xmrig | 9ea6a42367b28ec23ee4476bb87a04073146ca49b7211b012da96a571883389b

Analysis

max time kernel
149s
max time network
143s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
28/06/2024, 15:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9ea6a42367b28ec23ee4476bb87a04073146ca49b7211b012da96a571883389b_NeikiAnalytics.exe
Size

1.4MB
MD5

bbd24a22d4645ef1c45cb627a0712190
SHA1

519eb21743e87dbae3d978bb862b117c9559864e
SHA256

9ea6a42367b28ec23ee4476bb87a04073146ca49b7211b012da96a571883389b
SHA512

c7c6ce2ba701375f812716dd47ce633a3559ede3da002829ef61a3a2ea851f662a747bbd8efdce32da267df748a2425782a735c1c3e185e91eafd12b1b679415
SSDEEP

24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjhnXwx8/2Pbx/mbGRJpsHEm7qUutk:Lz071uv4BPMkHC0IlnASEx/RHpK7/

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 14 IoCs

miner

resource	yara_rule
behavioral1/memory/2672-50-0x000000013F8F0000-0x000000013FCE2000-memory.dmp	xmrig
behavioral1/memory/2864-55-0x000000013F290000-0x000000013F682000-memory.dmp	xmrig
behavioral1/memory/2696-54-0x000000013FD50000-0x0000000140142000-memory.dmp	xmrig
behavioral1/memory/1472-70-0x000000013F5C0000-0x000000013F9B2000-memory.dmp	xmrig
behavioral1/memory/2096-353-0x000000013F8B0000-0x000000013FCA2000-memory.dmp	xmrig
behavioral1/memory/2636-352-0x000000013F3F0000-0x000000013F7E2000-memory.dmp	xmrig
behavioral1/memory/2088-351-0x000000013FBE0000-0x000000013FFD2000-memory.dmp	xmrig
behavioral1/memory/2536-89-0x000000013F410000-0x000000013F802000-memory.dmp	xmrig
behavioral1/memory/2552-703-0x000000013FEC0000-0x00000001402B2000-memory.dmp	xmrig
behavioral1/memory/1896-1716-0x000000013F6F0000-0x000000013FAE2000-memory.dmp	xmrig
behavioral1/memory/1360-5362-0x000000013F100000-0x000000013F4F2000-memory.dmp	xmrig
behavioral1/memory/1360-5408-0x000000013F100000-0x000000013F4F2000-memory.dmp	xmrig
behavioral1/memory/2152-5414-0x000000013FF50000-0x0000000140342000-memory.dmp	xmrig
behavioral1/memory/1896-5419-0x000000013F6F0000-0x000000013FAE2000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
1056	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
2536	WFGiegs.exe
2636	ZBzzDpt.exe
2552	fndkylg.exe
2096	TgcYkih.exe
2672	XxkLLKz.exe
2696	bfdTVDA.exe
2864	vDQvZhU.exe
1896	mlKbBAz.exe
1472	ATzOdET.exe
2372	xfkSnFT.exe
1360	jLrrQmm.exe
2152	angIqPP.exe
2192	ZFWZgqZ.exe
1764	hccyXvn.exe
1368	RiqHSPp.exe
1584	kocXOHN.exe
2656	VAgTAwR.exe
1280	GDuulhX.exe
2040	YNGWyhq.exe
3048	DWUnOOS.exe
2108	WhnEiDU.exe
2104	SvFoMLH.exe
2688	wIURWDl.exe
2120	fxLWGUv.exe
600	JImbxcQ.exe
796	cBeAOhz.exe
1592	tPvFHQk.exe
1716	MbFMzJV.exe
1744	XzOQXHJ.exe
1480	DTgIUlm.exe
2956	pAudgtK.exe
2920	EPppTtx.exe
932	ZxLZUaQ.exe
1308	zeKRPni.exe
400	RdEKWiW.exe
2848	gXzBBUG.exe
1708	cRhjEhG.exe
1804	cNDSGkn.exe
2760	bFLGCFQ.exe
924	deGkIjG.exe
3068	XpAGCey.exe
716	xaCLdTI.exe
1720	cFLQhZq.exe
2944	fTYoebL.exe
1012	YlwZilb.exe
1556	kMXkAfG.exe
2676	iEPfEFD.exe
1964	rVBAXmN.exe
2032	qCshFaZ.exe
1916	ILvApfv.exe
2776	gzUEsmp.exe
1552	MQzunBx.exe
2680	FrpPAoH.exe
2596	NsmxZnw.exe
2528	fAYZOjQ.exe
2996	zNvYoaR.exe
2532	rxKqadR.exe
2712	ikGrKPx.exe
2580	oPTFqKd.exe
2420	IIDVefz.exe
2456	CfMTELu.exe
1656	akkyOSf.exe
1860	RfWyVtK.exe
2308	JcXiYps.exe

Loads dropped DLL 64 IoCs

pid	Process
2088	9ea6a42367b28ec23ee4476bb87a04073146ca49b7211b012da96a571883389b_NeikiAnalytics.exe
2088	9ea6a42367b28ec23ee4476bb87a04073146ca49b7211b012da96a571883389b_NeikiAnalytics.exe
2088	9ea6a42367b28ec23ee4476bb87a04073146ca49b7211b012da96a571883389b_NeikiAnalytics.exe
2088	9ea6a42367b28ec23ee4476bb87a04073146ca49b7211b012da96a571883389b_NeikiAnalytics.exe
2088	9ea6a42367b28ec23ee4476bb87a04073146ca49b7211b012da96a571883389b_NeikiAnalytics.exe
2088	9ea6a42367b28ec23ee4476bb87a04073146ca49b7211b012da96a571883389b_NeikiAnalytics.exe
2088	9ea6a42367b28ec23ee4476bb87a04073146ca49b7211b012da96a571883389b_NeikiAnalytics.exe
2088	9ea6a42367b28ec23ee4476bb87a04073146ca49b7211b012da96a571883389b_NeikiAnalytics.exe
2088	9ea6a42367b28ec23ee4476bb87a04073146ca49b7211b012da96a571883389b_NeikiAnalytics.exe
2088	9ea6a42367b28ec23ee4476bb87a04073146ca49b7211b012da96a571883389b_NeikiAnalytics.exe
2088	9ea6a42367b28ec23ee4476bb87a04073146ca49b7211b012da96a571883389b_NeikiAnalytics.exe
2088	9ea6a42367b28ec23ee4476bb87a04073146ca49b7211b012da96a571883389b_NeikiAnalytics.exe
2088	9ea6a42367b28ec23ee4476bb87a04073146ca49b7211b012da96a571883389b_NeikiAnalytics.exe
2088	9ea6a42367b28ec23ee4476bb87a04073146ca49b7211b012da96a571883389b_NeikiAnalytics.exe
2088	9ea6a42367b28ec23ee4476bb87a04073146ca49b7211b012da96a571883389b_NeikiAnalytics.exe
2088	9ea6a42367b28ec23ee4476bb87a04073146ca49b7211b012da96a571883389b_NeikiAnalytics.exe
2088	9ea6a42367b28ec23ee4476bb87a04073146ca49b7211b012da96a571883389b_NeikiAnalytics.exe
2088	9ea6a42367b28ec23ee4476bb87a04073146ca49b7211b012da96a571883389b_NeikiAnalytics.exe
2088	9ea6a42367b28ec23ee4476bb87a04073146ca49b7211b012da96a571883389b_NeikiAnalytics.exe
2088	9ea6a42367b28ec23ee4476bb87a04073146ca49b7211b012da96a571883389b_NeikiAnalytics.exe
2088	9ea6a42367b28ec23ee4476bb87a04073146ca49b7211b012da96a571883389b_NeikiAnalytics.exe
2088	9ea6a42367b28ec23ee4476bb87a04073146ca49b7211b012da96a571883389b_NeikiAnalytics.exe
2088	9ea6a42367b28ec23ee4476bb87a04073146ca49b7211b012da96a571883389b_NeikiAnalytics.exe
2088	9ea6a42367b28ec23ee4476bb87a04073146ca49b7211b012da96a571883389b_NeikiAnalytics.exe
2088	9ea6a42367b28ec23ee4476bb87a04073146ca49b7211b012da96a571883389b_NeikiAnalytics.exe
2088	9ea6a42367b28ec23ee4476bb87a04073146ca49b7211b012da96a571883389b_NeikiAnalytics.exe
2088	9ea6a42367b28ec23ee4476bb87a04073146ca49b7211b012da96a571883389b_NeikiAnalytics.exe
2088	9ea6a42367b28ec23ee4476bb87a04073146ca49b7211b012da96a571883389b_NeikiAnalytics.exe
2088	9ea6a42367b28ec23ee4476bb87a04073146ca49b7211b012da96a571883389b_NeikiAnalytics.exe
2088	9ea6a42367b28ec23ee4476bb87a04073146ca49b7211b012da96a571883389b_NeikiAnalytics.exe
2088	9ea6a42367b28ec23ee4476bb87a04073146ca49b7211b012da96a571883389b_NeikiAnalytics.exe
2088	9ea6a42367b28ec23ee4476bb87a04073146ca49b7211b012da96a571883389b_NeikiAnalytics.exe
2088	9ea6a42367b28ec23ee4476bb87a04073146ca49b7211b012da96a571883389b_NeikiAnalytics.exe
2088	9ea6a42367b28ec23ee4476bb87a04073146ca49b7211b012da96a571883389b_NeikiAnalytics.exe
2088	9ea6a42367b28ec23ee4476bb87a04073146ca49b7211b012da96a571883389b_NeikiAnalytics.exe
2088	9ea6a42367b28ec23ee4476bb87a04073146ca49b7211b012da96a571883389b_NeikiAnalytics.exe
2088	9ea6a42367b28ec23ee4476bb87a04073146ca49b7211b012da96a571883389b_NeikiAnalytics.exe
2088	9ea6a42367b28ec23ee4476bb87a04073146ca49b7211b012da96a571883389b_NeikiAnalytics.exe
2088	9ea6a42367b28ec23ee4476bb87a04073146ca49b7211b012da96a571883389b_NeikiAnalytics.exe
2088	9ea6a42367b28ec23ee4476bb87a04073146ca49b7211b012da96a571883389b_NeikiAnalytics.exe
2088	9ea6a42367b28ec23ee4476bb87a04073146ca49b7211b012da96a571883389b_NeikiAnalytics.exe
2088	9ea6a42367b28ec23ee4476bb87a04073146ca49b7211b012da96a571883389b_NeikiAnalytics.exe
2088	9ea6a42367b28ec23ee4476bb87a04073146ca49b7211b012da96a571883389b_NeikiAnalytics.exe
2088	9ea6a42367b28ec23ee4476bb87a04073146ca49b7211b012da96a571883389b_NeikiAnalytics.exe
2088	9ea6a42367b28ec23ee4476bb87a04073146ca49b7211b012da96a571883389b_NeikiAnalytics.exe
2088	9ea6a42367b28ec23ee4476bb87a04073146ca49b7211b012da96a571883389b_NeikiAnalytics.exe
2088	9ea6a42367b28ec23ee4476bb87a04073146ca49b7211b012da96a571883389b_NeikiAnalytics.exe
2088	9ea6a42367b28ec23ee4476bb87a04073146ca49b7211b012da96a571883389b_NeikiAnalytics.exe
2088	9ea6a42367b28ec23ee4476bb87a04073146ca49b7211b012da96a571883389b_NeikiAnalytics.exe
2088	9ea6a42367b28ec23ee4476bb87a04073146ca49b7211b012da96a571883389b_NeikiAnalytics.exe
2088	9ea6a42367b28ec23ee4476bb87a04073146ca49b7211b012da96a571883389b_NeikiAnalytics.exe
2088	9ea6a42367b28ec23ee4476bb87a04073146ca49b7211b012da96a571883389b_NeikiAnalytics.exe
2088	9ea6a42367b28ec23ee4476bb87a04073146ca49b7211b012da96a571883389b_NeikiAnalytics.exe
2088	9ea6a42367b28ec23ee4476bb87a04073146ca49b7211b012da96a571883389b_NeikiAnalytics.exe
2088	9ea6a42367b28ec23ee4476bb87a04073146ca49b7211b012da96a571883389b_NeikiAnalytics.exe
2088	9ea6a42367b28ec23ee4476bb87a04073146ca49b7211b012da96a571883389b_NeikiAnalytics.exe
2088	9ea6a42367b28ec23ee4476bb87a04073146ca49b7211b012da96a571883389b_NeikiAnalytics.exe
2088	9ea6a42367b28ec23ee4476bb87a04073146ca49b7211b012da96a571883389b_NeikiAnalytics.exe
2088	9ea6a42367b28ec23ee4476bb87a04073146ca49b7211b012da96a571883389b_NeikiAnalytics.exe
2088	9ea6a42367b28ec23ee4476bb87a04073146ca49b7211b012da96a571883389b_NeikiAnalytics.exe
2088	9ea6a42367b28ec23ee4476bb87a04073146ca49b7211b012da96a571883389b_NeikiAnalytics.exe
2088	9ea6a42367b28ec23ee4476bb87a04073146ca49b7211b012da96a571883389b_NeikiAnalytics.exe
2088	9ea6a42367b28ec23ee4476bb87a04073146ca49b7211b012da96a571883389b_NeikiAnalytics.exe
2088	9ea6a42367b28ec23ee4476bb87a04073146ca49b7211b012da96a571883389b_NeikiAnalytics.exe

UPX packed file 56 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2088-0-0x000000013FBE0000-0x000000013FFD2000-memory.dmp	upx
behavioral1/files/0x000a000000015cb1-3.dat	upx
behavioral1/files/0x0031000000015d0a-11.dat	upx
behavioral1/files/0x0007000000015d61-15.dat	upx
behavioral1/files/0x0007000000015d85-19.dat	upx
behavioral1/files/0x0007000000015d9c-20.dat	upx
behavioral1/files/0x0007000000015f23-24.dat	upx
behavioral1/files/0x0007000000016122-33.dat	upx
behavioral1/memory/2536-25-0x000000013F410000-0x000000013F802000-memory.dmp	upx
behavioral1/memory/2636-34-0x000000013F3F0000-0x000000013F7E2000-memory.dmp	upx
behavioral1/memory/2552-38-0x000000013FEC0000-0x00000001402B2000-memory.dmp	upx
behavioral1/memory/2096-45-0x000000013F8B0000-0x000000013FCA2000-memory.dmp	upx
behavioral1/memory/2672-50-0x000000013F8F0000-0x000000013FCE2000-memory.dmp	upx
behavioral1/memory/2864-55-0x000000013F290000-0x000000013F682000-memory.dmp	upx
behavioral1/memory/2696-54-0x000000013FD50000-0x0000000140142000-memory.dmp	upx
behavioral1/memory/1896-62-0x000000013F6F0000-0x000000013FAE2000-memory.dmp	upx
behavioral1/files/0x0030000000015d21-66.dat	upx
behavioral1/memory/1472-70-0x000000013F5C0000-0x000000013F9B2000-memory.dmp	upx
behavioral1/files/0x0007000000016ced-73.dat	upx
behavioral1/memory/2372-77-0x000000013F2A0000-0x000000013F692000-memory.dmp	upx
behavioral1/files/0x0006000000016d06-95.dat	upx
behavioral1/files/0x0006000000016d29-116.dat	upx
behavioral1/files/0x0006000000016d81-123.dat	upx
behavioral1/files/0x0006000000016f7e-138.dat	upx
behavioral1/files/0x000600000001737e-156.dat	upx
behavioral1/memory/2096-353-0x000000013F8B0000-0x000000013FCA2000-memory.dmp	upx
behavioral1/memory/2636-352-0x000000013F3F0000-0x000000013F7E2000-memory.dmp	upx
behavioral1/memory/2088-351-0x000000013FBE0000-0x000000013FFD2000-memory.dmp	upx
behavioral1/files/0x000600000001745d-188.dat	upx
behavioral1/files/0x0006000000017472-186.dat	upx
behavioral1/files/0x00060000000173e7-181.dat	upx
behavioral1/files/0x00060000000173dc-172.dat	upx
behavioral1/files/0x000600000001748d-190.dat	upx
behavioral1/files/0x00060000000173df-176.dat	upx
behavioral1/files/0x000600000001738c-161.dat	upx
behavioral1/files/0x00060000000173c5-165.dat	upx
behavioral1/files/0x000600000001737b-151.dat	upx
behavioral1/files/0x0006000000016da9-135.dat	upx
behavioral1/files/0x0006000000016e56-133.dat	upx
behavioral1/files/0x0006000000016d85-126.dat	upx
behavioral1/files/0x0006000000016d31-121.dat	upx
behavioral1/files/0x0006000000016d21-111.dat	upx
behavioral1/files/0x0006000000016d10-97.dat	upx
behavioral1/memory/2152-90-0x000000013FF50000-0x0000000140342000-memory.dmp	upx
behavioral1/memory/2536-89-0x000000013F410000-0x000000013F802000-memory.dmp	upx
behavioral1/files/0x0006000000016cfd-88.dat	upx
behavioral1/memory/1360-86-0x000000013F100000-0x000000013F4F2000-memory.dmp	upx
behavioral1/files/0x0006000000016d18-103.dat	upx
behavioral1/files/0x0006000000016cf3-80.dat	upx
behavioral1/files/0x0016000000005586-59.dat	upx
behavioral1/memory/2552-703-0x000000013FEC0000-0x00000001402B2000-memory.dmp	upx
behavioral1/memory/1896-1716-0x000000013F6F0000-0x000000013FAE2000-memory.dmp	upx
behavioral1/memory/1360-5362-0x000000013F100000-0x000000013F4F2000-memory.dmp	upx
behavioral1/memory/1360-5408-0x000000013F100000-0x000000013F4F2000-memory.dmp	upx
behavioral1/memory/2152-5414-0x000000013FF50000-0x0000000140342000-memory.dmp	upx
behavioral1/memory/1896-5419-0x000000013F6F0000-0x000000013FAE2000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\aHCHJAA.exe	9ea6a42367b28ec23ee4476bb87a04073146ca49b7211b012da96a571883389b_NeikiAnalytics.exe
File created	C:\Windows\System\cLpeOJp.exe	9ea6a42367b28ec23ee4476bb87a04073146ca49b7211b012da96a571883389b_NeikiAnalytics.exe
File created	C:\Windows\System\UGPyYVA.exe	9ea6a42367b28ec23ee4476bb87a04073146ca49b7211b012da96a571883389b_NeikiAnalytics.exe
File created	C:\Windows\System\kkCMLZD.exe	9ea6a42367b28ec23ee4476bb87a04073146ca49b7211b012da96a571883389b_NeikiAnalytics.exe
File created	C:\Windows\System\SrfCEwf.exe	9ea6a42367b28ec23ee4476bb87a04073146ca49b7211b012da96a571883389b_NeikiAnalytics.exe
File created	C:\Windows\System\eGxEntR.exe	9ea6a42367b28ec23ee4476bb87a04073146ca49b7211b012da96a571883389b_NeikiAnalytics.exe
File created	C:\Windows\System\wGOCOFw.exe	9ea6a42367b28ec23ee4476bb87a04073146ca49b7211b012da96a571883389b_NeikiAnalytics.exe
File created	C:\Windows\System\DWpPEiC.exe	9ea6a42367b28ec23ee4476bb87a04073146ca49b7211b012da96a571883389b_NeikiAnalytics.exe
File created	C:\Windows\System\MDhkYBf.exe	9ea6a42367b28ec23ee4476bb87a04073146ca49b7211b012da96a571883389b_NeikiAnalytics.exe
File created	C:\Windows\System\dAeHFbQ.exe	9ea6a42367b28ec23ee4476bb87a04073146ca49b7211b012da96a571883389b_NeikiAnalytics.exe
File created	C:\Windows\System\AKCKIcY.exe	9ea6a42367b28ec23ee4476bb87a04073146ca49b7211b012da96a571883389b_NeikiAnalytics.exe
File created	C:\Windows\System\oEamzag.exe	9ea6a42367b28ec23ee4476bb87a04073146ca49b7211b012da96a571883389b_NeikiAnalytics.exe
File created	C:\Windows\System\HGJtNSy.exe	9ea6a42367b28ec23ee4476bb87a04073146ca49b7211b012da96a571883389b_NeikiAnalytics.exe
File created	C:\Windows\System\cNDCvvg.exe	9ea6a42367b28ec23ee4476bb87a04073146ca49b7211b012da96a571883389b_NeikiAnalytics.exe
File created	C:\Windows\System\trrmHyD.exe	9ea6a42367b28ec23ee4476bb87a04073146ca49b7211b012da96a571883389b_NeikiAnalytics.exe
File created	C:\Windows\System\hHEbWTg.exe	9ea6a42367b28ec23ee4476bb87a04073146ca49b7211b012da96a571883389b_NeikiAnalytics.exe
File created	C:\Windows\System\xGkgYdC.exe	9ea6a42367b28ec23ee4476bb87a04073146ca49b7211b012da96a571883389b_NeikiAnalytics.exe
File created	C:\Windows\System\jpWUhGH.exe	9ea6a42367b28ec23ee4476bb87a04073146ca49b7211b012da96a571883389b_NeikiAnalytics.exe
File created	C:\Windows\System\ivTnrcV.exe	9ea6a42367b28ec23ee4476bb87a04073146ca49b7211b012da96a571883389b_NeikiAnalytics.exe
File created	C:\Windows\System\NrnQyfD.exe	9ea6a42367b28ec23ee4476bb87a04073146ca49b7211b012da96a571883389b_NeikiAnalytics.exe
File created	C:\Windows\System\IzXbLpm.exe	9ea6a42367b28ec23ee4476bb87a04073146ca49b7211b012da96a571883389b_NeikiAnalytics.exe
File created	C:\Windows\System\dLCYQKr.exe	9ea6a42367b28ec23ee4476bb87a04073146ca49b7211b012da96a571883389b_NeikiAnalytics.exe
File created	C:\Windows\System\CMIsqgk.exe	9ea6a42367b28ec23ee4476bb87a04073146ca49b7211b012da96a571883389b_NeikiAnalytics.exe
File created	C:\Windows\System\LNrhETx.exe	9ea6a42367b28ec23ee4476bb87a04073146ca49b7211b012da96a571883389b_NeikiAnalytics.exe
File created	C:\Windows\System\DSeULJL.exe	9ea6a42367b28ec23ee4476bb87a04073146ca49b7211b012da96a571883389b_NeikiAnalytics.exe
File created	C:\Windows\System\oSSooLc.exe	9ea6a42367b28ec23ee4476bb87a04073146ca49b7211b012da96a571883389b_NeikiAnalytics.exe
File created	C:\Windows\System\pWwtKoD.exe	9ea6a42367b28ec23ee4476bb87a04073146ca49b7211b012da96a571883389b_NeikiAnalytics.exe
File created	C:\Windows\System\lNkRQbo.exe	9ea6a42367b28ec23ee4476bb87a04073146ca49b7211b012da96a571883389b_NeikiAnalytics.exe
File created	C:\Windows\System\obWQOva.exe	9ea6a42367b28ec23ee4476bb87a04073146ca49b7211b012da96a571883389b_NeikiAnalytics.exe
File created	C:\Windows\System\GJtWXCw.exe	9ea6a42367b28ec23ee4476bb87a04073146ca49b7211b012da96a571883389b_NeikiAnalytics.exe
File created	C:\Windows\System\vPKdvTS.exe	9ea6a42367b28ec23ee4476bb87a04073146ca49b7211b012da96a571883389b_NeikiAnalytics.exe
File created	C:\Windows\System\Gapxvqt.exe	9ea6a42367b28ec23ee4476bb87a04073146ca49b7211b012da96a571883389b_NeikiAnalytics.exe
File created	C:\Windows\System\ymGtZTS.exe	9ea6a42367b28ec23ee4476bb87a04073146ca49b7211b012da96a571883389b_NeikiAnalytics.exe
File created	C:\Windows\System\zLXiNQy.exe	9ea6a42367b28ec23ee4476bb87a04073146ca49b7211b012da96a571883389b_NeikiAnalytics.exe
File created	C:\Windows\System\MwayujW.exe	9ea6a42367b28ec23ee4476bb87a04073146ca49b7211b012da96a571883389b_NeikiAnalytics.exe
File created	C:\Windows\System\Amcnkuy.exe	9ea6a42367b28ec23ee4476bb87a04073146ca49b7211b012da96a571883389b_NeikiAnalytics.exe
File created	C:\Windows\System\gSsrxfV.exe	9ea6a42367b28ec23ee4476bb87a04073146ca49b7211b012da96a571883389b_NeikiAnalytics.exe
File created	C:\Windows\System\OIHmzuK.exe	9ea6a42367b28ec23ee4476bb87a04073146ca49b7211b012da96a571883389b_NeikiAnalytics.exe
File created	C:\Windows\System\EvFZqFu.exe	9ea6a42367b28ec23ee4476bb87a04073146ca49b7211b012da96a571883389b_NeikiAnalytics.exe
File created	C:\Windows\System\liXfZcY.exe	9ea6a42367b28ec23ee4476bb87a04073146ca49b7211b012da96a571883389b_NeikiAnalytics.exe
File created	C:\Windows\System\AjySRSC.exe	9ea6a42367b28ec23ee4476bb87a04073146ca49b7211b012da96a571883389b_NeikiAnalytics.exe
File created	C:\Windows\System\YiyTYIT.exe	9ea6a42367b28ec23ee4476bb87a04073146ca49b7211b012da96a571883389b_NeikiAnalytics.exe
File created	C:\Windows\System\hwpwEoc.exe	9ea6a42367b28ec23ee4476bb87a04073146ca49b7211b012da96a571883389b_NeikiAnalytics.exe
File created	C:\Windows\System\rVKmeYK.exe	9ea6a42367b28ec23ee4476bb87a04073146ca49b7211b012da96a571883389b_NeikiAnalytics.exe
File created	C:\Windows\System\rvEJgCK.exe	9ea6a42367b28ec23ee4476bb87a04073146ca49b7211b012da96a571883389b_NeikiAnalytics.exe
File created	C:\Windows\System\EOirlbV.exe	9ea6a42367b28ec23ee4476bb87a04073146ca49b7211b012da96a571883389b_NeikiAnalytics.exe
File created	C:\Windows\System\pQvRkvH.exe	9ea6a42367b28ec23ee4476bb87a04073146ca49b7211b012da96a571883389b_NeikiAnalytics.exe
File created	C:\Windows\System\eRePPIm.exe	9ea6a42367b28ec23ee4476bb87a04073146ca49b7211b012da96a571883389b_NeikiAnalytics.exe
File created	C:\Windows\System\RRDqybW.exe	9ea6a42367b28ec23ee4476bb87a04073146ca49b7211b012da96a571883389b_NeikiAnalytics.exe
File created	C:\Windows\System\bytdtvl.exe	9ea6a42367b28ec23ee4476bb87a04073146ca49b7211b012da96a571883389b_NeikiAnalytics.exe
File created	C:\Windows\System\YlpRQbG.exe	9ea6a42367b28ec23ee4476bb87a04073146ca49b7211b012da96a571883389b_NeikiAnalytics.exe
File created	C:\Windows\System\sjgfosW.exe	9ea6a42367b28ec23ee4476bb87a04073146ca49b7211b012da96a571883389b_NeikiAnalytics.exe
File created	C:\Windows\System\TlcIcKK.exe	9ea6a42367b28ec23ee4476bb87a04073146ca49b7211b012da96a571883389b_NeikiAnalytics.exe
File created	C:\Windows\System\HEGrbZO.exe	9ea6a42367b28ec23ee4476bb87a04073146ca49b7211b012da96a571883389b_NeikiAnalytics.exe
File created	C:\Windows\System\jpGKwTX.exe	9ea6a42367b28ec23ee4476bb87a04073146ca49b7211b012da96a571883389b_NeikiAnalytics.exe
File created	C:\Windows\System\MHLxMzW.exe	9ea6a42367b28ec23ee4476bb87a04073146ca49b7211b012da96a571883389b_NeikiAnalytics.exe
File created	C:\Windows\System\PgphLDc.exe	9ea6a42367b28ec23ee4476bb87a04073146ca49b7211b012da96a571883389b_NeikiAnalytics.exe
File created	C:\Windows\System\Cslzspt.exe	9ea6a42367b28ec23ee4476bb87a04073146ca49b7211b012da96a571883389b_NeikiAnalytics.exe
File created	C:\Windows\System\xSwKiXn.exe	9ea6a42367b28ec23ee4476bb87a04073146ca49b7211b012da96a571883389b_NeikiAnalytics.exe
File created	C:\Windows\System\rOyYlHY.exe	9ea6a42367b28ec23ee4476bb87a04073146ca49b7211b012da96a571883389b_NeikiAnalytics.exe
File created	C:\Windows\System\fpKgXsP.exe	9ea6a42367b28ec23ee4476bb87a04073146ca49b7211b012da96a571883389b_NeikiAnalytics.exe
File created	C:\Windows\System\LZdOBXV.exe	9ea6a42367b28ec23ee4476bb87a04073146ca49b7211b012da96a571883389b_NeikiAnalytics.exe
File created	C:\Windows\System\dZYzmCa.exe	9ea6a42367b28ec23ee4476bb87a04073146ca49b7211b012da96a571883389b_NeikiAnalytics.exe
File created	C:\Windows\System\zzGaEZp.exe	9ea6a42367b28ec23ee4476bb87a04073146ca49b7211b012da96a571883389b_NeikiAnalytics.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1056	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2088	9ea6a42367b28ec23ee4476bb87a04073146ca49b7211b012da96a571883389b_NeikiAnalytics.exe
Token: SeLockMemoryPrivilege	2088	9ea6a42367b28ec23ee4476bb87a04073146ca49b7211b012da96a571883389b_NeikiAnalytics.exe
Token: SeDebugPrivilege	1056	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2088 wrote to memory of 1056	2088	9ea6a42367b28ec23ee4476bb87a04073146ca49b7211b012da96a571883389b_NeikiAnalytics.exe	29
PID 2088 wrote to memory of 1056	2088	9ea6a42367b28ec23ee4476bb87a04073146ca49b7211b012da96a571883389b_NeikiAnalytics.exe	29
PID 2088 wrote to memory of 1056	2088	9ea6a42367b28ec23ee4476bb87a04073146ca49b7211b012da96a571883389b_NeikiAnalytics.exe	29
PID 2088 wrote to memory of 2536	2088	9ea6a42367b28ec23ee4476bb87a04073146ca49b7211b012da96a571883389b_NeikiAnalytics.exe	30
PID 2088 wrote to memory of 2536	2088	9ea6a42367b28ec23ee4476bb87a04073146ca49b7211b012da96a571883389b_NeikiAnalytics.exe	30
PID 2088 wrote to memory of 2536	2088	9ea6a42367b28ec23ee4476bb87a04073146ca49b7211b012da96a571883389b_NeikiAnalytics.exe	30
PID 2088 wrote to memory of 2636	2088	9ea6a42367b28ec23ee4476bb87a04073146ca49b7211b012da96a571883389b_NeikiAnalytics.exe	31
PID 2088 wrote to memory of 2636	2088	9ea6a42367b28ec23ee4476bb87a04073146ca49b7211b012da96a571883389b_NeikiAnalytics.exe	31
PID 2088 wrote to memory of 2636	2088	9ea6a42367b28ec23ee4476bb87a04073146ca49b7211b012da96a571883389b_NeikiAnalytics.exe	31
PID 2088 wrote to memory of 2552	2088	9ea6a42367b28ec23ee4476bb87a04073146ca49b7211b012da96a571883389b_NeikiAnalytics.exe	32
PID 2088 wrote to memory of 2552	2088	9ea6a42367b28ec23ee4476bb87a04073146ca49b7211b012da96a571883389b_NeikiAnalytics.exe	32
PID 2088 wrote to memory of 2552	2088	9ea6a42367b28ec23ee4476bb87a04073146ca49b7211b012da96a571883389b_NeikiAnalytics.exe	32
PID 2088 wrote to memory of 2096	2088	9ea6a42367b28ec23ee4476bb87a04073146ca49b7211b012da96a571883389b_NeikiAnalytics.exe	33
PID 2088 wrote to memory of 2096	2088	9ea6a42367b28ec23ee4476bb87a04073146ca49b7211b012da96a571883389b_NeikiAnalytics.exe	33
PID 2088 wrote to memory of 2096	2088	9ea6a42367b28ec23ee4476bb87a04073146ca49b7211b012da96a571883389b_NeikiAnalytics.exe	33
PID 2088 wrote to memory of 2672	2088	9ea6a42367b28ec23ee4476bb87a04073146ca49b7211b012da96a571883389b_NeikiAnalytics.exe	34
PID 2088 wrote to memory of 2672	2088	9ea6a42367b28ec23ee4476bb87a04073146ca49b7211b012da96a571883389b_NeikiAnalytics.exe	34
PID 2088 wrote to memory of 2672	2088	9ea6a42367b28ec23ee4476bb87a04073146ca49b7211b012da96a571883389b_NeikiAnalytics.exe	34
PID 2088 wrote to memory of 2696	2088	9ea6a42367b28ec23ee4476bb87a04073146ca49b7211b012da96a571883389b_NeikiAnalytics.exe	35
PID 2088 wrote to memory of 2696	2088	9ea6a42367b28ec23ee4476bb87a04073146ca49b7211b012da96a571883389b_NeikiAnalytics.exe	35
PID 2088 wrote to memory of 2696	2088	9ea6a42367b28ec23ee4476bb87a04073146ca49b7211b012da96a571883389b_NeikiAnalytics.exe	35
PID 2088 wrote to memory of 2864	2088	9ea6a42367b28ec23ee4476bb87a04073146ca49b7211b012da96a571883389b_NeikiAnalytics.exe	36
PID 2088 wrote to memory of 2864	2088	9ea6a42367b28ec23ee4476bb87a04073146ca49b7211b012da96a571883389b_NeikiAnalytics.exe	36
PID 2088 wrote to memory of 2864	2088	9ea6a42367b28ec23ee4476bb87a04073146ca49b7211b012da96a571883389b_NeikiAnalytics.exe	36
PID 2088 wrote to memory of 1896	2088	9ea6a42367b28ec23ee4476bb87a04073146ca49b7211b012da96a571883389b_NeikiAnalytics.exe	37
PID 2088 wrote to memory of 1896	2088	9ea6a42367b28ec23ee4476bb87a04073146ca49b7211b012da96a571883389b_NeikiAnalytics.exe	37
PID 2088 wrote to memory of 1896	2088	9ea6a42367b28ec23ee4476bb87a04073146ca49b7211b012da96a571883389b_NeikiAnalytics.exe	37
PID 2088 wrote to memory of 1472	2088	9ea6a42367b28ec23ee4476bb87a04073146ca49b7211b012da96a571883389b_NeikiAnalytics.exe	38
PID 2088 wrote to memory of 1472	2088	9ea6a42367b28ec23ee4476bb87a04073146ca49b7211b012da96a571883389b_NeikiAnalytics.exe	38
PID 2088 wrote to memory of 1472	2088	9ea6a42367b28ec23ee4476bb87a04073146ca49b7211b012da96a571883389b_NeikiAnalytics.exe	38
PID 2088 wrote to memory of 2372	2088	9ea6a42367b28ec23ee4476bb87a04073146ca49b7211b012da96a571883389b_NeikiAnalytics.exe	39
PID 2088 wrote to memory of 2372	2088	9ea6a42367b28ec23ee4476bb87a04073146ca49b7211b012da96a571883389b_NeikiAnalytics.exe	39
PID 2088 wrote to memory of 2372	2088	9ea6a42367b28ec23ee4476bb87a04073146ca49b7211b012da96a571883389b_NeikiAnalytics.exe	39
PID 2088 wrote to memory of 1360	2088	9ea6a42367b28ec23ee4476bb87a04073146ca49b7211b012da96a571883389b_NeikiAnalytics.exe	40
PID 2088 wrote to memory of 1360	2088	9ea6a42367b28ec23ee4476bb87a04073146ca49b7211b012da96a571883389b_NeikiAnalytics.exe	40
PID 2088 wrote to memory of 1360	2088	9ea6a42367b28ec23ee4476bb87a04073146ca49b7211b012da96a571883389b_NeikiAnalytics.exe	40
PID 2088 wrote to memory of 2152	2088	9ea6a42367b28ec23ee4476bb87a04073146ca49b7211b012da96a571883389b_NeikiAnalytics.exe	41
PID 2088 wrote to memory of 2152	2088	9ea6a42367b28ec23ee4476bb87a04073146ca49b7211b012da96a571883389b_NeikiAnalytics.exe	41
PID 2088 wrote to memory of 2152	2088	9ea6a42367b28ec23ee4476bb87a04073146ca49b7211b012da96a571883389b_NeikiAnalytics.exe	41
PID 2088 wrote to memory of 2192	2088	9ea6a42367b28ec23ee4476bb87a04073146ca49b7211b012da96a571883389b_NeikiAnalytics.exe	42
PID 2088 wrote to memory of 2192	2088	9ea6a42367b28ec23ee4476bb87a04073146ca49b7211b012da96a571883389b_NeikiAnalytics.exe	42
PID 2088 wrote to memory of 2192	2088	9ea6a42367b28ec23ee4476bb87a04073146ca49b7211b012da96a571883389b_NeikiAnalytics.exe	42
PID 2088 wrote to memory of 1368	2088	9ea6a42367b28ec23ee4476bb87a04073146ca49b7211b012da96a571883389b_NeikiAnalytics.exe	43
PID 2088 wrote to memory of 1368	2088	9ea6a42367b28ec23ee4476bb87a04073146ca49b7211b012da96a571883389b_NeikiAnalytics.exe	43
PID 2088 wrote to memory of 1368	2088	9ea6a42367b28ec23ee4476bb87a04073146ca49b7211b012da96a571883389b_NeikiAnalytics.exe	43
PID 2088 wrote to memory of 1764	2088	9ea6a42367b28ec23ee4476bb87a04073146ca49b7211b012da96a571883389b_NeikiAnalytics.exe	44
PID 2088 wrote to memory of 1764	2088	9ea6a42367b28ec23ee4476bb87a04073146ca49b7211b012da96a571883389b_NeikiAnalytics.exe	44
PID 2088 wrote to memory of 1764	2088	9ea6a42367b28ec23ee4476bb87a04073146ca49b7211b012da96a571883389b_NeikiAnalytics.exe	44
PID 2088 wrote to memory of 1584	2088	9ea6a42367b28ec23ee4476bb87a04073146ca49b7211b012da96a571883389b_NeikiAnalytics.exe	45
PID 2088 wrote to memory of 1584	2088	9ea6a42367b28ec23ee4476bb87a04073146ca49b7211b012da96a571883389b_NeikiAnalytics.exe	45
PID 2088 wrote to memory of 1584	2088	9ea6a42367b28ec23ee4476bb87a04073146ca49b7211b012da96a571883389b_NeikiAnalytics.exe	45
PID 2088 wrote to memory of 2656	2088	9ea6a42367b28ec23ee4476bb87a04073146ca49b7211b012da96a571883389b_NeikiAnalytics.exe	46
PID 2088 wrote to memory of 2656	2088	9ea6a42367b28ec23ee4476bb87a04073146ca49b7211b012da96a571883389b_NeikiAnalytics.exe	46
PID 2088 wrote to memory of 2656	2088	9ea6a42367b28ec23ee4476bb87a04073146ca49b7211b012da96a571883389b_NeikiAnalytics.exe	46
PID 2088 wrote to memory of 1280	2088	9ea6a42367b28ec23ee4476bb87a04073146ca49b7211b012da96a571883389b_NeikiAnalytics.exe	47
PID 2088 wrote to memory of 1280	2088	9ea6a42367b28ec23ee4476bb87a04073146ca49b7211b012da96a571883389b_NeikiAnalytics.exe	47
PID 2088 wrote to memory of 1280	2088	9ea6a42367b28ec23ee4476bb87a04073146ca49b7211b012da96a571883389b_NeikiAnalytics.exe	47
PID 2088 wrote to memory of 2040	2088	9ea6a42367b28ec23ee4476bb87a04073146ca49b7211b012da96a571883389b_NeikiAnalytics.exe	48
PID 2088 wrote to memory of 2040	2088	9ea6a42367b28ec23ee4476bb87a04073146ca49b7211b012da96a571883389b_NeikiAnalytics.exe	48
PID 2088 wrote to memory of 2040	2088	9ea6a42367b28ec23ee4476bb87a04073146ca49b7211b012da96a571883389b_NeikiAnalytics.exe	48
PID 2088 wrote to memory of 2104	2088	9ea6a42367b28ec23ee4476bb87a04073146ca49b7211b012da96a571883389b_NeikiAnalytics.exe	49
PID 2088 wrote to memory of 2104	2088	9ea6a42367b28ec23ee4476bb87a04073146ca49b7211b012da96a571883389b_NeikiAnalytics.exe	49
PID 2088 wrote to memory of 2104	2088	9ea6a42367b28ec23ee4476bb87a04073146ca49b7211b012da96a571883389b_NeikiAnalytics.exe	49
PID 2088 wrote to memory of 3048	2088	9ea6a42367b28ec23ee4476bb87a04073146ca49b7211b012da96a571883389b_NeikiAnalytics.exe	50

C:\Users\Admin\AppData\Local\Temp\9ea6a42367b28ec23ee4476bb87a04073146ca49b7211b012da96a571883389b_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\9ea6a42367b28ec23ee4476bb87a04073146ca49b7211b012da96a571883389b_NeikiAnalytics.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2088
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1056
- C:\Windows\System\WFGiegs.exe
  C:\Windows\System\WFGiegs.exe
  2⤵
  - Executes dropped EXE
  PID:2536
- C:\Windows\System\ZBzzDpt.exe
  C:\Windows\System\ZBzzDpt.exe
  2⤵
  - Executes dropped EXE
  PID:2636
- C:\Windows\System\fndkylg.exe
  C:\Windows\System\fndkylg.exe
  2⤵
  - Executes dropped EXE
  PID:2552
- C:\Windows\System\TgcYkih.exe
  C:\Windows\System\TgcYkih.exe
  2⤵
  - Executes dropped EXE
  PID:2096
- C:\Windows\System\XxkLLKz.exe
  C:\Windows\System\XxkLLKz.exe
  2⤵
  - Executes dropped EXE
  PID:2672
- C:\Windows\System\bfdTVDA.exe
  C:\Windows\System\bfdTVDA.exe
  2⤵
  - Executes dropped EXE
  PID:2696
- C:\Windows\System\vDQvZhU.exe
  C:\Windows\System\vDQvZhU.exe
  2⤵
  - Executes dropped EXE
  PID:2864
- C:\Windows\System\mlKbBAz.exe
  C:\Windows\System\mlKbBAz.exe
  2⤵
  - Executes dropped EXE
  PID:1896
- C:\Windows\System\ATzOdET.exe
  C:\Windows\System\ATzOdET.exe
  2⤵
  - Executes dropped EXE
  PID:1472
- C:\Windows\System\xfkSnFT.exe
  C:\Windows\System\xfkSnFT.exe
  2⤵
  - Executes dropped EXE
  PID:2372
- C:\Windows\System\jLrrQmm.exe
  C:\Windows\System\jLrrQmm.exe
  2⤵
  - Executes dropped EXE
  PID:1360
- C:\Windows\System\angIqPP.exe
  C:\Windows\System\angIqPP.exe
  2⤵
  - Executes dropped EXE
  PID:2152
- C:\Windows\System\ZFWZgqZ.exe
  C:\Windows\System\ZFWZgqZ.exe
  2⤵
  - Executes dropped EXE
  PID:2192
- C:\Windows\System\RiqHSPp.exe
  C:\Windows\System\RiqHSPp.exe
  2⤵
  - Executes dropped EXE
  PID:1368
- C:\Windows\System\hccyXvn.exe
  C:\Windows\System\hccyXvn.exe
  2⤵
  - Executes dropped EXE
  PID:1764
- C:\Windows\System\kocXOHN.exe
  C:\Windows\System\kocXOHN.exe
  2⤵
  - Executes dropped EXE
  PID:1584
- C:\Windows\System\VAgTAwR.exe
  C:\Windows\System\VAgTAwR.exe
  2⤵
  - Executes dropped EXE
  PID:2656
- C:\Windows\System\GDuulhX.exe
  C:\Windows\System\GDuulhX.exe
  2⤵
  - Executes dropped EXE
  PID:1280
- C:\Windows\System\YNGWyhq.exe
  C:\Windows\System\YNGWyhq.exe
  2⤵
  - Executes dropped EXE
  PID:2040
- C:\Windows\System\SvFoMLH.exe
  C:\Windows\System\SvFoMLH.exe
  2⤵
  - Executes dropped EXE
  PID:2104
- C:\Windows\System\DWUnOOS.exe
  C:\Windows\System\DWUnOOS.exe
  2⤵
  - Executes dropped EXE
  PID:3048
- C:\Windows\System\wIURWDl.exe
  C:\Windows\System\wIURWDl.exe
  2⤵
  - Executes dropped EXE
  PID:2688
- C:\Windows\System\WhnEiDU.exe
  C:\Windows\System\WhnEiDU.exe
  2⤵
  - Executes dropped EXE
  PID:2108
- C:\Windows\System\fxLWGUv.exe
  C:\Windows\System\fxLWGUv.exe
  2⤵
  - Executes dropped EXE
  PID:2120
- C:\Windows\System\JImbxcQ.exe
  C:\Windows\System\JImbxcQ.exe
  2⤵
  - Executes dropped EXE
  PID:600
- C:\Windows\System\cBeAOhz.exe
  C:\Windows\System\cBeAOhz.exe
  2⤵
  - Executes dropped EXE
  PID:796
- C:\Windows\System\tPvFHQk.exe
  C:\Windows\System\tPvFHQk.exe
  2⤵
  - Executes dropped EXE
  PID:1592
- C:\Windows\System\MbFMzJV.exe
  C:\Windows\System\MbFMzJV.exe
  2⤵
  - Executes dropped EXE
  PID:1716
- C:\Windows\System\XzOQXHJ.exe
  C:\Windows\System\XzOQXHJ.exe
  2⤵
  - Executes dropped EXE
  PID:1744
- C:\Windows\System\DTgIUlm.exe
  C:\Windows\System\DTgIUlm.exe
  2⤵
  - Executes dropped EXE
  PID:1480
- C:\Windows\System\pAudgtK.exe
  C:\Windows\System\pAudgtK.exe
  2⤵
  - Executes dropped EXE
  PID:2956
- C:\Windows\System\RdEKWiW.exe
  C:\Windows\System\RdEKWiW.exe
  2⤵
  - Executes dropped EXE
  PID:400
- C:\Windows\System\EPppTtx.exe
  C:\Windows\System\EPppTtx.exe
  2⤵
  - Executes dropped EXE
  PID:2920
- C:\Windows\System\gXzBBUG.exe
  C:\Windows\System\gXzBBUG.exe
  2⤵
  - Executes dropped EXE
  PID:2848
- C:\Windows\System\ZxLZUaQ.exe
  C:\Windows\System\ZxLZUaQ.exe
  2⤵
  - Executes dropped EXE
  PID:932
- C:\Windows\System\cRhjEhG.exe
  C:\Windows\System\cRhjEhG.exe
  2⤵
  - Executes dropped EXE
  PID:1708
- C:\Windows\System\zeKRPni.exe
  C:\Windows\System\zeKRPni.exe
  2⤵
  - Executes dropped EXE
  PID:1308
- C:\Windows\System\cNDSGkn.exe
  C:\Windows\System\cNDSGkn.exe
  2⤵
  - Executes dropped EXE
  PID:1804
- C:\Windows\System\bFLGCFQ.exe
  C:\Windows\System\bFLGCFQ.exe
  2⤵
  - Executes dropped EXE
  PID:2760
- C:\Windows\System\deGkIjG.exe
  C:\Windows\System\deGkIjG.exe
  2⤵
  - Executes dropped EXE
  PID:924
- C:\Windows\System\XpAGCey.exe
  C:\Windows\System\XpAGCey.exe
  2⤵
  - Executes dropped EXE
  PID:3068
- C:\Windows\System\xaCLdTI.exe
  C:\Windows\System\xaCLdTI.exe
  2⤵
  - Executes dropped EXE
  PID:716
- C:\Windows\System\cFLQhZq.exe
  C:\Windows\System\cFLQhZq.exe
  2⤵
  - Executes dropped EXE
  PID:1720
- C:\Windows\System\iEPfEFD.exe
  C:\Windows\System\iEPfEFD.exe
  2⤵
  - Executes dropped EXE
  PID:2676
- C:\Windows\System\fTYoebL.exe
  C:\Windows\System\fTYoebL.exe
  2⤵
  - Executes dropped EXE
  PID:2944
- C:\Windows\System\rVBAXmN.exe
  C:\Windows\System\rVBAXmN.exe
  2⤵
  - Executes dropped EXE
  PID:1964
- C:\Windows\System\YlwZilb.exe
  C:\Windows\System\YlwZilb.exe
  2⤵
  - Executes dropped EXE
  PID:1012
- C:\Windows\System\qCshFaZ.exe
  C:\Windows\System\qCshFaZ.exe
  2⤵
  - Executes dropped EXE
  PID:2032
- C:\Windows\System\kMXkAfG.exe
  C:\Windows\System\kMXkAfG.exe
  2⤵
  - Executes dropped EXE
  PID:1556
- C:\Windows\System\ILvApfv.exe
  C:\Windows\System\ILvApfv.exe
  2⤵
  - Executes dropped EXE
  PID:1916
- C:\Windows\System\gzUEsmp.exe
  C:\Windows\System\gzUEsmp.exe
  2⤵
  - Executes dropped EXE
  PID:2776
- C:\Windows\System\MQzunBx.exe
  C:\Windows\System\MQzunBx.exe
  2⤵
  - Executes dropped EXE
  PID:1552
- C:\Windows\System\FrpPAoH.exe
  C:\Windows\System\FrpPAoH.exe
  2⤵
  - Executes dropped EXE
  PID:2680
- C:\Windows\System\NsmxZnw.exe
  C:\Windows\System\NsmxZnw.exe
  2⤵
  - Executes dropped EXE
  PID:2596
- C:\Windows\System\fAYZOjQ.exe
  C:\Windows\System\fAYZOjQ.exe
  2⤵
  - Executes dropped EXE
  PID:2528
- C:\Windows\System\zNvYoaR.exe
  C:\Windows\System\zNvYoaR.exe
  2⤵
  - Executes dropped EXE
  PID:2996
- C:\Windows\System\rxKqadR.exe
  C:\Windows\System\rxKqadR.exe
  2⤵
  - Executes dropped EXE
  PID:2532
- C:\Windows\System\oPTFqKd.exe
  C:\Windows\System\oPTFqKd.exe
  2⤵
  - Executes dropped EXE
  PID:2580
- C:\Windows\System\ikGrKPx.exe
  C:\Windows\System\ikGrKPx.exe
  2⤵
  - Executes dropped EXE
  PID:2712
- C:\Windows\System\IIDVefz.exe
  C:\Windows\System\IIDVefz.exe
  2⤵
  - Executes dropped EXE
  PID:2420
- C:\Windows\System\CfMTELu.exe
  C:\Windows\System\CfMTELu.exe
  2⤵
  - Executes dropped EXE
  PID:2456
- C:\Windows\System\akkyOSf.exe
  C:\Windows\System\akkyOSf.exe
  2⤵
  - Executes dropped EXE
  PID:1656
- C:\Windows\System\RfWyVtK.exe
  C:\Windows\System\RfWyVtK.exe
  2⤵
  - Executes dropped EXE
  PID:1860
- C:\Windows\System\JcXiYps.exe
  C:\Windows\System\JcXiYps.exe
  2⤵
  - Executes dropped EXE
  PID:2308
- C:\Windows\System\ZjWxVBK.exe
  C:\Windows\System\ZjWxVBK.exe
  2⤵
  PID:680
- C:\Windows\System\AbhgWeO.exe
  C:\Windows\System\AbhgWeO.exe
  2⤵
  PID:2184
- C:\Windows\System\XNdrlOe.exe
  C:\Windows\System\XNdrlOe.exe
  2⤵
  PID:1252
- C:\Windows\System\qEvrdpH.exe
  C:\Windows\System\qEvrdpH.exe
  2⤵
  PID:272
- C:\Windows\System\HQHItHA.exe
  C:\Windows\System\HQHItHA.exe
  2⤵
  PID:2496
- C:\Windows\System\HEqRwAu.exe
  C:\Windows\System\HEqRwAu.exe
  2⤵
  PID:2204
- C:\Windows\System\xcTijpk.exe
  C:\Windows\System\xcTijpk.exe
  2⤵
  PID:2132
- C:\Windows\System\DApRnfp.exe
  C:\Windows\System\DApRnfp.exe
  2⤵
  PID:2044
- C:\Windows\System\qXMQpDP.exe
  C:\Windows\System\qXMQpDP.exe
  2⤵
  PID:2692
- C:\Windows\System\yQOOgog.exe
  C:\Windows\System\yQOOgog.exe
  2⤵
  PID:700
- C:\Windows\System\nVjyUnr.exe
  C:\Windows\System\nVjyUnr.exe
  2⤵
  PID:1412
- C:\Windows\System\ATQpLWG.exe
  C:\Windows\System\ATQpLWG.exe
  2⤵
  PID:2860
- C:\Windows\System\YLgcWDk.exe
  C:\Windows\System\YLgcWDk.exe
  2⤵
  PID:2384
- C:\Windows\System\HosDlBz.exe
  C:\Windows\System\HosDlBz.exe
  2⤵
  PID:240
- C:\Windows\System\kazfnMG.exe
  C:\Windows\System\kazfnMG.exe
  2⤵
  PID:820
- C:\Windows\System\jQxmYQF.exe
  C:\Windows\System\jQxmYQF.exe
  2⤵
  PID:576
- C:\Windows\System\nIbEdAy.exe
  C:\Windows\System\nIbEdAy.exe
  2⤵
  PID:984
- C:\Windows\System\rECeLqU.exe
  C:\Windows\System\rECeLqU.exe
  2⤵
  PID:2764
- C:\Windows\System\MQVivsW.exe
  C:\Windows\System\MQVivsW.exe
  2⤵
  PID:852
- C:\Windows\System\eMJMtzh.exe
  C:\Windows\System\eMJMtzh.exe
  2⤵
  PID:2000
- C:\Windows\System\gcguXyi.exe
  C:\Windows\System\gcguXyi.exe
  2⤵
  PID:2136
- C:\Windows\System\zsNVOjl.exe
  C:\Windows\System\zsNVOjl.exe
  2⤵
  PID:2064
- C:\Windows\System\YSLDzrH.exe
  C:\Windows\System\YSLDzrH.exe
  2⤵
  PID:1976
- C:\Windows\System\dbjvkvK.exe
  C:\Windows\System\dbjvkvK.exe
  2⤵
  PID:2332
- C:\Windows\System\HsnxzLC.exe
  C:\Windows\System\HsnxzLC.exe
  2⤵
  PID:3052
- C:\Windows\System\LmXTAdC.exe
  C:\Windows\System\LmXTAdC.exe
  2⤵
  PID:2648
- C:\Windows\System\wFObAqj.exe
  C:\Windows\System\wFObAqj.exe
  2⤵
  PID:2564
- C:\Windows\System\GDlEWsz.exe
  C:\Windows\System\GDlEWsz.exe
  2⤵
  PID:896
- C:\Windows\System\wwCutMM.exe
  C:\Windows\System\wwCutMM.exe
  2⤵
  PID:2644
- C:\Windows\System\apKUxEj.exe
  C:\Windows\System\apKUxEj.exe
  2⤵
  PID:2172
- C:\Windows\System\jQJNeMT.exe
  C:\Windows\System\jQJNeMT.exe
  2⤵
  PID:3016
- C:\Windows\System\FoSTTGh.exe
  C:\Windows\System\FoSTTGh.exe
  2⤵
  PID:1432
- C:\Windows\System\LYBeIbJ.exe
  C:\Windows\System\LYBeIbJ.exe
  2⤵
  PID:2788
- C:\Windows\System\JWadSSS.exe
  C:\Windows\System\JWadSSS.exe
  2⤵
  PID:1604
- C:\Windows\System\OLQAlVI.exe
  C:\Windows\System\OLQAlVI.exe
  2⤵
  PID:1276
- C:\Windows\System\nlJtWwG.exe
  C:\Windows\System\nlJtWwG.exe
  2⤵
  PID:632
- C:\Windows\System\SwMzQlH.exe
  C:\Windows\System\SwMzQlH.exe
  2⤵
  PID:1784
- C:\Windows\System\oJpdSCq.exe
  C:\Windows\System\oJpdSCq.exe
  2⤵
  PID:2304
- C:\Windows\System\bBFmLIU.exe
  C:\Windows\System\bBFmLIU.exe
  2⤵
  PID:1428
- C:\Windows\System\DOWtcEK.exe
  C:\Windows\System\DOWtcEK.exe
  2⤵
  PID:740
- C:\Windows\System\jDYRRsJ.exe
  C:\Windows\System\jDYRRsJ.exe
  2⤵
  PID:2736
- C:\Windows\System\YRLYCaJ.exe
  C:\Windows\System\YRLYCaJ.exe
  2⤵
  PID:804
- C:\Windows\System\vSfIWin.exe
  C:\Windows\System\vSfIWin.exe
  2⤵
  PID:1260
- C:\Windows\System\eySgcjV.exe
  C:\Windows\System\eySgcjV.exe
  2⤵
  PID:1236
- C:\Windows\System\CiomiKd.exe
  C:\Windows\System\CiomiKd.exe
  2⤵
  PID:2168
- C:\Windows\System\npOFJzC.exe
  C:\Windows\System\npOFJzC.exe
  2⤵
  PID:1444
- C:\Windows\System\PublEzL.exe
  C:\Windows\System\PublEzL.exe
  2⤵
  PID:2720
- C:\Windows\System\kSImSXh.exe
  C:\Windows\System\kSImSXh.exe
  2⤵
  PID:2756
- C:\Windows\System\qMXkhUw.exe
  C:\Windows\System\qMXkhUw.exe
  2⤵
  PID:1540
- C:\Windows\System\iufgPKr.exe
  C:\Windows\System\iufgPKr.exe
  2⤵
  PID:1648
- C:\Windows\System\tWNLXzc.exe
  C:\Windows\System\tWNLXzc.exe
  2⤵
  PID:2856
- C:\Windows\System\IloUBKt.exe
  C:\Windows\System\IloUBKt.exe
  2⤵
  PID:2668
- C:\Windows\System\EgAfdMo.exe
  C:\Windows\System\EgAfdMo.exe
  2⤵
  PID:2980
- C:\Windows\System\pIEjScd.exe
  C:\Windows\System\pIEjScd.exe
  2⤵
  PID:2616
- C:\Windows\System\bbqACOf.exe
  C:\Windows\System\bbqACOf.exe
  2⤵
  PID:1028
- C:\Windows\System\vwUvMzK.exe
  C:\Windows\System\vwUvMzK.exe
  2⤵
  PID:2188
- C:\Windows\System\crGELjP.exe
  C:\Windows\System\crGELjP.exe
  2⤵
  PID:2176
- C:\Windows\System\mPLyDWQ.exe
  C:\Windows\System\mPLyDWQ.exe
  2⤵
  PID:2492
- C:\Windows\System\AFILzRE.exe
  C:\Windows\System\AFILzRE.exe
  2⤵
  PID:2752
- C:\Windows\System\AxnlsFM.exe
  C:\Windows\System\AxnlsFM.exe
  2⤵
  PID:2768
- C:\Windows\System\suGlkhY.exe
  C:\Windows\System\suGlkhY.exe
  2⤵
  PID:2068
- C:\Windows\System\OjZKzjT.exe
  C:\Windows\System\OjZKzjT.exe
  2⤵
  PID:2724
- C:\Windows\System\zMBwMCF.exe
  C:\Windows\System\zMBwMCF.exe
  2⤵
  PID:2444
- C:\Windows\System\QqgVkxs.exe
  C:\Windows\System\QqgVkxs.exe
  2⤵
  PID:1524
- C:\Windows\System\AEvwDTY.exe
  C:\Windows\System\AEvwDTY.exe
  2⤵
  PID:780
- C:\Windows\System\CTNEdip.exe
  C:\Windows\System\CTNEdip.exe
  2⤵
  PID:2936
- C:\Windows\System\VkYJkfR.exe
  C:\Windows\System\VkYJkfR.exe
  2⤵
  PID:2868
- C:\Windows\System\aoIrUCp.exe
  C:\Windows\System\aoIrUCp.exe
  2⤵
  PID:628
- C:\Windows\System\RtCHOUh.exe
  C:\Windows\System\RtCHOUh.exe
  2⤵
  PID:2256
- C:\Windows\System\jghbJqP.exe
  C:\Windows\System\jghbJqP.exe
  2⤵
  PID:2832
- C:\Windows\System\GOAWXTY.exe
  C:\Windows\System\GOAWXTY.exe
  2⤵
  PID:2716
- C:\Windows\System\OBLVJFl.exe
  C:\Windows\System\OBLVJFl.exe
  2⤵
  PID:2684
- C:\Windows\System\YeWoHcd.exe
  C:\Windows\System\YeWoHcd.exe
  2⤵
  PID:2060
- C:\Windows\System\kSLQMrD.exe
  C:\Windows\System\kSLQMrD.exe
  2⤵
  PID:2896
- C:\Windows\System\SUWnVoK.exe
  C:\Windows\System\SUWnVoK.exe
  2⤵
  PID:2732
- C:\Windows\System\amKTOes.exe
  C:\Windows\System\amKTOes.exe
  2⤵
  PID:2320
- C:\Windows\System\dnBWlnM.exe
  C:\Windows\System\dnBWlnM.exe
  2⤵
  PID:2232
- C:\Windows\System\SRDsyov.exe
  C:\Windows\System\SRDsyov.exe
  2⤵
  PID:2968
- C:\Windows\System\LnIJeig.exe
  C:\Windows\System\LnIJeig.exe
  2⤵
  PID:2824
- C:\Windows\System\ADNANlO.exe
  C:\Windows\System\ADNANlO.exe
  2⤵
  PID:1508
- C:\Windows\System\lgvOQth.exe
  C:\Windows\System\lgvOQth.exe
  2⤵
  PID:2548
- C:\Windows\System\HfIdXCz.exe
  C:\Windows\System\HfIdXCz.exe
  2⤵
  PID:1636
- C:\Windows\System\KFEQcuH.exe
  C:\Windows\System\KFEQcuH.exe
  2⤵
  PID:1800
- C:\Windows\System\vdPonND.exe
  C:\Windows\System\vdPonND.exe
  2⤵
  PID:1460
- C:\Windows\System\yvXXDCn.exe
  C:\Windows\System\yvXXDCn.exe
  2⤵
  PID:1664
- C:\Windows\System\SzLZxlU.exe
  C:\Windows\System\SzLZxlU.exe
  2⤵
  PID:1700
- C:\Windows\System\OXgiapF.exe
  C:\Windows\System\OXgiapF.exe
  2⤵
  PID:3000
- C:\Windows\System\tnjueiF.exe
  C:\Windows\System\tnjueiF.exe
  2⤵
  PID:344
- C:\Windows\System\dfmfHYs.exe
  C:\Windows\System\dfmfHYs.exe
  2⤵
  PID:1208
- C:\Windows\System\MBzpdhN.exe
  C:\Windows\System\MBzpdhN.exe
  2⤵
  PID:2912
- C:\Windows\System\xwYgmsC.exe
  C:\Windows\System\xwYgmsC.exe
  2⤵
  PID:2640
- C:\Windows\System\AqPNklD.exe
  C:\Windows\System\AqPNklD.exe
  2⤵
  PID:288
- C:\Windows\System\azBjHAJ.exe
  C:\Windows\System\azBjHAJ.exe
  2⤵
  PID:324
- C:\Windows\System\AXxIkoy.exe
  C:\Windows\System\AXxIkoy.exe
  2⤵
  PID:3004
- C:\Windows\System\xNUZnOL.exe
  C:\Windows\System\xNUZnOL.exe
  2⤵
  PID:2272
- C:\Windows\System\axrzzSl.exe
  C:\Windows\System\axrzzSl.exe
  2⤵
  PID:920
- C:\Windows\System\WFjUqeQ.exe
  C:\Windows\System\WFjUqeQ.exe
  2⤵
  PID:1416
- C:\Windows\System\YiwtTNn.exe
  C:\Windows\System\YiwtTNn.exe
  2⤵
  PID:1052
- C:\Windows\System\NHlRbPd.exe
  C:\Windows\System\NHlRbPd.exe
  2⤵
  PID:292
- C:\Windows\System\aJirOSh.exe
  C:\Windows\System\aJirOSh.exe
  2⤵
  PID:2348
- C:\Windows\System\rrKsuJu.exe
  C:\Windows\System\rrKsuJu.exe
  2⤵
  PID:1688
- C:\Windows\System\EpIWEAl.exe
  C:\Windows\System\EpIWEAl.exe
  2⤵
  PID:1988
- C:\Windows\System\HMFHTcj.exe
  C:\Windows\System\HMFHTcj.exe
  2⤵
  PID:3084
- C:\Windows\System\fcOlwkc.exe
  C:\Windows\System\fcOlwkc.exe
  2⤵
  PID:3100
- C:\Windows\System\cogBWTn.exe
  C:\Windows\System\cogBWTn.exe
  2⤵
  PID:3120
- C:\Windows\System\CywHntA.exe
  C:\Windows\System\CywHntA.exe
  2⤵
  PID:3136
- C:\Windows\System\YMtTufu.exe
  C:\Windows\System\YMtTufu.exe
  2⤵
  PID:3152
- C:\Windows\System\ePmiibC.exe
  C:\Windows\System\ePmiibC.exe
  2⤵
  PID:3168
- C:\Windows\System\ArDYujb.exe
  C:\Windows\System\ArDYujb.exe
  2⤵
  PID:3184
- C:\Windows\System\MwHWMJm.exe
  C:\Windows\System\MwHWMJm.exe
  2⤵
  PID:3204
- C:\Windows\System\icwtrKP.exe
  C:\Windows\System\icwtrKP.exe
  2⤵
  PID:3220
- C:\Windows\System\kbbBorz.exe
  C:\Windows\System\kbbBorz.exe
  2⤵
  PID:3236
- C:\Windows\System\UcjwqbF.exe
  C:\Windows\System\UcjwqbF.exe
  2⤵
  PID:3252
- C:\Windows\System\SqnSQUc.exe
  C:\Windows\System\SqnSQUc.exe
  2⤵
  PID:3268
- C:\Windows\System\EwBFjrz.exe
  C:\Windows\System\EwBFjrz.exe
  2⤵
  PID:3284
- C:\Windows\System\xBWnIRw.exe
  C:\Windows\System\xBWnIRw.exe
  2⤵
  PID:3300
- C:\Windows\System\eaDGuXi.exe
  C:\Windows\System\eaDGuXi.exe
  2⤵
  PID:3316
- C:\Windows\System\obyGSeF.exe
  C:\Windows\System\obyGSeF.exe
  2⤵
  PID:3332
- C:\Windows\System\vGyDPvY.exe
  C:\Windows\System\vGyDPvY.exe
  2⤵
  PID:3348
- C:\Windows\System\YxNuMsY.exe
  C:\Windows\System\YxNuMsY.exe
  2⤵
  PID:3364
- C:\Windows\System\sMLzTTs.exe
  C:\Windows\System\sMLzTTs.exe
  2⤵
  PID:3380
- C:\Windows\System\GYrVFWZ.exe
  C:\Windows\System\GYrVFWZ.exe
  2⤵
  PID:3396
- C:\Windows\System\QTqltmJ.exe
  C:\Windows\System\QTqltmJ.exe
  2⤵
  PID:3412
- C:\Windows\System\omfCFpo.exe
  C:\Windows\System\omfCFpo.exe
  2⤵
  PID:3428
- C:\Windows\System\HBrpgHH.exe
  C:\Windows\System\HBrpgHH.exe
  2⤵
  PID:3444
- C:\Windows\System\TjTilSW.exe
  C:\Windows\System\TjTilSW.exe
  2⤵
  PID:3460
- C:\Windows\System\poJGqoG.exe
  C:\Windows\System\poJGqoG.exe
  2⤵
  PID:3476
- C:\Windows\System\UKxWBFU.exe
  C:\Windows\System\UKxWBFU.exe
  2⤵
  PID:3492
- C:\Windows\System\ftZBOPx.exe
  C:\Windows\System\ftZBOPx.exe
  2⤵
  PID:3508
- C:\Windows\System\WIdjYmo.exe
  C:\Windows\System\WIdjYmo.exe
  2⤵
  PID:3524
- C:\Windows\System\OdSWIPR.exe
  C:\Windows\System\OdSWIPR.exe
  2⤵
  PID:3540
- C:\Windows\System\NHJQBMy.exe
  C:\Windows\System\NHJQBMy.exe
  2⤵
  PID:3560
- C:\Windows\System\FrjNwUc.exe
  C:\Windows\System\FrjNwUc.exe
  2⤵
  PID:3576
- C:\Windows\System\ocMiMiI.exe
  C:\Windows\System\ocMiMiI.exe
  2⤵
  PID:3612
- C:\Windows\System\MjmXyCK.exe
  C:\Windows\System\MjmXyCK.exe
  2⤵
  PID:3660
- C:\Windows\System\fDXMoIl.exe
  C:\Windows\System\fDXMoIl.exe
  2⤵
  PID:3712
- C:\Windows\System\rleMfeL.exe
  C:\Windows\System\rleMfeL.exe
  2⤵
  PID:3728
- C:\Windows\System\JePBxWW.exe
  C:\Windows\System\JePBxWW.exe
  2⤵
  PID:3752
- C:\Windows\System\XlQzCAl.exe
  C:\Windows\System\XlQzCAl.exe
  2⤵
  PID:3788
- C:\Windows\System\ItclDkQ.exe
  C:\Windows\System\ItclDkQ.exe
  2⤵
  PID:3848
- C:\Windows\System\EgGfvvi.exe
  C:\Windows\System\EgGfvvi.exe
  2⤵
  PID:3900
- C:\Windows\System\JaDaoJH.exe
  C:\Windows\System\JaDaoJH.exe
  2⤵
  PID:3936
- C:\Windows\System\mYBMbed.exe
  C:\Windows\System\mYBMbed.exe
  2⤵
  PID:3956
- C:\Windows\System\XXUdvGY.exe
  C:\Windows\System\XXUdvGY.exe
  2⤵
  PID:3976
- C:\Windows\System\zgAxtVc.exe
  C:\Windows\System\zgAxtVc.exe
  2⤵
  PID:3996
- C:\Windows\System\dApfmaP.exe
  C:\Windows\System\dApfmaP.exe
  2⤵
  PID:4016
- C:\Windows\System\CDOFykh.exe
  C:\Windows\System\CDOFykh.exe
  2⤵
  PID:4036
- C:\Windows\System\zNWNIBL.exe
  C:\Windows\System\zNWNIBL.exe
  2⤵
  PID:4056
- C:\Windows\System\XYVzUBl.exe
  C:\Windows\System\XYVzUBl.exe
  2⤵
  PID:4076
- C:\Windows\System\eyCaGkm.exe
  C:\Windows\System\eyCaGkm.exe
  2⤵
  PID:1536
- C:\Windows\System\IkjqHdG.exe
  C:\Windows\System\IkjqHdG.exe
  2⤵
  PID:608
- C:\Windows\System\sBpjBkG.exe
  C:\Windows\System\sBpjBkG.exe
  2⤵
  PID:1920
- C:\Windows\System\QORHOXc.exe
  C:\Windows\System\QORHOXc.exe
  2⤵
  PID:3076
- C:\Windows\System\vNeCrwe.exe
  C:\Windows\System\vNeCrwe.exe
  2⤵
  PID:3148
- C:\Windows\System\wCZcktn.exe
  C:\Windows\System\wCZcktn.exe
  2⤵
  PID:3180
- C:\Windows\System\KJembsL.exe
  C:\Windows\System\KJembsL.exe
  2⤵
  PID:2876
- C:\Windows\System\XQXzRDy.exe
  C:\Windows\System\XQXzRDy.exe
  2⤵
  PID:3092
- C:\Windows\System\LIaJVxR.exe
  C:\Windows\System\LIaJVxR.exe
  2⤵
  PID:3192
- C:\Windows\System\nZdVBNO.exe
  C:\Windows\System\nZdVBNO.exe
  2⤵
  PID:3260
- C:\Windows\System\CMCpQSO.exe
  C:\Windows\System\CMCpQSO.exe
  2⤵
  PID:3328
- C:\Windows\System\GaRXDCf.exe
  C:\Windows\System\GaRXDCf.exe
  2⤵
  PID:3392
- C:\Windows\System\hARrISR.exe
  C:\Windows\System\hARrISR.exe
  2⤵
  PID:3516
- C:\Windows\System\TtQwwdo.exe
  C:\Windows\System\TtQwwdo.exe
  2⤵
  PID:3556
- C:\Windows\System\GwcCQNz.exe
  C:\Windows\System\GwcCQNz.exe
  2⤵
  PID:3604
- C:\Windows\System\KAnjMKx.exe
  C:\Windows\System\KAnjMKx.exe
  2⤵
  PID:3500
- C:\Windows\System\lFkHxBP.exe
  C:\Windows\System\lFkHxBP.exe
  2⤵
  PID:3568
- C:\Windows\System\HWxkMaZ.exe
  C:\Windows\System\HWxkMaZ.exe
  2⤵
  PID:1600
- C:\Windows\System\hfMfhIk.exe
  C:\Windows\System\hfMfhIk.exe
  2⤵
  PID:1892
- C:\Windows\System\oVGtVYc.exe
  C:\Windows\System\oVGtVYc.exe
  2⤵
  PID:2608
- C:\Windows\System\lNkRQbo.exe
  C:\Windows\System\lNkRQbo.exe
  2⤵
  PID:2624
- C:\Windows\System\YXnMvfy.exe
  C:\Windows\System\YXnMvfy.exe
  2⤵
  PID:3312
- C:\Windows\System\TQfYzAH.exe
  C:\Windows\System\TQfYzAH.exe
  2⤵
  PID:3408
- C:\Windows\System\tZFICRL.exe
  C:\Windows\System\tZFICRL.exe
  2⤵
  PID:3468
- C:\Windows\System\ZniQOpK.exe
  C:\Windows\System\ZniQOpK.exe
  2⤵
  PID:2312
- C:\Windows\System\mZWexaW.exe
  C:\Windows\System\mZWexaW.exe
  2⤵
  PID:3700
- C:\Windows\System\LKqTKUR.exe
  C:\Windows\System\LKqTKUR.exe
  2⤵
  PID:3692
- C:\Windows\System\HYdlwjC.exe
  C:\Windows\System\HYdlwjC.exe
  2⤵
  PID:3720
- C:\Windows\System\FDWfJpT.exe
  C:\Windows\System\FDWfJpT.exe
  2⤵
  PID:3740
- C:\Windows\System\WftJajo.exe
  C:\Windows\System\WftJajo.exe
  2⤵
  PID:3772
- C:\Windows\System\dVOyGOC.exe
  C:\Windows\System\dVOyGOC.exe
  2⤵
  PID:3764
- C:\Windows\System\tlJDXbg.exe
  C:\Windows\System\tlJDXbg.exe
  2⤵
  PID:3828
- C:\Windows\System\MqhNAah.exe
  C:\Windows\System\MqhNAah.exe
  2⤵
  PID:3884
- C:\Windows\System\DhzLfSp.exe
  C:\Windows\System\DhzLfSp.exe
  2⤵
  PID:3836
- C:\Windows\System\EvWPdQP.exe
  C:\Windows\System\EvWPdQP.exe
  2⤵
  PID:3892
- C:\Windows\System\BtxjVUE.exe
  C:\Windows\System\BtxjVUE.exe
  2⤵
  PID:3920
- C:\Windows\System\IbZvnZS.exe
  C:\Windows\System\IbZvnZS.exe
  2⤵
  PID:3932
- C:\Windows\System\WbqiDLG.exe
  C:\Windows\System\WbqiDLG.exe
  2⤵
  PID:3964
- C:\Windows\System\AXIQsiH.exe
  C:\Windows\System\AXIQsiH.exe
  2⤵
  PID:3984
- C:\Windows\System\FXvUwQz.exe
  C:\Windows\System\FXvUwQz.exe
  2⤵
  PID:4012
- C:\Windows\System\UOajdiI.exe
  C:\Windows\System\UOajdiI.exe
  2⤵
  PID:4044
- C:\Windows\System\jnmVNQm.exe
  C:\Windows\System\jnmVNQm.exe
  2⤵
  PID:4072
- C:\Windows\System\DrYJJIe.exe
  C:\Windows\System\DrYJJIe.exe
  2⤵
  PID:1760
- C:\Windows\System\yFEmIgF.exe
  C:\Windows\System\yFEmIgF.exe
  2⤵
  PID:1152
- C:\Windows\System\RrrwoOB.exe
  C:\Windows\System\RrrwoOB.exe
  2⤵
  PID:968
- C:\Windows\System\BvLxHbK.exe
  C:\Windows\System\BvLxHbK.exe
  2⤵
  PID:3144
- C:\Windows\System\luYmkIe.exe
  C:\Windows\System\luYmkIe.exe
  2⤵
  PID:3216
- C:\Windows\System\DvQOXxF.exe
  C:\Windows\System\DvQOXxF.exe
  2⤵
  PID:1852
- C:\Windows\System\McZJmrj.exe
  C:\Windows\System\McZJmrj.exe
  2⤵
  PID:3200
- C:\Windows\System\urdAevk.exe
  C:\Windows\System\urdAevk.exe
  2⤵
  PID:3324
- C:\Windows\System\OPHiyqv.exe
  C:\Windows\System\OPHiyqv.exe
  2⤵
  PID:3452
- C:\Windows\System\RkuhdOD.exe
  C:\Windows\System\RkuhdOD.exe
  2⤵
  PID:3548
- C:\Windows\System\rXyQKAn.exe
  C:\Windows\System\rXyQKAn.exe
  2⤵
  PID:3592
- C:\Windows\System\ZzqWOId.exe
  C:\Windows\System\ZzqWOId.exe
  2⤵
  PID:1144
- C:\Windows\System\usQjeYc.exe
  C:\Windows\System\usQjeYc.exe
  2⤵
  PID:3628
- C:\Windows\System\RTOupyU.exe
  C:\Windows\System\RTOupyU.exe
  2⤵
  PID:3160
- C:\Windows\System\krowVAq.exe
  C:\Windows\System\krowVAq.exe
  2⤵
  PID:2016
- C:\Windows\System\BRbfynd.exe
  C:\Windows\System\BRbfynd.exe
  2⤵
  PID:3280
- C:\Windows\System\MVWEJeP.exe
  C:\Windows\System\MVWEJeP.exe
  2⤵
  PID:3372
- C:\Windows\System\mUbEpxy.exe
  C:\Windows\System\mUbEpxy.exe
  2⤵
  PID:3624
- C:\Windows\System\wfCXRew.exe
  C:\Windows\System\wfCXRew.exe
  2⤵
  PID:3680
- C:\Windows\System\EvjljiJ.exe
  C:\Windows\System\EvjljiJ.exe
  2⤵
  PID:3672
- C:\Windows\System\HpmSSaX.exe
  C:\Windows\System\HpmSSaX.exe
  2⤵
  PID:3744
- C:\Windows\System\JWqWyEA.exe
  C:\Windows\System\JWqWyEA.exe
  2⤵
  PID:3796
- C:\Windows\System\VZezdtD.exe
  C:\Windows\System\VZezdtD.exe
  2⤵
  PID:3456
- C:\Windows\System\yBKjSuC.exe
  C:\Windows\System\yBKjSuC.exe
  2⤵
  PID:3532
- C:\Windows\System\ZcfAnmg.exe
  C:\Windows\System\ZcfAnmg.exe
  2⤵
  PID:3644
- C:\Windows\System\PcGfPrD.exe
  C:\Windows\System\PcGfPrD.exe
  2⤵
  PID:3812
- C:\Windows\System\sngtZIQ.exe
  C:\Windows\System\sngtZIQ.exe
  2⤵
  PID:3972
- C:\Windows\System\ZcdOWql.exe
  C:\Windows\System\ZcdOWql.exe
  2⤵
  PID:3896
- C:\Windows\System\xgCUpgq.exe
  C:\Windows\System\xgCUpgq.exe
  2⤵
  PID:3116
- C:\Windows\System\hihRUaN.exe
  C:\Windows\System\hihRUaN.exe
  2⤵
  PID:4024
- C:\Windows\System\OYvKpYH.exe
  C:\Windows\System\OYvKpYH.exe
  2⤵
  PID:1848
- C:\Windows\System\pMqfGKM.exe
  C:\Windows\System\pMqfGKM.exe
  2⤵
  PID:3176
- C:\Windows\System\fwhiJFk.exe
  C:\Windows\System\fwhiJFk.exe
  2⤵
  PID:1448
- C:\Windows\System\FapWqpM.exe
  C:\Windows\System\FapWqpM.exe
  2⤵
  PID:3868
- C:\Windows\System\JoCMeQQ.exe
  C:\Windows\System\JoCMeQQ.exe
  2⤵
  PID:3952
- C:\Windows\System\nsjXmrk.exe
  C:\Windows\System\nsjXmrk.exe
  2⤵
  PID:580
- C:\Windows\System\hfXysyB.exe
  C:\Windows\System\hfXysyB.exe
  2⤵
  PID:2924
- C:\Windows\System\LHTynWS.exe
  C:\Windows\System\LHTynWS.exe
  2⤵
  PID:4004
- C:\Windows\System\WFlVLPs.exe
  C:\Windows\System\WFlVLPs.exe
  2⤵
  PID:3244
- C:\Windows\System\jJfJIGG.exe
  C:\Windows\System\jJfJIGG.exe
  2⤵
  PID:3404
- C:\Windows\System\SzOAFsM.exe
  C:\Windows\System\SzOAFsM.exe
  2⤵
  PID:3472
- C:\Windows\System\dpmCaTk.exe
  C:\Windows\System\dpmCaTk.exe
  2⤵
  PID:3908
- C:\Windows\System\TVnOBZK.exe
  C:\Windows\System\TVnOBZK.exe
  2⤵
  PID:3132
- C:\Windows\System\eMQcgTj.exe
  C:\Windows\System\eMQcgTj.exe
  2⤵
  PID:1588
- C:\Windows\System\TwRPhmK.exe
  C:\Windows\System\TwRPhmK.exe
  2⤵
  PID:4064
- C:\Windows\System\jEnXXuY.exe
  C:\Windows\System\jEnXXuY.exe
  2⤵
  PID:3776
- C:\Windows\System\qmpWGnA.exe
  C:\Windows\System\qmpWGnA.exe
  2⤵
  PID:3748
- C:\Windows\System\BVxLpwY.exe
  C:\Windows\System\BVxLpwY.exe
  2⤵
  PID:3784
- C:\Windows\System\rXwXYcF.exe
  C:\Windows\System\rXwXYcF.exe
  2⤵
  PID:3820
- C:\Windows\System\xTIKgYp.exe
  C:\Windows\System\xTIKgYp.exe
  2⤵
  PID:3824
- C:\Windows\System\CKcayHC.exe
  C:\Windows\System\CKcayHC.exe
  2⤵
  PID:3844
- C:\Windows\System\JTjwmKW.exe
  C:\Windows\System\JTjwmKW.exe
  2⤵
  PID:1728
- C:\Windows\System\yxGuewX.exe
  C:\Windows\System\yxGuewX.exe
  2⤵
  PID:4112
- C:\Windows\System\zjuDURI.exe
  C:\Windows\System\zjuDURI.exe
  2⤵
  PID:4128
- C:\Windows\System\jMiRgYc.exe
  C:\Windows\System\jMiRgYc.exe
  2⤵
  PID:4144
- C:\Windows\System\DfxgZCd.exe
  C:\Windows\System\DfxgZCd.exe
  2⤵
  PID:4160
- C:\Windows\System\iPlexDQ.exe
  C:\Windows\System\iPlexDQ.exe
  2⤵
  PID:4176
- C:\Windows\System\RFFzcEj.exe
  C:\Windows\System\RFFzcEj.exe
  2⤵
  PID:4192
- C:\Windows\System\ccLLCIM.exe
  C:\Windows\System\ccLLCIM.exe
  2⤵
  PID:4212
- C:\Windows\System\mBCBdUE.exe
  C:\Windows\System\mBCBdUE.exe
  2⤵
  PID:4228
- C:\Windows\System\YLGuwNe.exe
  C:\Windows\System\YLGuwNe.exe
  2⤵
  PID:4244
- C:\Windows\System\lyyxllQ.exe
  C:\Windows\System\lyyxllQ.exe
  2⤵
  PID:4260
- C:\Windows\System\BouRIQV.exe
  C:\Windows\System\BouRIQV.exe
  2⤵
  PID:4276
- C:\Windows\System\FHJlfWS.exe
  C:\Windows\System\FHJlfWS.exe
  2⤵
  PID:4336
- C:\Windows\System\gSaTGjx.exe
  C:\Windows\System\gSaTGjx.exe
  2⤵
  PID:4384
- C:\Windows\System\mNYvAfw.exe
  C:\Windows\System\mNYvAfw.exe
  2⤵
  PID:4404
- C:\Windows\System\ZUdsbRT.exe
  C:\Windows\System\ZUdsbRT.exe
  2⤵
  PID:4420
- C:\Windows\System\RDnOjKI.exe
  C:\Windows\System\RDnOjKI.exe
  2⤵
  PID:4436
- C:\Windows\System\kNQcFGk.exe
  C:\Windows\System\kNQcFGk.exe
  2⤵
  PID:4456
- C:\Windows\System\HxvuxUm.exe
  C:\Windows\System\HxvuxUm.exe
  2⤵
  PID:4472
- C:\Windows\System\pnrJZqV.exe
  C:\Windows\System\pnrJZqV.exe
  2⤵
  PID:4488
- C:\Windows\System\ovxCdud.exe
  C:\Windows\System\ovxCdud.exe
  2⤵
  PID:4516
- C:\Windows\System\LgimxHO.exe
  C:\Windows\System\LgimxHO.exe
  2⤵
  PID:4544
- C:\Windows\System\cCUSlYz.exe
  C:\Windows\System\cCUSlYz.exe
  2⤵
  PID:4560
- C:\Windows\System\gihXgGV.exe
  C:\Windows\System\gihXgGV.exe
  2⤵
  PID:4576
- C:\Windows\System\eXWbXIP.exe
  C:\Windows\System\eXWbXIP.exe
  2⤵
  PID:4604
- C:\Windows\System\lGEffeU.exe
  C:\Windows\System\lGEffeU.exe
  2⤵
  PID:4620
- C:\Windows\System\BApUcBk.exe
  C:\Windows\System\BApUcBk.exe
  2⤵
  PID:4640
- C:\Windows\System\fsmHAtU.exe
  C:\Windows\System\fsmHAtU.exe
  2⤵
  PID:4656
- C:\Windows\System\FBfbzOB.exe
  C:\Windows\System\FBfbzOB.exe
  2⤵
  PID:4672
- C:\Windows\System\HIzaHqH.exe
  C:\Windows\System\HIzaHqH.exe
  2⤵
  PID:4688
- C:\Windows\System\QuKQiAD.exe
  C:\Windows\System\QuKQiAD.exe
  2⤵
  PID:4704
- C:\Windows\System\enRBdFm.exe
  C:\Windows\System\enRBdFm.exe
  2⤵
  PID:4732
- C:\Windows\System\wovTdbB.exe
  C:\Windows\System\wovTdbB.exe
  2⤵
  PID:4748
- C:\Windows\System\oYDdfhV.exe
  C:\Windows\System\oYDdfhV.exe
  2⤵
  PID:4788
- C:\Windows\System\aSvnrLd.exe
  C:\Windows\System\aSvnrLd.exe
  2⤵
  PID:4804
- C:\Windows\System\BvTWmPr.exe
  C:\Windows\System\BvTWmPr.exe
  2⤵
  PID:4820
- C:\Windows\System\odikHVC.exe
  C:\Windows\System\odikHVC.exe
  2⤵
  PID:4840
- C:\Windows\System\EZUDOYn.exe
  C:\Windows\System\EZUDOYn.exe
  2⤵
  PID:4856
- C:\Windows\System\BKoTuVG.exe
  C:\Windows\System\BKoTuVG.exe
  2⤵
  PID:4884
- C:\Windows\System\AedfQCP.exe
  C:\Windows\System\AedfQCP.exe
  2⤵
  PID:4900
- C:\Windows\System\ttQzwig.exe
  C:\Windows\System\ttQzwig.exe
  2⤵
  PID:4920
- C:\Windows\System\LiXrFuD.exe
  C:\Windows\System\LiXrFuD.exe
  2⤵
  PID:4936
- C:\Windows\System\SqJpKtl.exe
  C:\Windows\System\SqJpKtl.exe
  2⤵
  PID:4956
- C:\Windows\System\dplgaZc.exe
  C:\Windows\System\dplgaZc.exe
  2⤵
  PID:4976
- C:\Windows\System\sXxBUwV.exe
  C:\Windows\System\sXxBUwV.exe
  2⤵
  PID:4992
- C:\Windows\System\LGXFmbA.exe
  C:\Windows\System\LGXFmbA.exe
  2⤵
  PID:5048
- C:\Windows\System\hKqavdZ.exe
  C:\Windows\System\hKqavdZ.exe
  2⤵
  PID:5072
- C:\Windows\System\yRtjfph.exe
  C:\Windows\System\yRtjfph.exe
  2⤵
  PID:5092
- C:\Windows\System\VpJHjIg.exe
  C:\Windows\System\VpJHjIg.exe
  2⤵
  PID:5108
- C:\Windows\System\NBjKHwd.exe
  C:\Windows\System\NBjKHwd.exe
  2⤵
  PID:2140
- C:\Windows\System\jcXCZhk.exe
  C:\Windows\System\jcXCZhk.exe
  2⤵
  PID:3276
- C:\Windows\System\CoLHoDQ.exe
  C:\Windows\System\CoLHoDQ.exe
  2⤵
  PID:4184
- C:\Windows\System\HHtApfb.exe
  C:\Windows\System\HHtApfb.exe
  2⤵
  PID:4284
- C:\Windows\System\cuSwSPd.exe
  C:\Windows\System\cuSwSPd.exe
  2⤵
  PID:4208
- C:\Windows\System\yBmAKrg.exe
  C:\Windows\System\yBmAKrg.exe
  2⤵
  PID:4092
- C:\Windows\System\zPNCGzQ.exe
  C:\Windows\System\zPNCGzQ.exe
  2⤵
  PID:4168
- C:\Windows\System\yPInpud.exe
  C:\Windows\System\yPInpud.exe
  2⤵
  PID:4236
- C:\Windows\System\jZZrRvV.exe
  C:\Windows\System\jZZrRvV.exe
  2⤵
  PID:4300
- C:\Windows\System\LCnITPL.exe
  C:\Windows\System\LCnITPL.exe
  2⤵
  PID:4328
- C:\Windows\System\DQSxsKa.exe
  C:\Windows\System\DQSxsKa.exe
  2⤵
  PID:4288
- C:\Windows\System\IBlVAYt.exe
  C:\Windows\System\IBlVAYt.exe
  2⤵
  PID:4356
- C:\Windows\System\hpsnWvx.exe
  C:\Windows\System\hpsnWvx.exe
  2⤵
  PID:4376
- C:\Windows\System\kKcAKcY.exe
  C:\Windows\System\kKcAKcY.exe
  2⤵
  PID:4416
- C:\Windows\System\RzVgYsb.exe
  C:\Windows\System\RzVgYsb.exe
  2⤵
  PID:4448
- C:\Windows\System\yyNZVpB.exe
  C:\Windows\System\yyNZVpB.exe
  2⤵
  PID:4480
- C:\Windows\System\jkAHIfn.exe
  C:\Windows\System\jkAHIfn.exe
  2⤵
  PID:4512
- C:\Windows\System\DtGFKQx.exe
  C:\Windows\System\DtGFKQx.exe
  2⤵
  PID:4536
- C:\Windows\System\DKsZSXq.exe
  C:\Windows\System\DKsZSXq.exe
  2⤵
  PID:4556
- C:\Windows\System\zNcRGoU.exe
  C:\Windows\System\zNcRGoU.exe
  2⤵
  PID:4588
- C:\Windows\System\OZvZCPK.exe
  C:\Windows\System\OZvZCPK.exe
  2⤵
  PID:4612
- C:\Windows\System\CVxAyEl.exe
  C:\Windows\System\CVxAyEl.exe
  2⤵
  PID:4628
- C:\Windows\System\XeEqkfM.exe
  C:\Windows\System\XeEqkfM.exe
  2⤵
  PID:4720
- C:\Windows\System\VkkrbZw.exe
  C:\Windows\System\VkkrbZw.exe
  2⤵
  PID:4696
- C:\Windows\System\dPuJnqX.exe
  C:\Windows\System\dPuJnqX.exe
  2⤵
  PID:4764
- C:\Windows\System\yvURVmL.exe
  C:\Windows\System\yvURVmL.exe
  2⤵
  PID:4988
- C:\Windows\System\ayXXoYS.exe
  C:\Windows\System\ayXXoYS.exe
  2⤵
  PID:4928
- C:\Windows\System\gOMdXBJ.exe
  C:\Windows\System\gOMdXBJ.exe
  2⤵
  PID:4964
- C:\Windows\System\jjswfZN.exe
  C:\Windows\System\jjswfZN.exe
  2⤵
  PID:5064
- C:\Windows\System\FJylCAX.exe
  C:\Windows\System\FJylCAX.exe
  2⤵
  PID:5028
- C:\Windows\System\HeyjrMS.exe
  C:\Windows\System\HeyjrMS.exe
  2⤵
  PID:5004
- C:\Windows\System\cFfiftI.exe
  C:\Windows\System\cFfiftI.exe
  2⤵
  PID:2632
- C:\Windows\System\cjJyJxH.exe
  C:\Windows\System\cjJyJxH.exe
  2⤵
  PID:4312
- C:\Windows\System\icWYfIk.exe
  C:\Windows\System\icWYfIk.exe
  2⤵
  PID:4352
- C:\Windows\System\uumODHL.exe
  C:\Windows\System\uumODHL.exe
  2⤵
  PID:4396
- C:\Windows\System\PjTVBKt.exe
  C:\Windows\System\PjTVBKt.exe
  2⤵
  PID:4468
- C:\Windows\System\bPpdkIu.exe
  C:\Windows\System\bPpdkIu.exe
  2⤵
  PID:2224
- C:\Windows\System\nkPEAba.exe
  C:\Windows\System\nkPEAba.exe
  2⤵
  PID:5080
- C:\Windows\System\nLbPVMA.exe
  C:\Windows\System\nLbPVMA.exe
  2⤵
  PID:5036
- C:\Windows\System\hVmnZjG.exe
  C:\Windows\System\hVmnZjG.exe
  2⤵
  PID:4740
- C:\Windows\System\DUKTHZa.exe
  C:\Windows\System\DUKTHZa.exe
  2⤵
  PID:4796
- C:\Windows\System\WiulWAB.exe
  C:\Windows\System\WiulWAB.exe
  2⤵
  PID:4848
- C:\Windows\System\uwhetvq.exe
  C:\Windows\System\uwhetvq.exe
  2⤵
  PID:4864
- C:\Windows\System\YxgjLvP.exe
  C:\Windows\System\YxgjLvP.exe
  2⤵
  PID:4784
- C:\Windows\System\NNzWVZQ.exe
  C:\Windows\System\NNzWVZQ.exe
  2⤵
  PID:4800
- C:\Windows\System\vBPUlkr.exe
  C:\Windows\System\vBPUlkr.exe
  2⤵
  PID:4728
- C:\Windows\System\GQkjkzx.exe
  C:\Windows\System\GQkjkzx.exe
  2⤵
  PID:5044
- C:\Windows\System\LDWQfcv.exe
  C:\Windows\System\LDWQfcv.exe
  2⤵
  PID:4332
- C:\Windows\System\BUFYeOH.exe
  C:\Windows\System\BUFYeOH.exe
  2⤵
  PID:5116
- C:\Windows\System\NMiqMRS.exe
  C:\Windows\System\NMiqMRS.exe
  2⤵
  PID:5024
- C:\Windows\System\FZdgJDP.exe
  C:\Windows\System\FZdgJDP.exe
  2⤵
  PID:5132
- C:\Windows\System\KEAdWeB.exe
  C:\Windows\System\KEAdWeB.exe
  2⤵
  PID:5148
- C:\Windows\System\RAMIRZn.exe
  C:\Windows\System\RAMIRZn.exe
  2⤵
  PID:5168
- C:\Windows\System\YMjYihg.exe
  C:\Windows\System\YMjYihg.exe
  2⤵
  PID:5184
- C:\Windows\System\dvOjuZX.exe
  C:\Windows\System\dvOjuZX.exe
  2⤵
  PID:5200
- C:\Windows\System\yjDaibs.exe
  C:\Windows\System\yjDaibs.exe
  2⤵
  PID:5248
- C:\Windows\System\GsFqjRU.exe
  C:\Windows\System\GsFqjRU.exe
  2⤵
  PID:5268
- C:\Windows\System\RQNBVAi.exe
  C:\Windows\System\RQNBVAi.exe
  2⤵
  PID:5284
- C:\Windows\System\AhpDuAI.exe
  C:\Windows\System\AhpDuAI.exe
  2⤵
  PID:5300
- C:\Windows\System\KSdDpZd.exe
  C:\Windows\System\KSdDpZd.exe
  2⤵
  PID:5316
- C:\Windows\System\RtgwLWN.exe
  C:\Windows\System\RtgwLWN.exe
  2⤵
  PID:5332
- C:\Windows\System\MBsGiqF.exe
  C:\Windows\System\MBsGiqF.exe
  2⤵
  PID:5348
- C:\Windows\System\VQwhllO.exe
  C:\Windows\System\VQwhllO.exe
  2⤵
  PID:5364
- C:\Windows\System\pzOTBdG.exe
  C:\Windows\System\pzOTBdG.exe
  2⤵
  PID:5380
- C:\Windows\System\tPdXfUh.exe
  C:\Windows\System\tPdXfUh.exe
  2⤵
  PID:5396
- C:\Windows\System\kidCrQz.exe
  C:\Windows\System\kidCrQz.exe
  2⤵
  PID:5412
- C:\Windows\System\PiPCSwn.exe
  C:\Windows\System\PiPCSwn.exe
  2⤵
  PID:5432
- C:\Windows\System\fUZWVmK.exe
  C:\Windows\System\fUZWVmK.exe
  2⤵
  PID:5452
- C:\Windows\System\UeemTCA.exe
  C:\Windows\System\UeemTCA.exe
  2⤵
  PID:5468
- C:\Windows\System\rtXjrJy.exe
  C:\Windows\System\rtXjrJy.exe
  2⤵
  PID:5484
- C:\Windows\System\liuUAsg.exe
  C:\Windows\System\liuUAsg.exe
  2⤵
  PID:5500
- C:\Windows\System\wMHQKVF.exe
  C:\Windows\System\wMHQKVF.exe
  2⤵
  PID:5520
- C:\Windows\System\gINvwAy.exe
  C:\Windows\System\gINvwAy.exe
  2⤵
  PID:5536
- C:\Windows\System\WdjcADy.exe
  C:\Windows\System\WdjcADy.exe
  2⤵
  PID:5556
- C:\Windows\System\gyEFMfv.exe
  C:\Windows\System\gyEFMfv.exe
  2⤵
  PID:5580
- C:\Windows\System\QdGckqN.exe
  C:\Windows\System\QdGckqN.exe
  2⤵
  PID:5596
- C:\Windows\System\OpwUonj.exe
  C:\Windows\System\OpwUonj.exe
  2⤵
  PID:5748
- C:\Windows\System\icqTHVN.exe
  C:\Windows\System\icqTHVN.exe
  2⤵
  PID:5768
- C:\Windows\System\CpORiQh.exe
  C:\Windows\System\CpORiQh.exe
  2⤵
  PID:5792
- C:\Windows\System\uOWSpIK.exe
  C:\Windows\System\uOWSpIK.exe
  2⤵
  PID:5808
- C:\Windows\System\XTXgMRC.exe
  C:\Windows\System\XTXgMRC.exe
  2⤵
  PID:5824
- C:\Windows\System\NiNOjeQ.exe
  C:\Windows\System\NiNOjeQ.exe
  2⤵
  PID:5840
- C:\Windows\System\jvyTeQX.exe
  C:\Windows\System\jvyTeQX.exe
  2⤵
  PID:5856
- C:\Windows\System\IOgjYbD.exe
  C:\Windows\System\IOgjYbD.exe
  2⤵
  PID:5872
- C:\Windows\System\sllRXWU.exe
  C:\Windows\System\sllRXWU.exe
  2⤵
  PID:5904
- C:\Windows\System\HZrRmLG.exe
  C:\Windows\System\HZrRmLG.exe
  2⤵
  PID:5920
- C:\Windows\System\XekAqtN.exe
  C:\Windows\System\XekAqtN.exe
  2⤵
  PID:5936
- C:\Windows\System\RlmoVEc.exe
  C:\Windows\System\RlmoVEc.exe
  2⤵
  PID:5952
- C:\Windows\System\uvjZAQk.exe
  C:\Windows\System\uvjZAQk.exe
  2⤵
  PID:5972
- C:\Windows\System\elhYGiS.exe
  C:\Windows\System\elhYGiS.exe
  2⤵
  PID:5988
- C:\Windows\System\XIxGbxu.exe
  C:\Windows\System\XIxGbxu.exe
  2⤵
  PID:6004
- C:\Windows\System\PxJWcCL.exe
  C:\Windows\System\PxJWcCL.exe
  2⤵
  PID:6020
- C:\Windows\System\MRZgMgu.exe
  C:\Windows\System\MRZgMgu.exe
  2⤵
  PID:6040
- C:\Windows\System\VEIEOqo.exe
  C:\Windows\System\VEIEOqo.exe
  2⤵
  PID:6056
- C:\Windows\System\UGGMKKu.exe
  C:\Windows\System\UGGMKKu.exe
  2⤵
  PID:6072
- C:\Windows\System\dsJRbIo.exe
  C:\Windows\System\dsJRbIo.exe
  2⤵
  PID:6088
- C:\Windows\System\gRLWeug.exe
  C:\Windows\System\gRLWeug.exe
  2⤵
  PID:6104
- C:\Windows\System\CJkgWTH.exe
  C:\Windows\System\CJkgWTH.exe
  2⤵
  PID:6120
- C:\Windows\System\joyTDFU.exe
  C:\Windows\System\joyTDFU.exe
  2⤵
  PID:6136
- C:\Windows\System\tGBAkgA.exe
  C:\Windows\System\tGBAkgA.exe
  2⤵
  PID:4684
- C:\Windows\System\xsmiLlP.exe
  C:\Windows\System\xsmiLlP.exe
  2⤵
  PID:3632
- C:\Windows\System\aprzMTQ.exe
  C:\Windows\System\aprzMTQ.exe
  2⤵
  PID:3552
- C:\Windows\System\oZDjOdk.exe
  C:\Windows\System\oZDjOdk.exe
  2⤵
  PID:4432
- C:\Windows\System\aEANWSK.exe
  C:\Windows\System\aEANWSK.exe
  2⤵
  PID:1952
- C:\Windows\System\iBpEYaX.exe
  C:\Windows\System\iBpEYaX.exe
  2⤵
  PID:4392
- C:\Windows\System\yOYAhuO.exe
  C:\Windows\System\yOYAhuO.exe
  2⤵
  PID:4572
- C:\Windows\System\BXqyxXO.exe
  C:\Windows\System\BXqyxXO.exe
  2⤵
  PID:4744
- C:\Windows\System\MpOsIVV.exe
  C:\Windows\System\MpOsIVV.exe
  2⤵
  PID:4828
- C:\Windows\System\AcfdXwL.exe
  C:\Windows\System\AcfdXwL.exe
  2⤵
  PID:4948
- C:\Windows\System\WjldPOO.exe
  C:\Windows\System\WjldPOO.exe
  2⤵
  PID:5140
- C:\Windows\System\gLCqUOa.exe
  C:\Windows\System\gLCqUOa.exe
  2⤵
  PID:4636
- C:\Windows\System\XwondBC.exe
  C:\Windows\System\XwondBC.exe
  2⤵
  PID:4052
- C:\Windows\System\yedzTwI.exe
  C:\Windows\System\yedzTwI.exe
  2⤵
  PID:4836
- C:\Windows\System\WTZlybR.exe
  C:\Windows\System\WTZlybR.exe
  2⤵
  PID:4968
- C:\Windows\System\VWwYyxh.exe
  C:\Windows\System\VWwYyxh.exe
  2⤵
  PID:4200
- C:\Windows\System\EfXgAUC.exe
  C:\Windows\System\EfXgAUC.exe
  2⤵
  PID:4768
- C:\Windows\System\wkHIMNR.exe
  C:\Windows\System\wkHIMNR.exe
  2⤵
  PID:4916
- C:\Windows\System\rSEmCCZ.exe
  C:\Windows\System\rSEmCCZ.exe
  2⤵
  PID:4540
- C:\Windows\System\VixeZnN.exe
  C:\Windows\System\VixeZnN.exe
  2⤵
  PID:5160
- C:\Windows\System\yvsdMuJ.exe
  C:\Windows\System\yvsdMuJ.exe
  2⤵
  PID:5296
- C:\Windows\System\QhQmzCk.exe
  C:\Windows\System\QhQmzCk.exe
  2⤵
  PID:5360
- C:\Windows\System\SzgigCY.exe
  C:\Windows\System\SzgigCY.exe
  2⤵
  PID:5424
- C:\Windows\System\EMemUcf.exe
  C:\Windows\System\EMemUcf.exe
  2⤵
  PID:5496
- C:\Windows\System\tlSWQKh.exe
  C:\Windows\System\tlSWQKh.exe
  2⤵
  PID:5604
- C:\Windows\System\GmlEQHe.exe
  C:\Windows\System\GmlEQHe.exe
  2⤵
  PID:5220
- C:\Windows\System\stLLfNI.exe
  C:\Windows\System\stLLfNI.exe
  2⤵
  PID:5232
- C:\Windows\System\vZpdrSx.exe
  C:\Windows\System\vZpdrSx.exe
  2⤵
  PID:5280
- C:\Windows\System\rHyFfNN.exe
  C:\Windows\System\rHyFfNN.exe
  2⤵
  PID:5344
- C:\Windows\System\RRDxSyv.exe
  C:\Windows\System\RRDxSyv.exe
  2⤵
  PID:5408
- C:\Windows\System\oVrMWjj.exe
  C:\Windows\System\oVrMWjj.exe
  2⤵
  PID:5448
- C:\Windows\System\xhAVXAl.exe
  C:\Windows\System\xhAVXAl.exe
  2⤵
  PID:5612
- C:\Windows\System\EZmmzHl.exe
  C:\Windows\System\EZmmzHl.exe
  2⤵
  PID:5508
- C:\Windows\System\PrZvIln.exe
  C:\Windows\System\PrZvIln.exe
  2⤵
  PID:5212
- C:\Windows\System\gASVXZI.exe
  C:\Windows\System\gASVXZI.exe
  2⤵
  PID:5544
- C:\Windows\System\pDmEJdw.exe
  C:\Windows\System\pDmEJdw.exe
  2⤵
  PID:5660
- C:\Windows\System\cuZLLoV.exe
  C:\Windows\System\cuZLLoV.exe
  2⤵
  PID:5672
- C:\Windows\System\NMCsokn.exe
  C:\Windows\System\NMCsokn.exe
  2⤵
  PID:5688
- C:\Windows\System\CZxKZLa.exe
  C:\Windows\System\CZxKZLa.exe
  2⤵
  PID:5716
- C:\Windows\System\xsTuzFf.exe
  C:\Windows\System\xsTuzFf.exe
  2⤵
  PID:5756
- C:\Windows\System\IkJYOZs.exe
  C:\Windows\System\IkJYOZs.exe
  2⤵
  PID:5916
- C:\Windows\System\ZvjxuNy.exe
  C:\Windows\System\ZvjxuNy.exe
  2⤵
  PID:5836
- C:\Windows\System\NykiFHa.exe
  C:\Windows\System\NykiFHa.exe
  2⤵
  PID:5948
- C:\Windows\System\VGBsDcg.exe
  C:\Windows\System\VGBsDcg.exe
  2⤵
  PID:6016
- C:\Windows\System\fjWYtvn.exe
  C:\Windows\System\fjWYtvn.exe
  2⤵
  PID:6084
- C:\Windows\System\spHVysh.exe
  C:\Windows\System\spHVysh.exe
  2⤵
  PID:5784
- C:\Windows\System\FgnalIf.exe
  C:\Windows\System\FgnalIf.exe
  2⤵
  PID:5848
- C:\Windows\System\LZawwCL.exe
  C:\Windows\System\LZawwCL.exe
  2⤵
  PID:4444
- C:\Windows\System\wfpOxww.exe
  C:\Windows\System\wfpOxww.exe
  2⤵
  PID:5124
- C:\Windows\System\sxWhQcY.exe
  C:\Windows\System\sxWhQcY.exe
  2⤵
  PID:5144
- C:\Windows\System\kkCbcvr.exe
  C:\Windows\System\kkCbcvr.exe
  2⤵
  PID:4400
- C:\Windows\System\SnvwZzf.exe
  C:\Windows\System\SnvwZzf.exe
  2⤵
  PID:2292
- C:\Windows\System\AXPcHQW.exe
  C:\Windows\System\AXPcHQW.exe
  2⤵
  PID:5464
- C:\Windows\System\aCsxggT.exe
  C:\Windows\System\aCsxggT.exe
  2⤵
  PID:5244
- C:\Windows\System\VRaFzqb.exe
  C:\Windows\System\VRaFzqb.exe
  2⤵
  PID:5616
- C:\Windows\System\lJECQIw.exe
  C:\Windows\System\lJECQIw.exe
  2⤵
  PID:5676
- C:\Windows\System\NvSsgpY.exe
  C:\Windows\System\NvSsgpY.exe
  2⤵
  PID:5532
- C:\Windows\System\XJAGiZJ.exe
  C:\Windows\System\XJAGiZJ.exe
  2⤵
  PID:4648
- C:\Windows\System\tXcwQWZ.exe
  C:\Windows\System\tXcwQWZ.exe
  2⤵
  PID:5392
- C:\Windows\System\LnBYywH.exe
  C:\Windows\System\LnBYywH.exe
  2⤵
  PID:5708
- C:\Windows\System\RFDTTWW.exe
  C:\Windows\System\RFDTTWW.exe
  2⤵
  PID:5340
- C:\Windows\System\EOWmqEg.exe
  C:\Windows\System\EOWmqEg.exe
  2⤵
  PID:5608
- C:\Windows\System\pDJcUJA.exe
  C:\Windows\System\pDJcUJA.exe
  2⤵
  PID:5896
- C:\Windows\System\kzLRYNk.exe
  C:\Windows\System\kzLRYNk.exe
  2⤵
  PID:5820
- C:\Windows\System\blRMxoy.exe
  C:\Windows\System\blRMxoy.exe
  2⤵
  PID:5192
- C:\Windows\System\EOinaWF.exe
  C:\Windows\System\EOinaWF.exe
  2⤵
  PID:5196
- C:\Windows\System\hCUSvSh.exe
  C:\Windows\System\hCUSvSh.exe
  2⤵
  PID:5968
- C:\Windows\System\rZrJMWB.exe
  C:\Windows\System\rZrJMWB.exe
  2⤵
  PID:6036
- C:\Windows\System\JZOSrUT.exe
  C:\Windows\System\JZOSrUT.exe
  2⤵
  PID:6100
- C:\Windows\System\xrRFQIf.exe
  C:\Windows\System\xrRFQIf.exe
  2⤵
  PID:4892
- C:\Windows\System\ffcaAUZ.exe
  C:\Windows\System\ffcaAUZ.exe
  2⤵
  PID:5208
- C:\Windows\System\gTTvyga.exe
  C:\Windows\System\gTTvyga.exe
  2⤵
  PID:5256
- C:\Windows\System\MgkmvVi.exe
  C:\Windows\System\MgkmvVi.exe
  2⤵
  PID:5636
- C:\Windows\System\Cgtzlvq.exe
  C:\Windows\System\Cgtzlvq.exe
  2⤵
  PID:5868
- C:\Windows\System\dRMiPZF.exe
  C:\Windows\System\dRMiPZF.exe
  2⤵
  PID:5776
- C:\Windows\System\QYHxAMD.exe
  C:\Windows\System\QYHxAMD.exe
  2⤵
  PID:5480
- C:\Windows\System\SPmpTJC.exe
  C:\Windows\System\SPmpTJC.exe
  2⤵
  PID:4716
- C:\Windows\System\fFxjbUI.exe
  C:\Windows\System\fFxjbUI.exe
  2⤵
  PID:5800
- C:\Windows\System\tcveDtB.exe
  C:\Windows\System\tcveDtB.exe
  2⤵
  PID:5588
- C:\Windows\System\VjNYVcn.exe
  C:\Windows\System\VjNYVcn.exe
  2⤵
  PID:4272
- C:\Windows\System\rWLbjYT.exe
  C:\Windows\System\rWLbjYT.exe
  2⤵
  PID:5640
- C:\Windows\System\tqRXXCb.exe
  C:\Windows\System\tqRXXCb.exe
  2⤵
  PID:4652
- C:\Windows\System\efBFHlh.exe
  C:\Windows\System\efBFHlh.exe
  2⤵
  PID:5732
- C:\Windows\System\aiMQfdb.exe
  C:\Windows\System\aiMQfdb.exe
  2⤵
  PID:5884
- C:\Windows\System\cUhpmef.exe
  C:\Windows\System\cUhpmef.exe
  2⤵
  PID:5900
- C:\Windows\System\XuEyNRw.exe
  C:\Windows\System\XuEyNRw.exe
  2⤵
  PID:6028
- C:\Windows\System\BkarXgP.exe
  C:\Windows\System\BkarXgP.exe
  2⤵
  PID:5964
- C:\Windows\System\HjMqMiF.exe
  C:\Windows\System\HjMqMiF.exe
  2⤵
  PID:6096
- C:\Windows\System\gPtKZqz.exe
  C:\Windows\System\gPtKZqz.exe
  2⤵
  PID:5020
- C:\Windows\System\UlcQlVh.exe
  C:\Windows\System\UlcQlVh.exe
  2⤵
  PID:5564
- C:\Windows\System\svLtCyO.exe
  C:\Windows\System\svLtCyO.exe
  2⤵
  PID:4908
- C:\Windows\System\XHSpBGV.exe
  C:\Windows\System\XHSpBGV.exe
  2⤵
  PID:4220
- C:\Windows\System\nFZSNFa.exe
  C:\Windows\System\nFZSNFa.exe
  2⤵
  PID:5228
- C:\Windows\System\xqLzDFh.exe
  C:\Windows\System\xqLzDFh.exe
  2⤵
  PID:5572
- C:\Windows\System\RDLYJWA.exe
  C:\Windows\System\RDLYJWA.exe
  2⤵
  PID:4896
- C:\Windows\System\yutyuAv.exe
  C:\Windows\System\yutyuAv.exe
  2⤵
  PID:5576
- C:\Windows\System\USUubtC.exe
  C:\Windows\System\USUubtC.exe
  2⤵
  PID:4944
- C:\Windows\System\Eermdvs.exe
  C:\Windows\System\Eermdvs.exe
  2⤵
  PID:5880
- C:\Windows\System\JzdxNGl.exe
  C:\Windows\System\JzdxNGl.exe
  2⤵
  PID:5704
- C:\Windows\System\zGWozGS.exe
  C:\Windows\System\zGWozGS.exe
  2⤵
  PID:4756
- C:\Windows\System\eWzqluv.exe
  C:\Windows\System\eWzqluv.exe
  2⤵
  PID:3724
- C:\Windows\System\OrxOfNH.exe
  C:\Windows\System\OrxOfNH.exe
  2⤵
  PID:5444
- C:\Windows\System\lQrQifE.exe
  C:\Windows\System\lQrQifE.exe
  2⤵
  PID:6012
- C:\Windows\System\vxvvfmW.exe
  C:\Windows\System\vxvvfmW.exe
  2⤵
  PID:5008
- C:\Windows\System\fTQjjCC.exe
  C:\Windows\System\fTQjjCC.exe
  2⤵
  PID:5984
- C:\Windows\System\lWdQQYX.exe
  C:\Windows\System\lWdQQYX.exe
  2⤵
  PID:6152
- C:\Windows\System\EcImmMO.exe
  C:\Windows\System\EcImmMO.exe
  2⤵
  PID:6168
- C:\Windows\System\qHHmJwU.exe
  C:\Windows\System\qHHmJwU.exe
  2⤵
  PID:6184
- C:\Windows\System\ritmatp.exe
  C:\Windows\System\ritmatp.exe
  2⤵
  PID:6200
- C:\Windows\System\KgYMewH.exe
  C:\Windows\System\KgYMewH.exe
  2⤵
  PID:6216
- C:\Windows\System\fcBoOhr.exe
  C:\Windows\System\fcBoOhr.exe
  2⤵
  PID:6232
- C:\Windows\System\YpjjVKC.exe
  C:\Windows\System\YpjjVKC.exe
  2⤵
  PID:6248
- C:\Windows\System\dgjNzrc.exe
  C:\Windows\System\dgjNzrc.exe
  2⤵
  PID:6264
- C:\Windows\System\CUdLFed.exe
  C:\Windows\System\CUdLFed.exe
  2⤵
  PID:6280
- C:\Windows\System\OjmWJsm.exe
  C:\Windows\System\OjmWJsm.exe
  2⤵
  PID:6296
- C:\Windows\System\bXxfjca.exe
  C:\Windows\System\bXxfjca.exe
  2⤵
  PID:6312
- C:\Windows\System\xEoqGHF.exe
  C:\Windows\System\xEoqGHF.exe
  2⤵
  PID:6356
- C:\Windows\System\XdThxiW.exe
  C:\Windows\System\XdThxiW.exe
  2⤵
  PID:6372
- C:\Windows\System\xHVpYyd.exe
  C:\Windows\System\xHVpYyd.exe
  2⤵
  PID:6388
- C:\Windows\System\aadqHpm.exe
  C:\Windows\System\aadqHpm.exe
  2⤵
  PID:6404
- C:\Windows\System\cFxyvtc.exe
  C:\Windows\System\cFxyvtc.exe
  2⤵
  PID:6420
- C:\Windows\System\ICHazTg.exe
  C:\Windows\System\ICHazTg.exe
  2⤵
  PID:6436
- C:\Windows\System\ZOxgIgU.exe
  C:\Windows\System\ZOxgIgU.exe
  2⤵
  PID:6452
- C:\Windows\System\vuUvOSa.exe
  C:\Windows\System\vuUvOSa.exe
  2⤵
  PID:6468
- C:\Windows\System\KUQbTIJ.exe
  C:\Windows\System\KUQbTIJ.exe
  2⤵
  PID:6484
- C:\Windows\System\IXqKEkn.exe
  C:\Windows\System\IXqKEkn.exe
  2⤵
  PID:6500
- C:\Windows\System\unddDUG.exe
  C:\Windows\System\unddDUG.exe
  2⤵
  PID:6516
- C:\Windows\System\tkuLsOL.exe
  C:\Windows\System\tkuLsOL.exe
  2⤵
  PID:6532
- C:\Windows\System\SQFkFND.exe
  C:\Windows\System\SQFkFND.exe
  2⤵
  PID:6548
- C:\Windows\System\emidNCs.exe
  C:\Windows\System\emidNCs.exe
  2⤵
  PID:6564
- C:\Windows\System\UbmGcqu.exe
  C:\Windows\System\UbmGcqu.exe
  2⤵
  PID:6580
- C:\Windows\System\xOCVOmn.exe
  C:\Windows\System\xOCVOmn.exe
  2⤵
  PID:6596
- C:\Windows\System\zbDCdOd.exe
  C:\Windows\System\zbDCdOd.exe
  2⤵
  PID:6612
- C:\Windows\System\IXiXyUT.exe
  C:\Windows\System\IXiXyUT.exe
  2⤵
  PID:6628
- C:\Windows\System\nCjjjFl.exe
  C:\Windows\System\nCjjjFl.exe
  2⤵
  PID:6644
- C:\Windows\System\MCeYyXQ.exe
  C:\Windows\System\MCeYyXQ.exe
  2⤵
  PID:6660
- C:\Windows\System\PrVoNLZ.exe
  C:\Windows\System\PrVoNLZ.exe
  2⤵
  PID:6676
- C:\Windows\System\iGbfrJL.exe
  C:\Windows\System\iGbfrJL.exe
  2⤵
  PID:6692
- C:\Windows\System\UrYVkaq.exe
  C:\Windows\System\UrYVkaq.exe
  2⤵
  PID:6708
- C:\Windows\System\LbrCgdS.exe
  C:\Windows\System\LbrCgdS.exe
  2⤵
  PID:6724
- C:\Windows\System\nzCCNJf.exe
  C:\Windows\System\nzCCNJf.exe
  2⤵
  PID:6740
- C:\Windows\System\kfrUwpc.exe
  C:\Windows\System\kfrUwpc.exe
  2⤵
  PID:6764
- C:\Windows\System\zjkNRaK.exe
  C:\Windows\System\zjkNRaK.exe
  2⤵
  PID:6780
- C:\Windows\System\qImhjpo.exe
  C:\Windows\System\qImhjpo.exe
  2⤵
  PID:6796
- C:\Windows\System\CVgOliH.exe
  C:\Windows\System\CVgOliH.exe
  2⤵
  PID:6816
- C:\Windows\System\UVKZGKD.exe
  C:\Windows\System\UVKZGKD.exe
  2⤵
  PID:6832
- C:\Windows\System\qHfIaFs.exe
  C:\Windows\System\qHfIaFs.exe
  2⤵
  PID:6852
- C:\Windows\System\SUyAGmj.exe
  C:\Windows\System\SUyAGmj.exe
  2⤵
  PID:6868
- C:\Windows\System\PncptFj.exe
  C:\Windows\System\PncptFj.exe
  2⤵
  PID:6884
- C:\Windows\System\SzWbiti.exe
  C:\Windows\System\SzWbiti.exe
  2⤵
  PID:6900
- C:\Windows\System\zKrGCpU.exe
  C:\Windows\System\zKrGCpU.exe
  2⤵
  PID:6916
- C:\Windows\System\PCHSaBT.exe
  C:\Windows\System\PCHSaBT.exe
  2⤵
  PID:6936
- C:\Windows\System\vtMvEqR.exe
  C:\Windows\System\vtMvEqR.exe
  2⤵
  PID:6952
- C:\Windows\System\QFKaTSN.exe
  C:\Windows\System\QFKaTSN.exe
  2⤵
  PID:7096
- C:\Windows\System\AGtvDcD.exe
  C:\Windows\System\AGtvDcD.exe
  2⤵
  PID:7120
- C:\Windows\System\ZDyPzNq.exe
  C:\Windows\System\ZDyPzNq.exe
  2⤵
  PID:7136
- C:\Windows\System\NNwFglT.exe
  C:\Windows\System\NNwFglT.exe
  2⤵
  PID:7152
- C:\Windows\System\lXAmiCS.exe
  C:\Windows\System\lXAmiCS.exe
  2⤵
  PID:5892
- C:\Windows\System\NWrjzMW.exe
  C:\Windows\System\NWrjzMW.exe
  2⤵
  PID:4760
- C:\Windows\System\vIoqnPn.exe
  C:\Windows\System\vIoqnPn.exe
  2⤵
  PID:6196
- C:\Windows\System\RvMzNxj.exe
  C:\Windows\System\RvMzNxj.exe
  2⤵
  PID:6228
- C:\Windows\System\PbQgGdK.exe
  C:\Windows\System\PbQgGdK.exe
  2⤵
  PID:6336
- C:\Windows\System\iGqFEFl.exe
  C:\Windows\System\iGqFEFl.exe
  2⤵
  PID:6176
- C:\Windows\System\ISgCtiZ.exe
  C:\Windows\System\ISgCtiZ.exe
  2⤵
  PID:6324
- C:\Windows\System\DbPvaYR.exe
  C:\Windows\System\DbPvaYR.exe
  2⤵
  PID:6380
- C:\Windows\System\nhtUIMD.exe
  C:\Windows\System\nhtUIMD.exe
  2⤵
  PID:5624
- C:\Windows\System\uQgDTyy.exe
  C:\Windows\System\uQgDTyy.exe
  2⤵
  PID:6148
- C:\Windows\System\IVkQeXc.exe
  C:\Windows\System\IVkQeXc.exe
  2⤵
  PID:6240
- C:\Windows\System\rqBgCAk.exe
  C:\Windows\System\rqBgCAk.exe
  2⤵
  PID:6368
- C:\Windows\System\QOzpHaY.exe
  C:\Windows\System\QOzpHaY.exe
  2⤵
  PID:6396
- C:\Windows\System\DtgndRJ.exe
  C:\Windows\System\DtgndRJ.exe
  2⤵
  PID:6432
- C:\Windows\System\WuBunIx.exe
  C:\Windows\System\WuBunIx.exe
  2⤵
  PID:6464
- C:\Windows\System\lfDyOKx.exe
  C:\Windows\System\lfDyOKx.exe
  2⤵
  PID:4832
- C:\Windows\System\jFqDEXr.exe
  C:\Windows\System\jFqDEXr.exe
  2⤵
  PID:6604
- C:\Windows\System\IhBZEOF.exe
  C:\Windows\System\IhBZEOF.exe
  2⤵
  PID:6672
- C:\Windows\System\AquGkQQ.exe
  C:\Windows\System\AquGkQQ.exe
  2⤵
  PID:6736
- C:\Windows\System\CwLxgTE.exe
  C:\Windows\System\CwLxgTE.exe
  2⤵
  PID:6496
- C:\Windows\System\DgIYqMo.exe
  C:\Windows\System\DgIYqMo.exe
  2⤵
  PID:6528
- C:\Windows\System\fdnBPQh.exe
  C:\Windows\System\fdnBPQh.exe
  2⤵
  PID:6524
- C:\Windows\System\aTeROeC.exe
  C:\Windows\System\aTeROeC.exe
  2⤵
  PID:6656
- C:\Windows\System\khvyAip.exe
  C:\Windows\System\khvyAip.exe
  2⤵
  PID:6720
- C:\Windows\System\wMPbotY.exe
  C:\Windows\System\wMPbotY.exe
  2⤵
  PID:6840
- C:\Windows\System\fqIvBJo.exe
  C:\Windows\System\fqIvBJo.exe
  2⤵
  PID:6880
- C:\Windows\System\ozazsTH.exe
  C:\Windows\System\ozazsTH.exe
  2⤵
  PID:6948
- C:\Windows\System\TqxIjnT.exe
  C:\Windows\System\TqxIjnT.exe
  2⤵
  PID:6860
- C:\Windows\System\UmRedQN.exe
  C:\Windows\System\UmRedQN.exe
  2⤵
  PID:6924
- C:\Windows\System\JwjIPbv.exe
  C:\Windows\System\JwjIPbv.exe
  2⤵
  PID:6824
- C:\Windows\System\qjFQCzJ.exe
  C:\Windows\System\qjFQCzJ.exe
  2⤵
  PID:6988
- C:\Windows\System\BYUuvVg.exe
  C:\Windows\System\BYUuvVg.exe
  2⤵
  PID:7004
- C:\Windows\System\ssMXkiK.exe
  C:\Windows\System\ssMXkiK.exe
  2⤵
  PID:7032
- C:\Windows\System\QFJSGKV.exe
  C:\Windows\System\QFJSGKV.exe
  2⤵
  PID:7036
- C:\Windows\System\LSVfHtR.exe
  C:\Windows\System\LSVfHtR.exe
  2⤵
  PID:7048
- C:\Windows\System\Vujxqbn.exe
  C:\Windows\System\Vujxqbn.exe
  2⤵
  PID:7064
- C:\Windows\System\Cslzspt.exe
  C:\Windows\System\Cslzspt.exe
  2⤵
  PID:7080
- C:\Windows\System\YUFbXAF.exe
  C:\Windows\System\YUFbXAF.exe
  2⤵
  PID:7092
- C:\Windows\System\IeIsXaS.exe
  C:\Windows\System\IeIsXaS.exe
  2⤵
  PID:7132
- C:\Windows\System\iorQuEc.exe
  C:\Windows\System\iorQuEc.exe
  2⤵
  PID:4140
- C:\Windows\System\nYhViJG.exe
  C:\Windows\System\nYhViJG.exe
  2⤵
  PID:7144
- C:\Windows\System\hfiyKiT.exe
  C:\Windows\System\hfiyKiT.exe
  2⤵
  PID:6256
- C:\Windows\System\wEaGHnC.exe
  C:\Windows\System\wEaGHnC.exe
  2⤵
  PID:4368
- C:\Windows\System\TJGTtOI.exe
  C:\Windows\System\TJGTtOI.exe
  2⤵
  PID:6304
- C:\Windows\System\YGQyiPF.exe
  C:\Windows\System\YGQyiPF.exe
  2⤵
  PID:6448
- C:\Windows\System\PEtcYtz.exe
  C:\Windows\System\PEtcYtz.exe
  2⤵
  PID:6592
- C:\Windows\System\XLaOcny.exe
  C:\Windows\System\XLaOcny.exe
  2⤵
  PID:6636
- C:\Windows\System\GwOdwgF.exe
  C:\Windows\System\GwOdwgF.exe
  2⤵
  PID:6804
- C:\Windows\System\xkNNjsa.exe
  C:\Windows\System\xkNNjsa.exe
  2⤵
  PID:6848
- C:\Windows\System\WXczDfU.exe
  C:\Windows\System\WXczDfU.exe
  2⤵
  PID:6572
- C:\Windows\System\igVubrQ.exe
  C:\Windows\System\igVubrQ.exe
  2⤵
  PID:5128
- C:\Windows\System\kjiHBpS.exe
  C:\Windows\System\kjiHBpS.exe
  2⤵
  PID:6480
- C:\Windows\System\CajNFNU.exe
  C:\Windows\System\CajNFNU.exe
  2⤵
  PID:6624
- C:\Windows\System\psffADe.exe
  C:\Windows\System\psffADe.exe
  2⤵
  PID:6828
- C:\Windows\System\kcrTRjz.exe
  C:\Windows\System\kcrTRjz.exe
  2⤵
  PID:6896
- C:\Windows\System\JTHnQvz.exe
  C:\Windows\System\JTHnQvz.exe
  2⤵
  PID:6932
- C:\Windows\System\BjQtEvs.exe
  C:\Windows\System\BjQtEvs.exe
  2⤵
  PID:7012
- C:\Windows\System\SPjctqV.exe
  C:\Windows\System\SPjctqV.exe
  2⤵
  PID:7068
- C:\Windows\System\qFbLCmL.exe
  C:\Windows\System\qFbLCmL.exe
  2⤵
  PID:7108
- C:\Windows\System\umoIWRq.exe
  C:\Windows\System\umoIWRq.exe
  2⤵
  PID:2780
- C:\Windows\System\XbsigXm.exe
  C:\Windows\System\XbsigXm.exe
  2⤵
  PID:6332
- C:\Windows\System\UAXDrdA.exe
  C:\Windows\System\UAXDrdA.exe
  2⤵
  PID:6288
- C:\Windows\System\pFNLdEs.exe
  C:\Windows\System\pFNLdEs.exe
  2⤵
  PID:6588
- C:\Windows\System\SWxvGpF.exe
  C:\Windows\System\SWxvGpF.exe
  2⤵
  PID:6428
- C:\Windows\System\qjGOzAW.exe
  C:\Windows\System\qjGOzAW.exe
  2⤵
  PID:6272
- C:\Windows\System\jaiRKVJ.exe
  C:\Windows\System\jaiRKVJ.exe
  2⤵
  PID:6704
- C:\Windows\System\sRAMaen.exe
  C:\Windows\System\sRAMaen.exe
  2⤵
  PID:6760
- C:\Windows\System\aLokiPb.exe
  C:\Windows\System\aLokiPb.exe
  2⤵
  PID:6756
- C:\Windows\System\QZwZTLZ.exe
  C:\Windows\System\QZwZTLZ.exe
  2⤵
  PID:6996
- C:\Windows\System\gkESmGM.exe
  C:\Windows\System\gkESmGM.exe
  2⤵
  PID:7084
- C:\Windows\System\qgeCeeB.exe
  C:\Windows\System\qgeCeeB.exe
  2⤵
  PID:5932
- C:\Windows\System\ZCHSMOt.exe
  C:\Windows\System\ZCHSMOt.exe
  2⤵
  PID:7172
- C:\Windows\System\EnmXPkt.exe
  C:\Windows\System\EnmXPkt.exe
  2⤵
  PID:7188
- C:\Windows\System\llcWQNW.exe
  C:\Windows\System\llcWQNW.exe
  2⤵
  PID:7208
- C:\Windows\System\CGTeCHW.exe
  C:\Windows\System\CGTeCHW.exe
  2⤵
  PID:7228
- C:\Windows\System\cEbZDYE.exe
  C:\Windows\System\cEbZDYE.exe
  2⤵
  PID:7248
- C:\Windows\System\VtnqlAK.exe
  C:\Windows\System\VtnqlAK.exe
  2⤵
  PID:7264
- C:\Windows\System\KiWQetT.exe
  C:\Windows\System\KiWQetT.exe
  2⤵
  PID:7280
- C:\Windows\System\bfuNdPA.exe
  C:\Windows\System\bfuNdPA.exe
  2⤵
  PID:7296
- C:\Windows\System\BiMJGXK.exe
  C:\Windows\System\BiMJGXK.exe
  2⤵
  PID:7312
- C:\Windows\System\grNLdfD.exe
  C:\Windows\System\grNLdfD.exe
  2⤵
  PID:7328
- C:\Windows\System\GgJUSHT.exe
  C:\Windows\System\GgJUSHT.exe
  2⤵
  PID:7344
- C:\Windows\System\cOFlcne.exe
  C:\Windows\System\cOFlcne.exe
  2⤵
  PID:7360
- C:\Windows\System\SgMCLVr.exe
  C:\Windows\System\SgMCLVr.exe
  2⤵
  PID:7376
- C:\Windows\System\tWezYpL.exe
  C:\Windows\System\tWezYpL.exe
  2⤵
  PID:7392
- C:\Windows\System\EXxpclr.exe
  C:\Windows\System\EXxpclr.exe
  2⤵
  PID:7408
- C:\Windows\System\PCzhBSb.exe
  C:\Windows\System\PCzhBSb.exe
  2⤵
  PID:7424
- C:\Windows\System\NJBNrlG.exe
  C:\Windows\System\NJBNrlG.exe
  2⤵
  PID:7440
- C:\Windows\System\hiVNayN.exe
  C:\Windows\System\hiVNayN.exe
  2⤵
  PID:7456
- C:\Windows\System\gTWMiIk.exe
  C:\Windows\System\gTWMiIk.exe
  2⤵
  PID:7472
- C:\Windows\System\SHVkDyP.exe
  C:\Windows\System\SHVkDyP.exe
  2⤵
  PID:7488
- C:\Windows\System\ujGINWR.exe
  C:\Windows\System\ujGINWR.exe
  2⤵
  PID:7504
- C:\Windows\System\hyqQaAq.exe
  C:\Windows\System\hyqQaAq.exe
  2⤵
  PID:7520
- C:\Windows\System\ZumWLkd.exe
  C:\Windows\System\ZumWLkd.exe
  2⤵
  PID:7536
- C:\Windows\System\zhqwSoK.exe
  C:\Windows\System\zhqwSoK.exe
  2⤵
  PID:7552
- C:\Windows\System\HmHvILZ.exe
  C:\Windows\System\HmHvILZ.exe
  2⤵
  PID:7568
- C:\Windows\System\xkCFulU.exe
  C:\Windows\System\xkCFulU.exe
  2⤵
  PID:7584
- C:\Windows\System\OMTJNjV.exe
  C:\Windows\System\OMTJNjV.exe
  2⤵
  PID:7600
- C:\Windows\System\cHyKPGm.exe
  C:\Windows\System\cHyKPGm.exe
  2⤵
  PID:7616
- C:\Windows\System\UYaHZwH.exe
  C:\Windows\System\UYaHZwH.exe
  2⤵
  PID:7632
- C:\Windows\System\gzfrsVa.exe
  C:\Windows\System\gzfrsVa.exe
  2⤵
  PID:7648
- C:\Windows\System\fQGMAvU.exe
  C:\Windows\System\fQGMAvU.exe
  2⤵
  PID:7664
- C:\Windows\System\WGJydaL.exe
  C:\Windows\System\WGJydaL.exe
  2⤵
  PID:7680
- C:\Windows\System\QFmlYxt.exe
  C:\Windows\System\QFmlYxt.exe
  2⤵
  PID:7696
- C:\Windows\System\iYMYkdg.exe
  C:\Windows\System\iYMYkdg.exe
  2⤵
  PID:7712
- C:\Windows\System\pVzoFPR.exe
  C:\Windows\System\pVzoFPR.exe
  2⤵
  PID:7728
- C:\Windows\System\zWzhXeX.exe
  C:\Windows\System\zWzhXeX.exe
  2⤵
  PID:7744
- C:\Windows\System\onUjznD.exe
  C:\Windows\System\onUjznD.exe
  2⤵
  PID:7760
- C:\Windows\System\QzogREU.exe
  C:\Windows\System\QzogREU.exe
  2⤵
  PID:7776
- C:\Windows\System\usDbORy.exe
  C:\Windows\System\usDbORy.exe
  2⤵
  PID:7792
- C:\Windows\System\SkpYgzD.exe
  C:\Windows\System\SkpYgzD.exe
  2⤵
  PID:7808
- C:\Windows\System\TbZrabA.exe
  C:\Windows\System\TbZrabA.exe
  2⤵
  PID:7824
- C:\Windows\System\zBRnVRX.exe
  C:\Windows\System\zBRnVRX.exe
  2⤵
  PID:7840
- C:\Windows\System\gcDEJXn.exe
  C:\Windows\System\gcDEJXn.exe
  2⤵
  PID:7856
- C:\Windows\System\XkxwkXP.exe
  C:\Windows\System\XkxwkXP.exe
  2⤵
  PID:7872
- C:\Windows\System\LpNvWlh.exe
  C:\Windows\System\LpNvWlh.exe
  2⤵
  PID:7888
- C:\Windows\System\BNGHlst.exe
  C:\Windows\System\BNGHlst.exe
  2⤵
  PID:7904
- C:\Windows\System\ZgEkbbf.exe
  C:\Windows\System\ZgEkbbf.exe
  2⤵
  PID:7924
- C:\Windows\System\oVPMsbh.exe
  C:\Windows\System\oVPMsbh.exe
  2⤵
  PID:7940
- C:\Windows\System\VlZDSGB.exe
  C:\Windows\System\VlZDSGB.exe
  2⤵
  PID:7956
- C:\Windows\System\JzYnNvw.exe
  C:\Windows\System\JzYnNvw.exe
  2⤵
  PID:7972
- C:\Windows\System\gQTQgbY.exe
  C:\Windows\System\gQTQgbY.exe
  2⤵
  PID:7988
- C:\Windows\System\enEZsQH.exe
  C:\Windows\System\enEZsQH.exe
  2⤵
  PID:8004
- C:\Windows\System\ZTeZJdu.exe
  C:\Windows\System\ZTeZJdu.exe
  2⤵
  PID:8020
- C:\Windows\System\fDxqWfo.exe
  C:\Windows\System\fDxqWfo.exe
  2⤵
  PID:8036
- C:\Windows\System\RNbuUST.exe
  C:\Windows\System\RNbuUST.exe
  2⤵
  PID:8052
- C:\Windows\System\PkTWLLf.exe
  C:\Windows\System\PkTWLLf.exe
  2⤵
  PID:8068
- C:\Windows\System\RUOYRoB.exe
  C:\Windows\System\RUOYRoB.exe
  2⤵
  PID:8084
- C:\Windows\System\ejFSSAy.exe
  C:\Windows\System\ejFSSAy.exe
  2⤵
  PID:8100
- C:\Windows\System\PgAeNfO.exe
  C:\Windows\System\PgAeNfO.exe
  2⤵
  PID:8116
- C:\Windows\System\yiRCIEy.exe
  C:\Windows\System\yiRCIEy.exe
  2⤵
  PID:8132
- C:\Windows\System\fCuikma.exe
  C:\Windows\System\fCuikma.exe
  2⤵
  PID:8148
- C:\Windows\System\LpMItUh.exe
  C:\Windows\System\LpMItUh.exe
  2⤵
  PID:8164
- C:\Windows\System\JOLgvEK.exe
  C:\Windows\System\JOLgvEK.exe
  2⤵
  PID:8180
- C:\Windows\System\nYvNkKi.exe
  C:\Windows\System\nYvNkKi.exe
  2⤵
  PID:6876
- C:\Windows\System\SKOtqjC.exe
  C:\Windows\System\SKOtqjC.exe
  2⤵
  PID:7052
- C:\Windows\System\lZIWYyi.exe
  C:\Windows\System\lZIWYyi.exe
  2⤵
  PID:7244
- C:\Windows\System\ioHTCsX.exe
  C:\Windows\System\ioHTCsX.exe
  2⤵
  PID:7272
- C:\Windows\System\AeiNVgy.exe
  C:\Windows\System\AeiNVgy.exe
  2⤵
  PID:7000
- C:\Windows\System\wyKraik.exe
  C:\Windows\System\wyKraik.exe
  2⤵
  PID:7184
- C:\Windows\System\ItHVAlu.exe
  C:\Windows\System\ItHVAlu.exe
  2⤵
  PID:6892
- C:\Windows\System\mHJSBGQ.exe
  C:\Windows\System\mHJSBGQ.exe
  2⤵
  PID:6320
- C:\Windows\System\nyuvYBz.exe
  C:\Windows\System\nyuvYBz.exe
  2⤵
  PID:1516
- C:\Windows\System\rmReXwo.exe
  C:\Windows\System\rmReXwo.exe
  2⤵
  PID:6972
- C:\Windows\System\ysKfksG.exe
  C:\Windows\System\ysKfksG.exe
  2⤵
  PID:7224
- C:\Windows\System\vYIzoDP.exe
  C:\Windows\System\vYIzoDP.exe
  2⤵
  PID:7324
- C:\Windows\System\JaZlPEG.exe
  C:\Windows\System\JaZlPEG.exe
  2⤵
  PID:7400
- C:\Windows\System\fYNzchl.exe
  C:\Windows\System\fYNzchl.exe
  2⤵
  PID:7464
- C:\Windows\System\GRjpBOr.exe
  C:\Windows\System\GRjpBOr.exe
  2⤵
  PID:7528
- C:\Windows\System\aVAiGnw.exe
  C:\Windows\System\aVAiGnw.exe
  2⤵
  PID:7420
- C:\Windows\System\KuSUUXZ.exe
  C:\Windows\System\KuSUUXZ.exe
  2⤵
  PID:7576
- C:\Windows\System\EWjDCvw.exe
  C:\Windows\System\EWjDCvw.exe
  2⤵
  PID:7784
- C:\Windows\System\TbPjGQx.exe
  C:\Windows\System\TbPjGQx.exe
  2⤵
  PID:7676
- C:\Windows\System\KWHYcmZ.exe
  C:\Windows\System\KWHYcmZ.exe
  2⤵
  PID:7740
- C:\Windows\System\nHRSNAj.exe
  C:\Windows\System\nHRSNAj.exe
  2⤵
  PID:7816
- C:\Windows\System\WAcAeLH.exe
  C:\Windows\System\WAcAeLH.exe
  2⤵
  PID:7804
- C:\Windows\System\hBnokgh.exe
  C:\Windows\System\hBnokgh.exe
  2⤵
  PID:7912
- C:\Windows\System\aPiIODe.exe
  C:\Windows\System\aPiIODe.exe
  2⤵
  PID:7948
- C:\Windows\System\jplSnpb.exe
  C:\Windows\System\jplSnpb.exe
  2⤵
  PID:7836
- C:\Windows\System\zRZLUfs.exe
  C:\Windows\System\zRZLUfs.exe
  2⤵
  PID:8044
- C:\Windows\System\FMOsiuQ.exe
  C:\Windows\System\FMOsiuQ.exe
  2⤵
  PID:7996
- C:\Windows\System\NpRfkIe.exe
  C:\Windows\System\NpRfkIe.exe
  2⤵
  PID:8028
- C:\Windows\System\qHXPtcv.exe
  C:\Windows\System\qHXPtcv.exe
  2⤵
  PID:7932
- C:\Windows\System\zVaSnmV.exe
  C:\Windows\System\zVaSnmV.exe
  2⤵
  PID:8140
- C:\Windows\System\QMHlncp.exe
  C:\Windows\System\QMHlncp.exe
  2⤵
  PID:8096
- C:\Windows\System\bjbyDUi.exe
  C:\Windows\System\bjbyDUi.exe
  2⤵
  PID:8176
- C:\Windows\System\FZafIVd.exe
  C:\Windows\System\FZafIVd.exe
  2⤵
  PID:7236
- C:\Windows\System\PxJFSqu.exe
  C:\Windows\System\PxJFSqu.exe
  2⤵
  PID:8160
- C:\Windows\System\BnBkkOF.exe
  C:\Windows\System\BnBkkOF.exe
  2⤵
  PID:7292
- C:\Windows\System\PxAkNTs.exe
  C:\Windows\System\PxAkNTs.exe
  2⤵
  PID:7496
- C:\Windows\System\PklQBFn.exe
  C:\Windows\System\PklQBFn.exe
  2⤵
  PID:8188
- C:\Windows\System\YRovbhs.exe
  C:\Windows\System\YRovbhs.exe
  2⤵
  PID:7260
- C:\Windows\System\SuLIzVY.exe
  C:\Windows\System\SuLIzVY.exe
  2⤵
  PID:4668
- C:\Windows\System\VBLnfTJ.exe
  C:\Windows\System\VBLnfTJ.exe
  2⤵
  PID:7560
- C:\Windows\System\zUqRoYR.exe
  C:\Windows\System\zUqRoYR.exe
  2⤵
  PID:7656
- C:\Windows\System\ecHYZao.exe
  C:\Windows\System\ecHYZao.exe
  2⤵
  PID:7352
- C:\Windows\System\QyWqRjI.exe
  C:\Windows\System\QyWqRjI.exe
  2⤵
  PID:7692
- C:\Windows\System\nIacbPc.exe
  C:\Windows\System\nIacbPc.exe
  2⤵
  PID:7720
- C:\Windows\System\zzGaEZp.exe
  C:\Windows\System\zzGaEZp.exe
  2⤵
  PID:7756
- C:\Windows\System\SeJdbQu.exe
  C:\Windows\System\SeJdbQu.exe
  2⤵
  PID:7852
- C:\Windows\System\XFRxYPI.exe
  C:\Windows\System\XFRxYPI.exe
  2⤵
  PID:8012
- C:\Windows\System\cDatxME.exe
  C:\Windows\System\cDatxME.exe
  2⤵
  PID:7936
- C:\Windows\System\HciYnos.exe
  C:\Windows\System\HciYnos.exe
  2⤵
  PID:8172
- C:\Windows\System\UteipsI.exe
  C:\Windows\System\UteipsI.exe
  2⤵
  PID:7216
- C:\Windows\System\ofdyEcU.exe
  C:\Windows\System\ofdyEcU.exe
  2⤵
  PID:7276
- C:\Windows\System\okxLovE.exe
  C:\Windows\System\okxLovE.exe
  2⤵
  PID:7480
- C:\Windows\System\iZqbdle.exe
  C:\Windows\System\iZqbdle.exe
  2⤵
  PID:7196
- C:\Windows\System\QDtEHXh.exe
  C:\Windows\System\QDtEHXh.exe
  2⤵
  PID:7880
- C:\Windows\System\KUZksvc.exe
  C:\Windows\System\KUZksvc.exe
  2⤵
  PID:7544
- C:\Windows\System\lbECIda.exe
  C:\Windows\System\lbECIda.exe
  2⤵
  PID:7772
- C:\Windows\System\rlUgdxb.exe
  C:\Windows\System\rlUgdxb.exe
  2⤵
  PID:8080
- C:\Windows\System\FAZPfKO.exe
  C:\Windows\System\FAZPfKO.exe
  2⤵
  PID:7240
- C:\Windows\System\DPZrXus.exe
  C:\Windows\System\DPZrXus.exe
  2⤵
  PID:7580
- C:\Windows\System\yktJhAg.exe
  C:\Windows\System\yktJhAg.exe
  2⤵
  PID:7708
- C:\Windows\System\EKcZnvo.exe
  C:\Windows\System\EKcZnvo.exe
  2⤵
  PID:7020
- C:\Windows\System\kuclZfQ.exe
  C:\Windows\System\kuclZfQ.exe
  2⤵
  PID:7848
- C:\Windows\System\MnSiiVu.exe
  C:\Windows\System\MnSiiVu.exe
  2⤵
  PID:7896
- C:\Windows\System\XPnyBfb.exe
  C:\Windows\System\XPnyBfb.exe
  2⤵
  PID:7644
- C:\Windows\System\GtXjfls.exe
  C:\Windows\System\GtXjfls.exe
  2⤵
  PID:7368
- C:\Windows\System\UBjGIAw.exe
  C:\Windows\System\UBjGIAw.exe
  2⤵
  PID:7564
- C:\Windows\System\SrvaMeL.exe
  C:\Windows\System\SrvaMeL.exe
  2⤵
  PID:7612
- C:\Windows\System\lJZfvOx.exe
  C:\Windows\System\lJZfvOx.exe
  2⤵
  PID:7624
- C:\Windows\System\GZrpeGm.exe
  C:\Windows\System\GZrpeGm.exe
  2⤵
  PID:8208
- C:\Windows\System\QEuOjZX.exe
  C:\Windows\System\QEuOjZX.exe
  2⤵
  PID:8224
- C:\Windows\System\mOpCnKi.exe
  C:\Windows\System\mOpCnKi.exe
  2⤵
  PID:8240
- C:\Windows\System\JvBMvVJ.exe
  C:\Windows\System\JvBMvVJ.exe
  2⤵
  PID:8256
- C:\Windows\System\RuBQqkU.exe
  C:\Windows\System\RuBQqkU.exe
  2⤵
  PID:8276
- C:\Windows\System\MHYmgVe.exe
  C:\Windows\System\MHYmgVe.exe
  2⤵
  PID:8292
- C:\Windows\System\TRTAETc.exe
  C:\Windows\System\TRTAETc.exe
  2⤵
  PID:8308
- C:\Windows\System\ujlXeLk.exe
  C:\Windows\System\ujlXeLk.exe
  2⤵
  PID:8324
- C:\Windows\System\aFrGYLO.exe
  C:\Windows\System\aFrGYLO.exe
  2⤵
  PID:8340
- C:\Windows\System\EnoBvea.exe
  C:\Windows\System\EnoBvea.exe
  2⤵
  PID:8360
- C:\Windows\System\ZDMOLXJ.exe
  C:\Windows\System\ZDMOLXJ.exe
  2⤵
  PID:8376
- C:\Windows\System\oWZrTzM.exe
  C:\Windows\System\oWZrTzM.exe
  2⤵
  PID:8392
- C:\Windows\System\HvpFDHB.exe
  C:\Windows\System\HvpFDHB.exe
  2⤵
  PID:8408
- C:\Windows\System\xwvQdoX.exe
  C:\Windows\System\xwvQdoX.exe
  2⤵
  PID:8428
- C:\Windows\System\oFmzHcQ.exe
  C:\Windows\System\oFmzHcQ.exe
  2⤵
  PID:8444
- C:\Windows\System\febGRMT.exe
  C:\Windows\System\febGRMT.exe
  2⤵
  PID:8468
- C:\Windows\System\pDSFELR.exe
  C:\Windows\System\pDSFELR.exe
  2⤵
  PID:8492
- C:\Windows\System\tpoccyn.exe
  C:\Windows\System\tpoccyn.exe
  2⤵
  PID:8516
- C:\Windows\System\vlawGYB.exe
  C:\Windows\System\vlawGYB.exe
  2⤵
  PID:8536
- C:\Windows\System\OkXGrvC.exe
  C:\Windows\System\OkXGrvC.exe
  2⤵
  PID:8640
- C:\Windows\System\cvUTLZG.exe
  C:\Windows\System\cvUTLZG.exe
  2⤵
  PID:8656
- C:\Windows\System\YSCFVQX.exe
  C:\Windows\System\YSCFVQX.exe
  2⤵
  PID:8672
- C:\Windows\System\GIzLwUk.exe
  C:\Windows\System\GIzLwUk.exe
  2⤵
  PID:8692
- C:\Windows\System\OAxbrZQ.exe
  C:\Windows\System\OAxbrZQ.exe
  2⤵
  PID:8708
- C:\Windows\System\IHGYGMG.exe
  C:\Windows\System\IHGYGMG.exe
  2⤵
  PID:8724
- C:\Windows\System\yXDcWFX.exe
  C:\Windows\System\yXDcWFX.exe
  2⤵
  PID:8740
- C:\Windows\System\ffsHbqh.exe
  C:\Windows\System\ffsHbqh.exe
  2⤵
  PID:8760
- C:\Windows\System\iiqQsaa.exe
  C:\Windows\System\iiqQsaa.exe
  2⤵
  PID:8776
- C:\Windows\System\TFdCCsT.exe
  C:\Windows\System\TFdCCsT.exe
  2⤵
  PID:8792
- C:\Windows\System\pmCrwLN.exe
  C:\Windows\System\pmCrwLN.exe
  2⤵
  PID:8808
- C:\Windows\System\RnaYrwB.exe
  C:\Windows\System\RnaYrwB.exe
  2⤵
  PID:8824
- C:\Windows\System\EzwDkvd.exe
  C:\Windows\System\EzwDkvd.exe
  2⤵
  PID:8840
- C:\Windows\System\vZQoFLa.exe
  C:\Windows\System\vZQoFLa.exe
  2⤵
  PID:8856
- C:\Windows\System\MaEEJxs.exe
  C:\Windows\System\MaEEJxs.exe
  2⤵
  PID:8872
- C:\Windows\System\XiBfSCp.exe
  C:\Windows\System\XiBfSCp.exe
  2⤵
  PID:8888
- C:\Windows\System\JpXYFTb.exe
  C:\Windows\System\JpXYFTb.exe
  2⤵
  PID:8904
- C:\Windows\System\VdzlpMc.exe
  C:\Windows\System\VdzlpMc.exe
  2⤵
  PID:8920
- C:\Windows\System\PLMnfwS.exe
  C:\Windows\System\PLMnfwS.exe
  2⤵
  PID:8936
- C:\Windows\System\GnIpXfk.exe
  C:\Windows\System\GnIpXfk.exe
  2⤵
  PID:8952
- C:\Windows\System\xtzmmLt.exe
  C:\Windows\System\xtzmmLt.exe
  2⤵
  PID:8968
- C:\Windows\System\UqcRCNa.exe
  C:\Windows\System\UqcRCNa.exe
  2⤵
  PID:8984
- C:\Windows\System\OPznJwb.exe
  C:\Windows\System\OPznJwb.exe
  2⤵
  PID:9000
- C:\Windows\System\bzDhEaI.exe
  C:\Windows\System\bzDhEaI.exe
  2⤵
  PID:9016
- C:\Windows\System\wuROBLP.exe
  C:\Windows\System\wuROBLP.exe
  2⤵
  PID:9032
- C:\Windows\System\foQXebc.exe
  C:\Windows\System\foQXebc.exe
  2⤵
  PID:9048
- C:\Windows\System\MHWwURQ.exe
  C:\Windows\System\MHWwURQ.exe
  2⤵
  PID:9064
- C:\Windows\System\vyHRFTT.exe
  C:\Windows\System\vyHRFTT.exe
  2⤵
  PID:9080
- C:\Windows\System\pdfNjPs.exe
  C:\Windows\System\pdfNjPs.exe
  2⤵
  PID:9096
- C:\Windows\System\aCaynrw.exe
  C:\Windows\System\aCaynrw.exe
  2⤵
  PID:9112
- C:\Windows\System\UsBXmLz.exe
  C:\Windows\System\UsBXmLz.exe
  2⤵
  PID:9128
- C:\Windows\System\fvowaDU.exe
  C:\Windows\System\fvowaDU.exe
  2⤵
  PID:9144
- C:\Windows\System\tvifKCc.exe
  C:\Windows\System\tvifKCc.exe
  2⤵
  PID:9160
- C:\Windows\System\pPdYsfJ.exe
  C:\Windows\System\pPdYsfJ.exe
  2⤵
  PID:9176
- C:\Windows\System\guMhqMD.exe
  C:\Windows\System\guMhqMD.exe
  2⤵
  PID:9192
- C:\Windows\System\fyjUedK.exe
  C:\Windows\System\fyjUedK.exe
  2⤵
  PID:9208
- C:\Windows\System\KxdLYsu.exe
  C:\Windows\System\KxdLYsu.exe
  2⤵
  PID:8216
- C:\Windows\System\GuPENUt.exe
  C:\Windows\System\GuPENUt.exe
  2⤵
  PID:8284
- C:\Windows\System\NIMInBy.exe
  C:\Windows\System\NIMInBy.exe
  2⤵
  PID:8316
- C:\Windows\System\QmMfItB.exe
  C:\Windows\System\QmMfItB.exe
  2⤵
  PID:7900
- C:\Windows\System\NEMoZNr.exe
  C:\Windows\System\NEMoZNr.exe
  2⤵
  PID:8348
- C:\Windows\System\PYmXNzn.exe
  C:\Windows\System\PYmXNzn.exe
  2⤵
  PID:8388
- C:\Windows\System\dMoZGgb.exe
  C:\Windows\System\dMoZGgb.exe
  2⤵
  PID:8452
- C:\Windows\System\IsXHlnG.exe
  C:\Windows\System\IsXHlnG.exe
  2⤵
  PID:8300
- C:\Windows\System\vDXBZkg.exe
  C:\Windows\System\vDXBZkg.exe
  2⤵
  PID:7864
- C:\Windows\System\gVVVlLw.exe
  C:\Windows\System\gVVVlLw.exe
  2⤵
  PID:8232
- C:\Windows\System\VJnJWCt.exe
  C:\Windows\System\VJnJWCt.exe
  2⤵
  PID:8484
- C:\Windows\System\pejWuyQ.exe
  C:\Windows\System\pejWuyQ.exe
  2⤵
  PID:8548
- C:\Windows\System\RzybOhw.exe
  C:\Windows\System\RzybOhw.exe
  2⤵
  PID:8572
- C:\Windows\System\ZoLSFFl.exe
  C:\Windows\System\ZoLSFFl.exe
  2⤵
  PID:8588
- C:\Windows\System\CTDAoJb.exe
  C:\Windows\System\CTDAoJb.exe
  2⤵
  PID:8668
- C:\Windows\System\xNeNXci.exe
  C:\Windows\System\xNeNXci.exe
  2⤵
  PID:8528
- C:\Windows\System\yymDBCu.exe
  C:\Windows\System\yymDBCu.exe
  2⤵
  PID:8768
- C:\Windows\System\TcuAHTx.exe
  C:\Windows\System\TcuAHTx.exe
  2⤵
  PID:8800
- C:\Windows\System\iOMPcxK.exe
  C:\Windows\System\iOMPcxK.exe
  2⤵
  PID:7628
- C:\Windows\System\OdLRcjH.exe
  C:\Windows\System\OdLRcjH.exe
  2⤵
  PID:8748
- C:\Windows\System\RDCBadn.exe
  C:\Windows\System\RDCBadn.exe
  2⤵
  PID:8788
- C:\Windows\System\CeHRHqV.exe
  C:\Windows\System\CeHRHqV.exe
  2⤵
  PID:8864
- C:\Windows\System\FRLvQyI.exe
  C:\Windows\System\FRLvQyI.exe
  2⤵
  PID:8880
- C:\Windows\System\SqvCXKL.exe
  C:\Windows\System\SqvCXKL.exe
  2⤵
  PID:8932
- C:\Windows\System\ewKzDOT.exe
  C:\Windows\System\ewKzDOT.exe
  2⤵
  PID:8996
- C:\Windows\System\omYsSkS.exe
  C:\Windows\System\omYsSkS.exe
  2⤵
  PID:9056
- C:\Windows\System\AZIOBaj.exe
  C:\Windows\System\AZIOBaj.exe
  2⤵
  PID:9120
- C:\Windows\System\bmxtYQy.exe
  C:\Windows\System\bmxtYQy.exe
  2⤵
  PID:9156
- C:\Windows\System\XlatuoK.exe
  C:\Windows\System\XlatuoK.exe
  2⤵
  PID:9044
- C:\Windows\System\fyGnoxO.exe
  C:\Windows\System\fyGnoxO.exe
  2⤵
  PID:8976
- C:\Windows\System\IFrDGEH.exe
  C:\Windows\System\IFrDGEH.exe
  2⤵
  PID:9104
- C:\Windows\System\LXlSVBr.exe
  C:\Windows\System\LXlSVBr.exe
  2⤵
  PID:9168
- C:\Windows\System\VwFOnVn.exe
  C:\Windows\System\VwFOnVn.exe
  2⤵
  PID:7688
- C:\Windows\System\eDaxAGR.exe
  C:\Windows\System\eDaxAGR.exe
  2⤵
  PID:8264
- C:\Windows\System\RvCkEmU.exe
  C:\Windows\System\RvCkEmU.exe
  2⤵
  PID:8128
- C:\Windows\System\HLDfasu.exe
  C:\Windows\System\HLDfasu.exe
  2⤵
  PID:8272
- C:\Windows\System\eVWvEnm.exe
  C:\Windows\System\eVWvEnm.exe
  2⤵
  PID:8064
- C:\Windows\System\LSUIUvr.exe
  C:\Windows\System\LSUIUvr.exe
  2⤵
  PID:8304
- C:\Windows\System\xcbYCLw.exe
  C:\Windows\System\xcbYCLw.exe
  2⤵
  PID:8336
- C:\Windows\System\cKNZrEY.exe
  C:\Windows\System\cKNZrEY.exe
  2⤵
  PID:8504
- C:\Windows\System\KCDdkDT.exe
  C:\Windows\System\KCDdkDT.exe
  2⤵
  PID:8476
- C:\Windows\System\XHdkvGM.exe
  C:\Windows\System\XHdkvGM.exe
  2⤵
  PID:8568
- C:\Windows\System\tvyxhbU.exe
  C:\Windows\System\tvyxhbU.exe
  2⤵
  PID:8684
- C:\Windows\System\dMbZFvv.exe
  C:\Windows\System\dMbZFvv.exe
  2⤵
  PID:8784
- C:\Windows\System\UoppxUE.exe
  C:\Windows\System\UoppxUE.exe
  2⤵
  PID:8524
- C:\Windows\System\aHCHJAA.exe
  C:\Windows\System\aHCHJAA.exe
  2⤵
  PID:8532
- C:\Windows\System\bjAJGWx.exe
  C:\Windows\System\bjAJGWx.exe
  2⤵
  PID:8384
- C:\Windows\System\gjQVrBy.exe
  C:\Windows\System\gjQVrBy.exe
  2⤵
  PID:8400
- C:\Windows\System\NnwyoCk.exe
  C:\Windows\System\NnwyoCk.exe
  2⤵
  PID:8500
- C:\Windows\System\NZXdDen.exe
  C:\Windows\System\NZXdDen.exe
  2⤵
  PID:8852
- C:\Windows\System\hohGNFK.exe
  C:\Windows\System\hohGNFK.exe
  2⤵
  PID:8456
- C:\Windows\System\JGwnMkC.exe
  C:\Windows\System\JGwnMkC.exe
  2⤵
  PID:8916
- C:\Windows\System\ARBAPUW.exe
  C:\Windows\System\ARBAPUW.exe
  2⤵
  PID:8720
- C:\Windows\System\pSBUBPV.exe
  C:\Windows\System\pSBUBPV.exe
  2⤵
  PID:8704
- C:\Windows\System\PWqRbOF.exe
  C:\Windows\System\PWqRbOF.exe
  2⤵
  PID:9092
- C:\Windows\System\fdWegkB.exe
  C:\Windows\System\fdWegkB.exe
  2⤵
  PID:9040
- C:\Windows\System\dLwpTuS.exe
  C:\Windows\System\dLwpTuS.exe
  2⤵
  PID:9076
- C:\Windows\System\yXnKAeV.exe
  C:\Windows\System\yXnKAeV.exe
  2⤵
  PID:9204
- C:\Windows\System\vzCOsYo.exe
  C:\Windows\System\vzCOsYo.exe
  2⤵
  PID:8252
- C:\Windows\System\CLKDICK.exe
  C:\Windows\System\CLKDICK.exe
  2⤵
  PID:9140
- C:\Windows\System\OApFuRJ.exe
  C:\Windows\System\OApFuRJ.exe
  2⤵
  PID:9232
- C:\Windows\System\yjcbOJn.exe
  C:\Windows\System\yjcbOJn.exe
  2⤵
  PID:9248
- C:\Windows\System\VWeCVym.exe
  C:\Windows\System\VWeCVym.exe
  2⤵
  PID:9272
- C:\Windows\System\oJtakae.exe
  C:\Windows\System\oJtakae.exe
  2⤵
  PID:9288
- C:\Windows\System\coRLvsC.exe
  C:\Windows\System\coRLvsC.exe
  2⤵
  PID:9308
- C:\Windows\System\UKIYYKd.exe
  C:\Windows\System\UKIYYKd.exe
  2⤵
  PID:9324
- C:\Windows\System\GTBMcte.exe
  C:\Windows\System\GTBMcte.exe
  2⤵
  PID:9340
- C:\Windows\System\ZzleGVE.exe
  C:\Windows\System\ZzleGVE.exe
  2⤵
  PID:9356
- C:\Windows\System\bJvEoMv.exe
  C:\Windows\System\bJvEoMv.exe
  2⤵
  PID:9372
- C:\Windows\System\iEMGPyg.exe
  C:\Windows\System\iEMGPyg.exe
  2⤵
  PID:9396
- C:\Windows\System\Uehbkcs.exe
  C:\Windows\System\Uehbkcs.exe
  2⤵
  PID:9412
- C:\Windows\System\JAxUJyR.exe
  C:\Windows\System\JAxUJyR.exe
  2⤵
  PID:9428
- C:\Windows\System\uvPiidV.exe
  C:\Windows\System\uvPiidV.exe
  2⤵
  PID:9444
- C:\Windows\System\ajMOSVC.exe
  C:\Windows\System\ajMOSVC.exe
  2⤵
  PID:9460
- C:\Windows\System\dlVkzoi.exe
  C:\Windows\System\dlVkzoi.exe
  2⤵
  PID:9476
- C:\Windows\System\DbIptLj.exe
  C:\Windows\System\DbIptLj.exe
  2⤵
  PID:9496
- C:\Windows\System\keIbjnv.exe
  C:\Windows\System\keIbjnv.exe
  2⤵
  PID:9512
- C:\Windows\System\LLEMnXE.exe
  C:\Windows\System\LLEMnXE.exe
  2⤵
  PID:9532
- C:\Windows\System\OLQiNBM.exe
  C:\Windows\System\OLQiNBM.exe
  2⤵
  PID:9548
- C:\Windows\System\LVevwGy.exe
  C:\Windows\System\LVevwGy.exe
  2⤵
  PID:9564
- C:\Windows\System\FYjxzZd.exe
  C:\Windows\System\FYjxzZd.exe
  2⤵
  PID:9580
- C:\Windows\System\IqJSYRT.exe
  C:\Windows\System\IqJSYRT.exe
  2⤵
  PID:9596
- C:\Windows\System\jAmuTxJ.exe
  C:\Windows\System\jAmuTxJ.exe
  2⤵
  PID:9612
- C:\Windows\System\BayHeTH.exe
  C:\Windows\System\BayHeTH.exe
  2⤵
  PID:9628
- C:\Windows\System\zMpETwh.exe
  C:\Windows\System\zMpETwh.exe
  2⤵
  PID:9644
- C:\Windows\System\oPEQCSb.exe
  C:\Windows\System\oPEQCSb.exe
  2⤵
  PID:9660
- C:\Windows\System\uGyhzjS.exe
  C:\Windows\System\uGyhzjS.exe
  2⤵
  PID:9676
- C:\Windows\System\XSVjxxw.exe
  C:\Windows\System\XSVjxxw.exe
  2⤵
  PID:9692
- C:\Windows\System\vXULUvL.exe
  C:\Windows\System\vXULUvL.exe
  2⤵
  PID:9708
- C:\Windows\System\CVbghKX.exe
  C:\Windows\System\CVbghKX.exe
  2⤵
  PID:9724
- C:\Windows\System\AgSscki.exe
  C:\Windows\System\AgSscki.exe
  2⤵
  PID:9740
- C:\Windows\System\tequWLg.exe
  C:\Windows\System\tequWLg.exe
  2⤵
  PID:9756
- C:\Windows\System\UpJpboo.exe
  C:\Windows\System\UpJpboo.exe
  2⤵
  PID:9772
- C:\Windows\System\ZnnhQYH.exe
  C:\Windows\System\ZnnhQYH.exe
  2⤵
  PID:9788
- C:\Windows\System\WJCLTgR.exe
  C:\Windows\System\WJCLTgR.exe
  2⤵
  PID:9804
- C:\Windows\System\Amcnkuy.exe
  C:\Windows\System\Amcnkuy.exe
  2⤵
  PID:9820
- C:\Windows\System\bOkUStQ.exe
  C:\Windows\System\bOkUStQ.exe
  2⤵
  PID:9836
- C:\Windows\System\IjngdNC.exe
  C:\Windows\System\IjngdNC.exe
  2⤵
  PID:9852
- C:\Windows\System\xMNgIpk.exe
  C:\Windows\System\xMNgIpk.exe
  2⤵
  PID:9868
- C:\Windows\System\qkNBimY.exe
  C:\Windows\System\qkNBimY.exe
  2⤵
  PID:9884
- C:\Windows\System\WArrZop.exe
  C:\Windows\System\WArrZop.exe
  2⤵
  PID:9900
- C:\Windows\System\FWZoyRk.exe
  C:\Windows\System\FWZoyRk.exe
  2⤵
  PID:9916
- C:\Windows\System\LtGLsDJ.exe
  C:\Windows\System\LtGLsDJ.exe
  2⤵
  PID:9932
- C:\Windows\System\IURDGym.exe
  C:\Windows\System\IURDGym.exe
  2⤵
  PID:9948
- C:\Windows\System\XjRFgee.exe
  C:\Windows\System\XjRFgee.exe
  2⤵
  PID:9964
- C:\Windows\System\ovStXDW.exe
  C:\Windows\System\ovStXDW.exe
  2⤵
  PID:9980
- C:\Windows\System\tstTUCa.exe
  C:\Windows\System\tstTUCa.exe
  2⤵
  PID:9996
- C:\Windows\System\Ocfdxvz.exe
  C:\Windows\System\Ocfdxvz.exe
  2⤵
  PID:10012
- C:\Windows\System\oAUvUmx.exe
  C:\Windows\System\oAUvUmx.exe
  2⤵
  PID:10028
- C:\Windows\System\NIRAirW.exe
  C:\Windows\System\NIRAirW.exe
  2⤵
  PID:10044
- C:\Windows\System\VRDedMM.exe
  C:\Windows\System\VRDedMM.exe
  2⤵
  PID:10060
- C:\Windows\System\qfgZJcY.exe
  C:\Windows\System\qfgZJcY.exe
  2⤵
  PID:10076
- C:\Windows\System\fEzejhr.exe
  C:\Windows\System\fEzejhr.exe
  2⤵
  PID:10092
- C:\Windows\System\eIUuVga.exe
  C:\Windows\System\eIUuVga.exe
  2⤵
  PID:10108
- C:\Windows\System\MwBJnFF.exe
  C:\Windows\System\MwBJnFF.exe
  2⤵
  PID:10124
- C:\Windows\System\BLsMQus.exe
  C:\Windows\System\BLsMQus.exe
  2⤵
  PID:10140
- C:\Windows\System\csuzLqY.exe
  C:\Windows\System\csuzLqY.exe
  2⤵
  PID:10156
- C:\Windows\System\COOAFmQ.exe
  C:\Windows\System\COOAFmQ.exe
  2⤵
  PID:10172
- C:\Windows\System\zWIwCXv.exe
  C:\Windows\System\zWIwCXv.exe
  2⤵
  PID:10188
- C:\Windows\System\XnqqJia.exe
  C:\Windows\System\XnqqJia.exe
  2⤵
  PID:10204
- C:\Windows\System\wfogLpu.exe
  C:\Windows\System\wfogLpu.exe
  2⤵
  PID:10220
- C:\Windows\System\eHoibnt.exe
  C:\Windows\System\eHoibnt.exe
  2⤵
  PID:10236
- C:\Windows\System\rDcqUqJ.exe
  C:\Windows\System\rDcqUqJ.exe
  2⤵
  PID:8560
- C:\Windows\System\npDZWRB.exe
  C:\Windows\System\npDZWRB.exe
  2⤵
  PID:8992
- C:\Windows\System\vklTkBd.exe
  C:\Windows\System\vklTkBd.exe
  2⤵
  PID:7356
- C:\Windows\System\ZRTJtyn.exe
  C:\Windows\System\ZRTJtyn.exe
  2⤵
  PID:9224
- C:\Windows\System\gvvNsUe.exe
  C:\Windows\System\gvvNsUe.exe
  2⤵
  PID:9264
- C:\Windows\System\ZYRhMVq.exe
  C:\Windows\System\ZYRhMVq.exe
  2⤵
  PID:9296
- C:\Windows\System\VJXujQf.exe
  C:\Windows\System\VJXujQf.exe
  2⤵
  PID:9364
- C:\Windows\System\utdQqSA.exe
  C:\Windows\System\utdQqSA.exe
  2⤵
  PID:8928
- C:\Windows\System\spHVLjq.exe
  C:\Windows\System\spHVLjq.exe
  2⤵
  PID:8204
- C:\Windows\System\NKkAolN.exe
  C:\Windows\System\NKkAolN.exe
  2⤵
  PID:8268
- C:\Windows\System\piGIwAu.exe
  C:\Windows\System\piGIwAu.exe
  2⤵
  PID:9388
- C:\Windows\System\vaNsKIR.exe
  C:\Windows\System\vaNsKIR.exe
  2⤵
  PID:9468
- C:\Windows\System\mhcICkZ.exe
  C:\Windows\System\mhcICkZ.exe
  2⤵
  PID:7388
- C:\Windows\System\fZjamDH.exe
  C:\Windows\System\fZjamDH.exe
  2⤵
  PID:9540
- C:\Windows\System\cZfRkii.exe
  C:\Windows\System\cZfRkii.exe
  2⤵
  PID:9576
- C:\Windows\System\YWoPWgT.exe
  C:\Windows\System\YWoPWgT.exe
  2⤵
  PID:9604
- C:\Windows\System\OCoNTgq.exe
  C:\Windows\System\OCoNTgq.exe
  2⤵
  PID:9700
- C:\Windows\System\SJIPYKT.exe
  C:\Windows\System\SJIPYKT.exe
  2⤵
  PID:9764
- C:\Windows\System\ohIbvmZ.exe
  C:\Windows\System\ohIbvmZ.exe
  2⤵
  PID:9800
- C:\Windows\System\joRcmwg.exe
  C:\Windows\System\joRcmwg.exe
  2⤵
  PID:9892
- C:\Windows\System\lKVeqga.exe
  C:\Windows\System\lKVeqga.exe
  2⤵
  PID:9956
- C:\Windows\System\hcHWEOC.exe
  C:\Windows\System\hcHWEOC.exe
  2⤵
  PID:10020
- C:\Windows\System\DjCpWom.exe
  C:\Windows\System\DjCpWom.exe
  2⤵
  PID:10084
- C:\Windows\System\JFexQAE.exe
  C:\Windows\System\JFexQAE.exe
  2⤵
  PID:9684
- C:\Windows\System\ofgitzL.exe
  C:\Windows\System\ofgitzL.exe
  2⤵
  PID:9880
- C:\Windows\System\mgHDkLY.exe
  C:\Windows\System\mgHDkLY.exe
  2⤵
  PID:9624
- C:\Windows\System\mExfuJn.exe
  C:\Windows\System\mExfuJn.exe
  2⤵
  PID:9780
- C:\Windows\System\sikVqoW.exe
  C:\Windows\System\sikVqoW.exe
  2⤵
  PID:10120
- C:\Windows\System\KSkVeDU.exe
  C:\Windows\System\KSkVeDU.exe
  2⤵
  PID:9976
- C:\Windows\System\VPLcSGZ.exe
  C:\Windows\System\VPLcSGZ.exe
  2⤵
  PID:9528
- C:\Windows\System\SkWBecp.exe
  C:\Windows\System\SkWBecp.exe
  2⤵
  PID:10068
- C:\Windows\System\kHrtbSf.exe
  C:\Windows\System\kHrtbSf.exe
  2⤵
  PID:10104

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\ATzOdET.exe

Filesize
1.4MB

MD5
c8d6aec124963e78cc291760b9dc75dd

SHA1
9681e997b07c1eeb57afe0cf1f53fc6e78b1f2c4

SHA256
b81e4bfc3a6bb024a6e468edb82538edf7d5e996ba71dbc2d3611775b9f5c4c7

SHA512
f926c23748d9c02d3f386135121823378e4d8ac4149bc6bba9e3b63eb2805f2b4ef6ab5126730c3a9fe21594490774521487c762b622502fdd9f4f64ea529471

Download Submit
C:\Windows\system\DTgIUlm.exe

Filesize
1.4MB

MD5
3c5c328449164ea1ffcb684dd8872a81

SHA1
302847959c867245330138ed83fe04fdc17beec6

SHA256
ac2d52ade07ddb60d7a9eeafcf27d59ecd24c5b8cdbca4fada8374a584eb74bf

SHA512
9c7df8526b59c22652b3e4f4e4e076a37ab4739456a420d1858a1747798a6ee9cf33aaa2da4ff46db7fb32e02730efba9dde7217465102f2404927ff9b2faba1

Download Submit
C:\Windows\system\DWUnOOS.exe

Filesize
1.4MB

MD5
3e85d662b77852549294917d53d1a9f7

SHA1
623b37ee71ddccff1229fb3f700f21810f74b8ff

SHA256
f7aba4e5d8b93465334cb7c78dd0c05afd1e38a313f88ebb683bd1d0436a6650

SHA512
75702fcf111c1af1b29017cca53f3029284a497ac75b23a14a12363174f9ae6b8d66b3146a7d2d36ca100229497845ea5204f1460855fa4532e575eddd33c2c7

Download Submit
C:\Windows\system\GDuulhX.exe

Filesize
1.4MB

MD5
07a47e93db5501d96ff21274df6b4501

SHA1
f34fe94350016042a6af6fb209468239262c114c

SHA256
ba27531e91cbd072a11bd69f53ddd028f6f9deb6d0b285dea145c92d4149d685

SHA512
a5d686c4e0569f40783f42bf76af7cdba41c1ef08ef40f59824ed1d061e22bf5cfcb52160404feaa8945a7f699a3b216b8230262debc4b17ae5cd819dec10c9e

Download Submit
C:\Windows\system\JImbxcQ.exe

Filesize
1.4MB

MD5
4c33b26b9c2ced096a438699e763e38a

SHA1
fb69880e266a7eac835053ddf9a0de4e3ab12653

SHA256
6e37c71b1ee77a498f2e0334b0b2caa976b42dc1186d993d310d727f1cb0e834

SHA512
e8c6ff58812c4af8b36d105c00046e0a1d1ac0281e85c4cf8cd3f2582ceff5bcc0a217bd92e186351b5cac586b724de109d78288db2f4e2a3dfa07f937977f3e

Download Submit
C:\Windows\system\MbFMzJV.exe

Filesize
1.4MB

MD5
ff3e950f8414681b92481475e8b5747d

SHA1
adf97c4fb7eb71790d164401f46d2b99f5064d11

SHA256
a728c00233a3c4cbac0a26ff13f9b06d5bcd2a00dc4343bf8dbb6ce3df5c07be

SHA512
2a6cdf225a98485249cdc84d12a6c3dbf5af807442aca7537cf2cfbd5461f4832872d23ce09cd51e54344cdac7c65e5de99c8b57e88cf65018fe9afb63212d0a

Download Submit
C:\Windows\system\NyKkjUi.exe

Filesize
18B

MD5
a849770cdd0a45de9e67ffe42c9fe77d

SHA1
e7381e1e8fa920a5334a803a631ad14bde45510b

SHA256
4c57fa411fb0fbf4ace47664e14ff0b63c1e0961d923dc12158473549e784ee5

SHA512
7d9b04aa670b2f562b0080f83b20f44bb87724e95d2f128837ed7ad74330d10ce8d4d038dd9cba367fb3aeabc8a9597bebc322371306a7bcb489bdc53f804b3f

Download Submit
C:\Windows\system\TgcYkih.exe

Filesize
1.4MB

MD5
f960495225f67e9f9e6d991d7abb848e

SHA1
c7e25c698cf891dc3d8cd097872925ba6cdfd718

SHA256
a62eeb90d08feb22e47808792f8b56c60ad49f126523ed120bd54ae9fde01b5c

SHA512
c953861bc32e295b9ad2bbae42dd50378ab266f7b5f67b8d52481e51affc3302f4b58535f2106782e6b1a090c53807d9d73b66f07dc4aa1a180febf2adaae208

Download Submit
C:\Windows\system\VAgTAwR.exe

Filesize
1.4MB

MD5
1d3ffba825d966a2c011ec48842b0a97

SHA1
1dd4d3aef997e2ddebffbf79d85544c5db14346a

SHA256
73da324b576218b400f85905f04904fd9d85bade4af68ae79220ef90d3eca94d

SHA512
840308f9b421c450b535e79b955a68a42ae94b73199edf07ffc7f9afc375248533bd932624cc884111f02259e4467e6336681bf935b44bae377bb02fd1092c38

Download Submit
C:\Windows\system\XzOQXHJ.exe

Filesize
1.4MB

MD5
9923d7f1906140afbc5e5abd3b605a25

SHA1
c68efc53f42a332f4be17c99750a4b0a43052f08

SHA256
d01c48ac9756986492abd4e3feb4b60ccffe52e96193ab75a4282da5846b1f0e

SHA512
363be0d5dedef03afeccdef60d3d7869b8b1216f55a0b2784b09b87f3b7438873f58a71d70ad30f875b9a01c5118484679bf059ffd18872984dfd08394d283ca

Download Submit
C:\Windows\system\ZBzzDpt.exe

Filesize
1.4MB

MD5
44ec1ba5100cdbbadd3a90f7da2e52b5

SHA1
286433ae82ffdcfe938dfea2a2273b35801d25e8

SHA256
06d77dc5552722ef32c7e3450a5e28cc72293962bc75f0e62b7d82b2658030e7

SHA512
e22372ca02857dc0a9a1a3ea5d3f161bcee141f5825b4f2c3efcaf33dc85ded5bc25b021a98446ca6ea91ec80c61b59066b0ad0cf6bb1c983f34b6d9e5d9ece3

Download Submit
C:\Windows\system\ZFWZgqZ.exe

Filesize
1.4MB

MD5
4c3acefdee93575d01526981e0a3df9d

SHA1
3c33d003b5289362a015e4eb51224fd1f8e671a4

SHA256
9d1f302ccb5a76a1c768e6c8dc703eb75fe9008007c9ad9eb38b0e427c213dd0

SHA512
b87a1bde1385feed892dee24b993a88202d1281bc82450088ece67aaac9d83fa9ea826c8d63c9bf970e2fdad11c7588e8ff16f41f92f2032366be80ff3ee04f5

Download Submit
C:\Windows\system\angIqPP.exe

Filesize
1.4MB

MD5
73d32abf32dc6eeec3f52a8233e848e0

SHA1
24c71b74823d3872ff5a6b70bec684b56fd0082f

SHA256
3f97b45e059e158259e94867906ad474e985bada93e4578107e585bef186a612

SHA512
2158ed65e5932611408d03d00d2774ea92a6de8002e441a9db18cab07538a3774c16e4f8e903eb41a0cc8045ddb6fe15e7199bae2e98ad51d6409944581d4a54

Download Submit
C:\Windows\system\cBeAOhz.exe

Filesize
1.4MB

MD5
b0088d8fddf3997820ea03d73e2c72ad

SHA1
ce113199a59246898bd34c8c7669a9196ce161a3

SHA256
f14d716541df6f29fb6b689baaa2de2721cd5a1b46bf21b462f6614783901b4b

SHA512
f350846478cd23dab188d12a789a0b4a1c2eca995defa85bc600c14d2b51600f4293da924b0aa77d02cf3905896b598677783599e67d96931fc5f21f38942cb5

Download Submit
C:\Windows\system\fndkylg.exe

Filesize
1.4MB

MD5
1ec381d1924a87e66c527d9bdc6cdaba

SHA1
539e43d1acb175e01a52b005f812ce0367687004

SHA256
d3529382e3b30aa1e3696ebd5bef47d30c36825fd21343e7f1822b795242a995

SHA512
d46abb690e7d2682f45e7273f947ae440649ad109082d3e5ced2ae4c2059032c20e855168f953494cfa18a4ad066d6d4504999cce6e3ae8366e6ede063cfdc13

Download Submit
C:\Windows\system\fxLWGUv.exe

Filesize
1.4MB

MD5
17473983936a6234fed90e3487a6d793

SHA1
1adc0a3bc9f7a7b1aaa0e68f07e114006142497e

SHA256
b79bba23779aa3eb4d6c84116ea208d77c4e27f5df8125a265e6f2b2c8cf5159

SHA512
3b944bc8512d7e534e67573cbfe6fcd02042ee5731c09bff53ce96701de39d6fb87c21d1d62ee7d9e7de569c7d8ec537f78ab8e94b47d62a979596b33289b726

Download Submit
C:\Windows\system\hccyXvn.exe

Filesize
1.4MB

MD5
a6c51bc865e528544566506f85b79742

SHA1
fbbea51f865ccd9196fa70547d1e9be1d47a4953

SHA256
8a567ae187f8597a0136200c7754357ebf2598dcfaf46542e21a26e2ebb5462e

SHA512
dc97368b585834453feb565b4a7e3696eb78bb345978871d4c305b0ad43be166f24884520c37cc20ff91da6938b70abcfabac5287dd72ad0fd87956624310cbf

Download Submit
C:\Windows\system\jLrrQmm.exe

Filesize
1.4MB

MD5
12205c7ff42869a51c3872b7ac51885e

SHA1
8c12337626bdd11f7e4013d6385ed46a6f4e6f01

SHA256
c51369326183b3e28578a9cc654c490ac49abc1ed82825209393c359aacc9578

SHA512
d4baa4dd71e8b56aa457f9c14c4353442776d827e8625b2b510227234f449064947b460fe83bb36ed2e3be8df75e25676872fe6341e3035e482cd863f22ed657

Download Submit
C:\Windows\system\kocXOHN.exe

Filesize
1.4MB

MD5
d8df7a2a7891b05022ea6fd4056f4c41

SHA1
920b9e0335d5a6afe7411601c1a8fd8a832b736c

SHA256
a3ae67e7325da66f909259c06abade38f4ded387573bdc87cd75648c199d8a2b

SHA512
bc775db90488d73b603746b4840eaba0589c5458ba194f91eb8010bd5a7f3dcf7b12643d87db658fdb33f8b0d3ead6b158c9d9125d868c7cb18333f1a797cd9d

Download Submit
C:\Windows\system\mlKbBAz.exe

Filesize
1.4MB

MD5
9978aae8d4d875cffb8328e82ffe6c0d

SHA1
91df2512aa76a82438cb8fcd53acdfcee615537b

SHA256
5314eee55257a5449922d685fae01a25e04380906f9c77dd4688a5a79ca163fb

SHA512
5daf232866bb9cd3834154cf4619ba904d9aea5ff5eebcf444ceb51672724f25ec616ac311980f0b41febe4be97abd56d50ebdc43bdcfbb05b615546963b0d1f

Download Submit
C:\Windows\system\pAudgtK.exe

Filesize
1.4MB

MD5
faa1905ca14889d11b0aeb10a25bb53d

SHA1
895152823d883a8f08a3f7b4df5447066504151a

SHA256
dc8086224904ef42152644de878a8006bf7229a2b9d1fb29e428f8f709a6046a

SHA512
ab08c88de5043b8b132a2e329f42e12beebce58a94396fc5444f4266dacb972f6b3711c2220eb5733f67c3104d97c49f000c3fcc7a1bd5db86012d91ee35c0bf

Download Submit
C:\Windows\system\tPvFHQk.exe

Filesize
1.4MB

MD5
a942bc79a0377526c1822dd36de71be1

SHA1
307a3bda88609f9f976f1c7106f24863e800542d

SHA256
1c4eaa69bd4087a7b014a44145db0e769cdc0aba7501b6c95f245fe52132c920

SHA512
c14334c8a883f6045172d39e80e124c16e72572b141eed373348ed79a343b48c800476f2c36eb7c7df2a64d679eaf0a54528df1f204eed53e053793c9f134c56

Download Submit
C:\Windows\system\xfkSnFT.exe

Filesize
1.4MB

MD5
d49a5421d2c6d3542ebb19b9c42ba0d6

SHA1
b14738b706d7dbea65d3b98b781cd62aec13b093

SHA256
f63d96450f6c7d1ef34de9b096cafe8a4c202dc0f31ff75e92b2a64ea822aacf

SHA512
3c57a8e9ad24013dfcde4e17c7dc51bb01b8d519c1b9a16cab3176160325555373b3e65fc78640a1762468b3cb53d12ccb8bcdc9bb85653b65ddb775679d7524

Download Submit
\Windows\system\EPppTtx.exe

Filesize
1.4MB

MD5
b43973694f4dcaa93de0bddfbbe7ad24

SHA1
803b6e1bbae419c1a3d277385bdf3db2e3542e2d

SHA256
c915ee8c70647ed98542d6d78bc2735775645809923f9a9a17944b6cf816e2cd

SHA512
b12f7947b93ac807df4a670ad90f91fd184dc93751cded6e620eb4f6e93e3a08cf089c2ee7c6e62a67756a2a8ce3bcbd77a8e6b74f899280562a59fbb47204d9

Download Submit
\Windows\system\RdEKWiW.exe

Filesize
1.4MB

MD5
3814c0c71dc8809fbc0af9bcc7731fc4

SHA1
189aa4d7a3acc083fe81e70a3f6f07ef5fa2c1cd

SHA256
a1af3c8d8c5af3ad36c59afd6d6d0826a22335a89c46eac13e40e90e1e7403dc

SHA512
8b22ec0739cf56b3c2db4959ff464145575c88ad491052531c1693a6e223d73d9b845ab4f416353e442b0408e8ae1e2392d70e202a0ca610e87d0db5a0f39133

Download Submit
\Windows\system\RiqHSPp.exe

Filesize
1.4MB

MD5
a3ed6e4c27442efc013a53f787626728

SHA1
a6e63c43e8df54d45170c330eef2396112ca47f4

SHA256
410cf912d48ba847687ed268f5d29dad322e1dd312f26f70de419b3743f2ba63

SHA512
e49532c4231ce02509c659458a509fadfe34ce67c5a5cb3433f7a52e581f585707610ce0b00475e223dd79f5cc4edd56cf688fc9d807c24338c1b51535d771ab

Download Submit
\Windows\system\SvFoMLH.exe

Filesize
1.4MB

MD5
429666cea1d315ea559578f9baf905bb

SHA1
015defb766c635624074fca5df3b8aff5a4f3fcb

SHA256
026130b0e055df681f1b2fcd5b425905d906246c223136372a74b2528a2cf18a

SHA512
864f0cf59af547ef3d539c2582b142656b1b2757afef41c5f759488a98a57b5e39187529c6badc3a9b72c3ea7568ac4c93041e5debf4731a248a3f781c2b0158

Download Submit
\Windows\system\WFGiegs.exe

Filesize
1.4MB

MD5
87c096a39e0df5dd5c80f498ea0893c5

SHA1
59905330a7d65ccce26ea861ce7f1a776b17c1a2

SHA256
ed4abd7ddc8fe8cfb89a66d445a953a27609dbc6d8b835fbb0d4c0add8f7eac5

SHA512
41aa3dd61d3a34962d34ff71f710204ea2c370cd14569e7484b24acbef1261de1be6f4a2c3ab17ca96c43c24e83676683226c40b21e9d6c14855d25c83d25d4b

Download Submit
\Windows\system\WhnEiDU.exe

Filesize
1.4MB

MD5
c8b6f4e1a5efb446d1738899644ff2fe

SHA1
234f8778f6b1a0534ef49d7f51433f8bba0d7f2e

SHA256
cc3a606c581dc80739645d3b0697b14f69dbe8aadac27a3aa91d1df6b78c5ce8

SHA512
dd5f8fe25d7d778c1eb09a9a625904032ebb18a39bcc8f2c99a7c542c4d4c8fc93bb157353540e0c701a43c80de113956819512af02c37d2af4ad839220f7ef5

Download Submit
\Windows\system\XxkLLKz.exe

Filesize
1.4MB

MD5
0165271f762396022d6fe9dac29287b2

SHA1
b46d921a4a800e6dbe4c07b5f474818ffcf005ec

SHA256
cdae7e73f27298cab830cad79a36f84d1e4ec2ab88d336fd6dafef62d954f1fd

SHA512
1d81d369a6ad32c78aca9675cb255c7db7e03fb54656c409edcde448bafb25fcd67159d0ee14e4a18d21072cc67350dc1d14a3569e43522d2ab5febde68e71f9

Download Submit
\Windows\system\YNGWyhq.exe

Filesize
1.4MB

MD5
e4315417d527bc8c45476aa0aabae600

SHA1
f6f34794cf4a4b2fe31adc24f246c62ff9abcd31

SHA256
044e98bfa263c1a01b82d39980836339c86c5a79fcf3d2fb8d987e187a90cb65

SHA512
1a7260b2f4e3d9f2f0b1d200ed11e13857b07c4602ee6199eea2c85352a2b21944bc8103d82639b608af44e7e4051ee12eb8294a6447469bcdfaa9c45db1b651

Download Submit
\Windows\system\bfdTVDA.exe

Filesize
1.4MB

MD5
83fce24e2a267e32b82e9d96ffaf8be6

SHA1
928a938f00473ded300c0f1fc523760e21e1a85c

SHA256
5e7ba8d3101e2a18589f237ff74bfc734e28204ee6450f953ef6eab4ec6a1e02

SHA512
1991f640b93e6b9e19a98189d53c73b0496eeb232d32a23b0cbb96bda299d48c11b37fb6b6d4714ad9bca8e88cb74f05451154ae37abf468ab76f7e4df10a34d

Download Submit
\Windows\system\vDQvZhU.exe

Filesize
1.4MB

MD5
9db4193127e29c8c7757443b2e962869

SHA1
6bd133f1e1569ff6f767a2bcf33e5a6bbebb2100

SHA256
668867f8101e43fe0edcdabd46469d47c63eb92b1e49f80355206dc358e3827e

SHA512
13c9372e1a74190131d85082c4330a67d05d29223934433bada8f9d661495878128627b90e4e9c4ab268d3e94745cf0c473dfb1ed72b2acb18a9ca9ff9fd12df

Download Submit
\Windows\system\wIURWDl.exe

Filesize
1.4MB

MD5
d1ac3a8e0685651c4bcb371c21e8ddd6

SHA1
0896c34d0db7ecf4e40f9068d960b05615783c56

SHA256
fd4990ebb326b118f8d4397040a81e26c7e9f8e13709634d0e6c76e62b8dbc17

SHA512
36c42571331aee858a897bdc52de30d7370845479a37fc8f3e7bb7b2eb32e8bf86cb1f0217e70b375dda39cf11af8b3d891a276dee0f655d49d4fbde582e7f10

Download Submit
memory/1056-75-0x0000000001D10000-0x0000000001D18000-memory.dmp

Filesize
32KB

Download
memory/1056-61-0x000000001B610000-0x000000001B8F2000-memory.dmp

Filesize
2.9MB

Download
memory/1360-86-0x000000013F100000-0x000000013F4F2000-memory.dmp

Filesize
3.9MB

Download
memory/1360-5408-0x000000013F100000-0x000000013F4F2000-memory.dmp

Filesize
3.9MB

Download
memory/1360-5362-0x000000013F100000-0x000000013F4F2000-memory.dmp

Filesize
3.9MB

Download
memory/1472-70-0x000000013F5C0000-0x000000013F9B2000-memory.dmp

Filesize
3.9MB

Download
memory/1896-62-0x000000013F6F0000-0x000000013FAE2000-memory.dmp

Filesize
3.9MB

Download
memory/1896-5419-0x000000013F6F0000-0x000000013FAE2000-memory.dmp

Filesize
3.9MB

Download
memory/1896-1716-0x000000013F6F0000-0x000000013FAE2000-memory.dmp

Filesize
3.9MB

Download
memory/2088-49-0x0000000003190000-0x0000000003582000-memory.dmp

Filesize
3.9MB

Download
memory/2088-351-0x000000013FBE0000-0x000000013FFD2000-memory.dmp

Filesize
3.9MB

Download
memory/2088-8002-0x0000000003730000-0x0000000003B22000-memory.dmp

Filesize
3.9MB

Download
memory/2088-1-0x00000000000F0000-0x0000000000100000-memory.dmp

Filesize
64KB

Download
memory/2088-52-0x000000013F290000-0x000000013F682000-memory.dmp

Filesize
3.9MB

Download
memory/2088-69-0x000000013F5C0000-0x000000013F9B2000-memory.dmp

Filesize
3.9MB

Download
memory/2088-82-0x000000013F100000-0x000000013F4F2000-memory.dmp

Filesize
3.9MB

Download
memory/2088-60-0x000000013F6F0000-0x000000013FAE2000-memory.dmp

Filesize
3.9MB

Download
memory/2088-51-0x0000000003190000-0x0000000003582000-memory.dmp

Filesize
3.9MB

Download
memory/2088-53-0x000000013F3F0000-0x000000013F7E2000-memory.dmp

Filesize
3.9MB

Download
memory/2088-39-0x0000000003190000-0x0000000003582000-memory.dmp

Filesize
3.9MB

Download
memory/2088-87-0x0000000003730000-0x0000000003B22000-memory.dmp

Filesize
3.9MB

Download
memory/2088-0-0x000000013FBE0000-0x000000013FFD2000-memory.dmp

Filesize
3.9MB

Download
memory/2088-35-0x0000000003190000-0x0000000003582000-memory.dmp

Filesize
3.9MB

Download
memory/2088-76-0x000000013F2A0000-0x000000013F692000-memory.dmp

Filesize
3.9MB

Download
memory/2088-7-0x000000013F410000-0x000000013F802000-memory.dmp

Filesize
3.9MB

Download
memory/2096-45-0x000000013F8B0000-0x000000013FCA2000-memory.dmp

Filesize
3.9MB

Download
memory/2096-353-0x000000013F8B0000-0x000000013FCA2000-memory.dmp

Filesize
3.9MB

Download
memory/2152-90-0x000000013FF50000-0x0000000140342000-memory.dmp

Filesize
3.9MB

Download
memory/2152-5414-0x000000013FF50000-0x0000000140342000-memory.dmp

Filesize
3.9MB

Download
memory/2372-77-0x000000013F2A0000-0x000000013F692000-memory.dmp

Filesize
3.9MB

Download
memory/2536-25-0x000000013F410000-0x000000013F802000-memory.dmp

Filesize
3.9MB

Download
memory/2536-89-0x000000013F410000-0x000000013F802000-memory.dmp

Filesize
3.9MB

Download
memory/2552-703-0x000000013FEC0000-0x00000001402B2000-memory.dmp

Filesize
3.9MB

Download
memory/2552-38-0x000000013FEC0000-0x00000001402B2000-memory.dmp

Filesize
3.9MB

Download
memory/2636-34-0x000000013F3F0000-0x000000013F7E2000-memory.dmp

Filesize
3.9MB

Download
memory/2636-352-0x000000013F3F0000-0x000000013F7E2000-memory.dmp

Filesize
3.9MB

Download
memory/2672-50-0x000000013F8F0000-0x000000013FCE2000-memory.dmp

Filesize
3.9MB

Download
memory/2696-54-0x000000013FD50000-0x0000000140142000-memory.dmp

Filesize
3.9MB

Download
memory/2864-55-0x000000013F290000-0x000000013F682000-memory.dmp

Filesize
3.9MB

Download