xmrig | 81e9e90460c6feda66f8b9b6ecc7c51b3d31a2f82a72d7fcc851fcc7016c7fc1

Analysis

max time kernel
150s
max time network
144s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
12-05-2024 00:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

51eec792cdcd8a6ab24a797052ecc1d0_NeikiAnalytics.exe
Size

2.6MB
MD5

51eec792cdcd8a6ab24a797052ecc1d0
SHA1

c7baca0cb7f5cebefbf6d8874e06ca3b4e8ec788
SHA256

81e9e90460c6feda66f8b9b6ecc7c51b3d31a2f82a72d7fcc851fcc7016c7fc1
SHA512

d976e6f0cc84de5e7ef9e4a29edb4d4490f4886a801a750d130f73981c20c792e60a80d3a9cf16dc615a6297deebb61cb70b383a95511e39c6a745f096d926ef
SSDEEP

49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0I6Gz3N1pF:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2RB

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 51 IoCs

miner

resource	yara_rule
behavioral1/memory/2188-1-0x000000013F3C0000-0x000000013F7B6000-memory.dmp	xmrig
behavioral1/files/0x000c00000001313a-3.dat	xmrig
behavioral1/files/0x0034000000015d07-10.dat	xmrig
behavioral1/files/0x0007000000015d79-23.dat	xmrig
behavioral1/memory/2188-22-0x000000013F9C0000-0x000000013FDB6000-memory.dmp	xmrig
behavioral1/memory/2628-29-0x000000013F9C0000-0x000000013FDB6000-memory.dmp	xmrig
behavioral1/files/0x0007000000015d8f-45.dat	xmrig
behavioral1/memory/2188-52-0x000000013F3C0000-0x000000013F7B6000-memory.dmp	xmrig
behavioral1/memory/2752-47-0x000000013FAF0000-0x000000013FEE6000-memory.dmp	xmrig
behavioral1/memory/2468-54-0x000000013FCB0000-0x00000001400A6000-memory.dmp	xmrig
behavioral1/files/0x0008000000016c63-53.dat	xmrig
behavioral1/files/0x0007000000004e76-51.dat	xmrig
behavioral1/memory/2544-44-0x000000013F0A0000-0x000000013F496000-memory.dmp	xmrig
behavioral1/memory/2560-43-0x000000013F2C0000-0x000000013F6B6000-memory.dmp	xmrig
behavioral1/files/0x0007000000015d87-42.dat	xmrig
behavioral1/memory/2532-20-0x000000013F7C0000-0x000000013FBB6000-memory.dmp	xmrig
behavioral1/files/0x0008000000015d67-18.dat	xmrig
behavioral1/memory/3044-9-0x000000013FD80000-0x0000000140176000-memory.dmp	xmrig
behavioral1/files/0x0034000000015d28-65.dat	xmrig
behavioral1/memory/2596-64-0x000000013FF00000-0x00000001402F6000-memory.dmp	xmrig
behavioral1/memory/2532-62-0x000000013F7C0000-0x000000013FBB6000-memory.dmp	xmrig
behavioral1/memory/3044-59-0x000000013FD80000-0x0000000140176000-memory.dmp	xmrig
behavioral1/files/0x0006000000016d26-96.dat	xmrig
behavioral1/files/0x0006000000016d0d-95.dat	xmrig
behavioral1/files/0x0006000000016d7e-112.dat	xmrig
behavioral1/files/0x000600000001747d-164.dat	xmrig
behavioral1/memory/2468-583-0x000000013FCB0000-0x00000001400A6000-memory.dmp	xmrig
behavioral1/memory/2544-298-0x000000013F0A0000-0x000000013F496000-memory.dmp	xmrig
behavioral1/files/0x0006000000017556-172.dat	xmrig
behavioral1/files/0x000600000001749c-168.dat	xmrig
behavioral1/files/0x000600000001745e-160.dat	xmrig
behavioral1/files/0x0006000000017456-156.dat	xmrig
behavioral1/files/0x00060000000173e0-152.dat	xmrig
behavioral1/files/0x00060000000173d8-148.dat	xmrig
behavioral1/files/0x00060000000173d5-144.dat	xmrig
behavioral1/files/0x0006000000017052-140.dat	xmrig
behavioral1/files/0x0006000000016eb2-136.dat	xmrig
behavioral1/files/0x0006000000016e94-132.dat	xmrig
behavioral1/files/0x0006000000016dbf-128.dat	xmrig
behavioral1/files/0x0006000000016dbb-124.dat	xmrig
behavioral1/files/0x0006000000016da7-120.dat	xmrig
behavioral1/files/0x0006000000016d90-116.dat	xmrig
behavioral1/files/0x0006000000016d3a-108.dat	xmrig
behavioral1/files/0x0006000000016d1e-88.dat	xmrig
behavioral1/files/0x0006000000016cb7-81.dat	xmrig
behavioral1/files/0x0006000000016ce4-80.dat	xmrig
behavioral1/files/0x0006000000016c6b-71.dat	xmrig
behavioral1/memory/2464-97-0x000000013F140000-0x000000013F536000-memory.dmp	xmrig
behavioral1/memory/2188-94-0x0000000003650000-0x0000000003A46000-memory.dmp	xmrig
behavioral1/memory/2900-78-0x000000013F3D0000-0x000000013F7C6000-memory.dmp	xmrig
behavioral1/memory/2628-4662-0x000000013F9C0000-0x000000013FDB6000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
1740	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
3044	GzrCfof.exe
2532	atqKIXh.exe
2628	MhNULTh.exe
2560	uIoagKc.exe
2544	QVmslXX.exe
2752	hDQegdg.exe
2468	eLZCQaM.exe
2596	MvaZxaZ.exe
2900	tFklVXd.exe
2464	xjNvOfZ.exe
1712	wrlhXDL.exe
1036	jlhcoww.exe
2936	mWglhbO.exe
2060	tcqydRP.exe
2320	rdhriyF.exe
2680	kBikqkO.exe
600	TRoXSee.exe
788	oSPjiyt.exe
2764	BpstiVh.exe
596	oaSTAwe.exe
1060	slDDGFn.exe
2312	gyRYQse.exe
868	PtRnyFS.exe
1292	DiDqiNz.exe
2056	bKnlIgJ.exe
2264	BBGggoM.exe
1484	tXCsjUF.exe
2296	GuYclUJ.exe
1756	DoZaIIR.exe
2732	SwfTpdI.exe
2860	yQonWtE.exe
608	HlBKlGo.exe
2064	IRrzJew.exe
2380	ygbxvdS.exe
968	ZNxVHqi.exe
452	BdsTEms.exe
1776	dMtdFGK.exe
1296	PqesMYG.exe
3048	ENXdYBe.exe
872	jEDiCND.exe
1772	aVSXohi.exe
2080	oZOcNod.exe
964	PDjuzWR.exe
784	QBxjmKx.exe
1068	kpqcxZR.exe
2828	eBCddIE.exe
2676	msOtXgT.exe
916	uRSsKBE.exe
1616	hIiYMoX.exe
2084	AZcEVgU.exe
1544	zhokPdE.exe
2208	gNMRpBq.exe
2996	YTfZwiZ.exe
1160	mmERIfI.exe
2908	sxLiwYB.exe
1020	XnzYMAg.exe
2508	JyOKMkP.exe
772	DfsGUDJ.exe
1632	EyfowNq.exe
2832	lqkguPH.exe
2216	fmypCNF.exe
2332	XncyKIy.exe
1608	JXugxaP.exe
1604	SQZmvBy.exe

Loads dropped DLL 64 IoCs

pid	Process
2188	51eec792cdcd8a6ab24a797052ecc1d0_NeikiAnalytics.exe
2188	51eec792cdcd8a6ab24a797052ecc1d0_NeikiAnalytics.exe
2188	51eec792cdcd8a6ab24a797052ecc1d0_NeikiAnalytics.exe
2188	51eec792cdcd8a6ab24a797052ecc1d0_NeikiAnalytics.exe
2188	51eec792cdcd8a6ab24a797052ecc1d0_NeikiAnalytics.exe
2188	51eec792cdcd8a6ab24a797052ecc1d0_NeikiAnalytics.exe
2188	51eec792cdcd8a6ab24a797052ecc1d0_NeikiAnalytics.exe
2188	51eec792cdcd8a6ab24a797052ecc1d0_NeikiAnalytics.exe
2188	51eec792cdcd8a6ab24a797052ecc1d0_NeikiAnalytics.exe
2188	51eec792cdcd8a6ab24a797052ecc1d0_NeikiAnalytics.exe
2188	51eec792cdcd8a6ab24a797052ecc1d0_NeikiAnalytics.exe
2188	51eec792cdcd8a6ab24a797052ecc1d0_NeikiAnalytics.exe
2188	51eec792cdcd8a6ab24a797052ecc1d0_NeikiAnalytics.exe
2188	51eec792cdcd8a6ab24a797052ecc1d0_NeikiAnalytics.exe
2188	51eec792cdcd8a6ab24a797052ecc1d0_NeikiAnalytics.exe
2188	51eec792cdcd8a6ab24a797052ecc1d0_NeikiAnalytics.exe
2188	51eec792cdcd8a6ab24a797052ecc1d0_NeikiAnalytics.exe
2188	51eec792cdcd8a6ab24a797052ecc1d0_NeikiAnalytics.exe
2188	51eec792cdcd8a6ab24a797052ecc1d0_NeikiAnalytics.exe
2188	51eec792cdcd8a6ab24a797052ecc1d0_NeikiAnalytics.exe
2188	51eec792cdcd8a6ab24a797052ecc1d0_NeikiAnalytics.exe
2188	51eec792cdcd8a6ab24a797052ecc1d0_NeikiAnalytics.exe
2188	51eec792cdcd8a6ab24a797052ecc1d0_NeikiAnalytics.exe
2188	51eec792cdcd8a6ab24a797052ecc1d0_NeikiAnalytics.exe
2188	51eec792cdcd8a6ab24a797052ecc1d0_NeikiAnalytics.exe
2188	51eec792cdcd8a6ab24a797052ecc1d0_NeikiAnalytics.exe
2188	51eec792cdcd8a6ab24a797052ecc1d0_NeikiAnalytics.exe
2188	51eec792cdcd8a6ab24a797052ecc1d0_NeikiAnalytics.exe
2188	51eec792cdcd8a6ab24a797052ecc1d0_NeikiAnalytics.exe
2188	51eec792cdcd8a6ab24a797052ecc1d0_NeikiAnalytics.exe
2188	51eec792cdcd8a6ab24a797052ecc1d0_NeikiAnalytics.exe
2188	51eec792cdcd8a6ab24a797052ecc1d0_NeikiAnalytics.exe
2188	51eec792cdcd8a6ab24a797052ecc1d0_NeikiAnalytics.exe
2188	51eec792cdcd8a6ab24a797052ecc1d0_NeikiAnalytics.exe
2188	51eec792cdcd8a6ab24a797052ecc1d0_NeikiAnalytics.exe
2188	51eec792cdcd8a6ab24a797052ecc1d0_NeikiAnalytics.exe
2188	51eec792cdcd8a6ab24a797052ecc1d0_NeikiAnalytics.exe
2188	51eec792cdcd8a6ab24a797052ecc1d0_NeikiAnalytics.exe
2188	51eec792cdcd8a6ab24a797052ecc1d0_NeikiAnalytics.exe
2188	51eec792cdcd8a6ab24a797052ecc1d0_NeikiAnalytics.exe
2188	51eec792cdcd8a6ab24a797052ecc1d0_NeikiAnalytics.exe
2188	51eec792cdcd8a6ab24a797052ecc1d0_NeikiAnalytics.exe
2188	51eec792cdcd8a6ab24a797052ecc1d0_NeikiAnalytics.exe
2188	51eec792cdcd8a6ab24a797052ecc1d0_NeikiAnalytics.exe
2188	51eec792cdcd8a6ab24a797052ecc1d0_NeikiAnalytics.exe
2188	51eec792cdcd8a6ab24a797052ecc1d0_NeikiAnalytics.exe
2188	51eec792cdcd8a6ab24a797052ecc1d0_NeikiAnalytics.exe
2188	51eec792cdcd8a6ab24a797052ecc1d0_NeikiAnalytics.exe
2188	51eec792cdcd8a6ab24a797052ecc1d0_NeikiAnalytics.exe
2188	51eec792cdcd8a6ab24a797052ecc1d0_NeikiAnalytics.exe
2188	51eec792cdcd8a6ab24a797052ecc1d0_NeikiAnalytics.exe
2188	51eec792cdcd8a6ab24a797052ecc1d0_NeikiAnalytics.exe
2188	51eec792cdcd8a6ab24a797052ecc1d0_NeikiAnalytics.exe
2188	51eec792cdcd8a6ab24a797052ecc1d0_NeikiAnalytics.exe
2188	51eec792cdcd8a6ab24a797052ecc1d0_NeikiAnalytics.exe
2188	51eec792cdcd8a6ab24a797052ecc1d0_NeikiAnalytics.exe
2188	51eec792cdcd8a6ab24a797052ecc1d0_NeikiAnalytics.exe
2188	51eec792cdcd8a6ab24a797052ecc1d0_NeikiAnalytics.exe
2188	51eec792cdcd8a6ab24a797052ecc1d0_NeikiAnalytics.exe
2188	51eec792cdcd8a6ab24a797052ecc1d0_NeikiAnalytics.exe
2188	51eec792cdcd8a6ab24a797052ecc1d0_NeikiAnalytics.exe
2188	51eec792cdcd8a6ab24a797052ecc1d0_NeikiAnalytics.exe
2188	51eec792cdcd8a6ab24a797052ecc1d0_NeikiAnalytics.exe
2188	51eec792cdcd8a6ab24a797052ecc1d0_NeikiAnalytics.exe

UPX packed file 49 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2188-1-0x000000013F3C0000-0x000000013F7B6000-memory.dmp	upx
behavioral1/files/0x000c00000001313a-3.dat	upx
behavioral1/files/0x0034000000015d07-10.dat	upx
behavioral1/files/0x0007000000015d79-23.dat	upx
behavioral1/memory/2628-29-0x000000013F9C0000-0x000000013FDB6000-memory.dmp	upx
behavioral1/files/0x0007000000015d8f-45.dat	upx
behavioral1/memory/2188-52-0x000000013F3C0000-0x000000013F7B6000-memory.dmp	upx
behavioral1/memory/2752-47-0x000000013FAF0000-0x000000013FEE6000-memory.dmp	upx
behavioral1/memory/2468-54-0x000000013FCB0000-0x00000001400A6000-memory.dmp	upx
behavioral1/files/0x0008000000016c63-53.dat	upx
behavioral1/files/0x0007000000004e76-51.dat	upx
behavioral1/memory/2544-44-0x000000013F0A0000-0x000000013F496000-memory.dmp	upx
behavioral1/memory/2560-43-0x000000013F2C0000-0x000000013F6B6000-memory.dmp	upx
behavioral1/files/0x0007000000015d87-42.dat	upx
behavioral1/memory/2532-20-0x000000013F7C0000-0x000000013FBB6000-memory.dmp	upx
behavioral1/files/0x0008000000015d67-18.dat	upx
behavioral1/memory/3044-9-0x000000013FD80000-0x0000000140176000-memory.dmp	upx
behavioral1/files/0x0034000000015d28-65.dat	upx
behavioral1/memory/2596-64-0x000000013FF00000-0x00000001402F6000-memory.dmp	upx
behavioral1/memory/2532-62-0x000000013F7C0000-0x000000013FBB6000-memory.dmp	upx
behavioral1/memory/3044-59-0x000000013FD80000-0x0000000140176000-memory.dmp	upx
behavioral1/files/0x0006000000016d26-96.dat	upx
behavioral1/files/0x0006000000016d0d-95.dat	upx
behavioral1/files/0x0006000000016d7e-112.dat	upx
behavioral1/files/0x000600000001747d-164.dat	upx
behavioral1/memory/2468-583-0x000000013FCB0000-0x00000001400A6000-memory.dmp	upx
behavioral1/memory/2544-298-0x000000013F0A0000-0x000000013F496000-memory.dmp	upx
behavioral1/files/0x0006000000017556-172.dat	upx
behavioral1/files/0x000600000001749c-168.dat	upx
behavioral1/files/0x000600000001745e-160.dat	upx
behavioral1/files/0x0006000000017456-156.dat	upx
behavioral1/files/0x00060000000173e0-152.dat	upx
behavioral1/files/0x00060000000173d8-148.dat	upx
behavioral1/files/0x00060000000173d5-144.dat	upx
behavioral1/files/0x0006000000017052-140.dat	upx
behavioral1/files/0x0006000000016eb2-136.dat	upx
behavioral1/files/0x0006000000016e94-132.dat	upx
behavioral1/files/0x0006000000016dbf-128.dat	upx
behavioral1/files/0x0006000000016dbb-124.dat	upx
behavioral1/files/0x0006000000016da7-120.dat	upx
behavioral1/files/0x0006000000016d90-116.dat	upx
behavioral1/files/0x0006000000016d3a-108.dat	upx
behavioral1/files/0x0006000000016d1e-88.dat	upx
behavioral1/files/0x0006000000016cb7-81.dat	upx
behavioral1/files/0x0006000000016ce4-80.dat	upx
behavioral1/files/0x0006000000016c6b-71.dat	upx
behavioral1/memory/2464-97-0x000000013F140000-0x000000013F536000-memory.dmp	upx
behavioral1/memory/2900-78-0x000000013F3D0000-0x000000013F7C6000-memory.dmp	upx
behavioral1/memory/2628-4662-0x000000013F9C0000-0x000000013FDB6000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\vaSQyIl.exe	51eec792cdcd8a6ab24a797052ecc1d0_NeikiAnalytics.exe
File created	C:\Windows\System\asUpwiI.exe	51eec792cdcd8a6ab24a797052ecc1d0_NeikiAnalytics.exe
File created	C:\Windows\System\qjGBQeR.exe	51eec792cdcd8a6ab24a797052ecc1d0_NeikiAnalytics.exe
File created	C:\Windows\System\zOuwKCi.exe	51eec792cdcd8a6ab24a797052ecc1d0_NeikiAnalytics.exe
File created	C:\Windows\System\nbvMotc.exe	51eec792cdcd8a6ab24a797052ecc1d0_NeikiAnalytics.exe
File created	C:\Windows\System\vbKFrdj.exe	51eec792cdcd8a6ab24a797052ecc1d0_NeikiAnalytics.exe
File created	C:\Windows\System\NogmeME.exe	51eec792cdcd8a6ab24a797052ecc1d0_NeikiAnalytics.exe
File created	C:\Windows\System\bkedXBo.exe	51eec792cdcd8a6ab24a797052ecc1d0_NeikiAnalytics.exe
File created	C:\Windows\System\EKEeubi.exe	51eec792cdcd8a6ab24a797052ecc1d0_NeikiAnalytics.exe
File created	C:\Windows\System\KZgEdrD.exe	51eec792cdcd8a6ab24a797052ecc1d0_NeikiAnalytics.exe
File created	C:\Windows\System\SlYwAju.exe	51eec792cdcd8a6ab24a797052ecc1d0_NeikiAnalytics.exe
File created	C:\Windows\System\hWCvWNB.exe	51eec792cdcd8a6ab24a797052ecc1d0_NeikiAnalytics.exe
File created	C:\Windows\System\ZrwqRgX.exe	51eec792cdcd8a6ab24a797052ecc1d0_NeikiAnalytics.exe
File created	C:\Windows\System\dOhwwjR.exe	51eec792cdcd8a6ab24a797052ecc1d0_NeikiAnalytics.exe
File created	C:\Windows\System\lYdnFgk.exe	51eec792cdcd8a6ab24a797052ecc1d0_NeikiAnalytics.exe
File created	C:\Windows\System\hwMGxAs.exe	51eec792cdcd8a6ab24a797052ecc1d0_NeikiAnalytics.exe
File created	C:\Windows\System\GyOXBbD.exe	51eec792cdcd8a6ab24a797052ecc1d0_NeikiAnalytics.exe
File created	C:\Windows\System\CEvyXCc.exe	51eec792cdcd8a6ab24a797052ecc1d0_NeikiAnalytics.exe
File created	C:\Windows\System\elLwFZL.exe	51eec792cdcd8a6ab24a797052ecc1d0_NeikiAnalytics.exe
File created	C:\Windows\System\orqBjva.exe	51eec792cdcd8a6ab24a797052ecc1d0_NeikiAnalytics.exe
File created	C:\Windows\System\jFjvrNI.exe	51eec792cdcd8a6ab24a797052ecc1d0_NeikiAnalytics.exe
File created	C:\Windows\System\WxeyZrn.exe	51eec792cdcd8a6ab24a797052ecc1d0_NeikiAnalytics.exe
File created	C:\Windows\System\iAgqdJo.exe	51eec792cdcd8a6ab24a797052ecc1d0_NeikiAnalytics.exe
File created	C:\Windows\System\VkMfoCG.exe	51eec792cdcd8a6ab24a797052ecc1d0_NeikiAnalytics.exe
File created	C:\Windows\System\hKkvQsJ.exe	51eec792cdcd8a6ab24a797052ecc1d0_NeikiAnalytics.exe
File created	C:\Windows\System\vJnarhr.exe	51eec792cdcd8a6ab24a797052ecc1d0_NeikiAnalytics.exe
File created	C:\Windows\System\gzDVNwr.exe	51eec792cdcd8a6ab24a797052ecc1d0_NeikiAnalytics.exe
File created	C:\Windows\System\XPDTCSh.exe	51eec792cdcd8a6ab24a797052ecc1d0_NeikiAnalytics.exe
File created	C:\Windows\System\WvIGwxD.exe	51eec792cdcd8a6ab24a797052ecc1d0_NeikiAnalytics.exe
File created	C:\Windows\System\KuORCTw.exe	51eec792cdcd8a6ab24a797052ecc1d0_NeikiAnalytics.exe
File created	C:\Windows\System\vYFtxUe.exe	51eec792cdcd8a6ab24a797052ecc1d0_NeikiAnalytics.exe
File created	C:\Windows\System\rBrBFZT.exe	51eec792cdcd8a6ab24a797052ecc1d0_NeikiAnalytics.exe
File created	C:\Windows\System\MiIbLLy.exe	51eec792cdcd8a6ab24a797052ecc1d0_NeikiAnalytics.exe
File created	C:\Windows\System\WrYTPYS.exe	51eec792cdcd8a6ab24a797052ecc1d0_NeikiAnalytics.exe
File created	C:\Windows\System\UBKWZyS.exe	51eec792cdcd8a6ab24a797052ecc1d0_NeikiAnalytics.exe
File created	C:\Windows\System\IFaVCdp.exe	51eec792cdcd8a6ab24a797052ecc1d0_NeikiAnalytics.exe
File created	C:\Windows\System\sIXSYcr.exe	51eec792cdcd8a6ab24a797052ecc1d0_NeikiAnalytics.exe
File created	C:\Windows\System\HGJylhq.exe	51eec792cdcd8a6ab24a797052ecc1d0_NeikiAnalytics.exe
File created	C:\Windows\System\msdrqhW.exe	51eec792cdcd8a6ab24a797052ecc1d0_NeikiAnalytics.exe
File created	C:\Windows\System\RMgmLMU.exe	51eec792cdcd8a6ab24a797052ecc1d0_NeikiAnalytics.exe
File created	C:\Windows\System\dNFHrVA.exe	51eec792cdcd8a6ab24a797052ecc1d0_NeikiAnalytics.exe
File created	C:\Windows\System\bVXLnUd.exe	51eec792cdcd8a6ab24a797052ecc1d0_NeikiAnalytics.exe
File created	C:\Windows\System\liHpswe.exe	51eec792cdcd8a6ab24a797052ecc1d0_NeikiAnalytics.exe
File created	C:\Windows\System\MQPXPfh.exe	51eec792cdcd8a6ab24a797052ecc1d0_NeikiAnalytics.exe
File created	C:\Windows\System\eBkGcHg.exe	51eec792cdcd8a6ab24a797052ecc1d0_NeikiAnalytics.exe
File created	C:\Windows\System\jcKXspG.exe	51eec792cdcd8a6ab24a797052ecc1d0_NeikiAnalytics.exe
File created	C:\Windows\System\Jiupbkl.exe	51eec792cdcd8a6ab24a797052ecc1d0_NeikiAnalytics.exe
File created	C:\Windows\System\GdBkwZb.exe	51eec792cdcd8a6ab24a797052ecc1d0_NeikiAnalytics.exe
File created	C:\Windows\System\tbfaSMt.exe	51eec792cdcd8a6ab24a797052ecc1d0_NeikiAnalytics.exe
File created	C:\Windows\System\gXEFoUI.exe	51eec792cdcd8a6ab24a797052ecc1d0_NeikiAnalytics.exe
File created	C:\Windows\System\yjawDas.exe	51eec792cdcd8a6ab24a797052ecc1d0_NeikiAnalytics.exe
File created	C:\Windows\System\kfaObZs.exe	51eec792cdcd8a6ab24a797052ecc1d0_NeikiAnalytics.exe
File created	C:\Windows\System\reSrXYJ.exe	51eec792cdcd8a6ab24a797052ecc1d0_NeikiAnalytics.exe
File created	C:\Windows\System\fcdSEjL.exe	51eec792cdcd8a6ab24a797052ecc1d0_NeikiAnalytics.exe
File created	C:\Windows\System\wbqWIGM.exe	51eec792cdcd8a6ab24a797052ecc1d0_NeikiAnalytics.exe
File created	C:\Windows\System\bzBZopL.exe	51eec792cdcd8a6ab24a797052ecc1d0_NeikiAnalytics.exe
File created	C:\Windows\System\rnAOvwk.exe	51eec792cdcd8a6ab24a797052ecc1d0_NeikiAnalytics.exe
File created	C:\Windows\System\ZcKwMZx.exe	51eec792cdcd8a6ab24a797052ecc1d0_NeikiAnalytics.exe
File created	C:\Windows\System\CcHNwGp.exe	51eec792cdcd8a6ab24a797052ecc1d0_NeikiAnalytics.exe
File created	C:\Windows\System\ibQlbuH.exe	51eec792cdcd8a6ab24a797052ecc1d0_NeikiAnalytics.exe
File created	C:\Windows\System\SfLBNZu.exe	51eec792cdcd8a6ab24a797052ecc1d0_NeikiAnalytics.exe
File created	C:\Windows\System\vsMUMlT.exe	51eec792cdcd8a6ab24a797052ecc1d0_NeikiAnalytics.exe
File created	C:\Windows\System\hhHSjLz.exe	51eec792cdcd8a6ab24a797052ecc1d0_NeikiAnalytics.exe
File created	C:\Windows\System\jVMZAOI.exe	51eec792cdcd8a6ab24a797052ecc1d0_NeikiAnalytics.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1740	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2188	51eec792cdcd8a6ab24a797052ecc1d0_NeikiAnalytics.exe
Token: SeLockMemoryPrivilege	2188	51eec792cdcd8a6ab24a797052ecc1d0_NeikiAnalytics.exe
Token: SeDebugPrivilege	1740	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2188 wrote to memory of 1740	2188	51eec792cdcd8a6ab24a797052ecc1d0_NeikiAnalytics.exe	29
PID 2188 wrote to memory of 1740	2188	51eec792cdcd8a6ab24a797052ecc1d0_NeikiAnalytics.exe	29
PID 2188 wrote to memory of 1740	2188	51eec792cdcd8a6ab24a797052ecc1d0_NeikiAnalytics.exe	29
PID 2188 wrote to memory of 3044	2188	51eec792cdcd8a6ab24a797052ecc1d0_NeikiAnalytics.exe	30
PID 2188 wrote to memory of 3044	2188	51eec792cdcd8a6ab24a797052ecc1d0_NeikiAnalytics.exe	30
PID 2188 wrote to memory of 3044	2188	51eec792cdcd8a6ab24a797052ecc1d0_NeikiAnalytics.exe	30
PID 2188 wrote to memory of 2532	2188	51eec792cdcd8a6ab24a797052ecc1d0_NeikiAnalytics.exe	31
PID 2188 wrote to memory of 2532	2188	51eec792cdcd8a6ab24a797052ecc1d0_NeikiAnalytics.exe	31
PID 2188 wrote to memory of 2532	2188	51eec792cdcd8a6ab24a797052ecc1d0_NeikiAnalytics.exe	31
PID 2188 wrote to memory of 2628	2188	51eec792cdcd8a6ab24a797052ecc1d0_NeikiAnalytics.exe	32
PID 2188 wrote to memory of 2628	2188	51eec792cdcd8a6ab24a797052ecc1d0_NeikiAnalytics.exe	32
PID 2188 wrote to memory of 2628	2188	51eec792cdcd8a6ab24a797052ecc1d0_NeikiAnalytics.exe	32
PID 2188 wrote to memory of 2560	2188	51eec792cdcd8a6ab24a797052ecc1d0_NeikiAnalytics.exe	33
PID 2188 wrote to memory of 2560	2188	51eec792cdcd8a6ab24a797052ecc1d0_NeikiAnalytics.exe	33
PID 2188 wrote to memory of 2560	2188	51eec792cdcd8a6ab24a797052ecc1d0_NeikiAnalytics.exe	33
PID 2188 wrote to memory of 2544	2188	51eec792cdcd8a6ab24a797052ecc1d0_NeikiAnalytics.exe	34
PID 2188 wrote to memory of 2544	2188	51eec792cdcd8a6ab24a797052ecc1d0_NeikiAnalytics.exe	34
PID 2188 wrote to memory of 2544	2188	51eec792cdcd8a6ab24a797052ecc1d0_NeikiAnalytics.exe	34
PID 2188 wrote to memory of 2752	2188	51eec792cdcd8a6ab24a797052ecc1d0_NeikiAnalytics.exe	35
PID 2188 wrote to memory of 2752	2188	51eec792cdcd8a6ab24a797052ecc1d0_NeikiAnalytics.exe	35
PID 2188 wrote to memory of 2752	2188	51eec792cdcd8a6ab24a797052ecc1d0_NeikiAnalytics.exe	35
PID 2188 wrote to memory of 2468	2188	51eec792cdcd8a6ab24a797052ecc1d0_NeikiAnalytics.exe	36
PID 2188 wrote to memory of 2468	2188	51eec792cdcd8a6ab24a797052ecc1d0_NeikiAnalytics.exe	36
PID 2188 wrote to memory of 2468	2188	51eec792cdcd8a6ab24a797052ecc1d0_NeikiAnalytics.exe	36
PID 2188 wrote to memory of 2596	2188	51eec792cdcd8a6ab24a797052ecc1d0_NeikiAnalytics.exe	37
PID 2188 wrote to memory of 2596	2188	51eec792cdcd8a6ab24a797052ecc1d0_NeikiAnalytics.exe	37
PID 2188 wrote to memory of 2596	2188	51eec792cdcd8a6ab24a797052ecc1d0_NeikiAnalytics.exe	37
PID 2188 wrote to memory of 2900	2188	51eec792cdcd8a6ab24a797052ecc1d0_NeikiAnalytics.exe	38
PID 2188 wrote to memory of 2900	2188	51eec792cdcd8a6ab24a797052ecc1d0_NeikiAnalytics.exe	38
PID 2188 wrote to memory of 2900	2188	51eec792cdcd8a6ab24a797052ecc1d0_NeikiAnalytics.exe	38
PID 2188 wrote to memory of 2936	2188	51eec792cdcd8a6ab24a797052ecc1d0_NeikiAnalytics.exe	39
PID 2188 wrote to memory of 2936	2188	51eec792cdcd8a6ab24a797052ecc1d0_NeikiAnalytics.exe	39
PID 2188 wrote to memory of 2936	2188	51eec792cdcd8a6ab24a797052ecc1d0_NeikiAnalytics.exe	39
PID 2188 wrote to memory of 2464	2188	51eec792cdcd8a6ab24a797052ecc1d0_NeikiAnalytics.exe	40
PID 2188 wrote to memory of 2464	2188	51eec792cdcd8a6ab24a797052ecc1d0_NeikiAnalytics.exe	40
PID 2188 wrote to memory of 2464	2188	51eec792cdcd8a6ab24a797052ecc1d0_NeikiAnalytics.exe	40
PID 2188 wrote to memory of 2060	2188	51eec792cdcd8a6ab24a797052ecc1d0_NeikiAnalytics.exe	41
PID 2188 wrote to memory of 2060	2188	51eec792cdcd8a6ab24a797052ecc1d0_NeikiAnalytics.exe	41
PID 2188 wrote to memory of 2060	2188	51eec792cdcd8a6ab24a797052ecc1d0_NeikiAnalytics.exe	41
PID 2188 wrote to memory of 1712	2188	51eec792cdcd8a6ab24a797052ecc1d0_NeikiAnalytics.exe	42
PID 2188 wrote to memory of 1712	2188	51eec792cdcd8a6ab24a797052ecc1d0_NeikiAnalytics.exe	42
PID 2188 wrote to memory of 1712	2188	51eec792cdcd8a6ab24a797052ecc1d0_NeikiAnalytics.exe	42
PID 2188 wrote to memory of 2320	2188	51eec792cdcd8a6ab24a797052ecc1d0_NeikiAnalytics.exe	43
PID 2188 wrote to memory of 2320	2188	51eec792cdcd8a6ab24a797052ecc1d0_NeikiAnalytics.exe	43
PID 2188 wrote to memory of 2320	2188	51eec792cdcd8a6ab24a797052ecc1d0_NeikiAnalytics.exe	43
PID 2188 wrote to memory of 1036	2188	51eec792cdcd8a6ab24a797052ecc1d0_NeikiAnalytics.exe	44
PID 2188 wrote to memory of 1036	2188	51eec792cdcd8a6ab24a797052ecc1d0_NeikiAnalytics.exe	44
PID 2188 wrote to memory of 1036	2188	51eec792cdcd8a6ab24a797052ecc1d0_NeikiAnalytics.exe	44
PID 2188 wrote to memory of 2680	2188	51eec792cdcd8a6ab24a797052ecc1d0_NeikiAnalytics.exe	45
PID 2188 wrote to memory of 2680	2188	51eec792cdcd8a6ab24a797052ecc1d0_NeikiAnalytics.exe	45
PID 2188 wrote to memory of 2680	2188	51eec792cdcd8a6ab24a797052ecc1d0_NeikiAnalytics.exe	45
PID 2188 wrote to memory of 600	2188	51eec792cdcd8a6ab24a797052ecc1d0_NeikiAnalytics.exe	46
PID 2188 wrote to memory of 600	2188	51eec792cdcd8a6ab24a797052ecc1d0_NeikiAnalytics.exe	46
PID 2188 wrote to memory of 600	2188	51eec792cdcd8a6ab24a797052ecc1d0_NeikiAnalytics.exe	46
PID 2188 wrote to memory of 788	2188	51eec792cdcd8a6ab24a797052ecc1d0_NeikiAnalytics.exe	47
PID 2188 wrote to memory of 788	2188	51eec792cdcd8a6ab24a797052ecc1d0_NeikiAnalytics.exe	47
PID 2188 wrote to memory of 788	2188	51eec792cdcd8a6ab24a797052ecc1d0_NeikiAnalytics.exe	47
PID 2188 wrote to memory of 2764	2188	51eec792cdcd8a6ab24a797052ecc1d0_NeikiAnalytics.exe	48
PID 2188 wrote to memory of 2764	2188	51eec792cdcd8a6ab24a797052ecc1d0_NeikiAnalytics.exe	48
PID 2188 wrote to memory of 2764	2188	51eec792cdcd8a6ab24a797052ecc1d0_NeikiAnalytics.exe	48
PID 2188 wrote to memory of 596	2188	51eec792cdcd8a6ab24a797052ecc1d0_NeikiAnalytics.exe	49
PID 2188 wrote to memory of 596	2188	51eec792cdcd8a6ab24a797052ecc1d0_NeikiAnalytics.exe	49
PID 2188 wrote to memory of 596	2188	51eec792cdcd8a6ab24a797052ecc1d0_NeikiAnalytics.exe	49
PID 2188 wrote to memory of 1060	2188	51eec792cdcd8a6ab24a797052ecc1d0_NeikiAnalytics.exe	50

C:\Users\Admin\AppData\Local\Temp\51eec792cdcd8a6ab24a797052ecc1d0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\51eec792cdcd8a6ab24a797052ecc1d0_NeikiAnalytics.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2188
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1740
- C:\Windows\System\GzrCfof.exe
  C:\Windows\System\GzrCfof.exe
  2⤵
  - Executes dropped EXE
  PID:3044
- C:\Windows\System\atqKIXh.exe
  C:\Windows\System\atqKIXh.exe
  2⤵
  - Executes dropped EXE
  PID:2532
- C:\Windows\System\MhNULTh.exe
  C:\Windows\System\MhNULTh.exe
  2⤵
  - Executes dropped EXE
  PID:2628
- C:\Windows\System\uIoagKc.exe
  C:\Windows\System\uIoagKc.exe
  2⤵
  - Executes dropped EXE
  PID:2560
- C:\Windows\System\QVmslXX.exe
  C:\Windows\System\QVmslXX.exe
  2⤵
  - Executes dropped EXE
  PID:2544
- C:\Windows\System\hDQegdg.exe
  C:\Windows\System\hDQegdg.exe
  2⤵
  - Executes dropped EXE
  PID:2752
- C:\Windows\System\eLZCQaM.exe
  C:\Windows\System\eLZCQaM.exe
  2⤵
  - Executes dropped EXE
  PID:2468
- C:\Windows\System\MvaZxaZ.exe
  C:\Windows\System\MvaZxaZ.exe
  2⤵
  - Executes dropped EXE
  PID:2596
- C:\Windows\System\tFklVXd.exe
  C:\Windows\System\tFklVXd.exe
  2⤵
  - Executes dropped EXE
  PID:2900
- C:\Windows\System\mWglhbO.exe
  C:\Windows\System\mWglhbO.exe
  2⤵
  - Executes dropped EXE
  PID:2936
- C:\Windows\System\xjNvOfZ.exe
  C:\Windows\System\xjNvOfZ.exe
  2⤵
  - Executes dropped EXE
  PID:2464
- C:\Windows\System\tcqydRP.exe
  C:\Windows\System\tcqydRP.exe
  2⤵
  - Executes dropped EXE
  PID:2060
- C:\Windows\System\wrlhXDL.exe
  C:\Windows\System\wrlhXDL.exe
  2⤵
  - Executes dropped EXE
  PID:1712
- C:\Windows\System\rdhriyF.exe
  C:\Windows\System\rdhriyF.exe
  2⤵
  - Executes dropped EXE
  PID:2320
- C:\Windows\System\jlhcoww.exe
  C:\Windows\System\jlhcoww.exe
  2⤵
  - Executes dropped EXE
  PID:1036
- C:\Windows\System\kBikqkO.exe
  C:\Windows\System\kBikqkO.exe
  2⤵
  - Executes dropped EXE
  PID:2680
- C:\Windows\System\TRoXSee.exe
  C:\Windows\System\TRoXSee.exe
  2⤵
  - Executes dropped EXE
  PID:600
- C:\Windows\System\oSPjiyt.exe
  C:\Windows\System\oSPjiyt.exe
  2⤵
  - Executes dropped EXE
  PID:788
- C:\Windows\System\BpstiVh.exe
  C:\Windows\System\BpstiVh.exe
  2⤵
  - Executes dropped EXE
  PID:2764
- C:\Windows\System\oaSTAwe.exe
  C:\Windows\System\oaSTAwe.exe
  2⤵
  - Executes dropped EXE
  PID:596
- C:\Windows\System\slDDGFn.exe
  C:\Windows\System\slDDGFn.exe
  2⤵
  - Executes dropped EXE
  PID:1060
- C:\Windows\System\gyRYQse.exe
  C:\Windows\System\gyRYQse.exe
  2⤵
  - Executes dropped EXE
  PID:2312
- C:\Windows\System\PtRnyFS.exe
  C:\Windows\System\PtRnyFS.exe
  2⤵
  - Executes dropped EXE
  PID:868
- C:\Windows\System\DiDqiNz.exe
  C:\Windows\System\DiDqiNz.exe
  2⤵
  - Executes dropped EXE
  PID:1292
- C:\Windows\System\bKnlIgJ.exe
  C:\Windows\System\bKnlIgJ.exe
  2⤵
  - Executes dropped EXE
  PID:2056
- C:\Windows\System\BBGggoM.exe
  C:\Windows\System\BBGggoM.exe
  2⤵
  - Executes dropped EXE
  PID:2264
- C:\Windows\System\tXCsjUF.exe
  C:\Windows\System\tXCsjUF.exe
  2⤵
  - Executes dropped EXE
  PID:1484
- C:\Windows\System\GuYclUJ.exe
  C:\Windows\System\GuYclUJ.exe
  2⤵
  - Executes dropped EXE
  PID:2296
- C:\Windows\System\DoZaIIR.exe
  C:\Windows\System\DoZaIIR.exe
  2⤵
  - Executes dropped EXE
  PID:1756
- C:\Windows\System\SwfTpdI.exe
  C:\Windows\System\SwfTpdI.exe
  2⤵
  - Executes dropped EXE
  PID:2732
- C:\Windows\System\yQonWtE.exe
  C:\Windows\System\yQonWtE.exe
  2⤵
  - Executes dropped EXE
  PID:2860
- C:\Windows\System\HlBKlGo.exe
  C:\Windows\System\HlBKlGo.exe
  2⤵
  - Executes dropped EXE
  PID:608
- C:\Windows\System\IRrzJew.exe
  C:\Windows\System\IRrzJew.exe
  2⤵
  - Executes dropped EXE
  PID:2064
- C:\Windows\System\ygbxvdS.exe
  C:\Windows\System\ygbxvdS.exe
  2⤵
  - Executes dropped EXE
  PID:2380
- C:\Windows\System\ZNxVHqi.exe
  C:\Windows\System\ZNxVHqi.exe
  2⤵
  - Executes dropped EXE
  PID:968
- C:\Windows\System\BdsTEms.exe
  C:\Windows\System\BdsTEms.exe
  2⤵
  - Executes dropped EXE
  PID:452
- C:\Windows\System\dMtdFGK.exe
  C:\Windows\System\dMtdFGK.exe
  2⤵
  - Executes dropped EXE
  PID:1776
- C:\Windows\System\PqesMYG.exe
  C:\Windows\System\PqesMYG.exe
  2⤵
  - Executes dropped EXE
  PID:1296
- C:\Windows\System\ENXdYBe.exe
  C:\Windows\System\ENXdYBe.exe
  2⤵
  - Executes dropped EXE
  PID:3048
- C:\Windows\System\jEDiCND.exe
  C:\Windows\System\jEDiCND.exe
  2⤵
  - Executes dropped EXE
  PID:872
- C:\Windows\System\aVSXohi.exe
  C:\Windows\System\aVSXohi.exe
  2⤵
  - Executes dropped EXE
  PID:1772
- C:\Windows\System\oZOcNod.exe
  C:\Windows\System\oZOcNod.exe
  2⤵
  - Executes dropped EXE
  PID:2080
- C:\Windows\System\PDjuzWR.exe
  C:\Windows\System\PDjuzWR.exe
  2⤵
  - Executes dropped EXE
  PID:964
- C:\Windows\System\QBxjmKx.exe
  C:\Windows\System\QBxjmKx.exe
  2⤵
  - Executes dropped EXE
  PID:784
- C:\Windows\System\kpqcxZR.exe
  C:\Windows\System\kpqcxZR.exe
  2⤵
  - Executes dropped EXE
  PID:1068
- C:\Windows\System\eBCddIE.exe
  C:\Windows\System\eBCddIE.exe
  2⤵
  - Executes dropped EXE
  PID:2828
- C:\Windows\System\msOtXgT.exe
  C:\Windows\System\msOtXgT.exe
  2⤵
  - Executes dropped EXE
  PID:2676
- C:\Windows\System\uRSsKBE.exe
  C:\Windows\System\uRSsKBE.exe
  2⤵
  - Executes dropped EXE
  PID:916
- C:\Windows\System\hIiYMoX.exe
  C:\Windows\System\hIiYMoX.exe
  2⤵
  - Executes dropped EXE
  PID:1616
- C:\Windows\System\AZcEVgU.exe
  C:\Windows\System\AZcEVgU.exe
  2⤵
  - Executes dropped EXE
  PID:2084
- C:\Windows\System\zhokPdE.exe
  C:\Windows\System\zhokPdE.exe
  2⤵
  - Executes dropped EXE
  PID:1544
- C:\Windows\System\gNMRpBq.exe
  C:\Windows\System\gNMRpBq.exe
  2⤵
  - Executes dropped EXE
  PID:2208
- C:\Windows\System\YTfZwiZ.exe
  C:\Windows\System\YTfZwiZ.exe
  2⤵
  - Executes dropped EXE
  PID:2996
- C:\Windows\System\mmERIfI.exe
  C:\Windows\System\mmERIfI.exe
  2⤵
  - Executes dropped EXE
  PID:1160
- C:\Windows\System\sxLiwYB.exe
  C:\Windows\System\sxLiwYB.exe
  2⤵
  - Executes dropped EXE
  PID:2908
- C:\Windows\System\XnzYMAg.exe
  C:\Windows\System\XnzYMAg.exe
  2⤵
  - Executes dropped EXE
  PID:1020
- C:\Windows\System\JyOKMkP.exe
  C:\Windows\System\JyOKMkP.exe
  2⤵
  - Executes dropped EXE
  PID:2508
- C:\Windows\System\DfsGUDJ.exe
  C:\Windows\System\DfsGUDJ.exe
  2⤵
  - Executes dropped EXE
  PID:772
- C:\Windows\System\EyfowNq.exe
  C:\Windows\System\EyfowNq.exe
  2⤵
  - Executes dropped EXE
  PID:1632
- C:\Windows\System\lqkguPH.exe
  C:\Windows\System\lqkguPH.exe
  2⤵
  - Executes dropped EXE
  PID:2832
- C:\Windows\System\fmypCNF.exe
  C:\Windows\System\fmypCNF.exe
  2⤵
  - Executes dropped EXE
  PID:2216
- C:\Windows\System\XncyKIy.exe
  C:\Windows\System\XncyKIy.exe
  2⤵
  - Executes dropped EXE
  PID:2332
- C:\Windows\System\JXugxaP.exe
  C:\Windows\System\JXugxaP.exe
  2⤵
  - Executes dropped EXE
  PID:1608
- C:\Windows\System\SQZmvBy.exe
  C:\Windows\System\SQZmvBy.exe
  2⤵
  - Executes dropped EXE
  PID:1604
- C:\Windows\System\nCbhsFK.exe
  C:\Windows\System\nCbhsFK.exe
  2⤵
  PID:2568
- C:\Windows\System\cNpAfbU.exe
  C:\Windows\System\cNpAfbU.exe
  2⤵
  PID:2260
- C:\Windows\System\bRduAdL.exe
  C:\Windows\System\bRduAdL.exe
  2⤵
  PID:2728
- C:\Windows\System\ZqANUkp.exe
  C:\Windows\System\ZqANUkp.exe
  2⤵
  PID:2528
- C:\Windows\System\zHraCMI.exe
  C:\Windows\System\zHraCMI.exe
  2⤵
  PID:2344
- C:\Windows\System\WAMLkwo.exe
  C:\Windows\System\WAMLkwo.exe
  2⤵
  PID:2608
- C:\Windows\System\CWErLwz.exe
  C:\Windows\System\CWErLwz.exe
  2⤵
  PID:2236
- C:\Windows\System\VRRYfSg.exe
  C:\Windows\System\VRRYfSg.exe
  2⤵
  PID:2620
- C:\Windows\System\liIvphB.exe
  C:\Windows\System\liIvphB.exe
  2⤵
  PID:2816
- C:\Windows\System\IuQnoCV.exe
  C:\Windows\System\IuQnoCV.exe
  2⤵
  PID:2004
- C:\Windows\System\tHsosUc.exe
  C:\Windows\System\tHsosUc.exe
  2⤵
  PID:2844
- C:\Windows\System\uXfTnbu.exe
  C:\Windows\System\uXfTnbu.exe
  2⤵
  PID:2912
- C:\Windows\System\cYnWAzY.exe
  C:\Windows\System\cYnWAzY.exe
  2⤵
  PID:2692
- C:\Windows\System\CenBllJ.exe
  C:\Windows\System\CenBllJ.exe
  2⤵
  PID:2044
- C:\Windows\System\RXVdJcl.exe
  C:\Windows\System\RXVdJcl.exe
  2⤵
  PID:1916
- C:\Windows\System\hOWcoCg.exe
  C:\Windows\System\hOWcoCg.exe
  2⤵
  PID:2984
- C:\Windows\System\BsNEVCu.exe
  C:\Windows\System\BsNEVCu.exe
  2⤵
  PID:2700
- C:\Windows\System\YMDqTDu.exe
  C:\Windows\System\YMDqTDu.exe
  2⤵
  PID:324
- C:\Windows\System\UhHZvym.exe
  C:\Windows\System\UhHZvym.exe
  2⤵
  PID:2776
- C:\Windows\System\yJZSImN.exe
  C:\Windows\System\yJZSImN.exe
  2⤵
  PID:1032
- C:\Windows\System\lwpUBpg.exe
  C:\Windows\System\lwpUBpg.exe
  2⤵
  PID:1328
- C:\Windows\System\nOFmiRb.exe
  C:\Windows\System\nOFmiRb.exe
  2⤵
  PID:1268
- C:\Windows\System\bNFTINi.exe
  C:\Windows\System\bNFTINi.exe
  2⤵
  PID:580
- C:\Windows\System\DqsVjmk.exe
  C:\Windows\System\DqsVjmk.exe
  2⤵
  PID:1444
- C:\Windows\System\KkcyMNz.exe
  C:\Windows\System\KkcyMNz.exe
  2⤵
  PID:1820
- C:\Windows\System\qJBIqhd.exe
  C:\Windows\System\qJBIqhd.exe
  2⤵
  PID:1796
- C:\Windows\System\wbSbVje.exe
  C:\Windows\System\wbSbVje.exe
  2⤵
  PID:1540
- C:\Windows\System\FCCNBtq.exe
  C:\Windows\System\FCCNBtq.exe
  2⤵
  PID:1140
- C:\Windows\System\tcNDkUQ.exe
  C:\Windows\System\tcNDkUQ.exe
  2⤵
  PID:2972
- C:\Windows\System\cuTtrnz.exe
  C:\Windows\System\cuTtrnz.exe
  2⤵
  PID:1340
- C:\Windows\System\hekSqMK.exe
  C:\Windows\System\hekSqMK.exe
  2⤵
  PID:1840
- C:\Windows\System\VHlxpgD.exe
  C:\Windows\System\VHlxpgD.exe
  2⤵
  PID:276
- C:\Windows\System\JabJQaL.exe
  C:\Windows\System\JabJQaL.exe
  2⤵
  PID:1780
- C:\Windows\System\zmDPYkX.exe
  C:\Windows\System\zmDPYkX.exe
  2⤵
  PID:1648
- C:\Windows\System\GPhODDE.exe
  C:\Windows\System\GPhODDE.exe
  2⤵
  PID:3004
- C:\Windows\System\VtAYiXF.exe
  C:\Windows\System\VtAYiXF.exe
  2⤵
  PID:3000
- C:\Windows\System\NaEkwcq.exe
  C:\Windows\System\NaEkwcq.exe
  2⤵
  PID:1824
- C:\Windows\System\BIpLCJy.exe
  C:\Windows\System\BIpLCJy.exe
  2⤵
  PID:2100
- C:\Windows\System\UYTevDT.exe
  C:\Windows\System\UYTevDT.exe
  2⤵
  PID:2176
- C:\Windows\System\bxerrBo.exe
  C:\Windows\System\bxerrBo.exe
  2⤵
  PID:1968
- C:\Windows\System\VSWdJAE.exe
  C:\Windows\System\VSWdJAE.exe
  2⤵
  PID:2036
- C:\Windows\System\fWQPdxn.exe
  C:\Windows\System\fWQPdxn.exe
  2⤵
  PID:576
- C:\Windows\System\fUoVWFC.exe
  C:\Windows\System\fUoVWFC.exe
  2⤵
  PID:2716
- C:\Windows\System\jnvAHRy.exe
  C:\Windows\System\jnvAHRy.exe
  2⤵
  PID:2440
- C:\Windows\System\lYdnFgk.exe
  C:\Windows\System\lYdnFgk.exe
  2⤵
  PID:2840
- C:\Windows\System\AGxTrQn.exe
  C:\Windows\System\AGxTrQn.exe
  2⤵
  PID:2504
- C:\Windows\System\JwhByLC.exe
  C:\Windows\System\JwhByLC.exe
  2⤵
  PID:2660
- C:\Windows\System\KSsNEsK.exe
  C:\Windows\System\KSsNEsK.exe
  2⤵
  PID:2964
- C:\Windows\System\ztivNGX.exe
  C:\Windows\System\ztivNGX.exe
  2⤵
  PID:1692
- C:\Windows\System\bdxCxjm.exe
  C:\Windows\System\bdxCxjm.exe
  2⤵
  PID:392
- C:\Windows\System\DjHEnlb.exe
  C:\Windows\System\DjHEnlb.exe
  2⤵
  PID:2524
- C:\Windows\System\LCfujuu.exe
  C:\Windows\System\LCfujuu.exe
  2⤵
  PID:860
- C:\Windows\System\wDTIgYm.exe
  C:\Windows\System\wDTIgYm.exe
  2⤵
  PID:2068
- C:\Windows\System\FskSoDV.exe
  C:\Windows\System\FskSoDV.exe
  2⤵
  PID:3088
- C:\Windows\System\GkAKXRs.exe
  C:\Windows\System\GkAKXRs.exe
  2⤵
  PID:3104
- C:\Windows\System\MqMaXlu.exe
  C:\Windows\System\MqMaXlu.exe
  2⤵
  PID:3120
- C:\Windows\System\OUVPTmr.exe
  C:\Windows\System\OUVPTmr.exe
  2⤵
  PID:3136
- C:\Windows\System\JzVPbyV.exe
  C:\Windows\System\JzVPbyV.exe
  2⤵
  PID:3152
- C:\Windows\System\TKmfDRP.exe
  C:\Windows\System\TKmfDRP.exe
  2⤵
  PID:3172
- C:\Windows\System\aKEceFm.exe
  C:\Windows\System\aKEceFm.exe
  2⤵
  PID:3188
- C:\Windows\System\CMqdJNB.exe
  C:\Windows\System\CMqdJNB.exe
  2⤵
  PID:3204
- C:\Windows\System\ksRXXTT.exe
  C:\Windows\System\ksRXXTT.exe
  2⤵
  PID:3220
- C:\Windows\System\xbSqLni.exe
  C:\Windows\System\xbSqLni.exe
  2⤵
  PID:3236
- C:\Windows\System\EvXTHlc.exe
  C:\Windows\System\EvXTHlc.exe
  2⤵
  PID:3252
- C:\Windows\System\xtWNpMJ.exe
  C:\Windows\System\xtWNpMJ.exe
  2⤵
  PID:3268
- C:\Windows\System\bNYFzBy.exe
  C:\Windows\System\bNYFzBy.exe
  2⤵
  PID:3284
- C:\Windows\System\SWNWPab.exe
  C:\Windows\System\SWNWPab.exe
  2⤵
  PID:3300
- C:\Windows\System\GqvUJTl.exe
  C:\Windows\System\GqvUJTl.exe
  2⤵
  PID:3316
- C:\Windows\System\OaFdJDE.exe
  C:\Windows\System\OaFdJDE.exe
  2⤵
  PID:3332
- C:\Windows\System\UjaLAwF.exe
  C:\Windows\System\UjaLAwF.exe
  2⤵
  PID:3348
- C:\Windows\System\VThYvae.exe
  C:\Windows\System\VThYvae.exe
  2⤵
  PID:3364
- C:\Windows\System\zAdILKi.exe
  C:\Windows\System\zAdILKi.exe
  2⤵
  PID:3380
- C:\Windows\System\jquxaNt.exe
  C:\Windows\System\jquxaNt.exe
  2⤵
  PID:3396
- C:\Windows\System\GMlsopj.exe
  C:\Windows\System\GMlsopj.exe
  2⤵
  PID:3412
- C:\Windows\System\ZwbQMEp.exe
  C:\Windows\System\ZwbQMEp.exe
  2⤵
  PID:3428
- C:\Windows\System\jJWNkyp.exe
  C:\Windows\System\jJWNkyp.exe
  2⤵
  PID:3444
- C:\Windows\System\kGXEgJU.exe
  C:\Windows\System\kGXEgJU.exe
  2⤵
  PID:3460
- C:\Windows\System\fynbjha.exe
  C:\Windows\System\fynbjha.exe
  2⤵
  PID:3476
- C:\Windows\System\MVznKVE.exe
  C:\Windows\System\MVznKVE.exe
  2⤵
  PID:3492
- C:\Windows\System\OIzmTwJ.exe
  C:\Windows\System\OIzmTwJ.exe
  2⤵
  PID:3508
- C:\Windows\System\ASFVjKa.exe
  C:\Windows\System\ASFVjKa.exe
  2⤵
  PID:3524
- C:\Windows\System\QnwfmOR.exe
  C:\Windows\System\QnwfmOR.exe
  2⤵
  PID:3540
- C:\Windows\System\eOygSNq.exe
  C:\Windows\System\eOygSNq.exe
  2⤵
  PID:3556
- C:\Windows\System\LIGhMNR.exe
  C:\Windows\System\LIGhMNR.exe
  2⤵
  PID:3572
- C:\Windows\System\RYWEpQR.exe
  C:\Windows\System\RYWEpQR.exe
  2⤵
  PID:3588
- C:\Windows\System\TmARUIB.exe
  C:\Windows\System\TmARUIB.exe
  2⤵
  PID:3604
- C:\Windows\System\bLgTbrX.exe
  C:\Windows\System\bLgTbrX.exe
  2⤵
  PID:3620
- C:\Windows\System\qoAGlfM.exe
  C:\Windows\System\qoAGlfM.exe
  2⤵
  PID:3636
- C:\Windows\System\uNAnbkG.exe
  C:\Windows\System\uNAnbkG.exe
  2⤵
  PID:3652
- C:\Windows\System\vdgmhOh.exe
  C:\Windows\System\vdgmhOh.exe
  2⤵
  PID:3668
- C:\Windows\System\jXHIwtt.exe
  C:\Windows\System\jXHIwtt.exe
  2⤵
  PID:3684
- C:\Windows\System\FxTxOgA.exe
  C:\Windows\System\FxTxOgA.exe
  2⤵
  PID:3700
- C:\Windows\System\GcORmHd.exe
  C:\Windows\System\GcORmHd.exe
  2⤵
  PID:3716
- C:\Windows\System\jgRewWC.exe
  C:\Windows\System\jgRewWC.exe
  2⤵
  PID:3732
- C:\Windows\System\WzTiFzC.exe
  C:\Windows\System\WzTiFzC.exe
  2⤵
  PID:3748
- C:\Windows\System\DWpTRZN.exe
  C:\Windows\System\DWpTRZN.exe
  2⤵
  PID:3764
- C:\Windows\System\gOlOHrW.exe
  C:\Windows\System\gOlOHrW.exe
  2⤵
  PID:3780
- C:\Windows\System\PKXyAyK.exe
  C:\Windows\System\PKXyAyK.exe
  2⤵
  PID:3796
- C:\Windows\System\CmhhIoe.exe
  C:\Windows\System\CmhhIoe.exe
  2⤵
  PID:3812
- C:\Windows\System\PLqBoYu.exe
  C:\Windows\System\PLqBoYu.exe
  2⤵
  PID:3828
- C:\Windows\System\QZAVzJZ.exe
  C:\Windows\System\QZAVzJZ.exe
  2⤵
  PID:3844
- C:\Windows\System\wentbIP.exe
  C:\Windows\System\wentbIP.exe
  2⤵
  PID:3860
- C:\Windows\System\hVJXCmg.exe
  C:\Windows\System\hVJXCmg.exe
  2⤵
  PID:3876
- C:\Windows\System\SPenOBT.exe
  C:\Windows\System\SPenOBT.exe
  2⤵
  PID:3892
- C:\Windows\System\VxSXJwD.exe
  C:\Windows\System\VxSXJwD.exe
  2⤵
  PID:3908
- C:\Windows\System\YsIZWZo.exe
  C:\Windows\System\YsIZWZo.exe
  2⤵
  PID:3924
- C:\Windows\System\OtZRbnb.exe
  C:\Windows\System\OtZRbnb.exe
  2⤵
  PID:3940
- C:\Windows\System\TdcNRIs.exe
  C:\Windows\System\TdcNRIs.exe
  2⤵
  PID:3956
- C:\Windows\System\fhpUMyJ.exe
  C:\Windows\System\fhpUMyJ.exe
  2⤵
  PID:3972
- C:\Windows\System\QKCytNO.exe
  C:\Windows\System\QKCytNO.exe
  2⤵
  PID:3988
- C:\Windows\System\eLCJxnc.exe
  C:\Windows\System\eLCJxnc.exe
  2⤵
  PID:4004
- C:\Windows\System\rIzoMwO.exe
  C:\Windows\System\rIzoMwO.exe
  2⤵
  PID:4020
- C:\Windows\System\bplDhqs.exe
  C:\Windows\System\bplDhqs.exe
  2⤵
  PID:4036
- C:\Windows\System\NXKWXuv.exe
  C:\Windows\System\NXKWXuv.exe
  2⤵
  PID:4052
- C:\Windows\System\EXDltoM.exe
  C:\Windows\System\EXDltoM.exe
  2⤵
  PID:4068
- C:\Windows\System\snbLNYq.exe
  C:\Windows\System\snbLNYq.exe
  2⤵
  PID:4084
- C:\Windows\System\sEHIxxt.exe
  C:\Windows\System\sEHIxxt.exe
  2⤵
  PID:2408
- C:\Windows\System\OdaDjsz.exe
  C:\Windows\System\OdaDjsz.exe
  2⤵
  PID:2096
- C:\Windows\System\eWwyhQs.exe
  C:\Windows\System\eWwyhQs.exe
  2⤵
  PID:1512
- C:\Windows\System\RnBisJe.exe
  C:\Windows\System\RnBisJe.exe
  2⤵
  PID:1556
- C:\Windows\System\dMykOGY.exe
  C:\Windows\System\dMykOGY.exe
  2⤵
  PID:1400
- C:\Windows\System\NwqSggx.exe
  C:\Windows\System\NwqSggx.exe
  2⤵
  PID:2748
- C:\Windows\System\Zzyivpq.exe
  C:\Windows\System\Zzyivpq.exe
  2⤵
  PID:2512
- C:\Windows\System\VsKwDUT.exe
  C:\Windows\System\VsKwDUT.exe
  2⤵
  PID:2292
- C:\Windows\System\tsrvurQ.exe
  C:\Windows\System\tsrvurQ.exe
  2⤵
  PID:1504
- C:\Windows\System\uFgJknc.exe
  C:\Windows\System\uFgJknc.exe
  2⤵
  PID:1576
- C:\Windows\System\TugAzpq.exe
  C:\Windows\System\TugAzpq.exe
  2⤵
  PID:2632
- C:\Windows\System\JeKGwkB.exe
  C:\Windows\System\JeKGwkB.exe
  2⤵
  PID:1704
- C:\Windows\System\EWYQxDw.exe
  C:\Windows\System\EWYQxDw.exe
  2⤵
  PID:1980
- C:\Windows\System\sjBnBXm.exe
  C:\Windows\System\sjBnBXm.exe
  2⤵
  PID:1048
- C:\Windows\System\sYSEHat.exe
  C:\Windows\System\sYSEHat.exe
  2⤵
  PID:2668
- C:\Windows\System\cCobMrv.exe
  C:\Windows\System\cCobMrv.exe
  2⤵
  PID:3084
- C:\Windows\System\VCvfiCu.exe
  C:\Windows\System\VCvfiCu.exe
  2⤵
  PID:3100
- C:\Windows\System\tSDcQaS.exe
  C:\Windows\System\tSDcQaS.exe
  2⤵
  PID:3148
- C:\Windows\System\pEltmKq.exe
  C:\Windows\System\pEltmKq.exe
  2⤵
  PID:3184
- C:\Windows\System\ANNzUVm.exe
  C:\Windows\System\ANNzUVm.exe
  2⤵
  PID:3216
- C:\Windows\System\GlzLuNq.exe
  C:\Windows\System\GlzLuNq.exe
  2⤵
  PID:3248
- C:\Windows\System\QbvSunf.exe
  C:\Windows\System\QbvSunf.exe
  2⤵
  PID:3264
- C:\Windows\System\kbmxiQE.exe
  C:\Windows\System\kbmxiQE.exe
  2⤵
  PID:3296
- C:\Windows\System\LOEGNDm.exe
  C:\Windows\System\LOEGNDm.exe
  2⤵
  PID:3344
- C:\Windows\System\vSPsliy.exe
  C:\Windows\System\vSPsliy.exe
  2⤵
  PID:3376
- C:\Windows\System\SmmytvY.exe
  C:\Windows\System\SmmytvY.exe
  2⤵
  PID:3408
- C:\Windows\System\KxoNXsL.exe
  C:\Windows\System\KxoNXsL.exe
  2⤵
  PID:3440
- C:\Windows\System\uecyAMd.exe
  C:\Windows\System\uecyAMd.exe
  2⤵
  PID:3472
- C:\Windows\System\xcDriEr.exe
  C:\Windows\System\xcDriEr.exe
  2⤵
  PID:3504
- C:\Windows\System\UbaqqQv.exe
  C:\Windows\System\UbaqqQv.exe
  2⤵
  PID:3536
- C:\Windows\System\gIekHYo.exe
  C:\Windows\System\gIekHYo.exe
  2⤵
  PID:3568
- C:\Windows\System\NSqxUdy.exe
  C:\Windows\System\NSqxUdy.exe
  2⤵
  PID:3584
- C:\Windows\System\dSdFPTE.exe
  C:\Windows\System\dSdFPTE.exe
  2⤵
  PID:3616
- C:\Windows\System\YFmYVTb.exe
  C:\Windows\System\YFmYVTb.exe
  2⤵
  PID:3660
- C:\Windows\System\tZyXlqV.exe
  C:\Windows\System\tZyXlqV.exe
  2⤵
  PID:3676
- C:\Windows\System\ZPemVnS.exe
  C:\Windows\System\ZPemVnS.exe
  2⤵
  PID:3724
- C:\Windows\System\vtetOQJ.exe
  C:\Windows\System\vtetOQJ.exe
  2⤵
  PID:3756
- C:\Windows\System\LPwCrpI.exe
  C:\Windows\System\LPwCrpI.exe
  2⤵
  PID:3772
- C:\Windows\System\lRxHVOQ.exe
  C:\Windows\System\lRxHVOQ.exe
  2⤵
  PID:3820
- C:\Windows\System\zbDOmfK.exe
  C:\Windows\System\zbDOmfK.exe
  2⤵
  PID:3852
- C:\Windows\System\zKXfVpV.exe
  C:\Windows\System\zKXfVpV.exe
  2⤵
  PID:3884
- C:\Windows\System\YIafpzi.exe
  C:\Windows\System\YIafpzi.exe
  2⤵
  PID:3916
- C:\Windows\System\BfxSLge.exe
  C:\Windows\System\BfxSLge.exe
  2⤵
  PID:3952
- C:\Windows\System\YGjPwSJ.exe
  C:\Windows\System\YGjPwSJ.exe
  2⤵
  PID:3964
- C:\Windows\System\VNGvVBm.exe
  C:\Windows\System\VNGvVBm.exe
  2⤵
  PID:4016
- C:\Windows\System\bSLYEbM.exe
  C:\Windows\System\bSLYEbM.exe
  2⤵
  PID:4044
- C:\Windows\System\CnqeLfR.exe
  C:\Windows\System\CnqeLfR.exe
  2⤵
  PID:4076
- C:\Windows\System\qdrHano.exe
  C:\Windows\System\qdrHano.exe
  2⤵
  PID:848
- C:\Windows\System\uKpUlqD.exe
  C:\Windows\System\uKpUlqD.exe
  2⤵
  PID:2116
- C:\Windows\System\dyjUtkN.exe
  C:\Windows\System\dyjUtkN.exe
  2⤵
  PID:1312
- C:\Windows\System\kVzotau.exe
  C:\Windows\System\kVzotau.exe
  2⤵
  PID:1736
- C:\Windows\System\VGjUewZ.exe
  C:\Windows\System\VGjUewZ.exe
  2⤵
  PID:908
- C:\Windows\System\jcIJtha.exe
  C:\Windows\System\jcIJtha.exe
  2⤵
  PID:2452
- C:\Windows\System\STEEMZH.exe
  C:\Windows\System\STEEMZH.exe
  2⤵
  PID:2556
- C:\Windows\System\ysLoqEG.exe
  C:\Windows\System\ysLoqEG.exe
  2⤵
  PID:2516
- C:\Windows\System\iFTvFBS.exe
  C:\Windows\System\iFTvFBS.exe
  2⤵
  PID:3096
- C:\Windows\System\zLlgTHw.exe
  C:\Windows\System\zLlgTHw.exe
  2⤵
  PID:3168
- C:\Windows\System\RprQLba.exe
  C:\Windows\System\RprQLba.exe
  2⤵
  PID:3232
- C:\Windows\System\gZLxsUs.exe
  C:\Windows\System\gZLxsUs.exe
  2⤵
  PID:3312
- C:\Windows\System\nHKFuuZ.exe
  C:\Windows\System\nHKFuuZ.exe
  2⤵
  PID:3392
- C:\Windows\System\lcjShyJ.exe
  C:\Windows\System\lcjShyJ.exe
  2⤵
  PID:3436
- C:\Windows\System\fRogqIi.exe
  C:\Windows\System\fRogqIi.exe
  2⤵
  PID:3532
- C:\Windows\System\oInNEuD.exe
  C:\Windows\System\oInNEuD.exe
  2⤵
  PID:3488
- C:\Windows\System\HKblWOv.exe
  C:\Windows\System\HKblWOv.exe
  2⤵
  PID:3612
- C:\Windows\System\PuDbURA.exe
  C:\Windows\System\PuDbURA.exe
  2⤵
  PID:3696
- C:\Windows\System\ttzYiKu.exe
  C:\Windows\System\ttzYiKu.exe
  2⤵
  PID:3760
- C:\Windows\System\XzrKens.exe
  C:\Windows\System\XzrKens.exe
  2⤵
  PID:3872
- C:\Windows\System\mULVrpe.exe
  C:\Windows\System\mULVrpe.exe
  2⤵
  PID:3936
- C:\Windows\System\ZkeBZqZ.exe
  C:\Windows\System\ZkeBZqZ.exe
  2⤵
  PID:4112
- C:\Windows\System\aDJryZP.exe
  C:\Windows\System\aDJryZP.exe
  2⤵
  PID:4128
- C:\Windows\System\zpeipIT.exe
  C:\Windows\System\zpeipIT.exe
  2⤵
  PID:4144
- C:\Windows\System\CuHhOcr.exe
  C:\Windows\System\CuHhOcr.exe
  2⤵
  PID:4160
- C:\Windows\System\UYpzkJB.exe
  C:\Windows\System\UYpzkJB.exe
  2⤵
  PID:4176
- C:\Windows\System\WBymlEG.exe
  C:\Windows\System\WBymlEG.exe
  2⤵
  PID:4192
- C:\Windows\System\LcJSwNH.exe
  C:\Windows\System\LcJSwNH.exe
  2⤵
  PID:4208
- C:\Windows\System\GLCGfGw.exe
  C:\Windows\System\GLCGfGw.exe
  2⤵
  PID:4224
- C:\Windows\System\xPcQlwx.exe
  C:\Windows\System\xPcQlwx.exe
  2⤵
  PID:4240
- C:\Windows\System\GayYdAW.exe
  C:\Windows\System\GayYdAW.exe
  2⤵
  PID:4256
- C:\Windows\System\yDDEBpy.exe
  C:\Windows\System\yDDEBpy.exe
  2⤵
  PID:4272
- C:\Windows\System\hKkvQsJ.exe
  C:\Windows\System\hKkvQsJ.exe
  2⤵
  PID:4288
- C:\Windows\System\IvSrQgz.exe
  C:\Windows\System\IvSrQgz.exe
  2⤵
  PID:4304
- C:\Windows\System\vYnxfMY.exe
  C:\Windows\System\vYnxfMY.exe
  2⤵
  PID:4320
- C:\Windows\System\mQvbQba.exe
  C:\Windows\System\mQvbQba.exe
  2⤵
  PID:4336
- C:\Windows\System\QeesfHV.exe
  C:\Windows\System\QeesfHV.exe
  2⤵
  PID:4352
- C:\Windows\System\ajaZmjI.exe
  C:\Windows\System\ajaZmjI.exe
  2⤵
  PID:4372
- C:\Windows\System\RKpDVYW.exe
  C:\Windows\System\RKpDVYW.exe
  2⤵
  PID:4388
- C:\Windows\System\jmHRxbr.exe
  C:\Windows\System\jmHRxbr.exe
  2⤵
  PID:4404
- C:\Windows\System\oWxAOIa.exe
  C:\Windows\System\oWxAOIa.exe
  2⤵
  PID:4420
- C:\Windows\System\BWLPQTP.exe
  C:\Windows\System\BWLPQTP.exe
  2⤵
  PID:4436
- C:\Windows\System\ecssDxK.exe
  C:\Windows\System\ecssDxK.exe
  2⤵
  PID:4452
- C:\Windows\System\xNDzbPm.exe
  C:\Windows\System\xNDzbPm.exe
  2⤵
  PID:4468
- C:\Windows\System\OGSYvwX.exe
  C:\Windows\System\OGSYvwX.exe
  2⤵
  PID:4484
- C:\Windows\System\IMUMXHU.exe
  C:\Windows\System\IMUMXHU.exe
  2⤵
  PID:4500
- C:\Windows\System\AcorUyk.exe
  C:\Windows\System\AcorUyk.exe
  2⤵
  PID:4516
- C:\Windows\System\yzvjxet.exe
  C:\Windows\System\yzvjxet.exe
  2⤵
  PID:4532
- C:\Windows\System\cTNEHLX.exe
  C:\Windows\System\cTNEHLX.exe
  2⤵
  PID:4548
- C:\Windows\System\sgoRzUh.exe
  C:\Windows\System\sgoRzUh.exe
  2⤵
  PID:4564
- C:\Windows\System\QOmWacf.exe
  C:\Windows\System\QOmWacf.exe
  2⤵
  PID:4580
- C:\Windows\System\hKqLmqk.exe
  C:\Windows\System\hKqLmqk.exe
  2⤵
  PID:4596
- C:\Windows\System\EeUfaCj.exe
  C:\Windows\System\EeUfaCj.exe
  2⤵
  PID:4612
- C:\Windows\System\aMEqslV.exe
  C:\Windows\System\aMEqslV.exe
  2⤵
  PID:4628
- C:\Windows\System\YOokeYx.exe
  C:\Windows\System\YOokeYx.exe
  2⤵
  PID:4644
- C:\Windows\System\HHPJQTt.exe
  C:\Windows\System\HHPJQTt.exe
  2⤵
  PID:4660
- C:\Windows\System\aAdWdYh.exe
  C:\Windows\System\aAdWdYh.exe
  2⤵
  PID:4676
- C:\Windows\System\gFpumWA.exe
  C:\Windows\System\gFpumWA.exe
  2⤵
  PID:4692
- C:\Windows\System\PLdFpFu.exe
  C:\Windows\System\PLdFpFu.exe
  2⤵
  PID:4708
- C:\Windows\System\xDhaFiP.exe
  C:\Windows\System\xDhaFiP.exe
  2⤵
  PID:4724
- C:\Windows\System\hkxBktE.exe
  C:\Windows\System\hkxBktE.exe
  2⤵
  PID:4740
- C:\Windows\System\zEuhikP.exe
  C:\Windows\System\zEuhikP.exe
  2⤵
  PID:4756
- C:\Windows\System\arcbfQs.exe
  C:\Windows\System\arcbfQs.exe
  2⤵
  PID:4772
- C:\Windows\System\asUpwiI.exe
  C:\Windows\System\asUpwiI.exe
  2⤵
  PID:4788
- C:\Windows\System\HRKgzve.exe
  C:\Windows\System\HRKgzve.exe
  2⤵
  PID:4804
- C:\Windows\System\JcGlMNP.exe
  C:\Windows\System\JcGlMNP.exe
  2⤵
  PID:4820
- C:\Windows\System\odCPZJX.exe
  C:\Windows\System\odCPZJX.exe
  2⤵
  PID:4836
- C:\Windows\System\UFulDzZ.exe
  C:\Windows\System\UFulDzZ.exe
  2⤵
  PID:4852
- C:\Windows\System\TuswgBl.exe
  C:\Windows\System\TuswgBl.exe
  2⤵
  PID:4868
- C:\Windows\System\HOxXcDa.exe
  C:\Windows\System\HOxXcDa.exe
  2⤵
  PID:4884
- C:\Windows\System\TIomxDp.exe
  C:\Windows\System\TIomxDp.exe
  2⤵
  PID:4900
- C:\Windows\System\tcSlukb.exe
  C:\Windows\System\tcSlukb.exe
  2⤵
  PID:4916
- C:\Windows\System\WxZwmTm.exe
  C:\Windows\System\WxZwmTm.exe
  2⤵
  PID:4932
- C:\Windows\System\ovyeNTH.exe
  C:\Windows\System\ovyeNTH.exe
  2⤵
  PID:4948
- C:\Windows\System\NLqzdyD.exe
  C:\Windows\System\NLqzdyD.exe
  2⤵
  PID:4964
- C:\Windows\System\silBOCY.exe
  C:\Windows\System\silBOCY.exe
  2⤵
  PID:4980
- C:\Windows\System\jgmYuri.exe
  C:\Windows\System\jgmYuri.exe
  2⤵
  PID:4996
- C:\Windows\System\VmzetgO.exe
  C:\Windows\System\VmzetgO.exe
  2⤵
  PID:5012
- C:\Windows\System\QticfVJ.exe
  C:\Windows\System\QticfVJ.exe
  2⤵
  PID:5028
- C:\Windows\System\DyQntYJ.exe
  C:\Windows\System\DyQntYJ.exe
  2⤵
  PID:5044
- C:\Windows\System\TFxGsGp.exe
  C:\Windows\System\TFxGsGp.exe
  2⤵
  PID:5060
- C:\Windows\System\qBVncYc.exe
  C:\Windows\System\qBVncYc.exe
  2⤵
  PID:5076
- C:\Windows\System\RMnIpyR.exe
  C:\Windows\System\RMnIpyR.exe
  2⤵
  PID:5092
- C:\Windows\System\pkNKwUF.exe
  C:\Windows\System\pkNKwUF.exe
  2⤵
  PID:5108
- C:\Windows\System\uiBdTjw.exe
  C:\Windows\System\uiBdTjw.exe
  2⤵
  PID:4028
- C:\Windows\System\LGAvfjv.exe
  C:\Windows\System\LGAvfjv.exe
  2⤵
  PID:3804
- C:\Windows\System\GyLHyuI.exe
  C:\Windows\System\GyLHyuI.exe
  2⤵
  PID:3948
- C:\Windows\System\pQCUxuA.exe
  C:\Windows\System\pQCUxuA.exe
  2⤵
  PID:4060
- C:\Windows\System\wSbWGyJ.exe
  C:\Windows\System\wSbWGyJ.exe
  2⤵
  PID:1708
- C:\Windows\System\SVTOsax.exe
  C:\Windows\System\SVTOsax.exe
  2⤵
  PID:2852
- C:\Windows\System\bYWIqOZ.exe
  C:\Windows\System\bYWIqOZ.exe
  2⤵
  PID:3244
- C:\Windows\System\wZccMpI.exe
  C:\Windows\System\wZccMpI.exe
  2⤵
  PID:3372
- C:\Windows\System\PtCNADK.exe
  C:\Windows\System\PtCNADK.exe
  2⤵
  PID:3160
- C:\Windows\System\czDbdma.exe
  C:\Windows\System\czDbdma.exe
  2⤵
  PID:3064
- C:\Windows\System\POPPiwv.exe
  C:\Windows\System\POPPiwv.exe
  2⤵
  PID:3452
- C:\Windows\System\rjFyAzq.exe
  C:\Windows\System\rjFyAzq.exe
  2⤵
  PID:3580
- C:\Windows\System\CEvyXCc.exe
  C:\Windows\System\CEvyXCc.exe
  2⤵
  PID:3740
- C:\Windows\System\ahdqolW.exe
  C:\Windows\System\ahdqolW.exe
  2⤵
  PID:3824
- C:\Windows\System\iJRGRcu.exe
  C:\Windows\System\iJRGRcu.exe
  2⤵
  PID:4124
- C:\Windows\System\VboEWAX.exe
  C:\Windows\System\VboEWAX.exe
  2⤵
  PID:4184
- C:\Windows\System\ZlMroZn.exe
  C:\Windows\System\ZlMroZn.exe
  2⤵
  PID:3016
- C:\Windows\System\tBsktSC.exe
  C:\Windows\System\tBsktSC.exe
  2⤵
  PID:4140
- C:\Windows\System\WrIGPID.exe
  C:\Windows\System\WrIGPID.exe
  2⤵
  PID:4168
- C:\Windows\System\arsjmxb.exe
  C:\Windows\System\arsjmxb.exe
  2⤵
  PID:4280
- C:\Windows\System\fukpabY.exe
  C:\Windows\System\fukpabY.exe
  2⤵
  PID:4296
- C:\Windows\System\TgVIIWr.exe
  C:\Windows\System\TgVIIWr.exe
  2⤵
  PID:4344
- C:\Windows\System\suInctF.exe
  C:\Windows\System\suInctF.exe
  2⤵
  PID:4360
- C:\Windows\System\FYFdfcX.exe
  C:\Windows\System\FYFdfcX.exe
  2⤵
  PID:4396
- C:\Windows\System\ZbMpLfL.exe
  C:\Windows\System\ZbMpLfL.exe
  2⤵
  PID:4416
- C:\Windows\System\skYKZET.exe
  C:\Windows\System\skYKZET.exe
  2⤵
  PID:4448
- C:\Windows\System\vuDDcTE.exe
  C:\Windows\System\vuDDcTE.exe
  2⤵
  PID:4608
- C:\Windows\System\XcAgFTc.exe
  C:\Windows\System\XcAgFTc.exe
  2⤵
  PID:2856
- C:\Windows\System\FjCPexd.exe
  C:\Windows\System\FjCPexd.exe
  2⤵
  PID:2804
- C:\Windows\System\rYLPEZt.exe
  C:\Windows\System\rYLPEZt.exe
  2⤵
  PID:4832
- C:\Windows\System\kHVxXaa.exe
  C:\Windows\System\kHVxXaa.exe
  2⤵
  PID:4896
- C:\Windows\System\TigkXnH.exe
  C:\Windows\System\TigkXnH.exe
  2⤵
  PID:4960
- C:\Windows\System\KHTqyUu.exe
  C:\Windows\System\KHTqyUu.exe
  2⤵
  PID:5020
- C:\Windows\System\fCbDXHJ.exe
  C:\Windows\System\fCbDXHJ.exe
  2⤵
  PID:5088
- C:\Windows\System\TbtYOCe.exe
  C:\Windows\System\TbtYOCe.exe
  2⤵
  PID:3920
- C:\Windows\System\VfXUQDU.exe
  C:\Windows\System\VfXUQDU.exe
  2⤵
  PID:3128
- C:\Windows\System\HIefkSd.exe
  C:\Windows\System\HIefkSd.exe
  2⤵
  PID:3456
- C:\Windows\System\MpHfFPd.exe
  C:\Windows\System\MpHfFPd.exe
  2⤵
  PID:4104
- C:\Windows\System\bibXSoP.exe
  C:\Windows\System\bibXSoP.exe
  2⤵
  PID:4172
- C:\Windows\System\vtAXjRU.exe
  C:\Windows\System\vtAXjRU.exe
  2⤵
  PID:4328
- C:\Windows\System\lanMVcd.exe
  C:\Windows\System\lanMVcd.exe
  2⤵
  PID:4752
- C:\Windows\System\SJonIRs.exe
  C:\Windows\System\SJonIRs.exe
  2⤵
  PID:4880
- C:\Windows\System\tGqNjDT.exe
  C:\Windows\System\tGqNjDT.exe
  2⤵
  PID:4944
- C:\Windows\System\BzuruMp.exe
  C:\Windows\System\BzuruMp.exe
  2⤵
  PID:5008
- C:\Windows\System\KRUNUjp.exe
  C:\Windows\System\KRUNUjp.exe
  2⤵
  PID:5072
- C:\Windows\System\LvwhQAy.exe
  C:\Windows\System\LvwhQAy.exe
  2⤵
  PID:4092
- C:\Windows\System\gwnuese.exe
  C:\Windows\System\gwnuese.exe
  2⤵
  PID:2484
- C:\Windows\System\WcVrZqQ.exe
  C:\Windows\System\WcVrZqQ.exe
  2⤵
  PID:2976
- C:\Windows\System\lXaabKY.exe
  C:\Windows\System\lXaabKY.exe
  2⤵
  PID:3664
- C:\Windows\System\cPkKvrn.exe
  C:\Windows\System\cPkKvrn.exe
  2⤵
  PID:4136
- C:\Windows\System\YlFKnxG.exe
  C:\Windows\System\YlFKnxG.exe
  2⤵
  PID:4316
- C:\Windows\System\fBVQrwH.exe
  C:\Windows\System\fBVQrwH.exe
  2⤵
  PID:4444
- C:\Windows\System\rQCSqTR.exe
  C:\Windows\System\rQCSqTR.exe
  2⤵
  PID:4640
- C:\Windows\System\cXTNkqk.exe
  C:\Windows\System\cXTNkqk.exe
  2⤵
  PID:4704
- C:\Windows\System\lFXuqWg.exe
  C:\Windows\System\lFXuqWg.exe
  2⤵
  PID:4768
- C:\Windows\System\FOXhTpI.exe
  C:\Windows\System\FOXhTpI.exe
  2⤵
  PID:4656
- C:\Windows\System\uZbWTQW.exe
  C:\Windows\System\uZbWTQW.exe
  2⤵
  PID:4592
- C:\Windows\System\qjGBQeR.exe
  C:\Windows\System\qjGBQeR.exe
  2⤵
  PID:1788
- C:\Windows\System\ZCBTtSV.exe
  C:\Windows\System\ZCBTtSV.exe
  2⤵
  PID:1948
- C:\Windows\System\GdaXMwy.exe
  C:\Windows\System\GdaXMwy.exe
  2⤵
  PID:1784
- C:\Windows\System\piJssML.exe
  C:\Windows\System\piJssML.exe
  2⤵
  PID:2648
- C:\Windows\System\NxveazM.exe
  C:\Windows\System\NxveazM.exe
  2⤵
  PID:2724
- C:\Windows\System\GXpyTyt.exe
  C:\Windows\System\GXpyTyt.exe
  2⤵
  PID:4864
- C:\Windows\System\KzJrVBW.exe
  C:\Windows\System\KzJrVBW.exe
  2⤵
  PID:3868
- C:\Windows\System\eWUzpVx.exe
  C:\Windows\System\eWUzpVx.exe
  2⤵
  PID:2920
- C:\Windows\System\WMhopWi.exe
  C:\Windows\System\WMhopWi.exe
  2⤵
  PID:2864
- C:\Windows\System\NbfMvBL.exe
  C:\Windows\System\NbfMvBL.exe
  2⤵
  PID:5040
- C:\Windows\System\OEkVCAr.exe
  C:\Windows\System\OEkVCAr.exe
  2⤵
  PID:1612
- C:\Windows\System\IuBHJcP.exe
  C:\Windows\System\IuBHJcP.exe
  2⤵
  PID:4928
- C:\Windows\System\cQyOhyM.exe
  C:\Windows\System\cQyOhyM.exe
  2⤵
  PID:5084
- C:\Windows\System\nOOaONE.exe
  C:\Windows\System\nOOaONE.exe
  2⤵
  PID:4312
- C:\Windows\System\PRCyjzF.exe
  C:\Windows\System\PRCyjzF.exe
  2⤵
  PID:4636
- C:\Windows\System\nDHKLcH.exe
  C:\Windows\System\nDHKLcH.exe
  2⤵
  PID:4620
- C:\Windows\System\dulXIZb.exe
  C:\Windows\System\dulXIZb.exe
  2⤵
  PID:4348
- C:\Windows\System\YfOfRTg.exe
  C:\Windows\System\YfOfRTg.exe
  2⤵
  PID:4784
- C:\Windows\System\wckvxMN.exe
  C:\Windows\System\wckvxMN.exe
  2⤵
  PID:4848
- C:\Windows\System\epoqWCX.exe
  C:\Windows\System\epoqWCX.exe
  2⤵
  PID:4384
- C:\Windows\System\HNNORZx.exe
  C:\Windows\System\HNNORZx.exe
  2⤵
  PID:4700
- C:\Windows\System\vWKfjxV.exe
  C:\Windows\System\vWKfjxV.exe
  2⤵
  PID:3340
- C:\Windows\System\uWQikzA.exe
  C:\Windows\System\uWQikzA.exe
  2⤵
  PID:5124
- C:\Windows\System\NtOAOFv.exe
  C:\Windows\System\NtOAOFv.exe
  2⤵
  PID:5140
- C:\Windows\System\dVJWsGN.exe
  C:\Windows\System\dVJWsGN.exe
  2⤵
  PID:5156
- C:\Windows\System\vZYLZrn.exe
  C:\Windows\System\vZYLZrn.exe
  2⤵
  PID:5172
- C:\Windows\System\kcBLJif.exe
  C:\Windows\System\kcBLJif.exe
  2⤵
  PID:5188
- C:\Windows\System\nISbOLS.exe
  C:\Windows\System\nISbOLS.exe
  2⤵
  PID:5204
- C:\Windows\System\dDqbaJd.exe
  C:\Windows\System\dDqbaJd.exe
  2⤵
  PID:5220
- C:\Windows\System\IjLGRBI.exe
  C:\Windows\System\IjLGRBI.exe
  2⤵
  PID:5236
- C:\Windows\System\rKmsHOg.exe
  C:\Windows\System\rKmsHOg.exe
  2⤵
  PID:5252
- C:\Windows\System\ECvHNRb.exe
  C:\Windows\System\ECvHNRb.exe
  2⤵
  PID:5268
- C:\Windows\System\OfGAKtB.exe
  C:\Windows\System\OfGAKtB.exe
  2⤵
  PID:5284
- C:\Windows\System\iRSgVSG.exe
  C:\Windows\System\iRSgVSG.exe
  2⤵
  PID:5300
- C:\Windows\System\cViTiXm.exe
  C:\Windows\System\cViTiXm.exe
  2⤵
  PID:5316
- C:\Windows\System\AmyPJtT.exe
  C:\Windows\System\AmyPJtT.exe
  2⤵
  PID:5332
- C:\Windows\System\dZPijxY.exe
  C:\Windows\System\dZPijxY.exe
  2⤵
  PID:5348
- C:\Windows\System\vbKFrdj.exe
  C:\Windows\System\vbKFrdj.exe
  2⤵
  PID:5364
- C:\Windows\System\qpGUEem.exe
  C:\Windows\System\qpGUEem.exe
  2⤵
  PID:5384
- C:\Windows\System\oJqsOBE.exe
  C:\Windows\System\oJqsOBE.exe
  2⤵
  PID:5400
- C:\Windows\System\JciJsuS.exe
  C:\Windows\System\JciJsuS.exe
  2⤵
  PID:5416
- C:\Windows\System\LUvPkzc.exe
  C:\Windows\System\LUvPkzc.exe
  2⤵
  PID:5432
- C:\Windows\System\GgOOmNu.exe
  C:\Windows\System\GgOOmNu.exe
  2⤵
  PID:5448
- C:\Windows\System\mDRADNh.exe
  C:\Windows\System\mDRADNh.exe
  2⤵
  PID:5464
- C:\Windows\System\weeaNGB.exe
  C:\Windows\System\weeaNGB.exe
  2⤵
  PID:5480
- C:\Windows\System\NvHlaYx.exe
  C:\Windows\System\NvHlaYx.exe
  2⤵
  PID:5496
- C:\Windows\System\XnFzlpK.exe
  C:\Windows\System\XnFzlpK.exe
  2⤵
  PID:5512
- C:\Windows\System\RdSbceZ.exe
  C:\Windows\System\RdSbceZ.exe
  2⤵
  PID:5528
- C:\Windows\System\gudIZKS.exe
  C:\Windows\System\gudIZKS.exe
  2⤵
  PID:5544
- C:\Windows\System\AVdRsqh.exe
  C:\Windows\System\AVdRsqh.exe
  2⤵
  PID:5560
- C:\Windows\System\kHdySRB.exe
  C:\Windows\System\kHdySRB.exe
  2⤵
  PID:5576
- C:\Windows\System\ecAfgNB.exe
  C:\Windows\System\ecAfgNB.exe
  2⤵
  PID:5592
- C:\Windows\System\oDSKfFX.exe
  C:\Windows\System\oDSKfFX.exe
  2⤵
  PID:5608
- C:\Windows\System\qCHZOrx.exe
  C:\Windows\System\qCHZOrx.exe
  2⤵
  PID:5624
- C:\Windows\System\JOikbhc.exe
  C:\Windows\System\JOikbhc.exe
  2⤵
  PID:5640
- C:\Windows\System\nxUaxWh.exe
  C:\Windows\System\nxUaxWh.exe
  2⤵
  PID:5656
- C:\Windows\System\vXepCrE.exe
  C:\Windows\System\vXepCrE.exe
  2⤵
  PID:5672
- C:\Windows\System\AkXsGSl.exe
  C:\Windows\System\AkXsGSl.exe
  2⤵
  PID:5688
- C:\Windows\System\NXJZzOK.exe
  C:\Windows\System\NXJZzOK.exe
  2⤵
  PID:5704
- C:\Windows\System\eeBsSzC.exe
  C:\Windows\System\eeBsSzC.exe
  2⤵
  PID:5720
- C:\Windows\System\EUijBAT.exe
  C:\Windows\System\EUijBAT.exe
  2⤵
  PID:5736
- C:\Windows\System\YBzQbja.exe
  C:\Windows\System\YBzQbja.exe
  2⤵
  PID:5752
- C:\Windows\System\QKblRCR.exe
  C:\Windows\System\QKblRCR.exe
  2⤵
  PID:5768
- C:\Windows\System\JgAlhnV.exe
  C:\Windows\System\JgAlhnV.exe
  2⤵
  PID:5784
- C:\Windows\System\VrIRbuM.exe
  C:\Windows\System\VrIRbuM.exe
  2⤵
  PID:5800
- C:\Windows\System\VEtvtRl.exe
  C:\Windows\System\VEtvtRl.exe
  2⤵
  PID:5816
- C:\Windows\System\BRwRooW.exe
  C:\Windows\System\BRwRooW.exe
  2⤵
  PID:5832
- C:\Windows\System\ZfFBdaW.exe
  C:\Windows\System\ZfFBdaW.exe
  2⤵
  PID:5848
- C:\Windows\System\wuBjqcG.exe
  C:\Windows\System\wuBjqcG.exe
  2⤵
  PID:5864
- C:\Windows\System\mMmbJkW.exe
  C:\Windows\System\mMmbJkW.exe
  2⤵
  PID:5880
- C:\Windows\System\MGjIZQY.exe
  C:\Windows\System\MGjIZQY.exe
  2⤵
  PID:5896
- C:\Windows\System\eOIklho.exe
  C:\Windows\System\eOIklho.exe
  2⤵
  PID:5912
- C:\Windows\System\gVRGfmp.exe
  C:\Windows\System\gVRGfmp.exe
  2⤵
  PID:5928
- C:\Windows\System\spvgeHl.exe
  C:\Windows\System\spvgeHl.exe
  2⤵
  PID:5944
- C:\Windows\System\DmaTQIM.exe
  C:\Windows\System\DmaTQIM.exe
  2⤵
  PID:5960
- C:\Windows\System\BVaDDcx.exe
  C:\Windows\System\BVaDDcx.exe
  2⤵
  PID:5976
- C:\Windows\System\iAZQVBN.exe
  C:\Windows\System\iAZQVBN.exe
  2⤵
  PID:5992
- C:\Windows\System\PLEcFCs.exe
  C:\Windows\System\PLEcFCs.exe
  2⤵
  PID:6008
- C:\Windows\System\XInhfxU.exe
  C:\Windows\System\XInhfxU.exe
  2⤵
  PID:6024
- C:\Windows\System\bfQhHHO.exe
  C:\Windows\System\bfQhHHO.exe
  2⤵
  PID:6040
- C:\Windows\System\vMpfvpN.exe
  C:\Windows\System\vMpfvpN.exe
  2⤵
  PID:6056
- C:\Windows\System\gpMGRtP.exe
  C:\Windows\System\gpMGRtP.exe
  2⤵
  PID:6072
- C:\Windows\System\VnDJoFq.exe
  C:\Windows\System\VnDJoFq.exe
  2⤵
  PID:6088
- C:\Windows\System\bCgewGz.exe
  C:\Windows\System\bCgewGz.exe
  2⤵
  PID:6104
- C:\Windows\System\dhSYMcB.exe
  C:\Windows\System\dhSYMcB.exe
  2⤵
  PID:6120
- C:\Windows\System\aVpsZeJ.exe
  C:\Windows\System\aVpsZeJ.exe
  2⤵
  PID:6136
- C:\Windows\System\ALujmnj.exe
  C:\Windows\System\ALujmnj.exe
  2⤵
  PID:1620
- C:\Windows\System\EmJrGxe.exe
  C:\Windows\System\EmJrGxe.exe
  2⤵
  PID:4976
- C:\Windows\System\SBoZWjI.exe
  C:\Windows\System\SBoZWjI.exe
  2⤵
  PID:2980
- C:\Windows\System\HwYqiZN.exe
  C:\Windows\System\HwYqiZN.exe
  2⤵
  PID:5136
- C:\Windows\System\CfzpViF.exe
  C:\Windows\System\CfzpViF.exe
  2⤵
  PID:5228
- C:\Windows\System\VaKFNYN.exe
  C:\Windows\System\VaKFNYN.exe
  2⤵
  PID:5292
- C:\Windows\System\jjNIlPe.exe
  C:\Windows\System\jjNIlPe.exe
  2⤵
  PID:4684
- C:\Windows\System\BjwpmrI.exe
  C:\Windows\System\BjwpmrI.exe
  2⤵
  PID:1976
- C:\Windows\System\njBKytJ.exe
  C:\Windows\System\njBKytJ.exe
  2⤵
  PID:1728
- C:\Windows\System\DFPoYqJ.exe
  C:\Windows\System\DFPoYqJ.exe
  2⤵
  PID:4992
- C:\Windows\System\WsjKnLZ.exe
  C:\Windows\System\WsjKnLZ.exe
  2⤵
  PID:5396
- C:\Windows\System\QuSkwlu.exe
  C:\Windows\System\QuSkwlu.exe
  2⤵
  PID:3628
- C:\Windows\System\pIQgpaD.exe
  C:\Windows\System\pIQgpaD.exe
  2⤵
  PID:4476
- C:\Windows\System\sApzXuO.exe
  C:\Windows\System\sApzXuO.exe
  2⤵
  PID:3792
- C:\Windows\System\QawsPsC.exe
  C:\Windows\System\QawsPsC.exe
  2⤵
  PID:4672
- C:\Windows\System\HeKgzKD.exe
  C:\Windows\System\HeKgzKD.exe
  2⤵
  PID:5148
- C:\Windows\System\vrdNYNn.exe
  C:\Windows\System\vrdNYNn.exe
  2⤵
  PID:1524
- C:\Windows\System\BdeoRtA.exe
  C:\Windows\System\BdeoRtA.exe
  2⤵
  PID:1724
- C:\Windows\System\xUOXKuM.exe
  C:\Windows\System\xUOXKuM.exe
  2⤵
  PID:5520
- C:\Windows\System\mqVrUbF.exe
  C:\Windows\System\mqVrUbF.exe
  2⤵
  PID:5276
- C:\Windows\System\XaKBpHD.exe
  C:\Windows\System\XaKBpHD.exe
  2⤵
  PID:2488
- C:\Windows\System\KCIpiJS.exe
  C:\Windows\System\KCIpiJS.exe
  2⤵
  PID:5376
- C:\Windows\System\LkOMvtT.exe
  C:\Windows\System\LkOMvtT.exe
  2⤵
  PID:5444
- C:\Windows\System\tYmLZpL.exe
  C:\Windows\System\tYmLZpL.exe
  2⤵
  PID:5508
- C:\Windows\System\YARLiLx.exe
  C:\Windows\System\YARLiLx.exe
  2⤵
  PID:5584
- C:\Windows\System\dGqjhXU.exe
  C:\Windows\System\dGqjhXU.exe
  2⤵
  PID:5648
- C:\Windows\System\TZguhZR.exe
  C:\Windows\System\TZguhZR.exe
  2⤵
  PID:5604
- C:\Windows\System\aiIfYnp.exe
  C:\Windows\System\aiIfYnp.exe
  2⤵
  PID:5664
- C:\Windows\System\bQhsntX.exe
  C:\Windows\System\bQhsntX.exe
  2⤵
  PID:5716
- C:\Windows\System\IeQNQER.exe
  C:\Windows\System\IeQNQER.exe
  2⤵
  PID:5696
- C:\Windows\System\lcVZPSP.exe
  C:\Windows\System\lcVZPSP.exe
  2⤵
  PID:5732
- C:\Windows\System\OTiQWHx.exe
  C:\Windows\System\OTiQWHx.exe
  2⤵
  PID:5812
- C:\Windows\System\LyxqsCw.exe
  C:\Windows\System\LyxqsCw.exe
  2⤵
  PID:5876
- C:\Windows\System\UpbxnxC.exe
  C:\Windows\System\UpbxnxC.exe
  2⤵
  PID:5908
- C:\Windows\System\ffnzUVy.exe
  C:\Windows\System\ffnzUVy.exe
  2⤵
  PID:5952
- C:\Windows\System\wLSEINb.exe
  C:\Windows\System\wLSEINb.exe
  2⤵
  PID:5860
- C:\Windows\System\zrtAEkw.exe
  C:\Windows\System\zrtAEkw.exe
  2⤵
  PID:6004
- C:\Windows\System\XsLelEH.exe
  C:\Windows\System\XsLelEH.exe
  2⤵
  PID:5984
- C:\Windows\System\nDMjriJ.exe
  C:\Windows\System\nDMjriJ.exe
  2⤵
  PID:5988
- C:\Windows\System\AlWAPhE.exe
  C:\Windows\System\AlWAPhE.exe
  2⤵
  PID:5924
- C:\Windows\System\JciqOvP.exe
  C:\Windows\System\JciqOvP.exe
  2⤵
  PID:6084
- C:\Windows\System\fomvpuy.exe
  C:\Windows\System\fomvpuy.exe
  2⤵
  PID:4828
- C:\Windows\System\JTgZNvo.exe
  C:\Windows\System\JTgZNvo.exe
  2⤵
  PID:5200
- C:\Windows\System\JnByLHv.exe
  C:\Windows\System\JnByLHv.exe
  2⤵
  PID:4200
- C:\Windows\System\YWTVuLw.exe
  C:\Windows\System\YWTVuLw.exe
  2⤵
  PID:6048
- C:\Windows\System\mzzLVdN.exe
  C:\Windows\System\mzzLVdN.exe
  2⤵
  PID:5184
- C:\Windows\System\OBAGHhr.exe
  C:\Windows\System\OBAGHhr.exe
  2⤵
  PID:6068
- C:\Windows\System\HZVEjLT.exe
  C:\Windows\System\HZVEjLT.exe
  2⤵
  PID:6096
- C:\Windows\System\zQIohIv.exe
  C:\Windows\System\zQIohIv.exe
  2⤵
  PID:4764
- C:\Windows\System\loALKZa.exe
  C:\Windows\System\loALKZa.exe
  2⤵
  PID:5164
- C:\Windows\System\SBDnYHV.exe
  C:\Windows\System\SBDnYHV.exe
  2⤵
  PID:2324
- C:\Windows\System\nMfdHNu.exe
  C:\Windows\System\nMfdHNu.exe
  2⤵
  PID:4032
- C:\Windows\System\UFYQJrE.exe
  C:\Windows\System\UFYQJrE.exe
  2⤵
  PID:4940
- C:\Windows\System\dTGxSld.exe
  C:\Windows\System\dTGxSld.exe
  2⤵
  PID:5556
- C:\Windows\System\TNpxlrh.exe
  C:\Windows\System\TNpxlrh.exe
  2⤵
  PID:5248
- C:\Windows\System\qLUGhIx.exe
  C:\Windows\System\qLUGhIx.exe
  2⤵
  PID:5412
- C:\Windows\System\dCqruJv.exe
  C:\Windows\System\dCqruJv.exe
  2⤵
  PID:5600
- C:\Windows\System\etHzIdk.exe
  C:\Windows\System\etHzIdk.exe
  2⤵
  PID:5684
- C:\Windows\System\nVgfdSM.exe
  C:\Windows\System\nVgfdSM.exe
  2⤵
  PID:5968
- C:\Windows\System\cdoATiB.exe
  C:\Windows\System\cdoATiB.exe
  2⤵
  PID:5588
- C:\Windows\System\VmPmIIt.exe
  C:\Windows\System\VmPmIIt.exe
  2⤵
  PID:5748
- C:\Windows\System\NlfBKYL.exe
  C:\Windows\System\NlfBKYL.exe
  2⤵
  PID:688
- C:\Windows\System\KrHJBnp.exe
  C:\Windows\System\KrHJBnp.exe
  2⤵
  PID:5956
- C:\Windows\System\ubjBfyq.exe
  C:\Windows\System\ubjBfyq.exe
  2⤵
  PID:1996
- C:\Windows\System\AEjJjdx.exe
  C:\Windows\System\AEjJjdx.exe
  2⤵
  PID:2404
- C:\Windows\System\LMgwIjI.exe
  C:\Windows\System\LMgwIjI.exe
  2⤵
  PID:5324
- C:\Windows\System\xcOAoNB.exe
  C:\Windows\System\xcOAoNB.exe
  2⤵
  PID:5796
- C:\Windows\System\zsZzQCT.exe
  C:\Windows\System\zsZzQCT.exe
  2⤵
  PID:1600
- C:\Windows\System\MbOlHpW.exe
  C:\Windows\System\MbOlHpW.exe
  2⤵
  PID:2960
- C:\Windows\System\UjKvVmc.exe
  C:\Windows\System\UjKvVmc.exe
  2⤵
  PID:2276
- C:\Windows\System\wYIziUh.exe
  C:\Windows\System\wYIziUh.exe
  2⤵
  PID:2708
- C:\Windows\System\sWdQemp.exe
  C:\Windows\System\sWdQemp.exe
  2⤵
  PID:4748
- C:\Windows\System\BzjNFhr.exe
  C:\Windows\System\BzjNFhr.exe
  2⤵
  PID:5476
- C:\Windows\System\lFrPFXl.exe
  C:\Windows\System\lFrPFXl.exe
  2⤵
  PID:2704
- C:\Windows\System\rlmgjjp.exe
  C:\Windows\System\rlmgjjp.exe
  2⤵
  PID:1812
- C:\Windows\System\GDKBFDC.exe
  C:\Windows\System\GDKBFDC.exe
  2⤵
  PID:5488
- C:\Windows\System\ZQvzOpr.exe
  C:\Windows\System\ZQvzOpr.exe
  2⤵
  PID:5568
- C:\Windows\System\aaKvZgO.exe
  C:\Windows\System\aaKvZgO.exe
  2⤵
  PID:6000
- C:\Windows\System\JJOVFKu.exe
  C:\Windows\System\JJOVFKu.exe
  2⤵
  PID:5744
- C:\Windows\System\ZFVLSXp.exe
  C:\Windows\System\ZFVLSXp.exe
  2⤵
  PID:960
- C:\Windows\System\lYMOkhQ.exe
  C:\Windows\System\lYMOkhQ.exe
  2⤵
  PID:2472
- C:\Windows\System\qZmCNBU.exe
  C:\Windows\System\qZmCNBU.exe
  2⤵
  PID:840
- C:\Windows\System\rkeEDPe.exe
  C:\Windows\System\rkeEDPe.exe
  2⤵
  PID:2144
- C:\Windows\System\tygyhmh.exe
  C:\Windows\System\tygyhmh.exe
  2⤵
  PID:6052
- C:\Windows\System\HxzXzEP.exe
  C:\Windows\System\HxzXzEP.exe
  2⤵
  PID:5940
- C:\Windows\System\IrQWkzI.exe
  C:\Windows\System\IrQWkzI.exe
  2⤵
  PID:6036
- C:\Windows\System\yQSjDrR.exe
  C:\Windows\System\yQSjDrR.exe
  2⤵
  PID:4604
- C:\Windows\System\GkwZEHe.exe
  C:\Windows\System\GkwZEHe.exe
  2⤵
  PID:6080
- C:\Windows\System\bwIgyJg.exe
  C:\Windows\System\bwIgyJg.exe
  2⤵
  PID:5872
- C:\Windows\System\YIyFUvl.exe
  C:\Windows\System\YIyFUvl.exe
  2⤵
  PID:2784
- C:\Windows\System\XIiJmRg.exe
  C:\Windows\System\XIiJmRg.exe
  2⤵
  PID:320
- C:\Windows\System\gQkUNkk.exe
  C:\Windows\System\gQkUNkk.exe
  2⤵
  PID:864
- C:\Windows\System\tGBUCQU.exe
  C:\Windows\System\tGBUCQU.exe
  2⤵
  PID:2248
- C:\Windows\System\HfqPgRO.exe
  C:\Windows\System\HfqPgRO.exe
  2⤵
  PID:2016
- C:\Windows\System\uSszEaq.exe
  C:\Windows\System\uSszEaq.exe
  2⤵
  PID:5180
- C:\Windows\System\TjYAtNu.exe
  C:\Windows\System\TjYAtNu.exe
  2⤵
  PID:4156
- C:\Windows\System\lrzUdIR.exe
  C:\Windows\System\lrzUdIR.exe
  2⤵
  PID:1588
- C:\Windows\System\BFPRUDB.exe
  C:\Windows\System\BFPRUDB.exe
  2⤵
  PID:1856
- C:\Windows\System\VlWKqHI.exe
  C:\Windows\System\VlWKqHI.exe
  2⤵
  PID:5972
- C:\Windows\System\fARuGkI.exe
  C:\Windows\System\fARuGkI.exe
  2⤵
  PID:2948
- C:\Windows\System\snOFGhM.exe
  C:\Windows\System\snOFGhM.exe
  2⤵
  PID:5380
- C:\Windows\System\tAbYkbN.exe
  C:\Windows\System\tAbYkbN.exe
  2⤵
  PID:6132
- C:\Windows\System\qrQqTiS.exe
  C:\Windows\System\qrQqTiS.exe
  2⤵
  PID:4912
- C:\Windows\System\tbkrbNj.exe
  C:\Windows\System\tbkrbNj.exe
  2⤵
  PID:1656
- C:\Windows\System\XGjfCOe.exe
  C:\Windows\System\XGjfCOe.exe
  2⤵
  PID:1336
- C:\Windows\System\lppfDAS.exe
  C:\Windows\System\lppfDAS.exe
  2⤵
  PID:6148
- C:\Windows\System\TNLpbZY.exe
  C:\Windows\System\TNLpbZY.exe
  2⤵
  PID:6164
- C:\Windows\System\xTCHyhj.exe
  C:\Windows\System\xTCHyhj.exe
  2⤵
  PID:6180
- C:\Windows\System\KkOXCJs.exe
  C:\Windows\System\KkOXCJs.exe
  2⤵
  PID:6196
- C:\Windows\System\xCfNESl.exe
  C:\Windows\System\xCfNESl.exe
  2⤵
  PID:6212
- C:\Windows\System\TMoXqgC.exe
  C:\Windows\System\TMoXqgC.exe
  2⤵
  PID:6228
- C:\Windows\System\ZlHNsWJ.exe
  C:\Windows\System\ZlHNsWJ.exe
  2⤵
  PID:6244
- C:\Windows\System\EUsdJRC.exe
  C:\Windows\System\EUsdJRC.exe
  2⤵
  PID:6260
- C:\Windows\System\sTdEZom.exe
  C:\Windows\System\sTdEZom.exe
  2⤵
  PID:6276
- C:\Windows\System\DAYZtBq.exe
  C:\Windows\System\DAYZtBq.exe
  2⤵
  PID:6292
- C:\Windows\System\esBZJCF.exe
  C:\Windows\System\esBZJCF.exe
  2⤵
  PID:6312
- C:\Windows\System\ccYjbav.exe
  C:\Windows\System\ccYjbav.exe
  2⤵
  PID:6328
- C:\Windows\System\hUQuLjo.exe
  C:\Windows\System\hUQuLjo.exe
  2⤵
  PID:6344
- C:\Windows\System\sWWkAkr.exe
  C:\Windows\System\sWWkAkr.exe
  2⤵
  PID:6360
- C:\Windows\System\iLDgTSO.exe
  C:\Windows\System\iLDgTSO.exe
  2⤵
  PID:6376
- C:\Windows\System\xAIScWm.exe
  C:\Windows\System\xAIScWm.exe
  2⤵
  PID:6392
- C:\Windows\System\lXZuIXt.exe
  C:\Windows\System\lXZuIXt.exe
  2⤵
  PID:6408
- C:\Windows\System\wKNjrhX.exe
  C:\Windows\System\wKNjrhX.exe
  2⤵
  PID:6424
- C:\Windows\System\wZErvCd.exe
  C:\Windows\System\wZErvCd.exe
  2⤵
  PID:6440
- C:\Windows\System\hvQRuns.exe
  C:\Windows\System\hvQRuns.exe
  2⤵
  PID:6456
- C:\Windows\System\CEYBzTB.exe
  C:\Windows\System\CEYBzTB.exe
  2⤵
  PID:6472
- C:\Windows\System\eWhAMsL.exe
  C:\Windows\System\eWhAMsL.exe
  2⤵
  PID:6488
- C:\Windows\System\ExsbAiz.exe
  C:\Windows\System\ExsbAiz.exe
  2⤵
  PID:6504
- C:\Windows\System\GPObIXB.exe
  C:\Windows\System\GPObIXB.exe
  2⤵
  PID:6520
- C:\Windows\System\uvkDrpg.exe
  C:\Windows\System\uvkDrpg.exe
  2⤵
  PID:6536
- C:\Windows\System\SimfeUx.exe
  C:\Windows\System\SimfeUx.exe
  2⤵
  PID:6552
- C:\Windows\System\SaqaLzj.exe
  C:\Windows\System\SaqaLzj.exe
  2⤵
  PID:6568
- C:\Windows\System\dEJYaHJ.exe
  C:\Windows\System\dEJYaHJ.exe
  2⤵
  PID:6584
- C:\Windows\System\avTmPxw.exe
  C:\Windows\System\avTmPxw.exe
  2⤵
  PID:6600
- C:\Windows\System\JCcYhko.exe
  C:\Windows\System\JCcYhko.exe
  2⤵
  PID:6616
- C:\Windows\System\QErXuuq.exe
  C:\Windows\System\QErXuuq.exe
  2⤵
  PID:6632
- C:\Windows\System\YGQHjmS.exe
  C:\Windows\System\YGQHjmS.exe
  2⤵
  PID:6648
- C:\Windows\System\TvMwUWp.exe
  C:\Windows\System\TvMwUWp.exe
  2⤵
  PID:6664
- C:\Windows\System\tOEivnZ.exe
  C:\Windows\System\tOEivnZ.exe
  2⤵
  PID:6680
- C:\Windows\System\biIlbFg.exe
  C:\Windows\System\biIlbFg.exe
  2⤵
  PID:6696
- C:\Windows\System\dBXxFuR.exe
  C:\Windows\System\dBXxFuR.exe
  2⤵
  PID:6712
- C:\Windows\System\Saubvji.exe
  C:\Windows\System\Saubvji.exe
  2⤵
  PID:6728
- C:\Windows\System\LCsLdnk.exe
  C:\Windows\System\LCsLdnk.exe
  2⤵
  PID:6744
- C:\Windows\System\AyePFlr.exe
  C:\Windows\System\AyePFlr.exe
  2⤵
  PID:6760
- C:\Windows\System\lVVPIDR.exe
  C:\Windows\System\lVVPIDR.exe
  2⤵
  PID:6776
- C:\Windows\System\zaEGind.exe
  C:\Windows\System\zaEGind.exe
  2⤵
  PID:6792
- C:\Windows\System\ybQyPmJ.exe
  C:\Windows\System\ybQyPmJ.exe
  2⤵
  PID:6808
- C:\Windows\System\vawrlEE.exe
  C:\Windows\System\vawrlEE.exe
  2⤵
  PID:6824
- C:\Windows\System\nCNjBsF.exe
  C:\Windows\System\nCNjBsF.exe
  2⤵
  PID:6844
- C:\Windows\System\YwYDFRq.exe
  C:\Windows\System\YwYDFRq.exe
  2⤵
  PID:6864
- C:\Windows\System\xAfZAMQ.exe
  C:\Windows\System\xAfZAMQ.exe
  2⤵
  PID:6880
- C:\Windows\System\prNnLCd.exe
  C:\Windows\System\prNnLCd.exe
  2⤵
  PID:6896
- C:\Windows\System\bXNRroI.exe
  C:\Windows\System\bXNRroI.exe
  2⤵
  PID:6912
- C:\Windows\System\LOrCgOp.exe
  C:\Windows\System\LOrCgOp.exe
  2⤵
  PID:6928
- C:\Windows\System\VmrbheD.exe
  C:\Windows\System\VmrbheD.exe
  2⤵
  PID:6944
- C:\Windows\System\JfcWbou.exe
  C:\Windows\System\JfcWbou.exe
  2⤵
  PID:6960
- C:\Windows\System\PJiqbqI.exe
  C:\Windows\System\PJiqbqI.exe
  2⤵
  PID:6976
- C:\Windows\System\QYiJgyc.exe
  C:\Windows\System\QYiJgyc.exe
  2⤵
  PID:6992
- C:\Windows\System\WCRfztr.exe
  C:\Windows\System\WCRfztr.exe
  2⤵
  PID:7008
- C:\Windows\System\mCArIcr.exe
  C:\Windows\System\mCArIcr.exe
  2⤵
  PID:7024
- C:\Windows\System\qWwimXT.exe
  C:\Windows\System\qWwimXT.exe
  2⤵
  PID:7040
- C:\Windows\System\KznDSlq.exe
  C:\Windows\System\KznDSlq.exe
  2⤵
  PID:7056
- C:\Windows\System\hvkVkLf.exe
  C:\Windows\System\hvkVkLf.exe
  2⤵
  PID:7072
- C:\Windows\System\byRvjuT.exe
  C:\Windows\System\byRvjuT.exe
  2⤵
  PID:7088
- C:\Windows\System\dBApChD.exe
  C:\Windows\System\dBApChD.exe
  2⤵
  PID:7104
- C:\Windows\System\dPKjPzX.exe
  C:\Windows\System\dPKjPzX.exe
  2⤵
  PID:7120
- C:\Windows\System\UrUWlCi.exe
  C:\Windows\System\UrUWlCi.exe
  2⤵
  PID:7136
- C:\Windows\System\YhwOjZT.exe
  C:\Windows\System\YhwOjZT.exe
  2⤵
  PID:7152
- C:\Windows\System\bjzjbKB.exe
  C:\Windows\System\bjzjbKB.exe
  2⤵
  PID:6192
- C:\Windows\System\LzYdjBt.exe
  C:\Windows\System\LzYdjBt.exe
  2⤵
  PID:6220
- C:\Windows\System\ubEGtlB.exe
  C:\Windows\System\ubEGtlB.exe
  2⤵
  PID:6284
- C:\Windows\System\JIgFnan.exe
  C:\Windows\System\JIgFnan.exe
  2⤵
  PID:6324
- C:\Windows\System\vkyEfGY.exe
  C:\Windows\System\vkyEfGY.exe
  2⤵
  PID:5616
- C:\Windows\System\ScmDsHO.exe
  C:\Windows\System\ScmDsHO.exe
  2⤵
  PID:6384
- C:\Windows\System\glwnXrQ.exe
  C:\Windows\System\glwnXrQ.exe
  2⤵
  PID:6448
- C:\Windows\System\hMQDBDL.exe
  C:\Windows\System\hMQDBDL.exe
  2⤵
  PID:6236
- C:\Windows\System\PczmFrW.exe
  C:\Windows\System\PczmFrW.exe
  2⤵
  PID:6300
- C:\Windows\System\HzGjdGR.exe
  C:\Windows\System\HzGjdGR.exe
  2⤵
  PID:6484
- C:\Windows\System\pnzbagr.exe
  C:\Windows\System\pnzbagr.exe
  2⤵
  PID:6368
- C:\Windows\System\slOnVWP.exe
  C:\Windows\System\slOnVWP.exe
  2⤵
  PID:6404
- C:\Windows\System\YBzMeUw.exe
  C:\Windows\System\YBzMeUw.exe
  2⤵
  PID:2808
- C:\Windows\System\EoAHBSx.exe
  C:\Windows\System\EoAHBSx.exe
  2⤵
  PID:6468
- C:\Windows\System\cCPEYJM.exe
  C:\Windows\System\cCPEYJM.exe
  2⤵
  PID:6608
- C:\Windows\System\PJRyKGs.exe
  C:\Windows\System\PJRyKGs.exe
  2⤵
  PID:6532
- C:\Windows\System\WlZFCwb.exe
  C:\Windows\System\WlZFCwb.exe
  2⤵
  PID:6596
- C:\Windows\System\kOlYUIY.exe
  C:\Windows\System\kOlYUIY.exe
  2⤵
  PID:6548
- C:\Windows\System\LhpHFIM.exe
  C:\Windows\System\LhpHFIM.exe
  2⤵
  PID:6656
- C:\Windows\System\TTpEQuc.exe
  C:\Windows\System\TTpEQuc.exe
  2⤵
  PID:6704
- C:\Windows\System\NZtqBlF.exe
  C:\Windows\System\NZtqBlF.exe
  2⤵
  PID:6768
- C:\Windows\System\zKYJBaL.exe
  C:\Windows\System\zKYJBaL.exe
  2⤵
  PID:6688
- C:\Windows\System\qOolHxH.exe
  C:\Windows\System\qOolHxH.exe
  2⤵
  PID:6752
- C:\Windows\System\oqTFxnY.exe
  C:\Windows\System\oqTFxnY.exe
  2⤵
  PID:6772
- C:\Windows\System\NidBszp.exe
  C:\Windows\System\NidBszp.exe
  2⤵
  PID:1720
- C:\Windows\System\NTRdMaH.exe
  C:\Windows\System\NTRdMaH.exe
  2⤵
  PID:6836
- C:\Windows\System\tvWyXIH.exe
  C:\Windows\System\tvWyXIH.exe
  2⤵
  PID:6852
- C:\Windows\System\FYgEpPh.exe
  C:\Windows\System\FYgEpPh.exe
  2⤵
  PID:2604
- C:\Windows\System\NGxwDtf.exe
  C:\Windows\System\NGxwDtf.exe
  2⤵
  PID:6968
- C:\Windows\System\IyQgilt.exe
  C:\Windows\System\IyQgilt.exe
  2⤵
  PID:7000
- C:\Windows\System\VGQDGTY.exe
  C:\Windows\System\VGQDGTY.exe
  2⤵
  PID:6888
- C:\Windows\System\aitDRTo.exe
  C:\Windows\System\aitDRTo.exe
  2⤵
  PID:7096
- C:\Windows\System\UNXGFNN.exe
  C:\Windows\System\UNXGFNN.exe
  2⤵
  PID:6952
- C:\Windows\System\VmdPQkb.exe
  C:\Windows\System\VmdPQkb.exe
  2⤵
  PID:6356
- C:\Windows\System\eVVsWte.exe
  C:\Windows\System\eVVsWte.exe
  2⤵
  PID:2364
- C:\Windows\System\xiCXutw.exe
  C:\Windows\System\xiCXutw.exe
  2⤵
  PID:6272
- C:\Windows\System\IXbsAjB.exe
  C:\Windows\System\IXbsAjB.exe
  2⤵
  PID:6516
- C:\Windows\System\zeITUbn.exe
  C:\Windows\System\zeITUbn.exe
  2⤵
  PID:7052
- C:\Windows\System\sDuTOEG.exe
  C:\Windows\System\sDuTOEG.exe
  2⤵
  PID:6816
- C:\Windows\System\heuOUtq.exe
  C:\Windows\System\heuOUtq.exe
  2⤵
  PID:6936
- C:\Windows\System\TEtMvGU.exe
  C:\Windows\System\TEtMvGU.exe
  2⤵
  PID:6644
- C:\Windows\System\HlxQaRS.exe
  C:\Windows\System\HlxQaRS.exe
  2⤵
  PID:6740
- C:\Windows\System\LxVIIKV.exe
  C:\Windows\System\LxVIIKV.exe
  2⤵
  PID:6920
- C:\Windows\System\xMUKlyR.exe
  C:\Windows\System\xMUKlyR.exe
  2⤵
  PID:6956
- C:\Windows\System\nDvVywt.exe
  C:\Windows\System\nDvVywt.exe
  2⤵
  PID:7020
- C:\Windows\System\JYyJDpd.exe
  C:\Windows\System\JYyJDpd.exe
  2⤵
  PID:7148
- C:\Windows\System\XyhpToz.exe
  C:\Windows\System\XyhpToz.exe
  2⤵
  PID:2824
- C:\Windows\System\xtQaZLZ.exe
  C:\Windows\System\xtQaZLZ.exe
  2⤵
  PID:6480
- C:\Windows\System\NpZOrVN.exe
  C:\Windows\System\NpZOrVN.exe
  2⤵
  PID:6464
- C:\Windows\System\ZKtkiIz.exe
  C:\Windows\System\ZKtkiIz.exe
  2⤵
  PID:6612
- C:\Windows\System\BDfdVEg.exe
  C:\Windows\System\BDfdVEg.exe
  2⤵
  PID:1532
- C:\Windows\System\WvRqvTu.exe
  C:\Windows\System\WvRqvTu.exe
  2⤵
  PID:6904
- C:\Windows\System\kJPyxXu.exe
  C:\Windows\System\kJPyxXu.exe
  2⤵
  PID:7068
- C:\Windows\System\jHtrDAe.exe
  C:\Windows\System\jHtrDAe.exe
  2⤵
  PID:1200
- C:\Windows\System\GOapYLv.exe
  C:\Windows\System\GOapYLv.exe
  2⤵
  PID:6268
- C:\Windows\System\WsqDywh.exe
  C:\Windows\System\WsqDywh.exe
  2⤵
  PID:7036
- C:\Windows\System\kcIomje.exe
  C:\Windows\System\kcIomje.exe
  2⤵
  PID:6208
- C:\Windows\System\uWEcidC.exe
  C:\Windows\System\uWEcidC.exe
  2⤵
  PID:7080
- C:\Windows\System\aHMAhor.exe
  C:\Windows\System\aHMAhor.exe
  2⤵
  PID:6544
- C:\Windows\System\lNdVpIZ.exe
  C:\Windows\System\lNdVpIZ.exe
  2⤵
  PID:3212
- C:\Windows\System\CIGKMoQ.exe
  C:\Windows\System\CIGKMoQ.exe
  2⤵
  PID:6416
- C:\Windows\System\XCEpBAy.exe
  C:\Windows\System\XCEpBAy.exe
  2⤵
  PID:7064
- C:\Windows\System\zJNMsFE.exe
  C:\Windows\System\zJNMsFE.exe
  2⤵
  PID:7144
- C:\Windows\System\lamJSLH.exe
  C:\Windows\System\lamJSLH.exe
  2⤵
  PID:1972
- C:\Windows\System\snVMKPk.exe
  C:\Windows\System\snVMKPk.exe
  2⤵
  PID:7048
- C:\Windows\System\NuolENa.exe
  C:\Windows\System\NuolENa.exe
  2⤵
  PID:6988
- C:\Windows\System\YssWTFW.exe
  C:\Windows\System\YssWTFW.exe
  2⤵
  PID:7176
- C:\Windows\System\svOGJao.exe
  C:\Windows\System\svOGJao.exe
  2⤵
  PID:7192
- C:\Windows\System\xdnqWWx.exe
  C:\Windows\System\xdnqWWx.exe
  2⤵
  PID:7208
- C:\Windows\System\EdEhPOj.exe
  C:\Windows\System\EdEhPOj.exe
  2⤵
  PID:7224
- C:\Windows\System\lDmEpJx.exe
  C:\Windows\System\lDmEpJx.exe
  2⤵
  PID:7240
- C:\Windows\System\fqDdBqj.exe
  C:\Windows\System\fqDdBqj.exe
  2⤵
  PID:7256
- C:\Windows\System\EMADcLK.exe
  C:\Windows\System\EMADcLK.exe
  2⤵
  PID:7272
- C:\Windows\System\JMEMXwr.exe
  C:\Windows\System\JMEMXwr.exe
  2⤵
  PID:7288
- C:\Windows\System\BsRZyQF.exe
  C:\Windows\System\BsRZyQF.exe
  2⤵
  PID:7304
- C:\Windows\System\KndLetT.exe
  C:\Windows\System\KndLetT.exe
  2⤵
  PID:7320
- C:\Windows\System\QbwbskU.exe
  C:\Windows\System\QbwbskU.exe
  2⤵
  PID:7336
- C:\Windows\System\kkgleKK.exe
  C:\Windows\System\kkgleKK.exe
  2⤵
  PID:7352
- C:\Windows\System\UOVjNko.exe
  C:\Windows\System\UOVjNko.exe
  2⤵
  PID:7368
- C:\Windows\System\jzJJojy.exe
  C:\Windows\System\jzJJojy.exe
  2⤵
  PID:7384
- C:\Windows\System\BwkocTX.exe
  C:\Windows\System\BwkocTX.exe
  2⤵
  PID:7400
- C:\Windows\System\mrJnTAm.exe
  C:\Windows\System\mrJnTAm.exe
  2⤵
  PID:7416
- C:\Windows\System\McwwWxQ.exe
  C:\Windows\System\McwwWxQ.exe
  2⤵
  PID:7432
- C:\Windows\System\GVOYnVV.exe
  C:\Windows\System\GVOYnVV.exe
  2⤵
  PID:7448
- C:\Windows\System\gvutTik.exe
  C:\Windows\System\gvutTik.exe
  2⤵
  PID:7464
- C:\Windows\System\rjqKFMN.exe
  C:\Windows\System\rjqKFMN.exe
  2⤵
  PID:7480
- C:\Windows\System\mbHoVgL.exe
  C:\Windows\System\mbHoVgL.exe
  2⤵
  PID:7496
- C:\Windows\System\xuNCNFS.exe
  C:\Windows\System\xuNCNFS.exe
  2⤵
  PID:7512
- C:\Windows\System\iMVrEPO.exe
  C:\Windows\System\iMVrEPO.exe
  2⤵
  PID:7528
- C:\Windows\System\PkCVXOo.exe
  C:\Windows\System\PkCVXOo.exe
  2⤵
  PID:7544
- C:\Windows\System\FbXtAyJ.exe
  C:\Windows\System\FbXtAyJ.exe
  2⤵
  PID:7560
- C:\Windows\System\AwvjAtm.exe
  C:\Windows\System\AwvjAtm.exe
  2⤵
  PID:7576
- C:\Windows\System\aZWTapA.exe
  C:\Windows\System\aZWTapA.exe
  2⤵
  PID:7592
- C:\Windows\System\NgrKkaq.exe
  C:\Windows\System\NgrKkaq.exe
  2⤵
  PID:7608
- C:\Windows\System\VyNFQaM.exe
  C:\Windows\System\VyNFQaM.exe
  2⤵
  PID:7624
- C:\Windows\System\amxiQFH.exe
  C:\Windows\System\amxiQFH.exe
  2⤵
  PID:7640
- C:\Windows\System\TydNLMB.exe
  C:\Windows\System\TydNLMB.exe
  2⤵
  PID:7656
- C:\Windows\System\uFHAuqX.exe
  C:\Windows\System\uFHAuqX.exe
  2⤵
  PID:7672
- C:\Windows\System\onNXGEU.exe
  C:\Windows\System\onNXGEU.exe
  2⤵
  PID:7688
- C:\Windows\System\Rfwfssf.exe
  C:\Windows\System\Rfwfssf.exe
  2⤵
  PID:7704
- C:\Windows\System\MiQyObo.exe
  C:\Windows\System\MiQyObo.exe
  2⤵
  PID:7720
- C:\Windows\System\mthXQYx.exe
  C:\Windows\System\mthXQYx.exe
  2⤵
  PID:7736
- C:\Windows\System\JpeGZvm.exe
  C:\Windows\System\JpeGZvm.exe
  2⤵
  PID:7752
- C:\Windows\System\AypSCuN.exe
  C:\Windows\System\AypSCuN.exe
  2⤵
  PID:7768
- C:\Windows\System\WPfNmKS.exe
  C:\Windows\System\WPfNmKS.exe
  2⤵
  PID:7784
- C:\Windows\System\DREwHWd.exe
  C:\Windows\System\DREwHWd.exe
  2⤵
  PID:7800
- C:\Windows\System\SuULMyN.exe
  C:\Windows\System\SuULMyN.exe
  2⤵
  PID:7816
- C:\Windows\System\inFzYeZ.exe
  C:\Windows\System\inFzYeZ.exe
  2⤵
  PID:7832
- C:\Windows\System\iKOFkql.exe
  C:\Windows\System\iKOFkql.exe
  2⤵
  PID:7848
- C:\Windows\System\MfCOolU.exe
  C:\Windows\System\MfCOolU.exe
  2⤵
  PID:7864
- C:\Windows\System\tpXLTLk.exe
  C:\Windows\System\tpXLTLk.exe
  2⤵
  PID:7880
- C:\Windows\System\nrRUbMO.exe
  C:\Windows\System\nrRUbMO.exe
  2⤵
  PID:7896
- C:\Windows\System\hqLTivi.exe
  C:\Windows\System\hqLTivi.exe
  2⤵
  PID:7912
- C:\Windows\System\DjjJVWN.exe
  C:\Windows\System\DjjJVWN.exe
  2⤵
  PID:7928
- C:\Windows\System\HrdscjB.exe
  C:\Windows\System\HrdscjB.exe
  2⤵
  PID:7944
- C:\Windows\System\LdPpFeV.exe
  C:\Windows\System\LdPpFeV.exe
  2⤵
  PID:7960
- C:\Windows\System\hLesBAn.exe
  C:\Windows\System\hLesBAn.exe
  2⤵
  PID:7976
- C:\Windows\System\nSLdxQk.exe
  C:\Windows\System\nSLdxQk.exe
  2⤵
  PID:7992
- C:\Windows\System\uQntyNa.exe
  C:\Windows\System\uQntyNa.exe
  2⤵
  PID:8008
- C:\Windows\System\EGLnkNU.exe
  C:\Windows\System\EGLnkNU.exe
  2⤵
  PID:8024
- C:\Windows\System\AmiWSwV.exe
  C:\Windows\System\AmiWSwV.exe
  2⤵
  PID:8040
- C:\Windows\System\eCqrvNd.exe
  C:\Windows\System\eCqrvNd.exe
  2⤵
  PID:8056
- C:\Windows\System\FTDrSGj.exe
  C:\Windows\System\FTDrSGj.exe
  2⤵
  PID:8072
- C:\Windows\System\UlGqNgp.exe
  C:\Windows\System\UlGqNgp.exe
  2⤵
  PID:8088
- C:\Windows\System\qbhaYaY.exe
  C:\Windows\System\qbhaYaY.exe
  2⤵
  PID:8104
- C:\Windows\System\OIQsjyq.exe
  C:\Windows\System\OIQsjyq.exe
  2⤵
  PID:8120
- C:\Windows\System\skSZxbI.exe
  C:\Windows\System\skSZxbI.exe
  2⤵
  PID:8136
- C:\Windows\System\smkhRmg.exe
  C:\Windows\System\smkhRmg.exe
  2⤵
  PID:8152
- C:\Windows\System\cumhqFh.exe
  C:\Windows\System\cumhqFh.exe
  2⤵
  PID:8168
- C:\Windows\System\WrYTPYS.exe
  C:\Windows\System\WrYTPYS.exe
  2⤵
  PID:8184
- C:\Windows\System\vMXPImY.exe
  C:\Windows\System\vMXPImY.exe
  2⤵
  PID:7172
- C:\Windows\System\eDFRepB.exe
  C:\Windows\System\eDFRepB.exe
  2⤵
  PID:7236
- C:\Windows\System\qegDeBO.exe
  C:\Windows\System\qegDeBO.exe
  2⤵
  PID:7300
- C:\Windows\System\HlIgFSB.exe
  C:\Windows\System\HlIgFSB.exe
  2⤵
  PID:7032
- C:\Windows\System\qyTEVyM.exe
  C:\Windows\System\qyTEVyM.exe
  2⤵
  PID:7396
- C:\Windows\System\nLZqJNe.exe
  C:\Windows\System\nLZqJNe.exe
  2⤵
  PID:7428
- C:\Windows\System\eSYdSvY.exe
  C:\Windows\System\eSYdSvY.exe
  2⤵
  PID:7492
- C:\Windows\System\umjHfwz.exe
  C:\Windows\System\umjHfwz.exe
  2⤵
  PID:7128
- C:\Windows\System\OVmQttc.exe
  C:\Windows\System\OVmQttc.exe
  2⤵
  PID:7552
- C:\Windows\System\rjctpDy.exe
  C:\Windows\System\rjctpDy.exe
  2⤵
  PID:7616
- C:\Windows\System\jmpoaYb.exe
  C:\Windows\System\jmpoaYb.exe
  2⤵
  PID:7248
- C:\Windows\System\lOyaHTg.exe
  C:\Windows\System\lOyaHTg.exe
  2⤵
  PID:7348
- C:\Windows\System\wPXkdTm.exe
  C:\Windows\System\wPXkdTm.exe
  2⤵
  PID:7440
- C:\Windows\System\EEUniVZ.exe
  C:\Windows\System\EEUniVZ.exe
  2⤵
  PID:7504
- C:\Windows\System\GPKvBod.exe
  C:\Windows\System\GPKvBod.exe
  2⤵
  PID:7568
- C:\Windows\System\ksxBzvH.exe
  C:\Windows\System\ksxBzvH.exe
  2⤵
  PID:7632
- C:\Windows\System\iZpIjax.exe
  C:\Windows\System\iZpIjax.exe
  2⤵
  PID:7312
- C:\Windows\System\pBARouh.exe
  C:\Windows\System\pBARouh.exe
  2⤵
  PID:7364
- C:\Windows\System\fwtypCf.exe
  C:\Windows\System\fwtypCf.exe
  2⤵
  PID:7712
- C:\Windows\System\wPjSemw.exe
  C:\Windows\System\wPjSemw.exe
  2⤵
  PID:7668
- C:\Windows\System\ptfRozJ.exe
  C:\Windows\System\ptfRozJ.exe
  2⤵
  PID:7748
- C:\Windows\System\AFOoBVF.exe
  C:\Windows\System\AFOoBVF.exe
  2⤵
  PID:7812
- C:\Windows\System\wlFSbtT.exe
  C:\Windows\System\wlFSbtT.exe
  2⤵
  PID:7908
- C:\Windows\System\gLMCPJI.exe
  C:\Windows\System\gLMCPJI.exe
  2⤵
  PID:7700
- C:\Windows\System\PvAkhcH.exe
  C:\Windows\System\PvAkhcH.exe
  2⤵
  PID:7856
- C:\Windows\System\WxaZMbG.exe
  C:\Windows\System\WxaZMbG.exe
  2⤵
  PID:7764
- C:\Windows\System\aiznuJP.exe
  C:\Windows\System\aiznuJP.exe
  2⤵
  PID:7936
- C:\Windows\System\rJUdBpc.exe
  C:\Windows\System\rJUdBpc.exe
  2⤵
  PID:8004
- C:\Windows\System\xIDsPDa.exe
  C:\Windows\System\xIDsPDa.exe
  2⤵
  PID:8064
- C:\Windows\System\LOHKjxy.exe
  C:\Windows\System\LOHKjxy.exe
  2⤵
  PID:8100
- C:\Windows\System\DvuUUFu.exe
  C:\Windows\System\DvuUUFu.exe
  2⤵
  PID:7984
- C:\Windows\System\ryybmDa.exe
  C:\Windows\System\ryybmDa.exe
  2⤵
  PID:8016
- C:\Windows\System\kFnplgj.exe
  C:\Windows\System\kFnplgj.exe
  2⤵
  PID:8112
- C:\Windows\System\qdTpXvx.exe
  C:\Windows\System\qdTpXvx.exe
  2⤵
  PID:6628
- C:\Windows\System\eWiWhCm.exe
  C:\Windows\System\eWiWhCm.exe
  2⤵
  PID:8084
- C:\Windows\System\jvFPJrP.exe
  C:\Windows\System\jvFPJrP.exe
  2⤵
  PID:7360
- C:\Windows\System\VNmCeiM.exe
  C:\Windows\System\VNmCeiM.exe
  2⤵
  PID:7204
- C:\Windows\System\cxiuELx.exe
  C:\Windows\System\cxiuELx.exe
  2⤵
  PID:7112
- C:\Windows\System\vxVKlji.exe
  C:\Windows\System\vxVKlji.exe
  2⤵
  PID:7408
- C:\Windows\System\rFDyVOn.exe
  C:\Windows\System\rFDyVOn.exe
  2⤵
  PID:7664
- C:\Windows\System\GqHJbod.exe
  C:\Windows\System\GqHJbod.exe
  2⤵
  PID:7424
- C:\Windows\System\zXieDWH.exe
  C:\Windows\System\zXieDWH.exe
  2⤵
  PID:7588
- C:\Windows\System\pRxjfQj.exe
  C:\Windows\System\pRxjfQj.exe
  2⤵
  PID:7584
- C:\Windows\System\QZmcgbA.exe
  C:\Windows\System\QZmcgbA.exe
  2⤵
  PID:7476
- C:\Windows\System\WBWfNVj.exe
  C:\Windows\System\WBWfNVj.exe
  2⤵
  PID:7684
- C:\Windows\System\HXyjpfv.exe
  C:\Windows\System\HXyjpfv.exe
  2⤵
  PID:7652
- C:\Windows\System\ODQYRWw.exe
  C:\Windows\System\ODQYRWw.exe
  2⤵
  PID:7888
- C:\Windows\System\dyycGac.exe
  C:\Windows\System\dyycGac.exe
  2⤵
  PID:7732
- C:\Windows\System\WmFqbna.exe
  C:\Windows\System\WmFqbna.exe
  2⤵
  PID:8036
- C:\Windows\System\IDtKsLb.exe
  C:\Windows\System\IDtKsLb.exe
  2⤵
  PID:7968
- C:\Windows\System\mlwwjYf.exe
  C:\Windows\System\mlwwjYf.exe
  2⤵
  PID:8144
- C:\Windows\System\BonssVA.exe
  C:\Windows\System\BonssVA.exe
  2⤵
  PID:8116
- C:\Windows\System\FrdXvln.exe
  C:\Windows\System\FrdXvln.exe
  2⤵
  PID:6788
- C:\Windows\System\YGfDmrn.exe
  C:\Windows\System\YGfDmrn.exe
  2⤵
  PID:7296
- C:\Windows\System\haalRCw.exe
  C:\Windows\System\haalRCw.exe
  2⤵
  PID:7216
- C:\Windows\System\JjAAufW.exe
  C:\Windows\System\JjAAufW.exe
  2⤵
  PID:6736
- C:\Windows\System\eyZraxY.exe
  C:\Windows\System\eyZraxY.exe
  2⤵
  PID:6972
- C:\Windows\System\WOfYeMY.exe
  C:\Windows\System\WOfYeMY.exe
  2⤵
  PID:7344
- C:\Windows\System\SYJwxrH.exe
  C:\Windows\System\SYJwxrH.exe
  2⤵
  PID:7472
- C:\Windows\System\fFLGkFi.exe
  C:\Windows\System\fFLGkFi.exe
  2⤵
  PID:8080
- C:\Windows\System\WJMEXgk.exe
  C:\Windows\System\WJMEXgk.exe
  2⤵
  PID:7824
- C:\Windows\System\wlMFvyh.exe
  C:\Windows\System\wlMFvyh.exe
  2⤵
  PID:7988
- C:\Windows\System\IUqqlYO.exe
  C:\Windows\System\IUqqlYO.exe
  2⤵
  PID:7232
- C:\Windows\System\qsZALis.exe
  C:\Windows\System\qsZALis.exe
  2⤵
  PID:7520
- C:\Windows\System\jvMjwdv.exe
  C:\Windows\System\jvMjwdv.exe
  2⤵
  PID:7924
- C:\Windows\System\gHgLTvs.exe
  C:\Windows\System\gHgLTvs.exe
  2⤵
  PID:8032
- C:\Windows\System\atmOEcR.exe
  C:\Windows\System\atmOEcR.exe
  2⤵
  PID:7488
- C:\Windows\System\hhHSjLz.exe
  C:\Windows\System\hhHSjLz.exe
  2⤵
  PID:8196
- C:\Windows\System\SuZpyzO.exe
  C:\Windows\System\SuZpyzO.exe
  2⤵
  PID:8212
- C:\Windows\System\orlctBz.exe
  C:\Windows\System\orlctBz.exe
  2⤵
  PID:8228
- C:\Windows\System\WHSeNlR.exe
  C:\Windows\System\WHSeNlR.exe
  2⤵
  PID:8244
- C:\Windows\System\siDJELj.exe
  C:\Windows\System\siDJELj.exe
  2⤵
  PID:8260
- C:\Windows\System\hsSOxMb.exe
  C:\Windows\System\hsSOxMb.exe
  2⤵
  PID:8276
- C:\Windows\System\wHMZiEs.exe
  C:\Windows\System\wHMZiEs.exe
  2⤵
  PID:8292
- C:\Windows\System\VPbznbU.exe
  C:\Windows\System\VPbznbU.exe
  2⤵
  PID:8308
- C:\Windows\System\xcuUPZO.exe
  C:\Windows\System\xcuUPZO.exe
  2⤵
  PID:8324
- C:\Windows\System\bCawqZr.exe
  C:\Windows\System\bCawqZr.exe
  2⤵
  PID:8340
- C:\Windows\System\yMqiDRt.exe
  C:\Windows\System\yMqiDRt.exe
  2⤵
  PID:8360
- C:\Windows\System\kBWGSVf.exe
  C:\Windows\System\kBWGSVf.exe
  2⤵
  PID:8376
- C:\Windows\System\WTathRa.exe
  C:\Windows\System\WTathRa.exe
  2⤵
  PID:8392
- C:\Windows\System\eylZUNb.exe
  C:\Windows\System\eylZUNb.exe
  2⤵
  PID:8408
- C:\Windows\System\PiulCTU.exe
  C:\Windows\System\PiulCTU.exe
  2⤵
  PID:8424
- C:\Windows\System\NlEeidb.exe
  C:\Windows\System\NlEeidb.exe
  2⤵
  PID:8440
- C:\Windows\System\XrDCmBY.exe
  C:\Windows\System\XrDCmBY.exe
  2⤵
  PID:8456
- C:\Windows\System\ZZTApJV.exe
  C:\Windows\System\ZZTApJV.exe
  2⤵
  PID:8472
- C:\Windows\System\oHFShyp.exe
  C:\Windows\System\oHFShyp.exe
  2⤵
  PID:8488
- C:\Windows\System\thLQvQh.exe
  C:\Windows\System\thLQvQh.exe
  2⤵
  PID:8504
- C:\Windows\System\KPiSYLH.exe
  C:\Windows\System\KPiSYLH.exe
  2⤵
  PID:8520
- C:\Windows\System\iNTgdsf.exe
  C:\Windows\System\iNTgdsf.exe
  2⤵
  PID:8536
- C:\Windows\System\sXONaMo.exe
  C:\Windows\System\sXONaMo.exe
  2⤵
  PID:8552
- C:\Windows\System\GDtqMYp.exe
  C:\Windows\System\GDtqMYp.exe
  2⤵
  PID:8568
- C:\Windows\System\bOhcTdf.exe
  C:\Windows\System\bOhcTdf.exe
  2⤵
  PID:8584
- C:\Windows\System\EjNapsi.exe
  C:\Windows\System\EjNapsi.exe
  2⤵
  PID:8600
- C:\Windows\System\upRpRle.exe
  C:\Windows\System\upRpRle.exe
  2⤵
  PID:8616
- C:\Windows\System\QfdTBHH.exe
  C:\Windows\System\QfdTBHH.exe
  2⤵
  PID:8632
- C:\Windows\System\MANJnbs.exe
  C:\Windows\System\MANJnbs.exe
  2⤵
  PID:8648
- C:\Windows\System\htLkjNS.exe
  C:\Windows\System\htLkjNS.exe
  2⤵
  PID:8664
- C:\Windows\System\SsPSHdO.exe
  C:\Windows\System\SsPSHdO.exe
  2⤵
  PID:8680
- C:\Windows\System\tokDKMX.exe
  C:\Windows\System\tokDKMX.exe
  2⤵
  PID:8696
- C:\Windows\System\tMDgFea.exe
  C:\Windows\System\tMDgFea.exe
  2⤵
  PID:8712
- C:\Windows\System\NROxkYV.exe
  C:\Windows\System\NROxkYV.exe
  2⤵
  PID:8728
- C:\Windows\System\KPGaJqy.exe
  C:\Windows\System\KPGaJqy.exe
  2⤵
  PID:8744
- C:\Windows\System\GewQPNu.exe
  C:\Windows\System\GewQPNu.exe
  2⤵
  PID:8760
- C:\Windows\System\GHfXJNj.exe
  C:\Windows\System\GHfXJNj.exe
  2⤵
  PID:8776
- C:\Windows\System\DhXHefr.exe
  C:\Windows\System\DhXHefr.exe
  2⤵
  PID:8792
- C:\Windows\System\YcIjJBo.exe
  C:\Windows\System\YcIjJBo.exe
  2⤵
  PID:8808
- C:\Windows\System\EGFEhsr.exe
  C:\Windows\System\EGFEhsr.exe
  2⤵
  PID:8824
- C:\Windows\System\qyIaYWt.exe
  C:\Windows\System\qyIaYWt.exe
  2⤵
  PID:8840
- C:\Windows\System\QGtWBrG.exe
  C:\Windows\System\QGtWBrG.exe
  2⤵
  PID:8856
- C:\Windows\System\EbFpeLR.exe
  C:\Windows\System\EbFpeLR.exe
  2⤵
  PID:8872
- C:\Windows\System\pWkxsWK.exe
  C:\Windows\System\pWkxsWK.exe
  2⤵
  PID:8888
- C:\Windows\System\TZadAyf.exe
  C:\Windows\System\TZadAyf.exe
  2⤵
  PID:8904
- C:\Windows\System\aRptxtp.exe
  C:\Windows\System\aRptxtp.exe
  2⤵
  PID:8920
- C:\Windows\System\ErsQdHf.exe
  C:\Windows\System\ErsQdHf.exe
  2⤵
  PID:8936
- C:\Windows\System\KlAzGKF.exe
  C:\Windows\System\KlAzGKF.exe
  2⤵
  PID:8952
- C:\Windows\System\xECaZyk.exe
  C:\Windows\System\xECaZyk.exe
  2⤵
  PID:8968
- C:\Windows\System\gXoTgJD.exe
  C:\Windows\System\gXoTgJD.exe
  2⤵
  PID:8984
- C:\Windows\System\lSybIqD.exe
  C:\Windows\System\lSybIqD.exe
  2⤵
  PID:9000
- C:\Windows\System\UCWLYuQ.exe
  C:\Windows\System\UCWLYuQ.exe
  2⤵
  PID:9016
- C:\Windows\System\Zprzqxe.exe
  C:\Windows\System\Zprzqxe.exe
  2⤵
  PID:9032
- C:\Windows\System\gANqeGi.exe
  C:\Windows\System\gANqeGi.exe
  2⤵
  PID:9048
- C:\Windows\System\sVyNFCi.exe
  C:\Windows\System\sVyNFCi.exe
  2⤵
  PID:9064
- C:\Windows\System\BHBczkw.exe
  C:\Windows\System\BHBczkw.exe
  2⤵
  PID:9084
- C:\Windows\System\qRdRZhX.exe
  C:\Windows\System\qRdRZhX.exe
  2⤵
  PID:9100
- C:\Windows\System\vWiMXoy.exe
  C:\Windows\System\vWiMXoy.exe
  2⤵
  PID:9116
- C:\Windows\System\eAucVHk.exe
  C:\Windows\System\eAucVHk.exe
  2⤵
  PID:9132
- C:\Windows\System\DWFwAUX.exe
  C:\Windows\System\DWFwAUX.exe
  2⤵
  PID:9148
- C:\Windows\System\bHTCxQB.exe
  C:\Windows\System\bHTCxQB.exe
  2⤵
  PID:9164
- C:\Windows\System\FVgcphH.exe
  C:\Windows\System\FVgcphH.exe
  2⤵
  PID:9180
- C:\Windows\System\eNgafoa.exe
  C:\Windows\System\eNgafoa.exe
  2⤵
  PID:9196
- C:\Windows\System\WRoXchv.exe
  C:\Windows\System\WRoXchv.exe
  2⤵
  PID:9212
- C:\Windows\System\sEhhpBX.exe
  C:\Windows\System\sEhhpBX.exe
  2⤵
  PID:6592
- C:\Windows\System\OTYlZmG.exe
  C:\Windows\System\OTYlZmG.exe
  2⤵
  PID:7972
- C:\Windows\System\CTcWoLg.exe
  C:\Windows\System\CTcWoLg.exe
  2⤵
  PID:8240
- C:\Windows\System\PYnEDjY.exe
  C:\Windows\System\PYnEDjY.exe
  2⤵
  PID:8304
- C:\Windows\System\lmDUHyc.exe
  C:\Windows\System\lmDUHyc.exe
  2⤵
  PID:8372
- C:\Windows\System\lrYRwHm.exe
  C:\Windows\System\lrYRwHm.exe
  2⤵
  PID:8436
- C:\Windows\System\kxQAEdo.exe
  C:\Windows\System\kxQAEdo.exe
  2⤵
  PID:8256
- C:\Windows\System\Agpphyo.exe
  C:\Windows\System\Agpphyo.exe
  2⤵
  PID:8388
- C:\Windows\System\SYuGDNt.exe
  C:\Windows\System\SYuGDNt.exe
  2⤵
  PID:8528
- C:\Windows\System\KZmtMqH.exe
  C:\Windows\System\KZmtMqH.exe
  2⤵
  PID:8564
- C:\Windows\System\qTutcdB.exe
  C:\Windows\System\qTutcdB.exe
  2⤵
  PID:8352
- C:\Windows\System\AiiVLou.exe
  C:\Windows\System\AiiVLou.exe
  2⤵
  PID:8480
- C:\Windows\System\TzkTImL.exe
  C:\Windows\System\TzkTImL.exe
  2⤵
  PID:8628
- C:\Windows\System\neYuYlu.exe
  C:\Windows\System\neYuYlu.exe
  2⤵
  PID:8512
- C:\Windows\System\psWvaTq.exe
  C:\Windows\System\psWvaTq.exe
  2⤵
  PID:8576
- C:\Windows\System\PvIfkYX.exe
  C:\Windows\System\PvIfkYX.exe
  2⤵
  PID:8608
- C:\Windows\System\LVlPOZE.exe
  C:\Windows\System\LVlPOZE.exe
  2⤵
  PID:8720
- C:\Windows\System\jVMZAOI.exe
  C:\Windows\System\jVMZAOI.exe
  2⤵
  PID:8756
- C:\Windows\System\akTwQTV.exe
  C:\Windows\System\akTwQTV.exe
  2⤵
  PID:8848
- C:\Windows\System\KQzuCkj.exe
  C:\Windows\System\KQzuCkj.exe
  2⤵
  PID:8736
- C:\Windows\System\afRIgZM.exe
  C:\Windows\System\afRIgZM.exe
  2⤵
  PID:8864
- C:\Windows\System\TbgzNhC.exe
  C:\Windows\System\TbgzNhC.exe
  2⤵
  PID:8708
- C:\Windows\System\hWCvWNB.exe
  C:\Windows\System\hWCvWNB.exe
  2⤵
  PID:8900
- C:\Windows\System\FWQzzSy.exe
  C:\Windows\System\FWQzzSy.exe
  2⤵
  PID:8948
- C:\Windows\System\AJQLMxi.exe
  C:\Windows\System\AJQLMxi.exe
  2⤵
  PID:9008
- C:\Windows\System\juYmEch.exe
  C:\Windows\System\juYmEch.exe
  2⤵
  PID:9012
- C:\Windows\System\zrMJrnu.exe
  C:\Windows\System\zrMJrnu.exe
  2⤵
  PID:9040
- C:\Windows\System\TeizJRd.exe
  C:\Windows\System\TeizJRd.exe
  2⤵
  PID:9080
- C:\Windows\System\cTZMKaA.exe
  C:\Windows\System\cTZMKaA.exe
  2⤵
  PID:9108
- C:\Windows\System\oVuTlLF.exe
  C:\Windows\System\oVuTlLF.exe
  2⤵
  PID:9060
- C:\Windows\System\etvYKFl.exe
  C:\Windows\System\etvYKFl.exe
  2⤵
  PID:9144
- C:\Windows\System\XCzrVhu.exe
  C:\Windows\System\XCzrVhu.exe
  2⤵
  PID:9128
- C:\Windows\System\RUERIfB.exe
  C:\Windows\System\RUERIfB.exe
  2⤵
  PID:9208
- C:\Windows\System\lDsOAlB.exe
  C:\Windows\System\lDsOAlB.exe
  2⤵
  PID:6860
- C:\Windows\System\xwdimCn.exe
  C:\Windows\System\xwdimCn.exe
  2⤵
  PID:7876
- C:\Windows\System\KKitMUH.exe
  C:\Windows\System\KKitMUH.exe
  2⤵
  PID:8236
- C:\Windows\System\pmTRDPa.exe
  C:\Windows\System\pmTRDPa.exe
  2⤵
  PID:1572
- C:\Windows\System\frHuJHN.exe
  C:\Windows\System\frHuJHN.exe
  2⤵
  PID:8252
- C:\Windows\System\liDfQvA.exe
  C:\Windows\System\liDfQvA.exe
  2⤵
  PID:8316
- C:\Windows\System\ikuyAYr.exe
  C:\Windows\System\ikuyAYr.exe
  2⤵
  PID:8580
- C:\Windows\System\inMAAau.exe
  C:\Windows\System\inMAAau.exe
  2⤵
  PID:8384
- C:\Windows\System\QQFKizi.exe
  C:\Windows\System\QQFKizi.exe
  2⤵
  PID:8692
- C:\Windows\System\vdmoDwM.exe
  C:\Windows\System\vdmoDwM.exe
  2⤵
  PID:8624
- C:\Windows\System\iNDmnzB.exe
  C:\Windows\System\iNDmnzB.exe
  2⤵
  PID:8676
- C:\Windows\System\AZCkNNY.exe
  C:\Windows\System\AZCkNNY.exe
  2⤵
  PID:8916
- C:\Windows\System\tqWsDLz.exe
  C:\Windows\System\tqWsDLz.exe
  2⤵
  PID:8896
- C:\Windows\System\PHjhkPl.exe
  C:\Windows\System\PHjhkPl.exe
  2⤵
  PID:8964
- C:\Windows\System\SWoLzAO.exe
  C:\Windows\System\SWoLzAO.exe
  2⤵
  PID:9092
- C:\Windows\System\uUgRDVg.exe
  C:\Windows\System\uUgRDVg.exe
  2⤵
  PID:9124
- C:\Windows\System\WsnqzDJ.exe
  C:\Windows\System\WsnqzDJ.exe
  2⤵
  PID:9192
- C:\Windows\System\QtLTtOH.exe
  C:\Windows\System\QtLTtOH.exe
  2⤵
  PID:8224
- C:\Windows\System\cZQaLmp.exe
  C:\Windows\System\cZQaLmp.exe
  2⤵
  PID:9204
- C:\Windows\System\PpOkFat.exe
  C:\Windows\System\PpOkFat.exe
  2⤵
  PID:8300
- C:\Windows\System\HVgOuXQ.exe
  C:\Windows\System\HVgOuXQ.exe
  2⤵
  PID:8788
- C:\Windows\System\NEgYSgK.exe
  C:\Windows\System\NEgYSgK.exe
  2⤵
  PID:8724
- C:\Windows\System\AeKukrk.exe
  C:\Windows\System\AeKukrk.exe
  2⤵
  PID:8772
- C:\Windows\System\SstgOqw.exe
  C:\Windows\System\SstgOqw.exe
  2⤵
  PID:9156
- C:\Windows\System\QwOvBzS.exe
  C:\Windows\System\QwOvBzS.exe
  2⤵
  PID:8548
- C:\Windows\System\dNjMzZW.exe
  C:\Windows\System\dNjMzZW.exe
  2⤵
  PID:8996
- C:\Windows\System\rKGpCah.exe
  C:\Windows\System\rKGpCah.exe
  2⤵
  PID:9176
- C:\Windows\System\bOhbtNN.exe
  C:\Windows\System\bOhbtNN.exe
  2⤵
  PID:8400
- C:\Windows\System\tOutslb.exe
  C:\Windows\System\tOutslb.exe
  2⤵
  PID:9232
- C:\Windows\System\UUJYcsu.exe
  C:\Windows\System\UUJYcsu.exe
  2⤵
  PID:9248
- C:\Windows\System\OygipOn.exe
  C:\Windows\System\OygipOn.exe
  2⤵
  PID:9264
- C:\Windows\System\oBdbXoq.exe
  C:\Windows\System\oBdbXoq.exe
  2⤵
  PID:9280
- C:\Windows\System\hdsXWIh.exe
  C:\Windows\System\hdsXWIh.exe
  2⤵
  PID:9296
- C:\Windows\System\HxiNfBJ.exe
  C:\Windows\System\HxiNfBJ.exe
  2⤵
  PID:9316
- C:\Windows\System\azrtIvb.exe
  C:\Windows\System\azrtIvb.exe
  2⤵
  PID:9336
- C:\Windows\System\ZUXeQMU.exe
  C:\Windows\System\ZUXeQMU.exe
  2⤵
  PID:9360
- C:\Windows\System\UxkPeUT.exe
  C:\Windows\System\UxkPeUT.exe
  2⤵
  PID:9376
- C:\Windows\System\BwRgMIn.exe
  C:\Windows\System\BwRgMIn.exe
  2⤵
  PID:9400
- C:\Windows\System\GPUglDP.exe
  C:\Windows\System\GPUglDP.exe
  2⤵
  PID:9420
- C:\Windows\System\YYjEbGN.exe
  C:\Windows\System\YYjEbGN.exe
  2⤵
  PID:9436
- C:\Windows\System\dWyAESF.exe
  C:\Windows\System\dWyAESF.exe
  2⤵
  PID:9452
- C:\Windows\System\gRJMtfe.exe
  C:\Windows\System\gRJMtfe.exe
  2⤵
  PID:9468
- C:\Windows\System\dTHQPTd.exe
  C:\Windows\System\dTHQPTd.exe
  2⤵
  PID:9484
- C:\Windows\System\YUPrVOw.exe
  C:\Windows\System\YUPrVOw.exe
  2⤵
  PID:9500
- C:\Windows\System\vhFjLGJ.exe
  C:\Windows\System\vhFjLGJ.exe
  2⤵
  PID:9516
- C:\Windows\System\SHtrHKC.exe
  C:\Windows\System\SHtrHKC.exe
  2⤵
  PID:9536
- C:\Windows\System\hSEnwtp.exe
  C:\Windows\System\hSEnwtp.exe
  2⤵
  PID:9556
- C:\Windows\System\pjeQhbF.exe
  C:\Windows\System\pjeQhbF.exe
  2⤵
  PID:9576
- C:\Windows\System\hjuFUzu.exe
  C:\Windows\System\hjuFUzu.exe
  2⤵
  PID:9596
- C:\Windows\System\WofKruK.exe
  C:\Windows\System\WofKruK.exe
  2⤵
  PID:9612
- C:\Windows\System\GbfZQtD.exe
  C:\Windows\System\GbfZQtD.exe
  2⤵
  PID:9632
- C:\Windows\System\HFZJRRw.exe
  C:\Windows\System\HFZJRRw.exe
  2⤵
  PID:9656
- C:\Windows\System\NYBrVTr.exe
  C:\Windows\System\NYBrVTr.exe
  2⤵
  PID:9676
- C:\Windows\System\qewzHIl.exe
  C:\Windows\System\qewzHIl.exe
  2⤵
  PID:9704
- C:\Windows\System\IabSATx.exe
  C:\Windows\System\IabSATx.exe
  2⤵
  PID:9724
- C:\Windows\System\rMNOEHe.exe
  C:\Windows\System\rMNOEHe.exe
  2⤵
  PID:9748
- C:\Windows\System\drjcgvf.exe
  C:\Windows\System\drjcgvf.exe
  2⤵
  PID:9768
- C:\Windows\System\NkfFNiw.exe
  C:\Windows\System\NkfFNiw.exe
  2⤵
  PID:9784
- C:\Windows\System\gAvaGhY.exe
  C:\Windows\System\gAvaGhY.exe
  2⤵
  PID:9800
- C:\Windows\System\rgiuuEL.exe
  C:\Windows\System\rgiuuEL.exe
  2⤵
  PID:9816
- C:\Windows\System\AAkGnza.exe
  C:\Windows\System\AAkGnza.exe
  2⤵
  PID:9832
- C:\Windows\System\RysNNlG.exe
  C:\Windows\System\RysNNlG.exe
  2⤵
  PID:9848
- C:\Windows\System\wCaaBBY.exe
  C:\Windows\System\wCaaBBY.exe
  2⤵
  PID:9864
- C:\Windows\System\ufQNQBC.exe
  C:\Windows\System\ufQNQBC.exe
  2⤵
  PID:9880
- C:\Windows\System\UuNhGVo.exe
  C:\Windows\System\UuNhGVo.exe
  2⤵
  PID:9896
- C:\Windows\System\GwqWPQd.exe
  C:\Windows\System\GwqWPQd.exe
  2⤵
  PID:9912
- C:\Windows\System\rhrnCkk.exe
  C:\Windows\System\rhrnCkk.exe
  2⤵
  PID:9928
- C:\Windows\System\HzAKygo.exe
  C:\Windows\System\HzAKygo.exe
  2⤵
  PID:9944
- C:\Windows\System\AdEZHxo.exe
  C:\Windows\System\AdEZHxo.exe
  2⤵
  PID:9960
- C:\Windows\System\xSqgxUG.exe
  C:\Windows\System\xSqgxUG.exe
  2⤵
  PID:9976
- C:\Windows\System\YzPLsnU.exe
  C:\Windows\System\YzPLsnU.exe
  2⤵
  PID:9992
- C:\Windows\System\AifWXjI.exe
  C:\Windows\System\AifWXjI.exe
  2⤵
  PID:10008
- C:\Windows\System\VDSExvm.exe
  C:\Windows\System\VDSExvm.exe
  2⤵
  PID:10024
- C:\Windows\System\oHqzTGL.exe
  C:\Windows\System\oHqzTGL.exe
  2⤵
  PID:10040
- C:\Windows\System\AvIslJd.exe
  C:\Windows\System\AvIslJd.exe
  2⤵
  PID:10056
- C:\Windows\System\grPBrXP.exe
  C:\Windows\System\grPBrXP.exe
  2⤵
  PID:10072
- C:\Windows\System\tfjzxDX.exe
  C:\Windows\System\tfjzxDX.exe
  2⤵
  PID:10088
- C:\Windows\System\KBcMIGj.exe
  C:\Windows\System\KBcMIGj.exe
  2⤵
  PID:10104
- C:\Windows\System\VQcSaBR.exe
  C:\Windows\System\VQcSaBR.exe
  2⤵
  PID:10120
- C:\Windows\System\pLokMyq.exe
  C:\Windows\System\pLokMyq.exe
  2⤵
  PID:10136
- C:\Windows\System\QaPmIZO.exe
  C:\Windows\System\QaPmIZO.exe
  2⤵
  PID:10152
- C:\Windows\System\cDbfFQI.exe
  C:\Windows\System\cDbfFQI.exe
  2⤵
  PID:10168
- C:\Windows\System\evkpBMv.exe
  C:\Windows\System\evkpBMv.exe
  2⤵
  PID:10184
- C:\Windows\System\axOnkmq.exe
  C:\Windows\System\axOnkmq.exe
  2⤵
  PID:10200
- C:\Windows\System\pyyuxKj.exe
  C:\Windows\System\pyyuxKj.exe
  2⤵
  PID:10216
- C:\Windows\System\SNElQpx.exe
  C:\Windows\System\SNElQpx.exe
  2⤵
  PID:10232
- C:\Windows\System\bejGKOC.exe
  C:\Windows\System\bejGKOC.exe
  2⤵
  PID:8880
- C:\Windows\System\MGcTKNK.exe
  C:\Windows\System\MGcTKNK.exe
  2⤵
  PID:9076
- C:\Windows\System\oElksaF.exe
  C:\Windows\System\oElksaF.exe
  2⤵
  PID:8820
- C:\Windows\System\SyzohBK.exe
  C:\Windows\System\SyzohBK.exe
  2⤵
  PID:9332
- C:\Windows\System\giJKwUM.exe
  C:\Windows\System\giJKwUM.exe
  2⤵
  PID:8452
- C:\Windows\System\iXweqgH.exe
  C:\Windows\System\iXweqgH.exe
  2⤵
  PID:8912
- C:\Windows\System\mXUGQXL.exe
  C:\Windows\System\mXUGQXL.exe
  2⤵
  PID:9416
- C:\Windows\System\RcKPmkx.exe
  C:\Windows\System\RcKPmkx.exe
  2⤵
  PID:9272
- C:\Windows\System\xJnzIKL.exe
  C:\Windows\System\xJnzIKL.exe
  2⤵
  PID:9432
- C:\Windows\System\qyASsBX.exe
  C:\Windows\System\qyASsBX.exe
  2⤵
  PID:9356
- C:\Windows\System\QtoPcib.exe
  C:\Windows\System\QtoPcib.exe
  2⤵
  PID:9392
- C:\Windows\System\pDjPeZP.exe
  C:\Windows\System\pDjPeZP.exe
  2⤵
  PID:9308
- C:\Windows\System\uSJrxcW.exe
  C:\Windows\System\uSJrxcW.exe
  2⤵
  PID:9480
- C:\Windows\System\qTARmBb.exe
  C:\Windows\System\qTARmBb.exe
  2⤵
  PID:9548
- C:\Windows\System\rKXqpOc.exe
  C:\Windows\System\rKXqpOc.exe
  2⤵
  PID:9588
- C:\Windows\System\hwjLCPN.exe
  C:\Windows\System\hwjLCPN.exe
  2⤵
  PID:9664
- C:\Windows\System\vSceCbs.exe
  C:\Windows\System\vSceCbs.exe
  2⤵
  PID:9716
- C:\Windows\System\wTsumfB.exe
  C:\Windows\System\wTsumfB.exe
  2⤵
  PID:9764
- C:\Windows\System\TUHGKte.exe
  C:\Windows\System\TUHGKte.exe
  2⤵
  PID:9736
- C:\Windows\System\TrqrNhQ.exe
  C:\Windows\System\TrqrNhQ.exe
  2⤵
  PID:9640

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\BBGggoM.exe

Filesize
2.6MB

MD5
c0aa94fba36a2218300c238a4f9f765e

SHA1
133b1e861548d4c4734482def10eb14a7042c1f8

SHA256
c4b3ebe1920ef2ac6a818f1f807b5bf1ff4aed49b0b801c0cc2a1d825fb9f203

SHA512
19e73906b6110c7a80c50ea2779ec97353536f9b31af06003a0fe554a5104a6f33d400c2fe23c2cbc72ac227a2130c3ffe320bafcd06f6b566c7e4bd700f8898

Download Submit
C:\Windows\system\BpstiVh.exe

Filesize
2.6MB

MD5
b86f7fb9cc3d458929179a3b25ff0990

SHA1
9fbb93acf3c171195a6d3c5c63485b0779642ce3

SHA256
3d8525475a886c3f803a45d722899dcc271e7a093360e39a067af665c883c4f7

SHA512
85f898de3268dd3a7755717d9ccb2dfd2e5971d69d85df09b4d5b00d01b1ba94c926939a45440366aabc1a5c54b9b801917c08da185198dcdee6a11596d56f47

Download Submit
C:\Windows\system\DiDqiNz.exe

Filesize
2.6MB

MD5
b5a5fe5ec33006e87c324a15a50ccd2c

SHA1
51e89fb334efe90a8b91c31fa371618e2728cd54

SHA256
934f6d431d808196c41573cfffec0639a90a301c4b930e99f613fe23cd478e5f

SHA512
d6254064ff8ab7712ab2a016d63e5ef10ccf0494fe61c1f4520511b6dc24d882f1aa6d0a5036899de7f968ab817f3b4d0327f042d1a86d98974d34c96c060646

Download Submit
C:\Windows\system\DoZaIIR.exe

Filesize
2.6MB

MD5
1074bf55cfa3598f16526f59a96a91df

SHA1
6afe79b4643ab5b4df6b8c44962ec013c04fbfaa

SHA256
d2d9756466d5db16c4a4ce8bbc84de6b919dcd93e6aabfd09cbd149a2dc23199

SHA512
03025b2767deb87144a672bb33bd52019ed4b23f1644f3ffae2dca59701f90d30c474c0c68befca6333f4c645f692cbf232cdebe1529ef83fcb708708074924e

Download Submit
C:\Windows\system\GuYclUJ.exe

Filesize
2.6MB

MD5
4e17975de5ec463e39f8e54761fb9eb9

SHA1
414645662f692d0c72a091c1b04f1a56d7cb7d79

SHA256
3c5f330d64d105ec3a8651ecc4c4e5755f6262b2e8a3620e3a56b8ef84cc3066

SHA512
18ff6dd6fbfd27762796f11fd089282174831f49b0bc3a81bd6cd48d0d60a7d2b25f99a5ba95e7311ff3ef817359b67357af0dc9bb47157e902171865fdd03ef

Download Submit
C:\Windows\system\HlBKlGo.exe

Filesize
2.6MB

MD5
c8b74d88c1a3de8548dc5b3c047ed906

SHA1
1ccfd549157e65b18602e2674e10dc6a48a74a42

SHA256
433eaa752e84b673b9d6386e95352d0c029a05db0e0aece7a9e2755cc36daffa

SHA512
1a32055f178d3bbf37765498eb6b2448a1a0171c3e4124f2ed962890f9b6cd1ed68529f4587f1056d40ddc07c2d1a59308a91d2f50ead2546f80f1123f053e6f

Download Submit
C:\Windows\system\MTFXvSM.exe

Filesize
8B

MD5
b4264996759d988d82730e6958cf8074

SHA1
7bbc1f74a3ce00994d790da4622d87f15f45b523

SHA256
8ec7039187958fcd27e56e585c4d65242972777fffc8821de830bc1ff1727bca

SHA512
90e2f3e49d27ab4d11cbf031af514cf6fc3a8851362bc0086d9e25b2d97c3341159ec901fb19a665474ceb995371e4f69eda62c3d14f844ace445c61339d139c

Download Submit
C:\Windows\system\MhNULTh.exe

Filesize
2.6MB

MD5
e8fdb673e9c7f4fe46fdd163407d06bc

SHA1
ce237a0a3697a3d52cce3cefc165530413e32857

SHA256
ff5ca6ccc9a40f637642e16e33f410c9ebc1b3c3a38710b8e45a982219862935

SHA512
f991b9a57b65d2d265d42964cd5bc2a089f562eda777ea96c870f637bd07726b6bc76ec0b152e6102a638b0b095b4aa34f4f5b5acc78b4c8fe6b701768e228bc

Download Submit
C:\Windows\system\PtRnyFS.exe

Filesize
2.6MB

MD5
804322dfbd15fb76eda61d62966639f0

SHA1
db47f338fdbd0524deaaa8936704a48ebe7e7444

SHA256
dcea440e9b8e0b43ad794578342f4529d6a8d1cf5a5146448214eb3ee9e91f40

SHA512
89767981a974cb86b7552e8e55396f47cf0afb31e7a461e9ec5e13270475e489f2384c41020ed2d8195ad431b6dd98be0cce0b277e71a0dc8bd14ecfec3e0faa

Download Submit
C:\Windows\system\QVmslXX.exe

Filesize
2.6MB

MD5
372968034fe3385302ed5d88833c672e

SHA1
a7117089018f28ce1a04bfd0f54b92e520dfaf73

SHA256
9d05d6568e4a751851b3c7ab746d8163cbe3b424ea0ac89dea6dc755a4be9d0d

SHA512
62862604703e6200beb6909d2460c19079324cbf84f353e96febd59290ede8ff3848218567c4a50251fedffb5052b667a5034a1a3b9f8f5b782996d8b048d061

Download Submit
C:\Windows\system\SwfTpdI.exe

Filesize
2.6MB

MD5
3367822f7dc5e4948c63b5fd4e0a4650

SHA1
4abe2f9d55eebac7d6143d7add5ab51d8929b581

SHA256
418b17c9dc441ea0134712d3d19bba8440a10231eecec0a03fc439a88e8214e6

SHA512
921de3f044b85d4ce6ab7e07cf774329f53ac56b577ac03486e053c4ddec461c85d21113e586e82c360257abb03c21188a1e15aaea39a6ba9022d6921038f014

Download Submit
C:\Windows\system\TRoXSee.exe

Filesize
2.6MB

MD5
6d742124bcbce8f9f8bd96a510e1e9b0

SHA1
cc71c2087fb5a4d25b016f18b9bf0ba3dcb828fc

SHA256
7bb8f4deb04d74de701a0526c7752cc929ae289d9fa7d60c46b2ecb41446836a

SHA512
806e415fe22a7be9dabac2173d65fd29b88cec50185f25a89d738adac90a5b1e54b9540f30f6039cf5b2ebcdb6c47898ef9f16862dbb8c86880ec74cf996bb20

Download Submit
C:\Windows\system\bKnlIgJ.exe

Filesize
2.6MB

MD5
85d79c5c5d7c6571033f48bb0e6a5083

SHA1
0ecbaff77c4a3dc7403e65f7d98e9b592c9de984

SHA256
831f3b034013b25f231a3dcbdc0ccda37bb99ba60a5952c05d7f37dafe09723a

SHA512
40d4d3418ba01592362f0a1604a9ef77f09f3390687aeebffb1e3661c5eb75f2ea44cbcdd8429a0e4e90fb95962de585204cecdd9b93b41a0818fbcefe911b2e

Download Submit
C:\Windows\system\eLZCQaM.exe

Filesize
2.6MB

MD5
0cc67a0c67e78e1d1f718c181b5285be

SHA1
149a6d7b1640a6dbcdd8bd4aa788d745c6917851

SHA256
0aa6d581c9646df13a97fa543a2214d0580493018e338ab7d2ee3e05cbc8ec1f

SHA512
92030e367976af12c991748404dfc2c5d757d75ba6e0f002a7de51d90ff3d4ae53b5e456d233c67f8959a44b2bd6f94fe1cab592567f6971eddd848d52d59ca8

Download Submit
C:\Windows\system\gyRYQse.exe

Filesize
2.6MB

MD5
93ddcd0cc78dc0b0678106074f7ec1ea

SHA1
5ee2823c806990221ceba5cd0924493c229a6ea6

SHA256
d3cbbb525f5ab1fb9d9cd44cbd7bfe2a3f90b1fea4be222194f22cec49c25968

SHA512
38c7e5f21504fa91110aa9a07321f67f38bd9b2960469457110bfd02c060579a90966fd1d0042a4ccc4c017cc4c08246cd8a3f34a661d0960533b2a9d0000b75

Download Submit
C:\Windows\system\hDQegdg.exe

Filesize
2.6MB

MD5
8e86bf0d8bed3e4ecaf83d9867727b3f

SHA1
f03cd58a8b9b660fce07d6d779bc5829b8cc7413

SHA256
007fd32c60d49049da42502e82737a8de0a4873f574c94d87a67bcc801613c8a

SHA512
79353bec507cf589fd7eb77a73043ac052ca3171f30f1b8c60b09015cc08e15b2debb8d71a9742a52d6300a24dcf992c7e427ccb57ccc2ac5c3ff10cd49ad20e

Download Submit
C:\Windows\system\jlhcoww.exe

Filesize
2.6MB

MD5
1d2bf51d916849ba7cdc7a6eb565ab8f

SHA1
de6a08be26f31267cbdee042781c6a38e58cce76

SHA256
5a578fad69fc21e2b227537edc156721bb258e3eb335e77cdfe88b4b72c3808e

SHA512
55ee1a6bdff309109fa00f83474ef97818e67a8732d37ea4a0d755729019435d052c85ed38f856c9c00b1c72f74b3cd425fcc9f7fcafd5c5c74e85226adf96da

Download Submit
C:\Windows\system\kBikqkO.exe

Filesize
2.6MB

MD5
3b6f31826d0b72608eb4fc0b2da88e1a

SHA1
5b4f30b9a709b56b2e449a53c5c0ac7a7892b7d8

SHA256
408a4b74d1322126df9f9a1d6805ed14a33fe66e7f9b869728c42d294e4120c1

SHA512
8691207e6b0e9a984c531de030db4b351a4e1e41bf0f5cc366ebc3b1f0d8d6bde5a424a61bf390467e632f459e75a5ec2e0bdfd1962eaabfdb13c1e5ba158b9e

Download Submit
C:\Windows\system\oSPjiyt.exe

Filesize
2.6MB

MD5
870c3716518e30f60cbbc131c1a6f500

SHA1
a2c94a34c9c2b7dbc5756dcf52d202c8d8e620fa

SHA256
15ced7c3bb09b4f40d8be33b4b1cfcef1029409ee6e499625e153ec795c93bb8

SHA512
1171e0acbdfcf683f20d407b29f6d95e380926207dfa6af445453f5b7cf3911da2dfc64bd924dc898c567493c072fe853668e2419a4df6ca70196653b98c4256

Download Submit
C:\Windows\system\oaSTAwe.exe

Filesize
2.6MB

MD5
f804002b4bc0b88b76bf8e767e4d78af

SHA1
6a3d8eb30225de5bbee32d2d9419e0b1665cbd17

SHA256
2d3db800c2fe3d93ea99367e8c9960d9ae6743b01325c17139307bfabf19aa31

SHA512
27477813babfaef892a91eeec861b4be18aa943cefd319cafd1d4e4a44d3a045bf5f883752ed2a40d1345ddd2c09b95bd241c4f80fb1f1c40cd67c708cfe02e5

Download Submit
C:\Windows\system\slDDGFn.exe

Filesize
2.6MB

MD5
2d764e77ed231fe276d846c8d3098c30

SHA1
3f70f255bd3bd3ee4970630745df24fa29e67b3b

SHA256
6d80fca27dca24a1f48cd8c8c85a73163f9e0141c2425309d244e6b0000667a8

SHA512
74d4245c675167a6f118a496a9552c91868fedbf292d562d53d3c2eb3c6942de6a0035ac996091087078c88064c9d5cd6598db0067a5514a4946c5a4465f26df

Download Submit
C:\Windows\system\tXCsjUF.exe

Filesize
2.6MB

MD5
68ba70be3d3a65d73420e98a51323b44

SHA1
713465a99318bbf48f1bbc2ed694cb3eacd0f560

SHA256
39f9cc71e8f7490ef380623f960460432936418d63301451585a2ca03af0bc8d

SHA512
9f8c707a4151a9035c8426bc1e5a00fd19e737e75768ab1556aa9307e3ac94851d557b926f18dabcd0ec563234c1ce15e40f6c213230acd4665d50304a09a916

Download Submit
C:\Windows\system\wrlhXDL.exe

Filesize
2.6MB

MD5
e8a8c1d8b3a5e9962bc18edbaeab6275

SHA1
bd3acb41487a885251efa0f288dd84a5151521ae

SHA256
0fc7fb9400cb5911cf638cc69b5b4bf805daa1157136c3e2cc5e2acda96a1d68

SHA512
140cfa93c1b3e8715c41b72e0e97d5b39e90447369017d26cc82a2afa97d7ed0da6feeb9b2410b777d1f4bc954c245507234ac644b6b2b7ac4c2875bfe3261ed

Download Submit
C:\Windows\system\xjNvOfZ.exe

Filesize
2.6MB

MD5
32d88f1b00222ee1c06a258068cdff9f

SHA1
145491b0f21b40f654b76464fa95750dc9d98c1b

SHA256
0bb47459f3899f0a6a6ebf8ce94266b4e277ab79897ed104b7c94891a4c55ef7

SHA512
03fcbe7ab4aa549828acb0fc2eb795cec3c0643b411c8cc9bb641a8c599bf8fa6bbfe6b6c6e0822c7464bc131efc5cb65f440fce63fc18db39e00f52fc424c6a

Download Submit
C:\Windows\system\yQonWtE.exe

Filesize
2.6MB

MD5
48b2cd50f572dba686cac201c2a98bd7

SHA1
da94c7167601aeb5c9217dbc50f08c25ba28fd48

SHA256
09bc38d884d79287b398d5f06eb63588fbc021fd087a6df826a8b04e2307a29b

SHA512
9828cee521edcaf093133ac2896946c8d0aa53b11d72da4c5f393c045bc2eaaae27eb0592e1b31f7a5fb41ecf1359074971bae1ba9cdafd7a4f95cddedf0f920

Download Submit
\Windows\system\GzrCfof.exe

Filesize
2.6MB

MD5
33baa178845b3ab6bf0fe3e224795d93

SHA1
cec5b45455472e66f98c48a911a5822288780d54

SHA256
6fed7bb29d07dc15d077a18dcc84fcbd9366f9b84595e3f174f008190a0ad625

SHA512
35835979a70f7c463a714ff3ae74a00bfa66670409757c3976fceba279cab1f77fa1f24aac9cb8a7305399c1e1bcaf1a5091a19b76482a6bfe3ef9efaffb07a8

Download Submit
\Windows\system\MvaZxaZ.exe

Filesize
2.6MB

MD5
3c5d93447d7cbbecb3e61846242a2d2f

SHA1
476277f9684759bdfddc3d3eaed8c60395f637ee

SHA256
7f332ded8df6ec824cbb635521880557b98e2ea37dd5dd349edecd6d3d80cb88

SHA512
0c1fc64035262c33e691a187fbbf1796af779f6bb12efdcf6c42428a2ae3bd9dda63fd6e4cfb9311f166ffd1f20e5db0e4cf371baa2ee351ba07cfbf3c4c9e19

Download Submit
\Windows\system\atqKIXh.exe

Filesize
2.6MB

MD5
8ab75ee4e1bf194c92b581f5ef97c363

SHA1
f5a34d90c9381d02daf787cb192453571a483107

SHA256
503ca48fa6c19d8dcf2606e7895b6166da8aeea47048216909176dbb3276df1e

SHA512
b78975b819bec2d2ffd114d58b437d28a7b26fb545c9fdc46e15608962611a3b8a9b0d22247603037f8d3fe8bbf1d94c44337e55fd7a8c92e89960955e5a42ce

Download Submit
\Windows\system\mWglhbO.exe

Filesize
2.6MB

MD5
ec10d659007f8dfee3da3cdcfcb0091a

SHA1
86c2febb3ad580f9ba98a87dc41e938b143aac66

SHA256
76ae7404c0eee7a3e25660b1f9adbd4b4618e295c129e421cf1bf832d5901daf

SHA512
0e186cb27636d73a51111e9093121477cb764a996bbb72a001f6f06c944171db8f66e6a10f173416203a85ad01897382bd0c368d843514804dddb25a7e071d18

Download Submit
\Windows\system\rdhriyF.exe

Filesize
2.6MB

MD5
6a52fba23dfe92fb460b7170589537a3

SHA1
fb875eea9fce2e5e620fc34697affee9307a1d65

SHA256
fbe799b6f05a5a5b7502a3fc664ef86bf952727db2e4529bee8c9df59c648607

SHA512
542de6cb979a670a46e755abf9f4855a91e23301135b0096eab8f9959642b2c2b01075548b046412065fa24d1f7d8f6b849f8ef84017885d70d3ccc07a2a0c0c

Download Submit
\Windows\system\tFklVXd.exe

Filesize
2.6MB

MD5
caf6dcc06ae628486f1ad544c6d28e48

SHA1
f6e3c165e63708e496bab8cee04ef33e7acd6d7a

SHA256
2c6e053e50876304e91ac3e884c8505e94010f97def0db15b981896de800dd9f

SHA512
783079af25a1e6511268fdbc780e68b15a96b9ad60fddafaf9b397bf11da3312c3d3b6b5c439a34450f0cc9ee1dc48e606c03aca1f5e7ef0715b29072c86730d

Download Submit
\Windows\system\tcqydRP.exe

Filesize
2.6MB

MD5
ab68a05fc2c17778a80fd22d93bbfc86

SHA1
73da37a3c9de757fffc683eb124fa3fd72af8924

SHA256
b921cfe8cf989282c4fc8fc384a574f3c8d21e026f147df7674f0afbc9566d2b

SHA512
2595b2ced55c79432ccd2d2a827db556a890d4f244931ad8753faf9f9843b75e489b6f10581ebd59190d32209ae944b82cba20bf4076bd6a9394c055012e110e

Download Submit
\Windows\system\uIoagKc.exe

Filesize
2.6MB

MD5
fc9f0531ce27c8d3d0e9141a42fdd2a4

SHA1
375b6d70b32698ba2fd3080de698f2d1ad8fdf18

SHA256
da4c84a29c6a6d7f5835bf6643fb3be2ef3d3e7a2890b6350ee201501ac9298a

SHA512
c5ea7df3d5bee580c51fb6a5725a631fc09339a2e63a7896f0a1a6a9db2de397ff2a8e6a32cc48c5ecfdde41d21d6e7ded62d9bbeee33887b4f9247961e06098

Download Submit
memory/1740-79-0x0000000002C10000-0x0000000002C90000-memory.dmp

Filesize
512KB

Download
memory/1740-58-0x0000000002860000-0x0000000002868000-memory.dmp

Filesize
32KB

Download
memory/1740-40-0x0000000002C10000-0x0000000002C90000-memory.dmp

Filesize
512KB

Download
memory/1740-57-0x000000001B630000-0x000000001B912000-memory.dmp

Filesize
2.9MB

Download
memory/2188-0-0x0000000001B20000-0x0000000001B30000-memory.dmp

Filesize
64KB

Download
memory/2188-100-0x0000000003650000-0x0000000003A46000-memory.dmp

Filesize
4.0MB

Download
memory/2188-5898-0x0000000003650000-0x0000000003A46000-memory.dmp

Filesize
4.0MB

Download
memory/2188-1-0x000000013F3C0000-0x000000013F7B6000-memory.dmp

Filesize
4.0MB

Download
memory/2188-94-0x0000000003650000-0x0000000003A46000-memory.dmp

Filesize
4.0MB

Download
memory/2188-38-0x000000013FAF0000-0x000000013FEE6000-memory.dmp

Filesize
4.0MB

Download
memory/2188-101-0x0000000003650000-0x0000000003A46000-memory.dmp

Filesize
4.0MB

Download
memory/2188-102-0x000000013FA60000-0x000000013FE56000-memory.dmp

Filesize
4.0MB

Download
memory/2188-52-0x000000013F3C0000-0x000000013F7B6000-memory.dmp

Filesize
4.0MB

Download
memory/2188-67-0x0000000003650000-0x0000000003A46000-memory.dmp

Filesize
4.0MB

Download
memory/2188-34-0x0000000003050000-0x0000000003446000-memory.dmp

Filesize
4.0MB

Download
memory/2188-22-0x000000013F9C0000-0x000000013FDB6000-memory.dmp

Filesize
4.0MB

Download
memory/2188-17-0x000000013F7C0000-0x000000013FBB6000-memory.dmp

Filesize
4.0MB

Download
memory/2188-6-0x000000013FD80000-0x0000000140176000-memory.dmp

Filesize
4.0MB

Download
memory/2464-97-0x000000013F140000-0x000000013F536000-memory.dmp

Filesize
4.0MB

Download
memory/2468-583-0x000000013FCB0000-0x00000001400A6000-memory.dmp

Filesize
4.0MB

Download
memory/2468-54-0x000000013FCB0000-0x00000001400A6000-memory.dmp

Filesize
4.0MB

Download
memory/2532-62-0x000000013F7C0000-0x000000013FBB6000-memory.dmp

Filesize
4.0MB

Download
memory/2532-20-0x000000013F7C0000-0x000000013FBB6000-memory.dmp

Filesize
4.0MB

Download
memory/2544-298-0x000000013F0A0000-0x000000013F496000-memory.dmp

Filesize
4.0MB

Download
memory/2544-44-0x000000013F0A0000-0x000000013F496000-memory.dmp

Filesize
4.0MB

Download
memory/2560-43-0x000000013F2C0000-0x000000013F6B6000-memory.dmp

Filesize
4.0MB

Download
memory/2596-64-0x000000013FF00000-0x00000001402F6000-memory.dmp

Filesize
4.0MB

Download
memory/2628-29-0x000000013F9C0000-0x000000013FDB6000-memory.dmp

Filesize
4.0MB

Download
memory/2628-4662-0x000000013F9C0000-0x000000013FDB6000-memory.dmp

Filesize
4.0MB

Download
memory/2752-47-0x000000013FAF0000-0x000000013FEE6000-memory.dmp

Filesize
4.0MB

Download
memory/2900-78-0x000000013F3D0000-0x000000013F7C6000-memory.dmp

Filesize
4.0MB

Download
memory/3044-9-0x000000013FD80000-0x0000000140176000-memory.dmp

Filesize
4.0MB

Download
memory/3044-59-0x000000013FD80000-0x0000000140176000-memory.dmp

Filesize
4.0MB

Download