xmrig | 7b4a909d87a24ce8dea1d5ca7ce658dd97a8ecc1fb0ab39422ee97d607b2d4d0

Analysis

max time kernel
150s
max time network
143s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
29/06/2024, 06:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7b4a909d87a24ce8dea1d5ca7ce658dd97a8ecc1fb0ab39422ee97d607b2d4d0_NeikiAnalytics.exe
Size

1.8MB
MD5

dab36e487ad00656dbcbdc478c018290
SHA1

149bc9e5f05468aab769b17566736a8a9338606c
SHA256

7b4a909d87a24ce8dea1d5ca7ce658dd97a8ecc1fb0ab39422ee97d607b2d4d0
SHA512

16189cf9dafcdb8ceec9b40d7a01ef4cf504748e5b3f668bba59a29943f4e5fb2872a09f455eed383a371ef6457d397b34b597a1cac0dcefe5aa61aa677054a7
SSDEEP

24576:zv3/fTLF671TilQFG4P5PMkibTJH+2Q/ynKeWYKpGncHBN/Vx+hZW0VGeE5l7QrR:Lz071uv4BPMkibTIA5CJJAb6Op

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 16 IoCs

miner

resource	yara_rule
behavioral1/memory/860-8-0x000000013FDE0000-0x00000001401D2000-memory.dmp	xmrig
behavioral1/memory/2908-16-0x000000013F650000-0x000000013FA42000-memory.dmp	xmrig
behavioral1/memory/2748-199-0x000000013FF60000-0x0000000140352000-memory.dmp	xmrig
behavioral1/memory/2672-198-0x000000013FA80000-0x000000013FE72000-memory.dmp	xmrig
behavioral1/memory/2628-197-0x000000013F540000-0x000000013F932000-memory.dmp	xmrig
behavioral1/memory/2580-196-0x000000013F7F0000-0x000000013FBE2000-memory.dmp	xmrig
behavioral1/memory/3068-202-0x000000013F480000-0x000000013F872000-memory.dmp	xmrig
behavioral1/memory/860-6299-0x000000013FDE0000-0x00000001401D2000-memory.dmp	xmrig
behavioral1/memory/2768-6300-0x000000013F910000-0x000000013FD02000-memory.dmp	xmrig
behavioral1/memory/3068-6332-0x000000013F480000-0x000000013F872000-memory.dmp	xmrig
behavioral1/memory/2908-6737-0x000000013F650000-0x000000013FA42000-memory.dmp	xmrig
behavioral1/memory/2628-6740-0x000000013F540000-0x000000013F932000-memory.dmp	xmrig
behavioral1/memory/2580-6738-0x000000013F7F0000-0x000000013FBE2000-memory.dmp	xmrig
behavioral1/memory/2748-6741-0x000000013FF60000-0x0000000140352000-memory.dmp	xmrig
behavioral1/memory/2672-6742-0x000000013FA80000-0x000000013FE72000-memory.dmp	xmrig
behavioral1/memory/1848-14464-0x000000013F350000-0x000000013F742000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
1152	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
860	ZwBEXed.exe
2908	HXgXHsM.exe
2768	sGYYtRN.exe
2580	pyDiOQa.exe
2628	yRGwFEO.exe
2672	dzcgqbp.exe
2748	mLrDMKQ.exe
3068	ktvVYBe.exe
2644	ldzebOk.exe
2544	SrVDuNk.exe
2504	cGilkFM.exe
2916	uqFgFMS.exe
2388	TimLYot.exe
1840	MiHnpxE.exe
812	YENoSXs.exe
1644	WOumtqF.exe
2660	uuZgPxf.exe
2404	OpJmweN.exe
2244	nssumuB.exe
2472	exgUdMl.exe
2528	qJIPLdn.exe
536	KMHGxVP.exe
1320	fRTgxJS.exe
2092	ZPOshoB.exe
340	QRWchgj.exe
352	ifnZaZs.exe
2592	HpTZuwJ.exe
2600	yAvwadI.exe
2448	keWdkAp.exe
2480	VwWokWW.exe
2032	iTDkBud.exe
1604	xtXltMC.exe
2188	gkOBkRP.exe
328	jkyBezK.exe
2156	bmwHDnh.exe
2120	lYnsymp.exe
1516	UhXGMhf.exe
2744	OckVROv.exe
1184	uABZUFm.exe
2236	tblWafJ.exe
476	laDKZVx.exe
2052	OGBFNPF.exe
1360	GhUHZQR.exe
2096	ODHjyEd.exe
1988	xKoZlGA.exe
2932	qXvoKBL.exe
2964	yKMWcDQ.exe
2980	UtqAnCH.exe
2212	DnQnqsA.exe
1592	DtqILJr.exe
996	zflASAr.exe
2524	YBpfIyr.exe
2604	LYrCkwZ.exe
2732	KxqaXOK.exe
1672	rVdNsXs.exe
628	UntqArp.exe
1168	NeHPCaO.exe
1692	DfCinzw.exe
968	PdJQJDw.exe
2576	oORDTgL.exe
2520	slfZBHu.exe
2288	lTauWSF.exe
2728	ASxZsBt.exe
752	nETIduT.exe

Loads dropped DLL 64 IoCs

pid	Process
1848	7b4a909d87a24ce8dea1d5ca7ce658dd97a8ecc1fb0ab39422ee97d607b2d4d0_NeikiAnalytics.exe
1848	7b4a909d87a24ce8dea1d5ca7ce658dd97a8ecc1fb0ab39422ee97d607b2d4d0_NeikiAnalytics.exe
1848	7b4a909d87a24ce8dea1d5ca7ce658dd97a8ecc1fb0ab39422ee97d607b2d4d0_NeikiAnalytics.exe
1848	7b4a909d87a24ce8dea1d5ca7ce658dd97a8ecc1fb0ab39422ee97d607b2d4d0_NeikiAnalytics.exe
1848	7b4a909d87a24ce8dea1d5ca7ce658dd97a8ecc1fb0ab39422ee97d607b2d4d0_NeikiAnalytics.exe
1848	7b4a909d87a24ce8dea1d5ca7ce658dd97a8ecc1fb0ab39422ee97d607b2d4d0_NeikiAnalytics.exe
1848	7b4a909d87a24ce8dea1d5ca7ce658dd97a8ecc1fb0ab39422ee97d607b2d4d0_NeikiAnalytics.exe
1848	7b4a909d87a24ce8dea1d5ca7ce658dd97a8ecc1fb0ab39422ee97d607b2d4d0_NeikiAnalytics.exe
1848	7b4a909d87a24ce8dea1d5ca7ce658dd97a8ecc1fb0ab39422ee97d607b2d4d0_NeikiAnalytics.exe
1848	7b4a909d87a24ce8dea1d5ca7ce658dd97a8ecc1fb0ab39422ee97d607b2d4d0_NeikiAnalytics.exe
1848	7b4a909d87a24ce8dea1d5ca7ce658dd97a8ecc1fb0ab39422ee97d607b2d4d0_NeikiAnalytics.exe
1848	7b4a909d87a24ce8dea1d5ca7ce658dd97a8ecc1fb0ab39422ee97d607b2d4d0_NeikiAnalytics.exe
1848	7b4a909d87a24ce8dea1d5ca7ce658dd97a8ecc1fb0ab39422ee97d607b2d4d0_NeikiAnalytics.exe
1848	7b4a909d87a24ce8dea1d5ca7ce658dd97a8ecc1fb0ab39422ee97d607b2d4d0_NeikiAnalytics.exe
1848	7b4a909d87a24ce8dea1d5ca7ce658dd97a8ecc1fb0ab39422ee97d607b2d4d0_NeikiAnalytics.exe
1848	7b4a909d87a24ce8dea1d5ca7ce658dd97a8ecc1fb0ab39422ee97d607b2d4d0_NeikiAnalytics.exe
1848	7b4a909d87a24ce8dea1d5ca7ce658dd97a8ecc1fb0ab39422ee97d607b2d4d0_NeikiAnalytics.exe
1848	7b4a909d87a24ce8dea1d5ca7ce658dd97a8ecc1fb0ab39422ee97d607b2d4d0_NeikiAnalytics.exe
1848	7b4a909d87a24ce8dea1d5ca7ce658dd97a8ecc1fb0ab39422ee97d607b2d4d0_NeikiAnalytics.exe
1848	7b4a909d87a24ce8dea1d5ca7ce658dd97a8ecc1fb0ab39422ee97d607b2d4d0_NeikiAnalytics.exe
1848	7b4a909d87a24ce8dea1d5ca7ce658dd97a8ecc1fb0ab39422ee97d607b2d4d0_NeikiAnalytics.exe
1848	7b4a909d87a24ce8dea1d5ca7ce658dd97a8ecc1fb0ab39422ee97d607b2d4d0_NeikiAnalytics.exe
1848	7b4a909d87a24ce8dea1d5ca7ce658dd97a8ecc1fb0ab39422ee97d607b2d4d0_NeikiAnalytics.exe
1848	7b4a909d87a24ce8dea1d5ca7ce658dd97a8ecc1fb0ab39422ee97d607b2d4d0_NeikiAnalytics.exe
1848	7b4a909d87a24ce8dea1d5ca7ce658dd97a8ecc1fb0ab39422ee97d607b2d4d0_NeikiAnalytics.exe
1848	7b4a909d87a24ce8dea1d5ca7ce658dd97a8ecc1fb0ab39422ee97d607b2d4d0_NeikiAnalytics.exe
1848	7b4a909d87a24ce8dea1d5ca7ce658dd97a8ecc1fb0ab39422ee97d607b2d4d0_NeikiAnalytics.exe
1848	7b4a909d87a24ce8dea1d5ca7ce658dd97a8ecc1fb0ab39422ee97d607b2d4d0_NeikiAnalytics.exe
1848	7b4a909d87a24ce8dea1d5ca7ce658dd97a8ecc1fb0ab39422ee97d607b2d4d0_NeikiAnalytics.exe
1848	7b4a909d87a24ce8dea1d5ca7ce658dd97a8ecc1fb0ab39422ee97d607b2d4d0_NeikiAnalytics.exe
1848	7b4a909d87a24ce8dea1d5ca7ce658dd97a8ecc1fb0ab39422ee97d607b2d4d0_NeikiAnalytics.exe
1848	7b4a909d87a24ce8dea1d5ca7ce658dd97a8ecc1fb0ab39422ee97d607b2d4d0_NeikiAnalytics.exe
1848	7b4a909d87a24ce8dea1d5ca7ce658dd97a8ecc1fb0ab39422ee97d607b2d4d0_NeikiAnalytics.exe
1848	7b4a909d87a24ce8dea1d5ca7ce658dd97a8ecc1fb0ab39422ee97d607b2d4d0_NeikiAnalytics.exe
1848	7b4a909d87a24ce8dea1d5ca7ce658dd97a8ecc1fb0ab39422ee97d607b2d4d0_NeikiAnalytics.exe
1848	7b4a909d87a24ce8dea1d5ca7ce658dd97a8ecc1fb0ab39422ee97d607b2d4d0_NeikiAnalytics.exe
1848	7b4a909d87a24ce8dea1d5ca7ce658dd97a8ecc1fb0ab39422ee97d607b2d4d0_NeikiAnalytics.exe
1848	7b4a909d87a24ce8dea1d5ca7ce658dd97a8ecc1fb0ab39422ee97d607b2d4d0_NeikiAnalytics.exe
1848	7b4a909d87a24ce8dea1d5ca7ce658dd97a8ecc1fb0ab39422ee97d607b2d4d0_NeikiAnalytics.exe
1848	7b4a909d87a24ce8dea1d5ca7ce658dd97a8ecc1fb0ab39422ee97d607b2d4d0_NeikiAnalytics.exe
1848	7b4a909d87a24ce8dea1d5ca7ce658dd97a8ecc1fb0ab39422ee97d607b2d4d0_NeikiAnalytics.exe
1848	7b4a909d87a24ce8dea1d5ca7ce658dd97a8ecc1fb0ab39422ee97d607b2d4d0_NeikiAnalytics.exe
1848	7b4a909d87a24ce8dea1d5ca7ce658dd97a8ecc1fb0ab39422ee97d607b2d4d0_NeikiAnalytics.exe
1848	7b4a909d87a24ce8dea1d5ca7ce658dd97a8ecc1fb0ab39422ee97d607b2d4d0_NeikiAnalytics.exe
1848	7b4a909d87a24ce8dea1d5ca7ce658dd97a8ecc1fb0ab39422ee97d607b2d4d0_NeikiAnalytics.exe
1848	7b4a909d87a24ce8dea1d5ca7ce658dd97a8ecc1fb0ab39422ee97d607b2d4d0_NeikiAnalytics.exe
1848	7b4a909d87a24ce8dea1d5ca7ce658dd97a8ecc1fb0ab39422ee97d607b2d4d0_NeikiAnalytics.exe
1848	7b4a909d87a24ce8dea1d5ca7ce658dd97a8ecc1fb0ab39422ee97d607b2d4d0_NeikiAnalytics.exe
1848	7b4a909d87a24ce8dea1d5ca7ce658dd97a8ecc1fb0ab39422ee97d607b2d4d0_NeikiAnalytics.exe
1848	7b4a909d87a24ce8dea1d5ca7ce658dd97a8ecc1fb0ab39422ee97d607b2d4d0_NeikiAnalytics.exe
1848	7b4a909d87a24ce8dea1d5ca7ce658dd97a8ecc1fb0ab39422ee97d607b2d4d0_NeikiAnalytics.exe
1848	7b4a909d87a24ce8dea1d5ca7ce658dd97a8ecc1fb0ab39422ee97d607b2d4d0_NeikiAnalytics.exe
1848	7b4a909d87a24ce8dea1d5ca7ce658dd97a8ecc1fb0ab39422ee97d607b2d4d0_NeikiAnalytics.exe
1848	7b4a909d87a24ce8dea1d5ca7ce658dd97a8ecc1fb0ab39422ee97d607b2d4d0_NeikiAnalytics.exe
1848	7b4a909d87a24ce8dea1d5ca7ce658dd97a8ecc1fb0ab39422ee97d607b2d4d0_NeikiAnalytics.exe
1848	7b4a909d87a24ce8dea1d5ca7ce658dd97a8ecc1fb0ab39422ee97d607b2d4d0_NeikiAnalytics.exe
1848	7b4a909d87a24ce8dea1d5ca7ce658dd97a8ecc1fb0ab39422ee97d607b2d4d0_NeikiAnalytics.exe
1848	7b4a909d87a24ce8dea1d5ca7ce658dd97a8ecc1fb0ab39422ee97d607b2d4d0_NeikiAnalytics.exe
1848	7b4a909d87a24ce8dea1d5ca7ce658dd97a8ecc1fb0ab39422ee97d607b2d4d0_NeikiAnalytics.exe
1848	7b4a909d87a24ce8dea1d5ca7ce658dd97a8ecc1fb0ab39422ee97d607b2d4d0_NeikiAnalytics.exe
1848	7b4a909d87a24ce8dea1d5ca7ce658dd97a8ecc1fb0ab39422ee97d607b2d4d0_NeikiAnalytics.exe
1848	7b4a909d87a24ce8dea1d5ca7ce658dd97a8ecc1fb0ab39422ee97d607b2d4d0_NeikiAnalytics.exe
1848	7b4a909d87a24ce8dea1d5ca7ce658dd97a8ecc1fb0ab39422ee97d607b2d4d0_NeikiAnalytics.exe
1848	7b4a909d87a24ce8dea1d5ca7ce658dd97a8ecc1fb0ab39422ee97d607b2d4d0_NeikiAnalytics.exe

UPX packed file 61 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1848-1-0x000000013F350000-0x000000013F742000-memory.dmp	upx
behavioral1/files/0x000b000000014abe-3.dat	upx
behavioral1/memory/860-8-0x000000013FDE0000-0x00000001401D2000-memory.dmp	upx
behavioral1/files/0x0008000000015605-11.dat	upx
behavioral1/files/0x0007000000015c83-51.dat	upx
behavioral1/files/0x000f000000005578-181.dat	upx
behavioral1/files/0x00060000000167d5-180.dat	upx
behavioral1/files/0x0006000000015d31-75.dat	upx
behavioral1/files/0x0009000000015c78-151.dat	upx
behavioral1/files/0x0006000000016ca5-149.dat	upx
behavioral1/files/0x0006000000016c51-143.dat	upx
behavioral1/files/0x0007000000016bfb-137.dat	upx
behavioral1/files/0x0006000000016be2-131.dat	upx
behavioral1/files/0x00060000000165ae-121.dat	upx
behavioral1/files/0x0006000000016448-115.dat	upx
behavioral1/files/0x00060000000160af-110.dat	upx
behavioral1/files/0x0006000000015f01-109.dat	upx
behavioral1/files/0x0006000000015d98-108.dat	upx
behavioral1/files/0x0006000000015d27-107.dat	upx
behavioral1/files/0x0006000000015d0f-106.dat	upx
behavioral1/files/0x0006000000015cfe-105.dat	upx
behavioral1/files/0x0006000000015cee-104.dat	upx
behavioral1/files/0x0006000000016176-100.dat	upx
behavioral1/files/0x0007000000015b6f-94.dat	upx
behavioral1/files/0x0006000000015f7a-93.dat	upx
behavioral1/files/0x0006000000015df1-83.dat	upx
behavioral1/files/0x0006000000015d1a-69.dat	upx
behavioral1/files/0x0007000000015616-65.dat	upx
behavioral1/files/0x0006000000015d07-62.dat	upx
behavioral1/files/0x0006000000015cf6-56.dat	upx
behavioral1/files/0x0009000000015cb6-52.dat	upx
behavioral1/files/0x000600000001650c-179.dat	upx
behavioral1/files/0x0006000000016287-178.dat	upx
behavioral1/files/0x0006000000016d1a-166.dat	upx
behavioral1/files/0x0006000000016cc6-159.dat	upx
behavioral1/files/0x0006000000016cb6-153.dat	upx
behavioral1/files/0x0006000000016c7c-146.dat	upx
behavioral1/files/0x0006000000016c04-140.dat	upx
behavioral1/files/0x0008000000015c52-50.dat	upx
behavioral1/files/0x0007000000015626-49.dat	upx
behavioral1/files/0x0008000000015cce-46.dat	upx
behavioral1/files/0x0007000000015c9f-40.dat	upx
behavioral1/memory/2768-39-0x000000013F910000-0x000000013FD02000-memory.dmp	upx
behavioral1/files/0x0009000000015018-13.dat	upx
behavioral1/memory/2908-16-0x000000013F650000-0x000000013FA42000-memory.dmp	upx
behavioral1/files/0x0006000000016cbe-156.dat	upx
behavioral1/memory/2748-199-0x000000013FF60000-0x0000000140352000-memory.dmp	upx
behavioral1/memory/2672-198-0x000000013FA80000-0x000000013FE72000-memory.dmp	upx
behavioral1/memory/2628-197-0x000000013F540000-0x000000013F932000-memory.dmp	upx
behavioral1/memory/2580-196-0x000000013F7F0000-0x000000013FBE2000-memory.dmp	upx
behavioral1/files/0x0006000000016d16-162.dat	upx
behavioral1/memory/3068-202-0x000000013F480000-0x000000013F872000-memory.dmp	upx
behavioral1/memory/860-6299-0x000000013FDE0000-0x00000001401D2000-memory.dmp	upx
behavioral1/memory/2768-6300-0x000000013F910000-0x000000013FD02000-memory.dmp	upx
behavioral1/memory/3068-6332-0x000000013F480000-0x000000013F872000-memory.dmp	upx
behavioral1/memory/2908-6737-0x000000013F650000-0x000000013FA42000-memory.dmp	upx
behavioral1/memory/2628-6740-0x000000013F540000-0x000000013F932000-memory.dmp	upx
behavioral1/memory/2580-6738-0x000000013F7F0000-0x000000013FBE2000-memory.dmp	upx
behavioral1/memory/2748-6741-0x000000013FF60000-0x0000000140352000-memory.dmp	upx
behavioral1/memory/2672-6742-0x000000013FA80000-0x000000013FE72000-memory.dmp	upx
behavioral1/memory/1848-14464-0x000000013F350000-0x000000013F742000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\mTKURpi.exe	7b4a909d87a24ce8dea1d5ca7ce658dd97a8ecc1fb0ab39422ee97d607b2d4d0_NeikiAnalytics.exe
File created	C:\Windows\System\aimAQRp.exe	7b4a909d87a24ce8dea1d5ca7ce658dd97a8ecc1fb0ab39422ee97d607b2d4d0_NeikiAnalytics.exe
File created	C:\Windows\System\gaDKpkW.exe	7b4a909d87a24ce8dea1d5ca7ce658dd97a8ecc1fb0ab39422ee97d607b2d4d0_NeikiAnalytics.exe
File created	C:\Windows\System\CZBStfV.exe	7b4a909d87a24ce8dea1d5ca7ce658dd97a8ecc1fb0ab39422ee97d607b2d4d0_NeikiAnalytics.exe
File created	C:\Windows\System\VSMkrLs.exe	7b4a909d87a24ce8dea1d5ca7ce658dd97a8ecc1fb0ab39422ee97d607b2d4d0_NeikiAnalytics.exe
File created	C:\Windows\System\VrBGFQr.exe	7b4a909d87a24ce8dea1d5ca7ce658dd97a8ecc1fb0ab39422ee97d607b2d4d0_NeikiAnalytics.exe
File created	C:\Windows\System\YdVVOwn.exe	7b4a909d87a24ce8dea1d5ca7ce658dd97a8ecc1fb0ab39422ee97d607b2d4d0_NeikiAnalytics.exe
File created	C:\Windows\System\ZpjlPyX.exe	7b4a909d87a24ce8dea1d5ca7ce658dd97a8ecc1fb0ab39422ee97d607b2d4d0_NeikiAnalytics.exe
File created	C:\Windows\System\vMNmGSg.exe	7b4a909d87a24ce8dea1d5ca7ce658dd97a8ecc1fb0ab39422ee97d607b2d4d0_NeikiAnalytics.exe
File created	C:\Windows\System\GfsbgzL.exe	7b4a909d87a24ce8dea1d5ca7ce658dd97a8ecc1fb0ab39422ee97d607b2d4d0_NeikiAnalytics.exe
File created	C:\Windows\System\xUwDZxd.exe	7b4a909d87a24ce8dea1d5ca7ce658dd97a8ecc1fb0ab39422ee97d607b2d4d0_NeikiAnalytics.exe
File created	C:\Windows\System\aMEoiQH.exe	7b4a909d87a24ce8dea1d5ca7ce658dd97a8ecc1fb0ab39422ee97d607b2d4d0_NeikiAnalytics.exe
File created	C:\Windows\System\MnXoSIk.exe	7b4a909d87a24ce8dea1d5ca7ce658dd97a8ecc1fb0ab39422ee97d607b2d4d0_NeikiAnalytics.exe
File created	C:\Windows\System\zMNZeHS.exe	7b4a909d87a24ce8dea1d5ca7ce658dd97a8ecc1fb0ab39422ee97d607b2d4d0_NeikiAnalytics.exe
File created	C:\Windows\System\MLniEEA.exe	7b4a909d87a24ce8dea1d5ca7ce658dd97a8ecc1fb0ab39422ee97d607b2d4d0_NeikiAnalytics.exe
File created	C:\Windows\System\gyeNBef.exe	7b4a909d87a24ce8dea1d5ca7ce658dd97a8ecc1fb0ab39422ee97d607b2d4d0_NeikiAnalytics.exe
File created	C:\Windows\System\KrzCNcX.exe	7b4a909d87a24ce8dea1d5ca7ce658dd97a8ecc1fb0ab39422ee97d607b2d4d0_NeikiAnalytics.exe
File created	C:\Windows\System\rlVOnds.exe	7b4a909d87a24ce8dea1d5ca7ce658dd97a8ecc1fb0ab39422ee97d607b2d4d0_NeikiAnalytics.exe
File created	C:\Windows\System\HALXtBx.exe	7b4a909d87a24ce8dea1d5ca7ce658dd97a8ecc1fb0ab39422ee97d607b2d4d0_NeikiAnalytics.exe
File created	C:\Windows\System\DnQnqsA.exe	7b4a909d87a24ce8dea1d5ca7ce658dd97a8ecc1fb0ab39422ee97d607b2d4d0_NeikiAnalytics.exe
File created	C:\Windows\System\jylTzoa.exe	7b4a909d87a24ce8dea1d5ca7ce658dd97a8ecc1fb0ab39422ee97d607b2d4d0_NeikiAnalytics.exe
File created	C:\Windows\System\KaTmCIo.exe	7b4a909d87a24ce8dea1d5ca7ce658dd97a8ecc1fb0ab39422ee97d607b2d4d0_NeikiAnalytics.exe
File created	C:\Windows\System\DbuxOch.exe	7b4a909d87a24ce8dea1d5ca7ce658dd97a8ecc1fb0ab39422ee97d607b2d4d0_NeikiAnalytics.exe
File created	C:\Windows\System\YIrdYej.exe	7b4a909d87a24ce8dea1d5ca7ce658dd97a8ecc1fb0ab39422ee97d607b2d4d0_NeikiAnalytics.exe
File created	C:\Windows\System\SFbWbpC.exe	7b4a909d87a24ce8dea1d5ca7ce658dd97a8ecc1fb0ab39422ee97d607b2d4d0_NeikiAnalytics.exe
File created	C:\Windows\System\qbDLRab.exe	7b4a909d87a24ce8dea1d5ca7ce658dd97a8ecc1fb0ab39422ee97d607b2d4d0_NeikiAnalytics.exe
File created	C:\Windows\System\lIyxAWF.exe	7b4a909d87a24ce8dea1d5ca7ce658dd97a8ecc1fb0ab39422ee97d607b2d4d0_NeikiAnalytics.exe
File created	C:\Windows\System\YDyEBjr.exe	7b4a909d87a24ce8dea1d5ca7ce658dd97a8ecc1fb0ab39422ee97d607b2d4d0_NeikiAnalytics.exe
File created	C:\Windows\System\yBsPBhD.exe	7b4a909d87a24ce8dea1d5ca7ce658dd97a8ecc1fb0ab39422ee97d607b2d4d0_NeikiAnalytics.exe
File created	C:\Windows\System\DSvhLDk.exe	7b4a909d87a24ce8dea1d5ca7ce658dd97a8ecc1fb0ab39422ee97d607b2d4d0_NeikiAnalytics.exe
File created	C:\Windows\System\xvXYrmA.exe	7b4a909d87a24ce8dea1d5ca7ce658dd97a8ecc1fb0ab39422ee97d607b2d4d0_NeikiAnalytics.exe
File created	C:\Windows\System\EdRWFsU.exe	7b4a909d87a24ce8dea1d5ca7ce658dd97a8ecc1fb0ab39422ee97d607b2d4d0_NeikiAnalytics.exe
File created	C:\Windows\System\lXdLHfI.exe	7b4a909d87a24ce8dea1d5ca7ce658dd97a8ecc1fb0ab39422ee97d607b2d4d0_NeikiAnalytics.exe
File created	C:\Windows\System\ujUKODz.exe	7b4a909d87a24ce8dea1d5ca7ce658dd97a8ecc1fb0ab39422ee97d607b2d4d0_NeikiAnalytics.exe
File created	C:\Windows\System\YRPtakQ.exe	7b4a909d87a24ce8dea1d5ca7ce658dd97a8ecc1fb0ab39422ee97d607b2d4d0_NeikiAnalytics.exe
File created	C:\Windows\System\WLUwUKw.exe	7b4a909d87a24ce8dea1d5ca7ce658dd97a8ecc1fb0ab39422ee97d607b2d4d0_NeikiAnalytics.exe
File created	C:\Windows\System\ItAHGAq.exe	7b4a909d87a24ce8dea1d5ca7ce658dd97a8ecc1fb0ab39422ee97d607b2d4d0_NeikiAnalytics.exe
File created	C:\Windows\System\WOumtqF.exe	7b4a909d87a24ce8dea1d5ca7ce658dd97a8ecc1fb0ab39422ee97d607b2d4d0_NeikiAnalytics.exe
File created	C:\Windows\System\zkFXvqU.exe	7b4a909d87a24ce8dea1d5ca7ce658dd97a8ecc1fb0ab39422ee97d607b2d4d0_NeikiAnalytics.exe
File created	C:\Windows\System\AeqJksz.exe	7b4a909d87a24ce8dea1d5ca7ce658dd97a8ecc1fb0ab39422ee97d607b2d4d0_NeikiAnalytics.exe
File created	C:\Windows\System\VrgdBQl.exe	7b4a909d87a24ce8dea1d5ca7ce658dd97a8ecc1fb0ab39422ee97d607b2d4d0_NeikiAnalytics.exe
File created	C:\Windows\System\adhRyQu.exe	7b4a909d87a24ce8dea1d5ca7ce658dd97a8ecc1fb0ab39422ee97d607b2d4d0_NeikiAnalytics.exe
File created	C:\Windows\System\AXGTeuU.exe	7b4a909d87a24ce8dea1d5ca7ce658dd97a8ecc1fb0ab39422ee97d607b2d4d0_NeikiAnalytics.exe
File created	C:\Windows\System\TjsDvVp.exe	7b4a909d87a24ce8dea1d5ca7ce658dd97a8ecc1fb0ab39422ee97d607b2d4d0_NeikiAnalytics.exe
File created	C:\Windows\System\TOioaKb.exe	7b4a909d87a24ce8dea1d5ca7ce658dd97a8ecc1fb0ab39422ee97d607b2d4d0_NeikiAnalytics.exe
File created	C:\Windows\System\dlvzQBC.exe	7b4a909d87a24ce8dea1d5ca7ce658dd97a8ecc1fb0ab39422ee97d607b2d4d0_NeikiAnalytics.exe
File created	C:\Windows\System\PvgtZax.exe	7b4a909d87a24ce8dea1d5ca7ce658dd97a8ecc1fb0ab39422ee97d607b2d4d0_NeikiAnalytics.exe
File created	C:\Windows\System\kFvniVA.exe	7b4a909d87a24ce8dea1d5ca7ce658dd97a8ecc1fb0ab39422ee97d607b2d4d0_NeikiAnalytics.exe
File created	C:\Windows\System\XOvNaBh.exe	7b4a909d87a24ce8dea1d5ca7ce658dd97a8ecc1fb0ab39422ee97d607b2d4d0_NeikiAnalytics.exe
File created	C:\Windows\System\NUylymP.exe	7b4a909d87a24ce8dea1d5ca7ce658dd97a8ecc1fb0ab39422ee97d607b2d4d0_NeikiAnalytics.exe
File created	C:\Windows\System\mntTcdz.exe	7b4a909d87a24ce8dea1d5ca7ce658dd97a8ecc1fb0ab39422ee97d607b2d4d0_NeikiAnalytics.exe
File created	C:\Windows\System\ghxSBuc.exe	7b4a909d87a24ce8dea1d5ca7ce658dd97a8ecc1fb0ab39422ee97d607b2d4d0_NeikiAnalytics.exe
File created	C:\Windows\System\VnHlczR.exe	7b4a909d87a24ce8dea1d5ca7ce658dd97a8ecc1fb0ab39422ee97d607b2d4d0_NeikiAnalytics.exe
File created	C:\Windows\System\MCJIUgk.exe	7b4a909d87a24ce8dea1d5ca7ce658dd97a8ecc1fb0ab39422ee97d607b2d4d0_NeikiAnalytics.exe
File created	C:\Windows\System\HzaAhBQ.exe	7b4a909d87a24ce8dea1d5ca7ce658dd97a8ecc1fb0ab39422ee97d607b2d4d0_NeikiAnalytics.exe
File created	C:\Windows\System\SnMdAGB.exe	7b4a909d87a24ce8dea1d5ca7ce658dd97a8ecc1fb0ab39422ee97d607b2d4d0_NeikiAnalytics.exe
File created	C:\Windows\System\EoBwfro.exe	7b4a909d87a24ce8dea1d5ca7ce658dd97a8ecc1fb0ab39422ee97d607b2d4d0_NeikiAnalytics.exe
File created	C:\Windows\System\WZsSSBp.exe	7b4a909d87a24ce8dea1d5ca7ce658dd97a8ecc1fb0ab39422ee97d607b2d4d0_NeikiAnalytics.exe
File created	C:\Windows\System\XvLzSWo.exe	7b4a909d87a24ce8dea1d5ca7ce658dd97a8ecc1fb0ab39422ee97d607b2d4d0_NeikiAnalytics.exe
File created	C:\Windows\System\lVzqiWb.exe	7b4a909d87a24ce8dea1d5ca7ce658dd97a8ecc1fb0ab39422ee97d607b2d4d0_NeikiAnalytics.exe
File created	C:\Windows\System\nWDSuQg.exe	7b4a909d87a24ce8dea1d5ca7ce658dd97a8ecc1fb0ab39422ee97d607b2d4d0_NeikiAnalytics.exe
File created	C:\Windows\System\xLwpAno.exe	7b4a909d87a24ce8dea1d5ca7ce658dd97a8ecc1fb0ab39422ee97d607b2d4d0_NeikiAnalytics.exe
File created	C:\Windows\System\SOZXFJW.exe	7b4a909d87a24ce8dea1d5ca7ce658dd97a8ecc1fb0ab39422ee97d607b2d4d0_NeikiAnalytics.exe
File created	C:\Windows\System\bYONkXw.exe	7b4a909d87a24ce8dea1d5ca7ce658dd97a8ecc1fb0ab39422ee97d607b2d4d0_NeikiAnalytics.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1152	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	1848	7b4a909d87a24ce8dea1d5ca7ce658dd97a8ecc1fb0ab39422ee97d607b2d4d0_NeikiAnalytics.exe
Token: SeLockMemoryPrivilege	1848	7b4a909d87a24ce8dea1d5ca7ce658dd97a8ecc1fb0ab39422ee97d607b2d4d0_NeikiAnalytics.exe
Token: SeDebugPrivilege	1152	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1848 wrote to memory of 1152	1848	7b4a909d87a24ce8dea1d5ca7ce658dd97a8ecc1fb0ab39422ee97d607b2d4d0_NeikiAnalytics.exe	29
PID 1848 wrote to memory of 1152	1848	7b4a909d87a24ce8dea1d5ca7ce658dd97a8ecc1fb0ab39422ee97d607b2d4d0_NeikiAnalytics.exe	29
PID 1848 wrote to memory of 1152	1848	7b4a909d87a24ce8dea1d5ca7ce658dd97a8ecc1fb0ab39422ee97d607b2d4d0_NeikiAnalytics.exe	29
PID 1848 wrote to memory of 860	1848	7b4a909d87a24ce8dea1d5ca7ce658dd97a8ecc1fb0ab39422ee97d607b2d4d0_NeikiAnalytics.exe	30
PID 1848 wrote to memory of 860	1848	7b4a909d87a24ce8dea1d5ca7ce658dd97a8ecc1fb0ab39422ee97d607b2d4d0_NeikiAnalytics.exe	30
PID 1848 wrote to memory of 860	1848	7b4a909d87a24ce8dea1d5ca7ce658dd97a8ecc1fb0ab39422ee97d607b2d4d0_NeikiAnalytics.exe	30
PID 1848 wrote to memory of 2908	1848	7b4a909d87a24ce8dea1d5ca7ce658dd97a8ecc1fb0ab39422ee97d607b2d4d0_NeikiAnalytics.exe	31
PID 1848 wrote to memory of 2908	1848	7b4a909d87a24ce8dea1d5ca7ce658dd97a8ecc1fb0ab39422ee97d607b2d4d0_NeikiAnalytics.exe	31
PID 1848 wrote to memory of 2908	1848	7b4a909d87a24ce8dea1d5ca7ce658dd97a8ecc1fb0ab39422ee97d607b2d4d0_NeikiAnalytics.exe	31
PID 1848 wrote to memory of 2768	1848	7b4a909d87a24ce8dea1d5ca7ce658dd97a8ecc1fb0ab39422ee97d607b2d4d0_NeikiAnalytics.exe	32
PID 1848 wrote to memory of 2768	1848	7b4a909d87a24ce8dea1d5ca7ce658dd97a8ecc1fb0ab39422ee97d607b2d4d0_NeikiAnalytics.exe	32
PID 1848 wrote to memory of 2768	1848	7b4a909d87a24ce8dea1d5ca7ce658dd97a8ecc1fb0ab39422ee97d607b2d4d0_NeikiAnalytics.exe	32
PID 1848 wrote to memory of 3068	1848	7b4a909d87a24ce8dea1d5ca7ce658dd97a8ecc1fb0ab39422ee97d607b2d4d0_NeikiAnalytics.exe	33
PID 1848 wrote to memory of 3068	1848	7b4a909d87a24ce8dea1d5ca7ce658dd97a8ecc1fb0ab39422ee97d607b2d4d0_NeikiAnalytics.exe	33
PID 1848 wrote to memory of 3068	1848	7b4a909d87a24ce8dea1d5ca7ce658dd97a8ecc1fb0ab39422ee97d607b2d4d0_NeikiAnalytics.exe	33
PID 1848 wrote to memory of 2580	1848	7b4a909d87a24ce8dea1d5ca7ce658dd97a8ecc1fb0ab39422ee97d607b2d4d0_NeikiAnalytics.exe	34
PID 1848 wrote to memory of 2580	1848	7b4a909d87a24ce8dea1d5ca7ce658dd97a8ecc1fb0ab39422ee97d607b2d4d0_NeikiAnalytics.exe	34
PID 1848 wrote to memory of 2580	1848	7b4a909d87a24ce8dea1d5ca7ce658dd97a8ecc1fb0ab39422ee97d607b2d4d0_NeikiAnalytics.exe	34
PID 1848 wrote to memory of 2644	1848	7b4a909d87a24ce8dea1d5ca7ce658dd97a8ecc1fb0ab39422ee97d607b2d4d0_NeikiAnalytics.exe	35
PID 1848 wrote to memory of 2644	1848	7b4a909d87a24ce8dea1d5ca7ce658dd97a8ecc1fb0ab39422ee97d607b2d4d0_NeikiAnalytics.exe	35
PID 1848 wrote to memory of 2644	1848	7b4a909d87a24ce8dea1d5ca7ce658dd97a8ecc1fb0ab39422ee97d607b2d4d0_NeikiAnalytics.exe	35
PID 1848 wrote to memory of 2628	1848	7b4a909d87a24ce8dea1d5ca7ce658dd97a8ecc1fb0ab39422ee97d607b2d4d0_NeikiAnalytics.exe	36
PID 1848 wrote to memory of 2628	1848	7b4a909d87a24ce8dea1d5ca7ce658dd97a8ecc1fb0ab39422ee97d607b2d4d0_NeikiAnalytics.exe	36
PID 1848 wrote to memory of 2628	1848	7b4a909d87a24ce8dea1d5ca7ce658dd97a8ecc1fb0ab39422ee97d607b2d4d0_NeikiAnalytics.exe	36
PID 1848 wrote to memory of 2660	1848	7b4a909d87a24ce8dea1d5ca7ce658dd97a8ecc1fb0ab39422ee97d607b2d4d0_NeikiAnalytics.exe	37
PID 1848 wrote to memory of 2660	1848	7b4a909d87a24ce8dea1d5ca7ce658dd97a8ecc1fb0ab39422ee97d607b2d4d0_NeikiAnalytics.exe	37
PID 1848 wrote to memory of 2660	1848	7b4a909d87a24ce8dea1d5ca7ce658dd97a8ecc1fb0ab39422ee97d607b2d4d0_NeikiAnalytics.exe	37
PID 1848 wrote to memory of 2672	1848	7b4a909d87a24ce8dea1d5ca7ce658dd97a8ecc1fb0ab39422ee97d607b2d4d0_NeikiAnalytics.exe	38
PID 1848 wrote to memory of 2672	1848	7b4a909d87a24ce8dea1d5ca7ce658dd97a8ecc1fb0ab39422ee97d607b2d4d0_NeikiAnalytics.exe	38
PID 1848 wrote to memory of 2672	1848	7b4a909d87a24ce8dea1d5ca7ce658dd97a8ecc1fb0ab39422ee97d607b2d4d0_NeikiAnalytics.exe	38
PID 1848 wrote to memory of 2592	1848	7b4a909d87a24ce8dea1d5ca7ce658dd97a8ecc1fb0ab39422ee97d607b2d4d0_NeikiAnalytics.exe	39
PID 1848 wrote to memory of 2592	1848	7b4a909d87a24ce8dea1d5ca7ce658dd97a8ecc1fb0ab39422ee97d607b2d4d0_NeikiAnalytics.exe	39
PID 1848 wrote to memory of 2592	1848	7b4a909d87a24ce8dea1d5ca7ce658dd97a8ecc1fb0ab39422ee97d607b2d4d0_NeikiAnalytics.exe	39
PID 1848 wrote to memory of 2748	1848	7b4a909d87a24ce8dea1d5ca7ce658dd97a8ecc1fb0ab39422ee97d607b2d4d0_NeikiAnalytics.exe	40
PID 1848 wrote to memory of 2748	1848	7b4a909d87a24ce8dea1d5ca7ce658dd97a8ecc1fb0ab39422ee97d607b2d4d0_NeikiAnalytics.exe	40
PID 1848 wrote to memory of 2748	1848	7b4a909d87a24ce8dea1d5ca7ce658dd97a8ecc1fb0ab39422ee97d607b2d4d0_NeikiAnalytics.exe	40
PID 1848 wrote to memory of 2600	1848	7b4a909d87a24ce8dea1d5ca7ce658dd97a8ecc1fb0ab39422ee97d607b2d4d0_NeikiAnalytics.exe	41
PID 1848 wrote to memory of 2600	1848	7b4a909d87a24ce8dea1d5ca7ce658dd97a8ecc1fb0ab39422ee97d607b2d4d0_NeikiAnalytics.exe	41
PID 1848 wrote to memory of 2600	1848	7b4a909d87a24ce8dea1d5ca7ce658dd97a8ecc1fb0ab39422ee97d607b2d4d0_NeikiAnalytics.exe	41
PID 1848 wrote to memory of 2544	1848	7b4a909d87a24ce8dea1d5ca7ce658dd97a8ecc1fb0ab39422ee97d607b2d4d0_NeikiAnalytics.exe	42
PID 1848 wrote to memory of 2544	1848	7b4a909d87a24ce8dea1d5ca7ce658dd97a8ecc1fb0ab39422ee97d607b2d4d0_NeikiAnalytics.exe	42
PID 1848 wrote to memory of 2544	1848	7b4a909d87a24ce8dea1d5ca7ce658dd97a8ecc1fb0ab39422ee97d607b2d4d0_NeikiAnalytics.exe	42
PID 1848 wrote to memory of 2448	1848	7b4a909d87a24ce8dea1d5ca7ce658dd97a8ecc1fb0ab39422ee97d607b2d4d0_NeikiAnalytics.exe	43
PID 1848 wrote to memory of 2448	1848	7b4a909d87a24ce8dea1d5ca7ce658dd97a8ecc1fb0ab39422ee97d607b2d4d0_NeikiAnalytics.exe	43
PID 1848 wrote to memory of 2448	1848	7b4a909d87a24ce8dea1d5ca7ce658dd97a8ecc1fb0ab39422ee97d607b2d4d0_NeikiAnalytics.exe	43
PID 1848 wrote to memory of 2504	1848	7b4a909d87a24ce8dea1d5ca7ce658dd97a8ecc1fb0ab39422ee97d607b2d4d0_NeikiAnalytics.exe	44
PID 1848 wrote to memory of 2504	1848	7b4a909d87a24ce8dea1d5ca7ce658dd97a8ecc1fb0ab39422ee97d607b2d4d0_NeikiAnalytics.exe	44
PID 1848 wrote to memory of 2504	1848	7b4a909d87a24ce8dea1d5ca7ce658dd97a8ecc1fb0ab39422ee97d607b2d4d0_NeikiAnalytics.exe	44
PID 1848 wrote to memory of 2480	1848	7b4a909d87a24ce8dea1d5ca7ce658dd97a8ecc1fb0ab39422ee97d607b2d4d0_NeikiAnalytics.exe	45
PID 1848 wrote to memory of 2480	1848	7b4a909d87a24ce8dea1d5ca7ce658dd97a8ecc1fb0ab39422ee97d607b2d4d0_NeikiAnalytics.exe	45
PID 1848 wrote to memory of 2480	1848	7b4a909d87a24ce8dea1d5ca7ce658dd97a8ecc1fb0ab39422ee97d607b2d4d0_NeikiAnalytics.exe	45
PID 1848 wrote to memory of 2916	1848	7b4a909d87a24ce8dea1d5ca7ce658dd97a8ecc1fb0ab39422ee97d607b2d4d0_NeikiAnalytics.exe	46
PID 1848 wrote to memory of 2916	1848	7b4a909d87a24ce8dea1d5ca7ce658dd97a8ecc1fb0ab39422ee97d607b2d4d0_NeikiAnalytics.exe	46
PID 1848 wrote to memory of 2916	1848	7b4a909d87a24ce8dea1d5ca7ce658dd97a8ecc1fb0ab39422ee97d607b2d4d0_NeikiAnalytics.exe	46
PID 1848 wrote to memory of 2032	1848	7b4a909d87a24ce8dea1d5ca7ce658dd97a8ecc1fb0ab39422ee97d607b2d4d0_NeikiAnalytics.exe	47
PID 1848 wrote to memory of 2032	1848	7b4a909d87a24ce8dea1d5ca7ce658dd97a8ecc1fb0ab39422ee97d607b2d4d0_NeikiAnalytics.exe	47
PID 1848 wrote to memory of 2032	1848	7b4a909d87a24ce8dea1d5ca7ce658dd97a8ecc1fb0ab39422ee97d607b2d4d0_NeikiAnalytics.exe	47
PID 1848 wrote to memory of 2388	1848	7b4a909d87a24ce8dea1d5ca7ce658dd97a8ecc1fb0ab39422ee97d607b2d4d0_NeikiAnalytics.exe	48
PID 1848 wrote to memory of 2388	1848	7b4a909d87a24ce8dea1d5ca7ce658dd97a8ecc1fb0ab39422ee97d607b2d4d0_NeikiAnalytics.exe	48
PID 1848 wrote to memory of 2388	1848	7b4a909d87a24ce8dea1d5ca7ce658dd97a8ecc1fb0ab39422ee97d607b2d4d0_NeikiAnalytics.exe	48
PID 1848 wrote to memory of 1604	1848	7b4a909d87a24ce8dea1d5ca7ce658dd97a8ecc1fb0ab39422ee97d607b2d4d0_NeikiAnalytics.exe	49
PID 1848 wrote to memory of 1604	1848	7b4a909d87a24ce8dea1d5ca7ce658dd97a8ecc1fb0ab39422ee97d607b2d4d0_NeikiAnalytics.exe	49
PID 1848 wrote to memory of 1604	1848	7b4a909d87a24ce8dea1d5ca7ce658dd97a8ecc1fb0ab39422ee97d607b2d4d0_NeikiAnalytics.exe	49
PID 1848 wrote to memory of 1840	1848	7b4a909d87a24ce8dea1d5ca7ce658dd97a8ecc1fb0ab39422ee97d607b2d4d0_NeikiAnalytics.exe	50

C:\Users\Admin\AppData\Local\Temp\7b4a909d87a24ce8dea1d5ca7ce658dd97a8ecc1fb0ab39422ee97d607b2d4d0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\7b4a909d87a24ce8dea1d5ca7ce658dd97a8ecc1fb0ab39422ee97d607b2d4d0_NeikiAnalytics.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1848
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1152
- C:\Windows\System\ZwBEXed.exe
  C:\Windows\System\ZwBEXed.exe
  2⤵
  - Executes dropped EXE
  PID:860
- C:\Windows\System\HXgXHsM.exe
  C:\Windows\System\HXgXHsM.exe
  2⤵
  - Executes dropped EXE
  PID:2908
- C:\Windows\System\sGYYtRN.exe
  C:\Windows\System\sGYYtRN.exe
  2⤵
  - Executes dropped EXE
  PID:2768
- C:\Windows\System\ktvVYBe.exe
  C:\Windows\System\ktvVYBe.exe
  2⤵
  - Executes dropped EXE
  PID:3068
- C:\Windows\System\pyDiOQa.exe
  C:\Windows\System\pyDiOQa.exe
  2⤵
  - Executes dropped EXE
  PID:2580
- C:\Windows\System\ldzebOk.exe
  C:\Windows\System\ldzebOk.exe
  2⤵
  - Executes dropped EXE
  PID:2644
- C:\Windows\System\yRGwFEO.exe
  C:\Windows\System\yRGwFEO.exe
  2⤵
  - Executes dropped EXE
  PID:2628
- C:\Windows\System\uuZgPxf.exe
  C:\Windows\System\uuZgPxf.exe
  2⤵
  - Executes dropped EXE
  PID:2660
- C:\Windows\System\dzcgqbp.exe
  C:\Windows\System\dzcgqbp.exe
  2⤵
  - Executes dropped EXE
  PID:2672
- C:\Windows\System\HpTZuwJ.exe
  C:\Windows\System\HpTZuwJ.exe
  2⤵
  - Executes dropped EXE
  PID:2592
- C:\Windows\System\mLrDMKQ.exe
  C:\Windows\System\mLrDMKQ.exe
  2⤵
  - Executes dropped EXE
  PID:2748
- C:\Windows\System\yAvwadI.exe
  C:\Windows\System\yAvwadI.exe
  2⤵
  - Executes dropped EXE
  PID:2600
- C:\Windows\System\SrVDuNk.exe
  C:\Windows\System\SrVDuNk.exe
  2⤵
  - Executes dropped EXE
  PID:2544
- C:\Windows\System\keWdkAp.exe
  C:\Windows\System\keWdkAp.exe
  2⤵
  - Executes dropped EXE
  PID:2448
- C:\Windows\System\cGilkFM.exe
  C:\Windows\System\cGilkFM.exe
  2⤵
  - Executes dropped EXE
  PID:2504
- C:\Windows\System\VwWokWW.exe
  C:\Windows\System\VwWokWW.exe
  2⤵
  - Executes dropped EXE
  PID:2480
- C:\Windows\System\uqFgFMS.exe
  C:\Windows\System\uqFgFMS.exe
  2⤵
  - Executes dropped EXE
  PID:2916
- C:\Windows\System\iTDkBud.exe
  C:\Windows\System\iTDkBud.exe
  2⤵
  - Executes dropped EXE
  PID:2032
- C:\Windows\System\TimLYot.exe
  C:\Windows\System\TimLYot.exe
  2⤵
  - Executes dropped EXE
  PID:2388
- C:\Windows\System\xtXltMC.exe
  C:\Windows\System\xtXltMC.exe
  2⤵
  - Executes dropped EXE
  PID:1604
- C:\Windows\System\MiHnpxE.exe
  C:\Windows\System\MiHnpxE.exe
  2⤵
  - Executes dropped EXE
  PID:1840
- C:\Windows\System\gkOBkRP.exe
  C:\Windows\System\gkOBkRP.exe
  2⤵
  - Executes dropped EXE
  PID:2188
- C:\Windows\System\YENoSXs.exe
  C:\Windows\System\YENoSXs.exe
  2⤵
  - Executes dropped EXE
  PID:812
- C:\Windows\System\jkyBezK.exe
  C:\Windows\System\jkyBezK.exe
  2⤵
  - Executes dropped EXE
  PID:328
- C:\Windows\System\WOumtqF.exe
  C:\Windows\System\WOumtqF.exe
  2⤵
  - Executes dropped EXE
  PID:1644
- C:\Windows\System\bmwHDnh.exe
  C:\Windows\System\bmwHDnh.exe
  2⤵
  - Executes dropped EXE
  PID:2156
- C:\Windows\System\OpJmweN.exe
  C:\Windows\System\OpJmweN.exe
  2⤵
  - Executes dropped EXE
  PID:2404
- C:\Windows\System\UhXGMhf.exe
  C:\Windows\System\UhXGMhf.exe
  2⤵
  - Executes dropped EXE
  PID:1516
- C:\Windows\System\nssumuB.exe
  C:\Windows\System\nssumuB.exe
  2⤵
  - Executes dropped EXE
  PID:2244
- C:\Windows\System\OckVROv.exe
  C:\Windows\System\OckVROv.exe
  2⤵
  - Executes dropped EXE
  PID:2744
- C:\Windows\System\exgUdMl.exe
  C:\Windows\System\exgUdMl.exe
  2⤵
  - Executes dropped EXE
  PID:2472
- C:\Windows\System\uABZUFm.exe
  C:\Windows\System\uABZUFm.exe
  2⤵
  - Executes dropped EXE
  PID:1184
- C:\Windows\System\qJIPLdn.exe
  C:\Windows\System\qJIPLdn.exe
  2⤵
  - Executes dropped EXE
  PID:2528
- C:\Windows\System\tblWafJ.exe
  C:\Windows\System\tblWafJ.exe
  2⤵
  - Executes dropped EXE
  PID:2236
- C:\Windows\System\KMHGxVP.exe
  C:\Windows\System\KMHGxVP.exe
  2⤵
  - Executes dropped EXE
  PID:536
- C:\Windows\System\laDKZVx.exe
  C:\Windows\System\laDKZVx.exe
  2⤵
  - Executes dropped EXE
  PID:476
- C:\Windows\System\fRTgxJS.exe
  C:\Windows\System\fRTgxJS.exe
  2⤵
  - Executes dropped EXE
  PID:1320
- C:\Windows\System\OGBFNPF.exe
  C:\Windows\System\OGBFNPF.exe
  2⤵
  - Executes dropped EXE
  PID:2052
- C:\Windows\System\ZPOshoB.exe
  C:\Windows\System\ZPOshoB.exe
  2⤵
  - Executes dropped EXE
  PID:2092
- C:\Windows\System\GhUHZQR.exe
  C:\Windows\System\GhUHZQR.exe
  2⤵
  - Executes dropped EXE
  PID:1360
- C:\Windows\System\QRWchgj.exe
  C:\Windows\System\QRWchgj.exe
  2⤵
  - Executes dropped EXE
  PID:340
- C:\Windows\System\xKoZlGA.exe
  C:\Windows\System\xKoZlGA.exe
  2⤵
  - Executes dropped EXE
  PID:1988
- C:\Windows\System\ifnZaZs.exe
  C:\Windows\System\ifnZaZs.exe
  2⤵
  - Executes dropped EXE
  PID:352
- C:\Windows\System\qXvoKBL.exe
  C:\Windows\System\qXvoKBL.exe
  2⤵
  - Executes dropped EXE
  PID:2932
- C:\Windows\System\lYnsymp.exe
  C:\Windows\System\lYnsymp.exe
  2⤵
  - Executes dropped EXE
  PID:2120
- C:\Windows\System\yKMWcDQ.exe
  C:\Windows\System\yKMWcDQ.exe
  2⤵
  - Executes dropped EXE
  PID:2964
- C:\Windows\System\ODHjyEd.exe
  C:\Windows\System\ODHjyEd.exe
  2⤵
  - Executes dropped EXE
  PID:2096
- C:\Windows\System\UtqAnCH.exe
  C:\Windows\System\UtqAnCH.exe
  2⤵
  - Executes dropped EXE
  PID:2980
- C:\Windows\System\DnQnqsA.exe
  C:\Windows\System\DnQnqsA.exe
  2⤵
  - Executes dropped EXE
  PID:2212
- C:\Windows\System\yEXIvBd.exe
  C:\Windows\System\yEXIvBd.exe
  2⤵
  PID:2108
- C:\Windows\System\DtqILJr.exe
  C:\Windows\System\DtqILJr.exe
  2⤵
  - Executes dropped EXE
  PID:1592
- C:\Windows\System\PIwbUkd.exe
  C:\Windows\System\PIwbUkd.exe
  2⤵
  PID:1704
- C:\Windows\System\zflASAr.exe
  C:\Windows\System\zflASAr.exe
  2⤵
  - Executes dropped EXE
  PID:996
- C:\Windows\System\dBAsbOP.exe
  C:\Windows\System\dBAsbOP.exe
  2⤵
  PID:568
- C:\Windows\System\YBpfIyr.exe
  C:\Windows\System\YBpfIyr.exe
  2⤵
  - Executes dropped EXE
  PID:2524
- C:\Windows\System\IEAOXfO.exe
  C:\Windows\System\IEAOXfO.exe
  2⤵
  PID:2536
- C:\Windows\System\LYrCkwZ.exe
  C:\Windows\System\LYrCkwZ.exe
  2⤵
  - Executes dropped EXE
  PID:2604
- C:\Windows\System\hwnhMLB.exe
  C:\Windows\System\hwnhMLB.exe
  2⤵
  PID:2136
- C:\Windows\System\KxqaXOK.exe
  C:\Windows\System\KxqaXOK.exe
  2⤵
  - Executes dropped EXE
  PID:2732
- C:\Windows\System\DcONvPf.exe
  C:\Windows\System\DcONvPf.exe
  2⤵
  PID:1800
- C:\Windows\System\rVdNsXs.exe
  C:\Windows\System\rVdNsXs.exe
  2⤵
  - Executes dropped EXE
  PID:1672
- C:\Windows\System\JKHILwj.exe
  C:\Windows\System\JKHILwj.exe
  2⤵
  PID:1192
- C:\Windows\System\UntqArp.exe
  C:\Windows\System\UntqArp.exe
  2⤵
  - Executes dropped EXE
  PID:628
- C:\Windows\System\yblkJTB.exe
  C:\Windows\System\yblkJTB.exe
  2⤵
  PID:2060
- C:\Windows\System\NeHPCaO.exe
  C:\Windows\System\NeHPCaO.exe
  2⤵
  - Executes dropped EXE
  PID:1168
- C:\Windows\System\wxqpTwc.exe
  C:\Windows\System\wxqpTwc.exe
  2⤵
  PID:772
- C:\Windows\System\DfCinzw.exe
  C:\Windows\System\DfCinzw.exe
  2⤵
  - Executes dropped EXE
  PID:1692
- C:\Windows\System\SQccOFv.exe
  C:\Windows\System\SQccOFv.exe
  2⤵
  PID:1600
- C:\Windows\System\PdJQJDw.exe
  C:\Windows\System\PdJQJDw.exe
  2⤵
  - Executes dropped EXE
  PID:968
- C:\Windows\System\sIJJOIB.exe
  C:\Windows\System\sIJJOIB.exe
  2⤵
  PID:912
- C:\Windows\System\oORDTgL.exe
  C:\Windows\System\oORDTgL.exe
  2⤵
  - Executes dropped EXE
  PID:2576
- C:\Windows\System\DvdusTP.exe
  C:\Windows\System\DvdusTP.exe
  2⤵
  PID:2820
- C:\Windows\System\slfZBHu.exe
  C:\Windows\System\slfZBHu.exe
  2⤵
  - Executes dropped EXE
  PID:2520
- C:\Windows\System\sXqTATl.exe
  C:\Windows\System\sXqTATl.exe
  2⤵
  PID:2080
- C:\Windows\System\lTauWSF.exe
  C:\Windows\System\lTauWSF.exe
  2⤵
  - Executes dropped EXE
  PID:2288
- C:\Windows\System\iNEPYSI.exe
  C:\Windows\System\iNEPYSI.exe
  2⤵
  PID:2072
- C:\Windows\System\ASxZsBt.exe
  C:\Windows\System\ASxZsBt.exe
  2⤵
  - Executes dropped EXE
  PID:2728
- C:\Windows\System\xUoEZhd.exe
  C:\Windows\System\xUoEZhd.exe
  2⤵
  PID:2456
- C:\Windows\System\nETIduT.exe
  C:\Windows\System\nETIduT.exe
  2⤵
  - Executes dropped EXE
  PID:752
- C:\Windows\System\Ldrdsob.exe
  C:\Windows\System\Ldrdsob.exe
  2⤵
  PID:2760
- C:\Windows\System\MqWxIeY.exe
  C:\Windows\System\MqWxIeY.exe
  2⤵
  PID:672
- C:\Windows\System\wsawgEl.exe
  C:\Windows\System\wsawgEl.exe
  2⤵
  PID:2400
- C:\Windows\System\NgsBKjp.exe
  C:\Windows\System\NgsBKjp.exe
  2⤵
  PID:2232
- C:\Windows\System\XdUjtoV.exe
  C:\Windows\System\XdUjtoV.exe
  2⤵
  PID:2640
- C:\Windows\System\iGcuJKV.exe
  C:\Windows\System\iGcuJKV.exe
  2⤵
  PID:3060
- C:\Windows\System\lRmljmB.exe
  C:\Windows\System\lRmljmB.exe
  2⤵
  PID:2208
- C:\Windows\System\pEbmmzj.exe
  C:\Windows\System\pEbmmzj.exe
  2⤵
  PID:2076
- C:\Windows\System\NUSFypd.exe
  C:\Windows\System\NUSFypd.exe
  2⤵
  PID:2712
- C:\Windows\System\oWdRFJg.exe
  C:\Windows\System\oWdRFJg.exe
  2⤵
  PID:2276
- C:\Windows\System\aDIshDi.exe
  C:\Windows\System\aDIshDi.exe
  2⤵
  PID:2992
- C:\Windows\System\KwRIapf.exe
  C:\Windows\System\KwRIapf.exe
  2⤵
  PID:2944
- C:\Windows\System\wIoOnmJ.exe
  C:\Windows\System\wIoOnmJ.exe
  2⤵
  PID:2616
- C:\Windows\System\VNtmrJs.exe
  C:\Windows\System\VNtmrJs.exe
  2⤵
  PID:1896
- C:\Windows\System\zMOTcul.exe
  C:\Windows\System\zMOTcul.exe
  2⤵
  PID:2632
- C:\Windows\System\SCXsKkp.exe
  C:\Windows\System\SCXsKkp.exe
  2⤵
  PID:776
- C:\Windows\System\NeTvGJV.exe
  C:\Windows\System\NeTvGJV.exe
  2⤵
  PID:692
- C:\Windows\System\YllXIwo.exe
  C:\Windows\System\YllXIwo.exe
  2⤵
  PID:1432
- C:\Windows\System\CPzFjmq.exe
  C:\Windows\System\CPzFjmq.exe
  2⤵
  PID:3080
- C:\Windows\System\sxdWOLe.exe
  C:\Windows\System\sxdWOLe.exe
  2⤵
  PID:3096
- C:\Windows\System\NzKqOHc.exe
  C:\Windows\System\NzKqOHc.exe
  2⤵
  PID:3112
- C:\Windows\System\jkahiWQ.exe
  C:\Windows\System\jkahiWQ.exe
  2⤵
  PID:3128
- C:\Windows\System\jjSdWjF.exe
  C:\Windows\System\jjSdWjF.exe
  2⤵
  PID:3144
- C:\Windows\System\PQoagZU.exe
  C:\Windows\System\PQoagZU.exe
  2⤵
  PID:3164
- C:\Windows\System\GlrffbV.exe
  C:\Windows\System\GlrffbV.exe
  2⤵
  PID:3184
- C:\Windows\System\vDyflxi.exe
  C:\Windows\System\vDyflxi.exe
  2⤵
  PID:3200
- C:\Windows\System\HtYWZsq.exe
  C:\Windows\System\HtYWZsq.exe
  2⤵
  PID:3216
- C:\Windows\System\ujXcfHn.exe
  C:\Windows\System\ujXcfHn.exe
  2⤵
  PID:3236
- C:\Windows\System\TPlIAfs.exe
  C:\Windows\System\TPlIAfs.exe
  2⤵
  PID:3252
- C:\Windows\System\uiXfkue.exe
  C:\Windows\System\uiXfkue.exe
  2⤵
  PID:3272
- C:\Windows\System\LwGojJa.exe
  C:\Windows\System\LwGojJa.exe
  2⤵
  PID:3288
- C:\Windows\System\rgrqFAP.exe
  C:\Windows\System\rgrqFAP.exe
  2⤵
  PID:3308
- C:\Windows\System\cHZMgye.exe
  C:\Windows\System\cHZMgye.exe
  2⤵
  PID:3328
- C:\Windows\System\LUfUXRa.exe
  C:\Windows\System\LUfUXRa.exe
  2⤵
  PID:3348
- C:\Windows\System\XvWWSPB.exe
  C:\Windows\System\XvWWSPB.exe
  2⤵
  PID:3604
- C:\Windows\System\MODAGIv.exe
  C:\Windows\System\MODAGIv.exe
  2⤵
  PID:3624
- C:\Windows\System\bNzqfLH.exe
  C:\Windows\System\bNzqfLH.exe
  2⤵
  PID:3644
- C:\Windows\System\acsaobH.exe
  C:\Windows\System\acsaobH.exe
  2⤵
  PID:3664
- C:\Windows\System\ZUPcBlt.exe
  C:\Windows\System\ZUPcBlt.exe
  2⤵
  PID:3684
- C:\Windows\System\FJDycCz.exe
  C:\Windows\System\FJDycCz.exe
  2⤵
  PID:3704
- C:\Windows\System\xCcAjUC.exe
  C:\Windows\System\xCcAjUC.exe
  2⤵
  PID:3720
- C:\Windows\System\BpuroMR.exe
  C:\Windows\System\BpuroMR.exe
  2⤵
  PID:3740
- C:\Windows\System\FWJpsEw.exe
  C:\Windows\System\FWJpsEw.exe
  2⤵
  PID:3756
- C:\Windows\System\vRcnocK.exe
  C:\Windows\System\vRcnocK.exe
  2⤵
  PID:3772
- C:\Windows\System\KPLQncr.exe
  C:\Windows\System\KPLQncr.exe
  2⤵
  PID:3792
- C:\Windows\System\ItqqaaV.exe
  C:\Windows\System\ItqqaaV.exe
  2⤵
  PID:3812
- C:\Windows\System\pbVQLxK.exe
  C:\Windows\System\pbVQLxK.exe
  2⤵
  PID:3828
- C:\Windows\System\WpLyYXk.exe
  C:\Windows\System\WpLyYXk.exe
  2⤵
  PID:3844
- C:\Windows\System\eWXBcJG.exe
  C:\Windows\System\eWXBcJG.exe
  2⤵
  PID:3864
- C:\Windows\System\JITPajW.exe
  C:\Windows\System\JITPajW.exe
  2⤵
  PID:3880
- C:\Windows\System\vYcKsbW.exe
  C:\Windows\System\vYcKsbW.exe
  2⤵
  PID:3896
- C:\Windows\System\cbQzwMD.exe
  C:\Windows\System\cbQzwMD.exe
  2⤵
  PID:3912
- C:\Windows\System\czKEGjW.exe
  C:\Windows\System\czKEGjW.exe
  2⤵
  PID:3928
- C:\Windows\System\gRmBXiM.exe
  C:\Windows\System\gRmBXiM.exe
  2⤵
  PID:3944
- C:\Windows\System\cTYheAh.exe
  C:\Windows\System\cTYheAh.exe
  2⤵
  PID:3960
- C:\Windows\System\CGQDIan.exe
  C:\Windows\System\CGQDIan.exe
  2⤵
  PID:3976
- C:\Windows\System\zSfLRCI.exe
  C:\Windows\System\zSfLRCI.exe
  2⤵
  PID:3992
- C:\Windows\System\jifGRdm.exe
  C:\Windows\System\jifGRdm.exe
  2⤵
  PID:4016
- C:\Windows\System\LefXePO.exe
  C:\Windows\System\LefXePO.exe
  2⤵
  PID:4036
- C:\Windows\System\tsfxkln.exe
  C:\Windows\System\tsfxkln.exe
  2⤵
  PID:4052
- C:\Windows\System\vxGFfpj.exe
  C:\Windows\System\vxGFfpj.exe
  2⤵
  PID:4068
- C:\Windows\System\XPkyORq.exe
  C:\Windows\System\XPkyORq.exe
  2⤵
  PID:2280
- C:\Windows\System\LlzMZYw.exe
  C:\Windows\System\LlzMZYw.exe
  2⤵
  PID:2868
- C:\Windows\System\aqWnHiN.exe
  C:\Windows\System\aqWnHiN.exe
  2⤵
  PID:2364
- C:\Windows\System\lXURIqs.exe
  C:\Windows\System\lXURIqs.exe
  2⤵
  PID:2336
- C:\Windows\System\KaUChWt.exe
  C:\Windows\System\KaUChWt.exe
  2⤵
  PID:3108
- C:\Windows\System\jxwCwXC.exe
  C:\Windows\System\jxwCwXC.exe
  2⤵
  PID:3180
- C:\Windows\System\YYkFlRy.exe
  C:\Windows\System\YYkFlRy.exe
  2⤵
  PID:3248
- C:\Windows\System\hgGycmn.exe
  C:\Windows\System\hgGycmn.exe
  2⤵
  PID:3316
- C:\Windows\System\DoFneXj.exe
  C:\Windows\System\DoFneXj.exe
  2⤵
  PID:2216
- C:\Windows\System\bhgWooa.exe
  C:\Windows\System\bhgWooa.exe
  2⤵
  PID:3360
- C:\Windows\System\SzmEAkk.exe
  C:\Windows\System\SzmEAkk.exe
  2⤵
  PID:3368
- C:\Windows\System\dRuLKCR.exe
  C:\Windows\System\dRuLKCR.exe
  2⤵
  PID:2668
- C:\Windows\System\OTwUDaq.exe
  C:\Windows\System\OTwUDaq.exe
  2⤵
  PID:2036
- C:\Windows\System\fWcHnGP.exe
  C:\Windows\System\fWcHnGP.exe
  2⤵
  PID:1460
- C:\Windows\System\cgkJUdp.exe
  C:\Windows\System\cgkJUdp.exe
  2⤵
  PID:3388
- C:\Windows\System\HMlDokl.exe
  C:\Windows\System\HMlDokl.exe
  2⤵
  PID:3404
- C:\Windows\System\hAFIwvN.exe
  C:\Windows\System\hAFIwvN.exe
  2⤵
  PID:1696
- C:\Windows\System\ztEBFpq.exe
  C:\Windows\System\ztEBFpq.exe
  2⤵
  PID:3408
- C:\Windows\System\HOksBOn.exe
  C:\Windows\System\HOksBOn.exe
  2⤵
  PID:3420
- C:\Windows\System\pCXLgJl.exe
  C:\Windows\System\pCXLgJl.exe
  2⤵
  PID:1688
- C:\Windows\System\jQbLbIE.exe
  C:\Windows\System\jQbLbIE.exe
  2⤵
  PID:2804
- C:\Windows\System\gyYAPdR.exe
  C:\Windows\System\gyYAPdR.exe
  2⤵
  PID:3452
- C:\Windows\System\wnTIEki.exe
  C:\Windows\System\wnTIEki.exe
  2⤵
  PID:1788
- C:\Windows\System\dMraVHj.exe
  C:\Windows\System\dMraVHj.exe
  2⤵
  PID:3472
- C:\Windows\System\AdEliHS.exe
  C:\Windows\System\AdEliHS.exe
  2⤵
  PID:3488
- C:\Windows\System\dAwZSGV.exe
  C:\Windows\System\dAwZSGV.exe
  2⤵
  PID:3500
- C:\Windows\System\lskwWTB.exe
  C:\Windows\System\lskwWTB.exe
  2⤵
  PID:3512
- C:\Windows\System\lHSNsRf.exe
  C:\Windows\System\lHSNsRf.exe
  2⤵
  PID:1472
- C:\Windows\System\GInXGTk.exe
  C:\Windows\System\GInXGTk.exe
  2⤵
  PID:3056
- C:\Windows\System\MVrGdNm.exe
  C:\Windows\System\MVrGdNm.exe
  2⤵
  PID:952
- C:\Windows\System\fFiJTYU.exe
  C:\Windows\System\fFiJTYU.exe
  2⤵
  PID:2440
- C:\Windows\System\ffAlhLN.exe
  C:\Windows\System\ffAlhLN.exe
  2⤵
  PID:2924
- C:\Windows\System\MtNlKlV.exe
  C:\Windows\System\MtNlKlV.exe
  2⤵
  PID:1828
- C:\Windows\System\wRiCLtT.exe
  C:\Windows\System\wRiCLtT.exe
  2⤵
  PID:2548
- C:\Windows\System\gvcWyHR.exe
  C:\Windows\System\gvcWyHR.exe
  2⤵
  PID:1952
- C:\Windows\System\GOjkOpC.exe
  C:\Windows\System\GOjkOpC.exe
  2⤵
  PID:2312
- C:\Windows\System\QuQCDHC.exe
  C:\Windows\System\QuQCDHC.exe
  2⤵
  PID:3088
- C:\Windows\System\ajMFGFz.exe
  C:\Windows\System\ajMFGFz.exe
  2⤵
  PID:3152
- C:\Windows\System\ihLWgiB.exe
  C:\Windows\System\ihLWgiB.exe
  2⤵
  PID:3196
- C:\Windows\System\nSAtBYh.exe
  C:\Windows\System\nSAtBYh.exe
  2⤵
  PID:3260
- C:\Windows\System\smGqPGD.exe
  C:\Windows\System\smGqPGD.exe
  2⤵
  PID:3304
- C:\Windows\System\YSHRRWF.exe
  C:\Windows\System\YSHRRWF.exe
  2⤵
  PID:1204
- C:\Windows\System\ywyfbsy.exe
  C:\Windows\System\ywyfbsy.exe
  2⤵
  PID:3296
- C:\Windows\System\EGgbTJD.exe
  C:\Windows\System\EGgbTJD.exe
  2⤵
  PID:3636
- C:\Windows\System\DtvBXBt.exe
  C:\Windows\System\DtvBXBt.exe
  2⤵
  PID:3656
- C:\Windows\System\PWeEohg.exe
  C:\Windows\System\PWeEohg.exe
  2⤵
  PID:3680
- C:\Windows\System\WCFzERA.exe
  C:\Windows\System\WCFzERA.exe
  2⤵
  PID:3752
- C:\Windows\System\aWKfpfh.exe
  C:\Windows\System\aWKfpfh.exe
  2⤵
  PID:3820
- C:\Windows\System\vuRBrIy.exe
  C:\Windows\System\vuRBrIy.exe
  2⤵
  PID:3860
- C:\Windows\System\VrgdBQl.exe
  C:\Windows\System\VrgdBQl.exe
  2⤵
  PID:3924
- C:\Windows\System\ZfSfxnO.exe
  C:\Windows\System\ZfSfxnO.exe
  2⤵
  PID:3988
- C:\Windows\System\jelFgex.exe
  C:\Windows\System\jelFgex.exe
  2⤵
  PID:4060
- C:\Windows\System\lRQEgqN.exe
  C:\Windows\System\lRQEgqN.exe
  2⤵
  PID:2516
- C:\Windows\System\VdoaVSx.exe
  C:\Windows\System\VdoaVSx.exe
  2⤵
  PID:3140
- C:\Windows\System\vMNmGSg.exe
  C:\Windows\System\vMNmGSg.exe
  2⤵
  PID:1200
- C:\Windows\System\DSpcICQ.exe
  C:\Windows\System\DSpcICQ.exe
  2⤵
  PID:1504
- C:\Windows\System\fGxgGFB.exe
  C:\Windows\System\fGxgGFB.exe
  2⤵
  PID:3836
- C:\Windows\System\jpJdVZh.exe
  C:\Windows\System\jpJdVZh.exe
  2⤵
  PID:3936
- C:\Windows\System\AiBsKJK.exe
  C:\Windows\System\AiBsKJK.exe
  2⤵
  PID:3736
- C:\Windows\System\BLlKqfG.exe
  C:\Windows\System\BLlKqfG.exe
  2⤵
  PID:2264
- C:\Windows\System\evlEPcW.exe
  C:\Windows\System\evlEPcW.exe
  2⤵
  PID:3468
- C:\Windows\System\RXMyYqx.exe
  C:\Windows\System\RXMyYqx.exe
  2⤵
  PID:3524
- C:\Windows\System\smgljsH.exe
  C:\Windows\System\smgljsH.exe
  2⤵
  PID:2608
- C:\Windows\System\fNWERmt.exe
  C:\Windows\System\fNWERmt.exe
  2⤵
  PID:2416
- C:\Windows\System\ERbhpId.exe
  C:\Windows\System\ERbhpId.exe
  2⤵
  PID:2988
- C:\Windows\System\EKvFaoD.exe
  C:\Windows\System\EKvFaoD.exe
  2⤵
  PID:3696
- C:\Windows\System\pMFvPPO.exe
  C:\Windows\System\pMFvPPO.exe
  2⤵
  PID:1588
- C:\Windows\System\sjTAMkb.exe
  C:\Windows\System\sjTAMkb.exe
  2⤵
  PID:2296
- C:\Windows\System\gJXYUgd.exe
  C:\Windows\System\gJXYUgd.exe
  2⤵
  PID:2648
- C:\Windows\System\uxCfoAU.exe
  C:\Windows\System\uxCfoAU.exe
  2⤵
  PID:2704
- C:\Windows\System\qGQdYQI.exe
  C:\Windows\System\qGQdYQI.exe
  2⤵
  PID:2900
- C:\Windows\System\wvtWANc.exe
  C:\Windows\System\wvtWANc.exe
  2⤵
  PID:3456
- C:\Windows\System\FnYnjcb.exe
  C:\Windows\System\FnYnjcb.exe
  2⤵
  PID:1824
- C:\Windows\System\xWyDkIa.exe
  C:\Windows\System\xWyDkIa.exe
  2⤵
  PID:3940
- C:\Windows\System\kaCjEaJ.exe
  C:\Windows\System\kaCjEaJ.exe
  2⤵
  PID:4004
- C:\Windows\System\HsZYKzS.exe
  C:\Windows\System\HsZYKzS.exe
  2⤵
  PID:4048
- C:\Windows\System\cnpcfdL.exe
  C:\Windows\System\cnpcfdL.exe
  2⤵
  PID:4088
- C:\Windows\System\OqvtuVu.exe
  C:\Windows\System\OqvtuVu.exe
  2⤵
  PID:3800
- C:\Windows\System\keuMHTh.exe
  C:\Windows\System\keuMHTh.exe
  2⤵
  PID:3380
- C:\Windows\System\bPoEfkd.exe
  C:\Windows\System\bPoEfkd.exe
  2⤵
  PID:1064
- C:\Windows\System\rUUpKhw.exe
  C:\Windows\System\rUUpKhw.exe
  2⤵
  PID:1268
- C:\Windows\System\oFMMcIz.exe
  C:\Windows\System\oFMMcIz.exe
  2⤵
  PID:1724
- C:\Windows\System\YlGGimt.exe
  C:\Windows\System\YlGGimt.exe
  2⤵
  PID:3364
- C:\Windows\System\UDuPSNy.exe
  C:\Windows\System\UDuPSNy.exe
  2⤵
  PID:3416
- C:\Windows\System\dfSgZCi.exe
  C:\Windows\System\dfSgZCi.exe
  2⤵
  PID:3484
- C:\Windows\System\xNslsUk.exe
  C:\Windows\System\xNslsUk.exe
  2⤵
  PID:1664
- C:\Windows\System\qfLdGFE.exe
  C:\Windows\System\qfLdGFE.exe
  2⤵
  PID:1092
- C:\Windows\System\lRsrGld.exe
  C:\Windows\System\lRsrGld.exe
  2⤵
  PID:2800
- C:\Windows\System\BoJTvbe.exe
  C:\Windows\System\BoJTvbe.exe
  2⤵
  PID:2140
- C:\Windows\System\fcLVQKc.exe
  C:\Windows\System\fcLVQKc.exe
  2⤵
  PID:2552
- C:\Windows\System\ToSTtfN.exe
  C:\Windows\System\ToSTtfN.exe
  2⤵
  PID:804
- C:\Windows\System\CmfCJeJ.exe
  C:\Windows\System\CmfCJeJ.exe
  2⤵
  PID:1632
- C:\Windows\System\lltrFPt.exe
  C:\Windows\System\lltrFPt.exe
  2⤵
  PID:2300
- C:\Windows\System\SrGEyCb.exe
  C:\Windows\System\SrGEyCb.exe
  2⤵
  PID:3192
- C:\Windows\System\bMopENP.exe
  C:\Windows\System\bMopENP.exe
  2⤵
  PID:3300
- C:\Windows\System\ITwvoQw.exe
  C:\Windows\System\ITwvoQw.exe
  2⤵
  PID:3560
- C:\Windows\System\VSrqFwo.exe
  C:\Windows\System\VSrqFwo.exe
  2⤵
  PID:3676
- C:\Windows\System\GyDNiWL.exe
  C:\Windows\System\GyDNiWL.exe
  2⤵
  PID:3784
- C:\Windows\System\FfeOyHx.exe
  C:\Windows\System\FfeOyHx.exe
  2⤵
  PID:3892
- C:\Windows\System\GTMBMVw.exe
  C:\Windows\System\GTMBMVw.exe
  2⤵
  PID:4028
- C:\Windows\System\gHVUBQm.exe
  C:\Windows\System\gHVUBQm.exe
  2⤵
  PID:3984
- C:\Windows\System\DRFcyPu.exe
  C:\Windows\System\DRFcyPu.exe
  2⤵
  PID:2488
- C:\Windows\System\ryHefcj.exe
  C:\Windows\System\ryHefcj.exe
  2⤵
  PID:3176
- C:\Windows\System\TjCdJqW.exe
  C:\Windows\System\TjCdJqW.exe
  2⤵
  PID:3444
- C:\Windows\System\rSfCxIN.exe
  C:\Windows\System\rSfCxIN.exe
  2⤵
  PID:2780
- C:\Windows\System\MAhLgBZ.exe
  C:\Windows\System\MAhLgBZ.exe
  2⤵
  PID:3520
- C:\Windows\System\jCDgEPA.exe
  C:\Windows\System\jCDgEPA.exe
  2⤵
  PID:2772
- C:\Windows\System\eAmuAas.exe
  C:\Windows\System\eAmuAas.exe
  2⤵
  PID:2044
- C:\Windows\System\ZEkfsBY.exe
  C:\Windows\System\ZEkfsBY.exe
  2⤵
  PID:2476
- C:\Windows\System\HTmBYuF.exe
  C:\Windows\System\HTmBYuF.exe
  2⤵
  PID:1148
- C:\Windows\System\TNlSxlK.exe
  C:\Windows\System\TNlSxlK.exe
  2⤵
  PID:2512
- C:\Windows\System\hNlqKwS.exe
  C:\Windows\System\hNlqKwS.exe
  2⤵
  PID:3904
- C:\Windows\System\cugIlGZ.exe
  C:\Windows\System\cugIlGZ.exe
  2⤵
  PID:4112
- C:\Windows\System\qWUKGFf.exe
  C:\Windows\System\qWUKGFf.exe
  2⤵
  PID:4128
- C:\Windows\System\IEDoGqI.exe
  C:\Windows\System\IEDoGqI.exe
  2⤵
  PID:4144
- C:\Windows\System\ftygxYN.exe
  C:\Windows\System\ftygxYN.exe
  2⤵
  PID:4160
- C:\Windows\System\iSVhFjb.exe
  C:\Windows\System\iSVhFjb.exe
  2⤵
  PID:4176
- C:\Windows\System\ATUoeAd.exe
  C:\Windows\System\ATUoeAd.exe
  2⤵
  PID:4192
- C:\Windows\System\kDVxYrC.exe
  C:\Windows\System\kDVxYrC.exe
  2⤵
  PID:4208
- C:\Windows\System\xFFhsKu.exe
  C:\Windows\System\xFFhsKu.exe
  2⤵
  PID:4224
- C:\Windows\System\IhAaRTr.exe
  C:\Windows\System\IhAaRTr.exe
  2⤵
  PID:4240
- C:\Windows\System\LXKCmAD.exe
  C:\Windows\System\LXKCmAD.exe
  2⤵
  PID:4256
- C:\Windows\System\qqzVPyY.exe
  C:\Windows\System\qqzVPyY.exe
  2⤵
  PID:4272
- C:\Windows\System\EFTMkdV.exe
  C:\Windows\System\EFTMkdV.exe
  2⤵
  PID:4288
- C:\Windows\System\CcvbQUY.exe
  C:\Windows\System\CcvbQUY.exe
  2⤵
  PID:4304
- C:\Windows\System\UJwQqZs.exe
  C:\Windows\System\UJwQqZs.exe
  2⤵
  PID:4320
- C:\Windows\System\xCrwdDs.exe
  C:\Windows\System\xCrwdDs.exe
  2⤵
  PID:4532
- C:\Windows\System\EdSMpsO.exe
  C:\Windows\System\EdSMpsO.exe
  2⤵
  PID:4560
- C:\Windows\System\QMgPzrR.exe
  C:\Windows\System\QMgPzrR.exe
  2⤵
  PID:4576
- C:\Windows\System\WXZyiSk.exe
  C:\Windows\System\WXZyiSk.exe
  2⤵
  PID:4592
- C:\Windows\System\UZuoGey.exe
  C:\Windows\System\UZuoGey.exe
  2⤵
  PID:4608
- C:\Windows\System\lxaxkhv.exe
  C:\Windows\System\lxaxkhv.exe
  2⤵
  PID:4628
- C:\Windows\System\PAfmZbs.exe
  C:\Windows\System\PAfmZbs.exe
  2⤵
  PID:4644
- C:\Windows\System\mWerkGI.exe
  C:\Windows\System\mWerkGI.exe
  2⤵
  PID:4660
- C:\Windows\System\uhjWrJj.exe
  C:\Windows\System\uhjWrJj.exe
  2⤵
  PID:4676
- C:\Windows\System\ONuSvXp.exe
  C:\Windows\System\ONuSvXp.exe
  2⤵
  PID:4692
- C:\Windows\System\qjHKnwH.exe
  C:\Windows\System\qjHKnwH.exe
  2⤵
  PID:4708
- C:\Windows\System\XeSlNVd.exe
  C:\Windows\System\XeSlNVd.exe
  2⤵
  PID:4724
- C:\Windows\System\VpDGWaZ.exe
  C:\Windows\System\VpDGWaZ.exe
  2⤵
  PID:4740
- C:\Windows\System\wlPQXfN.exe
  C:\Windows\System\wlPQXfN.exe
  2⤵
  PID:4756
- C:\Windows\System\faLtRRj.exe
  C:\Windows\System\faLtRRj.exe
  2⤵
  PID:4772
- C:\Windows\System\jIwtoYF.exe
  C:\Windows\System\jIwtoYF.exe
  2⤵
  PID:4788
- C:\Windows\System\TmwadCW.exe
  C:\Windows\System\TmwadCW.exe
  2⤵
  PID:4804
- C:\Windows\System\eZUOtiA.exe
  C:\Windows\System\eZUOtiA.exe
  2⤵
  PID:4820
- C:\Windows\System\LmSZfLz.exe
  C:\Windows\System\LmSZfLz.exe
  2⤵
  PID:4836
- C:\Windows\System\oIcDyqe.exe
  C:\Windows\System\oIcDyqe.exe
  2⤵
  PID:4852
- C:\Windows\System\VIpDtzy.exe
  C:\Windows\System\VIpDtzy.exe
  2⤵
  PID:4868
- C:\Windows\System\JyVIogV.exe
  C:\Windows\System\JyVIogV.exe
  2⤵
  PID:4884
- C:\Windows\System\kOqGVhs.exe
  C:\Windows\System\kOqGVhs.exe
  2⤵
  PID:4904
- C:\Windows\System\nvUMVyB.exe
  C:\Windows\System\nvUMVyB.exe
  2⤵
  PID:4920
- C:\Windows\System\mJDdgmC.exe
  C:\Windows\System\mJDdgmC.exe
  2⤵
  PID:4936
- C:\Windows\System\WdvwVFe.exe
  C:\Windows\System\WdvwVFe.exe
  2⤵
  PID:4952
- C:\Windows\System\vgKtIjq.exe
  C:\Windows\System\vgKtIjq.exe
  2⤵
  PID:4968
- C:\Windows\System\JofWIcO.exe
  C:\Windows\System\JofWIcO.exe
  2⤵
  PID:4984
- C:\Windows\System\VDIPvpZ.exe
  C:\Windows\System\VDIPvpZ.exe
  2⤵
  PID:5000
- C:\Windows\System\NDENGvF.exe
  C:\Windows\System\NDENGvF.exe
  2⤵
  PID:5016
- C:\Windows\System\kBMAPoN.exe
  C:\Windows\System\kBMAPoN.exe
  2⤵
  PID:5032
- C:\Windows\System\zWPOOGt.exe
  C:\Windows\System\zWPOOGt.exe
  2⤵
  PID:5048
- C:\Windows\System\RllMwZu.exe
  C:\Windows\System\RllMwZu.exe
  2⤵
  PID:5064
- C:\Windows\System\crxNALX.exe
  C:\Windows\System\crxNALX.exe
  2⤵
  PID:5080
- C:\Windows\System\DYMdAXJ.exe
  C:\Windows\System\DYMdAXJ.exe
  2⤵
  PID:5096
- C:\Windows\System\YKJBzJG.exe
  C:\Windows\System\YKJBzJG.exe
  2⤵
  PID:5112
- C:\Windows\System\OGdTsAF.exe
  C:\Windows\System\OGdTsAF.exe
  2⤵
  PID:940
- C:\Windows\System\gdFOvgC.exe
  C:\Windows\System\gdFOvgC.exe
  2⤵
  PID:1596
- C:\Windows\System\NvMzqVo.exe
  C:\Windows\System\NvMzqVo.exe
  2⤵
  PID:2016
- C:\Windows\System\adhRyQu.exe
  C:\Windows\System\adhRyQu.exe
  2⤵
  PID:2320
- C:\Windows\System\qIRJiCj.exe
  C:\Windows\System\qIRJiCj.exe
  2⤵
  PID:2348
- C:\Windows\System\IDZhjKV.exe
  C:\Windows\System\IDZhjKV.exe
  2⤵
  PID:1984
- C:\Windows\System\RXzfcms.exe
  C:\Windows\System\RXzfcms.exe
  2⤵
  PID:4124
- C:\Windows\System\kqfGwFQ.exe
  C:\Windows\System\kqfGwFQ.exe
  2⤵
  PID:4216
- C:\Windows\System\JhsysIq.exe
  C:\Windows\System\JhsysIq.exe
  2⤵
  PID:4280
- C:\Windows\System\dbDrYaf.exe
  C:\Windows\System\dbDrYaf.exe
  2⤵
  PID:2716
- C:\Windows\System\UwOuwpy.exe
  C:\Windows\System\UwOuwpy.exe
  2⤵
  PID:3808
- C:\Windows\System\ZShhBev.exe
  C:\Windows\System\ZShhBev.exe
  2⤵
  PID:4000
- C:\Windows\System\jRIbhmq.exe
  C:\Windows\System\jRIbhmq.exe
  2⤵
  PID:4524
- C:\Windows\System\tXtPYaH.exe
  C:\Windows\System\tXtPYaH.exe
  2⤵
  PID:4584
- C:\Windows\System\DbuxOch.exe
  C:\Windows\System\DbuxOch.exe
  2⤵
  PID:1628
- C:\Windows\System\jGZvILE.exe
  C:\Windows\System\jGZvILE.exe
  2⤵
  PID:2012
- C:\Windows\System\rJsjUGM.exe
  C:\Windows\System\rJsjUGM.exe
  2⤵
  PID:3228
- C:\Windows\System\BkGRlpe.exe
  C:\Windows\System\BkGRlpe.exe
  2⤵
  PID:3672
- C:\Windows\System\rjYXclh.exe
  C:\Windows\System\rjYXclh.exe
  2⤵
  PID:3956
- C:\Windows\System\iszdbuX.exe
  C:\Windows\System\iszdbuX.exe
  2⤵
  PID:1648
- C:\Windows\System\YvUGWnB.exe
  C:\Windows\System\YvUGWnB.exe
  2⤵
  PID:2420
- C:\Windows\System\sHujmVW.exe
  C:\Windows\System\sHujmVW.exe
  2⤵
  PID:1836
- C:\Windows\System\sSyXgFP.exe
  C:\Windows\System\sSyXgFP.exe
  2⤵
  PID:4136
- C:\Windows\System\rxxbNVZ.exe
  C:\Windows\System\rxxbNVZ.exe
  2⤵
  PID:4200
- C:\Windows\System\JRmLVQh.exe
  C:\Windows\System\JRmLVQh.exe
  2⤵
  PID:4264
- C:\Windows\System\OFPFBCh.exe
  C:\Windows\System\OFPFBCh.exe
  2⤵
  PID:4328
- C:\Windows\System\VMveXrq.exe
  C:\Windows\System\VMveXrq.exe
  2⤵
  PID:4348
- C:\Windows\System\ylnVVHt.exe
  C:\Windows\System\ylnVVHt.exe
  2⤵
  PID:4436
- C:\Windows\System\TkiGMlZ.exe
  C:\Windows\System\TkiGMlZ.exe
  2⤵
  PID:4700
- C:\Windows\System\NwIdDnP.exe
  C:\Windows\System\NwIdDnP.exe
  2⤵
  PID:4736
- C:\Windows\System\CSlcSFG.exe
  C:\Windows\System\CSlcSFG.exe
  2⤵
  PID:4800
- C:\Windows\System\HnPMkJx.exe
  C:\Windows\System\HnPMkJx.exe
  2⤵
  PID:4860
- C:\Windows\System\DSrtDGh.exe
  C:\Windows\System\DSrtDGh.exe
  2⤵
  PID:4636
- C:\Windows\System\sEotkeR.exe
  C:\Windows\System\sEotkeR.exe
  2⤵
  PID:4932
- C:\Windows\System\mCkJgwW.exe
  C:\Windows\System\mCkJgwW.exe
  2⤵
  PID:5088
- C:\Windows\System\EYuGIjw.exe
  C:\Windows\System\EYuGIjw.exe
  2⤵
  PID:3768
- C:\Windows\System\EadbCbv.exe
  C:\Windows\System\EadbCbv.exe
  2⤵
  PID:2636
- C:\Windows\System\xfLbMto.exe
  C:\Windows\System\xfLbMto.exe
  2⤵
  PID:3160
- C:\Windows\System\lRRbUDU.exe
  C:\Windows\System\lRRbUDU.exe
  2⤵
  PID:268
- C:\Windows\System\lBfANwE.exe
  C:\Windows\System\lBfANwE.exe
  2⤵
  PID:1816
- C:\Windows\System\iTVbmIQ.exe
  C:\Windows\System\iTVbmIQ.exe
  2⤵
  PID:2408
- C:\Windows\System\qHwWznk.exe
  C:\Windows\System\qHwWznk.exe
  2⤵
  PID:4300
- C:\Windows\System\tNGChTn.exe
  C:\Windows\System\tNGChTn.exe
  2⤵
  PID:4168
- C:\Windows\System\eIVciem.exe
  C:\Windows\System\eIVciem.exe
  2⤵
  PID:4624
- C:\Windows\System\jPBikos.exe
  C:\Windows\System\jPBikos.exe
  2⤵
  PID:4364
- C:\Windows\System\aDVRUZm.exe
  C:\Windows\System\aDVRUZm.exe
  2⤵
  PID:2996
- C:\Windows\System\lqbfBwb.exe
  C:\Windows\System\lqbfBwb.exe
  2⤵
  PID:2308
- C:\Windows\System\VfubphI.exe
  C:\Windows\System\VfubphI.exe
  2⤵
  PID:4336
- C:\Windows\System\XjVOKaK.exe
  C:\Windows\System\XjVOKaK.exe
  2⤵
  PID:3652
- C:\Windows\System\ALPZCSQ.exe
  C:\Windows\System\ALPZCSQ.exe
  2⤵
  PID:3908
- C:\Windows\System\ScMIyrJ.exe
  C:\Windows\System\ScMIyrJ.exe
  2⤵
  PID:1172
- C:\Windows\System\YaqKTQn.exe
  C:\Windows\System\YaqKTQn.exe
  2⤵
  PID:4552
- C:\Windows\System\VEavOyB.exe
  C:\Windows\System\VEavOyB.exe
  2⤵
  PID:4392
- C:\Windows\System\WxfGbiq.exe
  C:\Windows\System\WxfGbiq.exe
  2⤵
  PID:4684
- C:\Windows\System\vFtYRXQ.exe
  C:\Windows\System\vFtYRXQ.exe
  2⤵
  PID:4716
- C:\Windows\System\vrQwOQT.exe
  C:\Windows\System\vrQwOQT.exe
  2⤵
  PID:4424
- C:\Windows\System\UOLfXEo.exe
  C:\Windows\System\UOLfXEo.exe
  2⤵
  PID:4448
- C:\Windows\System\aOQXYoS.exe
  C:\Windows\System\aOQXYoS.exe
  2⤵
  PID:4472
- C:\Windows\System\kpgafzE.exe
  C:\Windows\System\kpgafzE.exe
  2⤵
  PID:4484
- C:\Windows\System\unMtGuY.exe
  C:\Windows\System\unMtGuY.exe
  2⤵
  PID:4500
- C:\Windows\System\ZgalxhC.exe
  C:\Windows\System\ZgalxhC.exe
  2⤵
  PID:4900
- C:\Windows\System\NeLsvgZ.exe
  C:\Windows\System\NeLsvgZ.exe
  2⤵
  PID:4892
- C:\Windows\System\kMpLCBy.exe
  C:\Windows\System\kMpLCBy.exe
  2⤵
  PID:5024
- C:\Windows\System\lOAtOdR.exe
  C:\Windows\System\lOAtOdR.exe
  2⤵
  PID:3700
- C:\Windows\System\TZtJvAI.exe
  C:\Windows\System\TZtJvAI.exe
  2⤵
  PID:1764
- C:\Windows\System\BdoJZuK.exe
  C:\Windows\System\BdoJZuK.exe
  2⤵
  PID:1104
- C:\Windows\System\KMfegFq.exe
  C:\Windows\System\KMfegFq.exe
  2⤵
  PID:4748
- C:\Windows\System\jHkJbtT.exe
  C:\Windows\System\jHkJbtT.exe
  2⤵
  PID:4812
- C:\Windows\System\PnXDVrH.exe
  C:\Windows\System\PnXDVrH.exe
  2⤵
  PID:4876
- C:\Windows\System\YjFDPwA.exe
  C:\Windows\System\YjFDPwA.exe
  2⤵
  PID:4944
- C:\Windows\System\BqLMrzA.exe
  C:\Windows\System\BqLMrzA.exe
  2⤵
  PID:5012
- C:\Windows\System\QbCtvra.exe
  C:\Windows\System\QbCtvra.exe
  2⤵
  PID:5076
- C:\Windows\System\qzTYlDC.exe
  C:\Windows\System\qzTYlDC.exe
  2⤵
  PID:4184
- C:\Windows\System\nssGNKL.exe
  C:\Windows\System\nssGNKL.exe
  2⤵
  PID:1228
- C:\Windows\System\ujaipcn.exe
  C:\Windows\System\ujaipcn.exe
  2⤵
  PID:4156
- C:\Windows\System\CqsHpeT.exe
  C:\Windows\System\CqsHpeT.exe
  2⤵
  PID:2192
- C:\Windows\System\cAOrKGC.exe
  C:\Windows\System\cAOrKGC.exe
  2⤵
  PID:4296
- C:\Windows\System\dpDgoui.exe
  C:\Windows\System\dpDgoui.exe
  2⤵
  PID:3788
- C:\Windows\System\hhrcUtu.exe
  C:\Windows\System\hhrcUtu.exe
  2⤵
  PID:4252
- C:\Windows\System\DtICVHA.exe
  C:\Windows\System\DtICVHA.exe
  2⤵
  PID:4232
- C:\Windows\System\vaftsLw.exe
  C:\Windows\System\vaftsLw.exe
  2⤵
  PID:4236
- C:\Windows\System\pmucRJs.exe
  C:\Windows\System\pmucRJs.exe
  2⤵
  PID:2620
- C:\Windows\System\zHoORhK.exe
  C:\Windows\System\zHoORhK.exe
  2⤵
  PID:900
- C:\Windows\System\uxtoIAZ.exe
  C:\Windows\System\uxtoIAZ.exe
  2⤵
  PID:2856
- C:\Windows\System\JpTNYjh.exe
  C:\Windows\System\JpTNYjh.exe
  2⤵
  PID:4652
- C:\Windows\System\qNRpXUq.exe
  C:\Windows\System\qNRpXUq.exe
  2⤵
  PID:4400
- C:\Windows\System\dtzWrCP.exe
  C:\Windows\System\dtzWrCP.exe
  2⤵
  PID:4656
- C:\Windows\System\vOppmfJ.exe
  C:\Windows\System\vOppmfJ.exe
  2⤵
  PID:4780
- C:\Windows\System\XsdqiMN.exe
  C:\Windows\System\XsdqiMN.exe
  2⤵
  PID:3104
- C:\Windows\System\aWacDHL.exe
  C:\Windows\System\aWacDHL.exe
  2⤵
  PID:4896
- C:\Windows\System\tccSUnb.exe
  C:\Windows\System\tccSUnb.exe
  2⤵
  PID:3876
- C:\Windows\System\KLJYHtD.exe
  C:\Windows\System\KLJYHtD.exe
  2⤵
  PID:4012
- C:\Windows\System\cMAbTjQ.exe
  C:\Windows\System\cMAbTjQ.exe
  2⤵
  PID:3764
- C:\Windows\System\FjDGzxO.exe
  C:\Windows\System\FjDGzxO.exe
  2⤵
  PID:3732
- C:\Windows\System\KBUbBvV.exe
  C:\Windows\System\KBUbBvV.exe
  2⤵
  PID:1716
- C:\Windows\System\JHDfQvJ.exe
  C:\Windows\System\JHDfQvJ.exe
  2⤵
  PID:4980
- C:\Windows\System\qjCvqMo.exe
  C:\Windows\System\qjCvqMo.exe
  2⤵
  PID:5040
- C:\Windows\System\aVNDNCz.exe
  C:\Windows\System\aVNDNCz.exe
  2⤵
  PID:4620
- C:\Windows\System\UMuFNiY.exe
  C:\Windows\System\UMuFNiY.exe
  2⤵
  PID:4544
- C:\Windows\System\YMZbFzC.exe
  C:\Windows\System\YMZbFzC.exe
  2⤵
  PID:2204
- C:\Windows\System\wweeFYw.exe
  C:\Windows\System\wweeFYw.exe
  2⤵
  PID:4384
- C:\Windows\System\nNqIfeb.exe
  C:\Windows\System\nNqIfeb.exe
  2⤵
  PID:4412
- C:\Windows\System\ixSzNDj.exe
  C:\Windows\System\ixSzNDj.exe
  2⤵
  PID:4480
- C:\Windows\System\zwBPqFZ.exe
  C:\Windows\System\zwBPqFZ.exe
  2⤵
  PID:3508
- C:\Windows\System\sxYXEMq.exe
  C:\Windows\System\sxYXEMq.exe
  2⤵
  PID:4668
- C:\Windows\System\fToDAvZ.exe
  C:\Windows\System\fToDAvZ.exe
  2⤵
  PID:4568
- C:\Windows\System\gcGxzep.exe
  C:\Windows\System\gcGxzep.exe
  2⤵
  PID:4796
- C:\Windows\System\EdRWFsU.exe
  C:\Windows\System\EdRWFsU.exe
  2⤵
  PID:2324
- C:\Windows\System\OuEePKA.exe
  C:\Windows\System\OuEePKA.exe
  2⤵
  PID:5128
- C:\Windows\System\SZHwqKn.exe
  C:\Windows\System\SZHwqKn.exe
  2⤵
  PID:5144
- C:\Windows\System\WzMEPVl.exe
  C:\Windows\System\WzMEPVl.exe
  2⤵
  PID:5164
- C:\Windows\System\maBMnNm.exe
  C:\Windows\System\maBMnNm.exe
  2⤵
  PID:5180
- C:\Windows\System\UmqttmJ.exe
  C:\Windows\System\UmqttmJ.exe
  2⤵
  PID:5196
- C:\Windows\System\VdEURRZ.exe
  C:\Windows\System\VdEURRZ.exe
  2⤵
  PID:5216
- C:\Windows\System\hmKzOFq.exe
  C:\Windows\System\hmKzOFq.exe
  2⤵
  PID:5232
- C:\Windows\System\PyAPcuJ.exe
  C:\Windows\System\PyAPcuJ.exe
  2⤵
  PID:5252
- C:\Windows\System\VdEEwqm.exe
  C:\Windows\System\VdEEwqm.exe
  2⤵
  PID:5268
- C:\Windows\System\XdMtyVK.exe
  C:\Windows\System\XdMtyVK.exe
  2⤵
  PID:5284
- C:\Windows\System\xggDuqX.exe
  C:\Windows\System\xggDuqX.exe
  2⤵
  PID:5300
- C:\Windows\System\hmKTyFv.exe
  C:\Windows\System\hmKTyFv.exe
  2⤵
  PID:5316
- C:\Windows\System\mxgYQZy.exe
  C:\Windows\System\mxgYQZy.exe
  2⤵
  PID:5332
- C:\Windows\System\JGfceNU.exe
  C:\Windows\System\JGfceNU.exe
  2⤵
  PID:5348
- C:\Windows\System\cFqYRwy.exe
  C:\Windows\System\cFqYRwy.exe
  2⤵
  PID:5364
- C:\Windows\System\XOrsvqw.exe
  C:\Windows\System\XOrsvqw.exe
  2⤵
  PID:5380
- C:\Windows\System\XMphGVQ.exe
  C:\Windows\System\XMphGVQ.exe
  2⤵
  PID:5396
- C:\Windows\System\qZfrxGG.exe
  C:\Windows\System\qZfrxGG.exe
  2⤵
  PID:5416
- C:\Windows\System\zqsUlnZ.exe
  C:\Windows\System\zqsUlnZ.exe
  2⤵
  PID:5568
- C:\Windows\System\TWIOPfK.exe
  C:\Windows\System\TWIOPfK.exe
  2⤵
  PID:5588
- C:\Windows\System\tHnDdoi.exe
  C:\Windows\System\tHnDdoi.exe
  2⤵
  PID:5604
- C:\Windows\System\cHvvvtT.exe
  C:\Windows\System\cHvvvtT.exe
  2⤵
  PID:5620
- C:\Windows\System\agMSYCn.exe
  C:\Windows\System\agMSYCn.exe
  2⤵
  PID:5640
- C:\Windows\System\nmrbfVF.exe
  C:\Windows\System\nmrbfVF.exe
  2⤵
  PID:5656
- C:\Windows\System\ikfEpAF.exe
  C:\Windows\System\ikfEpAF.exe
  2⤵
  PID:5676
- C:\Windows\System\hGGAZrH.exe
  C:\Windows\System\hGGAZrH.exe
  2⤵
  PID:5692
- C:\Windows\System\PzxzWpd.exe
  C:\Windows\System\PzxzWpd.exe
  2⤵
  PID:5712
- C:\Windows\System\EoPMLbP.exe
  C:\Windows\System\EoPMLbP.exe
  2⤵
  PID:5728
- C:\Windows\System\AkDnEfC.exe
  C:\Windows\System\AkDnEfC.exe
  2⤵
  PID:5744
- C:\Windows\System\OnMZpZB.exe
  C:\Windows\System\OnMZpZB.exe
  2⤵
  PID:5760
- C:\Windows\System\pdnyMwL.exe
  C:\Windows\System\pdnyMwL.exe
  2⤵
  PID:5780
- C:\Windows\System\EcFEqav.exe
  C:\Windows\System\EcFEqav.exe
  2⤵
  PID:5804
- C:\Windows\System\sHnqjBs.exe
  C:\Windows\System\sHnqjBs.exe
  2⤵
  PID:5820
- C:\Windows\System\RfJlDcp.exe
  C:\Windows\System\RfJlDcp.exe
  2⤵
  PID:5836
- C:\Windows\System\EtbKeCw.exe
  C:\Windows\System\EtbKeCw.exe
  2⤵
  PID:5852
- C:\Windows\System\EAvZHob.exe
  C:\Windows\System\EAvZHob.exe
  2⤵
  PID:5868
- C:\Windows\System\iqyNeiL.exe
  C:\Windows\System\iqyNeiL.exe
  2⤵
  PID:5884
- C:\Windows\System\XBYzeVH.exe
  C:\Windows\System\XBYzeVH.exe
  2⤵
  PID:5904
- C:\Windows\System\kzZZobx.exe
  C:\Windows\System\kzZZobx.exe
  2⤵
  PID:5920
- C:\Windows\System\MRuiGlg.exe
  C:\Windows\System\MRuiGlg.exe
  2⤵
  PID:5936
- C:\Windows\System\JhcDGvS.exe
  C:\Windows\System\JhcDGvS.exe
  2⤵
  PID:5952
- C:\Windows\System\lOAMKKB.exe
  C:\Windows\System\lOAMKKB.exe
  2⤵
  PID:5968
- C:\Windows\System\cNjIinY.exe
  C:\Windows\System\cNjIinY.exe
  2⤵
  PID:5984
- C:\Windows\System\wXJAZHR.exe
  C:\Windows\System\wXJAZHR.exe
  2⤵
  PID:6000
- C:\Windows\System\yqrxpuR.exe
  C:\Windows\System\yqrxpuR.exe
  2⤵
  PID:6016
- C:\Windows\System\dFpqcLF.exe
  C:\Windows\System\dFpqcLF.exe
  2⤵
  PID:6032
- C:\Windows\System\YMinfgL.exe
  C:\Windows\System\YMinfgL.exe
  2⤵
  PID:6048
- C:\Windows\System\cPvNWad.exe
  C:\Windows\System\cPvNWad.exe
  2⤵
  PID:6064
- C:\Windows\System\QNJSOAs.exe
  C:\Windows\System\QNJSOAs.exe
  2⤵
  PID:6084
- C:\Windows\System\WarsRgg.exe
  C:\Windows\System\WarsRgg.exe
  2⤵
  PID:6100
- C:\Windows\System\khbJQpA.exe
  C:\Windows\System\khbJQpA.exe
  2⤵
  PID:6116
- C:\Windows\System\bDIGuKE.exe
  C:\Windows\System\bDIGuKE.exe
  2⤵
  PID:6136
- C:\Windows\System\unSFmkx.exe
  C:\Windows\System\unSFmkx.exe
  2⤵
  PID:4912
- C:\Windows\System\ujNcZCS.exe
  C:\Windows\System\ujNcZCS.exe
  2⤵
  PID:4688
- C:\Windows\System\TmmVNOQ.exe
  C:\Windows\System\TmmVNOQ.exe
  2⤵
  PID:2896
- C:\Windows\System\bqfGFss.exe
  C:\Windows\System\bqfGFss.exe
  2⤵
  PID:5028
- C:\Windows\System\OoewQUL.exe
  C:\Windows\System\OoewQUL.exe
  2⤵
  PID:4356
- C:\Windows\System\SCejcEk.exe
  C:\Windows\System\SCejcEk.exe
  2⤵
  PID:4848
- C:\Windows\System\tTyRvFr.exe
  C:\Windows\System\tTyRvFr.exe
  2⤵
  PID:4672
- C:\Windows\System\lLMXaHy.exe
  C:\Windows\System\lLMXaHy.exe
  2⤵
  PID:876
- C:\Windows\System\umwBFJX.exe
  C:\Windows\System\umwBFJX.exe
  2⤵
  PID:5212
- C:\Windows\System\RUfjxOb.exe
  C:\Windows\System\RUfjxOb.exe
  2⤵
  PID:5276
- C:\Windows\System\GfsbgzL.exe
  C:\Windows\System\GfsbgzL.exe
  2⤵
  PID:5376
- C:\Windows\System\jgUCEdv.exe
  C:\Windows\System\jgUCEdv.exe
  2⤵
  PID:5452
- C:\Windows\System\CvzDGTA.exe
  C:\Windows\System\CvzDGTA.exe
  2⤵
  PID:5468
- C:\Windows\System\OveEpQo.exe
  C:\Windows\System\OveEpQo.exe
  2⤵
  PID:5492
- C:\Windows\System\MiAwFmQ.exe
  C:\Windows\System\MiAwFmQ.exe
  2⤵
  PID:5508
- C:\Windows\System\vxVlvIn.exe
  C:\Windows\System\vxVlvIn.exe
  2⤵
  PID:5524
- C:\Windows\System\JEQxbQs.exe
  C:\Windows\System\JEQxbQs.exe
  2⤵
  PID:5484
- C:\Windows\System\EVvxfbm.exe
  C:\Windows\System\EVvxfbm.exe
  2⤵
  PID:5552
- C:\Windows\System\kIerAyF.exe
  C:\Windows\System\kIerAyF.exe
  2⤵
  PID:5600
- C:\Windows\System\UxRixTN.exe
  C:\Windows\System\UxRixTN.exe
  2⤵
  PID:5560
- C:\Windows\System\wvtrCCM.exe
  C:\Windows\System\wvtrCCM.exe
  2⤵
  PID:5632
- C:\Windows\System\wsOcsJY.exe
  C:\Windows\System\wsOcsJY.exe
  2⤵
  PID:5704
- C:\Windows\System\GFWkXNz.exe
  C:\Windows\System\GFWkXNz.exe
  2⤵
  PID:5772
- C:\Windows\System\vRmGUvX.exe
  C:\Windows\System\vRmGUvX.exe
  2⤵
  PID:5816
- C:\Windows\System\FfSpwzL.exe
  C:\Windows\System\FfSpwzL.exe
  2⤵
  PID:5916
- C:\Windows\System\OMBHvtD.exe
  C:\Windows\System\OMBHvtD.exe
  2⤵
  PID:5976
- C:\Windows\System\jcMDdbA.exe
  C:\Windows\System\jcMDdbA.exe
  2⤵
  PID:5880
- C:\Windows\System\CuWwAFO.exe
  C:\Windows\System\CuWwAFO.exe
  2⤵
  PID:6108
- C:\Windows\System\PSkDvMO.exe
  C:\Windows\System\PSkDvMO.exe
  2⤵
  PID:6044
- C:\Windows\System\DDLLACm.exe
  C:\Windows\System\DDLLACm.exe
  2⤵
  PID:5616
- C:\Windows\System\gGODAZh.exe
  C:\Windows\System\gGODAZh.exe
  2⤵
  PID:5900
- C:\Windows\System\pmenCXC.exe
  C:\Windows\System\pmenCXC.exe
  2⤵
  PID:5720
- C:\Windows\System\mxRidfn.exe
  C:\Windows\System\mxRidfn.exe
  2⤵
  PID:5684
- C:\Windows\System\EuAPOut.exe
  C:\Windows\System\EuAPOut.exe
  2⤵
  PID:5896
- C:\Windows\System\frqjPZL.exe
  C:\Windows\System\frqjPZL.exe
  2⤵
  PID:4044
- C:\Windows\System\JaYETCU.exe
  C:\Windows\System\JaYETCU.exe
  2⤵
  PID:5800
- C:\Windows\System\TLLXIFQ.exe
  C:\Windows\System\TLLXIFQ.exe
  2⤵
  PID:5892
- C:\Windows\System\mBJDJsU.exe
  C:\Windows\System\mBJDJsU.exe
  2⤵
  PID:5224
- C:\Windows\System\bpbRqtk.exe
  C:\Windows\System\bpbRqtk.exe
  2⤵
  PID:6056
- C:\Windows\System\FlVoOQb.exe
  C:\Windows\System\FlVoOQb.exe
  2⤵
  PID:6128
- C:\Windows\System\KVsjSNt.exe
  C:\Windows\System\KVsjSNt.exe
  2⤵
  PID:4492
- C:\Windows\System\cPHGWQX.exe
  C:\Windows\System\cPHGWQX.exe
  2⤵
  PID:2180
- C:\Windows\System\gktDqmW.exe
  C:\Windows\System\gktDqmW.exe
  2⤵
  PID:5152
- C:\Windows\System\dkujutx.exe
  C:\Windows\System\dkujutx.exe
  2⤵
  PID:5260
- C:\Windows\System\lhUzsgv.exe
  C:\Windows\System\lhUzsgv.exe
  2⤵
  PID:5388
- C:\Windows\System\lkBsYvT.exe
  C:\Windows\System\lkBsYvT.exe
  2⤵
  PID:5440
- C:\Windows\System\yrajcGv.exe
  C:\Windows\System\yrajcGv.exe
  2⤵
  PID:4572
- C:\Windows\System\NKEUMPV.exe
  C:\Windows\System\NKEUMPV.exe
  2⤵
  PID:5308
- C:\Windows\System\yevVvbx.exe
  C:\Windows\System\yevVvbx.exe
  2⤵
  PID:4548
- C:\Windows\System\kyGkatv.exe
  C:\Windows\System\kyGkatv.exe
  2⤵
  PID:1812
- C:\Windows\System\dyvhFqc.exe
  C:\Windows\System\dyvhFqc.exe
  2⤵
  PID:4992
- C:\Windows\System\sizrnCd.exe
  C:\Windows\System\sizrnCd.exe
  2⤵
  PID:5248
- C:\Windows\System\TyBoozI.exe
  C:\Windows\System\TyBoozI.exe
  2⤵
  PID:5372
- C:\Windows\System\oPFMOJv.exe
  C:\Windows\System\oPFMOJv.exe
  2⤵
  PID:5504
- C:\Windows\System\WuvMRgf.exe
  C:\Windows\System\WuvMRgf.exe
  2⤵
  PID:5532
- C:\Windows\System\QHIoCxk.exe
  C:\Windows\System\QHIoCxk.exe
  2⤵
  PID:5580
- C:\Windows\System\lkllixH.exe
  C:\Windows\System\lkllixH.exe
  2⤵
  PID:5488
- C:\Windows\System\tGqPOjV.exe
  C:\Windows\System\tGqPOjV.exe
  2⤵
  PID:5848
- C:\Windows\System\EfRYQHq.exe
  C:\Windows\System\EfRYQHq.exe
  2⤵
  PID:5536
- C:\Windows\System\oQrdFkV.exe
  C:\Windows\System\oQrdFkV.exe
  2⤵
  PID:5944
- C:\Windows\System\xQustlG.exe
  C:\Windows\System\xQustlG.exe
  2⤵
  PID:6008
- C:\Windows\System\wQUGxAW.exe
  C:\Windows\System\wQUGxAW.exe
  2⤵
  PID:4512
- C:\Windows\System\IDNVLed.exe
  C:\Windows\System\IDNVLed.exe
  2⤵
  PID:5792
- C:\Windows\System\FKuhTCy.exe
  C:\Windows\System\FKuhTCy.exe
  2⤵
  PID:6060
- C:\Windows\System\levBSZm.exe
  C:\Windows\System\levBSZm.exe
  2⤵
  PID:2564
- C:\Windows\System\ojUsWCL.exe
  C:\Windows\System\ojUsWCL.exe
  2⤵
  PID:4420
- C:\Windows\System\GvmKmkk.exe
  C:\Windows\System\GvmKmkk.exe
  2⤵
  PID:5188
- C:\Windows\System\sCMdufI.exe
  C:\Windows\System\sCMdufI.exe
  2⤵
  PID:6124
- C:\Windows\System\mOaQQZG.exe
  C:\Windows\System\mOaQQZG.exe
  2⤵
  PID:5356
- C:\Windows\System\VnHlczR.exe
  C:\Windows\System\VnHlczR.exe
  2⤵
  PID:5436
- C:\Windows\System\uWZusEY.exe
  C:\Windows\System\uWZusEY.exe
  2⤵
  PID:1736
- C:\Windows\System\vtBccze.exe
  C:\Windows\System\vtBccze.exe
  2⤵
  PID:5480
- C:\Windows\System\wXaLfQP.exe
  C:\Windows\System\wXaLfQP.exe
  2⤵
  PID:5312
- C:\Windows\System\STiVGpW.exe
  C:\Windows\System\STiVGpW.exe
  2⤵
  PID:5392
- C:\Windows\System\pBumjdE.exe
  C:\Windows\System\pBumjdE.exe
  2⤵
  PID:6072
- C:\Windows\System\VoaRKaM.exe
  C:\Windows\System\VoaRKaM.exe
  2⤵
  PID:5444
- C:\Windows\System\NRNkVQt.exe
  C:\Windows\System\NRNkVQt.exe
  2⤵
  PID:4344
- C:\Windows\System\ukWVjQP.exe
  C:\Windows\System\ukWVjQP.exe
  2⤵
  PID:5464
- C:\Windows\System\ZzqarOH.exe
  C:\Windows\System\ZzqarOH.exe
  2⤵
  PID:5768
- C:\Windows\System\orWfAnr.exe
  C:\Windows\System\orWfAnr.exe
  2⤵
  PID:5752
- C:\Windows\System\XKbpHEd.exe
  C:\Windows\System\XKbpHEd.exe
  2⤵
  PID:4832
- C:\Windows\System\WOvymMB.exe
  C:\Windows\System\WOvymMB.exe
  2⤵
  PID:4600
- C:\Windows\System\PBbbhsn.exe
  C:\Windows\System\PBbbhsn.exe
  2⤵
  PID:5960
- C:\Windows\System\EJcILUn.exe
  C:\Windows\System\EJcILUn.exe
  2⤵
  PID:6112
- C:\Windows\System\JLphVpP.exe
  C:\Windows\System\JLphVpP.exe
  2⤵
  PID:5172
- C:\Windows\System\FHtUcLW.exe
  C:\Windows\System\FHtUcLW.exe
  2⤵
  PID:5520
- C:\Windows\System\JMrIQjY.exe
  C:\Windows\System\JMrIQjY.exe
  2⤵
  PID:5424
- C:\Windows\System\SXKZgoF.exe
  C:\Windows\System\SXKZgoF.exe
  2⤵
  PID:5740
- C:\Windows\System\kZMQvYz.exe
  C:\Windows\System\kZMQvYz.exe
  2⤵
  PID:5832
- C:\Windows\System\RPupVZr.exe
  C:\Windows\System\RPupVZr.exe
  2⤵
  PID:4732
- C:\Windows\System\TrUCrCY.exe
  C:\Windows\System\TrUCrCY.exe
  2⤵
  PID:5548
- C:\Windows\System\rwAwUEI.exe
  C:\Windows\System\rwAwUEI.exe
  2⤵
  PID:5672
- C:\Windows\System\VGKwMLG.exe
  C:\Windows\System\VGKwMLG.exe
  2⤵
  PID:6148
- C:\Windows\System\cxpwVLV.exe
  C:\Windows\System\cxpwVLV.exe
  2⤵
  PID:6164
- C:\Windows\System\XvAZvCe.exe
  C:\Windows\System\XvAZvCe.exe
  2⤵
  PID:6180
- C:\Windows\System\MxYJogC.exe
  C:\Windows\System\MxYJogC.exe
  2⤵
  PID:6196
- C:\Windows\System\cvhtTjn.exe
  C:\Windows\System\cvhtTjn.exe
  2⤵
  PID:6212
- C:\Windows\System\nLVeQMU.exe
  C:\Windows\System\nLVeQMU.exe
  2⤵
  PID:6228
- C:\Windows\System\VmtgElj.exe
  C:\Windows\System\VmtgElj.exe
  2⤵
  PID:6244
- C:\Windows\System\sBxsYBh.exe
  C:\Windows\System\sBxsYBh.exe
  2⤵
  PID:6260
- C:\Windows\System\uoacjdE.exe
  C:\Windows\System\uoacjdE.exe
  2⤵
  PID:6276
- C:\Windows\System\DEkiDOU.exe
  C:\Windows\System\DEkiDOU.exe
  2⤵
  PID:6292
- C:\Windows\System\FdPVNCX.exe
  C:\Windows\System\FdPVNCX.exe
  2⤵
  PID:6308
- C:\Windows\System\xxQpzSC.exe
  C:\Windows\System\xxQpzSC.exe
  2⤵
  PID:6324
- C:\Windows\System\MGqjFRP.exe
  C:\Windows\System\MGqjFRP.exe
  2⤵
  PID:6340
- C:\Windows\System\ElFpXDT.exe
  C:\Windows\System\ElFpXDT.exe
  2⤵
  PID:6356
- C:\Windows\System\PBwpOVo.exe
  C:\Windows\System\PBwpOVo.exe
  2⤵
  PID:6372
- C:\Windows\System\UBmKjIE.exe
  C:\Windows\System\UBmKjIE.exe
  2⤵
  PID:6388
- C:\Windows\System\RwzvdvD.exe
  C:\Windows\System\RwzvdvD.exe
  2⤵
  PID:6404
- C:\Windows\System\tBazvEg.exe
  C:\Windows\System\tBazvEg.exe
  2⤵
  PID:6420
- C:\Windows\System\FelXqyw.exe
  C:\Windows\System\FelXqyw.exe
  2⤵
  PID:6436
- C:\Windows\System\PgZsvQX.exe
  C:\Windows\System\PgZsvQX.exe
  2⤵
  PID:6452
- C:\Windows\System\tGtlSCm.exe
  C:\Windows\System\tGtlSCm.exe
  2⤵
  PID:6468
- C:\Windows\System\ucezvoV.exe
  C:\Windows\System\ucezvoV.exe
  2⤵
  PID:6484
- C:\Windows\System\ixvlQTO.exe
  C:\Windows\System\ixvlQTO.exe
  2⤵
  PID:6500
- C:\Windows\System\SleKFfz.exe
  C:\Windows\System\SleKFfz.exe
  2⤵
  PID:6516
- C:\Windows\System\ilxvPKP.exe
  C:\Windows\System\ilxvPKP.exe
  2⤵
  PID:6532
- C:\Windows\System\bDnQhys.exe
  C:\Windows\System\bDnQhys.exe
  2⤵
  PID:6548
- C:\Windows\System\yiFzVgj.exe
  C:\Windows\System\yiFzVgj.exe
  2⤵
  PID:6564
- C:\Windows\System\AUnoawS.exe
  C:\Windows\System\AUnoawS.exe
  2⤵
  PID:6580
- C:\Windows\System\oiIVxWR.exe
  C:\Windows\System\oiIVxWR.exe
  2⤵
  PID:6596
- C:\Windows\System\DovOArG.exe
  C:\Windows\System\DovOArG.exe
  2⤵
  PID:6612
- C:\Windows\System\oCFJHco.exe
  C:\Windows\System\oCFJHco.exe
  2⤵
  PID:6628
- C:\Windows\System\zKWAHMj.exe
  C:\Windows\System\zKWAHMj.exe
  2⤵
  PID:6644
- C:\Windows\System\ocBoMWE.exe
  C:\Windows\System\ocBoMWE.exe
  2⤵
  PID:6660
- C:\Windows\System\teapQXn.exe
  C:\Windows\System\teapQXn.exe
  2⤵
  PID:6676
- C:\Windows\System\aXGFuXW.exe
  C:\Windows\System\aXGFuXW.exe
  2⤵
  PID:6692
- C:\Windows\System\IVdiVYX.exe
  C:\Windows\System\IVdiVYX.exe
  2⤵
  PID:6708
- C:\Windows\System\puucXoa.exe
  C:\Windows\System\puucXoa.exe
  2⤵
  PID:6724
- C:\Windows\System\LFbmehk.exe
  C:\Windows\System\LFbmehk.exe
  2⤵
  PID:6740
- C:\Windows\System\WUYIGvz.exe
  C:\Windows\System\WUYIGvz.exe
  2⤵
  PID:6756
- C:\Windows\System\abUeOLV.exe
  C:\Windows\System\abUeOLV.exe
  2⤵
  PID:6772
- C:\Windows\System\oFEvHZL.exe
  C:\Windows\System\oFEvHZL.exe
  2⤵
  PID:6788
- C:\Windows\System\cHNxxQp.exe
  C:\Windows\System\cHNxxQp.exe
  2⤵
  PID:6804
- C:\Windows\System\hfbSJGO.exe
  C:\Windows\System\hfbSJGO.exe
  2⤵
  PID:6820
- C:\Windows\System\aLKdElU.exe
  C:\Windows\System\aLKdElU.exe
  2⤵
  PID:6836
- C:\Windows\System\izwxsEP.exe
  C:\Windows\System\izwxsEP.exe
  2⤵
  PID:6852
- C:\Windows\System\FwDKbHO.exe
  C:\Windows\System\FwDKbHO.exe
  2⤵
  PID:6868
- C:\Windows\System\YaOaDyY.exe
  C:\Windows\System\YaOaDyY.exe
  2⤵
  PID:6884
- C:\Windows\System\VOAapbF.exe
  C:\Windows\System\VOAapbF.exe
  2⤵
  PID:6900
- C:\Windows\System\eNyjJxk.exe
  C:\Windows\System\eNyjJxk.exe
  2⤵
  PID:6916
- C:\Windows\System\CYUyjqC.exe
  C:\Windows\System\CYUyjqC.exe
  2⤵
  PID:6932
- C:\Windows\System\ExouJus.exe
  C:\Windows\System\ExouJus.exe
  2⤵
  PID:6948
- C:\Windows\System\VFZNoVS.exe
  C:\Windows\System\VFZNoVS.exe
  2⤵
  PID:6964
- C:\Windows\System\JLUCoZu.exe
  C:\Windows\System\JLUCoZu.exe
  2⤵
  PID:6980
- C:\Windows\System\xKtlVNB.exe
  C:\Windows\System\xKtlVNB.exe
  2⤵
  PID:6996
- C:\Windows\System\HqILrPJ.exe
  C:\Windows\System\HqILrPJ.exe
  2⤵
  PID:7012
- C:\Windows\System\pyjZFsx.exe
  C:\Windows\System\pyjZFsx.exe
  2⤵
  PID:7028
- C:\Windows\System\UpUiDcv.exe
  C:\Windows\System\UpUiDcv.exe
  2⤵
  PID:7044
- C:\Windows\System\ORuVqqi.exe
  C:\Windows\System\ORuVqqi.exe
  2⤵
  PID:7060
- C:\Windows\System\lsjyyRL.exe
  C:\Windows\System\lsjyyRL.exe
  2⤵
  PID:7076
- C:\Windows\System\EpsefaD.exe
  C:\Windows\System\EpsefaD.exe
  2⤵
  PID:7092
- C:\Windows\System\frEeTdC.exe
  C:\Windows\System\frEeTdC.exe
  2⤵
  PID:7108
- C:\Windows\System\fkyljUw.exe
  C:\Windows\System\fkyljUw.exe
  2⤵
  PID:7124
- C:\Windows\System\DSdaLcQ.exe
  C:\Windows\System\DSdaLcQ.exe
  2⤵
  PID:7140
- C:\Windows\System\HPhOVbU.exe
  C:\Windows\System\HPhOVbU.exe
  2⤵
  PID:7156
- C:\Windows\System\aHHYiqL.exe
  C:\Windows\System\aHHYiqL.exe
  2⤵
  PID:6172
- C:\Windows\System\pWrtVWn.exe
  C:\Windows\System\pWrtVWn.exe
  2⤵
  PID:6208
- C:\Windows\System\stlVPDM.exe
  C:\Windows\System\stlVPDM.exe
  2⤵
  PID:6272
- C:\Windows\System\yzUwTPp.exe
  C:\Windows\System\yzUwTPp.exe
  2⤵
  PID:5192
- C:\Windows\System\usWJkxX.exe
  C:\Windows\System\usWJkxX.exe
  2⤵
  PID:6336
- C:\Windows\System\QpJnjBE.exe
  C:\Windows\System\QpJnjBE.exe
  2⤵
  PID:6396
- C:\Windows\System\GRpKOgV.exe
  C:\Windows\System\GRpKOgV.exe
  2⤵
  PID:6432
- C:\Windows\System\KNZKpRu.exe
  C:\Windows\System\KNZKpRu.exe
  2⤵
  PID:6460
- C:\Windows\System\ImQxTpe.exe
  C:\Windows\System\ImQxTpe.exe
  2⤵
  PID:6256
- C:\Windows\System\cahqEOw.exe
  C:\Windows\System\cahqEOw.exe
  2⤵
  PID:6348
- C:\Windows\System\FffIFiQ.exe
  C:\Windows\System\FffIFiQ.exe
  2⤵
  PID:6416
- C:\Windows\System\aRkrCLR.exe
  C:\Windows\System\aRkrCLR.exe
  2⤵
  PID:6476
- C:\Windows\System\aHZALyk.exe
  C:\Windows\System\aHZALyk.exe
  2⤵
  PID:6528
- C:\Windows\System\WsCLklT.exe
  C:\Windows\System\WsCLklT.exe
  2⤵
  PID:6620
- C:\Windows\System\CPYXAaK.exe
  C:\Windows\System\CPYXAaK.exe
  2⤵
  PID:6544
- C:\Windows\System\EEcbEXg.exe
  C:\Windows\System\EEcbEXg.exe
  2⤵
  PID:6576
- C:\Windows\System\vkeNbuo.exe
  C:\Windows\System\vkeNbuo.exe
  2⤵
  PID:6716
- C:\Windows\System\CKMqoOM.exe
  C:\Windows\System\CKMqoOM.exe
  2⤵
  PID:6668
- C:\Windows\System\DrKlgOV.exe
  C:\Windows\System\DrKlgOV.exe
  2⤵
  PID:6752
- C:\Windows\System\gFUdwyz.exe
  C:\Windows\System\gFUdwyz.exe
  2⤵
  PID:6784
- C:\Windows\System\RtUjiWa.exe
  C:\Windows\System\RtUjiWa.exe
  2⤵
  PID:6768
- C:\Windows\System\HoGeUXn.exe
  C:\Windows\System\HoGeUXn.exe
  2⤵
  PID:6844
- C:\Windows\System\QYPCRVv.exe
  C:\Windows\System\QYPCRVv.exe
  2⤵
  PID:6908
- C:\Windows\System\bdUcrTZ.exe
  C:\Windows\System\bdUcrTZ.exe
  2⤵
  PID:6828
- C:\Windows\System\oGrdGYM.exe
  C:\Windows\System\oGrdGYM.exe
  2⤵
  PID:7004
- C:\Windows\System\mgyZOAk.exe
  C:\Windows\System\mgyZOAk.exe
  2⤵
  PID:7040
- C:\Windows\System\wrrFoUg.exe
  C:\Windows\System\wrrFoUg.exe
  2⤵
  PID:7072
- C:\Windows\System\NbvgQJs.exe
  C:\Windows\System\NbvgQJs.exe
  2⤵
  PID:6992
- C:\Windows\System\vjByPty.exe
  C:\Windows\System\vjByPty.exe
  2⤵
  PID:6928
- C:\Windows\System\gInXKqs.exe
  C:\Windows\System\gInXKqs.exe
  2⤵
  PID:6268
- C:\Windows\System\wYTcIHd.exe
  C:\Windows\System\wYTcIHd.exe
  2⤵
  PID:6428
- C:\Windows\System\jLlCCZF.exe
  C:\Windows\System\jLlCCZF.exe
  2⤵
  PID:7116
- C:\Windows\System\mavLgqr.exe
  C:\Windows\System\mavLgqr.exe
  2⤵
  PID:7152
- C:\Windows\System\yHpBwXT.exe
  C:\Windows\System\yHpBwXT.exe
  2⤵
  PID:7020
- C:\Windows\System\mVHelsp.exe
  C:\Windows\System\mVHelsp.exe
  2⤵
  PID:6176
- C:\Windows\System\SjFjmAQ.exe
  C:\Windows\System\SjFjmAQ.exe
  2⤵
  PID:6160
- C:\Windows\System\JhZFmdN.exe
  C:\Windows\System\JhZFmdN.exe
  2⤵
  PID:6412
- C:\Windows\System\mYMLjwP.exe
  C:\Windows\System\mYMLjwP.exe
  2⤵
  PID:6732
- C:\Windows\System\VpOGcgd.exe
  C:\Windows\System\VpOGcgd.exe
  2⤵
  PID:6512
- C:\Windows\System\vGPxXCr.exe
  C:\Windows\System\vGPxXCr.exe
  2⤵
  PID:6720
- C:\Windows\System\puSBDMZ.exe
  C:\Windows\System\puSBDMZ.exe
  2⤵
  PID:6976
- C:\Windows\System\zDMhhvo.exe
  C:\Windows\System\zDMhhvo.exe
  2⤵
  PID:6652
- C:\Windows\System\SpoYXct.exe
  C:\Windows\System\SpoYXct.exe
  2⤵
  PID:5360
- C:\Windows\System\dVBPqwG.exe
  C:\Windows\System\dVBPqwG.exe
  2⤵
  PID:6240
- C:\Windows\System\sgcEXSd.exe
  C:\Windows\System\sgcEXSd.exe
  2⤵
  PID:6944
- C:\Windows\System\CyExQRD.exe
  C:\Windows\System\CyExQRD.exe
  2⤵
  PID:6588
- C:\Windows\System\LXWDynP.exe
  C:\Windows\System\LXWDynP.exe
  2⤵
  PID:6780
- C:\Windows\System\XGUaMTE.exe
  C:\Windows\System\XGUaMTE.exe
  2⤵
  PID:6972
- C:\Windows\System\tiPdEVo.exe
  C:\Windows\System\tiPdEVo.exe
  2⤵
  PID:7084
- C:\Windows\System\blGkxtD.exe
  C:\Windows\System\blGkxtD.exe
  2⤵
  PID:6988
- C:\Windows\System\QZtGEmy.exe
  C:\Windows\System\QZtGEmy.exe
  2⤵
  PID:6288
- C:\Windows\System\zKcsfMk.exe
  C:\Windows\System\zKcsfMk.exe
  2⤵
  PID:6876
- C:\Windows\System\XYebMMy.exe
  C:\Windows\System\XYebMMy.exe
  2⤵
  PID:6684
- C:\Windows\System\feuWIqC.exe
  C:\Windows\System\feuWIqC.exe
  2⤵
  PID:6896
- C:\Windows\System\GiLlvxe.exe
  C:\Windows\System\GiLlvxe.exe
  2⤵
  PID:6704
- C:\Windows\System\wpNAHMw.exe
  C:\Windows\System\wpNAHMw.exe
  2⤵
  PID:7180
- C:\Windows\System\NUDBWqI.exe
  C:\Windows\System\NUDBWqI.exe
  2⤵
  PID:7196
- C:\Windows\System\jLXeusi.exe
  C:\Windows\System\jLXeusi.exe
  2⤵
  PID:7212
- C:\Windows\System\UmmjTnW.exe
  C:\Windows\System\UmmjTnW.exe
  2⤵
  PID:7228
- C:\Windows\System\bCnLYxw.exe
  C:\Windows\System\bCnLYxw.exe
  2⤵
  PID:7248
- C:\Windows\System\OcRKtBo.exe
  C:\Windows\System\OcRKtBo.exe
  2⤵
  PID:7264
- C:\Windows\System\enGUJvj.exe
  C:\Windows\System\enGUJvj.exe
  2⤵
  PID:7284
- C:\Windows\System\jcnzyDb.exe
  C:\Windows\System\jcnzyDb.exe
  2⤵
  PID:7300
- C:\Windows\System\ckiPrlF.exe
  C:\Windows\System\ckiPrlF.exe
  2⤵
  PID:7316
- C:\Windows\System\cynGTwh.exe
  C:\Windows\System\cynGTwh.exe
  2⤵
  PID:7332
- C:\Windows\System\voLPSPB.exe
  C:\Windows\System\voLPSPB.exe
  2⤵
  PID:7352
- C:\Windows\System\UdJAyzA.exe
  C:\Windows\System\UdJAyzA.exe
  2⤵
  PID:7368
- C:\Windows\System\sZZjtrj.exe
  C:\Windows\System\sZZjtrj.exe
  2⤵
  PID:7384
- C:\Windows\System\nRgSOYJ.exe
  C:\Windows\System\nRgSOYJ.exe
  2⤵
  PID:7400
- C:\Windows\System\TZYAOOR.exe
  C:\Windows\System\TZYAOOR.exe
  2⤵
  PID:7416
- C:\Windows\System\LDzUnbu.exe
  C:\Windows\System\LDzUnbu.exe
  2⤵
  PID:7432
- C:\Windows\System\eeAzuDJ.exe
  C:\Windows\System\eeAzuDJ.exe
  2⤵
  PID:7448
- C:\Windows\System\TGRcjMc.exe
  C:\Windows\System\TGRcjMc.exe
  2⤵
  PID:7464
- C:\Windows\System\twyefoW.exe
  C:\Windows\System\twyefoW.exe
  2⤵
  PID:7480
- C:\Windows\System\gGiSgVu.exe
  C:\Windows\System\gGiSgVu.exe
  2⤵
  PID:7500
- C:\Windows\System\GAVtHlG.exe
  C:\Windows\System\GAVtHlG.exe
  2⤵
  PID:7520
- C:\Windows\System\gPmqDJM.exe
  C:\Windows\System\gPmqDJM.exe
  2⤵
  PID:7536
- C:\Windows\System\qtaEJXt.exe
  C:\Windows\System\qtaEJXt.exe
  2⤵
  PID:7552
- C:\Windows\System\RUViQxW.exe
  C:\Windows\System\RUViQxW.exe
  2⤵
  PID:7568
- C:\Windows\System\LQimhBN.exe
  C:\Windows\System\LQimhBN.exe
  2⤵
  PID:7584
- C:\Windows\System\TOgqswa.exe
  C:\Windows\System\TOgqswa.exe
  2⤵
  PID:7600
- C:\Windows\System\SubOzaP.exe
  C:\Windows\System\SubOzaP.exe
  2⤵
  PID:7616
- C:\Windows\System\vOneLZA.exe
  C:\Windows\System\vOneLZA.exe
  2⤵
  PID:7632
- C:\Windows\System\lucHzOn.exe
  C:\Windows\System\lucHzOn.exe
  2⤵
  PID:7648
- C:\Windows\System\tskQhQR.exe
  C:\Windows\System\tskQhQR.exe
  2⤵
  PID:7664
- C:\Windows\System\pNJqlKf.exe
  C:\Windows\System\pNJqlKf.exe
  2⤵
  PID:7680
- C:\Windows\System\dyxcBlQ.exe
  C:\Windows\System\dyxcBlQ.exe
  2⤵
  PID:7696
- C:\Windows\System\djiBlrF.exe
  C:\Windows\System\djiBlrF.exe
  2⤵
  PID:7712
- C:\Windows\System\lYpykGG.exe
  C:\Windows\System\lYpykGG.exe
  2⤵
  PID:7728
- C:\Windows\System\xPeCFkk.exe
  C:\Windows\System\xPeCFkk.exe
  2⤵
  PID:7748
- C:\Windows\System\glcRsbG.exe
  C:\Windows\System\glcRsbG.exe
  2⤵
  PID:7764
- C:\Windows\System\uPQdHzI.exe
  C:\Windows\System\uPQdHzI.exe
  2⤵
  PID:7780
- C:\Windows\System\GEOUyxO.exe
  C:\Windows\System\GEOUyxO.exe
  2⤵
  PID:7796
- C:\Windows\System\iZSUJdf.exe
  C:\Windows\System\iZSUJdf.exe
  2⤵
  PID:7812
- C:\Windows\System\QSBrMDh.exe
  C:\Windows\System\QSBrMDh.exe
  2⤵
  PID:7828
- C:\Windows\System\uYnGuxU.exe
  C:\Windows\System\uYnGuxU.exe
  2⤵
  PID:7844
- C:\Windows\System\RudhHSI.exe
  C:\Windows\System\RudhHSI.exe
  2⤵
  PID:7860
- C:\Windows\System\UMmVzMK.exe
  C:\Windows\System\UMmVzMK.exe
  2⤵
  PID:7876
- C:\Windows\System\ZAartsB.exe
  C:\Windows\System\ZAartsB.exe
  2⤵
  PID:7892
- C:\Windows\System\UVeQxJn.exe
  C:\Windows\System\UVeQxJn.exe
  2⤵
  PID:7908
- C:\Windows\System\pEaGcrP.exe
  C:\Windows\System\pEaGcrP.exe
  2⤵
  PID:7924
- C:\Windows\System\KNxiUGr.exe
  C:\Windows\System\KNxiUGr.exe
  2⤵
  PID:7940
- C:\Windows\System\sZOVwmi.exe
  C:\Windows\System\sZOVwmi.exe
  2⤵
  PID:7956
- C:\Windows\System\CGOHkVr.exe
  C:\Windows\System\CGOHkVr.exe
  2⤵
  PID:7972
- C:\Windows\System\ARTpvrE.exe
  C:\Windows\System\ARTpvrE.exe
  2⤵
  PID:7988
- C:\Windows\System\CfUtyMa.exe
  C:\Windows\System\CfUtyMa.exe
  2⤵
  PID:8004
- C:\Windows\System\yptdNVh.exe
  C:\Windows\System\yptdNVh.exe
  2⤵
  PID:8020
- C:\Windows\System\vWENGdg.exe
  C:\Windows\System\vWENGdg.exe
  2⤵
  PID:8036
- C:\Windows\System\GMtMUOj.exe
  C:\Windows\System\GMtMUOj.exe
  2⤵
  PID:8052
- C:\Windows\System\RusjRjl.exe
  C:\Windows\System\RusjRjl.exe
  2⤵
  PID:8068
- C:\Windows\System\eYMMjbR.exe
  C:\Windows\System\eYMMjbR.exe
  2⤵
  PID:8084
- C:\Windows\System\PbwNwnr.exe
  C:\Windows\System\PbwNwnr.exe
  2⤵
  PID:8100
- C:\Windows\System\mRedoBN.exe
  C:\Windows\System\mRedoBN.exe
  2⤵
  PID:8116
- C:\Windows\System\jhueduw.exe
  C:\Windows\System\jhueduw.exe
  2⤵
  PID:8132
- C:\Windows\System\bimAuVq.exe
  C:\Windows\System\bimAuVq.exe
  2⤵
  PID:8148
- C:\Windows\System\YDxgDVl.exe
  C:\Windows\System\YDxgDVl.exe
  2⤵
  PID:8164
- C:\Windows\System\BwYCiRU.exe
  C:\Windows\System\BwYCiRU.exe
  2⤵
  PID:8180
- C:\Windows\System\eNbujfY.exe
  C:\Windows\System\eNbujfY.exe
  2⤵
  PID:6496
- C:\Windows\System\ZHMfGUJ.exe
  C:\Windows\System\ZHMfGUJ.exe
  2⤵
  PID:6640
- C:\Windows\System\eiDWkYx.exe
  C:\Windows\System\eiDWkYx.exe
  2⤵
  PID:6448
- C:\Windows\System\olUDREi.exe
  C:\Windows\System\olUDREi.exe
  2⤵
  PID:7068
- C:\Windows\System\AxOjwjd.exe
  C:\Windows\System\AxOjwjd.exe
  2⤵
  PID:6560
- C:\Windows\System\ZJAvdoX.exe
  C:\Windows\System\ZJAvdoX.exe
  2⤵
  PID:6956
- C:\Windows\System\eYnQWiw.exe
  C:\Windows\System\eYnQWiw.exe
  2⤵
  PID:7188
- C:\Windows\System\FlTeKKm.exe
  C:\Windows\System\FlTeKKm.exe
  2⤵
  PID:7220
- C:\Windows\System\UfMqEOG.exe
  C:\Windows\System\UfMqEOG.exe
  2⤵
  PID:7256
- C:\Windows\System\TeWQqUd.exe
  C:\Windows\System\TeWQqUd.exe
  2⤵
  PID:7276
- C:\Windows\System\IvJekHz.exe
  C:\Windows\System\IvJekHz.exe
  2⤵
  PID:7324
- C:\Windows\System\RSSrlWU.exe
  C:\Windows\System\RSSrlWU.exe
  2⤵
  PID:7344
- C:\Windows\System\csAKaZi.exe
  C:\Windows\System\csAKaZi.exe
  2⤵
  PID:7392
- C:\Windows\System\NHniZLo.exe
  C:\Windows\System\NHniZLo.exe
  2⤵
  PID:7456
- C:\Windows\System\zDCbhxE.exe
  C:\Windows\System\zDCbhxE.exe
  2⤵
  PID:7496
- C:\Windows\System\tBnTfBL.exe
  C:\Windows\System\tBnTfBL.exe
  2⤵
  PID:7408
- C:\Windows\System\dfLSFuI.exe
  C:\Windows\System\dfLSFuI.exe
  2⤵
  PID:7472
- C:\Windows\System\FdhkqEH.exe
  C:\Windows\System\FdhkqEH.exe
  2⤵
  PID:7548
- C:\Windows\System\IdiWXmZ.exe
  C:\Windows\System\IdiWXmZ.exe
  2⤵
  PID:7692
- C:\Windows\System\NrqVqro.exe
  C:\Windows\System\NrqVqro.exe
  2⤵
  PID:7644
- C:\Windows\System\qBRvLbE.exe
  C:\Windows\System\qBRvLbE.exe
  2⤵
  PID:7580
- C:\Windows\System\UbQyUQI.exe
  C:\Windows\System\UbQyUQI.exe
  2⤵
  PID:7820
- C:\Windows\System\frvAvcj.exe
  C:\Windows\System\frvAvcj.exe
  2⤵
  PID:7884
- C:\Windows\System\emzQNFv.exe
  C:\Windows\System\emzQNFv.exe
  2⤵
  PID:7948
- C:\Windows\System\QUprvdQ.exe
  C:\Windows\System\QUprvdQ.exe
  2⤵
  PID:7672
- C:\Windows\System\MZzJOZO.exe
  C:\Windows\System\MZzJOZO.exe
  2⤵
  PID:7904
- C:\Windows\System\NWwYfrv.exe
  C:\Windows\System\NWwYfrv.exe
  2⤵
  PID:7804
- C:\Windows\System\VmlGSRq.exe
  C:\Windows\System\VmlGSRq.exe
  2⤵
  PID:7868
- C:\Windows\System\fZzroYK.exe
  C:\Windows\System\fZzroYK.exe
  2⤵
  PID:7964
- C:\Windows\System\JKORhUc.exe
  C:\Windows\System\JKORhUc.exe
  2⤵
  PID:8016
- C:\Windows\System\rziNhMu.exe
  C:\Windows\System\rziNhMu.exe
  2⤵
  PID:8080
- C:\Windows\System\JCOrinv.exe
  C:\Windows\System\JCOrinv.exe
  2⤵
  PID:8144
- C:\Windows\System\iErCCov.exe
  C:\Windows\System\iErCCov.exe
  2⤵
  PID:6368
- C:\Windows\System\Xokyyrf.exe
  C:\Windows\System\Xokyyrf.exe
  2⤵
  PID:7192
- C:\Windows\System\COzUTaa.exe
  C:\Windows\System\COzUTaa.exe
  2⤵
  PID:7244
- C:\Windows\System\PIzJPgQ.exe
  C:\Windows\System\PIzJPgQ.exe
  2⤵
  PID:8028
- C:\Windows\System\YnXFjyC.exe
  C:\Windows\System\YnXFjyC.exe
  2⤵
  PID:8096
- C:\Windows\System\aOQQUOZ.exe
  C:\Windows\System\aOQQUOZ.exe
  2⤵
  PID:8160
- C:\Windows\System\fCjDNXX.exe
  C:\Windows\System\fCjDNXX.exe
  2⤵
  PID:6252
- C:\Windows\System\hdNeMnV.exe
  C:\Windows\System\hdNeMnV.exe
  2⤵
  PID:5516
- C:\Windows\System\LYETTHj.exe
  C:\Windows\System\LYETTHj.exe
  2⤵
  PID:1156
- C:\Windows\System\JEROVUB.exe
  C:\Windows\System\JEROVUB.exe
  2⤵
  PID:7508
- C:\Windows\System\mUQVtgx.exe
  C:\Windows\System\mUQVtgx.exe
  2⤵
  PID:7560
- C:\Windows\System\HnupjOe.exe
  C:\Windows\System\HnupjOe.exe
  2⤵
  PID:7624
- C:\Windows\System\JJfucPk.exe
  C:\Windows\System\JJfucPk.exe
  2⤵
  PID:7492
- C:\Windows\System\BgNqcsy.exe
  C:\Windows\System\BgNqcsy.exe
  2⤵
  PID:7440
- C:\Windows\System\DzdjRci.exe
  C:\Windows\System\DzdjRci.exe
  2⤵
  PID:7724
- C:\Windows\System\pCnrPGc.exe
  C:\Windows\System\pCnrPGc.exe
  2⤵
  PID:7792
- C:\Windows\System\wgNIpVo.exe
  C:\Windows\System\wgNIpVo.exe
  2⤵
  PID:7740
- C:\Windows\System\QVroOWS.exe
  C:\Windows\System\QVroOWS.exe
  2⤵
  PID:7760
- C:\Windows\System\EEHQNbT.exe
  C:\Windows\System\EEHQNbT.exe
  2⤵
  PID:7856
- C:\Windows\System\UlCwqaE.exe
  C:\Windows\System\UlCwqaE.exe
  2⤵
  PID:7984
- C:\Windows\System\yTCCiuT.exe
  C:\Windows\System\yTCCiuT.exe
  2⤵
  PID:6380
- C:\Windows\System\LXJRqqv.exe
  C:\Windows\System\LXJRqqv.exe
  2⤵
  PID:8128
- C:\Windows\System\qrVwIvQ.exe
  C:\Windows\System\qrVwIvQ.exe
  2⤵
  PID:7900
- C:\Windows\System\AnzxDjM.exe
  C:\Windows\System\AnzxDjM.exe
  2⤵
  PID:8176
- C:\Windows\System\HTroOEx.exe
  C:\Windows\System\HTroOEx.exe
  2⤵
  PID:7204
- C:\Windows\System\SdzKKQS.exe
  C:\Windows\System\SdzKKQS.exe
  2⤵
  PID:6688
- C:\Windows\System\RKCTbrk.exe
  C:\Windows\System\RKCTbrk.exe
  2⤵
  PID:7376
- C:\Windows\System\pqxgHZK.exe
  C:\Windows\System\pqxgHZK.exe
  2⤵
  PID:7364
- C:\Windows\System\sILZUsU.exe
  C:\Windows\System\sILZUsU.exe
  2⤵
  PID:7608
- C:\Windows\System\tmJQdje.exe
  C:\Windows\System\tmJQdje.exe
  2⤵
  PID:6960
- C:\Windows\System\OkPVJXl.exe
  C:\Windows\System\OkPVJXl.exe
  2⤵
  PID:8156
- C:\Windows\System\vhkwWXi.exe
  C:\Windows\System\vhkwWXi.exe
  2⤵
  PID:7380
- C:\Windows\System\sValKPo.exe
  C:\Windows\System\sValKPo.exe
  2⤵
  PID:7708
- C:\Windows\System\tGBNWAE.exe
  C:\Windows\System\tGBNWAE.exe
  2⤵
  PID:7920
- C:\Windows\System\mIbyzbq.exe
  C:\Windows\System\mIbyzbq.exe
  2⤵
  PID:8140
- C:\Windows\System\VcdPEmt.exe
  C:\Windows\System\VcdPEmt.exe
  2⤵
  PID:6332
- C:\Windows\System\aCJiRfz.exe
  C:\Windows\System\aCJiRfz.exe
  2⤵
  PID:7308
- C:\Windows\System\QeGhTlA.exe
  C:\Windows\System\QeGhTlA.exe
  2⤵
  PID:7772
- C:\Windows\System\UMAmXRX.exe
  C:\Windows\System\UMAmXRX.exe
  2⤵
  PID:7208
- C:\Windows\System\RFnqgQm.exe
  C:\Windows\System\RFnqgQm.exe
  2⤵
  PID:8196
- C:\Windows\System\MJmKqkX.exe
  C:\Windows\System\MJmKqkX.exe
  2⤵
  PID:8212
- C:\Windows\System\wrGaBLm.exe
  C:\Windows\System\wrGaBLm.exe
  2⤵
  PID:8228
- C:\Windows\System\hfPINhG.exe
  C:\Windows\System\hfPINhG.exe
  2⤵
  PID:8244
- C:\Windows\System\YkovGDI.exe
  C:\Windows\System\YkovGDI.exe
  2⤵
  PID:8260
- C:\Windows\System\KBmVExV.exe
  C:\Windows\System\KBmVExV.exe
  2⤵
  PID:8276
- C:\Windows\System\dTyGVzy.exe
  C:\Windows\System\dTyGVzy.exe
  2⤵
  PID:8292
- C:\Windows\System\xttHvls.exe
  C:\Windows\System\xttHvls.exe
  2⤵
  PID:8308
- C:\Windows\System\AJTthbb.exe
  C:\Windows\System\AJTthbb.exe
  2⤵
  PID:8328
- C:\Windows\System\IvEQoiY.exe
  C:\Windows\System\IvEQoiY.exe
  2⤵
  PID:8344
- C:\Windows\System\mTdPsPH.exe
  C:\Windows\System\mTdPsPH.exe
  2⤵
  PID:8360
- C:\Windows\System\UGzpgAe.exe
  C:\Windows\System\UGzpgAe.exe
  2⤵
  PID:8376
- C:\Windows\System\xCthuuE.exe
  C:\Windows\System\xCthuuE.exe
  2⤵
  PID:8392
- C:\Windows\System\wLdgaMB.exe
  C:\Windows\System\wLdgaMB.exe
  2⤵
  PID:8408
- C:\Windows\System\LJidczo.exe
  C:\Windows\System\LJidczo.exe
  2⤵
  PID:8424
- C:\Windows\System\wiqTYOT.exe
  C:\Windows\System\wiqTYOT.exe
  2⤵
  PID:8440
- C:\Windows\System\wKubxPS.exe
  C:\Windows\System\wKubxPS.exe
  2⤵
  PID:8456
- C:\Windows\System\BAQhUOg.exe
  C:\Windows\System\BAQhUOg.exe
  2⤵
  PID:8472
- C:\Windows\System\DdHVKjZ.exe
  C:\Windows\System\DdHVKjZ.exe
  2⤵
  PID:8488
- C:\Windows\System\omURUsm.exe
  C:\Windows\System\omURUsm.exe
  2⤵
  PID:8504
- C:\Windows\System\CMNoEvW.exe
  C:\Windows\System\CMNoEvW.exe
  2⤵
  PID:8520
- C:\Windows\System\nRpAYDr.exe
  C:\Windows\System\nRpAYDr.exe
  2⤵
  PID:8536
- C:\Windows\System\pMxjIDw.exe
  C:\Windows\System\pMxjIDw.exe
  2⤵
  PID:8552
- C:\Windows\System\BQUDYrk.exe
  C:\Windows\System\BQUDYrk.exe
  2⤵
  PID:8568
- C:\Windows\System\lYwyyMV.exe
  C:\Windows\System\lYwyyMV.exe
  2⤵
  PID:8584
- C:\Windows\System\pZMMryZ.exe
  C:\Windows\System\pZMMryZ.exe
  2⤵
  PID:8600
- C:\Windows\System\kVgJmXp.exe
  C:\Windows\System\kVgJmXp.exe
  2⤵
  PID:8620
- C:\Windows\System\NEDiJth.exe
  C:\Windows\System\NEDiJth.exe
  2⤵
  PID:8636
- C:\Windows\System\XRLrGGY.exe
  C:\Windows\System\XRLrGGY.exe
  2⤵
  PID:8652
- C:\Windows\System\sOxbeFA.exe
  C:\Windows\System\sOxbeFA.exe
  2⤵
  PID:8668
- C:\Windows\System\mzPVQJV.exe
  C:\Windows\System\mzPVQJV.exe
  2⤵
  PID:8684
- C:\Windows\System\XkfSxdS.exe
  C:\Windows\System\XkfSxdS.exe
  2⤵
  PID:8700
- C:\Windows\System\VptNPqT.exe
  C:\Windows\System\VptNPqT.exe
  2⤵
  PID:8716
- C:\Windows\System\epidxFY.exe
  C:\Windows\System\epidxFY.exe
  2⤵
  PID:8732
- C:\Windows\System\FBmPVvA.exe
  C:\Windows\System\FBmPVvA.exe
  2⤵
  PID:8756
- C:\Windows\System\BhECUoS.exe
  C:\Windows\System\BhECUoS.exe
  2⤵
  PID:8772
- C:\Windows\System\PGSIHBg.exe
  C:\Windows\System\PGSIHBg.exe
  2⤵
  PID:8792
- C:\Windows\System\TNmkDQR.exe
  C:\Windows\System\TNmkDQR.exe
  2⤵
  PID:8900
- C:\Windows\System\MrGLQTk.exe
  C:\Windows\System\MrGLQTk.exe
  2⤵
  PID:8916
- C:\Windows\System\aEQtgZz.exe
  C:\Windows\System\aEQtgZz.exe
  2⤵
  PID:8932
- C:\Windows\System\tgymFYw.exe
  C:\Windows\System\tgymFYw.exe
  2⤵
  PID:8948
- C:\Windows\System\MwMtfui.exe
  C:\Windows\System\MwMtfui.exe
  2⤵
  PID:9036
- C:\Windows\System\csmYKkV.exe
  C:\Windows\System\csmYKkV.exe
  2⤵
  PID:9052
- C:\Windows\System\XIYEKdQ.exe
  C:\Windows\System\XIYEKdQ.exe
  2⤵
  PID:9068
- C:\Windows\System\HXNVGlN.exe
  C:\Windows\System\HXNVGlN.exe
  2⤵
  PID:9084
- C:\Windows\System\daIsYVQ.exe
  C:\Windows\System\daIsYVQ.exe
  2⤵
  PID:9100
- C:\Windows\System\DezzoXl.exe
  C:\Windows\System\DezzoXl.exe
  2⤵
  PID:9120
- C:\Windows\System\JgTkxXr.exe
  C:\Windows\System\JgTkxXr.exe
  2⤵
  PID:9136
- C:\Windows\System\fqCaMWA.exe
  C:\Windows\System\fqCaMWA.exe
  2⤵
  PID:9152
- C:\Windows\System\OXBzshR.exe
  C:\Windows\System\OXBzshR.exe
  2⤵
  PID:9172
- C:\Windows\System\JFLUAvy.exe
  C:\Windows\System\JFLUAvy.exe
  2⤵
  PID:9188
- C:\Windows\System\dvQXiGq.exe
  C:\Windows\System\dvQXiGq.exe
  2⤵
  PID:9204
- C:\Windows\System\PsqZHUW.exe
  C:\Windows\System\PsqZHUW.exe
  2⤵
  PID:8092
- C:\Windows\System\NfRBIZb.exe
  C:\Windows\System\NfRBIZb.exe
  2⤵
  PID:8256
- C:\Windows\System\QqjkHqf.exe
  C:\Windows\System\QqjkHqf.exe
  2⤵
  PID:8320
- C:\Windows\System\cspGajR.exe
  C:\Windows\System\cspGajR.exe
  2⤵
  PID:8384
- C:\Windows\System\RMdkIHH.exe
  C:\Windows\System\RMdkIHH.exe
  2⤵
  PID:7428
- C:\Windows\System\QOFzxSk.exe
  C:\Windows\System\QOFzxSk.exe
  2⤵
  PID:7996
- C:\Windows\System\RardFuC.exe
  C:\Windows\System\RardFuC.exe
  2⤵
  PID:7852
- C:\Windows\System\jcutVKN.exe
  C:\Windows\System\jcutVKN.exe
  2⤵
  PID:8208
- C:\Windows\System\NUxvPwu.exe
  C:\Windows\System\NUxvPwu.exe
  2⤵
  PID:8272
- C:\Windows\System\bzelvxg.exe
  C:\Windows\System\bzelvxg.exe
  2⤵
  PID:8340
- C:\Windows\System\KJWWhiH.exe
  C:\Windows\System\KJWWhiH.exe
  2⤵
  PID:8432
- C:\Windows\System\sxqxiSJ.exe
  C:\Windows\System\sxqxiSJ.exe
  2⤵
  PID:8496
- C:\Windows\System\URXMdpW.exe
  C:\Windows\System\URXMdpW.exe
  2⤵
  PID:8484
- C:\Windows\System\mlDJVCN.exe
  C:\Windows\System\mlDJVCN.exe
  2⤵
  PID:8576
- C:\Windows\System\IorZmLm.exe
  C:\Windows\System\IorZmLm.exe
  2⤵
  PID:8644
- C:\Windows\System\tFpJjiq.exe
  C:\Windows\System\tFpJjiq.exe
  2⤵
  PID:8692
- C:\Windows\System\RAGpEku.exe
  C:\Windows\System\RAGpEku.exe
  2⤵
  PID:8740
- C:\Windows\System\cpZdkfY.exe
  C:\Windows\System\cpZdkfY.exe
  2⤵
  PID:8784
- C:\Windows\System\bAHlFWB.exe
  C:\Windows\System\bAHlFWB.exe
  2⤵
  PID:8560
- C:\Windows\System\gaKBbjH.exe
  C:\Windows\System\gaKBbjH.exe
  2⤵
  PID:8564
- C:\Windows\System\WJgcSIf.exe
  C:\Windows\System\WJgcSIf.exe
  2⤵
  PID:8696
- C:\Windows\System\hgAsYyM.exe
  C:\Windows\System\hgAsYyM.exe
  2⤵
  PID:8800
- C:\Windows\System\EUqAzUl.exe
  C:\Windows\System\EUqAzUl.exe
  2⤵
  PID:8808
- C:\Windows\System\DEvVliw.exe
  C:\Windows\System\DEvVliw.exe
  2⤵
  PID:8828
- C:\Windows\System\nLUcmIm.exe
  C:\Windows\System\nLUcmIm.exe
  2⤵
  PID:8844
- C:\Windows\System\hLqWPOd.exe
  C:\Windows\System\hLqWPOd.exe
  2⤵
  PID:8860
- C:\Windows\System\kVCeoud.exe
  C:\Windows\System\kVCeoud.exe
  2⤵
  PID:8876
- C:\Windows\System\hADXbEK.exe
  C:\Windows\System\hADXbEK.exe
  2⤵
  PID:8892
- C:\Windows\System\PJZKcXX.exe
  C:\Windows\System\PJZKcXX.exe
  2⤵
  PID:8940
- C:\Windows\System\zWJCKjN.exe
  C:\Windows\System\zWJCKjN.exe
  2⤵
  PID:8960
- C:\Windows\System\ndPCsnL.exe
  C:\Windows\System\ndPCsnL.exe
  2⤵
  PID:8980
- C:\Windows\System\dAjEKln.exe
  C:\Windows\System\dAjEKln.exe
  2⤵
  PID:8996
- C:\Windows\System\crgBFgs.exe
  C:\Windows\System\crgBFgs.exe
  2⤵
  PID:9012
- C:\Windows\System\QkDKdoI.exe
  C:\Windows\System\QkDKdoI.exe
  2⤵
  PID:9028
- C:\Windows\System\AYrjLBe.exe
  C:\Windows\System\AYrjLBe.exe
  2⤵
  PID:9048
- C:\Windows\System\OUDPagF.exe
  C:\Windows\System\OUDPagF.exe
  2⤵
  PID:9108
- C:\Windows\System\iiouHTG.exe
  C:\Windows\System\iiouHTG.exe
  2⤵
  PID:9092
- C:\Windows\System\qIIpEgs.exe
  C:\Windows\System\qIIpEgs.exe
  2⤵
  PID:9160
- C:\Windows\System\KrVkoHv.exe
  C:\Windows\System\KrVkoHv.exe
  2⤵
  PID:9128
- C:\Windows\System\KWWGbIY.exe
  C:\Windows\System\KWWGbIY.exe
  2⤵
  PID:9196
- C:\Windows\System\OgWzJDl.exe
  C:\Windows\System\OgWzJDl.exe
  2⤵
  PID:8288
- C:\Windows\System\vNovMiZ.exe
  C:\Windows\System\vNovMiZ.exe
  2⤵
  PID:8356
- C:\Windows\System\QXVKMvK.exe
  C:\Windows\System\QXVKMvK.exe
  2⤵
  PID:7528
- C:\Windows\System\ZiTFTwo.exe
  C:\Windows\System\ZiTFTwo.exe
  2⤵
  PID:8372
- C:\Windows\System\cZCtRLg.exe
  C:\Windows\System\cZCtRLg.exe
  2⤵
  PID:8512
- C:\Windows\System\XDOBoPe.exe
  C:\Windows\System\XDOBoPe.exe
  2⤵
  PID:8708
- C:\Windows\System\KSPczgV.exe
  C:\Windows\System\KSPczgV.exe
  2⤵
  PID:8452
- C:\Windows\System\qYfCoTx.exe
  C:\Windows\System\qYfCoTx.exe
  2⤵
  PID:8336
- C:\Windows\System\FexCPcw.exe
  C:\Windows\System\FexCPcw.exe
  2⤵
  PID:8480
- C:\Windows\System\BVFiIim.exe
  C:\Windows\System\BVFiIim.exe
  2⤵
  PID:8780
- C:\Windows\System\FujjUfD.exe
  C:\Windows\System\FujjUfD.exe
  2⤵
  PID:8812
- C:\Windows\System\dZlBeDM.exe
  C:\Windows\System\dZlBeDM.exe
  2⤵
  PID:8868
- C:\Windows\System\pBmcBvA.exe
  C:\Windows\System\pBmcBvA.exe
  2⤵
  PID:8660
- C:\Windows\System\fGKYcwi.exe
  C:\Windows\System\fGKYcwi.exe
  2⤵
  PID:8768
- C:\Windows\System\nrtddPo.exe
  C:\Windows\System\nrtddPo.exe
  2⤵
  PID:8856
- C:\Windows\System\UVcGTPv.exe
  C:\Windows\System\UVcGTPv.exe
  2⤵
  PID:8972
- C:\Windows\System\sqUpDzP.exe
  C:\Windows\System\sqUpDzP.exe
  2⤵
  PID:8988
- C:\Windows\System\xEwXMfb.exe
  C:\Windows\System\xEwXMfb.exe
  2⤵
  PID:9116
- C:\Windows\System\pTVsuPF.exe
  C:\Windows\System\pTVsuPF.exe
  2⤵
  PID:9076
- C:\Windows\System\IQmAshO.exe
  C:\Windows\System\IQmAshO.exe
  2⤵
  PID:9168
- C:\Windows\System\ZtKYEuD.exe
  C:\Windows\System\ZtKYEuD.exe
  2⤵
  PID:8420
- C:\Windows\System\ojCZVmf.exe
  C:\Windows\System\ojCZVmf.exe
  2⤵
  PID:8676
- C:\Windows\System\VtwnPrS.exe
  C:\Windows\System\VtwnPrS.exe
  2⤵
  PID:8632
- C:\Windows\System\ARFFahd.exe
  C:\Windows\System\ARFFahd.exe
  2⤵
  PID:8852
- C:\Windows\System\mkvWXym.exe
  C:\Windows\System\mkvWXym.exe
  2⤵
  PID:7296
- C:\Windows\System\KqAhfyV.exe
  C:\Windows\System\KqAhfyV.exe
  2⤵
  PID:8764
- C:\Windows\System\BphiGgq.exe
  C:\Windows\System\BphiGgq.exe
  2⤵
  PID:8836
- C:\Windows\System\dUdXgRY.exe
  C:\Windows\System\dUdXgRY.exe
  2⤵
  PID:9132
- C:\Windows\System\ToskREU.exe
  C:\Windows\System\ToskREU.exe
  2⤵
  PID:8240
- C:\Windows\System\WtvDIWm.exe
  C:\Windows\System\WtvDIWm.exe
  2⤵
  PID:9164
- C:\Windows\System\JxDQiis.exe
  C:\Windows\System\JxDQiis.exe
  2⤵
  PID:8752
- C:\Windows\System\fOVDfIR.exe
  C:\Windows\System\fOVDfIR.exe
  2⤵
  PID:9044
- C:\Windows\System\CeHUukX.exe
  C:\Windows\System\CeHUukX.exe
  2⤵
  PID:8976
- C:\Windows\System\tTAcgpZ.exe
  C:\Windows\System\tTAcgpZ.exe
  2⤵
  PID:7756
- C:\Windows\System\FFetDKX.exe
  C:\Windows\System\FFetDKX.exe
  2⤵
  PID:7512
- C:\Windows\System\jROZfwW.exe
  C:\Windows\System\jROZfwW.exe
  2⤵
  PID:9224
- C:\Windows\System\IBplMiV.exe
  C:\Windows\System\IBplMiV.exe
  2⤵
  PID:9244
- C:\Windows\System\ymffjIU.exe
  C:\Windows\System\ymffjIU.exe
  2⤵
  PID:9260
- C:\Windows\System\llGsJkl.exe
  C:\Windows\System\llGsJkl.exe
  2⤵
  PID:9276
- C:\Windows\System\rpqQonn.exe
  C:\Windows\System\rpqQonn.exe
  2⤵
  PID:9292
- C:\Windows\System\ghGyyxA.exe
  C:\Windows\System\ghGyyxA.exe
  2⤵
  PID:9308
- C:\Windows\System\mNSeuyW.exe
  C:\Windows\System\mNSeuyW.exe
  2⤵
  PID:9324
- C:\Windows\System\nOHHplA.exe
  C:\Windows\System\nOHHplA.exe
  2⤵
  PID:9340
- C:\Windows\System\LzTiZue.exe
  C:\Windows\System\LzTiZue.exe
  2⤵
  PID:9356
- C:\Windows\System\kNHrJim.exe
  C:\Windows\System\kNHrJim.exe
  2⤵
  PID:9372
- C:\Windows\System\ByMTPpy.exe
  C:\Windows\System\ByMTPpy.exe
  2⤵
  PID:9388
- C:\Windows\System\yFHpYOn.exe
  C:\Windows\System\yFHpYOn.exe
  2⤵
  PID:9404
- C:\Windows\System\LxuNivT.exe
  C:\Windows\System\LxuNivT.exe
  2⤵
  PID:9420
- C:\Windows\System\XJNJLSR.exe
  C:\Windows\System\XJNJLSR.exe
  2⤵
  PID:9436
- C:\Windows\System\LwFhyeM.exe
  C:\Windows\System\LwFhyeM.exe
  2⤵
  PID:9452
- C:\Windows\System\fjVTock.exe
  C:\Windows\System\fjVTock.exe
  2⤵
  PID:9472
- C:\Windows\System\aeRTBNY.exe
  C:\Windows\System\aeRTBNY.exe
  2⤵
  PID:9568
- C:\Windows\System\yTCKgUg.exe
  C:\Windows\System\yTCKgUg.exe
  2⤵
  PID:9584
- C:\Windows\System\kCaxjfz.exe
  C:\Windows\System\kCaxjfz.exe
  2⤵
  PID:9600
- C:\Windows\System\zxVEFQM.exe
  C:\Windows\System\zxVEFQM.exe
  2⤵
  PID:9616
- C:\Windows\System\BjSunGs.exe
  C:\Windows\System\BjSunGs.exe
  2⤵
  PID:9632
- C:\Windows\System\lUyYXUn.exe
  C:\Windows\System\lUyYXUn.exe
  2⤵
  PID:9648
- C:\Windows\System\xarVxPw.exe
  C:\Windows\System\xarVxPw.exe
  2⤵
  PID:9664
- C:\Windows\System\UNojmzx.exe
  C:\Windows\System\UNojmzx.exe
  2⤵
  PID:9680
- C:\Windows\System\YPQvVOJ.exe
  C:\Windows\System\YPQvVOJ.exe
  2⤵
  PID:9696
- C:\Windows\System\aXlKufh.exe
  C:\Windows\System\aXlKufh.exe
  2⤵
  PID:9712
- C:\Windows\System\hMQIGdQ.exe
  C:\Windows\System\hMQIGdQ.exe
  2⤵
  PID:9732
- C:\Windows\System\UzHBYGg.exe
  C:\Windows\System\UzHBYGg.exe
  2⤵
  PID:9748
- C:\Windows\System\pnchdTA.exe
  C:\Windows\System\pnchdTA.exe
  2⤵
  PID:9764
- C:\Windows\System\yJVqZAg.exe
  C:\Windows\System\yJVqZAg.exe
  2⤵
  PID:9780
- C:\Windows\System\DfRDLld.exe
  C:\Windows\System\DfRDLld.exe
  2⤵
  PID:9796
- C:\Windows\System\dgigoxp.exe
  C:\Windows\System\dgigoxp.exe
  2⤵
  PID:9812
- C:\Windows\System\SsNdXdM.exe
  C:\Windows\System\SsNdXdM.exe
  2⤵
  PID:9828
- C:\Windows\System\YAYxtuN.exe
  C:\Windows\System\YAYxtuN.exe
  2⤵
  PID:9844
- C:\Windows\System\aDZkrIq.exe
  C:\Windows\System\aDZkrIq.exe
  2⤵
  PID:9860
- C:\Windows\System\OuaRbnG.exe
  C:\Windows\System\OuaRbnG.exe
  2⤵
  PID:9880
- C:\Windows\System\ZMZNPJp.exe
  C:\Windows\System\ZMZNPJp.exe
  2⤵
  PID:9896
- C:\Windows\System\ZlDmbqh.exe
  C:\Windows\System\ZlDmbqh.exe
  2⤵
  PID:9912
- C:\Windows\System\rcmpjiB.exe
  C:\Windows\System\rcmpjiB.exe
  2⤵
  PID:9928
- C:\Windows\System\gIjqIpc.exe
  C:\Windows\System\gIjqIpc.exe
  2⤵
  PID:9944
- C:\Windows\System\smrxRTA.exe
  C:\Windows\System\smrxRTA.exe
  2⤵
  PID:9960
- C:\Windows\System\ujbYLQW.exe
  C:\Windows\System\ujbYLQW.exe
  2⤵
  PID:9976
- C:\Windows\System\sBvmtlG.exe
  C:\Windows\System\sBvmtlG.exe
  2⤵
  PID:9992
- C:\Windows\System\XGtLpkJ.exe
  C:\Windows\System\XGtLpkJ.exe
  2⤵
  PID:10008
- C:\Windows\System\AAbepsX.exe
  C:\Windows\System\AAbepsX.exe
  2⤵
  PID:10024
- C:\Windows\System\XfZwjgn.exe
  C:\Windows\System\XfZwjgn.exe
  2⤵
  PID:10040
- C:\Windows\System\gutWeCi.exe
  C:\Windows\System\gutWeCi.exe
  2⤵
  PID:10056
- C:\Windows\System\BdmnpjG.exe
  C:\Windows\System\BdmnpjG.exe
  2⤵
  PID:10072
- C:\Windows\System\HQapIYH.exe
  C:\Windows\System\HQapIYH.exe
  2⤵
  PID:10088
- C:\Windows\System\cjEqFox.exe
  C:\Windows\System\cjEqFox.exe
  2⤵
  PID:10104
- C:\Windows\System\PuWybKu.exe
  C:\Windows\System\PuWybKu.exe
  2⤵
  PID:10120
- C:\Windows\System\MASTVhF.exe
  C:\Windows\System\MASTVhF.exe
  2⤵
  PID:10136
- C:\Windows\System\EpBbVnt.exe
  C:\Windows\System\EpBbVnt.exe
  2⤵
  PID:10152
- C:\Windows\System\AqPsDdj.exe
  C:\Windows\System\AqPsDdj.exe
  2⤵
  PID:10168
- C:\Windows\System\XVgmPib.exe
  C:\Windows\System\XVgmPib.exe
  2⤵
  PID:10184
- C:\Windows\System\lUZWVFB.exe
  C:\Windows\System\lUZWVFB.exe
  2⤵
  PID:10200
- C:\Windows\System\XfmJlEp.exe
  C:\Windows\System\XfmJlEp.exe
  2⤵
  PID:10216
- C:\Windows\System\ufDwPTT.exe
  C:\Windows\System\ufDwPTT.exe
  2⤵
  PID:10232
- C:\Windows\System\GiAxgVQ.exe
  C:\Windows\System\GiAxgVQ.exe
  2⤵
  PID:9236
- C:\Windows\System\QbwBJrU.exe
  C:\Windows\System\QbwBJrU.exe
  2⤵
  PID:9144
- C:\Windows\System\tdboqLK.exe
  C:\Windows\System\tdboqLK.exe
  2⤵
  PID:8064
- C:\Windows\System\qaZJNxC.exe
  C:\Windows\System\qaZJNxC.exe
  2⤵
  PID:8924
- C:\Windows\System\vgbZOCk.exe
  C:\Windows\System\vgbZOCk.exe
  2⤵
  PID:9252
- C:\Windows\System\nbhHBKo.exe
  C:\Windows\System\nbhHBKo.exe
  2⤵
  PID:9300
- C:\Windows\System\SROhbzj.exe
  C:\Windows\System\SROhbzj.exe
  2⤵
  PID:9284
- C:\Windows\System\kgbIpmn.exe
  C:\Windows\System\kgbIpmn.exe
  2⤵
  PID:9400
- C:\Windows\System\cEaHqhg.exe
  C:\Windows\System\cEaHqhg.exe
  2⤵
  PID:9464
- C:\Windows\System\yBhQSAM.exe
  C:\Windows\System\yBhQSAM.exe
  2⤵
  PID:9316
- C:\Windows\System\PqWmaDC.exe
  C:\Windows\System\PqWmaDC.exe
  2⤵
  PID:9352
- C:\Windows\System\BgiNQtM.exe
  C:\Windows\System\BgiNQtM.exe
  2⤵
  PID:9448
- C:\Windows\System\AsLjqfP.exe
  C:\Windows\System\AsLjqfP.exe
  2⤵
  PID:8968
- C:\Windows\System\JvLzdXF.exe
  C:\Windows\System\JvLzdXF.exe
  2⤵
  PID:9500
- C:\Windows\System\aPVVdOL.exe
  C:\Windows\System\aPVVdOL.exe
  2⤵
  PID:9520
- C:\Windows\System\nXqHORQ.exe
  C:\Windows\System\nXqHORQ.exe
  2⤵
  PID:9536
- C:\Windows\System\XHbYzAh.exe
  C:\Windows\System\XHbYzAh.exe
  2⤵
  PID:9552
- C:\Windows\System\QSSiAGw.exe
  C:\Windows\System\QSSiAGw.exe
  2⤵
  PID:9576
- C:\Windows\System\WKhLsxH.exe
  C:\Windows\System\WKhLsxH.exe
  2⤵
  PID:9596
- C:\Windows\System\FNOCDLt.exe
  C:\Windows\System\FNOCDLt.exe
  2⤵
  PID:9672
- C:\Windows\System\xkEBMAK.exe
  C:\Windows\System\xkEBMAK.exe
  2⤵
  PID:9708
- C:\Windows\System\EuIVoKj.exe
  C:\Windows\System\EuIVoKj.exe
  2⤵
  PID:9692
- C:\Windows\System\kgPRFHp.exe
  C:\Windows\System\kgPRFHp.exe
  2⤵
  PID:9740
- C:\Windows\System\QBkzrTb.exe
  C:\Windows\System\QBkzrTb.exe
  2⤵
  PID:9804
- C:\Windows\System\DryTVva.exe
  C:\Windows\System\DryTVva.exe
  2⤵
  PID:9840
- C:\Windows\System\icwGjCU.exe
  C:\Windows\System\icwGjCU.exe
  2⤵
  PID:9792
- C:\Windows\System\qbDLRab.exe
  C:\Windows\System\qbDLRab.exe
  2⤵
  PID:9904
- C:\Windows\System\YaQmGgL.exe
  C:\Windows\System\YaQmGgL.exe
  2⤵
  PID:9888
- C:\Windows\System\Gtwwbjm.exe
  C:\Windows\System\Gtwwbjm.exe
  2⤵
  PID:9920
- C:\Windows\System\vIUgJMW.exe
  C:\Windows\System\vIUgJMW.exe
  2⤵
  PID:9972
- C:\Windows\System\azBrzSo.exe
  C:\Windows\System\azBrzSo.exe
  2⤵
  PID:10036

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\HXgXHsM.exe

Filesize
1.8MB

MD5
6605a0e4f06df7a1d6bd63ba5e161eb3

SHA1
d8415037ce025a99b1f95b2a908daf34bd63c3df

SHA256
d4811e253bb439cc21322e5e280c37698d87184752b1940e5b9b27434910eba2

SHA512
e6262eea423cb90da273ed782d8c0f015c49b02335e2d8896c87075dc8e1cfa4c54f84b6cd5c7d60226664a414b22572b8aa56e6c2ac4b1af872cce40b6d7a98

Download Submit
C:\Windows\system\MiHnpxE.exe

Filesize
1.8MB

MD5
cbaa6ad6903d0e3faacafbef22d13b1b

SHA1
d34556031e5385f6304ebef846b95146a03a7af4

SHA256
178e6c82c358fabe5c9811cce5c969f81d5e2a6ebf67657362f443ddc2288c59

SHA512
ae4622f4b26ee7d4d2e012a3dc882ca1d545b0be4797a154b1de4bd2dbfb7e99dd9f93b36321f077706e58365ebfeed66f643bed0f9c049639af22935724d433

Download Submit
C:\Windows\system\OpJmweN.exe

Filesize
1.8MB

MD5
8dca222ffcb404f35c44d8693cf26084

SHA1
bc46c5ebcfc726079ea2be756679b71e0967b5f4

SHA256
d8ccc319e804c951469683342b84d0993d5dfb192bfba2f5e0ef8a5cfa8faa2b

SHA512
1437413e4bf0aee5eaa8bce1eb51affdd97420a3d5690ff9a684d275351af0d55e2340733de783d0e2762f06204ef116376fe29230d1cb435aa0d7d84442cf85

Download Submit
C:\Windows\system\SrVDuNk.exe

Filesize
1.8MB

MD5
1cad77d5ca69c80ff4402ab81a8a7bb8

SHA1
122b1e48d724b71b4e06154bff7afc82413354bb

SHA256
284ea1df80691206920d3f65ee1743fba098ec77b3529cd0500fba04002bd6ba

SHA512
d69bb05dd2f1d2a17262a54af615785e841432eebcdcc47c6492c71cff3000ffe05a7c8fe46ca0742c347eb1e8c47d17a103b7328c4ca065ba6b3ce68c2f10ef

Download Submit
C:\Windows\system\TimLYot.exe

Filesize
1.8MB

MD5
b2dcc9f66b336a894cf820492aab6ef1

SHA1
7379d753d977854a34c3c475313ae6e7d431c936

SHA256
0c5c2fc1e3e41ab1e96411a970c5fef6620299aeb3331462cfb3b4b8fa2ef72f

SHA512
b387e3490670186039d8055fa983e11913f17b228231c233124fb8edb7a640e2ddb824fa6263a4cda18cc5517ceea67b994867a2654881254e97d3d1bf99b05e

Download Submit
C:\Windows\system\WOumtqF.exe

Filesize
1.8MB

MD5
2f1c9ab3453e64bcd17a291d0e11871e

SHA1
1535fd115ef19994f48bcd8be56b967bab64c192

SHA256
3e0848c466c56772efc90c904c7dfe314b3ae4a27c86872c1ebc463ba98a97d2

SHA512
a3a1762723e35883320b5051b6f761ca52e33cac45053d0170933aec04464cdd5ef2b9c59e60153bd42e275ff69ba97f37a819d18c7762b9694e29158ce57fbf

Download Submit
C:\Windows\system\YENoSXs.exe

Filesize
1.8MB

MD5
8c1cf0a0f51a349c42eae7db2ddd982f

SHA1
b4dd1bb411bc521c564b62988d259afedb8b8251

SHA256
a2104afb13d42220b5cdea712feabf83cd6010a1a925d6932f66ad16b704c9f0

SHA512
00339c3ab25e4e0c6330a1f6e3acc3e568fc3f47c24bf0fccd7b0abc34632e9d85693a1e1a4ed3963d8789a209373c1743b0b9a56690d2334d92ecff74361788

Download Submit
C:\Windows\system\cGilkFM.exe

Filesize
1.8MB

MD5
2514a1fb48b23d4d087847f9d3f2e5be

SHA1
f9281a946128d410f4d35143db6c175f3ec80836

SHA256
a052eea69a045a2cf38ff9b169bc63111c421bf09399068fa75557c98c9d4be7

SHA512
6006f1d3f4f48779780fd6ceb888814abb18bc40f2da8b835e4956a1b357caa5f52bbcc0413710acdd6aee969723c0d36b93f9539f33a1a65e5ff8af29f6f21e

Download Submit
C:\Windows\system\dzcgqbp.exe

Filesize
1.8MB

MD5
8efae8c12f0c5f0b91e41905ebaae483

SHA1
608c2cfe5e50da209cad7899e3cc1d55c6cc07c8

SHA256
d22d2eac99584c5e85ea498fdade08dcb37c9915d8911da4bf5d59ba7aa0a700

SHA512
16e50ee05b5d17e6bb8fc367c75b6e4bd3e7db79e8b1afad55e189370a2c8c597f28505cb5a3228669d58bc9a2755f041d90c5558ebbd39846de0d87fdc55899

Download Submit
C:\Windows\system\exgUdMl.exe

Filesize
1.8MB

MD5
52944cb2e3e6cf777e6b1df67f5f2a13

SHA1
aa3319bbbf82ce59f02880ae633b4c07ada1f2cf

SHA256
b7e1e618222175f52d72b7a8b048a1d5d0b8ce70923ae90ecdabcfbd78a14669

SHA512
c41a5b24f1c5fb7bdb59de1ca04e84ce1493eb800e6d65f0386f1b8b3fe926a44a34e3ec65a20210d70bdc66d9b06eda513123c75cc8b6b90c9d1a81dd6b142d

Download Submit
C:\Windows\system\ktvVYBe.exe

Filesize
1.8MB

MD5
7fdca071b168b8a40e54b2764ee3d9dc

SHA1
0e301c69ebf386fd326cf19c1818b38ca525312d

SHA256
506bc9fda5ff1a16dccf1e4abedb45193020559583ffd44e225f498508c0482b

SHA512
967c852f98db03cb9d3c5c118cb9dbae37b446bf9726f18d763ca4f47608c368b97577990fc2304d691913b6dd7ea4cea7b7035110d324e171f57ca1aa5b27c4

Download Submit
C:\Windows\system\ldzebOk.exe

Filesize
1.8MB

MD5
12d3401962bc281c80943c4a33de7a66

SHA1
e94dd47ab53a3f49c905de64c855fbd5b0d7d9fb

SHA256
dd6c00f437786f1e9f32bc8369bc33bf040b458558e6caa64dc4de8212bdc1e6

SHA512
e224c5d8c1753792424e4e70a3c360435b678c378174a2e1333ccb7962009685d88186b885a7d24c061c95928c6dd5347796191dc7479ea3f2856cf53ada38cf

Download Submit
C:\Windows\system\mLrDMKQ.exe

Filesize
1.8MB

MD5
cb4c83b1fc29fb4be6a9f676c2c57a35

SHA1
d7e3488c95689c6f1cc37a52ed07f472c7477ace

SHA256
e9f65ed7e509b755314994562bc200ba64dbf71f3b57dadbda7791f39411b794

SHA512
272c5eea525c3ffdf75f96e20c7c560c6e24d70049a47443797b43f5921c9d451b9800a44ade3570bd92f8358f8694ef940495ee3183d3859a6ba591c30b2e69

Download Submit
C:\Windows\system\nssumuB.exe

Filesize
1.8MB

MD5
41d63061291e99ae1412b4444b1ade43

SHA1
857ee4e8c1a755a86e0d891982f44ffc58b3db55

SHA256
d16b9ce0a751c9c77e0e4ee6e61bcdaa59d46ed78f5232698e498cc322bbd9d6

SHA512
a1c4b30e58434390e1c134dddb38bf797ff9a1db4bae77df790f4337b4b65ca154a06ff1eba5dd6fcb4f3330dfbf52dbaa975d300b423523f69f443022e50ffd

Download Submit
C:\Windows\system\pyDiOQa.exe

Filesize
1.8MB

MD5
f425a86e1ad4d35a14572d6858aaec5b

SHA1
6a80d3b80c5dc19b75b61ed8c888586f314e98b9

SHA256
a89a2be747209b75c3dc8d6806fa5db4d568e21b3b85e2db23808dd2241a7905

SHA512
0f1f4c5dfd5b322546004f15369d5c934bafe1df07bbc59494fcc4588887c1ff0fa611b26f871cf59ef2b8ccac62696f5fe769b9ed6d734de02845195bd2b18c

Download Submit
C:\Windows\system\qJIPLdn.exe

Filesize
1.8MB

MD5
50d600e164d5577d623a255e6e56e29a

SHA1
ec7ffdebd9b6178f961086ddb4a5e0cd37c9e4a4

SHA256
506a0a11c6c6b62ad7c7bd44c28fc205ca6ea0b31d77c1286df43f96c635b83d

SHA512
03779625fe0dc0fedfd76d0a1272a52129edc44b047f31de21e02ab2dd5b8f9b8771c34661036707f3a87a3f5bf23c89f169f55fcc6de7678367575a1f934cdf

Download Submit
C:\Windows\system\sGYYtRN.exe

Filesize
1.8MB

MD5
7af6c36dc7d5b10e198d0182aaa61f00

SHA1
2db76ddd66a394d9e3724bc5f0af1a27f3eeb957

SHA256
18d01818b7532007983445ef6a4b4c7f576ab22a1a4e0a3d19b59099f929aa48

SHA512
8ac8f145663ce362f054e39249f3c01ad2113bd9ce78aec538c42231031836a38922f5c62215e677f5d24b41ca97a7d7745c0a0e1b0e2c08273d9a3fada95822

Download Submit
C:\Windows\system\uqFgFMS.exe

Filesize
1.8MB

MD5
57bb3a0475578e09f490e3b74671e37a

SHA1
55b96e63af30f0088e6622a08f1c60ce63b20444

SHA256
64a963e3a81f9262337eadd8c8c18e33a949b4054b392e0bdd720aa46fade53b

SHA512
590c878f0eabd1f2e82d32ce3a87754711daa4f04477126bf95cf6cb50913fa3a2604951783e3ab428807af08cefe3e9e896c9e922770023b6e4b3a7fb679760

Download Submit
C:\Windows\system\uuZgPxf.exe

Filesize
1.8MB

MD5
ef7f0669ed6036c856999816c3486ff8

SHA1
e288f55e698dc1cbc5135c5003f3daf3af176d93

SHA256
b5ac0e2cc7b71ce452b04904e4830021402799cfa1d9c3c80a90a0ca9d1c6cb6

SHA512
6df51da9e22f58e2cefe517da6ad30decab5eff57a84978005ad0504f4ccfa2413612cf69b0c89a98c04ba19d239cb91082c9c60b6bb3d4030fb95a5751d3078

Download Submit
C:\Windows\system\yRGwFEO.exe

Filesize
1.8MB

MD5
e7833d084f11c581892168c21b50ff19

SHA1
96a6abafe50d1b3049c6bbdf1c0c19e8d7fbb2b5

SHA256
bb57f39c0161dab91c1d0a6f6b98698de003134be8fc2c5ff61d924e75757488

SHA512
8f22d0d7998b58c26b047fe7f51100da0aeafdbb7834afccab4cb7f3c29388d0fbd8224f5d551228746118aafd631f32ad2cb208fbe420ee549d3c1b6509e5d9

Download Submit
\Windows\system\GhUHZQR.exe

Filesize
1.8MB

MD5
6eb656b36a83760bc7de5aa6ee9c6a8b

SHA1
60a416cd538b1d8c3b0aa5b67d5a84eada42d8b1

SHA256
cb8f42565f437eece6c33d160bb9edf4427894a805fb16dbd544974c2dad5707

SHA512
17d9d9a5e331ca0ac23169ea53c5c8bc7b561316e2d9c629a498ad8f6073805a3e5eb035b57f6a7b8913bc59f0bde160ef540dd192bcadd3f6a92f43eaf7bcd4

Download Submit
\Windows\system\HpTZuwJ.exe

Filesize
1.8MB

MD5
1c53266ca135c8c2ad9ffbf8c148af72

SHA1
25433432277a34c085da3f54ba7350d69f3d1573

SHA256
8d2dc0d662d58358c6d113c72b2ca82c0a09ed24a9f72a3c9d45ab6ae8c877c4

SHA512
d1d1f92115813865920df50914951f856cf4826c55e7d02b3a98efddf4d569024f7ce4ed83b29207a28aa464795316ac522b7f1740877ad92aaac7e36462bd68

Download Submit
\Windows\system\KMHGxVP.exe

Filesize
1.8MB

MD5
642a426fe719e3b040fab25cfd900ce8

SHA1
a37806df780ff2219f8443dcb9e4146c3fc6b2db

SHA256
7645efd5a75be9699d165c682d835694dc05f1770ddf99e3e42da9f802e16f65

SHA512
450fb76e268a9695eaade7b3df2d01acd0b8b9eb4d98079ce67a3e7f1c7290bd525fa0995c23a9777e881f7a07986eb2dc475d818373d51c38ca1033902b6e1b

Download Submit
\Windows\system\OGBFNPF.exe

Filesize
1.8MB

MD5
682b21f058e3b336c0da93ed6ed48dd1

SHA1
99fd6de6e51726025256bbb21c7f9b273c24da4e

SHA256
92c32ed9147caaa56861d08df513dee54472d6e4c76c1d4487c4f83bc4e67078

SHA512
d9ccd414aa13c9f4c7138e3306fb1a9ea216f3f9c85464fef75e529637c1480307f40eb41dbb63fecbb53181bd8d24241e18f2e6f0a78519d0deb450ec84b22d

Download Submit
\Windows\system\OckVROv.exe

Filesize
1.8MB

MD5
d62b80513f1d76b6be8fcca0e0d9f075

SHA1
6e5a8bb54ece8f8f4240006df3c1154bc49ae959

SHA256
db12c8d011a27841781724368174ee349d0e6a9986722a68d654259f4489c626

SHA512
9ef93544cc349b0d120a6cc459f674a9bc34293d10b5839ec6c448d363b8abf11e7787461be8c9f345562a8df9f1e469620cef2a1c545687184edc9e7641d5fe

Download Submit
\Windows\system\QRWchgj.exe

Filesize
1.8MB

MD5
4fcd92e3306c2e03bcfc5a0902f36607

SHA1
98fcd074a1a3a52a4dc220e283689c0af2b7d620

SHA256
5b62159528fbc6869e8d56f807b92c0ab033ac122a9d515580462e0b0b75c27d

SHA512
dcd7d118e8e6d1204151b7152efd33e1bc3c52dbdc6f8379daedd9787ac41c67d57fd850792faaa09b77761787867b8f96d3e39f8dab8f3cbbfcc410007b0236

Download Submit
\Windows\system\UhXGMhf.exe

Filesize
1.8MB

MD5
f4ce13828445ac48d0efdf1941ae011f

SHA1
32e49654118356f685608d2c842371afdfd32937

SHA256
6a091366a635de43f5fe903f7b31ab742bc91115fa1b86aa1c0eecaf16df6c14

SHA512
07ee00678ceacedd066576eee185c173fdf81db80e930c1e8c796f3b0e8d6d161ee20be0f37d3f930ac8734e4678065733825a366c627927153c9998f5142ea4

Download Submit
\Windows\system\VwWokWW.exe

Filesize
1.8MB

MD5
887d5f537f1ccf1351f1ae82a5351f4b

SHA1
434c764fd884c4ef2a75dd8922225614bfdd5aae

SHA256
cd4e8ec385997f21553707feaaceae42ee4a7e674f18d9ee9aa9f4ee816bc4e5

SHA512
c9a674924bcffa8f00ae1553a82df1e3711866b06469d0f3f7f45be3a4990a233a76e829603e3c189e497cfaf772f1bf01497a238914ebff4ff27b8b6e82cb8f

Download Submit
\Windows\system\ZPOshoB.exe

Filesize
1.8MB

MD5
9ce2f428ab35a04ccde0097a71257def

SHA1
b1172f45820a435eda7beb7f5918280ce333648e

SHA256
1ae51a4987ba12032e53f893df78070a6982361bd746e6b6bfbd5ab0542658c5

SHA512
2899e07fbd77e09a024568038d36219d4b00e002340c5d143ff4a61abf73295ae423d50987ff95a5d9aa7a7d2015ac90e341969d21dca171142d00175762fba4

Download Submit
\Windows\system\ZwBEXed.exe

Filesize
1.8MB

MD5
b27f7a5665fa4966813c3788b1540e2e

SHA1
6d72c5fa738e25ae679e36cb5596b75a1578445b

SHA256
feba4447255d89c14838e51aa9114bb2f28c23d7d29bb59bde20a9eaa1feb556

SHA512
ed2fecf4cbd92c3e6c7086daae176d23f98b0bdf716f8c7751c3462de2addae05e94154ae41ca1c454f682593e28ce069c8953cc9a15aea0a3701b9b718663db

Download Submit
\Windows\system\bmwHDnh.exe

Filesize
1.8MB

MD5
ed9c704d5404907f8493a219114b03c8

SHA1
25a30bb53bb989231085696038c1f63e063df57e

SHA256
409746b2d6d77bff8d96b0019ba3982516dbaf2cf00b26f0a087bf15d5da2539

SHA512
b6da24fe0eb84a3410e6b770e0fc7d2c25ee99069172d188e80f34c4fa2b302123c3a3790c9dc67db7ea34db2b44d5f5b90ace2425209b4379e616aa2c0b1fee

Download Submit
\Windows\system\fRTgxJS.exe

Filesize
1.8MB

MD5
b6416bc00c87d98db90af0a483818b9e

SHA1
b211fb7512195762de4af2357815d54a62714382

SHA256
7a83c32a502eb6efdd77fdb7f98a89ab4dbe7809792633e74f22fa50eaa6af8d

SHA512
66d7b5c410ecd88236b3f33b8e6f6d6b618467430c0883191498b64a7e3ae9257b936f224dee9503bdc4d7301bfa54bfb53dcb365654c004c9bce6455d6e05f5

Download Submit
\Windows\system\gkOBkRP.exe

Filesize
1.8MB

MD5
d98b37b23d43b7763aefd58bee5aad19

SHA1
0144b7afbcbf9805d69ec9a11d7361ada530122f

SHA256
fb35cffb81d300088063c8d0eb62f38dc590a38791820429194722666fbd3048

SHA512
e780a3366ac90523ebfb427f07588a28856adb4ba3adadcfe6ee695116c226869028cd04340e17d60b7b8805b7a23174fe067de403c9310b8575b37a38acd0b7

Download Submit
\Windows\system\iTDkBud.exe

Filesize
1.8MB

MD5
d35a6e0085328bf06fd32c01fdf8654f

SHA1
4fb305a9d262d76218c588452acbfdcfa9d606af

SHA256
51fdf1b9c1c7f68da91b7d555318d2e9407e0084f204e6e98ceffd3b597323c6

SHA512
937a64e140c2d64c26706c45bf9ec78c389e25d2b4a26ca9c9a059898209f4382cca044ba284b29123435ececf379e3cb97219f68ecb7f1e6d96c52bf05bbb54

Download Submit
\Windows\system\ifnZaZs.exe

Filesize
1.8MB

MD5
f7a9ab117620b7ac9cdaf8b55b041773

SHA1
cae0f50afe1f0db7067021b9b4f8086f79fdcb24

SHA256
9efc315d3e7bf69266c72b7b3992ec56303e12f0b9c25f13aba7cee5f36e57eb

SHA512
a116d3ec4858c02491711f245a18eaf32eb76e80d73df4f1f0c00b8e55d413890798dcf0a8ff5552ea2ab4340a30b654c46bd1952feb7cddc2fe9053cdaca470

Download Submit
\Windows\system\jkyBezK.exe

Filesize
1.8MB

MD5
6dda72b5e63c764c4a52b57dbd3c2c12

SHA1
8781ddcbb6a28c57714b1288269b7f60e242f87a

SHA256
bbe94c790646214a34b7bcc61e0c1d06870c7480004b08f3128cff46a22bf319

SHA512
a9b528d0dd24d6f2cb42c52b4a96adfa98500990b3e1e2855db1387b7607a37eb0ca6a3a4155d49d55523f55e37266d5bf592500958dc87df81e2dc830d88dd6

Download Submit
\Windows\system\keWdkAp.exe

Filesize
1.8MB

MD5
56310d535a229ab955030719fd4022b8

SHA1
803fc3f192bbe6a9e8e08f97d85111701cb5e7dc

SHA256
54a741a7a76af7d64b744018a71efbc2a31ba8689dd638ac5a91c103622ec430

SHA512
517d74e875e4205d2e232bb74919105511ebe021451695bd199de8ae6503a9a647f58d18c2cf40e7ce930da15797de9c7c50330e7062ef3eea1cc0a88afb447e

Download Submit
\Windows\system\laDKZVx.exe

Filesize
1.8MB

MD5
c4a6db910d33ef74494a82bf1a1ac374

SHA1
dca295bc3d2f3c05505c034225d87280a10e113a

SHA256
039c9726cf7644c49a9b0bb74401ecc9bc1dec0a41156413e4053b0d427ec714

SHA512
c73a9732e0838b23890924a77c6381d1976d6de67cc416b80289b88685c790f37f942ac4db64792835d23f24a174235cb661a4d781fd49a9a05b5953ebe338aa

Download Submit
\Windows\system\tblWafJ.exe

Filesize
1.8MB

MD5
cc57bab31a4a0e6c7d83050ad6014bf6

SHA1
713492e8b50760e3e105620d491b1451d5dd2bc5

SHA256
9485019308be4489397d5546e426a62d723c1ed99495b518636d56318c806d9a

SHA512
e440d56e92479d1d03ee10a20b1bbdd32c073d07b3af6ea7426cadc13b5d1a72c8209da7ff45340a1f455fb2c5638a42315691d716b1c019ec120d753c0375cd

Download Submit
\Windows\system\uABZUFm.exe

Filesize
1.8MB

MD5
345a7df0bcc9b94f73b69f182b1db52e

SHA1
576b755e2b3d191f44a42ea680b787cea45b7cc8

SHA256
f811dd4ee7e96d2b5d32d88a43bce1c0e15f97334f3adfb2b499bbcdf2b105b6

SHA512
f02c1dd378318e9c9043d7b729f54c980b47f29b1584bcd0f00d2d00b5b7d9ed323377dbeed1df314178d43d433fa3c5e9b93fc800a2ea54ce39329bf428804a

Download Submit
\Windows\system\xKoZlGA.exe

Filesize
1.8MB

MD5
1948d5a33b8ec18628e16d9c42365ed6

SHA1
348e091b9810d1a8cae4d7ff120ee1c989c3c80e

SHA256
ccaa3503514cc435bd96d93baed858624478d13bd9c03242443662ecdc8cf89f

SHA512
41457fa4e801dee93d20f8825d968041eec1962904c105aadd59caebb8fe36a3bd455842f949499912dac2f578624644d618f5361887d0d5cd3e9e68fd0dee4e

Download Submit
\Windows\system\xtXltMC.exe

Filesize
1.8MB

MD5
72cb0ba59c49007aa6ecf25585a64f47

SHA1
bd991d4bec787c6e3b2dbc89662d7c720d59bf55

SHA256
b65589c36400b0f81d097b4e6a889992bb11c8cedcb50b0f20fa08b543144839

SHA512
19f2cc51fb9c90eb2eaad67c2bfad01600ec0693bfb4b5226039cca2583a1d33a69fa6e0b6dcc446e88e7907af130b1c1ff26a8d6a9eec4da0d7ced86ac5d2c8

Download Submit
\Windows\system\yAvwadI.exe

Filesize
1.8MB

MD5
e07fd44b2d8bd8cce1a3cc0683a4a166

SHA1
38cd16acb87baef47579ef0fdef3986515318952

SHA256
699f7eef15d24a49625108ae2d2fd2621b75c2ce7c8e24c381aa6ba25763a960

SHA512
c163d38a4c67931e06b107e54c75e583f4ddf9c4219492b892ba327bc443a655a6da3f3919edbf44d409976ba7f174429af229f433d8aa244d93749ed040de51

Download Submit
memory/860-8-0x000000013FDE0000-0x00000001401D2000-memory.dmp

Filesize
3.9MB

Download
memory/860-6299-0x000000013FDE0000-0x00000001401D2000-memory.dmp

Filesize
3.9MB

Download
memory/1152-177-0x000000001B6A0000-0x000000001B982000-memory.dmp

Filesize
2.9MB

Download
memory/1152-183-0x0000000002150000-0x0000000002158000-memory.dmp

Filesize
32KB

Download
memory/1848-201-0x000000013FD10000-0x0000000140102000-memory.dmp

Filesize
3.9MB

Download
memory/1848-200-0x0000000002FF0000-0x00000000033E2000-memory.dmp

Filesize
3.9MB

Download
memory/1848-82-0x0000000002FF0000-0x00000000033E2000-memory.dmp

Filesize
3.9MB

Download
memory/1848-14464-0x000000013F350000-0x000000013F742000-memory.dmp

Filesize
3.9MB

Download
memory/1848-182-0x0000000002FF0000-0x00000000033E2000-memory.dmp

Filesize
3.9MB

Download
memory/1848-0-0x00000000000F0000-0x0000000000100000-memory.dmp

Filesize
64KB

Download
memory/1848-7-0x000000013FDE0000-0x00000001401D2000-memory.dmp

Filesize
3.9MB

Download
memory/1848-1-0x000000013F350000-0x000000013F742000-memory.dmp

Filesize
3.9MB

Download
memory/1848-204-0x000000013FF60000-0x0000000140352000-memory.dmp

Filesize
3.9MB

Download
memory/1848-205-0x000000013FF10000-0x0000000140302000-memory.dmp

Filesize
3.9MB

Download
memory/1848-203-0x000000013F7F0000-0x000000013FBE2000-memory.dmp

Filesize
3.9MB

Download
memory/1848-206-0x000000013FAD0000-0x000000013FEC2000-memory.dmp

Filesize
3.9MB

Download
memory/1848-186-0x0000000002FF0000-0x00000000033E2000-memory.dmp

Filesize
3.9MB

Download
memory/1848-175-0x0000000002FF0000-0x00000000033E2000-memory.dmp

Filesize
3.9MB

Download
memory/1848-103-0x0000000002FF0000-0x00000000033E2000-memory.dmp

Filesize
3.9MB

Download
memory/2580-196-0x000000013F7F0000-0x000000013FBE2000-memory.dmp

Filesize
3.9MB

Download
memory/2580-6738-0x000000013F7F0000-0x000000013FBE2000-memory.dmp

Filesize
3.9MB

Download
memory/2628-6740-0x000000013F540000-0x000000013F932000-memory.dmp

Filesize
3.9MB

Download
memory/2628-197-0x000000013F540000-0x000000013F932000-memory.dmp

Filesize
3.9MB

Download
memory/2672-198-0x000000013FA80000-0x000000013FE72000-memory.dmp

Filesize
3.9MB

Download
memory/2672-6742-0x000000013FA80000-0x000000013FE72000-memory.dmp

Filesize
3.9MB

Download
memory/2748-199-0x000000013FF60000-0x0000000140352000-memory.dmp

Filesize
3.9MB

Download
memory/2748-6741-0x000000013FF60000-0x0000000140352000-memory.dmp

Filesize
3.9MB

Download
memory/2768-6300-0x000000013F910000-0x000000013FD02000-memory.dmp

Filesize
3.9MB

Download
memory/2768-39-0x000000013F910000-0x000000013FD02000-memory.dmp

Filesize
3.9MB

Download
memory/2908-6737-0x000000013F650000-0x000000013FA42000-memory.dmp

Filesize
3.9MB

Download
memory/2908-16-0x000000013F650000-0x000000013FA42000-memory.dmp

Filesize
3.9MB

Download
memory/3068-6332-0x000000013F480000-0x000000013F872000-memory.dmp

Filesize
3.9MB

Download
memory/3068-202-0x000000013F480000-0x000000013F872000-memory.dmp

Filesize
3.9MB

Download