xmrig | 9ff2e109801b61a6edbb6fdc33033ad0a9d381d190c013ac2eee602bf6013c16

Analysis

max time kernel
120s
max time network
120s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
16/05/2024, 03:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8eb57ce74dae8e219911acc795500170_NeikiAnalytics.exe
Size

2.6MB
MD5

8eb57ce74dae8e219911acc795500170
SHA1

706f7ad4c60043cf3bd533f84aaed952fe81e40c
SHA256

9ff2e109801b61a6edbb6fdc33033ad0a9d381d190c013ac2eee602bf6013c16
SHA512

e82cd575532fd12d3308a8758288cfbee06eb36874031d00e228fd902f047f2da07c1b79c66063b0ed4251f5c22a2a55ef19f64aa707bc38d29090f9b4bfbf8d
SSDEEP

49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkyW10/w16BvZ+I+:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2RE

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 52 IoCs

miner

resource	yara_rule
behavioral1/memory/1068-1-0x000000013FB80000-0x000000013FF76000-memory.dmp	xmrig
behavioral1/files/0x000b000000015d0f-3.dat	xmrig
behavioral1/files/0x000800000001650c-19.dat	xmrig
behavioral1/files/0x000a0000000167d5-27.dat	xmrig
behavioral1/files/0x0009000000016176-10.dat	xmrig
behavioral1/files/0x0007000000016c7c-56.dat	xmrig
behavioral1/files/0x0006000000016cc6-79.dat	xmrig
behavioral1/files/0x0006000000016d51-85.dat	xmrig
behavioral1/memory/2516-88-0x000000013F350000-0x000000013F746000-memory.dmp	xmrig
behavioral1/files/0x0009000000016bfb-38.dat	xmrig
behavioral1/files/0x0006000000016d1a-81.dat	xmrig
behavioral1/files/0x0006000000016e24-113.dat	xmrig
behavioral1/memory/2528-117-0x000000013F980000-0x000000013FD76000-memory.dmp	xmrig
behavioral1/memory/2596-59-0x000000013FC00000-0x000000013FFF6000-memory.dmp	xmrig
behavioral1/files/0x0006000000016ca5-122.dat	xmrig
behavioral1/files/0x0006000000016d57-131.dat	xmrig
behavioral1/files/0x0007000000016fed-141.dat	xmrig
behavioral1/files/0x0006000000017422-176.dat	xmrig
behavioral1/files/0x00140000000185e9-186.dat	xmrig
behavioral1/files/0x00060000000174a5-181.dat	xmrig
behavioral1/files/0x0006000000017407-171.dat	xmrig
behavioral1/files/0x00060000000173f2-166.dat	xmrig
behavioral1/files/0x000600000001737c-161.dat	xmrig
behavioral1/files/0x0006000000017374-156.dat	xmrig
behavioral1/files/0x000600000001735a-146.dat	xmrig
behavioral1/files/0x0006000000017371-151.dat	xmrig
behavioral1/files/0x000f000000005578-137.dat	xmrig
behavioral1/memory/2740-110-0x000000013F760000-0x000000013FB56000-memory.dmp	xmrig
behavioral1/files/0x0007000000016c51-109.dat	xmrig
behavioral1/memory/1068-105-0x000000013FFC0000-0x00000001403B6000-memory.dmp	xmrig
behavioral1/memory/2476-104-0x000000013FFE0000-0x00000001403D6000-memory.dmp	xmrig
behavioral1/files/0x0009000000016a29-93.dat	xmrig
behavioral1/files/0x0006000000016d3e-82.dat	xmrig
behavioral1/files/0x0006000000016d16-74.dat	xmrig
behavioral1/files/0x0006000000016cb6-69.dat	xmrig
behavioral1/files/0x0006000000016cbe-64.dat	xmrig
behavioral1/files/0x0008000000016be2-42.dat	xmrig
behavioral1/memory/2244-121-0x000000013F860000-0x000000013FC56000-memory.dmp	xmrig
behavioral1/files/0x00070000000165ae-14.dat	xmrig
behavioral1/files/0x0007000000016c04-55.dat	xmrig
behavioral1/memory/1272-46-0x000000013FF30000-0x0000000140326000-memory.dmp	xmrig
behavioral1/memory/2148-37-0x000000013F7F0000-0x000000013FBE6000-memory.dmp	xmrig
behavioral1/memory/2332-28-0x000000013F060000-0x000000013F456000-memory.dmp	xmrig
behavioral1/memory/1272-8587-0x000000013FF30000-0x0000000140326000-memory.dmp	xmrig
behavioral1/memory/2332-8589-0x000000013F060000-0x000000013F456000-memory.dmp	xmrig
behavioral1/memory/2148-8588-0x000000013F7F0000-0x000000013FBE6000-memory.dmp	xmrig
behavioral1/memory/2740-8590-0x000000013F760000-0x000000013FB56000-memory.dmp	xmrig
behavioral1/memory/2596-8591-0x000000013FC00000-0x000000013FFF6000-memory.dmp	xmrig
behavioral1/memory/2528-8592-0x000000013F980000-0x000000013FD76000-memory.dmp	xmrig
behavioral1/memory/2516-8594-0x000000013F350000-0x000000013F746000-memory.dmp	xmrig
behavioral1/memory/2244-8593-0x000000013F860000-0x000000013FC56000-memory.dmp	xmrig
behavioral1/memory/2476-8595-0x000000013FFE0000-0x00000001403D6000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
2864	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
2332	PHSzJBb.exe
2148	NTUImws.exe
2740	pqMKJXj.exe
1272	mtaAyPI.exe
2596	WgMftYD.exe
2528	NCtQCvX.exe
2244	xZqNoHq.exe
2516	pPZdxII.exe
2476	GuWjzFB.exe
2984	UkimAHG.exe
1924	nILZMSb.exe
2560	yTKXhHg.exe
2908	kXpFGYf.exe
1060	TcOoZCC.exe
2676	HgYSuPY.exe
2392	CKKHAGm.exe
2416	maZrlNK.exe
2464	kMNLqvx.exe
2848	dsBzEHf.exe
1512	aztFqPO.exe
1948	DupPeRH.exe
856	zMVecDv.exe
1408	BTBpHDG.exe
2744	MPHlvBr.exe
2072	KYxdXjV.exe
656	VcMmpKg.exe
2300	tPCEscq.exe
1688	xvwLTFo.exe
2372	FhnyRqv.exe
340	qssZgAO.exe
3040	FbiDEGm.exe
2768	XaOTwSq.exe
1380	oeUzoPs.exe
1656	sdPewcm.exe
1824	VCsWFLf.exe
776	dMkdTAX.exe
1040	PSOWEOR.exe
552	hgRfzve.exe
1748	asvrzfX.exe
108	WMwVYxM.exe
1720	TwColLG.exe
3008	tISuMwp.exe
2104	dlVuUlQ.exe
1672	OlCiuLc.exe
3012	aKGjvwl.exe
1256	zCREFqu.exe
1752	EjIyZTD.exe
2860	ZnJkiaw.exe
2892	EMUHRgT.exe
2280	cOvboXV.exe
2808	GGiFiLZ.exe
1640	VXXIGbW.exe
2552	ZfuHOCa.exe
2536	nNocAwn.exe
2096	sjYkPLe.exe
2544	QssVBzK.exe
2380	YXDHlkS.exe
2568	ExEPWBJ.exe
1628	uunxFCC.exe
2696	RmeoeIv.exe
1452	kSNSaHF.exe
1500	vlRWHux.exe
1920	mmDtYna.exe
2144	tOQBmcE.exe

Loads dropped DLL 64 IoCs

pid	Process
1068	8eb57ce74dae8e219911acc795500170_NeikiAnalytics.exe
1068	8eb57ce74dae8e219911acc795500170_NeikiAnalytics.exe
1068	8eb57ce74dae8e219911acc795500170_NeikiAnalytics.exe
1068	8eb57ce74dae8e219911acc795500170_NeikiAnalytics.exe
1068	8eb57ce74dae8e219911acc795500170_NeikiAnalytics.exe
1068	8eb57ce74dae8e219911acc795500170_NeikiAnalytics.exe
1068	8eb57ce74dae8e219911acc795500170_NeikiAnalytics.exe
1068	8eb57ce74dae8e219911acc795500170_NeikiAnalytics.exe
1068	8eb57ce74dae8e219911acc795500170_NeikiAnalytics.exe
1068	8eb57ce74dae8e219911acc795500170_NeikiAnalytics.exe
1068	8eb57ce74dae8e219911acc795500170_NeikiAnalytics.exe
1068	8eb57ce74dae8e219911acc795500170_NeikiAnalytics.exe
1068	8eb57ce74dae8e219911acc795500170_NeikiAnalytics.exe
1068	8eb57ce74dae8e219911acc795500170_NeikiAnalytics.exe
1068	8eb57ce74dae8e219911acc795500170_NeikiAnalytics.exe
1068	8eb57ce74dae8e219911acc795500170_NeikiAnalytics.exe
1068	8eb57ce74dae8e219911acc795500170_NeikiAnalytics.exe
1068	8eb57ce74dae8e219911acc795500170_NeikiAnalytics.exe
1068	8eb57ce74dae8e219911acc795500170_NeikiAnalytics.exe
1068	8eb57ce74dae8e219911acc795500170_NeikiAnalytics.exe
1068	8eb57ce74dae8e219911acc795500170_NeikiAnalytics.exe
1068	8eb57ce74dae8e219911acc795500170_NeikiAnalytics.exe
1068	8eb57ce74dae8e219911acc795500170_NeikiAnalytics.exe
1068	8eb57ce74dae8e219911acc795500170_NeikiAnalytics.exe
1068	8eb57ce74dae8e219911acc795500170_NeikiAnalytics.exe
1068	8eb57ce74dae8e219911acc795500170_NeikiAnalytics.exe
1068	8eb57ce74dae8e219911acc795500170_NeikiAnalytics.exe
1068	8eb57ce74dae8e219911acc795500170_NeikiAnalytics.exe
1068	8eb57ce74dae8e219911acc795500170_NeikiAnalytics.exe
1068	8eb57ce74dae8e219911acc795500170_NeikiAnalytics.exe
1068	8eb57ce74dae8e219911acc795500170_NeikiAnalytics.exe
1068	8eb57ce74dae8e219911acc795500170_NeikiAnalytics.exe
1068	8eb57ce74dae8e219911acc795500170_NeikiAnalytics.exe
1068	8eb57ce74dae8e219911acc795500170_NeikiAnalytics.exe
1068	8eb57ce74dae8e219911acc795500170_NeikiAnalytics.exe
1068	8eb57ce74dae8e219911acc795500170_NeikiAnalytics.exe
1068	8eb57ce74dae8e219911acc795500170_NeikiAnalytics.exe
1068	8eb57ce74dae8e219911acc795500170_NeikiAnalytics.exe
1068	8eb57ce74dae8e219911acc795500170_NeikiAnalytics.exe
1068	8eb57ce74dae8e219911acc795500170_NeikiAnalytics.exe
1068	8eb57ce74dae8e219911acc795500170_NeikiAnalytics.exe
1068	8eb57ce74dae8e219911acc795500170_NeikiAnalytics.exe
1068	8eb57ce74dae8e219911acc795500170_NeikiAnalytics.exe
1068	8eb57ce74dae8e219911acc795500170_NeikiAnalytics.exe
1068	8eb57ce74dae8e219911acc795500170_NeikiAnalytics.exe
1068	8eb57ce74dae8e219911acc795500170_NeikiAnalytics.exe
1068	8eb57ce74dae8e219911acc795500170_NeikiAnalytics.exe
1068	8eb57ce74dae8e219911acc795500170_NeikiAnalytics.exe
1068	8eb57ce74dae8e219911acc795500170_NeikiAnalytics.exe
1068	8eb57ce74dae8e219911acc795500170_NeikiAnalytics.exe
1068	8eb57ce74dae8e219911acc795500170_NeikiAnalytics.exe
1068	8eb57ce74dae8e219911acc795500170_NeikiAnalytics.exe
1068	8eb57ce74dae8e219911acc795500170_NeikiAnalytics.exe
1068	8eb57ce74dae8e219911acc795500170_NeikiAnalytics.exe
1068	8eb57ce74dae8e219911acc795500170_NeikiAnalytics.exe
1068	8eb57ce74dae8e219911acc795500170_NeikiAnalytics.exe
1068	8eb57ce74dae8e219911acc795500170_NeikiAnalytics.exe
1068	8eb57ce74dae8e219911acc795500170_NeikiAnalytics.exe
1068	8eb57ce74dae8e219911acc795500170_NeikiAnalytics.exe
1068	8eb57ce74dae8e219911acc795500170_NeikiAnalytics.exe
1068	8eb57ce74dae8e219911acc795500170_NeikiAnalytics.exe
1068	8eb57ce74dae8e219911acc795500170_NeikiAnalytics.exe
1068	8eb57ce74dae8e219911acc795500170_NeikiAnalytics.exe
1068	8eb57ce74dae8e219911acc795500170_NeikiAnalytics.exe

UPX packed file 51 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1068-1-0x000000013FB80000-0x000000013FF76000-memory.dmp	upx
behavioral1/files/0x000b000000015d0f-3.dat	upx
behavioral1/files/0x000800000001650c-19.dat	upx
behavioral1/files/0x000a0000000167d5-27.dat	upx
behavioral1/files/0x0009000000016176-10.dat	upx
behavioral1/files/0x0007000000016c7c-56.dat	upx
behavioral1/files/0x0006000000016cc6-79.dat	upx
behavioral1/files/0x0006000000016d51-85.dat	upx
behavioral1/memory/2516-88-0x000000013F350000-0x000000013F746000-memory.dmp	upx
behavioral1/files/0x0009000000016bfb-38.dat	upx
behavioral1/files/0x0006000000016d1a-81.dat	upx
behavioral1/files/0x0006000000016e24-113.dat	upx
behavioral1/memory/2528-117-0x000000013F980000-0x000000013FD76000-memory.dmp	upx
behavioral1/memory/2596-59-0x000000013FC00000-0x000000013FFF6000-memory.dmp	upx
behavioral1/files/0x0006000000016ca5-122.dat	upx
behavioral1/files/0x0006000000016d57-131.dat	upx
behavioral1/files/0x0007000000016fed-141.dat	upx
behavioral1/files/0x0006000000017422-176.dat	upx
behavioral1/files/0x00140000000185e9-186.dat	upx
behavioral1/files/0x00060000000174a5-181.dat	upx
behavioral1/files/0x0006000000017407-171.dat	upx
behavioral1/files/0x00060000000173f2-166.dat	upx
behavioral1/files/0x000600000001737c-161.dat	upx
behavioral1/files/0x0006000000017374-156.dat	upx
behavioral1/files/0x000600000001735a-146.dat	upx
behavioral1/files/0x0006000000017371-151.dat	upx
behavioral1/files/0x000f000000005578-137.dat	upx
behavioral1/memory/2740-110-0x000000013F760000-0x000000013FB56000-memory.dmp	upx
behavioral1/files/0x0007000000016c51-109.dat	upx
behavioral1/memory/2476-104-0x000000013FFE0000-0x00000001403D6000-memory.dmp	upx
behavioral1/files/0x0009000000016a29-93.dat	upx
behavioral1/files/0x0006000000016d3e-82.dat	upx
behavioral1/files/0x0006000000016d16-74.dat	upx
behavioral1/files/0x0006000000016cb6-69.dat	upx
behavioral1/files/0x0006000000016cbe-64.dat	upx
behavioral1/files/0x0008000000016be2-42.dat	upx
behavioral1/memory/2244-121-0x000000013F860000-0x000000013FC56000-memory.dmp	upx
behavioral1/files/0x00070000000165ae-14.dat	upx
behavioral1/files/0x0007000000016c04-55.dat	upx
behavioral1/memory/1272-46-0x000000013FF30000-0x0000000140326000-memory.dmp	upx
behavioral1/memory/2148-37-0x000000013F7F0000-0x000000013FBE6000-memory.dmp	upx
behavioral1/memory/2332-28-0x000000013F060000-0x000000013F456000-memory.dmp	upx
behavioral1/memory/1272-8587-0x000000013FF30000-0x0000000140326000-memory.dmp	upx
behavioral1/memory/2332-8589-0x000000013F060000-0x000000013F456000-memory.dmp	upx
behavioral1/memory/2148-8588-0x000000013F7F0000-0x000000013FBE6000-memory.dmp	upx
behavioral1/memory/2740-8590-0x000000013F760000-0x000000013FB56000-memory.dmp	upx
behavioral1/memory/2596-8591-0x000000013FC00000-0x000000013FFF6000-memory.dmp	upx
behavioral1/memory/2528-8592-0x000000013F980000-0x000000013FD76000-memory.dmp	upx
behavioral1/memory/2516-8594-0x000000013F350000-0x000000013F746000-memory.dmp	upx
behavioral1/memory/2244-8593-0x000000013F860000-0x000000013FC56000-memory.dmp	upx
behavioral1/memory/2476-8595-0x000000013FFE0000-0x00000001403D6000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\gOFutUf.exe	8eb57ce74dae8e219911acc795500170_NeikiAnalytics.exe
File created	C:\Windows\System\ahhafqc.exe	8eb57ce74dae8e219911acc795500170_NeikiAnalytics.exe
File created	C:\Windows\System\SmvICjC.exe	8eb57ce74dae8e219911acc795500170_NeikiAnalytics.exe
File created	C:\Windows\System\UUIVfNA.exe	8eb57ce74dae8e219911acc795500170_NeikiAnalytics.exe
File created	C:\Windows\System\EkwzeZY.exe	8eb57ce74dae8e219911acc795500170_NeikiAnalytics.exe
File created	C:\Windows\System\hQXsuZa.exe	8eb57ce74dae8e219911acc795500170_NeikiAnalytics.exe
File created	C:\Windows\System\wPpRiYs.exe	8eb57ce74dae8e219911acc795500170_NeikiAnalytics.exe
File created	C:\Windows\System\PkpceKg.exe	8eb57ce74dae8e219911acc795500170_NeikiAnalytics.exe
File created	C:\Windows\System\ozVNFSe.exe	8eb57ce74dae8e219911acc795500170_NeikiAnalytics.exe
File created	C:\Windows\System\oLoQmEV.exe	8eb57ce74dae8e219911acc795500170_NeikiAnalytics.exe
File created	C:\Windows\System\xcgOvTz.exe	8eb57ce74dae8e219911acc795500170_NeikiAnalytics.exe
File created	C:\Windows\System\mkReDwE.exe	8eb57ce74dae8e219911acc795500170_NeikiAnalytics.exe
File created	C:\Windows\System\TZSVrJd.exe	8eb57ce74dae8e219911acc795500170_NeikiAnalytics.exe
File created	C:\Windows\System\vqMHHLQ.exe	8eb57ce74dae8e219911acc795500170_NeikiAnalytics.exe
File created	C:\Windows\System\NEGvVtF.exe	8eb57ce74dae8e219911acc795500170_NeikiAnalytics.exe
File created	C:\Windows\System\IdntGlQ.exe	8eb57ce74dae8e219911acc795500170_NeikiAnalytics.exe
File created	C:\Windows\System\zUdOEbK.exe	8eb57ce74dae8e219911acc795500170_NeikiAnalytics.exe
File created	C:\Windows\System\XrCSKxu.exe	8eb57ce74dae8e219911acc795500170_NeikiAnalytics.exe
File created	C:\Windows\System\WixFMsv.exe	8eb57ce74dae8e219911acc795500170_NeikiAnalytics.exe
File created	C:\Windows\System\Kjvqqmp.exe	8eb57ce74dae8e219911acc795500170_NeikiAnalytics.exe
File created	C:\Windows\System\FwtGSiZ.exe	8eb57ce74dae8e219911acc795500170_NeikiAnalytics.exe
File created	C:\Windows\System\mQlwTjG.exe	8eb57ce74dae8e219911acc795500170_NeikiAnalytics.exe
File created	C:\Windows\System\MKuomTy.exe	8eb57ce74dae8e219911acc795500170_NeikiAnalytics.exe
File created	C:\Windows\System\bJHNHRc.exe	8eb57ce74dae8e219911acc795500170_NeikiAnalytics.exe
File created	C:\Windows\System\EPyJaQw.exe	8eb57ce74dae8e219911acc795500170_NeikiAnalytics.exe
File created	C:\Windows\System\xBheoWa.exe	8eb57ce74dae8e219911acc795500170_NeikiAnalytics.exe
File created	C:\Windows\System\CBXwdpG.exe	8eb57ce74dae8e219911acc795500170_NeikiAnalytics.exe
File created	C:\Windows\System\HYcWZnW.exe	8eb57ce74dae8e219911acc795500170_NeikiAnalytics.exe
File created	C:\Windows\System\aMmoKSb.exe	8eb57ce74dae8e219911acc795500170_NeikiAnalytics.exe
File created	C:\Windows\System\UPCYMIw.exe	8eb57ce74dae8e219911acc795500170_NeikiAnalytics.exe
File created	C:\Windows\System\xablJTU.exe	8eb57ce74dae8e219911acc795500170_NeikiAnalytics.exe
File created	C:\Windows\System\QFLtyVe.exe	8eb57ce74dae8e219911acc795500170_NeikiAnalytics.exe
File created	C:\Windows\System\DETnkXP.exe	8eb57ce74dae8e219911acc795500170_NeikiAnalytics.exe
File created	C:\Windows\System\wJwJpGO.exe	8eb57ce74dae8e219911acc795500170_NeikiAnalytics.exe
File created	C:\Windows\System\mytSkZT.exe	8eb57ce74dae8e219911acc795500170_NeikiAnalytics.exe
File created	C:\Windows\System\UoiTsmM.exe	8eb57ce74dae8e219911acc795500170_NeikiAnalytics.exe
File created	C:\Windows\System\xUMfVmP.exe	8eb57ce74dae8e219911acc795500170_NeikiAnalytics.exe
File created	C:\Windows\System\hOcLxIw.exe	8eb57ce74dae8e219911acc795500170_NeikiAnalytics.exe
File created	C:\Windows\System\GLpQnEh.exe	8eb57ce74dae8e219911acc795500170_NeikiAnalytics.exe
File created	C:\Windows\System\YmvZAKs.exe	8eb57ce74dae8e219911acc795500170_NeikiAnalytics.exe
File created	C:\Windows\System\ynXZBbd.exe	8eb57ce74dae8e219911acc795500170_NeikiAnalytics.exe
File created	C:\Windows\System\JHLVSYG.exe	8eb57ce74dae8e219911acc795500170_NeikiAnalytics.exe
File created	C:\Windows\System\GBsqBGd.exe	8eb57ce74dae8e219911acc795500170_NeikiAnalytics.exe
File created	C:\Windows\System\fJjqrbY.exe	8eb57ce74dae8e219911acc795500170_NeikiAnalytics.exe
File created	C:\Windows\System\GNECbhV.exe	8eb57ce74dae8e219911acc795500170_NeikiAnalytics.exe
File created	C:\Windows\System\zMGRhjU.exe	8eb57ce74dae8e219911acc795500170_NeikiAnalytics.exe
File created	C:\Windows\System\OODyOPe.exe	8eb57ce74dae8e219911acc795500170_NeikiAnalytics.exe
File created	C:\Windows\System\qbdsGfu.exe	8eb57ce74dae8e219911acc795500170_NeikiAnalytics.exe
File created	C:\Windows\System\yUUOqjU.exe	8eb57ce74dae8e219911acc795500170_NeikiAnalytics.exe
File created	C:\Windows\System\aToXBbg.exe	8eb57ce74dae8e219911acc795500170_NeikiAnalytics.exe
File created	C:\Windows\System\JqIEocI.exe	8eb57ce74dae8e219911acc795500170_NeikiAnalytics.exe
File created	C:\Windows\System\CVwtTAg.exe	8eb57ce74dae8e219911acc795500170_NeikiAnalytics.exe
File created	C:\Windows\System\VbnsYhQ.exe	8eb57ce74dae8e219911acc795500170_NeikiAnalytics.exe
File created	C:\Windows\System\PVLUXje.exe	8eb57ce74dae8e219911acc795500170_NeikiAnalytics.exe
File created	C:\Windows\System\jfHrmDS.exe	8eb57ce74dae8e219911acc795500170_NeikiAnalytics.exe
File created	C:\Windows\System\GubwBcT.exe	8eb57ce74dae8e219911acc795500170_NeikiAnalytics.exe
File created	C:\Windows\System\cUGVrLz.exe	8eb57ce74dae8e219911acc795500170_NeikiAnalytics.exe
File created	C:\Windows\System\fWUyPXL.exe	8eb57ce74dae8e219911acc795500170_NeikiAnalytics.exe
File created	C:\Windows\System\OIlCGsu.exe	8eb57ce74dae8e219911acc795500170_NeikiAnalytics.exe
File created	C:\Windows\System\RCVDLBB.exe	8eb57ce74dae8e219911acc795500170_NeikiAnalytics.exe
File created	C:\Windows\System\XIhOfJa.exe	8eb57ce74dae8e219911acc795500170_NeikiAnalytics.exe
File created	C:\Windows\System\ZuSrBwk.exe	8eb57ce74dae8e219911acc795500170_NeikiAnalytics.exe
File created	C:\Windows\System\SSVXdvp.exe	8eb57ce74dae8e219911acc795500170_NeikiAnalytics.exe
File created	C:\Windows\System\sepExxw.exe	8eb57ce74dae8e219911acc795500170_NeikiAnalytics.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2864	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	1068	8eb57ce74dae8e219911acc795500170_NeikiAnalytics.exe
Token: SeLockMemoryPrivilege	1068	8eb57ce74dae8e219911acc795500170_NeikiAnalytics.exe
Token: SeDebugPrivilege	2864	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1068 wrote to memory of 2864	1068	8eb57ce74dae8e219911acc795500170_NeikiAnalytics.exe	29
PID 1068 wrote to memory of 2864	1068	8eb57ce74dae8e219911acc795500170_NeikiAnalytics.exe	29
PID 1068 wrote to memory of 2864	1068	8eb57ce74dae8e219911acc795500170_NeikiAnalytics.exe	29
PID 1068 wrote to memory of 2332	1068	8eb57ce74dae8e219911acc795500170_NeikiAnalytics.exe	30
PID 1068 wrote to memory of 2332	1068	8eb57ce74dae8e219911acc795500170_NeikiAnalytics.exe	30
PID 1068 wrote to memory of 2332	1068	8eb57ce74dae8e219911acc795500170_NeikiAnalytics.exe	30
PID 1068 wrote to memory of 2148	1068	8eb57ce74dae8e219911acc795500170_NeikiAnalytics.exe	31
PID 1068 wrote to memory of 2148	1068	8eb57ce74dae8e219911acc795500170_NeikiAnalytics.exe	31
PID 1068 wrote to memory of 2148	1068	8eb57ce74dae8e219911acc795500170_NeikiAnalytics.exe	31
PID 1068 wrote to memory of 2740	1068	8eb57ce74dae8e219911acc795500170_NeikiAnalytics.exe	32
PID 1068 wrote to memory of 2740	1068	8eb57ce74dae8e219911acc795500170_NeikiAnalytics.exe	32
PID 1068 wrote to memory of 2740	1068	8eb57ce74dae8e219911acc795500170_NeikiAnalytics.exe	32
PID 1068 wrote to memory of 1272	1068	8eb57ce74dae8e219911acc795500170_NeikiAnalytics.exe	33
PID 1068 wrote to memory of 1272	1068	8eb57ce74dae8e219911acc795500170_NeikiAnalytics.exe	33
PID 1068 wrote to memory of 1272	1068	8eb57ce74dae8e219911acc795500170_NeikiAnalytics.exe	33
PID 1068 wrote to memory of 2596	1068	8eb57ce74dae8e219911acc795500170_NeikiAnalytics.exe	34
PID 1068 wrote to memory of 2596	1068	8eb57ce74dae8e219911acc795500170_NeikiAnalytics.exe	34
PID 1068 wrote to memory of 2596	1068	8eb57ce74dae8e219911acc795500170_NeikiAnalytics.exe	34
PID 1068 wrote to memory of 2560	1068	8eb57ce74dae8e219911acc795500170_NeikiAnalytics.exe	35
PID 1068 wrote to memory of 2560	1068	8eb57ce74dae8e219911acc795500170_NeikiAnalytics.exe	35
PID 1068 wrote to memory of 2560	1068	8eb57ce74dae8e219911acc795500170_NeikiAnalytics.exe	35
PID 1068 wrote to memory of 2528	1068	8eb57ce74dae8e219911acc795500170_NeikiAnalytics.exe	36
PID 1068 wrote to memory of 2528	1068	8eb57ce74dae8e219911acc795500170_NeikiAnalytics.exe	36
PID 1068 wrote to memory of 2528	1068	8eb57ce74dae8e219911acc795500170_NeikiAnalytics.exe	36
PID 1068 wrote to memory of 2908	1068	8eb57ce74dae8e219911acc795500170_NeikiAnalytics.exe	37
PID 1068 wrote to memory of 2908	1068	8eb57ce74dae8e219911acc795500170_NeikiAnalytics.exe	37
PID 1068 wrote to memory of 2908	1068	8eb57ce74dae8e219911acc795500170_NeikiAnalytics.exe	37
PID 1068 wrote to memory of 2244	1068	8eb57ce74dae8e219911acc795500170_NeikiAnalytics.exe	38
PID 1068 wrote to memory of 2244	1068	8eb57ce74dae8e219911acc795500170_NeikiAnalytics.exe	38
PID 1068 wrote to memory of 2244	1068	8eb57ce74dae8e219911acc795500170_NeikiAnalytics.exe	38
PID 1068 wrote to memory of 2676	1068	8eb57ce74dae8e219911acc795500170_NeikiAnalytics.exe	39
PID 1068 wrote to memory of 2676	1068	8eb57ce74dae8e219911acc795500170_NeikiAnalytics.exe	39
PID 1068 wrote to memory of 2676	1068	8eb57ce74dae8e219911acc795500170_NeikiAnalytics.exe	39
PID 1068 wrote to memory of 2516	1068	8eb57ce74dae8e219911acc795500170_NeikiAnalytics.exe	40
PID 1068 wrote to memory of 2516	1068	8eb57ce74dae8e219911acc795500170_NeikiAnalytics.exe	40
PID 1068 wrote to memory of 2516	1068	8eb57ce74dae8e219911acc795500170_NeikiAnalytics.exe	40
PID 1068 wrote to memory of 2416	1068	8eb57ce74dae8e219911acc795500170_NeikiAnalytics.exe	41
PID 1068 wrote to memory of 2416	1068	8eb57ce74dae8e219911acc795500170_NeikiAnalytics.exe	41
PID 1068 wrote to memory of 2416	1068	8eb57ce74dae8e219911acc795500170_NeikiAnalytics.exe	41
PID 1068 wrote to memory of 2476	1068	8eb57ce74dae8e219911acc795500170_NeikiAnalytics.exe	42
PID 1068 wrote to memory of 2476	1068	8eb57ce74dae8e219911acc795500170_NeikiAnalytics.exe	42
PID 1068 wrote to memory of 2476	1068	8eb57ce74dae8e219911acc795500170_NeikiAnalytics.exe	42
PID 1068 wrote to memory of 2464	1068	8eb57ce74dae8e219911acc795500170_NeikiAnalytics.exe	43
PID 1068 wrote to memory of 2464	1068	8eb57ce74dae8e219911acc795500170_NeikiAnalytics.exe	43
PID 1068 wrote to memory of 2464	1068	8eb57ce74dae8e219911acc795500170_NeikiAnalytics.exe	43
PID 1068 wrote to memory of 2984	1068	8eb57ce74dae8e219911acc795500170_NeikiAnalytics.exe	44
PID 1068 wrote to memory of 2984	1068	8eb57ce74dae8e219911acc795500170_NeikiAnalytics.exe	44
PID 1068 wrote to memory of 2984	1068	8eb57ce74dae8e219911acc795500170_NeikiAnalytics.exe	44
PID 1068 wrote to memory of 2848	1068	8eb57ce74dae8e219911acc795500170_NeikiAnalytics.exe	45
PID 1068 wrote to memory of 2848	1068	8eb57ce74dae8e219911acc795500170_NeikiAnalytics.exe	45
PID 1068 wrote to memory of 2848	1068	8eb57ce74dae8e219911acc795500170_NeikiAnalytics.exe	45
PID 1068 wrote to memory of 1924	1068	8eb57ce74dae8e219911acc795500170_NeikiAnalytics.exe	46
PID 1068 wrote to memory of 1924	1068	8eb57ce74dae8e219911acc795500170_NeikiAnalytics.exe	46
PID 1068 wrote to memory of 1924	1068	8eb57ce74dae8e219911acc795500170_NeikiAnalytics.exe	46
PID 1068 wrote to memory of 1512	1068	8eb57ce74dae8e219911acc795500170_NeikiAnalytics.exe	47
PID 1068 wrote to memory of 1512	1068	8eb57ce74dae8e219911acc795500170_NeikiAnalytics.exe	47
PID 1068 wrote to memory of 1512	1068	8eb57ce74dae8e219911acc795500170_NeikiAnalytics.exe	47
PID 1068 wrote to memory of 1060	1068	8eb57ce74dae8e219911acc795500170_NeikiAnalytics.exe	48
PID 1068 wrote to memory of 1060	1068	8eb57ce74dae8e219911acc795500170_NeikiAnalytics.exe	48
PID 1068 wrote to memory of 1060	1068	8eb57ce74dae8e219911acc795500170_NeikiAnalytics.exe	48
PID 1068 wrote to memory of 1948	1068	8eb57ce74dae8e219911acc795500170_NeikiAnalytics.exe	49
PID 1068 wrote to memory of 1948	1068	8eb57ce74dae8e219911acc795500170_NeikiAnalytics.exe	49
PID 1068 wrote to memory of 1948	1068	8eb57ce74dae8e219911acc795500170_NeikiAnalytics.exe	49
PID 1068 wrote to memory of 2392	1068	8eb57ce74dae8e219911acc795500170_NeikiAnalytics.exe	50

C:\Users\Admin\AppData\Local\Temp\8eb57ce74dae8e219911acc795500170_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\8eb57ce74dae8e219911acc795500170_NeikiAnalytics.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1068
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2864
- C:\Windows\System\PHSzJBb.exe
  C:\Windows\System\PHSzJBb.exe
  2⤵
  - Executes dropped EXE
  PID:2332
- C:\Windows\System\NTUImws.exe
  C:\Windows\System\NTUImws.exe
  2⤵
  - Executes dropped EXE
  PID:2148
- C:\Windows\System\pqMKJXj.exe
  C:\Windows\System\pqMKJXj.exe
  2⤵
  - Executes dropped EXE
  PID:2740
- C:\Windows\System\mtaAyPI.exe
  C:\Windows\System\mtaAyPI.exe
  2⤵
  - Executes dropped EXE
  PID:1272
- C:\Windows\System\WgMftYD.exe
  C:\Windows\System\WgMftYD.exe
  2⤵
  - Executes dropped EXE
  PID:2596
- C:\Windows\System\yTKXhHg.exe
  C:\Windows\System\yTKXhHg.exe
  2⤵
  - Executes dropped EXE
  PID:2560
- C:\Windows\System\NCtQCvX.exe
  C:\Windows\System\NCtQCvX.exe
  2⤵
  - Executes dropped EXE
  PID:2528
- C:\Windows\System\kXpFGYf.exe
  C:\Windows\System\kXpFGYf.exe
  2⤵
  - Executes dropped EXE
  PID:2908
- C:\Windows\System\xZqNoHq.exe
  C:\Windows\System\xZqNoHq.exe
  2⤵
  - Executes dropped EXE
  PID:2244
- C:\Windows\System\HgYSuPY.exe
  C:\Windows\System\HgYSuPY.exe
  2⤵
  - Executes dropped EXE
  PID:2676
- C:\Windows\System\pPZdxII.exe
  C:\Windows\System\pPZdxII.exe
  2⤵
  - Executes dropped EXE
  PID:2516
- C:\Windows\System\maZrlNK.exe
  C:\Windows\System\maZrlNK.exe
  2⤵
  - Executes dropped EXE
  PID:2416
- C:\Windows\System\GuWjzFB.exe
  C:\Windows\System\GuWjzFB.exe
  2⤵
  - Executes dropped EXE
  PID:2476
- C:\Windows\System\kMNLqvx.exe
  C:\Windows\System\kMNLqvx.exe
  2⤵
  - Executes dropped EXE
  PID:2464
- C:\Windows\System\UkimAHG.exe
  C:\Windows\System\UkimAHG.exe
  2⤵
  - Executes dropped EXE
  PID:2984
- C:\Windows\System\dsBzEHf.exe
  C:\Windows\System\dsBzEHf.exe
  2⤵
  - Executes dropped EXE
  PID:2848
- C:\Windows\System\nILZMSb.exe
  C:\Windows\System\nILZMSb.exe
  2⤵
  - Executes dropped EXE
  PID:1924
- C:\Windows\System\aztFqPO.exe
  C:\Windows\System\aztFqPO.exe
  2⤵
  - Executes dropped EXE
  PID:1512
- C:\Windows\System\TcOoZCC.exe
  C:\Windows\System\TcOoZCC.exe
  2⤵
  - Executes dropped EXE
  PID:1060
- C:\Windows\System\DupPeRH.exe
  C:\Windows\System\DupPeRH.exe
  2⤵
  - Executes dropped EXE
  PID:1948
- C:\Windows\System\CKKHAGm.exe
  C:\Windows\System\CKKHAGm.exe
  2⤵
  - Executes dropped EXE
  PID:2392
- C:\Windows\System\zMVecDv.exe
  C:\Windows\System\zMVecDv.exe
  2⤵
  - Executes dropped EXE
  PID:856
- C:\Windows\System\BTBpHDG.exe
  C:\Windows\System\BTBpHDG.exe
  2⤵
  - Executes dropped EXE
  PID:1408
- C:\Windows\System\MPHlvBr.exe
  C:\Windows\System\MPHlvBr.exe
  2⤵
  - Executes dropped EXE
  PID:2744
- C:\Windows\System\KYxdXjV.exe
  C:\Windows\System\KYxdXjV.exe
  2⤵
  - Executes dropped EXE
  PID:2072
- C:\Windows\System\VcMmpKg.exe
  C:\Windows\System\VcMmpKg.exe
  2⤵
  - Executes dropped EXE
  PID:656
- C:\Windows\System\tPCEscq.exe
  C:\Windows\System\tPCEscq.exe
  2⤵
  - Executes dropped EXE
  PID:2300
- C:\Windows\System\xvwLTFo.exe
  C:\Windows\System\xvwLTFo.exe
  2⤵
  - Executes dropped EXE
  PID:1688
- C:\Windows\System\FhnyRqv.exe
  C:\Windows\System\FhnyRqv.exe
  2⤵
  - Executes dropped EXE
  PID:2372
- C:\Windows\System\qssZgAO.exe
  C:\Windows\System\qssZgAO.exe
  2⤵
  - Executes dropped EXE
  PID:340
- C:\Windows\System\FbiDEGm.exe
  C:\Windows\System\FbiDEGm.exe
  2⤵
  - Executes dropped EXE
  PID:3040
- C:\Windows\System\XaOTwSq.exe
  C:\Windows\System\XaOTwSq.exe
  2⤵
  - Executes dropped EXE
  PID:2768
- C:\Windows\System\oeUzoPs.exe
  C:\Windows\System\oeUzoPs.exe
  2⤵
  - Executes dropped EXE
  PID:1380
- C:\Windows\System\sdPewcm.exe
  C:\Windows\System\sdPewcm.exe
  2⤵
  - Executes dropped EXE
  PID:1656
- C:\Windows\System\VCsWFLf.exe
  C:\Windows\System\VCsWFLf.exe
  2⤵
  - Executes dropped EXE
  PID:1824
- C:\Windows\System\dMkdTAX.exe
  C:\Windows\System\dMkdTAX.exe
  2⤵
  - Executes dropped EXE
  PID:776
- C:\Windows\System\PSOWEOR.exe
  C:\Windows\System\PSOWEOR.exe
  2⤵
  - Executes dropped EXE
  PID:1040
- C:\Windows\System\hgRfzve.exe
  C:\Windows\System\hgRfzve.exe
  2⤵
  - Executes dropped EXE
  PID:552
- C:\Windows\System\asvrzfX.exe
  C:\Windows\System\asvrzfX.exe
  2⤵
  - Executes dropped EXE
  PID:1748
- C:\Windows\System\WMwVYxM.exe
  C:\Windows\System\WMwVYxM.exe
  2⤵
  - Executes dropped EXE
  PID:108
- C:\Windows\System\TwColLG.exe
  C:\Windows\System\TwColLG.exe
  2⤵
  - Executes dropped EXE
  PID:1720
- C:\Windows\System\tISuMwp.exe
  C:\Windows\System\tISuMwp.exe
  2⤵
  - Executes dropped EXE
  PID:3008
- C:\Windows\System\dlVuUlQ.exe
  C:\Windows\System\dlVuUlQ.exe
  2⤵
  - Executes dropped EXE
  PID:2104
- C:\Windows\System\OlCiuLc.exe
  C:\Windows\System\OlCiuLc.exe
  2⤵
  - Executes dropped EXE
  PID:1672
- C:\Windows\System\aKGjvwl.exe
  C:\Windows\System\aKGjvwl.exe
  2⤵
  - Executes dropped EXE
  PID:3012
- C:\Windows\System\zCREFqu.exe
  C:\Windows\System\zCREFqu.exe
  2⤵
  - Executes dropped EXE
  PID:1256
- C:\Windows\System\EjIyZTD.exe
  C:\Windows\System\EjIyZTD.exe
  2⤵
  - Executes dropped EXE
  PID:1752
- C:\Windows\System\ZnJkiaw.exe
  C:\Windows\System\ZnJkiaw.exe
  2⤵
  - Executes dropped EXE
  PID:2860
- C:\Windows\System\EMUHRgT.exe
  C:\Windows\System\EMUHRgT.exe
  2⤵
  - Executes dropped EXE
  PID:2892
- C:\Windows\System\cOvboXV.exe
  C:\Windows\System\cOvboXV.exe
  2⤵
  - Executes dropped EXE
  PID:2280
- C:\Windows\System\GGiFiLZ.exe
  C:\Windows\System\GGiFiLZ.exe
  2⤵
  - Executes dropped EXE
  PID:2808
- C:\Windows\System\VXXIGbW.exe
  C:\Windows\System\VXXIGbW.exe
  2⤵
  - Executes dropped EXE
  PID:1640
- C:\Windows\System\ZfuHOCa.exe
  C:\Windows\System\ZfuHOCa.exe
  2⤵
  - Executes dropped EXE
  PID:2552
- C:\Windows\System\nNocAwn.exe
  C:\Windows\System\nNocAwn.exe
  2⤵
  - Executes dropped EXE
  PID:2536
- C:\Windows\System\sjYkPLe.exe
  C:\Windows\System\sjYkPLe.exe
  2⤵
  - Executes dropped EXE
  PID:2096
- C:\Windows\System\QssVBzK.exe
  C:\Windows\System\QssVBzK.exe
  2⤵
  - Executes dropped EXE
  PID:2544
- C:\Windows\System\YXDHlkS.exe
  C:\Windows\System\YXDHlkS.exe
  2⤵
  - Executes dropped EXE
  PID:2380
- C:\Windows\System\ExEPWBJ.exe
  C:\Windows\System\ExEPWBJ.exe
  2⤵
  - Executes dropped EXE
  PID:2568
- C:\Windows\System\uunxFCC.exe
  C:\Windows\System\uunxFCC.exe
  2⤵
  - Executes dropped EXE
  PID:1628
- C:\Windows\System\RmeoeIv.exe
  C:\Windows\System\RmeoeIv.exe
  2⤵
  - Executes dropped EXE
  PID:2696
- C:\Windows\System\kSNSaHF.exe
  C:\Windows\System\kSNSaHF.exe
  2⤵
  - Executes dropped EXE
  PID:1452
- C:\Windows\System\vlRWHux.exe
  C:\Windows\System\vlRWHux.exe
  2⤵
  - Executes dropped EXE
  PID:1500
- C:\Windows\System\mmDtYna.exe
  C:\Windows\System\mmDtYna.exe
  2⤵
  - Executes dropped EXE
  PID:1920
- C:\Windows\System\tOQBmcE.exe
  C:\Windows\System\tOQBmcE.exe
  2⤵
  - Executes dropped EXE
  PID:2144
- C:\Windows\System\QrrPkQH.exe
  C:\Windows\System\QrrPkQH.exe
  2⤵
  PID:3060
- C:\Windows\System\iNNVKbx.exe
  C:\Windows\System\iNNVKbx.exe
  2⤵
  PID:1764
- C:\Windows\System\ulLfqJv.exe
  C:\Windows\System\ulLfqJv.exe
  2⤵
  PID:1992
- C:\Windows\System\poqEVWj.exe
  C:\Windows\System\poqEVWj.exe
  2⤵
  PID:1744
- C:\Windows\System\JtkkSWT.exe
  C:\Windows\System\JtkkSWT.exe
  2⤵
  PID:1596
- C:\Windows\System\vqoNLNS.exe
  C:\Windows\System\vqoNLNS.exe
  2⤵
  PID:2236
- C:\Windows\System\BxQZdhQ.exe
  C:\Windows\System\BxQZdhQ.exe
  2⤵
  PID:1144
- C:\Windows\System\YEDQIqb.exe
  C:\Windows\System\YEDQIqb.exe
  2⤵
  PID:1524
- C:\Windows\System\mlqlMGh.exe
  C:\Windows\System\mlqlMGh.exe
  2⤵
  PID:1288
- C:\Windows\System\JbzlMxM.exe
  C:\Windows\System\JbzlMxM.exe
  2⤵
  PID:560
- C:\Windows\System\vYXSrjn.exe
  C:\Windows\System\vYXSrjn.exe
  2⤵
  PID:912
- C:\Windows\System\JkFoJeA.exe
  C:\Windows\System\JkFoJeA.exe
  2⤵
  PID:3020
- C:\Windows\System\JsErATi.exe
  C:\Windows\System\JsErATi.exe
  2⤵
  PID:2128
- C:\Windows\System\ImaXjwy.exe
  C:\Windows\System\ImaXjwy.exe
  2⤵
  PID:1960
- C:\Windows\System\VFPAmvN.exe
  C:\Windows\System\VFPAmvN.exe
  2⤵
  PID:2708
- C:\Windows\System\EooreND.exe
  C:\Windows\System\EooreND.exe
  2⤵
  PID:2876
- C:\Windows\System\MzwHpXO.exe
  C:\Windows\System\MzwHpXO.exe
  2⤵
  PID:2040
- C:\Windows\System\yhtwEgE.exe
  C:\Windows\System\yhtwEgE.exe
  2⤵
  PID:2916
- C:\Windows\System\FAmlBBe.exe
  C:\Windows\System\FAmlBBe.exe
  2⤵
  PID:1588
- C:\Windows\System\lGcHLBE.exe
  C:\Windows\System\lGcHLBE.exe
  2⤵
  PID:2640
- C:\Windows\System\rSwSBOD.exe
  C:\Windows\System\rSwSBOD.exe
  2⤵
  PID:2512
- C:\Windows\System\QZZtEYo.exe
  C:\Windows\System\QZZtEYo.exe
  2⤵
  PID:1692
- C:\Windows\System\SejIimw.exe
  C:\Windows\System\SejIimw.exe
  2⤵
  PID:2256
- C:\Windows\System\zDguPzl.exe
  C:\Windows\System\zDguPzl.exe
  2⤵
  PID:2268
- C:\Windows\System\drowjel.exe
  C:\Windows\System\drowjel.exe
  2⤵
  PID:852
- C:\Windows\System\fmUxSpG.exe
  C:\Windows\System\fmUxSpG.exe
  2⤵
  PID:956
- C:\Windows\System\rMAgIsD.exe
  C:\Windows\System\rMAgIsD.exe
  2⤵
  PID:2920
- C:\Windows\System\JvuPAmG.exe
  C:\Windows\System\JvuPAmG.exe
  2⤵
  PID:2000
- C:\Windows\System\nGEoocu.exe
  C:\Windows\System\nGEoocu.exe
  2⤵
  PID:1244
- C:\Windows\System\XmcoWdi.exe
  C:\Windows\System\XmcoWdi.exe
  2⤵
  PID:1760
- C:\Windows\System\LGsnVVA.exe
  C:\Windows\System\LGsnVVA.exe
  2⤵
  PID:1868
- C:\Windows\System\MEHQrry.exe
  C:\Windows\System\MEHQrry.exe
  2⤵
  PID:1492
- C:\Windows\System\kBpZSOs.exe
  C:\Windows\System\kBpZSOs.exe
  2⤵
  PID:2904
- C:\Windows\System\BTIeRPY.exe
  C:\Windows\System\BTIeRPY.exe
  2⤵
  PID:3080
- C:\Windows\System\qVwmnJp.exe
  C:\Windows\System\qVwmnJp.exe
  2⤵
  PID:3100
- C:\Windows\System\QWcfayf.exe
  C:\Windows\System\QWcfayf.exe
  2⤵
  PID:3120
- C:\Windows\System\EFQTHWN.exe
  C:\Windows\System\EFQTHWN.exe
  2⤵
  PID:3140
- C:\Windows\System\FabrwFI.exe
  C:\Windows\System\FabrwFI.exe
  2⤵
  PID:3160
- C:\Windows\System\SAIfDgz.exe
  C:\Windows\System\SAIfDgz.exe
  2⤵
  PID:3188
- C:\Windows\System\qQyPXAR.exe
  C:\Windows\System\qQyPXAR.exe
  2⤵
  PID:3212
- C:\Windows\System\ZsAMSgL.exe
  C:\Windows\System\ZsAMSgL.exe
  2⤵
  PID:3228
- C:\Windows\System\BtIlFuc.exe
  C:\Windows\System\BtIlFuc.exe
  2⤵
  PID:3248
- C:\Windows\System\BYSHRTm.exe
  C:\Windows\System\BYSHRTm.exe
  2⤵
  PID:3264
- C:\Windows\System\GHzStxp.exe
  C:\Windows\System\GHzStxp.exe
  2⤵
  PID:3280
- C:\Windows\System\NMVFFUE.exe
  C:\Windows\System\NMVFFUE.exe
  2⤵
  PID:3296
- C:\Windows\System\AFIcNRt.exe
  C:\Windows\System\AFIcNRt.exe
  2⤵
  PID:3316
- C:\Windows\System\pnJBjQO.exe
  C:\Windows\System\pnJBjQO.exe
  2⤵
  PID:3332
- C:\Windows\System\OtSsHoU.exe
  C:\Windows\System\OtSsHoU.exe
  2⤵
  PID:3352
- C:\Windows\System\pxlSSSm.exe
  C:\Windows\System\pxlSSSm.exe
  2⤵
  PID:3376
- C:\Windows\System\sLXFyKC.exe
  C:\Windows\System\sLXFyKC.exe
  2⤵
  PID:3396
- C:\Windows\System\ISPVPXG.exe
  C:\Windows\System\ISPVPXG.exe
  2⤵
  PID:3412
- C:\Windows\System\atOZXPn.exe
  C:\Windows\System\atOZXPn.exe
  2⤵
  PID:3432
- C:\Windows\System\MIDSuNb.exe
  C:\Windows\System\MIDSuNb.exe
  2⤵
  PID:3448
- C:\Windows\System\vhbFRcp.exe
  C:\Windows\System\vhbFRcp.exe
  2⤵
  PID:3468
- C:\Windows\System\CzCbDny.exe
  C:\Windows\System\CzCbDny.exe
  2⤵
  PID:3488
- C:\Windows\System\gfChOiF.exe
  C:\Windows\System\gfChOiF.exe
  2⤵
  PID:3508
- C:\Windows\System\gfflXdp.exe
  C:\Windows\System\gfflXdp.exe
  2⤵
  PID:3528
- C:\Windows\System\gRSSCni.exe
  C:\Windows\System\gRSSCni.exe
  2⤵
  PID:3548
- C:\Windows\System\SBAVlJi.exe
  C:\Windows\System\SBAVlJi.exe
  2⤵
  PID:3568
- C:\Windows\System\ybmfEqk.exe
  C:\Windows\System\ybmfEqk.exe
  2⤵
  PID:3588
- C:\Windows\System\SjLyOCe.exe
  C:\Windows\System\SjLyOCe.exe
  2⤵
  PID:3608
- C:\Windows\System\ynixalA.exe
  C:\Windows\System\ynixalA.exe
  2⤵
  PID:3624
- C:\Windows\System\nkJCdOA.exe
  C:\Windows\System\nkJCdOA.exe
  2⤵
  PID:3648
- C:\Windows\System\kuIjAfw.exe
  C:\Windows\System\kuIjAfw.exe
  2⤵
  PID:3668
- C:\Windows\System\rxGmOSU.exe
  C:\Windows\System\rxGmOSU.exe
  2⤵
  PID:3688
- C:\Windows\System\LTKrsaR.exe
  C:\Windows\System\LTKrsaR.exe
  2⤵
  PID:3708
- C:\Windows\System\PzPhAMz.exe
  C:\Windows\System\PzPhAMz.exe
  2⤵
  PID:3728
- C:\Windows\System\mOiCRII.exe
  C:\Windows\System\mOiCRII.exe
  2⤵
  PID:3748
- C:\Windows\System\USuyAlT.exe
  C:\Windows\System\USuyAlT.exe
  2⤵
  PID:3768
- C:\Windows\System\CPClkKF.exe
  C:\Windows\System\CPClkKF.exe
  2⤵
  PID:3784
- C:\Windows\System\vCTgbHH.exe
  C:\Windows\System\vCTgbHH.exe
  2⤵
  PID:3804
- C:\Windows\System\JIiAZbS.exe
  C:\Windows\System\JIiAZbS.exe
  2⤵
  PID:3828
- C:\Windows\System\BayEwVx.exe
  C:\Windows\System\BayEwVx.exe
  2⤵
  PID:3908
- C:\Windows\System\wBEswSe.exe
  C:\Windows\System\wBEswSe.exe
  2⤵
  PID:3928
- C:\Windows\System\lEWbvsR.exe
  C:\Windows\System\lEWbvsR.exe
  2⤵
  PID:3948
- C:\Windows\System\WaUIJuz.exe
  C:\Windows\System\WaUIJuz.exe
  2⤵
  PID:3968
- C:\Windows\System\jKPILPj.exe
  C:\Windows\System\jKPILPj.exe
  2⤵
  PID:3988
- C:\Windows\System\OmPnxhn.exe
  C:\Windows\System\OmPnxhn.exe
  2⤵
  PID:4008
- C:\Windows\System\BAEBwcA.exe
  C:\Windows\System\BAEBwcA.exe
  2⤵
  PID:4028
- C:\Windows\System\wUUwiJy.exe
  C:\Windows\System\wUUwiJy.exe
  2⤵
  PID:4048
- C:\Windows\System\vTsYnpL.exe
  C:\Windows\System\vTsYnpL.exe
  2⤵
  PID:4068
- C:\Windows\System\SexoroK.exe
  C:\Windows\System\SexoroK.exe
  2⤵
  PID:4084
- C:\Windows\System\rokoTpl.exe
  C:\Windows\System\rokoTpl.exe
  2⤵
  PID:1756
- C:\Windows\System\NMSdMAS.exe
  C:\Windows\System\NMSdMAS.exe
  2⤵
  PID:1716
- C:\Windows\System\UJkpMvI.exe
  C:\Windows\System\UJkpMvI.exe
  2⤵
  PID:2404
- C:\Windows\System\ggPspse.exe
  C:\Windows\System\ggPspse.exe
  2⤵
  PID:2572
- C:\Windows\System\OerCAHH.exe
  C:\Windows\System\OerCAHH.exe
  2⤵
  PID:2112
- C:\Windows\System\rGTgRDd.exe
  C:\Windows\System\rGTgRDd.exe
  2⤵
  PID:2792
- C:\Windows\System\FoFCzQe.exe
  C:\Windows\System\FoFCzQe.exe
  2⤵
  PID:1952
- C:\Windows\System\GlBbZib.exe
  C:\Windows\System\GlBbZib.exe
  2⤵
  PID:944
- C:\Windows\System\hEjAkVM.exe
  C:\Windows\System\hEjAkVM.exe
  2⤵
  PID:1340
- C:\Windows\System\QGjNgyq.exe
  C:\Windows\System\QGjNgyq.exe
  2⤵
  PID:3148
- C:\Windows\System\RHvThMB.exe
  C:\Windows\System\RHvThMB.exe
  2⤵
  PID:1584
- C:\Windows\System\jdGmTlQ.exe
  C:\Windows\System\jdGmTlQ.exe
  2⤵
  PID:3208
- C:\Windows\System\oDWVOoT.exe
  C:\Windows\System\oDWVOoT.exe
  2⤵
  PID:2508
- C:\Windows\System\yxtSEpS.exe
  C:\Windows\System\yxtSEpS.exe
  2⤵
  PID:3308
- C:\Windows\System\eugttIO.exe
  C:\Windows\System\eugttIO.exe
  2⤵
  PID:3384
- C:\Windows\System\KNCWcoy.exe
  C:\Windows\System\KNCWcoy.exe
  2⤵
  PID:3056
- C:\Windows\System\fEZGGFC.exe
  C:\Windows\System\fEZGGFC.exe
  2⤵
  PID:3420
- C:\Windows\System\QGnbaAn.exe
  C:\Windows\System\QGnbaAn.exe
  2⤵
  PID:2816
- C:\Windows\System\pgBiJEM.exe
  C:\Windows\System\pgBiJEM.exe
  2⤵
  PID:1608
- C:\Windows\System\HxphWac.exe
  C:\Windows\System\HxphWac.exe
  2⤵
  PID:2020
- C:\Windows\System\pdAlkwc.exe
  C:\Windows\System\pdAlkwc.exe
  2⤵
  PID:3132
- C:\Windows\System\boWtpVt.exe
  C:\Windows\System\boWtpVt.exe
  2⤵
  PID:3092
- C:\Windows\System\pTJCkJa.exe
  C:\Windows\System\pTJCkJa.exe
  2⤵
  PID:3184
- C:\Windows\System\aNTCRJy.exe
  C:\Windows\System\aNTCRJy.exe
  2⤵
  PID:3616
- C:\Windows\System\RWUgJDv.exe
  C:\Windows\System\RWUgJDv.exe
  2⤵
  PID:3288
- C:\Windows\System\gmEpffv.exe
  C:\Windows\System\gmEpffv.exe
  2⤵
  PID:3660
- C:\Windows\System\oeJjWUu.exe
  C:\Windows\System\oeJjWUu.exe
  2⤵
  PID:3744
- C:\Windows\System\nhOTQTU.exe
  C:\Windows\System\nhOTQTU.exe
  2⤵
  PID:3364
- C:\Windows\System\wgBrxQz.exe
  C:\Windows\System\wgBrxQz.exe
  2⤵
  PID:3408
- C:\Windows\System\IOJOHnm.exe
  C:\Windows\System\IOJOHnm.exe
  2⤵
  PID:3816
- C:\Windows\System\PoxMUjD.exe
  C:\Windows\System\PoxMUjD.exe
  2⤵
  PID:3820
- C:\Windows\System\YkAbTmN.exe
  C:\Windows\System\YkAbTmN.exe
  2⤵
  PID:3564
- C:\Windows\System\mpNtekD.exe
  C:\Windows\System\mpNtekD.exe
  2⤵
  PID:3640
- C:\Windows\System\NaIssmV.exe
  C:\Windows\System\NaIssmV.exe
  2⤵
  PID:3684
- C:\Windows\System\cUhCkdC.exe
  C:\Windows\System\cUhCkdC.exe
  2⤵
  PID:3760
- C:\Windows\System\KHFhFsg.exe
  C:\Windows\System\KHFhFsg.exe
  2⤵
  PID:3836
- C:\Windows\System\qrogQLX.exe
  C:\Windows\System\qrogQLX.exe
  2⤵
  PID:3844
- C:\Windows\System\nepVFGL.exe
  C:\Windows\System\nepVFGL.exe
  2⤵
  PID:3860
- C:\Windows\System\dlGGVJg.exe
  C:\Windows\System\dlGGVJg.exe
  2⤵
  PID:3956
- C:\Windows\System\cFBxsqD.exe
  C:\Windows\System\cFBxsqD.exe
  2⤵
  PID:3996
- C:\Windows\System\mTGmrFC.exe
  C:\Windows\System\mTGmrFC.exe
  2⤵
  PID:4076
- C:\Windows\System\yOctbcO.exe
  C:\Windows\System\yOctbcO.exe
  2⤵
  PID:3936
- C:\Windows\System\YnjPEqy.exe
  C:\Windows\System\YnjPEqy.exe
  2⤵
  PID:2432
- C:\Windows\System\CXeOins.exe
  C:\Windows\System\CXeOins.exe
  2⤵
  PID:4020
- C:\Windows\System\jAmWqNc.exe
  C:\Windows\System\jAmWqNc.exe
  2⤵
  PID:1332
- C:\Windows\System\suNSYdr.exe
  C:\Windows\System\suNSYdr.exe
  2⤵
  PID:712
- C:\Windows\System\AcBsdYu.exe
  C:\Windows\System\AcBsdYu.exe
  2⤵
  PID:3276
- C:\Windows\System\AhsukIE.exe
  C:\Windows\System\AhsukIE.exe
  2⤵
  PID:2564
- C:\Windows\System\JuksJYh.exe
  C:\Windows\System\JuksJYh.exe
  2⤵
  PID:2500
- C:\Windows\System\uExHtKR.exe
  C:\Windows\System\uExHtKR.exe
  2⤵
  PID:2896
- C:\Windows\System\PfMpdFp.exe
  C:\Windows\System\PfMpdFp.exe
  2⤵
  PID:3540
- C:\Windows\System\blPpZsR.exe
  C:\Windows\System\blPpZsR.exe
  2⤵
  PID:3172
- C:\Windows\System\XUwyGpi.exe
  C:\Windows\System\XUwyGpi.exe
  2⤵
  PID:3360
- C:\Windows\System\hIawbIH.exe
  C:\Windows\System\hIawbIH.exe
  2⤵
  PID:3328
- C:\Windows\System\OKJlMLf.exe
  C:\Windows\System\OKJlMLf.exe
  2⤵
  PID:1820
- C:\Windows\System\urJNjoY.exe
  C:\Windows\System\urJNjoY.exe
  2⤵
  PID:708
- C:\Windows\System\nYmFKfF.exe
  C:\Windows\System\nYmFKfF.exe
  2⤵
  PID:3536
- C:\Windows\System\ZXzumxM.exe
  C:\Windows\System\ZXzumxM.exe
  2⤵
  PID:3812
- C:\Windows\System\rXoUlEW.exe
  C:\Windows\System\rXoUlEW.exe
  2⤵
  PID:3676
- C:\Windows\System\WDXNnVV.exe
  C:\Windows\System\WDXNnVV.exe
  2⤵
  PID:3796
- C:\Windows\System\vosMSAF.exe
  C:\Windows\System\vosMSAF.exe
  2⤵
  PID:2004
- C:\Windows\System\HXpuhbs.exe
  C:\Windows\System\HXpuhbs.exe
  2⤵
  PID:3180
- C:\Windows\System\ZkcURik.exe
  C:\Windows\System\ZkcURik.exe
  2⤵
  PID:4064
- C:\Windows\System\uuTZZdH.exe
  C:\Windows\System\uuTZZdH.exe
  2⤵
  PID:2836
- C:\Windows\System\yzSmbbg.exe
  C:\Windows\System\yzSmbbg.exe
  2⤵
  PID:3700
- C:\Windows\System\HbQOYfU.exe
  C:\Windows\System\HbQOYfU.exe
  2⤵
  PID:1544
- C:\Windows\System\yLRFlSP.exe
  C:\Windows\System\yLRFlSP.exe
  2⤵
  PID:1560
- C:\Windows\System\tBJNpgK.exe
  C:\Windows\System\tBJNpgK.exe
  2⤵
  PID:4000
- C:\Windows\System\YoCHvdi.exe
  C:\Windows\System\YoCHvdi.exe
  2⤵
  PID:2924
- C:\Windows\System\OYqrVYN.exe
  C:\Windows\System\OYqrVYN.exe
  2⤵
  PID:3112
- C:\Windows\System\EfCuDjT.exe
  C:\Windows\System\EfCuDjT.exe
  2⤵
  PID:1520
- C:\Windows\System\gWzPCMT.exe
  C:\Windows\System\gWzPCMT.exe
  2⤵
  PID:4092
- C:\Windows\System\PsIplkX.exe
  C:\Windows\System\PsIplkX.exe
  2⤵
  PID:4036
- C:\Windows\System\phvqlNm.exe
  C:\Windows\System\phvqlNm.exe
  2⤵
  PID:3724
- C:\Windows\System\bfzOxBG.exe
  C:\Windows\System\bfzOxBG.exe
  2⤵
  PID:3088
- C:\Windows\System\kNMOBum.exe
  C:\Windows\System\kNMOBum.exe
  2⤵
  PID:3424
- C:\Windows\System\eeCCMDf.exe
  C:\Windows\System\eeCCMDf.exe
  2⤵
  PID:4112
- C:\Windows\System\jDVBjut.exe
  C:\Windows\System\jDVBjut.exe
  2⤵
  PID:4128
- C:\Windows\System\qEecwet.exe
  C:\Windows\System\qEecwet.exe
  2⤵
  PID:4148
- C:\Windows\System\MvhHNOG.exe
  C:\Windows\System\MvhHNOG.exe
  2⤵
  PID:4164
- C:\Windows\System\JCrrgCW.exe
  C:\Windows\System\JCrrgCW.exe
  2⤵
  PID:4188
- C:\Windows\System\HECZyue.exe
  C:\Windows\System\HECZyue.exe
  2⤵
  PID:4208
- C:\Windows\System\eCWFsou.exe
  C:\Windows\System\eCWFsou.exe
  2⤵
  PID:4224
- C:\Windows\System\DOZNfzA.exe
  C:\Windows\System\DOZNfzA.exe
  2⤵
  PID:4240
- C:\Windows\System\PQbaBTG.exe
  C:\Windows\System\PQbaBTG.exe
  2⤵
  PID:4288
- C:\Windows\System\UvvfAcM.exe
  C:\Windows\System\UvvfAcM.exe
  2⤵
  PID:4308
- C:\Windows\System\vbSXTxe.exe
  C:\Windows\System\vbSXTxe.exe
  2⤵
  PID:4324
- C:\Windows\System\ydzCyWn.exe
  C:\Windows\System\ydzCyWn.exe
  2⤵
  PID:4340
- C:\Windows\System\KAKHfIP.exe
  C:\Windows\System\KAKHfIP.exe
  2⤵
  PID:4360
- C:\Windows\System\EfQbixK.exe
  C:\Windows\System\EfQbixK.exe
  2⤵
  PID:4380
- C:\Windows\System\vPaDlzr.exe
  C:\Windows\System\vPaDlzr.exe
  2⤵
  PID:4396
- C:\Windows\System\VjkUQWF.exe
  C:\Windows\System\VjkUQWF.exe
  2⤵
  PID:4412
- C:\Windows\System\RnYYjDk.exe
  C:\Windows\System\RnYYjDk.exe
  2⤵
  PID:4432
- C:\Windows\System\NzRQgDT.exe
  C:\Windows\System\NzRQgDT.exe
  2⤵
  PID:4448
- C:\Windows\System\UwVNqkN.exe
  C:\Windows\System\UwVNqkN.exe
  2⤵
  PID:4468
- C:\Windows\System\dNmaRwX.exe
  C:\Windows\System\dNmaRwX.exe
  2⤵
  PID:4484
- C:\Windows\System\BMUKzLP.exe
  C:\Windows\System\BMUKzLP.exe
  2⤵
  PID:4508
- C:\Windows\System\qIVupMI.exe
  C:\Windows\System\qIVupMI.exe
  2⤵
  PID:4524
- C:\Windows\System\zppygnp.exe
  C:\Windows\System\zppygnp.exe
  2⤵
  PID:4548
- C:\Windows\System\qKCDOMU.exe
  C:\Windows\System\qKCDOMU.exe
  2⤵
  PID:4564
- C:\Windows\System\hihUFGJ.exe
  C:\Windows\System\hihUFGJ.exe
  2⤵
  PID:4584
- C:\Windows\System\zEySyIk.exe
  C:\Windows\System\zEySyIk.exe
  2⤵
  PID:4600
- C:\Windows\System\BBBajtg.exe
  C:\Windows\System\BBBajtg.exe
  2⤵
  PID:4620
- C:\Windows\System\RxahEzj.exe
  C:\Windows\System\RxahEzj.exe
  2⤵
  PID:4636
- C:\Windows\System\CRBrIvO.exe
  C:\Windows\System\CRBrIvO.exe
  2⤵
  PID:4656
- C:\Windows\System\kTqNtBJ.exe
  C:\Windows\System\kTqNtBJ.exe
  2⤵
  PID:4672
- C:\Windows\System\WTDEsct.exe
  C:\Windows\System\WTDEsct.exe
  2⤵
  PID:4692
- C:\Windows\System\BktmOBF.exe
  C:\Windows\System\BktmOBF.exe
  2⤵
  PID:4708
- C:\Windows\System\lpyoTcR.exe
  C:\Windows\System\lpyoTcR.exe
  2⤵
  PID:4728
- C:\Windows\System\ztrJOkq.exe
  C:\Windows\System\ztrJOkq.exe
  2⤵
  PID:4744
- C:\Windows\System\UFHFoSN.exe
  C:\Windows\System\UFHFoSN.exe
  2⤵
  PID:4768
- C:\Windows\System\WSMNeHa.exe
  C:\Windows\System\WSMNeHa.exe
  2⤵
  PID:4788
- C:\Windows\System\qsbnsLT.exe
  C:\Windows\System\qsbnsLT.exe
  2⤵
  PID:4808
- C:\Windows\System\PBeDpYQ.exe
  C:\Windows\System\PBeDpYQ.exe
  2⤵
  PID:4824
- C:\Windows\System\erkEbAr.exe
  C:\Windows\System\erkEbAr.exe
  2⤵
  PID:4848
- C:\Windows\System\uJPPbAa.exe
  C:\Windows\System\uJPPbAa.exe
  2⤵
  PID:4864
- C:\Windows\System\dwViJSH.exe
  C:\Windows\System\dwViJSH.exe
  2⤵
  PID:4888
- C:\Windows\System\mrghoEw.exe
  C:\Windows\System\mrghoEw.exe
  2⤵
  PID:4904
- C:\Windows\System\lmDhghx.exe
  C:\Windows\System\lmDhghx.exe
  2⤵
  PID:4924
- C:\Windows\System\ZBAinnk.exe
  C:\Windows\System\ZBAinnk.exe
  2⤵
  PID:4948
- C:\Windows\System\dEYwvvt.exe
  C:\Windows\System\dEYwvvt.exe
  2⤵
  PID:5024
- C:\Windows\System\qRkrTNh.exe
  C:\Windows\System\qRkrTNh.exe
  2⤵
  PID:5044
- C:\Windows\System\mIqCdsx.exe
  C:\Windows\System\mIqCdsx.exe
  2⤵
  PID:5060
- C:\Windows\System\UCGpZhx.exe
  C:\Windows\System\UCGpZhx.exe
  2⤵
  PID:5076
- C:\Windows\System\EimmBXT.exe
  C:\Windows\System\EimmBXT.exe
  2⤵
  PID:5104
- C:\Windows\System\aKAUybp.exe
  C:\Windows\System\aKAUybp.exe
  2⤵
  PID:3484
- C:\Windows\System\VojOjeq.exe
  C:\Windows\System\VojOjeq.exe
  2⤵
  PID:3656
- C:\Windows\System\rzCOUTq.exe
  C:\Windows\System\rzCOUTq.exe
  2⤵
  PID:3852
- C:\Windows\System\seSixjV.exe
  C:\Windows\System\seSixjV.exe
  2⤵
  PID:3500
- C:\Windows\System\nkBplyc.exe
  C:\Windows\System\nkBplyc.exe
  2⤵
  PID:3644
- C:\Windows\System\DBfhNbV.exe
  C:\Windows\System\DBfhNbV.exe
  2⤵
  PID:2928
- C:\Windows\System\lXRgiAu.exe
  C:\Windows\System\lXRgiAu.exe
  2⤵
  PID:2616
- C:\Windows\System\bjRWfuD.exe
  C:\Windows\System\bjRWfuD.exe
  2⤵
  PID:3840
- C:\Windows\System\WOTivDL.exe
  C:\Windows\System\WOTivDL.exe
  2⤵
  PID:3704
- C:\Windows\System\gzqFboq.exe
  C:\Windows\System\gzqFboq.exe
  2⤵
  PID:2732
- C:\Windows\System\XAKbZYP.exe
  C:\Windows\System\XAKbZYP.exe
  2⤵
  PID:3600
- C:\Windows\System\FEarAVO.exe
  C:\Windows\System\FEarAVO.exe
  2⤵
  PID:4196
- C:\Windows\System\PTSWpIA.exe
  C:\Windows\System\PTSWpIA.exe
  2⤵
  PID:4236
- C:\Windows\System\tDAxSLP.exe
  C:\Windows\System\tDAxSLP.exe
  2⤵
  PID:3604
- C:\Windows\System\IshGPOq.exe
  C:\Windows\System\IshGPOq.exe
  2⤵
  PID:4304
- C:\Windows\System\PuSmtqV.exe
  C:\Windows\System\PuSmtqV.exe
  2⤵
  PID:4372
- C:\Windows\System\AwWpQca.exe
  C:\Windows\System\AwWpQca.exe
  2⤵
  PID:4440
- C:\Windows\System\QnMmbYx.exe
  C:\Windows\System\QnMmbYx.exe
  2⤵
  PID:4520
- C:\Windows\System\BYNsoCy.exe
  C:\Windows\System\BYNsoCy.exe
  2⤵
  PID:4592
- C:\Windows\System\aERUUth.exe
  C:\Windows\System\aERUUth.exe
  2⤵
  PID:4632
- C:\Windows\System\UfTeOAp.exe
  C:\Windows\System\UfTeOAp.exe
  2⤵
  PID:4704
- C:\Windows\System\UYgUulf.exe
  C:\Windows\System\UYgUulf.exe
  2⤵
  PID:4136
- C:\Windows\System\xZotlUS.exe
  C:\Windows\System\xZotlUS.exe
  2⤵
  PID:4180
- C:\Windows\System\aBFyOyB.exe
  C:\Windows\System\aBFyOyB.exe
  2⤵
  PID:4252
- C:\Windows\System\MapvSUn.exe
  C:\Windows\System\MapvSUn.exe
  2⤵
  PID:4268
- C:\Windows\System\zoqmZNo.exe
  C:\Windows\System\zoqmZNo.exe
  2⤵
  PID:4816
- C:\Windows\System\HwlfWgc.exe
  C:\Windows\System\HwlfWgc.exe
  2⤵
  PID:4860
- C:\Windows\System\WZKNXrr.exe
  C:\Windows\System\WZKNXrr.exe
  2⤵
  PID:4940
- C:\Windows\System\eizTxqK.exe
  C:\Windows\System\eizTxqK.exe
  2⤵
  PID:2408
- C:\Windows\System\qsULqfU.exe
  C:\Windows\System\qsULqfU.exe
  2⤵
  PID:4388
- C:\Windows\System\ADAkYvo.exe
  C:\Windows\System\ADAkYvo.exe
  2⤵
  PID:4428
- C:\Windows\System\cYSXivf.exe
  C:\Windows\System\cYSXivf.exe
  2⤵
  PID:4576
- C:\Windows\System\HYOOEOI.exe
  C:\Windows\System\HYOOEOI.exe
  2⤵
  PID:4680
- C:\Windows\System\DKrtUlU.exe
  C:\Windows\System\DKrtUlU.exe
  2⤵
  PID:4724
- C:\Windows\System\dtJNmDx.exe
  C:\Windows\System\dtJNmDx.exe
  2⤵
  PID:4764
- C:\Windows\System\wvUUqPa.exe
  C:\Windows\System\wvUUqPa.exe
  2⤵
  PID:4832
- C:\Windows\System\FcWjSXB.exe
  C:\Windows\System\FcWjSXB.exe
  2⤵
  PID:4872
- C:\Windows\System\uVtevmL.exe
  C:\Windows\System\uVtevmL.exe
  2⤵
  PID:4912
- C:\Windows\System\VjScOoN.exe
  C:\Windows\System\VjScOoN.exe
  2⤵
  PID:4500
- C:\Windows\System\uihCLhh.exe
  C:\Windows\System\uihCLhh.exe
  2⤵
  PID:4968
- C:\Windows\System\jOXHRkw.exe
  C:\Windows\System\jOXHRkw.exe
  2⤵
  PID:1968
- C:\Windows\System\PaKYFxy.exe
  C:\Windows\System\PaKYFxy.exe
  2⤵
  PID:4100
- C:\Windows\System\WAsxyau.exe
  C:\Windows\System\WAsxyau.exe
  2⤵
  PID:4616
- C:\Windows\System\niJJimQ.exe
  C:\Windows\System\niJJimQ.exe
  2⤵
  PID:4540
- C:\Windows\System\jxrUEqe.exe
  C:\Windows\System\jxrUEqe.exe
  2⤵
  PID:5036
- C:\Windows\System\gbRyinb.exe
  C:\Windows\System\gbRyinb.exe
  2⤵
  PID:5072
- C:\Windows\System\ObPNaPs.exe
  C:\Windows\System\ObPNaPs.exe
  2⤵
  PID:3152
- C:\Windows\System\hMNhhKv.exe
  C:\Windows\System\hMNhhKv.exe
  2⤵
  PID:4060
- C:\Windows\System\HzKlyxb.exe
  C:\Windows\System\HzKlyxb.exe
  2⤵
  PID:5084
- C:\Windows\System\hXEwLTy.exe
  C:\Windows\System\hXEwLTy.exe
  2⤵
  PID:5096
- C:\Windows\System\zzcxGMX.exe
  C:\Windows\System\zzcxGMX.exe
  2⤵
  PID:3076
- C:\Windows\System\YGuXhGs.exe
  C:\Windows\System\YGuXhGs.exe
  2⤵
  PID:3496
- C:\Windows\System\HnDyNVU.exe
  C:\Windows\System\HnDyNVU.exe
  2⤵
  PID:2444
- C:\Windows\System\STFsYTw.exe
  C:\Windows\System\STFsYTw.exe
  2⤵
  PID:4200
- C:\Windows\System\LmObpVk.exe
  C:\Windows\System\LmObpVk.exe
  2⤵
  PID:4404
- C:\Windows\System\tWZZhnw.exe
  C:\Windows\System\tWZZhnw.exe
  2⤵
  PID:4556
- C:\Windows\System\zyLbjhY.exe
  C:\Windows\System\zyLbjhY.exe
  2⤵
  PID:3044
- C:\Windows\System\qFNIIrN.exe
  C:\Windows\System\qFNIIrN.exe
  2⤵
  PID:3556
- C:\Windows\System\IqwbyIc.exe
  C:\Windows\System\IqwbyIc.exe
  2⤵
  PID:3348
- C:\Windows\System\YwabqFo.exe
  C:\Windows\System\YwabqFo.exe
  2⤵
  PID:2196
- C:\Windows\System\NctqwYA.exe
  C:\Windows\System\NctqwYA.exe
  2⤵
  PID:2636
- C:\Windows\System\NhwwLVP.exe
  C:\Windows\System\NhwwLVP.exe
  2⤵
  PID:4276
- C:\Windows\System\IKwkKla.exe
  C:\Windows\System\IKwkKla.exe
  2⤵
  PID:4740
- C:\Windows\System\OucHzmq.exe
  C:\Windows\System\OucHzmq.exe
  2⤵
  PID:4316
- C:\Windows\System\GZDjocB.exe
  C:\Windows\System\GZDjocB.exe
  2⤵
  PID:4896
- C:\Windows\System\nshrlrK.exe
  C:\Windows\System\nshrlrK.exe
  2⤵
  PID:4352
- C:\Windows\System\zWNcuvW.exe
  C:\Windows\System\zWNcuvW.exe
  2⤵
  PID:2532
- C:\Windows\System\rsrKOEu.exe
  C:\Windows\System\rsrKOEu.exe
  2⤵
  PID:2996
- C:\Windows\System\lHwQTIx.exe
  C:\Windows\System\lHwQTIx.exe
  2⤵
  PID:1312
- C:\Windows\System\FnKaCFj.exe
  C:\Windows\System\FnKaCFj.exe
  2⤵
  PID:4612
- C:\Windows\System\vHlPPTs.exe
  C:\Windows\System\vHlPPTs.exe
  2⤵
  PID:1032
- C:\Windows\System\xUqYCnl.exe
  C:\Windows\System\xUqYCnl.exe
  2⤵
  PID:1668
- C:\Windows\System\aQtiUzR.exe
  C:\Windows\System\aQtiUzR.exe
  2⤵
  PID:4760
- C:\Windows\System\rtZWECq.exe
  C:\Windows\System\rtZWECq.exe
  2⤵
  PID:4920
- C:\Windows\System\aNOsPSm.exe
  C:\Windows\System\aNOsPSm.exe
  2⤵
  PID:5000
- C:\Windows\System\kPUpFrg.exe
  C:\Windows\System\kPUpFrg.exe
  2⤵
  PID:5008
- C:\Windows\System\kiZcCnL.exe
  C:\Windows\System\kiZcCnL.exe
  2⤵
  PID:3980
- C:\Windows\System\fTmetoK.exe
  C:\Windows\System\fTmetoK.exe
  2⤵
  PID:4296
- C:\Windows\System\CoNkRVr.exe
  C:\Windows\System\CoNkRVr.exe
  2⤵
  PID:4736
- C:\Windows\System\aMpZiEf.exe
  C:\Windows\System\aMpZiEf.exe
  2⤵
  PID:3632
- C:\Windows\System\CUkpkzD.exe
  C:\Windows\System\CUkpkzD.exe
  2⤵
  PID:4804
- C:\Windows\System\ZRFPOZF.exe
  C:\Windows\System\ZRFPOZF.exe
  2⤵
  PID:112
- C:\Windows\System\LZSOdcJ.exe
  C:\Windows\System\LZSOdcJ.exe
  2⤵
  PID:2024
- C:\Windows\System\YtGnuac.exe
  C:\Windows\System\YtGnuac.exe
  2⤵
  PID:3964
- C:\Windows\System\mwACedR.exe
  C:\Windows\System\mwACedR.exe
  2⤵
  PID:4140
- C:\Windows\System\tGTYSDM.exe
  C:\Windows\System\tGTYSDM.exe
  2⤵
  PID:2668
- C:\Windows\System\dVzbjUx.exe
  C:\Windows\System\dVzbjUx.exe
  2⤵
  PID:4368
- C:\Windows\System\bnvEMdB.exe
  C:\Windows\System\bnvEMdB.exe
  2⤵
  PID:4516
- C:\Windows\System\ppciCOw.exe
  C:\Windows\System\ppciCOw.exe
  2⤵
  PID:4320
- C:\Windows\System\qAYMTUS.exe
  C:\Windows\System\qAYMTUS.exe
  2⤵
  PID:2488
- C:\Windows\System\YXHFcUH.exe
  C:\Windows\System\YXHFcUH.exe
  2⤵
  PID:2284
- C:\Windows\System\SzjpAQV.exe
  C:\Windows\System\SzjpAQV.exe
  2⤵
  PID:4216
- C:\Windows\System\HfiSAvn.exe
  C:\Windows\System\HfiSAvn.exe
  2⤵
  PID:4988
- C:\Windows\System\KMnjkJD.exe
  C:\Windows\System\KMnjkJD.exe
  2⤵
  PID:4496
- C:\Windows\System\ZgcHEBv.exe
  C:\Windows\System\ZgcHEBv.exe
  2⤵
  PID:4460
- C:\Windows\System\BfMdkaO.exe
  C:\Windows\System\BfMdkaO.exe
  2⤵
  PID:3620
- C:\Windows\System\gpEaauI.exe
  C:\Windows\System\gpEaauI.exe
  2⤵
  PID:2028
- C:\Windows\System\wGUjaVc.exe
  C:\Windows\System\wGUjaVc.exe
  2⤵
  PID:3504
- C:\Windows\System\uYOClcd.exe
  C:\Windows\System\uYOClcd.exe
  2⤵
  PID:4160
- C:\Windows\System\ieuzQBQ.exe
  C:\Windows\System\ieuzQBQ.exe
  2⤵
  PID:4476
- C:\Windows\System\bNtXTJG.exe
  C:\Windows\System\bNtXTJG.exe
  2⤵
  PID:4756
- C:\Windows\System\eQvgzLk.exe
  C:\Windows\System\eQvgzLk.exe
  2⤵
  PID:3520
- C:\Windows\System\GWZsbrz.exe
  C:\Windows\System\GWZsbrz.exe
  2⤵
  PID:4884
- C:\Windows\System\hEEjoYl.exe
  C:\Windows\System\hEEjoYl.exe
  2⤵
  PID:4420
- C:\Windows\System\nEiRLpf.exe
  C:\Windows\System\nEiRLpf.exe
  2⤵
  PID:4104
- C:\Windows\System\DAvEvIo.exe
  C:\Windows\System\DAvEvIo.exe
  2⤵
  PID:320
- C:\Windows\System\fjDOjrp.exe
  C:\Windows\System\fjDOjrp.exe
  2⤵
  PID:4356
- C:\Windows\System\nnfUiTl.exe
  C:\Windows\System\nnfUiTl.exe
  2⤵
  PID:872
- C:\Windows\System\lJTBjjz.exe
  C:\Windows\System\lJTBjjz.exe
  2⤵
  PID:3580
- C:\Windows\System\fmnhzgE.exe
  C:\Windows\System\fmnhzgE.exe
  2⤵
  PID:2204
- C:\Windows\System\NUNyaUX.exe
  C:\Windows\System\NUNyaUX.exe
  2⤵
  PID:3128
- C:\Windows\System\GZYJagW.exe
  C:\Windows\System\GZYJagW.exe
  2⤵
  PID:2612
- C:\Windows\System\qaWdNjz.exe
  C:\Windows\System\qaWdNjz.exe
  2⤵
  PID:804
- C:\Windows\System\ArtOyAX.exe
  C:\Windows\System\ArtOyAX.exe
  2⤵
  PID:4644
- C:\Windows\System\tkuhxyP.exe
  C:\Windows\System\tkuhxyP.exe
  2⤵
  PID:5112
- C:\Windows\System\KrTzkMY.exe
  C:\Windows\System\KrTzkMY.exe
  2⤵
  PID:4964
- C:\Windows\System\RLAHluZ.exe
  C:\Windows\System\RLAHluZ.exe
  2⤵
  PID:4248
- C:\Windows\System\Gibxfxn.exe
  C:\Windows\System\Gibxfxn.exe
  2⤵
  PID:1096
- C:\Windows\System\rSgTiVI.exe
  C:\Windows\System\rSgTiVI.exe
  2⤵
  PID:2728
- C:\Windows\System\EhIfwgL.exe
  C:\Windows\System\EhIfwgL.exe
  2⤵
  PID:1576
- C:\Windows\System\EEqBUMX.exe
  C:\Windows\System\EEqBUMX.exe
  2⤵
  PID:632
- C:\Windows\System\qlJmJQm.exe
  C:\Windows\System\qlJmJQm.exe
  2⤵
  PID:4176
- C:\Windows\System\LrNBvTD.exe
  C:\Windows\System\LrNBvTD.exe
  2⤵
  PID:812
- C:\Windows\System\uXCPfsC.exe
  C:\Windows\System\uXCPfsC.exe
  2⤵
  PID:5136
- C:\Windows\System\zuBJhiv.exe
  C:\Windows\System\zuBJhiv.exe
  2⤵
  PID:5152
- C:\Windows\System\UhgznfI.exe
  C:\Windows\System\UhgznfI.exe
  2⤵
  PID:5228
- C:\Windows\System\HMZCFkT.exe
  C:\Windows\System\HMZCFkT.exe
  2⤵
  PID:5244
- C:\Windows\System\qLJKStT.exe
  C:\Windows\System\qLJKStT.exe
  2⤵
  PID:5260
- C:\Windows\System\OPkiFXI.exe
  C:\Windows\System\OPkiFXI.exe
  2⤵
  PID:5276
- C:\Windows\System\rTqCPjn.exe
  C:\Windows\System\rTqCPjn.exe
  2⤵
  PID:5292
- C:\Windows\System\sGebONQ.exe
  C:\Windows\System\sGebONQ.exe
  2⤵
  PID:5308
- C:\Windows\System\CXJCsLq.exe
  C:\Windows\System\CXJCsLq.exe
  2⤵
  PID:5328
- C:\Windows\System\qzrUsyY.exe
  C:\Windows\System\qzrUsyY.exe
  2⤵
  PID:5348
- C:\Windows\System\GInIeRA.exe
  C:\Windows\System\GInIeRA.exe
  2⤵
  PID:5368
- C:\Windows\System\jdAQHaW.exe
  C:\Windows\System\jdAQHaW.exe
  2⤵
  PID:5384
- C:\Windows\System\NGHMVEp.exe
  C:\Windows\System\NGHMVEp.exe
  2⤵
  PID:5404
- C:\Windows\System\eScmmmm.exe
  C:\Windows\System\eScmmmm.exe
  2⤵
  PID:5420
- C:\Windows\System\UcHGsrn.exe
  C:\Windows\System\UcHGsrn.exe
  2⤵
  PID:5436
- C:\Windows\System\tqMliRU.exe
  C:\Windows\System\tqMliRU.exe
  2⤵
  PID:5452
- C:\Windows\System\GWkEFLo.exe
  C:\Windows\System\GWkEFLo.exe
  2⤵
  PID:5468
- C:\Windows\System\bqeNrir.exe
  C:\Windows\System\bqeNrir.exe
  2⤵
  PID:5488
- C:\Windows\System\OilrvlR.exe
  C:\Windows\System\OilrvlR.exe
  2⤵
  PID:5508
- C:\Windows\System\WJwcrUF.exe
  C:\Windows\System\WJwcrUF.exe
  2⤵
  PID:5524
- C:\Windows\System\fbeCAVT.exe
  C:\Windows\System\fbeCAVT.exe
  2⤵
  PID:5588
- C:\Windows\System\EYWdRgD.exe
  C:\Windows\System\EYWdRgD.exe
  2⤵
  PID:5604
- C:\Windows\System\nzMKBCc.exe
  C:\Windows\System\nzMKBCc.exe
  2⤵
  PID:5620
- C:\Windows\System\JFAxtTb.exe
  C:\Windows\System\JFAxtTb.exe
  2⤵
  PID:5636
- C:\Windows\System\aCXFmgl.exe
  C:\Windows\System\aCXFmgl.exe
  2⤵
  PID:5652
- C:\Windows\System\THfcOBK.exe
  C:\Windows\System\THfcOBK.exe
  2⤵
  PID:5668
- C:\Windows\System\jTgRgAP.exe
  C:\Windows\System\jTgRgAP.exe
  2⤵
  PID:5684
- C:\Windows\System\wvkLYMB.exe
  C:\Windows\System\wvkLYMB.exe
  2⤵
  PID:5700
- C:\Windows\System\rjnWJTT.exe
  C:\Windows\System\rjnWJTT.exe
  2⤵
  PID:5716
- C:\Windows\System\GQVLQqh.exe
  C:\Windows\System\GQVLQqh.exe
  2⤵
  PID:5732
- C:\Windows\System\eUatCPJ.exe
  C:\Windows\System\eUatCPJ.exe
  2⤵
  PID:5748
- C:\Windows\System\lGfgYOO.exe
  C:\Windows\System\lGfgYOO.exe
  2⤵
  PID:5764
- C:\Windows\System\ffZBFOT.exe
  C:\Windows\System\ffZBFOT.exe
  2⤵
  PID:5784
- C:\Windows\System\hFfDzjd.exe
  C:\Windows\System\hFfDzjd.exe
  2⤵
  PID:5848
- C:\Windows\System\BcIMiwS.exe
  C:\Windows\System\BcIMiwS.exe
  2⤵
  PID:5864
- C:\Windows\System\BvrIYuD.exe
  C:\Windows\System\BvrIYuD.exe
  2⤵
  PID:5880
- C:\Windows\System\xOFSTcL.exe
  C:\Windows\System\xOFSTcL.exe
  2⤵
  PID:5900
- C:\Windows\System\OBTBuvb.exe
  C:\Windows\System\OBTBuvb.exe
  2⤵
  PID:5920
- C:\Windows\System\jDdEYAC.exe
  C:\Windows\System\jDdEYAC.exe
  2⤵
  PID:5940
- C:\Windows\System\WMXLujl.exe
  C:\Windows\System\WMXLujl.exe
  2⤵
  PID:5956
- C:\Windows\System\pQAibFu.exe
  C:\Windows\System\pQAibFu.exe
  2⤵
  PID:5972
- C:\Windows\System\GgztwqZ.exe
  C:\Windows\System\GgztwqZ.exe
  2⤵
  PID:6008
- C:\Windows\System\CTqGqKt.exe
  C:\Windows\System\CTqGqKt.exe
  2⤵
  PID:6024
- C:\Windows\System\RGMaECq.exe
  C:\Windows\System\RGMaECq.exe
  2⤵
  PID:6040
- C:\Windows\System\CzubRyj.exe
  C:\Windows\System\CzubRyj.exe
  2⤵
  PID:6060
- C:\Windows\System\HdBUCYy.exe
  C:\Windows\System\HdBUCYy.exe
  2⤵
  PID:6080
- C:\Windows\System\ZYvwifM.exe
  C:\Windows\System\ZYvwifM.exe
  2⤵
  PID:6096
- C:\Windows\System\MFikRRa.exe
  C:\Windows\System\MFikRRa.exe
  2⤵
  PID:6116
- C:\Windows\System\QoRnFSm.exe
  C:\Windows\System\QoRnFSm.exe
  2⤵
  PID:6132
- C:\Windows\System\RGWOWny.exe
  C:\Windows\System\RGWOWny.exe
  2⤵
  PID:3920
- C:\Windows\System\VpHIdHZ.exe
  C:\Windows\System\VpHIdHZ.exe
  2⤵
  PID:4220
- C:\Windows\System\qOdqaZg.exe
  C:\Windows\System\qOdqaZg.exe
  2⤵
  PID:2044
- C:\Windows\System\mTtnQRK.exe
  C:\Windows\System\mTtnQRK.exe
  2⤵
  PID:280
- C:\Windows\System\egMuRXX.exe
  C:\Windows\System\egMuRXX.exe
  2⤵
  PID:1812
- C:\Windows\System\CtEaSFe.exe
  C:\Windows\System\CtEaSFe.exe
  2⤵
  PID:5116
- C:\Windows\System\awFCNqb.exe
  C:\Windows\System\awFCNqb.exe
  2⤵
  PID:2288
- C:\Windows\System\kwBoNnb.exe
  C:\Windows\System\kwBoNnb.exe
  2⤵
  PID:5004
- C:\Windows\System\lIjTuGn.exe
  C:\Windows\System\lIjTuGn.exe
  2⤵
  PID:5148
- C:\Windows\System\hJSyIgG.exe
  C:\Windows\System\hJSyIgG.exe
  2⤵
  PID:5204
- C:\Windows\System\kWJwElk.exe
  C:\Windows\System\kWJwElk.exe
  2⤵
  PID:5184
- C:\Windows\System\MmmYvUP.exe
  C:\Windows\System\MmmYvUP.exe
  2⤵
  PID:5284
- C:\Windows\System\VvLQnca.exe
  C:\Windows\System\VvLQnca.exe
  2⤵
  PID:5324
- C:\Windows\System\cfJelJY.exe
  C:\Windows\System\cfJelJY.exe
  2⤵
  PID:5360
- C:\Windows\System\eXzgGEO.exe
  C:\Windows\System\eXzgGEO.exe
  2⤵
  PID:1304
- C:\Windows\System\ZJevyZg.exe
  C:\Windows\System\ZJevyZg.exe
  2⤵
  PID:5532
- C:\Windows\System\SQIpKRI.exe
  C:\Windows\System\SQIpKRI.exe
  2⤵
  PID:1872
- C:\Windows\System\cpprRvg.exe
  C:\Windows\System\cpprRvg.exe
  2⤵
  PID:5552
- C:\Windows\System\LARzzbi.exe
  C:\Windows\System\LARzzbi.exe
  2⤵
  PID:5272
- C:\Windows\System\duCEwLw.exe
  C:\Windows\System\duCEwLw.exe
  2⤵
  PID:5560
- C:\Windows\System\eFaLwbX.exe
  C:\Windows\System\eFaLwbX.exe
  2⤵
  PID:5576
- C:\Windows\System\VLOUKqN.exe
  C:\Windows\System\VLOUKqN.exe
  2⤵
  PID:5340
- C:\Windows\System\dtFOQod.exe
  C:\Windows\System\dtFOQod.exe
  2⤵
  PID:5380
- C:\Windows\System\VAQgFYt.exe
  C:\Windows\System\VAQgFYt.exe
  2⤵
  PID:5476
- C:\Windows\System\QVtAdTL.exe
  C:\Windows\System\QVtAdTL.exe
  2⤵
  PID:580
- C:\Windows\System\MlYOfjv.exe
  C:\Windows\System\MlYOfjv.exe
  2⤵
  PID:5596
- C:\Windows\System\doKrwRm.exe
  C:\Windows\System\doKrwRm.exe
  2⤵
  PID:5744
- C:\Windows\System\TrbbhAl.exe
  C:\Windows\System\TrbbhAl.exe
  2⤵
  PID:5616
- C:\Windows\System\WvMTDCq.exe
  C:\Windows\System\WvMTDCq.exe
  2⤵
  PID:5660
- C:\Windows\System\MtVlFIe.exe
  C:\Windows\System\MtVlFIe.exe
  2⤵
  PID:5728
- C:\Windows\System\wKOzAWA.exe
  C:\Windows\System\wKOzAWA.exe
  2⤵
  PID:5796
- C:\Windows\System\xRJEXdZ.exe
  C:\Windows\System\xRJEXdZ.exe
  2⤵
  PID:5892
- C:\Windows\System\YtrYIko.exe
  C:\Windows\System\YtrYIko.exe
  2⤵
  PID:5968
- C:\Windows\System\oMNIGRT.exe
  C:\Windows\System\oMNIGRT.exe
  2⤵
  PID:5804
- C:\Windows\System\wMKzlzs.exe
  C:\Windows\System\wMKzlzs.exe
  2⤵
  PID:5824
- C:\Windows\System\ilzFynP.exe
  C:\Windows\System\ilzFynP.exe
  2⤵
  PID:6016
- C:\Windows\System\mwXLhPH.exe
  C:\Windows\System\mwXLhPH.exe
  2⤵
  PID:6056
- C:\Windows\System\EoDvwWL.exe
  C:\Windows\System\EoDvwWL.exe
  2⤵
  PID:5948
- C:\Windows\System\WVQkusY.exe
  C:\Windows\System\WVQkusY.exe
  2⤵
  PID:4980
- C:\Windows\System\krtdAsS.exe
  C:\Windows\System\krtdAsS.exe
  2⤵
  PID:4844
- C:\Windows\System\qDWpTWJ.exe
  C:\Windows\System\qDWpTWJ.exe
  2⤵
  PID:2424
- C:\Windows\System\hMazoOi.exe
  C:\Windows\System\hMazoOi.exe
  2⤵
  PID:5172
- C:\Windows\System\lbBuyPm.exe
  C:\Windows\System\lbBuyPm.exe
  2⤵
  PID:5992
- C:\Windows\System\MVfFTVd.exe
  C:\Windows\System\MVfFTVd.exe
  2⤵
  PID:5988
- C:\Windows\System\vKaUEnF.exe
  C:\Windows\System\vKaUEnF.exe
  2⤵
  PID:6068
- C:\Windows\System\NXTsYue.exe
  C:\Windows\System\NXTsYue.exe
  2⤵
  PID:5252
- C:\Windows\System\qcoTqVj.exe
  C:\Windows\System\qcoTqVj.exe
  2⤵
  PID:5496
- C:\Windows\System\MYlWnqw.exe
  C:\Windows\System\MYlWnqw.exe
  2⤵
  PID:6140
- C:\Windows\System\igDXWfB.exe
  C:\Windows\System\igDXWfB.exe
  2⤵
  PID:5220
- C:\Windows\System\tsZCRNI.exe
  C:\Windows\System\tsZCRNI.exe
  2⤵
  PID:5052
- C:\Windows\System\yfFfkSd.exe
  C:\Windows\System\yfFfkSd.exe
  2⤵
  PID:2692
- C:\Windows\System\bMsFeup.exe
  C:\Windows\System\bMsFeup.exe
  2⤵
  PID:5392
- C:\Windows\System\oAwiMyc.exe
  C:\Windows\System\oAwiMyc.exe
  2⤵
  PID:448
- C:\Windows\System\gqRfbso.exe
  C:\Windows\System\gqRfbso.exe
  2⤵
  PID:5540
- C:\Windows\System\LnycJjA.exe
  C:\Windows\System\LnycJjA.exe
  2⤵
  PID:5708
- C:\Windows\System\QNYhZeu.exe
  C:\Windows\System\QNYhZeu.exe
  2⤵
  PID:5776
- C:\Windows\System\ABRxmIp.exe
  C:\Windows\System\ABRxmIp.exe
  2⤵
  PID:5888
- C:\Windows\System\Weecyig.exe
  C:\Windows\System\Weecyig.exe
  2⤵
  PID:5316
- C:\Windows\System\iYhHVYG.exe
  C:\Windows\System\iYhHVYG.exe
  2⤵
  PID:6092
- C:\Windows\System\pYQBjkC.exe
  C:\Windows\System\pYQBjkC.exe
  2⤵
  PID:5832
- C:\Windows\System\nWyPclL.exe
  C:\Windows\System\nWyPclL.exe
  2⤵
  PID:5908
- C:\Windows\System\papaFyR.exe
  C:\Windows\System\papaFyR.exe
  2⤵
  PID:5464
- C:\Windows\System\tUwemAv.exe
  C:\Windows\System\tUwemAv.exe
  2⤵
  PID:5568
- C:\Windows\System\FwAvCGZ.exe
  C:\Windows\System\FwAvCGZ.exe
  2⤵
  PID:5644
- C:\Windows\System\HVIYmfC.exe
  C:\Windows\System\HVIYmfC.exe
  2⤵
  PID:5168
- C:\Windows\System\IIQIeLs.exe
  C:\Windows\System\IIQIeLs.exe
  2⤵
  PID:5724
- C:\Windows\System\hKNYGea.exe
  C:\Windows\System\hKNYGea.exe
  2⤵
  PID:5800
- C:\Windows\System\NfycmyP.exe
  C:\Windows\System\NfycmyP.exe
  2⤵
  PID:5432
- C:\Windows\System\yJiUwNu.exe
  C:\Windows\System\yJiUwNu.exe
  2⤵
  PID:5632
- C:\Windows\System\icfRxJi.exe
  C:\Windows\System\icfRxJi.exe
  2⤵
  PID:5964
- C:\Windows\System\kElcgIO.exe
  C:\Windows\System\kElcgIO.exe
  2⤵
  PID:4960
- C:\Windows\System\yUQOcsB.exe
  C:\Windows\System\yUQOcsB.exe
  2⤵
  PID:964
- C:\Windows\System\vXlBKni.exe
  C:\Windows\System\vXlBKni.exe
  2⤵
  PID:5500
- C:\Windows\System\JQacEBV.exe
  C:\Windows\System\JQacEBV.exe
  2⤵
  PID:2248
- C:\Windows\System\opVhSUS.exe
  C:\Windows\System\opVhSUS.exe
  2⤵
  PID:1832
- C:\Windows\System\zYHvrcw.exe
  C:\Windows\System\zYHvrcw.exe
  2⤵
  PID:5268
- C:\Windows\System\Kcpfwuz.exe
  C:\Windows\System\Kcpfwuz.exe
  2⤵
  PID:6128
- C:\Windows\System\vGToSlL.exe
  C:\Windows\System\vGToSlL.exe
  2⤵
  PID:2776
- C:\Windows\System\ZrbIXSr.exe
  C:\Windows\System\ZrbIXSr.exe
  2⤵
  PID:5828
- C:\Windows\System\ffERLUo.exe
  C:\Windows\System\ffERLUo.exe
  2⤵
  PID:6112
- C:\Windows\System\kVqhLWu.exe
  C:\Windows\System\kVqhLWu.exe
  2⤵
  PID:5208
- C:\Windows\System\cgfPdFM.exe
  C:\Windows\System\cgfPdFM.exe
  2⤵
  PID:2620
- C:\Windows\System\edJehVe.exe
  C:\Windows\System\edJehVe.exe
  2⤵
  PID:6148
- C:\Windows\System\WSZVPRu.exe
  C:\Windows\System\WSZVPRu.exe
  2⤵
  PID:6168
- C:\Windows\System\irJjxVI.exe
  C:\Windows\System\irJjxVI.exe
  2⤵
  PID:6188
- C:\Windows\System\ptNZEZA.exe
  C:\Windows\System\ptNZEZA.exe
  2⤵
  PID:6208
- C:\Windows\System\KMwlwNZ.exe
  C:\Windows\System\KMwlwNZ.exe
  2⤵
  PID:6228
- C:\Windows\System\ASUOAqP.exe
  C:\Windows\System\ASUOAqP.exe
  2⤵
  PID:6244
- C:\Windows\System\BYaKrov.exe
  C:\Windows\System\BYaKrov.exe
  2⤵
  PID:6264
- C:\Windows\System\aybNfWK.exe
  C:\Windows\System\aybNfWK.exe
  2⤵
  PID:6288
- C:\Windows\System\twfFenX.exe
  C:\Windows\System\twfFenX.exe
  2⤵
  PID:6308
- C:\Windows\System\vNKRQHO.exe
  C:\Windows\System\vNKRQHO.exe
  2⤵
  PID:6324
- C:\Windows\System\ismMNXt.exe
  C:\Windows\System\ismMNXt.exe
  2⤵
  PID:6344
- C:\Windows\System\totKpkJ.exe
  C:\Windows\System\totKpkJ.exe
  2⤵
  PID:6364
- C:\Windows\System\juuyHMF.exe
  C:\Windows\System\juuyHMF.exe
  2⤵
  PID:6388
- C:\Windows\System\sXHAGEg.exe
  C:\Windows\System\sXHAGEg.exe
  2⤵
  PID:6404
- C:\Windows\System\fJbSyqC.exe
  C:\Windows\System\fJbSyqC.exe
  2⤵
  PID:6476
- C:\Windows\System\TTfDwuY.exe
  C:\Windows\System\TTfDwuY.exe
  2⤵
  PID:6492
- C:\Windows\System\shbNYNZ.exe
  C:\Windows\System\shbNYNZ.exe
  2⤵
  PID:6508
- C:\Windows\System\PLAHsQR.exe
  C:\Windows\System\PLAHsQR.exe
  2⤵
  PID:6528
- C:\Windows\System\YUglqHp.exe
  C:\Windows\System\YUglqHp.exe
  2⤵
  PID:6548
- C:\Windows\System\vSZcUyX.exe
  C:\Windows\System\vSZcUyX.exe
  2⤵
  PID:6568
- C:\Windows\System\IVUgaWc.exe
  C:\Windows\System\IVUgaWc.exe
  2⤵
  PID:6588
- C:\Windows\System\GrhlceO.exe
  C:\Windows\System\GrhlceO.exe
  2⤵
  PID:6604
- C:\Windows\System\ElkNfqV.exe
  C:\Windows\System\ElkNfqV.exe
  2⤵
  PID:6624
- C:\Windows\System\fJNJvpv.exe
  C:\Windows\System\fJNJvpv.exe
  2⤵
  PID:6640
- C:\Windows\System\bwZwpGE.exe
  C:\Windows\System\bwZwpGE.exe
  2⤵
  PID:6656
- C:\Windows\System\AUKLsnZ.exe
  C:\Windows\System\AUKLsnZ.exe
  2⤵
  PID:6676
- C:\Windows\System\NnpyOiA.exe
  C:\Windows\System\NnpyOiA.exe
  2⤵
  PID:6696
- C:\Windows\System\mPweTIU.exe
  C:\Windows\System\mPweTIU.exe
  2⤵
  PID:6716
- C:\Windows\System\PeVXSak.exe
  C:\Windows\System\PeVXSak.exe
  2⤵
  PID:6732
- C:\Windows\System\YENzLPQ.exe
  C:\Windows\System\YENzLPQ.exe
  2⤵
  PID:6756
- C:\Windows\System\FiDuRDR.exe
  C:\Windows\System\FiDuRDR.exe
  2⤵
  PID:6772
- C:\Windows\System\NTsgyXo.exe
  C:\Windows\System\NTsgyXo.exe
  2⤵
  PID:6788
- C:\Windows\System\OqKilPb.exe
  C:\Windows\System\OqKilPb.exe
  2⤵
  PID:6804
- C:\Windows\System\aHHTJgk.exe
  C:\Windows\System\aHHTJgk.exe
  2⤵
  PID:6820
- C:\Windows\System\CYtTEjO.exe
  C:\Windows\System\CYtTEjO.exe
  2⤵
  PID:6836
- C:\Windows\System\HDsVhnM.exe
  C:\Windows\System\HDsVhnM.exe
  2⤵
  PID:6852
- C:\Windows\System\UlSGyVO.exe
  C:\Windows\System\UlSGyVO.exe
  2⤵
  PID:6868
- C:\Windows\System\batZJJO.exe
  C:\Windows\System\batZJJO.exe
  2⤵
  PID:6936
- C:\Windows\System\njyZTIu.exe
  C:\Windows\System\njyZTIu.exe
  2⤵
  PID:6956
- C:\Windows\System\OVrwpcG.exe
  C:\Windows\System\OVrwpcG.exe
  2⤵
  PID:6972
- C:\Windows\System\dAWySuE.exe
  C:\Windows\System\dAWySuE.exe
  2⤵
  PID:7000
- C:\Windows\System\OHAWxJq.exe
  C:\Windows\System\OHAWxJq.exe
  2⤵
  PID:7016
- C:\Windows\System\LbgXczY.exe
  C:\Windows\System\LbgXczY.exe
  2⤵
  PID:7036
- C:\Windows\System\HqTOnwv.exe
  C:\Windows\System\HqTOnwv.exe
  2⤵
  PID:7052
- C:\Windows\System\qJytYqu.exe
  C:\Windows\System\qJytYqu.exe
  2⤵
  PID:7072
- C:\Windows\System\xMZbJUs.exe
  C:\Windows\System\xMZbJUs.exe
  2⤵
  PID:7088
- C:\Windows\System\UCuaJHW.exe
  C:\Windows\System\UCuaJHW.exe
  2⤵
  PID:7108
- C:\Windows\System\vCKYZxj.exe
  C:\Windows\System\vCKYZxj.exe
  2⤵
  PID:7124
- C:\Windows\System\Csoljat.exe
  C:\Windows\System\Csoljat.exe
  2⤵
  PID:7148
- C:\Windows\System\pBFfknZ.exe
  C:\Windows\System\pBFfknZ.exe
  2⤵
  PID:6004
- C:\Windows\System\KLWyxcw.exe
  C:\Windows\System\KLWyxcw.exe
  2⤵
  PID:5240
- C:\Windows\System\LFUvhlj.exe
  C:\Windows\System\LFUvhlj.exe
  2⤵
  PID:6196
- C:\Windows\System\qfiaBHn.exe
  C:\Windows\System\qfiaBHn.exe
  2⤵
  PID:6240
- C:\Windows\System\YAoVNOL.exe
  C:\Windows\System\YAoVNOL.exe
  2⤵
  PID:1112
- C:\Windows\System\gYraDeS.exe
  C:\Windows\System\gYraDeS.exe
  2⤵
  PID:4156
- C:\Windows\System\JWEKNTe.exe
  C:\Windows\System\JWEKNTe.exe
  2⤵
  PID:5400
- C:\Windows\System\alhgBjd.exe
  C:\Windows\System\alhgBjd.exe
  2⤵
  PID:5188
- C:\Windows\System\IAfMPbD.exe
  C:\Windows\System\IAfMPbD.exe
  2⤵
  PID:6352
- C:\Windows\System\jqQrfeT.exe
  C:\Windows\System\jqQrfeT.exe
  2⤵
  PID:5876
- C:\Windows\System\xnFRHiD.exe
  C:\Windows\System\xnFRHiD.exe
  2⤵
  PID:2448
- C:\Windows\System\gTXovuT.exe
  C:\Windows\System\gTXovuT.exe
  2⤵
  PID:2208
- C:\Windows\System\qprmHkv.exe
  C:\Windows\System\qprmHkv.exe
  2⤵
  PID:5740
- C:\Windows\System\wvbDUMW.exe
  C:\Windows\System\wvbDUMW.exe
  2⤵
  PID:5376
- C:\Windows\System\nkzfncW.exe
  C:\Windows\System\nkzfncW.exe
  2⤵
  PID:5428
- C:\Windows\System\fgzjkrj.exe
  C:\Windows\System\fgzjkrj.exe
  2⤵
  PID:1928
- C:\Windows\System\AUHISvq.exe
  C:\Windows\System\AUHISvq.exe
  2⤵
  PID:6184
- C:\Windows\System\SctBtBN.exe
  C:\Windows\System\SctBtBN.exe
  2⤵
  PID:6516
- C:\Windows\System\PsckPQo.exe
  C:\Windows\System\PsckPQo.exe
  2⤵
  PID:2240
- C:\Windows\System\HKwqyEp.exe
  C:\Windows\System\HKwqyEp.exe
  2⤵
  PID:6220
- C:\Windows\System\LrxMtqs.exe
  C:\Windows\System\LrxMtqs.exe
  2⤵
  PID:6300
- C:\Windows\System\oxnqcFF.exe
  C:\Windows\System\oxnqcFF.exe
  2⤵
  PID:2644
- C:\Windows\System\UOWcJTU.exe
  C:\Windows\System\UOWcJTU.exe
  2⤵
  PID:6380
- C:\Windows\System\XrribVd.exe
  C:\Windows\System\XrribVd.exe
  2⤵
  PID:6444
- C:\Windows\System\WYsNQrd.exe
  C:\Windows\System\WYsNQrd.exe
  2⤵
  PID:6600
- C:\Windows\System\LAkPOas.exe
  C:\Windows\System\LAkPOas.exe
  2⤵
  PID:6432
- C:\Windows\System\wsRuKkS.exe
  C:\Windows\System\wsRuKkS.exe
  2⤵
  PID:6632
- C:\Windows\System\GOTZNsQ.exe
  C:\Windows\System\GOTZNsQ.exe
  2⤵
  PID:6704
- C:\Windows\System\yQOxEQi.exe
  C:\Windows\System\yQOxEQi.exe
  2⤵
  PID:6744
- C:\Windows\System\pKSfvvG.exe
  C:\Windows\System\pKSfvvG.exe
  2⤵
  PID:6452
- C:\Windows\System\qFBBUNs.exe
  C:\Windows\System\qFBBUNs.exe
  2⤵
  PID:6848
- C:\Windows\System\PTbZmzi.exe
  C:\Windows\System\PTbZmzi.exe
  2⤵
  PID:6904
- C:\Windows\System\KAnkSss.exe
  C:\Windows\System\KAnkSss.exe
  2⤵
  PID:6900
- C:\Windows\System\OTGfGpK.exe
  C:\Windows\System\OTGfGpK.exe
  2⤵
  PID:6920
- C:\Windows\System\IiXPjuo.exe
  C:\Windows\System\IiXPjuo.exe
  2⤵
  PID:6932
- C:\Windows\System\qciFcyr.exe
  C:\Windows\System\qciFcyr.exe
  2⤵
  PID:6728
- C:\Windows\System\QHtSvVN.exe
  C:\Windows\System\QHtSvVN.exe
  2⤵
  PID:6768
- C:\Windows\System\DtZrsFu.exe
  C:\Windows\System\DtZrsFu.exe
  2⤵
  PID:6980
- C:\Windows\System\NpcTnHE.exe
  C:\Windows\System\NpcTnHE.exe
  2⤵
  PID:7044
- C:\Windows\System\cTgNLZz.exe
  C:\Windows\System\cTgNLZz.exe
  2⤵
  PID:7116
- C:\Windows\System\mpvYqgW.exe
  C:\Windows\System\mpvYqgW.exe
  2⤵
  PID:7160
- C:\Windows\System\SZwUqTO.exe
  C:\Windows\System\SZwUqTO.exe
  2⤵
  PID:6160
- C:\Windows\System\ZBXCmSG.exe
  C:\Windows\System\ZBXCmSG.exe
  2⤵
  PID:5304
- C:\Windows\System\AjQnQMk.exe
  C:\Windows\System\AjQnQMk.exe
  2⤵
  PID:7024
- C:\Windows\System\RDytSqT.exe
  C:\Windows\System\RDytSqT.exe
  2⤵
  PID:1064
- C:\Windows\System\Sdinpyv.exe
  C:\Windows\System\Sdinpyv.exe
  2⤵
  PID:7060
- C:\Windows\System\UOADpkA.exe
  C:\Windows\System\UOADpkA.exe
  2⤵
  PID:7100
- C:\Windows\System\EBWjZjv.exe
  C:\Windows\System\EBWjZjv.exe
  2⤵
  PID:6252
- C:\Windows\System\MkRAAWg.exe
  C:\Windows\System\MkRAAWg.exe
  2⤵
  PID:5516
- C:\Windows\System\gzItHOy.exe
  C:\Windows\System\gzItHOy.exe
  2⤵
  PID:5200
- C:\Windows\System\VRyigFc.exe
  C:\Windows\System\VRyigFc.exe
  2⤵
  PID:5448
- C:\Windows\System\NnfdxgL.exe
  C:\Windows\System\NnfdxgL.exe
  2⤵
  PID:6256
- C:\Windows\System\KDrODKJ.exe
  C:\Windows\System\KDrODKJ.exe
  2⤵
  PID:6372
- C:\Windows\System\ZfyvVVQ.exe
  C:\Windows\System\ZfyvVVQ.exe
  2⤵
  PID:6260
- C:\Windows\System\mfFHmoQ.exe
  C:\Windows\System\mfFHmoQ.exe
  2⤵
  PID:6468
- C:\Windows\System\XxOgrga.exe
  C:\Windows\System\XxOgrga.exe
  2⤵
  PID:6884
- C:\Windows\System\afkCqTX.exe
  C:\Windows\System\afkCqTX.exe
  2⤵
  PID:6336
- C:\Windows\System\AHLolDw.exe
  C:\Windows\System\AHLolDw.exe
  2⤵
  PID:6400
- C:\Windows\System\YXFVGya.exe
  C:\Windows\System\YXFVGya.exe
  2⤵
  PID:6864
- C:\Windows\System\LXZRVkx.exe
  C:\Windows\System\LXZRVkx.exe
  2⤵
  PID:6616
- C:\Windows\System\SgHFCIu.exe
  C:\Windows\System\SgHFCIu.exe
  2⤵
  PID:6620
- C:\Windows\System\SMOykaU.exe
  C:\Windows\System\SMOykaU.exe
  2⤵
  PID:6652
- C:\Windows\System\VsBaWdx.exe
  C:\Windows\System\VsBaWdx.exe
  2⤵
  PID:6536
- C:\Windows\System\aLmxLyZ.exe
  C:\Windows\System\aLmxLyZ.exe
  2⤵
  PID:2504
- C:\Windows\System\fAUaiXZ.exe
  C:\Windows\System\fAUaiXZ.exe
  2⤵
  PID:6488
- C:\Windows\System\bQrxXFd.exe
  C:\Windows\System\bQrxXFd.exe
  2⤵
  PID:6668
- C:\Windows\System\LQRTAtR.exe
  C:\Windows\System\LQRTAtR.exe
  2⤵
  PID:2632
- C:\Windows\System\MnUJoAg.exe
  C:\Windows\System\MnUJoAg.exe
  2⤵
  PID:6504
- C:\Windows\System\GIpwdmj.exe
  C:\Windows\System\GIpwdmj.exe
  2⤵
  PID:7164
- C:\Windows\System\GiPifuz.exe
  C:\Windows\System\GiPifuz.exe
  2⤵
  PID:7032
- C:\Windows\System\mkaBZTC.exe
  C:\Windows\System\mkaBZTC.exe
  2⤵
  PID:6948
- C:\Windows\System\CiDqHhF.exe
  C:\Windows\System\CiDqHhF.exe
  2⤵
  PID:5612
- C:\Windows\System\HabAySC.exe
  C:\Windows\System\HabAySC.exe
  2⤵
  PID:6280
- C:\Windows\System\pPtsgrn.exe
  C:\Windows\System\pPtsgrn.exe
  2⤵
  PID:6460
- C:\Windows\System\FhKFgJR.exe
  C:\Windows\System\FhKFgJR.exe
  2⤵
  PID:6580
- C:\Windows\System\AmpJozL.exe
  C:\Windows\System\AmpJozL.exe
  2⤵
  PID:6692
- C:\Windows\System\FDbVYSG.exe
  C:\Windows\System\FDbVYSG.exe
  2⤵
  PID:6992
- C:\Windows\System\uHjMSRC.exe
  C:\Windows\System\uHjMSRC.exe
  2⤵
  PID:6968
- C:\Windows\System\XOnNwZX.exe
  C:\Windows\System\XOnNwZX.exe
  2⤵
  PID:7068
- C:\Windows\System\axFEqdy.exe
  C:\Windows\System\axFEqdy.exe
  2⤵
  PID:5696
- C:\Windows\System\tgBiVAH.exe
  C:\Windows\System\tgBiVAH.exe
  2⤵
  PID:5816
- C:\Windows\System\OpGDKmd.exe
  C:\Windows\System\OpGDKmd.exe
  2⤵
  PID:6316
- C:\Windows\System\wVBWRyd.exe
  C:\Windows\System\wVBWRyd.exe
  2⤵
  PID:6332
- C:\Windows\System\wsKzPck.exe
  C:\Windows\System\wsKzPck.exe
  2⤵
  PID:1604
- C:\Windows\System\KoMnQHU.exe
  C:\Windows\System\KoMnQHU.exe
  2⤵
  PID:6740
- C:\Windows\System\RkemmRP.exe
  C:\Windows\System\RkemmRP.exe
  2⤵
  PID:5180
- C:\Windows\System\qqDtJlp.exe
  C:\Windows\System\qqDtJlp.exe
  2⤵
  PID:7140
- C:\Windows\System\kXHNoes.exe
  C:\Windows\System\kXHNoes.exe
  2⤵
  PID:6828
- C:\Windows\System\OppsIKM.exe
  C:\Windows\System\OppsIKM.exe
  2⤵
  PID:6844
- C:\Windows\System\LAYGdLl.exe
  C:\Windows\System\LAYGdLl.exe
  2⤵
  PID:2600
- C:\Windows\System\iyLkzgj.exe
  C:\Windows\System\iyLkzgj.exe
  2⤵
  PID:6320
- C:\Windows\System\uhxVFmu.exe
  C:\Windows\System\uhxVFmu.exe
  2⤵
  PID:6360
- C:\Windows\System\FOTiUTf.exe
  C:\Windows\System\FOTiUTf.exe
  2⤵
  PID:2584
- C:\Windows\System\YNYyxky.exe
  C:\Windows\System\YNYyxky.exe
  2⤵
  PID:6816
- C:\Windows\System\tGRteRs.exe
  C:\Windows\System\tGRteRs.exe
  2⤵
  PID:6780
- C:\Windows\System\HzHgppV.exe
  C:\Windows\System\HzHgppV.exe
  2⤵
  PID:6272
- C:\Windows\System\gSlEcIc.exe
  C:\Windows\System\gSlEcIc.exe
  2⤵
  PID:6964
- C:\Windows\System\YVJOYJX.exe
  C:\Windows\System\YVJOYJX.exe
  2⤵
  PID:7084
- C:\Windows\System\bXjkvxT.exe
  C:\Windows\System\bXjkvxT.exe
  2⤵
  PID:6428
- C:\Windows\System\tzQaowi.exe
  C:\Windows\System\tzQaowi.exe
  2⤵
  PID:2384
- C:\Windows\System\WnnDTOf.exe
  C:\Windows\System\WnnDTOf.exe
  2⤵
  PID:5160
- C:\Windows\System\oqtYtAn.exe
  C:\Windows\System\oqtYtAn.exe
  2⤵
  PID:6784
- C:\Windows\System\XRJPyGg.exe
  C:\Windows\System\XRJPyGg.exe
  2⤵
  PID:6596
- C:\Windows\System\XLuEFfU.exe
  C:\Windows\System\XLuEFfU.exe
  2⤵
  PID:6472
- C:\Windows\System\WgoowFA.exe
  C:\Windows\System\WgoowFA.exe
  2⤵
  PID:6812
- C:\Windows\System\AlBbBlf.exe
  C:\Windows\System\AlBbBlf.exe
  2⤵
  PID:1300
- C:\Windows\System\mcpmhba.exe
  C:\Windows\System\mcpmhba.exe
  2⤵
  PID:7172
- C:\Windows\System\yMtEltn.exe
  C:\Windows\System\yMtEltn.exe
  2⤵
  PID:7192
- C:\Windows\System\qPFEePx.exe
  C:\Windows\System\qPFEePx.exe
  2⤵
  PID:7208
- C:\Windows\System\kFTTgpy.exe
  C:\Windows\System\kFTTgpy.exe
  2⤵
  PID:7232
- C:\Windows\System\cktbvdr.exe
  C:\Windows\System\cktbvdr.exe
  2⤵
  PID:7260
- C:\Windows\System\MLdyWmE.exe
  C:\Windows\System\MLdyWmE.exe
  2⤵
  PID:7276
- C:\Windows\System\EPyDrTC.exe
  C:\Windows\System\EPyDrTC.exe
  2⤵
  PID:7296
- C:\Windows\System\XJHvvGJ.exe
  C:\Windows\System\XJHvvGJ.exe
  2⤵
  PID:7312
- C:\Windows\System\oVLNfUC.exe
  C:\Windows\System\oVLNfUC.exe
  2⤵
  PID:7332
- C:\Windows\System\nFlYHRP.exe
  C:\Windows\System\nFlYHRP.exe
  2⤵
  PID:7348
- C:\Windows\System\GcewDQW.exe
  C:\Windows\System\GcewDQW.exe
  2⤵
  PID:7364
- C:\Windows\System\RpNnHpX.exe
  C:\Windows\System\RpNnHpX.exe
  2⤵
  PID:7384
- C:\Windows\System\CVsIxdt.exe
  C:\Windows\System\CVsIxdt.exe
  2⤵
  PID:7404
- C:\Windows\System\KchtRNS.exe
  C:\Windows\System\KchtRNS.exe
  2⤵
  PID:7420
- C:\Windows\System\XhrgUXd.exe
  C:\Windows\System\XhrgUXd.exe
  2⤵
  PID:7440
- C:\Windows\System\kDXNxJD.exe
  C:\Windows\System\kDXNxJD.exe
  2⤵
  PID:7456
- C:\Windows\System\WCNHVTy.exe
  C:\Windows\System\WCNHVTy.exe
  2⤵
  PID:7476
- C:\Windows\System\BsdtwJn.exe
  C:\Windows\System\BsdtwJn.exe
  2⤵
  PID:7500
- C:\Windows\System\wfeOFxD.exe
  C:\Windows\System\wfeOFxD.exe
  2⤵
  PID:7524
- C:\Windows\System\zECAgNA.exe
  C:\Windows\System\zECAgNA.exe
  2⤵
  PID:7548
- C:\Windows\System\gVdrdCF.exe
  C:\Windows\System\gVdrdCF.exe
  2⤵
  PID:7568
- C:\Windows\System\LkjfARm.exe
  C:\Windows\System\LkjfARm.exe
  2⤵
  PID:7592
- C:\Windows\System\wFaOYrN.exe
  C:\Windows\System\wFaOYrN.exe
  2⤵
  PID:7616
- C:\Windows\System\rEdscrN.exe
  C:\Windows\System\rEdscrN.exe
  2⤵
  PID:7636
- C:\Windows\System\CINyoII.exe
  C:\Windows\System\CINyoII.exe
  2⤵
  PID:7656
- C:\Windows\System\HhHgZmI.exe
  C:\Windows\System\HhHgZmI.exe
  2⤵
  PID:7676
- C:\Windows\System\AgbPmIf.exe
  C:\Windows\System\AgbPmIf.exe
  2⤵
  PID:7696
- C:\Windows\System\yCzwMVO.exe
  C:\Windows\System\yCzwMVO.exe
  2⤵
  PID:7716
- C:\Windows\System\GyChiBi.exe
  C:\Windows\System\GyChiBi.exe
  2⤵
  PID:7736
- C:\Windows\System\YqxCtLS.exe
  C:\Windows\System\YqxCtLS.exe
  2⤵
  PID:7760
- C:\Windows\System\cytLWJC.exe
  C:\Windows\System\cytLWJC.exe
  2⤵
  PID:7780
- C:\Windows\System\XMeJcuO.exe
  C:\Windows\System\XMeJcuO.exe
  2⤵
  PID:7796
- C:\Windows\System\vtSsNpv.exe
  C:\Windows\System\vtSsNpv.exe
  2⤵
  PID:7820
- C:\Windows\System\DtESHSJ.exe
  C:\Windows\System\DtESHSJ.exe
  2⤵
  PID:7840
- C:\Windows\System\oIEnoKk.exe
  C:\Windows\System\oIEnoKk.exe
  2⤵
  PID:7860
- C:\Windows\System\iYjHHWn.exe
  C:\Windows\System\iYjHHWn.exe
  2⤵
  PID:7884
- C:\Windows\System\jddbDww.exe
  C:\Windows\System\jddbDww.exe
  2⤵
  PID:7904
- C:\Windows\System\XDWPFKB.exe
  C:\Windows\System\XDWPFKB.exe
  2⤵
  PID:7920
- C:\Windows\System\cJSestB.exe
  C:\Windows\System\cJSestB.exe
  2⤵
  PID:7944
- C:\Windows\System\GdwhaNH.exe
  C:\Windows\System\GdwhaNH.exe
  2⤵
  PID:7960
- C:\Windows\System\HsSiUAc.exe
  C:\Windows\System\HsSiUAc.exe
  2⤵
  PID:7976
- C:\Windows\System\lmIJtuR.exe
  C:\Windows\System\lmIJtuR.exe
  2⤵
  PID:7992
- C:\Windows\System\xUMfVmP.exe
  C:\Windows\System\xUMfVmP.exe
  2⤵
  PID:8008
- C:\Windows\System\EMlbIJD.exe
  C:\Windows\System\EMlbIJD.exe
  2⤵
  PID:8024
- C:\Windows\System\NCJlLRi.exe
  C:\Windows\System\NCJlLRi.exe
  2⤵
  PID:8040
- C:\Windows\System\uFtfWvo.exe
  C:\Windows\System\uFtfWvo.exe
  2⤵
  PID:8056
- C:\Windows\System\hshlIER.exe
  C:\Windows\System\hshlIER.exe
  2⤵
  PID:8072
- C:\Windows\System\YokVmBG.exe
  C:\Windows\System\YokVmBG.exe
  2⤵
  PID:8088
- C:\Windows\System\ZSdWwHi.exe
  C:\Windows\System\ZSdWwHi.exe
  2⤵
  PID:8104
- C:\Windows\System\JocNPFH.exe
  C:\Windows\System\JocNPFH.exe
  2⤵
  PID:8120
- C:\Windows\System\tbAVPXM.exe
  C:\Windows\System\tbAVPXM.exe
  2⤵
  PID:8136
- C:\Windows\System\SeVwOdo.exe
  C:\Windows\System\SeVwOdo.exe
  2⤵
  PID:8152
- C:\Windows\System\QgiJmDK.exe
  C:\Windows\System\QgiJmDK.exe
  2⤵
  PID:8168
- C:\Windows\System\mBuawyI.exe
  C:\Windows\System\mBuawyI.exe
  2⤵
  PID:8188
- C:\Windows\System\zmzSusl.exe
  C:\Windows\System\zmzSusl.exe
  2⤵
  PID:7200
- C:\Windows\System\DkSeoij.exe
  C:\Windows\System\DkSeoij.exe
  2⤵
  PID:5164
- C:\Windows\System\wOypvQX.exe
  C:\Windows\System\wOypvQX.exe
  2⤵
  PID:7248
- C:\Windows\System\rtUgyjz.exe
  C:\Windows\System\rtUgyjz.exe
  2⤵
  PID:7288
- C:\Windows\System\geSZmQI.exe
  C:\Windows\System\geSZmQI.exe
  2⤵
  PID:7328
- C:\Windows\System\AUZsKvn.exe
  C:\Windows\System\AUZsKvn.exe
  2⤵
  PID:7224
- C:\Windows\System\eAsHOmD.exe
  C:\Windows\System\eAsHOmD.exe
  2⤵
  PID:7396
- C:\Windows\System\IVolcFh.exe
  C:\Windows\System\IVolcFh.exe
  2⤵
  PID:7432
- C:\Windows\System\QAhqGVH.exe
  C:\Windows\System\QAhqGVH.exe
  2⤵
  PID:7472
- C:\Windows\System\FmXfaYP.exe
  C:\Windows\System\FmXfaYP.exe
  2⤵
  PID:7220
- C:\Windows\System\JlbDElv.exe
  C:\Windows\System\JlbDElv.exe
  2⤵
  PID:7376
- C:\Windows\System\vdOCMSJ.exe
  C:\Windows\System\vdOCMSJ.exe
  2⤵
  PID:7564
- C:\Windows\System\cCdPFaG.exe
  C:\Windows\System\cCdPFaG.exe
  2⤵
  PID:7600
- C:\Windows\System\enYugDG.exe
  C:\Windows\System\enYugDG.exe
  2⤵
  PID:7672
- C:\Windows\System\xXfbTZu.exe
  C:\Windows\System\xXfbTZu.exe
  2⤵
  PID:7728
- C:\Windows\System\aeMZfRW.exe
  C:\Windows\System\aeMZfRW.exe
  2⤵
  PID:7732
- C:\Windows\System\qHTcGjc.exe
  C:\Windows\System\qHTcGjc.exe
  2⤵
  PID:7768
- C:\Windows\System\dYoiqbw.exe
  C:\Windows\System\dYoiqbw.exe
  2⤵
  PID:7792
- C:\Windows\System\qWXzuVt.exe
  C:\Windows\System\qWXzuVt.exe
  2⤵
  PID:7852
- C:\Windows\System\MDogGAi.exe
  C:\Windows\System\MDogGAi.exe
  2⤵
  PID:7876
- C:\Windows\System\FgaaNkz.exe
  C:\Windows\System\FgaaNkz.exe
  2⤵
  PID:7912
- C:\Windows\System\TInOxZr.exe
  C:\Windows\System\TInOxZr.exe
  2⤵
  PID:7956
- C:\Windows\System\vKhpWwl.exe
  C:\Windows\System\vKhpWwl.exe
  2⤵
  PID:7968
- C:\Windows\System\QBzIyGT.exe
  C:\Windows\System\QBzIyGT.exe
  2⤵
  PID:8032
- C:\Windows\System\bdBJicM.exe
  C:\Windows\System\bdBJicM.exe
  2⤵
  PID:8048
- C:\Windows\System\hKUXXIF.exe
  C:\Windows\System\hKUXXIF.exe
  2⤵
  PID:8080
- C:\Windows\System\zeIkgcc.exe
  C:\Windows\System\zeIkgcc.exe
  2⤵
  PID:8132
- C:\Windows\System\OkjqRDs.exe
  C:\Windows\System\OkjqRDs.exe
  2⤵
  PID:6892
- C:\Windows\System\BGGpGYL.exe
  C:\Windows\System\BGGpGYL.exe
  2⤵
  PID:7180
- C:\Windows\System\VWJCsnI.exe
  C:\Windows\System\VWJCsnI.exe
  2⤵
  PID:8184
- C:\Windows\System\kCCSmdd.exe
  C:\Windows\System\kCCSmdd.exe
  2⤵
  PID:6204
- C:\Windows\System\HqzEtQI.exe
  C:\Windows\System\HqzEtQI.exe
  2⤵
  PID:7468
- C:\Windows\System\fUvSCLz.exe
  C:\Windows\System\fUvSCLz.exe
  2⤵
  PID:7532
- C:\Windows\System\LEowAfc.exe
  C:\Windows\System\LEowAfc.exe
  2⤵
  PID:7356
- C:\Windows\System\iSkgELI.exe
  C:\Windows\System\iSkgELI.exe
  2⤵
  PID:7560
- C:\Windows\System\hUQwMzn.exe
  C:\Windows\System\hUQwMzn.exe
  2⤵
  PID:7452
- C:\Windows\System\jfHrmDS.exe
  C:\Windows\System\jfHrmDS.exe
  2⤵
  PID:7496
- C:\Windows\System\JQexZPK.exe
  C:\Windows\System\JQexZPK.exe
  2⤵
  PID:7576
- C:\Windows\System\yPbdygg.exe
  C:\Windows\System\yPbdygg.exe
  2⤵
  PID:7608
- C:\Windows\System\UPGFMRs.exe
  C:\Windows\System\UPGFMRs.exe
  2⤵
  PID:7628
- C:\Windows\System\LSzxOrw.exe
  C:\Windows\System\LSzxOrw.exe
  2⤵
  PID:7684
- C:\Windows\System\cgdnePs.exe
  C:\Windows\System\cgdnePs.exe
  2⤵
  PID:7724
- C:\Windows\System\rjVRWIz.exe
  C:\Windows\System\rjVRWIz.exe
  2⤵
  PID:7928
- C:\Windows\System\XYDcFOL.exe
  C:\Windows\System\XYDcFOL.exe
  2⤵
  PID:6180
- C:\Windows\System\YxHvlHR.exe
  C:\Windows\System\YxHvlHR.exe
  2⤵
  PID:8020
- C:\Windows\System\ozVNFSe.exe
  C:\Windows\System\ozVNFSe.exe
  2⤵
  PID:8176
- C:\Windows\System\sfvZPQo.exe
  C:\Windows\System\sfvZPQo.exe
  2⤵
  PID:7372
- C:\Windows\System\GfKoQLa.exe
  C:\Windows\System\GfKoQLa.exe
  2⤵
  PID:7344
- C:\Windows\System\aUBNwek.exe
  C:\Windows\System\aUBNwek.exe
  2⤵
  PID:8000
- C:\Windows\System\nRclrdl.exe
  C:\Windows\System\nRclrdl.exe
  2⤵
  PID:7324
- C:\Windows\System\HAGujur.exe
  C:\Windows\System\HAGujur.exe
  2⤵
  PID:7412
- C:\Windows\System\rvsbiGm.exe
  C:\Windows\System\rvsbiGm.exe
  2⤵
  PID:7580
- C:\Windows\System\NswkUfS.exe
  C:\Windows\System\NswkUfS.exe
  2⤵
  PID:8148
- C:\Windows\System\ZKOkiMg.exe
  C:\Windows\System\ZKOkiMg.exe
  2⤵
  PID:8068
- C:\Windows\System\HVofznF.exe
  C:\Windows\System\HVofznF.exe
  2⤵
  PID:7756
- C:\Windows\System\TwDILke.exe
  C:\Windows\System\TwDILke.exe
  2⤵
  PID:7896
- C:\Windows\System\ZwtyYiz.exe
  C:\Windows\System\ZwtyYiz.exe
  2⤵
  PID:7868
- C:\Windows\System\wbWVFlB.exe
  C:\Windows\System\wbWVFlB.exe
  2⤵
  PID:7464
- C:\Windows\System\Tfileau.exe
  C:\Windows\System\Tfileau.exe
  2⤵
  PID:7508
- C:\Windows\System\FyAuLyM.exe
  C:\Windows\System\FyAuLyM.exe
  2⤵
  PID:8164
- C:\Windows\System\owvfvYY.exe
  C:\Windows\System\owvfvYY.exe
  2⤵
  PID:7448
- C:\Windows\System\lElBkVT.exe
  C:\Windows\System\lElBkVT.exe
  2⤵
  PID:8116
- C:\Windows\System\fsgihrw.exe
  C:\Windows\System\fsgihrw.exe
  2⤵
  PID:7692
- C:\Windows\System\XsXmHPB.exe
  C:\Windows\System\XsXmHPB.exe
  2⤵
  PID:7776
- C:\Windows\System\RPniETb.exe
  C:\Windows\System\RPniETb.exe
  2⤵
  PID:7104
- C:\Windows\System\lakrypp.exe
  C:\Windows\System\lakrypp.exe
  2⤵
  PID:7836
- C:\Windows\System\vLhHnTk.exe
  C:\Windows\System\vLhHnTk.exe
  2⤵
  PID:7272
- C:\Windows\System\xElaSco.exe
  C:\Windows\System\xElaSco.exe
  2⤵
  PID:7540
- C:\Windows\System\rZGfvgs.exe
  C:\Windows\System\rZGfvgs.exe
  2⤵
  PID:7652
- C:\Windows\System\OlLazuj.exe
  C:\Windows\System\OlLazuj.exe
  2⤵
  PID:8208
- C:\Windows\System\ArrLBod.exe
  C:\Windows\System\ArrLBod.exe
  2⤵
  PID:8224
- C:\Windows\System\IRAWiDg.exe
  C:\Windows\System\IRAWiDg.exe
  2⤵
  PID:8240
- C:\Windows\System\IawLsJL.exe
  C:\Windows\System\IawLsJL.exe
  2⤵
  PID:8256
- C:\Windows\System\XaiDkOD.exe
  C:\Windows\System\XaiDkOD.exe
  2⤵
  PID:8284
- C:\Windows\System\mMgIzVC.exe
  C:\Windows\System\mMgIzVC.exe
  2⤵
  PID:8300
- C:\Windows\System\htIMQKj.exe
  C:\Windows\System\htIMQKj.exe
  2⤵
  PID:8316
- C:\Windows\System\VcSLOSL.exe
  C:\Windows\System\VcSLOSL.exe
  2⤵
  PID:8332
- C:\Windows\System\pDtTgtf.exe
  C:\Windows\System\pDtTgtf.exe
  2⤵
  PID:8404
- C:\Windows\System\hMWYxij.exe
  C:\Windows\System\hMWYxij.exe
  2⤵
  PID:8420
- C:\Windows\System\bnFJAcx.exe
  C:\Windows\System\bnFJAcx.exe
  2⤵
  PID:8440
- C:\Windows\System\DgiNVIM.exe
  C:\Windows\System\DgiNVIM.exe
  2⤵
  PID:8456
- C:\Windows\System\gBWivTV.exe
  C:\Windows\System\gBWivTV.exe
  2⤵
  PID:8472
- C:\Windows\System\epKrJvt.exe
  C:\Windows\System\epKrJvt.exe
  2⤵
  PID:8492
- C:\Windows\System\FAUBkIB.exe
  C:\Windows\System\FAUBkIB.exe
  2⤵
  PID:8512
- C:\Windows\System\lwvgamX.exe
  C:\Windows\System\lwvgamX.exe
  2⤵
  PID:8528
- C:\Windows\System\QAwozAd.exe
  C:\Windows\System\QAwozAd.exe
  2⤵
  PID:8548
- C:\Windows\System\bHWXKtL.exe
  C:\Windows\System\bHWXKtL.exe
  2⤵
  PID:8568
- C:\Windows\System\IXcGASF.exe
  C:\Windows\System\IXcGASF.exe
  2⤵
  PID:8584
- C:\Windows\System\tqaYgMJ.exe
  C:\Windows\System\tqaYgMJ.exe
  2⤵
  PID:8632
- C:\Windows\System\yFeFgdC.exe
  C:\Windows\System\yFeFgdC.exe
  2⤵
  PID:8648
- C:\Windows\System\aQrXAdm.exe
  C:\Windows\System\aQrXAdm.exe
  2⤵
  PID:8664
- C:\Windows\System\kdqDNrU.exe
  C:\Windows\System\kdqDNrU.exe
  2⤵
  PID:8692
- C:\Windows\System\ukzYBoe.exe
  C:\Windows\System\ukzYBoe.exe
  2⤵
  PID:8708
- C:\Windows\System\WpDOTJp.exe
  C:\Windows\System\WpDOTJp.exe
  2⤵
  PID:8724
- C:\Windows\System\bLhdqlZ.exe
  C:\Windows\System\bLhdqlZ.exe
  2⤵
  PID:8740
- C:\Windows\System\dyiLaHv.exe
  C:\Windows\System\dyiLaHv.exe
  2⤵
  PID:8756
- C:\Windows\System\fUnYBSO.exe
  C:\Windows\System\fUnYBSO.exe
  2⤵
  PID:8776
- C:\Windows\System\Ykshdxm.exe
  C:\Windows\System\Ykshdxm.exe
  2⤵
  PID:8792
- C:\Windows\System\QZCAYRV.exe
  C:\Windows\System\QZCAYRV.exe
  2⤵
  PID:8808
- C:\Windows\System\kiBtVUS.exe
  C:\Windows\System\kiBtVUS.exe
  2⤵
  PID:8828
- C:\Windows\System\xVrAogb.exe
  C:\Windows\System\xVrAogb.exe
  2⤵
  PID:8844
- C:\Windows\System\qDogeyO.exe
  C:\Windows\System\qDogeyO.exe
  2⤵
  PID:8868
- C:\Windows\System\fYJKIxS.exe
  C:\Windows\System\fYJKIxS.exe
  2⤵
  PID:8888
- C:\Windows\System\zxmrzXX.exe
  C:\Windows\System\zxmrzXX.exe
  2⤵
  PID:8904
- C:\Windows\System\ANgZjJf.exe
  C:\Windows\System\ANgZjJf.exe
  2⤵
  PID:8932
- C:\Windows\System\eIguNJR.exe
  C:\Windows\System\eIguNJR.exe
  2⤵
  PID:8952
- C:\Windows\System\OnDpfiI.exe
  C:\Windows\System\OnDpfiI.exe
  2⤵
  PID:8976
- C:\Windows\System\LOwWZto.exe
  C:\Windows\System\LOwWZto.exe
  2⤵
  PID:8992
- C:\Windows\System\TZSXZmF.exe
  C:\Windows\System\TZSXZmF.exe
  2⤵
  PID:9028
- C:\Windows\System\kIzxPWB.exe
  C:\Windows\System\kIzxPWB.exe
  2⤵
  PID:9044
- C:\Windows\System\cQPEKGz.exe
  C:\Windows\System\cQPEKGz.exe
  2⤵
  PID:9060
- C:\Windows\System\XQpEzgX.exe
  C:\Windows\System\XQpEzgX.exe
  2⤵
  PID:9076
- C:\Windows\System\dcwnvuE.exe
  C:\Windows\System\dcwnvuE.exe
  2⤵
  PID:9096
- C:\Windows\System\HdYNfXf.exe
  C:\Windows\System\HdYNfXf.exe
  2⤵
  PID:9112
- C:\Windows\System\WGoTCfY.exe
  C:\Windows\System\WGoTCfY.exe
  2⤵
  PID:9128
- C:\Windows\System\QoJadHy.exe
  C:\Windows\System\QoJadHy.exe
  2⤵
  PID:9148
- C:\Windows\System\BLGxWBk.exe
  C:\Windows\System\BLGxWBk.exe
  2⤵
  PID:9168
- C:\Windows\System\ombfcIC.exe
  C:\Windows\System\ombfcIC.exe
  2⤵
  PID:9192
- C:\Windows\System\iIQpSeE.exe
  C:\Windows\System\iIQpSeE.exe
  2⤵
  PID:9208
- C:\Windows\System\KpjPlow.exe
  C:\Windows\System\KpjPlow.exe
  2⤵
  PID:8292
- C:\Windows\System\MaHAgYq.exe
  C:\Windows\System\MaHAgYq.exe
  2⤵
  PID:8064
- C:\Windows\System\pqBmHTg.exe
  C:\Windows\System\pqBmHTg.exe
  2⤵
  PID:8264
- C:\Windows\System\PeiQbYb.exe
  C:\Windows\System\PeiQbYb.exe
  2⤵
  PID:7668
- C:\Windows\System\hsJUuNE.exe
  C:\Windows\System\hsJUuNE.exe
  2⤵
  PID:7492
- C:\Windows\System\TsOvFUy.exe
  C:\Windows\System\TsOvFUy.exe
  2⤵
  PID:8272
- C:\Windows\System\zoFYOFf.exe
  C:\Windows\System\zoFYOFf.exe
  2⤵
  PID:8340
- C:\Windows\System\DhnLBQo.exe
  C:\Windows\System\DhnLBQo.exe
  2⤵
  PID:8356
- C:\Windows\System\BtABigD.exe
  C:\Windows\System\BtABigD.exe
  2⤵
  PID:8372
- C:\Windows\System\lCnybKv.exe
  C:\Windows\System\lCnybKv.exe
  2⤵
  PID:8396
- C:\Windows\System\QfngTub.exe
  C:\Windows\System\QfngTub.exe
  2⤵
  PID:8448
- C:\Windows\System\xtPNrJZ.exe
  C:\Windows\System\xtPNrJZ.exe
  2⤵
  PID:8524
- C:\Windows\System\MVcxgfo.exe
  C:\Windows\System\MVcxgfo.exe
  2⤵
  PID:8592
- C:\Windows\System\yLvnWCY.exe
  C:\Windows\System\yLvnWCY.exe
  2⤵
  PID:8500
- C:\Windows\System\KLlvwgM.exe
  C:\Windows\System\KLlvwgM.exe
  2⤵
  PID:8536
- C:\Windows\System\zyjkqAb.exe
  C:\Windows\System\zyjkqAb.exe
  2⤵
  PID:8600
- C:\Windows\System\xePQZoQ.exe
  C:\Windows\System\xePQZoQ.exe
  2⤵
  PID:7788
- C:\Windows\System\HFmKyZM.exe
  C:\Windows\System\HFmKyZM.exe
  2⤵
  PID:8644
- C:\Windows\System\hKKwxhl.exe
  C:\Windows\System\hKKwxhl.exe
  2⤵
  PID:8680
- C:\Windows\System\OkPjnmp.exe
  C:\Windows\System\OkPjnmp.exe
  2⤵
  PID:8716
- C:\Windows\System\jREzvTP.exe
  C:\Windows\System\jREzvTP.exe
  2⤵
  PID:8772
- C:\Windows\System\ayscBzC.exe
  C:\Windows\System\ayscBzC.exe
  2⤵
  PID:8840
- C:\Windows\System\eFgnvbt.exe
  C:\Windows\System\eFgnvbt.exe
  2⤵
  PID:8748
- C:\Windows\System\ViuaUFr.exe
  C:\Windows\System\ViuaUFr.exe
  2⤵
  PID:8876
- C:\Windows\System\phetJfx.exe
  C:\Windows\System\phetJfx.exe
  2⤵
  PID:8620
- C:\Windows\System\Jkoshsg.exe
  C:\Windows\System\Jkoshsg.exe
  2⤵
  PID:8972
- C:\Windows\System\aDVqVcq.exe
  C:\Windows\System\aDVqVcq.exe
  2⤵
  PID:9004
- C:\Windows\System\oWlKEID.exe
  C:\Windows\System\oWlKEID.exe
  2⤵
  PID:9072
- C:\Windows\System\bgeOEGH.exe
  C:\Windows\System\bgeOEGH.exe
  2⤵
  PID:9024
- C:\Windows\System\MrZMYNT.exe
  C:\Windows\System\MrZMYNT.exe
  2⤵
  PID:9124
- C:\Windows\System\uTUNBPk.exe
  C:\Windows\System\uTUNBPk.exe
  2⤵
  PID:9120
- C:\Windows\System\QcZdvzC.exe
  C:\Windows\System\QcZdvzC.exe
  2⤵
  PID:9140
- C:\Windows\System\yWkfuGM.exe
  C:\Windows\System\yWkfuGM.exe
  2⤵
  PID:9136
- C:\Windows\System\pNiCTPD.exe
  C:\Windows\System\pNiCTPD.exe
  2⤵
  PID:7812
- C:\Windows\System\jgikqzz.exe
  C:\Windows\System\jgikqzz.exe
  2⤵
  PID:8324
- C:\Windows\System\XsUkbda.exe
  C:\Windows\System\XsUkbda.exe
  2⤵
  PID:7612
- C:\Windows\System\yduhOsb.exe
  C:\Windows\System\yduhOsb.exe
  2⤵
  PID:8348
- C:\Windows\System\kaxsLmo.exe
  C:\Windows\System\kaxsLmo.exe
  2⤵
  PID:8388
- C:\Windows\System\dGEUrLk.exe
  C:\Windows\System\dGEUrLk.exe
  2⤵
  PID:8400
- C:\Windows\System\GHVNXYL.exe
  C:\Windows\System\GHVNXYL.exe
  2⤵
  PID:8364
- C:\Windows\System\tUtWrtQ.exe
  C:\Windows\System\tUtWrtQ.exe
  2⤵
  PID:8520
- C:\Windows\System\etGkTNS.exe
  C:\Windows\System\etGkTNS.exe
  2⤵
  PID:8580
- C:\Windows\System\JviasYw.exe
  C:\Windows\System\JviasYw.exe
  2⤵
  PID:8704
- C:\Windows\System\turzoDQ.exe
  C:\Windows\System\turzoDQ.exe
  2⤵
  PID:8788
- C:\Windows\System\CLIKswv.exe
  C:\Windows\System\CLIKswv.exe
  2⤵
  PID:8612
- C:\Windows\System\IIFiUKY.exe
  C:\Windows\System\IIFiUKY.exe
  2⤵
  PID:8752
- C:\Windows\System\BQNiDHM.exe
  C:\Windows\System\BQNiDHM.exe
  2⤵
  PID:8820
- C:\Windows\System\HtkzUEn.exe
  C:\Windows\System\HtkzUEn.exe
  2⤵
  PID:8884
- C:\Windows\System\XpNTuQn.exe
  C:\Windows\System\XpNTuQn.exe
  2⤵
  PID:8924
- C:\Windows\System\MZjPrCj.exe
  C:\Windows\System\MZjPrCj.exe
  2⤵
  PID:8940
- C:\Windows\System\QYtxjBZ.exe
  C:\Windows\System\QYtxjBZ.exe
  2⤵
  PID:8988
- C:\Windows\System\SwdvdwO.exe
  C:\Windows\System\SwdvdwO.exe
  2⤵
  PID:9012
- C:\Windows\System\CcLOzUc.exe
  C:\Windows\System\CcLOzUc.exe
  2⤵
  PID:9160
- C:\Windows\System\vBjkTWY.exe
  C:\Windows\System\vBjkTWY.exe
  2⤵
  PID:7988
- C:\Windows\System\zSQIlxG.exe
  C:\Windows\System\zSQIlxG.exe
  2⤵
  PID:2800
- C:\Windows\System\kdwYXWZ.exe
  C:\Windows\System\kdwYXWZ.exe
  2⤵
  PID:8308
- C:\Windows\System\LQLTqsW.exe
  C:\Windows\System\LQLTqsW.exe
  2⤵
  PID:8368
- C:\Windows\System\GamLblB.exe
  C:\Windows\System\GamLblB.exe
  2⤵
  PID:8412
- C:\Windows\System\AYyxtTX.exe
  C:\Windows\System\AYyxtTX.exe
  2⤵
  PID:2868
- C:\Windows\System\vhjUVsy.exe
  C:\Windows\System\vhjUVsy.exe
  2⤵
  PID:8484
- C:\Windows\System\GpDNGii.exe
  C:\Windows\System\GpDNGii.exe
  2⤵
  PID:8672
- C:\Windows\System\gDdqRls.exe
  C:\Windows\System\gDdqRls.exe
  2⤵
  PID:8608
- C:\Windows\System\OTHpaOV.exe
  C:\Windows\System\OTHpaOV.exe
  2⤵
  PID:8860
- C:\Windows\System\NqZTOfd.exe
  C:\Windows\System\NqZTOfd.exe
  2⤵
  PID:9040
- C:\Windows\System\PbTBnYk.exe
  C:\Windows\System\PbTBnYk.exe
  2⤵
  PID:9200
- C:\Windows\System\RWBiMKu.exe
  C:\Windows\System\RWBiMKu.exe
  2⤵
  PID:9176
- C:\Windows\System\CgRLyae.exe
  C:\Windows\System\CgRLyae.exe
  2⤵
  PID:8128
- C:\Windows\System\RqdhAml.exe
  C:\Windows\System\RqdhAml.exe
  2⤵
  PID:8416
- C:\Windows\System\hGjWyhX.exe
  C:\Windows\System\hGjWyhX.exe
  2⤵
  PID:8268
- C:\Windows\System\zkXvqoA.exe
  C:\Windows\System\zkXvqoA.exe
  2⤵
  PID:7936
- C:\Windows\System\HaneIAs.exe
  C:\Windows\System\HaneIAs.exe
  2⤵
  PID:8504
- C:\Windows\System\OJrRcrI.exe
  C:\Windows\System\OJrRcrI.exe
  2⤵
  PID:8436
- C:\Windows\System\yIAiFUq.exe
  C:\Windows\System\yIAiFUq.exe
  2⤵
  PID:9000
- C:\Windows\System\LGyEphL.exe
  C:\Windows\System\LGyEphL.exe
  2⤵
  PID:8220
- C:\Windows\System\TMqllEg.exe
  C:\Windows\System\TMqllEg.exe
  2⤵
  PID:8768
- C:\Windows\System\UNLZvnF.exe
  C:\Windows\System\UNLZvnF.exe
  2⤵
  PID:8384
- C:\Windows\System\zXzdhHj.exe
  C:\Windows\System\zXzdhHj.exe
  2⤵
  PID:7900
- C:\Windows\System\lSNKjJS.exe
  C:\Windows\System\lSNKjJS.exe
  2⤵
  PID:8856
- C:\Windows\System\AeFitxi.exe
  C:\Windows\System\AeFitxi.exe
  2⤵
  PID:8280
- C:\Windows\System\lAlappD.exe
  C:\Windows\System\lAlappD.exe
  2⤵
  PID:9092
- C:\Windows\System\hFuKMBZ.exe
  C:\Windows\System\hFuKMBZ.exe
  2⤵
  PID:8916
- C:\Windows\System\fKIMNZD.exe
  C:\Windows\System\fKIMNZD.exe
  2⤵
  PID:9084
- C:\Windows\System\HVMOEpr.exe
  C:\Windows\System\HVMOEpr.exe
  2⤵
  PID:8252
- C:\Windows\System\LWGJGqd.exe
  C:\Windows\System\LWGJGqd.exe
  2⤵
  PID:9236
- C:\Windows\System\ddlWEBj.exe
  C:\Windows\System\ddlWEBj.exe
  2⤵
  PID:9260
- C:\Windows\System\kcHhCTd.exe
  C:\Windows\System\kcHhCTd.exe
  2⤵
  PID:9280
- C:\Windows\System\qIaevBk.exe
  C:\Windows\System\qIaevBk.exe
  2⤵
  PID:9300
- C:\Windows\System\CTwgLxX.exe
  C:\Windows\System\CTwgLxX.exe
  2⤵
  PID:9320
- C:\Windows\System\dtGLSlK.exe
  C:\Windows\System\dtGLSlK.exe
  2⤵
  PID:9336
- C:\Windows\System\OVipVLW.exe
  C:\Windows\System\OVipVLW.exe
  2⤵
  PID:9360
- C:\Windows\System\lUynOyu.exe
  C:\Windows\System\lUynOyu.exe
  2⤵
  PID:9376
- C:\Windows\System\AgScjZF.exe
  C:\Windows\System\AgScjZF.exe
  2⤵
  PID:9396
- C:\Windows\System\pJMUqOP.exe
  C:\Windows\System\pJMUqOP.exe
  2⤵
  PID:9428
- C:\Windows\System\QaZohRF.exe
  C:\Windows\System\QaZohRF.exe
  2⤵
  PID:9448
- C:\Windows\System\jPggLqP.exe
  C:\Windows\System\jPggLqP.exe
  2⤵
  PID:9464
- C:\Windows\System\QshgfLL.exe
  C:\Windows\System\QshgfLL.exe
  2⤵
  PID:9480
- C:\Windows\System\CwASgWw.exe
  C:\Windows\System\CwASgWw.exe
  2⤵
  PID:9500
- C:\Windows\System\bRRjRbB.exe
  C:\Windows\System\bRRjRbB.exe
  2⤵
  PID:9524
- C:\Windows\System\omHozDu.exe
  C:\Windows\System\omHozDu.exe
  2⤵
  PID:9548
- C:\Windows\System\CJdxrFK.exe
  C:\Windows\System\CJdxrFK.exe
  2⤵
  PID:9568
- C:\Windows\System\cwiApPS.exe
  C:\Windows\System\cwiApPS.exe
  2⤵
  PID:9584
- C:\Windows\System\NwZISyq.exe
  C:\Windows\System\NwZISyq.exe
  2⤵
  PID:9600
- C:\Windows\System\mcYdvEz.exe
  C:\Windows\System\mcYdvEz.exe
  2⤵
  PID:9624
- C:\Windows\System\yvJdLzo.exe
  C:\Windows\System\yvJdLzo.exe
  2⤵
  PID:9648
- C:\Windows\System\HziKInO.exe
  C:\Windows\System\HziKInO.exe
  2⤵
  PID:9664
- C:\Windows\System\HpNcSTf.exe
  C:\Windows\System\HpNcSTf.exe
  2⤵
  PID:9684
- C:\Windows\System\pKMEKZV.exe
  C:\Windows\System\pKMEKZV.exe
  2⤵
  PID:9704
- C:\Windows\System\DNHANRL.exe
  C:\Windows\System\DNHANRL.exe
  2⤵
  PID:9728
- C:\Windows\System\VwocmpP.exe
  C:\Windows\System\VwocmpP.exe
  2⤵
  PID:9744
- C:\Windows\System\vxwwWzl.exe
  C:\Windows\System\vxwwWzl.exe
  2⤵
  PID:9760
- C:\Windows\System\WuNndBX.exe
  C:\Windows\System\WuNndBX.exe
  2⤵
  PID:9788
- C:\Windows\System\gZkxqkT.exe
  C:\Windows\System\gZkxqkT.exe
  2⤵
  PID:9804
- C:\Windows\System\eTXWoEF.exe
  C:\Windows\System\eTXWoEF.exe
  2⤵
  PID:9824
- C:\Windows\System\RffVjsk.exe
  C:\Windows\System\RffVjsk.exe
  2⤵
  PID:9840
- C:\Windows\System\uHjJvWk.exe
  C:\Windows\System\uHjJvWk.exe
  2⤵
  PID:9856
- C:\Windows\System\tyNkWyZ.exe
  C:\Windows\System\tyNkWyZ.exe
  2⤵
  PID:9876
- C:\Windows\System\qtqVvaf.exe
  C:\Windows\System\qtqVvaf.exe
  2⤵
  PID:9908
- C:\Windows\System\CIAGXoG.exe
  C:\Windows\System\CIAGXoG.exe
  2⤵
  PID:9928
- C:\Windows\System\vyzuPRE.exe
  C:\Windows\System\vyzuPRE.exe
  2⤵
  PID:9944
- C:\Windows\System\FCytenG.exe
  C:\Windows\System\FCytenG.exe
  2⤵
  PID:9964
- C:\Windows\System\xkpdFwW.exe
  C:\Windows\System\xkpdFwW.exe
  2⤵
  PID:9988
- C:\Windows\System\yOEejlc.exe
  C:\Windows\System\yOEejlc.exe
  2⤵
  PID:10004
- C:\Windows\System\dXNCVAO.exe
  C:\Windows\System\dXNCVAO.exe
  2⤵
  PID:10024
- C:\Windows\System\ueEXZFJ.exe
  C:\Windows\System\ueEXZFJ.exe
  2⤵
  PID:10040
- C:\Windows\System\oRKptmo.exe
  C:\Windows\System\oRKptmo.exe
  2⤵
  PID:10056
- C:\Windows\System\ENxpnqg.exe
  C:\Windows\System\ENxpnqg.exe
  2⤵
  PID:10072
- C:\Windows\System\tCaxtti.exe
  C:\Windows\System\tCaxtti.exe
  2⤵
  PID:10088
- C:\Windows\System\fMgXReK.exe
  C:\Windows\System\fMgXReK.exe
  2⤵
  PID:10104
- C:\Windows\System\ikKmZgJ.exe
  C:\Windows\System\ikKmZgJ.exe
  2⤵
  PID:10124
- C:\Windows\System\wjSChbn.exe
  C:\Windows\System\wjSChbn.exe
  2⤵
  PID:10148
- C:\Windows\System\jWONYHL.exe
  C:\Windows\System\jWONYHL.exe
  2⤵
  PID:10164
- C:\Windows\System\BEvAKkR.exe
  C:\Windows\System\BEvAKkR.exe
  2⤵
  PID:10184
- C:\Windows\System\dTzxMDQ.exe
  C:\Windows\System\dTzxMDQ.exe
  2⤵
  PID:10204
- C:\Windows\System\fTVnwfZ.exe
  C:\Windows\System\fTVnwfZ.exe
  2⤵
  PID:10224
- C:\Windows\System\NtFSmLq.exe
  C:\Windows\System\NtFSmLq.exe
  2⤵
  PID:9052
- C:\Windows\System\ytwsgcj.exe
  C:\Windows\System\ytwsgcj.exe
  2⤵
  PID:9268
- C:\Windows\System\yoTKYQW.exe
  C:\Windows\System\yoTKYQW.exe
  2⤵
  PID:9256
- C:\Windows\System\bVAYort.exe
  C:\Windows\System\bVAYort.exe
  2⤵
  PID:9288
- C:\Windows\System\dxgASYZ.exe
  C:\Windows\System\dxgASYZ.exe
  2⤵
  PID:9352
- C:\Windows\System\eXXMcEl.exe
  C:\Windows\System\eXXMcEl.exe
  2⤵
  PID:9388
- C:\Windows\System\hIDxrhB.exe
  C:\Windows\System\hIDxrhB.exe
  2⤵
  PID:9412
- C:\Windows\System\nHpjOmM.exe
  C:\Windows\System\nHpjOmM.exe
  2⤵
  PID:9436
- C:\Windows\System\ALJkCji.exe
  C:\Windows\System\ALJkCji.exe
  2⤵
  PID:9472
- C:\Windows\System\ImAlykz.exe
  C:\Windows\System\ImAlykz.exe
  2⤵
  PID:9508
- C:\Windows\System\iSMCLyn.exe
  C:\Windows\System\iSMCLyn.exe
  2⤵
  PID:9544
- C:\Windows\System\aRsVfEW.exe
  C:\Windows\System\aRsVfEW.exe
  2⤵
  PID:9560
- C:\Windows\System\NEiAVMM.exe
  C:\Windows\System\NEiAVMM.exe
  2⤵
  PID:9608
- C:\Windows\System\HxRxiJH.exe
  C:\Windows\System\HxRxiJH.exe
  2⤵
  PID:9640
- C:\Windows\System\XcKDbuS.exe
  C:\Windows\System\XcKDbuS.exe
  2⤵
  PID:9680
- C:\Windows\System\yyTnhXT.exe
  C:\Windows\System\yyTnhXT.exe
  2⤵
  PID:9700
- C:\Windows\System\DEIrEWV.exe
  C:\Windows\System\DEIrEWV.exe
  2⤵
  PID:9768
- C:\Windows\System\GbCvzrq.exe
  C:\Windows\System\GbCvzrq.exe
  2⤵
  PID:9756
- C:\Windows\System\QuJkjqp.exe
  C:\Windows\System\QuJkjqp.exe
  2⤵
  PID:1556
- C:\Windows\System\gTHScKx.exe
  C:\Windows\System\gTHScKx.exe
  2⤵
  PID:9816
- C:\Windows\System\kFDsNKR.exe
  C:\Windows\System\kFDsNKR.exe
  2⤵
  PID:9868
- C:\Windows\System\iwDYOVk.exe
  C:\Windows\System\iwDYOVk.exe
  2⤵
  PID:9892
- C:\Windows\System\jBYSunD.exe
  C:\Windows\System\jBYSunD.exe
  2⤵
  PID:9920
- C:\Windows\System\sRScvsO.exe
  C:\Windows\System\sRScvsO.exe
  2⤵
  PID:9956
- C:\Windows\System\NUCxKUA.exe
  C:\Windows\System\NUCxKUA.exe
  2⤵
  PID:9980
- C:\Windows\System\ZIqAgoD.exe
  C:\Windows\System\ZIqAgoD.exe
  2⤵
  PID:10064
- C:\Windows\System\UbuouGq.exe
  C:\Windows\System\UbuouGq.exe
  2⤵
  PID:10180
- C:\Windows\System\bfrWMCB.exe
  C:\Windows\System\bfrWMCB.exe
  2⤵
  PID:10112
- C:\Windows\System\FEQMBBN.exe
  C:\Windows\System\FEQMBBN.exe
  2⤵
  PID:10016
- C:\Windows\System\nARgWUg.exe
  C:\Windows\System\nARgWUg.exe
  2⤵
  PID:10012
- C:\Windows\System\ujJPbMv.exe
  C:\Windows\System\ujJPbMv.exe
  2⤵
  PID:10120
- C:\Windows\System\bFxxwHC.exe
  C:\Windows\System\bFxxwHC.exe
  2⤵
  PID:10232
- C:\Windows\System\JpXNwVg.exe
  C:\Windows\System\JpXNwVg.exe
  2⤵
  PID:9276
- C:\Windows\System\tTDCYBx.exe
  C:\Windows\System\tTDCYBx.exe
  2⤵
  PID:9292
- C:\Windows\System\jAjiBlA.exe
  C:\Windows\System\jAjiBlA.exe
  2⤵
  PID:9416

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\BTBpHDG.exe

Filesize
2.6MB

MD5
ff9d15a1d1ecc6187bb7473d32f97260

SHA1
1ace4d69fa856d8f68bea20a7187ac407ff82561

SHA256
20fe7fd47c33587914b25b2f192b80e001c058ad6189e8690f33680cf1dec941

SHA512
3ba22cf2e3b6565080b09f35a49656e3c2ee6c823cf349b03cd25e29e5e1c775de241046d64a9e56640f90e35be99941f16da29baedc8dc8f353b7da254160f8

Download Submit
C:\Windows\system\DupPeRH.exe

Filesize
2.6MB

MD5
cda12377a3748c0af3b06858dea4a30d

SHA1
205eb6179439ed4d1ab9b6cd665cb850e51875a4

SHA256
b2d9307770b9127a73fc1c6991f6f9151febf69d76cad36434838528abfb4aec

SHA512
58c480a49d8baf62b9b3b0fa448370aaa17058d1495c39048fdd3ac9af9e77e62c068f82653d1c5da9138128f786a7c07cf1c9e66ccb0158add010d65d55a242

Download Submit
C:\Windows\system\FbiDEGm.exe

Filesize
2.6MB

MD5
4086e848f5197cb3fd2bc41fb3214bc3

SHA1
27db8b3068e3d36771cefe0893757431140b5385

SHA256
60aa9998d06fd67feb4f77eefad912569d2420c18b7ec48e718403fd9df6b1bf

SHA512
6a2b47106c912af971aeeab124cb663553c63d66985e4c48a99bc6a1d3008019077e3ee3bd7826b9d918d88ed024edf5febe0ccf723449da193942e5de1cf4ee

Download Submit
C:\Windows\system\FhnyRqv.exe

Filesize
2.6MB

MD5
c14519fc02bdf4ba12a9515321ca07ab

SHA1
7c4dd80e40e31c5484061e19645b985ca2d18203

SHA256
66b87fbc13bbbce4e9e6c63085d56b9b90501c0d931c72950894f5ce70cd51eb

SHA512
8a44ce27f58387a83e4f118074c4297674950f5344f5c9c5e8d46cb4f62b52497372fdac4c49a2953d43ed05e3f259eed1ff9f0280003a711fc87a5a38493368

Download Submit
C:\Windows\system\GuWjzFB.exe

Filesize
2.6MB

MD5
bac13559785f650f55fb5e3871349827

SHA1
7a87695922006bea42f484b62191b88d170f1ea1

SHA256
f0dcfe912f6897c8eb9ee2065e091b1c06457ff1ce188f671e089b09b01690ea

SHA512
f6611663fe4c958c4dc3456b121a4690b028cabc085dc65d97947afd01e83bbc62142df56d51daaffdbbd988b74e678142afd22268f280a1e53aba91250307d1

Download Submit
C:\Windows\system\HgYSuPY.exe

Filesize
2.6MB

MD5
f6dc1ee4b6b9f2dde7c6d17377b47743

SHA1
98168816eedcc9aff34dda02e1a4cf5a2846c6b1

SHA256
1e7ab3a131b8dde5500715682812a8728e83f7b49a16345ec57fb518607f854e

SHA512
98a38bb67f17a8a12bd17db2c989a87edca56b1c23da7390983dac9be997220fcd3cc40c8d92d588d6a21d91a77a8a8ae2fee64a783218fe7fc000f6d0a336ec

Download Submit
C:\Windows\system\KYxdXjV.exe

Filesize
2.6MB

MD5
d9550ce24fd6cf5b49f1e3e0b90f102c

SHA1
0b0dd99bb11b598b422254f0a543f0b3862b3f42

SHA256
73168e182ab77bb2f5d6dad5f8f438c5571ab39a72ae82cc689bfc0639fef998

SHA512
32a211390414fea10d27d0c03d70f85d9327b77139bc3df0fd55b554a4ea55a23e17dd8d3fa79772cffddd357b8599225c43107f33e3d1ab41393657eeef0a3d

Download Submit
C:\Windows\system\MPHlvBr.exe

Filesize
2.6MB

MD5
28c2c19b6163167c9551448f5682d4af

SHA1
1854678c20e1a90bb16453e484b2dbf2bb56a8e2

SHA256
8495723f9c65846f7648299ba9764653b4a400bd8936abada0c9700377030432

SHA512
7742deb1d68fff663e84271b20581736d91619a7ecae89d451c30dbb9353c51d5d40a058922cc368113aeb089e34da627c93797d840eb92ef123c541f4edf36f

Download Submit
C:\Windows\system\NCtQCvX.exe

Filesize
2.6MB

MD5
1fe8e94b8135440ab0928f0ae0528954

SHA1
a6ff3cdda43e7468e6e1fd6976d9668b17e42ddb

SHA256
01d3411c43ab91116fd8e313c34db62385d36d8176130040436e0514a46030cf

SHA512
1b77811dac99822d8f892ffd1d31c3e3db287761c88a027f575d845d4544b6750a682ac2533d3868193514b5ddb89c709ef550dedc091ab56cb99ec43edde880

Download Submit
C:\Windows\system\NTUImws.exe

Filesize
2.6MB

MD5
cd0a3b341c33c5ff304bdef6651ff862

SHA1
6f2bd218a27e60dad856f6a231f85c83f2e00b53

SHA256
9c0fa0cc7d526121646569b527f1131e7833b826ca0d364ae6426626b7e8187c

SHA512
4b6cbe029b239bf05422e9aea40a8afb5d4ae297fcba3bf096e65f4f1a6a43c60859b5d6f7073682584bcfaeb48f7dfcd907874bf329ff003c4d15b3ac959871

Download Submit
C:\Windows\system\UkimAHG.exe

Filesize
2.6MB

MD5
e88ebef03aa0dd15be0b4fbd316e887b

SHA1
19a9c0ec692250ae12f7072880e692ae9a36ea4d

SHA256
29cec7abf3865158e97dcfec1d6b230889cdc50694b11112e63f373e6651cf41

SHA512
b087f9db25949d0d3b0f780507cf74032857a6da710e7db7ef2732c4988c5c017da7f99a73605a8efbf47c179022138f856c211da5126b1844abf13358d2d646

Download Submit
C:\Windows\system\VcMmpKg.exe

Filesize
2.6MB

MD5
11fb8630310fb64a7f41f65fe69e3921

SHA1
31286fca4111dcf82e3f1f22f567461c89fe5673

SHA256
699f1ab34bce753df32dff8fd2b406dc465ed39373021f1126ac2cca04d2faf4

SHA512
dbbf0a78dd090cb2802c553344cad5eb7cea447a87682ff8bbf5d4c68a1a8800bc6efc572039efce0af955863f52347be0403bfb76b967f2e40468de8af7cff8

Download Submit
C:\Windows\system\WgMftYD.exe

Filesize
2.6MB

MD5
254934548831f0ee3544d904329a0abd

SHA1
af9dfbf1f531a7a39add11d8ad4be143902cccdb

SHA256
1fd0d13ce9ffb3bd40f4b180043af2e45d4bcedf9c335233a9f534ece6d2e1ce

SHA512
dbaee63f7a8c8dde401b217bbcd8ff985566ee16b014298a5b50f772597c1153058f501a61c7000627573684c3a73d60f10da6ab88661949d8bdb527344d8568

Download Submit
C:\Windows\system\XaOTwSq.exe

Filesize
2.6MB

MD5
55faf8c976fbe8a9fa973fed690be155

SHA1
feee351c4c26e09ac3afef84e349346528828b35

SHA256
332638ba660919080c42f7f0886dea28886f6e8a1dd8e45954b15baacf8e4278

SHA512
1521a72259070ea862eec6c12bcbe00a4131e3b8e464465efaaa8f87d340833d9f9a4c0369dbbc6231b7cb5aa7314ca664e61ce5049e0f6e466f46d8b3382444

Download Submit
C:\Windows\system\maZrlNK.exe

Filesize
2.6MB

MD5
388f221445c4eb4c6008de52906f90f9

SHA1
39cc16ec0c4e5890b7e3b76eba6b5dd3a0ceeaf6

SHA256
3072db74da0439b4dab593d5984d125d2de376cabb94a0a51a5d202dc29b4b84

SHA512
8f291e8a0ab819a34ce65a02c0f92c6c0f4af07bb4d4a25262e98fbb71b6316ed476f731c4279587e43187aa78649906585d5eb82c98b36de6ff48e80ea21008

Download Submit
C:\Windows\system\nILZMSb.exe

Filesize
2.6MB

MD5
541f705d2e71536e32fd507a6e57b182

SHA1
fe25182ff5444ca4b496d818b7f8279545c1a7a8

SHA256
5881d695f815b050a84740a936cddc39f926d75120c57cef35585fa925d5515d

SHA512
5481c4661d5099f232732e3a3ec0822faebcc3cceee172992a3bd9b57cf10139af1dc5cc2a13a0d770e3a5682f26a7b7d0d4ebc9e6dd74fc0c72205d0f7c0df0

Download Submit
C:\Windows\system\pPZdxII.exe

Filesize
2.6MB

MD5
6c765cad8abb32102b1815460dcf6180

SHA1
ee5cf754411f2f8e956351e19c5120b656f2c740

SHA256
aa349feeef9e7e088057c13225d3ac1a233db1d769f71c50422891ff9b4ea404

SHA512
87853fcab84ea1ce313171e59d99b9f6d7841635cac5cd5622e85d88a133b7ecc8f91a1e3def20b4c0e34f9df29aacb22c7f0639d2f8140c6cf6101246e57ad7

Download Submit
C:\Windows\system\pqMKJXj.exe

Filesize
2.6MB

MD5
32eb1b4bf80b3c906e0bf698319b8698

SHA1
397717df9fb9bbfbcc1160eff73bc4c3a92b8fc2

SHA256
e4972c1b4518f94dc81cf03c998906721c68c8209b8a8890d071e75621afdd54

SHA512
70880be2c4e6eb78192089afe912bf292868ab2fbf9ffd3aae370516bb95a7e741197aea846cbafcc6b69fdd91f57e7da39a36914b26112a561109a5e20ab50e

Download Submit
C:\Windows\system\qssZgAO.exe

Filesize
2.6MB

MD5
2f3d484a14ffba48b523aa801a0e93e4

SHA1
8f26f08390af9673df24a172e16433de76b287dc

SHA256
0797363a5b8ed21c51516be5004ecca2aaca43be52230c5dd7f0de372c697149

SHA512
5cb964370aa676aef17d4c282aaa3ab313c8bd1847991a277d12b5802290e8dc649a27ca5ddaf6d23d2cc7c9ac597bde83f91e8d67857e8bd1ec17302dbb9ec2

Download Submit
C:\Windows\system\tPCEscq.exe

Filesize
2.6MB

MD5
b1a606867c962af6ee9642e489fb8a48

SHA1
40e91c3fe5d14a4148956f805376c6cc7038f093

SHA256
cd91a6e79e4711217bc88367b63fae9c944cb2a2d8d2e079def7979a6167bc2a

SHA512
53b0ad39abb803d61817511293a472c91594a70aaaa17332099924d03db9a5632414dd2952899867712566f39dca0cd0caba7f10803edb7f7908358b62ba3fac

Download Submit
C:\Windows\system\xZqNoHq.exe

Filesize
2.6MB

MD5
435a13fc34d02d3a1458ae1eb6ab27aa

SHA1
b50b3d15955d55d81b496f699a2e0e71c548bb7c

SHA256
b6022f017ddf2d77ea12ebb293ebc9b5284fc9fc9c1ab435a086dd50638301a4

SHA512
3290a33e89684ece6192beb2e7f7e5af24471149008129d16f6d315d6a7ecdc1e5ce372990e05cff68af6ed94959b696e915dd3d725679854a89e3ef7c3d6a1c

Download Submit
C:\Windows\system\xvwLTFo.exe

Filesize
2.6MB

MD5
2fc23ce8eca0019b4afe32f81d77dbf9

SHA1
699ec9ff43b08c54c25860efd2fa2c4e38edde20

SHA256
6030998f7790303c65602db20c05b0819ef0d22d895e471bc589cb839144b6a1

SHA512
9bc8ccf01b35dd078dbe4434c4335bc128b8232d01c077ceededd4f12081da0bd7adf147a5ca18b5df482e98fe64a535d3e6e62a2364c0ff6d4e18c33a219dcb

Download Submit
C:\Windows\system\yTKXhHg.exe

Filesize
2.6MB

MD5
99567495395ef99dda0cceb238039fd4

SHA1
db65478cd1725d3c769db2486384ceba12f0b5fc

SHA256
a5b2b8155c7702e8aec57e8cd6805a8dc05f78ea0d29bc74de8cbd24f0de77d1

SHA512
50c09f2007e5176219058d4d19fcf51b401210ebb8a994d44a9b7e02c282717ea277102c5fef21dd507380b30252ee277a8085d734f1d978e53d4575cedbd315

Download Submit
C:\Windows\system\zMVecDv.exe

Filesize
2.6MB

MD5
b869d0a9d4fe5708422f19a331e7ea1b

SHA1
2850c3237a7b5721b0807adeabe1e99ea43b0e93

SHA256
6b18bd4c2f88055f43b21ef27d6bae84bb1176beff96c62a92c28923f25ce15d

SHA512
b4940bd1e3fdfc64cf1e2dc101720d08f62c09f48a6474fd8da214b2b7aac03d785d9a93b7ea35b6858b537eeda730f8ed7de780bdc0428d48db742c1094f266

Download Submit
\Windows\system\CKKHAGm.exe

Filesize
2.6MB

MD5
4a314b332e02691e6d26cbae45140f68

SHA1
054634f4ef54fe9275a439dafb28c2a09edabd13

SHA256
2376d5d0c07b9f972e1a88965cd8004c774cbfc162155a1d6bfd5fc817b41997

SHA512
410ece098266f7d944bc6a0abe5df7ea0cb54853ea2bcdbb8c59eb933b926c673279f1a8d0adfccc8850da38e2b867f9095e33b57dadd01ac879a9a8af203dfc

Download Submit
\Windows\system\PHSzJBb.exe

Filesize
2.6MB

MD5
a8b98699bda580548b1812fb1e3c4954

SHA1
23e8f7772b198e93e87c6158c0a83223b5cff2ab

SHA256
7772883dc583082026455b8fdc0025dc043f1a43a348212bb7367b567cd11603

SHA512
a1ae4bd5660060b91095c8a791588bfd3acdd6e020902f9d443e82ba00c29c1a9f717395585ab1bf2f1175e3982c348fdf4ff6e7f8c9ca218733715df92647aa

Download Submit
\Windows\system\TcOoZCC.exe

Filesize
2.6MB

MD5
a7762f19ea02a03d96312e7206dab379

SHA1
b35b382cd55c1040155a5071bf0227526d9aecfe

SHA256
8f70d0c283e852b5b8ba12793aae88908bfcfbab4e7727e1c798e382a0f151b2

SHA512
e8b121b584fafc70c98efd22a7e6cbe60f59a8c56b9fb8041c851a222041013917dda543efb3fe858ece19371884dc1c0048fdeeb04cd7bb77309ced65c8c7ff

Download Submit
\Windows\system\aztFqPO.exe

Filesize
2.6MB

MD5
724c5bb3282dd8830c8963e5d1f4ffb6

SHA1
8ed708c77b97018f8a4f5d9f83cbf1e088313247

SHA256
fe8140d51f685b8ff95a5e7edab739c1dbf1ea86349b9319c7b09df3c10a7f8c

SHA512
e442cbb1273ae48acba3c9c24eee13ecf1ac45da8a4cb6c29fb9a6f4ceb356c889bdbe0df495fb29116509beb54353a08a35af750cd69ad2507658454371c975

Download Submit
\Windows\system\dsBzEHf.exe

Filesize
2.6MB

MD5
1e3f6344ba79d3be818b7e8821636a24

SHA1
171d7a31346dd5ed4cd6426312f4c10f49a58c9a

SHA256
319980274c9003f0b1fcb6c825e0959c27c1c691f4e1f03f6022cff8fe5f285b

SHA512
15f8ab9c02ad9d4f1fd59bcb3937dde317dd12a03d217e4dfa2901468695f0724020c360dca0c5b3a87c46fb9fda093c0bb2a3de2ac0e82300569e0e788a57d2

Download Submit
\Windows\system\kMNLqvx.exe

Filesize
2.6MB

MD5
a3fba4e35d70bc19fed2a92044d132cb

SHA1
97b233dc86217c494ddb8c2573d55d8dc43bb419

SHA256
20751913c2162ec1787921f2b6a35e3ce9c0a67d5a026d962404b52340bc0f2e

SHA512
88054a29135dafaffb1c240d20e0e1f26dca827395a81c090285605422a7ab60f30e7ee8519f67781f360823cf76e248113d04229bb8069d9e86e030144ec7d5

Download Submit
\Windows\system\kXpFGYf.exe

Filesize
2.6MB

MD5
073a072c0eef67bae02dc61573edada1

SHA1
eac6755cb83555900be957a0fa2c4a18d1e1c39e

SHA256
cac42ad298d99277bc928763a66b2416104ebfba551293fc037d586679d68bbd

SHA512
f13b84f0535328585d2ffd9480a8468eee5a9ba291b06f58c6998bf329e33f4b13256e9fe865730e3407a45c4686cebf6620eb1646b3e6da06c5611ed8530579

Download Submit
\Windows\system\mtaAyPI.exe

Filesize
2.6MB

MD5
0215aed8a6a39c82e2df0cbffd2a37da

SHA1
127180ac329b5f23dabb5279a4fa3472cdb1c4a3

SHA256
6c91550612ebd23f873b77b2054ad498e3d388cd6acd62f9dffefae5d83f5796

SHA512
50c13922a54eebaa4df18185e217894d6342efea8eca967fa998ac4542a0f33675c5de82c2d4623d8050f04d862a00a9bf9e660eed654b6369208d646ee43d2f

Download Submit
memory/1068-108-0x000000013F760000-0x000000013FB56000-memory.dmp

Filesize
4.0MB

Download
memory/1068-30-0x0000000002C20000-0x0000000003016000-memory.dmp

Filesize
4.0MB

Download
memory/1068-0-0x0000000000100000-0x0000000000110000-memory.dmp

Filesize
64KB

Download
memory/1068-105-0x000000013FFC0000-0x00000001403B6000-memory.dmp

Filesize
4.0MB

Download
memory/1068-1-0x000000013FB80000-0x000000013FF76000-memory.dmp

Filesize
4.0MB

Download
memory/1068-97-0x0000000002F60000-0x0000000003356000-memory.dmp

Filesize
4.0MB

Download
memory/1068-111-0x000000013F5B0000-0x000000013F9A6000-memory.dmp

Filesize
4.0MB

Download
memory/1068-112-0x000000013F450000-0x000000013F846000-memory.dmp

Filesize
4.0MB

Download
memory/1068-16-0x000000013F060000-0x000000013F456000-memory.dmp

Filesize
4.0MB

Download
memory/1068-73-0x0000000002F60000-0x0000000003356000-memory.dmp

Filesize
4.0MB

Download
memory/1068-4248-0x0000000002F60000-0x0000000003356000-memory.dmp

Filesize
4.0MB

Download
memory/1068-51-0x0000000002F60000-0x0000000003356000-memory.dmp

Filesize
4.0MB

Download
memory/1068-41-0x0000000002F60000-0x0000000003356000-memory.dmp

Filesize
4.0MB

Download
memory/1068-125-0x0000000002F60000-0x0000000003356000-memory.dmp

Filesize
4.0MB

Download
memory/1068-123-0x000000013FFE0000-0x00000001403D6000-memory.dmp

Filesize
4.0MB

Download
memory/1068-120-0x0000000002F60000-0x0000000003356000-memory.dmp

Filesize
4.0MB

Download
memory/1272-46-0x000000013FF30000-0x0000000140326000-memory.dmp

Filesize
4.0MB

Download
memory/1272-8587-0x000000013FF30000-0x0000000140326000-memory.dmp

Filesize
4.0MB

Download
memory/2148-8588-0x000000013F7F0000-0x000000013FBE6000-memory.dmp

Filesize
4.0MB

Download
memory/2148-37-0x000000013F7F0000-0x000000013FBE6000-memory.dmp

Filesize
4.0MB

Download
memory/2244-121-0x000000013F860000-0x000000013FC56000-memory.dmp

Filesize
4.0MB

Download
memory/2244-8593-0x000000013F860000-0x000000013FC56000-memory.dmp

Filesize
4.0MB

Download
memory/2332-28-0x000000013F060000-0x000000013F456000-memory.dmp

Filesize
4.0MB

Download
memory/2332-8589-0x000000013F060000-0x000000013F456000-memory.dmp

Filesize
4.0MB

Download
memory/2476-8595-0x000000013FFE0000-0x00000001403D6000-memory.dmp

Filesize
4.0MB

Download
memory/2476-104-0x000000013FFE0000-0x00000001403D6000-memory.dmp

Filesize
4.0MB

Download
memory/2516-88-0x000000013F350000-0x000000013F746000-memory.dmp

Filesize
4.0MB

Download
memory/2516-8594-0x000000013F350000-0x000000013F746000-memory.dmp

Filesize
4.0MB

Download
memory/2528-8592-0x000000013F980000-0x000000013FD76000-memory.dmp

Filesize
4.0MB

Download
memory/2528-117-0x000000013F980000-0x000000013FD76000-memory.dmp

Filesize
4.0MB

Download
memory/2596-59-0x000000013FC00000-0x000000013FFF6000-memory.dmp

Filesize
4.0MB

Download
memory/2596-8591-0x000000013FC00000-0x000000013FFF6000-memory.dmp

Filesize
4.0MB

Download
memory/2740-8590-0x000000013F760000-0x000000013FB56000-memory.dmp

Filesize
4.0MB

Download
memory/2740-110-0x000000013F760000-0x000000013FB56000-memory.dmp

Filesize
4.0MB

Download
memory/2864-650-0x000000001B5A0000-0x000000001B882000-memory.dmp

Filesize
2.9MB

Download
memory/2864-752-0x00000000027A0000-0x00000000027A8000-memory.dmp

Filesize
32KB

Download