xmrig | 82a04decb6fe60912a068928e1b943d9f89be653e408aa95f65be58c8559fdcb

Analysis

max time kernel
149s
max time network
144s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
27/06/2024, 11:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

82a04decb6fe60912a068928e1b943d9f89be653e408aa95f65be58c8559fdcb_NeikiAnalytics.exe
Size

807KB
MD5

edd1a21770013b1540ed385847228d00
SHA1

5bfb208d89ffe36bc3d3e5a2954e5e0a80f9deba
SHA256

82a04decb6fe60912a068928e1b943d9f89be653e408aa95f65be58c8559fdcb
SHA512

252a9f28b58e65083c8cbef79e44988cafdf39f234f7d7b2982bb76f389bbc994308a6c17b445e175f1af96e1e3c91b6224b888c8bc28fe6e2a0bbef3fb0d0fe
SSDEEP

24576:zv3/fTLF671TilQFG4P5PmK/lzapp4p7e0IGI:Lz071uv4BPm6lu4pnm

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 18 IoCs

miner

resource	yara_rule
behavioral1/memory/2624-20-0x000000013F4B0000-0x000000013F8A2000-memory.dmp	xmrig
behavioral1/memory/2976-9-0x000000013FEF0000-0x00000001402E2000-memory.dmp	xmrig
behavioral1/memory/2588-50-0x000000013FB40000-0x000000013FF32000-memory.dmp	xmrig
behavioral1/memory/2512-48-0x000000013F820000-0x000000013FC12000-memory.dmp	xmrig
behavioral1/memory/2564-138-0x000000013F1A0000-0x000000013F592000-memory.dmp	xmrig
behavioral1/memory/2548-112-0x000000013FE70000-0x0000000140262000-memory.dmp	xmrig
behavioral1/memory/2404-54-0x000000013F970000-0x000000013FD62000-memory.dmp	xmrig
behavioral1/memory/2156-213-0x000000013F510000-0x000000013F902000-memory.dmp	xmrig
behavioral1/memory/2464-204-0x000000013F100000-0x000000013F4F2000-memory.dmp	xmrig
behavioral1/memory/2976-4380-0x000000013FEF0000-0x00000001402E2000-memory.dmp	xmrig
behavioral1/memory/2640-4381-0x000000013F330000-0x000000013F722000-memory.dmp	xmrig
behavioral1/memory/2464-4428-0x000000013F100000-0x000000013F4F2000-memory.dmp	xmrig
behavioral1/memory/2512-4422-0x000000013F820000-0x000000013FC12000-memory.dmp	xmrig
behavioral1/memory/2588-4432-0x000000013FB40000-0x000000013FF32000-memory.dmp	xmrig
behavioral1/memory/2564-4431-0x000000013F1A0000-0x000000013F592000-memory.dmp	xmrig
behavioral1/memory/2548-5059-0x000000013FE70000-0x0000000140262000-memory.dmp	xmrig
behavioral1/memory/2624-5087-0x000000013F4B0000-0x000000013F8A2000-memory.dmp	xmrig
behavioral1/memory/2188-8167-0x000000013F0B0000-0x000000013F4A2000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
2784	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
2976	wqZqqrk.exe
2624	DJZogBn.exe
2640	ykndzWW.exe
2512	QqSyvLt.exe
2588	TAuDuDA.exe
2404	GclVlIW.exe
2548	hLgGHoN.exe
2564	FTnaaaY.exe
2464	OETOGjO.exe
2156	NKslHkn.exe
1896	shikHYS.exe
984	DGIRmtK.exe
2112	LLZZFtA.exe
872	NcDgSMN.exe
860	GscheoC.exe
2892	VUOxXSy.exe
1536	TFkBJuh.exe
1376	krIwHAq.exe
1892	LAtvNxC.exe
2772	PaszaVG.exe
2036	rDbtVZY.exe
2096	JDnyUdF.exe
1280	fNCChXS.exe
2216	NYXTBTO.exe
944	qUSVPVn.exe
1548	oLmkGlC.exe
640	eqolqSC.exe
1936	kOAKcWX.exe
1568	yRfPPas.exe
2680	QxTqBpI.exe
2192	JKjlsNL.exe
1740	QLprfxL.exe
2268	gEPFbmi.exe
2172	xLanqFX.exe
592	kKZXiqq.exe
2120	rIQkiwi.exe
1168	FySDFjh.exe
2744	kZkquqQ.exe
1996	iFhczDf.exe
2224	LJLUaRV.exe
1664	IoOjMyZ.exe
1276	UnwyyPP.exe
3024	hyMOIqT.exe
1104	XdLFuPq.exe
2052	isQKiYI.exe
752	feTLxjd.exe
3048	XISvctA.exe
2824	hSnECNm.exe
2852	ZelwFPL.exe
2180	HvRcpwv.exe
2652	OeQyxjr.exe
2428	oDSEVwE.exe
2612	IEmxERt.exe
2488	KWvcNSI.exe
2376	HRYPyFX.exe
2900	zAquIaa.exe
2288	hCLJzXR.exe
2704	HWxzGOM.exe
1012	vFoYJyF.exe
1748	BAXffqJ.exe
1848	BvxuLWx.exe
384	nPsfcTL.exe
1600	fKVoZGU.exe
1016	qGBsvuZ.exe

Loads dropped DLL 64 IoCs

pid	Process
2188	82a04decb6fe60912a068928e1b943d9f89be653e408aa95f65be58c8559fdcb_NeikiAnalytics.exe
2188	82a04decb6fe60912a068928e1b943d9f89be653e408aa95f65be58c8559fdcb_NeikiAnalytics.exe
2188	82a04decb6fe60912a068928e1b943d9f89be653e408aa95f65be58c8559fdcb_NeikiAnalytics.exe
2188	82a04decb6fe60912a068928e1b943d9f89be653e408aa95f65be58c8559fdcb_NeikiAnalytics.exe
2188	82a04decb6fe60912a068928e1b943d9f89be653e408aa95f65be58c8559fdcb_NeikiAnalytics.exe
2188	82a04decb6fe60912a068928e1b943d9f89be653e408aa95f65be58c8559fdcb_NeikiAnalytics.exe
2188	82a04decb6fe60912a068928e1b943d9f89be653e408aa95f65be58c8559fdcb_NeikiAnalytics.exe
2188	82a04decb6fe60912a068928e1b943d9f89be653e408aa95f65be58c8559fdcb_NeikiAnalytics.exe
2188	82a04decb6fe60912a068928e1b943d9f89be653e408aa95f65be58c8559fdcb_NeikiAnalytics.exe
2188	82a04decb6fe60912a068928e1b943d9f89be653e408aa95f65be58c8559fdcb_NeikiAnalytics.exe
2188	82a04decb6fe60912a068928e1b943d9f89be653e408aa95f65be58c8559fdcb_NeikiAnalytics.exe
2188	82a04decb6fe60912a068928e1b943d9f89be653e408aa95f65be58c8559fdcb_NeikiAnalytics.exe
2188	82a04decb6fe60912a068928e1b943d9f89be653e408aa95f65be58c8559fdcb_NeikiAnalytics.exe
2188	82a04decb6fe60912a068928e1b943d9f89be653e408aa95f65be58c8559fdcb_NeikiAnalytics.exe
2188	82a04decb6fe60912a068928e1b943d9f89be653e408aa95f65be58c8559fdcb_NeikiAnalytics.exe
2188	82a04decb6fe60912a068928e1b943d9f89be653e408aa95f65be58c8559fdcb_NeikiAnalytics.exe
2188	82a04decb6fe60912a068928e1b943d9f89be653e408aa95f65be58c8559fdcb_NeikiAnalytics.exe
2188	82a04decb6fe60912a068928e1b943d9f89be653e408aa95f65be58c8559fdcb_NeikiAnalytics.exe
2188	82a04decb6fe60912a068928e1b943d9f89be653e408aa95f65be58c8559fdcb_NeikiAnalytics.exe
2188	82a04decb6fe60912a068928e1b943d9f89be653e408aa95f65be58c8559fdcb_NeikiAnalytics.exe
2188	82a04decb6fe60912a068928e1b943d9f89be653e408aa95f65be58c8559fdcb_NeikiAnalytics.exe
2188	82a04decb6fe60912a068928e1b943d9f89be653e408aa95f65be58c8559fdcb_NeikiAnalytics.exe
2188	82a04decb6fe60912a068928e1b943d9f89be653e408aa95f65be58c8559fdcb_NeikiAnalytics.exe
2188	82a04decb6fe60912a068928e1b943d9f89be653e408aa95f65be58c8559fdcb_NeikiAnalytics.exe
2188	82a04decb6fe60912a068928e1b943d9f89be653e408aa95f65be58c8559fdcb_NeikiAnalytics.exe
2188	82a04decb6fe60912a068928e1b943d9f89be653e408aa95f65be58c8559fdcb_NeikiAnalytics.exe
2188	82a04decb6fe60912a068928e1b943d9f89be653e408aa95f65be58c8559fdcb_NeikiAnalytics.exe
2188	82a04decb6fe60912a068928e1b943d9f89be653e408aa95f65be58c8559fdcb_NeikiAnalytics.exe
2188	82a04decb6fe60912a068928e1b943d9f89be653e408aa95f65be58c8559fdcb_NeikiAnalytics.exe
2188	82a04decb6fe60912a068928e1b943d9f89be653e408aa95f65be58c8559fdcb_NeikiAnalytics.exe
2188	82a04decb6fe60912a068928e1b943d9f89be653e408aa95f65be58c8559fdcb_NeikiAnalytics.exe
2188	82a04decb6fe60912a068928e1b943d9f89be653e408aa95f65be58c8559fdcb_NeikiAnalytics.exe
2188	82a04decb6fe60912a068928e1b943d9f89be653e408aa95f65be58c8559fdcb_NeikiAnalytics.exe
2188	82a04decb6fe60912a068928e1b943d9f89be653e408aa95f65be58c8559fdcb_NeikiAnalytics.exe
2188	82a04decb6fe60912a068928e1b943d9f89be653e408aa95f65be58c8559fdcb_NeikiAnalytics.exe
2188	82a04decb6fe60912a068928e1b943d9f89be653e408aa95f65be58c8559fdcb_NeikiAnalytics.exe
2188	82a04decb6fe60912a068928e1b943d9f89be653e408aa95f65be58c8559fdcb_NeikiAnalytics.exe
2188	82a04decb6fe60912a068928e1b943d9f89be653e408aa95f65be58c8559fdcb_NeikiAnalytics.exe
2188	82a04decb6fe60912a068928e1b943d9f89be653e408aa95f65be58c8559fdcb_NeikiAnalytics.exe
2188	82a04decb6fe60912a068928e1b943d9f89be653e408aa95f65be58c8559fdcb_NeikiAnalytics.exe
2188	82a04decb6fe60912a068928e1b943d9f89be653e408aa95f65be58c8559fdcb_NeikiAnalytics.exe
2188	82a04decb6fe60912a068928e1b943d9f89be653e408aa95f65be58c8559fdcb_NeikiAnalytics.exe
2188	82a04decb6fe60912a068928e1b943d9f89be653e408aa95f65be58c8559fdcb_NeikiAnalytics.exe
2188	82a04decb6fe60912a068928e1b943d9f89be653e408aa95f65be58c8559fdcb_NeikiAnalytics.exe
2188	82a04decb6fe60912a068928e1b943d9f89be653e408aa95f65be58c8559fdcb_NeikiAnalytics.exe
2188	82a04decb6fe60912a068928e1b943d9f89be653e408aa95f65be58c8559fdcb_NeikiAnalytics.exe
2188	82a04decb6fe60912a068928e1b943d9f89be653e408aa95f65be58c8559fdcb_NeikiAnalytics.exe
2188	82a04decb6fe60912a068928e1b943d9f89be653e408aa95f65be58c8559fdcb_NeikiAnalytics.exe
2188	82a04decb6fe60912a068928e1b943d9f89be653e408aa95f65be58c8559fdcb_NeikiAnalytics.exe
2188	82a04decb6fe60912a068928e1b943d9f89be653e408aa95f65be58c8559fdcb_NeikiAnalytics.exe
2188	82a04decb6fe60912a068928e1b943d9f89be653e408aa95f65be58c8559fdcb_NeikiAnalytics.exe
2188	82a04decb6fe60912a068928e1b943d9f89be653e408aa95f65be58c8559fdcb_NeikiAnalytics.exe
2188	82a04decb6fe60912a068928e1b943d9f89be653e408aa95f65be58c8559fdcb_NeikiAnalytics.exe
2188	82a04decb6fe60912a068928e1b943d9f89be653e408aa95f65be58c8559fdcb_NeikiAnalytics.exe
2188	82a04decb6fe60912a068928e1b943d9f89be653e408aa95f65be58c8559fdcb_NeikiAnalytics.exe
2188	82a04decb6fe60912a068928e1b943d9f89be653e408aa95f65be58c8559fdcb_NeikiAnalytics.exe
2188	82a04decb6fe60912a068928e1b943d9f89be653e408aa95f65be58c8559fdcb_NeikiAnalytics.exe
2188	82a04decb6fe60912a068928e1b943d9f89be653e408aa95f65be58c8559fdcb_NeikiAnalytics.exe
2188	82a04decb6fe60912a068928e1b943d9f89be653e408aa95f65be58c8559fdcb_NeikiAnalytics.exe
2188	82a04decb6fe60912a068928e1b943d9f89be653e408aa95f65be58c8559fdcb_NeikiAnalytics.exe
2188	82a04decb6fe60912a068928e1b943d9f89be653e408aa95f65be58c8559fdcb_NeikiAnalytics.exe
2188	82a04decb6fe60912a068928e1b943d9f89be653e408aa95f65be58c8559fdcb_NeikiAnalytics.exe
2188	82a04decb6fe60912a068928e1b943d9f89be653e408aa95f65be58c8559fdcb_NeikiAnalytics.exe
2188	82a04decb6fe60912a068928e1b943d9f89be653e408aa95f65be58c8559fdcb_NeikiAnalytics.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2188-2-0x000000013F0B0000-0x000000013F4A2000-memory.dmp	upx
behavioral1/files/0x000c00000001340b-6.dat	upx
behavioral1/files/0x000b000000012257-10.dat	upx
behavioral1/files/0x0008000000015d87-24.dat	upx
behavioral1/memory/2640-27-0x000000013F330000-0x000000013F722000-memory.dmp	upx
behavioral1/memory/2624-20-0x000000013F4B0000-0x000000013F8A2000-memory.dmp	upx
behavioral1/memory/2976-9-0x000000013FEF0000-0x00000001402E2000-memory.dmp	upx
behavioral1/files/0x0007000000015eaf-42.dat	upx
behavioral1/files/0x0008000000015e3a-40.dat	upx
behavioral1/files/0x0007000000004e76-35.dat	upx
behavioral1/files/0x0006000000016dbf-96.dat	upx
behavioral1/files/0x0006000000016da7-89.dat	upx
behavioral1/files/0x0006000000016d7e-81.dat	upx
behavioral1/memory/2588-50-0x000000013FB40000-0x000000013FF32000-memory.dmp	upx
behavioral1/files/0x0007000000016d1e-73.dat	upx
behavioral1/memory/2512-48-0x000000013F820000-0x000000013FC12000-memory.dmp	upx
behavioral1/files/0x0009000000015fe9-65.dat	upx
behavioral1/files/0x0007000000015f6d-58.dat	upx
behavioral1/files/0x0006000000016dbb-92.dat	upx
behavioral1/files/0x0005000000019241-198.dat	upx
behavioral1/files/0x000500000001922e-192.dat	upx
behavioral1/files/0x0006000000018c0a-187.dat	upx
behavioral1/files/0x00050000000191ed-184.dat	upx
behavioral1/files/0x00050000000191a7-178.dat	upx
behavioral1/files/0x0006000000019021-171.dat	upx
behavioral1/files/0x0006000000018c1a-165.dat	upx
behavioral1/files/0x0005000000018778-158.dat	upx
behavioral1/files/0x000500000001866b-149.dat	upx
behavioral1/files/0x0006000000017556-143.dat	upx
behavioral1/memory/2564-138-0x000000013F1A0000-0x000000013F592000-memory.dmp	upx
behavioral1/files/0x000600000001747d-135.dat	upx
behavioral1/files/0x0006000000017456-127.dat	upx
behavioral1/files/0x00060000000173d8-118.dat	upx
behavioral1/memory/2548-112-0x000000013FE70000-0x0000000140262000-memory.dmp	upx
behavioral1/files/0x0006000000017052-109.dat	upx
behavioral1/files/0x0006000000016e94-100.dat	upx
behavioral1/files/0x0006000000016d90-84.dat	upx
behavioral1/files/0x0006000000016d3a-76.dat	upx
behavioral1/files/0x0009000000016117-68.dat	upx
behavioral1/files/0x0031000000015d67-60.dat	upx
behavioral1/memory/2404-54-0x000000013F970000-0x000000013FD62000-memory.dmp	upx
behavioral1/memory/2156-213-0x000000013F510000-0x000000013F902000-memory.dmp	upx
behavioral1/memory/2464-204-0x000000013F100000-0x000000013F4F2000-memory.dmp	upx
behavioral1/files/0x0005000000019215-189.dat	upx
behavioral1/files/0x00050000000191cd-181.dat	upx
behavioral1/files/0x0006000000018f3a-168.dat	upx
behavioral1/files/0x000500000001923d-195.dat	upx
behavioral1/files/0x000500000001866d-157.dat	upx
behavioral1/files/0x000900000001864e-156.dat	upx
behavioral1/files/0x00060000000190b6-175.dat	upx
behavioral1/files/0x000600000001749c-141.dat	upx
behavioral1/files/0x000600000001745e-132.dat	upx
behavioral1/files/0x00060000000173e0-123.dat	upx
behavioral1/files/0x00060000000173d5-115.dat	upx
behavioral1/files/0x0006000000016eb2-105.dat	upx
behavioral1/memory/2976-4380-0x000000013FEF0000-0x00000001402E2000-memory.dmp	upx
behavioral1/memory/2640-4381-0x000000013F330000-0x000000013F722000-memory.dmp	upx
behavioral1/memory/2464-4428-0x000000013F100000-0x000000013F4F2000-memory.dmp	upx
behavioral1/memory/2512-4422-0x000000013F820000-0x000000013FC12000-memory.dmp	upx
behavioral1/memory/2588-4432-0x000000013FB40000-0x000000013FF32000-memory.dmp	upx
behavioral1/memory/2564-4431-0x000000013F1A0000-0x000000013F592000-memory.dmp	upx
behavioral1/memory/2548-5059-0x000000013FE70000-0x0000000140262000-memory.dmp	upx
behavioral1/memory/2624-5087-0x000000013F4B0000-0x000000013F8A2000-memory.dmp	upx
behavioral1/memory/2188-8167-0x000000013F0B0000-0x000000013F4A2000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\HIDRHKc.exe	82a04decb6fe60912a068928e1b943d9f89be653e408aa95f65be58c8559fdcb_NeikiAnalytics.exe
File created	C:\Windows\System\KJAPuXt.exe	82a04decb6fe60912a068928e1b943d9f89be653e408aa95f65be58c8559fdcb_NeikiAnalytics.exe
File created	C:\Windows\System\oEMQbVa.exe	82a04decb6fe60912a068928e1b943d9f89be653e408aa95f65be58c8559fdcb_NeikiAnalytics.exe
File created	C:\Windows\System\qlXPEVx.exe	82a04decb6fe60912a068928e1b943d9f89be653e408aa95f65be58c8559fdcb_NeikiAnalytics.exe
File created	C:\Windows\System\VJYfoOM.exe	82a04decb6fe60912a068928e1b943d9f89be653e408aa95f65be58c8559fdcb_NeikiAnalytics.exe
File created	C:\Windows\System\tXeQjjn.exe	82a04decb6fe60912a068928e1b943d9f89be653e408aa95f65be58c8559fdcb_NeikiAnalytics.exe
File created	C:\Windows\System\LAiKGuR.exe	82a04decb6fe60912a068928e1b943d9f89be653e408aa95f65be58c8559fdcb_NeikiAnalytics.exe
File created	C:\Windows\System\ZkNTsQs.exe	82a04decb6fe60912a068928e1b943d9f89be653e408aa95f65be58c8559fdcb_NeikiAnalytics.exe
File created	C:\Windows\System\sAAwjII.exe	82a04decb6fe60912a068928e1b943d9f89be653e408aa95f65be58c8559fdcb_NeikiAnalytics.exe
File created	C:\Windows\System\uxSZGvw.exe	82a04decb6fe60912a068928e1b943d9f89be653e408aa95f65be58c8559fdcb_NeikiAnalytics.exe
File created	C:\Windows\System\gEPFbmi.exe	82a04decb6fe60912a068928e1b943d9f89be653e408aa95f65be58c8559fdcb_NeikiAnalytics.exe
File created	C:\Windows\System\NYXTBTO.exe	82a04decb6fe60912a068928e1b943d9f89be653e408aa95f65be58c8559fdcb_NeikiAnalytics.exe
File created	C:\Windows\System\EUWlFEg.exe	82a04decb6fe60912a068928e1b943d9f89be653e408aa95f65be58c8559fdcb_NeikiAnalytics.exe
File created	C:\Windows\System\cRLpfqi.exe	82a04decb6fe60912a068928e1b943d9f89be653e408aa95f65be58c8559fdcb_NeikiAnalytics.exe
File created	C:\Windows\System\ullWYAj.exe	82a04decb6fe60912a068928e1b943d9f89be653e408aa95f65be58c8559fdcb_NeikiAnalytics.exe
File created	C:\Windows\System\MbrZNXG.exe	82a04decb6fe60912a068928e1b943d9f89be653e408aa95f65be58c8559fdcb_NeikiAnalytics.exe
File created	C:\Windows\System\vzHbSZx.exe	82a04decb6fe60912a068928e1b943d9f89be653e408aa95f65be58c8559fdcb_NeikiAnalytics.exe
File created	C:\Windows\System\kSwUuIp.exe	82a04decb6fe60912a068928e1b943d9f89be653e408aa95f65be58c8559fdcb_NeikiAnalytics.exe
File created	C:\Windows\System\QXuPyoR.exe	82a04decb6fe60912a068928e1b943d9f89be653e408aa95f65be58c8559fdcb_NeikiAnalytics.exe
File created	C:\Windows\System\TwBRQkG.exe	82a04decb6fe60912a068928e1b943d9f89be653e408aa95f65be58c8559fdcb_NeikiAnalytics.exe
File created	C:\Windows\System\iJYkacH.exe	82a04decb6fe60912a068928e1b943d9f89be653e408aa95f65be58c8559fdcb_NeikiAnalytics.exe
File created	C:\Windows\System\drNfSkr.exe	82a04decb6fe60912a068928e1b943d9f89be653e408aa95f65be58c8559fdcb_NeikiAnalytics.exe
File created	C:\Windows\System\OoITQzW.exe	82a04decb6fe60912a068928e1b943d9f89be653e408aa95f65be58c8559fdcb_NeikiAnalytics.exe
File created	C:\Windows\System\JHbJUAX.exe	82a04decb6fe60912a068928e1b943d9f89be653e408aa95f65be58c8559fdcb_NeikiAnalytics.exe
File created	C:\Windows\System\tWotHRV.exe	82a04decb6fe60912a068928e1b943d9f89be653e408aa95f65be58c8559fdcb_NeikiAnalytics.exe
File created	C:\Windows\System\NGIxzwh.exe	82a04decb6fe60912a068928e1b943d9f89be653e408aa95f65be58c8559fdcb_NeikiAnalytics.exe
File created	C:\Windows\System\uUeIIMe.exe	82a04decb6fe60912a068928e1b943d9f89be653e408aa95f65be58c8559fdcb_NeikiAnalytics.exe
File created	C:\Windows\System\GYRUTud.exe	82a04decb6fe60912a068928e1b943d9f89be653e408aa95f65be58c8559fdcb_NeikiAnalytics.exe
File created	C:\Windows\System\LOktThM.exe	82a04decb6fe60912a068928e1b943d9f89be653e408aa95f65be58c8559fdcb_NeikiAnalytics.exe
File created	C:\Windows\System\wsiGMgL.exe	82a04decb6fe60912a068928e1b943d9f89be653e408aa95f65be58c8559fdcb_NeikiAnalytics.exe
File created	C:\Windows\System\RqLUoPm.exe	82a04decb6fe60912a068928e1b943d9f89be653e408aa95f65be58c8559fdcb_NeikiAnalytics.exe
File created	C:\Windows\System\AqjPVey.exe	82a04decb6fe60912a068928e1b943d9f89be653e408aa95f65be58c8559fdcb_NeikiAnalytics.exe
File created	C:\Windows\System\TPRyxII.exe	82a04decb6fe60912a068928e1b943d9f89be653e408aa95f65be58c8559fdcb_NeikiAnalytics.exe
File created	C:\Windows\System\KFSZXNz.exe	82a04decb6fe60912a068928e1b943d9f89be653e408aa95f65be58c8559fdcb_NeikiAnalytics.exe
File created	C:\Windows\System\ywtaxfY.exe	82a04decb6fe60912a068928e1b943d9f89be653e408aa95f65be58c8559fdcb_NeikiAnalytics.exe
File created	C:\Windows\System\fcRbXfu.exe	82a04decb6fe60912a068928e1b943d9f89be653e408aa95f65be58c8559fdcb_NeikiAnalytics.exe
File created	C:\Windows\System\cBYsENd.exe	82a04decb6fe60912a068928e1b943d9f89be653e408aa95f65be58c8559fdcb_NeikiAnalytics.exe
File created	C:\Windows\System\MDtBWkw.exe	82a04decb6fe60912a068928e1b943d9f89be653e408aa95f65be58c8559fdcb_NeikiAnalytics.exe
File created	C:\Windows\System\MzcKwjM.exe	82a04decb6fe60912a068928e1b943d9f89be653e408aa95f65be58c8559fdcb_NeikiAnalytics.exe
File created	C:\Windows\System\BvGTrlq.exe	82a04decb6fe60912a068928e1b943d9f89be653e408aa95f65be58c8559fdcb_NeikiAnalytics.exe
File created	C:\Windows\System\lAdDpoJ.exe	82a04decb6fe60912a068928e1b943d9f89be653e408aa95f65be58c8559fdcb_NeikiAnalytics.exe
File created	C:\Windows\System\SOOLXNC.exe	82a04decb6fe60912a068928e1b943d9f89be653e408aa95f65be58c8559fdcb_NeikiAnalytics.exe
File created	C:\Windows\System\pUEEYvx.exe	82a04decb6fe60912a068928e1b943d9f89be653e408aa95f65be58c8559fdcb_NeikiAnalytics.exe
File created	C:\Windows\System\biiIlTF.exe	82a04decb6fe60912a068928e1b943d9f89be653e408aa95f65be58c8559fdcb_NeikiAnalytics.exe
File created	C:\Windows\System\FqZAbDH.exe	82a04decb6fe60912a068928e1b943d9f89be653e408aa95f65be58c8559fdcb_NeikiAnalytics.exe
File created	C:\Windows\System\lQKwelt.exe	82a04decb6fe60912a068928e1b943d9f89be653e408aa95f65be58c8559fdcb_NeikiAnalytics.exe
File created	C:\Windows\System\YunRGFR.exe	82a04decb6fe60912a068928e1b943d9f89be653e408aa95f65be58c8559fdcb_NeikiAnalytics.exe
File created	C:\Windows\System\wQSDMxf.exe	82a04decb6fe60912a068928e1b943d9f89be653e408aa95f65be58c8559fdcb_NeikiAnalytics.exe
File created	C:\Windows\System\RsVeMPd.exe	82a04decb6fe60912a068928e1b943d9f89be653e408aa95f65be58c8559fdcb_NeikiAnalytics.exe
File created	C:\Windows\System\aIOdAUv.exe	82a04decb6fe60912a068928e1b943d9f89be653e408aa95f65be58c8559fdcb_NeikiAnalytics.exe
File created	C:\Windows\System\DzGqghZ.exe	82a04decb6fe60912a068928e1b943d9f89be653e408aa95f65be58c8559fdcb_NeikiAnalytics.exe
File created	C:\Windows\System\NdKPhjo.exe	82a04decb6fe60912a068928e1b943d9f89be653e408aa95f65be58c8559fdcb_NeikiAnalytics.exe
File created	C:\Windows\System\zYgmOiO.exe	82a04decb6fe60912a068928e1b943d9f89be653e408aa95f65be58c8559fdcb_NeikiAnalytics.exe
File created	C:\Windows\System\qLfNeDs.exe	82a04decb6fe60912a068928e1b943d9f89be653e408aa95f65be58c8559fdcb_NeikiAnalytics.exe
File created	C:\Windows\System\SpPnMwj.exe	82a04decb6fe60912a068928e1b943d9f89be653e408aa95f65be58c8559fdcb_NeikiAnalytics.exe
File created	C:\Windows\System\ufUIIMy.exe	82a04decb6fe60912a068928e1b943d9f89be653e408aa95f65be58c8559fdcb_NeikiAnalytics.exe
File created	C:\Windows\System\XaBYAhO.exe	82a04decb6fe60912a068928e1b943d9f89be653e408aa95f65be58c8559fdcb_NeikiAnalytics.exe
File created	C:\Windows\System\eZEQPDt.exe	82a04decb6fe60912a068928e1b943d9f89be653e408aa95f65be58c8559fdcb_NeikiAnalytics.exe
File created	C:\Windows\System\XUMQnbg.exe	82a04decb6fe60912a068928e1b943d9f89be653e408aa95f65be58c8559fdcb_NeikiAnalytics.exe
File created	C:\Windows\System\QIQyozo.exe	82a04decb6fe60912a068928e1b943d9f89be653e408aa95f65be58c8559fdcb_NeikiAnalytics.exe
File created	C:\Windows\System\tlUjaOS.exe	82a04decb6fe60912a068928e1b943d9f89be653e408aa95f65be58c8559fdcb_NeikiAnalytics.exe
File created	C:\Windows\System\fALLJxD.exe	82a04decb6fe60912a068928e1b943d9f89be653e408aa95f65be58c8559fdcb_NeikiAnalytics.exe
File created	C:\Windows\System\NVZVBQU.exe	82a04decb6fe60912a068928e1b943d9f89be653e408aa95f65be58c8559fdcb_NeikiAnalytics.exe
File created	C:\Windows\System\pbcAtax.exe	82a04decb6fe60912a068928e1b943d9f89be653e408aa95f65be58c8559fdcb_NeikiAnalytics.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2784	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2188	82a04decb6fe60912a068928e1b943d9f89be653e408aa95f65be58c8559fdcb_NeikiAnalytics.exe
Token: SeLockMemoryPrivilege	2188	82a04decb6fe60912a068928e1b943d9f89be653e408aa95f65be58c8559fdcb_NeikiAnalytics.exe
Token: SeDebugPrivilege	2784	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2188 wrote to memory of 2784	2188	82a04decb6fe60912a068928e1b943d9f89be653e408aa95f65be58c8559fdcb_NeikiAnalytics.exe	29
PID 2188 wrote to memory of 2784	2188	82a04decb6fe60912a068928e1b943d9f89be653e408aa95f65be58c8559fdcb_NeikiAnalytics.exe	29
PID 2188 wrote to memory of 2784	2188	82a04decb6fe60912a068928e1b943d9f89be653e408aa95f65be58c8559fdcb_NeikiAnalytics.exe	29
PID 2188 wrote to memory of 2976	2188	82a04decb6fe60912a068928e1b943d9f89be653e408aa95f65be58c8559fdcb_NeikiAnalytics.exe	30
PID 2188 wrote to memory of 2976	2188	82a04decb6fe60912a068928e1b943d9f89be653e408aa95f65be58c8559fdcb_NeikiAnalytics.exe	30
PID 2188 wrote to memory of 2976	2188	82a04decb6fe60912a068928e1b943d9f89be653e408aa95f65be58c8559fdcb_NeikiAnalytics.exe	30
PID 2188 wrote to memory of 2624	2188	82a04decb6fe60912a068928e1b943d9f89be653e408aa95f65be58c8559fdcb_NeikiAnalytics.exe	31
PID 2188 wrote to memory of 2624	2188	82a04decb6fe60912a068928e1b943d9f89be653e408aa95f65be58c8559fdcb_NeikiAnalytics.exe	31
PID 2188 wrote to memory of 2624	2188	82a04decb6fe60912a068928e1b943d9f89be653e408aa95f65be58c8559fdcb_NeikiAnalytics.exe	31
PID 2188 wrote to memory of 2640	2188	82a04decb6fe60912a068928e1b943d9f89be653e408aa95f65be58c8559fdcb_NeikiAnalytics.exe	32
PID 2188 wrote to memory of 2640	2188	82a04decb6fe60912a068928e1b943d9f89be653e408aa95f65be58c8559fdcb_NeikiAnalytics.exe	32
PID 2188 wrote to memory of 2640	2188	82a04decb6fe60912a068928e1b943d9f89be653e408aa95f65be58c8559fdcb_NeikiAnalytics.exe	32
PID 2188 wrote to memory of 2512	2188	82a04decb6fe60912a068928e1b943d9f89be653e408aa95f65be58c8559fdcb_NeikiAnalytics.exe	33
PID 2188 wrote to memory of 2512	2188	82a04decb6fe60912a068928e1b943d9f89be653e408aa95f65be58c8559fdcb_NeikiAnalytics.exe	33
PID 2188 wrote to memory of 2512	2188	82a04decb6fe60912a068928e1b943d9f89be653e408aa95f65be58c8559fdcb_NeikiAnalytics.exe	33
PID 2188 wrote to memory of 2588	2188	82a04decb6fe60912a068928e1b943d9f89be653e408aa95f65be58c8559fdcb_NeikiAnalytics.exe	34
PID 2188 wrote to memory of 2588	2188	82a04decb6fe60912a068928e1b943d9f89be653e408aa95f65be58c8559fdcb_NeikiAnalytics.exe	34
PID 2188 wrote to memory of 2588	2188	82a04decb6fe60912a068928e1b943d9f89be653e408aa95f65be58c8559fdcb_NeikiAnalytics.exe	34
PID 2188 wrote to memory of 2404	2188	82a04decb6fe60912a068928e1b943d9f89be653e408aa95f65be58c8559fdcb_NeikiAnalytics.exe	35
PID 2188 wrote to memory of 2404	2188	82a04decb6fe60912a068928e1b943d9f89be653e408aa95f65be58c8559fdcb_NeikiAnalytics.exe	35
PID 2188 wrote to memory of 2404	2188	82a04decb6fe60912a068928e1b943d9f89be653e408aa95f65be58c8559fdcb_NeikiAnalytics.exe	35
PID 2188 wrote to memory of 2548	2188	82a04decb6fe60912a068928e1b943d9f89be653e408aa95f65be58c8559fdcb_NeikiAnalytics.exe	36
PID 2188 wrote to memory of 2548	2188	82a04decb6fe60912a068928e1b943d9f89be653e408aa95f65be58c8559fdcb_NeikiAnalytics.exe	36
PID 2188 wrote to memory of 2548	2188	82a04decb6fe60912a068928e1b943d9f89be653e408aa95f65be58c8559fdcb_NeikiAnalytics.exe	36
PID 2188 wrote to memory of 1568	2188	82a04decb6fe60912a068928e1b943d9f89be653e408aa95f65be58c8559fdcb_NeikiAnalytics.exe	37
PID 2188 wrote to memory of 1568	2188	82a04decb6fe60912a068928e1b943d9f89be653e408aa95f65be58c8559fdcb_NeikiAnalytics.exe	37
PID 2188 wrote to memory of 1568	2188	82a04decb6fe60912a068928e1b943d9f89be653e408aa95f65be58c8559fdcb_NeikiAnalytics.exe	37
PID 2188 wrote to memory of 2564	2188	82a04decb6fe60912a068928e1b943d9f89be653e408aa95f65be58c8559fdcb_NeikiAnalytics.exe	38
PID 2188 wrote to memory of 2564	2188	82a04decb6fe60912a068928e1b943d9f89be653e408aa95f65be58c8559fdcb_NeikiAnalytics.exe	38
PID 2188 wrote to memory of 2564	2188	82a04decb6fe60912a068928e1b943d9f89be653e408aa95f65be58c8559fdcb_NeikiAnalytics.exe	38
PID 2188 wrote to memory of 2680	2188	82a04decb6fe60912a068928e1b943d9f89be653e408aa95f65be58c8559fdcb_NeikiAnalytics.exe	39
PID 2188 wrote to memory of 2680	2188	82a04decb6fe60912a068928e1b943d9f89be653e408aa95f65be58c8559fdcb_NeikiAnalytics.exe	39
PID 2188 wrote to memory of 2680	2188	82a04decb6fe60912a068928e1b943d9f89be653e408aa95f65be58c8559fdcb_NeikiAnalytics.exe	39
PID 2188 wrote to memory of 2464	2188	82a04decb6fe60912a068928e1b943d9f89be653e408aa95f65be58c8559fdcb_NeikiAnalytics.exe	40
PID 2188 wrote to memory of 2464	2188	82a04decb6fe60912a068928e1b943d9f89be653e408aa95f65be58c8559fdcb_NeikiAnalytics.exe	40
PID 2188 wrote to memory of 2464	2188	82a04decb6fe60912a068928e1b943d9f89be653e408aa95f65be58c8559fdcb_NeikiAnalytics.exe	40
PID 2188 wrote to memory of 2192	2188	82a04decb6fe60912a068928e1b943d9f89be653e408aa95f65be58c8559fdcb_NeikiAnalytics.exe	41
PID 2188 wrote to memory of 2192	2188	82a04decb6fe60912a068928e1b943d9f89be653e408aa95f65be58c8559fdcb_NeikiAnalytics.exe	41
PID 2188 wrote to memory of 2192	2188	82a04decb6fe60912a068928e1b943d9f89be653e408aa95f65be58c8559fdcb_NeikiAnalytics.exe	41
PID 2188 wrote to memory of 2156	2188	82a04decb6fe60912a068928e1b943d9f89be653e408aa95f65be58c8559fdcb_NeikiAnalytics.exe	42
PID 2188 wrote to memory of 2156	2188	82a04decb6fe60912a068928e1b943d9f89be653e408aa95f65be58c8559fdcb_NeikiAnalytics.exe	42
PID 2188 wrote to memory of 2156	2188	82a04decb6fe60912a068928e1b943d9f89be653e408aa95f65be58c8559fdcb_NeikiAnalytics.exe	42
PID 2188 wrote to memory of 1740	2188	82a04decb6fe60912a068928e1b943d9f89be653e408aa95f65be58c8559fdcb_NeikiAnalytics.exe	43
PID 2188 wrote to memory of 1740	2188	82a04decb6fe60912a068928e1b943d9f89be653e408aa95f65be58c8559fdcb_NeikiAnalytics.exe	43
PID 2188 wrote to memory of 1740	2188	82a04decb6fe60912a068928e1b943d9f89be653e408aa95f65be58c8559fdcb_NeikiAnalytics.exe	43
PID 2188 wrote to memory of 1896	2188	82a04decb6fe60912a068928e1b943d9f89be653e408aa95f65be58c8559fdcb_NeikiAnalytics.exe	44
PID 2188 wrote to memory of 1896	2188	82a04decb6fe60912a068928e1b943d9f89be653e408aa95f65be58c8559fdcb_NeikiAnalytics.exe	44
PID 2188 wrote to memory of 1896	2188	82a04decb6fe60912a068928e1b943d9f89be653e408aa95f65be58c8559fdcb_NeikiAnalytics.exe	44
PID 2188 wrote to memory of 2268	2188	82a04decb6fe60912a068928e1b943d9f89be653e408aa95f65be58c8559fdcb_NeikiAnalytics.exe	45
PID 2188 wrote to memory of 2268	2188	82a04decb6fe60912a068928e1b943d9f89be653e408aa95f65be58c8559fdcb_NeikiAnalytics.exe	45
PID 2188 wrote to memory of 2268	2188	82a04decb6fe60912a068928e1b943d9f89be653e408aa95f65be58c8559fdcb_NeikiAnalytics.exe	45
PID 2188 wrote to memory of 984	2188	82a04decb6fe60912a068928e1b943d9f89be653e408aa95f65be58c8559fdcb_NeikiAnalytics.exe	46
PID 2188 wrote to memory of 984	2188	82a04decb6fe60912a068928e1b943d9f89be653e408aa95f65be58c8559fdcb_NeikiAnalytics.exe	46
PID 2188 wrote to memory of 984	2188	82a04decb6fe60912a068928e1b943d9f89be653e408aa95f65be58c8559fdcb_NeikiAnalytics.exe	46
PID 2188 wrote to memory of 2172	2188	82a04decb6fe60912a068928e1b943d9f89be653e408aa95f65be58c8559fdcb_NeikiAnalytics.exe	47
PID 2188 wrote to memory of 2172	2188	82a04decb6fe60912a068928e1b943d9f89be653e408aa95f65be58c8559fdcb_NeikiAnalytics.exe	47
PID 2188 wrote to memory of 2172	2188	82a04decb6fe60912a068928e1b943d9f89be653e408aa95f65be58c8559fdcb_NeikiAnalytics.exe	47
PID 2188 wrote to memory of 2112	2188	82a04decb6fe60912a068928e1b943d9f89be653e408aa95f65be58c8559fdcb_NeikiAnalytics.exe	48
PID 2188 wrote to memory of 2112	2188	82a04decb6fe60912a068928e1b943d9f89be653e408aa95f65be58c8559fdcb_NeikiAnalytics.exe	48
PID 2188 wrote to memory of 2112	2188	82a04decb6fe60912a068928e1b943d9f89be653e408aa95f65be58c8559fdcb_NeikiAnalytics.exe	48
PID 2188 wrote to memory of 592	2188	82a04decb6fe60912a068928e1b943d9f89be653e408aa95f65be58c8559fdcb_NeikiAnalytics.exe	49
PID 2188 wrote to memory of 592	2188	82a04decb6fe60912a068928e1b943d9f89be653e408aa95f65be58c8559fdcb_NeikiAnalytics.exe	49
PID 2188 wrote to memory of 592	2188	82a04decb6fe60912a068928e1b943d9f89be653e408aa95f65be58c8559fdcb_NeikiAnalytics.exe	49
PID 2188 wrote to memory of 872	2188	82a04decb6fe60912a068928e1b943d9f89be653e408aa95f65be58c8559fdcb_NeikiAnalytics.exe	50

C:\Users\Admin\AppData\Local\Temp\82a04decb6fe60912a068928e1b943d9f89be653e408aa95f65be58c8559fdcb_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\82a04decb6fe60912a068928e1b943d9f89be653e408aa95f65be58c8559fdcb_NeikiAnalytics.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2188
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2784
- C:\Windows\System\wqZqqrk.exe
  C:\Windows\System\wqZqqrk.exe
  2⤵
  - Executes dropped EXE
  PID:2976
- C:\Windows\System\DJZogBn.exe
  C:\Windows\System\DJZogBn.exe
  2⤵
  - Executes dropped EXE
  PID:2624
- C:\Windows\System\ykndzWW.exe
  C:\Windows\System\ykndzWW.exe
  2⤵
  - Executes dropped EXE
  PID:2640
- C:\Windows\System\QqSyvLt.exe
  C:\Windows\System\QqSyvLt.exe
  2⤵
  - Executes dropped EXE
  PID:2512
- C:\Windows\System\TAuDuDA.exe
  C:\Windows\System\TAuDuDA.exe
  2⤵
  - Executes dropped EXE
  PID:2588
- C:\Windows\System\GclVlIW.exe
  C:\Windows\System\GclVlIW.exe
  2⤵
  - Executes dropped EXE
  PID:2404
- C:\Windows\System\hLgGHoN.exe
  C:\Windows\System\hLgGHoN.exe
  2⤵
  - Executes dropped EXE
  PID:2548
- C:\Windows\System\yRfPPas.exe
  C:\Windows\System\yRfPPas.exe
  2⤵
  - Executes dropped EXE
  PID:1568
- C:\Windows\System\FTnaaaY.exe
  C:\Windows\System\FTnaaaY.exe
  2⤵
  - Executes dropped EXE
  PID:2564
- C:\Windows\System\QxTqBpI.exe
  C:\Windows\System\QxTqBpI.exe
  2⤵
  - Executes dropped EXE
  PID:2680
- C:\Windows\System\OETOGjO.exe
  C:\Windows\System\OETOGjO.exe
  2⤵
  - Executes dropped EXE
  PID:2464
- C:\Windows\System\JKjlsNL.exe
  C:\Windows\System\JKjlsNL.exe
  2⤵
  - Executes dropped EXE
  PID:2192
- C:\Windows\System\NKslHkn.exe
  C:\Windows\System\NKslHkn.exe
  2⤵
  - Executes dropped EXE
  PID:2156
- C:\Windows\System\QLprfxL.exe
  C:\Windows\System\QLprfxL.exe
  2⤵
  - Executes dropped EXE
  PID:1740
- C:\Windows\System\shikHYS.exe
  C:\Windows\System\shikHYS.exe
  2⤵
  - Executes dropped EXE
  PID:1896
- C:\Windows\System\gEPFbmi.exe
  C:\Windows\System\gEPFbmi.exe
  2⤵
  - Executes dropped EXE
  PID:2268
- C:\Windows\System\DGIRmtK.exe
  C:\Windows\System\DGIRmtK.exe
  2⤵
  - Executes dropped EXE
  PID:984
- C:\Windows\System\xLanqFX.exe
  C:\Windows\System\xLanqFX.exe
  2⤵
  - Executes dropped EXE
  PID:2172
- C:\Windows\System\LLZZFtA.exe
  C:\Windows\System\LLZZFtA.exe
  2⤵
  - Executes dropped EXE
  PID:2112
- C:\Windows\System\kKZXiqq.exe
  C:\Windows\System\kKZXiqq.exe
  2⤵
  - Executes dropped EXE
  PID:592
- C:\Windows\System\NcDgSMN.exe
  C:\Windows\System\NcDgSMN.exe
  2⤵
  - Executes dropped EXE
  PID:872
- C:\Windows\System\rIQkiwi.exe
  C:\Windows\System\rIQkiwi.exe
  2⤵
  - Executes dropped EXE
  PID:2120
- C:\Windows\System\GscheoC.exe
  C:\Windows\System\GscheoC.exe
  2⤵
  - Executes dropped EXE
  PID:860
- C:\Windows\System\FySDFjh.exe
  C:\Windows\System\FySDFjh.exe
  2⤵
  - Executes dropped EXE
  PID:1168
- C:\Windows\System\VUOxXSy.exe
  C:\Windows\System\VUOxXSy.exe
  2⤵
  - Executes dropped EXE
  PID:2892
- C:\Windows\System\kZkquqQ.exe
  C:\Windows\System\kZkquqQ.exe
  2⤵
  - Executes dropped EXE
  PID:2744
- C:\Windows\System\TFkBJuh.exe
  C:\Windows\System\TFkBJuh.exe
  2⤵
  - Executes dropped EXE
  PID:1536
- C:\Windows\System\iFhczDf.exe
  C:\Windows\System\iFhczDf.exe
  2⤵
  - Executes dropped EXE
  PID:1996
- C:\Windows\System\krIwHAq.exe
  C:\Windows\System\krIwHAq.exe
  2⤵
  - Executes dropped EXE
  PID:1376
- C:\Windows\System\LJLUaRV.exe
  C:\Windows\System\LJLUaRV.exe
  2⤵
  - Executes dropped EXE
  PID:2224
- C:\Windows\System\LAtvNxC.exe
  C:\Windows\System\LAtvNxC.exe
  2⤵
  - Executes dropped EXE
  PID:1892
- C:\Windows\System\IoOjMyZ.exe
  C:\Windows\System\IoOjMyZ.exe
  2⤵
  - Executes dropped EXE
  PID:1664
- C:\Windows\System\PaszaVG.exe
  C:\Windows\System\PaszaVG.exe
  2⤵
  - Executes dropped EXE
  PID:2772
- C:\Windows\System\UnwyyPP.exe
  C:\Windows\System\UnwyyPP.exe
  2⤵
  - Executes dropped EXE
  PID:1276
- C:\Windows\System\rDbtVZY.exe
  C:\Windows\System\rDbtVZY.exe
  2⤵
  - Executes dropped EXE
  PID:2036
- C:\Windows\System\hyMOIqT.exe
  C:\Windows\System\hyMOIqT.exe
  2⤵
  - Executes dropped EXE
  PID:3024
- C:\Windows\System\JDnyUdF.exe
  C:\Windows\System\JDnyUdF.exe
  2⤵
  - Executes dropped EXE
  PID:2096
- C:\Windows\System\XdLFuPq.exe
  C:\Windows\System\XdLFuPq.exe
  2⤵
  - Executes dropped EXE
  PID:1104
- C:\Windows\System\fNCChXS.exe
  C:\Windows\System\fNCChXS.exe
  2⤵
  - Executes dropped EXE
  PID:1280
- C:\Windows\System\isQKiYI.exe
  C:\Windows\System\isQKiYI.exe
  2⤵
  - Executes dropped EXE
  PID:2052
- C:\Windows\System\NYXTBTO.exe
  C:\Windows\System\NYXTBTO.exe
  2⤵
  - Executes dropped EXE
  PID:2216
- C:\Windows\System\feTLxjd.exe
  C:\Windows\System\feTLxjd.exe
  2⤵
  - Executes dropped EXE
  PID:752
- C:\Windows\System\qUSVPVn.exe
  C:\Windows\System\qUSVPVn.exe
  2⤵
  - Executes dropped EXE
  PID:944
- C:\Windows\System\XISvctA.exe
  C:\Windows\System\XISvctA.exe
  2⤵
  - Executes dropped EXE
  PID:3048
- C:\Windows\System\oLmkGlC.exe
  C:\Windows\System\oLmkGlC.exe
  2⤵
  - Executes dropped EXE
  PID:1548
- C:\Windows\System\hSnECNm.exe
  C:\Windows\System\hSnECNm.exe
  2⤵
  - Executes dropped EXE
  PID:2824
- C:\Windows\System\eqolqSC.exe
  C:\Windows\System\eqolqSC.exe
  2⤵
  - Executes dropped EXE
  PID:640
- C:\Windows\System\ZelwFPL.exe
  C:\Windows\System\ZelwFPL.exe
  2⤵
  - Executes dropped EXE
  PID:2852
- C:\Windows\System\kOAKcWX.exe
  C:\Windows\System\kOAKcWX.exe
  2⤵
  - Executes dropped EXE
  PID:1936
- C:\Windows\System\HvRcpwv.exe
  C:\Windows\System\HvRcpwv.exe
  2⤵
  - Executes dropped EXE
  PID:2180
- C:\Windows\System\OeQyxjr.exe
  C:\Windows\System\OeQyxjr.exe
  2⤵
  - Executes dropped EXE
  PID:2652
- C:\Windows\System\oDSEVwE.exe
  C:\Windows\System\oDSEVwE.exe
  2⤵
  - Executes dropped EXE
  PID:2428
- C:\Windows\System\IEmxERt.exe
  C:\Windows\System\IEmxERt.exe
  2⤵
  - Executes dropped EXE
  PID:2612
- C:\Windows\System\KWvcNSI.exe
  C:\Windows\System\KWvcNSI.exe
  2⤵
  - Executes dropped EXE
  PID:2488
- C:\Windows\System\HRYPyFX.exe
  C:\Windows\System\HRYPyFX.exe
  2⤵
  - Executes dropped EXE
  PID:2376
- C:\Windows\System\zAquIaa.exe
  C:\Windows\System\zAquIaa.exe
  2⤵
  - Executes dropped EXE
  PID:2900
- C:\Windows\System\hCLJzXR.exe
  C:\Windows\System\hCLJzXR.exe
  2⤵
  - Executes dropped EXE
  PID:2288
- C:\Windows\System\HWxzGOM.exe
  C:\Windows\System\HWxzGOM.exe
  2⤵
  - Executes dropped EXE
  PID:2704
- C:\Windows\System\vFoYJyF.exe
  C:\Windows\System\vFoYJyF.exe
  2⤵
  - Executes dropped EXE
  PID:1012
- C:\Windows\System\BAXffqJ.exe
  C:\Windows\System\BAXffqJ.exe
  2⤵
  - Executes dropped EXE
  PID:1748
- C:\Windows\System\BvxuLWx.exe
  C:\Windows\System\BvxuLWx.exe
  2⤵
  - Executes dropped EXE
  PID:1848
- C:\Windows\System\nPsfcTL.exe
  C:\Windows\System\nPsfcTL.exe
  2⤵
  - Executes dropped EXE
  PID:384
- C:\Windows\System\fKVoZGU.exe
  C:\Windows\System\fKVoZGU.exe
  2⤵
  - Executes dropped EXE
  PID:1600
- C:\Windows\System\qGBsvuZ.exe
  C:\Windows\System\qGBsvuZ.exe
  2⤵
  - Executes dropped EXE
  PID:1016
- C:\Windows\System\fBOYXGy.exe
  C:\Windows\System\fBOYXGy.exe
  2⤵
  PID:1092
- C:\Windows\System\YrDbCsU.exe
  C:\Windows\System\YrDbCsU.exe
  2⤵
  PID:1256
- C:\Windows\System\ARVFJoP.exe
  C:\Windows\System\ARVFJoP.exe
  2⤵
  PID:1184
- C:\Windows\System\PorGJHr.exe
  C:\Windows\System\PorGJHr.exe
  2⤵
  PID:2696
- C:\Windows\System\dFBprZh.exe
  C:\Windows\System\dFBprZh.exe
  2⤵
  PID:2044
- C:\Windows\System\CoYZIwg.exe
  C:\Windows\System\CoYZIwg.exe
  2⤵
  PID:580
- C:\Windows\System\qljBitW.exe
  C:\Windows\System\qljBitW.exe
  2⤵
  PID:1492
- C:\Windows\System\ZoCYZUz.exe
  C:\Windows\System\ZoCYZUz.exe
  2⤵
  PID:1228
- C:\Windows\System\rwNIRwI.exe
  C:\Windows\System\rwNIRwI.exe
  2⤵
  PID:1232
- C:\Windows\System\cXqhBKQ.exe
  C:\Windows\System\cXqhBKQ.exe
  2⤵
  PID:1388
- C:\Windows\System\OzCDOip.exe
  C:\Windows\System\OzCDOip.exe
  2⤵
  PID:552
- C:\Windows\System\CAwJjcm.exe
  C:\Windows\System\CAwJjcm.exe
  2⤵
  PID:1952
- C:\Windows\System\kojLUiq.exe
  C:\Windows\System\kojLUiq.exe
  2⤵
  PID:612
- C:\Windows\System\NBPBzlM.exe
  C:\Windows\System\NBPBzlM.exe
  2⤵
  PID:332
- C:\Windows\System\PzlFntL.exe
  C:\Windows\System\PzlFntL.exe
  2⤵
  PID:1632
- C:\Windows\System\QrJNrOG.exe
  C:\Windows\System\QrJNrOG.exe
  2⤵
  PID:1512
- C:\Windows\System\oYSUQLM.exe
  C:\Windows\System\oYSUQLM.exe
  2⤵
  PID:2448
- C:\Windows\System\ktAzwwa.exe
  C:\Windows\System\ktAzwwa.exe
  2⤵
  PID:1576
- C:\Windows\System\kigtdSh.exe
  C:\Windows\System\kigtdSh.exe
  2⤵
  PID:1888
- C:\Windows\System\oqxSDwW.exe
  C:\Windows\System\oqxSDwW.exe
  2⤵
  PID:2688
- C:\Windows\System\MUUryKs.exe
  C:\Windows\System\MUUryKs.exe
  2⤵
  PID:2780
- C:\Windows\System\VswJCZv.exe
  C:\Windows\System\VswJCZv.exe
  2⤵
  PID:2752
- C:\Windows\System\nyaGviQ.exe
  C:\Windows\System\nyaGviQ.exe
  2⤵
  PID:2352
- C:\Windows\System\CtEVWhv.exe
  C:\Windows\System\CtEVWhv.exe
  2⤵
  PID:2328
- C:\Windows\System\zOKBdCi.exe
  C:\Windows\System\zOKBdCi.exe
  2⤵
  PID:948
- C:\Windows\System\exoDbdz.exe
  C:\Windows\System\exoDbdz.exe
  2⤵
  PID:864
- C:\Windows\System\ByooVjb.exe
  C:\Windows\System\ByooVjb.exe
  2⤵
  PID:2280
- C:\Windows\System\jYTeJbO.exe
  C:\Windows\System\jYTeJbO.exe
  2⤵
  PID:888
- C:\Windows\System\MlLLkSH.exe
  C:\Windows\System\MlLLkSH.exe
  2⤵
  PID:352
- C:\Windows\System\gPwUpmP.exe
  C:\Windows\System\gPwUpmP.exe
  2⤵
  PID:2084
- C:\Windows\System\gaxsBBC.exe
  C:\Windows\System\gaxsBBC.exe
  2⤵
  PID:1668
- C:\Windows\System\ESeDPdG.exe
  C:\Windows\System\ESeDPdG.exe
  2⤵
  PID:2596
- C:\Windows\System\xehVYNx.exe
  C:\Windows\System\xehVYNx.exe
  2⤵
  PID:2580
- C:\Windows\System\FPgFaUC.exe
  C:\Windows\System\FPgFaUC.exe
  2⤵
  PID:2368
- C:\Windows\System\BeGqNDw.exe
  C:\Windows\System\BeGqNDw.exe
  2⤵
  PID:2528
- C:\Windows\System\ftllyYG.exe
  C:\Windows\System\ftllyYG.exe
  2⤵
  PID:2424
- C:\Windows\System\ZgZztYW.exe
  C:\Windows\System\ZgZztYW.exe
  2⤵
  PID:1540
- C:\Windows\System\CKyFqyc.exe
  C:\Windows\System\CKyFqyc.exe
  2⤵
  PID:1544
- C:\Windows\System\WuUbTJi.exe
  C:\Windows\System\WuUbTJi.exe
  2⤵
  PID:2200
- C:\Windows\System\XpIEZVO.exe
  C:\Windows\System\XpIEZVO.exe
  2⤵
  PID:540
- C:\Windows\System\EUvqniZ.exe
  C:\Windows\System\EUvqniZ.exe
  2⤵
  PID:2148
- C:\Windows\System\WBNYBSF.exe
  C:\Windows\System\WBNYBSF.exe
  2⤵
  PID:1264
- C:\Windows\System\BAkdXRv.exe
  C:\Windows\System\BAkdXRv.exe
  2⤵
  PID:2232
- C:\Windows\System\NuhNCoO.exe
  C:\Windows\System\NuhNCoO.exe
  2⤵
  PID:1680
- C:\Windows\System\EPCPFrL.exe
  C:\Windows\System\EPCPFrL.exe
  2⤵
  PID:2924
- C:\Windows\System\QrYEJiH.exe
  C:\Windows\System\QrYEJiH.exe
  2⤵
  PID:3040
- C:\Windows\System\YhnqSUT.exe
  C:\Windows\System\YhnqSUT.exe
  2⤵
  PID:1652
- C:\Windows\System\HNurldH.exe
  C:\Windows\System\HNurldH.exe
  2⤵
  PID:1924
- C:\Windows\System\JerhvCq.exe
  C:\Windows\System\JerhvCq.exe
  2⤵
  PID:2420
- C:\Windows\System\iDXRkuE.exe
  C:\Windows\System\iDXRkuE.exe
  2⤵
  PID:1008
- C:\Windows\System\cHdjvbC.exe
  C:\Windows\System\cHdjvbC.exe
  2⤵
  PID:1588
- C:\Windows\System\HdGWfZA.exe
  C:\Windows\System\HdGWfZA.exe
  2⤵
  PID:832
- C:\Windows\System\JYqTnks.exe
  C:\Windows\System\JYqTnks.exe
  2⤵
  PID:1596
- C:\Windows\System\vzDRdqm.exe
  C:\Windows\System\vzDRdqm.exe
  2⤵
  PID:1592
- C:\Windows\System\uqkqaof.exe
  C:\Windows\System\uqkqaof.exe
  2⤵
  PID:2872
- C:\Windows\System\thaxLPx.exe
  C:\Windows\System\thaxLPx.exe
  2⤵
  PID:2556
- C:\Windows\System\pbEbrDt.exe
  C:\Windows\System\pbEbrDt.exe
  2⤵
  PID:2128
- C:\Windows\System\ECQnmOq.exe
  C:\Windows\System\ECQnmOq.exe
  2⤵
  PID:3088
- C:\Windows\System\QGPLRgE.exe
  C:\Windows\System\QGPLRgE.exe
  2⤵
  PID:3104
- C:\Windows\System\kPUnHfj.exe
  C:\Windows\System\kPUnHfj.exe
  2⤵
  PID:3120
- C:\Windows\System\pItHugY.exe
  C:\Windows\System\pItHugY.exe
  2⤵
  PID:3136
- C:\Windows\System\ptmZRhV.exe
  C:\Windows\System\ptmZRhV.exe
  2⤵
  PID:3152
- C:\Windows\System\oVcNugB.exe
  C:\Windows\System\oVcNugB.exe
  2⤵
  PID:3168
- C:\Windows\System\QUlaiLa.exe
  C:\Windows\System\QUlaiLa.exe
  2⤵
  PID:3184
- C:\Windows\System\NKwSKQb.exe
  C:\Windows\System\NKwSKQb.exe
  2⤵
  PID:3200
- C:\Windows\System\HpnQkhB.exe
  C:\Windows\System\HpnQkhB.exe
  2⤵
  PID:3216
- C:\Windows\System\DXtQnht.exe
  C:\Windows\System\DXtQnht.exe
  2⤵
  PID:3232
- C:\Windows\System\sRIJghP.exe
  C:\Windows\System\sRIJghP.exe
  2⤵
  PID:3248
- C:\Windows\System\RKOVUKj.exe
  C:\Windows\System\RKOVUKj.exe
  2⤵
  PID:3264
- C:\Windows\System\YDDtsOX.exe
  C:\Windows\System\YDDtsOX.exe
  2⤵
  PID:3280
- C:\Windows\System\HtzsfHl.exe
  C:\Windows\System\HtzsfHl.exe
  2⤵
  PID:3296
- C:\Windows\System\qQvidzj.exe
  C:\Windows\System\qQvidzj.exe
  2⤵
  PID:3312
- C:\Windows\System\sUnFasq.exe
  C:\Windows\System\sUnFasq.exe
  2⤵
  PID:3328
- C:\Windows\System\VaQxsGM.exe
  C:\Windows\System\VaQxsGM.exe
  2⤵
  PID:3344
- C:\Windows\System\vLoWNfZ.exe
  C:\Windows\System\vLoWNfZ.exe
  2⤵
  PID:3360
- C:\Windows\System\qZtIsTv.exe
  C:\Windows\System\qZtIsTv.exe
  2⤵
  PID:3376
- C:\Windows\System\wiMzFjQ.exe
  C:\Windows\System\wiMzFjQ.exe
  2⤵
  PID:3392
- C:\Windows\System\GRGnovw.exe
  C:\Windows\System\GRGnovw.exe
  2⤵
  PID:3408
- C:\Windows\System\FkDFHpJ.exe
  C:\Windows\System\FkDFHpJ.exe
  2⤵
  PID:3428
- C:\Windows\System\oTpSnIC.exe
  C:\Windows\System\oTpSnIC.exe
  2⤵
  PID:3444
- C:\Windows\System\JAFPIqk.exe
  C:\Windows\System\JAFPIqk.exe
  2⤵
  PID:3460
- C:\Windows\System\HjgphOp.exe
  C:\Windows\System\HjgphOp.exe
  2⤵
  PID:3476
- C:\Windows\System\OKejtuj.exe
  C:\Windows\System\OKejtuj.exe
  2⤵
  PID:3492
- C:\Windows\System\GEVXBUX.exe
  C:\Windows\System\GEVXBUX.exe
  2⤵
  PID:3508
- C:\Windows\System\bQnrhXS.exe
  C:\Windows\System\bQnrhXS.exe
  2⤵
  PID:3524
- C:\Windows\System\SWUCbzS.exe
  C:\Windows\System\SWUCbzS.exe
  2⤵
  PID:3540
- C:\Windows\System\UzITmxX.exe
  C:\Windows\System\UzITmxX.exe
  2⤵
  PID:3556
- C:\Windows\System\AMhBGVd.exe
  C:\Windows\System\AMhBGVd.exe
  2⤵
  PID:3572
- C:\Windows\System\biiIlTF.exe
  C:\Windows\System\biiIlTF.exe
  2⤵
  PID:3588
- C:\Windows\System\BBKWnaO.exe
  C:\Windows\System\BBKWnaO.exe
  2⤵
  PID:3604
- C:\Windows\System\oDeCRya.exe
  C:\Windows\System\oDeCRya.exe
  2⤵
  PID:3620
- C:\Windows\System\DVygsLM.exe
  C:\Windows\System\DVygsLM.exe
  2⤵
  PID:3636
- C:\Windows\System\loXNQMP.exe
  C:\Windows\System\loXNQMP.exe
  2⤵
  PID:3652
- C:\Windows\System\YcsoldU.exe
  C:\Windows\System\YcsoldU.exe
  2⤵
  PID:3668
- C:\Windows\System\hGUxXWQ.exe
  C:\Windows\System\hGUxXWQ.exe
  2⤵
  PID:3684
- C:\Windows\System\UpdVePD.exe
  C:\Windows\System\UpdVePD.exe
  2⤵
  PID:3700
- C:\Windows\System\yUDLHGC.exe
  C:\Windows\System\yUDLHGC.exe
  2⤵
  PID:3716
- C:\Windows\System\AHBbhMd.exe
  C:\Windows\System\AHBbhMd.exe
  2⤵
  PID:3732
- C:\Windows\System\xybxMnH.exe
  C:\Windows\System\xybxMnH.exe
  2⤵
  PID:3748
- C:\Windows\System\MjCkBUr.exe
  C:\Windows\System\MjCkBUr.exe
  2⤵
  PID:3764
- C:\Windows\System\PCtadPX.exe
  C:\Windows\System\PCtadPX.exe
  2⤵
  PID:3780
- C:\Windows\System\caZFaRV.exe
  C:\Windows\System\caZFaRV.exe
  2⤵
  PID:3796
- C:\Windows\System\BKCPOPA.exe
  C:\Windows\System\BKCPOPA.exe
  2⤵
  PID:3812
- C:\Windows\System\crazHcg.exe
  C:\Windows\System\crazHcg.exe
  2⤵
  PID:3828
- C:\Windows\System\bTTBjyG.exe
  C:\Windows\System\bTTBjyG.exe
  2⤵
  PID:3844
- C:\Windows\System\BgGjTLV.exe
  C:\Windows\System\BgGjTLV.exe
  2⤵
  PID:3860
- C:\Windows\System\kgELZsb.exe
  C:\Windows\System\kgELZsb.exe
  2⤵
  PID:3876
- C:\Windows\System\jiLbJoi.exe
  C:\Windows\System\jiLbJoi.exe
  2⤵
  PID:3892
- C:\Windows\System\kQokHLD.exe
  C:\Windows\System\kQokHLD.exe
  2⤵
  PID:3908
- C:\Windows\System\OXEUJza.exe
  C:\Windows\System\OXEUJza.exe
  2⤵
  PID:3924
- C:\Windows\System\SLFRDrX.exe
  C:\Windows\System\SLFRDrX.exe
  2⤵
  PID:3940
- C:\Windows\System\WxBLcUH.exe
  C:\Windows\System\WxBLcUH.exe
  2⤵
  PID:3956
- C:\Windows\System\VsxTwrT.exe
  C:\Windows\System\VsxTwrT.exe
  2⤵
  PID:3972
- C:\Windows\System\CogsLzd.exe
  C:\Windows\System\CogsLzd.exe
  2⤵
  PID:3988
- C:\Windows\System\HRUlcaK.exe
  C:\Windows\System\HRUlcaK.exe
  2⤵
  PID:4004
- C:\Windows\System\FMGndzH.exe
  C:\Windows\System\FMGndzH.exe
  2⤵
  PID:4020
- C:\Windows\System\zYgmOiO.exe
  C:\Windows\System\zYgmOiO.exe
  2⤵
  PID:4036
- C:\Windows\System\ATEVHVe.exe
  C:\Windows\System\ATEVHVe.exe
  2⤵
  PID:4052
- C:\Windows\System\waktjfW.exe
  C:\Windows\System\waktjfW.exe
  2⤵
  PID:4068
- C:\Windows\System\PXrRYfB.exe
  C:\Windows\System\PXrRYfB.exe
  2⤵
  PID:4084
- C:\Windows\System\ziOcNUG.exe
  C:\Windows\System\ziOcNUG.exe
  2⤵
  PID:2880
- C:\Windows\System\tWiIWZl.exe
  C:\Windows\System\tWiIWZl.exe
  2⤵
  PID:292
- C:\Windows\System\yfUfhIi.exe
  C:\Windows\System\yfUfhIi.exe
  2⤵
  PID:1460
- C:\Windows\System\RUxmJsI.exe
  C:\Windows\System\RUxmJsI.exe
  2⤵
  PID:2732
- C:\Windows\System\DledsNm.exe
  C:\Windows\System\DledsNm.exe
  2⤵
  PID:2220
- C:\Windows\System\TxxToTo.exe
  C:\Windows\System\TxxToTo.exe
  2⤵
  PID:1704
- C:\Windows\System\oODxpjY.exe
  C:\Windows\System\oODxpjY.exe
  2⤵
  PID:1580
- C:\Windows\System\IoWnMuL.exe
  C:\Windows\System\IoWnMuL.exe
  2⤵
  PID:2568
- C:\Windows\System\SNRLJMN.exe
  C:\Windows\System\SNRLJMN.exe
  2⤵
  PID:2344
- C:\Windows\System\SQmSRUG.exe
  C:\Windows\System\SQmSRUG.exe
  2⤵
  PID:1096
- C:\Windows\System\rRDjUlv.exe
  C:\Windows\System\rRDjUlv.exe
  2⤵
  PID:108
- C:\Windows\System\FhlzPGy.exe
  C:\Windows\System\FhlzPGy.exe
  2⤵
  PID:1944
- C:\Windows\System\hMdnwaE.exe
  C:\Windows\System\hMdnwaE.exe
  2⤵
  PID:2800
- C:\Windows\System\tkjAxwt.exe
  C:\Windows\System\tkjAxwt.exe
  2⤵
  PID:3100
- C:\Windows\System\fgrygJS.exe
  C:\Windows\System\fgrygJS.exe
  2⤵
  PID:3132
- C:\Windows\System\wEyaVaX.exe
  C:\Windows\System\wEyaVaX.exe
  2⤵
  PID:3180
- C:\Windows\System\kGIOQwy.exe
  C:\Windows\System\kGIOQwy.exe
  2⤵
  PID:3212
- C:\Windows\System\GucnKkz.exe
  C:\Windows\System\GucnKkz.exe
  2⤵
  PID:3244
- C:\Windows\System\dfPvPMp.exe
  C:\Windows\System\dfPvPMp.exe
  2⤵
  PID:3276
- C:\Windows\System\JkNMqTW.exe
  C:\Windows\System\JkNMqTW.exe
  2⤵
  PID:3308
- C:\Windows\System\tlfhAar.exe
  C:\Windows\System\tlfhAar.exe
  2⤵
  PID:3340
- C:\Windows\System\pEcxfon.exe
  C:\Windows\System\pEcxfon.exe
  2⤵
  PID:3372
- C:\Windows\System\yrVMlzm.exe
  C:\Windows\System\yrVMlzm.exe
  2⤵
  PID:3404
- C:\Windows\System\yYUVqJi.exe
  C:\Windows\System\yYUVqJi.exe
  2⤵
  PID:3440
- C:\Windows\System\JwwKRSi.exe
  C:\Windows\System\JwwKRSi.exe
  2⤵
  PID:3472
- C:\Windows\System\cOJJCus.exe
  C:\Windows\System\cOJJCus.exe
  2⤵
  PID:3504
- C:\Windows\System\humeoYk.exe
  C:\Windows\System\humeoYk.exe
  2⤵
  PID:268
- C:\Windows\System\PtpVAkz.exe
  C:\Windows\System\PtpVAkz.exe
  2⤵
  PID:3532
- C:\Windows\System\AtRJzeA.exe
  C:\Windows\System\AtRJzeA.exe
  2⤵
  PID:3536
- C:\Windows\System\GwFOOVD.exe
  C:\Windows\System\GwFOOVD.exe
  2⤵
  PID:908
- C:\Windows\System\fKenmFZ.exe
  C:\Windows\System\fKenmFZ.exe
  2⤵
  PID:2828
- C:\Windows\System\DFEmqkf.exe
  C:\Windows\System\DFEmqkf.exe
  2⤵
  PID:3584
- C:\Windows\System\DluKRQR.exe
  C:\Windows\System\DluKRQR.exe
  2⤵
  PID:1520
- C:\Windows\System\ZaqyuTM.exe
  C:\Windows\System\ZaqyuTM.exe
  2⤵
  PID:3612
- C:\Windows\System\UMJRgIV.exe
  C:\Windows\System\UMJRgIV.exe
  2⤵
  PID:3644
- C:\Windows\System\GaBBQUA.exe
  C:\Windows\System\GaBBQUA.exe
  2⤵
  PID:3676
- C:\Windows\System\AzmcwbA.exe
  C:\Windows\System\AzmcwbA.exe
  2⤵
  PID:3708
- C:\Windows\System\HYlouEn.exe
  C:\Windows\System\HYlouEn.exe
  2⤵
  PID:3740
- C:\Windows\System\FRbGWww.exe
  C:\Windows\System\FRbGWww.exe
  2⤵
  PID:3772
- C:\Windows\System\WxqUjcY.exe
  C:\Windows\System\WxqUjcY.exe
  2⤵
  PID:3804
- C:\Windows\System\vxgoswC.exe
  C:\Windows\System\vxgoswC.exe
  2⤵
  PID:3836
- C:\Windows\System\Ilhqzfc.exe
  C:\Windows\System\Ilhqzfc.exe
  2⤵
  PID:3868
- C:\Windows\System\JzaCfar.exe
  C:\Windows\System\JzaCfar.exe
  2⤵
  PID:2092
- C:\Windows\System\MoLaWsu.exe
  C:\Windows\System\MoLaWsu.exe
  2⤵
  PID:3904
- C:\Windows\System\SITjUQN.exe
  C:\Windows\System\SITjUQN.exe
  2⤵
  PID:3948
- C:\Windows\System\hNAkYdH.exe
  C:\Windows\System\hNAkYdH.exe
  2⤵
  PID:3980
- C:\Windows\System\uYAApCU.exe
  C:\Windows\System\uYAApCU.exe
  2⤵
  PID:4012
- C:\Windows\System\iquooiu.exe
  C:\Windows\System\iquooiu.exe
  2⤵
  PID:4032
- C:\Windows\System\wNfQzCh.exe
  C:\Windows\System\wNfQzCh.exe
  2⤵
  PID:4064
- C:\Windows\System\RMlkZPA.exe
  C:\Windows\System\RMlkZPA.exe
  2⤵
  PID:2608
- C:\Windows\System\pAjLjGv.exe
  C:\Windows\System\pAjLjGv.exe
  2⤵
  PID:1188
- C:\Windows\System\cBGEatA.exe
  C:\Windows\System\cBGEatA.exe
  2⤵
  PID:1684
- C:\Windows\System\ySEWQNI.exe
  C:\Windows\System\ySEWQNI.exe
  2⤵
  PID:1884
- C:\Windows\System\fppzuKn.exe
  C:\Windows\System\fppzuKn.exe
  2⤵
  PID:1792
- C:\Windows\System\GEPlxLV.exe
  C:\Windows\System\GEPlxLV.exe
  2⤵
  PID:1244
- C:\Windows\System\nKKNTnD.exe
  C:\Windows\System\nKKNTnD.exe
  2⤵
  PID:1508
- C:\Windows\System\sIcSZZe.exe
  C:\Windows\System\sIcSZZe.exe
  2⤵
  PID:780
- C:\Windows\System\sizoVCy.exe
  C:\Windows\System\sizoVCy.exe
  2⤵
  PID:3116
- C:\Windows\System\TwBRQkG.exe
  C:\Windows\System\TwBRQkG.exe
  2⤵
  PID:3176
- C:\Windows\System\OjKBFdo.exe
  C:\Windows\System\OjKBFdo.exe
  2⤵
  PID:2496
- C:\Windows\System\uuRfojJ.exe
  C:\Windows\System\uuRfojJ.exe
  2⤵
  PID:3292
- C:\Windows\System\ABoxqmg.exe
  C:\Windows\System\ABoxqmg.exe
  2⤵
  PID:3336
- C:\Windows\System\ldkDdTj.exe
  C:\Windows\System\ldkDdTj.exe
  2⤵
  PID:1908
- C:\Windows\System\LOzHtBB.exe
  C:\Windows\System\LOzHtBB.exe
  2⤵
  PID:3488
- C:\Windows\System\wZcoIaq.exe
  C:\Windows\System\wZcoIaq.exe
  2⤵
  PID:3568
- C:\Windows\System\kYlnwPs.exe
  C:\Windows\System\kYlnwPs.exe
  2⤵
  PID:3648
- C:\Windows\System\BBuhbst.exe
  C:\Windows\System\BBuhbst.exe
  2⤵
  PID:568
- C:\Windows\System\yPmZwtf.exe
  C:\Windows\System\yPmZwtf.exe
  2⤵
  PID:3456
- C:\Windows\System\SGKxpcp.exe
  C:\Windows\System\SGKxpcp.exe
  2⤵
  PID:1696
- C:\Windows\System\YYkMjCS.exe
  C:\Windows\System\YYkMjCS.exe
  2⤵
  PID:1496
- C:\Windows\System\kvDiUXa.exe
  C:\Windows\System\kvDiUXa.exe
  2⤵
  PID:3696
- C:\Windows\System\ckidhsl.exe
  C:\Windows\System\ckidhsl.exe
  2⤵
  PID:3792
- C:\Windows\System\Kfbpuku.exe
  C:\Windows\System\Kfbpuku.exe
  2⤵
  PID:3900
- C:\Windows\System\bQmSEyf.exe
  C:\Windows\System\bQmSEyf.exe
  2⤵
  PID:4028
- C:\Windows\System\cIElUrI.exe
  C:\Windows\System\cIElUrI.exe
  2⤵
  PID:3424
- C:\Windows\System\VHyBhFe.exe
  C:\Windows\System\VHyBhFe.exe
  2⤵
  PID:2592
- C:\Windows\System\CqSaGUa.exe
  C:\Windows\System\CqSaGUa.exe
  2⤵
  PID:4092
- C:\Windows\System\uUWTTuI.exe
  C:\Windows\System\uUWTTuI.exe
  2⤵
  PID:2380
- C:\Windows\System\CSgwuAx.exe
  C:\Windows\System\CSgwuAx.exe
  2⤵
  PID:1992
- C:\Windows\System\nILEwXj.exe
  C:\Windows\System\nILEwXj.exe
  2⤵
  PID:2080
- C:\Windows\System\nXiaotE.exe
  C:\Windows\System\nXiaotE.exe
  2⤵
  PID:2692
- C:\Windows\System\JTCCUyn.exe
  C:\Windows\System\JTCCUyn.exe
  2⤵
  PID:2264
- C:\Windows\System\AscWELJ.exe
  C:\Windows\System\AscWELJ.exe
  2⤵
  PID:3196
- C:\Windows\System\cLqmdoD.exe
  C:\Windows\System\cLqmdoD.exe
  2⤵
  PID:3420
- C:\Windows\System\DlkwLQW.exe
  C:\Windows\System\DlkwLQW.exe
  2⤵
  PID:3388
- C:\Windows\System\UmzqTvz.exe
  C:\Windows\System\UmzqTvz.exe
  2⤵
  PID:900
- C:\Windows\System\CFbvAIU.exe
  C:\Windows\System\CFbvAIU.exe
  2⤵
  PID:2164
- C:\Windows\System\lVItfZK.exe
  C:\Windows\System\lVItfZK.exe
  2⤵
  PID:3256
- C:\Windows\System\QZmEPyy.exe
  C:\Windows\System\QZmEPyy.exe
  2⤵
  PID:2108
- C:\Windows\System\KOCiddj.exe
  C:\Windows\System\KOCiddj.exe
  2⤵
  PID:3968
- C:\Windows\System\uToLGZq.exe
  C:\Windows\System\uToLGZq.exe
  2⤵
  PID:3996
- C:\Windows\System\EFNuwIt.exe
  C:\Windows\System\EFNuwIt.exe
  2⤵
  PID:3824
- C:\Windows\System\tfMFFoD.exe
  C:\Windows\System\tfMFFoD.exe
  2⤵
  PID:3060
- C:\Windows\System\pbZuVsy.exe
  C:\Windows\System\pbZuVsy.exe
  2⤵
  PID:4080
- C:\Windows\System\CgAbKhw.exe
  C:\Windows\System\CgAbKhw.exe
  2⤵
  PID:3260
- C:\Windows\System\TOxlQKt.exe
  C:\Windows\System\TOxlQKt.exe
  2⤵
  PID:896
- C:\Windows\System\OuSdHes.exe
  C:\Windows\System\OuSdHes.exe
  2⤵
  PID:3680
- C:\Windows\System\iARAIqP.exe
  C:\Windows\System\iARAIqP.exe
  2⤵
  PID:2600
- C:\Windows\System\KCbyuok.exe
  C:\Windows\System\KCbyuok.exe
  2⤵
  PID:1644
- C:\Windows\System\lsUOtyt.exe
  C:\Windows\System\lsUOtyt.exe
  2⤵
  PID:3552
- C:\Windows\System\rfKEaOV.exe
  C:\Windows\System\rfKEaOV.exe
  2⤵
  PID:2932
- C:\Windows\System\hKmXMDf.exe
  C:\Windows\System\hKmXMDf.exe
  2⤵
  PID:3112
- C:\Windows\System\QbLOSiu.exe
  C:\Windows\System\QbLOSiu.exe
  2⤵
  PID:4104
- C:\Windows\System\CtEtYgZ.exe
  C:\Windows\System\CtEtYgZ.exe
  2⤵
  PID:4128
- C:\Windows\System\qlydlas.exe
  C:\Windows\System\qlydlas.exe
  2⤵
  PID:4152
- C:\Windows\System\lvKLMNP.exe
  C:\Windows\System\lvKLMNP.exe
  2⤵
  PID:4172
- C:\Windows\System\XYowooX.exe
  C:\Windows\System\XYowooX.exe
  2⤵
  PID:4188
- C:\Windows\System\LAAsjZQ.exe
  C:\Windows\System\LAAsjZQ.exe
  2⤵
  PID:4208
- C:\Windows\System\SDvheDK.exe
  C:\Windows\System\SDvheDK.exe
  2⤵
  PID:4224
- C:\Windows\System\RWALvKw.exe
  C:\Windows\System\RWALvKw.exe
  2⤵
  PID:4240
- C:\Windows\System\rZafblL.exe
  C:\Windows\System\rZafblL.exe
  2⤵
  PID:4256
- C:\Windows\System\yZVmwuQ.exe
  C:\Windows\System\yZVmwuQ.exe
  2⤵
  PID:4276
- C:\Windows\System\dJrSpka.exe
  C:\Windows\System\dJrSpka.exe
  2⤵
  PID:4296
- C:\Windows\System\LdGeOdE.exe
  C:\Windows\System\LdGeOdE.exe
  2⤵
  PID:4312
- C:\Windows\System\uiPooir.exe
  C:\Windows\System\uiPooir.exe
  2⤵
  PID:4332
- C:\Windows\System\ESdsLSc.exe
  C:\Windows\System\ESdsLSc.exe
  2⤵
  PID:4348
- C:\Windows\System\FIGqRud.exe
  C:\Windows\System\FIGqRud.exe
  2⤵
  PID:4364
- C:\Windows\System\jWiCIwq.exe
  C:\Windows\System\jWiCIwq.exe
  2⤵
  PID:4380
- C:\Windows\System\uLeQVbw.exe
  C:\Windows\System\uLeQVbw.exe
  2⤵
  PID:4400
- C:\Windows\System\UvZkQQE.exe
  C:\Windows\System\UvZkQQE.exe
  2⤵
  PID:4416
- C:\Windows\System\jTrAMQj.exe
  C:\Windows\System\jTrAMQj.exe
  2⤵
  PID:4432
- C:\Windows\System\OIsuGhj.exe
  C:\Windows\System\OIsuGhj.exe
  2⤵
  PID:4448
- C:\Windows\System\EjvjwMF.exe
  C:\Windows\System\EjvjwMF.exe
  2⤵
  PID:4464
- C:\Windows\System\ScihqMW.exe
  C:\Windows\System\ScihqMW.exe
  2⤵
  PID:4480
- C:\Windows\System\OUwZtur.exe
  C:\Windows\System\OUwZtur.exe
  2⤵
  PID:4500
- C:\Windows\System\TitpSDh.exe
  C:\Windows\System\TitpSDh.exe
  2⤵
  PID:4516
- C:\Windows\System\STIcNDp.exe
  C:\Windows\System\STIcNDp.exe
  2⤵
  PID:4532
- C:\Windows\System\AJVnenq.exe
  C:\Windows\System\AJVnenq.exe
  2⤵
  PID:4548
- C:\Windows\System\hJeQgIb.exe
  C:\Windows\System\hJeQgIb.exe
  2⤵
  PID:4564
- C:\Windows\System\oafQWTD.exe
  C:\Windows\System\oafQWTD.exe
  2⤵
  PID:4580
- C:\Windows\System\hIPxdtJ.exe
  C:\Windows\System\hIPxdtJ.exe
  2⤵
  PID:4600
- C:\Windows\System\eBrzfsY.exe
  C:\Windows\System\eBrzfsY.exe
  2⤵
  PID:4616
- C:\Windows\System\iRniBOQ.exe
  C:\Windows\System\iRniBOQ.exe
  2⤵
  PID:4632
- C:\Windows\System\oOepDCi.exe
  C:\Windows\System\oOepDCi.exe
  2⤵
  PID:4648
- C:\Windows\System\mGyONgh.exe
  C:\Windows\System\mGyONgh.exe
  2⤵
  PID:4664
- C:\Windows\System\isIFNVu.exe
  C:\Windows\System\isIFNVu.exe
  2⤵
  PID:4680
- C:\Windows\System\hwdeIEI.exe
  C:\Windows\System\hwdeIEI.exe
  2⤵
  PID:4696
- C:\Windows\System\AAtUTfc.exe
  C:\Windows\System\AAtUTfc.exe
  2⤵
  PID:4712
- C:\Windows\System\rDeYTcS.exe
  C:\Windows\System\rDeYTcS.exe
  2⤵
  PID:4728
- C:\Windows\System\cDHDbAc.exe
  C:\Windows\System\cDHDbAc.exe
  2⤵
  PID:4748
- C:\Windows\System\VqVXEFf.exe
  C:\Windows\System\VqVXEFf.exe
  2⤵
  PID:4764
- C:\Windows\System\BzWOLya.exe
  C:\Windows\System\BzWOLya.exe
  2⤵
  PID:4784
- C:\Windows\System\MSMiuMq.exe
  C:\Windows\System\MSMiuMq.exe
  2⤵
  PID:4800
- C:\Windows\System\HSzvynw.exe
  C:\Windows\System\HSzvynw.exe
  2⤵
  PID:4816
- C:\Windows\System\GSBCkyc.exe
  C:\Windows\System\GSBCkyc.exe
  2⤵
  PID:4832
- C:\Windows\System\GcObktT.exe
  C:\Windows\System\GcObktT.exe
  2⤵
  PID:4848
- C:\Windows\System\cKMSRUl.exe
  C:\Windows\System\cKMSRUl.exe
  2⤵
  PID:4892
- C:\Windows\System\VrjRdFT.exe
  C:\Windows\System\VrjRdFT.exe
  2⤵
  PID:4916
- C:\Windows\System\GGfFthh.exe
  C:\Windows\System\GGfFthh.exe
  2⤵
  PID:4932
- C:\Windows\System\uuiHHWl.exe
  C:\Windows\System\uuiHHWl.exe
  2⤵
  PID:4952
- C:\Windows\System\qyeSILV.exe
  C:\Windows\System\qyeSILV.exe
  2⤵
  PID:4968
- C:\Windows\System\xmKklvX.exe
  C:\Windows\System\xmKklvX.exe
  2⤵
  PID:4984
- C:\Windows\System\aaNtjzk.exe
  C:\Windows\System\aaNtjzk.exe
  2⤵
  PID:5000
- C:\Windows\System\NzwxEmm.exe
  C:\Windows\System\NzwxEmm.exe
  2⤵
  PID:5020
- C:\Windows\System\gUINfhc.exe
  C:\Windows\System\gUINfhc.exe
  2⤵
  PID:5040
- C:\Windows\System\kcuzOxB.exe
  C:\Windows\System\kcuzOxB.exe
  2⤵
  PID:5056
- C:\Windows\System\cFiuFBd.exe
  C:\Windows\System\cFiuFBd.exe
  2⤵
  PID:5072
- C:\Windows\System\gFuemPL.exe
  C:\Windows\System\gFuemPL.exe
  2⤵
  PID:5088
- C:\Windows\System\wtevoCm.exe
  C:\Windows\System\wtevoCm.exe
  2⤵
  PID:5108
- C:\Windows\System\BjQeiLD.exe
  C:\Windows\System\BjQeiLD.exe
  2⤵
  PID:2764
- C:\Windows\System\sWyzNRV.exe
  C:\Windows\System\sWyzNRV.exe
  2⤵
  PID:4116
- C:\Windows\System\pOKfaDG.exe
  C:\Windows\System\pOKfaDG.exe
  2⤵
  PID:4160
- C:\Windows\System\ctXBfnr.exe
  C:\Windows\System\ctXBfnr.exe
  2⤵
  PID:2476
- C:\Windows\System\iGzSjpx.exe
  C:\Windows\System\iGzSjpx.exe
  2⤵
  PID:4136
- C:\Windows\System\ULlTsrK.exe
  C:\Windows\System\ULlTsrK.exe
  2⤵
  PID:4184
- C:\Windows\System\PPuuHky.exe
  C:\Windows\System\PPuuHky.exe
  2⤵
  PID:4204
- C:\Windows\System\uHSRwVm.exe
  C:\Windows\System\uHSRwVm.exe
  2⤵
  PID:4264
- C:\Windows\System\iulYcpr.exe
  C:\Windows\System\iulYcpr.exe
  2⤵
  PID:4252
- C:\Windows\System\hnQmglf.exe
  C:\Windows\System\hnQmglf.exe
  2⤵
  PID:4320
- C:\Windows\System\UhyBZhO.exe
  C:\Windows\System\UhyBZhO.exe
  2⤵
  PID:4356
- C:\Windows\System\GlrUhsP.exe
  C:\Windows\System\GlrUhsP.exe
  2⤵
  PID:4372
- C:\Windows\System\mCGiOSr.exe
  C:\Windows\System\mCGiOSr.exe
  2⤵
  PID:4444
- C:\Windows\System\XKpsgic.exe
  C:\Windows\System\XKpsgic.exe
  2⤵
  PID:4512
- C:\Windows\System\EiQxfUP.exe
  C:\Windows\System\EiQxfUP.exe
  2⤵
  PID:4396
- C:\Windows\System\OwJXFVL.exe
  C:\Windows\System\OwJXFVL.exe
  2⤵
  PID:4456
- C:\Windows\System\qINagxO.exe
  C:\Windows\System\qINagxO.exe
  2⤵
  PID:4556
- C:\Windows\System\hobUkdt.exe
  C:\Windows\System\hobUkdt.exe
  2⤵
  PID:4640
- C:\Windows\System\Szeuaup.exe
  C:\Windows\System\Szeuaup.exe
  2⤵
  PID:4388
- C:\Windows\System\tACvwBj.exe
  C:\Windows\System\tACvwBj.exe
  2⤵
  PID:4708
- C:\Windows\System\ryMZOjH.exe
  C:\Windows\System\ryMZOjH.exe
  2⤵
  PID:4624
- C:\Windows\System\pvXIgea.exe
  C:\Windows\System\pvXIgea.exe
  2⤵
  PID:4596
- C:\Windows\System\jxXNoIk.exe
  C:\Windows\System\jxXNoIk.exe
  2⤵
  PID:4656
- C:\Windows\System\ZdATJsa.exe
  C:\Windows\System\ZdATJsa.exe
  2⤵
  PID:4780
- C:\Windows\System\vdHZJfA.exe
  C:\Windows\System\vdHZJfA.exe
  2⤵
  PID:4756
- C:\Windows\System\kRqRYvG.exe
  C:\Windows\System\kRqRYvG.exe
  2⤵
  PID:4840
- C:\Windows\System\qfAWvNE.exe
  C:\Windows\System\qfAWvNE.exe
  2⤵
  PID:4856
- C:\Windows\System\SLximDp.exe
  C:\Windows\System\SLximDp.exe
  2⤵
  PID:4876
- C:\Windows\System\ZQviAgH.exe
  C:\Windows\System\ZQviAgH.exe
  2⤵
  PID:4884
- C:\Windows\System\PaUtxcW.exe
  C:\Windows\System\PaUtxcW.exe
  2⤵
  PID:4912
- C:\Windows\System\UmhhcFX.exe
  C:\Windows\System\UmhhcFX.exe
  2⤵
  PID:4964
- C:\Windows\System\BfVSdZS.exe
  C:\Windows\System\BfVSdZS.exe
  2⤵
  PID:4944
- C:\Windows\System\GNFkRGu.exe
  C:\Windows\System\GNFkRGu.exe
  2⤵
  PID:5008
- C:\Windows\System\RdtQdLr.exe
  C:\Windows\System\RdtQdLr.exe
  2⤵
  PID:5052
- C:\Windows\System\JEqCXyC.exe
  C:\Windows\System\JEqCXyC.exe
  2⤵
  PID:3884
- C:\Windows\System\mPTKhKI.exe
  C:\Windows\System\mPTKhKI.exe
  2⤵
  PID:3468
- C:\Windows\System\BaUGIif.exe
  C:\Windows\System\BaUGIif.exe
  2⤵
  PID:4196
- C:\Windows\System\bovxoez.exe
  C:\Windows\System\bovxoez.exe
  2⤵
  PID:5068
- C:\Windows\System\DqxKlHg.exe
  C:\Windows\System\DqxKlHg.exe
  2⤵
  PID:4408
- C:\Windows\System\gjSdTJy.exe
  C:\Windows\System\gjSdTJy.exe
  2⤵
  PID:4392
- C:\Windows\System\VZUGFMk.exe
  C:\Windows\System\VZUGFMk.exe
  2⤵
  PID:4676
- C:\Windows\System\rEHKztZ.exe
  C:\Windows\System\rEHKztZ.exe
  2⤵
  PID:4736
- C:\Windows\System\zJZzFyp.exe
  C:\Windows\System\zJZzFyp.exe
  2⤵
  PID:4792
- C:\Windows\System\qLfNeDs.exe
  C:\Windows\System\qLfNeDs.exe
  2⤵
  PID:4888
- C:\Windows\System\eTEYCTZ.exe
  C:\Windows\System\eTEYCTZ.exe
  2⤵
  PID:4924
- C:\Windows\System\YNCtpVt.exe
  C:\Windows\System\YNCtpVt.exe
  2⤵
  PID:5104
- C:\Windows\System\ksOsjhy.exe
  C:\Windows\System\ksOsjhy.exe
  2⤵
  PID:4168
- C:\Windows\System\FsATLER.exe
  C:\Windows\System\FsATLER.exe
  2⤵
  PID:4180
- C:\Windows\System\kQUkrdE.exe
  C:\Windows\System\kQUkrdE.exe
  2⤵
  PID:4476
- C:\Windows\System\rwDiGki.exe
  C:\Windows\System\rwDiGki.exe
  2⤵
  PID:4660
- C:\Windows\System\PulKUQo.exe
  C:\Windows\System\PulKUQo.exe
  2⤵
  PID:4524
- C:\Windows\System\eQBHgIx.exe
  C:\Windows\System\eQBHgIx.exe
  2⤵
  PID:4720
- C:\Windows\System\uncziDY.exe
  C:\Windows\System\uncziDY.exe
  2⤵
  PID:4328
- C:\Windows\System\fnxzukc.exe
  C:\Windows\System\fnxzukc.exe
  2⤵
  PID:4868
- C:\Windows\System\yltspOu.exe
  C:\Windows\System\yltspOu.exe
  2⤵
  PID:4996
- C:\Windows\System\AFNxpOc.exe
  C:\Windows\System\AFNxpOc.exe
  2⤵
  PID:5128
- C:\Windows\System\SlPvNUP.exe
  C:\Windows\System\SlPvNUP.exe
  2⤵
  PID:5144
- C:\Windows\System\bJoTnAV.exe
  C:\Windows\System\bJoTnAV.exe
  2⤵
  PID:5160
- C:\Windows\System\hAgOquq.exe
  C:\Windows\System\hAgOquq.exe
  2⤵
  PID:5176
- C:\Windows\System\aHClHPe.exe
  C:\Windows\System\aHClHPe.exe
  2⤵
  PID:5192
- C:\Windows\System\ulKXQzr.exe
  C:\Windows\System\ulKXQzr.exe
  2⤵
  PID:5208
- C:\Windows\System\EUWlFEg.exe
  C:\Windows\System\EUWlFEg.exe
  2⤵
  PID:5224
- C:\Windows\System\VmjBQjT.exe
  C:\Windows\System\VmjBQjT.exe
  2⤵
  PID:5240
- C:\Windows\System\hIByLUS.exe
  C:\Windows\System\hIByLUS.exe
  2⤵
  PID:5256
- C:\Windows\System\jRFwbKK.exe
  C:\Windows\System\jRFwbKK.exe
  2⤵
  PID:5272
- C:\Windows\System\aVmYNgP.exe
  C:\Windows\System\aVmYNgP.exe
  2⤵
  PID:5288
- C:\Windows\System\IZBgCbK.exe
  C:\Windows\System\IZBgCbK.exe
  2⤵
  PID:5304
- C:\Windows\System\MFhxPJm.exe
  C:\Windows\System\MFhxPJm.exe
  2⤵
  PID:5320
- C:\Windows\System\iuKifkU.exe
  C:\Windows\System\iuKifkU.exe
  2⤵
  PID:5336
- C:\Windows\System\pJyyxzn.exe
  C:\Windows\System\pJyyxzn.exe
  2⤵
  PID:5352
- C:\Windows\System\kWTUXcT.exe
  C:\Windows\System\kWTUXcT.exe
  2⤵
  PID:5368
- C:\Windows\System\fOehOsN.exe
  C:\Windows\System\fOehOsN.exe
  2⤵
  PID:5384
- C:\Windows\System\bHQwnSZ.exe
  C:\Windows\System\bHQwnSZ.exe
  2⤵
  PID:5400
- C:\Windows\System\XIyabBN.exe
  C:\Windows\System\XIyabBN.exe
  2⤵
  PID:5416
- C:\Windows\System\LkgRZLG.exe
  C:\Windows\System\LkgRZLG.exe
  2⤵
  PID:5432
- C:\Windows\System\ygtGNbP.exe
  C:\Windows\System\ygtGNbP.exe
  2⤵
  PID:5448
- C:\Windows\System\nqHLesZ.exe
  C:\Windows\System\nqHLesZ.exe
  2⤵
  PID:5464
- C:\Windows\System\RWZOkSu.exe
  C:\Windows\System\RWZOkSu.exe
  2⤵
  PID:5480
- C:\Windows\System\aZXnkuI.exe
  C:\Windows\System\aZXnkuI.exe
  2⤵
  PID:5496
- C:\Windows\System\ZmrSUGl.exe
  C:\Windows\System\ZmrSUGl.exe
  2⤵
  PID:5512
- C:\Windows\System\MlcAmft.exe
  C:\Windows\System\MlcAmft.exe
  2⤵
  PID:5536
- C:\Windows\System\MpodYML.exe
  C:\Windows\System\MpodYML.exe
  2⤵
  PID:5552
- C:\Windows\System\ZBvbaGJ.exe
  C:\Windows\System\ZBvbaGJ.exe
  2⤵
  PID:5568
- C:\Windows\System\xSqTruz.exe
  C:\Windows\System\xSqTruz.exe
  2⤵
  PID:5584
- C:\Windows\System\lJDImOr.exe
  C:\Windows\System\lJDImOr.exe
  2⤵
  PID:5600
- C:\Windows\System\GqtTflL.exe
  C:\Windows\System\GqtTflL.exe
  2⤵
  PID:5616
- C:\Windows\System\VgQPIEn.exe
  C:\Windows\System\VgQPIEn.exe
  2⤵
  PID:5632
- C:\Windows\System\vGvxnSe.exe
  C:\Windows\System\vGvxnSe.exe
  2⤵
  PID:5648
- C:\Windows\System\ykmzwOl.exe
  C:\Windows\System\ykmzwOl.exe
  2⤵
  PID:5664
- C:\Windows\System\paVepCs.exe
  C:\Windows\System\paVepCs.exe
  2⤵
  PID:5680
- C:\Windows\System\WWpzqRC.exe
  C:\Windows\System\WWpzqRC.exe
  2⤵
  PID:5700
- C:\Windows\System\pjQrMIy.exe
  C:\Windows\System\pjQrMIy.exe
  2⤵
  PID:5716
- C:\Windows\System\MOTOHwz.exe
  C:\Windows\System\MOTOHwz.exe
  2⤵
  PID:5732
- C:\Windows\System\KBXDZNZ.exe
  C:\Windows\System\KBXDZNZ.exe
  2⤵
  PID:5748
- C:\Windows\System\KYmsezA.exe
  C:\Windows\System\KYmsezA.exe
  2⤵
  PID:5764
- C:\Windows\System\gRZfjXN.exe
  C:\Windows\System\gRZfjXN.exe
  2⤵
  PID:5784
- C:\Windows\System\xBDHzpG.exe
  C:\Windows\System\xBDHzpG.exe
  2⤵
  PID:5800
- C:\Windows\System\rPDvYLB.exe
  C:\Windows\System\rPDvYLB.exe
  2⤵
  PID:5816
- C:\Windows\System\voMmvPV.exe
  C:\Windows\System\voMmvPV.exe
  2⤵
  PID:5832
- C:\Windows\System\wnQBFBL.exe
  C:\Windows\System\wnQBFBL.exe
  2⤵
  PID:5852
- C:\Windows\System\riZwqWY.exe
  C:\Windows\System\riZwqWY.exe
  2⤵
  PID:5868
- C:\Windows\System\qPVyTBK.exe
  C:\Windows\System\qPVyTBK.exe
  2⤵
  PID:5884
- C:\Windows\System\FhtyUEc.exe
  C:\Windows\System\FhtyUEc.exe
  2⤵
  PID:5900
- C:\Windows\System\gIWsuaW.exe
  C:\Windows\System\gIWsuaW.exe
  2⤵
  PID:5916
- C:\Windows\System\ZLalLeu.exe
  C:\Windows\System\ZLalLeu.exe
  2⤵
  PID:5932
- C:\Windows\System\hyliMbI.exe
  C:\Windows\System\hyliMbI.exe
  2⤵
  PID:5952
- C:\Windows\System\HfYwXYL.exe
  C:\Windows\System\HfYwXYL.exe
  2⤵
  PID:5968
- C:\Windows\System\nXGPDyq.exe
  C:\Windows\System\nXGPDyq.exe
  2⤵
  PID:5984
- C:\Windows\System\XBCZqoP.exe
  C:\Windows\System\XBCZqoP.exe
  2⤵
  PID:6004
- C:\Windows\System\dqeJVPz.exe
  C:\Windows\System\dqeJVPz.exe
  2⤵
  PID:6020
- C:\Windows\System\CAxOxWA.exe
  C:\Windows\System\CAxOxWA.exe
  2⤵
  PID:6036
- C:\Windows\System\mCpsMRX.exe
  C:\Windows\System\mCpsMRX.exe
  2⤵
  PID:6056
- C:\Windows\System\yeQeDec.exe
  C:\Windows\System\yeQeDec.exe
  2⤵
  PID:6072
- C:\Windows\System\INVhUHT.exe
  C:\Windows\System\INVhUHT.exe
  2⤵
  PID:6088
- C:\Windows\System\RkNOLxk.exe
  C:\Windows\System\RkNOLxk.exe
  2⤵
  PID:6104
- C:\Windows\System\AXNvXDd.exe
  C:\Windows\System\AXNvXDd.exe
  2⤵
  PID:6120
- C:\Windows\System\SdWxsOg.exe
  C:\Windows\System\SdWxsOg.exe
  2⤵
  PID:6136
- C:\Windows\System\ZcgfPZv.exe
  C:\Windows\System\ZcgfPZv.exe
  2⤵
  PID:5036
- C:\Windows\System\WqYcQeY.exe
  C:\Windows\System\WqYcQeY.exe
  2⤵
  PID:4216
- C:\Windows\System\BjXfruR.exe
  C:\Windows\System\BjXfruR.exe
  2⤵
  PID:5200
- C:\Windows\System\MYaVYkc.exe
  C:\Windows\System\MYaVYkc.exe
  2⤵
  PID:4592
- C:\Windows\System\fLsMtWj.exe
  C:\Windows\System\fLsMtWj.exe
  2⤵
  PID:5300
- C:\Windows\System\GRiIDRh.exe
  C:\Windows\System\GRiIDRh.exe
  2⤵
  PID:4608
- C:\Windows\System\iRiHukE.exe
  C:\Windows\System\iRiHukE.exe
  2⤵
  PID:5100
- C:\Windows\System\gYGzUan.exe
  C:\Windows\System\gYGzUan.exe
  2⤵
  PID:4812
- C:\Windows\System\lrESwOH.exe
  C:\Windows\System\lrESwOH.exe
  2⤵
  PID:5424
- C:\Windows\System\KqgobcZ.exe
  C:\Windows\System\KqgobcZ.exe
  2⤵
  PID:5456
- C:\Windows\System\JyLRviY.exe
  C:\Windows\System\JyLRviY.exe
  2⤵
  PID:4288
- C:\Windows\System\XUMQnbg.exe
  C:\Windows\System\XUMQnbg.exe
  2⤵
  PID:1416
- C:\Windows\System\WiXVyMA.exe
  C:\Windows\System\WiXVyMA.exe
  2⤵
  PID:4148
- C:\Windows\System\xwCriWp.exe
  C:\Windows\System\xwCriWp.exe
  2⤵
  PID:4872
- C:\Windows\System\lxmSLpy.exe
  C:\Windows\System\lxmSLpy.exe
  2⤵
  PID:5440
- C:\Windows\System\WNZqnAU.exe
  C:\Windows\System\WNZqnAU.exe
  2⤵
  PID:5504
- C:\Windows\System\wrhIFBo.exe
  C:\Windows\System\wrhIFBo.exe
  2⤵
  PID:5064
- C:\Windows\System\ntxuIaC.exe
  C:\Windows\System\ntxuIaC.exe
  2⤵
  PID:5312
- C:\Windows\System\rwewuod.exe
  C:\Windows\System\rwewuod.exe
  2⤵
  PID:5348
- C:\Windows\System\GduaFJG.exe
  C:\Windows\System\GduaFJG.exe
  2⤵
  PID:4864
- C:\Windows\System\sfsiQth.exe
  C:\Windows\System\sfsiQth.exe
  2⤵
  PID:5216
- C:\Windows\System\skIXnBJ.exe
  C:\Windows\System\skIXnBJ.exe
  2⤵
  PID:5408
- C:\Windows\System\AqZVUgj.exe
  C:\Windows\System\AqZVUgj.exe
  2⤵
  PID:5544
- C:\Windows\System\IyRUvrt.exe
  C:\Windows\System\IyRUvrt.exe
  2⤵
  PID:5564
- C:\Windows\System\QzIFkCQ.exe
  C:\Windows\System\QzIFkCQ.exe
  2⤵
  PID:5624
- C:\Windows\System\ISnxutb.exe
  C:\Windows\System\ISnxutb.exe
  2⤵
  PID:5728
- C:\Windows\System\zPKRsXG.exe
  C:\Windows\System\zPKRsXG.exe
  2⤵
  PID:5756
- C:\Windows\System\HttfYXH.exe
  C:\Windows\System\HttfYXH.exe
  2⤵
  PID:5608
- C:\Windows\System\GpkmBzC.exe
  C:\Windows\System\GpkmBzC.exe
  2⤵
  PID:5676
- C:\Windows\System\yvXmYoJ.exe
  C:\Windows\System\yvXmYoJ.exe
  2⤵
  PID:5760
- C:\Windows\System\mCJtFSg.exe
  C:\Windows\System\mCJtFSg.exe
  2⤵
  PID:5924
- C:\Windows\System\zffQSJu.exe
  C:\Windows\System\zffQSJu.exe
  2⤵
  PID:5864
- C:\Windows\System\oyyktSY.exe
  C:\Windows\System\oyyktSY.exe
  2⤵
  PID:5928
- C:\Windows\System\rUpBuIx.exe
  C:\Windows\System\rUpBuIx.exe
  2⤵
  PID:6032
- C:\Windows\System\gpyzSYs.exe
  C:\Windows\System\gpyzSYs.exe
  2⤵
  PID:6100
- C:\Windows\System\rTMEvfu.exe
  C:\Windows\System\rTMEvfu.exe
  2⤵
  PID:5740
- C:\Windows\System\xRgTLPH.exe
  C:\Windows\System\xRgTLPH.exe
  2⤵
  PID:5840
- C:\Windows\System\caoqsvI.exe
  C:\Windows\System\caoqsvI.exe
  2⤵
  PID:5908
- C:\Windows\System\OkhOVsW.exe
  C:\Windows\System\OkhOVsW.exe
  2⤵
  PID:6016
- C:\Windows\System\dbAyTMo.exe
  C:\Windows\System\dbAyTMo.exe
  2⤵
  PID:6084
- C:\Windows\System\xxEGzQI.exe
  C:\Windows\System\xxEGzQI.exe
  2⤵
  PID:5808
- C:\Windows\System\qBTGCqK.exe
  C:\Windows\System\qBTGCqK.exe
  2⤵
  PID:5948
- C:\Windows\System\xPSrJNy.exe
  C:\Windows\System\xPSrJNy.exe
  2⤵
  PID:5172
- C:\Windows\System\pCHcBCv.exe
  C:\Windows\System\pCHcBCv.exe
  2⤵
  PID:3400
- C:\Windows\System\VUKuvXZ.exe
  C:\Windows\System\VUKuvXZ.exe
  2⤵
  PID:5236
- C:\Windows\System\ifQHGXp.exe
  C:\Windows\System\ifQHGXp.exe
  2⤵
  PID:5492
- C:\Windows\System\Ljbxozn.exe
  C:\Windows\System\Ljbxozn.exe
  2⤵
  PID:5124
- C:\Windows\System\kkylBiX.exe
  C:\Windows\System\kkylBiX.exe
  2⤵
  PID:5296
- C:\Windows\System\dzlAsLZ.exe
  C:\Windows\System\dzlAsLZ.exe
  2⤵
  PID:5016
- C:\Windows\System\rSUiYSG.exe
  C:\Windows\System\rSUiYSG.exe
  2⤵
  PID:4528
- C:\Windows\System\MGqveZb.exe
  C:\Windows\System\MGqveZb.exe
  2⤵
  PID:5280
- C:\Windows\System\iCzyZnv.exe
  C:\Windows\System\iCzyZnv.exe
  2⤵
  PID:5344
- C:\Windows\System\dvISdqV.exe
  C:\Windows\System\dvISdqV.exe
  2⤵
  PID:4824
- C:\Windows\System\stxevBV.exe
  C:\Windows\System\stxevBV.exe
  2⤵
  PID:5656
- C:\Windows\System\dhKHAOs.exe
  C:\Windows\System\dhKHAOs.exe
  2⤵
  PID:5712
- C:\Windows\System\XlrWoBY.exe
  C:\Windows\System\XlrWoBY.exe
  2⤵
  PID:5996
- C:\Windows\System\rXIvwAh.exe
  C:\Windows\System\rXIvwAh.exe
  2⤵
  PID:5592
- C:\Windows\System\bLtcAbg.exe
  C:\Windows\System\bLtcAbg.exe
  2⤵
  PID:5696
- C:\Windows\System\FqZAbDH.exe
  C:\Windows\System\FqZAbDH.exe
  2⤵
  PID:5828
- C:\Windows\System\WyeCGmN.exe
  C:\Windows\System\WyeCGmN.exe
  2⤵
  PID:5220
- C:\Windows\System\kkYMUaq.exe
  C:\Windows\System\kkYMUaq.exe
  2⤵
  PID:5824
- C:\Windows\System\xHYYJRU.exe
  C:\Windows\System\xHYYJRU.exe
  2⤵
  PID:5812
- C:\Windows\System\ITjEBIe.exe
  C:\Windows\System\ITjEBIe.exe
  2⤵
  PID:6080
- C:\Windows\System\dSbyAtO.exe
  C:\Windows\System\dSbyAtO.exe
  2⤵
  PID:5944
- C:\Windows\System\PHyNiuy.exe
  C:\Windows\System\PHyNiuy.exe
  2⤵
  PID:4344
- C:\Windows\System\mujktHB.exe
  C:\Windows\System\mujktHB.exe
  2⤵
  PID:4960
- C:\Windows\System\OwiFTSQ.exe
  C:\Windows\System\OwiFTSQ.exe
  2⤵
  PID:5532
- C:\Windows\System\PzGASKh.exe
  C:\Windows\System\PzGASKh.exe
  2⤵
  PID:6148
- C:\Windows\System\CHXAPhw.exe
  C:\Windows\System\CHXAPhw.exe
  2⤵
  PID:6164
- C:\Windows\System\dIncHCN.exe
  C:\Windows\System\dIncHCN.exe
  2⤵
  PID:6180
- C:\Windows\System\ztEiUvy.exe
  C:\Windows\System\ztEiUvy.exe
  2⤵
  PID:6196
- C:\Windows\System\JqLGhBR.exe
  C:\Windows\System\JqLGhBR.exe
  2⤵
  PID:6212
- C:\Windows\System\vTgsKWm.exe
  C:\Windows\System\vTgsKWm.exe
  2⤵
  PID:6228
- C:\Windows\System\WMtKLZc.exe
  C:\Windows\System\WMtKLZc.exe
  2⤵
  PID:6248
- C:\Windows\System\tbiLcMA.exe
  C:\Windows\System\tbiLcMA.exe
  2⤵
  PID:6264
- C:\Windows\System\rfpVmAv.exe
  C:\Windows\System\rfpVmAv.exe
  2⤵
  PID:6280
- C:\Windows\System\CSvuokU.exe
  C:\Windows\System\CSvuokU.exe
  2⤵
  PID:6296
- C:\Windows\System\LFZvMbA.exe
  C:\Windows\System\LFZvMbA.exe
  2⤵
  PID:6312
- C:\Windows\System\jiQWhUJ.exe
  C:\Windows\System\jiQWhUJ.exe
  2⤵
  PID:6328
- C:\Windows\System\ZCEplYS.exe
  C:\Windows\System\ZCEplYS.exe
  2⤵
  PID:6344
- C:\Windows\System\ExGXATZ.exe
  C:\Windows\System\ExGXATZ.exe
  2⤵
  PID:6360
- C:\Windows\System\uNKAfAA.exe
  C:\Windows\System\uNKAfAA.exe
  2⤵
  PID:6376
- C:\Windows\System\PIWaaVc.exe
  C:\Windows\System\PIWaaVc.exe
  2⤵
  PID:6396
- C:\Windows\System\hMttGXA.exe
  C:\Windows\System\hMttGXA.exe
  2⤵
  PID:6412
- C:\Windows\System\gNzSSqL.exe
  C:\Windows\System\gNzSSqL.exe
  2⤵
  PID:6428
- C:\Windows\System\xVCyBZt.exe
  C:\Windows\System\xVCyBZt.exe
  2⤵
  PID:6444
- C:\Windows\System\eSXqmgP.exe
  C:\Windows\System\eSXqmgP.exe
  2⤵
  PID:6460
- C:\Windows\System\IsyUJOi.exe
  C:\Windows\System\IsyUJOi.exe
  2⤵
  PID:6476
- C:\Windows\System\JopJzYW.exe
  C:\Windows\System\JopJzYW.exe
  2⤵
  PID:6492
- C:\Windows\System\MijShEU.exe
  C:\Windows\System\MijShEU.exe
  2⤵
  PID:6508
- C:\Windows\System\YukLGNR.exe
  C:\Windows\System\YukLGNR.exe
  2⤵
  PID:6524
- C:\Windows\System\jHHIVuK.exe
  C:\Windows\System\jHHIVuK.exe
  2⤵
  PID:6544
- C:\Windows\System\EYNPcOs.exe
  C:\Windows\System\EYNPcOs.exe
  2⤵
  PID:6560
- C:\Windows\System\YvYzRVS.exe
  C:\Windows\System\YvYzRVS.exe
  2⤵
  PID:6576
- C:\Windows\System\ECiBCpA.exe
  C:\Windows\System\ECiBCpA.exe
  2⤵
  PID:6596
- C:\Windows\System\bfWLEcT.exe
  C:\Windows\System\bfWLEcT.exe
  2⤵
  PID:6612
- C:\Windows\System\TLMjSGB.exe
  C:\Windows\System\TLMjSGB.exe
  2⤵
  PID:6628
- C:\Windows\System\jcabRpV.exe
  C:\Windows\System\jcabRpV.exe
  2⤵
  PID:6644
- C:\Windows\System\MzFcKKx.exe
  C:\Windows\System\MzFcKKx.exe
  2⤵
  PID:6660
- C:\Windows\System\RLEBpyv.exe
  C:\Windows\System\RLEBpyv.exe
  2⤵
  PID:6676
- C:\Windows\System\kSwUuIp.exe
  C:\Windows\System\kSwUuIp.exe
  2⤵
  PID:6692
- C:\Windows\System\fHqvuLl.exe
  C:\Windows\System\fHqvuLl.exe
  2⤵
  PID:6708
- C:\Windows\System\HOoSRHe.exe
  C:\Windows\System\HOoSRHe.exe
  2⤵
  PID:6724
- C:\Windows\System\uPwlteP.exe
  C:\Windows\System\uPwlteP.exe
  2⤵
  PID:6740
- C:\Windows\System\SqbHRqz.exe
  C:\Windows\System\SqbHRqz.exe
  2⤵
  PID:6756
- C:\Windows\System\FQYsKdv.exe
  C:\Windows\System\FQYsKdv.exe
  2⤵
  PID:6772
- C:\Windows\System\qDrElgK.exe
  C:\Windows\System\qDrElgK.exe
  2⤵
  PID:6788
- C:\Windows\System\WMuqFVg.exe
  C:\Windows\System\WMuqFVg.exe
  2⤵
  PID:6804
- C:\Windows\System\GzYtksL.exe
  C:\Windows\System\GzYtksL.exe
  2⤵
  PID:6820
- C:\Windows\System\akamoaM.exe
  C:\Windows\System\akamoaM.exe
  2⤵
  PID:6836
- C:\Windows\System\Iwszmju.exe
  C:\Windows\System\Iwszmju.exe
  2⤵
  PID:6856
- C:\Windows\System\sQgSuTB.exe
  C:\Windows\System\sQgSuTB.exe
  2⤵
  PID:6872
- C:\Windows\System\iYXkFgN.exe
  C:\Windows\System\iYXkFgN.exe
  2⤵
  PID:6888
- C:\Windows\System\DCjpZkP.exe
  C:\Windows\System\DCjpZkP.exe
  2⤵
  PID:6904
- C:\Windows\System\TsKuLAr.exe
  C:\Windows\System\TsKuLAr.exe
  2⤵
  PID:6920
- C:\Windows\System\YBhAZeV.exe
  C:\Windows\System\YBhAZeV.exe
  2⤵
  PID:6936
- C:\Windows\System\ZWWJbNc.exe
  C:\Windows\System\ZWWJbNc.exe
  2⤵
  PID:6952
- C:\Windows\System\XQdOmAG.exe
  C:\Windows\System\XQdOmAG.exe
  2⤵
  PID:6968
- C:\Windows\System\DGplDyv.exe
  C:\Windows\System\DGplDyv.exe
  2⤵
  PID:6984
- C:\Windows\System\KNFGLen.exe
  C:\Windows\System\KNFGLen.exe
  2⤵
  PID:7000
- C:\Windows\System\Gcnfbfb.exe
  C:\Windows\System\Gcnfbfb.exe
  2⤵
  PID:7016
- C:\Windows\System\fQiJYVL.exe
  C:\Windows\System\fQiJYVL.exe
  2⤵
  PID:7032
- C:\Windows\System\EAmZEVM.exe
  C:\Windows\System\EAmZEVM.exe
  2⤵
  PID:7048
- C:\Windows\System\OduQFgy.exe
  C:\Windows\System\OduQFgy.exe
  2⤵
  PID:7064
- C:\Windows\System\CGqbRie.exe
  C:\Windows\System\CGqbRie.exe
  2⤵
  PID:7080
- C:\Windows\System\hbArGrl.exe
  C:\Windows\System\hbArGrl.exe
  2⤵
  PID:7096
- C:\Windows\System\sXLOdAn.exe
  C:\Windows\System\sXLOdAn.exe
  2⤵
  PID:7112
- C:\Windows\System\XJkTgNC.exe
  C:\Windows\System\XJkTgNC.exe
  2⤵
  PID:7132
- C:\Windows\System\nSNsAxK.exe
  C:\Windows\System\nSNsAxK.exe
  2⤵
  PID:7148
- C:\Windows\System\MVrnSgY.exe
  C:\Windows\System\MVrnSgY.exe
  2⤵
  PID:7164
- C:\Windows\System\mzdaLgx.exe
  C:\Windows\System\mzdaLgx.exe
  2⤵
  PID:5692
- C:\Windows\System\cTxIAPC.exe
  C:\Windows\System\cTxIAPC.exe
  2⤵
  PID:5992
- C:\Windows\System\ZeyBDge.exe
  C:\Windows\System\ZeyBDge.exe
  2⤵
  PID:5860
- C:\Windows\System\YPKxGaB.exe
  C:\Windows\System\YPKxGaB.exe
  2⤵
  PID:4248
- C:\Windows\System\KJJDmJl.exe
  C:\Windows\System\KJJDmJl.exe
  2⤵
  PID:6240
- C:\Windows\System\STwKDMm.exe
  C:\Windows\System\STwKDMm.exe
  2⤵
  PID:6308
- C:\Windows\System\CAOgnpt.exe
  C:\Windows\System\CAOgnpt.exe
  2⤵
  PID:6372
- C:\Windows\System\ANGccDe.exe
  C:\Windows\System\ANGccDe.exe
  2⤵
  PID:6436
- C:\Windows\System\HqRxHcX.exe
  C:\Windows\System\HqRxHcX.exe
  2⤵
  PID:6504
- C:\Windows\System\JXFwImG.exe
  C:\Windows\System\JXFwImG.exe
  2⤵
  PID:6568
- C:\Windows\System\cponDtB.exe
  C:\Windows\System\cponDtB.exe
  2⤵
  PID:6636
- C:\Windows\System\uxSZGvw.exe
  C:\Windows\System\uxSZGvw.exe
  2⤵
  PID:6668
- C:\Windows\System\mrRnXmd.exe
  C:\Windows\System\mrRnXmd.exe
  2⤵
  PID:6732
- C:\Windows\System\CGQQIJT.exe
  C:\Windows\System\CGQQIJT.exe
  2⤵
  PID:6096
- C:\Windows\System\asxkzCH.exe
  C:\Windows\System\asxkzCH.exe
  2⤵
  PID:6832
- C:\Windows\System\EdzlyfL.exe
  C:\Windows\System\EdzlyfL.exe
  2⤵
  PID:6896
- C:\Windows\System\xjClcCF.exe
  C:\Windows\System\xjClcCF.exe
  2⤵
  PID:7056
- C:\Windows\System\ijzmrcy.exe
  C:\Windows\System\ijzmrcy.exe
  2⤵
  PID:7180
- C:\Windows\System\UONFRvs.exe
  C:\Windows\System\UONFRvs.exe
  2⤵
  PID:7196
- C:\Windows\System\gymnmPR.exe
  C:\Windows\System\gymnmPR.exe
  2⤵
  PID:7212
- C:\Windows\System\heHQzLH.exe
  C:\Windows\System\heHQzLH.exe
  2⤵
  PID:7272
- C:\Windows\System\fAYckqK.exe
  C:\Windows\System\fAYckqK.exe
  2⤵
  PID:7288
- C:\Windows\System\SajbFVk.exe
  C:\Windows\System\SajbFVk.exe
  2⤵
  PID:7304
- C:\Windows\System\wcQbuEk.exe
  C:\Windows\System\wcQbuEk.exe
  2⤵
  PID:7324
- C:\Windows\System\NEjNlIq.exe
  C:\Windows\System\NEjNlIq.exe
  2⤵
  PID:7340
- C:\Windows\System\QZAiFIZ.exe
  C:\Windows\System\QZAiFIZ.exe
  2⤵
  PID:7356
- C:\Windows\System\shVbXDA.exe
  C:\Windows\System\shVbXDA.exe
  2⤵
  PID:7372
- C:\Windows\System\onEhOVa.exe
  C:\Windows\System\onEhOVa.exe
  2⤵
  PID:7388
- C:\Windows\System\cKdKSOp.exe
  C:\Windows\System\cKdKSOp.exe
  2⤵
  PID:7404
- C:\Windows\System\PlyeMcK.exe
  C:\Windows\System\PlyeMcK.exe
  2⤵
  PID:7420
- C:\Windows\System\XUFPKUr.exe
  C:\Windows\System\XUFPKUr.exe
  2⤵
  PID:7436
- C:\Windows\System\bCoYZHj.exe
  C:\Windows\System\bCoYZHj.exe
  2⤵
  PID:7452
- C:\Windows\System\zXoFHuP.exe
  C:\Windows\System\zXoFHuP.exe
  2⤵
  PID:7472
- C:\Windows\System\wwmJuII.exe
  C:\Windows\System\wwmJuII.exe
  2⤵
  PID:7488
- C:\Windows\System\WjrIqph.exe
  C:\Windows\System\WjrIqph.exe
  2⤵
  PID:7504
- C:\Windows\System\nAaRrKH.exe
  C:\Windows\System\nAaRrKH.exe
  2⤵
  PID:7520
- C:\Windows\System\uUeUwJe.exe
  C:\Windows\System\uUeUwJe.exe
  2⤵
  PID:7536
- C:\Windows\System\ldxwfoV.exe
  C:\Windows\System\ldxwfoV.exe
  2⤵
  PID:7552
- C:\Windows\System\wTZqtqi.exe
  C:\Windows\System\wTZqtqi.exe
  2⤵
  PID:7568
- C:\Windows\System\EaRyMKi.exe
  C:\Windows\System\EaRyMKi.exe
  2⤵
  PID:7588
- C:\Windows\System\iJYkacH.exe
  C:\Windows\System\iJYkacH.exe
  2⤵
  PID:7604
- C:\Windows\System\IeGKNzZ.exe
  C:\Windows\System\IeGKNzZ.exe
  2⤵
  PID:7620
- C:\Windows\System\TlvzqBQ.exe
  C:\Windows\System\TlvzqBQ.exe
  2⤵
  PID:7636
- C:\Windows\System\gNnXyLQ.exe
  C:\Windows\System\gNnXyLQ.exe
  2⤵
  PID:7652
- C:\Windows\System\BqojXuq.exe
  C:\Windows\System\BqojXuq.exe
  2⤵
  PID:7668
- C:\Windows\System\sAxnjkE.exe
  C:\Windows\System\sAxnjkE.exe
  2⤵
  PID:7684
- C:\Windows\System\kVwOlvU.exe
  C:\Windows\System\kVwOlvU.exe
  2⤵
  PID:7700
- C:\Windows\System\rtHgfPZ.exe
  C:\Windows\System\rtHgfPZ.exe
  2⤵
  PID:7716
- C:\Windows\System\FgGEhDx.exe
  C:\Windows\System\FgGEhDx.exe
  2⤵
  PID:7732
- C:\Windows\System\TEakxQr.exe
  C:\Windows\System\TEakxQr.exe
  2⤵
  PID:7748
- C:\Windows\System\oEMQbVa.exe
  C:\Windows\System\oEMQbVa.exe
  2⤵
  PID:7764
- C:\Windows\System\mTCMxCQ.exe
  C:\Windows\System\mTCMxCQ.exe
  2⤵
  PID:7780
- C:\Windows\System\rpOkSMt.exe
  C:\Windows\System\rpOkSMt.exe
  2⤵
  PID:7796
- C:\Windows\System\RTTqmwI.exe
  C:\Windows\System\RTTqmwI.exe
  2⤵
  PID:7812
- C:\Windows\System\ueVscFJ.exe
  C:\Windows\System\ueVscFJ.exe
  2⤵
  PID:7832
- C:\Windows\System\iveCVzT.exe
  C:\Windows\System\iveCVzT.exe
  2⤵
  PID:7848
- C:\Windows\System\GVDsJQc.exe
  C:\Windows\System\GVDsJQc.exe
  2⤵
  PID:7864
- C:\Windows\System\sigfyhX.exe
  C:\Windows\System\sigfyhX.exe
  2⤵
  PID:7880
- C:\Windows\System\ArdZfnl.exe
  C:\Windows\System\ArdZfnl.exe
  2⤵
  PID:7900
- C:\Windows\System\vjvwqsi.exe
  C:\Windows\System\vjvwqsi.exe
  2⤵
  PID:7916
- C:\Windows\System\uYFiNLr.exe
  C:\Windows\System\uYFiNLr.exe
  2⤵
  PID:7932
- C:\Windows\System\oDuUOaw.exe
  C:\Windows\System\oDuUOaw.exe
  2⤵
  PID:7948
- C:\Windows\System\EVHRaPR.exe
  C:\Windows\System\EVHRaPR.exe
  2⤵
  PID:7964
- C:\Windows\System\ZmuKAjx.exe
  C:\Windows\System\ZmuKAjx.exe
  2⤵
  PID:7980
- C:\Windows\System\BpNPNpN.exe
  C:\Windows\System\BpNPNpN.exe
  2⤵
  PID:7996
- C:\Windows\System\REWTNWL.exe
  C:\Windows\System\REWTNWL.exe
  2⤵
  PID:8012
- C:\Windows\System\aIOdAUv.exe
  C:\Windows\System\aIOdAUv.exe
  2⤵
  PID:8028
- C:\Windows\System\ZePkoEd.exe
  C:\Windows\System\ZePkoEd.exe
  2⤵
  PID:8048
- C:\Windows\System\pxoaSGz.exe
  C:\Windows\System\pxoaSGz.exe
  2⤵
  PID:8064
- C:\Windows\System\VvZYips.exe
  C:\Windows\System\VvZYips.exe
  2⤵
  PID:8080
- C:\Windows\System\HWfZvrR.exe
  C:\Windows\System\HWfZvrR.exe
  2⤵
  PID:8096
- C:\Windows\System\CQXCGdK.exe
  C:\Windows\System\CQXCGdK.exe
  2⤵
  PID:8112
- C:\Windows\System\MoIHygn.exe
  C:\Windows\System\MoIHygn.exe
  2⤵
  PID:8128
- C:\Windows\System\Iomhpgp.exe
  C:\Windows\System\Iomhpgp.exe
  2⤵
  PID:8144
- C:\Windows\System\uuVzLnQ.exe
  C:\Windows\System\uuVzLnQ.exe
  2⤵
  PID:8160
- C:\Windows\System\iLhwzSM.exe
  C:\Windows\System\iLhwzSM.exe
  2⤵
  PID:8176
- C:\Windows\System\ilXtkGV.exe
  C:\Windows\System\ilXtkGV.exe
  2⤵
  PID:6932
- C:\Windows\System\LhEGgjp.exe
  C:\Windows\System\LhEGgjp.exe
  2⤵
  PID:4144
- C:\Windows\System\QELKMNw.exe
  C:\Windows\System\QELKMNw.exe
  2⤵
  PID:5576
- C:\Windows\System\KzliTWh.exe
  C:\Windows\System\KzliTWh.exe
  2⤵
  PID:4940
- C:\Windows\System\XMGiTMc.exe
  C:\Windows\System\XMGiTMc.exe
  2⤵
  PID:5796
- C:\Windows\System\cXSdWTF.exe
  C:\Windows\System\cXSdWTF.exe
  2⤵
  PID:6048
- C:\Windows\System\OlMrhRi.exe
  C:\Windows\System\OlMrhRi.exe
  2⤵
  PID:7088
- C:\Windows\System\gAgdmgt.exe
  C:\Windows\System\gAgdmgt.exe
  2⤵
  PID:7120
- C:\Windows\System\SDFIgMc.exe
  C:\Windows\System\SDFIgMc.exe
  2⤵
  PID:7160
- C:\Windows\System\lXikxKt.exe
  C:\Windows\System\lXikxKt.exe
  2⤵
  PID:6156
- C:\Windows\System\RdUXqkv.exe
  C:\Windows\System\RdUXqkv.exe
  2⤵
  PID:6192
- C:\Windows\System\TxcIkZd.exe
  C:\Windows\System\TxcIkZd.exe
  2⤵
  PID:6404
- C:\Windows\System\EsaPkTx.exe
  C:\Windows\System\EsaPkTx.exe
  2⤵
  PID:5396
- C:\Windows\System\mswnQkw.exe
  C:\Windows\System\mswnQkw.exe
  2⤵
  PID:6288
- C:\Windows\System\wpaXEja.exe
  C:\Windows\System\wpaXEja.exe
  2⤵
  PID:6352
- C:\Windows\System\QjilyzH.exe
  C:\Windows\System\QjilyzH.exe
  2⤵
  PID:6764
- C:\Windows\System\kbilGuK.exe
  C:\Windows\System\kbilGuK.exe
  2⤵
  PID:7176
- C:\Windows\System\miRocZH.exe
  C:\Windows\System\miRocZH.exe
  2⤵
  PID:6420
- C:\Windows\System\JGgARlQ.exe
  C:\Windows\System\JGgARlQ.exe
  2⤵
  PID:7104
- C:\Windows\System\uaVFiyj.exe
  C:\Windows\System\uaVFiyj.exe
  2⤵
  PID:3936
- C:\Windows\System\WOrWZCn.exe
  C:\Windows\System\WOrWZCn.exe
  2⤵
  PID:6472
- C:\Windows\System\Ytqefht.exe
  C:\Windows\System\Ytqefht.exe
  2⤵
  PID:6976
- C:\Windows\System\bWzXsrH.exe
  C:\Windows\System\bWzXsrH.exe
  2⤵
  PID:6068
- C:\Windows\System\NGIxzwh.exe
  C:\Windows\System\NGIxzwh.exe
  2⤵
  PID:2140
- C:\Windows\System\iLCvKhL.exe
  C:\Windows\System\iLCvKhL.exe
  2⤵
  PID:7284
- C:\Windows\System\QCuTPWc.exe
  C:\Windows\System\QCuTPWc.exe
  2⤵
  PID:7320
- C:\Windows\System\fwIORZN.exe
  C:\Windows\System\fwIORZN.exe
  2⤵
  PID:7416
- C:\Windows\System\tDjknav.exe
  C:\Windows\System\tDjknav.exe
  2⤵
  PID:7484
- C:\Windows\System\BGJLUMH.exe
  C:\Windows\System\BGJLUMH.exe
  2⤵
  PID:7740
- C:\Windows\System\ghFEIom.exe
  C:\Windows\System\ghFEIom.exe
  2⤵
  PID:7944
- C:\Windows\System\upeJcje.exe
  C:\Windows\System\upeJcje.exe
  2⤵
  PID:8072
- C:\Windows\System\jDdxGLk.exe
  C:\Windows\System\jDdxGLk.exe
  2⤵
  PID:8136
- C:\Windows\System\IkulovG.exe
  C:\Windows\System\IkulovG.exe
  2⤵
  PID:7428
- C:\Windows\System\eCXbuWi.exe
  C:\Windows\System\eCXbuWi.exe
  2⤵
  PID:7464
- C:\Windows\System\KLGxksA.exe
  C:\Windows\System\KLGxksA.exe
  2⤵
  PID:7532
- C:\Windows\System\NuyTOXe.exe
  C:\Windows\System\NuyTOXe.exe
  2⤵
  PID:6132
- C:\Windows\System\HbCZNzt.exe
  C:\Windows\System\HbCZNzt.exe
  2⤵
  PID:7600
- C:\Windows\System\oMchQkK.exe
  C:\Windows\System\oMchQkK.exe
  2⤵
  PID:5232
- C:\Windows\System\qlXPEVx.exe
  C:\Windows\System\qlXPEVx.exe
  2⤵
  PID:6260
- C:\Windows\System\HTpXaSa.exe
  C:\Windows\System\HTpXaSa.exe
  2⤵
  PID:7792
- C:\Windows\System\xkadIcg.exe
  C:\Windows\System\xkadIcg.exe
  2⤵
  PID:8056
- C:\Windows\System\zzVGbXP.exe
  C:\Windows\System\zzVGbXP.exe
  2⤵
  PID:7988
- C:\Windows\System\TlxGJKI.exe
  C:\Windows\System\TlxGJKI.exe
  2⤵
  PID:8088
- C:\Windows\System\FeuiLWO.exe
  C:\Windows\System\FeuiLWO.exe
  2⤵
  PID:7364
- C:\Windows\System\zdsgXna.exe
  C:\Windows\System\zdsgXna.exe
  2⤵
  PID:5188
- C:\Windows\System\DPgQzQI.exe
  C:\Windows\System\DPgQzQI.exe
  2⤵
  PID:7632
- C:\Windows\System\CekzOwi.exe
  C:\Windows\System\CekzOwi.exe
  2⤵
  PID:7760
- C:\Windows\System\CQgbVXi.exe
  C:\Windows\System\CQgbVXi.exe
  2⤵
  PID:7332
- C:\Windows\System\tJJAwsE.exe
  C:\Windows\System\tJJAwsE.exe
  2⤵
  PID:7060
- C:\Windows\System\QAgEhnk.exe
  C:\Windows\System\QAgEhnk.exe
  2⤵
  PID:7696
- C:\Windows\System\ypXcbXt.exe
  C:\Windows\System\ypXcbXt.exe
  2⤵
  PID:7860
- C:\Windows\System\SCWtMhI.exe
  C:\Windows\System\SCWtMhI.exe
  2⤵
  PID:7924
- C:\Windows\System\XRQvosm.exe
  C:\Windows\System\XRQvosm.exe
  2⤵
  PID:8184
- C:\Windows\System\cGmzdoR.exe
  C:\Windows\System\cGmzdoR.exe
  2⤵
  PID:6540
- C:\Windows\System\XoNsysm.exe
  C:\Windows\System\XoNsysm.exe
  2⤵
  PID:6456
- C:\Windows\System\fuFJOGR.exe
  C:\Windows\System\fuFJOGR.exe
  2⤵
  PID:6552
- C:\Windows\System\VTYWqhS.exe
  C:\Windows\System\VTYWqhS.exe
  2⤵
  PID:6588
- C:\Windows\System\bpKLGOB.exe
  C:\Windows\System\bpKLGOB.exe
  2⤵
  PID:6656
- C:\Windows\System\UUpoLMU.exe
  C:\Windows\System\UUpoLMU.exe
  2⤵
  PID:6812
- C:\Windows\System\MqsgmwQ.exe
  C:\Windows\System\MqsgmwQ.exe
  2⤵
  PID:6816
- C:\Windows\System\dMfEHsu.exe
  C:\Windows\System\dMfEHsu.exe
  2⤵
  PID:7072
- C:\Windows\System\wxKzack.exe
  C:\Windows\System\wxKzack.exe
  2⤵
  PID:6208
- C:\Windows\System\HuOCZFe.exe
  C:\Windows\System\HuOCZFe.exe
  2⤵
  PID:6800
- C:\Windows\System\DtHVDXE.exe
  C:\Windows\System\DtHVDXE.exe
  2⤵
  PID:6272
- C:\Windows\System\HvcVIJp.exe
  C:\Windows\System\HvcVIJp.exe
  2⤵
  PID:7220
- C:\Windows\System\caTNZhG.exe
  C:\Windows\System\caTNZhG.exe
  2⤵
  PID:6220
- C:\Windows\System\XUGWppa.exe
  C:\Windows\System\XUGWppa.exe
  2⤵
  PID:7240
- C:\Windows\System\qPqrJmk.exe
  C:\Windows\System\qPqrJmk.exe
  2⤵
  PID:6720
- C:\Windows\System\UUCMHid.exe
  C:\Windows\System\UUCMHid.exe
  2⤵
  PID:6852
- C:\Windows\System\jYkFhNX.exe
  C:\Windows\System\jYkFhNX.exe
  2⤵
  PID:6916
- C:\Windows\System\vTieSEL.exe
  C:\Windows\System\vTieSEL.exe
  2⤵
  PID:7256
- C:\Windows\System\pSxxtIN.exe
  C:\Windows\System\pSxxtIN.exe
  2⤵
  PID:7144
- C:\Windows\System\EIZSnsV.exe
  C:\Windows\System\EIZSnsV.exe
  2⤵
  PID:7384
- C:\Windows\System\eZYTKrp.exe
  C:\Windows\System\eZYTKrp.exe
  2⤵
  PID:7480
- C:\Windows\System\xsntiWB.exe
  C:\Windows\System\xsntiWB.exe
  2⤵
  PID:7644
- C:\Windows\System\ZBcoWqB.exe
  C:\Windows\System\ZBcoWqB.exe
  2⤵
  PID:7516
- C:\Windows\System\eQFcVay.exe
  C:\Windows\System\eQFcVay.exe
  2⤵
  PID:7776
- C:\Windows\System\ezRIGTz.exe
  C:\Windows\System\ezRIGTz.exe
  2⤵
  PID:7808
- C:\Windows\System\ezTXddW.exe
  C:\Windows\System\ezTXddW.exe
  2⤵
  PID:7840
- C:\Windows\System\xQePJMc.exe
  C:\Windows\System\xQePJMc.exe
  2⤵
  PID:7872
- C:\Windows\System\eVeypMX.exe
  C:\Windows\System\eVeypMX.exe
  2⤵
  PID:7912
- C:\Windows\System\guxGRWy.exe
  C:\Windows\System\guxGRWy.exe
  2⤵
  PID:8008
- C:\Windows\System\wABQnUq.exe
  C:\Windows\System\wABQnUq.exe
  2⤵
  PID:6992
- C:\Windows\System\wiDJgVd.exe
  C:\Windows\System\wiDJgVd.exe
  2⤵
  PID:6116
- C:\Windows\System\cEbzkyO.exe
  C:\Windows\System\cEbzkyO.exe
  2⤵
  PID:5184
- C:\Windows\System\VbJZmwW.exe
  C:\Windows\System\VbJZmwW.exe
  2⤵
  PID:7756
- C:\Windows\System\bfePqmr.exe
  C:\Windows\System\bfePqmr.exe
  2⤵
  PID:6388
- C:\Windows\System\HsIbKlD.exe
  C:\Windows\System\HsIbKlD.exe
  2⤵
  PID:8152
- C:\Windows\System\rPnEbDE.exe
  C:\Windows\System\rPnEbDE.exe
  2⤵
  PID:7128
- C:\Windows\System\mZTtfay.exe
  C:\Windows\System\mZTtfay.exe
  2⤵
  PID:7156
- C:\Windows\System\fDqsgTR.exe
  C:\Windows\System\fDqsgTR.exe
  2⤵
  PID:7664
- C:\Windows\System\myUFPsq.exe
  C:\Windows\System\myUFPsq.exe
  2⤵
  PID:7888
- C:\Windows\System\QGOCTBQ.exe
  C:\Windows\System\QGOCTBQ.exe
  2⤵
  PID:6536
- C:\Windows\System\hJafaYX.exe
  C:\Windows\System\hJafaYX.exe
  2⤵
  PID:6452
- C:\Windows\System\oQJLwKz.exe
  C:\Windows\System\oQJLwKz.exe
  2⤵
  PID:6652
- C:\Windows\System\uliByOr.exe
  C:\Windows\System\uliByOr.exe
  2⤵
  PID:7008
- C:\Windows\System\wXGQnLK.exe
  C:\Windows\System\wXGQnLK.exe
  2⤵
  PID:5780
- C:\Windows\System\IKhrxgy.exe
  C:\Windows\System\IKhrxgy.exe
  2⤵
  PID:6368
- C:\Windows\System\qiLmawI.exe
  C:\Windows\System\qiLmawI.exe
  2⤵
  PID:7192
- C:\Windows\System\HyKFPHY.exe
  C:\Windows\System\HyKFPHY.exe
  2⤵
  PID:7236
- C:\Windows\System\XkyzRgz.exe
  C:\Windows\System\XkyzRgz.exe
  2⤵
  PID:6880
- C:\Windows\System\hlRhrPo.exe
  C:\Windows\System\hlRhrPo.exe
  2⤵
  PID:6704
- C:\Windows\System\rgOBOWr.exe
  C:\Windows\System\rgOBOWr.exe
  2⤵
  PID:7744
- C:\Windows\System\EYbIbOt.exe
  C:\Windows\System\EYbIbOt.exe
  2⤵
  PID:7708
- C:\Windows\System\bMfrRkH.exe
  C:\Windows\System\bMfrRkH.exe
  2⤵
  PID:7876
- C:\Windows\System\HqPBtTB.exe
  C:\Windows\System\HqPBtTB.exe
  2⤵
  PID:7396
- C:\Windows\System\lZvTRZS.exe
  C:\Windows\System\lZvTRZS.exe
  2⤵
  PID:5876
- C:\Windows\System\mfrWOSP.exe
  C:\Windows\System\mfrWOSP.exe
  2⤵
  PID:5364
- C:\Windows\System\DEdDHcz.exe
  C:\Windows\System\DEdDHcz.exe
  2⤵
  PID:1004
- C:\Windows\System\vZqvjzl.exe
  C:\Windows\System\vZqvjzl.exe
  2⤵
  PID:6624
- C:\Windows\System\OIfoeWp.exe
  C:\Windows\System\OIfoeWp.exe
  2⤵
  PID:7188
- C:\Windows\System\ONDroub.exe
  C:\Windows\System\ONDroub.exe
  2⤵
  PID:7012
- C:\Windows\System\aDgAbsJ.exe
  C:\Windows\System\aDgAbsJ.exe
  2⤵
  PID:1532
- C:\Windows\System\UXqYhkC.exe
  C:\Windows\System\UXqYhkC.exe
  2⤵
  PID:7228
- C:\Windows\System\tqRIjqF.exe
  C:\Windows\System\tqRIjqF.exe
  2⤵
  PID:7380
- C:\Windows\System\FVdDBBJ.exe
  C:\Windows\System\FVdDBBJ.exe
  2⤵
  PID:7580
- C:\Windows\System\cwXIjOK.exe
  C:\Windows\System\cwXIjOK.exe
  2⤵
  PID:8108
- C:\Windows\System\MkHUnVS.exe
  C:\Windows\System\MkHUnVS.exe
  2⤵
  PID:7044
- C:\Windows\System\XzhrZpP.exe
  C:\Windows\System\XzhrZpP.exe
  2⤵
  PID:7564
- C:\Windows\System\ZnvbqpN.exe
  C:\Windows\System\ZnvbqpN.exe
  2⤵
  PID:6592
- C:\Windows\System\DovkRTx.exe
  C:\Windows\System\DovkRTx.exe
  2⤵
  PID:7172
- C:\Windows\System\tmHRHXs.exe
  C:\Windows\System\tmHRHXs.exe
  2⤵
  PID:5488
- C:\Windows\System\bKqxhbE.exe
  C:\Windows\System\bKqxhbE.exe
  2⤵
  PID:6768
- C:\Windows\System\cfKJuYR.exe
  C:\Windows\System\cfKJuYR.exe
  2⤵
  PID:6556
- C:\Windows\System\hrqNduW.exe
  C:\Windows\System\hrqNduW.exe
  2⤵
  PID:7232
- C:\Windows\System\VPwTljv.exe
  C:\Windows\System\VPwTljv.exe
  2⤵
  PID:6384
- C:\Windows\System\DRXmXsB.exe
  C:\Windows\System\DRXmXsB.exe
  2⤵
  PID:8060
- C:\Windows\System\tXeQjjn.exe
  C:\Windows\System\tXeQjjn.exe
  2⤵
  PID:7856
- C:\Windows\System\OvffTvx.exe
  C:\Windows\System\OvffTvx.exe
  2⤵
  PID:8120
- C:\Windows\System\XiHazct.exe
  C:\Windows\System\XiHazct.exe
  2⤵
  PID:1476
- C:\Windows\System\wdgYkhE.exe
  C:\Windows\System\wdgYkhE.exe
  2⤵
  PID:8036
- C:\Windows\System\tnYLkaW.exe
  C:\Windows\System\tnYLkaW.exe
  2⤵
  PID:7844
- C:\Windows\System\AXfVAlU.exe
  C:\Windows\System\AXfVAlU.exe
  2⤵
  PID:8208
- C:\Windows\System\zdcPStV.exe
  C:\Windows\System\zdcPStV.exe
  2⤵
  PID:8228
- C:\Windows\System\IExItDZ.exe
  C:\Windows\System\IExItDZ.exe
  2⤵
  PID:8264
- C:\Windows\System\bJrDgfV.exe
  C:\Windows\System\bJrDgfV.exe
  2⤵
  PID:8280
- C:\Windows\System\CqXZyHp.exe
  C:\Windows\System\CqXZyHp.exe
  2⤵
  PID:8300
- C:\Windows\System\XumuZNL.exe
  C:\Windows\System\XumuZNL.exe
  2⤵
  PID:8316
- C:\Windows\System\xcYANLc.exe
  C:\Windows\System\xcYANLc.exe
  2⤵
  PID:8332
- C:\Windows\System\CbBoOEH.exe
  C:\Windows\System\CbBoOEH.exe
  2⤵
  PID:8348
- C:\Windows\System\gVpVjbB.exe
  C:\Windows\System\gVpVjbB.exe
  2⤵
  PID:8364
- C:\Windows\System\ufUIIMy.exe
  C:\Windows\System\ufUIIMy.exe
  2⤵
  PID:8380
- C:\Windows\System\QIQyozo.exe
  C:\Windows\System\QIQyozo.exe
  2⤵
  PID:8396
- C:\Windows\System\gWAKbMx.exe
  C:\Windows\System\gWAKbMx.exe
  2⤵
  PID:8412
- C:\Windows\System\tjrwmGk.exe
  C:\Windows\System\tjrwmGk.exe
  2⤵
  PID:8428
- C:\Windows\System\VBhogxI.exe
  C:\Windows\System\VBhogxI.exe
  2⤵
  PID:8448
- C:\Windows\System\rfMdxXg.exe
  C:\Windows\System\rfMdxXg.exe
  2⤵
  PID:8464
- C:\Windows\System\NEJFXNR.exe
  C:\Windows\System\NEJFXNR.exe
  2⤵
  PID:8480
- C:\Windows\System\gwOvtwP.exe
  C:\Windows\System\gwOvtwP.exe
  2⤵
  PID:8500
- C:\Windows\System\AtNdlqo.exe
  C:\Windows\System\AtNdlqo.exe
  2⤵
  PID:8520
- C:\Windows\System\LAiKGuR.exe
  C:\Windows\System\LAiKGuR.exe
  2⤵
  PID:8536
- C:\Windows\System\Wnumkge.exe
  C:\Windows\System\Wnumkge.exe
  2⤵
  PID:8552
- C:\Windows\System\JXzrkYd.exe
  C:\Windows\System\JXzrkYd.exe
  2⤵
  PID:8568
- C:\Windows\System\LbpPVKO.exe
  C:\Windows\System\LbpPVKO.exe
  2⤵
  PID:8584
- C:\Windows\System\MqZHWTF.exe
  C:\Windows\System\MqZHWTF.exe
  2⤵
  PID:8604
- C:\Windows\System\WcyqwCE.exe
  C:\Windows\System\WcyqwCE.exe
  2⤵
  PID:8620
- C:\Windows\System\ZJHNYTg.exe
  C:\Windows\System\ZJHNYTg.exe
  2⤵
  PID:8636
- C:\Windows\System\ihFwbOM.exe
  C:\Windows\System\ihFwbOM.exe
  2⤵
  PID:8652
- C:\Windows\System\iWQEFBt.exe
  C:\Windows\System\iWQEFBt.exe
  2⤵
  PID:8668
- C:\Windows\System\nAIblrL.exe
  C:\Windows\System\nAIblrL.exe
  2⤵
  PID:8684
- C:\Windows\System\FeAASqy.exe
  C:\Windows\System\FeAASqy.exe
  2⤵
  PID:8700
- C:\Windows\System\htbfCcT.exe
  C:\Windows\System\htbfCcT.exe
  2⤵
  PID:8720
- C:\Windows\System\nVBoTrX.exe
  C:\Windows\System\nVBoTrX.exe
  2⤵
  PID:8740
- C:\Windows\System\cBqnckx.exe
  C:\Windows\System\cBqnckx.exe
  2⤵
  PID:8756
- C:\Windows\System\joXcbFM.exe
  C:\Windows\System\joXcbFM.exe
  2⤵
  PID:8772
- C:\Windows\System\UXUBwxX.exe
  C:\Windows\System\UXUBwxX.exe
  2⤵
  PID:8788
- C:\Windows\System\nmVzAbi.exe
  C:\Windows\System\nmVzAbi.exe
  2⤵
  PID:8804
- C:\Windows\System\vRSuPbb.exe
  C:\Windows\System\vRSuPbb.exe
  2⤵
  PID:8820
- C:\Windows\System\GgSjxVd.exe
  C:\Windows\System\GgSjxVd.exe
  2⤵
  PID:8836
- C:\Windows\System\zkRgojo.exe
  C:\Windows\System\zkRgojo.exe
  2⤵
  PID:8852
- C:\Windows\System\BZrwzfJ.exe
  C:\Windows\System\BZrwzfJ.exe
  2⤵
  PID:8868
- C:\Windows\System\vKLeDeR.exe
  C:\Windows\System\vKLeDeR.exe
  2⤵
  PID:8888
- C:\Windows\System\eJTJfIl.exe
  C:\Windows\System\eJTJfIl.exe
  2⤵
  PID:8908
- C:\Windows\System\IDXbxfe.exe
  C:\Windows\System\IDXbxfe.exe
  2⤵
  PID:8924
- C:\Windows\System\BEqRXIm.exe
  C:\Windows\System\BEqRXIm.exe
  2⤵
  PID:8944
- C:\Windows\System\TLYZpug.exe
  C:\Windows\System\TLYZpug.exe
  2⤵
  PID:8960
- C:\Windows\System\zukxgiO.exe
  C:\Windows\System\zukxgiO.exe
  2⤵
  PID:8980
- C:\Windows\System\eRcTaHP.exe
  C:\Windows\System\eRcTaHP.exe
  2⤵
  PID:9008
- C:\Windows\System\icqimzZ.exe
  C:\Windows\System\icqimzZ.exe
  2⤵
  PID:9164
- C:\Windows\System\UypZStJ.exe
  C:\Windows\System\UypZStJ.exe
  2⤵
  PID:8204
- C:\Windows\System\UeDrECg.exe
  C:\Windows\System\UeDrECg.exe
  2⤵
  PID:8252
- C:\Windows\System\FOiPBEP.exe
  C:\Windows\System\FOiPBEP.exe
  2⤵
  PID:8296
- C:\Windows\System\ahBaFvP.exe
  C:\Windows\System\ahBaFvP.exe
  2⤵
  PID:8392
- C:\Windows\System\qdKrSAl.exe
  C:\Windows\System\qdKrSAl.exe
  2⤵
  PID:8488
- C:\Windows\System\OLQobvD.exe
  C:\Windows\System\OLQobvD.exe
  2⤵
  PID:8532
- C:\Windows\System\WdArGBB.exe
  C:\Windows\System\WdArGBB.exe
  2⤵
  PID:8628
- C:\Windows\System\WdBDfIr.exe
  C:\Windows\System\WdBDfIr.exe
  2⤵
  PID:8696
- C:\Windows\System\PecZQNf.exe
  C:\Windows\System\PecZQNf.exe
  2⤵
  PID:8328
- C:\Windows\System\oNtiwwd.exe
  C:\Windows\System\oNtiwwd.exe
  2⤵
  PID:8732
- C:\Windows\System\EyoJsAK.exe
  C:\Windows\System\EyoJsAK.exe
  2⤵
  PID:8796
- C:\Windows\System\OKMVbEj.exe
  C:\Windows\System\OKMVbEj.exe
  2⤵
  PID:8340
- C:\Windows\System\MrchxhM.exe
  C:\Windows\System\MrchxhM.exe
  2⤵
  PID:8896
- C:\Windows\System\ROUntfV.exe
  C:\Windows\System\ROUntfV.exe
  2⤵
  PID:8580
- C:\Windows\System\RgvkSjC.exe
  C:\Windows\System\RgvkSjC.exe
  2⤵
  PID:8972
- C:\Windows\System\hrfrrLG.exe
  C:\Windows\System\hrfrrLG.exe
  2⤵
  PID:6964
- C:\Windows\System\gYujEsu.exe
  C:\Windows\System\gYujEsu.exe
  2⤵
  PID:8544
- C:\Windows\System\zwvuupS.exe
  C:\Windows\System\zwvuupS.exe
  2⤵
  PID:8812
- C:\Windows\System\kPWjHQg.exe
  C:\Windows\System\kPWjHQg.exe
  2⤵
  PID:8272
- C:\Windows\System\Qbcawvm.exe
  C:\Windows\System\Qbcawvm.exe
  2⤵
  PID:8344
- C:\Windows\System\XZYWFIl.exe
  C:\Windows\System\XZYWFIl.exe
  2⤵
  PID:8408
- C:\Windows\System\WVoeAwO.exe
  C:\Windows\System\WVoeAwO.exe
  2⤵
  PID:8508
- C:\Windows\System\ClFVofs.exe
  C:\Windows\System\ClFVofs.exe
  2⤵
  PID:8576
- C:\Windows\System\nswMAKO.exe
  C:\Windows\System\nswMAKO.exe
  2⤵
  PID:8680
- C:\Windows\System\mIeUTjb.exe
  C:\Windows\System\mIeUTjb.exe
  2⤵
  PID:8780
- C:\Windows\System\VyMpWkO.exe
  C:\Windows\System\VyMpWkO.exe
  2⤵
  PID:8848
- C:\Windows\System\IEWVQwJ.exe
  C:\Windows\System\IEWVQwJ.exe
  2⤵
  PID:8916
- C:\Windows\System\xstRcOQ.exe
  C:\Windows\System\xstRcOQ.exe
  2⤵
  PID:8992
- C:\Windows\System\EQcTcmm.exe
  C:\Windows\System\EQcTcmm.exe
  2⤵
  PID:9024
- C:\Windows\System\QmzcbNx.exe
  C:\Windows\System\QmzcbNx.exe
  2⤵
  PID:9036
- C:\Windows\System\NGRxrLP.exe
  C:\Windows\System\NGRxrLP.exe
  2⤵
  PID:9032
- C:\Windows\System\kzBIdEC.exe
  C:\Windows\System\kzBIdEC.exe
  2⤵
  PID:8444
- C:\Windows\System\iIXZbtw.exe
  C:\Windows\System\iIXZbtw.exe
  2⤵
  PID:9100
- C:\Windows\System\IjyqKuq.exe
  C:\Windows\System\IjyqKuq.exe
  2⤵
  PID:9088
- C:\Windows\System\bIvrCDh.exe
  C:\Windows\System\bIvrCDh.exe
  2⤵
  PID:9116
- C:\Windows\System\paWwPyl.exe
  C:\Windows\System\paWwPyl.exe
  2⤵
  PID:9156
- C:\Windows\System\jTCvhpo.exe
  C:\Windows\System\jTCvhpo.exe
  2⤵
  PID:9128
- C:\Windows\System\kEpPzwR.exe
  C:\Windows\System\kEpPzwR.exe
  2⤵
  PID:9148
- C:\Windows\System\cUmMwuU.exe
  C:\Windows\System\cUmMwuU.exe
  2⤵
  PID:9188
- C:\Windows\System\CRHcLqY.exe
  C:\Windows\System\CRHcLqY.exe
  2⤵
  PID:9204
- C:\Windows\System\hZDmiVP.exe
  C:\Windows\System\hZDmiVP.exe
  2⤵
  PID:6884
- C:\Windows\System\CSsLlVy.exe
  C:\Windows\System\CSsLlVy.exe
  2⤵
  PID:6844
- C:\Windows\System\NWWyDbt.exe
  C:\Windows\System\NWWyDbt.exe
  2⤵
  PID:8424
- C:\Windows\System\HzbJwhu.exe
  C:\Windows\System\HzbJwhu.exe
  2⤵
  PID:8600
- C:\Windows\System\pTdezDo.exe
  C:\Windows\System\pTdezDo.exe
  2⤵
  PID:8240
- C:\Windows\System\zbEnLsm.exe
  C:\Windows\System\zbEnLsm.exe
  2⤵
  PID:8528
- C:\Windows\System\gnZeIzr.exe
  C:\Windows\System\gnZeIzr.exe
  2⤵
  PID:8764
- C:\Windows\System\KRecfpj.exe
  C:\Windows\System\KRecfpj.exe
  2⤵
  PID:8940
- C:\Windows\System\sWeNDZs.exe
  C:\Windows\System\sWeNDZs.exe
  2⤵
  PID:8248
- C:\Windows\System\FnEkerm.exe
  C:\Windows\System\FnEkerm.exe
  2⤵
  PID:8376
- C:\Windows\System\clNcUxB.exe
  C:\Windows\System\clNcUxB.exe
  2⤵
  PID:8932
- C:\Windows\System\iqokVqw.exe
  C:\Windows\System\iqokVqw.exe
  2⤵
  PID:9016
- C:\Windows\System\jHgeqox.exe
  C:\Windows\System\jHgeqox.exe
  2⤵
  PID:9028
- C:\Windows\System\rxcZhus.exe
  C:\Windows\System\rxcZhus.exe
  2⤵
  PID:8456
- C:\Windows\System\aMoiNTq.exe
  C:\Windows\System\aMoiNTq.exe
  2⤵
  PID:8676
- C:\Windows\System\NKOcxwc.exe
  C:\Windows\System\NKOcxwc.exe
  2⤵
  PID:8952
- C:\Windows\System\LloZsne.exe
  C:\Windows\System\LloZsne.exe
  2⤵
  PID:9092
- C:\Windows\System\cIQQlOR.exe
  C:\Windows\System\cIQQlOR.exe
  2⤵
  PID:9140
- C:\Windows\System\aytFLHf.exe
  C:\Windows\System\aytFLHf.exe
  2⤵
  PID:9112
- C:\Windows\System\gwOaarW.exe
  C:\Windows\System\gwOaarW.exe
  2⤵
  PID:9212
- C:\Windows\System\heTNqWJ.exe
  C:\Windows\System\heTNqWJ.exe
  2⤵
  PID:8292
- C:\Windows\System\ppjTovb.exe
  C:\Windows\System\ppjTovb.exe
  2⤵
  PID:8592
- C:\Windows\System\ElWmgqx.exe
  C:\Windows\System\ElWmgqx.exe
  2⤵
  PID:9084
- C:\Windows\System\XucZszt.exe
  C:\Windows\System\XucZszt.exe
  2⤵
  PID:8596
- C:\Windows\System\WaRGJRy.exe
  C:\Windows\System\WaRGJRy.exe
  2⤵
  PID:9124
- C:\Windows\System\AWfXaKk.exe
  C:\Windows\System\AWfXaKk.exe
  2⤵
  PID:8436
- C:\Windows\System\nKIIvyB.exe
  C:\Windows\System\nKIIvyB.exe
  2⤵
  PID:7772
- C:\Windows\System\YdxcTdY.exe
  C:\Windows\System\YdxcTdY.exe
  2⤵
  PID:8648
- C:\Windows\System\zbHxJFe.exe
  C:\Windows\System\zbHxJFe.exe
  2⤵
  PID:9096
- C:\Windows\System\xuTtEXj.exe
  C:\Windows\System\xuTtEXj.exe
  2⤵
  PID:9196
- C:\Windows\System\CnCUlsQ.exe
  C:\Windows\System\CnCUlsQ.exe
  2⤵
  PID:9068
- C:\Windows\System\jVJTEIT.exe
  C:\Windows\System\jVJTEIT.exe
  2⤵
  PID:8220
- C:\Windows\System\OwZRrqf.exe
  C:\Windows\System\OwZRrqf.exe
  2⤵
  PID:8516
- C:\Windows\System\WydWEWS.exe
  C:\Windows\System\WydWEWS.exe
  2⤵
  PID:9044
- C:\Windows\System\TBuUKQR.exe
  C:\Windows\System\TBuUKQR.exe
  2⤵
  PID:8752
- C:\Windows\System\UxVXIof.exe
  C:\Windows\System\UxVXIof.exe
  2⤵
  PID:9184
- C:\Windows\System\tKUHqac.exe
  C:\Windows\System\tKUHqac.exe
  2⤵
  PID:8312
- C:\Windows\System\iTjEOFJ.exe
  C:\Windows\System\iTjEOFJ.exe
  2⤵
  PID:9228
- C:\Windows\System\bFINbQt.exe
  C:\Windows\System\bFINbQt.exe
  2⤵
  PID:9244
- C:\Windows\System\sdtExUM.exe
  C:\Windows\System\sdtExUM.exe
  2⤵
  PID:9260
- C:\Windows\System\mdsuNdk.exe
  C:\Windows\System\mdsuNdk.exe
  2⤵
  PID:9276
- C:\Windows\System\JkMamxV.exe
  C:\Windows\System\JkMamxV.exe
  2⤵
  PID:9292
- C:\Windows\System\Oluwfmq.exe
  C:\Windows\System\Oluwfmq.exe
  2⤵
  PID:9308
- C:\Windows\System\DBTDhIp.exe
  C:\Windows\System\DBTDhIp.exe
  2⤵
  PID:9324
- C:\Windows\System\bxPDKbS.exe
  C:\Windows\System\bxPDKbS.exe
  2⤵
  PID:9340
- C:\Windows\System\nkrEBYr.exe
  C:\Windows\System\nkrEBYr.exe
  2⤵
  PID:9356
- C:\Windows\System\ZaLPxKm.exe
  C:\Windows\System\ZaLPxKm.exe
  2⤵
  PID:9372
- C:\Windows\System\rBZntYN.exe
  C:\Windows\System\rBZntYN.exe
  2⤵
  PID:9388
- C:\Windows\System\FUqbRel.exe
  C:\Windows\System\FUqbRel.exe
  2⤵
  PID:9404
- C:\Windows\System\cRLpfqi.exe
  C:\Windows\System\cRLpfqi.exe
  2⤵
  PID:9420
- C:\Windows\System\WJFngXx.exe
  C:\Windows\System\WJFngXx.exe
  2⤵
  PID:9436
- C:\Windows\System\xLvgtBf.exe
  C:\Windows\System\xLvgtBf.exe
  2⤵
  PID:9452
- C:\Windows\System\sgiJIjX.exe
  C:\Windows\System\sgiJIjX.exe
  2⤵
  PID:9468
- C:\Windows\System\NyAiPAq.exe
  C:\Windows\System\NyAiPAq.exe
  2⤵
  PID:9484
- C:\Windows\System\YWtGcmN.exe
  C:\Windows\System\YWtGcmN.exe
  2⤵
  PID:9500
- C:\Windows\System\iXRoFvM.exe
  C:\Windows\System\iXRoFvM.exe
  2⤵
  PID:9516
- C:\Windows\System\ZTFwdKg.exe
  C:\Windows\System\ZTFwdKg.exe
  2⤵
  PID:9532
- C:\Windows\System\LVxWNov.exe
  C:\Windows\System\LVxWNov.exe
  2⤵
  PID:9548
- C:\Windows\System\EQAfjCr.exe
  C:\Windows\System\EQAfjCr.exe
  2⤵
  PID:9564
- C:\Windows\System\DcuilqP.exe
  C:\Windows\System\DcuilqP.exe
  2⤵
  PID:9580
- C:\Windows\System\xvEdSee.exe
  C:\Windows\System\xvEdSee.exe
  2⤵
  PID:9596
- C:\Windows\System\NlKFqzP.exe
  C:\Windows\System\NlKFqzP.exe
  2⤵
  PID:9612
- C:\Windows\System\nvPucvY.exe
  C:\Windows\System\nvPucvY.exe
  2⤵
  PID:9628
- C:\Windows\System\mhjfkTU.exe
  C:\Windows\System\mhjfkTU.exe
  2⤵
  PID:9644
- C:\Windows\System\LgxKqIp.exe
  C:\Windows\System\LgxKqIp.exe
  2⤵
  PID:9660
- C:\Windows\System\VhmdEoK.exe
  C:\Windows\System\VhmdEoK.exe
  2⤵
  PID:9676
- C:\Windows\System\lvFivCP.exe
  C:\Windows\System\lvFivCP.exe
  2⤵
  PID:9692
- C:\Windows\System\jmPNnhN.exe
  C:\Windows\System\jmPNnhN.exe
  2⤵
  PID:9708
- C:\Windows\System\cQonYNA.exe
  C:\Windows\System\cQonYNA.exe
  2⤵
  PID:9724
- C:\Windows\System\GXqmwIS.exe
  C:\Windows\System\GXqmwIS.exe
  2⤵
  PID:9740
- C:\Windows\System\vkLpPQm.exe
  C:\Windows\System\vkLpPQm.exe
  2⤵
  PID:9756
- C:\Windows\System\JudGfNI.exe
  C:\Windows\System\JudGfNI.exe
  2⤵
  PID:9772
- C:\Windows\System\wyGCTsV.exe
  C:\Windows\System\wyGCTsV.exe
  2⤵
  PID:9788
- C:\Windows\System\PEAIuyD.exe
  C:\Windows\System\PEAIuyD.exe
  2⤵
  PID:9804
- C:\Windows\System\IEQIcgU.exe
  C:\Windows\System\IEQIcgU.exe
  2⤵
  PID:9820
- C:\Windows\System\ZdvNKpA.exe
  C:\Windows\System\ZdvNKpA.exe
  2⤵
  PID:9836
- C:\Windows\System\QeEoQzU.exe
  C:\Windows\System\QeEoQzU.exe
  2⤵
  PID:9852
- C:\Windows\System\wrcwLdD.exe
  C:\Windows\System\wrcwLdD.exe
  2⤵
  PID:9868
- C:\Windows\System\VfWQyMd.exe
  C:\Windows\System\VfWQyMd.exe
  2⤵
  PID:9884
- C:\Windows\System\DzWZmjb.exe
  C:\Windows\System\DzWZmjb.exe
  2⤵
  PID:9900
- C:\Windows\System\dulEXMd.exe
  C:\Windows\System\dulEXMd.exe
  2⤵
  PID:9916
- C:\Windows\System\WzKFYEs.exe
  C:\Windows\System\WzKFYEs.exe
  2⤵
  PID:9932
- C:\Windows\System\damkFhN.exe
  C:\Windows\System\damkFhN.exe
  2⤵
  PID:9948
- C:\Windows\System\dFhCaXH.exe
  C:\Windows\System\dFhCaXH.exe
  2⤵
  PID:9964
- C:\Windows\System\hdpeiET.exe
  C:\Windows\System\hdpeiET.exe
  2⤵
  PID:9980
- C:\Windows\System\xFPYcDt.exe
  C:\Windows\System\xFPYcDt.exe
  2⤵
  PID:9996
- C:\Windows\System\tQclXxS.exe
  C:\Windows\System\tQclXxS.exe
  2⤵
  PID:10012
- C:\Windows\System\qsEnxuV.exe
  C:\Windows\System\qsEnxuV.exe
  2⤵
  PID:10028
- C:\Windows\System\XsxcVTq.exe
  C:\Windows\System\XsxcVTq.exe
  2⤵
  PID:10044
- C:\Windows\System\iJCyibC.exe
  C:\Windows\System\iJCyibC.exe
  2⤵
  PID:10060
- C:\Windows\System\uqgeTPD.exe
  C:\Windows\System\uqgeTPD.exe
  2⤵
  PID:10076
- C:\Windows\System\ZkluhMU.exe
  C:\Windows\System\ZkluhMU.exe
  2⤵
  PID:10092
- C:\Windows\System\VBCwjIq.exe
  C:\Windows\System\VBCwjIq.exe
  2⤵
  PID:10108
- C:\Windows\System\OKpYUUq.exe
  C:\Windows\System\OKpYUUq.exe
  2⤵
  PID:10124
- C:\Windows\System\cEfxCoF.exe
  C:\Windows\System\cEfxCoF.exe
  2⤵
  PID:10140
- C:\Windows\System\tawlkvb.exe
  C:\Windows\System\tawlkvb.exe
  2⤵
  PID:10156
- C:\Windows\System\UFfBDvS.exe
  C:\Windows\System\UFfBDvS.exe
  2⤵
  PID:10172
- C:\Windows\System\bRsWRJd.exe
  C:\Windows\System\bRsWRJd.exe
  2⤵
  PID:10188
- C:\Windows\System\YdGRzbp.exe
  C:\Windows\System\YdGRzbp.exe
  2⤵
  PID:10204
- C:\Windows\System\mErBxpZ.exe
  C:\Windows\System\mErBxpZ.exe
  2⤵
  PID:10220
- C:\Windows\System\LrWqDWM.exe
  C:\Windows\System\LrWqDWM.exe
  2⤵
  PID:10236
- C:\Windows\System\IQIWmfd.exe
  C:\Windows\System\IQIWmfd.exe
  2⤵
  PID:9268
- C:\Windows\System\nVctUgK.exe
  C:\Windows\System\nVctUgK.exe
  2⤵
  PID:9020
- C:\Windows\System\YMBaeLC.exe
  C:\Windows\System\YMBaeLC.exe
  2⤵
  PID:9272
- C:\Windows\System\KIilIAs.exe
  C:\Windows\System\KIilIAs.exe
  2⤵
  PID:9396
- C:\Windows\System\uHZaKer.exe
  C:\Windows\System\uHZaKer.exe
  2⤵
  PID:9432
- C:\Windows\System\GsIbOOx.exe
  C:\Windows\System\GsIbOOx.exe
  2⤵
  PID:9316
- C:\Windows\System\VJmcfZO.exe
  C:\Windows\System\VJmcfZO.exe
  2⤵
  PID:9528
- C:\Windows\System\ZWUKayP.exe
  C:\Windows\System\ZWUKayP.exe
  2⤵
  PID:9412
- C:\Windows\System\Oozdlyh.exe
  C:\Windows\System\Oozdlyh.exe
  2⤵
  PID:9200
- C:\Windows\System\SPVRrqP.exe
  C:\Windows\System\SPVRrqP.exe
  2⤵
  PID:8476
- C:\Windows\System\TDNbGxY.exe
  C:\Windows\System\TDNbGxY.exe
  2⤵
  PID:9380
- C:\Windows\System\gmHeNmV.exe
  C:\Windows\System\gmHeNmV.exe
  2⤵
  PID:9508
- C:\Windows\System\DWLJkkn.exe
  C:\Windows\System\DWLJkkn.exe
  2⤵
  PID:9256
- C:\Windows\System\mnfsGIE.exe
  C:\Windows\System\mnfsGIE.exe
  2⤵
  PID:9144
- C:\Windows\System\sUoCzhL.exe
  C:\Windows\System\sUoCzhL.exe
  2⤵
  PID:9620
- C:\Windows\System\aXnVHSU.exe
  C:\Windows\System\aXnVHSU.exe
  2⤵
  PID:9656
- C:\Windows\System\LOktThM.exe
  C:\Windows\System\LOktThM.exe
  2⤵
  PID:9640
- C:\Windows\System\KwunCqp.exe
  C:\Windows\System\KwunCqp.exe
  2⤵
  PID:9572
- C:\Windows\System\KAWuwxu.exe
  C:\Windows\System\KAWuwxu.exe
  2⤵
  PID:9604
- C:\Windows\System\AhXTzQX.exe
  C:\Windows\System\AhXTzQX.exe
  2⤵
  PID:9812
- C:\Windows\System\RpBARXC.exe
  C:\Windows\System\RpBARXC.exe
  2⤵
  PID:9608
- C:\Windows\System\iQTwHIF.exe
  C:\Windows\System\iQTwHIF.exe
  2⤵
  PID:9704
- C:\Windows\System\oobMogA.exe
  C:\Windows\System\oobMogA.exe
  2⤵
  PID:9876
- C:\Windows\System\LYZtldN.exe
  C:\Windows\System\LYZtldN.exe
  2⤵
  PID:9924
- C:\Windows\System\WnAxUkA.exe
  C:\Windows\System\WnAxUkA.exe
  2⤵
  PID:10004
- C:\Windows\System\KhpCaVW.exe
  C:\Windows\System\KhpCaVW.exe
  2⤵
  PID:9992
- C:\Windows\System\aadArQg.exe
  C:\Windows\System\aadArQg.exe
  2⤵
  PID:10024
- C:\Windows\System\YavyyQM.exe
  C:\Windows\System\YavyyQM.exe
  2⤵
  PID:10100
- C:\Windows\System\skfLLrk.exe
  C:\Windows\System\skfLLrk.exe
  2⤵
  PID:10136
- C:\Windows\System\GFKkVwo.exe
  C:\Windows\System\GFKkVwo.exe
  2⤵
  PID:10168
- C:\Windows\System\lXyZfee.exe
  C:\Windows\System\lXyZfee.exe
  2⤵
  PID:10232
- C:\Windows\System\gwBRkeY.exe
  C:\Windows\System\gwBRkeY.exe
  2⤵
  PID:10052
- C:\Windows\System\XhaoMmf.exe
  C:\Windows\System\XhaoMmf.exe
  2⤵
  PID:9284
- C:\Windows\System\yHyfHpa.exe
  C:\Windows\System\yHyfHpa.exe
  2⤵
  PID:10216
- C:\Windows\System\tLSlSwY.exe
  C:\Windows\System\tLSlSwY.exe
  2⤵
  PID:9052
- C:\Windows\System\CAGvwqM.exe
  C:\Windows\System\CAGvwqM.exe
  2⤵
  PID:9220

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\DGIRmtK.exe

Filesize
811KB

MD5
518f0686551b44f9b288c633b6bac60c

SHA1
df6cfaf26e26fed1c6404536487a284d2356ad2c

SHA256
13eb3066cbe3dc00f50cc75a8d5ce1ad5441cfc07f54c8e28717739c96faf6fa

SHA512
9a7e32262517419b8f385785387ac7806d7f168fd0d4a82a6f935aa7c9f31a37b1adb960d367e5a390bcc4a1729db0b1e5bfca440ee05b363c9943209cf7aa88

Download Submit
C:\Windows\system\FTnaaaY.exe

Filesize
809KB

MD5
00e414c03e763ed82d62a694dbd97777

SHA1
9497eba48819562b3bbd98eec0bc27f003da75e4

SHA256
a643471bdd2776607de7cdb3d1f1e936bfd4abd3c37ee8c534e1fdca2390b4f8

SHA512
60524022d8f70d8f886bd1f4c1dd6da7a5da00317bb4a9642f4b1d5ae59a3faad9bbb69224ce9470c9f68b311cf72d837365485cc4c033aeb34dcb7f97cd37e1

Download Submit
C:\Windows\system\GscheoC.exe

Filesize
813KB

MD5
597aafcdf37713267f48cfd26c393bc1

SHA1
2b5169b726ac1ab1dc9ec025a74246ee610e6162

SHA256
a9a185d6c71497987af039c252d7e6589aaab1088fa8ab21f1170af1c1cf6e2f

SHA512
711ee015877db3697539cf571e10a21f3a82ade31f804ab113a40bba072a728b930c5ff1c04b3315fc15fd5d927fa4a669d4e3841584d77c67a81c33cf127afe

Download Submit
C:\Windows\system\LAtvNxC.exe

Filesize
815KB

MD5
5f02417cbe1e5af4fd4a2c720ee8b8df

SHA1
23fa7c7c335ae84008820901f2a56b26df9f3e3a

SHA256
75396ef77ccce3ba6c044d828390f204d953480e6e2c25005c882e37722db88a

SHA512
89db3e9363a683ff918eecd5af528c1d90f0591d9849449850dacd0e5b9c3cfb4178a63c353ea15a32aaa7f93c3b1fe0fcc7d84a3377d93edb204a55288aa985

Download Submit
C:\Windows\system\LLZZFtA.exe

Filesize
812KB

MD5
6a0be52a3af13461a326f4df45d756f6

SHA1
c57df20d72486de0c6adf5e450dd3fab147abe28

SHA256
e8ab060838cb6be770a9419e2bc9155d315582f33bd65a8d5ce2643031debc6d

SHA512
519d317935f7dc7907882d5d5280db2237ee8e71a04d1155e8da1c2ff29047ab7e06575eeafdf2c7ad12b24b503cb32a84ea8074a4fe3387d28ab3de9cae5e0c

Download Submit
C:\Windows\system\NKslHkn.exe

Filesize
810KB

MD5
f8d5a64f68295a58776bd6d62cd0b789

SHA1
d08b04b7f4e057820774e9b5b29c56c80b26eba9

SHA256
3ebe32885a144c2f608f4e8cf1dcd43e5e208229169015584be31e0ab9ab17e9

SHA512
313e842b9ce76da39ffed01536c979c7bdde90ce7ef34adb237dc30536f5792aca8741c7a71235a1faf8d63bc56336c0441871e13982420a954a73ded03a87c7

Download Submit
C:\Windows\system\NcDgSMN.exe

Filesize
812KB

MD5
3ba49b91938dba2689ad22202d7710a9

SHA1
7498735773daa552bc6f9afdc9b537b627504cec

SHA256
91552b97fcaba36af864ab2894d1e681ecfbd883be01fbec96afee91dd87ceb7

SHA512
6f30885f7dd746250af97922ff38d96035896ffebf8aa95e213b6d018894972c453ec9a39790d11e49831d1d1bb9ef65732deb00f3ecc31c24711fb2b13f0af1

Download Submit
C:\Windows\system\OETOGjO.exe

Filesize
810KB

MD5
14f88152ed4a2a9179bd7d4bd41c2135

SHA1
2e73834153f4de8277d695f1aa8a628cd66f72ba

SHA256
b74699128817db44d56d09150a7ee392e0b66fcb29120d576f3b7e12bd01110e

SHA512
d09a93ba9655ab211fdfb8b8ba9e78db5a983f45c83f5f0e06638647f8284b52d9be91c8294c5db8010956d3a6293536c03ee45e1d9faabb4378bbb6efd7798b

Download Submit
C:\Windows\system\PaszaVG.exe

Filesize
815KB

MD5
6e48740bc390106a3916ab10f28c1a71

SHA1
39109b80be4db0c5475ca4d015087b360c780a42

SHA256
0214270086aa0066e3a692e73a392248171627f36d313352e3de434e54beff3f

SHA512
a3824a6d00cd16496a4e3512ea5b40baa42d2025e013c0641783e1ce16c23ad11e6c02c7157c98feee5e112997609cb6a3c26afb3e28884b9491e650b605878f

Download Submit
C:\Windows\system\QqSyvLt.exe

Filesize
808KB

MD5
4610b3fccad761fe02890dd52f0d5c1d

SHA1
582636b45db6361e8b6a3ced99baaea0bcc814f6

SHA256
d2ff96283a7272a8b7b3db858fdbf9220c4effc7164d5bc9d891b20dff490489

SHA512
505a7086cdf43b1cccfb704249d921d0a210d10460fce6e06f52e80d1fc346eaeaf1b76c17ff471239b2a05a249b969f3d4551a95ba2c0de0b0b1575db092e94

Download Submit
C:\Windows\system\QyeVzkZ.exe

Filesize
8B

MD5
d0006131beaebb92e850658503891617

SHA1
de653db142b9b50425a4ee6c916b897be48acd92

SHA256
8c5f1bcf10b1fab50580abb06a989b553bcc1068906fc05c4ce6f45645cd9b67

SHA512
71d621cbea95c921cd1da431972b3eef8940f417bc8ebb09598a58dc3cfd7121bd627aeeac17c8a8725f262050b709111e92ea2ad4b891c286d391e59400320d

Download Submit
C:\Windows\system\TAuDuDA.exe

Filesize
808KB

MD5
2834e8ec8f0a9579230239ddc89990a0

SHA1
b1ad98acb3271fe810b741be9d935eb85fbee98f

SHA256
b75e4c910d096c2006f59e03cf96e29d05eebf48a6038536a062229f9dd146c5

SHA512
c9ddc75a42b6336017eaee493d21bbe8ae51f8c5836188caade7fa9b6b419f1c4466b8e82cb064472e2790df8f6f2b33bab67f596dba12afc0d1941ed925ee06

Download Submit
C:\Windows\system\TFkBJuh.exe

Filesize
814KB

MD5
f3552b82b629a374af5c62160584119f

SHA1
4ba76b2cd225fcfa0bf64cb61e12d427f9e44d36

SHA256
ff11156b3a6aa1d3539961b5f74c61771207e81caebd20600d5c01c12a031507

SHA512
21a5cb1f175d5717f4cfae237d492f830ca6208bf0fd9d95eb6c8e033c8dffb4e84c4a240466e64e5c78ddb8484bd36d5c0ef5147f2d60078eb54049ac3db42b

Download Submit
C:\Windows\system\VUOxXSy.exe

Filesize
813KB

MD5
61c78edf73f9ea44379be773615e8283

SHA1
b65e5c5ea95cb8236c9fc615a4149f2ed1af2446

SHA256
b0d5423b05d50a81398a888c4cc1c9345573d2be7fc628bd112dfa02f0dde8a3

SHA512
3435f546bcc9a22671940a20bcdd2da5a64e026ba8c68c448013452eac1b1119246f21c7e1ec84d6b388f96bbc6f05725073f916082b4c3d6194f5c4693285cc

Download Submit
C:\Windows\system\hLgGHoN.exe

Filesize
809KB

MD5
8301bdb2930992d3a6dcdc74cc6cbdf6

SHA1
e81fe63b1dafd6171012d5babc79bf5132fdef8e

SHA256
e473da759b8fed45753bd3c57a43d9a33f1af50a33db185829e450362818909f

SHA512
54b2e45ebecf8b90c4513ae2d28617182140e4a35e4b53f2c2c60c8feb1bc984362e48d0a7237a9b21e0d25838b7fc925ce9f48cd3c13fc68ab2657865ebfd46

Download Submit
C:\Windows\system\krIwHAq.exe

Filesize
814KB

MD5
1b0cfabd269460f00946f521b6bfe0e8

SHA1
3e97f799f8d00360d46fa54af64e9ee94bef6aaf

SHA256
0c028d874383d6e109b97913d72f49a7ce4cd789435f5833299df7494066215b

SHA512
4e60121da0cbfff67c5d9564a79d89e11cf6e3db01bff30b5dc39bc960d7e3a1a72b038e5968136ee2cfe32553e8407119ca0f2a6ad0d5b1f1d139b6569a857d

Download Submit
C:\Windows\system\shikHYS.exe

Filesize
811KB

MD5
1599fb351a6fa582b5d80748638115b5

SHA1
48a4f20faa7ce0add86a093c481f075ab428332c

SHA256
d76e412f80f38fe6b9c3633dda26b0a97ae75a74983bdf40c61001673e7d379a

SHA512
deec25748bee71de2ae6f09e0fa17e6e02804ae842c70911cbe421e8963e3a1ee21918fa7d8006b201c78897e0fe79c456c93585603f3afb64ad7c9eacf91c06

Download Submit
C:\Windows\system\wqZqqrk.exe

Filesize
807KB

MD5
f62af0c16e933ff4b35c09a5ec28e30f

SHA1
12ee9ae4bd1d149c9857dd1635904f9c019100e9

SHA256
a44c89cabf8004e41b5a48e88e4a39f584e24aecc6d647fed1088ba9dab11c83

SHA512
469db75024aa526b3696fbac6889ab50e87b60797c0b09bb70a3a1269d840123a7c9cd7d3ce5c86391b1ba25b0a8208ed7b34789d33faeab2ebccdb5631d67e1

Download Submit
C:\Windows\system\ykndzWW.exe

Filesize
808KB

MD5
3ed6b75ff715b6d60bc9f1abc672e7ce

SHA1
79e5f55597d9375918ea4da025086b9820961185

SHA256
ca52bea8d8a3289f8ef64953bb12f5fdb2c063c9aaea13d542f0093496c47bae

SHA512
be02c45a6726f68d767fb8dd59c5a5726341421ee9a90f70768e294eeb3325e19a31687b544c3a9eb129a866e9fe939e9760ead87963bbd4ccc499cc7ed1f0cc

Download Submit
\Windows\system\DJZogBn.exe

Filesize
808KB

MD5
fa8b3dae9d9c1d8c5f50a9c2f09d9e6e

SHA1
b9c45c7856ab3030773e7781fc985374f9a002b2

SHA256
7b9f69f8c7fcdba9916435692bdc69ee166a3f8c74a320cc445e66c8d99712fc

SHA512
946fdfd9f597773fe1de11adacdb9b83374e3cbc99306a265e9a344107c24c4def391548b545a5825898b73133cef56fffce14c300a323324a43d4b933d9b4a5

Download Submit
\Windows\system\FySDFjh.exe

Filesize
813KB

MD5
9b552627bce2c29d60198e40a9f2bb7f

SHA1
edf7140b605c7bf416ec8814f00fcb3a64bb7750

SHA256
738c51405028426211bba3823f90ee0287aff62fa0736b30cd4a2bbdfc78664c

SHA512
a60529fa76e06b1f40a1b4a69a0de5e4b9a02015560182906daf0db7b580c186831fdd5a65a40ecc1ee78458c669db4dcd4ffedfed93a85eb24aab892bdde4cd

Download Submit
\Windows\system\GclVlIW.exe

Filesize
809KB

MD5
b9b22955671db80e5442ed76ffb52fbc

SHA1
facfa2d0480699c14a0d19acde0172aab9902c8f

SHA256
83e640f4c4ebc7518c82758ea522733c764cb87e9b0ebfaece35b58519ab1d5c

SHA512
74ad79eb0c13c2b2b6cb280f71f5c918a18a0d6910b654e620f921b3358b771ba500828491bcc1eae76d601d43baf0e8f1ae326151bca2be2b3043cef644388c

Download Submit
\Windows\system\IoOjMyZ.exe

Filesize
815KB

MD5
497bbb3b126984c6390fc488392b7a1b

SHA1
e9934fb8e5c6ef0afbda30c3ed627ecd92c966e1

SHA256
d98c6f7f5a11c02249e05582195520c883d54de3f6e63ef6a75fa9fafcefea46

SHA512
515e2a50035abf19bebc0275b16db740f27bf61ff8861260be6b58cae75227609fed6d87811966359525cd07fd73821e0f94ea422fa6f254a0e03d01b79d754e

Download Submit
\Windows\system\JDnyUdF.exe

Filesize
816KB

MD5
b2f91b502de3180bcf2cf14370f09fc2

SHA1
31ad9cc4552068df69c6901210f09eaeff115556

SHA256
e2eb29d2e645e5d18809bb0a784153a948931b8c16ab114f17aee6baa7fa2506

SHA512
d0004a74293a8855e0763578bb144749b0e96e985bc2bd2544ec5d30175a9073602c078642d409097ffa3234eefd63a7994576703926c5b8a47ed4dedb8c8a69

Download Submit
\Windows\system\JKjlsNL.exe

Filesize
810KB

MD5
5ff0f7ad729e34c8b7a59610b7786819

SHA1
d580bc3e2d02d3c493fe51e33316e974936d813b

SHA256
60b1a6091c05c01c793eaa79d81d27ccd994f58778271b5704318491d37701f8

SHA512
e67495a5e3817b4e3a8f4418e8341b1a71c2c4a7d6722c3855ec5693eceb8aadb9fe7a7bd3138bf360efa0f56af83bed6eb9dbd76301dcde3db16599b3881891

Download Submit
\Windows\system\LJLUaRV.exe

Filesize
815KB

MD5
e46fc0455b0977025e460c59154e599f

SHA1
c44dd02c1019f515866b5778f3dcc9da14b7086f

SHA256
5c56830761d5e78ef1bcb0a4c63fad426fa764864c761d49df47a977a798132b

SHA512
613fbed6806cbffedbc0a9253db3d27a02ce3d3dbb3a720e5960e2cddf3a3e425ee5fe3a1783543680f210af0f76e71adfd0cf8b6f4730d505d98cb488dc1840

Download Submit
\Windows\system\NYXTBTO.exe

Filesize
817KB

MD5
f173ae399ed4413927447a9b4590fcb2

SHA1
f0c1b0463697512a94cab23bb246b3264bf11b1d

SHA256
3c7b85eae9c4835c764a30a8aadb3ed534faa041a26fe45eecf3807b996cbc55

SHA512
5d60f89b157ef2808aa2dd5e0c9764af0268ddefac8558c6656843f33de0b68c5735401762c1d67222590eb65ea8dc65d3409fe4c7325ff0abe0824d1980c819

Download Submit
\Windows\system\QLprfxL.exe

Filesize
811KB

MD5
e1fd1dd96fa41be85d3ebf92beef6b56

SHA1
bafce5d9a1aed693a636d7a19c2e914df8362a16

SHA256
735ddb36672370ea811b485809ae31227be5bc9caf61b050c3d134570ae0354b

SHA512
086e6dd7830c64f8e9e92c15bfa5bee7df62d910107a13072b2c8414a32a9fea2a694a568e00c56427927a5c61975ea1930ded94d80840e97801441d471353a6

Download Submit
\Windows\system\QxTqBpI.exe

Filesize
810KB

MD5
4dad36d788d2a357f45c96b6a059e2cd

SHA1
cac008b90f1896572d6af34bf5d1ecfc0414e99f

SHA256
26bc732e96c136f7c79c32e5eb559ce63d8d1f7610eb6ab0ad22441e725644b9

SHA512
d3ecd317d1733b0ee13916c1c9c0b7c32bffc1f9421b736130e7881e04771d079814e1376d1e7bb0f330130328ab9e92dc0a62a94e6f5d8692587690ec22f0ef

Download Submit
\Windows\system\UnwyyPP.exe

Filesize
816KB

MD5
81ad72a63eddcac1ba694e8b4fb99110

SHA1
f882e5c460865a28a5b51cc04f8e9dd036f0f571

SHA256
e17d9e98d0d8bcce94af831188c89a0ddee3aa9ee4a666840d14db0ce3377b22

SHA512
2015b23c7979aeb05464e92f49932fff2a4058cd0525faf5b3b4ef1d315dd44e104d5e6b79456101accd01db89a6b83a863e82dd49601e8f1840fd12d471ccbe

Download Submit
\Windows\system\XISvctA.exe

Filesize
818KB

MD5
19fa39d497f4ce85661f4ed1c3920f8e

SHA1
a6e28e069d44ebaa7cc1d07cedd691b96bf8093a

SHA256
d2b176aca8ba510b8cecc84a201a18691f42cbfeb3e5c8f83f99fef9bcc9fc13

SHA512
a75594e7684e163cecde91bce67af087eca5ce9f6434cb48e19502aec4f40d1b0fa89c476d329bc80a86ed8da1ffa26767cb1b581ae7ce72da5e9644f518b3c8

Download Submit
\Windows\system\XdLFuPq.exe

Filesize
817KB

MD5
94a1f75a2a387bea62676a5d55004893

SHA1
e998cc1889b176139f680ed7ed0f9b79475c5f9a

SHA256
dbcb0a227e487c4ce5ecc3de732c03a0a8554a0d826d9022fa16fc2a6079cdaf

SHA512
8f692e4908d9c67573dd06cc69878858faab999db1a65dcd53a89f4423b0bafe623f738f2d8164452105b1874d39ed81e7642f210f36098ec026ba1db09c2f94

Download Submit
\Windows\system\fNCChXS.exe

Filesize
817KB

MD5
7681a922365fd9692691b94f6558462c

SHA1
65771ca4c20d2a7be2bd4da8c2fab5a96d9c0f5b

SHA256
86c6df44181e9e3fdba9d1245cef3d5f14c76ad41a021b3294a7988eadc3fc81

SHA512
0d3628d5c3d945e62064fefb678831a0f5fa53173d7a7e616a6305b5d3d6d743be783e7721112112f7f70067500ae0c285bc3ac7e2f95a69fdbe46a726f080e6

Download Submit
\Windows\system\feTLxjd.exe

Filesize
818KB

MD5
c9438e201e3d9550a43fddca1ec32e0c

SHA1
46c036f27f648baf4ccb5c0cafdead72561d68cd

SHA256
cfd114854b064c35cef73f32e6aa5773bda38fcdce7f0f9ad5f09b2b071c506f

SHA512
018debcb40b6b4692b2119daed313c54a2955713b7ce4988e4921abdc1b708c165d75de87e00ac9d3067d0d2e1fec8eb515d3f7e961d3bacc98fda5ee1bd4b04

Download Submit
\Windows\system\gEPFbmi.exe

Filesize
811KB

MD5
e3a9d96206b1ac1ca1bd0c5e3e856151

SHA1
217c6d3fd669433334075a3ba1f0a31c55fd6836

SHA256
9a9daef96c3f74d64f4a604f8ae85eb31ca8513a5588a4c3e116d774e7bf168a

SHA512
92ecb521de6283404eeb5e6b5f4d72b3a779e7fecff3ba5adcdaeebabeeeed9a433185925d8ffcf2659cca95bdf296aa523ea433a47c023ae1c9084621506049

Download Submit
\Windows\system\hyMOIqT.exe

Filesize
816KB

MD5
8e1bae195e5678736c3e6f94f57b1e5b

SHA1
6493e919c5054a51eaee532007f8e1e5a545409c

SHA256
eea9226874edff3ec0e31a9a679efd397c773b16257b1256de5c01a4b0cd8875

SHA512
b3af182daf096325e210afd32df5f5947e0057e3e20bfab1e924a0d5e9bcaeb273bfe1f287bd4ac9c21ef8eead78d583c8f3304c1f650c5535540c22407e0ab4

Download Submit
\Windows\system\iFhczDf.exe

Filesize
814KB

MD5
306ffa3cc3fa8bd93abffa16d8c91e81

SHA1
d368e37145bb755467be61fb4cae7f9ff4bc2c83

SHA256
784af5de74e8932b31327d0c8f14d472da48038e9703eb9e09e2ff3eaf09d5a2

SHA512
4b6dbefcd6ba5911c659587623e43456c6005448b341947bed07e5cc31c14ecc438f3c356041b8ed61c159546597f240eb855a7a7e24aa2cc5ab8480d260736f

Download Submit
\Windows\system\isQKiYI.exe

Filesize
817KB

MD5
804b4199e9b6ec75d17ec6bf31313e4a

SHA1
9f331f189107f6c7e026ddaeef5ce4941e368da4

SHA256
751e90b3915a3e3e2938edbe20579b4fa02f12f1030fc288805acfd2496f631d

SHA512
2104f32ea20ad68415affcce81a840478f3ae5c77caa4cf5079977f9dd4c73fd2e9d9f02166e9d24ac11072c6e80e31d9312b925610876f71dce595aabeee35b

Download Submit
\Windows\system\kKZXiqq.exe

Filesize
812KB

MD5
253bf502e7188a5651d187146cc4ee42

SHA1
218e709ed8ae56de637169243881abd5cf44db45

SHA256
5302c23ec1dfe4a0f070fff1f20eecdcb2f7e14fd7a025a22f4b6970feee64c3

SHA512
e561e1162b9288f7d9f27f09dbb3dae6fcf278632cd31bd96f0296cd9f750a9cd8096d7b9b291c4a7fbb0edb5efb48a3c2dcee0d940e08aeb1ccb2db7375e149

Download Submit
\Windows\system\kZkquqQ.exe

Filesize
814KB

MD5
9ad7d1218ebcc1707d00fa389fa233f4

SHA1
baab6c5984be88c4f6d49d45d85b93800ffa42ea

SHA256
c9fcca4ed9b01cb915caeee958ed35323161d751c7299b3f2df4b43839bea4d0

SHA512
00637f0fc4593fbbcef9123685b172ab988bca99d50536dfd9b1971be52916c8522bd14493aa145f96ff139e1056212bc9de097776b9d21086d43d9b002f6a7d

Download Submit
\Windows\system\qUSVPVn.exe

Filesize
818KB

MD5
8e60ca26d760ad12e7e24070888a8745

SHA1
36563be55ecf4d410727688aa3398c4fe40a11cf

SHA256
e60cd1fa3b44a6f096448197f15f1278e8fadbfc6c92d6c0d872d8c9f7bc5ed9

SHA512
495afe6ef69b1a715fc3c9be81ea69331cfd7734b3075b6191a6f8b6d52da2a41cd51d29bcbfd041bb9ecddfc9c0e9a7e217cc85b1a75d1dbbacd72e0049e29b

Download Submit
\Windows\system\rDbtVZY.exe

Filesize
816KB

MD5
595dda91437afc09efe9a0dbb1b41c57

SHA1
785f32ae4438ff0f28e3f93e4b36eafe61349e0b

SHA256
f1daeac5fa6a45dbca4453fd7dd067dd4ff05b4acdff59c9b9da4af0f0953124

SHA512
dce8b04e5f0cbb4a6207c502969b834c240d6d77c2ee25c7292ed1a0f984b258faa88dc25787b72a92b7956aa137f9f9954c6287d186f1f8c399e7e9eb1553a0

Download Submit
\Windows\system\rIQkiwi.exe

Filesize
813KB

MD5
b6c4bce9c4531c866dae82c9d644da6c

SHA1
4e5fd9aca9d860893c1269d514bae9fbc18efc16

SHA256
cafe1086c2bf949eb5baa78c6e79df0456ce28a54834138ba69d4096807ef2d1

SHA512
fdd21a2a6909ece146be2a06b75d23ca6f18714ae06f3c0efda941159ec70ada570a6c0ae9bd742c17522a6c6886e1f89d2dad47e605e825f0dd872ecaa16ccb

Download Submit
\Windows\system\xLanqFX.exe

Filesize
812KB

MD5
0b133ed973aec3d04e247dea71ed398f

SHA1
9b2d03e96f0512d3bc37e329058aa04eb9a82957

SHA256
29a00c22f05f29f0c33375b002be77c014db8313acbe3127701e102e8040b860

SHA512
5af47353fa772aa0451e8cfe84036fd602aa945203e2d7c91259749ed25b912d40130bb251009c2520606d21786cfdcd70ee6641667138a22d51063d792c3d16

Download Submit
\Windows\system\yRfPPas.exe

Filesize
809KB

MD5
1b52453f01d11514c95cf50cf35d0ccf

SHA1
0f3187eada16722538378b07f17c5b168a9ae921

SHA256
76fa6a07366cb9e7b373b7b86630c58bb03f8463f2ddb4126e18e7dbd8e66722

SHA512
d58832b6f7c5f86aa6228466931ee9164110db26d1a26ab7ca09c8f47f0301a8f49a80563c55759d4a23d7c259a6ec5c9f94ba639628cbce3eb9f1faa7404eb1

Download Submit
memory/2156-213-0x000000013F510000-0x000000013F902000-memory.dmp

Filesize
3.9MB

Download
memory/2188-8527-0x0000000003370000-0x0000000003762000-memory.dmp

Filesize
3.9MB

Download
memory/2188-2-0x000000013F0B0000-0x000000013F4A2000-memory.dmp

Filesize
3.9MB

Download
memory/2188-164-0x000000013F570000-0x000000013F962000-memory.dmp

Filesize
3.9MB

Download
memory/2188-46-0x000000013F820000-0x000000013FC12000-memory.dmp

Filesize
3.9MB

Download
memory/2188-8167-0x000000013F0B0000-0x000000013F4A2000-memory.dmp

Filesize
3.9MB

Download
memory/2188-51-0x000000013F970000-0x000000013FD62000-memory.dmp

Filesize
3.9MB

Download
memory/2188-107-0x000000013FE70000-0x0000000140262000-memory.dmp

Filesize
3.9MB

Download
memory/2188-9306-0x0000000003370000-0x0000000003762000-memory.dmp

Filesize
3.9MB

Download
memory/2188-25-0x0000000003370000-0x0000000003762000-memory.dmp

Filesize
3.9MB

Download
memory/2188-215-0x000000013F4B0000-0x000000013F8A2000-memory.dmp

Filesize
3.9MB

Download
memory/2188-49-0x000000013FB40000-0x000000013FF32000-memory.dmp

Filesize
3.9MB

Download
memory/2188-211-0x000000013F510000-0x000000013F902000-memory.dmp

Filesize
3.9MB

Download
memory/2188-125-0x0000000003370000-0x0000000003762000-memory.dmp

Filesize
3.9MB

Download
memory/2188-19-0x000000013F4B0000-0x000000013F8A2000-memory.dmp

Filesize
3.9MB

Download
memory/2188-8-0x000000013FEF0000-0x00000001402E2000-memory.dmp

Filesize
3.9MB

Download
memory/2188-0-0x00000000001F0000-0x0000000000200000-memory.dmp

Filesize
64KB

Download
memory/2404-54-0x000000013F970000-0x000000013FD62000-memory.dmp

Filesize
3.9MB

Download
memory/2464-4428-0x000000013F100000-0x000000013F4F2000-memory.dmp

Filesize
3.9MB

Download
memory/2464-204-0x000000013F100000-0x000000013F4F2000-memory.dmp

Filesize
3.9MB

Download
memory/2512-48-0x000000013F820000-0x000000013FC12000-memory.dmp

Filesize
3.9MB

Download
memory/2512-4422-0x000000013F820000-0x000000013FC12000-memory.dmp

Filesize
3.9MB

Download
memory/2548-112-0x000000013FE70000-0x0000000140262000-memory.dmp

Filesize
3.9MB

Download
memory/2548-5059-0x000000013FE70000-0x0000000140262000-memory.dmp

Filesize
3.9MB

Download
memory/2564-4431-0x000000013F1A0000-0x000000013F592000-memory.dmp

Filesize
3.9MB

Download
memory/2564-138-0x000000013F1A0000-0x000000013F592000-memory.dmp

Filesize
3.9MB

Download
memory/2588-50-0x000000013FB40000-0x000000013FF32000-memory.dmp

Filesize
3.9MB

Download
memory/2588-4432-0x000000013FB40000-0x000000013FF32000-memory.dmp

Filesize
3.9MB

Download
memory/2624-20-0x000000013F4B0000-0x000000013F8A2000-memory.dmp

Filesize
3.9MB

Download
memory/2624-5087-0x000000013F4B0000-0x000000013F8A2000-memory.dmp

Filesize
3.9MB

Download
memory/2640-4381-0x000000013F330000-0x000000013F722000-memory.dmp

Filesize
3.9MB

Download
memory/2640-27-0x000000013F330000-0x000000013F722000-memory.dmp

Filesize
3.9MB

Download
memory/2784-29-0x000007FEF598E000-0x000007FEF598F000-memory.dmp

Filesize
4KB

Download
memory/2784-28-0x00000000029F0000-0x0000000002A70000-memory.dmp

Filesize
512KB

Download
memory/2784-53-0x000007FEF56D0000-0x000007FEF606D000-memory.dmp

Filesize
9.6MB

Download
memory/2784-548-0x000007FEF56D0000-0x000007FEF606D000-memory.dmp

Filesize
9.6MB

Download
memory/2784-30-0x000000001B6E0000-0x000000001B9C2000-memory.dmp

Filesize
2.9MB

Download
memory/2784-31-0x0000000001ED0000-0x0000000001ED8000-memory.dmp

Filesize
32KB

Download
memory/2784-44-0x000007FEF56D0000-0x000007FEF606D000-memory.dmp

Filesize
9.6MB

Download
memory/2976-4380-0x000000013FEF0000-0x00000001402E2000-memory.dmp

Filesize
3.9MB

Download
memory/2976-9-0x000000013FEF0000-0x00000001402E2000-memory.dmp

Filesize
3.9MB

Download