xmrig | 35789f701b77e343adb5429545bd23aaf31d807b15b134bbfd9fe6f909210814

Analysis

max time kernel
150s
max time network
142s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
01/07/2024, 04:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

35789f701b77e343adb5429545bd23aaf31d807b15b134bbfd9fe6f909210814_NeikiAnalytics.exe
Size

1.8MB
MD5

45a4914df8d238e5f942b046f0f32b10
SHA1

cdbd1ff81b5d1dec83c8ea44d968c92507b2d779
SHA256

35789f701b77e343adb5429545bd23aaf31d807b15b134bbfd9fe6f909210814
SHA512

d8571f79341b6da0b1aac95d8d448b531b9d11604d5aca60a9f138b1c33554fc0f59af656c3af01af9cfbebcd8f599b369e13db1f834ba2e4baea7a8001fe763
SSDEEP

24576:zv3/fTLF671TilQFG4P5PMkFfkeMGvGr1t4oAirbNIjTd7QdZnbRh7m:Lz071uv4BPMkFfdk2auTxcPm

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 20 IoCs

miner

resource	yara_rule
behavioral1/memory/2016-9-0x000000013F3F0000-0x000000013F7E2000-memory.dmp	xmrig
behavioral1/memory/2636-28-0x000000013F570000-0x000000013F962000-memory.dmp	xmrig
behavioral1/memory/2252-113-0x000000013FA50000-0x000000013FE42000-memory.dmp	xmrig
behavioral1/memory/2908-25-0x000000013F7E0000-0x000000013FBD2000-memory.dmp	xmrig
behavioral1/memory/1936-1672-0x000000013F9B0000-0x000000013FDA2000-memory.dmp	xmrig
behavioral1/memory/2532-109-0x000000013FD70000-0x0000000140162000-memory.dmp	xmrig
behavioral1/memory/2484-106-0x000000013FFA0000-0x0000000140392000-memory.dmp	xmrig
behavioral1/memory/2368-105-0x000000013F030000-0x000000013F422000-memory.dmp	xmrig
behavioral1/memory/2476-103-0x000000013F210000-0x000000013F602000-memory.dmp	xmrig
behavioral1/memory/2400-97-0x000000013F1E0000-0x000000013F5D2000-memory.dmp	xmrig
behavioral1/memory/2644-93-0x000000013FCA0000-0x0000000140092000-memory.dmp	xmrig
behavioral1/memory/2908-4113-0x000000013F7E0000-0x000000013FBD2000-memory.dmp	xmrig
behavioral1/memory/2400-4604-0x000000013F1E0000-0x000000013F5D2000-memory.dmp	xmrig
behavioral1/memory/2016-4607-0x000000013F3F0000-0x000000013F7E2000-memory.dmp	xmrig
behavioral1/memory/2368-4608-0x000000013F030000-0x000000013F422000-memory.dmp	xmrig
behavioral1/memory/2476-4609-0x000000013F210000-0x000000013F602000-memory.dmp	xmrig
behavioral1/memory/2532-4653-0x000000013FD70000-0x0000000140162000-memory.dmp	xmrig
behavioral1/memory/2484-4734-0x000000013FFA0000-0x0000000140392000-memory.dmp	xmrig
behavioral1/memory/2252-4654-0x000000013FA50000-0x000000013FE42000-memory.dmp	xmrig
behavioral1/memory/2636-4744-0x000000013F570000-0x000000013F962000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
1944	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
2016	ZejIdgP.exe
2908	vCgJTfc.exe
2636	OBiKhDf.exe
2644	JqFlmoc.exe
2400	QDPGDfd.exe
2476	ZjZkueC.exe
2368	YClrZFx.exe
2484	gWiNVKi.exe
2532	ipTesFl.exe
2252	KkAICgR.exe
1512	XYfpyPc.exe
2408	oWqDqog.exe
1816	cwMMSFb.exe
2592	JLiRizH.exe
1884	YFhRGlX.exe
1664	EKmhFhp.exe
2540	fMAPmca.exe
2460	iHIuWLo.exe
2856	qRPaiQR.exe
764	lqgXvuF.exe
1640	RzGugdF.exe
1632	crYDMod.exe
3008	xONBvKy.exe
444	tdodiSw.exe
1536	DoVoFfK.exe
1672	gXoiHqE.exe
1764	ZrFAlLs.exe
2816	dgCrOyi.exe
936	gxuHvGH.exe
692	KtSqAMg.exe
2036	KuwlCeb.exe
2820	WZhWcSX.exe
1192	VptOBbS.exe
1388	UFSUZjf.exe
1988	lrKEjEG.exe
2144	pdhJshq.exe
1488	RcDkGDP.exe
2572	eydZMUC.exe
2700	gNKUIFe.exe
2840	FtSjiDO.exe
1468	OzzIQew.exe
2576	EwIpPSi.exe
2704	eDsNInT.exe
264	PjLqmkg.exe
2668	CSXPaTq.exe
2208	wzifbxN.exe
1532	BzfjStr.exe
2140	pLrvXgc.exe
880	tKItcmm.exe
2584	qKgdfdE.exe
2548	tNdXTwu.exe
324	DSeiKia.exe
1704	fsshZQH.exe
2772	VviMtyF.exe
1892	wcirMzo.exe
3100	UHqxtXx.exe
2060	JkjIAEc.exe
1592	OEQkdcP.exe
2612	UEqaQGP.exe
3172	uIJiffM.exe
2272	sznoGpV.exe
1380	xnPtjrP.exe
2712	xwTBKyw.exe
2088	bBdnvCt.exe

Loads dropped DLL 64 IoCs

pid	Process
1936	35789f701b77e343adb5429545bd23aaf31d807b15b134bbfd9fe6f909210814_NeikiAnalytics.exe
1936	35789f701b77e343adb5429545bd23aaf31d807b15b134bbfd9fe6f909210814_NeikiAnalytics.exe
1936	35789f701b77e343adb5429545bd23aaf31d807b15b134bbfd9fe6f909210814_NeikiAnalytics.exe
1936	35789f701b77e343adb5429545bd23aaf31d807b15b134bbfd9fe6f909210814_NeikiAnalytics.exe
1936	35789f701b77e343adb5429545bd23aaf31d807b15b134bbfd9fe6f909210814_NeikiAnalytics.exe
1936	35789f701b77e343adb5429545bd23aaf31d807b15b134bbfd9fe6f909210814_NeikiAnalytics.exe
1936	35789f701b77e343adb5429545bd23aaf31d807b15b134bbfd9fe6f909210814_NeikiAnalytics.exe
1936	35789f701b77e343adb5429545bd23aaf31d807b15b134bbfd9fe6f909210814_NeikiAnalytics.exe
1936	35789f701b77e343adb5429545bd23aaf31d807b15b134bbfd9fe6f909210814_NeikiAnalytics.exe
1936	35789f701b77e343adb5429545bd23aaf31d807b15b134bbfd9fe6f909210814_NeikiAnalytics.exe
1936	35789f701b77e343adb5429545bd23aaf31d807b15b134bbfd9fe6f909210814_NeikiAnalytics.exe
1936	35789f701b77e343adb5429545bd23aaf31d807b15b134bbfd9fe6f909210814_NeikiAnalytics.exe
1936	35789f701b77e343adb5429545bd23aaf31d807b15b134bbfd9fe6f909210814_NeikiAnalytics.exe
1936	35789f701b77e343adb5429545bd23aaf31d807b15b134bbfd9fe6f909210814_NeikiAnalytics.exe
1936	35789f701b77e343adb5429545bd23aaf31d807b15b134bbfd9fe6f909210814_NeikiAnalytics.exe
1936	35789f701b77e343adb5429545bd23aaf31d807b15b134bbfd9fe6f909210814_NeikiAnalytics.exe
1936	35789f701b77e343adb5429545bd23aaf31d807b15b134bbfd9fe6f909210814_NeikiAnalytics.exe
1936	35789f701b77e343adb5429545bd23aaf31d807b15b134bbfd9fe6f909210814_NeikiAnalytics.exe
1936	35789f701b77e343adb5429545bd23aaf31d807b15b134bbfd9fe6f909210814_NeikiAnalytics.exe
1936	35789f701b77e343adb5429545bd23aaf31d807b15b134bbfd9fe6f909210814_NeikiAnalytics.exe
1936	35789f701b77e343adb5429545bd23aaf31d807b15b134bbfd9fe6f909210814_NeikiAnalytics.exe
1936	35789f701b77e343adb5429545bd23aaf31d807b15b134bbfd9fe6f909210814_NeikiAnalytics.exe
1936	35789f701b77e343adb5429545bd23aaf31d807b15b134bbfd9fe6f909210814_NeikiAnalytics.exe
1936	35789f701b77e343adb5429545bd23aaf31d807b15b134bbfd9fe6f909210814_NeikiAnalytics.exe
1936	35789f701b77e343adb5429545bd23aaf31d807b15b134bbfd9fe6f909210814_NeikiAnalytics.exe
1936	35789f701b77e343adb5429545bd23aaf31d807b15b134bbfd9fe6f909210814_NeikiAnalytics.exe
1936	35789f701b77e343adb5429545bd23aaf31d807b15b134bbfd9fe6f909210814_NeikiAnalytics.exe
1936	35789f701b77e343adb5429545bd23aaf31d807b15b134bbfd9fe6f909210814_NeikiAnalytics.exe
1936	35789f701b77e343adb5429545bd23aaf31d807b15b134bbfd9fe6f909210814_NeikiAnalytics.exe
1936	35789f701b77e343adb5429545bd23aaf31d807b15b134bbfd9fe6f909210814_NeikiAnalytics.exe
1936	35789f701b77e343adb5429545bd23aaf31d807b15b134bbfd9fe6f909210814_NeikiAnalytics.exe
1936	35789f701b77e343adb5429545bd23aaf31d807b15b134bbfd9fe6f909210814_NeikiAnalytics.exe
1936	35789f701b77e343adb5429545bd23aaf31d807b15b134bbfd9fe6f909210814_NeikiAnalytics.exe
1936	35789f701b77e343adb5429545bd23aaf31d807b15b134bbfd9fe6f909210814_NeikiAnalytics.exe
1936	35789f701b77e343adb5429545bd23aaf31d807b15b134bbfd9fe6f909210814_NeikiAnalytics.exe
1936	35789f701b77e343adb5429545bd23aaf31d807b15b134bbfd9fe6f909210814_NeikiAnalytics.exe
1936	35789f701b77e343adb5429545bd23aaf31d807b15b134bbfd9fe6f909210814_NeikiAnalytics.exe
1936	35789f701b77e343adb5429545bd23aaf31d807b15b134bbfd9fe6f909210814_NeikiAnalytics.exe
1936	35789f701b77e343adb5429545bd23aaf31d807b15b134bbfd9fe6f909210814_NeikiAnalytics.exe
1936	35789f701b77e343adb5429545bd23aaf31d807b15b134bbfd9fe6f909210814_NeikiAnalytics.exe
1936	35789f701b77e343adb5429545bd23aaf31d807b15b134bbfd9fe6f909210814_NeikiAnalytics.exe
1936	35789f701b77e343adb5429545bd23aaf31d807b15b134bbfd9fe6f909210814_NeikiAnalytics.exe
1936	35789f701b77e343adb5429545bd23aaf31d807b15b134bbfd9fe6f909210814_NeikiAnalytics.exe
1936	35789f701b77e343adb5429545bd23aaf31d807b15b134bbfd9fe6f909210814_NeikiAnalytics.exe
1936	35789f701b77e343adb5429545bd23aaf31d807b15b134bbfd9fe6f909210814_NeikiAnalytics.exe
1936	35789f701b77e343adb5429545bd23aaf31d807b15b134bbfd9fe6f909210814_NeikiAnalytics.exe
1936	35789f701b77e343adb5429545bd23aaf31d807b15b134bbfd9fe6f909210814_NeikiAnalytics.exe
1936	35789f701b77e343adb5429545bd23aaf31d807b15b134bbfd9fe6f909210814_NeikiAnalytics.exe
1936	35789f701b77e343adb5429545bd23aaf31d807b15b134bbfd9fe6f909210814_NeikiAnalytics.exe
1936	35789f701b77e343adb5429545bd23aaf31d807b15b134bbfd9fe6f909210814_NeikiAnalytics.exe
1936	35789f701b77e343adb5429545bd23aaf31d807b15b134bbfd9fe6f909210814_NeikiAnalytics.exe
1936	35789f701b77e343adb5429545bd23aaf31d807b15b134bbfd9fe6f909210814_NeikiAnalytics.exe
1936	35789f701b77e343adb5429545bd23aaf31d807b15b134bbfd9fe6f909210814_NeikiAnalytics.exe
1936	35789f701b77e343adb5429545bd23aaf31d807b15b134bbfd9fe6f909210814_NeikiAnalytics.exe
1936	35789f701b77e343adb5429545bd23aaf31d807b15b134bbfd9fe6f909210814_NeikiAnalytics.exe
1936	35789f701b77e343adb5429545bd23aaf31d807b15b134bbfd9fe6f909210814_NeikiAnalytics.exe
1936	35789f701b77e343adb5429545bd23aaf31d807b15b134bbfd9fe6f909210814_NeikiAnalytics.exe
1936	35789f701b77e343adb5429545bd23aaf31d807b15b134bbfd9fe6f909210814_NeikiAnalytics.exe
1936	35789f701b77e343adb5429545bd23aaf31d807b15b134bbfd9fe6f909210814_NeikiAnalytics.exe
1936	35789f701b77e343adb5429545bd23aaf31d807b15b134bbfd9fe6f909210814_NeikiAnalytics.exe
1936	35789f701b77e343adb5429545bd23aaf31d807b15b134bbfd9fe6f909210814_NeikiAnalytics.exe
1936	35789f701b77e343adb5429545bd23aaf31d807b15b134bbfd9fe6f909210814_NeikiAnalytics.exe
1936	35789f701b77e343adb5429545bd23aaf31d807b15b134bbfd9fe6f909210814_NeikiAnalytics.exe
1936	35789f701b77e343adb5429545bd23aaf31d807b15b134bbfd9fe6f909210814_NeikiAnalytics.exe

UPX packed file 60 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1936-2-0x000000013F9B0000-0x000000013FDA2000-memory.dmp	upx
behavioral1/files/0x000c00000001226d-6.dat	upx
behavioral1/memory/2016-9-0x000000013F3F0000-0x000000013F7E2000-memory.dmp	upx
behavioral1/files/0x0008000000014342-23.dat	upx
behavioral1/memory/2636-28-0x000000013F570000-0x000000013F962000-memory.dmp	upx
behavioral1/files/0x0008000000014415-33.dat	upx
behavioral1/files/0x000f000000003683-32.dat	upx
behavioral1/files/0x0007000000014508-53.dat	upx
behavioral1/files/0x0006000000015679-61.dat	upx
behavioral1/files/0x0006000000015c8c-79.dat	upx
behavioral1/files/0x0006000000015cb7-86.dat	upx
behavioral1/files/0x0006000000015bc7-69.dat	upx
behavioral1/files/0x00070000000153fd-47.dat	upx
behavioral1/files/0x0006000000015cea-125.dat	upx
behavioral1/files/0x0006000000015cd6-121.dat	upx
behavioral1/files/0x000600000001562c-120.dat	upx
behavioral1/memory/2252-113-0x000000013FA50000-0x000000013FE42000-memory.dmp	upx
behavioral1/files/0x000600000001542b-50.dat	upx
behavioral1/files/0x000800000001451c-44.dat	upx
behavioral1/memory/2908-25-0x000000013F7E0000-0x000000013FBD2000-memory.dmp	upx
behavioral1/files/0x00360000000141c5-12.dat	upx
behavioral1/files/0x0006000000015d13-141.dat	upx
behavioral1/files/0x0006000000015d42-148.dat	upx
behavioral1/files/0x0006000000015f54-162.dat	upx
behavioral1/files/0x00060000000165d4-185.dat	upx
behavioral1/files/0x0006000000016448-178.dat	upx
behavioral1/files/0x0006000000016133-171.dat	upx
behavioral1/files/0x0006000000015fd4-164.dat	upx
behavioral1/files/0x0006000000015de5-157.dat	upx
behavioral1/files/0x0006000000015d72-150.dat	upx
behavioral1/files/0x0006000000015d20-143.dat	upx
behavioral1/files/0x0006000000015d09-136.dat	upx
behavioral1/memory/1936-1672-0x000000013F9B0000-0x000000013FDA2000-memory.dmp	upx
behavioral1/files/0x0006000000015cf3-129.dat	upx
behavioral1/files/0x0006000000015ce2-122.dat	upx
behavioral1/memory/2532-109-0x000000013FD70000-0x0000000140162000-memory.dmp	upx
behavioral1/memory/2484-106-0x000000013FFA0000-0x0000000140392000-memory.dmp	upx
behavioral1/memory/2368-105-0x000000013F030000-0x000000013F422000-memory.dmp	upx
behavioral1/memory/2476-103-0x000000013F210000-0x000000013F602000-memory.dmp	upx
behavioral1/memory/2400-97-0x000000013F1E0000-0x000000013F5D2000-memory.dmp	upx
behavioral1/memory/2644-93-0x000000013FCA0000-0x0000000140092000-memory.dmp	upx
behavioral1/files/0x0006000000015cbf-90.dat	upx
behavioral1/files/0x0006000000015caf-81.dat	upx
behavioral1/files/0x0006000000015c82-73.dat	upx
behavioral1/files/0x0006000000015b63-63.dat	upx
behavioral1/files/0x0006000000016824-190.dat	upx
behavioral1/files/0x0006000000016572-183.dat	upx
behavioral1/files/0x00060000000162cc-176.dat	upx
behavioral1/files/0x00060000000160f3-169.dat	upx
behavioral1/files/0x0006000000015d97-155.dat	upx
behavioral1/files/0x0006000000015cfd-134.dat	upx
behavioral1/memory/2908-4113-0x000000013F7E0000-0x000000013FBD2000-memory.dmp	upx
behavioral1/memory/2400-4604-0x000000013F1E0000-0x000000013F5D2000-memory.dmp	upx
behavioral1/memory/2016-4607-0x000000013F3F0000-0x000000013F7E2000-memory.dmp	upx
behavioral1/memory/2368-4608-0x000000013F030000-0x000000013F422000-memory.dmp	upx
behavioral1/memory/2476-4609-0x000000013F210000-0x000000013F602000-memory.dmp	upx
behavioral1/memory/2532-4653-0x000000013FD70000-0x0000000140162000-memory.dmp	upx
behavioral1/memory/2484-4734-0x000000013FFA0000-0x0000000140392000-memory.dmp	upx
behavioral1/memory/2252-4654-0x000000013FA50000-0x000000013FE42000-memory.dmp	upx
behavioral1/memory/2636-4744-0x000000013F570000-0x000000013F962000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\HzzjYSr.exe	35789f701b77e343adb5429545bd23aaf31d807b15b134bbfd9fe6f909210814_NeikiAnalytics.exe
File created	C:\Windows\System\NYNtBxD.exe	35789f701b77e343adb5429545bd23aaf31d807b15b134bbfd9fe6f909210814_NeikiAnalytics.exe
File created	C:\Windows\System\USfqElD.exe	35789f701b77e343adb5429545bd23aaf31d807b15b134bbfd9fe6f909210814_NeikiAnalytics.exe
File created	C:\Windows\System\iToftcs.exe	35789f701b77e343adb5429545bd23aaf31d807b15b134bbfd9fe6f909210814_NeikiAnalytics.exe
File created	C:\Windows\System\ZaquGLr.exe	35789f701b77e343adb5429545bd23aaf31d807b15b134bbfd9fe6f909210814_NeikiAnalytics.exe
File created	C:\Windows\System\yPbJFKY.exe	35789f701b77e343adb5429545bd23aaf31d807b15b134bbfd9fe6f909210814_NeikiAnalytics.exe
File created	C:\Windows\System\OqhGEjI.exe	35789f701b77e343adb5429545bd23aaf31d807b15b134bbfd9fe6f909210814_NeikiAnalytics.exe
File created	C:\Windows\System\SRTSKJj.exe	35789f701b77e343adb5429545bd23aaf31d807b15b134bbfd9fe6f909210814_NeikiAnalytics.exe
File created	C:\Windows\System\tCeuxDM.exe	35789f701b77e343adb5429545bd23aaf31d807b15b134bbfd9fe6f909210814_NeikiAnalytics.exe
File created	C:\Windows\System\xfLBNMj.exe	35789f701b77e343adb5429545bd23aaf31d807b15b134bbfd9fe6f909210814_NeikiAnalytics.exe
File created	C:\Windows\System\VjkREuP.exe	35789f701b77e343adb5429545bd23aaf31d807b15b134bbfd9fe6f909210814_NeikiAnalytics.exe
File created	C:\Windows\System\qYpWAmY.exe	35789f701b77e343adb5429545bd23aaf31d807b15b134bbfd9fe6f909210814_NeikiAnalytics.exe
File created	C:\Windows\System\HezmXqV.exe	35789f701b77e343adb5429545bd23aaf31d807b15b134bbfd9fe6f909210814_NeikiAnalytics.exe
File created	C:\Windows\System\TUmkcaJ.exe	35789f701b77e343adb5429545bd23aaf31d807b15b134bbfd9fe6f909210814_NeikiAnalytics.exe
File created	C:\Windows\System\iXCbpMU.exe	35789f701b77e343adb5429545bd23aaf31d807b15b134bbfd9fe6f909210814_NeikiAnalytics.exe
File created	C:\Windows\System\FioXNni.exe	35789f701b77e343adb5429545bd23aaf31d807b15b134bbfd9fe6f909210814_NeikiAnalytics.exe
File created	C:\Windows\System\vmjaTDg.exe	35789f701b77e343adb5429545bd23aaf31d807b15b134bbfd9fe6f909210814_NeikiAnalytics.exe
File created	C:\Windows\System\cPrTHEd.exe	35789f701b77e343adb5429545bd23aaf31d807b15b134bbfd9fe6f909210814_NeikiAnalytics.exe
File created	C:\Windows\System\EmWBOMa.exe	35789f701b77e343adb5429545bd23aaf31d807b15b134bbfd9fe6f909210814_NeikiAnalytics.exe
File created	C:\Windows\System\GDzOswi.exe	35789f701b77e343adb5429545bd23aaf31d807b15b134bbfd9fe6f909210814_NeikiAnalytics.exe
File created	C:\Windows\System\tAiWEiX.exe	35789f701b77e343adb5429545bd23aaf31d807b15b134bbfd9fe6f909210814_NeikiAnalytics.exe
File created	C:\Windows\System\uZBLBes.exe	35789f701b77e343adb5429545bd23aaf31d807b15b134bbfd9fe6f909210814_NeikiAnalytics.exe
File created	C:\Windows\System\mKUjziX.exe	35789f701b77e343adb5429545bd23aaf31d807b15b134bbfd9fe6f909210814_NeikiAnalytics.exe
File created	C:\Windows\System\jNjfIEt.exe	35789f701b77e343adb5429545bd23aaf31d807b15b134bbfd9fe6f909210814_NeikiAnalytics.exe
File created	C:\Windows\System\ievSBQK.exe	35789f701b77e343adb5429545bd23aaf31d807b15b134bbfd9fe6f909210814_NeikiAnalytics.exe
File created	C:\Windows\System\MlvgqwS.exe	35789f701b77e343adb5429545bd23aaf31d807b15b134bbfd9fe6f909210814_NeikiAnalytics.exe
File created	C:\Windows\System\mSKvhUH.exe	35789f701b77e343adb5429545bd23aaf31d807b15b134bbfd9fe6f909210814_NeikiAnalytics.exe
File created	C:\Windows\System\OndJdgx.exe	35789f701b77e343adb5429545bd23aaf31d807b15b134bbfd9fe6f909210814_NeikiAnalytics.exe
File created	C:\Windows\System\QJFbQwT.exe	35789f701b77e343adb5429545bd23aaf31d807b15b134bbfd9fe6f909210814_NeikiAnalytics.exe
File created	C:\Windows\System\bzTCDkE.exe	35789f701b77e343adb5429545bd23aaf31d807b15b134bbfd9fe6f909210814_NeikiAnalytics.exe
File created	C:\Windows\System\BbWJkFu.exe	35789f701b77e343adb5429545bd23aaf31d807b15b134bbfd9fe6f909210814_NeikiAnalytics.exe
File created	C:\Windows\System\wkbSJPa.exe	35789f701b77e343adb5429545bd23aaf31d807b15b134bbfd9fe6f909210814_NeikiAnalytics.exe
File created	C:\Windows\System\zqoJWnG.exe	35789f701b77e343adb5429545bd23aaf31d807b15b134bbfd9fe6f909210814_NeikiAnalytics.exe
File created	C:\Windows\System\medawCE.exe	35789f701b77e343adb5429545bd23aaf31d807b15b134bbfd9fe6f909210814_NeikiAnalytics.exe
File created	C:\Windows\System\cDZTimI.exe	35789f701b77e343adb5429545bd23aaf31d807b15b134bbfd9fe6f909210814_NeikiAnalytics.exe
File created	C:\Windows\System\veaCpZm.exe	35789f701b77e343adb5429545bd23aaf31d807b15b134bbfd9fe6f909210814_NeikiAnalytics.exe
File created	C:\Windows\System\hqsFVkN.exe	35789f701b77e343adb5429545bd23aaf31d807b15b134bbfd9fe6f909210814_NeikiAnalytics.exe
File created	C:\Windows\System\mgcUFwr.exe	35789f701b77e343adb5429545bd23aaf31d807b15b134bbfd9fe6f909210814_NeikiAnalytics.exe
File created	C:\Windows\System\VLDxhZM.exe	35789f701b77e343adb5429545bd23aaf31d807b15b134bbfd9fe6f909210814_NeikiAnalytics.exe
File created	C:\Windows\System\jtkYItj.exe	35789f701b77e343adb5429545bd23aaf31d807b15b134bbfd9fe6f909210814_NeikiAnalytics.exe
File created	C:\Windows\System\BHjEHEK.exe	35789f701b77e343adb5429545bd23aaf31d807b15b134bbfd9fe6f909210814_NeikiAnalytics.exe
File created	C:\Windows\System\WjRvcfB.exe	35789f701b77e343adb5429545bd23aaf31d807b15b134bbfd9fe6f909210814_NeikiAnalytics.exe
File created	C:\Windows\System\MHSzeSx.exe	35789f701b77e343adb5429545bd23aaf31d807b15b134bbfd9fe6f909210814_NeikiAnalytics.exe
File created	C:\Windows\System\pXzoxPY.exe	35789f701b77e343adb5429545bd23aaf31d807b15b134bbfd9fe6f909210814_NeikiAnalytics.exe
File created	C:\Windows\System\KHoQVBv.exe	35789f701b77e343adb5429545bd23aaf31d807b15b134bbfd9fe6f909210814_NeikiAnalytics.exe
File created	C:\Windows\System\jlzeGVt.exe	35789f701b77e343adb5429545bd23aaf31d807b15b134bbfd9fe6f909210814_NeikiAnalytics.exe
File created	C:\Windows\System\DnyPiXq.exe	35789f701b77e343adb5429545bd23aaf31d807b15b134bbfd9fe6f909210814_NeikiAnalytics.exe
File created	C:\Windows\System\BCydaAV.exe	35789f701b77e343adb5429545bd23aaf31d807b15b134bbfd9fe6f909210814_NeikiAnalytics.exe
File created	C:\Windows\System\zuGlSiO.exe	35789f701b77e343adb5429545bd23aaf31d807b15b134bbfd9fe6f909210814_NeikiAnalytics.exe
File created	C:\Windows\System\CvjYmVH.exe	35789f701b77e343adb5429545bd23aaf31d807b15b134bbfd9fe6f909210814_NeikiAnalytics.exe
File created	C:\Windows\System\msvqBPY.exe	35789f701b77e343adb5429545bd23aaf31d807b15b134bbfd9fe6f909210814_NeikiAnalytics.exe
File created	C:\Windows\System\FJeOReD.exe	35789f701b77e343adb5429545bd23aaf31d807b15b134bbfd9fe6f909210814_NeikiAnalytics.exe
File created	C:\Windows\System\JXeMNgX.exe	35789f701b77e343adb5429545bd23aaf31d807b15b134bbfd9fe6f909210814_NeikiAnalytics.exe
File created	C:\Windows\System\FcsWSjN.exe	35789f701b77e343adb5429545bd23aaf31d807b15b134bbfd9fe6f909210814_NeikiAnalytics.exe
File created	C:\Windows\System\OYyoMaX.exe	35789f701b77e343adb5429545bd23aaf31d807b15b134bbfd9fe6f909210814_NeikiAnalytics.exe
File created	C:\Windows\System\vAJPfSU.exe	35789f701b77e343adb5429545bd23aaf31d807b15b134bbfd9fe6f909210814_NeikiAnalytics.exe
File created	C:\Windows\System\dMNhqCE.exe	35789f701b77e343adb5429545bd23aaf31d807b15b134bbfd9fe6f909210814_NeikiAnalytics.exe
File created	C:\Windows\System\KdVZjTI.exe	35789f701b77e343adb5429545bd23aaf31d807b15b134bbfd9fe6f909210814_NeikiAnalytics.exe
File created	C:\Windows\System\mewcwmG.exe	35789f701b77e343adb5429545bd23aaf31d807b15b134bbfd9fe6f909210814_NeikiAnalytics.exe
File created	C:\Windows\System\EiSYrOr.exe	35789f701b77e343adb5429545bd23aaf31d807b15b134bbfd9fe6f909210814_NeikiAnalytics.exe
File created	C:\Windows\System\nKoKbXd.exe	35789f701b77e343adb5429545bd23aaf31d807b15b134bbfd9fe6f909210814_NeikiAnalytics.exe
File created	C:\Windows\System\iSCBaFx.exe	35789f701b77e343adb5429545bd23aaf31d807b15b134bbfd9fe6f909210814_NeikiAnalytics.exe
File created	C:\Windows\System\ASXhdZu.exe	35789f701b77e343adb5429545bd23aaf31d807b15b134bbfd9fe6f909210814_NeikiAnalytics.exe
File created	C:\Windows\System\ToVbuUL.exe	35789f701b77e343adb5429545bd23aaf31d807b15b134bbfd9fe6f909210814_NeikiAnalytics.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1944	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	1936	35789f701b77e343adb5429545bd23aaf31d807b15b134bbfd9fe6f909210814_NeikiAnalytics.exe
Token: SeLockMemoryPrivilege	1936	35789f701b77e343adb5429545bd23aaf31d807b15b134bbfd9fe6f909210814_NeikiAnalytics.exe
Token: SeDebugPrivilege	1944	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1936 wrote to memory of 1944	1936	35789f701b77e343adb5429545bd23aaf31d807b15b134bbfd9fe6f909210814_NeikiAnalytics.exe	29
PID 1936 wrote to memory of 1944	1936	35789f701b77e343adb5429545bd23aaf31d807b15b134bbfd9fe6f909210814_NeikiAnalytics.exe	29
PID 1936 wrote to memory of 1944	1936	35789f701b77e343adb5429545bd23aaf31d807b15b134bbfd9fe6f909210814_NeikiAnalytics.exe	29
PID 1936 wrote to memory of 2016	1936	35789f701b77e343adb5429545bd23aaf31d807b15b134bbfd9fe6f909210814_NeikiAnalytics.exe	30
PID 1936 wrote to memory of 2016	1936	35789f701b77e343adb5429545bd23aaf31d807b15b134bbfd9fe6f909210814_NeikiAnalytics.exe	30
PID 1936 wrote to memory of 2016	1936	35789f701b77e343adb5429545bd23aaf31d807b15b134bbfd9fe6f909210814_NeikiAnalytics.exe	30
PID 1936 wrote to memory of 2908	1936	35789f701b77e343adb5429545bd23aaf31d807b15b134bbfd9fe6f909210814_NeikiAnalytics.exe	31
PID 1936 wrote to memory of 2908	1936	35789f701b77e343adb5429545bd23aaf31d807b15b134bbfd9fe6f909210814_NeikiAnalytics.exe	31
PID 1936 wrote to memory of 2908	1936	35789f701b77e343adb5429545bd23aaf31d807b15b134bbfd9fe6f909210814_NeikiAnalytics.exe	31
PID 1936 wrote to memory of 2636	1936	35789f701b77e343adb5429545bd23aaf31d807b15b134bbfd9fe6f909210814_NeikiAnalytics.exe	32
PID 1936 wrote to memory of 2636	1936	35789f701b77e343adb5429545bd23aaf31d807b15b134bbfd9fe6f909210814_NeikiAnalytics.exe	32
PID 1936 wrote to memory of 2636	1936	35789f701b77e343adb5429545bd23aaf31d807b15b134bbfd9fe6f909210814_NeikiAnalytics.exe	32
PID 1936 wrote to memory of 2644	1936	35789f701b77e343adb5429545bd23aaf31d807b15b134bbfd9fe6f909210814_NeikiAnalytics.exe	33
PID 1936 wrote to memory of 2644	1936	35789f701b77e343adb5429545bd23aaf31d807b15b134bbfd9fe6f909210814_NeikiAnalytics.exe	33
PID 1936 wrote to memory of 2644	1936	35789f701b77e343adb5429545bd23aaf31d807b15b134bbfd9fe6f909210814_NeikiAnalytics.exe	33
PID 1936 wrote to memory of 2400	1936	35789f701b77e343adb5429545bd23aaf31d807b15b134bbfd9fe6f909210814_NeikiAnalytics.exe	34
PID 1936 wrote to memory of 2400	1936	35789f701b77e343adb5429545bd23aaf31d807b15b134bbfd9fe6f909210814_NeikiAnalytics.exe	34
PID 1936 wrote to memory of 2400	1936	35789f701b77e343adb5429545bd23aaf31d807b15b134bbfd9fe6f909210814_NeikiAnalytics.exe	34
PID 1936 wrote to memory of 2476	1936	35789f701b77e343adb5429545bd23aaf31d807b15b134bbfd9fe6f909210814_NeikiAnalytics.exe	35
PID 1936 wrote to memory of 2476	1936	35789f701b77e343adb5429545bd23aaf31d807b15b134bbfd9fe6f909210814_NeikiAnalytics.exe	35
PID 1936 wrote to memory of 2476	1936	35789f701b77e343adb5429545bd23aaf31d807b15b134bbfd9fe6f909210814_NeikiAnalytics.exe	35
PID 1936 wrote to memory of 2368	1936	35789f701b77e343adb5429545bd23aaf31d807b15b134bbfd9fe6f909210814_NeikiAnalytics.exe	36
PID 1936 wrote to memory of 2368	1936	35789f701b77e343adb5429545bd23aaf31d807b15b134bbfd9fe6f909210814_NeikiAnalytics.exe	36
PID 1936 wrote to memory of 2368	1936	35789f701b77e343adb5429545bd23aaf31d807b15b134bbfd9fe6f909210814_NeikiAnalytics.exe	36
PID 1936 wrote to memory of 2408	1936	35789f701b77e343adb5429545bd23aaf31d807b15b134bbfd9fe6f909210814_NeikiAnalytics.exe	37
PID 1936 wrote to memory of 2408	1936	35789f701b77e343adb5429545bd23aaf31d807b15b134bbfd9fe6f909210814_NeikiAnalytics.exe	37
PID 1936 wrote to memory of 2408	1936	35789f701b77e343adb5429545bd23aaf31d807b15b134bbfd9fe6f909210814_NeikiAnalytics.exe	37
PID 1936 wrote to memory of 2484	1936	35789f701b77e343adb5429545bd23aaf31d807b15b134bbfd9fe6f909210814_NeikiAnalytics.exe	38
PID 1936 wrote to memory of 2484	1936	35789f701b77e343adb5429545bd23aaf31d807b15b134bbfd9fe6f909210814_NeikiAnalytics.exe	38
PID 1936 wrote to memory of 2484	1936	35789f701b77e343adb5429545bd23aaf31d807b15b134bbfd9fe6f909210814_NeikiAnalytics.exe	38
PID 1936 wrote to memory of 2592	1936	35789f701b77e343adb5429545bd23aaf31d807b15b134bbfd9fe6f909210814_NeikiAnalytics.exe	39
PID 1936 wrote to memory of 2592	1936	35789f701b77e343adb5429545bd23aaf31d807b15b134bbfd9fe6f909210814_NeikiAnalytics.exe	39
PID 1936 wrote to memory of 2592	1936	35789f701b77e343adb5429545bd23aaf31d807b15b134bbfd9fe6f909210814_NeikiAnalytics.exe	39
PID 1936 wrote to memory of 2532	1936	35789f701b77e343adb5429545bd23aaf31d807b15b134bbfd9fe6f909210814_NeikiAnalytics.exe	40
PID 1936 wrote to memory of 2532	1936	35789f701b77e343adb5429545bd23aaf31d807b15b134bbfd9fe6f909210814_NeikiAnalytics.exe	40
PID 1936 wrote to memory of 2532	1936	35789f701b77e343adb5429545bd23aaf31d807b15b134bbfd9fe6f909210814_NeikiAnalytics.exe	40
PID 1936 wrote to memory of 2060	1936	35789f701b77e343adb5429545bd23aaf31d807b15b134bbfd9fe6f909210814_NeikiAnalytics.exe	41
PID 1936 wrote to memory of 2060	1936	35789f701b77e343adb5429545bd23aaf31d807b15b134bbfd9fe6f909210814_NeikiAnalytics.exe	41
PID 1936 wrote to memory of 2060	1936	35789f701b77e343adb5429545bd23aaf31d807b15b134bbfd9fe6f909210814_NeikiAnalytics.exe	41
PID 1936 wrote to memory of 2252	1936	35789f701b77e343adb5429545bd23aaf31d807b15b134bbfd9fe6f909210814_NeikiAnalytics.exe	42
PID 1936 wrote to memory of 2252	1936	35789f701b77e343adb5429545bd23aaf31d807b15b134bbfd9fe6f909210814_NeikiAnalytics.exe	42
PID 1936 wrote to memory of 2252	1936	35789f701b77e343adb5429545bd23aaf31d807b15b134bbfd9fe6f909210814_NeikiAnalytics.exe	42
PID 1936 wrote to memory of 1592	1936	35789f701b77e343adb5429545bd23aaf31d807b15b134bbfd9fe6f909210814_NeikiAnalytics.exe	43
PID 1936 wrote to memory of 1592	1936	35789f701b77e343adb5429545bd23aaf31d807b15b134bbfd9fe6f909210814_NeikiAnalytics.exe	43
PID 1936 wrote to memory of 1592	1936	35789f701b77e343adb5429545bd23aaf31d807b15b134bbfd9fe6f909210814_NeikiAnalytics.exe	43
PID 1936 wrote to memory of 1512	1936	35789f701b77e343adb5429545bd23aaf31d807b15b134bbfd9fe6f909210814_NeikiAnalytics.exe	44
PID 1936 wrote to memory of 1512	1936	35789f701b77e343adb5429545bd23aaf31d807b15b134bbfd9fe6f909210814_NeikiAnalytics.exe	44
PID 1936 wrote to memory of 1512	1936	35789f701b77e343adb5429545bd23aaf31d807b15b134bbfd9fe6f909210814_NeikiAnalytics.exe	44
PID 1936 wrote to memory of 2612	1936	35789f701b77e343adb5429545bd23aaf31d807b15b134bbfd9fe6f909210814_NeikiAnalytics.exe	45
PID 1936 wrote to memory of 2612	1936	35789f701b77e343adb5429545bd23aaf31d807b15b134bbfd9fe6f909210814_NeikiAnalytics.exe	45
PID 1936 wrote to memory of 2612	1936	35789f701b77e343adb5429545bd23aaf31d807b15b134bbfd9fe6f909210814_NeikiAnalytics.exe	45
PID 1936 wrote to memory of 1816	1936	35789f701b77e343adb5429545bd23aaf31d807b15b134bbfd9fe6f909210814_NeikiAnalytics.exe	46
PID 1936 wrote to memory of 1816	1936	35789f701b77e343adb5429545bd23aaf31d807b15b134bbfd9fe6f909210814_NeikiAnalytics.exe	46
PID 1936 wrote to memory of 1816	1936	35789f701b77e343adb5429545bd23aaf31d807b15b134bbfd9fe6f909210814_NeikiAnalytics.exe	46
PID 1936 wrote to memory of 2272	1936	35789f701b77e343adb5429545bd23aaf31d807b15b134bbfd9fe6f909210814_NeikiAnalytics.exe	47
PID 1936 wrote to memory of 2272	1936	35789f701b77e343adb5429545bd23aaf31d807b15b134bbfd9fe6f909210814_NeikiAnalytics.exe	47
PID 1936 wrote to memory of 2272	1936	35789f701b77e343adb5429545bd23aaf31d807b15b134bbfd9fe6f909210814_NeikiAnalytics.exe	47
PID 1936 wrote to memory of 1884	1936	35789f701b77e343adb5429545bd23aaf31d807b15b134bbfd9fe6f909210814_NeikiAnalytics.exe	48
PID 1936 wrote to memory of 1884	1936	35789f701b77e343adb5429545bd23aaf31d807b15b134bbfd9fe6f909210814_NeikiAnalytics.exe	48
PID 1936 wrote to memory of 1884	1936	35789f701b77e343adb5429545bd23aaf31d807b15b134bbfd9fe6f909210814_NeikiAnalytics.exe	48
PID 1936 wrote to memory of 1380	1936	35789f701b77e343adb5429545bd23aaf31d807b15b134bbfd9fe6f909210814_NeikiAnalytics.exe	49
PID 1936 wrote to memory of 1380	1936	35789f701b77e343adb5429545bd23aaf31d807b15b134bbfd9fe6f909210814_NeikiAnalytics.exe	49
PID 1936 wrote to memory of 1380	1936	35789f701b77e343adb5429545bd23aaf31d807b15b134bbfd9fe6f909210814_NeikiAnalytics.exe	49
PID 1936 wrote to memory of 1664	1936	35789f701b77e343adb5429545bd23aaf31d807b15b134bbfd9fe6f909210814_NeikiAnalytics.exe	50

C:\Users\Admin\AppData\Local\Temp\35789f701b77e343adb5429545bd23aaf31d807b15b134bbfd9fe6f909210814_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\35789f701b77e343adb5429545bd23aaf31d807b15b134bbfd9fe6f909210814_NeikiAnalytics.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1936
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1944
- C:\Windows\System\ZejIdgP.exe
  C:\Windows\System\ZejIdgP.exe
  2⤵
  - Executes dropped EXE
  PID:2016
- C:\Windows\System\vCgJTfc.exe
  C:\Windows\System\vCgJTfc.exe
  2⤵
  - Executes dropped EXE
  PID:2908
- C:\Windows\System\OBiKhDf.exe
  C:\Windows\System\OBiKhDf.exe
  2⤵
  - Executes dropped EXE
  PID:2636
- C:\Windows\System\JqFlmoc.exe
  C:\Windows\System\JqFlmoc.exe
  2⤵
  - Executes dropped EXE
  PID:2644
- C:\Windows\System\QDPGDfd.exe
  C:\Windows\System\QDPGDfd.exe
  2⤵
  - Executes dropped EXE
  PID:2400
- C:\Windows\System\ZjZkueC.exe
  C:\Windows\System\ZjZkueC.exe
  2⤵
  - Executes dropped EXE
  PID:2476
- C:\Windows\System\YClrZFx.exe
  C:\Windows\System\YClrZFx.exe
  2⤵
  - Executes dropped EXE
  PID:2368
- C:\Windows\System\oWqDqog.exe
  C:\Windows\System\oWqDqog.exe
  2⤵
  - Executes dropped EXE
  PID:2408
- C:\Windows\System\gWiNVKi.exe
  C:\Windows\System\gWiNVKi.exe
  2⤵
  - Executes dropped EXE
  PID:2484
- C:\Windows\System\JLiRizH.exe
  C:\Windows\System\JLiRizH.exe
  2⤵
  - Executes dropped EXE
  PID:2592
- C:\Windows\System\ipTesFl.exe
  C:\Windows\System\ipTesFl.exe
  2⤵
  - Executes dropped EXE
  PID:2532
- C:\Windows\System\JkjIAEc.exe
  C:\Windows\System\JkjIAEc.exe
  2⤵
  - Executes dropped EXE
  PID:2060
- C:\Windows\System\KkAICgR.exe
  C:\Windows\System\KkAICgR.exe
  2⤵
  - Executes dropped EXE
  PID:2252
- C:\Windows\System\OEQkdcP.exe
  C:\Windows\System\OEQkdcP.exe
  2⤵
  - Executes dropped EXE
  PID:1592
- C:\Windows\System\XYfpyPc.exe
  C:\Windows\System\XYfpyPc.exe
  2⤵
  - Executes dropped EXE
  PID:1512
- C:\Windows\System\UEqaQGP.exe
  C:\Windows\System\UEqaQGP.exe
  2⤵
  - Executes dropped EXE
  PID:2612
- C:\Windows\System\cwMMSFb.exe
  C:\Windows\System\cwMMSFb.exe
  2⤵
  - Executes dropped EXE
  PID:1816
- C:\Windows\System\sznoGpV.exe
  C:\Windows\System\sznoGpV.exe
  2⤵
  - Executes dropped EXE
  PID:2272
- C:\Windows\System\YFhRGlX.exe
  C:\Windows\System\YFhRGlX.exe
  2⤵
  - Executes dropped EXE
  PID:1884
- C:\Windows\System\xnPtjrP.exe
  C:\Windows\System\xnPtjrP.exe
  2⤵
  - Executes dropped EXE
  PID:1380
- C:\Windows\System\EKmhFhp.exe
  C:\Windows\System\EKmhFhp.exe
  2⤵
  - Executes dropped EXE
  PID:1664
- C:\Windows\System\xwTBKyw.exe
  C:\Windows\System\xwTBKyw.exe
  2⤵
  - Executes dropped EXE
  PID:2712
- C:\Windows\System\fMAPmca.exe
  C:\Windows\System\fMAPmca.exe
  2⤵
  - Executes dropped EXE
  PID:2540
- C:\Windows\System\bBdnvCt.exe
  C:\Windows\System\bBdnvCt.exe
  2⤵
  - Executes dropped EXE
  PID:2088
- C:\Windows\System\iHIuWLo.exe
  C:\Windows\System\iHIuWLo.exe
  2⤵
  - Executes dropped EXE
  PID:2460
- C:\Windows\System\OAgQjYj.exe
  C:\Windows\System\OAgQjYj.exe
  2⤵
  PID:2100
- C:\Windows\System\qRPaiQR.exe
  C:\Windows\System\qRPaiQR.exe
  2⤵
  - Executes dropped EXE
  PID:2856
- C:\Windows\System\IvtxXwk.exe
  C:\Windows\System\IvtxXwk.exe
  2⤵
  PID:532
- C:\Windows\System\lqgXvuF.exe
  C:\Windows\System\lqgXvuF.exe
  2⤵
  - Executes dropped EXE
  PID:764
- C:\Windows\System\egABqpu.exe
  C:\Windows\System\egABqpu.exe
  2⤵
  PID:284
- C:\Windows\System\RzGugdF.exe
  C:\Windows\System\RzGugdF.exe
  2⤵
  - Executes dropped EXE
  PID:1640
- C:\Windows\System\ikHzfOb.exe
  C:\Windows\System\ikHzfOb.exe
  2⤵
  PID:828
- C:\Windows\System\crYDMod.exe
  C:\Windows\System\crYDMod.exe
  2⤵
  - Executes dropped EXE
  PID:1632
- C:\Windows\System\OmQkktm.exe
  C:\Windows\System\OmQkktm.exe
  2⤵
  PID:2328
- C:\Windows\System\xONBvKy.exe
  C:\Windows\System\xONBvKy.exe
  2⤵
  - Executes dropped EXE
  PID:3008
- C:\Windows\System\MhVPMAq.exe
  C:\Windows\System\MhVPMAq.exe
  2⤵
  PID:2916
- C:\Windows\System\tdodiSw.exe
  C:\Windows\System\tdodiSw.exe
  2⤵
  - Executes dropped EXE
  PID:444
- C:\Windows\System\JZBTZPT.exe
  C:\Windows\System\JZBTZPT.exe
  2⤵
  PID:2784
- C:\Windows\System\DoVoFfK.exe
  C:\Windows\System\DoVoFfK.exe
  2⤵
  - Executes dropped EXE
  PID:1536
- C:\Windows\System\NizXvdn.exe
  C:\Windows\System\NizXvdn.exe
  2⤵
  PID:1596
- C:\Windows\System\gXoiHqE.exe
  C:\Windows\System\gXoiHqE.exe
  2⤵
  - Executes dropped EXE
  PID:1672
- C:\Windows\System\qezHGyH.exe
  C:\Windows\System\qezHGyH.exe
  2⤵
  PID:1264
- C:\Windows\System\ZrFAlLs.exe
  C:\Windows\System\ZrFAlLs.exe
  2⤵
  - Executes dropped EXE
  PID:1764
- C:\Windows\System\qxsFhxJ.exe
  C:\Windows\System\qxsFhxJ.exe
  2⤵
  PID:2248
- C:\Windows\System\dgCrOyi.exe
  C:\Windows\System\dgCrOyi.exe
  2⤵
  - Executes dropped EXE
  PID:2816
- C:\Windows\System\nUNAqXj.exe
  C:\Windows\System\nUNAqXj.exe
  2⤵
  PID:996
- C:\Windows\System\gxuHvGH.exe
  C:\Windows\System\gxuHvGH.exe
  2⤵
  - Executes dropped EXE
  PID:936
- C:\Windows\System\WzDSiLq.exe
  C:\Windows\System\WzDSiLq.exe
  2⤵
  PID:624
- C:\Windows\System\KtSqAMg.exe
  C:\Windows\System\KtSqAMg.exe
  2⤵
  - Executes dropped EXE
  PID:692
- C:\Windows\System\YWTjZIk.exe
  C:\Windows\System\YWTjZIk.exe
  2⤵
  PID:2064
- C:\Windows\System\KuwlCeb.exe
  C:\Windows\System\KuwlCeb.exe
  2⤵
  - Executes dropped EXE
  PID:2036
- C:\Windows\System\nIuonnB.exe
  C:\Windows\System\nIuonnB.exe
  2⤵
  PID:776
- C:\Windows\System\WZhWcSX.exe
  C:\Windows\System\WZhWcSX.exe
  2⤵
  - Executes dropped EXE
  PID:2820
- C:\Windows\System\UedEfSv.exe
  C:\Windows\System\UedEfSv.exe
  2⤵
  PID:1688
- C:\Windows\System\VptOBbS.exe
  C:\Windows\System\VptOBbS.exe
  2⤵
  - Executes dropped EXE
  PID:1192
- C:\Windows\System\iptGthr.exe
  C:\Windows\System\iptGthr.exe
  2⤵
  PID:2008
- C:\Windows\System\UFSUZjf.exe
  C:\Windows\System\UFSUZjf.exe
  2⤵
  - Executes dropped EXE
  PID:1388
- C:\Windows\System\vrOujBt.exe
  C:\Windows\System\vrOujBt.exe
  2⤵
  PID:2052
- C:\Windows\System\lrKEjEG.exe
  C:\Windows\System\lrKEjEG.exe
  2⤵
  - Executes dropped EXE
  PID:1988
- C:\Windows\System\mqKqUJq.exe
  C:\Windows\System\mqKqUJq.exe
  2⤵
  PID:2056
- C:\Windows\System\pdhJshq.exe
  C:\Windows\System\pdhJshq.exe
  2⤵
  - Executes dropped EXE
  PID:2144
- C:\Windows\System\mvjXdBO.exe
  C:\Windows\System\mvjXdBO.exe
  2⤵
  PID:1464
- C:\Windows\System\RcDkGDP.exe
  C:\Windows\System\RcDkGDP.exe
  2⤵
  - Executes dropped EXE
  PID:1488
- C:\Windows\System\pwKQVNG.exe
  C:\Windows\System\pwKQVNG.exe
  2⤵
  PID:2912
- C:\Windows\System\eydZMUC.exe
  C:\Windows\System\eydZMUC.exe
  2⤵
  - Executes dropped EXE
  PID:2572
- C:\Windows\System\odwHFei.exe
  C:\Windows\System\odwHFei.exe
  2⤵
  PID:2232
- C:\Windows\System\gNKUIFe.exe
  C:\Windows\System\gNKUIFe.exe
  2⤵
  - Executes dropped EXE
  PID:2700
- C:\Windows\System\xnhtmTq.exe
  C:\Windows\System\xnhtmTq.exe
  2⤵
  PID:2528
- C:\Windows\System\FtSjiDO.exe
  C:\Windows\System\FtSjiDO.exe
  2⤵
  - Executes dropped EXE
  PID:2840
- C:\Windows\System\IAaTFHh.exe
  C:\Windows\System\IAaTFHh.exe
  2⤵
  PID:1948
- C:\Windows\System\OzzIQew.exe
  C:\Windows\System\OzzIQew.exe
  2⤵
  - Executes dropped EXE
  PID:1468
- C:\Windows\System\BoVMZco.exe
  C:\Windows\System\BoVMZco.exe
  2⤵
  PID:2256
- C:\Windows\System\EwIpPSi.exe
  C:\Windows\System\EwIpPSi.exe
  2⤵
  - Executes dropped EXE
  PID:2576
- C:\Windows\System\hagveFN.exe
  C:\Windows\System\hagveFN.exe
  2⤵
  PID:2372
- C:\Windows\System\eDsNInT.exe
  C:\Windows\System\eDsNInT.exe
  2⤵
  - Executes dropped EXE
  PID:2704
- C:\Windows\System\bdHtJtr.exe
  C:\Windows\System\bdHtJtr.exe
  2⤵
  PID:2116
- C:\Windows\System\PjLqmkg.exe
  C:\Windows\System\PjLqmkg.exe
  2⤵
  - Executes dropped EXE
  PID:264
- C:\Windows\System\DPINFBL.exe
  C:\Windows\System\DPINFBL.exe
  2⤵
  PID:1524
- C:\Windows\System\CSXPaTq.exe
  C:\Windows\System\CSXPaTq.exe
  2⤵
  - Executes dropped EXE
  PID:2668
- C:\Windows\System\BucfTlX.exe
  C:\Windows\System\BucfTlX.exe
  2⤵
  PID:2432
- C:\Windows\System\wzifbxN.exe
  C:\Windows\System\wzifbxN.exe
  2⤵
  - Executes dropped EXE
  PID:2208
- C:\Windows\System\HKfYENC.exe
  C:\Windows\System\HKfYENC.exe
  2⤵
  PID:824
- C:\Windows\System\BzfjStr.exe
  C:\Windows\System\BzfjStr.exe
  2⤵
  - Executes dropped EXE
  PID:1532
- C:\Windows\System\qeSMKVW.exe
  C:\Windows\System\qeSMKVW.exe
  2⤵
  PID:768
- C:\Windows\System\pLrvXgc.exe
  C:\Windows\System\pLrvXgc.exe
  2⤵
  - Executes dropped EXE
  PID:2140
- C:\Windows\System\zERNiHX.exe
  C:\Windows\System\zERNiHX.exe
  2⤵
  PID:2880
- C:\Windows\System\tKItcmm.exe
  C:\Windows\System\tKItcmm.exe
  2⤵
  - Executes dropped EXE
  PID:880
- C:\Windows\System\yXsSqfG.exe
  C:\Windows\System\yXsSqfG.exe
  2⤵
  PID:2000
- C:\Windows\System\qKgdfdE.exe
  C:\Windows\System\qKgdfdE.exe
  2⤵
  - Executes dropped EXE
  PID:2584
- C:\Windows\System\YVWkIcb.exe
  C:\Windows\System\YVWkIcb.exe
  2⤵
  PID:2632
- C:\Windows\System\tNdXTwu.exe
  C:\Windows\System\tNdXTwu.exe
  2⤵
  - Executes dropped EXE
  PID:2548
- C:\Windows\System\uMzUTjo.exe
  C:\Windows\System\uMzUTjo.exe
  2⤵
  PID:2204
- C:\Windows\System\DSeiKia.exe
  C:\Windows\System\DSeiKia.exe
  2⤵
  - Executes dropped EXE
  PID:324
- C:\Windows\System\njmYYfy.exe
  C:\Windows\System\njmYYfy.exe
  2⤵
  PID:1696
- C:\Windows\System\fsshZQH.exe
  C:\Windows\System\fsshZQH.exe
  2⤵
  - Executes dropped EXE
  PID:1704
- C:\Windows\System\jFDwQMs.exe
  C:\Windows\System\jFDwQMs.exe
  2⤵
  PID:1332
- C:\Windows\System\VviMtyF.exe
  C:\Windows\System\VviMtyF.exe
  2⤵
  - Executes dropped EXE
  PID:2772
- C:\Windows\System\PnBfwzP.exe
  C:\Windows\System\PnBfwzP.exe
  2⤵
  PID:2456
- C:\Windows\System\wcirMzo.exe
  C:\Windows\System\wcirMzo.exe
  2⤵
  - Executes dropped EXE
  PID:1892
- C:\Windows\System\kLtbIul.exe
  C:\Windows\System\kLtbIul.exe
  2⤵
  PID:3084
- C:\Windows\System\UHqxtXx.exe
  C:\Windows\System\UHqxtXx.exe
  2⤵
  - Executes dropped EXE
  PID:3100
- C:\Windows\System\UTeKRnr.exe
  C:\Windows\System\UTeKRnr.exe
  2⤵
  PID:3156
- C:\Windows\System\uIJiffM.exe
  C:\Windows\System\uIJiffM.exe
  2⤵
  - Executes dropped EXE
  PID:3172
- C:\Windows\System\jmPdstQ.exe
  C:\Windows\System\jmPdstQ.exe
  2⤵
  PID:3320
- C:\Windows\System\CpAxsuT.exe
  C:\Windows\System\CpAxsuT.exe
  2⤵
  PID:3372
- C:\Windows\System\oCIjhto.exe
  C:\Windows\System\oCIjhto.exe
  2⤵
  PID:3448
- C:\Windows\System\jJpxcKK.exe
  C:\Windows\System\jJpxcKK.exe
  2⤵
  PID:3496
- C:\Windows\System\iKKsMvv.exe
  C:\Windows\System\iKKsMvv.exe
  2⤵
  PID:3620
- C:\Windows\System\KZmtwpL.exe
  C:\Windows\System\KZmtwpL.exe
  2⤵
  PID:3636
- C:\Windows\System\FVLPJgm.exe
  C:\Windows\System\FVLPJgm.exe
  2⤵
  PID:3652
- C:\Windows\System\zTelbYf.exe
  C:\Windows\System\zTelbYf.exe
  2⤵
  PID:3672
- C:\Windows\System\ppsdkXe.exe
  C:\Windows\System\ppsdkXe.exe
  2⤵
  PID:3688
- C:\Windows\System\hChtdSj.exe
  C:\Windows\System\hChtdSj.exe
  2⤵
  PID:3708
- C:\Windows\System\TDDjZDy.exe
  C:\Windows\System\TDDjZDy.exe
  2⤵
  PID:3724
- C:\Windows\System\QuHLwSp.exe
  C:\Windows\System\QuHLwSp.exe
  2⤵
  PID:3740
- C:\Windows\System\YwVGnbl.exe
  C:\Windows\System\YwVGnbl.exe
  2⤵
  PID:3756
- C:\Windows\System\JCZSevq.exe
  C:\Windows\System\JCZSevq.exe
  2⤵
  PID:3772
- C:\Windows\System\pgvvbOT.exe
  C:\Windows\System\pgvvbOT.exe
  2⤵
  PID:3816
- C:\Windows\System\kSHuBhJ.exe
  C:\Windows\System\kSHuBhJ.exe
  2⤵
  PID:3876
- C:\Windows\System\iVAqhlT.exe
  C:\Windows\System\iVAqhlT.exe
  2⤵
  PID:3920
- C:\Windows\System\BYktMVT.exe
  C:\Windows\System\BYktMVT.exe
  2⤵
  PID:3944
- C:\Windows\System\rszofGx.exe
  C:\Windows\System\rszofGx.exe
  2⤵
  PID:3968
- C:\Windows\System\aDvYvBH.exe
  C:\Windows\System\aDvYvBH.exe
  2⤵
  PID:3988
- C:\Windows\System\uXSiiUc.exe
  C:\Windows\System\uXSiiUc.exe
  2⤵
  PID:4008
- C:\Windows\System\MncZhoN.exe
  C:\Windows\System\MncZhoN.exe
  2⤵
  PID:4028
- C:\Windows\System\shDsGcx.exe
  C:\Windows\System\shDsGcx.exe
  2⤵
  PID:4048
- C:\Windows\System\XDQGcRS.exe
  C:\Windows\System\XDQGcRS.exe
  2⤵
  PID:4068
- C:\Windows\System\xNFzGJi.exe
  C:\Windows\System\xNFzGJi.exe
  2⤵
  PID:4088
- C:\Windows\System\uofHFEK.exe
  C:\Windows\System\uofHFEK.exe
  2⤵
  PID:1992
- C:\Windows\System\GcayiAV.exe
  C:\Windows\System\GcayiAV.exe
  2⤵
  PID:1692
- C:\Windows\System\EilDixC.exe
  C:\Windows\System\EilDixC.exe
  2⤵
  PID:2120
- C:\Windows\System\ceSsyre.exe
  C:\Windows\System\ceSsyre.exe
  2⤵
  PID:3112
- C:\Windows\System\OkTDFNc.exe
  C:\Windows\System\OkTDFNc.exe
  2⤵
  PID:2600
- C:\Windows\System\qULhZpP.exe
  C:\Windows\System\qULhZpP.exe
  2⤵
  PID:1252
- C:\Windows\System\DbZccLV.exe
  C:\Windows\System\DbZccLV.exe
  2⤵
  PID:2452
- C:\Windows\System\HGWETPn.exe
  C:\Windows\System\HGWETPn.exe
  2⤵
  PID:2864
- C:\Windows\System\LlKWKvA.exe
  C:\Windows\System\LlKWKvA.exe
  2⤵
  PID:1756
- C:\Windows\System\VWHpVOG.exe
  C:\Windows\System\VWHpVOG.exe
  2⤵
  PID:2776
- C:\Windows\System\QivNbcZ.exe
  C:\Windows\System\QivNbcZ.exe
  2⤵
  PID:760
- C:\Windows\System\RdQpbMY.exe
  C:\Windows\System\RdQpbMY.exe
  2⤵
  PID:2960
- C:\Windows\System\KfgtElX.exe
  C:\Windows\System\KfgtElX.exe
  2⤵
  PID:2044
- C:\Windows\System\DIwuyvN.exe
  C:\Windows\System\DIwuyvN.exe
  2⤵
  PID:1952
- C:\Windows\System\sujIiiz.exe
  C:\Windows\System\sujIiiz.exe
  2⤵
  PID:1600
- C:\Windows\System\bowdYGf.exe
  C:\Windows\System\bowdYGf.exe
  2⤵
  PID:2384
- C:\Windows\System\nhhRBpG.exe
  C:\Windows\System\nhhRBpG.exe
  2⤵
  PID:2852
- C:\Windows\System\KBcIyfa.exe
  C:\Windows\System\KBcIyfa.exe
  2⤵
  PID:1112
- C:\Windows\System\USjRCoS.exe
  C:\Windows\System\USjRCoS.exe
  2⤵
  PID:940
- C:\Windows\System\afuHqbY.exe
  C:\Windows\System\afuHqbY.exe
  2⤵
  PID:1240
- C:\Windows\System\WBfnlCG.exe
  C:\Windows\System\WBfnlCG.exe
  2⤵
  PID:900
- C:\Windows\System\nsfAvSQ.exe
  C:\Windows\System\nsfAvSQ.exe
  2⤵
  PID:268
- C:\Windows\System\Siwbvgf.exe
  C:\Windows\System\Siwbvgf.exe
  2⤵
  PID:2340
- C:\Windows\System\mWAGgSQ.exe
  C:\Windows\System\mWAGgSQ.exe
  2⤵
  PID:1940
- C:\Windows\System\RnQjQTL.exe
  C:\Windows\System\RnQjQTL.exe
  2⤵
  PID:1180
- C:\Windows\System\fyihAzz.exe
  C:\Windows\System\fyihAzz.exe
  2⤵
  PID:3228
- C:\Windows\System\QxdCHuP.exe
  C:\Windows\System\QxdCHuP.exe
  2⤵
  PID:3244
- C:\Windows\System\ABGSnKF.exe
  C:\Windows\System\ABGSnKF.exe
  2⤵
  PID:3260
- C:\Windows\System\rKrfNkn.exe
  C:\Windows\System\rKrfNkn.exe
  2⤵
  PID:3276
- C:\Windows\System\fBMzQTR.exe
  C:\Windows\System\fBMzQTR.exe
  2⤵
  PID:3296
- C:\Windows\System\kQNPTUf.exe
  C:\Windows\System\kQNPTUf.exe
  2⤵
  PID:3184
- C:\Windows\System\OzxKpFN.exe
  C:\Windows\System\OzxKpFN.exe
  2⤵
  PID:1188
- C:\Windows\System\NnQVGUW.exe
  C:\Windows\System\NnQVGUW.exe
  2⤵
  PID:3332
- C:\Windows\System\GoAHvso.exe
  C:\Windows\System\GoAHvso.exe
  2⤵
  PID:3348
- C:\Windows\System\QPSHozd.exe
  C:\Windows\System\QPSHozd.exe
  2⤵
  PID:3368
- C:\Windows\System\LgGqJYK.exe
  C:\Windows\System\LgGqJYK.exe
  2⤵
  PID:3440
- C:\Windows\System\oGmPLmb.exe
  C:\Windows\System\oGmPLmb.exe
  2⤵
  PID:3444
- C:\Windows\System\hQXIFjR.exe
  C:\Windows\System\hQXIFjR.exe
  2⤵
  PID:2780
- C:\Windows\System\hfBQehg.exe
  C:\Windows\System\hfBQehg.exe
  2⤵
  PID:836
- C:\Windows\System\GXlhMDK.exe
  C:\Windows\System\GXlhMDK.exe
  2⤵
  PID:3408
- C:\Windows\System\zxgPyXQ.exe
  C:\Windows\System\zxgPyXQ.exe
  2⤵
  PID:3432
- C:\Windows\System\wySVMfu.exe
  C:\Windows\System\wySVMfu.exe
  2⤵
  PID:3356
- C:\Windows\System\bJrgrBg.exe
  C:\Windows\System\bJrgrBg.exe
  2⤵
  PID:3516
- C:\Windows\System\eBQyxWn.exe
  C:\Windows\System\eBQyxWn.exe
  2⤵
  PID:3532
- C:\Windows\System\dIsNEKL.exe
  C:\Windows\System\dIsNEKL.exe
  2⤵
  PID:3548
- C:\Windows\System\fWWOdOn.exe
  C:\Windows\System\fWWOdOn.exe
  2⤵
  PID:3564
- C:\Windows\System\pRTiEiA.exe
  C:\Windows\System\pRTiEiA.exe
  2⤵
  PID:3812
- C:\Windows\System\icHylpe.exe
  C:\Windows\System\icHylpe.exe
  2⤵
  PID:3884
- C:\Windows\System\gFoPUpI.exe
  C:\Windows\System\gFoPUpI.exe
  2⤵
  PID:3904
- C:\Windows\System\XcCcDBV.exe
  C:\Windows\System\XcCcDBV.exe
  2⤵
  PID:2692
- C:\Windows\System\nLUflcb.exe
  C:\Windows\System\nLUflcb.exe
  2⤵
  PID:3628
- C:\Windows\System\vLNFjMT.exe
  C:\Windows\System\vLNFjMT.exe
  2⤵
  PID:3668
- C:\Windows\System\tgwdruw.exe
  C:\Windows\System\tgwdruw.exe
  2⤵
  PID:3704
- C:\Windows\System\ZkFnhqp.exe
  C:\Windows\System\ZkFnhqp.exe
  2⤵
  PID:3768
- C:\Windows\System\qZmyKcK.exe
  C:\Windows\System\qZmyKcK.exe
  2⤵
  PID:3864
- C:\Windows\System\ylSDhHq.exe
  C:\Windows\System\ylSDhHq.exe
  2⤵
  PID:3936
- C:\Windows\System\asXpgDh.exe
  C:\Windows\System\asXpgDh.exe
  2⤵
  PID:3964
- C:\Windows\System\leWJmqe.exe
  C:\Windows\System\leWJmqe.exe
  2⤵
  PID:3996
- C:\Windows\System\IfaGHts.exe
  C:\Windows\System\IfaGHts.exe
  2⤵
  PID:4016
- C:\Windows\System\hKDuuwl.exe
  C:\Windows\System\hKDuuwl.exe
  2⤵
  PID:4040
- C:\Windows\System\QpKaFSs.exe
  C:\Windows\System\QpKaFSs.exe
  2⤵
  PID:4076
- C:\Windows\System\OekIUfO.exe
  C:\Windows\System\OekIUfO.exe
  2⤵
  PID:2480
- C:\Windows\System\DYCQXPz.exe
  C:\Windows\System\DYCQXPz.exe
  2⤵
  PID:2212
- C:\Windows\System\SfbMZzH.exe
  C:\Windows\System\SfbMZzH.exe
  2⤵
  PID:1656
- C:\Windows\System\pBpgrcZ.exe
  C:\Windows\System\pBpgrcZ.exe
  2⤵
  PID:3180
- C:\Windows\System\SsesnwQ.exe
  C:\Windows\System\SsesnwQ.exe
  2⤵
  PID:2288
- C:\Windows\System\cwtkYca.exe
  C:\Windows\System\cwtkYca.exe
  2⤵
  PID:2276
- C:\Windows\System\ztqYEMg.exe
  C:\Windows\System\ztqYEMg.exe
  2⤵
  PID:860
- C:\Windows\System\MrvAbem.exe
  C:\Windows\System\MrvAbem.exe
  2⤵
  PID:540
- C:\Windows\System\zKsLxMy.exe
  C:\Windows\System\zKsLxMy.exe
  2⤵
  PID:2084
- C:\Windows\System\oJYPytJ.exe
  C:\Windows\System\oJYPytJ.exe
  2⤵
  PID:2684
- C:\Windows\System\LVVENET.exe
  C:\Windows\System\LVVENET.exe
  2⤵
  PID:1868
- C:\Windows\System\qUwyTYY.exe
  C:\Windows\System\qUwyTYY.exe
  2⤵
  PID:2508
- C:\Windows\System\rbdiXNM.exe
  C:\Windows\System\rbdiXNM.exe
  2⤵
  PID:684
- C:\Windows\System\qiNbFkf.exe
  C:\Windows\System\qiNbFkf.exe
  2⤵
  PID:844
- C:\Windows\System\iHstfGL.exe
  C:\Windows\System\iHstfGL.exe
  2⤵
  PID:2976
- C:\Windows\System\dvTKaWV.exe
  C:\Windows\System\dvTKaWV.exe
  2⤵
  PID:1244
- C:\Windows\System\WHAvcWp.exe
  C:\Windows\System\WHAvcWp.exe
  2⤵
  PID:3284
- C:\Windows\System\pMElEzW.exe
  C:\Windows\System\pMElEzW.exe
  2⤵
  PID:1004
- C:\Windows\System\DgOpxSL.exe
  C:\Windows\System\DgOpxSL.exe
  2⤵
  PID:2188
- C:\Windows\System\RpEiBOM.exe
  C:\Windows\System\RpEiBOM.exe
  2⤵
  PID:3412
- C:\Windows\System\KZMHuUP.exe
  C:\Windows\System\KZMHuUP.exe
  2⤵
  PID:3528
- C:\Windows\System\AuROBaC.exe
  C:\Windows\System\AuROBaC.exe
  2⤵
  PID:1568
- C:\Windows\System\JDCpDpT.exe
  C:\Windows\System\JDCpDpT.exe
  2⤵
  PID:2520
- C:\Windows\System\FTpYdfB.exe
  C:\Windows\System\FTpYdfB.exe
  2⤵
  PID:3540
- C:\Windows\System\rVpTtgr.exe
  C:\Windows\System\rVpTtgr.exe
  2⤵
  PID:3576
- C:\Windows\System\OYodnnT.exe
  C:\Windows\System\OYodnnT.exe
  2⤵
  PID:1768
- C:\Windows\System\yBCsBEi.exe
  C:\Windows\System\yBCsBEi.exe
  2⤵
  PID:2072
- C:\Windows\System\HLEZrFY.exe
  C:\Windows\System\HLEZrFY.exe
  2⤵
  PID:3600
- C:\Windows\System\KUMQGTE.exe
  C:\Windows\System\KUMQGTE.exe
  2⤵
  PID:3612
- C:\Windows\System\tCPnejQ.exe
  C:\Windows\System\tCPnejQ.exe
  2⤵
  PID:3680
- C:\Windows\System\lswkRSA.exe
  C:\Windows\System\lswkRSA.exe
  2⤵
  PID:1660
- C:\Windows\System\vWeBKmg.exe
  C:\Windows\System\vWeBKmg.exe
  2⤵
  PID:3268
- C:\Windows\System\eNWlsWN.exe
  C:\Windows\System\eNWlsWN.exe
  2⤵
  PID:3456
- C:\Windows\System\cuvBHhS.exe
  C:\Windows\System\cuvBHhS.exe
  2⤵
  PID:3748
- C:\Windows\System\OFKWkYG.exe
  C:\Windows\System\OFKWkYG.exe
  2⤵
  PID:2416
- C:\Windows\System\jNCeNTG.exe
  C:\Windows\System\jNCeNTG.exe
  2⤵
  PID:1712
- C:\Windows\System\CqilJIM.exe
  C:\Windows\System\CqilJIM.exe
  2⤵
  PID:2512
- C:\Windows\System\pDPpilH.exe
  C:\Windows\System\pDPpilH.exe
  2⤵
  PID:3664
- C:\Windows\System\tQLNfHd.exe
  C:\Windows\System\tQLNfHd.exe
  2⤵
  PID:1020
- C:\Windows\System\tNMrMJw.exe
  C:\Windows\System\tNMrMJw.exe
  2⤵
  PID:3832
- C:\Windows\System\eXYSioB.exe
  C:\Windows\System\eXYSioB.exe
  2⤵
  PID:3848
- C:\Windows\System\DsVWuzP.exe
  C:\Windows\System\DsVWuzP.exe
  2⤵
  PID:3872
- C:\Windows\System\uEFmXrA.exe
  C:\Windows\System\uEFmXrA.exe
  2⤵
  PID:3984
- C:\Windows\System\DAIFptk.exe
  C:\Windows\System\DAIFptk.exe
  2⤵
  PID:3952
- C:\Windows\System\oPHEaUv.exe
  C:\Windows\System\oPHEaUv.exe
  2⤵
  PID:2464
- C:\Windows\System\YhANBVy.exe
  C:\Windows\System\YhANBVy.exe
  2⤵
  PID:4080
- C:\Windows\System\AOPwUlF.exe
  C:\Windows\System\AOPwUlF.exe
  2⤵
  PID:2324
- C:\Windows\System\tChDEqA.exe
  C:\Windows\System\tChDEqA.exe
  2⤵
  PID:2596
- C:\Windows\System\cNokuxe.exe
  C:\Windows\System\cNokuxe.exe
  2⤵
  PID:796
- C:\Windows\System\tVXmLlw.exe
  C:\Windows\System\tVXmLlw.exe
  2⤵
  PID:2708
- C:\Windows\System\Qbwgdie.exe
  C:\Windows\System\Qbwgdie.exe
  2⤵
  PID:640
- C:\Windows\System\BDzMYYY.exe
  C:\Windows\System\BDzMYYY.exe
  2⤵
  PID:2568
- C:\Windows\System\gPTwpRA.exe
  C:\Windows\System\gPTwpRA.exe
  2⤵
  PID:1504
- C:\Windows\System\vtfIyBZ.exe
  C:\Windows\System\vtfIyBZ.exe
  2⤵
  PID:2136
- C:\Windows\System\CYJbEhU.exe
  C:\Windows\System\CYJbEhU.exe
  2⤵
  PID:2564
- C:\Windows\System\umJRbkT.exe
  C:\Windows\System\umJRbkT.exe
  2⤵
  PID:2488
- C:\Windows\System\NbLaIoZ.exe
  C:\Windows\System\NbLaIoZ.exe
  2⤵
  PID:2096
- C:\Windows\System\QXMttTE.exe
  C:\Windows\System\QXMttTE.exe
  2⤵
  PID:3292
- C:\Windows\System\fTFKAhW.exe
  C:\Windows\System\fTFKAhW.exe
  2⤵
  PID:3404
- C:\Windows\System\VsFwRSs.exe
  C:\Windows\System\VsFwRSs.exe
  2⤵
  PID:4112
- C:\Windows\System\fEHipsu.exe
  C:\Windows\System\fEHipsu.exe
  2⤵
  PID:4128
- C:\Windows\System\LADxtTJ.exe
  C:\Windows\System\LADxtTJ.exe
  2⤵
  PID:4144
- C:\Windows\System\wJjiiAD.exe
  C:\Windows\System\wJjiiAD.exe
  2⤵
  PID:4284
- C:\Windows\System\RYWGtrb.exe
  C:\Windows\System\RYWGtrb.exe
  2⤵
  PID:4320
- C:\Windows\System\veAYrni.exe
  C:\Windows\System\veAYrni.exe
  2⤵
  PID:4396
- C:\Windows\System\DfwqriX.exe
  C:\Windows\System\DfwqriX.exe
  2⤵
  PID:4412
- C:\Windows\System\QiOzwck.exe
  C:\Windows\System\QiOzwck.exe
  2⤵
  PID:4428
- C:\Windows\System\bILcSWq.exe
  C:\Windows\System\bILcSWq.exe
  2⤵
  PID:4444
- C:\Windows\System\CwcaWrS.exe
  C:\Windows\System\CwcaWrS.exe
  2⤵
  PID:4460
- C:\Windows\System\aGAjcaO.exe
  C:\Windows\System\aGAjcaO.exe
  2⤵
  PID:4476
- C:\Windows\System\cxHTDxo.exe
  C:\Windows\System\cxHTDxo.exe
  2⤵
  PID:4492
- C:\Windows\System\ASoWsGL.exe
  C:\Windows\System\ASoWsGL.exe
  2⤵
  PID:4508
- C:\Windows\System\bDZRkbT.exe
  C:\Windows\System\bDZRkbT.exe
  2⤵
  PID:4528
- C:\Windows\System\PdSfRPe.exe
  C:\Windows\System\PdSfRPe.exe
  2⤵
  PID:4544
- C:\Windows\System\EoOXNUD.exe
  C:\Windows\System\EoOXNUD.exe
  2⤵
  PID:4560
- C:\Windows\System\HuWRAiO.exe
  C:\Windows\System\HuWRAiO.exe
  2⤵
  PID:4576
- C:\Windows\System\GYxAcPJ.exe
  C:\Windows\System\GYxAcPJ.exe
  2⤵
  PID:4592
- C:\Windows\System\NaQnjqF.exe
  C:\Windows\System\NaQnjqF.exe
  2⤵
  PID:4608
- C:\Windows\System\jgddYOg.exe
  C:\Windows\System\jgddYOg.exe
  2⤵
  PID:4624
- C:\Windows\System\JohZIBB.exe
  C:\Windows\System\JohZIBB.exe
  2⤵
  PID:4688
- C:\Windows\System\QKtPktD.exe
  C:\Windows\System\QKtPktD.exe
  2⤵
  PID:4712
- C:\Windows\System\quJeTAv.exe
  C:\Windows\System\quJeTAv.exe
  2⤵
  PID:4728
- C:\Windows\System\TfmaowP.exe
  C:\Windows\System\TfmaowP.exe
  2⤵
  PID:4744
- C:\Windows\System\iBbklfk.exe
  C:\Windows\System\iBbklfk.exe
  2⤵
  PID:4760
- C:\Windows\System\sFubFQI.exe
  C:\Windows\System\sFubFQI.exe
  2⤵
  PID:4776
- C:\Windows\System\QeJATSu.exe
  C:\Windows\System\QeJATSu.exe
  2⤵
  PID:4792
- C:\Windows\System\ziuPxJx.exe
  C:\Windows\System\ziuPxJx.exe
  2⤵
  PID:4816
- C:\Windows\System\puwrBqU.exe
  C:\Windows\System\puwrBqU.exe
  2⤵
  PID:4876
- C:\Windows\System\CqQOEQs.exe
  C:\Windows\System\CqQOEQs.exe
  2⤵
  PID:4900
- C:\Windows\System\RWtWQnZ.exe
  C:\Windows\System\RWtWQnZ.exe
  2⤵
  PID:4924
- C:\Windows\System\wkfghVw.exe
  C:\Windows\System\wkfghVw.exe
  2⤵
  PID:4948
- C:\Windows\System\sGhrKsD.exe
  C:\Windows\System\sGhrKsD.exe
  2⤵
  PID:4964
- C:\Windows\System\DiEwILF.exe
  C:\Windows\System\DiEwILF.exe
  2⤵
  PID:5008
- C:\Windows\System\mzfxUXJ.exe
  C:\Windows\System\mzfxUXJ.exe
  2⤵
  PID:5028
- C:\Windows\System\FxbNAPu.exe
  C:\Windows\System\FxbNAPu.exe
  2⤵
  PID:5044
- C:\Windows\System\ZTflrpJ.exe
  C:\Windows\System\ZTflrpJ.exe
  2⤵
  PID:5060
- C:\Windows\System\ogtbyjo.exe
  C:\Windows\System\ogtbyjo.exe
  2⤵
  PID:5076
- C:\Windows\System\LDMiDye.exe
  C:\Windows\System\LDMiDye.exe
  2⤵
  PID:5092
- C:\Windows\System\OYYkGuT.exe
  C:\Windows\System\OYYkGuT.exe
  2⤵
  PID:5112
- C:\Windows\System\lOMOQbQ.exe
  C:\Windows\System\lOMOQbQ.exe
  2⤵
  PID:3508
- C:\Windows\System\PBxoKeh.exe
  C:\Windows\System\PBxoKeh.exe
  2⤵
  PID:1684
- C:\Windows\System\PnzdYul.exe
  C:\Windows\System\PnzdYul.exe
  2⤵
  PID:3808
- C:\Windows\System\CCkgWem.exe
  C:\Windows\System\CCkgWem.exe
  2⤵
  PID:2764
- C:\Windows\System\PulQNZS.exe
  C:\Windows\System\PulQNZS.exe
  2⤵
  PID:3860
- C:\Windows\System\OVSYluk.exe
  C:\Windows\System\OVSYluk.exe
  2⤵
  PID:3956
- C:\Windows\System\sMyvjmb.exe
  C:\Windows\System\sMyvjmb.exe
  2⤵
  PID:2280
- C:\Windows\System\jqLFxWu.exe
  C:\Windows\System\jqLFxWu.exe
  2⤵
  PID:3344
- C:\Windows\System\WBxrJXp.exe
  C:\Windows\System\WBxrJXp.exe
  2⤵
  PID:2756
- C:\Windows\System\VhatCHx.exe
  C:\Windows\System\VhatCHx.exe
  2⤵
  PID:3364
- C:\Windows\System\upisqJg.exe
  C:\Windows\System\upisqJg.exe
  2⤵
  PID:3492
- C:\Windows\System\WvOlTth.exe
  C:\Windows\System\WvOlTth.exe
  2⤵
  PID:2752
- C:\Windows\System\OezKKQC.exe
  C:\Windows\System\OezKKQC.exe
  2⤵
  PID:332
- C:\Windows\System\USfqElD.exe
  C:\Windows\System\USfqElD.exe
  2⤵
  PID:4168
- C:\Windows\System\VTYHqJS.exe
  C:\Windows\System\VTYHqJS.exe
  2⤵
  PID:4184
- C:\Windows\System\HwLVYOq.exe
  C:\Windows\System\HwLVYOq.exe
  2⤵
  PID:4204
- C:\Windows\System\GbexJXJ.exe
  C:\Windows\System\GbexJXJ.exe
  2⤵
  PID:4220
- C:\Windows\System\CpmYuwf.exe
  C:\Windows\System\CpmYuwf.exe
  2⤵
  PID:4236
- C:\Windows\System\kMkzOID.exe
  C:\Windows\System\kMkzOID.exe
  2⤵
  PID:4252
- C:\Windows\System\MglMrqK.exe
  C:\Windows\System\MglMrqK.exe
  2⤵
  PID:3632
- C:\Windows\System\daQXudK.exe
  C:\Windows\System\daQXudK.exe
  2⤵
  PID:4272
- C:\Windows\System\AVmMYhz.exe
  C:\Windows\System\AVmMYhz.exe
  2⤵
  PID:2768
- C:\Windows\System\BUDsADF.exe
  C:\Windows\System\BUDsADF.exe
  2⤵
  PID:4152
- C:\Windows\System\uxjKaMq.exe
  C:\Windows\System\uxjKaMq.exe
  2⤵
  PID:596
- C:\Windows\System\sOfYjdC.exe
  C:\Windows\System\sOfYjdC.exe
  2⤵
  PID:2240
- C:\Windows\System\jifGydb.exe
  C:\Windows\System\jifGydb.exe
  2⤵
  PID:3032
- C:\Windows\System\HqqyfUr.exe
  C:\Windows\System\HqqyfUr.exe
  2⤵
  PID:748
- C:\Windows\System\heUBztY.exe
  C:\Windows\System\heUBztY.exe
  2⤵
  PID:4136
- C:\Windows\System\joUeHCS.exe
  C:\Windows\System\joUeHCS.exe
  2⤵
  PID:4316
- C:\Windows\System\icVkAYT.exe
  C:\Windows\System\icVkAYT.exe
  2⤵
  PID:4344
- C:\Windows\System\tVZnYmo.exe
  C:\Windows\System\tVZnYmo.exe
  2⤵
  PID:4360
- C:\Windows\System\wBoYuTa.exe
  C:\Windows\System\wBoYuTa.exe
  2⤵
  PID:4376
- C:\Windows\System\BilkuXl.exe
  C:\Windows\System\BilkuXl.exe
  2⤵
  PID:4404
- C:\Windows\System\MZsyJYd.exe
  C:\Windows\System\MZsyJYd.exe
  2⤵
  PID:4600
- C:\Windows\System\YYkXzeS.exe
  C:\Windows\System\YYkXzeS.exe
  2⤵
  PID:4648
- C:\Windows\System\NtgpujK.exe
  C:\Windows\System\NtgpujK.exe
  2⤵
  PID:1176
- C:\Windows\System\hbbuMAp.exe
  C:\Windows\System\hbbuMAp.exe
  2⤵
  PID:4700
- C:\Windows\System\uuObbTP.exe
  C:\Windows\System\uuObbTP.exe
  2⤵
  PID:4784
- C:\Windows\System\JpJuZKu.exe
  C:\Windows\System\JpJuZKu.exe
  2⤵
  PID:4800
- C:\Windows\System\ZolWlKH.exe
  C:\Windows\System\ZolWlKH.exe
  2⤵
  PID:1560
- C:\Windows\System\Ufktntn.exe
  C:\Windows\System\Ufktntn.exe
  2⤵
  PID:4848
- C:\Windows\System\KyTAQIT.exe
  C:\Windows\System\KyTAQIT.exe
  2⤵
  PID:4864
- C:\Windows\System\erWMjiP.exe
  C:\Windows\System\erWMjiP.exe
  2⤵
  PID:4872
- C:\Windows\System\yvhEZeP.exe
  C:\Windows\System\yvhEZeP.exe
  2⤵
  PID:4908
- C:\Windows\System\XeMBUHM.exe
  C:\Windows\System\XeMBUHM.exe
  2⤵
  PID:4940
- C:\Windows\System\aPqCchT.exe
  C:\Windows\System\aPqCchT.exe
  2⤵
  PID:4960
- C:\Windows\System\Nhauoae.exe
  C:\Windows\System\Nhauoae.exe
  2⤵
  PID:5020
- C:\Windows\System\RUQtHRj.exe
  C:\Windows\System\RUQtHRj.exe
  2⤵
  PID:3556
- C:\Windows\System\CymVGBL.exe
  C:\Windows\System\CymVGBL.exe
  2⤵
  PID:5100
- C:\Windows\System\nPSdbux.exe
  C:\Windows\System\nPSdbux.exe
  2⤵
  PID:5004
- C:\Windows\System\WqXAlwK.exe
  C:\Windows\System\WqXAlwK.exe
  2⤵
  PID:3580
- C:\Windows\System\xTWgcRs.exe
  C:\Windows\System\xTWgcRs.exe
  2⤵
  PID:3596
- C:\Windows\System\OpyYYAb.exe
  C:\Windows\System\OpyYYAb.exe
  2⤵
  PID:3164
- C:\Windows\System\AxSQxQf.exe
  C:\Windows\System\AxSQxQf.exe
  2⤵
  PID:3252
- C:\Windows\System\zuVzGrx.exe
  C:\Windows\System\zuVzGrx.exe
  2⤵
  PID:3304
- C:\Windows\System\PgixlsC.exe
  C:\Windows\System\PgixlsC.exe
  2⤵
  PID:2164
- C:\Windows\System\NPpsLkA.exe
  C:\Windows\System\NPpsLkA.exe
  2⤵
  PID:3272
- C:\Windows\System\KJPaqFq.exe
  C:\Windows\System\KJPaqFq.exe
  2⤵
  PID:3080
- C:\Windows\System\NVdwGae.exe
  C:\Windows\System\NVdwGae.exe
  2⤵
  PID:3360
- C:\Windows\System\omWzQwK.exe
  C:\Windows\System\omWzQwK.exe
  2⤵
  PID:4000
- C:\Windows\System\sdGKzcC.exe
  C:\Windows\System\sdGKzcC.exe
  2⤵
  PID:4160
- C:\Windows\System\VGMUNzE.exe
  C:\Windows\System\VGMUNzE.exe
  2⤵
  PID:4228
- C:\Windows\System\OLWvEUp.exe
  C:\Windows\System\OLWvEUp.exe
  2⤵
  PID:292
- C:\Windows\System\koZjYXo.exe
  C:\Windows\System\koZjYXo.exe
  2⤵
  PID:2736
- C:\Windows\System\SRauVnw.exe
  C:\Windows\System\SRauVnw.exe
  2⤵
  PID:4308
- C:\Windows\System\ZMCdWjT.exe
  C:\Windows\System\ZMCdWjT.exe
  2⤵
  PID:972
- C:\Windows\System\GoJOpts.exe
  C:\Windows\System\GoJOpts.exe
  2⤵
  PID:4352
- C:\Windows\System\avRmjil.exe
  C:\Windows\System\avRmjil.exe
  2⤵
  PID:4436
- C:\Windows\System\eKjnpdw.exe
  C:\Windows\System\eKjnpdw.exe
  2⤵
  PID:4868
- C:\Windows\System\FCHllkx.exe
  C:\Windows\System\FCHllkx.exe
  2⤵
  PID:4456
- C:\Windows\System\ULKHlJK.exe
  C:\Windows\System\ULKHlJK.exe
  2⤵
  PID:4520
- C:\Windows\System\aknOqYQ.exe
  C:\Windows\System\aknOqYQ.exe
  2⤵
  PID:4540
- C:\Windows\System\MdZoqaw.exe
  C:\Windows\System\MdZoqaw.exe
  2⤵
  PID:4616
- C:\Windows\System\fXDMepT.exe
  C:\Windows\System\fXDMepT.exe
  2⤵
  PID:4704
- C:\Windows\System\lTbQOvD.exe
  C:\Windows\System\lTbQOvD.exe
  2⤵
  PID:1012
- C:\Windows\System\PqAeTlf.exe
  C:\Windows\System\PqAeTlf.exe
  2⤵
  PID:1220
- C:\Windows\System\kysDINX.exe
  C:\Windows\System\kysDINX.exe
  2⤵
  PID:4720
- C:\Windows\System\DHdLjFW.exe
  C:\Windows\System\DHdLjFW.exe
  2⤵
  PID:4828
- C:\Windows\System\IcFzHtW.exe
  C:\Windows\System\IcFzHtW.exe
  2⤵
  PID:4768
- C:\Windows\System\IwQGOpK.exe
  C:\Windows\System\IwQGOpK.exe
  2⤵
  PID:4840
- C:\Windows\System\ymZiLYV.exe
  C:\Windows\System\ymZiLYV.exe
  2⤵
  PID:4836
- C:\Windows\System\OhjjyNy.exe
  C:\Windows\System\OhjjyNy.exe
  2⤵
  PID:4916
- C:\Windows\System\PHvnEah.exe
  C:\Windows\System\PHvnEah.exe
  2⤵
  PID:4980
- C:\Windows\System\VmJmHgn.exe
  C:\Windows\System\VmJmHgn.exe
  2⤵
  PID:580
- C:\Windows\System\MJFGtgR.exe
  C:\Windows\System\MJFGtgR.exe
  2⤵
  PID:3648
- C:\Windows\System\VJQedwn.exe
  C:\Windows\System\VJQedwn.exe
  2⤵
  PID:3308
- C:\Windows\System\UTFrdPJ.exe
  C:\Windows\System\UTFrdPJ.exe
  2⤵
  PID:4060
- C:\Windows\System\ZjzIHXC.exe
  C:\Windows\System\ZjzIHXC.exe
  2⤵
  PID:5040
- C:\Windows\System\GGaXLBK.exe
  C:\Windows\System\GGaXLBK.exe
  2⤵
  PID:3780
- C:\Windows\System\wGwqvMU.exe
  C:\Windows\System\wGwqvMU.exe
  2⤵
  PID:3840
- C:\Windows\System\clogQMQ.exe
  C:\Windows\System\clogQMQ.exe
  2⤵
  PID:4200
- C:\Windows\System\mxNoKbb.exe
  C:\Windows\System\mxNoKbb.exe
  2⤵
  PID:4156
- C:\Windows\System\bEoMNwh.exe
  C:\Windows\System\bEoMNwh.exe
  2⤵
  PID:4248
- C:\Windows\System\FtFYNNX.exe
  C:\Windows\System\FtFYNNX.exe
  2⤵
  PID:4176
- C:\Windows\System\XebcyuA.exe
  C:\Windows\System\XebcyuA.exe
  2⤵
  PID:4120
- C:\Windows\System\AJsaIxL.exe
  C:\Windows\System\AJsaIxL.exe
  2⤵
  PID:664
- C:\Windows\System\ZnLYUeq.exe
  C:\Windows\System\ZnLYUeq.exe
  2⤵
  PID:4368
- C:\Windows\System\ObbszJB.exe
  C:\Windows\System\ObbszJB.exe
  2⤵
  PID:4488
- C:\Windows\System\MDnxGpi.exe
  C:\Windows\System\MDnxGpi.exe
  2⤵
  PID:3472
- C:\Windows\System\xnhrnte.exe
  C:\Windows\System\xnhrnte.exe
  2⤵
  PID:2068
- C:\Windows\System\HIdwPxr.exe
  C:\Windows\System\HIdwPxr.exe
  2⤵
  PID:4568
- C:\Windows\System\VIokDMl.exe
  C:\Windows\System\VIokDMl.exe
  2⤵
  PID:4644
- C:\Windows\System\fHHIGCb.exe
  C:\Windows\System\fHHIGCb.exe
  2⤵
  PID:4668
- C:\Windows\System\IZSAgnv.exe
  C:\Windows\System\IZSAgnv.exe
  2⤵
  PID:5052
- C:\Windows\System\bKTMioW.exe
  C:\Windows\System\bKTMioW.exe
  2⤵
  PID:4740
- C:\Windows\System\LcTBcDR.exe
  C:\Windows\System\LcTBcDR.exe
  2⤵
  PID:4752
- C:\Windows\System\boSbzmS.exe
  C:\Windows\System\boSbzmS.exe
  2⤵
  PID:4812
- C:\Windows\System\kGergjg.exe
  C:\Windows\System\kGergjg.exe
  2⤵
  PID:5108
- C:\Windows\System\qwmWDnT.exe
  C:\Windows\System\qwmWDnT.exe
  2⤵
  PID:3584
- C:\Windows\System\DaCtCdd.exe
  C:\Windows\System\DaCtCdd.exe
  2⤵
  PID:4808
- C:\Windows\System\Qkiphsz.exe
  C:\Windows\System\Qkiphsz.exe
  2⤵
  PID:3340
- C:\Windows\System\kFABVlU.exe
  C:\Windows\System\kFABVlU.exe
  2⤵
  PID:3168
- C:\Windows\System\RrGJJMb.exe
  C:\Windows\System\RrGJJMb.exe
  2⤵
  PID:3764
- C:\Windows\System\DUgERjC.exe
  C:\Windows\System\DUgERjC.exe
  2⤵
  PID:4104
- C:\Windows\System\VQsplev.exe
  C:\Windows\System\VQsplev.exe
  2⤵
  PID:5128
- C:\Windows\System\BbWJkFu.exe
  C:\Windows\System\BbWJkFu.exe
  2⤵
  PID:5144
- C:\Windows\System\wajueYO.exe
  C:\Windows\System\wajueYO.exe
  2⤵
  PID:5160
- C:\Windows\System\KzUOfRU.exe
  C:\Windows\System\KzUOfRU.exe
  2⤵
  PID:5176
- C:\Windows\System\cYCTBIH.exe
  C:\Windows\System\cYCTBIH.exe
  2⤵
  PID:5192
- C:\Windows\System\QtLkrag.exe
  C:\Windows\System\QtLkrag.exe
  2⤵
  PID:5208
- C:\Windows\System\oLiZZhL.exe
  C:\Windows\System\oLiZZhL.exe
  2⤵
  PID:5240
- C:\Windows\System\FJryeKe.exe
  C:\Windows\System\FJryeKe.exe
  2⤵
  PID:5260
- C:\Windows\System\dgqqSqc.exe
  C:\Windows\System\dgqqSqc.exe
  2⤵
  PID:5276
- C:\Windows\System\iANHBuk.exe
  C:\Windows\System\iANHBuk.exe
  2⤵
  PID:5292
- C:\Windows\System\IUfJnZr.exe
  C:\Windows\System\IUfJnZr.exe
  2⤵
  PID:5312
- C:\Windows\System\uGOKJNj.exe
  C:\Windows\System\uGOKJNj.exe
  2⤵
  PID:5332
- C:\Windows\System\jRAYPbh.exe
  C:\Windows\System\jRAYPbh.exe
  2⤵
  PID:5348
- C:\Windows\System\zogoZWW.exe
  C:\Windows\System\zogoZWW.exe
  2⤵
  PID:5364
- C:\Windows\System\eEoWHgy.exe
  C:\Windows\System\eEoWHgy.exe
  2⤵
  PID:5384
- C:\Windows\System\oQWMGqM.exe
  C:\Windows\System\oQWMGqM.exe
  2⤵
  PID:5400
- C:\Windows\System\qupVFUS.exe
  C:\Windows\System\qupVFUS.exe
  2⤵
  PID:5416
- C:\Windows\System\JWiIIrO.exe
  C:\Windows\System\JWiIIrO.exe
  2⤵
  PID:5568
- C:\Windows\System\uXkkzvS.exe
  C:\Windows\System\uXkkzvS.exe
  2⤵
  PID:5588
- C:\Windows\System\vptuOnn.exe
  C:\Windows\System\vptuOnn.exe
  2⤵
  PID:5604
- C:\Windows\System\rgvEFFb.exe
  C:\Windows\System\rgvEFFb.exe
  2⤵
  PID:5620
- C:\Windows\System\dbCUuxe.exe
  C:\Windows\System\dbCUuxe.exe
  2⤵
  PID:5636
- C:\Windows\System\ZgqIsqG.exe
  C:\Windows\System\ZgqIsqG.exe
  2⤵
  PID:5652
- C:\Windows\System\DSWABFt.exe
  C:\Windows\System\DSWABFt.exe
  2⤵
  PID:5668
- C:\Windows\System\xcmiCDl.exe
  C:\Windows\System\xcmiCDl.exe
  2⤵
  PID:5684
- C:\Windows\System\nbLXNGb.exe
  C:\Windows\System\nbLXNGb.exe
  2⤵
  PID:5704
- C:\Windows\System\HiqidNM.exe
  C:\Windows\System\HiqidNM.exe
  2⤵
  PID:5720
- C:\Windows\System\ZuwAbmr.exe
  C:\Windows\System\ZuwAbmr.exe
  2⤵
  PID:5736
- C:\Windows\System\DkmmtlM.exe
  C:\Windows\System\DkmmtlM.exe
  2⤵
  PID:5752
- C:\Windows\System\tSoWoCb.exe
  C:\Windows\System\tSoWoCb.exe
  2⤵
  PID:5768
- C:\Windows\System\RokLiRW.exe
  C:\Windows\System\RokLiRW.exe
  2⤵
  PID:5788
- C:\Windows\System\CBSvthB.exe
  C:\Windows\System\CBSvthB.exe
  2⤵
  PID:5852
- C:\Windows\System\CiFmqXT.exe
  C:\Windows\System\CiFmqXT.exe
  2⤵
  PID:5868
- C:\Windows\System\JbxecvS.exe
  C:\Windows\System\JbxecvS.exe
  2⤵
  PID:5884
- C:\Windows\System\xigvqVs.exe
  C:\Windows\System\xigvqVs.exe
  2⤵
  PID:5900
- C:\Windows\System\akDInjV.exe
  C:\Windows\System\akDInjV.exe
  2⤵
  PID:5916
- C:\Windows\System\DNABfsy.exe
  C:\Windows\System\DNABfsy.exe
  2⤵
  PID:5932
- C:\Windows\System\eyFsjwe.exe
  C:\Windows\System\eyFsjwe.exe
  2⤵
  PID:5948
- C:\Windows\System\rCExviJ.exe
  C:\Windows\System\rCExviJ.exe
  2⤵
  PID:5996
- C:\Windows\System\lWMJXTB.exe
  C:\Windows\System\lWMJXTB.exe
  2⤵
  PID:6012
- C:\Windows\System\rgnYMey.exe
  C:\Windows\System\rgnYMey.exe
  2⤵
  PID:6028
- C:\Windows\System\qPWvqxo.exe
  C:\Windows\System\qPWvqxo.exe
  2⤵
  PID:6044
- C:\Windows\System\vJWQdwI.exe
  C:\Windows\System\vJWQdwI.exe
  2⤵
  PID:6060
- C:\Windows\System\DRerYHN.exe
  C:\Windows\System\DRerYHN.exe
  2⤵
  PID:6076
- C:\Windows\System\cmBAlHi.exe
  C:\Windows\System\cmBAlHi.exe
  2⤵
  PID:6096
- C:\Windows\System\aReqsel.exe
  C:\Windows\System\aReqsel.exe
  2⤵
  PID:6112
- C:\Windows\System\drGvehR.exe
  C:\Windows\System\drGvehR.exe
  2⤵
  PID:6128
- C:\Windows\System\qloAoLQ.exe
  C:\Windows\System\qloAoLQ.exe
  2⤵
  PID:3980
- C:\Windows\System\VjkREuP.exe
  C:\Windows\System\VjkREuP.exe
  2⤵
  PID:4860
- C:\Windows\System\YcnJKAF.exe
  C:\Windows\System\YcnJKAF.exe
  2⤵
  PID:4388
- C:\Windows\System\WFFjdAF.exe
  C:\Windows\System\WFFjdAF.exe
  2⤵
  PID:4892
- C:\Windows\System\OhtEEhZ.exe
  C:\Windows\System\OhtEEhZ.exe
  2⤵
  PID:3856
- C:\Windows\System\jzCOMKL.exe
  C:\Windows\System\jzCOMKL.exe
  2⤵
  PID:3588
- C:\Windows\System\kTWTyjL.exe
  C:\Windows\System\kTWTyjL.exe
  2⤵
  PID:5152
- C:\Windows\System\eAyiTEG.exe
  C:\Windows\System\eAyiTEG.exe
  2⤵
  PID:4676
- C:\Windows\System\lXFEmJn.exe
  C:\Windows\System\lXFEmJn.exe
  2⤵
  PID:4936
- C:\Windows\System\qrYoqQJ.exe
  C:\Windows\System\qrYoqQJ.exe
  2⤵
  PID:2808
- C:\Windows\System\CCnxwwo.exe
  C:\Windows\System\CCnxwwo.exe
  2⤵
  PID:5124
- C:\Windows\System\iHFyGOW.exe
  C:\Windows\System\iHFyGOW.exe
  2⤵
  PID:4244
- C:\Windows\System\KULQFud.exe
  C:\Windows\System\KULQFud.exe
  2⤵
  PID:4364
- C:\Windows\System\plTZAcC.exe
  C:\Windows\System\plTZAcC.exe
  2⤵
  PID:4632
- C:\Windows\System\kHbXmXE.exe
  C:\Windows\System\kHbXmXE.exe
  2⤵
  PID:4640
- C:\Windows\System\MKFGdbK.exe
  C:\Windows\System\MKFGdbK.exe
  2⤵
  PID:744
- C:\Windows\System\gbslSug.exe
  C:\Windows\System\gbslSug.exe
  2⤵
  PID:5268
- C:\Windows\System\WOCchmL.exe
  C:\Windows\System\WOCchmL.exe
  2⤵
  PID:4260
- C:\Windows\System\xJeKSSW.exe
  C:\Windows\System\xJeKSSW.exe
  2⤵
  PID:5328
- C:\Windows\System\jGxqXXZ.exe
  C:\Windows\System\jGxqXXZ.exe
  2⤵
  PID:5360
- C:\Windows\System\yLPgZGb.exe
  C:\Windows\System\yLPgZGb.exe
  2⤵
  PID:5308
- C:\Windows\System\xenfRxk.exe
  C:\Windows\System\xenfRxk.exe
  2⤵
  PID:5452
- C:\Windows\System\hTWRxqW.exe
  C:\Windows\System\hTWRxqW.exe
  2⤵
  PID:5472
- C:\Windows\System\DaCJEik.exe
  C:\Windows\System\DaCJEik.exe
  2⤵
  PID:5496
- C:\Windows\System\BRezxik.exe
  C:\Windows\System\BRezxik.exe
  2⤵
  PID:5500
- C:\Windows\System\mnklGyS.exe
  C:\Windows\System\mnklGyS.exe
  2⤵
  PID:5524
- C:\Windows\System\MyMYwlb.exe
  C:\Windows\System\MyMYwlb.exe
  2⤵
  PID:5544
- C:\Windows\System\VzqiRtt.exe
  C:\Windows\System\VzqiRtt.exe
  2⤵
  PID:5556
- C:\Windows\System\RhtOyLU.exe
  C:\Windows\System\RhtOyLU.exe
  2⤵
  PID:5580
- C:\Windows\System\oamsvuc.exe
  C:\Windows\System\oamsvuc.exe
  2⤵
  PID:5616
- C:\Windows\System\UhxfVkv.exe
  C:\Windows\System\UhxfVkv.exe
  2⤵
  PID:5712
- C:\Windows\System\GoLlehS.exe
  C:\Windows\System\GoLlehS.exe
  2⤵
  PID:5808
- C:\Windows\System\cxQAYMl.exe
  C:\Windows\System\cxQAYMl.exe
  2⤵
  PID:5848
- C:\Windows\System\gsbZpIc.exe
  C:\Windows\System\gsbZpIc.exe
  2⤵
  PID:5880
- C:\Windows\System\kQHinsO.exe
  C:\Windows\System\kQHinsO.exe
  2⤵
  PID:5956
- C:\Windows\System\ohzmxIp.exe
  C:\Windows\System\ohzmxIp.exe
  2⤵
  PID:5964
- C:\Windows\System\sLSTQWU.exe
  C:\Windows\System\sLSTQWU.exe
  2⤵
  PID:5984
- C:\Windows\System\xwkgCRx.exe
  C:\Windows\System\xwkgCRx.exe
  2⤵
  PID:6008
- C:\Windows\System\mXugOEU.exe
  C:\Windows\System\mXugOEU.exe
  2⤵
  PID:6056
- C:\Windows\System\CZHxcWq.exe
  C:\Windows\System\CZHxcWq.exe
  2⤵
  PID:4652
- C:\Windows\System\IRrizkn.exe
  C:\Windows\System\IRrizkn.exe
  2⤵
  PID:4180
- C:\Windows\System\OnXZwzk.exe
  C:\Windows\System\OnXZwzk.exe
  2⤵
  PID:4336
- C:\Windows\System\qnqzrsS.exe
  C:\Windows\System\qnqzrsS.exe
  2⤵
  PID:5188
- C:\Windows\System\EUjOZHO.exe
  C:\Windows\System\EUjOZHO.exe
  2⤵
  PID:5204
- C:\Windows\System\irzZorP.exe
  C:\Windows\System\irzZorP.exe
  2⤵
  PID:4772
- C:\Windows\System\gjHxAfV.exe
  C:\Windows\System\gjHxAfV.exe
  2⤵
  PID:5300
- C:\Windows\System\sQdDYNL.exe
  C:\Windows\System\sQdDYNL.exe
  2⤵
  PID:5436
- C:\Windows\System\HYAPuSK.exe
  C:\Windows\System\HYAPuSK.exe
  2⤵
  PID:5444
- C:\Windows\System\sujRjMB.exe
  C:\Windows\System\sujRjMB.exe
  2⤵
  PID:4264
- C:\Windows\System\nbMNbKm.exe
  C:\Windows\System\nbMNbKm.exe
  2⤵
  PID:5512
- C:\Windows\System\IrBDGHn.exe
  C:\Windows\System\IrBDGHn.exe
  2⤵
  PID:5596
- C:\Windows\System\nrZivST.exe
  C:\Windows\System\nrZivST.exe
  2⤵
  PID:4620
- C:\Windows\System\WadNaLa.exe
  C:\Windows\System\WadNaLa.exe
  2⤵
  PID:5172
- C:\Windows\System\NiHDiGB.exe
  C:\Windows\System\NiHDiGB.exe
  2⤵
  PID:1900
- C:\Windows\System\cyxqiwv.exe
  C:\Windows\System\cyxqiwv.exe
  2⤵
  PID:5396
- C:\Windows\System\XwfABkx.exe
  C:\Windows\System\XwfABkx.exe
  2⤵
  PID:5744
- C:\Windows\System\UKmRpvy.exe
  C:\Windows\System\UKmRpvy.exe
  2⤵
  PID:5732
- C:\Windows\System\vnlyPXL.exe
  C:\Windows\System\vnlyPXL.exe
  2⤵
  PID:5800
- C:\Windows\System\QErxHob.exe
  C:\Windows\System\QErxHob.exe
  2⤵
  PID:5628
- C:\Windows\System\tCeuxDM.exe
  C:\Windows\System\tCeuxDM.exe
  2⤵
  PID:5696
- C:\Windows\System\cHbxDKN.exe
  C:\Windows\System\cHbxDKN.exe
  2⤵
  PID:5796
- C:\Windows\System\AUrUddi.exe
  C:\Windows\System\AUrUddi.exe
  2⤵
  PID:5892
- C:\Windows\System\FfCrnZa.exe
  C:\Windows\System\FfCrnZa.exe
  2⤵
  PID:5908
- C:\Windows\System\ItIiGZe.exe
  C:\Windows\System\ItIiGZe.exe
  2⤵
  PID:5960
- C:\Windows\System\PoadQFH.exe
  C:\Windows\System\PoadQFH.exe
  2⤵
  PID:5976
- C:\Windows\System\jEDiEmf.exe
  C:\Windows\System\jEDiEmf.exe
  2⤵
  PID:5424
- C:\Windows\System\SzISBAx.exe
  C:\Windows\System\SzISBAx.exe
  2⤵
  PID:5344
- C:\Windows\System\CQSoraU.exe
  C:\Windows\System\CQSoraU.exe
  2⤵
  PID:5488
- C:\Windows\System\vILhrDT.exe
  C:\Windows\System\vILhrDT.exe
  2⤵
  PID:4984
- C:\Windows\System\LCBEfzZ.exe
  C:\Windows\System\LCBEfzZ.exe
  2⤵
  PID:6072
- C:\Windows\System\ZpbwXyM.exe
  C:\Windows\System\ZpbwXyM.exe
  2⤵
  PID:2884
- C:\Windows\System\UREgRNp.exe
  C:\Windows\System\UREgRNp.exe
  2⤵
  PID:5380
- C:\Windows\System\gvlxAVV.exe
  C:\Windows\System\gvlxAVV.exe
  2⤵
  PID:5408
- C:\Windows\System\qxQSosr.exe
  C:\Windows\System\qxQSosr.exe
  2⤵
  PID:5156
- C:\Windows\System\zWAIBux.exe
  C:\Windows\System\zWAIBux.exe
  2⤵
  PID:5832
- C:\Windows\System\HXnzLIO.exe
  C:\Windows\System\HXnzLIO.exe
  2⤵
  PID:5860
- C:\Windows\System\xlwLxIA.exe
  C:\Windows\System\xlwLxIA.exe
  2⤵
  PID:5484
- C:\Windows\System\idJgzfE.exe
  C:\Windows\System\idJgzfE.exe
  2⤵
  PID:5516
- C:\Windows\System\FFbLKQJ.exe
  C:\Windows\System\FFbLKQJ.exe
  2⤵
  PID:5680
- C:\Windows\System\ezoaKTr.exe
  C:\Windows\System\ezoaKTr.exe
  2⤵
  PID:5820
- C:\Windows\System\SuGXCoN.exe
  C:\Windows\System\SuGXCoN.exe
  2⤵
  PID:5728
- C:\Windows\System\zwbRLdc.exe
  C:\Windows\System\zwbRLdc.exe
  2⤵
  PID:6124
- C:\Windows\System\EGbisko.exe
  C:\Windows\System\EGbisko.exe
  2⤵
  PID:3696
- C:\Windows\System\gkNLvdA.exe
  C:\Windows\System\gkNLvdA.exe
  2⤵
  PID:5456
- C:\Windows\System\WiGpdUx.exe
  C:\Windows\System\WiGpdUx.exe
  2⤵
  PID:4884
- C:\Windows\System\UJwTrLm.exe
  C:\Windows\System\UJwTrLm.exe
  2⤵
  PID:2292
- C:\Windows\System\vFjXKph.exe
  C:\Windows\System\vFjXKph.exe
  2⤵
  PID:5232
- C:\Windows\System\NbfpJEv.exe
  C:\Windows\System\NbfpJEv.exe
  2⤵
  PID:5988
- C:\Windows\System\rezawYN.exe
  C:\Windows\System\rezawYN.exe
  2⤵
  PID:5700
- C:\Windows\System\czxFpEf.exe
  C:\Windows\System\czxFpEf.exe
  2⤵
  PID:4684
- C:\Windows\System\ECzsDwa.exe
  C:\Windows\System\ECzsDwa.exe
  2⤵
  PID:6068
- C:\Windows\System\XSTUSPm.exe
  C:\Windows\System\XSTUSPm.exe
  2⤵
  PID:5532
- C:\Windows\System\UHkbQOv.exe
  C:\Windows\System\UHkbQOv.exe
  2⤵
  PID:5828
- C:\Windows\System\PtwYEGx.exe
  C:\Windows\System\PtwYEGx.exe
  2⤵
  PID:5320
- C:\Windows\System\BKkfcRd.exe
  C:\Windows\System\BKkfcRd.exe
  2⤵
  PID:6104
- C:\Windows\System\gktzSzZ.exe
  C:\Windows\System\gktzSzZ.exe
  2⤵
  PID:5840
- C:\Windows\System\eaEWiBz.exe
  C:\Windows\System\eaEWiBz.exe
  2⤵
  PID:5576
- C:\Windows\System\qXLzvoL.exe
  C:\Windows\System\qXLzvoL.exe
  2⤵
  PID:6120
- C:\Windows\System\hBBDzqH.exe
  C:\Windows\System\hBBDzqH.exe
  2⤵
  PID:2268
- C:\Windows\System\DYQKiPn.exe
  C:\Windows\System\DYQKiPn.exe
  2⤵
  PID:5072
- C:\Windows\System\cYcvLHP.exe
  C:\Windows\System\cYcvLHP.exe
  2⤵
  PID:4524
- C:\Windows\System\SiVLTiS.exe
  C:\Windows\System\SiVLTiS.exe
  2⤵
  PID:5648
- C:\Windows\System\vjtuhhv.exe
  C:\Windows\System\vjtuhhv.exe
  2⤵
  PID:6156
- C:\Windows\System\lpPFcDU.exe
  C:\Windows\System\lpPFcDU.exe
  2⤵
  PID:6172
- C:\Windows\System\KljlRCZ.exe
  C:\Windows\System\KljlRCZ.exe
  2⤵
  PID:6192
- C:\Windows\System\peeSJpT.exe
  C:\Windows\System\peeSJpT.exe
  2⤵
  PID:6208
- C:\Windows\System\QiKnrSX.exe
  C:\Windows\System\QiKnrSX.exe
  2⤵
  PID:6224
- C:\Windows\System\ZReMMQb.exe
  C:\Windows\System\ZReMMQb.exe
  2⤵
  PID:6240
- C:\Windows\System\PzmNvtA.exe
  C:\Windows\System\PzmNvtA.exe
  2⤵
  PID:6256
- C:\Windows\System\dEQwINn.exe
  C:\Windows\System\dEQwINn.exe
  2⤵
  PID:6272
- C:\Windows\System\HKFxAow.exe
  C:\Windows\System\HKFxAow.exe
  2⤵
  PID:6288
- C:\Windows\System\srDyAYk.exe
  C:\Windows\System\srDyAYk.exe
  2⤵
  PID:6324
- C:\Windows\System\KfWIRKo.exe
  C:\Windows\System\KfWIRKo.exe
  2⤵
  PID:6340
- C:\Windows\System\BgyHUkY.exe
  C:\Windows\System\BgyHUkY.exe
  2⤵
  PID:6356
- C:\Windows\System\PFaLxvi.exe
  C:\Windows\System\PFaLxvi.exe
  2⤵
  PID:6388
- C:\Windows\System\SRRiTlr.exe
  C:\Windows\System\SRRiTlr.exe
  2⤵
  PID:6404
- C:\Windows\System\pWkSmPo.exe
  C:\Windows\System\pWkSmPo.exe
  2⤵
  PID:6420
- C:\Windows\System\KVukekz.exe
  C:\Windows\System\KVukekz.exe
  2⤵
  PID:6440
- C:\Windows\System\LTztcCX.exe
  C:\Windows\System\LTztcCX.exe
  2⤵
  PID:6460
- C:\Windows\System\HASGUyv.exe
  C:\Windows\System\HASGUyv.exe
  2⤵
  PID:6484
- C:\Windows\System\xXFjnnT.exe
  C:\Windows\System\xXFjnnT.exe
  2⤵
  PID:6500
- C:\Windows\System\DTMiiSJ.exe
  C:\Windows\System\DTMiiSJ.exe
  2⤵
  PID:6516
- C:\Windows\System\uEATVvQ.exe
  C:\Windows\System\uEATVvQ.exe
  2⤵
  PID:6532
- C:\Windows\System\IUFhQdI.exe
  C:\Windows\System\IUFhQdI.exe
  2⤵
  PID:6548
- C:\Windows\System\QgQfklf.exe
  C:\Windows\System\QgQfklf.exe
  2⤵
  PID:6564
- C:\Windows\System\cteMTHQ.exe
  C:\Windows\System\cteMTHQ.exe
  2⤵
  PID:6580
- C:\Windows\System\NUgamnA.exe
  C:\Windows\System\NUgamnA.exe
  2⤵
  PID:6600
- C:\Windows\System\ulfVnNi.exe
  C:\Windows\System\ulfVnNi.exe
  2⤵
  PID:6620
- C:\Windows\System\xEPwnZD.exe
  C:\Windows\System\xEPwnZD.exe
  2⤵
  PID:6652
- C:\Windows\System\yttRoZg.exe
  C:\Windows\System\yttRoZg.exe
  2⤵
  PID:6668
- C:\Windows\System\PpVPxMA.exe
  C:\Windows\System\PpVPxMA.exe
  2⤵
  PID:6716
- C:\Windows\System\fmWrQXO.exe
  C:\Windows\System\fmWrQXO.exe
  2⤵
  PID:6736
- C:\Windows\System\rqJxrdj.exe
  C:\Windows\System\rqJxrdj.exe
  2⤵
  PID:6752
- C:\Windows\System\GEQFPgh.exe
  C:\Windows\System\GEQFPgh.exe
  2⤵
  PID:6768
- C:\Windows\System\sPfrLzw.exe
  C:\Windows\System\sPfrLzw.exe
  2⤵
  PID:6784
- C:\Windows\System\hMHqAue.exe
  C:\Windows\System\hMHqAue.exe
  2⤵
  PID:6800
- C:\Windows\System\MzInNMf.exe
  C:\Windows\System\MzInNMf.exe
  2⤵
  PID:6816
- C:\Windows\System\HJuylUC.exe
  C:\Windows\System\HJuylUC.exe
  2⤵
  PID:6840
- C:\Windows\System\SkOZcdt.exe
  C:\Windows\System\SkOZcdt.exe
  2⤵
  PID:6856
- C:\Windows\System\JvDBIke.exe
  C:\Windows\System\JvDBIke.exe
  2⤵
  PID:6872
- C:\Windows\System\XtNpWOk.exe
  C:\Windows\System\XtNpWOk.exe
  2⤵
  PID:6888
- C:\Windows\System\aXyKMUX.exe
  C:\Windows\System\aXyKMUX.exe
  2⤵
  PID:6904
- C:\Windows\System\zQmlqgS.exe
  C:\Windows\System\zQmlqgS.exe
  2⤵
  PID:6920
- C:\Windows\System\CYYtQba.exe
  C:\Windows\System\CYYtQba.exe
  2⤵
  PID:6936
- C:\Windows\System\VObnJNn.exe
  C:\Windows\System\VObnJNn.exe
  2⤵
  PID:6952
- C:\Windows\System\BcmHZuA.exe
  C:\Windows\System\BcmHZuA.exe
  2⤵
  PID:6980
- C:\Windows\System\OCnWITR.exe
  C:\Windows\System\OCnWITR.exe
  2⤵
  PID:7040
- C:\Windows\System\JOMePNM.exe
  C:\Windows\System\JOMePNM.exe
  2⤵
  PID:7056
- C:\Windows\System\kXhGmPd.exe
  C:\Windows\System\kXhGmPd.exe
  2⤵
  PID:7072
- C:\Windows\System\nUZSWmb.exe
  C:\Windows\System\nUZSWmb.exe
  2⤵
  PID:7088
- C:\Windows\System\bYyzSjr.exe
  C:\Windows\System\bYyzSjr.exe
  2⤵
  PID:6164
- C:\Windows\System\iTIVKid.exe
  C:\Windows\System\iTIVKid.exe
  2⤵
  PID:6204
- C:\Windows\System\SzyvlgW.exe
  C:\Windows\System\SzyvlgW.exe
  2⤵
  PID:6268
- C:\Windows\System\sQszPll.exe
  C:\Windows\System\sQszPll.exe
  2⤵
  PID:5536
- C:\Windows\System\cRWDwrO.exe
  C:\Windows\System\cRWDwrO.exe
  2⤵
  PID:6152
- C:\Windows\System\PfPILgY.exe
  C:\Windows\System\PfPILgY.exe
  2⤵
  PID:6220
- C:\Windows\System\afjznCk.exe
  C:\Windows\System\afjznCk.exe
  2⤵
  PID:6284
- C:\Windows\System\KDHbqXI.exe
  C:\Windows\System\KDHbqXI.exe
  2⤵
  PID:6352
- C:\Windows\System\sMxdGwH.exe
  C:\Windows\System\sMxdGwH.exe
  2⤵
  PID:6432
- C:\Windows\System\qJYmnGN.exe
  C:\Windows\System\qJYmnGN.exe
  2⤵
  PID:6480
- C:\Windows\System\QcOeLUU.exe
  C:\Windows\System\QcOeLUU.exe
  2⤵
  PID:6544
- C:\Windows\System\OWJzpxV.exe
  C:\Windows\System\OWJzpxV.exe
  2⤵
  PID:6616
- C:\Windows\System\iAeMcVP.exe
  C:\Windows\System\iAeMcVP.exe
  2⤵
  PID:6452
- C:\Windows\System\yrDfntx.exe
  C:\Windows\System\yrDfntx.exe
  2⤵
  PID:6628
- C:\Windows\System\EvCGzfh.exe
  C:\Windows\System\EvCGzfh.exe
  2⤵
  PID:6636
- C:\Windows\System\PAqyOgF.exe
  C:\Windows\System\PAqyOgF.exe
  2⤵
  PID:6644
- C:\Windows\System\yApFeih.exe
  C:\Windows\System\yApFeih.exe
  2⤵
  PID:6680
- C:\Windows\System\UnEYOdI.exe
  C:\Windows\System\UnEYOdI.exe
  2⤵
  PID:4196
- C:\Windows\System\YaEKFXk.exe
  C:\Windows\System\YaEKFXk.exe
  2⤵
  PID:6728
- C:\Windows\System\pWUtWpO.exe
  C:\Windows\System\pWUtWpO.exe
  2⤵
  PID:6796
- C:\Windows\System\WjpjwBV.exe
  C:\Windows\System\WjpjwBV.exe
  2⤵
  PID:6836
- C:\Windows\System\cAPnvkd.exe
  C:\Windows\System\cAPnvkd.exe
  2⤵
  PID:6896
- C:\Windows\System\qWNhGoQ.exe
  C:\Windows\System\qWNhGoQ.exe
  2⤵
  PID:6972
- C:\Windows\System\IPquGLs.exe
  C:\Windows\System\IPquGLs.exe
  2⤵
  PID:6748
- C:\Windows\System\YyDxfUF.exe
  C:\Windows\System\YyDxfUF.exe
  2⤵
  PID:6852
- C:\Windows\System\whTeuXc.exe
  C:\Windows\System\whTeuXc.exe
  2⤵
  PID:6944
- C:\Windows\System\SpAdZhA.exe
  C:\Windows\System\SpAdZhA.exe
  2⤵
  PID:6996
- C:\Windows\System\UJueDBb.exe
  C:\Windows\System\UJueDBb.exe
  2⤵
  PID:7004
- C:\Windows\System\kyKbFQz.exe
  C:\Windows\System\kyKbFQz.exe
  2⤵
  PID:7032
- C:\Windows\System\SrWcSLi.exe
  C:\Windows\System\SrWcSLi.exe
  2⤵
  PID:7084
- C:\Windows\System\jNjfIEt.exe
  C:\Windows\System\jNjfIEt.exe
  2⤵
  PID:7108
- C:\Windows\System\uzVdjry.exe
  C:\Windows\System\uzVdjry.exe
  2⤵
  PID:7124
- C:\Windows\System\jcHRmzU.exe
  C:\Windows\System\jcHRmzU.exe
  2⤵
  PID:7144
- C:\Windows\System\BrVLEAg.exe
  C:\Windows\System\BrVLEAg.exe
  2⤵
  PID:7148
- C:\Windows\System\uJLvZtl.exe
  C:\Windows\System\uJLvZtl.exe
  2⤵
  PID:5748
- C:\Windows\System\JEmTbJD.exe
  C:\Windows\System\JEmTbJD.exe
  2⤵
  PID:5552
- C:\Windows\System\cSdYgYz.exe
  C:\Windows\System\cSdYgYz.exe
  2⤵
  PID:6304
- C:\Windows\System\YHtuStD.exe
  C:\Windows\System\YHtuStD.exe
  2⤵
  PID:6576
- C:\Windows\System\QzOFORj.exe
  C:\Windows\System\QzOFORj.exe
  2⤵
  PID:6528
- C:\Windows\System\WUcfVaQ.exe
  C:\Windows\System\WUcfVaQ.exe
  2⤵
  PID:6332
- C:\Windows\System\aHEvLUm.exe
  C:\Windows\System\aHEvLUm.exe
  2⤵
  PID:6612
- C:\Windows\System\DQlLomb.exe
  C:\Windows\System\DQlLomb.exe
  2⤵
  PID:6280
- C:\Windows\System\kAOUJjS.exe
  C:\Windows\System\kAOUJjS.exe
  2⤵
  PID:6372
- C:\Windows\System\KisVzyY.exe
  C:\Windows\System\KisVzyY.exe
  2⤵
  PID:6724
- C:\Windows\System\jazADNJ.exe
  C:\Windows\System\jazADNJ.exe
  2⤵
  PID:6792
- C:\Windows\System\hWMTXuN.exe
  C:\Windows\System\hWMTXuN.exe
  2⤵
  PID:6744
- C:\Windows\System\SqPwDRF.exe
  C:\Windows\System\SqPwDRF.exe
  2⤵
  PID:6916
- C:\Windows\System\oFrKVqr.exe
  C:\Windows\System\oFrKVqr.exe
  2⤵
  PID:7128
- C:\Windows\System\zuxLKil.exe
  C:\Windows\System\zuxLKil.exe
  2⤵
  PID:6588
- C:\Windows\System\BqWglUx.exe
  C:\Windows\System\BqWglUx.exe
  2⤵
  PID:6780
- C:\Windows\System\GgYzBie.exe
  C:\Windows\System\GgYzBie.exe
  2⤵
  PID:7068
- C:\Windows\System\xZbrJtZ.exe
  C:\Windows\System\xZbrJtZ.exe
  2⤵
  PID:6964
- C:\Windows\System\BZbnLUn.exe
  C:\Windows\System\BZbnLUn.exe
  2⤵
  PID:6040
- C:\Windows\System\okNdYPJ.exe
  C:\Windows\System\okNdYPJ.exe
  2⤵
  PID:7140
- C:\Windows\System\IHOPkxv.exe
  C:\Windows\System\IHOPkxv.exe
  2⤵
  PID:6540
- C:\Windows\System\CcXxqwd.exe
  C:\Windows\System\CcXxqwd.exe
  2⤵
  PID:7156
- C:\Windows\System\iPbYQmq.exe
  C:\Windows\System\iPbYQmq.exe
  2⤵
  PID:6560
- C:\Windows\System\mPMQbcj.exe
  C:\Windows\System\mPMQbcj.exe
  2⤵
  PID:6376
- C:\Windows\System\qmNBHMQ.exe
  C:\Windows\System\qmNBHMQ.exe
  2⤵
  PID:6448
- C:\Windows\System\BADDiex.exe
  C:\Windows\System\BADDiex.exe
  2⤵
  PID:6496
- C:\Windows\System\noYeJOD.exe
  C:\Windows\System\noYeJOD.exe
  2⤵
  PID:6596
- C:\Windows\System\YYQzNor.exe
  C:\Windows\System\YYQzNor.exe
  2⤵
  PID:6700
- C:\Windows\System\qHcesKK.exe
  C:\Windows\System\qHcesKK.exe
  2⤵
  PID:6712
- C:\Windows\System\lRWFhRy.exe
  C:\Windows\System\lRWFhRy.exe
  2⤵
  PID:6848
- C:\Windows\System\ELjQVvu.exe
  C:\Windows\System\ELjQVvu.exe
  2⤵
  PID:6200
- C:\Windows\System\OBtghpE.exe
  C:\Windows\System\OBtghpE.exe
  2⤵
  PID:6140
- C:\Windows\System\ZhfZOsz.exe
  C:\Windows\System\ZhfZOsz.exe
  2⤵
  PID:6632
- C:\Windows\System\IdcHgND.exe
  C:\Windows\System\IdcHgND.exe
  2⤵
  PID:7180
- C:\Windows\System\mKujxwY.exe
  C:\Windows\System\mKujxwY.exe
  2⤵
  PID:7200
- C:\Windows\System\HYBKKTS.exe
  C:\Windows\System\HYBKKTS.exe
  2⤵
  PID:7216
- C:\Windows\System\vhzDgmv.exe
  C:\Windows\System\vhzDgmv.exe
  2⤵
  PID:7260
- C:\Windows\System\soFHtAG.exe
  C:\Windows\System\soFHtAG.exe
  2⤵
  PID:7276
- C:\Windows\System\rLgszSp.exe
  C:\Windows\System\rLgszSp.exe
  2⤵
  PID:7300
- C:\Windows\System\myngOxo.exe
  C:\Windows\System\myngOxo.exe
  2⤵
  PID:7320
- C:\Windows\System\AWKzSGu.exe
  C:\Windows\System\AWKzSGu.exe
  2⤵
  PID:7336
- C:\Windows\System\LyBgNaU.exe
  C:\Windows\System\LyBgNaU.exe
  2⤵
  PID:7352
- C:\Windows\System\uSgoaYJ.exe
  C:\Windows\System\uSgoaYJ.exe
  2⤵
  PID:7368
- C:\Windows\System\LTsvSyo.exe
  C:\Windows\System\LTsvSyo.exe
  2⤵
  PID:7384
- C:\Windows\System\adUigdw.exe
  C:\Windows\System\adUigdw.exe
  2⤵
  PID:7400
- C:\Windows\System\WzjtSjr.exe
  C:\Windows\System\WzjtSjr.exe
  2⤵
  PID:7416
- C:\Windows\System\SuEyrhg.exe
  C:\Windows\System\SuEyrhg.exe
  2⤵
  PID:7432
- C:\Windows\System\OgRkpDS.exe
  C:\Windows\System\OgRkpDS.exe
  2⤵
  PID:7448
- C:\Windows\System\FbURwKC.exe
  C:\Windows\System\FbURwKC.exe
  2⤵
  PID:7464
- C:\Windows\System\xubFqkd.exe
  C:\Windows\System\xubFqkd.exe
  2⤵
  PID:7484
- C:\Windows\System\avkuaVS.exe
  C:\Windows\System\avkuaVS.exe
  2⤵
  PID:7500
- C:\Windows\System\gTiEYWD.exe
  C:\Windows\System\gTiEYWD.exe
  2⤵
  PID:7516
- C:\Windows\System\BjJpbrS.exe
  C:\Windows\System\BjJpbrS.exe
  2⤵
  PID:7532
- C:\Windows\System\nGLswrH.exe
  C:\Windows\System\nGLswrH.exe
  2⤵
  PID:7552
- C:\Windows\System\Odjvlcu.exe
  C:\Windows\System\Odjvlcu.exe
  2⤵
  PID:7568
- C:\Windows\System\ARXpazW.exe
  C:\Windows\System\ARXpazW.exe
  2⤵
  PID:7588
- C:\Windows\System\XUwItQg.exe
  C:\Windows\System\XUwItQg.exe
  2⤵
  PID:7604
- C:\Windows\System\ozcvhwe.exe
  C:\Windows\System\ozcvhwe.exe
  2⤵
  PID:7620
- C:\Windows\System\lSviSBz.exe
  C:\Windows\System\lSviSBz.exe
  2⤵
  PID:7636
- C:\Windows\System\fmGToLC.exe
  C:\Windows\System\fmGToLC.exe
  2⤵
  PID:7652
- C:\Windows\System\ZyOHHJQ.exe
  C:\Windows\System\ZyOHHJQ.exe
  2⤵
  PID:7668
- C:\Windows\System\ifsGNjk.exe
  C:\Windows\System\ifsGNjk.exe
  2⤵
  PID:7688
- C:\Windows\System\oyekbHt.exe
  C:\Windows\System\oyekbHt.exe
  2⤵
  PID:7704
- C:\Windows\System\zlYYZoX.exe
  C:\Windows\System\zlYYZoX.exe
  2⤵
  PID:7720
- C:\Windows\System\sEcEJpu.exe
  C:\Windows\System\sEcEJpu.exe
  2⤵
  PID:7736
- C:\Windows\System\AymJsxV.exe
  C:\Windows\System\AymJsxV.exe
  2⤵
  PID:7752
- C:\Windows\System\cOLisUp.exe
  C:\Windows\System\cOLisUp.exe
  2⤵
  PID:7768
- C:\Windows\System\dWYwHQz.exe
  C:\Windows\System\dWYwHQz.exe
  2⤵
  PID:7784
- C:\Windows\System\mNbXRtF.exe
  C:\Windows\System\mNbXRtF.exe
  2⤵
  PID:7800
- C:\Windows\System\QGXWpZm.exe
  C:\Windows\System\QGXWpZm.exe
  2⤵
  PID:7816
- C:\Windows\System\IKSVgDw.exe
  C:\Windows\System\IKSVgDw.exe
  2⤵
  PID:7832
- C:\Windows\System\zegtjAH.exe
  C:\Windows\System\zegtjAH.exe
  2⤵
  PID:7848
- C:\Windows\System\soXKSMa.exe
  C:\Windows\System\soXKSMa.exe
  2⤵
  PID:7864
- C:\Windows\System\oxZHeKp.exe
  C:\Windows\System\oxZHeKp.exe
  2⤵
  PID:7880
- C:\Windows\System\fdlIuaI.exe
  C:\Windows\System\fdlIuaI.exe
  2⤵
  PID:7896
- C:\Windows\System\JWdpKIv.exe
  C:\Windows\System\JWdpKIv.exe
  2⤵
  PID:7912
- C:\Windows\System\oydDtMB.exe
  C:\Windows\System\oydDtMB.exe
  2⤵
  PID:7928
- C:\Windows\System\JkmXnhQ.exe
  C:\Windows\System\JkmXnhQ.exe
  2⤵
  PID:7944
- C:\Windows\System\ouJkVtO.exe
  C:\Windows\System\ouJkVtO.exe
  2⤵
  PID:7960
- C:\Windows\System\xeBZmye.exe
  C:\Windows\System\xeBZmye.exe
  2⤵
  PID:7976
- C:\Windows\System\huvQkGk.exe
  C:\Windows\System\huvQkGk.exe
  2⤵
  PID:7992
- C:\Windows\System\heFSYaY.exe
  C:\Windows\System\heFSYaY.exe
  2⤵
  PID:8008
- C:\Windows\System\jIdYMIH.exe
  C:\Windows\System\jIdYMIH.exe
  2⤵
  PID:8024
- C:\Windows\System\sRdvPlJ.exe
  C:\Windows\System\sRdvPlJ.exe
  2⤵
  PID:8040
- C:\Windows\System\twYwUJU.exe
  C:\Windows\System\twYwUJU.exe
  2⤵
  PID:8056
- C:\Windows\System\oYZKFqV.exe
  C:\Windows\System\oYZKFqV.exe
  2⤵
  PID:8072
- C:\Windows\System\vsyoWnr.exe
  C:\Windows\System\vsyoWnr.exe
  2⤵
  PID:8092
- C:\Windows\System\RggHvqG.exe
  C:\Windows\System\RggHvqG.exe
  2⤵
  PID:8108
- C:\Windows\System\XnidIia.exe
  C:\Windows\System\XnidIia.exe
  2⤵
  PID:8124
- C:\Windows\System\hEehigy.exe
  C:\Windows\System\hEehigy.exe
  2⤵
  PID:8140
- C:\Windows\System\fhtNjVv.exe
  C:\Windows\System\fhtNjVv.exe
  2⤵
  PID:8156
- C:\Windows\System\fAjRPKD.exe
  C:\Windows\System\fAjRPKD.exe
  2⤵
  PID:8172
- C:\Windows\System\bubSfeW.exe
  C:\Windows\System\bubSfeW.exe
  2⤵
  PID:8188
- C:\Windows\System\uhPsSZS.exe
  C:\Windows\System\uhPsSZS.exe
  2⤵
  PID:6368
- C:\Windows\System\irTPzaE.exe
  C:\Windows\System\irTPzaE.exe
  2⤵
  PID:7024
- C:\Windows\System\xrOXYsm.exe
  C:\Windows\System\xrOXYsm.exe
  2⤵
  PID:6832
- C:\Windows\System\uIepeit.exe
  C:\Windows\System\uIepeit.exe
  2⤵
  PID:6828
- C:\Windows\System\GXHhQDZ.exe
  C:\Windows\System\GXHhQDZ.exe
  2⤵
  PID:6472
- C:\Windows\System\sCxBYpZ.exe
  C:\Windows\System\sCxBYpZ.exe
  2⤵
  PID:7232
- C:\Windows\System\BxsJNuE.exe
  C:\Windows\System\BxsJNuE.exe
  2⤵
  PID:7268
- C:\Windows\System\zbOyhaF.exe
  C:\Windows\System\zbOyhaF.exe
  2⤵
  PID:7316
- C:\Windows\System\NfQRBBt.exe
  C:\Windows\System\NfQRBBt.exe
  2⤵
  PID:7020
- C:\Windows\System\gySRTrb.exe
  C:\Windows\System\gySRTrb.exe
  2⤵
  PID:7408
- C:\Windows\System\GBOKJlZ.exe
  C:\Windows\System\GBOKJlZ.exe
  2⤵
  PID:6384
- C:\Windows\System\lGIOVrg.exe
  C:\Windows\System\lGIOVrg.exe
  2⤵
  PID:7412
- C:\Windows\System\FjkrFZz.exe
  C:\Windows\System\FjkrFZz.exe
  2⤵
  PID:7472
- C:\Windows\System\hPOINIt.exe
  C:\Windows\System\hPOINIt.exe
  2⤵
  PID:7480
- C:\Windows\System\lffLgVP.exe
  C:\Windows\System\lffLgVP.exe
  2⤵
  PID:6524
- C:\Windows\System\cRyFfPh.exe
  C:\Windows\System\cRyFfPh.exe
  2⤵
  PID:7540
- C:\Windows\System\pytkLCa.exe
  C:\Windows\System\pytkLCa.exe
  2⤵
  PID:7292
- C:\Windows\System\fcFRbKD.exe
  C:\Windows\System\fcFRbKD.exe
  2⤵
  PID:7332
- C:\Windows\System\nMbDZRq.exe
  C:\Windows\System\nMbDZRq.exe
  2⤵
  PID:7284
- C:\Windows\System\GpuFrfp.exe
  C:\Windows\System\GpuFrfp.exe
  2⤵
  PID:7360
- C:\Windows\System\bnlbdik.exe
  C:\Windows\System\bnlbdik.exe
  2⤵
  PID:7492
- C:\Windows\System\GeUpxZd.exe
  C:\Windows\System\GeUpxZd.exe
  2⤵
  PID:7560
- C:\Windows\System\JrzDtDV.exe
  C:\Windows\System\JrzDtDV.exe
  2⤵
  PID:7616
- C:\Windows\System\HjYspjS.exe
  C:\Windows\System\HjYspjS.exe
  2⤵
  PID:7680
- C:\Windows\System\VPlKQfw.exe
  C:\Windows\System\VPlKQfw.exe
  2⤵
  PID:7744
- C:\Windows\System\NuJHOqX.exe
  C:\Windows\System\NuJHOqX.exe
  2⤵
  PID:7780
- C:\Windows\System\CYfjffr.exe
  C:\Windows\System\CYfjffr.exe
  2⤵
  PID:7844
- C:\Windows\System\ZrZgwtw.exe
  C:\Windows\System\ZrZgwtw.exe
  2⤵
  PID:7792
- C:\Windows\System\hqQhnKZ.exe
  C:\Windows\System\hqQhnKZ.exe
  2⤵
  PID:7856
- C:\Windows\System\ZEIlZnU.exe
  C:\Windows\System\ZEIlZnU.exe
  2⤵
  PID:7700
- C:\Windows\System\dhsURKe.exe
  C:\Windows\System\dhsURKe.exe
  2⤵
  PID:7888
- C:\Windows\System\BTRryIR.exe
  C:\Windows\System\BTRryIR.exe
  2⤵
  PID:7920
- C:\Windows\System\omQqlPw.exe
  C:\Windows\System\omQqlPw.exe
  2⤵
  PID:8000
- C:\Windows\System\PQuAyNB.exe
  C:\Windows\System\PQuAyNB.exe
  2⤵
  PID:7984
- C:\Windows\System\zqXdbbn.exe
  C:\Windows\System\zqXdbbn.exe
  2⤵
  PID:8120
- C:\Windows\System\kHqmoVI.exe
  C:\Windows\System\kHqmoVI.exe
  2⤵
  PID:6764
- C:\Windows\System\QYUODNj.exe
  C:\Windows\System\QYUODNj.exe
  2⤵
  PID:7028
- C:\Windows\System\DCEyiWc.exe
  C:\Windows\System\DCEyiWc.exe
  2⤵
  PID:7228
- C:\Windows\System\jyhcoxn.exe
  C:\Windows\System\jyhcoxn.exe
  2⤵
  PID:7240
- C:\Windows\System\YKQolqS.exe
  C:\Windows\System\YKQolqS.exe
  2⤵
  PID:7248
- C:\Windows\System\EHRwWVC.exe
  C:\Windows\System\EHRwWVC.exe
  2⤵
  PID:6556
- C:\Windows\System\PdDBcti.exe
  C:\Windows\System\PdDBcti.exe
  2⤵
  PID:7224
- C:\Windows\System\HffKYWJ.exe
  C:\Windows\System\HffKYWJ.exe
  2⤵
  PID:7296
- C:\Windows\System\xifCXAO.exe
  C:\Windows\System\xifCXAO.exe
  2⤵
  PID:7596
- C:\Windows\System\KkRHrka.exe
  C:\Windows\System\KkRHrka.exe
  2⤵
  PID:8136
- C:\Windows\System\VHnshAt.exe
  C:\Windows\System\VHnshAt.exe
  2⤵
  PID:8164
- C:\Windows\System\lDzNsdG.exe
  C:\Windows\System\lDzNsdG.exe
  2⤵
  PID:6336
- C:\Windows\System\JXPiARY.exe
  C:\Windows\System\JXPiARY.exe
  2⤵
  PID:8080
- C:\Windows\System\RFmbTwq.exe
  C:\Windows\System\RFmbTwq.exe
  2⤵
  PID:6216
- C:\Windows\System\VLfceNP.exe
  C:\Windows\System\VLfceNP.exe
  2⤵
  PID:7512
- C:\Windows\System\ntpdwZy.exe
  C:\Windows\System\ntpdwZy.exe
  2⤵
  PID:7712
- C:\Windows\System\oMgLuZz.exe
  C:\Windows\System\oMgLuZz.exe
  2⤵
  PID:7188
- C:\Windows\System\pzmXDxo.exe
  C:\Windows\System\pzmXDxo.exe
  2⤵
  PID:6312
- C:\Windows\System\lymAJwp.exe
  C:\Windows\System\lymAJwp.exe
  2⤵
  PID:8180
- C:\Windows\System\qvEHJVN.exe
  C:\Windows\System\qvEHJVN.exe
  2⤵
  PID:7288
- C:\Windows\System\MLBhMpz.exe
  C:\Windows\System\MLBhMpz.exe
  2⤵
  PID:7840
- C:\Windows\System\tujcpwH.exe
  C:\Windows\System\tujcpwH.exe
  2⤵
  PID:7528
- C:\Windows\System\sMXHeyR.exe
  C:\Windows\System\sMXHeyR.exe
  2⤵
  PID:7924
- C:\Windows\System\nocRERI.exe
  C:\Windows\System\nocRERI.exe
  2⤵
  PID:8064
- C:\Windows\System\qwtekGg.exe
  C:\Windows\System\qwtekGg.exe
  2⤵
  PID:7876
- C:\Windows\System\zdPYRVz.exe
  C:\Windows\System\zdPYRVz.exe
  2⤵
  PID:7660
- C:\Windows\System\KMxQOim.exe
  C:\Windows\System\KMxQOim.exe
  2⤵
  PID:7872
- C:\Windows\System\MTYRXaH.exe
  C:\Windows\System\MTYRXaH.exe
  2⤵
  PID:7908
- C:\Windows\System\nouOYKA.exe
  C:\Windows\System\nouOYKA.exe
  2⤵
  PID:8088
- C:\Windows\System\uzJGcdF.exe
  C:\Windows\System\uzJGcdF.exe
  2⤵
  PID:8084
- C:\Windows\System\ccEwgrP.exe
  C:\Windows\System\ccEwgrP.exe
  2⤵
  PID:7236
- C:\Windows\System\bKbOltq.exe
  C:\Windows\System\bKbOltq.exe
  2⤵
  PID:7196
- C:\Windows\System\EQnrRuX.exe
  C:\Windows\System\EQnrRuX.exe
  2⤵
  PID:7524
- C:\Windows\System\sZlEXUI.exe
  C:\Windows\System\sZlEXUI.exe
  2⤵
  PID:7824
- C:\Windows\System\tRpoEyv.exe
  C:\Windows\System\tRpoEyv.exe
  2⤵
  PID:8152
- C:\Windows\System\kIayTei.exe
  C:\Windows\System\kIayTei.exe
  2⤵
  PID:7776
- C:\Windows\System\uraZgQA.exe
  C:\Windows\System\uraZgQA.exe
  2⤵
  PID:8052
- C:\Windows\System\dxfEicO.exe
  C:\Windows\System\dxfEicO.exe
  2⤵
  PID:7428
- C:\Windows\System\CeusrGh.exe
  C:\Windows\System\CeusrGh.exe
  2⤵
  PID:7732
- C:\Windows\System\lHZvaGf.exe
  C:\Windows\System\lHZvaGf.exe
  2⤵
  PID:7244
- C:\Windows\System\nxEqLOO.exe
  C:\Windows\System\nxEqLOO.exe
  2⤵
  PID:8036
- C:\Windows\System\EUlgELS.exe
  C:\Windows\System\EUlgELS.exe
  2⤵
  PID:7376
- C:\Windows\System\viIouEb.exe
  C:\Windows\System\viIouEb.exe
  2⤵
  PID:7444
- C:\Windows\System\BooeWDK.exe
  C:\Windows\System\BooeWDK.exe
  2⤵
  PID:7380
- C:\Windows\System\RwMnyJF.exe
  C:\Windows\System\RwMnyJF.exe
  2⤵
  PID:8048
- C:\Windows\System\rjeWWBc.exe
  C:\Windows\System\rjeWWBc.exe
  2⤵
  PID:7988
- C:\Windows\System\KvERCqh.exe
  C:\Windows\System\KvERCqh.exe
  2⤵
  PID:8212
- C:\Windows\System\LnAVyZh.exe
  C:\Windows\System\LnAVyZh.exe
  2⤵
  PID:8232
- C:\Windows\System\UkxfBTL.exe
  C:\Windows\System\UkxfBTL.exe
  2⤵
  PID:8256
- C:\Windows\System\qZMCXKf.exe
  C:\Windows\System\qZMCXKf.exe
  2⤵
  PID:8272
- C:\Windows\System\ELYXZWO.exe
  C:\Windows\System\ELYXZWO.exe
  2⤵
  PID:8304
- C:\Windows\System\HzzjYSr.exe
  C:\Windows\System\HzzjYSr.exe
  2⤵
  PID:8324
- C:\Windows\System\MqczMHE.exe
  C:\Windows\System\MqczMHE.exe
  2⤵
  PID:8340
- C:\Windows\System\SWzHETX.exe
  C:\Windows\System\SWzHETX.exe
  2⤵
  PID:8360
- C:\Windows\System\djhEODw.exe
  C:\Windows\System\djhEODw.exe
  2⤵
  PID:8376
- C:\Windows\System\UdDdhwV.exe
  C:\Windows\System\UdDdhwV.exe
  2⤵
  PID:8396
- C:\Windows\System\UnBuxBY.exe
  C:\Windows\System\UnBuxBY.exe
  2⤵
  PID:8412
- C:\Windows\System\sWKZwPc.exe
  C:\Windows\System\sWKZwPc.exe
  2⤵
  PID:8428
- C:\Windows\System\QllAxqI.exe
  C:\Windows\System\QllAxqI.exe
  2⤵
  PID:8444
- C:\Windows\System\ROYfyHV.exe
  C:\Windows\System\ROYfyHV.exe
  2⤵
  PID:8460
- C:\Windows\System\ZhVbPmM.exe
  C:\Windows\System\ZhVbPmM.exe
  2⤵
  PID:8476
- C:\Windows\System\SYTaFUq.exe
  C:\Windows\System\SYTaFUq.exe
  2⤵
  PID:8492
- C:\Windows\System\ezFhFSe.exe
  C:\Windows\System\ezFhFSe.exe
  2⤵
  PID:8508
- C:\Windows\System\nBDVGca.exe
  C:\Windows\System\nBDVGca.exe
  2⤵
  PID:8524
- C:\Windows\System\MvOjXvC.exe
  C:\Windows\System\MvOjXvC.exe
  2⤵
  PID:8540
- C:\Windows\System\yLILWPu.exe
  C:\Windows\System\yLILWPu.exe
  2⤵
  PID:8556
- C:\Windows\System\qgenMHC.exe
  C:\Windows\System\qgenMHC.exe
  2⤵
  PID:8572
- C:\Windows\System\OiYyzdT.exe
  C:\Windows\System\OiYyzdT.exe
  2⤵
  PID:8588
- C:\Windows\System\ZhOxWso.exe
  C:\Windows\System\ZhOxWso.exe
  2⤵
  PID:8604
- C:\Windows\System\QGUnsqx.exe
  C:\Windows\System\QGUnsqx.exe
  2⤵
  PID:8620
- C:\Windows\System\EeiCDxs.exe
  C:\Windows\System\EeiCDxs.exe
  2⤵
  PID:8636
- C:\Windows\System\RKOfFtF.exe
  C:\Windows\System\RKOfFtF.exe
  2⤵
  PID:8652
- C:\Windows\System\EMwzzbK.exe
  C:\Windows\System\EMwzzbK.exe
  2⤵
  PID:8668
- C:\Windows\System\GTfZDtz.exe
  C:\Windows\System\GTfZDtz.exe
  2⤵
  PID:8684
- C:\Windows\System\vgREGzc.exe
  C:\Windows\System\vgREGzc.exe
  2⤵
  PID:8700
- C:\Windows\System\HIHCBAZ.exe
  C:\Windows\System\HIHCBAZ.exe
  2⤵
  PID:8716
- C:\Windows\System\qoWJdKc.exe
  C:\Windows\System\qoWJdKc.exe
  2⤵
  PID:8732
- C:\Windows\System\tqdTkIb.exe
  C:\Windows\System\tqdTkIb.exe
  2⤵
  PID:8748
- C:\Windows\System\YgTFnhr.exe
  C:\Windows\System\YgTFnhr.exe
  2⤵
  PID:8764
- C:\Windows\System\djwOQNP.exe
  C:\Windows\System\djwOQNP.exe
  2⤵
  PID:8780
- C:\Windows\System\lPnwfvO.exe
  C:\Windows\System\lPnwfvO.exe
  2⤵
  PID:8796
- C:\Windows\System\uVohJnP.exe
  C:\Windows\System\uVohJnP.exe
  2⤵
  PID:8812
- C:\Windows\System\ZnkBwFF.exe
  C:\Windows\System\ZnkBwFF.exe
  2⤵
  PID:8828
- C:\Windows\System\UucYygi.exe
  C:\Windows\System\UucYygi.exe
  2⤵
  PID:8844
- C:\Windows\System\bxbiaqw.exe
  C:\Windows\System\bxbiaqw.exe
  2⤵
  PID:8860
- C:\Windows\System\qfYJuzj.exe
  C:\Windows\System\qfYJuzj.exe
  2⤵
  PID:8876
- C:\Windows\System\HKCOaEa.exe
  C:\Windows\System\HKCOaEa.exe
  2⤵
  PID:8892
- C:\Windows\System\Nbkzbcb.exe
  C:\Windows\System\Nbkzbcb.exe
  2⤵
  PID:8908
- C:\Windows\System\uvSMYFi.exe
  C:\Windows\System\uvSMYFi.exe
  2⤵
  PID:8924
- C:\Windows\System\aLSMbhs.exe
  C:\Windows\System\aLSMbhs.exe
  2⤵
  PID:8940
- C:\Windows\System\ZjyGWXP.exe
  C:\Windows\System\ZjyGWXP.exe
  2⤵
  PID:8956
- C:\Windows\System\aEjqvdO.exe
  C:\Windows\System\aEjqvdO.exe
  2⤵
  PID:8972
- C:\Windows\System\uwxBBLM.exe
  C:\Windows\System\uwxBBLM.exe
  2⤵
  PID:8988
- C:\Windows\System\FIKsrLO.exe
  C:\Windows\System\FIKsrLO.exe
  2⤵
  PID:9004
- C:\Windows\System\ldMzhka.exe
  C:\Windows\System\ldMzhka.exe
  2⤵
  PID:9020
- C:\Windows\System\kNtkLFM.exe
  C:\Windows\System\kNtkLFM.exe
  2⤵
  PID:9036
- C:\Windows\System\PsXiHql.exe
  C:\Windows\System\PsXiHql.exe
  2⤵
  PID:9052
- C:\Windows\System\EUwlRXq.exe
  C:\Windows\System\EUwlRXq.exe
  2⤵
  PID:9068
- C:\Windows\System\hKtehlc.exe
  C:\Windows\System\hKtehlc.exe
  2⤵
  PID:9084
- C:\Windows\System\HqyJgeo.exe
  C:\Windows\System\HqyJgeo.exe
  2⤵
  PID:9100
- C:\Windows\System\oZxjwWq.exe
  C:\Windows\System\oZxjwWq.exe
  2⤵
  PID:9116
- C:\Windows\System\VFtypHK.exe
  C:\Windows\System\VFtypHK.exe
  2⤵
  PID:9132
- C:\Windows\System\NTjIFLr.exe
  C:\Windows\System\NTjIFLr.exe
  2⤵
  PID:9148
- C:\Windows\System\vDoocrJ.exe
  C:\Windows\System\vDoocrJ.exe
  2⤵
  PID:9164
- C:\Windows\System\yeTotEY.exe
  C:\Windows\System\yeTotEY.exe
  2⤵
  PID:9180
- C:\Windows\System\EefWuIF.exe
  C:\Windows\System\EefWuIF.exe
  2⤵
  PID:9196
- C:\Windows\System\kgGrXZD.exe
  C:\Windows\System\kgGrXZD.exe
  2⤵
  PID:9212
- C:\Windows\System\dSsdmsE.exe
  C:\Windows\System\dSsdmsE.exe
  2⤵
  PID:7208
- C:\Windows\System\ROLyrNq.exe
  C:\Windows\System\ROLyrNq.exe
  2⤵
  PID:8200
- C:\Windows\System\AyQTZmz.exe
  C:\Windows\System\AyQTZmz.exe
  2⤵
  PID:8224
- C:\Windows\System\JWOfcBZ.exe
  C:\Windows\System\JWOfcBZ.exe
  2⤵
  PID:8264
- C:\Windows\System\uwNrYlZ.exe
  C:\Windows\System\uwNrYlZ.exe
  2⤵
  PID:8320
- C:\Windows\System\gvzTWaa.exe
  C:\Windows\System\gvzTWaa.exe
  2⤵
  PID:8292
- C:\Windows\System\qjCjgtT.exe
  C:\Windows\System\qjCjgtT.exe
  2⤵
  PID:8384
- C:\Windows\System\SzLJLHC.exe
  C:\Windows\System\SzLJLHC.exe
  2⤵
  PID:8336
- C:\Windows\System\aswNDgd.exe
  C:\Windows\System\aswNDgd.exe
  2⤵
  PID:8300
- C:\Windows\System\gbHmAAc.exe
  C:\Windows\System\gbHmAAc.exe
  2⤵
  PID:8456
- C:\Windows\System\ORwweUo.exe
  C:\Windows\System\ORwweUo.exe
  2⤵
  PID:8488
- C:\Windows\System\eNHyqqJ.exe
  C:\Windows\System\eNHyqqJ.exe
  2⤵
  PID:8580
- C:\Windows\System\BhjfMFK.exe
  C:\Windows\System\BhjfMFK.exe
  2⤵
  PID:8648
- C:\Windows\System\xfXJaIg.exe
  C:\Windows\System\xfXJaIg.exe
  2⤵
  PID:8712
- C:\Windows\System\POiSTqL.exe
  C:\Windows\System\POiSTqL.exe
  2⤵
  PID:8500
- C:\Windows\System\uVqaRpm.exe
  C:\Windows\System\uVqaRpm.exe
  2⤵
  PID:8724
- C:\Windows\System\ROGztYV.exe
  C:\Windows\System\ROGztYV.exe
  2⤵
  PID:8440
- C:\Windows\System\PXEClCJ.exe
  C:\Windows\System\PXEClCJ.exe
  2⤵
  PID:8600
- C:\Windows\System\fgDiPBC.exe
  C:\Windows\System\fgDiPBC.exe
  2⤵
  PID:8696
- C:\Windows\System\PeaIjpT.exe
  C:\Windows\System\PeaIjpT.exe
  2⤵
  PID:8776
- C:\Windows\System\yWmhTZv.exe
  C:\Windows\System\yWmhTZv.exe
  2⤵
  PID:8840
- C:\Windows\System\GvRFsjU.exe
  C:\Windows\System\GvRFsjU.exe
  2⤵
  PID:8792
- C:\Windows\System\kibvQAw.exe
  C:\Windows\System\kibvQAw.exe
  2⤵
  PID:8856
- C:\Windows\System\ngsTcSq.exe
  C:\Windows\System\ngsTcSq.exe
  2⤵
  PID:8932
- C:\Windows\System\XIlluQM.exe
  C:\Windows\System\XIlluQM.exe
  2⤵
  PID:8964
- C:\Windows\System\FTcxNOJ.exe
  C:\Windows\System\FTcxNOJ.exe
  2⤵
  PID:8888
- C:\Windows\System\bIfoLri.exe
  C:\Windows\System\bIfoLri.exe
  2⤵
  PID:9000
- C:\Windows\System\dzuxJAW.exe
  C:\Windows\System\dzuxJAW.exe
  2⤵
  PID:9064
- C:\Windows\System\ncacvQf.exe
  C:\Windows\System\ncacvQf.exe
  2⤵
  PID:9124
- C:\Windows\System\knsWlQq.exe
  C:\Windows\System\knsWlQq.exe
  2⤵
  PID:9160
- C:\Windows\System\TkXYzdE.exe
  C:\Windows\System\TkXYzdE.exe
  2⤵
  PID:7392
- C:\Windows\System\QvXrkTh.exe
  C:\Windows\System\QvXrkTh.exe
  2⤵
  PID:9012
- C:\Windows\System\SqapdWk.exe
  C:\Windows\System\SqapdWk.exe
  2⤵
  PID:8372
- C:\Windows\System\JrknCTT.exe
  C:\Windows\System\JrknCTT.exe
  2⤵
  PID:9176
- C:\Windows\System\rBdDiBp.exe
  C:\Windows\System\rBdDiBp.exe
  2⤵
  PID:8284
- C:\Windows\System\kGZDLXR.exe
  C:\Windows\System\kGZDLXR.exe
  2⤵
  PID:9208
- C:\Windows\System\eEsKltD.exe
  C:\Windows\System\eEsKltD.exe
  2⤵
  PID:8240
- C:\Windows\System\bjoeUDZ.exe
  C:\Windows\System\bjoeUDZ.exe
  2⤵
  PID:8252
- C:\Windows\System\JDNNdfW.exe
  C:\Windows\System\JDNNdfW.exe
  2⤵
  PID:8616
- C:\Windows\System\UqiYgjT.exe
  C:\Windows\System\UqiYgjT.exe
  2⤵
  PID:8708
- C:\Windows\System\ApvfDdW.exe
  C:\Windows\System\ApvfDdW.exe
  2⤵
  PID:8532
- C:\Windows\System\ANxWsHP.exe
  C:\Windows\System\ANxWsHP.exe
  2⤵
  PID:8664
- C:\Windows\System\ZzWSQOZ.exe
  C:\Windows\System\ZzWSQOZ.exe
  2⤵
  PID:8836
- C:\Windows\System\fobYRtz.exe
  C:\Windows\System\fobYRtz.exe
  2⤵
  PID:8772
- C:\Windows\System\lEUVbTp.exe
  C:\Windows\System\lEUVbTp.exe
  2⤵
  PID:8868
- C:\Windows\System\mxJJiDk.exe
  C:\Windows\System\mxJJiDk.exe
  2⤵
  PID:8760
- C:\Windows\System\uJDPkkx.exe
  C:\Windows\System\uJDPkkx.exe
  2⤵
  PID:9096
- C:\Windows\System\CHYAncN.exe
  C:\Windows\System\CHYAncN.exe
  2⤵
  PID:9192
- C:\Windows\System\tNQWmPX.exe
  C:\Windows\System\tNQWmPX.exe
  2⤵
  PID:8948
- C:\Windows\System\YyFYcNT.exe
  C:\Windows\System\YyFYcNT.exe
  2⤵
  PID:9108
- C:\Windows\System\ncEFIgC.exe
  C:\Windows\System\ncEFIgC.exe
  2⤵
  PID:8280
- C:\Windows\System\GDeKcKG.exe
  C:\Windows\System\GDeKcKG.exe
  2⤵
  PID:8420
- C:\Windows\System\BKyuyTA.exe
  C:\Windows\System\BKyuyTA.exe
  2⤵
  PID:8740
- C:\Windows\System\AwUHQfj.exe
  C:\Windows\System\AwUHQfj.exe
  2⤵
  PID:8568
- C:\Windows\System\dEhjTJV.exe
  C:\Windows\System\dEhjTJV.exe
  2⤵
  PID:9032
- C:\Windows\System\sekIHQr.exe
  C:\Windows\System\sekIHQr.exe
  2⤵
  PID:8424
- C:\Windows\System\sGwNcoG.exe
  C:\Windows\System\sGwNcoG.exe
  2⤵
  PID:9220
- C:\Windows\System\WrZJdIK.exe
  C:\Windows\System\WrZJdIK.exe
  2⤵
  PID:9236
- C:\Windows\System\bRgnFqE.exe
  C:\Windows\System\bRgnFqE.exe
  2⤵
  PID:9252
- C:\Windows\System\xQLmnUG.exe
  C:\Windows\System\xQLmnUG.exe
  2⤵
  PID:9268
- C:\Windows\System\QCPIrZE.exe
  C:\Windows\System\QCPIrZE.exe
  2⤵
  PID:9284
- C:\Windows\System\GvbMxUG.exe
  C:\Windows\System\GvbMxUG.exe
  2⤵
  PID:9300
- C:\Windows\System\JwkGnvJ.exe
  C:\Windows\System\JwkGnvJ.exe
  2⤵
  PID:9316
- C:\Windows\System\tYgimfS.exe
  C:\Windows\System\tYgimfS.exe
  2⤵
  PID:9332
- C:\Windows\System\mIGPyDM.exe
  C:\Windows\System\mIGPyDM.exe
  2⤵
  PID:9348
- C:\Windows\System\QuFkBde.exe
  C:\Windows\System\QuFkBde.exe
  2⤵
  PID:9364
- C:\Windows\System\cZRVWzd.exe
  C:\Windows\System\cZRVWzd.exe
  2⤵
  PID:9380
- C:\Windows\System\mqdCGfg.exe
  C:\Windows\System\mqdCGfg.exe
  2⤵
  PID:9396
- C:\Windows\System\kbTZXBI.exe
  C:\Windows\System\kbTZXBI.exe
  2⤵
  PID:9412
- C:\Windows\System\UrbICsV.exe
  C:\Windows\System\UrbICsV.exe
  2⤵
  PID:9428
- C:\Windows\System\fSuKgTi.exe
  C:\Windows\System\fSuKgTi.exe
  2⤵
  PID:9444
- C:\Windows\System\PKPbJVv.exe
  C:\Windows\System\PKPbJVv.exe
  2⤵
  PID:9460
- C:\Windows\System\KyEAJVr.exe
  C:\Windows\System\KyEAJVr.exe
  2⤵
  PID:9476
- C:\Windows\System\HLHwJqG.exe
  C:\Windows\System\HLHwJqG.exe
  2⤵
  PID:9492
- C:\Windows\System\Jxmpdiv.exe
  C:\Windows\System\Jxmpdiv.exe
  2⤵
  PID:9508
- C:\Windows\System\RffLckn.exe
  C:\Windows\System\RffLckn.exe
  2⤵
  PID:9524
- C:\Windows\System\hsctcbM.exe
  C:\Windows\System\hsctcbM.exe
  2⤵
  PID:9632
- C:\Windows\System\yVzHTpU.exe
  C:\Windows\System\yVzHTpU.exe
  2⤵
  PID:9648
- C:\Windows\System\oyRWmvm.exe
  C:\Windows\System\oyRWmvm.exe
  2⤵
  PID:9664
- C:\Windows\System\DvfgzhC.exe
  C:\Windows\System\DvfgzhC.exe
  2⤵
  PID:9684
- C:\Windows\System\jQSBkem.exe
  C:\Windows\System\jQSBkem.exe
  2⤵
  PID:9700
- C:\Windows\System\drcxgaM.exe
  C:\Windows\System\drcxgaM.exe
  2⤵
  PID:9716
- C:\Windows\System\TXfFOnd.exe
  C:\Windows\System\TXfFOnd.exe
  2⤵
  PID:9732
- C:\Windows\System\pPwlcbx.exe
  C:\Windows\System\pPwlcbx.exe
  2⤵
  PID:9748
- C:\Windows\System\IfCxkDf.exe
  C:\Windows\System\IfCxkDf.exe
  2⤵
  PID:9764
- C:\Windows\System\ZUpohyq.exe
  C:\Windows\System\ZUpohyq.exe
  2⤵
  PID:9780
- C:\Windows\System\fyzglPL.exe
  C:\Windows\System\fyzglPL.exe
  2⤵
  PID:9796
- C:\Windows\System\YPiKYFf.exe
  C:\Windows\System\YPiKYFf.exe
  2⤵
  PID:9816
- C:\Windows\System\QxIqntA.exe
  C:\Windows\System\QxIqntA.exe
  2⤵
  PID:9832
- C:\Windows\System\ToZZoJA.exe
  C:\Windows\System\ToZZoJA.exe
  2⤵
  PID:9852
- C:\Windows\System\JYKSbtg.exe
  C:\Windows\System\JYKSbtg.exe
  2⤵
  PID:9872
- C:\Windows\System\QcxyzWJ.exe
  C:\Windows\System\QcxyzWJ.exe
  2⤵
  PID:9892
- C:\Windows\System\LwtIXcH.exe
  C:\Windows\System\LwtIXcH.exe
  2⤵
  PID:9908
- C:\Windows\System\YqtXrgz.exe
  C:\Windows\System\YqtXrgz.exe
  2⤵
  PID:9924
- C:\Windows\System\QoJASki.exe
  C:\Windows\System\QoJASki.exe
  2⤵
  PID:9940
- C:\Windows\System\EsRujrV.exe
  C:\Windows\System\EsRujrV.exe
  2⤵
  PID:9964
- C:\Windows\System\SxLtNin.exe
  C:\Windows\System\SxLtNin.exe
  2⤵
  PID:9980
- C:\Windows\System\QozUIZU.exe
  C:\Windows\System\QozUIZU.exe
  2⤵
  PID:10000
- C:\Windows\System\JudiZiW.exe
  C:\Windows\System\JudiZiW.exe
  2⤵
  PID:10020
- C:\Windows\System\hoyvaMq.exe
  C:\Windows\System\hoyvaMq.exe
  2⤵
  PID:10040
- C:\Windows\System\lyXZjGJ.exe
  C:\Windows\System\lyXZjGJ.exe
  2⤵
  PID:10056
- C:\Windows\System\qjneriU.exe
  C:\Windows\System\qjneriU.exe
  2⤵
  PID:10072
- C:\Windows\System\tLITlmC.exe
  C:\Windows\System\tLITlmC.exe
  2⤵
  PID:10092
- C:\Windows\System\TowoNpA.exe
  C:\Windows\System\TowoNpA.exe
  2⤵
  PID:10108
- C:\Windows\System\xtgTyVa.exe
  C:\Windows\System\xtgTyVa.exe
  2⤵
  PID:10128
- C:\Windows\System\JhHmQxF.exe
  C:\Windows\System\JhHmQxF.exe
  2⤵
  PID:10148
- C:\Windows\System\AJQycTd.exe
  C:\Windows\System\AJQycTd.exe
  2⤵
  PID:10168
- C:\Windows\System\cPrTHEd.exe
  C:\Windows\System\cPrTHEd.exe
  2⤵
  PID:10184
- C:\Windows\System\wBBubnc.exe
  C:\Windows\System\wBBubnc.exe
  2⤵
  PID:9308
- C:\Windows\System\AFubwQb.exe
  C:\Windows\System\AFubwQb.exe
  2⤵
  PID:9376
- C:\Windows\System\jMjjZxv.exe
  C:\Windows\System\jMjjZxv.exe
  2⤵
  PID:8288
- C:\Windows\System\zjJyWKG.exe
  C:\Windows\System\zjJyWKG.exe
  2⤵
  PID:9292
- C:\Windows\System\mPveoHb.exe
  C:\Windows\System\mPveoHb.exe
  2⤵
  PID:8516
- C:\Windows\System\igFzDIf.exe
  C:\Windows\System\igFzDIf.exe
  2⤵
  PID:8352
- C:\Windows\System\BOmytjT.exe
  C:\Windows\System\BOmytjT.exe
  2⤵
  PID:8852
- C:\Windows\System\UtKALop.exe
  C:\Windows\System\UtKALop.exe
  2⤵
  PID:8220
- C:\Windows\System\slELadC.exe
  C:\Windows\System\slELadC.exe
  2⤵
  PID:9264
- C:\Windows\System\JukRcUx.exe
  C:\Windows\System\JukRcUx.exe
  2⤵
  PID:9388
- C:\Windows\System\fMRvniX.exe
  C:\Windows\System\fMRvniX.exe
  2⤵
  PID:9468
- C:\Windows\System\Lcpxfvk.exe
  C:\Windows\System\Lcpxfvk.exe
  2⤵
  PID:9532
- C:\Windows\System\TeNenZx.exe
  C:\Windows\System\TeNenZx.exe
  2⤵
  PID:9392
- C:\Windows\System\WeRnTbE.exe
  C:\Windows\System\WeRnTbE.exe
  2⤵
  PID:9520
- C:\Windows\System\RmjwRvU.exe
  C:\Windows\System\RmjwRvU.exe
  2⤵
  PID:9548
- C:\Windows\System\OqhGEjI.exe
  C:\Windows\System\OqhGEjI.exe
  2⤵
  PID:9860
- C:\Windows\System\swPkLrJ.exe
  C:\Windows\System\swPkLrJ.exe
  2⤵
  PID:9932
- C:\Windows\System\zcWhZjQ.exe
  C:\Windows\System\zcWhZjQ.exe
  2⤵
  PID:10016
- C:\Windows\System\EYXrPYo.exe
  C:\Windows\System\EYXrPYo.exe
  2⤵
  PID:10080
- C:\Windows\System\MPCxZFy.exe
  C:\Windows\System\MPCxZFy.exe
  2⤵
  PID:10164
- C:\Windows\System\tfBqNcT.exe
  C:\Windows\System\tfBqNcT.exe
  2⤵
  PID:10192
- C:\Windows\System\SFcxcxk.exe
  C:\Windows\System\SFcxcxk.exe
  2⤵
  PID:10204
- C:\Windows\System\zmvSjkF.exe
  C:\Windows\System\zmvSjkF.exe
  2⤵
  PID:9708
- C:\Windows\System\vzvTWzP.exe
  C:\Windows\System\vzvTWzP.exe
  2⤵
  PID:10216
- C:\Windows\System\exZSjXB.exe
  C:\Windows\System\exZSjXB.exe
  2⤵
  PID:10028
- C:\Windows\System\KbCTNwQ.exe
  C:\Windows\System\KbCTNwQ.exe
  2⤵
  PID:10136
- C:\Windows\System\qxYWUnS.exe
  C:\Windows\System\qxYWUnS.exe
  2⤵
  PID:9672
- C:\Windows\System\znLcJwe.exe
  C:\Windows\System\znLcJwe.exe
  2⤵
  PID:9740
- C:\Windows\System\oEOuyFO.exe
  C:\Windows\System\oEOuyFO.exe
  2⤵
  PID:9840
- C:\Windows\System\mCLNskf.exe
  C:\Windows\System\mCLNskf.exe
  2⤵
  PID:9888
- C:\Windows\System\TxMhFwc.exe
  C:\Windows\System\TxMhFwc.exe
  2⤵
  PID:9996
- C:\Windows\System\kaiZyBh.exe
  C:\Windows\System\kaiZyBh.exe
  2⤵
  PID:10140
- C:\Windows\System\MOYyBFt.exe
  C:\Windows\System\MOYyBFt.exe
  2⤵
  PID:8900
- C:\Windows\System\teKpiAE.exe
  C:\Windows\System\teKpiAE.exe
  2⤵
  PID:9280
- C:\Windows\System\FkNGAES.exe
  C:\Windows\System\FkNGAES.exe
  2⤵
  PID:8520
- C:\Windows\System\jHZZulw.exe
  C:\Windows\System\jHZZulw.exe
  2⤵
  PID:9356
- C:\Windows\System\CSIppku.exe
  C:\Windows\System\CSIppku.exe
  2⤵
  PID:9500
- C:\Windows\System\KNYflLu.exe
  C:\Windows\System\KNYflLu.exe
  2⤵
  PID:9452
- C:\Windows\System\qRukqKx.exe
  C:\Windows\System\qRukqKx.exe
  2⤵
  PID:9516
- C:\Windows\System\EHOoRUy.exe
  C:\Windows\System\EHOoRUy.exe
  2⤵
  PID:9588
- C:\Windows\System\VSGMvdo.exe
  C:\Windows\System\VSGMvdo.exe
  2⤵
  PID:9572
- C:\Windows\System\BlAZNAo.exe
  C:\Windows\System\BlAZNAo.exe
  2⤵
  PID:9604
- C:\Windows\System\UPqvZFy.exe
  C:\Windows\System\UPqvZFy.exe
  2⤵
  PID:9628
- C:\Windows\System\YtINGxb.exe
  C:\Windows\System\YtINGxb.exe
  2⤵
  PID:9756
- C:\Windows\System\jYNdclE.exe
  C:\Windows\System\jYNdclE.exe
  2⤵
  PID:9696
- C:\Windows\System\WPvxlsp.exe
  C:\Windows\System\WPvxlsp.exe
  2⤵
  PID:10052

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\DoVoFfK.exe

Filesize
1.8MB

MD5
7fd6586ea68288f27795d8d65b0e9490

SHA1
051b8c8407342cd2767642606578a4763c508b7a

SHA256
d0e17e99a5be07497416db50f8135f8dec5f17235ca40e753c5424c42d971bc7

SHA512
815e48d8470ceed77ff6c9b432fcb37fb9e63954dd95ac6e222e198178f9416d3472fbfe9e9ae6117b662383de173531d968ddb71dbcf49f3a11ceb45b996044

Download Submit
C:\Windows\system\JLiRizH.exe

Filesize
1.8MB

MD5
fef24bda44ad694ec3c90e62cb493b03

SHA1
69154c9d5ade6a86a8a7fd98ec97aa495141efce

SHA256
da8936cb3333404356b72e1af109b8dbfc06e08319eb8a7f30675031ed162e75

SHA512
fc5b259845ec218be612dd8bdfe9528b043426dd204d25258db331fa8356772ae54457256ba8c507abf98c7b0c0ea4a39b0d555dfb364dd8a25215515379b76c

Download Submit
C:\Windows\system\JqFlmoc.exe

Filesize
1.8MB

MD5
6000d5121e565cebd9fae630e0162e50

SHA1
d0e16588c41ebc2aa1168f31bd620a4b1b25a58a

SHA256
0c8d2ea09e39c74803c3e7999cb3580dcad5e382897fcd0527c7e3e1dde29df8

SHA512
bda657da2f30909dcb23828de1ec05d18d80c3fa9219d4de2f030f1ecca61e462ff6ba529c5af9e771e3b9449a692cb87e2288a0eb28fb10efddf93b2f25269a

Download Submit
C:\Windows\system\KkAICgR.exe

Filesize
1.8MB

MD5
5762cf3a893afc59a825c76a97e8d51e

SHA1
155a6cdfdf3157fbd81167ef9469cab09234123f

SHA256
a4328633fbab69830bac4b027ec69115049f08c315a955f48faa1bd7e4e722c6

SHA512
52f44f0c84a23893f0ca5b0c8ab65e45245fa2f31074c3352b20be8c18c120f2d8ecd29a273fed566773b63e94613e6a44f29ed8c7b0ea8c8d25dfd6b11d0989

Download Submit
C:\Windows\system\OBiKhDf.exe

Filesize
1.8MB

MD5
69087d072f76df908074acaa99574d87

SHA1
b7e051b4e3ea06dc11eb93d76d974aabb4ee1ecf

SHA256
8da7964cf8a1e903cad29680eac2cb0cb35f1ac53b57f6badefcb876cba0ee98

SHA512
aaa9445d44a7fcfe8848cba909889a203e7a802db28653257dbc36d507baa2f869bae44c0717598565a167f4750ac775d41b737e102831860b6b17a5781f14f8

Download Submit
C:\Windows\system\RzGugdF.exe

Filesize
1.8MB

MD5
e2936c30d3b955f6c45f6509c315730a

SHA1
203fcac93d2019b0e7fb06883ea9aa732cce9f14

SHA256
f5137b8fc48149fa7a0db9f88ef681633edc68ddf5c68ea0fb81b0c4b815ec84

SHA512
ddd1768606b573d871acd6860baf803cd24f833baaa8fa5bf720aadec0ac9a842fec322c71d714f9f371d51c1d5bacfe59c7fc5f34eaa7a8a5e7e3a4dead9a3b

Download Submit
C:\Windows\system\XYfpyPc.exe

Filesize
1.8MB

MD5
8fe4f10f7116654274bf3a4ae8eeca03

SHA1
c56ee2ca47bfbe183effd815433b11d3c3e21c15

SHA256
30397bf1dd80fe5e82276aeebb1fd4e8a99261003086ac274b6a11d52676f2a6

SHA512
f8915e350d0721a7afdec614cf7ba1c37ff8b6851a990da37652a5fcd2fa382af8df125f415c7569587b4da5f09a69cb59ad94dfbfc804fb630d8d9726840d74

Download Submit
C:\Windows\system\YFhRGlX.exe

Filesize
1.8MB

MD5
36084100a43b0853113c8b39f9186a6b

SHA1
e9e71367bdc5d65ee68ac8a11c6ee25812ff92e4

SHA256
548199e7452b6fc55bd18e4b4dac69394afaaa408c8294b4e7a54a72148af50e

SHA512
c15944359df740607209b4eb8773b4dd275ad8668aab6f4c091ebaeebe0bd1c57ddcc4e77e27f0031d37dd14aa2aaf79d348fde1298fad277ee8c89373a46dfa

Download Submit
C:\Windows\system\ZejIdgP.exe

Filesize
1.8MB

MD5
c45f1ab34431e80efda47c31e1ffa3ec

SHA1
fcabd4dd32a0776ec438c753b2f6549796f353e7

SHA256
57557d813e84e19e7c557fa7900908fbf29b7ed33c251519732429731007ce12

SHA512
01530bd990f25255ff93c10fda88b9d369951980f4d220e88cd9d93890a28dc16c170ff8cfbbbdc017c27a7a8f377cec2cd543c67b22727e79b55451cedc1f37

Download Submit
C:\Windows\system\ZjZkueC.exe

Filesize
1.8MB

MD5
acb95d9f8a52df80ade67e9267644872

SHA1
da62598e40886e69fcdcf3709d9264331bc3e28b

SHA256
09f87d7cfec18a69b0627b7d2939b20876b9e4bb1024f83b22c329725b048dbb

SHA512
71e9f511ab3f0d7e659064054bb3f8cc213c53f79fff9932d4a22b153934d477733c4b761fd003a59dacc7e19727199bdf2488b0ef29437a9a8024fa7c4597e9

Download Submit
C:\Windows\system\crYDMod.exe

Filesize
1.8MB

MD5
c45ee15d625e9b00550b183169d6f24f

SHA1
327372c4d651451ca7eeff2f300436df937993f3

SHA256
5881c1d6fb7f291625dfe2ea1fc4877d30cb4e1d0b38f2b5f1d6e913d129391d

SHA512
23446cd8d467db36aba2ba21ecc11ea2a7f5bf2b883731e8ee1ae3a9c6409127199f9e9ea694b7117d3b1c07a818c8f031f582be7886feed69b637bfa3b37a18

Download Submit
C:\Windows\system\fMAPmca.exe

Filesize
1.8MB

MD5
0e1c3af78c45499288359d314e830f23

SHA1
8424e2c89b7f3688632fb9d30a14b6cc47cdab58

SHA256
12939d2c4cdd3710cfe2c5f0801c3e67299c29180e92a6dbf5bae2ef56c50af6

SHA512
9ec7bec82bfda90b300295cf642729796f413f9261a182a5f5cf1fed960810202ec19d6c64482097ac0675ea8d5d6bf9e0ccee00952b015de1cae853e3b8c773

Download Submit
C:\Windows\system\iHIuWLo.exe

Filesize
1.8MB

MD5
1142bbe35d24e94904a2a9e9bd30af69

SHA1
5542d3400b06510ca13da096645dc6521a5873ae

SHA256
388678fd326579391133ea572799f849bb5e34af6bbb27f4db0afae0c7a6abe1

SHA512
72df8a2c5bea88463a88e0017eafa0ab509ed390f7a6751808b82e323b019a6b9a578d4e4afa97e2d21e49c56e109e331d70d4703e755627ef91314bfcdf7451

Download Submit
C:\Windows\system\ipTesFl.exe

Filesize
1.8MB

MD5
9001272343873ec33476867fd99c76d2

SHA1
9da6d24d4c28767dc99258ef62989c1e0641cc3e

SHA256
317148f4648e365810bc4084a5c0e2259285a6081932283a4c7b97f9e25ccb71

SHA512
6912c0fa81708d99d5c8159b4ea5b5c45dbb1ba9239abc0ef55dfdc4bec97dc57013cec6460df2704d4ef069383cdee0f16d24c2212a3a99c1fd34aee0eb9303

Download Submit
C:\Windows\system\lqgXvuF.exe

Filesize
1.8MB

MD5
c6aed0edd27eba492d8fb523e44e1ba1

SHA1
4d18ead55cee756d1004671a93e6a3fd7581d69d

SHA256
6727b6bf965939de97a87cbb2953656d5d7c3cb70fb4b2eb8f98d5853069add6

SHA512
ae77cd716f938aeee6bcefa5ce2cfb5fe6dce3429f0c44cb23e914e2868d2f4eb0e604a058ff9c55e14e76b34d08aa64975d36176201f2584cbe8b4163dd4b83

Download Submit
C:\Windows\system\qRPaiQR.exe

Filesize
1.8MB

MD5
98e0bee7da4643c63d5c31fb51ecd246

SHA1
0f978f290e2f12d4abead4d81460591b73a70ac2

SHA256
3e0a3ed8be49f0fdfa7e34fbfc5600c708a49d2bb422ff205f1104df8051da49

SHA512
72a9d59c06b4e64b80630a61d6c868be75eda06f693b38d9cb7ac987d035113a3e379766b4590bf3e6932d1444d1592ffb8db79635a8fe169b19b70dffc71b3b

Download Submit
C:\Windows\system\tdodiSw.exe

Filesize
1.8MB

MD5
7ce102033099e88071b429d7ed40c2e2

SHA1
9e36b657c6c9c5728ecedf076cc5a65414d2e509

SHA256
6f468db1774b9a74f770c6c65af6413bb6616c0b84a22b6db977fa2e9e4188a4

SHA512
fe853d585677f892840fcee03eb303b85b99851fdc53aab1dbcf3b492ac7f19d7441247af5ef639c9f4f40adf6b0479fb4eb3f69afe1d70d8976c21607964175

Download Submit
C:\Windows\system\vCgJTfc.exe

Filesize
1.8MB

MD5
91c46a1d373e611dec9425748cc00949

SHA1
3cc49af642704286504998c0a1164578b67f6621

SHA256
30c2a405f0f5223733453b34a7ca984be2f8cc7b74574387953a738578eb2531

SHA512
e6f8374178aa58523d5e7a6a078f4d4f83ee62a3efd0e6c4a1a8a5c2718fddbc1b5bd6fa258b2cf62be5b3755939ea00b2a1ec3e6cbbdfa9a4dd55a031fad14d

Download Submit
C:\Windows\system\xONBvKy.exe

Filesize
1.8MB

MD5
bbde5fa072d78978a8d086510fbb91f8

SHA1
d047bee13c976e306ae209a286a14dd2fd9d01fb

SHA256
4c5a632e0c2f3f55feb771ab22916391bea41a68559bae8dcb26dd530d7c3911

SHA512
7d7654162d78c3ea16caab74f76e838241e26078afd01e2da2782abbee9d17f0d8f970dc7cc777f2ed868b6015afd690b04e564529ea36471bd3db6ba1d42840

Download Submit
\Windows\system\EKmhFhp.exe

Filesize
1.8MB

MD5
f69b3ef8c8eb93c3ca1af03d9bc27f30

SHA1
d1de26f0fb8b9e6f179caf9b803b4e6b4cbc1f94

SHA256
4285a057506624b2d888ec6557283f5bea9ebc8c224f5c6d1bf29887b1576627

SHA512
275bb71ecd8cffe662b4898da89b37b591a572a4c2ad7071c62057ec46ef8fecc3cd6259d19334ab0900d4b8d6022ee8bab49e2ac211dae3b327b6a8ff58f72a

Download Submit
\Windows\system\IvtxXwk.exe

Filesize
1.8MB

MD5
7db09b91e50061df134d29a035678bb6

SHA1
b3f1d49f5fad4b98f79563f93210cda5f506c8a0

SHA256
bdb8dfa0e470c6acf35b7f2aa2aef71a7f365660017c54dd3c5234ae1298603f

SHA512
72f2677f21df8c89275df9a8c9a5bceaf9d3e035d44914eea6043b94b70c5e6fb324b0ec7996f160d70e46f0e0c6ce92eb2c7d14a96bb72a1c38d43afbe2c965

Download Submit
\Windows\system\JZBTZPT.exe

Filesize
1.8MB

MD5
2f2b211d40fc41e9d4ca207b75ee87cb

SHA1
b9f5ce51cc30c45a24691e4bf554fc0333d859e5

SHA256
bc541cbc9fbfeed1f6faf702742cacc9aa904b57d1c87d81d59386386f063a97

SHA512
d0c2c98d9826d3e51fe0682f60a9928ecb7ef2bab01fc9556bb99eda59925d5364b49c4e58af0e0b51b72a7897ffd39f4f01e31b5f8ef6a006f75677f528b780

Download Submit
\Windows\system\JkjIAEc.exe

Filesize
1.8MB

MD5
5fe5417e130b0a29c78010b800335a5d

SHA1
c40a13cb37b1bc2c5ff32f7ed271b4f68c17631b

SHA256
47ee7983d9dfe554d7d52948cf51360db67903a9d50c3bae2ec51ad6218a4478

SHA512
c15ed2a140b67e1761ab83de43f6e4d3a987e22e7012bf28f6373fbc77d55548be327eef302e62ab2fc3ff3aef32736f66f246c5db1e5761c6dcedd1bc7b37ec

Download Submit
\Windows\system\MhVPMAq.exe

Filesize
1.8MB

MD5
0ac728f3ea18f13b4b94a4eb729fbc16

SHA1
696217dd5517a0a8dc13fb6e3f5757eaf1392231

SHA256
aedc426d3f59809012f30d5b93ac0a4ac27a651b0a5c7f75f58a34f7fc004ec6

SHA512
91f1e5030668fad14b707f6d480faf0a8c183815ea554566497031c9791569ac511ecdb3128b51580316019bc4b1880aa0a41947f0fc131a18e3f3279e2b8672

Download Submit
\Windows\system\OAgQjYj.exe

Filesize
1.8MB

MD5
4425edf1312c085965a5bba673d21dc2

SHA1
62cb442c100d4076062a6baaa0582fee33eaa38f

SHA256
9dc2f1a67e74fc1d176228a93ac6005cc97d55bdc81424cd1a4ed20813bdbd49

SHA512
6796e67982d56dd1f88582672cdfb2f4a80720429edbc04a0961d82a6cd90bf4edce3987ad12803f77eb6b51bbf981dfdafeaff1252b70cb27f0c149c41be361

Download Submit
\Windows\system\OEQkdcP.exe

Filesize
1.8MB

MD5
16979bce36f55f3e73ec38b1ae48926e

SHA1
8b0f602f40fe490c59e7ada96599c2b64c8dbb9a

SHA256
da40b2fd4646720945a0ef69ef4a397de84f2f1cb4b0be828f6ba8eb37e99aa6

SHA512
84c83155a699cbdd0a3a347d40c52dfaa872b0762a84cc97107f343ae8ef16a6a74f1a764c71bf856eeea04b6546f8871fe002deecf6a6b029fe7e1daf634c8a

Download Submit
\Windows\system\OmQkktm.exe

Filesize
1.8MB

MD5
70ae7caaec1ad021925555a3d87fcb9a

SHA1
d2298ebd3be2603383ddcf63b09460b1cdc31531

SHA256
6e5cefed8fdd9cedac35af20251460e1ba7db9cf4101d75109123cff9295bb97

SHA512
1a265047df6a17385f85d9872429aa75e5e982fd723d55686b542099da9fa8c0fce82cbefc01219f5765c32d8e619f9ed3684093ac5af1af273f4c93e62c19e4

Download Submit
\Windows\system\QDPGDfd.exe

Filesize
1.8MB

MD5
6d86081deec6d1c443d79ff9ad8cccdd

SHA1
8fc5d94d5f18a09e3eb10f1023c1904cc7986203

SHA256
99c9ee28bcffc418af4f889973ca5df826431016587922b42a6eaee8a97d8e20

SHA512
f6f00007aed5ee2bd1ce44e9fd993a2cdb48c4b1e3ee04b210e2432253a8dd7ca6f083a58ce4402c6f8527e2cf612d8a7fa0c122ecabb4b47930cec4f5f4adbd

Download Submit
\Windows\system\UEqaQGP.exe

Filesize
1.8MB

MD5
69afba207cffd2786ea707baf1cfcf5e

SHA1
9838b217dae704660c2b493b40251ad9be0f8f23

SHA256
b1af4921a8265603d3631670afe83191dd36e6b8c13e9fc46b54a0cf3638ed24

SHA512
ae39ecaabf4305e786b772eaf11699b6c8dcaaf0db18828532182c5feacc3d48749b005874ebadf3c166d031e1b6c1e9d13a21192be15d6f5ba3f041122d9a88

Download Submit
\Windows\system\YClrZFx.exe

Filesize
1.8MB

MD5
f4442d19710345ae39b1ba6cdeb50f24

SHA1
337c536ca98e03871f8155e21b5c9c6d83eff972

SHA256
ccf692b79850d8f0ca95abdf6ddad836407695c912875ca1ed225cc22bf21906

SHA512
af9abef05f7b66604dca215bcdd4cb9e295315ddc2f1544c87d7d05c0bab1b854c498a6ac145a05252d1348c1f4ac2360615b73f821ec510640073958dfe22bf

Download Submit
\Windows\system\bBdnvCt.exe

Filesize
1.8MB

MD5
adee8788d0a49fc4075537e0cef55a95

SHA1
5bc4e94fb3474e0615be065cf8387ac598016f9f

SHA256
14816d4fec62a8f82c65ec61beff0f28457015c0e708f6dcbb778c141512b1c8

SHA512
c2a5898a9b320c9f841c7b5f2c1e53cf8ea6b40a4ec828b674d677b23527ea38ca4a7c1d4f51596d768f1121b4e970150f0b1a53ac6e7842cd4f1d20a27ba1c4

Download Submit
\Windows\system\cwMMSFb.exe

Filesize
1.8MB

MD5
f976a20fd75c290b0026700a0bc1153f

SHA1
1fe8c6c72182c04914bdbbd3be145d0b2383df62

SHA256
5313d6a2e75adae1019b5b0b4507f9340d3cc2c1e797fb7a00664e3feca272c0

SHA512
112e0822bc332b4222635e3b2a796bc02396829b349fc410b2edfa251ba698476ae3c69328c3e3b1caf6b52d007ac8f85c0c45614d302cf269fcf54eb937ee6e

Download Submit
\Windows\system\egABqpu.exe

Filesize
1.8MB

MD5
22f7d60c7c4e4eb00a6a3bc10f2e347d

SHA1
5c44f42e693f77b50cc3efeb9a4d58f2cc4ae09f

SHA256
49c83980741ce5f9c22342bd8e0b80d590892866b47ac97c769152238705a48c

SHA512
2cedf775d5f3407f098648eea79dc144a3dc133df9eb47bd22579d1398a8f47cad65697184aeb465df0a63ada84bcb1dd38ee341fe11b00ec1a65a92f2874da8

Download Submit
\Windows\system\gWiNVKi.exe

Filesize
1.8MB

MD5
6198831f1e011d04105326bc76b50e99

SHA1
e7627e1a86c5d3344ea17e24644e8e14cb548fa1

SHA256
615fd7a89cd7b34c3da87a12911fd72f7860a613a4303b7e6bb51497d0426088

SHA512
9c35bed6bc96a7327adf8573f8dfe679d8ddb4af0b7aa9208030ad866ba51359d8a7d17f1a11b54264a9a575b83d77328d6ccff930dd521071ce270e536aaa97

Download Submit
\Windows\system\ikHzfOb.exe

Filesize
1.8MB

MD5
16329027edfc14ee09f612b156a75e39

SHA1
74a84ff315f1acc5f3534ddc5355f6e1ed0b34b5

SHA256
ec47999ca336724c48e6d9645c8ff83c9b840fa4eda79a2f2a03e33b1a473c1f

SHA512
d1a2db71e1f05459a9f4ebd3d26b28a6f558df9327c691ff4d48b9223c1b1d9df9c996d421deb2e774fe6b0c2a010a6d83148bdd9f1df9ab45419a4fc6daec2e

Download Submit
\Windows\system\oWqDqog.exe

Filesize
1.8MB

MD5
d67ab13d6e9c6f5decfd9d10bd74dc5c

SHA1
bf5abc1cca799acfd5fbe8a0d74a8f53658ff5e1

SHA256
aea127d56fbf3f2b5a57ef5aefd89a9d3db1213fc1634321eb88b177e943a662

SHA512
50a807c8c7e35f1ec0d21ecdc833378fba86caa17fdd4f7129c8d3fa59c106dce74b8723406008f9eb7672babe9c9d83ae2e63e96c80042fd9adeb0d9eb547ed

Download Submit
\Windows\system\sznoGpV.exe

Filesize
1.8MB

MD5
d53c9218a210d5c72d153c69fe819172

SHA1
10271901f491d68488c514593dcebbac402525ce

SHA256
bc43a25be4fed00ba21f439473a139cb4e21c68ac8a4fb5843b5110c55964581

SHA512
5559a9290eed7b965a6864bb894afa7ae708d5c4243533232f4eaffcbf8783557e805013fd3225995bcf9f74140f5c3e12ba6449cbbaf2731beb0df50585e21e

Download Submit
\Windows\system\xnPtjrP.exe

Filesize
1.8MB

MD5
ce63e3060c2b6d2df618fad18208a3ce

SHA1
49287ca022c71a4509f31d19043dd99c4e080a02

SHA256
0955025fb2609c2678b0ee57e5197cbdaa1636e5e19d7abb0b765daaffd22ae5

SHA512
1390c6db41f19501d0b765d47131098f7084547ad95c66dea228f7bf29bc2c45eb26ebc5abba4dfaab4a4b79e02b59a1c046461df781ae13ed41d2381c5dc679

Download Submit
\Windows\system\xwTBKyw.exe

Filesize
1.8MB

MD5
195d45fc71c02b8082df9d72b996e13a

SHA1
dbd6c562720a3206c0a032b0e871868dfc876378

SHA256
b8bcbbc617bc1cf0a13283f300a3e514b7f623655bf56573d3d76fbe9699ec86

SHA512
f996774df659989b1199116a415286cbb9d649f2ec0ae066a3ce9c8f733d26d3276bfb79f06e70fbb3733365710145bd9df5db48e89f38c46db06e2d49c542ca

Download Submit
memory/1936-115-0x000000013F570000-0x000000013F962000-memory.dmp

Filesize
3.9MB

Download
memory/1936-94-0x000000013F1E0000-0x000000013F5D2000-memory.dmp

Filesize
3.9MB

Download
memory/1936-13025-0x0000000003690000-0x0000000003A82000-memory.dmp

Filesize
3.9MB

Download
memory/1936-8-0x000000013F3F0000-0x000000013F7E2000-memory.dmp

Filesize
3.9MB

Download
memory/1936-0-0x00000000001F0000-0x0000000000200000-memory.dmp

Filesize
64KB

Download
memory/1936-22-0x0000000002FD0000-0x00000000033C2000-memory.dmp

Filesize
3.9MB

Download
memory/1936-1672-0x000000013F9B0000-0x000000013FDA2000-memory.dmp

Filesize
3.9MB

Download
memory/1936-119-0x0000000002FD0000-0x00000000033C2000-memory.dmp

Filesize
3.9MB

Download
memory/1936-114-0x000000013FED0000-0x00000001402C2000-memory.dmp

Filesize
3.9MB

Download
memory/1936-110-0x000000013FDF0000-0x00000001401E2000-memory.dmp

Filesize
3.9MB

Download
memory/1936-112-0x0000000003690000-0x0000000003A82000-memory.dmp

Filesize
3.9MB

Download
memory/1936-108-0x0000000003690000-0x0000000003A82000-memory.dmp

Filesize
3.9MB

Download
memory/1936-2-0x000000013F9B0000-0x000000013FDA2000-memory.dmp

Filesize
3.9MB

Download
memory/1936-98-0x000000013F210000-0x000000013F602000-memory.dmp

Filesize
3.9MB

Download
memory/1936-104-0x0000000003690000-0x0000000003A82000-memory.dmp

Filesize
3.9MB

Download
memory/1936-101-0x0000000003690000-0x0000000003A82000-memory.dmp

Filesize
3.9MB

Download
memory/1936-102-0x000000013FFA0000-0x0000000140392000-memory.dmp

Filesize
3.9MB

Download
memory/1944-87-0x000007FEF56E0000-0x000007FEF607D000-memory.dmp

Filesize
9.6MB

Download
memory/1944-414-0x000007FEF56E0000-0x000007FEF607D000-memory.dmp

Filesize
9.6MB

Download
memory/1944-118-0x000007FEF56E0000-0x000007FEF607D000-memory.dmp

Filesize
9.6MB

Download
memory/1944-96-0x000007FEF56E0000-0x000007FEF607D000-memory.dmp

Filesize
9.6MB

Download
memory/1944-35-0x000000001B7D0000-0x000000001BAB2000-memory.dmp

Filesize
2.9MB

Download
memory/1944-27-0x000007FEF599E000-0x000007FEF599F000-memory.dmp

Filesize
4KB

Download
memory/1944-36-0x00000000027E0000-0x00000000027E8000-memory.dmp

Filesize
32KB

Download
memory/1944-26-0x0000000002E70000-0x0000000002EF0000-memory.dmp

Filesize
512KB

Download
memory/2016-9-0x000000013F3F0000-0x000000013F7E2000-memory.dmp

Filesize
3.9MB

Download
memory/2016-4607-0x000000013F3F0000-0x000000013F7E2000-memory.dmp

Filesize
3.9MB

Download
memory/2252-4654-0x000000013FA50000-0x000000013FE42000-memory.dmp

Filesize
3.9MB

Download
memory/2252-113-0x000000013FA50000-0x000000013FE42000-memory.dmp

Filesize
3.9MB

Download
memory/2368-105-0x000000013F030000-0x000000013F422000-memory.dmp

Filesize
3.9MB

Download
memory/2368-4608-0x000000013F030000-0x000000013F422000-memory.dmp

Filesize
3.9MB

Download
memory/2400-4604-0x000000013F1E0000-0x000000013F5D2000-memory.dmp

Filesize
3.9MB

Download
memory/2400-97-0x000000013F1E0000-0x000000013F5D2000-memory.dmp

Filesize
3.9MB

Download
memory/2476-4609-0x000000013F210000-0x000000013F602000-memory.dmp

Filesize
3.9MB

Download
memory/2476-103-0x000000013F210000-0x000000013F602000-memory.dmp

Filesize
3.9MB

Download
memory/2484-106-0x000000013FFA0000-0x0000000140392000-memory.dmp

Filesize
3.9MB

Download
memory/2484-4734-0x000000013FFA0000-0x0000000140392000-memory.dmp

Filesize
3.9MB

Download
memory/2532-109-0x000000013FD70000-0x0000000140162000-memory.dmp

Filesize
3.9MB

Download
memory/2532-4653-0x000000013FD70000-0x0000000140162000-memory.dmp

Filesize
3.9MB

Download
memory/2636-28-0x000000013F570000-0x000000013F962000-memory.dmp

Filesize
3.9MB

Download
memory/2636-4744-0x000000013F570000-0x000000013F962000-memory.dmp

Filesize
3.9MB

Download
memory/2644-93-0x000000013FCA0000-0x0000000140092000-memory.dmp

Filesize
3.9MB

Download
memory/2908-4113-0x000000013F7E0000-0x000000013FBD2000-memory.dmp

Filesize
3.9MB

Download
memory/2908-25-0x000000013F7E0000-0x000000013FBD2000-memory.dmp

Filesize
3.9MB

Download