xmrig | d04e097d59023a1ba74884547009c42fc24bba869a70bf5f409094cbedcacb06

Analysis

max time kernel
150s
max time network
142s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
10/05/2024, 21:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

10bd318d69bbaec0c81cf390cafa3240_NeikiAnalytics.exe
Size

2.7MB
MD5

10bd318d69bbaec0c81cf390cafa3240
SHA1

36f2936a8709b532c7636b471e6836b5d6f050a3
SHA256

d04e097d59023a1ba74884547009c42fc24bba869a70bf5f409094cbedcacb06
SHA512

fdac870fc7686f608d515b7bebc23a7ff0a460827fe4902ac2d7ce16745546b4be3afb578fe4b1619259dc553114ec9178f5af59b66f70ccdbb3ae2d21bb17ce
SSDEEP

49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkivwSbakf:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2RX

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 54 IoCs

miner

resource	yara_rule
behavioral1/files/0x000c00000001342e-6.dat	xmrig
behavioral1/memory/2348-1-0x000000013F600000-0x000000013F9F6000-memory.dmp	xmrig
behavioral1/files/0x0030000000013adc-9.dat	xmrig
behavioral1/memory/2176-8-0x000000013FBA0000-0x000000013FF96000-memory.dmp	xmrig
behavioral1/memory/3012-16-0x000000013FA10000-0x000000013FE06000-memory.dmp	xmrig
behavioral1/files/0x000700000001418c-24.dat	xmrig
behavioral1/files/0x0016000000005586-30.dat	xmrig
behavioral1/files/0x000800000001431b-34.dat	xmrig
behavioral1/files/0x000900000001432f-39.dat	xmrig
behavioral1/files/0x0009000000014367-45.dat	xmrig
behavioral1/files/0x0006000000014b1c-54.dat	xmrig
behavioral1/files/0x0006000000014bd7-59.dat	xmrig
behavioral1/files/0x0006000000014c2d-64.dat	xmrig
behavioral1/files/0x000600000001507a-74.dat	xmrig
behavioral1/files/0x00060000000150d9-84.dat	xmrig
behavioral1/files/0x00060000000153ee-89.dat	xmrig
behavioral1/files/0x0006000000015662-99.dat	xmrig
behavioral1/files/0x0006000000015ae3-109.dat	xmrig
behavioral1/memory/1296-138-0x000000013FC70000-0x0000000140066000-memory.dmp	xmrig
behavioral1/files/0x0006000000015cd2-147.dat	xmrig
behavioral1/memory/2372-156-0x000000013FB40000-0x000000013FF36000-memory.dmp	xmrig
behavioral1/memory/2492-153-0x000000013F0A0000-0x000000013F496000-memory.dmp	xmrig
behavioral1/files/0x0006000000015ca8-152.dat	xmrig
behavioral1/files/0x002f000000013f2c-182.dat	xmrig
behavioral1/files/0x0006000000015d0a-189.dat	xmrig
behavioral1/files/0x0006000000015cf8-185.dat	xmrig
behavioral1/memory/2348-2440-0x000000013F600000-0x000000013F9F6000-memory.dmp	xmrig
behavioral1/memory/1876-170-0x000000013F990000-0x000000013FD86000-memory.dmp	xmrig
behavioral1/memory/2500-168-0x000000013F770000-0x000000013FB66000-memory.dmp	xmrig
behavioral1/files/0x0006000000015cc5-167.dat	xmrig
behavioral1/memory/2532-165-0x000000013F5D0000-0x000000013F9C6000-memory.dmp	xmrig
behavioral1/memory/2468-163-0x000000013FD00000-0x00000001400F6000-memory.dmp	xmrig
behavioral1/memory/2712-161-0x000000013FB30000-0x000000013FF26000-memory.dmp	xmrig
behavioral1/files/0x0006000000015ce3-158.dat	xmrig
behavioral1/files/0x0006000000015cee-176.dat	xmrig
behavioral1/memory/2640-175-0x000000013F8C0000-0x000000013FCB6000-memory.dmp	xmrig
behavioral1/memory/2348-151-0x000000013F0A0000-0x000000013F496000-memory.dmp	xmrig
behavioral1/memory/2688-150-0x000000013FAD0000-0x000000013FEC6000-memory.dmp	xmrig
behavioral1/files/0x0006000000015b85-119.dat	xmrig
behavioral1/files/0x0006000000015cb1-137.dat	xmrig
behavioral1/files/0x0006000000015c9a-125.dat	xmrig
behavioral1/files/0x0006000000015b50-114.dat	xmrig
behavioral1/files/0x00060000000158d9-104.dat	xmrig
behavioral1/files/0x000600000001565a-94.dat	xmrig
behavioral1/files/0x0006000000015083-79.dat	xmrig
behavioral1/files/0x0006000000014f57-69.dat	xmrig
behavioral1/files/0x0008000000014a60-49.dat	xmrig
behavioral1/memory/2176-2604-0x000000013FBA0000-0x000000013FF96000-memory.dmp	xmrig
behavioral1/memory/3012-3274-0x000000013FA10000-0x000000013FE06000-memory.dmp	xmrig
behavioral1/memory/2688-6566-0x000000013FAD0000-0x000000013FEC6000-memory.dmp	xmrig
behavioral1/memory/2468-6587-0x000000013FD00000-0x00000001400F6000-memory.dmp	xmrig
behavioral1/memory/2532-6600-0x000000013F5D0000-0x000000013F9C6000-memory.dmp	xmrig
behavioral1/memory/1876-6602-0x000000013F990000-0x000000013FD86000-memory.dmp	xmrig
behavioral1/memory/2640-6601-0x000000013F8C0000-0x000000013FCB6000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
2184	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
2176	TTIbxls.exe
3012	GKVftSz.exe
1296	ZdudMFR.exe
2688	RlRMlLp.exe
2492	TtcvwfM.exe
2372	JnEyMSF.exe
2712	kZpyUQG.exe
2468	BozYnme.exe
2532	ZUQpCOY.exe
2500	QzyJBbD.exe
1876	fhZeQMe.exe
2640	emrgqfF.exe
2804	uTjplhl.exe
2820	KPxiLCr.exe
2168	YgfslEk.exe
1428	kQyJOVf.exe
1860	iSmLflD.exe
2336	RKOzOyw.exe
1624	BhysUxA.exe
1760	xZgCaOc.exe
332	nDYzwzU.exe
2748	NlCWvsB.exe
2120	SWKHGks.exe
1768	RArlMnm.exe
1232	muMnkik.exe
1528	ZjrlYzY.exe
2296	WCKpRXU.exe
940	xEudFmA.exe
560	ghRFOby.exe
1512	NbrUbAS.exe
1136	PUsgwmE.exe
696	KAIjPZD.exe
2424	WEGiKCF.exe
1644	VyyZBOD.exe
2144	BmRVZzo.exe
1188	yRFKqGl.exe
1356	IUDdrWO.exe
1776	AqptOao.exe
2160	lUvGGDL.exe
1340	fXQfKfV.exe
648	KOeVeLA.exe
892	PsKjFQn.exe
2108	ygijdGT.exe
1764	cKMuQwO.exe
1872	EeiVykn.exe
868	AKmIwbd.exe
1020	uhXpHra.exe
2164	GvPQHjI.exe
1596	rFtYAiL.exe
2096	GjzWtCo.exe
3024	fWZJTQD.exe
2708	CpTBJkk.exe
2528	ZqdvMUy.exe
2740	CEhvKqZ.exe
2544	qXKHsAF.exe
1672	fGGqEoy.exe
2368	awxPXlk.exe
1264	blyocfF.exe
1608	jxJzCoP.exe
1272	xRDnayR.exe
1352	floZIZt.exe
1044	fQEPFYt.exe
1032	DtKxshP.exe
2260	KFCSWTm.exe

Loads dropped DLL 64 IoCs

pid	Process
2348	10bd318d69bbaec0c81cf390cafa3240_NeikiAnalytics.exe
2348	10bd318d69bbaec0c81cf390cafa3240_NeikiAnalytics.exe
2348	10bd318d69bbaec0c81cf390cafa3240_NeikiAnalytics.exe
2348	10bd318d69bbaec0c81cf390cafa3240_NeikiAnalytics.exe
2348	10bd318d69bbaec0c81cf390cafa3240_NeikiAnalytics.exe
2348	10bd318d69bbaec0c81cf390cafa3240_NeikiAnalytics.exe
2348	10bd318d69bbaec0c81cf390cafa3240_NeikiAnalytics.exe
2348	10bd318d69bbaec0c81cf390cafa3240_NeikiAnalytics.exe
2348	10bd318d69bbaec0c81cf390cafa3240_NeikiAnalytics.exe
2348	10bd318d69bbaec0c81cf390cafa3240_NeikiAnalytics.exe
2348	10bd318d69bbaec0c81cf390cafa3240_NeikiAnalytics.exe
2348	10bd318d69bbaec0c81cf390cafa3240_NeikiAnalytics.exe
2348	10bd318d69bbaec0c81cf390cafa3240_NeikiAnalytics.exe
2348	10bd318d69bbaec0c81cf390cafa3240_NeikiAnalytics.exe
2348	10bd318d69bbaec0c81cf390cafa3240_NeikiAnalytics.exe
2348	10bd318d69bbaec0c81cf390cafa3240_NeikiAnalytics.exe
2348	10bd318d69bbaec0c81cf390cafa3240_NeikiAnalytics.exe
2348	10bd318d69bbaec0c81cf390cafa3240_NeikiAnalytics.exe
2348	10bd318d69bbaec0c81cf390cafa3240_NeikiAnalytics.exe
2348	10bd318d69bbaec0c81cf390cafa3240_NeikiAnalytics.exe
2348	10bd318d69bbaec0c81cf390cafa3240_NeikiAnalytics.exe
2348	10bd318d69bbaec0c81cf390cafa3240_NeikiAnalytics.exe
2348	10bd318d69bbaec0c81cf390cafa3240_NeikiAnalytics.exe
2348	10bd318d69bbaec0c81cf390cafa3240_NeikiAnalytics.exe
2348	10bd318d69bbaec0c81cf390cafa3240_NeikiAnalytics.exe
2348	10bd318d69bbaec0c81cf390cafa3240_NeikiAnalytics.exe
2348	10bd318d69bbaec0c81cf390cafa3240_NeikiAnalytics.exe
2348	10bd318d69bbaec0c81cf390cafa3240_NeikiAnalytics.exe
2348	10bd318d69bbaec0c81cf390cafa3240_NeikiAnalytics.exe
2348	10bd318d69bbaec0c81cf390cafa3240_NeikiAnalytics.exe
2348	10bd318d69bbaec0c81cf390cafa3240_NeikiAnalytics.exe
2348	10bd318d69bbaec0c81cf390cafa3240_NeikiAnalytics.exe
2348	10bd318d69bbaec0c81cf390cafa3240_NeikiAnalytics.exe
2348	10bd318d69bbaec0c81cf390cafa3240_NeikiAnalytics.exe
2348	10bd318d69bbaec0c81cf390cafa3240_NeikiAnalytics.exe
2348	10bd318d69bbaec0c81cf390cafa3240_NeikiAnalytics.exe
2348	10bd318d69bbaec0c81cf390cafa3240_NeikiAnalytics.exe
2348	10bd318d69bbaec0c81cf390cafa3240_NeikiAnalytics.exe
2348	10bd318d69bbaec0c81cf390cafa3240_NeikiAnalytics.exe
2348	10bd318d69bbaec0c81cf390cafa3240_NeikiAnalytics.exe
2348	10bd318d69bbaec0c81cf390cafa3240_NeikiAnalytics.exe
2348	10bd318d69bbaec0c81cf390cafa3240_NeikiAnalytics.exe
2348	10bd318d69bbaec0c81cf390cafa3240_NeikiAnalytics.exe
2348	10bd318d69bbaec0c81cf390cafa3240_NeikiAnalytics.exe
2348	10bd318d69bbaec0c81cf390cafa3240_NeikiAnalytics.exe
2348	10bd318d69bbaec0c81cf390cafa3240_NeikiAnalytics.exe
2348	10bd318d69bbaec0c81cf390cafa3240_NeikiAnalytics.exe
2348	10bd318d69bbaec0c81cf390cafa3240_NeikiAnalytics.exe
2348	10bd318d69bbaec0c81cf390cafa3240_NeikiAnalytics.exe
2348	10bd318d69bbaec0c81cf390cafa3240_NeikiAnalytics.exe
2348	10bd318d69bbaec0c81cf390cafa3240_NeikiAnalytics.exe
2348	10bd318d69bbaec0c81cf390cafa3240_NeikiAnalytics.exe
2348	10bd318d69bbaec0c81cf390cafa3240_NeikiAnalytics.exe
2348	10bd318d69bbaec0c81cf390cafa3240_NeikiAnalytics.exe
2348	10bd318d69bbaec0c81cf390cafa3240_NeikiAnalytics.exe
2348	10bd318d69bbaec0c81cf390cafa3240_NeikiAnalytics.exe
2348	10bd318d69bbaec0c81cf390cafa3240_NeikiAnalytics.exe
2348	10bd318d69bbaec0c81cf390cafa3240_NeikiAnalytics.exe
2348	10bd318d69bbaec0c81cf390cafa3240_NeikiAnalytics.exe
2348	10bd318d69bbaec0c81cf390cafa3240_NeikiAnalytics.exe
2348	10bd318d69bbaec0c81cf390cafa3240_NeikiAnalytics.exe
2348	10bd318d69bbaec0c81cf390cafa3240_NeikiAnalytics.exe
2348	10bd318d69bbaec0c81cf390cafa3240_NeikiAnalytics.exe
2348	10bd318d69bbaec0c81cf390cafa3240_NeikiAnalytics.exe

UPX packed file 53 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x000c00000001342e-6.dat	upx
behavioral1/memory/2348-1-0x000000013F600000-0x000000013F9F6000-memory.dmp	upx
behavioral1/files/0x0030000000013adc-9.dat	upx
behavioral1/memory/2176-8-0x000000013FBA0000-0x000000013FF96000-memory.dmp	upx
behavioral1/memory/3012-16-0x000000013FA10000-0x000000013FE06000-memory.dmp	upx
behavioral1/files/0x000700000001418c-24.dat	upx
behavioral1/files/0x0016000000005586-30.dat	upx
behavioral1/files/0x000800000001431b-34.dat	upx
behavioral1/files/0x000900000001432f-39.dat	upx
behavioral1/files/0x0009000000014367-45.dat	upx
behavioral1/files/0x0006000000014b1c-54.dat	upx
behavioral1/files/0x0006000000014bd7-59.dat	upx
behavioral1/files/0x0006000000014c2d-64.dat	upx
behavioral1/files/0x000600000001507a-74.dat	upx
behavioral1/files/0x00060000000150d9-84.dat	upx
behavioral1/files/0x00060000000153ee-89.dat	upx
behavioral1/files/0x0006000000015662-99.dat	upx
behavioral1/files/0x0006000000015ae3-109.dat	upx
behavioral1/memory/1296-138-0x000000013FC70000-0x0000000140066000-memory.dmp	upx
behavioral1/files/0x0006000000015cd2-147.dat	upx
behavioral1/memory/2372-156-0x000000013FB40000-0x000000013FF36000-memory.dmp	upx
behavioral1/memory/2492-153-0x000000013F0A0000-0x000000013F496000-memory.dmp	upx
behavioral1/files/0x0006000000015ca8-152.dat	upx
behavioral1/files/0x002f000000013f2c-182.dat	upx
behavioral1/files/0x0006000000015d0a-189.dat	upx
behavioral1/files/0x0006000000015cf8-185.dat	upx
behavioral1/memory/2348-2440-0x000000013F600000-0x000000013F9F6000-memory.dmp	upx
behavioral1/memory/1876-170-0x000000013F990000-0x000000013FD86000-memory.dmp	upx
behavioral1/memory/2500-168-0x000000013F770000-0x000000013FB66000-memory.dmp	upx
behavioral1/files/0x0006000000015cc5-167.dat	upx
behavioral1/memory/2532-165-0x000000013F5D0000-0x000000013F9C6000-memory.dmp	upx
behavioral1/memory/2468-163-0x000000013FD00000-0x00000001400F6000-memory.dmp	upx
behavioral1/memory/2712-161-0x000000013FB30000-0x000000013FF26000-memory.dmp	upx
behavioral1/files/0x0006000000015ce3-158.dat	upx
behavioral1/files/0x0006000000015cee-176.dat	upx
behavioral1/memory/2640-175-0x000000013F8C0000-0x000000013FCB6000-memory.dmp	upx
behavioral1/memory/2688-150-0x000000013FAD0000-0x000000013FEC6000-memory.dmp	upx
behavioral1/files/0x0006000000015b85-119.dat	upx
behavioral1/files/0x0006000000015cb1-137.dat	upx
behavioral1/files/0x0006000000015c9a-125.dat	upx
behavioral1/files/0x0006000000015b50-114.dat	upx
behavioral1/files/0x00060000000158d9-104.dat	upx
behavioral1/files/0x000600000001565a-94.dat	upx
behavioral1/files/0x0006000000015083-79.dat	upx
behavioral1/files/0x0006000000014f57-69.dat	upx
behavioral1/files/0x0008000000014a60-49.dat	upx
behavioral1/memory/2176-2604-0x000000013FBA0000-0x000000013FF96000-memory.dmp	upx
behavioral1/memory/3012-3274-0x000000013FA10000-0x000000013FE06000-memory.dmp	upx
behavioral1/memory/2688-6566-0x000000013FAD0000-0x000000013FEC6000-memory.dmp	upx
behavioral1/memory/2468-6587-0x000000013FD00000-0x00000001400F6000-memory.dmp	upx
behavioral1/memory/2532-6600-0x000000013F5D0000-0x000000013F9C6000-memory.dmp	upx
behavioral1/memory/1876-6602-0x000000013F990000-0x000000013FD86000-memory.dmp	upx
behavioral1/memory/2640-6601-0x000000013F8C0000-0x000000013FCB6000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\DswlkNi.exe	10bd318d69bbaec0c81cf390cafa3240_NeikiAnalytics.exe
File created	C:\Windows\System\xHiWkqZ.exe	10bd318d69bbaec0c81cf390cafa3240_NeikiAnalytics.exe
File created	C:\Windows\System\XUVVhMA.exe	10bd318d69bbaec0c81cf390cafa3240_NeikiAnalytics.exe
File created	C:\Windows\System\ezzNTuE.exe	10bd318d69bbaec0c81cf390cafa3240_NeikiAnalytics.exe
File created	C:\Windows\System\sXwOoXG.exe	10bd318d69bbaec0c81cf390cafa3240_NeikiAnalytics.exe
File created	C:\Windows\System\QvBdgBu.exe	10bd318d69bbaec0c81cf390cafa3240_NeikiAnalytics.exe
File created	C:\Windows\System\AwkHWlw.exe	10bd318d69bbaec0c81cf390cafa3240_NeikiAnalytics.exe
File created	C:\Windows\System\cPbFUef.exe	10bd318d69bbaec0c81cf390cafa3240_NeikiAnalytics.exe
File created	C:\Windows\System\hJOucki.exe	10bd318d69bbaec0c81cf390cafa3240_NeikiAnalytics.exe
File created	C:\Windows\System\JQBawVe.exe	10bd318d69bbaec0c81cf390cafa3240_NeikiAnalytics.exe
File created	C:\Windows\System\hXUolrP.exe	10bd318d69bbaec0c81cf390cafa3240_NeikiAnalytics.exe
File created	C:\Windows\System\oamDgmo.exe	10bd318d69bbaec0c81cf390cafa3240_NeikiAnalytics.exe
File created	C:\Windows\System\EbFqoQC.exe	10bd318d69bbaec0c81cf390cafa3240_NeikiAnalytics.exe
File created	C:\Windows\System\ZXZpGjG.exe	10bd318d69bbaec0c81cf390cafa3240_NeikiAnalytics.exe
File created	C:\Windows\System\yMsnGot.exe	10bd318d69bbaec0c81cf390cafa3240_NeikiAnalytics.exe
File created	C:\Windows\System\rhQFxdt.exe	10bd318d69bbaec0c81cf390cafa3240_NeikiAnalytics.exe
File created	C:\Windows\System\IikfJDr.exe	10bd318d69bbaec0c81cf390cafa3240_NeikiAnalytics.exe
File created	C:\Windows\System\fehhftp.exe	10bd318d69bbaec0c81cf390cafa3240_NeikiAnalytics.exe
File created	C:\Windows\System\naaOvve.exe	10bd318d69bbaec0c81cf390cafa3240_NeikiAnalytics.exe
File created	C:\Windows\System\jAIVIOW.exe	10bd318d69bbaec0c81cf390cafa3240_NeikiAnalytics.exe
File created	C:\Windows\System\GQxiKra.exe	10bd318d69bbaec0c81cf390cafa3240_NeikiAnalytics.exe
File created	C:\Windows\System\LMcXVvx.exe	10bd318d69bbaec0c81cf390cafa3240_NeikiAnalytics.exe
File created	C:\Windows\System\MJLCPmQ.exe	10bd318d69bbaec0c81cf390cafa3240_NeikiAnalytics.exe
File created	C:\Windows\System\WxyCjhI.exe	10bd318d69bbaec0c81cf390cafa3240_NeikiAnalytics.exe
File created	C:\Windows\System\zTvUnEB.exe	10bd318d69bbaec0c81cf390cafa3240_NeikiAnalytics.exe
File created	C:\Windows\System\xOndzHA.exe	10bd318d69bbaec0c81cf390cafa3240_NeikiAnalytics.exe
File created	C:\Windows\System\yrDdQlV.exe	10bd318d69bbaec0c81cf390cafa3240_NeikiAnalytics.exe
File created	C:\Windows\System\GqdhCvv.exe	10bd318d69bbaec0c81cf390cafa3240_NeikiAnalytics.exe
File created	C:\Windows\System\cFgwTPA.exe	10bd318d69bbaec0c81cf390cafa3240_NeikiAnalytics.exe
File created	C:\Windows\System\orikUJe.exe	10bd318d69bbaec0c81cf390cafa3240_NeikiAnalytics.exe
File created	C:\Windows\System\tFOoRqh.exe	10bd318d69bbaec0c81cf390cafa3240_NeikiAnalytics.exe
File created	C:\Windows\System\ZvtdTtu.exe	10bd318d69bbaec0c81cf390cafa3240_NeikiAnalytics.exe
File created	C:\Windows\System\WqfTNiS.exe	10bd318d69bbaec0c81cf390cafa3240_NeikiAnalytics.exe
File created	C:\Windows\System\oTkcBGo.exe	10bd318d69bbaec0c81cf390cafa3240_NeikiAnalytics.exe
File created	C:\Windows\System\ADLTlGk.exe	10bd318d69bbaec0c81cf390cafa3240_NeikiAnalytics.exe
File created	C:\Windows\System\JmHdJvf.exe	10bd318d69bbaec0c81cf390cafa3240_NeikiAnalytics.exe
File created	C:\Windows\System\riDTbRX.exe	10bd318d69bbaec0c81cf390cafa3240_NeikiAnalytics.exe
File created	C:\Windows\System\HGqNpYk.exe	10bd318d69bbaec0c81cf390cafa3240_NeikiAnalytics.exe
File created	C:\Windows\System\ZnKhUrn.exe	10bd318d69bbaec0c81cf390cafa3240_NeikiAnalytics.exe
File created	C:\Windows\System\FwfPBlt.exe	10bd318d69bbaec0c81cf390cafa3240_NeikiAnalytics.exe
File created	C:\Windows\System\IHbWZBS.exe	10bd318d69bbaec0c81cf390cafa3240_NeikiAnalytics.exe
File created	C:\Windows\System\WqakYWV.exe	10bd318d69bbaec0c81cf390cafa3240_NeikiAnalytics.exe
File created	C:\Windows\System\ngBTDGm.exe	10bd318d69bbaec0c81cf390cafa3240_NeikiAnalytics.exe
File created	C:\Windows\System\zHSzeTc.exe	10bd318d69bbaec0c81cf390cafa3240_NeikiAnalytics.exe
File created	C:\Windows\System\YLGczNp.exe	10bd318d69bbaec0c81cf390cafa3240_NeikiAnalytics.exe
File created	C:\Windows\System\KciVWiu.exe	10bd318d69bbaec0c81cf390cafa3240_NeikiAnalytics.exe
File created	C:\Windows\System\FsgMDsF.exe	10bd318d69bbaec0c81cf390cafa3240_NeikiAnalytics.exe
File created	C:\Windows\System\cjbvEbm.exe	10bd318d69bbaec0c81cf390cafa3240_NeikiAnalytics.exe
File created	C:\Windows\System\DjkIsfj.exe	10bd318d69bbaec0c81cf390cafa3240_NeikiAnalytics.exe
File created	C:\Windows\System\OrsHqIH.exe	10bd318d69bbaec0c81cf390cafa3240_NeikiAnalytics.exe
File created	C:\Windows\System\riExmun.exe	10bd318d69bbaec0c81cf390cafa3240_NeikiAnalytics.exe
File created	C:\Windows\System\OFuAuOd.exe	10bd318d69bbaec0c81cf390cafa3240_NeikiAnalytics.exe
File created	C:\Windows\System\mnSXGlo.exe	10bd318d69bbaec0c81cf390cafa3240_NeikiAnalytics.exe
File created	C:\Windows\System\MnwxBze.exe	10bd318d69bbaec0c81cf390cafa3240_NeikiAnalytics.exe
File created	C:\Windows\System\hIuZgnp.exe	10bd318d69bbaec0c81cf390cafa3240_NeikiAnalytics.exe
File created	C:\Windows\System\ieMJxlj.exe	10bd318d69bbaec0c81cf390cafa3240_NeikiAnalytics.exe
File created	C:\Windows\System\HGJndzy.exe	10bd318d69bbaec0c81cf390cafa3240_NeikiAnalytics.exe
File created	C:\Windows\System\FmyJebP.exe	10bd318d69bbaec0c81cf390cafa3240_NeikiAnalytics.exe
File created	C:\Windows\System\nEiHfMB.exe	10bd318d69bbaec0c81cf390cafa3240_NeikiAnalytics.exe
File created	C:\Windows\System\uJsuJpi.exe	10bd318d69bbaec0c81cf390cafa3240_NeikiAnalytics.exe
File created	C:\Windows\System\eBhCOjt.exe	10bd318d69bbaec0c81cf390cafa3240_NeikiAnalytics.exe
File created	C:\Windows\System\bVDwLSz.exe	10bd318d69bbaec0c81cf390cafa3240_NeikiAnalytics.exe
File created	C:\Windows\System\QCVpaft.exe	10bd318d69bbaec0c81cf390cafa3240_NeikiAnalytics.exe
File created	C:\Windows\System\ngSkEqZ.exe	10bd318d69bbaec0c81cf390cafa3240_NeikiAnalytics.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2184	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2348	10bd318d69bbaec0c81cf390cafa3240_NeikiAnalytics.exe
Token: SeLockMemoryPrivilege	2348	10bd318d69bbaec0c81cf390cafa3240_NeikiAnalytics.exe
Token: SeDebugPrivilege	2184	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2348 wrote to memory of 2184	2348	10bd318d69bbaec0c81cf390cafa3240_NeikiAnalytics.exe	29
PID 2348 wrote to memory of 2184	2348	10bd318d69bbaec0c81cf390cafa3240_NeikiAnalytics.exe	29
PID 2348 wrote to memory of 2184	2348	10bd318d69bbaec0c81cf390cafa3240_NeikiAnalytics.exe	29
PID 2348 wrote to memory of 2176	2348	10bd318d69bbaec0c81cf390cafa3240_NeikiAnalytics.exe	30
PID 2348 wrote to memory of 2176	2348	10bd318d69bbaec0c81cf390cafa3240_NeikiAnalytics.exe	30
PID 2348 wrote to memory of 2176	2348	10bd318d69bbaec0c81cf390cafa3240_NeikiAnalytics.exe	30
PID 2348 wrote to memory of 3012	2348	10bd318d69bbaec0c81cf390cafa3240_NeikiAnalytics.exe	31
PID 2348 wrote to memory of 3012	2348	10bd318d69bbaec0c81cf390cafa3240_NeikiAnalytics.exe	31
PID 2348 wrote to memory of 3012	2348	10bd318d69bbaec0c81cf390cafa3240_NeikiAnalytics.exe	31
PID 2348 wrote to memory of 1296	2348	10bd318d69bbaec0c81cf390cafa3240_NeikiAnalytics.exe	32
PID 2348 wrote to memory of 1296	2348	10bd318d69bbaec0c81cf390cafa3240_NeikiAnalytics.exe	32
PID 2348 wrote to memory of 1296	2348	10bd318d69bbaec0c81cf390cafa3240_NeikiAnalytics.exe	32
PID 2348 wrote to memory of 2688	2348	10bd318d69bbaec0c81cf390cafa3240_NeikiAnalytics.exe	33
PID 2348 wrote to memory of 2688	2348	10bd318d69bbaec0c81cf390cafa3240_NeikiAnalytics.exe	33
PID 2348 wrote to memory of 2688	2348	10bd318d69bbaec0c81cf390cafa3240_NeikiAnalytics.exe	33
PID 2348 wrote to memory of 2492	2348	10bd318d69bbaec0c81cf390cafa3240_NeikiAnalytics.exe	34
PID 2348 wrote to memory of 2492	2348	10bd318d69bbaec0c81cf390cafa3240_NeikiAnalytics.exe	34
PID 2348 wrote to memory of 2492	2348	10bd318d69bbaec0c81cf390cafa3240_NeikiAnalytics.exe	34
PID 2348 wrote to memory of 2372	2348	10bd318d69bbaec0c81cf390cafa3240_NeikiAnalytics.exe	35
PID 2348 wrote to memory of 2372	2348	10bd318d69bbaec0c81cf390cafa3240_NeikiAnalytics.exe	35
PID 2348 wrote to memory of 2372	2348	10bd318d69bbaec0c81cf390cafa3240_NeikiAnalytics.exe	35
PID 2348 wrote to memory of 2712	2348	10bd318d69bbaec0c81cf390cafa3240_NeikiAnalytics.exe	36
PID 2348 wrote to memory of 2712	2348	10bd318d69bbaec0c81cf390cafa3240_NeikiAnalytics.exe	36
PID 2348 wrote to memory of 2712	2348	10bd318d69bbaec0c81cf390cafa3240_NeikiAnalytics.exe	36
PID 2348 wrote to memory of 2468	2348	10bd318d69bbaec0c81cf390cafa3240_NeikiAnalytics.exe	37
PID 2348 wrote to memory of 2468	2348	10bd318d69bbaec0c81cf390cafa3240_NeikiAnalytics.exe	37
PID 2348 wrote to memory of 2468	2348	10bd318d69bbaec0c81cf390cafa3240_NeikiAnalytics.exe	37
PID 2348 wrote to memory of 2532	2348	10bd318d69bbaec0c81cf390cafa3240_NeikiAnalytics.exe	38
PID 2348 wrote to memory of 2532	2348	10bd318d69bbaec0c81cf390cafa3240_NeikiAnalytics.exe	38
PID 2348 wrote to memory of 2532	2348	10bd318d69bbaec0c81cf390cafa3240_NeikiAnalytics.exe	38
PID 2348 wrote to memory of 2500	2348	10bd318d69bbaec0c81cf390cafa3240_NeikiAnalytics.exe	39
PID 2348 wrote to memory of 2500	2348	10bd318d69bbaec0c81cf390cafa3240_NeikiAnalytics.exe	39
PID 2348 wrote to memory of 2500	2348	10bd318d69bbaec0c81cf390cafa3240_NeikiAnalytics.exe	39
PID 2348 wrote to memory of 1876	2348	10bd318d69bbaec0c81cf390cafa3240_NeikiAnalytics.exe	40
PID 2348 wrote to memory of 1876	2348	10bd318d69bbaec0c81cf390cafa3240_NeikiAnalytics.exe	40
PID 2348 wrote to memory of 1876	2348	10bd318d69bbaec0c81cf390cafa3240_NeikiAnalytics.exe	40
PID 2348 wrote to memory of 2640	2348	10bd318d69bbaec0c81cf390cafa3240_NeikiAnalytics.exe	41
PID 2348 wrote to memory of 2640	2348	10bd318d69bbaec0c81cf390cafa3240_NeikiAnalytics.exe	41
PID 2348 wrote to memory of 2640	2348	10bd318d69bbaec0c81cf390cafa3240_NeikiAnalytics.exe	41
PID 2348 wrote to memory of 2804	2348	10bd318d69bbaec0c81cf390cafa3240_NeikiAnalytics.exe	42
PID 2348 wrote to memory of 2804	2348	10bd318d69bbaec0c81cf390cafa3240_NeikiAnalytics.exe	42
PID 2348 wrote to memory of 2804	2348	10bd318d69bbaec0c81cf390cafa3240_NeikiAnalytics.exe	42
PID 2348 wrote to memory of 2820	2348	10bd318d69bbaec0c81cf390cafa3240_NeikiAnalytics.exe	43
PID 2348 wrote to memory of 2820	2348	10bd318d69bbaec0c81cf390cafa3240_NeikiAnalytics.exe	43
PID 2348 wrote to memory of 2820	2348	10bd318d69bbaec0c81cf390cafa3240_NeikiAnalytics.exe	43
PID 2348 wrote to memory of 2168	2348	10bd318d69bbaec0c81cf390cafa3240_NeikiAnalytics.exe	44
PID 2348 wrote to memory of 2168	2348	10bd318d69bbaec0c81cf390cafa3240_NeikiAnalytics.exe	44
PID 2348 wrote to memory of 2168	2348	10bd318d69bbaec0c81cf390cafa3240_NeikiAnalytics.exe	44
PID 2348 wrote to memory of 1428	2348	10bd318d69bbaec0c81cf390cafa3240_NeikiAnalytics.exe	45
PID 2348 wrote to memory of 1428	2348	10bd318d69bbaec0c81cf390cafa3240_NeikiAnalytics.exe	45
PID 2348 wrote to memory of 1428	2348	10bd318d69bbaec0c81cf390cafa3240_NeikiAnalytics.exe	45
PID 2348 wrote to memory of 1860	2348	10bd318d69bbaec0c81cf390cafa3240_NeikiAnalytics.exe	46
PID 2348 wrote to memory of 1860	2348	10bd318d69bbaec0c81cf390cafa3240_NeikiAnalytics.exe	46
PID 2348 wrote to memory of 1860	2348	10bd318d69bbaec0c81cf390cafa3240_NeikiAnalytics.exe	46
PID 2348 wrote to memory of 2336	2348	10bd318d69bbaec0c81cf390cafa3240_NeikiAnalytics.exe	47
PID 2348 wrote to memory of 2336	2348	10bd318d69bbaec0c81cf390cafa3240_NeikiAnalytics.exe	47
PID 2348 wrote to memory of 2336	2348	10bd318d69bbaec0c81cf390cafa3240_NeikiAnalytics.exe	47
PID 2348 wrote to memory of 1624	2348	10bd318d69bbaec0c81cf390cafa3240_NeikiAnalytics.exe	48
PID 2348 wrote to memory of 1624	2348	10bd318d69bbaec0c81cf390cafa3240_NeikiAnalytics.exe	48
PID 2348 wrote to memory of 1624	2348	10bd318d69bbaec0c81cf390cafa3240_NeikiAnalytics.exe	48
PID 2348 wrote to memory of 1760	2348	10bd318d69bbaec0c81cf390cafa3240_NeikiAnalytics.exe	49
PID 2348 wrote to memory of 1760	2348	10bd318d69bbaec0c81cf390cafa3240_NeikiAnalytics.exe	49
PID 2348 wrote to memory of 1760	2348	10bd318d69bbaec0c81cf390cafa3240_NeikiAnalytics.exe	49
PID 2348 wrote to memory of 332	2348	10bd318d69bbaec0c81cf390cafa3240_NeikiAnalytics.exe	50

C:\Users\Admin\AppData\Local\Temp\10bd318d69bbaec0c81cf390cafa3240_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\10bd318d69bbaec0c81cf390cafa3240_NeikiAnalytics.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2348
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2184
- C:\Windows\System\TTIbxls.exe
  C:\Windows\System\TTIbxls.exe
  2⤵
  - Executes dropped EXE
  PID:2176
- C:\Windows\System\GKVftSz.exe
  C:\Windows\System\GKVftSz.exe
  2⤵
  - Executes dropped EXE
  PID:3012
- C:\Windows\System\ZdudMFR.exe
  C:\Windows\System\ZdudMFR.exe
  2⤵
  - Executes dropped EXE
  PID:1296
- C:\Windows\System\RlRMlLp.exe
  C:\Windows\System\RlRMlLp.exe
  2⤵
  - Executes dropped EXE
  PID:2688
- C:\Windows\System\TtcvwfM.exe
  C:\Windows\System\TtcvwfM.exe
  2⤵
  - Executes dropped EXE
  PID:2492
- C:\Windows\System\JnEyMSF.exe
  C:\Windows\System\JnEyMSF.exe
  2⤵
  - Executes dropped EXE
  PID:2372
- C:\Windows\System\kZpyUQG.exe
  C:\Windows\System\kZpyUQG.exe
  2⤵
  - Executes dropped EXE
  PID:2712
- C:\Windows\System\BozYnme.exe
  C:\Windows\System\BozYnme.exe
  2⤵
  - Executes dropped EXE
  PID:2468
- C:\Windows\System\ZUQpCOY.exe
  C:\Windows\System\ZUQpCOY.exe
  2⤵
  - Executes dropped EXE
  PID:2532
- C:\Windows\System\QzyJBbD.exe
  C:\Windows\System\QzyJBbD.exe
  2⤵
  - Executes dropped EXE
  PID:2500
- C:\Windows\System\fhZeQMe.exe
  C:\Windows\System\fhZeQMe.exe
  2⤵
  - Executes dropped EXE
  PID:1876
- C:\Windows\System\emrgqfF.exe
  C:\Windows\System\emrgqfF.exe
  2⤵
  - Executes dropped EXE
  PID:2640
- C:\Windows\System\uTjplhl.exe
  C:\Windows\System\uTjplhl.exe
  2⤵
  - Executes dropped EXE
  PID:2804
- C:\Windows\System\KPxiLCr.exe
  C:\Windows\System\KPxiLCr.exe
  2⤵
  - Executes dropped EXE
  PID:2820
- C:\Windows\System\YgfslEk.exe
  C:\Windows\System\YgfslEk.exe
  2⤵
  - Executes dropped EXE
  PID:2168
- C:\Windows\System\kQyJOVf.exe
  C:\Windows\System\kQyJOVf.exe
  2⤵
  - Executes dropped EXE
  PID:1428
- C:\Windows\System\iSmLflD.exe
  C:\Windows\System\iSmLflD.exe
  2⤵
  - Executes dropped EXE
  PID:1860
- C:\Windows\System\RKOzOyw.exe
  C:\Windows\System\RKOzOyw.exe
  2⤵
  - Executes dropped EXE
  PID:2336
- C:\Windows\System\BhysUxA.exe
  C:\Windows\System\BhysUxA.exe
  2⤵
  - Executes dropped EXE
  PID:1624
- C:\Windows\System\xZgCaOc.exe
  C:\Windows\System\xZgCaOc.exe
  2⤵
  - Executes dropped EXE
  PID:1760
- C:\Windows\System\nDYzwzU.exe
  C:\Windows\System\nDYzwzU.exe
  2⤵
  - Executes dropped EXE
  PID:332
- C:\Windows\System\NlCWvsB.exe
  C:\Windows\System\NlCWvsB.exe
  2⤵
  - Executes dropped EXE
  PID:2748
- C:\Windows\System\SWKHGks.exe
  C:\Windows\System\SWKHGks.exe
  2⤵
  - Executes dropped EXE
  PID:2120
- C:\Windows\System\ZjrlYzY.exe
  C:\Windows\System\ZjrlYzY.exe
  2⤵
  - Executes dropped EXE
  PID:1528
- C:\Windows\System\RArlMnm.exe
  C:\Windows\System\RArlMnm.exe
  2⤵
  - Executes dropped EXE
  PID:1768
- C:\Windows\System\WCKpRXU.exe
  C:\Windows\System\WCKpRXU.exe
  2⤵
  - Executes dropped EXE
  PID:2296
- C:\Windows\System\muMnkik.exe
  C:\Windows\System\muMnkik.exe
  2⤵
  - Executes dropped EXE
  PID:1232
- C:\Windows\System\ghRFOby.exe
  C:\Windows\System\ghRFOby.exe
  2⤵
  - Executes dropped EXE
  PID:560
- C:\Windows\System\xEudFmA.exe
  C:\Windows\System\xEudFmA.exe
  2⤵
  - Executes dropped EXE
  PID:940
- C:\Windows\System\NbrUbAS.exe
  C:\Windows\System\NbrUbAS.exe
  2⤵
  - Executes dropped EXE
  PID:1512
- C:\Windows\System\PUsgwmE.exe
  C:\Windows\System\PUsgwmE.exe
  2⤵
  - Executes dropped EXE
  PID:1136
- C:\Windows\System\KAIjPZD.exe
  C:\Windows\System\KAIjPZD.exe
  2⤵
  - Executes dropped EXE
  PID:696
- C:\Windows\System\WEGiKCF.exe
  C:\Windows\System\WEGiKCF.exe
  2⤵
  - Executes dropped EXE
  PID:2424
- C:\Windows\System\VyyZBOD.exe
  C:\Windows\System\VyyZBOD.exe
  2⤵
  - Executes dropped EXE
  PID:1644
- C:\Windows\System\BmRVZzo.exe
  C:\Windows\System\BmRVZzo.exe
  2⤵
  - Executes dropped EXE
  PID:2144
- C:\Windows\System\yRFKqGl.exe
  C:\Windows\System\yRFKqGl.exe
  2⤵
  - Executes dropped EXE
  PID:1188
- C:\Windows\System\IUDdrWO.exe
  C:\Windows\System\IUDdrWO.exe
  2⤵
  - Executes dropped EXE
  PID:1356
- C:\Windows\System\AqptOao.exe
  C:\Windows\System\AqptOao.exe
  2⤵
  - Executes dropped EXE
  PID:1776
- C:\Windows\System\lUvGGDL.exe
  C:\Windows\System\lUvGGDL.exe
  2⤵
  - Executes dropped EXE
  PID:2160
- C:\Windows\System\fXQfKfV.exe
  C:\Windows\System\fXQfKfV.exe
  2⤵
  - Executes dropped EXE
  PID:1340
- C:\Windows\System\KOeVeLA.exe
  C:\Windows\System\KOeVeLA.exe
  2⤵
  - Executes dropped EXE
  PID:648
- C:\Windows\System\BdyrTTu.exe
  C:\Windows\System\BdyrTTu.exe
  2⤵
  PID:1324
- C:\Windows\System\PsKjFQn.exe
  C:\Windows\System\PsKjFQn.exe
  2⤵
  - Executes dropped EXE
  PID:892
- C:\Windows\System\VraWkwi.exe
  C:\Windows\System\VraWkwi.exe
  2⤵
  PID:572
- C:\Windows\System\ygijdGT.exe
  C:\Windows\System\ygijdGT.exe
  2⤵
  - Executes dropped EXE
  PID:2108
- C:\Windows\System\LVJvgiZ.exe
  C:\Windows\System\LVJvgiZ.exe
  2⤵
  PID:2228
- C:\Windows\System\cKMuQwO.exe
  C:\Windows\System\cKMuQwO.exe
  2⤵
  - Executes dropped EXE
  PID:1764
- C:\Windows\System\TZtORWp.exe
  C:\Windows\System\TZtORWp.exe
  2⤵
  PID:356
- C:\Windows\System\EeiVykn.exe
  C:\Windows\System\EeiVykn.exe
  2⤵
  - Executes dropped EXE
  PID:1872
- C:\Windows\System\lPOvvxZ.exe
  C:\Windows\System\lPOvvxZ.exe
  2⤵
  PID:2044
- C:\Windows\System\AKmIwbd.exe
  C:\Windows\System\AKmIwbd.exe
  2⤵
  - Executes dropped EXE
  PID:868
- C:\Windows\System\CtQzOMH.exe
  C:\Windows\System\CtQzOMH.exe
  2⤵
  PID:896
- C:\Windows\System\uhXpHra.exe
  C:\Windows\System\uhXpHra.exe
  2⤵
  - Executes dropped EXE
  PID:1020
- C:\Windows\System\HgInrlU.exe
  C:\Windows\System\HgInrlU.exe
  2⤵
  PID:1704
- C:\Windows\System\GvPQHjI.exe
  C:\Windows\System\GvPQHjI.exe
  2⤵
  - Executes dropped EXE
  PID:2164
- C:\Windows\System\pXAaUAb.exe
  C:\Windows\System\pXAaUAb.exe
  2⤵
  PID:1592
- C:\Windows\System\rFtYAiL.exe
  C:\Windows\System\rFtYAiL.exe
  2⤵
  - Executes dropped EXE
  PID:1596
- C:\Windows\System\ITLqHoS.exe
  C:\Windows\System\ITLqHoS.exe
  2⤵
  PID:2836
- C:\Windows\System\GjzWtCo.exe
  C:\Windows\System\GjzWtCo.exe
  2⤵
  - Executes dropped EXE
  PID:2096
- C:\Windows\System\cxUVkON.exe
  C:\Windows\System\cxUVkON.exe
  2⤵
  PID:2656
- C:\Windows\System\fWZJTQD.exe
  C:\Windows\System\fWZJTQD.exe
  2⤵
  - Executes dropped EXE
  PID:3024
- C:\Windows\System\AuWlKdz.exe
  C:\Windows\System\AuWlKdz.exe
  2⤵
  PID:2792
- C:\Windows\System\CpTBJkk.exe
  C:\Windows\System\CpTBJkk.exe
  2⤵
  - Executes dropped EXE
  PID:2708
- C:\Windows\System\PofHTfg.exe
  C:\Windows\System\PofHTfg.exe
  2⤵
  PID:2452
- C:\Windows\System\ZqdvMUy.exe
  C:\Windows\System\ZqdvMUy.exe
  2⤵
  - Executes dropped EXE
  PID:2528
- C:\Windows\System\ACiQMbZ.exe
  C:\Windows\System\ACiQMbZ.exe
  2⤵
  PID:2976
- C:\Windows\System\CEhvKqZ.exe
  C:\Windows\System\CEhvKqZ.exe
  2⤵
  - Executes dropped EXE
  PID:2740
- C:\Windows\System\FTPxNCU.exe
  C:\Windows\System\FTPxNCU.exe
  2⤵
  PID:2772
- C:\Windows\System\qXKHsAF.exe
  C:\Windows\System\qXKHsAF.exe
  2⤵
  - Executes dropped EXE
  PID:2544
- C:\Windows\System\Xmnsqav.exe
  C:\Windows\System\Xmnsqav.exe
  2⤵
  PID:2936
- C:\Windows\System\fGGqEoy.exe
  C:\Windows\System\fGGqEoy.exe
  2⤵
  - Executes dropped EXE
  PID:1672
- C:\Windows\System\pMLlenz.exe
  C:\Windows\System\pMLlenz.exe
  2⤵
  PID:2332
- C:\Windows\System\awxPXlk.exe
  C:\Windows\System\awxPXlk.exe
  2⤵
  - Executes dropped EXE
  PID:2368
- C:\Windows\System\xdWQehI.exe
  C:\Windows\System\xdWQehI.exe
  2⤵
  PID:2444
- C:\Windows\System\blyocfF.exe
  C:\Windows\System\blyocfF.exe
  2⤵
  - Executes dropped EXE
  PID:1264
- C:\Windows\System\RiwIejV.exe
  C:\Windows\System\RiwIejV.exe
  2⤵
  PID:636
- C:\Windows\System\jxJzCoP.exe
  C:\Windows\System\jxJzCoP.exe
  2⤵
  - Executes dropped EXE
  PID:1608
- C:\Windows\System\nWbNeYP.exe
  C:\Windows\System\nWbNeYP.exe
  2⤵
  PID:488
- C:\Windows\System\xRDnayR.exe
  C:\Windows\System\xRDnayR.exe
  2⤵
  - Executes dropped EXE
  PID:1272
- C:\Windows\System\IjtkEIN.exe
  C:\Windows\System\IjtkEIN.exe
  2⤵
  PID:816
- C:\Windows\System\floZIZt.exe
  C:\Windows\System\floZIZt.exe
  2⤵
  - Executes dropped EXE
  PID:1352
- C:\Windows\System\Fqwvewt.exe
  C:\Windows\System\Fqwvewt.exe
  2⤵
  PID:2036
- C:\Windows\System\fQEPFYt.exe
  C:\Windows\System\fQEPFYt.exe
  2⤵
  - Executes dropped EXE
  PID:1044
- C:\Windows\System\bSmnvdh.exe
  C:\Windows\System\bSmnvdh.exe
  2⤵
  PID:1152
- C:\Windows\System\DtKxshP.exe
  C:\Windows\System\DtKxshP.exe
  2⤵
  - Executes dropped EXE
  PID:1032
- C:\Windows\System\yYyertQ.exe
  C:\Windows\System\yYyertQ.exe
  2⤵
  PID:2172
- C:\Windows\System\KFCSWTm.exe
  C:\Windows\System\KFCSWTm.exe
  2⤵
  - Executes dropped EXE
  PID:2260
- C:\Windows\System\PgYZQBL.exe
  C:\Windows\System\PgYZQBL.exe
  2⤵
  PID:3020
- C:\Windows\System\XFviQkf.exe
  C:\Windows\System\XFviQkf.exe
  2⤵
  PID:2328
- C:\Windows\System\yvDQsgR.exe
  C:\Windows\System\yvDQsgR.exe
  2⤵
  PID:1508
- C:\Windows\System\kICEKYb.exe
  C:\Windows\System\kICEKYb.exe
  2⤵
  PID:1656
- C:\Windows\System\gLKsQdY.exe
  C:\Windows\System\gLKsQdY.exe
  2⤵
  PID:2696
- C:\Windows\System\kfBJDPW.exe
  C:\Windows\System\kfBJDPW.exe
  2⤵
  PID:2644
- C:\Windows\System\GvdWCpT.exe
  C:\Windows\System\GvdWCpT.exe
  2⤵
  PID:2516
- C:\Windows\System\kFGGQdM.exe
  C:\Windows\System\kFGGQdM.exe
  2⤵
  PID:2904
- C:\Windows\System\LzjoOob.exe
  C:\Windows\System\LzjoOob.exe
  2⤵
  PID:2524
- C:\Windows\System\hWNhHaS.exe
  C:\Windows\System\hWNhHaS.exe
  2⤵
  PID:1736
- C:\Windows\System\pSCdbkJ.exe
  C:\Windows\System\pSCdbkJ.exe
  2⤵
  PID:352
- C:\Windows\System\RSPGXNZ.exe
  C:\Windows\System\RSPGXNZ.exe
  2⤵
  PID:1840
- C:\Windows\System\LWtpOCa.exe
  C:\Windows\System\LWtpOCa.exe
  2⤵
  PID:1712
- C:\Windows\System\UlLOhSw.exe
  C:\Windows\System\UlLOhSw.exe
  2⤵
  PID:2736
- C:\Windows\System\QtZdGby.exe
  C:\Windows\System\QtZdGby.exe
  2⤵
  PID:2416
- C:\Windows\System\gHYiHZs.exe
  C:\Windows\System\gHYiHZs.exe
  2⤵
  PID:2800
- C:\Windows\System\ZjrLgCl.exe
  C:\Windows\System\ZjrLgCl.exe
  2⤵
  PID:1856
- C:\Windows\System\yfnHDYk.exe
  C:\Windows\System\yfnHDYk.exe
  2⤵
  PID:3088
- C:\Windows\System\WmmoKEB.exe
  C:\Windows\System\WmmoKEB.exe
  2⤵
  PID:3104
- C:\Windows\System\rmjZCeE.exe
  C:\Windows\System\rmjZCeE.exe
  2⤵
  PID:3120
- C:\Windows\System\zhDCkWP.exe
  C:\Windows\System\zhDCkWP.exe
  2⤵
  PID:3136
- C:\Windows\System\dekAOau.exe
  C:\Windows\System\dekAOau.exe
  2⤵
  PID:3188
- C:\Windows\System\zxQNozJ.exe
  C:\Windows\System\zxQNozJ.exe
  2⤵
  PID:3376
- C:\Windows\System\qJBcASx.exe
  C:\Windows\System\qJBcASx.exe
  2⤵
  PID:3552
- C:\Windows\System\LWWpJDI.exe
  C:\Windows\System\LWWpJDI.exe
  2⤵
  PID:3580
- C:\Windows\System\vBiJpZk.exe
  C:\Windows\System\vBiJpZk.exe
  2⤵
  PID:3600
- C:\Windows\System\worKCth.exe
  C:\Windows\System\worKCth.exe
  2⤵
  PID:3620
- C:\Windows\System\koTxowS.exe
  C:\Windows\System\koTxowS.exe
  2⤵
  PID:3640
- C:\Windows\System\FFPlizr.exe
  C:\Windows\System\FFPlizr.exe
  2⤵
  PID:3660
- C:\Windows\System\qaqvpJT.exe
  C:\Windows\System\qaqvpJT.exe
  2⤵
  PID:3676
- C:\Windows\System\LDXouvK.exe
  C:\Windows\System\LDXouvK.exe
  2⤵
  PID:3700
- C:\Windows\System\OvnSQjf.exe
  C:\Windows\System\OvnSQjf.exe
  2⤵
  PID:3716
- C:\Windows\System\BVflTIK.exe
  C:\Windows\System\BVflTIK.exe
  2⤵
  PID:3732
- C:\Windows\System\YoRlNVd.exe
  C:\Windows\System\YoRlNVd.exe
  2⤵
  PID:3748
- C:\Windows\System\tWxWkYd.exe
  C:\Windows\System\tWxWkYd.exe
  2⤵
  PID:3776
- C:\Windows\System\dnGcoPd.exe
  C:\Windows\System\dnGcoPd.exe
  2⤵
  PID:3796
- C:\Windows\System\zxpcjuT.exe
  C:\Windows\System\zxpcjuT.exe
  2⤵
  PID:3816
- C:\Windows\System\sOPhlqh.exe
  C:\Windows\System\sOPhlqh.exe
  2⤵
  PID:3840
- C:\Windows\System\GUbPiQx.exe
  C:\Windows\System\GUbPiQx.exe
  2⤵
  PID:3860
- C:\Windows\System\ohXQIfM.exe
  C:\Windows\System\ohXQIfM.exe
  2⤵
  PID:3876
- C:\Windows\System\QZDpbhS.exe
  C:\Windows\System\QZDpbhS.exe
  2⤵
  PID:3900
- C:\Windows\System\RrCsTcF.exe
  C:\Windows\System\RrCsTcF.exe
  2⤵
  PID:3920
- C:\Windows\System\PairSiX.exe
  C:\Windows\System\PairSiX.exe
  2⤵
  PID:3940
- C:\Windows\System\JYdiwwe.exe
  C:\Windows\System\JYdiwwe.exe
  2⤵
  PID:3960
- C:\Windows\System\ggECXic.exe
  C:\Windows\System\ggECXic.exe
  2⤵
  PID:3980
- C:\Windows\System\iqaNcAy.exe
  C:\Windows\System\iqaNcAy.exe
  2⤵
  PID:4000
- C:\Windows\System\sbJyEfw.exe
  C:\Windows\System\sbJyEfw.exe
  2⤵
  PID:4016
- C:\Windows\System\OiHyeVA.exe
  C:\Windows\System\OiHyeVA.exe
  2⤵
  PID:4036
- C:\Windows\System\hoJRsbg.exe
  C:\Windows\System\hoJRsbg.exe
  2⤵
  PID:4060
- C:\Windows\System\aKXZiZK.exe
  C:\Windows\System\aKXZiZK.exe
  2⤵
  PID:4076
- C:\Windows\System\vtXNaeZ.exe
  C:\Windows\System\vtXNaeZ.exe
  2⤵
  PID:1728
- C:\Windows\System\bKgjjVZ.exe
  C:\Windows\System\bKgjjVZ.exe
  2⤵
  PID:2816
- C:\Windows\System\bpeoegr.exe
  C:\Windows\System\bpeoegr.exe
  2⤵
  PID:2796
- C:\Windows\System\wLqXqKC.exe
  C:\Windows\System\wLqXqKC.exe
  2⤵
  PID:1948
- C:\Windows\System\nEiHfMB.exe
  C:\Windows\System\nEiHfMB.exe
  2⤵
  PID:1424
- C:\Windows\System\sLfvFkT.exe
  C:\Windows\System\sLfvFkT.exe
  2⤵
  PID:1316
- C:\Windows\System\cSXdKYK.exe
  C:\Windows\System\cSXdKYK.exe
  2⤵
  PID:540
- C:\Windows\System\APTgJLt.exe
  C:\Windows\System\APTgJLt.exe
  2⤵
  PID:3028
- C:\Windows\System\rrkkxhe.exe
  C:\Windows\System\rrkkxhe.exe
  2⤵
  PID:1604
- C:\Windows\System\xTfDlOf.exe
  C:\Windows\System\xTfDlOf.exe
  2⤵
  PID:3216
- C:\Windows\System\MFEvtjg.exe
  C:\Windows\System\MFEvtjg.exe
  2⤵
  PID:3236
- C:\Windows\System\EwukXqC.exe
  C:\Windows\System\EwukXqC.exe
  2⤵
  PID:3252
- C:\Windows\System\QLPGkTe.exe
  C:\Windows\System\QLPGkTe.exe
  2⤵
  PID:3276
- C:\Windows\System\VeWgYlZ.exe
  C:\Windows\System\VeWgYlZ.exe
  2⤵
  PID:3292
- C:\Windows\System\RaLmbjX.exe
  C:\Windows\System\RaLmbjX.exe
  2⤵
  PID:3320
- C:\Windows\System\UNwHulm.exe
  C:\Windows\System\UNwHulm.exe
  2⤵
  PID:3348
- C:\Windows\System\EBiUaAL.exe
  C:\Windows\System\EBiUaAL.exe
  2⤵
  PID:3368
- C:\Windows\System\YjWHTkG.exe
  C:\Windows\System\YjWHTkG.exe
  2⤵
  PID:2624
- C:\Windows\System\DgXXIsj.exe
  C:\Windows\System\DgXXIsj.exe
  2⤵
  PID:1896
- C:\Windows\System\LPHssbc.exe
  C:\Windows\System\LPHssbc.exe
  2⤵
  PID:2856
- C:\Windows\System\nzmbGGi.exe
  C:\Windows\System\nzmbGGi.exe
  2⤵
  PID:2408
- C:\Windows\System\sdgrhwv.exe
  C:\Windows\System\sdgrhwv.exe
  2⤵
  PID:1900
- C:\Windows\System\pSNmTlS.exe
  C:\Windows\System\pSNmTlS.exe
  2⤵
  PID:1684
- C:\Windows\System\XDgDlzN.exe
  C:\Windows\System\XDgDlzN.exe
  2⤵
  PID:1864
- C:\Windows\System\XuJvpov.exe
  C:\Windows\System\XuJvpov.exe
  2⤵
  PID:2032
- C:\Windows\System\SCbQckt.exe
  C:\Windows\System\SCbQckt.exe
  2⤵
  PID:2256
- C:\Windows\System\oOhbqWq.exe
  C:\Windows\System\oOhbqWq.exe
  2⤵
  PID:3116
- C:\Windows\System\kiIwOuM.exe
  C:\Windows\System\kiIwOuM.exe
  2⤵
  PID:3168
- C:\Windows\System\rGmAYwK.exe
  C:\Windows\System\rGmAYwK.exe
  2⤵
  PID:2180
- C:\Windows\System\dgNVCoT.exe
  C:\Windows\System\dgNVCoT.exe
  2⤵
  PID:2676
- C:\Windows\System\IAZNtzu.exe
  C:\Windows\System\IAZNtzu.exe
  2⤵
  PID:3392
- C:\Windows\System\Cbldmqf.exe
  C:\Windows\System\Cbldmqf.exe
  2⤵
  PID:3412
- C:\Windows\System\tYhdEEU.exe
  C:\Windows\System\tYhdEEU.exe
  2⤵
  PID:3436
- C:\Windows\System\MFjZmLu.exe
  C:\Windows\System\MFjZmLu.exe
  2⤵
  PID:3452
- C:\Windows\System\hhJSBtS.exe
  C:\Windows\System\hhJSBtS.exe
  2⤵
  PID:3468
- C:\Windows\System\wZALCOg.exe
  C:\Windows\System\wZALCOg.exe
  2⤵
  PID:2788
- C:\Windows\System\DUCDtRA.exe
  C:\Windows\System\DUCDtRA.exe
  2⤵
  PID:2484
- C:\Windows\System\nXLBWwS.exe
  C:\Windows\System\nXLBWwS.exe
  2⤵
  PID:2984
- C:\Windows\System\AUJnEvn.exe
  C:\Windows\System\AUJnEvn.exe
  2⤵
  PID:3508
- C:\Windows\System\dmfltro.exe
  C:\Windows\System\dmfltro.exe
  2⤵
  PID:3576
- C:\Windows\System\MpaWVvG.exe
  C:\Windows\System\MpaWVvG.exe
  2⤵
  PID:3592
- C:\Windows\System\pUFMsUw.exe
  C:\Windows\System\pUFMsUw.exe
  2⤵
  PID:3656
- C:\Windows\System\vfPUnaC.exe
  C:\Windows\System\vfPUnaC.exe
  2⤵
  PID:3692
- C:\Windows\System\EjrrmcI.exe
  C:\Windows\System\EjrrmcI.exe
  2⤵
  PID:3760
- C:\Windows\System\pACaSqa.exe
  C:\Windows\System\pACaSqa.exe
  2⤵
  PID:3632
- C:\Windows\System\QmzsaBQ.exe
  C:\Windows\System\QmzsaBQ.exe
  2⤵
  PID:3808
- C:\Windows\System\DTJVWmK.exe
  C:\Windows\System\DTJVWmK.exe
  2⤵
  PID:3824
- C:\Windows\System\NVyCHpC.exe
  C:\Windows\System\NVyCHpC.exe
  2⤵
  PID:3848
- C:\Windows\System\bitfXbZ.exe
  C:\Windows\System\bitfXbZ.exe
  2⤵
  PID:3892
- C:\Windows\System\GETYuXT.exe
  C:\Windows\System\GETYuXT.exe
  2⤵
  PID:3932
- C:\Windows\System\iXerfXg.exe
  C:\Windows\System\iXerfXg.exe
  2⤵
  PID:3936
- C:\Windows\System\mmcSpHL.exe
  C:\Windows\System\mmcSpHL.exe
  2⤵
  PID:3972
- C:\Windows\System\KwdILEV.exe
  C:\Windows\System\KwdILEV.exe
  2⤵
  PID:3976
- C:\Windows\System\asKTkGe.exe
  C:\Windows\System\asKTkGe.exe
  2⤵
  PID:4056
- C:\Windows\System\jyZfGJr.exe
  C:\Windows\System\jyZfGJr.exe
  2⤵
  PID:3992
- C:\Windows\System\wfCMoND.exe
  C:\Windows\System\wfCMoND.exe
  2⤵
  PID:4032
- C:\Windows\System\wrrgsUN.exe
  C:\Windows\System\wrrgsUN.exe
  2⤵
  PID:4092
- C:\Windows\System\EIJIEVq.exe
  C:\Windows\System\EIJIEVq.exe
  2⤵
  PID:2148
- C:\Windows\System\ebCmCuH.exe
  C:\Windows\System\ebCmCuH.exe
  2⤵
  PID:2768
- C:\Windows\System\jZMwmXT.exe
  C:\Windows\System\jZMwmXT.exe
  2⤵
  PID:1532
- C:\Windows\System\JMILgxP.exe
  C:\Windows\System\JMILgxP.exe
  2⤵
  PID:308
- C:\Windows\System\XgcRByx.exe
  C:\Windows\System\XgcRByx.exe
  2⤵
  PID:2308
- C:\Windows\System\aJuplBg.exe
  C:\Windows\System\aJuplBg.exe
  2⤵
  PID:2392
- C:\Windows\System\FLQrphK.exe
  C:\Windows\System\FLQrphK.exe
  2⤵
  PID:3332
- C:\Windows\System\OBPYWFK.exe
  C:\Windows\System\OBPYWFK.exe
  2⤵
  PID:3268
- C:\Windows\System\xnQYBFI.exe
  C:\Windows\System\xnQYBFI.exe
  2⤵
  PID:3312
- C:\Windows\System\AjcLftQ.exe
  C:\Windows\System\AjcLftQ.exe
  2⤵
  PID:3356
- C:\Windows\System\eKRJNux.exe
  C:\Windows\System\eKRJNux.exe
  2⤵
  PID:3328
- C:\Windows\System\yoAFxIM.exe
  C:\Windows\System\yoAFxIM.exe
  2⤵
  PID:2276
- C:\Windows\System\bdreVaf.exe
  C:\Windows\System\bdreVaf.exe
  2⤵
  PID:2616
- C:\Windows\System\mWXTqck.exe
  C:\Windows\System\mWXTqck.exe
  2⤵
  PID:772
- C:\Windows\System\rnaVIRc.exe
  C:\Windows\System\rnaVIRc.exe
  2⤵
  PID:1708
- C:\Windows\System\VhqILAv.exe
  C:\Windows\System\VhqILAv.exe
  2⤵
  PID:1524
- C:\Windows\System\hGtVUDp.exe
  C:\Windows\System\hGtVUDp.exe
  2⤵
  PID:1552
- C:\Windows\System\jDNfofh.exe
  C:\Windows\System\jDNfofh.exe
  2⤵
  PID:320
- C:\Windows\System\KgolSRB.exe
  C:\Windows\System\KgolSRB.exe
  2⤵
  PID:3152
- C:\Windows\System\wEQVyOJ.exe
  C:\Windows\System\wEQVyOJ.exe
  2⤵
  PID:3560
- C:\Windows\System\PSaSWZr.exe
  C:\Windows\System\PSaSWZr.exe
  2⤵
  PID:3388
- C:\Windows\System\BIvpxjz.exe
  C:\Windows\System\BIvpxjz.exe
  2⤵
  PID:3400
- C:\Windows\System\AsoEBcA.exe
  C:\Windows\System\AsoEBcA.exe
  2⤵
  PID:2844
- C:\Windows\System\WnXeviY.exe
  C:\Windows\System\WnXeviY.exe
  2⤵
  PID:3792
- C:\Windows\System\ZvgbaHW.exe
  C:\Windows\System\ZvgbaHW.exe
  2⤵
  PID:3572
- C:\Windows\System\JLENxnh.exe
  C:\Windows\System\JLENxnh.exe
  2⤵
  PID:2612
- C:\Windows\System\orikUJe.exe
  C:\Windows\System\orikUJe.exe
  2⤵
  PID:2588
- C:\Windows\System\nZUcTQz.exe
  C:\Windows\System\nZUcTQz.exe
  2⤵
  PID:3708
- C:\Windows\System\GXikfco.exe
  C:\Windows\System\GXikfco.exe
  2⤵
  PID:780
- C:\Windows\System\EKQyzty.exe
  C:\Windows\System\EKQyzty.exe
  2⤵
  PID:4028
- C:\Windows\System\gCyZkkG.exe
  C:\Windows\System\gCyZkkG.exe
  2⤵
  PID:1516
- C:\Windows\System\urxLiEt.exe
  C:\Windows\System\urxLiEt.exe
  2⤵
  PID:3364
- C:\Windows\System\oHFlQDm.exe
  C:\Windows\System\oHFlQDm.exe
  2⤵
  PID:2460
- C:\Windows\System\LQBNous.exe
  C:\Windows\System\LQBNous.exe
  2⤵
  PID:2252
- C:\Windows\System\aTTBezP.exe
  C:\Windows\System\aTTBezP.exe
  2⤵
  PID:768
- C:\Windows\System\dNXzOer.exe
  C:\Windows\System\dNXzOer.exe
  2⤵
  PID:3224
- C:\Windows\System\inTgBQd.exe
  C:\Windows\System\inTgBQd.exe
  2⤵
  PID:912
- C:\Windows\System\MlIheKv.exe
  C:\Windows\System\MlIheKv.exe
  2⤵
  PID:2400
- C:\Windows\System\AhibqNU.exe
  C:\Windows\System\AhibqNU.exe
  2⤵
  PID:3144
- C:\Windows\System\NypRNrX.exe
  C:\Windows\System\NypRNrX.exe
  2⤵
  PID:3272
- C:\Windows\System\SNFrebv.exe
  C:\Windows\System\SNFrebv.exe
  2⤵
  PID:3280
- C:\Windows\System\eAQpzYT.exe
  C:\Windows\System\eAQpzYT.exe
  2⤵
  PID:3064
- C:\Windows\System\FcGAlYX.exe
  C:\Windows\System\FcGAlYX.exe
  2⤵
  PID:3296
- C:\Windows\System\ZahBzrp.exe
  C:\Windows\System\ZahBzrp.exe
  2⤵
  PID:3304
- C:\Windows\System\wclZoHG.exe
  C:\Windows\System\wclZoHG.exe
  2⤵
  PID:1120
- C:\Windows\System\XSGaqqn.exe
  C:\Windows\System\XSGaqqn.exe
  2⤵
  PID:3408
- C:\Windows\System\qywZjph.exe
  C:\Windows\System\qywZjph.exe
  2⤵
  PID:3448
- C:\Windows\System\JLbgCgz.exe
  C:\Windows\System\JLbgCgz.exe
  2⤵
  PID:1972
- C:\Windows\System\wsOprSO.exe
  C:\Windows\System\wsOprSO.exe
  2⤵
  PID:680
- C:\Windows\System\txbZpuG.exe
  C:\Windows\System\txbZpuG.exe
  2⤵
  PID:3588
- C:\Windows\System\jZeJqDB.exe
  C:\Windows\System\jZeJqDB.exe
  2⤵
  PID:3540
- C:\Windows\System\PpBrHVd.exe
  C:\Windows\System\PpBrHVd.exe
  2⤵
  PID:3888
- C:\Windows\System\CLjelqX.exe
  C:\Windows\System\CLjelqX.exe
  2⤵
  PID:2380
- C:\Windows\System\RthbrsC.exe
  C:\Windows\System\RthbrsC.exe
  2⤵
  PID:596
- C:\Windows\System\gJDuGCE.exe
  C:\Windows\System\gJDuGCE.exe
  2⤵
  PID:3668
- C:\Windows\System\SSTSaks.exe
  C:\Windows\System\SSTSaks.exe
  2⤵
  PID:3872
- C:\Windows\System\vuuNPNk.exe
  C:\Windows\System\vuuNPNk.exe
  2⤵
  PID:3316
- C:\Windows\System\HsnJBtH.exe
  C:\Windows\System\HsnJBtH.exe
  2⤵
  PID:3596
- C:\Windows\System\dWmlJyt.exe
  C:\Windows\System\dWmlJyt.exe
  2⤵
  PID:1156
- C:\Windows\System\BsSEUwE.exe
  C:\Windows\System\BsSEUwE.exe
  2⤵
  PID:2692
- C:\Windows\System\ytuqgCW.exe
  C:\Windows\System\ytuqgCW.exe
  2⤵
  PID:2280
- C:\Windows\System\iFJAEZd.exe
  C:\Windows\System\iFJAEZd.exe
  2⤵
  PID:3636
- C:\Windows\System\PFrjtDz.exe
  C:\Windows\System\PFrjtDz.exe
  2⤵
  PID:668
- C:\Windows\System\JwHvcQT.exe
  C:\Windows\System\JwHvcQT.exe
  2⤵
  PID:2092
- C:\Windows\System\ciizotD.exe
  C:\Windows\System\ciizotD.exe
  2⤵
  PID:2196
- C:\Windows\System\TpURbbQ.exe
  C:\Windows\System\TpURbbQ.exe
  2⤵
  PID:3424
- C:\Windows\System\VtJhsIU.exe
  C:\Windows\System\VtJhsIU.exe
  2⤵
  PID:3308
- C:\Windows\System\oGDMCbU.exe
  C:\Windows\System\oGDMCbU.exe
  2⤵
  PID:1584
- C:\Windows\System\bJdUFIX.exe
  C:\Windows\System\bJdUFIX.exe
  2⤵
  PID:392
- C:\Windows\System\lPQgpiB.exe
  C:\Windows\System\lPQgpiB.exe
  2⤵
  PID:2660
- C:\Windows\System\wfiISOs.exe
  C:\Windows\System\wfiISOs.exe
  2⤵
  PID:1304
- C:\Windows\System\yRhYIbv.exe
  C:\Windows\System\yRhYIbv.exe
  2⤵
  PID:4044
- C:\Windows\System\YRjemQE.exe
  C:\Windows\System\YRjemQE.exe
  2⤵
  PID:4108
- C:\Windows\System\BIzqKKq.exe
  C:\Windows\System\BIzqKKq.exe
  2⤵
  PID:4128
- C:\Windows\System\SyKEkVs.exe
  C:\Windows\System\SyKEkVs.exe
  2⤵
  PID:4144
- C:\Windows\System\gbjvIUG.exe
  C:\Windows\System\gbjvIUG.exe
  2⤵
  PID:4164
- C:\Windows\System\VJfoiOm.exe
  C:\Windows\System\VJfoiOm.exe
  2⤵
  PID:4180
- C:\Windows\System\BTlbOBx.exe
  C:\Windows\System\BTlbOBx.exe
  2⤵
  PID:4200
- C:\Windows\System\xuNPUwE.exe
  C:\Windows\System\xuNPUwE.exe
  2⤵
  PID:4220
- C:\Windows\System\tDioQis.exe
  C:\Windows\System\tDioQis.exe
  2⤵
  PID:4236
- C:\Windows\System\aHQYbjS.exe
  C:\Windows\System\aHQYbjS.exe
  2⤵
  PID:4256
- C:\Windows\System\SAXHVbI.exe
  C:\Windows\System\SAXHVbI.exe
  2⤵
  PID:4272
- C:\Windows\System\CAoXTqZ.exe
  C:\Windows\System\CAoXTqZ.exe
  2⤵
  PID:4292
- C:\Windows\System\PrVTGNe.exe
  C:\Windows\System\PrVTGNe.exe
  2⤵
  PID:4308
- C:\Windows\System\gFyUNpz.exe
  C:\Windows\System\gFyUNpz.exe
  2⤵
  PID:4328
- C:\Windows\System\iHmqCBv.exe
  C:\Windows\System\iHmqCBv.exe
  2⤵
  PID:4348
- C:\Windows\System\fBhoMnP.exe
  C:\Windows\System\fBhoMnP.exe
  2⤵
  PID:4364
- C:\Windows\System\iJumYah.exe
  C:\Windows\System\iJumYah.exe
  2⤵
  PID:4380
- C:\Windows\System\vjQZZtF.exe
  C:\Windows\System\vjQZZtF.exe
  2⤵
  PID:4396
- C:\Windows\System\WlZvrzx.exe
  C:\Windows\System\WlZvrzx.exe
  2⤵
  PID:4416
- C:\Windows\System\uUwasew.exe
  C:\Windows\System\uUwasew.exe
  2⤵
  PID:4432
- C:\Windows\System\mptQVvr.exe
  C:\Windows\System\mptQVvr.exe
  2⤵
  PID:4448
- C:\Windows\System\MkMIvdD.exe
  C:\Windows\System\MkMIvdD.exe
  2⤵
  PID:4464
- C:\Windows\System\ZzpPXIN.exe
  C:\Windows\System\ZzpPXIN.exe
  2⤵
  PID:4484
- C:\Windows\System\NEtyICZ.exe
  C:\Windows\System\NEtyICZ.exe
  2⤵
  PID:4504
- C:\Windows\System\KFQcyNP.exe
  C:\Windows\System\KFQcyNP.exe
  2⤵
  PID:4520
- C:\Windows\System\rwGmTAr.exe
  C:\Windows\System\rwGmTAr.exe
  2⤵
  PID:4540
- C:\Windows\System\uadTvLP.exe
  C:\Windows\System\uadTvLP.exe
  2⤵
  PID:4556
- C:\Windows\System\omRapoW.exe
  C:\Windows\System\omRapoW.exe
  2⤵
  PID:4572
- C:\Windows\System\OnMyukP.exe
  C:\Windows\System\OnMyukP.exe
  2⤵
  PID:4592
- C:\Windows\System\OWAPKwM.exe
  C:\Windows\System\OWAPKwM.exe
  2⤵
  PID:4608
- C:\Windows\System\xbhCycw.exe
  C:\Windows\System\xbhCycw.exe
  2⤵
  PID:4628
- C:\Windows\System\SOosbUz.exe
  C:\Windows\System\SOosbUz.exe
  2⤵
  PID:4648
- C:\Windows\System\uJsuJpi.exe
  C:\Windows\System\uJsuJpi.exe
  2⤵
  PID:4664
- C:\Windows\System\eRomBpV.exe
  C:\Windows\System\eRomBpV.exe
  2⤵
  PID:4684
- C:\Windows\System\CeyUeUr.exe
  C:\Windows\System\CeyUeUr.exe
  2⤵
  PID:4700
- C:\Windows\System\IsWCfEC.exe
  C:\Windows\System\IsWCfEC.exe
  2⤵
  PID:4720
- C:\Windows\System\bGjyneo.exe
  C:\Windows\System\bGjyneo.exe
  2⤵
  PID:4736
- C:\Windows\System\IoXWYbP.exe
  C:\Windows\System\IoXWYbP.exe
  2⤵
  PID:4756
- C:\Windows\System\mdcXvPP.exe
  C:\Windows\System\mdcXvPP.exe
  2⤵
  PID:4772
- C:\Windows\System\WNJYJIF.exe
  C:\Windows\System\WNJYJIF.exe
  2⤵
  PID:4788
- C:\Windows\System\kGuADbh.exe
  C:\Windows\System\kGuADbh.exe
  2⤵
  PID:4804
- C:\Windows\System\LAhPgfL.exe
  C:\Windows\System\LAhPgfL.exe
  2⤵
  PID:4824
- C:\Windows\System\REfzcSE.exe
  C:\Windows\System\REfzcSE.exe
  2⤵
  PID:4840
- C:\Windows\System\TXzAdYz.exe
  C:\Windows\System\TXzAdYz.exe
  2⤵
  PID:4856
- C:\Windows\System\MfcrsEh.exe
  C:\Windows\System\MfcrsEh.exe
  2⤵
  PID:4872
- C:\Windows\System\LfEsVls.exe
  C:\Windows\System\LfEsVls.exe
  2⤵
  PID:4888
- C:\Windows\System\kIXDkjW.exe
  C:\Windows\System\kIXDkjW.exe
  2⤵
  PID:4904
- C:\Windows\System\HEHWTbF.exe
  C:\Windows\System\HEHWTbF.exe
  2⤵
  PID:4920
- C:\Windows\System\GcQzIEL.exe
  C:\Windows\System\GcQzIEL.exe
  2⤵
  PID:4948
- C:\Windows\System\qxPvQiW.exe
  C:\Windows\System\qxPvQiW.exe
  2⤵
  PID:4992
- C:\Windows\System\MHhujnI.exe
  C:\Windows\System\MHhujnI.exe
  2⤵
  PID:5012
- C:\Windows\System\eAHuIMz.exe
  C:\Windows\System\eAHuIMz.exe
  2⤵
  PID:5032
- C:\Windows\System\UCssTNs.exe
  C:\Windows\System\UCssTNs.exe
  2⤵
  PID:5048
- C:\Windows\System\xxyMOLc.exe
  C:\Windows\System\xxyMOLc.exe
  2⤵
  PID:5068
- C:\Windows\System\PgMGNHL.exe
  C:\Windows\System\PgMGNHL.exe
  2⤵
  PID:5084
- C:\Windows\System\FGcmwZZ.exe
  C:\Windows\System\FGcmwZZ.exe
  2⤵
  PID:5100
- C:\Windows\System\omhPTLx.exe
  C:\Windows\System\omhPTLx.exe
  2⤵
  PID:3756
- C:\Windows\System\GnVPWwY.exe
  C:\Windows\System\GnVPWwY.exe
  2⤵
  PID:3836
- C:\Windows\System\UOOlAQX.exe
  C:\Windows\System\UOOlAQX.exe
  2⤵
  PID:2600
- C:\Windows\System\gWocJvN.exe
  C:\Windows\System\gWocJvN.exe
  2⤵
  PID:3652
- C:\Windows\System\TAWQYSz.exe
  C:\Windows\System\TAWQYSz.exe
  2⤵
  PID:3244
- C:\Windows\System\DdbefPs.exe
  C:\Windows\System\DdbefPs.exe
  2⤵
  PID:4252
- C:\Windows\System\lpQkEti.exe
  C:\Windows\System\lpQkEti.exe
  2⤵
  PID:4288
- C:\Windows\System\FFktPLU.exe
  C:\Windows\System\FFktPLU.exe
  2⤵
  PID:4388
- C:\Windows\System\sbAWyQN.exe
  C:\Windows\System\sbAWyQN.exe
  2⤵
  PID:4456
- C:\Windows\System\kIYemCf.exe
  C:\Windows\System\kIYemCf.exe
  2⤵
  PID:4500
- C:\Windows\System\grhVyVO.exe
  C:\Windows\System\grhVyVO.exe
  2⤵
  PID:4564
- C:\Windows\System\bzdxRLX.exe
  C:\Windows\System\bzdxRLX.exe
  2⤵
  PID:4636
- C:\Windows\System\OtGAkhq.exe
  C:\Windows\System\OtGAkhq.exe
  2⤵
  PID:4708
- C:\Windows\System\nIXysKy.exe
  C:\Windows\System\nIXysKy.exe
  2⤵
  PID:1748
- C:\Windows\System\xQltRmD.exe
  C:\Windows\System\xQltRmD.exe
  2⤵
  PID:4852
- C:\Windows\System\LAQkJTb.exe
  C:\Windows\System\LAQkJTb.exe
  2⤵
  PID:4912
- C:\Windows\System\mTEDADR.exe
  C:\Windows\System\mTEDADR.exe
  2⤵
  PID:4976
- C:\Windows\System\HECJAZc.exe
  C:\Windows\System\HECJAZc.exe
  2⤵
  PID:4784
- C:\Windows\System\VrVKijm.exe
  C:\Windows\System\VrVKijm.exe
  2⤵
  PID:5092
- C:\Windows\System\qcGXAvQ.exe
  C:\Windows\System\qcGXAvQ.exe
  2⤵
  PID:4984
- C:\Windows\System\aByyaxy.exe
  C:\Windows\System\aByyaxy.exe
  2⤵
  PID:5028
- C:\Windows\System\xOXxqmN.exe
  C:\Windows\System\xOXxqmN.exe
  2⤵
  PID:2620
- C:\Windows\System\ICLtKeD.exe
  C:\Windows\System\ICLtKeD.exe
  2⤵
  PID:5144
- C:\Windows\System\tFOoRqh.exe
  C:\Windows\System\tFOoRqh.exe
  2⤵
  PID:5160
- C:\Windows\System\bVDwLSz.exe
  C:\Windows\System\bVDwLSz.exe
  2⤵
  PID:5180
- C:\Windows\System\rIDgLZt.exe
  C:\Windows\System\rIDgLZt.exe
  2⤵
  PID:5200
- C:\Windows\System\myiUisz.exe
  C:\Windows\System\myiUisz.exe
  2⤵
  PID:5216
- C:\Windows\System\hqbRyVq.exe
  C:\Windows\System\hqbRyVq.exe
  2⤵
  PID:5232
- C:\Windows\System\EUzUpek.exe
  C:\Windows\System\EUzUpek.exe
  2⤵
  PID:5260
- C:\Windows\System\RrWAzCU.exe
  C:\Windows\System\RrWAzCU.exe
  2⤵
  PID:5276
- C:\Windows\System\GUJCGBZ.exe
  C:\Windows\System\GUJCGBZ.exe
  2⤵
  PID:5296
- C:\Windows\System\wkFHdIa.exe
  C:\Windows\System\wkFHdIa.exe
  2⤵
  PID:5316
- C:\Windows\System\bfpXRmB.exe
  C:\Windows\System\bfpXRmB.exe
  2⤵
  PID:5332
- C:\Windows\System\HmMitEc.exe
  C:\Windows\System\HmMitEc.exe
  2⤵
  PID:5352
- C:\Windows\System\MlBITJF.exe
  C:\Windows\System\MlBITJF.exe
  2⤵
  PID:5368
- C:\Windows\System\QxpSQzZ.exe
  C:\Windows\System\QxpSQzZ.exe
  2⤵
  PID:5388
- C:\Windows\System\eIxMDrl.exe
  C:\Windows\System\eIxMDrl.exe
  2⤵
  PID:5412
- C:\Windows\System\VvJZcli.exe
  C:\Windows\System\VvJZcli.exe
  2⤵
  PID:5432
- C:\Windows\System\fadRBdZ.exe
  C:\Windows\System\fadRBdZ.exe
  2⤵
  PID:5456
- C:\Windows\System\TZGRyrZ.exe
  C:\Windows\System\TZGRyrZ.exe
  2⤵
  PID:5472
- C:\Windows\System\YJBlkNO.exe
  C:\Windows\System\YJBlkNO.exe
  2⤵
  PID:5492
- C:\Windows\System\SSmTDKn.exe
  C:\Windows\System\SSmTDKn.exe
  2⤵
  PID:5508
- C:\Windows\System\NGIaihw.exe
  C:\Windows\System\NGIaihw.exe
  2⤵
  PID:5528
- C:\Windows\System\DdQacjO.exe
  C:\Windows\System\DdQacjO.exe
  2⤵
  PID:5544
- C:\Windows\System\ItqPsGN.exe
  C:\Windows\System\ItqPsGN.exe
  2⤵
  PID:5564
- C:\Windows\System\fiNiQbz.exe
  C:\Windows\System\fiNiQbz.exe
  2⤵
  PID:5580
- C:\Windows\System\XoiVkjT.exe
  C:\Windows\System\XoiVkjT.exe
  2⤵
  PID:5600
- C:\Windows\System\RWaftoT.exe
  C:\Windows\System\RWaftoT.exe
  2⤵
  PID:5616
- C:\Windows\System\DJQVfSm.exe
  C:\Windows\System\DJQVfSm.exe
  2⤵
  PID:5676
- C:\Windows\System\TVNLBeN.exe
  C:\Windows\System\TVNLBeN.exe
  2⤵
  PID:5692
- C:\Windows\System\lDXYofB.exe
  C:\Windows\System\lDXYofB.exe
  2⤵
  PID:5708
- C:\Windows\System\kjGkroI.exe
  C:\Windows\System\kjGkroI.exe
  2⤵
  PID:5732
- C:\Windows\System\gZXXEtg.exe
  C:\Windows\System\gZXXEtg.exe
  2⤵
  PID:5752
- C:\Windows\System\bewNSEv.exe
  C:\Windows\System\bewNSEv.exe
  2⤵
  PID:5772
- C:\Windows\System\ZcjsjOO.exe
  C:\Windows\System\ZcjsjOO.exe
  2⤵
  PID:5788
- C:\Windows\System\xtMuAVE.exe
  C:\Windows\System\xtMuAVE.exe
  2⤵
  PID:5804
- C:\Windows\System\bRqtFPH.exe
  C:\Windows\System\bRqtFPH.exe
  2⤵
  PID:5824
- C:\Windows\System\mgqwoOU.exe
  C:\Windows\System\mgqwoOU.exe
  2⤵
  PID:5844
- C:\Windows\System\cJukTqj.exe
  C:\Windows\System\cJukTqj.exe
  2⤵
  PID:5864
- C:\Windows\System\viyAyFZ.exe
  C:\Windows\System\viyAyFZ.exe
  2⤵
  PID:5880
- C:\Windows\System\pKyonrv.exe
  C:\Windows\System\pKyonrv.exe
  2⤵
  PID:5900
- C:\Windows\System\AEHWpEM.exe
  C:\Windows\System\AEHWpEM.exe
  2⤵
  PID:5916
- C:\Windows\System\lPwWNPp.exe
  C:\Windows\System\lPwWNPp.exe
  2⤵
  PID:5936
- C:\Windows\System\CmqhMkW.exe
  C:\Windows\System\CmqhMkW.exe
  2⤵
  PID:5960
- C:\Windows\System\nQJsGND.exe
  C:\Windows\System\nQJsGND.exe
  2⤵
  PID:6136
- C:\Windows\System\ZqGeEJp.exe
  C:\Windows\System\ZqGeEJp.exe
  2⤵
  PID:4748
- C:\Windows\System\rdQMGiA.exe
  C:\Windows\System\rdQMGiA.exe
  2⤵
  PID:3804
- C:\Windows\System\VrQkxSn.exe
  C:\Windows\System\VrQkxSn.exe
  2⤵
  PID:4244
- C:\Windows\System\FkdErpE.exe
  C:\Windows\System\FkdErpE.exe
  2⤵
  PID:2192
- C:\Windows\System\CvcUVmP.exe
  C:\Windows\System\CvcUVmP.exe
  2⤵
  PID:5188
- C:\Windows\System\iQHGDIT.exe
  C:\Windows\System\iQHGDIT.exe
  2⤵
  PID:5228
- C:\Windows\System\GqCeiRS.exe
  C:\Windows\System\GqCeiRS.exe
  2⤵
  PID:4972
- C:\Windows\System\GkCWPfm.exe
  C:\Windows\System\GkCWPfm.exe
  2⤵
  PID:3784
- C:\Windows\System\VHvEqWf.exe
  C:\Windows\System\VHvEqWf.exe
  2⤵
  PID:5340
- C:\Windows\System\vQvnzIN.exe
  C:\Windows\System\vQvnzIN.exe
  2⤵
  PID:5380
- C:\Windows\System\YUuQuoO.exe
  C:\Windows\System\YUuQuoO.exe
  2⤵
  PID:5384
- C:\Windows\System\KhRItDU.exe
  C:\Windows\System\KhRItDU.exe
  2⤵
  PID:5572
- C:\Windows\System\nJjAsqF.exe
  C:\Windows\System\nJjAsqF.exe
  2⤵
  PID:5612
- C:\Windows\System\biHMrNh.exe
  C:\Windows\System\biHMrNh.exe
  2⤵
  PID:5716
- C:\Windows\System\AZPpbTg.exe
  C:\Windows\System\AZPpbTg.exe
  2⤵
  PID:5768
- C:\Windows\System\EmNbzjz.exe
  C:\Windows\System\EmNbzjz.exe
  2⤵
  PID:2628
- C:\Windows\System\ehOktCD.exe
  C:\Windows\System\ehOktCD.exe
  2⤵
  PID:5876
- C:\Windows\System\yVctRNq.exe
  C:\Windows\System\yVctRNq.exe
  2⤵
  PID:5836
- C:\Windows\System\Uyewoyf.exe
  C:\Windows\System\Uyewoyf.exe
  2⤵
  PID:5948
- C:\Windows\System\POPEkmA.exe
  C:\Windows\System\POPEkmA.exe
  2⤵
  PID:5064
- C:\Windows\System\YyDWwXq.exe
  C:\Windows\System\YyDWwXq.exe
  2⤵
  PID:5288
- C:\Windows\System\bKuJByT.exe
  C:\Windows\System\bKuJByT.exe
  2⤵
  PID:3908
- C:\Windows\System\irDITHR.exe
  C:\Windows\System\irDITHR.exe
  2⤵
  PID:3956
- C:\Windows\System\UJTzpwI.exe
  C:\Windows\System\UJTzpwI.exe
  2⤵
  PID:3132
- C:\Windows\System\HRXtRYZ.exe
  C:\Windows\System\HRXtRYZ.exe
  2⤵
  PID:3420
- C:\Windows\System\dNMFOpT.exe
  C:\Windows\System\dNMFOpT.exe
  2⤵
  PID:1824
- C:\Windows\System\NgReHfA.exe
  C:\Windows\System\NgReHfA.exe
  2⤵
  PID:4120
- C:\Windows\System\RiBIBes.exe
  C:\Windows\System\RiBIBes.exe
  2⤵
  PID:4160
- C:\Windows\System\BZkkZPX.exe
  C:\Windows\System\BZkkZPX.exe
  2⤵
  PID:5108
- C:\Windows\System\hauqABN.exe
  C:\Windows\System\hauqABN.exe
  2⤵
  PID:2940
- C:\Windows\System\GMskcTN.exe
  C:\Windows\System\GMskcTN.exe
  2⤵
  PID:5024
- C:\Windows\System\ByMjDlE.exe
  C:\Windows\System\ByMjDlE.exe
  2⤵
  PID:4340
- C:\Windows\System\sVIfbjl.exe
  C:\Windows\System\sVIfbjl.exe
  2⤵
  PID:5252
- C:\Windows\System\NshpIYi.exe
  C:\Windows\System\NshpIYi.exe
  2⤵
  PID:5324
- C:\Windows\System\FgnfBoZ.exe
  C:\Windows\System\FgnfBoZ.exe
  2⤵
  PID:4588
- C:\Windows\System\ugiOtDG.exe
  C:\Windows\System\ugiOtDG.exe
  2⤵
  PID:4656
- C:\Windows\System\wDXfnLm.exe
  C:\Windows\System\wDXfnLm.exe
  2⤵
  PID:4728
- C:\Windows\System\XNjqHBe.exe
  C:\Windows\System\XNjqHBe.exe
  2⤵
  PID:4864
- C:\Windows\System\LrcVBIY.exe
  C:\Windows\System\LrcVBIY.exe
  2⤵
  PID:4868
- C:\Windows\System\DlshCTi.exe
  C:\Windows\System\DlshCTi.exe
  2⤵
  PID:5664
- C:\Windows\System\AHGREmx.exe
  C:\Windows\System\AHGREmx.exe
  2⤵
  PID:5860
- C:\Windows\System\PlHoDyk.exe
  C:\Windows\System\PlHoDyk.exe
  2⤵
  PID:5008
- C:\Windows\System\XKsjklR.exe
  C:\Windows\System\XKsjklR.exe
  2⤵
  PID:5080
- C:\Windows\System\cGFcpaE.exe
  C:\Windows\System\cGFcpaE.exe
  2⤵
  PID:4176
- C:\Windows\System\ALUBiUZ.exe
  C:\Windows\System\ALUBiUZ.exe
  2⤵
  PID:4280
- C:\Windows\System\ZAFdcVb.exe
  C:\Windows\System\ZAFdcVb.exe
  2⤵
  PID:4532
- C:\Windows\System\zhAydQv.exe
  C:\Windows\System\zhAydQv.exe
  2⤵
  PID:6008
- C:\Windows\System\kZLgKyf.exe
  C:\Windows\System\kZLgKyf.exe
  2⤵
  PID:5132
- C:\Windows\System\tftoeoQ.exe
  C:\Windows\System\tftoeoQ.exe
  2⤵
  PID:5168
- C:\Windows\System\EgThNho.exe
  C:\Windows\System\EgThNho.exe
  2⤵
  PID:5244
- C:\Windows\System\WenrVSW.exe
  C:\Windows\System\WenrVSW.exe
  2⤵
  PID:5396
- C:\Windows\System\fhifQhl.exe
  C:\Windows\System\fhifQhl.exe
  2⤵
  PID:5444
- C:\Windows\System\inpyokx.exe
  C:\Windows\System\inpyokx.exe
  2⤵
  PID:5552
- C:\Windows\System\TBZLuPG.exe
  C:\Windows\System\TBZLuPG.exe
  2⤵
  PID:5596
- C:\Windows\System\WRlBfjM.exe
  C:\Windows\System\WRlBfjM.exe
  2⤵
  PID:5636
- C:\Windows\System\WIbZVMf.exe
  C:\Windows\System\WIbZVMf.exe
  2⤵
  PID:5672
- C:\Windows\System\HbsFmcJ.exe
  C:\Windows\System\HbsFmcJ.exe
  2⤵
  PID:5748
- C:\Windows\System\jmchHdQ.exe
  C:\Windows\System\jmchHdQ.exe
  2⤵
  PID:5820
- C:\Windows\System\iYWknUf.exe
  C:\Windows\System\iYWknUf.exe
  2⤵
  PID:5976
- C:\Windows\System\yFMQIBM.exe
  C:\Windows\System\yFMQIBM.exe
  2⤵
  PID:6000
- C:\Windows\System\iKnTODu.exe
  C:\Windows\System\iKnTODu.exe
  2⤵
  PID:6024
- C:\Windows\System\gAfjhKH.exe
  C:\Windows\System\gAfjhKH.exe
  2⤵
  PID:6044
- C:\Windows\System\iJnsNzM.exe
  C:\Windows\System\iJnsNzM.exe
  2⤵
  PID:6064
- C:\Windows\System\YznQYtq.exe
  C:\Windows\System\YznQYtq.exe
  2⤵
  PID:6096
- C:\Windows\System\Fpqhhpi.exe
  C:\Windows\System\Fpqhhpi.exe
  2⤵
  PID:6112
- C:\Windows\System\iGiaeFn.exe
  C:\Windows\System\iGiaeFn.exe
  2⤵
  PID:4604
- C:\Windows\System\KZHiQzw.exe
  C:\Windows\System\KZHiQzw.exe
  2⤵
  PID:2488
- C:\Windows\System\GzQkcJT.exe
  C:\Windows\System\GzQkcJT.exe
  2⤵
  PID:2584
- C:\Windows\System\nAeyhiI.exe
  C:\Windows\System\nAeyhiI.exe
  2⤵
  PID:5268
- C:\Windows\System\sAoNUcB.exe
  C:\Windows\System\sAoNUcB.exe
  2⤵
  PID:4964
- C:\Windows\System\FNwOOMr.exe
  C:\Windows\System\FNwOOMr.exe
  2⤵
  PID:2756
- C:\Windows\System\mnSXGlo.exe
  C:\Windows\System\mnSXGlo.exe
  2⤵
  PID:2420
- C:\Windows\System\HvUPERv.exe
  C:\Windows\System\HvUPERv.exe
  2⤵
  PID:4216
- C:\Windows\System\xBmhBHK.exe
  C:\Windows\System\xBmhBHK.exe
  2⤵
  PID:5224
- C:\Windows\System\bVKkOXm.exe
  C:\Windows\System\bVKkOXm.exe
  2⤵
  PID:5500
- C:\Windows\System\OoMdwtR.exe
  C:\Windows\System\OoMdwtR.exe
  2⤵
  PID:5760
- C:\Windows\System\XtodEDi.exe
  C:\Windows\System\XtodEDi.exe
  2⤵
  PID:5376
- C:\Windows\System\xsrEtPn.exe
  C:\Windows\System\xsrEtPn.exe
  2⤵
  PID:452
- C:\Windows\System\HcvhXnL.exe
  C:\Windows\System\HcvhXnL.exe
  2⤵
  PID:4932
- C:\Windows\System\DWvQiZI.exe
  C:\Windows\System\DWvQiZI.exe
  2⤵
  PID:884
- C:\Windows\System\bDsootl.exe
  C:\Windows\System\bDsootl.exe
  2⤵
  PID:4404
- C:\Windows\System\SFeftDf.exe
  C:\Windows\System\SFeftDf.exe
  2⤵
  PID:1580
- C:\Windows\System\rIhwrTz.exe
  C:\Windows\System\rIhwrTz.exe
  2⤵
  PID:5856
- C:\Windows\System\cxwZTLX.exe
  C:\Windows\System\cxwZTLX.exe
  2⤵
  PID:2404
- C:\Windows\System\TZkLvtk.exe
  C:\Windows\System\TZkLvtk.exe
  2⤵
  PID:4376
- C:\Windows\System\bzYHnYD.exe
  C:\Windows\System\bzYHnYD.exe
  2⤵
  PID:4116
- C:\Windows\System\bgoLPDL.exe
  C:\Windows\System\bgoLPDL.exe
  2⤵
  PID:6060
- C:\Windows\System\bVZjnsq.exe
  C:\Windows\System\bVZjnsq.exe
  2⤵
  PID:4516
- C:\Windows\System\lvyMhOF.exe
  C:\Windows\System\lvyMhOF.exe
  2⤵
  PID:4440
- C:\Windows\System\MjBqbeJ.exe
  C:\Windows\System\MjBqbeJ.exe
  2⤵
  PID:4696
- C:\Windows\System\SXZFQYn.exe
  C:\Windows\System\SXZFQYn.exe
  2⤵
  PID:4836
- C:\Windows\System\RXbrHnO.exe
  C:\Windows\System\RXbrHnO.exe
  2⤵
  PID:4268
- C:\Windows\System\FmDbYyp.exe
  C:\Windows\System\FmDbYyp.exe
  2⤵
  PID:4408
- C:\Windows\System\IFWkJTZ.exe
  C:\Windows\System\IFWkJTZ.exe
  2⤵
  PID:4620
- C:\Windows\System\gNXkbzn.exe
  C:\Windows\System\gNXkbzn.exe
  2⤵
  PID:4644
- C:\Windows\System\Yxhhsee.exe
  C:\Windows\System\Yxhhsee.exe
  2⤵
  PID:4428
- C:\Windows\System\CobhDIS.exe
  C:\Windows\System\CobhDIS.exe
  2⤵
  PID:4928
- C:\Windows\System\FVVZmns.exe
  C:\Windows\System\FVVZmns.exe
  2⤵
  PID:4528
- C:\Windows\System\noapaVF.exe
  C:\Windows\System\noapaVF.exe
  2⤵
  PID:4960
- C:\Windows\System\kKQDkok.exe
  C:\Windows\System\kKQDkok.exe
  2⤵
  PID:5360
- C:\Windows\System\lttBfBQ.exe
  C:\Windows\System\lttBfBQ.exe
  2⤵
  PID:5240
- C:\Windows\System\fhGUAvn.exe
  C:\Windows\System\fhGUAvn.exe
  2⤵
  PID:5480
- C:\Windows\System\DsqxZdC.exe
  C:\Windows\System\DsqxZdC.exe
  2⤵
  PID:5648
- C:\Windows\System\zmBrAIp.exe
  C:\Windows\System\zmBrAIp.exe
  2⤵
  PID:5968
- C:\Windows\System\nVAhcUP.exe
  C:\Windows\System\nVAhcUP.exe
  2⤵
  PID:5668
- C:\Windows\System\oflSSYC.exe
  C:\Windows\System\oflSSYC.exe
  2⤵
  PID:6104
- C:\Windows\System\JsHyXpo.exe
  C:\Windows\System\JsHyXpo.exe
  2⤵
  PID:5652
- C:\Windows\System\zSgwoyq.exe
  C:\Windows\System\zSgwoyq.exe
  2⤵
  PID:2780
- C:\Windows\System\JqmcNFZ.exe
  C:\Windows\System\JqmcNFZ.exe
  2⤵
  PID:5308
- C:\Windows\System\Dhuiemn.exe
  C:\Windows\System\Dhuiemn.exe
  2⤵
  PID:5684
- C:\Windows\System\kshUXFx.exe
  C:\Windows\System\kshUXFx.exe
  2⤵
  PID:3672
- C:\Windows\System\hyVYoqV.exe
  C:\Windows\System\hyVYoqV.exe
  2⤵
  PID:4360
- C:\Windows\System\IyOXphe.exe
  C:\Windows\System\IyOXphe.exe
  2⤵
  PID:4584
- C:\Windows\System\KsIlQnw.exe
  C:\Windows\System\KsIlQnw.exe
  2⤵
  PID:4820
- C:\Windows\System\qDLbFzX.exe
  C:\Windows\System\qDLbFzX.exe
  2⤵
  PID:4732
- C:\Windows\System\NopelPM.exe
  C:\Windows\System\NopelPM.exe
  2⤵
  PID:6004
- C:\Windows\System\orBOTgE.exe
  C:\Windows\System\orBOTgE.exe
  2⤵
  PID:4716
- C:\Windows\System\RiiEsjn.exe
  C:\Windows\System\RiiEsjn.exe
  2⤵
  PID:5992
- C:\Windows\System\OzPkHXX.exe
  C:\Windows\System\OzPkHXX.exe
  2⤵
  PID:6084
- C:\Windows\System\NyZukEK.exe
  C:\Windows\System\NyZukEK.exe
  2⤵
  PID:4412
- C:\Windows\System\lYMpspw.exe
  C:\Windows\System\lYMpspw.exe
  2⤵
  PID:2432
- C:\Windows\System\ptxRRJD.exe
  C:\Windows\System\ptxRRJD.exe
  2⤵
  PID:5468
- C:\Windows\System\ivhtPDq.exe
  C:\Windows\System\ivhtPDq.exe
  2⤵
  PID:5784
- C:\Windows\System\CXunyIn.exe
  C:\Windows\System\CXunyIn.exe
  2⤵
  PID:4988
- C:\Windows\System\CGQkndn.exe
  C:\Windows\System\CGQkndn.exe
  2⤵
  PID:3952
- C:\Windows\System\IpkOjoF.exe
  C:\Windows\System\IpkOjoF.exe
  2⤵
  PID:5516
- C:\Windows\System\JWBKffZ.exe
  C:\Windows\System\JWBKffZ.exe
  2⤵
  PID:3040
- C:\Windows\System\CbbAxwl.exe
  C:\Windows\System\CbbAxwl.exe
  2⤵
  PID:1636
- C:\Windows\System\GUMrtDY.exe
  C:\Windows\System\GUMrtDY.exe
  2⤵
  PID:6124
- C:\Windows\System\DLhVjok.exe
  C:\Windows\System\DLhVjok.exe
  2⤵
  PID:5912
- C:\Windows\System\xHMpLCO.exe
  C:\Windows\System\xHMpLCO.exe
  2⤵
  PID:5892
- C:\Windows\System\aMUHNeg.exe
  C:\Windows\System\aMUHNeg.exe
  2⤵
  PID:4900
- C:\Windows\System\AsbfxHT.exe
  C:\Windows\System\AsbfxHT.exe
  2⤵
  PID:6076
- C:\Windows\System\rUHGVAq.exe
  C:\Windows\System\rUHGVAq.exe
  2⤵
  PID:5800
- C:\Windows\System\EgiizbR.exe
  C:\Windows\System\EgiizbR.exe
  2⤵
  PID:5644
- C:\Windows\System\jCteBZi.exe
  C:\Windows\System\jCteBZi.exe
  2⤵
  PID:5488
- C:\Windows\System\yTvcqmH.exe
  C:\Windows\System\yTvcqmH.exe
  2⤵
  PID:6016
- C:\Windows\System\hQJeUkp.exe
  C:\Windows\System\hQJeUkp.exe
  2⤵
  PID:5076
- C:\Windows\System\ncXOJAJ.exe
  C:\Windows\System\ncXOJAJ.exe
  2⤵
  PID:5128
- C:\Windows\System\kFnRvwX.exe
  C:\Windows\System\kFnRvwX.exe
  2⤵
  PID:5984
- C:\Windows\System\pwoiSRR.exe
  C:\Windows\System\pwoiSRR.exe
  2⤵
  PID:5988
- C:\Windows\System\MLpThnt.exe
  C:\Windows\System\MLpThnt.exe
  2⤵
  PID:1540
- C:\Windows\System\uReBnIw.exe
  C:\Windows\System\uReBnIw.exe
  2⤵
  PID:4136
- C:\Windows\System\TLscXpm.exe
  C:\Windows\System\TLscXpm.exe
  2⤵
  PID:1680
- C:\Windows\System\kuxGjnz.exe
  C:\Windows\System\kuxGjnz.exe
  2⤵
  PID:4264
- C:\Windows\System\WUoOuBP.exe
  C:\Windows\System\WUoOuBP.exe
  2⤵
  PID:5348
- C:\Windows\System\znBkdYL.exe
  C:\Windows\System\znBkdYL.exe
  2⤵
  PID:888
- C:\Windows\System\EUGirhZ.exe
  C:\Windows\System\EUGirhZ.exe
  2⤵
  PID:3112
- C:\Windows\System\xeNLjsd.exe
  C:\Windows\System\xeNLjsd.exe
  2⤵
  PID:6100
- C:\Windows\System\BIzuNxM.exe
  C:\Windows\System\BIzuNxM.exe
  2⤵
  PID:4676
- C:\Windows\System\ysppjhP.exe
  C:\Windows\System\ysppjhP.exe
  2⤵
  PID:5740
- C:\Windows\System\LfcdgfM.exe
  C:\Windows\System\LfcdgfM.exe
  2⤵
  PID:6088
- C:\Windows\System\LliwUKN.exe
  C:\Windows\System\LliwUKN.exe
  2⤵
  PID:584
- C:\Windows\System\JAriphe.exe
  C:\Windows\System\JAriphe.exe
  2⤵
  PID:5632
- C:\Windows\System\IGzJkrZ.exe
  C:\Windows\System\IGzJkrZ.exe
  2⤵
  PID:5000
- C:\Windows\System\VGVqmsG.exe
  C:\Windows\System\VGVqmsG.exe
  2⤵
  PID:1484
- C:\Windows\System\fJdaPtA.exe
  C:\Windows\System\fJdaPtA.exe
  2⤵
  PID:4024
- C:\Windows\System\JIwwRUi.exe
  C:\Windows\System\JIwwRUi.exe
  2⤵
  PID:6036
- C:\Windows\System\duzwAbu.exe
  C:\Windows\System\duzwAbu.exe
  2⤵
  PID:4884
- C:\Windows\System\ZtphZPh.exe
  C:\Windows\System\ZtphZPh.exe
  2⤵
  PID:4476
- C:\Windows\System\qkwirfD.exe
  C:\Windows\System\qkwirfD.exe
  2⤵
  PID:5704
- C:\Windows\System\YAmthao.exe
  C:\Windows\System\YAmthao.exe
  2⤵
  PID:6056
- C:\Windows\System\zZNhCgA.exe
  C:\Windows\System\zZNhCgA.exe
  2⤵
  PID:2344
- C:\Windows\System\CCdwcVw.exe
  C:\Windows\System\CCdwcVw.exe
  2⤵
  PID:5420
- C:\Windows\System\WuWassM.exe
  C:\Windows\System\WuWassM.exe
  2⤵
  PID:4832
- C:\Windows\System\tecjknN.exe
  C:\Windows\System\tecjknN.exe
  2⤵
  PID:5140
- C:\Windows\System\tkYBzTR.exe
  C:\Windows\System\tkYBzTR.exe
  2⤵
  PID:6092
- C:\Windows\System\Ejtzkgd.exe
  C:\Windows\System\Ejtzkgd.exe
  2⤵
  PID:5004
- C:\Windows\System\asJnvtV.exe
  C:\Windows\System\asJnvtV.exe
  2⤵
  PID:1476
- C:\Windows\System\oXknSSG.exe
  C:\Windows\System\oXknSSG.exe
  2⤵
  PID:4580
- C:\Windows\System\jrDPyYk.exe
  C:\Windows\System\jrDPyYk.exe
  2⤵
  PID:340
- C:\Windows\System\lpkccIl.exe
  C:\Windows\System\lpkccIl.exe
  2⤵
  PID:4768
- C:\Windows\System\aIZntnn.exe
  C:\Windows\System\aIZntnn.exe
  2⤵
  PID:616
- C:\Windows\System\sWlaEWf.exe
  C:\Windows\System\sWlaEWf.exe
  2⤵
  PID:4816
- C:\Windows\System\FFLOumZ.exe
  C:\Windows\System\FFLOumZ.exe
  2⤵
  PID:6156
- C:\Windows\System\UrFXhnL.exe
  C:\Windows\System\UrFXhnL.exe
  2⤵
  PID:6176
- C:\Windows\System\ndhIHsY.exe
  C:\Windows\System\ndhIHsY.exe
  2⤵
  PID:6196
- C:\Windows\System\HGgJbCT.exe
  C:\Windows\System\HGgJbCT.exe
  2⤵
  PID:6216
- C:\Windows\System\OAUMdip.exe
  C:\Windows\System\OAUMdip.exe
  2⤵
  PID:6236
- C:\Windows\System\TZdRndY.exe
  C:\Windows\System\TZdRndY.exe
  2⤵
  PID:6256
- C:\Windows\System\JOeCkZe.exe
  C:\Windows\System\JOeCkZe.exe
  2⤵
  PID:6280
- C:\Windows\System\hvIaBlL.exe
  C:\Windows\System\hvIaBlL.exe
  2⤵
  PID:6296
- C:\Windows\System\tUAfQWZ.exe
  C:\Windows\System\tUAfQWZ.exe
  2⤵
  PID:6320
- C:\Windows\System\KSiNqeW.exe
  C:\Windows\System\KSiNqeW.exe
  2⤵
  PID:6336
- C:\Windows\System\cANaFQa.exe
  C:\Windows\System\cANaFQa.exe
  2⤵
  PID:6352
- C:\Windows\System\KjPZkyN.exe
  C:\Windows\System\KjPZkyN.exe
  2⤵
  PID:6368
- C:\Windows\System\ibLEmbI.exe
  C:\Windows\System\ibLEmbI.exe
  2⤵
  PID:6392
- C:\Windows\System\hjkOmPw.exe
  C:\Windows\System\hjkOmPw.exe
  2⤵
  PID:6408
- C:\Windows\System\iYgVxsy.exe
  C:\Windows\System\iYgVxsy.exe
  2⤵
  PID:6428
- C:\Windows\System\WWLXpIv.exe
  C:\Windows\System\WWLXpIv.exe
  2⤵
  PID:6448
- C:\Windows\System\PRGEWYP.exe
  C:\Windows\System\PRGEWYP.exe
  2⤵
  PID:6464
- C:\Windows\System\VMVTBmn.exe
  C:\Windows\System\VMVTBmn.exe
  2⤵
  PID:6488
- C:\Windows\System\oRzaoIt.exe
  C:\Windows\System\oRzaoIt.exe
  2⤵
  PID:6520
- C:\Windows\System\sKvfMtw.exe
  C:\Windows\System\sKvfMtw.exe
  2⤵
  PID:6536
- C:\Windows\System\paXOQtU.exe
  C:\Windows\System\paXOQtU.exe
  2⤵
  PID:6556
- C:\Windows\System\REveAjI.exe
  C:\Windows\System\REveAjI.exe
  2⤵
  PID:6572
- C:\Windows\System\tmNAbIo.exe
  C:\Windows\System\tmNAbIo.exe
  2⤵
  PID:6592
- C:\Windows\System\LdokRqQ.exe
  C:\Windows\System\LdokRqQ.exe
  2⤵
  PID:6608
- C:\Windows\System\uAJJJXa.exe
  C:\Windows\System\uAJJJXa.exe
  2⤵
  PID:6632
- C:\Windows\System\YWxSYpU.exe
  C:\Windows\System\YWxSYpU.exe
  2⤵
  PID:6652
- C:\Windows\System\TAwvnaD.exe
  C:\Windows\System\TAwvnaD.exe
  2⤵
  PID:6676
- C:\Windows\System\RBbzsMK.exe
  C:\Windows\System\RBbzsMK.exe
  2⤵
  PID:6700
- C:\Windows\System\JDbZTFl.exe
  C:\Windows\System\JDbZTFl.exe
  2⤵
  PID:6724
- C:\Windows\System\OVeokQY.exe
  C:\Windows\System\OVeokQY.exe
  2⤵
  PID:6740
- C:\Windows\System\XZpjsEm.exe
  C:\Windows\System\XZpjsEm.exe
  2⤵
  PID:6756
- C:\Windows\System\JPeHwXY.exe
  C:\Windows\System\JPeHwXY.exe
  2⤵
  PID:6772
- C:\Windows\System\gCWNJaP.exe
  C:\Windows\System\gCWNJaP.exe
  2⤵
  PID:6788
- C:\Windows\System\ERXJcYT.exe
  C:\Windows\System\ERXJcYT.exe
  2⤵
  PID:6808
- C:\Windows\System\eBrJtMq.exe
  C:\Windows\System\eBrJtMq.exe
  2⤵
  PID:6828
- C:\Windows\System\suXDcMF.exe
  C:\Windows\System\suXDcMF.exe
  2⤵
  PID:6848
- C:\Windows\System\gWMvyvn.exe
  C:\Windows\System\gWMvyvn.exe
  2⤵
  PID:6864
- C:\Windows\System\vgfLssp.exe
  C:\Windows\System\vgfLssp.exe
  2⤵
  PID:6880
- C:\Windows\System\pWuTIzb.exe
  C:\Windows\System\pWuTIzb.exe
  2⤵
  PID:6900
- C:\Windows\System\XKlnlRg.exe
  C:\Windows\System\XKlnlRg.exe
  2⤵
  PID:6916
- C:\Windows\System\VTPAIrF.exe
  C:\Windows\System\VTPAIrF.exe
  2⤵
  PID:6936
- C:\Windows\System\hJKFchS.exe
  C:\Windows\System\hJKFchS.exe
  2⤵
  PID:6952
- C:\Windows\System\PBxSDdB.exe
  C:\Windows\System\PBxSDdB.exe
  2⤵
  PID:6968
- C:\Windows\System\WvBKZog.exe
  C:\Windows\System\WvBKZog.exe
  2⤵
  PID:6984
- C:\Windows\System\AKjHfpI.exe
  C:\Windows\System\AKjHfpI.exe
  2⤵
  PID:7000
- C:\Windows\System\XUABWOY.exe
  C:\Windows\System\XUABWOY.exe
  2⤵
  PID:7020
- C:\Windows\System\dfAxcoG.exe
  C:\Windows\System\dfAxcoG.exe
  2⤵
  PID:7040
- C:\Windows\System\TgMaMES.exe
  C:\Windows\System\TgMaMES.exe
  2⤵
  PID:7060
- C:\Windows\System\NBeMywU.exe
  C:\Windows\System\NBeMywU.exe
  2⤵
  PID:7080
- C:\Windows\System\CKWuMmI.exe
  C:\Windows\System\CKWuMmI.exe
  2⤵
  PID:7100
- C:\Windows\System\HBPUZGZ.exe
  C:\Windows\System\HBPUZGZ.exe
  2⤵
  PID:7120
- C:\Windows\System\TPWFtDn.exe
  C:\Windows\System\TPWFtDn.exe
  2⤵
  PID:7140
- C:\Windows\System\vrZftlo.exe
  C:\Windows\System\vrZftlo.exe
  2⤵
  PID:5956
- C:\Windows\System\TqrlVSz.exe
  C:\Windows\System\TqrlVSz.exe
  2⤵
  PID:1652
- C:\Windows\System\dxQOfzy.exe
  C:\Windows\System\dxQOfzy.exe
  2⤵
  PID:5816
- C:\Windows\System\MHEdojn.exe
  C:\Windows\System\MHEdojn.exe
  2⤵
  PID:6204
- C:\Windows\System\TyHwGdX.exe
  C:\Windows\System\TyHwGdX.exe
  2⤵
  PID:6248
- C:\Windows\System\ftywMft.exe
  C:\Windows\System\ftywMft.exe
  2⤵
  PID:6276
- C:\Windows\System\YzXTNsT.exe
  C:\Windows\System\YzXTNsT.exe
  2⤵
  PID:6312
- C:\Windows\System\oeDoGaU.exe
  C:\Windows\System\oeDoGaU.exe
  2⤵
  PID:6348
- C:\Windows\System\TyORQaY.exe
  C:\Windows\System\TyORQaY.exe
  2⤵
  PID:6328
- C:\Windows\System\rWrXmWz.exe
  C:\Windows\System\rWrXmWz.exe
  2⤵
  PID:6456
- C:\Windows\System\pJAJvKv.exe
  C:\Windows\System\pJAJvKv.exe
  2⤵
  PID:6504
- C:\Windows\System\JczelhX.exe
  C:\Windows\System\JczelhX.exe
  2⤵
  PID:6508
- C:\Windows\System\BYkTvIf.exe
  C:\Windows\System\BYkTvIf.exe
  2⤵
  PID:6444
- C:\Windows\System\QlruZwM.exe
  C:\Windows\System\QlruZwM.exe
  2⤵
  PID:6404
- C:\Windows\System\gouKhuH.exe
  C:\Windows\System\gouKhuH.exe
  2⤵
  PID:6620
- C:\Windows\System\jPdtEdM.exe
  C:\Windows\System\jPdtEdM.exe
  2⤵
  PID:6600
- C:\Windows\System\oJYwQFz.exe
  C:\Windows\System\oJYwQFz.exe
  2⤵
  PID:6568
- C:\Windows\System\XhQsDsU.exe
  C:\Windows\System\XhQsDsU.exe
  2⤵
  PID:6648
- C:\Windows\System\yXHGavB.exe
  C:\Windows\System\yXHGavB.exe
  2⤵
  PID:6820
- C:\Windows\System\WyRJxOY.exe
  C:\Windows\System\WyRJxOY.exe
  2⤵
  PID:6888
- C:\Windows\System\fkVZaTQ.exe
  C:\Windows\System\fkVZaTQ.exe
  2⤵
  PID:6960
- C:\Windows\System\wiJKsoi.exe
  C:\Windows\System\wiJKsoi.exe
  2⤵
  PID:6924
- C:\Windows\System\EidVdOg.exe
  C:\Windows\System\EidVdOg.exe
  2⤵
  PID:7068
- C:\Windows\System\CAJRczc.exe
  C:\Windows\System\CAJRczc.exe
  2⤵
  PID:7108
- C:\Windows\System\VTKtdqz.exe
  C:\Windows\System\VTKtdqz.exe
  2⤵
  PID:7152
- C:\Windows\System\bujkegf.exe
  C:\Windows\System\bujkegf.exe
  2⤵
  PID:6032
- C:\Windows\System\GpVRtwa.exe
  C:\Windows\System\GpVRtwa.exe
  2⤵
  PID:2724
- C:\Windows\System\UwQZGnO.exe
  C:\Windows\System\UwQZGnO.exe
  2⤵
  PID:6268
- C:\Windows\System\pbkpvNw.exe
  C:\Windows\System\pbkpvNw.exe
  2⤵
  PID:6288
- C:\Windows\System\JVaPsyW.exe
  C:\Windows\System\JVaPsyW.exe
  2⤵
  PID:6500
- C:\Windows\System\HVZreED.exe
  C:\Windows\System\HVZreED.exe
  2⤵
  PID:6332
- C:\Windows\System\YLGczNp.exe
  C:\Windows\System\YLGczNp.exe
  2⤵
  PID:6584
- C:\Windows\System\aOFddVu.exe
  C:\Windows\System\aOFddVu.exe
  2⤵
  PID:6840
- C:\Windows\System\HnTlENi.exe
  C:\Windows\System\HnTlENi.exe
  2⤵
  PID:6564
- C:\Windows\System\sbHRiaL.exe
  C:\Windows\System\sbHRiaL.exe
  2⤵
  PID:6804
- C:\Windows\System\obnxYal.exe
  C:\Windows\System\obnxYal.exe
  2⤵
  PID:6696
- C:\Windows\System\TEfIlcd.exe
  C:\Windows\System\TEfIlcd.exe
  2⤵
  PID:6912
- C:\Windows\System\EyYcdeC.exe
  C:\Windows\System\EyYcdeC.exe
  2⤵
  PID:6948
- C:\Windows\System\QOEDDtE.exe
  C:\Windows\System\QOEDDtE.exe
  2⤵
  PID:7008
- C:\Windows\System\whCIlmh.exe
  C:\Windows\System\whCIlmh.exe
  2⤵
  PID:7056
- C:\Windows\System\bKxHwwd.exe
  C:\Windows\System\bKxHwwd.exe
  2⤵
  PID:7136
- C:\Windows\System\jEGoOki.exe
  C:\Windows\System\jEGoOki.exe
  2⤵
  PID:6228
- C:\Windows\System\IFhHIjt.exe
  C:\Windows\System\IFhHIjt.exe
  2⤵
  PID:6344
- C:\Windows\System\XbVozAG.exe
  C:\Windows\System\XbVozAG.exe
  2⤵
  PID:6364
- C:\Windows\System\GFmkUto.exe
  C:\Windows\System\GFmkUto.exe
  2⤵
  PID:6604
- C:\Windows\System\bTUPIat.exe
  C:\Windows\System\bTUPIat.exe
  2⤵
  PID:6672
- C:\Windows\System\mdXTuvE.exe
  C:\Windows\System\mdXTuvE.exe
  2⤵
  PID:7116
- C:\Windows\System\SSqpPgl.exe
  C:\Windows\System\SSqpPgl.exe
  2⤵
  PID:6244
- C:\Windows\System\OmdfyML.exe
  C:\Windows\System\OmdfyML.exe
  2⤵
  PID:6836
- C:\Windows\System\FzxIKLP.exe
  C:\Windows\System\FzxIKLP.exe
  2⤵
  PID:7096
- C:\Windows\System\BZXmujs.exe
  C:\Windows\System\BZXmujs.exe
  2⤵
  PID:6976
- C:\Windows\System\bpARBDB.exe
  C:\Windows\System\bpARBDB.exe
  2⤵
  PID:6292
- C:\Windows\System\vYgOLWh.exe
  C:\Windows\System\vYgOLWh.exe
  2⤵
  PID:6996
- C:\Windows\System\jfSrjys.exe
  C:\Windows\System\jfSrjys.exe
  2⤵
  PID:6528
- C:\Windows\System\ERaepSW.exe
  C:\Windows\System\ERaepSW.exe
  2⤵
  PID:6932
- C:\Windows\System\GNDKGjR.exe
  C:\Windows\System\GNDKGjR.exe
  2⤵
  PID:7028
- C:\Windows\System\wPOKFiK.exe
  C:\Windows\System\wPOKFiK.exe
  2⤵
  PID:7184
- C:\Windows\System\NAyTfog.exe
  C:\Windows\System\NAyTfog.exe
  2⤵
  PID:7200
- C:\Windows\System\hITjqFa.exe
  C:\Windows\System\hITjqFa.exe
  2⤵
  PID:7220
- C:\Windows\System\KciVWiu.exe
  C:\Windows\System\KciVWiu.exe
  2⤵
  PID:7240
- C:\Windows\System\kqCrdSs.exe
  C:\Windows\System\kqCrdSs.exe
  2⤵
  PID:7256
- C:\Windows\System\NDxdHzq.exe
  C:\Windows\System\NDxdHzq.exe
  2⤵
  PID:7280
- C:\Windows\System\UqITrnH.exe
  C:\Windows\System\UqITrnH.exe
  2⤵
  PID:7304
- C:\Windows\System\QQXcHQs.exe
  C:\Windows\System\QQXcHQs.exe
  2⤵
  PID:7376
- C:\Windows\System\EZTHHNo.exe
  C:\Windows\System\EZTHHNo.exe
  2⤵
  PID:7396
- C:\Windows\System\WgAxExw.exe
  C:\Windows\System\WgAxExw.exe
  2⤵
  PID:7416
- C:\Windows\System\kHGzary.exe
  C:\Windows\System\kHGzary.exe
  2⤵
  PID:7436
- C:\Windows\System\IsfcqhQ.exe
  C:\Windows\System\IsfcqhQ.exe
  2⤵
  PID:7452
- C:\Windows\System\TWJjaED.exe
  C:\Windows\System\TWJjaED.exe
  2⤵
  PID:7468
- C:\Windows\System\ywODbgR.exe
  C:\Windows\System\ywODbgR.exe
  2⤵
  PID:7488
- C:\Windows\System\yLTobuV.exe
  C:\Windows\System\yLTobuV.exe
  2⤵
  PID:7504
- C:\Windows\System\LIGsMtk.exe
  C:\Windows\System\LIGsMtk.exe
  2⤵
  PID:7524
- C:\Windows\System\kKbNIKr.exe
  C:\Windows\System\kKbNIKr.exe
  2⤵
  PID:7540
- C:\Windows\System\HaOmcwy.exe
  C:\Windows\System\HaOmcwy.exe
  2⤵
  PID:7560
- C:\Windows\System\DcCMRKh.exe
  C:\Windows\System\DcCMRKh.exe
  2⤵
  PID:7580
- C:\Windows\System\vbLheCk.exe
  C:\Windows\System\vbLheCk.exe
  2⤵
  PID:7600
- C:\Windows\System\nHWsADz.exe
  C:\Windows\System\nHWsADz.exe
  2⤵
  PID:7616
- C:\Windows\System\xLPIVvK.exe
  C:\Windows\System\xLPIVvK.exe
  2⤵
  PID:7636
- C:\Windows\System\CVyCpPl.exe
  C:\Windows\System\CVyCpPl.exe
  2⤵
  PID:7660
- C:\Windows\System\WKaIGlE.exe
  C:\Windows\System\WKaIGlE.exe
  2⤵
  PID:7684
- C:\Windows\System\PXmhitV.exe
  C:\Windows\System\PXmhitV.exe
  2⤵
  PID:7708
- C:\Windows\System\bcUmAnl.exe
  C:\Windows\System\bcUmAnl.exe
  2⤵
  PID:7728
- C:\Windows\System\RTMZEJf.exe
  C:\Windows\System\RTMZEJf.exe
  2⤵
  PID:7752
- C:\Windows\System\RtzrxVE.exe
  C:\Windows\System\RtzrxVE.exe
  2⤵
  PID:7772
- C:\Windows\System\caPbFoF.exe
  C:\Windows\System\caPbFoF.exe
  2⤵
  PID:7788
- C:\Windows\System\LHuskvX.exe
  C:\Windows\System\LHuskvX.exe
  2⤵
  PID:7808
- C:\Windows\System\akvdBbW.exe
  C:\Windows\System\akvdBbW.exe
  2⤵
  PID:7832
- C:\Windows\System\KjnRBRG.exe
  C:\Windows\System\KjnRBRG.exe
  2⤵
  PID:7848
- C:\Windows\System\QFvjesu.exe
  C:\Windows\System\QFvjesu.exe
  2⤵
  PID:7876
- C:\Windows\System\FcJCksI.exe
  C:\Windows\System\FcJCksI.exe
  2⤵
  PID:7892
- C:\Windows\System\odyhhtR.exe
  C:\Windows\System\odyhhtR.exe
  2⤵
  PID:7908
- C:\Windows\System\AbjdmZM.exe
  C:\Windows\System\AbjdmZM.exe
  2⤵
  PID:7924
- C:\Windows\System\tEqisHT.exe
  C:\Windows\System\tEqisHT.exe
  2⤵
  PID:7940
- C:\Windows\System\KSJJqhR.exe
  C:\Windows\System\KSJJqhR.exe
  2⤵
  PID:7956
- C:\Windows\System\LndJEqQ.exe
  C:\Windows\System\LndJEqQ.exe
  2⤵
  PID:7972
- C:\Windows\System\rIJVYCx.exe
  C:\Windows\System\rIJVYCx.exe
  2⤵
  PID:7988
- C:\Windows\System\wuUNgpo.exe
  C:\Windows\System\wuUNgpo.exe
  2⤵
  PID:8004
- C:\Windows\System\pUzbNIB.exe
  C:\Windows\System\pUzbNIB.exe
  2⤵
  PID:8020
- C:\Windows\System\qaxNGsY.exe
  C:\Windows\System\qaxNGsY.exe
  2⤵
  PID:8036
- C:\Windows\System\HNAeeCP.exe
  C:\Windows\System\HNAeeCP.exe
  2⤵
  PID:8052
- C:\Windows\System\DCeHhhF.exe
  C:\Windows\System\DCeHhhF.exe
  2⤵
  PID:8068
- C:\Windows\System\gLkklHc.exe
  C:\Windows\System\gLkklHc.exe
  2⤵
  PID:8092
- C:\Windows\System\vQNNGbc.exe
  C:\Windows\System\vQNNGbc.exe
  2⤵
  PID:8108
- C:\Windows\System\ngtNAUG.exe
  C:\Windows\System\ngtNAUG.exe
  2⤵
  PID:8124
- C:\Windows\System\iCVdYtg.exe
  C:\Windows\System\iCVdYtg.exe
  2⤵
  PID:8140
- C:\Windows\System\fdNHMtL.exe
  C:\Windows\System\fdNHMtL.exe
  2⤵
  PID:8156
- C:\Windows\System\QoKXVGP.exe
  C:\Windows\System\QoKXVGP.exe
  2⤵
  PID:8172
- C:\Windows\System\icxYNlt.exe
  C:\Windows\System\icxYNlt.exe
  2⤵
  PID:8188
- C:\Windows\System\memzvwY.exe
  C:\Windows\System\memzvwY.exe
  2⤵
  PID:7212
- C:\Windows\System\ayrPTXz.exe
  C:\Windows\System\ayrPTXz.exe
  2⤵
  PID:6748
- C:\Windows\System\KmCNytb.exe
  C:\Windows\System\KmCNytb.exe
  2⤵
  PID:7132
- C:\Windows\System\fJkGARE.exe
  C:\Windows\System\fJkGARE.exe
  2⤵
  PID:6856
- C:\Windows\System\WyIBOgn.exe
  C:\Windows\System\WyIBOgn.exe
  2⤵
  PID:7036
- C:\Windows\System\OFbENOY.exe
  C:\Windows\System\OFbENOY.exe
  2⤵
  PID:6192
- C:\Windows\System\RmIplcP.exe
  C:\Windows\System\RmIplcP.exe
  2⤵
  PID:4796
- C:\Windows\System\EkauoAK.exe
  C:\Windows\System\EkauoAK.exe
  2⤵
  PID:6736
- C:\Windows\System\snifHZs.exe
  C:\Windows\System\snifHZs.exe
  2⤵
  PID:6796
- C:\Windows\System\yKwmVlG.exe
  C:\Windows\System\yKwmVlG.exe
  2⤵
  PID:6480
- C:\Windows\System\WthzpWW.exe
  C:\Windows\System\WthzpWW.exe
  2⤵
  PID:7316
- C:\Windows\System\FRtxvIY.exe
  C:\Windows\System\FRtxvIY.exe
  2⤵
  PID:7332
- C:\Windows\System\qsGYSlp.exe
  C:\Windows\System\qsGYSlp.exe
  2⤵
  PID:7324
- C:\Windows\System\ajNphnm.exe
  C:\Windows\System\ajNphnm.exe
  2⤵
  PID:7348
- C:\Windows\System\ZnCkONw.exe
  C:\Windows\System\ZnCkONw.exe
  2⤵
  PID:7372
- C:\Windows\System\mxvFcfX.exe
  C:\Windows\System\mxvFcfX.exe
  2⤵
  PID:7424
- C:\Windows\System\uGKapwq.exe
  C:\Windows\System\uGKapwq.exe
  2⤵
  PID:7460
- C:\Windows\System\tpDeFbR.exe
  C:\Windows\System\tpDeFbR.exe
  2⤵
  PID:7532
- C:\Windows\System\bwTcgGU.exe
  C:\Windows\System\bwTcgGU.exe
  2⤵
  PID:7576
- C:\Windows\System\tPYHxpK.exe
  C:\Windows\System\tPYHxpK.exe
  2⤵
  PID:7612
- C:\Windows\System\jzYIEAF.exe
  C:\Windows\System\jzYIEAF.exe
  2⤵
  PID:7652
- C:\Windows\System\RoypXDb.exe
  C:\Windows\System\RoypXDb.exe
  2⤵
  PID:7704
- C:\Windows\System\qYhLfMp.exe
  C:\Windows\System\qYhLfMp.exe
  2⤵
  PID:7588
- C:\Windows\System\JXDEURu.exe
  C:\Windows\System\JXDEURu.exe
  2⤵
  PID:7552
- C:\Windows\System\XSoZHHx.exe
  C:\Windows\System\XSoZHHx.exe
  2⤵
  PID:7624
- C:\Windows\System\LzHEkca.exe
  C:\Windows\System\LzHEkca.exe
  2⤵
  PID:7680
- C:\Windows\System\xgWKHTU.exe
  C:\Windows\System\xgWKHTU.exe
  2⤵
  PID:7748
- C:\Windows\System\kEdVfOS.exe
  C:\Windows\System\kEdVfOS.exe
  2⤵
  PID:7784
- C:\Windows\System\ePWTQdv.exe
  C:\Windows\System\ePWTQdv.exe
  2⤵
  PID:7800
- C:\Windows\System\bdStrnQ.exe
  C:\Windows\System\bdStrnQ.exe
  2⤵
  PID:8032
- C:\Windows\System\xuFVAOC.exe
  C:\Windows\System\xuFVAOC.exe
  2⤵
  PID:7916
- C:\Windows\System\OGgpJdU.exe
  C:\Windows\System\OGgpJdU.exe
  2⤵
  PID:7984
- C:\Windows\System\JDMVWyW.exe
  C:\Windows\System\JDMVWyW.exe
  2⤵
  PID:8076
- C:\Windows\System\XPxXzZo.exe
  C:\Windows\System\XPxXzZo.exe
  2⤵
  PID:8016
- C:\Windows\System\mSTsFCA.exe
  C:\Windows\System\mSTsFCA.exe
  2⤵
  PID:8104
- C:\Windows\System\lhujhiB.exe
  C:\Windows\System\lhujhiB.exe
  2⤵
  PID:7296
- C:\Windows\System\DCavzhP.exe
  C:\Windows\System\DCavzhP.exe
  2⤵
  PID:7300
- C:\Windows\System\mdwsGjo.exe
  C:\Windows\System\mdwsGjo.exe
  2⤵
  PID:7016
- C:\Windows\System\AFpkcMj.exe
  C:\Windows\System\AFpkcMj.exe
  2⤵
  PID:8116
- C:\Windows\System\QkQmDgd.exe
  C:\Windows\System\QkQmDgd.exe
  2⤵
  PID:8180
- C:\Windows\System\pXBUhxd.exe
  C:\Windows\System\pXBUhxd.exe
  2⤵
  PID:6388
- C:\Windows\System\TANkEKf.exe
  C:\Windows\System\TANkEKf.exe
  2⤵
  PID:7236
- C:\Windows\System\kXkrfCN.exe
  C:\Windows\System\kXkrfCN.exe
  2⤵
  PID:6616
- C:\Windows\System\oZRgYcK.exe
  C:\Windows\System\oZRgYcK.exe
  2⤵
  PID:6800
- C:\Windows\System\gaHjHNR.exe
  C:\Windows\System\gaHjHNR.exe
  2⤵
  PID:6164
- C:\Windows\System\tcszqCv.exe
  C:\Windows\System\tcszqCv.exe
  2⤵
  PID:7356
- C:\Windows\System\BIftLSu.exe
  C:\Windows\System\BIftLSu.exe
  2⤵
  PID:7180
- C:\Windows\System\wGRWRpL.exe
  C:\Windows\System\wGRWRpL.exe
  2⤵
  PID:7428
- C:\Windows\System\ZwoDXFk.exe
  C:\Windows\System\ZwoDXFk.exe
  2⤵
  PID:7696
- C:\Windows\System\BwVgjGU.exe
  C:\Windows\System\BwVgjGU.exe
  2⤵
  PID:7596
- C:\Windows\System\lBwFUnO.exe
  C:\Windows\System\lBwFUnO.exe
  2⤵
  PID:7720
- C:\Windows\System\FucuJwD.exe
  C:\Windows\System\FucuJwD.exe
  2⤵
  PID:6752
- C:\Windows\System\jrSvjni.exe
  C:\Windows\System\jrSvjni.exe
  2⤵
  PID:7804
- C:\Windows\System\tMbVvzf.exe
  C:\Windows\System\tMbVvzf.exe
  2⤵
  PID:6640
- C:\Windows\System\wxkQHrk.exe
  C:\Windows\System\wxkQHrk.exe
  2⤵
  PID:7336
- C:\Windows\System\ubfKrbF.exe
  C:\Windows\System\ubfKrbF.exe
  2⤵
  PID:7484
- C:\Windows\System\aGoJLDE.exe
  C:\Windows\System\aGoJLDE.exe
  2⤵
  PID:7672
- C:\Windows\System\hNzOBOe.exe
  C:\Windows\System\hNzOBOe.exe
  2⤵
  PID:7856
- C:\Windows\System\nnBsIrZ.exe
  C:\Windows\System\nnBsIrZ.exe
  2⤵
  PID:7868
- C:\Windows\System\EKhRHLd.exe
  C:\Windows\System\EKhRHLd.exe
  2⤵
  PID:7900
- C:\Windows\System\LXfaEFc.exe
  C:\Windows\System\LXfaEFc.exe
  2⤵
  PID:7964
- C:\Windows\System\SNtlMLi.exe
  C:\Windows\System\SNtlMLi.exe
  2⤵
  PID:8064
- C:\Windows\System\nVTqfje.exe
  C:\Windows\System\nVTqfje.exe
  2⤵
  PID:7872
- C:\Windows\System\SlQRiPH.exe
  C:\Windows\System\SlQRiPH.exe
  2⤵
  PID:7248
- C:\Windows\System\FmFesTp.exe
  C:\Windows\System\FmFesTp.exe
  2⤵
  PID:7568
- C:\Windows\System\PlMFtGh.exe
  C:\Windows\System\PlMFtGh.exe
  2⤵
  PID:7320
- C:\Windows\System\QrPqWmi.exe
  C:\Windows\System\QrPqWmi.exe
  2⤵
  PID:7048
- C:\Windows\System\rKLfhKk.exe
  C:\Windows\System\rKLfhKk.exe
  2⤵
  PID:7384
- C:\Windows\System\OPBAgLb.exe
  C:\Windows\System\OPBAgLb.exe
  2⤵
  PID:7128
- C:\Windows\System\GqEsBzq.exe
  C:\Windows\System\GqEsBzq.exe
  2⤵
  PID:6580
- C:\Windows\System\LRJIGhA.exe
  C:\Windows\System\LRJIGhA.exe
  2⤵
  PID:8136
- C:\Windows\System\pcOoaMP.exe
  C:\Windows\System\pcOoaMP.exe
  2⤵
  PID:2900
- C:\Windows\System\AZYVENs.exe
  C:\Windows\System\AZYVENs.exe
  2⤵
  PID:6872
- C:\Windows\System\jyxLKuZ.exe
  C:\Windows\System\jyxLKuZ.exe
  2⤵
  PID:6660
- C:\Windows\System\FCquBhr.exe
  C:\Windows\System\FCquBhr.exe
  2⤵
  PID:7592
- C:\Windows\System\DgDQihU.exe
  C:\Windows\System\DgDQihU.exe
  2⤵
  PID:7496
- C:\Windows\System\VyxmOnc.exe
  C:\Windows\System\VyxmOnc.exe
  2⤵
  PID:6552
- C:\Windows\System\CtXCULD.exe
  C:\Windows\System\CtXCULD.exe
  2⤵
  PID:7448
- C:\Windows\System\cFpWqbs.exe
  C:\Windows\System\cFpWqbs.exe
  2⤵
  PID:7760
- C:\Windows\System\XDZUpvQ.exe
  C:\Windows\System\XDZUpvQ.exe
  2⤵
  PID:8044
- C:\Windows\System\rViUSzm.exe
  C:\Windows\System\rViUSzm.exe
  2⤵
  PID:8028
- C:\Windows\System\mEfomGJ.exe
  C:\Windows\System\mEfomGJ.exe
  2⤵
  PID:7232
- C:\Windows\System\jOMzcsO.exe
  C:\Windows\System\jOMzcsO.exe
  2⤵
  PID:7228
- C:\Windows\System\VNFulLn.exe
  C:\Windows\System\VNFulLn.exe
  2⤵
  PID:7176
- C:\Windows\System\fPOSVNF.exe
  C:\Windows\System\fPOSVNF.exe
  2⤵
  PID:8152
- C:\Windows\System\YzURwvv.exe
  C:\Windows\System\YzURwvv.exe
  2⤵
  PID:2896
- C:\Windows\System\TUbeAVR.exe
  C:\Windows\System\TUbeAVR.exe
  2⤵
  PID:7520
- C:\Windows\System\vSZThAs.exe
  C:\Windows\System\vSZThAs.exe
  2⤵
  PID:8048
- C:\Windows\System\ybHrRrh.exe
  C:\Windows\System\ybHrRrh.exe
  2⤵
  PID:8100
- C:\Windows\System\lvPuJWC.exe
  C:\Windows\System\lvPuJWC.exe
  2⤵
  PID:7628
- C:\Windows\System\BdDyLaf.exe
  C:\Windows\System\BdDyLaf.exe
  2⤵
  PID:7820
- C:\Windows\System\NmcYgHn.exe
  C:\Windows\System\NmcYgHn.exe
  2⤵
  PID:7920
- C:\Windows\System\RoPefSH.exe
  C:\Windows\System\RoPefSH.exe
  2⤵
  PID:7412
- C:\Windows\System\eimvgvQ.exe
  C:\Windows\System\eimvgvQ.exe
  2⤵
  PID:7936
- C:\Windows\System\CmcbdCs.exe
  C:\Windows\System\CmcbdCs.exe
  2⤵
  PID:6992
- C:\Windows\System\HqQTzbp.exe
  C:\Windows\System\HqQTzbp.exe
  2⤵
  PID:3564
- C:\Windows\System\yvGpeue.exe
  C:\Windows\System\yvGpeue.exe
  2⤵
  PID:6548
- C:\Windows\System\qCVvpNm.exe
  C:\Windows\System\qCVvpNm.exe
  2⤵
  PID:7404
- C:\Windows\System\uLjvAsD.exe
  C:\Windows\System\uLjvAsD.exe
  2⤵
  PID:8200
- C:\Windows\System\GZHdpbQ.exe
  C:\Windows\System\GZHdpbQ.exe
  2⤵
  PID:8216
- C:\Windows\System\geYvHnm.exe
  C:\Windows\System\geYvHnm.exe
  2⤵
  PID:8244
- C:\Windows\System\UBIaNYi.exe
  C:\Windows\System\UBIaNYi.exe
  2⤵
  PID:8260
- C:\Windows\System\yqjOdXB.exe
  C:\Windows\System\yqjOdXB.exe
  2⤵
  PID:8276
- C:\Windows\System\AIzjZlS.exe
  C:\Windows\System\AIzjZlS.exe
  2⤵
  PID:8292
- C:\Windows\System\NvDtuUy.exe
  C:\Windows\System\NvDtuUy.exe
  2⤵
  PID:8308
- C:\Windows\System\EbDWbHX.exe
  C:\Windows\System\EbDWbHX.exe
  2⤵
  PID:8324
- C:\Windows\System\gumXdkk.exe
  C:\Windows\System\gumXdkk.exe
  2⤵
  PID:8340
- C:\Windows\System\CtnWrnE.exe
  C:\Windows\System\CtnWrnE.exe
  2⤵
  PID:8356
- C:\Windows\System\pcAxfsI.exe
  C:\Windows\System\pcAxfsI.exe
  2⤵
  PID:8372
- C:\Windows\System\tDrNCwB.exe
  C:\Windows\System\tDrNCwB.exe
  2⤵
  PID:8388
- C:\Windows\System\ClskaQB.exe
  C:\Windows\System\ClskaQB.exe
  2⤵
  PID:8404
- C:\Windows\System\qmoBzMF.exe
  C:\Windows\System\qmoBzMF.exe
  2⤵
  PID:8420
- C:\Windows\System\UCqXLMf.exe
  C:\Windows\System\UCqXLMf.exe
  2⤵
  PID:8436
- C:\Windows\System\MPUdgzP.exe
  C:\Windows\System\MPUdgzP.exe
  2⤵
  PID:8452
- C:\Windows\System\bIAronY.exe
  C:\Windows\System\bIAronY.exe
  2⤵
  PID:8468
- C:\Windows\System\vUHmbfH.exe
  C:\Windows\System\vUHmbfH.exe
  2⤵
  PID:8484
- C:\Windows\System\HRJmNIV.exe
  C:\Windows\System\HRJmNIV.exe
  2⤵
  PID:8500
- C:\Windows\System\tyPmOrT.exe
  C:\Windows\System\tyPmOrT.exe
  2⤵
  PID:8516
- C:\Windows\System\wFKEGzt.exe
  C:\Windows\System\wFKEGzt.exe
  2⤵
  PID:8532
- C:\Windows\System\DzBPsAv.exe
  C:\Windows\System\DzBPsAv.exe
  2⤵
  PID:8548
- C:\Windows\System\NRzPpda.exe
  C:\Windows\System\NRzPpda.exe
  2⤵
  PID:8564
- C:\Windows\System\TzMJXMt.exe
  C:\Windows\System\TzMJXMt.exe
  2⤵
  PID:8580
- C:\Windows\System\AHDZBBJ.exe
  C:\Windows\System\AHDZBBJ.exe
  2⤵
  PID:8596
- C:\Windows\System\FeYIsCr.exe
  C:\Windows\System\FeYIsCr.exe
  2⤵
  PID:8612
- C:\Windows\System\dNXguYF.exe
  C:\Windows\System\dNXguYF.exe
  2⤵
  PID:8628
- C:\Windows\System\dQhvaBn.exe
  C:\Windows\System\dQhvaBn.exe
  2⤵
  PID:8644
- C:\Windows\System\JJISaQU.exe
  C:\Windows\System\JJISaQU.exe
  2⤵
  PID:8732
- C:\Windows\System\rAdHKpi.exe
  C:\Windows\System\rAdHKpi.exe
  2⤵
  PID:8752
- C:\Windows\System\QdiAerd.exe
  C:\Windows\System\QdiAerd.exe
  2⤵
  PID:8768
- C:\Windows\System\RxMFaoc.exe
  C:\Windows\System\RxMFaoc.exe
  2⤵
  PID:8784
- C:\Windows\System\vxBIExN.exe
  C:\Windows\System\vxBIExN.exe
  2⤵
  PID:8800
- C:\Windows\System\eWurMzK.exe
  C:\Windows\System\eWurMzK.exe
  2⤵
  PID:8816
- C:\Windows\System\QFQteMc.exe
  C:\Windows\System\QFQteMc.exe
  2⤵
  PID:8832
- C:\Windows\System\StbXTIf.exe
  C:\Windows\System\StbXTIf.exe
  2⤵
  PID:8848
- C:\Windows\System\AAieTXT.exe
  C:\Windows\System\AAieTXT.exe
  2⤵
  PID:8864
- C:\Windows\System\ctEjzKE.exe
  C:\Windows\System\ctEjzKE.exe
  2⤵
  PID:8880
- C:\Windows\System\PuexSWH.exe
  C:\Windows\System\PuexSWH.exe
  2⤵
  PID:8896
- C:\Windows\System\tCDxLTL.exe
  C:\Windows\System\tCDxLTL.exe
  2⤵
  PID:8916
- C:\Windows\System\VgyiRqT.exe
  C:\Windows\System\VgyiRqT.exe
  2⤵
  PID:8932
- C:\Windows\System\BSNDeSD.exe
  C:\Windows\System\BSNDeSD.exe
  2⤵
  PID:8948
- C:\Windows\System\ltqDljg.exe
  C:\Windows\System\ltqDljg.exe
  2⤵
  PID:8964
- C:\Windows\System\tFWXRTB.exe
  C:\Windows\System\tFWXRTB.exe
  2⤵
  PID:8980
- C:\Windows\System\SpobzJa.exe
  C:\Windows\System\SpobzJa.exe
  2⤵
  PID:8996
- C:\Windows\System\OpOwYxI.exe
  C:\Windows\System\OpOwYxI.exe
  2⤵
  PID:9012
- C:\Windows\System\DXymxec.exe
  C:\Windows\System\DXymxec.exe
  2⤵
  PID:9028
- C:\Windows\System\cDRomww.exe
  C:\Windows\System\cDRomww.exe
  2⤵
  PID:9044
- C:\Windows\System\kNDAblM.exe
  C:\Windows\System\kNDAblM.exe
  2⤵
  PID:9124
- C:\Windows\System\QKugqeC.exe
  C:\Windows\System\QKugqeC.exe
  2⤵
  PID:9140
- C:\Windows\System\AbLHAtl.exe
  C:\Windows\System\AbLHAtl.exe
  2⤵
  PID:9176
- C:\Windows\System\pVCMKLj.exe
  C:\Windows\System\pVCMKLj.exe
  2⤵
  PID:8288
- C:\Windows\System\PmBljLw.exe
  C:\Windows\System\PmBljLw.exe
  2⤵
  PID:8352
- C:\Windows\System\WuOewqa.exe
  C:\Windows\System\WuOewqa.exe
  2⤵
  PID:8492
- C:\Windows\System\YkGtEQv.exe
  C:\Windows\System\YkGtEQv.exe
  2⤵
  PID:8556
- C:\Windows\System\EAtSKzz.exe
  C:\Windows\System\EAtSKzz.exe
  2⤵
  PID:7860
- C:\Windows\System\XrasGcR.exe
  C:\Windows\System\XrasGcR.exe
  2⤵
  PID:8300
- C:\Windows\System\BkQctIR.exe
  C:\Windows\System\BkQctIR.exe
  2⤵
  PID:8608
- C:\Windows\System\dKWzZTY.exe
  C:\Windows\System\dKWzZTY.exe
  2⤵
  PID:8636
- C:\Windows\System\EKiBKIS.exe
  C:\Windows\System\EKiBKIS.exe
  2⤵
  PID:8744
- C:\Windows\System\dNYvvnh.exe
  C:\Windows\System\dNYvvnh.exe
  2⤵
  PID:8872
- C:\Windows\System\NGiOlYi.exe
  C:\Windows\System\NGiOlYi.exe
  2⤵
  PID:8792
- C:\Windows\System\GVgJanh.exe
  C:\Windows\System\GVgJanh.exe
  2⤵
  PID:8828
- C:\Windows\System\PzoRKdV.exe
  C:\Windows\System\PzoRKdV.exe
  2⤵
  PID:8904
- C:\Windows\System\zxJEexW.exe
  C:\Windows\System\zxJEexW.exe
  2⤵
  PID:8924
- C:\Windows\System\jtNvyxq.exe
  C:\Windows\System\jtNvyxq.exe
  2⤵
  PID:9004
- C:\Windows\System\eSgxSQo.exe
  C:\Windows\System\eSgxSQo.exe
  2⤵
  PID:8960
- C:\Windows\System\trsTlZN.exe
  C:\Windows\System\trsTlZN.exe
  2⤵
  PID:8988
- C:\Windows\System\bGkgjnG.exe
  C:\Windows\System\bGkgjnG.exe
  2⤵
  PID:9068
- C:\Windows\System\qpkdFon.exe
  C:\Windows\System\qpkdFon.exe
  2⤵
  PID:9056
- C:\Windows\System\rVROFPW.exe
  C:\Windows\System\rVROFPW.exe
  2⤵
  PID:9088
- C:\Windows\System\ONaJhmg.exe
  C:\Windows\System\ONaJhmg.exe
  2⤵
  PID:9104
- C:\Windows\System\FKCwpBy.exe
  C:\Windows\System\FKCwpBy.exe
  2⤵
  PID:9164
- C:\Windows\System\HUadsPc.exe
  C:\Windows\System\HUadsPc.exe
  2⤵
  PID:9188
- C:\Windows\System\EzskWKr.exe
  C:\Windows\System\EzskWKr.exe
  2⤵
  PID:8208
- C:\Windows\System\TliSDms.exe
  C:\Windows\System\TliSDms.exe
  2⤵
  PID:8284
- C:\Windows\System\FJJrKGG.exe
  C:\Windows\System\FJJrKGG.exe
  2⤵
  PID:8380
- C:\Windows\System\RvWuMus.exe
  C:\Windows\System\RvWuMus.exe
  2⤵
  PID:8508
- C:\Windows\System\KPoHsYl.exe
  C:\Windows\System\KPoHsYl.exe
  2⤵
  PID:8572
- C:\Windows\System\tzlQHlv.exe
  C:\Windows\System\tzlQHlv.exe
  2⤵
  PID:7312
- C:\Windows\System\rTemPJG.exe
  C:\Windows\System\rTemPJG.exe
  2⤵
  PID:8268
- C:\Windows\System\TsqGnad.exe
  C:\Windows\System\TsqGnad.exe
  2⤵
  PID:8432
- C:\Windows\System\pXPoSTr.exe
  C:\Windows\System\pXPoSTr.exe
  2⤵
  PID:8524
- C:\Windows\System\sjrLaPV.exe
  C:\Windows\System\sjrLaPV.exe
  2⤵
  PID:8592
- C:\Windows\System\oxxntXp.exe
  C:\Windows\System\oxxntXp.exe
  2⤵
  PID:8640
- C:\Windows\System\VPAKHTh.exe
  C:\Windows\System\VPAKHTh.exe
  2⤵
  PID:8796
- C:\Windows\System\arWRJwV.exe
  C:\Windows\System\arWRJwV.exe
  2⤵
  PID:8912
- C:\Windows\System\zaztdMj.exe
  C:\Windows\System\zaztdMj.exe
  2⤵
  PID:8740
- C:\Windows\System\mnrsmCW.exe
  C:\Windows\System\mnrsmCW.exe
  2⤵
  PID:8888
- C:\Windows\System\wobvGKi.exe
  C:\Windows\System\wobvGKi.exe
  2⤵
  PID:9040
- C:\Windows\System\zLZTsCB.exe
  C:\Windows\System\zLZTsCB.exe
  2⤵
  PID:9060
- C:\Windows\System\OhJVksq.exe
  C:\Windows\System\OhJVksq.exe
  2⤵
  PID:9084
- C:\Windows\System\CjewTZw.exe
  C:\Windows\System\CjewTZw.exe
  2⤵
  PID:9156
- C:\Windows\System\RqwrpVV.exe
  C:\Windows\System\RqwrpVV.exe
  2⤵
  PID:9204
- C:\Windows\System\ivKJSwn.exe
  C:\Windows\System\ivKJSwn.exe
  2⤵
  PID:9136
- C:\Windows\System\YqRmDwi.exe
  C:\Windows\System\YqRmDwi.exe
  2⤵
  PID:8448
- C:\Windows\System\DceLKzY.exe
  C:\Windows\System\DceLKzY.exe
  2⤵
  PID:8228
- C:\Windows\System\oJazPSH.exe
  C:\Windows\System\oJazPSH.exe
  2⤵
  PID:8252
- C:\Windows\System\Wslvngw.exe
  C:\Windows\System\Wslvngw.exe
  2⤵
  PID:8620
- C:\Windows\System\MrJuupN.exe
  C:\Windows\System\MrJuupN.exe
  2⤵
  PID:8196
- C:\Windows\System\JlkwetY.exe
  C:\Windows\System\JlkwetY.exe
  2⤵
  PID:9052
- C:\Windows\System\VuMEXvd.exe
  C:\Windows\System\VuMEXvd.exe
  2⤵
  PID:8396
- C:\Windows\System\RiwehXc.exe
  C:\Windows\System\RiwehXc.exe
  2⤵
  PID:8728
- C:\Windows\System\YHDBqyO.exe
  C:\Windows\System\YHDBqyO.exe
  2⤵
  PID:6152
- C:\Windows\System\LaPhLSY.exe
  C:\Windows\System\LaPhLSY.exe
  2⤵
  PID:9008
- C:\Windows\System\JnYhXAd.exe
  C:\Windows\System\JnYhXAd.exe
  2⤵
  PID:9112
- C:\Windows\System\CkwtQTj.exe
  C:\Windows\System\CkwtQTj.exe
  2⤵
  PID:9116
- C:\Windows\System\nUNoCMy.exe
  C:\Windows\System\nUNoCMy.exe
  2⤵
  PID:9212
- C:\Windows\System\zUbbSAy.exe
  C:\Windows\System\zUbbSAy.exe
  2⤵
  PID:8940
- C:\Windows\System\JQgxbSJ.exe
  C:\Windows\System\JQgxbSJ.exe
  2⤵
  PID:9196
- C:\Windows\System\HfXYMGk.exe
  C:\Windows\System\HfXYMGk.exe
  2⤵
  PID:8604
- C:\Windows\System\fHtVRcb.exe
  C:\Windows\System\fHtVRcb.exe
  2⤵
  PID:8840
- C:\Windows\System\bpFqStu.exe
  C:\Windows\System\bpFqStu.exe
  2⤵
  PID:8464
- C:\Windows\System\amzyQKr.exe
  C:\Windows\System\amzyQKr.exe
  2⤵
  PID:8428
- C:\Windows\System\aLipXgu.exe
  C:\Windows\System\aLipXgu.exe
  2⤵
  PID:9232
- C:\Windows\System\ZeMvNkU.exe
  C:\Windows\System\ZeMvNkU.exe
  2⤵
  PID:9248
- C:\Windows\System\iqYobOV.exe
  C:\Windows\System\iqYobOV.exe
  2⤵
  PID:9264
- C:\Windows\System\LeMAQXE.exe
  C:\Windows\System\LeMAQXE.exe
  2⤵
  PID:9280
- C:\Windows\System\tPpzclj.exe
  C:\Windows\System\tPpzclj.exe
  2⤵
  PID:9296
- C:\Windows\System\IpRndzn.exe
  C:\Windows\System\IpRndzn.exe
  2⤵
  PID:9316
- C:\Windows\System\earsAck.exe
  C:\Windows\System\earsAck.exe
  2⤵
  PID:9336
- C:\Windows\System\RozHHfC.exe
  C:\Windows\System\RozHHfC.exe
  2⤵
  PID:9352
- C:\Windows\System\XAAFLFI.exe
  C:\Windows\System\XAAFLFI.exe
  2⤵
  PID:9372
- C:\Windows\System\xhmrQJT.exe
  C:\Windows\System\xhmrQJT.exe
  2⤵
  PID:9388
- C:\Windows\System\UrPUOlw.exe
  C:\Windows\System\UrPUOlw.exe
  2⤵
  PID:9404
- C:\Windows\System\PIPvZgD.exe
  C:\Windows\System\PIPvZgD.exe
  2⤵
  PID:9424
- C:\Windows\System\CGfVYAO.exe
  C:\Windows\System\CGfVYAO.exe
  2⤵
  PID:9452
- C:\Windows\System\QEMdiiP.exe
  C:\Windows\System\QEMdiiP.exe
  2⤵
  PID:9476
- C:\Windows\System\mkRSDAh.exe
  C:\Windows\System\mkRSDAh.exe
  2⤵
  PID:9500
- C:\Windows\System\jXWxAIW.exe
  C:\Windows\System\jXWxAIW.exe
  2⤵
  PID:9520
- C:\Windows\System\hWzYYfD.exe
  C:\Windows\System\hWzYYfD.exe
  2⤵
  PID:9556
- C:\Windows\System\VAIQOfn.exe
  C:\Windows\System\VAIQOfn.exe
  2⤵
  PID:9572
- C:\Windows\System\XsiyLUI.exe
  C:\Windows\System\XsiyLUI.exe
  2⤵
  PID:9596
- C:\Windows\System\RjrphmN.exe
  C:\Windows\System\RjrphmN.exe
  2⤵
  PID:9628
- C:\Windows\System\ByPeJeE.exe
  C:\Windows\System\ByPeJeE.exe
  2⤵
  PID:9648
- C:\Windows\System\VRIimlJ.exe
  C:\Windows\System\VRIimlJ.exe
  2⤵
  PID:9664
- C:\Windows\System\bvFnZch.exe
  C:\Windows\System\bvFnZch.exe
  2⤵
  PID:9692
- C:\Windows\System\HOgrRnW.exe
  C:\Windows\System\HOgrRnW.exe
  2⤵
  PID:9716
- C:\Windows\System\IzqhUuL.exe
  C:\Windows\System\IzqhUuL.exe
  2⤵
  PID:9744
- C:\Windows\System\ZZNaVGu.exe
  C:\Windows\System\ZZNaVGu.exe
  2⤵
  PID:9776
- C:\Windows\System\kjKRzNq.exe
  C:\Windows\System\kjKRzNq.exe
  2⤵
  PID:9804
- C:\Windows\System\hUpsduT.exe
  C:\Windows\System\hUpsduT.exe
  2⤵
  PID:9820
- C:\Windows\System\TyeiuQk.exe
  C:\Windows\System\TyeiuQk.exe
  2⤵
  PID:9836
- C:\Windows\System\XrQEKXK.exe
  C:\Windows\System\XrQEKXK.exe
  2⤵
  PID:9860
- C:\Windows\System\QfvnFdM.exe
  C:\Windows\System\QfvnFdM.exe
  2⤵
  PID:9884
- C:\Windows\System\TzZuDyR.exe
  C:\Windows\System\TzZuDyR.exe
  2⤵
  PID:9900
- C:\Windows\System\rKDWaBy.exe
  C:\Windows\System\rKDWaBy.exe
  2⤵
  PID:9916
- C:\Windows\System\RDvwoQC.exe
  C:\Windows\System\RDvwoQC.exe
  2⤵
  PID:9932
- C:\Windows\System\jPbuuQv.exe
  C:\Windows\System\jPbuuQv.exe
  2⤵
  PID:9960
- C:\Windows\System\YbCSaxo.exe
  C:\Windows\System\YbCSaxo.exe
  2⤵
  PID:9980
- C:\Windows\System\LMdSOka.exe
  C:\Windows\System\LMdSOka.exe
  2⤵
  PID:10000
- C:\Windows\System\QVgPebq.exe
  C:\Windows\System\QVgPebq.exe
  2⤵
  PID:10016
- C:\Windows\System\BQZEByX.exe
  C:\Windows\System\BQZEByX.exe
  2⤵
  PID:10036
- C:\Windows\System\niryZnY.exe
  C:\Windows\System\niryZnY.exe
  2⤵
  PID:10056
- C:\Windows\System\vhqchWZ.exe
  C:\Windows\System\vhqchWZ.exe
  2⤵
  PID:10072
- C:\Windows\System\fVxOjbD.exe
  C:\Windows\System\fVxOjbD.exe
  2⤵
  PID:10096
- C:\Windows\System\XgTbUUO.exe
  C:\Windows\System\XgTbUUO.exe
  2⤵
  PID:10112
- C:\Windows\System\AuupPoU.exe
  C:\Windows\System\AuupPoU.exe
  2⤵
  PID:10132
- C:\Windows\System\mbKXuez.exe
  C:\Windows\System\mbKXuez.exe
  2⤵
  PID:10152
- C:\Windows\System\MfxEirQ.exe
  C:\Windows\System\MfxEirQ.exe
  2⤵
  PID:10168
- C:\Windows\System\UvttSXj.exe
  C:\Windows\System\UvttSXj.exe
  2⤵
  PID:10188
- C:\Windows\System\qbVWUYi.exe
  C:\Windows\System\qbVWUYi.exe
  2⤵
  PID:10204
- C:\Windows\System\irFELDN.exe
  C:\Windows\System\irFELDN.exe
  2⤵
  PID:10224
- C:\Windows\System\yrzcZoq.exe
  C:\Windows\System\yrzcZoq.exe
  2⤵
  PID:8720
- C:\Windows\System\wsuqOoY.exe
  C:\Windows\System\wsuqOoY.exe
  2⤵
  PID:8576
- C:\Windows\System\uLaXDmC.exe
  C:\Windows\System\uLaXDmC.exe
  2⤵
  PID:9132
- C:\Windows\System\DEuapZb.exe
  C:\Windows\System\DEuapZb.exe
  2⤵
  PID:9328
- C:\Windows\System\QFOzxDs.exe
  C:\Windows\System\QFOzxDs.exe
  2⤵
  PID:9396
- C:\Windows\System\Vpbkoox.exe
  C:\Windows\System\Vpbkoox.exe
  2⤵
  PID:9484
- C:\Windows\System\EaOvuXI.exe
  C:\Windows\System\EaOvuXI.exe
  2⤵
  PID:9544
- C:\Windows\System\wIdEVIu.exe
  C:\Windows\System\wIdEVIu.exe
  2⤵
  PID:9584
- C:\Windows\System\YNUAZeF.exe
  C:\Windows\System\YNUAZeF.exe
  2⤵
  PID:9344
- C:\Windows\System\fKrsuHd.exe
  C:\Windows\System\fKrsuHd.exe
  2⤵
  PID:8240
- C:\Windows\System\yIhgNOC.exe
  C:\Windows\System\yIhgNOC.exe
  2⤵
  PID:8368
- C:\Windows\System\tNflhzr.exe
  C:\Windows\System\tNflhzr.exe
  2⤵
  PID:8972
- C:\Windows\System\cPPsHGb.exe
  C:\Windows\System\cPPsHGb.exe
  2⤵
  PID:9276
- C:\Windows\System\WhUdjvQ.exe
  C:\Windows\System\WhUdjvQ.exe
  2⤵
  PID:9412
- C:\Windows\System\LwwTPGj.exe
  C:\Windows\System\LwwTPGj.exe
  2⤵
  PID:9468
- C:\Windows\System\xQjoIFK.exe
  C:\Windows\System\xQjoIFK.exe
  2⤵
  PID:9636
- C:\Windows\System\RZbOdFL.exe
  C:\Windows\System\RZbOdFL.exe
  2⤵
  PID:9644
- C:\Windows\System\BCGvwVs.exe
  C:\Windows\System\BCGvwVs.exe
  2⤵
  PID:9672
- C:\Windows\System\AvpPiOv.exe
  C:\Windows\System\AvpPiOv.exe
  2⤵
  PID:9700
- C:\Windows\System\dNsgGjW.exe
  C:\Windows\System\dNsgGjW.exe
  2⤵
  PID:9736
- C:\Windows\System\hPfqPxI.exe
  C:\Windows\System\hPfqPxI.exe
  2⤵
  PID:9756
- C:\Windows\System\dJutdYn.exe
  C:\Windows\System\dJutdYn.exe
  2⤵
  PID:9772
- C:\Windows\System\jWjRTmt.exe
  C:\Windows\System\jWjRTmt.exe
  2⤵
  PID:9788
- C:\Windows\System\NLzxDzk.exe
  C:\Windows\System\NLzxDzk.exe
  2⤵
  PID:9844
- C:\Windows\System\BaigEnZ.exe
  C:\Windows\System\BaigEnZ.exe
  2⤵
  PID:9868
- C:\Windows\System\SXecSIJ.exe
  C:\Windows\System\SXecSIJ.exe
  2⤵
  PID:9940
- C:\Windows\System\vJFidOg.exe
  C:\Windows\System\vJFidOg.exe
  2⤵
  PID:9924
- C:\Windows\System\MVNcDKZ.exe
  C:\Windows\System\MVNcDKZ.exe
  2⤵
  PID:9992
- C:\Windows\System\vpjTJni.exe
  C:\Windows\System\vpjTJni.exe
  2⤵
  PID:9968
- C:\Windows\System\SELOXyR.exe
  C:\Windows\System\SELOXyR.exe
  2⤵
  PID:10140
- C:\Windows\System\GUbaYbr.exe
  C:\Windows\System\GUbaYbr.exe
  2⤵
  PID:10008
- C:\Windows\System\FwvtGZa.exe
  C:\Windows\System\FwvtGZa.exe
  2⤵
  PID:9324
- C:\Windows\System\cgRAsmj.exe
  C:\Windows\System\cgRAsmj.exe
  2⤵
  PID:10120
- C:\Windows\System\GZjcfxM.exe
  C:\Windows\System\GZjcfxM.exe
  2⤵
  PID:9364
- C:\Windows\System\YhxKsXa.exe
  C:\Windows\System\YhxKsXa.exe
  2⤵
  PID:8336
- C:\Windows\System\WlletOs.exe
  C:\Windows\System\WlletOs.exe
  2⤵
  PID:10012
- C:\Windows\System\KQzcKeZ.exe
  C:\Windows\System\KQzcKeZ.exe
  2⤵
  PID:10048
- C:\Windows\System\qshgIaU.exe
  C:\Windows\System\qshgIaU.exe
  2⤵
  PID:10128
- C:\Windows\System\eiXEAUS.exe
  C:\Windows\System\eiXEAUS.exe
  2⤵
  PID:9540
- C:\Windows\System\MXCfhpG.exe
  C:\Windows\System\MXCfhpG.exe
  2⤵
  PID:9448
- C:\Windows\System\ykoGkNe.exe
  C:\Windows\System\ykoGkNe.exe
  2⤵
  PID:8320

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\BhysUxA.exe

Filesize
2.7MB

MD5
e526fcb6571da2da7694f9cc3c102a4a

SHA1
a9d94637161deaed08b8c91f9315c66a81f586f2

SHA256
9eb4d3e546358fde8d73ad084363e05c8376a2b9e81833eab4aaead5ddb21f5f

SHA512
6091f5b0cb35bb4b89306579189af78edc07552270ebf04241cdeed71971c7815e5f629d8a7549e20aace0a13b03de42074b924f6c2a80d9b4b6d453d1122afe

Download Submit
C:\Windows\system\BozYnme.exe

Filesize
2.7MB

MD5
1cf474b92294973d2a3fe4d6c4589b6a

SHA1
fafa6f1cbaede7650ffd6698bad8954480434b20

SHA256
f5a1f81664e9d2335653695bdf2dc0a5668656472d097b0fa2380ef679c3b100

SHA512
51e972416aa8afa8b718a79fc6caa5ffdd4c9bca9c410a50d8331e8ee6941ce01abf39c348d8bb76a5eab8c36f9237dbc557dc158ced296b162e3c681922e8d3

Download Submit
C:\Windows\system\JnEyMSF.exe

Filesize
2.7MB

MD5
a8cc83343df66be26bb12108b222af79

SHA1
15e2fbfc17ea6274771284994e512b52b3baedce

SHA256
b09e2b06d318a968c925417aa9226e3f2a4e9dfa110c7874c0d65140511cde54

SHA512
827415e1e01f38660ac7980872065687745a02c7b9cf47c9c1ba2b69388ab4bb8dcd490c85afd2711cede9b5938bfeeadc507af64c27cf0b1b42934363a63495

Download Submit
C:\Windows\system\KAIjPZD.exe

Filesize
2.7MB

MD5
16778f1f022cc7bcf4038e923c3f6e40

SHA1
8079e0d47a8db5ccec7692f9a55a5e31152ccee2

SHA256
eb78df423dc5a16fba60164ade2f852c59eea87d22951adfc69efb0821fc3492

SHA512
9dba7e80fdb770de6fb5690940e30b902329d5e00f3c398d1a55ae30e9e697ef76d10d011d6a15613b2240ac83e67d70107c08b3625d8d4907038f5c3d13622e

Download Submit
C:\Windows\system\KPxiLCr.exe

Filesize
2.7MB

MD5
a8c1662b3cb0650b371c420cd1769e81

SHA1
c8a65f34a69912a525603a6b3f1a42e910cf0ebe

SHA256
027f578f6ca83e1651f97da3f6a7b25d5dd12b45261fac3081f9c3a95a42c7d0

SHA512
a17de49feec674eaf6d964426366cf0e38d5acb8054c8fe4fe9e50eb9d87d420811a12fce507fa3139e08bf3256b7581b94de9c5a247fedcdd8f984b48dd16d5

Download Submit
C:\Windows\system\NbrUbAS.exe

Filesize
2.7MB

MD5
190bd1f4c84883c3305c59dbe4bad5af

SHA1
a6643ac8a330823d35b7ad3ebe5abc6cc6541bb2

SHA256
663de0524bd94c48ed9204e814dc88a20252e447b93eb6edbc355fe09fc7f811

SHA512
77a0d72b9b5172e1e4520960ba18ba2c6092b1bbe172ba812ad0d42c067118815d960fd8e249360373b43e7af4e2349de398c32ac3d963ecf7425a317b30bc18

Download Submit
C:\Windows\system\NlCWvsB.exe

Filesize
2.7MB

MD5
5f1781ba83f862b333e2ad9eea62d278

SHA1
d8d3d71cd242a4025912a37d11e5222f836bc901

SHA256
2057e8f96c6ee17a0d78c2e0b28b2cae0745d1bf45e5e56774d2e763371c1da1

SHA512
f05f56c58cb66db4f9d219b167d6c24dc3c25de3c7657a6ffda1164d46b5b2248c047b05612827dd42789602e88d0920b3e070025edf95bff6352d676ffe4989

Download Submit
C:\Windows\system\PUsgwmE.exe

Filesize
2.7MB

MD5
ce6dc03eec89015904b7bc3979e10420

SHA1
e837432d3d6459606dc49b7849ac427756394ec9

SHA256
fbaebe10c2bf6c5fa419cd60ac0b5545d29a2abaefb97f3827b9398e1e6f6c86

SHA512
8b2d387824aecdcd7960b942cff631eb99a73f8a0ced8dcc49b1cea6ab690ea747f0aaa30cd96d0b96316fc6e55cf46d8f3729e4e0d9c6a4a48f2d1225ce3972

Download Submit
C:\Windows\system\QzyJBbD.exe

Filesize
2.7MB

MD5
a9f2f48b4c37f4d019dde911891d908d

SHA1
376c704d355fdf3eb729c552c092eee4d40aff76

SHA256
0c7a57358fa47e872753ba6d24ccab897445b6d32dd3750f20ac888e15faa4ee

SHA512
31f049713746b4cb0c13625cac0f6c8351f70cf71f91651e0b091246531b77f68dff13ba6c4514660d86e0e84e230fc6def820b8b09b40532c48c08988042f31

Download Submit
C:\Windows\system\RArlMnm.exe

Filesize
2.7MB

MD5
661f86c7e63a57539f07619156da2f80

SHA1
8f04ef1c258881fb84173d29f3d77662a4c6c1ff

SHA256
8b63c5d1ff02eb85aa3a3af470de5748b90d105738dcfaa8f54a10a45ea72870

SHA512
0e12dcdea0663c4a1715bbafd460a178e080baa9e736bf1e5d34591d58a8d3fd20b3d15851ebd2a65e150b977e095b0b9e327e4bd6b66b1535e277116bff1113

Download Submit
C:\Windows\system\RKOzOyw.exe

Filesize
2.7MB

MD5
6a68e4dabbd6c9966b1444d4b1eff139

SHA1
51649217f2752100392280328fed73b42bb86310

SHA256
b77da7ef8c7816b41aa45a6d682633fdaf04247fc943563d90f7cece4b4cfc73

SHA512
00b30a3c379a19bd9aa1da35918809dd8edce3fc59dfb0362f50897d895015208e16428291d4225207cb7a2c54ff46ed4f26bf120dcc77db819e22bf2e394297

Download Submit
C:\Windows\system\RlRMlLp.exe

Filesize
2.7MB

MD5
adfe52e2021d90e14849a94589dcec98

SHA1
f8e6db6780ed5ec076402bfb0190c8cedab09867

SHA256
074575a4d3cd85cd8df18d93f93353801cabaf565bff3c653e14bde82bb5a8ca

SHA512
ad5d72a70129ba783038708fd7ce42d357b5ceee81ad63245f75c8a393620498c5dc67282530ffba9700dd48201fac031a86b3f0a65c83719fccb2efd6287701

Download Submit
C:\Windows\system\SWKHGks.exe

Filesize
2.7MB

MD5
72c4aecbc871dde9643155be4aa96e72

SHA1
b7a1ae4e819b5e4083628749507529344bf8384c

SHA256
01097ae9959c3f8ab83e7af2057b76e75cbcbd2d36e389a93d19897783ad5397

SHA512
cd1272818bf7ce47d4f8245c2a6722a80dda2b53f70e6b4927b873fb2ea46b2d6d9240d0158df3921b52f8b1165545c54aef4818d8adfdf1ccba73954c6c0fc2

Download Submit
C:\Windows\system\TTIbxls.exe

Filesize
2.7MB

MD5
0c3c8f11e60e0eb69eba7f335161d8cd

SHA1
07a2089b66f239c68a61da88ce81f1520443da16

SHA256
1c4abbacfe4f42d36153faf6ab65437f8efa50acf773d1489e5fa2f3e8804644

SHA512
75dd2e5fd6691a5b1b939cd9d94f44aba50d16108b0fdb1f4586bebc156616a2374cf9d6d355249ea214941e9ff74850c204ac4592cd6cc9acacd1b51cfc94ca

Download Submit
C:\Windows\system\TtcvwfM.exe

Filesize
2.7MB

MD5
8d117f45f261062657f442b68ef71d9a

SHA1
225ef2fb931a4c9b02ba5e41be38a3171b9885a2

SHA256
52e5351ad2d5eb58b2227811f7bf39bb80039c2ee81fcc0acbb819c18b22be16

SHA512
bf9553d2231d5dd7df40b428d478a3f62e3ac42081b0f8a95b9ccb9e27c395e7ea6abd7bbbd62a2c3c3ac36ea04fda57cfeef54935408b2478b5f3978f4e93e6

Download Submit
C:\Windows\system\WCKpRXU.exe

Filesize
2.7MB

MD5
d06a24e05f5014804e110d79cbff6b02

SHA1
c848aa156f9342fba23423e70c09a8f0c791cf59

SHA256
53e1b30a22c756c34d5762fcc9b209926fcdd6f0e06384de785b3e422fe49ea7

SHA512
b57a4b3ff6cb0b5f69d3f130568bc2c288c0b48312b09721c342a49a69c2d9cb4da50cdc8bb032a7bd0f60343d12b6bb6f12871e551b9dc952d9802c15111bbb

Download Submit
C:\Windows\system\YgfslEk.exe

Filesize
2.7MB

MD5
4fae06c8e7b22db2a42ed9033d260357

SHA1
77b43eff6f1e1785ec74e522fdac7e036df44713

SHA256
3007477ca79100c0845b33a2f0ec15e6d7212768e6a71858439e0fbdf19ff0f7

SHA512
9ab52513490186b014ecf5ee2cddb48903a57f442733584a23baa4c1541002bb8e3769ae041c23831e8d9f9b8703d0132fba907259db32e3a7b1bfeb239c1890

Download Submit
C:\Windows\system\ZUQpCOY.exe

Filesize
2.7MB

MD5
8fa015020ab7e9e6ca005ab4b52f3472

SHA1
7919953eef40ad3b2e7adc5272038133b7f3ed3b

SHA256
8c2cc396dd2a34a6cd0d345a1812c30ed18b712c54642a7eb2b4aa47bf305ddb

SHA512
14b03d427d8d64a389476e1f97cf2d944fd0c7ee9f33eeb0122fe72169c0a2809d2495e37e35c2ab31389f8ca51d8532a024a97ca327c0c88cbd33a243a7ccd4

Download Submit
C:\Windows\system\ZdudMFR.exe

Filesize
2.7MB

MD5
2f373c288b8eb44bbbbb5d473eb94161

SHA1
4de40591c7e30058d663507beddcdb8dde49e399

SHA256
7d7f336b7188ae026a7fb2f4d92381e6ee58d3022b49a5927b6d54ac08f81584

SHA512
ecf6ceaeeed7db812d36829f0d26fef805e5935412a8a224d237d6b553b4d2656a24522e6bccd47d3172cfefe94178672f27d49118788732b2ab000e03de07e6

Download Submit
C:\Windows\system\ZjrlYzY.exe

Filesize
2.7MB

MD5
db909d63c431fd404d5633bfdce0e5f8

SHA1
b72008bdc1bee6ddd3f48bdbee6772cb2a22128b

SHA256
9cbef6f1a999d120278c189676c82cfc735869a2636e7313589824ba5e1c2739

SHA512
7862566babe40bbb81785d7ef5c56c9b9d441779f6fd76deae7b5520b642ceda034b8a00c284ed5d7ff0c1b97e9d071b6c8058a4b550dbe8abc846acd3f59e7d

Download Submit
C:\Windows\system\emrgqfF.exe

Filesize
2.7MB

MD5
22193a3024386b7770b8794a72bc00fb

SHA1
8d7a9cad38b7c28fdfacc19a3d9b4aa82aa0eb34

SHA256
b843d04cb801459381a29854facfd2c692a414f1095ecfbf58e15ae7e9662a4a

SHA512
d7f075e4b887a4f019c539a5ccf6ccdb9a86c95f8c037f59ac5239a603da47006c0bfd4b8a76f0b0d9181de39d1b4f8fe77c0d7fcba7fcc37fe6d5d7a4e699ca

Download Submit
C:\Windows\system\fhZeQMe.exe

Filesize
2.7MB

MD5
d189c137b75de0dfd00255173dbdb8c6

SHA1
c466c36bf9fcc27ce726b0d339f144ed0f9761ca

SHA256
0f288b79f74e9c78527a633db2b5afca539d592940878ea1d1f2ff799a69b6d6

SHA512
bafc94844c046212c2dc53318c9247adfbd71d93af8dd4b1571089084b52decc07c1eb2cc52de7bf5804a8c9e57b80982cec96349cc3f6625c7161f7a07120f5

Download Submit
C:\Windows\system\iSmLflD.exe

Filesize
2.7MB

MD5
0313aa84d947b13ed6657cbc1e25b6d7

SHA1
e36184257155217de4ef2074e836c3b08e0f6e93

SHA256
4ae32837d83a0a626f86c2b1a62e88617a35928ab997aff65f7ec398ffe363fa

SHA512
48038928ad2eabd7a563442a665f3bfee5dd2cd2129959c359c7f03cfb781081ea67fc629d1f0fda8549b6f8a48e69b33461416421309649c768baa5aca545fb

Download Submit
C:\Windows\system\kQyJOVf.exe

Filesize
2.7MB

MD5
8a41a219da8524d57848cb98074636ec

SHA1
23d045b61db4e574ea7cfb694c7cd0a8dd418e52

SHA256
b8ee62ac0b3b0db0f2a3eb4ddeb9eaa62a5d40c076221cbe667731314514ba98

SHA512
cbd4784d316cc3bfc222a0ed990aa14707fba4b3fe36c7287b31fb77838e47479d6d50445fcecf4624cb62be2c86d0775ae78ad3a3d9ae8c1202dc35afccb205

Download Submit
C:\Windows\system\kZpyUQG.exe

Filesize
2.7MB

MD5
b7b421c0f6c6b7560d6b8e16e595a4aa

SHA1
1c366464d81246cefe86a75fd499025961b17581

SHA256
2af3d06a2b373ccad0a45f629b214b80832a94791f7ba4e7be77cda3c691d55c

SHA512
4ada971ed9ace13abf44bbed2efbe12991bc24e097433efb2ad95eecba7fe8913d9ca8f4a7ff5a8d37c0743bc32b17538eb3a20bf387ae784e0a388e41e2a545

Download Submit
C:\Windows\system\muMnkik.exe

Filesize
2.7MB

MD5
526ee72b7467b4db87ba1f8d80b9aef4

SHA1
06f9ae78a3b7dbefe1a245660ebe40ec1c38d476

SHA256
afdb3e058f81a514879d60331f458d40bbd7b48585bf2d845959eec9e8d64dac

SHA512
fa41882a95c14067ecb1d39b2d70672bdd719e80dbc5d034690c64ba6f4bf1ccd80caa747c555e6518d762f07f13d13be514d7b355e0a417fd8908cde3aff692

Download Submit
C:\Windows\system\nDYzwzU.exe

Filesize
2.7MB

MD5
10774d01f17ba92518ea93ee91586022

SHA1
7375124380a31c116dd24cfdaaa5e13911fb77c4

SHA256
9688229ff349285dea161915d5bbb91b440e6ce3c3e48631c55a39559035544d

SHA512
c30e1a22c8e88ff6b33a293cf2343f1f7c430b95b62c05b4269649d7a950d77f8b435ffabb0020760c40c491de0bcacf948e4c039d52fef34ac82b31c3fd04c7

Download Submit
C:\Windows\system\uTjplhl.exe

Filesize
2.7MB

MD5
b4b99d360c0c72809638a8897ed333f5

SHA1
a86d456baa6e3c5e5bec038475ff405535144e1a

SHA256
8a7fcd3f326428e01a1be17ad60b2bb650a93c394724e44bae98397b03a6fe19

SHA512
4d4943b261869abce28f0ddf66b7384ee76e9dcc3811be4eafb8191c9f4872ccac9378a4975acb0fde607ef652a6cc8b7711cdb44452979846bea7cbb5b01396

Download Submit
C:\Windows\system\xEudFmA.exe

Filesize
2.7MB

MD5
18866c889834eebe2499964ad74baf1c

SHA1
a705b120637ce4c99bd6fd0573990a1773023022

SHA256
6b25dd79259141d072afc5f98f340b5100c5baa98f783654ccd7ac3d7db19547

SHA512
f634d758abc2294544f4e05b81a75241d594195bbc5ffd736f270d74e411b12f6025a9a03b6050726abe48c44f268ac058e5f3466e2e1e9b008cb041798de5c4

Download Submit
C:\Windows\system\xZgCaOc.exe

Filesize
2.7MB

MD5
94c7dc2c9cf4cabf605c809e93a02d88

SHA1
5e101e986ea12cd1a909618680f87ee294bb93a2

SHA256
e4ff01559abe1e4aa8359f97d25e0d24209220b3f8e0d2235d79d3d473681caa

SHA512
6b4be6add2401600029b7bd22e2820aa0906415bdabb4d2f44387d41dc3f25f4ef5d7b3b780465cb6f2e5dfc8e9ca27fe56a79fb2c4c01c4f3ecef27fdb0899b

Download Submit
\Windows\system\GKVftSz.exe

Filesize
2.7MB

MD5
851794c9784160f954bd314e7d64e477

SHA1
3922ccbc48e578bc391cec718417ae419c008e98

SHA256
19ce024ce0e93a4a6b2b5af71751f5c9822880ffa31896880f7cef5b2e12c441

SHA512
849b5840d79b18aa675737fcd0ae2803af675a28b02f5de2fb9e3874f2a0f16120ea89eedaccc9f02fd3645b6c3f172f4691ae313aca8e2eb19deb9f5c8e5c63

Download Submit
\Windows\system\ghRFOby.exe

Filesize
2.7MB

MD5
0592fb72761462b305b929c65ee3be20

SHA1
4da1dbf51470e2bf8a783deafb34343093a3cb18

SHA256
7903a06f122b72bcf6c5c0b21a0212de762fdee4b27e3c97b617b22c6d86a9b5

SHA512
da73d241d663d8330934e52c6836dd3c3f1a57a19ff71e23eed0fc3b31edd7ff4b6577119bea60fcf7ad3282bbf6a2ad0bfc7783449b59d43d1b01fdbdc65aaf

Download Submit
memory/1296-138-0x000000013FC70000-0x0000000140066000-memory.dmp

Filesize
4.0MB

Download
memory/1876-6602-0x000000013F990000-0x000000013FD86000-memory.dmp

Filesize
4.0MB

Download
memory/1876-170-0x000000013F990000-0x000000013FD86000-memory.dmp

Filesize
4.0MB

Download
memory/2176-2604-0x000000013FBA0000-0x000000013FF96000-memory.dmp

Filesize
4.0MB

Download
memory/2176-8-0x000000013FBA0000-0x000000013FF96000-memory.dmp

Filesize
4.0MB

Download
memory/2184-128-0x0000000002070000-0x0000000002078000-memory.dmp

Filesize
32KB

Download
memory/2184-130-0x000007FEF57B0000-0x000007FEF614D000-memory.dmp

Filesize
9.6MB

Download
memory/2184-26-0x000007FEF5A6E000-0x000007FEF5A6F000-memory.dmp

Filesize
4KB

Download
memory/2184-431-0x000007FEF57B0000-0x000007FEF614D000-memory.dmp

Filesize
9.6MB

Download
memory/2184-144-0x000007FEF57B0000-0x000007FEF614D000-memory.dmp

Filesize
9.6MB

Download
memory/2184-148-0x000007FEF57B0000-0x000007FEF614D000-memory.dmp

Filesize
9.6MB

Download
memory/2184-122-0x000000001B760000-0x000000001BA42000-memory.dmp

Filesize
2.9MB

Download
memory/2348-136-0x000000013FC70000-0x0000000140066000-memory.dmp

Filesize
4.0MB

Download
memory/2348-3633-0x000000013FC70000-0x0000000140066000-memory.dmp

Filesize
4.0MB

Download
memory/2348-171-0x0000000003870000-0x0000000003C66000-memory.dmp

Filesize
4.0MB

Download
memory/2348-1-0x000000013F600000-0x000000013F9F6000-memory.dmp

Filesize
4.0MB

Download
memory/2348-3661-0x0000000003870000-0x0000000003C66000-memory.dmp

Filesize
4.0MB

Download
memory/2348-162-0x000000013FD00000-0x00000001400F6000-memory.dmp

Filesize
4.0MB

Download
memory/2348-151-0x000000013F0A0000-0x000000013F496000-memory.dmp

Filesize
4.0MB

Download
memory/2348-3637-0x00000000032B0000-0x00000000036A6000-memory.dmp

Filesize
4.0MB

Download
memory/2348-2440-0x000000013F600000-0x000000013F9F6000-memory.dmp

Filesize
4.0MB

Download
memory/2348-169-0x0000000003870000-0x0000000003C66000-memory.dmp

Filesize
4.0MB

Download
memory/2348-164-0x00000000032B0000-0x00000000036A6000-memory.dmp

Filesize
4.0MB

Download
memory/2348-2605-0x000000013FBA0000-0x000000013FF96000-memory.dmp

Filesize
4.0MB

Download
memory/2348-166-0x00000000032B0000-0x00000000036A6000-memory.dmp

Filesize
4.0MB

Download
memory/2348-0-0x00000000000F0000-0x0000000000100000-memory.dmp

Filesize
64KB

Download
memory/2348-177-0x000000013FAD0000-0x000000013FEC6000-memory.dmp

Filesize
4.0MB

Download
memory/2348-13-0x000000013FA10000-0x000000013FE06000-memory.dmp

Filesize
4.0MB

Download
memory/2348-12-0x000000013FBA0000-0x000000013FF96000-memory.dmp

Filesize
4.0MB

Download
memory/2348-157-0x000000013FB30000-0x000000013FF26000-memory.dmp

Filesize
4.0MB

Download
memory/2348-154-0x000000013FB40000-0x000000013FF36000-memory.dmp

Filesize
4.0MB

Download
memory/2372-156-0x000000013FB40000-0x000000013FF36000-memory.dmp

Filesize
4.0MB

Download
memory/2468-163-0x000000013FD00000-0x00000001400F6000-memory.dmp

Filesize
4.0MB

Download
memory/2468-6587-0x000000013FD00000-0x00000001400F6000-memory.dmp

Filesize
4.0MB

Download
memory/2492-153-0x000000013F0A0000-0x000000013F496000-memory.dmp

Filesize
4.0MB

Download
memory/2500-168-0x000000013F770000-0x000000013FB66000-memory.dmp

Filesize
4.0MB

Download
memory/2532-165-0x000000013F5D0000-0x000000013F9C6000-memory.dmp

Filesize
4.0MB

Download
memory/2532-6600-0x000000013F5D0000-0x000000013F9C6000-memory.dmp

Filesize
4.0MB

Download
memory/2640-175-0x000000013F8C0000-0x000000013FCB6000-memory.dmp

Filesize
4.0MB

Download
memory/2640-6601-0x000000013F8C0000-0x000000013FCB6000-memory.dmp

Filesize
4.0MB

Download
memory/2688-150-0x000000013FAD0000-0x000000013FEC6000-memory.dmp

Filesize
4.0MB

Download
memory/2688-6566-0x000000013FAD0000-0x000000013FEC6000-memory.dmp

Filesize
4.0MB

Download
memory/2712-161-0x000000013FB30000-0x000000013FF26000-memory.dmp

Filesize
4.0MB

Download
memory/3012-3274-0x000000013FA10000-0x000000013FE06000-memory.dmp

Filesize
4.0MB

Download
memory/3012-16-0x000000013FA10000-0x000000013FE06000-memory.dmp

Filesize
4.0MB

Download