xmrig | 16f36860e3a2dffe184e8f11940f186ae1018a149e0e16356af9250ab1e392b4

Analysis

max time kernel
148s
max time network
143s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
15/05/2024, 11:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ce6d0d5497d91d5b32c04be8406f95d0_NeikiAnalytics.exe
Size

1.6MB
MD5

ce6d0d5497d91d5b32c04be8406f95d0
SHA1

869734823cd83e2f84a2e0b3846416697de89f38
SHA256

16f36860e3a2dffe184e8f11940f186ae1018a149e0e16356af9250ab1e392b4
SHA512

f710d77093d7ac6462394113f298806fa2482409cd4d5c288eb2af39e8d0e03fc43fa440999b8f1b700427b5177cd6902fbc6bc887a31ca252006889a67fd604
SSDEEP

24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvj7NaVNqd9OeSZXCdzvd4/iooIXmPDhPkf:Lz071uv4BPMkHC0IaSEzQR4iRFc

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 19 IoCs

miner

resource	yara_rule
behavioral1/memory/2752-192-0x000000013F620000-0x000000013FA12000-memory.dmp	xmrig
behavioral1/memory/2504-195-0x000000013FE50000-0x0000000140242000-memory.dmp	xmrig
behavioral1/memory/2944-197-0x000000013F7A0000-0x000000013FB92000-memory.dmp	xmrig
behavioral1/memory/2112-200-0x000000013F460000-0x000000013F852000-memory.dmp	xmrig
behavioral1/memory/2600-182-0x000000013F130000-0x000000013F522000-memory.dmp	xmrig
behavioral1/memory/2776-186-0x000000013F6D0000-0x000000013FAC2000-memory.dmp	xmrig
behavioral1/memory/2624-184-0x000000013F470000-0x000000013F862000-memory.dmp	xmrig
behavioral1/memory/2692-183-0x000000013F370000-0x000000013F762000-memory.dmp	xmrig
behavioral1/memory/1080-190-0x000000013FB20000-0x000000013FF12000-memory.dmp	xmrig
behavioral1/memory/2468-4459-0x000000013F680000-0x000000013FA72000-memory.dmp	xmrig
behavioral1/memory/2464-5330-0x000000013FBA0000-0x000000013FF92000-memory.dmp	xmrig
behavioral1/memory/2600-6309-0x000000013F130000-0x000000013F522000-memory.dmp	xmrig
behavioral1/memory/2692-6312-0x000000013F370000-0x000000013F762000-memory.dmp	xmrig
behavioral1/memory/2776-6316-0x000000013F6D0000-0x000000013FAC2000-memory.dmp	xmrig
behavioral1/memory/2916-6474-0x000000013FB50000-0x000000013FF42000-memory.dmp	xmrig
behavioral1/memory/2112-6339-0x000000013F460000-0x000000013F852000-memory.dmp	xmrig
behavioral1/memory/1080-6335-0x000000013FB20000-0x000000013FF12000-memory.dmp	xmrig
behavioral1/memory/2504-6333-0x000000013FE50000-0x0000000140242000-memory.dmp	xmrig
behavioral1/memory/2752-6327-0x000000013F620000-0x000000013FA12000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
1840	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
2464	HdGynpU.exe
2600	TuMSXzU.exe
2692	vMvaEPc.exe
2624	QjpNUdP.exe
2776	Wnqwopc.exe
2916	UrhLxqu.exe
1080	uzlzuBD.exe
2752	EpwwGyD.exe
2504	sVHqPSo.exe
2944	PgrAFiq.exe
2112	FgKrwgn.exe
2564	QmlOjAn.exe
2544	CPSxcfM.exe
3056	PzJkCGl.exe
1632	NmNUhUX.exe
1476	biTlAYi.exe
2788	FdbOwFv.exe
1940	pbbLDTa.exe
868	nLFXkzW.exe
1480	QkPVZUp.exe
2880	NNbuAck.exe
1952	MNQbXwA.exe
2864	EiMhqzr.exe
1444	WnYvbxx.exe
1136	PdcabTG.exe
1132	uUUnZBn.exe
392	lItJLaT.exe
764	juYLESb.exe
1880	eUtlFDQ.exe
1624	xOUvwfg.exe
832	dnAwRjF.exe
488	NcVZRfP.exe
1176	zOtyors.exe
1992	IOkIoAe.exe
1780	iJYhhmu.exe
1228	CNTqWhP.exe
2452	lIFJUho.exe
376	bTPLuVG.exe
1684	SOrGxAi.exe
3016	VKROHiy.exe
1508	avXVUYc.exe
2148	JrRcKjS.exe
1760	OnoeOGz.exe
3028	avNugdF.exe
880	wsvoUqI.exe
2432	rXAYmQy.exe
3008	yBBSbOl.exe
1128	ILKMNhU.exe
2820	zGovxPa.exe
2276	zcMjVMU.exe
1728	Fdkqffp.exe
2704	bQXcxPc.exe
2652	nnExqcX.exe
2664	hMlSbRg.exe
3060	XsljtMl.exe
2908	VBWIABx.exe
2720	dOxyVXM.exe
2556	REUfyET.exe
2532	XYWRyzP.exe
2572	iSSDGJU.exe
2892	pUOVUBz.exe
2800	bRJGoqM.exe
3048	SDWrHUF.exe
2668	SZmOpCq.exe

Loads dropped DLL 64 IoCs

pid	Process
2468	ce6d0d5497d91d5b32c04be8406f95d0_NeikiAnalytics.exe
2468	ce6d0d5497d91d5b32c04be8406f95d0_NeikiAnalytics.exe
2468	ce6d0d5497d91d5b32c04be8406f95d0_NeikiAnalytics.exe
2468	ce6d0d5497d91d5b32c04be8406f95d0_NeikiAnalytics.exe
2468	ce6d0d5497d91d5b32c04be8406f95d0_NeikiAnalytics.exe
2468	ce6d0d5497d91d5b32c04be8406f95d0_NeikiAnalytics.exe
2468	ce6d0d5497d91d5b32c04be8406f95d0_NeikiAnalytics.exe
2468	ce6d0d5497d91d5b32c04be8406f95d0_NeikiAnalytics.exe
2468	ce6d0d5497d91d5b32c04be8406f95d0_NeikiAnalytics.exe
2468	ce6d0d5497d91d5b32c04be8406f95d0_NeikiAnalytics.exe
2468	ce6d0d5497d91d5b32c04be8406f95d0_NeikiAnalytics.exe
2468	ce6d0d5497d91d5b32c04be8406f95d0_NeikiAnalytics.exe
2468	ce6d0d5497d91d5b32c04be8406f95d0_NeikiAnalytics.exe
2468	ce6d0d5497d91d5b32c04be8406f95d0_NeikiAnalytics.exe
2468	ce6d0d5497d91d5b32c04be8406f95d0_NeikiAnalytics.exe
2468	ce6d0d5497d91d5b32c04be8406f95d0_NeikiAnalytics.exe
2468	ce6d0d5497d91d5b32c04be8406f95d0_NeikiAnalytics.exe
2468	ce6d0d5497d91d5b32c04be8406f95d0_NeikiAnalytics.exe
2468	ce6d0d5497d91d5b32c04be8406f95d0_NeikiAnalytics.exe
2468	ce6d0d5497d91d5b32c04be8406f95d0_NeikiAnalytics.exe
2468	ce6d0d5497d91d5b32c04be8406f95d0_NeikiAnalytics.exe
2468	ce6d0d5497d91d5b32c04be8406f95d0_NeikiAnalytics.exe
2468	ce6d0d5497d91d5b32c04be8406f95d0_NeikiAnalytics.exe
2468	ce6d0d5497d91d5b32c04be8406f95d0_NeikiAnalytics.exe
2468	ce6d0d5497d91d5b32c04be8406f95d0_NeikiAnalytics.exe
2468	ce6d0d5497d91d5b32c04be8406f95d0_NeikiAnalytics.exe
2468	ce6d0d5497d91d5b32c04be8406f95d0_NeikiAnalytics.exe
2468	ce6d0d5497d91d5b32c04be8406f95d0_NeikiAnalytics.exe
2468	ce6d0d5497d91d5b32c04be8406f95d0_NeikiAnalytics.exe
2468	ce6d0d5497d91d5b32c04be8406f95d0_NeikiAnalytics.exe
2468	ce6d0d5497d91d5b32c04be8406f95d0_NeikiAnalytics.exe
2468	ce6d0d5497d91d5b32c04be8406f95d0_NeikiAnalytics.exe
2468	ce6d0d5497d91d5b32c04be8406f95d0_NeikiAnalytics.exe
2468	ce6d0d5497d91d5b32c04be8406f95d0_NeikiAnalytics.exe
2468	ce6d0d5497d91d5b32c04be8406f95d0_NeikiAnalytics.exe
2468	ce6d0d5497d91d5b32c04be8406f95d0_NeikiAnalytics.exe
2468	ce6d0d5497d91d5b32c04be8406f95d0_NeikiAnalytics.exe
2468	ce6d0d5497d91d5b32c04be8406f95d0_NeikiAnalytics.exe
2468	ce6d0d5497d91d5b32c04be8406f95d0_NeikiAnalytics.exe
2468	ce6d0d5497d91d5b32c04be8406f95d0_NeikiAnalytics.exe
2468	ce6d0d5497d91d5b32c04be8406f95d0_NeikiAnalytics.exe
2468	ce6d0d5497d91d5b32c04be8406f95d0_NeikiAnalytics.exe
2468	ce6d0d5497d91d5b32c04be8406f95d0_NeikiAnalytics.exe
2468	ce6d0d5497d91d5b32c04be8406f95d0_NeikiAnalytics.exe
2468	ce6d0d5497d91d5b32c04be8406f95d0_NeikiAnalytics.exe
2468	ce6d0d5497d91d5b32c04be8406f95d0_NeikiAnalytics.exe
2468	ce6d0d5497d91d5b32c04be8406f95d0_NeikiAnalytics.exe
2468	ce6d0d5497d91d5b32c04be8406f95d0_NeikiAnalytics.exe
2468	ce6d0d5497d91d5b32c04be8406f95d0_NeikiAnalytics.exe
2468	ce6d0d5497d91d5b32c04be8406f95d0_NeikiAnalytics.exe
2468	ce6d0d5497d91d5b32c04be8406f95d0_NeikiAnalytics.exe
2468	ce6d0d5497d91d5b32c04be8406f95d0_NeikiAnalytics.exe
2468	ce6d0d5497d91d5b32c04be8406f95d0_NeikiAnalytics.exe
2468	ce6d0d5497d91d5b32c04be8406f95d0_NeikiAnalytics.exe
2468	ce6d0d5497d91d5b32c04be8406f95d0_NeikiAnalytics.exe
2468	ce6d0d5497d91d5b32c04be8406f95d0_NeikiAnalytics.exe
2468	ce6d0d5497d91d5b32c04be8406f95d0_NeikiAnalytics.exe
2468	ce6d0d5497d91d5b32c04be8406f95d0_NeikiAnalytics.exe
2468	ce6d0d5497d91d5b32c04be8406f95d0_NeikiAnalytics.exe
2468	ce6d0d5497d91d5b32c04be8406f95d0_NeikiAnalytics.exe
2468	ce6d0d5497d91d5b32c04be8406f95d0_NeikiAnalytics.exe
2468	ce6d0d5497d91d5b32c04be8406f95d0_NeikiAnalytics.exe
2468	ce6d0d5497d91d5b32c04be8406f95d0_NeikiAnalytics.exe
2468	ce6d0d5497d91d5b32c04be8406f95d0_NeikiAnalytics.exe

UPX packed file 56 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2468-0-0x000000013F680000-0x000000013FA72000-memory.dmp	upx
behavioral1/files/0x000c0000000122e4-3.dat	upx
behavioral1/memory/2464-15-0x000000013FBA0000-0x000000013FF92000-memory.dmp	upx
behavioral1/files/0x000800000001269d-33.dat	upx
behavioral1/files/0x0009000000012678-29.dat	upx
behavioral1/files/0x00080000000126ab-37.dat	upx
behavioral1/files/0x00070000000133a8-65.dat	upx
behavioral1/files/0x00070000000133b9-74.dat	upx
behavioral1/files/0x0007000000013928-92.dat	upx
behavioral1/files/0x000800000001329e-84.dat	upx
behavioral1/files/0x0007000000013a11-111.dat	upx
behavioral1/files/0x00070000000139b4-98.dat	upx
behavioral1/files/0x00060000000141a2-130.dat	upx
behavioral1/files/0x00060000000141e6-141.dat	upx
behavioral1/files/0x0006000000014390-154.dat	upx
behavioral1/files/0x0006000000014120-128.dat	upx
behavioral1/files/0x0007000000013a21-126.dat	upx
behavioral1/files/0x000600000001447e-164.dat	upx
behavioral1/memory/2916-188-0x000000013FB50000-0x000000013FF42000-memory.dmp	upx
behavioral1/memory/2752-192-0x000000013F620000-0x000000013FA12000-memory.dmp	upx
behavioral1/memory/2504-195-0x000000013FE50000-0x0000000140242000-memory.dmp	upx
behavioral1/memory/2944-197-0x000000013F7A0000-0x000000013FB92000-memory.dmp	upx
behavioral1/memory/2112-200-0x000000013F460000-0x000000013F852000-memory.dmp	upx
behavioral1/memory/2600-182-0x000000013F130000-0x000000013F522000-memory.dmp	upx
behavioral1/memory/2776-186-0x000000013F6D0000-0x000000013FAC2000-memory.dmp	upx
behavioral1/memory/2624-184-0x000000013F470000-0x000000013F862000-memory.dmp	upx
behavioral1/memory/2692-183-0x000000013F370000-0x000000013F762000-memory.dmp	upx
behavioral1/files/0x000600000001448a-167.dat	upx
behavioral1/files/0x00060000000143ec-157.dat	upx
behavioral1/files/0x00060000000142c4-153.dat	upx
behavioral1/files/0x0006000000014316-150.dat	upx
behavioral1/files/0x00060000000142b0-143.dat	upx
behavioral1/files/0x00060000000141c0-138.dat	upx
behavioral1/memory/1080-190-0x000000013FB20000-0x000000013FF12000-memory.dmp	upx
behavioral1/files/0x00070000000139e0-108.dat	upx
behavioral1/files/0x0007000000013a71-120.dat	upx
behavioral1/files/0x00070000000139d8-101.dat	upx
behavioral1/files/0x000700000001342b-88.dat	upx
behavioral1/files/0x00070000000133b0-86.dat	upx
behavioral1/files/0x0008000000013113-81.dat	upx
behavioral1/files/0x0009000000012d51-54.dat	upx
behavioral1/files/0x000b000000012713-47.dat	upx
behavioral1/files/0x0008000000013172-58.dat	upx
behavioral1/files/0x000b0000000126e1-42.dat	upx
behavioral1/files/0x000b000000012303-13.dat	upx
behavioral1/files/0x000f000000005578-21.dat	upx
behavioral1/memory/2468-4459-0x000000013F680000-0x000000013FA72000-memory.dmp	upx
behavioral1/memory/2464-5330-0x000000013FBA0000-0x000000013FF92000-memory.dmp	upx
behavioral1/memory/2600-6309-0x000000013F130000-0x000000013F522000-memory.dmp	upx
behavioral1/memory/2692-6312-0x000000013F370000-0x000000013F762000-memory.dmp	upx
behavioral1/memory/2776-6316-0x000000013F6D0000-0x000000013FAC2000-memory.dmp	upx
behavioral1/memory/2916-6474-0x000000013FB50000-0x000000013FF42000-memory.dmp	upx
behavioral1/memory/2112-6339-0x000000013F460000-0x000000013F852000-memory.dmp	upx
behavioral1/memory/1080-6335-0x000000013FB20000-0x000000013FF12000-memory.dmp	upx
behavioral1/memory/2504-6333-0x000000013FE50000-0x0000000140242000-memory.dmp	upx
behavioral1/memory/2752-6327-0x000000013F620000-0x000000013FA12000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\vJNmbQe.exe	ce6d0d5497d91d5b32c04be8406f95d0_NeikiAnalytics.exe
File created	C:\Windows\System\KQQkgHy.exe	ce6d0d5497d91d5b32c04be8406f95d0_NeikiAnalytics.exe
File created	C:\Windows\System\GPmBrRy.exe	ce6d0d5497d91d5b32c04be8406f95d0_NeikiAnalytics.exe
File created	C:\Windows\System\fucxnEx.exe	ce6d0d5497d91d5b32c04be8406f95d0_NeikiAnalytics.exe
File created	C:\Windows\System\lTKNkLg.exe	ce6d0d5497d91d5b32c04be8406f95d0_NeikiAnalytics.exe
File created	C:\Windows\System\oFviiHt.exe	ce6d0d5497d91d5b32c04be8406f95d0_NeikiAnalytics.exe
File created	C:\Windows\System\KfiMaun.exe	ce6d0d5497d91d5b32c04be8406f95d0_NeikiAnalytics.exe
File created	C:\Windows\System\PWWfcoi.exe	ce6d0d5497d91d5b32c04be8406f95d0_NeikiAnalytics.exe
File created	C:\Windows\System\XXecWdq.exe	ce6d0d5497d91d5b32c04be8406f95d0_NeikiAnalytics.exe
File created	C:\Windows\System\dWGyRdF.exe	ce6d0d5497d91d5b32c04be8406f95d0_NeikiAnalytics.exe
File created	C:\Windows\System\BHeiZXK.exe	ce6d0d5497d91d5b32c04be8406f95d0_NeikiAnalytics.exe
File created	C:\Windows\System\AwPxWZN.exe	ce6d0d5497d91d5b32c04be8406f95d0_NeikiAnalytics.exe
File created	C:\Windows\System\YLysXaH.exe	ce6d0d5497d91d5b32c04be8406f95d0_NeikiAnalytics.exe
File created	C:\Windows\System\wvcfJUY.exe	ce6d0d5497d91d5b32c04be8406f95d0_NeikiAnalytics.exe
File created	C:\Windows\System\NWxaIQB.exe	ce6d0d5497d91d5b32c04be8406f95d0_NeikiAnalytics.exe
File created	C:\Windows\System\yKbSvQB.exe	ce6d0d5497d91d5b32c04be8406f95d0_NeikiAnalytics.exe
File created	C:\Windows\System\NVpLFcn.exe	ce6d0d5497d91d5b32c04be8406f95d0_NeikiAnalytics.exe
File created	C:\Windows\System\QEgaMbD.exe	ce6d0d5497d91d5b32c04be8406f95d0_NeikiAnalytics.exe
File created	C:\Windows\System\niptdZV.exe	ce6d0d5497d91d5b32c04be8406f95d0_NeikiAnalytics.exe
File created	C:\Windows\System\UFcsCqM.exe	ce6d0d5497d91d5b32c04be8406f95d0_NeikiAnalytics.exe
File created	C:\Windows\System\YJfIIFe.exe	ce6d0d5497d91d5b32c04be8406f95d0_NeikiAnalytics.exe
File created	C:\Windows\System\yPbUKng.exe	ce6d0d5497d91d5b32c04be8406f95d0_NeikiAnalytics.exe
File created	C:\Windows\System\WcVMCoN.exe	ce6d0d5497d91d5b32c04be8406f95d0_NeikiAnalytics.exe
File created	C:\Windows\System\EtBvEUZ.exe	ce6d0d5497d91d5b32c04be8406f95d0_NeikiAnalytics.exe
File created	C:\Windows\System\LVtwece.exe	ce6d0d5497d91d5b32c04be8406f95d0_NeikiAnalytics.exe
File created	C:\Windows\System\xTfpnuh.exe	ce6d0d5497d91d5b32c04be8406f95d0_NeikiAnalytics.exe
File created	C:\Windows\System\EfHwMFK.exe	ce6d0d5497d91d5b32c04be8406f95d0_NeikiAnalytics.exe
File created	C:\Windows\System\jtfFeOV.exe	ce6d0d5497d91d5b32c04be8406f95d0_NeikiAnalytics.exe
File created	C:\Windows\System\gMombgT.exe	ce6d0d5497d91d5b32c04be8406f95d0_NeikiAnalytics.exe
File created	C:\Windows\System\CkmBxPa.exe	ce6d0d5497d91d5b32c04be8406f95d0_NeikiAnalytics.exe
File created	C:\Windows\System\niXVxYC.exe	ce6d0d5497d91d5b32c04be8406f95d0_NeikiAnalytics.exe
File created	C:\Windows\System\iJyyQxW.exe	ce6d0d5497d91d5b32c04be8406f95d0_NeikiAnalytics.exe
File created	C:\Windows\System\baFxjqC.exe	ce6d0d5497d91d5b32c04be8406f95d0_NeikiAnalytics.exe
File created	C:\Windows\System\nHnGCQJ.exe	ce6d0d5497d91d5b32c04be8406f95d0_NeikiAnalytics.exe
File created	C:\Windows\System\WrKKUIN.exe	ce6d0d5497d91d5b32c04be8406f95d0_NeikiAnalytics.exe
File created	C:\Windows\System\qOzJDfM.exe	ce6d0d5497d91d5b32c04be8406f95d0_NeikiAnalytics.exe
File created	C:\Windows\System\leQDbOT.exe	ce6d0d5497d91d5b32c04be8406f95d0_NeikiAnalytics.exe
File created	C:\Windows\System\HvJvUzf.exe	ce6d0d5497d91d5b32c04be8406f95d0_NeikiAnalytics.exe
File created	C:\Windows\System\XBYOmMO.exe	ce6d0d5497d91d5b32c04be8406f95d0_NeikiAnalytics.exe
File created	C:\Windows\System\YgNSvUC.exe	ce6d0d5497d91d5b32c04be8406f95d0_NeikiAnalytics.exe
File created	C:\Windows\System\OFIHBFN.exe	ce6d0d5497d91d5b32c04be8406f95d0_NeikiAnalytics.exe
File created	C:\Windows\System\ttULBcg.exe	ce6d0d5497d91d5b32c04be8406f95d0_NeikiAnalytics.exe
File created	C:\Windows\System\Rqnccoq.exe	ce6d0d5497d91d5b32c04be8406f95d0_NeikiAnalytics.exe
File created	C:\Windows\System\afiwkYM.exe	ce6d0d5497d91d5b32c04be8406f95d0_NeikiAnalytics.exe
File created	C:\Windows\System\ABUgAnp.exe	ce6d0d5497d91d5b32c04be8406f95d0_NeikiAnalytics.exe
File created	C:\Windows\System\bDONYUv.exe	ce6d0d5497d91d5b32c04be8406f95d0_NeikiAnalytics.exe
File created	C:\Windows\System\JSKQalq.exe	ce6d0d5497d91d5b32c04be8406f95d0_NeikiAnalytics.exe
File created	C:\Windows\System\OTuqzdO.exe	ce6d0d5497d91d5b32c04be8406f95d0_NeikiAnalytics.exe
File created	C:\Windows\System\UPhrQrL.exe	ce6d0d5497d91d5b32c04be8406f95d0_NeikiAnalytics.exe
File created	C:\Windows\System\oLTyWug.exe	ce6d0d5497d91d5b32c04be8406f95d0_NeikiAnalytics.exe
File created	C:\Windows\System\LSEQSqO.exe	ce6d0d5497d91d5b32c04be8406f95d0_NeikiAnalytics.exe
File created	C:\Windows\System\wAPKKuT.exe	ce6d0d5497d91d5b32c04be8406f95d0_NeikiAnalytics.exe
File created	C:\Windows\System\QJBtYFp.exe	ce6d0d5497d91d5b32c04be8406f95d0_NeikiAnalytics.exe
File created	C:\Windows\System\GwaKdMc.exe	ce6d0d5497d91d5b32c04be8406f95d0_NeikiAnalytics.exe
File created	C:\Windows\System\twLGXAf.exe	ce6d0d5497d91d5b32c04be8406f95d0_NeikiAnalytics.exe
File created	C:\Windows\System\kQMRhAZ.exe	ce6d0d5497d91d5b32c04be8406f95d0_NeikiAnalytics.exe
File created	C:\Windows\System\AWlUyDA.exe	ce6d0d5497d91d5b32c04be8406f95d0_NeikiAnalytics.exe
File created	C:\Windows\System\CxFdyvU.exe	ce6d0d5497d91d5b32c04be8406f95d0_NeikiAnalytics.exe
File created	C:\Windows\System\LKQVOvn.exe	ce6d0d5497d91d5b32c04be8406f95d0_NeikiAnalytics.exe
File created	C:\Windows\System\KpERXOl.exe	ce6d0d5497d91d5b32c04be8406f95d0_NeikiAnalytics.exe
File created	C:\Windows\System\glRbFRW.exe	ce6d0d5497d91d5b32c04be8406f95d0_NeikiAnalytics.exe
File created	C:\Windows\System\zxKZprc.exe	ce6d0d5497d91d5b32c04be8406f95d0_NeikiAnalytics.exe
File created	C:\Windows\System\UaUUZFC.exe	ce6d0d5497d91d5b32c04be8406f95d0_NeikiAnalytics.exe
File created	C:\Windows\System\ToYEmPU.exe	ce6d0d5497d91d5b32c04be8406f95d0_NeikiAnalytics.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1840	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2468	ce6d0d5497d91d5b32c04be8406f95d0_NeikiAnalytics.exe
Token: SeLockMemoryPrivilege	2468	ce6d0d5497d91d5b32c04be8406f95d0_NeikiAnalytics.exe
Token: SeDebugPrivilege	1840	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2468 wrote to memory of 1840	2468	ce6d0d5497d91d5b32c04be8406f95d0_NeikiAnalytics.exe	29
PID 2468 wrote to memory of 1840	2468	ce6d0d5497d91d5b32c04be8406f95d0_NeikiAnalytics.exe	29
PID 2468 wrote to memory of 1840	2468	ce6d0d5497d91d5b32c04be8406f95d0_NeikiAnalytics.exe	29
PID 2468 wrote to memory of 2464	2468	ce6d0d5497d91d5b32c04be8406f95d0_NeikiAnalytics.exe	30
PID 2468 wrote to memory of 2464	2468	ce6d0d5497d91d5b32c04be8406f95d0_NeikiAnalytics.exe	30
PID 2468 wrote to memory of 2464	2468	ce6d0d5497d91d5b32c04be8406f95d0_NeikiAnalytics.exe	30
PID 2468 wrote to memory of 2600	2468	ce6d0d5497d91d5b32c04be8406f95d0_NeikiAnalytics.exe	31
PID 2468 wrote to memory of 2600	2468	ce6d0d5497d91d5b32c04be8406f95d0_NeikiAnalytics.exe	31
PID 2468 wrote to memory of 2600	2468	ce6d0d5497d91d5b32c04be8406f95d0_NeikiAnalytics.exe	31
PID 2468 wrote to memory of 2692	2468	ce6d0d5497d91d5b32c04be8406f95d0_NeikiAnalytics.exe	32
PID 2468 wrote to memory of 2692	2468	ce6d0d5497d91d5b32c04be8406f95d0_NeikiAnalytics.exe	32
PID 2468 wrote to memory of 2692	2468	ce6d0d5497d91d5b32c04be8406f95d0_NeikiAnalytics.exe	32
PID 2468 wrote to memory of 2624	2468	ce6d0d5497d91d5b32c04be8406f95d0_NeikiAnalytics.exe	33
PID 2468 wrote to memory of 2624	2468	ce6d0d5497d91d5b32c04be8406f95d0_NeikiAnalytics.exe	33
PID 2468 wrote to memory of 2624	2468	ce6d0d5497d91d5b32c04be8406f95d0_NeikiAnalytics.exe	33
PID 2468 wrote to memory of 2776	2468	ce6d0d5497d91d5b32c04be8406f95d0_NeikiAnalytics.exe	34
PID 2468 wrote to memory of 2776	2468	ce6d0d5497d91d5b32c04be8406f95d0_NeikiAnalytics.exe	34
PID 2468 wrote to memory of 2776	2468	ce6d0d5497d91d5b32c04be8406f95d0_NeikiAnalytics.exe	34
PID 2468 wrote to memory of 2916	2468	ce6d0d5497d91d5b32c04be8406f95d0_NeikiAnalytics.exe	35
PID 2468 wrote to memory of 2916	2468	ce6d0d5497d91d5b32c04be8406f95d0_NeikiAnalytics.exe	35
PID 2468 wrote to memory of 2916	2468	ce6d0d5497d91d5b32c04be8406f95d0_NeikiAnalytics.exe	35
PID 2468 wrote to memory of 1080	2468	ce6d0d5497d91d5b32c04be8406f95d0_NeikiAnalytics.exe	36
PID 2468 wrote to memory of 1080	2468	ce6d0d5497d91d5b32c04be8406f95d0_NeikiAnalytics.exe	36
PID 2468 wrote to memory of 1080	2468	ce6d0d5497d91d5b32c04be8406f95d0_NeikiAnalytics.exe	36
PID 2468 wrote to memory of 2752	2468	ce6d0d5497d91d5b32c04be8406f95d0_NeikiAnalytics.exe	37
PID 2468 wrote to memory of 2752	2468	ce6d0d5497d91d5b32c04be8406f95d0_NeikiAnalytics.exe	37
PID 2468 wrote to memory of 2752	2468	ce6d0d5497d91d5b32c04be8406f95d0_NeikiAnalytics.exe	37
PID 2468 wrote to memory of 2504	2468	ce6d0d5497d91d5b32c04be8406f95d0_NeikiAnalytics.exe	38
PID 2468 wrote to memory of 2504	2468	ce6d0d5497d91d5b32c04be8406f95d0_NeikiAnalytics.exe	38
PID 2468 wrote to memory of 2504	2468	ce6d0d5497d91d5b32c04be8406f95d0_NeikiAnalytics.exe	38
PID 2468 wrote to memory of 2544	2468	ce6d0d5497d91d5b32c04be8406f95d0_NeikiAnalytics.exe	39
PID 2468 wrote to memory of 2544	2468	ce6d0d5497d91d5b32c04be8406f95d0_NeikiAnalytics.exe	39
PID 2468 wrote to memory of 2544	2468	ce6d0d5497d91d5b32c04be8406f95d0_NeikiAnalytics.exe	39
PID 2468 wrote to memory of 2944	2468	ce6d0d5497d91d5b32c04be8406f95d0_NeikiAnalytics.exe	40
PID 2468 wrote to memory of 2944	2468	ce6d0d5497d91d5b32c04be8406f95d0_NeikiAnalytics.exe	40
PID 2468 wrote to memory of 2944	2468	ce6d0d5497d91d5b32c04be8406f95d0_NeikiAnalytics.exe	40
PID 2468 wrote to memory of 3056	2468	ce6d0d5497d91d5b32c04be8406f95d0_NeikiAnalytics.exe	41
PID 2468 wrote to memory of 3056	2468	ce6d0d5497d91d5b32c04be8406f95d0_NeikiAnalytics.exe	41
PID 2468 wrote to memory of 3056	2468	ce6d0d5497d91d5b32c04be8406f95d0_NeikiAnalytics.exe	41
PID 2468 wrote to memory of 2112	2468	ce6d0d5497d91d5b32c04be8406f95d0_NeikiAnalytics.exe	42
PID 2468 wrote to memory of 2112	2468	ce6d0d5497d91d5b32c04be8406f95d0_NeikiAnalytics.exe	42
PID 2468 wrote to memory of 2112	2468	ce6d0d5497d91d5b32c04be8406f95d0_NeikiAnalytics.exe	42
PID 2468 wrote to memory of 1632	2468	ce6d0d5497d91d5b32c04be8406f95d0_NeikiAnalytics.exe	43
PID 2468 wrote to memory of 1632	2468	ce6d0d5497d91d5b32c04be8406f95d0_NeikiAnalytics.exe	43
PID 2468 wrote to memory of 1632	2468	ce6d0d5497d91d5b32c04be8406f95d0_NeikiAnalytics.exe	43
PID 2468 wrote to memory of 2564	2468	ce6d0d5497d91d5b32c04be8406f95d0_NeikiAnalytics.exe	44
PID 2468 wrote to memory of 2564	2468	ce6d0d5497d91d5b32c04be8406f95d0_NeikiAnalytics.exe	44
PID 2468 wrote to memory of 2564	2468	ce6d0d5497d91d5b32c04be8406f95d0_NeikiAnalytics.exe	44
PID 2468 wrote to memory of 1476	2468	ce6d0d5497d91d5b32c04be8406f95d0_NeikiAnalytics.exe	45
PID 2468 wrote to memory of 1476	2468	ce6d0d5497d91d5b32c04be8406f95d0_NeikiAnalytics.exe	45
PID 2468 wrote to memory of 1476	2468	ce6d0d5497d91d5b32c04be8406f95d0_NeikiAnalytics.exe	45
PID 2468 wrote to memory of 2788	2468	ce6d0d5497d91d5b32c04be8406f95d0_NeikiAnalytics.exe	46
PID 2468 wrote to memory of 2788	2468	ce6d0d5497d91d5b32c04be8406f95d0_NeikiAnalytics.exe	46
PID 2468 wrote to memory of 2788	2468	ce6d0d5497d91d5b32c04be8406f95d0_NeikiAnalytics.exe	46
PID 2468 wrote to memory of 1940	2468	ce6d0d5497d91d5b32c04be8406f95d0_NeikiAnalytics.exe	47
PID 2468 wrote to memory of 1940	2468	ce6d0d5497d91d5b32c04be8406f95d0_NeikiAnalytics.exe	47
PID 2468 wrote to memory of 1940	2468	ce6d0d5497d91d5b32c04be8406f95d0_NeikiAnalytics.exe	47
PID 2468 wrote to memory of 868	2468	ce6d0d5497d91d5b32c04be8406f95d0_NeikiAnalytics.exe	48
PID 2468 wrote to memory of 868	2468	ce6d0d5497d91d5b32c04be8406f95d0_NeikiAnalytics.exe	48
PID 2468 wrote to memory of 868	2468	ce6d0d5497d91d5b32c04be8406f95d0_NeikiAnalytics.exe	48
PID 2468 wrote to memory of 1480	2468	ce6d0d5497d91d5b32c04be8406f95d0_NeikiAnalytics.exe	49
PID 2468 wrote to memory of 1480	2468	ce6d0d5497d91d5b32c04be8406f95d0_NeikiAnalytics.exe	49
PID 2468 wrote to memory of 1480	2468	ce6d0d5497d91d5b32c04be8406f95d0_NeikiAnalytics.exe	49
PID 2468 wrote to memory of 2880	2468	ce6d0d5497d91d5b32c04be8406f95d0_NeikiAnalytics.exe	50

C:\Users\Admin\AppData\Local\Temp\ce6d0d5497d91d5b32c04be8406f95d0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\ce6d0d5497d91d5b32c04be8406f95d0_NeikiAnalytics.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2468
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1840
- C:\Windows\System\HdGynpU.exe
  C:\Windows\System\HdGynpU.exe
  2⤵
  - Executes dropped EXE
  PID:2464
- C:\Windows\System\TuMSXzU.exe
  C:\Windows\System\TuMSXzU.exe
  2⤵
  - Executes dropped EXE
  PID:2600
- C:\Windows\System\vMvaEPc.exe
  C:\Windows\System\vMvaEPc.exe
  2⤵
  - Executes dropped EXE
  PID:2692
- C:\Windows\System\QjpNUdP.exe
  C:\Windows\System\QjpNUdP.exe
  2⤵
  - Executes dropped EXE
  PID:2624
- C:\Windows\System\Wnqwopc.exe
  C:\Windows\System\Wnqwopc.exe
  2⤵
  - Executes dropped EXE
  PID:2776
- C:\Windows\System\UrhLxqu.exe
  C:\Windows\System\UrhLxqu.exe
  2⤵
  - Executes dropped EXE
  PID:2916
- C:\Windows\System\uzlzuBD.exe
  C:\Windows\System\uzlzuBD.exe
  2⤵
  - Executes dropped EXE
  PID:1080
- C:\Windows\System\EpwwGyD.exe
  C:\Windows\System\EpwwGyD.exe
  2⤵
  - Executes dropped EXE
  PID:2752
- C:\Windows\System\sVHqPSo.exe
  C:\Windows\System\sVHqPSo.exe
  2⤵
  - Executes dropped EXE
  PID:2504
- C:\Windows\System\CPSxcfM.exe
  C:\Windows\System\CPSxcfM.exe
  2⤵
  - Executes dropped EXE
  PID:2544
- C:\Windows\System\PgrAFiq.exe
  C:\Windows\System\PgrAFiq.exe
  2⤵
  - Executes dropped EXE
  PID:2944
- C:\Windows\System\PzJkCGl.exe
  C:\Windows\System\PzJkCGl.exe
  2⤵
  - Executes dropped EXE
  PID:3056
- C:\Windows\System\FgKrwgn.exe
  C:\Windows\System\FgKrwgn.exe
  2⤵
  - Executes dropped EXE
  PID:2112
- C:\Windows\System\NmNUhUX.exe
  C:\Windows\System\NmNUhUX.exe
  2⤵
  - Executes dropped EXE
  PID:1632
- C:\Windows\System\QmlOjAn.exe
  C:\Windows\System\QmlOjAn.exe
  2⤵
  - Executes dropped EXE
  PID:2564
- C:\Windows\System\biTlAYi.exe
  C:\Windows\System\biTlAYi.exe
  2⤵
  - Executes dropped EXE
  PID:1476
- C:\Windows\System\FdbOwFv.exe
  C:\Windows\System\FdbOwFv.exe
  2⤵
  - Executes dropped EXE
  PID:2788
- C:\Windows\System\pbbLDTa.exe
  C:\Windows\System\pbbLDTa.exe
  2⤵
  - Executes dropped EXE
  PID:1940
- C:\Windows\System\nLFXkzW.exe
  C:\Windows\System\nLFXkzW.exe
  2⤵
  - Executes dropped EXE
  PID:868
- C:\Windows\System\QkPVZUp.exe
  C:\Windows\System\QkPVZUp.exe
  2⤵
  - Executes dropped EXE
  PID:1480
- C:\Windows\System\NNbuAck.exe
  C:\Windows\System\NNbuAck.exe
  2⤵
  - Executes dropped EXE
  PID:2880
- C:\Windows\System\EiMhqzr.exe
  C:\Windows\System\EiMhqzr.exe
  2⤵
  - Executes dropped EXE
  PID:2864
- C:\Windows\System\MNQbXwA.exe
  C:\Windows\System\MNQbXwA.exe
  2⤵
  - Executes dropped EXE
  PID:1952
- C:\Windows\System\WnYvbxx.exe
  C:\Windows\System\WnYvbxx.exe
  2⤵
  - Executes dropped EXE
  PID:1444
- C:\Windows\System\PdcabTG.exe
  C:\Windows\System\PdcabTG.exe
  2⤵
  - Executes dropped EXE
  PID:1136
- C:\Windows\System\uUUnZBn.exe
  C:\Windows\System\uUUnZBn.exe
  2⤵
  - Executes dropped EXE
  PID:1132
- C:\Windows\System\lItJLaT.exe
  C:\Windows\System\lItJLaT.exe
  2⤵
  - Executes dropped EXE
  PID:392
- C:\Windows\System\NcVZRfP.exe
  C:\Windows\System\NcVZRfP.exe
  2⤵
  - Executes dropped EXE
  PID:488
- C:\Windows\System\juYLESb.exe
  C:\Windows\System\juYLESb.exe
  2⤵
  - Executes dropped EXE
  PID:764
- C:\Windows\System\zOtyors.exe
  C:\Windows\System\zOtyors.exe
  2⤵
  - Executes dropped EXE
  PID:1176
- C:\Windows\System\eUtlFDQ.exe
  C:\Windows\System\eUtlFDQ.exe
  2⤵
  - Executes dropped EXE
  PID:1880
- C:\Windows\System\IOkIoAe.exe
  C:\Windows\System\IOkIoAe.exe
  2⤵
  - Executes dropped EXE
  PID:1992
- C:\Windows\System\xOUvwfg.exe
  C:\Windows\System\xOUvwfg.exe
  2⤵
  - Executes dropped EXE
  PID:1624
- C:\Windows\System\iJYhhmu.exe
  C:\Windows\System\iJYhhmu.exe
  2⤵
  - Executes dropped EXE
  PID:1780
- C:\Windows\System\dnAwRjF.exe
  C:\Windows\System\dnAwRjF.exe
  2⤵
  - Executes dropped EXE
  PID:832
- C:\Windows\System\lIFJUho.exe
  C:\Windows\System\lIFJUho.exe
  2⤵
  - Executes dropped EXE
  PID:2452
- C:\Windows\System\CNTqWhP.exe
  C:\Windows\System\CNTqWhP.exe
  2⤵
  - Executes dropped EXE
  PID:1228
- C:\Windows\System\bTPLuVG.exe
  C:\Windows\System\bTPLuVG.exe
  2⤵
  - Executes dropped EXE
  PID:376
- C:\Windows\System\SOrGxAi.exe
  C:\Windows\System\SOrGxAi.exe
  2⤵
  - Executes dropped EXE
  PID:1684
- C:\Windows\System\avNugdF.exe
  C:\Windows\System\avNugdF.exe
  2⤵
  - Executes dropped EXE
  PID:3028
- C:\Windows\System\VKROHiy.exe
  C:\Windows\System\VKROHiy.exe
  2⤵
  - Executes dropped EXE
  PID:3016
- C:\Windows\System\rXAYmQy.exe
  C:\Windows\System\rXAYmQy.exe
  2⤵
  - Executes dropped EXE
  PID:2432
- C:\Windows\System\avXVUYc.exe
  C:\Windows\System\avXVUYc.exe
  2⤵
  - Executes dropped EXE
  PID:1508
- C:\Windows\System\yBBSbOl.exe
  C:\Windows\System\yBBSbOl.exe
  2⤵
  - Executes dropped EXE
  PID:3008
- C:\Windows\System\JrRcKjS.exe
  C:\Windows\System\JrRcKjS.exe
  2⤵
  - Executes dropped EXE
  PID:2148
- C:\Windows\System\ILKMNhU.exe
  C:\Windows\System\ILKMNhU.exe
  2⤵
  - Executes dropped EXE
  PID:1128
- C:\Windows\System\OnoeOGz.exe
  C:\Windows\System\OnoeOGz.exe
  2⤵
  - Executes dropped EXE
  PID:1760
- C:\Windows\System\zGovxPa.exe
  C:\Windows\System\zGovxPa.exe
  2⤵
  - Executes dropped EXE
  PID:2820
- C:\Windows\System\wsvoUqI.exe
  C:\Windows\System\wsvoUqI.exe
  2⤵
  - Executes dropped EXE
  PID:880
- C:\Windows\System\zcMjVMU.exe
  C:\Windows\System\zcMjVMU.exe
  2⤵
  - Executes dropped EXE
  PID:2276
- C:\Windows\System\Fdkqffp.exe
  C:\Windows\System\Fdkqffp.exe
  2⤵
  - Executes dropped EXE
  PID:1728
- C:\Windows\System\bQXcxPc.exe
  C:\Windows\System\bQXcxPc.exe
  2⤵
  - Executes dropped EXE
  PID:2704
- C:\Windows\System\nnExqcX.exe
  C:\Windows\System\nnExqcX.exe
  2⤵
  - Executes dropped EXE
  PID:2652
- C:\Windows\System\hMlSbRg.exe
  C:\Windows\System\hMlSbRg.exe
  2⤵
  - Executes dropped EXE
  PID:2664
- C:\Windows\System\XsljtMl.exe
  C:\Windows\System\XsljtMl.exe
  2⤵
  - Executes dropped EXE
  PID:3060
- C:\Windows\System\XYWRyzP.exe
  C:\Windows\System\XYWRyzP.exe
  2⤵
  - Executes dropped EXE
  PID:2532
- C:\Windows\System\VBWIABx.exe
  C:\Windows\System\VBWIABx.exe
  2⤵
  - Executes dropped EXE
  PID:2908
- C:\Windows\System\iSSDGJU.exe
  C:\Windows\System\iSSDGJU.exe
  2⤵
  - Executes dropped EXE
  PID:2572
- C:\Windows\System\dOxyVXM.exe
  C:\Windows\System\dOxyVXM.exe
  2⤵
  - Executes dropped EXE
  PID:2720
- C:\Windows\System\pUOVUBz.exe
  C:\Windows\System\pUOVUBz.exe
  2⤵
  - Executes dropped EXE
  PID:2892
- C:\Windows\System\REUfyET.exe
  C:\Windows\System\REUfyET.exe
  2⤵
  - Executes dropped EXE
  PID:2556
- C:\Windows\System\bRJGoqM.exe
  C:\Windows\System\bRJGoqM.exe
  2⤵
  - Executes dropped EXE
  PID:2800
- C:\Windows\System\SDWrHUF.exe
  C:\Windows\System\SDWrHUF.exe
  2⤵
  - Executes dropped EXE
  PID:3048
- C:\Windows\System\SZmOpCq.exe
  C:\Windows\System\SZmOpCq.exe
  2⤵
  - Executes dropped EXE
  PID:2668
- C:\Windows\System\UHoHoYg.exe
  C:\Windows\System\UHoHoYg.exe
  2⤵
  PID:2392
- C:\Windows\System\wePxdKG.exe
  C:\Windows\System\wePxdKG.exe
  2⤵
  PID:2456
- C:\Windows\System\eXYjgqs.exe
  C:\Windows\System\eXYjgqs.exe
  2⤵
  PID:2192
- C:\Windows\System\KCnGfWl.exe
  C:\Windows\System\KCnGfWl.exe
  2⤵
  PID:1536
- C:\Windows\System\QICHEuY.exe
  C:\Windows\System\QICHEuY.exe
  2⤵
  PID:1292
- C:\Windows\System\TYDecSV.exe
  C:\Windows\System\TYDecSV.exe
  2⤵
  PID:2164
- C:\Windows\System\eNuASQJ.exe
  C:\Windows\System\eNuASQJ.exe
  2⤵
  PID:1752
- C:\Windows\System\BVjjjQw.exe
  C:\Windows\System\BVjjjQw.exe
  2⤵
  PID:2092
- C:\Windows\System\phsLazp.exe
  C:\Windows\System\phsLazp.exe
  2⤵
  PID:1640
- C:\Windows\System\ZdDteMw.exe
  C:\Windows\System\ZdDteMw.exe
  2⤵
  PID:2512
- C:\Windows\System\bDONYUv.exe
  C:\Windows\System\bDONYUv.exe
  2⤵
  PID:1236
- C:\Windows\System\hShHPSk.exe
  C:\Windows\System\hShHPSk.exe
  2⤵
  PID:1100
- C:\Windows\System\UQTomYL.exe
  C:\Windows\System\UQTomYL.exe
  2⤵
  PID:2928
- C:\Windows\System\UXVthxO.exe
  C:\Windows\System\UXVthxO.exe
  2⤵
  PID:1452
- C:\Windows\System\vTzJPsF.exe
  C:\Windows\System\vTzJPsF.exe
  2⤵
  PID:976
- C:\Windows\System\XsymWYN.exe
  C:\Windows\System\XsymWYN.exe
  2⤵
  PID:2404
- C:\Windows\System\LunMViD.exe
  C:\Windows\System\LunMViD.exe
  2⤵
  PID:2040
- C:\Windows\System\nVjQgZQ.exe
  C:\Windows\System\nVjQgZQ.exe
  2⤵
  PID:808
- C:\Windows\System\QjtMZqQ.exe
  C:\Windows\System\QjtMZqQ.exe
  2⤵
  PID:2180
- C:\Windows\System\OnVJaRx.exe
  C:\Windows\System\OnVJaRx.exe
  2⤵
  PID:1928
- C:\Windows\System\qImZDDy.exe
  C:\Windows\System\qImZDDy.exe
  2⤵
  PID:2028
- C:\Windows\System\BAhBeCq.exe
  C:\Windows\System\BAhBeCq.exe
  2⤵
  PID:2496
- C:\Windows\System\baUTgLT.exe
  C:\Windows\System\baUTgLT.exe
  2⤵
  PID:2804
- C:\Windows\System\kWAUTOs.exe
  C:\Windows\System\kWAUTOs.exe
  2⤵
  PID:2792
- C:\Windows\System\vcURDPi.exe
  C:\Windows\System\vcURDPi.exe
  2⤵
  PID:2660
- C:\Windows\System\ghbqPmz.exe
  C:\Windows\System\ghbqPmz.exe
  2⤵
  PID:2712
- C:\Windows\System\SrGMCoF.exe
  C:\Windows\System\SrGMCoF.exe
  2⤵
  PID:2840
- C:\Windows\System\rtkxjSc.exe
  C:\Windows\System\rtkxjSc.exe
  2⤵
  PID:2304
- C:\Windows\System\KhlthZX.exe
  C:\Windows\System\KhlthZX.exe
  2⤵
  PID:2860
- C:\Windows\System\IiRRuQB.exe
  C:\Windows\System\IiRRuQB.exe
  2⤵
  PID:564
- C:\Windows\System\zPgpxJq.exe
  C:\Windows\System\zPgpxJq.exe
  2⤵
  PID:324
- C:\Windows\System\ftnFsOc.exe
  C:\Windows\System\ftnFsOc.exe
  2⤵
  PID:1584
- C:\Windows\System\jyFsMln.exe
  C:\Windows\System\jyFsMln.exe
  2⤵
  PID:2348
- C:\Windows\System\LwDyrAF.exe
  C:\Windows\System\LwDyrAF.exe
  2⤵
  PID:1580
- C:\Windows\System\CRNnZya.exe
  C:\Windows\System\CRNnZya.exe
  2⤵
  PID:3020
- C:\Windows\System\pNpXOsR.exe
  C:\Windows\System\pNpXOsR.exe
  2⤵
  PID:2188
- C:\Windows\System\FTswcYy.exe
  C:\Windows\System\FTswcYy.exe
  2⤵
  PID:620
- C:\Windows\System\sBoqcNP.exe
  C:\Windows\System\sBoqcNP.exe
  2⤵
  PID:696
- C:\Windows\System\vTYSKly.exe
  C:\Windows\System\vTYSKly.exe
  2⤵
  PID:2740
- C:\Windows\System\tKcHNTe.exe
  C:\Windows\System\tKcHNTe.exe
  2⤵
  PID:2636
- C:\Windows\System\WRClfDl.exe
  C:\Windows\System\WRClfDl.exe
  2⤵
  PID:2748
- C:\Windows\System\cKDktPJ.exe
  C:\Windows\System\cKDktPJ.exe
  2⤵
  PID:2084
- C:\Windows\System\rDUhgVs.exe
  C:\Windows\System\rDUhgVs.exe
  2⤵
  PID:624
- C:\Windows\System\YbpbJPa.exe
  C:\Windows\System\YbpbJPa.exe
  2⤵
  PID:2096
- C:\Windows\System\eqdiIrH.exe
  C:\Windows\System\eqdiIrH.exe
  2⤵
  PID:1768
- C:\Windows\System\TUCjGLp.exe
  C:\Windows\System\TUCjGLp.exe
  2⤵
  PID:2816
- C:\Windows\System\vaEmlZM.exe
  C:\Windows\System\vaEmlZM.exe
  2⤵
  PID:1956
- C:\Windows\System\YsRLJVA.exe
  C:\Windows\System\YsRLJVA.exe
  2⤵
  PID:1244
- C:\Windows\System\FeyyZiA.exe
  C:\Windows\System\FeyyZiA.exe
  2⤵
  PID:2808
- C:\Windows\System\IlolrKb.exe
  C:\Windows\System\IlolrKb.exe
  2⤵
  PID:1740
- C:\Windows\System\gsAREuz.exe
  C:\Windows\System\gsAREuz.exe
  2⤵
  PID:1592
- C:\Windows\System\PRLBtzo.exe
  C:\Windows\System\PRLBtzo.exe
  2⤵
  PID:1604
- C:\Windows\System\mLhnvRg.exe
  C:\Windows\System\mLhnvRg.exe
  2⤵
  PID:1936
- C:\Windows\System\gsEeWPq.exe
  C:\Windows\System\gsEeWPq.exe
  2⤵
  PID:708
- C:\Windows\System\mhlxcQK.exe
  C:\Windows\System\mhlxcQK.exe
  2⤵
  PID:2352
- C:\Windows\System\XlqAiwv.exe
  C:\Windows\System\XlqAiwv.exe
  2⤵
  PID:1832
- C:\Windows\System\FLaFNGF.exe
  C:\Windows\System\FLaFNGF.exe
  2⤵
  PID:1152
- C:\Windows\System\IhfddjD.exe
  C:\Windows\System\IhfddjD.exe
  2⤵
  PID:2772
- C:\Windows\System\YOTAGnk.exe
  C:\Windows\System\YOTAGnk.exe
  2⤵
  PID:1316
- C:\Windows\System\GpVLHiG.exe
  C:\Windows\System\GpVLHiG.exe
  2⤵
  PID:3124
- C:\Windows\System\TpFWzyf.exe
  C:\Windows\System\TpFWzyf.exe
  2⤵
  PID:3220
- C:\Windows\System\dMtkyLG.exe
  C:\Windows\System\dMtkyLG.exe
  2⤵
  PID:3240
- C:\Windows\System\tAcjDVv.exe
  C:\Windows\System\tAcjDVv.exe
  2⤵
  PID:3256
- C:\Windows\System\HRSLzqL.exe
  C:\Windows\System\HRSLzqL.exe
  2⤵
  PID:3276
- C:\Windows\System\spjNYAC.exe
  C:\Windows\System\spjNYAC.exe
  2⤵
  PID:3300
- C:\Windows\System\AoKnTFK.exe
  C:\Windows\System\AoKnTFK.exe
  2⤵
  PID:3316
- C:\Windows\System\KxdjYYy.exe
  C:\Windows\System\KxdjYYy.exe
  2⤵
  PID:3332
- C:\Windows\System\FRdEAwS.exe
  C:\Windows\System\FRdEAwS.exe
  2⤵
  PID:3348
- C:\Windows\System\crdAlPV.exe
  C:\Windows\System\crdAlPV.exe
  2⤵
  PID:3368
- C:\Windows\System\KEKGBke.exe
  C:\Windows\System\KEKGBke.exe
  2⤵
  PID:3384
- C:\Windows\System\vSrTUtt.exe
  C:\Windows\System\vSrTUtt.exe
  2⤵
  PID:3400
- C:\Windows\System\LLOJQeZ.exe
  C:\Windows\System\LLOJQeZ.exe
  2⤵
  PID:3416
- C:\Windows\System\yMisAqq.exe
  C:\Windows\System\yMisAqq.exe
  2⤵
  PID:3460
- C:\Windows\System\bhYZgpJ.exe
  C:\Windows\System\bhYZgpJ.exe
  2⤵
  PID:3488
- C:\Windows\System\ZEAQaSK.exe
  C:\Windows\System\ZEAQaSK.exe
  2⤵
  PID:3504
- C:\Windows\System\IABeCEe.exe
  C:\Windows\System\IABeCEe.exe
  2⤵
  PID:3520
- C:\Windows\System\oCjYQIJ.exe
  C:\Windows\System\oCjYQIJ.exe
  2⤵
  PID:3536
- C:\Windows\System\PQiXvEI.exe
  C:\Windows\System\PQiXvEI.exe
  2⤵
  PID:3552
- C:\Windows\System\KUtscRe.exe
  C:\Windows\System\KUtscRe.exe
  2⤵
  PID:3568
- C:\Windows\System\NzwxcIm.exe
  C:\Windows\System\NzwxcIm.exe
  2⤵
  PID:3616
- C:\Windows\System\hJAvZlX.exe
  C:\Windows\System\hJAvZlX.exe
  2⤵
  PID:3636
- C:\Windows\System\LZOYxvH.exe
  C:\Windows\System\LZOYxvH.exe
  2⤵
  PID:3652
- C:\Windows\System\fUlMKWu.exe
  C:\Windows\System\fUlMKWu.exe
  2⤵
  PID:3668
- C:\Windows\System\kaArucR.exe
  C:\Windows\System\kaArucR.exe
  2⤵
  PID:3684
- C:\Windows\System\KlZPday.exe
  C:\Windows\System\KlZPday.exe
  2⤵
  PID:3700
- C:\Windows\System\DyWlQTM.exe
  C:\Windows\System\DyWlQTM.exe
  2⤵
  PID:3716
- C:\Windows\System\resfnUS.exe
  C:\Windows\System\resfnUS.exe
  2⤵
  PID:3732
- C:\Windows\System\rWsAErp.exe
  C:\Windows\System\rWsAErp.exe
  2⤵
  PID:3748
- C:\Windows\System\PiZQSFc.exe
  C:\Windows\System\PiZQSFc.exe
  2⤵
  PID:3764
- C:\Windows\System\bwWUNex.exe
  C:\Windows\System\bwWUNex.exe
  2⤵
  PID:3784
- C:\Windows\System\qzyaBGf.exe
  C:\Windows\System\qzyaBGf.exe
  2⤵
  PID:3800
- C:\Windows\System\wyQDAzM.exe
  C:\Windows\System\wyQDAzM.exe
  2⤵
  PID:3816
- C:\Windows\System\yZOOiYr.exe
  C:\Windows\System\yZOOiYr.exe
  2⤵
  PID:3832
- C:\Windows\System\aeVZuje.exe
  C:\Windows\System\aeVZuje.exe
  2⤵
  PID:3888
- C:\Windows\System\wGdJEhQ.exe
  C:\Windows\System\wGdJEhQ.exe
  2⤵
  PID:3904
- C:\Windows\System\VpUtMzG.exe
  C:\Windows\System\VpUtMzG.exe
  2⤵
  PID:3932
- C:\Windows\System\ldeCmtB.exe
  C:\Windows\System\ldeCmtB.exe
  2⤵
  PID:3948
- C:\Windows\System\iVFVxrS.exe
  C:\Windows\System\iVFVxrS.exe
  2⤵
  PID:3964
- C:\Windows\System\qRZEhow.exe
  C:\Windows\System\qRZEhow.exe
  2⤵
  PID:3980
- C:\Windows\System\pOetipa.exe
  C:\Windows\System\pOetipa.exe
  2⤵
  PID:3996
- C:\Windows\System\OTpwLLm.exe
  C:\Windows\System\OTpwLLm.exe
  2⤵
  PID:4012
- C:\Windows\System\lzyGtOU.exe
  C:\Windows\System\lzyGtOU.exe
  2⤵
  PID:4028
- C:\Windows\System\bkCqoXo.exe
  C:\Windows\System\bkCqoXo.exe
  2⤵
  PID:4048
- C:\Windows\System\bzGGjVU.exe
  C:\Windows\System\bzGGjVU.exe
  2⤵
  PID:4064
- C:\Windows\System\bpQwJXg.exe
  C:\Windows\System\bpQwJXg.exe
  2⤵
  PID:4080
- C:\Windows\System\HuGzxCB.exe
  C:\Windows\System\HuGzxCB.exe
  2⤵
  PID:2876
- C:\Windows\System\GtsTVcR.exe
  C:\Windows\System\GtsTVcR.exe
  2⤵
  PID:1048
- C:\Windows\System\TtykldG.exe
  C:\Windows\System\TtykldG.exe
  2⤵
  PID:2328
- C:\Windows\System\JboqfDV.exe
  C:\Windows\System\JboqfDV.exe
  2⤵
  PID:2924
- C:\Windows\System\SpUzRrx.exe
  C:\Windows\System\SpUzRrx.exe
  2⤵
  PID:1524
- C:\Windows\System\ZBtBSlZ.exe
  C:\Windows\System\ZBtBSlZ.exe
  2⤵
  PID:892
- C:\Windows\System\zAwlFef.exe
  C:\Windows\System\zAwlFef.exe
  2⤵
  PID:3076
- C:\Windows\System\tIueAcn.exe
  C:\Windows\System\tIueAcn.exe
  2⤵
  PID:2384
- C:\Windows\System\wwjpgbT.exe
  C:\Windows\System\wwjpgbT.exe
  2⤵
  PID:2960
- C:\Windows\System\SEveRJO.exe
  C:\Windows\System\SEveRJO.exe
  2⤵
  PID:2528
- C:\Windows\System\cGcSkkD.exe
  C:\Windows\System\cGcSkkD.exe
  2⤵
  PID:3084
- C:\Windows\System\OkeVfGf.exe
  C:\Windows\System\OkeVfGf.exe
  2⤵
  PID:3096
- C:\Windows\System\cQsHLyE.exe
  C:\Windows\System\cQsHLyE.exe
  2⤵
  PID:3112
- C:\Windows\System\KkCXQmO.exe
  C:\Windows\System\KkCXQmO.exe
  2⤵
  PID:2848
- C:\Windows\System\GEFVzcF.exe
  C:\Windows\System\GEFVzcF.exe
  2⤵
  PID:2124
- C:\Windows\System\ltUqBlq.exe
  C:\Windows\System\ltUqBlq.exe
  2⤵
  PID:3216
- C:\Windows\System\VAfjtmf.exe
  C:\Windows\System\VAfjtmf.exe
  2⤵
  PID:2216
- C:\Windows\System\QKBqXTd.exe
  C:\Windows\System\QKBqXTd.exe
  2⤵
  PID:3208
- C:\Windows\System\UKGvIXP.exe
  C:\Windows\System\UKGvIXP.exe
  2⤵
  PID:3144
- C:\Windows\System\LMxVdxU.exe
  C:\Windows\System\LMxVdxU.exe
  2⤵
  PID:3160
- C:\Windows\System\fsamDqs.exe
  C:\Windows\System\fsamDqs.exe
  2⤵
  PID:3180
- C:\Windows\System\ZBbcoLp.exe
  C:\Windows\System\ZBbcoLp.exe
  2⤵
  PID:2728
- C:\Windows\System\NWGCxlg.exe
  C:\Windows\System\NWGCxlg.exe
  2⤵
  PID:1988
- C:\Windows\System\AfvTliw.exe
  C:\Windows\System\AfvTliw.exe
  2⤵
  PID:2200
- C:\Windows\System\CvEzeXP.exe
  C:\Windows\System\CvEzeXP.exe
  2⤵
  PID:3212
- C:\Windows\System\VjBeAGo.exe
  C:\Windows\System\VjBeAGo.exe
  2⤵
  PID:3196
- C:\Windows\System\PgtHgYZ.exe
  C:\Windows\System\PgtHgYZ.exe
  2⤵
  PID:3264
- C:\Windows\System\mgHstsb.exe
  C:\Windows\System\mgHstsb.exe
  2⤵
  PID:3252
- C:\Windows\System\hQDWksm.exe
  C:\Windows\System\hQDWksm.exe
  2⤵
  PID:3360
- C:\Windows\System\UmWpAAV.exe
  C:\Windows\System\UmWpAAV.exe
  2⤵
  PID:3440
- C:\Windows\System\USjWJgQ.exe
  C:\Windows\System\USjWJgQ.exe
  2⤵
  PID:3476
- C:\Windows\System\DjBSriK.exe
  C:\Windows\System\DjBSriK.exe
  2⤵
  PID:3516
- C:\Windows\System\UysKZpE.exe
  C:\Windows\System\UysKZpE.exe
  2⤵
  PID:3580
- C:\Windows\System\BCaiBQJ.exe
  C:\Windows\System\BCaiBQJ.exe
  2⤵
  PID:3424
- C:\Windows\System\KufZSDo.exe
  C:\Windows\System\KufZSDo.exe
  2⤵
  PID:3584
- C:\Windows\System\exqKbHz.exe
  C:\Windows\System\exqKbHz.exe
  2⤵
  PID:3600
- C:\Windows\System\yEdhjli.exe
  C:\Windows\System\yEdhjli.exe
  2⤵
  PID:3664
- C:\Windows\System\ywAVUUi.exe
  C:\Windows\System\ywAVUUi.exe
  2⤵
  PID:3728
- C:\Windows\System\NYhrCsf.exe
  C:\Windows\System\NYhrCsf.exe
  2⤵
  PID:3632
- C:\Windows\System\MZuCfaJ.exe
  C:\Windows\System\MZuCfaJ.exe
  2⤵
  PID:3644
- C:\Windows\System\OLBOnMH.exe
  C:\Windows\System\OLBOnMH.exe
  2⤵
  PID:3796
- C:\Windows\System\gwDPHUi.exe
  C:\Windows\System\gwDPHUi.exe
  2⤵
  PID:3744
- C:\Windows\System\ylAMQww.exe
  C:\Windows\System\ylAMQww.exe
  2⤵
  PID:3808
- C:\Windows\System\vTjQEtL.exe
  C:\Windows\System\vTjQEtL.exe
  2⤵
  PID:3852
- C:\Windows\System\YoVjbZG.exe
  C:\Windows\System\YoVjbZG.exe
  2⤵
  PID:3868
- C:\Windows\System\HBSwVaf.exe
  C:\Windows\System\HBSwVaf.exe
  2⤵
  PID:3884
- C:\Windows\System\soaSIkT.exe
  C:\Windows\System\soaSIkT.exe
  2⤵
  PID:3940
- C:\Windows\System\bULYTFi.exe
  C:\Windows\System\bULYTFi.exe
  2⤵
  PID:3924
- C:\Windows\System\FhcVqXv.exe
  C:\Windows\System\FhcVqXv.exe
  2⤵
  PID:4040
- C:\Windows\System\rdtnUjL.exe
  C:\Windows\System\rdtnUjL.exe
  2⤵
  PID:2744
- C:\Windows\System\CDOgyej.exe
  C:\Windows\System\CDOgyej.exe
  2⤵
  PID:2764
- C:\Windows\System\RutSbOJ.exe
  C:\Windows\System\RutSbOJ.exe
  2⤵
  PID:3032
- C:\Windows\System\QtPmTXp.exe
  C:\Windows\System\QtPmTXp.exe
  2⤵
  PID:4044
- C:\Windows\System\mYTzQCp.exe
  C:\Windows\System\mYTzQCp.exe
  2⤵
  PID:3988
- C:\Windows\System\RYJHgQe.exe
  C:\Windows\System\RYJHgQe.exe
  2⤵
  PID:4056
- C:\Windows\System\AxxBLan.exe
  C:\Windows\System\AxxBLan.exe
  2⤵
  PID:1824
- C:\Windows\System\PnmbgVf.exe
  C:\Windows\System\PnmbgVf.exe
  2⤵
  PID:3024
- C:\Windows\System\fPFxlGv.exe
  C:\Windows\System\fPFxlGv.exe
  2⤵
  PID:2480
- C:\Windows\System\huMhQcR.exe
  C:\Windows\System\huMhQcR.exe
  2⤵
  PID:1456
- C:\Windows\System\RpIkBxf.exe
  C:\Windows\System\RpIkBxf.exe
  2⤵
  PID:860
- C:\Windows\System\SBlGbMo.exe
  C:\Windows\System\SBlGbMo.exe
  2⤵
  PID:3148
- C:\Windows\System\YEZYZKh.exe
  C:\Windows\System\YEZYZKh.exe
  2⤵
  PID:3232
- C:\Windows\System\TRPRsbz.exe
  C:\Windows\System\TRPRsbz.exe
  2⤵
  PID:3248
- C:\Windows\System\FkcwmUJ.exe
  C:\Windows\System\FkcwmUJ.exe
  2⤵
  PID:2000
- C:\Windows\System\wYboNoW.exe
  C:\Windows\System\wYboNoW.exe
  2⤵
  PID:1932
- C:\Windows\System\XgvNign.exe
  C:\Windows\System\XgvNign.exe
  2⤵
  PID:3376
- C:\Windows\System\GjdOiZh.exe
  C:\Windows\System\GjdOiZh.exe
  2⤵
  PID:3380
- C:\Windows\System\TRbyZiw.exe
  C:\Windows\System\TRbyZiw.exe
  2⤵
  PID:3324
- C:\Windows\System\ZVzIWNU.exe
  C:\Windows\System\ZVzIWNU.exe
  2⤵
  PID:3468
- C:\Windows\System\CvLqRKE.exe
  C:\Windows\System\CvLqRKE.exe
  2⤵
  PID:3512
- C:\Windows\System\sGTGBEH.exe
  C:\Windows\System\sGTGBEH.exe
  2⤵
  PID:3344
- C:\Windows\System\tJGhpcx.exe
  C:\Windows\System\tJGhpcx.exe
  2⤵
  PID:3696
- C:\Windows\System\SZRhmYc.exe
  C:\Windows\System\SZRhmYc.exe
  2⤵
  PID:4104
- C:\Windows\System\nmpaCML.exe
  C:\Windows\System\nmpaCML.exe
  2⤵
  PID:4120
- C:\Windows\System\wiSRhfS.exe
  C:\Windows\System\wiSRhfS.exe
  2⤵
  PID:4136
- C:\Windows\System\ZbtFwWa.exe
  C:\Windows\System\ZbtFwWa.exe
  2⤵
  PID:4152
- C:\Windows\System\XTRgqXx.exe
  C:\Windows\System\XTRgqXx.exe
  2⤵
  PID:4168
- C:\Windows\System\hktvaVh.exe
  C:\Windows\System\hktvaVh.exe
  2⤵
  PID:4184
- C:\Windows\System\KpfEfFj.exe
  C:\Windows\System\KpfEfFj.exe
  2⤵
  PID:4200
- C:\Windows\System\lfLVnFl.exe
  C:\Windows\System\lfLVnFl.exe
  2⤵
  PID:4220
- C:\Windows\System\nSXHpcR.exe
  C:\Windows\System\nSXHpcR.exe
  2⤵
  PID:4236
- C:\Windows\System\XtyNEHI.exe
  C:\Windows\System\XtyNEHI.exe
  2⤵
  PID:4252
- C:\Windows\System\NSgvYrk.exe
  C:\Windows\System\NSgvYrk.exe
  2⤵
  PID:4268
- C:\Windows\System\FYImSHW.exe
  C:\Windows\System\FYImSHW.exe
  2⤵
  PID:4284
- C:\Windows\System\Kvolujt.exe
  C:\Windows\System\Kvolujt.exe
  2⤵
  PID:4300
- C:\Windows\System\EJLKcbV.exe
  C:\Windows\System\EJLKcbV.exe
  2⤵
  PID:4316
- C:\Windows\System\aposHQu.exe
  C:\Windows\System\aposHQu.exe
  2⤵
  PID:4332
- C:\Windows\System\xAMmkGp.exe
  C:\Windows\System\xAMmkGp.exe
  2⤵
  PID:4352
- C:\Windows\System\zUFqQFt.exe
  C:\Windows\System\zUFqQFt.exe
  2⤵
  PID:4368
- C:\Windows\System\NgoAxUQ.exe
  C:\Windows\System\NgoAxUQ.exe
  2⤵
  PID:4384
- C:\Windows\System\BaFClRJ.exe
  C:\Windows\System\BaFClRJ.exe
  2⤵
  PID:4400
- C:\Windows\System\aiIDyAX.exe
  C:\Windows\System\aiIDyAX.exe
  2⤵
  PID:4416
- C:\Windows\System\NvoKpZK.exe
  C:\Windows\System\NvoKpZK.exe
  2⤵
  PID:4432
- C:\Windows\System\MKptWlY.exe
  C:\Windows\System\MKptWlY.exe
  2⤵
  PID:4452
- C:\Windows\System\bHkyPFj.exe
  C:\Windows\System\bHkyPFj.exe
  2⤵
  PID:4468
- C:\Windows\System\sONMZEh.exe
  C:\Windows\System\sONMZEh.exe
  2⤵
  PID:4484
- C:\Windows\System\mFDrHtL.exe
  C:\Windows\System\mFDrHtL.exe
  2⤵
  PID:4500
- C:\Windows\System\nCvfEtS.exe
  C:\Windows\System\nCvfEtS.exe
  2⤵
  PID:4516
- C:\Windows\System\ZXeZVgp.exe
  C:\Windows\System\ZXeZVgp.exe
  2⤵
  PID:4532
- C:\Windows\System\fagCtuO.exe
  C:\Windows\System\fagCtuO.exe
  2⤵
  PID:4548
- C:\Windows\System\JkwEOPX.exe
  C:\Windows\System\JkwEOPX.exe
  2⤵
  PID:4564
- C:\Windows\System\tQFFKIh.exe
  C:\Windows\System\tQFFKIh.exe
  2⤵
  PID:4580
- C:\Windows\System\oCynsHK.exe
  C:\Windows\System\oCynsHK.exe
  2⤵
  PID:4600
- C:\Windows\System\Ckufjgv.exe
  C:\Windows\System\Ckufjgv.exe
  2⤵
  PID:4616
- C:\Windows\System\PeyKIAR.exe
  C:\Windows\System\PeyKIAR.exe
  2⤵
  PID:4632
- C:\Windows\System\PVJEVrf.exe
  C:\Windows\System\PVJEVrf.exe
  2⤵
  PID:4648
- C:\Windows\System\hrhTUat.exe
  C:\Windows\System\hrhTUat.exe
  2⤵
  PID:4664
- C:\Windows\System\vvIzbnQ.exe
  C:\Windows\System\vvIzbnQ.exe
  2⤵
  PID:4680
- C:\Windows\System\hJJcBcK.exe
  C:\Windows\System\hJJcBcK.exe
  2⤵
  PID:4700
- C:\Windows\System\GcVSwKg.exe
  C:\Windows\System\GcVSwKg.exe
  2⤵
  PID:4716
- C:\Windows\System\fvnvYMG.exe
  C:\Windows\System\fvnvYMG.exe
  2⤵
  PID:4864
- C:\Windows\System\fKywCSy.exe
  C:\Windows\System\fKywCSy.exe
  2⤵
  PID:4888
- C:\Windows\System\ovcwMmv.exe
  C:\Windows\System\ovcwMmv.exe
  2⤵
  PID:4904
- C:\Windows\System\XgkCrtE.exe
  C:\Windows\System\XgkCrtE.exe
  2⤵
  PID:4920
- C:\Windows\System\DokDKqe.exe
  C:\Windows\System\DokDKqe.exe
  2⤵
  PID:4936
- C:\Windows\System\mSkEhoA.exe
  C:\Windows\System\mSkEhoA.exe
  2⤵
  PID:4952
- C:\Windows\System\rECPrcz.exe
  C:\Windows\System\rECPrcz.exe
  2⤵
  PID:4968
- C:\Windows\System\DOlhfBJ.exe
  C:\Windows\System\DOlhfBJ.exe
  2⤵
  PID:4984
- C:\Windows\System\GjWswtv.exe
  C:\Windows\System\GjWswtv.exe
  2⤵
  PID:5000
- C:\Windows\System\CIhImgL.exe
  C:\Windows\System\CIhImgL.exe
  2⤵
  PID:5016
- C:\Windows\System\amTHLCW.exe
  C:\Windows\System\amTHLCW.exe
  2⤵
  PID:5036
- C:\Windows\System\barrSLL.exe
  C:\Windows\System\barrSLL.exe
  2⤵
  PID:5052
- C:\Windows\System\CSEgNcE.exe
  C:\Windows\System\CSEgNcE.exe
  2⤵
  PID:5068
- C:\Windows\System\uUnWscN.exe
  C:\Windows\System\uUnWscN.exe
  2⤵
  PID:5084
- C:\Windows\System\EeZvXoP.exe
  C:\Windows\System\EeZvXoP.exe
  2⤵
  PID:5100
- C:\Windows\System\pECVIIW.exe
  C:\Windows\System\pECVIIW.exe
  2⤵
  PID:5116
- C:\Windows\System\ZwXthcc.exe
  C:\Windows\System\ZwXthcc.exe
  2⤵
  PID:3876
- C:\Windows\System\GmoJATq.exe
  C:\Windows\System\GmoJATq.exe
  2⤵
  PID:3916
- C:\Windows\System\soocVKc.exe
  C:\Windows\System\soocVKc.exe
  2⤵
  PID:1424
- C:\Windows\System\aVJMXDe.exe
  C:\Windows\System\aVJMXDe.exe
  2⤵
  PID:2904
- C:\Windows\System\MEsMaPf.exe
  C:\Windows\System\MEsMaPf.exe
  2⤵
  PID:2412
- C:\Windows\System\aMUEkVU.exe
  C:\Windows\System\aMUEkVU.exe
  2⤵
  PID:3136
- C:\Windows\System\khvyiMW.exe
  C:\Windows\System\khvyiMW.exe
  2⤵
  PID:3204
- C:\Windows\System\UBifKqn.exe
  C:\Windows\System\UBifKqn.exe
  2⤵
  PID:4748
- C:\Windows\System\EFJiNsU.exe
  C:\Windows\System\EFJiNsU.exe
  2⤵
  PID:3660
- C:\Windows\System\KKAOIxq.exe
  C:\Windows\System\KKAOIxq.exe
  2⤵
  PID:3864
- C:\Windows\System\FPanTla.exe
  C:\Windows\System\FPanTla.exe
  2⤵
  PID:4076
- C:\Windows\System\daDsLuM.exe
  C:\Windows\System\daDsLuM.exe
  2⤵
  PID:1968
- C:\Windows\System\YmmQsUb.exe
  C:\Windows\System\YmmQsUb.exe
  2⤵
  PID:936
- C:\Windows\System\dwgXBqW.exe
  C:\Windows\System\dwgXBqW.exe
  2⤵
  PID:4160
- C:\Windows\System\bOozrJF.exe
  C:\Windows\System\bOozrJF.exe
  2⤵
  PID:4736
- C:\Windows\System\JLovHpw.exe
  C:\Windows\System\JLovHpw.exe
  2⤵
  PID:4772
- C:\Windows\System\gbMrEVn.exe
  C:\Windows\System\gbMrEVn.exe
  2⤵
  PID:4800
- C:\Windows\System\hNHjznj.exe
  C:\Windows\System\hNHjznj.exe
  2⤵
  PID:4832
- C:\Windows\System\wFdBten.exe
  C:\Windows\System\wFdBten.exe
  2⤵
  PID:4808
- C:\Windows\System\gNisdqP.exe
  C:\Windows\System\gNisdqP.exe
  2⤵
  PID:3104
- C:\Windows\System\TvrQNks.exe
  C:\Windows\System\TvrQNks.exe
  2⤵
  PID:548
- C:\Windows\System\VqahQtF.exe
  C:\Windows\System\VqahQtF.exe
  2⤵
  PID:5024
- C:\Windows\System\cCjgLKp.exe
  C:\Windows\System\cCjgLKp.exe
  2⤵
  PID:4996
- C:\Windows\System\IEhYNtY.exe
  C:\Windows\System\IEhYNtY.exe
  2⤵
  PID:4088
- C:\Windows\System\JOKUeXR.exe
  C:\Windows\System\JOKUeXR.exe
  2⤵
  PID:4948
- C:\Windows\System\xkWSKUl.exe
  C:\Windows\System\xkWSKUl.exe
  2⤵
  PID:5080
- C:\Windows\System\BiBIvaV.exe
  C:\Windows\System\BiBIvaV.exe
  2⤵
  PID:3944
- C:\Windows\System\AeOcVhN.exe
  C:\Windows\System\AeOcVhN.exe
  2⤵
  PID:3140
- C:\Windows\System\QsvecsL.exe
  C:\Windows\System\QsvecsL.exe
  2⤵
  PID:4544
- C:\Windows\System\YmxsvkA.exe
  C:\Windows\System\YmxsvkA.exe
  2⤵
  PID:4480
- C:\Windows\System\USjoNYs.exe
  C:\Windows\System\USjoNYs.exe
  2⤵
  PID:4276
- C:\Windows\System\FSWJWHm.exe
  C:\Windows\System\FSWJWHm.exe
  2⤵
  PID:4608
- C:\Windows\System\QRIEgKk.exe
  C:\Windows\System\QRIEgKk.exe
  2⤵
  PID:5048
- C:\Windows\System\mxKvsID.exe
  C:\Windows\System\mxKvsID.exe
  2⤵
  PID:4292
- C:\Windows\System\GBZiBNY.exe
  C:\Windows\System\GBZiBNY.exe
  2⤵
  PID:4560
- C:\Windows\System\YXOWoSz.exe
  C:\Windows\System\YXOWoSz.exe
  2⤵
  PID:4660
- C:\Windows\System\oFviiHt.exe
  C:\Windows\System\oFviiHt.exe
  2⤵
  PID:4312
- C:\Windows\System\xwRqURz.exe
  C:\Windows\System\xwRqURz.exe
  2⤵
  PID:4424
- C:\Windows\System\lYxIanG.exe
  C:\Windows\System\lYxIanG.exe
  2⤵
  PID:4688
- C:\Windows\System\ZkbfbWH.exe
  C:\Windows\System\ZkbfbWH.exe
  2⤵
  PID:2088
- C:\Windows\System\ouFqCpl.exe
  C:\Windows\System\ouFqCpl.exe
  2⤵
  PID:2648
- C:\Windows\System\pmyvtwX.exe
  C:\Windows\System\pmyvtwX.exe
  2⤵
  PID:3532
- C:\Windows\System\GnnCqVP.exe
  C:\Windows\System\GnnCqVP.exe
  2⤵
  PID:3596
- C:\Windows\System\UnyPKJx.exe
  C:\Windows\System\UnyPKJx.exe
  2⤵
  PID:404
- C:\Windows\System\nlbuyau.exe
  C:\Windows\System\nlbuyau.exe
  2⤵
  PID:2416
- C:\Windows\System\wcMFGxj.exe
  C:\Windows\System\wcMFGxj.exe
  2⤵
  PID:4376
- C:\Windows\System\reiHpGN.exe
  C:\Windows\System\reiHpGN.exe
  2⤵
  PID:4340
- C:\Windows\System\ebdMifc.exe
  C:\Windows\System\ebdMifc.exe
  2⤵
  PID:1548
- C:\Windows\System\hoAvFYS.exe
  C:\Windows\System\hoAvFYS.exe
  2⤵
  PID:4696
- C:\Windows\System\HobaLpS.exe
  C:\Windows\System\HobaLpS.exe
  2⤵
  PID:3960
- C:\Windows\System\qjMmCKQ.exe
  C:\Windows\System\qjMmCKQ.exe
  2⤵
  PID:1440
- C:\Windows\System\JpRACFW.exe
  C:\Windows\System\JpRACFW.exe
  2⤵
  PID:3448
- C:\Windows\System\RMgqNMo.exe
  C:\Windows\System\RMgqNMo.exe
  2⤵
  PID:3896
- C:\Windows\System\iKSRDev.exe
  C:\Windows\System\iKSRDev.exe
  2⤵
  PID:904
- C:\Windows\System\xvJRxMV.exe
  C:\Windows\System\xvJRxMV.exe
  2⤵
  PID:2244
- C:\Windows\System\BAxLjeM.exe
  C:\Windows\System\BAxLjeM.exe
  2⤵
  PID:960
- C:\Windows\System\OxRYEmB.exe
  C:\Windows\System\OxRYEmB.exe
  2⤵
  PID:4744
- C:\Windows\System\RSlYmZm.exe
  C:\Windows\System\RSlYmZm.exe
  2⤵
  PID:4328
- C:\Windows\System\bMCiVkm.exe
  C:\Windows\System\bMCiVkm.exe
  2⤵
  PID:4752
- C:\Windows\System\NLtRCEB.exe
  C:\Windows\System\NLtRCEB.exe
  2⤵
  PID:4836
- C:\Windows\System\HGcxLSK.exe
  C:\Windows\System\HGcxLSK.exe
  2⤵
  PID:4828
- C:\Windows\System\FpVCrpc.exe
  C:\Windows\System\FpVCrpc.exe
  2⤵
  PID:4812
- C:\Windows\System\tHCRWip.exe
  C:\Windows\System\tHCRWip.exe
  2⤵
  PID:4900
- C:\Windows\System\SEjgKPy.exe
  C:\Windows\System\SEjgKPy.exe
  2⤵
  PID:4992
- C:\Windows\System\JimBLMR.exe
  C:\Windows\System\JimBLMR.exe
  2⤵
  PID:5060
- C:\Windows\System\rBOeNvt.exe
  C:\Windows\System\rBOeNvt.exe
  2⤵
  PID:4944
- C:\Windows\System\pVjehTv.exe
  C:\Windows\System\pVjehTv.exe
  2⤵
  PID:5012
- C:\Windows\System\QLajRWS.exe
  C:\Windows\System\QLajRWS.exe
  2⤵
  PID:4412
- C:\Windows\System\vJdnYrN.exe
  C:\Windows\System\vJdnYrN.exe
  2⤵
  PID:4448
- C:\Windows\System\sGFUmbd.exe
  C:\Windows\System\sGFUmbd.exe
  2⤵
  PID:4364
- C:\Windows\System\HQUbXEb.exe
  C:\Windows\System\HQUbXEb.exe
  2⤵
  PID:4672
- C:\Windows\System\ZiuBtWZ.exe
  C:\Windows\System\ZiuBtWZ.exe
  2⤵
  PID:5028
- C:\Windows\System\FOqEaFu.exe
  C:\Windows\System\FOqEaFu.exe
  2⤵
  PID:4496
- C:\Windows\System\HucrhHW.exe
  C:\Windows\System\HucrhHW.exe
  2⤵
  PID:4460
- C:\Windows\System\LTabVRp.exe
  C:\Windows\System\LTabVRp.exe
  2⤵
  PID:4624
- C:\Windows\System\BszFhwT.exe
  C:\Windows\System\BszFhwT.exe
  2⤵
  PID:3408
- C:\Windows\System\lqHzFzk.exe
  C:\Windows\System\lqHzFzk.exe
  2⤵
  PID:4116
- C:\Windows\System\QyGQCWE.exe
  C:\Windows\System\QyGQCWE.exe
  2⤵
  PID:3920
- C:\Windows\System\exLRGGk.exe
  C:\Windows\System\exLRGGk.exe
  2⤵
  PID:784
- C:\Windows\System\VlNPGMl.exe
  C:\Windows\System\VlNPGMl.exe
  2⤵
  PID:3236
- C:\Windows\System\BHAEYYP.exe
  C:\Windows\System\BHAEYYP.exe
  2⤵
  PID:3812
- C:\Windows\System\aKQTmnc.exe
  C:\Windows\System\aKQTmnc.exe
  2⤵
  PID:3456
- C:\Windows\System\TiSOZXq.exe
  C:\Windows\System\TiSOZXq.exe
  2⤵
  PID:3860
- C:\Windows\System\vPpZuww.exe
  C:\Windows\System\vPpZuww.exe
  2⤵
  PID:4008
- C:\Windows\System\FSbRVvY.exe
  C:\Windows\System\FSbRVvY.exe
  2⤵
  PID:3308
- C:\Windows\System\cGoIhmq.exe
  C:\Windows\System\cGoIhmq.exe
  2⤵
  PID:3296
- C:\Windows\System\GkAoayA.exe
  C:\Windows\System\GkAoayA.exe
  2⤵
  PID:4760
- C:\Windows\System\bELrNQH.exe
  C:\Windows\System\bELrNQH.exe
  2⤵
  PID:4396
- C:\Windows\System\KYzbwNS.exe
  C:\Windows\System\KYzbwNS.exe
  2⤵
  PID:4820
- C:\Windows\System\qpGCmLE.exe
  C:\Windows\System\qpGCmLE.exe
  2⤵
  PID:3392
- C:\Windows\System\tioQWbN.exe
  C:\Windows\System\tioQWbN.exe
  2⤵
  PID:5064
- C:\Windows\System\ZacqCSL.exe
  C:\Windows\System\ZacqCSL.exe
  2⤵
  PID:4928
- C:\Windows\System\uBOHOVY.exe
  C:\Windows\System\uBOHOVY.exe
  2⤵
  PID:3840
- C:\Windows\System\wYsUosh.exe
  C:\Windows\System\wYsUosh.exe
  2⤵
  PID:2424
- C:\Windows\System\UwrSvRG.exe
  C:\Windows\System\UwrSvRG.exe
  2⤵
  PID:4248
- C:\Windows\System\qSMysHc.exe
  C:\Windows\System\qSMysHc.exe
  2⤵
  PID:4540
- C:\Windows\System\XCrEura.exe
  C:\Windows\System\XCrEura.exe
  2⤵
  PID:4912
- C:\Windows\System\PXAayBI.exe
  C:\Windows\System\PXAayBI.exe
  2⤵
  PID:1560
- C:\Windows\System\JzekbMK.exe
  C:\Windows\System\JzekbMK.exe
  2⤵
  PID:4592
- C:\Windows\System\KnVHDaK.exe
  C:\Windows\System\KnVHDaK.exe
  2⤵
  PID:2408
- C:\Windows\System\nJIcFzE.exe
  C:\Windows\System\nJIcFzE.exe
  2⤵
  PID:4380
- C:\Windows\System\yQpofjN.exe
  C:\Windows\System\yQpofjN.exe
  2⤵
  PID:1172
- C:\Windows\System\MzKAhUB.exe
  C:\Windows\System\MzKAhUB.exe
  2⤵
  PID:3564
- C:\Windows\System\NvdtpKs.exe
  C:\Windows\System\NvdtpKs.exe
  2⤵
  PID:3272
- C:\Windows\System\PkwYdLC.exe
  C:\Windows\System\PkwYdLC.exe
  2⤵
  PID:3780
- C:\Windows\System\DRQVGiH.exe
  C:\Windows\System\DRQVGiH.exe
  2⤵
  PID:4768
- C:\Windows\System\vOLDYhb.exe
  C:\Windows\System\vOLDYhb.exe
  2⤵
  PID:4024
- C:\Windows\System\QHWKEbh.exe
  C:\Windows\System\QHWKEbh.exe
  2⤵
  PID:5128
- C:\Windows\System\mOeaKjz.exe
  C:\Windows\System\mOeaKjz.exe
  2⤵
  PID:5144
- C:\Windows\System\MjYBhqY.exe
  C:\Windows\System\MjYBhqY.exe
  2⤵
  PID:5160
- C:\Windows\System\RekqTls.exe
  C:\Windows\System\RekqTls.exe
  2⤵
  PID:5180
- C:\Windows\System\iSifeTf.exe
  C:\Windows\System\iSifeTf.exe
  2⤵
  PID:5196
- C:\Windows\System\ofkNWbX.exe
  C:\Windows\System\ofkNWbX.exe
  2⤵
  PID:5212
- C:\Windows\System\stFbLWZ.exe
  C:\Windows\System\stFbLWZ.exe
  2⤵
  PID:5228
- C:\Windows\System\WpTewVW.exe
  C:\Windows\System\WpTewVW.exe
  2⤵
  PID:5244
- C:\Windows\System\ZHWMiKR.exe
  C:\Windows\System\ZHWMiKR.exe
  2⤵
  PID:5260
- C:\Windows\System\XrsRdog.exe
  C:\Windows\System\XrsRdog.exe
  2⤵
  PID:5280
- C:\Windows\System\DdjtsfA.exe
  C:\Windows\System\DdjtsfA.exe
  2⤵
  PID:5296
- C:\Windows\System\rtyniFq.exe
  C:\Windows\System\rtyniFq.exe
  2⤵
  PID:5312
- C:\Windows\System\TNyvOQS.exe
  C:\Windows\System\TNyvOQS.exe
  2⤵
  PID:5328
- C:\Windows\System\VcDaBWo.exe
  C:\Windows\System\VcDaBWo.exe
  2⤵
  PID:5348
- C:\Windows\System\UkbFJjR.exe
  C:\Windows\System\UkbFJjR.exe
  2⤵
  PID:5368
- C:\Windows\System\LjxHMQb.exe
  C:\Windows\System\LjxHMQb.exe
  2⤵
  PID:5384
- C:\Windows\System\huuFbRz.exe
  C:\Windows\System\huuFbRz.exe
  2⤵
  PID:5400
- C:\Windows\System\fRiiwBe.exe
  C:\Windows\System\fRiiwBe.exe
  2⤵
  PID:5416
- C:\Windows\System\ewmNyvc.exe
  C:\Windows\System\ewmNyvc.exe
  2⤵
  PID:5432
- C:\Windows\System\rHZHzZv.exe
  C:\Windows\System\rHZHzZv.exe
  2⤵
  PID:5448
- C:\Windows\System\HYVnJXA.exe
  C:\Windows\System\HYVnJXA.exe
  2⤵
  PID:5584
- C:\Windows\System\TpNaxVE.exe
  C:\Windows\System\TpNaxVE.exe
  2⤵
  PID:5604
- C:\Windows\System\xihUwpQ.exe
  C:\Windows\System\xihUwpQ.exe
  2⤵
  PID:5620
- C:\Windows\System\REiDJso.exe
  C:\Windows\System\REiDJso.exe
  2⤵
  PID:5636
- C:\Windows\System\HzXcOAY.exe
  C:\Windows\System\HzXcOAY.exe
  2⤵
  PID:5652
- C:\Windows\System\CuTfdDh.exe
  C:\Windows\System\CuTfdDh.exe
  2⤵
  PID:5668
- C:\Windows\System\osxIBVr.exe
  C:\Windows\System\osxIBVr.exe
  2⤵
  PID:5684
- C:\Windows\System\TbPSrPQ.exe
  C:\Windows\System\TbPSrPQ.exe
  2⤵
  PID:5700
- C:\Windows\System\njUHaZe.exe
  C:\Windows\System\njUHaZe.exe
  2⤵
  PID:5716
- C:\Windows\System\ZgideFy.exe
  C:\Windows\System\ZgideFy.exe
  2⤵
  PID:5732
- C:\Windows\System\DeARkUu.exe
  C:\Windows\System\DeARkUu.exe
  2⤵
  PID:5748
- C:\Windows\System\PgCazlh.exe
  C:\Windows\System\PgCazlh.exe
  2⤵
  PID:5764
- C:\Windows\System\kOfVnmH.exe
  C:\Windows\System\kOfVnmH.exe
  2⤵
  PID:5780
- C:\Windows\System\adYTUGH.exe
  C:\Windows\System\adYTUGH.exe
  2⤵
  PID:5796
- C:\Windows\System\ZaHUjdC.exe
  C:\Windows\System\ZaHUjdC.exe
  2⤵
  PID:5812
- C:\Windows\System\mHUhXjS.exe
  C:\Windows\System\mHUhXjS.exe
  2⤵
  PID:5828
- C:\Windows\System\BUqcTIy.exe
  C:\Windows\System\BUqcTIy.exe
  2⤵
  PID:5848
- C:\Windows\System\AMjDJgp.exe
  C:\Windows\System\AMjDJgp.exe
  2⤵
  PID:5864
- C:\Windows\System\aDenKBB.exe
  C:\Windows\System\aDenKBB.exe
  2⤵
  PID:6052
- C:\Windows\System\UQTSxQr.exe
  C:\Windows\System\UQTSxQr.exe
  2⤵
  PID:6068
- C:\Windows\System\cKgZsOi.exe
  C:\Windows\System\cKgZsOi.exe
  2⤵
  PID:6084
- C:\Windows\System\nyojqzK.exe
  C:\Windows\System\nyojqzK.exe
  2⤵
  PID:6100
- C:\Windows\System\kPUFPHX.exe
  C:\Windows\System\kPUFPHX.exe
  2⤵
  PID:6124
- C:\Windows\System\xaRlXEe.exe
  C:\Windows\System\xaRlXEe.exe
  2⤵
  PID:5092
- C:\Windows\System\XfvqLFt.exe
  C:\Windows\System\XfvqLFt.exe
  2⤵
  PID:4676
- C:\Windows\System\lIjxTTE.exe
  C:\Windows\System\lIjxTTE.exe
  2⤵
  PID:4180
- C:\Windows\System\TluXwEa.exe
  C:\Windows\System\TluXwEa.exe
  2⤵
  PID:1084
- C:\Windows\System\McuPxID.exe
  C:\Windows\System\McuPxID.exe
  2⤵
  PID:5136
- C:\Windows\System\knoAeua.exe
  C:\Windows\System\knoAeua.exe
  2⤵
  PID:5204
- C:\Windows\System\xSSEOnZ.exe
  C:\Windows\System\xSSEOnZ.exe
  2⤵
  PID:5236
- C:\Windows\System\DLnaJzo.exe
  C:\Windows\System\DLnaJzo.exe
  2⤵
  PID:4100
- C:\Windows\System\UzYUWXb.exe
  C:\Windows\System\UzYUWXb.exe
  2⤵
  PID:5252
- C:\Windows\System\fhfTUcg.exe
  C:\Windows\System\fhfTUcg.exe
  2⤵
  PID:5188
- C:\Windows\System\YfFbwvt.exe
  C:\Windows\System\YfFbwvt.exe
  2⤵
  PID:3976
- C:\Windows\System\xwcbOTl.exe
  C:\Windows\System\xwcbOTl.exe
  2⤵
  PID:1620
- C:\Windows\System\ZzLUZDB.exe
  C:\Windows\System\ZzLUZDB.exe
  2⤵
  PID:4784
- C:\Windows\System\jHHwqDC.exe
  C:\Windows\System\jHHwqDC.exe
  2⤵
  PID:4216
- C:\Windows\System\uuWqCBS.exe
  C:\Windows\System\uuWqCBS.exe
  2⤵
  PID:4896
- C:\Windows\System\hiEYlps.exe
  C:\Windows\System\hiEYlps.exe
  2⤵
  PID:3172
- C:\Windows\System\AeZtGcb.exe
  C:\Windows\System\AeZtGcb.exe
  2⤵
  PID:1628
- C:\Windows\System\JqVcBft.exe
  C:\Windows\System\JqVcBft.exe
  2⤵
  PID:5524
- C:\Windows\System\QDCUHFE.exe
  C:\Windows\System\QDCUHFE.exe
  2⤵
  PID:5572
- C:\Windows\System\mzDbElq.exe
  C:\Windows\System\mzDbElq.exe
  2⤵
  PID:5612
- C:\Windows\System\WOeQqAk.exe
  C:\Windows\System\WOeQqAk.exe
  2⤵
  PID:5744
- C:\Windows\System\tRNOBkZ.exe
  C:\Windows\System\tRNOBkZ.exe
  2⤵
  PID:5708
- C:\Windows\System\JzGagSS.exe
  C:\Windows\System\JzGagSS.exe
  2⤵
  PID:5872
- C:\Windows\System\GQOBAnB.exe
  C:\Windows\System\GQOBAnB.exe
  2⤵
  PID:5804
- C:\Windows\System\yqrCkta.exe
  C:\Windows\System\yqrCkta.exe
  2⤵
  PID:1672
- C:\Windows\System\CEJLonl.exe
  C:\Windows\System\CEJLonl.exe
  2⤵
  PID:5728
- C:\Windows\System\WvDeSKV.exe
  C:\Windows\System\WvDeSKV.exe
  2⤵
  PID:5692
- C:\Windows\System\ZNPOkov.exe
  C:\Windows\System\ZNPOkov.exe
  2⤵
  PID:5792
- C:\Windows\System\YAZNLQd.exe
  C:\Windows\System\YAZNLQd.exe
  2⤵
  PID:5860
- C:\Windows\System\rkqvxOh.exe
  C:\Windows\System\rkqvxOh.exe
  2⤵
  PID:5888
- C:\Windows\System\NKyWUds.exe
  C:\Windows\System\NKyWUds.exe
  2⤵
  PID:5912
- C:\Windows\System\OdHPyUW.exe
  C:\Windows\System\OdHPyUW.exe
  2⤵
  PID:5904
- C:\Windows\System\uLleULS.exe
  C:\Windows\System\uLleULS.exe
  2⤵
  PID:5976
- C:\Windows\System\hBVevMD.exe
  C:\Windows\System\hBVevMD.exe
  2⤵
  PID:5984
- C:\Windows\System\pkdDhag.exe
  C:\Windows\System\pkdDhag.exe
  2⤵
  PID:6032
- C:\Windows\System\bGaiKSj.exe
  C:\Windows\System\bGaiKSj.exe
  2⤵
  PID:6048
- C:\Windows\System\lffzHdR.exe
  C:\Windows\System\lffzHdR.exe
  2⤵
  PID:6092
- C:\Windows\System\HOiDwpv.exe
  C:\Windows\System\HOiDwpv.exe
  2⤵
  PID:6112
- C:\Windows\System\gMUDjLu.exe
  C:\Windows\System\gMUDjLu.exe
  2⤵
  PID:6136
- C:\Windows\System\KYPnpwG.exe
  C:\Windows\System\KYPnpwG.exe
  2⤵
  PID:3824
- C:\Windows\System\lXImaeT.exe
  C:\Windows\System\lXImaeT.exe
  2⤵
  PID:1788
- C:\Windows\System\oPdXWJK.exe
  C:\Windows\System\oPdXWJK.exe
  2⤵
  PID:3680
- C:\Windows\System\LNzjjxv.exe
  C:\Windows\System\LNzjjxv.exe
  2⤵
  PID:5220
- C:\Windows\System\LcFyNYS.exe
  C:\Windows\System\LcFyNYS.exe
  2⤵
  PID:5344
- C:\Windows\System\OFIHBFN.exe
  C:\Windows\System\OFIHBFN.exe
  2⤵
  PID:5276
- C:\Windows\System\pdfjQuS.exe
  C:\Windows\System\pdfjQuS.exe
  2⤵
  PID:5288
- C:\Windows\System\pSOczqd.exe
  C:\Windows\System\pSOczqd.exe
  2⤵
  PID:5152
- C:\Windows\System\CxHJMva.exe
  C:\Windows\System\CxHJMva.exe
  2⤵
  PID:3432
- C:\Windows\System\GqmxlzX.exe
  C:\Windows\System\GqmxlzX.exe
  2⤵
  PID:5320
- C:\Windows\System\hwmGqBy.exe
  C:\Windows\System\hwmGqBy.exe
  2⤵
  PID:5336
- C:\Windows\System\LwmZToO.exe
  C:\Windows\System\LwmZToO.exe
  2⤵
  PID:5392
- C:\Windows\System\keFvWyE.exe
  C:\Windows\System\keFvWyE.exe
  2⤵
  PID:5424
- C:\Windows\System\qfkYdYK.exe
  C:\Windows\System\qfkYdYK.exe
  2⤵
  PID:5464
- C:\Windows\System\MrFTwnI.exe
  C:\Windows\System\MrFTwnI.exe
  2⤵
  PID:5476
- C:\Windows\System\nULwZUq.exe
  C:\Windows\System\nULwZUq.exe
  2⤵
  PID:5492
- C:\Windows\System\ccLPgIK.exe
  C:\Windows\System\ccLPgIK.exe
  2⤵
  PID:5508
- C:\Windows\System\ORWluDr.exe
  C:\Windows\System\ORWluDr.exe
  2⤵
  PID:5520
- C:\Windows\System\dZluelR.exe
  C:\Windows\System\dZluelR.exe
  2⤵
  PID:5644
- C:\Windows\System\AXyKGew.exe
  C:\Windows\System\AXyKGew.exe
  2⤵
  PID:5580
- C:\Windows\System\jrpgNrh.exe
  C:\Windows\System\jrpgNrh.exe
  2⤵
  PID:5896
- C:\Windows\System\LInkdph.exe
  C:\Windows\System\LInkdph.exe
  2⤵
  PID:5568
- C:\Windows\System\jndXJwI.exe
  C:\Windows\System\jndXJwI.exe
  2⤵
  PID:5808
- C:\Windows\System\dtCZStX.exe
  C:\Windows\System\dtCZStX.exe
  2⤵
  PID:5944
- C:\Windows\System\aOQcJQm.exe
  C:\Windows\System\aOQcJQm.exe
  2⤵
  PID:5968
- C:\Windows\System\DQwnHHc.exe
  C:\Windows\System\DQwnHHc.exe
  2⤵
  PID:5900
- C:\Windows\System\TxonvPW.exe
  C:\Windows\System\TxonvPW.exe
  2⤵
  PID:5932
- C:\Windows\System\LdmNVtf.exe
  C:\Windows\System\LdmNVtf.exe
  2⤵
  PID:5964
- C:\Windows\System\UYERIiD.exe
  C:\Windows\System\UYERIiD.exe
  2⤵
  PID:6020
- C:\Windows\System\lMvcIwV.exe
  C:\Windows\System\lMvcIwV.exe
  2⤵
  PID:6044
- C:\Windows\System\VyQTfGy.exe
  C:\Windows\System\VyQTfGy.exe
  2⤵
  PID:6140
- C:\Windows\System\oHHeDvw.exe
  C:\Windows\System\oHHeDvw.exe
  2⤵
  PID:3340
- C:\Windows\System\HstQCOk.exe
  C:\Windows\System\HstQCOk.exe
  2⤵
  PID:5008
- C:\Windows\System\XYOboLv.exe
  C:\Windows\System\XYOboLv.exe
  2⤵
  PID:5412
- C:\Windows\System\xEDZbDv.exe
  C:\Windows\System\xEDZbDv.exe
  2⤵
  PID:5468
- C:\Windows\System\gLOByrp.exe
  C:\Windows\System\gLOByrp.exe
  2⤵
  PID:5380
- C:\Windows\System\iqgboIg.exe
  C:\Windows\System\iqgboIg.exe
  2⤵
  PID:4656
- C:\Windows\System\AEuYgWx.exe
  C:\Windows\System\AEuYgWx.exe
  2⤵
  PID:4796
- C:\Windows\System\dGtPieb.exe
  C:\Windows\System\dGtPieb.exe
  2⤵
  PID:5500
- C:\Windows\System\lKCgCMv.exe
  C:\Windows\System\lKCgCMv.exe
  2⤵
  PID:5532
- C:\Windows\System\GpfjQbg.exe
  C:\Windows\System\GpfjQbg.exe
  2⤵
  PID:5560
- C:\Windows\System\fcRnxQk.exe
  C:\Windows\System\fcRnxQk.exe
  2⤵
  PID:5268
- C:\Windows\System\xNGPYig.exe
  C:\Windows\System\xNGPYig.exe
  2⤵
  PID:5632
- C:\Windows\System\SgGjOnj.exe
  C:\Windows\System\SgGjOnj.exe
  2⤵
  PID:5940
- C:\Windows\System\xQndVyY.exe
  C:\Windows\System\xQndVyY.exe
  2⤵
  PID:6016
- C:\Windows\System\fIgLEPC.exe
  C:\Windows\System\fIgLEPC.exe
  2⤵
  PID:4428
- C:\Windows\System\FAUqbZD.exe
  C:\Windows\System\FAUqbZD.exe
  2⤵
  PID:5760
- C:\Windows\System\YkobEms.exe
  C:\Windows\System\YkobEms.exe
  2⤵
  PID:4408
- C:\Windows\System\SmgarwL.exe
  C:\Windows\System\SmgarwL.exe
  2⤵
  PID:5444
- C:\Windows\System\kucumsS.exe
  C:\Windows\System\kucumsS.exe
  2⤵
  PID:6040
- C:\Windows\System\rFkDAiu.exe
  C:\Windows\System\rFkDAiu.exe
  2⤵
  PID:5936
- C:\Windows\System\ylFGPNZ.exe
  C:\Windows\System\ylFGPNZ.exe
  2⤵
  PID:5596
- C:\Windows\System\FRDlIgB.exe
  C:\Windows\System\FRDlIgB.exe
  2⤵
  PID:6132
- C:\Windows\System\xArvZay.exe
  C:\Windows\System\xArvZay.exe
  2⤵
  PID:5628
- C:\Windows\System\fSlhRyv.exe
  C:\Windows\System\fSlhRyv.exe
  2⤵
  PID:5980
- C:\Windows\System\LZhWtAj.exe
  C:\Windows\System\LZhWtAj.exe
  2⤵
  PID:5724
- C:\Windows\System\ALGIAIO.exe
  C:\Windows\System\ALGIAIO.exe
  2⤵
  PID:6076
- C:\Windows\System\RAsOsLc.exe
  C:\Windows\System\RAsOsLc.exe
  2⤵
  PID:6064
- C:\Windows\System\bqwrCRc.exe
  C:\Windows\System\bqwrCRc.exe
  2⤵
  PID:4816
- C:\Windows\System\XrpvOVy.exe
  C:\Windows\System\XrpvOVy.exe
  2⤵
  PID:5480
- C:\Windows\System\iLHUdow.exe
  C:\Windows\System\iLHUdow.exe
  2⤵
  PID:6148
- C:\Windows\System\gJwOmdU.exe
  C:\Windows\System\gJwOmdU.exe
  2⤵
  PID:6164
- C:\Windows\System\TMRokxM.exe
  C:\Windows\System\TMRokxM.exe
  2⤵
  PID:6180
- C:\Windows\System\FXwJIde.exe
  C:\Windows\System\FXwJIde.exe
  2⤵
  PID:6196
- C:\Windows\System\LVaIBgI.exe
  C:\Windows\System\LVaIBgI.exe
  2⤵
  PID:6212
- C:\Windows\System\bTplfNH.exe
  C:\Windows\System\bTplfNH.exe
  2⤵
  PID:6228
- C:\Windows\System\lpuTSRv.exe
  C:\Windows\System\lpuTSRv.exe
  2⤵
  PID:6244
- C:\Windows\System\KkjupsM.exe
  C:\Windows\System\KkjupsM.exe
  2⤵
  PID:6336
- C:\Windows\System\YlyaMhv.exe
  C:\Windows\System\YlyaMhv.exe
  2⤵
  PID:6352
- C:\Windows\System\yrRiRhM.exe
  C:\Windows\System\yrRiRhM.exe
  2⤵
  PID:6368
- C:\Windows\System\YUxGRMe.exe
  C:\Windows\System\YUxGRMe.exe
  2⤵
  PID:6384
- C:\Windows\System\ExiNXaw.exe
  C:\Windows\System\ExiNXaw.exe
  2⤵
  PID:6404
- C:\Windows\System\mDBSPQz.exe
  C:\Windows\System\mDBSPQz.exe
  2⤵
  PID:6420
- C:\Windows\System\mMLFBYC.exe
  C:\Windows\System\mMLFBYC.exe
  2⤵
  PID:6436
- C:\Windows\System\fouurzl.exe
  C:\Windows\System\fouurzl.exe
  2⤵
  PID:6456
- C:\Windows\System\ryMXUUk.exe
  C:\Windows\System\ryMXUUk.exe
  2⤵
  PID:6472
- C:\Windows\System\xFkSxdi.exe
  C:\Windows\System\xFkSxdi.exe
  2⤵
  PID:6488
- C:\Windows\System\GwGpvzZ.exe
  C:\Windows\System\GwGpvzZ.exe
  2⤵
  PID:6504
- C:\Windows\System\PtHsmMm.exe
  C:\Windows\System\PtHsmMm.exe
  2⤵
  PID:6520
- C:\Windows\System\QmjNxzs.exe
  C:\Windows\System\QmjNxzs.exe
  2⤵
  PID:6536
- C:\Windows\System\NjGAlPz.exe
  C:\Windows\System\NjGAlPz.exe
  2⤵
  PID:6552
- C:\Windows\System\KOpRscb.exe
  C:\Windows\System\KOpRscb.exe
  2⤵
  PID:6568
- C:\Windows\System\inFhHxU.exe
  C:\Windows\System\inFhHxU.exe
  2⤵
  PID:6584
- C:\Windows\System\DAPWTxI.exe
  C:\Windows\System\DAPWTxI.exe
  2⤵
  PID:6600
- C:\Windows\System\oLZBhgX.exe
  C:\Windows\System\oLZBhgX.exe
  2⤵
  PID:6616
- C:\Windows\System\pZZxylI.exe
  C:\Windows\System\pZZxylI.exe
  2⤵
  PID:6632
- C:\Windows\System\YKhMHak.exe
  C:\Windows\System\YKhMHak.exe
  2⤵
  PID:6652
- C:\Windows\System\cMiVQtY.exe
  C:\Windows\System\cMiVQtY.exe
  2⤵
  PID:6668
- C:\Windows\System\LXLyvEq.exe
  C:\Windows\System\LXLyvEq.exe
  2⤵
  PID:6684
- C:\Windows\System\GdYxAoA.exe
  C:\Windows\System\GdYxAoA.exe
  2⤵
  PID:6700
- C:\Windows\System\XPijpsK.exe
  C:\Windows\System\XPijpsK.exe
  2⤵
  PID:6716
- C:\Windows\System\iEUgYym.exe
  C:\Windows\System\iEUgYym.exe
  2⤵
  PID:6736
- C:\Windows\System\VQzDuuc.exe
  C:\Windows\System\VQzDuuc.exe
  2⤵
  PID:6752
- C:\Windows\System\EdYxvst.exe
  C:\Windows\System\EdYxvst.exe
  2⤵
  PID:6768
- C:\Windows\System\NTWOgOM.exe
  C:\Windows\System\NTWOgOM.exe
  2⤵
  PID:6784
- C:\Windows\System\LgaFnlD.exe
  C:\Windows\System\LgaFnlD.exe
  2⤵
  PID:6800
- C:\Windows\System\uLuLskq.exe
  C:\Windows\System\uLuLskq.exe
  2⤵
  PID:6816
- C:\Windows\System\TeVDMAu.exe
  C:\Windows\System\TeVDMAu.exe
  2⤵
  PID:6832
- C:\Windows\System\yqZQbwG.exe
  C:\Windows\System\yqZQbwG.exe
  2⤵
  PID:6848
- C:\Windows\System\FsmmkWv.exe
  C:\Windows\System\FsmmkWv.exe
  2⤵
  PID:6864
- C:\Windows\System\krqxwqz.exe
  C:\Windows\System\krqxwqz.exe
  2⤵
  PID:6896
- C:\Windows\System\NrNBaUa.exe
  C:\Windows\System\NrNBaUa.exe
  2⤵
  PID:6912
- C:\Windows\System\aeRMKiK.exe
  C:\Windows\System\aeRMKiK.exe
  2⤵
  PID:6928
- C:\Windows\System\UBnoTlD.exe
  C:\Windows\System\UBnoTlD.exe
  2⤵
  PID:6944
- C:\Windows\System\xSElYgZ.exe
  C:\Windows\System\xSElYgZ.exe
  2⤵
  PID:6964
- C:\Windows\System\vuWlanl.exe
  C:\Windows\System\vuWlanl.exe
  2⤵
  PID:7004
- C:\Windows\System\JvpPsTH.exe
  C:\Windows\System\JvpPsTH.exe
  2⤵
  PID:7020
- C:\Windows\System\PmqpdIf.exe
  C:\Windows\System\PmqpdIf.exe
  2⤵
  PID:7036
- C:\Windows\System\EZURooZ.exe
  C:\Windows\System\EZURooZ.exe
  2⤵
  PID:7052
- C:\Windows\System\ifBZeSt.exe
  C:\Windows\System\ifBZeSt.exe
  2⤵
  PID:7068
- C:\Windows\System\XhxkRuN.exe
  C:\Windows\System\XhxkRuN.exe
  2⤵
  PID:7084
- C:\Windows\System\voqZrwu.exe
  C:\Windows\System\voqZrwu.exe
  2⤵
  PID:7100
- C:\Windows\System\UepLmgz.exe
  C:\Windows\System\UepLmgz.exe
  2⤵
  PID:7116
- C:\Windows\System\OdVrTjC.exe
  C:\Windows\System\OdVrTjC.exe
  2⤵
  PID:5928
- C:\Windows\System\zDhgWSr.exe
  C:\Windows\System\zDhgWSr.exe
  2⤵
  PID:5880
- C:\Windows\System\YIuMkLa.exe
  C:\Windows\System\YIuMkLa.exe
  2⤵
  PID:6160
- C:\Windows\System\SZkIpNJ.exe
  C:\Windows\System\SZkIpNJ.exe
  2⤵
  PID:6252
- C:\Windows\System\XHHzjwb.exe
  C:\Windows\System\XHHzjwb.exe
  2⤵
  PID:6276
- C:\Windows\System\mxfdANB.exe
  C:\Windows\System\mxfdANB.exe
  2⤵
  PID:6268
- C:\Windows\System\CUNEwIR.exe
  C:\Windows\System\CUNEwIR.exe
  2⤵
  PID:6312
- C:\Windows\System\EGxbmMS.exe
  C:\Windows\System\EGxbmMS.exe
  2⤵
  PID:6444
- C:\Windows\System\XZIqPdL.exe
  C:\Windows\System\XZIqPdL.exe
  2⤵
  PID:6416
- C:\Windows\System\RWMUzIL.exe
  C:\Windows\System\RWMUzIL.exe
  2⤵
  PID:6544
- C:\Windows\System\knNVTYc.exe
  C:\Windows\System\knNVTYc.exe
  2⤵
  PID:6608
- C:\Windows\System\pBciGqQ.exe
  C:\Windows\System\pBciGqQ.exe
  2⤵
  PID:6612
- C:\Windows\System\upUEWRk.exe
  C:\Windows\System\upUEWRk.exe
  2⤵
  PID:6324
- C:\Windows\System\drnAhJa.exe
  C:\Windows\System\drnAhJa.exe
  2⤵
  PID:6392
- C:\Windows\System\CFxYTao.exe
  C:\Windows\System\CFxYTao.exe
  2⤵
  PID:6432
- C:\Windows\System\bhgnIlE.exe
  C:\Windows\System\bhgnIlE.exe
  2⤵
  PID:6680
- C:\Windows\System\ZmzhyhK.exe
  C:\Windows\System\ZmzhyhK.exe
  2⤵
  PID:6660
- C:\Windows\System\bfwckPk.exe
  C:\Windows\System\bfwckPk.exe
  2⤵
  PID:6724
- C:\Windows\System\WwLwjsK.exe
  C:\Windows\System\WwLwjsK.exe
  2⤵
  PID:6792
- C:\Windows\System\uqANFUX.exe
  C:\Windows\System\uqANFUX.exe
  2⤵
  PID:6856
- C:\Windows\System\sedXmpn.exe
  C:\Windows\System\sedXmpn.exe
  2⤵
  PID:6844
- C:\Windows\System\eRvLHxj.exe
  C:\Windows\System\eRvLHxj.exe
  2⤵
  PID:6876
- C:\Windows\System\QhwOmsS.exe
  C:\Windows\System\QhwOmsS.exe
  2⤵
  PID:6892
- C:\Windows\System\YfTdWVF.exe
  C:\Windows\System\YfTdWVF.exe
  2⤵
  PID:6980
- C:\Windows\System\Cugunoc.exe
  C:\Windows\System\Cugunoc.exe
  2⤵
  PID:6996
- C:\Windows\System\tELOvGT.exe
  C:\Windows\System\tELOvGT.exe
  2⤵
  PID:7096
- C:\Windows\System\BNKwBnf.exe
  C:\Windows\System\BNKwBnf.exe
  2⤵
  PID:7140
- C:\Windows\System\rwXeTPT.exe
  C:\Windows\System\rwXeTPT.exe
  2⤵
  PID:7156
- C:\Windows\System\YyrMVed.exe
  C:\Windows\System\YyrMVed.exe
  2⤵
  PID:4856
- C:\Windows\System\YNkHIYV.exe
  C:\Windows\System\YNkHIYV.exe
  2⤵
  PID:6208
- C:\Windows\System\FYJvKcd.exe
  C:\Windows\System\FYJvKcd.exe
  2⤵
  PID:6156
- C:\Windows\System\EkULLZZ.exe
  C:\Windows\System\EkULLZZ.exe
  2⤵
  PID:6264
- C:\Windows\System\eQFvzOH.exe
  C:\Windows\System\eQFvzOH.exe
  2⤵
  PID:6288
- C:\Windows\System\OYGkqhe.exe
  C:\Windows\System\OYGkqhe.exe
  2⤵
  PID:6648
- C:\Windows\System\YWEicnl.exe
  C:\Windows\System\YWEicnl.exe
  2⤵
  PID:6644
- C:\Windows\System\ZzDLEOt.exe
  C:\Windows\System\ZzDLEOt.exe
  2⤵
  PID:6712
- C:\Windows\System\ExrNaVA.exe
  C:\Windows\System\ExrNaVA.exe
  2⤵
  PID:6560
- C:\Windows\System\UqFXVnt.exe
  C:\Windows\System\UqFXVnt.exe
  2⤵
  PID:6512
- C:\Windows\System\eGSAUaP.exe
  C:\Windows\System\eGSAUaP.exe
  2⤵
  PID:6676
- C:\Windows\System\WhsvFoL.exe
  C:\Windows\System\WhsvFoL.exe
  2⤵
  PID:6224
- C:\Windows\System\NOxfwfg.exe
  C:\Windows\System\NOxfwfg.exe
  2⤵
  PID:6376
- C:\Windows\System\nhNFlRl.exe
  C:\Windows\System\nhNFlRl.exe
  2⤵
  PID:6696
- C:\Windows\System\wtpWLbg.exe
  C:\Windows\System\wtpWLbg.exe
  2⤵
  PID:6760
- C:\Windows\System\uqfCKUL.exe
  C:\Windows\System\uqfCKUL.exe
  2⤵
  PID:6828
- C:\Windows\System\NrbXarS.exe
  C:\Windows\System\NrbXarS.exe
  2⤵
  PID:6920
- C:\Windows\System\mFMThBC.exe
  C:\Windows\System\mFMThBC.exe
  2⤵
  PID:6908
- C:\Windows\System\WcVMCoN.exe
  C:\Windows\System\WcVMCoN.exe
  2⤵
  PID:6976
- C:\Windows\System\PvWGBuw.exe
  C:\Windows\System\PvWGBuw.exe
  2⤵
  PID:7016
- C:\Windows\System\QzugKfF.exe
  C:\Windows\System\QzugKfF.exe
  2⤵
  PID:6776
- C:\Windows\System\LsfnGqo.exe
  C:\Windows\System\LsfnGqo.exe
  2⤵
  PID:7076
- C:\Windows\System\RPiZKld.exe
  C:\Windows\System\RPiZKld.exe
  2⤵
  PID:7064
- C:\Windows\System\uzZHHBU.exe
  C:\Windows\System\uzZHHBU.exe
  2⤵
  PID:7148
- C:\Windows\System\oAOiphQ.exe
  C:\Windows\System\oAOiphQ.exe
  2⤵
  PID:6204
- C:\Windows\System\xcsRxdF.exe
  C:\Windows\System\xcsRxdF.exe
  2⤵
  PID:6296
- C:\Windows\System\IIdAPon.exe
  C:\Windows\System\IIdAPon.exe
  2⤵
  PID:6412
- C:\Windows\System\HNxODlb.exe
  C:\Windows\System\HNxODlb.exe
  2⤵
  PID:6320
- C:\Windows\System\XopIVrU.exe
  C:\Windows\System\XopIVrU.exe
  2⤵
  PID:6744
- C:\Windows\System\BAwETVJ.exe
  C:\Windows\System\BAwETVJ.exe
  2⤵
  PID:6904
- C:\Windows\System\TqRlgcN.exe
  C:\Windows\System\TqRlgcN.exe
  2⤵
  PID:6256
- C:\Windows\System\QuaJQMm.exe
  C:\Windows\System\QuaJQMm.exe
  2⤵
  PID:7136
- C:\Windows\System\QcaFhxB.exe
  C:\Windows\System\QcaFhxB.exe
  2⤵
  PID:7080
- C:\Windows\System\jgyBjSN.exe
  C:\Windows\System\jgyBjSN.exe
  2⤵
  PID:6364
- C:\Windows\System\ekenkES.exe
  C:\Windows\System\ekenkES.exe
  2⤵
  PID:6780
- C:\Windows\System\dnUSCgH.exe
  C:\Windows\System\dnUSCgH.exe
  2⤵
  PID:6884
- C:\Windows\System\VkUZZhJ.exe
  C:\Windows\System\VkUZZhJ.exe
  2⤵
  PID:5908
- C:\Windows\System\czKdycG.exe
  C:\Windows\System\czKdycG.exe
  2⤵
  PID:5308
- C:\Windows\System\IRGNixD.exe
  C:\Windows\System\IRGNixD.exe
  2⤵
  PID:6400
- C:\Windows\System\zByEhMY.exe
  C:\Windows\System\zByEhMY.exe
  2⤵
  PID:7108
- C:\Windows\System\wnHiKeO.exe
  C:\Windows\System\wnHiKeO.exe
  2⤵
  PID:6428
- C:\Windows\System\SGgksYZ.exe
  C:\Windows\System\SGgksYZ.exe
  2⤵
  PID:6936
- C:\Windows\System\AiKKlSu.exe
  C:\Windows\System\AiKKlSu.exe
  2⤵
  PID:7112
- C:\Windows\System\SLiJpEY.exe
  C:\Windows\System\SLiJpEY.exe
  2⤵
  PID:5776
- C:\Windows\System\iWeTQlo.exe
  C:\Windows\System\iWeTQlo.exe
  2⤵
  PID:7032
- C:\Windows\System\LBiyzsu.exe
  C:\Windows\System\LBiyzsu.exe
  2⤵
  PID:6360
- C:\Windows\System\aQgGknQ.exe
  C:\Windows\System\aQgGknQ.exe
  2⤵
  PID:6344
- C:\Windows\System\ItnRSbr.exe
  C:\Windows\System\ItnRSbr.exe
  2⤵
  PID:6732
- C:\Windows\System\mfjAVkG.exe
  C:\Windows\System\mfjAVkG.exe
  2⤵
  PID:6004
- C:\Windows\System\qYtrHwp.exe
  C:\Windows\System\qYtrHwp.exe
  2⤵
  PID:6500
- C:\Windows\System\bfHAcYp.exe
  C:\Windows\System\bfHAcYp.exe
  2⤵
  PID:6596
- C:\Windows\System\pCywnkR.exe
  C:\Windows\System\pCywnkR.exe
  2⤵
  PID:7172
- C:\Windows\System\TVCSHfD.exe
  C:\Windows\System\TVCSHfD.exe
  2⤵
  PID:7188
- C:\Windows\System\UpvhnOb.exe
  C:\Windows\System\UpvhnOb.exe
  2⤵
  PID:7204
- C:\Windows\System\FZCMVSd.exe
  C:\Windows\System\FZCMVSd.exe
  2⤵
  PID:7224
- C:\Windows\System\IacCVJC.exe
  C:\Windows\System\IacCVJC.exe
  2⤵
  PID:7240
- C:\Windows\System\AQgCzhY.exe
  C:\Windows\System\AQgCzhY.exe
  2⤵
  PID:7256
- C:\Windows\System\yTciVmN.exe
  C:\Windows\System\yTciVmN.exe
  2⤵
  PID:7272
- C:\Windows\System\LcOpaMf.exe
  C:\Windows\System\LcOpaMf.exe
  2⤵
  PID:7288
- C:\Windows\System\JkHzdyD.exe
  C:\Windows\System\JkHzdyD.exe
  2⤵
  PID:7304
- C:\Windows\System\qcTfHcx.exe
  C:\Windows\System\qcTfHcx.exe
  2⤵
  PID:7320
- C:\Windows\System\cMULtLx.exe
  C:\Windows\System\cMULtLx.exe
  2⤵
  PID:7336
- C:\Windows\System\JSKQalq.exe
  C:\Windows\System\JSKQalq.exe
  2⤵
  PID:7352
- C:\Windows\System\YTwyLmj.exe
  C:\Windows\System\YTwyLmj.exe
  2⤵
  PID:7368
- C:\Windows\System\JKDlgQB.exe
  C:\Windows\System\JKDlgQB.exe
  2⤵
  PID:7384
- C:\Windows\System\jvApSMp.exe
  C:\Windows\System\jvApSMp.exe
  2⤵
  PID:7400
- C:\Windows\System\aqzGiCV.exe
  C:\Windows\System\aqzGiCV.exe
  2⤵
  PID:7416
- C:\Windows\System\uiRmgnI.exe
  C:\Windows\System\uiRmgnI.exe
  2⤵
  PID:7432
- C:\Windows\System\CkmBxPa.exe
  C:\Windows\System\CkmBxPa.exe
  2⤵
  PID:7448
- C:\Windows\System\jJVUXsT.exe
  C:\Windows\System\jJVUXsT.exe
  2⤵
  PID:7464
- C:\Windows\System\UmwEdRE.exe
  C:\Windows\System\UmwEdRE.exe
  2⤵
  PID:7480
- C:\Windows\System\eOKRRGG.exe
  C:\Windows\System\eOKRRGG.exe
  2⤵
  PID:7496
- C:\Windows\System\OhcnnMt.exe
  C:\Windows\System\OhcnnMt.exe
  2⤵
  PID:7512
- C:\Windows\System\ZkkirIc.exe
  C:\Windows\System\ZkkirIc.exe
  2⤵
  PID:7528
- C:\Windows\System\cAIlmtK.exe
  C:\Windows\System\cAIlmtK.exe
  2⤵
  PID:7544
- C:\Windows\System\vlFmMzF.exe
  C:\Windows\System\vlFmMzF.exe
  2⤵
  PID:7560
- C:\Windows\System\kGjSGnX.exe
  C:\Windows\System\kGjSGnX.exe
  2⤵
  PID:7576
- C:\Windows\System\MrJfnlH.exe
  C:\Windows\System\MrJfnlH.exe
  2⤵
  PID:7592
- C:\Windows\System\QMCumbe.exe
  C:\Windows\System\QMCumbe.exe
  2⤵
  PID:7608
- C:\Windows\System\LtEdFzu.exe
  C:\Windows\System\LtEdFzu.exe
  2⤵
  PID:7624
- C:\Windows\System\wDahevQ.exe
  C:\Windows\System\wDahevQ.exe
  2⤵
  PID:7640
- C:\Windows\System\OdZjGQq.exe
  C:\Windows\System\OdZjGQq.exe
  2⤵
  PID:7656
- C:\Windows\System\qDGUaVW.exe
  C:\Windows\System\qDGUaVW.exe
  2⤵
  PID:7672
- C:\Windows\System\CdRDvEH.exe
  C:\Windows\System\CdRDvEH.exe
  2⤵
  PID:7688
- C:\Windows\System\YcvlvMe.exe
  C:\Windows\System\YcvlvMe.exe
  2⤵
  PID:7704
- C:\Windows\System\JmuLvyJ.exe
  C:\Windows\System\JmuLvyJ.exe
  2⤵
  PID:7720
- C:\Windows\System\CPwDkIV.exe
  C:\Windows\System\CPwDkIV.exe
  2⤵
  PID:7736
- C:\Windows\System\AHJyjvR.exe
  C:\Windows\System\AHJyjvR.exe
  2⤵
  PID:7752
- C:\Windows\System\BGbAbrs.exe
  C:\Windows\System\BGbAbrs.exe
  2⤵
  PID:7768
- C:\Windows\System\GvrnRcW.exe
  C:\Windows\System\GvrnRcW.exe
  2⤵
  PID:7784
- C:\Windows\System\rfEkhMV.exe
  C:\Windows\System\rfEkhMV.exe
  2⤵
  PID:7800
- C:\Windows\System\CdhVSti.exe
  C:\Windows\System\CdhVSti.exe
  2⤵
  PID:7816
- C:\Windows\System\zlsHicb.exe
  C:\Windows\System\zlsHicb.exe
  2⤵
  PID:7832
- C:\Windows\System\JGcpUZy.exe
  C:\Windows\System\JGcpUZy.exe
  2⤵
  PID:7848
- C:\Windows\System\EkAcXtD.exe
  C:\Windows\System\EkAcXtD.exe
  2⤵
  PID:7864
- C:\Windows\System\jWaRXaV.exe
  C:\Windows\System\jWaRXaV.exe
  2⤵
  PID:7880
- C:\Windows\System\jrhoPnu.exe
  C:\Windows\System\jrhoPnu.exe
  2⤵
  PID:7896
- C:\Windows\System\RcJUqWe.exe
  C:\Windows\System\RcJUqWe.exe
  2⤵
  PID:7912
- C:\Windows\System\ZXDKeBi.exe
  C:\Windows\System\ZXDKeBi.exe
  2⤵
  PID:7928
- C:\Windows\System\zjfbCIR.exe
  C:\Windows\System\zjfbCIR.exe
  2⤵
  PID:7944
- C:\Windows\System\XvszWYI.exe
  C:\Windows\System\XvszWYI.exe
  2⤵
  PID:7960
- C:\Windows\System\UkVTtvd.exe
  C:\Windows\System\UkVTtvd.exe
  2⤵
  PID:7976
- C:\Windows\System\zAtsfOC.exe
  C:\Windows\System\zAtsfOC.exe
  2⤵
  PID:7992
- C:\Windows\System\YEBdnpH.exe
  C:\Windows\System\YEBdnpH.exe
  2⤵
  PID:8008
- C:\Windows\System\WIBMtDt.exe
  C:\Windows\System\WIBMtDt.exe
  2⤵
  PID:8024
- C:\Windows\System\ZVAtIPa.exe
  C:\Windows\System\ZVAtIPa.exe
  2⤵
  PID:8040
- C:\Windows\System\TYcVkGX.exe
  C:\Windows\System\TYcVkGX.exe
  2⤵
  PID:8056
- C:\Windows\System\JmfqXPG.exe
  C:\Windows\System\JmfqXPG.exe
  2⤵
  PID:8072
- C:\Windows\System\KuwZeqg.exe
  C:\Windows\System\KuwZeqg.exe
  2⤵
  PID:8088
- C:\Windows\System\WZZkoro.exe
  C:\Windows\System\WZZkoro.exe
  2⤵
  PID:8104
- C:\Windows\System\fPSZFZV.exe
  C:\Windows\System\fPSZFZV.exe
  2⤵
  PID:8120
- C:\Windows\System\QOmVvdd.exe
  C:\Windows\System\QOmVvdd.exe
  2⤵
  PID:8136
- C:\Windows\System\satitzk.exe
  C:\Windows\System\satitzk.exe
  2⤵
  PID:8152
- C:\Windows\System\VnFscXl.exe
  C:\Windows\System\VnFscXl.exe
  2⤵
  PID:8168
- C:\Windows\System\NkKIjgq.exe
  C:\Windows\System\NkKIjgq.exe
  2⤵
  PID:8184
- C:\Windows\System\lcPgnMf.exe
  C:\Windows\System\lcPgnMf.exe
  2⤵
  PID:6592
- C:\Windows\System\SDuMmHU.exe
  C:\Windows\System\SDuMmHU.exe
  2⤵
  PID:7264
- C:\Windows\System\izzcNal.exe
  C:\Windows\System\izzcNal.exe
  2⤵
  PID:7328
- C:\Windows\System\ukkTLBR.exe
  C:\Windows\System\ukkTLBR.exe
  2⤵
  PID:7392
- C:\Windows\System\WCsvCrt.exe
  C:\Windows\System\WCsvCrt.exe
  2⤵
  PID:7456
- C:\Windows\System\izbQfIu.exe
  C:\Windows\System\izbQfIu.exe
  2⤵
  PID:7460
- C:\Windows\System\wvssjKA.exe
  C:\Windows\System\wvssjKA.exe
  2⤵
  PID:7248
- C:\Windows\System\LTGTFxz.exe
  C:\Windows\System\LTGTFxz.exe
  2⤵
  PID:7280
- C:\Windows\System\HrGXpin.exe
  C:\Windows\System\HrGXpin.exe
  2⤵
  PID:7376
- C:\Windows\System\aNrQxjR.exe
  C:\Windows\System\aNrQxjR.exe
  2⤵
  PID:7348
- C:\Windows\System\ePnNpud.exe
  C:\Windows\System\ePnNpud.exe
  2⤵
  PID:7504
- C:\Windows\System\bVyaTfP.exe
  C:\Windows\System\bVyaTfP.exe
  2⤵
  PID:7668
- C:\Windows\System\lpaLdmu.exe
  C:\Windows\System\lpaLdmu.exe
  2⤵
  PID:7744
- C:\Windows\System\LbymaSn.exe
  C:\Windows\System\LbymaSn.exe
  2⤵
  PID:7808
- C:\Windows\System\QaAyNkb.exe
  C:\Windows\System\QaAyNkb.exe
  2⤵
  PID:7728
- C:\Windows\System\scqBYnE.exe
  C:\Windows\System\scqBYnE.exe
  2⤵
  PID:7696
- C:\Windows\System\NOKrCUF.exe
  C:\Windows\System\NOKrCUF.exe
  2⤵
  PID:7764
- C:\Windows\System\fZMvdVD.exe
  C:\Windows\System\fZMvdVD.exe
  2⤵
  PID:7904
- C:\Windows\System\wdQInMr.exe
  C:\Windows\System\wdQInMr.exe
  2⤵
  PID:7860
- C:\Windows\System\hvfJnqz.exe
  C:\Windows\System\hvfJnqz.exe
  2⤵
  PID:7920
- C:\Windows\System\PhxUgzy.exe
  C:\Windows\System\PhxUgzy.exe
  2⤵
  PID:8000
- C:\Windows\System\ZwRYcjH.exe
  C:\Windows\System\ZwRYcjH.exe
  2⤵
  PID:7952
- C:\Windows\System\BsWylIL.exe
  C:\Windows\System\BsWylIL.exe
  2⤵
  PID:8032
- C:\Windows\System\DBLufGw.exe
  C:\Windows\System\DBLufGw.exe
  2⤵
  PID:8096
- C:\Windows\System\qWGEmqc.exe
  C:\Windows\System\qWGEmqc.exe
  2⤵
  PID:8128
- C:\Windows\System\LyOCKlc.exe
  C:\Windows\System\LyOCKlc.exe
  2⤵
  PID:8080
- C:\Windows\System\scuCMWg.exe
  C:\Windows\System\scuCMWg.exe
  2⤵
  PID:8164
- C:\Windows\System\JoxBVfV.exe
  C:\Windows\System\JoxBVfV.exe
  2⤵
  PID:7200
- C:\Windows\System\dzGhZws.exe
  C:\Windows\System\dzGhZws.exe
  2⤵
  PID:7300
- C:\Windows\System\pNQZZhX.exe
  C:\Windows\System\pNQZZhX.exe
  2⤵
  PID:7428
- C:\Windows\System\rWRBAju.exe
  C:\Windows\System\rWRBAju.exe
  2⤵
  PID:7488
- C:\Windows\System\ZeQoUXy.exe
  C:\Windows\System\ZeQoUXy.exe
  2⤵
  PID:6308
- C:\Windows\System\rUvyphI.exe
  C:\Windows\System\rUvyphI.exe
  2⤵
  PID:7316
- C:\Windows\System\ooWypaD.exe
  C:\Windows\System\ooWypaD.exe
  2⤵
  PID:7408
- C:\Windows\System\zHffSXp.exe
  C:\Windows\System\zHffSXp.exe
  2⤵
  PID:7552
- C:\Windows\System\SdmnWyi.exe
  C:\Windows\System\SdmnWyi.exe
  2⤵
  PID:7568
- C:\Windows\System\nDytiJV.exe
  C:\Windows\System\nDytiJV.exe
  2⤵
  PID:1568
- C:\Windows\System\YSviWYY.exe
  C:\Windows\System\YSviWYY.exe
  2⤵
  PID:7924
- C:\Windows\System\NEINRmr.exe
  C:\Windows\System\NEINRmr.exe
  2⤵
  PID:8144
- C:\Windows\System\jOIegST.exe
  C:\Windows\System\jOIegST.exe
  2⤵
  PID:7312
- C:\Windows\System\UrEOyxr.exe
  C:\Windows\System\UrEOyxr.exe
  2⤵
  PID:7872
- C:\Windows\System\LucnhYA.exe
  C:\Windows\System\LucnhYA.exe
  2⤵
  PID:8176
- C:\Windows\System\WPyTbyu.exe
  C:\Windows\System\WPyTbyu.exe
  2⤵
  PID:7792
- C:\Windows\System\jsBBKxP.exe
  C:\Windows\System\jsBBKxP.exe
  2⤵
  PID:7892
- C:\Windows\System\LOmGYpw.exe
  C:\Windows\System\LOmGYpw.exe
  2⤵
  PID:7424
- C:\Windows\System\NDgCSEw.exe
  C:\Windows\System\NDgCSEw.exe
  2⤵
  PID:7604
- C:\Windows\System\hSMvsNQ.exe
  C:\Windows\System\hSMvsNQ.exe
  2⤵
  PID:7632
- C:\Windows\System\dXNqvUd.exe
  C:\Windows\System\dXNqvUd.exe
  2⤵
  PID:7716
- C:\Windows\System\sPBotXE.exe
  C:\Windows\System\sPBotXE.exe
  2⤵
  PID:7760
- C:\Windows\System\BJgGtFZ.exe
  C:\Windows\System\BJgGtFZ.exe
  2⤵
  PID:7888
- C:\Windows\System\JYVGxQD.exe
  C:\Windows\System\JYVGxQD.exe
  2⤵
  PID:7936
- C:\Windows\System\jkUWAsm.exe
  C:\Windows\System\jkUWAsm.exe
  2⤵
  PID:7492
- C:\Windows\System\WmCzzvp.exe
  C:\Windows\System\WmCzzvp.exe
  2⤵
  PID:8160
- C:\Windows\System\rYnUcUG.exe
  C:\Windows\System\rYnUcUG.exe
  2⤵
  PID:7184
- C:\Windows\System\lNcFUtY.exe
  C:\Windows\System\lNcFUtY.exe
  2⤵
  PID:8112
- C:\Windows\System\NpkYubu.exe
  C:\Windows\System\NpkYubu.exe
  2⤵
  PID:7216
- C:\Windows\System\IiaZCGG.exe
  C:\Windows\System\IiaZCGG.exe
  2⤵
  PID:7828
- C:\Windows\System\hSEXbIQ.exe
  C:\Windows\System\hSEXbIQ.exe
  2⤵
  PID:7824
- C:\Windows\System\AQhzjfd.exe
  C:\Windows\System\AQhzjfd.exe
  2⤵
  PID:7988
- C:\Windows\System\aYzbuTv.exe
  C:\Windows\System\aYzbuTv.exe
  2⤵
  PID:7444
- C:\Windows\System\rZLZzlu.exe
  C:\Windows\System\rZLZzlu.exe
  2⤵
  PID:7984
- C:\Windows\System\VKWAoGw.exe
  C:\Windows\System\VKWAoGw.exe
  2⤵
  PID:8132
- C:\Windows\System\BLRzJdq.exe
  C:\Windows\System\BLRzJdq.exe
  2⤵
  PID:8204
- C:\Windows\System\alKglBp.exe
  C:\Windows\System\alKglBp.exe
  2⤵
  PID:8220
- C:\Windows\System\zcfPjXu.exe
  C:\Windows\System\zcfPjXu.exe
  2⤵
  PID:8368
- C:\Windows\System\oFDOwMh.exe
  C:\Windows\System\oFDOwMh.exe
  2⤵
  PID:8388
- C:\Windows\System\QoYWpNL.exe
  C:\Windows\System\QoYWpNL.exe
  2⤵
  PID:8408
- C:\Windows\System\wJSVCvW.exe
  C:\Windows\System\wJSVCvW.exe
  2⤵
  PID:8424
- C:\Windows\System\pCGMeWa.exe
  C:\Windows\System\pCGMeWa.exe
  2⤵
  PID:8444
- C:\Windows\System\iUERAXd.exe
  C:\Windows\System\iUERAXd.exe
  2⤵
  PID:8460
- C:\Windows\System\xNTJNKY.exe
  C:\Windows\System\xNTJNKY.exe
  2⤵
  PID:8476
- C:\Windows\System\vBKjCAy.exe
  C:\Windows\System\vBKjCAy.exe
  2⤵
  PID:8492
- C:\Windows\System\sotCkuo.exe
  C:\Windows\System\sotCkuo.exe
  2⤵
  PID:8508
- C:\Windows\System\GSIvKrY.exe
  C:\Windows\System\GSIvKrY.exe
  2⤵
  PID:8524
- C:\Windows\System\ligjPWB.exe
  C:\Windows\System\ligjPWB.exe
  2⤵
  PID:8540
- C:\Windows\System\IBNzURe.exe
  C:\Windows\System\IBNzURe.exe
  2⤵
  PID:8564
- C:\Windows\System\vPdohcQ.exe
  C:\Windows\System\vPdohcQ.exe
  2⤵
  PID:8580
- C:\Windows\System\MOctVfy.exe
  C:\Windows\System\MOctVfy.exe
  2⤵
  PID:8600
- C:\Windows\System\LqiCnfF.exe
  C:\Windows\System\LqiCnfF.exe
  2⤵
  PID:8616
- C:\Windows\System\phzhAMv.exe
  C:\Windows\System\phzhAMv.exe
  2⤵
  PID:8640
- C:\Windows\System\nbGCkJy.exe
  C:\Windows\System\nbGCkJy.exe
  2⤵
  PID:8656
- C:\Windows\System\XpYmbYo.exe
  C:\Windows\System\XpYmbYo.exe
  2⤵
  PID:8672
- C:\Windows\System\AJxJQKL.exe
  C:\Windows\System\AJxJQKL.exe
  2⤵
  PID:8688
- C:\Windows\System\oudYkzY.exe
  C:\Windows\System\oudYkzY.exe
  2⤵
  PID:8704
- C:\Windows\System\MAesVja.exe
  C:\Windows\System\MAesVja.exe
  2⤵
  PID:8720
- C:\Windows\System\jYkUBiG.exe
  C:\Windows\System\jYkUBiG.exe
  2⤵
  PID:8736
- C:\Windows\System\rJbOHoT.exe
  C:\Windows\System\rJbOHoT.exe
  2⤵
  PID:8752
- C:\Windows\System\qfjsNEN.exe
  C:\Windows\System\qfjsNEN.exe
  2⤵
  PID:8768
- C:\Windows\System\nldphRc.exe
  C:\Windows\System\nldphRc.exe
  2⤵
  PID:8784
- C:\Windows\System\yaHfAQh.exe
  C:\Windows\System\yaHfAQh.exe
  2⤵
  PID:8800
- C:\Windows\System\BggZHxF.exe
  C:\Windows\System\BggZHxF.exe
  2⤵
  PID:8816
- C:\Windows\System\ddYaAbZ.exe
  C:\Windows\System\ddYaAbZ.exe
  2⤵
  PID:8832
- C:\Windows\System\yplJMjF.exe
  C:\Windows\System\yplJMjF.exe
  2⤵
  PID:8852
- C:\Windows\System\QxxDhwr.exe
  C:\Windows\System\QxxDhwr.exe
  2⤵
  PID:8912
- C:\Windows\System\DpQqBlg.exe
  C:\Windows\System\DpQqBlg.exe
  2⤵
  PID:8928
- C:\Windows\System\dJSdJkh.exe
  C:\Windows\System\dJSdJkh.exe
  2⤵
  PID:8948
- C:\Windows\System\KFdciOm.exe
  C:\Windows\System\KFdciOm.exe
  2⤵
  PID:8964
- C:\Windows\System\VMxxWSK.exe
  C:\Windows\System\VMxxWSK.exe
  2⤵
  PID:8984
- C:\Windows\System\RYNBzSc.exe
  C:\Windows\System\RYNBzSc.exe
  2⤵
  PID:9000
- C:\Windows\System\kgbWtMX.exe
  C:\Windows\System\kgbWtMX.exe
  2⤵
  PID:9016
- C:\Windows\System\tDERCew.exe
  C:\Windows\System\tDERCew.exe
  2⤵
  PID:9032
- C:\Windows\System\tLeyRkG.exe
  C:\Windows\System\tLeyRkG.exe
  2⤵
  PID:9048
- C:\Windows\System\TzBtWMO.exe
  C:\Windows\System\TzBtWMO.exe
  2⤵
  PID:9064
- C:\Windows\System\DMpfyuw.exe
  C:\Windows\System\DMpfyuw.exe
  2⤵
  PID:9084
- C:\Windows\System\TLmvZpQ.exe
  C:\Windows\System\TLmvZpQ.exe
  2⤵
  PID:9104
- C:\Windows\System\zbyoXFx.exe
  C:\Windows\System\zbyoXFx.exe
  2⤵
  PID:9120
- C:\Windows\System\CnxxUVp.exe
  C:\Windows\System\CnxxUVp.exe
  2⤵
  PID:9136
- C:\Windows\System\FBGBBYE.exe
  C:\Windows\System\FBGBBYE.exe
  2⤵
  PID:9156
- C:\Windows\System\aGYkIaa.exe
  C:\Windows\System\aGYkIaa.exe
  2⤵
  PID:9172
- C:\Windows\System\ppyWgSQ.exe
  C:\Windows\System\ppyWgSQ.exe
  2⤵
  PID:9188
- C:\Windows\System\vKijqNf.exe
  C:\Windows\System\vKijqNf.exe
  2⤵
  PID:9204
- C:\Windows\System\YNACewP.exe
  C:\Windows\System\YNACewP.exe
  2⤵
  PID:7840
- C:\Windows\System\GaDGlak.exe
  C:\Windows\System\GaDGlak.exe
  2⤵
  PID:7588
- C:\Windows\System\ILmVCHB.exe
  C:\Windows\System\ILmVCHB.exe
  2⤵
  PID:8212
- C:\Windows\System\mwqFwyQ.exe
  C:\Windows\System\mwqFwyQ.exe
  2⤵
  PID:8236
- C:\Windows\System\JOWPSUb.exe
  C:\Windows\System\JOWPSUb.exe
  2⤵
  PID:8252
- C:\Windows\System\jhPBNXa.exe
  C:\Windows\System\jhPBNXa.exe
  2⤵
  PID:8264
- C:\Windows\System\yhQPrtQ.exe
  C:\Windows\System\yhQPrtQ.exe
  2⤵
  PID:8284
- C:\Windows\System\kDSwZXj.exe
  C:\Windows\System\kDSwZXj.exe
  2⤵
  PID:8304
- C:\Windows\System\gOMgVCl.exe
  C:\Windows\System\gOMgVCl.exe
  2⤵
  PID:8316
- C:\Windows\System\YkFHcEb.exe
  C:\Windows\System\YkFHcEb.exe
  2⤵
  PID:8332
- C:\Windows\System\cWRKmpS.exe
  C:\Windows\System\cWRKmpS.exe
  2⤵
  PID:8348
- C:\Windows\System\zKizNcp.exe
  C:\Windows\System\zKizNcp.exe
  2⤵
  PID:8380
- C:\Windows\System\LDbgwMq.exe
  C:\Windows\System\LDbgwMq.exe
  2⤵
  PID:8400
- C:\Windows\System\XpBaxOv.exe
  C:\Windows\System\XpBaxOv.exe
  2⤵
  PID:8844
- C:\Windows\System\jhLIEMZ.exe
  C:\Windows\System\jhLIEMZ.exe
  2⤵
  PID:8556
- C:\Windows\System\oBXeDTZ.exe
  C:\Windows\System\oBXeDTZ.exe
  2⤵
  PID:8700
- C:\Windows\System\IKsWQgY.exe
  C:\Windows\System\IKsWQgY.exe
  2⤵
  PID:8452
- C:\Windows\System\reqZPeO.exe
  C:\Windows\System\reqZPeO.exe
  2⤵
  PID:8488
- C:\Windows\System\fDNEDHA.exe
  C:\Windows\System\fDNEDHA.exe
  2⤵
  PID:8632
- C:\Windows\System\OYyuINv.exe
  C:\Windows\System\OYyuINv.exe
  2⤵
  PID:8732
- C:\Windows\System\ijSholF.exe
  C:\Windows\System\ijSholF.exe
  2⤵
  PID:8796
- C:\Windows\System\LhYvfgH.exe
  C:\Windows\System\LhYvfgH.exe
  2⤵
  PID:8872
- C:\Windows\System\JSxphJG.exe
  C:\Windows\System\JSxphJG.exe
  2⤵
  PID:8888
- C:\Windows\System\LQKdfmV.exe
  C:\Windows\System\LQKdfmV.exe
  2⤵
  PID:8908
- C:\Windows\System\LrgLhgc.exe
  C:\Windows\System\LrgLhgc.exe
  2⤵
  PID:8896
- C:\Windows\System\XWGMwxi.exe
  C:\Windows\System\XWGMwxi.exe
  2⤵
  PID:9024
- C:\Windows\System\feiOldv.exe
  C:\Windows\System\feiOldv.exe
  2⤵
  PID:9128
- C:\Windows\System\HMBJDIM.exe
  C:\Windows\System\HMBJDIM.exe
  2⤵
  PID:8940
- C:\Windows\System\WzXOhzV.exe
  C:\Windows\System\WzXOhzV.exe
  2⤵
  PID:8200
- C:\Windows\System\NsBqDoF.exe
  C:\Windows\System\NsBqDoF.exe
  2⤵
  PID:9148
- C:\Windows\System\XLBmMoW.exe
  C:\Windows\System\XLBmMoW.exe
  2⤵
  PID:9212
- C:\Windows\System\dFkcOaZ.exe
  C:\Windows\System\dFkcOaZ.exe
  2⤵
  PID:8280
- C:\Windows\System\LZBBqsM.exe
  C:\Windows\System\LZBBqsM.exe
  2⤵
  PID:8276
- C:\Windows\System\inIgauB.exe
  C:\Windows\System\inIgauB.exe
  2⤵
  PID:8344
- C:\Windows\System\cYsmPtk.exe
  C:\Windows\System\cYsmPtk.exe
  2⤵
  PID:8436
- C:\Windows\System\ZVGnYNJ.exe
  C:\Windows\System\ZVGnYNJ.exe
  2⤵
  PID:8532
- C:\Windows\System\qXOiuod.exe
  C:\Windows\System\qXOiuod.exe
  2⤵
  PID:8536
- C:\Windows\System\SqIpgnQ.exe
  C:\Windows\System\SqIpgnQ.exe
  2⤵
  PID:8648
- C:\Windows\System\vmWKGQH.exe
  C:\Windows\System\vmWKGQH.exe
  2⤵
  PID:8712
- C:\Windows\System\mMDwtgJ.exe
  C:\Windows\System\mMDwtgJ.exe
  2⤵
  PID:8776
- C:\Windows\System\FzMeasF.exe
  C:\Windows\System\FzMeasF.exe
  2⤵
  PID:8812
- C:\Windows\System\CaPEMUu.exe
  C:\Windows\System\CaPEMUu.exe
  2⤵
  PID:8548
- C:\Windows\System\aFgUwdC.exe
  C:\Windows\System\aFgUwdC.exe
  2⤵
  PID:8860
- C:\Windows\System\qRwBrVo.exe
  C:\Windows\System\qRwBrVo.exe
  2⤵
  PID:8864
- C:\Windows\System\cIyegaz.exe
  C:\Windows\System\cIyegaz.exe
  2⤵
  PID:9132
- C:\Windows\System\YeWPFLF.exe
  C:\Windows\System\YeWPFLF.exe
  2⤵
  PID:8824
- C:\Windows\System\qGxEdCF.exe
  C:\Windows\System\qGxEdCF.exe
  2⤵
  PID:8624
- C:\Windows\System\dCCmKbz.exe
  C:\Windows\System\dCCmKbz.exe
  2⤵
  PID:8880
- C:\Windows\System\AAanDtD.exe
  C:\Windows\System\AAanDtD.exe
  2⤵
  PID:9092
- C:\Windows\System\TcVJUzU.exe
  C:\Windows\System\TcVJUzU.exe
  2⤵
  PID:9040
- C:\Windows\System\tXawAMR.exe
  C:\Windows\System\tXawAMR.exe
  2⤵
  PID:9164
- C:\Windows\System\zNkKCfq.exe
  C:\Windows\System\zNkKCfq.exe
  2⤵
  PID:7540
- C:\Windows\System\AizsMhu.exe
  C:\Windows\System\AizsMhu.exe
  2⤵
  PID:8228
- C:\Windows\System\niXVxYC.exe
  C:\Windows\System\niXVxYC.exe
  2⤵
  PID:8260
- C:\Windows\System\hnxBUxN.exe
  C:\Windows\System\hnxBUxN.exe
  2⤵
  PID:9072
- C:\Windows\System\WzFcCla.exe
  C:\Windows\System\WzFcCla.exe
  2⤵
  PID:9184
- C:\Windows\System\vSzOHbU.exe
  C:\Windows\System\vSzOHbU.exe
  2⤵
  PID:8376
- C:\Windows\System\FADRlcD.exe
  C:\Windows\System\FADRlcD.exe
  2⤵
  PID:8244
- C:\Windows\System\EHhNDrJ.exe
  C:\Windows\System\EHhNDrJ.exe
  2⤵
  PID:8748
- C:\Windows\System\vYMILus.exe
  C:\Windows\System\vYMILus.exe
  2⤵
  PID:8432
- C:\Windows\System\crZEgoh.exe
  C:\Windows\System\crZEgoh.exe
  2⤵
  PID:8792
- C:\Windows\System\WlmiZZS.exe
  C:\Windows\System\WlmiZZS.exe
  2⤵
  PID:8684
- C:\Windows\System\jQeRrjF.exe
  C:\Windows\System\jQeRrjF.exe
  2⤵
  PID:8572
- C:\Windows\System\QzzbhbX.exe
  C:\Windows\System\QzzbhbX.exe
  2⤵
  PID:7776
- C:\Windows\System\AEArjCI.exe
  C:\Windows\System\AEArjCI.exe
  2⤵
  PID:9076
- C:\Windows\System\TCPcVZl.exe
  C:\Windows\System\TCPcVZl.exe
  2⤵
  PID:8520
- C:\Windows\System\LJiJVLN.exe
  C:\Windows\System\LJiJVLN.exe
  2⤵
  PID:8924
- C:\Windows\System\HbkNVWI.exe
  C:\Windows\System\HbkNVWI.exe
  2⤵
  PID:8668
- C:\Windows\System\qCSWwZt.exe
  C:\Windows\System\qCSWwZt.exe
  2⤵
  PID:8680
- C:\Windows\System\BvaAygu.exe
  C:\Windows\System\BvaAygu.exe
  2⤵
  PID:8840
- C:\Windows\System\HfEQiBz.exe
  C:\Windows\System\HfEQiBz.exe
  2⤵
  PID:7232
- C:\Windows\System\FzsuhAj.exe
  C:\Windows\System\FzsuhAj.exe
  2⤵
  PID:8364
- C:\Windows\System\XbGFzbj.exe
  C:\Windows\System\XbGFzbj.exe
  2⤵
  PID:8960
- C:\Windows\System\SYHgPDp.exe
  C:\Windows\System\SYHgPDp.exe
  2⤵
  PID:9028
- C:\Windows\System\HlHlcbU.exe
  C:\Windows\System\HlHlcbU.exe
  2⤵
  PID:8956
- C:\Windows\System\mUwfNnM.exe
  C:\Windows\System\mUwfNnM.exe
  2⤵
  PID:8876
- C:\Windows\System\qnDUJtm.exe
  C:\Windows\System\qnDUJtm.exe
  2⤵
  PID:9224
- C:\Windows\System\PEksoFq.exe
  C:\Windows\System\PEksoFq.exe
  2⤵
  PID:9240
- C:\Windows\System\YJXekOn.exe
  C:\Windows\System\YJXekOn.exe
  2⤵
  PID:9256
- C:\Windows\System\FNFLElA.exe
  C:\Windows\System\FNFLElA.exe
  2⤵
  PID:9272
- C:\Windows\System\KuCAOUi.exe
  C:\Windows\System\KuCAOUi.exe
  2⤵
  PID:9288
- C:\Windows\System\pGYNbAw.exe
  C:\Windows\System\pGYNbAw.exe
  2⤵
  PID:9304
- C:\Windows\System\FQZbxjm.exe
  C:\Windows\System\FQZbxjm.exe
  2⤵
  PID:9320
- C:\Windows\System\QVmGkeb.exe
  C:\Windows\System\QVmGkeb.exe
  2⤵
  PID:9336
- C:\Windows\System\lXmoDyE.exe
  C:\Windows\System\lXmoDyE.exe
  2⤵
  PID:9352
- C:\Windows\System\iwwBLTv.exe
  C:\Windows\System\iwwBLTv.exe
  2⤵
  PID:9368
- C:\Windows\System\ZaVfiHT.exe
  C:\Windows\System\ZaVfiHT.exe
  2⤵
  PID:9384
- C:\Windows\System\HxfLiZs.exe
  C:\Windows\System\HxfLiZs.exe
  2⤵
  PID:9400
- C:\Windows\System\HoHcqWu.exe
  C:\Windows\System\HoHcqWu.exe
  2⤵
  PID:9416
- C:\Windows\System\TqzswQK.exe
  C:\Windows\System\TqzswQK.exe
  2⤵
  PID:9432
- C:\Windows\System\bOONFEo.exe
  C:\Windows\System\bOONFEo.exe
  2⤵
  PID:9448
- C:\Windows\System\uGDpZce.exe
  C:\Windows\System\uGDpZce.exe
  2⤵
  PID:9464
- C:\Windows\System\zakYDER.exe
  C:\Windows\System\zakYDER.exe
  2⤵
  PID:9480
- C:\Windows\System\mZHVMVO.exe
  C:\Windows\System\mZHVMVO.exe
  2⤵
  PID:9496
- C:\Windows\System\wJCSvZH.exe
  C:\Windows\System\wJCSvZH.exe
  2⤵
  PID:9512
- C:\Windows\System\oFkAoBG.exe
  C:\Windows\System\oFkAoBG.exe
  2⤵
  PID:9528
- C:\Windows\System\QBfqGpN.exe
  C:\Windows\System\QBfqGpN.exe
  2⤵
  PID:9544
- C:\Windows\System\ccKlMKo.exe
  C:\Windows\System\ccKlMKo.exe
  2⤵
  PID:9560
- C:\Windows\System\cMunRYL.exe
  C:\Windows\System\cMunRYL.exe
  2⤵
  PID:9580
- C:\Windows\System\OYJVmin.exe
  C:\Windows\System\OYJVmin.exe
  2⤵
  PID:9600
- C:\Windows\System\GGuuIkk.exe
  C:\Windows\System\GGuuIkk.exe
  2⤵
  PID:9620
- C:\Windows\System\vgQWmyK.exe
  C:\Windows\System\vgQWmyK.exe
  2⤵
  PID:9636
- C:\Windows\System\BxknfWF.exe
  C:\Windows\System\BxknfWF.exe
  2⤵
  PID:9652
- C:\Windows\System\coCZoDA.exe
  C:\Windows\System\coCZoDA.exe
  2⤵
  PID:9668
- C:\Windows\System\QkuBJBh.exe
  C:\Windows\System\QkuBJBh.exe
  2⤵
  PID:9684
- C:\Windows\System\kotmSGM.exe
  C:\Windows\System\kotmSGM.exe
  2⤵
  PID:9700
- C:\Windows\System\lQXmugJ.exe
  C:\Windows\System\lQXmugJ.exe
  2⤵
  PID:9716
- C:\Windows\System\CRZdizn.exe
  C:\Windows\System\CRZdizn.exe
  2⤵
  PID:9732
- C:\Windows\System\wNLVHFO.exe
  C:\Windows\System\wNLVHFO.exe
  2⤵
  PID:9748
- C:\Windows\System\qffZgFU.exe
  C:\Windows\System\qffZgFU.exe
  2⤵
  PID:9764
- C:\Windows\System\ZBUotTD.exe
  C:\Windows\System\ZBUotTD.exe
  2⤵
  PID:9780
- C:\Windows\System\dEsAMkL.exe
  C:\Windows\System\dEsAMkL.exe
  2⤵
  PID:9796
- C:\Windows\System\YerFEdB.exe
  C:\Windows\System\YerFEdB.exe
  2⤵
  PID:9812
- C:\Windows\System\WslpybY.exe
  C:\Windows\System\WslpybY.exe
  2⤵
  PID:9888
- C:\Windows\System\ySMrBfD.exe
  C:\Windows\System\ySMrBfD.exe
  2⤵
  PID:9904
- C:\Windows\System\FlMxkqP.exe
  C:\Windows\System\FlMxkqP.exe
  2⤵
  PID:9920
- C:\Windows\System\fEmoyCy.exe
  C:\Windows\System\fEmoyCy.exe
  2⤵
  PID:9936
- C:\Windows\System\eMIjKQo.exe
  C:\Windows\System\eMIjKQo.exe
  2⤵
  PID:9952
- C:\Windows\System\WrKKUIN.exe
  C:\Windows\System\WrKKUIN.exe
  2⤵
  PID:9972
- C:\Windows\System\ENYZWyv.exe
  C:\Windows\System\ENYZWyv.exe
  2⤵
  PID:9988
- C:\Windows\System\nzPRFiX.exe
  C:\Windows\System\nzPRFiX.exe
  2⤵
  PID:10004
- C:\Windows\System\pyTDxHL.exe
  C:\Windows\System\pyTDxHL.exe
  2⤵
  PID:10020
- C:\Windows\System\gHlbALs.exe
  C:\Windows\System\gHlbALs.exe
  2⤵
  PID:10136
- C:\Windows\System\oQdkNop.exe
  C:\Windows\System\oQdkNop.exe
  2⤵
  PID:10156
- C:\Windows\System\iHspImk.exe
  C:\Windows\System\iHspImk.exe
  2⤵
  PID:10176
- C:\Windows\System\ekaVMlG.exe
  C:\Windows\System\ekaVMlG.exe
  2⤵
  PID:10192
- C:\Windows\System\PmaGeXL.exe
  C:\Windows\System\PmaGeXL.exe
  2⤵
  PID:9248
- C:\Windows\System\eebkMuh.exe
  C:\Windows\System\eebkMuh.exe
  2⤵
  PID:8500
- C:\Windows\System\cWiUrGM.exe
  C:\Windows\System\cWiUrGM.exe
  2⤵
  PID:9296
- C:\Windows\System\ekyApHz.exe
  C:\Windows\System\ekyApHz.exe
  2⤵
  PID:9360
- C:\Windows\System\xeOGrhv.exe
  C:\Windows\System\xeOGrhv.exe
  2⤵
  PID:9316
- C:\Windows\System\IPQmswv.exe
  C:\Windows\System\IPQmswv.exe
  2⤵
  PID:9408
- C:\Windows\System\RXKMlRt.exe
  C:\Windows\System\RXKMlRt.exe
  2⤵
  PID:9344
- C:\Windows\System\ywiDkvd.exe
  C:\Windows\System\ywiDkvd.exe
  2⤵
  PID:9488
- C:\Windows\System\WvrRFRT.exe
  C:\Windows\System\WvrRFRT.exe
  2⤵
  PID:9492
- C:\Windows\System\Qoxilps.exe
  C:\Windows\System\Qoxilps.exe
  2⤵
  PID:9552
- C:\Windows\System\STxCnJU.exe
  C:\Windows\System\STxCnJU.exe
  2⤵
  PID:9508
- C:\Windows\System\vtQHyYA.exe
  C:\Windows\System\vtQHyYA.exe
  2⤵
  PID:9576
- C:\Windows\System\DMmFrSt.exe
  C:\Windows\System\DMmFrSt.exe
  2⤵
  PID:9632
- C:\Windows\System\IefAHgS.exe
  C:\Windows\System\IefAHgS.exe
  2⤵
  PID:9648
- C:\Windows\System\scdyTmL.exe
  C:\Windows\System\scdyTmL.exe
  2⤵
  PID:9696
- C:\Windows\System\ubgCeyd.exe
  C:\Windows\System\ubgCeyd.exe
  2⤵
  PID:9724
- C:\Windows\System\GWtfALC.exe
  C:\Windows\System\GWtfALC.exe
  2⤵
  PID:9788
- C:\Windows\System\kKOKSKl.exe
  C:\Windows\System\kKOKSKl.exe
  2⤵
  PID:9804
- C:\Windows\System\HWCOqun.exe
  C:\Windows\System\HWCOqun.exe
  2⤵
  PID:9836
- C:\Windows\System\qPBwHGm.exe
  C:\Windows\System\qPBwHGm.exe
  2⤵
  PID:9852
- C:\Windows\System\sFJDtNA.exe
  C:\Windows\System\sFJDtNA.exe
  2⤵
  PID:9868
- C:\Windows\System\OtGTile.exe
  C:\Windows\System\OtGTile.exe
  2⤵
  PID:9900
- C:\Windows\System\iZcKazh.exe
  C:\Windows\System\iZcKazh.exe
  2⤵
  PID:9928
- C:\Windows\System\wqJVlDx.exe
  C:\Windows\System\wqJVlDx.exe
  2⤵
  PID:9996
- C:\Windows\System\cDQAstl.exe
  C:\Windows\System\cDQAstl.exe
  2⤵
  PID:9916
- C:\Windows\System\GwQvYYX.exe
  C:\Windows\System\GwQvYYX.exe
  2⤵
  PID:9912
- C:\Windows\System\DhTheWr.exe
  C:\Windows\System\DhTheWr.exe
  2⤵
  PID:9984
- C:\Windows\System\aQDzQDW.exe
  C:\Windows\System\aQDzQDW.exe
  2⤵
  PID:10060
- C:\Windows\System\omCKkpx.exe
  C:\Windows\System\omCKkpx.exe
  2⤵
  PID:10076
- C:\Windows\System\xoXlSND.exe
  C:\Windows\System\xoXlSND.exe
  2⤵
  PID:10096
- C:\Windows\System\mPMBEQb.exe
  C:\Windows\System\mPMBEQb.exe
  2⤵
  PID:10144
- C:\Windows\System\YqhgOsh.exe
  C:\Windows\System\YqhgOsh.exe
  2⤵
  PID:10128
- C:\Windows\System\rFNByNa.exe
  C:\Windows\System\rFNByNa.exe
  2⤵
  PID:10188
- C:\Windows\System\GmAbXTs.exe
  C:\Windows\System\GmAbXTs.exe
  2⤵
  PID:10204
- C:\Windows\System\GFHkYrB.exe
  C:\Windows\System\GFHkYrB.exe
  2⤵
  PID:10220
- C:\Windows\System\MGrJqql.exe
  C:\Windows\System\MGrJqql.exe
  2⤵
  PID:10236
- C:\Windows\System\RvpcKJa.exe
  C:\Windows\System\RvpcKJa.exe
  2⤵
  PID:9044
- C:\Windows\System\kfdYChb.exe
  C:\Windows\System\kfdYChb.exe
  2⤵
  PID:9264
- C:\Windows\System\LmCapYo.exe
  C:\Windows\System\LmCapYo.exe
  2⤵
  PID:8440
- C:\Windows\System\thMfRaW.exe
  C:\Windows\System\thMfRaW.exe
  2⤵
  PID:9280
- C:\Windows\System\tOlOIsD.exe
  C:\Windows\System\tOlOIsD.exe
  2⤵
  PID:9424
- C:\Windows\System\BKJQSmo.exe
  C:\Windows\System\BKJQSmo.exe
  2⤵
  PID:9472
- C:\Windows\System\XEBMBYf.exe
  C:\Windows\System\XEBMBYf.exe
  2⤵
  PID:9572
- C:\Windows\System\bUqnlHE.exe
  C:\Windows\System\bUqnlHE.exe
  2⤵
  PID:9712
- C:\Windows\System\hLCImsb.exe
  C:\Windows\System\hLCImsb.exe
  2⤵
  PID:9476

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\CPSxcfM.exe

Filesize
1.6MB

MD5
e9e8609c53778681c8518d43ca83ce3e

SHA1
8292ba96746223c41506f2f9d94bc42516c55a0f

SHA256
145d746c49296a4ef98c6e5edf7ea2a8c4879864106e926e74bccec3b6313c5f

SHA512
a89db44453e1466713e9b873785d3e8e576df4a53740e817cad1f26d0b5669c1e09a9fda24fe7d8c5d14d51d603cd656a688632b6f8dfe2a3d59ec06e35585cd

Download Submit
C:\Windows\system\EiMhqzr.exe

Filesize
1.6MB

MD5
201887d861268927a329ea190546b2ef

SHA1
62b39ac46ff3f2f181aa9de90ba4b7eb81e1d8d6

SHA256
a5a2e853e40bf97c52ebcea2899929cdeb5960c7992c1e84a905c129a6fad28f

SHA512
7f08380c107e0fac0d8a3cb84d427c651c85cfe916095f4414aab23fa1d48789d676d503454560e2ad6310d67188f7df772197a9597ee6450fb65e8c5b6add65

Download Submit
C:\Windows\system\EpwwGyD.exe

Filesize
1.6MB

MD5
785f7d8c5707541a93b75eaf5c889952

SHA1
ca701ba4f373ecc5c02c0082af4d11fc05294219

SHA256
bacc767d56b7a3c5905fc317d678e60170205793860e43cf0279f03363ee324d

SHA512
34db1f1e895efcef79b5982adceb06cf3b94f9f29766b13e84acb35d0eee3aac2e6fab74ea86a6133c148ac7434073e27d2add4559bfa29091f8f5edaed91dd7

Download Submit
C:\Windows\system\FdbOwFv.exe

Filesize
1.6MB

MD5
10dde542ec2871e7fa14f156097a1c5b

SHA1
9f8eecb41511184dfb1b2273d0e3dd829cd01319

SHA256
cf246b47ea35a131a79290dbf9c74a4d84c8c78ac4b70824a512d5fc22ca4604

SHA512
34ba668360835026cdf8149e3a6dede2600704e3b3758f16467e1f6240273b6adf520ff437d497252bb77a09b4d3279d8694c4b41e79435b5517f2495e1f694d

Download Submit
C:\Windows\system\FgKrwgn.exe

Filesize
1.6MB

MD5
e798eef37671f4e54b75474178d99804

SHA1
31c9988b5fe4afb59f7b1a76e9f51dc4a938bcdd

SHA256
7f3127215e6e79f61a488855a096596572d3da35cdd63f2d03b7f7c47b5b1b3a

SHA512
1383a2d773c931b5e8fb7f98a62de5127f3d5c1be33bd476afaa2ad846a55f0a3b777dece31765f3895205fdcc5fffd1bcf6591f6ffc8f0d41e433b4a7a71293

Download Submit
C:\Windows\system\MNQbXwA.exe

Filesize
1.6MB

MD5
f37a4c1a76bc365d20d08f1eb6d4c0b3

SHA1
9b7bcd661cf755ed0b4a62a383b3b94f01443d4a

SHA256
554023341f9fc1687119c14fb5b44e032e3dcf19e73e07c5080937b947ed1299

SHA512
f330a5f50dc23c677956ce00a174aa3710652352bb77e38e7e44fd737bda89e8d8dfe635fa75d9d511a0204548de1890c1075f44afa12936b93ed69852bdf6ae

Download Submit
C:\Windows\system\NNbuAck.exe

Filesize
1.6MB

MD5
e0a039b29afb65766c482b90037effa8

SHA1
ce374c2708101d9ceaaf3bfce39f40d68fa83619

SHA256
95414ad43507a5cbbfdf3fac039e8d7aa29aec570eb14af971d266d6cd63d980

SHA512
daf2c2bc499fea9eabc8261e5d51501e0121fb7de02a0ceb834ed40f532bffe2d27b9e19adab8b1fd41ba96b9e1788d93164e95ff89e6d495e3d99b6b9c6b2d9

Download Submit
C:\Windows\system\NmNUhUX.exe

Filesize
1.6MB

MD5
ca9b7750a22b604955b3b79eadb61dd7

SHA1
48f43ef3941d9e0537271c5cf81618079c520199

SHA256
95a60756d2e68a67596ad34420579db972f917777cb3c4bfdb0259eb379370ac

SHA512
0d75b348eeb9bf06c9435d5ddc0940b66cbbcbc56a48d0b174dc23276a669f25abdbe6d264b5052d19d2ca0453b65b9c2de5e81784f39cdba6cb31881f70e123

Download Submit
C:\Windows\system\PgrAFiq.exe

Filesize
1.6MB

MD5
966c10f674e3992c3021602e53c3111e

SHA1
9d8280088f93e158d5b9d0d5961dff7b54d81a94

SHA256
9eea92c7c578f387e9cbbfe1db570255b7ff4a4f3e4fa7c35620f0682b57a288

SHA512
85514dbbe2d7b242b2e1d6a47e34b964a95d09bd0079420b7c0c1e9b1f1687e3e751a5311130d476aef8322325115441b9ca09e866a554874f67857757e74dc0

Download Submit
C:\Windows\system\PzJkCGl.exe

Filesize
1.6MB

MD5
ff0928d77749d3302434025c48c52886

SHA1
65c198d8ed3d4702cac83bedba02bca8b6d17be3

SHA256
345eca99aab4c83a95fe664f8f600229907a3432f2b5e2ecd31e85d075cd395c

SHA512
3ad1b62189f2fc900ac95d8c81a92b250507011e32de4ea8d378bbdf46826e5895619c68f03f184e39a09711665aa9ff34165eb8d549818c0a958e066d0bccb6

Download Submit
C:\Windows\system\QjpNUdP.exe

Filesize
1.6MB

MD5
2da3bfc4a7755ead0f4b870a29b4a5cc

SHA1
21b0cecb6725d1299b057b46f09aa7cb35c50fa8

SHA256
7f1e0bf5f34da66e6e27a2ab394150a43eaeeed2ad120d28c51ef78282f50561

SHA512
4b8a902513e48bfa4ac9460f0bcb3058a93df6e7d7d7edce3808a3b71e71f5aa708844ac9dfc3cfa2de8bace307aa9870b0dc5a510a4f59cb5a62d3152c031df

Download Submit
C:\Windows\system\QkPVZUp.exe

Filesize
1.6MB

MD5
187cc99400f8513d83b9224614e833ff

SHA1
20044d15040c1a9cd27fa9494a8046481a87dba5

SHA256
e837d84cf7cd11ac3ce4d6d806e37ee69261b898f9ceb73d226a4039ab369b51

SHA512
68c9a2a5b7830739d60eb1431236773e4c60412e6ea67f79ed09095e8681da7b5e49b9bd16644f63369bcea14f88cd48895dbd11227267b01423a42d73f2a463

Download Submit
C:\Windows\system\QmlOjAn.exe

Filesize
1.6MB

MD5
f329dbd580ef8e79a9f78577f8897fa0

SHA1
864d75239f3f3c06e7fbff18a57fd41558330ab4

SHA256
864c29e54a69d26ff196a7f5cb147d9d0669502bd726b661ddf956b36a4a76a2

SHA512
dee126393aeb8594918d28243ce57b6ca13b270a1a29ac5d98ccaeee9f296be7f927616663896d4f8b18e05946970df6e8153bf157f211bcfd55fac5b7c4ead7

Download Submit
C:\Windows\system\TuMSXzU.exe

Filesize
1.6MB

MD5
1d88c778f2c2152a5ed653bf12391e33

SHA1
b706ee17a19ce78c50c77b46816c9c94a8e652b4

SHA256
cfa04d9395849485d9c627134cdc38413346044aafbb21a269bd7685344bdc1a

SHA512
493bf862117057cb12e39f04265d3102857d11a08b4fb5b58424d49d5ccd446481dd79abc883d98defe5dd1d74ff74db1633f22ef8724a29be9cadaadd5b0a1a

Download Submit
C:\Windows\system\UrhLxqu.exe

Filesize
1.6MB

MD5
eed15f73f65c2212bc62837d0d8bead6

SHA1
72a809ac4a0c4774b6788c6a774e59a120b6f9c1

SHA256
52f275a35f61538c581b850af67e88e212360c3d1a149ec7f79bc804c9053376

SHA512
85052e83dcfc162b7b117f50d267b10b67f9fd4589eb7d9b311108379dd8147669b409d41c180d47f55dc7ab18a61549ac708b3ac7079e66c1ea53e0bf21dbb4

Download Submit
C:\Windows\system\WnYvbxx.exe

Filesize
1.6MB

MD5
82f6579b8a95ef93a20697b142247979

SHA1
2bd15198cef38d6e64d31adc3acfd487d4c6ec24

SHA256
c94ff71e4c982502da2fce777c6135e10cd3ed216bd62fb4a6e64fed9dda798c

SHA512
7e081bf869b3f96f7b5abe93fbf00c2adf959121e9573b8232d0e8c8a4867a3a905a97fe9b924652efc7ddb54baeff61783d7bfb828f3f298a129bc5d4cc4687

Download Submit
C:\Windows\system\Wnqwopc.exe

Filesize
1.6MB

MD5
c78bf95c02d419f0b896eaaee7766af8

SHA1
730009dcca748e6c9abe62b31c5bcaa832009c8f

SHA256
bc149e999bc53770e36e3d062fe097d9cb79a0d791ee83d50e2848c1eb57825a

SHA512
0a89980f35422ecd16376d8c93f51d0a4079252da52b350643101d87d76fcc1cf688710f67caf5c2de1085290bf4b300f652fac8c732a978c6261358fbc59777

Download Submit
C:\Windows\system\YXGwbVb.exe

Filesize
8B

MD5
b4264996759d988d82730e6958cf8074

SHA1
7bbc1f74a3ce00994d790da4622d87f15f45b523

SHA256
8ec7039187958fcd27e56e585c4d65242972777fffc8821de830bc1ff1727bca

SHA512
90e2f3e49d27ab4d11cbf031af514cf6fc3a8851362bc0086d9e25b2d97c3341159ec901fb19a665474ceb995371e4f69eda62c3d14f844ace445c61339d139c

Download Submit
C:\Windows\system\biTlAYi.exe

Filesize
1.6MB

MD5
1e98b9b634c809cd3e6153b664cbf335

SHA1
00976409ba4c9d771f8950d704c082d9e416179a

SHA256
83487975aa05f282fb99ff1d5ee563ac2ec41118cf448f4f19ebcdb38ee175cc

SHA512
2b97bea33b4deb240e7c2dfbe4ea043f840137bbcdbd5c060d40c5a89c0be4f070cb7ad431accb9d5add7cf85d4de73a6775ad5c5acfe56bb088ca13f6d58337

Download Submit
C:\Windows\system\juYLESb.exe

Filesize
1.6MB

MD5
42e55541cbd4606b4c7b599bbede7ce0

SHA1
d20855a7be230da7c77ff1396cde02fd6a4bf2b0

SHA256
e9e4e391aaf8dd58e26fae3bab72e1adbe853b5aa20dd7554f68504858442d89

SHA512
3284e1eecfc68b2311c5015eace7523e4497859cb3d486884b378e6c4b8fa212ef520c563c501ef8082fe8fec437d2c9e4620091256d8e710164384f656f52dc

Download Submit
C:\Windows\system\lItJLaT.exe

Filesize
1.6MB

MD5
596de45fe7fa28dc6090ff9a2d2f1650

SHA1
3d331608b5cd28c3e291e6b020c9ac39984d5c2e

SHA256
fafaebe733bd6028677226805ecb4a3d60458a6074641a39dfa702456270622e

SHA512
d46d9bd58f9178c222aa0ea83856b3bc14bd94f5698b967102fb17d6fa009896095571b3ce1f68fa24105259e8934b06e5706bcfb725b0dd2d2cdf2e78afcf5f

Download Submit
C:\Windows\system\nLFXkzW.exe

Filesize
1.6MB

MD5
7ad04eac27b3073b591386ee284fe2a2

SHA1
0b89229a39a7bd0ad13360474a73e09aad33b45a

SHA256
8ba05f14d5e7390e9292faae3516ccb7711ede070762096e67a88e666f6b734f

SHA512
328ca86d222a39a41dfc313b3a8f25829d03a853532e0689c4a93cb1220e5e853c95237fa136a797ebbc2299b57f4272aef6641680dfa6b120ae6dc39394c444

Download Submit
C:\Windows\system\pbbLDTa.exe

Filesize
1.6MB

MD5
54a3bf7ae19c0be86fb089cb1a577388

SHA1
1eeb06530e664cdfe399176ce68d187aefc6b2ca

SHA256
50e0f847afb5d0f55b86032e4c79b01bfee0320b0f04bb47562b47a09a3f9311

SHA512
727d8f85d509ba751548c949234a18538519736de2040928fd9d02ca86e7c23220e964fa0ea01ec5c1782a8091f53b4c4511cbe9d5c3b0f60f8dfa742947e589

Download Submit
C:\Windows\system\sVHqPSo.exe

Filesize
1.6MB

MD5
df9aca37d59b77697f21ae65f65f7b4c

SHA1
653c107ebe7e5710bf0815b3cdb11eff7e3a9192

SHA256
aec98526445af0d1e62ccac92ae24e6fad3effe7e2c4ca40ea20d4b0ea273f39

SHA512
b3a78c2e7eda6def55bf268fab9a0de5948dad5d056ccfc4c03ca36d78c7b36b652bb597a708055587717cc05ee9a032f4942d4f88bcebcf305deae89141aa09

Download Submit
C:\Windows\system\uUUnZBn.exe

Filesize
1.6MB

MD5
9b65dff689605778dc0465e8cde93e6d

SHA1
f4e7b8bc09794ac6074db171779f187afeaadd19

SHA256
d5caf1cdd8a686fc9691c70651d9009015044749b4239775917060ae1627cbff

SHA512
e0631dc14ce94fa8b15cec61db5b357df130ccb59e92e9d20e23fbc6ba2e22523916cc050ccd5dc1c64d800edba37518f58630468b26483b980505fc969cb4e1

Download Submit
C:\Windows\system\uzlzuBD.exe

Filesize
1.6MB

MD5
23398549d665f146372c1299e0a94a22

SHA1
c36a2c707db528d6e433cbc0027047eff64d7e40

SHA256
ab69f95a41c8590015396875274e8c3f1c888385c7633aac0ff00769b90cd3ff

SHA512
21990cac8ab0a5b68e1473fc01c0f66299d498db64798228dbf11fbf04a54a71c31b98a485f1a5ba8236b0bc13ffd09ca8fad1dff57247bdaf94a2ef7cfc440b

Download Submit
C:\Windows\system\vMvaEPc.exe

Filesize
1.6MB

MD5
7b8f757d4ea81d433879800b31e424cb

SHA1
a53ef3291d5f63fc7c755e5dd1983b0b0362db4f

SHA256
1d556243eb3413b22f0c13b6fc7edb619e1a9ecfbaf4624a7d0c8309b9dba196

SHA512
01ccf116045eee12b18706c5d573a4779b6bf359a3a99d360ba857fced454a30c49d99c2f1dbea28a2dad0c04acee57191dfd7df0de340e4047476847eda0c36

Download Submit
C:\Windows\system\xOUvwfg.exe

Filesize
1.6MB

MD5
e4cbd36e41893252d965ff411b52a103

SHA1
018ee9fe9e7e544ee095ed3fe7e11a955efa5690

SHA256
d72aa153a165a3a1d517be6dde2c9cee10c2c23d99fe91e01ed7849e65d8f634

SHA512
c08acd0e6b2099dbca75e73080bd96c8be9df44453efe69c84a3a07b78385057adc048728e2dbb7f95105a0faf4a25e85dddc8dda5017e8e6fd375be43af5c40

Download Submit
\Windows\system\HdGynpU.exe

Filesize
1.6MB

MD5
8a101c3fbd7fd8d6fe648bc2a661e378

SHA1
ab6f93c980d8f9c2ea902433d6f43e120c844ae8

SHA256
8fcf13838c268262a7ee36cf8180b453891c0cfbe233c07ef743eada40c5f30e

SHA512
dd4e349edf62b4515e40278daf60fdfb42229779c2671292cb013576556b6b1ffa14f5160b513b2fe583eb996f3990a214fd11468a9ca5e12d4a6f1b541fa2d8

Download Submit
\Windows\system\IOkIoAe.exe

Filesize
1.6MB

MD5
19d74c79a22f5f362e860c2ad327a6e7

SHA1
25d29b7fb3b6730f90967b139b0941a04503d73a

SHA256
cf0a1da2746dcdddffbc4e80cc17450511a04c5ec75cbd20f93824a7e0f12c16

SHA512
7110349422bd5f927b50f775161fc3c842c1de99f2b5d4e9cc64c5539aefb474ab9760f0b8ede5f8d3c48ba3aee820888ca1cf04f0b7ed27c43974a0a86918ab

Download Submit
\Windows\system\NcVZRfP.exe

Filesize
1.6MB

MD5
96003c84300f0099ec6b4af8e07b1843

SHA1
246a6e365a092b962c9a45ec1a0c127745ff215f

SHA256
6f35f2b305618f60474d96e7cd47764c6d60be9c38a08805918a3a450fd7a6b8

SHA512
7e58162be6b5a344d2b1fb732aeb33ab6316cfbd90ca7a524c045b111e3985ed23f56b94729297d94a8a3fd17add775e2cc1deff1bf4706fab03fa500bc25932

Download Submit
\Windows\system\PdcabTG.exe

Filesize
1.6MB

MD5
f10b1094fe8d21e7fc6921c3652e0e5e

SHA1
6732c1b81cde9803fc2e75cce5c5679142d46359

SHA256
76c3ff4b762cdae85bb6011f560ca655be9d27000d3af68b901a54ca41dbfedf

SHA512
fe209ccb06a0a4486df062b6616dc2d2427268a78b100edb98fd436a09bf85f0de98b04e18095a8a127f6e8d840c4aa4159e4907dd100b5eddfe1d271403df20

Download Submit
\Windows\system\eUtlFDQ.exe

Filesize
1.6MB

MD5
7c7cd4bd059e83234cb8cda53b663299

SHA1
5642d0b45b3a547c95e7da9405069d08e1c80272

SHA256
549dfdc605f0772449529f4fa78ce63aa1498a5efa55a3b3ff8a6d298b85aa42

SHA512
eb8b797818b1c168aea15cab407b3800947a6fe9e751752974d505f9e95d76d4a3c3512e21a968cc6cd8129e31170f281273f65f8cd48d96cd471ee0d0f7c715

Download Submit
\Windows\system\iJYhhmu.exe

Filesize
1.6MB

MD5
6956b93ae4f156034e7df50dee0e794d

SHA1
d214ff3e29634128c73714b0b3e231764919f9ef

SHA256
e1d4d2c80c52906c1ef309d43106cdc79b42b627ce752de374707dd6390de6db

SHA512
240e8d99af0802eb3694d8317f5c75f69e9557e14924b2b16245c684424ac1c152742e5d8d8fa82eca4d69f033c6e962090f12ae9beed5d76744591fb7bd8b99

Download Submit
\Windows\system\zOtyors.exe

Filesize
1.6MB

MD5
3acac333e889a9dd5ecb7a481a5b3399

SHA1
601fa6af9d4af983e98588a4f93749df07fd790e

SHA256
1ec2a02b9553a6ffbd58ce3fbad219bbe08192255c7dbd78f403db056aad00fb

SHA512
b10b43b636d2fd8fa52446bc6f40f32a392f0d161cc13f90079738990797daea824758f670fa605c32606035f2847f2394b55596d7067ed832c63a72ce816365

Download Submit
memory/1080-190-0x000000013FB20000-0x000000013FF12000-memory.dmp

Filesize
3.9MB

Download
memory/1080-6335-0x000000013FB20000-0x000000013FF12000-memory.dmp

Filesize
3.9MB

Download
memory/1840-181-0x000007FEF5410000-0x000007FEF5DAD000-memory.dmp

Filesize
9.6MB

Download
memory/1840-301-0x000007FEF5410000-0x000007FEF5DAD000-memory.dmp

Filesize
9.6MB

Download
memory/1840-255-0x000000001B660000-0x000000001B942000-memory.dmp

Filesize
2.9MB

Download
memory/1840-25-0x000007FEF56CE000-0x000007FEF56CF000-memory.dmp

Filesize
4KB

Download
memory/1840-256-0x0000000001D60000-0x0000000001D68000-memory.dmp

Filesize
32KB

Download
memory/2112-6339-0x000000013F460000-0x000000013F852000-memory.dmp

Filesize
3.9MB

Download
memory/2112-200-0x000000013F460000-0x000000013F852000-memory.dmp

Filesize
3.9MB

Download
memory/2464-15-0x000000013FBA0000-0x000000013FF92000-memory.dmp

Filesize
3.9MB

Download
memory/2464-5330-0x000000013FBA0000-0x000000013FF92000-memory.dmp

Filesize
3.9MB

Download
memory/2468-1-0x00000000001F0000-0x0000000000200000-memory.dmp

Filesize
64KB

Download
memory/2468-24-0x0000000002E20000-0x0000000003212000-memory.dmp

Filesize
3.9MB

Download
memory/2468-191-0x0000000003530000-0x0000000003922000-memory.dmp

Filesize
3.9MB

Download
memory/2468-194-0x000000013F020000-0x000000013F412000-memory.dmp

Filesize
3.9MB

Download
memory/2468-189-0x000000013FB20000-0x000000013FF12000-memory.dmp

Filesize
3.9MB

Download
memory/2468-8025-0x0000000003530000-0x0000000003922000-memory.dmp

Filesize
3.9MB

Download
memory/2468-202-0x0000000003530000-0x0000000003922000-memory.dmp

Filesize
3.9MB

Download
memory/2468-201-0x000000013F130000-0x000000013F522000-memory.dmp

Filesize
3.9MB

Download
memory/2468-196-0x0000000003530000-0x0000000003922000-memory.dmp

Filesize
3.9MB

Download
memory/2468-10075-0x0000000003530000-0x0000000003922000-memory.dmp

Filesize
3.9MB

Download
memory/2468-185-0x0000000003530000-0x0000000003922000-memory.dmp

Filesize
3.9MB

Download
memory/2468-193-0x000000013FE50000-0x0000000140242000-memory.dmp

Filesize
3.9MB

Download
memory/2468-9651-0x0000000003530000-0x0000000003922000-memory.dmp

Filesize
3.9MB

Download
memory/2468-198-0x0000000003530000-0x0000000003922000-memory.dmp

Filesize
3.9MB

Download
memory/2468-9294-0x000000013FE50000-0x0000000140242000-memory.dmp

Filesize
3.9MB

Download
memory/2468-199-0x0000000003530000-0x0000000003922000-memory.dmp

Filesize
3.9MB

Download
memory/2468-6-0x000000013FBA0000-0x000000013FF92000-memory.dmp

Filesize
3.9MB

Download
memory/2468-187-0x000000013FB50000-0x000000013FF42000-memory.dmp

Filesize
3.9MB

Download
memory/2468-0-0x000000013F680000-0x000000013FA72000-memory.dmp

Filesize
3.9MB

Download
memory/2468-4459-0x000000013F680000-0x000000013FA72000-memory.dmp

Filesize
3.9MB

Download
memory/2504-195-0x000000013FE50000-0x0000000140242000-memory.dmp

Filesize
3.9MB

Download
memory/2504-6333-0x000000013FE50000-0x0000000140242000-memory.dmp

Filesize
3.9MB

Download
memory/2600-6309-0x000000013F130000-0x000000013F522000-memory.dmp

Filesize
3.9MB

Download
memory/2600-182-0x000000013F130000-0x000000013F522000-memory.dmp

Filesize
3.9MB

Download
memory/2624-184-0x000000013F470000-0x000000013F862000-memory.dmp

Filesize
3.9MB

Download
memory/2692-183-0x000000013F370000-0x000000013F762000-memory.dmp

Filesize
3.9MB

Download
memory/2692-6312-0x000000013F370000-0x000000013F762000-memory.dmp

Filesize
3.9MB

Download
memory/2752-192-0x000000013F620000-0x000000013FA12000-memory.dmp

Filesize
3.9MB

Download
memory/2752-6327-0x000000013F620000-0x000000013FA12000-memory.dmp

Filesize
3.9MB

Download
memory/2776-6316-0x000000013F6D0000-0x000000013FAC2000-memory.dmp

Filesize
3.9MB

Download
memory/2776-186-0x000000013F6D0000-0x000000013FAC2000-memory.dmp

Filesize
3.9MB

Download
memory/2916-6474-0x000000013FB50000-0x000000013FF42000-memory.dmp

Filesize
3.9MB

Download
memory/2916-188-0x000000013FB50000-0x000000013FF42000-memory.dmp

Filesize
3.9MB

Download
memory/2944-197-0x000000013F7A0000-0x000000013FB92000-memory.dmp

Filesize
3.9MB

Download