq.exe
  2⤵
  PID:9092
- C:\Windows\System\UwvhVOV.exe
  C:\Windows\System\UwvhVOV.exe
  2⤵
  PID:9108
- C:\Windows\System\ltmDsAY.exe
  C:\Windows\System\ltmDsAY.exe
  2⤵
  PID:9124
- C:\Windows\System\phFngTk.exe
  C:\Windows\System\phFngTk.exe
  2⤵
  PID:9140
- C:\Windows\System\WaWFNIq.exe
  C:\Windows\System\WaWFNIq.exe
  2⤵
  PID:9156
- C:\Windows\System\dTzYOaz.exe
  C:\Windows\System\dTzYOaz.exe
  2⤵
  PID:9172
- C:\Windows\System\DqGaITf.exe
  C:\Windows\System\DqGaITf.exe
  2⤵
  PID:9188
- C:\Windows\System\lZMyzJJ.exe
  C:\Windows\System\lZMyzJJ.exe
  2⤵
  PID:9204
- C:\Windows\System\pDBpykM.exe
  C:\Windows\System\pDBpykM.exe
  2⤵
  PID:7296
- C:\Windows\System\PNRcUdD.exe
  C:\Windows\System\PNRcUdD.exe
  2⤵
  PID:7680
- C:\Windows\System\sBZIWGw.exe
  C:\Windows\System\sBZIWGw.exe
  2⤵
  PID:7980
- C:\Windows\System\VFQvQjz.exe
  C:\Windows\System\VFQvQjz.exe
  2⤵
  PID:7616
- C:\Windows\System\wbfaIXd.exe
  C:\Windows\System\wbfaIXd.exe
  2⤵
  PID:8056
- C:\Windows\System\yaAvopF.exe
  C:\Windows\System\yaAvopF.exe
  2⤵
  PID:8248
- C:\Windows\System\kDwMVGF.exe
  C:\Windows\System\kDwMVGF.exe
  2⤵
  PID:6656
- C:\Windows\System\bpjHCwr.exe
  C:\Windows\System\bpjHCwr.exe
  2⤵
  PID:7920
- C:\Windows\System\bmkoNXK.exe
  C:\Windows\System\bmkoNXK.exe
  2⤵
  PID:8280
- C:\Windows\System\MiGnheG.exe
  C:\Windows\System\MiGnheG.exe
  2⤵
  PID:8312
- C:\Windows\System\MrcFjPc.exe
  C:\Windows\System\MrcFjPc.exe
  2⤵
  PID:8328
- C:\Windows\System\fiPlzMu.exe
  C:\Windows\System\fiPlzMu.exe
  2⤵
  PID:8296
- C:\Windows\System\vVQxGnt.exe
  C:\Windows\System\vVQxGnt.exe
  2⤵
  PID:8440
- C:\Windows\System\ufqfBCH.exe
  C:\Windows\System\ufqfBCH.exe
  2⤵
  PID:8396
- C:\Windows\System\UXpTkkb.exe
  C:\Windows\System\UXpTkkb.exe
  2⤵
  PID:8488
- C:\Windows\System\zEAyAVc.exe
  C:\Windows\System\zEAyAVc.exe
  2⤵
  PID:8520
- C:\Windows\System\hksXmDh.exe
  C:\Windows\System\hksXmDh.exe
  2⤵
  PID:8504
- C:\Windows\System\LTgURrO.exe
  C:\Windows\System\LTgURrO.exe
  2⤵
  PID:8600
- C:\Windows\System\HdDbVhj.exe
  C:\Windows\System\HdDbVhj.exe
  2⤵
  PID:8636
- C:\Windows\System\IyOSdVe.exe
  C:\Windows\System\IyOSdVe.exe
  2⤵
  PID:8736
- C:\Windows\System\JHTImKZ.exe
  C:\Windows\System\JHTImKZ.exe
  2⤵
  PID:8556
- C:\Windows\System\PUPXoGz.exe
  C:\Windows\System\PUPXoGz.exe
  2⤵
  PID:8620
- C:\Windows\System\vnsOMFL.exe
  C:\Windows\System\vnsOMFL.exe
  2⤵
  PID:8456
- C:\Windows\System\TijTsQR.exe
  C:\Windows\System\TijTsQR.exe
  2⤵
  PID:8752
- C:\Windows\System\tIDlPqX.exe
  C:\Windows\System\tIDlPqX.exe
  2⤵
  PID:8652
- C:\Windows\System\Laecvxl.exe
  C:\Windows\System\Laecvxl.exe
  2⤵
  PID:8828
- C:\Windows\System\YFlAtQg.exe
  C:\Windows\System\YFlAtQg.exe
  2⤵
  PID:7948
- C:\Windows\System\pBRfoRI.exe
  C:\Windows\System\pBRfoRI.exe
  2⤵
  PID:8876
- C:\Windows\System\kZchXBA.exe
  C:\Windows\System\kZchXBA.exe
  2⤵
  PID:8912
- C:\Windows\System\pJTTnKH.exe
  C:\Windows\System\pJTTnKH.exe
  2⤵
  PID:9004
- C:\Windows\System\DaNEOeD.exe
  C:\Windows\System\DaNEOeD.exe
  2⤵
  PID:9068
- C:\Windows\System\UVaPUsX.exe
  C:\Windows\System\UVaPUsX.exe
  2⤵
  PID:9132
- C:\Windows\System\VEDPtpK.exe
  C:\Windows\System\VEDPtpK.exe
  2⤵
  PID:9200
- C:\Windows\System\XmXGJzZ.exe
  C:\Windows\System\XmXGJzZ.exe
  2⤵
  PID:9196
- C:\Windows\System\lxIgEdX.exe
  C:\Windows\System\lxIgEdX.exe
  2⤵
  PID:7696
- C:\Windows\System\xwXoOTv.exe
  C:\Windows\System\xwXoOTv.exe
  2⤵
  PID:8992
- C:\Windows\System\gAARScK.exe
  C:\Windows\System\gAARScK.exe
  2⤵
  PID:8896
- C:\Windows\System\wnMJCuB.exe
  C:\Windows\System\wnMJCuB.exe
  2⤵
  PID:8332
- C:\Windows\System\vOqZOda.exe
  C:\Windows\System\vOqZOda.exe
  2⤵
  PID:8444
- C:\Windows\System\bvsXAxP.exe
  C:\Windows\System\bvsXAxP.exe
  2⤵
  PID:9020
- C:\Windows\System\kRxrCDE.exe
  C:\Windows\System\kRxrCDE.exe
  2⤵
  PID:9084
- C:\Windows\System\xenSwzu.exe
  C:\Windows\System\xenSwzu.exe
  2⤵
  PID:9148
- C:\Windows\System\nvaHiVq.exe
  C:\Windows\System\nvaHiVq.exe
  2⤵
  PID:7312
- C:\Windows\System\qAjodgf.exe
  C:\Windows\System\qAjodgf.exe
  2⤵
  PID:8408
- C:\Windows\System\CZkmCGe.exe
  C:\Windows\System\CZkmCGe.exe
  2⤵
  PID:8204
- C:\Windows\System\ikckoSl.exe
  C:\Windows\System\ikckoSl.exe
  2⤵
  PID:8428
- C:\Windows\System\UGsyAHf.exe
  C:\Windows\System\UGsyAHf.exe
  2⤵
  PID:8928
- C:\Windows\System\EdccGGb.exe
  C:\Windows\System\EdccGGb.exe
  2⤵
  PID:8364
- C:\Windows\System\aXIVMkd.exe
  C:\Windows\System\aXIVMkd.exe
  2⤵
  PID:8800
- C:\Windows\System\RrkLdxu.exe
  C:\Windows\System\RrkLdxu.exe
  2⤵
  PID:8536
- C:\Windows\System\AbAKVDo.exe
  C:\Windows\System\AbAKVDo.exe
  2⤵
  PID:8732
- C:\Windows\System\PWTkXUp.exe
  C:\Windows\System\PWTkXUp.exe
  2⤵
  PID:8588
- C:\Windows\System\DddYFir.exe
  C:\Windows\System\DddYFir.exe
  2⤵
  PID:8864
- C:\Windows\System\SWjLByK.exe
  C:\Windows\System\SWjLByK.exe
  2⤵
  PID:8816
- C:\Windows\System\qoQMgzh.exe
  C:\Windows\System\qoQMgzh.exe
  2⤵
  PID:8972
- C:\Windows\System\hFEajCK.exe
  C:\Windows\System\hFEajCK.exe
  2⤵
  PID:9104
- C:\Windows\System\SXFcbPc.exe
  C:\Windows\System\SXFcbPc.exe
  2⤵
  PID:9184
- C:\Windows\System\IWBVhgP.exe
  C:\Windows\System\IWBVhgP.exe
  2⤵
  PID:9056
- C:\Windows\System\OlQWZKI.exe
  C:\Windows\System\OlQWZKI.exe
  2⤵
  PID:8048
- C:\Windows\System\MZOeFwL.exe
  C:\Windows\System\MZOeFwL.exe
  2⤵
  PID:8284
- C:\Windows\System\QfzMeWs.exe
  C:\Windows\System\QfzMeWs.exe
  2⤵
  PID:9224
- C:\Windows\System\ozhdXzV.exe
  C:\Windows\System\ozhdXzV.exe
  2⤵
  PID:9240
- C:\Windows\System\VrCLZJG.exe
  C:\Windows\System\VrCLZJG.exe
  2⤵
  PID:9256
- C:\Windows\System\TLQbjws.exe
  C:\Windows\System\TLQbjws.exe
  2⤵
  PID:9272
- C:\Windows\System\nyauWBM.exe
  C:\Windows\System\nyauWBM.exe
  2⤵
  PID:9288
- C:\Windows\System\hIQNEZm.exe
  C:\Windows\System\hIQNEZm.exe
  2⤵
  PID:9304
- C:\Windows\System\NIJgZZZ.exe
  C:\Windows\System\NIJgZZZ.exe
  2⤵
  PID:9320
- C:\Windows\System\mKjziKz.exe
  C:\Windows\System\mKjziKz.exe
  2⤵
  PID:9336
- C:\Windows\System\tFYHKbr.exe
  C:\Windows\System\tFYHKbr.exe
  2⤵
  PID:9352
- C:\Windows\System\ryuGtQH.exe
  C:\Windows\System\ryuGtQH.exe
  2⤵
  PID:9368
- C:\Windows\System\tglDQGd.exe
  C:\Windows\System\tglDQGd.exe
  2⤵
  PID:9384
- C:\Windows\System\pOcyZkL.exe
  C:\Windows\System\pOcyZkL.exe
  2⤵
  PID:9400
- C:\Windows\System\neSmpDM.exe
  C:\Windows\System\neSmpDM.exe
  2⤵
  PID:9416
- C:\Windows\System\OBDdQbA.exe
  C:\Windows\System\OBDdQbA.exe
  2⤵
  PID:9436
- C:\Windows\System\XluHqzb.exe
  C:\Windows\System\XluHqzb.exe
  2⤵
  PID:9452
- C:\Windows\System\XjndWYI.exe
  C:\Windows\System\XjndWYI.exe
  2⤵
  PID:9468
- C:\Windows\System\XFxrpjv.exe
  C:\Windows\System\XFxrpjv.exe
  2⤵
  PID:9484
- C:\Windows\System\GZjyLIo.exe
  C:\Windows\System\GZjyLIo.exe
  2⤵
  PID:9500
- C:\Windows\System\vnzAPEc.exe
  C:\Windows\System\vnzAPEc.exe
  2⤵
  PID:9516
- C:\Windows\System\MuITonr.exe
  C:\Windows\System\MuITonr.exe
  2⤵
  PID:9532
- C:\Windows\System\WNaSRWe.exe
  C:\Windows\System\WNaSRWe.exe
  2⤵
  PID:9548
- C:\Windows\System\ubpxSmE.exe
  C:\Windows\System\ubpxSmE.exe
  2⤵
  PID:9564
- C:\Windows\System\BLJjNpf.exe
  C:\Windows\System\BLJjNpf.exe
  2⤵
  PID:9580
- C:\Windows\System\wsYIxoC.exe
  C:\Windows\System\wsYIxoC.exe
  2⤵
  PID:9596
- C:\Windows\System\RdQNDxW.exe
  C:\Windows\System\RdQNDxW.exe
  2⤵
  PID:9612
- C:\Windows\System\gZGXylq.exe
  C:\Windows\System\gZGXylq.exe
  2⤵
  PID:9628
- C:\Windows\System\zXiXqqE.exe
  C:\Windows\System\zXiXqqE.exe
  2⤵
  PID:9644
- C:\Windows\System\EZoXDYK.exe
  C:\Windows\System\EZoXDYK.exe
  2⤵
  PID:9660
- C:\Windows\System\hvezsYr.exe
  C:\Windows\System\hvezsYr.exe
  2⤵
  PID:9676
- C:\Windows\System\tskBiQR.exe
  C:\Windows\System\tskBiQR.exe
  2⤵
  PID:9692
- C:\Windows\System\XVYQQvJ.exe
  C:\Windows\System\XVYQQvJ.exe
  2⤵
  PID:9708
- C:\Windows\System\AdlNryz.exe
  C:\Windows\System\AdlNryz.exe
  2⤵
  PID:9724
- C:\Windows\System\UrhhjMy.exe
  C:\Windows\System\UrhhjMy.exe
  2⤵
  PID:9740
- C:\Windows\System\jnbmpGr.exe
  C:\Windows\System\jnbmpGr.exe
  2⤵
  PID:9760
- C:\Windows\System\wvKDjaE.exe
  C:\Windows\System\wvKDjaE.exe
  2⤵
  PID:9776
- C:\Windows\System\FVgWpWY.exe
  C:\Windows\System\FVgWpWY.exe
  2⤵
  PID:9792
- C:\Windows\System\bVXzJau.exe
  C:\Windows\System\bVXzJau.exe
  2⤵
  PID:9808
- C:\Windows\System\SbkWanE.exe
  C:\Windows\System\SbkWanE.exe
  2⤵
  PID:9824
- C:\Windows\System\CONcgCL.exe
  C:\Windows\System\CONcgCL.exe
  2⤵
  PID:9840
- C:\Windows\System\wKmKXoR.exe
  C:\Windows\System\wKmKXoR.exe
  2⤵
  PID:9856
- C:\Windows\System\csqVBzK.exe
  C:\Windows\System\csqVBzK.exe
  2⤵
  PID:9872
- C:\Windows\System\LniBiOr.exe
  C:\Windows\System\LniBiOr.exe
  2⤵
  PID:9888
- C:\Windows\System\EySrytq.exe
  C:\Windows\System\EySrytq.exe
  2⤵
  PID:9904
- C:\Windows\System\CNoyRWj.exe
  C:\Windows\System\CNoyRWj.exe
  2⤵
  PID:9920
- C:\Windows\System\qKsjZdk.exe
  C:\Windows\System\qKsjZdk.exe
  2⤵
  PID:9940
- C:\Windows\System\luthJia.exe
  C:\Windows\System\luthJia.exe
  2⤵
  PID:9956
- C:\Windows\System\Tegurxv.exe
  C:\Windows\System\Tegurxv.exe
  2⤵
  PID:9972
- C:\Windows\System\uIqbJsd.exe
  C:\Windows\System\uIqbJsd.exe
  2⤵
  PID:9988
- C:\Windows\System\zKxcEvw.exe
  C:\Windows\System\zKxcEvw.exe
  2⤵
  PID:10004
- C:\Windows\System\dICVzno.exe
  C:\Windows\System\dICVzno.exe
  2⤵
  PID:10020
- C:\Windows\System\NqLVJqa.exe
  C:\Windows\System\NqLVJqa.exe
  2⤵
  PID:10036
- C:\Windows\System\oJBXePI.exe
  C:\Windows\System\oJBXePI.exe
  2⤵
  PID:10052
- C:\Windows\System\zvNUonK.exe
  C:\Windows\System\zvNUonK.exe
  2⤵
  PID:10072
- C:\Windows\System\gSkQEIf.exe
  C:\Windows\System\gSkQEIf.exe
  2⤵
  PID:10088
- C:\Windows\System\GTLQKyz.exe
  C:\Windows\System\GTLQKyz.exe
  2⤵
  PID:10104
- C:\Windows\System\wWOvXlP.exe
  C:\Windows\System\wWOvXlP.exe
  2⤵
  PID:10124
- C:\Windows\System\SNAAfoD.exe
  C:\Windows\System\SNAAfoD.exe
  2⤵
  PID:10144
- C:\Windows\System\lYdAqGe.exe
  C:\Windows\System\lYdAqGe.exe
  2⤵
  PID:10160
- C:\Windows\System\qDtALNL.exe
  C:\Windows\System\qDtALNL.exe
  2⤵
  PID:10176
- C:\Windows\System\gwWqNSE.exe
  C:\Windows\System\gwWqNSE.exe
  2⤵
  PID:10192
- C:\Windows\System\cYVLTDN.exe
  C:\Windows\System\cYVLTDN.exe
  2⤵
  PID:10208
- C:\Windows\System\MpggTFw.exe
  C:\Windows\System\MpggTFw.exe
  2⤵
  PID:10224
- C:\Windows\System\CQzOaKu.exe
  C:\Windows\System\CQzOaKu.exe
  2⤵
  PID:9120
- C:\Windows\System\gQuQdqB.exe
  C:\Windows\System\gQuQdqB.exe
  2⤵
  PID:8220
- C:\Windows\System\gkVsxXX.exe
  C:\Windows\System\gkVsxXX.exe
  2⤵
  PID:9444
- C:\Windows\System\xzoGdHl.exe
  C:\Windows\System\xzoGdHl.exe
  2⤵
  PID:8844
- C:\Windows\System\YhRXmvN.exe
  C:\Windows\System\YhRXmvN.exe
  2⤵
  PID:9212
- C:\Windows\System\kuXcFxH.exe
  C:\Windows\System\kuXcFxH.exe
  2⤵
  PID:9284
- C:\Windows\System\xLcaIDE.exe
  C:\Windows\System\xLcaIDE.exe
  2⤵
  PID:9348
- C:\Windows\System\QtANbtV.exe
  C:\Windows\System\QtANbtV.exe
  2⤵
  PID:9448
- C:\Windows\System\tYoGZOk.exe
  C:\Windows\System\tYoGZOk.exe
  2⤵
  PID:9512
- C:\Windows\System\cKHuqer.exe
  C:\Windows\System\cKHuqer.exe
  2⤵
  PID:9576
- C:\Windows\System\AuUmhlW.exe
  C:\Windows\System\AuUmhlW.exe
  2⤵
  PID:8412
- C:\Windows\System\wjwacFm.exe
  C:\Windows\System\wjwacFm.exe
  2⤵
  PID:8552
- C:\Windows\System\SzlgRPx.exe
  C:\Windows\System\SzlgRPx.exe
  2⤵
  PID:9036
- C:\Windows\System\atwCgiz.exe
  C:\Windows\System\atwCgiz.exe
  2⤵
  PID:9640
- C:\Windows\System\IwanQDR.exe
  C:\Windows\System\IwanQDR.exe
  2⤵
  PID:8380
- C:\Windows\System\BfSZlBy.exe
  C:\Windows\System\BfSZlBy.exe
  2⤵
  PID:8648
- C:\Windows\System\AUnLikJ.exe
  C:\Windows\System\AUnLikJ.exe
  2⤵
  PID:9236
- C:\Windows\System\kCdELkK.exe
  C:\Windows\System\kCdELkK.exe
  2⤵
  PID:9432
- C:\Windows\System\JmtSeaK.exe
  C:\Windows\System\JmtSeaK.exe
  2⤵
  PID:9492
- C:\Windows\System\ovzmmYi.exe
  C:\Windows\System\ovzmmYi.exe
  2⤵
  PID:9556
- C:\Windows\System\mRXYIcB.exe
  C:\Windows\System\mRXYIcB.exe
  2⤵
  PID:9624
- C:\Windows\System\wcAhwGj.exe
  C:\Windows\System\wcAhwGj.exe
  2⤵
  PID:9720
- C:\Windows\System\DVFlzlj.exe
  C:\Windows\System\DVFlzlj.exe
  2⤵
  PID:9392
- C:\Windows\System\KsASLBF.exe
  C:\Windows\System\KsASLBF.exe
  2⤵
  PID:9620
- C:\Windows\System\iAyfKKw.exe
  C:\Windows\System\iAyfKKw.exe
  2⤵
  PID:9296
- C:\Windows\System\ghcJYkN.exe
  C:\Windows\System\ghcJYkN.exe
  2⤵
  PID:9756
- C:\Windows\System\jOgECie.exe
  C:\Windows\System\jOgECie.exe
  2⤵
  PID:9820
- C:\Windows\System\kyFogxv.exe
  C:\Windows\System\kyFogxv.exe
  2⤵
  PID:9912
- C:\Windows\System\cFuYLgp.exe
  C:\Windows\System\cFuYLgp.exe
  2⤵
  PID:9952
- C:\Windows\System\tMtMjNE.exe
  C:\Windows\System\tMtMjNE.exe
  2⤵
  PID:10016
- C:\Windows\System\BxXQDOS.exe
  C:\Windows\System\BxXQDOS.exe
  2⤵
  PID:10084
- C:\Windows\System\fJgJYww.exe
  C:\Windows\System\fJgJYww.exe
  2⤵
  PID:10152
- C:\Windows\System\IgeczUI.exe
  C:\Windows\System\IgeczUI.exe
  2⤵
  PID:10216
- C:\Windows\System\LOwXMrW.exe
  C:\Windows\System\LOwXMrW.exe
  2⤵
  PID:9800
- C:\Windows\System\mEeBMmb.exe
  C:\Windows\System\mEeBMmb.exe
  2⤵
  PID:10064

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\CzVjZnv.exe

Filesize
2.0MB

MD5
041ca385fab24a7031eb5014a6bbba36

SHA1
3a162ba043855688495df11e7e19012e97f35336

SHA256
5eab0759da35c591c932385fe0f612b2183a2238bd4f385754ac9390875b2994

SHA512
40dbedd8c1478638dabad758a97ced6e93fad69e28f83822d339c6061d7d84cf9d62770a3f4b7abcf8082c513c439d36273bb90e5efa3d704d2a4ace97da8598

Download Submit
C:\Windows\system\KOanhvE.exe

Filesize
1.9MB

MD5
690c4a62ce3ba3be316cf5ed18fed2c5

SHA1
c27d949df5e47902672882e89f679e12c2c1f815

SHA256
94fb1a79ab1e866db3ac0e57cb54022ec39adf213ed3bdd1c1fdce000ac1b186

SHA512
66f6b7f0cdfce077265fb8163f7d965a7e07760db0f0a5d4f2f795cbec94e117961a69596de9faa4460ca490e2559202fe8ac97ffc3a49dba9e05f19254b1620

Download Submit
C:\Windows\system\KvmYraF.exe

Filesize
1.9MB

MD5
1d9ddc8a80ed3c4290c1ee8291fc325c

SHA1
289ea8c6b66ee774c74480f46818993a78ccd643

SHA256
f41d33d555c18e6a62fc6c3552b8e1d43559f42727370965a23b450b6ecf23d4

SHA512
de82d9cd37cd7893ddeb2c75d7a9ceca9fdef011ed3503e6b5ce8ae8311d27ea94b4ab07521bfe25699859c6019bd0a85f976504562d722903b839bc50d3e460

Download Submit
C:\Windows\system\PAHSxHT.exe

Filesize
1.9MB

MD5
21379ffd018ed5f5821e06f6e21a6a55

SHA1
ab3307d9802c3104b918e0d9fcd1429cbfc18f85

SHA256
34f8e2b66bbb14a0f832437e2cc5b5ecaec8b60f1034c30ac901b3f4871a7dfc

SHA512
557db618dd8c91a47ba0903f6a03b69af2c2cbbc3ad586c256d3e7b9deba73292de2092578d8bbf47b730fcaf8e3edcd1d48abd7b623a7dc4bdfb73a714bac6b

Download Submit
C:\Windows\system\TXOgtuz.exe

Filesize
1.9MB

MD5
edbc463c94e361458810df5b6f279457

SHA1
47e623c483568bc4f1936e6102a34ead63441168

SHA256
b2d572e80f2ff5e643064f50c80e0248fda8d806eaec73954251eb88c57e8d37

SHA512
5236415c1e89bc48b712701d0341e776e7208d2d0814eba66e13f00225aafacdee05ed3bdef77051ab034f5313adc01c2e1f5cab4e8ea789d5b2c01e504f7e9d

Download Submit
C:\Windows\system\TjJXcKQ.exe

Filesize
1.9MB

MD5
c6922a819deb67384116af649b570f1b

SHA1
3b6ed2089ae7ef883b782cfb83c1d6371867b678

SHA256
df40804624ef557b55f9b422d75756dfa27d67ccf4b985a2af380aaf0e9423c1

SHA512
8b41de016b2f6c23a51cfe70d14708f8b0ded69e2c07bd87aadfd987c478d409e3a094ef567d783ee6984fcd7690d68248f95bee085a3126652c2a7b63d38d20

Download Submit
C:\Windows\system\VdmueaH.exe

Filesize
1.9MB

MD5
d9a8c298b9dad62323caa570b7065958

SHA1
e7be7f01fcf4064bc93b46a5ca99a5e6b36d20c0

SHA256
4bcc490c26cb8a8a597766559126080bc77a46992de23a0f8aa2635acaca21b0

SHA512
ee57e1fa2254c15aa0b844bf439a22eae7945afabfb96f8c0972d62cdb4cbc600112ee622f589c853b394a8a93c2bfa32fcaa7e1333c9813e0a91d6f15bbbbf7

Download Submit
C:\Windows\system\WzUxwTr.exe

Filesize
1.9MB

MD5
ac19884e8b41fe51c18cc170b4317bd0

SHA1
36f1aeff3f8bd93aef7bd2e2065d4861a947b0ce

SHA256
8dee84ce27ed4fed2b962827ef90ac810b642b551e3b8028228c5583d673d3c6

SHA512
0d37639feca8f497f22c204fd42132074c66e683d18354bab069775e9fbc467c0896d555ebcc2de4cf149ece1653bc36c0196db6bdd2afc9e77aec8b829ac282

Download Submit
C:\Windows\system\ZEBfmJp.exe

Filesize
1.9MB

MD5
6b091ae68b0afd9a4d4254bbcb9c1407

SHA1
5e5cd812a60572d8eee84b16f7b3d28d8fe8bf06

SHA256
6217c67ba6c2d0879f601cbda12ca9a1ef40fc05ba5972443c96de0f7a00909c

SHA512
53d70135b63439142f273e4c49eaa9787e7aea91504bf9f60ac3c06d99c38575b742e61508fec9fae6b927b6d38cba62d856d0c485892362044db7731047ff4b

Download Submit
C:\Windows\system\ZXpOERk.exe

Filesize
1.9MB

MD5
4ab228be2f7f27f8ea1247cb5625b40e

SHA1
74f7f5d854d8696a6997409fba1ccaa1880fd0b6

SHA256
085b2d170c775786da76ea1bef0348e3c55b925c25f848f5bf8000bcf828db81

SHA512
9de1f26afcc058d11705b46d7e0f7d518232bf2c30813fe6a88526a416da23f441d6a3262a7d62ccedb7417e64d1ea5bc231e8714b10fb5aec88f8a8f4258814

Download Submit
C:\Windows\system\dBliajx.exe

Filesize
1.9MB

MD5
87d57e8c87f93e583a9441e94719fb9e

SHA1
9f025b2e83170a2f8362054199ec1e2544d88ad5

SHA256
1f21dd326c1b9ea0ec9c928126dc161d5b5c348cbaee419b0d0a73146654658c

SHA512
f9932567a5ce12116ac75d9288a57d7b1fbfc1f6d3983b0a6f5ac215a2e09507311ad18451fcba474bd072001ce48fbef2f427527c7d80fd93c7739acb8ce5c2

Download Submit
C:\Windows\system\dflaYFH.exe

Filesize
1.9MB

MD5
1598b0c3bcd3e9395501860d22d63cc3

SHA1
3eb95e92331a7c4e2c017f348c044eb1723468d1

SHA256
80992c0f9364bf15dbef0a5627f003b25c3bb7e6fc84696bce86225b472b0427

SHA512
dbcd03604fb3a2dd32a8cd77c37abeb5639844d5464612c13372ca3af7b23ebf3e14f747616f5a5551d71aa93150f7e583e2c3942528f12bbeb77da4ff8f7d8f

Download Submit
C:\Windows\system\fTRTNGx.exe

Filesize
1.9MB

MD5
fa25af8cd7785adb1ed43e637cf4c865

SHA1
b4404b4c13cc9db18c0779b725a4a7a154c76112

SHA256
4747500ddf70f6e6b90ead3858e5de164a38fc26f45999d2882cca511f6d080b

SHA512
1d75c17762852fc5372c128ada148f953e2749c41f6f68bf4bbaf0b80033994e9369546725d0f967c7df2ddcbea451740d45b143fbf7716c08f77eae33460485

Download Submit
C:\Windows\system\ikuPoWd.exe

Filesize
1.9MB

MD5
462c7fd548c4faf0c1beedd68efd13bb

SHA1
97ea91e6b9c81581c331bfa8e6ad2df9c3f17df9

SHA256
a7824d78ffc969829c7df0633ec3f099ded709f5803c8f04a3d612e9f8f04cd5

SHA512
7b7c8ead84a656347f599e25c3dca2db70326c9bcea92592ab39abd98afda916cef9316a41ee016b5ea1cec41a9cdcd97c36193f54c1738e3b6edb44a271aff7

Download Submit
C:\Windows\system\kVXnGEw.exe

Filesize
1.9MB

MD5
e2b612bd97cda979284616dbe490860f

SHA1
99dd588e447491bd42e2ce73766b8a0c3a75d937

SHA256
f1e55d7b45ce5548ebe2fdd9856d0823c14d53c0d3812cd87e07b74ca9b8b962

SHA512
ef45a8099ae0df0251da6f8aeece8a40d831d8ba992c8372140ee2d2830f16694c9f4fc4f3f8908f3965830be95285ff3844db30e3bede76b4f1d1ef6d950e62

Download Submit
C:\Windows\system\nrCbBry.exe

Filesize
1.9MB

MD5
2972a77031e00f13a6dee6bc5225ed8c

SHA1
8d9bfba6eaccbd4b5863b39f82843268631202c3

SHA256
d81e27a108a5ebf06eb66bb5be368c49162a1118c2b8f5c6963b38b5281b65d0

SHA512
bea00c1800de5925fe02fce55bdd9ca5144a15ea2c6c6897ab1cadecf770fbb84d8d3748abe5cc9e76949b4fb9caec9e6e6958e1d5147615a27a0095409e30f2

Download Submit
C:\Windows\system\pOcMMeT.exe

Filesize
1.9MB

MD5
c9fc08afe6310e47917684c3ae13160c

SHA1
51567e944b4fdcb82643b0ab31b476e2321f3a76

SHA256
40b9a34da2ba0d782c0a4127abc356386900a625917fce9b1e256c76fd498dfe

SHA512
8044b0c334d04eb4b3b37fabe2cd0db8d637b7aa76b46b8d12127561587f37b39d9d6d64623a9fe0ee4afa36835ca00a40d05583f2ab7e3dcb40165cbc419126

Download Submit
C:\Windows\system\peUrfts.exe

Filesize
1.9MB

MD5
adc3282c3e5cadb480af193c1006a55b

SHA1
bbee168a7317fa48dbf7b79b64dd85e840a022bf

SHA256
ddde90bb2f44a3740e88b4a85022b890f364e5b173d213be1b55d1d26f9e5167

SHA512
74e20ac997e8f02c45331f7f0ff55dee39c3a83fcd134c719a2f5228296c91fea4d6d08de1eba0ac5e77e8348d77d3028faa33966e4562eaeebca26e50a93634

Download Submit
C:\Windows\system\pzuTiwt.exe

Filesize
1.9MB

MD5
2a66ef8f97ee798fcb0f94bd8a3547d3

SHA1
7d3e759b4b72c8c9817e19d890f42fda343c7ae6

SHA256
4e72c3ee9bb34b8aac1d12be1561c43b9727e754f4009f067c36ad356ea15694

SHA512
1b890cd687ffd387c8b82bdc7667873d432b13ca44a19433b2bf2cd8b02077894020905e04f3abd5e993dcd5bcd84aa8da4477d4ba4d7d1572bbd34520ea5737

Download Submit
C:\Windows\system\sjHxMPL.exe

Filesize
1.9MB

MD5
22f411f6bdfeac4da150cc9b68804242

SHA1
d19194eb66f94bc27c77a744b23bbe57fafc4d68

SHA256
390f4a90037575db9a1b9cbff705e8c9c12ea717c5adc056db4d440d7efcfa85

SHA512
d4aeaf0875fa94aed78339d524bde40051c24d617c575e811f1e27be245cbc37fa17a8c673292e351bd93d474e61b66082c2647011be42546dcc0dbdbe62749f

Download Submit
C:\Windows\system\uAuGEAN.exe

Filesize
2.0MB

MD5
8c8cadeee4bc51383f1cb67107486d03

SHA1
e6f97541a55556c7dfadc8137c703ee4e8db4ddc

SHA256
6c8017728ecc1f0304ae8ba43d696cca12f85aff4a38bee933861ee7e7e76c0c

SHA512
87ddf15a9313959c28fbbb6ed07ba4a1624427b3bd6505d999d6947f3532df3a9b24b134ed6db62876edeb48c5127b954a121bf4fcc4064f883e4c8a6de8371b

Download Submit
C:\Windows\system\uQPAHGc.exe

Filesize
1.9MB

MD5
530c1e4a9f6ae7910af414e01695f81b

SHA1
bcfb368c2fde1de78b1b8803d2a00471f5b37eaa

SHA256
b0d16633dff16882bee0d7d30179186d0fc0ef4d10208e835663af568e150463

SHA512
a94c62a469f6496cb6343ba0286115368b6a5f0df10e4ee3536ad361f9b36cc723b794e3ac92bab6863b2fbeb6dee8dfc599644fd0f63b3ad9039bb9c48cf85c

Download Submit
C:\Windows\system\xtXNhqs.exe

Filesize
1.9MB

MD5
aa4ce80b14804dbfcf08f8432f8c5ed0

SHA1
6d14164a5510d2eadb51680f1604e50616e6086e

SHA256
3fc115375059dd83eb4264362e7759ef07f70e8969d5e8bf817c9d09d117c9be

SHA512
cc4e81cf208eea820ae4c78d1f336d7e0b2b50c0ac4d3b2d4bc3e90bc88702ea1b4c802d8498e9ea6b65d8111ae3e62544ef9dfb80b4055764c8ab6069550f39

Download Submit
C:\Windows\system\zHiEekn.exe

Filesize
2.0MB

MD5
88352be12ab2f1e1abbbf38c98800dcd

SHA1
66835dc169d820b039d6a0936e987240b3d7f73c

SHA256
e786503b1e73a7dd9451c00339add78c22e4e7e1ce70d590baa6a8347b8667f9

SHA512
604dcb171db8b964cf0a41480749d051613da5dddf50721abe54bca4c19911050699e818c1d75351aa1f39c70932c1fc11f35c7510991983c2bc365ca1170459

Download Submit
C:\Windows\system\zLpWdDK.exe

Filesize
1.9MB

MD5
cea54df8bf825e4705eba310c3dd448a

SHA1
7e5a2062f40549711c7bedf3b128b03bd5ab25d2

SHA256
a6f7149fe0dc73ca1b38e841f23a2632589e83aadaff93ad05cb4c2254e06d49

SHA512
e8de90c8d2fc23a495a13ec29fbd3f10d59b4d192bf6905a7eaa58f434f839ab3024937a1eb9e421553d19429750aff275cc52b3b25437a3af7ba30a0d9a291d

Download Submit
C:\Windows\system\zSZdPgZ.exe

Filesize
1.9MB

MD5
e5db768fa73f690fe38414ec852b7e4f

SHA1
3fc2b9763b1bdfecda1a181fd4efe71fa173429a

SHA256
2e8c9c030b87f3c1bc751c51adc9e5c614668a87146187dcac4a4a9542a5880f

SHA512
0c35046d8debe51f202e20e66fd0eb928b9eec73f3bd11a9007f9762e52ad96af9ae08703283379db7638afeaccd0028b6fa753701ea45592340676cb7f2b3f5

Download Submit
C:\Windows\system\zqjrcrk.exe

Filesize
1.9MB

MD5
508f64d6654aa18bb586e6f634818bb3

SHA1
d5714144e41ba1aaec9de2ac01363eca02836e00

SHA256
3fb7e4b3460d130e02b4802c2cb732bc44bdb5eead990e9ad01ca1abaee16e2f

SHA512
9cb6141b7a242aff47be080da233825965450d35c138c4d96b83cd1a07cccd084fd6dc27f3590337a677971435f04e8e25fdba9ae0104dbfbe47bb2d135fd649

Download Submit
\Windows\system\MUQujQN.exe

Filesize
2.0MB

MD5
c2fdff614c0009bbb24b9a93de0166b3

SHA1
4ae0dc0c33b3f0d1e7eabe18e35c648dce0f6b0c

SHA256
2cf544967f129aa565143b37fb4d7c762086d6cb6a3e0891dc4fe0155a4023d3

SHA512
3352b7961f6af9c922ed876062038fd33c58e0843675dd1928cbaeaef2b2e2f89b903f7c368de580845a643a66f8037cb288aa639d02fa3a5c7cfa0fca1a49b3

Download Submit
\Windows\system\gUmyAdZ.exe

Filesize
1.9MB

MD5
0e87a787a3fa8d566680f7c13ec57fab

SHA1
afe6bcb7a718373908402eb986424b8c678e5add

SHA256
1e7c39ac1f304464904a3cdd3fa1a20694c230351be509a0f6672bd0e0898b00

SHA512
e957fb479fa0d8251e8a8d7003a5b3f085d96fb341e9e8e9463b6eff4f71e114822fe9b4e83e4c57e97f774ff45d214d669920d4d2f8a175c549495f081d1855

Download Submit
\Windows\system\iotvtha.exe

Filesize
1.9MB

MD5
cd9b277a947a71fbe5f528c93655db84

SHA1
72398dfdf33e3a20c9a8ba45261f198c57397ef4

SHA256
8b4c916a2f05b72d1a72142df4eac2885c7d80f61bad37e9244ba1975c8174e5

SHA512
95bafebab9f6c95660ada4b5655f2772fb3d1e43eb40d429c9600218a1228fbb9afefe5f71201bf930650f92200fc5db18cbac4643ec082815a040287f7a45a2

Download Submit
\Windows\system\lUixwEx.exe

Filesize
1.9MB

MD5
fe6d92984b70899120982a09f3f7a777

SHA1
db1c451b635d89053f093b448d2acf90a9fa46e9

SHA256
ee094c7409c3acf10499ccd5a211455da8a2d03bb871ed14a37a4c669f1680ee

SHA512
d549abcf0fe52ee1abf4601743c8cfd164c380a9ab5deff51ee025424ea4e666750091bfbc0bd193646c932e6c5f1520ed87316edfc29d5fc0661883b4be6710

Download Submit
\Windows\system\nxYFSxj.exe

Filesize
1.9MB

MD5
d126c4c76d2a91da8fd0d5acf1d1bd4f

SHA1
cfacdb18b6239a6c36c5124fe686e3071b67bf34

SHA256
e1c52aaf44bd402cd7064bc2029ac82de8a007651ef13b1dde1c8a20be4c5f83

SHA512
075cb55901cf2b271728c4a60eead6d479800a7dd446bc65fe64e39080b7f4027beb80f377db6fa2df5b87259411b309e6f8ce3e228564be00f0f8b4d919006e

Download Submit
memory/924-181-0x000000013FD90000-0x0000000140182000-memory.dmp

Filesize
3.9MB

Download
memory/924-4936-0x000000013FD90000-0x0000000140182000-memory.dmp

Filesize
3.9MB

Download
memory/1704-185-0x0000000003080000-0x0000000003472000-memory.dmp

Filesize
3.9MB

Download
memory/1704-176-0x000000013F440000-0x000000013F832000-memory.dmp

Filesize
3.9MB

Download
memory/1704-183-0x000000013F540000-0x000000013F932000-memory.dmp

Filesize
3.9MB

Download
memory/1704-5845-0x000000013F030000-0x000000013F422000-memory.dmp

Filesize
3.9MB

Download
memory/1704-180-0x000000013FD90000-0x0000000140182000-memory.dmp

Filesize
3.9MB

Download
memory/1704-20-0x000000013FC50000-0x0000000140042000-memory.dmp

Filesize
3.9MB

Download
memory/1704-187-0x0000000003080000-0x0000000003472000-memory.dmp

Filesize
3.9MB

Download
memory/1704-23-0x000000013FB50000-0x000000013FF42000-memory.dmp

Filesize
3.9MB

Download
memory/1704-190-0x000000013F570000-0x000000013F962000-memory.dmp

Filesize
3.9MB

Download
memory/1704-0-0x000000013F030000-0x000000013F422000-memory.dmp

Filesize
3.9MB

Download
memory/1704-182-0x000000013F5C0000-0x000000013F9B2000-memory.dmp

Filesize
3.9MB

Download
memory/1704-193-0x0000000003080000-0x0000000003472000-memory.dmp

Filesize
3.9MB

Download
memory/1704-1-0x00000000002F0000-0x0000000000300000-memory.dmp

Filesize
64KB

Download
memory/1704-178-0x000000013F900000-0x000000013FCF2000-memory.dmp

Filesize
3.9MB

Download
memory/1704-29-0x000000013F700000-0x000000013FAF2000-memory.dmp

Filesize
3.9MB

Download
memory/2008-192-0x000000001B540000-0x000000001B822000-memory.dmp

Filesize
2.9MB

Download
memory/2008-28-0x000007FEF4F6E000-0x000007FEF4F6F000-memory.dmp

Filesize
4KB

Download
memory/2008-1238-0x000007FEF4CB0000-0x000007FEF564D000-memory.dmp

Filesize
9.6MB

Download
memory/2008-174-0x000007FEF4CB0000-0x000007FEF564D000-memory.dmp

Filesize
9.6MB

Download
memory/2008-194-0x00000000029D0000-0x00000000029D8000-memory.dmp

Filesize
32KB

Download
memory/2008-27-0x00000000029E0000-0x0000000002A60000-memory.dmp

Filesize
512KB

Download
memory/2176-22-0x000000013FC50000-0x0000000140042000-memory.dmp

Filesize
3.9MB

Download
memory/2436-184-0x000000013F540000-0x000000013F932000-memory.dmp

Filesize
3.9MB

Download
memory/2436-4933-0x000000013F540000-0x000000013F932000-memory.dmp

Filesize
3.9MB

Download
memory/2440-175-0x000000013FED0000-0x00000001402C2000-memory.dmp

Filesize
3.9MB

Download
memory/2440-4935-0x000000013FED0000-0x00000001402C2000-memory.dmp

Filesize
3.9MB

Download
memory/2468-179-0x000000013F900000-0x000000013FCF2000-memory.dmp

Filesize
3.9MB

Download
memory/2468-4931-0x000000013F900000-0x000000013FCF2000-memory.dmp

Filesize
3.9MB

Download
memory/2492-4934-0x000000013F1E0000-0x000000013F5D2000-memory.dmp

Filesize
3.9MB

Download
memory/2492-188-0x000000013F1E0000-0x000000013F5D2000-memory.dmp

Filesize
3.9MB

Download
memory/2504-191-0x000000013F2A0000-0x000000013F692000-memory.dmp

Filesize
3.9MB

Download
memory/2580-4921-0x000000013FB50000-0x000000013FF42000-memory.dmp

Filesize
3.9MB

Download
memory/2580-25-0x000000013FB50000-0x000000013FF42000-memory.dmp

Filesize
3.9MB

Download
memory/2596-177-0x000000013F440000-0x000000013F832000-memory.dmp

Filesize
3.9MB

Download
memory/2596-4932-0x000000013F440000-0x000000013F832000-memory.dmp

Filesize
3.9MB

Download
memory/2616-26-0x000000013F700000-0x000000013FAF2000-memory.dmp

Filesize
3.9MB

Download
memory/2660-186-0x000000013F5C0000-0x000000013F9B2000-memory.dmp

Filesize
3.9MB

Download
memory/2660-4937-0x000000013F5C0000-0x000000013F9B2000-memory.dmp

Filesize
3.9MB

Download