xmrig | 3e155deca1b6c8cd4f62d4f6ffe75098b54b104030106f4147744c8281de3141

Analysis

max time kernel
150s
max time network
143s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
16/05/2024, 04:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9b976c1da9157ecfd86eaa3dec1d8e10_NeikiAnalytics.exe
Size

1.9MB
MD5

9b976c1da9157ecfd86eaa3dec1d8e10
SHA1

66e3b29d4769a0afd45ce0c2d6d5d730e888a242
SHA256

3e155deca1b6c8cd4f62d4f6ffe75098b54b104030106f4147744c8281de3141
SHA512

e6d94d037be4c760c170c911644fef2325aa9afb587db0bf011213ad8cb4134f5fd0fc0b2e1b6a8e05ad13d7b759c46ca2a670e64ce113e9f6080b23181447f4
SSDEEP

49152:T1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrSax91MkibTIDiaed:T1ONtyBeSFkXV1etEKLlWUTOfeiRA2Rt

Score

10^/10

xmrig execution miner

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 63 IoCs

miner

resource	yara_rule
behavioral1/memory/1712-0-0x000000013FE50000-0x000000014023D000-memory.dmp	xmrig
behavioral1/files/0x000c00000001443b-5.dat	xmrig
behavioral1/memory/2620-7-0x000000013FF60000-0x000000014034D000-memory.dmp	xmrig
behavioral1/memory/3008-13-0x000000013F600000-0x000000013F9ED000-memory.dmp	xmrig
behavioral1/files/0x00340000000146fc-12.dat	xmrig
behavioral1/files/0x0007000000014a9a-19.dat	xmrig
behavioral1/files/0x000e0000000054ab-26.dat	xmrig
behavioral1/files/0x0008000000014b4c-33.dat	xmrig
behavioral1/files/0x0006000000015cff-52.dat	xmrig
behavioral1/files/0x0006000000015d42-76.dat	xmrig
behavioral1/memory/2468-34-0x000000013FAB0000-0x000000013FE9D000-memory.dmp	xmrig
behavioral1/files/0x0006000000015d87-106.dat	xmrig
behavioral1/memory/2748-109-0x000000013F0D0000-0x000000013F4BD000-memory.dmp	xmrig
behavioral1/files/0x0009000000014fa2-46.dat	xmrig
behavioral1/memory/1832-120-0x000000013FB00000-0x000000013FEED000-memory.dmp	xmrig
behavioral1/memory/868-134-0x000000013FCD0000-0x00000001400BD000-memory.dmp	xmrig
behavioral1/memory/2760-157-0x000000013F480000-0x000000013F86D000-memory.dmp	xmrig
behavioral1/files/0x00060000000164aa-160.dat	xmrig
behavioral1/memory/2320-152-0x000000013F740000-0x000000013FB2D000-memory.dmp	xmrig
behavioral1/memory/1100-177-0x000000013F0C0000-0x000000013F4AD000-memory.dmp	xmrig
behavioral1/files/0x0006000000016c5e-199.dat	xmrig
behavioral1/memory/1708-194-0x000000013F7E0000-0x000000013FBCD000-memory.dmp	xmrig
behavioral1/files/0x0006000000016c44-193.dat	xmrig
behavioral1/memory/2960-189-0x000000013F7B0000-0x000000013FB9D000-memory.dmp	xmrig
behavioral1/files/0x0006000000016adc-188.dat	xmrig
behavioral1/memory/448-182-0x000000013FFE0000-0x00000001403CD000-memory.dmp	xmrig
behavioral1/files/0x0006000000016851-181.dat	xmrig
behavioral1/files/0x0006000000016616-176.dat	xmrig
behavioral1/files/0x000600000001621e-151.dat	xmrig
behavioral1/memory/2964-168-0x000000013FA60000-0x000000013FE4D000-memory.dmp	xmrig
behavioral1/memory/1512-164-0x000000013F840000-0x000000013FC2D000-memory.dmp	xmrig
behavioral1/files/0x000600000001658a-167.dat	xmrig
behavioral1/files/0x000600000001630a-156.dat	xmrig
behavioral1/memory/2328-145-0x000000013F300000-0x000000013F6ED000-memory.dmp	xmrig
behavioral1/files/0x000600000001610f-144.dat	xmrig
behavioral1/memory/1356-140-0x000000013F1C0000-0x000000013F5AD000-memory.dmp	xmrig
behavioral1/files/0x0006000000015fe5-138.dat	xmrig
behavioral1/files/0x0006000000015ecc-127.dat	xmrig
behavioral1/files/0x0006000000015f65-132.dat	xmrig
behavioral1/files/0x0006000000015d93-115.dat	xmrig
behavioral1/memory/1144-116-0x000000013FE60000-0x000000014024D000-memory.dmp	xmrig
behavioral1/files/0x0006000000015e32-119.dat	xmrig
behavioral1/files/0x0006000000015d7f-103.dat	xmrig
behavioral1/memory/2500-94-0x000000013F620000-0x000000013FA0D000-memory.dmp	xmrig
behavioral1/memory/1700-92-0x000000013F940000-0x000000013FD2D000-memory.dmp	xmrig
behavioral1/memory/2864-90-0x000000013FE20000-0x000000014020D000-memory.dmp	xmrig
behavioral1/memory/2436-88-0x000000013FC10000-0x000000013FFFD000-memory.dmp	xmrig
behavioral1/memory/772-96-0x000000013F640000-0x000000013FA2D000-memory.dmp	xmrig
behavioral1/memory/2632-85-0x000000013F100000-0x000000013F4ED000-memory.dmp	xmrig
behavioral1/memory/2668-84-0x000000013F180000-0x000000013F56D000-memory.dmp	xmrig
behavioral1/files/0x0006000000015d5f-93.dat	xmrig
behavioral1/files/0x0006000000015d4e-91.dat	xmrig
behavioral1/files/0x0006000000015d20-89.dat	xmrig
behavioral1/files/0x0008000000015ce3-87.dat	xmrig
behavioral1/files/0x0006000000015d6b-83.dat	xmrig
behavioral1/files/0x0006000000015d56-82.dat	xmrig
behavioral1/memory/2092-80-0x000000013F8D0000-0x000000013FCBD000-memory.dmp	xmrig
behavioral1/files/0x0007000000014bbc-38.dat	xmrig
behavioral1/memory/1928-107-0x000000013F380000-0x000000013F76D000-memory.dmp	xmrig
behavioral1/memory/2484-56-0x000000013F360000-0x000000013F74D000-memory.dmp	xmrig
behavioral1/memory/2556-48-0x000000013F410000-0x000000013F7FD000-memory.dmp	xmrig
behavioral1/memory/2604-40-0x000000013F3A0000-0x000000013F78D000-memory.dmp	xmrig
behavioral1/memory/2572-23-0x000000013F5A0000-0x000000013F98D000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
1760	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
2620	fqfviNr.exe
3008	XjlzWKj.exe
2572	VuKWpjW.exe
2604	btdEBOM.exe
2468	sPfthhS.exe
2632	zoIySvK.exe
2556	xogzKIg.exe
2484	tLVwvzD.exe
2092	CXTzLBD.exe
772	yyAOhUA.exe
2668	exhrAOs.exe
2436	oQqcdWq.exe
2864	XzTalWi.exe
1700	IsDnEjX.exe
2500	MfOTSNK.exe
2748	UVkgdTN.exe
1928	MDbEGYc.exe
1144	FLzDJFO.exe
1832	HIfNGXn.exe
1604	TnJyFZa.exe
868	GQORoXo.exe
1356	KpqfJyV.exe
2328	EblNVfG.exe
2320	wilRQGC.exe
2760	Ikltoyy.exe
1512	zTjHqIj.exe
2964	twVaojd.exe
1100	wiWetkZ.exe
448	TAHQNCE.exe
2960	SMjCuBS.exe
1708	DFllFIM.exe
1952	VSMhFpW.exe
1636	mQuqgSm.exe
2836	dmxYcGz.exe
384	dVFfKaM.exe
912	eEGXQrY.exe
576	bWpiRzP.exe
1564	JmNwDoE.exe
2044	DvCvuPI.exe
3032	KUDSmrx.exe
2824	aQlvekA.exe
992	SRtJTRG.exe
900	HbjiUgA.exe
1972	erQCxkY.exe
808	ySdErGj.exe
1624	rtcmAuR.exe
2944	MseZUKV.exe
1980	hTsFQZM.exe
2788	TJoLgPq.exe
2156	inFhhNC.exe
2440	ziSICuV.exe
1516	wyFaQVC.exe
1548	cqajdWE.exe
2676	IHYhtNZ.exe
2728	nQtgWOi.exe
2224	RkJnwvB.exe
1740	blGcups.exe
2180	THWeIje.exe
2200	EmuOaaE.exe
1180	NBTZEYn.exe
2752	Smbnxoz.exe
2764	psHnkKV.exe
2404	NYEXVCD.exe
1552	mDZXewX.exe

Loads dropped DLL 64 IoCs

pid	Process
1712	9b976c1da9157ecfd86eaa3dec1d8e10_NeikiAnalytics.exe
1712	9b976c1da9157ecfd86eaa3dec1d8e10_NeikiAnalytics.exe
1712	9b976c1da9157ecfd86eaa3dec1d8e10_NeikiAnalytics.exe
1712	9b976c1da9157ecfd86eaa3dec1d8e10_NeikiAnalytics.exe
1712	9b976c1da9157ecfd86eaa3dec1d8e10_NeikiAnalytics.exe
1712	9b976c1da9157ecfd86eaa3dec1d8e10_NeikiAnalytics.exe
1712	9b976c1da9157ecfd86eaa3dec1d8e10_NeikiAnalytics.exe
1712	9b976c1da9157ecfd86eaa3dec1d8e10_NeikiAnalytics.exe
1712	9b976c1da9157ecfd86eaa3dec1d8e10_NeikiAnalytics.exe
1712	9b976c1da9157ecfd86eaa3dec1d8e10_NeikiAnalytics.exe
1712	9b976c1da9157ecfd86eaa3dec1d8e10_NeikiAnalytics.exe
1712	9b976c1da9157ecfd86eaa3dec1d8e10_NeikiAnalytics.exe
1712	9b976c1da9157ecfd86eaa3dec1d8e10_NeikiAnalytics.exe
1712	9b976c1da9157ecfd86eaa3dec1d8e10_NeikiAnalytics.exe
1712	9b976c1da9157ecfd86eaa3dec1d8e10_NeikiAnalytics.exe
1712	9b976c1da9157ecfd86eaa3dec1d8e10_NeikiAnalytics.exe
1712	9b976c1da9157ecfd86eaa3dec1d8e10_NeikiAnalytics.exe
1712	9b976c1da9157ecfd86eaa3dec1d8e10_NeikiAnalytics.exe
1712	9b976c1da9157ecfd86eaa3dec1d8e10_NeikiAnalytics.exe
1712	9b976c1da9157ecfd86eaa3dec1d8e10_NeikiAnalytics.exe
1712	9b976c1da9157ecfd86eaa3dec1d8e10_NeikiAnalytics.exe
1712	9b976c1da9157ecfd86eaa3dec1d8e10_NeikiAnalytics.exe
1712	9b976c1da9157ecfd86eaa3dec1d8e10_NeikiAnalytics.exe
1712	9b976c1da9157ecfd86eaa3dec1d8e10_NeikiAnalytics.exe
1712	9b976c1da9157ecfd86eaa3dec1d8e10_NeikiAnalytics.exe
1712	9b976c1da9157ecfd86eaa3dec1d8e10_NeikiAnalytics.exe
1712	9b976c1da9157ecfd86eaa3dec1d8e10_NeikiAnalytics.exe
1712	9b976c1da9157ecfd86eaa3dec1d8e10_NeikiAnalytics.exe
1712	9b976c1da9157ecfd86eaa3dec1d8e10_NeikiAnalytics.exe
1712	9b976c1da9157ecfd86eaa3dec1d8e10_NeikiAnalytics.exe
1712	9b976c1da9157ecfd86eaa3dec1d8e10_NeikiAnalytics.exe
1712	9b976c1da9157ecfd86eaa3dec1d8e10_NeikiAnalytics.exe
1712	9b976c1da9157ecfd86eaa3dec1d8e10_NeikiAnalytics.exe
1712	9b976c1da9157ecfd86eaa3dec1d8e10_NeikiAnalytics.exe
1712	9b976c1da9157ecfd86eaa3dec1d8e10_NeikiAnalytics.exe
1712	9b976c1da9157ecfd86eaa3dec1d8e10_NeikiAnalytics.exe
1712	9b976c1da9157ecfd86eaa3dec1d8e10_NeikiAnalytics.exe
1712	9b976c1da9157ecfd86eaa3dec1d8e10_NeikiAnalytics.exe
1712	9b976c1da9157ecfd86eaa3dec1d8e10_NeikiAnalytics.exe
1712	9b976c1da9157ecfd86eaa3dec1d8e10_NeikiAnalytics.exe
1712	9b976c1da9157ecfd86eaa3dec1d8e10_NeikiAnalytics.exe
1712	9b976c1da9157ecfd86eaa3dec1d8e10_NeikiAnalytics.exe
1712	9b976c1da9157ecfd86eaa3dec1d8e10_NeikiAnalytics.exe
1712	9b976c1da9157ecfd86eaa3dec1d8e10_NeikiAnalytics.exe
1712	9b976c1da9157ecfd86eaa3dec1d8e10_NeikiAnalytics.exe
1712	9b976c1da9157ecfd86eaa3dec1d8e10_NeikiAnalytics.exe
1712	9b976c1da9157ecfd86eaa3dec1d8e10_NeikiAnalytics.exe
1712	9b976c1da9157ecfd86eaa3dec1d8e10_NeikiAnalytics.exe
1712	9b976c1da9157ecfd86eaa3dec1d8e10_NeikiAnalytics.exe
1712	9b976c1da9157ecfd86eaa3dec1d8e10_NeikiAnalytics.exe
1712	9b976c1da9157ecfd86eaa3dec1d8e10_NeikiAnalytics.exe
1712	9b976c1da9157ecfd86eaa3dec1d8e10_NeikiAnalytics.exe
1712	9b976c1da9157ecfd86eaa3dec1d8e10_NeikiAnalytics.exe
1712	9b976c1da9157ecfd86eaa3dec1d8e10_NeikiAnalytics.exe
1712	9b976c1da9157ecfd86eaa3dec1d8e10_NeikiAnalytics.exe
1712	9b976c1da9157ecfd86eaa3dec1d8e10_NeikiAnalytics.exe
1712	9b976c1da9157ecfd86eaa3dec1d8e10_NeikiAnalytics.exe
1712	9b976c1da9157ecfd86eaa3dec1d8e10_NeikiAnalytics.exe
1712	9b976c1da9157ecfd86eaa3dec1d8e10_NeikiAnalytics.exe
1712	9b976c1da9157ecfd86eaa3dec1d8e10_NeikiAnalytics.exe
1712	9b976c1da9157ecfd86eaa3dec1d8e10_NeikiAnalytics.exe
1712	9b976c1da9157ecfd86eaa3dec1d8e10_NeikiAnalytics.exe
1712	9b976c1da9157ecfd86eaa3dec1d8e10_NeikiAnalytics.exe
1712	9b976c1da9157ecfd86eaa3dec1d8e10_NeikiAnalytics.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\wDRRTlC.exe	9b976c1da9157ecfd86eaa3dec1d8e10_NeikiAnalytics.exe
File created	C:\Windows\System\GStmDfF.exe	9b976c1da9157ecfd86eaa3dec1d8e10_NeikiAnalytics.exe
File created	C:\Windows\System\CcXHpDJ.exe	9b976c1da9157ecfd86eaa3dec1d8e10_NeikiAnalytics.exe
File created	C:\Windows\System\kfZuFqT.exe	9b976c1da9157ecfd86eaa3dec1d8e10_NeikiAnalytics.exe
File created	C:\Windows\System\fetlIjU.exe	9b976c1da9157ecfd86eaa3dec1d8e10_NeikiAnalytics.exe
File created	C:\Windows\System\uKQendh.exe	9b976c1da9157ecfd86eaa3dec1d8e10_NeikiAnalytics.exe
File created	C:\Windows\System\COcrwWa.exe	9b976c1da9157ecfd86eaa3dec1d8e10_NeikiAnalytics.exe
File created	C:\Windows\System\FtUDMwo.exe	9b976c1da9157ecfd86eaa3dec1d8e10_NeikiAnalytics.exe
File created	C:\Windows\System\jxTJVDe.exe	9b976c1da9157ecfd86eaa3dec1d8e10_NeikiAnalytics.exe
File created	C:\Windows\System\kFrXDgC.exe	9b976c1da9157ecfd86eaa3dec1d8e10_NeikiAnalytics.exe
File created	C:\Windows\System\wzowsUx.exe	9b976c1da9157ecfd86eaa3dec1d8e10_NeikiAnalytics.exe
File created	C:\Windows\System\igkQFAe.exe	9b976c1da9157ecfd86eaa3dec1d8e10_NeikiAnalytics.exe
File created	C:\Windows\System\BIfxrND.exe	9b976c1da9157ecfd86eaa3dec1d8e10_NeikiAnalytics.exe
File created	C:\Windows\System\JLFlZGV.exe	9b976c1da9157ecfd86eaa3dec1d8e10_NeikiAnalytics.exe
File created	C:\Windows\System\hVHzKwl.exe	9b976c1da9157ecfd86eaa3dec1d8e10_NeikiAnalytics.exe
File created	C:\Windows\System\VzLbScY.exe	9b976c1da9157ecfd86eaa3dec1d8e10_NeikiAnalytics.exe
File created	C:\Windows\System\fURqlfF.exe	9b976c1da9157ecfd86eaa3dec1d8e10_NeikiAnalytics.exe
File created	C:\Windows\System\UYMdrKO.exe	9b976c1da9157ecfd86eaa3dec1d8e10_NeikiAnalytics.exe
File created	C:\Windows\System\sBVszqJ.exe	9b976c1da9157ecfd86eaa3dec1d8e10_NeikiAnalytics.exe
File created	C:\Windows\System\azMgmCP.exe	9b976c1da9157ecfd86eaa3dec1d8e10_NeikiAnalytics.exe
File created	C:\Windows\System\gowuNwN.exe	9b976c1da9157ecfd86eaa3dec1d8e10_NeikiAnalytics.exe
File created	C:\Windows\System\kgIdYie.exe	9b976c1da9157ecfd86eaa3dec1d8e10_NeikiAnalytics.exe
File created	C:\Windows\System\bQtkkYX.exe	9b976c1da9157ecfd86eaa3dec1d8e10_NeikiAnalytics.exe
File created	C:\Windows\System\NpHOKss.exe	9b976c1da9157ecfd86eaa3dec1d8e10_NeikiAnalytics.exe
File created	C:\Windows\System\jQREKPh.exe	9b976c1da9157ecfd86eaa3dec1d8e10_NeikiAnalytics.exe
File created	C:\Windows\System\bQaKQGw.exe	9b976c1da9157ecfd86eaa3dec1d8e10_NeikiAnalytics.exe
File created	C:\Windows\System\fuQBYLl.exe	9b976c1da9157ecfd86eaa3dec1d8e10_NeikiAnalytics.exe
File created	C:\Windows\System\EBLZBat.exe	9b976c1da9157ecfd86eaa3dec1d8e10_NeikiAnalytics.exe
File created	C:\Windows\System\WRrgzPR.exe	9b976c1da9157ecfd86eaa3dec1d8e10_NeikiAnalytics.exe
File created	C:\Windows\System\JDnWtLD.exe	9b976c1da9157ecfd86eaa3dec1d8e10_NeikiAnalytics.exe
File created	C:\Windows\System\qZMAZFQ.exe	9b976c1da9157ecfd86eaa3dec1d8e10_NeikiAnalytics.exe
File created	C:\Windows\System\YXdAiTc.exe	9b976c1da9157ecfd86eaa3dec1d8e10_NeikiAnalytics.exe
File created	C:\Windows\System\OiVwNap.exe	9b976c1da9157ecfd86eaa3dec1d8e10_NeikiAnalytics.exe
File created	C:\Windows\System\rBGyhWb.exe	9b976c1da9157ecfd86eaa3dec1d8e10_NeikiAnalytics.exe
File created	C:\Windows\System\NZfWTCT.exe	9b976c1da9157ecfd86eaa3dec1d8e10_NeikiAnalytics.exe
File created	C:\Windows\System\AKUOIBP.exe	9b976c1da9157ecfd86eaa3dec1d8e10_NeikiAnalytics.exe
File created	C:\Windows\System\xGQCDwC.exe	9b976c1da9157ecfd86eaa3dec1d8e10_NeikiAnalytics.exe
File created	C:\Windows\System\bAaimEj.exe	9b976c1da9157ecfd86eaa3dec1d8e10_NeikiAnalytics.exe
File created	C:\Windows\System\fFpcmNe.exe	9b976c1da9157ecfd86eaa3dec1d8e10_NeikiAnalytics.exe
File created	C:\Windows\System\sjDVEen.exe	9b976c1da9157ecfd86eaa3dec1d8e10_NeikiAnalytics.exe
File created	C:\Windows\System\ecyZIZN.exe	9b976c1da9157ecfd86eaa3dec1d8e10_NeikiAnalytics.exe
File created	C:\Windows\System\rLjryYQ.exe	9b976c1da9157ecfd86eaa3dec1d8e10_NeikiAnalytics.exe
File created	C:\Windows\System\xhiuIVm.exe	9b976c1da9157ecfd86eaa3dec1d8e10_NeikiAnalytics.exe
File created	C:\Windows\System\CxGbetY.exe	9b976c1da9157ecfd86eaa3dec1d8e10_NeikiAnalytics.exe
File created	C:\Windows\System\NUGEtYG.exe	9b976c1da9157ecfd86eaa3dec1d8e10_NeikiAnalytics.exe
File created	C:\Windows\System\NPCoezk.exe	9b976c1da9157ecfd86eaa3dec1d8e10_NeikiAnalytics.exe
File created	C:\Windows\System\zuuWDBk.exe	9b976c1da9157ecfd86eaa3dec1d8e10_NeikiAnalytics.exe
File created	C:\Windows\System\mbkiuAH.exe	9b976c1da9157ecfd86eaa3dec1d8e10_NeikiAnalytics.exe
File created	C:\Windows\System\JMhwmRl.exe	9b976c1da9157ecfd86eaa3dec1d8e10_NeikiAnalytics.exe
File created	C:\Windows\System\kuZZIRD.exe	9b976c1da9157ecfd86eaa3dec1d8e10_NeikiAnalytics.exe
File created	C:\Windows\System\JMltcPi.exe	9b976c1da9157ecfd86eaa3dec1d8e10_NeikiAnalytics.exe
File created	C:\Windows\System\IvCTAXf.exe	9b976c1da9157ecfd86eaa3dec1d8e10_NeikiAnalytics.exe
File created	C:\Windows\System\EsVwpZK.exe	9b976c1da9157ecfd86eaa3dec1d8e10_NeikiAnalytics.exe
File created	C:\Windows\System\VTcGriO.exe	9b976c1da9157ecfd86eaa3dec1d8e10_NeikiAnalytics.exe
File created	C:\Windows\System\zJGvEgo.exe	9b976c1da9157ecfd86eaa3dec1d8e10_NeikiAnalytics.exe
File created	C:\Windows\System\ASMpTIc.exe	9b976c1da9157ecfd86eaa3dec1d8e10_NeikiAnalytics.exe
File created	C:\Windows\System\gAAGotg.exe	9b976c1da9157ecfd86eaa3dec1d8e10_NeikiAnalytics.exe
File created	C:\Windows\System\AnvLIlu.exe	9b976c1da9157ecfd86eaa3dec1d8e10_NeikiAnalytics.exe
File created	C:\Windows\System\HHonXLl.exe	9b976c1da9157ecfd86eaa3dec1d8e10_NeikiAnalytics.exe
File created	C:\Windows\System\womYsQD.exe	9b976c1da9157ecfd86eaa3dec1d8e10_NeikiAnalytics.exe
File created	C:\Windows\System\rGfxYRH.exe	9b976c1da9157ecfd86eaa3dec1d8e10_NeikiAnalytics.exe
File created	C:\Windows\System\zWldWPp.exe	9b976c1da9157ecfd86eaa3dec1d8e10_NeikiAnalytics.exe
File created	C:\Windows\System\nxgeAVz.exe	9b976c1da9157ecfd86eaa3dec1d8e10_NeikiAnalytics.exe
File created	C:\Windows\System\DzDfYXU.exe	9b976c1da9157ecfd86eaa3dec1d8e10_NeikiAnalytics.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1760	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	1712	9b976c1da9157ecfd86eaa3dec1d8e10_NeikiAnalytics.exe
Token: SeLockMemoryPrivilege	1712	9b976c1da9157ecfd86eaa3dec1d8e10_NeikiAnalytics.exe
Token: SeDebugPrivilege	1760	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1712 wrote to memory of 1760	1712	9b976c1da9157ecfd86eaa3dec1d8e10_NeikiAnalytics.exe	29
PID 1712 wrote to memory of 1760	1712	9b976c1da9157ecfd86eaa3dec1d8e10_NeikiAnalytics.exe	29
PID 1712 wrote to memory of 1760	1712	9b976c1da9157ecfd86eaa3dec1d8e10_NeikiAnalytics.exe	29
PID 1712 wrote to memory of 2620	1712	9b976c1da9157ecfd86eaa3dec1d8e10_NeikiAnalytics.exe	30
PID 1712 wrote to memory of 2620	1712	9b976c1da9157ecfd86eaa3dec1d8e10_NeikiAnalytics.exe	30
PID 1712 wrote to memory of 2620	1712	9b976c1da9157ecfd86eaa3dec1d8e10_NeikiAnalytics.exe	30
PID 1712 wrote to memory of 3008	1712	9b976c1da9157ecfd86eaa3dec1d8e10_NeikiAnalytics.exe	31
PID 1712 wrote to memory of 3008	1712	9b976c1da9157ecfd86eaa3dec1d8e10_NeikiAnalytics.exe	31
PID 1712 wrote to memory of 3008	1712	9b976c1da9157ecfd86eaa3dec1d8e10_NeikiAnalytics.exe	31
PID 1712 wrote to memory of 2572	1712	9b976c1da9157ecfd86eaa3dec1d8e10_NeikiAnalytics.exe	32
PID 1712 wrote to memory of 2572	1712	9b976c1da9157ecfd86eaa3dec1d8e10_NeikiAnalytics.exe	32
PID 1712 wrote to memory of 2572	1712	9b976c1da9157ecfd86eaa3dec1d8e10_NeikiAnalytics.exe	32
PID 1712 wrote to memory of 2604	1712	9b976c1da9157ecfd86eaa3dec1d8e10_NeikiAnalytics.exe	33
PID 1712 wrote to memory of 2604	1712	9b976c1da9157ecfd86eaa3dec1d8e10_NeikiAnalytics.exe	33
PID 1712 wrote to memory of 2604	1712	9b976c1da9157ecfd86eaa3dec1d8e10_NeikiAnalytics.exe	33
PID 1712 wrote to memory of 2468	1712	9b976c1da9157ecfd86eaa3dec1d8e10_NeikiAnalytics.exe	34
PID 1712 wrote to memory of 2468	1712	9b976c1da9157ecfd86eaa3dec1d8e10_NeikiAnalytics.exe	34
PID 1712 wrote to memory of 2468	1712	9b976c1da9157ecfd86eaa3dec1d8e10_NeikiAnalytics.exe	34
PID 1712 wrote to memory of 2632	1712	9b976c1da9157ecfd86eaa3dec1d8e10_NeikiAnalytics.exe	35
PID 1712 wrote to memory of 2632	1712	9b976c1da9157ecfd86eaa3dec1d8e10_NeikiAnalytics.exe	35
PID 1712 wrote to memory of 2632	1712	9b976c1da9157ecfd86eaa3dec1d8e10_NeikiAnalytics.exe	35
PID 1712 wrote to memory of 2556	1712	9b976c1da9157ecfd86eaa3dec1d8e10_NeikiAnalytics.exe	36
PID 1712 wrote to memory of 2556	1712	9b976c1da9157ecfd86eaa3dec1d8e10_NeikiAnalytics.exe	36
PID 1712 wrote to memory of 2556	1712	9b976c1da9157ecfd86eaa3dec1d8e10_NeikiAnalytics.exe	36
PID 1712 wrote to memory of 2436	1712	9b976c1da9157ecfd86eaa3dec1d8e10_NeikiAnalytics.exe	37
PID 1712 wrote to memory of 2436	1712	9b976c1da9157ecfd86eaa3dec1d8e10_NeikiAnalytics.exe	37
PID 1712 wrote to memory of 2436	1712	9b976c1da9157ecfd86eaa3dec1d8e10_NeikiAnalytics.exe	37
PID 1712 wrote to memory of 2484	1712	9b976c1da9157ecfd86eaa3dec1d8e10_NeikiAnalytics.exe	38
PID 1712 wrote to memory of 2484	1712	9b976c1da9157ecfd86eaa3dec1d8e10_NeikiAnalytics.exe	38
PID 1712 wrote to memory of 2484	1712	9b976c1da9157ecfd86eaa3dec1d8e10_NeikiAnalytics.exe	38
PID 1712 wrote to memory of 2864	1712	9b976c1da9157ecfd86eaa3dec1d8e10_NeikiAnalytics.exe	39
PID 1712 wrote to memory of 2864	1712	9b976c1da9157ecfd86eaa3dec1d8e10_NeikiAnalytics.exe	39
PID 1712 wrote to memory of 2864	1712	9b976c1da9157ecfd86eaa3dec1d8e10_NeikiAnalytics.exe	39
PID 1712 wrote to memory of 2092	1712	9b976c1da9157ecfd86eaa3dec1d8e10_NeikiAnalytics.exe	40
PID 1712 wrote to memory of 2092	1712	9b976c1da9157ecfd86eaa3dec1d8e10_NeikiAnalytics.exe	40
PID 1712 wrote to memory of 2092	1712	9b976c1da9157ecfd86eaa3dec1d8e10_NeikiAnalytics.exe	40
PID 1712 wrote to memory of 1700	1712	9b976c1da9157ecfd86eaa3dec1d8e10_NeikiAnalytics.exe	41
PID 1712 wrote to memory of 1700	1712	9b976c1da9157ecfd86eaa3dec1d8e10_NeikiAnalytics.exe	41
PID 1712 wrote to memory of 1700	1712	9b976c1da9157ecfd86eaa3dec1d8e10_NeikiAnalytics.exe	41
PID 1712 wrote to memory of 772	1712	9b976c1da9157ecfd86eaa3dec1d8e10_NeikiAnalytics.exe	42
PID 1712 wrote to memory of 772	1712	9b976c1da9157ecfd86eaa3dec1d8e10_NeikiAnalytics.exe	42
PID 1712 wrote to memory of 772	1712	9b976c1da9157ecfd86eaa3dec1d8e10_NeikiAnalytics.exe	42
PID 1712 wrote to memory of 2500	1712	9b976c1da9157ecfd86eaa3dec1d8e10_NeikiAnalytics.exe	43
PID 1712 wrote to memory of 2500	1712	9b976c1da9157ecfd86eaa3dec1d8e10_NeikiAnalytics.exe	43
PID 1712 wrote to memory of 2500	1712	9b976c1da9157ecfd86eaa3dec1d8e10_NeikiAnalytics.exe	43
PID 1712 wrote to memory of 2668	1712	9b976c1da9157ecfd86eaa3dec1d8e10_NeikiAnalytics.exe	44
PID 1712 wrote to memory of 2668	1712	9b976c1da9157ecfd86eaa3dec1d8e10_NeikiAnalytics.exe	44
PID 1712 wrote to memory of 2668	1712	9b976c1da9157ecfd86eaa3dec1d8e10_NeikiAnalytics.exe	44
PID 1712 wrote to memory of 2748	1712	9b976c1da9157ecfd86eaa3dec1d8e10_NeikiAnalytics.exe	45
PID 1712 wrote to memory of 2748	1712	9b976c1da9157ecfd86eaa3dec1d8e10_NeikiAnalytics.exe	45
PID 1712 wrote to memory of 2748	1712	9b976c1da9157ecfd86eaa3dec1d8e10_NeikiAnalytics.exe	45
PID 1712 wrote to memory of 1928	1712	9b976c1da9157ecfd86eaa3dec1d8e10_NeikiAnalytics.exe	46
PID 1712 wrote to memory of 1928	1712	9b976c1da9157ecfd86eaa3dec1d8e10_NeikiAnalytics.exe	46
PID 1712 wrote to memory of 1928	1712	9b976c1da9157ecfd86eaa3dec1d8e10_NeikiAnalytics.exe	46
PID 1712 wrote to memory of 1144	1712	9b976c1da9157ecfd86eaa3dec1d8e10_NeikiAnalytics.exe	47
PID 1712 wrote to memory of 1144	1712	9b976c1da9157ecfd86eaa3dec1d8e10_NeikiAnalytics.exe	47
PID 1712 wrote to memory of 1144	1712	9b976c1da9157ecfd86eaa3dec1d8e10_NeikiAnalytics.exe	47
PID 1712 wrote to memory of 1832	1712	9b976c1da9157ecfd86eaa3dec1d8e10_NeikiAnalytics.exe	48
PID 1712 wrote to memory of 1832	1712	9b976c1da9157ecfd86eaa3dec1d8e10_NeikiAnalytics.exe	48
PID 1712 wrote to memory of 1832	1712	9b976c1da9157ecfd86eaa3dec1d8e10_NeikiAnalytics.exe	48
PID 1712 wrote to memory of 1604	1712	9b976c1da9157ecfd86eaa3dec1d8e10_NeikiAnalytics.exe	49
PID 1712 wrote to memory of 1604	1712	9b976c1da9157ecfd86eaa3dec1d8e10_NeikiAnalytics.exe	49
PID 1712 wrote to memory of 1604	1712	9b976c1da9157ecfd86eaa3dec1d8e10_NeikiAnalytics.exe	49
PID 1712 wrote to memory of 868	1712	9b976c1da9157ecfd86eaa3dec1d8e10_NeikiAnalytics.exe	50

C:\Users\Admin\AppData\Local\Temp\9b976c1da9157ecfd86eaa3dec1d8e10_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\9b976c1da9157ecfd86eaa3dec1d8e10_NeikiAnalytics.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1712
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1760
- C:\Windows\System\fqfviNr.exe
  C:\Windows\System\fqfviNr.exe
  2⤵
  - Executes dropped EXE
  PID:2620
- C:\Windows\System\XjlzWKj.exe
  C:\Windows\System\XjlzWKj.exe
  2⤵
  - Executes dropped EXE
  PID:3008
- C:\Windows\System\VuKWpjW.exe
  C:\Windows\System\VuKWpjW.exe
  2⤵
  - Executes dropped EXE
  PID:2572
- C:\Windows\System\btdEBOM.exe
  C:\Windows\System\btdEBOM.exe
  2⤵
  - Executes dropped EXE
  PID:2604
- C:\Windows\System\sPfthhS.exe
  C:\Windows\System\sPfthhS.exe
  2⤵
  - Executes dropped EXE
  PID:2468
- C:\Windows\System\zoIySvK.exe
  C:\Windows\System\zoIySvK.exe
  2⤵
  - Executes dropped EXE
  PID:2632
- C:\Windows\System\xogzKIg.exe
  C:\Windows\System\xogzKIg.exe
  2⤵
  - Executes dropped EXE
  PID:2556
- C:\Windows\System\oQqcdWq.exe
  C:\Windows\System\oQqcdWq.exe
  2⤵
  - Executes dropped EXE
  PID:2436
- C:\Windows\System\tLVwvzD.exe
  C:\Windows\System\tLVwvzD.exe
  2⤵
  - Executes dropped EXE
  PID:2484
- C:\Windows\System\XzTalWi.exe
  C:\Windows\System\XzTalWi.exe
  2⤵
  - Executes dropped EXE
  PID:2864
- C:\Windows\System\CXTzLBD.exe
  C:\Windows\System\CXTzLBD.exe
  2⤵
  - Executes dropped EXE
  PID:2092
- C:\Windows\System\IsDnEjX.exe
  C:\Windows\System\IsDnEjX.exe
  2⤵
  - Executes dropped EXE
  PID:1700
- C:\Windows\System\yyAOhUA.exe
  C:\Windows\System\yyAOhUA.exe
  2⤵
  - Executes dropped EXE
  PID:772
- C:\Windows\System\MfOTSNK.exe
  C:\Windows\System\MfOTSNK.exe
  2⤵
  - Executes dropped EXE
  PID:2500
- C:\Windows\System\exhrAOs.exe
  C:\Windows\System\exhrAOs.exe
  2⤵
  - Executes dropped EXE
  PID:2668
- C:\Windows\System\UVkgdTN.exe
  C:\Windows\System\UVkgdTN.exe
  2⤵
  - Executes dropped EXE
  PID:2748
- C:\Windows\System\MDbEGYc.exe
  C:\Windows\System\MDbEGYc.exe
  2⤵
  - Executes dropped EXE
  PID:1928
- C:\Windows\System\FLzDJFO.exe
  C:\Windows\System\FLzDJFO.exe
  2⤵
  - Executes dropped EXE
  PID:1144
- C:\Windows\System\HIfNGXn.exe
  C:\Windows\System\HIfNGXn.exe
  2⤵
  - Executes dropped EXE
  PID:1832
- C:\Windows\System\TnJyFZa.exe
  C:\Windows\System\TnJyFZa.exe
  2⤵
  - Executes dropped EXE
  PID:1604
- C:\Windows\System\GQORoXo.exe
  C:\Windows\System\GQORoXo.exe
  2⤵
  - Executes dropped EXE
  PID:868
- C:\Windows\System\KpqfJyV.exe
  C:\Windows\System\KpqfJyV.exe
  2⤵
  - Executes dropped EXE
  PID:1356
- C:\Windows\System\EblNVfG.exe
  C:\Windows\System\EblNVfG.exe
  2⤵
  - Executes dropped EXE
  PID:2328
- C:\Windows\System\wilRQGC.exe
  C:\Windows\System\wilRQGC.exe
  2⤵
  - Executes dropped EXE
  PID:2320
- C:\Windows\System\Ikltoyy.exe
  C:\Windows\System\Ikltoyy.exe
  2⤵
  - Executes dropped EXE
  PID:2760
- C:\Windows\System\zTjHqIj.exe
  C:\Windows\System\zTjHqIj.exe
  2⤵
  - Executes dropped EXE
  PID:1512
- C:\Windows\System\twVaojd.exe
  C:\Windows\System\twVaojd.exe
  2⤵
  - Executes dropped EXE
  PID:2964
- C:\Windows\System\wiWetkZ.exe
  C:\Windows\System\wiWetkZ.exe
  2⤵
  - Executes dropped EXE
  PID:1100
- C:\Windows\System\TAHQNCE.exe
  C:\Windows\System\TAHQNCE.exe
  2⤵
  - Executes dropped EXE
  PID:448
- C:\Windows\System\SMjCuBS.exe
  C:\Windows\System\SMjCuBS.exe
  2⤵
  - Executes dropped EXE
  PID:2960
- C:\Windows\System\DFllFIM.exe
  C:\Windows\System\DFllFIM.exe
  2⤵
  - Executes dropped EXE
  PID:1708
- C:\Windows\System\VSMhFpW.exe
  C:\Windows\System\VSMhFpW.exe
  2⤵
  - Executes dropped EXE
  PID:1952
- C:\Windows\System\mQuqgSm.exe
  C:\Windows\System\mQuqgSm.exe
  2⤵
  - Executes dropped EXE
  PID:1636
- C:\Windows\System\dmxYcGz.exe
  C:\Windows\System\dmxYcGz.exe
  2⤵
  - Executes dropped EXE
  PID:2836
- C:\Windows\System\dVFfKaM.exe
  C:\Windows\System\dVFfKaM.exe
  2⤵
  - Executes dropped EXE
  PID:384
- C:\Windows\System\eEGXQrY.exe
  C:\Windows\System\eEGXQrY.exe
  2⤵
  - Executes dropped EXE
  PID:912
- C:\Windows\System\bWpiRzP.exe
  C:\Windows\System\bWpiRzP.exe
  2⤵
  - Executes dropped EXE
  PID:576
- C:\Windows\System\JmNwDoE.exe
  C:\Windows\System\JmNwDoE.exe
  2⤵
  - Executes dropped EXE
  PID:1564
- C:\Windows\System\DvCvuPI.exe
  C:\Windows\System\DvCvuPI.exe
  2⤵
  - Executes dropped EXE
  PID:2044
- C:\Windows\System\KUDSmrx.exe
  C:\Windows\System\KUDSmrx.exe
  2⤵
  - Executes dropped EXE
  PID:3032
- C:\Windows\System\aQlvekA.exe
  C:\Windows\System\aQlvekA.exe
  2⤵
  - Executes dropped EXE
  PID:2824
- C:\Windows\System\SRtJTRG.exe
  C:\Windows\System\SRtJTRG.exe
  2⤵
  - Executes dropped EXE
  PID:992
- C:\Windows\System\HbjiUgA.exe
  C:\Windows\System\HbjiUgA.exe
  2⤵
  - Executes dropped EXE
  PID:900
- C:\Windows\System\erQCxkY.exe
  C:\Windows\System\erQCxkY.exe
  2⤵
  - Executes dropped EXE
  PID:1972
- C:\Windows\System\ySdErGj.exe
  C:\Windows\System\ySdErGj.exe
  2⤵
  - Executes dropped EXE
  PID:808
- C:\Windows\System\rtcmAuR.exe
  C:\Windows\System\rtcmAuR.exe
  2⤵
  - Executes dropped EXE
  PID:1624
- C:\Windows\System\MseZUKV.exe
  C:\Windows\System\MseZUKV.exe
  2⤵
  - Executes dropped EXE
  PID:2944
- C:\Windows\System\hTsFQZM.exe
  C:\Windows\System\hTsFQZM.exe
  2⤵
  - Executes dropped EXE
  PID:1980
- C:\Windows\System\TJoLgPq.exe
  C:\Windows\System\TJoLgPq.exe
  2⤵
  - Executes dropped EXE
  PID:2788
- C:\Windows\System\inFhhNC.exe
  C:\Windows\System\inFhhNC.exe
  2⤵
  - Executes dropped EXE
  PID:2156
- C:\Windows\System\ziSICuV.exe
  C:\Windows\System\ziSICuV.exe
  2⤵
  - Executes dropped EXE
  PID:2440
- C:\Windows\System\wyFaQVC.exe
  C:\Windows\System\wyFaQVC.exe
  2⤵
  - Executes dropped EXE
  PID:1516
- C:\Windows\System\cqajdWE.exe
  C:\Windows\System\cqajdWE.exe
  2⤵
  - Executes dropped EXE
  PID:1548
- C:\Windows\System\IHYhtNZ.exe
  C:\Windows\System\IHYhtNZ.exe
  2⤵
  - Executes dropped EXE
  PID:2676
- C:\Windows\System\nQtgWOi.exe
  C:\Windows\System\nQtgWOi.exe
  2⤵
  - Executes dropped EXE
  PID:2728
- C:\Windows\System\RkJnwvB.exe
  C:\Windows\System\RkJnwvB.exe
  2⤵
  - Executes dropped EXE
  PID:2224
- C:\Windows\System\blGcups.exe
  C:\Windows\System\blGcups.exe
  2⤵
  - Executes dropped EXE
  PID:1740
- C:\Windows\System\THWeIje.exe
  C:\Windows\System\THWeIje.exe
  2⤵
  - Executes dropped EXE
  PID:2180
- C:\Windows\System\EmuOaaE.exe
  C:\Windows\System\EmuOaaE.exe
  2⤵
  - Executes dropped EXE
  PID:2200
- C:\Windows\System\NBTZEYn.exe
  C:\Windows\System\NBTZEYn.exe
  2⤵
  - Executes dropped EXE
  PID:1180
- C:\Windows\System\Smbnxoz.exe
  C:\Windows\System\Smbnxoz.exe
  2⤵
  - Executes dropped EXE
  PID:2752
- C:\Windows\System\psHnkKV.exe
  C:\Windows\System\psHnkKV.exe
  2⤵
  - Executes dropped EXE
  PID:2764
- C:\Windows\System\NYEXVCD.exe
  C:\Windows\System\NYEXVCD.exe
  2⤵
  - Executes dropped EXE
  PID:2404
- C:\Windows\System\FPpfGxx.exe
  C:\Windows\System\FPpfGxx.exe
  2⤵
  PID:2932
- C:\Windows\System\mDZXewX.exe
  C:\Windows\System\mDZXewX.exe
  2⤵
  - Executes dropped EXE
  PID:1552
- C:\Windows\System\ydzvFDQ.exe
  C:\Windows\System\ydzvFDQ.exe
  2⤵
  PID:1880
- C:\Windows\System\IcmzOJi.exe
  C:\Windows\System\IcmzOJi.exe
  2⤵
  PID:2852
- C:\Windows\System\vrjjzom.exe
  C:\Windows\System\vrjjzom.exe
  2⤵
  PID:2988
- C:\Windows\System\BBDzlFr.exe
  C:\Windows\System\BBDzlFr.exe
  2⤵
  PID:1992
- C:\Windows\System\fdqHUFg.exe
  C:\Windows\System\fdqHUFg.exe
  2⤵
  PID:1528
- C:\Windows\System\FSLkONJ.exe
  C:\Windows\System\FSLkONJ.exe
  2⤵
  PID:2968
- C:\Windows\System\hfRwwvL.exe
  C:\Windows\System\hfRwwvL.exe
  2⤵
  PID:2252
- C:\Windows\System\dNjAvWk.exe
  C:\Windows\System\dNjAvWk.exe
  2⤵
  PID:2192
- C:\Windows\System\eUCqIdl.exe
  C:\Windows\System\eUCqIdl.exe
  2⤵
  PID:1616
- C:\Windows\System\IjIuCyt.exe
  C:\Windows\System\IjIuCyt.exe
  2⤵
  PID:1620
- C:\Windows\System\cposROG.exe
  C:\Windows\System\cposROG.exe
  2⤵
  PID:2600
- C:\Windows\System\poIcvWP.exe
  C:\Windows\System\poIcvWP.exe
  2⤵
  PID:284
- C:\Windows\System\wsbHilM.exe
  C:\Windows\System\wsbHilM.exe
  2⤵
  PID:2460
- C:\Windows\System\lWKyahl.exe
  C:\Windows\System\lWKyahl.exe
  2⤵
  PID:2744
- C:\Windows\System\mDSkdti.exe
  C:\Windows\System\mDSkdti.exe
  2⤵
  PID:1996
- C:\Windows\System\GpCivcz.exe
  C:\Windows\System\GpCivcz.exe
  2⤵
  PID:2868
- C:\Windows\System\hOYKTBM.exe
  C:\Windows\System\hOYKTBM.exe
  2⤵
  PID:1284
- C:\Windows\System\AqZvfou.exe
  C:\Windows\System\AqZvfou.exe
  2⤵
  PID:1452
- C:\Windows\System\rsSFJDh.exe
  C:\Windows\System\rsSFJDh.exe
  2⤵
  PID:1836
- C:\Windows\System\TKEcSbe.exe
  C:\Windows\System\TKEcSbe.exe
  2⤵
  PID:1220
- C:\Windows\System\VTcGriO.exe
  C:\Windows\System\VTcGriO.exe
  2⤵
  PID:2164
- C:\Windows\System\cvmKsDs.exe
  C:\Windows\System\cvmKsDs.exe
  2⤵
  PID:2080
- C:\Windows\System\BfXEXld.exe
  C:\Windows\System\BfXEXld.exe
  2⤵
  PID:2952
- C:\Windows\System\DcdAugT.exe
  C:\Windows\System\DcdAugT.exe
  2⤵
  PID:1520
- C:\Windows\System\zrePAWw.exe
  C:\Windows\System\zrePAWw.exe
  2⤵
  PID:1784
- C:\Windows\System\dmGBsLp.exe
  C:\Windows\System\dmGBsLp.exe
  2⤵
  PID:960
- C:\Windows\System\QhxukyQ.exe
  C:\Windows\System\QhxukyQ.exe
  2⤵
  PID:2832
- C:\Windows\System\HfuRWyJ.exe
  C:\Windows\System\HfuRWyJ.exe
  2⤵
  PID:2720
- C:\Windows\System\JXlFJox.exe
  C:\Windows\System\JXlFJox.exe
  2⤵
  PID:1768
- C:\Windows\System\YAKatEY.exe
  C:\Windows\System\YAKatEY.exe
  2⤵
  PID:3028
- C:\Windows\System\nJETcps.exe
  C:\Windows\System\nJETcps.exe
  2⤵
  PID:632
- C:\Windows\System\nebdXOe.exe
  C:\Windows\System\nebdXOe.exe
  2⤵
  PID:280
- C:\Windows\System\PFDEIBZ.exe
  C:\Windows\System\PFDEIBZ.exe
  2⤵
  PID:1556
- C:\Windows\System\LRVBjGx.exe
  C:\Windows\System\LRVBjGx.exe
  2⤵
  PID:1540
- C:\Windows\System\tmXlxWT.exe
  C:\Windows\System\tmXlxWT.exe
  2⤵
  PID:2084
- C:\Windows\System\xXjZPjj.exe
  C:\Windows\System\xXjZPjj.exe
  2⤵
  PID:2756
- C:\Windows\System\zbOMIzS.exe
  C:\Windows\System\zbOMIzS.exe
  2⤵
  PID:2316
- C:\Windows\System\MbqhxrY.exe
  C:\Windows\System\MbqhxrY.exe
  2⤵
  PID:2536
- C:\Windows\System\KguWiSs.exe
  C:\Windows\System\KguWiSs.exe
  2⤵
  PID:1796
- C:\Windows\System\KAdAwtP.exe
  C:\Windows\System\KAdAwtP.exe
  2⤵
  PID:2116
- C:\Windows\System\zJGvEgo.exe
  C:\Windows\System\zJGvEgo.exe
  2⤵
  PID:2300
- C:\Windows\System\TCmjeVV.exe
  C:\Windows\System\TCmjeVV.exe
  2⤵
  PID:1820
- C:\Windows\System\TKzXQSV.exe
  C:\Windows\System\TKzXQSV.exe
  2⤵
  PID:3088
- C:\Windows\System\QFNKlej.exe
  C:\Windows\System\QFNKlej.exe
  2⤵
  PID:3104
- C:\Windows\System\rQmSqCG.exe
  C:\Windows\System\rQmSqCG.exe
  2⤵
  PID:3124
- C:\Windows\System\JdfTeOq.exe
  C:\Windows\System\JdfTeOq.exe
  2⤵
  PID:3156
- C:\Windows\System\VwUrmrt.exe
  C:\Windows\System\VwUrmrt.exe
  2⤵
  PID:3172
- C:\Windows\System\vTixUJB.exe
  C:\Windows\System\vTixUJB.exe
  2⤵
  PID:3188
- C:\Windows\System\tkyoALJ.exe
  C:\Windows\System\tkyoALJ.exe
  2⤵
  PID:3216
- C:\Windows\System\rlzaNyh.exe
  C:\Windows\System\rlzaNyh.exe
  2⤵
  PID:3232
- C:\Windows\System\mooInfF.exe
  C:\Windows\System\mooInfF.exe
  2⤵
  PID:3248
- C:\Windows\System\OrqtiHa.exe
  C:\Windows\System\OrqtiHa.exe
  2⤵
  PID:3264
- C:\Windows\System\ZtCPmJO.exe
  C:\Windows\System\ZtCPmJO.exe
  2⤵
  PID:3280
- C:\Windows\System\TLDuGlC.exe
  C:\Windows\System\TLDuGlC.exe
  2⤵
  PID:3296
- C:\Windows\System\SWLKbgt.exe
  C:\Windows\System\SWLKbgt.exe
  2⤵
  PID:3328
- C:\Windows\System\nXSZFCo.exe
  C:\Windows\System\nXSZFCo.exe
  2⤵
  PID:3344
- C:\Windows\System\VmTVGFa.exe
  C:\Windows\System\VmTVGFa.exe
  2⤵
  PID:3360
- C:\Windows\System\GYhjoWg.exe
  C:\Windows\System\GYhjoWg.exe
  2⤵
  PID:3376
- C:\Windows\System\JuYiVJJ.exe
  C:\Windows\System\JuYiVJJ.exe
  2⤵
  PID:3392
- C:\Windows\System\NPCoezk.exe
  C:\Windows\System\NPCoezk.exe
  2⤵
  PID:3416
- C:\Windows\System\hOejsFx.exe
  C:\Windows\System\hOejsFx.exe
  2⤵
  PID:3432
- C:\Windows\System\pfkTgrQ.exe
  C:\Windows\System\pfkTgrQ.exe
  2⤵
  PID:3448
- C:\Windows\System\gJXjmpG.exe
  C:\Windows\System\gJXjmpG.exe
  2⤵
  PID:3468
- C:\Windows\System\GIJZdmD.exe
  C:\Windows\System\GIJZdmD.exe
  2⤵
  PID:3484
- C:\Windows\System\ceRXpkW.exe
  C:\Windows\System\ceRXpkW.exe
  2⤵
  PID:3500
- C:\Windows\System\iKTInDg.exe
  C:\Windows\System\iKTInDg.exe
  2⤵
  PID:3516
- C:\Windows\System\kKrojgh.exe
  C:\Windows\System\kKrojgh.exe
  2⤵
  PID:3532
- C:\Windows\System\wlgcqxz.exe
  C:\Windows\System\wlgcqxz.exe
  2⤵
  PID:3548
- C:\Windows\System\tWKacqW.exe
  C:\Windows\System\tWKacqW.exe
  2⤵
  PID:3564
- C:\Windows\System\qsULWNI.exe
  C:\Windows\System\qsULWNI.exe
  2⤵
  PID:3580
- C:\Windows\System\FYQQQQq.exe
  C:\Windows\System\FYQQQQq.exe
  2⤵
  PID:3616
- C:\Windows\System\WcbyGbx.exe
  C:\Windows\System\WcbyGbx.exe
  2⤵
  PID:3632
- C:\Windows\System\kQGiDNC.exe
  C:\Windows\System\kQGiDNC.exe
  2⤵
  PID:3648
- C:\Windows\System\ldlhLcJ.exe
  C:\Windows\System\ldlhLcJ.exe
  2⤵
  PID:3668
- C:\Windows\System\uOwDtDG.exe
  C:\Windows\System\uOwDtDG.exe
  2⤵
  PID:3688
- C:\Windows\System\LQIKVcc.exe
  C:\Windows\System\LQIKVcc.exe
  2⤵
  PID:3708
- C:\Windows\System\JRlgaoO.exe
  C:\Windows\System\JRlgaoO.exe
  2⤵
  PID:3728
- C:\Windows\System\BLJHEqb.exe
  C:\Windows\System\BLJHEqb.exe
  2⤵
  PID:3744
- C:\Windows\System\sTcoeEN.exe
  C:\Windows\System\sTcoeEN.exe
  2⤵
  PID:3760
- C:\Windows\System\MErXnoK.exe
  C:\Windows\System\MErXnoK.exe
  2⤵
  PID:3776
- C:\Windows\System\zkcBSUp.exe
  C:\Windows\System\zkcBSUp.exe
  2⤵
  PID:3792
- C:\Windows\System\NvSluHT.exe
  C:\Windows\System\NvSluHT.exe
  2⤵
  PID:3824
- C:\Windows\System\RewLorB.exe
  C:\Windows\System\RewLorB.exe
  2⤵
  PID:3840
- C:\Windows\System\ynPYxBW.exe
  C:\Windows\System\ynPYxBW.exe
  2⤵
  PID:3856
- C:\Windows\System\JZonkoP.exe
  C:\Windows\System\JZonkoP.exe
  2⤵
  PID:3872
- C:\Windows\System\YcModRi.exe
  C:\Windows\System\YcModRi.exe
  2⤵
  PID:3888
- C:\Windows\System\SmOnyVq.exe
  C:\Windows\System\SmOnyVq.exe
  2⤵
  PID:3908
- C:\Windows\System\kxXuDXJ.exe
  C:\Windows\System\kxXuDXJ.exe
  2⤵
  PID:3928
- C:\Windows\System\jyGzUlg.exe
  C:\Windows\System\jyGzUlg.exe
  2⤵
  PID:3948
- C:\Windows\System\AfzzArg.exe
  C:\Windows\System\AfzzArg.exe
  2⤵
  PID:3968
- C:\Windows\System\IUDsCSQ.exe
  C:\Windows\System\IUDsCSQ.exe
  2⤵
  PID:3984
- C:\Windows\System\JViiYbH.exe
  C:\Windows\System\JViiYbH.exe
  2⤵
  PID:4088
- C:\Windows\System\abaWahP.exe
  C:\Windows\System\abaWahP.exe
  2⤵
  PID:2108
- C:\Windows\System\jemWDHB.exe
  C:\Windows\System\jemWDHB.exe
  2⤵
  PID:2576
- C:\Windows\System\tGUEfdj.exe
  C:\Windows\System\tGUEfdj.exe
  2⤵
  PID:3428
- C:\Windows\System\ivrSiFS.exe
  C:\Windows\System\ivrSiFS.exe
  2⤵
  PID:3464
- C:\Windows\System\MrRAkFR.exe
  C:\Windows\System\MrRAkFR.exe
  2⤵
  PID:3528
- C:\Windows\System\APiuJur.exe
  C:\Windows\System\APiuJur.exe
  2⤵
  PID:3592
- C:\Windows\System\cNjtZkh.exe
  C:\Windows\System\cNjtZkh.exe
  2⤵
  PID:3604
- C:\Windows\System\aWpkmHu.exe
  C:\Windows\System\aWpkmHu.exe
  2⤵
  PID:3644
- C:\Windows\System\jJVFQBs.exe
  C:\Windows\System\jJVFQBs.exe
  2⤵
  PID:3716
- C:\Windows\System\ZcFlSGA.exe
  C:\Windows\System\ZcFlSGA.exe
  2⤵
  PID:3756
- C:\Windows\System\qXCeOiY.exe
  C:\Windows\System\qXCeOiY.exe
  2⤵
  PID:3864
- C:\Windows\System\cRKapOK.exe
  C:\Windows\System\cRKapOK.exe
  2⤵
  PID:3904
- C:\Windows\System\CZoppUV.exe
  C:\Windows\System\CZoppUV.exe
  2⤵
  PID:3628
- C:\Windows\System\OcBgpPg.exe
  C:\Windows\System\OcBgpPg.exe
  2⤵
  PID:3700
- C:\Windows\System\FNbzePj.exe
  C:\Windows\System\FNbzePj.exe
  2⤵
  PID:3800
- C:\Windows\System\mLZAIjx.exe
  C:\Windows\System\mLZAIjx.exe
  2⤵
  PID:3880
- C:\Windows\System\FwSMfgy.exe
  C:\Windows\System\FwSMfgy.exe
  2⤵
  PID:1464
- C:\Windows\System\gohTAgT.exe
  C:\Windows\System\gohTAgT.exe
  2⤵
  PID:3996
- C:\Windows\System\MocwmSD.exe
  C:\Windows\System\MocwmSD.exe
  2⤵
  PID:3076
- C:\Windows\System\ZepMflI.exe
  C:\Windows\System\ZepMflI.exe
  2⤵
  PID:3112
- C:\Windows\System\DnvSgtz.exe
  C:\Windows\System\DnvSgtz.exe
  2⤵
  PID:3200
- C:\Windows\System\EQZUcXk.exe
  C:\Windows\System\EQZUcXk.exe
  2⤵
  PID:3244
- C:\Windows\System\OWWtiFt.exe
  C:\Windows\System\OWWtiFt.exe
  2⤵
  PID:3312
- C:\Windows\System\XvqOjtZ.exe
  C:\Windows\System\XvqOjtZ.exe
  2⤵
  PID:1968
- C:\Windows\System\nMhzHNL.exe
  C:\Windows\System\nMhzHNL.exe
  2⤵
  PID:1352
- C:\Windows\System\omLJJTe.exe
  C:\Windows\System\omLJJTe.exe
  2⤵
  PID:2408
- C:\Windows\System\CyWFfCz.exe
  C:\Windows\System\CyWFfCz.exe
  2⤵
  PID:2296
- C:\Windows\System\UCxLsFf.exe
  C:\Windows\System\UCxLsFf.exe
  2⤵
  PID:1736
- C:\Windows\System\PhtucUt.exe
  C:\Windows\System\PhtucUt.exe
  2⤵
  PID:3132
- C:\Windows\System\DwwHELx.exe
  C:\Windows\System\DwwHELx.exe
  2⤵
  PID:3140
- C:\Windows\System\qwKQUsy.exe
  C:\Windows\System\qwKQUsy.exe
  2⤵
  PID:3152
- C:\Windows\System\MORkhGY.exe
  C:\Windows\System\MORkhGY.exe
  2⤵
  PID:3940
- C:\Windows\System\KEoxzqW.exe
  C:\Windows\System\KEoxzqW.exe
  2⤵
  PID:3444
- C:\Windows\System\GCHCqvw.exe
  C:\Windows\System\GCHCqvw.exe
  2⤵
  PID:3816
- C:\Windows\System\nCFWAxJ.exe
  C:\Windows\System\nCFWAxJ.exe
  2⤵
  PID:4032
- C:\Windows\System\IWEsPuv.exe
  C:\Windows\System\IWEsPuv.exe
  2⤵
  PID:4048
- C:\Windows\System\EdXCSbr.exe
  C:\Windows\System\EdXCSbr.exe
  2⤵
  PID:2872
- C:\Windows\System\Gazluig.exe
  C:\Windows\System\Gazluig.exe
  2⤵
  PID:3060
- C:\Windows\System\StWLHzr.exe
  C:\Windows\System\StWLHzr.exe
  2⤵
  PID:3260
- C:\Windows\System\PTsBQiV.exe
  C:\Windows\System\PTsBQiV.exe
  2⤵
  PID:3368
- C:\Windows\System\jgzakBo.exe
  C:\Windows\System\jgzakBo.exe
  2⤵
  PID:3724
- C:\Windows\System\tXgkZXe.exe
  C:\Windows\System\tXgkZXe.exe
  2⤵
  PID:3408
- C:\Windows\System\MwjDtKQ.exe
  C:\Windows\System\MwjDtKQ.exe
  2⤵
  PID:3508
- C:\Windows\System\xTZJUmn.exe
  C:\Windows\System\xTZJUmn.exe
  2⤵
  PID:3180
- C:\Windows\System\VnlqzJl.exe
  C:\Windows\System\VnlqzJl.exe
  2⤵
  PID:1500
- C:\Windows\System\SaLzoiL.exe
  C:\Windows\System\SaLzoiL.exe
  2⤵
  PID:2444
- C:\Windows\System\wUOvwbx.exe
  C:\Windows\System\wUOvwbx.exe
  2⤵
  PID:3848
- C:\Windows\System\tmEAhnu.exe
  C:\Windows\System\tmEAhnu.exe
  2⤵
  PID:1696
- C:\Windows\System\QTKvoyd.exe
  C:\Windows\System\QTKvoyd.exe
  2⤵
  PID:640
- C:\Windows\System\SGiyZSE.exe
  C:\Windows\System\SGiyZSE.exe
  2⤵
  PID:3956
- C:\Windows\System\taOrEbW.exe
  C:\Windows\System\taOrEbW.exe
  2⤵
  PID:1156
- C:\Windows\System\MviBNhh.exe
  C:\Windows\System\MviBNhh.exe
  2⤵
  PID:996
- C:\Windows\System\JZGTmtv.exe
  C:\Windows\System\JZGTmtv.exe
  2⤵
  PID:2580
- C:\Windows\System\ULcuOOz.exe
  C:\Windows\System\ULcuOOz.exe
  2⤵
  PID:1932
- C:\Windows\System\fIZqmdl.exe
  C:\Windows\System\fIZqmdl.exe
  2⤵
  PID:1816
- C:\Windows\System\waRSRzZ.exe
  C:\Windows\System\waRSRzZ.exe
  2⤵
  PID:3852
- C:\Windows\System\BFfaIBk.exe
  C:\Windows\System\BFfaIBk.exe
  2⤵
  PID:1204
- C:\Windows\System\OpdYuKJ.exe
  C:\Windows\System\OpdYuKJ.exe
  2⤵
  PID:2032
- C:\Windows\System\qrQNWBU.exe
  C:\Windows\System\qrQNWBU.exe
  2⤵
  PID:1656
- C:\Windows\System\lPqkvmO.exe
  C:\Windows\System\lPqkvmO.exe
  2⤵
  PID:764
- C:\Windows\System\pvJHtsa.exe
  C:\Windows\System\pvJHtsa.exe
  2⤵
  PID:3196
- C:\Windows\System\uvgaeZc.exe
  C:\Windows\System\uvgaeZc.exe
  2⤵
  PID:3212
- C:\Windows\System\iUOHXpH.exe
  C:\Windows\System\iUOHXpH.exe
  2⤵
  PID:2228
- C:\Windows\System\rZBXLAv.exe
  C:\Windows\System\rZBXLAv.exe
  2⤵
  PID:1940
- C:\Windows\System\znAUGim.exe
  C:\Windows\System\znAUGim.exe
  2⤵
  PID:2396
- C:\Windows\System\zqovpkJ.exe
  C:\Windows\System\zqovpkJ.exe
  2⤵
  PID:3048
- C:\Windows\System\JuAxPdl.exe
  C:\Windows\System\JuAxPdl.exe
  2⤵
  PID:3100
- C:\Windows\System\iikAkHK.exe
  C:\Windows\System\iikAkHK.exe
  2⤵
  PID:3680
- C:\Windows\System\krrjSGW.exe
  C:\Windows\System\krrjSGW.exe
  2⤵
  PID:3832
- C:\Windows\System\dxHOEHs.exe
  C:\Windows\System\dxHOEHs.exe
  2⤵
  PID:3228
- C:\Windows\System\NtcvAIc.exe
  C:\Windows\System\NtcvAIc.exe
  2⤵
  PID:3512
- C:\Windows\System\mkkjSgr.exe
  C:\Windows\System\mkkjSgr.exe
  2⤵
  PID:2592
- C:\Windows\System\gzeoPRq.exe
  C:\Windows\System\gzeoPRq.exe
  2⤵
  PID:3560
- C:\Windows\System\ludHOrU.exe
  C:\Windows\System\ludHOrU.exe
  2⤵
  PID:1648
- C:\Windows\System\NAVRQyO.exe
  C:\Windows\System\NAVRQyO.exe
  2⤵
  PID:1028
- C:\Windows\System\DbZXJpm.exe
  C:\Windows\System\DbZXJpm.exe
  2⤵
  PID:1532
- C:\Windows\System\MDdGZkH.exe
  C:\Windows\System\MDdGZkH.exe
  2⤵
  PID:3440
- C:\Windows\System\oERwhpF.exe
  C:\Windows\System\oERwhpF.exe
  2⤵
  PID:1652
- C:\Windows\System\wauDqyk.exe
  C:\Windows\System\wauDqyk.exe
  2⤵
  PID:3704
- C:\Windows\System\rXKxQNd.exe
  C:\Windows\System\rXKxQNd.exe
  2⤵
  PID:3768
- C:\Windows\System\oIYYXtz.exe
  C:\Windows\System\oIYYXtz.exe
  2⤵
  PID:2308
- C:\Windows\System\kmhkgdV.exe
  C:\Windows\System\kmhkgdV.exe
  2⤵
  PID:3740
- C:\Windows\System\ancJCav.exe
  C:\Windows\System\ancJCav.exe
  2⤵
  PID:2652
- C:\Windows\System\riLFasz.exe
  C:\Windows\System\riLFasz.exe
  2⤵
  PID:1660
- C:\Windows\System\EuYstAe.exe
  C:\Windows\System\EuYstAe.exe
  2⤵
  PID:2480
- C:\Windows\System\nFTZAMg.exe
  C:\Windows\System\nFTZAMg.exe
  2⤵
  PID:2656
- C:\Windows\System\fYyLgVk.exe
  C:\Windows\System\fYyLgVk.exe
  2⤵
  PID:1612
- C:\Windows\System\fWLWmHa.exe
  C:\Windows\System\fWLWmHa.exe
  2⤵
  PID:1776
- C:\Windows\System\jzmozfB.exe
  C:\Windows\System\jzmozfB.exe
  2⤵
  PID:3576
- C:\Windows\System\utVaTLO.exe
  C:\Windows\System\utVaTLO.exe
  2⤵
  PID:4056
- C:\Windows\System\KtMbolv.exe
  C:\Windows\System\KtMbolv.exe
  2⤵
  PID:2324
- C:\Windows\System\DGKeFCi.exe
  C:\Windows\System\DGKeFCi.exe
  2⤵
  PID:1876
- C:\Windows\System\LFykLAy.exe
  C:\Windows\System\LFykLAy.exe
  2⤵
  PID:2596
- C:\Windows\System\jrsfEdV.exe
  C:\Windows\System\jrsfEdV.exe
  2⤵
  PID:2540
- C:\Windows\System\NiuRmeT.exe
  C:\Windows\System\NiuRmeT.exe
  2⤵
  PID:3304
- C:\Windows\System\lrJlZSN.exe
  C:\Windows\System\lrJlZSN.exe
  2⤵
  PID:2616
- C:\Windows\System\FaXMhdy.exe
  C:\Windows\System\FaXMhdy.exe
  2⤵
  PID:1936
- C:\Windows\System\kWUhYqB.exe
  C:\Windows\System\kWUhYqB.exe
  2⤵
  PID:3900
- C:\Windows\System\KxsFDSd.exe
  C:\Windows\System\KxsFDSd.exe
  2⤵
  PID:4012
- C:\Windows\System\mZQFgZf.exe
  C:\Windows\System\mZQFgZf.exe
  2⤵
  PID:4064
- C:\Windows\System\gTFSkWm.exe
  C:\Windows\System\gTFSkWm.exe
  2⤵
  PID:2184
- C:\Windows\System\SsYtZWe.exe
  C:\Windows\System\SsYtZWe.exe
  2⤵
  PID:1328
- C:\Windows\System\tMujBhS.exe
  C:\Windows\System\tMujBhS.exe
  2⤵
  PID:2348
- C:\Windows\System\IIVlDvd.exe
  C:\Windows\System\IIVlDvd.exe
  2⤵
  PID:3788
- C:\Windows\System\PiTrKSa.exe
  C:\Windows\System\PiTrKSa.exe
  2⤵
  PID:2248
- C:\Windows\System\IjBifDU.exe
  C:\Windows\System\IjBifDU.exe
  2⤵
  PID:3820
- C:\Windows\System\nnDerJD.exe
  C:\Windows\System\nnDerJD.exe
  2⤵
  PID:3336
- C:\Windows\System\kDKeeBI.exe
  C:\Windows\System\kDKeeBI.exe
  2⤵
  PID:108
- C:\Windows\System\BEwNlJq.exe
  C:\Windows\System\BEwNlJq.exe
  2⤵
  PID:4108
- C:\Windows\System\dmkFLNr.exe
  C:\Windows\System\dmkFLNr.exe
  2⤵
  PID:4124
- C:\Windows\System\gaZRXGY.exe
  C:\Windows\System\gaZRXGY.exe
  2⤵
  PID:4144
- C:\Windows\System\NEJNOfL.exe
  C:\Windows\System\NEJNOfL.exe
  2⤵
  PID:4164
- C:\Windows\System\jehweuT.exe
  C:\Windows\System\jehweuT.exe
  2⤵
  PID:4180
- C:\Windows\System\tFeWNUS.exe
  C:\Windows\System\tFeWNUS.exe
  2⤵
  PID:4196
- C:\Windows\System\lsdCrzW.exe
  C:\Windows\System\lsdCrzW.exe
  2⤵
  PID:4212
- C:\Windows\System\tHnoMaU.exe
  C:\Windows\System\tHnoMaU.exe
  2⤵
  PID:4228
- C:\Windows\System\tRntUuj.exe
  C:\Windows\System\tRntUuj.exe
  2⤵
  PID:4244
- C:\Windows\System\rtiQXGU.exe
  C:\Windows\System\rtiQXGU.exe
  2⤵
  PID:4264
- C:\Windows\System\HngbEmU.exe
  C:\Windows\System\HngbEmU.exe
  2⤵
  PID:4284
- C:\Windows\System\CskRaRB.exe
  C:\Windows\System\CskRaRB.exe
  2⤵
  PID:4304
- C:\Windows\System\PQjqLsx.exe
  C:\Windows\System\PQjqLsx.exe
  2⤵
  PID:4324
- C:\Windows\System\NbkWtdT.exe
  C:\Windows\System\NbkWtdT.exe
  2⤵
  PID:4340
- C:\Windows\System\ZouzsGp.exe
  C:\Windows\System\ZouzsGp.exe
  2⤵
  PID:4364
- C:\Windows\System\kxoFWjT.exe
  C:\Windows\System\kxoFWjT.exe
  2⤵
  PID:4380
- C:\Windows\System\DHACXMF.exe
  C:\Windows\System\DHACXMF.exe
  2⤵
  PID:4404
- C:\Windows\System\wRmrNnf.exe
  C:\Windows\System\wRmrNnf.exe
  2⤵
  PID:4420
- C:\Windows\System\RxLcXaz.exe
  C:\Windows\System\RxLcXaz.exe
  2⤵
  PID:4572
- C:\Windows\System\JYYHPOW.exe
  C:\Windows\System\JYYHPOW.exe
  2⤵
  PID:4692
- C:\Windows\System\yAxcmdE.exe
  C:\Windows\System\yAxcmdE.exe
  2⤵
  PID:4708
- C:\Windows\System\rqIFGoG.exe
  C:\Windows\System\rqIFGoG.exe
  2⤵
  PID:4724
- C:\Windows\System\ZwwOMal.exe
  C:\Windows\System\ZwwOMal.exe
  2⤵
  PID:4740
- C:\Windows\System\AdUYIbv.exe
  C:\Windows\System\AdUYIbv.exe
  2⤵
  PID:4756
- C:\Windows\System\MmVapHC.exe
  C:\Windows\System\MmVapHC.exe
  2⤵
  PID:4772
- C:\Windows\System\olPeBJv.exe
  C:\Windows\System\olPeBJv.exe
  2⤵
  PID:4788
- C:\Windows\System\Hpvmyba.exe
  C:\Windows\System\Hpvmyba.exe
  2⤵
  PID:4804
- C:\Windows\System\hZfVomq.exe
  C:\Windows\System\hZfVomq.exe
  2⤵
  PID:4824
- C:\Windows\System\LKFQJAU.exe
  C:\Windows\System\LKFQJAU.exe
  2⤵
  PID:4852
- C:\Windows\System\BMceKfN.exe
  C:\Windows\System\BMceKfN.exe
  2⤵
  PID:4868
- C:\Windows\System\bApcTXv.exe
  C:\Windows\System\bApcTXv.exe
  2⤵
  PID:4888
- C:\Windows\System\PNbQfSp.exe
  C:\Windows\System\PNbQfSp.exe
  2⤵
  PID:4908
- C:\Windows\System\KgOzdtP.exe
  C:\Windows\System\KgOzdtP.exe
  2⤵
  PID:4924
- C:\Windows\System\JvUrOoE.exe
  C:\Windows\System\JvUrOoE.exe
  2⤵
  PID:4940
- C:\Windows\System\cKLGOQS.exe
  C:\Windows\System\cKLGOQS.exe
  2⤵
  PID:4956
- C:\Windows\System\fFWOOLP.exe
  C:\Windows\System\fFWOOLP.exe
  2⤵
  PID:4972
- C:\Windows\System\sNMqWZH.exe
  C:\Windows\System\sNMqWZH.exe
  2⤵
  PID:4988
- C:\Windows\System\VewnEdf.exe
  C:\Windows\System\VewnEdf.exe
  2⤵
  PID:5004
- C:\Windows\System\coIWMii.exe
  C:\Windows\System\coIWMii.exe
  2⤵
  PID:5020
- C:\Windows\System\WCrvnGm.exe
  C:\Windows\System\WCrvnGm.exe
  2⤵
  PID:5036
- C:\Windows\System\sqJSTfL.exe
  C:\Windows\System\sqJSTfL.exe
  2⤵
  PID:5052
- C:\Windows\System\NIZOOOH.exe
  C:\Windows\System\NIZOOOH.exe
  2⤵
  PID:5068
- C:\Windows\System\BvEyVbY.exe
  C:\Windows\System\BvEyVbY.exe
  2⤵
  PID:5084
- C:\Windows\System\CXMCOiG.exe
  C:\Windows\System\CXMCOiG.exe
  2⤵
  PID:5100
- C:\Windows\System\TLunKAC.exe
  C:\Windows\System\TLunKAC.exe
  2⤵
  PID:5116
- C:\Windows\System\qpdYhBH.exe
  C:\Windows\System\qpdYhBH.exe
  2⤵
  PID:1632
- C:\Windows\System\gXbleUB.exe
  C:\Windows\System\gXbleUB.exe
  2⤵
  PID:3588
- C:\Windows\System\uPFkKvu.exe
  C:\Windows\System\uPFkKvu.exe
  2⤵
  PID:4120
- C:\Windows\System\yRMBsUN.exe
  C:\Windows\System\yRMBsUN.exe
  2⤵
  PID:4188
- C:\Windows\System\GdnPZPK.exe
  C:\Windows\System\GdnPZPK.exe
  2⤵
  PID:4256
- C:\Windows\System\wZBLIvN.exe
  C:\Windows\System\wZBLIvN.exe
  2⤵
  PID:2288
- C:\Windows\System\OwsVFmx.exe
  C:\Windows\System\OwsVFmx.exe
  2⤵
  PID:4372
- C:\Windows\System\sOhpycP.exe
  C:\Windows\System\sOhpycP.exe
  2⤵
  PID:4220
- C:\Windows\System\YGXXkzR.exe
  C:\Windows\System\YGXXkzR.exe
  2⤵
  PID:3976
- C:\Windows\System\TTWUzfU.exe
  C:\Windows\System\TTWUzfU.exe
  2⤵
  PID:3980
- C:\Windows\System\GUzIgCM.exe
  C:\Windows\System\GUzIgCM.exe
  2⤵
  PID:3356
- C:\Windows\System\TrngXBL.exe
  C:\Windows\System\TrngXBL.exe
  2⤵
  PID:4140
- C:\Windows\System\hhhxqam.exe
  C:\Windows\System\hhhxqam.exe
  2⤵
  PID:4240
- C:\Windows\System\mBApvZx.exe
  C:\Windows\System\mBApvZx.exe
  2⤵
  PID:4348
- C:\Windows\System\pIeKPFD.exe
  C:\Windows\System\pIeKPFD.exe
  2⤵
  PID:2256
- C:\Windows\System\kRpqMjt.exe
  C:\Windows\System\kRpqMjt.exe
  2⤵
  PID:3340
- C:\Windows\System\pjBOkze.exe
  C:\Windows\System\pjBOkze.exe
  2⤵
  PID:2424
- C:\Windows\System\ocSBvcJ.exe
  C:\Windows\System\ocSBvcJ.exe
  2⤵
  PID:4448
- C:\Windows\System\BkcBCeS.exe
  C:\Windows\System\BkcBCeS.exe
  2⤵
  PID:1388
- C:\Windows\System\oQsYcTC.exe
  C:\Windows\System\oQsYcTC.exe
  2⤵
  PID:4464
- C:\Windows\System\QAynKwB.exe
  C:\Windows\System\QAynKwB.exe
  2⤵
  PID:2448
- C:\Windows\System\tSEggnE.exe
  C:\Windows\System\tSEggnE.exe
  2⤵
  PID:2844
- C:\Windows\System\cwBigcL.exe
  C:\Windows\System\cwBigcL.exe
  2⤵
  PID:3412
- C:\Windows\System\caOeXpu.exe
  C:\Windows\System\caOeXpu.exe
  2⤵
  PID:4496
- C:\Windows\System\tgXAgRf.exe
  C:\Windows\System\tgXAgRf.exe
  2⤵
  PID:588
- C:\Windows\System\EBvQAof.exe
  C:\Windows\System\EBvQAof.exe
  2⤵
  PID:2284
- C:\Windows\System\XjWNxNQ.exe
  C:\Windows\System\XjWNxNQ.exe
  2⤵
  PID:1756
- C:\Windows\System\dLMTSfm.exe
  C:\Windows\System\dLMTSfm.exe
  2⤵
  PID:776
- C:\Windows\System\BawIRWQ.exe
  C:\Windows\System\BawIRWQ.exe
  2⤵
  PID:4392
- C:\Windows\System\raVRIec.exe
  C:\Windows\System\raVRIec.exe
  2⤵
  PID:2796
- C:\Windows\System\WETHxFg.exe
  C:\Windows\System\WETHxFg.exe
  2⤵
  PID:4000
- C:\Windows\System\yEeTCaL.exe
  C:\Windows\System\yEeTCaL.exe
  2⤵
  PID:4584
- C:\Windows\System\VptNgvi.exe
  C:\Windows\System\VptNgvi.exe
  2⤵
  PID:4600
- C:\Windows\System\bvJZfrI.exe
  C:\Windows\System\bvJZfrI.exe
  2⤵
  PID:3224
- C:\Windows\System\kERvoWh.exe
  C:\Windows\System\kERvoWh.exe
  2⤵
  PID:4616
- C:\Windows\System\siYJiUI.exe
  C:\Windows\System\siYJiUI.exe
  2⤵
  PID:2564
- C:\Windows\System\seshVdn.exe
  C:\Windows\System\seshVdn.exe
  2⤵
  PID:4104
- C:\Windows\System\ByrLuCK.exe
  C:\Windows\System\ByrLuCK.exe
  2⤵
  PID:4356
- C:\Windows\System\ZCgScVW.exe
  C:\Windows\System\ZCgScVW.exe
  2⤵
  PID:4452
- C:\Windows\System\uOLyYmf.exe
  C:\Windows\System\uOLyYmf.exe
  2⤵
  PID:3052
- C:\Windows\System\ZbORuOv.exe
  C:\Windows\System\ZbORuOv.exe
  2⤵
  PID:4512
- C:\Windows\System\EVlqzQP.exe
  C:\Windows\System\EVlqzQP.exe
  2⤵
  PID:4528
- C:\Windows\System\OshRcCz.exe
  C:\Windows\System\OshRcCz.exe
  2⤵
  PID:4544
- C:\Windows\System\LYgwMxk.exe
  C:\Windows\System\LYgwMxk.exe
  2⤵
  PID:4564
- C:\Windows\System\TncCiQM.exe
  C:\Windows\System\TncCiQM.exe
  2⤵
  PID:4660
- C:\Windows\System\CBFqAEF.exe
  C:\Windows\System\CBFqAEF.exe
  2⤵
  PID:4640
- C:\Windows\System\YICvTRH.exe
  C:\Windows\System\YICvTRH.exe
  2⤵
  PID:4664
- C:\Windows\System\mFqSuKn.exe
  C:\Windows\System\mFqSuKn.exe
  2⤵
  PID:4720
- C:\Windows\System\eaYCsiV.exe
  C:\Windows\System\eaYCsiV.exe
  2⤵
  PID:4784
- C:\Windows\System\jjoKTVR.exe
  C:\Windows\System\jjoKTVR.exe
  2⤵
  PID:4848
- C:\Windows\System\Ykiwijx.exe
  C:\Windows\System\Ykiwijx.exe
  2⤵
  PID:4900
- C:\Windows\System\LbQcCTi.exe
  C:\Windows\System\LbQcCTi.exe
  2⤵
  PID:4964
- C:\Windows\System\KhgbMwh.exe
  C:\Windows\System\KhgbMwh.exe
  2⤵
  PID:4876
- C:\Windows\System\yDzLkCn.exe
  C:\Windows\System\yDzLkCn.exe
  2⤵
  PID:4280
- C:\Windows\System\OTqJUjI.exe
  C:\Windows\System\OTqJUjI.exe
  2⤵
  PID:4612
- C:\Windows\System\jeIYrPA.exe
  C:\Windows\System\jeIYrPA.exe
  2⤵
  PID:4780
- C:\Windows\System\cPBSPvi.exe
  C:\Windows\System\cPBSPvi.exe
  2⤵
  PID:4556
- C:\Windows\System\vjSvoSR.exe
  C:\Windows\System\vjSvoSR.exe
  2⤵
  PID:4552
- C:\Windows\System\sKvkiPz.exe
  C:\Windows\System\sKvkiPz.exe
  2⤵
  PID:3372
- C:\Windows\System\WCrXstL.exe
  C:\Windows\System\WCrXstL.exe
  2⤵
  PID:5092
- C:\Windows\System\QTsjRoc.exe
  C:\Windows\System\QTsjRoc.exe
  2⤵
  PID:5096
- C:\Windows\System\IzFmLKY.exe
  C:\Windows\System\IzFmLKY.exe
  2⤵
  PID:240
- C:\Windows\System\hcQbAPE.exe
  C:\Windows\System\hcQbAPE.exe
  2⤵
  PID:2264
- C:\Windows\System\KCLMZTD.exe
  C:\Windows\System\KCLMZTD.exe
  2⤵
  PID:2336
- C:\Windows\System\yrdaxUd.exe
  C:\Windows\System\yrdaxUd.exe
  2⤵
  PID:1724
- C:\Windows\System\KoiXqSV.exe
  C:\Windows\System\KoiXqSV.exe
  2⤵
  PID:4132
- C:\Windows\System\VPhJhBi.exe
  C:\Windows\System\VPhJhBi.exe
  2⤵
  PID:2332
- C:\Windows\System\ohjiEqe.exe
  C:\Windows\System\ohjiEqe.exe
  2⤵
  PID:4832
- C:\Windows\System\psVCBKL.exe
  C:\Windows\System\psVCBKL.exe
  2⤵
  PID:4952
- C:\Windows\System\iHksnTL.exe
  C:\Windows\System\iHksnTL.exe
  2⤵
  PID:4732
- C:\Windows\System\RWAjGpI.exe
  C:\Windows\System\RWAjGpI.exe
  2⤵
  PID:4916
- C:\Windows\System\YYwSorW.exe
  C:\Windows\System\YYwSorW.exe
  2⤵
  PID:3612
- C:\Windows\System\rHgOEdG.exe
  C:\Windows\System\rHgOEdG.exe
  2⤵
  PID:2896
- C:\Windows\System\vUvIAeM.exe
  C:\Windows\System\vUvIAeM.exe
  2⤵
  PID:4492
- C:\Windows\System\NqSLAVW.exe
  C:\Windows\System\NqSLAVW.exe
  2⤵
  PID:3308
- C:\Windows\System\kNiJQLY.exe
  C:\Windows\System\kNiJQLY.exe
  2⤵
  PID:4296
- C:\Windows\System\fCplgEY.exe
  C:\Windows\System\fCplgEY.exe
  2⤵
  PID:4896
- C:\Windows\System\hHTRccD.exe
  C:\Windows\System\hHTRccD.exe
  2⤵
  PID:4400
- C:\Windows\System\CJKHVOH.exe
  C:\Windows\System\CJKHVOH.exe
  2⤵
  PID:4656
- C:\Windows\System\XkSDkFd.exe
  C:\Windows\System\XkSDkFd.exe
  2⤵
  PID:4504
- C:\Windows\System\JAurrII.exe
  C:\Windows\System\JAurrII.exe
  2⤵
  PID:4996
- C:\Windows\System\DZBBSFr.exe
  C:\Windows\System\DZBBSFr.exe
  2⤵
  PID:4700
- C:\Windows\System\CVkIzAd.exe
  C:\Windows\System\CVkIzAd.exe
  2⤵
  PID:4252
- C:\Windows\System\zRchNrg.exe
  C:\Windows\System\zRchNrg.exe
  2⤵
  PID:4312
- C:\Windows\System\zuuWDBk.exe
  C:\Windows\System\zuuWDBk.exe
  2⤵
  PID:3272
- C:\Windows\System\umOabHR.exe
  C:\Windows\System\umOabHR.exe
  2⤵
  PID:4536
- C:\Windows\System\NdzbvQd.exe
  C:\Windows\System\NdzbvQd.exe
  2⤵
  PID:4648
- C:\Windows\System\WIJeRdv.exe
  C:\Windows\System\WIJeRdv.exe
  2⤵
  PID:1808
- C:\Windows\System\WQvwlrP.exe
  C:\Windows\System\WQvwlrP.exe
  2⤵
  PID:2784
- C:\Windows\System\cbhQOSn.exe
  C:\Windows\System\cbhQOSn.exe
  2⤵
  PID:4316
- C:\Windows\System\qFWRczu.exe
  C:\Windows\System\qFWRczu.exe
  2⤵
  PID:2272
- C:\Windows\System\BCIFchc.exe
  C:\Windows\System\BCIFchc.exe
  2⤵
  PID:4936
- C:\Windows\System\ecyZIZN.exe
  C:\Windows\System\ecyZIZN.exe
  2⤵
  PID:5032
- C:\Windows\System\HxnvLPc.exe
  C:\Windows\System\HxnvLPc.exe
  2⤵
  PID:4116
- C:\Windows\System\qQliyIE.exe
  C:\Windows\System\qQliyIE.exe
  2⤵
  PID:1572
- C:\Windows\System\RkIeiRq.exe
  C:\Windows\System\RkIeiRq.exe
  2⤵
  PID:2304
- C:\Windows\System\NHTjiBf.exe
  C:\Windows\System\NHTjiBf.exe
  2⤵
  PID:4388
- C:\Windows\System\wPbTWlY.exe
  C:\Windows\System\wPbTWlY.exe
  2⤵
  PID:2940
- C:\Windows\System\AexCKxq.exe
  C:\Windows\System\AexCKxq.exe
  2⤵
  PID:1800
- C:\Windows\System\PsVckMG.exe
  C:\Windows\System\PsVckMG.exe
  2⤵
  PID:4768
- C:\Windows\System\cegaOsd.exe
  C:\Windows\System\cegaOsd.exe
  2⤵
  PID:4208
- C:\Windows\System\bMsByiK.exe
  C:\Windows\System\bMsByiK.exe
  2⤵
  PID:4332
- C:\Windows\System\IgmXFwH.exe
  C:\Windows\System\IgmXFwH.exe
  2⤵
  PID:5060
- C:\Windows\System\mtBqPnv.exe
  C:\Windows\System\mtBqPnv.exe
  2⤵
  PID:4796
- C:\Windows\System\dNtgzvL.exe
  C:\Windows\System\dNtgzvL.exe
  2⤵
  PID:4484
- C:\Windows\System\ohuDBHd.exe
  C:\Windows\System\ohuDBHd.exe
  2⤵
  PID:5136
- C:\Windows\System\lUVlUbk.exe
  C:\Windows\System\lUVlUbk.exe
  2⤵
  PID:5152
- C:\Windows\System\OmZJkYA.exe
  C:\Windows\System\OmZJkYA.exe
  2⤵
  PID:5168
- C:\Windows\System\leFxPYH.exe
  C:\Windows\System\leFxPYH.exe
  2⤵
  PID:5184
- C:\Windows\System\LRhyXqq.exe
  C:\Windows\System\LRhyXqq.exe
  2⤵
  PID:5200
- C:\Windows\System\gpfoiXi.exe
  C:\Windows\System\gpfoiXi.exe
  2⤵
  PID:5224
- C:\Windows\System\QgsEEDm.exe
  C:\Windows\System\QgsEEDm.exe
  2⤵
  PID:5248
- C:\Windows\System\jYsdrGp.exe
  C:\Windows\System\jYsdrGp.exe
  2⤵
  PID:5268
- C:\Windows\System\jZSkAZf.exe
  C:\Windows\System\jZSkAZf.exe
  2⤵
  PID:5284
- C:\Windows\System\tRcKIQY.exe
  C:\Windows\System\tRcKIQY.exe
  2⤵
  PID:5300
- C:\Windows\System\oyIEvoN.exe
  C:\Windows\System\oyIEvoN.exe
  2⤵
  PID:5316
- C:\Windows\System\QLnXUVl.exe
  C:\Windows\System\QLnXUVl.exe
  2⤵
  PID:5332
- C:\Windows\System\oWyBikx.exe
  C:\Windows\System\oWyBikx.exe
  2⤵
  PID:5352
- C:\Windows\System\PiPCMMG.exe
  C:\Windows\System\PiPCMMG.exe
  2⤵
  PID:5368
- C:\Windows\System\cKlGnVl.exe
  C:\Windows\System\cKlGnVl.exe
  2⤵
  PID:5384
- C:\Windows\System\NYKwoll.exe
  C:\Windows\System\NYKwoll.exe
  2⤵
  PID:5400
- C:\Windows\System\mgMFWEV.exe
  C:\Windows\System\mgMFWEV.exe
  2⤵
  PID:5416
- C:\Windows\System\zjJzAEK.exe
  C:\Windows\System\zjJzAEK.exe
  2⤵
  PID:5432
- C:\Windows\System\pYamIog.exe
  C:\Windows\System\pYamIog.exe
  2⤵
  PID:5448
- C:\Windows\System\xuCylWD.exe
  C:\Windows\System\xuCylWD.exe
  2⤵
  PID:5464
- C:\Windows\System\MJPJdFp.exe
  C:\Windows\System\MJPJdFp.exe
  2⤵
  PID:5484
- C:\Windows\System\Ennqwrc.exe
  C:\Windows\System\Ennqwrc.exe
  2⤵
  PID:5508
- C:\Windows\System\vWMTGUX.exe
  C:\Windows\System\vWMTGUX.exe
  2⤵
  PID:5528
- C:\Windows\System\QNejNzl.exe
  C:\Windows\System\QNejNzl.exe
  2⤵
  PID:5544
- C:\Windows\System\urTOMCN.exe
  C:\Windows\System\urTOMCN.exe
  2⤵
  PID:5560
- C:\Windows\System\tQnxzhc.exe
  C:\Windows\System\tQnxzhc.exe
  2⤵
  PID:5576
- C:\Windows\System\HxszdEE.exe
  C:\Windows\System\HxszdEE.exe
  2⤵
  PID:5592
- C:\Windows\System\FQAPOMe.exe
  C:\Windows\System\FQAPOMe.exe
  2⤵
  PID:5608
- C:\Windows\System\SSqPtIt.exe
  C:\Windows\System\SSqPtIt.exe
  2⤵
  PID:5632
- C:\Windows\System\epfOehr.exe
  C:\Windows\System\epfOehr.exe
  2⤵
  PID:5656
- C:\Windows\System\nKnEGQJ.exe
  C:\Windows\System\nKnEGQJ.exe
  2⤵
  PID:5676
- C:\Windows\System\BJCijVV.exe
  C:\Windows\System\BJCijVV.exe
  2⤵
  PID:5696
- C:\Windows\System\XUkFluL.exe
  C:\Windows\System\XUkFluL.exe
  2⤵
  PID:5712
- C:\Windows\System\NgPUPcw.exe
  C:\Windows\System\NgPUPcw.exe
  2⤵
  PID:5728
- C:\Windows\System\inQyMNb.exe
  C:\Windows\System\inQyMNb.exe
  2⤵
  PID:5752
- C:\Windows\System\UowJeTm.exe
  C:\Windows\System\UowJeTm.exe
  2⤵
  PID:5768
- C:\Windows\System\pioahbS.exe
  C:\Windows\System\pioahbS.exe
  2⤵
  PID:5788
- C:\Windows\System\GOKWzFE.exe
  C:\Windows\System\GOKWzFE.exe
  2⤵
  PID:5808
- C:\Windows\System\oaOphpy.exe
  C:\Windows\System\oaOphpy.exe
  2⤵
  PID:5944
- C:\Windows\System\xzcrkYR.exe
  C:\Windows\System\xzcrkYR.exe
  2⤵
  PID:5976
- C:\Windows\System\gkfpVTr.exe
  C:\Windows\System\gkfpVTr.exe
  2⤵
  PID:6008
- C:\Windows\System\fVdFBxv.exe
  C:\Windows\System\fVdFBxv.exe
  2⤵
  PID:6028
- C:\Windows\System\eyKQMJs.exe
  C:\Windows\System\eyKQMJs.exe
  2⤵
  PID:6048
- C:\Windows\System\lkDenGD.exe
  C:\Windows\System\lkDenGD.exe
  2⤵
  PID:6072
- C:\Windows\System\tjXPqrQ.exe
  C:\Windows\System\tjXPqrQ.exe
  2⤵
  PID:6088
- C:\Windows\System\HChsMHX.exe
  C:\Windows\System\HChsMHX.exe
  2⤵
  PID:6112
- C:\Windows\System\fpocMXN.exe
  C:\Windows\System\fpocMXN.exe
  2⤵
  PID:6128
- C:\Windows\System\GWKgAfT.exe
  C:\Windows\System\GWKgAfT.exe
  2⤵
  PID:4608
- C:\Windows\System\KrjpHNN.exe
  C:\Windows\System\KrjpHNN.exe
  2⤵
  PID:4840
- C:\Windows\System\msIVEEd.exe
  C:\Windows\System\msIVEEd.exe
  2⤵
  PID:5144
- C:\Windows\System\IPiWfmA.exe
  C:\Windows\System\IPiWfmA.exe
  2⤵
  PID:5216
- C:\Windows\System\BNJChVY.exe
  C:\Windows\System\BNJChVY.exe
  2⤵
  PID:5208
- C:\Windows\System\kriUkWu.exe
  C:\Windows\System\kriUkWu.exe
  2⤵
  PID:5212
- C:\Windows\System\MsCEnPb.exe
  C:\Windows\System\MsCEnPb.exe
  2⤵
  PID:5392
- C:\Windows\System\lQrvjsd.exe
  C:\Windows\System\lQrvjsd.exe
  2⤵
  PID:5328
- C:\Windows\System\PnXICBd.exe
  C:\Windows\System\PnXICBd.exe
  2⤵
  PID:5492
- C:\Windows\System\PvrFDPa.exe
  C:\Windows\System\PvrFDPa.exe
  2⤵
  PID:5568
- C:\Windows\System\nkbjogb.exe
  C:\Windows\System\nkbjogb.exe
  2⤵
  PID:5604
- C:\Windows\System\ZPIeWWi.exe
  C:\Windows\System\ZPIeWWi.exe
  2⤵
  PID:5652
- C:\Windows\System\DdYxCQO.exe
  C:\Windows\System\DdYxCQO.exe
  2⤵
  PID:5724
- C:\Windows\System\VfriHtd.exe
  C:\Windows\System\VfriHtd.exe
  2⤵
  PID:5800
- C:\Windows\System\sucHLYk.exe
  C:\Windows\System\sucHLYk.exe
  2⤵
  PID:5128
- C:\Windows\System\zDWqUiK.exe
  C:\Windows\System\zDWqUiK.exe
  2⤵
  PID:5624
- C:\Windows\System\aNDVibA.exe
  C:\Windows\System\aNDVibA.exe
  2⤵
  PID:5816
- C:\Windows\System\FbtsASv.exe
  C:\Windows\System\FbtsASv.exe
  2⤵
  PID:5192
- C:\Windows\System\VYXUAiV.exe
  C:\Windows\System\VYXUAiV.exe
  2⤵
  PID:5832
- C:\Windows\System\LcbtUfo.exe
  C:\Windows\System\LcbtUfo.exe
  2⤵
  PID:5836
- C:\Windows\System\aecWnvo.exe
  C:\Windows\System\aecWnvo.exe
  2⤵
  PID:5516
- C:\Windows\System\cCCnqdI.exe
  C:\Windows\System\cCCnqdI.exe
  2⤵
  PID:5784
- C:\Windows\System\wtkYHDn.exe
  C:\Windows\System\wtkYHDn.exe
  2⤵
  PID:4428
- C:\Windows\System\XcQGOCN.exe
  C:\Windows\System\XcQGOCN.exe
  2⤵
  PID:5844
- C:\Windows\System\GIYgLPs.exe
  C:\Windows\System\GIYgLPs.exe
  2⤵
  PID:5308
- C:\Windows\System\adcAMUS.exe
  C:\Windows\System\adcAMUS.exe
  2⤵
  PID:5348
- C:\Windows\System\kgIdYie.exe
  C:\Windows\System\kgIdYie.exe
  2⤵
  PID:5584
- C:\Windows\System\QFDHoOT.exe
  C:\Windows\System\QFDHoOT.exe
  2⤵
  PID:5628
- C:\Windows\System\VRUXBti.exe
  C:\Windows\System\VRUXBti.exe
  2⤵
  PID:5748
- C:\Windows\System\vFYAbQq.exe
  C:\Windows\System\vFYAbQq.exe
  2⤵
  PID:5856
- C:\Windows\System\fjoytEg.exe
  C:\Windows\System\fjoytEg.exe
  2⤵
  PID:5876
- C:\Windows\System\fbmhgzm.exe
  C:\Windows\System\fbmhgzm.exe
  2⤵
  PID:5892
- C:\Windows\System\vGwArzB.exe
  C:\Windows\System\vGwArzB.exe
  2⤵
  PID:3960
- C:\Windows\System\EciFIpQ.exe
  C:\Windows\System\EciFIpQ.exe
  2⤵
  PID:5932
- C:\Windows\System\zPXHJwj.exe
  C:\Windows\System\zPXHJwj.exe
  2⤵
  PID:5956
- C:\Windows\System\mVreDvQ.exe
  C:\Windows\System\mVreDvQ.exe
  2⤵
  PID:5964
- C:\Windows\System\SvrpULh.exe
  C:\Windows\System\SvrpULh.exe
  2⤵
  PID:5988
- C:\Windows\System\czlBdFv.exe
  C:\Windows\System\czlBdFv.exe
  2⤵
  PID:6016
- C:\Windows\System\XCFJzhV.exe
  C:\Windows\System\XCFJzhV.exe
  2⤵
  PID:6056
- C:\Windows\System\nsTgTZv.exe
  C:\Windows\System\nsTgTZv.exe
  2⤵
  PID:6036
- C:\Windows\System\LYzFvXp.exe
  C:\Windows\System\LYzFvXp.exe
  2⤵
  PID:6136
- C:\Windows\System\LqJWggu.exe
  C:\Windows\System\LqJWggu.exe
  2⤵
  PID:5260
- C:\Windows\System\danQouE.exe
  C:\Windows\System\danQouE.exe
  2⤵
  PID:5500
- C:\Windows\System\VqVWslK.exe
  C:\Windows\System\VqVWslK.exe
  2⤵
  PID:5692
- C:\Windows\System\nsoWevY.exe
  C:\Windows\System\nsoWevY.exe
  2⤵
  PID:5704
- C:\Windows\System\ljCdQWW.exe
  C:\Windows\System\ljCdQWW.exe
  2⤵
  PID:5840
- C:\Windows\System\YAtAAiI.exe
  C:\Windows\System\YAtAAiI.exe
  2⤵
  PID:5196
- C:\Windows\System\JQWdyPm.exe
  C:\Windows\System\JQWdyPm.exe
  2⤵
  PID:6080
- C:\Windows\System\MuDmAOd.exe
  C:\Windows\System\MuDmAOd.exe
  2⤵
  PID:5644
- C:\Windows\System\PUTWwLb.exe
  C:\Windows\System\PUTWwLb.exe
  2⤵
  PID:6124
- C:\Windows\System\qpYiraP.exe
  C:\Windows\System\qpYiraP.exe
  2⤵
  PID:5380
- C:\Windows\System\NGpZPKi.exe
  C:\Windows\System\NGpZPKi.exe
  2⤵
  PID:5340
- C:\Windows\System\voVkGrK.exe
  C:\Windows\System\voVkGrK.exe
  2⤵
  PID:5296
- C:\Windows\System\lzUWAwd.exe
  C:\Windows\System\lzUWAwd.exe
  2⤵
  PID:2380
- C:\Windows\System\OgEvVZX.exe
  C:\Windows\System\OgEvVZX.exe
  2⤵
  PID:4524
- C:\Windows\System\zUizYmS.exe
  C:\Windows\System\zUizYmS.exe
  2⤵
  PID:5908
- C:\Windows\System\tSFPaMn.exe
  C:\Windows\System\tSFPaMn.exe
  2⤵
  PID:4224
- C:\Windows\System\cgvfrSZ.exe
  C:\Windows\System\cgvfrSZ.exe
  2⤵
  PID:6020
- C:\Windows\System\vnvxQCo.exe
  C:\Windows\System\vnvxQCo.exe
  2⤵
  PID:6108
- C:\Windows\System\GzOEvjf.exe
  C:\Windows\System\GzOEvjf.exe
  2⤵
  PID:4864
- C:\Windows\System\ibQWpFl.exe
  C:\Windows\System\ibQWpFl.exe
  2⤵
  PID:3572
- C:\Windows\System\xgKWECr.exe
  C:\Windows\System\xgKWECr.exe
  2⤵
  PID:5648
- C:\Windows\System\KXdrNfl.exe
  C:\Windows\System\KXdrNfl.exe
  2⤵
  PID:5968
- C:\Windows\System\glDdXuV.exe
  C:\Windows\System\glDdXuV.exe
  2⤵
  PID:6064
- C:\Windows\System\UkMmbWi.exe
  C:\Windows\System\UkMmbWi.exe
  2⤵
  PID:5160
- C:\Windows\System\PhJGRQe.exe
  C:\Windows\System\PhJGRQe.exe
  2⤵
  PID:5616
- C:\Windows\System\NsGFmCX.exe
  C:\Windows\System\NsGFmCX.exe
  2⤵
  PID:2476
- C:\Windows\System\MgJikSt.exe
  C:\Windows\System\MgJikSt.exe
  2⤵
  PID:5688
- C:\Windows\System\LKIPnCp.exe
  C:\Windows\System\LKIPnCp.exe
  2⤵
  PID:5240
- C:\Windows\System\SFbCsgM.exe
  C:\Windows\System\SFbCsgM.exe
  2⤵
  PID:5744
- C:\Windows\System\codFQFa.exe
  C:\Windows\System\codFQFa.exe
  2⤵
  PID:5952
- C:\Windows\System\hPmDpHW.exe
  C:\Windows\System\hPmDpHW.exe
  2⤵
  PID:5872
- C:\Windows\System\fASTidX.exe
  C:\Windows\System\fASTidX.exe
  2⤵
  PID:4672
- C:\Windows\System\aRHDFJS.exe
  C:\Windows\System\aRHDFJS.exe
  2⤵
  PID:5412
- C:\Windows\System\RBRvUhO.exe
  C:\Windows\System\RBRvUhO.exe
  2⤵
  PID:5256
- C:\Windows\System\IOihyRy.exe
  C:\Windows\System\IOihyRy.exe
  2⤵
  PID:5900
- C:\Windows\System\pGYbzIB.exe
  C:\Windows\System\pGYbzIB.exe
  2⤵
  PID:3352
- C:\Windows\System\FfEwDTE.exe
  C:\Windows\System\FfEwDTE.exe
  2⤵
  PID:5520
- C:\Windows\System\WlNUJWq.exe
  C:\Windows\System\WlNUJWq.exe
  2⤵
  PID:5920
- C:\Windows\System\fQHpVFG.exe
  C:\Windows\System\fQHpVFG.exe
  2⤵
  PID:5824
- C:\Windows\System\jbfYbth.exe
  C:\Windows\System\jbfYbth.exe
  2⤵
  PID:5480
- C:\Windows\System\NZfWTCT.exe
  C:\Windows\System\NZfWTCT.exe
  2⤵
  PID:6160
- C:\Windows\System\ZGwPhnt.exe
  C:\Windows\System\ZGwPhnt.exe
  2⤵
  PID:6228
- C:\Windows\System\lLHaSBv.exe
  C:\Windows\System\lLHaSBv.exe
  2⤵
  PID:6244
- C:\Windows\System\aNffisM.exe
  C:\Windows\System\aNffisM.exe
  2⤵
  PID:6260
- C:\Windows\System\rjuCZbj.exe
  C:\Windows\System\rjuCZbj.exe
  2⤵
  PID:6276
- C:\Windows\System\ZiTSXac.exe
  C:\Windows\System\ZiTSXac.exe
  2⤵
  PID:6296
- C:\Windows\System\hiQcyJe.exe
  C:\Windows\System\hiQcyJe.exe
  2⤵
  PID:6312
- C:\Windows\System\nBqQubY.exe
  C:\Windows\System\nBqQubY.exe
  2⤵
  PID:6328
- C:\Windows\System\AJCcdvu.exe
  C:\Windows\System\AJCcdvu.exe
  2⤵
  PID:6344
- C:\Windows\System\RpEjmrd.exe
  C:\Windows\System\RpEjmrd.exe
  2⤵
  PID:6376
- C:\Windows\System\YIQZxLJ.exe
  C:\Windows\System\YIQZxLJ.exe
  2⤵
  PID:6392
- C:\Windows\System\aqJLDek.exe
  C:\Windows\System\aqJLDek.exe
  2⤵
  PID:6408
- C:\Windows\System\cQtbmuf.exe
  C:\Windows\System\cQtbmuf.exe
  2⤵
  PID:6424
- C:\Windows\System\ZVXzeiu.exe
  C:\Windows\System\ZVXzeiu.exe
  2⤵
  PID:6440
- C:\Windows\System\NubkymZ.exe
  C:\Windows\System\NubkymZ.exe
  2⤵
  PID:6456
- C:\Windows\System\fRtkBLg.exe
  C:\Windows\System\fRtkBLg.exe
  2⤵
  PID:6476
- C:\Windows\System\BIbSqnS.exe
  C:\Windows\System\BIbSqnS.exe
  2⤵
  PID:6496
- C:\Windows\System\upBCTsu.exe
  C:\Windows\System\upBCTsu.exe
  2⤵
  PID:6512
- C:\Windows\System\JmBUQMh.exe
  C:\Windows\System\JmBUQMh.exe
  2⤵
  PID:6532
- C:\Windows\System\ZjcoFQV.exe
  C:\Windows\System\ZjcoFQV.exe
  2⤵
  PID:6552
- C:\Windows\System\FthixZB.exe
  C:\Windows\System\FthixZB.exe
  2⤵
  PID:6568
- C:\Windows\System\DAGCFOC.exe
  C:\Windows\System\DAGCFOC.exe
  2⤵
  PID:6584
- C:\Windows\System\mMqIGre.exe
  C:\Windows\System\mMqIGre.exe
  2⤵
  PID:6600
- C:\Windows\System\fzjJYyp.exe
  C:\Windows\System\fzjJYyp.exe
  2⤵
  PID:6620
- C:\Windows\System\bwzVtvW.exe
  C:\Windows\System\bwzVtvW.exe
  2⤵
  PID:6636
- C:\Windows\System\VWXyauq.exe
  C:\Windows\System\VWXyauq.exe
  2⤵
  PID:6656
- C:\Windows\System\xjsnGAw.exe
  C:\Windows\System\xjsnGAw.exe
  2⤵
  PID:6672
- C:\Windows\System\kTIVLNM.exe
  C:\Windows\System\kTIVLNM.exe
  2⤵
  PID:6704
- C:\Windows\System\BxcEpHX.exe
  C:\Windows\System\BxcEpHX.exe
  2⤵
  PID:6724
- C:\Windows\System\oPoQteN.exe
  C:\Windows\System\oPoQteN.exe
  2⤵
  PID:6740
- C:\Windows\System\XIpqSbO.exe
  C:\Windows\System\XIpqSbO.exe
  2⤵
  PID:6760
- C:\Windows\System\kIWjxGq.exe
  C:\Windows\System\kIWjxGq.exe
  2⤵
  PID:6780
- C:\Windows\System\DnivoVw.exe
  C:\Windows\System\DnivoVw.exe
  2⤵
  PID:6796
- C:\Windows\System\BludsZP.exe
  C:\Windows\System\BludsZP.exe
  2⤵
  PID:6812
- C:\Windows\System\WsQdlQu.exe
  C:\Windows\System\WsQdlQu.exe
  2⤵
  PID:6832
- C:\Windows\System\ceSiWcZ.exe
  C:\Windows\System\ceSiWcZ.exe
  2⤵
  PID:6848
- C:\Windows\System\SQfYSSc.exe
  C:\Windows\System\SQfYSSc.exe
  2⤵
  PID:6864
- C:\Windows\System\rPwtHCK.exe
  C:\Windows\System\rPwtHCK.exe
  2⤵
  PID:6880
- C:\Windows\System\pnKwAsU.exe
  C:\Windows\System\pnKwAsU.exe
  2⤵
  PID:6900
- C:\Windows\System\bBQMrwx.exe
  C:\Windows\System\bBQMrwx.exe
  2⤵
  PID:6916
- C:\Windows\System\QTvUiOV.exe
  C:\Windows\System\QTvUiOV.exe
  2⤵
  PID:6932
- C:\Windows\System\eoKtEYT.exe
  C:\Windows\System\eoKtEYT.exe
  2⤵
  PID:6948
- C:\Windows\System\fwhyBCc.exe
  C:\Windows\System\fwhyBCc.exe
  2⤵
  PID:6964
- C:\Windows\System\iCxtrwA.exe
  C:\Windows\System\iCxtrwA.exe
  2⤵
  PID:6984
- C:\Windows\System\KiADOTW.exe
  C:\Windows\System\KiADOTW.exe
  2⤵
  PID:7000
- C:\Windows\System\GxPzQbM.exe
  C:\Windows\System\GxPzQbM.exe
  2⤵
  PID:7016
- C:\Windows\System\zMWOUVH.exe
  C:\Windows\System\zMWOUVH.exe
  2⤵
  PID:7032
- C:\Windows\System\SPkCNXC.exe
  C:\Windows\System\SPkCNXC.exe
  2⤵
  PID:7048
- C:\Windows\System\YtWagEJ.exe
  C:\Windows\System\YtWagEJ.exe
  2⤵
  PID:7064
- C:\Windows\System\ckokcJo.exe
  C:\Windows\System\ckokcJo.exe
  2⤵
  PID:7080
- C:\Windows\System\VuTWioN.exe
  C:\Windows\System\VuTWioN.exe
  2⤵
  PID:6104
- C:\Windows\System\cBXjaog.exe
  C:\Windows\System\cBXjaog.exe
  2⤵
  PID:5620
- C:\Windows\System\iEWWToy.exe
  C:\Windows\System\iEWWToy.exe
  2⤵
  PID:6400
- C:\Windows\System\MdnSjVF.exe
  C:\Windows\System\MdnSjVF.exe
  2⤵
  PID:6436
- C:\Windows\System\fNdHZTW.exe
  C:\Windows\System\fNdHZTW.exe
  2⤵
  PID:6504
- C:\Windows\System\TdmjtrV.exe
  C:\Windows\System\TdmjtrV.exe
  2⤵
  PID:5848
- C:\Windows\System\zPbUpYF.exe
  C:\Windows\System\zPbUpYF.exe
  2⤵
  PID:6548
- C:\Windows\System\CYgbYGn.exe
  C:\Windows\System\CYgbYGn.exe
  2⤵
  PID:6608
- C:\Windows\System\VyyPWMa.exe
  C:\Windows\System\VyyPWMa.exe
  2⤵
  PID:6648
- C:\Windows\System\VbQmQty.exe
  C:\Windows\System\VbQmQty.exe
  2⤵
  PID:6272
- C:\Windows\System\lDvQWLj.exe
  C:\Windows\System\lDvQWLj.exe
  2⤵
  PID:6336
- C:\Windows\System\ocYmtPb.exe
  C:\Windows\System\ocYmtPb.exe
  2⤵
  PID:6628
- C:\Windows\System\yzcwhmt.exe
  C:\Windows\System\yzcwhmt.exe
  2⤵
  PID:6416
- C:\Windows\System\WhRwnPa.exe
  C:\Windows\System\WhRwnPa.exe
  2⤵
  PID:6732
- C:\Windows\System\spSffSS.exe
  C:\Windows\System\spSffSS.exe
  2⤵
  PID:6680
- C:\Windows\System\RDhdTYG.exe
  C:\Windows\System\RDhdTYG.exe
  2⤵
  PID:6808
- C:\Windows\System\ZWZOQNa.exe
  C:\Windows\System\ZWZOQNa.exe
  2⤵
  PID:6940
- C:\Windows\System\tDmHtRR.exe
  C:\Windows\System\tDmHtRR.exe
  2⤵
  PID:6980
- C:\Windows\System\PFcXDnm.exe
  C:\Windows\System\PFcXDnm.exe
  2⤵
  PID:7044
- C:\Windows\System\qfsherN.exe
  C:\Windows\System\qfsherN.exe
  2⤵
  PID:6520
- C:\Windows\System\DvIRKJl.exe
  C:\Windows\System\DvIRKJl.exe
  2⤵
  PID:6632
- C:\Windows\System\ImGiNmd.exe
  C:\Windows\System\ImGiNmd.exe
  2⤵
  PID:6824
- C:\Windows\System\tKEbSLm.exe
  C:\Windows\System\tKEbSLm.exe
  2⤵
  PID:6716
- C:\Windows\System\ShoxAFD.exe
  C:\Windows\System\ShoxAFD.exe
  2⤵
  PID:7124
- C:\Windows\System\agUrcSH.exe
  C:\Windows\System\agUrcSH.exe
  2⤵
  PID:7148
- C:\Windows\System\tKeGmjR.exe
  C:\Windows\System\tKeGmjR.exe
  2⤵
  PID:7104
- C:\Windows\System\aZkhlmM.exe
  C:\Windows\System\aZkhlmM.exe
  2⤵
  PID:6896
- C:\Windows\System\DUMuZbN.exe
  C:\Windows\System\DUMuZbN.exe
  2⤵
  PID:6960
- C:\Windows\System\eQErRGe.exe
  C:\Windows\System\eQErRGe.exe
  2⤵
  PID:7028
- C:\Windows\System\gcEjOaM.exe
  C:\Windows\System\gcEjOaM.exe
  2⤵
  PID:7120
- C:\Windows\System\teNayRz.exe
  C:\Windows\System\teNayRz.exe
  2⤵
  PID:6204
- C:\Windows\System\MhYZqBT.exe
  C:\Windows\System\MhYZqBT.exe
  2⤵
  PID:7144
- C:\Windows\System\VhOMpvl.exe
  C:\Windows\System\VhOMpvl.exe
  2⤵
  PID:6168
- C:\Windows\System\stqeOuw.exe
  C:\Windows\System\stqeOuw.exe
  2⤵
  PID:6172
- C:\Windows\System\DBjVXmP.exe
  C:\Windows\System\DBjVXmP.exe
  2⤵
  PID:5164
- C:\Windows\System\IPRFiiv.exe
  C:\Windows\System\IPRFiiv.exe
  2⤵
  PID:6284
- C:\Windows\System\QypcSVK.exe
  C:\Windows\System\QypcSVK.exe
  2⤵
  PID:6324
- C:\Windows\System\YGxKYMd.exe
  C:\Windows\System\YGxKYMd.exe
  2⤵
  PID:6156
- C:\Windows\System\KdREDWQ.exe
  C:\Windows\System\KdREDWQ.exe
  2⤵
  PID:6360
- C:\Windows\System\ftbYRga.exe
  C:\Windows\System\ftbYRga.exe
  2⤵
  PID:6432
- C:\Windows\System\nxFxHSf.exe
  C:\Windows\System\nxFxHSf.exe
  2⤵
  PID:6544
- C:\Windows\System\EBkryhz.exe
  C:\Windows\System\EBkryhz.exe
  2⤵
  PID:6576
- C:\Windows\System\iYUpSCk.exe
  C:\Windows\System\iYUpSCk.exe
  2⤵
  PID:5928
- C:\Windows\System\xSGqpZj.exe
  C:\Windows\System\xSGqpZj.exe
  2⤵
  PID:6612
- C:\Windows\System\QPILkUn.exe
  C:\Windows\System\QPILkUn.exe
  2⤵
  PID:6592
- C:\Windows\System\KebKFYb.exe
  C:\Windows\System\KebKFYb.exe
  2⤵
  PID:6388
- C:\Windows\System\lkJcJEs.exe
  C:\Windows\System\lkJcJEs.exe
  2⤵
  PID:6768
- C:\Windows\System\AzvjbYK.exe
  C:\Windows\System\AzvjbYK.exe
  2⤵
  PID:6804
- C:\Windows\System\UAxvfet.exe
  C:\Windows\System\UAxvfet.exe
  2⤵
  PID:7076
- C:\Windows\System\ATgtopx.exe
  C:\Windows\System\ATgtopx.exe
  2⤵
  PID:6776
- C:\Windows\System\FeQzTAH.exe
  C:\Windows\System\FeQzTAH.exe
  2⤵
  PID:7116
- C:\Windows\System\euCForN.exe
  C:\Windows\System\euCForN.exe
  2⤵
  PID:7012
- C:\Windows\System\yCuhdKk.exe
  C:\Windows\System\yCuhdKk.exe
  2⤵
  PID:6860
- C:\Windows\System\lhtngmT.exe
  C:\Windows\System\lhtngmT.exe
  2⤵
  PID:6956
- C:\Windows\System\LIrFyDz.exe
  C:\Windows\System\LIrFyDz.exe
  2⤵
  PID:7040
- C:\Windows\System\hvYxyDr.exe
  C:\Windows\System\hvYxyDr.exe
  2⤵
  PID:6856
- C:\Windows\System\RTStCxs.exe
  C:\Windows\System\RTStCxs.exe
  2⤵
  PID:7096
- C:\Windows\System\ZnWkzPC.exe
  C:\Windows\System\ZnWkzPC.exe
  2⤵
  PID:7160
- C:\Windows\System\swsZCre.exe
  C:\Windows\System\swsZCre.exe
  2⤵
  PID:6196
- C:\Windows\System\coftjdK.exe
  C:\Windows\System\coftjdK.exe
  2⤵
  PID:6256
- C:\Windows\System\mCxzSVv.exe
  C:\Windows\System\mCxzSVv.exe
  2⤵
  PID:5896
- C:\Windows\System\ubJbRIq.exe
  C:\Windows\System\ubJbRIq.exe
  2⤵
  PID:6304
- C:\Windows\System\DoMpIdq.exe
  C:\Windows\System\DoMpIdq.exe
  2⤵
  PID:6844
- C:\Windows\System\xCLfEhC.exe
  C:\Windows\System\xCLfEhC.exe
  2⤵
  PID:6996
- C:\Windows\System\rFmlqVF.exe
  C:\Windows\System\rFmlqVF.exe
  2⤵
  PID:6192
- C:\Windows\System\JfDPqqR.exe
  C:\Windows\System\JfDPqqR.exe
  2⤵
  PID:6224
- C:\Windows\System\LHTEVvs.exe
  C:\Windows\System\LHTEVvs.exe
  2⤵
  PID:7024
- C:\Windows\System\qXvmplY.exe
  C:\Windows\System\qXvmplY.exe
  2⤵
  PID:6472
- C:\Windows\System\dRsrFoo.exe
  C:\Windows\System\dRsrFoo.exe
  2⤵
  PID:6508
- C:\Windows\System\wHhKTcD.exe
  C:\Windows\System\wHhKTcD.exe
  2⤵
  PID:6972
- C:\Windows\System\UqrROoG.exe
  C:\Windows\System\UqrROoG.exe
  2⤵
  PID:6908
- C:\Windows\System\equfKEO.exe
  C:\Windows\System\equfKEO.exe
  2⤵
  PID:6212
- C:\Windows\System\HeZmdJO.exe
  C:\Windows\System\HeZmdJO.exe
  2⤵
  PID:5740
- C:\Windows\System\FZAIDXG.exe
  C:\Windows\System\FZAIDXG.exe
  2⤵
  PID:6560
- C:\Windows\System\XgImMeL.exe
  C:\Windows\System\XgImMeL.exe
  2⤵
  PID:6492
- C:\Windows\System\cogfJXk.exe
  C:\Windows\System\cogfJXk.exe
  2⤵
  PID:6320
- C:\Windows\System\VKdqJjl.exe
  C:\Windows\System\VKdqJjl.exe
  2⤵
  PID:6792
- C:\Windows\System\KkJBDTX.exe
  C:\Windows\System\KkJBDTX.exe
  2⤵
  PID:7184
- C:\Windows\System\mYxslXD.exe
  C:\Windows\System\mYxslXD.exe
  2⤵
  PID:7200
- C:\Windows\System\rHbXORG.exe
  C:\Windows\System\rHbXORG.exe
  2⤵
  PID:7216
- C:\Windows\System\teRKlfy.exe
  C:\Windows\System\teRKlfy.exe
  2⤵
  PID:7232
- C:\Windows\System\XbmTNOh.exe
  C:\Windows\System\XbmTNOh.exe
  2⤵
  PID:7248
- C:\Windows\System\MgHFwCx.exe
  C:\Windows\System\MgHFwCx.exe
  2⤵
  PID:7272
- C:\Windows\System\lRLegfa.exe
  C:\Windows\System\lRLegfa.exe
  2⤵
  PID:7288
- C:\Windows\System\LzcJcqC.exe
  C:\Windows\System\LzcJcqC.exe
  2⤵
  PID:7304
- C:\Windows\System\HIVinQd.exe
  C:\Windows\System\HIVinQd.exe
  2⤵
  PID:7324
- C:\Windows\System\BneedAP.exe
  C:\Windows\System\BneedAP.exe
  2⤵
  PID:7340
- C:\Windows\System\uAhGYUX.exe
  C:\Windows\System\uAhGYUX.exe
  2⤵
  PID:7400
- C:\Windows\System\hVavDgt.exe
  C:\Windows\System\hVavDgt.exe
  2⤵
  PID:7416
- C:\Windows\System\gEwFaNU.exe
  C:\Windows\System\gEwFaNU.exe
  2⤵
  PID:7564
- C:\Windows\System\dRcozGS.exe
  C:\Windows\System\dRcozGS.exe
  2⤵
  PID:7580
- C:\Windows\System\jLnzbaj.exe
  C:\Windows\System\jLnzbaj.exe
  2⤵
  PID:7596
- C:\Windows\System\qBdlqGR.exe
  C:\Windows\System\qBdlqGR.exe
  2⤵
  PID:7612
- C:\Windows\System\TMAfKkg.exe
  C:\Windows\System\TMAfKkg.exe
  2⤵
  PID:7628
- C:\Windows\System\kGbBTMV.exe
  C:\Windows\System\kGbBTMV.exe
  2⤵
  PID:7648
- C:\Windows\System\NpuQOXr.exe
  C:\Windows\System\NpuQOXr.exe
  2⤵
  PID:7664
- C:\Windows\System\GEolYyG.exe
  C:\Windows\System\GEolYyG.exe
  2⤵
  PID:7680
- C:\Windows\System\OeLchhM.exe
  C:\Windows\System\OeLchhM.exe
  2⤵
  PID:7696
- C:\Windows\System\ukkmRvN.exe
  C:\Windows\System\ukkmRvN.exe
  2⤵
  PID:7712
- C:\Windows\System\GnZtexA.exe
  C:\Windows\System\GnZtexA.exe
  2⤵
  PID:7728
- C:\Windows\System\GIBIqQd.exe
  C:\Windows\System\GIBIqQd.exe
  2⤵
  PID:7744
- C:\Windows\System\SXMtQoy.exe
  C:\Windows\System\SXMtQoy.exe
  2⤵
  PID:7760
- C:\Windows\System\IMnLKSP.exe
  C:\Windows\System\IMnLKSP.exe
  2⤵
  PID:7776
- C:\Windows\System\ZeUtFyk.exe
  C:\Windows\System\ZeUtFyk.exe
  2⤵
  PID:7792
- C:\Windows\System\xoRtrON.exe
  C:\Windows\System\xoRtrON.exe
  2⤵
  PID:7808
- C:\Windows\System\kJcQJdv.exe
  C:\Windows\System\kJcQJdv.exe
  2⤵
  PID:7824
- C:\Windows\System\IPDQyMu.exe
  C:\Windows\System\IPDQyMu.exe
  2⤵
  PID:7840
- C:\Windows\System\TrmhMCI.exe
  C:\Windows\System\TrmhMCI.exe
  2⤵
  PID:7856
- C:\Windows\System\YAbffhD.exe
  C:\Windows\System\YAbffhD.exe
  2⤵
  PID:7872
- C:\Windows\System\cdjScBI.exe
  C:\Windows\System\cdjScBI.exe
  2⤵
  PID:7888
- C:\Windows\System\HRslDDG.exe
  C:\Windows\System\HRslDDG.exe
  2⤵
  PID:7908
- C:\Windows\System\KMBlCsL.exe
  C:\Windows\System\KMBlCsL.exe
  2⤵
  PID:7928
- C:\Windows\System\kwIXzKR.exe
  C:\Windows\System\kwIXzKR.exe
  2⤵
  PID:7944
- C:\Windows\System\UjlSXro.exe
  C:\Windows\System\UjlSXro.exe
  2⤵
  PID:7960
- C:\Windows\System\MxrEkYm.exe
  C:\Windows\System\MxrEkYm.exe
  2⤵
  PID:7976
- C:\Windows\System\RqzzLKw.exe
  C:\Windows\System\RqzzLKw.exe
  2⤵
  PID:7992
- C:\Windows\System\ajvNDNm.exe
  C:\Windows\System\ajvNDNm.exe
  2⤵
  PID:8008
- C:\Windows\System\sNdHXTu.exe
  C:\Windows\System\sNdHXTu.exe
  2⤵
  PID:8024
- C:\Windows\System\xwEeMYE.exe
  C:\Windows\System\xwEeMYE.exe
  2⤵
  PID:8044
- C:\Windows\System\GZGREqi.exe
  C:\Windows\System\GZGREqi.exe
  2⤵
  PID:8064
- C:\Windows\System\JOMmyeI.exe
  C:\Windows\System\JOMmyeI.exe
  2⤵
  PID:8092
- C:\Windows\System\bTvXoIu.exe
  C:\Windows\System\bTvXoIu.exe
  2⤵
  PID:8112
- C:\Windows\System\gMqtGut.exe
  C:\Windows\System\gMqtGut.exe
  2⤵
  PID:8132
- C:\Windows\System\CnhAJCE.exe
  C:\Windows\System\CnhAJCE.exe
  2⤵
  PID:8148
- C:\Windows\System\wCkvVJB.exe
  C:\Windows\System\wCkvVJB.exe
  2⤵
  PID:8164
- C:\Windows\System\jPVWBeK.exe
  C:\Windows\System\jPVWBeK.exe
  2⤵
  PID:8180
- C:\Windows\System\CWaxKGC.exe
  C:\Windows\System\CWaxKGC.exe
  2⤵
  PID:6252
- C:\Windows\System\WmaNBVW.exe
  C:\Windows\System\WmaNBVW.exe
  2⤵
  PID:7240
- C:\Windows\System\DkEppRW.exe
  C:\Windows\System\DkEppRW.exe
  2⤵
  PID:6748
- C:\Windows\System\ITKTzKs.exe
  C:\Windows\System\ITKTzKs.exe
  2⤵
  PID:6700
- C:\Windows\System\ZHCnOJS.exe
  C:\Windows\System\ZHCnOJS.exe
  2⤵
  PID:7280
- C:\Windows\System\ktVnLaP.exe
  C:\Windows\System\ktVnLaP.exe
  2⤵
  PID:7312
- C:\Windows\System\mMHqOVP.exe
  C:\Windows\System\mMHqOVP.exe
  2⤵
  PID:7356
- C:\Windows\System\LBmtMzV.exe
  C:\Windows\System\LBmtMzV.exe
  2⤵
  PID:6216
- C:\Windows\System\vhECTkc.exe
  C:\Windows\System\vhECTkc.exe
  2⤵
  PID:5276
- C:\Windows\System\BrIWwKI.exe
  C:\Windows\System\BrIWwKI.exe
  2⤵
  PID:7256
- C:\Windows\System\VvxOHJf.exe
  C:\Windows\System\VvxOHJf.exe
  2⤵
  PID:7300
- C:\Windows\System\MLwtHOn.exe
  C:\Windows\System\MLwtHOn.exe
  2⤵
  PID:7360
- C:\Windows\System\SxwiGLa.exe
  C:\Windows\System\SxwiGLa.exe
  2⤵
  PID:7408
- C:\Windows\System\ENHRvtm.exe
  C:\Windows\System\ENHRvtm.exe
  2⤵
  PID:7388
- C:\Windows\System\OSWkiQU.exe
  C:\Windows\System\OSWkiQU.exe
  2⤵
  PID:7428
- C:\Windows\System\HvslqBc.exe
  C:\Windows\System\HvslqBc.exe
  2⤵
  PID:7444
- C:\Windows\System\gakADhZ.exe
  C:\Windows\System\gakADhZ.exe
  2⤵
  PID:7460
- C:\Windows\System\sdoYavs.exe
  C:\Windows\System\sdoYavs.exe
  2⤵
  PID:7500
- C:\Windows\System\zqbFxVB.exe
  C:\Windows\System\zqbFxVB.exe
  2⤵
  PID:7536
- C:\Windows\System\MCJfOsz.exe
  C:\Windows\System\MCJfOsz.exe
  2⤵
  PID:7472
- C:\Windows\System\SnJJgfZ.exe
  C:\Windows\System\SnJJgfZ.exe
  2⤵
  PID:7520
- C:\Windows\System\ZHpwalP.exe
  C:\Windows\System\ZHpwalP.exe
  2⤵
  PID:6352
- C:\Windows\System\XVhueEF.exe
  C:\Windows\System\XVhueEF.exe
  2⤵
  PID:1092
- C:\Windows\System\PvtDYwN.exe
  C:\Windows\System\PvtDYwN.exe
  2⤵
  PID:7660
- C:\Windows\System\xeMxBqi.exe
  C:\Windows\System\xeMxBqi.exe
  2⤵
  PID:7724
- C:\Windows\System\NSJYpQF.exe
  C:\Windows\System\NSJYpQF.exe
  2⤵
  PID:7656
- C:\Windows\System\ZeGFgUE.exe
  C:\Windows\System\ZeGFgUE.exe
  2⤵
  PID:7848
- C:\Windows\System\mKRzPTt.exe
  C:\Windows\System\mKRzPTt.exe
  2⤵
  PID:7952
- C:\Windows\System\ZrPhdAn.exe
  C:\Windows\System\ZrPhdAn.exe
  2⤵
  PID:7924
- C:\Windows\System\UGtdZkW.exe
  C:\Windows\System\UGtdZkW.exe
  2⤵
  PID:8052
- C:\Windows\System\ehybniS.exe
  C:\Windows\System\ehybniS.exe
  2⤵
  PID:8100
- C:\Windows\System\qYPleog.exe
  C:\Windows\System\qYPleog.exe
  2⤵
  PID:8108
- C:\Windows\System\OZpABIB.exe
  C:\Windows\System\OZpABIB.exe
  2⤵
  PID:8176
- C:\Windows\System\VjhHgFc.exe
  C:\Windows\System\VjhHgFc.exe
  2⤵
  PID:8076
- C:\Windows\System\IrVILzG.exe
  C:\Windows\System\IrVILzG.exe
  2⤵
  PID:7836
- C:\Windows\System\DWVxQQW.exe
  C:\Windows\System\DWVxQQW.exe
  2⤵
  PID:7904
- C:\Windows\System\apCYGCr.exe
  C:\Windows\System\apCYGCr.exe
  2⤵
  PID:7972
- C:\Windows\System\ZsoDlCl.exe
  C:\Windows\System\ZsoDlCl.exe
  2⤵
  PID:8040
- C:\Windows\System\WokPksy.exe
  C:\Windows\System\WokPksy.exe
  2⤵
  PID:8120
- C:\Windows\System\preyLKa.exe
  C:\Windows\System\preyLKa.exe
  2⤵
  PID:8188
- C:\Windows\System\lJttaDZ.exe
  C:\Windows\System\lJttaDZ.exe
  2⤵
  PID:5992
- C:\Windows\System\uKQendh.exe
  C:\Windows\System\uKQendh.exe
  2⤵
  PID:7284
- C:\Windows\System\UPemrhv.exe
  C:\Windows\System\UPemrhv.exe
  2⤵
  PID:7228
- C:\Windows\System\KfoOKFx.exe
  C:\Windows\System\KfoOKFx.exe
  2⤵
  PID:7384
- C:\Windows\System\beTwVRL.exe
  C:\Windows\System\beTwVRL.exe
  2⤵
  PID:7484
- C:\Windows\System\HbcWWtt.exe
  C:\Windows\System\HbcWWtt.exe
  2⤵
  PID:7480
- C:\Windows\System\rguXXzJ.exe
  C:\Windows\System\rguXXzJ.exe
  2⤵
  PID:7544
- C:\Windows\System\MpEgfNV.exe
  C:\Windows\System\MpEgfNV.exe
  2⤵
  PID:7624
- C:\Windows\System\MbvFWbe.exe
  C:\Windows\System\MbvFWbe.exe
  2⤵
  PID:7916
- C:\Windows\System\PvqybAK.exe
  C:\Windows\System\PvqybAK.exe
  2⤵
  PID:8016
- C:\Windows\System\UVKgbIg.exe
  C:\Windows\System\UVKgbIg.exe
  2⤵
  PID:7708
- C:\Windows\System\LNLIbeJ.exe
  C:\Windows\System\LNLIbeJ.exe
  2⤵
  PID:7900
- C:\Windows\System\xBkrvvF.exe
  C:\Windows\System\xBkrvvF.exe
  2⤵
  PID:8156
- C:\Windows\System\qTxWeIv.exe
  C:\Windows\System\qTxWeIv.exe
  2⤵
  PID:6448
- C:\Windows\System\trfWqtz.exe
  C:\Windows\System\trfWqtz.exe
  2⤵
  PID:7528
- C:\Windows\System\pmWFVSY.exe
  C:\Windows\System\pmWFVSY.exe
  2⤵
  PID:7352
- C:\Windows\System\eGQeGxy.exe
  C:\Windows\System\eGQeGxy.exe
  2⤵
  PID:7396
- C:\Windows\System\rSlfseX.exe
  C:\Windows\System\rSlfseX.exe
  2⤵
  PID:7832
- C:\Windows\System\yVxNFqV.exe
  C:\Windows\System\yVxNFqV.exe
  2⤵
  PID:8084
- C:\Windows\System\MJVFpwY.exe
  C:\Windows\System\MJVFpwY.exe
  2⤵
  PID:7440
- C:\Windows\System\oLqDgDV.exe
  C:\Windows\System\oLqDgDV.exe
  2⤵
  PID:7456
- C:\Windows\System\djGaORL.exe
  C:\Windows\System\djGaORL.exe
  2⤵
  PID:7604
- C:\Windows\System\UdXzduF.exe
  C:\Windows\System\UdXzduF.exe
  2⤵
  PID:7984
- C:\Windows\System\NkbyQsD.exe
  C:\Windows\System\NkbyQsD.exe
  2⤵
  PID:7768
- C:\Windows\System\znhggYT.exe
  C:\Windows\System\znhggYT.exe
  2⤵
  PID:8104
- C:\Windows\System\yCQYrJV.exe
  C:\Windows\System\yCQYrJV.exe
  2⤵
  PID:7560
- C:\Windows\System\DYgjbTj.exe
  C:\Windows\System\DYgjbTj.exe
  2⤵
  PID:7548
- C:\Windows\System\SqenRlO.exe
  C:\Windows\System\SqenRlO.exe
  2⤵
  PID:7636
- C:\Windows\System\LYUlvWt.exe
  C:\Windows\System\LYUlvWt.exe
  2⤵
  PID:8080
- C:\Windows\System\AYIZozi.exe
  C:\Windows\System\AYIZozi.exe
  2⤵
  PID:8056
- C:\Windows\System\WtTNNPV.exe
  C:\Windows\System\WtTNNPV.exe
  2⤵
  PID:8128
- C:\Windows\System\btlfkRw.exe
  C:\Windows\System\btlfkRw.exe
  2⤵
  PID:7476
- C:\Windows\System\aqMWSJl.exe
  C:\Windows\System\aqMWSJl.exe
  2⤵
  PID:6712
- C:\Windows\System\rGfxYRH.exe
  C:\Windows\System\rGfxYRH.exe
  2⤵
  PID:7800
- C:\Windows\System\JhfoobH.exe
  C:\Windows\System\JhfoobH.exe
  2⤵
  PID:7320
- C:\Windows\System\GLpGNxf.exe
  C:\Windows\System\GLpGNxf.exe
  2⤵
  PID:7608
- C:\Windows\System\ZjpTajK.exe
  C:\Windows\System\ZjpTajK.exe
  2⤵
  PID:7692
- C:\Windows\System\ySoQVqb.exe
  C:\Windows\System\ySoQVqb.exe
  2⤵
  PID:8032
- C:\Windows\System\fCvqwOd.exe
  C:\Windows\System\fCvqwOd.exe
  2⤵
  PID:7532
- C:\Windows\System\VHwxzih.exe
  C:\Windows\System\VHwxzih.exe
  2⤵
  PID:7412
- C:\Windows\System\omvMPXq.exe
  C:\Windows\System\omvMPXq.exe
  2⤵
  PID:7504
- C:\Windows\System\NCWtfOA.exe
  C:\Windows\System\NCWtfOA.exe
  2⤵
  PID:8144
- C:\Windows\System\SfkNIcF.exe
  C:\Windows\System\SfkNIcF.exe
  2⤵
  PID:8208
- C:\Windows\System\gENehXf.exe
  C:\Windows\System\gENehXf.exe
  2⤵
  PID:8236
- C:\Windows\System\dbdizfc.exe
  C:\Windows\System\dbdizfc.exe
  2⤵
  PID:8252
- C:\Windows\System\baMgmeA.exe
  C:\Windows\System\baMgmeA.exe
  2⤵
  PID:8268
- C:\Windows\System\aypJuaX.exe
  C:\Windows\System\aypJuaX.exe
  2⤵
  PID:8292
- C:\Windows\System\wOEiAmS.exe
  C:\Windows\System\wOEiAmS.exe
  2⤵
  PID:8308
- C:\Windows\System\PIvnWQU.exe
  C:\Windows\System\PIvnWQU.exe
  2⤵
  PID:8324
- C:\Windows\System\biGUTwB.exe
  C:\Windows\System\biGUTwB.exe
  2⤵
  PID:8340
- C:\Windows\System\ysIJdjq.exe
  C:\Windows\System\ysIJdjq.exe
  2⤵
  PID:8364
- C:\Windows\System\PBjZGno.exe
  C:\Windows\System\PBjZGno.exe
  2⤵
  PID:8380
- C:\Windows\System\aVQLlQd.exe
  C:\Windows\System\aVQLlQd.exe
  2⤵
  PID:8400
- C:\Windows\System\WfExtYU.exe
  C:\Windows\System\WfExtYU.exe
  2⤵
  PID:8416
- C:\Windows\System\MPHliUi.exe
  C:\Windows\System\MPHliUi.exe
  2⤵
  PID:8436
- C:\Windows\System\KpwQkbd.exe
  C:\Windows\System\KpwQkbd.exe
  2⤵
  PID:8456
- C:\Windows\System\nTkfgQk.exe
  C:\Windows\System\nTkfgQk.exe
  2⤵
  PID:8476
- C:\Windows\System\cXohKsI.exe
  C:\Windows\System\cXohKsI.exe
  2⤵
  PID:8492
- C:\Windows\System\LrMxluj.exe
  C:\Windows\System\LrMxluj.exe
  2⤵
  PID:8508
- C:\Windows\System\fEaDlcf.exe
  C:\Windows\System\fEaDlcf.exe
  2⤵
  PID:8524
- C:\Windows\System\seToGIK.exe
  C:\Windows\System\seToGIK.exe
  2⤵
  PID:8540
- C:\Windows\System\mVteDZj.exe
  C:\Windows\System\mVteDZj.exe
  2⤵
  PID:8556
- C:\Windows\System\ubEGXIl.exe
  C:\Windows\System\ubEGXIl.exe
  2⤵
  PID:8572
- C:\Windows\System\JZWoUAC.exe
  C:\Windows\System\JZWoUAC.exe
  2⤵
  PID:8588
- C:\Windows\System\WikzwwV.exe
  C:\Windows\System\WikzwwV.exe
  2⤵
  PID:8604
- C:\Windows\System\uRpTtYg.exe
  C:\Windows\System\uRpTtYg.exe
  2⤵
  PID:8620
- C:\Windows\System\pXdtdLa.exe
  C:\Windows\System\pXdtdLa.exe
  2⤵
  PID:8636
- C:\Windows\System\UhNDMfm.exe
  C:\Windows\System\UhNDMfm.exe
  2⤵
  PID:8652
- C:\Windows\System\EHeOXMJ.exe
  C:\Windows\System\EHeOXMJ.exe
  2⤵
  PID:8668
- C:\Windows\System\bhYAEcL.exe
  C:\Windows\System\bhYAEcL.exe
  2⤵
  PID:8952
- C:\Windows\System\hTxKEOh.exe
  C:\Windows\System\hTxKEOh.exe
  2⤵
  PID:8968
- C:\Windows\System\EFwAsgO.exe
  C:\Windows\System\EFwAsgO.exe
  2⤵
  PID:8988
- C:\Windows\System\QxKpTIk.exe
  C:\Windows\System\QxKpTIk.exe
  2⤵
  PID:9004
- C:\Windows\System\riwbNRX.exe
  C:\Windows\System\riwbNRX.exe
  2⤵
  PID:9020
- C:\Windows\System\leBPqJI.exe
  C:\Windows\System\leBPqJI.exe
  2⤵
  PID:9040
- C:\Windows\System\NWRxAJk.exe
  C:\Windows\System\NWRxAJk.exe
  2⤵
  PID:9060
- C:\Windows\System\HhzXOgV.exe
  C:\Windows\System\HhzXOgV.exe
  2⤵
  PID:9080
- C:\Windows\System\QoGvsoP.exe
  C:\Windows\System\QoGvsoP.exe
  2⤵
  PID:9096
- C:\Windows\System\YBAReNt.exe
  C:\Windows\System\YBAReNt.exe
  2⤵
  PID:9112
- C:\Windows\System\eoytrIb.exe
  C:\Windows\System\eoytrIb.exe
  2⤵
  PID:9132
- C:\Windows\System\mbkiuAH.exe
  C:\Windows\System\mbkiuAH.exe
  2⤵
  PID:9148
- C:\Windows\System\epTiAmO.exe
  C:\Windows\System\epTiAmO.exe
  2⤵
  PID:9164
- C:\Windows\System\bNAxQIt.exe
  C:\Windows\System\bNAxQIt.exe
  2⤵
  PID:9180
- C:\Windows\System\JSubQaU.exe
  C:\Windows\System\JSubQaU.exe
  2⤵
  PID:9200
- C:\Windows\System\assuCjU.exe
  C:\Windows\System\assuCjU.exe
  2⤵
  PID:7508
- C:\Windows\System\iEoUOni.exe
  C:\Windows\System\iEoUOni.exe
  2⤵
  PID:8228
- C:\Windows\System\oWGKmgI.exe
  C:\Windows\System\oWGKmgI.exe
  2⤵
  PID:4592
- C:\Windows\System\IVvtOwn.exe
  C:\Windows\System\IVvtOwn.exe
  2⤵
  PID:8248
- C:\Windows\System\gKfOwbr.exe
  C:\Windows\System\gKfOwbr.exe
  2⤵
  PID:8532
- C:\Windows\System\MXrRqzl.exe
  C:\Windows\System\MXrRqzl.exe
  2⤵
  PID:8644
- C:\Windows\System\NxqOZsc.exe
  C:\Windows\System\NxqOZsc.exe
  2⤵
  PID:8564
- C:\Windows\System\kXOetRa.exe
  C:\Windows\System\kXOetRa.exe
  2⤵
  PID:8632
- C:\Windows\System\QpzzapP.exe
  C:\Windows\System\QpzzapP.exe
  2⤵
  PID:8716
- C:\Windows\System\xbbZvaC.exe
  C:\Windows\System\xbbZvaC.exe
  2⤵
  PID:8684
- C:\Windows\System\JNnEAyR.exe
  C:\Windows\System\JNnEAyR.exe
  2⤵
  PID:8692
- C:\Windows\System\IcyGriy.exe
  C:\Windows\System\IcyGriy.exe
  2⤵
  PID:8912
- C:\Windows\System\odVCiSE.exe
  C:\Windows\System\odVCiSE.exe
  2⤵
  PID:8720
- C:\Windows\System\BsFYxJZ.exe
  C:\Windows\System\BsFYxJZ.exe
  2⤵
  PID:8740
- C:\Windows\System\unoQwcw.exe
  C:\Windows\System\unoQwcw.exe
  2⤵
  PID:8756
- C:\Windows\System\cNxvzgQ.exe
  C:\Windows\System\cNxvzgQ.exe
  2⤵
  PID:8772
- C:\Windows\System\eupZqll.exe
  C:\Windows\System\eupZqll.exe
  2⤵
  PID:8796
- C:\Windows\System\ZoHROyV.exe
  C:\Windows\System\ZoHROyV.exe
  2⤵
  PID:8808
- C:\Windows\System\PQgHglw.exe
  C:\Windows\System\PQgHglw.exe
  2⤵
  PID:8832
- C:\Windows\System\lkrQkGa.exe
  C:\Windows\System\lkrQkGa.exe
  2⤵
  PID:8844
- C:\Windows\System\ksjDcCh.exe
  C:\Windows\System\ksjDcCh.exe
  2⤵
  PID:8868
- C:\Windows\System\oiICZyK.exe
  C:\Windows\System\oiICZyK.exe
  2⤵
  PID:8888
- C:\Windows\System\mtKvfXR.exe
  C:\Windows\System\mtKvfXR.exe
  2⤵
  PID:8900
- C:\Windows\System\YgVlhHB.exe
  C:\Windows\System\YgVlhHB.exe
  2⤵
  PID:8928
- C:\Windows\System\pHLdZOE.exe
  C:\Windows\System\pHLdZOE.exe
  2⤵
  PID:8960
- C:\Windows\System\BOyOKqW.exe
  C:\Windows\System\BOyOKqW.exe
  2⤵
  PID:8976
- C:\Windows\System\kquRvIG.exe
  C:\Windows\System\kquRvIG.exe
  2⤵
  PID:8980
- C:\Windows\System\aqEyrwm.exe
  C:\Windows\System\aqEyrwm.exe
  2⤵
  PID:9056
- C:\Windows\System\JMtFduz.exe
  C:\Windows\System\JMtFduz.exe
  2⤵
  PID:9124
- C:\Windows\System\YouBbVb.exe
  C:\Windows\System\YouBbVb.exe
  2⤵
  PID:9160
- C:\Windows\System\lSgqVRJ.exe
  C:\Windows\System\lSgqVRJ.exe
  2⤵
  PID:9032
- C:\Windows\System\zMwTlup.exe
  C:\Windows\System\zMwTlup.exe
  2⤵
  PID:9212
- C:\Windows\System\YITTUwT.exe
  C:\Windows\System\YITTUwT.exe
  2⤵
  PID:7424
- C:\Windows\System\RcmzdwP.exe
  C:\Windows\System\RcmzdwP.exe
  2⤵
  PID:8224
- C:\Windows\System\iThKuWc.exe
  C:\Windows\System\iThKuWc.exe
  2⤵
  PID:9176
- C:\Windows\System\MncVKcF.exe
  C:\Windows\System\MncVKcF.exe
  2⤵
  PID:8288
- C:\Windows\System\TnyCExk.exe
  C:\Windows\System\TnyCExk.exe
  2⤵
  PID:8280
- C:\Windows\System\DmTyyMm.exe
  C:\Windows\System\DmTyyMm.exe
  2⤵
  PID:7492
- C:\Windows\System\jopraME.exe
  C:\Windows\System\jopraME.exe
  2⤵
  PID:8352
- C:\Windows\System\SxsvrBS.exe
  C:\Windows\System\SxsvrBS.exe
  2⤵
  PID:8388
- C:\Windows\System\ePhShAI.exe
  C:\Windows\System\ePhShAI.exe
  2⤵
  PID:8372
- C:\Windows\System\PPcrVMA.exe
  C:\Windows\System\PPcrVMA.exe
  2⤵
  PID:8408
- C:\Windows\System\JYDkoRO.exe
  C:\Windows\System\JYDkoRO.exe
  2⤵
  PID:8444
- C:\Windows\System\vbJAZMb.exe
  C:\Windows\System\vbJAZMb.exe
  2⤵
  PID:8488
- C:\Windows\System\RdfRmhD.exe
  C:\Windows\System\RdfRmhD.exe
  2⤵
  PID:8520
- C:\Windows\System\FGlXIsE.exe
  C:\Windows\System\FGlXIsE.exe
  2⤵
  PID:8464
- C:\Windows\System\qQDNbPl.exe
  C:\Windows\System\qQDNbPl.exe
  2⤵
  PID:8628
- C:\Windows\System\ZZKzWBB.exe
  C:\Windows\System\ZZKzWBB.exe
  2⤵
  PID:8696
- C:\Windows\System\lwORYyn.exe
  C:\Windows\System\lwORYyn.exe
  2⤵
  PID:8768
- C:\Windows\System\UrSckQF.exe
  C:\Windows\System\UrSckQF.exe
  2⤵
  PID:8848
- C:\Windows\System\TIVpCFP.exe
  C:\Windows\System\TIVpCFP.exe
  2⤵
  PID:8580
- C:\Windows\System\GqyVgBI.exe
  C:\Windows\System\GqyVgBI.exe
  2⤵
  PID:8948
- C:\Windows\System\bRtYwpM.exe
  C:\Windows\System\bRtYwpM.exe
  2⤵
  PID:9048
- C:\Windows\System\GPurgnW.exe
  C:\Windows\System\GPurgnW.exe
  2⤵
  PID:9208
- C:\Windows\System\gsncYtI.exe
  C:\Windows\System\gsncYtI.exe
  2⤵
  PID:8816
- C:\Windows\System\umOaaJe.exe
  C:\Windows\System\umOaaJe.exe
  2⤵
  PID:8200
- C:\Windows\System\BGIVIQA.exe
  C:\Windows\System\BGIVIQA.exe
  2⤵
  PID:8860
- C:\Windows\System\eKYJuva.exe
  C:\Windows\System\eKYJuva.exe
  2⤵
  PID:8944
- C:\Windows\System\BKYNMCW.exe
  C:\Windows\System\BKYNMCW.exe
  2⤵
  PID:8852
- C:\Windows\System\hiTuPVJ.exe
  C:\Windows\System\hiTuPVJ.exe
  2⤵
  PID:8284
- C:\Windows\System\xntOPDh.exe
  C:\Windows\System\xntOPDh.exe
  2⤵
  PID:9104
- C:\Windows\System\xTeEurs.exe
  C:\Windows\System\xTeEurs.exe
  2⤵
  PID:9012
- C:\Windows\System\OKCPlVa.exe
  C:\Windows\System\OKCPlVa.exe
  2⤵
  PID:9088
- C:\Windows\System\ZOEgxoe.exe
  C:\Windows\System\ZOEgxoe.exe
  2⤵
  PID:8348
- C:\Windows\System\lZYvPGA.exe
  C:\Windows\System\lZYvPGA.exe
  2⤵
  PID:8320
- C:\Windows\System\ItFxWLQ.exe
  C:\Windows\System\ItFxWLQ.exe
  2⤵
  PID:8484
- C:\Windows\System\wmKdxyB.exe
  C:\Windows\System\wmKdxyB.exe
  2⤵
  PID:8432
- C:\Windows\System\oXuEgbz.exe
  C:\Windows\System\oXuEgbz.exe
  2⤵
  PID:8840
- C:\Windows\System\sbVhRqk.exe
  C:\Windows\System\sbVhRqk.exe
  2⤵
  PID:9128
- C:\Windows\System\KwKjKIY.exe
  C:\Windows\System\KwKjKIY.exe
  2⤵
  PID:8304
- C:\Windows\System\IieLGDR.exe
  C:\Windows\System\IieLGDR.exe
  2⤵
  PID:8316
- C:\Windows\System\tEaQBSX.exe
  C:\Windows\System\tEaQBSX.exe
  2⤵
  PID:9220
- C:\Windows\System\FvNLpiG.exe
  C:\Windows\System\FvNLpiG.exe
  2⤵
  PID:9236
- C:\Windows\System\cjzjOvF.exe
  C:\Windows\System\cjzjOvF.exe
  2⤵
  PID:9408
- C:\Windows\System\ATauphI.exe
  C:\Windows\System\ATauphI.exe
  2⤵
  PID:9424
- C:\Windows\System\OhCDeBB.exe
  C:\Windows\System\OhCDeBB.exe
  2⤵
  PID:9444
- C:\Windows\System\FkZFPdC.exe
  C:\Windows\System\FkZFPdC.exe
  2⤵
  PID:9460
- C:\Windows\System\ihgWnxt.exe
  C:\Windows\System\ihgWnxt.exe
  2⤵
  PID:9476
- C:\Windows\System\ROjhDYR.exe
  C:\Windows\System\ROjhDYR.exe
  2⤵
  PID:9492
- C:\Windows\System\gbiLukg.exe
  C:\Windows\System\gbiLukg.exe
  2⤵
  PID:9516
- C:\Windows\System\IBylNnZ.exe
  C:\Windows\System\IBylNnZ.exe
  2⤵
  PID:9532
- C:\Windows\System\hOogeUn.exe
  C:\Windows\System\hOogeUn.exe
  2⤵
  PID:9552
- C:\Windows\System\KoSkNJK.exe
  C:\Windows\System\KoSkNJK.exe
  2⤵
  PID:9572
- C:\Windows\System\BJIkQcc.exe
  C:\Windows\System\BJIkQcc.exe
  2⤵
  PID:9588
- C:\Windows\System\eWCaKxD.exe
  C:\Windows\System\eWCaKxD.exe
  2⤵
  PID:9612
- C:\Windows\System\foumZmD.exe
  C:\Windows\System\foumZmD.exe
  2⤵
  PID:9632
- C:\Windows\System\DjjyoQF.exe
  C:\Windows\System\DjjyoQF.exe
  2⤵
  PID:9648
- C:\Windows\System\anpURDa.exe
  C:\Windows\System\anpURDa.exe
  2⤵
  PID:9664
- C:\Windows\System\XgAmePT.exe
  C:\Windows\System\XgAmePT.exe
  2⤵
  PID:9680
- C:\Windows\System\AmFhAQb.exe
  C:\Windows\System\AmFhAQb.exe
  2⤵
  PID:9912
- C:\Windows\System\hQPklTU.exe
  C:\Windows\System\hQPklTU.exe
  2⤵
  PID:9928
- C:\Windows\System\KfHUNcr.exe
  C:\Windows\System\KfHUNcr.exe
  2⤵
  PID:9944
- C:\Windows\System\SPwikhx.exe
  C:\Windows\System\SPwikhx.exe
  2⤵
  PID:9960
- C:\Windows\System\NdHZDSM.exe
  C:\Windows\System\NdHZDSM.exe
  2⤵
  PID:9976
- C:\Windows\System\QVWdQxo.exe
  C:\Windows\System\QVWdQxo.exe
  2⤵
  PID:9992
- C:\Windows\System\OwqEGfY.exe
  C:\Windows\System\OwqEGfY.exe
  2⤵
  PID:10008
- C:\Windows\System\DvphbVR.exe
  C:\Windows\System\DvphbVR.exe
  2⤵
  PID:10024
- C:\Windows\System\OFyykOq.exe
  C:\Windows\System\OFyykOq.exe
  2⤵
  PID:10040
- C:\Windows\System\KrOLnAr.exe
  C:\Windows\System\KrOLnAr.exe
  2⤵
  PID:10056
- C:\Windows\System\zihDLEW.exe
  C:\Windows\System\zihDLEW.exe
  2⤵
  PID:10072
- C:\Windows\System\LCQAlXb.exe
  C:\Windows\System\LCQAlXb.exe
  2⤵
  PID:10092
- C:\Windows\System\McybDwR.exe
  C:\Windows\System\McybDwR.exe
  2⤵
  PID:10112
- C:\Windows\System\ERlzzVF.exe
  C:\Windows\System\ERlzzVF.exe
  2⤵
  PID:10128
- C:\Windows\System\MoeUWaf.exe
  C:\Windows\System\MoeUWaf.exe
  2⤵
  PID:10144
- C:\Windows\System\mVWJPHb.exe
  C:\Windows\System\mVWJPHb.exe
  2⤵
  PID:10172
- C:\Windows\System\GJOuJZO.exe
  C:\Windows\System\GJOuJZO.exe
  2⤵
  PID:10188
- C:\Windows\System\uonGFGZ.exe
  C:\Windows\System\uonGFGZ.exe
  2⤵
  PID:10204
- C:\Windows\System\tWFelWg.exe
  C:\Windows\System\tWFelWg.exe
  2⤵
  PID:10220
- C:\Windows\System\gyhaiQX.exe
  C:\Windows\System\gyhaiQX.exe
  2⤵
  PID:10236
- C:\Windows\System\bCKHBIj.exe
  C:\Windows\System\bCKHBIj.exe
  2⤵
  PID:8748
- C:\Windows\System\tFfIAWH.exe
  C:\Windows\System\tFfIAWH.exe
  2⤵
  PID:8884
- C:\Windows\System\FTqLWXe.exe
  C:\Windows\System\FTqLWXe.exe
  2⤵
  PID:8504
- C:\Windows\System\MdZGIfJ.exe
  C:\Windows\System\MdZGIfJ.exe
  2⤵
  PID:8600
- C:\Windows\System\bymCwYr.exe
  C:\Windows\System\bymCwYr.exe
  2⤵
  PID:8828
- C:\Windows\System\TAggtYL.exe
  C:\Windows\System\TAggtYL.exe
  2⤵
  PID:6696
- C:\Windows\System\BkJoEst.exe
  C:\Windows\System\BkJoEst.exe
  2⤵
  PID:9072
- C:\Windows\System\iHNnHye.exe
  C:\Windows\System\iHNnHye.exe
  2⤵
  PID:8920
- C:\Windows\System\QOMbsZM.exe
  C:\Windows\System\QOMbsZM.exe
  2⤵
  PID:8336
- C:\Windows\System\zWvqxss.exe
  C:\Windows\System\zWvqxss.exe
  2⤵
  PID:8784
- C:\Windows\System\OMJGmZJ.exe
  C:\Windows\System\OMJGmZJ.exe
  2⤵
  PID:9076
- C:\Windows\System\trvgdHs.exe
  C:\Windows\System\trvgdHs.exe
  2⤵
  PID:9260
- C:\Windows\System\eVFBGRO.exe
  C:\Windows\System\eVFBGRO.exe
  2⤵
  PID:9316
- C:\Windows\System\aJVAbMp.exe
  C:\Windows\System\aJVAbMp.exe
  2⤵
  PID:9344
- C:\Windows\System\BJjJHAc.exe
  C:\Windows\System\BJjJHAc.exe
  2⤵
  PID:9368
- C:\Windows\System\oxWxtOu.exe
  C:\Windows\System\oxWxtOu.exe
  2⤵
  PID:9328
- C:\Windows\System\jvNWldr.exe
  C:\Windows\System\jvNWldr.exe
  2⤵
  PID:9300
- C:\Windows\System\CnxXuIH.exe
  C:\Windows\System\CnxXuIH.exe
  2⤵
  PID:9380
- C:\Windows\System\DsqJWLT.exe
  C:\Windows\System\DsqJWLT.exe
  2⤵
  PID:9392
- C:\Windows\System\pXGxvTo.exe
  C:\Windows\System\pXGxvTo.exe
  2⤵
  PID:9436
- C:\Windows\System\LHwvonL.exe
  C:\Windows\System\LHwvonL.exe
  2⤵
  PID:9504
- C:\Windows\System\OxVcYNz.exe
  C:\Windows\System\OxVcYNz.exe
  2⤵
  PID:9544
- C:\Windows\System\RGKOEMc.exe
  C:\Windows\System\RGKOEMc.exe
  2⤵
  PID:9620
- C:\Windows\System\XMsrKWo.exe
  C:\Windows\System\XMsrKWo.exe
  2⤵
  PID:9660
- C:\Windows\System\IjJQwPJ.exe
  C:\Windows\System\IjJQwPJ.exe
  2⤵
  PID:9452
- C:\Windows\System\IPNJBGe.exe
  C:\Windows\System\IPNJBGe.exe
  2⤵
  PID:9696
- C:\Windows\System\JGanDwX.exe
  C:\Windows\System\JGanDwX.exe
  2⤵
  PID:9528
- C:\Windows\System\vadJfCA.exe
  C:\Windows\System\vadJfCA.exe
  2⤵
  PID:9640
- C:\Windows\System\fYZHgYx.exe
  C:\Windows\System\fYZHgYx.exe
  2⤵
  PID:9700
- C:\Windows\System\pJGUPQw.exe
  C:\Windows\System\pJGUPQw.exe
  2⤵
  PID:9708
- C:\Windows\System\JqzpjHQ.exe
  C:\Windows\System\JqzpjHQ.exe
  2⤵
  PID:9744
- C:\Windows\System\dFCkSDx.exe
  C:\Windows\System\dFCkSDx.exe
  2⤵
  PID:9760
- C:\Windows\System\JYTrqKH.exe
  C:\Windows\System\JYTrqKH.exe
  2⤵
  PID:9780
- C:\Windows\System\oOPYKSZ.exe
  C:\Windows\System\oOPYKSZ.exe
  2⤵
  PID:9724
- C:\Windows\System\IrHjXFC.exe
  C:\Windows\System\IrHjXFC.exe
  2⤵
  PID:9816
- C:\Windows\System\sJGbzCd.exe
  C:\Windows\System\sJGbzCd.exe
  2⤵
  PID:9820
- C:\Windows\System\ilgFChh.exe
  C:\Windows\System\ilgFChh.exe
  2⤵
  PID:9840
- C:\Windows\System\EIcxPVd.exe
  C:\Windows\System\EIcxPVd.exe
  2⤵
  PID:9868
- C:\Windows\System\DLzevVR.exe
  C:\Windows\System\DLzevVR.exe
  2⤵
  PID:9876
- C:\Windows\System\UqmhJdW.exe
  C:\Windows\System\UqmhJdW.exe
  2⤵
  PID:9884
- C:\Windows\System\dRESNqp.exe
  C:\Windows\System\dRESNqp.exe
  2⤵
  PID:9904
- C:\Windows\System\VmKnNgF.exe
  C:\Windows\System\VmKnNgF.exe
  2⤵
  PID:10064
- C:\Windows\System\wMNmDnE.exe
  C:\Windows\System\wMNmDnE.exe
  2⤵
  PID:10108
- C:\Windows\System\Bemcbfj.exe
  C:\Windows\System\Bemcbfj.exe
  2⤵
  PID:10184
- C:\Windows\System\ZXbKGlB.exe
  C:\Windows\System\ZXbKGlB.exe
  2⤵
  PID:8220
- C:\Windows\System\BdUfYjI.exe
  C:\Windows\System\BdUfYjI.exe
  2⤵
  PID:8788
- C:\Windows\System\qgAceqE.exe
  C:\Windows\System\qgAceqE.exe
  2⤵
  PID:10016
- C:\Windows\System\igHjVFl.exe
  C:\Windows\System\igHjVFl.exe
  2⤵
  PID:10120
- C:\Windows\System\EdocMMS.exe
  C:\Windows\System\EdocMMS.exe
  2⤵
  PID:10196
- C:\Windows\System\FpWRzgr.exe
  C:\Windows\System\FpWRzgr.exe
  2⤵
  PID:9288
- C:\Windows\System\scsBoIK.exe
  C:\Windows\System\scsBoIK.exe
  2⤵
  PID:9924
- C:\Windows\System\EfochSj.exe
  C:\Windows\System\EfochSj.exe
  2⤵
  PID:10020
- C:\Windows\System\TvIXeyl.exe
  C:\Windows\System\TvIXeyl.exe
  2⤵
  PID:8396
- C:\Windows\System\uhQXJvd.exe
  C:\Windows\System\uhQXJvd.exe
  2⤵
  PID:8664
- C:\Windows\System\rxsLvzm.exe
  C:\Windows\System\rxsLvzm.exe
  2⤵
  PID:8924
- C:\Windows\System\NYHVwdE.exe
  C:\Windows\System\NYHVwdE.exe
  2⤵
  PID:9364
- C:\Windows\System\dtdYtJz.exe
  C:\Windows\System\dtdYtJz.exe
  2⤵
  PID:9324
- C:\Windows\System\jjawalW.exe
  C:\Windows\System\jjawalW.exe
  2⤵
  PID:9320
- C:\Windows\System\OOcYiwq.exe
  C:\Windows\System\OOcYiwq.exe
  2⤵
  PID:9472
- C:\Windows\System\XkZhYJm.exe
  C:\Windows\System\XkZhYJm.exe
  2⤵
  PID:9420
- C:\Windows\System\WwdihsM.exe
  C:\Windows\System\WwdihsM.exe
  2⤵
  PID:1588
- C:\Windows\System\XODwkUT.exe
  C:\Windows\System\XODwkUT.exe
  2⤵
  PID:9512
- C:\Windows\System\RFfFkIN.exe
  C:\Windows\System\RFfFkIN.exe
  2⤵
  PID:9484
- C:\Windows\System\OTUHPzS.exe
  C:\Windows\System\OTUHPzS.exe
  2⤵
  PID:9608
- C:\Windows\System\MMDbntg.exe
  C:\Windows\System\MMDbntg.exe
  2⤵
  PID:9600
- C:\Windows\System\hzpHIrS.exe
  C:\Windows\System\hzpHIrS.exe
  2⤵
  PID:9728
- C:\Windows\System\IhLbcKd.exe
  C:\Windows\System\IhLbcKd.exe
  2⤵
  PID:9828
- C:\Windows\System\YfOxkqT.exe
  C:\Windows\System\YfOxkqT.exe
  2⤵
  PID:9800
- C:\Windows\System\rVFRDGF.exe
  C:\Windows\System\rVFRDGF.exe
  2⤵
  PID:9804
- C:\Windows\System\rfYaZVy.exe
  C:\Windows\System\rfYaZVy.exe
  2⤵
  PID:10216

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\CXTzLBD.exe

Filesize
1.9MB

MD5
ffb73483907fd1e5cd9be25d0e7e775a

SHA1
aa7a3012bdb5ad0deb9f76e205d8cd2b6da0a881

SHA256
f7ce65faf1c7e304872edc30558d03ebbb113e9427694fbb41a61a64055c8900

SHA512
4a8351c95fa71e4b353a90f2c49dcb65c8183513c2f645cf09f594c0574c2b06c53d1abe91c9c13ce31682b6498c8406347a41d7c9573ab1f0f02a630b62f1a4

Download Submit
C:\Windows\system\DFllFIM.exe

Filesize
1.9MB

MD5
4efbcbe5119d6f2f866180b09470e8f7

SHA1
8858ecf4ce040dda7a8ef57e91495c9ca58c9e65

SHA256
28030913d4e209ecf40178de777c64fe9aa4e7b164d9f529ac81bcaa5b04cd50

SHA512
3c6aba87d4283eb989c856091c2a577712da7ee62200d5ee98a96c6acda3f21267542246de19bda0c338f22a66ed9bd897860207655aff62c844b9892f494a58

Download Submit
C:\Windows\system\EblNVfG.exe

Filesize
1.9MB

MD5
f45d69afc78bfe0d1f1926a477d2c865

SHA1
f548882eaa185c3091721d595efc4ca2bf2c7ccf

SHA256
7f01261146882cf694fdf0caefdd949794249be7546e93e461554c3e95f73966

SHA512
58ffa51edf56d4e243529f65065ec6e2cc281c099a7c611a7cef8c85b6142a81ef5576ea06978bbd2ed6d089b70ea98ff4fb08e6715a8cbd00f4a6cc6e0b8cb6

Download Submit
C:\Windows\system\FLzDJFO.exe

Filesize
1.9MB

MD5
913ebc2f9dcf8f61dbd46f1aa047333e

SHA1
be74c3cfb036a9d405d9d94addfe7aa116278706

SHA256
fdc2ad9b5af0d834920fa8e28404da2d9a7f33e4b4792e5f532018cb78dda41d

SHA512
8499413f7f1a279593256dbe874e92e4fcc6252ade7e5251b9ab921547743bb5b9f0665565af441412a9f3f966c612bd1f4e4322236fcb2c20f7c3592176035a

Download Submit
C:\Windows\system\GQORoXo.exe

Filesize
1.9MB

MD5
667046772f4f1d19968332fc9e463f62

SHA1
009f6fa4deedf52403127e260de96bbf7dbcc654

SHA256
88fd545e1b8d88aaaa114e09db81e8a7f39a016b322fbd2fecc219d26898618d

SHA512
f9568d130f06f7d223ac80b863eb31ce1acbe31f912a7fe654a55a8ec6c128ba0335601527dd47a53d0b926779a4f4ab4e753a56ca67a6f3db16fe406900a70c

Download Submit
C:\Windows\system\HIfNGXn.exe

Filesize
1.9MB

MD5
f1afeee53a5f6b5999efdf7648c9a04f

SHA1
aed2c650aa10fd93c951d191715033b6fd9886ce

SHA256
644cdaa15600c5fd444c292c36c51aedfb5e6c0cbaddecdbc91dcd4b6a81044d

SHA512
37585dbbc0affef93727bc857393bea044f5b3df73e16975aeec44fe273ff436ed82cc32438c37ac9a9fa946dd86dd7b6954c3fc7f86242d4777eea32533ced0

Download Submit
C:\Windows\system\Ikltoyy.exe

Filesize
1.9MB

MD5
fc3e2eb95ba81533dbfe0bc5b7c984d4

SHA1
1020fd65049c26e8a854a8478d86406e4cc19add

SHA256
f45547ad1784918611e80cfc13856a02c656f170e74833b131054f0416a1b9b8

SHA512
9912385a7aeeefca9c2a9c0acc0475bda29692517d5dbeffebf1be3e92fd993102f6416c70228b768251a5d63343c919ce50db9f7d90b6d6717fa4abc4aacc22

Download Submit
C:\Windows\system\IsDnEjX.exe

Filesize
1.9MB

MD5
883edd2f5d42a2fe2aa6a80abff92552

SHA1
83866b6bc554260e6ca0b56f548f419db91d1db3

SHA256
e1d8edf84cc9ea8c7fae6f3f87490396f78769aab7df3bdb4d95e4688e9c1308

SHA512
f90d1d7ae3f4bbb0c941f7d7d2d7161a1c07d1197e72e78ddd1a7a4de44f88a52bdc25864b2f8b344a2bb479a917e1da5c17f24a2d8b4e5ce07267425deafa18

Download Submit
C:\Windows\system\KpqfJyV.exe

Filesize
1.9MB

MD5
0a549cb847158f4e3133689cfef6d56e

SHA1
2b0816f2dfa911606b68271e24431a8205326b9d

SHA256
a0c332163af586b9efeccb03fa5244d68589445fba42f945fdfdc887dd712834

SHA512
cd597d46653e00420c8502525a5c675b48f0b8c84a9f552702ee8564304544b88089ff6172b5a97cde264fbfbe788a6842b1314dc30810a36df65e9e644282d5

Download Submit
C:\Windows\system\MDbEGYc.exe

Filesize
1.9MB

MD5
03cc9fb613958316ee7924b8323d886e

SHA1
ef938bbe98eac2a8061832f677a1971b7f50a2d0

SHA256
ac632cc5445cc3332778ed40dfe206a07ee2caa5904be632aba5fe017805ffb7

SHA512
545cb5721cb2aa365c5cc87ec41ee7fc615e92eb9bb78f60c97b1bde7eda2bb3a77b311c249be8f7ccc9a85ebd82b0d9c76a1cbed7b73cd8fb94542a63fcee6d

Download Submit
C:\Windows\system\MfOTSNK.exe

Filesize
1.9MB

MD5
be257e97f5428f54db9d29deea420a15

SHA1
c5af494fbc456f03e1ab02970a00530c7b6606c6

SHA256
8ca3e3fdb791d0e098831172bcacc0d0564a2c4a8c2d5d483379a03c4da723c5

SHA512
6cc3f968ec8758cae4862a6020e9a5439fd2aa2ed4fe56479f92fb3fc871d81cb893780dc23b12b491c36379e1fbb113448996b942a36fc6fdef105c5b99cc52

Download Submit
C:\Windows\system\SMjCuBS.exe

Filesize
1.9MB

MD5
68bda01184fb82419171e26dd0b7f5de

SHA1
ee8aabe6f86bbdc0b166cafbf8d68ebf2fa36baf

SHA256
a5363f84b51882071cbe783535cb2f9729179187d672d8c38c61a807986e961a

SHA512
d812f82f616c36d60c1207b228ddd1546094321d3f9dba8e705f0aee0c0c6bd154df942b452dfd09d3a80cf961447d46f29ec0ff3c6384ec899f68bb08e73d9d

Download Submit
C:\Windows\system\TAHQNCE.exe

Filesize
1.9MB

MD5
2ad19b711a3b8c82c182b11195b36397

SHA1
3ae31bef5559bcc80a0da08771c1fbb88d631ec4

SHA256
7b1b91f143f1f998f458604f5828c6864702c182d450f603871574433254ce8c

SHA512
e760dcd871df688e9c9634f7dd6ec757164c14a22747bf63cf97c6853612bf1b3b0e2778704b4c6ac8e121a61b825801809d65b2b9f616c39801853826e6a090

Download Submit
C:\Windows\system\TnJyFZa.exe

Filesize
1.9MB

MD5
772b0b896ea1bbf5aaa9e99bc3978642

SHA1
18a64565bf3597d54c7ba65a3d02b49ff60e19c7

SHA256
29c9edd24f1b7cced5144edae042d69e52fb7dc63316c8bf70540676c6eb6adb

SHA512
98487a6a77e054cf82e6e2154d1dfb523d1212a3680ce5a924f18dad60733603d624f217b4e4d478e3ded8cde3a3a847e3569ce716a3e1998f8fd645dbc7f37b

Download Submit
C:\Windows\system\UVkgdTN.exe

Filesize
1.9MB

MD5
b6979f501504c1f578f80ab307183064

SHA1
7da6dd0ccfc1898cf79915b6ba2e889180f70f6d

SHA256
862aa58fe16dbf5e664a6c7b3c0fdc841b9088e8f2830e8bb0c0733208da5703

SHA512
212017ee688da633a7ce58bc3c30c62505cc39074b88141e9abad8cf658de1c09030ca740555833e50ae5a6e22a38987bbd58f642e7a60137f89b6b323df80c4

Download Submit
C:\Windows\system\VSMhFpW.exe

Filesize
1.9MB

MD5
bef1d0e0ae3302a6042284600213a78b

SHA1
e559c4e9931621728005bc107776227b43d98301

SHA256
e1f8c35d1ee16f4af284bdd784a6b78e65bae3c58e916f7a9b5143cb37919cb9

SHA512
b5941f3323ebed070b59fee676b693d1d70a9bab013f9987c2fbcbdc07fe03e6ab0398c54252fe85d1f9b2db24b946af67a7625357077a3289ccf0129230d54c

Download Submit
C:\Windows\system\XjlzWKj.exe

Filesize
1.9MB

MD5
a3364784b68f9a1a1f9442ec24b45755

SHA1
8fac5e6217559d5feeacb175883ba3dd2c58fdae

SHA256
04d5b833731e2d43b50f32abd47970965c18d65d5a5ccf062f9620ad52a282d3

SHA512
4829bebddb8aad94f32779a9981da0c607a90666ddc0890a69d2bd2569c7991b3dfab32653b64ebecdb8d8efd4d3a65092e2109f8937dc1664d0aaf6bc819e0a

Download Submit
C:\Windows\system\XzTalWi.exe

Filesize
1.9MB

MD5
1d6e2ae03b00d24cc85da8fcac36b935

SHA1
4c364c91db2c7abfe7df26d6c5242e28116b1885

SHA256
4aba41c10c5fd3454c5de24d9c29ac9fd8b91481fe566d90fb87744b839bf215

SHA512
49db744b7efff6f6c547b788e68ac121c954e01f2261197e322a3b5361df6a8927a1e81c76f75fa2e60cc0ff309dc661bad838207a1ed0b44d199f5bd3797800

Download Submit
C:\Windows\system\exhrAOs.exe

Filesize
1.9MB

MD5
ab8c294b31cfb1209a851b7410826097

SHA1
4516b8c8fd534ca61e7c2cf9b4ff8eddea6f9c1f

SHA256
15b05e3753f1e89d50d00a90591ad8176673f553a9df843119956e65b419e910

SHA512
cc4409cd88f079f77cac45c64e659059b2371d64958bbf5662feebfefa67f87d004898f0812ea21e37d20a4ced65cba085bfb565335b94589f4808fd132b9964

Download Submit
C:\Windows\system\fqfviNr.exe

Filesize
1.9MB

MD5
a4b4798e8a4feb9b20c5b17642222be8

SHA1
be42c114604ae3b0af659f9381c5a7bca97b5528

SHA256
afa114b5d5c1a64d4ba3e04fe9cd2f60b80ab059f759e91e8460a77eb1ba23c5

SHA512
2dba3fdf55e4e8ccb53157d844a1a22e0c5737505275bbd542966263c1233bccc4eebeada994e26c2fd0596b03c069bcd36964adc4c27ca84fe798e664f7f0d1

Download Submit
C:\Windows\system\oQqcdWq.exe

Filesize
1.9MB

MD5
4c6c9fc681e78f06c516f5b8e50613c4

SHA1
d4928189de2bcad9d2cfa63416ec7a31041eded8

SHA256
998c125e774d36ec19fa82f3535f3e3465d3bae7b331dd05415a52e1098a8209

SHA512
740ab84565cce3ae287559b9ddba2866516e3b3ef875ec4861c07b07775046f3cf53c5bbfdef884c1868847b38acbbd0822ee0c38ea8e83a6d5cd8daee8d7624

Download Submit
C:\Windows\system\sPfthhS.exe

Filesize
1.9MB

MD5
5b5f1a9c106ba09d09994af616c8be75

SHA1
317997d41f6c4af56fb855640f0f3ed165c26fcc

SHA256
2ad61580cdf70cfde28733bac6a30f3c0a069c0b55fad69363d3474a2ba2678f

SHA512
c967a9d3a0ae596ca7bb7a10de89643ea2620377c5ccf1ceaa25e523f9ef2e78140757ebd158a367464fcd680ac6352a56fbc8196922ce60229097aff9d4bb94

Download Submit
C:\Windows\system\tLVwvzD.exe

Filesize
1.9MB

MD5
dc70726c4f54a7d8b29e427e10699b03

SHA1
22ecab1334f1bce161b5053f06e5b502f486ce67

SHA256
a9f05c600b14fd17ed232f6764a22bd14ce6d2cf9de61da4101cc4232b5327fc

SHA512
1c31431d3c96c244b5255b6f25ec04a4c641d39bb9796bc969ccd1c66a2f736c5089071c3e41ea07537267f2d7e5997a66d9c1e99dc169faa2ed0ddff6ed6661

Download Submit
C:\Windows\system\twVaojd.exe

Filesize
1.9MB

MD5
32e6b50bf1b7ff04da2f0c92ada5cec5

SHA1
9c54c40f30c468ce09210a432e6b2f59d2784dab

SHA256
5d2d0f31650ce82ae1ec13bb222f74577a67e2e32e5995a9677b9160ca9fb996

SHA512
2d236a98cc46a4818f320bebdc4047df933530e6251da0bb517fa0e5aa406d3ee1e4c5a264a62bc5ed19851ea562bbe8882a3ea392c435e08ef0129190f3c018

Download Submit
C:\Windows\system\wiWetkZ.exe

Filesize
1.9MB

MD5
45774a37edfb03b87f7354f2e5c1271c

SHA1
2206cd8ee510fe3c9a09860b514c1b5ffa95e342

SHA256
31968b3dc35d70b48a8e1497e8fe3bf3a185fcb62e2c4bf2c415948f329b2856

SHA512
a562cdc3b1833b37ca6c589b5dbaf0949e49d66547edbe61d9a56ac6ed13734613f50b9998de5c44e5bdbbf55c4d53044068ad9b9e779ff98d4c14a91b912996

Download Submit
C:\Windows\system\wilRQGC.exe

Filesize
1.9MB

MD5
1b5c135e992c61e562eed7c7e61040ef

SHA1
eefe92a181725461fb751b1e40b162283a15faf6

SHA256
cd40d9606c20b39f450265a83e33dfe01dd90c46d8318246fc1fcaadf9de0f60

SHA512
b8b7b6161ca5632503a1ce5e848d716a7bfc2eca5eeb6f0f369ecf1a4dc42dab5f189b4c7ab56e42fff6c30f77c4ccd37f4fb35bd5f3dd952f802d7d11fe3a0b

Download Submit
C:\Windows\system\xogzKIg.exe

Filesize
1.9MB

MD5
5fb4e0016096a6e74e187acd12b52fc7

SHA1
b967bb10c2a2f5310e35b3b7d1c3a6d4174884af

SHA256
c4ff7a673f1dae7953bc0313ed13e3d27381608d94ee97842732ce6f6e99f124

SHA512
7d156ba3e2cb401a9df3ab07dedfa62128ff42f93e3caa6e2218c4f5047f1220deb5a22a0b9adae599b40a37eaf27b13605297941ea73c6585d892accb0ff08f

Download Submit
C:\Windows\system\yyAOhUA.exe

Filesize
1.9MB

MD5
98f0d42aa59030a3a86c2b043a9dadcc

SHA1
b0e36ae55a227e8427d07af314ee5ed0879b7bb9

SHA256
09da746fd3483c6257c79949e27dd8d2050d9a4363b4a3c19e42482671695d8d

SHA512
40311fb06ccce6cc62979a4baadd485c5e6659b6e81f68867a7d5facc6fe5e1200be091d94f826e203703b8b4a8dd18a5b0d137b12a3c44f804f8491cf7d1518

Download Submit
C:\Windows\system\zoIySvK.exe

Filesize
1.9MB

MD5
99f97a67ba8ff8e255a235330e0f3a71

SHA1
9879be289fa21e3bd8fa03f4699a15b7f109483c

SHA256
0529864f694dbc2ccc77e4812459d6e4caec49f64112e2b1ef2e32c9bc4e3b33

SHA512
fcdedc09fd5e244cd3cdaeffb3f12967fa6b9fccbfbc04e59694c58bd6ba1c5fe35af74ef5aa9bc67595b335b0dc2df50f6d6327578246d45ec1555341e03d75

Download Submit
\Windows\system\VuKWpjW.exe

Filesize
1.9MB

MD5
866c8e07968ab19905bb29c5af217126

SHA1
fdae996e6affca90b1c3865c726cdcb0b91cebf1

SHA256
6202c7106fe6591861d7bda512e3afb1e86267337c8473ad7b4f784d57b65352

SHA512
2e13c032df150b3091170bbb4b9296fd95701eaa98156a08b2c025fe205b2916070de182c9dd0cf41cbe97aa36d248dc8ed04392c82c42d01fd0e63deea1fc36

Download Submit
\Windows\system\btdEBOM.exe

Filesize
1.9MB

MD5
434c33879173e45828c5c43b6d365cf5

SHA1
8b93570e5d4bc9c8226187e108f77ab24de7e496

SHA256
8fdd30ffdf6f807a7ca095975afd371db87ce74b6ca01f436ceb86628363400f

SHA512
03129b1085ff8bc405cd17ad1c103d503fc69a797bfd1c925bfbd2b78359fb743e59f55a5e5ab90e601eadd9ffbd30c539fb4f3da040e256266cf97c27fbc42c

Download Submit
\Windows\system\zTjHqIj.exe

Filesize
1.9MB

MD5
8148c0a275257f387d8e545fd733c4ba

SHA1
869725d0b17db89e73041e098ba914def9b6962e

SHA256
02add3b16939d437c8be008389caf1f305f31dbb4fe089b9eecd44911fa4fe60

SHA512
1ebadf83dd3e9436465f4e7a9014db2edea0ad3ba19dd69eb75c283aa3e8d2d0d0d5b094b55c191e0555cab90e032288440572e5d7623d7a12748ae01951b67c

Download Submit
memory/448-182-0x000000013FFE0000-0x00000001403CD000-memory.dmp

Filesize
3.9MB

Download
memory/772-96-0x000000013F640000-0x000000013FA2D000-memory.dmp

Filesize
3.9MB

Download
memory/868-134-0x000000013FCD0000-0x00000001400BD000-memory.dmp

Filesize
3.9MB

Download
memory/1100-177-0x000000013F0C0000-0x000000013F4AD000-memory.dmp

Filesize
3.9MB

Download
memory/1144-116-0x000000013FE60000-0x000000014024D000-memory.dmp

Filesize
3.9MB

Download
memory/1356-140-0x000000013F1C0000-0x000000013F5AD000-memory.dmp

Filesize
3.9MB

Download
memory/1512-164-0x000000013F840000-0x000000013FC2D000-memory.dmp

Filesize
3.9MB

Download
memory/1700-92-0x000000013F940000-0x000000013FD2D000-memory.dmp

Filesize
3.9MB

Download
memory/1708-194-0x000000013F7E0000-0x000000013FBCD000-memory.dmp

Filesize
3.9MB

Download
memory/1712-0-0x000000013FE50000-0x000000014023D000-memory.dmp

Filesize
3.9MB

Download
memory/1712-1-0x00000000001F0000-0x0000000000200000-memory.dmp

Filesize
64KB

Download
memory/1760-172-0x000007FEF5980000-0x000007FEF631D000-memory.dmp

Filesize
9.6MB

Download
memory/1760-765-0x000007FEF5980000-0x000007FEF631D000-memory.dmp

Filesize
9.6MB

Download
memory/1760-24-0x000007FEF5C3E000-0x000007FEF5C3F000-memory.dmp

Filesize
4KB

Download
memory/1760-64-0x000000001B600000-0x000000001B8E2000-memory.dmp

Filesize
2.9MB

Download
memory/1760-71-0x0000000002050000-0x0000000002058000-memory.dmp

Filesize
32KB

Download
memory/1832-120-0x000000013FB00000-0x000000013FEED000-memory.dmp

Filesize
3.9MB

Download
memory/1928-107-0x000000013F380000-0x000000013F76D000-memory.dmp

Filesize
3.9MB

Download
memory/2092-80-0x000000013F8D0000-0x000000013FCBD000-memory.dmp

Filesize
3.9MB

Download
memory/2320-152-0x000000013F740000-0x000000013FB2D000-memory.dmp

Filesize
3.9MB

Download
memory/2328-145-0x000000013F300000-0x000000013F6ED000-memory.dmp

Filesize
3.9MB

Download
memory/2436-88-0x000000013FC10000-0x000000013FFFD000-memory.dmp

Filesize
3.9MB

Download
memory/2468-34-0x000000013FAB0000-0x000000013FE9D000-memory.dmp

Filesize
3.9MB

Download
memory/2484-56-0x000000013F360000-0x000000013F74D000-memory.dmp

Filesize
3.9MB

Download
memory/2500-94-0x000000013F620000-0x000000013FA0D000-memory.dmp

Filesize
3.9MB

Download
memory/2556-48-0x000000013F410000-0x000000013F7FD000-memory.dmp

Filesize
3.9MB

Download
memory/2572-23-0x000000013F5A0000-0x000000013F98D000-memory.dmp

Filesize
3.9MB

Download
memory/2604-40-0x000000013F3A0000-0x000000013F78D000-memory.dmp

Filesize
3.9MB

Download
memory/2620-7-0x000000013FF60000-0x000000014034D000-memory.dmp

Filesize
3.9MB

Download
memory/2632-85-0x000000013F100000-0x000000013F4ED000-memory.dmp

Filesize
3.9MB

Download
memory/2668-84-0x000000013F180000-0x000000013F56D000-memory.dmp

Filesize
3.9MB

Download
memory/2748-109-0x000000013F0D0000-0x000000013F4BD000-memory.dmp

Filesize
3.9MB

Download
memory/2760-157-0x000000013F480000-0x000000013F86D000-memory.dmp

Filesize
3.9MB

Download
memory/2864-90-0x000000013FE20000-0x000000014020D000-memory.dmp

Filesize
3.9MB

Download
memory/2960-189-0x000000013F7B0000-0x000000013FB9D000-memory.dmp

Filesize
3.9MB

Download
memory/2964-168-0x000000013FA60000-0x000000013FE4D000-memory.dmp

Filesize
3.9MB

Download
memory/3008-13-0x000000013F600000-0x000000013F9ED000-memory.dmp

Filesize
3.9MB

Download