xmrig | bb36ae47c3affa9c354e29d0caf95d04602ce6554f76a37ef049e6b09784f55b

Analysis

max time kernel
150s
max time network
144s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
27/05/2024, 17:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

04485595732a1c9af08b695417b8fa50_NeikiAnalytics.exe
Size

2.6MB
MD5

04485595732a1c9af08b695417b8fa50
SHA1

9f081b49ebafa00e00c1cb9151f5e1f9ee7602a3
SHA256

bb36ae47c3affa9c354e29d0caf95d04602ce6554f76a37ef049e6b09784f55b
SHA512

a413adfd9b0ee061f4d3e2837e980b2eaa9d15d9eecabc7fb914ba195218c6aa0e8939c8259c15bc57ba6b8903a3d5f9b714ad5d4cf631d85e007d38b323803e
SSDEEP

49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0IlnASEx/R2X:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2RF

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 49 IoCs

miner

resource	yara_rule
behavioral1/memory/2344-1-0x000000013F780000-0x000000013FB76000-memory.dmp	xmrig
behavioral1/files/0x0009000000014390-3.dat	xmrig
behavioral1/files/0x00080000000147ea-14.dat	xmrig
behavioral1/files/0x0007000000014825-19.dat	xmrig
behavioral1/files/0x00070000000149f5-29.dat	xmrig
behavioral1/files/0x000f000000005578-44.dat	xmrig
behavioral1/files/0x00070000000155ed-56.dat	xmrig
behavioral1/files/0x00060000000155f7-68.dat	xmrig
behavioral1/files/0x0006000000015616-77.dat	xmrig
behavioral1/files/0x0006000000015c52-89.dat	xmrig
behavioral1/files/0x0007000000014abe-91.dat	xmrig
behavioral1/memory/2472-92-0x000000013F1B0000-0x000000013F5A6000-memory.dmp	xmrig
behavioral1/files/0x0006000000015c83-133.dat	xmrig
behavioral1/files/0x0006000000015cee-152.dat	xmrig
behavioral1/files/0x0006000000015cfe-163.dat	xmrig
behavioral1/files/0x0006000000015d1a-182.dat	xmrig
behavioral1/files/0x0006000000015d0f-177.dat	xmrig
behavioral1/files/0x0006000000015d07-172.dat	xmrig
behavioral1/files/0x00090000000146b8-167.dat	xmrig
behavioral1/files/0x0006000000015cf6-157.dat	xmrig
behavioral1/files/0x0006000000015cb6-142.dat	xmrig
behavioral1/files/0x0006000000015cce-147.dat	xmrig
behavioral1/files/0x0006000000015c9f-137.dat	xmrig
behavioral1/files/0x0006000000015c6b-131.dat	xmrig
behavioral1/files/0x0006000000015c3d-129.dat	xmrig
behavioral1/memory/2432-107-0x000000013FBD0000-0x000000013FFC6000-memory.dmp	xmrig
behavioral1/memory/2688-103-0x000000013F640000-0x000000013FA36000-memory.dmp	xmrig
behavioral1/memory/2664-88-0x000000013F440000-0x000000013F836000-memory.dmp	xmrig
behavioral1/files/0x0006000000015b6f-87.dat	xmrig
behavioral1/files/0x0006000000015626-78.dat	xmrig
behavioral1/files/0x0006000000015605-69.dat	xmrig
behavioral1/files/0x00060000000155f3-60.dat	xmrig
behavioral1/files/0x0007000000014ef8-55.dat	xmrig
behavioral1/memory/1688-54-0x000000013FFB0000-0x00000001403A6000-memory.dmp	xmrig
behavioral1/files/0x0007000000015018-51.dat	xmrig
behavioral1/files/0x000a000000014de9-45.dat	xmrig
behavioral1/memory/2624-39-0x000000013F510000-0x000000013F906000-memory.dmp	xmrig
behavioral1/files/0x0006000000015c78-111.dat	xmrig
behavioral1/memory/2116-36-0x000000013F240000-0x000000013F636000-memory.dmp	xmrig
behavioral1/memory/2176-18-0x000000013F1F0000-0x000000013F5E6000-memory.dmp	xmrig
behavioral1/files/0x00090000000146a2-11.dat	xmrig
behavioral1/memory/2832-8-0x000000013FC10000-0x0000000140006000-memory.dmp	xmrig
behavioral1/memory/2344-2826-0x000000013F780000-0x000000013FB76000-memory.dmp	xmrig
behavioral1/memory/2176-3075-0x000000013F1F0000-0x000000013F5E6000-memory.dmp	xmrig
behavioral1/memory/2472-5475-0x000000013F1B0000-0x000000013F5A6000-memory.dmp	xmrig
behavioral1/memory/2116-8580-0x000000013F240000-0x000000013F636000-memory.dmp	xmrig
behavioral1/memory/2624-8586-0x000000013F510000-0x000000013F906000-memory.dmp	xmrig
behavioral1/memory/2472-8607-0x000000013F1B0000-0x000000013F5A6000-memory.dmp	xmrig
behavioral1/memory/2432-8608-0x000000013FBD0000-0x000000013FFC6000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
1680	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
2832	apRUvpM.exe
2176	Dimdfsr.exe
2116	ionVtyn.exe
1688	YGkXzet.exe
2624	LlfJdnI.exe
2688	AkjMujq.exe
2664	pCQTufG.exe
2432	rUiCRmX.exe
2472	gUVlsFU.exe
1644	eBExWos.exe
2512	prDykCl.exe
2428	KuUlFGE.exe
1528	LBBAaEZ.exe
1260	aQiFWba.exe
2524	ROGIdZn.exe
2388	UjJdeDa.exe
2496	WuCzCbz.exe
1856	RHCpyqZ.exe
2492	mmTwMwW.exe
948	kJWiKNk.exe
1352	RkLhsPo.exe
1744	qWwmVJe.exe
848	kdXYFBj.exe
2520	WoAkfii.exe
2960	ZcQOKOF.exe
2600	YojokdW.exe
1412	WHNfcVY.exe
1416	DpcBtMd.exe
1988	mvouTax.exe
1516	PDRjrOU.exe
1112	poMnWKT.exe
828	DDCsZCv.exe
2980	PkFNYfu.exe
844	FjrYduC.exe
1228	QnKYUqt.exe
1796	ONmJljH.exe
1060	OmdSMTh.exe
1764	FzbCeWy.exe
1124	JVZgwtz.exe
952	gDlirJn.exe
896	LZHQGKx.exe
2932	dVOWlRC.exe
2772	OdkChUE.exe
3068	lmqBKAg.exe
2508	nPQTDCG.exe
2040	XVlSmea.exe
1136	qcGIdlz.exe
1732	fCZUlVm.exe
880	qIzyeXk.exe
2036	WnWaGgB.exe
1980	HUbKdmB.exe
1664	AaNfRmT.exe
2744	DNprhpk.exe
2616	vEVYFof.exe
2788	qtimFAd.exe
2592	EWmPrbm.exe
2376	BFZLasf.exe
1748	FVMsiXF.exe
2640	dzSFWLI.exe
1588	MgvGmDd.exe
2784	hnmRQpz.exe
2412	bqFOEgB.exe
2756	hQZaGfZ.exe
2880	gauOquh.exe

Loads dropped DLL 64 IoCs

pid	Process
2344	04485595732a1c9af08b695417b8fa50_NeikiAnalytics.exe
2344	04485595732a1c9af08b695417b8fa50_NeikiAnalytics.exe
2344	04485595732a1c9af08b695417b8fa50_NeikiAnalytics.exe
2344	04485595732a1c9af08b695417b8fa50_NeikiAnalytics.exe
2344	04485595732a1c9af08b695417b8fa50_NeikiAnalytics.exe
2344	04485595732a1c9af08b695417b8fa50_NeikiAnalytics.exe
2344	04485595732a1c9af08b695417b8fa50_NeikiAnalytics.exe
2344	04485595732a1c9af08b695417b8fa50_NeikiAnalytics.exe
2344	04485595732a1c9af08b695417b8fa50_NeikiAnalytics.exe
2344	04485595732a1c9af08b695417b8fa50_NeikiAnalytics.exe
2344	04485595732a1c9af08b695417b8fa50_NeikiAnalytics.exe
2344	04485595732a1c9af08b695417b8fa50_NeikiAnalytics.exe
2344	04485595732a1c9af08b695417b8fa50_NeikiAnalytics.exe
2344	04485595732a1c9af08b695417b8fa50_NeikiAnalytics.exe
2344	04485595732a1c9af08b695417b8fa50_NeikiAnalytics.exe
2344	04485595732a1c9af08b695417b8fa50_NeikiAnalytics.exe
2344	04485595732a1c9af08b695417b8fa50_NeikiAnalytics.exe
2344	04485595732a1c9af08b695417b8fa50_NeikiAnalytics.exe
2344	04485595732a1c9af08b695417b8fa50_NeikiAnalytics.exe
2344	04485595732a1c9af08b695417b8fa50_NeikiAnalytics.exe
2344	04485595732a1c9af08b695417b8fa50_NeikiAnalytics.exe
2344	04485595732a1c9af08b695417b8fa50_NeikiAnalytics.exe
2344	04485595732a1c9af08b695417b8fa50_NeikiAnalytics.exe
2344	04485595732a1c9af08b695417b8fa50_NeikiAnalytics.exe
2344	04485595732a1c9af08b695417b8fa50_NeikiAnalytics.exe
2344	04485595732a1c9af08b695417b8fa50_NeikiAnalytics.exe
2344	04485595732a1c9af08b695417b8fa50_NeikiAnalytics.exe
2344	04485595732a1c9af08b695417b8fa50_NeikiAnalytics.exe
2344	04485595732a1c9af08b695417b8fa50_NeikiAnalytics.exe
2344	04485595732a1c9af08b695417b8fa50_NeikiAnalytics.exe
2344	04485595732a1c9af08b695417b8fa50_NeikiAnalytics.exe
2344	04485595732a1c9af08b695417b8fa50_NeikiAnalytics.exe
2344	04485595732a1c9af08b695417b8fa50_NeikiAnalytics.exe
2344	04485595732a1c9af08b695417b8fa50_NeikiAnalytics.exe
2344	04485595732a1c9af08b695417b8fa50_NeikiAnalytics.exe
2344	04485595732a1c9af08b695417b8fa50_NeikiAnalytics.exe
2344	04485595732a1c9af08b695417b8fa50_NeikiAnalytics.exe
2344	04485595732a1c9af08b695417b8fa50_NeikiAnalytics.exe
2344	04485595732a1c9af08b695417b8fa50_NeikiAnalytics.exe
2344	04485595732a1c9af08b695417b8fa50_NeikiAnalytics.exe
2344	04485595732a1c9af08b695417b8fa50_NeikiAnalytics.exe
2344	04485595732a1c9af08b695417b8fa50_NeikiAnalytics.exe
2344	04485595732a1c9af08b695417b8fa50_NeikiAnalytics.exe
2344	04485595732a1c9af08b695417b8fa50_NeikiAnalytics.exe
2344	04485595732a1c9af08b695417b8fa50_NeikiAnalytics.exe
2344	04485595732a1c9af08b695417b8fa50_NeikiAnalytics.exe
2344	04485595732a1c9af08b695417b8fa50_NeikiAnalytics.exe
2344	04485595732a1c9af08b695417b8fa50_NeikiAnalytics.exe
2344	04485595732a1c9af08b695417b8fa50_NeikiAnalytics.exe
2344	04485595732a1c9af08b695417b8fa50_NeikiAnalytics.exe
2344	04485595732a1c9af08b695417b8fa50_NeikiAnalytics.exe
2344	04485595732a1c9af08b695417b8fa50_NeikiAnalytics.exe
2344	04485595732a1c9af08b695417b8fa50_NeikiAnalytics.exe
2344	04485595732a1c9af08b695417b8fa50_NeikiAnalytics.exe
2344	04485595732a1c9af08b695417b8fa50_NeikiAnalytics.exe
2344	04485595732a1c9af08b695417b8fa50_NeikiAnalytics.exe
2344	04485595732a1c9af08b695417b8fa50_NeikiAnalytics.exe
2344	04485595732a1c9af08b695417b8fa50_NeikiAnalytics.exe
2344	04485595732a1c9af08b695417b8fa50_NeikiAnalytics.exe
2344	04485595732a1c9af08b695417b8fa50_NeikiAnalytics.exe
2344	04485595732a1c9af08b695417b8fa50_NeikiAnalytics.exe
2344	04485595732a1c9af08b695417b8fa50_NeikiAnalytics.exe
2344	04485595732a1c9af08b695417b8fa50_NeikiAnalytics.exe
2344	04485595732a1c9af08b695417b8fa50_NeikiAnalytics.exe

UPX packed file 49 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2344-1-0x000000013F780000-0x000000013FB76000-memory.dmp	upx
behavioral1/files/0x0009000000014390-3.dat	upx
behavioral1/files/0x00080000000147ea-14.dat	upx
behavioral1/files/0x0007000000014825-19.dat	upx
behavioral1/files/0x00070000000149f5-29.dat	upx
behavioral1/files/0x000f000000005578-44.dat	upx
behavioral1/files/0x00070000000155ed-56.dat	upx
behavioral1/files/0x00060000000155f7-68.dat	upx
behavioral1/files/0x0006000000015616-77.dat	upx
behavioral1/files/0x0006000000015c52-89.dat	upx
behavioral1/files/0x0007000000014abe-91.dat	upx
behavioral1/memory/2472-92-0x000000013F1B0000-0x000000013F5A6000-memory.dmp	upx
behavioral1/files/0x0006000000015c83-133.dat	upx
behavioral1/files/0x0006000000015cee-152.dat	upx
behavioral1/files/0x0006000000015cfe-163.dat	upx
behavioral1/files/0x0006000000015d1a-182.dat	upx
behavioral1/files/0x0006000000015d0f-177.dat	upx
behavioral1/files/0x0006000000015d07-172.dat	upx
behavioral1/files/0x00090000000146b8-167.dat	upx
behavioral1/files/0x0006000000015cf6-157.dat	upx
behavioral1/files/0x0006000000015cb6-142.dat	upx
behavioral1/files/0x0006000000015cce-147.dat	upx
behavioral1/files/0x0006000000015c9f-137.dat	upx
behavioral1/files/0x0006000000015c6b-131.dat	upx
behavioral1/files/0x0006000000015c3d-129.dat	upx
behavioral1/memory/2432-107-0x000000013FBD0000-0x000000013FFC6000-memory.dmp	upx
behavioral1/memory/2688-103-0x000000013F640000-0x000000013FA36000-memory.dmp	upx
behavioral1/memory/2664-88-0x000000013F440000-0x000000013F836000-memory.dmp	upx
behavioral1/files/0x0006000000015b6f-87.dat	upx
behavioral1/files/0x0006000000015626-78.dat	upx
behavioral1/files/0x0006000000015605-69.dat	upx
behavioral1/files/0x00060000000155f3-60.dat	upx
behavioral1/files/0x0007000000014ef8-55.dat	upx
behavioral1/memory/1688-54-0x000000013FFB0000-0x00000001403A6000-memory.dmp	upx
behavioral1/files/0x0007000000015018-51.dat	upx
behavioral1/files/0x000a000000014de9-45.dat	upx
behavioral1/memory/2624-39-0x000000013F510000-0x000000013F906000-memory.dmp	upx
behavioral1/files/0x0006000000015c78-111.dat	upx
behavioral1/memory/2116-36-0x000000013F240000-0x000000013F636000-memory.dmp	upx
behavioral1/memory/2176-18-0x000000013F1F0000-0x000000013F5E6000-memory.dmp	upx
behavioral1/files/0x00090000000146a2-11.dat	upx
behavioral1/memory/2832-8-0x000000013FC10000-0x0000000140006000-memory.dmp	upx
behavioral1/memory/2344-2826-0x000000013F780000-0x000000013FB76000-memory.dmp	upx
behavioral1/memory/2176-3075-0x000000013F1F0000-0x000000013F5E6000-memory.dmp	upx
behavioral1/memory/2472-5475-0x000000013F1B0000-0x000000013F5A6000-memory.dmp	upx
behavioral1/memory/2116-8580-0x000000013F240000-0x000000013F636000-memory.dmp	upx
behavioral1/memory/2624-8586-0x000000013F510000-0x000000013F906000-memory.dmp	upx
behavioral1/memory/2472-8607-0x000000013F1B0000-0x000000013F5A6000-memory.dmp	upx
behavioral1/memory/2432-8608-0x000000013FBD0000-0x000000013FFC6000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\PgkmEhl.exe	04485595732a1c9af08b695417b8fa50_NeikiAnalytics.exe
File created	C:\Windows\System\cPXNaEb.exe	04485595732a1c9af08b695417b8fa50_NeikiAnalytics.exe
File created	C:\Windows\System\YvpyvdM.exe	04485595732a1c9af08b695417b8fa50_NeikiAnalytics.exe
File created	C:\Windows\System\qGNdnWZ.exe	04485595732a1c9af08b695417b8fa50_NeikiAnalytics.exe
File created	C:\Windows\System\DcAhSFo.exe	04485595732a1c9af08b695417b8fa50_NeikiAnalytics.exe
File created	C:\Windows\System\RoQXWQR.exe	04485595732a1c9af08b695417b8fa50_NeikiAnalytics.exe
File created	C:\Windows\System\LjNFTIV.exe	04485595732a1c9af08b695417b8fa50_NeikiAnalytics.exe
File created	C:\Windows\System\ICAyeWi.exe	04485595732a1c9af08b695417b8fa50_NeikiAnalytics.exe
File created	C:\Windows\System\IQzgFDy.exe	04485595732a1c9af08b695417b8fa50_NeikiAnalytics.exe
File created	C:\Windows\System\AQtSoNK.exe	04485595732a1c9af08b695417b8fa50_NeikiAnalytics.exe
File created	C:\Windows\System\DhswweY.exe	04485595732a1c9af08b695417b8fa50_NeikiAnalytics.exe
File created	C:\Windows\System\WDNhPoE.exe	04485595732a1c9af08b695417b8fa50_NeikiAnalytics.exe
File created	C:\Windows\System\onVguHQ.exe	04485595732a1c9af08b695417b8fa50_NeikiAnalytics.exe
File created	C:\Windows\System\wCVJAOh.exe	04485595732a1c9af08b695417b8fa50_NeikiAnalytics.exe
File created	C:\Windows\System\lFpuIPl.exe	04485595732a1c9af08b695417b8fa50_NeikiAnalytics.exe
File created	C:\Windows\System\xNirMUd.exe	04485595732a1c9af08b695417b8fa50_NeikiAnalytics.exe
File created	C:\Windows\System\XLdGnzE.exe	04485595732a1c9af08b695417b8fa50_NeikiAnalytics.exe
File created	C:\Windows\System\KqBsNif.exe	04485595732a1c9af08b695417b8fa50_NeikiAnalytics.exe
File created	C:\Windows\System\tbKrWfS.exe	04485595732a1c9af08b695417b8fa50_NeikiAnalytics.exe
File created	C:\Windows\System\XDrsweG.exe	04485595732a1c9af08b695417b8fa50_NeikiAnalytics.exe
File created	C:\Windows\System\ZfUwrdD.exe	04485595732a1c9af08b695417b8fa50_NeikiAnalytics.exe
File created	C:\Windows\System\IvTfFuY.exe	04485595732a1c9af08b695417b8fa50_NeikiAnalytics.exe
File created	C:\Windows\System\yschxXU.exe	04485595732a1c9af08b695417b8fa50_NeikiAnalytics.exe
File created	C:\Windows\System\XNkmnDx.exe	04485595732a1c9af08b695417b8fa50_NeikiAnalytics.exe
File created	C:\Windows\System\MaXJJir.exe	04485595732a1c9af08b695417b8fa50_NeikiAnalytics.exe
File created	C:\Windows\System\LDRmszS.exe	04485595732a1c9af08b695417b8fa50_NeikiAnalytics.exe
File created	C:\Windows\System\KXnybfI.exe	04485595732a1c9af08b695417b8fa50_NeikiAnalytics.exe
File created	C:\Windows\System\JwsnAcg.exe	04485595732a1c9af08b695417b8fa50_NeikiAnalytics.exe
File created	C:\Windows\System\fbmLAbQ.exe	04485595732a1c9af08b695417b8fa50_NeikiAnalytics.exe
File created	C:\Windows\System\TvHPmNL.exe	04485595732a1c9af08b695417b8fa50_NeikiAnalytics.exe
File created	C:\Windows\System\AQcKpXV.exe	04485595732a1c9af08b695417b8fa50_NeikiAnalytics.exe
File created	C:\Windows\System\WGkRqxL.exe	04485595732a1c9af08b695417b8fa50_NeikiAnalytics.exe
File created	C:\Windows\System\nWPOegP.exe	04485595732a1c9af08b695417b8fa50_NeikiAnalytics.exe
File created	C:\Windows\System\qQbxWXn.exe	04485595732a1c9af08b695417b8fa50_NeikiAnalytics.exe
File created	C:\Windows\System\qWwmVJe.exe	04485595732a1c9af08b695417b8fa50_NeikiAnalytics.exe
File created	C:\Windows\System\QBBXfmW.exe	04485595732a1c9af08b695417b8fa50_NeikiAnalytics.exe
File created	C:\Windows\System\RSPBxXB.exe	04485595732a1c9af08b695417b8fa50_NeikiAnalytics.exe
File created	C:\Windows\System\bUKwQRs.exe	04485595732a1c9af08b695417b8fa50_NeikiAnalytics.exe
File created	C:\Windows\System\GkUTPBc.exe	04485595732a1c9af08b695417b8fa50_NeikiAnalytics.exe
File created	C:\Windows\System\YmggsYa.exe	04485595732a1c9af08b695417b8fa50_NeikiAnalytics.exe
File created	C:\Windows\System\IsOWGfn.exe	04485595732a1c9af08b695417b8fa50_NeikiAnalytics.exe
File created	C:\Windows\System\HaxfXqg.exe	04485595732a1c9af08b695417b8fa50_NeikiAnalytics.exe
File created	C:\Windows\System\BQftznW.exe	04485595732a1c9af08b695417b8fa50_NeikiAnalytics.exe
File created	C:\Windows\System\BDwEqrg.exe	04485595732a1c9af08b695417b8fa50_NeikiAnalytics.exe
File created	C:\Windows\System\oUAluym.exe	04485595732a1c9af08b695417b8fa50_NeikiAnalytics.exe
File created	C:\Windows\System\iOJMmRH.exe	04485595732a1c9af08b695417b8fa50_NeikiAnalytics.exe
File created	C:\Windows\System\jKffrUQ.exe	04485595732a1c9af08b695417b8fa50_NeikiAnalytics.exe
File created	C:\Windows\System\qLPBqcZ.exe	04485595732a1c9af08b695417b8fa50_NeikiAnalytics.exe
File created	C:\Windows\System\lKCzqMo.exe	04485595732a1c9af08b695417b8fa50_NeikiAnalytics.exe
File created	C:\Windows\System\PbMWjjx.exe	04485595732a1c9af08b695417b8fa50_NeikiAnalytics.exe
File created	C:\Windows\System\oMbXhgD.exe	04485595732a1c9af08b695417b8fa50_NeikiAnalytics.exe
File created	C:\Windows\System\RmezvPK.exe	04485595732a1c9af08b695417b8fa50_NeikiAnalytics.exe
File created	C:\Windows\System\WhXUjKj.exe	04485595732a1c9af08b695417b8fa50_NeikiAnalytics.exe
File created	C:\Windows\System\floDFjN.exe	04485595732a1c9af08b695417b8fa50_NeikiAnalytics.exe
File created	C:\Windows\System\LTZxeHE.exe	04485595732a1c9af08b695417b8fa50_NeikiAnalytics.exe
File created	C:\Windows\System\DxtxVap.exe	04485595732a1c9af08b695417b8fa50_NeikiAnalytics.exe
File created	C:\Windows\System\RGPWOiU.exe	04485595732a1c9af08b695417b8fa50_NeikiAnalytics.exe
File created	C:\Windows\System\JAaJBUj.exe	04485595732a1c9af08b695417b8fa50_NeikiAnalytics.exe
File created	C:\Windows\System\MbQsayG.exe	04485595732a1c9af08b695417b8fa50_NeikiAnalytics.exe
File created	C:\Windows\System\evSPQWT.exe	04485595732a1c9af08b695417b8fa50_NeikiAnalytics.exe
File created	C:\Windows\System\dQVnzYD.exe	04485595732a1c9af08b695417b8fa50_NeikiAnalytics.exe
File created	C:\Windows\System\JMSdwho.exe	04485595732a1c9af08b695417b8fa50_NeikiAnalytics.exe
File created	C:\Windows\System\hhybvxG.exe	04485595732a1c9af08b695417b8fa50_NeikiAnalytics.exe
File created	C:\Windows\System\hGdFJZZ.exe	04485595732a1c9af08b695417b8fa50_NeikiAnalytics.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1680	powershell.exe
1680	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2344	04485595732a1c9af08b695417b8fa50_NeikiAnalytics.exe
Token: SeLockMemoryPrivilege	2344	04485595732a1c9af08b695417b8fa50_NeikiAnalytics.exe
Token: SeDebugPrivilege	1680	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2344 wrote to memory of 1680	2344	04485595732a1c9af08b695417b8fa50_NeikiAnalytics.exe	29
PID 2344 wrote to memory of 1680	2344	04485595732a1c9af08b695417b8fa50_NeikiAnalytics.exe	29
PID 2344 wrote to memory of 1680	2344	04485595732a1c9af08b695417b8fa50_NeikiAnalytics.exe	29
PID 2344 wrote to memory of 2832	2344	04485595732a1c9af08b695417b8fa50_NeikiAnalytics.exe	30
PID 2344 wrote to memory of 2832	2344	04485595732a1c9af08b695417b8fa50_NeikiAnalytics.exe	30
PID 2344 wrote to memory of 2832	2344	04485595732a1c9af08b695417b8fa50_NeikiAnalytics.exe	30
PID 2344 wrote to memory of 2176	2344	04485595732a1c9af08b695417b8fa50_NeikiAnalytics.exe	31
PID 2344 wrote to memory of 2176	2344	04485595732a1c9af08b695417b8fa50_NeikiAnalytics.exe	31
PID 2344 wrote to memory of 2176	2344	04485595732a1c9af08b695417b8fa50_NeikiAnalytics.exe	31
PID 2344 wrote to memory of 1688	2344	04485595732a1c9af08b695417b8fa50_NeikiAnalytics.exe	32
PID 2344 wrote to memory of 1688	2344	04485595732a1c9af08b695417b8fa50_NeikiAnalytics.exe	32
PID 2344 wrote to memory of 1688	2344	04485595732a1c9af08b695417b8fa50_NeikiAnalytics.exe	32
PID 2344 wrote to memory of 2116	2344	04485595732a1c9af08b695417b8fa50_NeikiAnalytics.exe	33
PID 2344 wrote to memory of 2116	2344	04485595732a1c9af08b695417b8fa50_NeikiAnalytics.exe	33
PID 2344 wrote to memory of 2116	2344	04485595732a1c9af08b695417b8fa50_NeikiAnalytics.exe	33
PID 2344 wrote to memory of 2624	2344	04485595732a1c9af08b695417b8fa50_NeikiAnalytics.exe	34
PID 2344 wrote to memory of 2624	2344	04485595732a1c9af08b695417b8fa50_NeikiAnalytics.exe	34
PID 2344 wrote to memory of 2624	2344	04485595732a1c9af08b695417b8fa50_NeikiAnalytics.exe	34
PID 2344 wrote to memory of 2428	2344	04485595732a1c9af08b695417b8fa50_NeikiAnalytics.exe	35
PID 2344 wrote to memory of 2428	2344	04485595732a1c9af08b695417b8fa50_NeikiAnalytics.exe	35
PID 2344 wrote to memory of 2428	2344	04485595732a1c9af08b695417b8fa50_NeikiAnalytics.exe	35
PID 2344 wrote to memory of 2688	2344	04485595732a1c9af08b695417b8fa50_NeikiAnalytics.exe	36
PID 2344 wrote to memory of 2688	2344	04485595732a1c9af08b695417b8fa50_NeikiAnalytics.exe	36
PID 2344 wrote to memory of 2688	2344	04485595732a1c9af08b695417b8fa50_NeikiAnalytics.exe	36
PID 2344 wrote to memory of 2524	2344	04485595732a1c9af08b695417b8fa50_NeikiAnalytics.exe	37
PID 2344 wrote to memory of 2524	2344	04485595732a1c9af08b695417b8fa50_NeikiAnalytics.exe	37
PID 2344 wrote to memory of 2524	2344	04485595732a1c9af08b695417b8fa50_NeikiAnalytics.exe	37
PID 2344 wrote to memory of 2664	2344	04485595732a1c9af08b695417b8fa50_NeikiAnalytics.exe	38
PID 2344 wrote to memory of 2664	2344	04485595732a1c9af08b695417b8fa50_NeikiAnalytics.exe	38
PID 2344 wrote to memory of 2664	2344	04485595732a1c9af08b695417b8fa50_NeikiAnalytics.exe	38
PID 2344 wrote to memory of 2388	2344	04485595732a1c9af08b695417b8fa50_NeikiAnalytics.exe	39
PID 2344 wrote to memory of 2388	2344	04485595732a1c9af08b695417b8fa50_NeikiAnalytics.exe	39
PID 2344 wrote to memory of 2388	2344	04485595732a1c9af08b695417b8fa50_NeikiAnalytics.exe	39
PID 2344 wrote to memory of 2432	2344	04485595732a1c9af08b695417b8fa50_NeikiAnalytics.exe	40
PID 2344 wrote to memory of 2432	2344	04485595732a1c9af08b695417b8fa50_NeikiAnalytics.exe	40
PID 2344 wrote to memory of 2432	2344	04485595732a1c9af08b695417b8fa50_NeikiAnalytics.exe	40
PID 2344 wrote to memory of 2496	2344	04485595732a1c9af08b695417b8fa50_NeikiAnalytics.exe	41
PID 2344 wrote to memory of 2496	2344	04485595732a1c9af08b695417b8fa50_NeikiAnalytics.exe	41
PID 2344 wrote to memory of 2496	2344	04485595732a1c9af08b695417b8fa50_NeikiAnalytics.exe	41
PID 2344 wrote to memory of 2472	2344	04485595732a1c9af08b695417b8fa50_NeikiAnalytics.exe	42
PID 2344 wrote to memory of 2472	2344	04485595732a1c9af08b695417b8fa50_NeikiAnalytics.exe	42
PID 2344 wrote to memory of 2472	2344	04485595732a1c9af08b695417b8fa50_NeikiAnalytics.exe	42
PID 2344 wrote to memory of 1856	2344	04485595732a1c9af08b695417b8fa50_NeikiAnalytics.exe	43
PID 2344 wrote to memory of 1856	2344	04485595732a1c9af08b695417b8fa50_NeikiAnalytics.exe	43
PID 2344 wrote to memory of 1856	2344	04485595732a1c9af08b695417b8fa50_NeikiAnalytics.exe	43
PID 2344 wrote to memory of 1644	2344	04485595732a1c9af08b695417b8fa50_NeikiAnalytics.exe	44
PID 2344 wrote to memory of 1644	2344	04485595732a1c9af08b695417b8fa50_NeikiAnalytics.exe	44
PID 2344 wrote to memory of 1644	2344	04485595732a1c9af08b695417b8fa50_NeikiAnalytics.exe	44
PID 2344 wrote to memory of 2492	2344	04485595732a1c9af08b695417b8fa50_NeikiAnalytics.exe	45
PID 2344 wrote to memory of 2492	2344	04485595732a1c9af08b695417b8fa50_NeikiAnalytics.exe	45
PID 2344 wrote to memory of 2492	2344	04485595732a1c9af08b695417b8fa50_NeikiAnalytics.exe	45
PID 2344 wrote to memory of 2512	2344	04485595732a1c9af08b695417b8fa50_NeikiAnalytics.exe	46
PID 2344 wrote to memory of 2512	2344	04485595732a1c9af08b695417b8fa50_NeikiAnalytics.exe	46
PID 2344 wrote to memory of 2512	2344	04485595732a1c9af08b695417b8fa50_NeikiAnalytics.exe	46
PID 2344 wrote to memory of 948	2344	04485595732a1c9af08b695417b8fa50_NeikiAnalytics.exe	47
PID 2344 wrote to memory of 948	2344	04485595732a1c9af08b695417b8fa50_NeikiAnalytics.exe	47
PID 2344 wrote to memory of 948	2344	04485595732a1c9af08b695417b8fa50_NeikiAnalytics.exe	47
PID 2344 wrote to memory of 1528	2344	04485595732a1c9af08b695417b8fa50_NeikiAnalytics.exe	48
PID 2344 wrote to memory of 1528	2344	04485595732a1c9af08b695417b8fa50_NeikiAnalytics.exe	48
PID 2344 wrote to memory of 1528	2344	04485595732a1c9af08b695417b8fa50_NeikiAnalytics.exe	48
PID 2344 wrote to memory of 1352	2344	04485595732a1c9af08b695417b8fa50_NeikiAnalytics.exe	49
PID 2344 wrote to memory of 1352	2344	04485595732a1c9af08b695417b8fa50_NeikiAnalytics.exe	49
PID 2344 wrote to memory of 1352	2344	04485595732a1c9af08b695417b8fa50_NeikiAnalytics.exe	49
PID 2344 wrote to memory of 1260	2344	04485595732a1c9af08b695417b8fa50_NeikiAnalytics.exe	50

C:\Users\Admin\AppData\Local\Temp\04485595732a1c9af08b695417b8fa50_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\04485595732a1c9af08b695417b8fa50_NeikiAnalytics.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2344
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1680
- C:\Windows\System\apRUvpM.exe
  C:\Windows\System\apRUvpM.exe
  2⤵
  - Executes dropped EXE
  PID:2832
- C:\Windows\System\Dimdfsr.exe
  C:\Windows\System\Dimdfsr.exe
  2⤵
  - Executes dropped EXE
  PID:2176
- C:\Windows\System\YGkXzet.exe
  C:\Windows\System\YGkXzet.exe
  2⤵
  - Executes dropped EXE
  PID:1688
- C:\Windows\System\ionVtyn.exe
  C:\Windows\System\ionVtyn.exe
  2⤵
  - Executes dropped EXE
  PID:2116
- C:\Windows\System\LlfJdnI.exe
  C:\Windows\System\LlfJdnI.exe
  2⤵
  - Executes dropped EXE
  PID:2624
- C:\Windows\System\KuUlFGE.exe
  C:\Windows\System\KuUlFGE.exe
  2⤵
  - Executes dropped EXE
  PID:2428
- C:\Windows\System\AkjMujq.exe
  C:\Windows\System\AkjMujq.exe
  2⤵
  - Executes dropped EXE
  PID:2688
- C:\Windows\System\ROGIdZn.exe
  C:\Windows\System\ROGIdZn.exe
  2⤵
  - Executes dropped EXE
  PID:2524
- C:\Windows\System\pCQTufG.exe
  C:\Windows\System\pCQTufG.exe
  2⤵
  - Executes dropped EXE
  PID:2664
- C:\Windows\System\UjJdeDa.exe
  C:\Windows\System\UjJdeDa.exe
  2⤵
  - Executes dropped EXE
  PID:2388
- C:\Windows\System\rUiCRmX.exe
  C:\Windows\System\rUiCRmX.exe
  2⤵
  - Executes dropped EXE
  PID:2432
- C:\Windows\System\WuCzCbz.exe
  C:\Windows\System\WuCzCbz.exe
  2⤵
  - Executes dropped EXE
  PID:2496
- C:\Windows\System\gUVlsFU.exe
  C:\Windows\System\gUVlsFU.exe
  2⤵
  - Executes dropped EXE
  PID:2472
- C:\Windows\System\RHCpyqZ.exe
  C:\Windows\System\RHCpyqZ.exe
  2⤵
  - Executes dropped EXE
  PID:1856
- C:\Windows\System\eBExWos.exe
  C:\Windows\System\eBExWos.exe
  2⤵
  - Executes dropped EXE
  PID:1644
- C:\Windows\System\mmTwMwW.exe
  C:\Windows\System\mmTwMwW.exe
  2⤵
  - Executes dropped EXE
  PID:2492
- C:\Windows\System\prDykCl.exe
  C:\Windows\System\prDykCl.exe
  2⤵
  - Executes dropped EXE
  PID:2512
- C:\Windows\System\kJWiKNk.exe
  C:\Windows\System\kJWiKNk.exe
  2⤵
  - Executes dropped EXE
  PID:948
- C:\Windows\System\LBBAaEZ.exe
  C:\Windows\System\LBBAaEZ.exe
  2⤵
  - Executes dropped EXE
  PID:1528
- C:\Windows\System\RkLhsPo.exe
  C:\Windows\System\RkLhsPo.exe
  2⤵
  - Executes dropped EXE
  PID:1352
- C:\Windows\System\aQiFWba.exe
  C:\Windows\System\aQiFWba.exe
  2⤵
  - Executes dropped EXE
  PID:1260
- C:\Windows\System\qWwmVJe.exe
  C:\Windows\System\qWwmVJe.exe
  2⤵
  - Executes dropped EXE
  PID:1744
- C:\Windows\System\kdXYFBj.exe
  C:\Windows\System\kdXYFBj.exe
  2⤵
  - Executes dropped EXE
  PID:848
- C:\Windows\System\WoAkfii.exe
  C:\Windows\System\WoAkfii.exe
  2⤵
  - Executes dropped EXE
  PID:2520
- C:\Windows\System\ZcQOKOF.exe
  C:\Windows\System\ZcQOKOF.exe
  2⤵
  - Executes dropped EXE
  PID:2960
- C:\Windows\System\YojokdW.exe
  C:\Windows\System\YojokdW.exe
  2⤵
  - Executes dropped EXE
  PID:2600
- C:\Windows\System\WHNfcVY.exe
  C:\Windows\System\WHNfcVY.exe
  2⤵
  - Executes dropped EXE
  PID:1412
- C:\Windows\System\DpcBtMd.exe
  C:\Windows\System\DpcBtMd.exe
  2⤵
  - Executes dropped EXE
  PID:1416
- C:\Windows\System\mvouTax.exe
  C:\Windows\System\mvouTax.exe
  2⤵
  - Executes dropped EXE
  PID:1988
- C:\Windows\System\PDRjrOU.exe
  C:\Windows\System\PDRjrOU.exe
  2⤵
  - Executes dropped EXE
  PID:1516
- C:\Windows\System\poMnWKT.exe
  C:\Windows\System\poMnWKT.exe
  2⤵
  - Executes dropped EXE
  PID:1112
- C:\Windows\System\DDCsZCv.exe
  C:\Windows\System\DDCsZCv.exe
  2⤵
  - Executes dropped EXE
  PID:828
- C:\Windows\System\PkFNYfu.exe
  C:\Windows\System\PkFNYfu.exe
  2⤵
  - Executes dropped EXE
  PID:2980
- C:\Windows\System\FjrYduC.exe
  C:\Windows\System\FjrYduC.exe
  2⤵
  - Executes dropped EXE
  PID:844
- C:\Windows\System\QnKYUqt.exe
  C:\Windows\System\QnKYUqt.exe
  2⤵
  - Executes dropped EXE
  PID:1228
- C:\Windows\System\ONmJljH.exe
  C:\Windows\System\ONmJljH.exe
  2⤵
  - Executes dropped EXE
  PID:1796
- C:\Windows\System\OmdSMTh.exe
  C:\Windows\System\OmdSMTh.exe
  2⤵
  - Executes dropped EXE
  PID:1060
- C:\Windows\System\FzbCeWy.exe
  C:\Windows\System\FzbCeWy.exe
  2⤵
  - Executes dropped EXE
  PID:1764
- C:\Windows\System\JVZgwtz.exe
  C:\Windows\System\JVZgwtz.exe
  2⤵
  - Executes dropped EXE
  PID:1124
- C:\Windows\System\gDlirJn.exe
  C:\Windows\System\gDlirJn.exe
  2⤵
  - Executes dropped EXE
  PID:952
- C:\Windows\System\LZHQGKx.exe
  C:\Windows\System\LZHQGKx.exe
  2⤵
  - Executes dropped EXE
  PID:896
- C:\Windows\System\dVOWlRC.exe
  C:\Windows\System\dVOWlRC.exe
  2⤵
  - Executes dropped EXE
  PID:2932
- C:\Windows\System\OdkChUE.exe
  C:\Windows\System\OdkChUE.exe
  2⤵
  - Executes dropped EXE
  PID:2772
- C:\Windows\System\lmqBKAg.exe
  C:\Windows\System\lmqBKAg.exe
  2⤵
  - Executes dropped EXE
  PID:3068
- C:\Windows\System\nPQTDCG.exe
  C:\Windows\System\nPQTDCG.exe
  2⤵
  - Executes dropped EXE
  PID:2508
- C:\Windows\System\XVlSmea.exe
  C:\Windows\System\XVlSmea.exe
  2⤵
  - Executes dropped EXE
  PID:2040
- C:\Windows\System\qcGIdlz.exe
  C:\Windows\System\qcGIdlz.exe
  2⤵
  - Executes dropped EXE
  PID:1136
- C:\Windows\System\qIzyeXk.exe
  C:\Windows\System\qIzyeXk.exe
  2⤵
  - Executes dropped EXE
  PID:880
- C:\Windows\System\fCZUlVm.exe
  C:\Windows\System\fCZUlVm.exe
  2⤵
  - Executes dropped EXE
  PID:1732
- C:\Windows\System\WnWaGgB.exe
  C:\Windows\System\WnWaGgB.exe
  2⤵
  - Executes dropped EXE
  PID:2036
- C:\Windows\System\HUbKdmB.exe
  C:\Windows\System\HUbKdmB.exe
  2⤵
  - Executes dropped EXE
  PID:1980
- C:\Windows\System\AaNfRmT.exe
  C:\Windows\System\AaNfRmT.exe
  2⤵
  - Executes dropped EXE
  PID:1664
- C:\Windows\System\DNprhpk.exe
  C:\Windows\System\DNprhpk.exe
  2⤵
  - Executes dropped EXE
  PID:2744
- C:\Windows\System\vEVYFof.exe
  C:\Windows\System\vEVYFof.exe
  2⤵
  - Executes dropped EXE
  PID:2616
- C:\Windows\System\qtimFAd.exe
  C:\Windows\System\qtimFAd.exe
  2⤵
  - Executes dropped EXE
  PID:2788
- C:\Windows\System\EWmPrbm.exe
  C:\Windows\System\EWmPrbm.exe
  2⤵
  - Executes dropped EXE
  PID:2592
- C:\Windows\System\BFZLasf.exe
  C:\Windows\System\BFZLasf.exe
  2⤵
  - Executes dropped EXE
  PID:2376
- C:\Windows\System\FVMsiXF.exe
  C:\Windows\System\FVMsiXF.exe
  2⤵
  - Executes dropped EXE
  PID:1748
- C:\Windows\System\dzSFWLI.exe
  C:\Windows\System\dzSFWLI.exe
  2⤵
  - Executes dropped EXE
  PID:2640
- C:\Windows\System\MgvGmDd.exe
  C:\Windows\System\MgvGmDd.exe
  2⤵
  - Executes dropped EXE
  PID:1588
- C:\Windows\System\hnmRQpz.exe
  C:\Windows\System\hnmRQpz.exe
  2⤵
  - Executes dropped EXE
  PID:2784
- C:\Windows\System\hQZaGfZ.exe
  C:\Windows\System\hQZaGfZ.exe
  2⤵
  - Executes dropped EXE
  PID:2756
- C:\Windows\System\bqFOEgB.exe
  C:\Windows\System\bqFOEgB.exe
  2⤵
  - Executes dropped EXE
  PID:2412
- C:\Windows\System\gauOquh.exe
  C:\Windows\System\gauOquh.exe
  2⤵
  - Executes dropped EXE
  PID:2880
- C:\Windows\System\kyetCLz.exe
  C:\Windows\System\kyetCLz.exe
  2⤵
  PID:1452
- C:\Windows\System\oPihQMc.exe
  C:\Windows\System\oPihQMc.exe
  2⤵
  PID:792
- C:\Windows\System\AflmlmA.exe
  C:\Windows\System\AflmlmA.exe
  2⤵
  PID:1968
- C:\Windows\System\XeGFCWB.exe
  C:\Windows\System\XeGFCWB.exe
  2⤵
  PID:1244
- C:\Windows\System\pgpZMzM.exe
  C:\Windows\System\pgpZMzM.exe
  2⤵
  PID:2348
- C:\Windows\System\FlfuCLL.exe
  C:\Windows\System\FlfuCLL.exe
  2⤵
  PID:2208
- C:\Windows\System\xoUPJcx.exe
  C:\Windows\System\xoUPJcx.exe
  2⤵
  PID:1872
- C:\Windows\System\mEgQdzA.exe
  C:\Windows\System\mEgQdzA.exe
  2⤵
  PID:1952
- C:\Windows\System\upnGvwz.exe
  C:\Windows\System\upnGvwz.exe
  2⤵
  PID:1292
- C:\Windows\System\fDfCPQJ.exe
  C:\Windows\System\fDfCPQJ.exe
  2⤵
  PID:2264
- C:\Windows\System\FArugKq.exe
  C:\Windows\System\FArugKq.exe
  2⤵
  PID:1540
- C:\Windows\System\ftENCOS.exe
  C:\Windows\System\ftENCOS.exe
  2⤵
  PID:1240
- C:\Windows\System\QRhQDfv.exe
  C:\Windows\System\QRhQDfv.exe
  2⤵
  PID:604
- C:\Windows\System\yrqDXxq.exe
  C:\Windows\System\yrqDXxq.exe
  2⤵
  PID:1420
- C:\Windows\System\lQMsyyj.exe
  C:\Windows\System\lQMsyyj.exe
  2⤵
  PID:2228
- C:\Windows\System\UVzXWoV.exe
  C:\Windows\System\UVzXWoV.exe
  2⤵
  PID:2504
- C:\Windows\System\UKzglbH.exe
  C:\Windows\System\UKzglbH.exe
  2⤵
  PID:2952
- C:\Windows\System\DEdelqY.exe
  C:\Windows\System\DEdelqY.exe
  2⤵
  PID:1724
- C:\Windows\System\GkkQwbd.exe
  C:\Windows\System\GkkQwbd.exe
  2⤵
  PID:2968
- C:\Windows\System\BlmIhAj.exe
  C:\Windows\System\BlmIhAj.exe
  2⤵
  PID:2852
- C:\Windows\System\JheLiXd.exe
  C:\Windows\System\JheLiXd.exe
  2⤵
  PID:2992
- C:\Windows\System\mymUbMY.exe
  C:\Windows\System\mymUbMY.exe
  2⤵
  PID:2548
- C:\Windows\System\AGDEvmS.exe
  C:\Windows\System\AGDEvmS.exe
  2⤵
  PID:2580
- C:\Windows\System\QFJsclX.exe
  C:\Windows\System\QFJsclX.exe
  2⤵
  PID:1584
- C:\Windows\System\ZZufFfK.exe
  C:\Windows\System\ZZufFfK.exe
  2⤵
  PID:2480
- C:\Windows\System\FbZBgMS.exe
  C:\Windows\System\FbZBgMS.exe
  2⤵
  PID:2712
- C:\Windows\System\fjOzWHz.exe
  C:\Windows\System\fjOzWHz.exe
  2⤵
  PID:2732
- C:\Windows\System\WjRMEWY.exe
  C:\Windows\System\WjRMEWY.exe
  2⤵
  PID:1668
- C:\Windows\System\XDzlxyQ.exe
  C:\Windows\System\XDzlxyQ.exe
  2⤵
  PID:2312
- C:\Windows\System\utNQgdU.exe
  C:\Windows\System\utNQgdU.exe
  2⤵
  PID:3084
- C:\Windows\System\CMTeHER.exe
  C:\Windows\System\CMTeHER.exe
  2⤵
  PID:3104
- C:\Windows\System\VRsiRKB.exe
  C:\Windows\System\VRsiRKB.exe
  2⤵
  PID:3128
- C:\Windows\System\ihRxBOp.exe
  C:\Windows\System\ihRxBOp.exe
  2⤵
  PID:3148
- C:\Windows\System\PomIQXA.exe
  C:\Windows\System\PomIQXA.exe
  2⤵
  PID:3164
- C:\Windows\System\RpTnjyt.exe
  C:\Windows\System\RpTnjyt.exe
  2⤵
  PID:3184
- C:\Windows\System\TTHEcjK.exe
  C:\Windows\System\TTHEcjK.exe
  2⤵
  PID:3200
- C:\Windows\System\fbBlgNR.exe
  C:\Windows\System\fbBlgNR.exe
  2⤵
  PID:3224
- C:\Windows\System\YeRLwjh.exe
  C:\Windows\System\YeRLwjh.exe
  2⤵
  PID:3240
- C:\Windows\System\Ntrcbkc.exe
  C:\Windows\System\Ntrcbkc.exe
  2⤵
  PID:3260
- C:\Windows\System\uirbJry.exe
  C:\Windows\System\uirbJry.exe
  2⤵
  PID:3280
- C:\Windows\System\TGHxWmk.exe
  C:\Windows\System\TGHxWmk.exe
  2⤵
  PID:3308
- C:\Windows\System\OXaOGJn.exe
  C:\Windows\System\OXaOGJn.exe
  2⤵
  PID:3332
- C:\Windows\System\ksrAUTi.exe
  C:\Windows\System\ksrAUTi.exe
  2⤵
  PID:3348
- C:\Windows\System\pDFEaMI.exe
  C:\Windows\System\pDFEaMI.exe
  2⤵
  PID:3364
- C:\Windows\System\BAgwNpu.exe
  C:\Windows\System\BAgwNpu.exe
  2⤵
  PID:3384
- C:\Windows\System\GiaWDfo.exe
  C:\Windows\System\GiaWDfo.exe
  2⤵
  PID:3408
- C:\Windows\System\duqadfn.exe
  C:\Windows\System\duqadfn.exe
  2⤵
  PID:3432
- C:\Windows\System\DFFYpyS.exe
  C:\Windows\System\DFFYpyS.exe
  2⤵
  PID:3452
- C:\Windows\System\rnXVHOg.exe
  C:\Windows\System\rnXVHOg.exe
  2⤵
  PID:3472
- C:\Windows\System\GyoanfW.exe
  C:\Windows\System\GyoanfW.exe
  2⤵
  PID:3492
- C:\Windows\System\gjhvRfS.exe
  C:\Windows\System\gjhvRfS.exe
  2⤵
  PID:3508
- C:\Windows\System\ciTqTeP.exe
  C:\Windows\System\ciTqTeP.exe
  2⤵
  PID:3532
- C:\Windows\System\pomHtDR.exe
  C:\Windows\System\pomHtDR.exe
  2⤵
  PID:3548
- C:\Windows\System\fLaOZER.exe
  C:\Windows\System\fLaOZER.exe
  2⤵
  PID:3568
- C:\Windows\System\MLbHrUC.exe
  C:\Windows\System\MLbHrUC.exe
  2⤵
  PID:3588
- C:\Windows\System\IrvDTPr.exe
  C:\Windows\System\IrvDTPr.exe
  2⤵
  PID:3604
- C:\Windows\System\jwMtdsq.exe
  C:\Windows\System\jwMtdsq.exe
  2⤵
  PID:3620
- C:\Windows\System\trrkjxQ.exe
  C:\Windows\System\trrkjxQ.exe
  2⤵
  PID:3636
- C:\Windows\System\WWJcEJu.exe
  C:\Windows\System\WWJcEJu.exe
  2⤵
  PID:3652
- C:\Windows\System\tOxzYAl.exe
  C:\Windows\System\tOxzYAl.exe
  2⤵
  PID:3668
- C:\Windows\System\IfFwsuC.exe
  C:\Windows\System\IfFwsuC.exe
  2⤵
  PID:3696
- C:\Windows\System\mTxoFEM.exe
  C:\Windows\System\mTxoFEM.exe
  2⤵
  PID:3716
- C:\Windows\System\ERnJqqb.exe
  C:\Windows\System\ERnJqqb.exe
  2⤵
  PID:3736
- C:\Windows\System\dVSHnNW.exe
  C:\Windows\System\dVSHnNW.exe
  2⤵
  PID:3756
- C:\Windows\System\rOpZQmF.exe
  C:\Windows\System\rOpZQmF.exe
  2⤵
  PID:3792
- C:\Windows\System\zfFiVTm.exe
  C:\Windows\System\zfFiVTm.exe
  2⤵
  PID:3812
- C:\Windows\System\ORjSzMF.exe
  C:\Windows\System\ORjSzMF.exe
  2⤵
  PID:3832
- C:\Windows\System\MHyAqmM.exe
  C:\Windows\System\MHyAqmM.exe
  2⤵
  PID:3848
- C:\Windows\System\JvuGUAT.exe
  C:\Windows\System\JvuGUAT.exe
  2⤵
  PID:3868
- C:\Windows\System\omIjGEK.exe
  C:\Windows\System\omIjGEK.exe
  2⤵
  PID:3892
- C:\Windows\System\UpKckyc.exe
  C:\Windows\System\UpKckyc.exe
  2⤵
  PID:3908
- C:\Windows\System\xTCGlKf.exe
  C:\Windows\System\xTCGlKf.exe
  2⤵
  PID:3924
- C:\Windows\System\MbkkzGw.exe
  C:\Windows\System\MbkkzGw.exe
  2⤵
  PID:3940
- C:\Windows\System\grgZsnR.exe
  C:\Windows\System\grgZsnR.exe
  2⤵
  PID:3964
- C:\Windows\System\bdADgQj.exe
  C:\Windows\System\bdADgQj.exe
  2⤵
  PID:3984
- C:\Windows\System\FnXChkA.exe
  C:\Windows\System\FnXChkA.exe
  2⤵
  PID:4008
- C:\Windows\System\COtNvcg.exe
  C:\Windows\System\COtNvcg.exe
  2⤵
  PID:4024
- C:\Windows\System\MCYpHYm.exe
  C:\Windows\System\MCYpHYm.exe
  2⤵
  PID:4044
- C:\Windows\System\oqjFEIW.exe
  C:\Windows\System\oqjFEIW.exe
  2⤵
  PID:4072
- C:\Windows\System\ENiIeJr.exe
  C:\Windows\System\ENiIeJr.exe
  2⤵
  PID:4088
- C:\Windows\System\cuMhcJs.exe
  C:\Windows\System\cuMhcJs.exe
  2⤵
  PID:1160
- C:\Windows\System\IwnSNyJ.exe
  C:\Windows\System\IwnSNyJ.exe
  2⤵
  PID:2064
- C:\Windows\System\QuGSCNn.exe
  C:\Windows\System\QuGSCNn.exe
  2⤵
  PID:2300
- C:\Windows\System\pIDaNFy.exe
  C:\Windows\System\pIDaNFy.exe
  2⤵
  PID:2416
- C:\Windows\System\CaZzjZJ.exe
  C:\Windows\System\CaZzjZJ.exe
  2⤵
  PID:1784
- C:\Windows\System\HYpJAwt.exe
  C:\Windows\System\HYpJAwt.exe
  2⤵
  PID:2104
- C:\Windows\System\lFRvEIh.exe
  C:\Windows\System\lFRvEIh.exe
  2⤵
  PID:972
- C:\Windows\System\ovmxCSC.exe
  C:\Windows\System\ovmxCSC.exe
  2⤵
  PID:2380
- C:\Windows\System\dNGfElj.exe
  C:\Windows\System\dNGfElj.exe
  2⤵
  PID:2248
- C:\Windows\System\RDjsNiP.exe
  C:\Windows\System\RDjsNiP.exe
  2⤵
  PID:1116
- C:\Windows\System\LMzkFUR.exe
  C:\Windows\System\LMzkFUR.exe
  2⤵
  PID:2888
- C:\Windows\System\yaQLClx.exe
  C:\Windows\System\yaQLClx.exe
  2⤵
  PID:1504
- C:\Windows\System\czWVfgB.exe
  C:\Windows\System\czWVfgB.exe
  2⤵
  PID:2340
- C:\Windows\System\OlebuUE.exe
  C:\Windows\System\OlebuUE.exe
  2⤵
  PID:1556
- C:\Windows\System\KKAUWFv.exe
  C:\Windows\System\KKAUWFv.exe
  2⤵
  PID:2708
- C:\Windows\System\KSthlMk.exe
  C:\Windows\System\KSthlMk.exe
  2⤵
  PID:3120
- C:\Windows\System\NIKZkkw.exe
  C:\Windows\System\NIKZkkw.exe
  2⤵
  PID:3192
- C:\Windows\System\QVuGwTH.exe
  C:\Windows\System\QVuGwTH.exe
  2⤵
  PID:1660
- C:\Windows\System\EPBsERf.exe
  C:\Windows\System\EPBsERf.exe
  2⤵
  PID:2748
- C:\Windows\System\kOezBvU.exe
  C:\Windows\System\kOezBvU.exe
  2⤵
  PID:3092
- C:\Windows\System\vwwccSK.exe
  C:\Windows\System\vwwccSK.exe
  2⤵
  PID:3172
- C:\Windows\System\wbZDVvc.exe
  C:\Windows\System\wbZDVvc.exe
  2⤵
  PID:3216
- C:\Windows\System\qUyvUgl.exe
  C:\Windows\System\qUyvUgl.exe
  2⤵
  PID:3360
- C:\Windows\System\mcFingG.exe
  C:\Windows\System\mcFingG.exe
  2⤵
  PID:3448
- C:\Windows\System\zZURhir.exe
  C:\Windows\System\zZURhir.exe
  2⤵
  PID:3484
- C:\Windows\System\ndlDQfL.exe
  C:\Windows\System\ndlDQfL.exe
  2⤵
  PID:3288
- C:\Windows\System\FOGMAoJ.exe
  C:\Windows\System\FOGMAoJ.exe
  2⤵
  PID:3524
- C:\Windows\System\JuhqQJo.exe
  C:\Windows\System\JuhqQJo.exe
  2⤵
  PID:3376
- C:\Windows\System\VNwRLnU.exe
  C:\Windows\System\VNwRLnU.exe
  2⤵
  PID:3416
- C:\Windows\System\yKNRCEu.exe
  C:\Windows\System\yKNRCEu.exe
  2⤵
  PID:3372
- C:\Windows\System\lzDvFaB.exe
  C:\Windows\System\lzDvFaB.exe
  2⤵
  PID:3504
- C:\Windows\System\WbnbkSu.exe
  C:\Windows\System\WbnbkSu.exe
  2⤵
  PID:3600
- C:\Windows\System\PPXeIoJ.exe
  C:\Windows\System\PPXeIoJ.exe
  2⤵
  PID:3704
- C:\Windows\System\diGrusZ.exe
  C:\Windows\System\diGrusZ.exe
  2⤵
  PID:3748
- C:\Windows\System\TmvFWNJ.exe
  C:\Windows\System\TmvFWNJ.exe
  2⤵
  PID:3692
- C:\Windows\System\AAmnwTO.exe
  C:\Windows\System\AAmnwTO.exe
  2⤵
  PID:3768
- C:\Windows\System\hbjJnVR.exe
  C:\Windows\System\hbjJnVR.exe
  2⤵
  PID:3772
- C:\Windows\System\UwMbfMe.exe
  C:\Windows\System\UwMbfMe.exe
  2⤵
  PID:3840
- C:\Windows\System\zPlMbDX.exe
  C:\Windows\System\zPlMbDX.exe
  2⤵
  PID:3680
- C:\Windows\System\ipPZPRT.exe
  C:\Windows\System\ipPZPRT.exe
  2⤵
  PID:3884
- C:\Windows\System\mMZrOsx.exe
  C:\Windows\System\mMZrOsx.exe
  2⤵
  PID:3992
- C:\Windows\System\spLCECM.exe
  C:\Windows\System\spLCECM.exe
  2⤵
  PID:3820
- C:\Windows\System\dkUYzAi.exe
  C:\Windows\System\dkUYzAi.exe
  2⤵
  PID:3864
- C:\Windows\System\oHhXxst.exe
  C:\Windows\System\oHhXxst.exe
  2⤵
  PID:4032
- C:\Windows\System\CzsJNRQ.exe
  C:\Windows\System\CzsJNRQ.exe
  2⤵
  PID:3972
- C:\Windows\System\xQoNndJ.exe
  C:\Windows\System\xQoNndJ.exe
  2⤵
  PID:4084
- C:\Windows\System\pCfnfzt.exe
  C:\Windows\System\pCfnfzt.exe
  2⤵
  PID:832
- C:\Windows\System\xAxkLms.exe
  C:\Windows\System\xAxkLms.exe
  2⤵
  PID:2808
- C:\Windows\System\LINIENY.exe
  C:\Windows\System\LINIENY.exe
  2⤵
  PID:3976
- C:\Windows\System\tsMdYLe.exe
  C:\Windows\System\tsMdYLe.exe
  2⤵
  PID:2124
- C:\Windows\System\zHAkqQH.exe
  C:\Windows\System\zHAkqQH.exe
  2⤵
  PID:1020
- C:\Windows\System\hdQCQCp.exe
  C:\Windows\System\hdQCQCp.exe
  2⤵
  PID:572
- C:\Windows\System\UaPIcfX.exe
  C:\Windows\System\UaPIcfX.exe
  2⤵
  PID:2296
- C:\Windows\System\cSvXcJI.exe
  C:\Windows\System\cSvXcJI.exe
  2⤵
  PID:1404
- C:\Windows\System\rNusZra.exe
  C:\Windows\System\rNusZra.exe
  2⤵
  PID:3232
- C:\Windows\System\GuEdBUU.exe
  C:\Windows\System\GuEdBUU.exe
  2⤵
  PID:884
- C:\Windows\System\zzHClsk.exe
  C:\Windows\System\zzHClsk.exe
  2⤵
  PID:3096
- C:\Windows\System\YjBRqks.exe
  C:\Windows\System\YjBRqks.exe
  2⤵
  PID:1580
- C:\Windows\System\zNFVwEN.exe
  C:\Windows\System\zNFVwEN.exe
  2⤵
  PID:3400
- C:\Windows\System\kUcKrrp.exe
  C:\Windows\System\kUcKrrp.exe
  2⤵
  PID:3300
- C:\Windows\System\LXxXgSX.exe
  C:\Windows\System\LXxXgSX.exe
  2⤵
  PID:3340
- C:\Windows\System\KTICqgG.exe
  C:\Windows\System\KTICqgG.exe
  2⤵
  PID:3500
- C:\Windows\System\hNPCEXh.exe
  C:\Windows\System\hNPCEXh.exe
  2⤵
  PID:3540
- C:\Windows\System\uECuydx.exe
  C:\Windows\System\uECuydx.exe
  2⤵
  PID:3764
- C:\Windows\System\VpfBTTW.exe
  C:\Windows\System\VpfBTTW.exe
  2⤵
  PID:3136
- C:\Windows\System\QMBsBwE.exe
  C:\Windows\System\QMBsBwE.exe
  2⤵
  PID:3480
- C:\Windows\System\NdUAxgb.exe
  C:\Windows\System\NdUAxgb.exe
  2⤵
  PID:3564
- C:\Windows\System\eBxPryd.exe
  C:\Windows\System\eBxPryd.exe
  2⤵
  PID:3468
- C:\Windows\System\CjwPgVA.exe
  C:\Windows\System\CjwPgVA.exe
  2⤵
  PID:3788
- C:\Windows\System\Qsiaggb.exe
  C:\Windows\System\Qsiaggb.exe
  2⤵
  PID:4080
- C:\Windows\System\qqYNsdz.exe
  C:\Windows\System\qqYNsdz.exe
  2⤵
  PID:4108
- C:\Windows\System\ERiDlBK.exe
  C:\Windows\System\ERiDlBK.exe
  2⤵
  PID:4124
- C:\Windows\System\GaUignj.exe
  C:\Windows\System\GaUignj.exe
  2⤵
  PID:4148
- C:\Windows\System\XkgwWpy.exe
  C:\Windows\System\XkgwWpy.exe
  2⤵
  PID:4168
- C:\Windows\System\GYYrsOH.exe
  C:\Windows\System\GYYrsOH.exe
  2⤵
  PID:4188
- C:\Windows\System\jgNdaTr.exe
  C:\Windows\System\jgNdaTr.exe
  2⤵
  PID:4208
- C:\Windows\System\GXhWuMb.exe
  C:\Windows\System\GXhWuMb.exe
  2⤵
  PID:4228
- C:\Windows\System\GvVSwbQ.exe
  C:\Windows\System\GvVSwbQ.exe
  2⤵
  PID:4248
- C:\Windows\System\YyupZfY.exe
  C:\Windows\System\YyupZfY.exe
  2⤵
  PID:4280
- C:\Windows\System\VPuJugF.exe
  C:\Windows\System\VPuJugF.exe
  2⤵
  PID:4296
- C:\Windows\System\dxCkqPW.exe
  C:\Windows\System\dxCkqPW.exe
  2⤵
  PID:4316
- C:\Windows\System\MuslZYH.exe
  C:\Windows\System\MuslZYH.exe
  2⤵
  PID:4332
- C:\Windows\System\CZtmlfm.exe
  C:\Windows\System\CZtmlfm.exe
  2⤵
  PID:4352
- C:\Windows\System\CknVtjZ.exe
  C:\Windows\System\CknVtjZ.exe
  2⤵
  PID:4372
- C:\Windows\System\dhmJYVF.exe
  C:\Windows\System\dhmJYVF.exe
  2⤵
  PID:4392
- C:\Windows\System\ARmKUFG.exe
  C:\Windows\System\ARmKUFG.exe
  2⤵
  PID:4408
- C:\Windows\System\jAzdJbZ.exe
  C:\Windows\System\jAzdJbZ.exe
  2⤵
  PID:4424
- C:\Windows\System\VTyNeiP.exe
  C:\Windows\System\VTyNeiP.exe
  2⤵
  PID:4444
- C:\Windows\System\oqTkbKx.exe
  C:\Windows\System\oqTkbKx.exe
  2⤵
  PID:4464
- C:\Windows\System\WnkySzc.exe
  C:\Windows\System\WnkySzc.exe
  2⤵
  PID:4480
- C:\Windows\System\cxlMsjy.exe
  C:\Windows\System\cxlMsjy.exe
  2⤵
  PID:4504
- C:\Windows\System\CTfopSb.exe
  C:\Windows\System\CTfopSb.exe
  2⤵
  PID:4520
- C:\Windows\System\DevEuiM.exe
  C:\Windows\System\DevEuiM.exe
  2⤵
  PID:4544
- C:\Windows\System\TMNQAWo.exe
  C:\Windows\System\TMNQAWo.exe
  2⤵
  PID:4560
- C:\Windows\System\aNmTvNs.exe
  C:\Windows\System\aNmTvNs.exe
  2⤵
  PID:4580
- C:\Windows\System\UswYVlE.exe
  C:\Windows\System\UswYVlE.exe
  2⤵
  PID:4600
- C:\Windows\System\AsZyQmW.exe
  C:\Windows\System\AsZyQmW.exe
  2⤵
  PID:4620
- C:\Windows\System\iOoZUDN.exe
  C:\Windows\System\iOoZUDN.exe
  2⤵
  PID:4640
- C:\Windows\System\pllofmZ.exe
  C:\Windows\System\pllofmZ.exe
  2⤵
  PID:4660
- C:\Windows\System\xEHIMMg.exe
  C:\Windows\System\xEHIMMg.exe
  2⤵
  PID:4676
- C:\Windows\System\cDTIgEe.exe
  C:\Windows\System\cDTIgEe.exe
  2⤵
  PID:4696
- C:\Windows\System\OrEPcEn.exe
  C:\Windows\System\OrEPcEn.exe
  2⤵
  PID:4712
- C:\Windows\System\KJCAGaf.exe
  C:\Windows\System\KJCAGaf.exe
  2⤵
  PID:4772
- C:\Windows\System\mPnQwdY.exe
  C:\Windows\System\mPnQwdY.exe
  2⤵
  PID:4792
- C:\Windows\System\FDjgKUz.exe
  C:\Windows\System\FDjgKUz.exe
  2⤵
  PID:4808
- C:\Windows\System\afGcphl.exe
  C:\Windows\System\afGcphl.exe
  2⤵
  PID:4824
- C:\Windows\System\bjHZbyI.exe
  C:\Windows\System\bjHZbyI.exe
  2⤵
  PID:4848
- C:\Windows\System\zOarxRo.exe
  C:\Windows\System\zOarxRo.exe
  2⤵
  PID:4868
- C:\Windows\System\KzanmWH.exe
  C:\Windows\System\KzanmWH.exe
  2⤵
  PID:4892
- C:\Windows\System\TUrasaH.exe
  C:\Windows\System\TUrasaH.exe
  2⤵
  PID:4912
- C:\Windows\System\DFgknFG.exe
  C:\Windows\System\DFgknFG.exe
  2⤵
  PID:4932
- C:\Windows\System\ooAzxxE.exe
  C:\Windows\System\ooAzxxE.exe
  2⤵
  PID:4948
- C:\Windows\System\vArjoQy.exe
  C:\Windows\System\vArjoQy.exe
  2⤵
  PID:4968
- C:\Windows\System\elngbyz.exe
  C:\Windows\System\elngbyz.exe
  2⤵
  PID:4988
- C:\Windows\System\DZhKZSr.exe
  C:\Windows\System\DZhKZSr.exe
  2⤵
  PID:5008
- C:\Windows\System\gyDUCyX.exe
  C:\Windows\System\gyDUCyX.exe
  2⤵
  PID:5024
- C:\Windows\System\SCzLhdA.exe
  C:\Windows\System\SCzLhdA.exe
  2⤵
  PID:5044
- C:\Windows\System\RgvSJay.exe
  C:\Windows\System\RgvSJay.exe
  2⤵
  PID:5060
- C:\Windows\System\yywwMog.exe
  C:\Windows\System\yywwMog.exe
  2⤵
  PID:5080
- C:\Windows\System\PwZVToj.exe
  C:\Windows\System\PwZVToj.exe
  2⤵
  PID:5096
- C:\Windows\System\DCrSSmY.exe
  C:\Windows\System\DCrSSmY.exe
  2⤵
  PID:5116
- C:\Windows\System\WXGuRXI.exe
  C:\Windows\System\WXGuRXI.exe
  2⤵
  PID:4068
- C:\Windows\System\VaiJByZ.exe
  C:\Windows\System\VaiJByZ.exe
  2⤵
  PID:320
- C:\Windows\System\fmrlDWy.exe
  C:\Windows\System\fmrlDWy.exe
  2⤵
  PID:3724
- C:\Windows\System\vUkmpDE.exe
  C:\Windows\System\vUkmpDE.exe
  2⤵
  PID:3684
- C:\Windows\System\txRCIPZ.exe
  C:\Windows\System\txRCIPZ.exe
  2⤵
  PID:544
- C:\Windows\System\eHQmomH.exe
  C:\Windows\System\eHQmomH.exe
  2⤵
  PID:3236
- C:\Windows\System\kYQVqqm.exe
  C:\Windows\System\kYQVqqm.exe
  2⤵
  PID:4036
- C:\Windows\System\WZDgwNu.exe
  C:\Windows\System\WZDgwNu.exe
  2⤵
  PID:3256
- C:\Windows\System\jkPHSth.exe
  C:\Windows\System\jkPHSth.exe
  2⤵
  PID:4056
- C:\Windows\System\EECENGU.exe
  C:\Windows\System\EECENGU.exe
  2⤵
  PID:3380
- C:\Windows\System\TlJzkTb.exe
  C:\Windows\System\TlJzkTb.exe
  2⤵
  PID:3080
- C:\Windows\System\YxmZrUU.exe
  C:\Windows\System\YxmZrUU.exe
  2⤵
  PID:2516
- C:\Windows\System\SXNiLMw.exe
  C:\Windows\System\SXNiLMw.exe
  2⤵
  PID:1800
- C:\Windows\System\opNDSzJ.exe
  C:\Windows\System\opNDSzJ.exe
  2⤵
  PID:3212
- C:\Windows\System\yKabVuo.exe
  C:\Windows\System\yKabVuo.exe
  2⤵
  PID:3808
- C:\Windows\System\HWXQYan.exe
  C:\Windows\System\HWXQYan.exe
  2⤵
  PID:3644
- C:\Windows\System\MAhqAPS.exe
  C:\Windows\System\MAhqAPS.exe
  2⤵
  PID:3116
- C:\Windows\System\LVMiIXY.exe
  C:\Windows\System\LVMiIXY.exe
  2⤵
  PID:4160
- C:\Windows\System\swDWVak.exe
  C:\Windows\System\swDWVak.exe
  2⤵
  PID:4204
- C:\Windows\System\MLzcdTH.exe
  C:\Windows\System\MLzcdTH.exe
  2⤵
  PID:3144
- C:\Windows\System\LHKYkrf.exe
  C:\Windows\System\LHKYkrf.exe
  2⤵
  PID:4288
- C:\Windows\System\WMWCtpF.exe
  C:\Windows\System\WMWCtpF.exe
  2⤵
  PID:3520
- C:\Windows\System\nVPuQqk.exe
  C:\Windows\System\nVPuQqk.exe
  2⤵
  PID:4364
- C:\Windows\System\hEueiKP.exe
  C:\Windows\System\hEueiKP.exe
  2⤵
  PID:4436
- C:\Windows\System\WPbRSUZ.exe
  C:\Windows\System\WPbRSUZ.exe
  2⤵
  PID:3688
- C:\Windows\System\TXigfOD.exe
  C:\Windows\System\TXigfOD.exe
  2⤵
  PID:4552
- C:\Windows\System\pEFmXLG.exe
  C:\Windows\System\pEFmXLG.exe
  2⤵
  PID:4144
- C:\Windows\System\KLdLqJV.exe
  C:\Windows\System\KLdLqJV.exe
  2⤵
  PID:4344
- C:\Windows\System\JKFtiGE.exe
  C:\Windows\System\JKFtiGE.exe
  2⤵
  PID:4388
- C:\Windows\System\RTJyEPN.exe
  C:\Windows\System\RTJyEPN.exe
  2⤵
  PID:4452
- C:\Windows\System\jmnquPS.exe
  C:\Windows\System\jmnquPS.exe
  2⤵
  PID:4500
- C:\Windows\System\mNgqXKn.exe
  C:\Windows\System\mNgqXKn.exe
  2⤵
  PID:4612
- C:\Windows\System\kCjhClr.exe
  C:\Windows\System\kCjhClr.exe
  2⤵
  PID:4692
- C:\Windows\System\qUbyZEh.exe
  C:\Windows\System\qUbyZEh.exe
  2⤵
  PID:4488
- C:\Windows\System\jPLxVKS.exe
  C:\Windows\System\jPLxVKS.exe
  2⤵
  PID:4740
- C:\Windows\System\kLuLmwt.exe
  C:\Windows\System\kLuLmwt.exe
  2⤵
  PID:4568
- C:\Windows\System\wUjBRnd.exe
  C:\Windows\System\wUjBRnd.exe
  2⤵
  PID:4780
- C:\Windows\System\vuyuTTu.exe
  C:\Windows\System\vuyuTTu.exe
  2⤵
  PID:2648
- C:\Windows\System\huoZKyr.exe
  C:\Windows\System\huoZKyr.exe
  2⤵
  PID:4856
- C:\Windows\System\mgUAGMD.exe
  C:\Windows\System\mgUAGMD.exe
  2⤵
  PID:4964
- C:\Windows\System\qmVgwFG.exe
  C:\Windows\System\qmVgwFG.exe
  2⤵
  PID:4908
- C:\Windows\System\qETsJZM.exe
  C:\Windows\System\qETsJZM.exe
  2⤵
  PID:4980
- C:\Windows\System\DamcGFW.exe
  C:\Windows\System\DamcGFW.exe
  2⤵
  PID:5052
- C:\Windows\System\SSvsHVh.exe
  C:\Windows\System\SSvsHVh.exe
  2⤵
  PID:4016
- C:\Windows\System\soJiYJM.exe
  C:\Windows\System\soJiYJM.exe
  2⤵
  PID:3880
- C:\Windows\System\GJzbsyS.exe
  C:\Windows\System\GJzbsyS.exe
  2⤵
  PID:4884
- C:\Windows\System\aYXoqMC.exe
  C:\Windows\System\aYXoqMC.exe
  2⤵
  PID:4920
- C:\Windows\System\dIMgZgB.exe
  C:\Windows\System\dIMgZgB.exe
  2⤵
  PID:4956
- C:\Windows\System\eBMQXBc.exe
  C:\Windows\System\eBMQXBc.exe
  2⤵
  PID:2572
- C:\Windows\System\USpDDmX.exe
  C:\Windows\System\USpDDmX.exe
  2⤵
  PID:5040
- C:\Windows\System\KKxlTCn.exe
  C:\Windows\System\KKxlTCn.exe
  2⤵
  PID:2244
- C:\Windows\System\NDwGDtb.exe
  C:\Windows\System\NDwGDtb.exe
  2⤵
  PID:3356
- C:\Windows\System\PtpxfYk.exe
  C:\Windows\System\PtpxfYk.exe
  2⤵
  PID:3404
- C:\Windows\System\tezQZXj.exe
  C:\Windows\System\tezQZXj.exe
  2⤵
  PID:3544
- C:\Windows\System\FPjLPLt.exe
  C:\Windows\System\FPjLPLt.exe
  2⤵
  PID:4368
- C:\Windows\System\IzfwBSL.exe
  C:\Windows\System\IzfwBSL.exe
  2⤵
  PID:5104
- C:\Windows\System\GCRVybO.exe
  C:\Windows\System\GCRVybO.exe
  2⤵
  PID:2900
- C:\Windows\System\tzlBtaB.exe
  C:\Windows\System\tzlBtaB.exe
  2⤵
  PID:4100
- C:\Windows\System\jtAoluU.exe
  C:\Windows\System\jtAoluU.exe
  2⤵
  PID:3960
- C:\Windows\System\axPTWpT.exe
  C:\Windows\System\axPTWpT.exe
  2⤵
  PID:5032
- C:\Windows\System\GcVswXo.exe
  C:\Windows\System\GcVswXo.exe
  2⤵
  PID:1040
- C:\Windows\System\DKDTviK.exe
  C:\Windows\System\DKDTviK.exe
  2⤵
  PID:3876
- C:\Windows\System\hPmLgNj.exe
  C:\Windows\System\hPmLgNj.exe
  2⤵
  PID:4156
- C:\Windows\System\jyMONZY.exe
  C:\Windows\System\jyMONZY.exe
  2⤵
  PID:2452
- C:\Windows\System\DfbUwFh.exe
  C:\Windows\System\DfbUwFh.exe
  2⤵
  PID:4432
- C:\Windows\System\WHGhSue.exe
  C:\Windows\System\WHGhSue.exe
  2⤵
  PID:4512
- C:\Windows\System\banPiYr.exe
  C:\Windows\System\banPiYr.exe
  2⤵
  PID:4220
- C:\Windows\System\WJvfXqS.exe
  C:\Windows\System\WJvfXqS.exe
  2⤵
  PID:4632
- C:\Windows\System\QCkpEjk.exe
  C:\Windows\System\QCkpEjk.exe
  2⤵
  PID:4256
- C:\Windows\System\XHTdWJp.exe
  C:\Windows\System\XHTdWJp.exe
  2⤵
  PID:4180
- C:\Windows\System\AvndjuL.exe
  C:\Windows\System\AvndjuL.exe
  2⤵
  PID:4304
- C:\Windows\System\cUBGrLX.exe
  C:\Windows\System\cUBGrLX.exe
  2⤵
  PID:1200
- C:\Windows\System\EQcjsDE.exe
  C:\Windows\System\EQcjsDE.exe
  2⤵
  PID:1636
- C:\Windows\System\qXHENKj.exe
  C:\Windows\System\qXHENKj.exe
  2⤵
  PID:1204
- C:\Windows\System\tKWCvUd.exe
  C:\Windows\System\tKWCvUd.exe
  2⤵
  PID:4684
- C:\Windows\System\ZmcHJUl.exe
  C:\Windows\System\ZmcHJUl.exe
  2⤵
  PID:4540
- C:\Windows\System\cnFwMxQ.exe
  C:\Windows\System\cnFwMxQ.exe
  2⤵
  PID:2892
- C:\Windows\System\eyEDLYr.exe
  C:\Windows\System\eyEDLYr.exe
  2⤵
  PID:4820
- C:\Windows\System\OcuvhyX.exe
  C:\Windows\System\OcuvhyX.exe
  2⤵
  PID:5020
- C:\Windows\System\qUwqWgb.exe
  C:\Windows\System\qUwqWgb.exe
  2⤵
  PID:3952
- C:\Windows\System\sEhMrDk.exe
  C:\Windows\System\sEhMrDk.exe
  2⤵
  PID:5092
- C:\Windows\System\naETYqh.exe
  C:\Windows\System\naETYqh.exe
  2⤵
  PID:2020
- C:\Windows\System\qefOzVM.exe
  C:\Windows\System\qefOzVM.exe
  2⤵
  PID:4788
- C:\Windows\System\wDggNfE.exe
  C:\Windows\System\wDggNfE.exe
  2⤵
  PID:5004
- C:\Windows\System\NacZqGS.exe
  C:\Windows\System\NacZqGS.exe
  2⤵
  PID:3316
- C:\Windows\System\pEESJvK.exe
  C:\Windows\System\pEESJvK.exe
  2⤵
  PID:4224
- C:\Windows\System\zLIJqeM.exe
  C:\Windows\System\zLIJqeM.exe
  2⤵
  PID:4928
- C:\Windows\System\CFtjhBh.exe
  C:\Windows\System\CFtjhBh.exe
  2⤵
  PID:3744
- C:\Windows\System\bcJrQCd.exe
  C:\Windows\System\bcJrQCd.exe
  2⤵
  PID:4360
- C:\Windows\System\LZiRljN.exe
  C:\Windows\System\LZiRljN.exe
  2⤵
  PID:1752
- C:\Windows\System\QZNaobP.exe
  C:\Windows\System\QZNaobP.exe
  2⤵
  PID:4628
- C:\Windows\System\GYCKEYf.exe
  C:\Windows\System\GYCKEYf.exe
  2⤵
  PID:4268
- C:\Windows\System\zVueHHW.exe
  C:\Windows\System\zVueHHW.exe
  2⤵
  PID:2156
- C:\Windows\System\IIBeFec.exe
  C:\Windows\System\IIBeFec.exe
  2⤵
  PID:2740
- C:\Windows\System\DpcUWSH.exe
  C:\Windows\System\DpcUWSH.exe
  2⤵
  PID:2596
- C:\Windows\System\IvTfFuY.exe
  C:\Windows\System\IvTfFuY.exe
  2⤵
  PID:2140
- C:\Windows\System\sINapyv.exe
  C:\Windows\System\sINapyv.exe
  2⤵
  PID:1812
- C:\Windows\System\avlVXkR.exe
  C:\Windows\System\avlVXkR.exe
  2⤵
  PID:4200
- C:\Windows\System\tgMILzV.exe
  C:\Windows\System\tgMILzV.exe
  2⤵
  PID:5112
- C:\Windows\System\ENhwOYk.exe
  C:\Windows\System\ENhwOYk.exe
  2⤵
  PID:2768
- C:\Windows\System\uibasNC.exe
  C:\Windows\System\uibasNC.exe
  2⤵
  PID:3612
- C:\Windows\System\tNYFyir.exe
  C:\Windows\System\tNYFyir.exe
  2⤵
  PID:4404
- C:\Windows\System\cEwYnBs.exe
  C:\Windows\System\cEwYnBs.exe
  2⤵
  PID:4668
- C:\Windows\System\cidanar.exe
  C:\Windows\System\cidanar.exe
  2⤵
  PID:2308
- C:\Windows\System\oOKRwcK.exe
  C:\Windows\System\oOKRwcK.exe
  2⤵
  PID:4648
- C:\Windows\System\ZDwxwWL.exe
  C:\Windows\System\ZDwxwWL.exe
  2⤵
  PID:4732
- C:\Windows\System\pzKznjY.exe
  C:\Windows\System\pzKznjY.exe
  2⤵
  PID:4976
- C:\Windows\System\uirRyUB.exe
  C:\Windows\System\uirRyUB.exe
  2⤵
  PID:3160
- C:\Windows\System\qAkQmdl.exe
  C:\Windows\System\qAkQmdl.exe
  2⤵
  PID:4704
- C:\Windows\System\DADBQSq.exe
  C:\Windows\System\DADBQSq.exe
  2⤵
  PID:1604
- C:\Windows\System\zmzJIUK.exe
  C:\Windows\System\zmzJIUK.exe
  2⤵
  PID:1848
- C:\Windows\System\iLBLOgS.exe
  C:\Windows\System\iLBLOgS.exe
  2⤵
  PID:4844
- C:\Windows\System\FIDhywN.exe
  C:\Windows\System\FIDhywN.exe
  2⤵
  PID:3996
- C:\Windows\System\ThiWAoo.exe
  C:\Windows\System\ThiWAoo.exe
  2⤵
  PID:3396
- C:\Windows\System\GFWrobJ.exe
  C:\Windows\System\GFWrobJ.exe
  2⤵
  PID:4748
- C:\Windows\System\uzNaGzi.exe
  C:\Windows\System\uzNaGzi.exe
  2⤵
  PID:5132
- C:\Windows\System\rhovRpY.exe
  C:\Windows\System\rhovRpY.exe
  2⤵
  PID:5148
- C:\Windows\System\geDLylf.exe
  C:\Windows\System\geDLylf.exe
  2⤵
  PID:5164
- C:\Windows\System\VDlweyJ.exe
  C:\Windows\System\VDlweyJ.exe
  2⤵
  PID:5180
- C:\Windows\System\RfsVKqw.exe
  C:\Windows\System\RfsVKqw.exe
  2⤵
  PID:5200
- C:\Windows\System\QQLzmiD.exe
  C:\Windows\System\QQLzmiD.exe
  2⤵
  PID:5216
- C:\Windows\System\SlJWGxw.exe
  C:\Windows\System\SlJWGxw.exe
  2⤵
  PID:5236
- C:\Windows\System\SCrMYeN.exe
  C:\Windows\System\SCrMYeN.exe
  2⤵
  PID:5252
- C:\Windows\System\tBrhZfs.exe
  C:\Windows\System\tBrhZfs.exe
  2⤵
  PID:5268
- C:\Windows\System\kygdipN.exe
  C:\Windows\System\kygdipN.exe
  2⤵
  PID:5288
- C:\Windows\System\wMgFAcj.exe
  C:\Windows\System\wMgFAcj.exe
  2⤵
  PID:5308
- C:\Windows\System\jyKlHFI.exe
  C:\Windows\System\jyKlHFI.exe
  2⤵
  PID:5324
- C:\Windows\System\LQDdXTo.exe
  C:\Windows\System\LQDdXTo.exe
  2⤵
  PID:5344
- C:\Windows\System\LEDvIco.exe
  C:\Windows\System\LEDvIco.exe
  2⤵
  PID:5364
- C:\Windows\System\iQByMFm.exe
  C:\Windows\System\iQByMFm.exe
  2⤵
  PID:5380
- C:\Windows\System\HdWoHnL.exe
  C:\Windows\System\HdWoHnL.exe
  2⤵
  PID:5400
- C:\Windows\System\PuBkqXl.exe
  C:\Windows\System\PuBkqXl.exe
  2⤵
  PID:5420
- C:\Windows\System\EFcQqGq.exe
  C:\Windows\System\EFcQqGq.exe
  2⤵
  PID:5436
- C:\Windows\System\FQcLiIG.exe
  C:\Windows\System\FQcLiIG.exe
  2⤵
  PID:5452
- C:\Windows\System\uzJidsP.exe
  C:\Windows\System\uzJidsP.exe
  2⤵
  PID:5472
- C:\Windows\System\jxdEZVv.exe
  C:\Windows\System\jxdEZVv.exe
  2⤵
  PID:5492
- C:\Windows\System\cUVQGsM.exe
  C:\Windows\System\cUVQGsM.exe
  2⤵
  PID:5508
- C:\Windows\System\WaMWWow.exe
  C:\Windows\System\WaMWWow.exe
  2⤵
  PID:5528
- C:\Windows\System\UVxZdRT.exe
  C:\Windows\System\UVxZdRT.exe
  2⤵
  PID:5544
- C:\Windows\System\BcyPpWI.exe
  C:\Windows\System\BcyPpWI.exe
  2⤵
  PID:5564
- C:\Windows\System\zuHOMNN.exe
  C:\Windows\System\zuHOMNN.exe
  2⤵
  PID:5580
- C:\Windows\System\dqcjfaM.exe
  C:\Windows\System\dqcjfaM.exe
  2⤵
  PID:5596
- C:\Windows\System\dKdFtDc.exe
  C:\Windows\System\dKdFtDc.exe
  2⤵
  PID:5612
- C:\Windows\System\lUDSPuO.exe
  C:\Windows\System\lUDSPuO.exe
  2⤵
  PID:5628
- C:\Windows\System\WJpTGZH.exe
  C:\Windows\System\WJpTGZH.exe
  2⤵
  PID:5652
- C:\Windows\System\FbsBFvV.exe
  C:\Windows\System\FbsBFvV.exe
  2⤵
  PID:5668
- C:\Windows\System\EawFDkt.exe
  C:\Windows\System\EawFDkt.exe
  2⤵
  PID:5684
- C:\Windows\System\bYCcSJn.exe
  C:\Windows\System\bYCcSJn.exe
  2⤵
  PID:5704
- C:\Windows\System\jmotICE.exe
  C:\Windows\System\jmotICE.exe
  2⤵
  PID:5724
- C:\Windows\System\ArvsPFa.exe
  C:\Windows\System\ArvsPFa.exe
  2⤵
  PID:5740
- C:\Windows\System\HNwQppq.exe
  C:\Windows\System\HNwQppq.exe
  2⤵
  PID:5760
- C:\Windows\System\YppTrEm.exe
  C:\Windows\System\YppTrEm.exe
  2⤵
  PID:5776
- C:\Windows\System\eJTReaj.exe
  C:\Windows\System\eJTReaj.exe
  2⤵
  PID:5792
- C:\Windows\System\NXGyEHh.exe
  C:\Windows\System\NXGyEHh.exe
  2⤵
  PID:5808
- C:\Windows\System\gFWhIbE.exe
  C:\Windows\System\gFWhIbE.exe
  2⤵
  PID:5824
- C:\Windows\System\saEmely.exe
  C:\Windows\System\saEmely.exe
  2⤵
  PID:5840
- C:\Windows\System\VCwLONj.exe
  C:\Windows\System\VCwLONj.exe
  2⤵
  PID:5972
- C:\Windows\System\PnzSiSn.exe
  C:\Windows\System\PnzSiSn.exe
  2⤵
  PID:5988
- C:\Windows\System\yssqDry.exe
  C:\Windows\System\yssqDry.exe
  2⤵
  PID:6016
- C:\Windows\System\jWDUjzm.exe
  C:\Windows\System\jWDUjzm.exe
  2⤵
  PID:6036
- C:\Windows\System\PvLrOQd.exe
  C:\Windows\System\PvLrOQd.exe
  2⤵
  PID:6052
- C:\Windows\System\GiDdZFb.exe
  C:\Windows\System\GiDdZFb.exe
  2⤵
  PID:6068
- C:\Windows\System\skzrYtT.exe
  C:\Windows\System\skzrYtT.exe
  2⤵
  PID:6084
- C:\Windows\System\qevOfCx.exe
  C:\Windows\System\qevOfCx.exe
  2⤵
  PID:6104
- C:\Windows\System\cWgCira.exe
  C:\Windows\System\cWgCira.exe
  2⤵
  PID:6124
- C:\Windows\System\EGwCENx.exe
  C:\Windows\System\EGwCENx.exe
  2⤵
  PID:6140
- C:\Windows\System\edYoRai.exe
  C:\Windows\System\edYoRai.exe
  2⤵
  PID:2012
- C:\Windows\System\jaIvqYL.exe
  C:\Windows\System\jaIvqYL.exe
  2⤵
  PID:4752
- C:\Windows\System\ZWTvsSa.exe
  C:\Windows\System\ZWTvsSa.exe
  2⤵
  PID:4476
- C:\Windows\System\nekwrJN.exe
  C:\Windows\System\nekwrJN.exe
  2⤵
  PID:5188
- C:\Windows\System\QhYtOct.exe
  C:\Windows\System\QhYtOct.exe
  2⤵
  PID:4572
- C:\Windows\System\xRHEpCL.exe
  C:\Windows\System\xRHEpCL.exe
  2⤵
  PID:5300
- C:\Windows\System\SVhWvNF.exe
  C:\Windows\System\SVhWvNF.exe
  2⤵
  PID:4460
- C:\Windows\System\ocQCfqZ.exe
  C:\Windows\System\ocQCfqZ.exe
  2⤵
  PID:5128
- C:\Windows\System\ENODHjI.exe
  C:\Windows\System\ENODHjI.exe
  2⤵
  PID:5160
- C:\Windows\System\LsVRCdH.exe
  C:\Windows\System\LsVRCdH.exe
  2⤵
  PID:3420
- C:\Windows\System\LqojaFX.exe
  C:\Windows\System\LqojaFX.exe
  2⤵
  PID:4832
- C:\Windows\System\VYcrVce.exe
  C:\Windows\System\VYcrVce.exe
  2⤵
  PID:5444
- C:\Windows\System\DiEfHwr.exe
  C:\Windows\System\DiEfHwr.exe
  2⤵
  PID:5484
- C:\Windows\System\KEGLVWy.exe
  C:\Windows\System\KEGLVWy.exe
  2⤵
  PID:5552
- C:\Windows\System\nucZOHR.exe
  C:\Windows\System\nucZOHR.exe
  2⤵
  PID:5588
- C:\Windows\System\AvtSFjs.exe
  C:\Windows\System\AvtSFjs.exe
  2⤵
  PID:5140
- C:\Windows\System\kTLuxcZ.exe
  C:\Windows\System\kTLuxcZ.exe
  2⤵
  PID:5660
- C:\Windows\System\fenllFJ.exe
  C:\Windows\System\fenllFJ.exe
  2⤵
  PID:5696
- C:\Windows\System\BFMhXDJ.exe
  C:\Windows\System\BFMhXDJ.exe
  2⤵
  PID:5736
- C:\Windows\System\NDdIfVV.exe
  C:\Windows\System\NDdIfVV.exe
  2⤵
  PID:5176
- C:\Windows\System\GJvDxHB.exe
  C:\Windows\System\GJvDxHB.exe
  2⤵
  PID:5244
- C:\Windows\System\bMavAXu.exe
  C:\Windows\System\bMavAXu.exe
  2⤵
  PID:5316
- C:\Windows\System\eqRlriG.exe
  C:\Windows\System\eqRlriG.exe
  2⤵
  PID:5520
- C:\Windows\System\BEnCzuk.exe
  C:\Windows\System\BEnCzuk.exe
  2⤵
  PID:5360
- C:\Windows\System\TGOIevr.exe
  C:\Windows\System\TGOIevr.exe
  2⤵
  PID:5460
- C:\Windows\System\tVkrEZb.exe
  C:\Windows\System\tVkrEZb.exe
  2⤵
  PID:5504
- C:\Windows\System\lgTPlah.exe
  C:\Windows\System\lgTPlah.exe
  2⤵
  PID:5604
- C:\Windows\System\dhVNjFG.exe
  C:\Windows\System\dhVNjFG.exe
  2⤵
  PID:5680
- C:\Windows\System\wNlNorj.exe
  C:\Windows\System\wNlNorj.exe
  2⤵
  PID:5756
- C:\Windows\System\eYXSxqb.exe
  C:\Windows\System\eYXSxqb.exe
  2⤵
  PID:5788
- C:\Windows\System\FWeJjmV.exe
  C:\Windows\System\FWeJjmV.exe
  2⤵
  PID:5904
- C:\Windows\System\EIHkJfT.exe
  C:\Windows\System\EIHkJfT.exe
  2⤵
  PID:5920
- C:\Windows\System\TnvNYAo.exe
  C:\Windows\System\TnvNYAo.exe
  2⤵
  PID:5936
- C:\Windows\System\acasmnD.exe
  C:\Windows\System\acasmnD.exe
  2⤵
  PID:5952
- C:\Windows\System\mtdOZeK.exe
  C:\Windows\System\mtdOZeK.exe
  2⤵
  PID:5968
- C:\Windows\System\puYlvEq.exe
  C:\Windows\System\puYlvEq.exe
  2⤵
  PID:2940
- C:\Windows\System\zDimaPc.exe
  C:\Windows\System\zDimaPc.exe
  2⤵
  PID:1148
- C:\Windows\System\jiDcJjB.exe
  C:\Windows\System\jiDcJjB.exe
  2⤵
  PID:6004
- C:\Windows\System\SGOvaGh.exe
  C:\Windows\System\SGOvaGh.exe
  2⤵
  PID:6048
- C:\Windows\System\NHWmFMs.exe
  C:\Windows\System\NHWmFMs.exe
  2⤵
  PID:6116
- C:\Windows\System\fdgkXDj.exe
  C:\Windows\System\fdgkXDj.exe
  2⤵
  PID:2464
- C:\Windows\System\oivCidl.exe
  C:\Windows\System\oivCidl.exe
  2⤵
  PID:5984
- C:\Windows\System\PxlomVg.exe
  C:\Windows\System\PxlomVg.exe
  2⤵
  PID:1808
- C:\Windows\System\ucjUvGq.exe
  C:\Windows\System\ucjUvGq.exe
  2⤵
  PID:4244
- C:\Windows\System\fczvaTB.exe
  C:\Windows\System\fczvaTB.exe
  2⤵
  PID:3112
- C:\Windows\System\AkzCLek.exe
  C:\Windows\System\AkzCLek.exe
  2⤵
  PID:2556
- C:\Windows\System\mdJIQuK.exe
  C:\Windows\System\mdJIQuK.exe
  2⤵
  PID:2644
- C:\Windows\System\gXUWYLy.exe
  C:\Windows\System\gXUWYLy.exe
  2⤵
  PID:3800
- C:\Windows\System\BnXNduO.exe
  C:\Windows\System\BnXNduO.exe
  2⤵
  PID:4064
- C:\Windows\System\CibaMjm.exe
  C:\Windows\System\CibaMjm.exe
  2⤵
  PID:5408
- C:\Windows\System\MLcYpYC.exe
  C:\Windows\System\MLcYpYC.exe
  2⤵
  PID:5516
- C:\Windows\System\aNZgEkf.exe
  C:\Windows\System\aNZgEkf.exe
  2⤵
  PID:1824
- C:\Windows\System\IItUaEU.exe
  C:\Windows\System\IItUaEU.exe
  2⤵
  PID:5416
- C:\Windows\System\RkhDJEo.exe
  C:\Windows\System\RkhDJEo.exe
  2⤵
  PID:5280
- C:\Windows\System\jBMTISk.exe
  C:\Windows\System\jBMTISk.exe
  2⤵
  PID:5468
- C:\Windows\System\zgKgMmG.exe
  C:\Windows\System\zgKgMmG.exe
  2⤵
  PID:4900
- C:\Windows\System\zDECQWu.exe
  C:\Windows\System\zDECQWu.exe
  2⤵
  PID:5640
- C:\Windows\System\bgUDXDK.exe
  C:\Windows\System\bgUDXDK.exe
  2⤵
  PID:1572
- C:\Windows\System\lZtavVY.exe
  C:\Windows\System\lZtavVY.exe
  2⤵
  PID:5648
- C:\Windows\System\LdECAFD.exe
  C:\Windows\System\LdECAFD.exe
  2⤵
  PID:5720
- C:\Windows\System\rJsZjuB.exe
  C:\Windows\System\rJsZjuB.exe
  2⤵
  PID:5620
- C:\Windows\System\XQNxIOf.exe
  C:\Windows\System\XQNxIOf.exe
  2⤵
  PID:5352
- C:\Windows\System\rQjVPEO.exe
  C:\Windows\System\rQjVPEO.exe
  2⤵
  PID:1548
- C:\Windows\System\zhBjdtt.exe
  C:\Windows\System\zhBjdtt.exe
  2⤵
  PID:2544
- C:\Windows\System\njwxEJe.exe
  C:\Windows\System\njwxEJe.exe
  2⤵
  PID:1080
- C:\Windows\System\HEIjwau.exe
  C:\Windows\System\HEIjwau.exe
  2⤵
  PID:2000
- C:\Windows\System\VLnhCdl.exe
  C:\Windows\System\VLnhCdl.exe
  2⤵
  PID:5944
- C:\Windows\System\TpRHLmk.exe
  C:\Windows\System\TpRHLmk.exe
  2⤵
  PID:5956
- C:\Windows\System\smjGoNC.exe
  C:\Windows\System\smjGoNC.exe
  2⤵
  PID:5296
- C:\Windows\System\bhGzGBi.exe
  C:\Windows\System\bhGzGBi.exe
  2⤵
  PID:5376
- C:\Windows\System\ylrPvGY.exe
  C:\Windows\System\ylrPvGY.exe
  2⤵
  PID:6064
- C:\Windows\System\OfTetCf.exe
  C:\Windows\System\OfTetCf.exe
  2⤵
  PID:6100
- C:\Windows\System\XLdGnzE.exe
  C:\Windows\System\XLdGnzE.exe
  2⤵
  PID:5340
- C:\Windows\System\cXKuBSg.exe
  C:\Windows\System\cXKuBSg.exe
  2⤵
  PID:5664
- C:\Windows\System\DdCSiRT.exe
  C:\Windows\System\DdCSiRT.exe
  2⤵
  PID:5396
- C:\Windows\System\dDdUTiO.exe
  C:\Windows\System\dDdUTiO.exe
  2⤵
  PID:4496
- C:\Windows\System\hCQfqhJ.exe
  C:\Windows\System\hCQfqhJ.exe
  2⤵
  PID:5856
- C:\Windows\System\pofRkob.exe
  C:\Windows\System\pofRkob.exe
  2⤵
  PID:5248
- C:\Windows\System\xWzuVRB.exe
  C:\Windows\System\xWzuVRB.exe
  2⤵
  PID:5356
- C:\Windows\System\wPpLDxH.exe
  C:\Windows\System\wPpLDxH.exe
  2⤵
  PID:5716
- C:\Windows\System\JbkphnM.exe
  C:\Windows\System\JbkphnM.exe
  2⤵
  PID:5888
- C:\Windows\System\VyMAjQm.exe
  C:\Windows\System\VyMAjQm.exe
  2⤵
  PID:5900
- C:\Windows\System\wiCNBOF.exe
  C:\Windows\System\wiCNBOF.exe
  2⤵
  PID:5916
- C:\Windows\System\TmoTRAL.exe
  C:\Windows\System\TmoTRAL.exe
  2⤵
  PID:5852
- C:\Windows\System\PeBNAzp.exe
  C:\Windows\System\PeBNAzp.exe
  2⤵
  PID:2408
- C:\Windows\System\DwlLnhu.exe
  C:\Windows\System\DwlLnhu.exe
  2⤵
  PID:4708
- C:\Windows\System\VcYlyYv.exe
  C:\Windows\System\VcYlyYv.exe
  2⤵
  PID:6044
- C:\Windows\System\DOnuNsE.exe
  C:\Windows\System\DOnuNsE.exe
  2⤵
  PID:3064
- C:\Windows\System\GBytCQk.exe
  C:\Windows\System\GBytCQk.exe
  2⤵
  PID:5800
- C:\Windows\System\XPPcvIV.exe
  C:\Windows\System\XPPcvIV.exe
  2⤵
  PID:5260
- C:\Windows\System\iFyMqFT.exe
  C:\Windows\System\iFyMqFT.exe
  2⤵
  PID:5156
- C:\Windows\System\mKYViEx.exe
  C:\Windows\System\mKYViEx.exe
  2⤵
  PID:5592
- C:\Windows\System\ZQHcSyT.exe
  C:\Windows\System\ZQHcSyT.exe
  2⤵
  PID:5428
- C:\Windows\System\hptGlfF.exe
  C:\Windows\System\hptGlfF.exe
  2⤵
  PID:4416
- C:\Windows\System\fOSaLia.exe
  C:\Windows\System\fOSaLia.exe
  2⤵
  PID:5336
- C:\Windows\System\MTngnio.exe
  C:\Windows\System\MTngnio.exe
  2⤵
  PID:5576
- C:\Windows\System\HXcYXzz.exe
  C:\Windows\System\HXcYXzz.exe
  2⤵
  PID:5332
- C:\Windows\System\JRlsVGS.exe
  C:\Windows\System\JRlsVGS.exe
  2⤵
  PID:6112
- C:\Windows\System\LxRBFbh.exe
  C:\Windows\System\LxRBFbh.exe
  2⤵
  PID:6148
- C:\Windows\System\fZdpBqm.exe
  C:\Windows\System\fZdpBqm.exe
  2⤵
  PID:6168
- C:\Windows\System\fnMbdEN.exe
  C:\Windows\System\fnMbdEN.exe
  2⤵
  PID:6188
- C:\Windows\System\YMUWJiv.exe
  C:\Windows\System\YMUWJiv.exe
  2⤵
  PID:6208
- C:\Windows\System\fJPcPyc.exe
  C:\Windows\System\fJPcPyc.exe
  2⤵
  PID:6228
- C:\Windows\System\xDaUOed.exe
  C:\Windows\System\xDaUOed.exe
  2⤵
  PID:6248
- C:\Windows\System\jPXLdhD.exe
  C:\Windows\System\jPXLdhD.exe
  2⤵
  PID:6268
- C:\Windows\System\cuxpwDY.exe
  C:\Windows\System\cuxpwDY.exe
  2⤵
  PID:6288
- C:\Windows\System\XeEKmbr.exe
  C:\Windows\System\XeEKmbr.exe
  2⤵
  PID:6304
- C:\Windows\System\KVGYCvd.exe
  C:\Windows\System\KVGYCvd.exe
  2⤵
  PID:6320
- C:\Windows\System\bIgcvDk.exe
  C:\Windows\System\bIgcvDk.exe
  2⤵
  PID:6344
- C:\Windows\System\gNjVRlS.exe
  C:\Windows\System\gNjVRlS.exe
  2⤵
  PID:6360
- C:\Windows\System\CSweqRY.exe
  C:\Windows\System\CSweqRY.exe
  2⤵
  PID:6380
- C:\Windows\System\hCrjrRa.exe
  C:\Windows\System\hCrjrRa.exe
  2⤵
  PID:6404
- C:\Windows\System\dhaPdcP.exe
  C:\Windows\System\dhaPdcP.exe
  2⤵
  PID:6424
- C:\Windows\System\Nuitrbf.exe
  C:\Windows\System\Nuitrbf.exe
  2⤵
  PID:6444
- C:\Windows\System\xopBlwj.exe
  C:\Windows\System\xopBlwj.exe
  2⤵
  PID:6468
- C:\Windows\System\ZccTcYW.exe
  C:\Windows\System\ZccTcYW.exe
  2⤵
  PID:6492
- C:\Windows\System\WIuhfoo.exe
  C:\Windows\System\WIuhfoo.exe
  2⤵
  PID:6516
- C:\Windows\System\tOShFtC.exe
  C:\Windows\System\tOShFtC.exe
  2⤵
  PID:6544
- C:\Windows\System\jLiShoA.exe
  C:\Windows\System\jLiShoA.exe
  2⤵
  PID:6564
- C:\Windows\System\LnjOyOs.exe
  C:\Windows\System\LnjOyOs.exe
  2⤵
  PID:6584
- C:\Windows\System\PPTwzkb.exe
  C:\Windows\System\PPTwzkb.exe
  2⤵
  PID:6604
- C:\Windows\System\DAgiJsX.exe
  C:\Windows\System\DAgiJsX.exe
  2⤵
  PID:6620
- C:\Windows\System\hwGmAPG.exe
  C:\Windows\System\hwGmAPG.exe
  2⤵
  PID:6640
- C:\Windows\System\AsUZovE.exe
  C:\Windows\System\AsUZovE.exe
  2⤵
  PID:6660
- C:\Windows\System\HNmSBni.exe
  C:\Windows\System\HNmSBni.exe
  2⤵
  PID:6680
- C:\Windows\System\DBKtiEj.exe
  C:\Windows\System\DBKtiEj.exe
  2⤵
  PID:6704
- C:\Windows\System\vgTjqSK.exe
  C:\Windows\System\vgTjqSK.exe
  2⤵
  PID:6720
- C:\Windows\System\PKIroMe.exe
  C:\Windows\System\PKIroMe.exe
  2⤵
  PID:6736
- C:\Windows\System\GWjvIaE.exe
  C:\Windows\System\GWjvIaE.exe
  2⤵
  PID:6756
- C:\Windows\System\nwyHZpG.exe
  C:\Windows\System\nwyHZpG.exe
  2⤵
  PID:6772
- C:\Windows\System\HDXZQvB.exe
  C:\Windows\System\HDXZQvB.exe
  2⤵
  PID:6804
- C:\Windows\System\GVhMLZJ.exe
  C:\Windows\System\GVhMLZJ.exe
  2⤵
  PID:6820
- C:\Windows\System\gVsiRHv.exe
  C:\Windows\System\gVsiRHv.exe
  2⤵
  PID:6844
- C:\Windows\System\fhUELDA.exe
  C:\Windows\System\fhUELDA.exe
  2⤵
  PID:6860
- C:\Windows\System\yfHqVDw.exe
  C:\Windows\System\yfHqVDw.exe
  2⤵
  PID:6884
- C:\Windows\System\JjrqJyF.exe
  C:\Windows\System\JjrqJyF.exe
  2⤵
  PID:6908
- C:\Windows\System\lRjfnyx.exe
  C:\Windows\System\lRjfnyx.exe
  2⤵
  PID:6924
- C:\Windows\System\zQJHeiN.exe
  C:\Windows\System\zQJHeiN.exe
  2⤵
  PID:6944
- C:\Windows\System\aAfWXqR.exe
  C:\Windows\System\aAfWXqR.exe
  2⤵
  PID:6964
- C:\Windows\System\RWJzqqr.exe
  C:\Windows\System\RWJzqqr.exe
  2⤵
  PID:6988
- C:\Windows\System\fHmyCzm.exe
  C:\Windows\System\fHmyCzm.exe
  2⤵
  PID:7008
- C:\Windows\System\qVDdJse.exe
  C:\Windows\System\qVDdJse.exe
  2⤵
  PID:7028
- C:\Windows\System\GwSGTfE.exe
  C:\Windows\System\GwSGTfE.exe
  2⤵
  PID:7044
- C:\Windows\System\NYScIMP.exe
  C:\Windows\System\NYScIMP.exe
  2⤵
  PID:7060
- C:\Windows\System\ZLBpNpA.exe
  C:\Windows\System\ZLBpNpA.exe
  2⤵
  PID:7084
- C:\Windows\System\NhCmXQe.exe
  C:\Windows\System\NhCmXQe.exe
  2⤵
  PID:7104
- C:\Windows\System\WMWvDnT.exe
  C:\Windows\System\WMWvDnT.exe
  2⤵
  PID:7124
- C:\Windows\System\QsDXkND.exe
  C:\Windows\System\QsDXkND.exe
  2⤵
  PID:7140
- C:\Windows\System\opAizMg.exe
  C:\Windows\System\opAizMg.exe
  2⤵
  PID:7164
- C:\Windows\System\iMYAXRM.exe
  C:\Windows\System\iMYAXRM.exe
  2⤵
  PID:5224
- C:\Windows\System\dBoTcGH.exe
  C:\Windows\System\dBoTcGH.exe
  2⤵
  PID:1648
- C:\Windows\System\ayghyiB.exe
  C:\Windows\System\ayghyiB.exe
  2⤵
  PID:808
- C:\Windows\System\TUdLGCD.exe
  C:\Windows\System\TUdLGCD.exe
  2⤵
  PID:5804
- C:\Windows\System\BIzItXT.exe
  C:\Windows\System\BIzItXT.exe
  2⤵
  PID:2460
- C:\Windows\System\uKBrkbD.exe
  C:\Windows\System\uKBrkbD.exe
  2⤵
  PID:6244
- C:\Windows\System\CDKOCRx.exe
  C:\Windows\System\CDKOCRx.exe
  2⤵
  PID:6356
- C:\Windows\System\EhtfUle.exe
  C:\Windows\System\EhtfUle.exe
  2⤵
  PID:6400
- C:\Windows\System\GTyzhKu.exe
  C:\Windows\System\GTyzhKu.exe
  2⤵
  PID:2564
- C:\Windows\System\JjjROeM.exe
  C:\Windows\System\JjjROeM.exe
  2⤵
  PID:6484
- C:\Windows\System\gPAvnKs.exe
  C:\Windows\System\gPAvnKs.exe
  2⤵
  PID:1208
- C:\Windows\System\OHtlyTj.exe
  C:\Windows\System\OHtlyTj.exe
  2⤵
  PID:6184
- C:\Windows\System\mFyPHUh.exe
  C:\Windows\System\mFyPHUh.exe
  2⤵
  PID:6652
- C:\Windows\System\bCFuxSa.exe
  C:\Windows\System\bCFuxSa.exe
  2⤵
  PID:5880
- C:\Windows\System\bdgDYHL.exe
  C:\Windows\System\bdgDYHL.exe
  2⤵
  PID:6696
- C:\Windows\System\gRMrTiJ.exe
  C:\Windows\System\gRMrTiJ.exe
  2⤵
  PID:1640
- C:\Windows\System\nOoNWCv.exe
  C:\Windows\System\nOoNWCv.exe
  2⤵
  PID:6896
- C:\Windows\System\EOyruTv.exe
  C:\Windows\System\EOyruTv.exe
  2⤵
  PID:6556
- C:\Windows\System\etLFdQZ.exe
  C:\Windows\System\etLFdQZ.exe
  2⤵
  PID:6940
- C:\Windows\System\CptQzIx.exe
  C:\Windows\System\CptQzIx.exe
  2⤵
  PID:6628
- C:\Windows\System\lBlLYiO.exe
  C:\Windows\System\lBlLYiO.exe
  2⤵
  PID:7020
- C:\Windows\System\VbjETgc.exe
  C:\Windows\System\VbjETgc.exe
  2⤵
  PID:7052
- C:\Windows\System\ZqQhRXN.exe
  C:\Windows\System\ZqQhRXN.exe
  2⤵
  PID:7096
- C:\Windows\System\rCalLOH.exe
  C:\Windows\System\rCalLOH.exe
  2⤵
  PID:1108
- C:\Windows\System\qGTJMlu.exe
  C:\Windows\System\qGTJMlu.exe
  2⤵
  PID:6464
- C:\Windows\System\KlJIjSN.exe
  C:\Windows\System\KlJIjSN.exe
  2⤵
  PID:7132
- C:\Windows\System\eDzsxwl.exe
  C:\Windows\System\eDzsxwl.exe
  2⤵
  PID:6240
- C:\Windows\System\wzRCmxa.exe
  C:\Windows\System\wzRCmxa.exe
  2⤵
  PID:6432
- C:\Windows\System\JsjzMCL.exe
  C:\Windows\System\JsjzMCL.exe
  2⤵
  PID:6528
- C:\Windows\System\QiGjqLZ.exe
  C:\Windows\System\QiGjqLZ.exe
  2⤵
  PID:6592
- C:\Windows\System\nyXUtOL.exe
  C:\Windows\System\nyXUtOL.exe
  2⤵
  PID:6220
- C:\Windows\System\nKASPJD.exe
  C:\Windows\System\nKASPJD.exe
  2⤵
  PID:6256
- C:\Windows\System\zIOUNVj.exe
  C:\Windows\System\zIOUNVj.exe
  2⤵
  PID:6368
- C:\Windows\System\POlcYCk.exe
  C:\Windows\System\POlcYCk.exe
  2⤵
  PID:6300
- C:\Windows\System\wcePKKm.exe
  C:\Windows\System\wcePKKm.exe
  2⤵
  PID:6412
- C:\Windows\System\ySbuJHv.exe
  C:\Windows\System\ySbuJHv.exe
  2⤵
  PID:6728
- C:\Windows\System\IJQnPhD.exe
  C:\Windows\System\IJQnPhD.exe
  2⤵
  PID:6764
- C:\Windows\System\ADjPmks.exe
  C:\Windows\System\ADjPmks.exe
  2⤵
  PID:6816
- C:\Windows\System\fndUkDH.exe
  C:\Windows\System\fndUkDH.exe
  2⤵
  PID:6176
- C:\Windows\System\fXyjqdz.exe
  C:\Windows\System\fXyjqdz.exe
  2⤵
  PID:6672
- C:\Windows\System\NTMeZhE.exe
  C:\Windows\System\NTMeZhE.exe
  2⤵
  PID:6744
- C:\Windows\System\bvNMYcd.exe
  C:\Windows\System\bvNMYcd.exe
  2⤵
  PID:6788
- C:\Windows\System\XtkiVjO.exe
  C:\Windows\System\XtkiVjO.exe
  2⤵
  PID:6832
- C:\Windows\System\fwKCYpD.exe
  C:\Windows\System\fwKCYpD.exe
  2⤵
  PID:6916
- C:\Windows\System\HTBFIbI.exe
  C:\Windows\System\HTBFIbI.exe
  2⤵
  PID:7024
- C:\Windows\System\AoPKyDX.exe
  C:\Windows\System\AoPKyDX.exe
  2⤵
  PID:7080
- C:\Windows\System\QBMCcDv.exe
  C:\Windows\System\QBMCcDv.exe
  2⤵
  PID:7156
- C:\Windows\System\JefWgdn.exe
  C:\Windows\System\JefWgdn.exe
  2⤵
  PID:6196
- C:\Windows\System\yVLNYzu.exe
  C:\Windows\System\yVLNYzu.exe
  2⤵
  PID:6276
- C:\Windows\System\HjFxucL.exe
  C:\Windows\System\HjFxucL.exe
  2⤵
  PID:6576
- C:\Windows\System\ACBYcCL.exe
  C:\Windows\System\ACBYcCL.exe
  2⤵
  PID:5872
- C:\Windows\System\JkZIEnT.exe
  C:\Windows\System\JkZIEnT.exe
  2⤵
  PID:6512
- C:\Windows\System\erxSeXJ.exe
  C:\Windows\System\erxSeXJ.exe
  2⤵
  PID:7092
- C:\Windows\System\UXooQNU.exe
  C:\Windows\System\UXooQNU.exe
  2⤵
  PID:6452
- C:\Windows\System\WOOaaMj.exe
  C:\Windows\System\WOOaaMj.exe
  2⤵
  PID:6524
- C:\Windows\System\ZGRMGcf.exe
  C:\Windows\System\ZGRMGcf.exe
  2⤵
  PID:6216
- C:\Windows\System\KyDFKmr.exe
  C:\Windows\System\KyDFKmr.exe
  2⤵
  PID:1612
- C:\Windows\System\twktPlr.exe
  C:\Windows\System\twktPlr.exe
  2⤵
  PID:6460
- C:\Windows\System\XghXTmm.exe
  C:\Windows\System\XghXTmm.exe
  2⤵
  PID:6580
- C:\Windows\System\foaXzRx.exe
  C:\Windows\System\foaXzRx.exe
  2⤵
  PID:6716
- C:\Windows\System\RKunezh.exe
  C:\Windows\System\RKunezh.exe
  2⤵
  PID:5964
- C:\Windows\System\DqnBBzO.exe
  C:\Windows\System\DqnBBzO.exe
  2⤵
  PID:5644
- C:\Windows\System\jLtYDsV.exe
  C:\Windows\System\jLtYDsV.exe
  2⤵
  PID:6280
- C:\Windows\System\qrVGgkM.exe
  C:\Windows\System\qrVGgkM.exe
  2⤵
  PID:6956
- C:\Windows\System\UAmygkn.exe
  C:\Windows\System\UAmygkn.exe
  2⤵
  PID:6260
- C:\Windows\System\RzmBxwv.exe
  C:\Windows\System\RzmBxwv.exe
  2⤵
  PID:7016
- C:\Windows\System\dhMPSwY.exe
  C:\Windows\System\dhMPSwY.exe
  2⤵
  PID:1628
- C:\Windows\System\fwcBjeb.exe
  C:\Windows\System\fwcBjeb.exe
  2⤵
  PID:1860
- C:\Windows\System\cnBbKCt.exe
  C:\Windows\System\cnBbKCt.exe
  2⤵
  PID:6996
- C:\Windows\System\QLwDXjN.exe
  C:\Windows\System\QLwDXjN.exe
  2⤵
  PID:6984
- C:\Windows\System\gNUMqgq.exe
  C:\Windows\System\gNUMqgq.exe
  2⤵
  PID:7120
- C:\Windows\System\uwCpANl.exe
  C:\Windows\System\uwCpANl.exe
  2⤵
  PID:6156
- C:\Windows\System\dpLsaAU.exe
  C:\Windows\System\dpLsaAU.exe
  2⤵
  PID:7136
- C:\Windows\System\vjqUveR.exe
  C:\Windows\System\vjqUveR.exe
  2⤵
  PID:6312
- C:\Windows\System\wdoiapU.exe
  C:\Windows\System\wdoiapU.exe
  2⤵
  PID:7192
- C:\Windows\System\vfWqDZF.exe
  C:\Windows\System\vfWqDZF.exe
  2⤵
  PID:7216
- C:\Windows\System\DycNUzI.exe
  C:\Windows\System\DycNUzI.exe
  2⤵
  PID:7240
- C:\Windows\System\BOIvKTA.exe
  C:\Windows\System\BOIvKTA.exe
  2⤵
  PID:7256
- C:\Windows\System\qogFTRT.exe
  C:\Windows\System\qogFTRT.exe
  2⤵
  PID:7272
- C:\Windows\System\BxVackx.exe
  C:\Windows\System\BxVackx.exe
  2⤵
  PID:7292
- C:\Windows\System\JoUVEVd.exe
  C:\Windows\System\JoUVEVd.exe
  2⤵
  PID:7312
- C:\Windows\System\llnVxci.exe
  C:\Windows\System\llnVxci.exe
  2⤵
  PID:7336
- C:\Windows\System\flmxLfY.exe
  C:\Windows\System\flmxLfY.exe
  2⤵
  PID:7360
- C:\Windows\System\oITvKSA.exe
  C:\Windows\System\oITvKSA.exe
  2⤵
  PID:7380
- C:\Windows\System\WdeMYZc.exe
  C:\Windows\System\WdeMYZc.exe
  2⤵
  PID:7396
- C:\Windows\System\KktAdOG.exe
  C:\Windows\System\KktAdOG.exe
  2⤵
  PID:7412
- C:\Windows\System\SMKbQgP.exe
  C:\Windows\System\SMKbQgP.exe
  2⤵
  PID:7428
- C:\Windows\System\AbOESiO.exe
  C:\Windows\System\AbOESiO.exe
  2⤵
  PID:7444
- C:\Windows\System\wWTaXMc.exe
  C:\Windows\System\wWTaXMc.exe
  2⤵
  PID:7468
- C:\Windows\System\jqnAXSK.exe
  C:\Windows\System\jqnAXSK.exe
  2⤵
  PID:7492
- C:\Windows\System\Iakraiw.exe
  C:\Windows\System\Iakraiw.exe
  2⤵
  PID:7512
- C:\Windows\System\ylQSzoK.exe
  C:\Windows\System\ylQSzoK.exe
  2⤵
  PID:7528
- C:\Windows\System\JkOnVqW.exe
  C:\Windows\System\JkOnVqW.exe
  2⤵
  PID:7544
- C:\Windows\System\ifeZbDB.exe
  C:\Windows\System\ifeZbDB.exe
  2⤵
  PID:7560
- C:\Windows\System\rNpSOyp.exe
  C:\Windows\System\rNpSOyp.exe
  2⤵
  PID:7580
- C:\Windows\System\WjYOVmm.exe
  C:\Windows\System\WjYOVmm.exe
  2⤵
  PID:7600
- C:\Windows\System\oGiRSSZ.exe
  C:\Windows\System\oGiRSSZ.exe
  2⤵
  PID:7628
- C:\Windows\System\UsxJawI.exe
  C:\Windows\System\UsxJawI.exe
  2⤵
  PID:7644
- C:\Windows\System\qomPtjz.exe
  C:\Windows\System\qomPtjz.exe
  2⤵
  PID:7664
- C:\Windows\System\DGxZZQb.exe
  C:\Windows\System\DGxZZQb.exe
  2⤵
  PID:7684
- C:\Windows\System\yVbUHyv.exe
  C:\Windows\System\yVbUHyv.exe
  2⤵
  PID:7708
- C:\Windows\System\RSPBxXB.exe
  C:\Windows\System\RSPBxXB.exe
  2⤵
  PID:7724
- C:\Windows\System\JXdBNdL.exe
  C:\Windows\System\JXdBNdL.exe
  2⤵
  PID:7748
- C:\Windows\System\BfDaxqM.exe
  C:\Windows\System\BfDaxqM.exe
  2⤵
  PID:7764
- C:\Windows\System\epgdwTf.exe
  C:\Windows\System\epgdwTf.exe
  2⤵
  PID:7784
- C:\Windows\System\MnlFkfw.exe
  C:\Windows\System\MnlFkfw.exe
  2⤵
  PID:7824
- C:\Windows\System\UrfQOvC.exe
  C:\Windows\System\UrfQOvC.exe
  2⤵
  PID:7860
- C:\Windows\System\MuwGwTw.exe
  C:\Windows\System\MuwGwTw.exe
  2⤵
  PID:7876
- C:\Windows\System\VDSvquv.exe
  C:\Windows\System\VDSvquv.exe
  2⤵
  PID:7892
- C:\Windows\System\gNmwtpC.exe
  C:\Windows\System\gNmwtpC.exe
  2⤵
  PID:7908
- C:\Windows\System\UcrNCuD.exe
  C:\Windows\System\UcrNCuD.exe
  2⤵
  PID:7932
- C:\Windows\System\jFrAijz.exe
  C:\Windows\System\jFrAijz.exe
  2⤵
  PID:7952
- C:\Windows\System\LtpMitf.exe
  C:\Windows\System\LtpMitf.exe
  2⤵
  PID:7972
- C:\Windows\System\ZNETuNF.exe
  C:\Windows\System\ZNETuNF.exe
  2⤵
  PID:7992
- C:\Windows\System\cPVqVqd.exe
  C:\Windows\System\cPVqVqd.exe
  2⤵
  PID:8012
- C:\Windows\System\cifXWGY.exe
  C:\Windows\System\cifXWGY.exe
  2⤵
  PID:8032
- C:\Windows\System\mlDZBoo.exe
  C:\Windows\System\mlDZBoo.exe
  2⤵
  PID:8052
- C:\Windows\System\MOQmyjd.exe
  C:\Windows\System\MOQmyjd.exe
  2⤵
  PID:8068
- C:\Windows\System\bZWfCNQ.exe
  C:\Windows\System\bZWfCNQ.exe
  2⤵
  PID:8084
- C:\Windows\System\BgypTiM.exe
  C:\Windows\System\BgypTiM.exe
  2⤵
  PID:8100
- C:\Windows\System\APnTrGN.exe
  C:\Windows\System\APnTrGN.exe
  2⤵
  PID:8116
- C:\Windows\System\YCjnijy.exe
  C:\Windows\System\YCjnijy.exe
  2⤵
  PID:8132
- C:\Windows\System\tWBWtpE.exe
  C:\Windows\System\tWBWtpE.exe
  2⤵
  PID:8148
- C:\Windows\System\EkeuIDB.exe
  C:\Windows\System\EkeuIDB.exe
  2⤵
  PID:8168
- C:\Windows\System\JRfLMTB.exe
  C:\Windows\System\JRfLMTB.exe
  2⤵
  PID:8184
- C:\Windows\System\uTTgNkD.exe
  C:\Windows\System\uTTgNkD.exe
  2⤵
  PID:7180
- C:\Windows\System\hefejxo.exe
  C:\Windows\System\hefejxo.exe
  2⤵
  PID:6504
- C:\Windows\System\NmsRrZG.exe
  C:\Windows\System\NmsRrZG.exe
  2⤵
  PID:7232
- C:\Windows\System\INAVlco.exe
  C:\Windows\System\INAVlco.exe
  2⤵
  PID:7072
- C:\Windows\System\GUyWAOf.exe
  C:\Windows\System\GUyWAOf.exe
  2⤵
  PID:7300
- C:\Windows\System\lhVxMrQ.exe
  C:\Windows\System\lhVxMrQ.exe
  2⤵
  PID:7344
- C:\Windows\System\uXyNpxI.exe
  C:\Windows\System\uXyNpxI.exe
  2⤵
  PID:6388
- C:\Windows\System\MEAGllP.exe
  C:\Windows\System\MEAGllP.exe
  2⤵
  PID:7356
- C:\Windows\System\BoqvGRs.exe
  C:\Windows\System\BoqvGRs.exe
  2⤵
  PID:6616
- C:\Windows\System\hmuLUBS.exe
  C:\Windows\System\hmuLUBS.exe
  2⤵
  PID:7252
- C:\Windows\System\yhEuehM.exe
  C:\Windows\System\yhEuehM.exe
  2⤵
  PID:6060
- C:\Windows\System\HjLvobw.exe
  C:\Windows\System\HjLvobw.exe
  2⤵
  PID:6936
- C:\Windows\System\HoGqzym.exe
  C:\Windows\System\HoGqzym.exe
  2⤵
  PID:7204
- C:\Windows\System\yuZTMFP.exe
  C:\Windows\System\yuZTMFP.exe
  2⤵
  PID:7456
- C:\Windows\System\CgmlEKZ.exe
  C:\Windows\System\CgmlEKZ.exe
  2⤵
  PID:6976
- C:\Windows\System\FeIijZK.exe
  C:\Windows\System\FeIijZK.exe
  2⤵
  PID:6828
- C:\Windows\System\yrfuUCx.exe
  C:\Windows\System\yrfuUCx.exe
  2⤵
  PID:7536
- C:\Windows\System\AAjNPKj.exe
  C:\Windows\System\AAjNPKj.exe
  2⤵
  PID:2424
- C:\Windows\System\yzowHiJ.exe
  C:\Windows\System\yzowHiJ.exe
  2⤵
  PID:7200
- C:\Windows\System\mWACjGk.exe
  C:\Windows\System\mWACjGk.exe
  2⤵
  PID:7624
- C:\Windows\System\XaFvdpE.exe
  C:\Windows\System\XaFvdpE.exe
  2⤵
  PID:7288
- C:\Windows\System\ijiskpc.exe
  C:\Windows\System\ijiskpc.exe
  2⤵
  PID:7700
- C:\Windows\System\IncGmHd.exe
  C:\Windows\System\IncGmHd.exe
  2⤵
  PID:7740
- C:\Windows\System\AAsQKYR.exe
  C:\Windows\System\AAsQKYR.exe
  2⤵
  PID:7524
- C:\Windows\System\KJrtbnJ.exe
  C:\Windows\System\KJrtbnJ.exe
  2⤵
  PID:7592
- C:\Windows\System\VNwPtkH.exe
  C:\Windows\System\VNwPtkH.exe
  2⤵
  PID:7672
- C:\Windows\System\GqEDzNx.exe
  C:\Windows\System\GqEDzNx.exe
  2⤵
  PID:7716
- C:\Windows\System\AErgPWT.exe
  C:\Windows\System\AErgPWT.exe
  2⤵
  PID:7792
- C:\Windows\System\wtbwFCD.exe
  C:\Windows\System\wtbwFCD.exe
  2⤵
  PID:7812
- C:\Windows\System\WfIhlpf.exe
  C:\Windows\System\WfIhlpf.exe
  2⤵
  PID:7836
- C:\Windows\System\mgyralo.exe
  C:\Windows\System\mgyralo.exe
  2⤵
  PID:7916
- C:\Windows\System\iSSHTqh.exe
  C:\Windows\System\iSSHTqh.exe
  2⤵
  PID:7928
- C:\Windows\System\GRuNAmL.exe
  C:\Windows\System\GRuNAmL.exe
  2⤵
  PID:7944
- C:\Windows\System\zMXsJAF.exe
  C:\Windows\System\zMXsJAF.exe
  2⤵
  PID:7904
- C:\Windows\System\NRutqrx.exe
  C:\Windows\System\NRutqrx.exe
  2⤵
  PID:8044
- C:\Windows\System\jESaomE.exe
  C:\Windows\System\jESaomE.exe
  2⤵
  PID:8080
- C:\Windows\System\VLoOCmf.exe
  C:\Windows\System\VLoOCmf.exe
  2⤵
  PID:8144
- C:\Windows\System\gNkuCjx.exe
  C:\Windows\System\gNkuCjx.exe
  2⤵
  PID:8092
- C:\Windows\System\fFECoQm.exe
  C:\Windows\System\fFECoQm.exe
  2⤵
  PID:8160
- C:\Windows\System\MAXclri.exe
  C:\Windows\System\MAXclri.exe
  2⤵
  PID:6416
- C:\Windows\System\llTZpsj.exe
  C:\Windows\System\llTZpsj.exe
  2⤵
  PID:6668
- C:\Windows\System\VvwiSVl.exe
  C:\Windows\System\VvwiSVl.exe
  2⤵
  PID:6700
- C:\Windows\System\WxOxbIc.exe
  C:\Windows\System\WxOxbIc.exe
  2⤵
  PID:6872
- C:\Windows\System\dnRIIYg.exe
  C:\Windows\System\dnRIIYg.exe
  2⤵
  PID:6880
- C:\Windows\System\yiyUDhG.exe
  C:\Windows\System\yiyUDhG.exe
  2⤵
  PID:6600
- C:\Windows\System\emStJzh.exe
  C:\Windows\System\emStJzh.exe
  2⤵
  PID:7420
- C:\Windows\System\bBaENLK.exe
  C:\Windows\System\bBaENLK.exe
  2⤵
  PID:6892
- C:\Windows\System\fuRLnhd.exe
  C:\Windows\System\fuRLnhd.exe
  2⤵
  PID:7612
- C:\Windows\System\yKRElVj.exe
  C:\Windows\System\yKRElVj.exe
  2⤵
  PID:7692
- C:\Windows\System\jwuZcok.exe
  C:\Windows\System\jwuZcok.exe
  2⤵
  PID:7776
- C:\Windows\System\duxCeNj.exe
  C:\Windows\System\duxCeNj.exe
  2⤵
  PID:7068
- C:\Windows\System\nayYFVV.exe
  C:\Windows\System\nayYFVV.exe
  2⤵
  PID:7452
- C:\Windows\System\vlhocWL.exe
  C:\Windows\System\vlhocWL.exe
  2⤵
  PID:7656
- C:\Windows\System\sOyLpTu.exe
  C:\Windows\System\sOyLpTu.exe
  2⤵
  PID:7284
- C:\Windows\System\lJgPAvW.exe
  C:\Windows\System\lJgPAvW.exe
  2⤵
  PID:7480
- C:\Windows\System\yJCzSdr.exe
  C:\Windows\System\yJCzSdr.exe
  2⤵
  PID:7636
- C:\Windows\System\flwydaf.exe
  C:\Windows\System\flwydaf.exe
  2⤵
  PID:7704
- C:\Windows\System\ltlxCIq.exe
  C:\Windows\System\ltlxCIq.exe
  2⤵
  PID:7800
- C:\Windows\System\RYEKkgI.exe
  C:\Windows\System\RYEKkgI.exe
  2⤵
  PID:7848
- C:\Windows\System\xMmGNwZ.exe
  C:\Windows\System\xMmGNwZ.exe
  2⤵
  PID:7924
- C:\Windows\System\IWIkICI.exe
  C:\Windows\System\IWIkICI.exe
  2⤵
  PID:7840
- C:\Windows\System\IqYMSTj.exe
  C:\Windows\System\IqYMSTj.exe
  2⤵
  PID:7884
- C:\Windows\System\ksKJfre.exe
  C:\Windows\System\ksKJfre.exe
  2⤵
  PID:7940
- C:\Windows\System\iKSrkDc.exe
  C:\Windows\System\iKSrkDc.exe
  2⤵
  PID:7948
- C:\Windows\System\ItmpBQl.exe
  C:\Windows\System\ItmpBQl.exe
  2⤵
  PID:8020
- C:\Windows\System\ZIFRfQR.exe
  C:\Windows\System\ZIFRfQR.exe
  2⤵
  PID:8128
- C:\Windows\System\wcocByN.exe
  C:\Windows\System\wcocByN.exe
  2⤵
  PID:6332
- C:\Windows\System\yZJtDfm.exe
  C:\Windows\System\yZJtDfm.exe
  2⤵
  PID:7236
- C:\Windows\System\YvfRqMO.exe
  C:\Windows\System\YvfRqMO.exe
  2⤵
  PID:7780
- C:\Windows\System\mYrRctD.exe
  C:\Windows\System\mYrRctD.exe
  2⤵
  PID:6840
- C:\Windows\System\PbVmDeU.exe
  C:\Windows\System\PbVmDeU.exe
  2⤵
  PID:7308
- C:\Windows\System\xXxfnII.exe
  C:\Windows\System\xXxfnII.exe
  2⤵
  PID:7620
- C:\Windows\System\MxYJSRN.exe
  C:\Windows\System\MxYJSRN.exe
  2⤵
  PID:7464
- C:\Windows\System\wsQTNEv.exe
  C:\Windows\System\wsQTNEv.exe
  2⤵
  PID:7732
- C:\Windows\System\OQkyUse.exe
  C:\Windows\System\OQkyUse.exe
  2⤵
  PID:7328
- C:\Windows\System\kJEvydF.exe
  C:\Windows\System\kJEvydF.exe
  2⤵
  PID:7376
- C:\Windows\System\uElDNnu.exe
  C:\Windows\System\uElDNnu.exe
  2⤵
  PID:7856
- C:\Windows\System\EoHEwpT.exe
  C:\Windows\System\EoHEwpT.exe
  2⤵
  PID:7556
- C:\Windows\System\pwyNRxy.exe
  C:\Windows\System\pwyNRxy.exe
  2⤵
  PID:7820
- C:\Windows\System\bnBGNIw.exe
  C:\Windows\System\bnBGNIw.exe
  2⤵
  PID:6328
- C:\Windows\System\VQOyaHS.exe
  C:\Windows\System\VQOyaHS.exe
  2⤵
  PID:7760
- C:\Windows\System\Qsdtwwa.exe
  C:\Windows\System\Qsdtwwa.exe
  2⤵
  PID:8004
- C:\Windows\System\NftplMM.exe
  C:\Windows\System\NftplMM.exe
  2⤵
  PID:6336
- C:\Windows\System\ywjFGWZ.exe
  C:\Windows\System\ywjFGWZ.exe
  2⤵
  PID:7268
- C:\Windows\System\mmQMVGy.exe
  C:\Windows\System\mmQMVGy.exe
  2⤵
  PID:7304
- C:\Windows\System\cTkrnkD.exe
  C:\Windows\System\cTkrnkD.exe
  2⤵
  PID:7484
- C:\Windows\System\vRJSStE.exe
  C:\Windows\System\vRJSStE.exe
  2⤵
  PID:1816
- C:\Windows\System\bkNwOXW.exe
  C:\Windows\System\bkNwOXW.exe
  2⤵
  PID:8048
- C:\Windows\System\EqFQmmz.exe
  C:\Windows\System\EqFQmmz.exe
  2⤵
  PID:7968
- C:\Windows\System\jrNfKRA.exe
  C:\Windows\System\jrNfKRA.exe
  2⤵
  PID:6540
- C:\Windows\System\MKXBzNj.exe
  C:\Windows\System\MKXBzNj.exe
  2⤵
  PID:7188
- C:\Windows\System\ylKcvNw.exe
  C:\Windows\System\ylKcvNw.exe
  2⤵
  PID:7324
- C:\Windows\System\Gitzean.exe
  C:\Windows\System\Gitzean.exe
  2⤵
  PID:6952
- C:\Windows\System\FOZPHEJ.exe
  C:\Windows\System\FOZPHEJ.exe
  2⤵
  PID:8208
- C:\Windows\System\tGoBgJg.exe
  C:\Windows\System\tGoBgJg.exe
  2⤵
  PID:8232
- C:\Windows\System\viMmBGg.exe
  C:\Windows\System\viMmBGg.exe
  2⤵
  PID:8248
- C:\Windows\System\mbhymfe.exe
  C:\Windows\System\mbhymfe.exe
  2⤵
  PID:8264
- C:\Windows\System\VjBUXAz.exe
  C:\Windows\System\VjBUXAz.exe
  2⤵
  PID:8280
- C:\Windows\System\UOpXdQL.exe
  C:\Windows\System\UOpXdQL.exe
  2⤵
  PID:8296
- C:\Windows\System\djRZeMG.exe
  C:\Windows\System\djRZeMG.exe
  2⤵
  PID:8312
- C:\Windows\System\vxchyQq.exe
  C:\Windows\System\vxchyQq.exe
  2⤵
  PID:8336
- C:\Windows\System\ftzgKAZ.exe
  C:\Windows\System\ftzgKAZ.exe
  2⤵
  PID:8360
- C:\Windows\System\GtWvdSG.exe
  C:\Windows\System\GtWvdSG.exe
  2⤵
  PID:8384
- C:\Windows\System\nAtLSQx.exe
  C:\Windows\System\nAtLSQx.exe
  2⤵
  PID:8400
- C:\Windows\System\oMbFxcr.exe
  C:\Windows\System\oMbFxcr.exe
  2⤵
  PID:8420
- C:\Windows\System\QKcRQjR.exe
  C:\Windows\System\QKcRQjR.exe
  2⤵
  PID:8440
- C:\Windows\System\FKeeEio.exe
  C:\Windows\System\FKeeEio.exe
  2⤵
  PID:8464
- C:\Windows\System\bdddVKq.exe
  C:\Windows\System\bdddVKq.exe
  2⤵
  PID:8480
- C:\Windows\System\oHFvVvs.exe
  C:\Windows\System\oHFvVvs.exe
  2⤵
  PID:8512
- C:\Windows\System\gcgNOTk.exe
  C:\Windows\System\gcgNOTk.exe
  2⤵
  PID:8532
- C:\Windows\System\wrgarQC.exe
  C:\Windows\System\wrgarQC.exe
  2⤵
  PID:8552
- C:\Windows\System\NDtDmgv.exe
  C:\Windows\System\NDtDmgv.exe
  2⤵
  PID:8576
- C:\Windows\System\vXbMJHO.exe
  C:\Windows\System\vXbMJHO.exe
  2⤵
  PID:8592
- C:\Windows\System\QAQuXTr.exe
  C:\Windows\System\QAQuXTr.exe
  2⤵
  PID:8612
- C:\Windows\System\fRZrJXO.exe
  C:\Windows\System\fRZrJXO.exe
  2⤵
  PID:8632
- C:\Windows\System\GKDZRch.exe
  C:\Windows\System\GKDZRch.exe
  2⤵
  PID:8648
- C:\Windows\System\PQrpxTt.exe
  C:\Windows\System\PQrpxTt.exe
  2⤵
  PID:8668
- C:\Windows\System\NctTsPq.exe
  C:\Windows\System\NctTsPq.exe
  2⤵
  PID:8684
- C:\Windows\System\CQxAWfF.exe
  C:\Windows\System\CQxAWfF.exe
  2⤵
  PID:8700
- C:\Windows\System\PCMzqmS.exe
  C:\Windows\System\PCMzqmS.exe
  2⤵
  PID:8720
- C:\Windows\System\sgTnYUT.exe
  C:\Windows\System\sgTnYUT.exe
  2⤵
  PID:8736
- C:\Windows\System\bZgozkm.exe
  C:\Windows\System\bZgozkm.exe
  2⤵
  PID:8752
- C:\Windows\System\dVQpvOo.exe
  C:\Windows\System\dVQpvOo.exe
  2⤵
  PID:8772
- C:\Windows\System\dpheIMP.exe
  C:\Windows\System\dpheIMP.exe
  2⤵
  PID:8788
- C:\Windows\System\Uhqpocy.exe
  C:\Windows\System\Uhqpocy.exe
  2⤵
  PID:8804
- C:\Windows\System\LNrVpuZ.exe
  C:\Windows\System\LNrVpuZ.exe
  2⤵
  PID:8820
- C:\Windows\System\WhuKemQ.exe
  C:\Windows\System\WhuKemQ.exe
  2⤵
  PID:8836
- C:\Windows\System\wSfVDPm.exe
  C:\Windows\System\wSfVDPm.exe
  2⤵
  PID:8852
- C:\Windows\System\wDqWRaZ.exe
  C:\Windows\System\wDqWRaZ.exe
  2⤵
  PID:8868
- C:\Windows\System\UseqElQ.exe
  C:\Windows\System\UseqElQ.exe
  2⤵
  PID:8884
- C:\Windows\System\IIWdKEn.exe
  C:\Windows\System\IIWdKEn.exe
  2⤵
  PID:8900
- C:\Windows\System\UNiKuku.exe
  C:\Windows\System\UNiKuku.exe
  2⤵
  PID:8916
- C:\Windows\System\mvyRaOk.exe
  C:\Windows\System\mvyRaOk.exe
  2⤵
  PID:8932
- C:\Windows\System\fcotAcN.exe
  C:\Windows\System\fcotAcN.exe
  2⤵
  PID:8948
- C:\Windows\System\rbaNqZB.exe
  C:\Windows\System\rbaNqZB.exe
  2⤵
  PID:8964
- C:\Windows\System\ylLAXzp.exe
  C:\Windows\System\ylLAXzp.exe
  2⤵
  PID:8980
- C:\Windows\System\mzBguUM.exe
  C:\Windows\System\mzBguUM.exe
  2⤵
  PID:8996
- C:\Windows\System\DiBEAZx.exe
  C:\Windows\System\DiBEAZx.exe
  2⤵
  PID:9012
- C:\Windows\System\XGphDcA.exe
  C:\Windows\System\XGphDcA.exe
  2⤵
  PID:9032
- C:\Windows\System\wXPNBZl.exe
  C:\Windows\System\wXPNBZl.exe
  2⤵
  PID:9048
- C:\Windows\System\vmwnOjm.exe
  C:\Windows\System\vmwnOjm.exe
  2⤵
  PID:9064
- C:\Windows\System\uBYMrER.exe
  C:\Windows\System\uBYMrER.exe
  2⤵
  PID:9080
- C:\Windows\System\WBVCIOd.exe
  C:\Windows\System\WBVCIOd.exe
  2⤵
  PID:6552
- C:\Windows\System\ujQmOXd.exe
  C:\Windows\System\ujQmOXd.exe
  2⤵
  PID:7984
- C:\Windows\System\PxMjwKe.exe
  C:\Windows\System\PxMjwKe.exe
  2⤵
  PID:7228
- C:\Windows\System\bwAnpxS.exe
  C:\Windows\System\bwAnpxS.exe
  2⤵
  PID:7504
- C:\Windows\System\glgSNWT.exe
  C:\Windows\System\glgSNWT.exe
  2⤵
  PID:8176
- C:\Windows\System\gzaUmTc.exe
  C:\Windows\System\gzaUmTc.exe
  2⤵
  PID:8244
- C:\Windows\System\pPdDzgo.exe
  C:\Windows\System\pPdDzgo.exe
  2⤵
  PID:8276
- C:\Windows\System\wxIcVWl.exe
  C:\Windows\System\wxIcVWl.exe
  2⤵
  PID:8348
- C:\Windows\System\FsiIUZZ.exe
  C:\Windows\System\FsiIUZZ.exe
  2⤵
  PID:8436
- C:\Windows\System\KzXKxKL.exe
  C:\Windows\System\KzXKxKL.exe
  2⤵
  PID:8520
- C:\Windows\System\wQTrGCi.exe
  C:\Windows\System\wQTrGCi.exe
  2⤵
  PID:8568
- C:\Windows\System\ghuVrVv.exe
  C:\Windows\System\ghuVrVv.exe
  2⤵
  PID:8604
- C:\Windows\System\LhYKpBU.exe
  C:\Windows\System\LhYKpBU.exe
  2⤵
  PID:8664
- C:\Windows\System\rKkIcCT.exe
  C:\Windows\System\rKkIcCT.exe
  2⤵
  PID:8680
- C:\Windows\System\VaoNmTX.exe
  C:\Windows\System\VaoNmTX.exe
  2⤵
  PID:8292
- C:\Windows\System\pLTvkLi.exe
  C:\Windows\System\pLTvkLi.exe
  2⤵
  PID:8716
- C:\Windows\System\vtBUYiW.exe
  C:\Windows\System\vtBUYiW.exe
  2⤵
  PID:8448
- C:\Windows\System\FUvYJma.exe
  C:\Windows\System\FUvYJma.exe
  2⤵
  PID:8372
- C:\Windows\System\fRklVZX.exe
  C:\Windows\System\fRklVZX.exe
  2⤵
  PID:8416
- C:\Windows\System\BKmhDTv.exe
  C:\Windows\System\BKmhDTv.exe
  2⤵
  PID:8496
- C:\Windows\System\gFmoXdZ.exe
  C:\Windows\System\gFmoXdZ.exe
  2⤵
  PID:8540
- C:\Windows\System\aRwtZcx.exe
  C:\Windows\System\aRwtZcx.exe
  2⤵
  PID:8588
- C:\Windows\System\BxSMLWt.exe
  C:\Windows\System\BxSMLWt.exe
  2⤵
  PID:8656
- C:\Windows\System\TDQtVdG.exe
  C:\Windows\System\TDQtVdG.exe
  2⤵
  PID:8728
- C:\Windows\System\bZzGKSo.exe
  C:\Windows\System\bZzGKSo.exe
  2⤵
  PID:8768
- C:\Windows\System\CWwGqVw.exe
  C:\Windows\System\CWwGqVw.exe
  2⤵
  PID:8800
- C:\Windows\System\mgqLxdc.exe
  C:\Windows\System\mgqLxdc.exe
  2⤵
  PID:8848
- C:\Windows\System\NyONPHy.exe
  C:\Windows\System\NyONPHy.exe
  2⤵
  PID:8908
- C:\Windows\System\sMJLfwQ.exe
  C:\Windows\System\sMJLfwQ.exe
  2⤵
  PID:8972
- C:\Windows\System\gMAzGPa.exe
  C:\Windows\System\gMAzGPa.exe
  2⤵
  PID:2268
- C:\Windows\System\PGKUFaa.exe
  C:\Windows\System\PGKUFaa.exe
  2⤵
  PID:9040
- C:\Windows\System\rkHBWmz.exe
  C:\Windows\System\rkHBWmz.exe
  2⤵
  PID:8988
- C:\Windows\System\FuZSWko.exe
  C:\Windows\System\FuZSWko.exe
  2⤵
  PID:8864
- C:\Windows\System\kdriAfg.exe
  C:\Windows\System\kdriAfg.exe
  2⤵
  PID:8928
- C:\Windows\System\mAllicK.exe
  C:\Windows\System\mAllicK.exe
  2⤵
  PID:9020
- C:\Windows\System\QgfAPNM.exe
  C:\Windows\System\QgfAPNM.exe
  2⤵
  PID:9088
- C:\Windows\System\vDmrbtJ.exe
  C:\Windows\System\vDmrbtJ.exe
  2⤵
  PID:9104
- C:\Windows\System\XHUnVYu.exe
  C:\Windows\System\XHUnVYu.exe
  2⤵
  PID:9120
- C:\Windows\System\msvscMT.exe
  C:\Windows\System\msvscMT.exe
  2⤵
  PID:9136
- C:\Windows\System\rbFeFQr.exe
  C:\Windows\System\rbFeFQr.exe
  2⤵
  PID:9152
- C:\Windows\System\QrxqusS.exe
  C:\Windows\System\QrxqusS.exe
  2⤵
  PID:9164
- C:\Windows\System\QqezQgJ.exe
  C:\Windows\System\QqezQgJ.exe
  2⤵
  PID:9184
- C:\Windows\System\UADJkcR.exe
  C:\Windows\System\UADJkcR.exe
  2⤵
  PID:9200
- C:\Windows\System\vBTdtzk.exe
  C:\Windows\System\vBTdtzk.exe
  2⤵
  PID:7224
- C:\Windows\System\yduchMU.exe
  C:\Windows\System\yduchMU.exe
  2⤵
  PID:2904
- C:\Windows\System\oTrTXHm.exe
  C:\Windows\System\oTrTXHm.exe
  2⤵
  PID:2684
- C:\Windows\System\FNucLTw.exe
  C:\Windows\System\FNucLTw.exe
  2⤵
  PID:8060
- C:\Windows\System\LVFRfxi.exe
  C:\Windows\System\LVFRfxi.exe
  2⤵
  PID:8064
- C:\Windows\System\rWRkaOE.exe
  C:\Windows\System\rWRkaOE.exe
  2⤵
  PID:8204
- C:\Windows\System\mnljUjU.exe
  C:\Windows\System\mnljUjU.exe
  2⤵
  PID:8352
- C:\Windows\System\zKdNSWv.exe
  C:\Windows\System\zKdNSWv.exe
  2⤵
  PID:8528
- C:\Windows\System\SXDXudk.exe
  C:\Windows\System\SXDXudk.exe
  2⤵
  PID:8708
- C:\Windows\System\tGuSSJJ.exe
  C:\Windows\System\tGuSSJJ.exe
  2⤵
  PID:8492
- C:\Windows\System\IGzpNTY.exe
  C:\Windows\System\IGzpNTY.exe
  2⤵
  PID:8660
- C:\Windows\System\huCvVEj.exe
  C:\Windows\System\huCvVEj.exe
  2⤵
  PID:8880
- C:\Windows\System\NPCcRWX.exe
  C:\Windows\System\NPCcRWX.exe
  2⤵
  PID:9056
- C:\Windows\System\JbYIyiL.exe
  C:\Windows\System\JbYIyiL.exe
  2⤵
  PID:9076
- C:\Windows\System\fIYAuWt.exe
  C:\Windows\System\fIYAuWt.exe
  2⤵
  PID:9148
- C:\Windows\System\PsyhbYs.exe
  C:\Windows\System\PsyhbYs.exe
  2⤵
  PID:9212
- C:\Windows\System\kMZfjlt.exe
  C:\Windows\System\kMZfjlt.exe
  2⤵
  PID:8640
- C:\Windows\System\cVskisV.exe
  C:\Windows\System\cVskisV.exe
  2⤵
  PID:8644
- C:\Windows\System\yinrUDF.exe
  C:\Windows\System\yinrUDF.exe
  2⤵
  PID:9124
- C:\Windows\System\wWWGikN.exe
  C:\Windows\System\wWWGikN.exe
  2⤵
  PID:8560
- C:\Windows\System\qYNXYJk.exe
  C:\Windows\System\qYNXYJk.exe
  2⤵
  PID:2660
- C:\Windows\System\xKAguJu.exe
  C:\Windows\System\xKAguJu.exe
  2⤵
  PID:9116
- C:\Windows\System\hJBoBOe.exe
  C:\Windows\System\hJBoBOe.exe
  2⤵
  PID:8924
- C:\Windows\System\czuhMoj.exe
  C:\Windows\System\czuhMoj.exe
  2⤵
  PID:8408
- C:\Windows\System\sRdCHUb.exe
  C:\Windows\System\sRdCHUb.exe
  2⤵
  PID:8764
- C:\Windows\System\YaIxEou.exe
  C:\Windows\System\YaIxEou.exe
  2⤵
  PID:8584
- C:\Windows\System\AyRBKKo.exe
  C:\Windows\System\AyRBKKo.exe
  2⤵
  PID:9096
- C:\Windows\System\ZnAOotZ.exe
  C:\Windows\System\ZnAOotZ.exe
  2⤵
  PID:9196
- C:\Windows\System\Yhthedv.exe
  C:\Windows\System\Yhthedv.exe
  2⤵
  PID:8224
- C:\Windows\System\BDyWhEH.exe
  C:\Windows\System\BDyWhEH.exe
  2⤵
  PID:8876
- C:\Windows\System\ewfgfOL.exe
  C:\Windows\System\ewfgfOL.exe
  2⤵
  PID:9208
- C:\Windows\System\IFsrOBG.exe
  C:\Windows\System\IFsrOBG.exe
  2⤵
  PID:8628
- C:\Windows\System\MLXctLw.exe
  C:\Windows\System\MLXctLw.exe
  2⤵
  PID:8376
- C:\Windows\System\DyOiDFO.exe
  C:\Windows\System\DyOiDFO.exe
  2⤵
  PID:8992
- C:\Windows\System\HvnCqaz.exe
  C:\Windows\System\HvnCqaz.exe
  2⤵
  PID:8780
- C:\Windows\System\gnJmIQe.exe
  C:\Windows\System\gnJmIQe.exe
  2⤵
  PID:8288
- C:\Windows\System\JGknvmw.exe
  C:\Windows\System\JGknvmw.exe
  2⤵
  PID:8860
- C:\Windows\System\LAqBAWY.exe
  C:\Windows\System\LAqBAWY.exe
  2⤵
  PID:8428
- C:\Windows\System\QFYqQek.exe
  C:\Windows\System\QFYqQek.exe
  2⤵
  PID:7212
- C:\Windows\System\YELMReB.exe
  C:\Windows\System\YELMReB.exe
  2⤵
  PID:8748
- C:\Windows\System\wJDkvXM.exe
  C:\Windows\System\wJDkvXM.exe
  2⤵
  PID:8260
- C:\Windows\System\teAckOC.exe
  C:\Windows\System\teAckOC.exe
  2⤵
  PID:7964
- C:\Windows\System\FcKSRCx.exe
  C:\Windows\System\FcKSRCx.exe
  2⤵
  PID:9112
- C:\Windows\System\QjFpElT.exe
  C:\Windows\System\QjFpElT.exe
  2⤵
  PID:8548
- C:\Windows\System\HPviitG.exe
  C:\Windows\System\HPviitG.exe
  2⤵
  PID:8240
- C:\Windows\System\zZMmoMD.exe
  C:\Windows\System\zZMmoMD.exe
  2⤵
  PID:8344
- C:\Windows\System\iDtnsvO.exe
  C:\Windows\System\iDtnsvO.exe
  2⤵
  PID:7404
- C:\Windows\System\ubdSTRT.exe
  C:\Windows\System\ubdSTRT.exe
  2⤵
  PID:9228
- C:\Windows\System\FutCfaR.exe
  C:\Windows\System\FutCfaR.exe
  2⤵
  PID:9248
- C:\Windows\System\rZFXNuX.exe
  C:\Windows\System\rZFXNuX.exe
  2⤵
  PID:9264
- C:\Windows\System\MmbOomr.exe
  C:\Windows\System\MmbOomr.exe
  2⤵
  PID:9280
- C:\Windows\System\mLANsdP.exe
  C:\Windows\System\mLANsdP.exe
  2⤵
  PID:9296
- C:\Windows\System\aCrHhTx.exe
  C:\Windows\System\aCrHhTx.exe
  2⤵
  PID:9312
- C:\Windows\System\MdWfJuP.exe
  C:\Windows\System\MdWfJuP.exe
  2⤵
  PID:9328
- C:\Windows\System\ELmsEGF.exe
  C:\Windows\System\ELmsEGF.exe
  2⤵
  PID:9344
- C:\Windows\System\BpvEkWE.exe
  C:\Windows\System\BpvEkWE.exe
  2⤵
  PID:9360
- C:\Windows\System\bFooPdn.exe
  C:\Windows\System\bFooPdn.exe
  2⤵
  PID:9376
- C:\Windows\System\HOtCALv.exe
  C:\Windows\System\HOtCALv.exe
  2⤵
  PID:9392
- C:\Windows\System\vvAShGd.exe
  C:\Windows\System\vvAShGd.exe
  2⤵
  PID:9408
- C:\Windows\System\GTpuqGI.exe
  C:\Windows\System\GTpuqGI.exe
  2⤵
  PID:9428
- C:\Windows\System\mUTYtxL.exe
  C:\Windows\System\mUTYtxL.exe
  2⤵
  PID:9448
- C:\Windows\System\aShJecp.exe
  C:\Windows\System\aShJecp.exe
  2⤵
  PID:9468
- C:\Windows\System\qITrlFn.exe
  C:\Windows\System\qITrlFn.exe
  2⤵
  PID:9492
- C:\Windows\System\XfWYYSJ.exe
  C:\Windows\System\XfWYYSJ.exe
  2⤵
  PID:9512
- C:\Windows\System\uZpWIkD.exe
  C:\Windows\System\uZpWIkD.exe
  2⤵
  PID:9528
- C:\Windows\System\gcBhyez.exe
  C:\Windows\System\gcBhyez.exe
  2⤵
  PID:9544
- C:\Windows\System\lQCVfLb.exe
  C:\Windows\System\lQCVfLb.exe
  2⤵
  PID:9560
- C:\Windows\System\HowHZKN.exe
  C:\Windows\System\HowHZKN.exe
  2⤵
  PID:9576
- C:\Windows\System\MbkBXUL.exe
  C:\Windows\System\MbkBXUL.exe
  2⤵
  PID:9592
- C:\Windows\System\rvcjOdS.exe
  C:\Windows\System\rvcjOdS.exe
  2⤵
  PID:9608
- C:\Windows\System\tiZsMfi.exe
  C:\Windows\System\tiZsMfi.exe
  2⤵
  PID:9624
- C:\Windows\System\NEvpgUu.exe
  C:\Windows\System\NEvpgUu.exe
  2⤵
  PID:9644
- C:\Windows\System\LWsqwaW.exe
  C:\Windows\System\LWsqwaW.exe
  2⤵
  PID:9660
- C:\Windows\System\GCPGEWW.exe
  C:\Windows\System\GCPGEWW.exe
  2⤵
  PID:9676
- C:\Windows\System\eXPYBsQ.exe
  C:\Windows\System\eXPYBsQ.exe
  2⤵
  PID:9692
- C:\Windows\System\YsBUbfF.exe
  C:\Windows\System\YsBUbfF.exe
  2⤵
  PID:9708
- C:\Windows\System\UgdaixB.exe
  C:\Windows\System\UgdaixB.exe
  2⤵
  PID:9724
- C:\Windows\System\WvlwWho.exe
  C:\Windows\System\WvlwWho.exe
  2⤵
  PID:9740
- C:\Windows\System\yKGHQqx.exe
  C:\Windows\System\yKGHQqx.exe
  2⤵
  PID:9760
- C:\Windows\System\aWHedjO.exe
  C:\Windows\System\aWHedjO.exe
  2⤵
  PID:9784
- C:\Windows\System\LGyuSKj.exe
  C:\Windows\System\LGyuSKj.exe
  2⤵
  PID:9912
- C:\Windows\System\qDldfwy.exe
  C:\Windows\System\qDldfwy.exe
  2⤵
  PID:9928
- C:\Windows\System\OoWuoDA.exe
  C:\Windows\System\OoWuoDA.exe
  2⤵
  PID:9944
- C:\Windows\System\qUFloRx.exe
  C:\Windows\System\qUFloRx.exe
  2⤵
  PID:9964
- C:\Windows\System\hhNphJC.exe
  C:\Windows\System\hhNphJC.exe
  2⤵
  PID:9980
- C:\Windows\System\nnHYKSA.exe
  C:\Windows\System\nnHYKSA.exe
  2⤵
  PID:9996
- C:\Windows\System\NNTmyqH.exe
  C:\Windows\System\NNTmyqH.exe
  2⤵
  PID:10012
- C:\Windows\System\wUHQgjS.exe
  C:\Windows\System\wUHQgjS.exe
  2⤵
  PID:10028
- C:\Windows\System\EdreKVy.exe
  C:\Windows\System\EdreKVy.exe
  2⤵
  PID:10044
- C:\Windows\System\ocJkiHY.exe
  C:\Windows\System\ocJkiHY.exe
  2⤵
  PID:10060
- C:\Windows\System\bwXTXcd.exe
  C:\Windows\System\bwXTXcd.exe
  2⤵
  PID:10076
- C:\Windows\System\uoRAHnW.exe
  C:\Windows\System\uoRAHnW.exe
  2⤵
  PID:10096
- C:\Windows\System\gMUsxst.exe
  C:\Windows\System\gMUsxst.exe
  2⤵
  PID:10112
- C:\Windows\System\UnGmLMW.exe
  C:\Windows\System\UnGmLMW.exe
  2⤵
  PID:10128
- C:\Windows\System\ibsALxn.exe
  C:\Windows\System\ibsALxn.exe
  2⤵
  PID:10148
- C:\Windows\System\yzMpTXc.exe
  C:\Windows\System\yzMpTXc.exe
  2⤵
  PID:10168
- C:\Windows\System\StPHcbC.exe
  C:\Windows\System\StPHcbC.exe
  2⤵
  PID:10188
- C:\Windows\System\DFeZqdr.exe
  C:\Windows\System\DFeZqdr.exe
  2⤵
  PID:10212
- C:\Windows\System\pNIEIPc.exe
  C:\Windows\System\pNIEIPc.exe
  2⤵
  PID:10232
- C:\Windows\System\wbnmdlh.exe
  C:\Windows\System\wbnmdlh.exe
  2⤵
  PID:8396
- C:\Windows\System\egymxNx.exe
  C:\Windows\System\egymxNx.exe
  2⤵
  PID:9304
- C:\Windows\System\OzTCwbN.exe
  C:\Windows\System\OzTCwbN.exe
  2⤵
  PID:9220
- C:\Windows\System\fUTCJKO.exe
  C:\Windows\System\fUTCJKO.exe
  2⤵
  PID:9256
- C:\Windows\System\zydktqZ.exe
  C:\Windows\System\zydktqZ.exe
  2⤵
  PID:9320
- C:\Windows\System\uJLrnGe.exe
  C:\Windows\System\uJLrnGe.exe
  2⤵
  PID:9404
- C:\Windows\System\TBoTQMP.exe
  C:\Windows\System\TBoTQMP.exe
  2⤵
  PID:9656
- C:\Windows\System\DXNEtGP.exe
  C:\Windows\System\DXNEtGP.exe
  2⤵
  PID:9384
- C:\Windows\System\ojumrzF.exe
  C:\Windows\System\ojumrzF.exe
  2⤵
  PID:9388
- C:\Windows\System\EFzdCSi.exe
  C:\Windows\System\EFzdCSi.exe
  2⤵
  PID:9420
- C:\Windows\System\BphXvok.exe
  C:\Windows\System\BphXvok.exe
  2⤵
  PID:9536
- C:\Windows\System\vdosRgw.exe
  C:\Windows\System\vdosRgw.exe
  2⤵
  PID:9668
- C:\Windows\System\AfsFtiE.exe
  C:\Windows\System\AfsFtiE.exe
  2⤵
  PID:9720
- C:\Windows\System\EiTcKPK.exe
  C:\Windows\System\EiTcKPK.exe
  2⤵
  PID:9768
- C:\Windows\System\cbimhkK.exe
  C:\Windows\System\cbimhkK.exe
  2⤵
  PID:9792
- C:\Windows\System\qFmSWDu.exe
  C:\Windows\System\qFmSWDu.exe
  2⤵
  PID:9808
- C:\Windows\System\zyYRVgo.exe
  C:\Windows\System\zyYRVgo.exe
  2⤵
  PID:9868
- C:\Windows\System\jiKxzrn.exe
  C:\Windows\System\jiKxzrn.exe
  2⤵
  PID:9872
- C:\Windows\System\VwnAZnc.exe
  C:\Windows\System\VwnAZnc.exe
  2⤵
  PID:9844
- C:\Windows\System\RqjBbZN.exe
  C:\Windows\System\RqjBbZN.exe
  2⤵
  PID:9820
- C:\Windows\System\VfIMarI.exe
  C:\Windows\System\VfIMarI.exe
  2⤵
  PID:9900
- C:\Windows\System\gBeYboj.exe
  C:\Windows\System\gBeYboj.exe
  2⤵
  PID:9940
- C:\Windows\System\HQxgnyh.exe
  C:\Windows\System\HQxgnyh.exe
  2⤵
  PID:10040
- C:\Windows\System\ekQXnHJ.exe
  C:\Windows\System\ekQXnHJ.exe
  2⤵
  PID:10104
- C:\Windows\System\fvcgnfE.exe
  C:\Windows\System\fvcgnfE.exe
  2⤵
  PID:10176
- C:\Windows\System\ccTyLSG.exe
  C:\Windows\System\ccTyLSG.exe
  2⤵
  PID:9240
- C:\Windows\System\KRZtOhS.exe
  C:\Windows\System\KRZtOhS.exe
  2⤵
  PID:9224
- C:\Windows\System\BcRpJTd.exe
  C:\Windows\System\BcRpJTd.exe
  2⤵
  PID:9440
- C:\Windows\System\oTkoRiC.exe
  C:\Windows\System\oTkoRiC.exe
  2⤵
  PID:9960
- C:\Windows\System\PRrgjkI.exe
  C:\Windows\System\PRrgjkI.exe
  2⤵
  PID:9288
- C:\Windows\System\DUKCpox.exe
  C:\Windows\System\DUKCpox.exe
  2⤵
  PID:9368
- C:\Windows\System\oKvAYWa.exe
  C:\Windows\System\oKvAYWa.exe
  2⤵
  PID:10160
- C:\Windows\System\VdzkZgK.exe
  C:\Windows\System\VdzkZgK.exe
  2⤵
  PID:10124

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\AkjMujq.exe

Filesize
2.6MB

MD5
f27ff1a9b47469c91b08b00140be34b2

SHA1
ee9223119a0d76861278d638955118d9fdef1354

SHA256
ed926a64a7f2724b5026d858a1dd0469a8cd68ceee0556ebc459f86734f746c2

SHA512
f049d429133c6b56adb741ce022dba8a4c32a7cf15b70906deef92edff4b6ec62702c663016db657230a90e3794888129d73761590f73e7d646c6c11dd6e72d6

Download Submit
C:\Windows\system\DDCsZCv.exe

Filesize
2.6MB

MD5
d31cbe9a5ebd12d554f56cebc3ab04b2

SHA1
993646be624f9e1243ee3f3ea93ae133a2326309

SHA256
fe4f7d505182cb2abedb762bae7f7ae5793952f4d92ba1d675d6ded654be3424

SHA512
013eae4fb272317c07c23ef5bd773c99cce6a05c4846925474c74d548b588684ad770f21011302e21b470358ff56fedfb5fb0c2979b120fce1ae08b371485728

Download Submit
C:\Windows\system\Dimdfsr.exe

Filesize
2.6MB

MD5
9eed87a4604ca7451cf28c63056209a7

SHA1
aba6701f8f388e2fc9f167d91f0296edd22c6e1b

SHA256
2f7490e43b450913be0dc6388b1ab1012ee2d73617ad44c331ee8766b643f71c

SHA512
4ed747b200d11bc4daa91d54ee8051f9b0cb10d6b6ed85f089dda09d1e8807817ffd17d2f39d9f65162c5e9d70908b215394a81575de7f115fa1b4bd149538e0

Download Submit
C:\Windows\system\DpcBtMd.exe

Filesize
2.6MB

MD5
6c95577416f82cd8a7710f815501dea6

SHA1
3e5caba5585e1ecb109646eb8ebe81fe1b4115e9

SHA256
c9f1798a955d144a754470261083a9d0faecc0a12f6392865a73c756207b37a6

SHA512
b751ad110d51a27c279ec318bbbe80b132999165b79494e95fb425db56ac7e9ef320f84cbb80a976dd599076754647826d168cb91c0aa9d7f54ae6564f997a82

Download Submit
C:\Windows\system\KuUlFGE.exe

Filesize
2.6MB

MD5
bc360b61e5f198ba3df9f5bd3bbfac7e

SHA1
f7f5b1d0eebd91ae9aff239a24d0b142ca084fbc

SHA256
1eb2377186aeaa534d574aa055270796277fd5b8054e8585cf0f14426f20e5e1

SHA512
da529595477740957647d7f5c7c678995d0ed5f6017fba1e9b2c3c1a8b1d1febfc7bc475aa11e89b099384a6b625ce399467e9a754e69e59201de52dea53d441

Download Submit
C:\Windows\system\LlfJdnI.exe

Filesize
2.6MB

MD5
735dc2bfdb4305872d7375028c92214f

SHA1
8faa8394ccb6fba575c76515c10f316ac64b9cfc

SHA256
d4ae5615db07b0bc56f1e0cd883bdb9ef430a40f77e4dddd71fb178ebb213643

SHA512
023a410f0ecff91f4beb10ee453629fd29819fdc92f2d58b0431d5260887576d9e6d49477fd1128bd5f05033fd5e95bbb8e00c3b88dd0a8e6f70b09d3057c085

Download Submit
C:\Windows\system\PDRjrOU.exe

Filesize
2.6MB

MD5
36b70c0dd3f3b9d2a9b9188b12ea8494

SHA1
910e47446b49fbf0bb8b1d10dcbcdf84ea147f25

SHA256
a57a96a3c51bc7e2cb54563b443c307fd84a85402753c144a96b1f96a488f673

SHA512
9f2b5e6029c530662aa74526b5e13c09da1ae0968672fe9124517eb4358c09525acc05e5e3062b2ee0e54d7d1748c3355e4632fcbfd9c6437b8af287b81470eb

Download Submit
C:\Windows\system\RkLhsPo.exe

Filesize
2.6MB

MD5
8976821f0281c5dd0c26a602be7e5d52

SHA1
7719fe260faae686aa8a1a213b591e2ad217966e

SHA256
b9fca7218ab46760d47e34fbef1cc9063f4dfacde57f385bdc567a300f75dfe5

SHA512
e6800d95e7981c4a46270698e56a01721161b155f87e55e36d7b0a13f81e6d8ed4c47a956fbb939e27e6094072798efb3a8600a070539709512e24b22687f343

Download Submit
C:\Windows\system\WHNfcVY.exe

Filesize
2.6MB

MD5
e2d5c905f81c28117cb854c8b93a9f50

SHA1
9949cee2227623adcf0e9ba624a0edc008969398

SHA256
7b665b38056df4918b619d81e7b1b428ce3d9dfa5cf7709a6a4f5f75755e3603

SHA512
80d8dd06bc890dcc0c406053d7c4eada077c10b3430970cbe732511a38246128da5d2a1037b090ecfc5c863a08ae3af82ed45352797c3a2d2c1b07da283444d0

Download Submit
C:\Windows\system\WoAkfii.exe

Filesize
2.6MB

MD5
5427fc04049a07a9851c462dc3cb633a

SHA1
d4779e51f94781cb9817574dd727aacec2d8aebd

SHA256
bdc9a3f99d566674ba448eafa968642dcf103b7aa0bc1c77a4ac30e02ba1325f

SHA512
5c6e5c356482d18c9b0115201eba5ca77e9bdb17b02f980fcf3c5a6e2752aae5d155119624f732b2175b83d62878fbf56167e16e7ef582d00ecbd83757ef49af

Download Submit
C:\Windows\system\YojokdW.exe

Filesize
2.6MB

MD5
8398789d7994301756543037554c4a07

SHA1
6b63e351a32b9e96e12c94df027aed708108e3d8

SHA256
daafb53b7863124dbaacbc3850255fb2ef9237c8ef9b2821b193d44c850ec258

SHA512
51f445e84adde93ea157b13f95c574b59b77c0e0e1a0d2c12829aeb9d75f8ce87558220f3a65b3d5b0c2f3dfc179a4cad34cdb84f4cd6050cf894e12eb0ffebf

Download Submit
C:\Windows\system\ZcQOKOF.exe

Filesize
2.6MB

MD5
f037228cc7c5db3fa8604dae440f1acb

SHA1
573841d91a381f0b74f4f7af62edd87cec1fdc4d

SHA256
fdac1f4721cee519bb96a6cc3b4390eaec0694955c6f83e477993b2a082f3b9f

SHA512
5a5452fd528eac92add571b812d401812d4853c4b03f832521458d61fdac425bac139f277b657e433c66e7ff6a461f3aa2908f74386528ac9f2b07a189c00c1b

Download Submit
C:\Windows\system\aQiFWba.exe

Filesize
2.6MB

MD5
55dab63f016f728fe415f718b8c9b47a

SHA1
36bdfd72dacc2d91b1e79f473375b65a03d055a0

SHA256
44ebe8375406507eab2c4d58d0d1c3be2da01a1d9c32c7f5d5c6fffd19114096

SHA512
a568e0fda205a2047b5c12acc39897fea86c8c395df19d45f3b79d34da3a8013db3e7f204374262480ba29745f2e9e2c06da774245728bdca7e70675fac61da8

Download Submit
C:\Windows\system\eBExWos.exe

Filesize
2.6MB

MD5
721f325d321c02a39f6b2a2cf3c782d4

SHA1
9bde007860761fabc627efa78461e9471c189d0f

SHA256
e78c8cca55ea94452ed6bd9d57a0b5037a8d098dac77d283b6e7c3a0da072ea6

SHA512
f116b2d04af9b1532f4734aeb45466026564e32d12c01c3ccf8b0d0cd9588accfaba479039ab1d834129b21da262c6c880f6223014f20fde3cfb53ead9cb1b39

Download Submit
C:\Windows\system\gUVlsFU.exe

Filesize
2.6MB

MD5
12c19712a5cc7ed195278f483fe09e1d

SHA1
3114af7d370e9004124328c15763251fca6dacce

SHA256
023f465d6e9780acbe9a3552b652ae13d818b4f69b8132253ec45c9b74a17f5a

SHA512
ac617938a8ee7dcf0f44fe9d434057cf607f75ed6085229b5ed6ed8d8d76d94722129f5223204cbae5e978380e1019c2b4e9027ed5e97c852cf10a679a36f0a4

Download Submit
C:\Windows\system\kJWiKNk.exe

Filesize
2.6MB

MD5
510a5f156e03af352845573360005933

SHA1
45d273a417ebab9fe0cb323d9e908c29b2fe6431

SHA256
1df5bc1fc2d60110c0cf6fe96e17605b185be910544c75f7e8deaf9a9f40ea01

SHA512
e821b1fa084131548b4bda9619260f3c34d8951d3320103e7623d200f5c614277fb7af260104062cbf1028005a3f11c50bbc92b8ee4904d90a36bc16d16a3ac3

Download Submit
C:\Windows\system\kdXYFBj.exe

Filesize
2.6MB

MD5
ff6ec86f421317843428e5b98247e9e0

SHA1
199872ccb7e24c5971645824476201b00606f682

SHA256
e2ce143d0b5ffb8b98419b5deab69465d07f200f619630f8ea63b98e33a1c2cb

SHA512
29279c572e9f20c7f1f7bb7d33f97162ca768822b49bd29969b44e33703d3d93aaa673089c96304a62ac19ac3e54926704b00e4828d80c88c3b950b98c2af464

Download Submit
C:\Windows\system\mvouTax.exe

Filesize
2.6MB

MD5
0f05c15c958ac7332aa835d54e155d0e

SHA1
e069688f1b898a71359c88cf5d195c086f360cef

SHA256
6cffa623823d638f936d4f8a0708b53fe3f30403c18c17b32eb976a2fcb1af4d

SHA512
3fdd2edb736a1334f34f10dd290301df8193ff6bea20bc0cf4832144454b903b28d7d7656cabc87398ffda84653c4f802baf81e23d333b2396a8225198bacf23

Download Submit
C:\Windows\system\pCQTufG.exe

Filesize
2.6MB

MD5
a78b56c23f0b8f73502a1e7655253f89

SHA1
21e37c99c0eadc3b22a8fd600e9272630be2e573

SHA256
0db42ff62c325c2dd5898e6be17bd4d8f4b26f0275eb3c362cb2bb4d41e1810b

SHA512
d88f8edb79a1e987c542459cdaf354c26356b90e2cecfabc7cb851276dab6d33b2d5970e94fa12295e53061e399395299609d2172d472870bd02541c803268cc

Download Submit
C:\Windows\system\poMnWKT.exe

Filesize
2.6MB

MD5
8d0de7b04599a529caf146866d94beeb

SHA1
5f5cb5846adec98ec949415bb267e85f9411ee4d

SHA256
346e23875fdc77c7220d709db584dfd7c810baad470e544edd713e94898c866c

SHA512
530de04ef06573b83df1dfaa2ba423be50bc3252f0bb0d264f4865647bf7d7f309f7fe8ebec46860892fcea10a3d336721125d7fe3425324776d97e9409a3ffe

Download Submit
C:\Windows\system\prDykCl.exe

Filesize
2.6MB

MD5
71e169ebcc2d292b65c813c9313d6b99

SHA1
e170e90954ae0758bb76358f470e9d2b281bfc86

SHA256
7a5618321a29163cee1c5777667baafa4d59b0219bba287ea6db4dbcefa45bd2

SHA512
58b591d47a8a7fa6f2aef41cb294602f6b5f13698f4bd612b8557c476ca16a4c1a475bffd93e92581627551faedb34db533c6184e9f40d393607d2039946f4e8

Download Submit
C:\Windows\system\qWwmVJe.exe

Filesize
2.6MB

MD5
636682b7ef61b877244e22a27677e96e

SHA1
7c84f2223fa97e2f614abe7c3a944ab0d524cc13

SHA256
a2cc065b0cc875e0e0e6187f10e51ba4e3d5d47159f29b33fbb338c721278beb

SHA512
df708549aeb8e968748578637bb8ddac1212fe52ea66c22a47efd4b65ab19dd713c6eb3ecbd96fa5664d03d4aa34558de74cc5e8193cd7d53157273a37a3111e

Download Submit
\Windows\system\LBBAaEZ.exe

Filesize
2.6MB

MD5
244075c12206d3b002b54090a0ecc06b

SHA1
95d12d5cbbcc146f283c9b807e1291f16656e45a

SHA256
2b2d70d9aa31fad77c942bc2f544806c42c601527d8da937a7944099a6456848

SHA512
f160b233931368a9dc7d81c9119952c922e8c52ec15beda312a4dc3eb02b70b7aff537485842e804f47fbd39d4e63af220b5c2c4b6595196eae9707569169aef

Download Submit
\Windows\system\RHCpyqZ.exe

Filesize
2.6MB

MD5
f8f95aab25d31181cd611da12145b58c

SHA1
2e30d2ca67aaa412648ae5711a03fc76c4ae72bf

SHA256
0899a741ad6101a8c4925615eaf6f7cbb18f98a2e32569a1c5fd530a41e58121

SHA512
9fcc6532901340ba89358c85093ac483c0ce0578a8b8386b680b89135f7a52bd3efb89f7340d33d364d35cdedf054bdc94d2bbc63ec4b8af31efbcbc6dc3fe47

Download Submit
\Windows\system\ROGIdZn.exe

Filesize
2.6MB

MD5
9b4d8f6e157cf6557947be90a281c1b6

SHA1
7351ff165c35961d86826ebcd455028112c3abfb

SHA256
ce7f375f437205de19733513b8ba68711b5614ab0985628dc271d804236fdf65

SHA512
be95e166c280962fd0fdb37b774f1ad7793eeca48efa2b81bc6f90cde36a4c44247c50e35584045ea0754849103863b4ce973a55800669f696ce6ae33eb108b0

Download Submit
\Windows\system\UjJdeDa.exe

Filesize
2.6MB

MD5
74d16a71ffcc83d37c69c3618b5b61d4

SHA1
c4ab6449b9e9f20715adef59a58a20af1c9c18a4

SHA256
2ae7cac888441b56d26470eb54cb34907bc2141151bc94aae1f631d873b7b039

SHA512
0d47c385e140255cde9c5eda7d4915e4695342bd4f6aa7b9e51cfae8d3ba08e7dbf0a375c59a310863dd129d3dc366f2f66abc5a6c0210b4dd1dac8e60d761de

Download Submit
\Windows\system\WuCzCbz.exe

Filesize
2.6MB

MD5
1f2dd6f40c48257b29f110d5f4590355

SHA1
462c514c88c9d7c190b10f6a957a44ee677f0603

SHA256
01668839335c44a80c022a6c5c08b6284b1f85f887e3ead324d5dfd915b40ae3

SHA512
639d8468e09abc23baf8972761c35b91245157843482f1ed5eb9bc84bfc0fee81de56b28b943836221d3e9eec6e6cc27294caa6dea7d08c652f0cfcdb0f83f26

Download Submit
\Windows\system\YGkXzet.exe

Filesize
2.6MB

MD5
6554bccd3fff5f411740a900064447be

SHA1
b0eeb7d71e913bf18b075d60768153a9111d5fdb

SHA256
cc53226adf2ca114ca5c5a4644bced86635344f0a71e80031c484c7c592b11ac

SHA512
b49d547f5bd72f30fb40e8ce01b73e750aafd8523f8173998b0dbe8d4e73681d9fbe5488e6366c96a877b657e70279b6122bb8169d7f5b001cd962464aa4a87e

Download Submit
\Windows\system\apRUvpM.exe

Filesize
2.6MB

MD5
5da80c9eb3d904d29dbc196471a20c88

SHA1
38d1397f754dd9cafcab6dd30b34d4e33d7e31ae

SHA256
06fc00555aa542826b051bc58eb1f8c3a363b1d66712bbf013beebf04e1342b7

SHA512
5a61df5321f977d9906e760ae27b5b8380517de467b46a4c6884eb6c68f8ecdf08eecbfc95aaf6391ef01d2686cc6e1c43aaf438842c1a93cbe481b28f86d5e2

Download Submit
\Windows\system\ionVtyn.exe

Filesize
2.6MB

MD5
9a7aef1594e2c3c8cc0496ef4448aaf2

SHA1
c01e911f248ba170c3e9661ede34dfe9da22c210

SHA256
206e61747c87878eaa7e204e54990294f1d28f2af0f7014d11e08f1532974f70

SHA512
8a477189f785745a82cc2dc35e1fdeae5705888224c4d4cfe957ca4783dba3a845099420e389ab06b242122864207001ce8dadc4810b1926190b31ae9bdda20f

Download Submit
\Windows\system\mmTwMwW.exe

Filesize
2.6MB

MD5
b129f5752bb15a43c91acd1f423a1a3f

SHA1
87768debc85c32b0e8dc567208092eccc718c5f4

SHA256
0a175f91417d032cdea616ee0685545682b1b0793c850a0f8cc58a162fe46548

SHA512
83d32f96fa2c63d68bf5b6fbce5d7277a1b6c2e9d4250d0505f655d917b31c447ec7ba80a5c86409dd13c5ef791aebc0ccf6d7eee7773f58e963f76314e0064f

Download Submit
\Windows\system\rUiCRmX.exe

Filesize
2.6MB

MD5
8595c2212d16ea33cc418b2c6cd731e7

SHA1
14521c1ce95d3be7547eec38dd9bc9a3fcf86c91

SHA256
6d511bfbd4323ece1994cb4b5d4262ba6e5adf8ea5128fee30837134b7617057

SHA512
dc9e0a3ea9dcb6e8bc8e92e0a08f3751d60817c72161e44c03edca9b86da8a50475ea8e069840c322492dea74c588ddcce83d7e0497d7be556535f5c437b1010

Download Submit
memory/1680-1813-0x0000000001D90000-0x0000000001D98000-memory.dmp

Filesize
32KB

Download
memory/1680-1193-0x000000001B720000-0x000000001BA02000-memory.dmp

Filesize
2.9MB

Download
memory/1688-54-0x000000013FFB0000-0x00000001403A6000-memory.dmp

Filesize
4.0MB

Download
memory/2116-8580-0x000000013F240000-0x000000013F636000-memory.dmp

Filesize
4.0MB

Download
memory/2116-36-0x000000013F240000-0x000000013F636000-memory.dmp

Filesize
4.0MB

Download
memory/2176-18-0x000000013F1F0000-0x000000013F5E6000-memory.dmp

Filesize
4.0MB

Download
memory/2176-3075-0x000000013F1F0000-0x000000013F5E6000-memory.dmp

Filesize
4.0MB

Download
memory/2344-1-0x000000013F780000-0x000000013FB76000-memory.dmp

Filesize
4.0MB

Download
memory/2344-104-0x0000000003110000-0x0000000003506000-memory.dmp

Filesize
4.0MB

Download
memory/2344-90-0x000000013F1B0000-0x000000013F5A6000-memory.dmp

Filesize
4.0MB

Download
memory/2344-106-0x000000013FBD0000-0x000000013FFC6000-memory.dmp

Filesize
4.0MB

Download
memory/2344-5480-0x000000013F320000-0x000000013F716000-memory.dmp

Filesize
4.0MB

Download
memory/2344-0-0x00000000001F0000-0x0000000000200000-memory.dmp

Filesize
64KB

Download
memory/2344-4-0x000000013FC10000-0x0000000140006000-memory.dmp

Filesize
4.0MB

Download
memory/2344-72-0x000000013FF50000-0x0000000140346000-memory.dmp

Filesize
4.0MB

Download
memory/2344-108-0x000000013F250000-0x000000013F646000-memory.dmp

Filesize
4.0MB

Download
memory/2344-59-0x0000000003110000-0x0000000003506000-memory.dmp

Filesize
4.0MB

Download
memory/2344-2826-0x000000013F780000-0x000000013FB76000-memory.dmp

Filesize
4.0MB

Download
memory/2344-93-0x000000013F320000-0x000000013F716000-memory.dmp

Filesize
4.0MB

Download
memory/2344-13-0x000000013F1F0000-0x000000013F5E6000-memory.dmp

Filesize
4.0MB

Download
memory/2432-107-0x000000013FBD0000-0x000000013FFC6000-memory.dmp

Filesize
4.0MB

Download
memory/2432-8608-0x000000013FBD0000-0x000000013FFC6000-memory.dmp

Filesize
4.0MB

Download
memory/2472-92-0x000000013F1B0000-0x000000013F5A6000-memory.dmp

Filesize
4.0MB

Download
memory/2472-5475-0x000000013F1B0000-0x000000013F5A6000-memory.dmp

Filesize
4.0MB

Download
memory/2472-8607-0x000000013F1B0000-0x000000013F5A6000-memory.dmp

Filesize
4.0MB

Download
memory/2624-39-0x000000013F510000-0x000000013F906000-memory.dmp

Filesize
4.0MB

Download
memory/2624-8586-0x000000013F510000-0x000000013F906000-memory.dmp

Filesize
4.0MB

Download
memory/2664-88-0x000000013F440000-0x000000013F836000-memory.dmp

Filesize
4.0MB

Download
memory/2688-103-0x000000013F640000-0x000000013FA36000-memory.dmp

Filesize
4.0MB

Download
memory/2832-8-0x000000013FC10000-0x0000000140006000-memory.dmp

Filesize
4.0MB

Download