xmrig | 48070200e02575d185f00ba629b85026e542cb753bfbbf6d72904b399a36dadf

Analysis

max time kernel
150s
max time network
149s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
29/06/2024, 01:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

48070200e02575d185f00ba629b85026e542cb753bfbbf6d72904b399a36dadf_NeikiAnalytics.exe
Size

1.8MB
MD5

16a2be79a839200276fb7964b5e76b90
SHA1

0e06987347c4d01ad619612790c77b7bdab3f90e
SHA256

48070200e02575d185f00ba629b85026e542cb753bfbbf6d72904b399a36dadf
SHA512

1b741584a5a6be171ae0293cbebbc91ac1278bef4469e10e57ad9d25723072484be822fff4e07209711b7b43e19a66fcbabed1c4e50a05ec77bc598eaf43866b
SSDEEP

24576:zv3/fTLF671TilQFG4P5PMkibTJH+2Q/ynKeWYKpGncHBN/Vx+hZW0VGeE5l7Qr7:Lz071uv4BPMkibTIA5CJJAbz

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 24 IoCs

miner

resource	yara_rule
behavioral1/memory/2760-131-0x000000013F370000-0x000000013F762000-memory.dmp	xmrig
behavioral1/memory/2816-136-0x000000013F5D0000-0x000000013F9C2000-memory.dmp	xmrig
behavioral1/memory/2784-138-0x000000013FF80000-0x0000000140372000-memory.dmp	xmrig
behavioral1/memory/2772-140-0x000000013FA00000-0x000000013FDF2000-memory.dmp	xmrig
behavioral1/memory/2724-468-0x000000013F530000-0x000000013F922000-memory.dmp	xmrig
behavioral1/memory/1440-466-0x000000013F600000-0x000000013F9F2000-memory.dmp	xmrig
behavioral1/memory/1020-483-0x000000013FBD0000-0x000000013FFC2000-memory.dmp	xmrig
behavioral1/memory/952-482-0x000000013F340000-0x000000013F732000-memory.dmp	xmrig
behavioral1/memory/2452-150-0x000000013FE80000-0x0000000140272000-memory.dmp	xmrig
behavioral1/memory/556-148-0x000000013FD90000-0x0000000140182000-memory.dmp	xmrig
behavioral1/memory/2488-146-0x000000013F450000-0x000000013F842000-memory.dmp	xmrig
behavioral1/memory/2528-144-0x000000013FCB0000-0x00000001400A2000-memory.dmp	xmrig
behavioral1/memory/2976-142-0x000000013F240000-0x000000013F632000-memory.dmp	xmrig
behavioral1/memory/1440-139-0x000000013FA00000-0x000000013FDF2000-memory.dmp	xmrig
behavioral1/memory/2624-134-0x000000013FE00000-0x00000001401F2000-memory.dmp	xmrig
behavioral1/memory/2760-3466-0x000000013F370000-0x000000013F762000-memory.dmp	xmrig
behavioral1/memory/2976-3471-0x000000013F240000-0x000000013F632000-memory.dmp	xmrig
behavioral1/memory/2452-3484-0x000000013FE80000-0x0000000140272000-memory.dmp	xmrig
behavioral1/memory/2624-3626-0x000000013FE00000-0x00000001401F2000-memory.dmp	xmrig
behavioral1/memory/2772-5111-0x000000013FA00000-0x000000013FDF2000-memory.dmp	xmrig
behavioral1/memory/2724-5268-0x000000013F530000-0x000000013F922000-memory.dmp	xmrig
behavioral1/memory/2784-5267-0x000000013FF80000-0x0000000140372000-memory.dmp	xmrig
behavioral1/memory/2488-5276-0x000000013F450000-0x000000013F842000-memory.dmp	xmrig
behavioral1/memory/556-5353-0x000000013FD90000-0x0000000140182000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
2556	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
2724	Yuvywxs.exe
2760	LsiMyeu.exe
2624	ygOTwTP.exe
2816	ffASkia.exe
2784	JgvDlfI.exe
2772	tJpZbmg.exe
2976	UJpMsuF.exe
2528	xBmoceR.exe
2488	YUbXglB.exe
556	IjiUiYP.exe
2452	PNItsgr.exe
1020	JWFDrNL.exe
2680	gSeMhZK.exe
952	izWziwX.exe
1504	EbTqwtB.exe
2700	wPeXEnk.exe
2380	VwFUjej.exe
832	zVHbkTC.exe
2248	YVOpRBX.exe
1888	FEHzPbB.exe
1360	qOncIeJ.exe
936	jzIRpGO.exe
2412	sSQSqkZ.exe
1384	oCWONtK.exe
1332	ehOhYFO.exe
2036	vKAiFkT.exe
1740	sxxfaIH.exe
2344	igaQfNs.exe
2460	lEmmoQB.exe
1120	BfCtqWb.exe
1792	WUnNAhQ.exe
1532	oJVFqRm.exe
2340	sSicVIY.exe
3020	VfHBEWe.exe
2080	GwaWMxY.exe
1616	zEJvpmf.exe
1068	otcqVbq.exe
1636	XrWlnqm.exe
2364	eKmEtrR.exe
1232	nASyZfa.exe
824	TnKoCuF.exe
1172	CpbepIK.exe
1940	uxnuXYR.exe
1796	SItkLrp.exe
628	wStjfmr.exe
2148	NSMbbNI.exe
2900	QXqROca.exe
2996	ePYTGqW.exe
1668	slxHvmQ.exe
884	YFOjkfN.exe
2228	nWjaqjl.exe
2844	czqHDMH.exe
1588	KODFAwC.exe
3044	YhgvcLw.exe
2820	alwMSGQ.exe
2636	KsZGJGK.exe
2644	lPDkvBF.exe
900	eVKNsXd.exe
468	EkDllXd.exe
2512	edvbJmh.exe
1140	lYwerEb.exe
2560	eNLzvHL.exe
1092	XrzPHNr.exe
2328	tmBTWin.exe

Loads dropped DLL 64 IoCs

pid	Process
1440	48070200e02575d185f00ba629b85026e542cb753bfbbf6d72904b399a36dadf_NeikiAnalytics.exe
1440	48070200e02575d185f00ba629b85026e542cb753bfbbf6d72904b399a36dadf_NeikiAnalytics.exe
1440	48070200e02575d185f00ba629b85026e542cb753bfbbf6d72904b399a36dadf_NeikiAnalytics.exe
1440	48070200e02575d185f00ba629b85026e542cb753bfbbf6d72904b399a36dadf_NeikiAnalytics.exe
1440	48070200e02575d185f00ba629b85026e542cb753bfbbf6d72904b399a36dadf_NeikiAnalytics.exe
1440	48070200e02575d185f00ba629b85026e542cb753bfbbf6d72904b399a36dadf_NeikiAnalytics.exe
1440	48070200e02575d185f00ba629b85026e542cb753bfbbf6d72904b399a36dadf_NeikiAnalytics.exe
1440	48070200e02575d185f00ba629b85026e542cb753bfbbf6d72904b399a36dadf_NeikiAnalytics.exe
1440	48070200e02575d185f00ba629b85026e542cb753bfbbf6d72904b399a36dadf_NeikiAnalytics.exe
1440	48070200e02575d185f00ba629b85026e542cb753bfbbf6d72904b399a36dadf_NeikiAnalytics.exe
1440	48070200e02575d185f00ba629b85026e542cb753bfbbf6d72904b399a36dadf_NeikiAnalytics.exe
1440	48070200e02575d185f00ba629b85026e542cb753bfbbf6d72904b399a36dadf_NeikiAnalytics.exe
1440	48070200e02575d185f00ba629b85026e542cb753bfbbf6d72904b399a36dadf_NeikiAnalytics.exe
1440	48070200e02575d185f00ba629b85026e542cb753bfbbf6d72904b399a36dadf_NeikiAnalytics.exe
1440	48070200e02575d185f00ba629b85026e542cb753bfbbf6d72904b399a36dadf_NeikiAnalytics.exe
1440	48070200e02575d185f00ba629b85026e542cb753bfbbf6d72904b399a36dadf_NeikiAnalytics.exe
1440	48070200e02575d185f00ba629b85026e542cb753bfbbf6d72904b399a36dadf_NeikiAnalytics.exe
1440	48070200e02575d185f00ba629b85026e542cb753bfbbf6d72904b399a36dadf_NeikiAnalytics.exe
1440	48070200e02575d185f00ba629b85026e542cb753bfbbf6d72904b399a36dadf_NeikiAnalytics.exe
1440	48070200e02575d185f00ba629b85026e542cb753bfbbf6d72904b399a36dadf_NeikiAnalytics.exe
1440	48070200e02575d185f00ba629b85026e542cb753bfbbf6d72904b399a36dadf_NeikiAnalytics.exe
1440	48070200e02575d185f00ba629b85026e542cb753bfbbf6d72904b399a36dadf_NeikiAnalytics.exe
1440	48070200e02575d185f00ba629b85026e542cb753bfbbf6d72904b399a36dadf_NeikiAnalytics.exe
1440	48070200e02575d185f00ba629b85026e542cb753bfbbf6d72904b399a36dadf_NeikiAnalytics.exe
1440	48070200e02575d185f00ba629b85026e542cb753bfbbf6d72904b399a36dadf_NeikiAnalytics.exe
1440	48070200e02575d185f00ba629b85026e542cb753bfbbf6d72904b399a36dadf_NeikiAnalytics.exe
1440	48070200e02575d185f00ba629b85026e542cb753bfbbf6d72904b399a36dadf_NeikiAnalytics.exe
1440	48070200e02575d185f00ba629b85026e542cb753bfbbf6d72904b399a36dadf_NeikiAnalytics.exe
1440	48070200e02575d185f00ba629b85026e542cb753bfbbf6d72904b399a36dadf_NeikiAnalytics.exe
1440	48070200e02575d185f00ba629b85026e542cb753bfbbf6d72904b399a36dadf_NeikiAnalytics.exe
1440	48070200e02575d185f00ba629b85026e542cb753bfbbf6d72904b399a36dadf_NeikiAnalytics.exe
1440	48070200e02575d185f00ba629b85026e542cb753bfbbf6d72904b399a36dadf_NeikiAnalytics.exe
1440	48070200e02575d185f00ba629b85026e542cb753bfbbf6d72904b399a36dadf_NeikiAnalytics.exe
1440	48070200e02575d185f00ba629b85026e542cb753bfbbf6d72904b399a36dadf_NeikiAnalytics.exe
1440	48070200e02575d185f00ba629b85026e542cb753bfbbf6d72904b399a36dadf_NeikiAnalytics.exe
1440	48070200e02575d185f00ba629b85026e542cb753bfbbf6d72904b399a36dadf_NeikiAnalytics.exe
1440	48070200e02575d185f00ba629b85026e542cb753bfbbf6d72904b399a36dadf_NeikiAnalytics.exe
1440	48070200e02575d185f00ba629b85026e542cb753bfbbf6d72904b399a36dadf_NeikiAnalytics.exe
1440	48070200e02575d185f00ba629b85026e542cb753bfbbf6d72904b399a36dadf_NeikiAnalytics.exe
1440	48070200e02575d185f00ba629b85026e542cb753bfbbf6d72904b399a36dadf_NeikiAnalytics.exe
1440	48070200e02575d185f00ba629b85026e542cb753bfbbf6d72904b399a36dadf_NeikiAnalytics.exe
1440	48070200e02575d185f00ba629b85026e542cb753bfbbf6d72904b399a36dadf_NeikiAnalytics.exe
1440	48070200e02575d185f00ba629b85026e542cb753bfbbf6d72904b399a36dadf_NeikiAnalytics.exe
1440	48070200e02575d185f00ba629b85026e542cb753bfbbf6d72904b399a36dadf_NeikiAnalytics.exe
1440	48070200e02575d185f00ba629b85026e542cb753bfbbf6d72904b399a36dadf_NeikiAnalytics.exe
1440	48070200e02575d185f00ba629b85026e542cb753bfbbf6d72904b399a36dadf_NeikiAnalytics.exe
1440	48070200e02575d185f00ba629b85026e542cb753bfbbf6d72904b399a36dadf_NeikiAnalytics.exe
1440	48070200e02575d185f00ba629b85026e542cb753bfbbf6d72904b399a36dadf_NeikiAnalytics.exe
1440	48070200e02575d185f00ba629b85026e542cb753bfbbf6d72904b399a36dadf_NeikiAnalytics.exe
1440	48070200e02575d185f00ba629b85026e542cb753bfbbf6d72904b399a36dadf_NeikiAnalytics.exe
1440	48070200e02575d185f00ba629b85026e542cb753bfbbf6d72904b399a36dadf_NeikiAnalytics.exe
1440	48070200e02575d185f00ba629b85026e542cb753bfbbf6d72904b399a36dadf_NeikiAnalytics.exe
1440	48070200e02575d185f00ba629b85026e542cb753bfbbf6d72904b399a36dadf_NeikiAnalytics.exe
1440	48070200e02575d185f00ba629b85026e542cb753bfbbf6d72904b399a36dadf_NeikiAnalytics.exe
1440	48070200e02575d185f00ba629b85026e542cb753bfbbf6d72904b399a36dadf_NeikiAnalytics.exe
1440	48070200e02575d185f00ba629b85026e542cb753bfbbf6d72904b399a36dadf_NeikiAnalytics.exe
1440	48070200e02575d185f00ba629b85026e542cb753bfbbf6d72904b399a36dadf_NeikiAnalytics.exe
1440	48070200e02575d185f00ba629b85026e542cb753bfbbf6d72904b399a36dadf_NeikiAnalytics.exe
1440	48070200e02575d185f00ba629b85026e542cb753bfbbf6d72904b399a36dadf_NeikiAnalytics.exe
1440	48070200e02575d185f00ba629b85026e542cb753bfbbf6d72904b399a36dadf_NeikiAnalytics.exe
1440	48070200e02575d185f00ba629b85026e542cb753bfbbf6d72904b399a36dadf_NeikiAnalytics.exe
1440	48070200e02575d185f00ba629b85026e542cb753bfbbf6d72904b399a36dadf_NeikiAnalytics.exe
1440	48070200e02575d185f00ba629b85026e542cb753bfbbf6d72904b399a36dadf_NeikiAnalytics.exe
1440	48070200e02575d185f00ba629b85026e542cb753bfbbf6d72904b399a36dadf_NeikiAnalytics.exe

UPX packed file 59 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1440-1-0x000000013F600000-0x000000013F9F2000-memory.dmp	upx
behavioral1/files/0x000b000000012280-3.dat	upx
behavioral1/memory/2724-9-0x000000013F530000-0x000000013F922000-memory.dmp	upx
behavioral1/files/0x002d000000015c68-18.dat	upx
behavioral1/files/0x000b000000003d5f-23.dat	upx
behavioral1/files/0x0007000000015cd2-33.dat	upx
behavioral1/files/0x0009000000015dc5-42.dat	upx
behavioral1/files/0x0006000000016c76-51.dat	upx
behavioral1/files/0x0007000000015cf2-37.dat	upx
behavioral1/files/0x0008000000016c2a-48.dat	upx
behavioral1/files/0x0006000000016cec-78.dat	upx
behavioral1/files/0x0006000000016d3c-112.dat	upx
behavioral1/files/0x0006000000016d5b-119.dat	upx
behavioral1/memory/2760-131-0x000000013F370000-0x000000013F762000-memory.dmp	upx
behavioral1/memory/2816-136-0x000000013F5D0000-0x000000013F9C2000-memory.dmp	upx
behavioral1/memory/2784-138-0x000000013FF80000-0x0000000140372000-memory.dmp	upx
behavioral1/memory/2772-140-0x000000013FA00000-0x000000013FDF2000-memory.dmp	upx
behavioral1/files/0x0006000000017578-166.dat	upx
behavioral1/files/0x00050000000186ce-184.dat	upx
behavioral1/files/0x0006000000016d4c-117.dat	upx
behavioral1/files/0x0006000000016e6b-194.dat	upx
behavioral1/memory/2724-468-0x000000013F530000-0x000000013F922000-memory.dmp	upx
behavioral1/memory/1440-466-0x000000013F600000-0x000000013F9F2000-memory.dmp	upx
behavioral1/memory/1020-483-0x000000013FBD0000-0x000000013FFC2000-memory.dmp	upx
behavioral1/memory/952-482-0x000000013F340000-0x000000013F732000-memory.dmp	upx
behavioral1/files/0x00050000000186dc-190.dat	upx
behavioral1/files/0x001500000001861a-181.dat	upx
behavioral1/files/0x00050000000186a7-179.dat	upx
behavioral1/files/0x00060000000177fe-170.dat	upx
behavioral1/files/0x0006000000017090-165.dat	upx
behavioral1/files/0x00060000000170cf-162.dat	upx
behavioral1/files/0x0006000000016d94-123.dat	upx
behavioral1/files/0x0006000000016d98-160.dat	upx
behavioral1/memory/2452-150-0x000000013FE80000-0x0000000140272000-memory.dmp	upx
behavioral1/memory/556-148-0x000000013FD90000-0x0000000140182000-memory.dmp	upx
behavioral1/memory/2488-146-0x000000013F450000-0x000000013F842000-memory.dmp	upx
behavioral1/memory/2528-144-0x000000013FCB0000-0x00000001400A2000-memory.dmp	upx
behavioral1/memory/2976-142-0x000000013F240000-0x000000013F632000-memory.dmp	upx
behavioral1/memory/2624-134-0x000000013FE00000-0x00000001401F2000-memory.dmp	upx
behavioral1/files/0x0006000000016d2b-108.dat	upx
behavioral1/files/0x0006000000016d0a-97.dat	upx
behavioral1/files/0x0006000000016d0f-101.dat	upx
behavioral1/files/0x0006000000016cfe-92.dat	upx
behavioral1/files/0x0006000000016cf8-88.dat	upx
behavioral1/files/0x0006000000016ce4-86.dat	upx
behavioral1/files/0x0006000000016ccb-84.dat	upx
behavioral1/files/0x0006000000016c9d-58.dat	upx
behavioral1/files/0x0006000000016cdc-68.dat	upx
behavioral1/files/0x0012000000015c83-62.dat	upx
behavioral1/files/0x0008000000015cb9-28.dat	upx
behavioral1/memory/2760-3466-0x000000013F370000-0x000000013F762000-memory.dmp	upx
behavioral1/memory/2976-3471-0x000000013F240000-0x000000013F632000-memory.dmp	upx
behavioral1/memory/2452-3484-0x000000013FE80000-0x0000000140272000-memory.dmp	upx
behavioral1/memory/2624-3626-0x000000013FE00000-0x00000001401F2000-memory.dmp	upx
behavioral1/memory/2772-5111-0x000000013FA00000-0x000000013FDF2000-memory.dmp	upx
behavioral1/memory/2724-5268-0x000000013F530000-0x000000013F922000-memory.dmp	upx
behavioral1/memory/2784-5267-0x000000013FF80000-0x0000000140372000-memory.dmp	upx
behavioral1/memory/2488-5276-0x000000013F450000-0x000000013F842000-memory.dmp	upx
behavioral1/memory/556-5353-0x000000013FD90000-0x0000000140182000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\qpRbVUH.exe	48070200e02575d185f00ba629b85026e542cb753bfbbf6d72904b399a36dadf_NeikiAnalytics.exe
File created	C:\Windows\System\uQGLNSj.exe	48070200e02575d185f00ba629b85026e542cb753bfbbf6d72904b399a36dadf_NeikiAnalytics.exe
File created	C:\Windows\System\HkGPryw.exe	48070200e02575d185f00ba629b85026e542cb753bfbbf6d72904b399a36dadf_NeikiAnalytics.exe
File created	C:\Windows\System\syagLzB.exe	48070200e02575d185f00ba629b85026e542cb753bfbbf6d72904b399a36dadf_NeikiAnalytics.exe
File created	C:\Windows\System\ibhrtPf.exe	48070200e02575d185f00ba629b85026e542cb753bfbbf6d72904b399a36dadf_NeikiAnalytics.exe
File created	C:\Windows\System\uYeIKuw.exe	48070200e02575d185f00ba629b85026e542cb753bfbbf6d72904b399a36dadf_NeikiAnalytics.exe
File created	C:\Windows\System\FBmJQgs.exe	48070200e02575d185f00ba629b85026e542cb753bfbbf6d72904b399a36dadf_NeikiAnalytics.exe
File created	C:\Windows\System\IRfmwVa.exe	48070200e02575d185f00ba629b85026e542cb753bfbbf6d72904b399a36dadf_NeikiAnalytics.exe
File created	C:\Windows\System\VYRuLea.exe	48070200e02575d185f00ba629b85026e542cb753bfbbf6d72904b399a36dadf_NeikiAnalytics.exe
File created	C:\Windows\System\JFZTsoU.exe	48070200e02575d185f00ba629b85026e542cb753bfbbf6d72904b399a36dadf_NeikiAnalytics.exe
File created	C:\Windows\System\DTsnnHN.exe	48070200e02575d185f00ba629b85026e542cb753bfbbf6d72904b399a36dadf_NeikiAnalytics.exe
File created	C:\Windows\System\ykiREkU.exe	48070200e02575d185f00ba629b85026e542cb753bfbbf6d72904b399a36dadf_NeikiAnalytics.exe
File created	C:\Windows\System\txleEQx.exe	48070200e02575d185f00ba629b85026e542cb753bfbbf6d72904b399a36dadf_NeikiAnalytics.exe
File created	C:\Windows\System\qKsjvcI.exe	48070200e02575d185f00ba629b85026e542cb753bfbbf6d72904b399a36dadf_NeikiAnalytics.exe
File created	C:\Windows\System\sXbyoQW.exe	48070200e02575d185f00ba629b85026e542cb753bfbbf6d72904b399a36dadf_NeikiAnalytics.exe
File created	C:\Windows\System\zggfBAb.exe	48070200e02575d185f00ba629b85026e542cb753bfbbf6d72904b399a36dadf_NeikiAnalytics.exe
File created	C:\Windows\System\PdtlEUW.exe	48070200e02575d185f00ba629b85026e542cb753bfbbf6d72904b399a36dadf_NeikiAnalytics.exe
File created	C:\Windows\System\dErLQOx.exe	48070200e02575d185f00ba629b85026e542cb753bfbbf6d72904b399a36dadf_NeikiAnalytics.exe
File created	C:\Windows\System\wNpqDxH.exe	48070200e02575d185f00ba629b85026e542cb753bfbbf6d72904b399a36dadf_NeikiAnalytics.exe
File created	C:\Windows\System\QkvtMAA.exe	48070200e02575d185f00ba629b85026e542cb753bfbbf6d72904b399a36dadf_NeikiAnalytics.exe
File created	C:\Windows\System\MaXElse.exe	48070200e02575d185f00ba629b85026e542cb753bfbbf6d72904b399a36dadf_NeikiAnalytics.exe
File created	C:\Windows\System\ZOZselC.exe	48070200e02575d185f00ba629b85026e542cb753bfbbf6d72904b399a36dadf_NeikiAnalytics.exe
File created	C:\Windows\System\nkjveOJ.exe	48070200e02575d185f00ba629b85026e542cb753bfbbf6d72904b399a36dadf_NeikiAnalytics.exe
File created	C:\Windows\System\wuDpOQm.exe	48070200e02575d185f00ba629b85026e542cb753bfbbf6d72904b399a36dadf_NeikiAnalytics.exe
File created	C:\Windows\System\zyjkeAu.exe	48070200e02575d185f00ba629b85026e542cb753bfbbf6d72904b399a36dadf_NeikiAnalytics.exe
File created	C:\Windows\System\HKchUsn.exe	48070200e02575d185f00ba629b85026e542cb753bfbbf6d72904b399a36dadf_NeikiAnalytics.exe
File created	C:\Windows\System\FANMBcX.exe	48070200e02575d185f00ba629b85026e542cb753bfbbf6d72904b399a36dadf_NeikiAnalytics.exe
File created	C:\Windows\System\NxitDZd.exe	48070200e02575d185f00ba629b85026e542cb753bfbbf6d72904b399a36dadf_NeikiAnalytics.exe
File created	C:\Windows\System\MLlpmgC.exe	48070200e02575d185f00ba629b85026e542cb753bfbbf6d72904b399a36dadf_NeikiAnalytics.exe
File created	C:\Windows\System\kveDscF.exe	48070200e02575d185f00ba629b85026e542cb753bfbbf6d72904b399a36dadf_NeikiAnalytics.exe
File created	C:\Windows\System\rRrjELd.exe	48070200e02575d185f00ba629b85026e542cb753bfbbf6d72904b399a36dadf_NeikiAnalytics.exe
File created	C:\Windows\System\mKvWUBe.exe	48070200e02575d185f00ba629b85026e542cb753bfbbf6d72904b399a36dadf_NeikiAnalytics.exe
File created	C:\Windows\System\XXPRDZV.exe	48070200e02575d185f00ba629b85026e542cb753bfbbf6d72904b399a36dadf_NeikiAnalytics.exe
File created	C:\Windows\System\nzExLfh.exe	48070200e02575d185f00ba629b85026e542cb753bfbbf6d72904b399a36dadf_NeikiAnalytics.exe
File created	C:\Windows\System\eOVcoUN.exe	48070200e02575d185f00ba629b85026e542cb753bfbbf6d72904b399a36dadf_NeikiAnalytics.exe
File created	C:\Windows\System\FZZfjtk.exe	48070200e02575d185f00ba629b85026e542cb753bfbbf6d72904b399a36dadf_NeikiAnalytics.exe
File created	C:\Windows\System\bKmiifM.exe	48070200e02575d185f00ba629b85026e542cb753bfbbf6d72904b399a36dadf_NeikiAnalytics.exe
File created	C:\Windows\System\nBrQDHP.exe	48070200e02575d185f00ba629b85026e542cb753bfbbf6d72904b399a36dadf_NeikiAnalytics.exe
File created	C:\Windows\System\HzfjQyh.exe	48070200e02575d185f00ba629b85026e542cb753bfbbf6d72904b399a36dadf_NeikiAnalytics.exe
File created	C:\Windows\System\dvxTCxt.exe	48070200e02575d185f00ba629b85026e542cb753bfbbf6d72904b399a36dadf_NeikiAnalytics.exe
File created	C:\Windows\System\JgPoRLI.exe	48070200e02575d185f00ba629b85026e542cb753bfbbf6d72904b399a36dadf_NeikiAnalytics.exe
File created	C:\Windows\System\nvYtdbd.exe	48070200e02575d185f00ba629b85026e542cb753bfbbf6d72904b399a36dadf_NeikiAnalytics.exe
File created	C:\Windows\System\JmasSve.exe	48070200e02575d185f00ba629b85026e542cb753bfbbf6d72904b399a36dadf_NeikiAnalytics.exe
File created	C:\Windows\System\pYxTNOM.exe	48070200e02575d185f00ba629b85026e542cb753bfbbf6d72904b399a36dadf_NeikiAnalytics.exe
File created	C:\Windows\System\qtFXmWE.exe	48070200e02575d185f00ba629b85026e542cb753bfbbf6d72904b399a36dadf_NeikiAnalytics.exe
File created	C:\Windows\System\NsCEUsr.exe	48070200e02575d185f00ba629b85026e542cb753bfbbf6d72904b399a36dadf_NeikiAnalytics.exe
File created	C:\Windows\System\cHhXDdz.exe	48070200e02575d185f00ba629b85026e542cb753bfbbf6d72904b399a36dadf_NeikiAnalytics.exe
File created	C:\Windows\System\awXcsGr.exe	48070200e02575d185f00ba629b85026e542cb753bfbbf6d72904b399a36dadf_NeikiAnalytics.exe
File created	C:\Windows\System\WSrbDVK.exe	48070200e02575d185f00ba629b85026e542cb753bfbbf6d72904b399a36dadf_NeikiAnalytics.exe
File created	C:\Windows\System\KJUWHvr.exe	48070200e02575d185f00ba629b85026e542cb753bfbbf6d72904b399a36dadf_NeikiAnalytics.exe
File created	C:\Windows\System\XegFsMf.exe	48070200e02575d185f00ba629b85026e542cb753bfbbf6d72904b399a36dadf_NeikiAnalytics.exe
File created	C:\Windows\System\uLgxaQZ.exe	48070200e02575d185f00ba629b85026e542cb753bfbbf6d72904b399a36dadf_NeikiAnalytics.exe
File created	C:\Windows\System\itJepRn.exe	48070200e02575d185f00ba629b85026e542cb753bfbbf6d72904b399a36dadf_NeikiAnalytics.exe
File created	C:\Windows\System\VfHBEWe.exe	48070200e02575d185f00ba629b85026e542cb753bfbbf6d72904b399a36dadf_NeikiAnalytics.exe
File created	C:\Windows\System\FhZmpCb.exe	48070200e02575d185f00ba629b85026e542cb753bfbbf6d72904b399a36dadf_NeikiAnalytics.exe
File created	C:\Windows\System\MBJcaIg.exe	48070200e02575d185f00ba629b85026e542cb753bfbbf6d72904b399a36dadf_NeikiAnalytics.exe
File created	C:\Windows\System\OZUENxV.exe	48070200e02575d185f00ba629b85026e542cb753bfbbf6d72904b399a36dadf_NeikiAnalytics.exe
File created	C:\Windows\System\rquothR.exe	48070200e02575d185f00ba629b85026e542cb753bfbbf6d72904b399a36dadf_NeikiAnalytics.exe
File created	C:\Windows\System\ZCTAsqu.exe	48070200e02575d185f00ba629b85026e542cb753bfbbf6d72904b399a36dadf_NeikiAnalytics.exe
File created	C:\Windows\System\uCaeLYx.exe	48070200e02575d185f00ba629b85026e542cb753bfbbf6d72904b399a36dadf_NeikiAnalytics.exe
File created	C:\Windows\System\XnWvveP.exe	48070200e02575d185f00ba629b85026e542cb753bfbbf6d72904b399a36dadf_NeikiAnalytics.exe
File created	C:\Windows\System\WefIhET.exe	48070200e02575d185f00ba629b85026e542cb753bfbbf6d72904b399a36dadf_NeikiAnalytics.exe
File created	C:\Windows\System\GfUrkSW.exe	48070200e02575d185f00ba629b85026e542cb753bfbbf6d72904b399a36dadf_NeikiAnalytics.exe
File created	C:\Windows\System\JLnbOgG.exe	48070200e02575d185f00ba629b85026e542cb753bfbbf6d72904b399a36dadf_NeikiAnalytics.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2556	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	1440	48070200e02575d185f00ba629b85026e542cb753bfbbf6d72904b399a36dadf_NeikiAnalytics.exe
Token: SeLockMemoryPrivilege	1440	48070200e02575d185f00ba629b85026e542cb753bfbbf6d72904b399a36dadf_NeikiAnalytics.exe
Token: SeDebugPrivilege	2556	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1440 wrote to memory of 2556	1440	48070200e02575d185f00ba629b85026e542cb753bfbbf6d72904b399a36dadf_NeikiAnalytics.exe	29
PID 1440 wrote to memory of 2556	1440	48070200e02575d185f00ba629b85026e542cb753bfbbf6d72904b399a36dadf_NeikiAnalytics.exe	29
PID 1440 wrote to memory of 2556	1440	48070200e02575d185f00ba629b85026e542cb753bfbbf6d72904b399a36dadf_NeikiAnalytics.exe	29
PID 1440 wrote to memory of 2724	1440	48070200e02575d185f00ba629b85026e542cb753bfbbf6d72904b399a36dadf_NeikiAnalytics.exe	30
PID 1440 wrote to memory of 2724	1440	48070200e02575d185f00ba629b85026e542cb753bfbbf6d72904b399a36dadf_NeikiAnalytics.exe	30
PID 1440 wrote to memory of 2724	1440	48070200e02575d185f00ba629b85026e542cb753bfbbf6d72904b399a36dadf_NeikiAnalytics.exe	30
PID 1440 wrote to memory of 2760	1440	48070200e02575d185f00ba629b85026e542cb753bfbbf6d72904b399a36dadf_NeikiAnalytics.exe	31
PID 1440 wrote to memory of 2760	1440	48070200e02575d185f00ba629b85026e542cb753bfbbf6d72904b399a36dadf_NeikiAnalytics.exe	31
PID 1440 wrote to memory of 2760	1440	48070200e02575d185f00ba629b85026e542cb753bfbbf6d72904b399a36dadf_NeikiAnalytics.exe	31
PID 1440 wrote to memory of 2624	1440	48070200e02575d185f00ba629b85026e542cb753bfbbf6d72904b399a36dadf_NeikiAnalytics.exe	32
PID 1440 wrote to memory of 2624	1440	48070200e02575d185f00ba629b85026e542cb753bfbbf6d72904b399a36dadf_NeikiAnalytics.exe	32
PID 1440 wrote to memory of 2624	1440	48070200e02575d185f00ba629b85026e542cb753bfbbf6d72904b399a36dadf_NeikiAnalytics.exe	32
PID 1440 wrote to memory of 2816	1440	48070200e02575d185f00ba629b85026e542cb753bfbbf6d72904b399a36dadf_NeikiAnalytics.exe	33
PID 1440 wrote to memory of 2816	1440	48070200e02575d185f00ba629b85026e542cb753bfbbf6d72904b399a36dadf_NeikiAnalytics.exe	33
PID 1440 wrote to memory of 2816	1440	48070200e02575d185f00ba629b85026e542cb753bfbbf6d72904b399a36dadf_NeikiAnalytics.exe	33
PID 1440 wrote to memory of 2784	1440	48070200e02575d185f00ba629b85026e542cb753bfbbf6d72904b399a36dadf_NeikiAnalytics.exe	34
PID 1440 wrote to memory of 2784	1440	48070200e02575d185f00ba629b85026e542cb753bfbbf6d72904b399a36dadf_NeikiAnalytics.exe	34
PID 1440 wrote to memory of 2784	1440	48070200e02575d185f00ba629b85026e542cb753bfbbf6d72904b399a36dadf_NeikiAnalytics.exe	34
PID 1440 wrote to memory of 2772	1440	48070200e02575d185f00ba629b85026e542cb753bfbbf6d72904b399a36dadf_NeikiAnalytics.exe	35
PID 1440 wrote to memory of 2772	1440	48070200e02575d185f00ba629b85026e542cb753bfbbf6d72904b399a36dadf_NeikiAnalytics.exe	35
PID 1440 wrote to memory of 2772	1440	48070200e02575d185f00ba629b85026e542cb753bfbbf6d72904b399a36dadf_NeikiAnalytics.exe	35
PID 1440 wrote to memory of 2976	1440	48070200e02575d185f00ba629b85026e542cb753bfbbf6d72904b399a36dadf_NeikiAnalytics.exe	36
PID 1440 wrote to memory of 2976	1440	48070200e02575d185f00ba629b85026e542cb753bfbbf6d72904b399a36dadf_NeikiAnalytics.exe	36
PID 1440 wrote to memory of 2976	1440	48070200e02575d185f00ba629b85026e542cb753bfbbf6d72904b399a36dadf_NeikiAnalytics.exe	36
PID 1440 wrote to memory of 2528	1440	48070200e02575d185f00ba629b85026e542cb753bfbbf6d72904b399a36dadf_NeikiAnalytics.exe	37
PID 1440 wrote to memory of 2528	1440	48070200e02575d185f00ba629b85026e542cb753bfbbf6d72904b399a36dadf_NeikiAnalytics.exe	37
PID 1440 wrote to memory of 2528	1440	48070200e02575d185f00ba629b85026e542cb753bfbbf6d72904b399a36dadf_NeikiAnalytics.exe	37
PID 1440 wrote to memory of 2488	1440	48070200e02575d185f00ba629b85026e542cb753bfbbf6d72904b399a36dadf_NeikiAnalytics.exe	38
PID 1440 wrote to memory of 2488	1440	48070200e02575d185f00ba629b85026e542cb753bfbbf6d72904b399a36dadf_NeikiAnalytics.exe	38
PID 1440 wrote to memory of 2488	1440	48070200e02575d185f00ba629b85026e542cb753bfbbf6d72904b399a36dadf_NeikiAnalytics.exe	38
PID 1440 wrote to memory of 556	1440	48070200e02575d185f00ba629b85026e542cb753bfbbf6d72904b399a36dadf_NeikiAnalytics.exe	39
PID 1440 wrote to memory of 556	1440	48070200e02575d185f00ba629b85026e542cb753bfbbf6d72904b399a36dadf_NeikiAnalytics.exe	39
PID 1440 wrote to memory of 556	1440	48070200e02575d185f00ba629b85026e542cb753bfbbf6d72904b399a36dadf_NeikiAnalytics.exe	39
PID 1440 wrote to memory of 2452	1440	48070200e02575d185f00ba629b85026e542cb753bfbbf6d72904b399a36dadf_NeikiAnalytics.exe	40
PID 1440 wrote to memory of 2452	1440	48070200e02575d185f00ba629b85026e542cb753bfbbf6d72904b399a36dadf_NeikiAnalytics.exe	40
PID 1440 wrote to memory of 2452	1440	48070200e02575d185f00ba629b85026e542cb753bfbbf6d72904b399a36dadf_NeikiAnalytics.exe	40
PID 1440 wrote to memory of 952	1440	48070200e02575d185f00ba629b85026e542cb753bfbbf6d72904b399a36dadf_NeikiAnalytics.exe	41
PID 1440 wrote to memory of 952	1440	48070200e02575d185f00ba629b85026e542cb753bfbbf6d72904b399a36dadf_NeikiAnalytics.exe	41
PID 1440 wrote to memory of 952	1440	48070200e02575d185f00ba629b85026e542cb753bfbbf6d72904b399a36dadf_NeikiAnalytics.exe	41
PID 1440 wrote to memory of 1020	1440	48070200e02575d185f00ba629b85026e542cb753bfbbf6d72904b399a36dadf_NeikiAnalytics.exe	42
PID 1440 wrote to memory of 1020	1440	48070200e02575d185f00ba629b85026e542cb753bfbbf6d72904b399a36dadf_NeikiAnalytics.exe	42
PID 1440 wrote to memory of 1020	1440	48070200e02575d185f00ba629b85026e542cb753bfbbf6d72904b399a36dadf_NeikiAnalytics.exe	42
PID 1440 wrote to memory of 1504	1440	48070200e02575d185f00ba629b85026e542cb753bfbbf6d72904b399a36dadf_NeikiAnalytics.exe	43
PID 1440 wrote to memory of 1504	1440	48070200e02575d185f00ba629b85026e542cb753bfbbf6d72904b399a36dadf_NeikiAnalytics.exe	43
PID 1440 wrote to memory of 1504	1440	48070200e02575d185f00ba629b85026e542cb753bfbbf6d72904b399a36dadf_NeikiAnalytics.exe	43
PID 1440 wrote to memory of 2680	1440	48070200e02575d185f00ba629b85026e542cb753bfbbf6d72904b399a36dadf_NeikiAnalytics.exe	44
PID 1440 wrote to memory of 2680	1440	48070200e02575d185f00ba629b85026e542cb753bfbbf6d72904b399a36dadf_NeikiAnalytics.exe	44
PID 1440 wrote to memory of 2680	1440	48070200e02575d185f00ba629b85026e542cb753bfbbf6d72904b399a36dadf_NeikiAnalytics.exe	44
PID 1440 wrote to memory of 2700	1440	48070200e02575d185f00ba629b85026e542cb753bfbbf6d72904b399a36dadf_NeikiAnalytics.exe	45
PID 1440 wrote to memory of 2700	1440	48070200e02575d185f00ba629b85026e542cb753bfbbf6d72904b399a36dadf_NeikiAnalytics.exe	45
PID 1440 wrote to memory of 2700	1440	48070200e02575d185f00ba629b85026e542cb753bfbbf6d72904b399a36dadf_NeikiAnalytics.exe	45
PID 1440 wrote to memory of 2380	1440	48070200e02575d185f00ba629b85026e542cb753bfbbf6d72904b399a36dadf_NeikiAnalytics.exe	46
PID 1440 wrote to memory of 2380	1440	48070200e02575d185f00ba629b85026e542cb753bfbbf6d72904b399a36dadf_NeikiAnalytics.exe	46
PID 1440 wrote to memory of 2380	1440	48070200e02575d185f00ba629b85026e542cb753bfbbf6d72904b399a36dadf_NeikiAnalytics.exe	46
PID 1440 wrote to memory of 832	1440	48070200e02575d185f00ba629b85026e542cb753bfbbf6d72904b399a36dadf_NeikiAnalytics.exe	47
PID 1440 wrote to memory of 832	1440	48070200e02575d185f00ba629b85026e542cb753bfbbf6d72904b399a36dadf_NeikiAnalytics.exe	47
PID 1440 wrote to memory of 832	1440	48070200e02575d185f00ba629b85026e542cb753bfbbf6d72904b399a36dadf_NeikiAnalytics.exe	47
PID 1440 wrote to memory of 2248	1440	48070200e02575d185f00ba629b85026e542cb753bfbbf6d72904b399a36dadf_NeikiAnalytics.exe	48
PID 1440 wrote to memory of 2248	1440	48070200e02575d185f00ba629b85026e542cb753bfbbf6d72904b399a36dadf_NeikiAnalytics.exe	48
PID 1440 wrote to memory of 2248	1440	48070200e02575d185f00ba629b85026e542cb753bfbbf6d72904b399a36dadf_NeikiAnalytics.exe	48
PID 1440 wrote to memory of 1888	1440	48070200e02575d185f00ba629b85026e542cb753bfbbf6d72904b399a36dadf_NeikiAnalytics.exe	49
PID 1440 wrote to memory of 1888	1440	48070200e02575d185f00ba629b85026e542cb753bfbbf6d72904b399a36dadf_NeikiAnalytics.exe	49
PID 1440 wrote to memory of 1888	1440	48070200e02575d185f00ba629b85026e542cb753bfbbf6d72904b399a36dadf_NeikiAnalytics.exe	49
PID 1440 wrote to memory of 1360	1440	48070200e02575d185f00ba629b85026e542cb753bfbbf6d72904b399a36dadf_NeikiAnalytics.exe	50

C:\Users\Admin\AppData\Local\Temp\48070200e02575d185f00ba629b85026e542cb753bfbbf6d72904b399a36dadf_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\48070200e02575d185f00ba629b85026e542cb753bfbbf6d72904b399a36dadf_NeikiAnalytics.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1440
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2556
- C:\Windows\System\Yuvywxs.exe
  C:\Windows\System\Yuvywxs.exe
  2⤵
  - Executes dropped EXE
  PID:2724
- C:\Windows\System\LsiMyeu.exe
  C:\Windows\System\LsiMyeu.exe
  2⤵
  - Executes dropped EXE
  PID:2760
- C:\Windows\System\ygOTwTP.exe
  C:\Windows\System\ygOTwTP.exe
  2⤵
  - Executes dropped EXE
  PID:2624
- C:\Windows\System\ffASkia.exe
  C:\Windows\System\ffASkia.exe
  2⤵
  - Executes dropped EXE
  PID:2816
- C:\Windows\System\JgvDlfI.exe
  C:\Windows\System\JgvDlfI.exe
  2⤵
  - Executes dropped EXE
  PID:2784
- C:\Windows\System\tJpZbmg.exe
  C:\Windows\System\tJpZbmg.exe
  2⤵
  - Executes dropped EXE
  PID:2772
- C:\Windows\System\UJpMsuF.exe
  C:\Windows\System\UJpMsuF.exe
  2⤵
  - Executes dropped EXE
  PID:2976
- C:\Windows\System\xBmoceR.exe
  C:\Windows\System\xBmoceR.exe
  2⤵
  - Executes dropped EXE
  PID:2528
- C:\Windows\System\YUbXglB.exe
  C:\Windows\System\YUbXglB.exe
  2⤵
  - Executes dropped EXE
  PID:2488
- C:\Windows\System\IjiUiYP.exe
  C:\Windows\System\IjiUiYP.exe
  2⤵
  - Executes dropped EXE
  PID:556
- C:\Windows\System\PNItsgr.exe
  C:\Windows\System\PNItsgr.exe
  2⤵
  - Executes dropped EXE
  PID:2452
- C:\Windows\System\izWziwX.exe
  C:\Windows\System\izWziwX.exe
  2⤵
  - Executes dropped EXE
  PID:952
- C:\Windows\System\JWFDrNL.exe
  C:\Windows\System\JWFDrNL.exe
  2⤵
  - Executes dropped EXE
  PID:1020
- C:\Windows\System\EbTqwtB.exe
  C:\Windows\System\EbTqwtB.exe
  2⤵
  - Executes dropped EXE
  PID:1504
- C:\Windows\System\gSeMhZK.exe
  C:\Windows\System\gSeMhZK.exe
  2⤵
  - Executes dropped EXE
  PID:2680
- C:\Windows\System\wPeXEnk.exe
  C:\Windows\System\wPeXEnk.exe
  2⤵
  - Executes dropped EXE
  PID:2700
- C:\Windows\System\VwFUjej.exe
  C:\Windows\System\VwFUjej.exe
  2⤵
  - Executes dropped EXE
  PID:2380
- C:\Windows\System\zVHbkTC.exe
  C:\Windows\System\zVHbkTC.exe
  2⤵
  - Executes dropped EXE
  PID:832
- C:\Windows\System\YVOpRBX.exe
  C:\Windows\System\YVOpRBX.exe
  2⤵
  - Executes dropped EXE
  PID:2248
- C:\Windows\System\FEHzPbB.exe
  C:\Windows\System\FEHzPbB.exe
  2⤵
  - Executes dropped EXE
  PID:1888
- C:\Windows\System\qOncIeJ.exe
  C:\Windows\System\qOncIeJ.exe
  2⤵
  - Executes dropped EXE
  PID:1360
- C:\Windows\System\jzIRpGO.exe
  C:\Windows\System\jzIRpGO.exe
  2⤵
  - Executes dropped EXE
  PID:936
- C:\Windows\System\sSQSqkZ.exe
  C:\Windows\System\sSQSqkZ.exe
  2⤵
  - Executes dropped EXE
  PID:2412
- C:\Windows\System\lEmmoQB.exe
  C:\Windows\System\lEmmoQB.exe
  2⤵
  - Executes dropped EXE
  PID:2460
- C:\Windows\System\oCWONtK.exe
  C:\Windows\System\oCWONtK.exe
  2⤵
  - Executes dropped EXE
  PID:1384
- C:\Windows\System\BfCtqWb.exe
  C:\Windows\System\BfCtqWb.exe
  2⤵
  - Executes dropped EXE
  PID:1120
- C:\Windows\System\ehOhYFO.exe
  C:\Windows\System\ehOhYFO.exe
  2⤵
  - Executes dropped EXE
  PID:1332
- C:\Windows\System\sSicVIY.exe
  C:\Windows\System\sSicVIY.exe
  2⤵
  - Executes dropped EXE
  PID:2340
- C:\Windows\System\vKAiFkT.exe
  C:\Windows\System\vKAiFkT.exe
  2⤵
  - Executes dropped EXE
  PID:2036
- C:\Windows\System\GwaWMxY.exe
  C:\Windows\System\GwaWMxY.exe
  2⤵
  - Executes dropped EXE
  PID:2080
- C:\Windows\System\sxxfaIH.exe
  C:\Windows\System\sxxfaIH.exe
  2⤵
  - Executes dropped EXE
  PID:1740
- C:\Windows\System\otcqVbq.exe
  C:\Windows\System\otcqVbq.exe
  2⤵
  - Executes dropped EXE
  PID:1068
- C:\Windows\System\igaQfNs.exe
  C:\Windows\System\igaQfNs.exe
  2⤵
  - Executes dropped EXE
  PID:2344
- C:\Windows\System\nASyZfa.exe
  C:\Windows\System\nASyZfa.exe
  2⤵
  - Executes dropped EXE
  PID:1232
- C:\Windows\System\WUnNAhQ.exe
  C:\Windows\System\WUnNAhQ.exe
  2⤵
  - Executes dropped EXE
  PID:1792
- C:\Windows\System\TnKoCuF.exe
  C:\Windows\System\TnKoCuF.exe
  2⤵
  - Executes dropped EXE
  PID:824
- C:\Windows\System\oJVFqRm.exe
  C:\Windows\System\oJVFqRm.exe
  2⤵
  - Executes dropped EXE
  PID:1532
- C:\Windows\System\CpbepIK.exe
  C:\Windows\System\CpbepIK.exe
  2⤵
  - Executes dropped EXE
  PID:1172
- C:\Windows\System\VfHBEWe.exe
  C:\Windows\System\VfHBEWe.exe
  2⤵
  - Executes dropped EXE
  PID:3020
- C:\Windows\System\uxnuXYR.exe
  C:\Windows\System\uxnuXYR.exe
  2⤵
  - Executes dropped EXE
  PID:1940
- C:\Windows\System\zEJvpmf.exe
  C:\Windows\System\zEJvpmf.exe
  2⤵
  - Executes dropped EXE
  PID:1616
- C:\Windows\System\SItkLrp.exe
  C:\Windows\System\SItkLrp.exe
  2⤵
  - Executes dropped EXE
  PID:1796
- C:\Windows\System\XrWlnqm.exe
  C:\Windows\System\XrWlnqm.exe
  2⤵
  - Executes dropped EXE
  PID:1636
- C:\Windows\System\wStjfmr.exe
  C:\Windows\System\wStjfmr.exe
  2⤵
  - Executes dropped EXE
  PID:628
- C:\Windows\System\eKmEtrR.exe
  C:\Windows\System\eKmEtrR.exe
  2⤵
  - Executes dropped EXE
  PID:2364
- C:\Windows\System\NSMbbNI.exe
  C:\Windows\System\NSMbbNI.exe
  2⤵
  - Executes dropped EXE
  PID:2148
- C:\Windows\System\QXqROca.exe
  C:\Windows\System\QXqROca.exe
  2⤵
  - Executes dropped EXE
  PID:2900
- C:\Windows\System\ePYTGqW.exe
  C:\Windows\System\ePYTGqW.exe
  2⤵
  - Executes dropped EXE
  PID:2996
- C:\Windows\System\slxHvmQ.exe
  C:\Windows\System\slxHvmQ.exe
  2⤵
  - Executes dropped EXE
  PID:1668
- C:\Windows\System\YFOjkfN.exe
  C:\Windows\System\YFOjkfN.exe
  2⤵
  - Executes dropped EXE
  PID:884
- C:\Windows\System\nWjaqjl.exe
  C:\Windows\System\nWjaqjl.exe
  2⤵
  - Executes dropped EXE
  PID:2228
- C:\Windows\System\czqHDMH.exe
  C:\Windows\System\czqHDMH.exe
  2⤵
  - Executes dropped EXE
  PID:2844
- C:\Windows\System\KODFAwC.exe
  C:\Windows\System\KODFAwC.exe
  2⤵
  - Executes dropped EXE
  PID:1588
- C:\Windows\System\WSrbDVK.exe
  C:\Windows\System\WSrbDVK.exe
  2⤵
  PID:1708
- C:\Windows\System\YhgvcLw.exe
  C:\Windows\System\YhgvcLw.exe
  2⤵
  - Executes dropped EXE
  PID:3044
- C:\Windows\System\vNxByho.exe
  C:\Windows\System\vNxByho.exe
  2⤵
  PID:2804
- C:\Windows\System\alwMSGQ.exe
  C:\Windows\System\alwMSGQ.exe
  2⤵
  - Executes dropped EXE
  PID:2820
- C:\Windows\System\jYNeewr.exe
  C:\Windows\System\jYNeewr.exe
  2⤵
  PID:2632
- C:\Windows\System\KsZGJGK.exe
  C:\Windows\System\KsZGJGK.exe
  2⤵
  - Executes dropped EXE
  PID:2636
- C:\Windows\System\uIGhKTk.exe
  C:\Windows\System\uIGhKTk.exe
  2⤵
  PID:2524
- C:\Windows\System\lPDkvBF.exe
  C:\Windows\System\lPDkvBF.exe
  2⤵
  - Executes dropped EXE
  PID:2644
- C:\Windows\System\iBgKZIq.exe
  C:\Windows\System\iBgKZIq.exe
  2⤵
  PID:2468
- C:\Windows\System\eVKNsXd.exe
  C:\Windows\System\eVKNsXd.exe
  2⤵
  - Executes dropped EXE
  PID:900
- C:\Windows\System\HHwKbWb.exe
  C:\Windows\System\HHwKbWb.exe
  2⤵
  PID:2124
- C:\Windows\System\EkDllXd.exe
  C:\Windows\System\EkDllXd.exe
  2⤵
  - Executes dropped EXE
  PID:468
- C:\Windows\System\CuxcmzC.exe
  C:\Windows\System\CuxcmzC.exe
  2⤵
  PID:1364
- C:\Windows\System\edvbJmh.exe
  C:\Windows\System\edvbJmh.exe
  2⤵
  - Executes dropped EXE
  PID:2512
- C:\Windows\System\oUDZvTu.exe
  C:\Windows\System\oUDZvTu.exe
  2⤵
  PID:2568
- C:\Windows\System\lYwerEb.exe
  C:\Windows\System\lYwerEb.exe
  2⤵
  - Executes dropped EXE
  PID:1140
- C:\Windows\System\HQtCeAh.exe
  C:\Windows\System\HQtCeAh.exe
  2⤵
  PID:2244
- C:\Windows\System\eNLzvHL.exe
  C:\Windows\System\eNLzvHL.exe
  2⤵
  - Executes dropped EXE
  PID:2560
- C:\Windows\System\xqGtlOS.exe
  C:\Windows\System\xqGtlOS.exe
  2⤵
  PID:2864
- C:\Windows\System\XrzPHNr.exe
  C:\Windows\System\XrzPHNr.exe
  2⤵
  - Executes dropped EXE
  PID:1092
- C:\Windows\System\kPyBvyV.exe
  C:\Windows\System\kPyBvyV.exe
  2⤵
  PID:2404
- C:\Windows\System\tmBTWin.exe
  C:\Windows\System\tmBTWin.exe
  2⤵
  - Executes dropped EXE
  PID:2328
- C:\Windows\System\OGDoaRP.exe
  C:\Windows\System\OGDoaRP.exe
  2⤵
  PID:1684
- C:\Windows\System\GlJIdjX.exe
  C:\Windows\System\GlJIdjX.exe
  2⤵
  PID:1676
- C:\Windows\System\coZIftt.exe
  C:\Windows\System\coZIftt.exe
  2⤵
  PID:1620
- C:\Windows\System\zduOkmq.exe
  C:\Windows\System\zduOkmq.exe
  2⤵
  PID:1996
- C:\Windows\System\MSFsvQR.exe
  C:\Windows\System\MSFsvQR.exe
  2⤵
  PID:2656
- C:\Windows\System\eJpbEGG.exe
  C:\Windows\System\eJpbEGG.exe
  2⤵
  PID:1444
- C:\Windows\System\KNogHEn.exe
  C:\Windows\System\KNogHEn.exe
  2⤵
  PID:2268
- C:\Windows\System\LPnvniQ.exe
  C:\Windows\System\LPnvniQ.exe
  2⤵
  PID:764
- C:\Windows\System\KfnMIhh.exe
  C:\Windows\System\KfnMIhh.exe
  2⤵
  PID:2012
- C:\Windows\System\qcCHclw.exe
  C:\Windows\System\qcCHclw.exe
  2⤵
  PID:1468
- C:\Windows\System\wwgvfch.exe
  C:\Windows\System\wwgvfch.exe
  2⤵
  PID:1164
- C:\Windows\System\pfHfXRq.exe
  C:\Windows\System\pfHfXRq.exe
  2⤵
  PID:1816
- C:\Windows\System\hwBfrwk.exe
  C:\Windows\System\hwBfrwk.exe
  2⤵
  PID:1728
- C:\Windows\System\VBzTZxn.exe
  C:\Windows\System\VBzTZxn.exe
  2⤵
  PID:928
- C:\Windows\System\nDJvLwT.exe
  C:\Windows\System\nDJvLwT.exe
  2⤵
  PID:552
- C:\Windows\System\lybUpfE.exe
  C:\Windows\System\lybUpfE.exe
  2⤵
  PID:2060
- C:\Windows\System\qhJiCtX.exe
  C:\Windows\System\qhJiCtX.exe
  2⤵
  PID:872
- C:\Windows\System\UELvlWU.exe
  C:\Windows\System\UELvlWU.exe
  2⤵
  PID:2216
- C:\Windows\System\pSJsEJY.exe
  C:\Windows\System\pSJsEJY.exe
  2⤵
  PID:2192
- C:\Windows\System\cmdJxFt.exe
  C:\Windows\System\cmdJxFt.exe
  2⤵
  PID:1860
- C:\Windows\System\PXMjezH.exe
  C:\Windows\System\PXMjezH.exe
  2⤵
  PID:2472
- C:\Windows\System\LSUsyXL.exe
  C:\Windows\System\LSUsyXL.exe
  2⤵
  PID:584
- C:\Windows\System\MShtJxr.exe
  C:\Windows\System\MShtJxr.exe
  2⤵
  PID:1632
- C:\Windows\System\VFDQgqi.exe
  C:\Windows\System\VFDQgqi.exe
  2⤵
  PID:2516
- C:\Windows\System\akGhPfo.exe
  C:\Windows\System\akGhPfo.exe
  2⤵
  PID:2588
- C:\Windows\System\tTjJdcc.exe
  C:\Windows\System\tTjJdcc.exe
  2⤵
  PID:1976
- C:\Windows\System\SfxluTF.exe
  C:\Windows\System\SfxluTF.exe
  2⤵
  PID:1448
- C:\Windows\System\GNBgwJs.exe
  C:\Windows\System\GNBgwJs.exe
  2⤵
  PID:2668
- C:\Windows\System\ZSCezyG.exe
  C:\Windows\System\ZSCezyG.exe
  2⤵
  PID:1464
- C:\Windows\System\hhdKAQR.exe
  C:\Windows\System\hhdKAQR.exe
  2⤵
  PID:2920
- C:\Windows\System\HKyWOAS.exe
  C:\Windows\System\HKyWOAS.exe
  2⤵
  PID:2672
- C:\Windows\System\uqRkSfb.exe
  C:\Windows\System\uqRkSfb.exe
  2⤵
  PID:3084
- C:\Windows\System\nLHofBc.exe
  C:\Windows\System\nLHofBc.exe
  2⤵
  PID:3100
- C:\Windows\System\GVCgaNB.exe
  C:\Windows\System\GVCgaNB.exe
  2⤵
  PID:3116
- C:\Windows\System\IdfwvfJ.exe
  C:\Windows\System\IdfwvfJ.exe
  2⤵
  PID:3132
- C:\Windows\System\UOkoINd.exe
  C:\Windows\System\UOkoINd.exe
  2⤵
  PID:3148
- C:\Windows\System\GwIOeSV.exe
  C:\Windows\System\GwIOeSV.exe
  2⤵
  PID:3164
- C:\Windows\System\LSrXOny.exe
  C:\Windows\System\LSrXOny.exe
  2⤵
  PID:3180
- C:\Windows\System\BGSCqtO.exe
  C:\Windows\System\BGSCqtO.exe
  2⤵
  PID:3196
- C:\Windows\System\wNbjYSC.exe
  C:\Windows\System\wNbjYSC.exe
  2⤵
  PID:3212
- C:\Windows\System\rJklrPu.exe
  C:\Windows\System\rJklrPu.exe
  2⤵
  PID:3228
- C:\Windows\System\mijlGmc.exe
  C:\Windows\System\mijlGmc.exe
  2⤵
  PID:3248
- C:\Windows\System\sCtbAbg.exe
  C:\Windows\System\sCtbAbg.exe
  2⤵
  PID:3264
- C:\Windows\System\oLbixGq.exe
  C:\Windows\System\oLbixGq.exe
  2⤵
  PID:3280
- C:\Windows\System\mxjBdmz.exe
  C:\Windows\System\mxjBdmz.exe
  2⤵
  PID:3296
- C:\Windows\System\PJgkCUa.exe
  C:\Windows\System\PJgkCUa.exe
  2⤵
  PID:3312
- C:\Windows\System\RmulRui.exe
  C:\Windows\System\RmulRui.exe
  2⤵
  PID:3328
- C:\Windows\System\Vvnrooe.exe
  C:\Windows\System\Vvnrooe.exe
  2⤵
  PID:3344
- C:\Windows\System\sFoTkaJ.exe
  C:\Windows\System\sFoTkaJ.exe
  2⤵
  PID:3360
- C:\Windows\System\ZJhYjvS.exe
  C:\Windows\System\ZJhYjvS.exe
  2⤵
  PID:3376
- C:\Windows\System\UTsguWj.exe
  C:\Windows\System\UTsguWj.exe
  2⤵
  PID:3392
- C:\Windows\System\cKokOEn.exe
  C:\Windows\System\cKokOEn.exe
  2⤵
  PID:3408
- C:\Windows\System\iXJPVFW.exe
  C:\Windows\System\iXJPVFW.exe
  2⤵
  PID:3424
- C:\Windows\System\TGDXCdX.exe
  C:\Windows\System\TGDXCdX.exe
  2⤵
  PID:3440
- C:\Windows\System\SQGhtOD.exe
  C:\Windows\System\SQGhtOD.exe
  2⤵
  PID:3456
- C:\Windows\System\wriEVQL.exe
  C:\Windows\System\wriEVQL.exe
  2⤵
  PID:3472
- C:\Windows\System\UZZzDVD.exe
  C:\Windows\System\UZZzDVD.exe
  2⤵
  PID:3488
- C:\Windows\System\bsPTkvv.exe
  C:\Windows\System\bsPTkvv.exe
  2⤵
  PID:3504
- C:\Windows\System\pllMNPX.exe
  C:\Windows\System\pllMNPX.exe
  2⤵
  PID:3520
- C:\Windows\System\DViCjcy.exe
  C:\Windows\System\DViCjcy.exe
  2⤵
  PID:3536
- C:\Windows\System\yfhgEWs.exe
  C:\Windows\System\yfhgEWs.exe
  2⤵
  PID:3552
- C:\Windows\System\xdzKqFS.exe
  C:\Windows\System\xdzKqFS.exe
  2⤵
  PID:3568
- C:\Windows\System\artvEGU.exe
  C:\Windows\System\artvEGU.exe
  2⤵
  PID:3584
- C:\Windows\System\YvtLjGP.exe
  C:\Windows\System\YvtLjGP.exe
  2⤵
  PID:3600
- C:\Windows\System\kAFtvOW.exe
  C:\Windows\System\kAFtvOW.exe
  2⤵
  PID:3616
- C:\Windows\System\FscXWnA.exe
  C:\Windows\System\FscXWnA.exe
  2⤵
  PID:3636
- C:\Windows\System\DlAtcpo.exe
  C:\Windows\System\DlAtcpo.exe
  2⤵
  PID:3652
- C:\Windows\System\IOzURok.exe
  C:\Windows\System\IOzURok.exe
  2⤵
  PID:3668
- C:\Windows\System\YihoNnS.exe
  C:\Windows\System\YihoNnS.exe
  2⤵
  PID:3684
- C:\Windows\System\rWtRaPf.exe
  C:\Windows\System\rWtRaPf.exe
  2⤵
  PID:3700
- C:\Windows\System\miUNBng.exe
  C:\Windows\System\miUNBng.exe
  2⤵
  PID:3716
- C:\Windows\System\nGbjQiG.exe
  C:\Windows\System\nGbjQiG.exe
  2⤵
  PID:3732
- C:\Windows\System\mMTIKcf.exe
  C:\Windows\System\mMTIKcf.exe
  2⤵
  PID:3748
- C:\Windows\System\rLXUTPQ.exe
  C:\Windows\System\rLXUTPQ.exe
  2⤵
  PID:3764
- C:\Windows\System\HcocTKS.exe
  C:\Windows\System\HcocTKS.exe
  2⤵
  PID:3780
- C:\Windows\System\BSDCwvd.exe
  C:\Windows\System\BSDCwvd.exe
  2⤵
  PID:3796
- C:\Windows\System\TNqyBzu.exe
  C:\Windows\System\TNqyBzu.exe
  2⤵
  PID:3812
- C:\Windows\System\VmUztle.exe
  C:\Windows\System\VmUztle.exe
  2⤵
  PID:3828
- C:\Windows\System\SHzrPxA.exe
  C:\Windows\System\SHzrPxA.exe
  2⤵
  PID:3844
- C:\Windows\System\yoOeqAF.exe
  C:\Windows\System\yoOeqAF.exe
  2⤵
  PID:3860
- C:\Windows\System\bLngVTl.exe
  C:\Windows\System\bLngVTl.exe
  2⤵
  PID:3876
- C:\Windows\System\rKAipNZ.exe
  C:\Windows\System\rKAipNZ.exe
  2⤵
  PID:3892
- C:\Windows\System\bGtKyVq.exe
  C:\Windows\System\bGtKyVq.exe
  2⤵
  PID:3916
- C:\Windows\System\AWWmyCq.exe
  C:\Windows\System\AWWmyCq.exe
  2⤵
  PID:3940
- C:\Windows\System\zIiSepo.exe
  C:\Windows\System\zIiSepo.exe
  2⤵
  PID:4028
- C:\Windows\System\szeEGRp.exe
  C:\Windows\System\szeEGRp.exe
  2⤵
  PID:4044
- C:\Windows\System\qQRBnaX.exe
  C:\Windows\System\qQRBnaX.exe
  2⤵
  PID:4060
- C:\Windows\System\KzSswRk.exe
  C:\Windows\System\KzSswRk.exe
  2⤵
  PID:4076
- C:\Windows\System\wfPttGx.exe
  C:\Windows\System\wfPttGx.exe
  2⤵
  PID:4092
- C:\Windows\System\QmAPAHF.exe
  C:\Windows\System\QmAPAHF.exe
  2⤵
  PID:2188
- C:\Windows\System\ZsIFcur.exe
  C:\Windows\System\ZsIFcur.exe
  2⤵
  PID:1704
- C:\Windows\System\rZEKJdo.exe
  C:\Windows\System\rZEKJdo.exe
  2⤵
  PID:324
- C:\Windows\System\RZnMdXz.exe
  C:\Windows\System\RZnMdXz.exe
  2⤵
  PID:1128
- C:\Windows\System\ebRFQye.exe
  C:\Windows\System\ebRFQye.exe
  2⤵
  PID:3096
- C:\Windows\System\NImxMMa.exe
  C:\Windows\System\NImxMMa.exe
  2⤵
  PID:1356
- C:\Windows\System\pKNwUfl.exe
  C:\Windows\System\pKNwUfl.exe
  2⤵
  PID:3192
- C:\Windows\System\BGoIFVE.exe
  C:\Windows\System\BGoIFVE.exe
  2⤵
  PID:3260
- C:\Windows\System\LFgpTDK.exe
  C:\Windows\System\LFgpTDK.exe
  2⤵
  PID:3320
- C:\Windows\System\jLWtYuB.exe
  C:\Windows\System\jLWtYuB.exe
  2⤵
  PID:3384
- C:\Windows\System\bynoPIr.exe
  C:\Windows\System\bynoPIr.exe
  2⤵
  PID:3448
- C:\Windows\System\HGimWpA.exe
  C:\Windows\System\HGimWpA.exe
  2⤵
  PID:3544
- C:\Windows\System\qllTPgD.exe
  C:\Windows\System\qllTPgD.exe
  2⤵
  PID:3644
- C:\Windows\System\wXdysmc.exe
  C:\Windows\System\wXdysmc.exe
  2⤵
  PID:3708
- C:\Windows\System\rICdgfr.exe
  C:\Windows\System\rICdgfr.exe
  2⤵
  PID:3772
- C:\Windows\System\USXYTOz.exe
  C:\Windows\System\USXYTOz.exe
  2⤵
  PID:1872
- C:\Windows\System\oDlfCrF.exe
  C:\Windows\System\oDlfCrF.exe
  2⤵
  PID:3836
- C:\Windows\System\pZHuPtg.exe
  C:\Windows\System\pZHuPtg.exe
  2⤵
  PID:2320
- C:\Windows\System\TvfafPy.exe
  C:\Windows\System\TvfafPy.exe
  2⤵
  PID:3908
- C:\Windows\System\SymbbbJ.exe
  C:\Windows\System\SymbbbJ.exe
  2⤵
  PID:3956
- C:\Windows\System\PoFzrzv.exe
  C:\Windows\System\PoFzrzv.exe
  2⤵
  PID:3968
- C:\Windows\System\thFWuSs.exe
  C:\Windows\System\thFWuSs.exe
  2⤵
  PID:3992
- C:\Windows\System\yQLVOAy.exe
  C:\Windows\System\yQLVOAy.exe
  2⤵
  PID:4004
- C:\Windows\System\dwvVHXg.exe
  C:\Windows\System\dwvVHXg.exe
  2⤵
  PID:4020
- C:\Windows\System\SgaCSIr.exe
  C:\Windows\System\SgaCSIr.exe
  2⤵
  PID:4056
- C:\Windows\System\twgGcly.exe
  C:\Windows\System\twgGcly.exe
  2⤵
  PID:852
- C:\Windows\System\ltbzJiH.exe
  C:\Windows\System\ltbzJiH.exe
  2⤵
  PID:3156
- C:\Windows\System\mTUzXWd.exe
  C:\Windows\System\mTUzXWd.exe
  2⤵
  PID:3352
- C:\Windows\System\tKzFVXU.exe
  C:\Windows\System\tKzFVXU.exe
  2⤵
  PID:3516
- C:\Windows\System\vWWIbZL.exe
  C:\Windows\System\vWWIbZL.exe
  2⤵
  PID:3808
- C:\Windows\System\TiTooha.exe
  C:\Windows\System\TiTooha.exe
  2⤵
  PID:4104
- C:\Windows\System\YkzGMAz.exe
  C:\Windows\System\YkzGMAz.exe
  2⤵
  PID:4120
- C:\Windows\System\bRAKEoW.exe
  C:\Windows\System\bRAKEoW.exe
  2⤵
  PID:4136
- C:\Windows\System\BslVmLI.exe
  C:\Windows\System\BslVmLI.exe
  2⤵
  PID:4152
- C:\Windows\System\TbggxPL.exe
  C:\Windows\System\TbggxPL.exe
  2⤵
  PID:4168
- C:\Windows\System\JmxIvUh.exe
  C:\Windows\System\JmxIvUh.exe
  2⤵
  PID:4184
- C:\Windows\System\RBnQuSc.exe
  C:\Windows\System\RBnQuSc.exe
  2⤵
  PID:4200
- C:\Windows\System\dwVfbBC.exe
  C:\Windows\System\dwVfbBC.exe
  2⤵
  PID:4216
- C:\Windows\System\gmrIXRL.exe
  C:\Windows\System\gmrIXRL.exe
  2⤵
  PID:4232
- C:\Windows\System\eBWOJpK.exe
  C:\Windows\System\eBWOJpK.exe
  2⤵
  PID:4248
- C:\Windows\System\EgZfuOA.exe
  C:\Windows\System\EgZfuOA.exe
  2⤵
  PID:4264
- C:\Windows\System\pffmZyo.exe
  C:\Windows\System\pffmZyo.exe
  2⤵
  PID:4284
- C:\Windows\System\RCvNyHV.exe
  C:\Windows\System\RCvNyHV.exe
  2⤵
  PID:4300
- C:\Windows\System\CmggStf.exe
  C:\Windows\System\CmggStf.exe
  2⤵
  PID:4316
- C:\Windows\System\bshbNZS.exe
  C:\Windows\System\bshbNZS.exe
  2⤵
  PID:4332
- C:\Windows\System\DcSVOVN.exe
  C:\Windows\System\DcSVOVN.exe
  2⤵
  PID:4348
- C:\Windows\System\kyUJQpb.exe
  C:\Windows\System\kyUJQpb.exe
  2⤵
  PID:4364
- C:\Windows\System\xDYkGoz.exe
  C:\Windows\System\xDYkGoz.exe
  2⤵
  PID:4380
- C:\Windows\System\WSNSNDv.exe
  C:\Windows\System\WSNSNDv.exe
  2⤵
  PID:4396
- C:\Windows\System\pCsxMsB.exe
  C:\Windows\System\pCsxMsB.exe
  2⤵
  PID:4412
- C:\Windows\System\ofvljJy.exe
  C:\Windows\System\ofvljJy.exe
  2⤵
  PID:4428
- C:\Windows\System\ReNHOhs.exe
  C:\Windows\System\ReNHOhs.exe
  2⤵
  PID:4444
- C:\Windows\System\NuxWfSk.exe
  C:\Windows\System\NuxWfSk.exe
  2⤵
  PID:4460
- C:\Windows\System\OEHUHdc.exe
  C:\Windows\System\OEHUHdc.exe
  2⤵
  PID:4476
- C:\Windows\System\PKLMBTw.exe
  C:\Windows\System\PKLMBTw.exe
  2⤵
  PID:4492
- C:\Windows\System\IHeVBtd.exe
  C:\Windows\System\IHeVBtd.exe
  2⤵
  PID:4508
- C:\Windows\System\DGrvnYD.exe
  C:\Windows\System\DGrvnYD.exe
  2⤵
  PID:4524
- C:\Windows\System\AYdQlmO.exe
  C:\Windows\System\AYdQlmO.exe
  2⤵
  PID:4540
- C:\Windows\System\eBmHLsV.exe
  C:\Windows\System\eBmHLsV.exe
  2⤵
  PID:4556
- C:\Windows\System\snTmZFC.exe
  C:\Windows\System\snTmZFC.exe
  2⤵
  PID:4572
- C:\Windows\System\QjYArEx.exe
  C:\Windows\System\QjYArEx.exe
  2⤵
  PID:4588
- C:\Windows\System\CvkfFuf.exe
  C:\Windows\System\CvkfFuf.exe
  2⤵
  PID:4604
- C:\Windows\System\vGuGXrX.exe
  C:\Windows\System\vGuGXrX.exe
  2⤵
  PID:4620
- C:\Windows\System\NebBBov.exe
  C:\Windows\System\NebBBov.exe
  2⤵
  PID:4636
- C:\Windows\System\ANuDOYG.exe
  C:\Windows\System\ANuDOYG.exe
  2⤵
  PID:4652
- C:\Windows\System\XnWvveP.exe
  C:\Windows\System\XnWvveP.exe
  2⤵
  PID:4668
- C:\Windows\System\bZrwTKj.exe
  C:\Windows\System\bZrwTKj.exe
  2⤵
  PID:4684
- C:\Windows\System\yHjTfuh.exe
  C:\Windows\System\yHjTfuh.exe
  2⤵
  PID:4700
- C:\Windows\System\CNxHVBt.exe
  C:\Windows\System\CNxHVBt.exe
  2⤵
  PID:4716
- C:\Windows\System\NgXWpWP.exe
  C:\Windows\System\NgXWpWP.exe
  2⤵
  PID:4732
- C:\Windows\System\OHMTSxb.exe
  C:\Windows\System\OHMTSxb.exe
  2⤵
  PID:4748
- C:\Windows\System\qYuVgWV.exe
  C:\Windows\System\qYuVgWV.exe
  2⤵
  PID:4764
- C:\Windows\System\VFHsaXq.exe
  C:\Windows\System\VFHsaXq.exe
  2⤵
  PID:4780
- C:\Windows\System\pjxuKti.exe
  C:\Windows\System\pjxuKti.exe
  2⤵
  PID:4796
- C:\Windows\System\GONyePK.exe
  C:\Windows\System\GONyePK.exe
  2⤵
  PID:4812
- C:\Windows\System\ilKTFOP.exe
  C:\Windows\System\ilKTFOP.exe
  2⤵
  PID:4828
- C:\Windows\System\vPjLwCd.exe
  C:\Windows\System\vPjLwCd.exe
  2⤵
  PID:4844
- C:\Windows\System\UJfFtFV.exe
  C:\Windows\System\UJfFtFV.exe
  2⤵
  PID:4860
- C:\Windows\System\yoCGIHJ.exe
  C:\Windows\System\yoCGIHJ.exe
  2⤵
  PID:4876
- C:\Windows\System\FhZmpCb.exe
  C:\Windows\System\FhZmpCb.exe
  2⤵
  PID:4892
- C:\Windows\System\foQxGPO.exe
  C:\Windows\System\foQxGPO.exe
  2⤵
  PID:4908
- C:\Windows\System\ZbpZqYa.exe
  C:\Windows\System\ZbpZqYa.exe
  2⤵
  PID:4924
- C:\Windows\System\yGTJXns.exe
  C:\Windows\System\yGTJXns.exe
  2⤵
  PID:4940
- C:\Windows\System\QUEvwCE.exe
  C:\Windows\System\QUEvwCE.exe
  2⤵
  PID:4956
- C:\Windows\System\GZKjhWR.exe
  C:\Windows\System\GZKjhWR.exe
  2⤵
  PID:4972
- C:\Windows\System\pZGoHdn.exe
  C:\Windows\System\pZGoHdn.exe
  2⤵
  PID:4988
- C:\Windows\System\UwZdzXu.exe
  C:\Windows\System\UwZdzXu.exe
  2⤵
  PID:5004
- C:\Windows\System\RdSejXZ.exe
  C:\Windows\System\RdSejXZ.exe
  2⤵
  PID:5020
- C:\Windows\System\lzsRsUM.exe
  C:\Windows\System\lzsRsUM.exe
  2⤵
  PID:5036
- C:\Windows\System\yYwIMMb.exe
  C:\Windows\System\yYwIMMb.exe
  2⤵
  PID:5052
- C:\Windows\System\VLVWFUt.exe
  C:\Windows\System\VLVWFUt.exe
  2⤵
  PID:5072
- C:\Windows\System\sUOYDqB.exe
  C:\Windows\System\sUOYDqB.exe
  2⤵
  PID:5088
- C:\Windows\System\HRcOlfr.exe
  C:\Windows\System\HRcOlfr.exe
  2⤵
  PID:5104
- C:\Windows\System\dWDZFGH.exe
  C:\Windows\System\dWDZFGH.exe
  2⤵
  PID:3952
- C:\Windows\System\ydiYrcA.exe
  C:\Windows\System\ydiYrcA.exe
  2⤵
  PID:4012
- C:\Windows\System\ihCrCbh.exe
  C:\Windows\System\ihCrCbh.exe
  2⤵
  PID:1244
- C:\Windows\System\TjoaUFm.exe
  C:\Windows\System\TjoaUFm.exe
  2⤵
  PID:3680
- C:\Windows\System\FfphAjL.exe
  C:\Windows\System\FfphAjL.exe
  2⤵
  PID:4144
- C:\Windows\System\iHvSfOT.exe
  C:\Windows\System\iHvSfOT.exe
  2⤵
  PID:4208
- C:\Windows\System\YdMekEn.exe
  C:\Windows\System\YdMekEn.exe
  2⤵
  PID:4272
- C:\Windows\System\tcnHsUM.exe
  C:\Windows\System\tcnHsUM.exe
  2⤵
  PID:4312
- C:\Windows\System\xmcVWzV.exe
  C:\Windows\System\xmcVWzV.exe
  2⤵
  PID:4376
- C:\Windows\System\Ndqoyev.exe
  C:\Windows\System\Ndqoyev.exe
  2⤵
  PID:4440
- C:\Windows\System\aAkuxYp.exe
  C:\Windows\System\aAkuxYp.exe
  2⤵
  PID:4504
- C:\Windows\System\dcwFRDQ.exe
  C:\Windows\System\dcwFRDQ.exe
  2⤵
  PID:4568
- C:\Windows\System\CFauUYj.exe
  C:\Windows\System\CFauUYj.exe
  2⤵
  PID:4628
- C:\Windows\System\xRwlsGT.exe
  C:\Windows\System\xRwlsGT.exe
  2⤵
  PID:4664
- C:\Windows\System\VjNDKiM.exe
  C:\Windows\System\VjNDKiM.exe
  2⤵
  PID:4728
- C:\Windows\System\SCqoBzw.exe
  C:\Windows\System\SCqoBzw.exe
  2⤵
  PID:4792
- C:\Windows\System\tbyuzWH.exe
  C:\Windows\System\tbyuzWH.exe
  2⤵
  PID:4856
- C:\Windows\System\mOUsfis.exe
  C:\Windows\System\mOUsfis.exe
  2⤵
  PID:4916
- C:\Windows\System\gqMIOZy.exe
  C:\Windows\System\gqMIOZy.exe
  2⤵
  PID:4980
- C:\Windows\System\teyeKyn.exe
  C:\Windows\System\teyeKyn.exe
  2⤵
  PID:5044
- C:\Windows\System\LDwpWwL.exe
  C:\Windows\System\LDwpWwL.exe
  2⤵
  PID:1956
- C:\Windows\System\mQLYHlV.exe
  C:\Windows\System\mQLYHlV.exe
  2⤵
  PID:4244
- C:\Windows\System\hUmKjNH.exe
  C:\Windows\System\hUmKjNH.exe
  2⤵
  PID:5132
- C:\Windows\System\AwiFSIL.exe
  C:\Windows\System\AwiFSIL.exe
  2⤵
  PID:5148
- C:\Windows\System\vWFblrx.exe
  C:\Windows\System\vWFblrx.exe
  2⤵
  PID:5172
- C:\Windows\System\NFSBkJS.exe
  C:\Windows\System\NFSBkJS.exe
  2⤵
  PID:5188
- C:\Windows\System\ryhmVVD.exe
  C:\Windows\System\ryhmVVD.exe
  2⤵
  PID:5204
- C:\Windows\System\YBZxNFo.exe
  C:\Windows\System\YBZxNFo.exe
  2⤵
  PID:5220
- C:\Windows\System\EdpFZAZ.exe
  C:\Windows\System\EdpFZAZ.exe
  2⤵
  PID:5236
- C:\Windows\System\ACPseyy.exe
  C:\Windows\System\ACPseyy.exe
  2⤵
  PID:5252
- C:\Windows\System\yiJwXJf.exe
  C:\Windows\System\yiJwXJf.exe
  2⤵
  PID:5268
- C:\Windows\System\CBKkVXT.exe
  C:\Windows\System\CBKkVXT.exe
  2⤵
  PID:5284
- C:\Windows\System\TfUKGAY.exe
  C:\Windows\System\TfUKGAY.exe
  2⤵
  PID:5300
- C:\Windows\System\NlQWlwJ.exe
  C:\Windows\System\NlQWlwJ.exe
  2⤵
  PID:5316
- C:\Windows\System\dXwJKIF.exe
  C:\Windows\System\dXwJKIF.exe
  2⤵
  PID:5332
- C:\Windows\System\UiKcXfc.exe
  C:\Windows\System\UiKcXfc.exe
  2⤵
  PID:5348
- C:\Windows\System\sJQWgDo.exe
  C:\Windows\System\sJQWgDo.exe
  2⤵
  PID:5364
- C:\Windows\System\aXmqyPT.exe
  C:\Windows\System\aXmqyPT.exe
  2⤵
  PID:5380
- C:\Windows\System\kXUzdAu.exe
  C:\Windows\System\kXUzdAu.exe
  2⤵
  PID:5396
- C:\Windows\System\yddyPpS.exe
  C:\Windows\System\yddyPpS.exe
  2⤵
  PID:5412
- C:\Windows\System\JgPoRLI.exe
  C:\Windows\System\JgPoRLI.exe
  2⤵
  PID:5428
- C:\Windows\System\DYpHSyS.exe
  C:\Windows\System\DYpHSyS.exe
  2⤵
  PID:5448
- C:\Windows\System\fdAUUnB.exe
  C:\Windows\System\fdAUUnB.exe
  2⤵
  PID:5464
- C:\Windows\System\cytBZSm.exe
  C:\Windows\System\cytBZSm.exe
  2⤵
  PID:5480
- C:\Windows\System\WWECGFa.exe
  C:\Windows\System\WWECGFa.exe
  2⤵
  PID:5496
- C:\Windows\System\jEYpXaI.exe
  C:\Windows\System\jEYpXaI.exe
  2⤵
  PID:5512
- C:\Windows\System\dksHGqC.exe
  C:\Windows\System\dksHGqC.exe
  2⤵
  PID:5528
- C:\Windows\System\AkeyLhC.exe
  C:\Windows\System\AkeyLhC.exe
  2⤵
  PID:5544
- C:\Windows\System\loCRZXD.exe
  C:\Windows\System\loCRZXD.exe
  2⤵
  PID:5560
- C:\Windows\System\TkdjnJW.exe
  C:\Windows\System\TkdjnJW.exe
  2⤵
  PID:5576
- C:\Windows\System\pysXYvd.exe
  C:\Windows\System\pysXYvd.exe
  2⤵
  PID:5592
- C:\Windows\System\zmiClNQ.exe
  C:\Windows\System\zmiClNQ.exe
  2⤵
  PID:5608
- C:\Windows\System\gLErbEr.exe
  C:\Windows\System\gLErbEr.exe
  2⤵
  PID:5624
- C:\Windows\System\LQCortA.exe
  C:\Windows\System\LQCortA.exe
  2⤵
  PID:5640
- C:\Windows\System\CbJYwXm.exe
  C:\Windows\System\CbJYwXm.exe
  2⤵
  PID:5656
- C:\Windows\System\VgAGFGB.exe
  C:\Windows\System\VgAGFGB.exe
  2⤵
  PID:5672
- C:\Windows\System\bNRArXW.exe
  C:\Windows\System\bNRArXW.exe
  2⤵
  PID:5688
- C:\Windows\System\fuiSgka.exe
  C:\Windows\System\fuiSgka.exe
  2⤵
  PID:5704
- C:\Windows\System\IKJOwZI.exe
  C:\Windows\System\IKJOwZI.exe
  2⤵
  PID:5720
- C:\Windows\System\ILduWiq.exe
  C:\Windows\System\ILduWiq.exe
  2⤵
  PID:5736
- C:\Windows\System\iTstIgX.exe
  C:\Windows\System\iTstIgX.exe
  2⤵
  PID:5752
- C:\Windows\System\kYsAuep.exe
  C:\Windows\System\kYsAuep.exe
  2⤵
  PID:5768
- C:\Windows\System\rlSGHZc.exe
  C:\Windows\System\rlSGHZc.exe
  2⤵
  PID:5784
- C:\Windows\System\jSgspmQ.exe
  C:\Windows\System\jSgspmQ.exe
  2⤵
  PID:5800
- C:\Windows\System\sWLLSBM.exe
  C:\Windows\System\sWLLSBM.exe
  2⤵
  PID:5816
- C:\Windows\System\DQIvAez.exe
  C:\Windows\System\DQIvAez.exe
  2⤵
  PID:5832
- C:\Windows\System\sOBJdbZ.exe
  C:\Windows\System\sOBJdbZ.exe
  2⤵
  PID:5848
- C:\Windows\System\stNkKYx.exe
  C:\Windows\System\stNkKYx.exe
  2⤵
  PID:5864
- C:\Windows\System\AUWBrkg.exe
  C:\Windows\System\AUWBrkg.exe
  2⤵
  PID:5880
- C:\Windows\System\dmOQDJl.exe
  C:\Windows\System\dmOQDJl.exe
  2⤵
  PID:5900
- C:\Windows\System\dksqFUA.exe
  C:\Windows\System\dksqFUA.exe
  2⤵
  PID:5916
- C:\Windows\System\QJvcnCC.exe
  C:\Windows\System\QJvcnCC.exe
  2⤵
  PID:5932
- C:\Windows\System\eUxsofE.exe
  C:\Windows\System\eUxsofE.exe
  2⤵
  PID:5948
- C:\Windows\System\AAEgACD.exe
  C:\Windows\System\AAEgACD.exe
  2⤵
  PID:5964
- C:\Windows\System\WWyZZLl.exe
  C:\Windows\System\WWyZZLl.exe
  2⤵
  PID:5980
- C:\Windows\System\buRUnjx.exe
  C:\Windows\System\buRUnjx.exe
  2⤵
  PID:5996
- C:\Windows\System\XRRiQOQ.exe
  C:\Windows\System\XRRiQOQ.exe
  2⤵
  PID:6012
- C:\Windows\System\EStKsWo.exe
  C:\Windows\System\EStKsWo.exe
  2⤵
  PID:6028
- C:\Windows\System\poZHlZO.exe
  C:\Windows\System\poZHlZO.exe
  2⤵
  PID:6044
- C:\Windows\System\kayVyOv.exe
  C:\Windows\System\kayVyOv.exe
  2⤵
  PID:6060
- C:\Windows\System\dCdJOho.exe
  C:\Windows\System\dCdJOho.exe
  2⤵
  PID:6076
- C:\Windows\System\xjaJWlm.exe
  C:\Windows\System\xjaJWlm.exe
  2⤵
  PID:6092
- C:\Windows\System\JOtDgxX.exe
  C:\Windows\System\JOtDgxX.exe
  2⤵
  PID:6108
- C:\Windows\System\mmNfikP.exe
  C:\Windows\System\mmNfikP.exe
  2⤵
  PID:6124
- C:\Windows\System\PzBxtce.exe
  C:\Windows\System\PzBxtce.exe
  2⤵
  PID:6140
- C:\Windows\System\DymPgMC.exe
  C:\Windows\System\DymPgMC.exe
  2⤵
  PID:4600
- C:\Windows\System\yzNKyEy.exe
  C:\Windows\System\yzNKyEy.exe
  2⤵
  PID:4824
- C:\Windows\System\hJbgqKl.exe
  C:\Windows\System\hJbgqKl.exe
  2⤵
  PID:5080
- C:\Windows\System\KFSUCkG.exe
  C:\Windows\System\KFSUCkG.exe
  2⤵
  PID:3028
- C:\Windows\System\JhkrWKk.exe
  C:\Windows\System\JhkrWKk.exe
  2⤵
  PID:5160
- C:\Windows\System\mcoTzgn.exe
  C:\Windows\System\mcoTzgn.exe
  2⤵
  PID:5228
- C:\Windows\System\WOMVeQl.exe
  C:\Windows\System\WOMVeQl.exe
  2⤵
  PID:5264
- C:\Windows\System\vhqGOqF.exe
  C:\Windows\System\vhqGOqF.exe
  2⤵
  PID:5328
- C:\Windows\System\FKEcuNm.exe
  C:\Windows\System\FKEcuNm.exe
  2⤵
  PID:5388
- C:\Windows\System\aRKnsnY.exe
  C:\Windows\System\aRKnsnY.exe
  2⤵
  PID:5424
- C:\Windows\System\UxJnJTH.exe
  C:\Windows\System\UxJnJTH.exe
  2⤵
  PID:5492
- C:\Windows\System\oDnzfRI.exe
  C:\Windows\System\oDnzfRI.exe
  2⤵
  PID:5556
- C:\Windows\System\Jlczunk.exe
  C:\Windows\System\Jlczunk.exe
  2⤵
  PID:1604
- C:\Windows\System\QKZoPMY.exe
  C:\Windows\System\QKZoPMY.exe
  2⤵
  PID:5648
- C:\Windows\System\eSRzTue.exe
  C:\Windows\System\eSRzTue.exe
  2⤵
  PID:5684
- C:\Windows\System\wZvkNck.exe
  C:\Windows\System\wZvkNck.exe
  2⤵
  PID:5716
- C:\Windows\System\UTxUeJG.exe
  C:\Windows\System\UTxUeJG.exe
  2⤵
  PID:5776
- C:\Windows\System\fqcOJEg.exe
  C:\Windows\System\fqcOJEg.exe
  2⤵
  PID:1500
- C:\Windows\System\UkhbbiN.exe
  C:\Windows\System\UkhbbiN.exe
  2⤵
  PID:1496
- C:\Windows\System\DUttBnl.exe
  C:\Windows\System\DUttBnl.exe
  2⤵
  PID:2256
- C:\Windows\System\KSkAiZA.exe
  C:\Windows\System\KSkAiZA.exe
  2⤵
  PID:1072
- C:\Windows\System\qkmQxdu.exe
  C:\Windows\System\qkmQxdu.exe
  2⤵
  PID:5908
- C:\Windows\System\BfZXCfj.exe
  C:\Windows\System\BfZXCfj.exe
  2⤵
  PID:5972
- C:\Windows\System\KrPmyKA.exe
  C:\Windows\System\KrPmyKA.exe
  2⤵
  PID:6036
- C:\Windows\System\kEPndeM.exe
  C:\Windows\System\kEPndeM.exe
  2⤵
  PID:6100
- C:\Windows\System\GIcvjRa.exe
  C:\Windows\System\GIcvjRa.exe
  2⤵
  PID:4696
- C:\Windows\System\cjQRqcQ.exe
  C:\Windows\System\cjQRqcQ.exe
  2⤵
  PID:5084
- C:\Windows\System\DbLqbcg.exe
  C:\Windows\System\DbLqbcg.exe
  2⤵
  PID:5196
- C:\Windows\System\JeafIWY.exe
  C:\Windows\System\JeafIWY.exe
  2⤵
  PID:5392
- C:\Windows\System\IWzEgYc.exe
  C:\Windows\System\IWzEgYc.exe
  2⤵
  PID:1136
- C:\Windows\System\htvIqWy.exe
  C:\Windows\System\htvIqWy.exe
  2⤵
  PID:1664
- C:\Windows\System\KyuhxkZ.exe
  C:\Windows\System\KyuhxkZ.exe
  2⤵
  PID:620
- C:\Windows\System\YcHuQTr.exe
  C:\Windows\System\YcHuQTr.exe
  2⤵
  PID:6132
- C:\Windows\System\ySfbzQd.exe
  C:\Windows\System\ySfbzQd.exe
  2⤵
  PID:5524
- C:\Windows\System\WzZYpbk.exe
  C:\Windows\System\WzZYpbk.exe
  2⤵
  PID:2892
- C:\Windows\System\qOfCevN.exe
  C:\Windows\System\qOfCevN.exe
  2⤵
  PID:3988
- C:\Windows\System\LEMBTMf.exe
  C:\Windows\System\LEMBTMf.exe
  2⤵
  PID:1936
- C:\Windows\System\KYwHLnx.exe
  C:\Windows\System\KYwHLnx.exe
  2⤵
  PID:3984
- C:\Windows\System\pYrlSTf.exe
  C:\Windows\System\pYrlSTf.exe
  2⤵
  PID:6160
- C:\Windows\System\kMBdupI.exe
  C:\Windows\System\kMBdupI.exe
  2⤵
  PID:6176
- C:\Windows\System\bTfWIKs.exe
  C:\Windows\System\bTfWIKs.exe
  2⤵
  PID:6192
- C:\Windows\System\rPHjGmE.exe
  C:\Windows\System\rPHjGmE.exe
  2⤵
  PID:6208
- C:\Windows\System\eOZIXHz.exe
  C:\Windows\System\eOZIXHz.exe
  2⤵
  PID:6224
- C:\Windows\System\EOtfNgd.exe
  C:\Windows\System\EOtfNgd.exe
  2⤵
  PID:6240
- C:\Windows\System\JJDjxrV.exe
  C:\Windows\System\JJDjxrV.exe
  2⤵
  PID:6256
- C:\Windows\System\dhTSNXU.exe
  C:\Windows\System\dhTSNXU.exe
  2⤵
  PID:6272
- C:\Windows\System\LglIolx.exe
  C:\Windows\System\LglIolx.exe
  2⤵
  PID:6288
- C:\Windows\System\uoOhPKf.exe
  C:\Windows\System\uoOhPKf.exe
  2⤵
  PID:6304
- C:\Windows\System\ysFVIyU.exe
  C:\Windows\System\ysFVIyU.exe
  2⤵
  PID:6320
- C:\Windows\System\DZLLpqy.exe
  C:\Windows\System\DZLLpqy.exe
  2⤵
  PID:6336
- C:\Windows\System\eJbGvZi.exe
  C:\Windows\System\eJbGvZi.exe
  2⤵
  PID:6352
- C:\Windows\System\ADQVoSz.exe
  C:\Windows\System\ADQVoSz.exe
  2⤵
  PID:6368
- C:\Windows\System\LAAzVds.exe
  C:\Windows\System\LAAzVds.exe
  2⤵
  PID:6384
- C:\Windows\System\RuMoHYk.exe
  C:\Windows\System\RuMoHYk.exe
  2⤵
  PID:6400
- C:\Windows\System\GLsecuV.exe
  C:\Windows\System\GLsecuV.exe
  2⤵
  PID:6416
- C:\Windows\System\CgFBMhv.exe
  C:\Windows\System\CgFBMhv.exe
  2⤵
  PID:6432
- C:\Windows\System\jOVugvH.exe
  C:\Windows\System\jOVugvH.exe
  2⤵
  PID:6448
- C:\Windows\System\KmCEYzT.exe
  C:\Windows\System\KmCEYzT.exe
  2⤵
  PID:6464
- C:\Windows\System\isDmYGJ.exe
  C:\Windows\System\isDmYGJ.exe
  2⤵
  PID:6480
- C:\Windows\System\eVBxVXW.exe
  C:\Windows\System\eVBxVXW.exe
  2⤵
  PID:6496
- C:\Windows\System\qgyPLIM.exe
  C:\Windows\System\qgyPLIM.exe
  2⤵
  PID:6512
- C:\Windows\System\OyeaSrF.exe
  C:\Windows\System\OyeaSrF.exe
  2⤵
  PID:6528
- C:\Windows\System\ITWeagS.exe
  C:\Windows\System\ITWeagS.exe
  2⤵
  PID:6544
- C:\Windows\System\PhZZVoQ.exe
  C:\Windows\System\PhZZVoQ.exe
  2⤵
  PID:6560
- C:\Windows\System\LcTlCBm.exe
  C:\Windows\System\LcTlCBm.exe
  2⤵
  PID:6576
- C:\Windows\System\MDujFGN.exe
  C:\Windows\System\MDujFGN.exe
  2⤵
  PID:6592
- C:\Windows\System\qdxHrdQ.exe
  C:\Windows\System\qdxHrdQ.exe
  2⤵
  PID:6608
- C:\Windows\System\dIoCvLf.exe
  C:\Windows\System\dIoCvLf.exe
  2⤵
  PID:6624
- C:\Windows\System\aZHrvmn.exe
  C:\Windows\System\aZHrvmn.exe
  2⤵
  PID:6640
- C:\Windows\System\kAjXiJu.exe
  C:\Windows\System\kAjXiJu.exe
  2⤵
  PID:6656
- C:\Windows\System\BGeSajH.exe
  C:\Windows\System\BGeSajH.exe
  2⤵
  PID:6672
- C:\Windows\System\eTeGQBM.exe
  C:\Windows\System\eTeGQBM.exe
  2⤵
  PID:6692
- C:\Windows\System\JVZEnlX.exe
  C:\Windows\System\JVZEnlX.exe
  2⤵
  PID:6708
- C:\Windows\System\CRFwcza.exe
  C:\Windows\System\CRFwcza.exe
  2⤵
  PID:6724
- C:\Windows\System\ZlDBNUp.exe
  C:\Windows\System\ZlDBNUp.exe
  2⤵
  PID:6740
- C:\Windows\System\jYomSJZ.exe
  C:\Windows\System\jYomSJZ.exe
  2⤵
  PID:6756
- C:\Windows\System\xCjiGxv.exe
  C:\Windows\System\xCjiGxv.exe
  2⤵
  PID:6772
- C:\Windows\System\zYpjqJF.exe
  C:\Windows\System\zYpjqJF.exe
  2⤵
  PID:6788
- C:\Windows\System\FzqTyqY.exe
  C:\Windows\System\FzqTyqY.exe
  2⤵
  PID:6804
- C:\Windows\System\EMRhEpH.exe
  C:\Windows\System\EMRhEpH.exe
  2⤵
  PID:6820
- C:\Windows\System\FCAhrvb.exe
  C:\Windows\System\FCAhrvb.exe
  2⤵
  PID:6836
- C:\Windows\System\jHWGgoa.exe
  C:\Windows\System\jHWGgoa.exe
  2⤵
  PID:6852
- C:\Windows\System\GtldnbO.exe
  C:\Windows\System\GtldnbO.exe
  2⤵
  PID:6868
- C:\Windows\System\mlVOHZu.exe
  C:\Windows\System\mlVOHZu.exe
  2⤵
  PID:6884
- C:\Windows\System\KYVAtbH.exe
  C:\Windows\System\KYVAtbH.exe
  2⤵
  PID:6900
- C:\Windows\System\xyYjUQC.exe
  C:\Windows\System\xyYjUQC.exe
  2⤵
  PID:6916
- C:\Windows\System\aSUrfvX.exe
  C:\Windows\System\aSUrfvX.exe
  2⤵
  PID:6932
- C:\Windows\System\RnGlLTI.exe
  C:\Windows\System\RnGlLTI.exe
  2⤵
  PID:6948
- C:\Windows\System\QvBNNvq.exe
  C:\Windows\System\QvBNNvq.exe
  2⤵
  PID:6964
- C:\Windows\System\LEumPGy.exe
  C:\Windows\System\LEumPGy.exe
  2⤵
  PID:6980
- C:\Windows\System\aFnwfIh.exe
  C:\Windows\System\aFnwfIh.exe
  2⤵
  PID:6996
- C:\Windows\System\SvbZyrK.exe
  C:\Windows\System\SvbZyrK.exe
  2⤵
  PID:7012
- C:\Windows\System\YbRMlyW.exe
  C:\Windows\System\YbRMlyW.exe
  2⤵
  PID:7028
- C:\Windows\System\elOBJSm.exe
  C:\Windows\System\elOBJSm.exe
  2⤵
  PID:7044
- C:\Windows\System\PBlgbdg.exe
  C:\Windows\System\PBlgbdg.exe
  2⤵
  PID:7060
- C:\Windows\System\rkdGvZi.exe
  C:\Windows\System\rkdGvZi.exe
  2⤵
  PID:7076
- C:\Windows\System\YzzQDOX.exe
  C:\Windows\System\YzzQDOX.exe
  2⤵
  PID:7092
- C:\Windows\System\Sxjrxjg.exe
  C:\Windows\System\Sxjrxjg.exe
  2⤵
  PID:7108
- C:\Windows\System\iYWnbgx.exe
  C:\Windows\System\iYWnbgx.exe
  2⤵
  PID:7124
- C:\Windows\System\aTuFxmg.exe
  C:\Windows\System\aTuFxmg.exe
  2⤵
  PID:7160
- C:\Windows\System\pOxSCbf.exe
  C:\Windows\System\pOxSCbf.exe
  2⤵
  PID:2768
- C:\Windows\System\HCjrSyV.exe
  C:\Windows\System\HCjrSyV.exe
  2⤵
  PID:2564
- C:\Windows\System\nVwFKbB.exe
  C:\Windows\System\nVwFKbB.exe
  2⤵
  PID:6204
- C:\Windows\System\CPlFluc.exe
  C:\Windows\System\CPlFluc.exe
  2⤵
  PID:6264
- C:\Windows\System\UJakUmg.exe
  C:\Windows\System\UJakUmg.exe
  2⤵
  PID:6328
- C:\Windows\System\MdfdTWL.exe
  C:\Windows\System\MdfdTWL.exe
  2⤵
  PID:6392
- C:\Windows\System\NdBdbYE.exe
  C:\Windows\System\NdBdbYE.exe
  2⤵
  PID:2736
- C:\Windows\System\ejxhcNO.exe
  C:\Windows\System\ejxhcNO.exe
  2⤵
  PID:2092
- C:\Windows\System\UepIBig.exe
  C:\Windows\System\UepIBig.exe
  2⤵
  PID:6460
- C:\Windows\System\JWSaXYg.exe
  C:\Windows\System\JWSaXYg.exe
  2⤵
  PID:6520
- C:\Windows\System\CcjBVNt.exe
  C:\Windows\System\CcjBVNt.exe
  2⤵
  PID:6552
- C:\Windows\System\LCHVoIw.exe
  C:\Windows\System\LCHVoIw.exe
  2⤵
  PID:6616
- C:\Windows\System\rppyuGS.exe
  C:\Windows\System\rppyuGS.exe
  2⤵
  PID:2596
- C:\Windows\System\aWAywGI.exe
  C:\Windows\System\aWAywGI.exe
  2⤵
  PID:6688
- C:\Windows\System\oMUvMIN.exe
  C:\Windows\System\oMUvMIN.exe
  2⤵
  PID:1952
- C:\Windows\System\vfNswUK.exe
  C:\Windows\System\vfNswUK.exe
  2⤵
  PID:2932
- C:\Windows\System\QJezdqc.exe
  C:\Windows\System\QJezdqc.exe
  2⤵
  PID:6812
- C:\Windows\System\ASWPmlp.exe
  C:\Windows\System\ASWPmlp.exe
  2⤵
  PID:6876
- C:\Windows\System\uWpkUjW.exe
  C:\Windows\System\uWpkUjW.exe
  2⤵
  PID:6944
- C:\Windows\System\dhAIKwM.exe
  C:\Windows\System\dhAIKwM.exe
  2⤵
  PID:7004
- C:\Windows\System\kAaBagM.exe
  C:\Windows\System\kAaBagM.exe
  2⤵
  PID:3792
- C:\Windows\System\lZlwaQF.exe
  C:\Windows\System\lZlwaQF.exe
  2⤵
  PID:7176
- C:\Windows\System\eWkPcek.exe
  C:\Windows\System\eWkPcek.exe
  2⤵
  PID:7192
- C:\Windows\System\fyYTeMM.exe
  C:\Windows\System\fyYTeMM.exe
  2⤵
  PID:7208
- C:\Windows\System\XXUrHUl.exe
  C:\Windows\System\XXUrHUl.exe
  2⤵
  PID:7224
- C:\Windows\System\aYvheRm.exe
  C:\Windows\System\aYvheRm.exe
  2⤵
  PID:7240
- C:\Windows\System\LNCPAby.exe
  C:\Windows\System\LNCPAby.exe
  2⤵
  PID:7256
- C:\Windows\System\CWWFvqj.exe
  C:\Windows\System\CWWFvqj.exe
  2⤵
  PID:7272
- C:\Windows\System\zUnXZST.exe
  C:\Windows\System\zUnXZST.exe
  2⤵
  PID:7288
- C:\Windows\System\PDSiTCU.exe
  C:\Windows\System\PDSiTCU.exe
  2⤵
  PID:7304
- C:\Windows\System\qXKJaFW.exe
  C:\Windows\System\qXKJaFW.exe
  2⤵
  PID:7320
- C:\Windows\System\mTFSntM.exe
  C:\Windows\System\mTFSntM.exe
  2⤵
  PID:7336
- C:\Windows\System\YKhwLEV.exe
  C:\Windows\System\YKhwLEV.exe
  2⤵
  PID:7352
- C:\Windows\System\VGKqjiq.exe
  C:\Windows\System\VGKqjiq.exe
  2⤵
  PID:7368
- C:\Windows\System\ZcaRVMx.exe
  C:\Windows\System\ZcaRVMx.exe
  2⤵
  PID:7384
- C:\Windows\System\zcGSbxY.exe
  C:\Windows\System\zcGSbxY.exe
  2⤵
  PID:7436
- C:\Windows\System\QSGHNBf.exe
  C:\Windows\System\QSGHNBf.exe
  2⤵
  PID:7452
- C:\Windows\System\YOqLPHM.exe
  C:\Windows\System\YOqLPHM.exe
  2⤵
  PID:7468
- C:\Windows\System\aHyvrSF.exe
  C:\Windows\System\aHyvrSF.exe
  2⤵
  PID:7484
- C:\Windows\System\rJjiQPS.exe
  C:\Windows\System\rJjiQPS.exe
  2⤵
  PID:7500
- C:\Windows\System\ffkahiZ.exe
  C:\Windows\System\ffkahiZ.exe
  2⤵
  PID:7516
- C:\Windows\System\IlWxKus.exe
  C:\Windows\System\IlWxKus.exe
  2⤵
  PID:7532
- C:\Windows\System\KhsVgaq.exe
  C:\Windows\System\KhsVgaq.exe
  2⤵
  PID:7548
- C:\Windows\System\jZgDnob.exe
  C:\Windows\System\jZgDnob.exe
  2⤵
  PID:7568
- C:\Windows\System\RIjxWje.exe
  C:\Windows\System\RIjxWje.exe
  2⤵
  PID:7584
- C:\Windows\System\JoaYjFg.exe
  C:\Windows\System\JoaYjFg.exe
  2⤵
  PID:7600
- C:\Windows\System\vFGiNca.exe
  C:\Windows\System\vFGiNca.exe
  2⤵
  PID:7616
- C:\Windows\System\NbXeheL.exe
  C:\Windows\System\NbXeheL.exe
  2⤵
  PID:7632
- C:\Windows\System\jTIczwB.exe
  C:\Windows\System\jTIczwB.exe
  2⤵
  PID:7648
- C:\Windows\System\OOjmnvQ.exe
  C:\Windows\System\OOjmnvQ.exe
  2⤵
  PID:7664
- C:\Windows\System\psQFnCQ.exe
  C:\Windows\System\psQFnCQ.exe
  2⤵
  PID:7680
- C:\Windows\System\rWaEepT.exe
  C:\Windows\System\rWaEepT.exe
  2⤵
  PID:7696
- C:\Windows\System\XxNKpNK.exe
  C:\Windows\System\XxNKpNK.exe
  2⤵
  PID:7712
- C:\Windows\System\OhrOjKJ.exe
  C:\Windows\System\OhrOjKJ.exe
  2⤵
  PID:7728
- C:\Windows\System\MaZmptc.exe
  C:\Windows\System\MaZmptc.exe
  2⤵
  PID:7744
- C:\Windows\System\SEAKbRc.exe
  C:\Windows\System\SEAKbRc.exe
  2⤵
  PID:7760
- C:\Windows\System\AufnxAD.exe
  C:\Windows\System\AufnxAD.exe
  2⤵
  PID:7776
- C:\Windows\System\QbBZEFO.exe
  C:\Windows\System\QbBZEFO.exe
  2⤵
  PID:7792
- C:\Windows\System\SlpCsYC.exe
  C:\Windows\System\SlpCsYC.exe
  2⤵
  PID:7808
- C:\Windows\System\XogkXHJ.exe
  C:\Windows\System\XogkXHJ.exe
  2⤵
  PID:7824
- C:\Windows\System\HcHabJm.exe
  C:\Windows\System\HcHabJm.exe
  2⤵
  PID:7840
- C:\Windows\System\YyuZWsj.exe
  C:\Windows\System\YyuZWsj.exe
  2⤵
  PID:7856
- C:\Windows\System\OoEJWiY.exe
  C:\Windows\System\OoEJWiY.exe
  2⤵
  PID:7872
- C:\Windows\System\HNIZGbr.exe
  C:\Windows\System\HNIZGbr.exe
  2⤵
  PID:7896
- C:\Windows\System\bqMcPsE.exe
  C:\Windows\System\bqMcPsE.exe
  2⤵
  PID:7912
- C:\Windows\System\sqimrpK.exe
  C:\Windows\System\sqimrpK.exe
  2⤵
  PID:7928
- C:\Windows\System\Grvbhxr.exe
  C:\Windows\System\Grvbhxr.exe
  2⤵
  PID:7944
- C:\Windows\System\fmuRgsq.exe
  C:\Windows\System\fmuRgsq.exe
  2⤵
  PID:7964
- C:\Windows\System\htFRhPz.exe
  C:\Windows\System\htFRhPz.exe
  2⤵
  PID:7992
- C:\Windows\System\CoFEUhX.exe
  C:\Windows\System\CoFEUhX.exe
  2⤵
  PID:8008
- C:\Windows\System\XOKRzmo.exe
  C:\Windows\System\XOKRzmo.exe
  2⤵
  PID:8024
- C:\Windows\System\kZDcGQT.exe
  C:\Windows\System\kZDcGQT.exe
  2⤵
  PID:8040
- C:\Windows\System\RfQzQQL.exe
  C:\Windows\System\RfQzQQL.exe
  2⤵
  PID:8056
- C:\Windows\System\MqhrtqW.exe
  C:\Windows\System\MqhrtqW.exe
  2⤵
  PID:8072
- C:\Windows\System\fETQBsd.exe
  C:\Windows\System\fETQBsd.exe
  2⤵
  PID:8088
- C:\Windows\System\DXgwqCP.exe
  C:\Windows\System\DXgwqCP.exe
  2⤵
  PID:8104
- C:\Windows\System\zggfBAb.exe
  C:\Windows\System\zggfBAb.exe
  2⤵
  PID:8120
- C:\Windows\System\CXPCCZy.exe
  C:\Windows\System\CXPCCZy.exe
  2⤵
  PID:8136
- C:\Windows\System\IZYseIJ.exe
  C:\Windows\System\IZYseIJ.exe
  2⤵
  PID:8152
- C:\Windows\System\ErEYMsV.exe
  C:\Windows\System\ErEYMsV.exe
  2⤵
  PID:8168
- C:\Windows\System\lPHkVyF.exe
  C:\Windows\System\lPHkVyF.exe
  2⤵
  PID:8184
- C:\Windows\System\NPNimOA.exe
  C:\Windows\System\NPNimOA.exe
  2⤵
  PID:7132
- C:\Windows\System\zBQxMnT.exe
  C:\Windows\System\zBQxMnT.exe
  2⤵
  PID:7408
- C:\Windows\System\jBsvawQ.exe
  C:\Windows\System\jBsvawQ.exe
  2⤵
  PID:7140
- C:\Windows\System\AmYsFmL.exe
  C:\Windows\System\AmYsFmL.exe
  2⤵
  PID:7156
- C:\Windows\System\AoHhuzH.exe
  C:\Windows\System\AoHhuzH.exe
  2⤵
  PID:6360
- C:\Windows\System\NOgrMbu.exe
  C:\Windows\System\NOgrMbu.exe
  2⤵
  PID:6588
- C:\Windows\System\KzkqrTa.exe
  C:\Windows\System\KzkqrTa.exe
  2⤵
  PID:6844
- C:\Windows\System\yNhIPQv.exe
  C:\Windows\System\yNhIPQv.exe
  2⤵
  PID:6976
- C:\Windows\System\BBoPDAl.exe
  C:\Windows\System\BBoPDAl.exe
  2⤵
  PID:7236
- C:\Windows\System\nMDRWUy.exe
  C:\Windows\System\nMDRWUy.exe
  2⤵
  PID:7328
- C:\Windows\System\UCzjpUx.exe
  C:\Windows\System\UCzjpUx.exe
  2⤵
  PID:7396
- C:\Windows\System\dzbApfv.exe
  C:\Windows\System\dzbApfv.exe
  2⤵
  PID:7412
- C:\Windows\System\gnbfcFr.exe
  C:\Windows\System\gnbfcFr.exe
  2⤵
  PID:7460
- C:\Windows\System\hMUqZZm.exe
  C:\Windows\System\hMUqZZm.exe
  2⤵
  PID:7560
- C:\Windows\System\nkjveOJ.exe
  C:\Windows\System\nkjveOJ.exe
  2⤵
  PID:7628
- C:\Windows\System\zYVIPcM.exe
  C:\Windows\System\zYVIPcM.exe
  2⤵
  PID:7692
- C:\Windows\System\dseWEPJ.exe
  C:\Windows\System\dseWEPJ.exe
  2⤵
  PID:7756
- C:\Windows\System\fOIKEXL.exe
  C:\Windows\System\fOIKEXL.exe
  2⤵
  PID:7820
- C:\Windows\System\UsDWgFj.exe
  C:\Windows\System\UsDWgFj.exe
  2⤵
  PID:7880
- C:\Windows\System\OqHWgCU.exe
  C:\Windows\System\OqHWgCU.exe
  2⤵
  PID:7920
- C:\Windows\System\KwdDyNC.exe
  C:\Windows\System\KwdDyNC.exe
  2⤵
  PID:7960
- C:\Windows\System\dDlJuMg.exe
  C:\Windows\System\dDlJuMg.exe
  2⤵
  PID:8036
- C:\Windows\System\ULMkOUH.exe
  C:\Windows\System\ULMkOUH.exe
  2⤵
  PID:8100
- C:\Windows\System\CBfEwlI.exe
  C:\Windows\System\CBfEwlI.exe
  2⤵
  PID:8164
- C:\Windows\System\BRsTwQi.exe
  C:\Windows\System\BRsTwQi.exe
  2⤵
  PID:7136
- C:\Windows\System\TklBGMU.exe
  C:\Windows\System\TklBGMU.exe
  2⤵
  PID:4072
- C:\Windows\System\IqbkInN.exe
  C:\Windows\System\IqbkInN.exe
  2⤵
  PID:3068
- C:\Windows\System\oYzmBKj.exe
  C:\Windows\System\oYzmBKj.exe
  2⤵
  PID:2576
- C:\Windows\System\YCwrBKq.exe
  C:\Windows\System\YCwrBKq.exe
  2⤵
  PID:2580
- C:\Windows\System\TcLWTXf.exe
  C:\Windows\System\TcLWTXf.exe
  2⤵
  PID:7424
- C:\Windows\System\GmjSNBk.exe
  C:\Windows\System\GmjSNBk.exe
  2⤵
  PID:7360
- C:\Windows\System\yXaLkTw.exe
  C:\Windows\System\yXaLkTw.exe
  2⤵
  PID:7596
- C:\Windows\System\rZdYsfk.exe
  C:\Windows\System\rZdYsfk.exe
  2⤵
  PID:2220
- C:\Windows\System\koasezp.exe
  C:\Windows\System\koasezp.exe
  2⤵
  PID:1864
- C:\Windows\System\UbCnWbb.exe
  C:\Windows\System\UbCnWbb.exe
  2⤵
  PID:3128
- C:\Windows\System\RiAzGzU.exe
  C:\Windows\System\RiAzGzU.exe
  2⤵
  PID:4196
- C:\Windows\System\OnhItgh.exe
  C:\Windows\System\OnhItgh.exe
  2⤵
  PID:4356
- C:\Windows\System\VBogMKx.exe
  C:\Windows\System\VBogMKx.exe
  2⤵
  PID:4520
- C:\Windows\System\vBckDZa.exe
  C:\Windows\System\vBckDZa.exe
  2⤵
  PID:4648
- C:\Windows\System\ZxyvxhJ.exe
  C:\Windows\System\ZxyvxhJ.exe
  2⤵
  PID:7956
- C:\Windows\System\sPgxvME.exe
  C:\Windows\System\sPgxvME.exe
  2⤵
  PID:4712
- C:\Windows\System\XdIZLYs.exe
  C:\Windows\System\XdIZLYs.exe
  2⤵
  PID:4804
- C:\Windows\System\zTzUJxF.exe
  C:\Windows\System\zTzUJxF.exe
  2⤵
  PID:4932
- C:\Windows\System\lEDvQpu.exe
  C:\Windows\System\lEDvQpu.exe
  2⤵
  PID:5032
- C:\Windows\System\HLKBjca.exe
  C:\Windows\System\HLKBjca.exe
  2⤵
  PID:3980
- C:\Windows\System\FeJKqdl.exe
  C:\Windows\System\FeJKqdl.exe
  2⤵
  PID:7204
- C:\Windows\System\SnHQfvD.exe
  C:\Windows\System\SnHQfvD.exe
  2⤵
  PID:5012
- C:\Windows\System\CVVwUMd.exe
  C:\Windows\System\CVVwUMd.exe
  2⤵
  PID:5216
- C:\Windows\System\rlSpBte.exe
  C:\Windows\System\rlSpBte.exe
  2⤵
  PID:5472
- C:\Windows\System\uKsCDex.exe
  C:\Windows\System\uKsCDex.exe
  2⤵
  PID:7752
- C:\Windows\System\MvmFVTd.exe
  C:\Windows\System\MvmFVTd.exe
  2⤵
  PID:4260
- C:\Windows\System\FkYueUH.exe
  C:\Windows\System\FkYueUH.exe
  2⤵
  PID:4616
- C:\Windows\System\JQdREyT.exe
  C:\Windows\System\JQdREyT.exe
  2⤵
  PID:5892
- C:\Windows\System\UaPlkMp.exe
  C:\Windows\System\UaPlkMp.exe
  2⤵
  PID:4708
- C:\Windows\System\UMvBPuY.exe
  C:\Windows\System\UMvBPuY.exe
  2⤵
  PID:5260
- C:\Windows\System\ilyEydW.exe
  C:\Windows\System\ilyEydW.exe
  2⤵
  PID:4904
- C:\Windows\System\qpRbVUH.exe
  C:\Windows\System\qpRbVUH.exe
  2⤵
  PID:5588
- C:\Windows\System\txtwwil.exe
  C:\Windows\System\txtwwil.exe
  2⤵
  PID:6068
- C:\Windows\System\iqdyBWV.exe
  C:\Windows\System\iqdyBWV.exe
  2⤵
  PID:7264
- C:\Windows\System\WRfnJqt.exe
  C:\Windows\System\WRfnJqt.exe
  2⤵
  PID:5876
- C:\Windows\System\DlINzno.exe
  C:\Windows\System\DlINzno.exe
  2⤵
  PID:6252
- C:\Windows\System\UNNYdVn.exe
  C:\Windows\System\UNNYdVn.exe
  2⤵
  PID:6312
- C:\Windows\System\RIBuCmp.exe
  C:\Windows\System\RIBuCmp.exe
  2⤵
  PID:4084
- C:\Windows\System\AhVIwNu.exe
  C:\Windows\System\AhVIwNu.exe
  2⤵
  PID:1868
- C:\Windows\System\NYXkbQh.exe
  C:\Windows\System\NYXkbQh.exe
  2⤵
  PID:4100
- C:\Windows\System\hROynBY.exe
  C:\Windows\System\hROynBY.exe
  2⤵
  PID:4192
- C:\Windows\System\ksnqCJh.exe
  C:\Windows\System\ksnqCJh.exe
  2⤵
  PID:4296
- C:\Windows\System\MBpXpko.exe
  C:\Windows\System\MBpXpko.exe
  2⤵
  PID:4388
- C:\Windows\System\sImrGxt.exe
  C:\Windows\System\sImrGxt.exe
  2⤵
  PID:4488
- C:\Windows\System\owlaOhC.exe
  C:\Windows\System\owlaOhC.exe
  2⤵
  PID:4584
- C:\Windows\System\yQXQrpk.exe
  C:\Windows\System\yQXQrpk.exe
  2⤵
  PID:4744
- C:\Windows\System\FFTEOCx.exe
  C:\Windows\System\FFTEOCx.exe
  2⤵
  PID:4936
- C:\Windows\System\zsldVci.exe
  C:\Windows\System\zsldVci.exe
  2⤵
  PID:7428
- C:\Windows\System\sznNvov.exe
  C:\Windows\System\sznNvov.exe
  2⤵
  PID:4536
- C:\Windows\System\xMsatSl.exe
  C:\Windows\System\xMsatSl.exe
  2⤵
  PID:4280
- C:\Windows\System\bUIZqak.exe
  C:\Windows\System\bUIZqak.exe
  2⤵
  PID:5016
- C:\Windows\System\lVjGoei.exe
  C:\Windows\System\lVjGoei.exe
  2⤵
  PID:5244
- C:\Windows\System\QUBEmaY.exe
  C:\Windows\System\QUBEmaY.exe
  2⤵
  PID:5308
- C:\Windows\System\GcAWYCL.exe
  C:\Windows\System\GcAWYCL.exe
  2⤵
  PID:5376
- C:\Windows\System\DifoxHD.exe
  C:\Windows\System\DifoxHD.exe
  2⤵
  PID:5440
- C:\Windows\System\scRdaiJ.exe
  C:\Windows\System\scRdaiJ.exe
  2⤵
  PID:4484
- C:\Windows\System\VZUEltd.exe
  C:\Windows\System\VZUEltd.exe
  2⤵
  PID:5700
- C:\Windows\System\vuQFViE.exe
  C:\Windows\System\vuQFViE.exe
  2⤵
  PID:5796
- C:\Windows\System\oQUJUso.exe
  C:\Windows\System\oQUJUso.exe
  2⤵
  PID:5924
- C:\Windows\System\iiOlAZQ.exe
  C:\Windows\System\iiOlAZQ.exe
  2⤵
  PID:6024
- C:\Windows\System\TOwjOqY.exe
  C:\Windows\System\TOwjOqY.exe
  2⤵
  PID:6120
- C:\Windows\System\viYoLvc.exe
  C:\Windows\System\viYoLvc.exe
  2⤵
  PID:6084
- C:\Windows\System\ugsYFHT.exe
  C:\Windows\System\ugsYFHT.exe
  2⤵
  PID:1060
- C:\Windows\System\trdhqzu.exe
  C:\Windows\System\trdhqzu.exe
  2⤵
  PID:5184
- C:\Windows\System\NPQiqBG.exe
  C:\Windows\System\NPQiqBG.exe
  2⤵
  PID:5296
- C:\Windows\System\BYyAmbe.exe
  C:\Windows\System\BYyAmbe.exe
  2⤵
  PID:6004
- C:\Windows\System\XLmaaTP.exe
  C:\Windows\System\XLmaaTP.exe
  2⤵
  PID:6152
- C:\Windows\System\fEkoNZs.exe
  C:\Windows\System\fEkoNZs.exe
  2⤵
  PID:6248
- C:\Windows\System\qFHybqL.exe
  C:\Windows\System\qFHybqL.exe
  2⤵
  PID:6444
- C:\Windows\System\BhVtJzS.exe
  C:\Windows\System\BhVtJzS.exe
  2⤵
  PID:5988
- C:\Windows\System\dLNXoFD.exe
  C:\Windows\System\dLNXoFD.exe
  2⤵
  PID:6600
- C:\Windows\System\fXHCdvO.exe
  C:\Windows\System\fXHCdvO.exe
  2⤵
  PID:6664
- C:\Windows\System\lsDhFny.exe
  C:\Windows\System\lsDhFny.exe
  2⤵
  PID:5360
- C:\Windows\System\hrVBuea.exe
  C:\Windows\System\hrVBuea.exe
  2⤵
  PID:6796
- C:\Windows\System\iNfMhGo.exe
  C:\Windows\System\iNfMhGo.exe
  2⤵
  PID:6864
- C:\Windows\System\nByjmtZ.exe
  C:\Windows\System\nByjmtZ.exe
  2⤵
  PID:5840
- C:\Windows\System\CPLRtYU.exe
  C:\Windows\System\CPLRtYU.exe
  2⤵
  PID:2156
- C:\Windows\System\evWUzJg.exe
  C:\Windows\System\evWUzJg.exe
  2⤵
  PID:1132
- C:\Windows\System\XVPtzgz.exe
  C:\Windows\System\XVPtzgz.exe
  2⤵
  PID:1712
- C:\Windows\System\ISDxgvI.exe
  C:\Windows\System\ISDxgvI.exe
  2⤵
  PID:836
- C:\Windows\System\hDsRZAi.exe
  C:\Windows\System\hDsRZAi.exe
  2⤵
  PID:2916
- C:\Windows\System\OAyRHAg.exe
  C:\Windows\System\OAyRHAg.exe
  2⤵
  PID:2168
- C:\Windows\System\TLgkqdd.exe
  C:\Windows\System\TLgkqdd.exe
  2⤵
  PID:1672
- C:\Windows\System\XMpWOrC.exe
  C:\Windows\System\XMpWOrC.exe
  2⤵
  PID:3244
- C:\Windows\System\PLHrzsw.exe
  C:\Windows\System\PLHrzsw.exe
  2⤵
  PID:3304
- C:\Windows\System\VXFsKSS.exe
  C:\Windows\System\VXFsKSS.exe
  2⤵
  PID:3368
- C:\Windows\System\DOkdEqu.exe
  C:\Windows\System\DOkdEqu.exe
  2⤵
  PID:3432
- C:\Windows\System\iWNAEyL.exe
  C:\Windows\System\iWNAEyL.exe
  2⤵
  PID:3496
- C:\Windows\System\jJjEAtz.exe
  C:\Windows\System\jJjEAtz.exe
  2⤵
  PID:3560
- C:\Windows\System\vSzEYSr.exe
  C:\Windows\System\vSzEYSr.exe
  2⤵
  PID:3628
- C:\Windows\System\saXfFKu.exe
  C:\Windows\System\saXfFKu.exe
  2⤵
  PID:3756
- C:\Windows\System\pJEcgGH.exe
  C:\Windows\System\pJEcgGH.exe
  2⤵
  PID:3696
- C:\Windows\System\kEcYjnJ.exe
  C:\Windows\System\kEcYjnJ.exe
  2⤵
  PID:3852
- C:\Windows\System\hHCHgDh.exe
  C:\Windows\System\hHCHgDh.exe
  2⤵
  PID:3924
- C:\Windows\System\hMKfrQR.exe
  C:\Windows\System\hMKfrQR.exe
  2⤵
  PID:7768
- C:\Windows\System\sWUCaLq.exe
  C:\Windows\System\sWUCaLq.exe
  2⤵
  PID:8080
- C:\Windows\System\wuNrmCm.exe
  C:\Windows\System\wuNrmCm.exe
  2⤵
  PID:7152
- C:\Windows\System\dUutemA.exe
  C:\Windows\System\dUutemA.exe
  2⤵
  PID:6492
- C:\Windows\System\QCzfmJh.exe
  C:\Windows\System\QCzfmJh.exe
  2⤵
  PID:7400
- C:\Windows\System\lEjYIbr.exe
  C:\Windows\System\lEjYIbr.exe
  2⤵
  PID:4772
- C:\Windows\System\uYeIKuw.exe
  C:\Windows\System\uYeIKuw.exe
  2⤵
  PID:5064
- C:\Windows\System\UVYFzwg.exe
  C:\Windows\System\UVYFzwg.exe
  2⤵
  PID:5572
- C:\Windows\System\kbSFhKH.exe
  C:\Windows\System\kbSFhKH.exe
  2⤵
  PID:5828
- C:\Windows\System\JHeGxnU.exe
  C:\Windows\System\JHeGxnU.exe
  2⤵
  PID:5696
- C:\Windows\System\dhiecax.exe
  C:\Windows\System\dhiecax.exe
  2⤵
  PID:4884
- C:\Windows\System\EVHcLGt.exe
  C:\Windows\System\EVHcLGt.exe
  2⤵
  PID:7020
- C:\Windows\System\rgmOqbs.exe
  C:\Windows\System\rgmOqbs.exe
  2⤵
  PID:7084
- C:\Windows\System\yBIXdaT.exe
  C:\Windows\System\yBIXdaT.exe
  2⤵
  PID:1716
- C:\Windows\System\mxCtdTF.exe
  C:\Windows\System\mxCtdTF.exe
  2⤵
  PID:6200
- C:\Windows\System\vqQCiVD.exe
  C:\Windows\System\vqQCiVD.exe
  2⤵
  PID:6428
- C:\Windows\System\mxoZUPQ.exe
  C:\Windows\System\mxoZUPQ.exe
  2⤵
  PID:6620
- C:\Windows\System\cqauUMi.exe
  C:\Windows\System\cqauUMi.exe
  2⤵
  PID:6780
- C:\Windows\System\CGoWjPX.exe
  C:\Windows\System\CGoWjPX.exe
  2⤵
  PID:6912
- C:\Windows\System\JtFYKRX.exe
  C:\Windows\System\JtFYKRX.exe
  2⤵
  PID:7188
- C:\Windows\System\AwIWtMQ.exe
  C:\Windows\System\AwIWtMQ.exe
  2⤵
  PID:7376
- C:\Windows\System\oCtGbKR.exe
  C:\Windows\System\oCtGbKR.exe
  2⤵
  PID:7476
- C:\Windows\System\puThXXA.exe
  C:\Windows\System\puThXXA.exe
  2⤵
  PID:7544
- C:\Windows\System\aeTTtQM.exe
  C:\Windows\System\aeTTtQM.exe
  2⤵
  PID:7612
- C:\Windows\System\cBDbetu.exe
  C:\Windows\System\cBDbetu.exe
  2⤵
  PID:7676
- C:\Windows\System\iCdMmlQ.exe
  C:\Windows\System\iCdMmlQ.exe
  2⤵
  PID:7736
- C:\Windows\System\NVCYyun.exe
  C:\Windows\System\NVCYyun.exe
  2⤵
  PID:6540
- C:\Windows\System\eDVsEjf.exe
  C:\Windows\System\eDVsEjf.exe
  2⤵
  PID:6896
- C:\Windows\System\gBRwmWS.exe
  C:\Windows\System\gBRwmWS.exe
  2⤵
  PID:7432
- C:\Windows\System\PdtlEUW.exe
  C:\Windows\System\PdtlEUW.exe
  2⤵
  PID:3608
- C:\Windows\System\ZUzwTmL.exe
  C:\Windows\System\ZUzwTmL.exe
  2⤵
  PID:5168
- C:\Windows\System\GBtRadC.exe
  C:\Windows\System\GBtRadC.exe
  2⤵
  PID:7300
- C:\Windows\System\rzDtmnX.exe
  C:\Windows\System\rzDtmnX.exe
  2⤵
  PID:7816
- C:\Windows\System\UEmOJeI.exe
  C:\Windows\System\UEmOJeI.exe
  2⤵
  PID:4068
- C:\Windows\System\NzmtuwJ.exe
  C:\Windows\System\NzmtuwJ.exe
  2⤵
  PID:3512
- C:\Windows\System\tCRQNvE.exe
  C:\Windows\System\tCRQNvE.exe
  2⤵
  PID:5028
- C:\Windows\System\FBmJQgs.exe
  C:\Windows\System\FBmJQgs.exe
  2⤵
  PID:5668
- C:\Windows\System\sHympLH.exe
  C:\Windows\System\sHympLH.exe
  2⤵
  PID:6280
- C:\Windows\System\kdkqYdc.exe
  C:\Windows\System\kdkqYdc.exe
  2⤵
  PID:2372
- C:\Windows\System\IkONgAf.exe
  C:\Windows\System\IkONgAf.exe
  2⤵
  PID:2780
- C:\Windows\System\WEfRLxO.exe
  C:\Windows\System\WEfRLxO.exe
  2⤵
  PID:4292
- C:\Windows\System\efaLcAL.exe
  C:\Windows\System\efaLcAL.exe
  2⤵
  PID:4328
- C:\Windows\System\LgWzipL.exe
  C:\Windows\System\LgWzipL.exe
  2⤵
  PID:4996
- C:\Windows\System\RBtrIuq.exe
  C:\Windows\System\RBtrIuq.exe
  2⤵
  PID:4660
- C:\Windows\System\OemktBr.exe
  C:\Windows\System\OemktBr.exe
  2⤵
  PID:5212
- C:\Windows\System\VYFUDFJ.exe
  C:\Windows\System\VYFUDFJ.exe
  2⤵
  PID:5344
- C:\Windows\System\pLDCuGR.exe
  C:\Windows\System\pLDCuGR.exe
  2⤵
  PID:4408
- C:\Windows\System\qOGmBSL.exe
  C:\Windows\System\qOGmBSL.exe
  2⤵
  PID:5760
- C:\Windows\System\bNTNoua.exe
  C:\Windows\System\bNTNoua.exe
  2⤵
  PID:5280
- C:\Windows\System\PDHkiYz.exe
  C:\Windows\System\PDHkiYz.exe
  2⤵
  PID:5992
- C:\Windows\System\MVngzaF.exe
  C:\Windows\System\MVngzaF.exe
  2⤵
  PID:5940
- C:\Windows\System\HdNVWXu.exe
  C:\Windows\System\HdNVWXu.exe
  2⤵
  PID:6188
- C:\Windows\System\ngBIVve.exe
  C:\Windows\System\ngBIVve.exe
  2⤵
  PID:2484
- C:\Windows\System\wbStBQl.exe
  C:\Windows\System\wbStBQl.exe
  2⤵
  PID:1596
- C:\Windows\System\cGxYpkN.exe
  C:\Windows\System\cGxYpkN.exe
  2⤵
  PID:6632
- C:\Windows\System\mbttJzi.exe
  C:\Windows\System\mbttJzi.exe
  2⤵
  PID:4724
- C:\Windows\System\xjJYbQj.exe
  C:\Windows\System\xjJYbQj.exe
  2⤵
  PID:6440
- C:\Windows\System\cyNfcrv.exe
  C:\Windows\System\cyNfcrv.exe
  2⤵
  PID:6736
- C:\Windows\System\BsAOUkd.exe
  C:\Windows\System\BsAOUkd.exe
  2⤵
  PID:6956
- C:\Windows\System\xRQjzKk.exe
  C:\Windows\System\xRQjzKk.exe
  2⤵
  PID:6832
- C:\Windows\System\iKnrJUv.exe
  C:\Windows\System\iKnrJUv.exe
  2⤵
  PID:1904
- C:\Windows\System\baEcugD.exe
  C:\Windows\System\baEcugD.exe
  2⤵
  PID:392
- C:\Windows\System\ztpnOST.exe
  C:\Windows\System\ztpnOST.exe
  2⤵
  PID:1696
- C:\Windows\System\HeePPWG.exe
  C:\Windows\System\HeePPWG.exe
  2⤵
  PID:2016
- C:\Windows\System\kgEfHZE.exe
  C:\Windows\System\kgEfHZE.exe
  2⤵
  PID:536
- C:\Windows\System\kiHdsHX.exe
  C:\Windows\System\kiHdsHX.exe
  2⤵
  PID:1688
- C:\Windows\System\gUHaHoO.exe
  C:\Windows\System\gUHaHoO.exe
  2⤵
  PID:1764
- C:\Windows\System\CtbDUKy.exe
  C:\Windows\System\CtbDUKy.exe
  2⤵
  PID:1564
- C:\Windows\System\dVTGUkw.exe
  C:\Windows\System\dVTGUkw.exe
  2⤵
  PID:3080
- C:\Windows\System\EXhyDPt.exe
  C:\Windows\System\EXhyDPt.exe
  2⤵
  PID:3176
- C:\Windows\System\AJnkXYb.exe
  C:\Windows\System\AJnkXYb.exe
  2⤵
  PID:6768
- C:\Windows\System\AzOmUEc.exe
  C:\Windows\System\AzOmUEc.exe
  2⤵
  PID:3208
- C:\Windows\System\VHYTiSI.exe
  C:\Windows\System\VHYTiSI.exe
  2⤵
  PID:3532
- C:\Windows\System\bgwbtqu.exe
  C:\Windows\System\bgwbtqu.exe
  2⤵
  PID:3692
- C:\Windows\System\xSzTBKu.exe
  C:\Windows\System\xSzTBKu.exe
  2⤵
  PID:3468
- C:\Windows\System\DhvZOsW.exe
  C:\Windows\System\DhvZOsW.exe
  2⤵
  PID:3464
- C:\Windows\System\QpgUtjd.exe
  C:\Windows\System\QpgUtjd.exe
  2⤵
  PID:7940
- C:\Windows\System\pyMlLBt.exe
  C:\Windows\System\pyMlLBt.exe
  2⤵
  PID:2056
- C:\Windows\System\nRIIRZB.exe
  C:\Windows\System\nRIIRZB.exe
  2⤵
  PID:4872
- C:\Windows\System\VRnfgQx.exe
  C:\Windows\System\VRnfgQx.exe
  2⤵
  PID:6924
- C:\Windows\System\UhmrBuC.exe
  C:\Windows\System\UhmrBuC.exe
  2⤵
  PID:6300
- C:\Windows\System\cLMHQkz.exe
  C:\Windows\System\cLMHQkz.exe
  2⤵
  PID:1988
- C:\Windows\System\xOUBeUA.exe
  C:\Windows\System\xOUBeUA.exe
  2⤵
  PID:6992
- C:\Windows\System\hUCaQlL.exe
  C:\Windows\System\hUCaQlL.exe
  2⤵
  PID:7184
- C:\Windows\System\AbZetUS.exe
  C:\Windows\System\AbZetUS.exe
  2⤵
  PID:7284
- C:\Windows\System\PJlYhJR.exe
  C:\Windows\System\PJlYhJR.exe
  2⤵
  PID:7444
- C:\Windows\System\ijpdelG.exe
  C:\Windows\System\ijpdelG.exe
  2⤵
  PID:7644
- C:\Windows\System\PwsGpca.exe
  C:\Windows\System\PwsGpca.exe
  2⤵
  PID:7868
- C:\Windows\System\KoNzrWZ.exe
  C:\Windows\System\KoNzrWZ.exe
  2⤵
  PID:7528
- C:\Windows\System\MUhSSgp.exe
  C:\Windows\System\MUhSSgp.exe
  2⤵
  PID:264
- C:\Windows\System\KhyOliN.exe
  C:\Windows\System\KhyOliN.exe
  2⤵
  PID:7804
- C:\Windows\System\ITWPcJF.exe
  C:\Windows\System\ITWPcJF.exe
  2⤵
  PID:1772
- C:\Windows\System\IRfmwVa.exe
  C:\Windows\System\IRfmwVa.exe
  2⤵
  PID:7788
- C:\Windows\System\JEzuMuQ.exe
  C:\Windows\System\JEzuMuQ.exe
  2⤵
  PID:6860
- C:\Windows\System\uoStJZk.exe
  C:\Windows\System\uoStJZk.exe
  2⤵
  PID:3012
- C:\Windows\System\TlxYpSn.exe
  C:\Windows\System\TlxYpSn.exe
  2⤵
  PID:4420
- C:\Windows\System\FHgoWOe.exe
  C:\Windows\System\FHgoWOe.exe
  2⤵
  PID:7952
- C:\Windows\System\mTYnuez.exe
  C:\Windows\System\mTYnuez.exe
  2⤵
  PID:5896
- C:\Windows\System\azlSdWH.exe
  C:\Windows\System\azlSdWH.exe
  2⤵
  PID:4564
- C:\Windows\System\UqIMhsR.exe
  C:\Windows\System\UqIMhsR.exe
  2⤵
  PID:4256
- C:\Windows\System\ZxOAbpg.exe
  C:\Windows\System\ZxOAbpg.exe
  2⤵
  PID:4760
- C:\Windows\System\iHPKwfd.exe
  C:\Windows\System\iHPKwfd.exe
  2⤵
  PID:2584
- C:\Windows\System\KHBqGyU.exe
  C:\Windows\System\KHBqGyU.exe
  2⤵
  PID:1612
- C:\Windows\System\IdIfSvl.exe
  C:\Windows\System\IdIfSvl.exe
  2⤵
  PID:5508
- C:\Windows\System\bqGQmsl.exe
  C:\Windows\System\bqGQmsl.exe
  2⤵
  PID:3912
- C:\Windows\System\gWRpUSN.exe
  C:\Windows\System\gWRpUSN.exe
  2⤵
  PID:4500
- C:\Windows\System\aJbvyuZ.exe
  C:\Windows\System\aJbvyuZ.exe
  2⤵
  PID:2884
- C:\Windows\System\jflQPyl.exe
  C:\Windows\System\jflQPyl.exe
  2⤵
  PID:4052
- C:\Windows\System\aviQqVj.exe
  C:\Windows\System\aviQqVj.exe
  2⤵
  PID:2708
- C:\Windows\System\RHCbLUm.exe
  C:\Windows\System\RHCbLUm.exe
  2⤵
  PID:944
- C:\Windows\System\LKOfVFA.exe
  C:\Windows\System\LKOfVFA.exe
  2⤵
  PID:2776
- C:\Windows\System\CFMFDnJ.exe
  C:\Windows\System\CFMFDnJ.exe
  2⤵
  PID:3112
- C:\Windows\System\jKZmdvU.exe
  C:\Windows\System\jKZmdvU.exe
  2⤵
  PID:3824
- C:\Windows\System\AjqzQpT.exe
  C:\Windows\System\AjqzQpT.exe
  2⤵
  PID:1880
- C:\Windows\System\IrgYLiP.exe
  C:\Windows\System\IrgYLiP.exe
  2⤵
  PID:7908
- C:\Windows\System\EDwNDLp.exe
  C:\Windows\System\EDwNDLp.exe
  2⤵
  PID:1112
- C:\Windows\System\roBINwR.exe
  C:\Windows\System\roBINwR.exe
  2⤵
  PID:2904
- C:\Windows\System\aJBGLsA.exe
  C:\Windows\System\aJBGLsA.exe
  2⤵
  PID:3936
- C:\Windows\System\cUrcNEw.exe
  C:\Windows\System\cUrcNEw.exe
  2⤵
  PID:4868
- C:\Windows\System\TjXEHzZ.exe
  C:\Windows\System\TjXEHzZ.exe
  2⤵
  PID:1368
- C:\Windows\System\IhkVybc.exe
  C:\Windows\System\IhkVybc.exe
  2⤵
  PID:7120
- C:\Windows\System\lglhhJR.exe
  C:\Windows\System\lglhhJR.exe
  2⤵
  PID:6412
- C:\Windows\System\klfrnMP.exe
  C:\Windows\System\klfrnMP.exe
  2⤵
  PID:7252
- C:\Windows\System\PJhNrKK.exe
  C:\Windows\System\PJhNrKK.exe
  2⤵
  PID:5156
- C:\Windows\System\LRWrWze.exe
  C:\Windows\System\LRWrWze.exe
  2⤵
  PID:2788
- C:\Windows\System\tDaKgFI.exe
  C:\Windows\System\tDaKgFI.exe
  2⤵
  PID:3140
- C:\Windows\System\tRzxLXD.exe
  C:\Windows\System\tRzxLXD.exe
  2⤵
  PID:7100
- C:\Windows\System\qzBFZEo.exe
  C:\Windows\System\qzBFZEo.exe
  2⤵
  PID:6536
- C:\Windows\System\tABwCek.exe
  C:\Windows\System\tABwCek.exe
  2⤵
  PID:3868
- C:\Windows\System\sBXYfXi.exe
  C:\Windows\System\sBXYfXi.exe
  2⤵
  PID:8032
- C:\Windows\System\dPfsnKf.exe
  C:\Windows\System\dPfsnKf.exe
  2⤵
  PID:2964
- C:\Windows\System\fBAsyIy.exe
  C:\Windows\System\fBAsyIy.exe
  2⤵
  PID:5888
- C:\Windows\System\VCuhIck.exe
  C:\Windows\System\VCuhIck.exe
  2⤵
  PID:6508
- C:\Windows\System\lPwlikA.exe
  C:\Windows\System\lPwlikA.exe
  2⤵
  PID:6220
- C:\Windows\System\lFADKeY.exe
  C:\Windows\System\lFADKeY.exe
  2⤵
  PID:1652
- C:\Windows\System\ZqVRXun.exe
  C:\Windows\System\ZqVRXun.exe
  2⤵
  PID:8132
- C:\Windows\System\AeZXqgF.exe
  C:\Windows\System\AeZXqgF.exe
  2⤵
  PID:5680
- C:\Windows\System\JAnMZKR.exe
  C:\Windows\System\JAnMZKR.exe
  2⤵
  PID:3276
- C:\Windows\System\LTHuZtL.exe
  C:\Windows\System\LTHuZtL.exe
  2⤵
  PID:3340
- C:\Windows\System\tbLLRjm.exe
  C:\Windows\System\tbLLRjm.exe
  2⤵
  PID:6424
- C:\Windows\System\xUNVUbx.exe
  C:\Windows\System\xUNVUbx.exe
  2⤵
  PID:3612
- C:\Windows\System\dAOZJef.exe
  C:\Windows\System\dAOZJef.exe
  2⤵
  PID:7512
- C:\Windows\System\frZTipP.exe
  C:\Windows\System\frZTipP.exe
  2⤵
  PID:4176
- C:\Windows\System\NdsBVGL.exe
  C:\Windows\System\NdsBVGL.exe
  2⤵
  PID:1580
- C:\Windows\System\zevLxMM.exe
  C:\Windows\System\zevLxMM.exe
  2⤵
  PID:1088
- C:\Windows\System\ziSciun.exe
  C:\Windows\System\ziSciun.exe
  2⤵
  PID:6056
- C:\Windows\System\GjqacQo.exe
  C:\Windows\System\GjqacQo.exe
  2⤵
  PID:5276
- C:\Windows\System\TKTMDFG.exe
  C:\Windows\System\TKTMDFG.exe
  2⤵
  PID:6116
- C:\Windows\System\XIWKlsq.exe
  C:\Windows\System\XIWKlsq.exe
  2⤵
  PID:8180
- C:\Windows\System\AgHjWOM.exe
  C:\Windows\System\AgHjWOM.exe
  2⤵
  PID:5100
- C:\Windows\System\VyvRCsb.exe
  C:\Windows\System\VyvRCsb.exe
  2⤵
  PID:7708
- C:\Windows\System\yLTqZfs.exe
  C:\Windows\System\yLTqZfs.exe
  2⤵
  PID:4808
- C:\Windows\System\asVMzZg.exe
  C:\Windows\System\asVMzZg.exe
  2⤵
  PID:5568
- C:\Windows\System\gIAksIY.exe
  C:\Windows\System\gIAksIY.exe
  2⤵
  PID:3400
- C:\Windows\System\EpcBAIT.exe
  C:\Windows\System\EpcBAIT.exe
  2⤵
  PID:2612
- C:\Windows\System\VRHdlwo.exe
  C:\Windows\System\VRHdlwo.exe
  2⤵
  PID:288
- C:\Windows\System\zLdrwgQ.exe
  C:\Windows\System\zLdrwgQ.exe
  2⤵
  PID:2756
- C:\Windows\System\YECdzWK.exe
  C:\Windows\System\YECdzWK.exe
  2⤵
  PID:3032
- C:\Windows\System\hsWZoqz.exe
  C:\Windows\System\hsWZoqz.exe
  2⤵
  PID:6524
- C:\Windows\System\QiOBLpp.exe
  C:\Windows\System\QiOBLpp.exe
  2⤵
  PID:7248
- C:\Windows\System\hbLUREB.exe
  C:\Windows\System\hbLUREB.exe
  2⤵
  PID:6748
- C:\Windows\System\fhlUgOW.exe
  C:\Windows\System\fhlUgOW.exe
  2⤵
  PID:108
- C:\Windows\System\cwugrbS.exe
  C:\Windows\System\cwugrbS.exe
  2⤵
  PID:8208
- C:\Windows\System\rtEnXlc.exe
  C:\Windows\System\rtEnXlc.exe
  2⤵
  PID:8224
- C:\Windows\System\JAJnLwZ.exe
  C:\Windows\System\JAJnLwZ.exe
  2⤵
  PID:8240
- C:\Windows\System\dLZEDGw.exe
  C:\Windows\System\dLZEDGw.exe
  2⤵
  PID:8276
- C:\Windows\System\WBeFeSi.exe
  C:\Windows\System\WBeFeSi.exe
  2⤵
  PID:8336
- C:\Windows\System\uKZCjVn.exe
  C:\Windows\System\uKZCjVn.exe
  2⤵
  PID:8352
- C:\Windows\System\CowJTCA.exe
  C:\Windows\System\CowJTCA.exe
  2⤵
  PID:8368
- C:\Windows\System\GPcNVUO.exe
  C:\Windows\System\GPcNVUO.exe
  2⤵
  PID:8384
- C:\Windows\System\qHiBqeS.exe
  C:\Windows\System\qHiBqeS.exe
  2⤵
  PID:8400
- C:\Windows\System\FmFpMfu.exe
  C:\Windows\System\FmFpMfu.exe
  2⤵
  PID:8416
- C:\Windows\System\MuiUoae.exe
  C:\Windows\System\MuiUoae.exe
  2⤵
  PID:8432
- C:\Windows\System\JrxDhhy.exe
  C:\Windows\System\JrxDhhy.exe
  2⤵
  PID:8452
- C:\Windows\System\lgxnYZm.exe
  C:\Windows\System\lgxnYZm.exe
  2⤵
  PID:8468
- C:\Windows\System\UxYioSA.exe
  C:\Windows\System\UxYioSA.exe
  2⤵
  PID:8484
- C:\Windows\System\hvJhpOX.exe
  C:\Windows\System\hvJhpOX.exe
  2⤵
  PID:8504
- C:\Windows\System\FCuawGq.exe
  C:\Windows\System\FCuawGq.exe
  2⤵
  PID:8528
- C:\Windows\System\VKzZbCe.exe
  C:\Windows\System\VKzZbCe.exe
  2⤵
  PID:8544
- C:\Windows\System\kVYgkIy.exe
  C:\Windows\System\kVYgkIy.exe
  2⤵
  PID:8568
- C:\Windows\System\JmasSve.exe
  C:\Windows\System\JmasSve.exe
  2⤵
  PID:8584
- C:\Windows\System\VxKEobM.exe
  C:\Windows\System\VxKEobM.exe
  2⤵
  PID:8600
- C:\Windows\System\zNpcBxq.exe
  C:\Windows\System\zNpcBxq.exe
  2⤵
  PID:8616
- C:\Windows\System\asIVERB.exe
  C:\Windows\System\asIVERB.exe
  2⤵
  PID:8632
- C:\Windows\System\APVLPCl.exe
  C:\Windows\System\APVLPCl.exe
  2⤵
  PID:8652
- C:\Windows\System\VuQPLrh.exe
  C:\Windows\System\VuQPLrh.exe
  2⤵
  PID:8668
- C:\Windows\System\xepRdAS.exe
  C:\Windows\System\xepRdAS.exe
  2⤵
  PID:8684
- C:\Windows\System\AtyDRvK.exe
  C:\Windows\System\AtyDRvK.exe
  2⤵
  PID:8700
- C:\Windows\System\LbqSFLz.exe
  C:\Windows\System\LbqSFLz.exe
  2⤵
  PID:8716
- C:\Windows\System\ZajOcVE.exe
  C:\Windows\System\ZajOcVE.exe
  2⤵
  PID:8732
- C:\Windows\System\qMoIlzl.exe
  C:\Windows\System\qMoIlzl.exe
  2⤵
  PID:8748
- C:\Windows\System\yvVwLhV.exe
  C:\Windows\System\yvVwLhV.exe
  2⤵
  PID:8768
- C:\Windows\System\TdrMdtf.exe
  C:\Windows\System\TdrMdtf.exe
  2⤵
  PID:8784
- C:\Windows\System\DafTPEP.exe
  C:\Windows\System\DafTPEP.exe
  2⤵
  PID:8800
- C:\Windows\System\oiyjHyo.exe
  C:\Windows\System\oiyjHyo.exe
  2⤵
  PID:8816
- C:\Windows\System\jLuNmZE.exe
  C:\Windows\System\jLuNmZE.exe
  2⤵
  PID:8840
- C:\Windows\System\xiikQhT.exe
  C:\Windows\System\xiikQhT.exe
  2⤵
  PID:8856
- C:\Windows\System\aYKlXsG.exe
  C:\Windows\System\aYKlXsG.exe
  2⤵
  PID:8876
- C:\Windows\System\BvpiGKP.exe
  C:\Windows\System\BvpiGKP.exe
  2⤵
  PID:8892
- C:\Windows\System\TVbByvr.exe
  C:\Windows\System\TVbByvr.exe
  2⤵
  PID:8908
- C:\Windows\System\jvktFVe.exe
  C:\Windows\System\jvktFVe.exe
  2⤵
  PID:8924
- C:\Windows\System\qTKpLXn.exe
  C:\Windows\System\qTKpLXn.exe
  2⤵
  PID:8940
- C:\Windows\System\NdJTRyt.exe
  C:\Windows\System\NdJTRyt.exe
  2⤵
  PID:8956
- C:\Windows\System\Lsgwmik.exe
  C:\Windows\System\Lsgwmik.exe
  2⤵
  PID:8972
- C:\Windows\System\lPvbsMu.exe
  C:\Windows\System\lPvbsMu.exe
  2⤵
  PID:8988
- C:\Windows\System\WKOeVjK.exe
  C:\Windows\System\WKOeVjK.exe
  2⤵
  PID:9004
- C:\Windows\System\OMnZQFw.exe
  C:\Windows\System\OMnZQFw.exe
  2⤵
  PID:9020
- C:\Windows\System\lBHlWWC.exe
  C:\Windows\System\lBHlWWC.exe
  2⤵
  PID:9036
- C:\Windows\System\TgiZItf.exe
  C:\Windows\System\TgiZItf.exe
  2⤵
  PID:9056
- C:\Windows\System\OEvcUQo.exe
  C:\Windows\System\OEvcUQo.exe
  2⤵
  PID:9072
- C:\Windows\System\AVyZFPB.exe
  C:\Windows\System\AVyZFPB.exe
  2⤵
  PID:9088
- C:\Windows\System\lXRFneO.exe
  C:\Windows\System\lXRFneO.exe
  2⤵
  PID:9104
- C:\Windows\System\NQjCztF.exe
  C:\Windows\System\NQjCztF.exe
  2⤵
  PID:9120
- C:\Windows\System\yYnEPCE.exe
  C:\Windows\System\yYnEPCE.exe
  2⤵
  PID:9136
- C:\Windows\System\wRGZXbR.exe
  C:\Windows\System\wRGZXbR.exe
  2⤵
  PID:9152
- C:\Windows\System\hOojrZO.exe
  C:\Windows\System\hOojrZO.exe
  2⤵
  PID:9168
- C:\Windows\System\yRgXOnr.exe
  C:\Windows\System\yRgXOnr.exe
  2⤵
  PID:9184
- C:\Windows\System\EOUpTNF.exe
  C:\Windows\System\EOUpTNF.exe
  2⤵
  PID:9200
- C:\Windows\System\zzROuoe.exe
  C:\Windows\System\zzROuoe.exe
  2⤵
  PID:1312
- C:\Windows\System\ehcHzvl.exe
  C:\Windows\System\ehcHzvl.exe
  2⤵
  PID:8248
- C:\Windows\System\soOApcM.exe
  C:\Windows\System\soOApcM.exe
  2⤵
  PID:8272
- C:\Windows\System\EhkRKdl.exe
  C:\Windows\System\EhkRKdl.exe
  2⤵
  PID:2648
- C:\Windows\System\YdJZlbw.exe
  C:\Windows\System\YdJZlbw.exe
  2⤵
  PID:8232
- C:\Windows\System\vnGDJfa.exe
  C:\Windows\System\vnGDJfa.exe
  2⤵
  PID:8288
- C:\Windows\System\FAdDHsZ.exe
  C:\Windows\System\FAdDHsZ.exe
  2⤵
  PID:8312
- C:\Windows\System\jZPcSvi.exe
  C:\Windows\System\jZPcSvi.exe
  2⤵
  PID:8344
- C:\Windows\System\DKmggWg.exe
  C:\Windows\System\DKmggWg.exe
  2⤵
  PID:8328
- C:\Windows\System\IKnmZIh.exe
  C:\Windows\System\IKnmZIh.exe
  2⤵
  PID:8476
- C:\Windows\System\cVNSwbh.exe
  C:\Windows\System\cVNSwbh.exe
  2⤵
  PID:8364
- C:\Windows\System\dYygIQz.exe
  C:\Windows\System\dYygIQz.exe
  2⤵
  PID:8428
- C:\Windows\System\OsUgOwa.exe
  C:\Windows\System\OsUgOwa.exe
  2⤵
  PID:8496
- C:\Windows\System\cnELAdd.exe
  C:\Windows\System\cnELAdd.exe
  2⤵
  PID:8556
- C:\Windows\System\efUwQnD.exe
  C:\Windows\System\efUwQnD.exe
  2⤵
  PID:8580
- C:\Windows\System\mgbKvTk.exe
  C:\Windows\System\mgbKvTk.exe
  2⤵
  PID:8648
- C:\Windows\System\ISPolow.exe
  C:\Windows\System\ISPolow.exe
  2⤵
  PID:8592
- C:\Windows\System\exGeZIZ.exe
  C:\Windows\System\exGeZIZ.exe
  2⤵
  PID:8520
- C:\Windows\System\WXlbbjX.exe
  C:\Windows\System\WXlbbjX.exe
  2⤵
  PID:8724
- C:\Windows\System\vcqBvkn.exe
  C:\Windows\System\vcqBvkn.exe
  2⤵
  PID:8780
- C:\Windows\System\awxPdNV.exe
  C:\Windows\System\awxPdNV.exe
  2⤵
  PID:8708
- C:\Windows\System\vBKZwLa.exe
  C:\Windows\System\vBKZwLa.exe
  2⤵
  PID:8792
- C:\Windows\System\IxziQQV.exe
  C:\Windows\System\IxziQQV.exe
  2⤵
  PID:8828
- C:\Windows\System\RHmYplS.exe
  C:\Windows\System\RHmYplS.exe
  2⤵
  PID:8832
- C:\Windows\System\nioYqwN.exe
  C:\Windows\System\nioYqwN.exe
  2⤵
  PID:8864
- C:\Windows\System\EJjHHtO.exe
  C:\Windows\System\EJjHHtO.exe
  2⤵
  PID:8756
- C:\Windows\System\LzHnhaK.exe
  C:\Windows\System\LzHnhaK.exe
  2⤵
  PID:9032
- C:\Windows\System\ONVIUEc.exe
  C:\Windows\System\ONVIUEc.exe
  2⤵
  PID:9100
- C:\Windows\System\FlgczTh.exe
  C:\Windows\System\FlgczTh.exe
  2⤵
  PID:9132
- C:\Windows\System\iyCEUDN.exe
  C:\Windows\System\iyCEUDN.exe
  2⤵
  PID:8952
- C:\Windows\System\lapbcbW.exe
  C:\Windows\System\lapbcbW.exe
  2⤵
  PID:8888
- C:\Windows\System\cFJELyc.exe
  C:\Windows\System\cFJELyc.exe
  2⤵
  PID:9196
- C:\Windows\System\CbJlTqA.exe
  C:\Windows\System\CbJlTqA.exe
  2⤵
  PID:8948
- C:\Windows\System\XXPRDZV.exe
  C:\Windows\System\XXPRDZV.exe
  2⤵
  PID:9044
- C:\Windows\System\rPWZMvr.exe
  C:\Windows\System\rPWZMvr.exe
  2⤵
  PID:9084
- C:\Windows\System\mhKTEDB.exe
  C:\Windows\System\mhKTEDB.exe
  2⤵
  PID:9144
- C:\Windows\System\zgaaAJV.exe
  C:\Windows\System\zgaaAJV.exe
  2⤵
  PID:8264
- C:\Windows\System\PpkFcUj.exe
  C:\Windows\System\PpkFcUj.exe
  2⤵
  PID:8260
- C:\Windows\System\yGcJuGv.exe
  C:\Windows\System\yGcJuGv.exe
  2⤵
  PID:8296
- C:\Windows\System\EGrdZFy.exe
  C:\Windows\System\EGrdZFy.exe
  2⤵
  PID:8396
- C:\Windows\System\TGqvWAI.exe
  C:\Windows\System\TGqvWAI.exe
  2⤵
  PID:8332
- C:\Windows\System\qDnOrEI.exe
  C:\Windows\System\qDnOrEI.exe
  2⤵
  PID:8644
- C:\Windows\System\XdeGqaI.exe
  C:\Windows\System\XdeGqaI.exe
  2⤵
  PID:8380
- C:\Windows\System\JBmfMLd.exe
  C:\Windows\System\JBmfMLd.exe
  2⤵
  PID:8624
- C:\Windows\System\EMuNvJg.exe
  C:\Windows\System\EMuNvJg.exe
  2⤵
  PID:8712
- C:\Windows\System\uljLUTf.exe
  C:\Windows\System\uljLUTf.exe
  2⤵
  PID:5632
- C:\Windows\System\bgloQZA.exe
  C:\Windows\System\bgloQZA.exe
  2⤵
  PID:8812
- C:\Windows\System\alZxWQT.exe
  C:\Windows\System\alZxWQT.exe
  2⤵
  PID:8996
- C:\Windows\System\RopxTRO.exe
  C:\Windows\System\RopxTRO.exe
  2⤵
  PID:9052
- C:\Windows\System\LYIcMio.exe
  C:\Windows\System\LYIcMio.exe
  2⤵
  PID:9028
- C:\Windows\System\prBYCSu.exe
  C:\Windows\System\prBYCSu.exe
  2⤵
  PID:8916
- C:\Windows\System\oZFYVqU.exe
  C:\Windows\System\oZFYVqU.exe
  2⤵
  PID:9148
- C:\Windows\System\MgwfvxK.exe
  C:\Windows\System\MgwfvxK.exe
  2⤵
  PID:9116
- C:\Windows\System\LphOplt.exe
  C:\Windows\System\LphOplt.exe
  2⤵
  PID:9180
- C:\Windows\System\FHzUbIy.exe
  C:\Windows\System\FHzUbIy.exe
  2⤵
  PID:8284
- C:\Windows\System\MtxYsas.exe
  C:\Windows\System\MtxYsas.exe
  2⤵
  PID:8460
- C:\Windows\System\avERtgq.exe
  C:\Windows\System\avERtgq.exe
  2⤵
  PID:8392
- C:\Windows\System\paSusIV.exe
  C:\Windows\System\paSusIV.exe
  2⤵
  PID:8808
- C:\Windows\System\HyYliKp.exe
  C:\Windows\System\HyYliKp.exe
  2⤵
  PID:8448
- C:\Windows\System\JAlHjBA.exe
  C:\Windows\System\JAlHjBA.exe
  2⤵
  PID:8612
- C:\Windows\System\OVsVNLq.exe
  C:\Windows\System\OVsVNLq.exe
  2⤵
  PID:8204
- C:\Windows\System\VGEndSM.exe
  C:\Windows\System\VGEndSM.exe
  2⤵
  PID:8608
- C:\Windows\System\kqUsgXb.exe
  C:\Windows\System\kqUsgXb.exe
  2⤵
  PID:8524
- C:\Windows\System\TjhKTOt.exe
  C:\Windows\System\TjhKTOt.exe
  2⤵
  PID:8852
- C:\Windows\System\PNcILAB.exe
  C:\Windows\System\PNcILAB.exe
  2⤵
  PID:8776
- C:\Windows\System\hVlkSXx.exe
  C:\Windows\System\hVlkSXx.exe
  2⤵
  PID:8932
- C:\Windows\System\ZAUBvdP.exe
  C:\Windows\System\ZAUBvdP.exe
  2⤵
  PID:9164
- C:\Windows\System\maMPvbf.exe
  C:\Windows\System\maMPvbf.exe
  2⤵
  PID:8552
- C:\Windows\System\ONlhDFP.exe
  C:\Windows\System\ONlhDFP.exe
  2⤵
  PID:9224
- C:\Windows\System\fFcylIQ.exe
  C:\Windows\System\fFcylIQ.exe
  2⤵
  PID:9240
- C:\Windows\System\DWwiYrF.exe
  C:\Windows\System\DWwiYrF.exe
  2⤵
  PID:9256
- C:\Windows\System\bhtsSds.exe
  C:\Windows\System\bhtsSds.exe
  2⤵
  PID:9284
- C:\Windows\System\PQshgwX.exe
  C:\Windows\System\PQshgwX.exe
  2⤵
  PID:9336
- C:\Windows\System\JevZFaI.exe
  C:\Windows\System\JevZFaI.exe
  2⤵
  PID:9352
- C:\Windows\System\mCOUben.exe
  C:\Windows\System\mCOUben.exe
  2⤵
  PID:9368
- C:\Windows\System\nGVhIcS.exe
  C:\Windows\System\nGVhIcS.exe
  2⤵
  PID:9384
- C:\Windows\System\cfdirys.exe
  C:\Windows\System\cfdirys.exe
  2⤵
  PID:9400
- C:\Windows\System\wNpqDxH.exe
  C:\Windows\System\wNpqDxH.exe
  2⤵
  PID:9416
- C:\Windows\System\nCSIMmr.exe
  C:\Windows\System\nCSIMmr.exe
  2⤵
  PID:9452
- C:\Windows\System\uCmCDrF.exe
  C:\Windows\System\uCmCDrF.exe
  2⤵
  PID:9480
- C:\Windows\System\WtudPNh.exe
  C:\Windows\System\WtudPNh.exe
  2⤵
  PID:9500
- C:\Windows\System\WOaaDqG.exe
  C:\Windows\System\WOaaDqG.exe
  2⤵
  PID:9516
- C:\Windows\System\WrxuPtO.exe
  C:\Windows\System\WrxuPtO.exe
  2⤵
  PID:9532
- C:\Windows\System\diKQsHv.exe
  C:\Windows\System\diKQsHv.exe
  2⤵
  PID:9556
- C:\Windows\System\yHAnfGT.exe
  C:\Windows\System\yHAnfGT.exe
  2⤵
  PID:9572
- C:\Windows\System\wmfVbLN.exe
  C:\Windows\System\wmfVbLN.exe
  2⤵
  PID:9588
- C:\Windows\System\TcfoSZM.exe
  C:\Windows\System\TcfoSZM.exe
  2⤵
  PID:9604
- C:\Windows\System\Bfqigsh.exe
  C:\Windows\System\Bfqigsh.exe
  2⤵
  PID:9620
- C:\Windows\System\mrnFEgA.exe
  C:\Windows\System\mrnFEgA.exe
  2⤵
  PID:9636
- C:\Windows\System\mLrxzvD.exe
  C:\Windows\System\mLrxzvD.exe
  2⤵
  PID:9652
- C:\Windows\System\gXdesyj.exe
  C:\Windows\System\gXdesyj.exe
  2⤵
  PID:9668
- C:\Windows\System\HWKRjUw.exe
  C:\Windows\System\HWKRjUw.exe
  2⤵
  PID:9684
- C:\Windows\System\PXGfSlH.exe
  C:\Windows\System\PXGfSlH.exe
  2⤵
  PID:9700
- C:\Windows\System\DUKsryF.exe
  C:\Windows\System\DUKsryF.exe
  2⤵
  PID:9716
- C:\Windows\System\viWlTLs.exe
  C:\Windows\System\viWlTLs.exe
  2⤵
  PID:9732
- C:\Windows\System\vchxsKA.exe
  C:\Windows\System\vchxsKA.exe
  2⤵
  PID:9748
- C:\Windows\System\FSmuzCX.exe
  C:\Windows\System\FSmuzCX.exe
  2⤵
  PID:9764
- C:\Windows\System\qcVGHrW.exe
  C:\Windows\System\qcVGHrW.exe
  2⤵
  PID:9780
- C:\Windows\System\ZqaAkBw.exe
  C:\Windows\System\ZqaAkBw.exe
  2⤵
  PID:9796
- C:\Windows\System\osDerkZ.exe
  C:\Windows\System\osDerkZ.exe
  2⤵
  PID:9812
- C:\Windows\System\jEzbYnf.exe
  C:\Windows\System\jEzbYnf.exe
  2⤵
  PID:9828
- C:\Windows\System\CDlrwyR.exe
  C:\Windows\System\CDlrwyR.exe
  2⤵
  PID:9860
- C:\Windows\System\ikmLjLr.exe
  C:\Windows\System\ikmLjLr.exe
  2⤵
  PID:9876
- C:\Windows\System\VZOWzDD.exe
  C:\Windows\System\VZOWzDD.exe
  2⤵
  PID:9892
- C:\Windows\System\oTZSHhV.exe
  C:\Windows\System\oTZSHhV.exe
  2⤵
  PID:9912
- C:\Windows\System\UqhvlzK.exe
  C:\Windows\System\UqhvlzK.exe
  2⤵
  PID:9928
- C:\Windows\System\pHrodoD.exe
  C:\Windows\System\pHrodoD.exe
  2⤵
  PID:9944
- C:\Windows\System\BfIzEhE.exe
  C:\Windows\System\BfIzEhE.exe
  2⤵
  PID:9964
- C:\Windows\System\WkQHFGr.exe
  C:\Windows\System\WkQHFGr.exe
  2⤵
  PID:9980
- C:\Windows\System\DhpKNqT.exe
  C:\Windows\System\DhpKNqT.exe
  2⤵
  PID:9996
- C:\Windows\System\NmIeBgd.exe
  C:\Windows\System\NmIeBgd.exe
  2⤵
  PID:10012
- C:\Windows\System\xlRJuOA.exe
  C:\Windows\System\xlRJuOA.exe
  2⤵
  PID:10028
- C:\Windows\System\uoEEcEM.exe
  C:\Windows\System\uoEEcEM.exe
  2⤵
  PID:10044
- C:\Windows\System\TiIAnOa.exe
  C:\Windows\System\TiIAnOa.exe
  2⤵
  PID:10060
- C:\Windows\System\LDXEZko.exe
  C:\Windows\System\LDXEZko.exe
  2⤵
  PID:10076
- C:\Windows\System\XtVxzTH.exe
  C:\Windows\System\XtVxzTH.exe
  2⤵
  PID:10092
- C:\Windows\System\qiWsMjb.exe
  C:\Windows\System\qiWsMjb.exe
  2⤵
  PID:10108
- C:\Windows\System\ifIFkPg.exe
  C:\Windows\System\ifIFkPg.exe
  2⤵
  PID:10124
- C:\Windows\System\TSmpoSE.exe
  C:\Windows\System\TSmpoSE.exe
  2⤵
  PID:10140
- C:\Windows\System\EULMtpi.exe
  C:\Windows\System\EULMtpi.exe
  2⤵
  PID:10160
- C:\Windows\System\qmwONsv.exe
  C:\Windows\System\qmwONsv.exe
  2⤵
  PID:10176
- C:\Windows\System\NUYmXKO.exe
  C:\Windows\System\NUYmXKO.exe
  2⤵
  PID:10192
- C:\Windows\System\nfNsnwD.exe
  C:\Windows\System\nfNsnwD.exe
  2⤵
  PID:10208
- C:\Windows\System\NVpDRqI.exe
  C:\Windows\System\NVpDRqI.exe
  2⤵
  PID:10224
- C:\Windows\System\rluUNUN.exe
  C:\Windows\System\rluUNUN.exe
  2⤵
  PID:1108
- C:\Windows\System\LvlgaVq.exe
  C:\Windows\System\LvlgaVq.exe
  2⤵
  PID:8664
- C:\Windows\System\PwDPRGq.exe
  C:\Windows\System\PwDPRGq.exe
  2⤵
  PID:1488
- C:\Windows\System\UTNbkEK.exe
  C:\Windows\System\UTNbkEK.exe
  2⤵
  PID:9248
- C:\Windows\System\wnUBXqj.exe
  C:\Windows\System\wnUBXqj.exe
  2⤵
  PID:9264
- C:\Windows\System\XPfViUz.exe
  C:\Windows\System\XPfViUz.exe
  2⤵
  PID:9276
- C:\Windows\System\WSOqWyT.exe
  C:\Windows\System\WSOqWyT.exe
  2⤵
  PID:9348
- C:\Windows\System\IUqjHni.exe
  C:\Windows\System\IUqjHni.exe
  2⤵
  PID:9412
- C:\Windows\System\YkBUtXg.exe
  C:\Windows\System\YkBUtXg.exe
  2⤵
  PID:9304
- C:\Windows\System\EPskszS.exe
  C:\Windows\System\EPskszS.exe
  2⤵
  PID:9332
- C:\Windows\System\FoWEoxR.exe
  C:\Windows\System\FoWEoxR.exe
  2⤵
  PID:9392
- C:\Windows\System\ZuTgPDg.exe
  C:\Windows\System\ZuTgPDg.exe
  2⤵
  PID:9428
- C:\Windows\System\wnTwfsK.exe
  C:\Windows\System\wnTwfsK.exe
  2⤵
  PID:9444
- C:\Windows\System\IBGjdyh.exe
  C:\Windows\System\IBGjdyh.exe
  2⤵
  PID:9524
- C:\Windows\System\UQuheCf.exe
  C:\Windows\System\UQuheCf.exe
  2⤵
  PID:9464
- C:\Windows\System\xQCzoHZ.exe
  C:\Windows\System\xQCzoHZ.exe
  2⤵
  PID:9512
- C:\Windows\System\GkiUeFl.exe
  C:\Windows\System\GkiUeFl.exe
  2⤵
  PID:9612
- C:\Windows\System\JUMeamx.exe
  C:\Windows\System\JUMeamx.exe
  2⤵
  PID:9580
- C:\Windows\System\VvjmTnW.exe
  C:\Windows\System\VvjmTnW.exe
  2⤵
  PID:9708
- C:\Windows\System\gEdiHnw.exe
  C:\Windows\System\gEdiHnw.exe
  2⤵
  PID:9628
- C:\Windows\System\ShPvElH.exe
  C:\Windows\System\ShPvElH.exe
  2⤵
  PID:9692
- C:\Windows\System\WePeHFV.exe
  C:\Windows\System\WePeHFV.exe
  2⤵
  PID:9756
- C:\Windows\System\WiNggPn.exe
  C:\Windows\System\WiNggPn.exe
  2⤵
  PID:9788
- C:\Windows\System\FEDltkA.exe
  C:\Windows\System\FEDltkA.exe
  2⤵
  PID:9772
- C:\Windows\System\JRkKCkD.exe
  C:\Windows\System\JRkKCkD.exe
  2⤵
  PID:9836
- C:\Windows\System\pYxTNOM.exe
  C:\Windows\System\pYxTNOM.exe
  2⤵
  PID:9848
- C:\Windows\System\soZMjgv.exe
  C:\Windows\System\soZMjgv.exe
  2⤵
  PID:9956
- C:\Windows\System\fJiDbjW.exe
  C:\Windows\System\fJiDbjW.exe
  2⤵
  PID:9988
- C:\Windows\System\zYkoVTr.exe
  C:\Windows\System\zYkoVTr.exe
  2⤵
  PID:9992
- C:\Windows\System\TtTbYuH.exe
  C:\Windows\System\TtTbYuH.exe
  2⤵
  PID:9940
- C:\Windows\System\MGutliz.exe
  C:\Windows\System\MGutliz.exe
  2⤵
  PID:10008
- C:\Windows\System\SziYZyc.exe
  C:\Windows\System\SziYZyc.exe
  2⤵
  PID:10024
- C:\Windows\System\fLpuikv.exe
  C:\Windows\System\fLpuikv.exe
  2⤵
  PID:10116
- C:\Windows\System\BXJidhR.exe
  C:\Windows\System\BXJidhR.exe
  2⤵
  PID:10184
- C:\Windows\System\vmmMmZx.exe
  C:\Windows\System\vmmMmZx.exe
  2⤵
  PID:10040
- C:\Windows\System\UJRRBWG.exe
  C:\Windows\System\UJRRBWG.exe
  2⤵
  PID:10172
- C:\Windows\System\NBqtzZS.exe
  C:\Windows\System\NBqtzZS.exe
  2⤵
  PID:10136
- C:\Windows\System\ELeLoyc.exe
  C:\Windows\System\ELeLoyc.exe
  2⤵
  PID:10232

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\BfCtqWb.exe

Filesize
1.8MB

MD5
7d8a378acca77050c0652b5ec44d906b

SHA1
0d13be96f2d33230ff9057cb571e9c91fbc2c98a

SHA256
0e13294340ce3fa4ce7aeba66deff1fa11b4d049d07961d0d2f9bd0bb212733a

SHA512
7c174fd20c8fe16f531b3e6373a5b1c57f958d3ae8d7c37c151e7b68ed38d2970aaced5dcb92b31d707ac825942506cb67208e33b1e0128aa8070ac684d273c4

Download Submit
C:\Windows\system\EbTqwtB.exe

Filesize
1.8MB

MD5
3550135592317e5fedb5d3d4cdcce26c

SHA1
c521f1afec6b69d15e67395517f7cfac0b057009

SHA256
8eb721cce67b063c2cd21710102fc1ea93ade676f9dd9f7679548c149b13bc4a

SHA512
d02c28fc45aeaaedd6c0c4fb38a71268328d9d4dfd5f21f4250ebb7764ce70e9238e4a6cda1e6297f5aa276c5f8178368e78af9597e8775686711446ba4e7e0b

Download Submit
C:\Windows\system\FEHzPbB.exe

Filesize
1.8MB

MD5
80cda23aed1385ad67dd0cb517a72f60

SHA1
57841628a7ebdbe783929119abab5e40038cbf4a

SHA256
46873beee905d02790f73d7c28c3f58da4a18763da0667738dc18e6de91bdad3

SHA512
474cdaf6661761bd3b222f7ce16e485f3115d9b93f52c82dac9c438d6d633d299b2484f28cc97c5587ada74fa86e3ab409cd0c37e0da85492b545393461fa7be

Download Submit
C:\Windows\system\IjiUiYP.exe

Filesize
1.8MB

MD5
654e425796c2020fc63034e1f1319056

SHA1
1af42de539483f6c50328dccc386520a17fe63f9

SHA256
f9b3330a930f8d93610dc52ed69e9ef065777504578029fbaa0b5311769e3e9b

SHA512
5771e50486f531cfc4bf304f25c9ee0ee9b7ef66253998c30dccb12e41675d30fbde29dc3d13c69ba0f7db94f12b7d42952aed5c8d53a489bc42123a9cbaccf4

Download Submit
C:\Windows\system\JWFDrNL.exe

Filesize
1.8MB

MD5
85e89fe9ab6e0e88ee2eff3999ff2dea

SHA1
61abd1eb58f5b5a72b9e0b9b139510336c4f3be5

SHA256
95c25799d92504a9c11486eaa03218e9681950c4c459ade353c24e8edbb71604

SHA512
0bb3109061ff35330112955581aa377bc4f3f5cb09e610e4893f8c1e648d22a9291cd612c2e2ae6a942ca6fd46e934e6ad72a0b370e5e8fffee39b9341834f0a

Download Submit
C:\Windows\system\JgvDlfI.exe

Filesize
1.8MB

MD5
44d117d3815872ce9fc76687d5fd002d

SHA1
7e1c3b7b8fc1454be9b6ad49e10df21101a09fa5

SHA256
150993726863fb2e8359877b87644ec0fbb54ab6fa66ef87edf3dc671f2d7ff5

SHA512
6af6093a7b1b6a783f93fed4bc4998d760ee5a507d7b61181512bd0e280d0414b0da063cdd25c02f9bf312d306437d56011d82434b369bf93aeb5aef29a75640

Download Submit
C:\Windows\system\LsiMyeu.exe

Filesize
1.8MB

MD5
a409007b661e542c97ac8421e681205b

SHA1
5693d497b0347c59a36408c1515786f276c44672

SHA256
aeee038c637cb3af059798f775a41ca337dfee357801cb6c72cf42081565eb85

SHA512
0d95ca1b235310c0ed98bb7a7861ce631caee4c9529c39d675be4540564cb0afd891aa6fc50a7f23e0d565c5dc6f3430643abef3e4d54a7f1160b1426da59887

Download Submit
C:\Windows\system\PNItsgr.exe

Filesize
1.8MB

MD5
a87e6eeaf5176ba742a06dade37a4ba0

SHA1
51d4a45de59f1b50cd4840f400f883ac36a5a7b0

SHA256
c3085c16252eb5ce1ea8454f1e06761c3beb4e54c0be69fb4ebfbb5c03444f9b

SHA512
becb8a2f281418c2958e5ff635b7e98e8efc4d2edc671cbb5160cde21172def8b33e6f2948e5b07c788465181229dfe06f85110fd933ab94969a89cb04ae18b0

Download Submit
C:\Windows\system\UJpMsuF.exe

Filesize
1.8MB

MD5
ed12f5c305e47de63076432a1d0f2460

SHA1
c81d7882981957a752906606844ba5a0ecb64591

SHA256
0961bad348777e131b2824ad892c2764ae69a3d4c0d1c1cb35d5680c2d8607ed

SHA512
c3ebd1cf0d5eeb1daafec630eff1ee574b41ab6ce6278e7ae4a79c40ae856a07cd8b80e61d23a9241b2e16d4243f55b5ac45566f442d75a0ef52d4a986fb7d61

Download Submit
C:\Windows\system\VwFUjej.exe

Filesize
1.8MB

MD5
d53bac7b5d16876ab4131d52624ff903

SHA1
e204467d07630ecae3da0aeee2c6f557c4c0d0cb

SHA256
fcd1027dfbbbcbfc59d8f2d80b41629ab30771ff17a57fff2e406e391ee6a22e

SHA512
4db26d3952b181d52ffa6a63365cb07bb05f23f0d2f998c41cf051021b3316ea2c3526d8558b7a1a5c784bd5c490cfc46ec4519d8f362ddd26e92a210579d3cb

Download Submit
C:\Windows\system\YUbXglB.exe

Filesize
1.8MB

MD5
37bcb4fee366c9a39c8d60e03f74ff6f

SHA1
a460ac0b924e986593156cad3fb6b6f7b6470857

SHA256
fac846c821f9ba3779b26c7263067b939e7b28d4efa37c4bbd0952a8a6d67939

SHA512
68c4154b4ec0852fcd8944f07779bf3d651115da44d75cfee719c7d4bd1d010eec3c77161b7ea85d7c00b316804e6760b422ca7e0878acd58f053f1bbc0fed65

Download Submit
C:\Windows\system\YVOpRBX.exe

Filesize
1.8MB

MD5
aeb840b3ae723ee5305f0f9b4117db3e

SHA1
7c00b9fe14e3fbbbb628e6dfbb78bf267a143d6b

SHA256
9124ad086c7f1db06db42f8fe54a685195151dd7a45888f180296ff47813e482

SHA512
9dc286b8570be11d66f0a985e4b295b6eae39e58ac9b15b0ee18ac923c664c7960f377a9a7c974bd05609c743bfd525fb0f9c842629f6d2e54caa6010f40150e

Download Submit
C:\Windows\system\ehOhYFO.exe

Filesize
1.8MB

MD5
12b3e80dcd222e3ba0674288315ac834

SHA1
38333c02b90381daf4462520fccac7af446936fe

SHA256
52979c64f73215cc74732382f66bb317178e5e5978be690a1f465ec2d191d097

SHA512
857ac0fff544eb18f356c91541b34f5c44b0daa11c459d7634ae8095369b5c8371eabeed08f262656c7679a4b184b6b2a03f5a3b4f0f2b249682b40b7c2193d3

Download Submit
C:\Windows\system\ffASkia.exe

Filesize
1.8MB

MD5
f90e412938a87c9046ae332a80781b8f

SHA1
cd4c8ffd135fd579f85e7927b7bd905b7baca326

SHA256
c168a0b35886dc33fb520638989fa7c2190f03389826e47babd177b8347a9b55

SHA512
6107bc0625c3bcc9d5964ebfe952051524ae5dfea1bafeef4d019898593846ec70362340d9f350eca353a2983df2a6ba83ea6f41dc50c1969328a10c5a35e1b4

Download Submit
C:\Windows\system\gSeMhZK.exe

Filesize
1.8MB

MD5
00e42ba647dd090c5caa4fb54904b0d4

SHA1
cd61fcacb75e35b6d257dce27cc3fbac66a891fb

SHA256
9566b523291a1aead5c940b7106123ab0f035a9d28b5490bb75da4cd28f4ff3b

SHA512
515ab9a47ed3afa386d1b76a96713c7673e7b1c7213facbdeb8cfd2017c2ac95215e9e3da2553ff672492beeba12547b8dd37444aa9ab5ff3a11be5b06328929

Download Submit
C:\Windows\system\izWziwX.exe

Filesize
1.8MB

MD5
9f0a8ff6dc8bfe2eba78e11d24c0c753

SHA1
3692274101f4d12d4130a6225dd6dd30b9a305ac

SHA256
12d6e2ab04c8afd30a982c00ecd3e11b1897652ed1e9c1b74351d2922a0fedac

SHA512
ad220a551a8f7a590d393a54a5ea4f3cb6bedb8d30493cae3e19a12663684ab9c7aa59a792fbf7134f76e2e0ecd3b0bbd5af8b497f04a5ffaf30e9648a88737f

Download Submit
C:\Windows\system\jzIRpGO.exe

Filesize
1.8MB

MD5
a399b7d27681ada450bc0f18abb5f070

SHA1
7b3ab496dfe7d2adf710d09fe33714595dbe201b

SHA256
dd61c2664da458a2eb6046fa6440056371dca8a04d091cb75033f16c3fa6abbf

SHA512
000533870fb584c5472d5a843db60d774aa6ed577f7ddb410ace674064147a6b504a2ee4ba6215a3e8cdd5c3064706b8c0326e5da71a134a86eaef64a37f64c3

Download Submit
C:\Windows\system\oCWONtK.exe

Filesize
1.8MB

MD5
533f198ebbe2b11493f2d524712975af

SHA1
d0b179105939b7dc79c5f1dcc082b2ea0b38081c

SHA256
1088a3ac4a03781a75aaeee67b5dbd3452095ed9b128b99ea3f0d5823b343ecd

SHA512
b1f00c68e9515ff727f47bdf20ff018a4b0f69a9194a196140f6405087d22d5990a30fbd3959826463189061230416a05ffa981888d2765d9a3b843b4519f28b

Download Submit
C:\Windows\system\qOncIeJ.exe

Filesize
1.8MB

MD5
7067b50ae747f35f6dd4bbba63b581b0

SHA1
068d79ebe67ac09e1f248dd4ddc577611bd03e9c

SHA256
00022f5f38fae603511501fddcf131d84264770bac6e911b7179be3eba82966f

SHA512
e98406ec7ba400c56427385a09521e574af64026823a5b7622d556c368736a061e11fbaf0f1872bd52ee93d211d5233730f89ee2f50f756a147fc861af55bf1c

Download Submit
C:\Windows\system\sxxfaIH.exe

Filesize
1.8MB

MD5
bdb9d0e3802c3c622d4f36d4bdf93c3e

SHA1
2e9a1443e1eb7540132a2ce1c4bcd51b79fc1136

SHA256
f4f5627aa284971b4915b7fe7c3cd9072cc4cda9c276a4ed78ee1359fb4b8281

SHA512
c12b8e17139c9466aa325836b12933ba8c5d60473dd8d9f7af2f11d8af517de821f508afec2c9095a136a2bd5968bfcdb69b3d0879fce055f82db4b5b06e90c1

Download Submit
C:\Windows\system\tJpZbmg.exe

Filesize
1.8MB

MD5
f8ba008d485e4eea2c475e9b610a63c0

SHA1
952b890152ef404bbab3babe274cc540df0e989c

SHA256
38033fc9664042374f2d9142e7980e3d8c0a3d85b2efb39bd177eaa13b4dd32b

SHA512
6643e1aff1c7edcfd3191343d87ab842e3036a895ad75d8f30e799a6b04b8f0ab7020dba95c2d58e2f009ec5a53fc1f7aeafd71e4f3e6c8e08f18fec65352c27

Download Submit
C:\Windows\system\wPeXEnk.exe

Filesize
1.8MB

MD5
93242a43bd18e307c40937efe98fb344

SHA1
33b52097b9e5b11c4a4d9c2b3288d52ac3b48c9f

SHA256
89e08fe431832f237883a97d05b05c89c59a795edc7fdccfbbe70cb3835ab13f

SHA512
fad3a190b2aeff491dc2b877e49b8679e4cdff31b6e469af8977b9eb0070fbd4f18f8ca5427a3ddb521c0b6b73b2f2988f3bea209c298d684dbe456ec8ae8696

Download Submit
C:\Windows\system\xBmoceR.exe

Filesize
1.8MB

MD5
89abe2bbaa7d8c98007ee25d5efd6d54

SHA1
46e76f3d87fbe29ab81d09ea3362cf8b7f038835

SHA256
739b682d14548c5a4838072e7dabc3d5f631373e016cd9e20f5534094a614529

SHA512
1bd7e8cbd065c86c4341fa2031627e87aef2472ffaaa70463ebff758b906123af38a2dd3c7b97b3f05ce92bae96c88b2e3183662e33ec248c017c75c6d0d5da3

Download Submit
C:\Windows\system\ygOTwTP.exe

Filesize
1.8MB

MD5
1986339e4407920f9b7262757a807316

SHA1
371da7b48ac8f34b7ea510c53b5a6c8aeec73b48

SHA256
b74af26d5e786f5c9bb5676ea7e82c4b6a378496c3118cbac7dba283658ba542

SHA512
6d9e26d6f8ab242a9b88eb55c9733c314208d60e0561c4d86650d719a007176fdf052cba71b2fc7e7bf148e43e38cdf1012db45e874d93ea8395e2c77dc7358c

Download Submit
C:\Windows\system\zVHbkTC.exe

Filesize
1.8MB

MD5
6ac50e8530be3b9434535afbb31da09a

SHA1
d5002204d72f672514a47a9ed54b6155afdeb2b1

SHA256
46000a662012242f16d49acbdfc99d173fefa87fc7ecf82a7444a403207122b8

SHA512
c9c86b8f38ef421e8e3c5567285db9a92505db77322f0637a152d7774a53ccd682bdaf4b410e2057374559d722002187b7e66e9aab41d6b417a10d0eb6a557e8

Download Submit
\Windows\system\GwaWMxY.exe

Filesize
1.8MB

MD5
4648fc6ae4e7cc7e7b2b2060bf3940e5

SHA1
2f294782b0211b4e47c05e065056fe5db3ad5d6f

SHA256
a7c976a5f92bf4054d8546534bdd6c2f2f64beaf5278cad1685c057cdda06f52

SHA512
e68421f3b19c105543fb5e75bf4349006babf8bedcbf823fe82abea96c85526680436de5a8d98e00edca71b3757a5a3fdc8973a1af5191b6a9c86966c4a49297

Download Submit
\Windows\system\Yuvywxs.exe

Filesize
1.8MB

MD5
fa5c1784a5ffa46e0ad33a9707a78eda

SHA1
bdbecfecf288791547f76c7e4483c81d2650c52f

SHA256
5e6a383a051bf5a6cbe956a89d6ecef315b3b13685ec7cd729e09cb284502463

SHA512
b57d6ee60d28a9ee012ad60d073d101c9d90d7a9cfe1c45bd51a63f368c9d0238ea3c1c53010094a61fd5bddfbd1681b5d130d92be9a8eb1cd8d13881122aa30

Download Submit
\Windows\system\igaQfNs.exe

Filesize
1.8MB

MD5
c5bf0f00a05c5e0cdb3664eb45459f64

SHA1
ca28924b7c90476be738f6cd303231515518f343

SHA256
389babfdb5069f1230f1c0bea8c01dc2415232723213d02ecdb59a3073ff84a0

SHA512
13b89cf5675cb46bfb9200de72d43764f0d4082aa37be3176a673b31a39fb6943f39522349faff8cf8a8c230d7685d8dc798b515b379db6f3edfa8d57bb9c4db

Download Submit
\Windows\system\lEmmoQB.exe

Filesize
1.8MB

MD5
eb98d73687d19a6a3b6736ee0bd6a83a

SHA1
67395a680eb751a786a0e6b94fa27e151e2e132e

SHA256
08326b99358b75fe23b624581c471369c0163b88fc99cff57a1b3e0558c5a064

SHA512
dcd94d8d338aee55e94f823b350baac084c1ade755eb56d27d28b3005ad7ed1534227581cba5a5313065522c5f318f9b35b4ab563ea1131ed70e62834d8bd0b2

Download Submit
\Windows\system\nASyZfa.exe

Filesize
1.8MB

MD5
82b7ed66978775ff513a378c72b5ea16

SHA1
e3533fc2a98c83df3af00c04bd5d91023ab63e7b

SHA256
68ffc7af31c9523ecf80c3df9b1b9984a8c86bb438dce2b6b1b78327738444e6

SHA512
e10d0e82a2abe3484f89ad7474ee05a5047f1e4074a778f508ffea1210808cf7f0555876fa957b5d827160c2f4011e4729f36cffd0a6a40304d6036f0c863aef

Download Submit
\Windows\system\otcqVbq.exe

Filesize
1.8MB

MD5
4d544516d0f0ea23cad98e73ffeef2f0

SHA1
3f9ce084d0ae5375013e930d9979a7b46a57bf18

SHA256
c7c8554966d6e8afdf2138a923f03bdc6e691da5a9623bcaae6491fcb633d615

SHA512
0cf5a7a8d0c9c9e9894860e4bdba558b2c2e879023815019c771106fe8b1fdc18e30b1bf5eae31369a992d6ddd75a30eac247c8fa8d710d11d7ca1e3a241aca4

Download Submit
\Windows\system\sSQSqkZ.exe

Filesize
1.8MB

MD5
068710fb4c454e880b6a1003d51765a1

SHA1
d4c607feed6c6026a202975cedc34d605319da27

SHA256
622de9a234714de006dabfc34b0556a6ddaa32de365c65cdc45f2a6729decc3d

SHA512
75f7aca2f2b66f39ea48c1e70ccaf87fe052981c5dc9734f8dfd33b0760f45ea04ce229f0a41524fb6f06ac25c42982fa89a8671f89e21e9e40cfba3bcb00af4

Download Submit
\Windows\system\sSicVIY.exe

Filesize
1.8MB

MD5
dd8badf675ffdb5b23227f38244b9a05

SHA1
4efb307ef13b73cb417a70b90dd5a2137637d5c4

SHA256
59efe92c3fbb37fabeb820317c7dc041d6c44414df30ad73645b2e2e691b8ade

SHA512
987a744d9c95e4436675e656300868bf83c17fd16b2d557d5af28ca3d1e9768edeaa74c4be65562a515f0b283a2a53fca6f6aefd3da4f2649a065570b9d394fe

Download Submit
\Windows\system\vKAiFkT.exe

Filesize
1.8MB

MD5
65a05fc4ede65060690137512dc23b8f

SHA1
51dcd12cf207b2fbf862039e1f505d19ddb01e99

SHA256
7fc05ede4c3a411547861718c14c6f34d2b05c8fb77c3be440e84aeb0bb26275

SHA512
79c515b5658038ddb88e9781b62ca05e5bbcd1e182e4a56f6258277900e8504a819942a5e6a5c42aa855877675d4e981ad30eccaa5a3d76f6f1a2ca4b8a4c25f

Download Submit
memory/556-5353-0x000000013FD90000-0x0000000140182000-memory.dmp

Filesize
3.9MB

Download
memory/556-148-0x000000013FD90000-0x0000000140182000-memory.dmp

Filesize
3.9MB

Download
memory/952-482-0x000000013F340000-0x000000013F732000-memory.dmp

Filesize
3.9MB

Download
memory/1020-483-0x000000013FBD0000-0x000000013FFC2000-memory.dmp

Filesize
3.9MB

Download
memory/1440-133-0x000000013FE00000-0x00000001401F2000-memory.dmp

Filesize
3.9MB

Download
memory/1440-145-0x0000000002B20000-0x0000000002F12000-memory.dmp

Filesize
3.9MB

Download
memory/1440-1-0x000000013F600000-0x000000013F9F2000-memory.dmp

Filesize
3.9MB

Download
memory/1440-466-0x000000013F600000-0x000000013F9F2000-memory.dmp

Filesize
3.9MB

Download
memory/1440-143-0x000000013FCB0000-0x00000001400A2000-memory.dmp

Filesize
3.9MB

Download
memory/1440-152-0x000000013FBD0000-0x000000013FFC2000-memory.dmp

Filesize
3.9MB

Download
memory/1440-151-0x0000000002B20000-0x0000000002F12000-memory.dmp

Filesize
3.9MB

Download
memory/1440-130-0x0000000002B20000-0x0000000002F12000-memory.dmp

Filesize
3.9MB

Download
memory/1440-149-0x000000013FE80000-0x0000000140272000-memory.dmp

Filesize
3.9MB

Download
memory/1440-147-0x000000013FD90000-0x0000000140182000-memory.dmp

Filesize
3.9MB

Download
memory/1440-7-0x0000000002B20000-0x0000000002F12000-memory.dmp

Filesize
3.9MB

Download
memory/1440-0-0x0000000000080000-0x0000000000090000-memory.dmp

Filesize
64KB

Download
memory/1440-135-0x0000000002B20000-0x0000000002F12000-memory.dmp

Filesize
3.9MB

Download
memory/1440-137-0x000000013FF80000-0x0000000140372000-memory.dmp

Filesize
3.9MB

Download
memory/1440-141-0x0000000002B20000-0x0000000002F12000-memory.dmp

Filesize
3.9MB

Download
memory/1440-139-0x000000013FA00000-0x000000013FDF2000-memory.dmp

Filesize
3.9MB

Download
memory/2452-3484-0x000000013FE80000-0x0000000140272000-memory.dmp

Filesize
3.9MB

Download
memory/2452-150-0x000000013FE80000-0x0000000140272000-memory.dmp

Filesize
3.9MB

Download
memory/2488-146-0x000000013F450000-0x000000013F842000-memory.dmp

Filesize
3.9MB

Download
memory/2488-5276-0x000000013F450000-0x000000013F842000-memory.dmp

Filesize
3.9MB

Download
memory/2528-144-0x000000013FCB0000-0x00000001400A2000-memory.dmp

Filesize
3.9MB

Download
memory/2556-132-0x000007FEF59C0000-0x000007FEF635D000-memory.dmp

Filesize
9.6MB

Download
memory/2556-129-0x000007FEF59C0000-0x000007FEF635D000-memory.dmp

Filesize
9.6MB

Download
memory/2556-249-0x0000000002220000-0x0000000002228000-memory.dmp

Filesize
32KB

Download
memory/2556-14-0x000007FEF5C7E000-0x000007FEF5C7F000-memory.dmp

Filesize
4KB

Download
memory/2556-247-0x000000001B200000-0x000000001B4E2000-memory.dmp

Filesize
2.9MB

Download
memory/2624-3626-0x000000013FE00000-0x00000001401F2000-memory.dmp

Filesize
3.9MB

Download
memory/2624-134-0x000000013FE00000-0x00000001401F2000-memory.dmp

Filesize
3.9MB

Download
memory/2724-5268-0x000000013F530000-0x000000013F922000-memory.dmp

Filesize
3.9MB

Download
memory/2724-9-0x000000013F530000-0x000000013F922000-memory.dmp

Filesize
3.9MB

Download
memory/2724-468-0x000000013F530000-0x000000013F922000-memory.dmp

Filesize
3.9MB

Download
memory/2760-3466-0x000000013F370000-0x000000013F762000-memory.dmp

Filesize
3.9MB

Download
memory/2760-131-0x000000013F370000-0x000000013F762000-memory.dmp

Filesize
3.9MB

Download
memory/2772-140-0x000000013FA00000-0x000000013FDF2000-memory.dmp

Filesize
3.9MB

Download
memory/2772-5111-0x000000013FA00000-0x000000013FDF2000-memory.dmp

Filesize
3.9MB

Download
memory/2784-138-0x000000013FF80000-0x0000000140372000-memory.dmp

Filesize
3.9MB

Download
memory/2784-5267-0x000000013FF80000-0x0000000140372000-memory.dmp

Filesize
3.9MB

Download
memory/2816-136-0x000000013F5D0000-0x000000013F9C2000-memory.dmp

Filesize
3.9MB

Download
memory/2976-3471-0x000000013F240000-0x000000013F632000-memory.dmp

Filesize
3.9MB

Download
memory/2976-142-0x000000013F240000-0x000000013F632000-memory.dmp

Filesize
3.9MB

Download