xmrig | b8c4eafa4f1b9646a990bc1b932cec6b6c451a2f8579c4ecb33bb3d6402f8296

Analysis

max time kernel
150s
max time network
145s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
29/06/2024, 19:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

b8c4eafa4f1b9646a990bc1b932cec6b6c451a2f8579c4ecb33bb3d6402f8296_NeikiAnalytics.exe
Size

1.9MB
MD5

0c3c576fca07d5f329df74fd0e3569b0
SHA1

61bbd7e05c72aba7d8bcb7485ffef6c53788a63c
SHA256

b8c4eafa4f1b9646a990bc1b932cec6b6c451a2f8579c4ecb33bb3d6402f8296
SHA512

f63c90fdbd3941164012d6def721b7f4488962ce380b0e54ae35fa7fb1049f8adedcf9c9071a03e3a048f223b6c94ae128b238384a39063a8075819879b68dfa
SSDEEP

49152:Lz071uv4BPMkibTIA5lCx7kvRWa4pXx/4zYDCmH:NABd

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 10 IoCs

miner

resource	yara_rule
behavioral1/memory/2736-191-0x000000013F2A0000-0x000000013F692000-memory.dmp	xmrig
behavioral1/memory/2844-186-0x000000013FBB0000-0x000000013FFA2000-memory.dmp	xmrig
behavioral1/memory/2148-183-0x000000013FA60000-0x000000013FE52000-memory.dmp	xmrig
behavioral1/memory/2732-160-0x000000013F310000-0x000000013F702000-memory.dmp	xmrig
behavioral1/memory/2348-195-0x000000013F830000-0x000000013FC22000-memory.dmp	xmrig
behavioral1/memory/2348-4668-0x000000013F830000-0x000000013FC22000-memory.dmp	xmrig
behavioral1/memory/2736-4670-0x000000013F2A0000-0x000000013F692000-memory.dmp	xmrig
behavioral1/memory/2844-4672-0x000000013FBB0000-0x000000013FFA2000-memory.dmp	xmrig
behavioral1/memory/1600-5087-0x000000013FB60000-0x000000013FF52000-memory.dmp	xmrig
behavioral1/memory/2148-5089-0x000000013FA60000-0x000000013FE52000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
2448	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
1600	GDQUvcK.exe
2348	evoKUPw.exe
2732	StaYfsX.exe
2148	FEHuEhf.exe
2844	OmTCdfT.exe
2736	YXMevff.exe
2640	cItKRDM.exe
2132	yuyXosR.exe
2212	CZyAPky.exe
2528	klwnJrC.exe
3024	ngUrNGd.exe
3040	EEpJupX.exe
2588	pVBzQWQ.exe
2584	qvjhqJj.exe
2088	TIClZeZ.exe
2340	WeqMqiH.exe
2868	BjNrcHu.exe
2888	gBlbxxw.exe
3020	zVjEKDH.exe
1828	kOJrvJy.exe
1692	MgzEjnx.exe
2420	AUUxGnJ.exe
2792	noTDKCl.exe
1320	ewfBZnp.exe
1964	XqsRHDP.exe
2144	QctOvGm.exe
2864	BISFtNC.exe
1528	JwNVMsx.exe
1640	rhyMILj.exe
2036	JlakuNm.exe
1684	txZryHJ.exe
2184	HxFgZgP.exe
2800	qGuzazN.exe
2168	NAUhdbr.exe
1256	NKOqdlL.exe
2304	FWcHSpU.exe
2120	lgpLSQr.exe
1876	svSzMob.exe
1976	ZwQwTYl.exe
1656	HQPDSlA.exe
2008	FUHmIsF.exe
1160	ZRjcZTY.exe
3012	ewZWgoJ.exe
1524	gnnzEds.exe
2996	jhCYiwr.exe
2312	esmdckD.exe
1292	KMtMOnO.exe
1620	WTwdLPj.exe
1608	ZxdEHPF.exe
2752	SnTukpR.exe
2828	DcYrzQP.exe
3064	oLBQuiz.exe
2204	CYcupou.exe
2900	NXhQHWB.exe
2764	Opgtdwg.exe
2560	xvkUZmV.exe
2552	BXqGCkY.exe
1736	IaalhFE.exe
3016	WxOQNrV.exe
1996	hyvucrJ.exe
1824	yBvbPbz.exe
2012	wpUudbG.exe
2208	jvxNaHO.exe
1224	jJRMsiW.exe

Loads dropped DLL 64 IoCs

pid	Process
1752	b8c4eafa4f1b9646a990bc1b932cec6b6c451a2f8579c4ecb33bb3d6402f8296_NeikiAnalytics.exe
1752	b8c4eafa4f1b9646a990bc1b932cec6b6c451a2f8579c4ecb33bb3d6402f8296_NeikiAnalytics.exe
1752	b8c4eafa4f1b9646a990bc1b932cec6b6c451a2f8579c4ecb33bb3d6402f8296_NeikiAnalytics.exe
1752	b8c4eafa4f1b9646a990bc1b932cec6b6c451a2f8579c4ecb33bb3d6402f8296_NeikiAnalytics.exe
1752	b8c4eafa4f1b9646a990bc1b932cec6b6c451a2f8579c4ecb33bb3d6402f8296_NeikiAnalytics.exe
1752	b8c4eafa4f1b9646a990bc1b932cec6b6c451a2f8579c4ecb33bb3d6402f8296_NeikiAnalytics.exe
1752	b8c4eafa4f1b9646a990bc1b932cec6b6c451a2f8579c4ecb33bb3d6402f8296_NeikiAnalytics.exe
1752	b8c4eafa4f1b9646a990bc1b932cec6b6c451a2f8579c4ecb33bb3d6402f8296_NeikiAnalytics.exe
1752	b8c4eafa4f1b9646a990bc1b932cec6b6c451a2f8579c4ecb33bb3d6402f8296_NeikiAnalytics.exe
1752	b8c4eafa4f1b9646a990bc1b932cec6b6c451a2f8579c4ecb33bb3d6402f8296_NeikiAnalytics.exe
1752	b8c4eafa4f1b9646a990bc1b932cec6b6c451a2f8579c4ecb33bb3d6402f8296_NeikiAnalytics.exe
1752	b8c4eafa4f1b9646a990bc1b932cec6b6c451a2f8579c4ecb33bb3d6402f8296_NeikiAnalytics.exe
1752	b8c4eafa4f1b9646a990bc1b932cec6b6c451a2f8579c4ecb33bb3d6402f8296_NeikiAnalytics.exe
1752	b8c4eafa4f1b9646a990bc1b932cec6b6c451a2f8579c4ecb33bb3d6402f8296_NeikiAnalytics.exe
1752	b8c4eafa4f1b9646a990bc1b932cec6b6c451a2f8579c4ecb33bb3d6402f8296_NeikiAnalytics.exe
1752	b8c4eafa4f1b9646a990bc1b932cec6b6c451a2f8579c4ecb33bb3d6402f8296_NeikiAnalytics.exe
1752	b8c4eafa4f1b9646a990bc1b932cec6b6c451a2f8579c4ecb33bb3d6402f8296_NeikiAnalytics.exe
1752	b8c4eafa4f1b9646a990bc1b932cec6b6c451a2f8579c4ecb33bb3d6402f8296_NeikiAnalytics.exe
1752	b8c4eafa4f1b9646a990bc1b932cec6b6c451a2f8579c4ecb33bb3d6402f8296_NeikiAnalytics.exe
1752	b8c4eafa4f1b9646a990bc1b932cec6b6c451a2f8579c4ecb33bb3d6402f8296_NeikiAnalytics.exe
1752	b8c4eafa4f1b9646a990bc1b932cec6b6c451a2f8579c4ecb33bb3d6402f8296_NeikiAnalytics.exe
1752	b8c4eafa4f1b9646a990bc1b932cec6b6c451a2f8579c4ecb33bb3d6402f8296_NeikiAnalytics.exe
1752	b8c4eafa4f1b9646a990bc1b932cec6b6c451a2f8579c4ecb33bb3d6402f8296_NeikiAnalytics.exe
1752	b8c4eafa4f1b9646a990bc1b932cec6b6c451a2f8579c4ecb33bb3d6402f8296_NeikiAnalytics.exe
1752	b8c4eafa4f1b9646a990bc1b932cec6b6c451a2f8579c4ecb33bb3d6402f8296_NeikiAnalytics.exe
1752	b8c4eafa4f1b9646a990bc1b932cec6b6c451a2f8579c4ecb33bb3d6402f8296_NeikiAnalytics.exe
1752	b8c4eafa4f1b9646a990bc1b932cec6b6c451a2f8579c4ecb33bb3d6402f8296_NeikiAnalytics.exe
1752	b8c4eafa4f1b9646a990bc1b932cec6b6c451a2f8579c4ecb33bb3d6402f8296_NeikiAnalytics.exe
1752	b8c4eafa4f1b9646a990bc1b932cec6b6c451a2f8579c4ecb33bb3d6402f8296_NeikiAnalytics.exe
1752	b8c4eafa4f1b9646a990bc1b932cec6b6c451a2f8579c4ecb33bb3d6402f8296_NeikiAnalytics.exe
1752	b8c4eafa4f1b9646a990bc1b932cec6b6c451a2f8579c4ecb33bb3d6402f8296_NeikiAnalytics.exe
1752	b8c4eafa4f1b9646a990bc1b932cec6b6c451a2f8579c4ecb33bb3d6402f8296_NeikiAnalytics.exe
1752	b8c4eafa4f1b9646a990bc1b932cec6b6c451a2f8579c4ecb33bb3d6402f8296_NeikiAnalytics.exe
1752	b8c4eafa4f1b9646a990bc1b932cec6b6c451a2f8579c4ecb33bb3d6402f8296_NeikiAnalytics.exe
1752	b8c4eafa4f1b9646a990bc1b932cec6b6c451a2f8579c4ecb33bb3d6402f8296_NeikiAnalytics.exe
1752	b8c4eafa4f1b9646a990bc1b932cec6b6c451a2f8579c4ecb33bb3d6402f8296_NeikiAnalytics.exe
1752	b8c4eafa4f1b9646a990bc1b932cec6b6c451a2f8579c4ecb33bb3d6402f8296_NeikiAnalytics.exe
1752	b8c4eafa4f1b9646a990bc1b932cec6b6c451a2f8579c4ecb33bb3d6402f8296_NeikiAnalytics.exe
1752	b8c4eafa4f1b9646a990bc1b932cec6b6c451a2f8579c4ecb33bb3d6402f8296_NeikiAnalytics.exe
1752	b8c4eafa4f1b9646a990bc1b932cec6b6c451a2f8579c4ecb33bb3d6402f8296_NeikiAnalytics.exe
1752	b8c4eafa4f1b9646a990bc1b932cec6b6c451a2f8579c4ecb33bb3d6402f8296_NeikiAnalytics.exe
1752	b8c4eafa4f1b9646a990bc1b932cec6b6c451a2f8579c4ecb33bb3d6402f8296_NeikiAnalytics.exe
1752	b8c4eafa4f1b9646a990bc1b932cec6b6c451a2f8579c4ecb33bb3d6402f8296_NeikiAnalytics.exe
1752	b8c4eafa4f1b9646a990bc1b932cec6b6c451a2f8579c4ecb33bb3d6402f8296_NeikiAnalytics.exe
1752	b8c4eafa4f1b9646a990bc1b932cec6b6c451a2f8579c4ecb33bb3d6402f8296_NeikiAnalytics.exe
1752	b8c4eafa4f1b9646a990bc1b932cec6b6c451a2f8579c4ecb33bb3d6402f8296_NeikiAnalytics.exe
1752	b8c4eafa4f1b9646a990bc1b932cec6b6c451a2f8579c4ecb33bb3d6402f8296_NeikiAnalytics.exe
1752	b8c4eafa4f1b9646a990bc1b932cec6b6c451a2f8579c4ecb33bb3d6402f8296_NeikiAnalytics.exe
1752	b8c4eafa4f1b9646a990bc1b932cec6b6c451a2f8579c4ecb33bb3d6402f8296_NeikiAnalytics.exe
1752	b8c4eafa4f1b9646a990bc1b932cec6b6c451a2f8579c4ecb33bb3d6402f8296_NeikiAnalytics.exe
1752	b8c4eafa4f1b9646a990bc1b932cec6b6c451a2f8579c4ecb33bb3d6402f8296_NeikiAnalytics.exe
1752	b8c4eafa4f1b9646a990bc1b932cec6b6c451a2f8579c4ecb33bb3d6402f8296_NeikiAnalytics.exe
1752	b8c4eafa4f1b9646a990bc1b932cec6b6c451a2f8579c4ecb33bb3d6402f8296_NeikiAnalytics.exe
1752	b8c4eafa4f1b9646a990bc1b932cec6b6c451a2f8579c4ecb33bb3d6402f8296_NeikiAnalytics.exe
1752	b8c4eafa4f1b9646a990bc1b932cec6b6c451a2f8579c4ecb33bb3d6402f8296_NeikiAnalytics.exe
1752	b8c4eafa4f1b9646a990bc1b932cec6b6c451a2f8579c4ecb33bb3d6402f8296_NeikiAnalytics.exe
1752	b8c4eafa4f1b9646a990bc1b932cec6b6c451a2f8579c4ecb33bb3d6402f8296_NeikiAnalytics.exe
1752	b8c4eafa4f1b9646a990bc1b932cec6b6c451a2f8579c4ecb33bb3d6402f8296_NeikiAnalytics.exe
1752	b8c4eafa4f1b9646a990bc1b932cec6b6c451a2f8579c4ecb33bb3d6402f8296_NeikiAnalytics.exe
1752	b8c4eafa4f1b9646a990bc1b932cec6b6c451a2f8579c4ecb33bb3d6402f8296_NeikiAnalytics.exe
1752	b8c4eafa4f1b9646a990bc1b932cec6b6c451a2f8579c4ecb33bb3d6402f8296_NeikiAnalytics.exe
1752	b8c4eafa4f1b9646a990bc1b932cec6b6c451a2f8579c4ecb33bb3d6402f8296_NeikiAnalytics.exe
1752	b8c4eafa4f1b9646a990bc1b932cec6b6c451a2f8579c4ecb33bb3d6402f8296_NeikiAnalytics.exe
1752	b8c4eafa4f1b9646a990bc1b932cec6b6c451a2f8579c4ecb33bb3d6402f8296_NeikiAnalytics.exe

UPX packed file 48 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x000d000000012279-3.dat	upx
behavioral1/memory/1752-1-0x000000013FDB0000-0x00000001401A2000-memory.dmp	upx
behavioral1/memory/1600-8-0x000000013FB60000-0x000000013FF52000-memory.dmp	upx
behavioral1/files/0x00350000000141aa-12.dat	upx
behavioral1/files/0x0008000000014254-13.dat	upx
behavioral1/files/0x0006000000015c91-61.dat	upx
behavioral1/files/0x0006000000015b72-135.dat	upx
behavioral1/files/0x0006000000016228-134.dat	upx
behavioral1/files/0x0006000000016020-124.dat	upx
behavioral1/files/0x0006000000015f40-118.dat	upx
behavioral1/files/0x0006000000015fbb-121.dat	upx
behavioral1/memory/2736-191-0x000000013F2A0000-0x000000013F692000-memory.dmp	upx
behavioral1/memory/2844-186-0x000000013FBB0000-0x000000013FFA2000-memory.dmp	upx
behavioral1/memory/2148-183-0x000000013FA60000-0x000000013FE52000-memory.dmp	upx
behavioral1/files/0x0006000000015cca-163.dat	upx
behavioral1/files/0x0006000000015ca9-161.dat	upx
behavioral1/memory/2732-160-0x000000013F310000-0x000000013F702000-memory.dmp	upx
behavioral1/files/0x0006000000015d89-155.dat	upx
behavioral1/files/0x0006000000015d1e-154.dat	upx
behavioral1/files/0x0006000000015d02-153.dat	upx
behavioral1/files/0x0006000000015ced-152.dat	upx
behavioral1/files/0x0006000000015cd8-151.dat	upx
behavioral1/files/0x0006000000015cc2-150.dat	upx
behavioral1/files/0x0006000000015c9b-149.dat	upx
behavioral1/files/0x000600000001640f-138.dat	upx
behavioral1/files/0x0006000000016126-130.dat	upx
behavioral1/files/0x0006000000015a15-117.dat	upx
behavioral1/files/0x0006000000015d99-114.dat	upx
behavioral1/files/0x0006000000015d28-107.dat	upx
behavioral1/files/0x0006000000015d13-101.dat	upx
behavioral1/files/0x0006000000015cf5-94.dat	upx
behavioral1/memory/2348-195-0x000000013F830000-0x000000013FC22000-memory.dmp	upx
behavioral1/files/0x000600000001543a-89.dat	upx
behavioral1/files/0x0006000000015ce1-87.dat	upx
behavioral1/files/0x0006000000015bb5-83.dat	upx
behavioral1/files/0x0006000000015b37-75.dat	upx
behavioral1/files/0x00060000000155e8-74.dat	upx
behavioral1/files/0x000600000001523e-73.dat	upx
behavioral1/files/0x00070000000144d6-72.dat	upx
behavioral1/files/0x0007000000014430-69.dat	upx
behavioral1/files/0x000700000001448b-38.dat	upx
behavioral1/files/0x00080000000150aa-56.dat	upx
behavioral1/files/0x0008000000014317-25.dat	upx
behavioral1/memory/2348-4668-0x000000013F830000-0x000000013FC22000-memory.dmp	upx
behavioral1/memory/2736-4670-0x000000013F2A0000-0x000000013F692000-memory.dmp	upx
behavioral1/memory/2844-4672-0x000000013FBB0000-0x000000013FFA2000-memory.dmp	upx
behavioral1/memory/1600-5087-0x000000013FB60000-0x000000013FF52000-memory.dmp	upx
behavioral1/memory/2148-5089-0x000000013FA60000-0x000000013FE52000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\czjCngJ.exe	b8c4eafa4f1b9646a990bc1b932cec6b6c451a2f8579c4ecb33bb3d6402f8296_NeikiAnalytics.exe
File created	C:\Windows\System\qAbWUWc.exe	b8c4eafa4f1b9646a990bc1b932cec6b6c451a2f8579c4ecb33bb3d6402f8296_NeikiAnalytics.exe
File created	C:\Windows\System\ttrlFsc.exe	b8c4eafa4f1b9646a990bc1b932cec6b6c451a2f8579c4ecb33bb3d6402f8296_NeikiAnalytics.exe
File created	C:\Windows\System\vBiCnOj.exe	b8c4eafa4f1b9646a990bc1b932cec6b6c451a2f8579c4ecb33bb3d6402f8296_NeikiAnalytics.exe
File created	C:\Windows\System\JabVdMS.exe	b8c4eafa4f1b9646a990bc1b932cec6b6c451a2f8579c4ecb33bb3d6402f8296_NeikiAnalytics.exe
File created	C:\Windows\System\VtrCsaS.exe	b8c4eafa4f1b9646a990bc1b932cec6b6c451a2f8579c4ecb33bb3d6402f8296_NeikiAnalytics.exe
File created	C:\Windows\System\HzRfnGq.exe	b8c4eafa4f1b9646a990bc1b932cec6b6c451a2f8579c4ecb33bb3d6402f8296_NeikiAnalytics.exe
File created	C:\Windows\System\ncLFDeM.exe	b8c4eafa4f1b9646a990bc1b932cec6b6c451a2f8579c4ecb33bb3d6402f8296_NeikiAnalytics.exe
File created	C:\Windows\System\EtWgjwV.exe	b8c4eafa4f1b9646a990bc1b932cec6b6c451a2f8579c4ecb33bb3d6402f8296_NeikiAnalytics.exe
File created	C:\Windows\System\DtwDksF.exe	b8c4eafa4f1b9646a990bc1b932cec6b6c451a2f8579c4ecb33bb3d6402f8296_NeikiAnalytics.exe
File created	C:\Windows\System\JhsJyrZ.exe	b8c4eafa4f1b9646a990bc1b932cec6b6c451a2f8579c4ecb33bb3d6402f8296_NeikiAnalytics.exe
File created	C:\Windows\System\AiwNMaK.exe	b8c4eafa4f1b9646a990bc1b932cec6b6c451a2f8579c4ecb33bb3d6402f8296_NeikiAnalytics.exe
File created	C:\Windows\System\NCsfcFO.exe	b8c4eafa4f1b9646a990bc1b932cec6b6c451a2f8579c4ecb33bb3d6402f8296_NeikiAnalytics.exe
File created	C:\Windows\System\lUjYPel.exe	b8c4eafa4f1b9646a990bc1b932cec6b6c451a2f8579c4ecb33bb3d6402f8296_NeikiAnalytics.exe
File created	C:\Windows\System\pykkyGd.exe	b8c4eafa4f1b9646a990bc1b932cec6b6c451a2f8579c4ecb33bb3d6402f8296_NeikiAnalytics.exe
File created	C:\Windows\System\AmEEKgw.exe	b8c4eafa4f1b9646a990bc1b932cec6b6c451a2f8579c4ecb33bb3d6402f8296_NeikiAnalytics.exe
File created	C:\Windows\System\djybcBs.exe	b8c4eafa4f1b9646a990bc1b932cec6b6c451a2f8579c4ecb33bb3d6402f8296_NeikiAnalytics.exe
File created	C:\Windows\System\Mduuhuv.exe	b8c4eafa4f1b9646a990bc1b932cec6b6c451a2f8579c4ecb33bb3d6402f8296_NeikiAnalytics.exe
File created	C:\Windows\System\cAdjTpB.exe	b8c4eafa4f1b9646a990bc1b932cec6b6c451a2f8579c4ecb33bb3d6402f8296_NeikiAnalytics.exe
File created	C:\Windows\System\LsSqoxh.exe	b8c4eafa4f1b9646a990bc1b932cec6b6c451a2f8579c4ecb33bb3d6402f8296_NeikiAnalytics.exe
File created	C:\Windows\System\ywSgxpd.exe	b8c4eafa4f1b9646a990bc1b932cec6b6c451a2f8579c4ecb33bb3d6402f8296_NeikiAnalytics.exe
File created	C:\Windows\System\HzbobSe.exe	b8c4eafa4f1b9646a990bc1b932cec6b6c451a2f8579c4ecb33bb3d6402f8296_NeikiAnalytics.exe
File created	C:\Windows\System\jXYRfiq.exe	b8c4eafa4f1b9646a990bc1b932cec6b6c451a2f8579c4ecb33bb3d6402f8296_NeikiAnalytics.exe
File created	C:\Windows\System\tVbSlsl.exe	b8c4eafa4f1b9646a990bc1b932cec6b6c451a2f8579c4ecb33bb3d6402f8296_NeikiAnalytics.exe
File created	C:\Windows\System\NKOqdlL.exe	b8c4eafa4f1b9646a990bc1b932cec6b6c451a2f8579c4ecb33bb3d6402f8296_NeikiAnalytics.exe
File created	C:\Windows\System\nRLXgwr.exe	b8c4eafa4f1b9646a990bc1b932cec6b6c451a2f8579c4ecb33bb3d6402f8296_NeikiAnalytics.exe
File created	C:\Windows\System\OFlHnRD.exe	b8c4eafa4f1b9646a990bc1b932cec6b6c451a2f8579c4ecb33bb3d6402f8296_NeikiAnalytics.exe
File created	C:\Windows\System\bNTDQNj.exe	b8c4eafa4f1b9646a990bc1b932cec6b6c451a2f8579c4ecb33bb3d6402f8296_NeikiAnalytics.exe
File created	C:\Windows\System\fJWzvke.exe	b8c4eafa4f1b9646a990bc1b932cec6b6c451a2f8579c4ecb33bb3d6402f8296_NeikiAnalytics.exe
File created	C:\Windows\System\yVEGXWg.exe	b8c4eafa4f1b9646a990bc1b932cec6b6c451a2f8579c4ecb33bb3d6402f8296_NeikiAnalytics.exe
File created	C:\Windows\System\seEMwms.exe	b8c4eafa4f1b9646a990bc1b932cec6b6c451a2f8579c4ecb33bb3d6402f8296_NeikiAnalytics.exe
File created	C:\Windows\System\OgPItMl.exe	b8c4eafa4f1b9646a990bc1b932cec6b6c451a2f8579c4ecb33bb3d6402f8296_NeikiAnalytics.exe
File created	C:\Windows\System\bZIurCt.exe	b8c4eafa4f1b9646a990bc1b932cec6b6c451a2f8579c4ecb33bb3d6402f8296_NeikiAnalytics.exe
File created	C:\Windows\System\fhSSmmJ.exe	b8c4eafa4f1b9646a990bc1b932cec6b6c451a2f8579c4ecb33bb3d6402f8296_NeikiAnalytics.exe
File created	C:\Windows\System\DQeAeIW.exe	b8c4eafa4f1b9646a990bc1b932cec6b6c451a2f8579c4ecb33bb3d6402f8296_NeikiAnalytics.exe
File created	C:\Windows\System\vbwlRmp.exe	b8c4eafa4f1b9646a990bc1b932cec6b6c451a2f8579c4ecb33bb3d6402f8296_NeikiAnalytics.exe
File created	C:\Windows\System\UkWIbUe.exe	b8c4eafa4f1b9646a990bc1b932cec6b6c451a2f8579c4ecb33bb3d6402f8296_NeikiAnalytics.exe
File created	C:\Windows\System\iRkJBuZ.exe	b8c4eafa4f1b9646a990bc1b932cec6b6c451a2f8579c4ecb33bb3d6402f8296_NeikiAnalytics.exe
File created	C:\Windows\System\gGtXEDz.exe	b8c4eafa4f1b9646a990bc1b932cec6b6c451a2f8579c4ecb33bb3d6402f8296_NeikiAnalytics.exe
File created	C:\Windows\System\QclZeAQ.exe	b8c4eafa4f1b9646a990bc1b932cec6b6c451a2f8579c4ecb33bb3d6402f8296_NeikiAnalytics.exe
File created	C:\Windows\System\uEcaCzs.exe	b8c4eafa4f1b9646a990bc1b932cec6b6c451a2f8579c4ecb33bb3d6402f8296_NeikiAnalytics.exe
File created	C:\Windows\System\BhRHNOd.exe	b8c4eafa4f1b9646a990bc1b932cec6b6c451a2f8579c4ecb33bb3d6402f8296_NeikiAnalytics.exe
File created	C:\Windows\System\asQTvom.exe	b8c4eafa4f1b9646a990bc1b932cec6b6c451a2f8579c4ecb33bb3d6402f8296_NeikiAnalytics.exe
File created	C:\Windows\System\gYeQJFt.exe	b8c4eafa4f1b9646a990bc1b932cec6b6c451a2f8579c4ecb33bb3d6402f8296_NeikiAnalytics.exe
File created	C:\Windows\System\OZxvEXd.exe	b8c4eafa4f1b9646a990bc1b932cec6b6c451a2f8579c4ecb33bb3d6402f8296_NeikiAnalytics.exe
File created	C:\Windows\System\QCzmslB.exe	b8c4eafa4f1b9646a990bc1b932cec6b6c451a2f8579c4ecb33bb3d6402f8296_NeikiAnalytics.exe
File created	C:\Windows\System\ZMIEwCI.exe	b8c4eafa4f1b9646a990bc1b932cec6b6c451a2f8579c4ecb33bb3d6402f8296_NeikiAnalytics.exe
File created	C:\Windows\System\lVruDGu.exe	b8c4eafa4f1b9646a990bc1b932cec6b6c451a2f8579c4ecb33bb3d6402f8296_NeikiAnalytics.exe
File created	C:\Windows\System\jKjOMjq.exe	b8c4eafa4f1b9646a990bc1b932cec6b6c451a2f8579c4ecb33bb3d6402f8296_NeikiAnalytics.exe
File created	C:\Windows\System\psGjCsJ.exe	b8c4eafa4f1b9646a990bc1b932cec6b6c451a2f8579c4ecb33bb3d6402f8296_NeikiAnalytics.exe
File created	C:\Windows\System\UoVNjUt.exe	b8c4eafa4f1b9646a990bc1b932cec6b6c451a2f8579c4ecb33bb3d6402f8296_NeikiAnalytics.exe
File created	C:\Windows\System\iLGwaIy.exe	b8c4eafa4f1b9646a990bc1b932cec6b6c451a2f8579c4ecb33bb3d6402f8296_NeikiAnalytics.exe
File created	C:\Windows\System\tuTLNsa.exe	b8c4eafa4f1b9646a990bc1b932cec6b6c451a2f8579c4ecb33bb3d6402f8296_NeikiAnalytics.exe
File created	C:\Windows\System\XADyjyF.exe	b8c4eafa4f1b9646a990bc1b932cec6b6c451a2f8579c4ecb33bb3d6402f8296_NeikiAnalytics.exe
File created	C:\Windows\System\YoPQwdX.exe	b8c4eafa4f1b9646a990bc1b932cec6b6c451a2f8579c4ecb33bb3d6402f8296_NeikiAnalytics.exe
File created	C:\Windows\System\aLcIaoa.exe	b8c4eafa4f1b9646a990bc1b932cec6b6c451a2f8579c4ecb33bb3d6402f8296_NeikiAnalytics.exe
File created	C:\Windows\System\JphjdJr.exe	b8c4eafa4f1b9646a990bc1b932cec6b6c451a2f8579c4ecb33bb3d6402f8296_NeikiAnalytics.exe
File created	C:\Windows\System\rWIaMgo.exe	b8c4eafa4f1b9646a990bc1b932cec6b6c451a2f8579c4ecb33bb3d6402f8296_NeikiAnalytics.exe
File created	C:\Windows\System\waPcWHO.exe	b8c4eafa4f1b9646a990bc1b932cec6b6c451a2f8579c4ecb33bb3d6402f8296_NeikiAnalytics.exe
File created	C:\Windows\System\dbzUVpX.exe	b8c4eafa4f1b9646a990bc1b932cec6b6c451a2f8579c4ecb33bb3d6402f8296_NeikiAnalytics.exe
File created	C:\Windows\System\wAUgWSE.exe	b8c4eafa4f1b9646a990bc1b932cec6b6c451a2f8579c4ecb33bb3d6402f8296_NeikiAnalytics.exe
File created	C:\Windows\System\BktwECM.exe	b8c4eafa4f1b9646a990bc1b932cec6b6c451a2f8579c4ecb33bb3d6402f8296_NeikiAnalytics.exe
File created	C:\Windows\System\xjukOwo.exe	b8c4eafa4f1b9646a990bc1b932cec6b6c451a2f8579c4ecb33bb3d6402f8296_NeikiAnalytics.exe
File created	C:\Windows\System\YwXBcOs.exe	b8c4eafa4f1b9646a990bc1b932cec6b6c451a2f8579c4ecb33bb3d6402f8296_NeikiAnalytics.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2448	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	1752	b8c4eafa4f1b9646a990bc1b932cec6b6c451a2f8579c4ecb33bb3d6402f8296_NeikiAnalytics.exe
Token: SeLockMemoryPrivilege	1752	b8c4eafa4f1b9646a990bc1b932cec6b6c451a2f8579c4ecb33bb3d6402f8296_NeikiAnalytics.exe
Token: SeDebugPrivilege	2448	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1752 wrote to memory of 2448	1752	b8c4eafa4f1b9646a990bc1b932cec6b6c451a2f8579c4ecb33bb3d6402f8296_NeikiAnalytics.exe	29
PID 1752 wrote to memory of 2448	1752	b8c4eafa4f1b9646a990bc1b932cec6b6c451a2f8579c4ecb33bb3d6402f8296_NeikiAnalytics.exe	29
PID 1752 wrote to memory of 2448	1752	b8c4eafa4f1b9646a990bc1b932cec6b6c451a2f8579c4ecb33bb3d6402f8296_NeikiAnalytics.exe	29
PID 1752 wrote to memory of 1600	1752	b8c4eafa4f1b9646a990bc1b932cec6b6c451a2f8579c4ecb33bb3d6402f8296_NeikiAnalytics.exe	30
PID 1752 wrote to memory of 1600	1752	b8c4eafa4f1b9646a990bc1b932cec6b6c451a2f8579c4ecb33bb3d6402f8296_NeikiAnalytics.exe	30
PID 1752 wrote to memory of 1600	1752	b8c4eafa4f1b9646a990bc1b932cec6b6c451a2f8579c4ecb33bb3d6402f8296_NeikiAnalytics.exe	30
PID 1752 wrote to memory of 2348	1752	b8c4eafa4f1b9646a990bc1b932cec6b6c451a2f8579c4ecb33bb3d6402f8296_NeikiAnalytics.exe	31
PID 1752 wrote to memory of 2348	1752	b8c4eafa4f1b9646a990bc1b932cec6b6c451a2f8579c4ecb33bb3d6402f8296_NeikiAnalytics.exe	31
PID 1752 wrote to memory of 2348	1752	b8c4eafa4f1b9646a990bc1b932cec6b6c451a2f8579c4ecb33bb3d6402f8296_NeikiAnalytics.exe	31
PID 1752 wrote to memory of 2736	1752	b8c4eafa4f1b9646a990bc1b932cec6b6c451a2f8579c4ecb33bb3d6402f8296_NeikiAnalytics.exe	32
PID 1752 wrote to memory of 2736	1752	b8c4eafa4f1b9646a990bc1b932cec6b6c451a2f8579c4ecb33bb3d6402f8296_NeikiAnalytics.exe	32
PID 1752 wrote to memory of 2736	1752	b8c4eafa4f1b9646a990bc1b932cec6b6c451a2f8579c4ecb33bb3d6402f8296_NeikiAnalytics.exe	32
PID 1752 wrote to memory of 2732	1752	b8c4eafa4f1b9646a990bc1b932cec6b6c451a2f8579c4ecb33bb3d6402f8296_NeikiAnalytics.exe	33
PID 1752 wrote to memory of 2732	1752	b8c4eafa4f1b9646a990bc1b932cec6b6c451a2f8579c4ecb33bb3d6402f8296_NeikiAnalytics.exe	33
PID 1752 wrote to memory of 2732	1752	b8c4eafa4f1b9646a990bc1b932cec6b6c451a2f8579c4ecb33bb3d6402f8296_NeikiAnalytics.exe	33
PID 1752 wrote to memory of 2640	1752	b8c4eafa4f1b9646a990bc1b932cec6b6c451a2f8579c4ecb33bb3d6402f8296_NeikiAnalytics.exe	34
PID 1752 wrote to memory of 2640	1752	b8c4eafa4f1b9646a990bc1b932cec6b6c451a2f8579c4ecb33bb3d6402f8296_NeikiAnalytics.exe	34
PID 1752 wrote to memory of 2640	1752	b8c4eafa4f1b9646a990bc1b932cec6b6c451a2f8579c4ecb33bb3d6402f8296_NeikiAnalytics.exe	34
PID 1752 wrote to memory of 2148	1752	b8c4eafa4f1b9646a990bc1b932cec6b6c451a2f8579c4ecb33bb3d6402f8296_NeikiAnalytics.exe	35
PID 1752 wrote to memory of 2148	1752	b8c4eafa4f1b9646a990bc1b932cec6b6c451a2f8579c4ecb33bb3d6402f8296_NeikiAnalytics.exe	35
PID 1752 wrote to memory of 2148	1752	b8c4eafa4f1b9646a990bc1b932cec6b6c451a2f8579c4ecb33bb3d6402f8296_NeikiAnalytics.exe	35
PID 1752 wrote to memory of 2132	1752	b8c4eafa4f1b9646a990bc1b932cec6b6c451a2f8579c4ecb33bb3d6402f8296_NeikiAnalytics.exe	36
PID 1752 wrote to memory of 2132	1752	b8c4eafa4f1b9646a990bc1b932cec6b6c451a2f8579c4ecb33bb3d6402f8296_NeikiAnalytics.exe	36
PID 1752 wrote to memory of 2132	1752	b8c4eafa4f1b9646a990bc1b932cec6b6c451a2f8579c4ecb33bb3d6402f8296_NeikiAnalytics.exe	36
PID 1752 wrote to memory of 2844	1752	b8c4eafa4f1b9646a990bc1b932cec6b6c451a2f8579c4ecb33bb3d6402f8296_NeikiAnalytics.exe	37
PID 1752 wrote to memory of 2844	1752	b8c4eafa4f1b9646a990bc1b932cec6b6c451a2f8579c4ecb33bb3d6402f8296_NeikiAnalytics.exe	37
PID 1752 wrote to memory of 2844	1752	b8c4eafa4f1b9646a990bc1b932cec6b6c451a2f8579c4ecb33bb3d6402f8296_NeikiAnalytics.exe	37
PID 1752 wrote to memory of 2212	1752	b8c4eafa4f1b9646a990bc1b932cec6b6c451a2f8579c4ecb33bb3d6402f8296_NeikiAnalytics.exe	38
PID 1752 wrote to memory of 2212	1752	b8c4eafa4f1b9646a990bc1b932cec6b6c451a2f8579c4ecb33bb3d6402f8296_NeikiAnalytics.exe	38
PID 1752 wrote to memory of 2212	1752	b8c4eafa4f1b9646a990bc1b932cec6b6c451a2f8579c4ecb33bb3d6402f8296_NeikiAnalytics.exe	38
PID 1752 wrote to memory of 2588	1752	b8c4eafa4f1b9646a990bc1b932cec6b6c451a2f8579c4ecb33bb3d6402f8296_NeikiAnalytics.exe	39
PID 1752 wrote to memory of 2588	1752	b8c4eafa4f1b9646a990bc1b932cec6b6c451a2f8579c4ecb33bb3d6402f8296_NeikiAnalytics.exe	39
PID 1752 wrote to memory of 2588	1752	b8c4eafa4f1b9646a990bc1b932cec6b6c451a2f8579c4ecb33bb3d6402f8296_NeikiAnalytics.exe	39
PID 1752 wrote to memory of 2528	1752	b8c4eafa4f1b9646a990bc1b932cec6b6c451a2f8579c4ecb33bb3d6402f8296_NeikiAnalytics.exe	40
PID 1752 wrote to memory of 2528	1752	b8c4eafa4f1b9646a990bc1b932cec6b6c451a2f8579c4ecb33bb3d6402f8296_NeikiAnalytics.exe	40
PID 1752 wrote to memory of 2528	1752	b8c4eafa4f1b9646a990bc1b932cec6b6c451a2f8579c4ecb33bb3d6402f8296_NeikiAnalytics.exe	40
PID 1752 wrote to memory of 2584	1752	b8c4eafa4f1b9646a990bc1b932cec6b6c451a2f8579c4ecb33bb3d6402f8296_NeikiAnalytics.exe	41
PID 1752 wrote to memory of 2584	1752	b8c4eafa4f1b9646a990bc1b932cec6b6c451a2f8579c4ecb33bb3d6402f8296_NeikiAnalytics.exe	41
PID 1752 wrote to memory of 2584	1752	b8c4eafa4f1b9646a990bc1b932cec6b6c451a2f8579c4ecb33bb3d6402f8296_NeikiAnalytics.exe	41
PID 1752 wrote to memory of 3024	1752	b8c4eafa4f1b9646a990bc1b932cec6b6c451a2f8579c4ecb33bb3d6402f8296_NeikiAnalytics.exe	42
PID 1752 wrote to memory of 3024	1752	b8c4eafa4f1b9646a990bc1b932cec6b6c451a2f8579c4ecb33bb3d6402f8296_NeikiAnalytics.exe	42
PID 1752 wrote to memory of 3024	1752	b8c4eafa4f1b9646a990bc1b932cec6b6c451a2f8579c4ecb33bb3d6402f8296_NeikiAnalytics.exe	42
PID 1752 wrote to memory of 2088	1752	b8c4eafa4f1b9646a990bc1b932cec6b6c451a2f8579c4ecb33bb3d6402f8296_NeikiAnalytics.exe	43
PID 1752 wrote to memory of 2088	1752	b8c4eafa4f1b9646a990bc1b932cec6b6c451a2f8579c4ecb33bb3d6402f8296_NeikiAnalytics.exe	43
PID 1752 wrote to memory of 2088	1752	b8c4eafa4f1b9646a990bc1b932cec6b6c451a2f8579c4ecb33bb3d6402f8296_NeikiAnalytics.exe	43
PID 1752 wrote to memory of 3040	1752	b8c4eafa4f1b9646a990bc1b932cec6b6c451a2f8579c4ecb33bb3d6402f8296_NeikiAnalytics.exe	44
PID 1752 wrote to memory of 3040	1752	b8c4eafa4f1b9646a990bc1b932cec6b6c451a2f8579c4ecb33bb3d6402f8296_NeikiAnalytics.exe	44
PID 1752 wrote to memory of 3040	1752	b8c4eafa4f1b9646a990bc1b932cec6b6c451a2f8579c4ecb33bb3d6402f8296_NeikiAnalytics.exe	44
PID 1752 wrote to memory of 2340	1752	b8c4eafa4f1b9646a990bc1b932cec6b6c451a2f8579c4ecb33bb3d6402f8296_NeikiAnalytics.exe	45
PID 1752 wrote to memory of 2340	1752	b8c4eafa4f1b9646a990bc1b932cec6b6c451a2f8579c4ecb33bb3d6402f8296_NeikiAnalytics.exe	45
PID 1752 wrote to memory of 2340	1752	b8c4eafa4f1b9646a990bc1b932cec6b6c451a2f8579c4ecb33bb3d6402f8296_NeikiAnalytics.exe	45
PID 1752 wrote to memory of 2868	1752	b8c4eafa4f1b9646a990bc1b932cec6b6c451a2f8579c4ecb33bb3d6402f8296_NeikiAnalytics.exe	46
PID 1752 wrote to memory of 2868	1752	b8c4eafa4f1b9646a990bc1b932cec6b6c451a2f8579c4ecb33bb3d6402f8296_NeikiAnalytics.exe	46
PID 1752 wrote to memory of 2868	1752	b8c4eafa4f1b9646a990bc1b932cec6b6c451a2f8579c4ecb33bb3d6402f8296_NeikiAnalytics.exe	46
PID 1752 wrote to memory of 2864	1752	b8c4eafa4f1b9646a990bc1b932cec6b6c451a2f8579c4ecb33bb3d6402f8296_NeikiAnalytics.exe	47
PID 1752 wrote to memory of 2864	1752	b8c4eafa4f1b9646a990bc1b932cec6b6c451a2f8579c4ecb33bb3d6402f8296_NeikiAnalytics.exe	47
PID 1752 wrote to memory of 2864	1752	b8c4eafa4f1b9646a990bc1b932cec6b6c451a2f8579c4ecb33bb3d6402f8296_NeikiAnalytics.exe	47
PID 1752 wrote to memory of 2888	1752	b8c4eafa4f1b9646a990bc1b932cec6b6c451a2f8579c4ecb33bb3d6402f8296_NeikiAnalytics.exe	48
PID 1752 wrote to memory of 2888	1752	b8c4eafa4f1b9646a990bc1b932cec6b6c451a2f8579c4ecb33bb3d6402f8296_NeikiAnalytics.exe	48
PID 1752 wrote to memory of 2888	1752	b8c4eafa4f1b9646a990bc1b932cec6b6c451a2f8579c4ecb33bb3d6402f8296_NeikiAnalytics.exe	48
PID 1752 wrote to memory of 1528	1752	b8c4eafa4f1b9646a990bc1b932cec6b6c451a2f8579c4ecb33bb3d6402f8296_NeikiAnalytics.exe	49
PID 1752 wrote to memory of 1528	1752	b8c4eafa4f1b9646a990bc1b932cec6b6c451a2f8579c4ecb33bb3d6402f8296_NeikiAnalytics.exe	49
PID 1752 wrote to memory of 1528	1752	b8c4eafa4f1b9646a990bc1b932cec6b6c451a2f8579c4ecb33bb3d6402f8296_NeikiAnalytics.exe	49
PID 1752 wrote to memory of 3020	1752	b8c4eafa4f1b9646a990bc1b932cec6b6c451a2f8579c4ecb33bb3d6402f8296_NeikiAnalytics.exe	50

C:\Users\Admin\AppData\Local\Temp\b8c4eafa4f1b9646a990bc1b932cec6b6c451a2f8579c4ecb33bb3d6402f8296_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\b8c4eafa4f1b9646a990bc1b932cec6b6c451a2f8579c4ecb33bb3d6402f8296_NeikiAnalytics.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1752
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2448
- C:\Windows\System\GDQUvcK.exe
  C:\Windows\System\GDQUvcK.exe
  2⤵
  - Executes dropped EXE
  PID:1600
- C:\Windows\System\evoKUPw.exe
  C:\Windows\System\evoKUPw.exe
  2⤵
  - Executes dropped EXE
  PID:2348
- C:\Windows\System\YXMevff.exe
  C:\Windows\System\YXMevff.exe
  2⤵
  - Executes dropped EXE
  PID:2736
- C:\Windows\System\StaYfsX.exe
  C:\Windows\System\StaYfsX.exe
  2⤵
  - Executes dropped EXE
  PID:2732
- C:\Windows\System\cItKRDM.exe
  C:\Windows\System\cItKRDM.exe
  2⤵
  - Executes dropped EXE
  PID:2640
- C:\Windows\System\FEHuEhf.exe
  C:\Windows\System\FEHuEhf.exe
  2⤵
  - Executes dropped EXE
  PID:2148
- C:\Windows\System\yuyXosR.exe
  C:\Windows\System\yuyXosR.exe
  2⤵
  - Executes dropped EXE
  PID:2132
- C:\Windows\System\OmTCdfT.exe
  C:\Windows\System\OmTCdfT.exe
  2⤵
  - Executes dropped EXE
  PID:2844
- C:\Windows\System\CZyAPky.exe
  C:\Windows\System\CZyAPky.exe
  2⤵
  - Executes dropped EXE
  PID:2212
- C:\Windows\System\pVBzQWQ.exe
  C:\Windows\System\pVBzQWQ.exe
  2⤵
  - Executes dropped EXE
  PID:2588
- C:\Windows\System\klwnJrC.exe
  C:\Windows\System\klwnJrC.exe
  2⤵
  - Executes dropped EXE
  PID:2528
- C:\Windows\System\qvjhqJj.exe
  C:\Windows\System\qvjhqJj.exe
  2⤵
  - Executes dropped EXE
  PID:2584
- C:\Windows\System\ngUrNGd.exe
  C:\Windows\System\ngUrNGd.exe
  2⤵
  - Executes dropped EXE
  PID:3024
- C:\Windows\System\TIClZeZ.exe
  C:\Windows\System\TIClZeZ.exe
  2⤵
  - Executes dropped EXE
  PID:2088
- C:\Windows\System\EEpJupX.exe
  C:\Windows\System\EEpJupX.exe
  2⤵
  - Executes dropped EXE
  PID:3040
- C:\Windows\System\WeqMqiH.exe
  C:\Windows\System\WeqMqiH.exe
  2⤵
  - Executes dropped EXE
  PID:2340
- C:\Windows\System\BjNrcHu.exe
  C:\Windows\System\BjNrcHu.exe
  2⤵
  - Executes dropped EXE
  PID:2868
- C:\Windows\System\BISFtNC.exe
  C:\Windows\System\BISFtNC.exe
  2⤵
  - Executes dropped EXE
  PID:2864
- C:\Windows\System\gBlbxxw.exe
  C:\Windows\System\gBlbxxw.exe
  2⤵
  - Executes dropped EXE
  PID:2888
- C:\Windows\System\JwNVMsx.exe
  C:\Windows\System\JwNVMsx.exe
  2⤵
  - Executes dropped EXE
  PID:1528
- C:\Windows\System\zVjEKDH.exe
  C:\Windows\System\zVjEKDH.exe
  2⤵
  - Executes dropped EXE
  PID:3020
- C:\Windows\System\rhyMILj.exe
  C:\Windows\System\rhyMILj.exe
  2⤵
  - Executes dropped EXE
  PID:1640
- C:\Windows\System\kOJrvJy.exe
  C:\Windows\System\kOJrvJy.exe
  2⤵
  - Executes dropped EXE
  PID:1828
- C:\Windows\System\JlakuNm.exe
  C:\Windows\System\JlakuNm.exe
  2⤵
  - Executes dropped EXE
  PID:2036
- C:\Windows\System\MgzEjnx.exe
  C:\Windows\System\MgzEjnx.exe
  2⤵
  - Executes dropped EXE
  PID:1692
- C:\Windows\System\HxFgZgP.exe
  C:\Windows\System\HxFgZgP.exe
  2⤵
  - Executes dropped EXE
  PID:2184
- C:\Windows\System\AUUxGnJ.exe
  C:\Windows\System\AUUxGnJ.exe
  2⤵
  - Executes dropped EXE
  PID:2420
- C:\Windows\System\qGuzazN.exe
  C:\Windows\System\qGuzazN.exe
  2⤵
  - Executes dropped EXE
  PID:2800
- C:\Windows\System\noTDKCl.exe
  C:\Windows\System\noTDKCl.exe
  2⤵
  - Executes dropped EXE
  PID:2792
- C:\Windows\System\NAUhdbr.exe
  C:\Windows\System\NAUhdbr.exe
  2⤵
  - Executes dropped EXE
  PID:2168
- C:\Windows\System\ewfBZnp.exe
  C:\Windows\System\ewfBZnp.exe
  2⤵
  - Executes dropped EXE
  PID:1320
- C:\Windows\System\NKOqdlL.exe
  C:\Windows\System\NKOqdlL.exe
  2⤵
  - Executes dropped EXE
  PID:1256
- C:\Windows\System\XqsRHDP.exe
  C:\Windows\System\XqsRHDP.exe
  2⤵
  - Executes dropped EXE
  PID:1964
- C:\Windows\System\FWcHSpU.exe
  C:\Windows\System\FWcHSpU.exe
  2⤵
  - Executes dropped EXE
  PID:2304
- C:\Windows\System\QctOvGm.exe
  C:\Windows\System\QctOvGm.exe
  2⤵
  - Executes dropped EXE
  PID:2144
- C:\Windows\System\lgpLSQr.exe
  C:\Windows\System\lgpLSQr.exe
  2⤵
  - Executes dropped EXE
  PID:2120
- C:\Windows\System\txZryHJ.exe
  C:\Windows\System\txZryHJ.exe
  2⤵
  - Executes dropped EXE
  PID:1684
- C:\Windows\System\svSzMob.exe
  C:\Windows\System\svSzMob.exe
  2⤵
  - Executes dropped EXE
  PID:1876
- C:\Windows\System\ZwQwTYl.exe
  C:\Windows\System\ZwQwTYl.exe
  2⤵
  - Executes dropped EXE
  PID:1976
- C:\Windows\System\HQPDSlA.exe
  C:\Windows\System\HQPDSlA.exe
  2⤵
  - Executes dropped EXE
  PID:1656
- C:\Windows\System\FUHmIsF.exe
  C:\Windows\System\FUHmIsF.exe
  2⤵
  - Executes dropped EXE
  PID:2008
- C:\Windows\System\ZRjcZTY.exe
  C:\Windows\System\ZRjcZTY.exe
  2⤵
  - Executes dropped EXE
  PID:1160
- C:\Windows\System\ewZWgoJ.exe
  C:\Windows\System\ewZWgoJ.exe
  2⤵
  - Executes dropped EXE
  PID:3012
- C:\Windows\System\jhCYiwr.exe
  C:\Windows\System\jhCYiwr.exe
  2⤵
  - Executes dropped EXE
  PID:2996
- C:\Windows\System\gnnzEds.exe
  C:\Windows\System\gnnzEds.exe
  2⤵
  - Executes dropped EXE
  PID:1524
- C:\Windows\System\KMtMOnO.exe
  C:\Windows\System\KMtMOnO.exe
  2⤵
  - Executes dropped EXE
  PID:1292
- C:\Windows\System\esmdckD.exe
  C:\Windows\System\esmdckD.exe
  2⤵
  - Executes dropped EXE
  PID:2312
- C:\Windows\System\WTwdLPj.exe
  C:\Windows\System\WTwdLPj.exe
  2⤵
  - Executes dropped EXE
  PID:1620
- C:\Windows\System\ZxdEHPF.exe
  C:\Windows\System\ZxdEHPF.exe
  2⤵
  - Executes dropped EXE
  PID:1608
- C:\Windows\System\SnTukpR.exe
  C:\Windows\System\SnTukpR.exe
  2⤵
  - Executes dropped EXE
  PID:2752
- C:\Windows\System\DcYrzQP.exe
  C:\Windows\System\DcYrzQP.exe
  2⤵
  - Executes dropped EXE
  PID:2828
- C:\Windows\System\oLBQuiz.exe
  C:\Windows\System\oLBQuiz.exe
  2⤵
  - Executes dropped EXE
  PID:3064
- C:\Windows\System\CYcupou.exe
  C:\Windows\System\CYcupou.exe
  2⤵
  - Executes dropped EXE
  PID:2204
- C:\Windows\System\NXhQHWB.exe
  C:\Windows\System\NXhQHWB.exe
  2⤵
  - Executes dropped EXE
  PID:2900
- C:\Windows\System\Opgtdwg.exe
  C:\Windows\System\Opgtdwg.exe
  2⤵
  - Executes dropped EXE
  PID:2764
- C:\Windows\System\xvkUZmV.exe
  C:\Windows\System\xvkUZmV.exe
  2⤵
  - Executes dropped EXE
  PID:2560
- C:\Windows\System\BXqGCkY.exe
  C:\Windows\System\BXqGCkY.exe
  2⤵
  - Executes dropped EXE
  PID:2552
- C:\Windows\System\IaalhFE.exe
  C:\Windows\System\IaalhFE.exe
  2⤵
  - Executes dropped EXE
  PID:1736
- C:\Windows\System\WxOQNrV.exe
  C:\Windows\System\WxOQNrV.exe
  2⤵
  - Executes dropped EXE
  PID:3016
- C:\Windows\System\hyvucrJ.exe
  C:\Windows\System\hyvucrJ.exe
  2⤵
  - Executes dropped EXE
  PID:1996
- C:\Windows\System\yBvbPbz.exe
  C:\Windows\System\yBvbPbz.exe
  2⤵
  - Executes dropped EXE
  PID:1824
- C:\Windows\System\wpUudbG.exe
  C:\Windows\System\wpUudbG.exe
  2⤵
  - Executes dropped EXE
  PID:2012
- C:\Windows\System\jvxNaHO.exe
  C:\Windows\System\jvxNaHO.exe
  2⤵
  - Executes dropped EXE
  PID:2208
- C:\Windows\System\jJRMsiW.exe
  C:\Windows\System\jJRMsiW.exe
  2⤵
  - Executes dropped EXE
  PID:1224
- C:\Windows\System\jwNaFBU.exe
  C:\Windows\System\jwNaFBU.exe
  2⤵
  PID:2724
- C:\Windows\System\evYlYVn.exe
  C:\Windows\System\evYlYVn.exe
  2⤵
  PID:1772
- C:\Windows\System\mYOxqgY.exe
  C:\Windows\System\mYOxqgY.exe
  2⤵
  PID:2716
- C:\Windows\System\UeVVeUm.exe
  C:\Windows\System\UeVVeUm.exe
  2⤵
  PID:2284
- C:\Windows\System\eHsXCKM.exe
  C:\Windows\System\eHsXCKM.exe
  2⤵
  PID:2504
- C:\Windows\System\OkOjGlf.exe
  C:\Windows\System\OkOjGlf.exe
  2⤵
  PID:1040
- C:\Windows\System\VvGzDKQ.exe
  C:\Windows\System\VvGzDKQ.exe
  2⤵
  PID:2496
- C:\Windows\System\AmWiRUF.exe
  C:\Windows\System\AmWiRUF.exe
  2⤵
  PID:1004
- C:\Windows\System\IKuBkod.exe
  C:\Windows\System\IKuBkod.exe
  2⤵
  PID:2072
- C:\Windows\System\EAZRzhY.exe
  C:\Windows\System\EAZRzhY.exe
  2⤵
  PID:2728
- C:\Windows\System\JxWbujN.exe
  C:\Windows\System\JxWbujN.exe
  2⤵
  PID:2680
- C:\Windows\System\zLRWDhW.exe
  C:\Windows\System\zLRWDhW.exe
  2⤵
  PID:2920
- C:\Windows\System\vaqUwel.exe
  C:\Windows\System\vaqUwel.exe
  2⤵
  PID:1328
- C:\Windows\System\CYXUJws.exe
  C:\Windows\System\CYXUJws.exe
  2⤵
  PID:2308
- C:\Windows\System\ZYLfCkB.exe
  C:\Windows\System\ZYLfCkB.exe
  2⤵
  PID:1272
- C:\Windows\System\EAzOOHo.exe
  C:\Windows\System\EAzOOHo.exe
  2⤵
  PID:2768
- C:\Windows\System\HYpelDu.exe
  C:\Windows\System\HYpelDu.exe
  2⤵
  PID:1332
- C:\Windows\System\XPOROHU.exe
  C:\Windows\System\XPOROHU.exe
  2⤵
  PID:2928
- C:\Windows\System\vwSpUJf.exe
  C:\Windows\System\vwSpUJf.exe
  2⤵
  PID:2856
- C:\Windows\System\QbUoESc.exe
  C:\Windows\System\QbUoESc.exe
  2⤵
  PID:2580
- C:\Windows\System\wzOdoZV.exe
  C:\Windows\System\wzOdoZV.exe
  2⤵
  PID:2708
- C:\Windows\System\sJEtZyo.exe
  C:\Windows\System\sJEtZyo.exe
  2⤵
  PID:2904
- C:\Windows\System\QHlZmPT.exe
  C:\Windows\System\QHlZmPT.exe
  2⤵
  PID:2280
- C:\Windows\System\GtSIMGv.exe
  C:\Windows\System\GtSIMGv.exe
  2⤵
  PID:3056
- C:\Windows\System\DuLvsqa.exe
  C:\Windows\System\DuLvsqa.exe
  2⤵
  PID:1104
- C:\Windows\System\ZdPwJsg.exe
  C:\Windows\System\ZdPwJsg.exe
  2⤵
  PID:1236
- C:\Windows\System\oyhbhQQ.exe
  C:\Windows\System\oyhbhQQ.exe
  2⤵
  PID:1864
- C:\Windows\System\sBSCoDC.exe
  C:\Windows\System\sBSCoDC.exe
  2⤵
  PID:1120
- C:\Windows\System\RaqtxSl.exe
  C:\Windows\System\RaqtxSl.exe
  2⤵
  PID:2272
- C:\Windows\System\uUwZRFU.exe
  C:\Windows\System\uUwZRFU.exe
  2⤵
  PID:2180
- C:\Windows\System\vLjHgtM.exe
  C:\Windows\System\vLjHgtM.exe
  2⤵
  PID:1792
- C:\Windows\System\ZXPYuxq.exe
  C:\Windows\System\ZXPYuxq.exe
  2⤵
  PID:2988
- C:\Windows\System\fscuIlO.exe
  C:\Windows\System\fscuIlO.exe
  2⤵
  PID:1588
- C:\Windows\System\gjvezoY.exe
  C:\Windows\System\gjvezoY.exe
  2⤵
  PID:2124
- C:\Windows\System\xiYRChc.exe
  C:\Windows\System\xiYRChc.exe
  2⤵
  PID:2676
- C:\Windows\System\xuzjAmm.exe
  C:\Windows\System\xuzjAmm.exe
  2⤵
  PID:2772
- C:\Windows\System\xjiuJmU.exe
  C:\Windows\System\xjiuJmU.exe
  2⤵
  PID:2656
- C:\Windows\System\LQIaOxn.exe
  C:\Windows\System\LQIaOxn.exe
  2⤵
  PID:1696
- C:\Windows\System\gQmRDFy.exe
  C:\Windows\System\gQmRDFy.exe
  2⤵
  PID:1788
- C:\Windows\System\YNPnOEK.exe
  C:\Windows\System\YNPnOEK.exe
  2⤵
  PID:2664
- C:\Windows\System\PEIsTny.exe
  C:\Windows\System\PEIsTny.exe
  2⤵
  PID:3004
- C:\Windows\System\dTBfyaY.exe
  C:\Windows\System\dTBfyaY.exe
  2⤵
  PID:2576
- C:\Windows\System\cIyIIQu.exe
  C:\Windows\System\cIyIIQu.exe
  2⤵
  PID:2600
- C:\Windows\System\JagjxoV.exe
  C:\Windows\System\JagjxoV.exe
  2⤵
  PID:1636
- C:\Windows\System\EPVcnTN.exe
  C:\Windows\System\EPVcnTN.exe
  2⤵
  PID:2804
- C:\Windows\System\GOnEbMH.exe
  C:\Windows\System\GOnEbMH.exe
  2⤵
  PID:1248
- C:\Windows\System\tojWIEk.exe
  C:\Windows\System\tojWIEk.exe
  2⤵
  PID:1784
- C:\Windows\System\KtUtusP.exe
  C:\Windows\System\KtUtusP.exe
  2⤵
  PID:1452
- C:\Windows\System\eakhPYF.exe
  C:\Windows\System\eakhPYF.exe
  2⤵
  PID:2852
- C:\Windows\System\kMEBqBE.exe
  C:\Windows\System\kMEBqBE.exe
  2⤵
  PID:2668
- C:\Windows\System\iAuRuef.exe
  C:\Windows\System\iAuRuef.exe
  2⤵
  PID:2876
- C:\Windows\System\qiTqSFC.exe
  C:\Windows\System\qiTqSFC.exe
  2⤵
  PID:2924
- C:\Windows\System\ExBhtik.exe
  C:\Windows\System\ExBhtik.exe
  2⤵
  PID:2832
- C:\Windows\System\kCyobzm.exe
  C:\Windows\System\kCyobzm.exe
  2⤵
  PID:1840
- C:\Windows\System\HBpkVqb.exe
  C:\Windows\System\HBpkVqb.exe
  2⤵
  PID:2436
- C:\Windows\System\VkRNrxU.exe
  C:\Windows\System\VkRNrxU.exe
  2⤵
  PID:2992
- C:\Windows\System\EqLxEnb.exe
  C:\Windows\System\EqLxEnb.exe
  2⤵
  PID:2000
- C:\Windows\System\YtCaFVo.exe
  C:\Windows\System\YtCaFVo.exe
  2⤵
  PID:940
- C:\Windows\System\AKUvrgn.exe
  C:\Windows\System\AKUvrgn.exe
  2⤵
  PID:1520
- C:\Windows\System\YIlCLbV.exe
  C:\Windows\System\YIlCLbV.exe
  2⤵
  PID:2536
- C:\Windows\System\gEqJPST.exe
  C:\Windows\System\gEqJPST.exe
  2⤵
  PID:1984
- C:\Windows\System\OTpviZF.exe
  C:\Windows\System\OTpviZF.exe
  2⤵
  PID:1948
- C:\Windows\System\CeAVgex.exe
  C:\Windows\System\CeAVgex.exe
  2⤵
  PID:1316
- C:\Windows\System\oZYovTE.exe
  C:\Windows\System\oZYovTE.exe
  2⤵
  PID:1952
- C:\Windows\System\WhpOmon.exe
  C:\Windows\System\WhpOmon.exe
  2⤵
  PID:2712
- C:\Windows\System\ApTzJbg.exe
  C:\Windows\System\ApTzJbg.exe
  2⤵
  PID:1408
- C:\Windows\System\fDRozZT.exe
  C:\Windows\System\fDRozZT.exe
  2⤵
  PID:2756
- C:\Windows\System\ScukYqa.exe
  C:\Windows\System\ScukYqa.exe
  2⤵
  PID:892
- C:\Windows\System\EtXkgpe.exe
  C:\Windows\System\EtXkgpe.exe
  2⤵
  PID:1060
- C:\Windows\System\HlHtjkP.exe
  C:\Windows\System\HlHtjkP.exe
  2⤵
  PID:1664
- C:\Windows\System\ytJBJmH.exe
  C:\Windows\System\ytJBJmH.exe
  2⤵
  PID:1012
- C:\Windows\System\ldRBuxU.exe
  C:\Windows\System\ldRBuxU.exe
  2⤵
  PID:776
- C:\Windows\System\zsNYkRc.exe
  C:\Windows\System\zsNYkRc.exe
  2⤵
  PID:2532
- C:\Windows\System\NhJbiMb.exe
  C:\Windows\System\NhJbiMb.exe
  2⤵
  PID:2292
- C:\Windows\System\IBQXlPd.exe
  C:\Windows\System\IBQXlPd.exe
  2⤵
  PID:1728
- C:\Windows\System\tnweoAi.exe
  C:\Windows\System\tnweoAi.exe
  2⤵
  PID:2896
- C:\Windows\System\KXoMbjH.exe
  C:\Windows\System\KXoMbjH.exe
  2⤵
  PID:1492
- C:\Windows\System\nYiAIYr.exe
  C:\Windows\System\nYiAIYr.exe
  2⤵
  PID:2464
- C:\Windows\System\nYXCtRS.exe
  C:\Windows\System\nYXCtRS.exe
  2⤵
  PID:3036
- C:\Windows\System\SBFgHha.exe
  C:\Windows\System\SBFgHha.exe
  2⤵
  PID:2512
- C:\Windows\System\qsPKhiq.exe
  C:\Windows\System\qsPKhiq.exe
  2⤵
  PID:1432
- C:\Windows\System\UFTEddl.exe
  C:\Windows\System\UFTEddl.exe
  2⤵
  PID:2268
- C:\Windows\System\sxQbbhU.exe
  C:\Windows\System\sxQbbhU.exe
  2⤵
  PID:1304
- C:\Windows\System\pqCaDyq.exe
  C:\Windows\System\pqCaDyq.exe
  2⤵
  PID:856
- C:\Windows\System\DDNlzwi.exe
  C:\Windows\System\DDNlzwi.exe
  2⤵
  PID:340
- C:\Windows\System\OgPItMl.exe
  C:\Windows\System\OgPItMl.exe
  2⤵
  PID:1944
- C:\Windows\System\SFzEUQE.exe
  C:\Windows\System\SFzEUQE.exe
  2⤵
  PID:2444
- C:\Windows\System\ODjdCvm.exe
  C:\Windows\System\ODjdCvm.exe
  2⤵
  PID:1540
- C:\Windows\System\PkNXMBn.exe
  C:\Windows\System\PkNXMBn.exe
  2⤵
  PID:2160
- C:\Windows\System\HulvXUL.exe
  C:\Windows\System\HulvXUL.exe
  2⤵
  PID:1200
- C:\Windows\System\PaxEFVZ.exe
  C:\Windows\System\PaxEFVZ.exe
  2⤵
  PID:2232
- C:\Windows\System\bJFnZPc.exe
  C:\Windows\System\bJFnZPc.exe
  2⤵
  PID:2424
- C:\Windows\System\TDleSny.exe
  C:\Windows\System\TDleSny.exe
  2⤵
  PID:356
- C:\Windows\System\IIfPoOZ.exe
  C:\Windows\System\IIfPoOZ.exe
  2⤵
  PID:1488
- C:\Windows\System\BSaHqmi.exe
  C:\Windows\System\BSaHqmi.exe
  2⤵
  PID:2740
- C:\Windows\System\EuYCTyg.exe
  C:\Windows\System\EuYCTyg.exe
  2⤵
  PID:3080
- C:\Windows\System\NWHllxB.exe
  C:\Windows\System\NWHllxB.exe
  2⤵
  PID:3096
- C:\Windows\System\SfHYsRm.exe
  C:\Windows\System\SfHYsRm.exe
  2⤵
  PID:3112
- C:\Windows\System\iDSTnRd.exe
  C:\Windows\System\iDSTnRd.exe
  2⤵
  PID:3128
- C:\Windows\System\eFPNGOm.exe
  C:\Windows\System\eFPNGOm.exe
  2⤵
  PID:3144
- C:\Windows\System\MEHNuCC.exe
  C:\Windows\System\MEHNuCC.exe
  2⤵
  PID:3160
- C:\Windows\System\vZQveBH.exe
  C:\Windows\System\vZQveBH.exe
  2⤵
  PID:3176
- C:\Windows\System\pwBIbxv.exe
  C:\Windows\System\pwBIbxv.exe
  2⤵
  PID:3196
- C:\Windows\System\JVCKQjD.exe
  C:\Windows\System\JVCKQjD.exe
  2⤵
  PID:3212
- C:\Windows\System\rAIgJAv.exe
  C:\Windows\System\rAIgJAv.exe
  2⤵
  PID:3228
- C:\Windows\System\cTfnIRF.exe
  C:\Windows\System\cTfnIRF.exe
  2⤵
  PID:3244
- C:\Windows\System\pPilNoZ.exe
  C:\Windows\System\pPilNoZ.exe
  2⤵
  PID:3260
- C:\Windows\System\PhonIKa.exe
  C:\Windows\System\PhonIKa.exe
  2⤵
  PID:3276
- C:\Windows\System\TVXcXaQ.exe
  C:\Windows\System\TVXcXaQ.exe
  2⤵
  PID:3296
- C:\Windows\System\vIvVALp.exe
  C:\Windows\System\vIvVALp.exe
  2⤵
  PID:3312
- C:\Windows\System\ComEjCi.exe
  C:\Windows\System\ComEjCi.exe
  2⤵
  PID:3328
- C:\Windows\System\ltbdOOd.exe
  C:\Windows\System\ltbdOOd.exe
  2⤵
  PID:3344
- C:\Windows\System\wjBIrQJ.exe
  C:\Windows\System\wjBIrQJ.exe
  2⤵
  PID:3360
- C:\Windows\System\NgBcJuy.exe
  C:\Windows\System\NgBcJuy.exe
  2⤵
  PID:3376
- C:\Windows\System\DCsvSoN.exe
  C:\Windows\System\DCsvSoN.exe
  2⤵
  PID:3392
- C:\Windows\System\NaUXtzp.exe
  C:\Windows\System\NaUXtzp.exe
  2⤵
  PID:3408
- C:\Windows\System\tRHvOxU.exe
  C:\Windows\System\tRHvOxU.exe
  2⤵
  PID:3428
- C:\Windows\System\hbUxaaj.exe
  C:\Windows\System\hbUxaaj.exe
  2⤵
  PID:3444
- C:\Windows\System\JZItlim.exe
  C:\Windows\System\JZItlim.exe
  2⤵
  PID:3460
- C:\Windows\System\cwZlidY.exe
  C:\Windows\System\cwZlidY.exe
  2⤵
  PID:3476
- C:\Windows\System\JDPKqhm.exe
  C:\Windows\System\JDPKqhm.exe
  2⤵
  PID:3492
- C:\Windows\System\KirHxtX.exe
  C:\Windows\System\KirHxtX.exe
  2⤵
  PID:3508
- C:\Windows\System\lNzaqqO.exe
  C:\Windows\System\lNzaqqO.exe
  2⤵
  PID:3524
- C:\Windows\System\zmxkNus.exe
  C:\Windows\System\zmxkNus.exe
  2⤵
  PID:3540
- C:\Windows\System\aqJOApa.exe
  C:\Windows\System\aqJOApa.exe
  2⤵
  PID:3648
- C:\Windows\System\ESNJKxM.exe
  C:\Windows\System\ESNJKxM.exe
  2⤵
  PID:3664
- C:\Windows\System\HpJkZoD.exe
  C:\Windows\System\HpJkZoD.exe
  2⤵
  PID:3680
- C:\Windows\System\BoDkzcp.exe
  C:\Windows\System\BoDkzcp.exe
  2⤵
  PID:3696
- C:\Windows\System\HgmzSGe.exe
  C:\Windows\System\HgmzSGe.exe
  2⤵
  PID:3712
- C:\Windows\System\JbzQoyv.exe
  C:\Windows\System\JbzQoyv.exe
  2⤵
  PID:3728
- C:\Windows\System\vlsjYwt.exe
  C:\Windows\System\vlsjYwt.exe
  2⤵
  PID:3744
- C:\Windows\System\CPlhmTK.exe
  C:\Windows\System\CPlhmTK.exe
  2⤵
  PID:3760
- C:\Windows\System\IRqsgly.exe
  C:\Windows\System\IRqsgly.exe
  2⤵
  PID:3776
- C:\Windows\System\OvDVHNT.exe
  C:\Windows\System\OvDVHNT.exe
  2⤵
  PID:3792
- C:\Windows\System\HYORulC.exe
  C:\Windows\System\HYORulC.exe
  2⤵
  PID:3808
- C:\Windows\System\xOlUhDS.exe
  C:\Windows\System\xOlUhDS.exe
  2⤵
  PID:3824
- C:\Windows\System\nfpEwSv.exe
  C:\Windows\System\nfpEwSv.exe
  2⤵
  PID:3840
- C:\Windows\System\uRVjbLL.exe
  C:\Windows\System\uRVjbLL.exe
  2⤵
  PID:3856
- C:\Windows\System\LHLqMPr.exe
  C:\Windows\System\LHLqMPr.exe
  2⤵
  PID:3872
- C:\Windows\System\wQtjsFB.exe
  C:\Windows\System\wQtjsFB.exe
  2⤵
  PID:3888
- C:\Windows\System\RKqkftr.exe
  C:\Windows\System\RKqkftr.exe
  2⤵
  PID:3904
- C:\Windows\System\YozaObr.exe
  C:\Windows\System\YozaObr.exe
  2⤵
  PID:3920
- C:\Windows\System\GRpTAcE.exe
  C:\Windows\System\GRpTAcE.exe
  2⤵
  PID:3936
- C:\Windows\System\DUuyeXj.exe
  C:\Windows\System\DUuyeXj.exe
  2⤵
  PID:3952
- C:\Windows\System\qizIgcG.exe
  C:\Windows\System\qizIgcG.exe
  2⤵
  PID:3968
- C:\Windows\System\NqMLAMn.exe
  C:\Windows\System\NqMLAMn.exe
  2⤵
  PID:3996
- C:\Windows\System\RQpwQtn.exe
  C:\Windows\System\RQpwQtn.exe
  2⤵
  PID:4012
- C:\Windows\System\rGNxaxx.exe
  C:\Windows\System\rGNxaxx.exe
  2⤵
  PID:4028
- C:\Windows\System\BKZquHF.exe
  C:\Windows\System\BKZquHF.exe
  2⤵
  PID:4044
- C:\Windows\System\hZZArNa.exe
  C:\Windows\System\hZZArNa.exe
  2⤵
  PID:4060
- C:\Windows\System\EYgNdMt.exe
  C:\Windows\System\EYgNdMt.exe
  2⤵
  PID:4076
- C:\Windows\System\lQfxSBk.exe
  C:\Windows\System\lQfxSBk.exe
  2⤵
  PID:4092
- C:\Windows\System\xXNQoWI.exe
  C:\Windows\System\xXNQoWI.exe
  2⤵
  PID:2384
- C:\Windows\System\zfHCqFU.exe
  C:\Windows\System\zfHCqFU.exe
  2⤵
  PID:2264
- C:\Windows\System\WldZLPA.exe
  C:\Windows\System\WldZLPA.exe
  2⤵
  PID:2480
- C:\Windows\System\EmqWdxd.exe
  C:\Windows\System\EmqWdxd.exe
  2⤵
  PID:3124
- C:\Windows\System\FGALIJe.exe
  C:\Windows\System\FGALIJe.exe
  2⤵
  PID:3192
- C:\Windows\System\HdseKpm.exe
  C:\Windows\System\HdseKpm.exe
  2⤵
  PID:3256
- C:\Windows\System\FmecHdR.exe
  C:\Windows\System\FmecHdR.exe
  2⤵
  PID:3320
- C:\Windows\System\DMlMuTX.exe
  C:\Windows\System\DMlMuTX.exe
  2⤵
  PID:676
- C:\Windows\System\XwkxxBA.exe
  C:\Windows\System\XwkxxBA.exe
  2⤵
  PID:1704
- C:\Windows\System\HJfNrmf.exe
  C:\Windows\System\HJfNrmf.exe
  2⤵
  PID:3076
- C:\Windows\System\yqVadev.exe
  C:\Windows\System\yqVadev.exe
  2⤵
  PID:3468
- C:\Windows\System\MMlYnoe.exe
  C:\Windows\System\MMlYnoe.exe
  2⤵
  PID:3400
- C:\Windows\System\GQlDwjZ.exe
  C:\Windows\System\GQlDwjZ.exe
  2⤵
  PID:3336
- C:\Windows\System\YfGSqHP.exe
  C:\Windows\System\YfGSqHP.exe
  2⤵
  PID:3208
- C:\Windows\System\nFPlaTQ.exe
  C:\Windows\System\nFPlaTQ.exe
  2⤵
  PID:3304
- C:\Windows\System\xYKVwAK.exe
  C:\Windows\System\xYKVwAK.exe
  2⤵
  PID:3168
- C:\Windows\System\PdGNmcQ.exe
  C:\Windows\System\PdGNmcQ.exe
  2⤵
  PID:3504
- C:\Windows\System\eKlRnph.exe
  C:\Windows\System\eKlRnph.exe
  2⤵
  PID:3660
- C:\Windows\System\SMaamtn.exe
  C:\Windows\System\SMaamtn.exe
  2⤵
  PID:2140
- C:\Windows\System\XILxmqM.exe
  C:\Windows\System\XILxmqM.exe
  2⤵
  PID:3552
- C:\Windows\System\gyxQEex.exe
  C:\Windows\System\gyxQEex.exe
  2⤵
  PID:3568
- C:\Windows\System\RAdrkNW.exe
  C:\Windows\System\RAdrkNW.exe
  2⤵
  PID:3580
- C:\Windows\System\ESXPhvI.exe
  C:\Windows\System\ESXPhvI.exe
  2⤵
  PID:3592
- C:\Windows\System\LjCwPQp.exe
  C:\Windows\System\LjCwPQp.exe
  2⤵
  PID:3608
- C:\Windows\System\GNQNVzl.exe
  C:\Windows\System\GNQNVzl.exe
  2⤵
  PID:3624
- C:\Windows\System\UuuvtfS.exe
  C:\Windows\System\UuuvtfS.exe
  2⤵
  PID:3640
- C:\Windows\System\AzFwgvl.exe
  C:\Windows\System\AzFwgvl.exe
  2⤵
  PID:3416
- C:\Windows\System\SSSxanj.exe
  C:\Windows\System\SSSxanj.exe
  2⤵
  PID:3452
- C:\Windows\System\pjYlkBZ.exe
  C:\Windows\System\pjYlkBZ.exe
  2⤵
  PID:3704
- C:\Windows\System\KIJktkg.exe
  C:\Windows\System\KIJktkg.exe
  2⤵
  PID:3720
- C:\Windows\System\MGGHPuV.exe
  C:\Windows\System\MGGHPuV.exe
  2⤵
  PID:3784
- C:\Windows\System\LKisyJC.exe
  C:\Windows\System\LKisyJC.exe
  2⤵
  PID:3896
- C:\Windows\System\jwYxyVp.exe
  C:\Windows\System\jwYxyVp.exe
  2⤵
  PID:3960
- C:\Windows\System\ciPsGzL.exe
  C:\Windows\System\ciPsGzL.exe
  2⤵
  PID:3768
- C:\Windows\System\ejtpmEN.exe
  C:\Windows\System\ejtpmEN.exe
  2⤵
  PID:4004
- C:\Windows\System\ExDEvzw.exe
  C:\Windows\System\ExDEvzw.exe
  2⤵
  PID:3988
- C:\Windows\System\nSxbmZT.exe
  C:\Windows\System\nSxbmZT.exe
  2⤵
  PID:4068
- C:\Windows\System\TVrpavc.exe
  C:\Windows\System\TVrpavc.exe
  2⤵
  PID:4088
- C:\Windows\System\lilcGdq.exe
  C:\Windows\System\lilcGdq.exe
  2⤵
  PID:4052
- C:\Windows\System\xmyfMdT.exe
  C:\Windows\System\xmyfMdT.exe
  2⤵
  PID:3092
- C:\Windows\System\kbKKJux.exe
  C:\Windows\System\kbKKJux.exe
  2⤵
  PID:1880
- C:\Windows\System\qGTiHdR.exe
  C:\Windows\System\qGTiHdR.exe
  2⤵
  PID:3404
- C:\Windows\System\mlmdPzU.exe
  C:\Windows\System\mlmdPzU.exe
  2⤵
  PID:3272
- C:\Windows\System\KPWHavC.exe
  C:\Windows\System\KPWHavC.exe
  2⤵
  PID:3548
- C:\Windows\System\gEKQASN.exe
  C:\Windows\System\gEKQASN.exe
  2⤵
  PID:956
- C:\Windows\System\uZkuSVf.exe
  C:\Windows\System\uZkuSVf.exe
  2⤵
  PID:3340
- C:\Windows\System\pfdvWfi.exe
  C:\Windows\System\pfdvWfi.exe
  2⤵
  PID:484
- C:\Windows\System\YKRDMta.exe
  C:\Windows\System\YKRDMta.exe
  2⤵
  PID:1780
- C:\Windows\System\cKseiVv.exe
  C:\Windows\System\cKseiVv.exe
  2⤵
  PID:3560
- C:\Windows\System\WnSYxPK.exe
  C:\Windows\System\WnSYxPK.exe
  2⤵
  PID:3588
- C:\Windows\System\dvZxAZE.exe
  C:\Windows\System\dvZxAZE.exe
  2⤵
  PID:3604
- C:\Windows\System\QNJWYdR.exe
  C:\Windows\System\QNJWYdR.exe
  2⤵
  PID:3692
- C:\Windows\System\mEBEFPy.exe
  C:\Windows\System\mEBEFPy.exe
  2⤵
  PID:3676
- C:\Windows\System\TqOJsAW.exe
  C:\Windows\System\TqOJsAW.exe
  2⤵
  PID:3852
- C:\Windows\System\vKhNhzl.exe
  C:\Windows\System\vKhNhzl.exe
  2⤵
  PID:2564
- C:\Windows\System\PaPbZaO.exe
  C:\Windows\System\PaPbZaO.exe
  2⤵
  PID:3976
- C:\Windows\System\AMtPqUy.exe
  C:\Windows\System\AMtPqUy.exe
  2⤵
  PID:3864
- C:\Windows\System\wCxhBrw.exe
  C:\Windows\System\wCxhBrw.exe
  2⤵
  PID:3984
- C:\Windows\System\JezteCQ.exe
  C:\Windows\System\JezteCQ.exe
  2⤵
  PID:1404
- C:\Windows\System\aTfWTyA.exe
  C:\Windows\System\aTfWTyA.exe
  2⤵
  PID:3520
- C:\Windows\System\fIImLXy.exe
  C:\Windows\System\fIImLXy.exe
  2⤵
  PID:352
- C:\Windows\System\FmVuVAI.exe
  C:\Windows\System\FmVuVAI.exe
  2⤵
  PID:3384
- C:\Windows\System\gvGwpbf.exe
  C:\Windows\System\gvGwpbf.exe
  2⤵
  PID:3688
- C:\Windows\System\mjYITEw.exe
  C:\Windows\System\mjYITEw.exe
  2⤵
  PID:3800
- C:\Windows\System\PijMCmp.exe
  C:\Windows\System\PijMCmp.exe
  2⤵
  PID:3120
- C:\Windows\System\qyKVuaT.exe
  C:\Windows\System\qyKVuaT.exe
  2⤵
  PID:3308
- C:\Windows\System\gySySFl.exe
  C:\Windows\System\gySySFl.exe
  2⤵
  PID:2396
- C:\Windows\System\lsNuEND.exe
  C:\Windows\System\lsNuEND.exe
  2⤵
  PID:3620
- C:\Windows\System\pnPQSno.exe
  C:\Windows\System\pnPQSno.exe
  2⤵
  PID:3836
- C:\Windows\System\DeLzbnQ.exe
  C:\Windows\System\DeLzbnQ.exe
  2⤵
  PID:3368
- C:\Windows\System\lrtDbrH.exe
  C:\Windows\System\lrtDbrH.exe
  2⤵
  PID:3756
- C:\Windows\System\gdjduRt.exe
  C:\Windows\System\gdjduRt.exe
  2⤵
  PID:3816
- C:\Windows\System\rbajQOn.exe
  C:\Windows\System\rbajQOn.exe
  2⤵
  PID:3880
- C:\Windows\System\bWvaHsJ.exe
  C:\Windows\System\bWvaHsJ.exe
  2⤵
  PID:3980
- C:\Windows\System\pQoLcXw.exe
  C:\Windows\System\pQoLcXw.exe
  2⤵
  PID:3536
- C:\Windows\System\kohOPRO.exe
  C:\Windows\System\kohOPRO.exe
  2⤵
  PID:3108
- C:\Windows\System\vyyZnwe.exe
  C:\Windows\System\vyyZnwe.exe
  2⤵
  PID:3424
- C:\Windows\System\XVzKREQ.exe
  C:\Windows\System\XVzKREQ.exe
  2⤵
  PID:3252
- C:\Windows\System\OmHHcEa.exe
  C:\Windows\System\OmHHcEa.exe
  2⤵
  PID:2476
- C:\Windows\System\zZJTYAv.exe
  C:\Windows\System\zZJTYAv.exe
  2⤵
  PID:4104
- C:\Windows\System\dmSMaWy.exe
  C:\Windows\System\dmSMaWy.exe
  2⤵
  PID:4120
- C:\Windows\System\wsrcrSb.exe
  C:\Windows\System\wsrcrSb.exe
  2⤵
  PID:4136
- C:\Windows\System\JwnqZrv.exe
  C:\Windows\System\JwnqZrv.exe
  2⤵
  PID:4152
- C:\Windows\System\zbUtOOd.exe
  C:\Windows\System\zbUtOOd.exe
  2⤵
  PID:4168
- C:\Windows\System\ptQHyyN.exe
  C:\Windows\System\ptQHyyN.exe
  2⤵
  PID:4188
- C:\Windows\System\xXCrDyU.exe
  C:\Windows\System\xXCrDyU.exe
  2⤵
  PID:4204
- C:\Windows\System\rzKkanh.exe
  C:\Windows\System\rzKkanh.exe
  2⤵
  PID:4220
- C:\Windows\System\JViDtsP.exe
  C:\Windows\System\JViDtsP.exe
  2⤵
  PID:4292
- C:\Windows\System\CDyPHNd.exe
  C:\Windows\System\CDyPHNd.exe
  2⤵
  PID:4312
- C:\Windows\System\fLzJntX.exe
  C:\Windows\System\fLzJntX.exe
  2⤵
  PID:4328
- C:\Windows\System\jzLteiv.exe
  C:\Windows\System\jzLteiv.exe
  2⤵
  PID:4344
- C:\Windows\System\HzbobSe.exe
  C:\Windows\System\HzbobSe.exe
  2⤵
  PID:4360
- C:\Windows\System\ggSbfpx.exe
  C:\Windows\System\ggSbfpx.exe
  2⤵
  PID:4376
- C:\Windows\System\dtMliBJ.exe
  C:\Windows\System\dtMliBJ.exe
  2⤵
  PID:4392
- C:\Windows\System\IoqGBfF.exe
  C:\Windows\System\IoqGBfF.exe
  2⤵
  PID:4408
- C:\Windows\System\sLasEOL.exe
  C:\Windows\System\sLasEOL.exe
  2⤵
  PID:4424
- C:\Windows\System\iCrhSoY.exe
  C:\Windows\System\iCrhSoY.exe
  2⤵
  PID:4440
- C:\Windows\System\dsjUVgx.exe
  C:\Windows\System\dsjUVgx.exe
  2⤵
  PID:4456
- C:\Windows\System\FAoDTrJ.exe
  C:\Windows\System\FAoDTrJ.exe
  2⤵
  PID:4472
- C:\Windows\System\KZHZnnv.exe
  C:\Windows\System\KZHZnnv.exe
  2⤵
  PID:4488
- C:\Windows\System\zdUDtWq.exe
  C:\Windows\System\zdUDtWq.exe
  2⤵
  PID:4504
- C:\Windows\System\YJzjxJr.exe
  C:\Windows\System\YJzjxJr.exe
  2⤵
  PID:4520
- C:\Windows\System\FzCdyAd.exe
  C:\Windows\System\FzCdyAd.exe
  2⤵
  PID:4536
- C:\Windows\System\kyeenEM.exe
  C:\Windows\System\kyeenEM.exe
  2⤵
  PID:4552
- C:\Windows\System\eacrQRc.exe
  C:\Windows\System\eacrQRc.exe
  2⤵
  PID:4568
- C:\Windows\System\qlnPARs.exe
  C:\Windows\System\qlnPARs.exe
  2⤵
  PID:4584
- C:\Windows\System\lNVuOuW.exe
  C:\Windows\System\lNVuOuW.exe
  2⤵
  PID:4600
- C:\Windows\System\IrhziGS.exe
  C:\Windows\System\IrhziGS.exe
  2⤵
  PID:4616
- C:\Windows\System\PuFoCfp.exe
  C:\Windows\System\PuFoCfp.exe
  2⤵
  PID:4632
- C:\Windows\System\HnXphrI.exe
  C:\Windows\System\HnXphrI.exe
  2⤵
  PID:4648
- C:\Windows\System\pjGCKDx.exe
  C:\Windows\System\pjGCKDx.exe
  2⤵
  PID:4664
- C:\Windows\System\SJoRhxx.exe
  C:\Windows\System\SJoRhxx.exe
  2⤵
  PID:4680
- C:\Windows\System\WmJKMLK.exe
  C:\Windows\System\WmJKMLK.exe
  2⤵
  PID:4696
- C:\Windows\System\AousjIj.exe
  C:\Windows\System\AousjIj.exe
  2⤵
  PID:4716
- C:\Windows\System\afUjeHv.exe
  C:\Windows\System\afUjeHv.exe
  2⤵
  PID:4732
- C:\Windows\System\JHfKKQp.exe
  C:\Windows\System\JHfKKQp.exe
  2⤵
  PID:4748
- C:\Windows\System\rhPzTRS.exe
  C:\Windows\System\rhPzTRS.exe
  2⤵
  PID:4764
- C:\Windows\System\nkoiYEq.exe
  C:\Windows\System\nkoiYEq.exe
  2⤵
  PID:4784
- C:\Windows\System\MInNKYr.exe
  C:\Windows\System\MInNKYr.exe
  2⤵
  PID:4800
- C:\Windows\System\Vnxgmdo.exe
  C:\Windows\System\Vnxgmdo.exe
  2⤵
  PID:4816
- C:\Windows\System\aXCITCi.exe
  C:\Windows\System\aXCITCi.exe
  2⤵
  PID:4832
- C:\Windows\System\CAuLbYn.exe
  C:\Windows\System\CAuLbYn.exe
  2⤵
  PID:4848
- C:\Windows\System\RjZWBUP.exe
  C:\Windows\System\RjZWBUP.exe
  2⤵
  PID:4864
- C:\Windows\System\uYzMzCr.exe
  C:\Windows\System\uYzMzCr.exe
  2⤵
  PID:4880
- C:\Windows\System\oMIZBbB.exe
  C:\Windows\System\oMIZBbB.exe
  2⤵
  PID:4896
- C:\Windows\System\OsrlDeV.exe
  C:\Windows\System\OsrlDeV.exe
  2⤵
  PID:4912
- C:\Windows\System\BnfdUAY.exe
  C:\Windows\System\BnfdUAY.exe
  2⤵
  PID:4936
- C:\Windows\System\gyNLFvl.exe
  C:\Windows\System\gyNLFvl.exe
  2⤵
  PID:4952
- C:\Windows\System\LqUVroz.exe
  C:\Windows\System\LqUVroz.exe
  2⤵
  PID:4968
- C:\Windows\System\ZQcrzYN.exe
  C:\Windows\System\ZQcrzYN.exe
  2⤵
  PID:4984
- C:\Windows\System\ZiHCpgM.exe
  C:\Windows\System\ZiHCpgM.exe
  2⤵
  PID:5000
- C:\Windows\System\beXwqpd.exe
  C:\Windows\System\beXwqpd.exe
  2⤵
  PID:5016
- C:\Windows\System\coTgmaQ.exe
  C:\Windows\System\coTgmaQ.exe
  2⤵
  PID:5036
- C:\Windows\System\YgolHYW.exe
  C:\Windows\System\YgolHYW.exe
  2⤵
  PID:5052
- C:\Windows\System\rsaTqEG.exe
  C:\Windows\System\rsaTqEG.exe
  2⤵
  PID:5068
- C:\Windows\System\ZYEKDUU.exe
  C:\Windows\System\ZYEKDUU.exe
  2⤵
  PID:5084
- C:\Windows\System\kLraifm.exe
  C:\Windows\System\kLraifm.exe
  2⤵
  PID:5100
- C:\Windows\System\GCMrciZ.exe
  C:\Windows\System\GCMrciZ.exe
  2⤵
  PID:5116
- C:\Windows\System\HonBART.exe
  C:\Windows\System\HonBART.exe
  2⤵
  PID:4112
- C:\Windows\System\MQfETtO.exe
  C:\Windows\System\MQfETtO.exe
  2⤵
  PID:1624
- C:\Windows\System\kHMeEBm.exe
  C:\Windows\System\kHMeEBm.exe
  2⤵
  PID:3352
- C:\Windows\System\GoZILcU.exe
  C:\Windows\System\GoZILcU.exe
  2⤵
  PID:3912
- C:\Windows\System\mAWnZAz.exe
  C:\Windows\System\mAWnZAz.exe
  2⤵
  PID:4084
- C:\Windows\System\JFplNyK.exe
  C:\Windows\System\JFplNyK.exe
  2⤵
  PID:4020
- C:\Windows\System\glEcZTv.exe
  C:\Windows\System\glEcZTv.exe
  2⤵
  PID:4128
- C:\Windows\System\YAKmBfv.exe
  C:\Windows\System\YAKmBfv.exe
  2⤵
  PID:4200
- C:\Windows\System\MPwWFZo.exe
  C:\Windows\System\MPwWFZo.exe
  2⤵
  PID:4240
- C:\Windows\System\draSyPX.exe
  C:\Windows\System\draSyPX.exe
  2⤵
  PID:4256
- C:\Windows\System\uPOWtvy.exe
  C:\Windows\System\uPOWtvy.exe
  2⤵
  PID:4272
- C:\Windows\System\NQQdBtJ.exe
  C:\Windows\System\NQQdBtJ.exe
  2⤵
  PID:4336
- C:\Windows\System\DaXXudH.exe
  C:\Windows\System\DaXXudH.exe
  2⤵
  PID:4432
- C:\Windows\System\RxJCYLo.exe
  C:\Windows\System\RxJCYLo.exe
  2⤵
  PID:4400
- C:\Windows\System\AqNTotN.exe
  C:\Windows\System\AqNTotN.exe
  2⤵
  PID:4500
- C:\Windows\System\ROwrZDP.exe
  C:\Windows\System\ROwrZDP.exe
  2⤵
  PID:4596
- C:\Windows\System\CRVFNXU.exe
  C:\Windows\System\CRVFNXU.exe
  2⤵
  PID:4660
- C:\Windows\System\WhCZjrh.exe
  C:\Windows\System\WhCZjrh.exe
  2⤵
  PID:4728
- C:\Windows\System\eATcwmj.exe
  C:\Windows\System\eATcwmj.exe
  2⤵
  PID:4672
- C:\Windows\System\ZrlbXsL.exe
  C:\Windows\System\ZrlbXsL.exe
  2⤵
  PID:4280
- C:\Windows\System\eKDPSft.exe
  C:\Windows\System\eKDPSft.exe
  2⤵
  PID:4448
- C:\Windows\System\JTTjbUS.exe
  C:\Windows\System\JTTjbUS.exe
  2⤵
  PID:4796
- C:\Windows\System\uolrVSA.exe
  C:\Windows\System\uolrVSA.exe
  2⤵
  PID:4452
- C:\Windows\System\uVcAZzG.exe
  C:\Windows\System\uVcAZzG.exe
  2⤵
  PID:4480
- C:\Windows\System\THrdtmX.exe
  C:\Windows\System\THrdtmX.exe
  2⤵
  PID:4860
- C:\Windows\System\RSZfvCv.exe
  C:\Windows\System\RSZfvCv.exe
  2⤵
  PID:4928
- C:\Windows\System\mrIbmzj.exe
  C:\Windows\System\mrIbmzj.exe
  2⤵
  PID:4712
- C:\Windows\System\etNevVL.exe
  C:\Windows\System\etNevVL.exe
  2⤵
  PID:4580
- C:\Windows\System\ZcCFxio.exe
  C:\Windows\System\ZcCFxio.exe
  2⤵
  PID:4808
- C:\Windows\System\zgdtSTv.exe
  C:\Windows\System\zgdtSTv.exe
  2⤵
  PID:4776
- C:\Windows\System\VCURZDQ.exe
  C:\Windows\System\VCURZDQ.exe
  2⤵
  PID:4840
- C:\Windows\System\omArlOp.exe
  C:\Windows\System\omArlOp.exe
  2⤵
  PID:4908
- C:\Windows\System\qeUXLnm.exe
  C:\Windows\System\qeUXLnm.exe
  2⤵
  PID:4992
- C:\Windows\System\bsWRJHK.exe
  C:\Windows\System\bsWRJHK.exe
  2⤵
  PID:5060
- C:\Windows\System\ZuxDdpI.exe
  C:\Windows\System\ZuxDdpI.exe
  2⤵
  PID:3156
- C:\Windows\System\JzhmWUc.exe
  C:\Windows\System\JzhmWUc.exe
  2⤵
  PID:4100
- C:\Windows\System\uHumQGJ.exe
  C:\Windows\System\uHumQGJ.exe
  2⤵
  PID:4236
- C:\Windows\System\EeUrLgl.exe
  C:\Windows\System\EeUrLgl.exe
  2⤵
  PID:4944
- C:\Windows\System\JeorYXd.exe
  C:\Windows\System\JeorYXd.exe
  2⤵
  PID:4980
- C:\Windows\System\SEzIvKS.exe
  C:\Windows\System\SEzIvKS.exe
  2⤵
  PID:5076
- C:\Windows\System\eZnZEdw.exe
  C:\Windows\System\eZnZEdw.exe
  2⤵
  PID:4144
- C:\Windows\System\bNOYLVt.exe
  C:\Windows\System\bNOYLVt.exe
  2⤵
  PID:3600
- C:\Windows\System\KEtyvZl.exe
  C:\Windows\System\KEtyvZl.exe
  2⤵
  PID:4196
- C:\Windows\System\AiwNMaK.exe
  C:\Windows\System\AiwNMaK.exe
  2⤵
  PID:4468
- C:\Windows\System\nLPnZHt.exe
  C:\Windows\System\nLPnZHt.exe
  2⤵
  PID:4308
- C:\Windows\System\weOlopj.exe
  C:\Windows\System\weOlopj.exe
  2⤵
  PID:4656
- C:\Windows\System\aGATIUu.exe
  C:\Windows\System\aGATIUu.exe
  2⤵
  PID:4756
- C:\Windows\System\QRwMhoU.exe
  C:\Windows\System\QRwMhoU.exe
  2⤵
  PID:4388
- C:\Windows\System\vrnGNeN.exe
  C:\Windows\System\vrnGNeN.exe
  2⤵
  PID:4892
- C:\Windows\System\fyoYvhi.exe
  C:\Windows\System\fyoYvhi.exe
  2⤵
  PID:4708
- C:\Windows\System\QzUMkZK.exe
  C:\Windows\System\QzUMkZK.exe
  2⤵
  PID:4544
- C:\Windows\System\FvXaTjv.exe
  C:\Windows\System\FvXaTjv.exe
  2⤵
  PID:4180
- C:\Windows\System\zwqnqry.exe
  C:\Windows\System\zwqnqry.exe
  2⤵
  PID:5012
- C:\Windows\System\IHqOYnF.exe
  C:\Windows\System\IHqOYnF.exe
  2⤵
  PID:4612
- C:\Windows\System\jDqAoBY.exe
  C:\Windows\System\jDqAoBY.exe
  2⤵
  PID:4148
- C:\Windows\System\LgnEZLk.exe
  C:\Windows\System\LgnEZLk.exe
  2⤵
  PID:3576
- C:\Windows\System\VAcqeAi.exe
  C:\Windows\System\VAcqeAi.exe
  2⤵
  PID:1556
- C:\Windows\System\XsaHbCj.exe
  C:\Windows\System\XsaHbCj.exe
  2⤵
  PID:4976
- C:\Windows\System\jjKwzZq.exe
  C:\Windows\System\jjKwzZq.exe
  2⤵
  PID:5008
- C:\Windows\System\iDzVfzr.exe
  C:\Windows\System\iDzVfzr.exe
  2⤵
  PID:4592
- C:\Windows\System\iysdtHh.exe
  C:\Windows\System\iysdtHh.exe
  2⤵
  PID:4844
- C:\Windows\System\NiWudHW.exe
  C:\Windows\System\NiWudHW.exe
  2⤵
  PID:5160
- C:\Windows\System\qwbgrWt.exe
  C:\Windows\System\qwbgrWt.exe
  2⤵
  PID:5244
- C:\Windows\System\FAgQKBQ.exe
  C:\Windows\System\FAgQKBQ.exe
  2⤵
  PID:5260
- C:\Windows\System\AHWeSrQ.exe
  C:\Windows\System\AHWeSrQ.exe
  2⤵
  PID:5276
- C:\Windows\System\BxbZJEG.exe
  C:\Windows\System\BxbZJEG.exe
  2⤵
  PID:5292
- C:\Windows\System\gTiXRMP.exe
  C:\Windows\System\gTiXRMP.exe
  2⤵
  PID:5308
- C:\Windows\System\rHGXgGt.exe
  C:\Windows\System\rHGXgGt.exe
  2⤵
  PID:5324
- C:\Windows\System\rzqMJit.exe
  C:\Windows\System\rzqMJit.exe
  2⤵
  PID:5340
- C:\Windows\System\yIJbMYw.exe
  C:\Windows\System\yIJbMYw.exe
  2⤵
  PID:5360
- C:\Windows\System\HDofzLZ.exe
  C:\Windows\System\HDofzLZ.exe
  2⤵
  PID:5376
- C:\Windows\System\TDsvHtd.exe
  C:\Windows\System\TDsvHtd.exe
  2⤵
  PID:5392
- C:\Windows\System\GwRavoM.exe
  C:\Windows\System\GwRavoM.exe
  2⤵
  PID:5408
- C:\Windows\System\UIvhFYl.exe
  C:\Windows\System\UIvhFYl.exe
  2⤵
  PID:5424
- C:\Windows\System\ZEhNxlu.exe
  C:\Windows\System\ZEhNxlu.exe
  2⤵
  PID:5440
- C:\Windows\System\nEhhqHD.exe
  C:\Windows\System\nEhhqHD.exe
  2⤵
  PID:5460
- C:\Windows\System\UNDItOt.exe
  C:\Windows\System\UNDItOt.exe
  2⤵
  PID:5476
- C:\Windows\System\tfldIMK.exe
  C:\Windows\System\tfldIMK.exe
  2⤵
  PID:5492
- C:\Windows\System\qqPpUcR.exe
  C:\Windows\System\qqPpUcR.exe
  2⤵
  PID:5508
- C:\Windows\System\igpgIWu.exe
  C:\Windows\System\igpgIWu.exe
  2⤵
  PID:5528
- C:\Windows\System\gtshSfi.exe
  C:\Windows\System\gtshSfi.exe
  2⤵
  PID:5544
- C:\Windows\System\GHzQCoF.exe
  C:\Windows\System\GHzQCoF.exe
  2⤵
  PID:5560
- C:\Windows\System\AKdtqbY.exe
  C:\Windows\System\AKdtqbY.exe
  2⤵
  PID:5576
- C:\Windows\System\KaITLiY.exe
  C:\Windows\System\KaITLiY.exe
  2⤵
  PID:5592
- C:\Windows\System\MxHOluI.exe
  C:\Windows\System\MxHOluI.exe
  2⤵
  PID:5612
- C:\Windows\System\ZlgxeeL.exe
  C:\Windows\System\ZlgxeeL.exe
  2⤵
  PID:5628
- C:\Windows\System\zztDDGI.exe
  C:\Windows\System\zztDDGI.exe
  2⤵
  PID:5644
- C:\Windows\System\hhsIeho.exe
  C:\Windows\System\hhsIeho.exe
  2⤵
  PID:5660
- C:\Windows\System\VZqfxCc.exe
  C:\Windows\System\VZqfxCc.exe
  2⤵
  PID:5676
- C:\Windows\System\JjBbqjn.exe
  C:\Windows\System\JjBbqjn.exe
  2⤵
  PID:5692
- C:\Windows\System\gXbzLxi.exe
  C:\Windows\System\gXbzLxi.exe
  2⤵
  PID:5712
- C:\Windows\System\gGtXEDz.exe
  C:\Windows\System\gGtXEDz.exe
  2⤵
  PID:5728
- C:\Windows\System\OmoVrPv.exe
  C:\Windows\System\OmoVrPv.exe
  2⤵
  PID:5744
- C:\Windows\System\gNZPzyv.exe
  C:\Windows\System\gNZPzyv.exe
  2⤵
  PID:5760
- C:\Windows\System\avONqnn.exe
  C:\Windows\System\avONqnn.exe
  2⤵
  PID:5776
- C:\Windows\System\OGEIMLN.exe
  C:\Windows\System\OGEIMLN.exe
  2⤵
  PID:5792
- C:\Windows\System\XnkMlHA.exe
  C:\Windows\System\XnkMlHA.exe
  2⤵
  PID:5812
- C:\Windows\System\PlGcvDe.exe
  C:\Windows\System\PlGcvDe.exe
  2⤵
  PID:5828
- C:\Windows\System\vxpiZId.exe
  C:\Windows\System\vxpiZId.exe
  2⤵
  PID:5844
- C:\Windows\System\YHNAzAB.exe
  C:\Windows\System\YHNAzAB.exe
  2⤵
  PID:5860
- C:\Windows\System\scjtysF.exe
  C:\Windows\System\scjtysF.exe
  2⤵
  PID:5880
- C:\Windows\System\kmQxupv.exe
  C:\Windows\System\kmQxupv.exe
  2⤵
  PID:5900
- C:\Windows\System\mQGKkOt.exe
  C:\Windows\System\mQGKkOt.exe
  2⤵
  PID:6044
- C:\Windows\System\vCXERoD.exe
  C:\Windows\System\vCXERoD.exe
  2⤵
  PID:6060
- C:\Windows\System\ShuekUr.exe
  C:\Windows\System\ShuekUr.exe
  2⤵
  PID:6076
- C:\Windows\System\TpcEkVh.exe
  C:\Windows\System\TpcEkVh.exe
  2⤵
  PID:6092
- C:\Windows\System\pmMUwJt.exe
  C:\Windows\System\pmMUwJt.exe
  2⤵
  PID:6108
- C:\Windows\System\CmlFjIR.exe
  C:\Windows\System\CmlFjIR.exe
  2⤵
  PID:6124
- C:\Windows\System\aPGyklr.exe
  C:\Windows\System\aPGyklr.exe
  2⤵
  PID:6140
- C:\Windows\System\RkgdPOs.exe
  C:\Windows\System\RkgdPOs.exe
  2⤵
  PID:4692
- C:\Windows\System\ruVozQr.exe
  C:\Windows\System\ruVozQr.exe
  2⤵
  PID:4828
- C:\Windows\System\pYJVxuH.exe
  C:\Windows\System\pYJVxuH.exe
  2⤵
  PID:5176
- C:\Windows\System\pFCeeBI.exe
  C:\Windows\System\pFCeeBI.exe
  2⤵
  PID:4232
- C:\Windows\System\dkYCyTl.exe
  C:\Windows\System\dkYCyTl.exe
  2⤵
  PID:4876
- C:\Windows\System\DRMXBed.exe
  C:\Windows\System\DRMXBed.exe
  2⤵
  PID:2696
- C:\Windows\System\gahlWCY.exe
  C:\Windows\System\gahlWCY.exe
  2⤵
  PID:4704
- C:\Windows\System\SlPqrdc.exe
  C:\Windows\System\SlPqrdc.exe
  2⤵
  PID:4932
- C:\Windows\System\XmjMRcv.exe
  C:\Windows\System\XmjMRcv.exe
  2⤵
  PID:4964
- C:\Windows\System\FYLAPFG.exe
  C:\Windows\System\FYLAPFG.exe
  2⤵
  PID:5192
- C:\Windows\System\wnpCZGC.exe
  C:\Windows\System\wnpCZGC.exe
  2⤵
  PID:4420
- C:\Windows\System\QxJZocR.exe
  C:\Windows\System\QxJZocR.exe
  2⤵
  PID:5132
- C:\Windows\System\UUzMzTp.exe
  C:\Windows\System\UUzMzTp.exe
  2⤵
  PID:5156
- C:\Windows\System\osWHVtu.exe
  C:\Windows\System\osWHVtu.exe
  2⤵
  PID:5220
- C:\Windows\System\pzUjtRl.exe
  C:\Windows\System\pzUjtRl.exe
  2⤵
  PID:5224
- C:\Windows\System\uNBtqVY.exe
  C:\Windows\System\uNBtqVY.exe
  2⤵
  PID:5272
- C:\Windows\System\oTAOwLK.exe
  C:\Windows\System\oTAOwLK.exe
  2⤵
  PID:5336
- C:\Windows\System\RlYajMh.exe
  C:\Windows\System\RlYajMh.exe
  2⤵
  PID:5404
- C:\Windows\System\qlIUaZV.exe
  C:\Windows\System\qlIUaZV.exe
  2⤵
  PID:5468
- C:\Windows\System\QhlDELX.exe
  C:\Windows\System\QhlDELX.exe
  2⤵
  PID:5540
- C:\Windows\System\cDyrChW.exe
  C:\Windows\System\cDyrChW.exe
  2⤵
  PID:5256
- C:\Windows\System\WJcgYbb.exe
  C:\Windows\System\WJcgYbb.exe
  2⤵
  PID:5668
- C:\Windows\System\YENZULN.exe
  C:\Windows\System\YENZULN.exe
  2⤵
  PID:5708
- C:\Windows\System\mCgfEjX.exe
  C:\Windows\System\mCgfEjX.exe
  2⤵
  PID:5772
- C:\Windows\System\KlhIjjT.exe
  C:\Windows\System\KlhIjjT.exe
  2⤵
  PID:5836
- C:\Windows\System\sfSycNm.exe
  C:\Windows\System\sfSycNm.exe
  2⤵
  PID:5876
- C:\Windows\System\CVjBPnl.exe
  C:\Windows\System\CVjBPnl.exe
  2⤵
  PID:5944
- C:\Windows\System\aIGiVLu.exe
  C:\Windows\System\aIGiVLu.exe
  2⤵
  PID:5928
- C:\Windows\System\MCqRrnz.exe
  C:\Windows\System\MCqRrnz.exe
  2⤵
  PID:5964
- C:\Windows\System\PPXYrLX.exe
  C:\Windows\System\PPXYrLX.exe
  2⤵
  PID:5980
- C:\Windows\System\lWgCyAR.exe
  C:\Windows\System\lWgCyAR.exe
  2⤵
  PID:5996
- C:\Windows\System\KEUqjtf.exe
  C:\Windows\System\KEUqjtf.exe
  2⤵
  PID:6016
- C:\Windows\System\bxpnytW.exe
  C:\Windows\System\bxpnytW.exe
  2⤵
  PID:6028
- C:\Windows\System\JqTUnhm.exe
  C:\Windows\System\JqTUnhm.exe
  2⤵
  PID:5912
- C:\Windows\System\jxrVpKG.exe
  C:\Windows\System\jxrVpKG.exe
  2⤵
  PID:6132
- C:\Windows\System\FhikglD.exe
  C:\Windows\System\FhikglD.exe
  2⤵
  PID:4516
- C:\Windows\System\jaCdxOM.exe
  C:\Windows\System\jaCdxOM.exe
  2⤵
  PID:5352
- C:\Windows\System\wbDSZNC.exe
  C:\Windows\System\wbDSZNC.exe
  2⤵
  PID:5452
- C:\Windows\System\otaYGbu.exe
  C:\Windows\System\otaYGbu.exe
  2⤵
  PID:5516
- C:\Windows\System\UYpLUUU.exe
  C:\Windows\System\UYpLUUU.exe
  2⤵
  PID:5620
- C:\Windows\System\HyVfbJe.exe
  C:\Windows\System\HyVfbJe.exe
  2⤵
  PID:5720
- C:\Windows\System\BiygIRz.exe
  C:\Windows\System\BiygIRz.exe
  2⤵
  PID:5824
- C:\Windows\System\vDpnQpJ.exe
  C:\Windows\System\vDpnQpJ.exe
  2⤵
  PID:4252
- C:\Windows\System\JypERru.exe
  C:\Windows\System\JypERru.exe
  2⤵
  PID:5356
- C:\Windows\System\eUYtwHb.exe
  C:\Windows\System\eUYtwHb.exe
  2⤵
  PID:5552
- C:\Windows\System\teriSfX.exe
  C:\Windows\System\teriSfX.exe
  2⤵
  PID:5856
- C:\Windows\System\QsPlwcz.exe
  C:\Windows\System\QsPlwcz.exe
  2⤵
  PID:6084
- C:\Windows\System\hRIsQOa.exe
  C:\Windows\System\hRIsQOa.exe
  2⤵
  PID:1552
- C:\Windows\System\tpdBRyL.exe
  C:\Windows\System\tpdBRyL.exe
  2⤵
  PID:5172
- C:\Windows\System\IYbrCOi.exe
  C:\Windows\System\IYbrCOi.exe
  2⤵
  PID:2936
- C:\Windows\System\bIZskVP.exe
  C:\Windows\System\bIZskVP.exe
  2⤵
  PID:5332
- C:\Windows\System\LWnBQBg.exe
  C:\Windows\System\LWnBQBg.exe
  2⤵
  PID:5600
- C:\Windows\System\grfNchW.exe
  C:\Windows\System\grfNchW.exe
  2⤵
  PID:5808
- C:\Windows\System\zrtRKDD.exe
  C:\Windows\System\zrtRKDD.exe
  2⤵
  PID:5920
- C:\Windows\System\UHbojqu.exe
  C:\Windows\System\UHbojqu.exe
  2⤵
  PID:5992
- C:\Windows\System\CuuMvMl.exe
  C:\Windows\System\CuuMvMl.exe
  2⤵
  PID:6020
- C:\Windows\System\UoAKueI.exe
  C:\Windows\System\UoAKueI.exe
  2⤵
  PID:6036
- C:\Windows\System\bRlrXzV.exe
  C:\Windows\System\bRlrXzV.exe
  2⤵
  PID:5208
- C:\Windows\System\IDsvjzX.exe
  C:\Windows\System\IDsvjzX.exe
  2⤵
  PID:5372
- C:\Windows\System\wEVYhYs.exe
  C:\Windows\System\wEVYhYs.exe
  2⤵
  PID:5536
- C:\Windows\System\DwMloXV.exe
  C:\Windows\System\DwMloXV.exe
  2⤵
  PID:5768
- C:\Windows\System\nXXPmhU.exe
  C:\Windows\System\nXXPmhU.exe
  2⤵
  PID:5972
- C:\Windows\System\tqVLZgd.exe
  C:\Windows\System\tqVLZgd.exe
  2⤵
  PID:4640
- C:\Windows\System\DnqzeCF.exe
  C:\Windows\System\DnqzeCF.exe
  2⤵
  PID:5448
- C:\Windows\System\phWNfDI.exe
  C:\Windows\System\phWNfDI.exe
  2⤵
  PID:5752
- C:\Windows\System\BaECmXr.exe
  C:\Windows\System\BaECmXr.exe
  2⤵
  PID:5688
- C:\Windows\System\FCPCjkh.exe
  C:\Windows\System\FCPCjkh.exe
  2⤵
  PID:6120
- C:\Windows\System\tOsRkpS.exe
  C:\Windows\System\tOsRkpS.exe
  2⤵
  PID:5572
- C:\Windows\System\NzONjXp.exe
  C:\Windows\System\NzONjXp.exe
  2⤵
  PID:5152
- C:\Windows\System\RdotKtW.exe
  C:\Windows\System\RdotKtW.exe
  2⤵
  PID:5932
- C:\Windows\System\ddChhcS.exe
  C:\Windows\System\ddChhcS.exe
  2⤵
  PID:5960
- C:\Windows\System\mnewsSG.exe
  C:\Windows\System\mnewsSG.exe
  2⤵
  PID:5284
- C:\Windows\System\uUsKGNr.exe
  C:\Windows\System\uUsKGNr.exe
  2⤵
  PID:6068
- C:\Windows\System\QOCqWDs.exe
  C:\Windows\System\QOCqWDs.exe
  2⤵
  PID:6012
- C:\Windows\System\QkYHFWe.exe
  C:\Windows\System\QkYHFWe.exe
  2⤵
  PID:5652
- C:\Windows\System\qVWsQVr.exe
  C:\Windows\System\qVWsQVr.exe
  2⤵
  PID:5420
- C:\Windows\System\ysLXTaT.exe
  C:\Windows\System\ysLXTaT.exe
  2⤵
  PID:5236
- C:\Windows\System\BxCylqR.exe
  C:\Windows\System\BxCylqR.exe
  2⤵
  PID:5988
- C:\Windows\System\qvTOXOX.exe
  C:\Windows\System\qvTOXOX.exe
  2⤵
  PID:5888
- C:\Windows\System\bkIafdD.exe
  C:\Windows\System\bkIafdD.exe
  2⤵
  PID:6104
- C:\Windows\System\SCFuJsw.exe
  C:\Windows\System\SCFuJsw.exe
  2⤵
  PID:5196
- C:\Windows\System\WiTjDMg.exe
  C:\Windows\System\WiTjDMg.exe
  2⤵
  PID:5144
- C:\Windows\System\DdtrClQ.exe
  C:\Windows\System\DdtrClQ.exe
  2⤵
  PID:5252
- C:\Windows\System\TlZjMmQ.exe
  C:\Windows\System\TlZjMmQ.exe
  2⤵
  PID:5896
- C:\Windows\System\ghaOnkX.exe
  C:\Windows\System\ghaOnkX.exe
  2⤵
  PID:6136
- C:\Windows\System\ACuUneZ.exe
  C:\Windows\System\ACuUneZ.exe
  2⤵
  PID:5640
- C:\Windows\System\PtyPXHa.exe
  C:\Windows\System\PtyPXHa.exe
  2⤵
  PID:6148
- C:\Windows\System\tGRcWel.exe
  C:\Windows\System\tGRcWel.exe
  2⤵
  PID:6164
- C:\Windows\System\KlJJEqx.exe
  C:\Windows\System\KlJJEqx.exe
  2⤵
  PID:6180
- C:\Windows\System\XzqsJGc.exe
  C:\Windows\System\XzqsJGc.exe
  2⤵
  PID:6196
- C:\Windows\System\claeEyE.exe
  C:\Windows\System\claeEyE.exe
  2⤵
  PID:6212
- C:\Windows\System\bmLdlnb.exe
  C:\Windows\System\bmLdlnb.exe
  2⤵
  PID:6228
- C:\Windows\System\dgDftBh.exe
  C:\Windows\System\dgDftBh.exe
  2⤵
  PID:6244
- C:\Windows\System\xVKSBqP.exe
  C:\Windows\System\xVKSBqP.exe
  2⤵
  PID:6264
- C:\Windows\System\FUFgifH.exe
  C:\Windows\System\FUFgifH.exe
  2⤵
  PID:6280
- C:\Windows\System\KdwlZjZ.exe
  C:\Windows\System\KdwlZjZ.exe
  2⤵
  PID:6296
- C:\Windows\System\tkhoZiB.exe
  C:\Windows\System\tkhoZiB.exe
  2⤵
  PID:6312
- C:\Windows\System\ynNNRRG.exe
  C:\Windows\System\ynNNRRG.exe
  2⤵
  PID:6328
- C:\Windows\System\SgANLPg.exe
  C:\Windows\System\SgANLPg.exe
  2⤵
  PID:6344
- C:\Windows\System\NXgAbqt.exe
  C:\Windows\System\NXgAbqt.exe
  2⤵
  PID:6360
- C:\Windows\System\tBzDOkz.exe
  C:\Windows\System\tBzDOkz.exe
  2⤵
  PID:6376
- C:\Windows\System\UOtqYUC.exe
  C:\Windows\System\UOtqYUC.exe
  2⤵
  PID:6392
- C:\Windows\System\TVBvwWA.exe
  C:\Windows\System\TVBvwWA.exe
  2⤵
  PID:6408
- C:\Windows\System\NQdVuYw.exe
  C:\Windows\System\NQdVuYw.exe
  2⤵
  PID:6424
- C:\Windows\System\RxytRsT.exe
  C:\Windows\System\RxytRsT.exe
  2⤵
  PID:6440
- C:\Windows\System\JPyaRKj.exe
  C:\Windows\System\JPyaRKj.exe
  2⤵
  PID:6456
- C:\Windows\System\hkyyTdk.exe
  C:\Windows\System\hkyyTdk.exe
  2⤵
  PID:6472
- C:\Windows\System\ZZslbAP.exe
  C:\Windows\System\ZZslbAP.exe
  2⤵
  PID:6488
- C:\Windows\System\FedRBJw.exe
  C:\Windows\System\FedRBJw.exe
  2⤵
  PID:6504
- C:\Windows\System\hYvVuSP.exe
  C:\Windows\System\hYvVuSP.exe
  2⤵
  PID:6520
- C:\Windows\System\hKMtnIf.exe
  C:\Windows\System\hKMtnIf.exe
  2⤵
  PID:6536
- C:\Windows\System\VVuMUEJ.exe
  C:\Windows\System\VVuMUEJ.exe
  2⤵
  PID:6552
- C:\Windows\System\UctKsbA.exe
  C:\Windows\System\UctKsbA.exe
  2⤵
  PID:6568
- C:\Windows\System\bOJShoG.exe
  C:\Windows\System\bOJShoG.exe
  2⤵
  PID:6584
- C:\Windows\System\QRxXZkP.exe
  C:\Windows\System\QRxXZkP.exe
  2⤵
  PID:6600
- C:\Windows\System\OQaREHm.exe
  C:\Windows\System\OQaREHm.exe
  2⤵
  PID:6616
- C:\Windows\System\jaLnQOP.exe
  C:\Windows\System\jaLnQOP.exe
  2⤵
  PID:6632
- C:\Windows\System\izFPYTw.exe
  C:\Windows\System\izFPYTw.exe
  2⤵
  PID:6648
- C:\Windows\System\KkDKBXi.exe
  C:\Windows\System\KkDKBXi.exe
  2⤵
  PID:6664
- C:\Windows\System\DMYWDLV.exe
  C:\Windows\System\DMYWDLV.exe
  2⤵
  PID:6680
- C:\Windows\System\nxJOknL.exe
  C:\Windows\System\nxJOknL.exe
  2⤵
  PID:6696
- C:\Windows\System\uICZdcV.exe
  C:\Windows\System\uICZdcV.exe
  2⤵
  PID:6712
- C:\Windows\System\fTZtWKw.exe
  C:\Windows\System\fTZtWKw.exe
  2⤵
  PID:6728
- C:\Windows\System\SWEAbpH.exe
  C:\Windows\System\SWEAbpH.exe
  2⤵
  PID:6744
- C:\Windows\System\ZZbkGsx.exe
  C:\Windows\System\ZZbkGsx.exe
  2⤵
  PID:6760
- C:\Windows\System\IGiwNyZ.exe
  C:\Windows\System\IGiwNyZ.exe
  2⤵
  PID:6776
- C:\Windows\System\ZeveqOO.exe
  C:\Windows\System\ZeveqOO.exe
  2⤵
  PID:6792
- C:\Windows\System\NTttvZY.exe
  C:\Windows\System\NTttvZY.exe
  2⤵
  PID:6808
- C:\Windows\System\cksgMRG.exe
  C:\Windows\System\cksgMRG.exe
  2⤵
  PID:6824
- C:\Windows\System\oUBxgQE.exe
  C:\Windows\System\oUBxgQE.exe
  2⤵
  PID:6840
- C:\Windows\System\wbITpXU.exe
  C:\Windows\System\wbITpXU.exe
  2⤵
  PID:6856
- C:\Windows\System\ppDkTFN.exe
  C:\Windows\System\ppDkTFN.exe
  2⤵
  PID:6872
- C:\Windows\System\FPTKoVM.exe
  C:\Windows\System\FPTKoVM.exe
  2⤵
  PID:6888
- C:\Windows\System\qUoncMW.exe
  C:\Windows\System\qUoncMW.exe
  2⤵
  PID:6904
- C:\Windows\System\CGYPyRA.exe
  C:\Windows\System\CGYPyRA.exe
  2⤵
  PID:6920
- C:\Windows\System\gJHbUGw.exe
  C:\Windows\System\gJHbUGw.exe
  2⤵
  PID:6936
- C:\Windows\System\TVdcdHt.exe
  C:\Windows\System\TVdcdHt.exe
  2⤵
  PID:6952
- C:\Windows\System\sATtoYK.exe
  C:\Windows\System\sATtoYK.exe
  2⤵
  PID:6968
- C:\Windows\System\DJTvDDE.exe
  C:\Windows\System\DJTvDDE.exe
  2⤵
  PID:6984
- C:\Windows\System\PQjzsfO.exe
  C:\Windows\System\PQjzsfO.exe
  2⤵
  PID:7000
- C:\Windows\System\okVLNER.exe
  C:\Windows\System\okVLNER.exe
  2⤵
  PID:7016
- C:\Windows\System\lwCVtLN.exe
  C:\Windows\System\lwCVtLN.exe
  2⤵
  PID:7032
- C:\Windows\System\nHNTEhF.exe
  C:\Windows\System\nHNTEhF.exe
  2⤵
  PID:7048
- C:\Windows\System\BoGVHcr.exe
  C:\Windows\System\BoGVHcr.exe
  2⤵
  PID:7064
- C:\Windows\System\TsoWKVl.exe
  C:\Windows\System\TsoWKVl.exe
  2⤵
  PID:7080
- C:\Windows\System\LxBVJbs.exe
  C:\Windows\System\LxBVJbs.exe
  2⤵
  PID:7096
- C:\Windows\System\OvWrYyl.exe
  C:\Windows\System\OvWrYyl.exe
  2⤵
  PID:7112
- C:\Windows\System\CIkfgLb.exe
  C:\Windows\System\CIkfgLb.exe
  2⤵
  PID:7128
- C:\Windows\System\NkVAvLP.exe
  C:\Windows\System\NkVAvLP.exe
  2⤵
  PID:7144
- C:\Windows\System\FxUgIaN.exe
  C:\Windows\System\FxUgIaN.exe
  2⤵
  PID:7160
- C:\Windows\System\jmdAWNT.exe
  C:\Windows\System\jmdAWNT.exe
  2⤵
  PID:6008
- C:\Windows\System\CXIeIVX.exe
  C:\Windows\System\CXIeIVX.exe
  2⤵
  PID:6220
- C:\Windows\System\QzqeeyR.exe
  C:\Windows\System\QzqeeyR.exe
  2⤵
  PID:5484
- C:\Windows\System\OgFeVBq.exe
  C:\Windows\System\OgFeVBq.exe
  2⤵
  PID:6320
- C:\Windows\System\toxiqqQ.exe
  C:\Windows\System\toxiqqQ.exe
  2⤵
  PID:6384
- C:\Windows\System\CrkzxIR.exe
  C:\Windows\System\CrkzxIR.exe
  2⤵
  PID:6116
- C:\Windows\System\HTfjJtQ.exe
  C:\Windows\System\HTfjJtQ.exe
  2⤵
  PID:6272
- C:\Windows\System\qNZDBil.exe
  C:\Windows\System\qNZDBil.exe
  2⤵
  PID:6308
- C:\Windows\System\OXgdAlN.exe
  C:\Windows\System\OXgdAlN.exe
  2⤵
  PID:5588
- C:\Windows\System\SaifFUg.exe
  C:\Windows\System\SaifFUg.exe
  2⤵
  PID:6208
- C:\Windows\System\iLJdkMS.exe
  C:\Windows\System\iLJdkMS.exe
  2⤵
  PID:5168
- C:\Windows\System\UAxrmTH.exe
  C:\Windows\System\UAxrmTH.exe
  2⤵
  PID:5416
- C:\Windows\System\VCCmRgF.exe
  C:\Windows\System\VCCmRgF.exe
  2⤵
  PID:5436
- C:\Windows\System\wszXftC.exe
  C:\Windows\System\wszXftC.exe
  2⤵
  PID:6340
- C:\Windows\System\shSCLYD.exe
  C:\Windows\System\shSCLYD.exe
  2⤵
  PID:6432
- C:\Windows\System\HkAmmvx.exe
  C:\Windows\System\HkAmmvx.exe
  2⤵
  PID:6480
- C:\Windows\System\raXolIS.exe
  C:\Windows\System\raXolIS.exe
  2⤵
  PID:6512
- C:\Windows\System\HhItwnM.exe
  C:\Windows\System\HhItwnM.exe
  2⤵
  PID:6528
- C:\Windows\System\PHAfEAK.exe
  C:\Windows\System\PHAfEAK.exe
  2⤵
  PID:6576
- C:\Windows\System\tXUzUXX.exe
  C:\Windows\System\tXUzUXX.exe
  2⤵
  PID:6640
- C:\Windows\System\xDnkfyh.exe
  C:\Windows\System\xDnkfyh.exe
  2⤵
  PID:6676
- C:\Windows\System\oqzeKiO.exe
  C:\Windows\System\oqzeKiO.exe
  2⤵
  PID:6736
- C:\Windows\System\chrOFCU.exe
  C:\Windows\System\chrOFCU.exe
  2⤵
  PID:6772
- C:\Windows\System\RcDLjyc.exe
  C:\Windows\System\RcDLjyc.exe
  2⤵
  PID:6624
- C:\Windows\System\EFDThzH.exe
  C:\Windows\System\EFDThzH.exe
  2⤵
  PID:6864
- C:\Windows\System\RNaeEwU.exe
  C:\Windows\System\RNaeEwU.exe
  2⤵
  PID:6896
- C:\Windows\System\HJhEEQD.exe
  C:\Windows\System\HJhEEQD.exe
  2⤵
  PID:6928
- C:\Windows\System\fJWzvke.exe
  C:\Windows\System\fJWzvke.exe
  2⤵
  PID:6992
- C:\Windows\System\HwuOTPV.exe
  C:\Windows\System\HwuOTPV.exe
  2⤵
  PID:6784
- C:\Windows\System\AMuhpqy.exe
  C:\Windows\System\AMuhpqy.exe
  2⤵
  PID:6724
- C:\Windows\System\OBVfDyv.exe
  C:\Windows\System\OBVfDyv.exe
  2⤵
  PID:6976
- C:\Windows\System\FyOwrMD.exe
  C:\Windows\System\FyOwrMD.exe
  2⤵
  PID:6852
- C:\Windows\System\kmtFLef.exe
  C:\Windows\System\kmtFLef.exe
  2⤵
  PID:6916
- C:\Windows\System\sfcxqYF.exe
  C:\Windows\System\sfcxqYF.exe
  2⤵
  PID:6980
- C:\Windows\System\ptxbKxb.exe
  C:\Windows\System\ptxbKxb.exe
  2⤵
  PID:7044
- C:\Windows\System\ebSRnOZ.exe
  C:\Windows\System\ebSRnOZ.exe
  2⤵
  PID:7120
- C:\Windows\System\JJOAHCg.exe
  C:\Windows\System\JJOAHCg.exe
  2⤵
  PID:7104
- C:\Windows\System\yyYVaSA.exe
  C:\Windows\System\yyYVaSA.exe
  2⤵
  PID:6156
- C:\Windows\System\AGDRgMN.exe
  C:\Windows\System\AGDRgMN.exe
  2⤵
  PID:6288
- C:\Windows\System\lchyRQU.exe
  C:\Windows\System\lchyRQU.exe
  2⤵
  PID:6276
- C:\Windows\System\LrvDOfa.exe
  C:\Windows\System\LrvDOfa.exe
  2⤵
  PID:6352
- C:\Windows\System\EcyVLnu.exe
  C:\Windows\System\EcyVLnu.exe
  2⤵
  PID:5788
- C:\Windows\System\XCeTCQx.exe
  C:\Windows\System\XCeTCQx.exe
  2⤵
  PID:6236
- C:\Windows\System\gloaYQZ.exe
  C:\Windows\System\gloaYQZ.exe
  2⤵
  PID:6452
- C:\Windows\System\iuuTQma.exe
  C:\Windows\System\iuuTQma.exe
  2⤵
  PID:6404
- C:\Windows\System\EfxvMuH.exe
  C:\Windows\System\EfxvMuH.exe
  2⤵
  PID:1936
- C:\Windows\System\fsxEYHc.exe
  C:\Windows\System\fsxEYHc.exe
  2⤵
  PID:6708
- C:\Windows\System\itApIPz.exe
  C:\Windows\System\itApIPz.exe
  2⤵
  PID:6548
- C:\Windows\System\FDJbfwW.exe
  C:\Windows\System\FDJbfwW.exe
  2⤵
  PID:6564
- C:\Windows\System\KQGHfAq.exe
  C:\Windows\System\KQGHfAq.exe
  2⤵
  PID:6688
- C:\Windows\System\QQLNwNO.exe
  C:\Windows\System\QQLNwNO.exe
  2⤵
  PID:6960
- C:\Windows\System\hkKLBHY.exe
  C:\Windows\System\hkKLBHY.exe
  2⤵
  PID:7024
- C:\Windows\System\xjukOwo.exe
  C:\Windows\System\xjukOwo.exe
  2⤵
  PID:7056
- C:\Windows\System\IVxKFpI.exe
  C:\Windows\System\IVxKFpI.exe
  2⤵
  PID:6884
- C:\Windows\System\ReNlrgA.exe
  C:\Windows\System\ReNlrgA.exe
  2⤵
  PID:7012
- C:\Windows\System\cBWXHtA.exe
  C:\Windows\System\cBWXHtA.exe
  2⤵
  PID:7156
- C:\Windows\System\SVJWsms.exe
  C:\Windows\System\SVJWsms.exe
  2⤵
  PID:6416
- C:\Windows\System\BYpayui.exe
  C:\Windows\System\BYpayui.exe
  2⤵
  PID:4368
- C:\Windows\System\IIydtuP.exe
  C:\Windows\System\IIydtuP.exe
  2⤵
  PID:6656
- C:\Windows\System\lcoMfEE.exe
  C:\Windows\System\lcoMfEE.exe
  2⤵
  PID:6628
- C:\Windows\System\BAPGyno.exe
  C:\Windows\System\BAPGyno.exe
  2⤵
  PID:7076
- C:\Windows\System\cmcWqwk.exe
  C:\Windows\System\cmcWqwk.exe
  2⤵
  PID:6252
- C:\Windows\System\PAGuiww.exe
  C:\Windows\System\PAGuiww.exe
  2⤵
  PID:6372
- C:\Windows\System\FfCUiff.exe
  C:\Windows\System\FfCUiff.exe
  2⤵
  PID:6768
- C:\Windows\System\wsmarOU.exe
  C:\Windows\System\wsmarOU.exe
  2⤵
  PID:5188
- C:\Windows\System\YoBOoZV.exe
  C:\Windows\System\YoBOoZV.exe
  2⤵
  PID:6672
- C:\Windows\System\lwSGZGL.exe
  C:\Windows\System\lwSGZGL.exe
  2⤵
  PID:7172
- C:\Windows\System\epmHvLE.exe
  C:\Windows\System\epmHvLE.exe
  2⤵
  PID:7188
- C:\Windows\System\BpwadOn.exe
  C:\Windows\System\BpwadOn.exe
  2⤵
  PID:7204
- C:\Windows\System\gXGJHZl.exe
  C:\Windows\System\gXGJHZl.exe
  2⤵
  PID:7220
- C:\Windows\System\PmMZYUK.exe
  C:\Windows\System\PmMZYUK.exe
  2⤵
  PID:7236
- C:\Windows\System\txYsSCu.exe
  C:\Windows\System\txYsSCu.exe
  2⤵
  PID:7252
- C:\Windows\System\gaxTyJn.exe
  C:\Windows\System\gaxTyJn.exe
  2⤵
  PID:7268
- C:\Windows\System\sjNOJPC.exe
  C:\Windows\System\sjNOJPC.exe
  2⤵
  PID:7284
- C:\Windows\System\HYZKFLp.exe
  C:\Windows\System\HYZKFLp.exe
  2⤵
  PID:7300
- C:\Windows\System\GPDHXVA.exe
  C:\Windows\System\GPDHXVA.exe
  2⤵
  PID:7316
- C:\Windows\System\mOsOhpn.exe
  C:\Windows\System\mOsOhpn.exe
  2⤵
  PID:7332
- C:\Windows\System\zTqlowh.exe
  C:\Windows\System\zTqlowh.exe
  2⤵
  PID:7348
- C:\Windows\System\EeoIKyb.exe
  C:\Windows\System\EeoIKyb.exe
  2⤵
  PID:7364
- C:\Windows\System\JdyJonB.exe
  C:\Windows\System\JdyJonB.exe
  2⤵
  PID:7380
- C:\Windows\System\FXjzltU.exe
  C:\Windows\System\FXjzltU.exe
  2⤵
  PID:7396
- C:\Windows\System\KSAeogB.exe
  C:\Windows\System\KSAeogB.exe
  2⤵
  PID:7412
- C:\Windows\System\bIVohxU.exe
  C:\Windows\System\bIVohxU.exe
  2⤵
  PID:7428
- C:\Windows\System\fddhjtz.exe
  C:\Windows\System\fddhjtz.exe
  2⤵
  PID:7448
- C:\Windows\System\NtEaIAQ.exe
  C:\Windows\System\NtEaIAQ.exe
  2⤵
  PID:7464
- C:\Windows\System\CfTKWcL.exe
  C:\Windows\System\CfTKWcL.exe
  2⤵
  PID:7480
- C:\Windows\System\tVwJYyg.exe
  C:\Windows\System\tVwJYyg.exe
  2⤵
  PID:7496
- C:\Windows\System\nHzlJuY.exe
  C:\Windows\System\nHzlJuY.exe
  2⤵
  PID:7512
- C:\Windows\System\DVLTrIf.exe
  C:\Windows\System\DVLTrIf.exe
  2⤵
  PID:7528
- C:\Windows\System\bFhtGrk.exe
  C:\Windows\System\bFhtGrk.exe
  2⤵
  PID:7544
- C:\Windows\System\pZhcJOY.exe
  C:\Windows\System\pZhcJOY.exe
  2⤵
  PID:7560
- C:\Windows\System\MoAhgHG.exe
  C:\Windows\System\MoAhgHG.exe
  2⤵
  PID:7576
- C:\Windows\System\dHjdyPp.exe
  C:\Windows\System\dHjdyPp.exe
  2⤵
  PID:7592
- C:\Windows\System\ZfmYIhx.exe
  C:\Windows\System\ZfmYIhx.exe
  2⤵
  PID:7608
- C:\Windows\System\zBJleks.exe
  C:\Windows\System\zBJleks.exe
  2⤵
  PID:7624
- C:\Windows\System\THyOYVF.exe
  C:\Windows\System\THyOYVF.exe
  2⤵
  PID:7640
- C:\Windows\System\wYZatkI.exe
  C:\Windows\System\wYZatkI.exe
  2⤵
  PID:7656
- C:\Windows\System\CnaSQox.exe
  C:\Windows\System\CnaSQox.exe
  2⤵
  PID:7672
- C:\Windows\System\GsBjeIu.exe
  C:\Windows\System\GsBjeIu.exe
  2⤵
  PID:7688
- C:\Windows\System\fqwuDod.exe
  C:\Windows\System\fqwuDod.exe
  2⤵
  PID:7704
- C:\Windows\System\LWrasfJ.exe
  C:\Windows\System\LWrasfJ.exe
  2⤵
  PID:7720
- C:\Windows\System\OdDNrrM.exe
  C:\Windows\System\OdDNrrM.exe
  2⤵
  PID:7736
- C:\Windows\System\Asdzpqy.exe
  C:\Windows\System\Asdzpqy.exe
  2⤵
  PID:7752
- C:\Windows\System\AcUXCLZ.exe
  C:\Windows\System\AcUXCLZ.exe
  2⤵
  PID:7768
- C:\Windows\System\xxOSpjW.exe
  C:\Windows\System\xxOSpjW.exe
  2⤵
  PID:7784
- C:\Windows\System\JWRbLwF.exe
  C:\Windows\System\JWRbLwF.exe
  2⤵
  PID:7800
- C:\Windows\System\VuxyGLL.exe
  C:\Windows\System\VuxyGLL.exe
  2⤵
  PID:7816
- C:\Windows\System\qkZVUml.exe
  C:\Windows\System\qkZVUml.exe
  2⤵
  PID:7832
- C:\Windows\System\vYYyJSN.exe
  C:\Windows\System\vYYyJSN.exe
  2⤵
  PID:7848
- C:\Windows\System\GzIxiMT.exe
  C:\Windows\System\GzIxiMT.exe
  2⤵
  PID:7864
- C:\Windows\System\mluwAuo.exe
  C:\Windows\System\mluwAuo.exe
  2⤵
  PID:7880
- C:\Windows\System\GZNyREP.exe
  C:\Windows\System\GZNyREP.exe
  2⤵
  PID:7896
- C:\Windows\System\pMMIPas.exe
  C:\Windows\System\pMMIPas.exe
  2⤵
  PID:7912
- C:\Windows\System\CAgxwpY.exe
  C:\Windows\System\CAgxwpY.exe
  2⤵
  PID:7928
- C:\Windows\System\AuIiZoc.exe
  C:\Windows\System\AuIiZoc.exe
  2⤵
  PID:7944
- C:\Windows\System\TnPJRNK.exe
  C:\Windows\System\TnPJRNK.exe
  2⤵
  PID:7960
- C:\Windows\System\GpdbKyS.exe
  C:\Windows\System\GpdbKyS.exe
  2⤵
  PID:7976
- C:\Windows\System\rIackkU.exe
  C:\Windows\System\rIackkU.exe
  2⤵
  PID:7992
- C:\Windows\System\mbHtMrO.exe
  C:\Windows\System\mbHtMrO.exe
  2⤵
  PID:8008
- C:\Windows\System\qJuJZod.exe
  C:\Windows\System\qJuJZod.exe
  2⤵
  PID:8024
- C:\Windows\System\WjSePPK.exe
  C:\Windows\System\WjSePPK.exe
  2⤵
  PID:8040
- C:\Windows\System\lxicgSC.exe
  C:\Windows\System\lxicgSC.exe
  2⤵
  PID:8056
- C:\Windows\System\ffkDERX.exe
  C:\Windows\System\ffkDERX.exe
  2⤵
  PID:8072
- C:\Windows\System\hDyNkFk.exe
  C:\Windows\System\hDyNkFk.exe
  2⤵
  PID:8088
- C:\Windows\System\DwMMaJx.exe
  C:\Windows\System\DwMMaJx.exe
  2⤵
  PID:8104
- C:\Windows\System\IWwaxZg.exe
  C:\Windows\System\IWwaxZg.exe
  2⤵
  PID:8120
- C:\Windows\System\WQlnIDJ.exe
  C:\Windows\System\WQlnIDJ.exe
  2⤵
  PID:8136
- C:\Windows\System\RgVnBkQ.exe
  C:\Windows\System\RgVnBkQ.exe
  2⤵
  PID:8152
- C:\Windows\System\DzdVMVp.exe
  C:\Windows\System\DzdVMVp.exe
  2⤵
  PID:8168
- C:\Windows\System\jCEsgtQ.exe
  C:\Windows\System\jCEsgtQ.exe
  2⤵
  PID:8184
- C:\Windows\System\aYjeRjj.exe
  C:\Windows\System\aYjeRjj.exe
  2⤵
  PID:5268
- C:\Windows\System\gzgZxkH.exe
  C:\Windows\System\gzgZxkH.exe
  2⤵
  PID:6500
- C:\Windows\System\glTmFnH.exe
  C:\Windows\System\glTmFnH.exe
  2⤵
  PID:6304
- C:\Windows\System\xlPfKTs.exe
  C:\Windows\System\xlPfKTs.exe
  2⤵
  PID:7028
- C:\Windows\System\POXzPiR.exe
  C:\Windows\System\POXzPiR.exe
  2⤵
  PID:7088
- C:\Windows\System\kKYpADw.exe
  C:\Windows\System\kKYpADw.exe
  2⤵
  PID:7244
- C:\Windows\System\XeEmfoS.exe
  C:\Windows\System\XeEmfoS.exe
  2⤵
  PID:7196
- C:\Windows\System\fxLmopx.exe
  C:\Windows\System\fxLmopx.exe
  2⤵
  PID:7264
- C:\Windows\System\uEZLLrm.exe
  C:\Windows\System\uEZLLrm.exe
  2⤵
  PID:7312
- C:\Windows\System\WlHNehR.exe
  C:\Windows\System\WlHNehR.exe
  2⤵
  PID:7328
- C:\Windows\System\jOCNqnM.exe
  C:\Windows\System\jOCNqnM.exe
  2⤵
  PID:7360
- C:\Windows\System\sVMHaga.exe
  C:\Windows\System\sVMHaga.exe
  2⤵
  PID:7408
- C:\Windows\System\dLXCVXv.exe
  C:\Windows\System\dLXCVXv.exe
  2⤵
  PID:7424
- C:\Windows\System\qBYwvsY.exe
  C:\Windows\System\qBYwvsY.exe
  2⤵
  PID:7476
- C:\Windows\System\vhIPpsO.exe
  C:\Windows\System\vhIPpsO.exe
  2⤵
  PID:7504
- C:\Windows\System\CgONwUZ.exe
  C:\Windows\System\CgONwUZ.exe
  2⤵
  PID:7572
- C:\Windows\System\GTvkeiL.exe
  C:\Windows\System\GTvkeiL.exe
  2⤵
  PID:7636
- C:\Windows\System\KHrokzM.exe
  C:\Windows\System\KHrokzM.exe
  2⤵
  PID:7700
- C:\Windows\System\YaGQbKS.exe
  C:\Windows\System\YaGQbKS.exe
  2⤵
  PID:7764
- C:\Windows\System\LGGCbQO.exe
  C:\Windows\System\LGGCbQO.exe
  2⤵
  PID:7556
- C:\Windows\System\nJDJyEx.exe
  C:\Windows\System\nJDJyEx.exe
  2⤵
  PID:7652
- C:\Windows\System\lgLbwrG.exe
  C:\Windows\System\lgLbwrG.exe
  2⤵
  PID:7744
- C:\Windows\System\zlmrHXU.exe
  C:\Windows\System\zlmrHXU.exe
  2⤵
  PID:7520
- C:\Windows\System\CjVSYsQ.exe
  C:\Windows\System\CjVSYsQ.exe
  2⤵
  PID:7620
- C:\Windows\System\qLiZbJs.exe
  C:\Windows\System\qLiZbJs.exe
  2⤵
  PID:7812
- C:\Windows\System\GkpxhZm.exe
  C:\Windows\System\GkpxhZm.exe
  2⤵
  PID:7840
- C:\Windows\System\LnYXaDL.exe
  C:\Windows\System\LnYXaDL.exe
  2⤵
  PID:7920
- C:\Windows\System\dgezbhu.exe
  C:\Windows\System\dgezbhu.exe
  2⤵
  PID:7908
- C:\Windows\System\YlrETFN.exe
  C:\Windows\System\YlrETFN.exe
  2⤵
  PID:7956
- C:\Windows\System\PryfdSo.exe
  C:\Windows\System\PryfdSo.exe
  2⤵
  PID:7988
- C:\Windows\System\ZTTElJS.exe
  C:\Windows\System\ZTTElJS.exe
  2⤵
  PID:8016
- C:\Windows\System\FTWkNLZ.exe
  C:\Windows\System\FTWkNLZ.exe
  2⤵
  PID:8052
- C:\Windows\System\GEGqmQP.exe
  C:\Windows\System\GEGqmQP.exe
  2⤵
  PID:8080
- C:\Windows\System\FmjpKAh.exe
  C:\Windows\System\FmjpKAh.exe
  2⤵
  PID:8116
- C:\Windows\System\cBtDDYZ.exe
  C:\Windows\System\cBtDDYZ.exe
  2⤵
  PID:8132
- C:\Windows\System\VLLdcyt.exe
  C:\Windows\System\VLLdcyt.exe
  2⤵
  PID:6240
- C:\Windows\System\tGeXSze.exe
  C:\Windows\System\tGeXSze.exe
  2⤵
  PID:4288
- C:\Windows\System\uLTEpml.exe
  C:\Windows\System\uLTEpml.exe
  2⤵
  PID:7340
- C:\Windows\System\xTWyXpf.exe
  C:\Windows\System\xTWyXpf.exe
  2⤵
  PID:7296
- C:\Windows\System\eVOrljj.exe
  C:\Windows\System\eVOrljj.exe
  2⤵
  PID:6912
- C:\Windows\System\ORXIWDs.exe
  C:\Windows\System\ORXIWDs.exe
  2⤵
  PID:6820
- C:\Windows\System\kfxmYDu.exe
  C:\Windows\System\kfxmYDu.exe
  2⤵
  PID:7308
- C:\Windows\System\jwuKquj.exe
  C:\Windows\System\jwuKquj.exe
  2⤵
  PID:7456
- C:\Windows\System\LHnDAWh.exe
  C:\Windows\System\LHnDAWh.exe
  2⤵
  PID:7540
- C:\Windows\System\quoeeRD.exe
  C:\Windows\System\quoeeRD.exe
  2⤵
  PID:7796
- C:\Windows\System\QwFfjgh.exe
  C:\Windows\System\QwFfjgh.exe
  2⤵
  PID:7508
- C:\Windows\System\KGhviGK.exe
  C:\Windows\System\KGhviGK.exe
  2⤵
  PID:7760
- C:\Windows\System\zUjhtAr.exe
  C:\Windows\System\zUjhtAr.exe
  2⤵
  PID:7824
- C:\Windows\System\jfaLTMx.exe
  C:\Windows\System\jfaLTMx.exe
  2⤵
  PID:7844
- C:\Windows\System\qAbWUWc.exe
  C:\Windows\System\qAbWUWc.exe
  2⤵
  PID:7968
- C:\Windows\System\HtNnbwa.exe
  C:\Windows\System\HtNnbwa.exe
  2⤵
  PID:7936
- C:\Windows\System\CvItgzC.exe
  C:\Windows\System\CvItgzC.exe
  2⤵
  PID:8180
- C:\Windows\System\QyXmQdl.exe
  C:\Windows\System\QyXmQdl.exe
  2⤵
  PID:7324
- C:\Windows\System\DUOLtHD.exe
  C:\Windows\System\DUOLtHD.exe
  2⤵
  PID:8068
- C:\Windows\System\PBWsNeN.exe
  C:\Windows\System\PBWsNeN.exe
  2⤵
  PID:7952
- C:\Windows\System\rDerlRa.exe
  C:\Windows\System\rDerlRa.exe
  2⤵
  PID:7684
- C:\Windows\System\mJalVoq.exe
  C:\Windows\System\mJalVoq.exe
  2⤵
  PID:7776
- C:\Windows\System\iPqQbrQ.exe
  C:\Windows\System\iPqQbrQ.exe
  2⤵
  PID:8160
- C:\Windows\System\AehyjQI.exe
  C:\Windows\System\AehyjQI.exe
  2⤵
  PID:7904
- C:\Windows\System\wBvEJwi.exe
  C:\Windows\System\wBvEJwi.exe
  2⤵
  PID:7604
- C:\Windows\System\CJKdlhF.exe
  C:\Windows\System\CJKdlhF.exe
  2⤵
  PID:7616
- C:\Windows\System\PHzqhvq.exe
  C:\Windows\System\PHzqhvq.exe
  2⤵
  PID:8064
- C:\Windows\System\GOTigbK.exe
  C:\Windows\System\GOTigbK.exe
  2⤵
  PID:6756
- C:\Windows\System\bUBjrXa.exe
  C:\Windows\System\bUBjrXa.exe
  2⤵
  PID:7444
- C:\Windows\System\iWHtetN.exe
  C:\Windows\System\iWHtetN.exe
  2⤵
  PID:7436
- C:\Windows\System\PpBZmgR.exe
  C:\Windows\System\PpBZmgR.exe
  2⤵
  PID:8208
- C:\Windows\System\WYzdeVW.exe
  C:\Windows\System\WYzdeVW.exe
  2⤵
  PID:8224
- C:\Windows\System\SidJeOk.exe
  C:\Windows\System\SidJeOk.exe
  2⤵
  PID:8240
- C:\Windows\System\RDpoBSv.exe
  C:\Windows\System\RDpoBSv.exe
  2⤵
  PID:8256
- C:\Windows\System\yvfeTQs.exe
  C:\Windows\System\yvfeTQs.exe
  2⤵
  PID:8272
- C:\Windows\System\nXmLHuM.exe
  C:\Windows\System\nXmLHuM.exe
  2⤵
  PID:8288
- C:\Windows\System\jwsMqCk.exe
  C:\Windows\System\jwsMqCk.exe
  2⤵
  PID:8304
- C:\Windows\System\kqiXSHN.exe
  C:\Windows\System\kqiXSHN.exe
  2⤵
  PID:8320
- C:\Windows\System\TFqwRnC.exe
  C:\Windows\System\TFqwRnC.exe
  2⤵
  PID:8336
- C:\Windows\System\vLsINqb.exe
  C:\Windows\System\vLsINqb.exe
  2⤵
  PID:8352
- C:\Windows\System\JJXVhsZ.exe
  C:\Windows\System\JJXVhsZ.exe
  2⤵
  PID:8368
- C:\Windows\System\YdlXrna.exe
  C:\Windows\System\YdlXrna.exe
  2⤵
  PID:8384
- C:\Windows\System\uevrjBN.exe
  C:\Windows\System\uevrjBN.exe
  2⤵
  PID:8400
- C:\Windows\System\bEwADpM.exe
  C:\Windows\System\bEwADpM.exe
  2⤵
  PID:8416
- C:\Windows\System\nTTeOHV.exe
  C:\Windows\System\nTTeOHV.exe
  2⤵
  PID:8436
- C:\Windows\System\plFRZUJ.exe
  C:\Windows\System\plFRZUJ.exe
  2⤵
  PID:8452
- C:\Windows\System\yuTiRjk.exe
  C:\Windows\System\yuTiRjk.exe
  2⤵
  PID:8468
- C:\Windows\System\mBzRCMF.exe
  C:\Windows\System\mBzRCMF.exe
  2⤵
  PID:8484
- C:\Windows\System\wzaZZTn.exe
  C:\Windows\System\wzaZZTn.exe
  2⤵
  PID:8500
- C:\Windows\System\yWVjoVe.exe
  C:\Windows\System\yWVjoVe.exe
  2⤵
  PID:8516
- C:\Windows\System\CogBMkO.exe
  C:\Windows\System\CogBMkO.exe
  2⤵
  PID:8532
- C:\Windows\System\NWzynmE.exe
  C:\Windows\System\NWzynmE.exe
  2⤵
  PID:8548
- C:\Windows\System\vtcAYBT.exe
  C:\Windows\System\vtcAYBT.exe
  2⤵
  PID:8564
- C:\Windows\System\moWlHci.exe
  C:\Windows\System\moWlHci.exe
  2⤵
  PID:8580
- C:\Windows\System\xBcDMNS.exe
  C:\Windows\System\xBcDMNS.exe
  2⤵
  PID:8596
- C:\Windows\System\MzVBMUg.exe
  C:\Windows\System\MzVBMUg.exe
  2⤵
  PID:8612
- C:\Windows\System\NtJOMOQ.exe
  C:\Windows\System\NtJOMOQ.exe
  2⤵
  PID:8628
- C:\Windows\System\XqvlUES.exe
  C:\Windows\System\XqvlUES.exe
  2⤵
  PID:8644
- C:\Windows\System\bmnTIFd.exe
  C:\Windows\System\bmnTIFd.exe
  2⤵
  PID:8660
- C:\Windows\System\PzsMIIL.exe
  C:\Windows\System\PzsMIIL.exe
  2⤵
  PID:8676
- C:\Windows\System\OLYMdUi.exe
  C:\Windows\System\OLYMdUi.exe
  2⤵
  PID:8692
- C:\Windows\System\NcfKcIv.exe
  C:\Windows\System\NcfKcIv.exe
  2⤵
  PID:8708
- C:\Windows\System\EPhiNXq.exe
  C:\Windows\System\EPhiNXq.exe
  2⤵
  PID:8724
- C:\Windows\System\vnuQXOb.exe
  C:\Windows\System\vnuQXOb.exe
  2⤵
  PID:8740
- C:\Windows\System\fvKobFZ.exe
  C:\Windows\System\fvKobFZ.exe
  2⤵
  PID:8756
- C:\Windows\System\TNhAZfn.exe
  C:\Windows\System\TNhAZfn.exe
  2⤵
  PID:8772
- C:\Windows\System\kZfMRJy.exe
  C:\Windows\System\kZfMRJy.exe
  2⤵
  PID:8788
- C:\Windows\System\uasYNuL.exe
  C:\Windows\System\uasYNuL.exe
  2⤵
  PID:8804
- C:\Windows\System\cYhnaZG.exe
  C:\Windows\System\cYhnaZG.exe
  2⤵
  PID:8820
- C:\Windows\System\iDhmwjC.exe
  C:\Windows\System\iDhmwjC.exe
  2⤵
  PID:8836
- C:\Windows\System\MLOYCnU.exe
  C:\Windows\System\MLOYCnU.exe
  2⤵
  PID:8852
- C:\Windows\System\LfQgNsT.exe
  C:\Windows\System\LfQgNsT.exe
  2⤵
  PID:8868
- C:\Windows\System\jYypYcG.exe
  C:\Windows\System\jYypYcG.exe
  2⤵
  PID:8884
- C:\Windows\System\rNZxHaU.exe
  C:\Windows\System\rNZxHaU.exe
  2⤵
  PID:8900
- C:\Windows\System\CduYCut.exe
  C:\Windows\System\CduYCut.exe
  2⤵
  PID:8916
- C:\Windows\System\lVoHMpR.exe
  C:\Windows\System\lVoHMpR.exe
  2⤵
  PID:8932
- C:\Windows\System\ItRnqWB.exe
  C:\Windows\System\ItRnqWB.exe
  2⤵
  PID:8948
- C:\Windows\System\ZGIzqcb.exe
  C:\Windows\System\ZGIzqcb.exe
  2⤵
  PID:8964
- C:\Windows\System\DZgMvdn.exe
  C:\Windows\System\DZgMvdn.exe
  2⤵
  PID:8980
- C:\Windows\System\uAUGhPl.exe
  C:\Windows\System\uAUGhPl.exe
  2⤵
  PID:8996
- C:\Windows\System\AMpOcLz.exe
  C:\Windows\System\AMpOcLz.exe
  2⤵
  PID:9020
- C:\Windows\System\MlxJDVM.exe
  C:\Windows\System\MlxJDVM.exe
  2⤵
  PID:9036
- C:\Windows\System\YRrMGnU.exe
  C:\Windows\System\YRrMGnU.exe
  2⤵
  PID:9052
- C:\Windows\System\lgMDCrX.exe
  C:\Windows\System\lgMDCrX.exe
  2⤵
  PID:9068
- C:\Windows\System\KhgJdzV.exe
  C:\Windows\System\KhgJdzV.exe
  2⤵
  PID:9084
- C:\Windows\System\gVFXPjz.exe
  C:\Windows\System\gVFXPjz.exe
  2⤵
  PID:9100
- C:\Windows\System\YogVKVI.exe
  C:\Windows\System\YogVKVI.exe
  2⤵
  PID:9116
- C:\Windows\System\dvmctva.exe
  C:\Windows\System\dvmctva.exe
  2⤵
  PID:9132
- C:\Windows\System\LLonmTp.exe
  C:\Windows\System\LLonmTp.exe
  2⤵
  PID:9148
- C:\Windows\System\rGRdJiP.exe
  C:\Windows\System\rGRdJiP.exe
  2⤵
  PID:9164
- C:\Windows\System\BlCsGhu.exe
  C:\Windows\System\BlCsGhu.exe
  2⤵
  PID:9180
- C:\Windows\System\vSOdeEQ.exe
  C:\Windows\System\vSOdeEQ.exe
  2⤵
  PID:9196
- C:\Windows\System\gEwkJvZ.exe
  C:\Windows\System\gEwkJvZ.exe
  2⤵
  PID:9212
- C:\Windows\System\xjQARst.exe
  C:\Windows\System\xjQARst.exe
  2⤵
  PID:8236
- C:\Windows\System\ioUvbWz.exe
  C:\Windows\System\ioUvbWz.exe
  2⤵
  PID:8264
- C:\Windows\System\IZmIdPH.exe
  C:\Windows\System\IZmIdPH.exe
  2⤵
  PID:7872
- C:\Windows\System\NqjCPpT.exe
  C:\Windows\System\NqjCPpT.exe
  2⤵
  PID:8300
- C:\Windows\System\TMdmKhi.exe
  C:\Windows\System\TMdmKhi.exe
  2⤵
  PID:8364
- C:\Windows\System\nOCKHGT.exe
  C:\Windows\System\nOCKHGT.exe
  2⤵
  PID:7696
- C:\Windows\System\pwZKmGb.exe
  C:\Windows\System\pwZKmGb.exe
  2⤵
  PID:7712
- C:\Windows\System\oIaQPxT.exe
  C:\Windows\System\oIaQPxT.exe
  2⤵
  PID:8344
- C:\Windows\System\CTmLngG.exe
  C:\Windows\System\CTmLngG.exe
  2⤵
  PID:7420
- C:\Windows\System\CtOBjoH.exe
  C:\Windows\System\CtOBjoH.exe
  2⤵
  PID:8348
- C:\Windows\System\SgyvUOk.exe
  C:\Windows\System\SgyvUOk.exe
  2⤵
  PID:8424
- C:\Windows\System\RouiOGD.exe
  C:\Windows\System\RouiOGD.exe
  2⤵
  PID:8460
- C:\Windows\System\fwohYSD.exe
  C:\Windows\System\fwohYSD.exe
  2⤵
  PID:8492
- C:\Windows\System\dLqlFbc.exe
  C:\Windows\System\dLqlFbc.exe
  2⤵
  PID:8556
- C:\Windows\System\gbuDJKL.exe
  C:\Windows\System\gbuDJKL.exe
  2⤵
  PID:8620
- C:\Windows\System\uGCMUsa.exe
  C:\Windows\System\uGCMUsa.exe
  2⤵
  PID:8684
- C:\Windows\System\qiKtwnF.exe
  C:\Windows\System\qiKtwnF.exe
  2⤵
  PID:8540
- C:\Windows\System\fdWAVCA.exe
  C:\Windows\System\fdWAVCA.exe
  2⤵
  PID:8716
- C:\Windows\System\njAKbcq.exe
  C:\Windows\System\njAKbcq.exe
  2⤵
  PID:8572
- C:\Windows\System\HUesVMe.exe
  C:\Windows\System\HUesVMe.exe
  2⤵
  PID:8720
- C:\Windows\System\mLIHdtj.exe
  C:\Windows\System\mLIHdtj.exe
  2⤵
  PID:8732
- C:\Windows\System\KncmKrA.exe
  C:\Windows\System\KncmKrA.exe
  2⤵
  PID:8768
- C:\Windows\System\cQeeqft.exe
  C:\Windows\System\cQeeqft.exe
  2⤵
  PID:8800
- C:\Windows\System\EbZxAon.exe
  C:\Windows\System\EbZxAon.exe
  2⤵
  PID:8848
- C:\Windows\System\ecfkDgZ.exe
  C:\Windows\System\ecfkDgZ.exe
  2⤵
  PID:8912
- C:\Windows\System\OOpKXgq.exe
  C:\Windows\System\OOpKXgq.exe
  2⤵
  PID:8972
- C:\Windows\System\jRXHfKi.exe
  C:\Windows\System\jRXHfKi.exe
  2⤵
  PID:8828
- C:\Windows\System\HDmYeLV.exe
  C:\Windows\System\HDmYeLV.exe
  2⤵
  PID:8892
- C:\Windows\System\HslkUDX.exe
  C:\Windows\System\HslkUDX.exe
  2⤵
  PID:8956
- C:\Windows\System\nTQsQcF.exe
  C:\Windows\System\nTQsQcF.exe
  2⤵
  PID:9016
- C:\Windows\System\mHeinvV.exe
  C:\Windows\System\mHeinvV.exe
  2⤵
  PID:9048
- C:\Windows\System\MVQKBkv.exe
  C:\Windows\System\MVQKBkv.exe
  2⤵
  PID:9064
- C:\Windows\System\wSIgftA.exe
  C:\Windows\System\wSIgftA.exe
  2⤵
  PID:9112
- C:\Windows\System\VpVAXkW.exe
  C:\Windows\System\VpVAXkW.exe
  2⤵
  PID:9128
- C:\Windows\System\OEEFUYD.exe
  C:\Windows\System\OEEFUYD.exe
  2⤵
  PID:9176
- C:\Windows\System\oSqXWoD.exe
  C:\Windows\System\oSqXWoD.exe
  2⤵
  PID:9208
- C:\Windows\System\mgqLXpc.exe
  C:\Windows\System\mgqLXpc.exe
  2⤵
  PID:8296
- C:\Windows\System\hJuctWC.exe
  C:\Windows\System\hJuctWC.exe
  2⤵
  PID:7780
- C:\Windows\System\YKpEtqo.exe
  C:\Windows\System\YKpEtqo.exe
  2⤵
  PID:7248
- C:\Windows\System\wkiiTmp.exe
  C:\Windows\System\wkiiTmp.exe
  2⤵
  PID:8432
- C:\Windows\System\xvUczIm.exe
  C:\Windows\System\xvUczIm.exe
  2⤵
  PID:8412
- C:\Windows\System\ZXGfvSp.exe
  C:\Windows\System\ZXGfvSp.exe
  2⤵
  PID:8360
- C:\Windows\System\dtzzlRd.exe
  C:\Windows\System\dtzzlRd.exe
  2⤵
  PID:8652
- C:\Windows\System\eJhCJoc.exe
  C:\Windows\System\eJhCJoc.exe
  2⤵
  PID:8608
- C:\Windows\System\RbYagqU.exe
  C:\Windows\System\RbYagqU.exe
  2⤵
  PID:8764
- C:\Windows\System\HtvoKkr.exe
  C:\Windows\System\HtvoKkr.exe
  2⤵
  PID:8592
- C:\Windows\System\QVVdmXn.exe
  C:\Windows\System\QVVdmXn.exe
  2⤵
  PID:8864
- C:\Windows\System\LnxyNWo.exe
  C:\Windows\System\LnxyNWo.exe
  2⤵
  PID:9060
- C:\Windows\System\aMJTTJc.exe
  C:\Windows\System\aMJTTJc.exe
  2⤵
  PID:8512
- C:\Windows\System\teszULZ.exe
  C:\Windows\System\teszULZ.exe
  2⤵
  PID:9144
- C:\Windows\System\lNoZkTm.exe
  C:\Windows\System\lNoZkTm.exe
  2⤵
  PID:8908
- C:\Windows\System\ZzzPWgl.exe
  C:\Windows\System\ZzzPWgl.exe
  2⤵
  PID:9044
- C:\Windows\System\QpJdBQS.exe
  C:\Windows\System\QpJdBQS.exe
  2⤵
  PID:9124
- C:\Windows\System\nZLxknU.exe
  C:\Windows\System\nZLxknU.exe
  2⤵
  PID:9204
- C:\Windows\System\YMZEXES.exe
  C:\Windows\System\YMZEXES.exe
  2⤵
  PID:8316
- C:\Windows\System\xMbsFbx.exe
  C:\Windows\System\xMbsFbx.exe
  2⤵
  PID:8668
- C:\Windows\System\gEAxGvW.exe
  C:\Windows\System\gEAxGvW.exe
  2⤵
  PID:8252
- C:\Windows\System\XCIfhBk.exe
  C:\Windows\System\XCIfhBk.exe
  2⤵
  PID:8528
- C:\Windows\System\gSbWQvp.exe
  C:\Windows\System\gSbWQvp.exe
  2⤵
  PID:8588
- C:\Windows\System\hXgNViD.exe
  C:\Windows\System\hXgNViD.exe
  2⤵
  PID:8748
- C:\Windows\System\uQziMmQ.exe
  C:\Windows\System\uQziMmQ.exe
  2⤵
  PID:8464
- C:\Windows\System\VOFmBol.exe
  C:\Windows\System\VOFmBol.exe
  2⤵
  PID:9080
- C:\Windows\System\wnMWxnp.exe
  C:\Windows\System\wnMWxnp.exe
  2⤵
  PID:8796
- C:\Windows\System\evpqmDc.exe
  C:\Windows\System\evpqmDc.exe
  2⤵
  PID:8944
- C:\Windows\System\DqlbsHf.exe
  C:\Windows\System\DqlbsHf.exe
  2⤵
  PID:8312
- C:\Windows\System\bQpCSKK.exe
  C:\Windows\System\bQpCSKK.exe
  2⤵
  PID:8928
- C:\Windows\System\kdyXwGy.exe
  C:\Windows\System\kdyXwGy.exe
  2⤵
  PID:9108
- C:\Windows\System\wAdPdFg.exe
  C:\Windows\System\wAdPdFg.exe
  2⤵
  PID:9220
- C:\Windows\System\XqPKmrZ.exe
  C:\Windows\System\XqPKmrZ.exe
  2⤵
  PID:9236
- C:\Windows\System\oLayMtP.exe
  C:\Windows\System\oLayMtP.exe
  2⤵
  PID:9252
- C:\Windows\System\Pirvclu.exe
  C:\Windows\System\Pirvclu.exe
  2⤵
  PID:9268
- C:\Windows\System\WoOSDbG.exe
  C:\Windows\System\WoOSDbG.exe
  2⤵
  PID:9284
- C:\Windows\System\izDGUpW.exe
  C:\Windows\System\izDGUpW.exe
  2⤵
  PID:9300
- C:\Windows\System\JllDYst.exe
  C:\Windows\System\JllDYst.exe
  2⤵
  PID:9316
- C:\Windows\System\oTVhEmz.exe
  C:\Windows\System\oTVhEmz.exe
  2⤵
  PID:9332
- C:\Windows\System\UWhzzjq.exe
  C:\Windows\System\UWhzzjq.exe
  2⤵
  PID:9348
- C:\Windows\System\kDSxAbb.exe
  C:\Windows\System\kDSxAbb.exe
  2⤵
  PID:9364
- C:\Windows\System\EuNvcNB.exe
  C:\Windows\System\EuNvcNB.exe
  2⤵
  PID:9380
- C:\Windows\System\RzjYuNJ.exe
  C:\Windows\System\RzjYuNJ.exe
  2⤵
  PID:9396
- C:\Windows\System\xanYpYX.exe
  C:\Windows\System\xanYpYX.exe
  2⤵
  PID:9412
- C:\Windows\System\vBAkJeH.exe
  C:\Windows\System\vBAkJeH.exe
  2⤵
  PID:9428
- C:\Windows\System\xZqBAfl.exe
  C:\Windows\System\xZqBAfl.exe
  2⤵
  PID:9444
- C:\Windows\System\YkOHFoa.exe
  C:\Windows\System\YkOHFoa.exe
  2⤵
  PID:9460
- C:\Windows\System\GWCTtRs.exe
  C:\Windows\System\GWCTtRs.exe
  2⤵
  PID:9476
- C:\Windows\System\rxRsADH.exe
  C:\Windows\System\rxRsADH.exe
  2⤵
  PID:9492
- C:\Windows\System\tMViwBo.exe
  C:\Windows\System\tMViwBo.exe
  2⤵
  PID:9508
- C:\Windows\System\XWrMMey.exe
  C:\Windows\System\XWrMMey.exe
  2⤵
  PID:9524
- C:\Windows\System\uHsbLxj.exe
  C:\Windows\System\uHsbLxj.exe
  2⤵
  PID:9540
- C:\Windows\System\kGYElBj.exe
  C:\Windows\System\kGYElBj.exe
  2⤵
  PID:9556
- C:\Windows\System\XIAHwBm.exe
  C:\Windows\System\XIAHwBm.exe
  2⤵
  PID:9572
- C:\Windows\System\iaQUGMv.exe
  C:\Windows\System\iaQUGMv.exe
  2⤵
  PID:9588
- C:\Windows\System\lZeSohQ.exe
  C:\Windows\System\lZeSohQ.exe
  2⤵
  PID:9604
- C:\Windows\System\gWiAXbQ.exe
  C:\Windows\System\gWiAXbQ.exe
  2⤵
  PID:9620
- C:\Windows\System\NLNLdXb.exe
  C:\Windows\System\NLNLdXb.exe
  2⤵
  PID:9636
- C:\Windows\System\SELdQbm.exe
  C:\Windows\System\SELdQbm.exe
  2⤵
  PID:9652
- C:\Windows\System\jjDJzrn.exe
  C:\Windows\System\jjDJzrn.exe
  2⤵
  PID:9668
- C:\Windows\System\FLtPfaX.exe
  C:\Windows\System\FLtPfaX.exe
  2⤵
  PID:9684
- C:\Windows\System\mzsoUAX.exe
  C:\Windows\System\mzsoUAX.exe
  2⤵
  PID:9700
- C:\Windows\System\BfBuSTt.exe
  C:\Windows\System\BfBuSTt.exe
  2⤵
  PID:9716
- C:\Windows\System\xEWtLwf.exe
  C:\Windows\System\xEWtLwf.exe
  2⤵
  PID:9732
- C:\Windows\System\nhhAhSV.exe
  C:\Windows\System\nhhAhSV.exe
  2⤵
  PID:9748
- C:\Windows\System\BkGPvTc.exe
  C:\Windows\System\BkGPvTc.exe
  2⤵
  PID:9772
- C:\Windows\System\HqYtFQp.exe
  C:\Windows\System\HqYtFQp.exe
  2⤵
  PID:9788
- C:\Windows\System\VgyqTBw.exe
  C:\Windows\System\VgyqTBw.exe
  2⤵
  PID:9804
- C:\Windows\System\XanFLid.exe
  C:\Windows\System\XanFLid.exe
  2⤵
  PID:9820
- C:\Windows\System\KsHFsDa.exe
  C:\Windows\System\KsHFsDa.exe
  2⤵
  PID:9836
- C:\Windows\System\nVhdisZ.exe
  C:\Windows\System\nVhdisZ.exe
  2⤵
  PID:9852
- C:\Windows\System\looKMcl.exe
  C:\Windows\System\looKMcl.exe
  2⤵
  PID:9868
- C:\Windows\System\RTFpgos.exe
  C:\Windows\System\RTFpgos.exe
  2⤵
  PID:9888
- C:\Windows\System\TrQnjfb.exe
  C:\Windows\System\TrQnjfb.exe
  2⤵
  PID:9904
- C:\Windows\System\IJAVOfW.exe
  C:\Windows\System\IJAVOfW.exe
  2⤵
  PID:9920
- C:\Windows\System\LxfavSH.exe
  C:\Windows\System\LxfavSH.exe
  2⤵
  PID:9936
- C:\Windows\System\ekLCEan.exe
  C:\Windows\System\ekLCEan.exe
  2⤵
  PID:9952
- C:\Windows\System\zRiZVwk.exe
  C:\Windows\System\zRiZVwk.exe
  2⤵
  PID:9968
- C:\Windows\System\PtYfBfY.exe
  C:\Windows\System\PtYfBfY.exe
  2⤵
  PID:9984
- C:\Windows\System\RZVUNdC.exe
  C:\Windows\System\RZVUNdC.exe
  2⤵
  PID:10000
- C:\Windows\System\WhYruJW.exe
  C:\Windows\System\WhYruJW.exe
  2⤵
  PID:10016
- C:\Windows\System\GYcZHVV.exe
  C:\Windows\System\GYcZHVV.exe
  2⤵
  PID:10032
- C:\Windows\System\FkvfKKJ.exe
  C:\Windows\System\FkvfKKJ.exe
  2⤵
  PID:10048
- C:\Windows\System\ubtBjGx.exe
  C:\Windows\System\ubtBjGx.exe
  2⤵
  PID:10064
- C:\Windows\System\cieKLkH.exe
  C:\Windows\System\cieKLkH.exe
  2⤵
  PID:10080
- C:\Windows\System\rEeDWMd.exe
  C:\Windows\System\rEeDWMd.exe
  2⤵
  PID:10096
- C:\Windows\System\qsJrZwn.exe
  C:\Windows\System\qsJrZwn.exe
  2⤵
  PID:10112
- C:\Windows\System\DVgjAiD.exe
  C:\Windows\System\DVgjAiD.exe
  2⤵
  PID:10128
- C:\Windows\System\dDmdvYV.exe
  C:\Windows\System\dDmdvYV.exe
  2⤵
  PID:10144
- C:\Windows\System\hFEUQkW.exe
  C:\Windows\System\hFEUQkW.exe
  2⤵
  PID:10160
- C:\Windows\System\LwssuBz.exe
  C:\Windows\System\LwssuBz.exe
  2⤵
  PID:10176
- C:\Windows\System\RchHKVm.exe
  C:\Windows\System\RchHKVm.exe
  2⤵
  PID:10192
- C:\Windows\System\oJOJFyU.exe
  C:\Windows\System\oJOJFyU.exe
  2⤵
  PID:10208
- C:\Windows\System\hVdmIBF.exe
  C:\Windows\System\hVdmIBF.exe
  2⤵
  PID:10224
- C:\Windows\System\sAOdlFE.exe
  C:\Windows\System\sAOdlFE.exe
  2⤵
  PID:8736
- C:\Windows\System\OpfXsSz.exe
  C:\Windows\System\OpfXsSz.exe
  2⤵
  PID:8508
- C:\Windows\System\Mkjktjw.exe
  C:\Windows\System\Mkjktjw.exe
  2⤵
  PID:8860
- C:\Windows\System\XwipjIK.exe
  C:\Windows\System\XwipjIK.exe
  2⤵
  PID:9260
- C:\Windows\System\HtHVBqB.exe
  C:\Windows\System\HtHVBqB.exe
  2⤵
  PID:9308
- C:\Windows\System\NQJdebp.exe
  C:\Windows\System\NQJdebp.exe
  2⤵
  PID:9372
- C:\Windows\System\WxEFSnv.exe
  C:\Windows\System\WxEFSnv.exe
  2⤵
  PID:9436
- C:\Windows\System\tuSscCm.exe
  C:\Windows\System\tuSscCm.exe
  2⤵
  PID:9500
- C:\Windows\System\lofPevw.exe
  C:\Windows\System\lofPevw.exe
  2⤵
  PID:9564
- C:\Windows\System\iDpciCs.exe
  C:\Windows\System\iDpciCs.exe
  2⤵
  PID:9628
- C:\Windows\System\evSmPLP.exe
  C:\Windows\System\evSmPLP.exe
  2⤵
  PID:9664
- C:\Windows\System\dgYJsMV.exe
  C:\Windows\System\dgYJsMV.exe
  2⤵
  PID:9324
- C:\Windows\System\IDNjeGs.exe
  C:\Windows\System\IDNjeGs.exe
  2⤵
  PID:9692
- C:\Windows\System\WLmhhjk.exe
  C:\Windows\System\WLmhhjk.exe
  2⤵
  PID:9420
- C:\Windows\System\LfHATez.exe
  C:\Windows\System\LfHATez.exe
  2⤵
  PID:9484
- C:\Windows\System\ktJTqLq.exe
  C:\Windows\System\ktJTqLq.exe
  2⤵
  PID:9724
- C:\Windows\System\XjsHgsY.exe
  C:\Windows\System\XjsHgsY.exe
  2⤵
  PID:9616
- C:\Windows\System\XImtvav.exe
  C:\Windows\System\XImtvav.exe
  2⤵
  PID:9680
- C:\Windows\System\JIdTbkt.exe
  C:\Windows\System\JIdTbkt.exe
  2⤵
  PID:9740
- C:\Windows\System\TsNOcdK.exe
  C:\Windows\System\TsNOcdK.exe
  2⤵
  PID:9160
- C:\Windows\System\IEzoVIX.exe
  C:\Windows\System\IEzoVIX.exe
  2⤵
  PID:9828

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\AUUxGnJ.exe

Filesize
1.9MB

MD5
1a3554b3f07613a56241a71c0a58aba3

SHA1
f266d8a945aa4727c8548444e01f758943b3c039

SHA256
016f4f3579eab797802aeaceb2f6a553d6a31b6b0abf895c5bb8f8e5babe690e

SHA512
7f710bf336910555878e9139267960d79adcf31db7d41de76de6b6f0c8a775746d0747dc8f1870193a153c16b054c64cb06cc6965182bcae3c314ae054a6fb34

Download Submit
C:\Windows\system\BISFtNC.exe

Filesize
1.9MB

MD5
9ba16dd54c2c529f1bfd5ee80c6302a1

SHA1
603100faa4d7deee535c57ac8d7804ca48688a1e

SHA256
10c4cb3640195f28010686399259f8821723bc9459d75153be5b6b242da07c9b

SHA512
1adbdbf5cce4489e71facfa8dd701f53ce12ca6bfe6e1ea2971641b8308a898ec26f7a81e42adebac58fae11d41e663e2ff56fde977a121320ff1db5ff79d09b

Download Submit
C:\Windows\system\BjNrcHu.exe

Filesize
1.9MB

MD5
6fb0cfe2c7dc2e364d8d0e2b4a8dd065

SHA1
036aa71f7d008c1ba97a5a965a73dc897d8c40ff

SHA256
987762dabf3c2a37c61e432655bbf48e9ba63b0cab4f66263cd8f78ac1fe2ff6

SHA512
d94e2c3310fea63d4f9e8372c88360828b2abd668a8eb78ebed322cebb79443f3ce6a494f0c20225e403007c441a68d1b9b39183c07d321b866a35ef361f0c08

Download Submit
C:\Windows\system\CZyAPky.exe

Filesize
1.9MB

MD5
8d545a491eb349e2782675f840887300

SHA1
65da911d4a2f5503383006e6f614d4ee5c5931c9

SHA256
cf2161848103017ffdf02c213457536e7db3714e380ae551280c00180e2a9767

SHA512
eb5707072c9b73c92d211b257aa3c42fc8250f2ea847046526ffee24c8b8f20795bde5b1c216914feacaf64bf1bf898ca836c5d9721252c2d38760afd6f9c86b

Download Submit
C:\Windows\system\EEpJupX.exe

Filesize
1.9MB

MD5
76e95c69c2b15fb4b9b320080dd4f87a

SHA1
88d79fea4b18b24753066464560f6c1bc5d6bcff

SHA256
6c4b9d5c351bb6a7d2b4bb6b4a1c47780522b28a52a5bab54e93cd5d159f520d

SHA512
b70154b216fd1fc948f2ad18f30541dc7d794d3f6fb9303f246a46874fb79bf43a4bdd7acb83b107448e6bbc10beae5771959cea80be7a64e1d160836d94eb82

Download Submit
C:\Windows\system\FEHuEhf.exe

Filesize
1.9MB

MD5
329a303be559a345f28640d67f5b0057

SHA1
bdcece2577cd071968aa72d595a8e1b300c26a8a

SHA256
719a853191858b502456cb915509f590f1f9156e016fe8703a5d721ef17c357c

SHA512
d979ccfd35f7098d3608c80513382a22a571b61ce467743aeffa4dd8245433a4e8c2eec543c1604543f702ed748ce23f9bfd4be8cba9bb7752a0b65e88a179cc

Download Submit
C:\Windows\system\ILZwrvp.exe

Filesize
8B

MD5
d8f939ee099285eb5299be97436baa4d

SHA1
e982a1f84114c575869e996a9a214509ee9e0e66

SHA256
e7c262920797c23676b4311de18f70723dfd833b4d38ec2d89ac9d49b2f67690

SHA512
e31bd5edb5ca774adb6b49128eb293ef2a9394fca94c3def6901a7d4903de06386842bbd81ce1630fc901df52644e493a263be2bc59bd514aa7a1f110b251fe2

Download Submit
C:\Windows\system\JwNVMsx.exe

Filesize
1.9MB

MD5
0d2f8579af7ecd20555426dba4418be0

SHA1
a0cccfbe7e0e02ea5443604187db2b32db1b1b23

SHA256
9c2e1311b308322722516db7a9c1484f3b35aa0dedbb51b79d658af21106b452

SHA512
e5f21fc67ca265b80dfd8aa4bbd070b8d05d9e512777c666eb69983ae927f54d163f5d10b63a1b9c70ad4f064d700384ce12172b91a169e11801e6ab576b1401

Download Submit
C:\Windows\system\MgzEjnx.exe

Filesize
1.9MB

MD5
f74891f7e6c34a7c1060e33e6dee919f

SHA1
25ae53409f8d8cff7e9e4db5f27596cc814baf1f

SHA256
4b2128fae7165cc9b951a64b79593a0e2b58b93debc67e990cbbc86f26c05430

SHA512
5a8f38b8486c76252bf579fa7d541bef280d6fcf60a5e84007ab863489523cc5388e1159ac57578a73a79e5c492c2fff0b44d4e959f9dae760490c733fc9c2e5

Download Submit
C:\Windows\system\OmTCdfT.exe

Filesize
1.9MB

MD5
110b244a6702d7f5d901df25a4d2a3f5

SHA1
7d24601ce8072d5a05c39e62e73106b3442eac94

SHA256
a8fdf1529ab4af616699579077fb1ab801a836b2bf2ba4b801ac743954bfa38b

SHA512
b121f43c0212758a5d6788c7b18139711e571c9df0c56a841ade56e02b878a0ff3dc08b697402ecd5f38cca5d173f47fcf1b9dddf413b73c5033dc8a016ab248

Download Submit
C:\Windows\system\StaYfsX.exe

Filesize
1.9MB

MD5
16de2c4c84c5f92b1c05ccd2daf735f6

SHA1
e8f0dc17b0abbf2ac3fe35542c5f721889d7f724

SHA256
7856c27b70fc08c724588410cb881d882c1dae268b50fa41fb1465295698dcfc

SHA512
89f23462dea715a6b4e06f34d6c3857cd9dbd6b1d03c664627caeac70035fdea7c630b7e668be776a763f2e005e1ae848f82791a0f0f0c81aa75e2130fbfea2c

Download Submit
C:\Windows\system\TIClZeZ.exe

Filesize
1.9MB

MD5
83fef3240bbbb22d8ec9c2b114bcaccb

SHA1
d438b2a6514c3d2a5f874c2e87e04b1abfb24154

SHA256
aee00cceccf0bec070b5d1b758831c7d356ab4342400fa63a1839a95ab9718e0

SHA512
0d28a61e7b818e23438626e5ee958c7b29a48b97cb24b1b3e2bf908338410b170dc1dc4abb6d7eae7f5feba4aa669c609185bf937283108ea7062224501a8c94

Download Submit
C:\Windows\system\cItKRDM.exe

Filesize
1.9MB

MD5
ddc5e05fd02419a07a85afbf50adb18e

SHA1
7827f8a36141a59f3bc94f37859dc2b3520e2428

SHA256
7969720364b4dcb3af4b3f5f2db612254dab516e7c25f4ba86a2eca81128d922

SHA512
d9fdda6b5bdfc46bb2edbb805459ead747fa056f65b6fffe24eb34c2f21dd35f0ef8e54a4ed5d4311de81f453954844caacc03deff868e07950fa711c02a1266

Download Submit
C:\Windows\system\evoKUPw.exe

Filesize
1.9MB

MD5
7778c0e5dc4414bb69e149ff039df553

SHA1
af2108313480c1e00e4d1bcb441ed882b5f09d18

SHA256
7e9e931d73b0dca40b294ccd13d8587ef33e106a17f3f68ed944d821b960d6e3

SHA512
10b1a9d01738917b9204a8f298d248f7ca6a5c2837c9ef29cb09d25dbb7a73e3e082aee3c543d02355dc6d8eccb3598afbb6bac048460173b6b86d3084fcf8b8

Download Submit
C:\Windows\system\gBlbxxw.exe

Filesize
1.9MB

MD5
3a6a5dafdd1a816a71131c1255e6c037

SHA1
f24f29dcdfd2bd116cd35d583bb40fb1910321ba

SHA256
3f67497648b06485efde7e53f144ed78b4f67cdfc29c88a56ceed7432baec464

SHA512
9ba4ad600bbe205e38130d83878024e33d62fc9f13d595b0e23d77cd274ae65984b56b8f74d4e8aae6bd851491f0e4144bf55fa3240b8ed95594efe82a5783b7

Download Submit
C:\Windows\system\kOJrvJy.exe

Filesize
1.9MB

MD5
f376bb68d26e7664960577bb2c7a6fd7

SHA1
9eaf6bf01df8d8efbe93a0be06811ec62aa8a4b5

SHA256
0405485e6e114b100c4bdbff12c1a79a40f3d12f09d3c3b466339b72ae3c7a7e

SHA512
1883b0ad0e1a000a0edd6c982be648027ceb792e6fa1f93be9aaa5c960096240731118c8410c3e112f62b3827b622c80e7577e0b22820e5399debcea63c59cc8

Download Submit
C:\Windows\system\klwnJrC.exe

Filesize
1.9MB

MD5
d53ef42509cf3268d5211d9bebe4ba21

SHA1
e39c096f4faab6f9f0cc237c283dd71c171d9a39

SHA256
aae36e128467f3bfb589267a73e38d476b1c4001e619639d9749920de2039610

SHA512
f872558022988de221ec41f13856c69109e6328469ba2ccc0a3721fda6711dc41ceb0ff537c9cf494fdc8e2b6e1851004b1c0e548d864ae2471dcf008bd4fce4

Download Submit
C:\Windows\system\ngUrNGd.exe

Filesize
1.9MB

MD5
a2acc24954506a257d19fd853bbcfc68

SHA1
eb8e1aa0a30e0b4c75c6ed3f8ad805a843e8cdaf

SHA256
6eac7faa90557808c3e996cf0f6488f1ddb9f42f2aed949410b9241033d778df

SHA512
e494405c5e8422777f9210a7edc878c10bd8a7c51329a8a63ef8acd698e4b051102c332efaa49312194c50977dcccd190763adc1acd9a5f87df77f9df393ba1b

Download Submit
C:\Windows\system\noTDKCl.exe

Filesize
1.9MB

MD5
f9ba1d082b9f570bb76c32841819ad79

SHA1
d29a4c28b82e10e5e66048aa9031c018b89f82e1

SHA256
57e808c51fe10975153e64a885e43f95e92a1c60d9a849fd6a79f3eb1dbe02ed

SHA512
25b9a8358f0787e24415f3391fc9b14cb6f7380b5a1c9fd7449efd97984ed2e57a0a63ead6041206656249af67bcf87aca100bbfe03f1160c1f8b01f3c3ec9d1

Download Submit
C:\Windows\system\pVBzQWQ.exe

Filesize
1.9MB

MD5
e03c8db6dd9ec374fbba800ecdcbc433

SHA1
c200446ac3c0cb6a8777827147f70d4ff648db8f

SHA256
1dcafd3dc8b3f33fc260d57068c1175ce5c43e386ac9c795b4fa62addf69daa0

SHA512
f64b43dced8b6a487cc6fdb79778a4883cd55aeb1f61faf236ccf20920df5db6c3a76a3a6d970005423f347eb1842fb7f458f568ac3a9a475a309c6e5555c25b

Download Submit
C:\Windows\system\qvjhqJj.exe

Filesize
1.9MB

MD5
fa48c26ffa17ff7a99d442bdcc5e736a

SHA1
b2bceb749d0051f02e7d0ec1a69a035d1e08a6eb

SHA256
8cf6c056789ba3e1eac4ffed64f3ab2a0b63e50fd28937f4c8422e063afacf67

SHA512
954cfd608383145a216abda7939bb8cf43a4889ffe2573bd61b421ab1e229e13ba2bc35762611bcb33af0344f14c742dd026dc7e653651be2a1ee9fcfb3a899e

Download Submit
C:\Windows\system\yuyXosR.exe

Filesize
1.9MB

MD5
12c0d433e95bc69be44748ead1c49949

SHA1
d54e829f371889aeb2a26a3de262074ed9db669c

SHA256
65c0a0cc43ee4eed2457c4b2046c259d5ffab3a67bd508f860c2364757abdf67

SHA512
9ddff513661cf49c97e8e2553735a8af9f9e396a481e6daabed3fa22c9bc8034792d19755f51a7e02219772c593cd6cbc89f8f7d8eb2842912bed4dbd6f14cc0

Download Submit
C:\Windows\system\zVjEKDH.exe

Filesize
1.9MB

MD5
2be4d1fbb073e15a654440654b0aeb02

SHA1
f2d0c0fd45ba76abc0a3b68e05a8143d09b70b63

SHA256
17501d600bd3ae97be4ff63e2423fb5847b17f4f35563fdd6a8f79b5c72fd003

SHA512
cf8a1dc6f7ed3914a56f3d2318257750825db35b4e72d2708e3dee5ec4f5ba3d205cb3bb9f2fbfd5bfef1cb8ee6e810bd0675a277f8bee0f811801262f9df31a

Download Submit
\Windows\system\FWcHSpU.exe

Filesize
1.9MB

MD5
be507d80e8989fde0f786ef1de6b6662

SHA1
f4af34273dc047e5a33dd8a3ce4839bcbb789545

SHA256
8b2af5b4e39d8cdd6160ecc02126d053709b0ce8b99626c6a334ee21cf27983e

SHA512
655a817c53c67ddcfbb12e889ff19146c746fa7b1bb815e65211a7865bb1cdbbe67627c5d0abb7a6a4aecfe007c99756974b9b37f2f1c8a376ace50cb7cc4ad5

Download Submit
\Windows\system\GDQUvcK.exe

Filesize
1.9MB

MD5
ce18fb637b974069d72deb97882421df

SHA1
dda4b5c88a90b479a1aef144cf566cdd4152b8c8

SHA256
7e9df76eb9bcef3848db28af01c7cf54fde6569a2387e99f1e735af7de727b95

SHA512
c0b4050a80e5a018c23afceace2eba43221fe9ab43014c501111e13ab585ef731b8caf9ee45dcdd11fe99282b76d8c0f5d91add64063cb97d88c4a2459bab3b4

Download Submit
\Windows\system\HxFgZgP.exe

Filesize
1.9MB

MD5
c7bd508e3549fe515d0a56a3860b9def

SHA1
829a8675e92a69d3f88936cbcc69c0f35bf69749

SHA256
6aeee905ee72253c65c559341cbd60758ecf7b1a42bf2acd52cbafecfef08afa

SHA512
a22a587511c4655dcf09e621128e19a46460fdbf2579a3df823d60eb2f965613810fe1ad13cf2957b6b5956ac5b33b9505e99fbb06389407f2bb783546b92fa8

Download Submit
\Windows\system\JlakuNm.exe

Filesize
1.9MB

MD5
99034ebaa59f5528b5a2b006b754da4c

SHA1
157bbbf67224b709a9f615ba902fdcf77e940d5f

SHA256
64204a434be760dbe956cb09159efbe965da1042e7caa4b3b538124d9d50ef92

SHA512
a1a93bc21b5a56ae5814a531b2a7390c57061c16de867d44e0fad9989f49afe7aa6524c3ebf93865fec5a936660b0b8cfa3fa0d9f0fd9ed241bfd264182eda61

Download Submit
\Windows\system\NAUhdbr.exe

Filesize
1.9MB

MD5
01c8aa6623672e83d911a4893671c3cb

SHA1
1aae7a9598581c530a4d088385ddfdf123ca83fe

SHA256
045442b1776a50d0bc853e50490933697b1a141abe4d191aa47e607d301be496

SHA512
3a6cb1326c588e12c2e8810630deee7697c23dc64149b5cc1182bc59504d635eb3e29b690898490ca639e152cdc3ce1839050a08fb42dc4d01444ea1cfda48e4

Download Submit
\Windows\system\NKOqdlL.exe

Filesize
1.9MB

MD5
e3adf8aaf6eb2eb12431e329617ccad1

SHA1
3b02a5830dcc2657055d86512dc0db6e813d0949

SHA256
1cf8b8014eaa817b7d732fe1144799d0734dc2679160592fce2b9bc19636b4cc

SHA512
4bcb584f039ea4ffe0be73f79f52028251ca8e226c099142ef45c02c7a61a2a7429e5c02571abdca4b8ca69ee5bd1f87656d6a55d3ade1875d514ab5f683a1ef

Download Submit
\Windows\system\QctOvGm.exe

Filesize
1.9MB

MD5
a52bc7fa297a74e80f7c66c6b26b9e1a

SHA1
dd68cd70a57d8771925df0663f4389f91d431847

SHA256
e1ba654b2c9fae353aecbef2176b88a3f5e14857a30cb89bfe5b295158ca3061

SHA512
8acbe366bf06e1b2b8ed9186189e918345406cffe8ebcb038d4db48a12117b4e03dbe28cc32e31ed1a01040d58a19fcc876c1926513e9f6840f5a6f8478014b2

Download Submit
\Windows\system\WeqMqiH.exe

Filesize
1.9MB

MD5
d51d37fa001abf78366f03f7ff5716c3

SHA1
891c2fae016df70dfe1cc5f619299b40c7b82543

SHA256
8c6caaaf64ae3d26ac4b6ba25724bf47b61ada1d4043ff8f66b945fbc67097f2

SHA512
9aed2a92b18c8c78b78893cb8143dadcf2f6f13b76cf62b17df44137db6c034a899303542242b65a697f3653240c395493be1b357c9420f7ce60356084c633b8

Download Submit
\Windows\system\XqsRHDP.exe

Filesize
1.9MB

MD5
5167eb149ac0b59a885f0a2387549baf

SHA1
2e72f52dbc976e8825ff4497a82aece1b9a138a8

SHA256
df7cec4c12ef685bb1eb55b3f5ee304eb3c959c84c625fd1aefc527db5c55c4a

SHA512
455e407188eb0245ab2e2ed890e1e428c95df3188321caac20915a7a129d8093cc28c5506c6c756fade63bf917870c1939a515b67d718c757712676c78a17ed0

Download Submit
\Windows\system\YXMevff.exe

Filesize
1.9MB

MD5
62e82d13719619e003e440237df61387

SHA1
d783e437966a54f0eb4e735e00792f4c0d177ef2

SHA256
17525192f48e222fb1d8084d66dbee80c084259ab69a3eac448dedc500273d1b

SHA512
2a33a87416dc3b73c383ce0037ba58bb7d3ec69814f9de0e2b9736472e0724d6cf98b1cc02dd775510197a504c49ab737e31e709bb11bf469b64207a1b4d93f2

Download Submit
\Windows\system\ewfBZnp.exe

Filesize
1.9MB

MD5
1c0847cc0bfab29757e2910685ed1f29

SHA1
7008cc123eedc498d18d1a80df55264e7663a06e

SHA256
b2e764ee1e36a585d84b72c0cd49b706a1e8cc101418e1f06ec57d9ba0d7abef

SHA512
b724bc4b80a83a2428c49f2f2a52f98aa9f9dcbcdc3aa2d0961ab8d2a5c7665efad594426a7b51671bcb2a9f1a995ed9cf911569b986cee09def7dc23fc8a4fc

Download Submit
\Windows\system\lgpLSQr.exe

Filesize
1.9MB

MD5
2e9d8dcf8208f9d030935232ab990f06

SHA1
7d546d582ca2fbb549e95df0b5c9265c3c706629

SHA256
e50a877c2170fb9d186f41e71c5db8549d6e0501766a94e962a2f9c361e8a89e

SHA512
385b0f49806f5a581937c0838d679d33d9e633377d3512f11695725bd41edaeadf85511b84ddabfad0a3bee1bf7e7e1e7aac7a8d1bd6b1719507241b44b55aa7

Download Submit
\Windows\system\qGuzazN.exe

Filesize
1.9MB

MD5
f01a82e8db1e9f35fb3d04544e58b1c8

SHA1
51d0ef4e8dc9a5d997591b5ed8e9a9a655513144

SHA256
befe98d0c65d1085cdbec9841dd8a46943db99ee85cff656e4bcfe831f4676c5

SHA512
2eb00e2acf501fa2f3959b8648054fa68698f52deaa23ce57efceb9f69a38e11b9498b70269ffc8fcf9a4f44a296ae46a5834bb951c030f1b9c18ae96cb1670d

Download Submit
\Windows\system\rhyMILj.exe

Filesize
1.9MB

MD5
8e6d88c2cd7c7495b57738bae6da8410

SHA1
24cb913b9c8947fe819754b2164ee0783a68f6fc

SHA256
d19b7c76d7bf779e00d654cebfae95f5c1d910a6db3a4291154a05bc72f68863

SHA512
589fa01aba597aafdba969b6577761f58f54eaeb85b9a0207f40bad2474597d37fe9a7f6096afc706f1c0b53890311deb1a87636ffc6ba53607e066c3a82a821

Download Submit
memory/1600-5087-0x000000013FB60000-0x000000013FF52000-memory.dmp

Filesize
3.9MB

Download
memory/1600-8-0x000000013FB60000-0x000000013FF52000-memory.dmp

Filesize
3.9MB

Download
memory/1752-30-0x0000000002730000-0x0000000002B22000-memory.dmp

Filesize
3.9MB

Download
memory/1752-197-0x000000013F430000-0x000000013F822000-memory.dmp

Filesize
3.9MB

Download
memory/1752-184-0x000000013F2A0000-0x000000013F692000-memory.dmp

Filesize
3.9MB

Download
memory/1752-159-0x0000000003650000-0x0000000003A42000-memory.dmp

Filesize
3.9MB

Download
memory/1752-146-0x000000013F310000-0x000000013F702000-memory.dmp

Filesize
3.9MB

Download
memory/1752-1-0x000000013FDB0000-0x00000001401A2000-memory.dmp

Filesize
3.9MB

Download
memory/1752-198-0x000000013F580000-0x000000013F972000-memory.dmp

Filesize
3.9MB

Download
memory/1752-196-0x0000000003650000-0x0000000003A42000-memory.dmp

Filesize
3.9MB

Download
memory/1752-0-0x00000000000F0000-0x0000000000100000-memory.dmp

Filesize
64KB

Download
memory/1752-185-0x000000013F4A0000-0x000000013F892000-memory.dmp

Filesize
3.9MB

Download
memory/1752-148-0x0000000003650000-0x0000000003A42000-memory.dmp

Filesize
3.9MB

Download
memory/1752-194-0x000000013F5F0000-0x000000013F9E2000-memory.dmp

Filesize
3.9MB

Download
memory/1752-57-0x000000013F2A0000-0x000000013F692000-memory.dmp

Filesize
3.9MB

Download
memory/1752-188-0x0000000003650000-0x0000000003A42000-memory.dmp

Filesize
3.9MB

Download
memory/1752-181-0x0000000003650000-0x0000000003A42000-memory.dmp

Filesize
3.9MB

Download
memory/1752-187-0x000000013F070000-0x000000013F462000-memory.dmp

Filesize
3.9MB

Download
memory/1752-182-0x000000013F530000-0x000000013F922000-memory.dmp

Filesize
3.9MB

Download
memory/1752-44-0x000000013F830000-0x000000013FC22000-memory.dmp

Filesize
3.9MB

Download
memory/2148-183-0x000000013FA60000-0x000000013FE52000-memory.dmp

Filesize
3.9MB

Download
memory/2148-5089-0x000000013FA60000-0x000000013FE52000-memory.dmp

Filesize
3.9MB

Download
memory/2348-195-0x000000013F830000-0x000000013FC22000-memory.dmp

Filesize
3.9MB

Download
memory/2348-4668-0x000000013F830000-0x000000013FC22000-memory.dmp

Filesize
3.9MB

Download
memory/2448-180-0x000000001B5C0000-0x000000001B8A2000-memory.dmp

Filesize
2.9MB

Download
memory/2448-190-0x0000000001FC0000-0x0000000001FC8000-memory.dmp

Filesize
32KB

Download
memory/2732-160-0x000000013F310000-0x000000013F702000-memory.dmp

Filesize
3.9MB

Download
memory/2736-4670-0x000000013F2A0000-0x000000013F692000-memory.dmp

Filesize
3.9MB

Download
memory/2736-191-0x000000013F2A0000-0x000000013F692000-memory.dmp

Filesize
3.9MB

Download
memory/2844-186-0x000000013FBB0000-0x000000013FFA2000-memory.dmp

Filesize
3.9MB

Download
memory/2844-4672-0x000000013FBB0000-0x000000013FFA2000-memory.dmp

Filesize
3.9MB

Download