xmrig | 1ea48d3ecfc182aec295b602075a0b0fec48bcfc5c8743721b0bb22c1441109d

Analysis

max time kernel
150s
max time network
146s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
02/06/2024, 01:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

18d708bb8ec38d98210415284ae03b40_NeikiAnalytics.exe
Size

1.9MB
MD5

18d708bb8ec38d98210415284ae03b40
SHA1

72e6913c4521f00c96ca654492f685070855f75f
SHA256

1ea48d3ecfc182aec295b602075a0b0fec48bcfc5c8743721b0bb22c1441109d
SHA512

a4771790bbfbb3bf063ed313353bfff67c01022fa39c3878e9172dc1c319ab731c2fd1e001b4baca2cd3082122901089d4dd5a9985b2fd553f6aa2798154400e
SSDEEP

49152:Lz071uv4BPMkibTIA5lCx7kvRWa4pXYPGg8O:NAB+

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 18 IoCs

miner

resource	yara_rule
behavioral1/memory/2624-67-0x000000013FFB0000-0x00000001403A2000-memory.dmp	xmrig
behavioral1/memory/2520-87-0x000000013FA60000-0x000000013FE52000-memory.dmp	xmrig
behavioral1/memory/2840-98-0x000000013F2D0000-0x000000013F6C2000-memory.dmp	xmrig
behavioral1/memory/1744-4157-0x000000013F030000-0x000000013F422000-memory.dmp	xmrig
behavioral1/memory/3060-4291-0x000000013FEA0000-0x0000000140292000-memory.dmp	xmrig
behavioral1/memory/1756-4269-0x000000013F4A0000-0x000000013F892000-memory.dmp	xmrig
behavioral1/memory/2400-4267-0x000000013F050000-0x000000013F442000-memory.dmp	xmrig
behavioral1/memory/2656-4239-0x000000013FF50000-0x0000000140342000-memory.dmp	xmrig
behavioral1/memory/2844-94-0x000000013F590000-0x000000013F982000-memory.dmp	xmrig
behavioral1/memory/3060-92-0x000000013FEA0000-0x0000000140292000-memory.dmp	xmrig
behavioral1/memory/2656-88-0x000000013FF50000-0x0000000140342000-memory.dmp	xmrig
behavioral1/memory/3020-91-0x000000013FDE0000-0x00000001401D2000-memory.dmp	xmrig
behavioral1/memory/1756-89-0x000000013F4A0000-0x000000013F892000-memory.dmp	xmrig
behavioral1/memory/2400-86-0x000000013F050000-0x000000013F442000-memory.dmp	xmrig
behavioral1/memory/2652-80-0x000000013FEE0000-0x00000001402D2000-memory.dmp	xmrig
behavioral1/memory/2736-22-0x000000013F9A0000-0x000000013FD92000-memory.dmp	xmrig
behavioral1/memory/1744-17-0x000000013F030000-0x000000013F422000-memory.dmp	xmrig
behavioral1/memory/2248-5923-0x000000013F460000-0x000000013F852000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
1760	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
1744	HDKChaQ.exe
2736	UvVjWGS.exe
2624	cGLRpjP.exe
2652	qWGqTwe.exe
2400	IHuPBoE.exe
2520	WcDPFha.exe
2656	tjzNXLm.exe
1756	IpCLuRk.exe
3020	aRsQbmT.exe
3060	smCPtXG.exe
2840	BRxWqbg.exe
2844	VMSWMfa.exe
1616	mSNQHaW.exe
2208	svLwJYh.exe
1828	YVsuDxD.exe
2016	OUKRMoV.exe
2480	ZYTsdeq.exe
2992	LufZFEj.exe
2740	fDfcoBo.exe
3044	FQyydyG.exe
880	RxKesEC.exe
1344	xFOyrND.exe
1964	eddqziD.exe
2144	QHvOemX.exe
2816	nwHhqHD.exe
588	XIyOggH.exe
1864	AhUsGLh.exe
1772	SmAYWvX.exe
844	PDPiVvZ.exe
2120	zxRdKsa.exe
2428	MyJMSro.exe
1388	XBcnwnU.exe
1800	UPVWKwy.exe
956	GlhipsZ.exe
1316	OiMEPJM.exe
1820	hGJdjhg.exe
1256	LmbvEOQ.exe
1780	scxzpET.exe
960	kNcMCUk.exe
984	xubiyAy.exe
1164	LUNcHnc.exe
1960	qQUNgay.exe
1696	JNiAukR.exe
1748	aIZmCUV.exe
768	OXhEoEJ.exe
2968	BnxyWmU.exe
1608	MwAyDgR.exe
2052	LWEgWdj.exe
1844	NTtQlSN.exe
1816	kzDtjIt.exe
2064	KPtRbDW.exe
3000	jkxexmt.exe
2916	KmIfZfx.exe
1720	UyDqvPX.exe
1580	eSblzaA.exe
2632	wzBTCqA.exe
2112	TRjzWJh.exe
2812	grBUkLP.exe
1244	JaLdRIS.exe
2680	WEfPQJu.exe
2796	emIYBzq.exe
1508	ZRvoANN.exe
1532	LpkkNoH.exe
2592	UVUnHRn.exe

Loads dropped DLL 64 IoCs

pid	Process
2248	18d708bb8ec38d98210415284ae03b40_NeikiAnalytics.exe
2248	18d708bb8ec38d98210415284ae03b40_NeikiAnalytics.exe
2248	18d708bb8ec38d98210415284ae03b40_NeikiAnalytics.exe
2248	18d708bb8ec38d98210415284ae03b40_NeikiAnalytics.exe
2248	18d708bb8ec38d98210415284ae03b40_NeikiAnalytics.exe
2248	18d708bb8ec38d98210415284ae03b40_NeikiAnalytics.exe
2248	18d708bb8ec38d98210415284ae03b40_NeikiAnalytics.exe
2248	18d708bb8ec38d98210415284ae03b40_NeikiAnalytics.exe
2248	18d708bb8ec38d98210415284ae03b40_NeikiAnalytics.exe
2248	18d708bb8ec38d98210415284ae03b40_NeikiAnalytics.exe
2248	18d708bb8ec38d98210415284ae03b40_NeikiAnalytics.exe
2248	18d708bb8ec38d98210415284ae03b40_NeikiAnalytics.exe
2248	18d708bb8ec38d98210415284ae03b40_NeikiAnalytics.exe
2248	18d708bb8ec38d98210415284ae03b40_NeikiAnalytics.exe
2248	18d708bb8ec38d98210415284ae03b40_NeikiAnalytics.exe
2248	18d708bb8ec38d98210415284ae03b40_NeikiAnalytics.exe
2248	18d708bb8ec38d98210415284ae03b40_NeikiAnalytics.exe
2248	18d708bb8ec38d98210415284ae03b40_NeikiAnalytics.exe
2248	18d708bb8ec38d98210415284ae03b40_NeikiAnalytics.exe
2248	18d708bb8ec38d98210415284ae03b40_NeikiAnalytics.exe
2248	18d708bb8ec38d98210415284ae03b40_NeikiAnalytics.exe
2248	18d708bb8ec38d98210415284ae03b40_NeikiAnalytics.exe
2248	18d708bb8ec38d98210415284ae03b40_NeikiAnalytics.exe
2248	18d708bb8ec38d98210415284ae03b40_NeikiAnalytics.exe
2248	18d708bb8ec38d98210415284ae03b40_NeikiAnalytics.exe
2248	18d708bb8ec38d98210415284ae03b40_NeikiAnalytics.exe
2248	18d708bb8ec38d98210415284ae03b40_NeikiAnalytics.exe
2248	18d708bb8ec38d98210415284ae03b40_NeikiAnalytics.exe
2248	18d708bb8ec38d98210415284ae03b40_NeikiAnalytics.exe
2248	18d708bb8ec38d98210415284ae03b40_NeikiAnalytics.exe
2248	18d708bb8ec38d98210415284ae03b40_NeikiAnalytics.exe
2248	18d708bb8ec38d98210415284ae03b40_NeikiAnalytics.exe
2248	18d708bb8ec38d98210415284ae03b40_NeikiAnalytics.exe
2248	18d708bb8ec38d98210415284ae03b40_NeikiAnalytics.exe
2248	18d708bb8ec38d98210415284ae03b40_NeikiAnalytics.exe
2248	18d708bb8ec38d98210415284ae03b40_NeikiAnalytics.exe
2248	18d708bb8ec38d98210415284ae03b40_NeikiAnalytics.exe
2248	18d708bb8ec38d98210415284ae03b40_NeikiAnalytics.exe
2248	18d708bb8ec38d98210415284ae03b40_NeikiAnalytics.exe
2248	18d708bb8ec38d98210415284ae03b40_NeikiAnalytics.exe
2248	18d708bb8ec38d98210415284ae03b40_NeikiAnalytics.exe
2248	18d708bb8ec38d98210415284ae03b40_NeikiAnalytics.exe
2248	18d708bb8ec38d98210415284ae03b40_NeikiAnalytics.exe
2248	18d708bb8ec38d98210415284ae03b40_NeikiAnalytics.exe
2248	18d708bb8ec38d98210415284ae03b40_NeikiAnalytics.exe
2248	18d708bb8ec38d98210415284ae03b40_NeikiAnalytics.exe
2248	18d708bb8ec38d98210415284ae03b40_NeikiAnalytics.exe
2248	18d708bb8ec38d98210415284ae03b40_NeikiAnalytics.exe
2248	18d708bb8ec38d98210415284ae03b40_NeikiAnalytics.exe
2248	18d708bb8ec38d98210415284ae03b40_NeikiAnalytics.exe
2248	18d708bb8ec38d98210415284ae03b40_NeikiAnalytics.exe
2248	18d708bb8ec38d98210415284ae03b40_NeikiAnalytics.exe
2248	18d708bb8ec38d98210415284ae03b40_NeikiAnalytics.exe
2248	18d708bb8ec38d98210415284ae03b40_NeikiAnalytics.exe
2248	18d708bb8ec38d98210415284ae03b40_NeikiAnalytics.exe
2248	18d708bb8ec38d98210415284ae03b40_NeikiAnalytics.exe
2248	18d708bb8ec38d98210415284ae03b40_NeikiAnalytics.exe
2248	18d708bb8ec38d98210415284ae03b40_NeikiAnalytics.exe
2248	18d708bb8ec38d98210415284ae03b40_NeikiAnalytics.exe
2248	18d708bb8ec38d98210415284ae03b40_NeikiAnalytics.exe
2248	18d708bb8ec38d98210415284ae03b40_NeikiAnalytics.exe
2248	18d708bb8ec38d98210415284ae03b40_NeikiAnalytics.exe
2248	18d708bb8ec38d98210415284ae03b40_NeikiAnalytics.exe
2248	18d708bb8ec38d98210415284ae03b40_NeikiAnalytics.exe

UPX packed file 56 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2248-2-0x000000013F460000-0x000000013F852000-memory.dmp	upx
behavioral1/files/0x000c0000000136fc-3.dat	upx
behavioral1/files/0x0033000000013f21-13.dat	upx
behavioral1/files/0x001400000000549e-27.dat	upx
behavioral1/files/0x0007000000014319-40.dat	upx
behavioral1/files/0x000900000001444f-52.dat	upx
behavioral1/files/0x0006000000014e5a-57.dat	upx
behavioral1/memory/2624-67-0x000000013FFB0000-0x00000001403A2000-memory.dmp	upx
behavioral1/memory/2520-87-0x000000013FA60000-0x000000013FE52000-memory.dmp	upx
behavioral1/memory/2840-98-0x000000013F2D0000-0x000000013F6C2000-memory.dmp	upx
behavioral1/files/0x0006000000015b13-114.dat	upx
behavioral1/files/0x0006000000015bb9-125.dat	upx
behavioral1/files/0x0006000000015c9c-145.dat	upx
behavioral1/files/0x0006000000015ca5-149.dat	upx
behavioral1/files/0x0006000000015ca5-147.dat	upx
behavioral1/files/0x0006000000015cb9-171.dat	upx
behavioral1/files/0x0006000000015cf7-192.dat	upx
behavioral1/memory/1744-4157-0x000000013F030000-0x000000013F422000-memory.dmp	upx
behavioral1/memory/3060-4291-0x000000013FEA0000-0x0000000140292000-memory.dmp	upx
behavioral1/memory/1756-4269-0x000000013F4A0000-0x000000013F892000-memory.dmp	upx
behavioral1/memory/2400-4267-0x000000013F050000-0x000000013F442000-memory.dmp	upx
behavioral1/memory/2656-4239-0x000000013FF50000-0x0000000140342000-memory.dmp	upx
behavioral1/files/0x0006000000015cf7-190.dat	upx
behavioral1/files/0x0006000000015cec-188.dat	upx
behavioral1/files/0x0006000000015cdb-184.dat	upx
behavioral1/files/0x0006000000015cc1-176.dat	upx
behavioral1/files/0x0006000000015cca-180.dat	upx
behavioral1/files/0x0006000000015cad-166.dat	upx
behavioral1/files/0x0006000000015c86-141.dat	upx
behavioral1/files/0x0006000000015c7c-137.dat	upx
behavioral1/files/0x0006000000015c7c-135.dat	upx
behavioral1/files/0x0006000000015c6d-133.dat	upx
behavioral1/files/0x0006000000015c51-129.dat	upx
behavioral1/files/0x0006000000015c51-127.dat	upx
behavioral1/files/0x0006000000015b77-121.dat	upx
behavioral1/files/0x003400000001416f-117.dat	upx
behavioral1/files/0x00060000000155e3-105.dat	upx
behavioral1/files/0x0006000000015642-107.dat	upx
behavioral1/files/0x00060000000153cf-99.dat	upx
behavioral1/memory/2844-94-0x000000013F590000-0x000000013F982000-memory.dmp	upx
behavioral1/memory/3060-92-0x000000013FEA0000-0x0000000140292000-memory.dmp	upx
behavioral1/memory/2656-88-0x000000013FF50000-0x0000000140342000-memory.dmp	upx
behavioral1/memory/3020-91-0x000000013FDE0000-0x00000001401D2000-memory.dmp	upx
behavioral1/memory/1756-89-0x000000013F4A0000-0x000000013F892000-memory.dmp	upx
behavioral1/memory/2400-86-0x000000013F050000-0x000000013F442000-memory.dmp	upx
behavioral1/memory/2652-80-0x000000013FEE0000-0x00000001402D2000-memory.dmp	upx
behavioral1/files/0x0006000000015362-77.dat	upx
behavioral1/files/0x0006000000015136-68.dat	upx
behavioral1/files/0x0006000000015023-61.dat	upx
behavioral1/files/0x0007000000014284-34.dat	upx
behavioral1/files/0x000700000001430e-37.dat	upx
behavioral1/files/0x0008000000014216-33.dat	upx
behavioral1/memory/2736-22-0x000000013F9A0000-0x000000013FD92000-memory.dmp	upx
behavioral1/memory/1744-17-0x000000013F030000-0x000000013F422000-memory.dmp	upx
behavioral1/files/0x000c0000000136fc-6.dat	upx
behavioral1/memory/2248-5923-0x000000013F460000-0x000000013F852000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\mjjUYon.exe	18d708bb8ec38d98210415284ae03b40_NeikiAnalytics.exe
File created	C:\Windows\System\NKybaQS.exe	18d708bb8ec38d98210415284ae03b40_NeikiAnalytics.exe
File created	C:\Windows\System\LWEgWdj.exe	18d708bb8ec38d98210415284ae03b40_NeikiAnalytics.exe
File created	C:\Windows\System\SlShfLn.exe	18d708bb8ec38d98210415284ae03b40_NeikiAnalytics.exe
File created	C:\Windows\System\DcKmzIx.exe	18d708bb8ec38d98210415284ae03b40_NeikiAnalytics.exe
File created	C:\Windows\System\BjQHfgL.exe	18d708bb8ec38d98210415284ae03b40_NeikiAnalytics.exe
File created	C:\Windows\System\aXfJWxz.exe	18d708bb8ec38d98210415284ae03b40_NeikiAnalytics.exe
File created	C:\Windows\System\xiWFWzb.exe	18d708bb8ec38d98210415284ae03b40_NeikiAnalytics.exe
File created	C:\Windows\System\xuHnEhI.exe	18d708bb8ec38d98210415284ae03b40_NeikiAnalytics.exe
File created	C:\Windows\System\QvFYoBX.exe	18d708bb8ec38d98210415284ae03b40_NeikiAnalytics.exe
File created	C:\Windows\System\SONrqLR.exe	18d708bb8ec38d98210415284ae03b40_NeikiAnalytics.exe
File created	C:\Windows\System\yCduhmS.exe	18d708bb8ec38d98210415284ae03b40_NeikiAnalytics.exe
File created	C:\Windows\System\YAGstxg.exe	18d708bb8ec38d98210415284ae03b40_NeikiAnalytics.exe
File created	C:\Windows\System\IjaNUQT.exe	18d708bb8ec38d98210415284ae03b40_NeikiAnalytics.exe
File created	C:\Windows\System\XwuMJzh.exe	18d708bb8ec38d98210415284ae03b40_NeikiAnalytics.exe
File created	C:\Windows\System\SQeCrLG.exe	18d708bb8ec38d98210415284ae03b40_NeikiAnalytics.exe
File created	C:\Windows\System\ghmPJry.exe	18d708bb8ec38d98210415284ae03b40_NeikiAnalytics.exe
File created	C:\Windows\System\urWPTvO.exe	18d708bb8ec38d98210415284ae03b40_NeikiAnalytics.exe
File created	C:\Windows\System\ZxUvERP.exe	18d708bb8ec38d98210415284ae03b40_NeikiAnalytics.exe
File created	C:\Windows\System\lcmIzta.exe	18d708bb8ec38d98210415284ae03b40_NeikiAnalytics.exe
File created	C:\Windows\System\FGMrlIx.exe	18d708bb8ec38d98210415284ae03b40_NeikiAnalytics.exe
File created	C:\Windows\System\cdhAOTU.exe	18d708bb8ec38d98210415284ae03b40_NeikiAnalytics.exe
File created	C:\Windows\System\izJJAQC.exe	18d708bb8ec38d98210415284ae03b40_NeikiAnalytics.exe
File created	C:\Windows\System\ADeUBQR.exe	18d708bb8ec38d98210415284ae03b40_NeikiAnalytics.exe
File created	C:\Windows\System\RVlSmEq.exe	18d708bb8ec38d98210415284ae03b40_NeikiAnalytics.exe
File created	C:\Windows\System\FhGfiDG.exe	18d708bb8ec38d98210415284ae03b40_NeikiAnalytics.exe
File created	C:\Windows\System\exAJtYy.exe	18d708bb8ec38d98210415284ae03b40_NeikiAnalytics.exe
File created	C:\Windows\System\avcirWr.exe	18d708bb8ec38d98210415284ae03b40_NeikiAnalytics.exe
File created	C:\Windows\System\XPjEmNF.exe	18d708bb8ec38d98210415284ae03b40_NeikiAnalytics.exe
File created	C:\Windows\System\IauZxNj.exe	18d708bb8ec38d98210415284ae03b40_NeikiAnalytics.exe
File created	C:\Windows\System\QpwYnvr.exe	18d708bb8ec38d98210415284ae03b40_NeikiAnalytics.exe
File created	C:\Windows\System\lWNRZOy.exe	18d708bb8ec38d98210415284ae03b40_NeikiAnalytics.exe
File created	C:\Windows\System\cDbIgUa.exe	18d708bb8ec38d98210415284ae03b40_NeikiAnalytics.exe
File created	C:\Windows\System\dzWzYGD.exe	18d708bb8ec38d98210415284ae03b40_NeikiAnalytics.exe
File created	C:\Windows\System\nTTHUAq.exe	18d708bb8ec38d98210415284ae03b40_NeikiAnalytics.exe
File created	C:\Windows\System\wPlChEx.exe	18d708bb8ec38d98210415284ae03b40_NeikiAnalytics.exe
File created	C:\Windows\System\zEkexsv.exe	18d708bb8ec38d98210415284ae03b40_NeikiAnalytics.exe
File created	C:\Windows\System\VufgiTw.exe	18d708bb8ec38d98210415284ae03b40_NeikiAnalytics.exe
File created	C:\Windows\System\DDYwdew.exe	18d708bb8ec38d98210415284ae03b40_NeikiAnalytics.exe
File created	C:\Windows\System\HwNRzAy.exe	18d708bb8ec38d98210415284ae03b40_NeikiAnalytics.exe
File created	C:\Windows\System\SrfZaOf.exe	18d708bb8ec38d98210415284ae03b40_NeikiAnalytics.exe
File created	C:\Windows\System\XOIopOu.exe	18d708bb8ec38d98210415284ae03b40_NeikiAnalytics.exe
File created	C:\Windows\System\oJzONUk.exe	18d708bb8ec38d98210415284ae03b40_NeikiAnalytics.exe
File created	C:\Windows\System\CufPtLt.exe	18d708bb8ec38d98210415284ae03b40_NeikiAnalytics.exe
File created	C:\Windows\System\IejZVxM.exe	18d708bb8ec38d98210415284ae03b40_NeikiAnalytics.exe
File created	C:\Windows\System\yCUXEVp.exe	18d708bb8ec38d98210415284ae03b40_NeikiAnalytics.exe
File created	C:\Windows\System\jnbzVRW.exe	18d708bb8ec38d98210415284ae03b40_NeikiAnalytics.exe
File created	C:\Windows\System\NxFHyZz.exe	18d708bb8ec38d98210415284ae03b40_NeikiAnalytics.exe
File created	C:\Windows\System\eVQZysO.exe	18d708bb8ec38d98210415284ae03b40_NeikiAnalytics.exe
File created	C:\Windows\System\sdMCJvT.exe	18d708bb8ec38d98210415284ae03b40_NeikiAnalytics.exe
File created	C:\Windows\System\WXhnvRt.exe	18d708bb8ec38d98210415284ae03b40_NeikiAnalytics.exe
File created	C:\Windows\System\YqwKqwA.exe	18d708bb8ec38d98210415284ae03b40_NeikiAnalytics.exe
File created	C:\Windows\System\xnmEAls.exe	18d708bb8ec38d98210415284ae03b40_NeikiAnalytics.exe
File created	C:\Windows\System\MSuDAik.exe	18d708bb8ec38d98210415284ae03b40_NeikiAnalytics.exe
File created	C:\Windows\System\vbyJIEg.exe	18d708bb8ec38d98210415284ae03b40_NeikiAnalytics.exe
File created	C:\Windows\System\vXzWIuC.exe	18d708bb8ec38d98210415284ae03b40_NeikiAnalytics.exe
File created	C:\Windows\System\mYkpilH.exe	18d708bb8ec38d98210415284ae03b40_NeikiAnalytics.exe
File created	C:\Windows\System\wyZgMOl.exe	18d708bb8ec38d98210415284ae03b40_NeikiAnalytics.exe
File created	C:\Windows\System\mjPnNAa.exe	18d708bb8ec38d98210415284ae03b40_NeikiAnalytics.exe
File created	C:\Windows\System\PbjCfBf.exe	18d708bb8ec38d98210415284ae03b40_NeikiAnalytics.exe
File created	C:\Windows\System\TuTYpbq.exe	18d708bb8ec38d98210415284ae03b40_NeikiAnalytics.exe
File created	C:\Windows\System\WEuHXVA.exe	18d708bb8ec38d98210415284ae03b40_NeikiAnalytics.exe
File created	C:\Windows\System\EhknAxE.exe	18d708bb8ec38d98210415284ae03b40_NeikiAnalytics.exe
File created	C:\Windows\System\OMZkAkY.exe	18d708bb8ec38d98210415284ae03b40_NeikiAnalytics.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1760	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2248	18d708bb8ec38d98210415284ae03b40_NeikiAnalytics.exe
Token: SeLockMemoryPrivilege	2248	18d708bb8ec38d98210415284ae03b40_NeikiAnalytics.exe
Token: SeDebugPrivilege	1760	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2248 wrote to memory of 1760	2248	18d708bb8ec38d98210415284ae03b40_NeikiAnalytics.exe	29
PID 2248 wrote to memory of 1760	2248	18d708bb8ec38d98210415284ae03b40_NeikiAnalytics.exe	29
PID 2248 wrote to memory of 1760	2248	18d708bb8ec38d98210415284ae03b40_NeikiAnalytics.exe	29
PID 2248 wrote to memory of 1744	2248	18d708bb8ec38d98210415284ae03b40_NeikiAnalytics.exe	30
PID 2248 wrote to memory of 1744	2248	18d708bb8ec38d98210415284ae03b40_NeikiAnalytics.exe	30
PID 2248 wrote to memory of 1744	2248	18d708bb8ec38d98210415284ae03b40_NeikiAnalytics.exe	30
PID 2248 wrote to memory of 2736	2248	18d708bb8ec38d98210415284ae03b40_NeikiAnalytics.exe	31
PID 2248 wrote to memory of 2736	2248	18d708bb8ec38d98210415284ae03b40_NeikiAnalytics.exe	31
PID 2248 wrote to memory of 2736	2248	18d708bb8ec38d98210415284ae03b40_NeikiAnalytics.exe	31
PID 2248 wrote to memory of 2624	2248	18d708bb8ec38d98210415284ae03b40_NeikiAnalytics.exe	32
PID 2248 wrote to memory of 2624	2248	18d708bb8ec38d98210415284ae03b40_NeikiAnalytics.exe	32
PID 2248 wrote to memory of 2624	2248	18d708bb8ec38d98210415284ae03b40_NeikiAnalytics.exe	32
PID 2248 wrote to memory of 2652	2248	18d708bb8ec38d98210415284ae03b40_NeikiAnalytics.exe	33
PID 2248 wrote to memory of 2652	2248	18d708bb8ec38d98210415284ae03b40_NeikiAnalytics.exe	33
PID 2248 wrote to memory of 2652	2248	18d708bb8ec38d98210415284ae03b40_NeikiAnalytics.exe	33
PID 2248 wrote to memory of 2520	2248	18d708bb8ec38d98210415284ae03b40_NeikiAnalytics.exe	34
PID 2248 wrote to memory of 2520	2248	18d708bb8ec38d98210415284ae03b40_NeikiAnalytics.exe	34
PID 2248 wrote to memory of 2520	2248	18d708bb8ec38d98210415284ae03b40_NeikiAnalytics.exe	34
PID 2248 wrote to memory of 2400	2248	18d708bb8ec38d98210415284ae03b40_NeikiAnalytics.exe	35
PID 2248 wrote to memory of 2400	2248	18d708bb8ec38d98210415284ae03b40_NeikiAnalytics.exe	35
PID 2248 wrote to memory of 2400	2248	18d708bb8ec38d98210415284ae03b40_NeikiAnalytics.exe	35
PID 2248 wrote to memory of 2656	2248	18d708bb8ec38d98210415284ae03b40_NeikiAnalytics.exe	36
PID 2248 wrote to memory of 2656	2248	18d708bb8ec38d98210415284ae03b40_NeikiAnalytics.exe	36
PID 2248 wrote to memory of 2656	2248	18d708bb8ec38d98210415284ae03b40_NeikiAnalytics.exe	36
PID 2248 wrote to memory of 1756	2248	18d708bb8ec38d98210415284ae03b40_NeikiAnalytics.exe	37
PID 2248 wrote to memory of 1756	2248	18d708bb8ec38d98210415284ae03b40_NeikiAnalytics.exe	37
PID 2248 wrote to memory of 1756	2248	18d708bb8ec38d98210415284ae03b40_NeikiAnalytics.exe	37
PID 2248 wrote to memory of 3020	2248	18d708bb8ec38d98210415284ae03b40_NeikiAnalytics.exe	38
PID 2248 wrote to memory of 3020	2248	18d708bb8ec38d98210415284ae03b40_NeikiAnalytics.exe	38
PID 2248 wrote to memory of 3020	2248	18d708bb8ec38d98210415284ae03b40_NeikiAnalytics.exe	38
PID 2248 wrote to memory of 3060	2248	18d708bb8ec38d98210415284ae03b40_NeikiAnalytics.exe	39
PID 2248 wrote to memory of 3060	2248	18d708bb8ec38d98210415284ae03b40_NeikiAnalytics.exe	39
PID 2248 wrote to memory of 3060	2248	18d708bb8ec38d98210415284ae03b40_NeikiAnalytics.exe	39
PID 2248 wrote to memory of 2840	2248	18d708bb8ec38d98210415284ae03b40_NeikiAnalytics.exe	40
PID 2248 wrote to memory of 2840	2248	18d708bb8ec38d98210415284ae03b40_NeikiAnalytics.exe	40
PID 2248 wrote to memory of 2840	2248	18d708bb8ec38d98210415284ae03b40_NeikiAnalytics.exe	40
PID 2248 wrote to memory of 2844	2248	18d708bb8ec38d98210415284ae03b40_NeikiAnalytics.exe	41
PID 2248 wrote to memory of 2844	2248	18d708bb8ec38d98210415284ae03b40_NeikiAnalytics.exe	41
PID 2248 wrote to memory of 2844	2248	18d708bb8ec38d98210415284ae03b40_NeikiAnalytics.exe	41
PID 2248 wrote to memory of 1616	2248	18d708bb8ec38d98210415284ae03b40_NeikiAnalytics.exe	42
PID 2248 wrote to memory of 1616	2248	18d708bb8ec38d98210415284ae03b40_NeikiAnalytics.exe	42
PID 2248 wrote to memory of 1616	2248	18d708bb8ec38d98210415284ae03b40_NeikiAnalytics.exe	42
PID 2248 wrote to memory of 2208	2248	18d708bb8ec38d98210415284ae03b40_NeikiAnalytics.exe	43
PID 2248 wrote to memory of 2208	2248	18d708bb8ec38d98210415284ae03b40_NeikiAnalytics.exe	43
PID 2248 wrote to memory of 2208	2248	18d708bb8ec38d98210415284ae03b40_NeikiAnalytics.exe	43
PID 2248 wrote to memory of 1828	2248	18d708bb8ec38d98210415284ae03b40_NeikiAnalytics.exe	44
PID 2248 wrote to memory of 1828	2248	18d708bb8ec38d98210415284ae03b40_NeikiAnalytics.exe	44
PID 2248 wrote to memory of 1828	2248	18d708bb8ec38d98210415284ae03b40_NeikiAnalytics.exe	44
PID 2248 wrote to memory of 2016	2248	18d708bb8ec38d98210415284ae03b40_NeikiAnalytics.exe	45
PID 2248 wrote to memory of 2016	2248	18d708bb8ec38d98210415284ae03b40_NeikiAnalytics.exe	45
PID 2248 wrote to memory of 2016	2248	18d708bb8ec38d98210415284ae03b40_NeikiAnalytics.exe	45
PID 2248 wrote to memory of 2480	2248	18d708bb8ec38d98210415284ae03b40_NeikiAnalytics.exe	46
PID 2248 wrote to memory of 2480	2248	18d708bb8ec38d98210415284ae03b40_NeikiAnalytics.exe	46
PID 2248 wrote to memory of 2480	2248	18d708bb8ec38d98210415284ae03b40_NeikiAnalytics.exe	46
PID 2248 wrote to memory of 2992	2248	18d708bb8ec38d98210415284ae03b40_NeikiAnalytics.exe	47
PID 2248 wrote to memory of 2992	2248	18d708bb8ec38d98210415284ae03b40_NeikiAnalytics.exe	47
PID 2248 wrote to memory of 2992	2248	18d708bb8ec38d98210415284ae03b40_NeikiAnalytics.exe	47
PID 2248 wrote to memory of 2740	2248	18d708bb8ec38d98210415284ae03b40_NeikiAnalytics.exe	48
PID 2248 wrote to memory of 2740	2248	18d708bb8ec38d98210415284ae03b40_NeikiAnalytics.exe	48
PID 2248 wrote to memory of 2740	2248	18d708bb8ec38d98210415284ae03b40_NeikiAnalytics.exe	48
PID 2248 wrote to memory of 3044	2248	18d708bb8ec38d98210415284ae03b40_NeikiAnalytics.exe	49
PID 2248 wrote to memory of 3044	2248	18d708bb8ec38d98210415284ae03b40_NeikiAnalytics.exe	49
PID 2248 wrote to memory of 3044	2248	18d708bb8ec38d98210415284ae03b40_NeikiAnalytics.exe	49
PID 2248 wrote to memory of 880	2248	18d708bb8ec38d98210415284ae03b40_NeikiAnalytics.exe	50

C:\Users\Admin\AppData\Local\Temp\18d708bb8ec38d98210415284ae03b40_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\18d708bb8ec38d98210415284ae03b40_NeikiAnalytics.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2248
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1760
- C:\Windows\System\HDKChaQ.exe
  C:\Windows\System\HDKChaQ.exe
  2⤵
  - Executes dropped EXE
  PID:1744
- C:\Windows\System\UvVjWGS.exe
  C:\Windows\System\UvVjWGS.exe
  2⤵
  - Executes dropped EXE
  PID:2736
- C:\Windows\System\cGLRpjP.exe
  C:\Windows\System\cGLRpjP.exe
  2⤵
  - Executes dropped EXE
  PID:2624
- C:\Windows\System\qWGqTwe.exe
  C:\Windows\System\qWGqTwe.exe
  2⤵
  - Executes dropped EXE
  PID:2652
- C:\Windows\System\WcDPFha.exe
  C:\Windows\System\WcDPFha.exe
  2⤵
  - Executes dropped EXE
  PID:2520
- C:\Windows\System\IHuPBoE.exe
  C:\Windows\System\IHuPBoE.exe
  2⤵
  - Executes dropped EXE
  PID:2400
- C:\Windows\System\tjzNXLm.exe
  C:\Windows\System\tjzNXLm.exe
  2⤵
  - Executes dropped EXE
  PID:2656
- C:\Windows\System\IpCLuRk.exe
  C:\Windows\System\IpCLuRk.exe
  2⤵
  - Executes dropped EXE
  PID:1756
- C:\Windows\System\aRsQbmT.exe
  C:\Windows\System\aRsQbmT.exe
  2⤵
  - Executes dropped EXE
  PID:3020
- C:\Windows\System\smCPtXG.exe
  C:\Windows\System\smCPtXG.exe
  2⤵
  - Executes dropped EXE
  PID:3060
- C:\Windows\System\BRxWqbg.exe
  C:\Windows\System\BRxWqbg.exe
  2⤵
  - Executes dropped EXE
  PID:2840
- C:\Windows\System\VMSWMfa.exe
  C:\Windows\System\VMSWMfa.exe
  2⤵
  - Executes dropped EXE
  PID:2844
- C:\Windows\System\mSNQHaW.exe
  C:\Windows\System\mSNQHaW.exe
  2⤵
  - Executes dropped EXE
  PID:1616
- C:\Windows\System\svLwJYh.exe
  C:\Windows\System\svLwJYh.exe
  2⤵
  - Executes dropped EXE
  PID:2208
- C:\Windows\System\YVsuDxD.exe
  C:\Windows\System\YVsuDxD.exe
  2⤵
  - Executes dropped EXE
  PID:1828
- C:\Windows\System\OUKRMoV.exe
  C:\Windows\System\OUKRMoV.exe
  2⤵
  - Executes dropped EXE
  PID:2016
- C:\Windows\System\ZYTsdeq.exe
  C:\Windows\System\ZYTsdeq.exe
  2⤵
  - Executes dropped EXE
  PID:2480
- C:\Windows\System\LufZFEj.exe
  C:\Windows\System\LufZFEj.exe
  2⤵
  - Executes dropped EXE
  PID:2992
- C:\Windows\System\fDfcoBo.exe
  C:\Windows\System\fDfcoBo.exe
  2⤵
  - Executes dropped EXE
  PID:2740
- C:\Windows\System\FQyydyG.exe
  C:\Windows\System\FQyydyG.exe
  2⤵
  - Executes dropped EXE
  PID:3044
- C:\Windows\System\RxKesEC.exe
  C:\Windows\System\RxKesEC.exe
  2⤵
  - Executes dropped EXE
  PID:880
- C:\Windows\System\xFOyrND.exe
  C:\Windows\System\xFOyrND.exe
  2⤵
  - Executes dropped EXE
  PID:1344
- C:\Windows\System\eddqziD.exe
  C:\Windows\System\eddqziD.exe
  2⤵
  - Executes dropped EXE
  PID:1964
- C:\Windows\System\QHvOemX.exe
  C:\Windows\System\QHvOemX.exe
  2⤵
  - Executes dropped EXE
  PID:2144
- C:\Windows\System\nwHhqHD.exe
  C:\Windows\System\nwHhqHD.exe
  2⤵
  - Executes dropped EXE
  PID:2816
- C:\Windows\System\XIyOggH.exe
  C:\Windows\System\XIyOggH.exe
  2⤵
  - Executes dropped EXE
  PID:588
- C:\Windows\System\AhUsGLh.exe
  C:\Windows\System\AhUsGLh.exe
  2⤵
  - Executes dropped EXE
  PID:1864
- C:\Windows\System\SmAYWvX.exe
  C:\Windows\System\SmAYWvX.exe
  2⤵
  - Executes dropped EXE
  PID:1772
- C:\Windows\System\PDPiVvZ.exe
  C:\Windows\System\PDPiVvZ.exe
  2⤵
  - Executes dropped EXE
  PID:844
- C:\Windows\System\zxRdKsa.exe
  C:\Windows\System\zxRdKsa.exe
  2⤵
  - Executes dropped EXE
  PID:2120
- C:\Windows\System\MyJMSro.exe
  C:\Windows\System\MyJMSro.exe
  2⤵
  - Executes dropped EXE
  PID:2428
- C:\Windows\System\XBcnwnU.exe
  C:\Windows\System\XBcnwnU.exe
  2⤵
  - Executes dropped EXE
  PID:1388
- C:\Windows\System\UPVWKwy.exe
  C:\Windows\System\UPVWKwy.exe
  2⤵
  - Executes dropped EXE
  PID:1800
- C:\Windows\System\GlhipsZ.exe
  C:\Windows\System\GlhipsZ.exe
  2⤵
  - Executes dropped EXE
  PID:956
- C:\Windows\System\OiMEPJM.exe
  C:\Windows\System\OiMEPJM.exe
  2⤵
  - Executes dropped EXE
  PID:1316
- C:\Windows\System\hGJdjhg.exe
  C:\Windows\System\hGJdjhg.exe
  2⤵
  - Executes dropped EXE
  PID:1820
- C:\Windows\System\LmbvEOQ.exe
  C:\Windows\System\LmbvEOQ.exe
  2⤵
  - Executes dropped EXE
  PID:1256
- C:\Windows\System\scxzpET.exe
  C:\Windows\System\scxzpET.exe
  2⤵
  - Executes dropped EXE
  PID:1780
- C:\Windows\System\kNcMCUk.exe
  C:\Windows\System\kNcMCUk.exe
  2⤵
  - Executes dropped EXE
  PID:960
- C:\Windows\System\xubiyAy.exe
  C:\Windows\System\xubiyAy.exe
  2⤵
  - Executes dropped EXE
  PID:984
- C:\Windows\System\LUNcHnc.exe
  C:\Windows\System\LUNcHnc.exe
  2⤵
  - Executes dropped EXE
  PID:1164
- C:\Windows\System\qQUNgay.exe
  C:\Windows\System\qQUNgay.exe
  2⤵
  - Executes dropped EXE
  PID:1960
- C:\Windows\System\JNiAukR.exe
  C:\Windows\System\JNiAukR.exe
  2⤵
  - Executes dropped EXE
  PID:1696
- C:\Windows\System\aIZmCUV.exe
  C:\Windows\System\aIZmCUV.exe
  2⤵
  - Executes dropped EXE
  PID:1748
- C:\Windows\System\OXhEoEJ.exe
  C:\Windows\System\OXhEoEJ.exe
  2⤵
  - Executes dropped EXE
  PID:768
- C:\Windows\System\BnxyWmU.exe
  C:\Windows\System\BnxyWmU.exe
  2⤵
  - Executes dropped EXE
  PID:2968
- C:\Windows\System\MwAyDgR.exe
  C:\Windows\System\MwAyDgR.exe
  2⤵
  - Executes dropped EXE
  PID:1608
- C:\Windows\System\LWEgWdj.exe
  C:\Windows\System\LWEgWdj.exe
  2⤵
  - Executes dropped EXE
  PID:2052
- C:\Windows\System\NTtQlSN.exe
  C:\Windows\System\NTtQlSN.exe
  2⤵
  - Executes dropped EXE
  PID:1844
- C:\Windows\System\kzDtjIt.exe
  C:\Windows\System\kzDtjIt.exe
  2⤵
  - Executes dropped EXE
  PID:1816
- C:\Windows\System\KPtRbDW.exe
  C:\Windows\System\KPtRbDW.exe
  2⤵
  - Executes dropped EXE
  PID:2064
- C:\Windows\System\jkxexmt.exe
  C:\Windows\System\jkxexmt.exe
  2⤵
  - Executes dropped EXE
  PID:3000
- C:\Windows\System\KmIfZfx.exe
  C:\Windows\System\KmIfZfx.exe
  2⤵
  - Executes dropped EXE
  PID:2916
- C:\Windows\System\UyDqvPX.exe
  C:\Windows\System\UyDqvPX.exe
  2⤵
  - Executes dropped EXE
  PID:1720
- C:\Windows\System\eSblzaA.exe
  C:\Windows\System\eSblzaA.exe
  2⤵
  - Executes dropped EXE
  PID:1580
- C:\Windows\System\wzBTCqA.exe
  C:\Windows\System\wzBTCqA.exe
  2⤵
  - Executes dropped EXE
  PID:2632
- C:\Windows\System\TRjzWJh.exe
  C:\Windows\System\TRjzWJh.exe
  2⤵
  - Executes dropped EXE
  PID:2112
- C:\Windows\System\grBUkLP.exe
  C:\Windows\System\grBUkLP.exe
  2⤵
  - Executes dropped EXE
  PID:2812
- C:\Windows\System\JaLdRIS.exe
  C:\Windows\System\JaLdRIS.exe
  2⤵
  - Executes dropped EXE
  PID:1244
- C:\Windows\System\WEfPQJu.exe
  C:\Windows\System\WEfPQJu.exe
  2⤵
  - Executes dropped EXE
  PID:2680
- C:\Windows\System\emIYBzq.exe
  C:\Windows\System\emIYBzq.exe
  2⤵
  - Executes dropped EXE
  PID:2796
- C:\Windows\System\ZRvoANN.exe
  C:\Windows\System\ZRvoANN.exe
  2⤵
  - Executes dropped EXE
  PID:1508
- C:\Windows\System\LpkkNoH.exe
  C:\Windows\System\LpkkNoH.exe
  2⤵
  - Executes dropped EXE
  PID:1532
- C:\Windows\System\UVUnHRn.exe
  C:\Windows\System\UVUnHRn.exe
  2⤵
  - Executes dropped EXE
  PID:2592
- C:\Windows\System\hSrnmon.exe
  C:\Windows\System\hSrnmon.exe
  2⤵
  PID:3024
- C:\Windows\System\UlWIzXO.exe
  C:\Windows\System\UlWIzXO.exe
  2⤵
  PID:2128
- C:\Windows\System\zcbHasV.exe
  C:\Windows\System\zcbHasV.exe
  2⤵
  PID:596
- C:\Windows\System\aWHtFgw.exe
  C:\Windows\System\aWHtFgw.exe
  2⤵
  PID:872
- C:\Windows\System\CiIVfDg.exe
  C:\Windows\System\CiIVfDg.exe
  2⤵
  PID:612
- C:\Windows\System\zVOpBOV.exe
  C:\Windows\System\zVOpBOV.exe
  2⤵
  PID:1648
- C:\Windows\System\MEVvvuj.exe
  C:\Windows\System\MEVvvuj.exe
  2⤵
  PID:2088
- C:\Windows\System\jLcwJUB.exe
  C:\Windows\System\jLcwJUB.exe
  2⤵
  PID:656
- C:\Windows\System\nUJpniE.exe
  C:\Windows\System\nUJpniE.exe
  2⤵
  PID:2132
- C:\Windows\System\YcxwJTb.exe
  C:\Windows\System\YcxwJTb.exe
  2⤵
  PID:1544
- C:\Windows\System\MuYksnU.exe
  C:\Windows\System\MuYksnU.exe
  2⤵
  PID:1776
- C:\Windows\System\ljyTnON.exe
  C:\Windows\System\ljyTnON.exe
  2⤵
  PID:1872
- C:\Windows\System\VOJMRSK.exe
  C:\Windows\System\VOJMRSK.exe
  2⤵
  PID:2976
- C:\Windows\System\ZwqUMzQ.exe
  C:\Windows\System\ZwqUMzQ.exe
  2⤵
  PID:1996
- C:\Windows\System\NREdAyE.exe
  C:\Windows\System\NREdAyE.exe
  2⤵
  PID:1976
- C:\Windows\System\EfKvmve.exe
  C:\Windows\System\EfKvmve.exe
  2⤵
  PID:2020
- C:\Windows\System\aMYATyg.exe
  C:\Windows\System\aMYATyg.exe
  2⤵
  PID:2068
- C:\Windows\System\fckvvfg.exe
  C:\Windows\System\fckvvfg.exe
  2⤵
  PID:2372
- C:\Windows\System\xqAdAKI.exe
  C:\Windows\System\xqAdAKI.exe
  2⤵
  PID:1512
- C:\Windows\System\fGFlWrm.exe
  C:\Windows\System\fGFlWrm.exe
  2⤵
  PID:2612
- C:\Windows\System\sZmoGLc.exe
  C:\Windows\System\sZmoGLc.exe
  2⤵
  PID:2096
- C:\Windows\System\sQhaEBT.exe
  C:\Windows\System\sQhaEBT.exe
  2⤵
  PID:1600
- C:\Windows\System\SgvLchM.exe
  C:\Windows\System\SgvLchM.exe
  2⤵
  PID:2432
- C:\Windows\System\wUJESbk.exe
  C:\Windows\System\wUJESbk.exe
  2⤵
  PID:2188
- C:\Windows\System\ZNAuojR.exe
  C:\Windows\System\ZNAuojR.exe
  2⤵
  PID:2932
- C:\Windows\System\bOihqix.exe
  C:\Windows\System\bOihqix.exe
  2⤵
  PID:2836
- C:\Windows\System\uppLdRL.exe
  C:\Windows\System\uppLdRL.exe
  2⤵
  PID:2888
- C:\Windows\System\DnERXaG.exe
  C:\Windows\System\DnERXaG.exe
  2⤵
  PID:2444
- C:\Windows\System\blfXEgF.exe
  C:\Windows\System\blfXEgF.exe
  2⤵
  PID:1752
- C:\Windows\System\hDromrd.exe
  C:\Windows\System\hDromrd.exe
  2⤵
  PID:1916
- C:\Windows\System\BmBqgfJ.exe
  C:\Windows\System\BmBqgfJ.exe
  2⤵
  PID:1036
- C:\Windows\System\wSGiZaM.exe
  C:\Windows\System\wSGiZaM.exe
  2⤵
  PID:1496
- C:\Windows\System\IRqHOhG.exe
  C:\Windows\System\IRqHOhG.exe
  2⤵
  PID:1988
- C:\Windows\System\pErGtfQ.exe
  C:\Windows\System\pErGtfQ.exe
  2⤵
  PID:1932
- C:\Windows\System\kgNigXd.exe
  C:\Windows\System\kgNigXd.exe
  2⤵
  PID:2324
- C:\Windows\System\mZnKEhL.exe
  C:\Windows\System\mZnKEhL.exe
  2⤵
  PID:708
- C:\Windows\System\DizygMP.exe
  C:\Windows\System\DizygMP.exe
  2⤵
  PID:2076
- C:\Windows\System\BxFENpW.exe
  C:\Windows\System\BxFENpW.exe
  2⤵
  PID:2404
- C:\Windows\System\brAXjxg.exe
  C:\Windows\System\brAXjxg.exe
  2⤵
  PID:1948
- C:\Windows\System\asmfBXp.exe
  C:\Windows\System\asmfBXp.exe
  2⤵
  PID:2692
- C:\Windows\System\foQebxM.exe
  C:\Windows\System\foQebxM.exe
  2⤵
  PID:848
- C:\Windows\System\iPjXapE.exe
  C:\Windows\System\iPjXapE.exe
  2⤵
  PID:1592
- C:\Windows\System\WclTxCG.exe
  C:\Windows\System\WclTxCG.exe
  2⤵
  PID:2488
- C:\Windows\System\WMrouUy.exe
  C:\Windows\System\WMrouUy.exe
  2⤵
  PID:2568
- C:\Windows\System\MOHMaEX.exe
  C:\Windows\System\MOHMaEX.exe
  2⤵
  PID:2072
- C:\Windows\System\FhGfiDG.exe
  C:\Windows\System\FhGfiDG.exe
  2⤵
  PID:2764
- C:\Windows\System\CKJMPME.exe
  C:\Windows\System\CKJMPME.exe
  2⤵
  PID:2540
- C:\Windows\System\BTQMyTp.exe
  C:\Windows\System\BTQMyTp.exe
  2⤵
  PID:2668
- C:\Windows\System\ZBukduI.exe
  C:\Windows\System\ZBukduI.exe
  2⤵
  PID:2196
- C:\Windows\System\cMtaFsk.exe
  C:\Windows\System\cMtaFsk.exe
  2⤵
  PID:1488
- C:\Windows\System\ulvyvkw.exe
  C:\Windows\System\ulvyvkw.exe
  2⤵
  PID:2312
- C:\Windows\System\HtpUtvr.exe
  C:\Windows\System\HtpUtvr.exe
  2⤵
  PID:1332
- C:\Windows\System\KPTCUIL.exe
  C:\Windows\System\KPTCUIL.exe
  2⤵
  PID:1628
- C:\Windows\System\NjSGHnN.exe
  C:\Windows\System\NjSGHnN.exe
  2⤵
  PID:896
- C:\Windows\System\SaXAOHV.exe
  C:\Windows\System\SaXAOHV.exe
  2⤵
  PID:2640
- C:\Windows\System\vvcZNPP.exe
  C:\Windows\System\vvcZNPP.exe
  2⤵
  PID:2880
- C:\Windows\System\gSXlwLG.exe
  C:\Windows\System\gSXlwLG.exe
  2⤵
  PID:2548
- C:\Windows\System\BWZkLoO.exe
  C:\Windows\System\BWZkLoO.exe
  2⤵
  PID:1516
- C:\Windows\System\PUuvCMQ.exe
  C:\Windows\System\PUuvCMQ.exe
  2⤵
  PID:2244
- C:\Windows\System\Xqxhltk.exe
  C:\Windows\System\Xqxhltk.exe
  2⤵
  PID:2688
- C:\Windows\System\UcKhAoR.exe
  C:\Windows\System\UcKhAoR.exe
  2⤵
  PID:2008
- C:\Windows\System\jUpYZaH.exe
  C:\Windows\System\jUpYZaH.exe
  2⤵
  PID:3092
- C:\Windows\System\lDYtFXB.exe
  C:\Windows\System\lDYtFXB.exe
  2⤵
  PID:3108
- C:\Windows\System\CwCEKKr.exe
  C:\Windows\System\CwCEKKr.exe
  2⤵
  PID:3124
- C:\Windows\System\qnkDpQk.exe
  C:\Windows\System\qnkDpQk.exe
  2⤵
  PID:3140
- C:\Windows\System\CfCsXeM.exe
  C:\Windows\System\CfCsXeM.exe
  2⤵
  PID:3156
- C:\Windows\System\AGRBmTg.exe
  C:\Windows\System\AGRBmTg.exe
  2⤵
  PID:3172
- C:\Windows\System\tLedeHZ.exe
  C:\Windows\System\tLedeHZ.exe
  2⤵
  PID:3188
- C:\Windows\System\LzArwXY.exe
  C:\Windows\System\LzArwXY.exe
  2⤵
  PID:3204
- C:\Windows\System\lgqJkGx.exe
  C:\Windows\System\lgqJkGx.exe
  2⤵
  PID:3220
- C:\Windows\System\MTIctAq.exe
  C:\Windows\System\MTIctAq.exe
  2⤵
  PID:3236
- C:\Windows\System\jtBBHkW.exe
  C:\Windows\System\jtBBHkW.exe
  2⤵
  PID:3260
- C:\Windows\System\vYDcdis.exe
  C:\Windows\System\vYDcdis.exe
  2⤵
  PID:3372
- C:\Windows\System\sdAwAox.exe
  C:\Windows\System\sdAwAox.exe
  2⤵
  PID:3388
- C:\Windows\System\GeHmBzR.exe
  C:\Windows\System\GeHmBzR.exe
  2⤵
  PID:3404
- C:\Windows\System\lnKiXHu.exe
  C:\Windows\System\lnKiXHu.exe
  2⤵
  PID:3420
- C:\Windows\System\Ocrgaff.exe
  C:\Windows\System\Ocrgaff.exe
  2⤵
  PID:3436
- C:\Windows\System\OCRFsWt.exe
  C:\Windows\System\OCRFsWt.exe
  2⤵
  PID:3452
- C:\Windows\System\ZFpKrdc.exe
  C:\Windows\System\ZFpKrdc.exe
  2⤵
  PID:3468
- C:\Windows\System\vFZajXs.exe
  C:\Windows\System\vFZajXs.exe
  2⤵
  PID:3484
- C:\Windows\System\MIgvKJF.exe
  C:\Windows\System\MIgvKJF.exe
  2⤵
  PID:3500
- C:\Windows\System\ylbwcjR.exe
  C:\Windows\System\ylbwcjR.exe
  2⤵
  PID:3516
- C:\Windows\System\pMUKgYp.exe
  C:\Windows\System\pMUKgYp.exe
  2⤵
  PID:3532
- C:\Windows\System\sVIOdmM.exe
  C:\Windows\System\sVIOdmM.exe
  2⤵
  PID:3548
- C:\Windows\System\YIoycvy.exe
  C:\Windows\System\YIoycvy.exe
  2⤵
  PID:3564
- C:\Windows\System\PHMUzBD.exe
  C:\Windows\System\PHMUzBD.exe
  2⤵
  PID:3580
- C:\Windows\System\qoynMzk.exe
  C:\Windows\System\qoynMzk.exe
  2⤵
  PID:3596
- C:\Windows\System\BBBCVAd.exe
  C:\Windows\System\BBBCVAd.exe
  2⤵
  PID:3612
- C:\Windows\System\emKgrTF.exe
  C:\Windows\System\emKgrTF.exe
  2⤵
  PID:3628
- C:\Windows\System\WXhnvRt.exe
  C:\Windows\System\WXhnvRt.exe
  2⤵
  PID:3644
- C:\Windows\System\UlXbYcl.exe
  C:\Windows\System\UlXbYcl.exe
  2⤵
  PID:3660
- C:\Windows\System\rVoHtTn.exe
  C:\Windows\System\rVoHtTn.exe
  2⤵
  PID:3680
- C:\Windows\System\gGBZCiO.exe
  C:\Windows\System\gGBZCiO.exe
  2⤵
  PID:3696
- C:\Windows\System\ayftbSz.exe
  C:\Windows\System\ayftbSz.exe
  2⤵
  PID:3716
- C:\Windows\System\tHBRjRA.exe
  C:\Windows\System\tHBRjRA.exe
  2⤵
  PID:3848
- C:\Windows\System\XOoBiGp.exe
  C:\Windows\System\XOoBiGp.exe
  2⤵
  PID:3868
- C:\Windows\System\PAYqDpN.exe
  C:\Windows\System\PAYqDpN.exe
  2⤵
  PID:3884
- C:\Windows\System\Ohsadiz.exe
  C:\Windows\System\Ohsadiz.exe
  2⤵
  PID:3900
- C:\Windows\System\oxIUtzq.exe
  C:\Windows\System\oxIUtzq.exe
  2⤵
  PID:3920
- C:\Windows\System\cAeibfZ.exe
  C:\Windows\System\cAeibfZ.exe
  2⤵
  PID:3936
- C:\Windows\System\ZkqCLeX.exe
  C:\Windows\System\ZkqCLeX.exe
  2⤵
  PID:3952
- C:\Windows\System\xLtHSFD.exe
  C:\Windows\System\xLtHSFD.exe
  2⤵
  PID:3968
- C:\Windows\System\SutYKVy.exe
  C:\Windows\System\SutYKVy.exe
  2⤵
  PID:3984
- C:\Windows\System\WxMcrQx.exe
  C:\Windows\System\WxMcrQx.exe
  2⤵
  PID:4000
- C:\Windows\System\DRcGmGz.exe
  C:\Windows\System\DRcGmGz.exe
  2⤵
  PID:4020
- C:\Windows\System\neYOXQj.exe
  C:\Windows\System\neYOXQj.exe
  2⤵
  PID:4036
- C:\Windows\System\AJiHNZn.exe
  C:\Windows\System\AJiHNZn.exe
  2⤵
  PID:4052
- C:\Windows\System\FZqUPbW.exe
  C:\Windows\System\FZqUPbW.exe
  2⤵
  PID:4072
- C:\Windows\System\HYXdnBW.exe
  C:\Windows\System\HYXdnBW.exe
  2⤵
  PID:4092
- C:\Windows\System\aPXODcf.exe
  C:\Windows\System\aPXODcf.exe
  2⤵
  PID:1000
- C:\Windows\System\URuYhDt.exe
  C:\Windows\System\URuYhDt.exe
  2⤵
  PID:2456
- C:\Windows\System\dHaRhlH.exe
  C:\Windows\System\dHaRhlH.exe
  2⤵
  PID:892
- C:\Windows\System\QpHFPUK.exe
  C:\Windows\System\QpHFPUK.exe
  2⤵
  PID:3148
- C:\Windows\System\JFyEKkc.exe
  C:\Windows\System\JFyEKkc.exe
  2⤵
  PID:3212
- C:\Windows\System\YfFTGCL.exe
  C:\Windows\System\YfFTGCL.exe
  2⤵
  PID:3252
- C:\Windows\System\abwwayy.exe
  C:\Windows\System\abwwayy.exe
  2⤵
  PID:2808
- C:\Windows\System\zbVmUPu.exe
  C:\Windows\System\zbVmUPu.exe
  2⤵
  PID:2660
- C:\Windows\System\JVKvRyF.exe
  C:\Windows\System\JVKvRyF.exe
  2⤵
  PID:3104
- C:\Windows\System\KSIlinM.exe
  C:\Windows\System\KSIlinM.exe
  2⤵
  PID:3196
- C:\Windows\System\mbqTNZP.exe
  C:\Windows\System\mbqTNZP.exe
  2⤵
  PID:3268
- C:\Windows\System\JsPQMEy.exe
  C:\Windows\System\JsPQMEy.exe
  2⤵
  PID:3336
- C:\Windows\System\UgTtTuu.exe
  C:\Windows\System\UgTtTuu.exe
  2⤵
  PID:3364
- C:\Windows\System\fBUZLpm.exe
  C:\Windows\System\fBUZLpm.exe
  2⤵
  PID:3380
- C:\Windows\System\UADAUsB.exe
  C:\Windows\System\UADAUsB.exe
  2⤵
  PID:3400
- C:\Windows\System\AZVSuPQ.exe
  C:\Windows\System\AZVSuPQ.exe
  2⤵
  PID:3444
- C:\Windows\System\cvGPgCN.exe
  C:\Windows\System\cvGPgCN.exe
  2⤵
  PID:3508
- C:\Windows\System\LusEgZW.exe
  C:\Windows\System\LusEgZW.exe
  2⤵
  PID:3540
- C:\Windows\System\FhflxZN.exe
  C:\Windows\System\FhflxZN.exe
  2⤵
  PID:3572
- C:\Windows\System\nYiWVAg.exe
  C:\Windows\System\nYiWVAg.exe
  2⤵
  PID:1980
- C:\Windows\System\hgMlPCG.exe
  C:\Windows\System\hgMlPCG.exe
  2⤵
  PID:3640
- C:\Windows\System\fSirTbz.exe
  C:\Windows\System\fSirTbz.exe
  2⤵
  PID:3652
- C:\Windows\System\ZFpEABk.exe
  C:\Windows\System\ZFpEABk.exe
  2⤵
  PID:3748
- C:\Windows\System\KzSkRQY.exe
  C:\Windows\System\KzSkRQY.exe
  2⤵
  PID:3676
- C:\Windows\System\MYWLcSj.exe
  C:\Windows\System\MYWLcSj.exe
  2⤵
  PID:3656
- C:\Windows\System\zfnWJuE.exe
  C:\Windows\System\zfnWJuE.exe
  2⤵
  PID:3732
- C:\Windows\System\WFwitRE.exe
  C:\Windows\System\WFwitRE.exe
  2⤵
  PID:3796
- C:\Windows\System\TeVNsYe.exe
  C:\Windows\System\TeVNsYe.exe
  2⤵
  PID:3016
- C:\Windows\System\PixFPWk.exe
  C:\Windows\System\PixFPWk.exe
  2⤵
  PID:3808
- C:\Windows\System\dZUAWNP.exe
  C:\Windows\System\dZUAWNP.exe
  2⤵
  PID:3832
- C:\Windows\System\URbLaUN.exe
  C:\Windows\System\URbLaUN.exe
  2⤵
  PID:3728
- C:\Windows\System\gaZJfkc.exe
  C:\Windows\System\gaZJfkc.exe
  2⤵
  PID:1952
- C:\Windows\System\GVttyUN.exe
  C:\Windows\System\GVttyUN.exe
  2⤵
  PID:1620
- C:\Windows\System\cjvZooi.exe
  C:\Windows\System\cjvZooi.exe
  2⤵
  PID:3864
- C:\Windows\System\QPDtsgW.exe
  C:\Windows\System\QPDtsgW.exe
  2⤵
  PID:3916
- C:\Windows\System\ZSNvyQg.exe
  C:\Windows\System\ZSNvyQg.exe
  2⤵
  PID:3996
- C:\Windows\System\mdpyJwz.exe
  C:\Windows\System\mdpyJwz.exe
  2⤵
  PID:4060
- C:\Windows\System\iuiTLHu.exe
  C:\Windows\System\iuiTLHu.exe
  2⤵
  PID:1764
- C:\Windows\System\pGIFlld.exe
  C:\Windows\System\pGIFlld.exe
  2⤵
  PID:2784
- C:\Windows\System\ulBPZsd.exe
  C:\Windows\System\ulBPZsd.exe
  2⤵
  PID:4012
- C:\Windows\System\loHxvDw.exe
  C:\Windows\System\loHxvDw.exe
  2⤵
  PID:2756
- C:\Windows\System\StKVJhH.exe
  C:\Windows\System\StKVJhH.exe
  2⤵
  PID:2700
- C:\Windows\System\HgkkkCA.exe
  C:\Windows\System\HgkkkCA.exe
  2⤵
  PID:2464
- C:\Windows\System\uZlRgVE.exe
  C:\Windows\System\uZlRgVE.exe
  2⤵
  PID:3088
- C:\Windows\System\pLrCciB.exe
  C:\Windows\System\pLrCciB.exe
  2⤵
  PID:2300
- C:\Windows\System\xgRbTUf.exe
  C:\Windows\System\xgRbTUf.exe
  2⤵
  PID:3228
- C:\Windows\System\InhQcHb.exe
  C:\Windows\System\InhQcHb.exe
  2⤵
  PID:3136
- C:\Windows\System\iPuWgdb.exe
  C:\Windows\System\iPuWgdb.exe
  2⤵
  PID:3280
- C:\Windows\System\vLXhzHU.exe
  C:\Windows\System\vLXhzHU.exe
  2⤵
  PID:2460
- C:\Windows\System\YBOXEKa.exe
  C:\Windows\System\YBOXEKa.exe
  2⤵
  PID:3288
- C:\Windows\System\zhkIDra.exe
  C:\Windows\System\zhkIDra.exe
  2⤵
  PID:1384
- C:\Windows\System\isDPCIm.exe
  C:\Windows\System\isDPCIm.exe
  2⤵
  PID:3412
- C:\Windows\System\UeQzxiP.exe
  C:\Windows\System\UeQzxiP.exe
  2⤵
  PID:3464
- C:\Windows\System\StmaRzD.exe
  C:\Windows\System\StmaRzD.exe
  2⤵
  PID:2468
- C:\Windows\System\BltfwJO.exe
  C:\Windows\System\BltfwJO.exe
  2⤵
  PID:3544
- C:\Windows\System\BmzaiFz.exe
  C:\Windows\System\BmzaiFz.exe
  2⤵
  PID:3588
- C:\Windows\System\pJCoVxu.exe
  C:\Windows\System\pJCoVxu.exe
  2⤵
  PID:3736
- C:\Windows\System\VuzMecE.exe
  C:\Windows\System\VuzMecE.exe
  2⤵
  PID:3760
- C:\Windows\System\PtpphdN.exe
  C:\Windows\System\PtpphdN.exe
  2⤵
  PID:3784
- C:\Windows\System\yrxQWKt.exe
  C:\Windows\System\yrxQWKt.exe
  2⤵
  PID:3672
- C:\Windows\System\zwVZYly.exe
  C:\Windows\System\zwVZYly.exe
  2⤵
  PID:4028
- C:\Windows\System\QSyfjdZ.exe
  C:\Windows\System\QSyfjdZ.exe
  2⤵
  PID:4044
- C:\Windows\System\MzxyuyJ.exe
  C:\Windows\System\MzxyuyJ.exe
  2⤵
  PID:3876
- C:\Windows\System\AqVBIQl.exe
  C:\Windows\System\AqVBIQl.exe
  2⤵
  PID:4068
- C:\Windows\System\SPhbeni.exe
  C:\Windows\System\SPhbeni.exe
  2⤵
  PID:2288
- C:\Windows\System\aVgukZN.exe
  C:\Windows\System\aVgukZN.exe
  2⤵
  PID:3084
- C:\Windows\System\aiDeXRJ.exe
  C:\Windows\System\aiDeXRJ.exe
  2⤵
  PID:2608
- C:\Windows\System\KdQpLCz.exe
  C:\Windows\System\KdQpLCz.exe
  2⤵
  PID:1136
- C:\Windows\System\okxBuGU.exe
  C:\Windows\System\okxBuGU.exe
  2⤵
  PID:3792
- C:\Windows\System\sYMtxmj.exe
  C:\Windows\System\sYMtxmj.exe
  2⤵
  PID:3592
- C:\Windows\System\xGVKZUB.exe
  C:\Windows\System\xGVKZUB.exe
  2⤵
  PID:3964
- C:\Windows\System\uXFuDOF.exe
  C:\Windows\System\uXFuDOF.exe
  2⤵
  PID:1876
- C:\Windows\System\qouSwII.exe
  C:\Windows\System\qouSwII.exe
  2⤵
  PID:3840
- C:\Windows\System\OAOIgFy.exe
  C:\Windows\System\OAOIgFy.exe
  2⤵
  PID:3168
- C:\Windows\System\cuauooP.exe
  C:\Windows\System\cuauooP.exe
  2⤵
  PID:3416
- C:\Windows\System\ekIOuAs.exe
  C:\Windows\System\ekIOuAs.exe
  2⤵
  PID:1152
- C:\Windows\System\ZCQOddq.exe
  C:\Windows\System\ZCQOddq.exe
  2⤵
  PID:3708
- C:\Windows\System\UGhTool.exe
  C:\Windows\System\UGhTool.exe
  2⤵
  PID:2172
- C:\Windows\System\MTXOZWJ.exe
  C:\Windows\System\MTXOZWJ.exe
  2⤵
  PID:1268
- C:\Windows\System\ytgAzWk.exe
  C:\Windows\System\ytgAzWk.exe
  2⤵
  PID:3800
- C:\Windows\System\JtFnoNI.exe
  C:\Windows\System\JtFnoNI.exe
  2⤵
  PID:3496
- C:\Windows\System\wyZgMOl.exe
  C:\Windows\System\wyZgMOl.exe
  2⤵
  PID:3120
- C:\Windows\System\KazCUtu.exe
  C:\Windows\System\KazCUtu.exe
  2⤵
  PID:3248
- C:\Windows\System\YntuXSG.exe
  C:\Windows\System\YntuXSG.exe
  2⤵
  PID:3668
- C:\Windows\System\WZVNTDU.exe
  C:\Windows\System\WZVNTDU.exe
  2⤵
  PID:3824
- C:\Windows\System\rmZtHAH.exe
  C:\Windows\System\rmZtHAH.exe
  2⤵
  PID:3712
- C:\Windows\System\XUYQPyi.exe
  C:\Windows\System\XUYQPyi.exe
  2⤵
  PID:632
- C:\Windows\System\SCLKimg.exe
  C:\Windows\System\SCLKimg.exe
  2⤵
  PID:2872
- C:\Windows\System\iOzbhNU.exe
  C:\Windows\System\iOzbhNU.exe
  2⤵
  PID:2156
- C:\Windows\System\pAUqiHh.exe
  C:\Windows\System\pAUqiHh.exe
  2⤵
  PID:1352
- C:\Windows\System\ChHPvMj.exe
  C:\Windows\System\ChHPvMj.exe
  2⤵
  PID:3776
- C:\Windows\System\CEIVxKz.exe
  C:\Windows\System\CEIVxKz.exe
  2⤵
  PID:796
- C:\Windows\System\LtwuyKD.exe
  C:\Windows\System\LtwuyKD.exe
  2⤵
  PID:2904
- C:\Windows\System\OUbpjot.exe
  C:\Windows\System\OUbpjot.exe
  2⤵
  PID:3244
- C:\Windows\System\zEkexsv.exe
  C:\Windows\System\zEkexsv.exe
  2⤵
  PID:3460
- C:\Windows\System\kTJlUna.exe
  C:\Windows\System\kTJlUna.exe
  2⤵
  PID:1644
- C:\Windows\System\NxFHyZz.exe
  C:\Windows\System\NxFHyZz.exe
  2⤵
  PID:2388
- C:\Windows\System\wVFTuKo.exe
  C:\Windows\System\wVFTuKo.exe
  2⤵
  PID:3636
- C:\Windows\System\OHzAgKx.exe
  C:\Windows\System\OHzAgKx.exe
  2⤵
  PID:3064
- C:\Windows\System\ZNDqZFK.exe
  C:\Windows\System\ZNDqZFK.exe
  2⤵
  PID:4088
- C:\Windows\System\PouTJKm.exe
  C:\Windows\System\PouTJKm.exe
  2⤵
  PID:2704
- C:\Windows\System\kqXgank.exe
  C:\Windows\System\kqXgank.exe
  2⤵
  PID:3980
- C:\Windows\System\KrxeDPp.exe
  C:\Windows\System\KrxeDPp.exe
  2⤵
  PID:2220
- C:\Windows\System\WeBpySV.exe
  C:\Windows\System\WeBpySV.exe
  2⤵
  PID:3528
- C:\Windows\System\XpUrxpR.exe
  C:\Windows\System\XpUrxpR.exe
  2⤵
  PID:3620
- C:\Windows\System\CTSFsxc.exe
  C:\Windows\System\CTSFsxc.exe
  2⤵
  PID:2800
- C:\Windows\System\gDOfPOy.exe
  C:\Windows\System\gDOfPOy.exe
  2⤵
  PID:2720
- C:\Windows\System\TxUMWLO.exe
  C:\Windows\System\TxUMWLO.exe
  2⤵
  PID:3356
- C:\Windows\System\DqHlNzd.exe
  C:\Windows\System\DqHlNzd.exe
  2⤵
  PID:3512
- C:\Windows\System\HqRPuRn.exe
  C:\Windows\System\HqRPuRn.exe
  2⤵
  PID:4116
- C:\Windows\System\cXbGWPu.exe
  C:\Windows\System\cXbGWPu.exe
  2⤵
  PID:4132
- C:\Windows\System\fGuMVhZ.exe
  C:\Windows\System\fGuMVhZ.exe
  2⤵
  PID:4148
- C:\Windows\System\sQkCvov.exe
  C:\Windows\System\sQkCvov.exe
  2⤵
  PID:4168
- C:\Windows\System\vMXnfzb.exe
  C:\Windows\System\vMXnfzb.exe
  2⤵
  PID:4184
- C:\Windows\System\QnjDTip.exe
  C:\Windows\System\QnjDTip.exe
  2⤵
  PID:4200
- C:\Windows\System\tpSSvSt.exe
  C:\Windows\System\tpSSvSt.exe
  2⤵
  PID:4216
- C:\Windows\System\EJiYAAs.exe
  C:\Windows\System\EJiYAAs.exe
  2⤵
  PID:4232
- C:\Windows\System\tcnlMgF.exe
  C:\Windows\System\tcnlMgF.exe
  2⤵
  PID:4252
- C:\Windows\System\dnhbuqd.exe
  C:\Windows\System\dnhbuqd.exe
  2⤵
  PID:4280
- C:\Windows\System\KbUGles.exe
  C:\Windows\System\KbUGles.exe
  2⤵
  PID:4348
- C:\Windows\System\VtjjdPs.exe
  C:\Windows\System\VtjjdPs.exe
  2⤵
  PID:4364
- C:\Windows\System\vzxdUyg.exe
  C:\Windows\System\vzxdUyg.exe
  2⤵
  PID:4384
- C:\Windows\System\ixRTHIO.exe
  C:\Windows\System\ixRTHIO.exe
  2⤵
  PID:4404
- C:\Windows\System\iCjwkpt.exe
  C:\Windows\System\iCjwkpt.exe
  2⤵
  PID:4420
- C:\Windows\System\vBXIJTB.exe
  C:\Windows\System\vBXIJTB.exe
  2⤵
  PID:4436
- C:\Windows\System\qyFjGab.exe
  C:\Windows\System\qyFjGab.exe
  2⤵
  PID:4452
- C:\Windows\System\DKVSjbr.exe
  C:\Windows\System\DKVSjbr.exe
  2⤵
  PID:4472
- C:\Windows\System\rivKori.exe
  C:\Windows\System\rivKori.exe
  2⤵
  PID:4488
- C:\Windows\System\poAeWiU.exe
  C:\Windows\System\poAeWiU.exe
  2⤵
  PID:4504
- C:\Windows\System\rzHzJSz.exe
  C:\Windows\System\rzHzJSz.exe
  2⤵
  PID:4524
- C:\Windows\System\KovDmNJ.exe
  C:\Windows\System\KovDmNJ.exe
  2⤵
  PID:4548
- C:\Windows\System\dGHXoLe.exe
  C:\Windows\System\dGHXoLe.exe
  2⤵
  PID:4588
- C:\Windows\System\wzPPKdN.exe
  C:\Windows\System\wzPPKdN.exe
  2⤵
  PID:4608
- C:\Windows\System\mwLKULb.exe
  C:\Windows\System\mwLKULb.exe
  2⤵
  PID:4624
- C:\Windows\System\TeiiSGe.exe
  C:\Windows\System\TeiiSGe.exe
  2⤵
  PID:4640
- C:\Windows\System\nFUeRvN.exe
  C:\Windows\System\nFUeRvN.exe
  2⤵
  PID:4656
- C:\Windows\System\dcOcwRa.exe
  C:\Windows\System\dcOcwRa.exe
  2⤵
  PID:4676
- C:\Windows\System\BOBZIDe.exe
  C:\Windows\System\BOBZIDe.exe
  2⤵
  PID:4692
- C:\Windows\System\bRZcSIQ.exe
  C:\Windows\System\bRZcSIQ.exe
  2⤵
  PID:4708
- C:\Windows\System\eEOWhDN.exe
  C:\Windows\System\eEOWhDN.exe
  2⤵
  PID:4724
- C:\Windows\System\bKUXgdr.exe
  C:\Windows\System\bKUXgdr.exe
  2⤵
  PID:4740
- C:\Windows\System\PeVpkXR.exe
  C:\Windows\System\PeVpkXR.exe
  2⤵
  PID:4760
- C:\Windows\System\TgPCzDv.exe
  C:\Windows\System\TgPCzDv.exe
  2⤵
  PID:4784
- C:\Windows\System\tEMiNDM.exe
  C:\Windows\System\tEMiNDM.exe
  2⤵
  PID:4800
- C:\Windows\System\ZzoaacH.exe
  C:\Windows\System\ZzoaacH.exe
  2⤵
  PID:4828
- C:\Windows\System\FofkpiL.exe
  C:\Windows\System\FofkpiL.exe
  2⤵
  PID:4856
- C:\Windows\System\paRzyqp.exe
  C:\Windows\System\paRzyqp.exe
  2⤵
  PID:4896
- C:\Windows\System\gyxweMf.exe
  C:\Windows\System\gyxweMf.exe
  2⤵
  PID:4916
- C:\Windows\System\VApaGFj.exe
  C:\Windows\System\VApaGFj.exe
  2⤵
  PID:4932
- C:\Windows\System\BdTMuKr.exe
  C:\Windows\System\BdTMuKr.exe
  2⤵
  PID:4956
- C:\Windows\System\Opgfgjv.exe
  C:\Windows\System\Opgfgjv.exe
  2⤵
  PID:4976
- C:\Windows\System\kIiILFR.exe
  C:\Windows\System\kIiILFR.exe
  2⤵
  PID:4992
- C:\Windows\System\kAdRMfD.exe
  C:\Windows\System\kAdRMfD.exe
  2⤵
  PID:5008
- C:\Windows\System\rNEZBqU.exe
  C:\Windows\System\rNEZBqU.exe
  2⤵
  PID:5028
- C:\Windows\System\zUHgEHe.exe
  C:\Windows\System\zUHgEHe.exe
  2⤵
  PID:5052
- C:\Windows\System\xcsSjPv.exe
  C:\Windows\System\xcsSjPv.exe
  2⤵
  PID:5072
- C:\Windows\System\dzWzYGD.exe
  C:\Windows\System\dzWzYGD.exe
  2⤵
  PID:5088
- C:\Windows\System\IpJMbQo.exe
  C:\Windows\System\IpJMbQo.exe
  2⤵
  PID:5104
- C:\Windows\System\lbGDfTg.exe
  C:\Windows\System\lbGDfTg.exe
  2⤵
  PID:3976
- C:\Windows\System\drniEnZ.exe
  C:\Windows\System\drniEnZ.exe
  2⤵
  PID:4260
- C:\Windows\System\pfqnfpc.exe
  C:\Windows\System\pfqnfpc.exe
  2⤵
  PID:3284
- C:\Windows\System\jJsGWnv.exe
  C:\Windows\System\jJsGWnv.exe
  2⤵
  PID:3004
- C:\Windows\System\yvKLUOt.exe
  C:\Windows\System\yvKLUOt.exe
  2⤵
  PID:4140
- C:\Windows\System\VhazFuH.exe
  C:\Windows\System\VhazFuH.exe
  2⤵
  PID:1456
- C:\Windows\System\WGJRBKd.exe
  C:\Windows\System\WGJRBKd.exe
  2⤵
  PID:4144
- C:\Windows\System\RijqYNX.exe
  C:\Windows\System\RijqYNX.exe
  2⤵
  PID:4292
- C:\Windows\System\emfmGsf.exe
  C:\Windows\System\emfmGsf.exe
  2⤵
  PID:4304
- C:\Windows\System\UTbfqqZ.exe
  C:\Windows\System\UTbfqqZ.exe
  2⤵
  PID:4328
- C:\Windows\System\FQRsJyw.exe
  C:\Windows\System\FQRsJyw.exe
  2⤵
  PID:4336
- C:\Windows\System\xuHnEhI.exe
  C:\Windows\System\xuHnEhI.exe
  2⤵
  PID:4392
- C:\Windows\System\uwnddLm.exe
  C:\Windows\System\uwnddLm.exe
  2⤵
  PID:2148
- C:\Windows\System\eVQZysO.exe
  C:\Windows\System\eVQZysO.exe
  2⤵
  PID:108
- C:\Windows\System\mcKoZyi.exe
  C:\Windows\System\mcKoZyi.exe
  2⤵
  PID:4480
- C:\Windows\System\jsUbETP.exe
  C:\Windows\System\jsUbETP.exe
  2⤵
  PID:4484
- C:\Windows\System\TxtjNOD.exe
  C:\Windows\System\TxtjNOD.exe
  2⤵
  PID:4556
- C:\Windows\System\oBoGCHg.exe
  C:\Windows\System\oBoGCHg.exe
  2⤵
  PID:4584
- C:\Windows\System\IftyewB.exe
  C:\Windows\System\IftyewB.exe
  2⤵
  PID:4632
- C:\Windows\System\eUZpPnr.exe
  C:\Windows\System\eUZpPnr.exe
  2⤵
  PID:4700
- C:\Windows\System\MBcKrqj.exe
  C:\Windows\System\MBcKrqj.exe
  2⤵
  PID:4736
- C:\Windows\System\bLpTtAs.exe
  C:\Windows\System\bLpTtAs.exe
  2⤵
  PID:4648
- C:\Windows\System\eMLlzTG.exe
  C:\Windows\System\eMLlzTG.exe
  2⤵
  PID:4716
- C:\Windows\System\dzGrgvM.exe
  C:\Windows\System\dzGrgvM.exe
  2⤵
  PID:4688
- C:\Windows\System\hyCpGGP.exe
  C:\Windows\System\hyCpGGP.exe
  2⤵
  PID:4796
- C:\Windows\System\JfCGvzl.exe
  C:\Windows\System\JfCGvzl.exe
  2⤵
  PID:4824
- C:\Windows\System\hLFczlV.exe
  C:\Windows\System\hLFczlV.exe
  2⤵
  PID:4864
- C:\Windows\System\xGYRQve.exe
  C:\Windows\System\xGYRQve.exe
  2⤵
  PID:4868
- C:\Windows\System\mjjUYon.exe
  C:\Windows\System\mjjUYon.exe
  2⤵
  PID:4320
- C:\Windows\System\EGpyzss.exe
  C:\Windows\System\EGpyzss.exe
  2⤵
  PID:2884
- C:\Windows\System\WNFjVKO.exe
  C:\Windows\System\WNFjVKO.exe
  2⤵
  PID:4924
- C:\Windows\System\dpDfsRb.exe
  C:\Windows\System\dpDfsRb.exe
  2⤵
  PID:4952
- C:\Windows\System\mnRZBTb.exe
  C:\Windows\System\mnRZBTb.exe
  2⤵
  PID:4972
- C:\Windows\System\DhTfQAn.exe
  C:\Windows\System\DhTfQAn.exe
  2⤵
  PID:5020
- C:\Windows\System\kmYfMnw.exe
  C:\Windows\System\kmYfMnw.exe
  2⤵
  PID:5048
- C:\Windows\System\PRmCMro.exe
  C:\Windows\System\PRmCMro.exe
  2⤵
  PID:1224
- C:\Windows\System\CFZkTLB.exe
  C:\Windows\System\CFZkTLB.exe
  2⤵
  PID:4888
- C:\Windows\System\vpRPTYk.exe
  C:\Windows\System\vpRPTYk.exe
  2⤵
  PID:2936
- C:\Windows\System\qkIhWRP.exe
  C:\Windows\System\qkIhWRP.exe
  2⤵
  PID:4272
- C:\Windows\System\lHcPCBc.exe
  C:\Windows\System\lHcPCBc.exe
  2⤵
  PID:4312
- C:\Windows\System\NDYJYOF.exe
  C:\Windows\System\NDYJYOF.exe
  2⤵
  PID:4444
- C:\Windows\System\hblevlO.exe
  C:\Windows\System\hblevlO.exe
  2⤵
  PID:4544
- C:\Windows\System\pqrUTKH.exe
  C:\Windows\System\pqrUTKH.exe
  2⤵
  PID:4576
- C:\Windows\System\ImkEVJV.exe
  C:\Windows\System\ImkEVJV.exe
  2⤵
  PID:4732
- C:\Windows\System\cubmkdG.exe
  C:\Windows\System\cubmkdG.exe
  2⤵
  PID:4940
- C:\Windows\System\RdoUppo.exe
  C:\Windows\System\RdoUppo.exe
  2⤵
  PID:4852
- C:\Windows\System\rSCkiLI.exe
  C:\Windows\System\rSCkiLI.exe
  2⤵
  PID:4772
- C:\Windows\System\XsfXocZ.exe
  C:\Windows\System\XsfXocZ.exe
  2⤵
  PID:4560
- C:\Windows\System\nOzIPDX.exe
  C:\Windows\System\nOzIPDX.exe
  2⤵
  PID:5044
- C:\Windows\System\CGAEWph.exe
  C:\Windows\System\CGAEWph.exe
  2⤵
  PID:4908
- C:\Windows\System\dqzqJBA.exe
  C:\Windows\System\dqzqJBA.exe
  2⤵
  PID:4984
- C:\Windows\System\GfihIpY.exe
  C:\Windows\System\GfihIpY.exe
  2⤵
  PID:5064
- C:\Windows\System\xVSwgsw.exe
  C:\Windows\System\xVSwgsw.exe
  2⤵
  PID:5112
- C:\Windows\System\QvFYoBX.exe
  C:\Windows\System\QvFYoBX.exe
  2⤵
  PID:4224
- C:\Windows\System\yGnXxAH.exe
  C:\Windows\System\yGnXxAH.exe
  2⤵
  PID:2832
- C:\Windows\System\pDsqpNU.exe
  C:\Windows\System\pDsqpNU.exe
  2⤵
  PID:4356
- C:\Windows\System\IWdUTSG.exe
  C:\Windows\System\IWdUTSG.exe
  2⤵
  PID:4332
- C:\Windows\System\kmoWPlD.exe
  C:\Windows\System\kmoWPlD.exe
  2⤵
  PID:4372
- C:\Windows\System\JocBFYC.exe
  C:\Windows\System\JocBFYC.exe
  2⤵
  PID:2368
- C:\Windows\System\NVddiRu.exe
  C:\Windows\System\NVddiRu.exe
  2⤵
  PID:4516
- C:\Windows\System\CSfqtsy.exe
  C:\Windows\System\CSfqtsy.exe
  2⤵
  PID:4572
- C:\Windows\System\oYgVHbR.exe
  C:\Windows\System\oYgVHbR.exe
  2⤵
  PID:4812
- C:\Windows\System\YtXguQs.exe
  C:\Windows\System\YtXguQs.exe
  2⤵
  PID:4836
- C:\Windows\System\gGaiHlr.exe
  C:\Windows\System\gGaiHlr.exe
  2⤵
  PID:4672
- C:\Windows\System\QUBvexr.exe
  C:\Windows\System\QUBvexr.exe
  2⤵
  PID:5024
- C:\Windows\System\MqxTcok.exe
  C:\Windows\System\MqxTcok.exe
  2⤵
  PID:4124
- C:\Windows\System\QlAahIY.exe
  C:\Windows\System\QlAahIY.exe
  2⤵
  PID:2408
- C:\Windows\System\NOcYHzG.exe
  C:\Windows\System\NOcYHzG.exe
  2⤵
  PID:2912
- C:\Windows\System\PeTTIyd.exe
  C:\Windows\System\PeTTIyd.exe
  2⤵
  PID:4208
- C:\Windows\System\VqteaFu.exe
  C:\Windows\System\VqteaFu.exe
  2⤵
  PID:4112
- C:\Windows\System\vvvrZKJ.exe
  C:\Windows\System\vvvrZKJ.exe
  2⤵
  PID:4288
- C:\Windows\System\TxpLivC.exe
  C:\Windows\System\TxpLivC.exe
  2⤵
  PID:5124
- C:\Windows\System\SWlnjwc.exe
  C:\Windows\System\SWlnjwc.exe
  2⤵
  PID:5140
- C:\Windows\System\jOUOGCS.exe
  C:\Windows\System\jOUOGCS.exe
  2⤵
  PID:5156
- C:\Windows\System\icSfiyC.exe
  C:\Windows\System\icSfiyC.exe
  2⤵
  PID:5176
- C:\Windows\System\IjQDCbr.exe
  C:\Windows\System\IjQDCbr.exe
  2⤵
  PID:5192
- C:\Windows\System\lpacbRa.exe
  C:\Windows\System\lpacbRa.exe
  2⤵
  PID:5208
- C:\Windows\System\ebFIHTt.exe
  C:\Windows\System\ebFIHTt.exe
  2⤵
  PID:5224
- C:\Windows\System\nVnThWI.exe
  C:\Windows\System\nVnThWI.exe
  2⤵
  PID:5244
- C:\Windows\System\cExEeCv.exe
  C:\Windows\System\cExEeCv.exe
  2⤵
  PID:5260
- C:\Windows\System\GrQGlMH.exe
  C:\Windows\System\GrQGlMH.exe
  2⤵
  PID:5276
- C:\Windows\System\EnJkDRX.exe
  C:\Windows\System\EnJkDRX.exe
  2⤵
  PID:5292
- C:\Windows\System\kjfzSvN.exe
  C:\Windows\System\kjfzSvN.exe
  2⤵
  PID:5316
- C:\Windows\System\VFwaNtF.exe
  C:\Windows\System\VFwaNtF.exe
  2⤵
  PID:5332
- C:\Windows\System\xldVnyb.exe
  C:\Windows\System\xldVnyb.exe
  2⤵
  PID:5360
- C:\Windows\System\AmyHVUV.exe
  C:\Windows\System\AmyHVUV.exe
  2⤵
  PID:5488
- C:\Windows\System\hiGOWCM.exe
  C:\Windows\System\hiGOWCM.exe
  2⤵
  PID:5508
- C:\Windows\System\wEIJTDD.exe
  C:\Windows\System\wEIJTDD.exe
  2⤵
  PID:5528
- C:\Windows\System\dKbtzMU.exe
  C:\Windows\System\dKbtzMU.exe
  2⤵
  PID:5544
- C:\Windows\System\WmQqxWH.exe
  C:\Windows\System\WmQqxWH.exe
  2⤵
  PID:5560
- C:\Windows\System\AxUjThZ.exe
  C:\Windows\System\AxUjThZ.exe
  2⤵
  PID:5576
- C:\Windows\System\PakztMT.exe
  C:\Windows\System\PakztMT.exe
  2⤵
  PID:5592
- C:\Windows\System\cNbWFtB.exe
  C:\Windows\System\cNbWFtB.exe
  2⤵
  PID:5612
- C:\Windows\System\TTvLAiW.exe
  C:\Windows\System\TTvLAiW.exe
  2⤵
  PID:5628
- C:\Windows\System\iUJupqH.exe
  C:\Windows\System\iUJupqH.exe
  2⤵
  PID:5644
- C:\Windows\System\mjPnNAa.exe
  C:\Windows\System\mjPnNAa.exe
  2⤵
  PID:5664
- C:\Windows\System\cwiBlvR.exe
  C:\Windows\System\cwiBlvR.exe
  2⤵
  PID:5680
- C:\Windows\System\xsNYYFw.exe
  C:\Windows\System\xsNYYFw.exe
  2⤵
  PID:5696
- C:\Windows\System\vxYXDYv.exe
  C:\Windows\System\vxYXDYv.exe
  2⤵
  PID:5716
- C:\Windows\System\MhCGcSo.exe
  C:\Windows\System\MhCGcSo.exe
  2⤵
  PID:5732
- C:\Windows\System\llZeJit.exe
  C:\Windows\System\llZeJit.exe
  2⤵
  PID:5748
- C:\Windows\System\cBdlnHt.exe
  C:\Windows\System\cBdlnHt.exe
  2⤵
  PID:5764
- C:\Windows\System\udrnWit.exe
  C:\Windows\System\udrnWit.exe
  2⤵
  PID:5780
- C:\Windows\System\SindwMG.exe
  C:\Windows\System\SindwMG.exe
  2⤵
  PID:5800
- C:\Windows\System\nmCBQKz.exe
  C:\Windows\System\nmCBQKz.exe
  2⤵
  PID:5816
- C:\Windows\System\ZQpiRYX.exe
  C:\Windows\System\ZQpiRYX.exe
  2⤵
  PID:5832
- C:\Windows\System\YMhdLRq.exe
  C:\Windows\System\YMhdLRq.exe
  2⤵
  PID:5852
- C:\Windows\System\zzcVLdr.exe
  C:\Windows\System\zzcVLdr.exe
  2⤵
  PID:5868
- C:\Windows\System\OOflikQ.exe
  C:\Windows\System\OOflikQ.exe
  2⤵
  PID:5884
- C:\Windows\System\dcbUMrT.exe
  C:\Windows\System\dcbUMrT.exe
  2⤵
  PID:5900
- C:\Windows\System\hpnJHJe.exe
  C:\Windows\System\hpnJHJe.exe
  2⤵
  PID:5920
- C:\Windows\System\iqchcGq.exe
  C:\Windows\System\iqchcGq.exe
  2⤵
  PID:5952
- C:\Windows\System\ZkcwkfT.exe
  C:\Windows\System\ZkcwkfT.exe
  2⤵
  PID:5968
- C:\Windows\System\sEiSSYP.exe
  C:\Windows\System\sEiSSYP.exe
  2⤵
  PID:5984
- C:\Windows\System\tCjNCuI.exe
  C:\Windows\System\tCjNCuI.exe
  2⤵
  PID:6000
- C:\Windows\System\ujVMRXI.exe
  C:\Windows\System\ujVMRXI.exe
  2⤵
  PID:6020
- C:\Windows\System\TvxhdIM.exe
  C:\Windows\System\TvxhdIM.exe
  2⤵
  PID:6036
- C:\Windows\System\shNbyxp.exe
  C:\Windows\System\shNbyxp.exe
  2⤵
  PID:6052
- C:\Windows\System\gAckrBE.exe
  C:\Windows\System\gAckrBE.exe
  2⤵
  PID:6068
- C:\Windows\System\qQnZcJW.exe
  C:\Windows\System\qQnZcJW.exe
  2⤵
  PID:6084
- C:\Windows\System\lBDbfVY.exe
  C:\Windows\System\lBDbfVY.exe
  2⤵
  PID:6108
- C:\Windows\System\pWVlzGG.exe
  C:\Windows\System\pWVlzGG.exe
  2⤵
  PID:6124
- C:\Windows\System\ihbfIUy.exe
  C:\Windows\System\ihbfIUy.exe
  2⤵
  PID:6140
- C:\Windows\System\flDgEbm.exe
  C:\Windows\System\flDgEbm.exe
  2⤵
  PID:4536
- C:\Windows\System\HzZjuhy.exe
  C:\Windows\System\HzZjuhy.exe
  2⤵
  PID:2648
- C:\Windows\System\WyZrxLK.exe
  C:\Windows\System\WyZrxLK.exe
  2⤵
  PID:5164
- C:\Windows\System\luzFEWx.exe
  C:\Windows\System\luzFEWx.exe
  2⤵
  PID:5232
- C:\Windows\System\GFZoWjD.exe
  C:\Windows\System\GFZoWjD.exe
  2⤵
  PID:5268
- C:\Windows\System\dukUXGp.exe
  C:\Windows\System\dukUXGp.exe
  2⤵
  PID:4412
- C:\Windows\System\lAgUfao.exe
  C:\Windows\System\lAgUfao.exe
  2⤵
  PID:4180
- C:\Windows\System\mZqquPm.exe
  C:\Windows\System\mZqquPm.exe
  2⤵
  PID:5040
- C:\Windows\System\HIoYqWH.exe
  C:\Windows\System\HIoYqWH.exe
  2⤵
  PID:4564
- C:\Windows\System\DDDWTUq.exe
  C:\Windows\System\DDDWTUq.exe
  2⤵
  PID:4380
- C:\Windows\System\dUNjmUs.exe
  C:\Windows\System\dUNjmUs.exe
  2⤵
  PID:5188
- C:\Windows\System\JjQpkkW.exe
  C:\Windows\System\JjQpkkW.exe
  2⤵
  PID:5368
- C:\Windows\System\uCWhEeO.exe
  C:\Windows\System\uCWhEeO.exe
  2⤵
  PID:5432
- C:\Windows\System\xDzbCoD.exe
  C:\Windows\System\xDzbCoD.exe
  2⤵
  PID:5460
- C:\Windows\System\jYHYaYw.exe
  C:\Windows\System\jYHYaYw.exe
  2⤵
  PID:5372
- C:\Windows\System\ORlgtRm.exe
  C:\Windows\System\ORlgtRm.exe
  2⤵
  PID:5416
- C:\Windows\System\eMOldxQ.exe
  C:\Windows\System\eMOldxQ.exe
  2⤵
  PID:5444
- C:\Windows\System\SpnKQjG.exe
  C:\Windows\System\SpnKQjG.exe
  2⤵
  PID:5480
- C:\Windows\System\VXWFPuG.exe
  C:\Windows\System\VXWFPuG.exe
  2⤵
  PID:5676
- C:\Windows\System\hSHPtDu.exe
  C:\Windows\System\hSHPtDu.exe
  2⤵
  PID:5568
- C:\Windows\System\zrpMHzY.exe
  C:\Windows\System\zrpMHzY.exe
  2⤵
  PID:5776
- C:\Windows\System\hWnLTJy.exe
  C:\Windows\System\hWnLTJy.exe
  2⤵
  PID:5844
- C:\Windows\System\pcguzIv.exe
  C:\Windows\System\pcguzIv.exe
  2⤵
  PID:5640
- C:\Windows\System\IQxXQBU.exe
  C:\Windows\System\IQxXQBU.exe
  2⤵
  PID:5908
- C:\Windows\System\PXUgwLp.exe
  C:\Windows\System\PXUgwLp.exe
  2⤵
  PID:5712
- C:\Windows\System\HxfdWEz.exe
  C:\Windows\System\HxfdWEz.exe
  2⤵
  PID:5936
- C:\Windows\System\mXDtbAw.exe
  C:\Windows\System\mXDtbAw.exe
  2⤵
  PID:5948
- C:\Windows\System\aHkrEvS.exe
  C:\Windows\System\aHkrEvS.exe
  2⤵
  PID:5896
- C:\Windows\System\IhRcRUD.exe
  C:\Windows\System\IhRcRUD.exe
  2⤵
  PID:5824
- C:\Windows\System\cHJbyjv.exe
  C:\Windows\System\cHJbyjv.exe
  2⤵
  PID:5760
- C:\Windows\System\sIsOreu.exe
  C:\Windows\System\sIsOreu.exe
  2⤵
  PID:5692
- C:\Windows\System\LgjdctL.exe
  C:\Windows\System\LgjdctL.exe
  2⤵
  PID:5588
- C:\Windows\System\sqAyIgz.exe
  C:\Windows\System\sqAyIgz.exe
  2⤵
  PID:5524
- C:\Windows\System\cdLXxQQ.exe
  C:\Windows\System\cdLXxQQ.exe
  2⤵
  PID:5996
- C:\Windows\System\NGDCPiC.exe
  C:\Windows\System\NGDCPiC.exe
  2⤵
  PID:6092
- C:\Windows\System\IOsycok.exe
  C:\Windows\System\IOsycok.exe
  2⤵
  PID:6132
- C:\Windows\System\ospAzhz.exe
  C:\Windows\System\ospAzhz.exe
  2⤵
  PID:5200
- C:\Windows\System\VLQgDib.exe
  C:\Windows\System\VLQgDib.exe
  2⤵
  PID:4968
- C:\Windows\System\VWyBTUS.exe
  C:\Windows\System\VWyBTUS.exe
  2⤵
  PID:4464
- C:\Windows\System\GRoINMB.exe
  C:\Windows\System\GRoINMB.exe
  2⤵
  PID:5220
- C:\Windows\System\MhDRytS.exe
  C:\Windows\System\MhDRytS.exe
  2⤵
  PID:4240
- C:\Windows\System\dMtfGGW.exe
  C:\Windows\System\dMtfGGW.exe
  2⤵
  PID:6012
- C:\Windows\System\iFtZNhk.exe
  C:\Windows\System\iFtZNhk.exe
  2⤵
  PID:6076
- C:\Windows\System\rNRZRQs.exe
  C:\Windows\System\rNRZRQs.exe
  2⤵
  PID:3180
- C:\Windows\System\wLWzSQc.exe
  C:\Windows\System\wLWzSQc.exe
  2⤵
  PID:5152
- C:\Windows\System\wBFgtRQ.exe
  C:\Windows\System\wBFgtRQ.exe
  2⤵
  PID:5312
- C:\Windows\System\qAkPvkJ.exe
  C:\Windows\System\qAkPvkJ.exe
  2⤵
  PID:5344
- C:\Windows\System\mkAxBcw.exe
  C:\Windows\System\mkAxBcw.exe
  2⤵
  PID:5976
- C:\Windows\System\tZMogIA.exe
  C:\Windows\System\tZMogIA.exe
  2⤵
  PID:5456
- C:\Windows\System\SWmsjXD.exe
  C:\Windows\System\SWmsjXD.exe
  2⤵
  PID:5472
- C:\Windows\System\AwWCsDb.exe
  C:\Windows\System\AwWCsDb.exe
  2⤵
  PID:5840
- C:\Windows\System\EbGrFll.exe
  C:\Windows\System\EbGrFll.exe
  2⤵
  PID:5812
- C:\Windows\System\NjHsfpL.exe
  C:\Windows\System\NjHsfpL.exe
  2⤵
  PID:5428
- C:\Windows\System\QIGebpJ.exe
  C:\Windows\System\QIGebpJ.exe
  2⤵
  PID:5572
- C:\Windows\System\MgzweMp.exe
  C:\Windows\System\MgzweMp.exe
  2⤵
  PID:4704
- C:\Windows\System\IkUCAmW.exe
  C:\Windows\System\IkUCAmW.exe
  2⤵
  PID:5744
- C:\Windows\System\CLIZrli.exe
  C:\Windows\System\CLIZrli.exe
  2⤵
  PID:5604
- C:\Windows\System\eYfvaEI.exe
  C:\Windows\System\eYfvaEI.exe
  2⤵
  PID:5940
- C:\Windows\System\vgekvVy.exe
  C:\Windows\System\vgekvVy.exe
  2⤵
  PID:5792
- C:\Windows\System\PRDRRCp.exe
  C:\Windows\System\PRDRRCp.exe
  2⤵
  PID:5860
- C:\Windows\System\tQJnOKE.exe
  C:\Windows\System\tQJnOKE.exe
  2⤵
  PID:5728
- C:\Windows\System\HFZgZud.exe
  C:\Windows\System\HFZgZud.exe
  2⤵
  PID:5724
- C:\Windows\System\MSEbSRl.exe
  C:\Windows\System\MSEbSRl.exe
  2⤵
  PID:5272
- C:\Windows\System\iHuMIUS.exe
  C:\Windows\System\iHuMIUS.exe
  2⤵
  PID:5148
- C:\Windows\System\sGydbcZ.exe
  C:\Windows\System\sGydbcZ.exe
  2⤵
  PID:4104
- C:\Windows\System\prZhCQj.exe
  C:\Windows\System\prZhCQj.exe
  2⤵
  PID:4512
- C:\Windows\System\MNTfwpV.exe
  C:\Windows\System\MNTfwpV.exe
  2⤵
  PID:4108
- C:\Windows\System\PptnFKT.exe
  C:\Windows\System\PptnFKT.exe
  2⤵
  PID:6116
- C:\Windows\System\JYHXGqs.exe
  C:\Windows\System\JYHXGqs.exe
  2⤵
  PID:5808
- C:\Windows\System\XOIopOu.exe
  C:\Windows\System\XOIopOu.exe
  2⤵
  PID:5536
- C:\Windows\System\gBzpCmc.exe
  C:\Windows\System\gBzpCmc.exe
  2⤵
  PID:5708
- C:\Windows\System\lmpswYf.exe
  C:\Windows\System\lmpswYf.exe
  2⤵
  PID:5788
- C:\Windows\System\hnReDMa.exe
  C:\Windows\System\hnReDMa.exe
  2⤵
  PID:5080
- C:\Windows\System\gMCNaSv.exe
  C:\Windows\System\gMCNaSv.exe
  2⤵
  PID:4500
- C:\Windows\System\YUBeKeN.exe
  C:\Windows\System\YUBeKeN.exe
  2⤵
  PID:5376
- C:\Windows\System\JbHHXvr.exe
  C:\Windows\System\JbHHXvr.exe
  2⤵
  PID:5636
- C:\Windows\System\fPeyZLv.exe
  C:\Windows\System\fPeyZLv.exe
  2⤵
  PID:5284
- C:\Windows\System\cprouOy.exe
  C:\Windows\System\cprouOy.exe
  2⤵
  PID:6104
- C:\Windows\System\yCduhmS.exe
  C:\Windows\System\yCduhmS.exe
  2⤵
  PID:5556
- C:\Windows\System\rsnHtnR.exe
  C:\Windows\System\rsnHtnR.exe
  2⤵
  PID:4948
- C:\Windows\System\kPhSbyX.exe
  C:\Windows\System\kPhSbyX.exe
  2⤵
  PID:5356
- C:\Windows\System\JQbReYQ.exe
  C:\Windows\System\JQbReYQ.exe
  2⤵
  PID:4884
- C:\Windows\System\szkwDBu.exe
  C:\Windows\System\szkwDBu.exe
  2⤵
  PID:6148
- C:\Windows\System\BxiGMRV.exe
  C:\Windows\System\BxiGMRV.exe
  2⤵
  PID:6164
- C:\Windows\System\AGUooQa.exe
  C:\Windows\System\AGUooQa.exe
  2⤵
  PID:6184
- C:\Windows\System\PnojrNT.exe
  C:\Windows\System\PnojrNT.exe
  2⤵
  PID:6200
- C:\Windows\System\MsaYrhQ.exe
  C:\Windows\System\MsaYrhQ.exe
  2⤵
  PID:6220
- C:\Windows\System\LmEJTTh.exe
  C:\Windows\System\LmEJTTh.exe
  2⤵
  PID:6236
- C:\Windows\System\QPMkxwh.exe
  C:\Windows\System\QPMkxwh.exe
  2⤵
  PID:6308
- C:\Windows\System\kclQhbX.exe
  C:\Windows\System\kclQhbX.exe
  2⤵
  PID:6324
- C:\Windows\System\rpMkOri.exe
  C:\Windows\System\rpMkOri.exe
  2⤵
  PID:6340
- C:\Windows\System\QMhcaZi.exe
  C:\Windows\System\QMhcaZi.exe
  2⤵
  PID:6356
- C:\Windows\System\FRwHHBM.exe
  C:\Windows\System\FRwHHBM.exe
  2⤵
  PID:6372
- C:\Windows\System\kRTDDMB.exe
  C:\Windows\System\kRTDDMB.exe
  2⤵
  PID:6396
- C:\Windows\System\rJDrAvy.exe
  C:\Windows\System\rJDrAvy.exe
  2⤵
  PID:6412
- C:\Windows\System\phfULQL.exe
  C:\Windows\System\phfULQL.exe
  2⤵
  PID:6428
- C:\Windows\System\VoVsliR.exe
  C:\Windows\System\VoVsliR.exe
  2⤵
  PID:6444
- C:\Windows\System\JpIBxDk.exe
  C:\Windows\System\JpIBxDk.exe
  2⤵
  PID:6460
- C:\Windows\System\eRfKHCN.exe
  C:\Windows\System\eRfKHCN.exe
  2⤵
  PID:6476
- C:\Windows\System\DYpZzGe.exe
  C:\Windows\System\DYpZzGe.exe
  2⤵
  PID:6492
- C:\Windows\System\ANPgvjs.exe
  C:\Windows\System\ANPgvjs.exe
  2⤵
  PID:6508
- C:\Windows\System\ynypOQm.exe
  C:\Windows\System\ynypOQm.exe
  2⤵
  PID:6528
- C:\Windows\System\WXmiGAB.exe
  C:\Windows\System\WXmiGAB.exe
  2⤵
  PID:6544
- C:\Windows\System\kXOMTTt.exe
  C:\Windows\System\kXOMTTt.exe
  2⤵
  PID:6560
- C:\Windows\System\fXEiunj.exe
  C:\Windows\System\fXEiunj.exe
  2⤵
  PID:6576
- C:\Windows\System\PvDVnEY.exe
  C:\Windows\System\PvDVnEY.exe
  2⤵
  PID:6592
- C:\Windows\System\GLqrdDS.exe
  C:\Windows\System\GLqrdDS.exe
  2⤵
  PID:6612
- C:\Windows\System\GEZzkXf.exe
  C:\Windows\System\GEZzkXf.exe
  2⤵
  PID:6632
- C:\Windows\System\sIfkjxv.exe
  C:\Windows\System\sIfkjxv.exe
  2⤵
  PID:6648
- C:\Windows\System\dqIFdTE.exe
  C:\Windows\System\dqIFdTE.exe
  2⤵
  PID:6664
- C:\Windows\System\aLBDMek.exe
  C:\Windows\System\aLBDMek.exe
  2⤵
  PID:6680
- C:\Windows\System\YhHzYuU.exe
  C:\Windows\System\YhHzYuU.exe
  2⤵
  PID:6696
- C:\Windows\System\bYtWGfX.exe
  C:\Windows\System\bYtWGfX.exe
  2⤵
  PID:6712
- C:\Windows\System\UAcDkUP.exe
  C:\Windows\System\UAcDkUP.exe
  2⤵
  PID:6728
- C:\Windows\System\GwGOFXH.exe
  C:\Windows\System\GwGOFXH.exe
  2⤵
  PID:6744
- C:\Windows\System\xwQkiFY.exe
  C:\Windows\System\xwQkiFY.exe
  2⤵
  PID:6764
- C:\Windows\System\noViSFB.exe
  C:\Windows\System\noViSFB.exe
  2⤵
  PID:6780
- C:\Windows\System\ylIWsbZ.exe
  C:\Windows\System\ylIWsbZ.exe
  2⤵
  PID:6796
- C:\Windows\System\RkimehI.exe
  C:\Windows\System\RkimehI.exe
  2⤵
  PID:6812
- C:\Windows\System\DLuJRwP.exe
  C:\Windows\System\DLuJRwP.exe
  2⤵
  PID:6828
- C:\Windows\System\hqVpTqi.exe
  C:\Windows\System\hqVpTqi.exe
  2⤵
  PID:6844
- C:\Windows\System\vgQRHiV.exe
  C:\Windows\System\vgQRHiV.exe
  2⤵
  PID:6860
- C:\Windows\System\lowrZXd.exe
  C:\Windows\System\lowrZXd.exe
  2⤵
  PID:6876
- C:\Windows\System\sIOeHhy.exe
  C:\Windows\System\sIOeHhy.exe
  2⤵
  PID:6892
- C:\Windows\System\JnSGwFb.exe
  C:\Windows\System\JnSGwFb.exe
  2⤵
  PID:6908
- C:\Windows\System\DKEwtvQ.exe
  C:\Windows\System\DKEwtvQ.exe
  2⤵
  PID:6924
- C:\Windows\System\NBmeNVx.exe
  C:\Windows\System\NBmeNVx.exe
  2⤵
  PID:6940
- C:\Windows\System\mGHidWM.exe
  C:\Windows\System\mGHidWM.exe
  2⤵
  PID:6968
- C:\Windows\System\cdBsFBX.exe
  C:\Windows\System\cdBsFBX.exe
  2⤵
  PID:6984
- C:\Windows\System\BTETmkl.exe
  C:\Windows\System\BTETmkl.exe
  2⤵
  PID:7000
- C:\Windows\System\lFBgRWM.exe
  C:\Windows\System\lFBgRWM.exe
  2⤵
  PID:7016
- C:\Windows\System\cYxIiLa.exe
  C:\Windows\System\cYxIiLa.exe
  2⤵
  PID:7032
- C:\Windows\System\qCQdgPt.exe
  C:\Windows\System\qCQdgPt.exe
  2⤵
  PID:7048
- C:\Windows\System\EeRexyF.exe
  C:\Windows\System\EeRexyF.exe
  2⤵
  PID:7064
- C:\Windows\System\UOkjRqV.exe
  C:\Windows\System\UOkjRqV.exe
  2⤵
  PID:7080
- C:\Windows\System\aMFVDZD.exe
  C:\Windows\System\aMFVDZD.exe
  2⤵
  PID:7096
- C:\Windows\System\CYiiZuJ.exe
  C:\Windows\System\CYiiZuJ.exe
  2⤵
  PID:7112
- C:\Windows\System\GcHVpil.exe
  C:\Windows\System\GcHVpil.exe
  2⤵
  PID:7128
- C:\Windows\System\GwuDtzw.exe
  C:\Windows\System\GwuDtzw.exe
  2⤵
  PID:7144
- C:\Windows\System\nlQOemp.exe
  C:\Windows\System\nlQOemp.exe
  2⤵
  PID:7160
- C:\Windows\System\WzsYCVk.exe
  C:\Windows\System\WzsYCVk.exe
  2⤵
  PID:5864
- C:\Windows\System\TYaMIcG.exe
  C:\Windows\System\TYaMIcG.exe
  2⤵
  PID:5172
- C:\Windows\System\iyyxEih.exe
  C:\Windows\System\iyyxEih.exe
  2⤵
  PID:4248
- C:\Windows\System\XbzYAAn.exe
  C:\Windows\System\XbzYAAn.exe
  2⤵
  PID:5328
- C:\Windows\System\FOgENae.exe
  C:\Windows\System\FOgENae.exe
  2⤵
  PID:6172
- C:\Windows\System\aaiASty.exe
  C:\Windows\System\aaiASty.exe
  2⤵
  PID:6160
- C:\Windows\System\uQSZuSB.exe
  C:\Windows\System\uQSZuSB.exe
  2⤵
  PID:6228
- C:\Windows\System\zMnendd.exe
  C:\Windows\System\zMnendd.exe
  2⤵
  PID:6212
- C:\Windows\System\qsthVfV.exe
  C:\Windows\System\qsthVfV.exe
  2⤵
  PID:5504
- C:\Windows\System\dEsUFIz.exe
  C:\Windows\System\dEsUFIz.exe
  2⤵
  PID:6268
- C:\Windows\System\gnzmLLJ.exe
  C:\Windows\System\gnzmLLJ.exe
  2⤵
  PID:6264
- C:\Windows\System\OxwyozC.exe
  C:\Windows\System\OxwyozC.exe
  2⤵
  PID:6288
- C:\Windows\System\yHgrwZm.exe
  C:\Windows\System\yHgrwZm.exe
  2⤵
  PID:6320
- C:\Windows\System\KVUUoDM.exe
  C:\Windows\System\KVUUoDM.exe
  2⤵
  PID:6304
- C:\Windows\System\PbjCfBf.exe
  C:\Windows\System\PbjCfBf.exe
  2⤵
  PID:6352
- C:\Windows\System\QjxBHdG.exe
  C:\Windows\System\QjxBHdG.exe
  2⤵
  PID:6484
- C:\Windows\System\kcOShVl.exe
  C:\Windows\System\kcOShVl.exe
  2⤵
  PID:6584
- C:\Windows\System\yRiOhEd.exe
  C:\Windows\System\yRiOhEd.exe
  2⤵
  PID:6776
- C:\Windows\System\ptUnNFu.exe
  C:\Windows\System\ptUnNFu.exe
  2⤵
  PID:6824
- C:\Windows\System\rOAynaL.exe
  C:\Windows\System\rOAynaL.exe
  2⤵
  PID:6888
- C:\Windows\System\WrGcPsG.exe
  C:\Windows\System\WrGcPsG.exe
  2⤵
  PID:6840
- C:\Windows\System\scpbxbg.exe
  C:\Windows\System\scpbxbg.exe
  2⤵
  PID:6932
- C:\Windows\System\ouzpVNe.exe
  C:\Windows\System\ouzpVNe.exe
  2⤵
  PID:6956
- C:\Windows\System\YUdNSiF.exe
  C:\Windows\System\YUdNSiF.exe
  2⤵
  PID:6964
- C:\Windows\System\ekvVMqF.exe
  C:\Windows\System\ekvVMqF.exe
  2⤵
  PID:6976
- C:\Windows\System\TTZsXFB.exe
  C:\Windows\System\TTZsXFB.exe
  2⤵
  PID:7088
- C:\Windows\System\lvcPItk.exe
  C:\Windows\System\lvcPItk.exe
  2⤵
  PID:7040
- C:\Windows\System\JpchwpA.exe
  C:\Windows\System\JpchwpA.exe
  2⤵
  PID:7108
- C:\Windows\System\Sexhzkj.exe
  C:\Windows\System\Sexhzkj.exe
  2⤵
  PID:7156
- C:\Windows\System\mdvWTee.exe
  C:\Windows\System\mdvWTee.exe
  2⤵
  PID:6100
- C:\Windows\System\vSLTeIK.exe
  C:\Windows\System\vSLTeIK.exe
  2⤵
  PID:5620
- C:\Windows\System\qSQCaok.exe
  C:\Windows\System\qSQCaok.exe
  2⤵
  PID:7136
- C:\Windows\System\GHaKLTa.exe
  C:\Windows\System\GHaKLTa.exe
  2⤵
  PID:5412
- C:\Windows\System\aEtrpYe.exe
  C:\Windows\System\aEtrpYe.exe
  2⤵
  PID:6244
- C:\Windows\System\iRhYEQH.exe
  C:\Windows\System\iRhYEQH.exe
  2⤵
  PID:6280
- C:\Windows\System\abnAFmX.exe
  C:\Windows\System\abnAFmX.exe
  2⤵
  PID:6332
- C:\Windows\System\oJzONUk.exe
  C:\Windows\System\oJzONUk.exe
  2⤵
  PID:6368
- C:\Windows\System\niYWxyn.exe
  C:\Windows\System\niYWxyn.exe
  2⤵
  PID:6552
- C:\Windows\System\gSHVlWB.exe
  C:\Windows\System\gSHVlWB.exe
  2⤵
  PID:6588
- C:\Windows\System\vRZSaTI.exe
  C:\Windows\System\vRZSaTI.exe
  2⤵
  PID:6656
- C:\Windows\System\qLqhwOk.exe
  C:\Windows\System\qLqhwOk.exe
  2⤵
  PID:6720
- C:\Windows\System\EXnceYw.exe
  C:\Windows\System\EXnceYw.exe
  2⤵
  PID:6520
- C:\Windows\System\BroEhjn.exe
  C:\Windows\System\BroEhjn.exe
  2⤵
  PID:6408
- C:\Windows\System\uiUimmm.exe
  C:\Windows\System\uiUimmm.exe
  2⤵
  PID:6604
- C:\Windows\System\RtGKJdp.exe
  C:\Windows\System\RtGKJdp.exe
  2⤵
  PID:6468
- C:\Windows\System\ybriLgS.exe
  C:\Windows\System\ybriLgS.exe
  2⤵
  PID:6540
- C:\Windows\System\oenbJAk.exe
  C:\Windows\System\oenbJAk.exe
  2⤵
  PID:6608
- C:\Windows\System\XzmQQhh.exe
  C:\Windows\System\XzmQQhh.exe
  2⤵
  PID:6676
- C:\Windows\System\TmhRqdn.exe
  C:\Windows\System\TmhRqdn.exe
  2⤵
  PID:6736
- C:\Windows\System\QcrJiTG.exe
  C:\Windows\System\QcrJiTG.exe
  2⤵
  PID:6872
- C:\Windows\System\rLbobZh.exe
  C:\Windows\System\rLbobZh.exe
  2⤵
  PID:6936
- C:\Windows\System\quIjBQo.exe
  C:\Windows\System\quIjBQo.exe
  2⤵
  PID:6820
- C:\Windows\System\Nkhtskz.exe
  C:\Windows\System\Nkhtskz.exe
  2⤵
  PID:5352
- C:\Windows\System\HhmNpdv.exe
  C:\Windows\System\HhmNpdv.exe
  2⤵
  PID:6260
- C:\Windows\System\GeAgoHg.exe
  C:\Windows\System\GeAgoHg.exe
  2⤵
  PID:6624
- C:\Windows\System\FmoeKpt.exe
  C:\Windows\System\FmoeKpt.exe
  2⤵
  PID:6516
- C:\Windows\System\EHjgjoT.exe
  C:\Windows\System\EHjgjoT.exe
  2⤵
  PID:6752
- C:\Windows\System\RvyCXUX.exe
  C:\Windows\System\RvyCXUX.exe
  2⤵
  PID:6792
- C:\Windows\System\dKswzMP.exe
  C:\Windows\System\dKswzMP.exe
  2⤵
  PID:2900
- C:\Windows\System\gvFMxNB.exe
  C:\Windows\System\gvFMxNB.exe
  2⤵
  PID:6644
- C:\Windows\System\TxVwNGa.exe
  C:\Windows\System\TxVwNGa.exe
  2⤵
  PID:6740
- C:\Windows\System\WcLNnHI.exe
  C:\Windows\System\WcLNnHI.exe
  2⤵
  PID:6960
- C:\Windows\System\pCsjhYB.exe
  C:\Windows\System\pCsjhYB.exe
  2⤵
  PID:5500
- C:\Windows\System\azpIcbb.exe
  C:\Windows\System\azpIcbb.exe
  2⤵
  PID:7044
- C:\Windows\System\mLxGLsF.exe
  C:\Windows\System\mLxGLsF.exe
  2⤵
  PID:7120
- C:\Windows\System\KwjSQgq.exe
  C:\Windows\System\KwjSQgq.exe
  2⤵
  PID:6456
- C:\Windows\System\DCtryDV.exe
  C:\Windows\System\DCtryDV.exe
  2⤵
  PID:6952
- C:\Windows\System\bPvfjcr.exe
  C:\Windows\System\bPvfjcr.exe
  2⤵
  PID:6572
- C:\Windows\System\fbURaNb.exe
  C:\Windows\System\fbURaNb.exe
  2⤵
  PID:6388
- C:\Windows\System\YIMPDfc.exe
  C:\Windows\System\YIMPDfc.exe
  2⤵
  PID:1276
- C:\Windows\System\wHtFuqi.exe
  C:\Windows\System\wHtFuqi.exe
  2⤵
  PID:6248
- C:\Windows\System\GeXRJNl.exe
  C:\Windows\System\GeXRJNl.exe
  2⤵
  PID:7056
- C:\Windows\System\qxVSdnk.exe
  C:\Windows\System\qxVSdnk.exe
  2⤵
  PID:5468
- C:\Windows\System\XHancud.exe
  C:\Windows\System\XHancud.exe
  2⤵
  PID:6364
- C:\Windows\System\KWCRmuD.exe
  C:\Windows\System\KWCRmuD.exe
  2⤵
  PID:6836
- C:\Windows\System\cqRcHfp.exe
  C:\Windows\System\cqRcHfp.exe
  2⤵
  PID:7152
- C:\Windows\System\zhxoBEL.exe
  C:\Windows\System\zhxoBEL.exe
  2⤵
  PID:2860
- C:\Windows\System\VWPICwK.exe
  C:\Windows\System\VWPICwK.exe
  2⤵
  PID:7180
- C:\Windows\System\LHxeSWv.exe
  C:\Windows\System\LHxeSWv.exe
  2⤵
  PID:7196
- C:\Windows\System\SZHDUpO.exe
  C:\Windows\System\SZHDUpO.exe
  2⤵
  PID:7212
- C:\Windows\System\pCTtrpT.exe
  C:\Windows\System\pCTtrpT.exe
  2⤵
  PID:7228
- C:\Windows\System\wSKqREA.exe
  C:\Windows\System\wSKqREA.exe
  2⤵
  PID:7244
- C:\Windows\System\kdsUxZm.exe
  C:\Windows\System\kdsUxZm.exe
  2⤵
  PID:7260
- C:\Windows\System\cBZmlHp.exe
  C:\Windows\System\cBZmlHp.exe
  2⤵
  PID:7276
- C:\Windows\System\KnsTHlG.exe
  C:\Windows\System\KnsTHlG.exe
  2⤵
  PID:7296
- C:\Windows\System\gqARwtY.exe
  C:\Windows\System\gqARwtY.exe
  2⤵
  PID:7316
- C:\Windows\System\dokOoAm.exe
  C:\Windows\System\dokOoAm.exe
  2⤵
  PID:7332
- C:\Windows\System\LkAxouA.exe
  C:\Windows\System\LkAxouA.exe
  2⤵
  PID:7352
- C:\Windows\System\RntOsWT.exe
  C:\Windows\System\RntOsWT.exe
  2⤵
  PID:7368
- C:\Windows\System\sNIJtNq.exe
  C:\Windows\System\sNIJtNq.exe
  2⤵
  PID:7384
- C:\Windows\System\BONdSzA.exe
  C:\Windows\System\BONdSzA.exe
  2⤵
  PID:7400
- C:\Windows\System\jlOhKfW.exe
  C:\Windows\System\jlOhKfW.exe
  2⤵
  PID:7416
- C:\Windows\System\hCsCScZ.exe
  C:\Windows\System\hCsCScZ.exe
  2⤵
  PID:7432
- C:\Windows\System\LFaQfyJ.exe
  C:\Windows\System\LFaQfyJ.exe
  2⤵
  PID:7448
- C:\Windows\System\zidKpHZ.exe
  C:\Windows\System\zidKpHZ.exe
  2⤵
  PID:7492
- C:\Windows\System\UXKckJQ.exe
  C:\Windows\System\UXKckJQ.exe
  2⤵
  PID:7512
- C:\Windows\System\pyMcMvq.exe
  C:\Windows\System\pyMcMvq.exe
  2⤵
  PID:7528
- C:\Windows\System\WSpcwQP.exe
  C:\Windows\System\WSpcwQP.exe
  2⤵
  PID:7544
- C:\Windows\System\pioYtET.exe
  C:\Windows\System\pioYtET.exe
  2⤵
  PID:7560
- C:\Windows\System\MenSHWU.exe
  C:\Windows\System\MenSHWU.exe
  2⤵
  PID:7576
- C:\Windows\System\leRXfFt.exe
  C:\Windows\System\leRXfFt.exe
  2⤵
  PID:7596
- C:\Windows\System\knTdpVY.exe
  C:\Windows\System\knTdpVY.exe
  2⤵
  PID:7612
- C:\Windows\System\exAJtYy.exe
  C:\Windows\System\exAJtYy.exe
  2⤵
  PID:7628
- C:\Windows\System\vsooieF.exe
  C:\Windows\System\vsooieF.exe
  2⤵
  PID:7644
- C:\Windows\System\PFZQmFc.exe
  C:\Windows\System\PFZQmFc.exe
  2⤵
  PID:7660
- C:\Windows\System\BPPxmQO.exe
  C:\Windows\System\BPPxmQO.exe
  2⤵
  PID:7676
- C:\Windows\System\CRxHIfc.exe
  C:\Windows\System\CRxHIfc.exe
  2⤵
  PID:7692
- C:\Windows\System\oHLOuAF.exe
  C:\Windows\System\oHLOuAF.exe
  2⤵
  PID:7708
- C:\Windows\System\TlnCgAD.exe
  C:\Windows\System\TlnCgAD.exe
  2⤵
  PID:7724
- C:\Windows\System\iWxEDIY.exe
  C:\Windows\System\iWxEDIY.exe
  2⤵
  PID:7772
- C:\Windows\System\CIGDiBk.exe
  C:\Windows\System\CIGDiBk.exe
  2⤵
  PID:7788
- C:\Windows\System\oZORVZf.exe
  C:\Windows\System\oZORVZf.exe
  2⤵
  PID:7920
- C:\Windows\System\TLjQjNf.exe
  C:\Windows\System\TLjQjNf.exe
  2⤵
  PID:7936
- C:\Windows\System\IbDJJuS.exe
  C:\Windows\System\IbDJJuS.exe
  2⤵
  PID:7952
- C:\Windows\System\zIyjiLq.exe
  C:\Windows\System\zIyjiLq.exe
  2⤵
  PID:7972
- C:\Windows\System\ODFGhEE.exe
  C:\Windows\System\ODFGhEE.exe
  2⤵
  PID:7988
- C:\Windows\System\JVxllzy.exe
  C:\Windows\System\JVxllzy.exe
  2⤵
  PID:8004
- C:\Windows\System\WHrbVXy.exe
  C:\Windows\System\WHrbVXy.exe
  2⤵
  PID:8164
- C:\Windows\System\fZASUDY.exe
  C:\Windows\System\fZASUDY.exe
  2⤵
  PID:8180
- C:\Windows\System\ZEucXRA.exe
  C:\Windows\System\ZEucXRA.exe
  2⤵
  PID:7172
- C:\Windows\System\ILxrVvm.exe
  C:\Windows\System\ILxrVvm.exe
  2⤵
  PID:6996
- C:\Windows\System\FCwUSib.exe
  C:\Windows\System\FCwUSib.exe
  2⤵
  PID:7240
- C:\Windows\System\ksuKNTJ.exe
  C:\Windows\System\ksuKNTJ.exe
  2⤵
  PID:7304
- C:\Windows\System\RziJUQC.exe
  C:\Windows\System\RziJUQC.exe
  2⤵
  PID:7076
- C:\Windows\System\oMTsrSh.exe
  C:\Windows\System\oMTsrSh.exe
  2⤵
  PID:7192
- C:\Windows\System\IauZxNj.exe
  C:\Windows\System\IauZxNj.exe
  2⤵
  PID:7252
- C:\Windows\System\ScSYTrC.exe
  C:\Windows\System\ScSYTrC.exe
  2⤵
  PID:7292
- C:\Windows\System\XkAruqW.exe
  C:\Windows\System\XkAruqW.exe
  2⤵
  PID:7376
- C:\Windows\System\tdIojwQ.exe
  C:\Windows\System\tdIojwQ.exe
  2⤵
  PID:7440
- C:\Windows\System\IuwiBAs.exe
  C:\Windows\System\IuwiBAs.exe
  2⤵
  PID:7444
- C:\Windows\System\HFLqoNV.exe
  C:\Windows\System\HFLqoNV.exe
  2⤵
  PID:7456
- C:\Windows\System\mNswNYK.exe
  C:\Windows\System\mNswNYK.exe
  2⤵
  PID:7468
- C:\Windows\System\INBAYoO.exe
  C:\Windows\System\INBAYoO.exe
  2⤵
  PID:7480
- C:\Windows\System\rUcqTfX.exe
  C:\Windows\System\rUcqTfX.exe
  2⤵
  PID:7504
- C:\Windows\System\eWtGDWu.exe
  C:\Windows\System\eWtGDWu.exe
  2⤵
  PID:7604
- C:\Windows\System\DXWNLTy.exe
  C:\Windows\System\DXWNLTy.exe
  2⤵
  PID:7508
- C:\Windows\System\wNQnBwY.exe
  C:\Windows\System\wNQnBwY.exe
  2⤵
  PID:7592
- C:\Windows\System\YDINEkL.exe
  C:\Windows\System\YDINEkL.exe
  2⤵
  PID:7552
- C:\Windows\System\afEThqx.exe
  C:\Windows\System\afEThqx.exe
  2⤵
  PID:7588
- C:\Windows\System\WfKQDRu.exe
  C:\Windows\System\WfKQDRu.exe
  2⤵
  PID:7656
- C:\Windows\System\bMDajqS.exe
  C:\Windows\System\bMDajqS.exe
  2⤵
  PID:7716
- C:\Windows\System\OCsIfXd.exe
  C:\Windows\System\OCsIfXd.exe
  2⤵
  PID:7752
- C:\Windows\System\LoRUuuZ.exe
  C:\Windows\System\LoRUuuZ.exe
  2⤵
  PID:7760
- C:\Windows\System\JLvANuA.exe
  C:\Windows\System\JLvANuA.exe
  2⤵
  PID:7808
- C:\Windows\System\IbCQUiK.exe
  C:\Windows\System\IbCQUiK.exe
  2⤵
  PID:7824
- C:\Windows\System\aXeZXmW.exe
  C:\Windows\System\aXeZXmW.exe
  2⤵
  PID:7844
- C:\Windows\System\AsaBZFc.exe
  C:\Windows\System\AsaBZFc.exe
  2⤵
  PID:7860
- C:\Windows\System\KpfwRch.exe
  C:\Windows\System\KpfwRch.exe
  2⤵
  PID:7876
- C:\Windows\System\RhbHBRk.exe
  C:\Windows\System\RhbHBRk.exe
  2⤵
  PID:7892
- C:\Windows\System\awGjDAS.exe
  C:\Windows\System\awGjDAS.exe
  2⤵
  PID:7784
- C:\Windows\System\xaqdlNJ.exe
  C:\Windows\System\xaqdlNJ.exe
  2⤵
  PID:7768
- C:\Windows\System\LWRwCMR.exe
  C:\Windows\System\LWRwCMR.exe
  2⤵
  PID:7984
- C:\Windows\System\eRDnYHq.exe
  C:\Windows\System\eRDnYHq.exe
  2⤵
  PID:7996
- C:\Windows\System\IFYgFcu.exe
  C:\Windows\System\IFYgFcu.exe
  2⤵
  PID:7964
- C:\Windows\System\rUFSEyh.exe
  C:\Windows\System\rUFSEyh.exe
  2⤵
  PID:8024
- C:\Windows\System\jiFjKfa.exe
  C:\Windows\System\jiFjKfa.exe
  2⤵
  PID:8040
- C:\Windows\System\QzzSSne.exe
  C:\Windows\System\QzzSSne.exe
  2⤵
  PID:8060
- C:\Windows\System\hlgSjqh.exe
  C:\Windows\System\hlgSjqh.exe
  2⤵
  PID:8076
- C:\Windows\System\fkQXmin.exe
  C:\Windows\System\fkQXmin.exe
  2⤵
  PID:8092
- C:\Windows\System\oIynVse.exe
  C:\Windows\System\oIynVse.exe
  2⤵
  PID:8108
- C:\Windows\System\eEdGcrP.exe
  C:\Windows\System\eEdGcrP.exe
  2⤵
  PID:8124
- C:\Windows\System\yivIIoG.exe
  C:\Windows\System\yivIIoG.exe
  2⤵
  PID:8140
- C:\Windows\System\FGBNNwP.exe
  C:\Windows\System\FGBNNwP.exe
  2⤵
  PID:8156
- C:\Windows\System\ZSsOHpZ.exe
  C:\Windows\System\ZSsOHpZ.exe
  2⤵
  PID:5324
- C:\Windows\System\mlQjSBo.exe
  C:\Windows\System\mlQjSBo.exe
  2⤵
  PID:6884
- C:\Windows\System\SfQMNBp.exe
  C:\Windows\System\SfQMNBp.exe
  2⤵
  PID:7328
- C:\Windows\System\YamYEJt.exe
  C:\Windows\System\YamYEJt.exe
  2⤵
  PID:7460
- C:\Windows\System\RvuGSKm.exe
  C:\Windows\System\RvuGSKm.exe
  2⤵
  PID:7500
- C:\Windows\System\dTPjYUs.exe
  C:\Windows\System\dTPjYUs.exe
  2⤵
  PID:7396
- C:\Windows\System\CrXcrnv.exe
  C:\Windows\System\CrXcrnv.exe
  2⤵
  PID:7288
- C:\Windows\System\AuIaDTY.exe
  C:\Windows\System\AuIaDTY.exe
  2⤵
  PID:7312
- C:\Windows\System\uRenTst.exe
  C:\Windows\System\uRenTst.exe
  2⤵
  PID:7568
- C:\Windows\System\WyukpmY.exe
  C:\Windows\System\WyukpmY.exe
  2⤵
  PID:7624
- C:\Windows\System\UIZCDdf.exe
  C:\Windows\System\UIZCDdf.exe
  2⤵
  PID:6600
- C:\Windows\System\YAGstxg.exe
  C:\Windows\System\YAGstxg.exe
  2⤵
  PID:7688
- C:\Windows\System\GnXPBTP.exe
  C:\Windows\System\GnXPBTP.exe
  2⤵
  PID:7652
- C:\Windows\System\gUbYErE.exe
  C:\Windows\System\gUbYErE.exe
  2⤵
  PID:1652
- C:\Windows\System\ATUCNMR.exe
  C:\Windows\System\ATUCNMR.exe
  2⤵
  PID:7816
- C:\Windows\System\QQIKbOD.exe
  C:\Windows\System\QQIKbOD.exe
  2⤵
  PID:7840
- C:\Windows\System\tmvLoAF.exe
  C:\Windows\System\tmvLoAF.exe
  2⤵
  PID:7852
- C:\Windows\System\czSyPkg.exe
  C:\Windows\System\czSyPkg.exe
  2⤵
  PID:7888
- C:\Windows\System\HgWVzbK.exe
  C:\Windows\System\HgWVzbK.exe
  2⤵
  PID:8032
- C:\Windows\System\HMQbWuZ.exe
  C:\Windows\System\HMQbWuZ.exe
  2⤵
  PID:8072
- C:\Windows\System\uwbuatl.exe
  C:\Windows\System\uwbuatl.exe
  2⤵
  PID:8052
- C:\Windows\System\ibiCSPB.exe
  C:\Windows\System\ibiCSPB.exe
  2⤵
  PID:7780
- C:\Windows\System\lmeczje.exe
  C:\Windows\System\lmeczje.exe
  2⤵
  PID:8152
- C:\Windows\System\pWTbPTg.exe
  C:\Windows\System\pWTbPTg.exe
  2⤵
  PID:7700
- C:\Windows\System\aRkgcSB.exe
  C:\Windows\System\aRkgcSB.exe
  2⤵
  PID:7636
- C:\Windows\System\woTfKFr.exe
  C:\Windows\System\woTfKFr.exe
  2⤵
  PID:7928
- C:\Windows\System\LzfJqMr.exe
  C:\Windows\System\LzfJqMr.exe
  2⤵
  PID:8036
- C:\Windows\System\kIRcepB.exe
  C:\Windows\System\kIRcepB.exe
  2⤵
  PID:8172
- C:\Windows\System\eQNtnZe.exe
  C:\Windows\System\eQNtnZe.exe
  2⤵
  PID:7176
- C:\Windows\System\YLCLCFf.exe
  C:\Windows\System\YLCLCFf.exe
  2⤵
  PID:8020
- C:\Windows\System\ZAaQUXd.exe
  C:\Windows\System\ZAaQUXd.exe
  2⤵
  PID:7736
- C:\Windows\System\nPHpWpR.exe
  C:\Windows\System\nPHpWpR.exe
  2⤵
  PID:7820
- C:\Windows\System\ZMdoAPc.exe
  C:\Windows\System\ZMdoAPc.exe
  2⤵
  PID:7804
- C:\Windows\System\EkSdcpE.exe
  C:\Windows\System\EkSdcpE.exe
  2⤵
  PID:5300
- C:\Windows\System\lsPKWLD.exe
  C:\Windows\System\lsPKWLD.exe
  2⤵
  PID:7476
- C:\Windows\System\HXtCjoh.exe
  C:\Windows\System\HXtCjoh.exe
  2⤵
  PID:7188
- C:\Windows\System\NHrxQBk.exe
  C:\Windows\System\NHrxQBk.exe
  2⤵
  PID:7224
- C:\Windows\System\jIVsIyw.exe
  C:\Windows\System\jIVsIyw.exe
  2⤵
  PID:1576
- C:\Windows\System\VMexnMe.exe
  C:\Windows\System\VMexnMe.exe
  2⤵
  PID:8000
- C:\Windows\System\jQdKPjA.exe
  C:\Windows\System\jQdKPjA.exe
  2⤵
  PID:8188
- C:\Windows\System\kOvjBTG.exe
  C:\Windows\System\kOvjBTG.exe
  2⤵
  PID:7800
- C:\Windows\System\LACHCcw.exe
  C:\Windows\System\LACHCcw.exe
  2⤵
  PID:1528
- C:\Windows\System\RiYYhiE.exe
  C:\Windows\System\RiYYhiE.exe
  2⤵
  PID:7672
- C:\Windows\System\HeBJHxF.exe
  C:\Windows\System\HeBJHxF.exe
  2⤵
  PID:7236
- C:\Windows\System\qgiWxpp.exe
  C:\Windows\System\qgiWxpp.exe
  2⤵
  PID:7268
- C:\Windows\System\IjAzQFt.exe
  C:\Windows\System\IjAzQFt.exe
  2⤵
  PID:8208
- C:\Windows\System\QuPpKou.exe
  C:\Windows\System\QuPpKou.exe
  2⤵
  PID:8224
- C:\Windows\System\bdIaBWG.exe
  C:\Windows\System\bdIaBWG.exe
  2⤵
  PID:8240
- C:\Windows\System\SaSoqHg.exe
  C:\Windows\System\SaSoqHg.exe
  2⤵
  PID:8256
- C:\Windows\System\lrbxckZ.exe
  C:\Windows\System\lrbxckZ.exe
  2⤵
  PID:8272
- C:\Windows\System\aciiOos.exe
  C:\Windows\System\aciiOos.exe
  2⤵
  PID:8288
- C:\Windows\System\hicjMli.exe
  C:\Windows\System\hicjMli.exe
  2⤵
  PID:8304
- C:\Windows\System\JsxUzXJ.exe
  C:\Windows\System\JsxUzXJ.exe
  2⤵
  PID:8320
- C:\Windows\System\cdiUrpW.exe
  C:\Windows\System\cdiUrpW.exe
  2⤵
  PID:8336
- C:\Windows\System\YVZdLSQ.exe
  C:\Windows\System\YVZdLSQ.exe
  2⤵
  PID:8352
- C:\Windows\System\TuTYpbq.exe
  C:\Windows\System\TuTYpbq.exe
  2⤵
  PID:8368
- C:\Windows\System\AkFvvbN.exe
  C:\Windows\System\AkFvvbN.exe
  2⤵
  PID:8384
- C:\Windows\System\KJbvwOp.exe
  C:\Windows\System\KJbvwOp.exe
  2⤵
  PID:8400
- C:\Windows\System\xkFkqQF.exe
  C:\Windows\System\xkFkqQF.exe
  2⤵
  PID:8416
- C:\Windows\System\qGTtoIX.exe
  C:\Windows\System\qGTtoIX.exe
  2⤵
  PID:8432
- C:\Windows\System\xftaHQc.exe
  C:\Windows\System\xftaHQc.exe
  2⤵
  PID:8448
- C:\Windows\System\cZMZTxo.exe
  C:\Windows\System\cZMZTxo.exe
  2⤵
  PID:8580
- C:\Windows\System\NMlZeKY.exe
  C:\Windows\System\NMlZeKY.exe
  2⤵
  PID:8600
- C:\Windows\System\iuVyMWc.exe
  C:\Windows\System\iuVyMWc.exe
  2⤵
  PID:8620
- C:\Windows\System\aLiptoc.exe
  C:\Windows\System\aLiptoc.exe
  2⤵
  PID:8636
- C:\Windows\System\uQTdmQB.exe
  C:\Windows\System\uQTdmQB.exe
  2⤵
  PID:8652
- C:\Windows\System\COgLgmc.exe
  C:\Windows\System\COgLgmc.exe
  2⤵
  PID:8668
- C:\Windows\System\xPxBYVz.exe
  C:\Windows\System\xPxBYVz.exe
  2⤵
  PID:8688
- C:\Windows\System\oMqImbE.exe
  C:\Windows\System\oMqImbE.exe
  2⤵
  PID:8704
- C:\Windows\System\hrLCJVY.exe
  C:\Windows\System\hrLCJVY.exe
  2⤵
  PID:8724
- C:\Windows\System\ntUkqJq.exe
  C:\Windows\System\ntUkqJq.exe
  2⤵
  PID:8740
- C:\Windows\System\QaisRhG.exe
  C:\Windows\System\QaisRhG.exe
  2⤵
  PID:8756
- C:\Windows\System\TFirqDN.exe
  C:\Windows\System\TFirqDN.exe
  2⤵
  PID:8772
- C:\Windows\System\YRoEnbr.exe
  C:\Windows\System\YRoEnbr.exe
  2⤵
  PID:8788
- C:\Windows\System\kwskerH.exe
  C:\Windows\System\kwskerH.exe
  2⤵
  PID:8804
- C:\Windows\System\xMWzVre.exe
  C:\Windows\System\xMWzVre.exe
  2⤵
  PID:8820
- C:\Windows\System\WbYxBrL.exe
  C:\Windows\System\WbYxBrL.exe
  2⤵
  PID:8836
- C:\Windows\System\nAyfxOd.exe
  C:\Windows\System\nAyfxOd.exe
  2⤵
  PID:8856
- C:\Windows\System\DsluHCT.exe
  C:\Windows\System\DsluHCT.exe
  2⤵
  PID:8876
- C:\Windows\System\vDdVFOm.exe
  C:\Windows\System\vDdVFOm.exe
  2⤵
  PID:8896
- C:\Windows\System\jNWmUnS.exe
  C:\Windows\System\jNWmUnS.exe
  2⤵
  PID:8912
- C:\Windows\System\nCAKbdg.exe
  C:\Windows\System\nCAKbdg.exe
  2⤵
  PID:8948
- C:\Windows\System\aEzAiXC.exe
  C:\Windows\System\aEzAiXC.exe
  2⤵
  PID:8972
- C:\Windows\System\rZUFiYS.exe
  C:\Windows\System\rZUFiYS.exe
  2⤵
  PID:8988
- C:\Windows\System\QjKwina.exe
  C:\Windows\System\QjKwina.exe
  2⤵
  PID:9004
- C:\Windows\System\VFtFTXJ.exe
  C:\Windows\System\VFtFTXJ.exe
  2⤵
  PID:9020
- C:\Windows\System\QWdvubc.exe
  C:\Windows\System\QWdvubc.exe
  2⤵
  PID:9036
- C:\Windows\System\IjaNUQT.exe
  C:\Windows\System\IjaNUQT.exe
  2⤵
  PID:9052
- C:\Windows\System\WvuJWjD.exe
  C:\Windows\System\WvuJWjD.exe
  2⤵
  PID:9068
- C:\Windows\System\kQDLbSU.exe
  C:\Windows\System\kQDLbSU.exe
  2⤵
  PID:9084
- C:\Windows\System\skvdrdz.exe
  C:\Windows\System\skvdrdz.exe
  2⤵
  PID:9100
- C:\Windows\System\RdtiLvD.exe
  C:\Windows\System\RdtiLvD.exe
  2⤵
  PID:9116
- C:\Windows\System\eTSMktm.exe
  C:\Windows\System\eTSMktm.exe
  2⤵
  PID:9132
- C:\Windows\System\WjXJWLO.exe
  C:\Windows\System\WjXJWLO.exe
  2⤵
  PID:9148
- C:\Windows\System\WcMdsVU.exe
  C:\Windows\System\WcMdsVU.exe
  2⤵
  PID:9168
- C:\Windows\System\aYjsHpP.exe
  C:\Windows\System\aYjsHpP.exe
  2⤵
  PID:9184
- C:\Windows\System\PETOosQ.exe
  C:\Windows\System\PETOosQ.exe
  2⤵
  PID:9200
- C:\Windows\System\ckIUhZN.exe
  C:\Windows\System\ckIUhZN.exe
  2⤵
  PID:7640
- C:\Windows\System\YCsBeNr.exe
  C:\Windows\System\YCsBeNr.exe
  2⤵
  PID:8216
- C:\Windows\System\IBOwQuO.exe
  C:\Windows\System\IBOwQuO.exe
  2⤵
  PID:8204
- C:\Windows\System\RuTZSxq.exe
  C:\Windows\System\RuTZSxq.exe
  2⤵
  PID:7900
- C:\Windows\System\TOVVPht.exe
  C:\Windows\System\TOVVPht.exe
  2⤵
  PID:7884
- C:\Windows\System\VSJPTwl.exe
  C:\Windows\System\VSJPTwl.exe
  2⤵
  PID:8312
- C:\Windows\System\SAYZthQ.exe
  C:\Windows\System\SAYZthQ.exe
  2⤵
  PID:8376
- C:\Windows\System\dCODhgJ.exe
  C:\Windows\System\dCODhgJ.exe
  2⤵
  PID:8364
- C:\Windows\System\DRVOrFo.exe
  C:\Windows\System\DRVOrFo.exe
  2⤵
  PID:8412
- C:\Windows\System\dkTQuff.exe
  C:\Windows\System\dkTQuff.exe
  2⤵
  PID:8440
- C:\Windows\System\SuCTHIJ.exe
  C:\Windows\System\SuCTHIJ.exe
  2⤵
  PID:8444
- C:\Windows\System\lAwYRZw.exe
  C:\Windows\System\lAwYRZw.exe
  2⤵
  PID:8088
- C:\Windows\System\FGMrlIx.exe
  C:\Windows\System\FGMrlIx.exe
  2⤵
  PID:8488
- C:\Windows\System\dWtwbdF.exe
  C:\Windows\System\dWtwbdF.exe
  2⤵
  PID:8508
- C:\Windows\System\GSnrsNM.exe
  C:\Windows\System\GSnrsNM.exe
  2⤵
  PID:8520
- C:\Windows\System\HIVWxtO.exe
  C:\Windows\System\HIVWxtO.exe
  2⤵
  PID:8540
- C:\Windows\System\gCeGQzl.exe
  C:\Windows\System\gCeGQzl.exe
  2⤵
  PID:8560
- C:\Windows\System\TklQQFi.exe
  C:\Windows\System\TklQQFi.exe
  2⤵
  PID:8552
- C:\Windows\System\VgvSAVG.exe
  C:\Windows\System\VgvSAVG.exe
  2⤵
  PID:8644
- C:\Windows\System\cFDoNLn.exe
  C:\Windows\System\cFDoNLn.exe
  2⤵
  PID:8680
- C:\Windows\System\duFZaxC.exe
  C:\Windows\System\duFZaxC.exe
  2⤵
  PID:8868
- C:\Windows\System\PCecbQp.exe
  C:\Windows\System\PCecbQp.exe
  2⤵
  PID:8748
- C:\Windows\System\YqwKqwA.exe
  C:\Windows\System\YqwKqwA.exe
  2⤵
  PID:8936
- C:\Windows\System\cnelKxe.exe
  C:\Windows\System\cnelKxe.exe
  2⤵
  PID:8980
- C:\Windows\System\AVbHIHf.exe
  C:\Windows\System\AVbHIHf.exe
  2⤵
  PID:9044
- C:\Windows\System\ruIblDm.exe
  C:\Windows\System\ruIblDm.exe
  2⤵
  PID:9108
- C:\Windows\System\ZaXaMWm.exe
  C:\Windows\System\ZaXaMWm.exe
  2⤵
  PID:8964
- C:\Windows\System\kaHFsxy.exe
  C:\Windows\System\kaHFsxy.exe
  2⤵
  PID:9032
- C:\Windows\System\ExCnOQm.exe
  C:\Windows\System\ExCnOQm.exe
  2⤵
  PID:9060
- C:\Windows\System\seEABAA.exe
  C:\Windows\System\seEABAA.exe
  2⤵
  PID:9164
- C:\Windows\System\SlYPPhy.exe
  C:\Windows\System\SlYPPhy.exe
  2⤵
  PID:8232
- C:\Windows\System\ipcmUNh.exe
  C:\Windows\System\ipcmUNh.exe
  2⤵
  PID:8280
- C:\Windows\System\WBntkCB.exe
  C:\Windows\System\WBntkCB.exe
  2⤵
  PID:9180
- C:\Windows\System\EpPjjkq.exe
  C:\Windows\System\EpPjjkq.exe
  2⤵
  PID:8200
- C:\Windows\System\VxUUGgz.exe
  C:\Windows\System\VxUUGgz.exe
  2⤵
  PID:8268
- C:\Windows\System\JtFydiG.exe
  C:\Windows\System\JtFydiG.exe
  2⤵
  PID:8332
- C:\Windows\System\GvGJmCO.exe
  C:\Windows\System\GvGJmCO.exe
  2⤵
  PID:8468
- C:\Windows\System\jrWbriz.exe
  C:\Windows\System\jrWbriz.exe
  2⤵
  PID:8568
- C:\Windows\System\iVDTzMU.exe
  C:\Windows\System\iVDTzMU.exe
  2⤵
  PID:8676
- C:\Windows\System\EtKlaWX.exe
  C:\Windows\System\EtKlaWX.exe
  2⤵
  PID:8548
- C:\Windows\System\ptkqfoB.exe
  C:\Windows\System\ptkqfoB.exe
  2⤵
  PID:8476
- C:\Windows\System\lQSCYyr.exe
  C:\Windows\System\lQSCYyr.exe
  2⤵
  PID:8616
- C:\Windows\System\auvYAlC.exe
  C:\Windows\System\auvYAlC.exe
  2⤵
  PID:8764
- C:\Windows\System\rinjVno.exe
  C:\Windows\System\rinjVno.exe
  2⤵
  PID:8784
- C:\Windows\System\njYuhOn.exe
  C:\Windows\System\njYuhOn.exe
  2⤵
  PID:8716
- C:\Windows\System\qvfcPeT.exe
  C:\Windows\System\qvfcPeT.exe
  2⤵
  PID:8864
- C:\Windows\System\AOcwufp.exe
  C:\Windows\System\AOcwufp.exe
  2⤵
  PID:8888
- C:\Windows\System\RaFTihh.exe
  C:\Windows\System\RaFTihh.exe
  2⤵
  PID:8700
- C:\Windows\System\eaifsRn.exe
  C:\Windows\System\eaifsRn.exe
  2⤵
  PID:8780
- C:\Windows\System\SHwCYFv.exe
  C:\Windows\System\SHwCYFv.exe
  2⤵
  PID:8940
- C:\Windows\System\XTCpTJV.exe
  C:\Windows\System\XTCpTJV.exe
  2⤵
  PID:8852
- C:\Windows\System\tWsGJhH.exe
  C:\Windows\System\tWsGJhH.exe
  2⤵
  PID:8932
- C:\Windows\System\uPGIUZF.exe
  C:\Windows\System\uPGIUZF.exe
  2⤵
  PID:9012
- C:\Windows\System\koBfOyc.exe
  C:\Windows\System\koBfOyc.exe
  2⤵
  PID:9196
- C:\Windows\System\cnxrRuo.exe
  C:\Windows\System\cnxrRuo.exe
  2⤵
  PID:8116
- C:\Windows\System\iDBACnw.exe
  C:\Windows\System\iDBACnw.exe
  2⤵
  PID:9140
- C:\Windows\System\gOfiiQD.exe
  C:\Windows\System\gOfiiQD.exe
  2⤵
  PID:8344
- C:\Windows\System\vAddwWh.exe
  C:\Windows\System\vAddwWh.exe
  2⤵
  PID:8348
- C:\Windows\System\KHZmWkH.exe
  C:\Windows\System\KHZmWkH.exe
  2⤵
  PID:8532
- C:\Windows\System\odEHdrz.exe
  C:\Windows\System\odEHdrz.exe
  2⤵
  PID:8480
- C:\Windows\System\wfCDNzD.exe
  C:\Windows\System\wfCDNzD.exe
  2⤵
  PID:8832
- C:\Windows\System\rJzbXSG.exe
  C:\Windows\System\rJzbXSG.exe
  2⤵
  PID:8528
- C:\Windows\System\SocnYil.exe
  C:\Windows\System\SocnYil.exe
  2⤵
  PID:8392
- C:\Windows\System\GNJheRv.exe
  C:\Windows\System\GNJheRv.exe
  2⤵
  PID:8752
- C:\Windows\System\cOOdANd.exe
  C:\Windows\System\cOOdANd.exe
  2⤵
  PID:7668
- C:\Windows\System\wYkYBEQ.exe
  C:\Windows\System\wYkYBEQ.exe
  2⤵
  PID:8396
- C:\Windows\System\UELgyvi.exe
  C:\Windows\System\UELgyvi.exe
  2⤵
  PID:8872
- C:\Windows\System\zZViHKV.exe
  C:\Windows\System\zZViHKV.exe
  2⤵
  PID:8500
- C:\Windows\System\WvHKiVS.exe
  C:\Windows\System\WvHKiVS.exe
  2⤵
  PID:8844
- C:\Windows\System\txhvczu.exe
  C:\Windows\System\txhvczu.exe
  2⤵
  PID:8632
- C:\Windows\System\HLKcbpQ.exe
  C:\Windows\System\HLKcbpQ.exe
  2⤵
  PID:9080
- C:\Windows\System\iOQSKQq.exe
  C:\Windows\System\iOQSKQq.exe
  2⤵
  PID:9096
- C:\Windows\System\KDxMuEb.exe
  C:\Windows\System\KDxMuEb.exe
  2⤵
  PID:8408
- C:\Windows\System\PWcYOJk.exe
  C:\Windows\System\PWcYOJk.exe
  2⤵
  PID:9220
- C:\Windows\System\gaTrcJb.exe
  C:\Windows\System\gaTrcJb.exe
  2⤵
  PID:9236
- C:\Windows\System\FnhORZD.exe
  C:\Windows\System\FnhORZD.exe
  2⤵
  PID:9252
- C:\Windows\System\dJzadBp.exe
  C:\Windows\System\dJzadBp.exe
  2⤵
  PID:9268
- C:\Windows\System\izjNmhv.exe
  C:\Windows\System\izjNmhv.exe
  2⤵
  PID:9284
- C:\Windows\System\kuucfVb.exe
  C:\Windows\System\kuucfVb.exe
  2⤵
  PID:9300
- C:\Windows\System\zPYmyPf.exe
  C:\Windows\System\zPYmyPf.exe
  2⤵
  PID:9316
- C:\Windows\System\uvzprwT.exe
  C:\Windows\System\uvzprwT.exe
  2⤵
  PID:9336
- C:\Windows\System\CufPtLt.exe
  C:\Windows\System\CufPtLt.exe
  2⤵
  PID:9352
- C:\Windows\System\VufgiTw.exe
  C:\Windows\System\VufgiTw.exe
  2⤵
  PID:9368
- C:\Windows\System\CmoBREA.exe
  C:\Windows\System\CmoBREA.exe
  2⤵
  PID:9388
- C:\Windows\System\KZeapBr.exe
  C:\Windows\System\KZeapBr.exe
  2⤵
  PID:9404
- C:\Windows\System\OFgajBB.exe
  C:\Windows\System\OFgajBB.exe
  2⤵
  PID:9420
- C:\Windows\System\jqAAvnK.exe
  C:\Windows\System\jqAAvnK.exe
  2⤵
  PID:9436
- C:\Windows\System\EjfmCjS.exe
  C:\Windows\System\EjfmCjS.exe
  2⤵
  PID:9452
- C:\Windows\System\NBkJpoc.exe
  C:\Windows\System\NBkJpoc.exe
  2⤵
  PID:9472
- C:\Windows\System\rYWhbfg.exe
  C:\Windows\System\rYWhbfg.exe
  2⤵
  PID:9488
- C:\Windows\System\QSDFFmk.exe
  C:\Windows\System\QSDFFmk.exe
  2⤵
  PID:9504
- C:\Windows\System\loHksvq.exe
  C:\Windows\System\loHksvq.exe
  2⤵
  PID:9520
- C:\Windows\System\qEXOBol.exe
  C:\Windows\System\qEXOBol.exe
  2⤵
  PID:9536
- C:\Windows\System\rxzOSlw.exe
  C:\Windows\System\rxzOSlw.exe
  2⤵
  PID:9560
- C:\Windows\System\HXpFKxo.exe
  C:\Windows\System\HXpFKxo.exe
  2⤵
  PID:9576
- C:\Windows\System\udrJphZ.exe
  C:\Windows\System\udrJphZ.exe
  2⤵
  PID:9596
- C:\Windows\System\xLYsQXE.exe
  C:\Windows\System\xLYsQXE.exe
  2⤵
  PID:9612
- C:\Windows\System\sScCSjK.exe
  C:\Windows\System\sScCSjK.exe
  2⤵
  PID:9628
- C:\Windows\System\KZQtxjm.exe
  C:\Windows\System\KZQtxjm.exe
  2⤵
  PID:9644
- C:\Windows\System\zRHwbRl.exe
  C:\Windows\System\zRHwbRl.exe
  2⤵
  PID:9660
- C:\Windows\System\CiMInJL.exe
  C:\Windows\System\CiMInJL.exe
  2⤵
  PID:9676
- C:\Windows\System\DDYwdew.exe
  C:\Windows\System\DDYwdew.exe
  2⤵
  PID:9692
- C:\Windows\System\tYaCZoW.exe
  C:\Windows\System\tYaCZoW.exe
  2⤵
  PID:9824
- C:\Windows\System\dWEIgXX.exe
  C:\Windows\System\dWEIgXX.exe
  2⤵
  PID:9840
- C:\Windows\System\XBgfpzV.exe
  C:\Windows\System\XBgfpzV.exe
  2⤵
  PID:9856
- C:\Windows\System\wLXFDaj.exe
  C:\Windows\System\wLXFDaj.exe
  2⤵
  PID:9876
- C:\Windows\System\KhBUHLG.exe
  C:\Windows\System\KhBUHLG.exe
  2⤵
  PID:9892
- C:\Windows\System\ONRldYR.exe
  C:\Windows\System\ONRldYR.exe
  2⤵
  PID:9912
- C:\Windows\System\WFgyggu.exe
  C:\Windows\System\WFgyggu.exe
  2⤵
  PID:9936
- C:\Windows\System\hPlYkJW.exe
  C:\Windows\System\hPlYkJW.exe
  2⤵
  PID:9952
- C:\Windows\System\GzhjDeA.exe
  C:\Windows\System\GzhjDeA.exe
  2⤵
  PID:9968
- C:\Windows\System\XgirNHX.exe
  C:\Windows\System\XgirNHX.exe
  2⤵
  PID:9984
- C:\Windows\System\xvJrXYk.exe
  C:\Windows\System\xvJrXYk.exe
  2⤵
  PID:10000
- C:\Windows\System\shXZFrd.exe
  C:\Windows\System\shXZFrd.exe
  2⤵
  PID:10024
- C:\Windows\System\aRgYqdT.exe
  C:\Windows\System\aRgYqdT.exe
  2⤵
  PID:10040
- C:\Windows\System\bYUkrZe.exe
  C:\Windows\System\bYUkrZe.exe
  2⤵
  PID:10064
- C:\Windows\System\hfLHdle.exe
  C:\Windows\System\hfLHdle.exe
  2⤵
  PID:10080
- C:\Windows\System\mLJuYYX.exe
  C:\Windows\System\mLJuYYX.exe
  2⤵
  PID:10096
- C:\Windows\System\CyZdtJQ.exe
  C:\Windows\System\CyZdtJQ.exe
  2⤵
  PID:10116
- C:\Windows\System\Crghnab.exe
  C:\Windows\System\Crghnab.exe
  2⤵
  PID:10132
- C:\Windows\System\LtVvOAu.exe
  C:\Windows\System\LtVvOAu.exe
  2⤵
  PID:10152
- C:\Windows\System\TeSyYde.exe
  C:\Windows\System\TeSyYde.exe
  2⤵
  PID:9280
- C:\Windows\System\WHSMeMy.exe
  C:\Windows\System\WHSMeMy.exe
  2⤵
  PID:9312
- C:\Windows\System\DSiWVdx.exe
  C:\Windows\System\DSiWVdx.exe
  2⤵
  PID:9296
- C:\Windows\System\tOEWgjE.exe
  C:\Windows\System\tOEWgjE.exe
  2⤵
  PID:9232
- C:\Windows\System\UzDsaXy.exe
  C:\Windows\System\UzDsaXy.exe
  2⤵
  PID:9348
- C:\Windows\System\gQdHdNn.exe
  C:\Windows\System\gQdHdNn.exe
  2⤵
  PID:9376
- C:\Windows\System\PbdrOZY.exe
  C:\Windows\System\PbdrOZY.exe
  2⤵
  PID:9416
- C:\Windows\System\nABcVQj.exe
  C:\Windows\System\nABcVQj.exe
  2⤵
  PID:9448
- C:\Windows\System\WhrAjsu.exe
  C:\Windows\System\WhrAjsu.exe
  2⤵
  PID:9480
- C:\Windows\System\JAJCCrN.exe
  C:\Windows\System\JAJCCrN.exe
  2⤵
  PID:9516
- C:\Windows\System\yKiWLEM.exe
  C:\Windows\System\yKiWLEM.exe
  2⤵
  PID:9548
- C:\Windows\System\yQAfMzt.exe
  C:\Windows\System\yQAfMzt.exe
  2⤵
  PID:9532
- C:\Windows\System\lNyFfRd.exe
  C:\Windows\System\lNyFfRd.exe
  2⤵
  PID:9568
- C:\Windows\System\NdbnsNJ.exe
  C:\Windows\System\NdbnsNJ.exe
  2⤵
  PID:9624
- C:\Windows\System\mAUvljO.exe
  C:\Windows\System\mAUvljO.exe
  2⤵
  PID:9684
- C:\Windows\System\ZLJLTPl.exe
  C:\Windows\System\ZLJLTPl.exe
  2⤵
  PID:8996
- C:\Windows\System\zqzBSDp.exe
  C:\Windows\System\zqzBSDp.exe
  2⤵
  PID:9716
- C:\Windows\System\zIheGyX.exe
  C:\Windows\System\zIheGyX.exe
  2⤵
  PID:9732
- C:\Windows\System\mFswYvz.exe
  C:\Windows\System\mFswYvz.exe
  2⤵
  PID:9752
- C:\Windows\System\aKpWYDq.exe
  C:\Windows\System\aKpWYDq.exe
  2⤵
  PID:9764
- C:\Windows\System\CJuESwn.exe
  C:\Windows\System\CJuESwn.exe
  2⤵
  PID:9784
- C:\Windows\System\nZHhRqb.exe
  C:\Windows\System\nZHhRqb.exe
  2⤵
  PID:9800
- C:\Windows\System\jcppQoa.exe
  C:\Windows\System\jcppQoa.exe
  2⤵
  PID:9812
- C:\Windows\System\NdIubhr.exe
  C:\Windows\System\NdIubhr.exe
  2⤵
  PID:9836
- C:\Windows\System\nIHZrCN.exe
  C:\Windows\System\nIHZrCN.exe
  2⤵
  PID:9964
- C:\Windows\System\QVLvaRF.exe
  C:\Windows\System\QVLvaRF.exe
  2⤵
  PID:10104
- C:\Windows\System\opsBurT.exe
  C:\Windows\System\opsBurT.exe
  2⤵
  PID:10160
- C:\Windows\System\qTucLbA.exe
  C:\Windows\System\qTucLbA.exe
  2⤵
  PID:10220
- C:\Windows\System\BEXqOMX.exe
  C:\Windows\System\BEXqOMX.exe
  2⤵
  PID:8828
- C:\Windows\System\YhCufHq.exe
  C:\Windows\System\YhCufHq.exe
  2⤵
  PID:2560
- C:\Windows\System\TQIMtYR.exe
  C:\Windows\System\TQIMtYR.exe
  2⤵
  PID:9360
- C:\Windows\System\KvxkYPg.exe
  C:\Windows\System\KvxkYPg.exe
  2⤵
  PID:9744
- C:\Windows\System\UwKDucS.exe
  C:\Windows\System\UwKDucS.exe
  2⤵
  PID:8608
- C:\Windows\System\KoUCgNU.exe
  C:\Windows\System\KoUCgNU.exe
  2⤵
  PID:9324
- C:\Windows\System\XlqTkCh.exe
  C:\Windows\System\XlqTkCh.exe
  2⤵
  PID:9512
- C:\Windows\System\xnmEAls.exe
  C:\Windows\System\xnmEAls.exe
  2⤵
  PID:9620
- C:\Windows\System\JeDdQVi.exe
  C:\Windows\System\JeDdQVi.exe
  2⤵
  PID:9724
- C:\Windows\System\hbUuJqf.exe
  C:\Windows\System\hbUuJqf.exe
  2⤵
  PID:9820
- C:\Windows\System\WOmOcpk.exe
  C:\Windows\System\WOmOcpk.exe
  2⤵
  PID:9872
- C:\Windows\System\duWsRwl.exe
  C:\Windows\System\duWsRwl.exe
  2⤵
  PID:9920
- C:\Windows\System\dasaIMW.exe
  C:\Windows\System\dasaIMW.exe
  2⤵
  PID:10036
- C:\Windows\System\eSEAiUs.exe
  C:\Windows\System\eSEAiUs.exe
  2⤵
  PID:10056
- C:\Windows\System\PUfnWml.exe
  C:\Windows\System\PUfnWml.exe
  2⤵
  PID:10076
- C:\Windows\System\iwckXRm.exe
  C:\Windows\System\iwckXRm.exe
  2⤵
  PID:1016
- C:\Windows\System\jAnkxCb.exe
  C:\Windows\System\jAnkxCb.exe
  2⤵
  PID:10204
- C:\Windows\System\edUNmZG.exe
  C:\Windows\System\edUNmZG.exe
  2⤵
  PID:8284
- C:\Windows\System\hlBuIcL.exe
  C:\Windows\System\hlBuIcL.exe
  2⤵
  PID:9248

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\AhUsGLh.exe

Filesize
1.9MB

MD5
87b8c9fa567769b71735a78b29af5439

SHA1
9eb467034afcf698b344471a0a3f4ed50697340a

SHA256
6469f2b9fd0fff5be88ac3ae8fdcefb92f7a7ca4d249ff85a6ca538e7c167c8b

SHA512
95c492302d2b384cfe6a8520c69c141268ad35bb463712e5db7d32f77a722d9b6b92d057efa1a32aa03c77e93855dccfebd8f908e356de268f5f54055440f759

Download Submit
C:\Windows\system\FQyydyG.exe

Filesize
1024KB

MD5
56e04114975f51a81eb2f8b9d8ea33ea

SHA1
ac5dba53fd512f53d1e0abc1a8c729217e442d4e

SHA256
435c3ca94ffe7a9adae968f5d7ee01108070cd801f8a2459300faa210a0ffa1f

SHA512
735d340f2ea4e7c759c516609f1c40201cf56fed9b0210fd7fc41286335fac00f4398b5f3de8ba5d7f2d4b357096ff14242f0aa0d52c3b174ac1e9d4c9df7e76

Download Submit
C:\Windows\system\HDKChaQ.exe

Filesize
1.9MB

MD5
3641ba37628f650f79ca90405df45595

SHA1
fb0bf55face502bec11738903d33b79a786cd713

SHA256
ec187d25f6ed4ba9a726a976e2787794fce5c221d862395ca9946ff12f634821

SHA512
794e4f97a6078bcb069245270ee4c309b84750463184787c767339f27b0f96db0604fbd556707e1a0a59da87a72a46588baf78ba43644aab96b06e5e9bd87e77

Download Submit
C:\Windows\system\IpCLuRk.exe

Filesize
1.9MB

MD5
77645d1e230ffe76addcdf5bf29d5a8d

SHA1
3c84bce876345a8d99b13c4996ebef1a3a1df3df

SHA256
cfc8d2e845f158deece03c666a70dfbc4c8eb7de740fa6c00013e6f4f4886d60

SHA512
62a1082578e2389bcbda88d8e03b49dd32186bfd21e21d98bd460838f7df59f56cdb741d66d009d19cf72cde7df333c0f3a7243bf7431be97cf847b4f430b615

Download Submit
C:\Windows\system\LufZFEj.exe

Filesize
1.9MB

MD5
9bc8a59e2c3c1505be522e47fa06448e

SHA1
6e84af6f07bbe753454364f03480e76c24f2faec

SHA256
ebdcbd7fcec3c68568cdd2046cbc1b406a5ee3599078d75a6e446dd7ca278756

SHA512
401e8b7ae2610820d289d43895da82406d52f47b01b542b845ffc9f1ce4d0fa0b9b59d3f893b19a2b18750e7bf14fbb37ba08eb52b57d4d672b89c075bb3d964

Download Submit
C:\Windows\system\MyJMSro.exe

Filesize
1.9MB

MD5
30cdae21da9e1e03226786e56daad985

SHA1
f08bdb8415bd85483c7b777fc9f81cd2cefbee25

SHA256
2e144b2358e0ae9abb022607df85c0b9d08c140b17f553bb05e0d7723158bf4b

SHA512
4115e4238935c90ae9cf801ad23dd3785b74d79abce4ad410eeb9bf92594aa8627068fc435b344d4032b582a0d858b8e8f8d0e367f7c46daa74aedcab36b0288

Download Submit
C:\Windows\system\OUKRMoV.exe

Filesize
1.9MB

MD5
d2b8d5b65cf7b998678476197784b1b1

SHA1
648ac66fc69b668a74bc802280fb5032eabc2286

SHA256
c0247817f467acee1664225a0fc14710c64c1b7165e01fbcd3cfb04ed800131d

SHA512
450056d50bf465345124bc0485887def55c9258352e4cdeba79e524a365cd37cb524d3e7f43bf1a29a84d2ec4c31b20e45ac62dd739d41422cc6d167307b8046

Download Submit
C:\Windows\system\PDPiVvZ.exe

Filesize
1.9MB

MD5
33038db73f3c28c3a08fe0dc4dce2155

SHA1
843613316c33095974865dafe124c5db93a22694

SHA256
5b96f4e66cd1f0a6bda2b2d0b1526a868f768f5816458cdcd8c21eada6d2339d

SHA512
34b3a4b36f6574ceef61cbaf323d84dc5424494c9248e54451f2909dd602da532d24c7bd862c8bd4fac8e2916a0e7efce48a784214c6ab53d4a4d4c38408e271

Download Submit
C:\Windows\system\QHvOemX.exe

Filesize
1.9MB

MD5
2c7a72ce73d1695c7496afbd85457041

SHA1
da84b6cf670cfaa696245b70cfc39fa5c6391d1d

SHA256
a09dc6e7eab9fff0ba6626d112fc7292ad37c2b8f9d6fbc2cfe58e31d4614eb0

SHA512
ed2bf7f979ce610007254101e032dd016d70659462d5114cc332985ec1a0fd05b8c8ddd5d30edd924acda0486be2d977998b9c7b760077a45e1ee76fae8948f3

Download Submit
C:\Windows\system\RxKesEC.exe

Filesize
1.9MB

MD5
a62b9d37749f31fed7f050396d729f07

SHA1
8e6cdac87a2695afa9973755c7560918f386e076

SHA256
563ea0ce3ad59d04e64d46502ec0204f80a2085ae1f80ec09270d2feaf64e918

SHA512
999749e1ed9e1864317398322bf7a063c54077a99755173faff35759b994dfa4da872b267f65e3fc8bd850a251ec2e9149439c6a69d60fa202530c93e967e2b5

Download Submit
C:\Windows\system\SmAYWvX.exe

Filesize
1.9MB

MD5
a4307e6090111b869328990d2724ac7b

SHA1
319c0d3313bb661a4437eb846ce655825a8d6221

SHA256
8fbb1ee7cd8a3133309348653d0041c04285eb3c8a41b71735ff19f2d4b678bc

SHA512
03e2efb3de81040456583d71f6c2075450f19957c5a758a17d9c4d75c4017c76dd707b0053ae7e77589fb694afcf5e9814f30974cbe3e52dda3b6c1453272cd0

Download Submit
C:\Windows\system\VMSWMfa.exe

Filesize
1.9MB

MD5
9f1a5dce1a058b18538d9b71cc9009d1

SHA1
2bd88b45bc520687ac25b3793ee9bc99da52a219

SHA256
306d9292708f2abc739c9223dd26ceaf3af36cc8c6032136539abe1112458062

SHA512
6e370a2d9d9f8ae1920545ee918ea66f2e49179e09f854afb75410edd874de9b24ca2adb57c8ed14830b85c835b621831dc9183b5a4de4f22433614d0dbda786

Download Submit
C:\Windows\system\XBcnwnU.exe

Filesize
1.9MB

MD5
e24c6e2688bfd30adbb77d090f343690

SHA1
acd5aec4e03d8ec6f473b6156a6a2cfd5f2b66d3

SHA256
3232a41e721ee40bb90349e84e5b9cc93b8a798b2be29f3f8073c5d8e491a69e

SHA512
e138ce083270eb494e2ad0b21e8b150cc23df17a741d9f92e4f7908ccdd9928580c9cac4ad492b40e7bf28347f36f35d6d6db92e68954ed097a2481668a1e9ac

Download Submit
C:\Windows\system\XIyOggH.exe

Filesize
1.9MB

MD5
efe44e0c57f51032ed149cace19ee541

SHA1
3a2b803d5e11beca525c8a6a224898ee040f900a

SHA256
5e444fb1352b0ea9f849a73628561e4939bb0782e9057eeef780077e17616a6e

SHA512
4df447be89273c970d485c46903979f41824741d055a69a350a79be5b20443fcf2384cc14977fc640a9115c329791dd04cdac3a50fd1422bc621b463b969e115

Download Submit
C:\Windows\system\ZYTsdeq.exe

Filesize
1.9MB

MD5
e1d8ec7dffd3abd36bbd94da59b28e64

SHA1
34f994aeaf6ef4e850d53e0cf1acb350afa59433

SHA256
f0f95f9f6784e26bc055e0e041ef293b3e6caaa2a33dee5dc70c198fd621034e

SHA512
0667cce6113d08c4b60067b10f82a8b21af06c7ae95b04d398a752ff8f25d31de36faffa7fad38b49d90b8f999370e3d4844f190b261719e5bb2a1750c4c2108

Download Submit
C:\Windows\system\aRsQbmT.exe

Filesize
1.9MB

MD5
31f781feba0e630bd9230edd25d4810f

SHA1
5be81e00361e9e3489b9836ef4c8b225b56a55ee

SHA256
e6005c88d3b09522b504034e28722d4884b8bac74b3bfa9d6e6b070ce0d40915

SHA512
a5889be7b5f7485a179df7e22d3ece6c1502b541f854d0ec47d613adb1ffd29d2254c63ce77f6027ac2789ea51fb7f87d0852cb39cd872dc2b42cda99d1c685c

Download Submit
C:\Windows\system\cGLRpjP.exe

Filesize
1.9MB

MD5
4b0ab04c7c8913bb6f0b92c4eeaaee0d

SHA1
07f15f9fec5176668ab5f3699077d1fb0cc5a553

SHA256
b3dca4b66b6d191570a236850fa0cc4a5c05a46d6785111c135679aee6542614

SHA512
b0def2215bb2e08a7cf35b7ebee77924e446e80dbaf27bb56c8a3e6d3c83f9907a52adf7e92b818abbaa768a1d7ad4398ec43db8d5a131f90c05034f3d5c4260

Download Submit
C:\Windows\system\eddqziD.exe

Filesize
1.9MB

MD5
0c3cbd52a4c268c78abe330a7acba141

SHA1
b6b50886cb2ffd51ec06c38d9458b34d5a4944f6

SHA256
7ec43fd0d1d52e69d0b5a71e03eb515b0f637c5da67f77c50fc95203b7288b17

SHA512
eb2b4f589004ea80cc85e571135e01a89c9c630da573bb6ac4e69c5c3f7d85774ada83eec34dc087e2d29aa93f79085bad4a56872b6fd65e6bdefe4f593b099d

Download Submit
C:\Windows\system\fDfcoBo.exe

Filesize
1.9MB

MD5
51663a9866f8412f9e7e817ac2cbb279

SHA1
4528ca48b7f9383f7ecd5822906e1cdea3799659

SHA256
4385e1c64482b2ba6ed8d0568ab10cef966af8a166fd9662dbadc0990a2eb15a

SHA512
3f6e8b7ec39f5245f1db3a5915c0a6e951aea01460dc353c5bf1127633567062589876006d5a0b777c648145ca5da8b0e2bd71f1836a47481e6a6665b694840a

Download Submit
C:\Windows\system\nwHhqHD.exe

Filesize
1.9MB

MD5
7dc62ea378fb35e5be5cecc3bed09133

SHA1
6b4dbb648fac71e12a599cbec5d611a6862d3f6d

SHA256
0f031e3a10949129b89d4bd1cf0627c70568da4727dee26e6dcbf07d9eb5f73e

SHA512
d5023e96626049c65c3abe1cbe5593748d627a74a6bbf42578841fa55b8c8ec8a6fdaacd89c2062038c439295df15bb428a8bce378777f363b8f7e597efc77b7

Download Submit
C:\Windows\system\qWGqTwe.exe

Filesize
1.9MB

MD5
16cd29ad7f6488ad7d67b4077568aa45

SHA1
946fde599a68b1301f7c9f5d8ffddab94d2ca713

SHA256
3ac0a1d3695aecfb9c62b6572bfb146a9f46f5739d2365730aad13f2760949db

SHA512
32314bc81f3613290ddd0ea9cb7b512c3107a10afdc9dfc774b177f73b51b2088c072570eab802ce0d6f42270e328ca01d87c4819b341f761aed86ed43ec0e02

Download Submit
C:\Windows\system\svLwJYh.exe

Filesize
1.9MB

MD5
8f713476e613cb5830566f869bef373b

SHA1
fca8e9d823e47e7a51a48b57fc44636f58e1b0be

SHA256
d5e70a8b6a05ceaf5e945a5aa6940b28c098baee226bb1d5440009847fa5789b

SHA512
59433778f8289ba88c83d4c9fcb698fed00462f077838e1a397d3343b3920b75d01893ca3fe0a6d23322aaef729b3d88a0e62049aa1128055328cdf2abdd2da0

Download Submit
C:\Windows\system\xFOyrND.exe

Filesize
1.6MB

MD5
ee6ab9290dc415c2a2aae15f4d319a9d

SHA1
2a8647449b2edfc93436b741dd4e04411c1f8a68

SHA256
dedeba5e61f29529c923246afd07ef6c211c30a647d91cb33877a636e08bc5bf

SHA512
7bd7e7da5cc6b09f4aae13caf05d09a8e426e4471c026f34d376300de479c45f2b88e0cb02462f396c0531943e520835db9bf9f72f1f9bae7f684f5244c75461

Download Submit
C:\Windows\system\zxRdKsa.exe

Filesize
1.9MB

MD5
cf29891c2bdf0b22208167f396a9b22f

SHA1
d7667dec756b8ee2572ea6450dd0b4a3f8a5b737

SHA256
580784351e51e16fb22eaf57c25ba9dcedb7536f42ef3aabf2f12d9574317723

SHA512
09686643875e031b9657bc766c4a2197665c73555c641b17989ddbe9757d8b9378852bd0cb3f859e051bea0f18704c3be12c721385d89311a82f38b91df6e7d8

Download Submit
\Windows\system\BRxWqbg.exe

Filesize
1.9MB

MD5
52c5a79cbc18d9cf32105d9156a6e502

SHA1
1b715d7d13f60b2e47712aff91cd901baf4d533d

SHA256
47299c81b38fbeb0ccea78780130252e9763818ec16fc9b7628721db9501a357

SHA512
65153bbc4823be35a58437788a60ca47bd4d04eb0b1f747cebce64c216527acbf1622a0ed2219e7036b705ad0d3828a66d55ed451e9d0e8b0df83376d6025970

Download Submit
\Windows\system\FQyydyG.exe

Filesize
1.9MB

MD5
67b356ae8d1df6de1b93eccaa241aed2

SHA1
8f7515c941bdbe84f0d793c53455cfd33161fc19

SHA256
937cee70d7bc630711d0664cdc2de6c0944c03986be71a8af2c9277e1f4487ba

SHA512
d220a00e1a83d446b448940686875dece3bea3953d411a352f7a9a462a1494bd19acc1142bb3d9b86fb09088944ab4b7dde5d8a183e3d1a95a60ce2847036f57

Download Submit
\Windows\system\HDKChaQ.exe

Filesize
1.5MB

MD5
f5e3ed77bc8a44696f256b21f28262db

SHA1
1ca43e7c9b0e691949ca606cbb4361e33634633a

SHA256
0e0d5d8e5dd5a482676632ddfc6be528d61c98fbd9540db344d547572db4528b

SHA512
70cef56c9ec930c0c8ecaed0e81919997b1d03e4585c3ac63ac3faf2e63995d1ec51798ead86ea82c9de2337ce340e126faf4551d654382620ed3d699a9a9b51

Download Submit
\Windows\system\IHuPBoE.exe

Filesize
1.9MB

MD5
50e9b4bbf2c83d736fdfe415a3899b9c

SHA1
1ad10ae8b8c0addb801e0e3e0ee47e52947127d0

SHA256
01ebab5ac47e4e51d2820b7c0f3e102f6e411f404c357adba33b3d831a273b89

SHA512
2149ae55feae6961df29b1255b12f0efa32ae5f62a714b33fa8eb18ccebaf21898f4d0e13d136c68f298093f41efaa60bf749bb22db1a27478ba36ee845fdb42

Download Submit
\Windows\system\UvVjWGS.exe

Filesize
1.9MB

MD5
a95f9cde1aa0468993128d1da090722b

SHA1
6ad768db6dffaca074f9d322924a42301fb98817

SHA256
dd943fb6d92c703cb769fbc970791b066d2505a4f3f382549953294128653b8e

SHA512
454bf1c06e45e69dc83ec33e1fa9e581dbfc6819f11bcc777a08743a54e0479eae65ea82838c09a526a727cb49857a3a7a5e1136425667461d898ae6cd769dcb

Download Submit
\Windows\system\WcDPFha.exe

Filesize
1.9MB

MD5
65417edf5381cae041585b82bcd29b34

SHA1
5dc7da89de5a57103d3e87249cfc9603e79e795a

SHA256
767021175c5fd35fcf0a32f5cd9177751bf7bb4bcc146925a4c0a55de6b3ebb9

SHA512
1effe52956623b664177d62ed21defddf11f4ae126c0347815949484cd0841e33e9e0def1274c0bb6ce6dff87c58dc12b7898c9d94d9086f0de1fd0b7c08dd21

Download Submit
\Windows\system\XBcnwnU.exe

Filesize
1.2MB

MD5
79280af93d358e9cddb0dd704c769973

SHA1
a365c3436004a87f5b4722b955b5d15d4c020431

SHA256
fe492aeccc915e0cf6ec4d2106f512e438c4076addae9f49a9a069b80a1dcd27

SHA512
6c574000a6a82bc330fd88227faeec0a3141f8d8ef12db1c3148da5f52be8f2870ff28e575f31c1b2bae14d1f0e178a22f4ff77963e9f9b121395f8bf328c932

Download Submit
\Windows\system\YVsuDxD.exe

Filesize
1.9MB

MD5
0ebf9a60d3cc5f4daef8d6c916e0c380

SHA1
08361a2df8731f973fb7b63166f7f3a126c4d3db

SHA256
24ebc73db290d2d0113a1f44da1bb1d033c61f3a7b90a805f9688f0b5210b195

SHA512
1897fdcbf3cf5c84a3c4fdb08b55fe1c470e25269a2c4a7b0093546d6d05432611e0f92780a675cd7a3800c284f84318b5d1ba5cb34667442b51e1ee6eabe2ed

Download Submit
\Windows\system\mSNQHaW.exe

Filesize
1.9MB

MD5
1b91d2345ad2cf9b8556cbbbdd4277d0

SHA1
d1e26a08aad5c17e738e701f1ec828aa5c70de3a

SHA256
eb5d551c1ab5c8c12c236f38dc7901ae4920c488a8d13a905f744694d68d8502

SHA512
3718da64834cb73cd2e22c93f17a3db8627da43ddbefd782fdb072f9f67e93530ab341d884ae204f38ed83ddb93e3cf1390ad2e7dc839407b5180181fe76fce1

Download Submit
\Windows\system\nwHhqHD.exe

Filesize
448KB

MD5
2264ad6cf2c3feda241e32c18cc63613

SHA1
6cf1d5079287ae747430510102276a5d8553f195

SHA256
aab1acd918f567ff34b418fd2971ffb7ad7f9284ea4d62c517c015f2e4f1d70f

SHA512
51d3f07b3e2d80ac627998a5fc071e41f8cd34e52e9d27ee547393019213fb2b53ce77d281d07d4df20e449416034194d3a784391c6fc788a552c1cba010098f

Download Submit
\Windows\system\smCPtXG.exe

Filesize
1.1MB

MD5
a093996abe7835e88584180c57950227

SHA1
f5920a542348decd0056be3a87a1ebc9c3386a7e

SHA256
93daf8ef56540f6302ad2d84984497e4b8556382a87ce404daadbc7c57d91d3e

SHA512
1242dd7797f9ae6b8802e7416446c32b2e7b0547d149b48b7c9a2d2c3f7931daf0de7c76d0b42629f664b31654b498df0ac76a74be79956db543888d1af56c75

Download Submit
\Windows\system\tjzNXLm.exe

Filesize
1.9MB

MD5
3814f1f4cb81ca7e17fb846d78cd2a4d

SHA1
e34c473f5743812f2a74e313bfa83abeba712f88

SHA256
efe0473e73f45791f193ebfccf01270872a7867628502b18277379801bc06ec8

SHA512
0fa43f23b2fa7a5bda3dd7b34ff66f7d643b06fce3eb07b225f9d8ebbde3449af22897814a0ebefb4af0575e3e786befbf1b9a6e499f70ad5f6bd47f64efe088

Download Submit
\Windows\system\xFOyrND.exe

Filesize
1.9MB

MD5
e23011f472dd6334090be845622e4152

SHA1
c8efed4498331eab88972e390137dec14882af94

SHA256
6a642ce50fce7135d685cf791ce88520f3027cdcd08e6948cbb7584e2ddc6055

SHA512
c5454d3788fe0041d6b0e7bfbe0e2f6fff1bb29d1983d46608c9f8bf9f165f4f6c30333b5b1611f5d957241cbe6406f31ab523400f6f43a60a0c3bfb2ff70296

Download Submit
memory/1744-4157-0x000000013F030000-0x000000013F422000-memory.dmp

Filesize
3.9MB

Download
memory/1744-17-0x000000013F030000-0x000000013F422000-memory.dmp

Filesize
3.9MB

Download
memory/1756-89-0x000000013F4A0000-0x000000013F892000-memory.dmp

Filesize
3.9MB

Download
memory/1756-4269-0x000000013F4A0000-0x000000013F892000-memory.dmp

Filesize
3.9MB

Download
memory/1760-60-0x000007FEF5910000-0x000007FEF62AD000-memory.dmp

Filesize
9.6MB

Download
memory/1760-18-0x0000000002920000-0x00000000029A0000-memory.dmp

Filesize
512KB

Download
memory/1760-19-0x000007FEF5BCE000-0x000007FEF5BCF000-memory.dmp

Filesize
4KB

Download
memory/1760-26-0x000000001B6F0000-0x000000001B9D2000-memory.dmp

Filesize
2.9MB

Download
memory/1760-28-0x0000000002040000-0x0000000002048000-memory.dmp

Filesize
32KB

Download
memory/1760-65-0x000007FEF5910000-0x000007FEF62AD000-memory.dmp

Filesize
9.6MB

Download
memory/1760-76-0x000007FEF5910000-0x000007FEF62AD000-memory.dmp

Filesize
9.6MB

Download
memory/1760-83-0x000007FEF5910000-0x000007FEF62AD000-memory.dmp

Filesize
9.6MB

Download
memory/2248-90-0x000000013FDE0000-0x00000001401D2000-memory.dmp

Filesize
3.9MB

Download
memory/2248-6514-0x0000000003530000-0x0000000003922000-memory.dmp

Filesize
3.9MB

Download
memory/2248-6606-0x0000000003530000-0x0000000003922000-memory.dmp

Filesize
3.9MB

Download
memory/2248-85-0x0000000003530000-0x0000000003922000-memory.dmp

Filesize
3.9MB

Download
memory/2248-84-0x000000013FF50000-0x0000000140342000-memory.dmp

Filesize
3.9MB

Download
memory/2248-6595-0x000000013FEA0000-0x0000000140292000-memory.dmp

Filesize
3.9MB

Download
memory/2248-82-0x000000013F050000-0x000000013F442000-memory.dmp

Filesize
3.9MB

Download
memory/2248-81-0x000000013FA60000-0x000000013FE52000-memory.dmp

Filesize
3.9MB

Download
memory/2248-6516-0x0000000003530000-0x0000000003922000-memory.dmp

Filesize
3.9MB

Download
memory/2248-2-0x000000013F460000-0x000000013F852000-memory.dmp

Filesize
3.9MB

Download
memory/2248-6515-0x000000013FDE0000-0x00000001401D2000-memory.dmp

Filesize
3.9MB

Download
memory/2248-95-0x000000013FFB0000-0x00000001403A2000-memory.dmp

Filesize
3.9MB

Download
memory/2248-6487-0x000000013F9A0000-0x000000013FD92000-memory.dmp

Filesize
3.9MB

Download
memory/2248-93-0x0000000003530000-0x0000000003922000-memory.dmp

Filesize
3.9MB

Download
memory/2248-5923-0x000000013F460000-0x000000013F852000-memory.dmp

Filesize
3.9MB

Download
memory/2248-78-0x000000013FEE0000-0x00000001402D2000-memory.dmp

Filesize
3.9MB

Download
memory/2248-0-0x00000000001F0000-0x0000000000200000-memory.dmp

Filesize
64KB

Download
memory/2248-12-0x000000013F030000-0x000000013F422000-memory.dmp

Filesize
3.9MB

Download
memory/2248-97-0x0000000003530000-0x0000000003922000-memory.dmp

Filesize
3.9MB

Download
memory/2248-96-0x000000013FEA0000-0x0000000140292000-memory.dmp

Filesize
3.9MB

Download
memory/2248-20-0x000000013F9A0000-0x000000013FD92000-memory.dmp

Filesize
3.9MB

Download
memory/2400-4267-0x000000013F050000-0x000000013F442000-memory.dmp

Filesize
3.9MB

Download
memory/2400-86-0x000000013F050000-0x000000013F442000-memory.dmp

Filesize
3.9MB

Download
memory/2520-87-0x000000013FA60000-0x000000013FE52000-memory.dmp

Filesize
3.9MB

Download
memory/2624-67-0x000000013FFB0000-0x00000001403A2000-memory.dmp

Filesize
3.9MB

Download
memory/2652-80-0x000000013FEE0000-0x00000001402D2000-memory.dmp

Filesize
3.9MB

Download
memory/2656-4239-0x000000013FF50000-0x0000000140342000-memory.dmp

Filesize
3.9MB

Download
memory/2656-88-0x000000013FF50000-0x0000000140342000-memory.dmp

Filesize
3.9MB

Download
memory/2736-22-0x000000013F9A0000-0x000000013FD92000-memory.dmp

Filesize
3.9MB

Download
memory/2840-98-0x000000013F2D0000-0x000000013F6C2000-memory.dmp

Filesize
3.9MB

Download
memory/2844-94-0x000000013F590000-0x000000013F982000-memory.dmp

Filesize
3.9MB

Download
memory/3020-91-0x000000013FDE0000-0x00000001401D2000-memory.dmp

Filesize
3.9MB

Download
memory/3060-4291-0x000000013FEA0000-0x0000000140292000-memory.dmp

Filesize
3.9MB

Download
memory/3060-92-0x000000013FEA0000-0x0000000140292000-memory.dmp

Filesize
3.9MB

Download