xmrig | 9cb58a11ffaa0120f3647a51a540591a64eca92eb2dee099a1612600f4618027

Analysis

max time kernel
150s
max time network
141s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
23/05/2024, 06:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0875f5a33c42d1402b721166f2d2b060_NeikiAnalytics.exe
Size

3.0MB
MD5

0875f5a33c42d1402b721166f2d2b060
SHA1

3d74a954c83fcbd8ede30870805273bcc98e1aa1
SHA256

9cb58a11ffaa0120f3647a51a540591a64eca92eb2dee099a1612600f4618027
SHA512

dc4c14bb663aeae066aa24e852bb01bc56818f4e2d820c4988cde9dccf51c40837b3fc8652ea09eb987129e7c23e7d2b7f83e0767a55543b17395acd130ab9cb
SSDEEP

49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMki8CnfZFOzV:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2R+

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 52 IoCs

miner

resource	yara_rule
behavioral1/memory/2980-1-0x000000013F600000-0x000000013F9F6000-memory.dmp	xmrig
behavioral1/files/0x000c00000001227b-6.dat	xmrig
behavioral1/files/0x0037000000016d3d-9.dat	xmrig
behavioral1/files/0x0007000000016dda-30.dat	xmrig
behavioral1/files/0x0008000000016de7-39.dat	xmrig
behavioral1/files/0x0009000000017042-45.dat	xmrig
behavioral1/files/0x000500000001878d-54.dat	xmrig
behavioral1/files/0x0006000000018bf0-59.dat	xmrig
behavioral1/files/0x0005000000019275-85.dat	xmrig
behavioral1/files/0x0005000000019283-94.dat	xmrig
behavioral1/files/0x000500000001954b-170.dat	xmrig
behavioral1/memory/2840-290-0x000000013FCA0000-0x0000000140096000-memory.dmp	xmrig
behavioral1/memory/2688-314-0x000000013F6F0000-0x000000013FAE6000-memory.dmp	xmrig
behavioral1/memory/1832-310-0x000000013F8B0000-0x000000013FCA6000-memory.dmp	xmrig
behavioral1/memory/1232-306-0x000000013F6F0000-0x000000013FAE6000-memory.dmp	xmrig
behavioral1/memory/1236-304-0x000000013F050000-0x000000013F446000-memory.dmp	xmrig
behavioral1/memory/3036-302-0x000000013F880000-0x000000013FC76000-memory.dmp	xmrig
behavioral1/memory/2576-300-0x000000013FD50000-0x0000000140146000-memory.dmp	xmrig
behavioral1/memory/2472-298-0x000000013F550000-0x000000013F946000-memory.dmp	xmrig
behavioral1/memory/2728-295-0x000000013FE20000-0x0000000140216000-memory.dmp	xmrig
behavioral1/memory/2592-292-0x000000013F5D0000-0x000000013F9C6000-memory.dmp	xmrig
behavioral1/files/0x0005000000019501-161.dat	xmrig
behavioral1/files/0x00050000000194eb-153.dat	xmrig
behavioral1/files/0x00050000000194a8-145.dat	xmrig
behavioral1/files/0x0005000000019462-137.dat	xmrig
behavioral1/files/0x00050000000193b1-122.dat	xmrig
behavioral1/files/0x000500000001943e-129.dat	xmrig
behavioral1/files/0x000500000001957d-173.dat	xmrig
behavioral1/files/0x0005000000019507-166.dat	xmrig
behavioral1/files/0x00050000000194ef-157.dat	xmrig
behavioral1/files/0x00050000000194b8-149.dat	xmrig
behavioral1/files/0x0005000000019491-142.dat	xmrig
behavioral1/files/0x0005000000019457-134.dat	xmrig
behavioral1/files/0x0005000000019433-126.dat	xmrig
behavioral1/files/0x000500000001939f-109.dat	xmrig
behavioral1/files/0x00050000000193a5-115.dat	xmrig
behavioral1/files/0x000500000001933a-99.dat	xmrig
behavioral1/files/0x0005000000019381-104.dat	xmrig
behavioral1/files/0x0005000000019277-89.dat	xmrig
behavioral1/files/0x0005000000019260-79.dat	xmrig
behavioral1/files/0x000500000001925d-74.dat	xmrig
behavioral1/files/0x000500000001923b-69.dat	xmrig
behavioral1/files/0x0005000000019228-64.dat	xmrig
behavioral1/files/0x0007000000017477-49.dat	xmrig
behavioral1/files/0x0007000000004e76-35.dat	xmrig
behavioral1/memory/2560-25-0x000000013FFA0000-0x0000000140396000-memory.dmp	xmrig
behavioral1/files/0x0008000000016d69-18.dat	xmrig
behavioral1/memory/1932-16-0x000000013F250000-0x000000013F646000-memory.dmp	xmrig
behavioral1/memory/2980-3133-0x000000013F600000-0x000000013F9F6000-memory.dmp	xmrig
behavioral1/memory/2728-5149-0x000000013FE20000-0x0000000140216000-memory.dmp	xmrig
behavioral1/memory/1832-5158-0x000000013F8B0000-0x000000013FCA6000-memory.dmp	xmrig
behavioral1/memory/1232-5157-0x000000013F6F0000-0x000000013FAE6000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
2748	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
1932	kXgCFLz.exe
2560	semKiLB.exe
2688	QGUMgki.exe
2840	DWcaHVp.exe
2592	aucLKQz.exe
2728	qXzbLwk.exe
2472	Skjlyjp.exe
2576	iJVJEoM.exe
3036	TKApdyG.exe
1236	NoaQyLJ.exe
1232	CJcJaQB.exe
1832	wZCIPyr.exe
2768	skGLPhe.exe
2780	HDaMJhU.exe
1580	OypVewi.exe
1664	KFtnQEK.exe
272	vZibEQn.exe
276	qHwiTdR.exe
1492	EmiZOYl.exe
2120	ZsMTuZu.exe
2344	zNerLHT.exe
480	VExlmqT.exe
2140	JrSqHah.exe
1156	mybtstE.exe
2208	aMPIYNk.exe
1052	xzjGeGd.exe
1076	EwULBxe.exe
2316	YTpEsgW.exe
2020	HZcQyxz.exe
2892	fIDHcNG.exe
1804	BANEQOi.exe
956	hkmYSeZ.exe
1012	iBxeMbY.exe
836	zPwqGOl.exe
2320	yxcwWOu.exe
1980	ejAgCkP.exe
2072	CfVhjQn.exe
2244	zLjeuTd.exe
1968	rpRlSSn.exe
1896	uWnRInA.exe
2564	QKgVfjT.exe
2732	TPkGMfX.exe
2736	CKZJVpE.exe
2452	LQJTVEs.exe
1944	QKfbbAf.exe
1924	jPqJDLl.exe
1112	kkbPucp.exe
2644	noKRZjG.exe
3068	Qgkpnjc.exe
2412	KnexswZ.exe
1680	TbrTIKW.exe
1444	iinrPms.exe
952	guxeZDZ.exe
1656	yEpOBIT.exe
1940	zSQCaLx.exe
2784	NANNrZS.exe
1984	feNHtOx.exe
1708	YPjcARr.exe
616	XXOeMfw.exe
1908	cRjVHZl.exe
2368	wTkyVjg.exe
2372	tpZnQpz.exe
1616	wrrvyZr.exe
2676	ueJsJKg.exe

Loads dropped DLL 64 IoCs

pid	Process
2980	0875f5a33c42d1402b721166f2d2b060_NeikiAnalytics.exe
2980	0875f5a33c42d1402b721166f2d2b060_NeikiAnalytics.exe
2980	0875f5a33c42d1402b721166f2d2b060_NeikiAnalytics.exe
2980	0875f5a33c42d1402b721166f2d2b060_NeikiAnalytics.exe
2980	0875f5a33c42d1402b721166f2d2b060_NeikiAnalytics.exe
2980	0875f5a33c42d1402b721166f2d2b060_NeikiAnalytics.exe
2980	0875f5a33c42d1402b721166f2d2b060_NeikiAnalytics.exe
2980	0875f5a33c42d1402b721166f2d2b060_NeikiAnalytics.exe
2980	0875f5a33c42d1402b721166f2d2b060_NeikiAnalytics.exe
2980	0875f5a33c42d1402b721166f2d2b060_NeikiAnalytics.exe
2980	0875f5a33c42d1402b721166f2d2b060_NeikiAnalytics.exe
2980	0875f5a33c42d1402b721166f2d2b060_NeikiAnalytics.exe
2980	0875f5a33c42d1402b721166f2d2b060_NeikiAnalytics.exe
2980	0875f5a33c42d1402b721166f2d2b060_NeikiAnalytics.exe
2980	0875f5a33c42d1402b721166f2d2b060_NeikiAnalytics.exe
2980	0875f5a33c42d1402b721166f2d2b060_NeikiAnalytics.exe
2980	0875f5a33c42d1402b721166f2d2b060_NeikiAnalytics.exe
2980	0875f5a33c42d1402b721166f2d2b060_NeikiAnalytics.exe
2980	0875f5a33c42d1402b721166f2d2b060_NeikiAnalytics.exe
2980	0875f5a33c42d1402b721166f2d2b060_NeikiAnalytics.exe
2980	0875f5a33c42d1402b721166f2d2b060_NeikiAnalytics.exe
2980	0875f5a33c42d1402b721166f2d2b060_NeikiAnalytics.exe
2980	0875f5a33c42d1402b721166f2d2b060_NeikiAnalytics.exe
2980	0875f5a33c42d1402b721166f2d2b060_NeikiAnalytics.exe
2980	0875f5a33c42d1402b721166f2d2b060_NeikiAnalytics.exe
2980	0875f5a33c42d1402b721166f2d2b060_NeikiAnalytics.exe
2980	0875f5a33c42d1402b721166f2d2b060_NeikiAnalytics.exe
2980	0875f5a33c42d1402b721166f2d2b060_NeikiAnalytics.exe
2980	0875f5a33c42d1402b721166f2d2b060_NeikiAnalytics.exe
2980	0875f5a33c42d1402b721166f2d2b060_NeikiAnalytics.exe
2980	0875f5a33c42d1402b721166f2d2b060_NeikiAnalytics.exe
2980	0875f5a33c42d1402b721166f2d2b060_NeikiAnalytics.exe
2980	0875f5a33c42d1402b721166f2d2b060_NeikiAnalytics.exe
2980	0875f5a33c42d1402b721166f2d2b060_NeikiAnalytics.exe
2980	0875f5a33c42d1402b721166f2d2b060_NeikiAnalytics.exe
2980	0875f5a33c42d1402b721166f2d2b060_NeikiAnalytics.exe
2980	0875f5a33c42d1402b721166f2d2b060_NeikiAnalytics.exe
2980	0875f5a33c42d1402b721166f2d2b060_NeikiAnalytics.exe
2980	0875f5a33c42d1402b721166f2d2b060_NeikiAnalytics.exe
2980	0875f5a33c42d1402b721166f2d2b060_NeikiAnalytics.exe
2980	0875f5a33c42d1402b721166f2d2b060_NeikiAnalytics.exe
2980	0875f5a33c42d1402b721166f2d2b060_NeikiAnalytics.exe
2980	0875f5a33c42d1402b721166f2d2b060_NeikiAnalytics.exe
2980	0875f5a33c42d1402b721166f2d2b060_NeikiAnalytics.exe
2980	0875f5a33c42d1402b721166f2d2b060_NeikiAnalytics.exe
2980	0875f5a33c42d1402b721166f2d2b060_NeikiAnalytics.exe
2980	0875f5a33c42d1402b721166f2d2b060_NeikiAnalytics.exe
2980	0875f5a33c42d1402b721166f2d2b060_NeikiAnalytics.exe
2980	0875f5a33c42d1402b721166f2d2b060_NeikiAnalytics.exe
2980	0875f5a33c42d1402b721166f2d2b060_NeikiAnalytics.exe
2980	0875f5a33c42d1402b721166f2d2b060_NeikiAnalytics.exe
2980	0875f5a33c42d1402b721166f2d2b060_NeikiAnalytics.exe
2980	0875f5a33c42d1402b721166f2d2b060_NeikiAnalytics.exe
2980	0875f5a33c42d1402b721166f2d2b060_NeikiAnalytics.exe
2980	0875f5a33c42d1402b721166f2d2b060_NeikiAnalytics.exe
2980	0875f5a33c42d1402b721166f2d2b060_NeikiAnalytics.exe
2980	0875f5a33c42d1402b721166f2d2b060_NeikiAnalytics.exe
2980	0875f5a33c42d1402b721166f2d2b060_NeikiAnalytics.exe
2980	0875f5a33c42d1402b721166f2d2b060_NeikiAnalytics.exe
2980	0875f5a33c42d1402b721166f2d2b060_NeikiAnalytics.exe
2980	0875f5a33c42d1402b721166f2d2b060_NeikiAnalytics.exe
2980	0875f5a33c42d1402b721166f2d2b060_NeikiAnalytics.exe
2980	0875f5a33c42d1402b721166f2d2b060_NeikiAnalytics.exe
2980	0875f5a33c42d1402b721166f2d2b060_NeikiAnalytics.exe

UPX packed file 52 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2980-1-0x000000013F600000-0x000000013F9F6000-memory.dmp	upx
behavioral1/files/0x000c00000001227b-6.dat	upx
behavioral1/files/0x0037000000016d3d-9.dat	upx
behavioral1/files/0x0007000000016dda-30.dat	upx
behavioral1/files/0x0008000000016de7-39.dat	upx
behavioral1/files/0x0009000000017042-45.dat	upx
behavioral1/files/0x000500000001878d-54.dat	upx
behavioral1/files/0x0006000000018bf0-59.dat	upx
behavioral1/files/0x0005000000019275-85.dat	upx
behavioral1/files/0x0005000000019283-94.dat	upx
behavioral1/files/0x000500000001954b-170.dat	upx
behavioral1/memory/2840-290-0x000000013FCA0000-0x0000000140096000-memory.dmp	upx
behavioral1/memory/2688-314-0x000000013F6F0000-0x000000013FAE6000-memory.dmp	upx
behavioral1/memory/1832-310-0x000000013F8B0000-0x000000013FCA6000-memory.dmp	upx
behavioral1/memory/1232-306-0x000000013F6F0000-0x000000013FAE6000-memory.dmp	upx
behavioral1/memory/1236-304-0x000000013F050000-0x000000013F446000-memory.dmp	upx
behavioral1/memory/3036-302-0x000000013F880000-0x000000013FC76000-memory.dmp	upx
behavioral1/memory/2576-300-0x000000013FD50000-0x0000000140146000-memory.dmp	upx
behavioral1/memory/2472-298-0x000000013F550000-0x000000013F946000-memory.dmp	upx
behavioral1/memory/2728-295-0x000000013FE20000-0x0000000140216000-memory.dmp	upx
behavioral1/memory/2592-292-0x000000013F5D0000-0x000000013F9C6000-memory.dmp	upx
behavioral1/files/0x0005000000019501-161.dat	upx
behavioral1/files/0x00050000000194eb-153.dat	upx
behavioral1/files/0x00050000000194a8-145.dat	upx
behavioral1/files/0x0005000000019462-137.dat	upx
behavioral1/files/0x00050000000193b1-122.dat	upx
behavioral1/files/0x000500000001943e-129.dat	upx
behavioral1/files/0x000500000001957d-173.dat	upx
behavioral1/files/0x0005000000019507-166.dat	upx
behavioral1/files/0x00050000000194ef-157.dat	upx
behavioral1/files/0x00050000000194b8-149.dat	upx
behavioral1/files/0x0005000000019491-142.dat	upx
behavioral1/files/0x0005000000019457-134.dat	upx
behavioral1/files/0x0005000000019433-126.dat	upx
behavioral1/files/0x000500000001939f-109.dat	upx
behavioral1/files/0x00050000000193a5-115.dat	upx
behavioral1/files/0x000500000001933a-99.dat	upx
behavioral1/files/0x0005000000019381-104.dat	upx
behavioral1/files/0x0005000000019277-89.dat	upx
behavioral1/files/0x0005000000019260-79.dat	upx
behavioral1/files/0x000500000001925d-74.dat	upx
behavioral1/files/0x000500000001923b-69.dat	upx
behavioral1/files/0x0005000000019228-64.dat	upx
behavioral1/files/0x0007000000017477-49.dat	upx
behavioral1/files/0x0007000000004e76-35.dat	upx
behavioral1/memory/2560-25-0x000000013FFA0000-0x0000000140396000-memory.dmp	upx
behavioral1/files/0x0008000000016d69-18.dat	upx
behavioral1/memory/1932-16-0x000000013F250000-0x000000013F646000-memory.dmp	upx
behavioral1/memory/2980-3133-0x000000013F600000-0x000000013F9F6000-memory.dmp	upx
behavioral1/memory/2728-5149-0x000000013FE20000-0x0000000140216000-memory.dmp	upx
behavioral1/memory/1832-5158-0x000000013F8B0000-0x000000013FCA6000-memory.dmp	upx
behavioral1/memory/1232-5157-0x000000013F6F0000-0x000000013FAE6000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\qfIHPAV.exe	0875f5a33c42d1402b721166f2d2b060_NeikiAnalytics.exe
File created	C:\Windows\System\XcWjsbm.exe	0875f5a33c42d1402b721166f2d2b060_NeikiAnalytics.exe
File created	C:\Windows\System\aDwKvxd.exe	0875f5a33c42d1402b721166f2d2b060_NeikiAnalytics.exe
File created	C:\Windows\System\nBVADHw.exe	0875f5a33c42d1402b721166f2d2b060_NeikiAnalytics.exe
File created	C:\Windows\System\zCCQvyw.exe	0875f5a33c42d1402b721166f2d2b060_NeikiAnalytics.exe
File created	C:\Windows\System\tiROWTZ.exe	0875f5a33c42d1402b721166f2d2b060_NeikiAnalytics.exe
File created	C:\Windows\System\TxkSuPQ.exe	0875f5a33c42d1402b721166f2d2b060_NeikiAnalytics.exe
File created	C:\Windows\System\agJInuE.exe	0875f5a33c42d1402b721166f2d2b060_NeikiAnalytics.exe
File created	C:\Windows\System\aXWZakO.exe	0875f5a33c42d1402b721166f2d2b060_NeikiAnalytics.exe
File created	C:\Windows\System\igwaJNo.exe	0875f5a33c42d1402b721166f2d2b060_NeikiAnalytics.exe
File created	C:\Windows\System\OMVPVWD.exe	0875f5a33c42d1402b721166f2d2b060_NeikiAnalytics.exe
File created	C:\Windows\System\DYUdQsD.exe	0875f5a33c42d1402b721166f2d2b060_NeikiAnalytics.exe
File created	C:\Windows\System\dLUhJKu.exe	0875f5a33c42d1402b721166f2d2b060_NeikiAnalytics.exe
File created	C:\Windows\System\TLuwzVs.exe	0875f5a33c42d1402b721166f2d2b060_NeikiAnalytics.exe
File created	C:\Windows\System\DIhmxhZ.exe	0875f5a33c42d1402b721166f2d2b060_NeikiAnalytics.exe
File created	C:\Windows\System\rcydcNz.exe	0875f5a33c42d1402b721166f2d2b060_NeikiAnalytics.exe
File created	C:\Windows\System\RndxzLp.exe	0875f5a33c42d1402b721166f2d2b060_NeikiAnalytics.exe
File created	C:\Windows\System\Aarnrwc.exe	0875f5a33c42d1402b721166f2d2b060_NeikiAnalytics.exe
File created	C:\Windows\System\CRNQCWT.exe	0875f5a33c42d1402b721166f2d2b060_NeikiAnalytics.exe
File created	C:\Windows\System\sbbfLsf.exe	0875f5a33c42d1402b721166f2d2b060_NeikiAnalytics.exe
File created	C:\Windows\System\dgVjgJz.exe	0875f5a33c42d1402b721166f2d2b060_NeikiAnalytics.exe
File created	C:\Windows\System\UjKOJYb.exe	0875f5a33c42d1402b721166f2d2b060_NeikiAnalytics.exe
File created	C:\Windows\System\QnBIbuf.exe	0875f5a33c42d1402b721166f2d2b060_NeikiAnalytics.exe
File created	C:\Windows\System\mtenZZf.exe	0875f5a33c42d1402b721166f2d2b060_NeikiAnalytics.exe
File created	C:\Windows\System\RloZXzk.exe	0875f5a33c42d1402b721166f2d2b060_NeikiAnalytics.exe
File created	C:\Windows\System\ZTYhNxA.exe	0875f5a33c42d1402b721166f2d2b060_NeikiAnalytics.exe
File created	C:\Windows\System\jKdgNNo.exe	0875f5a33c42d1402b721166f2d2b060_NeikiAnalytics.exe
File created	C:\Windows\System\kXyJRGb.exe	0875f5a33c42d1402b721166f2d2b060_NeikiAnalytics.exe
File created	C:\Windows\System\sFUHxUi.exe	0875f5a33c42d1402b721166f2d2b060_NeikiAnalytics.exe
File created	C:\Windows\System\NnYARwV.exe	0875f5a33c42d1402b721166f2d2b060_NeikiAnalytics.exe
File created	C:\Windows\System\ESXnlsW.exe	0875f5a33c42d1402b721166f2d2b060_NeikiAnalytics.exe
File created	C:\Windows\System\fCxMkra.exe	0875f5a33c42d1402b721166f2d2b060_NeikiAnalytics.exe
File created	C:\Windows\System\aJJINjT.exe	0875f5a33c42d1402b721166f2d2b060_NeikiAnalytics.exe
File created	C:\Windows\System\yWaEtjP.exe	0875f5a33c42d1402b721166f2d2b060_NeikiAnalytics.exe
File created	C:\Windows\System\bjRknrw.exe	0875f5a33c42d1402b721166f2d2b060_NeikiAnalytics.exe
File created	C:\Windows\System\QObuBnl.exe	0875f5a33c42d1402b721166f2d2b060_NeikiAnalytics.exe
File created	C:\Windows\System\AvvMvPL.exe	0875f5a33c42d1402b721166f2d2b060_NeikiAnalytics.exe
File created	C:\Windows\System\WglfGZL.exe	0875f5a33c42d1402b721166f2d2b060_NeikiAnalytics.exe
File created	C:\Windows\System\WhpSCpP.exe	0875f5a33c42d1402b721166f2d2b060_NeikiAnalytics.exe
File created	C:\Windows\System\TrpdMuM.exe	0875f5a33c42d1402b721166f2d2b060_NeikiAnalytics.exe
File created	C:\Windows\System\iGtBHXj.exe	0875f5a33c42d1402b721166f2d2b060_NeikiAnalytics.exe
File created	C:\Windows\System\IouitCi.exe	0875f5a33c42d1402b721166f2d2b060_NeikiAnalytics.exe
File created	C:\Windows\System\jbyqVUv.exe	0875f5a33c42d1402b721166f2d2b060_NeikiAnalytics.exe
File created	C:\Windows\System\ZbXXVil.exe	0875f5a33c42d1402b721166f2d2b060_NeikiAnalytics.exe
File created	C:\Windows\System\nkFILnR.exe	0875f5a33c42d1402b721166f2d2b060_NeikiAnalytics.exe
File created	C:\Windows\System\iYuvWNC.exe	0875f5a33c42d1402b721166f2d2b060_NeikiAnalytics.exe
File created	C:\Windows\System\VTYmtkj.exe	0875f5a33c42d1402b721166f2d2b060_NeikiAnalytics.exe
File created	C:\Windows\System\mTGjAFG.exe	0875f5a33c42d1402b721166f2d2b060_NeikiAnalytics.exe
File created	C:\Windows\System\Pbogawf.exe	0875f5a33c42d1402b721166f2d2b060_NeikiAnalytics.exe
File created	C:\Windows\System\LlSQEzr.exe	0875f5a33c42d1402b721166f2d2b060_NeikiAnalytics.exe
File created	C:\Windows\System\rNkCuBh.exe	0875f5a33c42d1402b721166f2d2b060_NeikiAnalytics.exe
File created	C:\Windows\System\bfkaglW.exe	0875f5a33c42d1402b721166f2d2b060_NeikiAnalytics.exe
File created	C:\Windows\System\IkzsJir.exe	0875f5a33c42d1402b721166f2d2b060_NeikiAnalytics.exe
File created	C:\Windows\System\gqOUziD.exe	0875f5a33c42d1402b721166f2d2b060_NeikiAnalytics.exe
File created	C:\Windows\System\kPmCuVE.exe	0875f5a33c42d1402b721166f2d2b060_NeikiAnalytics.exe
File created	C:\Windows\System\zyflMDT.exe	0875f5a33c42d1402b721166f2d2b060_NeikiAnalytics.exe
File created	C:\Windows\System\sVdDDex.exe	0875f5a33c42d1402b721166f2d2b060_NeikiAnalytics.exe
File created	C:\Windows\System\eDTNqoY.exe	0875f5a33c42d1402b721166f2d2b060_NeikiAnalytics.exe
File created	C:\Windows\System\XztxUay.exe	0875f5a33c42d1402b721166f2d2b060_NeikiAnalytics.exe
File created	C:\Windows\System\CudYPwO.exe	0875f5a33c42d1402b721166f2d2b060_NeikiAnalytics.exe
File created	C:\Windows\System\cEHOHKg.exe	0875f5a33c42d1402b721166f2d2b060_NeikiAnalytics.exe
File created	C:\Windows\System\wZPIhqs.exe	0875f5a33c42d1402b721166f2d2b060_NeikiAnalytics.exe
File created	C:\Windows\System\cyoqSAE.exe	0875f5a33c42d1402b721166f2d2b060_NeikiAnalytics.exe
File created	C:\Windows\System\dJuKKqF.exe	0875f5a33c42d1402b721166f2d2b060_NeikiAnalytics.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2748	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2980	0875f5a33c42d1402b721166f2d2b060_NeikiAnalytics.exe
Token: SeLockMemoryPrivilege	2980	0875f5a33c42d1402b721166f2d2b060_NeikiAnalytics.exe
Token: SeDebugPrivilege	2748	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2980 wrote to memory of 2748	2980	0875f5a33c42d1402b721166f2d2b060_NeikiAnalytics.exe	29
PID 2980 wrote to memory of 2748	2980	0875f5a33c42d1402b721166f2d2b060_NeikiAnalytics.exe	29
PID 2980 wrote to memory of 2748	2980	0875f5a33c42d1402b721166f2d2b060_NeikiAnalytics.exe	29
PID 2980 wrote to memory of 1932	2980	0875f5a33c42d1402b721166f2d2b060_NeikiAnalytics.exe	30
PID 2980 wrote to memory of 1932	2980	0875f5a33c42d1402b721166f2d2b060_NeikiAnalytics.exe	30
PID 2980 wrote to memory of 1932	2980	0875f5a33c42d1402b721166f2d2b060_NeikiAnalytics.exe	30
PID 2980 wrote to memory of 2560	2980	0875f5a33c42d1402b721166f2d2b060_NeikiAnalytics.exe	31
PID 2980 wrote to memory of 2560	2980	0875f5a33c42d1402b721166f2d2b060_NeikiAnalytics.exe	31
PID 2980 wrote to memory of 2560	2980	0875f5a33c42d1402b721166f2d2b060_NeikiAnalytics.exe	31
PID 2980 wrote to memory of 2688	2980	0875f5a33c42d1402b721166f2d2b060_NeikiAnalytics.exe	32
PID 2980 wrote to memory of 2688	2980	0875f5a33c42d1402b721166f2d2b060_NeikiAnalytics.exe	32
PID 2980 wrote to memory of 2688	2980	0875f5a33c42d1402b721166f2d2b060_NeikiAnalytics.exe	32
PID 2980 wrote to memory of 2840	2980	0875f5a33c42d1402b721166f2d2b060_NeikiAnalytics.exe	33
PID 2980 wrote to memory of 2840	2980	0875f5a33c42d1402b721166f2d2b060_NeikiAnalytics.exe	33
PID 2980 wrote to memory of 2840	2980	0875f5a33c42d1402b721166f2d2b060_NeikiAnalytics.exe	33
PID 2980 wrote to memory of 2592	2980	0875f5a33c42d1402b721166f2d2b060_NeikiAnalytics.exe	34
PID 2980 wrote to memory of 2592	2980	0875f5a33c42d1402b721166f2d2b060_NeikiAnalytics.exe	34
PID 2980 wrote to memory of 2592	2980	0875f5a33c42d1402b721166f2d2b060_NeikiAnalytics.exe	34
PID 2980 wrote to memory of 2728	2980	0875f5a33c42d1402b721166f2d2b060_NeikiAnalytics.exe	35
PID 2980 wrote to memory of 2728	2980	0875f5a33c42d1402b721166f2d2b060_NeikiAnalytics.exe	35
PID 2980 wrote to memory of 2728	2980	0875f5a33c42d1402b721166f2d2b060_NeikiAnalytics.exe	35
PID 2980 wrote to memory of 2472	2980	0875f5a33c42d1402b721166f2d2b060_NeikiAnalytics.exe	36
PID 2980 wrote to memory of 2472	2980	0875f5a33c42d1402b721166f2d2b060_NeikiAnalytics.exe	36
PID 2980 wrote to memory of 2472	2980	0875f5a33c42d1402b721166f2d2b060_NeikiAnalytics.exe	36
PID 2980 wrote to memory of 2576	2980	0875f5a33c42d1402b721166f2d2b060_NeikiAnalytics.exe	37
PID 2980 wrote to memory of 2576	2980	0875f5a33c42d1402b721166f2d2b060_NeikiAnalytics.exe	37
PID 2980 wrote to memory of 2576	2980	0875f5a33c42d1402b721166f2d2b060_NeikiAnalytics.exe	37
PID 2980 wrote to memory of 3036	2980	0875f5a33c42d1402b721166f2d2b060_NeikiAnalytics.exe	38
PID 2980 wrote to memory of 3036	2980	0875f5a33c42d1402b721166f2d2b060_NeikiAnalytics.exe	38
PID 2980 wrote to memory of 3036	2980	0875f5a33c42d1402b721166f2d2b060_NeikiAnalytics.exe	38
PID 2980 wrote to memory of 1236	2980	0875f5a33c42d1402b721166f2d2b060_NeikiAnalytics.exe	39
PID 2980 wrote to memory of 1236	2980	0875f5a33c42d1402b721166f2d2b060_NeikiAnalytics.exe	39
PID 2980 wrote to memory of 1236	2980	0875f5a33c42d1402b721166f2d2b060_NeikiAnalytics.exe	39
PID 2980 wrote to memory of 1232	2980	0875f5a33c42d1402b721166f2d2b060_NeikiAnalytics.exe	40
PID 2980 wrote to memory of 1232	2980	0875f5a33c42d1402b721166f2d2b060_NeikiAnalytics.exe	40
PID 2980 wrote to memory of 1232	2980	0875f5a33c42d1402b721166f2d2b060_NeikiAnalytics.exe	40
PID 2980 wrote to memory of 1832	2980	0875f5a33c42d1402b721166f2d2b060_NeikiAnalytics.exe	41
PID 2980 wrote to memory of 1832	2980	0875f5a33c42d1402b721166f2d2b060_NeikiAnalytics.exe	41
PID 2980 wrote to memory of 1832	2980	0875f5a33c42d1402b721166f2d2b060_NeikiAnalytics.exe	41
PID 2980 wrote to memory of 2768	2980	0875f5a33c42d1402b721166f2d2b060_NeikiAnalytics.exe	42
PID 2980 wrote to memory of 2768	2980	0875f5a33c42d1402b721166f2d2b060_NeikiAnalytics.exe	42
PID 2980 wrote to memory of 2768	2980	0875f5a33c42d1402b721166f2d2b060_NeikiAnalytics.exe	42
PID 2980 wrote to memory of 2780	2980	0875f5a33c42d1402b721166f2d2b060_NeikiAnalytics.exe	43
PID 2980 wrote to memory of 2780	2980	0875f5a33c42d1402b721166f2d2b060_NeikiAnalytics.exe	43
PID 2980 wrote to memory of 2780	2980	0875f5a33c42d1402b721166f2d2b060_NeikiAnalytics.exe	43
PID 2980 wrote to memory of 1580	2980	0875f5a33c42d1402b721166f2d2b060_NeikiAnalytics.exe	44
PID 2980 wrote to memory of 1580	2980	0875f5a33c42d1402b721166f2d2b060_NeikiAnalytics.exe	44
PID 2980 wrote to memory of 1580	2980	0875f5a33c42d1402b721166f2d2b060_NeikiAnalytics.exe	44
PID 2980 wrote to memory of 1664	2980	0875f5a33c42d1402b721166f2d2b060_NeikiAnalytics.exe	45
PID 2980 wrote to memory of 1664	2980	0875f5a33c42d1402b721166f2d2b060_NeikiAnalytics.exe	45
PID 2980 wrote to memory of 1664	2980	0875f5a33c42d1402b721166f2d2b060_NeikiAnalytics.exe	45
PID 2980 wrote to memory of 272	2980	0875f5a33c42d1402b721166f2d2b060_NeikiAnalytics.exe	46
PID 2980 wrote to memory of 272	2980	0875f5a33c42d1402b721166f2d2b060_NeikiAnalytics.exe	46
PID 2980 wrote to memory of 272	2980	0875f5a33c42d1402b721166f2d2b060_NeikiAnalytics.exe	46
PID 2980 wrote to memory of 276	2980	0875f5a33c42d1402b721166f2d2b060_NeikiAnalytics.exe	47
PID 2980 wrote to memory of 276	2980	0875f5a33c42d1402b721166f2d2b060_NeikiAnalytics.exe	47
PID 2980 wrote to memory of 276	2980	0875f5a33c42d1402b721166f2d2b060_NeikiAnalytics.exe	47
PID 2980 wrote to memory of 1492	2980	0875f5a33c42d1402b721166f2d2b060_NeikiAnalytics.exe	48
PID 2980 wrote to memory of 1492	2980	0875f5a33c42d1402b721166f2d2b060_NeikiAnalytics.exe	48
PID 2980 wrote to memory of 1492	2980	0875f5a33c42d1402b721166f2d2b060_NeikiAnalytics.exe	48
PID 2980 wrote to memory of 2120	2980	0875f5a33c42d1402b721166f2d2b060_NeikiAnalytics.exe	49
PID 2980 wrote to memory of 2120	2980	0875f5a33c42d1402b721166f2d2b060_NeikiAnalytics.exe	49
PID 2980 wrote to memory of 2120	2980	0875f5a33c42d1402b721166f2d2b060_NeikiAnalytics.exe	49
PID 2980 wrote to memory of 2344	2980	0875f5a33c42d1402b721166f2d2b060_NeikiAnalytics.exe	50

C:\Users\Admin\AppData\Local\Temp\0875f5a33c42d1402b721166f2d2b060_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\0875f5a33c42d1402b721166f2d2b060_NeikiAnalytics.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2980
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2748
- C:\Windows\System\kXgCFLz.exe
  C:\Windows\System\kXgCFLz.exe
  2⤵
  - Executes dropped EXE
  PID:1932
- C:\Windows\System\semKiLB.exe
  C:\Windows\System\semKiLB.exe
  2⤵
  - Executes dropped EXE
  PID:2560
- C:\Windows\System\QGUMgki.exe
  C:\Windows\System\QGUMgki.exe
  2⤵
  - Executes dropped EXE
  PID:2688
- C:\Windows\System\DWcaHVp.exe
  C:\Windows\System\DWcaHVp.exe
  2⤵
  - Executes dropped EXE
  PID:2840
- C:\Windows\System\aucLKQz.exe
  C:\Windows\System\aucLKQz.exe
  2⤵
  - Executes dropped EXE
  PID:2592
- C:\Windows\System\qXzbLwk.exe
  C:\Windows\System\qXzbLwk.exe
  2⤵
  - Executes dropped EXE
  PID:2728
- C:\Windows\System\Skjlyjp.exe
  C:\Windows\System\Skjlyjp.exe
  2⤵
  - Executes dropped EXE
  PID:2472
- C:\Windows\System\iJVJEoM.exe
  C:\Windows\System\iJVJEoM.exe
  2⤵
  - Executes dropped EXE
  PID:2576
- C:\Windows\System\TKApdyG.exe
  C:\Windows\System\TKApdyG.exe
  2⤵
  - Executes dropped EXE
  PID:3036
- C:\Windows\System\NoaQyLJ.exe
  C:\Windows\System\NoaQyLJ.exe
  2⤵
  - Executes dropped EXE
  PID:1236
- C:\Windows\System\CJcJaQB.exe
  C:\Windows\System\CJcJaQB.exe
  2⤵
  - Executes dropped EXE
  PID:1232
- C:\Windows\System\wZCIPyr.exe
  C:\Windows\System\wZCIPyr.exe
  2⤵
  - Executes dropped EXE
  PID:1832
- C:\Windows\System\skGLPhe.exe
  C:\Windows\System\skGLPhe.exe
  2⤵
  - Executes dropped EXE
  PID:2768
- C:\Windows\System\HDaMJhU.exe
  C:\Windows\System\HDaMJhU.exe
  2⤵
  - Executes dropped EXE
  PID:2780
- C:\Windows\System\OypVewi.exe
  C:\Windows\System\OypVewi.exe
  2⤵
  - Executes dropped EXE
  PID:1580
- C:\Windows\System\KFtnQEK.exe
  C:\Windows\System\KFtnQEK.exe
  2⤵
  - Executes dropped EXE
  PID:1664
- C:\Windows\System\vZibEQn.exe
  C:\Windows\System\vZibEQn.exe
  2⤵
  - Executes dropped EXE
  PID:272
- C:\Windows\System\qHwiTdR.exe
  C:\Windows\System\qHwiTdR.exe
  2⤵
  - Executes dropped EXE
  PID:276
- C:\Windows\System\EmiZOYl.exe
  C:\Windows\System\EmiZOYl.exe
  2⤵
  - Executes dropped EXE
  PID:1492
- C:\Windows\System\ZsMTuZu.exe
  C:\Windows\System\ZsMTuZu.exe
  2⤵
  - Executes dropped EXE
  PID:2120
- C:\Windows\System\zNerLHT.exe
  C:\Windows\System\zNerLHT.exe
  2⤵
  - Executes dropped EXE
  PID:2344
- C:\Windows\System\VExlmqT.exe
  C:\Windows\System\VExlmqT.exe
  2⤵
  - Executes dropped EXE
  PID:480
- C:\Windows\System\JrSqHah.exe
  C:\Windows\System\JrSqHah.exe
  2⤵
  - Executes dropped EXE
  PID:2140
- C:\Windows\System\HZcQyxz.exe
  C:\Windows\System\HZcQyxz.exe
  2⤵
  - Executes dropped EXE
  PID:2020
- C:\Windows\System\mybtstE.exe
  C:\Windows\System\mybtstE.exe
  2⤵
  - Executes dropped EXE
  PID:1156
- C:\Windows\System\jPqJDLl.exe
  C:\Windows\System\jPqJDLl.exe
  2⤵
  - Executes dropped EXE
  PID:1924
- C:\Windows\System\aMPIYNk.exe
  C:\Windows\System\aMPIYNk.exe
  2⤵
  - Executes dropped EXE
  PID:2208
- C:\Windows\System\kkbPucp.exe
  C:\Windows\System\kkbPucp.exe
  2⤵
  - Executes dropped EXE
  PID:1112
- C:\Windows\System\xzjGeGd.exe
  C:\Windows\System\xzjGeGd.exe
  2⤵
  - Executes dropped EXE
  PID:1052
- C:\Windows\System\noKRZjG.exe
  C:\Windows\System\noKRZjG.exe
  2⤵
  - Executes dropped EXE
  PID:2644
- C:\Windows\System\EwULBxe.exe
  C:\Windows\System\EwULBxe.exe
  2⤵
  - Executes dropped EXE
  PID:1076
- C:\Windows\System\Qgkpnjc.exe
  C:\Windows\System\Qgkpnjc.exe
  2⤵
  - Executes dropped EXE
  PID:3068
- C:\Windows\System\YTpEsgW.exe
  C:\Windows\System\YTpEsgW.exe
  2⤵
  - Executes dropped EXE
  PID:2316
- C:\Windows\System\KnexswZ.exe
  C:\Windows\System\KnexswZ.exe
  2⤵
  - Executes dropped EXE
  PID:2412
- C:\Windows\System\fIDHcNG.exe
  C:\Windows\System\fIDHcNG.exe
  2⤵
  - Executes dropped EXE
  PID:2892
- C:\Windows\System\TbrTIKW.exe
  C:\Windows\System\TbrTIKW.exe
  2⤵
  - Executes dropped EXE
  PID:1680
- C:\Windows\System\BANEQOi.exe
  C:\Windows\System\BANEQOi.exe
  2⤵
  - Executes dropped EXE
  PID:1804
- C:\Windows\System\iinrPms.exe
  C:\Windows\System\iinrPms.exe
  2⤵
  - Executes dropped EXE
  PID:1444
- C:\Windows\System\hkmYSeZ.exe
  C:\Windows\System\hkmYSeZ.exe
  2⤵
  - Executes dropped EXE
  PID:956
- C:\Windows\System\guxeZDZ.exe
  C:\Windows\System\guxeZDZ.exe
  2⤵
  - Executes dropped EXE
  PID:952
- C:\Windows\System\iBxeMbY.exe
  C:\Windows\System\iBxeMbY.exe
  2⤵
  - Executes dropped EXE
  PID:1012
- C:\Windows\System\yEpOBIT.exe
  C:\Windows\System\yEpOBIT.exe
  2⤵
  - Executes dropped EXE
  PID:1656
- C:\Windows\System\zPwqGOl.exe
  C:\Windows\System\zPwqGOl.exe
  2⤵
  - Executes dropped EXE
  PID:836
- C:\Windows\System\zSQCaLx.exe
  C:\Windows\System\zSQCaLx.exe
  2⤵
  - Executes dropped EXE
  PID:1940
- C:\Windows\System\yxcwWOu.exe
  C:\Windows\System\yxcwWOu.exe
  2⤵
  - Executes dropped EXE
  PID:2320
- C:\Windows\System\feNHtOx.exe
  C:\Windows\System\feNHtOx.exe
  2⤵
  - Executes dropped EXE
  PID:1984
- C:\Windows\System\ejAgCkP.exe
  C:\Windows\System\ejAgCkP.exe
  2⤵
  - Executes dropped EXE
  PID:1980
- C:\Windows\System\YPjcARr.exe
  C:\Windows\System\YPjcARr.exe
  2⤵
  - Executes dropped EXE
  PID:1708
- C:\Windows\System\CfVhjQn.exe
  C:\Windows\System\CfVhjQn.exe
  2⤵
  - Executes dropped EXE
  PID:2072
- C:\Windows\System\XXOeMfw.exe
  C:\Windows\System\XXOeMfw.exe
  2⤵
  - Executes dropped EXE
  PID:616
- C:\Windows\System\zLjeuTd.exe
  C:\Windows\System\zLjeuTd.exe
  2⤵
  - Executes dropped EXE
  PID:2244
- C:\Windows\System\cRjVHZl.exe
  C:\Windows\System\cRjVHZl.exe
  2⤵
  - Executes dropped EXE
  PID:1908
- C:\Windows\System\rpRlSSn.exe
  C:\Windows\System\rpRlSSn.exe
  2⤵
  - Executes dropped EXE
  PID:1968
- C:\Windows\System\wTkyVjg.exe
  C:\Windows\System\wTkyVjg.exe
  2⤵
  - Executes dropped EXE
  PID:2368
- C:\Windows\System\uWnRInA.exe
  C:\Windows\System\uWnRInA.exe
  2⤵
  - Executes dropped EXE
  PID:1896
- C:\Windows\System\tpZnQpz.exe
  C:\Windows\System\tpZnQpz.exe
  2⤵
  - Executes dropped EXE
  PID:2372
- C:\Windows\System\QKgVfjT.exe
  C:\Windows\System\QKgVfjT.exe
  2⤵
  - Executes dropped EXE
  PID:2564
- C:\Windows\System\wrrvyZr.exe
  C:\Windows\System\wrrvyZr.exe
  2⤵
  - Executes dropped EXE
  PID:1616
- C:\Windows\System\TPkGMfX.exe
  C:\Windows\System\TPkGMfX.exe
  2⤵
  - Executes dropped EXE
  PID:2732
- C:\Windows\System\ueJsJKg.exe
  C:\Windows\System\ueJsJKg.exe
  2⤵
  - Executes dropped EXE
  PID:2676
- C:\Windows\System\CKZJVpE.exe
  C:\Windows\System\CKZJVpE.exe
  2⤵
  - Executes dropped EXE
  PID:2736
- C:\Windows\System\xfCpHSG.exe
  C:\Windows\System\xfCpHSG.exe
  2⤵
  PID:2628
- C:\Windows\System\LQJTVEs.exe
  C:\Windows\System\LQJTVEs.exe
  2⤵
  - Executes dropped EXE
  PID:2452
- C:\Windows\System\agcjbtf.exe
  C:\Windows\System\agcjbtf.exe
  2⤵
  PID:2952
- C:\Windows\System\QKfbbAf.exe
  C:\Windows\System\QKfbbAf.exe
  2⤵
  - Executes dropped EXE
  PID:1944
- C:\Windows\System\fuVXlao.exe
  C:\Windows\System\fuVXlao.exe
  2⤵
  PID:2444
- C:\Windows\System\NANNrZS.exe
  C:\Windows\System\NANNrZS.exe
  2⤵
  - Executes dropped EXE
  PID:2784
- C:\Windows\System\aHQFgha.exe
  C:\Windows\System\aHQFgha.exe
  2⤵
  PID:1524
- C:\Windows\System\bzzsGSD.exe
  C:\Windows\System\bzzsGSD.exe
  2⤵
  PID:2156
- C:\Windows\System\EdZBren.exe
  C:\Windows\System\EdZBren.exe
  2⤵
  PID:3020
- C:\Windows\System\zlTHEWb.exe
  C:\Windows\System\zlTHEWb.exe
  2⤵
  PID:2816
- C:\Windows\System\UAyGJfn.exe
  C:\Windows\System\UAyGJfn.exe
  2⤵
  PID:1964
- C:\Windows\System\VdutzqJ.exe
  C:\Windows\System\VdutzqJ.exe
  2⤵
  PID:1412
- C:\Windows\System\fCsJRvh.exe
  C:\Windows\System\fCsJRvh.exe
  2⤵
  PID:696
- C:\Windows\System\raFGBjj.exe
  C:\Windows\System\raFGBjj.exe
  2⤵
  PID:2092
- C:\Windows\System\rZUlwxk.exe
  C:\Windows\System\rZUlwxk.exe
  2⤵
  PID:1264
- C:\Windows\System\MXgCKUQ.exe
  C:\Windows\System\MXgCKUQ.exe
  2⤵
  PID:1660
- C:\Windows\System\KdPUCdB.exe
  C:\Windows\System\KdPUCdB.exe
  2⤵
  PID:2280
- C:\Windows\System\jxXwtAl.exe
  C:\Windows\System\jxXwtAl.exe
  2⤵
  PID:1852
- C:\Windows\System\qQsPIHx.exe
  C:\Windows\System\qQsPIHx.exe
  2⤵
  PID:2228
- C:\Windows\System\OsYXLwv.exe
  C:\Windows\System\OsYXLwv.exe
  2⤵
  PID:2132
- C:\Windows\System\mJwkHEA.exe
  C:\Windows\System\mJwkHEA.exe
  2⤵
  PID:1512
- C:\Windows\System\vEBtUkW.exe
  C:\Windows\System\vEBtUkW.exe
  2⤵
  PID:2820
- C:\Windows\System\tDarVGB.exe
  C:\Windows\System\tDarVGB.exe
  2⤵
  PID:288
- C:\Windows\System\MAfEaSP.exe
  C:\Windows\System\MAfEaSP.exe
  2⤵
  PID:1328
- C:\Windows\System\XvOeJDS.exe
  C:\Windows\System\XvOeJDS.exe
  2⤵
  PID:2632
- C:\Windows\System\fiqPeII.exe
  C:\Windows\System\fiqPeII.exe
  2⤵
  PID:1536
- C:\Windows\System\ljEGVaK.exe
  C:\Windows\System\ljEGVaK.exe
  2⤵
  PID:2028
- C:\Windows\System\gdqtDNk.exe
  C:\Windows\System\gdqtDNk.exe
  2⤵
  PID:668
- C:\Windows\System\mhpoAmK.exe
  C:\Windows\System\mhpoAmK.exe
  2⤵
  PID:1392
- C:\Windows\System\RAtgpeu.exe
  C:\Windows\System\RAtgpeu.exe
  2⤵
  PID:2284
- C:\Windows\System\bZaQVPm.exe
  C:\Windows\System\bZaQVPm.exe
  2⤵
  PID:1228
- C:\Windows\System\VsUHmOb.exe
  C:\Windows\System\VsUHmOb.exe
  2⤵
  PID:800
- C:\Windows\System\sLbVjav.exe
  C:\Windows\System\sLbVjav.exe
  2⤵
  PID:2428
- C:\Windows\System\ejlMQUt.exe
  C:\Windows\System\ejlMQUt.exe
  2⤵
  PID:3012
- C:\Windows\System\HRiwaGb.exe
  C:\Windows\System\HRiwaGb.exe
  2⤵
  PID:2596
- C:\Windows\System\WQzoCdv.exe
  C:\Windows\System\WQzoCdv.exe
  2⤵
  PID:2624
- C:\Windows\System\vefFjnb.exe
  C:\Windows\System\vefFjnb.exe
  2⤵
  PID:2556
- C:\Windows\System\ntlQSuA.exe
  C:\Windows\System\ntlQSuA.exe
  2⤵
  PID:328
- C:\Windows\System\vyMFkKQ.exe
  C:\Windows\System\vyMFkKQ.exe
  2⤵
  PID:2160
- C:\Windows\System\zHTnWKi.exe
  C:\Windows\System\zHTnWKi.exe
  2⤵
  PID:2532
- C:\Windows\System\lvlchAh.exe
  C:\Windows\System\lvlchAh.exe
  2⤵
  PID:3032
- C:\Windows\System\SREHhDq.exe
  C:\Windows\System\SREHhDq.exe
  2⤵
  PID:1844
- C:\Windows\System\phXcSXr.exe
  C:\Windows\System\phXcSXr.exe
  2⤵
  PID:1772
- C:\Windows\System\IxuzaEG.exe
  C:\Windows\System\IxuzaEG.exe
  2⤵
  PID:916
- C:\Windows\System\UsGJVAM.exe
  C:\Windows\System\UsGJVAM.exe
  2⤵
  PID:1448
- C:\Windows\System\lxkZLsH.exe
  C:\Windows\System\lxkZLsH.exe
  2⤵
  PID:1704
- C:\Windows\System\BSEgdHZ.exe
  C:\Windows\System\BSEgdHZ.exe
  2⤵
  PID:3064
- C:\Windows\System\uvbUlyG.exe
  C:\Windows\System\uvbUlyG.exe
  2⤵
  PID:1632
- C:\Windows\System\GAwUvYV.exe
  C:\Windows\System\GAwUvYV.exe
  2⤵
  PID:2740
- C:\Windows\System\GUfeEsD.exe
  C:\Windows\System\GUfeEsD.exe
  2⤵
  PID:2384
- C:\Windows\System\FUZmSzn.exe
  C:\Windows\System\FUZmSzn.exe
  2⤵
  PID:2656
- C:\Windows\System\DhjIBDj.exe
  C:\Windows\System\DhjIBDj.exe
  2⤵
  PID:1860
- C:\Windows\System\pEiwvnO.exe
  C:\Windows\System\pEiwvnO.exe
  2⤵
  PID:1976
- C:\Windows\System\JVLqncJ.exe
  C:\Windows\System\JVLqncJ.exe
  2⤵
  PID:2396
- C:\Windows\System\KiBYlet.exe
  C:\Windows\System\KiBYlet.exe
  2⤵
  PID:1836
- C:\Windows\System\NKRkgnz.exe
  C:\Windows\System\NKRkgnz.exe
  2⤵
  PID:1652
- C:\Windows\System\bpFWPLF.exe
  C:\Windows\System\bpFWPLF.exe
  2⤵
  PID:1912
- C:\Windows\System\YVVPAkb.exe
  C:\Windows\System\YVVPAkb.exe
  2⤵
  PID:1508
- C:\Windows\System\tHCFCrM.exe
  C:\Windows\System\tHCFCrM.exe
  2⤵
  PID:996
- C:\Windows\System\PDZFWIu.exe
  C:\Windows\System\PDZFWIu.exe
  2⤵
  PID:376
- C:\Windows\System\LXdMgeM.exe
  C:\Windows\System\LXdMgeM.exe
  2⤵
  PID:2600
- C:\Windows\System\HMBHPre.exe
  C:\Windows\System\HMBHPre.exe
  2⤵
  PID:2812
- C:\Windows\System\RQuGxiI.exe
  C:\Windows\System\RQuGxiI.exe
  2⤵
  PID:856
- C:\Windows\System\inIStuE.exe
  C:\Windows\System\inIStuE.exe
  2⤵
  PID:3004
- C:\Windows\System\BGSRWIT.exe
  C:\Windows\System\BGSRWIT.exe
  2⤵
  PID:3084
- C:\Windows\System\LmznXqg.exe
  C:\Windows\System\LmznXqg.exe
  2⤵
  PID:3100
- C:\Windows\System\CvBYxzS.exe
  C:\Windows\System\CvBYxzS.exe
  2⤵
  PID:3124
- C:\Windows\System\SeCaoMi.exe
  C:\Windows\System\SeCaoMi.exe
  2⤵
  PID:3140
- C:\Windows\System\jkwMgRw.exe
  C:\Windows\System\jkwMgRw.exe
  2⤵
  PID:3160
- C:\Windows\System\fRBbpTi.exe
  C:\Windows\System\fRBbpTi.exe
  2⤵
  PID:3184
- C:\Windows\System\cQlqjth.exe
  C:\Windows\System\cQlqjth.exe
  2⤵
  PID:3204
- C:\Windows\System\pMUdZuo.exe
  C:\Windows\System\pMUdZuo.exe
  2⤵
  PID:3220
- C:\Windows\System\hNPxHrJ.exe
  C:\Windows\System\hNPxHrJ.exe
  2⤵
  PID:3244
- C:\Windows\System\sDXvUkM.exe
  C:\Windows\System\sDXvUkM.exe
  2⤵
  PID:3264
- C:\Windows\System\viJMScL.exe
  C:\Windows\System\viJMScL.exe
  2⤵
  PID:3284
- C:\Windows\System\PteEyNi.exe
  C:\Windows\System\PteEyNi.exe
  2⤵
  PID:3304
- C:\Windows\System\CEAyvVy.exe
  C:\Windows\System\CEAyvVy.exe
  2⤵
  PID:3324
- C:\Windows\System\qtdnQnd.exe
  C:\Windows\System\qtdnQnd.exe
  2⤵
  PID:3340
- C:\Windows\System\tWOIXDT.exe
  C:\Windows\System\tWOIXDT.exe
  2⤵
  PID:3360
- C:\Windows\System\npAmEUy.exe
  C:\Windows\System\npAmEUy.exe
  2⤵
  PID:3380
- C:\Windows\System\JvMrhxF.exe
  C:\Windows\System\JvMrhxF.exe
  2⤵
  PID:3400
- C:\Windows\System\NpGYRPm.exe
  C:\Windows\System\NpGYRPm.exe
  2⤵
  PID:3416
- C:\Windows\System\kHtegsG.exe
  C:\Windows\System\kHtegsG.exe
  2⤵
  PID:3436
- C:\Windows\System\lkuRsGV.exe
  C:\Windows\System\lkuRsGV.exe
  2⤵
  PID:3464
- C:\Windows\System\CTZGGUQ.exe
  C:\Windows\System\CTZGGUQ.exe
  2⤵
  PID:3484
- C:\Windows\System\gyGmRZR.exe
  C:\Windows\System\gyGmRZR.exe
  2⤵
  PID:3504
- C:\Windows\System\RzIUeiy.exe
  C:\Windows\System\RzIUeiy.exe
  2⤵
  PID:3524
- C:\Windows\System\mXbBJNj.exe
  C:\Windows\System\mXbBJNj.exe
  2⤵
  PID:3540
- C:\Windows\System\IXYxiLQ.exe
  C:\Windows\System\IXYxiLQ.exe
  2⤵
  PID:3564
- C:\Windows\System\lNniLql.exe
  C:\Windows\System\lNniLql.exe
  2⤵
  PID:3580
- C:\Windows\System\hUPMTkW.exe
  C:\Windows\System\hUPMTkW.exe
  2⤵
  PID:3600
- C:\Windows\System\PCOzAYp.exe
  C:\Windows\System\PCOzAYp.exe
  2⤵
  PID:3624
- C:\Windows\System\DuLfbpw.exe
  C:\Windows\System\DuLfbpw.exe
  2⤵
  PID:3644
- C:\Windows\System\lzBXBNi.exe
  C:\Windows\System\lzBXBNi.exe
  2⤵
  PID:3664
- C:\Windows\System\XvdLdxG.exe
  C:\Windows\System\XvdLdxG.exe
  2⤵
  PID:3684
- C:\Windows\System\YRAThEx.exe
  C:\Windows\System\YRAThEx.exe
  2⤵
  PID:3700
- C:\Windows\System\krxqvmw.exe
  C:\Windows\System\krxqvmw.exe
  2⤵
  PID:3720
- C:\Windows\System\LnPzdyy.exe
  C:\Windows\System\LnPzdyy.exe
  2⤵
  PID:3744
- C:\Windows\System\opiUeDa.exe
  C:\Windows\System\opiUeDa.exe
  2⤵
  PID:3764
- C:\Windows\System\mjPGtIj.exe
  C:\Windows\System\mjPGtIj.exe
  2⤵
  PID:3784
- C:\Windows\System\akvWFvt.exe
  C:\Windows\System\akvWFvt.exe
  2⤵
  PID:3804
- C:\Windows\System\gSOuEZH.exe
  C:\Windows\System\gSOuEZH.exe
  2⤵
  PID:3824
- C:\Windows\System\zulRtNA.exe
  C:\Windows\System\zulRtNA.exe
  2⤵
  PID:3844
- C:\Windows\System\GVjePYz.exe
  C:\Windows\System\GVjePYz.exe
  2⤵
  PID:3864
- C:\Windows\System\QmjjZBF.exe
  C:\Windows\System\QmjjZBF.exe
  2⤵
  PID:3884
- C:\Windows\System\XArTlWX.exe
  C:\Windows\System\XArTlWX.exe
  2⤵
  PID:3904
- C:\Windows\System\jSkJPkF.exe
  C:\Windows\System\jSkJPkF.exe
  2⤵
  PID:3924
- C:\Windows\System\mBQrqNG.exe
  C:\Windows\System\mBQrqNG.exe
  2⤵
  PID:3940
- C:\Windows\System\QrWYRQJ.exe
  C:\Windows\System\QrWYRQJ.exe
  2⤵
  PID:3964
- C:\Windows\System\VGTlUGW.exe
  C:\Windows\System\VGTlUGW.exe
  2⤵
  PID:3984
- C:\Windows\System\TwZVpLf.exe
  C:\Windows\System\TwZVpLf.exe
  2⤵
  PID:4004
- C:\Windows\System\ndUYQLO.exe
  C:\Windows\System\ndUYQLO.exe
  2⤵
  PID:4020
- C:\Windows\System\FTMXDVo.exe
  C:\Windows\System\FTMXDVo.exe
  2⤵
  PID:4044
- C:\Windows\System\ZDZanDa.exe
  C:\Windows\System\ZDZanDa.exe
  2⤵
  PID:4064
- C:\Windows\System\XIiDDKo.exe
  C:\Windows\System\XIiDDKo.exe
  2⤵
  PID:4084
- C:\Windows\System\AIqtQpT.exe
  C:\Windows\System\AIqtQpT.exe
  2⤵
  PID:1140
- C:\Windows\System\RRFKvUU.exe
  C:\Windows\System\RRFKvUU.exe
  2⤵
  PID:2708
- C:\Windows\System\lrmnsiV.exe
  C:\Windows\System\lrmnsiV.exe
  2⤵
  PID:2528
- C:\Windows\System\QhTQZKv.exe
  C:\Windows\System\QhTQZKv.exe
  2⤵
  PID:1776
- C:\Windows\System\reojMxL.exe
  C:\Windows\System\reojMxL.exe
  2⤵
  PID:2068
- C:\Windows\System\ebXnXPQ.exe
  C:\Windows\System\ebXnXPQ.exe
  2⤵
  PID:2896
- C:\Windows\System\JBEcGzr.exe
  C:\Windows\System\JBEcGzr.exe
  2⤵
  PID:2524
- C:\Windows\System\sLbobdT.exe
  C:\Windows\System\sLbobdT.exe
  2⤵
  PID:2968
- C:\Windows\System\BsLwoUb.exe
  C:\Windows\System\BsLwoUb.exe
  2⤵
  PID:1692
- C:\Windows\System\RmapqEa.exe
  C:\Windows\System\RmapqEa.exe
  2⤵
  PID:3108
- C:\Windows\System\UZdoRcm.exe
  C:\Windows\System\UZdoRcm.exe
  2⤵
  PID:2932
- C:\Windows\System\gXnWGqg.exe
  C:\Windows\System\gXnWGqg.exe
  2⤵
  PID:3116
- C:\Windows\System\bTdzoMU.exe
  C:\Windows\System\bTdzoMU.exe
  2⤵
  PID:3172
- C:\Windows\System\UuCUDQD.exe
  C:\Windows\System\UuCUDQD.exe
  2⤵
  PID:3200
- C:\Windows\System\CIllTHC.exe
  C:\Windows\System\CIllTHC.exe
  2⤵
  PID:3236
- C:\Windows\System\sJQaiKR.exe
  C:\Windows\System\sJQaiKR.exe
  2⤵
  PID:3216
- C:\Windows\System\xzaAVnD.exe
  C:\Windows\System\xzaAVnD.exe
  2⤵
  PID:3312
- C:\Windows\System\VaMZOdU.exe
  C:\Windows\System\VaMZOdU.exe
  2⤵
  PID:3320
- C:\Windows\System\cRbILzT.exe
  C:\Windows\System\cRbILzT.exe
  2⤵
  PID:3392
- C:\Windows\System\NXzFjnj.exe
  C:\Windows\System\NXzFjnj.exe
  2⤵
  PID:3428
- C:\Windows\System\WDEyrmt.exe
  C:\Windows\System\WDEyrmt.exe
  2⤵
  PID:3372
- C:\Windows\System\yKKTWkG.exe
  C:\Windows\System\yKKTWkG.exe
  2⤵
  PID:3480
- C:\Windows\System\wrIQlhH.exe
  C:\Windows\System\wrIQlhH.exe
  2⤵
  PID:3512
- C:\Windows\System\gbbpquo.exe
  C:\Windows\System\gbbpquo.exe
  2⤵
  PID:3520
- C:\Windows\System\kFGMnDq.exe
  C:\Windows\System\kFGMnDq.exe
  2⤵
  PID:3588
- C:\Windows\System\jlQXsAH.exe
  C:\Windows\System\jlQXsAH.exe
  2⤵
  PID:3632
- C:\Windows\System\vcblvdk.exe
  C:\Windows\System\vcblvdk.exe
  2⤵
  PID:3576
- C:\Windows\System\DQCOsYl.exe
  C:\Windows\System\DQCOsYl.exe
  2⤵
  PID:3680
- C:\Windows\System\qLjyvFh.exe
  C:\Windows\System\qLjyvFh.exe
  2⤵
  PID:3708
- C:\Windows\System\YfXPBLb.exe
  C:\Windows\System\YfXPBLb.exe
  2⤵
  PID:3760
- C:\Windows\System\eelvbFG.exe
  C:\Windows\System\eelvbFG.exe
  2⤵
  PID:3736
- C:\Windows\System\TNZFvNK.exe
  C:\Windows\System\TNZFvNK.exe
  2⤵
  PID:3800
- C:\Windows\System\whZluIq.exe
  C:\Windows\System\whZluIq.exe
  2⤵
  PID:3812
- C:\Windows\System\FPKYiWV.exe
  C:\Windows\System\FPKYiWV.exe
  2⤵
  PID:3880
- C:\Windows\System\nnmytsf.exe
  C:\Windows\System\nnmytsf.exe
  2⤵
  PID:3912
- C:\Windows\System\oUScJpR.exe
  C:\Windows\System\oUScJpR.exe
  2⤵
  PID:3920
- C:\Windows\System\KIJigeD.exe
  C:\Windows\System\KIJigeD.exe
  2⤵
  PID:3932
- C:\Windows\System\BsWWdOM.exe
  C:\Windows\System\BsWWdOM.exe
  2⤵
  PID:3980
- C:\Windows\System\uysDKTl.exe
  C:\Windows\System\uysDKTl.exe
  2⤵
  PID:4036
- C:\Windows\System\ecdbYTX.exe
  C:\Windows\System\ecdbYTX.exe
  2⤵
  PID:4052
- C:\Windows\System\ltmbOKy.exe
  C:\Windows\System\ltmbOKy.exe
  2⤵
  PID:4080
- C:\Windows\System\pDjPPzu.exe
  C:\Windows\System\pDjPPzu.exe
  2⤵
  PID:1676
- C:\Windows\System\beAemgG.exe
  C:\Windows\System\beAemgG.exe
  2⤵
  PID:2172
- C:\Windows\System\tvwcwyF.exe
  C:\Windows\System\tvwcwyF.exe
  2⤵
  PID:1784
- C:\Windows\System\kNjNpKM.exe
  C:\Windows\System\kNjNpKM.exe
  2⤵
  PID:2232
- C:\Windows\System\fAISVUD.exe
  C:\Windows\System\fAISVUD.exe
  2⤵
  PID:908
- C:\Windows\System\MtBxsHx.exe
  C:\Windows\System\MtBxsHx.exe
  2⤵
  PID:3076
- C:\Windows\System\DdEntla.exe
  C:\Windows\System\DdEntla.exe
  2⤵
  PID:864
- C:\Windows\System\rirzhTy.exe
  C:\Windows\System\rirzhTy.exe
  2⤵
  PID:3168
- C:\Windows\System\rdpMTkH.exe
  C:\Windows\System\rdpMTkH.exe
  2⤵
  PID:3212
- C:\Windows\System\nZyTBdm.exe
  C:\Windows\System\nZyTBdm.exe
  2⤵
  PID:3292
- C:\Windows\System\enznEHU.exe
  C:\Windows\System\enznEHU.exe
  2⤵
  PID:3352
- C:\Windows\System\zaaqrTt.exe
  C:\Windows\System\zaaqrTt.exe
  2⤵
  PID:3356
- C:\Windows\System\fprJOAr.exe
  C:\Windows\System\fprJOAr.exe
  2⤵
  PID:3448
- C:\Windows\System\XkqazRx.exe
  C:\Windows\System\XkqazRx.exe
  2⤵
  PID:3460
- C:\Windows\System\CfDHAig.exe
  C:\Windows\System\CfDHAig.exe
  2⤵
  PID:3596
- C:\Windows\System\nCSEkpt.exe
  C:\Windows\System\nCSEkpt.exe
  2⤵
  PID:3616
- C:\Windows\System\WJJYYdW.exe
  C:\Windows\System\WJJYYdW.exe
  2⤵
  PID:3652
- C:\Windows\System\njNocqF.exe
  C:\Windows\System\njNocqF.exe
  2⤵
  PID:3732
- C:\Windows\System\lGnYymJ.exe
  C:\Windows\System\lGnYymJ.exe
  2⤵
  PID:3696
- C:\Windows\System\ViYsGAH.exe
  C:\Windows\System\ViYsGAH.exe
  2⤵
  PID:3840
- C:\Windows\System\jnlRkUK.exe
  C:\Windows\System\jnlRkUK.exe
  2⤵
  PID:3900
- C:\Windows\System\omlwMkP.exe
  C:\Windows\System\omlwMkP.exe
  2⤵
  PID:3936
- C:\Windows\System\jMlEQqt.exe
  C:\Windows\System\jMlEQqt.exe
  2⤵
  PID:4016
- C:\Windows\System\IfZIZTd.exe
  C:\Windows\System\IfZIZTd.exe
  2⤵
  PID:2460
- C:\Windows\System\CtLkGuX.exe
  C:\Windows\System\CtLkGuX.exe
  2⤵
  PID:4056
- C:\Windows\System\KzvUFZj.exe
  C:\Windows\System\KzvUFZj.exe
  2⤵
  PID:2288
- C:\Windows\System\dseHmMk.exe
  C:\Windows\System\dseHmMk.exe
  2⤵
  PID:2948
- C:\Windows\System\YNSnlEg.exe
  C:\Windows\System\YNSnlEg.exe
  2⤵
  PID:820
- C:\Windows\System\lDZrZNd.exe
  C:\Windows\System\lDZrZNd.exe
  2⤵
  PID:2872
- C:\Windows\System\TSjiytf.exe
  C:\Windows\System\TSjiytf.exe
  2⤵
  PID:3132
- C:\Windows\System\kWuPtFy.exe
  C:\Windows\System\kWuPtFy.exe
  2⤵
  PID:3300
- C:\Windows\System\LPmizgX.exe
  C:\Windows\System\LPmizgX.exe
  2⤵
  PID:3396
- C:\Windows\System\kAlbrkB.exe
  C:\Windows\System\kAlbrkB.exe
  2⤵
  PID:3500
- C:\Windows\System\zlTWzyH.exe
  C:\Windows\System\zlTWzyH.exe
  2⤵
  PID:3560
- C:\Windows\System\vbEYtEW.exe
  C:\Windows\System\vbEYtEW.exe
  2⤵
  PID:3672
- C:\Windows\System\KDpIfXG.exe
  C:\Windows\System\KDpIfXG.exe
  2⤵
  PID:3656
- C:\Windows\System\AMHhWER.exe
  C:\Windows\System\AMHhWER.exe
  2⤵
  PID:3836
- C:\Windows\System\pgsmAQj.exe
  C:\Windows\System\pgsmAQj.exe
  2⤵
  PID:3960
- C:\Windows\System\MqKXzDa.exe
  C:\Windows\System\MqKXzDa.exe
  2⤵
  PID:4076
- C:\Windows\System\DhWchNH.exe
  C:\Windows\System\DhWchNH.exe
  2⤵
  PID:1996
- C:\Windows\System\ZmguwHa.exe
  C:\Windows\System\ZmguwHa.exe
  2⤵
  PID:2408
- C:\Windows\System\NwgSsjM.exe
  C:\Windows\System\NwgSsjM.exe
  2⤵
  PID:2260
- C:\Windows\System\fTpCdBj.exe
  C:\Windows\System\fTpCdBj.exe
  2⤵
  PID:4104
- C:\Windows\System\ECKECjD.exe
  C:\Windows\System\ECKECjD.exe
  2⤵
  PID:4124
- C:\Windows\System\vkKguXS.exe
  C:\Windows\System\vkKguXS.exe
  2⤵
  PID:4144
- C:\Windows\System\kDigwBN.exe
  C:\Windows\System\kDigwBN.exe
  2⤵
  PID:4164
- C:\Windows\System\qfIHPAV.exe
  C:\Windows\System\qfIHPAV.exe
  2⤵
  PID:4184
- C:\Windows\System\NjOrZJs.exe
  C:\Windows\System\NjOrZJs.exe
  2⤵
  PID:4204
- C:\Windows\System\qASNdAZ.exe
  C:\Windows\System\qASNdAZ.exe
  2⤵
  PID:4224
- C:\Windows\System\FygWpHM.exe
  C:\Windows\System\FygWpHM.exe
  2⤵
  PID:4244
- C:\Windows\System\wjmebQW.exe
  C:\Windows\System\wjmebQW.exe
  2⤵
  PID:4264
- C:\Windows\System\UfcOVog.exe
  C:\Windows\System\UfcOVog.exe
  2⤵
  PID:4284
- C:\Windows\System\GMuVPJk.exe
  C:\Windows\System\GMuVPJk.exe
  2⤵
  PID:4304
- C:\Windows\System\nkFILnR.exe
  C:\Windows\System\nkFILnR.exe
  2⤵
  PID:4324
- C:\Windows\System\saEBqIA.exe
  C:\Windows\System\saEBqIA.exe
  2⤵
  PID:4344
- C:\Windows\System\GfoDqRx.exe
  C:\Windows\System\GfoDqRx.exe
  2⤵
  PID:4364
- C:\Windows\System\dDdGMte.exe
  C:\Windows\System\dDdGMte.exe
  2⤵
  PID:4384
- C:\Windows\System\fjhHegT.exe
  C:\Windows\System\fjhHegT.exe
  2⤵
  PID:4404
- C:\Windows\System\ruGRZUT.exe
  C:\Windows\System\ruGRZUT.exe
  2⤵
  PID:4424
- C:\Windows\System\ntHIigE.exe
  C:\Windows\System\ntHIigE.exe
  2⤵
  PID:4444
- C:\Windows\System\hvZFGsX.exe
  C:\Windows\System\hvZFGsX.exe
  2⤵
  PID:4464
- C:\Windows\System\TnRfyCI.exe
  C:\Windows\System\TnRfyCI.exe
  2⤵
  PID:4484
- C:\Windows\System\lbxSxzU.exe
  C:\Windows\System\lbxSxzU.exe
  2⤵
  PID:4504
- C:\Windows\System\zwblSbZ.exe
  C:\Windows\System\zwblSbZ.exe
  2⤵
  PID:4524
- C:\Windows\System\tuViyxV.exe
  C:\Windows\System\tuViyxV.exe
  2⤵
  PID:4544
- C:\Windows\System\DwWGCRn.exe
  C:\Windows\System\DwWGCRn.exe
  2⤵
  PID:4564
- C:\Windows\System\kDwPrqO.exe
  C:\Windows\System\kDwPrqO.exe
  2⤵
  PID:4584
- C:\Windows\System\KUMygqI.exe
  C:\Windows\System\KUMygqI.exe
  2⤵
  PID:4604
- C:\Windows\System\WenAJtI.exe
  C:\Windows\System\WenAJtI.exe
  2⤵
  PID:4624
- C:\Windows\System\tzwsMLc.exe
  C:\Windows\System\tzwsMLc.exe
  2⤵
  PID:4644
- C:\Windows\System\nMWLgMT.exe
  C:\Windows\System\nMWLgMT.exe
  2⤵
  PID:4664
- C:\Windows\System\mjDyMZD.exe
  C:\Windows\System\mjDyMZD.exe
  2⤵
  PID:4684
- C:\Windows\System\RJuVZqH.exe
  C:\Windows\System\RJuVZqH.exe
  2⤵
  PID:4704
- C:\Windows\System\foMBXGN.exe
  C:\Windows\System\foMBXGN.exe
  2⤵
  PID:4724
- C:\Windows\System\qddrpYl.exe
  C:\Windows\System\qddrpYl.exe
  2⤵
  PID:4744
- C:\Windows\System\GbcRrzE.exe
  C:\Windows\System\GbcRrzE.exe
  2⤵
  PID:4764
- C:\Windows\System\VWjsBbD.exe
  C:\Windows\System\VWjsBbD.exe
  2⤵
  PID:4784
- C:\Windows\System\PIazfif.exe
  C:\Windows\System\PIazfif.exe
  2⤵
  PID:4804
- C:\Windows\System\IztFsNn.exe
  C:\Windows\System\IztFsNn.exe
  2⤵
  PID:4824
- C:\Windows\System\jRJATXD.exe
  C:\Windows\System\jRJATXD.exe
  2⤵
  PID:4844
- C:\Windows\System\iuibnIM.exe
  C:\Windows\System\iuibnIM.exe
  2⤵
  PID:4864
- C:\Windows\System\mqpYMrx.exe
  C:\Windows\System\mqpYMrx.exe
  2⤵
  PID:4884
- C:\Windows\System\GWJoxUY.exe
  C:\Windows\System\GWJoxUY.exe
  2⤵
  PID:4904
- C:\Windows\System\CmrVUjB.exe
  C:\Windows\System\CmrVUjB.exe
  2⤵
  PID:4924
- C:\Windows\System\thagfsC.exe
  C:\Windows\System\thagfsC.exe
  2⤵
  PID:4944
- C:\Windows\System\nHZQrZT.exe
  C:\Windows\System\nHZQrZT.exe
  2⤵
  PID:4964
- C:\Windows\System\hOnmNDf.exe
  C:\Windows\System\hOnmNDf.exe
  2⤵
  PID:4984
- C:\Windows\System\MwUlcHS.exe
  C:\Windows\System\MwUlcHS.exe
  2⤵
  PID:5004
- C:\Windows\System\BwQCNuO.exe
  C:\Windows\System\BwQCNuO.exe
  2⤵
  PID:5024
- C:\Windows\System\pbfoZhA.exe
  C:\Windows\System\pbfoZhA.exe
  2⤵
  PID:5044
- C:\Windows\System\KpNUhCj.exe
  C:\Windows\System\KpNUhCj.exe
  2⤵
  PID:5064
- C:\Windows\System\WPHqNwd.exe
  C:\Windows\System\WPHqNwd.exe
  2⤵
  PID:5084
- C:\Windows\System\LAgtUry.exe
  C:\Windows\System\LAgtUry.exe
  2⤵
  PID:5104
- C:\Windows\System\zEHabXh.exe
  C:\Windows\System\zEHabXh.exe
  2⤵
  PID:3156
- C:\Windows\System\hxbJGdl.exe
  C:\Windows\System\hxbJGdl.exe
  2⤵
  PID:3176
- C:\Windows\System\RndxzLp.exe
  C:\Windows\System\RndxzLp.exe
  2⤵
  PID:3636
- C:\Windows\System\lNrEgRs.exe
  C:\Windows\System\lNrEgRs.exe
  2⤵
  PID:3780
- C:\Windows\System\HkEzNFk.exe
  C:\Windows\System\HkEzNFk.exe
  2⤵
  PID:3852
- C:\Windows\System\lcXBKyS.exe
  C:\Windows\System\lcXBKyS.exe
  2⤵
  PID:2480
- C:\Windows\System\zaHFqbk.exe
  C:\Windows\System\zaHFqbk.exe
  2⤵
  PID:2696
- C:\Windows\System\vTscuze.exe
  C:\Windows\System\vTscuze.exe
  2⤵
  PID:3196
- C:\Windows\System\AVfEjXj.exe
  C:\Windows\System\AVfEjXj.exe
  2⤵
  PID:4112
- C:\Windows\System\paHFMQP.exe
  C:\Windows\System\paHFMQP.exe
  2⤵
  PID:2992
- C:\Windows\System\doXGqee.exe
  C:\Windows\System\doXGqee.exe
  2⤵
  PID:4156
- C:\Windows\System\mqeHSZz.exe
  C:\Windows\System\mqeHSZz.exe
  2⤵
  PID:4212
- C:\Windows\System\hGHINtu.exe
  C:\Windows\System\hGHINtu.exe
  2⤵
  PID:4252
- C:\Windows\System\TMISIKK.exe
  C:\Windows\System\TMISIKK.exe
  2⤵
  PID:4272
- C:\Windows\System\fIzdEGC.exe
  C:\Windows\System\fIzdEGC.exe
  2⤵
  PID:4296
- C:\Windows\System\XvKCnBc.exe
  C:\Windows\System\XvKCnBc.exe
  2⤵
  PID:4336
- C:\Windows\System\QYAmcoa.exe
  C:\Windows\System\QYAmcoa.exe
  2⤵
  PID:4360
- C:\Windows\System\arHFXUu.exe
  C:\Windows\System\arHFXUu.exe
  2⤵
  PID:4416
- C:\Windows\System\NHDEBRx.exe
  C:\Windows\System\NHDEBRx.exe
  2⤵
  PID:4452
- C:\Windows\System\ifHmaRI.exe
  C:\Windows\System\ifHmaRI.exe
  2⤵
  PID:4472
- C:\Windows\System\BHIkSOY.exe
  C:\Windows\System\BHIkSOY.exe
  2⤵
  PID:4500
- C:\Windows\System\NLGUvIF.exe
  C:\Windows\System\NLGUvIF.exe
  2⤵
  PID:4516
- C:\Windows\System\rygTrLE.exe
  C:\Windows\System\rygTrLE.exe
  2⤵
  PID:4580
- C:\Windows\System\EuRWTtM.exe
  C:\Windows\System\EuRWTtM.exe
  2⤵
  PID:4600
- C:\Windows\System\bHdboXO.exe
  C:\Windows\System\bHdboXO.exe
  2⤵
  PID:3192
- C:\Windows\System\GGNgJoi.exe
  C:\Windows\System\GGNgJoi.exe
  2⤵
  PID:4636
- C:\Windows\System\fDVnfVA.exe
  C:\Windows\System\fDVnfVA.exe
  2⤵
  PID:4680
- C:\Windows\System\mtrxvNc.exe
  C:\Windows\System\mtrxvNc.exe
  2⤵
  PID:4712
- C:\Windows\System\NCmEecz.exe
  C:\Windows\System\NCmEecz.exe
  2⤵
  PID:4716
- C:\Windows\System\SpJFnpg.exe
  C:\Windows\System\SpJFnpg.exe
  2⤵
  PID:4760
- C:\Windows\System\CsyRoWu.exe
  C:\Windows\System\CsyRoWu.exe
  2⤵
  PID:2544
- C:\Windows\System\RSkaEdZ.exe
  C:\Windows\System\RSkaEdZ.exe
  2⤵
  PID:4816
- C:\Windows\System\EeoAkWF.exe
  C:\Windows\System\EeoAkWF.exe
  2⤵
  PID:4856
- C:\Windows\System\hVYVKUa.exe
  C:\Windows\System\hVYVKUa.exe
  2⤵
  PID:4872
- C:\Windows\System\cUEdnrj.exe
  C:\Windows\System\cUEdnrj.exe
  2⤵
  PID:4912
- C:\Windows\System\HtvWBAh.exe
  C:\Windows\System\HtvWBAh.exe
  2⤵
  PID:4936
- C:\Windows\System\AkalhKN.exe
  C:\Windows\System\AkalhKN.exe
  2⤵
  PID:4952
- C:\Windows\System\qtdtpFW.exe
  C:\Windows\System\qtdtpFW.exe
  2⤵
  PID:4980
- C:\Windows\System\RnXPuWA.exe
  C:\Windows\System\RnXPuWA.exe
  2⤵
  PID:5000
- C:\Windows\System\RdHYGtt.exe
  C:\Windows\System\RdHYGtt.exe
  2⤵
  PID:1340
- C:\Windows\System\ZfoGqmg.exe
  C:\Windows\System\ZfoGqmg.exe
  2⤵
  PID:5060
- C:\Windows\System\pCimTcs.exe
  C:\Windows\System\pCimTcs.exe
  2⤵
  PID:5076
- C:\Windows\System\qZgnrWP.exe
  C:\Windows\System\qZgnrWP.exe
  2⤵
  PID:3240
- C:\Windows\System\lhReLpz.exe
  C:\Windows\System\lhReLpz.exe
  2⤵
  PID:264
- C:\Windows\System\uCBrXQa.exe
  C:\Windows\System\uCBrXQa.exe
  2⤵
  PID:3492
- C:\Windows\System\cREybdi.exe
  C:\Windows\System\cREybdi.exe
  2⤵
  PID:3956
- C:\Windows\System\rqkFrIf.exe
  C:\Windows\System\rqkFrIf.exe
  2⤵
  PID:4032
- C:\Windows\System\fDbqtdH.exe
  C:\Windows\System\fDbqtdH.exe
  2⤵
  PID:2636
- C:\Windows\System\KuOCwbz.exe
  C:\Windows\System\KuOCwbz.exe
  2⤵
  PID:1592
- C:\Windows\System\aeWLHSH.exe
  C:\Windows\System\aeWLHSH.exe
  2⤵
  PID:4152
- C:\Windows\System\LZVGQus.exe
  C:\Windows\System\LZVGQus.exe
  2⤵
  PID:4220
- C:\Windows\System\TLKDmPb.exe
  C:\Windows\System\TLKDmPb.exe
  2⤵
  PID:4312
- C:\Windows\System\mAQzMZK.exe
  C:\Windows\System\mAQzMZK.exe
  2⤵
  PID:4276
- C:\Windows\System\LXwPORr.exe
  C:\Windows\System\LXwPORr.exe
  2⤵
  PID:4376
- C:\Windows\System\DxlRRvX.exe
  C:\Windows\System\DxlRRvX.exe
  2⤵
  PID:4436
- C:\Windows\System\jrAyrit.exe
  C:\Windows\System\jrAyrit.exe
  2⤵
  PID:4532
- C:\Windows\System\JNqiLdy.exe
  C:\Windows\System\JNqiLdy.exe
  2⤵
  PID:4556
- C:\Windows\System\owvUpSl.exe
  C:\Windows\System\owvUpSl.exe
  2⤵
  PID:4592
- C:\Windows\System\YeRZArO.exe
  C:\Windows\System\YeRZArO.exe
  2⤵
  PID:4596
- C:\Windows\System\FGrhDaC.exe
  C:\Windows\System\FGrhDaC.exe
  2⤵
  PID:4672
- C:\Windows\System\qdaloSj.exe
  C:\Windows\System\qdaloSj.exe
  2⤵
  PID:4752
- C:\Windows\System\jDKmyER.exe
  C:\Windows\System\jDKmyER.exe
  2⤵
  PID:4812
- C:\Windows\System\aUNqNKA.exe
  C:\Windows\System\aUNqNKA.exe
  2⤵
  PID:4840
- C:\Windows\System\VlYiJsJ.exe
  C:\Windows\System\VlYiJsJ.exe
  2⤵
  PID:2148
- C:\Windows\System\UEwZxrV.exe
  C:\Windows\System\UEwZxrV.exe
  2⤵
  PID:1544
- C:\Windows\System\NjTsGvu.exe
  C:\Windows\System\NjTsGvu.exe
  2⤵
  PID:920
- C:\Windows\System\ygceGNK.exe
  C:\Windows\System\ygceGNK.exe
  2⤵
  PID:5012
- C:\Windows\System\jOYqAHE.exe
  C:\Windows\System\jOYqAHE.exe
  2⤵
  PID:1748
- C:\Windows\System\dLghvpK.exe
  C:\Windows\System\dLghvpK.exe
  2⤵
  PID:552
- C:\Windows\System\imuvYnZ.exe
  C:\Windows\System\imuvYnZ.exe
  2⤵
  PID:5052
- C:\Windows\System\pTIvoMG.exe
  C:\Windows\System\pTIvoMG.exe
  2⤵
  PID:3476
- C:\Windows\System\BSuVAtx.exe
  C:\Windows\System\BSuVAtx.exe
  2⤵
  PID:3592
- C:\Windows\System\esHtEmd.exe
  C:\Windows\System\esHtEmd.exe
  2⤵
  PID:2004
- C:\Windows\System\nKijYDU.exe
  C:\Windows\System\nKijYDU.exe
  2⤵
  PID:1292
- C:\Windows\System\SRQFlzf.exe
  C:\Windows\System\SRQFlzf.exe
  2⤵
  PID:2756
- C:\Windows\System\FhTVnpB.exe
  C:\Windows\System\FhTVnpB.exe
  2⤵
  PID:2272
- C:\Windows\System\WQiaCzx.exe
  C:\Windows\System\WQiaCzx.exe
  2⤵
  PID:4192
- C:\Windows\System\subLShw.exe
  C:\Windows\System\subLShw.exe
  2⤵
  PID:4232
- C:\Windows\System\QhTfdaF.exe
  C:\Windows\System\QhTfdaF.exe
  2⤵
  PID:4316
- C:\Windows\System\yfnDrLY.exe
  C:\Windows\System\yfnDrLY.exe
  2⤵
  PID:2196
- C:\Windows\System\fLSqGXV.exe
  C:\Windows\System\fLSqGXV.exe
  2⤵
  PID:4460
- C:\Windows\System\olNjeFt.exe
  C:\Windows\System\olNjeFt.exe
  2⤵
  PID:4476
- C:\Windows\System\FrBfXBN.exe
  C:\Windows\System\FrBfXBN.exe
  2⤵
  PID:4552
- C:\Windows\System\EhGYfvz.exe
  C:\Windows\System\EhGYfvz.exe
  2⤵
  PID:4620
- C:\Windows\System\SHGCQHx.exe
  C:\Windows\System\SHGCQHx.exe
  2⤵
  PID:4740
- C:\Windows\System\KhLLYyL.exe
  C:\Windows\System\KhLLYyL.exe
  2⤵
  PID:4820
- C:\Windows\System\rNXnIcx.exe
  C:\Windows\System\rNXnIcx.exe
  2⤵
  PID:2848
- C:\Windows\System\NxKlIJa.exe
  C:\Windows\System\NxKlIJa.exe
  2⤵
  PID:4896
- C:\Windows\System\LwjczXq.exe
  C:\Windows\System\LwjczXq.exe
  2⤵
  PID:2388
- C:\Windows\System\GVtgzFd.exe
  C:\Windows\System\GVtgzFd.exe
  2⤵
  PID:2776
- C:\Windows\System\dnZGLts.exe
  C:\Windows\System\dnZGLts.exe
  2⤵
  PID:5096
- C:\Windows\System\CnLLBKG.exe
  C:\Windows\System\CnLLBKG.exe
  2⤵
  PID:4916
- C:\Windows\System\ssaFNGE.exe
  C:\Windows\System\ssaFNGE.exe
  2⤵
  PID:2188
- C:\Windows\System\ddSvDWv.exe
  C:\Windows\System\ddSvDWv.exe
  2⤵
  PID:2012
- C:\Windows\System\qbcDOaJ.exe
  C:\Windows\System\qbcDOaJ.exe
  2⤵
  PID:580
- C:\Windows\System\VuoZjqp.exe
  C:\Windows\System\VuoZjqp.exe
  2⤵
  PID:4196
- C:\Windows\System\EavILgl.exe
  C:\Windows\System\EavILgl.exe
  2⤵
  PID:2052
- C:\Windows\System\rOiwKes.exe
  C:\Windows\System\rOiwKes.exe
  2⤵
  PID:4656
- C:\Windows\System\VuaQWDP.exe
  C:\Windows\System\VuaQWDP.exe
  2⤵
  PID:4616
- C:\Windows\System\arnljQN.exe
  C:\Windows\System\arnljQN.exe
  2⤵
  PID:1716
- C:\Windows\System\TAdFdpX.exe
  C:\Windows\System\TAdFdpX.exe
  2⤵
  PID:2036
- C:\Windows\System\rvmMgjN.exe
  C:\Windows\System\rvmMgjN.exe
  2⤵
  PID:3412
- C:\Windows\System\GYyQAwZ.exe
  C:\Windows\System\GYyQAwZ.exe
  2⤵
  PID:4136
- C:\Windows\System\zuvjwds.exe
  C:\Windows\System\zuvjwds.exe
  2⤵
  PID:4352
- C:\Windows\System\JYMxRoE.exe
  C:\Windows\System\JYMxRoE.exe
  2⤵
  PID:5032
- C:\Windows\System\MPASVhW.exe
  C:\Windows\System\MPASVhW.exe
  2⤵
  PID:4956
- C:\Windows\System\dIuyxaV.exe
  C:\Windows\System\dIuyxaV.exe
  2⤵
  PID:5080
- C:\Windows\System\fjXYkxz.exe
  C:\Windows\System\fjXYkxz.exe
  2⤵
  PID:4380
- C:\Windows\System\dLpVsDf.exe
  C:\Windows\System\dLpVsDf.exe
  2⤵
  PID:2668
- C:\Windows\System\qekWzAx.exe
  C:\Windows\System\qekWzAx.exe
  2⤵
  PID:3612
- C:\Windows\System\VJXsKzi.exe
  C:\Windows\System\VJXsKzi.exe
  2⤵
  PID:2268
- C:\Windows\System\tyJGcPx.exe
  C:\Windows\System\tyJGcPx.exe
  2⤵
  PID:4572
- C:\Windows\System\GWwfbfB.exe
  C:\Windows\System\GWwfbfB.exe
  2⤵
  PID:4236
- C:\Windows\System\HsxZLbw.exe
  C:\Windows\System\HsxZLbw.exe
  2⤵
  PID:4960
- C:\Windows\System\vpVSKjb.exe
  C:\Windows\System\vpVSKjb.exe
  2⤵
  PID:2488
- C:\Windows\System\JvhuIAK.exe
  C:\Windows\System\JvhuIAK.exe
  2⤵
  PID:2008
- C:\Windows\System\hOGnvgP.exe
  C:\Windows\System\hOGnvgP.exe
  2⤵
  PID:3976
- C:\Windows\System\jhwcdpQ.exe
  C:\Windows\System\jhwcdpQ.exe
  2⤵
  PID:5124
- C:\Windows\System\XjFBGBK.exe
  C:\Windows\System\XjFBGBK.exe
  2⤵
  PID:5144
- C:\Windows\System\gzTCJrn.exe
  C:\Windows\System\gzTCJrn.exe
  2⤵
  PID:5164
- C:\Windows\System\Tcfadcb.exe
  C:\Windows\System\Tcfadcb.exe
  2⤵
  PID:5188
- C:\Windows\System\BdnitNc.exe
  C:\Windows\System\BdnitNc.exe
  2⤵
  PID:5204
- C:\Windows\System\XumGqqI.exe
  C:\Windows\System\XumGqqI.exe
  2⤵
  PID:5220
- C:\Windows\System\nXgjFIP.exe
  C:\Windows\System\nXgjFIP.exe
  2⤵
  PID:5236
- C:\Windows\System\wjzmkBW.exe
  C:\Windows\System\wjzmkBW.exe
  2⤵
  PID:5256
- C:\Windows\System\rpWjZoC.exe
  C:\Windows\System\rpWjZoC.exe
  2⤵
  PID:5272
- C:\Windows\System\nYfRUgC.exe
  C:\Windows\System\nYfRUgC.exe
  2⤵
  PID:5288
- C:\Windows\System\WoUIjwG.exe
  C:\Windows\System\WoUIjwG.exe
  2⤵
  PID:5304
- C:\Windows\System\EgFSNLR.exe
  C:\Windows\System\EgFSNLR.exe
  2⤵
  PID:5328
- C:\Windows\System\qgmrmGm.exe
  C:\Windows\System\qgmrmGm.exe
  2⤵
  PID:5352
- C:\Windows\System\bWlqJhm.exe
  C:\Windows\System\bWlqJhm.exe
  2⤵
  PID:5368
- C:\Windows\System\rpTspFR.exe
  C:\Windows\System\rpTspFR.exe
  2⤵
  PID:5384
- C:\Windows\System\JomLgHk.exe
  C:\Windows\System\JomLgHk.exe
  2⤵
  PID:5400
- C:\Windows\System\EZeIIfT.exe
  C:\Windows\System\EZeIIfT.exe
  2⤵
  PID:5416
- C:\Windows\System\NwEImHZ.exe
  C:\Windows\System\NwEImHZ.exe
  2⤵
  PID:5488
- C:\Windows\System\zLRFzST.exe
  C:\Windows\System\zLRFzST.exe
  2⤵
  PID:5512
- C:\Windows\System\fHkAKoS.exe
  C:\Windows\System\fHkAKoS.exe
  2⤵
  PID:5528
- C:\Windows\System\UcsMgvm.exe
  C:\Windows\System\UcsMgvm.exe
  2⤵
  PID:5548
- C:\Windows\System\nKeEpyS.exe
  C:\Windows\System\nKeEpyS.exe
  2⤵
  PID:5564
- C:\Windows\System\tbKWgGw.exe
  C:\Windows\System\tbKWgGw.exe
  2⤵
  PID:5584
- C:\Windows\System\YcaMmnk.exe
  C:\Windows\System\YcaMmnk.exe
  2⤵
  PID:5604
- C:\Windows\System\wJbvkpA.exe
  C:\Windows\System\wJbvkpA.exe
  2⤵
  PID:5620
- C:\Windows\System\rRJdOTd.exe
  C:\Windows\System\rRJdOTd.exe
  2⤵
  PID:5636
- C:\Windows\System\aIYqAsb.exe
  C:\Windows\System\aIYqAsb.exe
  2⤵
  PID:5652
- C:\Windows\System\WXKNKsn.exe
  C:\Windows\System\WXKNKsn.exe
  2⤵
  PID:5672
- C:\Windows\System\TLZlZIQ.exe
  C:\Windows\System\TLZlZIQ.exe
  2⤵
  PID:5692
- C:\Windows\System\lAYISjU.exe
  C:\Windows\System\lAYISjU.exe
  2⤵
  PID:5708
- C:\Windows\System\PLAermy.exe
  C:\Windows\System\PLAermy.exe
  2⤵
  PID:5724
- C:\Windows\System\NurztEb.exe
  C:\Windows\System\NurztEb.exe
  2⤵
  PID:5740
- C:\Windows\System\OrlGQYH.exe
  C:\Windows\System\OrlGQYH.exe
  2⤵
  PID:5756
- C:\Windows\System\erFcFWy.exe
  C:\Windows\System\erFcFWy.exe
  2⤵
  PID:5772
- C:\Windows\System\OVTmPgj.exe
  C:\Windows\System\OVTmPgj.exe
  2⤵
  PID:5792
- C:\Windows\System\nikXYVA.exe
  C:\Windows\System\nikXYVA.exe
  2⤵
  PID:5812
- C:\Windows\System\orgQNTo.exe
  C:\Windows\System\orgQNTo.exe
  2⤵
  PID:5836
- C:\Windows\System\mlOSTrg.exe
  C:\Windows\System\mlOSTrg.exe
  2⤵
  PID:5856
- C:\Windows\System\PUymPsJ.exe
  C:\Windows\System\PUymPsJ.exe
  2⤵
  PID:5872
- C:\Windows\System\RKUqoJt.exe
  C:\Windows\System\RKUqoJt.exe
  2⤵
  PID:5888
- C:\Windows\System\vbPnkSV.exe
  C:\Windows\System\vbPnkSV.exe
  2⤵
  PID:5904
- C:\Windows\System\hBltTos.exe
  C:\Windows\System\hBltTos.exe
  2⤵
  PID:5920
- C:\Windows\System\kEhClFY.exe
  C:\Windows\System\kEhClFY.exe
  2⤵
  PID:5992
- C:\Windows\System\IDWWcxg.exe
  C:\Windows\System\IDWWcxg.exe
  2⤵
  PID:6008
- C:\Windows\System\znWXyyg.exe
  C:\Windows\System\znWXyyg.exe
  2⤵
  PID:6024
- C:\Windows\System\aURpjNm.exe
  C:\Windows\System\aURpjNm.exe
  2⤵
  PID:6044
- C:\Windows\System\LIVZNOO.exe
  C:\Windows\System\LIVZNOO.exe
  2⤵
  PID:6068
- C:\Windows\System\jXSlzlJ.exe
  C:\Windows\System\jXSlzlJ.exe
  2⤵
  PID:6088
- C:\Windows\System\obMKtty.exe
  C:\Windows\System\obMKtty.exe
  2⤵
  PID:6108
- C:\Windows\System\dFHqibS.exe
  C:\Windows\System\dFHqibS.exe
  2⤵
  PID:6128
- C:\Windows\System\FzInckd.exe
  C:\Windows\System\FzInckd.exe
  2⤵
  PID:1992
- C:\Windows\System\lhhjeKK.exe
  C:\Windows\System\lhhjeKK.exe
  2⤵
  PID:4792
- C:\Windows\System\pvVCCHp.exe
  C:\Windows\System\pvVCCHp.exe
  2⤵
  PID:5196
- C:\Windows\System\MgVrcta.exe
  C:\Windows\System\MgVrcta.exe
  2⤵
  PID:5264
- C:\Windows\System\CJUdUPh.exe
  C:\Windows\System\CJUdUPh.exe
  2⤵
  PID:5296
- C:\Windows\System\vDzTYzQ.exe
  C:\Windows\System\vDzTYzQ.exe
  2⤵
  PID:5376
- C:\Windows\System\APgZRrH.exe
  C:\Windows\System\APgZRrH.exe
  2⤵
  PID:5020
- C:\Windows\System\wqhMVyD.exe
  C:\Windows\System\wqhMVyD.exe
  2⤵
  PID:5172
- C:\Windows\System\eKCgHXh.exe
  C:\Windows\System\eKCgHXh.exe
  2⤵
  PID:5216
- C:\Windows\System\oyRzfCv.exe
  C:\Windows\System\oyRzfCv.exe
  2⤵
  PID:5424
- C:\Windows\System\JdLXyCp.exe
  C:\Windows\System\JdLXyCp.exe
  2⤵
  PID:2516
- C:\Windows\System\vXWMOHA.exe
  C:\Windows\System\vXWMOHA.exe
  2⤵
  PID:5444
- C:\Windows\System\RpGKOWK.exe
  C:\Windows\System\RpGKOWK.exe
  2⤵
  PID:5248
- C:\Windows\System\QzCnVQB.exe
  C:\Windows\System\QzCnVQB.exe
  2⤵
  PID:5396
- C:\Windows\System\nIMXxoQ.exe
  C:\Windows\System\nIMXxoQ.exe
  2⤵
  PID:5456
- C:\Windows\System\UEjCnLu.exe
  C:\Windows\System\UEjCnLu.exe
  2⤵
  PID:5472
- C:\Windows\System\dYSEFcT.exe
  C:\Windows\System\dYSEFcT.exe
  2⤵
  PID:5484
- C:\Windows\System\ogVYMSX.exe
  C:\Windows\System\ogVYMSX.exe
  2⤵
  PID:5536
- C:\Windows\System\oYhgRSg.exe
  C:\Windows\System\oYhgRSg.exe
  2⤵
  PID:5576
- C:\Windows\System\tOzGGII.exe
  C:\Windows\System\tOzGGII.exe
  2⤵
  PID:5788
- C:\Windows\System\jAJKjel.exe
  C:\Windows\System\jAJKjel.exe
  2⤵
  PID:5828
- C:\Windows\System\YYXjboK.exe
  C:\Windows\System\YYXjboK.exe
  2⤵
  PID:5900
- C:\Windows\System\DBcfJHt.exe
  C:\Windows\System\DBcfJHt.exe
  2⤵
  PID:5944
- C:\Windows\System\ewTJzYW.exe
  C:\Windows\System\ewTJzYW.exe
  2⤵
  PID:5628
- C:\Windows\System\PtWwgjT.exe
  C:\Windows\System\PtWwgjT.exe
  2⤵
  PID:5732
- C:\Windows\System\DajxPCb.exe
  C:\Windows\System\DajxPCb.exe
  2⤵
  PID:5524
- C:\Windows\System\YkILmiQ.exe
  C:\Windows\System\YkILmiQ.exe
  2⤵
  PID:5704
- C:\Windows\System\nxiwzSw.exe
  C:\Windows\System\nxiwzSw.exe
  2⤵
  PID:5936
- C:\Windows\System\JklygCi.exe
  C:\Windows\System\JklygCi.exe
  2⤵
  PID:5880
- C:\Windows\System\SpfRsdr.exe
  C:\Windows\System\SpfRsdr.exe
  2⤵
  PID:5848
- C:\Windows\System\ZKaWGaA.exe
  C:\Windows\System\ZKaWGaA.exe
  2⤵
  PID:5988
- C:\Windows\System\CAKqkil.exe
  C:\Windows\System\CAKqkil.exe
  2⤵
  PID:6064
- C:\Windows\System\VpkSous.exe
  C:\Windows\System\VpkSous.exe
  2⤵
  PID:6084
- C:\Windows\System\JTNYehx.exe
  C:\Windows\System\JTNYehx.exe
  2⤵
  PID:6136
- C:\Windows\System\iuJOcoh.exe
  C:\Windows\System\iuJOcoh.exe
  2⤵
  PID:6116
- C:\Windows\System\YJxEXhB.exe
  C:\Windows\System\YJxEXhB.exe
  2⤵
  PID:5160
- C:\Windows\System\bIsAtEs.exe
  C:\Windows\System\bIsAtEs.exe
  2⤵
  PID:4392
- C:\Windows\System\VkGuSkQ.exe
  C:\Windows\System\VkGuSkQ.exe
  2⤵
  PID:5436
- C:\Windows\System\oRUQtbD.exe
  C:\Windows\System\oRUQtbD.exe
  2⤵
  PID:5176
- C:\Windows\System\UIGPfdq.exe
  C:\Windows\System\UIGPfdq.exe
  2⤵
  PID:4696
- C:\Windows\System\NrnHuoB.exe
  C:\Windows\System\NrnHuoB.exe
  2⤵
  PID:4116
- C:\Windows\System\pLaFrBE.exe
  C:\Windows\System\pLaFrBE.exe
  2⤵
  PID:5440
- C:\Windows\System\IccnMfH.exe
  C:\Windows\System\IccnMfH.exe
  2⤵
  PID:5468
- C:\Windows\System\dnPLfpM.exe
  C:\Windows\System\dnPLfpM.exe
  2⤵
  PID:5320
- C:\Windows\System\kLoUGCr.exe
  C:\Windows\System\kLoUGCr.exe
  2⤵
  PID:5688
- C:\Windows\System\WEOtVnB.exe
  C:\Windows\System\WEOtVnB.exe
  2⤵
  PID:5752
- C:\Windows\System\WbwGYBG.exe
  C:\Windows\System\WbwGYBG.exe
  2⤵
  PID:5616
- C:\Windows\System\hgcEVgQ.exe
  C:\Windows\System\hgcEVgQ.exe
  2⤵
  PID:5932
- C:\Windows\System\nXwBTqy.exe
  C:\Windows\System\nXwBTqy.exe
  2⤵
  PID:5660
- C:\Windows\System\GMvlybW.exe
  C:\Windows\System\GMvlybW.exe
  2⤵
  PID:5808
- C:\Windows\System\fVxEuOg.exe
  C:\Windows\System\fVxEuOg.exe
  2⤵
  PID:5972
- C:\Windows\System\CMAZygS.exe
  C:\Windows\System\CMAZygS.exe
  2⤵
  PID:5984
- C:\Windows\System\lssUgnN.exe
  C:\Windows\System\lssUgnN.exe
  2⤵
  PID:5884
- C:\Windows\System\UaePnaz.exe
  C:\Windows\System\UaePnaz.exe
  2⤵
  PID:6036
- C:\Windows\System\UZVGDxu.exe
  C:\Windows\System\UZVGDxu.exe
  2⤵
  PID:5596
- C:\Windows\System\kWxXYCw.exe
  C:\Windows\System\kWxXYCw.exe
  2⤵
  PID:5448
- C:\Windows\System\TDqOoYq.exe
  C:\Windows\System\TDqOoYq.exe
  2⤵
  PID:5544
- C:\Windows\System\LFaeLJh.exe
  C:\Windows\System\LFaeLJh.exe
  2⤵
  PID:6052
- C:\Windows\System\IDwmWqH.exe
  C:\Windows\System\IDwmWqH.exe
  2⤵
  PID:5344
- C:\Windows\System\uEEnZDk.exe
  C:\Windows\System\uEEnZDk.exe
  2⤵
  PID:5428
- C:\Windows\System\JASRjpM.exe
  C:\Windows\System\JASRjpM.exe
  2⤵
  PID:5520
- C:\Windows\System\plLJqOB.exe
  C:\Windows\System\plLJqOB.exe
  2⤵
  PID:6080
- C:\Windows\System\lsXdrpB.exe
  C:\Windows\System\lsXdrpB.exe
  2⤵
  PID:1548
- C:\Windows\System\NwaUswF.exe
  C:\Windows\System\NwaUswF.exe
  2⤵
  PID:6148
- C:\Windows\System\TeCWClN.exe
  C:\Windows\System\TeCWClN.exe
  2⤵
  PID:6168
- C:\Windows\System\AsjHJWb.exe
  C:\Windows\System\AsjHJWb.exe
  2⤵
  PID:6188
- C:\Windows\System\YKlaEvI.exe
  C:\Windows\System\YKlaEvI.exe
  2⤵
  PID:6264
- C:\Windows\System\HZAilrO.exe
  C:\Windows\System\HZAilrO.exe
  2⤵
  PID:6284
- C:\Windows\System\bazLtJe.exe
  C:\Windows\System\bazLtJe.exe
  2⤵
  PID:6300
- C:\Windows\System\CWnpwFa.exe
  C:\Windows\System\CWnpwFa.exe
  2⤵
  PID:6316
- C:\Windows\System\CuFqkID.exe
  C:\Windows\System\CuFqkID.exe
  2⤵
  PID:6340
- C:\Windows\System\ZDRsgCw.exe
  C:\Windows\System\ZDRsgCw.exe
  2⤵
  PID:6360
- C:\Windows\System\ffZkxOs.exe
  C:\Windows\System\ffZkxOs.exe
  2⤵
  PID:6376
- C:\Windows\System\rrscWsS.exe
  C:\Windows\System\rrscWsS.exe
  2⤵
  PID:6392
- C:\Windows\System\VCThgaj.exe
  C:\Windows\System\VCThgaj.exe
  2⤵
  PID:6408
- C:\Windows\System\iWPNQeU.exe
  C:\Windows\System\iWPNQeU.exe
  2⤵
  PID:6424
- C:\Windows\System\zfSWURz.exe
  C:\Windows\System\zfSWURz.exe
  2⤵
  PID:6440
- C:\Windows\System\avFPAuH.exe
  C:\Windows\System\avFPAuH.exe
  2⤵
  PID:6456
- C:\Windows\System\LQNVHaC.exe
  C:\Windows\System\LQNVHaC.exe
  2⤵
  PID:6476
- C:\Windows\System\nNMPAim.exe
  C:\Windows\System\nNMPAim.exe
  2⤵
  PID:6500
- C:\Windows\System\BSqUCDB.exe
  C:\Windows\System\BSqUCDB.exe
  2⤵
  PID:6524
- C:\Windows\System\tmIlpMt.exe
  C:\Windows\System\tmIlpMt.exe
  2⤵
  PID:6540
- C:\Windows\System\UDtCkEs.exe
  C:\Windows\System\UDtCkEs.exe
  2⤵
  PID:6556
- C:\Windows\System\QnSIfNE.exe
  C:\Windows\System\QnSIfNE.exe
  2⤵
  PID:6572
- C:\Windows\System\QjIRIqz.exe
  C:\Windows\System\QjIRIqz.exe
  2⤵
  PID:6588
- C:\Windows\System\hcNlFZe.exe
  C:\Windows\System\hcNlFZe.exe
  2⤵
  PID:6604
- C:\Windows\System\yDaoOaz.exe
  C:\Windows\System\yDaoOaz.exe
  2⤵
  PID:6620
- C:\Windows\System\raupZJC.exe
  C:\Windows\System\raupZJC.exe
  2⤵
  PID:6636
- C:\Windows\System\AeffZZi.exe
  C:\Windows\System\AeffZZi.exe
  2⤵
  PID:6664
- C:\Windows\System\vYVyXUD.exe
  C:\Windows\System\vYVyXUD.exe
  2⤵
  PID:6680
- C:\Windows\System\IPkCeLy.exe
  C:\Windows\System\IPkCeLy.exe
  2⤵
  PID:6700
- C:\Windows\System\XdXHOFJ.exe
  C:\Windows\System\XdXHOFJ.exe
  2⤵
  PID:6716
- C:\Windows\System\gBxcAjc.exe
  C:\Windows\System\gBxcAjc.exe
  2⤵
  PID:6732
- C:\Windows\System\lcqnBxD.exe
  C:\Windows\System\lcqnBxD.exe
  2⤵
  PID:6748
- C:\Windows\System\qvXvBYT.exe
  C:\Windows\System\qvXvBYT.exe
  2⤵
  PID:6764
- C:\Windows\System\uMbQxDh.exe
  C:\Windows\System\uMbQxDh.exe
  2⤵
  PID:6780
- C:\Windows\System\DsYafeI.exe
  C:\Windows\System\DsYafeI.exe
  2⤵
  PID:6796
- C:\Windows\System\mdXrndT.exe
  C:\Windows\System\mdXrndT.exe
  2⤵
  PID:6812
- C:\Windows\System\dnQlLGM.exe
  C:\Windows\System\dnQlLGM.exe
  2⤵
  PID:6828
- C:\Windows\System\ksdieDS.exe
  C:\Windows\System\ksdieDS.exe
  2⤵
  PID:6936
- C:\Windows\System\nhciZro.exe
  C:\Windows\System\nhciZro.exe
  2⤵
  PID:6952
- C:\Windows\System\nfAFxGM.exe
  C:\Windows\System\nfAFxGM.exe
  2⤵
  PID:6968
- C:\Windows\System\nShkLEB.exe
  C:\Windows\System\nShkLEB.exe
  2⤵
  PID:6984
- C:\Windows\System\KrxJMYX.exe
  C:\Windows\System\KrxJMYX.exe
  2⤵
  PID:7000
- C:\Windows\System\omtGOza.exe
  C:\Windows\System\omtGOza.exe
  2⤵
  PID:7016
- C:\Windows\System\DZnUWdb.exe
  C:\Windows\System\DZnUWdb.exe
  2⤵
  PID:7032
- C:\Windows\System\zYCSuzQ.exe
  C:\Windows\System\zYCSuzQ.exe
  2⤵
  PID:7056
- C:\Windows\System\IGHUWSM.exe
  C:\Windows\System\IGHUWSM.exe
  2⤵
  PID:7076
- C:\Windows\System\DaHaCEw.exe
  C:\Windows\System\DaHaCEw.exe
  2⤵
  PID:7100
- C:\Windows\System\sOJAlfk.exe
  C:\Windows\System\sOJAlfk.exe
  2⤵
  PID:7116
- C:\Windows\System\yQfMHBI.exe
  C:\Windows\System\yQfMHBI.exe
  2⤵
  PID:7136
- C:\Windows\System\bsjZmkD.exe
  C:\Windows\System\bsjZmkD.exe
  2⤵
  PID:7152
- C:\Windows\System\HZKylLM.exe
  C:\Windows\System\HZKylLM.exe
  2⤵
  PID:5748
- C:\Windows\System\hwOIyMp.exe
  C:\Windows\System\hwOIyMp.exe
  2⤵
  PID:5800
- C:\Windows\System\QlJormg.exe
  C:\Windows\System\QlJormg.exe
  2⤵
  PID:5768
- C:\Windows\System\SYTOSVK.exe
  C:\Windows\System\SYTOSVK.exe
  2⤵
  PID:6020
- C:\Windows\System\BXwvtkl.exe
  C:\Windows\System\BXwvtkl.exe
  2⤵
  PID:6196
- C:\Windows\System\wqZoZjC.exe
  C:\Windows\System\wqZoZjC.exe
  2⤵
  PID:6156
- C:\Windows\System\VhzyLHV.exe
  C:\Windows\System\VhzyLHV.exe
  2⤵
  PID:6208
- C:\Windows\System\amjRENU.exe
  C:\Windows\System\amjRENU.exe
  2⤵
  PID:6228
- C:\Windows\System\GPwoQKe.exe
  C:\Windows\System\GPwoQKe.exe
  2⤵
  PID:6232
- C:\Windows\System\moboDlN.exe
  C:\Windows\System\moboDlN.exe
  2⤵
  PID:6244
- C:\Windows\System\jJCCREc.exe
  C:\Windows\System\jJCCREc.exe
  2⤵
  PID:6248
- C:\Windows\System\OxwgpEs.exe
  C:\Windows\System\OxwgpEs.exe
  2⤵
  PID:5960
- C:\Windows\System\SjehEky.exe
  C:\Windows\System\SjehEky.exe
  2⤵
  PID:5464
- C:\Windows\System\ZKdloAR.exe
  C:\Windows\System\ZKdloAR.exe
  2⤵
  PID:6272
- C:\Windows\System\WCazzBo.exe
  C:\Windows\System\WCazzBo.exe
  2⤵
  PID:6180
- C:\Windows\System\PLNitBT.exe
  C:\Windows\System\PLNitBT.exe
  2⤵
  PID:6280
- C:\Windows\System\ICYeaKM.exe
  C:\Windows\System\ICYeaKM.exe
  2⤵
  PID:6432
- C:\Windows\System\rpRVdiS.exe
  C:\Windows\System\rpRVdiS.exe
  2⤵
  PID:6384
- C:\Windows\System\lggOdMr.exe
  C:\Windows\System\lggOdMr.exe
  2⤵
  PID:6520
- C:\Windows\System\FTrUTMU.exe
  C:\Windows\System\FTrUTMU.exe
  2⤵
  PID:6584
- C:\Windows\System\yWxtlNB.exe
  C:\Windows\System\yWxtlNB.exe
  2⤵
  PID:6648
- C:\Windows\System\nVXEDnR.exe
  C:\Windows\System\nVXEDnR.exe
  2⤵
  PID:6688
- C:\Windows\System\Dmrghte.exe
  C:\Windows\System\Dmrghte.exe
  2⤵
  PID:6388
- C:\Windows\System\ozIAmQx.exe
  C:\Windows\System\ozIAmQx.exe
  2⤵
  PID:6628
- C:\Windows\System\jJgWoBO.exe
  C:\Windows\System\jJgWoBO.exe
  2⤵
  PID:6740
- C:\Windows\System\BCTUJGN.exe
  C:\Windows\System\BCTUJGN.exe
  2⤵
  PID:6416
- C:\Windows\System\utGgmzl.exe
  C:\Windows\System\utGgmzl.exe
  2⤵
  PID:6860
- C:\Windows\System\NeRnrJL.exe
  C:\Windows\System\NeRnrJL.exe
  2⤵
  PID:6776
- C:\Windows\System\LgAilZI.exe
  C:\Windows\System\LgAilZI.exe
  2⤵
  PID:6948
- C:\Windows\System\FuGziYy.exe
  C:\Windows\System\FuGziYy.exe
  2⤵
  PID:7088
- C:\Windows\System\DyGkuMz.exe
  C:\Windows\System\DyGkuMz.exe
  2⤵
  PID:6852
- C:\Windows\System\bsUjwHP.exe
  C:\Windows\System\bsUjwHP.exe
  2⤵
  PID:6868
- C:\Windows\System\WZaqhSX.exe
  C:\Windows\System\WZaqhSX.exe
  2⤵
  PID:6892
- C:\Windows\System\iULvEsm.exe
  C:\Windows\System\iULvEsm.exe
  2⤵
  PID:6920
- C:\Windows\System\tKIMXad.exe
  C:\Windows\System\tKIMXad.exe
  2⤵
  PID:6928
- C:\Windows\System\KawcKti.exe
  C:\Windows\System\KawcKti.exe
  2⤵
  PID:7164
- C:\Windows\System\vaNkdjR.exe
  C:\Windows\System\vaNkdjR.exe
  2⤵
  PID:7024
- C:\Windows\System\gPiWPTD.exe
  C:\Windows\System\gPiWPTD.exe
  2⤵
  PID:4876
- C:\Windows\System\ldhHeTc.exe
  C:\Windows\System\ldhHeTc.exe
  2⤵
  PID:6164
- C:\Windows\System\pQQRArL.exe
  C:\Windows\System\pQQRArL.exe
  2⤵
  PID:6536
- C:\Windows\System\EUFQBeL.exe
  C:\Windows\System\EUFQBeL.exe
  2⤵
  PID:5452
- C:\Windows\System\OMIBcZO.exe
  C:\Windows\System\OMIBcZO.exe
  2⤵
  PID:6492
- C:\Windows\System\yRaNhNB.exe
  C:\Windows\System\yRaNhNB.exe
  2⤵
  PID:6204
- C:\Windows\System\rvJhXbF.exe
  C:\Windows\System\rvJhXbF.exe
  2⤵
  PID:5780
- C:\Windows\System\BWFGPde.exe
  C:\Windows\System\BWFGPde.exe
  2⤵
  PID:6512
- C:\Windows\System\iLktcRj.exe
  C:\Windows\System\iLktcRj.exe
  2⤵
  PID:6644
- C:\Windows\System\imIaRJM.exe
  C:\Windows\System\imIaRJM.exe
  2⤵
  PID:5648
- C:\Windows\System\mOzFqhi.exe
  C:\Windows\System\mOzFqhi.exe
  2⤵
  PID:5212
- C:\Windows\System\wBRMDEq.exe
  C:\Windows\System\wBRMDEq.exe
  2⤵
  PID:6220
- C:\Windows\System\KkNBGMM.exe
  C:\Windows\System\KkNBGMM.exe
  2⤵
  PID:6356
- C:\Windows\System\CXRzqVY.exe
  C:\Windows\System\CXRzqVY.exe
  2⤵
  PID:6552
- C:\Windows\System\EdlXsQd.exe
  C:\Windows\System\EdlXsQd.exe
  2⤵
  PID:6792
- C:\Windows\System\IMowUfV.exe
  C:\Windows\System\IMowUfV.exe
  2⤵
  PID:6484
- C:\Windows\System\iRoPsJR.exe
  C:\Windows\System\iRoPsJR.exe
  2⤵
  PID:4520
- C:\Windows\System\yRHazUF.exe
  C:\Windows\System\yRHazUF.exe
  2⤵
  PID:6452
- C:\Windows\System\FwzXAoF.exe
  C:\Windows\System\FwzXAoF.exe
  2⤵
  PID:6980
- C:\Windows\System\OvxTgVx.exe
  C:\Windows\System\OvxTgVx.exe
  2⤵
  PID:6772
- C:\Windows\System\poQEnUR.exe
  C:\Windows\System\poQEnUR.exe
  2⤵
  PID:6880
- C:\Windows\System\rvOsgVY.exe
  C:\Windows\System\rvOsgVY.exe
  2⤵
  PID:5364
- C:\Windows\System\eDrcWiK.exe
  C:\Windows\System\eDrcWiK.exe
  2⤵
  PID:6140
- C:\Windows\System\DphQZbx.exe
  C:\Windows\System\DphQZbx.exe
  2⤵
  PID:5940
- C:\Windows\System\gKRORsv.exe
  C:\Windows\System\gKRORsv.exe
  2⤵
  PID:6336
- C:\Windows\System\deqFrkM.exe
  C:\Windows\System\deqFrkM.exe
  2⤵
  PID:5348
- C:\Windows\System\urUaNFy.exe
  C:\Windows\System\urUaNFy.exe
  2⤵
  PID:7048
- C:\Windows\System\DZVJxvV.exe
  C:\Windows\System\DZVJxvV.exe
  2⤵
  PID:6400
- C:\Windows\System\YltCnYU.exe
  C:\Windows\System\YltCnYU.exe
  2⤵
  PID:5392
- C:\Windows\System\vJbwoQu.exe
  C:\Windows\System\vJbwoQu.exe
  2⤵
  PID:6728
- C:\Windows\System\CValHBK.exe
  C:\Windows\System\CValHBK.exe
  2⤵
  PID:6216
- C:\Windows\System\HBzqapy.exe
  C:\Windows\System\HBzqapy.exe
  2⤵
  PID:7108
- C:\Windows\System\SYIOPdZ.exe
  C:\Windows\System\SYIOPdZ.exe
  2⤵
  PID:6176
- C:\Windows\System\uiagpkL.exe
  C:\Windows\System\uiagpkL.exe
  2⤵
  PID:6352
- C:\Windows\System\BdQXUqB.exe
  C:\Windows\System\BdQXUqB.exe
  2⤵
  PID:6508
- C:\Windows\System\orLDyDp.exe
  C:\Windows\System\orLDyDp.exe
  2⤵
  PID:6596
- C:\Windows\System\BkpcZgz.exe
  C:\Windows\System\BkpcZgz.exe
  2⤵
  PID:6660
- C:\Windows\System\sDqFMfN.exe
  C:\Windows\System\sDqFMfN.exe
  2⤵
  PID:5912
- C:\Windows\System\RjQHvLj.exe
  C:\Windows\System\RjQHvLj.exe
  2⤵
  PID:7124
- C:\Windows\System\POVVNld.exe
  C:\Windows\System\POVVNld.exe
  2⤵
  PID:7160
- C:\Windows\System\vbfdecZ.exe
  C:\Windows\System\vbfdecZ.exe
  2⤵
  PID:6372
- C:\Windows\System\uyGHUUp.exe
  C:\Windows\System\uyGHUUp.exe
  2⤵
  PID:6260
- C:\Windows\System\vpJvibH.exe
  C:\Windows\System\vpJvibH.exe
  2⤵
  PID:6516
- C:\Windows\System\laPBbid.exe
  C:\Windows\System\laPBbid.exe
  2⤵
  PID:6848
- C:\Windows\System\puAFLNx.exe
  C:\Windows\System\puAFLNx.exe
  2⤵
  PID:7176
- C:\Windows\System\PCtmJZA.exe
  C:\Windows\System\PCtmJZA.exe
  2⤵
  PID:7192
- C:\Windows\System\SWsPLNJ.exe
  C:\Windows\System\SWsPLNJ.exe
  2⤵
  PID:7208
- C:\Windows\System\apNfAio.exe
  C:\Windows\System\apNfAio.exe
  2⤵
  PID:7224
- C:\Windows\System\tuBKCXo.exe
  C:\Windows\System\tuBKCXo.exe
  2⤵
  PID:7240
- C:\Windows\System\gLxZYxX.exe
  C:\Windows\System\gLxZYxX.exe
  2⤵
  PID:7256
- C:\Windows\System\puxAAbn.exe
  C:\Windows\System\puxAAbn.exe
  2⤵
  PID:7340
- C:\Windows\System\bcwykbb.exe
  C:\Windows\System\bcwykbb.exe
  2⤵
  PID:7356
- C:\Windows\System\ahmxjmS.exe
  C:\Windows\System\ahmxjmS.exe
  2⤵
  PID:7376
- C:\Windows\System\BoEmIpp.exe
  C:\Windows\System\BoEmIpp.exe
  2⤵
  PID:7392
- C:\Windows\System\XEIDcvh.exe
  C:\Windows\System\XEIDcvh.exe
  2⤵
  PID:7408
- C:\Windows\System\IYqHOeC.exe
  C:\Windows\System\IYqHOeC.exe
  2⤵
  PID:7424
- C:\Windows\System\SYivYAq.exe
  C:\Windows\System\SYivYAq.exe
  2⤵
  PID:7448
- C:\Windows\System\aMsebYX.exe
  C:\Windows\System\aMsebYX.exe
  2⤵
  PID:7472
- C:\Windows\System\trbInoc.exe
  C:\Windows\System\trbInoc.exe
  2⤵
  PID:7492
- C:\Windows\System\xBzuCgn.exe
  C:\Windows\System\xBzuCgn.exe
  2⤵
  PID:7508
- C:\Windows\System\OPvkAEu.exe
  C:\Windows\System\OPvkAEu.exe
  2⤵
  PID:7524
- C:\Windows\System\dnmqKie.exe
  C:\Windows\System\dnmqKie.exe
  2⤵
  PID:7540
- C:\Windows\System\bSwSSEW.exe
  C:\Windows\System\bSwSSEW.exe
  2⤵
  PID:7560
- C:\Windows\System\gsZTFpA.exe
  C:\Windows\System\gsZTFpA.exe
  2⤵
  PID:7576
- C:\Windows\System\ZpWoZuM.exe
  C:\Windows\System\ZpWoZuM.exe
  2⤵
  PID:7604
- C:\Windows\System\cUclvEz.exe
  C:\Windows\System\cUclvEz.exe
  2⤵
  PID:7620
- C:\Windows\System\xxkFlmo.exe
  C:\Windows\System\xxkFlmo.exe
  2⤵
  PID:7636
- C:\Windows\System\UccmeHT.exe
  C:\Windows\System\UccmeHT.exe
  2⤵
  PID:7652
- C:\Windows\System\cRUWzBw.exe
  C:\Windows\System\cRUWzBw.exe
  2⤵
  PID:7668
- C:\Windows\System\NvYhXJo.exe
  C:\Windows\System\NvYhXJo.exe
  2⤵
  PID:7684
- C:\Windows\System\OlsRtFr.exe
  C:\Windows\System\OlsRtFr.exe
  2⤵
  PID:7700
- C:\Windows\System\ACOMyNx.exe
  C:\Windows\System\ACOMyNx.exe
  2⤵
  PID:7716
- C:\Windows\System\YtNLMTA.exe
  C:\Windows\System\YtNLMTA.exe
  2⤵
  PID:7784
- C:\Windows\System\WWKTURd.exe
  C:\Windows\System\WWKTURd.exe
  2⤵
  PID:7804
- C:\Windows\System\FfJbbQc.exe
  C:\Windows\System\FfJbbQc.exe
  2⤵
  PID:7820
- C:\Windows\System\giOnxyW.exe
  C:\Windows\System\giOnxyW.exe
  2⤵
  PID:7840
- C:\Windows\System\vLAADHU.exe
  C:\Windows\System\vLAADHU.exe
  2⤵
  PID:7856
- C:\Windows\System\lKCVExx.exe
  C:\Windows\System\lKCVExx.exe
  2⤵
  PID:7872
- C:\Windows\System\IDZpeQw.exe
  C:\Windows\System\IDZpeQw.exe
  2⤵
  PID:7892
- C:\Windows\System\HjNyYJm.exe
  C:\Windows\System\HjNyYJm.exe
  2⤵
  PID:7912
- C:\Windows\System\TusejVX.exe
  C:\Windows\System\TusejVX.exe
  2⤵
  PID:7928
- C:\Windows\System\VZRyQEA.exe
  C:\Windows\System\VZRyQEA.exe
  2⤵
  PID:7956
- C:\Windows\System\XBgRUVA.exe
  C:\Windows\System\XBgRUVA.exe
  2⤵
  PID:7976
- C:\Windows\System\sVxnwqP.exe
  C:\Windows\System\sVxnwqP.exe
  2⤵
  PID:7992
- C:\Windows\System\SxaHtup.exe
  C:\Windows\System\SxaHtup.exe
  2⤵
  PID:8012
- C:\Windows\System\ZJpjODK.exe
  C:\Windows\System\ZJpjODK.exe
  2⤵
  PID:8040
- C:\Windows\System\QBoVneH.exe
  C:\Windows\System\QBoVneH.exe
  2⤵
  PID:8060
- C:\Windows\System\trGKrKQ.exe
  C:\Windows\System\trGKrKQ.exe
  2⤵
  PID:8084
- C:\Windows\System\muRoVeL.exe
  C:\Windows\System\muRoVeL.exe
  2⤵
  PID:8100
- C:\Windows\System\QFzjZOP.exe
  C:\Windows\System\QFzjZOP.exe
  2⤵
  PID:8120
- C:\Windows\System\zxIDdwS.exe
  C:\Windows\System\zxIDdwS.exe
  2⤵
  PID:8136
- C:\Windows\System\TxkSuPQ.exe
  C:\Windows\System\TxkSuPQ.exe
  2⤵
  PID:8156
- C:\Windows\System\ePOirPh.exe
  C:\Windows\System\ePOirPh.exe
  2⤵
  PID:2608
- C:\Windows\System\PEMxUmj.exe
  C:\Windows\System\PEMxUmj.exe
  2⤵
  PID:6840
- C:\Windows\System\mvmGSIw.exe
  C:\Windows\System\mvmGSIw.exe
  2⤵
  PID:6760
- C:\Windows\System\eiQNCoE.exe
  C:\Windows\System\eiQNCoE.exe
  2⤵
  PID:6844
- C:\Windows\System\NGdgJVh.exe
  C:\Windows\System\NGdgJVh.exe
  2⤵
  PID:6724
- C:\Windows\System\bUuhJcQ.exe
  C:\Windows\System\bUuhJcQ.exe
  2⤵
  PID:7236
- C:\Windows\System\SvnRAXX.exe
  C:\Windows\System\SvnRAXX.exe
  2⤵
  PID:7284
- C:\Windows\System\uiydmzC.exe
  C:\Windows\System\uiydmzC.exe
  2⤵
  PID:6916
- C:\Windows\System\byDitJB.exe
  C:\Windows\System\byDitJB.exe
  2⤵
  PID:7292
- C:\Windows\System\OkcljHi.exe
  C:\Windows\System\OkcljHi.exe
  2⤵
  PID:7204
- C:\Windows\System\dGRkGio.exe
  C:\Windows\System\dGRkGio.exe
  2⤵
  PID:6944
- C:\Windows\System\zbialnc.exe
  C:\Windows\System\zbialnc.exe
  2⤵
  PID:5980
- C:\Windows\System\aaXmHYu.exe
  C:\Windows\System\aaXmHYu.exe
  2⤵
  PID:7324
- C:\Windows\System\aWKJAeY.exe
  C:\Windows\System\aWKJAeY.exe
  2⤵
  PID:7336
- C:\Windows\System\gutaWnz.exe
  C:\Windows\System\gutaWnz.exe
  2⤵
  PID:7348
- C:\Windows\System\OYWGmOF.exe
  C:\Windows\System\OYWGmOF.exe
  2⤵
  PID:7420
- C:\Windows\System\DojMGPN.exe
  C:\Windows\System\DojMGPN.exe
  2⤵
  PID:7456
- C:\Windows\System\GKgfqsl.exe
  C:\Windows\System\GKgfqsl.exe
  2⤵
  PID:7568
- C:\Windows\System\cXpBFdN.exe
  C:\Windows\System\cXpBFdN.exe
  2⤵
  PID:7520
- C:\Windows\System\oXQRDoM.exe
  C:\Windows\System\oXQRDoM.exe
  2⤵
  PID:7584
- C:\Windows\System\BvZRUQk.exe
  C:\Windows\System\BvZRUQk.exe
  2⤵
  PID:7432
- C:\Windows\System\glwJgEQ.exe
  C:\Windows\System\glwJgEQ.exe
  2⤵
  PID:7592
- C:\Windows\System\rUxtGvi.exe
  C:\Windows\System\rUxtGvi.exe
  2⤵
  PID:7480
- C:\Windows\System\nZwlOvG.exe
  C:\Windows\System\nZwlOvG.exe
  2⤵
  PID:7628
- C:\Windows\System\oWupqOK.exe
  C:\Windows\System\oWupqOK.exe
  2⤵
  PID:7692
- C:\Windows\System\iScNZkg.exe
  C:\Windows\System\iScNZkg.exe
  2⤵
  PID:7748
- C:\Windows\System\VGjGDfh.exe
  C:\Windows\System\VGjGDfh.exe
  2⤵
  PID:7828
- C:\Windows\System\XUxbGsN.exe
  C:\Windows\System\XUxbGsN.exe
  2⤵
  PID:7864
- C:\Windows\System\sVFQFMz.exe
  C:\Windows\System\sVFQFMz.exe
  2⤵
  PID:7904
- C:\Windows\System\QsDJdAB.exe
  C:\Windows\System\QsDJdAB.exe
  2⤵
  PID:7884
- C:\Windows\System\stAiSLj.exe
  C:\Windows\System\stAiSLj.exe
  2⤵
  PID:7920
- C:\Windows\System\tetxUdC.exe
  C:\Windows\System\tetxUdC.exe
  2⤵
  PID:8036
- C:\Windows\System\ewYbqjM.exe
  C:\Windows\System\ewYbqjM.exe
  2⤵
  PID:8072
- C:\Windows\System\anKNsos.exe
  C:\Windows\System\anKNsos.exe
  2⤵
  PID:7924
- C:\Windows\System\tGweoby.exe
  C:\Windows\System\tGweoby.exe
  2⤵
  PID:8048
- C:\Windows\System\ihEeZhE.exe
  C:\Windows\System\ihEeZhE.exe
  2⤵
  PID:8116
- C:\Windows\System\vTYFjCH.exe
  C:\Windows\System\vTYFjCH.exe
  2⤵
  PID:8112
- C:\Windows\System\KFQdxsN.exe
  C:\Windows\System\KFQdxsN.exe
  2⤵
  PID:8164
- C:\Windows\System\TJiWLqq.exe
  C:\Windows\System\TJiWLqq.exe
  2⤵
  PID:6496
- C:\Windows\System\QVgrMOS.exe
  C:\Windows\System\QVgrMOS.exe
  2⤵
  PID:7084
- C:\Windows\System\qLglrQd.exe
  C:\Windows\System\qLglrQd.exe
  2⤵
  PID:7248
- C:\Windows\System\SfgxuFY.exe
  C:\Windows\System\SfgxuFY.exe
  2⤵
  PID:6932
- C:\Windows\System\FxIwJNY.exe
  C:\Windows\System\FxIwJNY.exe
  2⤵
  PID:7068
- C:\Windows\System\EFTjoBF.exe
  C:\Windows\System\EFTjoBF.exe
  2⤵
  PID:7272
- C:\Windows\System\wOQqbKR.exe
  C:\Windows\System\wOQqbKR.exe
  2⤵
  PID:6888
- C:\Windows\System\JuNOchs.exe
  C:\Windows\System\JuNOchs.exe
  2⤵
  PID:7304
- C:\Windows\System\BgGCXMe.exe
  C:\Windows\System\BgGCXMe.exe
  2⤵
  PID:7444
- C:\Windows\System\JRkdBaW.exe
  C:\Windows\System\JRkdBaW.exe
  2⤵
  PID:7500
- C:\Windows\System\OEUppUy.exe
  C:\Windows\System\OEUppUy.exe
  2⤵
  PID:7616
- C:\Windows\System\ysxgOCi.exe
  C:\Windows\System\ysxgOCi.exe
  2⤵
  PID:7556
- C:\Windows\System\fSyCLbM.exe
  C:\Windows\System\fSyCLbM.exe
  2⤵
  PID:7440
- C:\Windows\System\AQaMHjI.exe
  C:\Windows\System\AQaMHjI.exe
  2⤵
  PID:7696
- C:\Windows\System\COyYOHN.exe
  C:\Windows\System\COyYOHN.exe
  2⤵
  PID:7768
- C:\Windows\System\nBcELnu.exe
  C:\Windows\System\nBcELnu.exe
  2⤵
  PID:7832
- C:\Windows\System\iMEvPEL.exe
  C:\Windows\System\iMEvPEL.exe
  2⤵
  PID:7944
- C:\Windows\System\VsyQpeT.exe
  C:\Windows\System\VsyQpeT.exe
  2⤵
  PID:7948
- C:\Windows\System\HWkAdns.exe
  C:\Windows\System\HWkAdns.exe
  2⤵
  PID:7952
- C:\Windows\System\sKbufXM.exe
  C:\Windows\System\sKbufXM.exe
  2⤵
  PID:7988
- C:\Windows\System\KwVVjwr.exe
  C:\Windows\System\KwVVjwr.exe
  2⤵
  PID:8008
- C:\Windows\System\lfZBODu.exe
  C:\Windows\System\lfZBODu.exe
  2⤵
  PID:7972
- C:\Windows\System\xBbTYGU.exe
  C:\Windows\System\xBbTYGU.exe
  2⤵
  PID:8188
- C:\Windows\System\aZoYcjF.exe
  C:\Windows\System\aZoYcjF.exe
  2⤵
  PID:7588
- C:\Windows\System\pKjooXe.exe
  C:\Windows\System\pKjooXe.exe
  2⤵
  PID:6960
- C:\Windows\System\SXkClRW.exe
  C:\Windows\System\SXkClRW.exe
  2⤵
  PID:6864
- C:\Windows\System\rOKQHOo.exe
  C:\Windows\System\rOKQHOo.exe
  2⤵
  PID:6656
- C:\Windows\System\FyQtsOu.exe
  C:\Windows\System\FyQtsOu.exe
  2⤵
  PID:7368
- C:\Windows\System\ljyRjqI.exe
  C:\Windows\System\ljyRjqI.exe
  2⤵
  PID:7712
- C:\Windows\System\zrkAqkO.exe
  C:\Windows\System\zrkAqkO.exe
  2⤵
  PID:7468
- C:\Windows\System\nnUdOpi.exe
  C:\Windows\System\nnUdOpi.exe
  2⤵
  PID:7596
- C:\Windows\System\HTKQmAb.exe
  C:\Windows\System\HTKQmAb.exe
  2⤵
  PID:7780
- C:\Windows\System\UxZoreR.exe
  C:\Windows\System\UxZoreR.exe
  2⤵
  PID:7736
- C:\Windows\System\rlOBMiC.exe
  C:\Windows\System\rlOBMiC.exe
  2⤵
  PID:8176
- C:\Windows\System\dwhfeWk.exe
  C:\Windows\System\dwhfeWk.exe
  2⤵
  PID:7220
- C:\Windows\System\KsGhxUB.exe
  C:\Windows\System\KsGhxUB.exe
  2⤵
  PID:7940
- C:\Windows\System\LqvPLlc.exe
  C:\Windows\System\LqvPLlc.exe
  2⤵
  PID:8020
- C:\Windows\System\UQRaNyA.exe
  C:\Windows\System\UQRaNyA.exe
  2⤵
  PID:8000
- C:\Windows\System\qdpCUCY.exe
  C:\Windows\System\qdpCUCY.exe
  2⤵
  PID:6836
- C:\Windows\System\BHbaEzb.exe
  C:\Windows\System\BHbaEzb.exe
  2⤵
  PID:7268
- C:\Windows\System\vCnceLn.exe
  C:\Windows\System\vCnceLn.exe
  2⤵
  PID:7388
- C:\Windows\System\ujWNuQo.exe
  C:\Windows\System\ujWNuQo.exe
  2⤵
  PID:7760
- C:\Windows\System\NczAYQU.exe
  C:\Windows\System\NczAYQU.exe
  2⤵
  PID:8096
- C:\Windows\System\ESXnlsW.exe
  C:\Windows\System\ESXnlsW.exe
  2⤵
  PID:7968
- C:\Windows\System\ZNaMQjj.exe
  C:\Windows\System\ZNaMQjj.exe
  2⤵
  PID:7320
- C:\Windows\System\fAiDyTE.exe
  C:\Windows\System\fAiDyTE.exe
  2⤵
  PID:7488
- C:\Windows\System\njlEHup.exe
  C:\Windows\System\njlEHup.exe
  2⤵
  PID:7092
- C:\Windows\System\UtbKRrS.exe
  C:\Windows\System\UtbKRrS.exe
  2⤵
  PID:4396
- C:\Windows\System\jRwtvQZ.exe
  C:\Windows\System\jRwtvQZ.exe
  2⤵
  PID:7532
- C:\Windows\System\eKpderT.exe
  C:\Windows\System\eKpderT.exe
  2⤵
  PID:7536
- C:\Windows\System\wwTHSdE.exe
  C:\Windows\System\wwTHSdE.exe
  2⤵
  PID:7984
- C:\Windows\System\wHLMTlB.exe
  C:\Windows\System\wHLMTlB.exe
  2⤵
  PID:7276
- C:\Windows\System\bePvbPI.exe
  C:\Windows\System\bePvbPI.exe
  2⤵
  PID:8224
- C:\Windows\System\nWkAqEY.exe
  C:\Windows\System\nWkAqEY.exe
  2⤵
  PID:8244
- C:\Windows\System\cKGIKKQ.exe
  C:\Windows\System\cKGIKKQ.exe
  2⤵
  PID:8264
- C:\Windows\System\iZyfOvy.exe
  C:\Windows\System\iZyfOvy.exe
  2⤵
  PID:8280
- C:\Windows\System\eWIXtzd.exe
  C:\Windows\System\eWIXtzd.exe
  2⤵
  PID:8296
- C:\Windows\System\EoLFcBf.exe
  C:\Windows\System\EoLFcBf.exe
  2⤵
  PID:8316
- C:\Windows\System\WuBEuEZ.exe
  C:\Windows\System\WuBEuEZ.exe
  2⤵
  PID:8332
- C:\Windows\System\RrVbxaz.exe
  C:\Windows\System\RrVbxaz.exe
  2⤵
  PID:8360
- C:\Windows\System\xcBYkob.exe
  C:\Windows\System\xcBYkob.exe
  2⤵
  PID:8376
- C:\Windows\System\uBdRhtp.exe
  C:\Windows\System\uBdRhtp.exe
  2⤵
  PID:8392
- C:\Windows\System\jjtzovR.exe
  C:\Windows\System\jjtzovR.exe
  2⤵
  PID:8408
- C:\Windows\System\AaQCZbu.exe
  C:\Windows\System\AaQCZbu.exe
  2⤵
  PID:8424
- C:\Windows\System\OQMGong.exe
  C:\Windows\System\OQMGong.exe
  2⤵
  PID:8444
- C:\Windows\System\TqwvFhH.exe
  C:\Windows\System\TqwvFhH.exe
  2⤵
  PID:8492
- C:\Windows\System\QSJrhbE.exe
  C:\Windows\System\QSJrhbE.exe
  2⤵
  PID:8508
- C:\Windows\System\FTepUHA.exe
  C:\Windows\System\FTepUHA.exe
  2⤵
  PID:8524
- C:\Windows\System\IusQDBT.exe
  C:\Windows\System\IusQDBT.exe
  2⤵
  PID:8544
- C:\Windows\System\mbKlCvB.exe
  C:\Windows\System\mbKlCvB.exe
  2⤵
  PID:8560
- C:\Windows\System\RWCEumj.exe
  C:\Windows\System\RWCEumj.exe
  2⤵
  PID:8580
- C:\Windows\System\kgRnlIh.exe
  C:\Windows\System\kgRnlIh.exe
  2⤵
  PID:8596
- C:\Windows\System\mYJYHBJ.exe
  C:\Windows\System\mYJYHBJ.exe
  2⤵
  PID:8636
- C:\Windows\System\VIWReSE.exe
  C:\Windows\System\VIWReSE.exe
  2⤵
  PID:8652
- C:\Windows\System\aScBNFa.exe
  C:\Windows\System\aScBNFa.exe
  2⤵
  PID:8668
- C:\Windows\System\gReWoVs.exe
  C:\Windows\System\gReWoVs.exe
  2⤵
  PID:8688
- C:\Windows\System\dekVBls.exe
  C:\Windows\System\dekVBls.exe
  2⤵
  PID:8704
- C:\Windows\System\qhxaxrD.exe
  C:\Windows\System\qhxaxrD.exe
  2⤵
  PID:8736
- C:\Windows\System\mVmjMpg.exe
  C:\Windows\System\mVmjMpg.exe
  2⤵
  PID:8752
- C:\Windows\System\FvAhvIC.exe
  C:\Windows\System\FvAhvIC.exe
  2⤵
  PID:8768
- C:\Windows\System\izSOqLC.exe
  C:\Windows\System\izSOqLC.exe
  2⤵
  PID:8784
- C:\Windows\System\morADmG.exe
  C:\Windows\System\morADmG.exe
  2⤵
  PID:8808
- C:\Windows\System\EkvLOrK.exe
  C:\Windows\System\EkvLOrK.exe
  2⤵
  PID:8828
- C:\Windows\System\RzncUwf.exe
  C:\Windows\System\RzncUwf.exe
  2⤵
  PID:8844
- C:\Windows\System\IEMzEdl.exe
  C:\Windows\System\IEMzEdl.exe
  2⤵
  PID:8860
- C:\Windows\System\CHWDHVG.exe
  C:\Windows\System\CHWDHVG.exe
  2⤵
  PID:8880
- C:\Windows\System\GTXlSyh.exe
  C:\Windows\System\GTXlSyh.exe
  2⤵
  PID:8908
- C:\Windows\System\IShjdAt.exe
  C:\Windows\System\IShjdAt.exe
  2⤵
  PID:8924
- C:\Windows\System\xbAFvwf.exe
  C:\Windows\System\xbAFvwf.exe
  2⤵
  PID:8940
- C:\Windows\System\tGNseDX.exe
  C:\Windows\System\tGNseDX.exe
  2⤵
  PID:8960
- C:\Windows\System\xfUEmjz.exe
  C:\Windows\System\xfUEmjz.exe
  2⤵
  PID:8976
- C:\Windows\System\lrOGoDd.exe
  C:\Windows\System\lrOGoDd.exe
  2⤵
  PID:8992
- C:\Windows\System\LLXaeLX.exe
  C:\Windows\System\LLXaeLX.exe
  2⤵
  PID:9012
- C:\Windows\System\WaXACkZ.exe
  C:\Windows\System\WaXACkZ.exe
  2⤵
  PID:9060
- C:\Windows\System\Fvanzfz.exe
  C:\Windows\System\Fvanzfz.exe
  2⤵
  PID:9076
- C:\Windows\System\THHkxqh.exe
  C:\Windows\System\THHkxqh.exe
  2⤵
  PID:9100
- C:\Windows\System\saCqqSw.exe
  C:\Windows\System\saCqqSw.exe
  2⤵
  PID:9116
- C:\Windows\System\AlOHHwF.exe
  C:\Windows\System\AlOHHwF.exe
  2⤵
  PID:9140
- C:\Windows\System\HItlVGL.exe
  C:\Windows\System\HItlVGL.exe
  2⤵
  PID:9156
- C:\Windows\System\rDdJTqv.exe
  C:\Windows\System\rDdJTqv.exe
  2⤵
  PID:9172
- C:\Windows\System\mQBZFaL.exe
  C:\Windows\System\mQBZFaL.exe
  2⤵
  PID:9188
- C:\Windows\System\OXADNLJ.exe
  C:\Windows\System\OXADNLJ.exe
  2⤵
  PID:9212
- C:\Windows\System\RXbXFgP.exe
  C:\Windows\System\RXbXFgP.exe
  2⤵
  PID:8068
- C:\Windows\System\YqJMDrX.exe
  C:\Windows\System\YqJMDrX.exe
  2⤵
  PID:7772
- C:\Windows\System\nJsCxNc.exe
  C:\Windows\System\nJsCxNc.exe
  2⤵
  PID:8236
- C:\Windows\System\iMfuIVN.exe
  C:\Windows\System\iMfuIVN.exe
  2⤵
  PID:8308
- C:\Windows\System\SUEDSou.exe
  C:\Windows\System\SUEDSou.exe
  2⤵
  PID:8204
- C:\Windows\System\ixUgdBY.exe
  C:\Windows\System\ixUgdBY.exe
  2⤵
  PID:8348
- C:\Windows\System\VHNuRZA.exe
  C:\Windows\System\VHNuRZA.exe
  2⤵
  PID:8212
- C:\Windows\System\goaZlnt.exe
  C:\Windows\System\goaZlnt.exe
  2⤵
  PID:8372
- C:\Windows\System\axDTYpe.exe
  C:\Windows\System\axDTYpe.exe
  2⤵
  PID:8456
- C:\Windows\System\gBrllkY.exe
  C:\Windows\System\gBrllkY.exe
  2⤵
  PID:8432
- C:\Windows\System\UaBecqB.exe
  C:\Windows\System\UaBecqB.exe
  2⤵
  PID:8472
- C:\Windows\System\hFvIcKU.exe
  C:\Windows\System\hFvIcKU.exe
  2⤵
  PID:8516
- C:\Windows\System\JzpXouN.exe
  C:\Windows\System\JzpXouN.exe
  2⤵
  PID:8532
- C:\Windows\System\QPIfjWa.exe
  C:\Windows\System\QPIfjWa.exe
  2⤵
  PID:8540
- C:\Windows\System\sqkSJSF.exe
  C:\Windows\System\sqkSJSF.exe
  2⤵
  PID:8608
- C:\Windows\System\todAGEA.exe
  C:\Windows\System\todAGEA.exe
  2⤵
  PID:8624
- C:\Windows\System\CByZWFx.exe
  C:\Windows\System\CByZWFx.exe
  2⤵
  PID:8648
- C:\Windows\System\wbibnpy.exe
  C:\Windows\System\wbibnpy.exe
  2⤵
  PID:8680
- C:\Windows\System\cmqYgkt.exe
  C:\Windows\System\cmqYgkt.exe
  2⤵
  PID:8724
- C:\Windows\System\iIaohQL.exe
  C:\Windows\System\iIaohQL.exe
  2⤵
  PID:8744
- C:\Windows\System\RxbHrdx.exe
  C:\Windows\System\RxbHrdx.exe
  2⤵
  PID:8796
- C:\Windows\System\tZniLhj.exe
  C:\Windows\System\tZniLhj.exe
  2⤵
  PID:8776
- C:\Windows\System\yzWkdZg.exe
  C:\Windows\System\yzWkdZg.exe
  2⤵
  PID:8868
- C:\Windows\System\DUJYEOC.exe
  C:\Windows\System\DUJYEOC.exe
  2⤵
  PID:8852
- C:\Windows\System\hHolZOV.exe
  C:\Windows\System\hHolZOV.exe
  2⤵
  PID:8892
- C:\Windows\System\adWGbRV.exe
  C:\Windows\System\adWGbRV.exe
  2⤵
  PID:8948
- C:\Windows\System\bywDdSM.exe
  C:\Windows\System\bywDdSM.exe
  2⤵
  PID:8988
- C:\Windows\System\qpBQKPj.exe
  C:\Windows\System\qpBQKPj.exe
  2⤵
  PID:8972
- C:\Windows\System\FiXCJll.exe
  C:\Windows\System\FiXCJll.exe
  2⤵
  PID:9052
- C:\Windows\System\VSvRVGW.exe
  C:\Windows\System\VSvRVGW.exe
  2⤵
  PID:9092
- C:\Windows\System\iAcmCkx.exe
  C:\Windows\System\iAcmCkx.exe
  2⤵
  PID:9124
- C:\Windows\System\JIPYbWm.exe
  C:\Windows\System\JIPYbWm.exe
  2⤵
  PID:9148
- C:\Windows\System\YmHbQEu.exe
  C:\Windows\System\YmHbQEu.exe
  2⤵
  PID:9200
- C:\Windows\System\TMBnxdN.exe
  C:\Windows\System\TMBnxdN.exe
  2⤵
  PID:6348
- C:\Windows\System\pSrqmjF.exe
  C:\Windows\System\pSrqmjF.exe
  2⤵
  PID:7880
- C:\Windows\System\YJlYxNQ.exe
  C:\Windows\System\YJlYxNQ.exe
  2⤵
  PID:8344
- C:\Windows\System\tetGTZR.exe
  C:\Windows\System\tetGTZR.exe
  2⤵
  PID:8324
- C:\Windows\System\jinJdZP.exe
  C:\Windows\System\jinJdZP.exe
  2⤵
  PID:8416
- C:\Windows\System\UozusbS.exe
  C:\Windows\System\UozusbS.exe
  2⤵
  PID:8440
- C:\Windows\System\ehnJUDG.exe
  C:\Windows\System\ehnJUDG.exe
  2⤵
  PID:8488
- C:\Windows\System\IoxKFpE.exe
  C:\Windows\System\IoxKFpE.exe
  2⤵
  PID:8536
- C:\Windows\System\mCwnmZN.exe
  C:\Windows\System\mCwnmZN.exe
  2⤵
  PID:9032
- C:\Windows\System\kFeIRUD.exe
  C:\Windows\System\kFeIRUD.exe
  2⤵
  PID:8660
- C:\Windows\System\vJBhoxE.exe
  C:\Windows\System\vJBhoxE.exe
  2⤵
  PID:8764
- C:\Windows\System\MsvIxme.exe
  C:\Windows\System\MsvIxme.exe
  2⤵
  PID:8916
- C:\Windows\System\oOKfAii.exe
  C:\Windows\System\oOKfAii.exe
  2⤵
  PID:8836
- C:\Windows\System\xxzbymR.exe
  C:\Windows\System\xxzbymR.exe
  2⤵
  PID:8888
- C:\Windows\System\ZCmyhom.exe
  C:\Windows\System\ZCmyhom.exe
  2⤵
  PID:8720
- C:\Windows\System\lMLQJTn.exe
  C:\Windows\System\lMLQJTn.exe
  2⤵
  PID:9028
- C:\Windows\System\KRDoojg.exe
  C:\Windows\System\KRDoojg.exe
  2⤵
  PID:9008
- C:\Windows\System\Dmvrttd.exe
  C:\Windows\System\Dmvrttd.exe
  2⤵
  PID:9088
- C:\Windows\System\EOGnAES.exe
  C:\Windows\System\EOGnAES.exe
  2⤵
  PID:9132
- C:\Windows\System\WIGuebA.exe
  C:\Windows\System\WIGuebA.exe
  2⤵
  PID:1472
- C:\Windows\System\qfTfvhQ.exe
  C:\Windows\System\qfTfvhQ.exe
  2⤵
  PID:7812
- C:\Windows\System\KNlKSDJ.exe
  C:\Windows\System\KNlKSDJ.exe
  2⤵
  PID:7600
- C:\Windows\System\apkPliY.exe
  C:\Windows\System\apkPliY.exe
  2⤵
  PID:8388
- C:\Windows\System\WTXlgKQ.exe
  C:\Windows\System\WTXlgKQ.exe
  2⤵
  PID:8452
- C:\Windows\System\SxlziQV.exe
  C:\Windows\System\SxlziQV.exe
  2⤵
  PID:8552
- C:\Windows\System\edhNwzj.exe
  C:\Windows\System\edhNwzj.exe
  2⤵
  PID:8576
- C:\Windows\System\hHngYqm.exe
  C:\Windows\System\hHngYqm.exe
  2⤵
  PID:8804
- C:\Windows\System\MxtOdKI.exe
  C:\Windows\System\MxtOdKI.exe
  2⤵
  PID:8716
- C:\Windows\System\KqcpAxv.exe
  C:\Windows\System\KqcpAxv.exe
  2⤵
  PID:9000
- C:\Windows\System\IqUoZKg.exe
  C:\Windows\System\IqUoZKg.exe
  2⤵
  PID:8936
- C:\Windows\System\aWJkAMi.exe
  C:\Windows\System\aWJkAMi.exe
  2⤵
  PID:7172
- C:\Windows\System\MIfkRUG.exe
  C:\Windows\System\MIfkRUG.exe
  2⤵
  PID:8220
- C:\Windows\System\iiHYziD.exe
  C:\Windows\System\iiHYziD.exe
  2⤵
  PID:8352
- C:\Windows\System\NcTAJoG.exe
  C:\Windows\System\NcTAJoG.exe
  2⤵
  PID:9204
- C:\Windows\System\JpZuAyJ.exe
  C:\Windows\System\JpZuAyJ.exe
  2⤵
  PID:8484
- C:\Windows\System\jSVbjjb.exe
  C:\Windows\System\jSVbjjb.exe
  2⤵
  PID:8604
- C:\Windows\System\TLnxUfv.exe
  C:\Windows\System\TLnxUfv.exe
  2⤵
  PID:8684
- C:\Windows\System\NrfKjuf.exe
  C:\Windows\System\NrfKjuf.exe
  2⤵
  PID:9004
- C:\Windows\System\LYNUvYj.exe
  C:\Windows\System\LYNUvYj.exe
  2⤵
  PID:9040
- C:\Windows\System\jDTmORg.exe
  C:\Windows\System\jDTmORg.exe
  2⤵
  PID:9196
- C:\Windows\System\bjkHmwY.exe
  C:\Windows\System\bjkHmwY.exe
  2⤵
  PID:8904
- C:\Windows\System\bVRqEVm.exe
  C:\Windows\System\bVRqEVm.exe
  2⤵
  PID:8840
- C:\Windows\System\kZNBLVH.exe
  C:\Windows\System\kZNBLVH.exe
  2⤵
  PID:8876
- C:\Windows\System\JnTWknJ.exe
  C:\Windows\System\JnTWknJ.exe
  2⤵
  PID:8292
- C:\Windows\System\BKkOAdQ.exe
  C:\Windows\System\BKkOAdQ.exe
  2⤵
  PID:8504
- C:\Windows\System\VEtPwYB.exe
  C:\Windows\System\VEtPwYB.exe
  2⤵
  PID:9208
- C:\Windows\System\BEYRlOs.exe
  C:\Windows\System\BEYRlOs.exe
  2⤵
  PID:9224
- C:\Windows\System\xIlmGlX.exe
  C:\Windows\System\xIlmGlX.exe
  2⤵
  PID:9240
- C:\Windows\System\CaGtvmk.exe
  C:\Windows\System\CaGtvmk.exe
  2⤵
  PID:9260
- C:\Windows\System\hNLeqed.exe
  C:\Windows\System\hNLeqed.exe
  2⤵
  PID:9276
- C:\Windows\System\VNilMSl.exe
  C:\Windows\System\VNilMSl.exe
  2⤵
  PID:9292
- C:\Windows\System\ApxQepP.exe
  C:\Windows\System\ApxQepP.exe
  2⤵
  PID:9312
- C:\Windows\System\rDzpgmP.exe
  C:\Windows\System\rDzpgmP.exe
  2⤵
  PID:9328
- C:\Windows\System\OzIvEFr.exe
  C:\Windows\System\OzIvEFr.exe
  2⤵
  PID:9344
- C:\Windows\System\vGQgXhQ.exe
  C:\Windows\System\vGQgXhQ.exe
  2⤵
  PID:9360
- C:\Windows\System\MuHfdFh.exe
  C:\Windows\System\MuHfdFh.exe
  2⤵
  PID:9376
- C:\Windows\System\XxnIuqy.exe
  C:\Windows\System\XxnIuqy.exe
  2⤵
  PID:9444
- C:\Windows\System\xzSwZNr.exe
  C:\Windows\System\xzSwZNr.exe
  2⤵
  PID:9460
- C:\Windows\System\lFKXaoq.exe
  C:\Windows\System\lFKXaoq.exe
  2⤵
  PID:9476
- C:\Windows\System\HMVEapO.exe
  C:\Windows\System\HMVEapO.exe
  2⤵
  PID:9492
- C:\Windows\System\DYHRLGD.exe
  C:\Windows\System\DYHRLGD.exe
  2⤵
  PID:9508
- C:\Windows\System\MXaznOa.exe
  C:\Windows\System\MXaznOa.exe
  2⤵
  PID:9524
- C:\Windows\System\elMeFCE.exe
  C:\Windows\System\elMeFCE.exe
  2⤵
  PID:9556
- C:\Windows\System\JEOaeCq.exe
  C:\Windows\System\JEOaeCq.exe
  2⤵
  PID:9572
- C:\Windows\System\uAxYKqI.exe
  C:\Windows\System\uAxYKqI.exe
  2⤵
  PID:9592
- C:\Windows\System\SIMFlbx.exe
  C:\Windows\System\SIMFlbx.exe
  2⤵
  PID:9608
- C:\Windows\System\vXFcVvX.exe
  C:\Windows\System\vXFcVvX.exe
  2⤵
  PID:9624
- C:\Windows\System\MuTGuEb.exe
  C:\Windows\System\MuTGuEb.exe
  2⤵
  PID:9640
- C:\Windows\System\ZFGciZq.exe
  C:\Windows\System\ZFGciZq.exe
  2⤵
  PID:9656
- C:\Windows\System\WmqVGvb.exe
  C:\Windows\System\WmqVGvb.exe
  2⤵
  PID:9676
- C:\Windows\System\LULfiBW.exe
  C:\Windows\System\LULfiBW.exe
  2⤵
  PID:9696
- C:\Windows\System\MJDxKCs.exe
  C:\Windows\System\MJDxKCs.exe
  2⤵
  PID:9712
- C:\Windows\System\bLRwhJu.exe
  C:\Windows\System\bLRwhJu.exe
  2⤵
  PID:9736
- C:\Windows\System\gqdLrug.exe
  C:\Windows\System\gqdLrug.exe
  2⤵
  PID:9780
- C:\Windows\System\MvDpmGs.exe
  C:\Windows\System\MvDpmGs.exe
  2⤵
  PID:9796
- C:\Windows\System\UNsQeNt.exe
  C:\Windows\System\UNsQeNt.exe
  2⤵
  PID:9816
- C:\Windows\System\Ihwrtda.exe
  C:\Windows\System\Ihwrtda.exe
  2⤵
  PID:9844
- C:\Windows\System\VjuBvON.exe
  C:\Windows\System\VjuBvON.exe
  2⤵
  PID:9864
- C:\Windows\System\JhZhaNr.exe
  C:\Windows\System\JhZhaNr.exe
  2⤵
  PID:9884
- C:\Windows\System\NQAvvia.exe
  C:\Windows\System\NQAvvia.exe
  2⤵
  PID:9900
- C:\Windows\System\LcyzYiR.exe
  C:\Windows\System\LcyzYiR.exe
  2⤵
  PID:9924
- C:\Windows\System\CZOwnUz.exe
  C:\Windows\System\CZOwnUz.exe
  2⤵
  PID:9940
- C:\Windows\System\SzsRsQs.exe
  C:\Windows\System\SzsRsQs.exe
  2⤵
  PID:9956
- C:\Windows\System\qjheLnj.exe
  C:\Windows\System\qjheLnj.exe
  2⤵
  PID:9976
- C:\Windows\System\UOvMykJ.exe
  C:\Windows\System\UOvMykJ.exe
  2⤵
  PID:9996
- C:\Windows\System\vrfMjeh.exe
  C:\Windows\System\vrfMjeh.exe
  2⤵
  PID:10016
- C:\Windows\System\IXYfwaA.exe
  C:\Windows\System\IXYfwaA.exe
  2⤵
  PID:10032
- C:\Windows\System\kNfzMSb.exe
  C:\Windows\System\kNfzMSb.exe
  2⤵
  PID:10052
- C:\Windows\System\FrLxEpE.exe
  C:\Windows\System\FrLxEpE.exe
  2⤵
  PID:10072
- C:\Windows\System\lUnkuZY.exe
  C:\Windows\System\lUnkuZY.exe
  2⤵
  PID:10088
- C:\Windows\System\plduKuG.exe
  C:\Windows\System\plduKuG.exe
  2⤵
  PID:10108
- C:\Windows\System\lfpNzIb.exe
  C:\Windows\System\lfpNzIb.exe
  2⤵
  PID:10124
- C:\Windows\System\XXthFqT.exe
  C:\Windows\System\XXthFqT.exe
  2⤵
  PID:10140
- C:\Windows\System\ZegWDqE.exe
  C:\Windows\System\ZegWDqE.exe
  2⤵
  PID:10156
- C:\Windows\System\kUcwnjc.exe
  C:\Windows\System\kUcwnjc.exe
  2⤵
  PID:10172
- C:\Windows\System\uTNJFJl.exe
  C:\Windows\System\uTNJFJl.exe
  2⤵
  PID:10188
- C:\Windows\System\NCODtVh.exe
  C:\Windows\System\NCODtVh.exe
  2⤵
  PID:10204
- C:\Windows\System\ZlNHbER.exe
  C:\Windows\System\ZlNHbER.exe
  2⤵
  PID:10220
- C:\Windows\System\METfdJD.exe
  C:\Windows\System\METfdJD.exe
  2⤵
  PID:10236
- C:\Windows\System\vVbqpGy.exe
  C:\Windows\System\vVbqpGy.exe
  2⤵
  PID:8824
- C:\Windows\System\pQOifzr.exe
  C:\Windows\System\pQOifzr.exe
  2⤵
  PID:9164
- C:\Windows\System\tYDgAmx.exe
  C:\Windows\System\tYDgAmx.exe
  2⤵
  PID:9220
- C:\Windows\System\jijLUPt.exe
  C:\Windows\System\jijLUPt.exe
  2⤵
  PID:9324
- C:\Windows\System\FdulPCH.exe
  C:\Windows\System\FdulPCH.exe
  2⤵
  PID:9396
- C:\Windows\System\OexmEor.exe
  C:\Windows\System\OexmEor.exe
  2⤵
  PID:9336
- C:\Windows\System\wMwXYuP.exe
  C:\Windows\System\wMwXYuP.exe
  2⤵
  PID:9300
- C:\Windows\System\KZwMMys.exe
  C:\Windows\System\KZwMMys.exe
  2⤵
  PID:9440
- C:\Windows\System\xsOWWTf.exe
  C:\Windows\System\xsOWWTf.exe
  2⤵
  PID:9468
- C:\Windows\System\AAbtPku.exe
  C:\Windows\System\AAbtPku.exe
  2⤵
  PID:9552
- C:\Windows\System\ufXCxuo.exe
  C:\Windows\System\ufXCxuo.exe
  2⤵
  PID:9652
- C:\Windows\System\qQKCodV.exe
  C:\Windows\System\qQKCodV.exe
  2⤵
  PID:9720
- C:\Windows\System\WdWziKq.exe
  C:\Windows\System\WdWziKq.exe
  2⤵
  PID:9632
- C:\Windows\System\PqbJwCh.exe
  C:\Windows\System\PqbJwCh.exe
  2⤵
  PID:9636
- C:\Windows\System\PvrbUqt.exe
  C:\Windows\System\PvrbUqt.exe
  2⤵
  PID:9792
- C:\Windows\System\vCiwBMm.exe
  C:\Windows\System\vCiwBMm.exe
  2⤵
  PID:9804
- C:\Windows\System\qqEQuZc.exe
  C:\Windows\System\qqEQuZc.exe
  2⤵
  PID:9752
- C:\Windows\System\aEyooTP.exe
  C:\Windows\System\aEyooTP.exe
  2⤵
  PID:9824
- C:\Windows\System\ypLoggl.exe
  C:\Windows\System\ypLoggl.exe
  2⤵
  PID:9840
- C:\Windows\System\zDlbGZa.exe
  C:\Windows\System\zDlbGZa.exe
  2⤵
  PID:9876
- C:\Windows\System\dELVdqm.exe
  C:\Windows\System\dELVdqm.exe
  2⤵
  PID:9952
- C:\Windows\System\ImyQMvD.exe
  C:\Windows\System\ImyQMvD.exe
  2⤵
  PID:10064
- C:\Windows\System\JIjVpqE.exe
  C:\Windows\System\JIjVpqE.exe
  2⤵
  PID:10132
- C:\Windows\System\Hacgngz.exe
  C:\Windows\System\Hacgngz.exe
  2⤵
  PID:9968
- C:\Windows\System\HCAAVpg.exe
  C:\Windows\System\HCAAVpg.exe
  2⤵
  PID:10012
- C:\Windows\System\mVmZzbC.exe
  C:\Windows\System\mVmZzbC.exe
  2⤵
  PID:10084
- C:\Windows\System\lbMOBXJ.exe
  C:\Windows\System\lbMOBXJ.exe
  2⤵
  PID:10148
- C:\Windows\System\JwaZRvu.exe
  C:\Windows\System\JwaZRvu.exe
  2⤵
  PID:10184
- C:\Windows\System\nikdwJy.exe
  C:\Windows\System\nikdwJy.exe
  2⤵
  PID:9232
- C:\Windows\System\UFbUEyG.exe
  C:\Windows\System\UFbUEyG.exe
  2⤵
  PID:8628
- C:\Windows\System\dhvrADG.exe
  C:\Windows\System\dhvrADG.exe
  2⤵
  PID:8480
- C:\Windows\System\emZOPlV.exe
  C:\Windows\System\emZOPlV.exe
  2⤵
  PID:9284

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\CJcJaQB.exe

Filesize
3.0MB

MD5
ee75a526b120cb3337ee2a693fb3a3b0

SHA1
9341e65611e1df102ba3858aac9ee4d99d59f7b5

SHA256
a56a6656f5363cd87986ea1b7a7fe2e25aaffebc486d2f13e158e802b19a2c33

SHA512
388e0bb5785ee73af262a56d87652546f2bfd5571aff7587537ba60914ab82f8fe88ee8db31a8acc3368425ec1847b5d4f36dc7c9567eab8e9645d92255c2f69

Download Submit
C:\Windows\system\DWcaHVp.exe

Filesize
3.0MB

MD5
4b06729a34c6819c2964659579b36705

SHA1
f53ae7ebfb4d323f21279565f0b852d2f3b27dfa

SHA256
0e14161db030768d72d59bf515f4e30cd733d0ffc7fbea58ec33075509aa35cc

SHA512
35ea0b6f35251d6d8c55b75845f6d6d20a6d025aab8ed370f19ad29a2a97eb169eec71e05a5ba5c99f3a7144acadab54dbb6771195de0968565318e2d7060b70

Download Submit
C:\Windows\system\EmiZOYl.exe

Filesize
3.0MB

MD5
714a95655d246acccb18eec1b1f29f8a

SHA1
69d7d7adfffa15a71f2ad0600e318c41c5f61eb7

SHA256
e96ff7e47d68baf273cdd844f4bfe791f43844d5d133f63a15d25d13b271339b

SHA512
75956ad255018a6baa415dbb0642ed02ffeb5346acb533b1fae110216019f0bb0be9899f7f538e17cc87defc22abf865db899e67b17ec544134fec186591321e

Download Submit
C:\Windows\system\EwULBxe.exe

Filesize
3.0MB

MD5
ab471bd7fd406622bf030ed9b2d53921

SHA1
030c14d051318a02951cc88a19475db803bb0efd

SHA256
cfb44ee2fef01a59ba7cc266056bb1bc40db4c54149a5c04c5923ba78e04a5e5

SHA512
48b3d8174c3d07e65c248ef1d95fc07aa15eed9a04d7fe9ea0a35a3fa4bd7816021fd1a5a5e67762acb10c3398e0ac65be8f21d307a903f74e45a15674d8c5f3

Download Submit
C:\Windows\system\HDaMJhU.exe

Filesize
3.0MB

MD5
f56adb6fffd0ba6d070a1a4f04e9e8e8

SHA1
a1f56798884b786138cc0037234b5231bfc920e9

SHA256
c03a70ee4efdb570b4a1ef0812260ce15df54fd7dcba20fbb3614528769fe479

SHA512
e1dafefa65ac8da75c3baa43d5ee22e9fc4d5b028739be3514df2f445ec2ec11a664d192c7e55e65424a6d1e5ed0b86d1cb33d3f7772e98eb08ce38e1a097cfb

Download Submit
C:\Windows\system\JrSqHah.exe

Filesize
3.0MB

MD5
96cd2c2c63ed638ba759a40d8f734612

SHA1
a0f151b9125d9df274cbe6973efb3d85900a668b

SHA256
06f7bce3e3aa6eddcb276d0c30d012dcb4d1ccec61c1ede3fb26e1cae8219fc2

SHA512
0520207de73423fae65b9790b01bd4d0d4131235e9acce841fa9590e73f142d5289cc80210ca2bbe2ba7af5087a8574c25548e85134b3bf6d93a708b4df31db4

Download Submit
C:\Windows\system\KFtnQEK.exe

Filesize
3.0MB

MD5
61991bb029ba9286596202d16788cbc3

SHA1
04bcedba11105e71096ff3fc3ef55e5d692ee198

SHA256
b3402800d128cefd81c31c58d07368bca0968227a4f398b653972d36bdb0df76

SHA512
7f233077dbc929bc7080a91296166bd8b4913cd5d1872c2ec6880640d05053268f6c87cb02edac72935c7bd603238468f684a65a2e157c63da3c35ee8540d341

Download Submit
C:\Windows\system\NoaQyLJ.exe

Filesize
3.0MB

MD5
af5b3c082e9ac1f7bb50523b82525b45

SHA1
4a67c6f7914d1bbbda7d3f5d5751b546cdbef51f

SHA256
d3f566754c57dae86bfd3cdb6bf27c696d99a25ab4a4f60495c4ea3e63eb0d78

SHA512
fd1b7edc01f487fd49a9919e40a56c9f483a573897b8df9f8ffd6e73e7fa8b88a016b7c23a16edbd866edcdd8954c468e9fd9ca8c91b5a30025055780cc97256

Download Submit
C:\Windows\system\OypVewi.exe

Filesize
3.0MB

MD5
7f195151edb651925e409b67e8a78aa8

SHA1
8276567750b11d88d865d849069f77ca74dc4bd1

SHA256
e2a601cb2d02dedc959693b30aec01470b792d04d9e6459e45d359b412cebb13

SHA512
f7a8b2f48f5f04218e174e39ad71bbc887f3c2dcb4205d228ab07be50de226cf3b4d9cd2581ba4980b7d4913a38f300e5ae977c23c87a3fc429179d1b07a14b7

Download Submit
C:\Windows\system\QGUMgki.exe

Filesize
3.0MB

MD5
822166d34dd5e883ff8716140a952747

SHA1
3e90a49bfeb24f0cce86ec6f49e93321f124d4f4

SHA256
9f40b78ff655025000b4fbbbad41b6af0f593e899c6265b2d4f420775ab821dd

SHA512
e399a4d2f6a02887e1f325c8ad0d6fb25bdcaa01cfd46a9215ab9c762ed2c67b51e72aa323566af64b042b25784a3c75a5eeff8f77d8474feab5aba4f328ac87

Download Submit
C:\Windows\system\Skjlyjp.exe

Filesize
3.0MB

MD5
fa8b68257002b11cbb34de687dedabdc

SHA1
8fe0aa31c1656f596025e6ea9eb417db1ac8523b

SHA256
db18ae74b7f3f1b154db4fae10194152640967685a9259f4cc6191908eafb7f1

SHA512
bb65fc33bc8606d1d6e7ff175af348e95b0ff864cc1938f241901c9bcc7a67d76f5aa3105ded7f2292d0b52435b682ef08495916c84f158c4f9f21e0bada52c1

Download Submit
C:\Windows\system\TKApdyG.exe

Filesize
3.0MB

MD5
8120cb07fbf9a4a9fa61c90043927217

SHA1
3eadeb14797f55fea694459b8b6a7b8b4a251cbd

SHA256
d135e2242b651d75285319ed1b48b48c3d552222a97557f921db954313beecd5

SHA512
cae45906446e461260f400cf51ab008af55aee68490d8922c8c48e51190163ee0c5433b4a03a5004c5192cf9b702d72cf40d1ce93f30b1fa87c35252b2eb47a8

Download Submit
C:\Windows\system\VExlmqT.exe

Filesize
3.0MB

MD5
b84bce3007ceec825fddc98f4b6f22d5

SHA1
d0c1585c298d263d91d9774cddd07e5a51a00dff

SHA256
c3575e065dea4fe954ecc7d054ed630f98c7a8faa3de0f05bd8d4bb5646229f6

SHA512
f8091df8137196445ab199f0d7d353a4aa2f093eb60863764866ca1a38caf46df0e49ca23459434a1a12369a05e46c7e15c9c119ed6c520c141f684e67b83c9b

Download Submit
C:\Windows\system\YTpEsgW.exe

Filesize
3.0MB

MD5
03c8edf20973a39426a0bb88b2c41ec6

SHA1
a76652599b42ed16f9b6b16bd621cb3b6422919c

SHA256
e7d40a2dd86c32dd4508610359d2244f52938d0157a6a0080b8e293b4af2d2a2

SHA512
dc7120bd26483b10db4c68a37b6459832537311cf1b6e4c2f38844a902978f2d9a6ef5c0e688a8a3a35e31ad0d790818a97d1dda16db063a55ce1f7f1437fa70

Download Submit
C:\Windows\system\ZsMTuZu.exe

Filesize
3.0MB

MD5
93f632d0de890046846eefb67a86aa8a

SHA1
5760193d7799f9e0fe6769e8e1bfdbe55a012ac3

SHA256
40744e159b10b747ad5f0449a767ffe633c8676e85a98c2b2c25b3e1a39e638b

SHA512
d78d27c58b7ed92170703878ba19e6b25000d6333559440e13f61a488b1583dade508d5c06f391830f16a7ff2465bac9ec3e5e80fa12c65882b1fa07329dcf8c

Download Submit
C:\Windows\system\aMPIYNk.exe

Filesize
3.0MB

MD5
406d2f1e65484388a0abfab83a2e2003

SHA1
ca3fd98a3b56632f2ecd4e123d125f10c5a3767b

SHA256
bafcf554241d5d4641e2c22706703f57530298d55a34808307ed559b3d1b098d

SHA512
e1f0ed12c8683e3b94e92f7200169efc85c7caa6d741fda19ae669a05f5410dcc0e05a56c405024aab09d25725c538ab83789e7853c3e7b4a2e8ef145056164d

Download Submit
C:\Windows\system\aucLKQz.exe

Filesize
3.0MB

MD5
e16af1dbc5ac311acab165bbfb83690a

SHA1
4d0b5a91ad6937ae7c15ecc0f0412ffdb2726a73

SHA256
ebc9d79f4909ed0e3d2238afd398c98e8e247490b649406e8fa3da40ea66d903

SHA512
ddb1fb9e272f5ac0648a2ab8b031744e0e7efce46ad453808fb31f5c323c752b74f9329866e9c2b4815308a3926d7110371bea0d94c751cc472e9baea2407cab

Download Submit
C:\Windows\system\iJVJEoM.exe

Filesize
3.0MB

MD5
ea4afd76107d5c7fe92efe57cbd202cd

SHA1
afe4b5b65dc79202b68b5ce98ca837520b912af8

SHA256
dee26cd70986b481d935f5ff053dc896914a5f5a72ac572f8aa1d65aef1520af

SHA512
5d9950849080646be18158767f7ff8996b4b45634bab73cb9ce0bec45b2ce984ad083f2afd63878b37760d1ae605a9d5f3f9fc59909519ad8e4ceb2a3cb58069

Download Submit
C:\Windows\system\kXgCFLz.exe

Filesize
3.0MB

MD5
a8b3f2d6c168e307655798adf0ba8b16

SHA1
1ae62642182317b0c6006907f0a0d56fe3aeb7a7

SHA256
414d1c2a9186fb0254b7ad30ddd82439992f72cc3f7987eb3d55822b6ceed79e

SHA512
99bb54e9f6809654ae397d5c64438c6c5d531f59ac525410a27c6bef6ecd66462398005045c759712ddf2725dbd8a3dfc652a7300d697e8e1ae34bd7ab40c6c9

Download Submit
C:\Windows\system\mybtstE.exe

Filesize
3.0MB

MD5
1c2af952b63cb95859d7bb6ac09cf581

SHA1
4554dc16fa98445fdbd4b3f54c86fa41e1cd24e0

SHA256
fd9e08b47ff25007d26e3dc31ae58141a80af80d8d0516c0ad5e452a048af592

SHA512
b6116c8bc8fed9878a77431f86deaa1b2c511387df5ba24a4438737f666c1413c57f97e1e6941bfb2318b0cbdf6c00537a332693b1c93a420e90da2a02893901

Download Submit
C:\Windows\system\qHwiTdR.exe

Filesize
3.0MB

MD5
9dae8af36c16ce578af5d548e408efe2

SHA1
13652a002b63d819def3da845244ea5396737db2

SHA256
9405e586b7db64d9c52b962006c076866470214845e6d4cb05f9a30580f6c7ff

SHA512
2a3b624bc8ecf0cbe717d4a9f4b92c267796d29c17d52e8c02dd641c44cd8e530ce9ee121588b3e85a1e5aab68bb9ca084725bb57b84991eb9d09d9a856f7d7e

Download Submit
C:\Windows\system\qXzbLwk.exe

Filesize
3.0MB

MD5
90c18d0a898a2d3e912c2bf9acf1cf7b

SHA1
90ecbabaf0895fa45a466ff93655f192b6826a3b

SHA256
044ee5c0f9493b1dbf62b54482d23b65955bf46d25013d9e18916ac386c77147

SHA512
dc06d611aadd075e18e3926515d5e543fc9cc073c01064fbbcc2fc5c598155d2f366592b66f18b3f8dae152d8a793b8041b6229bd20cfc85c227120158dcb6b3

Download Submit
C:\Windows\system\skGLPhe.exe

Filesize
3.0MB

MD5
5b4578d1f56c212730b2fbe55aae0983

SHA1
5ee23ffd43fe688a079be2a693efff0a7bca054f

SHA256
b45ae2300baed030203b7268c1a99be32ed518eccf2c0f37d3f86346cc6a8856

SHA512
0a1ea63c69c4cfe71c56b56cb1c129a566772aef1599f0556a3ad4a5ead85d3fbee271e4aa07197d007cdb7425ce5527423872cc3190d937acef5a3724d2cbd1

Download Submit
C:\Windows\system\vZibEQn.exe

Filesize
3.0MB

MD5
f0c54037cfe4da9a9baf240415d7d762

SHA1
cce367b738f4fa7b190c23b5c4f4be4676fb8dc8

SHA256
0603f9e4e521f75e9a56a22fea8dbc2df7328999308fb48468278dc2dcb70567

SHA512
6eb5292e51901cdc481aae8571ad46b8deacd7cdf8f849c98c406475193e2a992a761db02d92f7f1b874925fa5896690d98591172cb9f125b645d73bd71fedb0

Download Submit
C:\Windows\system\wZCIPyr.exe

Filesize
3.0MB

MD5
a146bf3df8c116b293206fe3a7c900c7

SHA1
e49c9e31acfc049b3635df491414c45be82546c0

SHA256
53d74b5ac55079f37b28a924a8d434f24ffec8f2e9c2fd88ad73c9baebb12dc9

SHA512
e7545345d58987273fe8d94903194a75694d35e19a1f254d4d519fcb16d9a18c61d0fd0ccce2eb86c9c5fd21c3684ef385027ad89ee3b143e22b06f135161fa3

Download Submit
C:\Windows\system\xzjGeGd.exe

Filesize
3.0MB

MD5
fb2d87aab27fc62b8da8737b3654a6d4

SHA1
343d59e6a92a1169b66218609794711819a407e9

SHA256
8917686c78cb07080de1d9fd8438b6ad522654c160e60c50ddfbd456f7eee9c4

SHA512
6f04637f51e64afdc315f1bfd3f8b33c20e2aaa605af61551e3edd850305c118f58f99e0e5846c33102aca8a8e7a751da7114b863df51353e7150f389d7657f4

Download Submit
C:\Windows\system\zNerLHT.exe

Filesize
3.0MB

MD5
d210792a4689d16b2dc5472bccb6a403

SHA1
7143072e1c32b731beeed7cfd834f48ca0f9cd97

SHA256
522c5eb24343a4091d694ab2f53fdc6155e41c71f6946fb4d2c958168b2aa18e

SHA512
623afd4f7c5182ece930208526f83295bb49ffef7f6c64782f47fcdd1e7eaba90813892d04d68d619ed4d8e085163dd338898620cae69b5fcaa71ef70be17564

Download Submit
\Windows\system\HZcQyxz.exe

Filesize
3.0MB

MD5
7116fafe803e65388793f5a3efdf7cb6

SHA1
7cc4771a985ee55a3acb885d8f8b87428b7da3df

SHA256
1e47407198a94c0431ff4920db4712c2e1c6461b31eab8cf4a3eca9dd472e78f

SHA512
b28aedb6a347f65a92554104a48244c5ab83e5090522d7859eba223a16ee76b67b5b743a7f0f1da4133493f0da29d52b116c807a12e3acfd98cb3501974f01b2

Download Submit
\Windows\system\KnexswZ.exe

Filesize
3.0MB

MD5
b07ccab9a107baf953829964e0a2e061

SHA1
c3f662fb9724c9f4ca4fbce6bbd2a770ff05a550

SHA256
0d1e15aca2dd8f664e38dad6ed3c9ba7146ae0f480395007ca0d43917deef9ed

SHA512
04bb76c1d7dd4746169193a3828fcaa67a9ac17d1ba3839928fed2ab84c6bc90c9c267eab3045852d6d66bd6c0be0c6b44f44788a8926879073b082e9def480c

Download Submit
\Windows\system\Qgkpnjc.exe

Filesize
3.0MB

MD5
07451e9e59fce78a166a51628744befa

SHA1
7e04fa5b6ba2babd4197f5798b7216bd24479f42

SHA256
bdb22c86e84a10ebb6c7f97904a8c8966e41d2e279fe9fe8a6ca788896f1cb23

SHA512
ccac3871fbe17b2bb0fa27384daa5437e8b9bb1b1b7070295fb389830c3256b36711f40db47ed1633d2633bca328ed63187ddc17df84fd1af9d85b1503270964

Download Submit
\Windows\system\fIDHcNG.exe

Filesize
3.0MB

MD5
f29ec3fd1a9a37556a1a11cf3bee2f4c

SHA1
a16d850e5f4ae284d59127bb12614484acd9ba0e

SHA256
beb755c39df2d86b0bf93ff7f5c33d5c913a433f78c63ca7b90fc51139f72f7d

SHA512
94dd1b67ebe06a83b7af07fa8ffc9f106cd69c1868f8e32eb2d1166d7f83ec9865fbbdb2234a1a232f6283754c8ed00a67832ed02ea6e82003b4ad831f651dcb

Download Submit
\Windows\system\jPqJDLl.exe

Filesize
3.0MB

MD5
087927b0d48d1ac0d64dd3d2bef2bd80

SHA1
9ed40658912b3ac2963d2af4d9afcd55c397ff2c

SHA256
5c8b70fb5305457d62bbe17f09345737a0b22ac3498c248aeedaa0b0b546f9ba

SHA512
b77a1ce601a827a27f7243837bfb8acb6a496ea43f18bf18b172bcb045a8801243b75f56812515436b8b436d9a2ec1be5870dc16eaaa269b7d8110575e78c209

Download Submit
\Windows\system\kkbPucp.exe

Filesize
3.0MB

MD5
da889a558c705e070d3073bb1d21eb50

SHA1
690e73adf8bed7d19733850b4deb3aa1890e30a1

SHA256
1753bbc9887d99c3346e2add6467aa5b0c5ac3243bbf7c23b0452b32cb5fb1ea

SHA512
7106732688d13f7d9afb67143af6523376b04a50f25a911993a09178e182d44cb896ced2b91e8ea6f9490d1b85311d48960279f64d5bd35b51f2d850321cb382

Download Submit
\Windows\system\noKRZjG.exe

Filesize
3.0MB

MD5
d68a9af41ff734d372c625ae027c634c

SHA1
add8ea69294f4d646040d96e8bdacf261e6037a7

SHA256
a3bb66ab32ccef6c42a191ae86a3f17c99a0406498418ee948ec22d88cf4c13a

SHA512
e78561c0f1cf79325f8a798b2dfe35e67c5546e5f62549280223df6a49463fc5c288424292874b83d5ce5b628c2f9a0f34012aa8cb5a5679e9fdc92dd07284a2

Download Submit
\Windows\system\semKiLB.exe

Filesize
3.0MB

MD5
058e487cce624f01e663ecb427273e66

SHA1
71e422b0fc09beb0e7cfc0c2645b11da38c3ab22

SHA256
19a83a153051c61fe400e7357b5ae3f4e9e344767ea04349b4bba6998b36207f

SHA512
74854e968b4eaf0d19938267b5ee7ba5a47b4b032b52a29827bee6951904f0b9816a5409a890ce1ce3975dc0602a5ac090d107428234710b5b0032b6d9a91cab

Download Submit
memory/1232-5157-0x000000013F6F0000-0x000000013FAE6000-memory.dmp

Filesize
4.0MB

Download
memory/1232-306-0x000000013F6F0000-0x000000013FAE6000-memory.dmp

Filesize
4.0MB

Download
memory/1236-304-0x000000013F050000-0x000000013F446000-memory.dmp

Filesize
4.0MB

Download
memory/1832-5158-0x000000013F8B0000-0x000000013FCA6000-memory.dmp

Filesize
4.0MB

Download
memory/1832-310-0x000000013F8B0000-0x000000013FCA6000-memory.dmp

Filesize
4.0MB

Download
memory/1932-16-0x000000013F250000-0x000000013F646000-memory.dmp

Filesize
4.0MB

Download
memory/2472-298-0x000000013F550000-0x000000013F946000-memory.dmp

Filesize
4.0MB

Download
memory/2560-25-0x000000013FFA0000-0x0000000140396000-memory.dmp

Filesize
4.0MB

Download
memory/2576-300-0x000000013FD50000-0x0000000140146000-memory.dmp

Filesize
4.0MB

Download
memory/2592-292-0x000000013F5D0000-0x000000013F9C6000-memory.dmp

Filesize
4.0MB

Download
memory/2688-314-0x000000013F6F0000-0x000000013FAE6000-memory.dmp

Filesize
4.0MB

Download
memory/2728-295-0x000000013FE20000-0x0000000140216000-memory.dmp

Filesize
4.0MB

Download
memory/2728-5149-0x000000013FE20000-0x0000000140216000-memory.dmp

Filesize
4.0MB

Download
memory/2748-26-0x000007FEF614E000-0x000007FEF614F000-memory.dmp

Filesize
4KB

Download
memory/2748-112-0x000000001B6B0000-0x000000001B992000-memory.dmp

Filesize
2.9MB

Download
memory/2748-282-0x000007FEF5E90000-0x000007FEF682D000-memory.dmp

Filesize
9.6MB

Download
memory/2748-118-0x0000000002340000-0x0000000002348000-memory.dmp

Filesize
32KB

Download
memory/2748-319-0x000007FEF5E90000-0x000007FEF682D000-memory.dmp

Filesize
9.6MB

Download
memory/2748-315-0x000007FEF5E90000-0x000007FEF682D000-memory.dmp

Filesize
9.6MB

Download
memory/2748-281-0x000007FEF5E90000-0x000007FEF682D000-memory.dmp

Filesize
9.6MB

Download
memory/2840-290-0x000000013FCA0000-0x0000000140096000-memory.dmp

Filesize
4.0MB

Download
memory/2980-0-0x00000000000F0000-0x0000000000100000-memory.dmp

Filesize
64KB

Download
memory/2980-3724-0x00000000036F0000-0x0000000003AE6000-memory.dmp

Filesize
4.0MB

Download
memory/2980-296-0x00000000036F0000-0x0000000003AE6000-memory.dmp

Filesize
4.0MB

Download
memory/2980-303-0x000000013F050000-0x000000013F446000-memory.dmp

Filesize
4.0MB

Download
memory/2980-307-0x00000000036F0000-0x0000000003AE6000-memory.dmp

Filesize
4.0MB

Download
memory/2980-291-0x00000000036F0000-0x0000000003AE6000-memory.dmp

Filesize
4.0MB

Download
memory/2980-8-0x0000000003200000-0x00000000035F6000-memory.dmp

Filesize
4.0MB

Download
memory/2980-301-0x00000000036F0000-0x0000000003AE6000-memory.dmp

Filesize
4.0MB

Download
memory/2980-293-0x000000013FE20000-0x0000000140216000-memory.dmp

Filesize
4.0MB

Download
memory/2980-1-0x000000013F600000-0x000000013F9F6000-memory.dmp

Filesize
4.0MB

Download
memory/2980-17-0x0000000003200000-0x00000000035F6000-memory.dmp

Filesize
4.0MB

Download
memory/2980-311-0x000000013FFA0000-0x0000000140396000-memory.dmp

Filesize
4.0MB

Download
memory/2980-3133-0x000000013F600000-0x000000013F9F6000-memory.dmp

Filesize
4.0MB

Download
memory/2980-299-0x000000013FD50000-0x0000000140146000-memory.dmp

Filesize
4.0MB

Download
memory/2980-3757-0x00000000036F0000-0x0000000003AE6000-memory.dmp

Filesize
4.0MB

Download
memory/2980-3750-0x000000013F050000-0x000000013F446000-memory.dmp

Filesize
4.0MB

Download
memory/2980-3763-0x00000000036F0000-0x0000000003AE6000-memory.dmp

Filesize
4.0MB

Download
memory/2980-305-0x00000000036F0000-0x0000000003AE6000-memory.dmp

Filesize
4.0MB

Download
memory/2980-285-0x000000013FCA0000-0x0000000140096000-memory.dmp

Filesize
4.0MB

Download
memory/3036-302-0x000000013F880000-0x000000013FC76000-memory.dmp

Filesize
4.0MB

Download