xmrig | 267d2847efe40211e90927f27ef9c4f21d8603189d4f7a5b5629ce982c6678fb

Analysis

max time kernel
149s
max time network
148s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
16/05/2024, 16:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

e482b8365d6da9989b571535a7d6d5f0_NeikiAnalytics.exe
Size

1.5MB
MD5

e482b8365d6da9989b571535a7d6d5f0
SHA1

09f029c7bda3b27500847138291378308364ef62
SHA256

267d2847efe40211e90927f27ef9c4f21d8603189d4f7a5b5629ce982c6678fb
SHA512

edb51dff043dfb2f8ab9528916befa120f7b2110e58701decad5157553a50f866dd22a3b08a9407b3f90b34b46f9a8a7f1386a8f8429c35c116bdf7e84a50eae
SSDEEP

24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvj7NaVNqd9OeSZXCdzvd4/iooIXsLL0z:Lz071uv4BPMkHC0IaSEzQR4iRLEz

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 21 IoCs

miner

resource	yara_rule
behavioral1/memory/2000-307-0x000000013F590000-0x000000013F982000-memory.dmp	xmrig
behavioral1/memory/2024-266-0x000000013FA20000-0x000000013FE12000-memory.dmp	xmrig
behavioral1/memory/2504-368-0x000000013F900000-0x000000013FCF2000-memory.dmp	xmrig
behavioral1/memory/2440-366-0x000000013F320000-0x000000013F712000-memory.dmp	xmrig
behavioral1/memory/2608-364-0x000000013FA70000-0x000000013FE62000-memory.dmp	xmrig
behavioral1/memory/3048-362-0x000000013F980000-0x000000013FD72000-memory.dmp	xmrig
behavioral1/memory/1684-360-0x000000013FD90000-0x0000000140182000-memory.dmp	xmrig
behavioral1/memory/1060-358-0x000000013F200000-0x000000013F5F2000-memory.dmp	xmrig
behavioral1/memory/2696-356-0x000000013F2D0000-0x000000013F6C2000-memory.dmp	xmrig
behavioral1/memory/2548-354-0x000000013F870000-0x000000013FC62000-memory.dmp	xmrig
behavioral1/memory/2652-352-0x000000013F7E0000-0x000000013FBD2000-memory.dmp	xmrig
behavioral1/memory/2024-5436-0x000000013FA20000-0x000000013FE12000-memory.dmp	xmrig
behavioral1/memory/2548-5430-0x000000013F870000-0x000000013FC62000-memory.dmp	xmrig
behavioral1/memory/2696-5450-0x000000013F2D0000-0x000000013F6C2000-memory.dmp	xmrig
behavioral1/memory/1060-5456-0x000000013F200000-0x000000013F5F2000-memory.dmp	xmrig
behavioral1/memory/1684-5457-0x000000013FD90000-0x0000000140182000-memory.dmp	xmrig
behavioral1/memory/3048-5475-0x000000013F980000-0x000000013FD72000-memory.dmp	xmrig
behavioral1/memory/2608-5617-0x000000013FA70000-0x000000013FE62000-memory.dmp	xmrig
behavioral1/memory/2652-5628-0x000000013F7E0000-0x000000013FBD2000-memory.dmp	xmrig
behavioral1/memory/2440-5641-0x000000013F320000-0x000000013F712000-memory.dmp	xmrig
behavioral1/memory/2364-8370-0x000000013F6E0000-0x000000013FAD2000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
1048	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
2024	YsVHcGT.exe
2000	HaoFBCe.exe
2652	ZmrVExF.exe
2548	lSPjghE.exe
2696	OKhKysH.exe
1060	uxIGnQW.exe
1684	oQXmMyA.exe
3048	VzaVStk.exe
2608	pSwfxAV.exe
2440	qOxNYPm.exe
2504	yYoEUAG.exe
1280	KDnZAMy.exe
2960	ymopjav.exe
2980	PsTVpwt.exe
636	zUnvfGU.exe
1976	ijCPktg.exe
2112	VZGvwGw.exe
1636	ezPDNWd.exe
2032	dVbHTya.exe
2812	GFvvvcd.exe
2624	kgERbiv.exe
2744	NmqcrsE.exe
2752	eVhwRuC.exe
2956	UWDDyzD.exe
1992	TUnZKBa.exe
1388	cyVxYwG.exe
848	uMVbWms.exe
2188	vjlMAki.exe
2892	aHktuMe.exe
556	wcbNzTh.exe
644	gAUJRPe.exe
1476	cBtvtXr.exe
816	opjPKhQ.exe
2408	ohvLLPl.exe
448	qFBaTOy.exe
1748	AJOlZYf.exe
1780	oJfhavM.exe
976	PTfdCEV.exe
1796	czlEnkU.exe
1324	Exrivws.exe
2028	clDvwvf.exe
2904	mLvvOWs.exe
888	GGaMtpL.exe
2080	uETaorI.exe
1508	KmigdBf.exe
2356	uZXNjcr.exe
2184	oKxrsSZ.exe
1044	SZTlfJn.exe
1276	uBUKVjC.exe
2668	SvVDWiZ.exe
2476	wscaPsn.exe
2576	KvfhJaV.exe
2452	cSUwoMd.exe
2492	cmCXslb.exe
2020	EyhAqav.exe
2836	yKNCVXi.exe
2004	JnGpZcC.exe
756	DRdXQmK.exe
588	CEvcCEU.exe
1860	iSChywq.exe
1644	fowrDVK.exe
1228	yvFDEqd.exe
2132	asqcTtc.exe
1920	UoTHjbi.exe

Loads dropped DLL 64 IoCs

pid	Process
2364	e482b8365d6da9989b571535a7d6d5f0_NeikiAnalytics.exe
2364	e482b8365d6da9989b571535a7d6d5f0_NeikiAnalytics.exe
2364	e482b8365d6da9989b571535a7d6d5f0_NeikiAnalytics.exe
2364	e482b8365d6da9989b571535a7d6d5f0_NeikiAnalytics.exe
2364	e482b8365d6da9989b571535a7d6d5f0_NeikiAnalytics.exe
2364	e482b8365d6da9989b571535a7d6d5f0_NeikiAnalytics.exe
2364	e482b8365d6da9989b571535a7d6d5f0_NeikiAnalytics.exe
2364	e482b8365d6da9989b571535a7d6d5f0_NeikiAnalytics.exe
2364	e482b8365d6da9989b571535a7d6d5f0_NeikiAnalytics.exe
2364	e482b8365d6da9989b571535a7d6d5f0_NeikiAnalytics.exe
2364	e482b8365d6da9989b571535a7d6d5f0_NeikiAnalytics.exe
2364	e482b8365d6da9989b571535a7d6d5f0_NeikiAnalytics.exe
2364	e482b8365d6da9989b571535a7d6d5f0_NeikiAnalytics.exe
2364	e482b8365d6da9989b571535a7d6d5f0_NeikiAnalytics.exe
2364	e482b8365d6da9989b571535a7d6d5f0_NeikiAnalytics.exe
2364	e482b8365d6da9989b571535a7d6d5f0_NeikiAnalytics.exe
2364	e482b8365d6da9989b571535a7d6d5f0_NeikiAnalytics.exe
2364	e482b8365d6da9989b571535a7d6d5f0_NeikiAnalytics.exe
2364	e482b8365d6da9989b571535a7d6d5f0_NeikiAnalytics.exe
2364	e482b8365d6da9989b571535a7d6d5f0_NeikiAnalytics.exe
2364	e482b8365d6da9989b571535a7d6d5f0_NeikiAnalytics.exe
2364	e482b8365d6da9989b571535a7d6d5f0_NeikiAnalytics.exe
2364	e482b8365d6da9989b571535a7d6d5f0_NeikiAnalytics.exe
2364	e482b8365d6da9989b571535a7d6d5f0_NeikiAnalytics.exe
2364	e482b8365d6da9989b571535a7d6d5f0_NeikiAnalytics.exe
2364	e482b8365d6da9989b571535a7d6d5f0_NeikiAnalytics.exe
2364	e482b8365d6da9989b571535a7d6d5f0_NeikiAnalytics.exe
2364	e482b8365d6da9989b571535a7d6d5f0_NeikiAnalytics.exe
2364	e482b8365d6da9989b571535a7d6d5f0_NeikiAnalytics.exe
2364	e482b8365d6da9989b571535a7d6d5f0_NeikiAnalytics.exe
2364	e482b8365d6da9989b571535a7d6d5f0_NeikiAnalytics.exe
2364	e482b8365d6da9989b571535a7d6d5f0_NeikiAnalytics.exe
2364	e482b8365d6da9989b571535a7d6d5f0_NeikiAnalytics.exe
2364	e482b8365d6da9989b571535a7d6d5f0_NeikiAnalytics.exe
2364	e482b8365d6da9989b571535a7d6d5f0_NeikiAnalytics.exe
2364	e482b8365d6da9989b571535a7d6d5f0_NeikiAnalytics.exe
2364	e482b8365d6da9989b571535a7d6d5f0_NeikiAnalytics.exe
2364	e482b8365d6da9989b571535a7d6d5f0_NeikiAnalytics.exe
2364	e482b8365d6da9989b571535a7d6d5f0_NeikiAnalytics.exe
2364	e482b8365d6da9989b571535a7d6d5f0_NeikiAnalytics.exe
2364	e482b8365d6da9989b571535a7d6d5f0_NeikiAnalytics.exe
2364	e482b8365d6da9989b571535a7d6d5f0_NeikiAnalytics.exe
2364	e482b8365d6da9989b571535a7d6d5f0_NeikiAnalytics.exe
2364	e482b8365d6da9989b571535a7d6d5f0_NeikiAnalytics.exe
2364	e482b8365d6da9989b571535a7d6d5f0_NeikiAnalytics.exe
2364	e482b8365d6da9989b571535a7d6d5f0_NeikiAnalytics.exe
2364	e482b8365d6da9989b571535a7d6d5f0_NeikiAnalytics.exe
2364	e482b8365d6da9989b571535a7d6d5f0_NeikiAnalytics.exe
2364	e482b8365d6da9989b571535a7d6d5f0_NeikiAnalytics.exe
2364	e482b8365d6da9989b571535a7d6d5f0_NeikiAnalytics.exe
2364	e482b8365d6da9989b571535a7d6d5f0_NeikiAnalytics.exe
2364	e482b8365d6da9989b571535a7d6d5f0_NeikiAnalytics.exe
2364	e482b8365d6da9989b571535a7d6d5f0_NeikiAnalytics.exe
2364	e482b8365d6da9989b571535a7d6d5f0_NeikiAnalytics.exe
2364	e482b8365d6da9989b571535a7d6d5f0_NeikiAnalytics.exe
2364	e482b8365d6da9989b571535a7d6d5f0_NeikiAnalytics.exe
2364	e482b8365d6da9989b571535a7d6d5f0_NeikiAnalytics.exe
2364	e482b8365d6da9989b571535a7d6d5f0_NeikiAnalytics.exe
2364	e482b8365d6da9989b571535a7d6d5f0_NeikiAnalytics.exe
2364	e482b8365d6da9989b571535a7d6d5f0_NeikiAnalytics.exe
2364	e482b8365d6da9989b571535a7d6d5f0_NeikiAnalytics.exe
2364	e482b8365d6da9989b571535a7d6d5f0_NeikiAnalytics.exe
2364	e482b8365d6da9989b571535a7d6d5f0_NeikiAnalytics.exe
2364	e482b8365d6da9989b571535a7d6d5f0_NeikiAnalytics.exe

UPX packed file 55 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2364-0-0x000000013F6E0000-0x000000013FAD2000-memory.dmp	upx
behavioral1/files/0x000c000000014228-6.dat	upx
behavioral1/files/0x003600000001443b-15.dat	upx
behavioral1/files/0x000e0000000054ab-20.dat	upx
behavioral1/files/0x00080000000146fc-26.dat	upx
behavioral1/files/0x0007000000014712-31.dat	upx
behavioral1/files/0x000700000001471a-35.dat	upx
behavioral1/files/0x000a000000014826-41.dat	upx
behavioral1/files/0x0006000000015c9e-47.dat	upx
behavioral1/files/0x000900000001487f-45.dat	upx
behavioral1/files/0x0006000000015cff-75.dat	upx
behavioral1/files/0x0006000000015d42-87.dat	upx
behavioral1/files/0x0006000000015d56-97.dat	upx
behavioral1/files/0x0006000000015d6b-107.dat	upx
behavioral1/files/0x0006000000015d5f-105.dat	upx
behavioral1/files/0x0006000000015d93-129.dat	upx
behavioral1/files/0x0006000000015e32-143.dat	upx
behavioral1/files/0x0006000000015fe5-151.dat	upx
behavioral1/files/0x0006000000015f65-147.dat	upx
behavioral1/files/0x000600000001630a-161.dat	upx
behavioral1/files/0x000600000001610f-153.dat	upx
behavioral1/files/0x00060000000164aa-166.dat	upx
behavioral1/files/0x000600000001621e-159.dat	upx
behavioral1/files/0x00360000000144e8-127.dat	upx
behavioral1/files/0x0006000000015ecc-139.dat	upx
behavioral1/files/0x0006000000015d87-123.dat	upx
behavioral1/files/0x0006000000015d7f-115.dat	upx
behavioral1/files/0x0006000000015d4e-96.dat	upx
behavioral1/files/0x0006000000015d20-85.dat	upx
behavioral1/files/0x0006000000015ccd-73.dat	upx
behavioral1/files/0x0006000000015ce3-70.dat	upx
behavioral1/files/0x0006000000015cd9-68.dat	upx
behavioral1/files/0x0006000000015cb6-60.dat	upx
behavioral1/files/0x0006000000015cae-53.dat	upx
behavioral1/memory/2000-307-0x000000013F590000-0x000000013F982000-memory.dmp	upx
behavioral1/memory/2024-266-0x000000013FA20000-0x000000013FE12000-memory.dmp	upx
behavioral1/memory/2504-368-0x000000013F900000-0x000000013FCF2000-memory.dmp	upx
behavioral1/memory/2440-366-0x000000013F320000-0x000000013F712000-memory.dmp	upx
behavioral1/memory/2608-364-0x000000013FA70000-0x000000013FE62000-memory.dmp	upx
behavioral1/memory/3048-362-0x000000013F980000-0x000000013FD72000-memory.dmp	upx
behavioral1/memory/1684-360-0x000000013FD90000-0x0000000140182000-memory.dmp	upx
behavioral1/memory/1060-358-0x000000013F200000-0x000000013F5F2000-memory.dmp	upx
behavioral1/memory/2696-356-0x000000013F2D0000-0x000000013F6C2000-memory.dmp	upx
behavioral1/memory/2548-354-0x000000013F870000-0x000000013FC62000-memory.dmp	upx
behavioral1/memory/2652-352-0x000000013F7E0000-0x000000013FBD2000-memory.dmp	upx
behavioral1/memory/2024-5436-0x000000013FA20000-0x000000013FE12000-memory.dmp	upx
behavioral1/memory/2548-5430-0x000000013F870000-0x000000013FC62000-memory.dmp	upx
behavioral1/memory/2696-5450-0x000000013F2D0000-0x000000013F6C2000-memory.dmp	upx
behavioral1/memory/1060-5456-0x000000013F200000-0x000000013F5F2000-memory.dmp	upx
behavioral1/memory/1684-5457-0x000000013FD90000-0x0000000140182000-memory.dmp	upx
behavioral1/memory/3048-5475-0x000000013F980000-0x000000013FD72000-memory.dmp	upx
behavioral1/memory/2608-5617-0x000000013FA70000-0x000000013FE62000-memory.dmp	upx
behavioral1/memory/2652-5628-0x000000013F7E0000-0x000000013FBD2000-memory.dmp	upx
behavioral1/memory/2440-5641-0x000000013F320000-0x000000013F712000-memory.dmp	upx
behavioral1/memory/2364-8370-0x000000013F6E0000-0x000000013FAD2000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\gjjvQJC.exe	e482b8365d6da9989b571535a7d6d5f0_NeikiAnalytics.exe
File created	C:\Windows\System\NBcwVGi.exe	e482b8365d6da9989b571535a7d6d5f0_NeikiAnalytics.exe
File created	C:\Windows\System\OKGqoiI.exe	e482b8365d6da9989b571535a7d6d5f0_NeikiAnalytics.exe
File created	C:\Windows\System\DNlInIX.exe	e482b8365d6da9989b571535a7d6d5f0_NeikiAnalytics.exe
File created	C:\Windows\System\JsomHTl.exe	e482b8365d6da9989b571535a7d6d5f0_NeikiAnalytics.exe
File created	C:\Windows\System\XCwlRRy.exe	e482b8365d6da9989b571535a7d6d5f0_NeikiAnalytics.exe
File created	C:\Windows\System\erRebGD.exe	e482b8365d6da9989b571535a7d6d5f0_NeikiAnalytics.exe
File created	C:\Windows\System\LOCyOOn.exe	e482b8365d6da9989b571535a7d6d5f0_NeikiAnalytics.exe
File created	C:\Windows\System\CUMRurd.exe	e482b8365d6da9989b571535a7d6d5f0_NeikiAnalytics.exe
File created	C:\Windows\System\qwNKTVC.exe	e482b8365d6da9989b571535a7d6d5f0_NeikiAnalytics.exe
File created	C:\Windows\System\DjssaAD.exe	e482b8365d6da9989b571535a7d6d5f0_NeikiAnalytics.exe
File created	C:\Windows\System\uSXFKTG.exe	e482b8365d6da9989b571535a7d6d5f0_NeikiAnalytics.exe
File created	C:\Windows\System\zZkZxSU.exe	e482b8365d6da9989b571535a7d6d5f0_NeikiAnalytics.exe
File created	C:\Windows\System\KZckZuD.exe	e482b8365d6da9989b571535a7d6d5f0_NeikiAnalytics.exe
File created	C:\Windows\System\HiudgZn.exe	e482b8365d6da9989b571535a7d6d5f0_NeikiAnalytics.exe
File created	C:\Windows\System\oMzAshX.exe	e482b8365d6da9989b571535a7d6d5f0_NeikiAnalytics.exe
File created	C:\Windows\System\WlYAxsD.exe	e482b8365d6da9989b571535a7d6d5f0_NeikiAnalytics.exe
File created	C:\Windows\System\IVBwPoI.exe	e482b8365d6da9989b571535a7d6d5f0_NeikiAnalytics.exe
File created	C:\Windows\System\yFfPKXU.exe	e482b8365d6da9989b571535a7d6d5f0_NeikiAnalytics.exe
File created	C:\Windows\System\guKQXWf.exe	e482b8365d6da9989b571535a7d6d5f0_NeikiAnalytics.exe
File created	C:\Windows\System\HBuGBot.exe	e482b8365d6da9989b571535a7d6d5f0_NeikiAnalytics.exe
File created	C:\Windows\System\ppJdfsG.exe	e482b8365d6da9989b571535a7d6d5f0_NeikiAnalytics.exe
File created	C:\Windows\System\laYnzvu.exe	e482b8365d6da9989b571535a7d6d5f0_NeikiAnalytics.exe
File created	C:\Windows\System\dwByuDV.exe	e482b8365d6da9989b571535a7d6d5f0_NeikiAnalytics.exe
File created	C:\Windows\System\BsrBraK.exe	e482b8365d6da9989b571535a7d6d5f0_NeikiAnalytics.exe
File created	C:\Windows\System\AuWXYpc.exe	e482b8365d6da9989b571535a7d6d5f0_NeikiAnalytics.exe
File created	C:\Windows\System\FRsGoUA.exe	e482b8365d6da9989b571535a7d6d5f0_NeikiAnalytics.exe
File created	C:\Windows\System\OFGyUfX.exe	e482b8365d6da9989b571535a7d6d5f0_NeikiAnalytics.exe
File created	C:\Windows\System\vNrTEVt.exe	e482b8365d6da9989b571535a7d6d5f0_NeikiAnalytics.exe
File created	C:\Windows\System\DerFsdi.exe	e482b8365d6da9989b571535a7d6d5f0_NeikiAnalytics.exe
File created	C:\Windows\System\KjeNjbb.exe	e482b8365d6da9989b571535a7d6d5f0_NeikiAnalytics.exe
File created	C:\Windows\System\JqZTdhd.exe	e482b8365d6da9989b571535a7d6d5f0_NeikiAnalytics.exe
File created	C:\Windows\System\joNhbkN.exe	e482b8365d6da9989b571535a7d6d5f0_NeikiAnalytics.exe
File created	C:\Windows\System\AkWnEHl.exe	e482b8365d6da9989b571535a7d6d5f0_NeikiAnalytics.exe
File created	C:\Windows\System\hMNoqhO.exe	e482b8365d6da9989b571535a7d6d5f0_NeikiAnalytics.exe
File created	C:\Windows\System\whxMuaG.exe	e482b8365d6da9989b571535a7d6d5f0_NeikiAnalytics.exe
File created	C:\Windows\System\RYsGALd.exe	e482b8365d6da9989b571535a7d6d5f0_NeikiAnalytics.exe
File created	C:\Windows\System\buXpKSh.exe	e482b8365d6da9989b571535a7d6d5f0_NeikiAnalytics.exe
File created	C:\Windows\System\VocipjP.exe	e482b8365d6da9989b571535a7d6d5f0_NeikiAnalytics.exe
File created	C:\Windows\System\WZCAjKK.exe	e482b8365d6da9989b571535a7d6d5f0_NeikiAnalytics.exe
File created	C:\Windows\System\ekKNDep.exe	e482b8365d6da9989b571535a7d6d5f0_NeikiAnalytics.exe
File created	C:\Windows\System\OjFGawe.exe	e482b8365d6da9989b571535a7d6d5f0_NeikiAnalytics.exe
File created	C:\Windows\System\qdzYeoT.exe	e482b8365d6da9989b571535a7d6d5f0_NeikiAnalytics.exe
File created	C:\Windows\System\xuQuMqS.exe	e482b8365d6da9989b571535a7d6d5f0_NeikiAnalytics.exe
File created	C:\Windows\System\YmxpwtS.exe	e482b8365d6da9989b571535a7d6d5f0_NeikiAnalytics.exe
File created	C:\Windows\System\muOKjmK.exe	e482b8365d6da9989b571535a7d6d5f0_NeikiAnalytics.exe
File created	C:\Windows\System\GybaJxU.exe	e482b8365d6da9989b571535a7d6d5f0_NeikiAnalytics.exe
File created	C:\Windows\System\OSzIZpC.exe	e482b8365d6da9989b571535a7d6d5f0_NeikiAnalytics.exe
File created	C:\Windows\System\OVYZANF.exe	e482b8365d6da9989b571535a7d6d5f0_NeikiAnalytics.exe
File created	C:\Windows\System\WOICylo.exe	e482b8365d6da9989b571535a7d6d5f0_NeikiAnalytics.exe
File created	C:\Windows\System\eEgiNQK.exe	e482b8365d6da9989b571535a7d6d5f0_NeikiAnalytics.exe
File created	C:\Windows\System\ZQnTivo.exe	e482b8365d6da9989b571535a7d6d5f0_NeikiAnalytics.exe
File created	C:\Windows\System\fvaIoys.exe	e482b8365d6da9989b571535a7d6d5f0_NeikiAnalytics.exe
File created	C:\Windows\System\slmUtod.exe	e482b8365d6da9989b571535a7d6d5f0_NeikiAnalytics.exe
File created	C:\Windows\System\qkMzlMg.exe	e482b8365d6da9989b571535a7d6d5f0_NeikiAnalytics.exe
File created	C:\Windows\System\zcJIJOx.exe	e482b8365d6da9989b571535a7d6d5f0_NeikiAnalytics.exe
File created	C:\Windows\System\ywWOohq.exe	e482b8365d6da9989b571535a7d6d5f0_NeikiAnalytics.exe
File created	C:\Windows\System\YzvzUTd.exe	e482b8365d6da9989b571535a7d6d5f0_NeikiAnalytics.exe
File created	C:\Windows\System\rGITOOb.exe	e482b8365d6da9989b571535a7d6d5f0_NeikiAnalytics.exe
File created	C:\Windows\System\etYsUoO.exe	e482b8365d6da9989b571535a7d6d5f0_NeikiAnalytics.exe
File created	C:\Windows\System\ACJtlwa.exe	e482b8365d6da9989b571535a7d6d5f0_NeikiAnalytics.exe
File created	C:\Windows\System\zRLrwTF.exe	e482b8365d6da9989b571535a7d6d5f0_NeikiAnalytics.exe
File created	C:\Windows\System\wusYeix.exe	e482b8365d6da9989b571535a7d6d5f0_NeikiAnalytics.exe
File created	C:\Windows\System\sIfFzQb.exe	e482b8365d6da9989b571535a7d6d5f0_NeikiAnalytics.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1048	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2364	e482b8365d6da9989b571535a7d6d5f0_NeikiAnalytics.exe
Token: SeDebugPrivilege	1048	powershell.exe
Token: SeLockMemoryPrivilege	2364	e482b8365d6da9989b571535a7d6d5f0_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2364 wrote to memory of 1048	2364	e482b8365d6da9989b571535a7d6d5f0_NeikiAnalytics.exe	29
PID 2364 wrote to memory of 1048	2364	e482b8365d6da9989b571535a7d6d5f0_NeikiAnalytics.exe	29
PID 2364 wrote to memory of 1048	2364	e482b8365d6da9989b571535a7d6d5f0_NeikiAnalytics.exe	29
PID 2364 wrote to memory of 2024	2364	e482b8365d6da9989b571535a7d6d5f0_NeikiAnalytics.exe	30
PID 2364 wrote to memory of 2024	2364	e482b8365d6da9989b571535a7d6d5f0_NeikiAnalytics.exe	30
PID 2364 wrote to memory of 2024	2364	e482b8365d6da9989b571535a7d6d5f0_NeikiAnalytics.exe	30
PID 2364 wrote to memory of 2000	2364	e482b8365d6da9989b571535a7d6d5f0_NeikiAnalytics.exe	31
PID 2364 wrote to memory of 2000	2364	e482b8365d6da9989b571535a7d6d5f0_NeikiAnalytics.exe	31
PID 2364 wrote to memory of 2000	2364	e482b8365d6da9989b571535a7d6d5f0_NeikiAnalytics.exe	31
PID 2364 wrote to memory of 2652	2364	e482b8365d6da9989b571535a7d6d5f0_NeikiAnalytics.exe	32
PID 2364 wrote to memory of 2652	2364	e482b8365d6da9989b571535a7d6d5f0_NeikiAnalytics.exe	32
PID 2364 wrote to memory of 2652	2364	e482b8365d6da9989b571535a7d6d5f0_NeikiAnalytics.exe	32
PID 2364 wrote to memory of 2548	2364	e482b8365d6da9989b571535a7d6d5f0_NeikiAnalytics.exe	33
PID 2364 wrote to memory of 2548	2364	e482b8365d6da9989b571535a7d6d5f0_NeikiAnalytics.exe	33
PID 2364 wrote to memory of 2548	2364	e482b8365d6da9989b571535a7d6d5f0_NeikiAnalytics.exe	33
PID 2364 wrote to memory of 2696	2364	e482b8365d6da9989b571535a7d6d5f0_NeikiAnalytics.exe	34
PID 2364 wrote to memory of 2696	2364	e482b8365d6da9989b571535a7d6d5f0_NeikiAnalytics.exe	34
PID 2364 wrote to memory of 2696	2364	e482b8365d6da9989b571535a7d6d5f0_NeikiAnalytics.exe	34
PID 2364 wrote to memory of 1060	2364	e482b8365d6da9989b571535a7d6d5f0_NeikiAnalytics.exe	35
PID 2364 wrote to memory of 1060	2364	e482b8365d6da9989b571535a7d6d5f0_NeikiAnalytics.exe	35
PID 2364 wrote to memory of 1060	2364	e482b8365d6da9989b571535a7d6d5f0_NeikiAnalytics.exe	35
PID 2364 wrote to memory of 1684	2364	e482b8365d6da9989b571535a7d6d5f0_NeikiAnalytics.exe	36
PID 2364 wrote to memory of 1684	2364	e482b8365d6da9989b571535a7d6d5f0_NeikiAnalytics.exe	36
PID 2364 wrote to memory of 1684	2364	e482b8365d6da9989b571535a7d6d5f0_NeikiAnalytics.exe	36
PID 2364 wrote to memory of 3048	2364	e482b8365d6da9989b571535a7d6d5f0_NeikiAnalytics.exe	37
PID 2364 wrote to memory of 3048	2364	e482b8365d6da9989b571535a7d6d5f0_NeikiAnalytics.exe	37
PID 2364 wrote to memory of 3048	2364	e482b8365d6da9989b571535a7d6d5f0_NeikiAnalytics.exe	37
PID 2364 wrote to memory of 2608	2364	e482b8365d6da9989b571535a7d6d5f0_NeikiAnalytics.exe	38
PID 2364 wrote to memory of 2608	2364	e482b8365d6da9989b571535a7d6d5f0_NeikiAnalytics.exe	38
PID 2364 wrote to memory of 2608	2364	e482b8365d6da9989b571535a7d6d5f0_NeikiAnalytics.exe	38
PID 2364 wrote to memory of 2440	2364	e482b8365d6da9989b571535a7d6d5f0_NeikiAnalytics.exe	39
PID 2364 wrote to memory of 2440	2364	e482b8365d6da9989b571535a7d6d5f0_NeikiAnalytics.exe	39
PID 2364 wrote to memory of 2440	2364	e482b8365d6da9989b571535a7d6d5f0_NeikiAnalytics.exe	39
PID 2364 wrote to memory of 2504	2364	e482b8365d6da9989b571535a7d6d5f0_NeikiAnalytics.exe	40
PID 2364 wrote to memory of 2504	2364	e482b8365d6da9989b571535a7d6d5f0_NeikiAnalytics.exe	40
PID 2364 wrote to memory of 2504	2364	e482b8365d6da9989b571535a7d6d5f0_NeikiAnalytics.exe	40
PID 2364 wrote to memory of 2960	2364	e482b8365d6da9989b571535a7d6d5f0_NeikiAnalytics.exe	41
PID 2364 wrote to memory of 2960	2364	e482b8365d6da9989b571535a7d6d5f0_NeikiAnalytics.exe	41
PID 2364 wrote to memory of 2960	2364	e482b8365d6da9989b571535a7d6d5f0_NeikiAnalytics.exe	41
PID 2364 wrote to memory of 1280	2364	e482b8365d6da9989b571535a7d6d5f0_NeikiAnalytics.exe	42
PID 2364 wrote to memory of 1280	2364	e482b8365d6da9989b571535a7d6d5f0_NeikiAnalytics.exe	42
PID 2364 wrote to memory of 1280	2364	e482b8365d6da9989b571535a7d6d5f0_NeikiAnalytics.exe	42
PID 2364 wrote to memory of 636	2364	e482b8365d6da9989b571535a7d6d5f0_NeikiAnalytics.exe	43
PID 2364 wrote to memory of 636	2364	e482b8365d6da9989b571535a7d6d5f0_NeikiAnalytics.exe	43
PID 2364 wrote to memory of 636	2364	e482b8365d6da9989b571535a7d6d5f0_NeikiAnalytics.exe	43
PID 2364 wrote to memory of 2980	2364	e482b8365d6da9989b571535a7d6d5f0_NeikiAnalytics.exe	44
PID 2364 wrote to memory of 2980	2364	e482b8365d6da9989b571535a7d6d5f0_NeikiAnalytics.exe	44
PID 2364 wrote to memory of 2980	2364	e482b8365d6da9989b571535a7d6d5f0_NeikiAnalytics.exe	44
PID 2364 wrote to memory of 1976	2364	e482b8365d6da9989b571535a7d6d5f0_NeikiAnalytics.exe	45
PID 2364 wrote to memory of 1976	2364	e482b8365d6da9989b571535a7d6d5f0_NeikiAnalytics.exe	45
PID 2364 wrote to memory of 1976	2364	e482b8365d6da9989b571535a7d6d5f0_NeikiAnalytics.exe	45
PID 2364 wrote to memory of 2112	2364	e482b8365d6da9989b571535a7d6d5f0_NeikiAnalytics.exe	46
PID 2364 wrote to memory of 2112	2364	e482b8365d6da9989b571535a7d6d5f0_NeikiAnalytics.exe	46
PID 2364 wrote to memory of 2112	2364	e482b8365d6da9989b571535a7d6d5f0_NeikiAnalytics.exe	46
PID 2364 wrote to memory of 1636	2364	e482b8365d6da9989b571535a7d6d5f0_NeikiAnalytics.exe	47
PID 2364 wrote to memory of 1636	2364	e482b8365d6da9989b571535a7d6d5f0_NeikiAnalytics.exe	47
PID 2364 wrote to memory of 1636	2364	e482b8365d6da9989b571535a7d6d5f0_NeikiAnalytics.exe	47
PID 2364 wrote to memory of 2032	2364	e482b8365d6da9989b571535a7d6d5f0_NeikiAnalytics.exe	48
PID 2364 wrote to memory of 2032	2364	e482b8365d6da9989b571535a7d6d5f0_NeikiAnalytics.exe	48
PID 2364 wrote to memory of 2032	2364	e482b8365d6da9989b571535a7d6d5f0_NeikiAnalytics.exe	48
PID 2364 wrote to memory of 2812	2364	e482b8365d6da9989b571535a7d6d5f0_NeikiAnalytics.exe	49
PID 2364 wrote to memory of 2812	2364	e482b8365d6da9989b571535a7d6d5f0_NeikiAnalytics.exe	49
PID 2364 wrote to memory of 2812	2364	e482b8365d6da9989b571535a7d6d5f0_NeikiAnalytics.exe	49
PID 2364 wrote to memory of 2624	2364	e482b8365d6da9989b571535a7d6d5f0_NeikiAnalytics.exe	50

C:\Users\Admin\AppData\Local\Temp\e482b8365d6da9989b571535a7d6d5f0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\e482b8365d6da9989b571535a7d6d5f0_NeikiAnalytics.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2364
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1048
- C:\Windows\System\YsVHcGT.exe
  C:\Windows\System\YsVHcGT.exe
  2⤵
  - Executes dropped EXE
  PID:2024
- C:\Windows\System\HaoFBCe.exe
  C:\Windows\System\HaoFBCe.exe
  2⤵
  - Executes dropped EXE
  PID:2000
- C:\Windows\System\ZmrVExF.exe
  C:\Windows\System\ZmrVExF.exe
  2⤵
  - Executes dropped EXE
  PID:2652
- C:\Windows\System\lSPjghE.exe
  C:\Windows\System\lSPjghE.exe
  2⤵
  - Executes dropped EXE
  PID:2548
- C:\Windows\System\OKhKysH.exe
  C:\Windows\System\OKhKysH.exe
  2⤵
  - Executes dropped EXE
  PID:2696
- C:\Windows\System\uxIGnQW.exe
  C:\Windows\System\uxIGnQW.exe
  2⤵
  - Executes dropped EXE
  PID:1060
- C:\Windows\System\oQXmMyA.exe
  C:\Windows\System\oQXmMyA.exe
  2⤵
  - Executes dropped EXE
  PID:1684
- C:\Windows\System\VzaVStk.exe
  C:\Windows\System\VzaVStk.exe
  2⤵
  - Executes dropped EXE
  PID:3048
- C:\Windows\System\pSwfxAV.exe
  C:\Windows\System\pSwfxAV.exe
  2⤵
  - Executes dropped EXE
  PID:2608
- C:\Windows\System\qOxNYPm.exe
  C:\Windows\System\qOxNYPm.exe
  2⤵
  - Executes dropped EXE
  PID:2440
- C:\Windows\System\yYoEUAG.exe
  C:\Windows\System\yYoEUAG.exe
  2⤵
  - Executes dropped EXE
  PID:2504
- C:\Windows\System\ymopjav.exe
  C:\Windows\System\ymopjav.exe
  2⤵
  - Executes dropped EXE
  PID:2960
- C:\Windows\System\KDnZAMy.exe
  C:\Windows\System\KDnZAMy.exe
  2⤵
  - Executes dropped EXE
  PID:1280
- C:\Windows\System\zUnvfGU.exe
  C:\Windows\System\zUnvfGU.exe
  2⤵
  - Executes dropped EXE
  PID:636
- C:\Windows\System\PsTVpwt.exe
  C:\Windows\System\PsTVpwt.exe
  2⤵
  - Executes dropped EXE
  PID:2980
- C:\Windows\System\ijCPktg.exe
  C:\Windows\System\ijCPktg.exe
  2⤵
  - Executes dropped EXE
  PID:1976
- C:\Windows\System\VZGvwGw.exe
  C:\Windows\System\VZGvwGw.exe
  2⤵
  - Executes dropped EXE
  PID:2112
- C:\Windows\System\ezPDNWd.exe
  C:\Windows\System\ezPDNWd.exe
  2⤵
  - Executes dropped EXE
  PID:1636
- C:\Windows\System\dVbHTya.exe
  C:\Windows\System\dVbHTya.exe
  2⤵
  - Executes dropped EXE
  PID:2032
- C:\Windows\System\GFvvvcd.exe
  C:\Windows\System\GFvvvcd.exe
  2⤵
  - Executes dropped EXE
  PID:2812
- C:\Windows\System\kgERbiv.exe
  C:\Windows\System\kgERbiv.exe
  2⤵
  - Executes dropped EXE
  PID:2624
- C:\Windows\System\NmqcrsE.exe
  C:\Windows\System\NmqcrsE.exe
  2⤵
  - Executes dropped EXE
  PID:2744
- C:\Windows\System\eVhwRuC.exe
  C:\Windows\System\eVhwRuC.exe
  2⤵
  - Executes dropped EXE
  PID:2752
- C:\Windows\System\UWDDyzD.exe
  C:\Windows\System\UWDDyzD.exe
  2⤵
  - Executes dropped EXE
  PID:2956
- C:\Windows\System\TUnZKBa.exe
  C:\Windows\System\TUnZKBa.exe
  2⤵
  - Executes dropped EXE
  PID:1992
- C:\Windows\System\uMVbWms.exe
  C:\Windows\System\uMVbWms.exe
  2⤵
  - Executes dropped EXE
  PID:848
- C:\Windows\System\cyVxYwG.exe
  C:\Windows\System\cyVxYwG.exe
  2⤵
  - Executes dropped EXE
  PID:1388
- C:\Windows\System\vjlMAki.exe
  C:\Windows\System\vjlMAki.exe
  2⤵
  - Executes dropped EXE
  PID:2188
- C:\Windows\System\aHktuMe.exe
  C:\Windows\System\aHktuMe.exe
  2⤵
  - Executes dropped EXE
  PID:2892
- C:\Windows\System\JnGpZcC.exe
  C:\Windows\System\JnGpZcC.exe
  2⤵
  - Executes dropped EXE
  PID:2004
- C:\Windows\System\wcbNzTh.exe
  C:\Windows\System\wcbNzTh.exe
  2⤵
  - Executes dropped EXE
  PID:556
- C:\Windows\System\DRdXQmK.exe
  C:\Windows\System\DRdXQmK.exe
  2⤵
  - Executes dropped EXE
  PID:756
- C:\Windows\System\gAUJRPe.exe
  C:\Windows\System\gAUJRPe.exe
  2⤵
  - Executes dropped EXE
  PID:644
- C:\Windows\System\CEvcCEU.exe
  C:\Windows\System\CEvcCEU.exe
  2⤵
  - Executes dropped EXE
  PID:588
- C:\Windows\System\cBtvtXr.exe
  C:\Windows\System\cBtvtXr.exe
  2⤵
  - Executes dropped EXE
  PID:1476
- C:\Windows\System\iSChywq.exe
  C:\Windows\System\iSChywq.exe
  2⤵
  - Executes dropped EXE
  PID:1860
- C:\Windows\System\opjPKhQ.exe
  C:\Windows\System\opjPKhQ.exe
  2⤵
  - Executes dropped EXE
  PID:816
- C:\Windows\System\fowrDVK.exe
  C:\Windows\System\fowrDVK.exe
  2⤵
  - Executes dropped EXE
  PID:1644
- C:\Windows\System\ohvLLPl.exe
  C:\Windows\System\ohvLLPl.exe
  2⤵
  - Executes dropped EXE
  PID:2408
- C:\Windows\System\yvFDEqd.exe
  C:\Windows\System\yvFDEqd.exe
  2⤵
  - Executes dropped EXE
  PID:1228
- C:\Windows\System\qFBaTOy.exe
  C:\Windows\System\qFBaTOy.exe
  2⤵
  - Executes dropped EXE
  PID:448
- C:\Windows\System\asqcTtc.exe
  C:\Windows\System\asqcTtc.exe
  2⤵
  - Executes dropped EXE
  PID:2132
- C:\Windows\System\AJOlZYf.exe
  C:\Windows\System\AJOlZYf.exe
  2⤵
  - Executes dropped EXE
  PID:1748
- C:\Windows\System\UoTHjbi.exe
  C:\Windows\System\UoTHjbi.exe
  2⤵
  - Executes dropped EXE
  PID:1920
- C:\Windows\System\oJfhavM.exe
  C:\Windows\System\oJfhavM.exe
  2⤵
  - Executes dropped EXE
  PID:1780
- C:\Windows\System\NdgpIeh.exe
  C:\Windows\System\NdgpIeh.exe
  2⤵
  PID:1772
- C:\Windows\System\PTfdCEV.exe
  C:\Windows\System\PTfdCEV.exe
  2⤵
  - Executes dropped EXE
  PID:976
- C:\Windows\System\mmPAXSZ.exe
  C:\Windows\System\mmPAXSZ.exe
  2⤵
  PID:1624
- C:\Windows\System\czlEnkU.exe
  C:\Windows\System\czlEnkU.exe
  2⤵
  - Executes dropped EXE
  PID:1796
- C:\Windows\System\gxgWfDp.exe
  C:\Windows\System\gxgWfDp.exe
  2⤵
  PID:308
- C:\Windows\System\Exrivws.exe
  C:\Windows\System\Exrivws.exe
  2⤵
  - Executes dropped EXE
  PID:1324
- C:\Windows\System\DlfBZVG.exe
  C:\Windows\System\DlfBZVG.exe
  2⤵
  PID:916
- C:\Windows\System\clDvwvf.exe
  C:\Windows\System\clDvwvf.exe
  2⤵
  - Executes dropped EXE
  PID:2028
- C:\Windows\System\Joefuvx.exe
  C:\Windows\System\Joefuvx.exe
  2⤵
  PID:776
- C:\Windows\System\mLvvOWs.exe
  C:\Windows\System\mLvvOWs.exe
  2⤵
  - Executes dropped EXE
  PID:2904
- C:\Windows\System\jzrMSrn.exe
  C:\Windows\System\jzrMSrn.exe
  2⤵
  PID:2520
- C:\Windows\System\GGaMtpL.exe
  C:\Windows\System\GGaMtpL.exe
  2⤵
  - Executes dropped EXE
  PID:888
- C:\Windows\System\vjaZdID.exe
  C:\Windows\System\vjaZdID.exe
  2⤵
  PID:2044
- C:\Windows\System\uETaorI.exe
  C:\Windows\System\uETaorI.exe
  2⤵
  - Executes dropped EXE
  PID:2080
- C:\Windows\System\vLiXVbh.exe
  C:\Windows\System\vLiXVbh.exe
  2⤵
  PID:2272
- C:\Windows\System\KmigdBf.exe
  C:\Windows\System\KmigdBf.exe
  2⤵
  - Executes dropped EXE
  PID:1508
- C:\Windows\System\XtjppfI.exe
  C:\Windows\System\XtjppfI.exe
  2⤵
  PID:2928
- C:\Windows\System\uZXNjcr.exe
  C:\Windows\System\uZXNjcr.exe
  2⤵
  - Executes dropped EXE
  PID:2356
- C:\Windows\System\QbqCILZ.exe
  C:\Windows\System\QbqCILZ.exe
  2⤵
  PID:2400
- C:\Windows\System\oKxrsSZ.exe
  C:\Windows\System\oKxrsSZ.exe
  2⤵
  - Executes dropped EXE
  PID:2184
- C:\Windows\System\TcivihI.exe
  C:\Windows\System\TcivihI.exe
  2⤵
  PID:1604
- C:\Windows\System\SZTlfJn.exe
  C:\Windows\System\SZTlfJn.exe
  2⤵
  - Executes dropped EXE
  PID:1044
- C:\Windows\System\RkDCKtA.exe
  C:\Windows\System\RkDCKtA.exe
  2⤵
  PID:1584
- C:\Windows\System\uBUKVjC.exe
  C:\Windows\System\uBUKVjC.exe
  2⤵
  - Executes dropped EXE
  PID:1276
- C:\Windows\System\bLabVdR.exe
  C:\Windows\System\bLabVdR.exe
  2⤵
  PID:2644
- C:\Windows\System\SvVDWiZ.exe
  C:\Windows\System\SvVDWiZ.exe
  2⤵
  - Executes dropped EXE
  PID:2668
- C:\Windows\System\SjSLRlL.exe
  C:\Windows\System\SjSLRlL.exe
  2⤵
  PID:2756
- C:\Windows\System\wscaPsn.exe
  C:\Windows\System\wscaPsn.exe
  2⤵
  - Executes dropped EXE
  PID:2476
- C:\Windows\System\tiATEwZ.exe
  C:\Windows\System\tiATEwZ.exe
  2⤵
  PID:2692
- C:\Windows\System\KvfhJaV.exe
  C:\Windows\System\KvfhJaV.exe
  2⤵
  - Executes dropped EXE
  PID:2576
- C:\Windows\System\FCqEgFv.exe
  C:\Windows\System\FCqEgFv.exe
  2⤵
  PID:2968
- C:\Windows\System\cSUwoMd.exe
  C:\Windows\System\cSUwoMd.exe
  2⤵
  - Executes dropped EXE
  PID:2452
- C:\Windows\System\UJbVAhC.exe
  C:\Windows\System\UJbVAhC.exe
  2⤵
  PID:2484
- C:\Windows\System\cmCXslb.exe
  C:\Windows\System\cmCXslb.exe
  2⤵
  - Executes dropped EXE
  PID:2492
- C:\Windows\System\swYTfaB.exe
  C:\Windows\System\swYTfaB.exe
  2⤵
  PID:2728
- C:\Windows\System\EyhAqav.exe
  C:\Windows\System\EyhAqav.exe
  2⤵
  - Executes dropped EXE
  PID:2020
- C:\Windows\System\NEmWXVW.exe
  C:\Windows\System\NEmWXVW.exe
  2⤵
  PID:2540
- C:\Windows\System\yKNCVXi.exe
  C:\Windows\System\yKNCVXi.exe
  2⤵
  - Executes dropped EXE
  PID:2836
- C:\Windows\System\Rsacaac.exe
  C:\Windows\System\Rsacaac.exe
  2⤵
  PID:2684
- C:\Windows\System\aefhOpt.exe
  C:\Windows\System\aefhOpt.exe
  2⤵
  PID:768
- C:\Windows\System\fvaIoys.exe
  C:\Windows\System\fvaIoys.exe
  2⤵
  PID:404
- C:\Windows\System\SFDSDGM.exe
  C:\Windows\System\SFDSDGM.exe
  2⤵
  PID:2496
- C:\Windows\System\fqAFHPp.exe
  C:\Windows\System\fqAFHPp.exe
  2⤵
  PID:2388
- C:\Windows\System\LhmuYFz.exe
  C:\Windows\System\LhmuYFz.exe
  2⤵
  PID:1696
- C:\Windows\System\FYdPvvj.exe
  C:\Windows\System\FYdPvvj.exe
  2⤵
  PID:2704
- C:\Windows\System\HCyTeiC.exe
  C:\Windows\System\HCyTeiC.exe
  2⤵
  PID:1872
- C:\Windows\System\nOmlwZo.exe
  C:\Windows\System\nOmlwZo.exe
  2⤵
  PID:1408
- C:\Windows\System\OxSJzoR.exe
  C:\Windows\System\OxSJzoR.exe
  2⤵
  PID:1912
- C:\Windows\System\GshMeUm.exe
  C:\Windows\System\GshMeUm.exe
  2⤵
  PID:1776
- C:\Windows\System\wNQchXA.exe
  C:\Windows\System\wNQchXA.exe
  2⤵
  PID:1088
- C:\Windows\System\eCKvsKm.exe
  C:\Windows\System\eCKvsKm.exe
  2⤵
  PID:2412
- C:\Windows\System\CusIQhY.exe
  C:\Windows\System\CusIQhY.exe
  2⤵
  PID:2940
- C:\Windows\System\WDVSjub.exe
  C:\Windows\System\WDVSjub.exe
  2⤵
  PID:2212
- C:\Windows\System\VRduwNe.exe
  C:\Windows\System\VRduwNe.exe
  2⤵
  PID:2884
- C:\Windows\System\sLpfotu.exe
  C:\Windows\System\sLpfotu.exe
  2⤵
  PID:268
- C:\Windows\System\pMXMPoC.exe
  C:\Windows\System\pMXMPoC.exe
  2⤵
  PID:2584
- C:\Windows\System\OPNCVgY.exe
  C:\Windows\System\OPNCVgY.exe
  2⤵
  PID:2840
- C:\Windows\System\zzyJyiT.exe
  C:\Windows\System\zzyJyiT.exe
  2⤵
  PID:2860
- C:\Windows\System\CMSEQtV.exe
  C:\Windows\System\CMSEQtV.exe
  2⤵
  PID:2168
- C:\Windows\System\yZaurZW.exe
  C:\Windows\System\yZaurZW.exe
  2⤵
  PID:988
- C:\Windows\System\bEnrlqe.exe
  C:\Windows\System\bEnrlqe.exe
  2⤵
  PID:2480
- C:\Windows\System\ZnYTYiN.exe
  C:\Windows\System\ZnYTYiN.exe
  2⤵
  PID:3012
- C:\Windows\System\EZqwNik.exe
  C:\Windows\System\EZqwNik.exe
  2⤵
  PID:1792
- C:\Windows\System\xZIIadZ.exe
  C:\Windows\System\xZIIadZ.exe
  2⤵
  PID:1864
- C:\Windows\System\GBptOgh.exe
  C:\Windows\System\GBptOgh.exe
  2⤵
  PID:1788
- C:\Windows\System\CxxuZeI.exe
  C:\Windows\System\CxxuZeI.exe
  2⤵
  PID:1556
- C:\Windows\System\IXyiYPJ.exe
  C:\Windows\System\IXyiYPJ.exe
  2⤵
  PID:2256
- C:\Windows\System\KUMshlf.exe
  C:\Windows\System\KUMshlf.exe
  2⤵
  PID:2472
- C:\Windows\System\OsHhWxf.exe
  C:\Windows\System\OsHhWxf.exe
  2⤵
  PID:2992
- C:\Windows\System\FzWwNoV.exe
  C:\Windows\System\FzWwNoV.exe
  2⤵
  PID:2680
- C:\Windows\System\EbmlnwB.exe
  C:\Windows\System\EbmlnwB.exe
  2⤵
  PID:2592
- C:\Windows\System\ruUkBqX.exe
  C:\Windows\System\ruUkBqX.exe
  2⤵
  PID:1712
- C:\Windows\System\RGVjvFV.exe
  C:\Windows\System\RGVjvFV.exe
  2⤵
  PID:1504
- C:\Windows\System\mNpiOuR.exe
  C:\Windows\System\mNpiOuR.exe
  2⤵
  PID:2056
- C:\Windows\System\CYZajmO.exe
  C:\Windows\System\CYZajmO.exe
  2⤵
  PID:1032
- C:\Windows\System\aWvycEZ.exe
  C:\Windows\System\aWvycEZ.exe
  2⤵
  PID:1664
- C:\Windows\System\fvQHFZt.exe
  C:\Windows\System\fvQHFZt.exe
  2⤵
  PID:2780
- C:\Windows\System\jPfJFGb.exe
  C:\Windows\System\jPfJFGb.exe
  2⤵
  PID:2560
- C:\Windows\System\kwlJzCx.exe
  C:\Windows\System\kwlJzCx.exe
  2⤵
  PID:2720
- C:\Windows\System\KpZQvgz.exe
  C:\Windows\System\KpZQvgz.exe
  2⤵
  PID:2964
- C:\Windows\System\FosGPeG.exe
  C:\Windows\System\FosGPeG.exe
  2⤵
  PID:2420
- C:\Windows\System\tzfKVti.exe
  C:\Windows\System\tzfKVti.exe
  2⤵
  PID:2516
- C:\Windows\System\JLiPivY.exe
  C:\Windows\System\JLiPivY.exe
  2⤵
  PID:1312
- C:\Windows\System\EsstCOb.exe
  C:\Windows\System\EsstCOb.exe
  2⤵
  PID:1784
- C:\Windows\System\KcNRgtQ.exe
  C:\Windows\System\KcNRgtQ.exe
  2⤵
  PID:1536
- C:\Windows\System\GnboKIs.exe
  C:\Windows\System\GnboKIs.exe
  2⤵
  PID:1152
- C:\Windows\System\meIDzLA.exe
  C:\Windows\System\meIDzLA.exe
  2⤵
  PID:488
- C:\Windows\System\NLeFsHE.exe
  C:\Windows\System\NLeFsHE.exe
  2⤵
  PID:2544
- C:\Windows\System\VtucHRM.exe
  C:\Windows\System\VtucHRM.exe
  2⤵
  PID:2244
- C:\Windows\System\KPphvth.exe
  C:\Windows\System\KPphvth.exe
  2⤵
  PID:2716
- C:\Windows\System\RxXQdqX.exe
  C:\Windows\System\RxXQdqX.exe
  2⤵
  PID:2784
- C:\Windows\System\kyCPZqF.exe
  C:\Windows\System\kyCPZqF.exe
  2⤵
  PID:1344
- C:\Windows\System\DdDEQMq.exe
  C:\Windows\System\DdDEQMq.exe
  2⤵
  PID:1448
- C:\Windows\System\dFbECEf.exe
  C:\Windows\System\dFbECEf.exe
  2⤵
  PID:1932
- C:\Windows\System\ydqKgML.exe
  C:\Windows\System\ydqKgML.exe
  2⤵
  PID:1812
- C:\Windows\System\oLpXYFX.exe
  C:\Windows\System\oLpXYFX.exe
  2⤵
  PID:960
- C:\Windows\System\hXZNknA.exe
  C:\Windows\System\hXZNknA.exe
  2⤵
  PID:1820
- C:\Windows\System\BQHOewO.exe
  C:\Windows\System\BQHOewO.exe
  2⤵
  PID:2392
- C:\Windows\System\MxqnLzR.exe
  C:\Windows\System\MxqnLzR.exe
  2⤵
  PID:1868
- C:\Windows\System\FDiaTJC.exe
  C:\Windows\System\FDiaTJC.exe
  2⤵
  PID:992
- C:\Windows\System\TomBOdV.exe
  C:\Windows\System\TomBOdV.exe
  2⤵
  PID:2436
- C:\Windows\System\gZksMFk.exe
  C:\Windows\System\gZksMFk.exe
  2⤵
  PID:700
- C:\Windows\System\wvZkoyM.exe
  C:\Windows\System\wvZkoyM.exe
  2⤵
  PID:2612
- C:\Windows\System\yXtAKzV.exe
  C:\Windows\System\yXtAKzV.exe
  2⤵
  PID:1708
- C:\Windows\System\NZInZpI.exe
  C:\Windows\System\NZInZpI.exe
  2⤵
  PID:2768
- C:\Windows\System\jFSGcOm.exe
  C:\Windows\System\jFSGcOm.exe
  2⤵
  PID:1716
- C:\Windows\System\WMNzMUi.exe
  C:\Windows\System\WMNzMUi.exe
  2⤵
  PID:2448
- C:\Windows\System\sAwQpQb.exe
  C:\Windows\System\sAwQpQb.exe
  2⤵
  PID:3008
- C:\Windows\System\PwKKSNx.exe
  C:\Windows\System\PwKKSNx.exe
  2⤵
  PID:1352
- C:\Windows\System\KIclCuI.exe
  C:\Windows\System\KIclCuI.exe
  2⤵
  PID:1668
- C:\Windows\System\RWyokAb.exe
  C:\Windows\System\RWyokAb.exe
  2⤵
  PID:2748
- C:\Windows\System\imdxVNK.exe
  C:\Windows\System\imdxVNK.exe
  2⤵
  PID:696
- C:\Windows\System\FCrqCGK.exe
  C:\Windows\System\FCrqCGK.exe
  2⤵
  PID:1592
- C:\Windows\System\mGojjKI.exe
  C:\Windows\System\mGojjKI.exe
  2⤵
  PID:2488
- C:\Windows\System\cRQjATc.exe
  C:\Windows\System\cRQjATc.exe
  2⤵
  PID:3080
- C:\Windows\System\ZIKxaKG.exe
  C:\Windows\System\ZIKxaKG.exe
  2⤵
  PID:3096
- C:\Windows\System\tYoIhkD.exe
  C:\Windows\System\tYoIhkD.exe
  2⤵
  PID:3112
- C:\Windows\System\FYpZsnc.exe
  C:\Windows\System\FYpZsnc.exe
  2⤵
  PID:3128
- C:\Windows\System\gGCypJP.exe
  C:\Windows\System\gGCypJP.exe
  2⤵
  PID:3144
- C:\Windows\System\uhEhNQL.exe
  C:\Windows\System\uhEhNQL.exe
  2⤵
  PID:3160
- C:\Windows\System\LOoTXun.exe
  C:\Windows\System\LOoTXun.exe
  2⤵
  PID:3176
- C:\Windows\System\jBDYVpC.exe
  C:\Windows\System\jBDYVpC.exe
  2⤵
  PID:3192
- C:\Windows\System\lISRVMy.exe
  C:\Windows\System\lISRVMy.exe
  2⤵
  PID:3208
- C:\Windows\System\DaMgSuG.exe
  C:\Windows\System\DaMgSuG.exe
  2⤵
  PID:3312
- C:\Windows\System\CGwKwHC.exe
  C:\Windows\System\CGwKwHC.exe
  2⤵
  PID:3444
- C:\Windows\System\CgBMIlu.exe
  C:\Windows\System\CgBMIlu.exe
  2⤵
  PID:3460
- C:\Windows\System\KvHijoe.exe
  C:\Windows\System\KvHijoe.exe
  2⤵
  PID:3476
- C:\Windows\System\NfmGDZf.exe
  C:\Windows\System\NfmGDZf.exe
  2⤵
  PID:3496
- C:\Windows\System\opQJIFh.exe
  C:\Windows\System\opQJIFh.exe
  2⤵
  PID:3524
- C:\Windows\System\qAJMHHG.exe
  C:\Windows\System\qAJMHHG.exe
  2⤵
  PID:3544
- C:\Windows\System\eXiIHUw.exe
  C:\Windows\System\eXiIHUw.exe
  2⤵
  PID:3560
- C:\Windows\System\NFApimr.exe
  C:\Windows\System\NFApimr.exe
  2⤵
  PID:3576
- C:\Windows\System\gFjghPc.exe
  C:\Windows\System\gFjghPc.exe
  2⤵
  PID:3592
- C:\Windows\System\qQBBkMc.exe
  C:\Windows\System\qQBBkMc.exe
  2⤵
  PID:3608
- C:\Windows\System\KzzHFtx.exe
  C:\Windows\System\KzzHFtx.exe
  2⤵
  PID:3624
- C:\Windows\System\VuMwkdS.exe
  C:\Windows\System\VuMwkdS.exe
  2⤵
  PID:3640
- C:\Windows\System\uQnQfCQ.exe
  C:\Windows\System\uQnQfCQ.exe
  2⤵
  PID:3656
- C:\Windows\System\bUivxpd.exe
  C:\Windows\System\bUivxpd.exe
  2⤵
  PID:3672
- C:\Windows\System\wrqwlSH.exe
  C:\Windows\System\wrqwlSH.exe
  2⤵
  PID:3688
- C:\Windows\System\IjthHek.exe
  C:\Windows\System\IjthHek.exe
  2⤵
  PID:3704
- C:\Windows\System\HWrPqUa.exe
  C:\Windows\System\HWrPqUa.exe
  2⤵
  PID:3720
- C:\Windows\System\YlydcCs.exe
  C:\Windows\System\YlydcCs.exe
  2⤵
  PID:3736
- C:\Windows\System\ezBwwpB.exe
  C:\Windows\System\ezBwwpB.exe
  2⤵
  PID:3752
- C:\Windows\System\dDTDRUJ.exe
  C:\Windows\System\dDTDRUJ.exe
  2⤵
  PID:3768
- C:\Windows\System\ABGMZok.exe
  C:\Windows\System\ABGMZok.exe
  2⤵
  PID:3784
- C:\Windows\System\CFyUiZS.exe
  C:\Windows\System\CFyUiZS.exe
  2⤵
  PID:3800
- C:\Windows\System\ctmpxgS.exe
  C:\Windows\System\ctmpxgS.exe
  2⤵
  PID:3816
- C:\Windows\System\NOBxXol.exe
  C:\Windows\System\NOBxXol.exe
  2⤵
  PID:3832
- C:\Windows\System\IjLDLGi.exe
  C:\Windows\System\IjLDLGi.exe
  2⤵
  PID:3848
- C:\Windows\System\eTjqnVP.exe
  C:\Windows\System\eTjqnVP.exe
  2⤵
  PID:3864
- C:\Windows\System\pwYJcAZ.exe
  C:\Windows\System\pwYJcAZ.exe
  2⤵
  PID:3880
- C:\Windows\System\nsJXRXr.exe
  C:\Windows\System\nsJXRXr.exe
  2⤵
  PID:3896
- C:\Windows\System\lYcUkMW.exe
  C:\Windows\System\lYcUkMW.exe
  2⤵
  PID:3916
- C:\Windows\System\ecPtUaq.exe
  C:\Windows\System\ecPtUaq.exe
  2⤵
  PID:3932
- C:\Windows\System\syPYTAu.exe
  C:\Windows\System\syPYTAu.exe
  2⤵
  PID:3948
- C:\Windows\System\FxWaCWc.exe
  C:\Windows\System\FxWaCWc.exe
  2⤵
  PID:3964
- C:\Windows\System\lvCtNKy.exe
  C:\Windows\System\lvCtNKy.exe
  2⤵
  PID:3980
- C:\Windows\System\TtTkNXX.exe
  C:\Windows\System\TtTkNXX.exe
  2⤵
  PID:3996
- C:\Windows\System\vCwoCxY.exe
  C:\Windows\System\vCwoCxY.exe
  2⤵
  PID:4012
- C:\Windows\System\kbXxKbi.exe
  C:\Windows\System\kbXxKbi.exe
  2⤵
  PID:4028
- C:\Windows\System\buRGnzW.exe
  C:\Windows\System\buRGnzW.exe
  2⤵
  PID:4044
- C:\Windows\System\bEnrsqh.exe
  C:\Windows\System\bEnrsqh.exe
  2⤵
  PID:4060
- C:\Windows\System\DMwCYNL.exe
  C:\Windows\System\DMwCYNL.exe
  2⤵
  PID:4076
- C:\Windows\System\qwaGIPJ.exe
  C:\Windows\System\qwaGIPJ.exe
  2⤵
  PID:1804
- C:\Windows\System\UKywbab.exe
  C:\Windows\System\UKywbab.exe
  2⤵
  PID:3108
- C:\Windows\System\cXvlbAA.exe
  C:\Windows\System\cXvlbAA.exe
  2⤵
  PID:3172
- C:\Windows\System\NrxhxNj.exe
  C:\Windows\System\NrxhxNj.exe
  2⤵
  PID:3044
- C:\Windows\System\KyseXHb.exe
  C:\Windows\System\KyseXHb.exe
  2⤵
  PID:3032
- C:\Windows\System\BXdrMsb.exe
  C:\Windows\System\BXdrMsb.exe
  2⤵
  PID:3124
- C:\Windows\System\EywbwMN.exe
  C:\Windows\System\EywbwMN.exe
  2⤵
  PID:3296
- C:\Windows\System\khmJbeI.exe
  C:\Windows\System\khmJbeI.exe
  2⤵
  PID:3340
- C:\Windows\System\jnLsKFT.exe
  C:\Windows\System\jnLsKFT.exe
  2⤵
  PID:3392
- C:\Windows\System\oqrQCkB.exe
  C:\Windows\System\oqrQCkB.exe
  2⤵
  PID:3472
- C:\Windows\System\QxeCPOM.exe
  C:\Windows\System\QxeCPOM.exe
  2⤵
  PID:3536
- C:\Windows\System\EDPYmGp.exe
  C:\Windows\System\EDPYmGp.exe
  2⤵
  PID:3616
- C:\Windows\System\UdHgPzR.exe
  C:\Windows\System\UdHgPzR.exe
  2⤵
  PID:3584
- C:\Windows\System\VZmpcYG.exe
  C:\Windows\System\VZmpcYG.exe
  2⤵
  PID:3600
- C:\Windows\System\VhBBDEM.exe
  C:\Windows\System\VhBBDEM.exe
  2⤵
  PID:3728
- C:\Windows\System\ljmCVok.exe
  C:\Windows\System\ljmCVok.exe
  2⤵
  PID:3732
- C:\Windows\System\hXmYPxU.exe
  C:\Windows\System\hXmYPxU.exe
  2⤵
  PID:3796
- C:\Windows\System\GxnZBXS.exe
  C:\Windows\System\GxnZBXS.exe
  2⤵
  PID:3892
- C:\Windows\System\EdRrGGw.exe
  C:\Windows\System\EdRrGGw.exe
  2⤵
  PID:3960
- C:\Windows\System\FxkTILj.exe
  C:\Windows\System\FxkTILj.exe
  2⤵
  PID:4052
- C:\Windows\System\ZxFdsNd.exe
  C:\Windows\System\ZxFdsNd.exe
  2⤵
  PID:3844
- C:\Windows\System\tZVNrWO.exe
  C:\Windows\System\tZVNrWO.exe
  2⤵
  PID:3912
- C:\Windows\System\kIThTZM.exe
  C:\Windows\System\kIThTZM.exe
  2⤵
  PID:3972
- C:\Windows\System\LWaWLQa.exe
  C:\Windows\System\LWaWLQa.exe
  2⤵
  PID:4068
- C:\Windows\System\AXtIgiT.exe
  C:\Windows\System\AXtIgiT.exe
  2⤵
  PID:2632
- C:\Windows\System\ZLlwgdd.exe
  C:\Windows\System\ZLlwgdd.exe
  2⤵
  PID:2140
- C:\Windows\System\BXzaxMR.exe
  C:\Windows\System\BXzaxMR.exe
  2⤵
  PID:3076
- C:\Windows\System\kWyZPMQ.exe
  C:\Windows\System\kWyZPMQ.exe
  2⤵
  PID:2384
- C:\Windows\System\oIfoZtE.exe
  C:\Windows\System\oIfoZtE.exe
  2⤵
  PID:1560
- C:\Windows\System\TmRQAhh.exe
  C:\Windows\System\TmRQAhh.exe
  2⤵
  PID:1968
- C:\Windows\System\TTLIwqZ.exe
  C:\Windows\System\TTLIwqZ.exe
  2⤵
  PID:3004
- C:\Windows\System\PRPBjLN.exe
  C:\Windows\System\PRPBjLN.exe
  2⤵
  PID:3088
- C:\Windows\System\FzfYFFK.exe
  C:\Windows\System\FzfYFFK.exe
  2⤵
  PID:3092
- C:\Windows\System\EpPmyem.exe
  C:\Windows\System\EpPmyem.exe
  2⤵
  PID:3228
- C:\Windows\System\OXQfVNp.exe
  C:\Windows\System\OXQfVNp.exe
  2⤵
  PID:3220
- C:\Windows\System\dXeHhZc.exe
  C:\Windows\System\dXeHhZc.exe
  2⤵
  PID:3356
- C:\Windows\System\CBRlbpX.exe
  C:\Windows\System\CBRlbpX.exe
  2⤵
  PID:3376
- C:\Windows\System\ZvCHiis.exe
  C:\Windows\System\ZvCHiis.exe
  2⤵
  PID:3360
- C:\Windows\System\KXQZCWq.exe
  C:\Windows\System\KXQZCWq.exe
  2⤵
  PID:3428
- C:\Windows\System\xpDqMSb.exe
  C:\Windows\System\xpDqMSb.exe
  2⤵
  PID:3412
- C:\Windows\System\DUiGpve.exe
  C:\Windows\System\DUiGpve.exe
  2⤵
  PID:3492
- C:\Windows\System\moCQsSt.exe
  C:\Windows\System\moCQsSt.exe
  2⤵
  PID:3452
- C:\Windows\System\nFGwTKA.exe
  C:\Windows\System\nFGwTKA.exe
  2⤵
  PID:3520
- C:\Windows\System\yakdkeR.exe
  C:\Windows\System\yakdkeR.exe
  2⤵
  PID:3652
- C:\Windows\System\LEliMAd.exe
  C:\Windows\System\LEliMAd.exe
  2⤵
  PID:3632
- C:\Windows\System\UaLQBVW.exe
  C:\Windows\System\UaLQBVW.exe
  2⤵
  PID:3748
- C:\Windows\System\vrydaQa.exe
  C:\Windows\System\vrydaQa.exe
  2⤵
  PID:3764
- C:\Windows\System\viiuFRd.exe
  C:\Windows\System\viiuFRd.exe
  2⤵
  PID:3856
- C:\Windows\System\zxIKMxv.exe
  C:\Windows\System\zxIKMxv.exe
  2⤵
  PID:4024
- C:\Windows\System\mpmwHXa.exe
  C:\Windows\System\mpmwHXa.exe
  2⤵
  PID:3840
- C:\Windows\System\sWzJZCH.exe
  C:\Windows\System\sWzJZCH.exe
  2⤵
  PID:3944
- C:\Windows\System\AjOBnku.exe
  C:\Windows\System\AjOBnku.exe
  2⤵
  PID:4008
- C:\Windows\System\EbfCLEN.exe
  C:\Windows\System\EbfCLEN.exe
  2⤵
  PID:4088
- C:\Windows\System\BYMVkax.exe
  C:\Windows\System\BYMVkax.exe
  2⤵
  PID:2416
- C:\Windows\System\QSrzHyS.exe
  C:\Windows\System\QSrzHyS.exe
  2⤵
  PID:3260
- C:\Windows\System\eGvhZir.exe
  C:\Windows\System\eGvhZir.exe
  2⤵
  PID:2280
- C:\Windows\System\QowmRCm.exe
  C:\Windows\System\QowmRCm.exe
  2⤵
  PID:3156
- C:\Windows\System\ZfRBUUv.exe
  C:\Windows\System\ZfRBUUv.exe
  2⤵
  PID:3216
- C:\Windows\System\wEPjkXA.exe
  C:\Windows\System\wEPjkXA.exe
  2⤵
  PID:3184
- C:\Windows\System\KDNZgpI.exe
  C:\Windows\System\KDNZgpI.exe
  2⤵
  PID:1308
- C:\Windows\System\ahQzQdY.exe
  C:\Windows\System\ahQzQdY.exe
  2⤵
  PID:3332
- C:\Windows\System\PpjdVKt.exe
  C:\Windows\System\PpjdVKt.exe
  2⤵
  PID:2880
- C:\Windows\System\jDIWZmc.exe
  C:\Windows\System\jDIWZmc.exe
  2⤵
  PID:3388
- C:\Windows\System\mWidKgW.exe
  C:\Windows\System\mWidKgW.exe
  2⤵
  PID:3416
- C:\Windows\System\ZvngLHw.exe
  C:\Windows\System\ZvngLHw.exe
  2⤵
  PID:3420
- C:\Windows\System\YENywjC.exe
  C:\Windows\System\YENywjC.exe
  2⤵
  PID:3436
- C:\Windows\System\LjqeVXX.exe
  C:\Windows\System\LjqeVXX.exe
  2⤵
  PID:2788
- C:\Windows\System\OHjvNyv.exe
  C:\Windows\System\OHjvNyv.exe
  2⤵
  PID:3808
- C:\Windows\System\JsHkpnT.exe
  C:\Windows\System\JsHkpnT.exe
  2⤵
  PID:3860
- C:\Windows\System\GOrMPBP.exe
  C:\Windows\System\GOrMPBP.exe
  2⤵
  PID:4092
- C:\Windows\System\XHczHkk.exe
  C:\Windows\System\XHczHkk.exe
  2⤵
  PID:4040
- C:\Windows\System\EgsGWUk.exe
  C:\Windows\System\EgsGWUk.exe
  2⤵
  PID:3204
- C:\Windows\System\WqZeJpk.exe
  C:\Windows\System\WqZeJpk.exe
  2⤵
  PID:1156
- C:\Windows\System\EjgyGzv.exe
  C:\Windows\System\EjgyGzv.exe
  2⤵
  PID:1620
- C:\Windows\System\ZtkLZbj.exe
  C:\Windows\System\ZtkLZbj.exe
  2⤵
  PID:2648
- C:\Windows\System\IsfmoyX.exe
  C:\Windows\System\IsfmoyX.exe
  2⤵
  PID:2100
- C:\Windows\System\lXaXgum.exe
  C:\Windows\System\lXaXgum.exe
  2⤵
  PID:3504
- C:\Windows\System\BMIBqTW.exe
  C:\Windows\System\BMIBqTW.exe
  2⤵
  PID:2300
- C:\Windows\System\YYNgygw.exe
  C:\Windows\System\YYNgygw.exe
  2⤵
  PID:3556
- C:\Windows\System\WLRpohb.exe
  C:\Windows\System\WLRpohb.exe
  2⤵
  PID:784
- C:\Windows\System\KisAvre.exe
  C:\Windows\System\KisAvre.exe
  2⤵
  PID:2672
- C:\Windows\System\rsVyGSQ.exe
  C:\Windows\System\rsVyGSQ.exe
  2⤵
  PID:2328
- C:\Windows\System\KFFOkaG.exe
  C:\Windows\System\KFFOkaG.exe
  2⤵
  PID:3940
- C:\Windows\System\TwpyLsA.exe
  C:\Windows\System\TwpyLsA.exe
  2⤵
  PID:3888
- C:\Windows\System\sHtVpam.exe
  C:\Windows\System\sHtVpam.exe
  2⤵
  PID:3056
- C:\Windows\System\kpohfpZ.exe
  C:\Windows\System\kpohfpZ.exe
  2⤵
  PID:3488
- C:\Windows\System\mcknIsb.exe
  C:\Windows\System\mcknIsb.exe
  2⤵
  PID:1940
- C:\Windows\System\dvamCJc.exe
  C:\Windows\System\dvamCJc.exe
  2⤵
  PID:3168
- C:\Windows\System\LNxldpj.exe
  C:\Windows\System\LNxldpj.exe
  2⤵
  PID:2808
- C:\Windows\System\rziXpvJ.exe
  C:\Windows\System\rziXpvJ.exe
  2⤵
  PID:1496
- C:\Windows\System\EWZSzkC.exe
  C:\Windows\System\EWZSzkC.exe
  2⤵
  PID:3680
- C:\Windows\System\vVAzqfz.exe
  C:\Windows\System\vVAzqfz.exe
  2⤵
  PID:3664
- C:\Windows\System\aIpykhe.exe
  C:\Windows\System\aIpykhe.exe
  2⤵
  PID:4020
- C:\Windows\System\bfUnMwl.exe
  C:\Windows\System\bfUnMwl.exe
  2⤵
  PID:2984
- C:\Windows\System\xjMZNwo.exe
  C:\Windows\System\xjMZNwo.exe
  2⤵
  PID:4108
- C:\Windows\System\bunqjpE.exe
  C:\Windows\System\bunqjpE.exe
  2⤵
  PID:4124
- C:\Windows\System\yqXJITF.exe
  C:\Windows\System\yqXJITF.exe
  2⤵
  PID:4140
- C:\Windows\System\UjuIgeb.exe
  C:\Windows\System\UjuIgeb.exe
  2⤵
  PID:4156
- C:\Windows\System\YZfsSPR.exe
  C:\Windows\System\YZfsSPR.exe
  2⤵
  PID:4176
- C:\Windows\System\JwAElfQ.exe
  C:\Windows\System\JwAElfQ.exe
  2⤵
  PID:4192
- C:\Windows\System\HiudgZn.exe
  C:\Windows\System\HiudgZn.exe
  2⤵
  PID:4208
- C:\Windows\System\gmAvMJM.exe
  C:\Windows\System\gmAvMJM.exe
  2⤵
  PID:4228
- C:\Windows\System\ZTZFTCj.exe
  C:\Windows\System\ZTZFTCj.exe
  2⤵
  PID:4244
- C:\Windows\System\pGRvxGc.exe
  C:\Windows\System\pGRvxGc.exe
  2⤵
  PID:4264
- C:\Windows\System\LekNCqd.exe
  C:\Windows\System\LekNCqd.exe
  2⤵
  PID:4280
- C:\Windows\System\TIpsoOm.exe
  C:\Windows\System\TIpsoOm.exe
  2⤵
  PID:4296
- C:\Windows\System\moirXDN.exe
  C:\Windows\System\moirXDN.exe
  2⤵
  PID:4312
- C:\Windows\System\DFBgrmy.exe
  C:\Windows\System\DFBgrmy.exe
  2⤵
  PID:4400
- C:\Windows\System\svMhNVn.exe
  C:\Windows\System\svMhNVn.exe
  2⤵
  PID:4428
- C:\Windows\System\hnhBxsx.exe
  C:\Windows\System\hnhBxsx.exe
  2⤵
  PID:4448
- C:\Windows\System\tqtKRSm.exe
  C:\Windows\System\tqtKRSm.exe
  2⤵
  PID:4476
- C:\Windows\System\peKveLu.exe
  C:\Windows\System\peKveLu.exe
  2⤵
  PID:4492
- C:\Windows\System\HFBxcoB.exe
  C:\Windows\System\HFBxcoB.exe
  2⤵
  PID:4512
- C:\Windows\System\CtpAQpE.exe
  C:\Windows\System\CtpAQpE.exe
  2⤵
  PID:4532
- C:\Windows\System\aPXuAUG.exe
  C:\Windows\System\aPXuAUG.exe
  2⤵
  PID:4548
- C:\Windows\System\FjGPlCO.exe
  C:\Windows\System\FjGPlCO.exe
  2⤵
  PID:4564
- C:\Windows\System\sxazaeY.exe
  C:\Windows\System\sxazaeY.exe
  2⤵
  PID:4592
- C:\Windows\System\HMGYbWB.exe
  C:\Windows\System\HMGYbWB.exe
  2⤵
  PID:4624
- C:\Windows\System\fQVKaVT.exe
  C:\Windows\System\fQVKaVT.exe
  2⤵
  PID:4668
- C:\Windows\System\rIcRxFO.exe
  C:\Windows\System\rIcRxFO.exe
  2⤵
  PID:4700
- C:\Windows\System\HIMgYgF.exe
  C:\Windows\System\HIMgYgF.exe
  2⤵
  PID:4720
- C:\Windows\System\hOgBTWr.exe
  C:\Windows\System\hOgBTWr.exe
  2⤵
  PID:4736
- C:\Windows\System\RtfFlPk.exe
  C:\Windows\System\RtfFlPk.exe
  2⤵
  PID:4752
- C:\Windows\System\CNfnlfw.exe
  C:\Windows\System\CNfnlfw.exe
  2⤵
  PID:4768
- C:\Windows\System\IKWNYMf.exe
  C:\Windows\System\IKWNYMf.exe
  2⤵
  PID:4784
- C:\Windows\System\XNjGSYj.exe
  C:\Windows\System\XNjGSYj.exe
  2⤵
  PID:4800
- C:\Windows\System\IQTqwaP.exe
  C:\Windows\System\IQTqwaP.exe
  2⤵
  PID:4816
- C:\Windows\System\IaccSfU.exe
  C:\Windows\System\IaccSfU.exe
  2⤵
  PID:4832
- C:\Windows\System\JWnPhaI.exe
  C:\Windows\System\JWnPhaI.exe
  2⤵
  PID:4852
- C:\Windows\System\zcNvLlg.exe
  C:\Windows\System\zcNvLlg.exe
  2⤵
  PID:4872
- C:\Windows\System\iLaHXTP.exe
  C:\Windows\System\iLaHXTP.exe
  2⤵
  PID:4888
- C:\Windows\System\JIMXgCr.exe
  C:\Windows\System\JIMXgCr.exe
  2⤵
  PID:4904
- C:\Windows\System\zQuGMIx.exe
  C:\Windows\System\zQuGMIx.exe
  2⤵
  PID:4920
- C:\Windows\System\wicktRo.exe
  C:\Windows\System\wicktRo.exe
  2⤵
  PID:4940
- C:\Windows\System\wCKXWHS.exe
  C:\Windows\System\wCKXWHS.exe
  2⤵
  PID:4956
- C:\Windows\System\YWRDnvL.exe
  C:\Windows\System\YWRDnvL.exe
  2⤵
  PID:5008
- C:\Windows\System\TzIRoot.exe
  C:\Windows\System\TzIRoot.exe
  2⤵
  PID:5028
- C:\Windows\System\HeloUfD.exe
  C:\Windows\System\HeloUfD.exe
  2⤵
  PID:5044
- C:\Windows\System\pDyHIIr.exe
  C:\Windows\System\pDyHIIr.exe
  2⤵
  PID:5060
- C:\Windows\System\lSZOplG.exe
  C:\Windows\System\lSZOplG.exe
  2⤵
  PID:5076
- C:\Windows\System\iwYhJBV.exe
  C:\Windows\System\iwYhJBV.exe
  2⤵
  PID:5092
- C:\Windows\System\nIEbXWm.exe
  C:\Windows\System\nIEbXWm.exe
  2⤵
  PID:5108
- C:\Windows\System\pXTgBHY.exe
  C:\Windows\System\pXTgBHY.exe
  2⤵
  PID:3240
- C:\Windows\System\NbXIcYn.exe
  C:\Windows\System\NbXIcYn.exe
  2⤵
  PID:4172
- C:\Windows\System\sCcyOQx.exe
  C:\Windows\System\sCcyOQx.exe
  2⤵
  PID:1728
- C:\Windows\System\bxYzXKH.exe
  C:\Windows\System\bxYzXKH.exe
  2⤵
  PID:3224
- C:\Windows\System\zMpXrCi.exe
  C:\Windows\System\zMpXrCi.exe
  2⤵
  PID:3792
- C:\Windows\System\GwMjhLp.exe
  C:\Windows\System\GwMjhLp.exe
  2⤵
  PID:4240
- C:\Windows\System\OxyJasI.exe
  C:\Windows\System\OxyJasI.exe
  2⤵
  PID:4220
- C:\Windows\System\NGlyRuM.exe
  C:\Windows\System\NGlyRuM.exe
  2⤵
  PID:4328
- C:\Windows\System\Owzvkea.exe
  C:\Windows\System\Owzvkea.exe
  2⤵
  PID:4288
- C:\Windows\System\ZXvqyys.exe
  C:\Windows\System\ZXvqyys.exe
  2⤵
  PID:4344
- C:\Windows\System\HzeTWuc.exe
  C:\Windows\System\HzeTWuc.exe
  2⤵
  PID:4360
- C:\Windows\System\xJfkPeQ.exe
  C:\Windows\System\xJfkPeQ.exe
  2⤵
  PID:4376
- C:\Windows\System\SKXzWkZ.exe
  C:\Windows\System\SKXzWkZ.exe
  2⤵
  PID:4392
- C:\Windows\System\slLKZBV.exe
  C:\Windows\System\slLKZBV.exe
  2⤵
  PID:4396
- C:\Windows\System\UyHTtaP.exe
  C:\Windows\System\UyHTtaP.exe
  2⤵
  PID:4440
- C:\Windows\System\cFFpjVq.exe
  C:\Windows\System\cFFpjVq.exe
  2⤵
  PID:4540
- C:\Windows\System\wQmQgUv.exe
  C:\Windows\System\wQmQgUv.exe
  2⤵
  PID:4560
- C:\Windows\System\HqLGNRZ.exe
  C:\Windows\System\HqLGNRZ.exe
  2⤵
  PID:4612
- C:\Windows\System\xJyDqbV.exe
  C:\Windows\System\xJyDqbV.exe
  2⤵
  PID:4608
- C:\Windows\System\ekKNDep.exe
  C:\Windows\System\ekKNDep.exe
  2⤵
  PID:4644
- C:\Windows\System\HpiMZxG.exe
  C:\Windows\System\HpiMZxG.exe
  2⤵
  PID:4712
- C:\Windows\System\ulHnrlo.exe
  C:\Windows\System\ulHnrlo.exe
  2⤵
  PID:4776
- C:\Windows\System\yufYeCU.exe
  C:\Windows\System\yufYeCU.exe
  2⤵
  PID:4840
- C:\Windows\System\BusxqKV.exe
  C:\Windows\System\BusxqKV.exe
  2⤵
  PID:4948
- C:\Windows\System\yrwOXhH.exe
  C:\Windows\System\yrwOXhH.exe
  2⤵
  PID:4844
- C:\Windows\System\FVagGIk.exe
  C:\Windows\System\FVagGIk.exe
  2⤵
  PID:4860
- C:\Windows\System\pdpZWMb.exe
  C:\Windows\System\pdpZWMb.exe
  2⤵
  PID:4764
- C:\Windows\System\ortMQSG.exe
  C:\Windows\System\ortMQSG.exe
  2⤵
  PID:4680
- C:\Windows\System\jtGdJNd.exe
  C:\Windows\System\jtGdJNd.exe
  2⤵
  PID:4988
- C:\Windows\System\olEcRsv.exe
  C:\Windows\System\olEcRsv.exe
  2⤵
  PID:4728
- C:\Windows\System\EVfTHus.exe
  C:\Windows\System\EVfTHus.exe
  2⤵
  PID:4932
- C:\Windows\System\oGCUzJD.exe
  C:\Windows\System\oGCUzJD.exe
  2⤵
  PID:5068
- C:\Windows\System\VCmuzSu.exe
  C:\Windows\System\VCmuzSu.exe
  2⤵
  PID:5072
- C:\Windows\System\StzrtKq.exe
  C:\Windows\System\StzrtKq.exe
  2⤵
  PID:5116
- C:\Windows\System\wVBWaGw.exe
  C:\Windows\System\wVBWaGw.exe
  2⤵
  PID:3812
- C:\Windows\System\ioQJTDo.exe
  C:\Windows\System\ioQJTDo.exe
  2⤵
  PID:4104
- C:\Windows\System\nvAAQXM.exe
  C:\Windows\System\nvAAQXM.exe
  2⤵
  PID:4136
- C:\Windows\System\OYYmTnr.exe
  C:\Windows\System\OYYmTnr.exe
  2⤵
  PID:3368
- C:\Windows\System\oatlGYO.exe
  C:\Windows\System\oatlGYO.exe
  2⤵
  PID:4184
- C:\Windows\System\WieotNM.exe
  C:\Windows\System\WieotNM.exe
  2⤵
  PID:4200
- C:\Windows\System\riCXkSA.exe
  C:\Windows\System\riCXkSA.exe
  2⤵
  PID:4256
- C:\Windows\System\zdsEJYT.exe
  C:\Windows\System\zdsEJYT.exe
  2⤵
  PID:4464
- C:\Windows\System\olObqMs.exe
  C:\Windows\System\olObqMs.exe
  2⤵
  PID:4352
- C:\Windows\System\XrDlgyR.exe
  C:\Windows\System\XrDlgyR.exe
  2⤵
  PID:3992
- C:\Windows\System\gxLLjca.exe
  C:\Windows\System\gxLLjca.exe
  2⤵
  PID:4368
- C:\Windows\System\TboHWcB.exe
  C:\Windows\System\TboHWcB.exe
  2⤵
  PID:4676
- C:\Windows\System\dJvCJkt.exe
  C:\Windows\System\dJvCJkt.exe
  2⤵
  PID:4848
- C:\Windows\System\BlCAfht.exe
  C:\Windows\System\BlCAfht.exe
  2⤵
  PID:4964
- C:\Windows\System\alZQPXO.exe
  C:\Windows\System\alZQPXO.exe
  2⤵
  PID:4796
- C:\Windows\System\cJHaePk.exe
  C:\Windows\System\cJHaePk.exe
  2⤵
  PID:5000
- C:\Windows\System\qtxALgH.exe
  C:\Windows\System\qtxALgH.exe
  2⤵
  PID:5024
- C:\Windows\System\eGtRewQ.exe
  C:\Windows\System\eGtRewQ.exe
  2⤵
  PID:5004
- C:\Windows\System\LIFPKMm.exe
  C:\Windows\System\LIFPKMm.exe
  2⤵
  PID:5084
- C:\Windows\System\ZKKlzAX.exe
  C:\Windows\System\ZKKlzAX.exe
  2⤵
  PID:3904
- C:\Windows\System\YsdvFhO.exe
  C:\Windows\System\YsdvFhO.exe
  2⤵
  PID:4204
- C:\Windows\System\XmXMabQ.exe
  C:\Windows\System\XmXMabQ.exe
  2⤵
  PID:4120
- C:\Windows\System\FgeCzFh.exe
  C:\Windows\System\FgeCzFh.exe
  2⤵
  PID:4188
- C:\Windows\System\vPPEZXv.exe
  C:\Windows\System\vPPEZXv.exe
  2⤵
  PID:4436
- C:\Windows\System\NEyqSxd.exe
  C:\Windows\System\NEyqSxd.exe
  2⤵
  PID:4504
- C:\Windows\System\WpDmXrG.exe
  C:\Windows\System\WpDmXrG.exe
  2⤵
  PID:2932
- C:\Windows\System\sAgbMOu.exe
  C:\Windows\System\sAgbMOu.exe
  2⤵
  PID:4584
- C:\Windows\System\gkZvZfg.exe
  C:\Windows\System\gkZvZfg.exe
  2⤵
  PID:4640
- C:\Windows\System\WfHDXMn.exe
  C:\Windows\System\WfHDXMn.exe
  2⤵
  PID:4588
- C:\Windows\System\aYuzgXf.exe
  C:\Windows\System\aYuzgXf.exe
  2⤵
  PID:4648
- C:\Windows\System\kHzbzkI.exe
  C:\Windows\System\kHzbzkI.exe
  2⤵
  PID:4748
- C:\Windows\System\MQhiNLm.exe
  C:\Windows\System\MQhiNLm.exe
  2⤵
  PID:4896
- C:\Windows\System\zPvlRvv.exe
  C:\Windows\System\zPvlRvv.exe
  2⤵
  PID:5020
- C:\Windows\System\OlfrGvc.exe
  C:\Windows\System\OlfrGvc.exe
  2⤵
  PID:4272
- C:\Windows\System\wxOBYfA.exe
  C:\Windows\System\wxOBYfA.exe
  2⤵
  PID:4928
- C:\Windows\System\mxtlWqq.exe
  C:\Windows\System\mxtlWqq.exe
  2⤵
  PID:4692
- C:\Windows\System\aEfANGJ.exe
  C:\Windows\System\aEfANGJ.exe
  2⤵
  PID:4292
- C:\Windows\System\erRebGD.exe
  C:\Windows\System\erRebGD.exe
  2⤵
  PID:4420
- C:\Windows\System\uhVJEXB.exe
  C:\Windows\System\uhVJEXB.exe
  2⤵
  PID:4468
- C:\Windows\System\dhEhHca.exe
  C:\Windows\System\dhEhHca.exe
  2⤵
  PID:5124
- C:\Windows\System\BiJgVut.exe
  C:\Windows\System\BiJgVut.exe
  2⤵
  PID:5140
- C:\Windows\System\JNAqeFp.exe
  C:\Windows\System\JNAqeFp.exe
  2⤵
  PID:5156
- C:\Windows\System\LapzTVu.exe
  C:\Windows\System\LapzTVu.exe
  2⤵
  PID:5172
- C:\Windows\System\ZiBGbxU.exe
  C:\Windows\System\ZiBGbxU.exe
  2⤵
  PID:5192
- C:\Windows\System\ELoYuQe.exe
  C:\Windows\System\ELoYuQe.exe
  2⤵
  PID:5208
- C:\Windows\System\yAFwhIC.exe
  C:\Windows\System\yAFwhIC.exe
  2⤵
  PID:5224
- C:\Windows\System\ItTJCLL.exe
  C:\Windows\System\ItTJCLL.exe
  2⤵
  PID:5240
- C:\Windows\System\RQYXVhM.exe
  C:\Windows\System\RQYXVhM.exe
  2⤵
  PID:5260
- C:\Windows\System\ohPbDmI.exe
  C:\Windows\System\ohPbDmI.exe
  2⤵
  PID:5276
- C:\Windows\System\AgTmQnq.exe
  C:\Windows\System\AgTmQnq.exe
  2⤵
  PID:5292
- C:\Windows\System\YIGtdkO.exe
  C:\Windows\System\YIGtdkO.exe
  2⤵
  PID:5312
- C:\Windows\System\dXBAJNE.exe
  C:\Windows\System\dXBAJNE.exe
  2⤵
  PID:5420
- C:\Windows\System\pdknJED.exe
  C:\Windows\System\pdknJED.exe
  2⤵
  PID:5436
- C:\Windows\System\aCClWqR.exe
  C:\Windows\System\aCClWqR.exe
  2⤵
  PID:5456
- C:\Windows\System\YZhdyqY.exe
  C:\Windows\System\YZhdyqY.exe
  2⤵
  PID:5472
- C:\Windows\System\LTcIQeZ.exe
  C:\Windows\System\LTcIQeZ.exe
  2⤵
  PID:5496
- C:\Windows\System\PwEyiAe.exe
  C:\Windows\System\PwEyiAe.exe
  2⤵
  PID:5512
- C:\Windows\System\scAjqPT.exe
  C:\Windows\System\scAjqPT.exe
  2⤵
  PID:5528
- C:\Windows\System\klvDAvG.exe
  C:\Windows\System\klvDAvG.exe
  2⤵
  PID:5544
- C:\Windows\System\vutantb.exe
  C:\Windows\System\vutantb.exe
  2⤵
  PID:5560
- C:\Windows\System\XOulRgO.exe
  C:\Windows\System\XOulRgO.exe
  2⤵
  PID:5580
- C:\Windows\System\nolMhaa.exe
  C:\Windows\System\nolMhaa.exe
  2⤵
  PID:5596
- C:\Windows\System\izerYlu.exe
  C:\Windows\System\izerYlu.exe
  2⤵
  PID:5612
- C:\Windows\System\yiXfEBf.exe
  C:\Windows\System\yiXfEBf.exe
  2⤵
  PID:5628
- C:\Windows\System\uOuMkfT.exe
  C:\Windows\System\uOuMkfT.exe
  2⤵
  PID:5644
- C:\Windows\System\AtTRqCX.exe
  C:\Windows\System\AtTRqCX.exe
  2⤵
  PID:5660
- C:\Windows\System\nScVpuf.exe
  C:\Windows\System\nScVpuf.exe
  2⤵
  PID:5676
- C:\Windows\System\pZMrXDg.exe
  C:\Windows\System\pZMrXDg.exe
  2⤵
  PID:5692
- C:\Windows\System\OpIWvDy.exe
  C:\Windows\System\OpIWvDy.exe
  2⤵
  PID:5708
- C:\Windows\System\eDlCfqX.exe
  C:\Windows\System\eDlCfqX.exe
  2⤵
  PID:5724
- C:\Windows\System\smZipiF.exe
  C:\Windows\System\smZipiF.exe
  2⤵
  PID:5744
- C:\Windows\System\DdxMnAO.exe
  C:\Windows\System\DdxMnAO.exe
  2⤵
  PID:5760
- C:\Windows\System\uCflzrD.exe
  C:\Windows\System\uCflzrD.exe
  2⤵
  PID:5776
- C:\Windows\System\pXPMeFZ.exe
  C:\Windows\System\pXPMeFZ.exe
  2⤵
  PID:5792
- C:\Windows\System\jkLZSdf.exe
  C:\Windows\System\jkLZSdf.exe
  2⤵
  PID:5808
- C:\Windows\System\yWeUNEm.exe
  C:\Windows\System\yWeUNEm.exe
  2⤵
  PID:5828
- C:\Windows\System\BARzfkt.exe
  C:\Windows\System\BARzfkt.exe
  2⤵
  PID:5844
- C:\Windows\System\QGiQmXY.exe
  C:\Windows\System\QGiQmXY.exe
  2⤵
  PID:5860
- C:\Windows\System\lOFMpwd.exe
  C:\Windows\System\lOFMpwd.exe
  2⤵
  PID:5876
- C:\Windows\System\cTpIMPX.exe
  C:\Windows\System\cTpIMPX.exe
  2⤵
  PID:5980
- C:\Windows\System\QRRjIAP.exe
  C:\Windows\System\QRRjIAP.exe
  2⤵
  PID:6008
- C:\Windows\System\bbuajXS.exe
  C:\Windows\System\bbuajXS.exe
  2⤵
  PID:6028
- C:\Windows\System\UdggCJy.exe
  C:\Windows\System\UdggCJy.exe
  2⤵
  PID:6044
- C:\Windows\System\KIzcwVb.exe
  C:\Windows\System\KIzcwVb.exe
  2⤵
  PID:6060
- C:\Windows\System\EdQYCfA.exe
  C:\Windows\System\EdQYCfA.exe
  2⤵
  PID:6092
- C:\Windows\System\rvkXiYs.exe
  C:\Windows\System\rvkXiYs.exe
  2⤵
  PID:6108
- C:\Windows\System\DAYNACw.exe
  C:\Windows\System\DAYNACw.exe
  2⤵
  PID:6124
- C:\Windows\System\FqRIUTe.exe
  C:\Windows\System\FqRIUTe.exe
  2⤵
  PID:6140
- C:\Windows\System\kpKpORu.exe
  C:\Windows\System\kpKpORu.exe
  2⤵
  PID:4744
- C:\Windows\System\QJkfYQG.exe
  C:\Windows\System\QJkfYQG.exe
  2⤵
  PID:4100
- C:\Windows\System\bTirtNG.exe
  C:\Windows\System\bTirtNG.exe
  2⤵
  PID:5308
- C:\Windows\System\jjwGcTz.exe
  C:\Windows\System\jjwGcTz.exe
  2⤵
  PID:5268
- C:\Windows\System\lFCByNm.exe
  C:\Windows\System\lFCByNm.exe
  2⤵
  PID:5200
- C:\Windows\System\qeSMjaE.exe
  C:\Windows\System\qeSMjaE.exe
  2⤵
  PID:5132
- C:\Windows\System\vUNXTYB.exe
  C:\Windows\System\vUNXTYB.exe
  2⤵
  PID:5152
- C:\Windows\System\ZxYQvqf.exe
  C:\Windows\System\ZxYQvqf.exe
  2⤵
  PID:4636
- C:\Windows\System\rUfWqJO.exe
  C:\Windows\System\rUfWqJO.exe
  2⤵
  PID:3252
- C:\Windows\System\coHnmEM.exe
  C:\Windows\System\coHnmEM.exe
  2⤵
  PID:5252
- C:\Windows\System\HFaBOIQ.exe
  C:\Windows\System\HFaBOIQ.exe
  2⤵
  PID:4984
- C:\Windows\System\PPJpOSH.exe
  C:\Windows\System\PPJpOSH.exe
  2⤵
  PID:4308
- C:\Windows\System\mDtTZWE.exe
  C:\Windows\System\mDtTZWE.exe
  2⤵
  PID:5180
- C:\Windows\System\ldKnkFX.exe
  C:\Windows\System\ldKnkFX.exe
  2⤵
  PID:5256
- C:\Windows\System\szpIaqg.exe
  C:\Windows\System\szpIaqg.exe
  2⤵
  PID:5332
- C:\Windows\System\cyFchie.exe
  C:\Windows\System\cyFchie.exe
  2⤵
  PID:5348
- C:\Windows\System\PqnyQIq.exe
  C:\Windows\System\PqnyQIq.exe
  2⤵
  PID:5368
- C:\Windows\System\slSvPmg.exe
  C:\Windows\System\slSvPmg.exe
  2⤵
  PID:5392
- C:\Windows\System\fsoaMzh.exe
  C:\Windows\System\fsoaMzh.exe
  2⤵
  PID:5404
- C:\Windows\System\UjkhAAn.exe
  C:\Windows\System\UjkhAAn.exe
  2⤵
  PID:5416
- C:\Windows\System\UDWBRjP.exe
  C:\Windows\System\UDWBRjP.exe
  2⤵
  PID:5480
- C:\Windows\System\CbeFeij.exe
  C:\Windows\System\CbeFeij.exe
  2⤵
  PID:5464
- C:\Windows\System\GXmPABa.exe
  C:\Windows\System\GXmPABa.exe
  2⤵
  PID:5536
- C:\Windows\System\jtoiRqN.exe
  C:\Windows\System\jtoiRqN.exe
  2⤵
  PID:5608
- C:\Windows\System\VeSQYEE.exe
  C:\Windows\System\VeSQYEE.exe
  2⤵
  PID:5672
- C:\Windows\System\ZnjrdUF.exe
  C:\Windows\System\ZnjrdUF.exe
  2⤵
  PID:5804
- C:\Windows\System\giZkOsk.exe
  C:\Windows\System\giZkOsk.exe
  2⤵
  PID:5740
- C:\Windows\System\tKdSOzQ.exe
  C:\Windows\System\tKdSOzQ.exe
  2⤵
  PID:5816
- C:\Windows\System\vixCVuZ.exe
  C:\Windows\System\vixCVuZ.exe
  2⤵
  PID:5656
- C:\Windows\System\lzmaSYd.exe
  C:\Windows\System\lzmaSYd.exe
  2⤵
  PID:5520
- C:\Windows\System\zqZCxle.exe
  C:\Windows\System\zqZCxle.exe
  2⤵
  PID:5556
- C:\Windows\System\hwCscoF.exe
  C:\Windows\System\hwCscoF.exe
  2⤵
  PID:5684
- C:\Windows\System\foRewkJ.exe
  C:\Windows\System\foRewkJ.exe
  2⤵
  PID:5788
- C:\Windows\System\wUgahAH.exe
  C:\Windows\System\wUgahAH.exe
  2⤵
  PID:5752
- C:\Windows\System\UIzYoSS.exe
  C:\Windows\System\UIzYoSS.exe
  2⤵
  PID:5900
- C:\Windows\System\bHIKwIU.exe
  C:\Windows\System\bHIKwIU.exe
  2⤵
  PID:5924
- C:\Windows\System\OVZXhLr.exe
  C:\Windows\System\OVZXhLr.exe
  2⤵
  PID:5936
- C:\Windows\System\cMuzGdA.exe
  C:\Windows\System\cMuzGdA.exe
  2⤵
  PID:5952
- C:\Windows\System\jADGMSb.exe
  C:\Windows\System\jADGMSb.exe
  2⤵
  PID:5720
- C:\Windows\System\RNgPsdX.exe
  C:\Windows\System\RNgPsdX.exe
  2⤵
  PID:6000
- C:\Windows\System\NYecxqd.exe
  C:\Windows\System\NYecxqd.exe
  2⤵
  PID:6056
- C:\Windows\System\etSsnSL.exe
  C:\Windows\System\etSsnSL.exe
  2⤵
  PID:6036
- C:\Windows\System\KjhyLlA.exe
  C:\Windows\System\KjhyLlA.exe
  2⤵
  PID:6076
- C:\Windows\System\lTmefVZ.exe
  C:\Windows\System\lTmefVZ.exe
  2⤵
  PID:6104
- C:\Windows\System\oaUzZaU.exe
  C:\Windows\System\oaUzZaU.exe
  2⤵
  PID:4656
- C:\Windows\System\XJhCPKL.exe
  C:\Windows\System\XJhCPKL.exe
  2⤵
  PID:5232
- C:\Windows\System\OBRWhce.exe
  C:\Windows\System\OBRWhce.exe
  2⤵
  PID:4488
- C:\Windows\System\FTuTOhb.exe
  C:\Windows\System\FTuTOhb.exe
  2⤵
  PID:4916
- C:\Windows\System\sUxPvpy.exe
  C:\Windows\System\sUxPvpy.exe
  2⤵
  PID:5356
- C:\Windows\System\CmCHFKb.exe
  C:\Windows\System\CmCHFKb.exe
  2⤵
  PID:5452
- C:\Windows\System\IhPHSHl.exe
  C:\Windows\System\IhPHSHl.exe
  2⤵
  PID:6160
- C:\Windows\System\dpbzrez.exe
  C:\Windows\System\dpbzrez.exe
  2⤵
  PID:6176
- C:\Windows\System\pMjzzBL.exe
  C:\Windows\System\pMjzzBL.exe
  2⤵
  PID:6192
- C:\Windows\System\EQtONZj.exe
  C:\Windows\System\EQtONZj.exe
  2⤵
  PID:6208
- C:\Windows\System\NhKdqPh.exe
  C:\Windows\System\NhKdqPh.exe
  2⤵
  PID:6224
- C:\Windows\System\LDwizAD.exe
  C:\Windows\System\LDwizAD.exe
  2⤵
  PID:6244
- C:\Windows\System\XyDnojv.exe
  C:\Windows\System\XyDnojv.exe
  2⤵
  PID:6260
- C:\Windows\System\MHOGZPe.exe
  C:\Windows\System\MHOGZPe.exe
  2⤵
  PID:6280
- C:\Windows\System\gEcbojN.exe
  C:\Windows\System\gEcbojN.exe
  2⤵
  PID:6296
- C:\Windows\System\kPuBNlP.exe
  C:\Windows\System\kPuBNlP.exe
  2⤵
  PID:6312
- C:\Windows\System\keHxlil.exe
  C:\Windows\System\keHxlil.exe
  2⤵
  PID:6332
- C:\Windows\System\sQHbaoV.exe
  C:\Windows\System\sQHbaoV.exe
  2⤵
  PID:6348
- C:\Windows\System\DAAbgtU.exe
  C:\Windows\System\DAAbgtU.exe
  2⤵
  PID:6364
- C:\Windows\System\yUDIAMH.exe
  C:\Windows\System\yUDIAMH.exe
  2⤵
  PID:6380
- C:\Windows\System\QXEVywT.exe
  C:\Windows\System\QXEVywT.exe
  2⤵
  PID:6396
- C:\Windows\System\scCoRuZ.exe
  C:\Windows\System\scCoRuZ.exe
  2⤵
  PID:6412
- C:\Windows\System\YZVnwIB.exe
  C:\Windows\System\YZVnwIB.exe
  2⤵
  PID:6432
- C:\Windows\System\gvQKKuu.exe
  C:\Windows\System\gvQKKuu.exe
  2⤵
  PID:6448
- C:\Windows\System\fqNiLig.exe
  C:\Windows\System\fqNiLig.exe
  2⤵
  PID:6464
- C:\Windows\System\cLgjBho.exe
  C:\Windows\System\cLgjBho.exe
  2⤵
  PID:6480
- C:\Windows\System\LFGkfLx.exe
  C:\Windows\System\LFGkfLx.exe
  2⤵
  PID:6496
- C:\Windows\System\uvyNuKh.exe
  C:\Windows\System\uvyNuKh.exe
  2⤵
  PID:6528
- C:\Windows\System\hqmFbGR.exe
  C:\Windows\System\hqmFbGR.exe
  2⤵
  PID:6556
- C:\Windows\System\StqmASx.exe
  C:\Windows\System\StqmASx.exe
  2⤵
  PID:6572
- C:\Windows\System\ukXqFOr.exe
  C:\Windows\System\ukXqFOr.exe
  2⤵
  PID:6588
- C:\Windows\System\mJqemGU.exe
  C:\Windows\System\mJqemGU.exe
  2⤵
  PID:6612
- C:\Windows\System\mUqRGZt.exe
  C:\Windows\System\mUqRGZt.exe
  2⤵
  PID:6628
- C:\Windows\System\okShECS.exe
  C:\Windows\System\okShECS.exe
  2⤵
  PID:6644
- C:\Windows\System\SpLxQQD.exe
  C:\Windows\System\SpLxQQD.exe
  2⤵
  PID:6660
- C:\Windows\System\yxKPJFl.exe
  C:\Windows\System\yxKPJFl.exe
  2⤵
  PID:6676
- C:\Windows\System\muSZmOf.exe
  C:\Windows\System\muSZmOf.exe
  2⤵
  PID:6692
- C:\Windows\System\zzzfoad.exe
  C:\Windows\System\zzzfoad.exe
  2⤵
  PID:6708
- C:\Windows\System\ihKCTlf.exe
  C:\Windows\System\ihKCTlf.exe
  2⤵
  PID:6724
- C:\Windows\System\cJCgkNq.exe
  C:\Windows\System\cJCgkNq.exe
  2⤵
  PID:6740
- C:\Windows\System\rlgVxei.exe
  C:\Windows\System\rlgVxei.exe
  2⤵
  PID:6756
- C:\Windows\System\mPyTmjg.exe
  C:\Windows\System\mPyTmjg.exe
  2⤵
  PID:6772
- C:\Windows\System\NCTfVhd.exe
  C:\Windows\System\NCTfVhd.exe
  2⤵
  PID:6788
- C:\Windows\System\DZRaeHA.exe
  C:\Windows\System\DZRaeHA.exe
  2⤵
  PID:6804
- C:\Windows\System\XPPXjQw.exe
  C:\Windows\System\XPPXjQw.exe
  2⤵
  PID:6820
- C:\Windows\System\WcnLfTi.exe
  C:\Windows\System\WcnLfTi.exe
  2⤵
  PID:6836
- C:\Windows\System\PuRkAcE.exe
  C:\Windows\System\PuRkAcE.exe
  2⤵
  PID:6852
- C:\Windows\System\JZOejYY.exe
  C:\Windows\System\JZOejYY.exe
  2⤵
  PID:6868
- C:\Windows\System\MFeVSdQ.exe
  C:\Windows\System\MFeVSdQ.exe
  2⤵
  PID:6884
- C:\Windows\System\VVsRFFK.exe
  C:\Windows\System\VVsRFFK.exe
  2⤵
  PID:6904
- C:\Windows\System\PJCwisP.exe
  C:\Windows\System\PJCwisP.exe
  2⤵
  PID:6920
- C:\Windows\System\OrgjtTD.exe
  C:\Windows\System\OrgjtTD.exe
  2⤵
  PID:6940
- C:\Windows\System\DgEvitc.exe
  C:\Windows\System\DgEvitc.exe
  2⤵
  PID:6956
- C:\Windows\System\yPTYsus.exe
  C:\Windows\System\yPTYsus.exe
  2⤵
  PID:6972
- C:\Windows\System\vCzmBWM.exe
  C:\Windows\System\vCzmBWM.exe
  2⤵
  PID:6988
- C:\Windows\System\xZiTnXV.exe
  C:\Windows\System\xZiTnXV.exe
  2⤵
  PID:7004
- C:\Windows\System\vHQsump.exe
  C:\Windows\System\vHQsump.exe
  2⤵
  PID:7020
- C:\Windows\System\CMSHOWn.exe
  C:\Windows\System\CMSHOWn.exe
  2⤵
  PID:7036
- C:\Windows\System\edGyUKX.exe
  C:\Windows\System\edGyUKX.exe
  2⤵
  PID:7052
- C:\Windows\System\cfwWeKZ.exe
  C:\Windows\System\cfwWeKZ.exe
  2⤵
  PID:7076
- C:\Windows\System\FGbtyQI.exe
  C:\Windows\System\FGbtyQI.exe
  2⤵
  PID:7092
- C:\Windows\System\fIGUpWe.exe
  C:\Windows\System\fIGUpWe.exe
  2⤵
  PID:7108
- C:\Windows\System\ILpymSU.exe
  C:\Windows\System\ILpymSU.exe
  2⤵
  PID:7128
- C:\Windows\System\GBvuWqC.exe
  C:\Windows\System\GBvuWqC.exe
  2⤵
  PID:7148
- C:\Windows\System\UTbTdus.exe
  C:\Windows\System\UTbTdus.exe
  2⤵
  PID:7164
- C:\Windows\System\hwEHXxG.exe
  C:\Windows\System\hwEHXxG.exe
  2⤵
  PID:4660
- C:\Windows\System\NWIsEdD.exe
  C:\Windows\System\NWIsEdD.exe
  2⤵
  PID:5588
- C:\Windows\System\HADNySr.exe
  C:\Windows\System\HADNySr.exe
  2⤵
  PID:5784
- C:\Windows\System\MPeITOB.exe
  C:\Windows\System\MPeITOB.exe
  2⤵
  PID:6072
- C:\Windows\System\ajeldTP.exe
  C:\Windows\System\ajeldTP.exe
  2⤵
  PID:4384
- C:\Windows\System\tJYQLai.exe
  C:\Windows\System\tJYQLai.exe
  2⤵
  PID:5328
- C:\Windows\System\pqyoFzw.exe
  C:\Windows\System\pqyoFzw.exe
  2⤵
  PID:6184
- C:\Windows\System\jUSHPSU.exe
  C:\Windows\System\jUSHPSU.exe
  2⤵
  PID:6256
- C:\Windows\System\NCJpaRq.exe
  C:\Windows\System\NCJpaRq.exe
  2⤵
  PID:6320
- C:\Windows\System\uHKPTUA.exe
  C:\Windows\System\uHKPTUA.exe
  2⤵
  PID:5768
- C:\Windows\System\uGfnzqR.exe
  C:\Windows\System\uGfnzqR.exe
  2⤵
  PID:6388
- C:\Windows\System\jwjFjpD.exe
  C:\Windows\System\jwjFjpD.exe
  2⤵
  PID:6428
- C:\Windows\System\fZmKUfI.exe
  C:\Windows\System\fZmKUfI.exe
  2⤵
  PID:5604
- C:\Windows\System\zdoOvuO.exe
  C:\Windows\System\zdoOvuO.exe
  2⤵
  PID:5540
- C:\Windows\System\cPzYUET.exe
  C:\Windows\System\cPzYUET.exe
  2⤵
  PID:6504
- C:\Windows\System\WpDRBFE.exe
  C:\Windows\System\WpDRBFE.exe
  2⤵
  PID:5220
- C:\Windows\System\PCcVwqp.exe
  C:\Windows\System\PCcVwqp.exe
  2⤵
  PID:5340
- C:\Windows\System\DlDmfnz.exe
  C:\Windows\System\DlDmfnz.exe
  2⤵
  PID:5384
- C:\Windows\System\LcFrqCK.exe
  C:\Windows\System\LcFrqCK.exe
  2⤵
  PID:5432
- C:\Windows\System\dihTaBp.exe
  C:\Windows\System\dihTaBp.exe
  2⤵
  PID:5836
- C:\Windows\System\siwsrAB.exe
  C:\Windows\System\siwsrAB.exe
  2⤵
  PID:5732
- C:\Windows\System\JCzdPEy.exe
  C:\Windows\System\JCzdPEy.exe
  2⤵
  PID:5652
- C:\Windows\System\yvakArJ.exe
  C:\Windows\System\yvakArJ.exe
  2⤵
  PID:5920
- C:\Windows\System\ghsTUnv.exe
  C:\Windows\System\ghsTUnv.exe
  2⤵
  PID:5968
- C:\Windows\System\iyMkLFd.exe
  C:\Windows\System\iyMkLFd.exe
  2⤵
  PID:6088
- C:\Windows\System\RzYzGEu.exe
  C:\Windows\System\RzYzGEu.exe
  2⤵
  PID:3256
- C:\Windows\System\mRVGuTm.exe
  C:\Windows\System\mRVGuTm.exe
  2⤵
  PID:6204
- C:\Windows\System\gRbhCBc.exe
  C:\Windows\System\gRbhCBc.exe
  2⤵
  PID:6268
- C:\Windows\System\utWlGBJ.exe
  C:\Windows\System\utWlGBJ.exe
  2⤵
  PID:6308
- C:\Windows\System\wVsOMpX.exe
  C:\Windows\System\wVsOMpX.exe
  2⤵
  PID:6376
- C:\Windows\System\GTFtIoZ.exe
  C:\Windows\System\GTFtIoZ.exe
  2⤵
  PID:6440
- C:\Windows\System\AALIQSl.exe
  C:\Windows\System\AALIQSl.exe
  2⤵
  PID:6512
- C:\Windows\System\VLIVzya.exe
  C:\Windows\System\VLIVzya.exe
  2⤵
  PID:6460
- C:\Windows\System\WkHkQAL.exe
  C:\Windows\System\WkHkQAL.exe
  2⤵
  PID:6544
- C:\Windows\System\zjPphNZ.exe
  C:\Windows\System\zjPphNZ.exe
  2⤵
  PID:6540
- C:\Windows\System\brkqfRg.exe
  C:\Windows\System\brkqfRg.exe
  2⤵
  PID:6624
- C:\Windows\System\gLJgHkU.exe
  C:\Windows\System\gLJgHkU.exe
  2⤵
  PID:6720
- C:\Windows\System\xEVNzQm.exe
  C:\Windows\System\xEVNzQm.exe
  2⤵
  PID:6780
- C:\Windows\System\RDCWjeF.exe
  C:\Windows\System\RDCWjeF.exe
  2⤵
  PID:6844
- C:\Windows\System\dOvlyuL.exe
  C:\Windows\System\dOvlyuL.exe
  2⤵
  PID:6912
- C:\Windows\System\cMUjRTR.exe
  C:\Windows\System\cMUjRTR.exe
  2⤵
  PID:6980
- C:\Windows\System\gtJJIUt.exe
  C:\Windows\System\gtJJIUt.exe
  2⤵
  PID:7048
- C:\Windows\System\vTGRFpG.exe
  C:\Windows\System\vTGRFpG.exe
  2⤵
  PID:7116
- C:\Windows\System\SoDgOHM.exe
  C:\Windows\System\SoDgOHM.exe
  2⤵
  PID:7160
- C:\Windows\System\FXsTPZq.exe
  C:\Windows\System\FXsTPZq.exe
  2⤵
  PID:6600
- C:\Windows\System\mpxjTpy.exe
  C:\Windows\System\mpxjTpy.exe
  2⤵
  PID:6736
- C:\Windows\System\DtGzuUg.exe
  C:\Windows\System\DtGzuUg.exe
  2⤵
  PID:7028
- C:\Windows\System\gMcLUZq.exe
  C:\Windows\System\gMcLUZq.exe
  2⤵
  PID:6564
- C:\Windows\System\iYYKrUL.exe
  C:\Windows\System\iYYKrUL.exe
  2⤵
  PID:6640
- C:\Windows\System\IoyYKdI.exe
  C:\Windows\System\IoyYKdI.exe
  2⤵
  PID:6732
- C:\Windows\System\OhefXrD.exe
  C:\Windows\System\OhefXrD.exe
  2⤵
  PID:6800
- C:\Windows\System\xJFVmCc.exe
  C:\Windows\System\xJFVmCc.exe
  2⤵
  PID:6896
- C:\Windows\System\vkHnxkg.exe
  C:\Windows\System\vkHnxkg.exe
  2⤵
  PID:6964
- C:\Windows\System\hSUaLyo.exe
  C:\Windows\System\hSUaLyo.exe
  2⤵
  PID:7032
- C:\Windows\System\vkFSyzG.exe
  C:\Windows\System\vkFSyzG.exe
  2⤵
  PID:7104
- C:\Windows\System\MHXJlea.exe
  C:\Windows\System\MHXJlea.exe
  2⤵
  PID:5668
- C:\Windows\System\RxjMpOG.exe
  C:\Windows\System\RxjMpOG.exe
  2⤵
  PID:6052
- C:\Windows\System\uoUIzlw.exe
  C:\Windows\System\uoUIzlw.exe
  2⤵
  PID:5324
- C:\Windows\System\VgVlBTd.exe
  C:\Windows\System\VgVlBTd.exe
  2⤵
  PID:6156
- C:\Windows\System\ahjANQT.exe
  C:\Windows\System\ahjANQT.exe
  2⤵
  PID:6328
- C:\Windows\System\PxxHvXn.exe
  C:\Windows\System\PxxHvXn.exe
  2⤵
  PID:4528
- C:\Windows\System\FCaOffV.exe
  C:\Windows\System\FCaOffV.exe
  2⤵
  PID:6424
- C:\Windows\System\wAVcMZA.exe
  C:\Windows\System\wAVcMZA.exe
  2⤵
  PID:5104
- C:\Windows\System\MqPTWHL.exe
  C:\Windows\System\MqPTWHL.exe
  2⤵
  PID:4472
- C:\Windows\System\osxONqS.exe
  C:\Windows\System\osxONqS.exe
  2⤵
  PID:5704
- C:\Windows\System\KrRDepN.exe
  C:\Windows\System\KrRDepN.exe
  2⤵
  PID:5976
- C:\Windows\System\fXwHrkA.exe
  C:\Windows\System\fXwHrkA.exe
  2⤵
  PID:6240
- C:\Windows\System\lepaxVg.exe
  C:\Windows\System\lepaxVg.exe
  2⤵
  PID:6168
- C:\Windows\System\RneDeRh.exe
  C:\Windows\System\RneDeRh.exe
  2⤵
  PID:5908
- C:\Windows\System\FcIoudw.exe
  C:\Windows\System\FcIoudw.exe
  2⤵
  PID:5488
- C:\Windows\System\HuTaGOR.exe
  C:\Windows\System\HuTaGOR.exe
  2⤵
  PID:6304
- C:\Windows\System\YqsXgwa.exe
  C:\Windows\System\YqsXgwa.exe
  2⤵
  PID:6488
- C:\Windows\System\LBkqDMB.exe
  C:\Windows\System\LBkqDMB.exe
  2⤵
  PID:6652
- C:\Windows\System\AXkguZE.exe
  C:\Windows\System\AXkguZE.exe
  2⤵
  PID:6948
- C:\Windows\System\PQuTQQW.exe
  C:\Windows\System\PQuTQQW.exe
  2⤵
  PID:5360
- C:\Windows\System\hiZwZFn.exe
  C:\Windows\System\hiZwZFn.exe
  2⤵
  PID:7124
- C:\Windows\System\qifiIEk.exe
  C:\Windows\System\qifiIEk.exe
  2⤵
  PID:6552
- C:\Windows\System\NdcRGZt.exe
  C:\Windows\System\NdcRGZt.exe
  2⤵
  PID:6716
- C:\Windows\System\wHesjlH.exe
  C:\Windows\System\wHesjlH.exe
  2⤵
  PID:6832
- C:\Windows\System\sCuNVZY.exe
  C:\Windows\System\sCuNVZY.exe
  2⤵
  PID:6952
- C:\Windows\System\ahUAJDq.exe
  C:\Windows\System\ahUAJDq.exe
  2⤵
  PID:6928
- C:\Windows\System\paTzlfq.exe
  C:\Windows\System\paTzlfq.exe
  2⤵
  PID:5960
- C:\Windows\System\GfvyYwL.exe
  C:\Windows\System\GfvyYwL.exe
  2⤵
  PID:7072
- C:\Windows\System\wRLeEkS.exe
  C:\Windows\System\wRLeEkS.exe
  2⤵
  PID:5300
- C:\Windows\System\jHhEzLw.exe
  C:\Windows\System\jHhEzLw.exe
  2⤵
  PID:6936
- C:\Windows\System\wdqMIoS.exe
  C:\Windows\System\wdqMIoS.exe
  2⤵
  PID:5620
- C:\Windows\System\MMfcIrM.exe
  C:\Windows\System\MMfcIrM.exe
  2⤵
  PID:6020
- C:\Windows\System\MKgEjGt.exe
  C:\Windows\System\MKgEjGt.exe
  2⤵
  PID:5872
- C:\Windows\System\xxGqUpi.exe
  C:\Windows\System\xxGqUpi.exe
  2⤵
  PID:6876
- C:\Windows\System\vqJYFUa.exe
  C:\Windows\System\vqJYFUa.exe
  2⤵
  PID:5948
- C:\Windows\System\FJcHHVC.exe
  C:\Windows\System\FJcHHVC.exe
  2⤵
  PID:5136
- C:\Windows\System\bImjdrv.exe
  C:\Windows\System\bImjdrv.exe
  2⤵
  PID:4880
- C:\Windows\System\iUhklUH.exe
  C:\Windows\System\iUhklUH.exe
  2⤵
  PID:6584
- C:\Windows\System\kZxeSoC.exe
  C:\Windows\System\kZxeSoC.exe
  2⤵
  PID:6172
- C:\Windows\System\KnPyORf.exe
  C:\Windows\System\KnPyORf.exe
  2⤵
  PID:6752
- C:\Windows\System\BiBhzLO.exe
  C:\Windows\System\BiBhzLO.exe
  2⤵
  PID:6816
- C:\Windows\System\jTEnVNS.exe
  C:\Windows\System\jTEnVNS.exe
  2⤵
  PID:7000
- C:\Windows\System\LnVIYLu.exe
  C:\Windows\System\LnVIYLu.exe
  2⤵
  PID:5204
- C:\Windows\System\rYInfhc.exe
  C:\Windows\System\rYInfhc.exe
  2⤵
  PID:5288
- C:\Windows\System\wdkZTsp.exe
  C:\Windows\System\wdkZTsp.exe
  2⤵
  PID:6288
- C:\Windows\System\lOnUjuS.exe
  C:\Windows\System\lOnUjuS.exe
  2⤵
  PID:5412
- C:\Windows\System\SWrPkgs.exe
  C:\Windows\System\SWrPkgs.exe
  2⤵
  PID:6688
- C:\Windows\System\HTQBVYo.exe
  C:\Windows\System\HTQBVYo.exe
  2⤵
  PID:6360
- C:\Windows\System\GBZMISL.exe
  C:\Windows\System\GBZMISL.exe
  2⤵
  PID:6236
- C:\Windows\System\mZchEZC.exe
  C:\Windows\System\mZchEZC.exe
  2⤵
  PID:6324
- C:\Windows\System\ZpborqV.exe
  C:\Windows\System\ZpborqV.exe
  2⤵
  PID:5248
- C:\Windows\System\iQHfckm.exe
  C:\Windows\System\iQHfckm.exe
  2⤵
  PID:5396
- C:\Windows\System\eHIWfUQ.exe
  C:\Windows\System\eHIWfUQ.exe
  2⤵
  PID:7184
- C:\Windows\System\baQHIpH.exe
  C:\Windows\System\baQHIpH.exe
  2⤵
  PID:7200
- C:\Windows\System\UaZOUei.exe
  C:\Windows\System\UaZOUei.exe
  2⤵
  PID:7216
- C:\Windows\System\mpRGImR.exe
  C:\Windows\System\mpRGImR.exe
  2⤵
  PID:7232
- C:\Windows\System\rtNIYRa.exe
  C:\Windows\System\rtNIYRa.exe
  2⤵
  PID:7248
- C:\Windows\System\IjPwsXY.exe
  C:\Windows\System\IjPwsXY.exe
  2⤵
  PID:7344
- C:\Windows\System\qfnWiRG.exe
  C:\Windows\System\qfnWiRG.exe
  2⤵
  PID:7360
- C:\Windows\System\dlMZuMZ.exe
  C:\Windows\System\dlMZuMZ.exe
  2⤵
  PID:7380
- C:\Windows\System\wnpqONL.exe
  C:\Windows\System\wnpqONL.exe
  2⤵
  PID:7396
- C:\Windows\System\UEboXci.exe
  C:\Windows\System\UEboXci.exe
  2⤵
  PID:7412
- C:\Windows\System\SYdXaGC.exe
  C:\Windows\System\SYdXaGC.exe
  2⤵
  PID:7440
- C:\Windows\System\mTnagPH.exe
  C:\Windows\System\mTnagPH.exe
  2⤵
  PID:7460
- C:\Windows\System\QSqFwWN.exe
  C:\Windows\System\QSqFwWN.exe
  2⤵
  PID:7476
- C:\Windows\System\VyyLHJR.exe
  C:\Windows\System\VyyLHJR.exe
  2⤵
  PID:7496
- C:\Windows\System\wvTXkyt.exe
  C:\Windows\System\wvTXkyt.exe
  2⤵
  PID:7512
- C:\Windows\System\eIuYFVb.exe
  C:\Windows\System\eIuYFVb.exe
  2⤵
  PID:7532
- C:\Windows\System\UxtNvAK.exe
  C:\Windows\System\UxtNvAK.exe
  2⤵
  PID:7548
- C:\Windows\System\qZRdLAh.exe
  C:\Windows\System\qZRdLAh.exe
  2⤵
  PID:7564
- C:\Windows\System\CPDCAcx.exe
  C:\Windows\System\CPDCAcx.exe
  2⤵
  PID:7580
- C:\Windows\System\wzCLZLp.exe
  C:\Windows\System\wzCLZLp.exe
  2⤵
  PID:7596
- C:\Windows\System\HzafXNH.exe
  C:\Windows\System\HzafXNH.exe
  2⤵
  PID:7612
- C:\Windows\System\NcsDPKO.exe
  C:\Windows\System\NcsDPKO.exe
  2⤵
  PID:7628
- C:\Windows\System\PFQcDXS.exe
  C:\Windows\System\PFQcDXS.exe
  2⤵
  PID:7644
- C:\Windows\System\bqllNXQ.exe
  C:\Windows\System\bqllNXQ.exe
  2⤵
  PID:7668
- C:\Windows\System\Emipzig.exe
  C:\Windows\System\Emipzig.exe
  2⤵
  PID:7684
- C:\Windows\System\wpCBRLS.exe
  C:\Windows\System\wpCBRLS.exe
  2⤵
  PID:7700
- C:\Windows\System\cxllxxV.exe
  C:\Windows\System\cxllxxV.exe
  2⤵
  PID:7720
- C:\Windows\System\CQqqJQu.exe
  C:\Windows\System\CQqqJQu.exe
  2⤵
  PID:7736
- C:\Windows\System\tPOubbm.exe
  C:\Windows\System\tPOubbm.exe
  2⤵
  PID:7828
- C:\Windows\System\GkBpnaU.exe
  C:\Windows\System\GkBpnaU.exe
  2⤵
  PID:7844
- C:\Windows\System\snsCJMI.exe
  C:\Windows\System\snsCJMI.exe
  2⤵
  PID:7860
- C:\Windows\System\fMVgyLx.exe
  C:\Windows\System\fMVgyLx.exe
  2⤵
  PID:7876
- C:\Windows\System\YMmlacv.exe
  C:\Windows\System\YMmlacv.exe
  2⤵
  PID:7892
- C:\Windows\System\kuYphOz.exe
  C:\Windows\System\kuYphOz.exe
  2⤵
  PID:7908
- C:\Windows\System\uYUgDgj.exe
  C:\Windows\System\uYUgDgj.exe
  2⤵
  PID:7924
- C:\Windows\System\WzPeVko.exe
  C:\Windows\System\WzPeVko.exe
  2⤵
  PID:7940
- C:\Windows\System\FvCpjlz.exe
  C:\Windows\System\FvCpjlz.exe
  2⤵
  PID:7956
- C:\Windows\System\bQRFyfn.exe
  C:\Windows\System\bQRFyfn.exe
  2⤵
  PID:7972
- C:\Windows\System\IAeKiWK.exe
  C:\Windows\System\IAeKiWK.exe
  2⤵
  PID:7988
- C:\Windows\System\FdRhAzq.exe
  C:\Windows\System\FdRhAzq.exe
  2⤵
  PID:8004
- C:\Windows\System\TBTbhLj.exe
  C:\Windows\System\TBTbhLj.exe
  2⤵
  PID:8020
- C:\Windows\System\tWjoPbx.exe
  C:\Windows\System\tWjoPbx.exe
  2⤵
  PID:8036
- C:\Windows\System\znoCatz.exe
  C:\Windows\System\znoCatz.exe
  2⤵
  PID:8052
- C:\Windows\System\sueBoSo.exe
  C:\Windows\System\sueBoSo.exe
  2⤵
  PID:8076
- C:\Windows\System\ADPgzgd.exe
  C:\Windows\System\ADPgzgd.exe
  2⤵
  PID:8092
- C:\Windows\System\CkfqPHr.exe
  C:\Windows\System\CkfqPHr.exe
  2⤵
  PID:8108
- C:\Windows\System\zFviOrL.exe
  C:\Windows\System\zFviOrL.exe
  2⤵
  PID:8124
- C:\Windows\System\IYfjCTD.exe
  C:\Windows\System\IYfjCTD.exe
  2⤵
  PID:8140
- C:\Windows\System\IsfCTfu.exe
  C:\Windows\System\IsfCTfu.exe
  2⤵
  PID:8156
- C:\Windows\System\hVJGigL.exe
  C:\Windows\System\hVJGigL.exe
  2⤵
  PID:8176
- C:\Windows\System\QouZowf.exe
  C:\Windows\System\QouZowf.exe
  2⤵
  PID:7176
- C:\Windows\System\oHbMrEg.exe
  C:\Windows\System\oHbMrEg.exe
  2⤵
  PID:7084
- C:\Windows\System\anrrjAW.exe
  C:\Windows\System\anrrjAW.exe
  2⤵
  PID:6768
- C:\Windows\System\qPWaHmS.exe
  C:\Windows\System\qPWaHmS.exe
  2⤵
  PID:6704
- C:\Windows\System\RgNiTtu.exe
  C:\Windows\System\RgNiTtu.exe
  2⤵
  PID:7224
- C:\Windows\System\bAdtaeJ.exe
  C:\Windows\System\bAdtaeJ.exe
  2⤵
  PID:7256
- C:\Windows\System\XXuCKdj.exe
  C:\Windows\System\XXuCKdj.exe
  2⤵
  PID:7276
- C:\Windows\System\FQBXEIN.exe
  C:\Windows\System\FQBXEIN.exe
  2⤵
  PID:7292
- C:\Windows\System\LeOtiYs.exe
  C:\Windows\System\LeOtiYs.exe
  2⤵
  PID:7304
- C:\Windows\System\KKdSieD.exe
  C:\Windows\System\KKdSieD.exe
  2⤵
  PID:7324
- C:\Windows\System\SLvsXPc.exe
  C:\Windows\System\SLvsXPc.exe
  2⤵
  PID:7352
- C:\Windows\System\eHiAGez.exe
  C:\Windows\System\eHiAGez.exe
  2⤵
  PID:7420
- C:\Windows\System\jVaJeKN.exe
  C:\Windows\System\jVaJeKN.exe
  2⤵
  PID:7436
- C:\Windows\System\sQUiFfH.exe
  C:\Windows\System\sQUiFfH.exe
  2⤵
  PID:7508
- C:\Windows\System\XWLSEUk.exe
  C:\Windows\System\XWLSEUk.exe
  2⤵
  PID:7576
- C:\Windows\System\NrRiFpD.exe
  C:\Windows\System\NrRiFpD.exe
  2⤵
  PID:7640
- C:\Windows\System\EjBsVgw.exe
  C:\Windows\System\EjBsVgw.exe
  2⤵
  PID:7404
- C:\Windows\System\OmRveHR.exe
  C:\Windows\System\OmRveHR.exe
  2⤵
  PID:7456
- C:\Windows\System\VEbmoGY.exe
  C:\Windows\System\VEbmoGY.exe
  2⤵
  PID:7656
- C:\Windows\System\vSrTwos.exe
  C:\Windows\System\vSrTwos.exe
  2⤵
  PID:7560
- C:\Windows\System\GwbllbP.exe
  C:\Windows\System\GwbllbP.exe
  2⤵
  PID:7340
- C:\Windows\System\zcuoCpl.exe
  C:\Windows\System\zcuoCpl.exe
  2⤵
  PID:7520
- C:\Windows\System\ohOzBCP.exe
  C:\Windows\System\ohOzBCP.exe
  2⤵
  PID:7620
- C:\Windows\System\DCPeXAy.exe
  C:\Windows\System\DCPeXAy.exe
  2⤵
  PID:7696
- C:\Windows\System\LxlLeIr.exe
  C:\Windows\System\LxlLeIr.exe
  2⤵
  PID:7748
- C:\Windows\System\XnDxiNl.exe
  C:\Windows\System\XnDxiNl.exe
  2⤵
  PID:7764
- C:\Windows\System\HUuJkfu.exe
  C:\Windows\System\HUuJkfu.exe
  2⤵
  PID:7800
- C:\Windows\System\OIgYEzd.exe
  C:\Windows\System\OIgYEzd.exe
  2⤵
  PID:7812
- C:\Windows\System\imJhdGy.exe
  C:\Windows\System\imJhdGy.exe
  2⤵
  PID:7788
- C:\Windows\System\WmLWWbM.exe
  C:\Windows\System\WmLWWbM.exe
  2⤵
  PID:7996
- C:\Windows\System\UJJzRZu.exe
  C:\Windows\System\UJJzRZu.exe
  2⤵
  PID:8072
- C:\Windows\System\tcJnRzH.exe
  C:\Windows\System\tcJnRzH.exe
  2⤵
  PID:7868
- C:\Windows\System\BXUhznr.exe
  C:\Windows\System\BXUhznr.exe
  2⤵
  PID:7900
- C:\Windows\System\UIRICsj.exe
  C:\Windows\System\UIRICsj.exe
  2⤵
  PID:7884
- C:\Windows\System\Jgmeqea.exe
  C:\Windows\System\Jgmeqea.exe
  2⤵
  PID:7916
- C:\Windows\System\OdJVMkq.exe
  C:\Windows\System\OdJVMkq.exe
  2⤵
  PID:7984
- C:\Windows\System\WrGfoQs.exe
  C:\Windows\System\WrGfoQs.exe
  2⤵
  PID:8084
- C:\Windows\System\KKnypmy.exe
  C:\Windows\System\KKnypmy.exe
  2⤵
  PID:8148
- C:\Windows\System\rLZvEPL.exe
  C:\Windows\System\rLZvEPL.exe
  2⤵
  PID:6596
- C:\Windows\System\lbWaAeI.exe
  C:\Windows\System\lbWaAeI.exe
  2⤵
  PID:6276
- C:\Windows\System\GBadyWw.exe
  C:\Windows\System\GBadyWw.exe
  2⤵
  PID:7196
- C:\Windows\System\ZyQcwtE.exe
  C:\Windows\System\ZyQcwtE.exe
  2⤵
  PID:7268
- C:\Windows\System\hOBpvGN.exe
  C:\Windows\System\hOBpvGN.exe
  2⤵
  PID:7300
- C:\Windows\System\zYARCSj.exe
  C:\Windows\System\zYARCSj.exe
  2⤵
  PID:7212
- C:\Windows\System\kUvNGNE.exe
  C:\Windows\System\kUvNGNE.exe
  2⤵
  PID:6700
- C:\Windows\System\PXMYBnl.exe
  C:\Windows\System\PXMYBnl.exe
  2⤵
  PID:7572
- C:\Windows\System\fwNQupL.exe
  C:\Windows\System\fwNQupL.exe
  2⤵
  PID:7208
- C:\Windows\System\JElUcIT.exe
  C:\Windows\System\JElUcIT.exe
  2⤵
  PID:7320
- C:\Windows\System\OqYGttW.exe
  C:\Windows\System\OqYGttW.exe
  2⤵
  PID:7280
- C:\Windows\System\gpGNmnR.exe
  C:\Windows\System\gpGNmnR.exe
  2⤵
  PID:7472
- C:\Windows\System\wOSQrHB.exe
  C:\Windows\System\wOSQrHB.exe
  2⤵
  PID:7452
- C:\Windows\System\RQhfydQ.exe
  C:\Windows\System\RQhfydQ.exe
  2⤵
  PID:7528
- C:\Windows\System\oeTyysW.exe
  C:\Windows\System\oeTyysW.exe
  2⤵
  PID:7744
- C:\Windows\System\OqAjgqz.exe
  C:\Windows\System\OqAjgqz.exe
  2⤵
  PID:7776
- C:\Windows\System\EOumqwt.exe
  C:\Windows\System\EOumqwt.exe
  2⤵
  PID:7856
- C:\Windows\System\msFzVfs.exe
  C:\Windows\System\msFzVfs.exe
  2⤵
  PID:7624
- C:\Windows\System\NHvEczu.exe
  C:\Windows\System\NHvEczu.exe
  2⤵
  PID:8048
- C:\Windows\System\lQLsmfb.exe
  C:\Windows\System\lQLsmfb.exe
  2⤵
  PID:7824
- C:\Windows\System\KWrIQov.exe
  C:\Windows\System\KWrIQov.exe
  2⤵
  PID:7272
- C:\Windows\System\YFSEeUp.exe
  C:\Windows\System\YFSEeUp.exe
  2⤵
  PID:7288
- C:\Windows\System\QRQGCAo.exe
  C:\Windows\System\QRQGCAo.exe
  2⤵
  PID:7760
- C:\Windows\System\pNuPZOa.exe
  C:\Windows\System\pNuPZOa.exe
  2⤵
  PID:7840
- C:\Windows\System\WMOHxuB.exe
  C:\Windows\System\WMOHxuB.exe
  2⤵
  PID:8172
- C:\Windows\System\LhBkQAV.exe
  C:\Windows\System\LhBkQAV.exe
  2⤵
  PID:7952
- C:\Windows\System\AJTdXIV.exe
  C:\Windows\System\AJTdXIV.exe
  2⤵
  PID:8044
- C:\Windows\System\PzlwKiO.exe
  C:\Windows\System\PzlwKiO.exe
  2⤵
  PID:7708
- C:\Windows\System\ViEIInj.exe
  C:\Windows\System\ViEIInj.exe
  2⤵
  PID:7392
- C:\Windows\System\aZeTTKu.exe
  C:\Windows\System\aZeTTKu.exe
  2⤵
  PID:7448
- C:\Windows\System\lIPKlFJ.exe
  C:\Windows\System\lIPKlFJ.exe
  2⤵
  PID:8032
- C:\Windows\System\NaHOuEb.exe
  C:\Windows\System\NaHOuEb.exe
  2⤵
  PID:8016
- C:\Windows\System\nSmocck.exe
  C:\Windows\System\nSmocck.exe
  2⤵
  PID:8060
- C:\Windows\System\IBXGmsz.exe
  C:\Windows\System\IBXGmsz.exe
  2⤵
  PID:7428
- C:\Windows\System\TiFrVNp.exe
  C:\Windows\System\TiFrVNp.exe
  2⤵
  PID:8164
- C:\Windows\System\vDTAnaz.exe
  C:\Windows\System\vDTAnaz.exe
  2⤵
  PID:8120
- C:\Windows\System\hEGezVY.exe
  C:\Windows\System\hEGezVY.exe
  2⤵
  PID:8064
- C:\Windows\System\PBSNuNQ.exe
  C:\Windows\System\PBSNuNQ.exe
  2⤵
  PID:7608
- C:\Windows\System\aOvrbht.exe
  C:\Windows\System\aOvrbht.exe
  2⤵
  PID:7636
- C:\Windows\System\RmNTXTj.exe
  C:\Windows\System\RmNTXTj.exe
  2⤵
  PID:7780
- C:\Windows\System\FJhvgXM.exe
  C:\Windows\System\FJhvgXM.exe
  2⤵
  PID:7820
- C:\Windows\System\lOmRABg.exe
  C:\Windows\System\lOmRABg.exe
  2⤵
  PID:7432
- C:\Windows\System\EdhKUnk.exe
  C:\Windows\System\EdhKUnk.exe
  2⤵
  PID:1572
- C:\Windows\System\wYTZSLK.exe
  C:\Windows\System\wYTZSLK.exe
  2⤵
  PID:7336
- C:\Windows\System\zSxTqfw.exe
  C:\Windows\System\zSxTqfw.exe
  2⤵
  PID:8196
- C:\Windows\System\EGCFXzu.exe
  C:\Windows\System\EGCFXzu.exe
  2⤵
  PID:8212
- C:\Windows\System\CMlyDIV.exe
  C:\Windows\System\CMlyDIV.exe
  2⤵
  PID:8228
- C:\Windows\System\IWlWTaI.exe
  C:\Windows\System\IWlWTaI.exe
  2⤵
  PID:8244
- C:\Windows\System\lEGXDzS.exe
  C:\Windows\System\lEGXDzS.exe
  2⤵
  PID:8260
- C:\Windows\System\SnbPTsU.exe
  C:\Windows\System\SnbPTsU.exe
  2⤵
  PID:8276
- C:\Windows\System\mJuywuZ.exe
  C:\Windows\System\mJuywuZ.exe
  2⤵
  PID:8292
- C:\Windows\System\gkNEGpy.exe
  C:\Windows\System\gkNEGpy.exe
  2⤵
  PID:8308
- C:\Windows\System\JwdleVV.exe
  C:\Windows\System\JwdleVV.exe
  2⤵
  PID:8324
- C:\Windows\System\UromVfY.exe
  C:\Windows\System\UromVfY.exe
  2⤵
  PID:8340
- C:\Windows\System\BGVIton.exe
  C:\Windows\System\BGVIton.exe
  2⤵
  PID:8356
- C:\Windows\System\dHFMgiK.exe
  C:\Windows\System\dHFMgiK.exe
  2⤵
  PID:8372
- C:\Windows\System\MKAXemN.exe
  C:\Windows\System\MKAXemN.exe
  2⤵
  PID:8388
- C:\Windows\System\aJBdLRS.exe
  C:\Windows\System\aJBdLRS.exe
  2⤵
  PID:8404
- C:\Windows\System\khtELNz.exe
  C:\Windows\System\khtELNz.exe
  2⤵
  PID:8420
- C:\Windows\System\OxmPJDF.exe
  C:\Windows\System\OxmPJDF.exe
  2⤵
  PID:8436
- C:\Windows\System\CPStexq.exe
  C:\Windows\System\CPStexq.exe
  2⤵
  PID:8452
- C:\Windows\System\tuYxkWO.exe
  C:\Windows\System\tuYxkWO.exe
  2⤵
  PID:8472
- C:\Windows\System\eupbwou.exe
  C:\Windows\System\eupbwou.exe
  2⤵
  PID:8488
- C:\Windows\System\IiobZWS.exe
  C:\Windows\System\IiobZWS.exe
  2⤵
  PID:8504
- C:\Windows\System\fwuBDSP.exe
  C:\Windows\System\fwuBDSP.exe
  2⤵
  PID:8520
- C:\Windows\System\CuSTlGJ.exe
  C:\Windows\System\CuSTlGJ.exe
  2⤵
  PID:8536
- C:\Windows\System\QADIQPF.exe
  C:\Windows\System\QADIQPF.exe
  2⤵
  PID:8552
- C:\Windows\System\qtvvqcd.exe
  C:\Windows\System\qtvvqcd.exe
  2⤵
  PID:8568
- C:\Windows\System\AQHDIqu.exe
  C:\Windows\System\AQHDIqu.exe
  2⤵
  PID:8584
- C:\Windows\System\UheCVgm.exe
  C:\Windows\System\UheCVgm.exe
  2⤵
  PID:8600
- C:\Windows\System\mFDjPVE.exe
  C:\Windows\System\mFDjPVE.exe
  2⤵
  PID:8616
- C:\Windows\System\KIzoSrE.exe
  C:\Windows\System\KIzoSrE.exe
  2⤵
  PID:8636
- C:\Windows\System\ETxUaNQ.exe
  C:\Windows\System\ETxUaNQ.exe
  2⤵
  PID:8652
- C:\Windows\System\dBNznrW.exe
  C:\Windows\System\dBNznrW.exe
  2⤵
  PID:8672
- C:\Windows\System\aaMopuU.exe
  C:\Windows\System\aaMopuU.exe
  2⤵
  PID:8688
- C:\Windows\System\wfceaAh.exe
  C:\Windows\System\wfceaAh.exe
  2⤵
  PID:8704
- C:\Windows\System\jHKSnEQ.exe
  C:\Windows\System\jHKSnEQ.exe
  2⤵
  PID:8720
- C:\Windows\System\UVfkxCl.exe
  C:\Windows\System\UVfkxCl.exe
  2⤵
  PID:8736
- C:\Windows\System\tmiDyMV.exe
  C:\Windows\System\tmiDyMV.exe
  2⤵
  PID:8752
- C:\Windows\System\DpeFSOv.exe
  C:\Windows\System\DpeFSOv.exe
  2⤵
  PID:8768
- C:\Windows\System\JTfeRrD.exe
  C:\Windows\System\JTfeRrD.exe
  2⤵
  PID:8788
- C:\Windows\System\PkQWYzt.exe
  C:\Windows\System\PkQWYzt.exe
  2⤵
  PID:8808
- C:\Windows\System\KzCuZlA.exe
  C:\Windows\System\KzCuZlA.exe
  2⤵
  PID:8824
- C:\Windows\System\MPKFArb.exe
  C:\Windows\System\MPKFArb.exe
  2⤵
  PID:8840
- C:\Windows\System\wnSjWMA.exe
  C:\Windows\System\wnSjWMA.exe
  2⤵
  PID:8856
- C:\Windows\System\vSGTorK.exe
  C:\Windows\System\vSGTorK.exe
  2⤵
  PID:8872
- C:\Windows\System\iWbcysR.exe
  C:\Windows\System\iWbcysR.exe
  2⤵
  PID:8888
- C:\Windows\System\tCSXuZE.exe
  C:\Windows\System\tCSXuZE.exe
  2⤵
  PID:8904
- C:\Windows\System\ppHmxcZ.exe
  C:\Windows\System\ppHmxcZ.exe
  2⤵
  PID:8920
- C:\Windows\System\AMxmOGt.exe
  C:\Windows\System\AMxmOGt.exe
  2⤵
  PID:8936
- C:\Windows\System\uEITkmO.exe
  C:\Windows\System\uEITkmO.exe
  2⤵
  PID:8952
- C:\Windows\System\LoBJJWQ.exe
  C:\Windows\System\LoBJJWQ.exe
  2⤵
  PID:8968
- C:\Windows\System\AsGcrGf.exe
  C:\Windows\System\AsGcrGf.exe
  2⤵
  PID:8984
- C:\Windows\System\vCQuTQu.exe
  C:\Windows\System\vCQuTQu.exe
  2⤵
  PID:9000
- C:\Windows\System\lWcDLUp.exe
  C:\Windows\System\lWcDLUp.exe
  2⤵
  PID:9016
- C:\Windows\System\feQnfSo.exe
  C:\Windows\System\feQnfSo.exe
  2⤵
  PID:9032
- C:\Windows\System\IlZsdbO.exe
  C:\Windows\System\IlZsdbO.exe
  2⤵
  PID:9048
- C:\Windows\System\qMxhpsy.exe
  C:\Windows\System\qMxhpsy.exe
  2⤵
  PID:9064
- C:\Windows\System\mTsUmjm.exe
  C:\Windows\System\mTsUmjm.exe
  2⤵
  PID:9080
- C:\Windows\System\IkssHAO.exe
  C:\Windows\System\IkssHAO.exe
  2⤵
  PID:9096
- C:\Windows\System\cnBFknW.exe
  C:\Windows\System\cnBFknW.exe
  2⤵
  PID:9112
- C:\Windows\System\mgIkSDu.exe
  C:\Windows\System\mgIkSDu.exe
  2⤵
  PID:9140
- C:\Windows\System\HITLHON.exe
  C:\Windows\System\HITLHON.exe
  2⤵
  PID:9156
- C:\Windows\System\ZaeJWTB.exe
  C:\Windows\System\ZaeJWTB.exe
  2⤵
  PID:9172
- C:\Windows\System\cGtDPoR.exe
  C:\Windows\System\cGtDPoR.exe
  2⤵
  PID:9192
- C:\Windows\System\FkPPcns.exe
  C:\Windows\System\FkPPcns.exe
  2⤵
  PID:9208
- C:\Windows\System\HLtMQST.exe
  C:\Windows\System\HLtMQST.exe
  2⤵
  PID:7592
- C:\Windows\System\OSYtWJD.exe
  C:\Windows\System\OSYtWJD.exe
  2⤵
  PID:8252
- C:\Windows\System\vbjzhNj.exe
  C:\Windows\System\vbjzhNj.exe
  2⤵
  PID:8316
- C:\Windows\System\VXvgiRD.exe
  C:\Windows\System\VXvgiRD.exe
  2⤵
  PID:8240
- C:\Windows\System\waBpQPT.exe
  C:\Windows\System\waBpQPT.exe
  2⤵
  PID:8208
- C:\Windows\System\gOUQWNc.exe
  C:\Windows\System\gOUQWNc.exe
  2⤵
  PID:8304
- C:\Windows\System\cIAscSG.exe
  C:\Windows\System\cIAscSG.exe
  2⤵
  PID:8396
- C:\Windows\System\kTvfNdk.exe
  C:\Windows\System\kTvfNdk.exe
  2⤵
  PID:8412
- C:\Windows\System\BUTOqdu.exe
  C:\Windows\System\BUTOqdu.exe
  2⤵
  PID:8480
- C:\Windows\System\rtRqhxQ.exe
  C:\Windows\System\rtRqhxQ.exe
  2⤵
  PID:8544
- C:\Windows\System\OLBQdwr.exe
  C:\Windows\System\OLBQdwr.exe
  2⤵
  PID:8608
- C:\Windows\System\jiOyoVH.exe
  C:\Windows\System\jiOyoVH.exe
  2⤵
  PID:8680
- C:\Windows\System\yrvQcpA.exe
  C:\Windows\System\yrvQcpA.exe
  2⤵
  PID:8500
- C:\Windows\System\LSCdzyr.exe
  C:\Windows\System\LSCdzyr.exe
  2⤵
  PID:8432
- C:\Windows\System\Wfwpmhx.exe
  C:\Windows\System\Wfwpmhx.exe
  2⤵
  PID:8532
- C:\Windows\System\vJVuexX.exe
  C:\Windows\System\vJVuexX.exe
  2⤵
  PID:8632
- C:\Windows\System\CKTWgtR.exe
  C:\Windows\System\CKTWgtR.exe
  2⤵
  PID:8696
- C:\Windows\System\cWhXgZz.exe
  C:\Windows\System\cWhXgZz.exe
  2⤵
  PID:8744
- C:\Windows\System\LQmPfoR.exe
  C:\Windows\System\LQmPfoR.exe
  2⤵
  PID:8816
- C:\Windows\System\ZoCyARK.exe
  C:\Windows\System\ZoCyARK.exe
  2⤵
  PID:8728
- C:\Windows\System\bWHJqqc.exe
  C:\Windows\System\bWHJqqc.exe
  2⤵
  PID:8836
- C:\Windows\System\VcysDPU.exe
  C:\Windows\System\VcysDPU.exe
  2⤵
  PID:8832
- C:\Windows\System\hltyWzX.exe
  C:\Windows\System\hltyWzX.exe
  2⤵
  PID:8896
- C:\Windows\System\NZCEXSM.exe
  C:\Windows\System\NZCEXSM.exe
  2⤵
  PID:8928
- C:\Windows\System\oRwrXBs.exe
  C:\Windows\System\oRwrXBs.exe
  2⤵
  PID:8980
- C:\Windows\System\ssRUAej.exe
  C:\Windows\System\ssRUAej.exe
  2⤵
  PID:8992
- C:\Windows\System\WYWymjR.exe
  C:\Windows\System\WYWymjR.exe
  2⤵
  PID:8960
- C:\Windows\System\PXRGuGO.exe
  C:\Windows\System\PXRGuGO.exe
  2⤵
  PID:9088
- C:\Windows\System\dDKpbsw.exe
  C:\Windows\System\dDKpbsw.exe
  2⤵
  PID:9124
- C:\Windows\System\osyzTQm.exe
  C:\Windows\System\osyzTQm.exe
  2⤵
  PID:9132
- C:\Windows\System\mgsGgcc.exe
  C:\Windows\System\mgsGgcc.exe
  2⤵
  PID:9180
- C:\Windows\System\dgXRQjP.exe
  C:\Windows\System\dgXRQjP.exe
  2⤵
  PID:8268
- C:\Windows\System\koQFtLv.exe
  C:\Windows\System\koQFtLv.exe
  2⤵
  PID:8336
- C:\Windows\System\xqLNeXq.exe
  C:\Windows\System\xqLNeXq.exe
  2⤵
  PID:9164
- C:\Windows\System\GLiVszx.exe
  C:\Windows\System\GLiVszx.exe
  2⤵
  PID:9200
- C:\Windows\System\YqDFLlW.exe
  C:\Windows\System\YqDFLlW.exe
  2⤵
  PID:8496
- C:\Windows\System\zRLrwTF.exe
  C:\Windows\System\zRLrwTF.exe
  2⤵
  PID:8352
- C:\Windows\System\HiFCFns.exe
  C:\Windows\System\HiFCFns.exe
  2⤵
  PID:8384
- C:\Windows\System\MpqUkWI.exe
  C:\Windows\System\MpqUkWI.exe
  2⤵
  PID:8624
- C:\Windows\System\mryQANt.exe
  C:\Windows\System\mryQANt.exe
  2⤵
  PID:8668
- C:\Windows\System\DQhLeUD.exe
  C:\Windows\System\DQhLeUD.exe
  2⤵
  PID:8596
- C:\Windows\System\zuzDJCu.exe
  C:\Windows\System\zuzDJCu.exe
  2⤵
  PID:8948
- C:\Windows\System\QoiWCxW.exe
  C:\Windows\System\QoiWCxW.exe
  2⤵
  PID:9072
- C:\Windows\System\LHlYNdc.exe
  C:\Windows\System\LHlYNdc.exe
  2⤵
  PID:8716
- C:\Windows\System\VzMztyG.exe
  C:\Windows\System\VzMztyG.exe
  2⤵
  PID:9012
- C:\Windows\System\RYNekxr.exe
  C:\Windows\System\RYNekxr.exe
  2⤵
  PID:8916
- C:\Windows\System\ezuacsg.exe
  C:\Windows\System\ezuacsg.exe
  2⤵
  PID:9104
- C:\Windows\System\QddnmvL.exe
  C:\Windows\System\QddnmvL.exe
  2⤵
  PID:9128
- C:\Windows\System\jXtZRbW.exe
  C:\Windows\System\jXtZRbW.exe
  2⤵
  PID:8204
- C:\Windows\System\suvssqO.exe
  C:\Windows\System\suvssqO.exe
  2⤵
  PID:8444
- C:\Windows\System\ORUFPtV.exe
  C:\Windows\System\ORUFPtV.exe
  2⤵
  PID:9204
- C:\Windows\System\aRxWyli.exe
  C:\Windows\System\aRxWyli.exe
  2⤵
  PID:8780
- C:\Windows\System\DYKNjdh.exe
  C:\Windows\System\DYKNjdh.exe
  2⤵
  PID:8300
- C:\Windows\System\YyWDJJE.exe
  C:\Windows\System\YyWDJJE.exe
  2⤵
  PID:8880
- C:\Windows\System\CtdROXU.exe
  C:\Windows\System\CtdROXU.exe
  2⤵
  PID:8848
- C:\Windows\System\DRwjNII.exe
  C:\Windows\System\DRwjNII.exe
  2⤵
  PID:9060
- C:\Windows\System\wMrNvhQ.exe
  C:\Windows\System\wMrNvhQ.exe
  2⤵
  PID:8288
- C:\Windows\System\nZeOxqG.exe
  C:\Windows\System\nZeOxqG.exe
  2⤵
  PID:7796
- C:\Windows\System\xFknnqa.exe
  C:\Windows\System\xFknnqa.exe
  2⤵
  PID:8592
- C:\Windows\System\BopgdIn.exe
  C:\Windows\System\BopgdIn.exe
  2⤵
  PID:9040
- C:\Windows\System\gOkprmh.exe
  C:\Windows\System\gOkprmh.exe
  2⤵
  PID:9120
- C:\Windows\System\BqoWeUJ.exe
  C:\Windows\System\BqoWeUJ.exe
  2⤵
  PID:8648
- C:\Windows\System\pjHTtgq.exe
  C:\Windows\System\pjHTtgq.exe
  2⤵
  PID:9220
- C:\Windows\System\wpMZqYC.exe
  C:\Windows\System\wpMZqYC.exe
  2⤵
  PID:9236
- C:\Windows\System\FfmVsyY.exe
  C:\Windows\System\FfmVsyY.exe
  2⤵
  PID:9252
- C:\Windows\System\WFirVmY.exe
  C:\Windows\System\WFirVmY.exe
  2⤵
  PID:9268
- C:\Windows\System\LzBjdof.exe
  C:\Windows\System\LzBjdof.exe
  2⤵
  PID:9284
- C:\Windows\System\ApGQcWo.exe
  C:\Windows\System\ApGQcWo.exe
  2⤵
  PID:9308
- C:\Windows\System\rUrZEyZ.exe
  C:\Windows\System\rUrZEyZ.exe
  2⤵
  PID:9324
- C:\Windows\System\AJuRZwH.exe
  C:\Windows\System\AJuRZwH.exe
  2⤵
  PID:9344
- C:\Windows\System\HsIfNfm.exe
  C:\Windows\System\HsIfNfm.exe
  2⤵
  PID:9360
- C:\Windows\System\VtIkzPj.exe
  C:\Windows\System\VtIkzPj.exe
  2⤵
  PID:9376
- C:\Windows\System\LxhxqUI.exe
  C:\Windows\System\LxhxqUI.exe
  2⤵
  PID:9392
- C:\Windows\System\LfLtAbe.exe
  C:\Windows\System\LfLtAbe.exe
  2⤵
  PID:9408
- C:\Windows\System\ultDtLi.exe
  C:\Windows\System\ultDtLi.exe
  2⤵
  PID:9424
- C:\Windows\System\UqCoDLD.exe
  C:\Windows\System\UqCoDLD.exe
  2⤵
  PID:9472
- C:\Windows\System\Adnmjpt.exe
  C:\Windows\System\Adnmjpt.exe
  2⤵
  PID:9488
- C:\Windows\System\cEPyIyR.exe
  C:\Windows\System\cEPyIyR.exe
  2⤵
  PID:9504
- C:\Windows\System\NBikVmo.exe
  C:\Windows\System\NBikVmo.exe
  2⤵
  PID:9520
- C:\Windows\System\KHRnnha.exe
  C:\Windows\System\KHRnnha.exe
  2⤵
  PID:9536
- C:\Windows\System\Pyclipx.exe
  C:\Windows\System\Pyclipx.exe
  2⤵
  PID:9552
- C:\Windows\System\kkKJJVR.exe
  C:\Windows\System\kkKJJVR.exe
  2⤵
  PID:9568
- C:\Windows\System\KMGhpQe.exe
  C:\Windows\System\KMGhpQe.exe
  2⤵
  PID:9584
- C:\Windows\System\eblxKka.exe
  C:\Windows\System\eblxKka.exe
  2⤵
  PID:9600
- C:\Windows\System\tyGUYbe.exe
  C:\Windows\System\tyGUYbe.exe
  2⤵
  PID:9616
- C:\Windows\System\aAwQqoI.exe
  C:\Windows\System\aAwQqoI.exe
  2⤵
  PID:9632
- C:\Windows\System\UAvckDa.exe
  C:\Windows\System\UAvckDa.exe
  2⤵
  PID:9648
- C:\Windows\System\IiuImTB.exe
  C:\Windows\System\IiuImTB.exe
  2⤵
  PID:9664
- C:\Windows\System\ohdGTvV.exe
  C:\Windows\System\ohdGTvV.exe
  2⤵
  PID:9680
- C:\Windows\System\gcIygjY.exe
  C:\Windows\System\gcIygjY.exe
  2⤵
  PID:9696
- C:\Windows\System\HExrBcO.exe
  C:\Windows\System\HExrBcO.exe
  2⤵
  PID:9712
- C:\Windows\System\vtXjDqu.exe
  C:\Windows\System\vtXjDqu.exe
  2⤵
  PID:9732
- C:\Windows\System\VCyuGGY.exe
  C:\Windows\System\VCyuGGY.exe
  2⤵
  PID:9748
- C:\Windows\System\UTqKidh.exe
  C:\Windows\System\UTqKidh.exe
  2⤵
  PID:9764
- C:\Windows\System\lVNyqpV.exe
  C:\Windows\System\lVNyqpV.exe
  2⤵
  PID:9780
- C:\Windows\System\TSEjuDG.exe
  C:\Windows\System\TSEjuDG.exe
  2⤵
  PID:9796
- C:\Windows\System\WepuOGt.exe
  C:\Windows\System\WepuOGt.exe
  2⤵
  PID:9812
- C:\Windows\System\XVhCwRL.exe
  C:\Windows\System\XVhCwRL.exe
  2⤵
  PID:9828
- C:\Windows\System\feGnvGl.exe
  C:\Windows\System\feGnvGl.exe
  2⤵
  PID:9844
- C:\Windows\System\xsVJAbI.exe
  C:\Windows\System\xsVJAbI.exe
  2⤵
  PID:9860
- C:\Windows\System\WmmsyQS.exe
  C:\Windows\System\WmmsyQS.exe
  2⤵
  PID:9876
- C:\Windows\System\eqMgdAk.exe
  C:\Windows\System\eqMgdAk.exe
  2⤵
  PID:9892
- C:\Windows\System\MQDAaXC.exe
  C:\Windows\System\MQDAaXC.exe
  2⤵
  PID:10008
- C:\Windows\System\BdECxXy.exe
  C:\Windows\System\BdECxXy.exe
  2⤵
  PID:10024
- C:\Windows\System\CNZnoIR.exe
  C:\Windows\System\CNZnoIR.exe
  2⤵
  PID:10044
- C:\Windows\System\LqqnBTS.exe
  C:\Windows\System\LqqnBTS.exe
  2⤵
  PID:10068
- C:\Windows\System\IymRWir.exe
  C:\Windows\System\IymRWir.exe
  2⤵
  PID:10084
- C:\Windows\System\ANaGCWN.exe
  C:\Windows\System\ANaGCWN.exe
  2⤵
  PID:10100
- C:\Windows\System\FhMAKHM.exe
  C:\Windows\System\FhMAKHM.exe
  2⤵
  PID:10116
- C:\Windows\System\cqNhzxR.exe
  C:\Windows\System\cqNhzxR.exe
  2⤵
  PID:10140
- C:\Windows\System\LtgIXXY.exe
  C:\Windows\System\LtgIXXY.exe
  2⤵
  PID:10156
- C:\Windows\System\bZVoDGc.exe
  C:\Windows\System\bZVoDGc.exe
  2⤵
  PID:10172
- C:\Windows\System\QQvLIST.exe
  C:\Windows\System\QQvLIST.exe
  2⤵
  PID:10188
- C:\Windows\System\LcLBhXg.exe
  C:\Windows\System\LcLBhXg.exe
  2⤵
  PID:10204
- C:\Windows\System\PRvZXRZ.exe
  C:\Windows\System\PRvZXRZ.exe
  2⤵
  PID:10220
- C:\Windows\System\BsrEYpv.exe
  C:\Windows\System\BsrEYpv.exe
  2⤵
  PID:9244
- C:\Windows\System\dqLSuNt.exe
  C:\Windows\System\dqLSuNt.exe
  2⤵
  PID:9232
- C:\Windows\System\TzwnRcN.exe
  C:\Windows\System\TzwnRcN.exe
  2⤵
  PID:9264
- C:\Windows\System\eCnIibO.exe
  C:\Windows\System\eCnIibO.exe
  2⤵
  PID:8348
- C:\Windows\System\YmChTVg.exe
  C:\Windows\System\YmChTVg.exe
  2⤵
  PID:9292
- C:\Windows\System\ZzCiajQ.exe
  C:\Windows\System\ZzCiajQ.exe
  2⤵
  PID:9296
- C:\Windows\System\nITlLWi.exe
  C:\Windows\System\nITlLWi.exe
  2⤵
  PID:9456
- C:\Windows\System\eJnkXNA.exe
  C:\Windows\System\eJnkXNA.exe
  2⤵
  PID:9480
- C:\Windows\System\pwTKTnN.exe
  C:\Windows\System\pwTKTnN.exe
  2⤵
  PID:9500
- C:\Windows\System\TpYchJx.exe
  C:\Windows\System\TpYchJx.exe
  2⤵
  PID:9592
- C:\Windows\System\rIBXXWA.exe
  C:\Windows\System\rIBXXWA.exe
  2⤵
  PID:9640
- C:\Windows\System\bYXWXrO.exe
  C:\Windows\System\bYXWXrO.exe
  2⤵
  PID:9656
- C:\Windows\System\qwZDozi.exe
  C:\Windows\System\qwZDozi.exe
  2⤵
  PID:9704
- C:\Windows\System\TliaijP.exe
  C:\Windows\System\TliaijP.exe
  2⤵
  PID:9688
- C:\Windows\System\itryDtV.exe
  C:\Windows\System\itryDtV.exe
  2⤵
  PID:9744
- C:\Windows\System\WRHXSDS.exe
  C:\Windows\System\WRHXSDS.exe
  2⤵
  PID:9912
- C:\Windows\System\EzfPUBa.exe
  C:\Windows\System\EzfPUBa.exe
  2⤵
  PID:9928
- C:\Windows\System\bDfTXeX.exe
  C:\Windows\System\bDfTXeX.exe
  2⤵
  PID:9956
- C:\Windows\System\LHpOqzk.exe
  C:\Windows\System\LHpOqzk.exe
  2⤵
  PID:9972
- C:\Windows\System\AtOHYju.exe
  C:\Windows\System\AtOHYju.exe
  2⤵
  PID:9980
- C:\Windows\System\VWcYbZj.exe
  C:\Windows\System\VWcYbZj.exe
  2⤵
  PID:10016
- C:\Windows\System\sZmLHop.exe
  C:\Windows\System\sZmLHop.exe
  2⤵
  PID:10064
- C:\Windows\System\Ypvtpzj.exe
  C:\Windows\System\Ypvtpzj.exe
  2⤵
  PID:10096
- C:\Windows\System\OVFJaWY.exe
  C:\Windows\System\OVFJaWY.exe
  2⤵
  PID:10136
- C:\Windows\System\KicvVKD.exe
  C:\Windows\System\KicvVKD.exe
  2⤵
  PID:10108

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\GFvvvcd.exe

Filesize
1.5MB

MD5
28e7d32b57be04bcc6228da8e8e77dce

SHA1
6f10e8d6e5d2119f9d5f0d80dcf21f760b08ad72

SHA256
2a851f3eda5490ffc03f21b90315ae74512a51696ac915a2edefb0ca9f8b164c

SHA512
de61d99264b7d58654b60c8d26169b472e818ac6d7c45ab4f71842cd99a4e901cb7360d5e3e47e60c6eafc11d85929b5b03fba010891d2f822794dac5165a258

Download Submit
C:\Windows\system\HaoFBCe.exe

Filesize
1.5MB

MD5
da8ffe7f8bef9e6e1b82ba60b2c95098

SHA1
d1ccbcbb4596594354b3678f5275d5b1d19be37b

SHA256
b1e1c0e42c4478c194ff2f5729dbbc301eede9f900b3daa8872bdcf1efc23291

SHA512
b6645e746eacc0b9e26506f52e86f7d014e7b47bedc9c3899fa12c9035495d42226225b6b1656666f295ae286343de3b6db8f9ea57c321fb1167e3ac91894df2

Download Submit
C:\Windows\system\KDnZAMy.exe

Filesize
1.5MB

MD5
7944d4cf5925783645220dd46f505937

SHA1
3cfd26a4abea55e76d2cd3e90a22a92c6ac1625f

SHA256
0fff066be0650168e47dda07f7b3f2aa4fcd60f62dce6daee31e5a521d368c58

SHA512
bedd2b7c82f4cd07376fa75ca434863b89817ada4e40ecbb956acceb5d7fd726365ec364e1ce3ec700205557964407d944c37506cde3ef7e1b60cbf1ddeb1653

Download Submit
C:\Windows\system\NmqcrsE.exe

Filesize
1.5MB

MD5
9e8debde8d69500f2bc0d516cdd69cfb

SHA1
6eafd7c1f2e3f79c12aa69315d25f35b7d23be23

SHA256
88b6f35f673e447c3ac0f23e9865548d80ecc6c3ad94ba312b80d2d7f0671407

SHA512
7c9bb0d9be593bf54c9c436b991ee603a1b7cf1c19202fe22fd14a9ce70d96f1155ef8f146d648e3be57d79d6dc97a6bceaa43e0ea80344666b75aa267b3e6f3

Download Submit
C:\Windows\system\OKhKysH.exe

Filesize
1.5MB

MD5
efa5c9a70bde3366efa4a23408064416

SHA1
72e6c7cceaa6331736785a4357db4035f9c8537c

SHA256
22d636dbfae404f8b74fc8fc8ce0a98cb25b9f4f53fdaba89d4a2eb13fcf2f0d

SHA512
d22276728e1149e066d0f5a90d7ab4449bf192bbe5c38837c2f2774d338ec8f3a049d40cc7c3a7f66637d32546c1c32c046d5468216b1afe6c2cad5b91b87366

Download Submit
C:\Windows\system\UWDDyzD.exe

Filesize
1.5MB

MD5
3abeaa01aabded415d5f983934504be1

SHA1
fdab2152b8a6fdc3083aa442dc1fa989108d4db2

SHA256
cd0e3b4f8721a712c3b539d0dd250e5de23185dbe962678e72f9ae41c3db0ffd

SHA512
d094a921ee5d26e189812dd0b2a53ef1f60f32cf2b1b76fac6acf844396023be09bed1b3cabc3c0a482beac76ba4040adb181bd78772349aae3e24fc89164bb1

Download Submit
C:\Windows\system\VzaVStk.exe

Filesize
1.5MB

MD5
a1c3fd233c3c651e93a72ef5e3cc6f44

SHA1
7764ef2e4a78c14363e8bf1bb213eb0cd28878cd

SHA256
1164515daf545ad33ea6c309a100edac859ab991f8117c434f261320dea00c84

SHA512
43b3c7966549591827210a2a61f335bd4c4a43b6e2c422e8c3a82d6e6a3074c650b2ba5ed977e1a4c11c12a19892b004c7160d92b8f7be26d30b9780aeeedfc0

Download Submit
C:\Windows\system\YsVHcGT.exe

Filesize
1.5MB

MD5
5c2b16715091b796a9a2ec4dcc9e7dfa

SHA1
c8896b01d8e207bd59e7fd5804da7ef5e2d5df30

SHA256
14776c553f051b1617a66c32f6356405e136c94b4312020b12fd016adfbe1b54

SHA512
cfa448af7ec433f6657186bfbbd36d6789bda9ec16f93c01b353b08a20ad3891c5b8f343a030b040419dfe12fcf001c3283d591562f245642864220ba1cf9150

Download Submit
C:\Windows\system\ZmrVExF.exe

Filesize
1.5MB

MD5
e1616f8c21ffc3ad7733340aec0aa5c2

SHA1
ee6a109b96e8b5e77d706469c29c3de7c1988b9a

SHA256
ad07635dc1fcce2bf1ae81fc998a8b5e8105896d771ea0f00ff4bf02f54e61ef

SHA512
52815231f9e393a218a6d6d8547226d2678aea5e1a61219b7fddef318db05a56cd03087d977a383962f949cdf4e5ed6a97bcaf135d37127de7f29d57780c29b1

Download Submit
C:\Windows\system\aHktuMe.exe

Filesize
1.5MB

MD5
423e3fca7c7aea282c3dfae67b6c4add

SHA1
6ca7a242a9753f181831719be48360125d25393f

SHA256
3d9b1c06430f6f3f0ebe58e513913281af9da0e8b82738dd5d5773c8ee7156b3

SHA512
93513592db38b289b4c941106af73fcedbba51a3c6b1d12cc6cc1311f530697acd7627deb2029460afbbdef95348266184b9be701fde935439b0fa13271f043e

Download Submit
C:\Windows\system\cyVxYwG.exe

Filesize
1.5MB

MD5
53465be66782e427d0c18f8c7d9df444

SHA1
5eb77a7ae782d3493c61e92b3c7ba04b73edfabc

SHA256
da7468d2b17242c2466255d5591ba79c4bfedc08903e2e3a8fbe513dd9a717ca

SHA512
945bcd2820674db4501232c1a35feacc816b6c88489ec10a667e2ac8082a20ec36ea3b50d7f9fdb38f9cd0bbe4f02ca6edb3a39db35d945269a0253390222cf3

Download Submit
C:\Windows\system\eVhwRuC.exe

Filesize
1.5MB

MD5
378ee17b63b44c24b0b3ee997c036e27

SHA1
cf6c6ef72f0e1d03126d0f74c771d821194e8383

SHA256
a0a58b54d6e8aa0f6b7d9b544c7745d3137d7b3948c015bf074c8ff0c3f9f5d7

SHA512
d9ba5ff4488335580ba6f2b4f3797a4543ea5297acbefe101e03feba2d2d6a26d70b2dc5ec20072ec13f343ee55c60f699a68dff1cd4270cbd040dc5ea90a4a1

Download Submit
C:\Windows\system\ezPDNWd.exe

Filesize
1.5MB

MD5
29a3509655729d820ded6db088718857

SHA1
d7bb8ad8716cd8d9b9e2ff880fd54e6e38b5a79b

SHA256
56dab152bb61dcee0bdfbc38de862fb5f52e3cd0093e5c235bd020ca751329bb

SHA512
6489402929d793031f9f8ed482c8046b2541d034639fed4bd5b61c95f4ec711623f9ff49096ce2ea25b55958ae49ee97117bb3fd61f85bc6b6afa0dfb47c7a1c

Download Submit
C:\Windows\system\gAUJRPe.exe

Filesize
1.5MB

MD5
f17efcbd30c1de2b0132533d72811a09

SHA1
799ecd0061490b07f8722bc0d2702d325bc1d8dd

SHA256
a8ad18237a8e4eb3df78d33ab6a6ab75e65aed06a9784000f4993b33eaf431cd

SHA512
49aa29dd9653f084e8f08361853e0f5fe5f439e3a7125dfedd9a19deacec0a55eaedeaae13091501c8805aac152b8f13fa61be88f8ff2e6e4fc79c70b86e6223

Download Submit
C:\Windows\system\ijCPktg.exe

Filesize
1.5MB

MD5
27600d2e89b36f2f45ef001a82020ade

SHA1
8c18d2123f51b5f9426def29a16a9701f4a564ab

SHA256
c19c138e0cd17395a8d95ae111b90832588786fe54b129e4754f6c96d99880e7

SHA512
b58e1b087f665dc8fde4d7a4594fa4a015b7217f35dba8e892f5070173ac6009d07faaad6ad2d8aad7441fb42da9f4871e1e6d487427911ad9244dbcc6e5b205

Download Submit
C:\Windows\system\lSPjghE.exe

Filesize
1.5MB

MD5
6f457e41ee0a4932f100992a3e5e7105

SHA1
a08bfd4c04609949ce38ce6b838fc5dcdb7b9b2e

SHA256
3cf61ad09e06676511c9c04568fcb8ae24710e0a7abebbc309af8b4dd2e92cc0

SHA512
601df82a94bcf6bd1a09ab554589664bdb2d3274a30a68d296357f2016f1d27f22f6f6a66d871a5bdbf9c0aa35a868a397310693442a8f8a9fd2652a2a29b5db

Download Submit
C:\Windows\system\oQXmMyA.exe

Filesize
1.5MB

MD5
470b809ffae224fbeac9bf920d02b3bd

SHA1
1277050f330af7c3190e4e9bf723a6d1c4632a09

SHA256
ad68d990971a403e730e720c1a73df548ab0635d4e6203b7281d3ca271c03594

SHA512
66a678562046c355617fd9cadb7d24feb92974f336d27d786ba86a5a6b3782cbacece066588a1536b6c5b39be2aa33f8bce653d5ab7b92012c46be07a504f379

Download Submit
C:\Windows\system\qOxNYPm.exe

Filesize
1.5MB

MD5
f2f53f4312aa46b8aabae9a3786cdd44

SHA1
33e99d26904e5761024439eb36ff0cc70c2c38d7

SHA256
837bf19036191a503a4bdd1048651701bb7654e1dc44f49fb4d9587d553b5aee

SHA512
5d0c0b0c3163940e5f9950a3fc58171e728af35eff928ab593dbe61f1c6a0a97804d95b0421a3ad3135b45c7426b2203c2865be175e7dc89be64a808275aaea3

Download Submit
C:\Windows\system\uMVbWms.exe

Filesize
1.5MB

MD5
e75e3ffee0ea30f3f5da4c0ae5d18faa

SHA1
a970b6f48ab58c328c2ff2cf4aa8dc37be03efe8

SHA256
b94e59fd7d1b59c164cafbd40d447f0a83fd7d8c982e89a9ea6ebfd17ee002e6

SHA512
940c3a914ccbb30412318bc5e45feac32c0866adf3eee05a1698e1678d5897971ce87b8b837aeb1fb242d4a6eff8fa217d96ef38a4e1fec5734bab0974f9bb67

Download Submit
C:\Windows\system\uxIGnQW.exe

Filesize
1.5MB

MD5
6bde42d6cc84c2a1896da3b5c95cac3e

SHA1
353d8e05343385bbbcf10f462a85671cce2765d9

SHA256
04624b2a872c5c9f7662c52bc63c3a70eb2b075c1c8600e7a02f058c1377971e

SHA512
a75ec99a0b1284b80ddaa2a4a7344822e821ddb6117bba4fdea14c3f8bb5c2e054c7e23d35f6c994c304534a040b6b6fc8667a7dad9fc1918ad9e237964b52ad

Download Submit
C:\Windows\system\vjlMAki.exe

Filesize
1.5MB

MD5
9172e06768ac715e0c9f84e3ab24ed7c

SHA1
ce6b509c067634878f3d63bffd162cd127d4a7c3

SHA256
a605c1cc2064804d8e2ac38cab39726e0bcf4ae3fd344a11810e4d44b61d400b

SHA512
c4d17dfb175a715093d7a679e63b560dfb5e2647190706915fd46ca4c42b4275d525bc39f179b0d4749520ca5a9b275c8d427c8e6bf8d506aff3e0ed4056ce09

Download Submit
C:\Windows\system\wcbNzTh.exe

Filesize
1.5MB

MD5
70781ff4eb8e58154f5b17e9e54432ae

SHA1
c50c03060ca8f9cdb1b9e05e64d16ea4afcce4a9

SHA256
a8bc83b56d1c8ee8830e864a372d61c968940e50e13732568b6aaa2b84ef3cfb

SHA512
ccef8b5b075428282d8ffcf1343cbe937921e3e9b2f1b42945400453a7bb3711dca85b206208ef915aaca2a321aad4e043aadee6154c3523d5944141f17c73cf

Download Submit
C:\Windows\system\yYoEUAG.exe

Filesize
1.5MB

MD5
0886ec1abf188e967cda724e2d0fa96c

SHA1
21b7fa9622f2fbe53d3d6ef3a60aa73214401ed8

SHA256
2f8120760b359510b5ff3058e24b610e834d01ba835c0589675507e9b66408e5

SHA512
82742d390cad8c9f5d063ac6b6ba17a576742cbd98b9f2e39ca6f914388492c0c862592883fa4f38cc0a7c626c89d1fd57e635c05df0327e68e1bbb09d217274

Download Submit
C:\Windows\system\ymopjav.exe

Filesize
1.5MB

MD5
983e981090fe9d4ff6426174176b8ccd

SHA1
0a741000a998c923d484e49551f98b810124078b

SHA256
9eaad391b1abef3490b93a4d7b479d554aee48ca5f09ee2334bbc6cc8690adbf

SHA512
34a394b7dd0b1b6ccb4a8c3ad8d8f82f559d4e7a6cd5bc92bbe02131f007320063aeca2817f45e0e5dea98777e14a1269a0dba94dd4523ba2f29fd6331ea14d2

Download Submit
\Windows\system\DRdXQmK.exe

Filesize
1.5MB

MD5
190c63e95c26fbcf9008a0307eac6ba7

SHA1
0981ddd07ea865cb809c879fc893487dc3e0a741

SHA256
602eb9dc14ccf93f04754d9c4c1fe4eca9c82fa87790cf64f817ad0191acdfff

SHA512
2a8a50e8a00bb5f38eeacbd34c81bee3be84da0e06fa65281471c0f83ced50741286234c24e221ff3be1f750b7da87f75d0e5d26409b197d953448fb90e7149b

Download Submit
\Windows\system\JnGpZcC.exe

Filesize
1.5MB

MD5
f64862ab41b98c28d3a214466fe8d06b

SHA1
6b35643ece0bbfffeeeb53e72a384a67bf7cc2b7

SHA256
8272df0a541713ea04a92748373afd13fc8a2f18c34dac478690d361988e212a

SHA512
77b31772f4c197b990cb6d71a430a9b69c38424b9011494ea0269487e12ee7d6f6534642a3b7b70ba75b601cc7750528790d048e5fcab9589c0e29d13fce3c3c

Download Submit
\Windows\system\PsTVpwt.exe

Filesize
1.5MB

MD5
17ada6eb3c7ca9fbb5b6c68c64088e76

SHA1
3cd129796b878585e6a868293931925f109010fa

SHA256
8e455137e9052acc0180646aa39658fb7394d3fe25cd789f1f82c218e698b876

SHA512
e32d47c0fad8cbb1e94178cf19eda3e304ea8c29951a488aa5c5d0ed25d29629dd1249c3a249c5e712a3ef81da5e95f0971a1c74ecbf8bc89a4aea8aeb3e3ace

Download Submit
\Windows\system\TUnZKBa.exe

Filesize
1.5MB

MD5
563c243793b051223e110bd6475685f9

SHA1
b8c02d99d688e71c8fcf58a42d2ffaae6d8ab4f6

SHA256
2646a50f25198f99ae3184f27e14be3cbff4725d0ed75278365ee732387278ea

SHA512
99463490a20f042b28013eb141ac54770bf0bf622718e2fdb795b3ff6f1a82bfe4b0b9bc637d8644a0308eabafe7a45db092041415752130227af67c5b70d249

Download Submit
\Windows\system\VZGvwGw.exe

Filesize
1.5MB

MD5
43a87629aa3eb46bd14d37d5cee4921a

SHA1
bee484b2875390fe991100178beb341d79085ba0

SHA256
2797136854424a850eff2ebbb48c1130e1e30ad90f4f5d66d5a65cc6491ba675

SHA512
14f859c1bcd6bbb6bdd8386f17da31d24c5cc40765688d873fabdfb6d0373d2765364d858901a0d8b914e0346c96228463a619a440a03528f295aed0b1b5e98c

Download Submit
\Windows\system\dVbHTya.exe

Filesize
1.5MB

MD5
7d8709719fa609c1073b87eac43e6b37

SHA1
7d7a415a4228272dc5531e6cbd82f5aaabd75477

SHA256
5892364ba0bfd3da00ada57d381eef7754aaeada0ce977a374377ccf2b01bf62

SHA512
ec4342325c072d87e7633ac08fe0e157bcc1732475970d99e5358872d289e20c1813dbb9d5ace81dec1d671e1509a3dff98c89010c7de80a20f163784f732047

Download Submit
\Windows\system\kgERbiv.exe

Filesize
1.5MB

MD5
bbd8653f0d84d0ec2fed04cc9b0051d7

SHA1
455f630f70675aa2b02428773233a16ca3b9580b

SHA256
47f76f6f7fe3802b3f8b44bea93c0ea9f28268809b3e779b65bd452b67875a05

SHA512
f0ca326ba4a21611617df7d2ec0c526bde9ec6da2d72106ca3d6f30ecf720e9d0f3a5ab4aa6b3f89cd5257133c0910085b61d94e197092ce931d78e1f0e72127

Download Submit
\Windows\system\pSwfxAV.exe

Filesize
1.5MB

MD5
0e91601858439c6cad4e886dd3765876

SHA1
882224755de97129a36ba7d7d4ff546cb71c2eff

SHA256
40aea10d0a9d0f8be9cbb23c4f0d72b4d3b94404976b4bbf1eb4480d50e62222

SHA512
e081bf1684c29c7f1d3a687774e77df3689e5c0a61aff71aec3ac75fa823741c57a40ede2e2cbd48d294aae6f9f00437597ece8d302aa73484564c8166a27b2a

Download Submit
\Windows\system\zUnvfGU.exe

Filesize
1.5MB

MD5
0ca729cfbfb0ce4ab3b9eead266cb038

SHA1
0ab6a793c3a2e222eb2a17abdfcd42f90ec18a28

SHA256
4c6b0309371b50c65db289d7cc55d885384a140b8f8d38538f41e11a8789f510

SHA512
7e36b47ca8ec86b90a031f9c0e771ac7aa91e22c74e631a39ecdd9a146d75c79a61232bca8f3b6f36d99cfb7c2b2756b8664f3b771f6cd0c62f05444420763bb

Download Submit
memory/1048-118-0x000000001B570000-0x000000001B852000-memory.dmp

Filesize
2.9MB

Download
memory/1048-347-0x000007FEF56C0000-0x000007FEF605D000-memory.dmp

Filesize
9.6MB

Download
memory/1048-119-0x00000000027E0000-0x00000000027E8000-memory.dmp

Filesize
32KB

Download
memory/1048-479-0x000007FEF56C0000-0x000007FEF605D000-memory.dmp

Filesize
9.6MB

Download
memory/1048-308-0x000007FEF597E000-0x000007FEF597F000-memory.dmp

Filesize
4KB

Download
memory/1048-375-0x000007FEF56C0000-0x000007FEF605D000-memory.dmp

Filesize
9.6MB

Download
memory/1048-348-0x000007FEF56C0000-0x000007FEF605D000-memory.dmp

Filesize
9.6MB

Download
memory/1060-5456-0x000000013F200000-0x000000013F5F2000-memory.dmp

Filesize
3.9MB

Download
memory/1060-358-0x000000013F200000-0x000000013F5F2000-memory.dmp

Filesize
3.9MB

Download
memory/1684-5457-0x000000013FD90000-0x0000000140182000-memory.dmp

Filesize
3.9MB

Download
memory/1684-360-0x000000013FD90000-0x0000000140182000-memory.dmp

Filesize
3.9MB

Download
memory/2000-307-0x000000013F590000-0x000000013F982000-memory.dmp

Filesize
3.9MB

Download
memory/2024-266-0x000000013FA20000-0x000000013FE12000-memory.dmp

Filesize
3.9MB

Download
memory/2024-5436-0x000000013FA20000-0x000000013FE12000-memory.dmp

Filesize
3.9MB

Download
memory/2364-373-0x0000000003140000-0x0000000003532000-memory.dmp

Filesize
3.9MB

Download
memory/2364-11115-0x0000000003140000-0x0000000003532000-memory.dmp

Filesize
3.9MB

Download
memory/2364-367-0x0000000003140000-0x0000000003532000-memory.dmp

Filesize
3.9MB

Download
memory/2364-11826-0x0000000003140000-0x0000000003532000-memory.dmp

Filesize
3.9MB

Download
memory/2364-365-0x0000000003140000-0x0000000003532000-memory.dmp

Filesize
3.9MB

Download
memory/2364-11141-0x0000000003140000-0x0000000003532000-memory.dmp

Filesize
3.9MB

Download
memory/2364-363-0x0000000003140000-0x0000000003532000-memory.dmp

Filesize
3.9MB

Download
memory/2364-11140-0x0000000003140000-0x0000000003532000-memory.dmp

Filesize
3.9MB

Download
memory/2364-361-0x0000000003140000-0x0000000003532000-memory.dmp

Filesize
3.9MB

Download
memory/2364-370-0x0000000003140000-0x0000000003532000-memory.dmp

Filesize
3.9MB

Download
memory/2364-359-0x000000013FD90000-0x0000000140182000-memory.dmp

Filesize
3.9MB

Download
memory/2364-369-0x000000013FCD0000-0x00000001400C2000-memory.dmp

Filesize
3.9MB

Download
memory/2364-357-0x000000013F200000-0x000000013F5F2000-memory.dmp

Filesize
3.9MB

Download
memory/2364-11139-0x000000013FD90000-0x0000000140182000-memory.dmp

Filesize
3.9MB

Download
memory/2364-355-0x000000013F2D0000-0x000000013F6C2000-memory.dmp

Filesize
3.9MB

Download
memory/2364-11137-0x0000000003140000-0x0000000003532000-memory.dmp

Filesize
3.9MB

Download
memory/2364-353-0x0000000003140000-0x0000000003532000-memory.dmp

Filesize
3.9MB

Download
memory/2364-11138-0x000000013F200000-0x000000013F5F2000-memory.dmp

Filesize
3.9MB

Download
memory/2364-351-0x0000000003140000-0x0000000003532000-memory.dmp

Filesize
3.9MB

Download
memory/2364-1-0x0000000001B20000-0x0000000001B30000-memory.dmp

Filesize
64KB

Download
memory/2364-11135-0x000000013FCD0000-0x00000001400C2000-memory.dmp

Filesize
3.9MB

Download
memory/2364-11136-0x000000013F2D0000-0x000000013F6C2000-memory.dmp

Filesize
3.9MB

Download
memory/2364-7-0x0000000003140000-0x0000000003532000-memory.dmp

Filesize
3.9MB

Download
memory/2364-0-0x000000013F6E0000-0x000000013FAD2000-memory.dmp

Filesize
3.9MB

Download
memory/2364-11130-0x0000000003140000-0x0000000003532000-memory.dmp

Filesize
3.9MB

Download
memory/2364-11125-0x0000000003140000-0x0000000003532000-memory.dmp

Filesize
3.9MB

Download
memory/2364-11120-0x0000000003140000-0x0000000003532000-memory.dmp

Filesize
3.9MB

Download
memory/2364-8370-0x000000013F6E0000-0x000000013FAD2000-memory.dmp

Filesize
3.9MB

Download
memory/2440-366-0x000000013F320000-0x000000013F712000-memory.dmp

Filesize
3.9MB

Download
memory/2440-5641-0x000000013F320000-0x000000013F712000-memory.dmp

Filesize
3.9MB

Download
memory/2504-368-0x000000013F900000-0x000000013FCF2000-memory.dmp

Filesize
3.9MB

Download
memory/2548-5430-0x000000013F870000-0x000000013FC62000-memory.dmp

Filesize
3.9MB

Download
memory/2548-354-0x000000013F870000-0x000000013FC62000-memory.dmp

Filesize
3.9MB

Download
memory/2608-5617-0x000000013FA70000-0x000000013FE62000-memory.dmp

Filesize
3.9MB

Download
memory/2608-364-0x000000013FA70000-0x000000013FE62000-memory.dmp

Filesize
3.9MB

Download
memory/2652-352-0x000000013F7E0000-0x000000013FBD2000-memory.dmp

Filesize
3.9MB

Download
memory/2652-5628-0x000000013F7E0000-0x000000013FBD2000-memory.dmp

Filesize
3.9MB

Download
memory/2696-5450-0x000000013F2D0000-0x000000013F6C2000-memory.dmp

Filesize
3.9MB

Download
memory/2696-356-0x000000013F2D0000-0x000000013F6C2000-memory.dmp

Filesize
3.9MB

Download
memory/3048-5475-0x000000013F980000-0x000000013FD72000-memory.dmp

Filesize
3.9MB

Download
memory/3048-362-0x000000013F980000-0x000000013FD72000-memory.dmp

Filesize
3.9MB

Download