xmrig | a6f48f8f554b67aa4e0112b00c48936b33a60a9b63c29a6b47f1c36f0268de76

Analysis

max time kernel
149s
max time network
145s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
02-06-2024 23:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8299291116572e81c4a532247dfb92d0_NeikiAnalytics.exe
Size

1.7MB
MD5

8299291116572e81c4a532247dfb92d0
SHA1

336e759cbf2e33c932cb8e6cc293a8f958d1d319
SHA256

a6f48f8f554b67aa4e0112b00c48936b33a60a9b63c29a6b47f1c36f0268de76
SHA512

12a948cae01b0de019f5a280ec543107fda8a0c1968ef54e1efdd5ab1757cf113fbeb19a3e1459edd3e0558af3a34f5352f34e8260acaa7356492b06e99afc8c
SSDEEP

24576:zv3/fTLF671TilQFG4P5PMkFfkeMlN675EgEPgspmBeQxWCLU0SwVUuBk5ck:Lz071uv4BPMkFfdg6NsIRSwV7C

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 21 IoCs

miner

resource	yara_rule
behavioral1/memory/2088-16-0x000000013FCD0000-0x00000001400C2000-memory.dmp	xmrig
behavioral1/memory/2564-211-0x000000013FEB0000-0x00000001402A2000-memory.dmp	xmrig
behavioral1/memory/2924-225-0x000000013F200000-0x000000013F5F2000-memory.dmp	xmrig
behavioral1/memory/2028-224-0x000000013F550000-0x000000013F942000-memory.dmp	xmrig
behavioral1/memory/2580-223-0x000000013F170000-0x000000013F562000-memory.dmp	xmrig
behavioral1/memory/2788-220-0x000000013F790000-0x000000013FB82000-memory.dmp	xmrig
behavioral1/memory/2556-218-0x000000013F280000-0x000000013F672000-memory.dmp	xmrig
behavioral1/memory/2584-216-0x000000013F2E0000-0x000000013F6D2000-memory.dmp	xmrig
behavioral1/memory/2752-213-0x000000013FE70000-0x0000000140262000-memory.dmp	xmrig
behavioral1/memory/2748-14-0x000000013F2C0000-0x000000013F6B2000-memory.dmp	xmrig
behavioral1/memory/2584-6611-0x000000013F2E0000-0x000000013F6D2000-memory.dmp	xmrig
behavioral1/memory/2028-6613-0x000000013F550000-0x000000013F942000-memory.dmp	xmrig
behavioral1/memory/2580-6612-0x000000013F170000-0x000000013F562000-memory.dmp	xmrig
behavioral1/memory/2564-6610-0x000000013FEB0000-0x00000001402A2000-memory.dmp	xmrig
behavioral1/memory/2748-6614-0x000000013F2C0000-0x000000013F6B2000-memory.dmp	xmrig
behavioral1/memory/2728-6615-0x000000013F6A0000-0x000000013FA92000-memory.dmp	xmrig
behavioral1/memory/2088-6641-0x000000013FCD0000-0x00000001400C2000-memory.dmp	xmrig
behavioral1/memory/2788-6651-0x000000013F790000-0x000000013FB82000-memory.dmp	xmrig
behavioral1/memory/2752-6649-0x000000013FE70000-0x0000000140262000-memory.dmp	xmrig
behavioral1/memory/2556-6644-0x000000013F280000-0x000000013F672000-memory.dmp	xmrig
behavioral1/memory/2288-13822-0x000000013F130000-0x000000013F522000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
2252	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
2748	PFLxUgd.exe
2088	sBFDrwB.exe
2728	LIOTHsM.exe
2924	pakGXwV.exe
2564	hcNjJTm.exe
2752	wVkZZiY.exe
2584	OqvdDtt.exe
2556	hKqioPH.exe
2788	CsIDZhP.exe
2580	giYkBSX.exe
2028	BGSwKYU.exe
2856	foyocTc.exe
3016	cGrfEpO.exe
620	AUsbLCL.exe
1040	yDkFNla.exe
2656	GWNdRrL.exe
1064	nhCNVxp.exe
3024	dSAVREU.exe
2792	qPDfoIG.exe
2892	PkDQaws.exe
1996	cmdmpOV.exe
1296	LAxEYba.exe
1704	bJTkoJm.exe
1592	LFbSRbl.exe
2632	KifzXXH.exe
2412	QIlfNUU.exe
680	wjbPAXi.exe
1572	jEPCXlw.exe
584	gZvmDZt.exe
836	jHScFIE.exe
2508	xyWHLGW.exe
1948	sABSMNU.exe
2940	hxpnMbr.exe
3060	AHUYGuh.exe
1560	DATJVVY.exe
1384	aBqieTF.exe
2976	HbjBXlR.exe
1168	cHYiXYS.exe
1496	usOToVB.exe
1848	tITmvfp.exe
692	xIykzTf.exe
1804	vTpNMkc.exe
376	KxhKBwM.exe
1888	HOYgOss.exe
2052	VceuAjW.exe
2676	xUTZJQL.exe
2280	OHhUpgP.exe
2832	qwzTkfM.exe
356	adAYTKI.exe
1600	NzNbTtm.exe
2040	UVEOvyV.exe
1928	qkEWXtt.exe
2948	qwwSyPS.exe
2980	CPKqHDE.exe
2056	uZMvpcs.exe
2324	JfyDHNe.exe
1724	UirDTIF.exe
1328	bkShdNw.exe
1628	bjxMxjh.exe
2628	JFaayMi.exe
2692	svbflwa.exe
2368	gzDjYQZ.exe
1348	IyJeehZ.exe
2068	pONhUGK.exe

Loads dropped DLL 64 IoCs

pid	Process
2288	8299291116572e81c4a532247dfb92d0_NeikiAnalytics.exe
2288	8299291116572e81c4a532247dfb92d0_NeikiAnalytics.exe
2288	8299291116572e81c4a532247dfb92d0_NeikiAnalytics.exe
2288	8299291116572e81c4a532247dfb92d0_NeikiAnalytics.exe
2288	8299291116572e81c4a532247dfb92d0_NeikiAnalytics.exe
2288	8299291116572e81c4a532247dfb92d0_NeikiAnalytics.exe
2288	8299291116572e81c4a532247dfb92d0_NeikiAnalytics.exe
2288	8299291116572e81c4a532247dfb92d0_NeikiAnalytics.exe
2288	8299291116572e81c4a532247dfb92d0_NeikiAnalytics.exe
2288	8299291116572e81c4a532247dfb92d0_NeikiAnalytics.exe
2288	8299291116572e81c4a532247dfb92d0_NeikiAnalytics.exe
2288	8299291116572e81c4a532247dfb92d0_NeikiAnalytics.exe
2288	8299291116572e81c4a532247dfb92d0_NeikiAnalytics.exe
2288	8299291116572e81c4a532247dfb92d0_NeikiAnalytics.exe
2288	8299291116572e81c4a532247dfb92d0_NeikiAnalytics.exe
2288	8299291116572e81c4a532247dfb92d0_NeikiAnalytics.exe
2288	8299291116572e81c4a532247dfb92d0_NeikiAnalytics.exe
2288	8299291116572e81c4a532247dfb92d0_NeikiAnalytics.exe
2288	8299291116572e81c4a532247dfb92d0_NeikiAnalytics.exe
2288	8299291116572e81c4a532247dfb92d0_NeikiAnalytics.exe
2288	8299291116572e81c4a532247dfb92d0_NeikiAnalytics.exe
2288	8299291116572e81c4a532247dfb92d0_NeikiAnalytics.exe
2288	8299291116572e81c4a532247dfb92d0_NeikiAnalytics.exe
2288	8299291116572e81c4a532247dfb92d0_NeikiAnalytics.exe
2288	8299291116572e81c4a532247dfb92d0_NeikiAnalytics.exe
2288	8299291116572e81c4a532247dfb92d0_NeikiAnalytics.exe
2288	8299291116572e81c4a532247dfb92d0_NeikiAnalytics.exe
2288	8299291116572e81c4a532247dfb92d0_NeikiAnalytics.exe
2288	8299291116572e81c4a532247dfb92d0_NeikiAnalytics.exe
2288	8299291116572e81c4a532247dfb92d0_NeikiAnalytics.exe
2288	8299291116572e81c4a532247dfb92d0_NeikiAnalytics.exe
2288	8299291116572e81c4a532247dfb92d0_NeikiAnalytics.exe
2288	8299291116572e81c4a532247dfb92d0_NeikiAnalytics.exe
2288	8299291116572e81c4a532247dfb92d0_NeikiAnalytics.exe
2288	8299291116572e81c4a532247dfb92d0_NeikiAnalytics.exe
2288	8299291116572e81c4a532247dfb92d0_NeikiAnalytics.exe
2288	8299291116572e81c4a532247dfb92d0_NeikiAnalytics.exe
2288	8299291116572e81c4a532247dfb92d0_NeikiAnalytics.exe
2288	8299291116572e81c4a532247dfb92d0_NeikiAnalytics.exe
2288	8299291116572e81c4a532247dfb92d0_NeikiAnalytics.exe
2288	8299291116572e81c4a532247dfb92d0_NeikiAnalytics.exe
2288	8299291116572e81c4a532247dfb92d0_NeikiAnalytics.exe
2288	8299291116572e81c4a532247dfb92d0_NeikiAnalytics.exe
2288	8299291116572e81c4a532247dfb92d0_NeikiAnalytics.exe
2288	8299291116572e81c4a532247dfb92d0_NeikiAnalytics.exe
2288	8299291116572e81c4a532247dfb92d0_NeikiAnalytics.exe
2288	8299291116572e81c4a532247dfb92d0_NeikiAnalytics.exe
2288	8299291116572e81c4a532247dfb92d0_NeikiAnalytics.exe
2288	8299291116572e81c4a532247dfb92d0_NeikiAnalytics.exe
2288	8299291116572e81c4a532247dfb92d0_NeikiAnalytics.exe
2288	8299291116572e81c4a532247dfb92d0_NeikiAnalytics.exe
2288	8299291116572e81c4a532247dfb92d0_NeikiAnalytics.exe
2288	8299291116572e81c4a532247dfb92d0_NeikiAnalytics.exe
2288	8299291116572e81c4a532247dfb92d0_NeikiAnalytics.exe
2288	8299291116572e81c4a532247dfb92d0_NeikiAnalytics.exe
2288	8299291116572e81c4a532247dfb92d0_NeikiAnalytics.exe
2288	8299291116572e81c4a532247dfb92d0_NeikiAnalytics.exe
2288	8299291116572e81c4a532247dfb92d0_NeikiAnalytics.exe
2288	8299291116572e81c4a532247dfb92d0_NeikiAnalytics.exe
2288	8299291116572e81c4a532247dfb92d0_NeikiAnalytics.exe
2288	8299291116572e81c4a532247dfb92d0_NeikiAnalytics.exe
2288	8299291116572e81c4a532247dfb92d0_NeikiAnalytics.exe
2288	8299291116572e81c4a532247dfb92d0_NeikiAnalytics.exe
2288	8299291116572e81c4a532247dfb92d0_NeikiAnalytics.exe

UPX packed file 57 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2288-1-0x000000013F130000-0x000000013F522000-memory.dmp	upx
behavioral1/files/0x003700000001451d-7.dat	upx
behavioral1/files/0x000b0000000122ee-6.dat	upx
behavioral1/memory/2088-16-0x000000013FCD0000-0x00000001400C2000-memory.dmp	upx
behavioral1/files/0x00080000000146a7-20.dat	upx
behavioral1/files/0x00130000000054a8-33.dat	upx
behavioral1/files/0x0008000000015cc2-49.dat	upx
behavioral1/files/0x0006000000015cd8-59.dat	upx
behavioral1/files/0x0006000000015d1e-84.dat	upx
behavioral1/files/0x0006000000015d89-94.dat	upx
behavioral1/files/0x0006000000016020-111.dat	upx
behavioral1/files/0x00060000000167e8-152.dat	upx
behavioral1/files/0x0006000000015cca-109.dat	upx
behavioral1/files/0x0006000000016126-115.dat	upx
behavioral1/files/0x0006000000015fbb-130.dat	upx
behavioral1/files/0x000600000001640f-135.dat	upx
behavioral1/memory/2564-211-0x000000013FEB0000-0x00000001402A2000-memory.dmp	upx
behavioral1/files/0x0006000000016ca1-171.dat	upx
behavioral1/files/0x0006000000016c57-163.dat	upx
behavioral1/files/0x0006000000016a3a-153.dat	upx
behavioral1/files/0x0006000000016591-143.dat	upx
behavioral1/files/0x0006000000015d99-128.dat	upx
behavioral1/memory/2924-225-0x000000013F200000-0x000000013F5F2000-memory.dmp	upx
behavioral1/files/0x0006000000015d28-126.dat	upx
behavioral1/files/0x0006000000015d13-124.dat	upx
behavioral1/files/0x0006000000015cf5-122.dat	upx
behavioral1/files/0x0006000000015ce1-120.dat	upx
behavioral1/memory/2028-224-0x000000013F550000-0x000000013F942000-memory.dmp	upx
behavioral1/memory/2580-223-0x000000013F170000-0x000000013F562000-memory.dmp	upx
behavioral1/memory/2788-220-0x000000013F790000-0x000000013FB82000-memory.dmp	upx
behavioral1/memory/2556-218-0x000000013F280000-0x000000013F672000-memory.dmp	upx
behavioral1/memory/2584-216-0x000000013F2E0000-0x000000013F6D2000-memory.dmp	upx
behavioral1/memory/2752-213-0x000000013FE70000-0x0000000140262000-memory.dmp	upx
behavioral1/files/0x0006000000016c5b-170.dat	upx
behavioral1/files/0x0006000000016c3a-161.dat	upx
behavioral1/files/0x0006000000015d02-81.dat	upx
behavioral1/files/0x0008000000014c0b-57.dat	upx
behavioral1/files/0x0008000000014a29-48.dat	upx
behavioral1/files/0x000600000001650f-142.dat	upx
behavioral1/files/0x0006000000016228-133.dat	upx
behavioral1/files/0x00080000000148af-40.dat	upx
behavioral1/files/0x0006000000015f40-102.dat	upx
behavioral1/files/0x0006000000015ced-69.dat	upx
behavioral1/files/0x000700000001474b-32.dat	upx
behavioral1/memory/2728-28-0x000000013F6A0000-0x000000013FA92000-memory.dmp	upx
behavioral1/memory/2748-14-0x000000013F2C0000-0x000000013F6B2000-memory.dmp	upx
behavioral1/memory/2584-6611-0x000000013F2E0000-0x000000013F6D2000-memory.dmp	upx
behavioral1/memory/2028-6613-0x000000013F550000-0x000000013F942000-memory.dmp	upx
behavioral1/memory/2580-6612-0x000000013F170000-0x000000013F562000-memory.dmp	upx
behavioral1/memory/2564-6610-0x000000013FEB0000-0x00000001402A2000-memory.dmp	upx
behavioral1/memory/2748-6614-0x000000013F2C0000-0x000000013F6B2000-memory.dmp	upx
behavioral1/memory/2728-6615-0x000000013F6A0000-0x000000013FA92000-memory.dmp	upx
behavioral1/memory/2088-6641-0x000000013FCD0000-0x00000001400C2000-memory.dmp	upx
behavioral1/memory/2788-6651-0x000000013F790000-0x000000013FB82000-memory.dmp	upx
behavioral1/memory/2752-6649-0x000000013FE70000-0x0000000140262000-memory.dmp	upx
behavioral1/memory/2556-6644-0x000000013F280000-0x000000013F672000-memory.dmp	upx
behavioral1/memory/2288-13822-0x000000013F130000-0x000000013F522000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\BOUbZBd.exe	8299291116572e81c4a532247dfb92d0_NeikiAnalytics.exe
File created	C:\Windows\System\MESNgLL.exe	8299291116572e81c4a532247dfb92d0_NeikiAnalytics.exe
File created	C:\Windows\System\UrSxgbI.exe	8299291116572e81c4a532247dfb92d0_NeikiAnalytics.exe
File created	C:\Windows\System\ObGaBtS.exe	8299291116572e81c4a532247dfb92d0_NeikiAnalytics.exe
File created	C:\Windows\System\aRVBcqt.exe	8299291116572e81c4a532247dfb92d0_NeikiAnalytics.exe
File created	C:\Windows\System\KxzgqkM.exe	8299291116572e81c4a532247dfb92d0_NeikiAnalytics.exe
File created	C:\Windows\System\OTBWDQu.exe	8299291116572e81c4a532247dfb92d0_NeikiAnalytics.exe
File created	C:\Windows\System\bALMyKm.exe	8299291116572e81c4a532247dfb92d0_NeikiAnalytics.exe
File created	C:\Windows\System\AZyNgwt.exe	8299291116572e81c4a532247dfb92d0_NeikiAnalytics.exe
File created	C:\Windows\System\qmcPpMd.exe	8299291116572e81c4a532247dfb92d0_NeikiAnalytics.exe
File created	C:\Windows\System\iTqpvfk.exe	8299291116572e81c4a532247dfb92d0_NeikiAnalytics.exe
File created	C:\Windows\System\akvwUSy.exe	8299291116572e81c4a532247dfb92d0_NeikiAnalytics.exe
File created	C:\Windows\System\AcDLOzg.exe	8299291116572e81c4a532247dfb92d0_NeikiAnalytics.exe
File created	C:\Windows\System\KLCXbyd.exe	8299291116572e81c4a532247dfb92d0_NeikiAnalytics.exe
File created	C:\Windows\System\GDkLZse.exe	8299291116572e81c4a532247dfb92d0_NeikiAnalytics.exe
File created	C:\Windows\System\IazFXeT.exe	8299291116572e81c4a532247dfb92d0_NeikiAnalytics.exe
File created	C:\Windows\System\tPbrdRb.exe	8299291116572e81c4a532247dfb92d0_NeikiAnalytics.exe
File created	C:\Windows\System\AeVlsJD.exe	8299291116572e81c4a532247dfb92d0_NeikiAnalytics.exe
File created	C:\Windows\System\rzbIeAs.exe	8299291116572e81c4a532247dfb92d0_NeikiAnalytics.exe
File created	C:\Windows\System\kFTUGTS.exe	8299291116572e81c4a532247dfb92d0_NeikiAnalytics.exe
File created	C:\Windows\System\BsxSZzB.exe	8299291116572e81c4a532247dfb92d0_NeikiAnalytics.exe
File created	C:\Windows\System\dTYVjEX.exe	8299291116572e81c4a532247dfb92d0_NeikiAnalytics.exe
File created	C:\Windows\System\UMjQRuT.exe	8299291116572e81c4a532247dfb92d0_NeikiAnalytics.exe
File created	C:\Windows\System\RykyEfN.exe	8299291116572e81c4a532247dfb92d0_NeikiAnalytics.exe
File created	C:\Windows\System\yUeTdMg.exe	8299291116572e81c4a532247dfb92d0_NeikiAnalytics.exe
File created	C:\Windows\System\znAeKMK.exe	8299291116572e81c4a532247dfb92d0_NeikiAnalytics.exe
File created	C:\Windows\System\osnMmKY.exe	8299291116572e81c4a532247dfb92d0_NeikiAnalytics.exe
File created	C:\Windows\System\McVtDyM.exe	8299291116572e81c4a532247dfb92d0_NeikiAnalytics.exe
File created	C:\Windows\System\iLCjaBh.exe	8299291116572e81c4a532247dfb92d0_NeikiAnalytics.exe
File created	C:\Windows\System\uYMhmCM.exe	8299291116572e81c4a532247dfb92d0_NeikiAnalytics.exe
File created	C:\Windows\System\WNBSeaB.exe	8299291116572e81c4a532247dfb92d0_NeikiAnalytics.exe
File created	C:\Windows\System\WqvySIn.exe	8299291116572e81c4a532247dfb92d0_NeikiAnalytics.exe
File created	C:\Windows\System\cFBycnr.exe	8299291116572e81c4a532247dfb92d0_NeikiAnalytics.exe
File created	C:\Windows\System\FXbHPNZ.exe	8299291116572e81c4a532247dfb92d0_NeikiAnalytics.exe
File created	C:\Windows\System\jiupcAM.exe	8299291116572e81c4a532247dfb92d0_NeikiAnalytics.exe
File created	C:\Windows\System\ODHIwgH.exe	8299291116572e81c4a532247dfb92d0_NeikiAnalytics.exe
File created	C:\Windows\System\jZFaAto.exe	8299291116572e81c4a532247dfb92d0_NeikiAnalytics.exe
File created	C:\Windows\System\AqmTINW.exe	8299291116572e81c4a532247dfb92d0_NeikiAnalytics.exe
File created	C:\Windows\System\gCfNdty.exe	8299291116572e81c4a532247dfb92d0_NeikiAnalytics.exe
File created	C:\Windows\System\uOeYEzX.exe	8299291116572e81c4a532247dfb92d0_NeikiAnalytics.exe
File created	C:\Windows\System\cPAcHfU.exe	8299291116572e81c4a532247dfb92d0_NeikiAnalytics.exe
File created	C:\Windows\System\HSRROud.exe	8299291116572e81c4a532247dfb92d0_NeikiAnalytics.exe
File created	C:\Windows\System\clkglSF.exe	8299291116572e81c4a532247dfb92d0_NeikiAnalytics.exe
File created	C:\Windows\System\HLgmGia.exe	8299291116572e81c4a532247dfb92d0_NeikiAnalytics.exe
File created	C:\Windows\System\wYNpFte.exe	8299291116572e81c4a532247dfb92d0_NeikiAnalytics.exe
File created	C:\Windows\System\GMjKLed.exe	8299291116572e81c4a532247dfb92d0_NeikiAnalytics.exe
File created	C:\Windows\System\pXvFgHL.exe	8299291116572e81c4a532247dfb92d0_NeikiAnalytics.exe
File created	C:\Windows\System\HxmfIVM.exe	8299291116572e81c4a532247dfb92d0_NeikiAnalytics.exe
File created	C:\Windows\System\vMFxwjE.exe	8299291116572e81c4a532247dfb92d0_NeikiAnalytics.exe
File created	C:\Windows\System\ZcJToaJ.exe	8299291116572e81c4a532247dfb92d0_NeikiAnalytics.exe
File created	C:\Windows\System\qksmNTQ.exe	8299291116572e81c4a532247dfb92d0_NeikiAnalytics.exe
File created	C:\Windows\System\ApWsCDW.exe	8299291116572e81c4a532247dfb92d0_NeikiAnalytics.exe
File created	C:\Windows\System\gxHovxC.exe	8299291116572e81c4a532247dfb92d0_NeikiAnalytics.exe
File created	C:\Windows\System\KBIPuwd.exe	8299291116572e81c4a532247dfb92d0_NeikiAnalytics.exe
File created	C:\Windows\System\qikjunp.exe	8299291116572e81c4a532247dfb92d0_NeikiAnalytics.exe
File created	C:\Windows\System\jtptcuL.exe	8299291116572e81c4a532247dfb92d0_NeikiAnalytics.exe
File created	C:\Windows\System\GYFhkll.exe	8299291116572e81c4a532247dfb92d0_NeikiAnalytics.exe
File created	C:\Windows\System\tVMeVPI.exe	8299291116572e81c4a532247dfb92d0_NeikiAnalytics.exe
File created	C:\Windows\System\ZTnfCaO.exe	8299291116572e81c4a532247dfb92d0_NeikiAnalytics.exe
File created	C:\Windows\System\YrzwAhq.exe	8299291116572e81c4a532247dfb92d0_NeikiAnalytics.exe
File created	C:\Windows\System\mOHrkkO.exe	8299291116572e81c4a532247dfb92d0_NeikiAnalytics.exe
File created	C:\Windows\System\zdeNNqi.exe	8299291116572e81c4a532247dfb92d0_NeikiAnalytics.exe
File created	C:\Windows\System\vLbhXFO.exe	8299291116572e81c4a532247dfb92d0_NeikiAnalytics.exe
File created	C:\Windows\System\kOjTPKT.exe	8299291116572e81c4a532247dfb92d0_NeikiAnalytics.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2252	powershell.exe
2252	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2288	8299291116572e81c4a532247dfb92d0_NeikiAnalytics.exe
Token: SeLockMemoryPrivilege	2288	8299291116572e81c4a532247dfb92d0_NeikiAnalytics.exe
Token: SeDebugPrivilege	2252	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2288 wrote to memory of 2252	2288	8299291116572e81c4a532247dfb92d0_NeikiAnalytics.exe	29
PID 2288 wrote to memory of 2252	2288	8299291116572e81c4a532247dfb92d0_NeikiAnalytics.exe	29
PID 2288 wrote to memory of 2252	2288	8299291116572e81c4a532247dfb92d0_NeikiAnalytics.exe	29
PID 2288 wrote to memory of 2748	2288	8299291116572e81c4a532247dfb92d0_NeikiAnalytics.exe	30
PID 2288 wrote to memory of 2748	2288	8299291116572e81c4a532247dfb92d0_NeikiAnalytics.exe	30
PID 2288 wrote to memory of 2748	2288	8299291116572e81c4a532247dfb92d0_NeikiAnalytics.exe	30
PID 2288 wrote to memory of 2088	2288	8299291116572e81c4a532247dfb92d0_NeikiAnalytics.exe	31
PID 2288 wrote to memory of 2088	2288	8299291116572e81c4a532247dfb92d0_NeikiAnalytics.exe	31
PID 2288 wrote to memory of 2088	2288	8299291116572e81c4a532247dfb92d0_NeikiAnalytics.exe	31
PID 2288 wrote to memory of 2728	2288	8299291116572e81c4a532247dfb92d0_NeikiAnalytics.exe	32
PID 2288 wrote to memory of 2728	2288	8299291116572e81c4a532247dfb92d0_NeikiAnalytics.exe	32
PID 2288 wrote to memory of 2728	2288	8299291116572e81c4a532247dfb92d0_NeikiAnalytics.exe	32
PID 2288 wrote to memory of 2924	2288	8299291116572e81c4a532247dfb92d0_NeikiAnalytics.exe	33
PID 2288 wrote to memory of 2924	2288	8299291116572e81c4a532247dfb92d0_NeikiAnalytics.exe	33
PID 2288 wrote to memory of 2924	2288	8299291116572e81c4a532247dfb92d0_NeikiAnalytics.exe	33
PID 2288 wrote to memory of 2564	2288	8299291116572e81c4a532247dfb92d0_NeikiAnalytics.exe	34
PID 2288 wrote to memory of 2564	2288	8299291116572e81c4a532247dfb92d0_NeikiAnalytics.exe	34
PID 2288 wrote to memory of 2564	2288	8299291116572e81c4a532247dfb92d0_NeikiAnalytics.exe	34
PID 2288 wrote to memory of 2752	2288	8299291116572e81c4a532247dfb92d0_NeikiAnalytics.exe	35
PID 2288 wrote to memory of 2752	2288	8299291116572e81c4a532247dfb92d0_NeikiAnalytics.exe	35
PID 2288 wrote to memory of 2752	2288	8299291116572e81c4a532247dfb92d0_NeikiAnalytics.exe	35
PID 2288 wrote to memory of 2584	2288	8299291116572e81c4a532247dfb92d0_NeikiAnalytics.exe	36
PID 2288 wrote to memory of 2584	2288	8299291116572e81c4a532247dfb92d0_NeikiAnalytics.exe	36
PID 2288 wrote to memory of 2584	2288	8299291116572e81c4a532247dfb92d0_NeikiAnalytics.exe	36
PID 2288 wrote to memory of 2788	2288	8299291116572e81c4a532247dfb92d0_NeikiAnalytics.exe	37
PID 2288 wrote to memory of 2788	2288	8299291116572e81c4a532247dfb92d0_NeikiAnalytics.exe	37
PID 2288 wrote to memory of 2788	2288	8299291116572e81c4a532247dfb92d0_NeikiAnalytics.exe	37
PID 2288 wrote to memory of 2556	2288	8299291116572e81c4a532247dfb92d0_NeikiAnalytics.exe	38
PID 2288 wrote to memory of 2556	2288	8299291116572e81c4a532247dfb92d0_NeikiAnalytics.exe	38
PID 2288 wrote to memory of 2556	2288	8299291116572e81c4a532247dfb92d0_NeikiAnalytics.exe	38
PID 2288 wrote to memory of 2656	2288	8299291116572e81c4a532247dfb92d0_NeikiAnalytics.exe	39
PID 2288 wrote to memory of 2656	2288	8299291116572e81c4a532247dfb92d0_NeikiAnalytics.exe	39
PID 2288 wrote to memory of 2656	2288	8299291116572e81c4a532247dfb92d0_NeikiAnalytics.exe	39
PID 2288 wrote to memory of 2580	2288	8299291116572e81c4a532247dfb92d0_NeikiAnalytics.exe	40
PID 2288 wrote to memory of 2580	2288	8299291116572e81c4a532247dfb92d0_NeikiAnalytics.exe	40
PID 2288 wrote to memory of 2580	2288	8299291116572e81c4a532247dfb92d0_NeikiAnalytics.exe	40
PID 2288 wrote to memory of 3024	2288	8299291116572e81c4a532247dfb92d0_NeikiAnalytics.exe	41
PID 2288 wrote to memory of 3024	2288	8299291116572e81c4a532247dfb92d0_NeikiAnalytics.exe	41
PID 2288 wrote to memory of 3024	2288	8299291116572e81c4a532247dfb92d0_NeikiAnalytics.exe	41
PID 2288 wrote to memory of 2028	2288	8299291116572e81c4a532247dfb92d0_NeikiAnalytics.exe	42
PID 2288 wrote to memory of 2028	2288	8299291116572e81c4a532247dfb92d0_NeikiAnalytics.exe	42
PID 2288 wrote to memory of 2028	2288	8299291116572e81c4a532247dfb92d0_NeikiAnalytics.exe	42
PID 2288 wrote to memory of 2792	2288	8299291116572e81c4a532247dfb92d0_NeikiAnalytics.exe	43
PID 2288 wrote to memory of 2792	2288	8299291116572e81c4a532247dfb92d0_NeikiAnalytics.exe	43
PID 2288 wrote to memory of 2792	2288	8299291116572e81c4a532247dfb92d0_NeikiAnalytics.exe	43
PID 2288 wrote to memory of 2856	2288	8299291116572e81c4a532247dfb92d0_NeikiAnalytics.exe	44
PID 2288 wrote to memory of 2856	2288	8299291116572e81c4a532247dfb92d0_NeikiAnalytics.exe	44
PID 2288 wrote to memory of 2856	2288	8299291116572e81c4a532247dfb92d0_NeikiAnalytics.exe	44
PID 2288 wrote to memory of 2892	2288	8299291116572e81c4a532247dfb92d0_NeikiAnalytics.exe	45
PID 2288 wrote to memory of 2892	2288	8299291116572e81c4a532247dfb92d0_NeikiAnalytics.exe	45
PID 2288 wrote to memory of 2892	2288	8299291116572e81c4a532247dfb92d0_NeikiAnalytics.exe	45
PID 2288 wrote to memory of 3016	2288	8299291116572e81c4a532247dfb92d0_NeikiAnalytics.exe	46
PID 2288 wrote to memory of 3016	2288	8299291116572e81c4a532247dfb92d0_NeikiAnalytics.exe	46
PID 2288 wrote to memory of 3016	2288	8299291116572e81c4a532247dfb92d0_NeikiAnalytics.exe	46
PID 2288 wrote to memory of 1996	2288	8299291116572e81c4a532247dfb92d0_NeikiAnalytics.exe	47
PID 2288 wrote to memory of 1996	2288	8299291116572e81c4a532247dfb92d0_NeikiAnalytics.exe	47
PID 2288 wrote to memory of 1996	2288	8299291116572e81c4a532247dfb92d0_NeikiAnalytics.exe	47
PID 2288 wrote to memory of 620	2288	8299291116572e81c4a532247dfb92d0_NeikiAnalytics.exe	48
PID 2288 wrote to memory of 620	2288	8299291116572e81c4a532247dfb92d0_NeikiAnalytics.exe	48
PID 2288 wrote to memory of 620	2288	8299291116572e81c4a532247dfb92d0_NeikiAnalytics.exe	48
PID 2288 wrote to memory of 1296	2288	8299291116572e81c4a532247dfb92d0_NeikiAnalytics.exe	49
PID 2288 wrote to memory of 1296	2288	8299291116572e81c4a532247dfb92d0_NeikiAnalytics.exe	49
PID 2288 wrote to memory of 1296	2288	8299291116572e81c4a532247dfb92d0_NeikiAnalytics.exe	49
PID 2288 wrote to memory of 1040	2288	8299291116572e81c4a532247dfb92d0_NeikiAnalytics.exe	50

C:\Users\Admin\AppData\Local\Temp\8299291116572e81c4a532247dfb92d0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\8299291116572e81c4a532247dfb92d0_NeikiAnalytics.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2288
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2252
- C:\Windows\System\PFLxUgd.exe
  C:\Windows\System\PFLxUgd.exe
  2⤵
  - Executes dropped EXE
  PID:2748
- C:\Windows\System\sBFDrwB.exe
  C:\Windows\System\sBFDrwB.exe
  2⤵
  - Executes dropped EXE
  PID:2088
- C:\Windows\System\LIOTHsM.exe
  C:\Windows\System\LIOTHsM.exe
  2⤵
  - Executes dropped EXE
  PID:2728
- C:\Windows\System\pakGXwV.exe
  C:\Windows\System\pakGXwV.exe
  2⤵
  - Executes dropped EXE
  PID:2924
- C:\Windows\System\hcNjJTm.exe
  C:\Windows\System\hcNjJTm.exe
  2⤵
  - Executes dropped EXE
  PID:2564
- C:\Windows\System\wVkZZiY.exe
  C:\Windows\System\wVkZZiY.exe
  2⤵
  - Executes dropped EXE
  PID:2752
- C:\Windows\System\OqvdDtt.exe
  C:\Windows\System\OqvdDtt.exe
  2⤵
  - Executes dropped EXE
  PID:2584
- C:\Windows\System\CsIDZhP.exe
  C:\Windows\System\CsIDZhP.exe
  2⤵
  - Executes dropped EXE
  PID:2788
- C:\Windows\System\hKqioPH.exe
  C:\Windows\System\hKqioPH.exe
  2⤵
  - Executes dropped EXE
  PID:2556
- C:\Windows\System\GWNdRrL.exe
  C:\Windows\System\GWNdRrL.exe
  2⤵
  - Executes dropped EXE
  PID:2656
- C:\Windows\System\giYkBSX.exe
  C:\Windows\System\giYkBSX.exe
  2⤵
  - Executes dropped EXE
  PID:2580
- C:\Windows\System\dSAVREU.exe
  C:\Windows\System\dSAVREU.exe
  2⤵
  - Executes dropped EXE
  PID:3024
- C:\Windows\System\BGSwKYU.exe
  C:\Windows\System\BGSwKYU.exe
  2⤵
  - Executes dropped EXE
  PID:2028
- C:\Windows\System\qPDfoIG.exe
  C:\Windows\System\qPDfoIG.exe
  2⤵
  - Executes dropped EXE
  PID:2792
- C:\Windows\System\foyocTc.exe
  C:\Windows\System\foyocTc.exe
  2⤵
  - Executes dropped EXE
  PID:2856
- C:\Windows\System\PkDQaws.exe
  C:\Windows\System\PkDQaws.exe
  2⤵
  - Executes dropped EXE
  PID:2892
- C:\Windows\System\cGrfEpO.exe
  C:\Windows\System\cGrfEpO.exe
  2⤵
  - Executes dropped EXE
  PID:3016
- C:\Windows\System\cmdmpOV.exe
  C:\Windows\System\cmdmpOV.exe
  2⤵
  - Executes dropped EXE
  PID:1996
- C:\Windows\System\AUsbLCL.exe
  C:\Windows\System\AUsbLCL.exe
  2⤵
  - Executes dropped EXE
  PID:620
- C:\Windows\System\LAxEYba.exe
  C:\Windows\System\LAxEYba.exe
  2⤵
  - Executes dropped EXE
  PID:1296
- C:\Windows\System\yDkFNla.exe
  C:\Windows\System\yDkFNla.exe
  2⤵
  - Executes dropped EXE
  PID:1040
- C:\Windows\System\bJTkoJm.exe
  C:\Windows\System\bJTkoJm.exe
  2⤵
  - Executes dropped EXE
  PID:1704
- C:\Windows\System\nhCNVxp.exe
  C:\Windows\System\nhCNVxp.exe
  2⤵
  - Executes dropped EXE
  PID:1064
- C:\Windows\System\QIlfNUU.exe
  C:\Windows\System\QIlfNUU.exe
  2⤵
  - Executes dropped EXE
  PID:2412
- C:\Windows\System\LFbSRbl.exe
  C:\Windows\System\LFbSRbl.exe
  2⤵
  - Executes dropped EXE
  PID:1592
- C:\Windows\System\jEPCXlw.exe
  C:\Windows\System\jEPCXlw.exe
  2⤵
  - Executes dropped EXE
  PID:1572
- C:\Windows\System\KifzXXH.exe
  C:\Windows\System\KifzXXH.exe
  2⤵
  - Executes dropped EXE
  PID:2632
- C:\Windows\System\hxpnMbr.exe
  C:\Windows\System\hxpnMbr.exe
  2⤵
  - Executes dropped EXE
  PID:2940
- C:\Windows\System\wjbPAXi.exe
  C:\Windows\System\wjbPAXi.exe
  2⤵
  - Executes dropped EXE
  PID:680
- C:\Windows\System\cHYiXYS.exe
  C:\Windows\System\cHYiXYS.exe
  2⤵
  - Executes dropped EXE
  PID:1168
- C:\Windows\System\gZvmDZt.exe
  C:\Windows\System\gZvmDZt.exe
  2⤵
  - Executes dropped EXE
  PID:584
- C:\Windows\System\usOToVB.exe
  C:\Windows\System\usOToVB.exe
  2⤵
  - Executes dropped EXE
  PID:1496
- C:\Windows\System\jHScFIE.exe
  C:\Windows\System\jHScFIE.exe
  2⤵
  - Executes dropped EXE
  PID:836
- C:\Windows\System\tITmvfp.exe
  C:\Windows\System\tITmvfp.exe
  2⤵
  - Executes dropped EXE
  PID:1848
- C:\Windows\System\xyWHLGW.exe
  C:\Windows\System\xyWHLGW.exe
  2⤵
  - Executes dropped EXE
  PID:2508
- C:\Windows\System\KxhKBwM.exe
  C:\Windows\System\KxhKBwM.exe
  2⤵
  - Executes dropped EXE
  PID:376
- C:\Windows\System\sABSMNU.exe
  C:\Windows\System\sABSMNU.exe
  2⤵
  - Executes dropped EXE
  PID:1948
- C:\Windows\System\adAYTKI.exe
  C:\Windows\System\adAYTKI.exe
  2⤵
  - Executes dropped EXE
  PID:356
- C:\Windows\System\AHUYGuh.exe
  C:\Windows\System\AHUYGuh.exe
  2⤵
  - Executes dropped EXE
  PID:3060
- C:\Windows\System\NzNbTtm.exe
  C:\Windows\System\NzNbTtm.exe
  2⤵
  - Executes dropped EXE
  PID:1600
- C:\Windows\System\DATJVVY.exe
  C:\Windows\System\DATJVVY.exe
  2⤵
  - Executes dropped EXE
  PID:1560
- C:\Windows\System\UVEOvyV.exe
  C:\Windows\System\UVEOvyV.exe
  2⤵
  - Executes dropped EXE
  PID:2040
- C:\Windows\System\aBqieTF.exe
  C:\Windows\System\aBqieTF.exe
  2⤵
  - Executes dropped EXE
  PID:1384
- C:\Windows\System\qkEWXtt.exe
  C:\Windows\System\qkEWXtt.exe
  2⤵
  - Executes dropped EXE
  PID:1928
- C:\Windows\System\HbjBXlR.exe
  C:\Windows\System\HbjBXlR.exe
  2⤵
  - Executes dropped EXE
  PID:2976
- C:\Windows\System\qwwSyPS.exe
  C:\Windows\System\qwwSyPS.exe
  2⤵
  - Executes dropped EXE
  PID:2948
- C:\Windows\System\xIykzTf.exe
  C:\Windows\System\xIykzTf.exe
  2⤵
  - Executes dropped EXE
  PID:692
- C:\Windows\System\uZMvpcs.exe
  C:\Windows\System\uZMvpcs.exe
  2⤵
  - Executes dropped EXE
  PID:2056
- C:\Windows\System\vTpNMkc.exe
  C:\Windows\System\vTpNMkc.exe
  2⤵
  - Executes dropped EXE
  PID:1804
- C:\Windows\System\JfyDHNe.exe
  C:\Windows\System\JfyDHNe.exe
  2⤵
  - Executes dropped EXE
  PID:2324
- C:\Windows\System\HOYgOss.exe
  C:\Windows\System\HOYgOss.exe
  2⤵
  - Executes dropped EXE
  PID:1888
- C:\Windows\System\UirDTIF.exe
  C:\Windows\System\UirDTIF.exe
  2⤵
  - Executes dropped EXE
  PID:1724
- C:\Windows\System\VceuAjW.exe
  C:\Windows\System\VceuAjW.exe
  2⤵
  - Executes dropped EXE
  PID:2052
- C:\Windows\System\bkShdNw.exe
  C:\Windows\System\bkShdNw.exe
  2⤵
  - Executes dropped EXE
  PID:1328
- C:\Windows\System\xUTZJQL.exe
  C:\Windows\System\xUTZJQL.exe
  2⤵
  - Executes dropped EXE
  PID:2676
- C:\Windows\System\bjxMxjh.exe
  C:\Windows\System\bjxMxjh.exe
  2⤵
  - Executes dropped EXE
  PID:1628
- C:\Windows\System\OHhUpgP.exe
  C:\Windows\System\OHhUpgP.exe
  2⤵
  - Executes dropped EXE
  PID:2280
- C:\Windows\System\svbflwa.exe
  C:\Windows\System\svbflwa.exe
  2⤵
  - Executes dropped EXE
  PID:2692
- C:\Windows\System\qwzTkfM.exe
  C:\Windows\System\qwzTkfM.exe
  2⤵
  - Executes dropped EXE
  PID:2832
- C:\Windows\System\gzDjYQZ.exe
  C:\Windows\System\gzDjYQZ.exe
  2⤵
  - Executes dropped EXE
  PID:2368
- C:\Windows\System\CPKqHDE.exe
  C:\Windows\System\CPKqHDE.exe
  2⤵
  - Executes dropped EXE
  PID:2980
- C:\Windows\System\IyJeehZ.exe
  C:\Windows\System\IyJeehZ.exe
  2⤵
  - Executes dropped EXE
  PID:1348
- C:\Windows\System\JFaayMi.exe
  C:\Windows\System\JFaayMi.exe
  2⤵
  - Executes dropped EXE
  PID:2628
- C:\Windows\System\pONhUGK.exe
  C:\Windows\System\pONhUGK.exe
  2⤵
  - Executes dropped EXE
  PID:2068
- C:\Windows\System\eUYhHQp.exe
  C:\Windows\System\eUYhHQp.exe
  2⤵
  PID:2388
- C:\Windows\System\PCHxoeQ.exe
  C:\Windows\System\PCHxoeQ.exe
  2⤵
  PID:1540
- C:\Windows\System\ZLxNYfo.exe
  C:\Windows\System\ZLxNYfo.exe
  2⤵
  PID:2548
- C:\Windows\System\ZtmYBoh.exe
  C:\Windows\System\ZtmYBoh.exe
  2⤵
  PID:1864
- C:\Windows\System\MzSWhBq.exe
  C:\Windows\System\MzSWhBq.exe
  2⤵
  PID:2188
- C:\Windows\System\TrQgKnV.exe
  C:\Windows\System\TrQgKnV.exe
  2⤵
  PID:1932
- C:\Windows\System\crnMimB.exe
  C:\Windows\System\crnMimB.exe
  2⤵
  PID:2880
- C:\Windows\System\HYfIQfk.exe
  C:\Windows\System\HYfIQfk.exe
  2⤵
  PID:3000
- C:\Windows\System\RPXPBKH.exe
  C:\Windows\System\RPXPBKH.exe
  2⤵
  PID:1588
- C:\Windows\System\chXyuhh.exe
  C:\Windows\System\chXyuhh.exe
  2⤵
  PID:1680
- C:\Windows\System\cKxOCOh.exe
  C:\Windows\System\cKxOCOh.exe
  2⤵
  PID:2820
- C:\Windows\System\tBikyRv.exe
  C:\Windows\System\tBikyRv.exe
  2⤵
  PID:2340
- C:\Windows\System\FnNmoGd.exe
  C:\Windows\System\FnNmoGd.exe
  2⤵
  PID:1448
- C:\Windows\System\ZyRsOXF.exe
  C:\Windows\System\ZyRsOXF.exe
  2⤵
  PID:900
- C:\Windows\System\wGsxNAN.exe
  C:\Windows\System\wGsxNAN.exe
  2⤵
  PID:1664
- C:\Windows\System\IODWCpd.exe
  C:\Windows\System\IODWCpd.exe
  2⤵
  PID:2072
- C:\Windows\System\LxkvMZd.exe
  C:\Windows\System\LxkvMZd.exe
  2⤵
  PID:1028
- C:\Windows\System\lmeUTOh.exe
  C:\Windows\System\lmeUTOh.exe
  2⤵
  PID:560
- C:\Windows\System\GicbbYO.exe
  C:\Windows\System\GicbbYO.exe
  2⤵
  PID:2024
- C:\Windows\System\RdmjCVI.exe
  C:\Windows\System\RdmjCVI.exe
  2⤵
  PID:2212
- C:\Windows\System\OVjDFbC.exe
  C:\Windows\System\OVjDFbC.exe
  2⤵
  PID:484
- C:\Windows\System\BfLqenK.exe
  C:\Windows\System\BfLqenK.exe
  2⤵
  PID:1380
- C:\Windows\System\mzTUYfw.exe
  C:\Windows\System\mzTUYfw.exe
  2⤵
  PID:2884
- C:\Windows\System\PhzrFPC.exe
  C:\Windows\System\PhzrFPC.exe
  2⤵
  PID:948
- C:\Windows\System\srtHyfN.exe
  C:\Windows\System\srtHyfN.exe
  2⤵
  PID:876
- C:\Windows\System\RxEnmRY.exe
  C:\Windows\System\RxEnmRY.exe
  2⤵
  PID:2848
- C:\Windows\System\tHFuyoT.exe
  C:\Windows\System\tHFuyoT.exe
  2⤵
  PID:1728
- C:\Windows\System\vFgHAJG.exe
  C:\Windows\System\vFgHAJG.exe
  2⤵
  PID:2876
- C:\Windows\System\HJdpHSs.exe
  C:\Windows\System\HJdpHSs.exe
  2⤵
  PID:1604
- C:\Windows\System\tHMQZNN.exe
  C:\Windows\System\tHMQZNN.exe
  2⤵
  PID:1988
- C:\Windows\System\tfZzueJ.exe
  C:\Windows\System\tfZzueJ.exe
  2⤵
  PID:712
- C:\Windows\System\ZGcIUiL.exe
  C:\Windows\System\ZGcIUiL.exe
  2⤵
  PID:1692
- C:\Windows\System\MEptKfc.exe
  C:\Windows\System\MEptKfc.exe
  2⤵
  PID:2532
- C:\Windows\System\nrFGISQ.exe
  C:\Windows\System\nrFGISQ.exe
  2⤵
  PID:2720
- C:\Windows\System\VoFmAoC.exe
  C:\Windows\System\VoFmAoC.exe
  2⤵
  PID:2472
- C:\Windows\System\PBroiqk.exe
  C:\Windows\System\PBroiqk.exe
  2⤵
  PID:2268
- C:\Windows\System\kEAYVVq.exe
  C:\Windows\System\kEAYVVq.exe
  2⤵
  PID:380
- C:\Windows\System\WIHeKqA.exe
  C:\Windows\System\WIHeKqA.exe
  2⤵
  PID:3008
- C:\Windows\System\WVJpnQG.exe
  C:\Windows\System\WVJpnQG.exe
  2⤵
  PID:2576
- C:\Windows\System\MGIhCrM.exe
  C:\Windows\System\MGIhCrM.exe
  2⤵
  PID:316
- C:\Windows\System\jlAdIYR.exe
  C:\Windows\System\jlAdIYR.exe
  2⤵
  PID:2100
- C:\Windows\System\jxsaCWd.exe
  C:\Windows\System\jxsaCWd.exe
  2⤵
  PID:2520
- C:\Windows\System\GZNstQt.exe
  C:\Windows\System\GZNstQt.exe
  2⤵
  PID:2504
- C:\Windows\System\HTiIReu.exe
  C:\Windows\System\HTiIReu.exe
  2⤵
  PID:2200
- C:\Windows\System\OsNtOrG.exe
  C:\Windows\System\OsNtOrG.exe
  2⤵
  PID:952
- C:\Windows\System\RXjGZzj.exe
  C:\Windows\System\RXjGZzj.exe
  2⤵
  PID:908
- C:\Windows\System\lRzWiDv.exe
  C:\Windows\System\lRzWiDv.exe
  2⤵
  PID:304
- C:\Windows\System\gMNZQmA.exe
  C:\Windows\System\gMNZQmA.exe
  2⤵
  PID:888
- C:\Windows\System\oPoBMbX.exe
  C:\Windows\System\oPoBMbX.exe
  2⤵
  PID:3036
- C:\Windows\System\BTfKlZn.exe
  C:\Windows\System\BTfKlZn.exe
  2⤵
  PID:1620
- C:\Windows\System\gnTeauj.exe
  C:\Windows\System\gnTeauj.exe
  2⤵
  PID:1544
- C:\Windows\System\bJnHZUC.exe
  C:\Windows\System\bJnHZUC.exe
  2⤵
  PID:612
- C:\Windows\System\CzjLaoY.exe
  C:\Windows\System\CzjLaoY.exe
  2⤵
  PID:2604
- C:\Windows\System\orxnHJb.exe
  C:\Windows\System\orxnHJb.exe
  2⤵
  PID:2596
- C:\Windows\System\gbwjZHM.exe
  C:\Windows\System\gbwjZHM.exe
  2⤵
  PID:2328
- C:\Windows\System\hOLdRSs.exe
  C:\Windows\System\hOLdRSs.exe
  2⤵
  PID:2992
- C:\Windows\System\sVvLjBE.exe
  C:\Windows\System\sVvLjBE.exe
  2⤵
  PID:1872
- C:\Windows\System\DhigmRZ.exe
  C:\Windows\System\DhigmRZ.exe
  2⤵
  PID:784
- C:\Windows\System\iONVlyj.exe
  C:\Windows\System\iONVlyj.exe
  2⤵
  PID:1656
- C:\Windows\System\xXqtJuC.exe
  C:\Windows\System\xXqtJuC.exe
  2⤵
  PID:1200
- C:\Windows\System\gowhuzS.exe
  C:\Windows\System\gowhuzS.exe
  2⤵
  PID:600
- C:\Windows\System\AuxzJam.exe
  C:\Windows\System\AuxzJam.exe
  2⤵
  PID:2568
- C:\Windows\System\EZTOQcF.exe
  C:\Windows\System\EZTOQcF.exe
  2⤵
  PID:1520
- C:\Windows\System\ZYIJvlL.exe
  C:\Windows\System\ZYIJvlL.exe
  2⤵
  PID:2804
- C:\Windows\System\AiJXndR.exe
  C:\Windows\System\AiJXndR.exe
  2⤵
  PID:3012
- C:\Windows\System\sMZKVRl.exe
  C:\Windows\System\sMZKVRl.exe
  2⤵
  PID:2004
- C:\Windows\System\gQuKVNB.exe
  C:\Windows\System\gQuKVNB.exe
  2⤵
  PID:528
- C:\Windows\System\NQCPhlh.exe
  C:\Windows\System\NQCPhlh.exe
  2⤵
  PID:3088
- C:\Windows\System\YPmkNsv.exe
  C:\Windows\System\YPmkNsv.exe
  2⤵
  PID:3112
- C:\Windows\System\BUlzcZJ.exe
  C:\Windows\System\BUlzcZJ.exe
  2⤵
  PID:3128
- C:\Windows\System\BEIUMMk.exe
  C:\Windows\System\BEIUMMk.exe
  2⤵
  PID:3144
- C:\Windows\System\tuFriof.exe
  C:\Windows\System\tuFriof.exe
  2⤵
  PID:3160
- C:\Windows\System\WUIdBzq.exe
  C:\Windows\System\WUIdBzq.exe
  2⤵
  PID:3180
- C:\Windows\System\oyXZfXX.exe
  C:\Windows\System\oyXZfXX.exe
  2⤵
  PID:3196
- C:\Windows\System\NbhfjRU.exe
  C:\Windows\System\NbhfjRU.exe
  2⤵
  PID:3212
- C:\Windows\System\mAJpwCl.exe
  C:\Windows\System\mAJpwCl.exe
  2⤵
  PID:3228
- C:\Windows\System\orTeDMT.exe
  C:\Windows\System\orTeDMT.exe
  2⤵
  PID:3252
- C:\Windows\System\lIFnzLM.exe
  C:\Windows\System\lIFnzLM.exe
  2⤵
  PID:3268
- C:\Windows\System\monLTjZ.exe
  C:\Windows\System\monLTjZ.exe
  2⤵
  PID:3288
- C:\Windows\System\naKsWlA.exe
  C:\Windows\System\naKsWlA.exe
  2⤵
  PID:3304
- C:\Windows\System\GvqMDzk.exe
  C:\Windows\System\GvqMDzk.exe
  2⤵
  PID:3324
- C:\Windows\System\lVDYpdf.exe
  C:\Windows\System\lVDYpdf.exe
  2⤵
  PID:3340
- C:\Windows\System\VBKxMpX.exe
  C:\Windows\System\VBKxMpX.exe
  2⤵
  PID:3360
- C:\Windows\System\bxwuTFU.exe
  C:\Windows\System\bxwuTFU.exe
  2⤵
  PID:3376
- C:\Windows\System\FpJjBWs.exe
  C:\Windows\System\FpJjBWs.exe
  2⤵
  PID:3396
- C:\Windows\System\wLcgnVR.exe
  C:\Windows\System\wLcgnVR.exe
  2⤵
  PID:3416
- C:\Windows\System\hOyoZqf.exe
  C:\Windows\System\hOyoZqf.exe
  2⤵
  PID:3468
- C:\Windows\System\wjwapZO.exe
  C:\Windows\System\wjwapZO.exe
  2⤵
  PID:3520
- C:\Windows\System\ixUZNJI.exe
  C:\Windows\System\ixUZNJI.exe
  2⤵
  PID:3536
- C:\Windows\System\xrQnFNR.exe
  C:\Windows\System\xrQnFNR.exe
  2⤵
  PID:3552
- C:\Windows\System\OSpUlho.exe
  C:\Windows\System\OSpUlho.exe
  2⤵
  PID:3568
- C:\Windows\System\wIBrCQI.exe
  C:\Windows\System\wIBrCQI.exe
  2⤵
  PID:3584
- C:\Windows\System\ohWJLdb.exe
  C:\Windows\System\ohWJLdb.exe
  2⤵
  PID:3600
- C:\Windows\System\KfNjhmz.exe
  C:\Windows\System\KfNjhmz.exe
  2⤵
  PID:3616
- C:\Windows\System\HJIILSc.exe
  C:\Windows\System\HJIILSc.exe
  2⤵
  PID:3640
- C:\Windows\System\NVUgEaO.exe
  C:\Windows\System\NVUgEaO.exe
  2⤵
  PID:3656
- C:\Windows\System\AIZXxbk.exe
  C:\Windows\System\AIZXxbk.exe
  2⤵
  PID:3672
- C:\Windows\System\vQaEJQB.exe
  C:\Windows\System\vQaEJQB.exe
  2⤵
  PID:3688
- C:\Windows\System\ArCJGfM.exe
  C:\Windows\System\ArCJGfM.exe
  2⤵
  PID:3712
- C:\Windows\System\dmFLVzz.exe
  C:\Windows\System\dmFLVzz.exe
  2⤵
  PID:3728
- C:\Windows\System\iNSxwKi.exe
  C:\Windows\System\iNSxwKi.exe
  2⤵
  PID:3744
- C:\Windows\System\bOqqnPE.exe
  C:\Windows\System\bOqqnPE.exe
  2⤵
  PID:3760
- C:\Windows\System\LKqftqe.exe
  C:\Windows\System\LKqftqe.exe
  2⤵
  PID:3784
- C:\Windows\System\uzmFlsw.exe
  C:\Windows\System\uzmFlsw.exe
  2⤵
  PID:3800
- C:\Windows\System\MuGZMyC.exe
  C:\Windows\System\MuGZMyC.exe
  2⤵
  PID:3828
- C:\Windows\System\UTCMpdf.exe
  C:\Windows\System\UTCMpdf.exe
  2⤵
  PID:3888
- C:\Windows\System\dXLEQZC.exe
  C:\Windows\System\dXLEQZC.exe
  2⤵
  PID:3908
- C:\Windows\System\gWmTlBB.exe
  C:\Windows\System\gWmTlBB.exe
  2⤵
  PID:3928
- C:\Windows\System\HebuptV.exe
  C:\Windows\System\HebuptV.exe
  2⤵
  PID:3948
- C:\Windows\System\ZBvHXsj.exe
  C:\Windows\System\ZBvHXsj.exe
  2⤵
  PID:3968
- C:\Windows\System\MgAwYMb.exe
  C:\Windows\System\MgAwYMb.exe
  2⤵
  PID:3988
- C:\Windows\System\gFxqyId.exe
  C:\Windows\System\gFxqyId.exe
  2⤵
  PID:4008
- C:\Windows\System\FPIGmAl.exe
  C:\Windows\System\FPIGmAl.exe
  2⤵
  PID:4028
- C:\Windows\System\gwHXrQR.exe
  C:\Windows\System\gwHXrQR.exe
  2⤵
  PID:4048
- C:\Windows\System\KVxiDjk.exe
  C:\Windows\System\KVxiDjk.exe
  2⤵
  PID:4068
- C:\Windows\System\rjbKsnS.exe
  C:\Windows\System\rjbKsnS.exe
  2⤵
  PID:4084
- C:\Windows\System\WbyCowE.exe
  C:\Windows\System\WbyCowE.exe
  2⤵
  PID:1048
- C:\Windows\System\tdtFTny.exe
  C:\Windows\System\tdtFTny.exe
  2⤵
  PID:2192
- C:\Windows\System\qsLxnXo.exe
  C:\Windows\System\qsLxnXo.exe
  2⤵
  PID:1820
- C:\Windows\System\xnPFYch.exe
  C:\Windows\System\xnPFYch.exe
  2⤵
  PID:308
- C:\Windows\System\BXXbjDI.exe
  C:\Windows\System\BXXbjDI.exe
  2⤵
  PID:3124
- C:\Windows\System\rIIMzLF.exe
  C:\Windows\System\rIIMzLF.exe
  2⤵
  PID:3220
- C:\Windows\System\puTWuVP.exe
  C:\Windows\System\puTWuVP.exe
  2⤵
  PID:3332
- C:\Windows\System\vKXUBip.exe
  C:\Windows\System\vKXUBip.exe
  2⤵
  PID:3404
- C:\Windows\System\YvsquCq.exe
  C:\Windows\System\YvsquCq.exe
  2⤵
  PID:2144
- C:\Windows\System\VpHUOdC.exe
  C:\Windows\System\VpHUOdC.exe
  2⤵
  PID:2224
- C:\Windows\System\skwMoyk.exe
  C:\Windows\System\skwMoyk.exe
  2⤵
  PID:300
- C:\Windows\System\aBysJfQ.exe
  C:\Windows\System\aBysJfQ.exe
  2⤵
  PID:3484
- C:\Windows\System\DIEhZRo.exe
  C:\Windows\System\DIEhZRo.exe
  2⤵
  PID:3516
- C:\Windows\System\ATRxOra.exe
  C:\Windows\System\ATRxOra.exe
  2⤵
  PID:3612
- C:\Windows\System\FOLmDUz.exe
  C:\Windows\System\FOLmDUz.exe
  2⤵
  PID:3684
- C:\Windows\System\kefKzAv.exe
  C:\Windows\System\kefKzAv.exe
  2⤵
  PID:3792
- C:\Windows\System\TJScpip.exe
  C:\Windows\System\TJScpip.exe
  2⤵
  PID:656
- C:\Windows\System\gsvHwlN.exe
  C:\Windows\System\gsvHwlN.exe
  2⤵
  PID:3096
- C:\Windows\System\HlGoXDe.exe
  C:\Windows\System\HlGoXDe.exe
  2⤵
  PID:3136
- C:\Windows\System\yhWENGP.exe
  C:\Windows\System\yhWENGP.exe
  2⤵
  PID:3204
- C:\Windows\System\iZHzuJk.exe
  C:\Windows\System\iZHzuJk.exe
  2⤵
  PID:2812
- C:\Windows\System\jVvDUQv.exe
  C:\Windows\System\jVvDUQv.exe
  2⤵
  PID:3248
- C:\Windows\System\JGJjwgw.exe
  C:\Windows\System\JGJjwgw.exe
  2⤵
  PID:3312
- C:\Windows\System\HOxadqT.exe
  C:\Windows\System\HOxadqT.exe
  2⤵
  PID:3352
- C:\Windows\System\MUgRSmm.exe
  C:\Windows\System\MUgRSmm.exe
  2⤵
  PID:3840
- C:\Windows\System\pfGiNtd.exe
  C:\Windows\System\pfGiNtd.exe
  2⤵
  PID:1060
- C:\Windows\System\UZfmQPM.exe
  C:\Windows\System\UZfmQPM.exe
  2⤵
  PID:3436
- C:\Windows\System\QgMDrBw.exe
  C:\Windows\System\QgMDrBw.exe
  2⤵
  PID:3452
- C:\Windows\System\NRVdsru.exe
  C:\Windows\System\NRVdsru.exe
  2⤵
  PID:3464
- C:\Windows\System\fheznMJ.exe
  C:\Windows\System\fheznMJ.exe
  2⤵
  PID:3860
- C:\Windows\System\TOMzwCE.exe
  C:\Windows\System\TOMzwCE.exe
  2⤵
  PID:3564
- C:\Windows\System\AhjHVun.exe
  C:\Windows\System\AhjHVun.exe
  2⤵
  PID:3628
- C:\Windows\System\tSGWhEm.exe
  C:\Windows\System\tSGWhEm.exe
  2⤵
  PID:3668
- C:\Windows\System\fgqzCCf.exe
  C:\Windows\System\fgqzCCf.exe
  2⤵
  PID:3704
- C:\Windows\System\ALJFkfw.exe
  C:\Windows\System\ALJFkfw.exe
  2⤵
  PID:3708
- C:\Windows\System\vTIjkXX.exe
  C:\Windows\System\vTIjkXX.exe
  2⤵
  PID:3772
- C:\Windows\System\XuArGoG.exe
  C:\Windows\System\XuArGoG.exe
  2⤵
  PID:3812
- C:\Windows\System\XbAWFcz.exe
  C:\Windows\System\XbAWFcz.exe
  2⤵
  PID:3880
- C:\Windows\System\OSYMtGq.exe
  C:\Windows\System\OSYMtGq.exe
  2⤵
  PID:3916
- C:\Windows\System\OAGMGRF.exe
  C:\Windows\System\OAGMGRF.exe
  2⤵
  PID:3964
- C:\Windows\System\DWecvsz.exe
  C:\Windows\System\DWecvsz.exe
  2⤵
  PID:3960
- C:\Windows\System\iGjezGx.exe
  C:\Windows\System\iGjezGx.exe
  2⤵
  PID:3984
- C:\Windows\System\gzIuKLp.exe
  C:\Windows\System\gzIuKLp.exe
  2⤵
  PID:4076
- C:\Windows\System\gXEStyG.exe
  C:\Windows\System\gXEStyG.exe
  2⤵
  PID:1076
- C:\Windows\System\hDOlrtC.exe
  C:\Windows\System\hDOlrtC.exe
  2⤵
  PID:3192
- C:\Windows\System\quSlmSb.exe
  C:\Windows\System\quSlmSb.exe
  2⤵
  PID:1644
- C:\Windows\System\gFuKPVP.exe
  C:\Windows\System\gFuKPVP.exe
  2⤵
  PID:2496
- C:\Windows\System\DeQHTAN.exe
  C:\Windows\System\DeQHTAN.exe
  2⤵
  PID:2184
- C:\Windows\System\mbbMWhb.exe
  C:\Windows\System\mbbMWhb.exe
  2⤵
  PID:1688
- C:\Windows\System\cVqCXWv.exe
  C:\Windows\System\cVqCXWv.exe
  2⤵
  PID:3580
- C:\Windows\System\ROlqybu.exe
  C:\Windows\System\ROlqybu.exe
  2⤵
  PID:4056
- C:\Windows\System\yBLkwlY.exe
  C:\Windows\System\yBLkwlY.exe
  2⤵
  PID:852
- C:\Windows\System\tTxNyJF.exe
  C:\Windows\System\tTxNyJF.exe
  2⤵
  PID:3576
- C:\Windows\System\oHneFsx.exe
  C:\Windows\System\oHneFsx.exe
  2⤵
  PID:3752
- C:\Windows\System\GrojfSd.exe
  C:\Windows\System\GrojfSd.exe
  2⤵
  PID:3176
- C:\Windows\System\xMWyCBs.exe
  C:\Windows\System\xMWyCBs.exe
  2⤵
  PID:3348
- C:\Windows\System\DabnYDA.exe
  C:\Windows\System\DabnYDA.exe
  2⤵
  PID:4112
- C:\Windows\System\NQpMqfW.exe
  C:\Windows\System\NQpMqfW.exe
  2⤵
  PID:4128
- C:\Windows\System\ccjDQQJ.exe
  C:\Windows\System\ccjDQQJ.exe
  2⤵
  PID:4144
- C:\Windows\System\zYhwliD.exe
  C:\Windows\System\zYhwliD.exe
  2⤵
  PID:4160
- C:\Windows\System\aHKsOLS.exe
  C:\Windows\System\aHKsOLS.exe
  2⤵
  PID:4176
- C:\Windows\System\JnuEFOY.exe
  C:\Windows\System\JnuEFOY.exe
  2⤵
  PID:4192
- C:\Windows\System\DcOUnsK.exe
  C:\Windows\System\DcOUnsK.exe
  2⤵
  PID:4208
- C:\Windows\System\rVZbuDt.exe
  C:\Windows\System\rVZbuDt.exe
  2⤵
  PID:4364
- C:\Windows\System\rhFdKUt.exe
  C:\Windows\System\rhFdKUt.exe
  2⤵
  PID:4380
- C:\Windows\System\GzlwlCg.exe
  C:\Windows\System\GzlwlCg.exe
  2⤵
  PID:4396
- C:\Windows\System\VyjPrMX.exe
  C:\Windows\System\VyjPrMX.exe
  2⤵
  PID:4412
- C:\Windows\System\veHbQme.exe
  C:\Windows\System\veHbQme.exe
  2⤵
  PID:4428
- C:\Windows\System\TEjkJgc.exe
  C:\Windows\System\TEjkJgc.exe
  2⤵
  PID:4448
- C:\Windows\System\ilpiZQZ.exe
  C:\Windows\System\ilpiZQZ.exe
  2⤵
  PID:4464
- C:\Windows\System\lzsuAkL.exe
  C:\Windows\System\lzsuAkL.exe
  2⤵
  PID:4480
- C:\Windows\System\OFRMKQE.exe
  C:\Windows\System\OFRMKQE.exe
  2⤵
  PID:4496
- C:\Windows\System\eXLeysH.exe
  C:\Windows\System\eXLeysH.exe
  2⤵
  PID:4512
- C:\Windows\System\iUxVtxx.exe
  C:\Windows\System\iUxVtxx.exe
  2⤵
  PID:4540
- C:\Windows\System\QcXiSKR.exe
  C:\Windows\System\QcXiSKR.exe
  2⤵
  PID:4556
- C:\Windows\System\WvzqsQu.exe
  C:\Windows\System\WvzqsQu.exe
  2⤵
  PID:4572
- C:\Windows\System\aqAzuJG.exe
  C:\Windows\System\aqAzuJG.exe
  2⤵
  PID:4588
- C:\Windows\System\JRZDTpN.exe
  C:\Windows\System\JRZDTpN.exe
  2⤵
  PID:4604
- C:\Windows\System\ZfvEkNm.exe
  C:\Windows\System\ZfvEkNm.exe
  2⤵
  PID:4620
- C:\Windows\System\wkhOkgV.exe
  C:\Windows\System\wkhOkgV.exe
  2⤵
  PID:4640
- C:\Windows\System\UcSTHzL.exe
  C:\Windows\System\UcSTHzL.exe
  2⤵
  PID:4720
- C:\Windows\System\ZWlFxQH.exe
  C:\Windows\System\ZWlFxQH.exe
  2⤵
  PID:4736
- C:\Windows\System\pyrRoTU.exe
  C:\Windows\System\pyrRoTU.exe
  2⤵
  PID:4752
- C:\Windows\System\nhjyudB.exe
  C:\Windows\System\nhjyudB.exe
  2⤵
  PID:4768
- C:\Windows\System\jdKgaFY.exe
  C:\Windows\System\jdKgaFY.exe
  2⤵
  PID:4792
- C:\Windows\System\jTkZpiJ.exe
  C:\Windows\System\jTkZpiJ.exe
  2⤵
  PID:4808
- C:\Windows\System\IQSHgLT.exe
  C:\Windows\System\IQSHgLT.exe
  2⤵
  PID:4824
- C:\Windows\System\HrcDhQK.exe
  C:\Windows\System\HrcDhQK.exe
  2⤵
  PID:4840
- C:\Windows\System\pootKNK.exe
  C:\Windows\System\pootKNK.exe
  2⤵
  PID:4856
- C:\Windows\System\BfIlTZa.exe
  C:\Windows\System\BfIlTZa.exe
  2⤵
  PID:4872
- C:\Windows\System\YsJtwQQ.exe
  C:\Windows\System\YsJtwQQ.exe
  2⤵
  PID:4888
- C:\Windows\System\ceBDbET.exe
  C:\Windows\System\ceBDbET.exe
  2⤵
  PID:4904
- C:\Windows\System\XmBFVrJ.exe
  C:\Windows\System\XmBFVrJ.exe
  2⤵
  PID:4920
- C:\Windows\System\nMFvVHf.exe
  C:\Windows\System\nMFvVHf.exe
  2⤵
  PID:4936
- C:\Windows\System\qhIMqJK.exe
  C:\Windows\System\qhIMqJK.exe
  2⤵
  PID:4952
- C:\Windows\System\wsrPdxq.exe
  C:\Windows\System\wsrPdxq.exe
  2⤵
  PID:4968
- C:\Windows\System\yUOiPIE.exe
  C:\Windows\System\yUOiPIE.exe
  2⤵
  PID:4984
- C:\Windows\System\DpBqtaB.exe
  C:\Windows\System\DpBqtaB.exe
  2⤵
  PID:5000
- C:\Windows\System\ZcvbEhm.exe
  C:\Windows\System\ZcvbEhm.exe
  2⤵
  PID:5016
- C:\Windows\System\BTxqVuP.exe
  C:\Windows\System\BTxqVuP.exe
  2⤵
  PID:5032
- C:\Windows\System\TVzHsSH.exe
  C:\Windows\System\TVzHsSH.exe
  2⤵
  PID:5048
- C:\Windows\System\vIrnQSq.exe
  C:\Windows\System\vIrnQSq.exe
  2⤵
  PID:5064
- C:\Windows\System\xjFmEjp.exe
  C:\Windows\System\xjFmEjp.exe
  2⤵
  PID:5084
- C:\Windows\System\gFNmvyB.exe
  C:\Windows\System\gFNmvyB.exe
  2⤵
  PID:5100
- C:\Windows\System\HRiNPTF.exe
  C:\Windows\System\HRiNPTF.exe
  2⤵
  PID:5116
- C:\Windows\System\awuUjxG.exe
  C:\Windows\System\awuUjxG.exe
  2⤵
  PID:3444
- C:\Windows\System\FSPTGOP.exe
  C:\Windows\System\FSPTGOP.exe
  2⤵
  PID:3596
- C:\Windows\System\ijJguNs.exe
  C:\Windows\System\ijJguNs.exe
  2⤵
  PID:3740
- C:\Windows\System\aiywoDX.exe
  C:\Windows\System\aiywoDX.exe
  2⤵
  PID:3920
- C:\Windows\System\jkaFhya.exe
  C:\Windows\System\jkaFhya.exe
  2⤵
  PID:2016
- C:\Windows\System\ZZtDSwb.exe
  C:\Windows\System\ZZtDSwb.exe
  2⤵
  PID:1308
- C:\Windows\System\EvniQJF.exe
  C:\Windows\System\EvniQJF.exe
  2⤵
  PID:2908
- C:\Windows\System\SzYOVjp.exe
  C:\Windows\System\SzYOVjp.exe
  2⤵
  PID:4256
- C:\Windows\System\bXslNpQ.exe
  C:\Windows\System\bXslNpQ.exe
  2⤵
  PID:4308
- C:\Windows\System\otXeSqu.exe
  C:\Windows\System\otXeSqu.exe
  2⤵
  PID:4064
- C:\Windows\System\inVHLpo.exe
  C:\Windows\System\inVHLpo.exe
  2⤵
  PID:4320
- C:\Windows\System\RYQWgbx.exe
  C:\Windows\System\RYQWgbx.exe
  2⤵
  PID:4332
- C:\Windows\System\VRkZLGt.exe
  C:\Windows\System\VRkZLGt.exe
  2⤵
  PID:4348
- C:\Windows\System\WGwamPm.exe
  C:\Windows\System\WGwamPm.exe
  2⤵
  PID:2816
- C:\Windows\System\UvPePER.exe
  C:\Windows\System\UvPePER.exe
  2⤵
  PID:4356
- C:\Windows\System\lBnSInI.exe
  C:\Windows\System\lBnSInI.exe
  2⤵
  PID:4388
- C:\Windows\System\AbKPJxX.exe
  C:\Windows\System\AbKPJxX.exe
  2⤵
  PID:4424
- C:\Windows\System\PsjKQDz.exe
  C:\Windows\System\PsjKQDz.exe
  2⤵
  PID:4532
- C:\Windows\System\LWNiQDr.exe
  C:\Windows\System\LWNiQDr.exe
  2⤵
  PID:4520
- C:\Windows\System\ETUrndx.exe
  C:\Windows\System\ETUrndx.exe
  2⤵
  PID:3044
- C:\Windows\System\WObCwoB.exe
  C:\Windows\System\WObCwoB.exe
  2⤵
  PID:1796
- C:\Windows\System\rqgEudn.exe
  C:\Windows\System\rqgEudn.exe
  2⤵
  PID:3384
- C:\Windows\System\DEPNZjo.exe
  C:\Windows\System\DEPNZjo.exe
  2⤵
  PID:3428
- C:\Windows\System\MlvUBTE.exe
  C:\Windows\System\MlvUBTE.exe
  2⤵
  PID:3460
- C:\Windows\System\tjkTWES.exe
  C:\Windows\System\tjkTWES.exe
  2⤵
  PID:3808
- C:\Windows\System\ISexEcV.exe
  C:\Windows\System\ISexEcV.exe
  2⤵
  PID:3940
- C:\Windows\System\BlRCJCm.exe
  C:\Windows\System\BlRCJCm.exe
  2⤵
  PID:4440
- C:\Windows\System\HztGTAD.exe
  C:\Windows\System\HztGTAD.exe
  2⤵
  PID:1764
- C:\Windows\System\YakUhKR.exe
  C:\Windows\System\YakUhKR.exe
  2⤵
  PID:2128
- C:\Windows\System\soUQBLe.exe
  C:\Windows\System\soUQBLe.exe
  2⤵
  PID:4136
- C:\Windows\System\itetayZ.exe
  C:\Windows\System\itetayZ.exe
  2⤵
  PID:4200
- C:\Windows\System\HDxnKrf.exe
  C:\Windows\System\HDxnKrf.exe
  2⤵
  PID:2560
- C:\Windows\System\UDnJmve.exe
  C:\Windows\System\UDnJmve.exe
  2⤵
  PID:4404
- C:\Windows\System\QzwKzCy.exe
  C:\Windows\System\QzwKzCy.exe
  2⤵
  PID:4552
- C:\Windows\System\RfpftYj.exe
  C:\Windows\System\RfpftYj.exe
  2⤵
  PID:4616
- C:\Windows\System\pkwUAet.exe
  C:\Windows\System\pkwUAet.exe
  2⤵
  PID:4688
- C:\Windows\System\yojhizv.exe
  C:\Windows\System\yojhizv.exe
  2⤵
  PID:4704
- C:\Windows\System\UCsSOPS.exe
  C:\Windows\System\UCsSOPS.exe
  2⤵
  PID:992
- C:\Windows\System\QxiciJl.exe
  C:\Windows\System\QxiciJl.exe
  2⤵
  PID:2236
- C:\Windows\System\nwOwIGp.exe
  C:\Windows\System\nwOwIGp.exe
  2⤵
  PID:4712
- C:\Windows\System\MeuGBDj.exe
  C:\Windows\System\MeuGBDj.exe
  2⤵
  PID:2216
- C:\Windows\System\mlmXnvu.exe
  C:\Windows\System\mlmXnvu.exe
  2⤵
  PID:588
- C:\Windows\System\shgajeC.exe
  C:\Windows\System\shgajeC.exe
  2⤵
  PID:4780
- C:\Windows\System\eHkvoVy.exe
  C:\Windows\System\eHkvoVy.exe
  2⤵
  PID:4820
- C:\Windows\System\vdeufMP.exe
  C:\Windows\System\vdeufMP.exe
  2⤵
  PID:4912
- C:\Windows\System\imZZVtH.exe
  C:\Windows\System\imZZVtH.exe
  2⤵
  PID:4980
- C:\Windows\System\MPokEhU.exe
  C:\Windows\System\MPokEhU.exe
  2⤵
  PID:5040
- C:\Windows\System\xOXGxuy.exe
  C:\Windows\System\xOXGxuy.exe
  2⤵
  PID:5108
- C:\Windows\System\zLyZMln.exe
  C:\Windows\System\zLyZMln.exe
  2⤵
  PID:4852
- C:\Windows\System\xJZOUsy.exe
  C:\Windows\System\xJZOUsy.exe
  2⤵
  PID:3368
- C:\Windows\System\bvWZwnT.exe
  C:\Windows\System\bvWZwnT.exe
  2⤵
  PID:3724
- C:\Windows\System\FSDZwNG.exe
  C:\Windows\System\FSDZwNG.exe
  2⤵
  PID:4760
- C:\Windows\System\hlxJaDO.exe
  C:\Windows\System\hlxJaDO.exe
  2⤵
  PID:4804
- C:\Windows\System\kZJJVSo.exe
  C:\Windows\System\kZJJVSo.exe
  2⤵
  PID:4868
- C:\Windows\System\sNCTOjf.exe
  C:\Windows\System\sNCTOjf.exe
  2⤵
  PID:4932
- C:\Windows\System\qgWuLgJ.exe
  C:\Windows\System\qgWuLgJ.exe
  2⤵
  PID:4996
- C:\Windows\System\GOjzJSp.exe
  C:\Windows\System\GOjzJSp.exe
  2⤵
  PID:5060
- C:\Windows\System\AEKlkHR.exe
  C:\Windows\System\AEKlkHR.exe
  2⤵
  PID:3084
- C:\Windows\System\LIHiegL.exe
  C:\Windows\System\LIHiegL.exe
  2⤵
  PID:3844
- C:\Windows\System\lEtHcpH.exe
  C:\Windows\System\lEtHcpH.exe
  2⤵
  PID:3996
- C:\Windows\System\rsMVryG.exe
  C:\Windows\System\rsMVryG.exe
  2⤵
  PID:4020
- C:\Windows\System\PFUsljV.exe
  C:\Windows\System\PFUsljV.exe
  2⤵
  PID:3300
- C:\Windows\System\TanWfgI.exe
  C:\Windows\System\TanWfgI.exe
  2⤵
  PID:4120
- C:\Windows\System\AjrueZh.exe
  C:\Windows\System\AjrueZh.exe
  2⤵
  PID:4224
- C:\Windows\System\ooQHvBy.exe
  C:\Windows\System\ooQHvBy.exe
  2⤵
  PID:4236
- C:\Windows\System\gGxTjRN.exe
  C:\Windows\System\gGxTjRN.exe
  2⤵
  PID:4252
- C:\Windows\System\UWVcIul.exe
  C:\Windows\System\UWVcIul.exe
  2⤵
  PID:4276
- C:\Windows\System\NwIixcP.exe
  C:\Windows\System\NwIixcP.exe
  2⤵
  PID:4288
- C:\Windows\System\rUNorjz.exe
  C:\Windows\System\rUNorjz.exe
  2⤵
  PID:4328
- C:\Windows\System\XZWrfxv.exe
  C:\Windows\System\XZWrfxv.exe
  2⤵
  PID:4344
- C:\Windows\System\URKnHwk.exe
  C:\Windows\System\URKnHwk.exe
  2⤵
  PID:4312
- C:\Windows\System\zYzIghC.exe
  C:\Windows\System\zYzIghC.exe
  2⤵
  PID:4040
- C:\Windows\System\aOlVykq.exe
  C:\Windows\System\aOlVykq.exe
  2⤵
  PID:4152
- C:\Windows\System\YWSOeis.exe
  C:\Windows\System\YWSOeis.exe
  2⤵
  PID:4568
- C:\Windows\System\OifBGXO.exe
  C:\Windows\System\OifBGXO.exe
  2⤵
  PID:1068
- C:\Windows\System\NKbEUlx.exe
  C:\Windows\System\NKbEUlx.exe
  2⤵
  PID:4632
- C:\Windows\System\qkQJmiq.exe
  C:\Windows\System\qkQJmiq.exe
  2⤵
  PID:4636
- C:\Windows\System\XMbyUmD.exe
  C:\Windows\System\XMbyUmD.exe
  2⤵
  PID:2660
- C:\Windows\System\IDmQOxL.exe
  C:\Windows\System\IDmQOxL.exe
  2⤵
  PID:1400
- C:\Windows\System\RaXQMlK.exe
  C:\Windows\System\RaXQMlK.exe
  2⤵
  PID:2132
- C:\Windows\System\EdHPpbk.exe
  C:\Windows\System\EdHPpbk.exe
  2⤵
  PID:3392
- C:\Windows\System\aOxWKUL.exe
  C:\Windows\System\aOxWKUL.exe
  2⤵
  PID:1504
- C:\Windows\System\UdFRMMq.exe
  C:\Windows\System\UdFRMMq.exe
  2⤵
  PID:3532
- C:\Windows\System\RFlhiTS.exe
  C:\Windows\System\RFlhiTS.exe
  2⤵
  PID:1596
- C:\Windows\System\cBSpBgO.exe
  C:\Windows\System\cBSpBgO.exe
  2⤵
  PID:3780
- C:\Windows\System\LMnKwAs.exe
  C:\Windows\System\LMnKwAs.exe
  2⤵
  PID:2968
- C:\Windows\System\FGIFriT.exe
  C:\Windows\System\FGIFriT.exe
  2⤵
  PID:4168
- C:\Windows\System\VjOMUac.exe
  C:\Windows\System\VjOMUac.exe
  2⤵
  PID:3120
- C:\Windows\System\QUazyhj.exe
  C:\Windows\System\QUazyhj.exe
  2⤵
  PID:4584
- C:\Windows\System\iQogcRN.exe
  C:\Windows\System\iQogcRN.exe
  2⤵
  PID:2640
- C:\Windows\System\DxUcnNY.exe
  C:\Windows\System\DxUcnNY.exe
  2⤵
  PID:4976
- C:\Windows\System\LnxBwom.exe
  C:\Windows\System\LnxBwom.exe
  2⤵
  PID:4800
- C:\Windows\System\saTxLEt.exe
  C:\Windows\System\saTxLEt.exe
  2⤵
  PID:3864
- C:\Windows\System\GitcXQO.exe
  C:\Windows\System\GitcXQO.exe
  2⤵
  PID:4900
- C:\Windows\System\UdkrDoE.exe
  C:\Windows\System\UdkrDoE.exe
  2⤵
  PID:4244
- C:\Windows\System\gRqeBmY.exe
  C:\Windows\System\gRqeBmY.exe
  2⤵
  PID:1652
- C:\Windows\System\clkglSF.exe
  C:\Windows\System\clkglSF.exe
  2⤵
  PID:4184
- C:\Windows\System\kInhlvf.exe
  C:\Windows\System\kInhlvf.exe
  2⤵
  PID:5028
- C:\Windows\System\hEjrhEI.exe
  C:\Windows\System\hEjrhEI.exe
  2⤵
  PID:3876
- C:\Windows\System\SIuvyvx.exe
  C:\Windows\System\SIuvyvx.exe
  2⤵
  PID:3980
- C:\Windows\System\eINZMkY.exe
  C:\Windows\System\eINZMkY.exe
  2⤵
  PID:4528
- C:\Windows\System\sjgznKS.exe
  C:\Windows\System\sjgznKS.exe
  2⤵
  PID:3680
- C:\Windows\System\tLjouey.exe
  C:\Windows\System\tLjouey.exe
  2⤵
  PID:3900
- C:\Windows\System\eHfFjTK.exe
  C:\Windows\System\eHfFjTK.exe
  2⤵
  PID:4340
- C:\Windows\System\mtPFjkG.exe
  C:\Windows\System\mtPFjkG.exe
  2⤵
  PID:4648
- C:\Windows\System\JRlhmfV.exe
  C:\Windows\System\JRlhmfV.exe
  2⤵
  PID:4460
- C:\Windows\System\hgySDpx.exe
  C:\Windows\System\hgySDpx.exe
  2⤵
  PID:2716
- C:\Windows\System\emddRxa.exe
  C:\Windows\System\emddRxa.exe
  2⤵
  PID:3884
- C:\Windows\System\BpPmMmr.exe
  C:\Windows\System\BpPmMmr.exe
  2⤵
  PID:2036
- C:\Windows\System\TLEYcCB.exe
  C:\Windows\System\TLEYcCB.exe
  2⤵
  PID:4476
- C:\Windows\System\GhKLslq.exe
  C:\Windows\System\GhKLslq.exe
  2⤵
  PID:2620
- C:\Windows\System\NXHCllt.exe
  C:\Windows\System\NXHCllt.exe
  2⤵
  PID:4884
- C:\Windows\System\ZcNZXPw.exe
  C:\Windows\System\ZcNZXPw.exe
  2⤵
  PID:3824
- C:\Windows\System\dYkyZGl.exe
  C:\Windows\System\dYkyZGl.exe
  2⤵
  PID:4964
- C:\Windows\System\iYtwAji.exe
  C:\Windows\System\iYtwAji.exe
  2⤵
  PID:5096
- C:\Windows\System\lGHASLN.exe
  C:\Windows\System\lGHASLN.exe
  2⤵
  PID:4220
- C:\Windows\System\dKkqeXz.exe
  C:\Windows\System\dKkqeXz.exe
  2⤵
  PID:2896
- C:\Windows\System\SgnXiUU.exe
  C:\Windows\System\SgnXiUU.exe
  2⤵
  PID:4296
- C:\Windows\System\rDhGufA.exe
  C:\Windows\System\rDhGufA.exe
  2⤵
  PID:2932
- C:\Windows\System\hnQPchc.exe
  C:\Windows\System\hnQPchc.exe
  2⤵
  PID:4216
- C:\Windows\System\JOmyyco.exe
  C:\Windows\System\JOmyyco.exe
  2⤵
  PID:5080
- C:\Windows\System\uMDagQp.exe
  C:\Windows\System\uMDagQp.exe
  2⤵
  PID:4992
- C:\Windows\System\JlTmRlW.exe
  C:\Windows\System\JlTmRlW.exe
  2⤵
  PID:4232
- C:\Windows\System\pRGaEbR.exe
  C:\Windows\System\pRGaEbR.exe
  2⤵
  PID:920
- C:\Windows\System\tFJJzis.exe
  C:\Windows\System\tFJJzis.exe
  2⤵
  PID:348
- C:\Windows\System\BQdDTlP.exe
  C:\Windows\System\BQdDTlP.exe
  2⤵
  PID:4696
- C:\Windows\System\hFAUcSX.exe
  C:\Windows\System\hFAUcSX.exe
  2⤵
  PID:4836
- C:\Windows\System\eRMLKKP.exe
  C:\Windows\System\eRMLKKP.exe
  2⤵
  PID:4280
- C:\Windows\System\KBoLQvW.exe
  C:\Windows\System\KBoLQvW.exe
  2⤵
  PID:5124
- C:\Windows\System\dACxDjc.exe
  C:\Windows\System\dACxDjc.exe
  2⤵
  PID:5140
- C:\Windows\System\JgZAsBB.exe
  C:\Windows\System\JgZAsBB.exe
  2⤵
  PID:5156
- C:\Windows\System\lPCjHdQ.exe
  C:\Windows\System\lPCjHdQ.exe
  2⤵
  PID:5172
- C:\Windows\System\GDngdAR.exe
  C:\Windows\System\GDngdAR.exe
  2⤵
  PID:5188
- C:\Windows\System\REFJjzH.exe
  C:\Windows\System\REFJjzH.exe
  2⤵
  PID:5204
- C:\Windows\System\ScEWxnA.exe
  C:\Windows\System\ScEWxnA.exe
  2⤵
  PID:5220
- C:\Windows\System\MtvJSoX.exe
  C:\Windows\System\MtvJSoX.exe
  2⤵
  PID:5236
- C:\Windows\System\QOndVJX.exe
  C:\Windows\System\QOndVJX.exe
  2⤵
  PID:5252
- C:\Windows\System\aVgdpGM.exe
  C:\Windows\System\aVgdpGM.exe
  2⤵
  PID:5268
- C:\Windows\System\kiGXnfb.exe
  C:\Windows\System\kiGXnfb.exe
  2⤵
  PID:5284
- C:\Windows\System\beSZkbn.exe
  C:\Windows\System\beSZkbn.exe
  2⤵
  PID:5300
- C:\Windows\System\dQigOBn.exe
  C:\Windows\System\dQigOBn.exe
  2⤵
  PID:5316
- C:\Windows\System\JpnbEjw.exe
  C:\Windows\System\JpnbEjw.exe
  2⤵
  PID:5332
- C:\Windows\System\eHkANyW.exe
  C:\Windows\System\eHkANyW.exe
  2⤵
  PID:5348
- C:\Windows\System\FvwQSlS.exe
  C:\Windows\System\FvwQSlS.exe
  2⤵
  PID:5364
- C:\Windows\System\orRMwXM.exe
  C:\Windows\System\orRMwXM.exe
  2⤵
  PID:5380
- C:\Windows\System\uBatlVF.exe
  C:\Windows\System\uBatlVF.exe
  2⤵
  PID:5396
- C:\Windows\System\poyMDYR.exe
  C:\Windows\System\poyMDYR.exe
  2⤵
  PID:5412
- C:\Windows\System\EBZxgkl.exe
  C:\Windows\System\EBZxgkl.exe
  2⤵
  PID:5428
- C:\Windows\System\vdlgygb.exe
  C:\Windows\System\vdlgygb.exe
  2⤵
  PID:5444
- C:\Windows\System\HAwYsVR.exe
  C:\Windows\System\HAwYsVR.exe
  2⤵
  PID:5460
- C:\Windows\System\FMwLihf.exe
  C:\Windows\System\FMwLihf.exe
  2⤵
  PID:5476
- C:\Windows\System\qgrhUew.exe
  C:\Windows\System\qgrhUew.exe
  2⤵
  PID:5492
- C:\Windows\System\XgqvFHA.exe
  C:\Windows\System\XgqvFHA.exe
  2⤵
  PID:5508
- C:\Windows\System\vIVPhaq.exe
  C:\Windows\System\vIVPhaq.exe
  2⤵
  PID:5524
- C:\Windows\System\RykyEfN.exe
  C:\Windows\System\RykyEfN.exe
  2⤵
  PID:5540
- C:\Windows\System\cBDPOsq.exe
  C:\Windows\System\cBDPOsq.exe
  2⤵
  PID:5556
- C:\Windows\System\rYqlMdd.exe
  C:\Windows\System\rYqlMdd.exe
  2⤵
  PID:5572
- C:\Windows\System\ZZaCemn.exe
  C:\Windows\System\ZZaCemn.exe
  2⤵
  PID:5588
- C:\Windows\System\JuwzzNx.exe
  C:\Windows\System\JuwzzNx.exe
  2⤵
  PID:5604
- C:\Windows\System\dPsVbrQ.exe
  C:\Windows\System\dPsVbrQ.exe
  2⤵
  PID:5620
- C:\Windows\System\ozCYWnE.exe
  C:\Windows\System\ozCYWnE.exe
  2⤵
  PID:5636
- C:\Windows\System\KDmKkzR.exe
  C:\Windows\System\KDmKkzR.exe
  2⤵
  PID:5652
- C:\Windows\System\oIDrsyb.exe
  C:\Windows\System\oIDrsyb.exe
  2⤵
  PID:5668
- C:\Windows\System\WuXJITL.exe
  C:\Windows\System\WuXJITL.exe
  2⤵
  PID:5684
- C:\Windows\System\YFOTqsz.exe
  C:\Windows\System\YFOTqsz.exe
  2⤵
  PID:5700
- C:\Windows\System\ZnJYpcR.exe
  C:\Windows\System\ZnJYpcR.exe
  2⤵
  PID:5716
- C:\Windows\System\IcbnfTd.exe
  C:\Windows\System\IcbnfTd.exe
  2⤵
  PID:5732
- C:\Windows\System\OaKAYNl.exe
  C:\Windows\System\OaKAYNl.exe
  2⤵
  PID:5748
- C:\Windows\System\MliXjit.exe
  C:\Windows\System\MliXjit.exe
  2⤵
  PID:5764
- C:\Windows\System\CPfdpfh.exe
  C:\Windows\System\CPfdpfh.exe
  2⤵
  PID:5780
- C:\Windows\System\qrNztOc.exe
  C:\Windows\System\qrNztOc.exe
  2⤵
  PID:5796
- C:\Windows\System\NfqCjRa.exe
  C:\Windows\System\NfqCjRa.exe
  2⤵
  PID:5812
- C:\Windows\System\imPMGfb.exe
  C:\Windows\System\imPMGfb.exe
  2⤵
  PID:5828
- C:\Windows\System\JcFYloH.exe
  C:\Windows\System\JcFYloH.exe
  2⤵
  PID:5844
- C:\Windows\System\PpYsXai.exe
  C:\Windows\System\PpYsXai.exe
  2⤵
  PID:5860
- C:\Windows\System\dcQwwOL.exe
  C:\Windows\System\dcQwwOL.exe
  2⤵
  PID:5876
- C:\Windows\System\HUavYhD.exe
  C:\Windows\System\HUavYhD.exe
  2⤵
  PID:5892
- C:\Windows\System\egPcudm.exe
  C:\Windows\System\egPcudm.exe
  2⤵
  PID:5908
- C:\Windows\System\iEwwNxA.exe
  C:\Windows\System\iEwwNxA.exe
  2⤵
  PID:5924
- C:\Windows\System\fBfKpsY.exe
  C:\Windows\System\fBfKpsY.exe
  2⤵
  PID:5940
- C:\Windows\System\MCWirzx.exe
  C:\Windows\System\MCWirzx.exe
  2⤵
  PID:5956
- C:\Windows\System\dSXqqQk.exe
  C:\Windows\System\dSXqqQk.exe
  2⤵
  PID:5972
- C:\Windows\System\kqTjnIP.exe
  C:\Windows\System\kqTjnIP.exe
  2⤵
  PID:5988
- C:\Windows\System\denwYgL.exe
  C:\Windows\System\denwYgL.exe
  2⤵
  PID:6004
- C:\Windows\System\ZOOpSfy.exe
  C:\Windows\System\ZOOpSfy.exe
  2⤵
  PID:6020
- C:\Windows\System\BqUCZsD.exe
  C:\Windows\System\BqUCZsD.exe
  2⤵
  PID:6036
- C:\Windows\System\ntTvHnQ.exe
  C:\Windows\System\ntTvHnQ.exe
  2⤵
  PID:6052
- C:\Windows\System\DnWHUQj.exe
  C:\Windows\System\DnWHUQj.exe
  2⤵
  PID:6068
- C:\Windows\System\MkhUnBH.exe
  C:\Windows\System\MkhUnBH.exe
  2⤵
  PID:6084
- C:\Windows\System\URfjcUR.exe
  C:\Windows\System\URfjcUR.exe
  2⤵
  PID:6100
- C:\Windows\System\ARBqEXA.exe
  C:\Windows\System\ARBqEXA.exe
  2⤵
  PID:6116
- C:\Windows\System\zfPxwIB.exe
  C:\Windows\System\zfPxwIB.exe
  2⤵
  PID:6132
- C:\Windows\System\kNsXwek.exe
  C:\Windows\System\kNsXwek.exe
  2⤵
  PID:3608
- C:\Windows\System\kouWUKJ.exe
  C:\Windows\System\kouWUKJ.exe
  2⤵
  PID:4732
- C:\Windows\System\KrjJqxM.exe
  C:\Windows\System\KrjJqxM.exe
  2⤵
  PID:5164
- C:\Windows\System\wwCWhtj.exe
  C:\Windows\System\wwCWhtj.exe
  2⤵
  PID:5168
- C:\Windows\System\HWsMzYt.exe
  C:\Windows\System\HWsMzYt.exe
  2⤵
  PID:5260
- C:\Windows\System\XSxqRwu.exe
  C:\Windows\System\XSxqRwu.exe
  2⤵
  PID:4548
- C:\Windows\System\TxysIdJ.exe
  C:\Windows\System\TxysIdJ.exe
  2⤵
  PID:5056
- C:\Windows\System\yKwIuWS.exe
  C:\Windows\System\yKwIuWS.exe
  2⤵
  PID:5008
- C:\Windows\System\edSGOIf.exe
  C:\Windows\System\edSGOIf.exe
  2⤵
  PID:5324
- C:\Windows\System\uSluMix.exe
  C:\Windows\System\uSluMix.exe
  2⤵
  PID:5244
- C:\Windows\System\VFtmeFX.exe
  C:\Windows\System\VFtmeFX.exe
  2⤵
  PID:5152
- C:\Windows\System\KYcxAwq.exe
  C:\Windows\System\KYcxAwq.exe
  2⤵
  PID:4744
- C:\Windows\System\jjsKCoL.exe
  C:\Windows\System\jjsKCoL.exe
  2⤵
  PID:5340
- C:\Windows\System\quhpHab.exe
  C:\Windows\System\quhpHab.exe
  2⤵
  PID:5308
- C:\Windows\System\SKhbFuq.exe
  C:\Windows\System\SKhbFuq.exe
  2⤵
  PID:5404
- C:\Windows\System\NkBPKqW.exe
  C:\Windows\System\NkBPKqW.exe
  2⤵
  PID:5424
- C:\Windows\System\YBEhAxL.exe
  C:\Windows\System\YBEhAxL.exe
  2⤵
  PID:5488
- C:\Windows\System\xvCHYRc.exe
  C:\Windows\System\xvCHYRc.exe
  2⤵
  PID:5552
- C:\Windows\System\XKQwzID.exe
  C:\Windows\System\XKQwzID.exe
  2⤵
  PID:5612
- C:\Windows\System\GOVcHaV.exe
  C:\Windows\System\GOVcHaV.exe
  2⤵
  PID:5680
- C:\Windows\System\kwvNzvh.exe
  C:\Windows\System\kwvNzvh.exe
  2⤵
  PID:5504
- C:\Windows\System\rpbInQU.exe
  C:\Windows\System\rpbInQU.exe
  2⤵
  PID:5596
- C:\Windows\System\LhoHlTZ.exe
  C:\Windows\System\LhoHlTZ.exe
  2⤵
  PID:5740
- C:\Windows\System\gtsvDEm.exe
  C:\Windows\System\gtsvDEm.exe
  2⤵
  PID:5804
- C:\Windows\System\LgCVJIo.exe
  C:\Windows\System\LgCVJIo.exe
  2⤵
  PID:5728
- C:\Windows\System\edpAFKE.exe
  C:\Windows\System\edpAFKE.exe
  2⤵
  PID:5840
- C:\Windows\System\vNpWmOR.exe
  C:\Windows\System\vNpWmOR.exe
  2⤵
  PID:5436
- C:\Windows\System\jwdsoTb.exe
  C:\Windows\System\jwdsoTb.exe
  2⤵
  PID:5660
- C:\Windows\System\QQnruiy.exe
  C:\Windows\System\QQnruiy.exe
  2⤵
  PID:5788
- C:\Windows\System\TWNnUfa.exe
  C:\Windows\System\TWNnUfa.exe
  2⤵
  PID:5852
- C:\Windows\System\TtgVjuO.exe
  C:\Windows\System\TtgVjuO.exe
  2⤵
  PID:5964
- C:\Windows\System\bArVvSb.exe
  C:\Windows\System\bArVvSb.exe
  2⤵
  PID:5888
- C:\Windows\System\IRWUcZq.exe
  C:\Windows\System\IRWUcZq.exe
  2⤵
  PID:5856
- C:\Windows\System\vTAXEDE.exe
  C:\Windows\System\vTAXEDE.exe
  2⤵
  PID:5980
- C:\Windows\System\kAPYtNi.exe
  C:\Windows\System\kAPYtNi.exe
  2⤵
  PID:4352
- C:\Windows\System\gOgmNzf.exe
  C:\Windows\System\gOgmNzf.exe
  2⤵
  PID:1632
- C:\Windows\System\UXPcghD.exe
  C:\Windows\System\UXPcghD.exe
  2⤵
  PID:6048
- C:\Windows\System\lAgnGPE.exe
  C:\Windows\System\lAgnGPE.exe
  2⤵
  PID:4472
- C:\Windows\System\CNeYoDd.exe
  C:\Windows\System\CNeYoDd.exe
  2⤵
  PID:5356
- C:\Windows\System\dlBWjuU.exe
  C:\Windows\System\dlBWjuU.exe
  2⤵
  PID:2672
- C:\Windows\System\fQVPSBe.exe
  C:\Windows\System\fQVPSBe.exe
  2⤵
  PID:5264
- C:\Windows\System\daYsJan.exe
  C:\Windows\System\daYsJan.exe
  2⤵
  PID:6108
- C:\Windows\System\vKSZdIl.exe
  C:\Windows\System\vKSZdIl.exe
  2⤵
  PID:5420
- C:\Windows\System\WKhplgI.exe
  C:\Windows\System\WKhplgI.exe
  2⤵
  PID:5564
- C:\Windows\System\AZyNgwt.exe
  C:\Windows\System\AZyNgwt.exe
  2⤵
  PID:5776
- C:\Windows\System\aRXgVTM.exe
  C:\Windows\System\aRXgVTM.exe
  2⤵
  PID:5212
- C:\Windows\System\CSQVfmH.exe
  C:\Windows\System\CSQVfmH.exe
  2⤵
  PID:5884
- C:\Windows\System\ZYXeeYw.exe
  C:\Windows\System\ZYXeeYw.exe
  2⤵
  PID:5136
- C:\Windows\System\qnzYHqC.exe
  C:\Windows\System\qnzYHqC.exe
  2⤵
  PID:5952
- C:\Windows\System\aOQZrnj.exe
  C:\Windows\System\aOQZrnj.exe
  2⤵
  PID:4628
- C:\Windows\System\ZkdQJtR.exe
  C:\Windows\System\ZkdQJtR.exe
  2⤵
  PID:5456
- C:\Windows\System\kNyWgtY.exe
  C:\Windows\System\kNyWgtY.exe
  2⤵
  PID:5584
- C:\Windows\System\EfrlAyw.exe
  C:\Windows\System\EfrlAyw.exe
  2⤵
  PID:5632
- C:\Windows\System\zwwpXCP.exe
  C:\Windows\System\zwwpXCP.exe
  2⤵
  PID:5760
- C:\Windows\System\fAfPkAM.exe
  C:\Windows\System\fAfPkAM.exe
  2⤵
  PID:5920
- C:\Windows\System\AcqGpph.exe
  C:\Windows\System\AcqGpph.exe
  2⤵
  PID:6016
- C:\Windows\System\YObYYYc.exe
  C:\Windows\System\YObYYYc.exe
  2⤵
  PID:5376
- C:\Windows\System\juoQtxq.exe
  C:\Windows\System\juoQtxq.exe
  2⤵
  PID:5772
- C:\Windows\System\xkhhuDO.exe
  C:\Windows\System\xkhhuDO.exe
  2⤵
  PID:5532
- C:\Windows\System\YzlqImX.exe
  C:\Windows\System\YzlqImX.exe
  2⤵
  PID:6080
- C:\Windows\System\eAsmzob.exe
  C:\Windows\System\eAsmzob.exe
  2⤵
  PID:5276
- C:\Windows\System\nPKnXJt.exe
  C:\Windows\System\nPKnXJt.exe
  2⤵
  PID:2112
- C:\Windows\System\ieUSJUe.exe
  C:\Windows\System\ieUSJUe.exe
  2⤵
  PID:5388
- C:\Windows\System\YYyjFvK.exe
  C:\Windows\System\YYyjFvK.exe
  2⤵
  PID:5936
- C:\Windows\System\zYiEGTh.exe
  C:\Windows\System\zYiEGTh.exe
  2⤵
  PID:3856
- C:\Windows\System\yFCZKQa.exe
  C:\Windows\System\yFCZKQa.exe
  2⤵
  PID:6156
- C:\Windows\System\cwaSicO.exe
  C:\Windows\System\cwaSicO.exe
  2⤵
  PID:6172
- C:\Windows\System\JXCUCpb.exe
  C:\Windows\System\JXCUCpb.exe
  2⤵
  PID:6188
- C:\Windows\System\aoMmtFh.exe
  C:\Windows\System\aoMmtFh.exe
  2⤵
  PID:6204
- C:\Windows\System\KgSdpWr.exe
  C:\Windows\System\KgSdpWr.exe
  2⤵
  PID:6220
- C:\Windows\System\FUDtbzI.exe
  C:\Windows\System\FUDtbzI.exe
  2⤵
  PID:6236
- C:\Windows\System\cfSzddB.exe
  C:\Windows\System\cfSzddB.exe
  2⤵
  PID:6252
- C:\Windows\System\RQnghNG.exe
  C:\Windows\System\RQnghNG.exe
  2⤵
  PID:6268
- C:\Windows\System\QcKiItH.exe
  C:\Windows\System\QcKiItH.exe
  2⤵
  PID:6284
- C:\Windows\System\CHSuLsq.exe
  C:\Windows\System\CHSuLsq.exe
  2⤵
  PID:6300
- C:\Windows\System\MIxokdi.exe
  C:\Windows\System\MIxokdi.exe
  2⤵
  PID:6316
- C:\Windows\System\WytOuzH.exe
  C:\Windows\System\WytOuzH.exe
  2⤵
  PID:6332
- C:\Windows\System\MKjrPeq.exe
  C:\Windows\System\MKjrPeq.exe
  2⤵
  PID:6352
- C:\Windows\System\cKOdYxz.exe
  C:\Windows\System\cKOdYxz.exe
  2⤵
  PID:6368
- C:\Windows\System\WcQIkFR.exe
  C:\Windows\System\WcQIkFR.exe
  2⤵
  PID:6384
- C:\Windows\System\wPsLWxd.exe
  C:\Windows\System\wPsLWxd.exe
  2⤵
  PID:6400
- C:\Windows\System\GFZvgNM.exe
  C:\Windows\System\GFZvgNM.exe
  2⤵
  PID:6416
- C:\Windows\System\MrDcCjk.exe
  C:\Windows\System\MrDcCjk.exe
  2⤵
  PID:6432
- C:\Windows\System\RxcliWu.exe
  C:\Windows\System\RxcliWu.exe
  2⤵
  PID:6448
- C:\Windows\System\UkohEOt.exe
  C:\Windows\System\UkohEOt.exe
  2⤵
  PID:6464
- C:\Windows\System\AtCXHYv.exe
  C:\Windows\System\AtCXHYv.exe
  2⤵
  PID:6480
- C:\Windows\System\HPWGTpw.exe
  C:\Windows\System\HPWGTpw.exe
  2⤵
  PID:6496
- C:\Windows\System\mtOtXrT.exe
  C:\Windows\System\mtOtXrT.exe
  2⤵
  PID:6512
- C:\Windows\System\eYbDAeH.exe
  C:\Windows\System\eYbDAeH.exe
  2⤵
  PID:6528
- C:\Windows\System\yrAUVfH.exe
  C:\Windows\System\yrAUVfH.exe
  2⤵
  PID:6544
- C:\Windows\System\ShTOXSE.exe
  C:\Windows\System\ShTOXSE.exe
  2⤵
  PID:6560
- C:\Windows\System\FJGPqXO.exe
  C:\Windows\System\FJGPqXO.exe
  2⤵
  PID:6576
- C:\Windows\System\TBTIQHp.exe
  C:\Windows\System\TBTIQHp.exe
  2⤵
  PID:6592
- C:\Windows\System\mjUmMMw.exe
  C:\Windows\System\mjUmMMw.exe
  2⤵
  PID:6608
- C:\Windows\System\UZzHoPh.exe
  C:\Windows\System\UZzHoPh.exe
  2⤵
  PID:6624
- C:\Windows\System\UtUiMrS.exe
  C:\Windows\System\UtUiMrS.exe
  2⤵
  PID:6640
- C:\Windows\System\YuKWJZb.exe
  C:\Windows\System\YuKWJZb.exe
  2⤵
  PID:6656
- C:\Windows\System\VaRlPjM.exe
  C:\Windows\System\VaRlPjM.exe
  2⤵
  PID:6672
- C:\Windows\System\XQZilSw.exe
  C:\Windows\System\XQZilSw.exe
  2⤵
  PID:6688
- C:\Windows\System\MfDxznr.exe
  C:\Windows\System\MfDxznr.exe
  2⤵
  PID:6704
- C:\Windows\System\OQTXagk.exe
  C:\Windows\System\OQTXagk.exe
  2⤵
  PID:6720
- C:\Windows\System\dYzehct.exe
  C:\Windows\System\dYzehct.exe
  2⤵
  PID:6736
- C:\Windows\System\edIQVrS.exe
  C:\Windows\System\edIQVrS.exe
  2⤵
  PID:6752
- C:\Windows\System\ZveKQPP.exe
  C:\Windows\System\ZveKQPP.exe
  2⤵
  PID:6768
- C:\Windows\System\peCniPH.exe
  C:\Windows\System\peCniPH.exe
  2⤵
  PID:6784
- C:\Windows\System\TcQFEFN.exe
  C:\Windows\System\TcQFEFN.exe
  2⤵
  PID:6800
- C:\Windows\System\hsXjbgO.exe
  C:\Windows\System\hsXjbgO.exe
  2⤵
  PID:6816
- C:\Windows\System\VWkycPi.exe
  C:\Windows\System\VWkycPi.exe
  2⤵
  PID:6832
- C:\Windows\System\ZmEBmBc.exe
  C:\Windows\System\ZmEBmBc.exe
  2⤵
  PID:6852
- C:\Windows\System\YVeoOcc.exe
  C:\Windows\System\YVeoOcc.exe
  2⤵
  PID:6868
- C:\Windows\System\kJwIGpF.exe
  C:\Windows\System\kJwIGpF.exe
  2⤵
  PID:6884
- C:\Windows\System\aYmxRTM.exe
  C:\Windows\System\aYmxRTM.exe
  2⤵
  PID:6900
- C:\Windows\System\QTiXloc.exe
  C:\Windows\System\QTiXloc.exe
  2⤵
  PID:6916
- C:\Windows\System\gxFQVJt.exe
  C:\Windows\System\gxFQVJt.exe
  2⤵
  PID:6932
- C:\Windows\System\dwTFPey.exe
  C:\Windows\System\dwTFPey.exe
  2⤵
  PID:6948
- C:\Windows\System\CPBVHOi.exe
  C:\Windows\System\CPBVHOi.exe
  2⤵
  PID:6964
- C:\Windows\System\XKgamxY.exe
  C:\Windows\System\XKgamxY.exe
  2⤵
  PID:6980
- C:\Windows\System\ielhaRq.exe
  C:\Windows\System\ielhaRq.exe
  2⤵
  PID:6996
- C:\Windows\System\Vuzdsgl.exe
  C:\Windows\System\Vuzdsgl.exe
  2⤵
  PID:7012
- C:\Windows\System\IzPhRDt.exe
  C:\Windows\System\IzPhRDt.exe
  2⤵
  PID:7028
- C:\Windows\System\IWRYAbE.exe
  C:\Windows\System\IWRYAbE.exe
  2⤵
  PID:7044
- C:\Windows\System\PACVWAa.exe
  C:\Windows\System\PACVWAa.exe
  2⤵
  PID:7060
- C:\Windows\System\IrvbwQa.exe
  C:\Windows\System\IrvbwQa.exe
  2⤵
  PID:7076
- C:\Windows\System\iBfZwCM.exe
  C:\Windows\System\iBfZwCM.exe
  2⤵
  PID:7092
- C:\Windows\System\TiuCXvE.exe
  C:\Windows\System\TiuCXvE.exe
  2⤵
  PID:7108
- C:\Windows\System\BIvcMQR.exe
  C:\Windows\System\BIvcMQR.exe
  2⤵
  PID:7124
- C:\Windows\System\CGHEBMN.exe
  C:\Windows\System\CGHEBMN.exe
  2⤵
  PID:7140
- C:\Windows\System\iFPyEsi.exe
  C:\Windows\System\iFPyEsi.exe
  2⤵
  PID:7156
- C:\Windows\System\NHdiSGG.exe
  C:\Windows\System\NHdiSGG.exe
  2⤵
  PID:5900
- C:\Windows\System\xsovbpd.exe
  C:\Windows\System\xsovbpd.exe
  2⤵
  PID:6164
- C:\Windows\System\uOeYEzX.exe
  C:\Windows\System\uOeYEzX.exe
  2⤵
  PID:6200
- C:\Windows\System\kbNsQNv.exe
  C:\Windows\System\kbNsQNv.exe
  2⤵
  PID:6264
- C:\Windows\System\Xrbbzou.exe
  C:\Windows\System\Xrbbzou.exe
  2⤵
  PID:6328
- C:\Windows\System\cWEgjNU.exe
  C:\Windows\System\cWEgjNU.exe
  2⤵
  PID:6396
- C:\Windows\System\aseUGdD.exe
  C:\Windows\System\aseUGdD.exe
  2⤵
  PID:6460
- C:\Windows\System\lnxHdRe.exe
  C:\Windows\System\lnxHdRe.exe
  2⤵
  PID:6524
- C:\Windows\System\oqobzDI.exe
  C:\Windows\System\oqobzDI.exe
  2⤵
  PID:6588
- C:\Windows\System\xgRFXsG.exe
  C:\Windows\System\xgRFXsG.exe
  2⤵
  PID:6652
- C:\Windows\System\sxsqqQV.exe
  C:\Windows\System\sxsqqQV.exe
  2⤵
  PID:6712
- C:\Windows\System\JhpxIOL.exe
  C:\Windows\System\JhpxIOL.exe
  2⤵
  PID:6776
- C:\Windows\System\QccFGuw.exe
  C:\Windows\System\QccFGuw.exe
  2⤵
  PID:6276
- C:\Windows\System\SWfCeEb.exe
  C:\Windows\System\SWfCeEb.exe
  2⤵
  PID:5948
- C:\Windows\System\Nollgda.exe
  C:\Windows\System\Nollgda.exe
  2⤵
  PID:6308
- C:\Windows\System\egNVQae.exe
  C:\Windows\System\egNVQae.exe
  2⤵
  PID:6012
- C:\Windows\System\RAlSPaa.exe
  C:\Windows\System\RAlSPaa.exe
  2⤵
  PID:5012
- C:\Windows\System\VuElHBN.exe
  C:\Windows\System\VuElHBN.exe
  2⤵
  PID:6184
- C:\Windows\System\WpkeHTw.exe
  C:\Windows\System\WpkeHTw.exe
  2⤵
  PID:6280
- C:\Windows\System\HehylHQ.exe
  C:\Windows\System\HehylHQ.exe
  2⤵
  PID:6348
- C:\Windows\System\ldUTFdG.exe
  C:\Windows\System\ldUTFdG.exe
  2⤵
  PID:6412
- C:\Windows\System\lhCMhCM.exe
  C:\Windows\System\lhCMhCM.exe
  2⤵
  PID:6508
- C:\Windows\System\lOwYOXX.exe
  C:\Windows\System\lOwYOXX.exe
  2⤵
  PID:6572
- C:\Windows\System\wxSsaAA.exe
  C:\Windows\System\wxSsaAA.exe
  2⤵
  PID:6668
- C:\Windows\System\eLKpJpB.exe
  C:\Windows\System\eLKpJpB.exe
  2⤵
  PID:6760
- C:\Windows\System\aoKyKOA.exe
  C:\Windows\System\aoKyKOA.exe
  2⤵
  PID:6828
- C:\Windows\System\UMiSqIe.exe
  C:\Windows\System\UMiSqIe.exe
  2⤵
  PID:6728
- C:\Windows\System\MEydltB.exe
  C:\Windows\System\MEydltB.exe
  2⤵
  PID:6824
- C:\Windows\System\AcDLOzg.exe
  C:\Windows\System\AcDLOzg.exe
  2⤵
  PID:6912
- C:\Windows\System\tMlVucV.exe
  C:\Windows\System\tMlVucV.exe
  2⤵
  PID:6976
- C:\Windows\System\HbSHpbo.exe
  C:\Windows\System\HbSHpbo.exe
  2⤵
  PID:7040
- C:\Windows\System\iSJrkpD.exe
  C:\Windows\System\iSJrkpD.exe
  2⤵
  PID:7104
- C:\Windows\System\NzwwYiH.exe
  C:\Windows\System\NzwwYiH.exe
  2⤵
  PID:7024
- C:\Windows\System\idljCiV.exe
  C:\Windows\System\idljCiV.exe
  2⤵
  PID:6956
- C:\Windows\System\rzbIeAs.exe
  C:\Windows\System\rzbIeAs.exe
  2⤵
  PID:6928
- C:\Windows\System\SiWDZag.exe
  C:\Windows\System\SiWDZag.exe
  2⤵
  PID:7084
- C:\Windows\System\aiFlgEe.exe
  C:\Windows\System\aiFlgEe.exe
  2⤵
  PID:7136
- C:\Windows\System\aPERamS.exe
  C:\Windows\System\aPERamS.exe
  2⤵
  PID:7148
- C:\Windows\System\HeJuSWU.exe
  C:\Windows\System\HeJuSWU.exe
  2⤵
  PID:6296
- C:\Windows\System\NhYqzfY.exe
  C:\Windows\System\NhYqzfY.exe
  2⤵
  PID:6556
- C:\Windows\System\goovsBP.exe
  C:\Windows\System\goovsBP.exe
  2⤵
  PID:5536
- C:\Windows\System\SCvBIoJ.exe
  C:\Windows\System\SCvBIoJ.exe
  2⤵
  PID:6260
- C:\Windows\System\uSGNEVi.exe
  C:\Windows\System\uSGNEVi.exe
  2⤵
  PID:6620
- C:\Windows\System\qYpfGWi.exe
  C:\Windows\System\qYpfGWi.exe
  2⤵
  PID:6812
- C:\Windows\System\wwGnohY.exe
  C:\Windows\System\wwGnohY.exe
  2⤵
  PID:5180
- C:\Windows\System\qtyeSbj.exe
  C:\Windows\System\qtyeSbj.exe
  2⤵
  PID:6244
- C:\Windows\System\LavZGMo.exe
  C:\Windows\System\LavZGMo.exe
  2⤵
  PID:6408
- C:\Windows\System\fQfUWhb.exe
  C:\Windows\System\fQfUWhb.exe
  2⤵
  PID:6632
- C:\Windows\System\HuWOMUt.exe
  C:\Windows\System\HuWOMUt.exe
  2⤵
  PID:5692
- C:\Windows\System\wDdyamN.exe
  C:\Windows\System\wDdyamN.exe
  2⤵
  PID:6848
- C:\Windows\System\BXiDuth.exe
  C:\Windows\System\BXiDuth.exe
  2⤵
  PID:6312
- C:\Windows\System\bSCDKGw.exe
  C:\Windows\System\bSCDKGw.exe
  2⤵
  PID:6664
- C:\Windows\System\kuTeTvN.exe
  C:\Windows\System\kuTeTvN.exe
  2⤵
  PID:6972
- C:\Windows\System\EIwiItb.exe
  C:\Windows\System\EIwiItb.exe
  2⤵
  PID:6892
- C:\Windows\System\gXmbxfD.exe
  C:\Windows\System\gXmbxfD.exe
  2⤵
  PID:6924
- C:\Windows\System\EAdgbTt.exe
  C:\Windows\System\EAdgbTt.exe
  2⤵
  PID:7120
- C:\Windows\System\wlkpujs.exe
  C:\Windows\System\wlkpujs.exe
  2⤵
  PID:6196
- C:\Windows\System\xrcpWAa.exe
  C:\Windows\System\xrcpWAa.exe
  2⤵
  PID:6392
- C:\Windows\System\CGLSQXq.exe
  C:\Windows\System\CGLSQXq.exe
  2⤵
  PID:6492
- C:\Windows\System\LhpmIzK.exe
  C:\Windows\System\LhpmIzK.exe
  2⤵
  PID:6540
- C:\Windows\System\JmXJDpW.exe
  C:\Windows\System\JmXJDpW.exe
  2⤵
  PID:6180
- C:\Windows\System\ghMdzsw.exe
  C:\Windows\System\ghMdzsw.exe
  2⤵
  PID:6216
- C:\Windows\System\rncSWEC.exe
  C:\Windows\System\rncSWEC.exe
  2⤵
  PID:6504
- C:\Windows\System\bBlFhLV.exe
  C:\Windows\System\bBlFhLV.exe
  2⤵
  PID:6792
- C:\Windows\System\QWNwwie.exe
  C:\Windows\System\QWNwwie.exe
  2⤵
  PID:7056
- C:\Windows\System\HJSIIOx.exe
  C:\Windows\System\HJSIIOx.exe
  2⤵
  PID:6992
- C:\Windows\System\zjIfVhL.exe
  C:\Windows\System\zjIfVhL.exe
  2⤵
  PID:5628
- C:\Windows\System\ORPAyEJ.exe
  C:\Windows\System\ORPAyEJ.exe
  2⤵
  PID:6456
- C:\Windows\System\islOBsZ.exe
  C:\Windows\System\islOBsZ.exe
  2⤵
  PID:6732
- C:\Windows\System\fADcLeE.exe
  C:\Windows\System\fADcLeE.exe
  2⤵
  PID:5712
- C:\Windows\System\FyJCdys.exe
  C:\Windows\System\FyJCdys.exe
  2⤵
  PID:7036
- C:\Windows\System\jLSrbgT.exe
  C:\Windows\System\jLSrbgT.exe
  2⤵
  PID:5676
- C:\Windows\System\jonaHLi.exe
  C:\Windows\System\jonaHLi.exe
  2⤵
  PID:5228
- C:\Windows\System\QSUanOu.exe
  C:\Windows\System\QSUanOu.exe
  2⤵
  PID:7176
- C:\Windows\System\NfjXsTa.exe
  C:\Windows\System\NfjXsTa.exe
  2⤵
  PID:7192
- C:\Windows\System\jMkxxby.exe
  C:\Windows\System\jMkxxby.exe
  2⤵
  PID:7208
- C:\Windows\System\UHbCCET.exe
  C:\Windows\System\UHbCCET.exe
  2⤵
  PID:7224
- C:\Windows\System\sanGekY.exe
  C:\Windows\System\sanGekY.exe
  2⤵
  PID:7240
- C:\Windows\System\rjbIEkZ.exe
  C:\Windows\System\rjbIEkZ.exe
  2⤵
  PID:7256
- C:\Windows\System\PXWDngn.exe
  C:\Windows\System\PXWDngn.exe
  2⤵
  PID:7272
- C:\Windows\System\tsElBcX.exe
  C:\Windows\System\tsElBcX.exe
  2⤵
  PID:7288
- C:\Windows\System\qEVLuwz.exe
  C:\Windows\System\qEVLuwz.exe
  2⤵
  PID:7304
- C:\Windows\System\oiZYiRj.exe
  C:\Windows\System\oiZYiRj.exe
  2⤵
  PID:7320
- C:\Windows\System\bweEcXD.exe
  C:\Windows\System\bweEcXD.exe
  2⤵
  PID:7336
- C:\Windows\System\pALEbTw.exe
  C:\Windows\System\pALEbTw.exe
  2⤵
  PID:7352
- C:\Windows\System\hIopqeh.exe
  C:\Windows\System\hIopqeh.exe
  2⤵
  PID:7368
- C:\Windows\System\pcItSAk.exe
  C:\Windows\System\pcItSAk.exe
  2⤵
  PID:7384
- C:\Windows\System\BNWMDPD.exe
  C:\Windows\System\BNWMDPD.exe
  2⤵
  PID:7400
- C:\Windows\System\GqewEWi.exe
  C:\Windows\System\GqewEWi.exe
  2⤵
  PID:7416
- C:\Windows\System\zOIPXad.exe
  C:\Windows\System\zOIPXad.exe
  2⤵
  PID:7432
- C:\Windows\System\PfvzTUv.exe
  C:\Windows\System\PfvzTUv.exe
  2⤵
  PID:7448
- C:\Windows\System\CcdxnQi.exe
  C:\Windows\System\CcdxnQi.exe
  2⤵
  PID:7464
- C:\Windows\System\MlWuAjZ.exe
  C:\Windows\System\MlWuAjZ.exe
  2⤵
  PID:7480
- C:\Windows\System\kZbduJC.exe
  C:\Windows\System\kZbduJC.exe
  2⤵
  PID:7496
- C:\Windows\System\sDXRCHN.exe
  C:\Windows\System\sDXRCHN.exe
  2⤵
  PID:7512
- C:\Windows\System\rawByQs.exe
  C:\Windows\System\rawByQs.exe
  2⤵
  PID:7528
- C:\Windows\System\KYWCNqa.exe
  C:\Windows\System\KYWCNqa.exe
  2⤵
  PID:7544
- C:\Windows\System\wLYPiZs.exe
  C:\Windows\System\wLYPiZs.exe
  2⤵
  PID:7560
- C:\Windows\System\fabbJcs.exe
  C:\Windows\System\fabbJcs.exe
  2⤵
  PID:7576
- C:\Windows\System\bXHHcNT.exe
  C:\Windows\System\bXHHcNT.exe
  2⤵
  PID:7592
- C:\Windows\System\wxDyfXh.exe
  C:\Windows\System\wxDyfXh.exe
  2⤵
  PID:7608
- C:\Windows\System\vTiBBuh.exe
  C:\Windows\System\vTiBBuh.exe
  2⤵
  PID:7624
- C:\Windows\System\jFibPZD.exe
  C:\Windows\System\jFibPZD.exe
  2⤵
  PID:7640
- C:\Windows\System\xfvCZcQ.exe
  C:\Windows\System\xfvCZcQ.exe
  2⤵
  PID:7656
- C:\Windows\System\TirRFmh.exe
  C:\Windows\System\TirRFmh.exe
  2⤵
  PID:7672
- C:\Windows\System\ILpbQCe.exe
  C:\Windows\System\ILpbQCe.exe
  2⤵
  PID:7688
- C:\Windows\System\UYdlOQR.exe
  C:\Windows\System\UYdlOQR.exe
  2⤵
  PID:7704
- C:\Windows\System\uESyIAH.exe
  C:\Windows\System\uESyIAH.exe
  2⤵
  PID:7720
- C:\Windows\System\QgeUipF.exe
  C:\Windows\System\QgeUipF.exe
  2⤵
  PID:7736
- C:\Windows\System\QQvEzfN.exe
  C:\Windows\System\QQvEzfN.exe
  2⤵
  PID:7752
- C:\Windows\System\goNZGLs.exe
  C:\Windows\System\goNZGLs.exe
  2⤵
  PID:7768
- C:\Windows\System\TfBcKAq.exe
  C:\Windows\System\TfBcKAq.exe
  2⤵
  PID:7784
- C:\Windows\System\dkHZWaF.exe
  C:\Windows\System\dkHZWaF.exe
  2⤵
  PID:7800
- C:\Windows\System\OuUvUjG.exe
  C:\Windows\System\OuUvUjG.exe
  2⤵
  PID:7816
- C:\Windows\System\YimxwaU.exe
  C:\Windows\System\YimxwaU.exe
  2⤵
  PID:7832
- C:\Windows\System\yfeXtWI.exe
  C:\Windows\System\yfeXtWI.exe
  2⤵
  PID:7848
- C:\Windows\System\mUeghFw.exe
  C:\Windows\System\mUeghFw.exe
  2⤵
  PID:7864
- C:\Windows\System\HREHQwf.exe
  C:\Windows\System\HREHQwf.exe
  2⤵
  PID:7880
- C:\Windows\System\xtBqjmT.exe
  C:\Windows\System\xtBqjmT.exe
  2⤵
  PID:7896
- C:\Windows\System\cqRkDYR.exe
  C:\Windows\System\cqRkDYR.exe
  2⤵
  PID:7916
- C:\Windows\System\UzEnetC.exe
  C:\Windows\System\UzEnetC.exe
  2⤵
  PID:7932
- C:\Windows\System\GchXLzJ.exe
  C:\Windows\System\GchXLzJ.exe
  2⤵
  PID:7948
- C:\Windows\System\BhAamnV.exe
  C:\Windows\System\BhAamnV.exe
  2⤵
  PID:7964
- C:\Windows\System\ORZmZTd.exe
  C:\Windows\System\ORZmZTd.exe
  2⤵
  PID:7980
- C:\Windows\System\dkUaDWx.exe
  C:\Windows\System\dkUaDWx.exe
  2⤵
  PID:7996
- C:\Windows\System\jRWscGm.exe
  C:\Windows\System\jRWscGm.exe
  2⤵
  PID:8012
- C:\Windows\System\LpBpPoH.exe
  C:\Windows\System\LpBpPoH.exe
  2⤵
  PID:8028
- C:\Windows\System\pFQZUUE.exe
  C:\Windows\System\pFQZUUE.exe
  2⤵
  PID:8044
- C:\Windows\System\GtDWEsE.exe
  C:\Windows\System\GtDWEsE.exe
  2⤵
  PID:8060
- C:\Windows\System\OrCvKfi.exe
  C:\Windows\System\OrCvKfi.exe
  2⤵
  PID:8076
- C:\Windows\System\tEyOPgD.exe
  C:\Windows\System\tEyOPgD.exe
  2⤵
  PID:8092
- C:\Windows\System\dcBxtng.exe
  C:\Windows\System\dcBxtng.exe
  2⤵
  PID:8108
- C:\Windows\System\AijUUmF.exe
  C:\Windows\System\AijUUmF.exe
  2⤵
  PID:8124
- C:\Windows\System\CpoIdFs.exe
  C:\Windows\System\CpoIdFs.exe
  2⤵
  PID:8140
- C:\Windows\System\qZbKgTC.exe
  C:\Windows\System\qZbKgTC.exe
  2⤵
  PID:8156
- C:\Windows\System\pqDoYEz.exe
  C:\Windows\System\pqDoYEz.exe
  2⤵
  PID:8172
- C:\Windows\System\KCGVYkS.exe
  C:\Windows\System\KCGVYkS.exe
  2⤵
  PID:8188
- C:\Windows\System\wNSeHkv.exe
  C:\Windows\System\wNSeHkv.exe
  2⤵
  PID:7184
- C:\Windows\System\LkQRzLf.exe
  C:\Windows\System\LkQRzLf.exe
  2⤵
  PID:7200
- C:\Windows\System\LIrPhjV.exe
  C:\Windows\System\LIrPhjV.exe
  2⤵
  PID:7248
- C:\Windows\System\CgWCmpW.exe
  C:\Windows\System\CgWCmpW.exe
  2⤵
  PID:7316
- C:\Windows\System\KdVCBpE.exe
  C:\Windows\System\KdVCBpE.exe
  2⤵
  PID:7376
- C:\Windows\System\vYluEaS.exe
  C:\Windows\System\vYluEaS.exe
  2⤵
  PID:7264
- C:\Windows\System\QCoBDEz.exe
  C:\Windows\System\QCoBDEz.exe
  2⤵
  PID:7268
- C:\Windows\System\qFnFSVT.exe
  C:\Windows\System\qFnFSVT.exe
  2⤵
  PID:7300
- C:\Windows\System\ZItTCPm.exe
  C:\Windows\System\ZItTCPm.exe
  2⤵
  PID:7504
- C:\Windows\System\iGoWbUh.exe
  C:\Windows\System\iGoWbUh.exe
  2⤵
  PID:7568
- C:\Windows\System\RcuWATv.exe
  C:\Windows\System\RcuWATv.exe
  2⤵
  PID:7392
- C:\Windows\System\HdNwMNH.exe
  C:\Windows\System\HdNwMNH.exe
  2⤵
  PID:7604
- C:\Windows\System\GfOWFHJ.exe
  C:\Windows\System\GfOWFHJ.exe
  2⤵
  PID:7636
- C:\Windows\System\gXcctpK.exe
  C:\Windows\System\gXcctpK.exe
  2⤵
  PID:7524
- C:\Windows\System\YgkIijS.exe
  C:\Windows\System\YgkIijS.exe
  2⤵
  PID:7584
- C:\Windows\System\atLUGVe.exe
  C:\Windows\System\atLUGVe.exe
  2⤵
  PID:7664
- C:\Windows\System\GllyYhU.exe
  C:\Windows\System\GllyYhU.exe
  2⤵
  PID:7684
- C:\Windows\System\hpQhOFk.exe
  C:\Windows\System\hpQhOFk.exe
  2⤵
  PID:7712
- C:\Windows\System\munEmlM.exe
  C:\Windows\System\munEmlM.exe
  2⤵
  PID:7792
- C:\Windows\System\ZroiDvn.exe
  C:\Windows\System\ZroiDvn.exe
  2⤵
  PID:7828
- C:\Windows\System\ndGddLC.exe
  C:\Windows\System\ndGddLC.exe
  2⤵
  PID:7744
- C:\Windows\System\PYHCnzj.exe
  C:\Windows\System\PYHCnzj.exe
  2⤵
  PID:7924
- C:\Windows\System\ZifnqZY.exe
  C:\Windows\System\ZifnqZY.exe
  2⤵
  PID:7988
- C:\Windows\System\uQSlhiZ.exe
  C:\Windows\System\uQSlhiZ.exe
  2⤵
  PID:8024
- C:\Windows\System\lCWFZYj.exe
  C:\Windows\System\lCWFZYj.exe
  2⤵
  PID:7812
- C:\Windows\System\DcEXfaH.exe
  C:\Windows\System\DcEXfaH.exe
  2⤵
  PID:8088
- C:\Windows\System\FtEOuEi.exe
  C:\Windows\System\FtEOuEi.exe
  2⤵
  PID:7872
- C:\Windows\System\duoZJOt.exe
  C:\Windows\System\duoZJOt.exe
  2⤵
  PID:8040
- C:\Windows\System\wuRaDLw.exe
  C:\Windows\System\wuRaDLw.exe
  2⤵
  PID:7940
- C:\Windows\System\VJZXoUT.exe
  C:\Windows\System\VJZXoUT.exe
  2⤵
  PID:8004
- C:\Windows\System\dQfIInk.exe
  C:\Windows\System\dQfIInk.exe
  2⤵
  PID:8068
- C:\Windows\System\CIEvkcP.exe
  C:\Windows\System\CIEvkcP.exe
  2⤵
  PID:8136
- C:\Windows\System\UZXNIwY.exe
  C:\Windows\System\UZXNIwY.exe
  2⤵
  PID:6428
- C:\Windows\System\ehCZPBo.exe
  C:\Windows\System\ehCZPBo.exe
  2⤵
  PID:7284
- C:\Windows\System\rFyoHip.exe
  C:\Windows\System\rFyoHip.exe
  2⤵
  PID:7220
- C:\Windows\System\PGWHJMH.exe
  C:\Windows\System\PGWHJMH.exe
  2⤵
  PID:7444
- C:\Windows\System\GflaLZn.exe
  C:\Windows\System\GflaLZn.exe
  2⤵
  PID:7360
- C:\Windows\System\oHPIKKp.exe
  C:\Windows\System\oHPIKKp.exe
  2⤵
  PID:7364
- C:\Windows\System\gyAxXEU.exe
  C:\Windows\System\gyAxXEU.exe
  2⤵
  PID:7428
- C:\Windows\System\AChNGpA.exe
  C:\Windows\System\AChNGpA.exe
  2⤵
  PID:7632
- C:\Windows\System\rmiyRrD.exe
  C:\Windows\System\rmiyRrD.exe
  2⤵
  PID:7556
- C:\Windows\System\wADQdYa.exe
  C:\Windows\System\wADQdYa.exe
  2⤵
  PID:7796
- C:\Windows\System\bGmpwFt.exe
  C:\Windows\System\bGmpwFt.exe
  2⤵
  PID:7760
- C:\Windows\System\fnYlSbf.exe
  C:\Windows\System\fnYlSbf.exe
  2⤵
  PID:7888
- C:\Windows\System\KKGdiMT.exe
  C:\Windows\System\KKGdiMT.exe
  2⤵
  PID:7960
- C:\Windows\System\pBuNcdf.exe
  C:\Windows\System\pBuNcdf.exe
  2⤵
  PID:7956
- C:\Windows\System\ULtcBPL.exe
  C:\Windows\System\ULtcBPL.exe
  2⤵
  PID:8120
- C:\Windows\System\syWtglU.exe
  C:\Windows\System\syWtglU.exe
  2⤵
  PID:8168
- C:\Windows\System\Euigwyc.exe
  C:\Windows\System\Euigwyc.exe
  2⤵
  PID:2152
- C:\Windows\System\YPGyOFD.exe
  C:\Windows\System\YPGyOFD.exe
  2⤵
  PID:8036
- C:\Windows\System\XgJMhXN.exe
  C:\Windows\System\XgJMhXN.exe
  2⤵
  PID:7172
- C:\Windows\System\EPPePwC.exe
  C:\Windows\System\EPPePwC.exe
  2⤵
  PID:7412
- C:\Windows\System\nleGkps.exe
  C:\Windows\System\nleGkps.exe
  2⤵
  PID:7520
- C:\Windows\System\CdtcEHW.exe
  C:\Windows\System\CdtcEHW.exe
  2⤵
  PID:7616
- C:\Windows\System\DtZGlOd.exe
  C:\Windows\System\DtZGlOd.exe
  2⤵
  PID:7824
- C:\Windows\System\xnVSfMW.exe
  C:\Windows\System\xnVSfMW.exe
  2⤵
  PID:8152
- C:\Windows\System\cviNMQI.exe
  C:\Windows\System\cviNMQI.exe
  2⤵
  PID:7424
- C:\Windows\System\bwiaoIy.exe
  C:\Windows\System\bwiaoIy.exe
  2⤵
  PID:7808
- C:\Windows\System\XRxmrxY.exe
  C:\Windows\System\XRxmrxY.exe
  2⤵
  PID:7776
- C:\Windows\System\viAFTZh.exe
  C:\Windows\System\viAFTZh.exe
  2⤵
  PID:7280
- C:\Windows\System\pRpxplm.exe
  C:\Windows\System\pRpxplm.exe
  2⤵
  PID:7976
- C:\Windows\System\VjgVnwd.exe
  C:\Windows\System\VjgVnwd.exe
  2⤵
  PID:8196
- C:\Windows\System\AhquDVi.exe
  C:\Windows\System\AhquDVi.exe
  2⤵
  PID:8212
- C:\Windows\System\dPzhQHi.exe
  C:\Windows\System\dPzhQHi.exe
  2⤵
  PID:8228
- C:\Windows\System\TmPcvWO.exe
  C:\Windows\System\TmPcvWO.exe
  2⤵
  PID:8244
- C:\Windows\System\lNVXtYz.exe
  C:\Windows\System\lNVXtYz.exe
  2⤵
  PID:8260
- C:\Windows\System\OmUIWKy.exe
  C:\Windows\System\OmUIWKy.exe
  2⤵
  PID:8276
- C:\Windows\System\GCnBOCj.exe
  C:\Windows\System\GCnBOCj.exe
  2⤵
  PID:8292
- C:\Windows\System\wIofasr.exe
  C:\Windows\System\wIofasr.exe
  2⤵
  PID:8308
- C:\Windows\System\OiKSkhM.exe
  C:\Windows\System\OiKSkhM.exe
  2⤵
  PID:8324
- C:\Windows\System\hhkIuhn.exe
  C:\Windows\System\hhkIuhn.exe
  2⤵
  PID:8340
- C:\Windows\System\zNwKhGV.exe
  C:\Windows\System\zNwKhGV.exe
  2⤵
  PID:8356
- C:\Windows\System\HlhdyBK.exe
  C:\Windows\System\HlhdyBK.exe
  2⤵
  PID:8372
- C:\Windows\System\EfsJydn.exe
  C:\Windows\System\EfsJydn.exe
  2⤵
  PID:8388
- C:\Windows\System\JBuqTWB.exe
  C:\Windows\System\JBuqTWB.exe
  2⤵
  PID:8404
- C:\Windows\System\nTfSSiT.exe
  C:\Windows\System\nTfSSiT.exe
  2⤵
  PID:8420
- C:\Windows\System\riiUeuM.exe
  C:\Windows\System\riiUeuM.exe
  2⤵
  PID:8436
- C:\Windows\System\dzjxgVW.exe
  C:\Windows\System\dzjxgVW.exe
  2⤵
  PID:8452
- C:\Windows\System\qTPlvlo.exe
  C:\Windows\System\qTPlvlo.exe
  2⤵
  PID:8468
- C:\Windows\System\ePxAVZp.exe
  C:\Windows\System\ePxAVZp.exe
  2⤵
  PID:8484
- C:\Windows\System\zHglVbE.exe
  C:\Windows\System\zHglVbE.exe
  2⤵
  PID:8500
- C:\Windows\System\cHzEvYz.exe
  C:\Windows\System\cHzEvYz.exe
  2⤵
  PID:8516
- C:\Windows\System\IlgGsPK.exe
  C:\Windows\System\IlgGsPK.exe
  2⤵
  PID:8532
- C:\Windows\System\dnZqFqa.exe
  C:\Windows\System\dnZqFqa.exe
  2⤵
  PID:8548
- C:\Windows\System\GpiqxAI.exe
  C:\Windows\System\GpiqxAI.exe
  2⤵
  PID:8564
- C:\Windows\System\EPTGESO.exe
  C:\Windows\System\EPTGESO.exe
  2⤵
  PID:8580
- C:\Windows\System\nekikUr.exe
  C:\Windows\System\nekikUr.exe
  2⤵
  PID:8596
- C:\Windows\System\TMHhCli.exe
  C:\Windows\System\TMHhCli.exe
  2⤵
  PID:8612
- C:\Windows\System\QPnvdiA.exe
  C:\Windows\System\QPnvdiA.exe
  2⤵
  PID:8628
- C:\Windows\System\PSyvLqq.exe
  C:\Windows\System\PSyvLqq.exe
  2⤵
  PID:8644
- C:\Windows\System\mRAUEGT.exe
  C:\Windows\System\mRAUEGT.exe
  2⤵
  PID:8660
- C:\Windows\System\zFlfoMy.exe
  C:\Windows\System\zFlfoMy.exe
  2⤵
  PID:8676
- C:\Windows\System\xQlbCTK.exe
  C:\Windows\System\xQlbCTK.exe
  2⤵
  PID:8692
- C:\Windows\System\GLUlRid.exe
  C:\Windows\System\GLUlRid.exe
  2⤵
  PID:8708
- C:\Windows\System\hBMeWrC.exe
  C:\Windows\System\hBMeWrC.exe
  2⤵
  PID:8724
- C:\Windows\System\ddhBlgx.exe
  C:\Windows\System\ddhBlgx.exe
  2⤵
  PID:8740
- C:\Windows\System\CgTtIBn.exe
  C:\Windows\System\CgTtIBn.exe
  2⤵
  PID:8756
- C:\Windows\System\AmIhBwF.exe
  C:\Windows\System\AmIhBwF.exe
  2⤵
  PID:8772
- C:\Windows\System\bQxkyTE.exe
  C:\Windows\System\bQxkyTE.exe
  2⤵
  PID:8788
- C:\Windows\System\wZNhzby.exe
  C:\Windows\System\wZNhzby.exe
  2⤵
  PID:8804
- C:\Windows\System\Iyddxlf.exe
  C:\Windows\System\Iyddxlf.exe
  2⤵
  PID:8820
- C:\Windows\System\SlbSWwX.exe
  C:\Windows\System\SlbSWwX.exe
  2⤵
  PID:8836
- C:\Windows\System\JAImPTs.exe
  C:\Windows\System\JAImPTs.exe
  2⤵
  PID:8852
- C:\Windows\System\jQEaoiO.exe
  C:\Windows\System\jQEaoiO.exe
  2⤵
  PID:8868
- C:\Windows\System\NMvwPMG.exe
  C:\Windows\System\NMvwPMG.exe
  2⤵
  PID:8884
- C:\Windows\System\BiijjsH.exe
  C:\Windows\System\BiijjsH.exe
  2⤵
  PID:8900
- C:\Windows\System\GepvEtz.exe
  C:\Windows\System\GepvEtz.exe
  2⤵
  PID:8916
- C:\Windows\System\PVNMAEc.exe
  C:\Windows\System\PVNMAEc.exe
  2⤵
  PID:8932
- C:\Windows\System\xCwYyhi.exe
  C:\Windows\System\xCwYyhi.exe
  2⤵
  PID:8948
- C:\Windows\System\bmTqxnN.exe
  C:\Windows\System\bmTqxnN.exe
  2⤵
  PID:8964
- C:\Windows\System\ILahBIA.exe
  C:\Windows\System\ILahBIA.exe
  2⤵
  PID:8980
- C:\Windows\System\kIEXVqJ.exe
  C:\Windows\System\kIEXVqJ.exe
  2⤵
  PID:8996
- C:\Windows\System\YqhMVYo.exe
  C:\Windows\System\YqhMVYo.exe
  2⤵
  PID:9012
- C:\Windows\System\HxmfIVM.exe
  C:\Windows\System\HxmfIVM.exe
  2⤵
  PID:9028
- C:\Windows\System\SssxKCP.exe
  C:\Windows\System\SssxKCP.exe
  2⤵
  PID:9044
- C:\Windows\System\kjapgxz.exe
  C:\Windows\System\kjapgxz.exe
  2⤵
  PID:9060
- C:\Windows\System\yRDuNys.exe
  C:\Windows\System\yRDuNys.exe
  2⤵
  PID:9076
- C:\Windows\System\yPYJVih.exe
  C:\Windows\System\yPYJVih.exe
  2⤵
  PID:9092
- C:\Windows\System\Zkewkhy.exe
  C:\Windows\System\Zkewkhy.exe
  2⤵
  PID:9108
- C:\Windows\System\kYNSnJf.exe
  C:\Windows\System\kYNSnJf.exe
  2⤵
  PID:9124
- C:\Windows\System\EhtitkH.exe
  C:\Windows\System\EhtitkH.exe
  2⤵
  PID:9148
- C:\Windows\System\qwyfDnv.exe
  C:\Windows\System\qwyfDnv.exe
  2⤵
  PID:9164
- C:\Windows\System\SglJqPS.exe
  C:\Windows\System\SglJqPS.exe
  2⤵
  PID:9180
- C:\Windows\System\tbPoNTX.exe
  C:\Windows\System\tbPoNTX.exe
  2⤵
  PID:9196
- C:\Windows\System\MKgbYvA.exe
  C:\Windows\System\MKgbYvA.exe
  2⤵
  PID:9212
- C:\Windows\System\zJlzXsh.exe
  C:\Windows\System\zJlzXsh.exe
  2⤵
  PID:7476
- C:\Windows\System\WLdAvIY.exe
  C:\Windows\System\WLdAvIY.exe
  2⤵
  PID:8020
- C:\Windows\System\kMdKqLU.exe
  C:\Windows\System\kMdKqLU.exe
  2⤵
  PID:8252
- C:\Windows\System\sEDljLW.exe
  C:\Windows\System\sEDljLW.exe
  2⤵
  PID:8316
- C:\Windows\System\riIqlzy.exe
  C:\Windows\System\riIqlzy.exe
  2⤵
  PID:8320
- C:\Windows\System\uCRvbCv.exe
  C:\Windows\System\uCRvbCv.exe
  2⤵
  PID:8384
- C:\Windows\System\YyfebLt.exe
  C:\Windows\System\YyfebLt.exe
  2⤵
  PID:8416
- C:\Windows\System\aSodNdJ.exe
  C:\Windows\System\aSodNdJ.exe
  2⤵
  PID:8448
- C:\Windows\System\jPGIAHv.exe
  C:\Windows\System\jPGIAHv.exe
  2⤵
  PID:8300
- C:\Windows\System\qvALvYp.exe
  C:\Windows\System\qvALvYp.exe
  2⤵
  PID:8364
- C:\Windows\System\UMmPCmb.exe
  C:\Windows\System\UMmPCmb.exe
  2⤵
  PID:8428
- C:\Windows\System\OcgnSTU.exe
  C:\Windows\System\OcgnSTU.exe
  2⤵
  PID:8544
- C:\Windows\System\WqldPoD.exe
  C:\Windows\System\WqldPoD.exe
  2⤵
  PID:8464
- C:\Windows\System\zYswOhw.exe
  C:\Windows\System\zYswOhw.exe
  2⤵
  PID:8576
- C:\Windows\System\xbzbcrg.exe
  C:\Windows\System\xbzbcrg.exe
  2⤵
  PID:8608
- C:\Windows\System\EUrnViX.exe
  C:\Windows\System\EUrnViX.exe
  2⤵
  PID:8672
- C:\Windows\System\HJxqoZO.exe
  C:\Windows\System\HJxqoZO.exe
  2⤵
  PID:8620
- C:\Windows\System\MtzuPoJ.exe
  C:\Windows\System\MtzuPoJ.exe
  2⤵
  PID:8656
- C:\Windows\System\eVcdzHg.exe
  C:\Windows\System\eVcdzHg.exe
  2⤵
  PID:8720
- C:\Windows\System\HKXJOJJ.exe
  C:\Windows\System\HKXJOJJ.exe
  2⤵
  PID:8748
- C:\Windows\System\PIjrGhG.exe
  C:\Windows\System\PIjrGhG.exe
  2⤵
  PID:8800
- C:\Windows\System\QKFCbce.exe
  C:\Windows\System\QKFCbce.exe
  2⤵
  PID:8812
- C:\Windows\System\iYpcgpe.exe
  C:\Windows\System\iYpcgpe.exe
  2⤵
  PID:8892
- C:\Windows\System\CUAYMRC.exe
  C:\Windows\System\CUAYMRC.exe
  2⤵
  PID:8848
- C:\Windows\System\zsaxhdK.exe
  C:\Windows\System\zsaxhdK.exe
  2⤵
  PID:8880
- C:\Windows\System\hdGGRpZ.exe
  C:\Windows\System\hdGGRpZ.exe
  2⤵
  PID:8972
- C:\Windows\System\InBlZNb.exe
  C:\Windows\System\InBlZNb.exe
  2⤵
  PID:8956
- C:\Windows\System\lZAiNgq.exe
  C:\Windows\System\lZAiNgq.exe
  2⤵
  PID:8992
- C:\Windows\System\zMaUoDv.exe
  C:\Windows\System\zMaUoDv.exe
  2⤵
  PID:9068
- C:\Windows\System\UeTMjIB.exe
  C:\Windows\System\UeTMjIB.exe
  2⤵
  PID:9084
- C:\Windows\System\AhsQDeJ.exe
  C:\Windows\System\AhsQDeJ.exe
  2⤵
  PID:9072
- C:\Windows\System\qSytEfP.exe
  C:\Windows\System\qSytEfP.exe
  2⤵
  PID:1584
- C:\Windows\System\MuqaTgY.exe
  C:\Windows\System\MuqaTgY.exe
  2⤵
  PID:9188
- C:\Windows\System\OFGUmVs.exe
  C:\Windows\System\OFGUmVs.exe
  2⤵
  PID:7860
- C:\Windows\System\cZrQwFV.exe
  C:\Windows\System\cZrQwFV.exe
  2⤵
  PID:8288
- C:\Windows\System\mCnXwrr.exe
  C:\Windows\System\mCnXwrr.exe
  2⤵
  PID:8476
- C:\Windows\System\ySHeKoR.exe
  C:\Windows\System\ySHeKoR.exe
  2⤵
  PID:9176
- C:\Windows\System\EwbXUhY.exe
  C:\Windows\System\EwbXUhY.exe
  2⤵
  PID:8512
- C:\Windows\System\YCfqyOD.exe
  C:\Windows\System\YCfqyOD.exe
  2⤵
  PID:8704
- C:\Windows\System\PQNVBeH.exe
  C:\Windows\System\PQNVBeH.exe
  2⤵
  PID:8768
- C:\Windows\System\CkWGmpH.exe
  C:\Windows\System\CkWGmpH.exe
  2⤵
  PID:8284
- C:\Windows\System\OuVIhGI.exe
  C:\Windows\System\OuVIhGI.exe
  2⤵
  PID:8640
- C:\Windows\System\mdVEkYY.exe
  C:\Windows\System\mdVEkYY.exe
  2⤵
  PID:7020
- C:\Windows\System\ywXllPu.exe
  C:\Windows\System\ywXllPu.exe
  2⤵
  PID:8528
- C:\Windows\System\NkZLzdz.exe
  C:\Windows\System\NkZLzdz.exe
  2⤵
  PID:8592
- C:\Windows\System\rwnTrPi.exe
  C:\Windows\System\rwnTrPi.exe
  2⤵
  PID:8864
- C:\Windows\System\ULxPaJq.exe
  C:\Windows\System\ULxPaJq.exe
  2⤵
  PID:8944
- C:\Windows\System\IeXvolQ.exe
  C:\Windows\System\IeXvolQ.exe
  2⤵
  PID:8912
- C:\Windows\System\TRKJPZI.exe
  C:\Windows\System\TRKJPZI.exe
  2⤵
  PID:8960
- C:\Windows\System\ZcJToaJ.exe
  C:\Windows\System\ZcJToaJ.exe
  2⤵
  PID:9120
- C:\Windows\System\kFYnLpt.exe
  C:\Windows\System\kFYnLpt.exe
  2⤵
  PID:9116
- C:\Windows\System\PkfyiGi.exe
  C:\Windows\System\PkfyiGi.exe
  2⤵
  PID:8396
- C:\Windows\System\eyaIRPk.exe
  C:\Windows\System\eyaIRPk.exe
  2⤵
  PID:9172
- C:\Windows\System\jSmYrNR.exe
  C:\Windows\System\jSmYrNR.exe
  2⤵
  PID:7492
- C:\Windows\System\vZjKZNy.exe
  C:\Windows\System\vZjKZNy.exe
  2⤵
  PID:8688
- C:\Windows\System\FUhSVxj.exe
  C:\Windows\System\FUhSVxj.exe
  2⤵
  PID:8540
- C:\Windows\System\UKjVfNS.exe
  C:\Windows\System\UKjVfNS.exe
  2⤵
  PID:8816
- C:\Windows\System\nHouyWF.exe
  C:\Windows\System\nHouyWF.exe
  2⤵
  PID:9140
- C:\Windows\System\bepGyMQ.exe
  C:\Windows\System\bepGyMQ.exe
  2⤵
  PID:8716
- C:\Windows\System\KknxnMo.exe
  C:\Windows\System\KknxnMo.exe
  2⤵
  PID:9132
- C:\Windows\System\sXEIIiw.exe
  C:\Windows\System\sXEIIiw.exe
  2⤵
  PID:8736
- C:\Windows\System\wUPqMtM.exe
  C:\Windows\System\wUPqMtM.exe
  2⤵
  PID:9052
- C:\Windows\System\FDqSIxK.exe
  C:\Windows\System\FDqSIxK.exe
  2⤵
  PID:8352
- C:\Windows\System\HijFpLU.exe
  C:\Windows\System\HijFpLU.exe
  2⤵
  PID:9024
- C:\Windows\System\yuoDqEm.exe
  C:\Windows\System\yuoDqEm.exe
  2⤵
  PID:8208
- C:\Windows\System\wqynSle.exe
  C:\Windows\System\wqynSle.exe
  2⤵
  PID:9232
- C:\Windows\System\fEcsSOW.exe
  C:\Windows\System\fEcsSOW.exe
  2⤵
  PID:9248
- C:\Windows\System\XgONnkO.exe
  C:\Windows\System\XgONnkO.exe
  2⤵
  PID:9264
- C:\Windows\System\NaLCiIM.exe
  C:\Windows\System\NaLCiIM.exe
  2⤵
  PID:9280
- C:\Windows\System\RvhOHQO.exe
  C:\Windows\System\RvhOHQO.exe
  2⤵
  PID:9296
- C:\Windows\System\kkfiYAY.exe
  C:\Windows\System\kkfiYAY.exe
  2⤵
  PID:9312
- C:\Windows\System\BgZzeXG.exe
  C:\Windows\System\BgZzeXG.exe
  2⤵
  PID:9328
- C:\Windows\System\egxCwUb.exe
  C:\Windows\System\egxCwUb.exe
  2⤵
  PID:9344
- C:\Windows\System\vxugati.exe
  C:\Windows\System\vxugati.exe
  2⤵
  PID:9360
- C:\Windows\System\hPVxlrY.exe
  C:\Windows\System\hPVxlrY.exe
  2⤵
  PID:9376
- C:\Windows\System\gAyKlBS.exe
  C:\Windows\System\gAyKlBS.exe
  2⤵
  PID:9392
- C:\Windows\System\diLlDQT.exe
  C:\Windows\System\diLlDQT.exe
  2⤵
  PID:9408
- C:\Windows\System\HJJiqMb.exe
  C:\Windows\System\HJJiqMb.exe
  2⤵
  PID:9424
- C:\Windows\System\KBPXqEe.exe
  C:\Windows\System\KBPXqEe.exe
  2⤵
  PID:9444
- C:\Windows\System\xOdLaUs.exe
  C:\Windows\System\xOdLaUs.exe
  2⤵
  PID:9460
- C:\Windows\System\IpahndD.exe
  C:\Windows\System\IpahndD.exe
  2⤵
  PID:9476
- C:\Windows\System\PrsYAVN.exe
  C:\Windows\System\PrsYAVN.exe
  2⤵
  PID:9492
- C:\Windows\System\rigfujh.exe
  C:\Windows\System\rigfujh.exe
  2⤵
  PID:9508
- C:\Windows\System\ZqZtfLz.exe
  C:\Windows\System\ZqZtfLz.exe
  2⤵
  PID:9524
- C:\Windows\System\aGQeAbk.exe
  C:\Windows\System\aGQeAbk.exe
  2⤵
  PID:9540
- C:\Windows\System\jpAJmhH.exe
  C:\Windows\System\jpAJmhH.exe
  2⤵
  PID:9556
- C:\Windows\System\abkEuzr.exe
  C:\Windows\System\abkEuzr.exe
  2⤵
  PID:9572
- C:\Windows\System\FHGqYJn.exe
  C:\Windows\System\FHGqYJn.exe
  2⤵
  PID:9588
- C:\Windows\System\ZmIquzk.exe
  C:\Windows\System\ZmIquzk.exe
  2⤵
  PID:9604
- C:\Windows\System\LwFWnXO.exe
  C:\Windows\System\LwFWnXO.exe
  2⤵
  PID:9620
- C:\Windows\System\JnUaLuO.exe
  C:\Windows\System\JnUaLuO.exe
  2⤵
  PID:9636
- C:\Windows\System\EpIxFmt.exe
  C:\Windows\System\EpIxFmt.exe
  2⤵
  PID:9656
- C:\Windows\System\oKGykhD.exe
  C:\Windows\System\oKGykhD.exe
  2⤵
  PID:9672
- C:\Windows\System\JBBPhCU.exe
  C:\Windows\System\JBBPhCU.exe
  2⤵
  PID:9688
- C:\Windows\System\HzWfCQY.exe
  C:\Windows\System\HzWfCQY.exe
  2⤵
  PID:9704
- C:\Windows\System\fccofCL.exe
  C:\Windows\System\fccofCL.exe
  2⤵
  PID:9720
- C:\Windows\System\scXKoWr.exe
  C:\Windows\System\scXKoWr.exe
  2⤵
  PID:9736
- C:\Windows\System\WZCfwgB.exe
  C:\Windows\System\WZCfwgB.exe
  2⤵
  PID:9752
- C:\Windows\System\sWvAJkA.exe
  C:\Windows\System\sWvAJkA.exe
  2⤵
  PID:9768
- C:\Windows\System\YFywgjQ.exe
  C:\Windows\System\YFywgjQ.exe
  2⤵
  PID:9784
- C:\Windows\System\kOYIdNZ.exe
  C:\Windows\System\kOYIdNZ.exe
  2⤵
  PID:9800
- C:\Windows\System\AehcPFK.exe
  C:\Windows\System\AehcPFK.exe
  2⤵
  PID:9816
- C:\Windows\System\dkkFFcM.exe
  C:\Windows\System\dkkFFcM.exe
  2⤵
  PID:9832
- C:\Windows\System\xarKLNS.exe
  C:\Windows\System\xarKLNS.exe
  2⤵
  PID:9848
- C:\Windows\System\LgxgDLv.exe
  C:\Windows\System\LgxgDLv.exe
  2⤵
  PID:9864
- C:\Windows\System\MEQCBUH.exe
  C:\Windows\System\MEQCBUH.exe
  2⤵
  PID:9880
- C:\Windows\System\luaCegI.exe
  C:\Windows\System\luaCegI.exe
  2⤵
  PID:9896
- C:\Windows\System\hBzsDzw.exe
  C:\Windows\System\hBzsDzw.exe
  2⤵
  PID:9912
- C:\Windows\System\FBOUOhK.exe
  C:\Windows\System\FBOUOhK.exe
  2⤵
  PID:9928
- C:\Windows\System\Cccxbie.exe
  C:\Windows\System\Cccxbie.exe
  2⤵
  PID:9944
- C:\Windows\System\bYcfgld.exe
  C:\Windows\System\bYcfgld.exe
  2⤵
  PID:9960
- C:\Windows\System\UmQDUBI.exe
  C:\Windows\System\UmQDUBI.exe
  2⤵
  PID:9980
- C:\Windows\System\VuxQhKw.exe
  C:\Windows\System\VuxQhKw.exe
  2⤵
  PID:9996
- C:\Windows\System\ZcNtgqw.exe
  C:\Windows\System\ZcNtgqw.exe
  2⤵
  PID:10012
- C:\Windows\System\BDlXExU.exe
  C:\Windows\System\BDlXExU.exe
  2⤵
  PID:10028
- C:\Windows\System\sDRSUks.exe
  C:\Windows\System\sDRSUks.exe
  2⤵
  PID:10044
- C:\Windows\System\VHQOjmo.exe
  C:\Windows\System\VHQOjmo.exe
  2⤵
  PID:10064
- C:\Windows\System\jKfbcYJ.exe
  C:\Windows\System\jKfbcYJ.exe
  2⤵
  PID:10080
- C:\Windows\System\gdgupWu.exe
  C:\Windows\System\gdgupWu.exe
  2⤵
  PID:10096
- C:\Windows\System\BDwCqdy.exe
  C:\Windows\System\BDwCqdy.exe
  2⤵
  PID:10112
- C:\Windows\System\lscnMzI.exe
  C:\Windows\System\lscnMzI.exe
  2⤵
  PID:10128
- C:\Windows\System\qGkgBNs.exe
  C:\Windows\System\qGkgBNs.exe
  2⤵
  PID:10144
- C:\Windows\System\qmnEWYr.exe
  C:\Windows\System\qmnEWYr.exe
  2⤵
  PID:10160
- C:\Windows\System\fVlLBrV.exe
  C:\Windows\System\fVlLBrV.exe
  2⤵
  PID:10176
- C:\Windows\System\erXGjAs.exe
  C:\Windows\System\erXGjAs.exe
  2⤵
  PID:10192
- C:\Windows\System\EedTjqs.exe
  C:\Windows\System\EedTjqs.exe
  2⤵
  PID:10208
- C:\Windows\System\yEoeziz.exe
  C:\Windows\System\yEoeziz.exe
  2⤵
  PID:10224
- C:\Windows\System\etAEzkc.exe
  C:\Windows\System\etAEzkc.exe
  2⤵
  PID:8860
- C:\Windows\System\rMneuPM.exe
  C:\Windows\System\rMneuPM.exe
  2⤵
  PID:9276
- C:\Windows\System\HPwSvXG.exe
  C:\Windows\System\HPwSvXG.exe
  2⤵
  PID:9340
- C:\Windows\System\PVEOcqb.exe
  C:\Windows\System\PVEOcqb.exe
  2⤵
  PID:8668
- C:\Windows\System\dOZUPdA.exe
  C:\Windows\System\dOZUPdA.exe
  2⤵
  PID:9400
- C:\Windows\System\XyQKynx.exe
  C:\Windows\System\XyQKynx.exe
  2⤵
  PID:9468
- C:\Windows\System\OOsmAHG.exe
  C:\Windows\System\OOsmAHG.exe
  2⤵
  PID:9532
- C:\Windows\System\uvNdUQs.exe
  C:\Windows\System\uvNdUQs.exe
  2⤵
  PID:9596
- C:\Windows\System\gSbudyz.exe
  C:\Windows\System\gSbudyz.exe
  2⤵
  PID:9632
- C:\Windows\System\XobCFFc.exe
  C:\Windows\System\XobCFFc.exe
  2⤵
  PID:9356
- C:\Windows\System\MzpEPzn.exe
  C:\Windows\System\MzpEPzn.exe
  2⤵
  PID:9260
- C:\Windows\System\SKJPueg.exe
  C:\Windows\System\SKJPueg.exe
  2⤵
  PID:9352
- C:\Windows\System\kyPJSGG.exe
  C:\Windows\System\kyPJSGG.exe
  2⤵
  PID:9456
- C:\Windows\System\LpCOwue.exe
  C:\Windows\System\LpCOwue.exe
  2⤵
  PID:9548
- C:\Windows\System\BLiSCCQ.exe
  C:\Windows\System\BLiSCCQ.exe
  2⤵
  PID:9612
- C:\Windows\System\soCpIJK.exe
  C:\Windows\System\soCpIJK.exe
  2⤵
  PID:9652
- C:\Windows\System\frgnlkx.exe
  C:\Windows\System\frgnlkx.exe
  2⤵
  PID:9684
- C:\Windows\System\zeWCXRu.exe
  C:\Windows\System\zeWCXRu.exe
  2⤵
  PID:9728
- C:\Windows\System\dxHHQkQ.exe
  C:\Windows\System\dxHHQkQ.exe
  2⤵
  PID:9792
- C:\Windows\System\XbOlokG.exe
  C:\Windows\System\XbOlokG.exe
  2⤵
  PID:9780
- C:\Windows\System\UwGvUlm.exe
  C:\Windows\System\UwGvUlm.exe
  2⤵
  PID:9824
- C:\Windows\System\SWSLTvJ.exe
  C:\Windows\System\SWSLTvJ.exe
  2⤵
  PID:9888
- C:\Windows\System\HBnKxxy.exe
  C:\Windows\System\HBnKxxy.exe
  2⤵
  PID:9956
- C:\Windows\System\wwDTJZC.exe
  C:\Windows\System\wwDTJZC.exe
  2⤵
  PID:9840
- C:\Windows\System\VulhTGX.exe
  C:\Windows\System\VulhTGX.exe
  2⤵
  PID:9812
- C:\Windows\System\AektAlW.exe
  C:\Windows\System\AektAlW.exe
  2⤵
  PID:9904
- C:\Windows\System\WiJrYyb.exe
  C:\Windows\System\WiJrYyb.exe
  2⤵
  PID:9968
- C:\Windows\System\XFNQbRZ.exe
  C:\Windows\System\XFNQbRZ.exe
  2⤵
  PID:10052

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\AUsbLCL.exe

Filesize
1.7MB

MD5
a2b6294cc116478252fe5c3e6323ef08

SHA1
261d34548fd88c66e9b71a1c0d37972443edb713

SHA256
ef1ed36fb91b8dda18f5d02b1c41e9a54ba5fd27666e72de48d4aedef1773b59

SHA512
b32e76dc46a6492d7a59ea7d32de7d3f444c2249b9ca4d93be63cacca7e5cb7c7dcf70b1dff4f441ff37d578549d6302c7653b51ba5b9ae2d621a695b55f571b

Download Submit
C:\Windows\system\BGSwKYU.exe

Filesize
1.7MB

MD5
5bf86700d8789a8d7a31b9b4b8535f9b

SHA1
a78eec68b3cf2f2c73b8f6ad37a3e347d6707c3a

SHA256
30e7ada3cbe6a9f50372178c47377b978eb99a59f522e0e839473814cc957272

SHA512
94b9b380576c7d0ec2d0bcf77b557a9449dc3a2866f3df721858834aeb838093fb3e09d49c6379c25892f4ea3e6bea0bcb80f3f58d88690e2d62df0540f73b3a

Download Submit
C:\Windows\system\CsIDZhP.exe

Filesize
1.7MB

MD5
893af4ee90d25db60d6671f281f2e7a5

SHA1
0931203a12a91cbbeedf77b61f5cb781a4c7a029

SHA256
f5c569e29a317cbc9a937fa508f5a2f26960d82625e39491da7a18b2300416a4

SHA512
bef638f72698722cc0dedc98c75ea5717d9390d73321f951cdcc58c6f727e5ca38967868f1d563896d8a4c4091518b7fc1fab0b16cd7aa917e81b57f9b4b592e

Download Submit
C:\Windows\system\GWNdRrL.exe

Filesize
1.7MB

MD5
40983da1a994d30733eb84767797dfb4

SHA1
0677da60ac714a1506792cb8872f50b0b26ae93c

SHA256
ab700c48885c757461a93bcc771dae09319c9634dd14476c602200be68a5e074

SHA512
32ad37dd2e8df42c9cfe04c6e0731360d2a8e60c80993a52d93eb839c2cbc7f43b89d429ff1a05cf1234c2bf85353465ee013a85a2488c71bda8931beec9fd9b

Download Submit
C:\Windows\system\KifzXXH.exe

Filesize
1.7MB

MD5
720d1b80e962790c505ffcb9a811611b

SHA1
343ffb5a9638d6210b9cef25614bebdbea4e65b7

SHA256
d810ee01193686f7075302ce7a84d0723a45b1840364469e77db555f306e7d45

SHA512
a88176c173200dda815b9f3ac1fe9281c188a564b544eba56d273ee6e0d9cb89140f2a84b4847d6f2fe084ae5148a7270d1621a048253a47987b175ac98d955f

Download Submit
C:\Windows\system\LAxEYba.exe

Filesize
1.7MB

MD5
9ceb7dd38749bf471c2c381aa4e9000f

SHA1
3c363b9eb09c2fab1921af1f98636fd0e27bc909

SHA256
10db8b88ad60cf9980d8566f3bfc44b43e454e6d6c83f11d1b6e2c4d13b48e08

SHA512
df6934c57ce46b3b52443ff315fef77a1030dde7da396b18563217dd2d625f8862e7ca5b52777c28f9c949916cf7318ccfd5ea9fb42c72e06a744120e1b7b0cf

Download Submit
C:\Windows\system\LFbSRbl.exe

Filesize
1.7MB

MD5
198409564d80601384094f4a9673a2ba

SHA1
a668d74b5defed99d16d10dfa1ed14a4a706533c

SHA256
83e65f2d4d3cb2958e8edce27e314501bbc4ee0193b2ec9431639645fad6fae8

SHA512
6357d8a2d2df7222c68c5fdeaddd73e911bc58589c054718fb97284676514721d49bd36d4a9cf504558d6b390ec6620c1e51ec41c1160b50f55305c161381318

Download Submit
C:\Windows\system\LIOTHsM.exe

Filesize
1.7MB

MD5
5580b2fc1f442eaa0d9af3a3ea037a0e

SHA1
61fe700ef7368a7f085822c26ae3f4c55cfbb0ac

SHA256
bca5d132ff95bc118955de5c361036af5c190fe34f575748ac8ad8366badb8d7

SHA512
1568cbad35f46c313483b69baba67b045e5d0db7243651ea1a82874828a3bdf342d23c5ba40f03bb001c6911da407da76bb6461d6de3a4c6ce6814d9696d0cd3

Download Submit
C:\Windows\system\OqvdDtt.exe

Filesize
1.7MB

MD5
317f1378c27c36e08663f99d321ab32f

SHA1
21ecc27a5e49119b62fff67f34f53cc0bca7b57d

SHA256
992187504e563d0676ad201eaa787713bb257923a2219d709663ee76c814cd11

SHA512
d5231368b2e5342528b9acf3563801b855ed290089e324964f7587e32efc544eafa950ce1f013dfef77a275881e228dc0b97bbfc2315db81756e8201eff205f3

Download Submit
C:\Windows\system\PFLxUgd.exe

Filesize
1.7MB

MD5
391366038b475c01e4367659d72d0024

SHA1
5ba6be3e27ca163865ad83117a608b229e22d5a2

SHA256
8ec51f5393a6f5c7f671ceeeafef465a6a6a246784d167aed3ba6da2e1e7ac32

SHA512
56157695fb450befc994629b6a127c9e70a2d15251cbc6c326893834e85ab7e6491af1730e5d3094c9c1ca42ee1c12a378486ee5eb1849d320e7bec1dfc1ca31

Download Submit
C:\Windows\system\PkDQaws.exe

Filesize
1.7MB

MD5
52f7c1943cf718046b6c8c6c1325db01

SHA1
55e8219470adbe8d1db1c19704183a86e38de982

SHA256
5465630f3634358f90c32b39da7a5d5eb99f06bd195d262af6bbf0a43c9b9628

SHA512
b169fad923492638eb23685a71238da496fb62a302723825cd65baa429befde37deb336d3a5abfaaf431ebfe60ad355cd0b9b1e5e17d5e984333d86cfc872f99

Download Submit
C:\Windows\system\bJTkoJm.exe

Filesize
1.7MB

MD5
0447ac733cd2f19dc9b2453f621dbb52

SHA1
fab815e9d27f0f1f4b2fb07e4594c46622c2154d

SHA256
c320f293c52c72ef7edd5858a6e9a101e90ab634c86f9cbe059e613701bd0bfb

SHA512
cad88d22604089c27f9df5f5d52878f72bedaa4c17325e550f560c85f276904f0ff769fccbbc1cd1cd8d6497407d5e56a3bfd55504e722fa8b002b3e2b2b4fc1

Download Submit
C:\Windows\system\cmdmpOV.exe

Filesize
1.7MB

MD5
2f31482533308add46624018c853c861

SHA1
a9282871500a87d8a7f26ee134b467f80731cffb

SHA256
24b299a3b83811133492415ea5d8f032825bf9c5cb4c8e8e3dad23ab27503cb9

SHA512
6896178dbe2123dc95b5f6b7f0f3517ce633f9346108abe79eb989975268920f0e5c89aeff578e87566dfee3dbf0eafd62ffb6bbfbb1f20210fd4dad8586d6c9

Download Submit
C:\Windows\system\dSAVREU.exe

Filesize
1.7MB

MD5
071492922de634c78dbcb2a9ce09c5d4

SHA1
57172cefa81c2b22f8017fff1301f6c38fa29ab7

SHA256
e56398bc32761ba0e5fec6c54f791c044998955ac4656bb26bf72056260f80d6

SHA512
4e33f290c39b236c8c9397b4232c85f55b6b8414f0a1d6f1c76bf5fe8467e385595f817f5c64de990dc9c70877cb4a41a10414cc853f6fe3f197882b7baf2a0d

Download Submit
C:\Windows\system\foyocTc.exe

Filesize
1.7MB

MD5
c10450f2852df6a45b3db4c1ccbac39c

SHA1
6a1ab231d3344acf510bb4cf9dabda61fc5f0b9c

SHA256
5a50bcb67d2a255371f710e4087039be488130b6f0adb3b7c8aacba003925367

SHA512
513cc676b17d8fa8722bc300e47af1f80ffdf48b9914b6504ae6218c15d7c9099fd4c86dd205bf77ae0be49e7f8dc1d5ff1edf681252158026f8cafb9190d453

Download Submit
C:\Windows\system\gZvmDZt.exe

Filesize
1.7MB

MD5
97d18f3c6c265352b3210986d4de0f26

SHA1
bb382cd61e3d983635043c2d35b2fb5d5ae97c56

SHA256
d42cfc0621032dd91802dc28fddddad112348d75745dbe0e0de86826e729a119

SHA512
14016f2e2f20de0c60df1832ef21817ebaab27f82988c8af2657116712d173f73e184434c35b0a5043dbe75e49a914da1ad9f20d035cb497cf8524d0454c3895

Download Submit
C:\Windows\system\jHScFIE.exe

Filesize
1.7MB

MD5
428778db26f4cf2e3d2dd34273010b56

SHA1
7ae4f546b25341c06605422954bc6df61d875b28

SHA256
a4ba0c83fdef4ef1f960c7a3b403fd2bc389a450986db07843b4de886f12356e

SHA512
22341877c97d6f2f2f16f79bcba85a841db638b8dc2d409030a7e7fbae3dbd44b9e71f5c43a67b9596602611ff8bec9bcc2df617db8806ea323556961f6625e2

Download Submit
C:\Windows\system\pakGXwV.exe

Filesize
1.7MB

MD5
986acc510a57840281d84a5dad0ab6ab

SHA1
fec77e5ff5c48d40d3c157b12bc10b721d51e2b0

SHA256
727f1078147a6a7c2c4aedb3e82fa298037ae902f507fd88d52d6948ff783cf6

SHA512
fd29a3c97024ae0bec248ac0a2a8e990d64ba5f64acf6372b4f66a0ecbb95d11fac50e98ee444fbef6de19bd81e9fefd1f25943b057d11cb97fd0ddf34116eb9

Download Submit
C:\Windows\system\qPDfoIG.exe

Filesize
1.7MB

MD5
3aa97e9c6f55d1534ddab4995626d193

SHA1
e5d330aca7e1404f27f3483a36bf018afbd14252

SHA256
c1ba4140343f61765b4ed28602720115821b9d4c7327da5213c94e7de6d659ab

SHA512
5e322e4694b8cf414296a34cc099d37a893ea2f89090840a7c493b07783673b478d87663c87d340be045b402fc2ad3ce6dd51bf0fd6b37cbb96c107005ac2394

Download Submit
C:\Windows\system\wVkZZiY.exe

Filesize
1.7MB

MD5
5fc9d1a4ad61ca2451724bd623150347

SHA1
704b86494ee9bf4dc685eb5be383a7c9452497c2

SHA256
ea3389e16d4a9580d8ba6c697d132d51b648aad54cb1455132f1ba66648bfd04

SHA512
d22bdb9e1ca3eb873509fa9b135c7cb394b6a3074b30342c774198b19974ec8daf54f15d6ea927a51adfcdc3c81df98347544b175f118a60ae53c366fc3e30c1

Download Submit
C:\Windows\system\wjbPAXi.exe

Filesize
1.7MB

MD5
388cea0c5ad6db8f4c4b7a3430cb27a7

SHA1
830a683d311d55f44ba48e23650a8ee36e4d2c8c

SHA256
858ba8562712f18565391bbad5bbe9ad35ed97557eb6efdf8a3d8d8f94b0df11

SHA512
2d3c31c19a150e8571da444ea9913f88167b0233fda706ce7c2543c079d848d3e5ed8316287d92ddd0f84e866593058972e53a6bb781afeaf04ee4203d6d8a0e

Download Submit
C:\Windows\system\yDkFNla.exe

Filesize
1.7MB

MD5
99b9aadfad5b1a9852f5a667f6a8e592

SHA1
ff5850d43e303c3799e40ede65cae523c3e05d47

SHA256
4e877e7485dd04ed234190296fe5378161080e1b0b3bbff4b3cde2ae30977603

SHA512
b14cb57298f032d7c5af7adbf30795b05b63a12abaca5425c0758d6100b7c6f2fc0a4a4189320fdb043280dae6752977246e2c531470c7ea8663c71d59537e24

Download Submit
\Windows\system\QIlfNUU.exe

Filesize
1.7MB

MD5
eabee7e616c7ca8f962cf6136fabf9ac

SHA1
499beba6eb0ec0b16a9ddf07cc79ac755c04f329

SHA256
526642eddc70fa5e507700b86a0804c74f2db021cd88cd9554a4f472527693c7

SHA512
02b4b847c889dbb96c40edd984938cba9ef458b28ea3f5a1e1ec3c67b36c4855534736a92443313eb4998b4b45bc0852dc8f71ab56b3430d9b20d1fbdbb73809

Download Submit
\Windows\system\cGrfEpO.exe

Filesize
1.7MB

MD5
a32ceca9ba51f94fee42ed96f211190d

SHA1
547ecf1735d23d738cf6a331576bc5a481d8349c

SHA256
1c0fa221d1dcd96ee4adbc4b4ac0cc291b936afcdf8186625c52fccc05c51aa3

SHA512
7ac32cf3e2a31fa2cc55ac376fcddc27fc0b157721882612d66ba1713de303f3a38a59bfaf11540872978616c0de3c45679e2a055421409ada3a84e0159320e1

Download Submit
\Windows\system\cHYiXYS.exe

Filesize
1.7MB

MD5
8dc35dcfd1fb3b70e0652c96e89a7828

SHA1
5f487696fdc43ea708a8d6d91647357635a4f065

SHA256
b956797761fe87b0d5b526676cfff4d22d925acd8078ac83aa6e919156b9b20d

SHA512
5600ac17e92ada741830c7eabf3f929b0edec1d23f91c06bf06399dcaac94f69526ea39f5479936add512bea8fc405a3df90701a3071023ca395fb4e59931786

Download Submit
\Windows\system\giYkBSX.exe

Filesize
1.7MB

MD5
cf00ef22022327ac2ef0fe41cdce3759

SHA1
d5953f9990964a6b4f3f2a0295a3fb8fe8f80528

SHA256
abc1506bc7688f588a0c86dcc3fa2ca7a7c83a61de85eb7bd89c6e1bc6c34ae9

SHA512
6e84a941f06a0294dac31dfbced6dfda2826538c834358257d4efc21fd2b9b116c303d28aa7eb977de227c1c2eff69a41c28ec00cf37f044e865f0b15912856b

Download Submit
\Windows\system\hKqioPH.exe

Filesize
1.7MB

MD5
e77a4390a74bae8d05cba0ceb899ceb3

SHA1
aefbba416ddcf90559c696301eb20d650737ef53

SHA256
3f781a922f6bb2622bc6bbb8ec591835914c8e0be179af8bcc2552c43db1487a

SHA512
3c2840c0767b1f52db9ee5f3462408a864dacb99895a302f0e5bd1497316fce71354323a247411695983c175848df71a0e02c14aedbdeb48dbf4038902cb9f0c

Download Submit
\Windows\system\hcNjJTm.exe

Filesize
1.7MB

MD5
668e46cc68b568acb295a7b42cda0a24

SHA1
fb60c99183feb48bf22c7a16772b182014624a7e

SHA256
cdc1168bcde541079dbf357b0495c38f504aaa2f5821bc40fb9fb2d98467aac5

SHA512
25df3859011e7af0a11966923fcc00d638227ad52db8d308213f186d7da4547d4b6e846e94ae5a7d7134562b4ece28e85ece37bfed31b163b1eddf97512e28e9

Download Submit
\Windows\system\hxpnMbr.exe

Filesize
1.7MB

MD5
ec39c6fdfa48e8e64295c212b9b5bbe1

SHA1
be38572cac1f750453337fce5c0d23d466c0fbd1

SHA256
aaadbb265b81cb5af9a8319d4710917ebfc8893c20046417b16770c09825958c

SHA512
cd3e697536dafdbd25ee9de8ea741d9876e2407027d332764708faffaff784a720339b4131415dbf78769c51a2138233db1a7cba0fd1d49495b623270fc59ce3

Download Submit
\Windows\system\jEPCXlw.exe

Filesize
1.7MB

MD5
b3d6884643640c24453cb97f2bc7305d

SHA1
f152bd1a0589704a34496e7df85cd138ee95a7d5

SHA256
c71bf50ea79770efec2791a2d3aeec8763e2549e018c58b88526036bdcd96473

SHA512
e16774b8d65ee5b9647106c745ed4b0ace87f966638b11fa8dd31144215c4c5cbcd7a735446fcbd8325348616956aa50f82a32bb08c24e900895425a347eccda

Download Submit
\Windows\system\nhCNVxp.exe

Filesize
1.7MB

MD5
058e76f9128a3f1eb8a83c130ea3558f

SHA1
f543a17414f33fae46d0874e1983c8cd6b629d2c

SHA256
f3722ac0523b2ef40fcfe4140bfe100c48577e1bec59870bdc12b6d5485c3ad3

SHA512
adbfbed059c12bb80c3bc455be609fd60d855b29fa4ee8fd89d731c64efc8d30a038e16f10ff1839f3bd1a2053c4778507e9e83c40c7880cbbc17e00c9d3bfdd

Download Submit
\Windows\system\sBFDrwB.exe

Filesize
1.7MB

MD5
f3ee212b895528fb29860355ec87586e

SHA1
7eda9cf331eb8c6c0268b87e0fd0303d0dae4697

SHA256
ef85a23db06f07efbc67aea6fc2a095993ea9496ccbc0d0d273140b6d64bae10

SHA512
9da153732652d6573bce4d63029c8c97891a77c04477e56a02ae16b98de46dbba7e836e6511b286804a9cf151872fd8b85761c1af4e727660e40ea04020657c2

Download Submit
\Windows\system\tITmvfp.exe

Filesize
1.7MB

MD5
510527f62b4a30969776dcad81b700f4

SHA1
a2920fdf68ed190e7ae8ad7ff39f47146a42a763

SHA256
14e68dff881edcf67b4f6647dee570421116a792c2d7d547cb3434a7e7464bdb

SHA512
9c722b51d7737a81db917f7e374999e40066ace6ecb739e5e7e0d439705c54eb873d73e9233164327cf359e0b2cef969e89d5389de774f06504e887fb237672a

Download Submit
\Windows\system\usOToVB.exe

Filesize
1.7MB

MD5
eee64b35cac983d03f991f67b00dc641

SHA1
e5f08dada94ebd2a1868fb7124e2e28cbaa44179

SHA256
4f5087a9e1fe1eac2fe01beeacc5c9329ed82b79f6fa3704444ff1504e943627

SHA512
0c3a44113c7daa1eb9e100bbb017af11a56a6de3e1d49aee8fb3a401035f739c5384500d5a865a92dd28e160f7782fb8442d0126b36ea92a6a6ed5ad700c1dea

Download Submit
memory/2028-224-0x000000013F550000-0x000000013F942000-memory.dmp

Filesize
3.9MB

Download
memory/2028-6613-0x000000013F550000-0x000000013F942000-memory.dmp

Filesize
3.9MB

Download
memory/2088-6641-0x000000013FCD0000-0x00000001400C2000-memory.dmp

Filesize
3.9MB

Download
memory/2088-16-0x000000013FCD0000-0x00000001400C2000-memory.dmp

Filesize
3.9MB

Download
memory/2252-680-0x000000001B530000-0x000000001B812000-memory.dmp

Filesize
2.9MB

Download
memory/2252-30-0x0000000002A20000-0x0000000002AA0000-memory.dmp

Filesize
512KB

Download
memory/2252-4265-0x000007FEF61D0000-0x000007FEF6B6D000-memory.dmp

Filesize
9.6MB

Download
memory/2252-31-0x000007FEF648E000-0x000007FEF648F000-memory.dmp

Filesize
4KB

Download
memory/2252-209-0x000007FEF61D0000-0x000007FEF6B6D000-memory.dmp

Filesize
9.6MB

Download
memory/2252-791-0x0000000002790000-0x0000000002798000-memory.dmp

Filesize
32KB

Download
memory/2288-217-0x00000000036D0000-0x0000000003AC2000-memory.dmp

Filesize
3.9MB

Download
memory/2288-214-0x00000000036D0000-0x0000000003AC2000-memory.dmp

Filesize
3.9MB

Download
memory/2288-222-0x000000013FD10000-0x0000000140102000-memory.dmp

Filesize
3.9MB

Download
memory/2288-12-0x00000000030A0000-0x0000000003492000-memory.dmp

Filesize
3.9MB

Download
memory/2288-1-0x000000013F130000-0x000000013F522000-memory.dmp

Filesize
3.9MB

Download
memory/2288-221-0x00000000036D0000-0x0000000003AC2000-memory.dmp

Filesize
3.9MB

Download
memory/2288-219-0x00000000036D0000-0x0000000003AC2000-memory.dmp

Filesize
3.9MB

Download
memory/2288-212-0x000000013FE70000-0x0000000140262000-memory.dmp

Filesize
3.9MB

Download
memory/2288-15-0x000000013FCD0000-0x00000001400C2000-memory.dmp

Filesize
3.9MB

Download
memory/2288-210-0x000000013FEB0000-0x00000001402A2000-memory.dmp

Filesize
3.9MB

Download
memory/2288-215-0x000000013F790000-0x000000013FB82000-memory.dmp

Filesize
3.9MB

Download
memory/2288-0-0x00000000001F0000-0x0000000000200000-memory.dmp

Filesize
64KB

Download
memory/2288-13822-0x000000013F130000-0x000000013F522000-memory.dmp

Filesize
3.9MB

Download
memory/2556-6644-0x000000013F280000-0x000000013F672000-memory.dmp

Filesize
3.9MB

Download
memory/2556-218-0x000000013F280000-0x000000013F672000-memory.dmp

Filesize
3.9MB

Download
memory/2564-6610-0x000000013FEB0000-0x00000001402A2000-memory.dmp

Filesize
3.9MB

Download
memory/2564-211-0x000000013FEB0000-0x00000001402A2000-memory.dmp

Filesize
3.9MB

Download
memory/2580-223-0x000000013F170000-0x000000013F562000-memory.dmp

Filesize
3.9MB

Download
memory/2580-6612-0x000000013F170000-0x000000013F562000-memory.dmp

Filesize
3.9MB

Download
memory/2584-216-0x000000013F2E0000-0x000000013F6D2000-memory.dmp

Filesize
3.9MB

Download
memory/2584-6611-0x000000013F2E0000-0x000000013F6D2000-memory.dmp

Filesize
3.9MB

Download
memory/2728-28-0x000000013F6A0000-0x000000013FA92000-memory.dmp

Filesize
3.9MB

Download
memory/2728-6615-0x000000013F6A0000-0x000000013FA92000-memory.dmp

Filesize
3.9MB

Download
memory/2748-14-0x000000013F2C0000-0x000000013F6B2000-memory.dmp

Filesize
3.9MB

Download
memory/2748-6614-0x000000013F2C0000-0x000000013F6B2000-memory.dmp

Filesize
3.9MB

Download
memory/2752-213-0x000000013FE70000-0x0000000140262000-memory.dmp

Filesize
3.9MB

Download
memory/2752-6649-0x000000013FE70000-0x0000000140262000-memory.dmp

Filesize
3.9MB

Download
memory/2788-6651-0x000000013F790000-0x000000013FB82000-memory.dmp

Filesize
3.9MB

Download
memory/2788-220-0x000000013F790000-0x000000013FB82000-memory.dmp

Filesize
3.9MB

Download
memory/2924-225-0x000000013F200000-0x000000013F5F2000-memory.dmp

Filesize
3.9MB

Download