xmrig | 48473e63c22af3b061920fdf9bf429ebaa7109ae2210f4251fef829d04891140

Analysis

max time kernel
149s
max time network
143s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
01/07/2024, 09:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

48473e63c22af3b061920fdf9bf429ebaa7109ae2210f4251fef829d04891140_NeikiAnalytics.exe
Size

1.7MB
MD5

cd51ac11994955d30efaa0b23b66c3b0
SHA1

774e7cbf3982e897b9ddb7b17f43810fccaa590b
SHA256

48473e63c22af3b061920fdf9bf429ebaa7109ae2210f4251fef829d04891140
SHA512

0e34183c2a712bcad17016a6a115e271373bfbb14e4d57aaf68e07ebb96c3bcca87d135467f5e0d67c1e649ae273407210046606cb62f65c77730efbfa1c5529
SSDEEP

24576:zv3/fTLF671TilQFG4P5PMkFfkeMlN675EgEPgsU5qTqOkDilK3uPpHbcMfOoZ:Lz071uv4BPMkFfdg6NsOkc2h

Score

10^/10

xmrig execution miner persistence privilege_escalation upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 22 IoCs

miner

resource	yara_rule
behavioral1/memory/3060-15-0x000000013F530000-0x000000013F922000-memory.dmp	xmrig
behavioral1/memory/2984-12-0x000000013F030000-0x000000013F422000-memory.dmp	xmrig
behavioral1/memory/2696-29-0x000000013F9E0000-0x000000013FDD2000-memory.dmp	xmrig
behavioral1/memory/2944-72-0x000000013F330000-0x000000013F722000-memory.dmp	xmrig
behavioral1/memory/2008-91-0x000000013F0B0000-0x000000013F4A2000-memory.dmp	xmrig
behavioral1/memory/2168-95-0x000000013F350000-0x000000013F742000-memory.dmp	xmrig
behavioral1/memory/2008-94-0x0000000003460000-0x0000000003852000-memory.dmp	xmrig
behavioral1/memory/2932-651-0x000000013F230000-0x000000013F622000-memory.dmp	xmrig
behavioral1/memory/2704-54-0x000000013FA70000-0x000000013FE62000-memory.dmp	xmrig
behavioral1/memory/2584-53-0x000000013F620000-0x000000013FA12000-memory.dmp	xmrig
behavioral1/memory/2800-50-0x000000013FB70000-0x000000013FF62000-memory.dmp	xmrig
behavioral1/memory/2136-5356-0x000000013FB90000-0x000000013FF82000-memory.dmp	xmrig
behavioral1/memory/2696-5366-0x000000013F9E0000-0x000000013FDD2000-memory.dmp	xmrig
behavioral1/memory/3060-5365-0x000000013F530000-0x000000013F922000-memory.dmp	xmrig
behavioral1/memory/2932-5364-0x000000013F230000-0x000000013F622000-memory.dmp	xmrig
behavioral1/memory/2584-5363-0x000000013F620000-0x000000013FA12000-memory.dmp	xmrig
behavioral1/memory/2984-5362-0x000000013F030000-0x000000013F422000-memory.dmp	xmrig
behavioral1/memory/2704-5361-0x000000013FA70000-0x000000013FE62000-memory.dmp	xmrig
behavioral1/memory/2944-5360-0x000000013F330000-0x000000013F722000-memory.dmp	xmrig
behavioral1/memory/2800-5359-0x000000013FB70000-0x000000013FF62000-memory.dmp	xmrig
behavioral1/memory/2808-5358-0x000000013FC00000-0x000000013FFF2000-memory.dmp	xmrig
behavioral1/memory/2168-5357-0x000000013F350000-0x000000013F742000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
2184	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
2984	QNSjcxA.exe
3060	PnehNRy.exe
2696	PTgnHuP.exe
2584	cImECvt.exe
2800	xFxUvmL.exe
2704	ZMAApKf.exe
2932	wDzNavQ.exe
2944	eerXBOM.exe
2136	iLWqXgu.exe
2808	PPQquwB.exe
2168	sqLibiS.exe
2780	jIiddEw.exe
2332	hyAHkar.exe
2368	ALyPJQq.exe
332	UWMVoSV.exe
1892	ZexZYwD.exe
636	qOBUmah.exe
2004	jknIshO.exe
2872	DvLNgjc.exe
3068	BMZnrUO.exe
1648	cuYWZup.exe
764	LSZrbGn.exe
1476	xDTREXx.exe
2180	hDSKsZZ.exe
352	piIZZsR.exe
2428	XCYPnWe.exe
2132	UgIbPOD.exe
1788	nmyApdw.exe
1984	LDppwds.exe
1056	WzkokLT.exe
2172	eyxOsNr.exe
1640	RypjhQu.exe
1240	QSbVmDI.exe
344	LivjOue.exe
1080	LEImZCi.exe
1504	jTwLAYI.exe
3064	Qvzwlvz.exe
2188	QzrRuhS.exe
1300	iSRTwIn.exe
3000	PqhXDYh.exe
2076	YpXuiXL.exe
2560	cEAhihQ.exe
2976	jZiSnUr.exe
2532	dArfeMa.exe
2496	ZWSBGbO.exe
2524	kNNAIrM.exe
2760	WaHNrTe.exe
940	uZczzuZ.exe
1644	mdlgTek.exe
1028	WLoyXIA.exe
1036	sAVgLBw.exe
896	ChAlLjO.exe
2372	MvVfrKo.exe
2972	kjmhdBT.exe
1680	XeiBcCX.exe
3084	PpmGpFI.exe
3116	YJirumi.exe
3148	phcNCTW.exe
3180	MTBtiJF.exe
3212	iwDVcoi.exe
3244	oyXNodN.exe
3276	zYIQuKi.exe
3308	rJOVIgv.exe
3340	nOngKMA.exe

Loads dropped DLL 64 IoCs

pid	Process
2008	48473e63c22af3b061920fdf9bf429ebaa7109ae2210f4251fef829d04891140_NeikiAnalytics.exe
2008	48473e63c22af3b061920fdf9bf429ebaa7109ae2210f4251fef829d04891140_NeikiAnalytics.exe
2008	48473e63c22af3b061920fdf9bf429ebaa7109ae2210f4251fef829d04891140_NeikiAnalytics.exe
2008	48473e63c22af3b061920fdf9bf429ebaa7109ae2210f4251fef829d04891140_NeikiAnalytics.exe
2008	48473e63c22af3b061920fdf9bf429ebaa7109ae2210f4251fef829d04891140_NeikiAnalytics.exe
2008	48473e63c22af3b061920fdf9bf429ebaa7109ae2210f4251fef829d04891140_NeikiAnalytics.exe
2008	48473e63c22af3b061920fdf9bf429ebaa7109ae2210f4251fef829d04891140_NeikiAnalytics.exe
2008	48473e63c22af3b061920fdf9bf429ebaa7109ae2210f4251fef829d04891140_NeikiAnalytics.exe
2008	48473e63c22af3b061920fdf9bf429ebaa7109ae2210f4251fef829d04891140_NeikiAnalytics.exe
2008	48473e63c22af3b061920fdf9bf429ebaa7109ae2210f4251fef829d04891140_NeikiAnalytics.exe
2008	48473e63c22af3b061920fdf9bf429ebaa7109ae2210f4251fef829d04891140_NeikiAnalytics.exe
2008	48473e63c22af3b061920fdf9bf429ebaa7109ae2210f4251fef829d04891140_NeikiAnalytics.exe
2008	48473e63c22af3b061920fdf9bf429ebaa7109ae2210f4251fef829d04891140_NeikiAnalytics.exe
2008	48473e63c22af3b061920fdf9bf429ebaa7109ae2210f4251fef829d04891140_NeikiAnalytics.exe
2008	48473e63c22af3b061920fdf9bf429ebaa7109ae2210f4251fef829d04891140_NeikiAnalytics.exe
2008	48473e63c22af3b061920fdf9bf429ebaa7109ae2210f4251fef829d04891140_NeikiAnalytics.exe
2008	48473e63c22af3b061920fdf9bf429ebaa7109ae2210f4251fef829d04891140_NeikiAnalytics.exe
2008	48473e63c22af3b061920fdf9bf429ebaa7109ae2210f4251fef829d04891140_NeikiAnalytics.exe
2008	48473e63c22af3b061920fdf9bf429ebaa7109ae2210f4251fef829d04891140_NeikiAnalytics.exe
2008	48473e63c22af3b061920fdf9bf429ebaa7109ae2210f4251fef829d04891140_NeikiAnalytics.exe
2008	48473e63c22af3b061920fdf9bf429ebaa7109ae2210f4251fef829d04891140_NeikiAnalytics.exe
2008	48473e63c22af3b061920fdf9bf429ebaa7109ae2210f4251fef829d04891140_NeikiAnalytics.exe
2008	48473e63c22af3b061920fdf9bf429ebaa7109ae2210f4251fef829d04891140_NeikiAnalytics.exe
2008	48473e63c22af3b061920fdf9bf429ebaa7109ae2210f4251fef829d04891140_NeikiAnalytics.exe
2008	48473e63c22af3b061920fdf9bf429ebaa7109ae2210f4251fef829d04891140_NeikiAnalytics.exe
2008	48473e63c22af3b061920fdf9bf429ebaa7109ae2210f4251fef829d04891140_NeikiAnalytics.exe
2008	48473e63c22af3b061920fdf9bf429ebaa7109ae2210f4251fef829d04891140_NeikiAnalytics.exe
2008	48473e63c22af3b061920fdf9bf429ebaa7109ae2210f4251fef829d04891140_NeikiAnalytics.exe
2008	48473e63c22af3b061920fdf9bf429ebaa7109ae2210f4251fef829d04891140_NeikiAnalytics.exe
2008	48473e63c22af3b061920fdf9bf429ebaa7109ae2210f4251fef829d04891140_NeikiAnalytics.exe
2008	48473e63c22af3b061920fdf9bf429ebaa7109ae2210f4251fef829d04891140_NeikiAnalytics.exe
2008	48473e63c22af3b061920fdf9bf429ebaa7109ae2210f4251fef829d04891140_NeikiAnalytics.exe
2008	48473e63c22af3b061920fdf9bf429ebaa7109ae2210f4251fef829d04891140_NeikiAnalytics.exe
2008	48473e63c22af3b061920fdf9bf429ebaa7109ae2210f4251fef829d04891140_NeikiAnalytics.exe
2008	48473e63c22af3b061920fdf9bf429ebaa7109ae2210f4251fef829d04891140_NeikiAnalytics.exe
2008	48473e63c22af3b061920fdf9bf429ebaa7109ae2210f4251fef829d04891140_NeikiAnalytics.exe
2008	48473e63c22af3b061920fdf9bf429ebaa7109ae2210f4251fef829d04891140_NeikiAnalytics.exe
2008	48473e63c22af3b061920fdf9bf429ebaa7109ae2210f4251fef829d04891140_NeikiAnalytics.exe
2008	48473e63c22af3b061920fdf9bf429ebaa7109ae2210f4251fef829d04891140_NeikiAnalytics.exe
2008	48473e63c22af3b061920fdf9bf429ebaa7109ae2210f4251fef829d04891140_NeikiAnalytics.exe
2008	48473e63c22af3b061920fdf9bf429ebaa7109ae2210f4251fef829d04891140_NeikiAnalytics.exe
2008	48473e63c22af3b061920fdf9bf429ebaa7109ae2210f4251fef829d04891140_NeikiAnalytics.exe
2008	48473e63c22af3b061920fdf9bf429ebaa7109ae2210f4251fef829d04891140_NeikiAnalytics.exe
2008	48473e63c22af3b061920fdf9bf429ebaa7109ae2210f4251fef829d04891140_NeikiAnalytics.exe
2008	48473e63c22af3b061920fdf9bf429ebaa7109ae2210f4251fef829d04891140_NeikiAnalytics.exe
2008	48473e63c22af3b061920fdf9bf429ebaa7109ae2210f4251fef829d04891140_NeikiAnalytics.exe
2008	48473e63c22af3b061920fdf9bf429ebaa7109ae2210f4251fef829d04891140_NeikiAnalytics.exe
2008	48473e63c22af3b061920fdf9bf429ebaa7109ae2210f4251fef829d04891140_NeikiAnalytics.exe
2008	48473e63c22af3b061920fdf9bf429ebaa7109ae2210f4251fef829d04891140_NeikiAnalytics.exe
2008	48473e63c22af3b061920fdf9bf429ebaa7109ae2210f4251fef829d04891140_NeikiAnalytics.exe
2008	48473e63c22af3b061920fdf9bf429ebaa7109ae2210f4251fef829d04891140_NeikiAnalytics.exe
2008	48473e63c22af3b061920fdf9bf429ebaa7109ae2210f4251fef829d04891140_NeikiAnalytics.exe
2008	48473e63c22af3b061920fdf9bf429ebaa7109ae2210f4251fef829d04891140_NeikiAnalytics.exe
2008	48473e63c22af3b061920fdf9bf429ebaa7109ae2210f4251fef829d04891140_NeikiAnalytics.exe
2008	48473e63c22af3b061920fdf9bf429ebaa7109ae2210f4251fef829d04891140_NeikiAnalytics.exe
2008	48473e63c22af3b061920fdf9bf429ebaa7109ae2210f4251fef829d04891140_NeikiAnalytics.exe
2008	48473e63c22af3b061920fdf9bf429ebaa7109ae2210f4251fef829d04891140_NeikiAnalytics.exe
2008	48473e63c22af3b061920fdf9bf429ebaa7109ae2210f4251fef829d04891140_NeikiAnalytics.exe
2008	48473e63c22af3b061920fdf9bf429ebaa7109ae2210f4251fef829d04891140_NeikiAnalytics.exe
2008	48473e63c22af3b061920fdf9bf429ebaa7109ae2210f4251fef829d04891140_NeikiAnalytics.exe
2008	48473e63c22af3b061920fdf9bf429ebaa7109ae2210f4251fef829d04891140_NeikiAnalytics.exe
2008	48473e63c22af3b061920fdf9bf429ebaa7109ae2210f4251fef829d04891140_NeikiAnalytics.exe
2008	48473e63c22af3b061920fdf9bf429ebaa7109ae2210f4251fef829d04891140_NeikiAnalytics.exe
2008	48473e63c22af3b061920fdf9bf429ebaa7109ae2210f4251fef829d04891140_NeikiAnalytics.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2008-0-0x000000013F0B0000-0x000000013F4A2000-memory.dmp	upx
behavioral1/files/0x000c00000001342e-3.dat	upx
behavioral1/files/0x0030000000013adc-7.dat	upx
behavioral1/memory/3060-15-0x000000013F530000-0x000000013F922000-memory.dmp	upx
behavioral1/memory/2984-12-0x000000013F030000-0x000000013F422000-memory.dmp	upx
behavioral1/files/0x000700000001418c-10.dat	upx
behavioral1/files/0x0007000000014251-31.dat	upx
behavioral1/files/0x000700000001431b-32.dat	upx
behavioral1/memory/2696-29-0x000000013F9E0000-0x000000013FDD2000-memory.dmp	upx
behavioral1/files/0x0016000000005586-36.dat	upx
behavioral1/memory/2944-72-0x000000013F330000-0x000000013F722000-memory.dmp	upx
behavioral1/files/0x0008000000014a60-73.dat	upx
behavioral1/memory/2136-74-0x000000013FB90000-0x000000013FF82000-memory.dmp	upx
behavioral1/files/0x0006000000014f57-90.dat	upx
behavioral1/memory/2008-91-0x000000013F0B0000-0x000000013F4A2000-memory.dmp	upx
behavioral1/files/0x0006000000014bd7-75.dat	upx
behavioral1/memory/2168-95-0x000000013F350000-0x000000013F742000-memory.dmp	upx
behavioral1/files/0x0006000000015083-103.dat	upx
behavioral1/files/0x0006000000015662-117.dat	upx
behavioral1/files/0x0006000000015d59-173.dat	upx
behavioral1/files/0x0006000000015d9c-182.dat	upx
behavioral1/files/0x0006000000015d61-175.dat	upx
behavioral1/files/0x0006000000015d39-168.dat	upx
behavioral1/files/0x0006000000015d0a-161.dat	upx
behavioral1/files/0x0006000000015cee-154.dat	upx
behavioral1/files/0x0006000000015cd2-147.dat	upx
behavioral1/files/0x0006000000015cb1-140.dat	upx
behavioral1/files/0x0006000000015c9a-133.dat	upx
behavioral1/files/0x0006000000015b50-126.dat	upx
behavioral1/files/0x00060000000158d9-119.dat	upx
behavioral1/files/0x000600000001565a-112.dat	upx
behavioral1/files/0x00060000000150d9-105.dat	upx
behavioral1/files/0x000600000001507a-98.dat	upx
behavioral1/files/0x0006000000014c2d-82.dat	upx
behavioral1/files/0x0006000000015f23-187.dat	upx
behavioral1/files/0x0006000000015d85-180.dat	upx
behavioral1/files/0x0006000000015d21-166.dat	upx
behavioral1/files/0x0006000000015cf8-159.dat	upx
behavioral1/files/0x0006000000015ce3-152.dat	upx
behavioral1/files/0x0006000000015cc5-145.dat	upx
behavioral1/files/0x0006000000015ca8-138.dat	upx
behavioral1/files/0x0006000000015b85-131.dat	upx
behavioral1/files/0x0006000000015ae3-125.dat	upx
behavioral1/files/0x00060000000153ee-110.dat	upx
behavioral1/memory/2932-651-0x000000013F230000-0x000000013F622000-memory.dmp	upx
behavioral1/memory/2808-89-0x000000013FC00000-0x000000013FFF2000-memory.dmp	upx
behavioral1/files/0x002f000000013f2c-80.dat	upx
behavioral1/memory/2704-54-0x000000013FA70000-0x000000013FE62000-memory.dmp	upx
behavioral1/memory/2584-53-0x000000013F620000-0x000000013FA12000-memory.dmp	upx
behavioral1/memory/2800-50-0x000000013FB70000-0x000000013FF62000-memory.dmp	upx
behavioral1/files/0x0006000000014b1c-68.dat	upx
behavioral1/memory/2932-66-0x000000013F230000-0x000000013F622000-memory.dmp	upx
behavioral1/files/0x000a000000014367-58.dat	upx
behavioral1/memory/2136-5356-0x000000013FB90000-0x000000013FF82000-memory.dmp	upx
behavioral1/memory/2696-5366-0x000000013F9E0000-0x000000013FDD2000-memory.dmp	upx
behavioral1/memory/3060-5365-0x000000013F530000-0x000000013F922000-memory.dmp	upx
behavioral1/memory/2932-5364-0x000000013F230000-0x000000013F622000-memory.dmp	upx
behavioral1/memory/2584-5363-0x000000013F620000-0x000000013FA12000-memory.dmp	upx
behavioral1/memory/2984-5362-0x000000013F030000-0x000000013F422000-memory.dmp	upx
behavioral1/memory/2704-5361-0x000000013FA70000-0x000000013FE62000-memory.dmp	upx
behavioral1/memory/2944-5360-0x000000013F330000-0x000000013F722000-memory.dmp	upx
behavioral1/memory/2800-5359-0x000000013FB70000-0x000000013FF62000-memory.dmp	upx
behavioral1/memory/2808-5358-0x000000013FC00000-0x000000013FFF2000-memory.dmp	upx
behavioral1/memory/2168-5357-0x000000013F350000-0x000000013F742000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\FLtSyAa.exe	48473e63c22af3b061920fdf9bf429ebaa7109ae2210f4251fef829d04891140_NeikiAnalytics.exe
File created	C:\Windows\System\RCrtFbc.exe	48473e63c22af3b061920fdf9bf429ebaa7109ae2210f4251fef829d04891140_NeikiAnalytics.exe
File created	C:\Windows\System\HllWqMV.exe	48473e63c22af3b061920fdf9bf429ebaa7109ae2210f4251fef829d04891140_NeikiAnalytics.exe
File created	C:\Windows\System\AhJGXys.exe	48473e63c22af3b061920fdf9bf429ebaa7109ae2210f4251fef829d04891140_NeikiAnalytics.exe
File created	C:\Windows\System\QEQXoJM.exe	48473e63c22af3b061920fdf9bf429ebaa7109ae2210f4251fef829d04891140_NeikiAnalytics.exe
File created	C:\Windows\System\mKNmqEL.exe	48473e63c22af3b061920fdf9bf429ebaa7109ae2210f4251fef829d04891140_NeikiAnalytics.exe
File created	C:\Windows\System\yTNSKdA.exe	48473e63c22af3b061920fdf9bf429ebaa7109ae2210f4251fef829d04891140_NeikiAnalytics.exe
File created	C:\Windows\System\gpehuUT.exe	48473e63c22af3b061920fdf9bf429ebaa7109ae2210f4251fef829d04891140_NeikiAnalytics.exe
File created	C:\Windows\System\Jodgspk.exe	48473e63c22af3b061920fdf9bf429ebaa7109ae2210f4251fef829d04891140_NeikiAnalytics.exe
File created	C:\Windows\System\EGzjjly.exe	48473e63c22af3b061920fdf9bf429ebaa7109ae2210f4251fef829d04891140_NeikiAnalytics.exe
File created	C:\Windows\System\uuciipP.exe	48473e63c22af3b061920fdf9bf429ebaa7109ae2210f4251fef829d04891140_NeikiAnalytics.exe
File created	C:\Windows\System\hoBjEXz.exe	48473e63c22af3b061920fdf9bf429ebaa7109ae2210f4251fef829d04891140_NeikiAnalytics.exe
File created	C:\Windows\System\wQxHYwn.exe	48473e63c22af3b061920fdf9bf429ebaa7109ae2210f4251fef829d04891140_NeikiAnalytics.exe
File created	C:\Windows\System\zsMYANU.exe	48473e63c22af3b061920fdf9bf429ebaa7109ae2210f4251fef829d04891140_NeikiAnalytics.exe
File created	C:\Windows\System\sAvOzKr.exe	48473e63c22af3b061920fdf9bf429ebaa7109ae2210f4251fef829d04891140_NeikiAnalytics.exe
File created	C:\Windows\System\TMJrtyE.exe	48473e63c22af3b061920fdf9bf429ebaa7109ae2210f4251fef829d04891140_NeikiAnalytics.exe
File created	C:\Windows\System\wPGOjVM.exe	48473e63c22af3b061920fdf9bf429ebaa7109ae2210f4251fef829d04891140_NeikiAnalytics.exe
File created	C:\Windows\System\DqAKOVb.exe	48473e63c22af3b061920fdf9bf429ebaa7109ae2210f4251fef829d04891140_NeikiAnalytics.exe
File created	C:\Windows\System\ososmwu.exe	48473e63c22af3b061920fdf9bf429ebaa7109ae2210f4251fef829d04891140_NeikiAnalytics.exe
File created	C:\Windows\System\KSmjpPN.exe	48473e63c22af3b061920fdf9bf429ebaa7109ae2210f4251fef829d04891140_NeikiAnalytics.exe
File created	C:\Windows\System\UwFpbGE.exe	48473e63c22af3b061920fdf9bf429ebaa7109ae2210f4251fef829d04891140_NeikiAnalytics.exe
File created	C:\Windows\System\VUhfDLA.exe	48473e63c22af3b061920fdf9bf429ebaa7109ae2210f4251fef829d04891140_NeikiAnalytics.exe
File created	C:\Windows\System\bHLKzML.exe	48473e63c22af3b061920fdf9bf429ebaa7109ae2210f4251fef829d04891140_NeikiAnalytics.exe
File created	C:\Windows\System\hIsFzfO.exe	48473e63c22af3b061920fdf9bf429ebaa7109ae2210f4251fef829d04891140_NeikiAnalytics.exe
File created	C:\Windows\System\NZToGyI.exe	48473e63c22af3b061920fdf9bf429ebaa7109ae2210f4251fef829d04891140_NeikiAnalytics.exe
File created	C:\Windows\System\HITlbUu.exe	48473e63c22af3b061920fdf9bf429ebaa7109ae2210f4251fef829d04891140_NeikiAnalytics.exe
File created	C:\Windows\System\kYHrkhD.exe	48473e63c22af3b061920fdf9bf429ebaa7109ae2210f4251fef829d04891140_NeikiAnalytics.exe
File created	C:\Windows\System\NdRurGa.exe	48473e63c22af3b061920fdf9bf429ebaa7109ae2210f4251fef829d04891140_NeikiAnalytics.exe
File created	C:\Windows\System\vYXxgtL.exe	48473e63c22af3b061920fdf9bf429ebaa7109ae2210f4251fef829d04891140_NeikiAnalytics.exe
File created	C:\Windows\System\Ysibnxd.exe	48473e63c22af3b061920fdf9bf429ebaa7109ae2210f4251fef829d04891140_NeikiAnalytics.exe
File created	C:\Windows\System\AWLjQIl.exe	48473e63c22af3b061920fdf9bf429ebaa7109ae2210f4251fef829d04891140_NeikiAnalytics.exe
File created	C:\Windows\System\dVIXlFQ.exe	48473e63c22af3b061920fdf9bf429ebaa7109ae2210f4251fef829d04891140_NeikiAnalytics.exe
File created	C:\Windows\System\Qssioxy.exe	48473e63c22af3b061920fdf9bf429ebaa7109ae2210f4251fef829d04891140_NeikiAnalytics.exe
File created	C:\Windows\System\RAfzZlY.exe	48473e63c22af3b061920fdf9bf429ebaa7109ae2210f4251fef829d04891140_NeikiAnalytics.exe
File created	C:\Windows\System\cTtSdfp.exe	48473e63c22af3b061920fdf9bf429ebaa7109ae2210f4251fef829d04891140_NeikiAnalytics.exe
File created	C:\Windows\System\tijtmcX.exe	48473e63c22af3b061920fdf9bf429ebaa7109ae2210f4251fef829d04891140_NeikiAnalytics.exe
File created	C:\Windows\System\EkxMzbq.exe	48473e63c22af3b061920fdf9bf429ebaa7109ae2210f4251fef829d04891140_NeikiAnalytics.exe
File created	C:\Windows\System\KJAuhkS.exe	48473e63c22af3b061920fdf9bf429ebaa7109ae2210f4251fef829d04891140_NeikiAnalytics.exe
File created	C:\Windows\System\UdTZwrd.exe	48473e63c22af3b061920fdf9bf429ebaa7109ae2210f4251fef829d04891140_NeikiAnalytics.exe
File created	C:\Windows\System\AqmsYVG.exe	48473e63c22af3b061920fdf9bf429ebaa7109ae2210f4251fef829d04891140_NeikiAnalytics.exe
File created	C:\Windows\System\tTBFsxv.exe	48473e63c22af3b061920fdf9bf429ebaa7109ae2210f4251fef829d04891140_NeikiAnalytics.exe
File created	C:\Windows\System\MRrutBC.exe	48473e63c22af3b061920fdf9bf429ebaa7109ae2210f4251fef829d04891140_NeikiAnalytics.exe
File created	C:\Windows\System\KhUsjrR.exe	48473e63c22af3b061920fdf9bf429ebaa7109ae2210f4251fef829d04891140_NeikiAnalytics.exe
File created	C:\Windows\System\StUDItn.exe	48473e63c22af3b061920fdf9bf429ebaa7109ae2210f4251fef829d04891140_NeikiAnalytics.exe
File created	C:\Windows\System\JGajIrp.exe	48473e63c22af3b061920fdf9bf429ebaa7109ae2210f4251fef829d04891140_NeikiAnalytics.exe
File created	C:\Windows\System\qSupPie.exe	48473e63c22af3b061920fdf9bf429ebaa7109ae2210f4251fef829d04891140_NeikiAnalytics.exe
File created	C:\Windows\System\gNZwZwZ.exe	48473e63c22af3b061920fdf9bf429ebaa7109ae2210f4251fef829d04891140_NeikiAnalytics.exe
File created	C:\Windows\System\VWEaGzm.exe	48473e63c22af3b061920fdf9bf429ebaa7109ae2210f4251fef829d04891140_NeikiAnalytics.exe
File created	C:\Windows\System\PBaVMks.exe	48473e63c22af3b061920fdf9bf429ebaa7109ae2210f4251fef829d04891140_NeikiAnalytics.exe
File created	C:\Windows\System\rCnUnTJ.exe	48473e63c22af3b061920fdf9bf429ebaa7109ae2210f4251fef829d04891140_NeikiAnalytics.exe
File created	C:\Windows\System\DLcFGRD.exe	48473e63c22af3b061920fdf9bf429ebaa7109ae2210f4251fef829d04891140_NeikiAnalytics.exe
File created	C:\Windows\System\ChQOMoC.exe	48473e63c22af3b061920fdf9bf429ebaa7109ae2210f4251fef829d04891140_NeikiAnalytics.exe
File created	C:\Windows\System\HIyBain.exe	48473e63c22af3b061920fdf9bf429ebaa7109ae2210f4251fef829d04891140_NeikiAnalytics.exe
File created	C:\Windows\System\BMZnrUO.exe	48473e63c22af3b061920fdf9bf429ebaa7109ae2210f4251fef829d04891140_NeikiAnalytics.exe
File created	C:\Windows\System\LEImZCi.exe	48473e63c22af3b061920fdf9bf429ebaa7109ae2210f4251fef829d04891140_NeikiAnalytics.exe
File created	C:\Windows\System\GxhZcly.exe	48473e63c22af3b061920fdf9bf429ebaa7109ae2210f4251fef829d04891140_NeikiAnalytics.exe
File created	C:\Windows\System\mnljSLN.exe	48473e63c22af3b061920fdf9bf429ebaa7109ae2210f4251fef829d04891140_NeikiAnalytics.exe
File created	C:\Windows\System\kmXMNZU.exe	48473e63c22af3b061920fdf9bf429ebaa7109ae2210f4251fef829d04891140_NeikiAnalytics.exe
File created	C:\Windows\System\fnVScsj.exe	48473e63c22af3b061920fdf9bf429ebaa7109ae2210f4251fef829d04891140_NeikiAnalytics.exe
File created	C:\Windows\System\DjJmlFc.exe	48473e63c22af3b061920fdf9bf429ebaa7109ae2210f4251fef829d04891140_NeikiAnalytics.exe
File created	C:\Windows\System\AOMgAyb.exe	48473e63c22af3b061920fdf9bf429ebaa7109ae2210f4251fef829d04891140_NeikiAnalytics.exe
File created	C:\Windows\System\piyodYK.exe	48473e63c22af3b061920fdf9bf429ebaa7109ae2210f4251fef829d04891140_NeikiAnalytics.exe
File created	C:\Windows\System\EEiKFwx.exe	48473e63c22af3b061920fdf9bf429ebaa7109ae2210f4251fef829d04891140_NeikiAnalytics.exe
File created	C:\Windows\System\MLMaMWJ.exe	48473e63c22af3b061920fdf9bf429ebaa7109ae2210f4251fef829d04891140_NeikiAnalytics.exe

Event Triggered Execution: Accessibility Features 1 TTPs
Windows contains accessibility features that may be used by adversaries to establish persistence and/or elevate privileges.
persistence privilege_escalation

Accessibility Features
T1546.008

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2184	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2008	48473e63c22af3b061920fdf9bf429ebaa7109ae2210f4251fef829d04891140_NeikiAnalytics.exe
Token: SeLockMemoryPrivilege	2008	48473e63c22af3b061920fdf9bf429ebaa7109ae2210f4251fef829d04891140_NeikiAnalytics.exe
Token: SeDebugPrivilege	2184	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2008 wrote to memory of 2184	2008	48473e63c22af3b061920fdf9bf429ebaa7109ae2210f4251fef829d04891140_NeikiAnalytics.exe	29
PID 2008 wrote to memory of 2184	2008	48473e63c22af3b061920fdf9bf429ebaa7109ae2210f4251fef829d04891140_NeikiAnalytics.exe	29
PID 2008 wrote to memory of 2184	2008	48473e63c22af3b061920fdf9bf429ebaa7109ae2210f4251fef829d04891140_NeikiAnalytics.exe	29
PID 2008 wrote to memory of 2984	2008	48473e63c22af3b061920fdf9bf429ebaa7109ae2210f4251fef829d04891140_NeikiAnalytics.exe	30
PID 2008 wrote to memory of 2984	2008	48473e63c22af3b061920fdf9bf429ebaa7109ae2210f4251fef829d04891140_NeikiAnalytics.exe	30
PID 2008 wrote to memory of 2984	2008	48473e63c22af3b061920fdf9bf429ebaa7109ae2210f4251fef829d04891140_NeikiAnalytics.exe	30
PID 2008 wrote to memory of 3060	2008	48473e63c22af3b061920fdf9bf429ebaa7109ae2210f4251fef829d04891140_NeikiAnalytics.exe	31
PID 2008 wrote to memory of 3060	2008	48473e63c22af3b061920fdf9bf429ebaa7109ae2210f4251fef829d04891140_NeikiAnalytics.exe	31
PID 2008 wrote to memory of 3060	2008	48473e63c22af3b061920fdf9bf429ebaa7109ae2210f4251fef829d04891140_NeikiAnalytics.exe	31
PID 2008 wrote to memory of 2696	2008	48473e63c22af3b061920fdf9bf429ebaa7109ae2210f4251fef829d04891140_NeikiAnalytics.exe	32
PID 2008 wrote to memory of 2696	2008	48473e63c22af3b061920fdf9bf429ebaa7109ae2210f4251fef829d04891140_NeikiAnalytics.exe	32
PID 2008 wrote to memory of 2696	2008	48473e63c22af3b061920fdf9bf429ebaa7109ae2210f4251fef829d04891140_NeikiAnalytics.exe	32
PID 2008 wrote to memory of 2584	2008	48473e63c22af3b061920fdf9bf429ebaa7109ae2210f4251fef829d04891140_NeikiAnalytics.exe	33
PID 2008 wrote to memory of 2584	2008	48473e63c22af3b061920fdf9bf429ebaa7109ae2210f4251fef829d04891140_NeikiAnalytics.exe	33
PID 2008 wrote to memory of 2584	2008	48473e63c22af3b061920fdf9bf429ebaa7109ae2210f4251fef829d04891140_NeikiAnalytics.exe	33
PID 2008 wrote to memory of 2800	2008	48473e63c22af3b061920fdf9bf429ebaa7109ae2210f4251fef829d04891140_NeikiAnalytics.exe	34
PID 2008 wrote to memory of 2800	2008	48473e63c22af3b061920fdf9bf429ebaa7109ae2210f4251fef829d04891140_NeikiAnalytics.exe	34
PID 2008 wrote to memory of 2800	2008	48473e63c22af3b061920fdf9bf429ebaa7109ae2210f4251fef829d04891140_NeikiAnalytics.exe	34
PID 2008 wrote to memory of 2704	2008	48473e63c22af3b061920fdf9bf429ebaa7109ae2210f4251fef829d04891140_NeikiAnalytics.exe	35
PID 2008 wrote to memory of 2704	2008	48473e63c22af3b061920fdf9bf429ebaa7109ae2210f4251fef829d04891140_NeikiAnalytics.exe	35
PID 2008 wrote to memory of 2704	2008	48473e63c22af3b061920fdf9bf429ebaa7109ae2210f4251fef829d04891140_NeikiAnalytics.exe	35
PID 2008 wrote to memory of 2932	2008	48473e63c22af3b061920fdf9bf429ebaa7109ae2210f4251fef829d04891140_NeikiAnalytics.exe	36
PID 2008 wrote to memory of 2932	2008	48473e63c22af3b061920fdf9bf429ebaa7109ae2210f4251fef829d04891140_NeikiAnalytics.exe	36
PID 2008 wrote to memory of 2932	2008	48473e63c22af3b061920fdf9bf429ebaa7109ae2210f4251fef829d04891140_NeikiAnalytics.exe	36
PID 2008 wrote to memory of 2136	2008	48473e63c22af3b061920fdf9bf429ebaa7109ae2210f4251fef829d04891140_NeikiAnalytics.exe	37
PID 2008 wrote to memory of 2136	2008	48473e63c22af3b061920fdf9bf429ebaa7109ae2210f4251fef829d04891140_NeikiAnalytics.exe	37
PID 2008 wrote to memory of 2136	2008	48473e63c22af3b061920fdf9bf429ebaa7109ae2210f4251fef829d04891140_NeikiAnalytics.exe	37
PID 2008 wrote to memory of 2944	2008	48473e63c22af3b061920fdf9bf429ebaa7109ae2210f4251fef829d04891140_NeikiAnalytics.exe	38
PID 2008 wrote to memory of 2944	2008	48473e63c22af3b061920fdf9bf429ebaa7109ae2210f4251fef829d04891140_NeikiAnalytics.exe	38
PID 2008 wrote to memory of 2944	2008	48473e63c22af3b061920fdf9bf429ebaa7109ae2210f4251fef829d04891140_NeikiAnalytics.exe	38
PID 2008 wrote to memory of 2780	2008	48473e63c22af3b061920fdf9bf429ebaa7109ae2210f4251fef829d04891140_NeikiAnalytics.exe	39
PID 2008 wrote to memory of 2780	2008	48473e63c22af3b061920fdf9bf429ebaa7109ae2210f4251fef829d04891140_NeikiAnalytics.exe	39
PID 2008 wrote to memory of 2780	2008	48473e63c22af3b061920fdf9bf429ebaa7109ae2210f4251fef829d04891140_NeikiAnalytics.exe	39
PID 2008 wrote to memory of 2808	2008	48473e63c22af3b061920fdf9bf429ebaa7109ae2210f4251fef829d04891140_NeikiAnalytics.exe	40
PID 2008 wrote to memory of 2808	2008	48473e63c22af3b061920fdf9bf429ebaa7109ae2210f4251fef829d04891140_NeikiAnalytics.exe	40
PID 2008 wrote to memory of 2808	2008	48473e63c22af3b061920fdf9bf429ebaa7109ae2210f4251fef829d04891140_NeikiAnalytics.exe	40
PID 2008 wrote to memory of 2916	2008	48473e63c22af3b061920fdf9bf429ebaa7109ae2210f4251fef829d04891140_NeikiAnalytics.exe	41
PID 2008 wrote to memory of 2916	2008	48473e63c22af3b061920fdf9bf429ebaa7109ae2210f4251fef829d04891140_NeikiAnalytics.exe	41
PID 2008 wrote to memory of 2916	2008	48473e63c22af3b061920fdf9bf429ebaa7109ae2210f4251fef829d04891140_NeikiAnalytics.exe	41
PID 2008 wrote to memory of 2168	2008	48473e63c22af3b061920fdf9bf429ebaa7109ae2210f4251fef829d04891140_NeikiAnalytics.exe	42
PID 2008 wrote to memory of 2168	2008	48473e63c22af3b061920fdf9bf429ebaa7109ae2210f4251fef829d04891140_NeikiAnalytics.exe	42
PID 2008 wrote to memory of 2168	2008	48473e63c22af3b061920fdf9bf429ebaa7109ae2210f4251fef829d04891140_NeikiAnalytics.exe	42
PID 2008 wrote to memory of 1968	2008	48473e63c22af3b061920fdf9bf429ebaa7109ae2210f4251fef829d04891140_NeikiAnalytics.exe	43
PID 2008 wrote to memory of 1968	2008	48473e63c22af3b061920fdf9bf429ebaa7109ae2210f4251fef829d04891140_NeikiAnalytics.exe	43
PID 2008 wrote to memory of 1968	2008	48473e63c22af3b061920fdf9bf429ebaa7109ae2210f4251fef829d04891140_NeikiAnalytics.exe	43
PID 2008 wrote to memory of 2332	2008	48473e63c22af3b061920fdf9bf429ebaa7109ae2210f4251fef829d04891140_NeikiAnalytics.exe	44
PID 2008 wrote to memory of 2332	2008	48473e63c22af3b061920fdf9bf429ebaa7109ae2210f4251fef829d04891140_NeikiAnalytics.exe	44
PID 2008 wrote to memory of 2332	2008	48473e63c22af3b061920fdf9bf429ebaa7109ae2210f4251fef829d04891140_NeikiAnalytics.exe	44
PID 2008 wrote to memory of 1900	2008	48473e63c22af3b061920fdf9bf429ebaa7109ae2210f4251fef829d04891140_NeikiAnalytics.exe	45
PID 2008 wrote to memory of 1900	2008	48473e63c22af3b061920fdf9bf429ebaa7109ae2210f4251fef829d04891140_NeikiAnalytics.exe	45
PID 2008 wrote to memory of 1900	2008	48473e63c22af3b061920fdf9bf429ebaa7109ae2210f4251fef829d04891140_NeikiAnalytics.exe	45
PID 2008 wrote to memory of 2368	2008	48473e63c22af3b061920fdf9bf429ebaa7109ae2210f4251fef829d04891140_NeikiAnalytics.exe	46
PID 2008 wrote to memory of 2368	2008	48473e63c22af3b061920fdf9bf429ebaa7109ae2210f4251fef829d04891140_NeikiAnalytics.exe	46
PID 2008 wrote to memory of 2368	2008	48473e63c22af3b061920fdf9bf429ebaa7109ae2210f4251fef829d04891140_NeikiAnalytics.exe	46
PID 2008 wrote to memory of 1956	2008	48473e63c22af3b061920fdf9bf429ebaa7109ae2210f4251fef829d04891140_NeikiAnalytics.exe	47
PID 2008 wrote to memory of 1956	2008	48473e63c22af3b061920fdf9bf429ebaa7109ae2210f4251fef829d04891140_NeikiAnalytics.exe	47
PID 2008 wrote to memory of 1956	2008	48473e63c22af3b061920fdf9bf429ebaa7109ae2210f4251fef829d04891140_NeikiAnalytics.exe	47
PID 2008 wrote to memory of 332	2008	48473e63c22af3b061920fdf9bf429ebaa7109ae2210f4251fef829d04891140_NeikiAnalytics.exe	48
PID 2008 wrote to memory of 332	2008	48473e63c22af3b061920fdf9bf429ebaa7109ae2210f4251fef829d04891140_NeikiAnalytics.exe	48
PID 2008 wrote to memory of 332	2008	48473e63c22af3b061920fdf9bf429ebaa7109ae2210f4251fef829d04891140_NeikiAnalytics.exe	48
PID 2008 wrote to memory of 2444	2008	48473e63c22af3b061920fdf9bf429ebaa7109ae2210f4251fef829d04891140_NeikiAnalytics.exe	49
PID 2008 wrote to memory of 2444	2008	48473e63c22af3b061920fdf9bf429ebaa7109ae2210f4251fef829d04891140_NeikiAnalytics.exe	49
PID 2008 wrote to memory of 2444	2008	48473e63c22af3b061920fdf9bf429ebaa7109ae2210f4251fef829d04891140_NeikiAnalytics.exe	49
PID 2008 wrote to memory of 1892	2008	48473e63c22af3b061920fdf9bf429ebaa7109ae2210f4251fef829d04891140_NeikiAnalytics.exe	50

C:\Users\Admin\AppData\Local\Temp\48473e63c22af3b061920fdf9bf429ebaa7109ae2210f4251fef829d04891140_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\48473e63c22af3b061920fdf9bf429ebaa7109ae2210f4251fef829d04891140_NeikiAnalytics.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2008
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2184
- C:\Windows\System\QNSjcxA.exe
  C:\Windows\System\QNSjcxA.exe
  2⤵
  - Executes dropped EXE
  PID:2984
- C:\Windows\System\PnehNRy.exe
  C:\Windows\System\PnehNRy.exe
  2⤵
  - Executes dropped EXE
  PID:3060
- C:\Windows\System\PTgnHuP.exe
  C:\Windows\System\PTgnHuP.exe
  2⤵
  - Executes dropped EXE
  PID:2696
- C:\Windows\System\cImECvt.exe
  C:\Windows\System\cImECvt.exe
  2⤵
  - Executes dropped EXE
  PID:2584
- C:\Windows\System\xFxUvmL.exe
  C:\Windows\System\xFxUvmL.exe
  2⤵
  - Executes dropped EXE
  PID:2800
- C:\Windows\System\ZMAApKf.exe
  C:\Windows\System\ZMAApKf.exe
  2⤵
  - Executes dropped EXE
  PID:2704
- C:\Windows\System\wDzNavQ.exe
  C:\Windows\System\wDzNavQ.exe
  2⤵
  - Executes dropped EXE
  PID:2932
- C:\Windows\System\iLWqXgu.exe
  C:\Windows\System\iLWqXgu.exe
  2⤵
  - Executes dropped EXE
  PID:2136
- C:\Windows\System\eerXBOM.exe
  C:\Windows\System\eerXBOM.exe
  2⤵
  - Executes dropped EXE
  PID:2944
- C:\Windows\System\jIiddEw.exe
  C:\Windows\System\jIiddEw.exe
  2⤵
  - Executes dropped EXE
  PID:2780
- C:\Windows\System\PPQquwB.exe
  C:\Windows\System\PPQquwB.exe
  2⤵
  - Executes dropped EXE
  PID:2808
- C:\Windows\System\vOyxCyU.exe
  C:\Windows\System\vOyxCyU.exe
  2⤵
  PID:2916
- C:\Windows\System\sqLibiS.exe
  C:\Windows\System\sqLibiS.exe
  2⤵
  - Executes dropped EXE
  PID:2168
- C:\Windows\System\XJmRZTU.exe
  C:\Windows\System\XJmRZTU.exe
  2⤵
  PID:1968
- C:\Windows\System\hyAHkar.exe
  C:\Windows\System\hyAHkar.exe
  2⤵
  - Executes dropped EXE
  PID:2332
- C:\Windows\System\ESzpyvK.exe
  C:\Windows\System\ESzpyvK.exe
  2⤵
  PID:1900
- C:\Windows\System\ALyPJQq.exe
  C:\Windows\System\ALyPJQq.exe
  2⤵
  - Executes dropped EXE
  PID:2368
- C:\Windows\System\cNCjfGz.exe
  C:\Windows\System\cNCjfGz.exe
  2⤵
  PID:1956
- C:\Windows\System\UWMVoSV.exe
  C:\Windows\System\UWMVoSV.exe
  2⤵
  - Executes dropped EXE
  PID:332
- C:\Windows\System\IlUJChg.exe
  C:\Windows\System\IlUJChg.exe
  2⤵
  PID:2444
- C:\Windows\System\ZexZYwD.exe
  C:\Windows\System\ZexZYwD.exe
  2⤵
  - Executes dropped EXE
  PID:1892
- C:\Windows\System\QUyONdw.exe
  C:\Windows\System\QUyONdw.exe
  2⤵
  PID:1440
- C:\Windows\System\qOBUmah.exe
  C:\Windows\System\qOBUmah.exe
  2⤵
  - Executes dropped EXE
  PID:636
- C:\Windows\System\nzgipwX.exe
  C:\Windows\System\nzgipwX.exe
  2⤵
  PID:2276
- C:\Windows\System\jknIshO.exe
  C:\Windows\System\jknIshO.exe
  2⤵
  - Executes dropped EXE
  PID:2004
- C:\Windows\System\tOXCuyv.exe
  C:\Windows\System\tOXCuyv.exe
  2⤵
  PID:2244
- C:\Windows\System\DvLNgjc.exe
  C:\Windows\System\DvLNgjc.exe
  2⤵
  - Executes dropped EXE
  PID:2872
- C:\Windows\System\gCwDplp.exe
  C:\Windows\System\gCwDplp.exe
  2⤵
  PID:2632
- C:\Windows\System\BMZnrUO.exe
  C:\Windows\System\BMZnrUO.exe
  2⤵
  - Executes dropped EXE
  PID:3068
- C:\Windows\System\FGjLlHt.exe
  C:\Windows\System\FGjLlHt.exe
  2⤵
  PID:1940
- C:\Windows\System\cuYWZup.exe
  C:\Windows\System\cuYWZup.exe
  2⤵
  - Executes dropped EXE
  PID:1648
- C:\Windows\System\nnrmqvB.exe
  C:\Windows\System\nnrmqvB.exe
  2⤵
  PID:780
- C:\Windows\System\LSZrbGn.exe
  C:\Windows\System\LSZrbGn.exe
  2⤵
  - Executes dropped EXE
  PID:764
- C:\Windows\System\BNuXBFA.exe
  C:\Windows\System\BNuXBFA.exe
  2⤵
  PID:576
- C:\Windows\System\xDTREXx.exe
  C:\Windows\System\xDTREXx.exe
  2⤵
  - Executes dropped EXE
  PID:1476
- C:\Windows\System\RPmGWAN.exe
  C:\Windows\System\RPmGWAN.exe
  2⤵
  PID:816
- C:\Windows\System\hDSKsZZ.exe
  C:\Windows\System\hDSKsZZ.exe
  2⤵
  - Executes dropped EXE
  PID:2180
- C:\Windows\System\rDaXpOb.exe
  C:\Windows\System\rDaXpOb.exe
  2⤵
  PID:1636
- C:\Windows\System\piIZZsR.exe
  C:\Windows\System\piIZZsR.exe
  2⤵
  - Executes dropped EXE
  PID:352
- C:\Windows\System\gVtbmZo.exe
  C:\Windows\System\gVtbmZo.exe
  2⤵
  PID:1060
- C:\Windows\System\XCYPnWe.exe
  C:\Windows\System\XCYPnWe.exe
  2⤵
  - Executes dropped EXE
  PID:2428
- C:\Windows\System\FKJffNE.exe
  C:\Windows\System\FKJffNE.exe
  2⤵
  PID:2140
- C:\Windows\System\UgIbPOD.exe
  C:\Windows\System\UgIbPOD.exe
  2⤵
  - Executes dropped EXE
  PID:2132
- C:\Windows\System\oVdsVEk.exe
  C:\Windows\System\oVdsVEk.exe
  2⤵
  PID:1384
- C:\Windows\System\nmyApdw.exe
  C:\Windows\System\nmyApdw.exe
  2⤵
  - Executes dropped EXE
  PID:1788
- C:\Windows\System\uLzSKec.exe
  C:\Windows\System\uLzSKec.exe
  2⤵
  PID:1664
- C:\Windows\System\LDppwds.exe
  C:\Windows\System\LDppwds.exe
  2⤵
  - Executes dropped EXE
  PID:1984
- C:\Windows\System\dhThQPZ.exe
  C:\Windows\System\dhThQPZ.exe
  2⤵
  PID:1360
- C:\Windows\System\WzkokLT.exe
  C:\Windows\System\WzkokLT.exe
  2⤵
  - Executes dropped EXE
  PID:1056
- C:\Windows\System\OhvHvwA.exe
  C:\Windows\System\OhvHvwA.exe
  2⤵
  PID:2260
- C:\Windows\System\eyxOsNr.exe
  C:\Windows\System\eyxOsNr.exe
  2⤵
  - Executes dropped EXE
  PID:2172
- C:\Windows\System\hsoQjqK.exe
  C:\Windows\System\hsoQjqK.exe
  2⤵
  PID:1276
- C:\Windows\System\RypjhQu.exe
  C:\Windows\System\RypjhQu.exe
  2⤵
  - Executes dropped EXE
  PID:1640
- C:\Windows\System\ROGdFTd.exe
  C:\Windows\System\ROGdFTd.exe
  2⤵
  PID:2016
- C:\Windows\System\QSbVmDI.exe
  C:\Windows\System\QSbVmDI.exe
  2⤵
  - Executes dropped EXE
  PID:1240
- C:\Windows\System\tQQVsrs.exe
  C:\Windows\System\tQQVsrs.exe
  2⤵
  PID:2884
- C:\Windows\System\LivjOue.exe
  C:\Windows\System\LivjOue.exe
  2⤵
  - Executes dropped EXE
  PID:344
- C:\Windows\System\rojdnTm.exe
  C:\Windows\System\rojdnTm.exe
  2⤵
  PID:848
- C:\Windows\System\LEImZCi.exe
  C:\Windows\System\LEImZCi.exe
  2⤵
  - Executes dropped EXE
  PID:1080
- C:\Windows\System\AGTRAfL.exe
  C:\Windows\System\AGTRAfL.exe
  2⤵
  PID:2152
- C:\Windows\System\jTwLAYI.exe
  C:\Windows\System\jTwLAYI.exe
  2⤵
  - Executes dropped EXE
  PID:1504
- C:\Windows\System\tHJdIgR.exe
  C:\Windows\System\tHJdIgR.exe
  2⤵
  PID:2908
- C:\Windows\System\Qvzwlvz.exe
  C:\Windows\System\Qvzwlvz.exe
  2⤵
  - Executes dropped EXE
  PID:3064
- C:\Windows\System\WwODYcJ.exe
  C:\Windows\System\WwODYcJ.exe
  2⤵
  PID:2388
- C:\Windows\System\QzrRuhS.exe
  C:\Windows\System\QzrRuhS.exe
  2⤵
  - Executes dropped EXE
  PID:2188
- C:\Windows\System\DVtCCqp.exe
  C:\Windows\System\DVtCCqp.exe
  2⤵
  PID:1604
- C:\Windows\System\iSRTwIn.exe
  C:\Windows\System\iSRTwIn.exe
  2⤵
  - Executes dropped EXE
  PID:1300
- C:\Windows\System\WZQlKcQ.exe
  C:\Windows\System\WZQlKcQ.exe
  2⤵
  PID:2176
- C:\Windows\System\PqhXDYh.exe
  C:\Windows\System\PqhXDYh.exe
  2⤵
  - Executes dropped EXE
  PID:3000
- C:\Windows\System\AeSrizO.exe
  C:\Windows\System\AeSrizO.exe
  2⤵
  PID:564
- C:\Windows\System\YpXuiXL.exe
  C:\Windows\System\YpXuiXL.exe
  2⤵
  - Executes dropped EXE
  PID:2076
- C:\Windows\System\gSAGoYb.exe
  C:\Windows\System\gSAGoYb.exe
  2⤵
  PID:2588
- C:\Windows\System\cEAhihQ.exe
  C:\Windows\System\cEAhihQ.exe
  2⤵
  - Executes dropped EXE
  PID:2560
- C:\Windows\System\OGkbNjg.exe
  C:\Windows\System\OGkbNjg.exe
  2⤵
  PID:2568
- C:\Windows\System\jZiSnUr.exe
  C:\Windows\System\jZiSnUr.exe
  2⤵
  - Executes dropped EXE
  PID:2976
- C:\Windows\System\WyeBTum.exe
  C:\Windows\System\WyeBTum.exe
  2⤵
  PID:1228
- C:\Windows\System\dArfeMa.exe
  C:\Windows\System\dArfeMa.exe
  2⤵
  - Executes dropped EXE
  PID:2532
- C:\Windows\System\oljucuh.exe
  C:\Windows\System\oljucuh.exe
  2⤵
  PID:2480
- C:\Windows\System\ZWSBGbO.exe
  C:\Windows\System\ZWSBGbO.exe
  2⤵
  - Executes dropped EXE
  PID:2496
- C:\Windows\System\zaXzyLo.exe
  C:\Windows\System\zaXzyLo.exe
  2⤵
  PID:340
- C:\Windows\System\kNNAIrM.exe
  C:\Windows\System\kNNAIrM.exe
  2⤵
  - Executes dropped EXE
  PID:2524
- C:\Windows\System\NulBNAm.exe
  C:\Windows\System\NulBNAm.exe
  2⤵
  PID:888
- C:\Windows\System\WaHNrTe.exe
  C:\Windows\System\WaHNrTe.exe
  2⤵
  - Executes dropped EXE
  PID:2760
- C:\Windows\System\YMPvZeg.exe
  C:\Windows\System\YMPvZeg.exe
  2⤵
  PID:596
- C:\Windows\System\uZczzuZ.exe
  C:\Windows\System\uZczzuZ.exe
  2⤵
  - Executes dropped EXE
  PID:940
- C:\Windows\System\fpCDjhb.exe
  C:\Windows\System\fpCDjhb.exe
  2⤵
  PID:2380
- C:\Windows\System\mdlgTek.exe
  C:\Windows\System\mdlgTek.exe
  2⤵
  - Executes dropped EXE
  PID:1644
- C:\Windows\System\ZKiTbyQ.exe
  C:\Windows\System\ZKiTbyQ.exe
  2⤵
  PID:1552
- C:\Windows\System\WLoyXIA.exe
  C:\Windows\System\WLoyXIA.exe
  2⤵
  - Executes dropped EXE
  PID:1028
- C:\Windows\System\OrVKQTU.exe
  C:\Windows\System\OrVKQTU.exe
  2⤵
  PID:3020
- C:\Windows\System\sAVgLBw.exe
  C:\Windows\System\sAVgLBw.exe
  2⤵
  - Executes dropped EXE
  PID:1036
- C:\Windows\System\HMsOYws.exe
  C:\Windows\System\HMsOYws.exe
  2⤵
  PID:2764
- C:\Windows\System\ChAlLjO.exe
  C:\Windows\System\ChAlLjO.exe
  2⤵
  - Executes dropped EXE
  PID:896
- C:\Windows\System\TDkzVuf.exe
  C:\Windows\System\TDkzVuf.exe
  2⤵
  PID:1600
- C:\Windows\System\MvVfrKo.exe
  C:\Windows\System\MvVfrKo.exe
  2⤵
  - Executes dropped EXE
  PID:2372
- C:\Windows\System\aRechvq.exe
  C:\Windows\System\aRechvq.exe
  2⤵
  PID:1632
- C:\Windows\System\kjmhdBT.exe
  C:\Windows\System\kjmhdBT.exe
  2⤵
  - Executes dropped EXE
  PID:2972
- C:\Windows\System\FPztCnR.exe
  C:\Windows\System\FPztCnR.exe
  2⤵
  PID:1876
- C:\Windows\System\XeiBcCX.exe
  C:\Windows\System\XeiBcCX.exe
  2⤵
  - Executes dropped EXE
  PID:1680
- C:\Windows\System\VWMaSJl.exe
  C:\Windows\System\VWMaSJl.exe
  2⤵
  PID:1828
- C:\Windows\System\PpmGpFI.exe
  C:\Windows\System\PpmGpFI.exe
  2⤵
  - Executes dropped EXE
  PID:3084
- C:\Windows\System\lTMtVuM.exe
  C:\Windows\System\lTMtVuM.exe
  2⤵
  PID:3100
- C:\Windows\System\YJirumi.exe
  C:\Windows\System\YJirumi.exe
  2⤵
  - Executes dropped EXE
  PID:3116
- C:\Windows\System\AIojXSb.exe
  C:\Windows\System\AIojXSb.exe
  2⤵
  PID:3132
- C:\Windows\System\phcNCTW.exe
  C:\Windows\System\phcNCTW.exe
  2⤵
  - Executes dropped EXE
  PID:3148
- C:\Windows\System\VYaLRrg.exe
  C:\Windows\System\VYaLRrg.exe
  2⤵
  PID:3164
- C:\Windows\System\MTBtiJF.exe
  C:\Windows\System\MTBtiJF.exe
  2⤵
  - Executes dropped EXE
  PID:3180
- C:\Windows\System\OuPtjJC.exe
  C:\Windows\System\OuPtjJC.exe
  2⤵
  PID:3196
- C:\Windows\System\iwDVcoi.exe
  C:\Windows\System\iwDVcoi.exe
  2⤵
  - Executes dropped EXE
  PID:3212
- C:\Windows\System\mEiQCSw.exe
  C:\Windows\System\mEiQCSw.exe
  2⤵
  PID:3228
- C:\Windows\System\oyXNodN.exe
  C:\Windows\System\oyXNodN.exe
  2⤵
  - Executes dropped EXE
  PID:3244
- C:\Windows\System\ybzFxtr.exe
  C:\Windows\System\ybzFxtr.exe
  2⤵
  PID:3260
- C:\Windows\System\zYIQuKi.exe
  C:\Windows\System\zYIQuKi.exe
  2⤵
  - Executes dropped EXE
  PID:3276
- C:\Windows\System\JWIikfh.exe
  C:\Windows\System\JWIikfh.exe
  2⤵
  PID:3292
- C:\Windows\System\rJOVIgv.exe
  C:\Windows\System\rJOVIgv.exe
  2⤵
  - Executes dropped EXE
  PID:3308
- C:\Windows\System\TKbGFfT.exe
  C:\Windows\System\TKbGFfT.exe
  2⤵
  PID:3324
- C:\Windows\System\nOngKMA.exe
  C:\Windows\System\nOngKMA.exe
  2⤵
  - Executes dropped EXE
  PID:3340
- C:\Windows\System\CuXBdeh.exe
  C:\Windows\System\CuXBdeh.exe
  2⤵
  PID:3356
- C:\Windows\System\MOKiZIf.exe
  C:\Windows\System\MOKiZIf.exe
  2⤵
  PID:3372
- C:\Windows\System\xKXeypn.exe
  C:\Windows\System\xKXeypn.exe
  2⤵
  PID:3388
- C:\Windows\System\iWOtGjf.exe
  C:\Windows\System\iWOtGjf.exe
  2⤵
  PID:3404
- C:\Windows\System\EnZOnjT.exe
  C:\Windows\System\EnZOnjT.exe
  2⤵
  PID:3420
- C:\Windows\System\xPSCuDh.exe
  C:\Windows\System\xPSCuDh.exe
  2⤵
  PID:3436
- C:\Windows\System\zlxKgQV.exe
  C:\Windows\System\zlxKgQV.exe
  2⤵
  PID:3452
- C:\Windows\System\DDlFMMu.exe
  C:\Windows\System\DDlFMMu.exe
  2⤵
  PID:3468
- C:\Windows\System\XeRCFtW.exe
  C:\Windows\System\XeRCFtW.exe
  2⤵
  PID:3484
- C:\Windows\System\qKVftjr.exe
  C:\Windows\System\qKVftjr.exe
  2⤵
  PID:3500
- C:\Windows\System\JsZPaOh.exe
  C:\Windows\System\JsZPaOh.exe
  2⤵
  PID:3516
- C:\Windows\System\vukyncf.exe
  C:\Windows\System\vukyncf.exe
  2⤵
  PID:3532
- C:\Windows\System\CKfwGIY.exe
  C:\Windows\System\CKfwGIY.exe
  2⤵
  PID:3548
- C:\Windows\System\HUFQoAz.exe
  C:\Windows\System\HUFQoAz.exe
  2⤵
  PID:3564
- C:\Windows\System\DzmVpoR.exe
  C:\Windows\System\DzmVpoR.exe
  2⤵
  PID:3580
- C:\Windows\System\VaxFqSw.exe
  C:\Windows\System\VaxFqSw.exe
  2⤵
  PID:3596
- C:\Windows\System\kkYcQbA.exe
  C:\Windows\System\kkYcQbA.exe
  2⤵
  PID:3612
- C:\Windows\System\ngzpUKI.exe
  C:\Windows\System\ngzpUKI.exe
  2⤵
  PID:3628
- C:\Windows\System\ntNehZN.exe
  C:\Windows\System\ntNehZN.exe
  2⤵
  PID:3644
- C:\Windows\System\KKShGEQ.exe
  C:\Windows\System\KKShGEQ.exe
  2⤵
  PID:3660
- C:\Windows\System\EOAdtUg.exe
  C:\Windows\System\EOAdtUg.exe
  2⤵
  PID:3676
- C:\Windows\System\gWyHkNq.exe
  C:\Windows\System\gWyHkNq.exe
  2⤵
  PID:3692
- C:\Windows\System\wUWDypr.exe
  C:\Windows\System\wUWDypr.exe
  2⤵
  PID:3708
- C:\Windows\System\buGwBHa.exe
  C:\Windows\System\buGwBHa.exe
  2⤵
  PID:3724
- C:\Windows\System\hfMRYUs.exe
  C:\Windows\System\hfMRYUs.exe
  2⤵
  PID:3740
- C:\Windows\System\NHtVQvE.exe
  C:\Windows\System\NHtVQvE.exe
  2⤵
  PID:3756
- C:\Windows\System\hOyhykC.exe
  C:\Windows\System\hOyhykC.exe
  2⤵
  PID:3772
- C:\Windows\System\XwGDJRA.exe
  C:\Windows\System\XwGDJRA.exe
  2⤵
  PID:3788
- C:\Windows\System\nSzwODN.exe
  C:\Windows\System\nSzwODN.exe
  2⤵
  PID:4128
- C:\Windows\System\ZhNsiid.exe
  C:\Windows\System\ZhNsiid.exe
  2⤵
  PID:4144
- C:\Windows\System\HVPnmHv.exe
  C:\Windows\System\HVPnmHv.exe
  2⤵
  PID:4160
- C:\Windows\System\kWmFiEL.exe
  C:\Windows\System\kWmFiEL.exe
  2⤵
  PID:4184
- C:\Windows\System\usMbOPs.exe
  C:\Windows\System\usMbOPs.exe
  2⤵
  PID:4208
- C:\Windows\System\WuqHjZx.exe
  C:\Windows\System\WuqHjZx.exe
  2⤵
  PID:4224
- C:\Windows\System\YfndIAe.exe
  C:\Windows\System\YfndIAe.exe
  2⤵
  PID:4240
- C:\Windows\System\JvCJcmc.exe
  C:\Windows\System\JvCJcmc.exe
  2⤵
  PID:4320
- C:\Windows\System\tbyutWV.exe
  C:\Windows\System\tbyutWV.exe
  2⤵
  PID:4344
- C:\Windows\System\LdGiCpT.exe
  C:\Windows\System\LdGiCpT.exe
  2⤵
  PID:4404
- C:\Windows\System\mCtUQzW.exe
  C:\Windows\System\mCtUQzW.exe
  2⤵
  PID:4436
- C:\Windows\System\ddyYLMX.exe
  C:\Windows\System\ddyYLMX.exe
  2⤵
  PID:4468
- C:\Windows\System\haCOvEz.exe
  C:\Windows\System\haCOvEz.exe
  2⤵
  PID:4512
- C:\Windows\System\wwjFiFt.exe
  C:\Windows\System\wwjFiFt.exe
  2⤵
  PID:4548
- C:\Windows\System\njoiVVz.exe
  C:\Windows\System\njoiVVz.exe
  2⤵
  PID:4576
- C:\Windows\System\FgkVYox.exe
  C:\Windows\System\FgkVYox.exe
  2⤵
  PID:4612
- C:\Windows\System\GoCLalz.exe
  C:\Windows\System\GoCLalz.exe
  2⤵
  PID:4660
- C:\Windows\System\jovqAqO.exe
  C:\Windows\System\jovqAqO.exe
  2⤵
  PID:4700
- C:\Windows\System\ZTjpTZv.exe
  C:\Windows\System\ZTjpTZv.exe
  2⤵
  PID:4744
- C:\Windows\System\DvpHTOn.exe
  C:\Windows\System\DvpHTOn.exe
  2⤵
  PID:4788
- C:\Windows\System\RkydeiH.exe
  C:\Windows\System\RkydeiH.exe
  2⤵
  PID:4812
- C:\Windows\System\zFdrwrr.exe
  C:\Windows\System\zFdrwrr.exe
  2⤵
  PID:4844
- C:\Windows\System\OuDzIoH.exe
  C:\Windows\System\OuDzIoH.exe
  2⤵
  PID:4884
- C:\Windows\System\OIAmyvx.exe
  C:\Windows\System\OIAmyvx.exe
  2⤵
  PID:4908
- C:\Windows\System\zqynimV.exe
  C:\Windows\System\zqynimV.exe
  2⤵
  PID:4924
- C:\Windows\System\KxIYtpc.exe
  C:\Windows\System\KxIYtpc.exe
  2⤵
  PID:4948
- C:\Windows\System\EQiRHla.exe
  C:\Windows\System\EQiRHla.exe
  2⤵
  PID:4968
- C:\Windows\System\TNbbDIp.exe
  C:\Windows\System\TNbbDIp.exe
  2⤵
  PID:4984
- C:\Windows\System\vmqUriX.exe
  C:\Windows\System\vmqUriX.exe
  2⤵
  PID:5004
- C:\Windows\System\mSngKVk.exe
  C:\Windows\System\mSngKVk.exe
  2⤵
  PID:5024
- C:\Windows\System\YUmlrZB.exe
  C:\Windows\System\YUmlrZB.exe
  2⤵
  PID:5044
- C:\Windows\System\sOgOGDM.exe
  C:\Windows\System\sOgOGDM.exe
  2⤵
  PID:5068
- C:\Windows\System\TVrQhif.exe
  C:\Windows\System\TVrQhif.exe
  2⤵
  PID:5084
- C:\Windows\System\BoRBnvA.exe
  C:\Windows\System\BoRBnvA.exe
  2⤵
  PID:5104
- C:\Windows\System\RlzJRLT.exe
  C:\Windows\System\RlzJRLT.exe
  2⤵
  PID:3796
- C:\Windows\System\uhdAXui.exe
  C:\Windows\System\uhdAXui.exe
  2⤵
  PID:1232
- C:\Windows\System\DPowzsg.exe
  C:\Windows\System\DPowzsg.exe
  2⤵
  PID:3904
- C:\Windows\System\sTVulFY.exe
  C:\Windows\System\sTVulFY.exe
  2⤵
  PID:3924
- C:\Windows\System\LzJbzYk.exe
  C:\Windows\System\LzJbzYk.exe
  2⤵
  PID:3980
- C:\Windows\System\pjGJorm.exe
  C:\Windows\System\pjGJorm.exe
  2⤵
  PID:3996
- C:\Windows\System\gIaUiAB.exe
  C:\Windows\System\gIaUiAB.exe
  2⤵
  PID:4012
- C:\Windows\System\ISeLvFa.exe
  C:\Windows\System\ISeLvFa.exe
  2⤵
  PID:4032
- C:\Windows\System\VAIdpMC.exe
  C:\Windows\System\VAIdpMC.exe
  2⤵
  PID:4052
- C:\Windows\System\AzYUQNB.exe
  C:\Windows\System\AzYUQNB.exe
  2⤵
  PID:4076
- C:\Windows\System\wpgCcMp.exe
  C:\Windows\System\wpgCcMp.exe
  2⤵
  PID:4092
- C:\Windows\System\oqPFLxO.exe
  C:\Windows\System\oqPFLxO.exe
  2⤵
  PID:1324
- C:\Windows\System\jiaUDej.exe
  C:\Windows\System\jiaUDej.exe
  2⤵
  PID:1592
- C:\Windows\System\yemFxOO.exe
  C:\Windows\System\yemFxOO.exe
  2⤵
  PID:2376
- C:\Windows\System\dbDmKPt.exe
  C:\Windows\System\dbDmKPt.exe
  2⤵
  PID:3128
- C:\Windows\System\FhrhowI.exe
  C:\Windows\System\FhrhowI.exe
  2⤵
  PID:3192
- C:\Windows\System\hDCLxLg.exe
  C:\Windows\System\hDCLxLg.exe
  2⤵
  PID:3256
- C:\Windows\System\KUjghSo.exe
  C:\Windows\System\KUjghSo.exe
  2⤵
  PID:2864
- C:\Windows\System\eMTzUeB.exe
  C:\Windows\System\eMTzUeB.exe
  2⤵
  PID:988
- C:\Windows\System\JcoKfUH.exe
  C:\Windows\System\JcoKfUH.exe
  2⤵
  PID:4204
- C:\Windows\System\jvlWBMP.exe
  C:\Windows\System\jvlWBMP.exe
  2⤵
  PID:4192
- C:\Windows\System\bfAKTNi.exe
  C:\Windows\System\bfAKTNi.exe
  2⤵
  PID:2664
- C:\Windows\System\KNHLolh.exe
  C:\Windows\System\KNHLolh.exe
  2⤵
  PID:2460
- C:\Windows\System\PWgLBQJ.exe
  C:\Windows\System\PWgLBQJ.exe
  2⤵
  PID:1684
- C:\Windows\System\RXvXnfX.exe
  C:\Windows\System\RXvXnfX.exe
  2⤵
  PID:108
- C:\Windows\System\XybVEwb.exe
  C:\Windows\System\XybVEwb.exe
  2⤵
  PID:1120
- C:\Windows\System\JRWSWGC.exe
  C:\Windows\System\JRWSWGC.exe
  2⤵
  PID:648
- C:\Windows\System\oOELhDM.exe
  C:\Windows\System\oOELhDM.exe
  2⤵
  PID:2868
- C:\Windows\System\wwQrFPo.exe
  C:\Windows\System\wwQrFPo.exe
  2⤵
  PID:3652
- C:\Windows\System\uNrFUqg.exe
  C:\Windows\System\uNrFUqg.exe
  2⤵
  PID:2264
- C:\Windows\System\gVXbDsq.exe
  C:\Windows\System\gVXbDsq.exe
  2⤵
  PID:1992
- C:\Windows\System\CfNEpeg.exe
  C:\Windows\System\CfNEpeg.exe
  2⤵
  PID:2192
- C:\Windows\System\TvsGZbQ.exe
  C:\Windows\System\TvsGZbQ.exe
  2⤵
  PID:3012
- C:\Windows\System\kPXEFse.exe
  C:\Windows\System\kPXEFse.exe
  2⤵
  PID:2472
- C:\Windows\System\sgilKpV.exe
  C:\Windows\System\sgilKpV.exe
  2⤵
  PID:1652
- C:\Windows\System\CADbPLm.exe
  C:\Windows\System\CADbPLm.exe
  2⤵
  PID:3560
- C:\Windows\System\ZoKqeIE.exe
  C:\Windows\System\ZoKqeIE.exe
  2⤵
  PID:3496
- C:\Windows\System\zRgCGsq.exe
  C:\Windows\System\zRgCGsq.exe
  2⤵
  PID:3432
- C:\Windows\System\tGOeXub.exe
  C:\Windows\System\tGOeXub.exe
  2⤵
  PID:3368
- C:\Windows\System\XNpldqs.exe
  C:\Windows\System\XNpldqs.exe
  2⤵
  PID:3304
- C:\Windows\System\xbOAOUu.exe
  C:\Windows\System\xbOAOUu.exe
  2⤵
  PID:3236
- C:\Windows\System\VgfOLxM.exe
  C:\Windows\System\VgfOLxM.exe
  2⤵
  PID:3172
- C:\Windows\System\GeQCrtm.exe
  C:\Windows\System\GeQCrtm.exe
  2⤵
  PID:3080
- C:\Windows\System\TXOqPHF.exe
  C:\Windows\System\TXOqPHF.exe
  2⤵
  PID:1428
- C:\Windows\System\tjlQwrx.exe
  C:\Windows\System\tjlQwrx.exe
  2⤵
  PID:2892
- C:\Windows\System\CTenpCq.exe
  C:\Windows\System\CTenpCq.exe
  2⤵
  PID:1340
- C:\Windows\System\AMYlmVp.exe
  C:\Windows\System\AMYlmVp.exe
  2⤵
  PID:2092
- C:\Windows\System\cwjzcvd.exe
  C:\Windows\System\cwjzcvd.exe
  2⤵
  PID:668
- C:\Windows\System\gRTeigY.exe
  C:\Windows\System\gRTeigY.exe
  2⤵
  PID:2548
- C:\Windows\System\UzeLvEf.exe
  C:\Windows\System\UzeLvEf.exe
  2⤵
  PID:4352
- C:\Windows\System\iyFLVIZ.exe
  C:\Windows\System\iyFLVIZ.exe
  2⤵
  PID:4372
- C:\Windows\System\SSpRNjK.exe
  C:\Windows\System\SSpRNjK.exe
  2⤵
  PID:4384
- C:\Windows\System\xokAIjk.exe
  C:\Windows\System\xokAIjk.exe
  2⤵
  PID:2744
- C:\Windows\System\MpwxIeW.exe
  C:\Windows\System\MpwxIeW.exe
  2⤵
  PID:2940
- C:\Windows\System\WXFfrSu.exe
  C:\Windows\System\WXFfrSu.exe
  2⤵
  PID:4392
- C:\Windows\System\WzGqoCs.exe
  C:\Windows\System\WzGqoCs.exe
  2⤵
  PID:4432
- C:\Windows\System\NUWaRpl.exe
  C:\Windows\System\NUWaRpl.exe
  2⤵
  PID:4444
- C:\Windows\System\idNMRZI.exe
  C:\Windows\System\idNMRZI.exe
  2⤵
  PID:4460
- C:\Windows\System\fhKCmAJ.exe
  C:\Windows\System\fhKCmAJ.exe
  2⤵
  PID:4488
- C:\Windows\System\DzuZlcF.exe
  C:\Windows\System\DzuZlcF.exe
  2⤵
  PID:2272
- C:\Windows\System\sEDFsuQ.exe
  C:\Windows\System\sEDFsuQ.exe
  2⤵
  PID:4508
- C:\Windows\System\MxCbDYw.exe
  C:\Windows\System\MxCbDYw.exe
  2⤵
  PID:412
- C:\Windows\System\ukobWPO.exe
  C:\Windows\System\ukobWPO.exe
  2⤵
  PID:1492
- C:\Windows\System\sSKZqXN.exe
  C:\Windows\System\sSKZqXN.exe
  2⤵
  PID:1048
- C:\Windows\System\WxUeebO.exe
  C:\Windows\System\WxUeebO.exe
  2⤵
  PID:4564
- C:\Windows\System\jPZBEYh.exe
  C:\Windows\System\jPZBEYh.exe
  2⤵
  PID:2504
- C:\Windows\System\vmTtvKW.exe
  C:\Windows\System\vmTtvKW.exe
  2⤵
  PID:1868
- C:\Windows\System\UhsYiAf.exe
  C:\Windows\System\UhsYiAf.exe
  2⤵
  PID:4588
- C:\Windows\System\jzmJYAA.exe
  C:\Windows\System\jzmJYAA.exe
  2⤵
  PID:812
- C:\Windows\System\vZXIrpw.exe
  C:\Windows\System\vZXIrpw.exe
  2⤵
  PID:2628
- C:\Windows\System\pNlDOys.exe
  C:\Windows\System\pNlDOys.exe
  2⤵
  PID:4640
- C:\Windows\System\ybcMbAK.exe
  C:\Windows\System\ybcMbAK.exe
  2⤵
  PID:560
- C:\Windows\System\MFTSonq.exe
  C:\Windows\System\MFTSonq.exe
  2⤵
  PID:4656
- C:\Windows\System\XauSQcl.exe
  C:\Windows\System\XauSQcl.exe
  2⤵
  PID:4668
- C:\Windows\System\ZRBkMCb.exe
  C:\Windows\System\ZRBkMCb.exe
  2⤵
  PID:4696
- C:\Windows\System\RTCEiTn.exe
  C:\Windows\System\RTCEiTn.exe
  2⤵
  PID:4692
- C:\Windows\System\yUBIUMx.exe
  C:\Windows\System\yUBIUMx.exe
  2⤵
  PID:4724
- C:\Windows\System\sDQuVgE.exe
  C:\Windows\System\sDQuVgE.exe
  2⤵
  PID:4712
- C:\Windows\System\HuDoCbZ.exe
  C:\Windows\System\HuDoCbZ.exe
  2⤵
  PID:4760
- C:\Windows\System\dGhuYmG.exe
  C:\Windows\System\dGhuYmG.exe
  2⤵
  PID:4796
- C:\Windows\System\iXyOriL.exe
  C:\Windows\System\iXyOriL.exe
  2⤵
  PID:4780
- C:\Windows\System\cyfCYqp.exe
  C:\Windows\System\cyfCYqp.exe
  2⤵
  PID:4820
- C:\Windows\System\oMGUCkA.exe
  C:\Windows\System\oMGUCkA.exe
  2⤵
  PID:4864
- C:\Windows\System\AuKNweO.exe
  C:\Windows\System\AuKNweO.exe
  2⤵
  PID:4832
- C:\Windows\System\ZcXvdHe.exe
  C:\Windows\System\ZcXvdHe.exe
  2⤵
  PID:2384
- C:\Windows\System\kszepSj.exe
  C:\Windows\System\kszepSj.exe
  2⤵
  PID:4900
- C:\Windows\System\LcpJPgf.exe
  C:\Windows\System\LcpJPgf.exe
  2⤵
  PID:4920
- C:\Windows\System\XtKQprJ.exe
  C:\Windows\System\XtKQprJ.exe
  2⤵
  PID:4964
- C:\Windows\System\GnlqRUZ.exe
  C:\Windows\System\GnlqRUZ.exe
  2⤵
  PID:2576
- C:\Windows\System\JyuruWp.exe
  C:\Windows\System\JyuruWp.exe
  2⤵
  PID:2476
- C:\Windows\System\lhRhWCr.exe
  C:\Windows\System\lhRhWCr.exe
  2⤵
  PID:5080
- C:\Windows\System\vFhPThH.exe
  C:\Windows\System\vFhPThH.exe
  2⤵
  PID:5112
- C:\Windows\System\YupFTuT.exe
  C:\Windows\System\YupFTuT.exe
  2⤵
  PID:3880
- C:\Windows\System\IDJgAyF.exe
  C:\Windows\System\IDJgAyF.exe
  2⤵
  PID:4044
- C:\Windows\System\VzWGMdf.exe
  C:\Windows\System\VzWGMdf.exe
  2⤵
  PID:2672
- C:\Windows\System\QcQssPw.exe
  C:\Windows\System\QcQssPw.exe
  2⤵
  PID:1764
- C:\Windows\System\aWZOxvs.exe
  C:\Windows\System\aWZOxvs.exe
  2⤵
  PID:1668
- C:\Windows\System\FTyrwld.exe
  C:\Windows\System\FTyrwld.exe
  2⤵
  PID:2304
- C:\Windows\System\vxUUwar.exe
  C:\Windows\System\vxUUwar.exe
  2⤵
  PID:1172
- C:\Windows\System\tXZOSEF.exe
  C:\Windows\System\tXZOSEF.exe
  2⤵
  PID:2848
- C:\Windows\System\QgAEmpD.exe
  C:\Windows\System\QgAEmpD.exe
  2⤵
  PID:600
- C:\Windows\System\lHnCOwg.exe
  C:\Windows\System\lHnCOwg.exe
  2⤵
  PID:680
- C:\Windows\System\HptmXKi.exe
  C:\Windows\System\HptmXKi.exe
  2⤵
  PID:1872
- C:\Windows\System\FoPfHLl.exe
  C:\Windows\System\FoPfHLl.exe
  2⤵
  PID:3688
- C:\Windows\System\TAIKSdh.exe
  C:\Windows\System\TAIKSdh.exe
  2⤵
  PID:3752
- C:\Windows\System\fzaIWwa.exe
  C:\Windows\System\fzaIWwa.exe
  2⤵
  PID:4168
- C:\Windows\System\vbDVotv.exe
  C:\Windows\System\vbDVotv.exe
  2⤵
  PID:4220
- C:\Windows\System\WqxwBtM.exe
  C:\Windows\System\WqxwBtM.exe
  2⤵
  PID:3268
- C:\Windows\System\NewmaPP.exe
  C:\Windows\System\NewmaPP.exe
  2⤵
  PID:3528
- C:\Windows\System\SDhbPTR.exe
  C:\Windows\System\SDhbPTR.exe
  2⤵
  PID:3804
- C:\Windows\System\gPwLqms.exe
  C:\Windows\System\gPwLqms.exe
  2⤵
  PID:3108
- C:\Windows\System\fIFAfdl.exe
  C:\Windows\System\fIFAfdl.exe
  2⤵
  PID:1756
- C:\Windows\System\PUDFeOo.exe
  C:\Windows\System\PUDFeOo.exe
  2⤵
  PID:4364
- C:\Windows\System\DLCUokM.exe
  C:\Windows\System\DLCUokM.exe
  2⤵
  PID:3588
- C:\Windows\System\eVFnGed.exe
  C:\Windows\System\eVFnGed.exe
  2⤵
  PID:3204
- C:\Windows\System\AYBVnFL.exe
  C:\Windows\System\AYBVnFL.exe
  2⤵
  PID:2968
- C:\Windows\System\agbYMDR.exe
  C:\Windows\System\agbYMDR.exe
  2⤵
  PID:4400
- C:\Windows\System\JflevcS.exe
  C:\Windows\System\JflevcS.exe
  2⤵
  PID:4476
- C:\Windows\System\XXGDcXM.exe
  C:\Windows\System\XXGDcXM.exe
  2⤵
  PID:2580
- C:\Windows\System\fvzZqoI.exe
  C:\Windows\System\fvzZqoI.exe
  2⤵
  PID:4596
- C:\Windows\System\qwSSXXD.exe
  C:\Windows\System\qwSSXXD.exe
  2⤵
  PID:2256
- C:\Windows\System\nYmJbPs.exe
  C:\Windows\System\nYmJbPs.exe
  2⤵
  PID:1748
- C:\Windows\System\vtnemmV.exe
  C:\Windows\System\vtnemmV.exe
  2⤵
  PID:4776
- C:\Windows\System\QBnNOmJ.exe
  C:\Windows\System\QBnNOmJ.exe
  2⤵
  PID:4876
- C:\Windows\System\JDqOkEr.exe
  C:\Windows\System\JDqOkEr.exe
  2⤵
  PID:2724
- C:\Windows\System\wRIFGAf.exe
  C:\Windows\System\wRIFGAf.exe
  2⤵
  PID:3620
- C:\Windows\System\eOMGzSd.exe
  C:\Windows\System\eOMGzSd.exe
  2⤵
  PID:1952
- C:\Windows\System\OmaZMRz.exe
  C:\Windows\System\OmaZMRz.exe
  2⤵
  PID:2728
- C:\Windows\System\aPpuxuP.exe
  C:\Windows\System\aPpuxuP.exe
  2⤵
  PID:4464
- C:\Windows\System\hFjhwcl.exe
  C:\Windows\System\hFjhwcl.exe
  2⤵
  PID:4528
- C:\Windows\System\HJGYEaa.exe
  C:\Windows\System\HJGYEaa.exe
  2⤵
  PID:2992
- C:\Windows\System\vstXmLa.exe
  C:\Windows\System\vstXmLa.exe
  2⤵
  PID:5052
- C:\Windows\System\gPNqJaS.exe
  C:\Windows\System\gPNqJaS.exe
  2⤵
  PID:5096
- C:\Windows\System\BAskIvV.exe
  C:\Windows\System\BAskIvV.exe
  2⤵
  PID:3900
- C:\Windows\System\DxiBseP.exe
  C:\Windows\System\DxiBseP.exe
  2⤵
  PID:3124
- C:\Windows\System\gPGcjIE.exe
  C:\Windows\System\gPGcjIE.exe
  2⤵
  PID:4024
- C:\Windows\System\CPwNYOU.exe
  C:\Windows\System\CPwNYOU.exe
  2⤵
  PID:3932
- C:\Windows\System\owbBDzZ.exe
  C:\Windows\System\owbBDzZ.exe
  2⤵
  PID:3960
- C:\Windows\System\yaqHiYM.exe
  C:\Windows\System\yaqHiYM.exe
  2⤵
  PID:3992
- C:\Windows\System\qVySQkT.exe
  C:\Windows\System\qVySQkT.exe
  2⤵
  PID:2612
- C:\Windows\System\DxYMkmr.exe
  C:\Windows\System\DxYMkmr.exe
  2⤵
  PID:2500
- C:\Windows\System\CiAdeQR.exe
  C:\Windows\System\CiAdeQR.exe
  2⤵
  PID:4248
- C:\Windows\System\ihsqBxv.exe
  C:\Windows\System\ihsqBxv.exe
  2⤵
  PID:3160
- C:\Windows\System\flwvXVM.exe
  C:\Windows\System\flwvXVM.exe
  2⤵
  PID:1676
- C:\Windows\System\SdelSjT.exe
  C:\Windows\System\SdelSjT.exe
  2⤵
  PID:2660
- C:\Windows\System\EXLRKcW.exe
  C:\Windows\System\EXLRKcW.exe
  2⤵
  PID:2224
- C:\Windows\System\COOUNdt.exe
  C:\Windows\System\COOUNdt.exe
  2⤵
  PID:1888
- C:\Windows\System\OFEGPuL.exe
  C:\Windows\System\OFEGPuL.exe
  2⤵
  PID:1620
- C:\Windows\System\lYYDJQx.exe
  C:\Windows\System\lYYDJQx.exe
  2⤵
  PID:2240
- C:\Windows\System\hencSmG.exe
  C:\Windows\System\hencSmG.exe
  2⤵
  PID:4216
- C:\Windows\System\wimvyTd.exe
  C:\Windows\System\wimvyTd.exe
  2⤵
  PID:4312
- C:\Windows\System\hrJdRkl.exe
  C:\Windows\System\hrJdRkl.exe
  2⤵
  PID:2640
- C:\Windows\System\zMPiNEK.exe
  C:\Windows\System\zMPiNEK.exe
  2⤵
  PID:4536
- C:\Windows\System\IERggAb.exe
  C:\Windows\System\IERggAb.exe
  2⤵
  PID:4880
- C:\Windows\System\xRhaXRW.exe
  C:\Windows\System\xRhaXRW.exe
  2⤵
  PID:4752
- C:\Windows\System\SeZuKTo.exe
  C:\Windows\System\SeZuKTo.exe
  2⤵
  PID:4976
- C:\Windows\System\iPETWHL.exe
  C:\Windows\System\iPETWHL.exe
  2⤵
  PID:4424
- C:\Windows\System\ilbyqRe.exe
  C:\Windows\System\ilbyqRe.exe
  2⤵
  PID:4592
- C:\Windows\System\VoTFsMU.exe
  C:\Windows\System\VoTFsMU.exe
  2⤵
  PID:4496
- C:\Windows\System\QsxouNg.exe
  C:\Windows\System\QsxouNg.exe
  2⤵
  PID:584
- C:\Windows\System\YJmRXBz.exe
  C:\Windows\System\YJmRXBz.exe
  2⤵
  PID:4732
- C:\Windows\System\RRAVqzV.exe
  C:\Windows\System\RRAVqzV.exe
  2⤵
  PID:4772
- C:\Windows\System\UjfeIOp.exe
  C:\Windows\System\UjfeIOp.exe
  2⤵
  PID:5020
- C:\Windows\System\EvzvulS.exe
  C:\Windows\System\EvzvulS.exe
  2⤵
  PID:5056
- C:\Windows\System\gjFZHTj.exe
  C:\Windows\System\gjFZHTj.exe
  2⤵
  PID:4048
- C:\Windows\System\DnrLoIY.exe
  C:\Windows\System\DnrLoIY.exe
  2⤵
  PID:2740
- C:\Windows\System\WumzYoB.exe
  C:\Windows\System\WumzYoB.exe
  2⤵
  PID:3288
- C:\Windows\System\wmQGViv.exe
  C:\Windows\System\wmQGViv.exe
  2⤵
  PID:3952
- C:\Windows\System\QSmODBj.exe
  C:\Windows\System\QSmODBj.exe
  2⤵
  PID:3988
- C:\Windows\System\fwkHBgY.exe
  C:\Windows\System\fwkHBgY.exe
  2⤵
  PID:2652
- C:\Windows\System\vFLyDcL.exe
  C:\Windows\System\vFLyDcL.exe
  2⤵
  PID:772
- C:\Windows\System\kHlNdVF.exe
  C:\Windows\System\kHlNdVF.exe
  2⤵
  PID:1020
- C:\Windows\System\nBaJpom.exe
  C:\Windows\System\nBaJpom.exe
  2⤵
  PID:2964
- C:\Windows\System\OskRAfo.exe
  C:\Windows\System\OskRAfo.exe
  2⤵
  PID:1584
- C:\Windows\System\WVbVdcA.exe
  C:\Windows\System\WVbVdcA.exe
  2⤵
  PID:1820
- C:\Windows\System\PcmFPsW.exe
  C:\Windows\System\PcmFPsW.exe
  2⤵
  PID:3720
- C:\Windows\System\tYHGFra.exe
  C:\Windows\System\tYHGFra.exe
  2⤵
  PID:4336
- C:\Windows\System\QtBhEIl.exe
  C:\Windows\System\QtBhEIl.exe
  2⤵
  PID:4672
- C:\Windows\System\KmtagHo.exe
  C:\Windows\System\KmtagHo.exe
  2⤵
  PID:2228
- C:\Windows\System\xQlUuQQ.exe
  C:\Windows\System\xQlUuQQ.exe
  2⤵
  PID:4644
- C:\Windows\System\VgahPcD.exe
  C:\Windows\System\VgahPcD.exe
  2⤵
  PID:4768
- C:\Windows\System\lWvlYKF.exe
  C:\Windows\System\lWvlYKF.exe
  2⤵
  PID:4716
- C:\Windows\System\yHNgNle.exe
  C:\Windows\System\yHNgNle.exe
  2⤵
  PID:4800
- C:\Windows\System\WHWwjTB.exe
  C:\Windows\System\WHWwjTB.exe
  2⤵
  PID:2528
- C:\Windows\System\PaybcJv.exe
  C:\Windows\System\PaybcJv.exe
  2⤵
  PID:1188
- C:\Windows\System\uaFFdrv.exe
  C:\Windows\System\uaFFdrv.exe
  2⤵
  PID:2900
- C:\Windows\System\JskGowc.exe
  C:\Windows\System\JskGowc.exe
  2⤵
  PID:3964
- C:\Windows\System\ARdSozn.exe
  C:\Windows\System\ARdSozn.exe
  2⤵
  PID:3916
- C:\Windows\System\MrSumHB.exe
  C:\Windows\System\MrSumHB.exe
  2⤵
  PID:2856
- C:\Windows\System\NrfNrdV.exe
  C:\Windows\System\NrfNrdV.exe
  2⤵
  PID:4636
- C:\Windows\System\puBBmPC.exe
  C:\Windows\System\puBBmPC.exe
  2⤵
  PID:3748
- C:\Windows\System\XFTrWAH.exe
  C:\Windows\System\XFTrWAH.exe
  2⤵
  PID:3336
- C:\Windows\System\Rxdegse.exe
  C:\Windows\System\Rxdegse.exe
  2⤵
  PID:3592
- C:\Windows\System\zaVMmeR.exe
  C:\Windows\System\zaVMmeR.exe
  2⤵
  PID:4504
- C:\Windows\System\ZxiJrhr.exe
  C:\Windows\System\ZxiJrhr.exe
  2⤵
  PID:4836
- C:\Windows\System\jBnEVEz.exe
  C:\Windows\System\jBnEVEz.exe
  2⤵
  PID:2516
- C:\Windows\System\CkGLyAA.exe
  C:\Windows\System\CkGLyAA.exe
  2⤵
  PID:4936
- C:\Windows\System\jMDLKCC.exe
  C:\Windows\System\jMDLKCC.exe
  2⤵
  PID:2452
- C:\Windows\System\hnNhDSy.exe
  C:\Windows\System\hnNhDSy.exe
  2⤵
  PID:4996
- C:\Windows\System\jSMCSHp.exe
  C:\Windows\System\jSMCSHp.exe
  2⤵
  PID:3140
- C:\Windows\System\TRyLlQV.exe
  C:\Windows\System\TRyLlQV.exe
  2⤵
  PID:4628
- C:\Windows\System\SRgRGtz.exe
  C:\Windows\System\SRgRGtz.exe
  2⤵
  PID:5016
- C:\Windows\System\aZWaCIe.exe
  C:\Windows\System\aZWaCIe.exe
  2⤵
  PID:4944
- C:\Windows\System\xKdhAVH.exe
  C:\Windows\System\xKdhAVH.exe
  2⤵
  PID:2820
- C:\Windows\System\sRnGZkh.exe
  C:\Windows\System\sRnGZkh.exe
  2⤵
  PID:4020
- C:\Windows\System\OmpEgvR.exe
  C:\Windows\System\OmpEgvR.exe
  2⤵
  PID:2488
- C:\Windows\System\uwbcORL.exe
  C:\Windows\System\uwbcORL.exe
  2⤵
  PID:4860
- C:\Windows\System\DAHJHYD.exe
  C:\Windows\System\DAHJHYD.exe
  2⤵
  PID:4572
- C:\Windows\System\RIQMUvb.exe
  C:\Windows\System\RIQMUvb.exe
  2⤵
  PID:5128
- C:\Windows\System\QBfFKSK.exe
  C:\Windows\System\QBfFKSK.exe
  2⤵
  PID:5144
- C:\Windows\System\DNjdHqC.exe
  C:\Windows\System\DNjdHqC.exe
  2⤵
  PID:5160
- C:\Windows\System\mYokwSF.exe
  C:\Windows\System\mYokwSF.exe
  2⤵
  PID:5176
- C:\Windows\System\FyLJsMc.exe
  C:\Windows\System\FyLJsMc.exe
  2⤵
  PID:5192
- C:\Windows\System\gaZCYko.exe
  C:\Windows\System\gaZCYko.exe
  2⤵
  PID:5208
- C:\Windows\System\pQcyVqv.exe
  C:\Windows\System\pQcyVqv.exe
  2⤵
  PID:5292
- C:\Windows\System\QuGRWXW.exe
  C:\Windows\System\QuGRWXW.exe
  2⤵
  PID:5308
- C:\Windows\System\BCGOKMe.exe
  C:\Windows\System\BCGOKMe.exe
  2⤵
  PID:5324
- C:\Windows\System\sDFGSQY.exe
  C:\Windows\System\sDFGSQY.exe
  2⤵
  PID:5348
- C:\Windows\System\wnjmQsN.exe
  C:\Windows\System\wnjmQsN.exe
  2⤵
  PID:5364
- C:\Windows\System\SDxuAEo.exe
  C:\Windows\System\SDxuAEo.exe
  2⤵
  PID:5380
- C:\Windows\System\PpWaNIl.exe
  C:\Windows\System\PpWaNIl.exe
  2⤵
  PID:5396
- C:\Windows\System\CBfMwAG.exe
  C:\Windows\System\CBfMwAG.exe
  2⤵
  PID:5412
- C:\Windows\System\eQlMUct.exe
  C:\Windows\System\eQlMUct.exe
  2⤵
  PID:5428
- C:\Windows\System\OnYNGCo.exe
  C:\Windows\System\OnYNGCo.exe
  2⤵
  PID:5452
- C:\Windows\System\KTZgsnO.exe
  C:\Windows\System\KTZgsnO.exe
  2⤵
  PID:5468
- C:\Windows\System\WOLSCVZ.exe
  C:\Windows\System\WOLSCVZ.exe
  2⤵
  PID:5484
- C:\Windows\System\icPaAAH.exe
  C:\Windows\System\icPaAAH.exe
  2⤵
  PID:5500
- C:\Windows\System\OVMrreD.exe
  C:\Windows\System\OVMrreD.exe
  2⤵
  PID:5516
- C:\Windows\System\obHXXaS.exe
  C:\Windows\System\obHXXaS.exe
  2⤵
  PID:5532
- C:\Windows\System\nDVjokV.exe
  C:\Windows\System\nDVjokV.exe
  2⤵
  PID:5548
- C:\Windows\System\BPjBWmB.exe
  C:\Windows\System\BPjBWmB.exe
  2⤵
  PID:5564
- C:\Windows\System\CylIasP.exe
  C:\Windows\System\CylIasP.exe
  2⤵
  PID:5580
- C:\Windows\System\IRdRHyg.exe
  C:\Windows\System\IRdRHyg.exe
  2⤵
  PID:5596
- C:\Windows\System\vIjVrGG.exe
  C:\Windows\System\vIjVrGG.exe
  2⤵
  PID:5612
- C:\Windows\System\CdJwDFh.exe
  C:\Windows\System\CdJwDFh.exe
  2⤵
  PID:5628
- C:\Windows\System\qvmbyCy.exe
  C:\Windows\System\qvmbyCy.exe
  2⤵
  PID:5652
- C:\Windows\System\lewldzo.exe
  C:\Windows\System\lewldzo.exe
  2⤵
  PID:5668
- C:\Windows\System\yGZvwjY.exe
  C:\Windows\System\yGZvwjY.exe
  2⤵
  PID:5684
- C:\Windows\System\luGTNhD.exe
  C:\Windows\System\luGTNhD.exe
  2⤵
  PID:5700
- C:\Windows\System\fSBdQjT.exe
  C:\Windows\System\fSBdQjT.exe
  2⤵
  PID:5716
- C:\Windows\System\KjCqfST.exe
  C:\Windows\System\KjCqfST.exe
  2⤵
  PID:5732
- C:\Windows\System\pfuGADG.exe
  C:\Windows\System\pfuGADG.exe
  2⤵
  PID:5748
- C:\Windows\System\DAXUHtX.exe
  C:\Windows\System\DAXUHtX.exe
  2⤵
  PID:5764
- C:\Windows\System\dzLGCqF.exe
  C:\Windows\System\dzLGCqF.exe
  2⤵
  PID:5780
- C:\Windows\System\JSpCfCu.exe
  C:\Windows\System\JSpCfCu.exe
  2⤵
  PID:5796
- C:\Windows\System\CBYspda.exe
  C:\Windows\System\CBYspda.exe
  2⤵
  PID:5812
- C:\Windows\System\PeUPtPm.exe
  C:\Windows\System\PeUPtPm.exe
  2⤵
  PID:5828
- C:\Windows\System\PQzHmCO.exe
  C:\Windows\System\PQzHmCO.exe
  2⤵
  PID:5844
- C:\Windows\System\YosZiWS.exe
  C:\Windows\System\YosZiWS.exe
  2⤵
  PID:5860
- C:\Windows\System\BNHhILd.exe
  C:\Windows\System\BNHhILd.exe
  2⤵
  PID:5876
- C:\Windows\System\ZcOOIwO.exe
  C:\Windows\System\ZcOOIwO.exe
  2⤵
  PID:5892
- C:\Windows\System\BveLcrI.exe
  C:\Windows\System\BveLcrI.exe
  2⤵
  PID:5912
- C:\Windows\System\cxiZhRx.exe
  C:\Windows\System\cxiZhRx.exe
  2⤵
  PID:5928
- C:\Windows\System\sHwVndd.exe
  C:\Windows\System\sHwVndd.exe
  2⤵
  PID:5944
- C:\Windows\System\lVKWMTd.exe
  C:\Windows\System\lVKWMTd.exe
  2⤵
  PID:5960
- C:\Windows\System\zxOzkxx.exe
  C:\Windows\System\zxOzkxx.exe
  2⤵
  PID:5980
- C:\Windows\System\vlkjwOP.exe
  C:\Windows\System\vlkjwOP.exe
  2⤵
  PID:5996
- C:\Windows\System\agVIaFC.exe
  C:\Windows\System\agVIaFC.exe
  2⤵
  PID:6012
- C:\Windows\System\ErDRtau.exe
  C:\Windows\System\ErDRtau.exe
  2⤵
  PID:6032
- C:\Windows\System\oHfGdMa.exe
  C:\Windows\System\oHfGdMa.exe
  2⤵
  PID:6048
- C:\Windows\System\vBJICNe.exe
  C:\Windows\System\vBJICNe.exe
  2⤵
  PID:6064
- C:\Windows\System\xieCAQH.exe
  C:\Windows\System\xieCAQH.exe
  2⤵
  PID:6084
- C:\Windows\System\yqUuOUU.exe
  C:\Windows\System\yqUuOUU.exe
  2⤵
  PID:6104
- C:\Windows\System\EWGpiYZ.exe
  C:\Windows\System\EWGpiYZ.exe
  2⤵
  PID:6120
- C:\Windows\System\bdMynGb.exe
  C:\Windows\System\bdMynGb.exe
  2⤵
  PID:6140
- C:\Windows\System\alfJnRh.exe
  C:\Windows\System\alfJnRh.exe
  2⤵
  PID:2840
- C:\Windows\System\ONXErfX.exe
  C:\Windows\System\ONXErfX.exe
  2⤵
  PID:1432
- C:\Windows\System\ylABgyr.exe
  C:\Windows\System\ylABgyr.exe
  2⤵
  PID:5188
- C:\Windows\System\JyEhRDn.exe
  C:\Windows\System\JyEhRDn.exe
  2⤵
  PID:4736
- C:\Windows\System\wXAODPH.exe
  C:\Windows\System\wXAODPH.exe
  2⤵
  PID:5136
- C:\Windows\System\LmklUmO.exe
  C:\Windows\System\LmklUmO.exe
  2⤵
  PID:5204
- C:\Windows\System\WjhXBYZ.exe
  C:\Windows\System\WjhXBYZ.exe
  2⤵
  PID:5236
- C:\Windows\System\sjljKTB.exe
  C:\Windows\System\sjljKTB.exe
  2⤵
  PID:5248
- C:\Windows\System\tZopVhV.exe
  C:\Windows\System\tZopVhV.exe
  2⤵
  PID:5260
- C:\Windows\System\IujTpNB.exe
  C:\Windows\System\IujTpNB.exe
  2⤵
  PID:2440
- C:\Windows\System\BSOdrti.exe
  C:\Windows\System\BSOdrti.exe
  2⤵
  PID:5332
- C:\Windows\System\pWnfHGY.exe
  C:\Windows\System\pWnfHGY.exe
  2⤵
  PID:5360
- C:\Windows\System\xWqYKir.exe
  C:\Windows\System\xWqYKir.exe
  2⤵
  PID:5372
- C:\Windows\System\yBZXAhI.exe
  C:\Windows\System\yBZXAhI.exe
  2⤵
  PID:5436
- C:\Windows\System\cZGCZGI.exe
  C:\Windows\System\cZGCZGI.exe
  2⤵
  PID:5424
- C:\Windows\System\rfdMbJq.exe
  C:\Windows\System\rfdMbJq.exe
  2⤵
  PID:5952
- C:\Windows\System\HexArJJ.exe
  C:\Windows\System\HexArJJ.exe
  2⤵
  PID:5856
- C:\Windows\System\uKdtScL.exe
  C:\Windows\System\uKdtScL.exe
  2⤵
  PID:5760
- C:\Windows\System\MKCVhnt.exe
  C:\Windows\System\MKCVhnt.exe
  2⤵
  PID:5692
- C:\Windows\System\NalTeFq.exe
  C:\Windows\System\NalTeFq.exe
  2⤵
  PID:5620
- C:\Windows\System\UYGjjhV.exe
  C:\Windows\System\UYGjjhV.exe
  2⤵
  PID:5556
- C:\Windows\System\hCIpVoT.exe
  C:\Windows\System\hCIpVoT.exe
  2⤵
  PID:5492
- C:\Windows\System\oJHIvXQ.exe
  C:\Windows\System\oJHIvXQ.exe
  2⤵
  PID:5460
- C:\Windows\System\IlIvZzQ.exe
  C:\Windows\System\IlIvZzQ.exe
  2⤵
  PID:6024
- C:\Windows\System\LSooVUE.exe
  C:\Windows\System\LSooVUE.exe
  2⤵
  PID:6096
- C:\Windows\System\RiiLXSd.exe
  C:\Windows\System\RiiLXSd.exe
  2⤵
  PID:6136
- C:\Windows\System\VSGxvWI.exe
  C:\Windows\System\VSGxvWI.exe
  2⤵
  PID:540
- C:\Windows\System\RdspsAY.exe
  C:\Windows\System\RdspsAY.exe
  2⤵
  PID:5276
- C:\Windows\System\deYUgUu.exe
  C:\Windows\System\deYUgUu.exe
  2⤵
  PID:5956
- C:\Windows\System\UjpkLAI.exe
  C:\Windows\System\UjpkLAI.exe
  2⤵
  PID:5496
- C:\Windows\System\fCxtqPG.exe
  C:\Windows\System\fCxtqPG.exe
  2⤵
  PID:6132
- C:\Windows\System\bZsQdEn.exe
  C:\Windows\System\bZsQdEn.exe
  2⤵
  PID:5408
- C:\Windows\System\rUoOdAH.exe
  C:\Windows\System\rUoOdAH.exe
  2⤵
  PID:5244
- C:\Windows\System\QomBCrL.exe
  C:\Windows\System\QomBCrL.exe
  2⤵
  PID:6160
- C:\Windows\System\vcRmQxm.exe
  C:\Windows\System\vcRmQxm.exe
  2⤵
  PID:6184
- C:\Windows\System\cNFzxtk.exe
  C:\Windows\System\cNFzxtk.exe
  2⤵
  PID:6200
- C:\Windows\System\TSCReDJ.exe
  C:\Windows\System\TSCReDJ.exe
  2⤵
  PID:6216
- C:\Windows\System\BvgoYmJ.exe
  C:\Windows\System\BvgoYmJ.exe
  2⤵
  PID:6244
- C:\Windows\System\FgrmyCy.exe
  C:\Windows\System\FgrmyCy.exe
  2⤵
  PID:6260
- C:\Windows\System\CEuPPsC.exe
  C:\Windows\System\CEuPPsC.exe
  2⤵
  PID:6276
- C:\Windows\System\QiEtmCS.exe
  C:\Windows\System\QiEtmCS.exe
  2⤵
  PID:6292
- C:\Windows\System\QJBTytk.exe
  C:\Windows\System\QJBTytk.exe
  2⤵
  PID:6308
- C:\Windows\System\LlCrJao.exe
  C:\Windows\System\LlCrJao.exe
  2⤵
  PID:6324
- C:\Windows\System\NflKnie.exe
  C:\Windows\System\NflKnie.exe
  2⤵
  PID:6340
- C:\Windows\System\IDxBQBF.exe
  C:\Windows\System\IDxBQBF.exe
  2⤵
  PID:6356
- C:\Windows\System\lcwqWJd.exe
  C:\Windows\System\lcwqWJd.exe
  2⤵
  PID:6372
- C:\Windows\System\XwVdySQ.exe
  C:\Windows\System\XwVdySQ.exe
  2⤵
  PID:6388
- C:\Windows\System\WkJPnIE.exe
  C:\Windows\System\WkJPnIE.exe
  2⤵
  PID:6404
- C:\Windows\System\EEuwGGw.exe
  C:\Windows\System\EEuwGGw.exe
  2⤵
  PID:6420
- C:\Windows\System\QFUbCXy.exe
  C:\Windows\System\QFUbCXy.exe
  2⤵
  PID:6436
- C:\Windows\System\jQJrXNh.exe
  C:\Windows\System\jQJrXNh.exe
  2⤵
  PID:6452
- C:\Windows\System\nFteAuY.exe
  C:\Windows\System\nFteAuY.exe
  2⤵
  PID:6468
- C:\Windows\System\eqRQqLa.exe
  C:\Windows\System\eqRQqLa.exe
  2⤵
  PID:6484
- C:\Windows\System\nHamxoF.exe
  C:\Windows\System\nHamxoF.exe
  2⤵
  PID:6500
- C:\Windows\System\WmpZjxC.exe
  C:\Windows\System\WmpZjxC.exe
  2⤵
  PID:6516
- C:\Windows\System\irXgDxo.exe
  C:\Windows\System\irXgDxo.exe
  2⤵
  PID:6532
- C:\Windows\System\hWapYeG.exe
  C:\Windows\System\hWapYeG.exe
  2⤵
  PID:6548
- C:\Windows\System\VhZrpKE.exe
  C:\Windows\System\VhZrpKE.exe
  2⤵
  PID:6564
- C:\Windows\System\OIPMlxh.exe
  C:\Windows\System\OIPMlxh.exe
  2⤵
  PID:6580
- C:\Windows\System\QAsDcgX.exe
  C:\Windows\System\QAsDcgX.exe
  2⤵
  PID:6596
- C:\Windows\System\oHfYCLM.exe
  C:\Windows\System\oHfYCLM.exe
  2⤵
  PID:6612
- C:\Windows\System\GnJkBAU.exe
  C:\Windows\System\GnJkBAU.exe
  2⤵
  PID:6628
- C:\Windows\System\BHgOnYb.exe
  C:\Windows\System\BHgOnYb.exe
  2⤵
  PID:6644
- C:\Windows\System\NktxxgZ.exe
  C:\Windows\System\NktxxgZ.exe
  2⤵
  PID:6660
- C:\Windows\System\ylCUmcO.exe
  C:\Windows\System\ylCUmcO.exe
  2⤵
  PID:6676
- C:\Windows\System\yTEQFly.exe
  C:\Windows\System\yTEQFly.exe
  2⤵
  PID:6692
- C:\Windows\System\zvbOzMH.exe
  C:\Windows\System\zvbOzMH.exe
  2⤵
  PID:6708
- C:\Windows\System\GUVrXtL.exe
  C:\Windows\System\GUVrXtL.exe
  2⤵
  PID:6724
- C:\Windows\System\QbSERwP.exe
  C:\Windows\System\QbSERwP.exe
  2⤵
  PID:6740
- C:\Windows\System\GDEDDgq.exe
  C:\Windows\System\GDEDDgq.exe
  2⤵
  PID:6756
- C:\Windows\System\eFDDWjK.exe
  C:\Windows\System\eFDDWjK.exe
  2⤵
  PID:6772
- C:\Windows\System\ptIyftM.exe
  C:\Windows\System\ptIyftM.exe
  2⤵
  PID:6788
- C:\Windows\System\SWyLlEC.exe
  C:\Windows\System\SWyLlEC.exe
  2⤵
  PID:6816
- C:\Windows\System\Zcjbdyt.exe
  C:\Windows\System\Zcjbdyt.exe
  2⤵
  PID:6832
- C:\Windows\System\mgfWdBL.exe
  C:\Windows\System\mgfWdBL.exe
  2⤵
  PID:6848
- C:\Windows\System\NAxvswo.exe
  C:\Windows\System\NAxvswo.exe
  2⤵
  PID:6864
- C:\Windows\System\sFrnjmb.exe
  C:\Windows\System\sFrnjmb.exe
  2⤵
  PID:6880
- C:\Windows\System\hAFwDBP.exe
  C:\Windows\System\hAFwDBP.exe
  2⤵
  PID:6896
- C:\Windows\System\bKahWbB.exe
  C:\Windows\System\bKahWbB.exe
  2⤵
  PID:6912
- C:\Windows\System\QHnZAbO.exe
  C:\Windows\System\QHnZAbO.exe
  2⤵
  PID:6928
- C:\Windows\System\ZGqvVCc.exe
  C:\Windows\System\ZGqvVCc.exe
  2⤵
  PID:6944
- C:\Windows\System\oCXpvrh.exe
  C:\Windows\System\oCXpvrh.exe
  2⤵
  PID:6960
- C:\Windows\System\vItjCDu.exe
  C:\Windows\System\vItjCDu.exe
  2⤵
  PID:6976
- C:\Windows\System\BUubAGD.exe
  C:\Windows\System\BUubAGD.exe
  2⤵
  PID:6992
- C:\Windows\System\RrwPjfB.exe
  C:\Windows\System\RrwPjfB.exe
  2⤵
  PID:7008
- C:\Windows\System\WohVqOp.exe
  C:\Windows\System\WohVqOp.exe
  2⤵
  PID:7024
- C:\Windows\System\tsTllLW.exe
  C:\Windows\System\tsTllLW.exe
  2⤵
  PID:7040
- C:\Windows\System\sReDmpu.exe
  C:\Windows\System\sReDmpu.exe
  2⤵
  PID:7056
- C:\Windows\System\sQJtpNp.exe
  C:\Windows\System\sQJtpNp.exe
  2⤵
  PID:7072
- C:\Windows\System\mRjCIoH.exe
  C:\Windows\System\mRjCIoH.exe
  2⤵
  PID:7092
- C:\Windows\System\ibOPCQe.exe
  C:\Windows\System\ibOPCQe.exe
  2⤵
  PID:7108
- C:\Windows\System\NElxXRL.exe
  C:\Windows\System\NElxXRL.exe
  2⤵
  PID:7124
- C:\Windows\System\OJxEzln.exe
  C:\Windows\System\OJxEzln.exe
  2⤵
  PID:7140
- C:\Windows\System\UGRkkqg.exe
  C:\Windows\System\UGRkkqg.exe
  2⤵
  PID:7156
- C:\Windows\System\PsJHsMT.exe
  C:\Windows\System\PsJHsMT.exe
  2⤵
  PID:5660
- C:\Windows\System\LomvLvg.exe
  C:\Windows\System\LomvLvg.exe
  2⤵
  PID:5404
- C:\Windows\System\qNlCFQX.exe
  C:\Windows\System\qNlCFQX.exe
  2⤵
  PID:6192
- C:\Windows\System\ilAoDtI.exe
  C:\Windows\System\ilAoDtI.exe
  2⤵
  PID:5904
- C:\Windows\System\ysKVhFv.exe
  C:\Windows\System\ysKVhFv.exe
  2⤵
  PID:6008
- C:\Windows\System\XWqUGKx.exe
  C:\Windows\System\XWqUGKx.exe
  2⤵
  PID:5836
- C:\Windows\System\JWFEIsT.exe
  C:\Windows\System\JWFEIsT.exe
  2⤵
  PID:5640
- C:\Windows\System\WchJlFr.exe
  C:\Windows\System\WchJlFr.exe
  2⤵
  PID:5872
- C:\Windows\System\uwmexBw.exe
  C:\Windows\System\uwmexBw.exe
  2⤵
  PID:5940
- C:\Windows\System\rQcoqch.exe
  C:\Windows\System\rQcoqch.exe
  2⤵
  PID:6116
- C:\Windows\System\mayulEh.exe
  C:\Windows\System\mayulEh.exe
  2⤵
  PID:3240
- C:\Windows\System\EozvalE.exe
  C:\Windows\System\EozvalE.exe
  2⤵
  PID:5224
- C:\Windows\System\DuMMriE.exe
  C:\Windows\System\DuMMriE.exe
  2⤵
  PID:5304
- C:\Windows\System\sFUbZER.exe
  C:\Windows\System\sFUbZER.exe
  2⤵
  PID:5440
- C:\Windows\System\czIyUrq.exe
  C:\Windows\System\czIyUrq.exe
  2⤵
  PID:5884
- C:\Windows\System\ptzdrwP.exe
  C:\Windows\System\ptzdrwP.exe
  2⤵
  PID:5560
- C:\Windows\System\yNAVAlw.exe
  C:\Windows\System\yNAVAlw.exe
  2⤵
  PID:6092
- C:\Windows\System\RAwkwnv.exe
  C:\Windows\System\RAwkwnv.exe
  2⤵
  PID:5320
- C:\Windows\System\iZypppn.exe
  C:\Windows\System\iZypppn.exe
  2⤵
  PID:6128
- C:\Windows\System\EcfHtyc.exe
  C:\Windows\System\EcfHtyc.exe
  2⤵
  PID:6176
- C:\Windows\System\XjooGXD.exe
  C:\Windows\System\XjooGXD.exe
  2⤵
  PID:6232
- C:\Windows\System\JJqhqyW.exe
  C:\Windows\System\JJqhqyW.exe
  2⤵
  PID:5604
- C:\Windows\System\NMrUhVA.exe
  C:\Windows\System\NMrUhVA.exe
  2⤵
  PID:6240
- C:\Windows\System\DJNLaWi.exe
  C:\Windows\System\DJNLaWi.exe
  2⤵
  PID:6304
- C:\Windows\System\ZctddES.exe
  C:\Windows\System\ZctddES.exe
  2⤵
  PID:6368
- C:\Windows\System\jBIqeVn.exe
  C:\Windows\System\jBIqeVn.exe
  2⤵
  PID:5804
- C:\Windows\System\XDbsETE.exe
  C:\Windows\System\XDbsETE.exe
  2⤵
  PID:5708
- C:\Windows\System\HNgYLtN.exe
  C:\Windows\System\HNgYLtN.exe
  2⤵
  PID:5636
- C:\Windows\System\KzoeAbd.exe
  C:\Windows\System\KzoeAbd.exe
  2⤵
  PID:5540
- C:\Windows\System\gfAwjai.exe
  C:\Windows\System\gfAwjai.exe
  2⤵
  PID:6384
- C:\Windows\System\RkMTjXB.exe
  C:\Windows\System\RkMTjXB.exe
  2⤵
  PID:6320
- C:\Windows\System\fsttgxQ.exe
  C:\Windows\System\fsttgxQ.exe
  2⤵
  PID:6416
- C:\Windows\System\iJmWinA.exe
  C:\Windows\System\iJmWinA.exe
  2⤵
  PID:6432
- C:\Windows\System\gPYkjYb.exe
  C:\Windows\System\gPYkjYb.exe
  2⤵
  PID:6512
- C:\Windows\System\FnpYCqd.exe
  C:\Windows\System\FnpYCqd.exe
  2⤵
  PID:6576
- C:\Windows\System\deuqhHx.exe
  C:\Windows\System\deuqhHx.exe
  2⤵
  PID:6636
- C:\Windows\System\PdsLCOQ.exe
  C:\Windows\System\PdsLCOQ.exe
  2⤵
  PID:6556
- C:\Windows\System\jzGOzye.exe
  C:\Windows\System\jzGOzye.exe
  2⤵
  PID:6700
- C:\Windows\System\KyyHjlz.exe
  C:\Windows\System\KyyHjlz.exe
  2⤵
  PID:6704
- C:\Windows\System\SjqEMbD.exe
  C:\Windows\System\SjqEMbD.exe
  2⤵
  PID:6796
- C:\Windows\System\xjuavNB.exe
  C:\Windows\System\xjuavNB.exe
  2⤵
  PID:6784
- C:\Windows\System\XrSlLbQ.exe
  C:\Windows\System\XrSlLbQ.exe
  2⤵
  PID:6720
- C:\Windows\System\SplajCH.exe
  C:\Windows\System\SplajCH.exe
  2⤵
  PID:6496
- C:\Windows\System\ajMwezt.exe
  C:\Windows\System\ajMwezt.exe
  2⤵
  PID:6800
- C:\Windows\System\EYOnfeB.exe
  C:\Windows\System\EYOnfeB.exe
  2⤵
  PID:6824
- C:\Windows\System\wjnGPcB.exe
  C:\Windows\System\wjnGPcB.exe
  2⤵
  PID:6888
- C:\Windows\System\AgxWBeY.exe
  C:\Windows\System\AgxWBeY.exe
  2⤵
  PID:6952
- C:\Windows\System\KnzGpum.exe
  C:\Windows\System\KnzGpum.exe
  2⤵
  PID:7020
- C:\Windows\System\jrHKAIo.exe
  C:\Windows\System\jrHKAIo.exe
  2⤵
  PID:7084
- C:\Windows\System\xWIEgeH.exe
  C:\Windows\System\xWIEgeH.exe
  2⤵
  PID:7120
- C:\Windows\System\HMwJZma.exe
  C:\Windows\System\HMwJZma.exe
  2⤵
  PID:5356
- C:\Windows\System\hXWYZxl.exe
  C:\Windows\System\hXWYZxl.exe
  2⤵
  PID:6072
- C:\Windows\System\IxiSLkZ.exe
  C:\Windows\System\IxiSLkZ.exe
  2⤵
  PID:5140
- C:\Windows\System\mTaytWS.exe
  C:\Windows\System\mTaytWS.exe
  2⤵
  PID:5788
- C:\Windows\System\vxsShCN.exe
  C:\Windows\System\vxsShCN.exe
  2⤵
  PID:4428
- C:\Windows\System\hNNebUs.exe
  C:\Windows\System\hNNebUs.exe
  2⤵
  PID:5264
- C:\Windows\System\uVbkWRH.exe
  C:\Windows\System\uVbkWRH.exe
  2⤵
  PID:5300
- C:\Windows\System\KQGSbjY.exe
  C:\Windows\System\KQGSbjY.exe
  2⤵
  PID:7164
- C:\Windows\System\oSazwOZ.exe
  C:\Windows\System\oSazwOZ.exe
  2⤵
  PID:5908
- C:\Windows\System\gigvfFb.exe
  C:\Windows\System\gigvfFb.exe
  2⤵
  PID:7064
- C:\Windows\System\xOJlFCQ.exe
  C:\Windows\System\xOJlFCQ.exe
  2⤵
  PID:6940
- C:\Windows\System\RIzbbJm.exe
  C:\Windows\System\RIzbbJm.exe
  2⤵
  PID:5152
- C:\Windows\System\QfUNqox.exe
  C:\Windows\System\QfUNqox.exe
  2⤵
  PID:6172
- C:\Windows\System\uhUPshs.exe
  C:\Windows\System\uhUPshs.exe
  2⤵
  PID:6060
- C:\Windows\System\kXuccYY.exe
  C:\Windows\System\kXuccYY.exe
  2⤵
  PID:6020
- C:\Windows\System\OKWahQh.exe
  C:\Windows\System\OKWahQh.exe
  2⤵
  PID:5512
- C:\Windows\System\hMbrWMd.exe
  C:\Windows\System\hMbrWMd.exe
  2⤵
  PID:5680
- C:\Windows\System\fyDCqeA.exe
  C:\Windows\System\fyDCqeA.exe
  2⤵
  PID:6076
- C:\Windows\System\ajzIOvA.exe
  C:\Windows\System\ajzIOvA.exe
  2⤵
  PID:5572
- C:\Windows\System\tnYKELS.exe
  C:\Windows\System\tnYKELS.exe
  2⤵
  PID:6448
- C:\Windows\System\OIOauDx.exe
  C:\Windows\System\OIOauDx.exe
  2⤵
  PID:6508
- C:\Windows\System\pDVTTlG.exe
  C:\Windows\System\pDVTTlG.exe
  2⤵
  PID:6524
- C:\Windows\System\LlZElaR.exe
  C:\Windows\System\LlZElaR.exe
  2⤵
  PID:6592
- C:\Windows\System\Sbtislx.exe
  C:\Windows\System\Sbtislx.exe
  2⤵
  PID:6588
- C:\Windows\System\tLhJVhP.exe
  C:\Windows\System\tLhJVhP.exe
  2⤵
  PID:6492
- C:\Windows\System\NIKKoDT.exe
  C:\Windows\System\NIKKoDT.exe
  2⤵
  PID:6956
- C:\Windows\System\USdppgU.exe
  C:\Windows\System\USdppgU.exe
  2⤵
  PID:6044
- C:\Windows\System\PFUTVeu.exe
  C:\Windows\System\PFUTVeu.exe
  2⤵
  PID:5232
- C:\Windows\System\JDCLyiP.exe
  C:\Windows\System\JDCLyiP.exe
  2⤵
  PID:7136
- C:\Windows\System\ChJVznT.exe
  C:\Windows\System\ChJVznT.exe
  2⤵
  PID:5696
- C:\Windows\System\FbbvTPv.exe
  C:\Windows\System\FbbvTPv.exe
  2⤵
  PID:5792
- C:\Windows\System\dPbXIDa.exe
  C:\Windows\System\dPbXIDa.exe
  2⤵
  PID:6284
- C:\Windows\System\MLSsmCQ.exe
  C:\Windows\System\MLSsmCQ.exe
  2⤵
  PID:6808
- C:\Windows\System\HQadOwK.exe
  C:\Windows\System\HQadOwK.exe
  2⤵
  PID:6768
- C:\Windows\System\NGMdFDy.exe
  C:\Windows\System\NGMdFDy.exe
  2⤵
  PID:6988
- C:\Windows\System\bXDmlWa.exe
  C:\Windows\System\bXDmlWa.exe
  2⤵
  PID:6560
- C:\Windows\System\uhwHIxL.exe
  C:\Windows\System\uhwHIxL.exe
  2⤵
  PID:7152
- C:\Windows\System\kVODyZX.exe
  C:\Windows\System\kVODyZX.exe
  2⤵
  PID:6004
- C:\Windows\System\EHBTIXF.exe
  C:\Windows\System\EHBTIXF.exe
  2⤵
  PID:5284
- C:\Windows\System\tWofQqm.exe
  C:\Windows\System\tWofQqm.exe
  2⤵
  PID:6400
- C:\Windows\System\dIlehvW.exe
  C:\Windows\System\dIlehvW.exe
  2⤵
  PID:6684
- C:\Windows\System\syDeesg.exe
  C:\Windows\System\syDeesg.exe
  2⤵
  PID:6908
- C:\Windows\System\cKRsPqO.exe
  C:\Windows\System\cKRsPqO.exe
  2⤵
  PID:6272
- C:\Windows\System\YsErMwI.exe
  C:\Windows\System\YsErMwI.exe
  2⤵
  PID:6856
- C:\Windows\System\EPqaUgv.exe
  C:\Windows\System\EPqaUgv.exe
  2⤵
  PID:1740
- C:\Windows\System\uQrmOTU.exe
  C:\Windows\System\uQrmOTU.exe
  2⤵
  PID:6688
- C:\Windows\System\utKUSVn.exe
  C:\Windows\System\utKUSVn.exe
  2⤵
  PID:7068
- C:\Windows\System\dwanYdr.exe
  C:\Windows\System\dwanYdr.exe
  2⤵
  PID:6972
- C:\Windows\System\YqKDcPH.exe
  C:\Windows\System\YqKDcPH.exe
  2⤵
  PID:6336
- C:\Windows\System\YixHeXS.exe
  C:\Windows\System\YixHeXS.exe
  2⤵
  PID:6428
- C:\Windows\System\UdzMQOC.exe
  C:\Windows\System\UdzMQOC.exe
  2⤵
  PID:7132
- C:\Windows\System\TfZkRaI.exe
  C:\Windows\System\TfZkRaI.exe
  2⤵
  PID:6316
- C:\Windows\System\FAVKpIz.exe
  C:\Windows\System\FAVKpIz.exe
  2⤵
  PID:7000
- C:\Windows\System\sevKCjw.exe
  C:\Windows\System\sevKCjw.exe
  2⤵
  PID:7016
- C:\Windows\System\kCCzbKP.exe
  C:\Windows\System\kCCzbKP.exe
  2⤵
  PID:5744
- C:\Windows\System\foiFYOI.exe
  C:\Windows\System\foiFYOI.exe
  2⤵
  PID:6736
- C:\Windows\System\mYsUrLC.exe
  C:\Windows\System\mYsUrLC.exe
  2⤵
  PID:7184
- C:\Windows\System\qXyctAH.exe
  C:\Windows\System\qXyctAH.exe
  2⤵
  PID:7200
- C:\Windows\System\AUkttEI.exe
  C:\Windows\System\AUkttEI.exe
  2⤵
  PID:7216
- C:\Windows\System\zPprPbm.exe
  C:\Windows\System\zPprPbm.exe
  2⤵
  PID:7232
- C:\Windows\System\mdzhVXG.exe
  C:\Windows\System\mdzhVXG.exe
  2⤵
  PID:7248
- C:\Windows\System\YxEjzAy.exe
  C:\Windows\System\YxEjzAy.exe
  2⤵
  PID:7264
- C:\Windows\System\eeAVQIi.exe
  C:\Windows\System\eeAVQIi.exe
  2⤵
  PID:7284
- C:\Windows\System\NlEGcvM.exe
  C:\Windows\System\NlEGcvM.exe
  2⤵
  PID:7300
- C:\Windows\System\puXBXFK.exe
  C:\Windows\System\puXBXFK.exe
  2⤵
  PID:7316
- C:\Windows\System\dBSBhmL.exe
  C:\Windows\System\dBSBhmL.exe
  2⤵
  PID:7332
- C:\Windows\System\KmuJgWY.exe
  C:\Windows\System\KmuJgWY.exe
  2⤵
  PID:7348
- C:\Windows\System\qUkOapn.exe
  C:\Windows\System\qUkOapn.exe
  2⤵
  PID:7364
- C:\Windows\System\iGmyYuV.exe
  C:\Windows\System\iGmyYuV.exe
  2⤵
  PID:7380
- C:\Windows\System\tpEDLED.exe
  C:\Windows\System\tpEDLED.exe
  2⤵
  PID:7396
- C:\Windows\System\TmAaUjf.exe
  C:\Windows\System\TmAaUjf.exe
  2⤵
  PID:7412
- C:\Windows\System\dTFFDfL.exe
  C:\Windows\System\dTFFDfL.exe
  2⤵
  PID:7428
- C:\Windows\System\ESdEAND.exe
  C:\Windows\System\ESdEAND.exe
  2⤵
  PID:7444
- C:\Windows\System\ZPmXTxC.exe
  C:\Windows\System\ZPmXTxC.exe
  2⤵
  PID:7460
- C:\Windows\System\hRzDkem.exe
  C:\Windows\System\hRzDkem.exe
  2⤵
  PID:7476
- C:\Windows\System\ROCDYET.exe
  C:\Windows\System\ROCDYET.exe
  2⤵
  PID:7492
- C:\Windows\System\vIeSxso.exe
  C:\Windows\System\vIeSxso.exe
  2⤵
  PID:7508
- C:\Windows\System\amKrQKZ.exe
  C:\Windows\System\amKrQKZ.exe
  2⤵
  PID:7524
- C:\Windows\System\rvQiRwC.exe
  C:\Windows\System\rvQiRwC.exe
  2⤵
  PID:7540
- C:\Windows\System\xrJZZdy.exe
  C:\Windows\System\xrJZZdy.exe
  2⤵
  PID:7556
- C:\Windows\System\gjGvNbS.exe
  C:\Windows\System\gjGvNbS.exe
  2⤵
  PID:7572
- C:\Windows\System\jEKZaGm.exe
  C:\Windows\System\jEKZaGm.exe
  2⤵
  PID:7588
- C:\Windows\System\MphfSxG.exe
  C:\Windows\System\MphfSxG.exe
  2⤵
  PID:7604
- C:\Windows\System\PanDpzF.exe
  C:\Windows\System\PanDpzF.exe
  2⤵
  PID:7620
- C:\Windows\System\ciiZLWk.exe
  C:\Windows\System\ciiZLWk.exe
  2⤵
  PID:7636
- C:\Windows\System\uujxEey.exe
  C:\Windows\System\uujxEey.exe
  2⤵
  PID:7652
- C:\Windows\System\jXJrkPs.exe
  C:\Windows\System\jXJrkPs.exe
  2⤵
  PID:7668
- C:\Windows\System\TpZzevp.exe
  C:\Windows\System\TpZzevp.exe
  2⤵
  PID:7684
- C:\Windows\System\bJZyQiH.exe
  C:\Windows\System\bJZyQiH.exe
  2⤵
  PID:7700
- C:\Windows\System\BBeXoxM.exe
  C:\Windows\System\BBeXoxM.exe
  2⤵
  PID:7716
- C:\Windows\System\KmkyznR.exe
  C:\Windows\System\KmkyznR.exe
  2⤵
  PID:7732
- C:\Windows\System\WJxFOTu.exe
  C:\Windows\System\WJxFOTu.exe
  2⤵
  PID:7748
- C:\Windows\System\IyLUBWw.exe
  C:\Windows\System\IyLUBWw.exe
  2⤵
  PID:7764
- C:\Windows\System\xJdAnsH.exe
  C:\Windows\System\xJdAnsH.exe
  2⤵
  PID:7780
- C:\Windows\System\IjDTfdg.exe
  C:\Windows\System\IjDTfdg.exe
  2⤵
  PID:7796
- C:\Windows\System\UdTZwrd.exe
  C:\Windows\System\UdTZwrd.exe
  2⤵
  PID:7812
- C:\Windows\System\yJbdITs.exe
  C:\Windows\System\yJbdITs.exe
  2⤵
  PID:7828
- C:\Windows\System\FQSpddi.exe
  C:\Windows\System\FQSpddi.exe
  2⤵
  PID:7848
- C:\Windows\System\gYguvkx.exe
  C:\Windows\System\gYguvkx.exe
  2⤵
  PID:7864
- C:\Windows\System\liJZNMR.exe
  C:\Windows\System\liJZNMR.exe
  2⤵
  PID:7880
- C:\Windows\System\kakXaie.exe
  C:\Windows\System\kakXaie.exe
  2⤵
  PID:7896
- C:\Windows\System\bdugqZB.exe
  C:\Windows\System\bdugqZB.exe
  2⤵
  PID:7912
- C:\Windows\System\jfqAVgp.exe
  C:\Windows\System\jfqAVgp.exe
  2⤵
  PID:7928
- C:\Windows\System\NeeMeNR.exe
  C:\Windows\System\NeeMeNR.exe
  2⤵
  PID:7944
- C:\Windows\System\nCoVoHa.exe
  C:\Windows\System\nCoVoHa.exe
  2⤵
  PID:7960
- C:\Windows\System\tlbmTlD.exe
  C:\Windows\System\tlbmTlD.exe
  2⤵
  PID:7976
- C:\Windows\System\nNsDZqT.exe
  C:\Windows\System\nNsDZqT.exe
  2⤵
  PID:7992
- C:\Windows\System\IOVgbFY.exe
  C:\Windows\System\IOVgbFY.exe
  2⤵
  PID:8008
- C:\Windows\System\seQpcCW.exe
  C:\Windows\System\seQpcCW.exe
  2⤵
  PID:8024
- C:\Windows\System\CHIwIiJ.exe
  C:\Windows\System\CHIwIiJ.exe
  2⤵
  PID:8040
- C:\Windows\System\hBOMwCh.exe
  C:\Windows\System\hBOMwCh.exe
  2⤵
  PID:8056
- C:\Windows\System\nRKSJMT.exe
  C:\Windows\System\nRKSJMT.exe
  2⤵
  PID:8072
- C:\Windows\System\ODXHEDj.exe
  C:\Windows\System\ODXHEDj.exe
  2⤵
  PID:8088
- C:\Windows\System\KXghVvZ.exe
  C:\Windows\System\KXghVvZ.exe
  2⤵
  PID:8104
- C:\Windows\System\GNZtbzQ.exe
  C:\Windows\System\GNZtbzQ.exe
  2⤵
  PID:8120
- C:\Windows\System\GQgcEJF.exe
  C:\Windows\System\GQgcEJF.exe
  2⤵
  PID:8136
- C:\Windows\System\KmTAOpw.exe
  C:\Windows\System\KmTAOpw.exe
  2⤵
  PID:8152
- C:\Windows\System\DIakXNK.exe
  C:\Windows\System\DIakXNK.exe
  2⤵
  PID:8168
- C:\Windows\System\mKuigCg.exe
  C:\Windows\System\mKuigCg.exe
  2⤵
  PID:8184
- C:\Windows\System\hYdcMzU.exe
  C:\Windows\System\hYdcMzU.exe
  2⤵
  PID:6572
- C:\Windows\System\qZoYcXn.exe
  C:\Windows\System\qZoYcXn.exe
  2⤵
  PID:7260
- C:\Windows\System\lFMSNPo.exe
  C:\Windows\System\lFMSNPo.exe
  2⤵
  PID:7228
- C:\Windows\System\SXZSWQD.exe
  C:\Windows\System\SXZSWQD.exe
  2⤵
  PID:7324
- C:\Windows\System\hclthaF.exe
  C:\Windows\System\hclthaF.exe
  2⤵
  PID:7360
- C:\Windows\System\ehTAayo.exe
  C:\Windows\System\ehTAayo.exe
  2⤵
  PID:6812
- C:\Windows\System\caAxlLO.exe
  C:\Windows\System\caAxlLO.exe
  2⤵
  PID:7484
- C:\Windows\System\UWWKtjD.exe
  C:\Windows\System\UWWKtjD.exe
  2⤵
  PID:7052
- C:\Windows\System\iymQEwi.exe
  C:\Windows\System\iymQEwi.exe
  2⤵
  PID:7308
- C:\Windows\System\SdWrSnF.exe
  C:\Windows\System\SdWrSnF.exe
  2⤵
  PID:7272
- C:\Windows\System\qBzsWjd.exe
  C:\Windows\System\qBzsWjd.exe
  2⤵
  PID:7340
- C:\Windows\System\eJdIAqb.exe
  C:\Windows\System\eJdIAqb.exe
  2⤵
  PID:7404
- C:\Windows\System\hRqQSHz.exe
  C:\Windows\System\hRqQSHz.exe
  2⤵
  PID:7468
- C:\Windows\System\TiHCOvj.exe
  C:\Windows\System\TiHCOvj.exe
  2⤵
  PID:7516
- C:\Windows\System\bMJwTRk.exe
  C:\Windows\System\bMJwTRk.exe
  2⤵
  PID:7532
- C:\Windows\System\rhZlbEl.exe
  C:\Windows\System\rhZlbEl.exe
  2⤵
  PID:7580
- C:\Windows\System\qMrhfob.exe
  C:\Windows\System\qMrhfob.exe
  2⤵
  PID:7644
- C:\Windows\System\DncWVMM.exe
  C:\Windows\System\DncWVMM.exe
  2⤵
  PID:7596
- C:\Windows\System\dGAgpUL.exe
  C:\Windows\System\dGAgpUL.exe
  2⤵
  PID:7772
- C:\Windows\System\XmDSWea.exe
  C:\Windows\System\XmDSWea.exe
  2⤵
  PID:7808
- C:\Windows\System\xQumMej.exe
  C:\Windows\System\xQumMej.exe
  2⤵
  PID:7844
- C:\Windows\System\MdnnPMb.exe
  C:\Windows\System\MdnnPMb.exe
  2⤵
  PID:7904
- C:\Windows\System\DjyKgAa.exe
  C:\Windows\System\DjyKgAa.exe
  2⤵
  PID:7940
- C:\Windows\System\DsynwvY.exe
  C:\Windows\System\DsynwvY.exe
  2⤵
  PID:7632
- C:\Windows\System\vjzVqcI.exe
  C:\Windows\System\vjzVqcI.exe
  2⤵
  PID:7660
- C:\Windows\System\ukBIVpu.exe
  C:\Windows\System\ukBIVpu.exe
  2⤵
  PID:7856
- C:\Windows\System\QgJDMhX.exe
  C:\Windows\System\QgJDMhX.exe
  2⤵
  PID:7952
- C:\Windows\System\XeHCORV.exe
  C:\Windows\System\XeHCORV.exe
  2⤵
  PID:7892
- C:\Windows\System\FKqOaqD.exe
  C:\Windows\System\FKqOaqD.exe
  2⤵
  PID:7968
- C:\Windows\System\HLVQMXM.exe
  C:\Windows\System\HLVQMXM.exe
  2⤵
  PID:8020
- C:\Windows\System\UUkHBgO.exe
  C:\Windows\System\UUkHBgO.exe
  2⤵
  PID:8100
- C:\Windows\System\YyRdUPC.exe
  C:\Windows\System\YyRdUPC.exe
  2⤵
  PID:8132
- C:\Windows\System\VrrJoOO.exe
  C:\Windows\System\VrrJoOO.exe
  2⤵
  PID:8116
- C:\Windows\System\sUFlUJa.exe
  C:\Windows\System\sUFlUJa.exe
  2⤵
  PID:8160
- C:\Windows\System\oTrWRyI.exe
  C:\Windows\System\oTrWRyI.exe
  2⤵
  PID:5388
- C:\Windows\System\nkuwgfu.exe
  C:\Windows\System\nkuwgfu.exe
  2⤵
  PID:7840
- C:\Windows\System\QzLlZvs.exe
  C:\Windows\System\QzLlZvs.exe
  2⤵
  PID:7908
- C:\Windows\System\JsrxrXz.exe
  C:\Windows\System\JsrxrXz.exe
  2⤵
  PID:8036
- C:\Windows\System\uXQIumb.exe
  C:\Windows\System\uXQIumb.exe
  2⤵
  PID:7804
- C:\Windows\System\qPXuKJE.exe
  C:\Windows\System\qPXuKJE.exe
  2⤵
  PID:7756
- C:\Windows\System\XWrbAxm.exe
  C:\Windows\System\XWrbAxm.exe
  2⤵
  PID:7988
- C:\Windows\System\zOsgQKi.exe
  C:\Windows\System\zOsgQKi.exe
  2⤵
  PID:8052
- C:\Windows\System\TyXvtEw.exe
  C:\Windows\System\TyXvtEw.exe
  2⤵
  PID:8068
- C:\Windows\System\FhWzVhB.exe
  C:\Windows\System\FhWzVhB.exe
  2⤵
  PID:5920
- C:\Windows\System\TmjjEGi.exe
  C:\Windows\System\TmjjEGi.exe
  2⤵
  PID:7176
- C:\Windows\System\saPvYoN.exe
  C:\Windows\System\saPvYoN.exe
  2⤵
  PID:7244
- C:\Windows\System\oPxBqKn.exe
  C:\Windows\System\oPxBqKn.exe
  2⤵
  PID:6252
- C:\Windows\System\FUUOvVZ.exe
  C:\Windows\System\FUUOvVZ.exe
  2⤵
  PID:7372
- C:\Windows\System\TRHqIkl.exe
  C:\Windows\System\TRHqIkl.exe
  2⤵
  PID:7612
- C:\Windows\System\gtPTgNQ.exe
  C:\Windows\System\gtPTgNQ.exe
  2⤵
  PID:7600
- C:\Windows\System\ZkYVCeH.exe
  C:\Windows\System\ZkYVCeH.exe
  2⤵
  PID:7792
- C:\Windows\System\vKalLnY.exe
  C:\Windows\System\vKalLnY.exe
  2⤵
  PID:7820
- C:\Windows\System\DtTTDdn.exe
  C:\Windows\System\DtTTDdn.exe
  2⤵
  PID:8080
- C:\Windows\System\GAgQAWi.exe
  C:\Windows\System\GAgQAWi.exe
  2⤵
  PID:7696
- C:\Windows\System\VSoSJKn.exe
  C:\Windows\System\VSoSJKn.exe
  2⤵
  PID:8176
- C:\Windows\System\ELuhkyy.exe
  C:\Windows\System\ELuhkyy.exe
  2⤵
  PID:7420
- C:\Windows\System\EhhtNTD.exe
  C:\Windows\System\EhhtNTD.exe
  2⤵
  PID:6748
- C:\Windows\System\gEsWtLS.exe
  C:\Windows\System\gEsWtLS.exe
  2⤵
  PID:7552
- C:\Windows\System\QZUyWuM.exe
  C:\Windows\System\QZUyWuM.exe
  2⤵
  PID:8016
- C:\Windows\System\ycWagxo.exe
  C:\Windows\System\ycWagxo.exe
  2⤵
  PID:7328
- C:\Windows\System\GbTucsQ.exe
  C:\Windows\System\GbTucsQ.exe
  2⤵
  PID:8196
- C:\Windows\System\AGbHHGW.exe
  C:\Windows\System\AGbHHGW.exe
  2⤵
  PID:8212
- C:\Windows\System\EuRuvLx.exe
  C:\Windows\System\EuRuvLx.exe
  2⤵
  PID:8228
- C:\Windows\System\AYzuHZL.exe
  C:\Windows\System\AYzuHZL.exe
  2⤵
  PID:8244
- C:\Windows\System\wzvwjVC.exe
  C:\Windows\System\wzvwjVC.exe
  2⤵
  PID:8264
- C:\Windows\System\dqILvSv.exe
  C:\Windows\System\dqILvSv.exe
  2⤵
  PID:8280
- C:\Windows\System\VbvvnZD.exe
  C:\Windows\System\VbvvnZD.exe
  2⤵
  PID:8296
- C:\Windows\System\xZYDrYX.exe
  C:\Windows\System\xZYDrYX.exe
  2⤵
  PID:8312
- C:\Windows\System\zOkepLr.exe
  C:\Windows\System\zOkepLr.exe
  2⤵
  PID:8328
- C:\Windows\System\jFmXppm.exe
  C:\Windows\System\jFmXppm.exe
  2⤵
  PID:8344
- C:\Windows\System\OSuSeob.exe
  C:\Windows\System\OSuSeob.exe
  2⤵
  PID:8364
- C:\Windows\System\avZqMtP.exe
  C:\Windows\System\avZqMtP.exe
  2⤵
  PID:8528
- C:\Windows\System\MXCSfft.exe
  C:\Windows\System\MXCSfft.exe
  2⤵
  PID:8544
- C:\Windows\System\DmeYWQv.exe
  C:\Windows\System\DmeYWQv.exe
  2⤵
  PID:8560
- C:\Windows\System\ypABxKl.exe
  C:\Windows\System\ypABxKl.exe
  2⤵
  PID:8592
- C:\Windows\System\AQmonOP.exe
  C:\Windows\System\AQmonOP.exe
  2⤵
  PID:8608
- C:\Windows\System\hstdbMm.exe
  C:\Windows\System\hstdbMm.exe
  2⤵
  PID:8624
- C:\Windows\System\WNXOfyR.exe
  C:\Windows\System\WNXOfyR.exe
  2⤵
  PID:8700
- C:\Windows\System\uaRlrzE.exe
  C:\Windows\System\uaRlrzE.exe
  2⤵
  PID:8716
- C:\Windows\System\PlPWkFm.exe
  C:\Windows\System\PlPWkFm.exe
  2⤵
  PID:8736
- C:\Windows\System\NZToGyI.exe
  C:\Windows\System\NZToGyI.exe
  2⤵
  PID:8752
- C:\Windows\System\aJPXUqg.exe
  C:\Windows\System\aJPXUqg.exe
  2⤵
  PID:8768
- C:\Windows\System\xmLcASD.exe
  C:\Windows\System\xmLcASD.exe
  2⤵
  PID:8792
- C:\Windows\System\bLKoMse.exe
  C:\Windows\System\bLKoMse.exe
  2⤵
  PID:8816
- C:\Windows\System\EEiKFwx.exe
  C:\Windows\System\EEiKFwx.exe
  2⤵
  PID:8832
- C:\Windows\System\LsbkFuT.exe
  C:\Windows\System\LsbkFuT.exe
  2⤵
  PID:8848
- C:\Windows\System\CXZSLSM.exe
  C:\Windows\System\CXZSLSM.exe
  2⤵
  PID:8864
- C:\Windows\System\KKtWdII.exe
  C:\Windows\System\KKtWdII.exe
  2⤵
  PID:8880
- C:\Windows\System\KSUAaUr.exe
  C:\Windows\System\KSUAaUr.exe
  2⤵
  PID:8896
- C:\Windows\System\QOBoIus.exe
  C:\Windows\System\QOBoIus.exe
  2⤵
  PID:8912
- C:\Windows\System\sdKuToP.exe
  C:\Windows\System\sdKuToP.exe
  2⤵
  PID:8928
- C:\Windows\System\QjDhyJU.exe
  C:\Windows\System\QjDhyJU.exe
  2⤵
  PID:8948
- C:\Windows\System\SDyHGwL.exe
  C:\Windows\System\SDyHGwL.exe
  2⤵
  PID:8964
- C:\Windows\System\czPfNNI.exe
  C:\Windows\System\czPfNNI.exe
  2⤵
  PID:8984
- C:\Windows\System\glEpVXj.exe
  C:\Windows\System\glEpVXj.exe
  2⤵
  PID:9004
- C:\Windows\System\Xejtxyb.exe
  C:\Windows\System\Xejtxyb.exe
  2⤵
  PID:9020
- C:\Windows\System\JbYGRmI.exe
  C:\Windows\System\JbYGRmI.exe
  2⤵
  PID:9044
- C:\Windows\System\lAlexgn.exe
  C:\Windows\System\lAlexgn.exe
  2⤵
  PID:9064
- C:\Windows\System\fikPQCb.exe
  C:\Windows\System\fikPQCb.exe
  2⤵
  PID:9080
- C:\Windows\System\xenpdUh.exe
  C:\Windows\System\xenpdUh.exe
  2⤵
  PID:9100
- C:\Windows\System\WGZPVWR.exe
  C:\Windows\System\WGZPVWR.exe
  2⤵
  PID:9116
- C:\Windows\System\zlZOtxi.exe
  C:\Windows\System\zlZOtxi.exe
  2⤵
  PID:9132
- C:\Windows\System\IVuQNZw.exe
  C:\Windows\System\IVuQNZw.exe
  2⤵
  PID:9152
- C:\Windows\System\IJceOZX.exe
  C:\Windows\System\IJceOZX.exe
  2⤵
  PID:9168
- C:\Windows\System\FOFOPtP.exe
  C:\Windows\System\FOFOPtP.exe
  2⤵
  PID:9184
- C:\Windows\System\Yzqixhz.exe
  C:\Windows\System\Yzqixhz.exe
  2⤵
  PID:9200
- C:\Windows\System\VhtbTca.exe
  C:\Windows\System\VhtbTca.exe
  2⤵
  PID:1572
- C:\Windows\System\zSnFTcm.exe
  C:\Windows\System\zSnFTcm.exe
  2⤵
  PID:8276
- C:\Windows\System\AHeWYnO.exe
  C:\Windows\System\AHeWYnO.exe
  2⤵
  PID:8340
- C:\Windows\System\NAQHtvF.exe
  C:\Windows\System\NAQHtvF.exe
  2⤵
  PID:8204
- C:\Windows\System\yFGupFu.exe
  C:\Windows\System\yFGupFu.exe
  2⤵
  PID:7312
- C:\Windows\System\WGCqbMP.exe
  C:\Windows\System\WGCqbMP.exe
  2⤵
  PID:8908
- C:\Windows\System\jobMxFW.exe
  C:\Windows\System\jobMxFW.exe
  2⤵
  PID:8976
- C:\Windows\System\RmzjSyx.exe
  C:\Windows\System\RmzjSyx.exe
  2⤵
  PID:9060
- C:\Windows\System\tQFWmxu.exe
  C:\Windows\System\tQFWmxu.exe
  2⤵
  PID:9124
- C:\Windows\System\GaaktxP.exe
  C:\Windows\System\GaaktxP.exe
  2⤵
  PID:9196
- C:\Windows\System\yBRhpTt.exe
  C:\Windows\System\yBRhpTt.exe
  2⤵
  PID:7224
- C:\Windows\System\edTwISq.exe
  C:\Windows\System\edTwISq.exe
  2⤵
  PID:8652
- C:\Windows\System\kjeTasJ.exe
  C:\Windows\System\kjeTasJ.exe
  2⤵
  PID:8636
- C:\Windows\System\fWrVhyZ.exe
  C:\Windows\System\fWrVhyZ.exe
  2⤵
  PID:8664
- C:\Windows\System\iEHNRjc.exe
  C:\Windows\System\iEHNRjc.exe
  2⤵
  PID:8680
- C:\Windows\System\WybboNk.exe
  C:\Windows\System\WybboNk.exe
  2⤵
  PID:8812
- C:\Windows\System\uMZFQTd.exe
  C:\Windows\System\uMZFQTd.exe
  2⤵
  PID:7376
- C:\Windows\System\cepEGpr.exe
  C:\Windows\System\cepEGpr.exe
  2⤵
  PID:7876
- C:\Windows\System\BOrCrBC.exe
  C:\Windows\System\BOrCrBC.exe
  2⤵
  PID:7504
- C:\Windows\System\cmyebQE.exe
  C:\Windows\System\cmyebQE.exe
  2⤵
  PID:8252
- C:\Windows\System\vCRcYTY.exe
  C:\Windows\System\vCRcYTY.exe
  2⤵
  PID:8292
- C:\Windows\System\SjYWDMR.exe
  C:\Windows\System\SjYWDMR.exe
  2⤵
  PID:8360
- C:\Windows\System\ZhTUrDY.exe
  C:\Windows\System\ZhTUrDY.exe
  2⤵
  PID:8572
- C:\Windows\System\AhpHHUa.exe
  C:\Windows\System\AhpHHUa.exe
  2⤵
  PID:8620
- C:\Windows\System\AnShnrZ.exe
  C:\Windows\System\AnShnrZ.exe
  2⤵
  PID:8748
- C:\Windows\System\OmCJwCT.exe
  C:\Windows\System\OmCJwCT.exe
  2⤵
  PID:8788
- C:\Windows\System\BlJieoX.exe
  C:\Windows\System\BlJieoX.exe
  2⤵
  PID:8860
- C:\Windows\System\WcvCRiB.exe
  C:\Windows\System\WcvCRiB.exe
  2⤵
  PID:8924
- C:\Windows\System\NBbsTWA.exe
  C:\Windows\System\NBbsTWA.exe
  2⤵
  PID:8992
- C:\Windows\System\cdEzJeY.exe
  C:\Windows\System\cdEzJeY.exe
  2⤵
  PID:9036
- C:\Windows\System\NHCxCDs.exe
  C:\Windows\System\NHCxCDs.exe
  2⤵
  PID:9112
- C:\Windows\System\AYquhBD.exe
  C:\Windows\System\AYquhBD.exe
  2⤵
  PID:9176
- C:\Windows\System\pLKAWNn.exe
  C:\Windows\System\pLKAWNn.exe
  2⤵
  PID:8112
- C:\Windows\System\DSCHHww.exe
  C:\Windows\System\DSCHHww.exe
  2⤵
  PID:8448
- C:\Windows\System\EkALKVY.exe
  C:\Windows\System\EkALKVY.exe
  2⤵
  PID:8492
- C:\Windows\System\ObCaZeD.exe
  C:\Windows\System\ObCaZeD.exe
  2⤵
  PID:8380
- C:\Windows\System\LEQWeiS.exe
  C:\Windows\System\LEQWeiS.exe
  2⤵
  PID:8428
- C:\Windows\System\vWKyXEB.exe
  C:\Windows\System\vWKyXEB.exe
  2⤵
  PID:8464
- C:\Windows\System\BVScpFN.exe
  C:\Windows\System\BVScpFN.exe
  2⤵
  PID:8496
- C:\Windows\System\VUDSBfv.exe
  C:\Windows\System\VUDSBfv.exe
  2⤵
  PID:8512
- C:\Windows\System\BnSqJrq.exe
  C:\Windows\System\BnSqJrq.exe
  2⤵
  PID:8600
- C:\Windows\System\ILcDynj.exe
  C:\Windows\System\ILcDynj.exe
  2⤵
  PID:8844
- C:\Windows\System\ScyJYQi.exe
  C:\Windows\System\ScyJYQi.exe
  2⤵
  PID:8944
- C:\Windows\System\jSxSGlP.exe
  C:\Windows\System\jSxSGlP.exe
  2⤵
  PID:8936
- C:\Windows\System\rKayaeT.exe
  C:\Windows\System\rKayaeT.exe
  2⤵
  PID:9056
- C:\Windows\System\ZNRfrBK.exe
  C:\Windows\System\ZNRfrBK.exe
  2⤵
  PID:8260
- C:\Windows\System\TtfcKhX.exe
  C:\Windows\System\TtfcKhX.exe
  2⤵
  PID:8568
- C:\Windows\System\KVZOHKJ.exe
  C:\Windows\System\KVZOHKJ.exe
  2⤵
  PID:8856
- C:\Windows\System\bTyAstt.exe
  C:\Windows\System\bTyAstt.exe
  2⤵
  PID:9076
- C:\Windows\System\DWelVfI.exe
  C:\Windows\System\DWelVfI.exe
  2⤵
  PID:9208
- C:\Windows\System\TtzijRv.exe
  C:\Windows\System\TtzijRv.exe
  2⤵
  PID:8460
- C:\Windows\System\PufWtgo.exe
  C:\Windows\System\PufWtgo.exe
  2⤵
  PID:9192
- C:\Windows\System\NtefOgp.exe
  C:\Windows\System\NtefOgp.exe
  2⤵
  PID:8660
- C:\Windows\System\fzYHUoe.exe
  C:\Windows\System\fzYHUoe.exe
  2⤵
  PID:8476
- C:\Windows\System\rnggSoW.exe
  C:\Windows\System\rnggSoW.exe
  2⤵
  PID:8520
- C:\Windows\System\GhjiJOL.exe
  C:\Windows\System\GhjiJOL.exe
  2⤵
  PID:9028
- C:\Windows\System\mqePENo.exe
  C:\Windows\System\mqePENo.exe
  2⤵
  PID:8876
- C:\Windows\System\QnWXhqH.exe
  C:\Windows\System\QnWXhqH.exe
  2⤵
  PID:9128
- C:\Windows\System\gBcjEMZ.exe
  C:\Windows\System\gBcjEMZ.exe
  2⤵
  PID:8980
- C:\Windows\System\OxJXyQt.exe
  C:\Windows\System\OxJXyQt.exe
  2⤵
  PID:8444
- C:\Windows\System\AqmsYVG.exe
  C:\Windows\System\AqmsYVG.exe
  2⤵
  PID:9000
- C:\Windows\System\qvqNLIA.exe
  C:\Windows\System\qvqNLIA.exe
  2⤵
  PID:8656
- C:\Windows\System\olNEhNo.exe
  C:\Windows\System\olNEhNo.exe
  2⤵
  PID:8800
- C:\Windows\System\MxhVJvT.exe
  C:\Windows\System\MxhVJvT.exe
  2⤵
  PID:8356
- C:\Windows\System\zZnxumt.exe
  C:\Windows\System\zZnxumt.exe
  2⤵
  PID:7452
- C:\Windows\System\fBuGMNz.exe
  C:\Windows\System\fBuGMNz.exe
  2⤵
  PID:8472
- C:\Windows\System\thKcpbB.exe
  C:\Windows\System\thKcpbB.exe
  2⤵
  PID:8804
- C:\Windows\System\pSMTSLy.exe
  C:\Windows\System\pSMTSLy.exe
  2⤵
  PID:7388
- C:\Windows\System\mGGXslK.exe
  C:\Windows\System\mGGXslK.exe
  2⤵
  PID:9212
- C:\Windows\System\QGdRIfI.exe
  C:\Windows\System\QGdRIfI.exe
  2⤵
  PID:8432
- C:\Windows\System\wtBeaqE.exe
  C:\Windows\System\wtBeaqE.exe
  2⤵
  PID:8828
- C:\Windows\System\KcIxyPV.exe
  C:\Windows\System\KcIxyPV.exe
  2⤵
  PID:9108
- C:\Windows\System\BmDJQkQ.exe
  C:\Windows\System\BmDJQkQ.exe
  2⤵
  PID:9148
- C:\Windows\System\KypCOJu.exe
  C:\Windows\System\KypCOJu.exe
  2⤵
  PID:8516
- C:\Windows\System\syABtqt.exe
  C:\Windows\System\syABtqt.exe
  2⤵
  PID:8760
- C:\Windows\System\DBYnbgy.exe
  C:\Windows\System\DBYnbgy.exe
  2⤵
  PID:8540
- C:\Windows\System\qgbtfeM.exe
  C:\Windows\System\qgbtfeM.exe
  2⤵
  PID:9072
- C:\Windows\System\yuxMAAf.exe
  C:\Windows\System\yuxMAAf.exe
  2⤵
  PID:9144
- C:\Windows\System\FyTVpxq.exe
  C:\Windows\System\FyTVpxq.exe
  2⤵
  PID:7712
- C:\Windows\System\vyNutLc.exe
  C:\Windows\System\vyNutLc.exe
  2⤵
  PID:8508
- C:\Windows\System\PBaVMks.exe
  C:\Windows\System\PBaVMks.exe
  2⤵
  PID:8352
- C:\Windows\System\wzXhDtL.exe
  C:\Windows\System\wzXhDtL.exe
  2⤵
  PID:8732
- C:\Windows\System\ojYEHGy.exe
  C:\Windows\System\ojYEHGy.exe
  2⤵
  PID:7280
- C:\Windows\System\CQLaHML.exe
  C:\Windows\System\CQLaHML.exe
  2⤵
  PID:8920
- C:\Windows\System\HCpuLYU.exe
  C:\Windows\System\HCpuLYU.exe
  2⤵
  PID:9220
- C:\Windows\System\ziazxaq.exe
  C:\Windows\System\ziazxaq.exe
  2⤵
  PID:9236
- C:\Windows\System\faWYFHO.exe
  C:\Windows\System\faWYFHO.exe
  2⤵
  PID:9252
- C:\Windows\System\aBbSBpH.exe
  C:\Windows\System\aBbSBpH.exe
  2⤵
  PID:9268
- C:\Windows\System\iYetwbt.exe
  C:\Windows\System\iYetwbt.exe
  2⤵
  PID:9284
- C:\Windows\System\EnzbIFR.exe
  C:\Windows\System\EnzbIFR.exe
  2⤵
  PID:9304
- C:\Windows\System\WWOLFQW.exe
  C:\Windows\System\WWOLFQW.exe
  2⤵
  PID:9320
- C:\Windows\System\bqLiQsh.exe
  C:\Windows\System\bqLiQsh.exe
  2⤵
  PID:9336
- C:\Windows\System\JvuyUIO.exe
  C:\Windows\System\JvuyUIO.exe
  2⤵
  PID:9352
- C:\Windows\System\yEwrcSd.exe
  C:\Windows\System\yEwrcSd.exe
  2⤵
  PID:9368
- C:\Windows\System\bhMQNEk.exe
  C:\Windows\System\bhMQNEk.exe
  2⤵
  PID:9388
- C:\Windows\System\oWrClcG.exe
  C:\Windows\System\oWrClcG.exe
  2⤵
  PID:9404
- C:\Windows\System\xVgSgDs.exe
  C:\Windows\System\xVgSgDs.exe
  2⤵
  PID:9420
- C:\Windows\System\MXZXWCG.exe
  C:\Windows\System\MXZXWCG.exe
  2⤵
  PID:9436
- C:\Windows\System\qJkwGUw.exe
  C:\Windows\System\qJkwGUw.exe
  2⤵
  PID:9452
- C:\Windows\System\QpPKOKu.exe
  C:\Windows\System\QpPKOKu.exe
  2⤵
  PID:9468
- C:\Windows\System\ioVDBGU.exe
  C:\Windows\System\ioVDBGU.exe
  2⤵
  PID:9484
- C:\Windows\System\mwxMzmY.exe
  C:\Windows\System\mwxMzmY.exe
  2⤵
  PID:9500
- C:\Windows\System\LcDoUZT.exe
  C:\Windows\System\LcDoUZT.exe
  2⤵
  PID:9516
- C:\Windows\System\EEkXMrE.exe
  C:\Windows\System\EEkXMrE.exe
  2⤵
  PID:9532
- C:\Windows\System\dNvWYkP.exe
  C:\Windows\System\dNvWYkP.exe
  2⤵
  PID:9548
- C:\Windows\System\PWgmPvM.exe
  C:\Windows\System\PWgmPvM.exe
  2⤵
  PID:9564
- C:\Windows\System\oantUkW.exe
  C:\Windows\System\oantUkW.exe
  2⤵
  PID:9612
- C:\Windows\System\dEJbXdY.exe
  C:\Windows\System\dEJbXdY.exe
  2⤵
  PID:9632
- C:\Windows\System\tkzChvu.exe
  C:\Windows\System\tkzChvu.exe
  2⤵
  PID:9648
- C:\Windows\System\LqpPnir.exe
  C:\Windows\System\LqpPnir.exe
  2⤵
  PID:9676
- C:\Windows\System\FbwvOHT.exe
  C:\Windows\System\FbwvOHT.exe
  2⤵
  PID:9692
- C:\Windows\System\DtvehJN.exe
  C:\Windows\System\DtvehJN.exe
  2⤵
  PID:9708
- C:\Windows\System\WyEAXKm.exe
  C:\Windows\System\WyEAXKm.exe
  2⤵
  PID:9724
- C:\Windows\System\nBDwQWJ.exe
  C:\Windows\System\nBDwQWJ.exe
  2⤵
  PID:9740
- C:\Windows\System\jsEzqxk.exe
  C:\Windows\System\jsEzqxk.exe
  2⤵
  PID:9756
- C:\Windows\System\zkSJxQe.exe
  C:\Windows\System\zkSJxQe.exe
  2⤵
  PID:9772
- C:\Windows\System\ggrBhRD.exe
  C:\Windows\System\ggrBhRD.exe
  2⤵
  PID:9788
- C:\Windows\System\uRLUpJQ.exe
  C:\Windows\System\uRLUpJQ.exe
  2⤵
  PID:9808
- C:\Windows\System\qiWerqZ.exe
  C:\Windows\System\qiWerqZ.exe
  2⤵
  PID:9824
- C:\Windows\System\eMtrtHi.exe
  C:\Windows\System\eMtrtHi.exe
  2⤵
  PID:9840
- C:\Windows\System\EDoYKPs.exe
  C:\Windows\System\EDoYKPs.exe
  2⤵
  PID:9856
- C:\Windows\System\BSIlhKn.exe
  C:\Windows\System\BSIlhKn.exe
  2⤵
  PID:9872
- C:\Windows\System\FvPRnGn.exe
  C:\Windows\System\FvPRnGn.exe
  2⤵
  PID:9888
- C:\Windows\System\MBxZfld.exe
  C:\Windows\System\MBxZfld.exe
  2⤵
  PID:9904
- C:\Windows\System\NitIeDt.exe
  C:\Windows\System\NitIeDt.exe
  2⤵
  PID:9920
- C:\Windows\System\fjAeius.exe
  C:\Windows\System\fjAeius.exe
  2⤵
  PID:9936
- C:\Windows\System\VkZbgWz.exe
  C:\Windows\System\VkZbgWz.exe
  2⤵
  PID:9952
- C:\Windows\System\AYQXdkl.exe
  C:\Windows\System\AYQXdkl.exe
  2⤵
  PID:9968
- C:\Windows\System\krlOPfc.exe
  C:\Windows\System\krlOPfc.exe
  2⤵
  PID:9984
- C:\Windows\System\lMUIESp.exe
  C:\Windows\System\lMUIESp.exe
  2⤵
  PID:10000
- C:\Windows\System\ddWksyf.exe
  C:\Windows\System\ddWksyf.exe
  2⤵
  PID:10016
- C:\Windows\System\tjurfEs.exe
  C:\Windows\System\tjurfEs.exe
  2⤵
  PID:10032
- C:\Windows\System\fCQNbxu.exe
  C:\Windows\System\fCQNbxu.exe
  2⤵
  PID:10048
- C:\Windows\System\djJGgxI.exe
  C:\Windows\System\djJGgxI.exe
  2⤵
  PID:10064
- C:\Windows\System\KOaQbpG.exe
  C:\Windows\System\KOaQbpG.exe
  2⤵
  PID:10080
- C:\Windows\System\aGJRHrX.exe
  C:\Windows\System\aGJRHrX.exe
  2⤵
  PID:10096
- C:\Windows\System\oxyWwyN.exe
  C:\Windows\System\oxyWwyN.exe
  2⤵
  PID:10112
- C:\Windows\System\zkiRXOt.exe
  C:\Windows\System\zkiRXOt.exe
  2⤵
  PID:10128
- C:\Windows\System\mEkvGnc.exe
  C:\Windows\System\mEkvGnc.exe
  2⤵
  PID:10144
- C:\Windows\System\GAUrCeo.exe
  C:\Windows\System\GAUrCeo.exe
  2⤵
  PID:10160
- C:\Windows\System\hzurXas.exe
  C:\Windows\System\hzurXas.exe
  2⤵
  PID:10176
- C:\Windows\System\QHvUVOc.exe
  C:\Windows\System\QHvUVOc.exe
  2⤵
  PID:10192
- C:\Windows\System\aDWUkkw.exe
  C:\Windows\System\aDWUkkw.exe
  2⤵
  PID:10212
- C:\Windows\System\UntvjUH.exe
  C:\Windows\System\UntvjUH.exe
  2⤵
  PID:10228
- C:\Windows\System\QKEktJW.exe
  C:\Windows\System\QKEktJW.exe
  2⤵
  PID:9244
- C:\Windows\System\hQYPTjs.exe
  C:\Windows\System\hQYPTjs.exe
  2⤵
  PID:8780
- C:\Windows\System\igFAYqp.exe
  C:\Windows\System\igFAYqp.exe
  2⤵
  PID:9312
- C:\Windows\System\JaLZzUz.exe
  C:\Windows\System\JaLZzUz.exe
  2⤵
  PID:9264
- C:\Windows\System\xhTYvSQ.exe
  C:\Windows\System\xhTYvSQ.exe
  2⤵
  PID:9296
- C:\Windows\System\APBesix.exe
  C:\Windows\System\APBesix.exe
  2⤵
  PID:9360
- C:\Windows\System\nmTIgRa.exe
  C:\Windows\System\nmTIgRa.exe
  2⤵
  PID:9412
- C:\Windows\System\xupGZGL.exe
  C:\Windows\System\xupGZGL.exe
  2⤵
  PID:9428
- C:\Windows\System\EODQjfB.exe
  C:\Windows\System\EODQjfB.exe
  2⤵
  PID:9464
- C:\Windows\System\YGGFshO.exe
  C:\Windows\System\YGGFshO.exe
  2⤵
  PID:9492
- C:\Windows\System\rXASqfU.exe
  C:\Windows\System\rXASqfU.exe
  2⤵
  PID:9572
- C:\Windows\System\BWqFnjW.exe
  C:\Windows\System\BWqFnjW.exe
  2⤵
  PID:9556
- C:\Windows\System\UhBMMUZ.exe
  C:\Windows\System\UhBMMUZ.exe
  2⤵
  PID:9584
- C:\Windows\System\HkBZACQ.exe
  C:\Windows\System\HkBZACQ.exe
  2⤵
  PID:9596
- C:\Windows\System\KzcqTpJ.exe
  C:\Windows\System\KzcqTpJ.exe
  2⤵
  PID:9640
- C:\Windows\System\QKFVWfM.exe
  C:\Windows\System\QKFVWfM.exe
  2⤵
  PID:9656
- C:\Windows\System\AtvNYfg.exe
  C:\Windows\System\AtvNYfg.exe
  2⤵
  PID:9668
- C:\Windows\System\eLeKomY.exe
  C:\Windows\System\eLeKomY.exe
  2⤵
  PID:9716
- C:\Windows\System\EnsXMTu.exe
  C:\Windows\System\EnsXMTu.exe
  2⤵
  PID:9780
- C:\Windows\System\UmOqqIa.exe
  C:\Windows\System\UmOqqIa.exe
  2⤵
  PID:9848
- C:\Windows\System\ysUUHny.exe
  C:\Windows\System\ysUUHny.exe
  2⤵
  PID:9912
- C:\Windows\System\djFMJAY.exe
  C:\Windows\System\djFMJAY.exe
  2⤵
  PID:9704
- C:\Windows\System\KuwArLV.exe
  C:\Windows\System\KuwArLV.exe
  2⤵
  PID:9796
- C:\Windows\System\qiyOoST.exe
  C:\Windows\System\qiyOoST.exe
  2⤵
  PID:9864
- C:\Windows\System\QobwcLX.exe
  C:\Windows\System\QobwcLX.exe
  2⤵
  PID:9896
- C:\Windows\System\HITlbUu.exe
  C:\Windows\System\HITlbUu.exe
  2⤵
  PID:9976
- C:\Windows\System\WxdQSHg.exe
  C:\Windows\System\WxdQSHg.exe
  2⤵
  PID:9932
- C:\Windows\System\FNBJMrW.exe
  C:\Windows\System\FNBJMrW.exe
  2⤵
  PID:10024
- C:\Windows\System\NdRurGa.exe
  C:\Windows\System\NdRurGa.exe
  2⤵
  PID:10076
- C:\Windows\System\drZUUBn.exe
  C:\Windows\System\drZUUBn.exe
  2⤵
  PID:10056
- C:\Windows\System\lrEDVyb.exe
  C:\Windows\System\lrEDVyb.exe
  2⤵
  PID:10236
- C:\Windows\System\oWQskAj.exe
  C:\Windows\System\oWQskAj.exe
  2⤵
  PID:8224
- C:\Windows\System\ZGyinVp.exe
  C:\Windows\System\ZGyinVp.exe
  2⤵
  PID:10220
- C:\Windows\System\NjrYOWq.exe
  C:\Windows\System\NjrYOWq.exe
  2⤵
  PID:9280
- C:\Windows\System\bgprahB.exe
  C:\Windows\System\bgprahB.exe
  2⤵
  PID:9380
- C:\Windows\System\BWjlURk.exe
  C:\Windows\System\BWjlURk.exe
  2⤵
  PID:9432
- C:\Windows\System\ZvysNMp.exe
  C:\Windows\System\ZvysNMp.exe
  2⤵
  PID:9580
- C:\Windows\System\lByyvKM.exe
  C:\Windows\System\lByyvKM.exe
  2⤵
  PID:9664
- C:\Windows\System\vwvgnuE.exe
  C:\Windows\System\vwvgnuE.exe
  2⤵
  PID:9460
- C:\Windows\System\iIfzgHL.exe
  C:\Windows\System\iIfzgHL.exe
  2⤵
  PID:9764
- C:\Windows\System\OqrACAD.exe
  C:\Windows\System\OqrACAD.exe
  2⤵
  PID:9448
- C:\Windows\System\EhtXJSr.exe
  C:\Windows\System\EhtXJSr.exe
  2⤵
  PID:9400
- C:\Windows\System\aJXONKw.exe
  C:\Windows\System\aJXONKw.exe
  2⤵
  PID:9684
- C:\Windows\System\TvviIyi.exe
  C:\Windows\System\TvviIyi.exe
  2⤵
  PID:9868
- C:\Windows\System\BJOMMpE.exe
  C:\Windows\System\BJOMMpE.exe
  2⤵
  PID:9836
- C:\Windows\System\gETJvLK.exe
  C:\Windows\System\gETJvLK.exe
  2⤵
  PID:10072
- C:\Windows\System\ThPiiZS.exe
  C:\Windows\System\ThPiiZS.exe
  2⤵
  PID:9960
- C:\Windows\System\gxoqoQu.exe
  C:\Windows\System\gxoqoQu.exe
  2⤵
  PID:10108
- C:\Windows\System\sVhdOgl.exe
  C:\Windows\System\sVhdOgl.exe
  2⤵
  PID:10168
- C:\Windows\System\sNZypMz.exe
  C:\Windows\System\sNZypMz.exe
  2⤵
  PID:10208
- C:\Windows\System\xJTRFIG.exe
  C:\Windows\System\xJTRFIG.exe
  2⤵
  PID:10156
- C:\Windows\System\UMXkvPO.exe
  C:\Windows\System\UMXkvPO.exe
  2⤵
  PID:9544
- C:\Windows\System\DZVqNXX.exe
  C:\Windows\System\DZVqNXX.exe
  2⤵
  PID:9300
- C:\Windows\System\dwdtkOi.exe
  C:\Windows\System\dwdtkOi.exe
  2⤵
  PID:9624
- C:\Windows\System\DZBSXdE.exe
  C:\Windows\System\DZBSXdE.exe
  2⤵
  PID:9732
- C:\Windows\System\OKLLmCg.exe
  C:\Windows\System\OKLLmCg.exe
  2⤵
  PID:10136
- C:\Windows\System\HsNJNTk.exe
  C:\Windows\System\HsNJNTk.exe
  2⤵
  PID:9884
- C:\Windows\System\zajocrF.exe
  C:\Windows\System\zajocrF.exe
  2⤵
  PID:10060
- C:\Windows\System\MgseYHW.exe
  C:\Windows\System\MgseYHW.exe
  2⤵
  PID:10028
- C:\Windows\System\maXSVaG.exe
  C:\Windows\System\maXSVaG.exe
  2⤵
  PID:9880
- C:\Windows\System\tCQuLvg.exe
  C:\Windows\System\tCQuLvg.exe
  2⤵
  PID:10044
- C:\Windows\System\aNuGrDP.exe
  C:\Windows\System\aNuGrDP.exe
  2⤵
  PID:9328
- C:\Windows\System\NLfsLTj.exe
  C:\Windows\System\NLfsLTj.exe
  2⤵
  PID:10152
- C:\Windows\System\pgBazcR.exe
  C:\Windows\System\pgBazcR.exe
  2⤵
  PID:9804
- C:\Windows\System\tlaywID.exe
  C:\Windows\System\tlaywID.exe
  2⤵
  PID:9384

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Event Triggered Execution

T1546

Accessibility Features

T1546.008

Privilege Escalation

Event Triggered Execution

T1546

Accessibility Features

T1546.008

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\ALyPJQq.exe

Filesize
1.7MB

MD5
d422935fba4b6b70af2abcc0d223c09f

SHA1
9f6f1cce12902ba989e19eceb196c3d92dfde92d

SHA256
894b66063362cb4f89599a30bfdb893d214cc0e4bbed9783981e10e90ec50d82

SHA512
05c87c619a3508b94bb85258758f716c19a622e9f63357ffb080b09b1baf2c83786cbfe25ca2a291ea90e292f7607e0a0b4d8577fc0ff67128426c2e8e5287f9

Download Submit
C:\Windows\system\BMZnrUO.exe

Filesize
1.7MB

MD5
f85280e08dbbb3bcac7e6ddcd8b514ce

SHA1
b30d2df5dec3c3943c64d8a83420239b406c46d2

SHA256
524f1e5f32f35094c66400e205d41873d4a790d018cf0c955372f177244f4096

SHA512
dbe4710266c69607307d0c38ff96c60dfd072b15325a6c205d4a72adc151d4c53413faaf8abfda092ffeddd889c9cd393c6f2e694eb6ce4aa8d196c856a10560

Download Submit
C:\Windows\system\DvLNgjc.exe

Filesize
1.7MB

MD5
7b19d02f31374220221a7135807c2862

SHA1
2a46caa53431717044b7283aafa98ef77678f997

SHA256
5d59229c8889866b2a6177f46d0903796c21cb06cd2f7668a8990473c19c0be1

SHA512
c12461e9a0cb7be9b84fba33a9a177dd08c8fe8be061f00a0543afa18b9eaa4e6f7c1108a458ee22901b1c41fb249395ffaf73dfb70f91f72ddf18723dd062af

Download Submit
C:\Windows\system\LSZrbGn.exe

Filesize
1.7MB

MD5
b27aebe710f3dc1794dcb329974ddc20

SHA1
7a76a20cbf229823507103d1b90e9827174be293

SHA256
9b6f53283e9c9c1c84e9f5ec81e1cd01a26d47b862bf853504503b48c9fb76f8

SHA512
9e75893473f42670be49a4832f9dcc4bd4b786c2c19fe4f778a3d60a3191d75ab7ddb7c95a00cd88a27f41324bf0362d7236c9e9bb3e6e3c18117e3d4dfebac1

Download Submit
C:\Windows\system\PPQquwB.exe

Filesize
1.7MB

MD5
f4fef571864bbcfdfd0b2cb10708f094

SHA1
77b188a6e9cfee0b0e6ca00f9a442edaaa685448

SHA256
d5af6d71a59e0c8b8a9448416ebfe70928d763a4527286b102bc3fdb5187a497

SHA512
0d748fee1356351459381f317a64b95375a83ed2db94e14234b9bb73082aa08507b980ed95d802a8b29a889bd97abffee79b0e4b455245fd19834fb3fd79dbfa

Download Submit
C:\Windows\system\PTgnHuP.exe

Filesize
1.7MB

MD5
5778702f4dbf9dae359234d716753dc1

SHA1
4205eb0d90058262bb60ec4c396a8e2f6f109e94

SHA256
503aaa7d7a928640de0ef9120b60b3336dbd6fd37a68d14d8660858af6130cca

SHA512
68bb83a52410f55a2f921be12a3add5fb295ee5535a7830fd5018985e3ca8feee83fa1745718cb39b7805c3b7672a1b69b4fc9b168fd6d569a148b209f074648

Download Submit
C:\Windows\system\UWMVoSV.exe

Filesize
1.7MB

MD5
8df7277a6a8c1c6e7d3ec9b3449f1a8d

SHA1
497c3c224684258188ca6e4ca35269cc4129b774

SHA256
a038383181ac0e7d932701655266b3139043a85aa92c8119659fe94c9a0e9be8

SHA512
a91480f2a40d796bd14719c5b94a7e1988df62e95871cffd0c12c70f0c8d900ca13a0c7b66030b68c99b449d5679bfd93b2772b56e860452712cbcf7944891ec

Download Submit
C:\Windows\system\ZexZYwD.exe

Filesize
1.7MB

MD5
1f075203e09bb9a717f01e3155d9b07a

SHA1
ee5ff32f7358a409d405ee9da7d20c29b2237585

SHA256
2d65aef9343f7d50530d0066a5cd5f2e68532ffb063257c3a0a5ac9f446de846

SHA512
118e120840daa3c01d2bd05df71772773c69438cd17b267e48abd9418c0f03f040d4154c28f7c607184418af59a51c730e95bbc1c75ffdd5e519e45cc99d4b73

Download Submit
C:\Windows\system\cImECvt.exe

Filesize
1.7MB

MD5
48ef53e147bca2d66e5b147e5d1b91a0

SHA1
90d6e241e6fc0307c5ddeadfa2abf70a78aaa4ed

SHA256
a68a875de9ac0ac2f4f827ea7d002a6af54511fac300b950b49507d6a6efa4e5

SHA512
547164c0c1bef7a18d24ad72a40e26b39463546f9128a1c6bce999ad70cb8229a38fe963380dc24b214e8e9179ef4769a2f2c72dcfeb7c542740864501b1545e

Download Submit
C:\Windows\system\cuYWZup.exe

Filesize
1.7MB

MD5
9a0afbcf809be763267bc15216327c2d

SHA1
dff9a55afedcc1e24ce2dc206a8d9905065462d8

SHA256
4bbd5afaf917d4a4b9e151e1ce3a02c8217c39d535182f00747d32bad0b2248b

SHA512
08b747e32681f8e8275b4dd020360cacdf0b60c0cfafc50cc84b7a859ba13b6243ba7f3cd96030981e46a01eb7762b027278c61bd720723cf1e386aacb28826e

Download Submit
C:\Windows\system\eerXBOM.exe

Filesize
1.7MB

MD5
f47ff176452aacc882fbb1a0bcd1731e

SHA1
5531f3ead07c24ae942917e0cc0110073824050a

SHA256
ce976ad1d7793daba00006ad42776ac07e3d43782e627adcbc972f9620a7a703

SHA512
dae15b2c1506620433f61f51e28d3ee3660b765a148e6f2bd528489696e7bac0afbf3727db76135ad1df64a21c8c93dad1d642a2627a2a43de4333fc42d29058

Download Submit
C:\Windows\system\hDSKsZZ.exe

Filesize
1.7MB

MD5
b0718edca3569c907e4c820acec46070

SHA1
5961d763e592581c9ee0bae50e3f77aea731120e

SHA256
a8379a56c508ea135dd326eb4d3c45302f0490a35dd08786ce4449d7e7e0d11a

SHA512
1b545fd15884b3d4ff5c649dd94ab4a185a2f8f5f7c8a01f57f18c9915b2328e5a95be25567a82c874d49b2673643ea3155a1dc4fc8dd75d9041b969a275b9f3

Download Submit
C:\Windows\system\hyAHkar.exe

Filesize
1.7MB

MD5
7ee3da8b2bbc3df1c47fdc257a21ee4d

SHA1
f79bfa8747dd80c3e6df106dac2125d436dbcdea

SHA256
f9431c77fb922a5fb2d11f962f3b89841fd40e7ac4684c71426c7b8cd54bd6ce

SHA512
d3f483526751373c9ec8f9be886f10a8e64559e5d6ec6403497784bc4de70f88cc6004f671606ae6788384c213e36f273152d9ee814747c72ca649b242678b80

Download Submit
C:\Windows\system\iLWqXgu.exe

Filesize
1.7MB

MD5
e2dacc7fc54d0d34f49d744e5167a5e0

SHA1
9e815bd0da49bcdacbcbcaf529b13a2c6c0a6526

SHA256
b2f31db8cc517d02922c9c78bfe2fc5c6307d5e0ac70d53deebb715aa36e4fd5

SHA512
f8f476492f103981c70f6ba3ae98ca1ecf7ff7274b83dd52b5a262bac281f03b4b999195bdd7f3d69c8ed54a0fbc5dbf9b1f09deee4efe9706675615706ab0b6

Download Submit
C:\Windows\system\jknIshO.exe

Filesize
1.7MB

MD5
44a5a7caf5edb526244c4a5126a07822

SHA1
f9ad092fe1ddb98f4f21252f39c5638aa987883f

SHA256
798ea67b017d5c5126935c0d5e2017fd4502613f9768da5c043551fa303846f4

SHA512
d1345ff7ee8592ad1206cd2919ea79a8bc4a50b052dfe6020a71b27563ae9f756fc076be1399eafa66676b20b8de51573dd4788b81a93501857c5713cbef9fb0

Download Submit
C:\Windows\system\piIZZsR.exe

Filesize
1.7MB

MD5
28e66c0909bc3ceda9ede30728497a6f

SHA1
68ad774d37e2e52a382f12bae0fa71779c44813d

SHA256
9f52c632e841e366c64ab876465181b7d97ba9b60e58a1378babe98162e508f4

SHA512
781469617f0edae3a7c4212ac2a424976150d3769d47aea2aafb4bcac3e4279ef478c9da90eb8434c4cb226ace54cae5d1c781507d7ef53c1d8da1cb070c9889

Download Submit
C:\Windows\system\qOBUmah.exe

Filesize
1.7MB

MD5
02da4ebaf918263f0297d27cc04571d4

SHA1
6ec38abdfb0346e9a07715ee4841326e9887b223

SHA256
c8c4a138b9239447f47a31792c1f4cf79e530cb1b17035a13ec0b6a019e9d4c3

SHA512
a6b946d5df693647ca025256d1280a82d6b721bc254bcc6dfa00d16d5dc93a4cc745c60ab3504c39092b30de39a3430bd2993d14e70dba5615fd84acd5185125

Download Submit
C:\Windows\system\sqLibiS.exe

Filesize
1.7MB

MD5
1252b358133a2f282cc47aab806b1bb3

SHA1
3c4751293e475386ef63e7b52ea9465eca6406c8

SHA256
71610dfc42c942484befe69c94868b5bb9d987e40fc2019f0a4a5dfe159ed4af

SHA512
398582f2af0468401afcdd7ecbd6abad6f5ca975f795f7e56f559a3e38652e76001c1e8730c784007c989f44d75b1fee5b81f1e7d1083624163acbb74fa0910d

Download Submit
C:\Windows\system\wDzNavQ.exe

Filesize
1.7MB

MD5
2afa6eb786e682ef6aaeb820827c3da8

SHA1
58d8b62665e9f2c6f10546644da959c2e1a8addc

SHA256
606a360bec8cb7a08a7d383d2a308dec9878c25d5879974b627b8c6635543d7a

SHA512
e970147c1b2fc0795edc9992da103cc2add43241650c7d3663ab5fdae73273072c740a896cbcbf68c0ec377a9a1714191b1099c67665d1eba662d72d627f6bb6

Download Submit
C:\Windows\system\xDTREXx.exe

Filesize
1.7MB

MD5
f529ff3c0ae4985926c11fe0d207804f

SHA1
23b8e0384d849c62bcd9e340e6c08ce6a0a156d0

SHA256
0c221cf4afb83e41a5f521a6dc5209549bfa3a034122bff395c4d288d850a1c8

SHA512
f4c11778e3ef3c211efaa236f4bda717e8f9f97d676d7e274b5f8782c148fafcc11ad5ce1ff0736df3ed1f3583c7794797b38ccc9f7aecae9a08b631f9691777

Download Submit
\Windows\system\BNuXBFA.exe

Filesize
1.7MB

MD5
1aa7ea7a5cab070abdcc057f75888d45

SHA1
4b8ae619a5926e802625ecefb14467a62b5efae0

SHA256
51c2b530844767ca3487ce64d7496aa71c980e30cf85da0e0918eb6c24508b9e

SHA512
f2c10dd7e93d5cb932d2fe1d7ab3838f73bdb66ff8ae2edce469b415bcd1663ea3adcf080702336fd215e097c7151b991243d7fbfe5fc54a68add68d692acf72

Download Submit
\Windows\system\ESzpyvK.exe

Filesize
1.7MB

MD5
97830239428885548d18756d380a1f3f

SHA1
1a3547e65dd0bd6f723df4e3dac566409eb84d3d

SHA256
416950a21727561ffd92fbbb4d03c50ac42708b00c66380481737ec077e294a4

SHA512
5031f9587db17fd8fc852604c755ab69240a8dfda292854fb6e9d01a17b5e18e9599a943b5bf768cfe7fd45df2e56f40089150c0d817d5716d34c71d94a07d71

Download Submit
\Windows\system\FGjLlHt.exe

Filesize
1.7MB

MD5
84b8a36ecc791aebe4f1a36a7e590948

SHA1
8a784bdddfd1a74e979c055772d21cc378ee530e

SHA256
ef087e5da9e3b7f4a807bc69b253a9b57843f01537e22f42d991c09b63c66db0

SHA512
aefab35a39cc6c482d45a523da8473675934bf8f6ca0e82ac4a12bac82dbdc2c58fa50820cbfb371eab2c117eb3b7c2cbf3629f55c706f9f4bf9a13857adcabb

Download Submit
\Windows\system\IlUJChg.exe

Filesize
1.7MB

MD5
8fa6c53054f7943953138745d04d93ff

SHA1
dc164a3773361599cbb3dd04c2364cf5e3e6322b

SHA256
98420c9198b30573f0a40a1dcf8b4c8a9dad46de612520bfaf58d9d4004f2d39

SHA512
b85e817a8e27d202ef0ab8f75ec0bbce5614bd09943ea20415c53dca9e99fde2b16e6af1da89ddaeebdb4d84f4aca0eb83248e583c926a893ad46303ebd74d4b

Download Submit
\Windows\system\PnehNRy.exe

Filesize
1.7MB

MD5
d6d7cff5a6039ae01a0d079d811f5909

SHA1
e4a832af76ed1a9921d7bfa3bbd4b4c8450587fb

SHA256
58ac8cf6547681b959c9e3112878f9179a18bbbea0d23017f918ae158075f7b6

SHA512
58db4edd327de00bd896bc1008557e5a2ef904c9ed00a844e435907dace9e39efd8020962d3fd541637e6e65da13098e9b3f6dce6e15eb8d063b04964c1691d6

Download Submit
\Windows\system\QNSjcxA.exe

Filesize
1.7MB

MD5
7cb8c65e437e2dfd0838dd3d3e4f7da3

SHA1
e75f651d1339bda132ee3219f28dad3935024923

SHA256
adfd822ef8ab46d3d833c92a5f01122bf8b95c934c5824fba9a33b4fd5e9bd7c

SHA512
c74ee4a4f3c9a9ccfc07f27bbfda4e911dc1e0393eaa80c05bffbfad982673c1fe4dff7201aca6e12b7429206d59c9f34e765b1ec4a94fbcd958c44c47b1ae3d

Download Submit
\Windows\system\QUyONdw.exe

Filesize
1.7MB

MD5
6b92533c7bc1022aec038d621542ae33

SHA1
050c5fa338dd8b288527da61e04028b2ca95a00a

SHA256
2696d450d1ff8387b283a8fdc6cb0f905c43f4a5bff80ee6d4a5b9387b311f92

SHA512
abaa6442e00029a685bef77f0529fd81cf5195870cf0b6f10bf4c954e21818a152572ea293b0c7b9a62c2108d1f41c57d54d1d0e17cedc73b80600b53866fb60

Download Submit
\Windows\system\RPmGWAN.exe

Filesize
1.7MB

MD5
df0135dd42830eae9fbac1be6e23b167

SHA1
5d496a4777730e66563d032fe998589aa324ac61

SHA256
68ff01bae9dc7474a86c232b460e3969e4615ef58e88751da53e44ee5cc7be82

SHA512
92a8428b0c6b67c5fc89f71adbeb35cce7ebe3d6559292d6ef82cad45648d8fca72926c776b4279206699dc3cbc705a5a376c9fadd1812f4bb180beeb41513ec

Download Submit
\Windows\system\XJmRZTU.exe

Filesize
1.7MB

MD5
08ceab0f9ebb878459657dcf83c7bfad

SHA1
a2da2f99814e8d90f002a9249e8834f66485f937

SHA256
ff1fddb913d19eb7fbcb55a8cd3ab76e301239962d36b6b1cc23fe832bbf4a27

SHA512
e9ab5d2e1013f7edc93a04f4cf09150c2626a3569bec934f0ae381b6fb76c1fe4a5e28322f5e7a6e37cf00f47e5ba167c7ad1dc086b88fd372d00976b2accf68

Download Submit
\Windows\system\ZMAApKf.exe

Filesize
1.7MB

MD5
d86906de36971d6440e3534766ae82e2

SHA1
175be9095baae8f0074ac59692f9eb2df4b38c36

SHA256
8555629eb84ea9bc28ef5b7bf148d9925ffcdf57bfea0b4966198408b1cfdac0

SHA512
52c9e967e6556de2d66567a10c64e564702c23c2f5d78a2e3817ae50823315cb7357e991e22ee3acdd7e59aea39730c1a176587d3347d36966cc1a0f39c6407a

Download Submit
\Windows\system\cNCjfGz.exe

Filesize
1.7MB

MD5
58c11aeacc82cbddaec9c8c100df9c67

SHA1
19bac42833af228e5e61fe5af3097e154351fd8b

SHA256
b1d61b090745d6019b84ff8ec5c5b190187abbefad76ba401313896376d52a35

SHA512
6a8a3319bb9d5722e1f0bc3e72e5eac52809c6679990d8519799a99f559be6ce7e2d9d6e1c59126a9fcc5dc10f65df165743e022a51336d92c6e0a785f1191f1

Download Submit
\Windows\system\gCwDplp.exe

Filesize
1.7MB

MD5
2e42543c8b181e4611f0cfd12d71bfce

SHA1
36d7c6f3c4181eb745009c978a8ff52ddabd917e

SHA256
1534f5bdd1e41d25dea07d3d0f95700ec956a67d8e0b588e5743096e306a6211

SHA512
2d66482dec4eb627107f55aae975c3aacf5e51fea3d569c3b3b30889de90af2a8042f5906afc78af45004b5079b212b598a4604d5188176d44249af06d251dff

Download Submit
\Windows\system\jIiddEw.exe

Filesize
1.7MB

MD5
742e950ae2b8236f8bbbd6efa0db802d

SHA1
dc40f6fd04f18bebbb8f86086e59524bbcb681fc

SHA256
8c89bf1ef7bda458ec53d10a10e67bc9831707b87beb1c42233c17bc577939af

SHA512
e852187c42e6a6a5d50fc184d6fbbfe636b5e75f08679a5e0036959b5d3c97bfd9de32a091b702ecca7420c7da0ad7f33f8d315e6275917d4cde0156f186ebb9

Download Submit
\Windows\system\nnrmqvB.exe

Filesize
1.7MB

MD5
dac2056834e9626065777f5583fac230

SHA1
34443bc58afc2f55dd81faabdd958d1af4dff248

SHA256
9015c77b07f7886f57dce71e17250cad918589db7ef69a6e03d1d26e000584ef

SHA512
b76e377765f6bb2b83992f9739fac7a7d1a9be5b11295515e3934a06ee27882be8616b265604d88758cbfba31b89c24161818d2b10bfc71594ac750261ac3c1c

Download Submit
\Windows\system\nzgipwX.exe

Filesize
1.7MB

MD5
6c9aa439901b21a9d64c9ff33ab3373e

SHA1
f1952a74970e51b52f444a3c43bb4b1d99bddc44

SHA256
a05fe1b033b12053bba3328dcd3c7f9a390c38adafb4edaf9d77a75dbf50579a

SHA512
613435007e4bec9f23bb2a0b585b8b314d2b384cd3c5060906d4cd9647576bfff033bc406650629f9f0fface5cf7ea1fa97d6406aa0fd9527f139d227dbb0351

Download Submit
\Windows\system\rDaXpOb.exe

Filesize
1.7MB

MD5
ce65d71f87e95b5706ce41e5200b0573

SHA1
eb6b6ce41dbf987b2e2aa5b99c27b7bc8ecd9c31

SHA256
127c3a692106fc2edb6b5f3558a7aef9d9f3402a9c2a0c394a35c5a45d718226

SHA512
c1b5d2b82e88d98552856062661528cdeee03fdc838465dd25c51bab3e9b580929e10b4903147182c803ea1e5adbfccc458b3c314b9e637be3ec49ec2c0ca223

Download Submit
\Windows\system\tOXCuyv.exe

Filesize
1.7MB

MD5
eaff985e970a51001e4ccfde4854aca8

SHA1
c2726307dd1cd0f7a148ea48527167dccc2a1e78

SHA256
4ad2c105ca79cd7918719583c14f21940cc237e8eb286be8be428303eae2ef93

SHA512
2bf0edd22e809f7efce7fac87066a9119bc85ede7c4f11e796925387a1e99709274ab9d08e7be5a1c2b61bf9a74384b81dee6e8fdebb35eecb5a25275fc8bf93

Download Submit
\Windows\system\vOyxCyU.exe

Filesize
1.7MB

MD5
d6312eeed9b6d39f375b77e3c1ec44c7

SHA1
0eb83e7cbb5f39d2d8625960ffcfb0e8750895a1

SHA256
a4cebcb07ad9a646f3dde4e15f971da5cb60c0af17af9def143f21df5b6b9819

SHA512
7d7653ac3d15e58b6eda275188af5ab349da06d1c9c36603d5ce3827552e62a95ecf0bb1ad2e8c149596d4f23262fb6deea3d797eedc453e162b2842f341068d

Download Submit
\Windows\system\xFxUvmL.exe

Filesize
1.7MB

MD5
72f13e5ea3d39a41d745fcbfc3a9ca2c

SHA1
9c9c1e348c264c37c122badf9c9b52984edf1c00

SHA256
b87fe1607f4401400725873ff3d484b04db95293e6dc6df693319b55ed47581e

SHA512
4afc9d63167357375c939d5e3e891d07e8e499da892035123d3a4573ab27d0a6fec0859db0b2c819867dea3fdc3033df921c5565a42c1e6d6c67ae45683a2749

Download Submit
memory/2008-61-0x0000000003460000-0x0000000003852000-memory.dmp

Filesize
3.9MB

Download
memory/2008-11697-0x0000000003460000-0x0000000003852000-memory.dmp

Filesize
3.9MB

Download
memory/2008-1-0x00000000000F0000-0x0000000000100000-memory.dmp

Filesize
64KB

Download
memory/2008-91-0x000000013F0B0000-0x000000013F4A2000-memory.dmp

Filesize
3.9MB

Download
memory/2008-0-0x000000013F0B0000-0x000000013F4A2000-memory.dmp

Filesize
3.9MB

Download
memory/2008-70-0x0000000003460000-0x0000000003852000-memory.dmp

Filesize
3.9MB

Download
memory/2008-11040-0x000000013FC00000-0x000000013FFF2000-memory.dmp

Filesize
3.9MB

Download
memory/2008-48-0x000000013FA70000-0x000000013FE62000-memory.dmp

Filesize
3.9MB

Download
memory/2008-51-0x000000013F620000-0x000000013FA12000-memory.dmp

Filesize
3.9MB

Download
memory/2008-94-0x0000000003460000-0x0000000003852000-memory.dmp

Filesize
3.9MB

Download
memory/2008-69-0x000000013FB90000-0x000000013FF82000-memory.dmp

Filesize
3.9MB

Download
memory/2008-7668-0x0000000003460000-0x0000000003852000-memory.dmp

Filesize
3.9MB

Download
memory/2008-14-0x000000013F530000-0x000000013F922000-memory.dmp

Filesize
3.9MB

Download
memory/2008-46-0x000000013FB70000-0x000000013FF62000-memory.dmp

Filesize
3.9MB

Download
memory/2008-650-0x0000000003460000-0x0000000003852000-memory.dmp

Filesize
3.9MB

Download
memory/2008-28-0x000000013F9E0000-0x000000013FDD2000-memory.dmp

Filesize
3.9MB

Download
memory/2008-11368-0x0000000003460000-0x0000000003852000-memory.dmp

Filesize
3.9MB

Download
memory/2136-5356-0x000000013FB90000-0x000000013FF82000-memory.dmp

Filesize
3.9MB

Download
memory/2136-74-0x000000013FB90000-0x000000013FF82000-memory.dmp

Filesize
3.9MB

Download
memory/2168-5357-0x000000013F350000-0x000000013F742000-memory.dmp

Filesize
3.9MB

Download
memory/2168-95-0x000000013F350000-0x000000013F742000-memory.dmp

Filesize
3.9MB

Download
memory/2184-30-0x000007FEF5A6E000-0x000007FEF5A6F000-memory.dmp

Filesize
4KB

Download
memory/2184-33-0x000000001B6E0000-0x000000001B9C2000-memory.dmp

Filesize
2.9MB

Download
memory/2184-43-0x0000000002220000-0x0000000002228000-memory.dmp

Filesize
32KB

Download
memory/2184-42-0x000007FEF57B0000-0x000007FEF614D000-memory.dmp

Filesize
9.6MB

Download
memory/2184-44-0x000007FEF57B0000-0x000007FEF614D000-memory.dmp

Filesize
9.6MB

Download
memory/2184-97-0x000007FEF57B0000-0x000007FEF614D000-memory.dmp

Filesize
9.6MB

Download
memory/2184-492-0x000007FEF57B0000-0x000007FEF614D000-memory.dmp

Filesize
9.6MB

Download
memory/2184-45-0x000007FEF57B0000-0x000007FEF614D000-memory.dmp

Filesize
9.6MB

Download
memory/2184-401-0x000007FEF57B0000-0x000007FEF614D000-memory.dmp

Filesize
9.6MB

Download
memory/2184-47-0x000007FEF57B0000-0x000007FEF614D000-memory.dmp

Filesize
9.6MB

Download
memory/2584-53-0x000000013F620000-0x000000013FA12000-memory.dmp

Filesize
3.9MB

Download
memory/2584-5363-0x000000013F620000-0x000000013FA12000-memory.dmp

Filesize
3.9MB

Download
memory/2696-29-0x000000013F9E0000-0x000000013FDD2000-memory.dmp

Filesize
3.9MB

Download
memory/2696-5366-0x000000013F9E0000-0x000000013FDD2000-memory.dmp

Filesize
3.9MB

Download
memory/2704-54-0x000000013FA70000-0x000000013FE62000-memory.dmp

Filesize
3.9MB

Download
memory/2704-5361-0x000000013FA70000-0x000000013FE62000-memory.dmp

Filesize
3.9MB

Download
memory/2800-50-0x000000013FB70000-0x000000013FF62000-memory.dmp

Filesize
3.9MB

Download
memory/2800-5359-0x000000013FB70000-0x000000013FF62000-memory.dmp

Filesize
3.9MB

Download
memory/2808-5358-0x000000013FC00000-0x000000013FFF2000-memory.dmp

Filesize
3.9MB

Download
memory/2808-89-0x000000013FC00000-0x000000013FFF2000-memory.dmp

Filesize
3.9MB

Download
memory/2932-5364-0x000000013F230000-0x000000013F622000-memory.dmp

Filesize
3.9MB

Download
memory/2932-66-0x000000013F230000-0x000000013F622000-memory.dmp

Filesize
3.9MB

Download
memory/2932-651-0x000000013F230000-0x000000013F622000-memory.dmp

Filesize
3.9MB

Download
memory/2944-5360-0x000000013F330000-0x000000013F722000-memory.dmp

Filesize
3.9MB

Download
memory/2944-72-0x000000013F330000-0x000000013F722000-memory.dmp

Filesize
3.9MB

Download
memory/2984-5362-0x000000013F030000-0x000000013F422000-memory.dmp

Filesize
3.9MB

Download
memory/2984-12-0x000000013F030000-0x000000013F422000-memory.dmp

Filesize
3.9MB

Download
memory/3060-5365-0x000000013F530000-0x000000013F922000-memory.dmp

Filesize
3.9MB

Download
memory/3060-15-0x000000013F530000-0x000000013F922000-memory.dmp

Filesize
3.9MB

Download