xmrig | 1b93f3e613bdcc8ed06c254c1558617234ca0da586dd106850520b3615615a68

Analysis

max time kernel
150s
max time network
151s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
05/06/2024, 07:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

48954448f00ae43f3cefc4ef63367d80_NeikiAnalytics.exe
Size

1.8MB
MD5

48954448f00ae43f3cefc4ef63367d80
SHA1

0a79225041e39bee036fe1cb5d449b648ef220a4
SHA256

1b93f3e613bdcc8ed06c254c1558617234ca0da586dd106850520b3615615a68
SHA512

fefa15ef83a5f9b7e94f2b4d600c5f36055ac3af7ba6e4e28c963ac719a583c4a251d5742143a4329207364e8b7cbb0997e61548b9394ad1d66293d34f741388
SSDEEP

24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjpbc8nJwbomvu2Nrlum7+a7EtLgCPimzh:Lz071uv4BPMkHC0IBcAUNRSa7kj5z9oY

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 18 IoCs

miner

resource	yara_rule
behavioral1/memory/300-13-0x000000013F0F0000-0x000000013F4E2000-memory.dmp	xmrig
behavioral1/memory/2556-86-0x000000013F600000-0x000000013F9F2000-memory.dmp	xmrig
behavioral1/memory/2664-83-0x000000013F3A0000-0x000000013F792000-memory.dmp	xmrig
behavioral1/memory/2544-80-0x000000013F6A0000-0x000000013FA92000-memory.dmp	xmrig
behavioral1/memory/1432-115-0x000000013FE90000-0x0000000140282000-memory.dmp	xmrig
behavioral1/memory/2088-111-0x000000013FEF0000-0x00000001402E2000-memory.dmp	xmrig
behavioral1/memory/2500-107-0x000000013FA50000-0x000000013FE42000-memory.dmp	xmrig
behavioral1/memory/2492-102-0x000000013FCA0000-0x0000000140092000-memory.dmp	xmrig
behavioral1/memory/2812-93-0x000000013FDC0000-0x00000001401B2000-memory.dmp	xmrig
behavioral1/memory/300-6564-0x000000013F0F0000-0x000000013F4E2000-memory.dmp	xmrig
behavioral1/memory/2544-6565-0x000000013F6A0000-0x000000013FA92000-memory.dmp	xmrig
behavioral1/memory/1432-6641-0x000000013FE90000-0x0000000140282000-memory.dmp	xmrig
behavioral1/memory/2492-6643-0x000000013FCA0000-0x0000000140092000-memory.dmp	xmrig
behavioral1/memory/2500-6647-0x000000013FA50000-0x000000013FE42000-memory.dmp	xmrig
behavioral1/memory/2812-6646-0x000000013FDC0000-0x00000001401B2000-memory.dmp	xmrig
behavioral1/memory/2088-6645-0x000000013FEF0000-0x00000001402E2000-memory.dmp	xmrig
behavioral1/memory/2556-6644-0x000000013F600000-0x000000013F9F2000-memory.dmp	xmrig
behavioral1/memory/2944-13519-0x000000013F210000-0x000000013F602000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
3056	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
300	MwvmAML.exe
2544	HqZVabd.exe
2664	XzaGZFz.exe
2556	cOmzrmZ.exe
2812	nOgYqax.exe
2492	XRsQxgo.exe
2500	DROkXoi.exe
2088	uFkTqkt.exe
1432	PDrfhhZ.exe
2728	RIANuoM.exe
2472	dfWPhnv.exe
2604	gbMDeKH.exe
2000	NgoRcZm.exe
2452	QpDIfvc.exe
3000	gfccxmZ.exe
1796	oUnENgU.exe
2968	rhsFYqF.exe
2820	ymeZFgM.exe
2800	IxfBbeF.exe
1428	OKHXLqc.exe
2120	SwHslig.exe
1892	sodZWQX.exe
324	HPyWnba.exe
1512	aYnozhX.exe
1724	RhNaOvy.exe
488	FTfbYKo.exe
1996	MdOgLxu.exe
344	SsgwhNn.exe
384	xgECKKk.exe
2256	CNufDxO.exe
1280	qXpHWwu.exe
2168	cTnSZbB.exe
1060	FKmjbhI.exe
2340	uXijzal.exe
1548	QoQgrgD.exe
1876	KSGSlyN.exe
472	hKBQWUN.exe
612	lPxUYMt.exe
764	rpwHJsb.exe
1496	ePjXxFu.exe
1392	FXzAPzO.exe
2252	rjkgFAV.exe
908	pLizJuq.exe
1592	hknpYXI.exe
1572	gSrtmPN.exe
1036	CHsuXRY.exe
992	cPLOcWg.exe
884	BQTJcOJ.exe
2532	KHJyEIs.exe
2204	jnuiptz.exe
1600	zuEfkcj.exe
2756	PDPYNzq.exe
2668	OtMkVsx.exe
2440	eRScuCu.exe
2564	NTUQUXZ.exe
3068	siwyOmK.exe
2504	cuHvSDZ.exe
840	VnpVezn.exe
1636	BZBhyzz.exe
1648	EwjqGMU.exe
2960	DuobQRy.exe
1396	DGxUrAI.exe
844	TVXlrCN.exe
1292	FiCGqDO.exe

Loads dropped DLL 64 IoCs

pid	Process
2944	48954448f00ae43f3cefc4ef63367d80_NeikiAnalytics.exe
2944	48954448f00ae43f3cefc4ef63367d80_NeikiAnalytics.exe
2944	48954448f00ae43f3cefc4ef63367d80_NeikiAnalytics.exe
2944	48954448f00ae43f3cefc4ef63367d80_NeikiAnalytics.exe
2944	48954448f00ae43f3cefc4ef63367d80_NeikiAnalytics.exe
2944	48954448f00ae43f3cefc4ef63367d80_NeikiAnalytics.exe
2944	48954448f00ae43f3cefc4ef63367d80_NeikiAnalytics.exe
2944	48954448f00ae43f3cefc4ef63367d80_NeikiAnalytics.exe
2944	48954448f00ae43f3cefc4ef63367d80_NeikiAnalytics.exe
2944	48954448f00ae43f3cefc4ef63367d80_NeikiAnalytics.exe
2944	48954448f00ae43f3cefc4ef63367d80_NeikiAnalytics.exe
2944	48954448f00ae43f3cefc4ef63367d80_NeikiAnalytics.exe
2944	48954448f00ae43f3cefc4ef63367d80_NeikiAnalytics.exe
2944	48954448f00ae43f3cefc4ef63367d80_NeikiAnalytics.exe
2944	48954448f00ae43f3cefc4ef63367d80_NeikiAnalytics.exe
2944	48954448f00ae43f3cefc4ef63367d80_NeikiAnalytics.exe
2944	48954448f00ae43f3cefc4ef63367d80_NeikiAnalytics.exe
2944	48954448f00ae43f3cefc4ef63367d80_NeikiAnalytics.exe
2944	48954448f00ae43f3cefc4ef63367d80_NeikiAnalytics.exe
2944	48954448f00ae43f3cefc4ef63367d80_NeikiAnalytics.exe
2944	48954448f00ae43f3cefc4ef63367d80_NeikiAnalytics.exe
2944	48954448f00ae43f3cefc4ef63367d80_NeikiAnalytics.exe
2944	48954448f00ae43f3cefc4ef63367d80_NeikiAnalytics.exe
2944	48954448f00ae43f3cefc4ef63367d80_NeikiAnalytics.exe
2944	48954448f00ae43f3cefc4ef63367d80_NeikiAnalytics.exe
2944	48954448f00ae43f3cefc4ef63367d80_NeikiAnalytics.exe
2944	48954448f00ae43f3cefc4ef63367d80_NeikiAnalytics.exe
2944	48954448f00ae43f3cefc4ef63367d80_NeikiAnalytics.exe
2944	48954448f00ae43f3cefc4ef63367d80_NeikiAnalytics.exe
2944	48954448f00ae43f3cefc4ef63367d80_NeikiAnalytics.exe
2944	48954448f00ae43f3cefc4ef63367d80_NeikiAnalytics.exe
2944	48954448f00ae43f3cefc4ef63367d80_NeikiAnalytics.exe
2944	48954448f00ae43f3cefc4ef63367d80_NeikiAnalytics.exe
2944	48954448f00ae43f3cefc4ef63367d80_NeikiAnalytics.exe
2944	48954448f00ae43f3cefc4ef63367d80_NeikiAnalytics.exe
2944	48954448f00ae43f3cefc4ef63367d80_NeikiAnalytics.exe
2944	48954448f00ae43f3cefc4ef63367d80_NeikiAnalytics.exe
2944	48954448f00ae43f3cefc4ef63367d80_NeikiAnalytics.exe
2944	48954448f00ae43f3cefc4ef63367d80_NeikiAnalytics.exe
2944	48954448f00ae43f3cefc4ef63367d80_NeikiAnalytics.exe
2944	48954448f00ae43f3cefc4ef63367d80_NeikiAnalytics.exe
2944	48954448f00ae43f3cefc4ef63367d80_NeikiAnalytics.exe
2944	48954448f00ae43f3cefc4ef63367d80_NeikiAnalytics.exe
2944	48954448f00ae43f3cefc4ef63367d80_NeikiAnalytics.exe
2944	48954448f00ae43f3cefc4ef63367d80_NeikiAnalytics.exe
2944	48954448f00ae43f3cefc4ef63367d80_NeikiAnalytics.exe
2944	48954448f00ae43f3cefc4ef63367d80_NeikiAnalytics.exe
2944	48954448f00ae43f3cefc4ef63367d80_NeikiAnalytics.exe
2944	48954448f00ae43f3cefc4ef63367d80_NeikiAnalytics.exe
2944	48954448f00ae43f3cefc4ef63367d80_NeikiAnalytics.exe
2944	48954448f00ae43f3cefc4ef63367d80_NeikiAnalytics.exe
2944	48954448f00ae43f3cefc4ef63367d80_NeikiAnalytics.exe
2944	48954448f00ae43f3cefc4ef63367d80_NeikiAnalytics.exe
2944	48954448f00ae43f3cefc4ef63367d80_NeikiAnalytics.exe
2944	48954448f00ae43f3cefc4ef63367d80_NeikiAnalytics.exe
2944	48954448f00ae43f3cefc4ef63367d80_NeikiAnalytics.exe
2944	48954448f00ae43f3cefc4ef63367d80_NeikiAnalytics.exe
2944	48954448f00ae43f3cefc4ef63367d80_NeikiAnalytics.exe
2944	48954448f00ae43f3cefc4ef63367d80_NeikiAnalytics.exe
2944	48954448f00ae43f3cefc4ef63367d80_NeikiAnalytics.exe
2944	48954448f00ae43f3cefc4ef63367d80_NeikiAnalytics.exe
2944	48954448f00ae43f3cefc4ef63367d80_NeikiAnalytics.exe
2944	48954448f00ae43f3cefc4ef63367d80_NeikiAnalytics.exe
2944	48954448f00ae43f3cefc4ef63367d80_NeikiAnalytics.exe

UPX packed file 52 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2944-2-0x000000013F210000-0x000000013F602000-memory.dmp	upx
behavioral1/files/0x000b000000014284-6.dat	upx
behavioral1/files/0x002d0000000144e9-19.dat	upx
behavioral1/files/0x001400000000549e-18.dat	upx
behavioral1/memory/300-13-0x000000013F0F0000-0x000000013F4E2000-memory.dmp	upx
behavioral1/files/0x0007000000014817-31.dat	upx
behavioral1/files/0x0009000000014b12-38.dat	upx
behavioral1/files/0x0006000000015c7c-47.dat	upx
behavioral1/files/0x0006000000015c9c-52.dat	upx
behavioral1/files/0x0006000000015cc1-68.dat	upx
behavioral1/files/0x0007000000015c6d-42.dat	upx
behavioral1/files/0x0007000000014983-35.dat	upx
behavioral1/files/0x000800000001470b-28.dat	upx
behavioral1/files/0x0006000000015d6e-143.dat	upx
behavioral1/files/0x0006000000015cca-123.dat	upx
behavioral1/files/0x0006000000015cf7-131.dat	upx
behavioral1/files/0x0006000000016597-187.dat	upx
behavioral1/files/0x0006000000016525-181.dat	upx
behavioral1/files/0x00060000000167ef-193.dat	upx
behavioral1/files/0x0006000000016a45-196.dat	upx
behavioral1/files/0x0006000000016277-175.dat	upx
behavioral1/files/0x0006000000016056-167.dat	upx
behavioral1/files/0x0006000000016411-180.dat	upx
behavioral1/files/0x00060000000160f8-171.dat	upx
behavioral1/files/0x0006000000015f1b-147.dat	upx
behavioral1/files/0x0006000000015d5d-138.dat	upx
behavioral1/files/0x002c00000001450b-129.dat	upx
behavioral1/files/0x0006000000015cec-125.dat	upx
behavioral1/files/0x0006000000015f9e-157.dat	upx
behavioral1/memory/2556-86-0x000000013F600000-0x000000013F9F2000-memory.dmp	upx
behavioral1/memory/2664-83-0x000000013F3A0000-0x000000013F792000-memory.dmp	upx
behavioral1/memory/2544-80-0x000000013F6A0000-0x000000013FA92000-memory.dmp	upx
behavioral1/files/0x0006000000015d06-135.dat	upx
behavioral1/files/0x0006000000015cb9-117.dat	upx
behavioral1/memory/1432-115-0x000000013FE90000-0x0000000140282000-memory.dmp	upx
behavioral1/files/0x0006000000015ca5-112.dat	upx
behavioral1/memory/2088-111-0x000000013FEF0000-0x00000001402E2000-memory.dmp	upx
behavioral1/memory/2500-107-0x000000013FA50000-0x000000013FE42000-memory.dmp	upx
behavioral1/files/0x0006000000015c86-103.dat	upx
behavioral1/memory/2492-102-0x000000013FCA0000-0x0000000140092000-memory.dmp	upx
behavioral1/files/0x0006000000015cdb-100.dat	upx
behavioral1/memory/2812-93-0x000000013FDC0000-0x00000001401B2000-memory.dmp	upx
behavioral1/files/0x0006000000015cad-61.dat	upx
behavioral1/memory/300-6564-0x000000013F0F0000-0x000000013F4E2000-memory.dmp	upx
behavioral1/memory/2544-6565-0x000000013F6A0000-0x000000013FA92000-memory.dmp	upx
behavioral1/memory/1432-6641-0x000000013FE90000-0x0000000140282000-memory.dmp	upx
behavioral1/memory/2492-6643-0x000000013FCA0000-0x0000000140092000-memory.dmp	upx
behavioral1/memory/2500-6647-0x000000013FA50000-0x000000013FE42000-memory.dmp	upx
behavioral1/memory/2812-6646-0x000000013FDC0000-0x00000001401B2000-memory.dmp	upx
behavioral1/memory/2088-6645-0x000000013FEF0000-0x00000001402E2000-memory.dmp	upx
behavioral1/memory/2556-6644-0x000000013F600000-0x000000013F9F2000-memory.dmp	upx
behavioral1/memory/2944-13519-0x000000013F210000-0x000000013F602000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\YMnfNXL.exe	48954448f00ae43f3cefc4ef63367d80_NeikiAnalytics.exe
File created	C:\Windows\System\xexqQWu.exe	48954448f00ae43f3cefc4ef63367d80_NeikiAnalytics.exe
File created	C:\Windows\System\XBaCClF.exe	48954448f00ae43f3cefc4ef63367d80_NeikiAnalytics.exe
File created	C:\Windows\System\vnAwsyz.exe	48954448f00ae43f3cefc4ef63367d80_NeikiAnalytics.exe
File created	C:\Windows\System\IbPsyjt.exe	48954448f00ae43f3cefc4ef63367d80_NeikiAnalytics.exe
File created	C:\Windows\System\ipbtVEC.exe	48954448f00ae43f3cefc4ef63367d80_NeikiAnalytics.exe
File created	C:\Windows\System\FGyGUGE.exe	48954448f00ae43f3cefc4ef63367d80_NeikiAnalytics.exe
File created	C:\Windows\System\kckbuvd.exe	48954448f00ae43f3cefc4ef63367d80_NeikiAnalytics.exe
File created	C:\Windows\System\ijFStlI.exe	48954448f00ae43f3cefc4ef63367d80_NeikiAnalytics.exe
File created	C:\Windows\System\NACdAVN.exe	48954448f00ae43f3cefc4ef63367d80_NeikiAnalytics.exe
File created	C:\Windows\System\GzHmqhU.exe	48954448f00ae43f3cefc4ef63367d80_NeikiAnalytics.exe
File created	C:\Windows\System\eZHFTuU.exe	48954448f00ae43f3cefc4ef63367d80_NeikiAnalytics.exe
File created	C:\Windows\System\wUFxsbN.exe	48954448f00ae43f3cefc4ef63367d80_NeikiAnalytics.exe
File created	C:\Windows\System\QgkmwAx.exe	48954448f00ae43f3cefc4ef63367d80_NeikiAnalytics.exe
File created	C:\Windows\System\rsBoJTV.exe	48954448f00ae43f3cefc4ef63367d80_NeikiAnalytics.exe
File created	C:\Windows\System\QVhtOXm.exe	48954448f00ae43f3cefc4ef63367d80_NeikiAnalytics.exe
File created	C:\Windows\System\quxosZD.exe	48954448f00ae43f3cefc4ef63367d80_NeikiAnalytics.exe
File created	C:\Windows\System\JlFhncD.exe	48954448f00ae43f3cefc4ef63367d80_NeikiAnalytics.exe
File created	C:\Windows\System\tPSKqYf.exe	48954448f00ae43f3cefc4ef63367d80_NeikiAnalytics.exe
File created	C:\Windows\System\DvXDPFj.exe	48954448f00ae43f3cefc4ef63367d80_NeikiAnalytics.exe
File created	C:\Windows\System\XygdSGc.exe	48954448f00ae43f3cefc4ef63367d80_NeikiAnalytics.exe
File created	C:\Windows\System\Xmhixwm.exe	48954448f00ae43f3cefc4ef63367d80_NeikiAnalytics.exe
File created	C:\Windows\System\aWMFRyp.exe	48954448f00ae43f3cefc4ef63367d80_NeikiAnalytics.exe
File created	C:\Windows\System\jImxnRX.exe	48954448f00ae43f3cefc4ef63367d80_NeikiAnalytics.exe
File created	C:\Windows\System\IbNaIXp.exe	48954448f00ae43f3cefc4ef63367d80_NeikiAnalytics.exe
File created	C:\Windows\System\uNNqYoK.exe	48954448f00ae43f3cefc4ef63367d80_NeikiAnalytics.exe
File created	C:\Windows\System\FucgvDw.exe	48954448f00ae43f3cefc4ef63367d80_NeikiAnalytics.exe
File created	C:\Windows\System\FIybiTM.exe	48954448f00ae43f3cefc4ef63367d80_NeikiAnalytics.exe
File created	C:\Windows\System\uqrLmsQ.exe	48954448f00ae43f3cefc4ef63367d80_NeikiAnalytics.exe
File created	C:\Windows\System\DtikltJ.exe	48954448f00ae43f3cefc4ef63367d80_NeikiAnalytics.exe
File created	C:\Windows\System\vFsUNqA.exe	48954448f00ae43f3cefc4ef63367d80_NeikiAnalytics.exe
File created	C:\Windows\System\zoLttER.exe	48954448f00ae43f3cefc4ef63367d80_NeikiAnalytics.exe
File created	C:\Windows\System\JHnIidn.exe	48954448f00ae43f3cefc4ef63367d80_NeikiAnalytics.exe
File created	C:\Windows\System\YUMDOcz.exe	48954448f00ae43f3cefc4ef63367d80_NeikiAnalytics.exe
File created	C:\Windows\System\IMURseH.exe	48954448f00ae43f3cefc4ef63367d80_NeikiAnalytics.exe
File created	C:\Windows\System\YwqNcyk.exe	48954448f00ae43f3cefc4ef63367d80_NeikiAnalytics.exe
File created	C:\Windows\System\vzyUpaX.exe	48954448f00ae43f3cefc4ef63367d80_NeikiAnalytics.exe
File created	C:\Windows\System\WsLjDmB.exe	48954448f00ae43f3cefc4ef63367d80_NeikiAnalytics.exe
File created	C:\Windows\System\GbQQrwW.exe	48954448f00ae43f3cefc4ef63367d80_NeikiAnalytics.exe
File created	C:\Windows\System\Lexmtax.exe	48954448f00ae43f3cefc4ef63367d80_NeikiAnalytics.exe
File created	C:\Windows\System\XhHDCfy.exe	48954448f00ae43f3cefc4ef63367d80_NeikiAnalytics.exe
File created	C:\Windows\System\lWEiJHa.exe	48954448f00ae43f3cefc4ef63367d80_NeikiAnalytics.exe
File created	C:\Windows\System\ZBapfNz.exe	48954448f00ae43f3cefc4ef63367d80_NeikiAnalytics.exe
File created	C:\Windows\System\GbJXROU.exe	48954448f00ae43f3cefc4ef63367d80_NeikiAnalytics.exe
File created	C:\Windows\System\xbMUiFM.exe	48954448f00ae43f3cefc4ef63367d80_NeikiAnalytics.exe
File created	C:\Windows\System\JkVBnYW.exe	48954448f00ae43f3cefc4ef63367d80_NeikiAnalytics.exe
File created	C:\Windows\System\gkSgQKH.exe	48954448f00ae43f3cefc4ef63367d80_NeikiAnalytics.exe
File created	C:\Windows\System\UCmAGHD.exe	48954448f00ae43f3cefc4ef63367d80_NeikiAnalytics.exe
File created	C:\Windows\System\KmnvJUH.exe	48954448f00ae43f3cefc4ef63367d80_NeikiAnalytics.exe
File created	C:\Windows\System\KlXxkiM.exe	48954448f00ae43f3cefc4ef63367d80_NeikiAnalytics.exe
File created	C:\Windows\System\EqzBAZC.exe	48954448f00ae43f3cefc4ef63367d80_NeikiAnalytics.exe
File created	C:\Windows\System\bFOgmzg.exe	48954448f00ae43f3cefc4ef63367d80_NeikiAnalytics.exe
File created	C:\Windows\System\XSKYVPz.exe	48954448f00ae43f3cefc4ef63367d80_NeikiAnalytics.exe
File created	C:\Windows\System\MRbFzbO.exe	48954448f00ae43f3cefc4ef63367d80_NeikiAnalytics.exe
File created	C:\Windows\System\FRUCyOy.exe	48954448f00ae43f3cefc4ef63367d80_NeikiAnalytics.exe
File created	C:\Windows\System\JfgwtWz.exe	48954448f00ae43f3cefc4ef63367d80_NeikiAnalytics.exe
File created	C:\Windows\System\GVpccXI.exe	48954448f00ae43f3cefc4ef63367d80_NeikiAnalytics.exe
File created	C:\Windows\System\LbKAhCQ.exe	48954448f00ae43f3cefc4ef63367d80_NeikiAnalytics.exe
File created	C:\Windows\System\ysVEOoJ.exe	48954448f00ae43f3cefc4ef63367d80_NeikiAnalytics.exe
File created	C:\Windows\System\wvFXXVS.exe	48954448f00ae43f3cefc4ef63367d80_NeikiAnalytics.exe
File created	C:\Windows\System\umSkplS.exe	48954448f00ae43f3cefc4ef63367d80_NeikiAnalytics.exe
File created	C:\Windows\System\OoatySD.exe	48954448f00ae43f3cefc4ef63367d80_NeikiAnalytics.exe
File created	C:\Windows\System\AfRsACY.exe	48954448f00ae43f3cefc4ef63367d80_NeikiAnalytics.exe
File created	C:\Windows\System\JabIaNo.exe	48954448f00ae43f3cefc4ef63367d80_NeikiAnalytics.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
3056	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2944	48954448f00ae43f3cefc4ef63367d80_NeikiAnalytics.exe
Token: SeDebugPrivilege	3056	powershell.exe
Token: SeLockMemoryPrivilege	2944	48954448f00ae43f3cefc4ef63367d80_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2944 wrote to memory of 3056	2944	48954448f00ae43f3cefc4ef63367d80_NeikiAnalytics.exe	29
PID 2944 wrote to memory of 3056	2944	48954448f00ae43f3cefc4ef63367d80_NeikiAnalytics.exe	29
PID 2944 wrote to memory of 3056	2944	48954448f00ae43f3cefc4ef63367d80_NeikiAnalytics.exe	29
PID 2944 wrote to memory of 300	2944	48954448f00ae43f3cefc4ef63367d80_NeikiAnalytics.exe	30
PID 2944 wrote to memory of 300	2944	48954448f00ae43f3cefc4ef63367d80_NeikiAnalytics.exe	30
PID 2944 wrote to memory of 300	2944	48954448f00ae43f3cefc4ef63367d80_NeikiAnalytics.exe	30
PID 2944 wrote to memory of 2544	2944	48954448f00ae43f3cefc4ef63367d80_NeikiAnalytics.exe	31
PID 2944 wrote to memory of 2544	2944	48954448f00ae43f3cefc4ef63367d80_NeikiAnalytics.exe	31
PID 2944 wrote to memory of 2544	2944	48954448f00ae43f3cefc4ef63367d80_NeikiAnalytics.exe	31
PID 2944 wrote to memory of 2664	2944	48954448f00ae43f3cefc4ef63367d80_NeikiAnalytics.exe	32
PID 2944 wrote to memory of 2664	2944	48954448f00ae43f3cefc4ef63367d80_NeikiAnalytics.exe	32
PID 2944 wrote to memory of 2664	2944	48954448f00ae43f3cefc4ef63367d80_NeikiAnalytics.exe	32
PID 2944 wrote to memory of 2728	2944	48954448f00ae43f3cefc4ef63367d80_NeikiAnalytics.exe	33
PID 2944 wrote to memory of 2728	2944	48954448f00ae43f3cefc4ef63367d80_NeikiAnalytics.exe	33
PID 2944 wrote to memory of 2728	2944	48954448f00ae43f3cefc4ef63367d80_NeikiAnalytics.exe	33
PID 2944 wrote to memory of 2556	2944	48954448f00ae43f3cefc4ef63367d80_NeikiAnalytics.exe	34
PID 2944 wrote to memory of 2556	2944	48954448f00ae43f3cefc4ef63367d80_NeikiAnalytics.exe	34
PID 2944 wrote to memory of 2556	2944	48954448f00ae43f3cefc4ef63367d80_NeikiAnalytics.exe	34
PID 2944 wrote to memory of 2472	2944	48954448f00ae43f3cefc4ef63367d80_NeikiAnalytics.exe	35
PID 2944 wrote to memory of 2472	2944	48954448f00ae43f3cefc4ef63367d80_NeikiAnalytics.exe	35
PID 2944 wrote to memory of 2472	2944	48954448f00ae43f3cefc4ef63367d80_NeikiAnalytics.exe	35
PID 2944 wrote to memory of 2812	2944	48954448f00ae43f3cefc4ef63367d80_NeikiAnalytics.exe	36
PID 2944 wrote to memory of 2812	2944	48954448f00ae43f3cefc4ef63367d80_NeikiAnalytics.exe	36
PID 2944 wrote to memory of 2812	2944	48954448f00ae43f3cefc4ef63367d80_NeikiAnalytics.exe	36
PID 2944 wrote to memory of 2604	2944	48954448f00ae43f3cefc4ef63367d80_NeikiAnalytics.exe	37
PID 2944 wrote to memory of 2604	2944	48954448f00ae43f3cefc4ef63367d80_NeikiAnalytics.exe	37
PID 2944 wrote to memory of 2604	2944	48954448f00ae43f3cefc4ef63367d80_NeikiAnalytics.exe	37
PID 2944 wrote to memory of 2492	2944	48954448f00ae43f3cefc4ef63367d80_NeikiAnalytics.exe	38
PID 2944 wrote to memory of 2492	2944	48954448f00ae43f3cefc4ef63367d80_NeikiAnalytics.exe	38
PID 2944 wrote to memory of 2492	2944	48954448f00ae43f3cefc4ef63367d80_NeikiAnalytics.exe	38
PID 2944 wrote to memory of 2452	2944	48954448f00ae43f3cefc4ef63367d80_NeikiAnalytics.exe	39
PID 2944 wrote to memory of 2452	2944	48954448f00ae43f3cefc4ef63367d80_NeikiAnalytics.exe	39
PID 2944 wrote to memory of 2452	2944	48954448f00ae43f3cefc4ef63367d80_NeikiAnalytics.exe	39
PID 2944 wrote to memory of 2500	2944	48954448f00ae43f3cefc4ef63367d80_NeikiAnalytics.exe	40
PID 2944 wrote to memory of 2500	2944	48954448f00ae43f3cefc4ef63367d80_NeikiAnalytics.exe	40
PID 2944 wrote to memory of 2500	2944	48954448f00ae43f3cefc4ef63367d80_NeikiAnalytics.exe	40
PID 2944 wrote to memory of 3000	2944	48954448f00ae43f3cefc4ef63367d80_NeikiAnalytics.exe	41
PID 2944 wrote to memory of 3000	2944	48954448f00ae43f3cefc4ef63367d80_NeikiAnalytics.exe	41
PID 2944 wrote to memory of 3000	2944	48954448f00ae43f3cefc4ef63367d80_NeikiAnalytics.exe	41
PID 2944 wrote to memory of 2088	2944	48954448f00ae43f3cefc4ef63367d80_NeikiAnalytics.exe	42
PID 2944 wrote to memory of 2088	2944	48954448f00ae43f3cefc4ef63367d80_NeikiAnalytics.exe	42
PID 2944 wrote to memory of 2088	2944	48954448f00ae43f3cefc4ef63367d80_NeikiAnalytics.exe	42
PID 2944 wrote to memory of 1796	2944	48954448f00ae43f3cefc4ef63367d80_NeikiAnalytics.exe	43
PID 2944 wrote to memory of 1796	2944	48954448f00ae43f3cefc4ef63367d80_NeikiAnalytics.exe	43
PID 2944 wrote to memory of 1796	2944	48954448f00ae43f3cefc4ef63367d80_NeikiAnalytics.exe	43
PID 2944 wrote to memory of 1432	2944	48954448f00ae43f3cefc4ef63367d80_NeikiAnalytics.exe	44
PID 2944 wrote to memory of 1432	2944	48954448f00ae43f3cefc4ef63367d80_NeikiAnalytics.exe	44
PID 2944 wrote to memory of 1432	2944	48954448f00ae43f3cefc4ef63367d80_NeikiAnalytics.exe	44
PID 2944 wrote to memory of 2968	2944	48954448f00ae43f3cefc4ef63367d80_NeikiAnalytics.exe	45
PID 2944 wrote to memory of 2968	2944	48954448f00ae43f3cefc4ef63367d80_NeikiAnalytics.exe	45
PID 2944 wrote to memory of 2968	2944	48954448f00ae43f3cefc4ef63367d80_NeikiAnalytics.exe	45
PID 2944 wrote to memory of 2000	2944	48954448f00ae43f3cefc4ef63367d80_NeikiAnalytics.exe	46
PID 2944 wrote to memory of 2000	2944	48954448f00ae43f3cefc4ef63367d80_NeikiAnalytics.exe	46
PID 2944 wrote to memory of 2000	2944	48954448f00ae43f3cefc4ef63367d80_NeikiAnalytics.exe	46
PID 2944 wrote to memory of 2820	2944	48954448f00ae43f3cefc4ef63367d80_NeikiAnalytics.exe	47
PID 2944 wrote to memory of 2820	2944	48954448f00ae43f3cefc4ef63367d80_NeikiAnalytics.exe	47
PID 2944 wrote to memory of 2820	2944	48954448f00ae43f3cefc4ef63367d80_NeikiAnalytics.exe	47
PID 2944 wrote to memory of 2800	2944	48954448f00ae43f3cefc4ef63367d80_NeikiAnalytics.exe	48
PID 2944 wrote to memory of 2800	2944	48954448f00ae43f3cefc4ef63367d80_NeikiAnalytics.exe	48
PID 2944 wrote to memory of 2800	2944	48954448f00ae43f3cefc4ef63367d80_NeikiAnalytics.exe	48
PID 2944 wrote to memory of 1892	2944	48954448f00ae43f3cefc4ef63367d80_NeikiAnalytics.exe	49
PID 2944 wrote to memory of 1892	2944	48954448f00ae43f3cefc4ef63367d80_NeikiAnalytics.exe	49
PID 2944 wrote to memory of 1892	2944	48954448f00ae43f3cefc4ef63367d80_NeikiAnalytics.exe	49
PID 2944 wrote to memory of 1428	2944	48954448f00ae43f3cefc4ef63367d80_NeikiAnalytics.exe	50

C:\Users\Admin\AppData\Local\Temp\48954448f00ae43f3cefc4ef63367d80_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\48954448f00ae43f3cefc4ef63367d80_NeikiAnalytics.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2944
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3056
- C:\Windows\System\MwvmAML.exe
  C:\Windows\System\MwvmAML.exe
  2⤵
  - Executes dropped EXE
  PID:300
- C:\Windows\System\HqZVabd.exe
  C:\Windows\System\HqZVabd.exe
  2⤵
  - Executes dropped EXE
  PID:2544
- C:\Windows\System\XzaGZFz.exe
  C:\Windows\System\XzaGZFz.exe
  2⤵
  - Executes dropped EXE
  PID:2664
- C:\Windows\System\RIANuoM.exe
  C:\Windows\System\RIANuoM.exe
  2⤵
  - Executes dropped EXE
  PID:2728
- C:\Windows\System\cOmzrmZ.exe
  C:\Windows\System\cOmzrmZ.exe
  2⤵
  - Executes dropped EXE
  PID:2556
- C:\Windows\System\dfWPhnv.exe
  C:\Windows\System\dfWPhnv.exe
  2⤵
  - Executes dropped EXE
  PID:2472
- C:\Windows\System\nOgYqax.exe
  C:\Windows\System\nOgYqax.exe
  2⤵
  - Executes dropped EXE
  PID:2812
- C:\Windows\System\gbMDeKH.exe
  C:\Windows\System\gbMDeKH.exe
  2⤵
  - Executes dropped EXE
  PID:2604
- C:\Windows\System\XRsQxgo.exe
  C:\Windows\System\XRsQxgo.exe
  2⤵
  - Executes dropped EXE
  PID:2492
- C:\Windows\System\QpDIfvc.exe
  C:\Windows\System\QpDIfvc.exe
  2⤵
  - Executes dropped EXE
  PID:2452
- C:\Windows\System\DROkXoi.exe
  C:\Windows\System\DROkXoi.exe
  2⤵
  - Executes dropped EXE
  PID:2500
- C:\Windows\System\gfccxmZ.exe
  C:\Windows\System\gfccxmZ.exe
  2⤵
  - Executes dropped EXE
  PID:3000
- C:\Windows\System\uFkTqkt.exe
  C:\Windows\System\uFkTqkt.exe
  2⤵
  - Executes dropped EXE
  PID:2088
- C:\Windows\System\oUnENgU.exe
  C:\Windows\System\oUnENgU.exe
  2⤵
  - Executes dropped EXE
  PID:1796
- C:\Windows\System\PDrfhhZ.exe
  C:\Windows\System\PDrfhhZ.exe
  2⤵
  - Executes dropped EXE
  PID:1432
- C:\Windows\System\rhsFYqF.exe
  C:\Windows\System\rhsFYqF.exe
  2⤵
  - Executes dropped EXE
  PID:2968
- C:\Windows\System\NgoRcZm.exe
  C:\Windows\System\NgoRcZm.exe
  2⤵
  - Executes dropped EXE
  PID:2000
- C:\Windows\System\ymeZFgM.exe
  C:\Windows\System\ymeZFgM.exe
  2⤵
  - Executes dropped EXE
  PID:2820
- C:\Windows\System\IxfBbeF.exe
  C:\Windows\System\IxfBbeF.exe
  2⤵
  - Executes dropped EXE
  PID:2800
- C:\Windows\System\sodZWQX.exe
  C:\Windows\System\sodZWQX.exe
  2⤵
  - Executes dropped EXE
  PID:1892
- C:\Windows\System\OKHXLqc.exe
  C:\Windows\System\OKHXLqc.exe
  2⤵
  - Executes dropped EXE
  PID:1428
- C:\Windows\System\aYnozhX.exe
  C:\Windows\System\aYnozhX.exe
  2⤵
  - Executes dropped EXE
  PID:1512
- C:\Windows\System\SwHslig.exe
  C:\Windows\System\SwHslig.exe
  2⤵
  - Executes dropped EXE
  PID:2120
- C:\Windows\System\RhNaOvy.exe
  C:\Windows\System\RhNaOvy.exe
  2⤵
  - Executes dropped EXE
  PID:1724
- C:\Windows\System\HPyWnba.exe
  C:\Windows\System\HPyWnba.exe
  2⤵
  - Executes dropped EXE
  PID:324
- C:\Windows\System\FTfbYKo.exe
  C:\Windows\System\FTfbYKo.exe
  2⤵
  - Executes dropped EXE
  PID:488
- C:\Windows\System\MdOgLxu.exe
  C:\Windows\System\MdOgLxu.exe
  2⤵
  - Executes dropped EXE
  PID:1996
- C:\Windows\System\SsgwhNn.exe
  C:\Windows\System\SsgwhNn.exe
  2⤵
  - Executes dropped EXE
  PID:344
- C:\Windows\System\xgECKKk.exe
  C:\Windows\System\xgECKKk.exe
  2⤵
  - Executes dropped EXE
  PID:384
- C:\Windows\System\qXpHWwu.exe
  C:\Windows\System\qXpHWwu.exe
  2⤵
  - Executes dropped EXE
  PID:1280
- C:\Windows\System\CNufDxO.exe
  C:\Windows\System\CNufDxO.exe
  2⤵
  - Executes dropped EXE
  PID:2256
- C:\Windows\System\QoQgrgD.exe
  C:\Windows\System\QoQgrgD.exe
  2⤵
  - Executes dropped EXE
  PID:1548
- C:\Windows\System\cTnSZbB.exe
  C:\Windows\System\cTnSZbB.exe
  2⤵
  - Executes dropped EXE
  PID:2168
- C:\Windows\System\FXzAPzO.exe
  C:\Windows\System\FXzAPzO.exe
  2⤵
  - Executes dropped EXE
  PID:1392
- C:\Windows\System\FKmjbhI.exe
  C:\Windows\System\FKmjbhI.exe
  2⤵
  - Executes dropped EXE
  PID:1060
- C:\Windows\System\rjkgFAV.exe
  C:\Windows\System\rjkgFAV.exe
  2⤵
  - Executes dropped EXE
  PID:2252
- C:\Windows\System\uXijzal.exe
  C:\Windows\System\uXijzal.exe
  2⤵
  - Executes dropped EXE
  PID:2340
- C:\Windows\System\pLizJuq.exe
  C:\Windows\System\pLizJuq.exe
  2⤵
  - Executes dropped EXE
  PID:908
- C:\Windows\System\KSGSlyN.exe
  C:\Windows\System\KSGSlyN.exe
  2⤵
  - Executes dropped EXE
  PID:1876
- C:\Windows\System\gSrtmPN.exe
  C:\Windows\System\gSrtmPN.exe
  2⤵
  - Executes dropped EXE
  PID:1572
- C:\Windows\System\hKBQWUN.exe
  C:\Windows\System\hKBQWUN.exe
  2⤵
  - Executes dropped EXE
  PID:472
- C:\Windows\System\CHsuXRY.exe
  C:\Windows\System\CHsuXRY.exe
  2⤵
  - Executes dropped EXE
  PID:1036
- C:\Windows\System\lPxUYMt.exe
  C:\Windows\System\lPxUYMt.exe
  2⤵
  - Executes dropped EXE
  PID:612
- C:\Windows\System\cPLOcWg.exe
  C:\Windows\System\cPLOcWg.exe
  2⤵
  - Executes dropped EXE
  PID:992
- C:\Windows\System\rpwHJsb.exe
  C:\Windows\System\rpwHJsb.exe
  2⤵
  - Executes dropped EXE
  PID:764
- C:\Windows\System\BQTJcOJ.exe
  C:\Windows\System\BQTJcOJ.exe
  2⤵
  - Executes dropped EXE
  PID:884
- C:\Windows\System\ePjXxFu.exe
  C:\Windows\System\ePjXxFu.exe
  2⤵
  - Executes dropped EXE
  PID:1496
- C:\Windows\System\jnuiptz.exe
  C:\Windows\System\jnuiptz.exe
  2⤵
  - Executes dropped EXE
  PID:2204
- C:\Windows\System\hknpYXI.exe
  C:\Windows\System\hknpYXI.exe
  2⤵
  - Executes dropped EXE
  PID:1592
- C:\Windows\System\zuEfkcj.exe
  C:\Windows\System\zuEfkcj.exe
  2⤵
  - Executes dropped EXE
  PID:1600
- C:\Windows\System\KHJyEIs.exe
  C:\Windows\System\KHJyEIs.exe
  2⤵
  - Executes dropped EXE
  PID:2532
- C:\Windows\System\OtMkVsx.exe
  C:\Windows\System\OtMkVsx.exe
  2⤵
  - Executes dropped EXE
  PID:2668
- C:\Windows\System\PDPYNzq.exe
  C:\Windows\System\PDPYNzq.exe
  2⤵
  - Executes dropped EXE
  PID:2756
- C:\Windows\System\eRScuCu.exe
  C:\Windows\System\eRScuCu.exe
  2⤵
  - Executes dropped EXE
  PID:2440
- C:\Windows\System\NTUQUXZ.exe
  C:\Windows\System\NTUQUXZ.exe
  2⤵
  - Executes dropped EXE
  PID:2564
- C:\Windows\System\DuobQRy.exe
  C:\Windows\System\DuobQRy.exe
  2⤵
  - Executes dropped EXE
  PID:2960
- C:\Windows\System\siwyOmK.exe
  C:\Windows\System\siwyOmK.exe
  2⤵
  - Executes dropped EXE
  PID:3068
- C:\Windows\System\AEPUBJk.exe
  C:\Windows\System\AEPUBJk.exe
  2⤵
  PID:2328
- C:\Windows\System\cuHvSDZ.exe
  C:\Windows\System\cuHvSDZ.exe
  2⤵
  - Executes dropped EXE
  PID:2504
- C:\Windows\System\FAdxtEs.exe
  C:\Windows\System\FAdxtEs.exe
  2⤵
  PID:1936
- C:\Windows\System\VnpVezn.exe
  C:\Windows\System\VnpVezn.exe
  2⤵
  - Executes dropped EXE
  PID:840
- C:\Windows\System\rikNlzw.exe
  C:\Windows\System\rikNlzw.exe
  2⤵
  PID:2028
- C:\Windows\System\BZBhyzz.exe
  C:\Windows\System\BZBhyzz.exe
  2⤵
  - Executes dropped EXE
  PID:1636
- C:\Windows\System\zWxqJFp.exe
  C:\Windows\System\zWxqJFp.exe
  2⤵
  PID:336
- C:\Windows\System\EwjqGMU.exe
  C:\Windows\System\EwjqGMU.exe
  2⤵
  - Executes dropped EXE
  PID:1648
- C:\Windows\System\zdOvGRz.exe
  C:\Windows\System\zdOvGRz.exe
  2⤵
  PID:2964
- C:\Windows\System\DGxUrAI.exe
  C:\Windows\System\DGxUrAI.exe
  2⤵
  - Executes dropped EXE
  PID:1396
- C:\Windows\System\yMXFPej.exe
  C:\Windows\System\yMXFPej.exe
  2⤵
  PID:2060
- C:\Windows\System\TVXlrCN.exe
  C:\Windows\System\TVXlrCN.exe
  2⤵
  - Executes dropped EXE
  PID:844
- C:\Windows\System\FdyXxzm.exe
  C:\Windows\System\FdyXxzm.exe
  2⤵
  PID:2100
- C:\Windows\System\FiCGqDO.exe
  C:\Windows\System\FiCGqDO.exe
  2⤵
  - Executes dropped EXE
  PID:1292
- C:\Windows\System\JUWfFpN.exe
  C:\Windows\System\JUWfFpN.exe
  2⤵
  PID:1772
- C:\Windows\System\ATdjTck.exe
  C:\Windows\System\ATdjTck.exe
  2⤵
  PID:2284
- C:\Windows\System\TMsYuEd.exe
  C:\Windows\System\TMsYuEd.exe
  2⤵
  PID:804
- C:\Windows\System\yXMDrqS.exe
  C:\Windows\System\yXMDrqS.exe
  2⤵
  PID:2372
- C:\Windows\System\gnIdhvT.exe
  C:\Windows\System\gnIdhvT.exe
  2⤵
  PID:2116
- C:\Windows\System\zYPpRHd.exe
  C:\Windows\System\zYPpRHd.exe
  2⤵
  PID:2548
- C:\Windows\System\czXtfAt.exe
  C:\Windows\System\czXtfAt.exe
  2⤵
  PID:332
- C:\Windows\System\UXojjBb.exe
  C:\Windows\System\UXojjBb.exe
  2⤵
  PID:952
- C:\Windows\System\EVPzkft.exe
  C:\Windows\System\EVPzkft.exe
  2⤵
  PID:2640
- C:\Windows\System\nnjCuIZ.exe
  C:\Windows\System\nnjCuIZ.exe
  2⤵
  PID:2032
- C:\Windows\System\JpuCsFf.exe
  C:\Windows\System\JpuCsFf.exe
  2⤵
  PID:2576
- C:\Windows\System\iRqpZzR.exe
  C:\Windows\System\iRqpZzR.exe
  2⤵
  PID:2948
- C:\Windows\System\MRFAVUP.exe
  C:\Windows\System\MRFAVUP.exe
  2⤵
  PID:1152
- C:\Windows\System\EiqhVwx.exe
  C:\Windows\System\EiqhVwx.exe
  2⤵
  PID:1372
- C:\Windows\System\UcGALQU.exe
  C:\Windows\System\UcGALQU.exe
  2⤵
  PID:2016
- C:\Windows\System\fwxgXvw.exe
  C:\Windows\System\fwxgXvw.exe
  2⤵
  PID:1984
- C:\Windows\System\xshaoWB.exe
  C:\Windows\System\xshaoWB.exe
  2⤵
  PID:2200
- C:\Windows\System\sxMzKDO.exe
  C:\Windows\System\sxMzKDO.exe
  2⤵
  PID:1720
- C:\Windows\System\BmjojPf.exe
  C:\Windows\System\BmjojPf.exe
  2⤵
  PID:2952
- C:\Windows\System\JWCkHgV.exe
  C:\Windows\System\JWCkHgV.exe
  2⤵
  PID:2588
- C:\Windows\System\SflaWOM.exe
  C:\Windows\System\SflaWOM.exe
  2⤵
  PID:692
- C:\Windows\System\ebRprdB.exe
  C:\Windows\System\ebRprdB.exe
  2⤵
  PID:2808
- C:\Windows\System\kuSCikv.exe
  C:\Windows\System\kuSCikv.exe
  2⤵
  PID:780
- C:\Windows\System\FjnOFrm.exe
  C:\Windows\System\FjnOFrm.exe
  2⤵
  PID:1860
- C:\Windows\System\VavSMsP.exe
  C:\Windows\System\VavSMsP.exe
  2⤵
  PID:2180
- C:\Windows\System\SjpBOLl.exe
  C:\Windows\System\SjpBOLl.exe
  2⤵
  PID:1952
- C:\Windows\System\DajseSD.exe
  C:\Windows\System\DajseSD.exe
  2⤵
  PID:896
- C:\Windows\System\wxksYld.exe
  C:\Windows\System\wxksYld.exe
  2⤵
  PID:2424
- C:\Windows\System\tuVOJTn.exe
  C:\Windows\System\tuVOJTn.exe
  2⤵
  PID:2344
- C:\Windows\System\tElOpZc.exe
  C:\Windows\System\tElOpZc.exe
  2⤵
  PID:2760
- C:\Windows\System\Wsgdnmj.exe
  C:\Windows\System\Wsgdnmj.exe
  2⤵
  PID:2924
- C:\Windows\System\wPnZmuH.exe
  C:\Windows\System\wPnZmuH.exe
  2⤵
  PID:848
- C:\Windows\System\jnczZjj.exe
  C:\Windows\System\jnczZjj.exe
  2⤵
  PID:1628
- C:\Windows\System\ummTULW.exe
  C:\Windows\System\ummTULW.exe
  2⤵
  PID:1840
- C:\Windows\System\hRKbMhf.exe
  C:\Windows\System\hRKbMhf.exe
  2⤵
  PID:784
- C:\Windows\System\RDbYaKj.exe
  C:\Windows\System\RDbYaKj.exe
  2⤵
  PID:2904
- C:\Windows\System\UwbDdxf.exe
  C:\Windows\System\UwbDdxf.exe
  2⤵
  PID:956
- C:\Windows\System\KtOnjRm.exe
  C:\Windows\System\KtOnjRm.exe
  2⤵
  PID:2392
- C:\Windows\System\ggTqzMb.exe
  C:\Windows\System\ggTqzMb.exe
  2⤵
  PID:2300
- C:\Windows\System\BGjcqtX.exe
  C:\Windows\System\BGjcqtX.exe
  2⤵
  PID:2516
- C:\Windows\System\Cyqhvhg.exe
  C:\Windows\System\Cyqhvhg.exe
  2⤵
  PID:1708
- C:\Windows\System\RuAnVey.exe
  C:\Windows\System\RuAnVey.exe
  2⤵
  PID:3036
- C:\Windows\System\VMnDrfN.exe
  C:\Windows\System\VMnDrfN.exe
  2⤵
  PID:2480
- C:\Windows\System\DEDeKKk.exe
  C:\Windows\System\DEDeKKk.exe
  2⤵
  PID:1944
- C:\Windows\System\EFnxOss.exe
  C:\Windows\System\EFnxOss.exe
  2⤵
  PID:1680
- C:\Windows\System\JxXSxdJ.exe
  C:\Windows\System\JxXSxdJ.exe
  2⤵
  PID:2656
- C:\Windows\System\FgYWwGa.exe
  C:\Windows\System\FgYWwGa.exe
  2⤵
  PID:2528
- C:\Windows\System\mraYeWT.exe
  C:\Windows\System\mraYeWT.exe
  2⤵
  PID:3088
- C:\Windows\System\eGgielh.exe
  C:\Windows\System\eGgielh.exe
  2⤵
  PID:3104
- C:\Windows\System\LVDKWpm.exe
  C:\Windows\System\LVDKWpm.exe
  2⤵
  PID:3120
- C:\Windows\System\ZWMjieq.exe
  C:\Windows\System\ZWMjieq.exe
  2⤵
  PID:3136
- C:\Windows\System\VyNRfph.exe
  C:\Windows\System\VyNRfph.exe
  2⤵
  PID:3152
- C:\Windows\System\QxeTgjb.exe
  C:\Windows\System\QxeTgjb.exe
  2⤵
  PID:3168
- C:\Windows\System\xKlODPc.exe
  C:\Windows\System\xKlODPc.exe
  2⤵
  PID:3184
- C:\Windows\System\JGVsNll.exe
  C:\Windows\System\JGVsNll.exe
  2⤵
  PID:3200
- C:\Windows\System\lXEWjaT.exe
  C:\Windows\System\lXEWjaT.exe
  2⤵
  PID:3220
- C:\Windows\System\lPSZosj.exe
  C:\Windows\System\lPSZosj.exe
  2⤵
  PID:3236
- C:\Windows\System\sXOXNEz.exe
  C:\Windows\System\sXOXNEz.exe
  2⤵
  PID:3252
- C:\Windows\System\TVShJmY.exe
  C:\Windows\System\TVShJmY.exe
  2⤵
  PID:3268
- C:\Windows\System\wCRAjNF.exe
  C:\Windows\System\wCRAjNF.exe
  2⤵
  PID:3284
- C:\Windows\System\lzeSlWZ.exe
  C:\Windows\System\lzeSlWZ.exe
  2⤵
  PID:3300
- C:\Windows\System\SsLKjpm.exe
  C:\Windows\System\SsLKjpm.exe
  2⤵
  PID:3316
- C:\Windows\System\QxxvNIP.exe
  C:\Windows\System\QxxvNIP.exe
  2⤵
  PID:3336
- C:\Windows\System\qgPRYFx.exe
  C:\Windows\System\qgPRYFx.exe
  2⤵
  PID:3352
- C:\Windows\System\OZqZQPj.exe
  C:\Windows\System\OZqZQPj.exe
  2⤵
  PID:3368
- C:\Windows\System\lYXGSVC.exe
  C:\Windows\System\lYXGSVC.exe
  2⤵
  PID:3384
- C:\Windows\System\IRyyMzX.exe
  C:\Windows\System\IRyyMzX.exe
  2⤵
  PID:3400
- C:\Windows\System\icTbOUL.exe
  C:\Windows\System\icTbOUL.exe
  2⤵
  PID:3420
- C:\Windows\System\QNwSfAr.exe
  C:\Windows\System\QNwSfAr.exe
  2⤵
  PID:3436
- C:\Windows\System\toAJmRU.exe
  C:\Windows\System\toAJmRU.exe
  2⤵
  PID:3452
- C:\Windows\System\qgPrmUw.exe
  C:\Windows\System\qgPrmUw.exe
  2⤵
  PID:3484
- C:\Windows\System\YhiGWlP.exe
  C:\Windows\System\YhiGWlP.exe
  2⤵
  PID:3500
- C:\Windows\System\DevPwHV.exe
  C:\Windows\System\DevPwHV.exe
  2⤵
  PID:3516
- C:\Windows\System\BpqKmgf.exe
  C:\Windows\System\BpqKmgf.exe
  2⤵
  PID:3532
- C:\Windows\System\iQgWdOh.exe
  C:\Windows\System\iQgWdOh.exe
  2⤵
  PID:3548
- C:\Windows\System\BGPwHNF.exe
  C:\Windows\System\BGPwHNF.exe
  2⤵
  PID:3564
- C:\Windows\System\bRCvBxl.exe
  C:\Windows\System\bRCvBxl.exe
  2⤵
  PID:3580
- C:\Windows\System\DcKYXKi.exe
  C:\Windows\System\DcKYXKi.exe
  2⤵
  PID:3596
- C:\Windows\System\FPqMvwX.exe
  C:\Windows\System\FPqMvwX.exe
  2⤵
  PID:3612
- C:\Windows\System\PCLDyVj.exe
  C:\Windows\System\PCLDyVj.exe
  2⤵
  PID:3628
- C:\Windows\System\rtYplTw.exe
  C:\Windows\System\rtYplTw.exe
  2⤵
  PID:3644
- C:\Windows\System\jSrznEn.exe
  C:\Windows\System\jSrznEn.exe
  2⤵
  PID:3664
- C:\Windows\System\rvZHtTn.exe
  C:\Windows\System\rvZHtTn.exe
  2⤵
  PID:3680
- C:\Windows\System\CoViyCH.exe
  C:\Windows\System\CoViyCH.exe
  2⤵
  PID:3696
- C:\Windows\System\EtyHdPA.exe
  C:\Windows\System\EtyHdPA.exe
  2⤵
  PID:3712
- C:\Windows\System\tagdrOx.exe
  C:\Windows\System\tagdrOx.exe
  2⤵
  PID:3732
- C:\Windows\System\KOzUGkB.exe
  C:\Windows\System\KOzUGkB.exe
  2⤵
  PID:3760
- C:\Windows\System\rYMtBil.exe
  C:\Windows\System\rYMtBil.exe
  2⤵
  PID:3784
- C:\Windows\System\DRJdRqT.exe
  C:\Windows\System\DRJdRqT.exe
  2⤵
  PID:3804
- C:\Windows\System\vdSvwgD.exe
  C:\Windows\System\vdSvwgD.exe
  2⤵
  PID:3820
- C:\Windows\System\qzeeRcp.exe
  C:\Windows\System\qzeeRcp.exe
  2⤵
  PID:3836
- C:\Windows\System\fVMnQcy.exe
  C:\Windows\System\fVMnQcy.exe
  2⤵
  PID:3852
- C:\Windows\System\edWJRfg.exe
  C:\Windows\System\edWJRfg.exe
  2⤵
  PID:3868
- C:\Windows\System\qxFvTLD.exe
  C:\Windows\System\qxFvTLD.exe
  2⤵
  PID:3884
- C:\Windows\System\DjFnGHL.exe
  C:\Windows\System\DjFnGHL.exe
  2⤵
  PID:3900
- C:\Windows\System\xPljsqL.exe
  C:\Windows\System\xPljsqL.exe
  2⤵
  PID:3920
- C:\Windows\System\PsvIjHB.exe
  C:\Windows\System\PsvIjHB.exe
  2⤵
  PID:3936
- C:\Windows\System\eFLqEeF.exe
  C:\Windows\System\eFLqEeF.exe
  2⤵
  PID:3952
- C:\Windows\System\ezNyYEz.exe
  C:\Windows\System\ezNyYEz.exe
  2⤵
  PID:3968
- C:\Windows\System\ijbJqPe.exe
  C:\Windows\System\ijbJqPe.exe
  2⤵
  PID:3984
- C:\Windows\System\fTkbjVk.exe
  C:\Windows\System\fTkbjVk.exe
  2⤵
  PID:4000
- C:\Windows\System\jdmOEoO.exe
  C:\Windows\System\jdmOEoO.exe
  2⤵
  PID:4016
- C:\Windows\System\SyHwCnL.exe
  C:\Windows\System\SyHwCnL.exe
  2⤵
  PID:4032
- C:\Windows\System\icCpUBe.exe
  C:\Windows\System\icCpUBe.exe
  2⤵
  PID:4048
- C:\Windows\System\xNnurlK.exe
  C:\Windows\System\xNnurlK.exe
  2⤵
  PID:4064
- C:\Windows\System\MripXaX.exe
  C:\Windows\System\MripXaX.exe
  2⤵
  PID:4080
- C:\Windows\System\VoUJsJs.exe
  C:\Windows\System\VoUJsJs.exe
  2⤵
  PID:2872
- C:\Windows\System\VRvvLOM.exe
  C:\Windows\System\VRvvLOM.exe
  2⤵
  PID:2188
- C:\Windows\System\BsjthtN.exe
  C:\Windows\System\BsjthtN.exe
  2⤵
  PID:2584
- C:\Windows\System\tZNfAmM.exe
  C:\Windows\System\tZNfAmM.exe
  2⤵
  PID:2488
- C:\Windows\System\cyRHPOU.exe
  C:\Windows\System\cyRHPOU.exe
  2⤵
  PID:3100
- C:\Windows\System\mbRzBfi.exe
  C:\Windows\System\mbRzBfi.exe
  2⤵
  PID:452
- C:\Windows\System\POdnncE.exe
  C:\Windows\System\POdnncE.exe
  2⤵
  PID:2856
- C:\Windows\System\OHtqjEF.exe
  C:\Windows\System\OHtqjEF.exe
  2⤵
  PID:3228
- C:\Windows\System\nFfTxpI.exe
  C:\Windows\System\nFfTxpI.exe
  2⤵
  PID:3296
- C:\Windows\System\natXXra.exe
  C:\Windows\System\natXXra.exe
  2⤵
  PID:3360
- C:\Windows\System\uAjkbGT.exe
  C:\Windows\System\uAjkbGT.exe
  2⤵
  PID:3392
- C:\Windows\System\ClEhHew.exe
  C:\Windows\System\ClEhHew.exe
  2⤵
  PID:3460
- C:\Windows\System\momKJwl.exe
  C:\Windows\System\momKJwl.exe
  2⤵
  PID:3480
- C:\Windows\System\lQvnudY.exe
  C:\Windows\System\lQvnudY.exe
  2⤵
  PID:3052
- C:\Windows\System\jNtBTCN.exe
  C:\Windows\System\jNtBTCN.exe
  2⤵
  PID:3512
- C:\Windows\System\zdFLyqI.exe
  C:\Windows\System\zdFLyqI.exe
  2⤵
  PID:3576
- C:\Windows\System\tirOXlG.exe
  C:\Windows\System\tirOXlG.exe
  2⤵
  PID:3640
- C:\Windows\System\iHEGPJG.exe
  C:\Windows\System\iHEGPJG.exe
  2⤵
  PID:3704
- C:\Windows\System\AkRSYyo.exe
  C:\Windows\System\AkRSYyo.exe
  2⤵
  PID:2988
- C:\Windows\System\zXUvHOL.exe
  C:\Windows\System\zXUvHOL.exe
  2⤵
  PID:1776
- C:\Windows\System\yQYyOJJ.exe
  C:\Windows\System\yQYyOJJ.exe
  2⤵
  PID:2352
- C:\Windows\System\vhFjbPq.exe
  C:\Windows\System\vhFjbPq.exe
  2⤵
  PID:3084
- C:\Windows\System\pbcEOPm.exe
  C:\Windows\System\pbcEOPm.exe
  2⤵
  PID:3112
- C:\Windows\System\AYEBnqa.exe
  C:\Windows\System\AYEBnqa.exe
  2⤵
  PID:4100
- C:\Windows\System\VtzBaNh.exe
  C:\Windows\System\VtzBaNh.exe
  2⤵
  PID:4116
- C:\Windows\System\DLctkLk.exe
  C:\Windows\System\DLctkLk.exe
  2⤵
  PID:4132
- C:\Windows\System\ryZmhap.exe
  C:\Windows\System\ryZmhap.exe
  2⤵
  PID:4148
- C:\Windows\System\EMXGDhb.exe
  C:\Windows\System\EMXGDhb.exe
  2⤵
  PID:4164
- C:\Windows\System\gMrAiBR.exe
  C:\Windows\System\gMrAiBR.exe
  2⤵
  PID:4184
- C:\Windows\System\zWzszaR.exe
  C:\Windows\System\zWzszaR.exe
  2⤵
  PID:4200
- C:\Windows\System\fMOdaet.exe
  C:\Windows\System\fMOdaet.exe
  2⤵
  PID:4216
- C:\Windows\System\qpeaiUn.exe
  C:\Windows\System\qpeaiUn.exe
  2⤵
  PID:4232
- C:\Windows\System\QgUCOxg.exe
  C:\Windows\System\QgUCOxg.exe
  2⤵
  PID:4248
- C:\Windows\System\hcjwfTJ.exe
  C:\Windows\System\hcjwfTJ.exe
  2⤵
  PID:4356
- C:\Windows\System\efoFDOJ.exe
  C:\Windows\System\efoFDOJ.exe
  2⤵
  PID:4488
- C:\Windows\System\fxKSMNy.exe
  C:\Windows\System\fxKSMNy.exe
  2⤵
  PID:4572
- C:\Windows\System\ZtBLddx.exe
  C:\Windows\System\ZtBLddx.exe
  2⤵
  PID:4588
- C:\Windows\System\qKOmqzc.exe
  C:\Windows\System\qKOmqzc.exe
  2⤵
  PID:4604
- C:\Windows\System\WGkICXc.exe
  C:\Windows\System\WGkICXc.exe
  2⤵
  PID:4620
- C:\Windows\System\ZJVWteX.exe
  C:\Windows\System\ZJVWteX.exe
  2⤵
  PID:4636
- C:\Windows\System\GYFgWBX.exe
  C:\Windows\System\GYFgWBX.exe
  2⤵
  PID:4652
- C:\Windows\System\xvyBYPK.exe
  C:\Windows\System\xvyBYPK.exe
  2⤵
  PID:4668
- C:\Windows\System\iuEZplN.exe
  C:\Windows\System\iuEZplN.exe
  2⤵
  PID:4684
- C:\Windows\System\RROynSW.exe
  C:\Windows\System\RROynSW.exe
  2⤵
  PID:4700
- C:\Windows\System\TikKTFB.exe
  C:\Windows\System\TikKTFB.exe
  2⤵
  PID:4716
- C:\Windows\System\oImgaKO.exe
  C:\Windows\System\oImgaKO.exe
  2⤵
  PID:4732
- C:\Windows\System\mdOPZfm.exe
  C:\Windows\System\mdOPZfm.exe
  2⤵
  PID:4748
- C:\Windows\System\oSgVjtn.exe
  C:\Windows\System\oSgVjtn.exe
  2⤵
  PID:4764
- C:\Windows\System\DsilqRe.exe
  C:\Windows\System\DsilqRe.exe
  2⤵
  PID:4780
- C:\Windows\System\symorJn.exe
  C:\Windows\System\symorJn.exe
  2⤵
  PID:4796
- C:\Windows\System\yZjenDq.exe
  C:\Windows\System\yZjenDq.exe
  2⤵
  PID:4812
- C:\Windows\System\XbMqjrS.exe
  C:\Windows\System\XbMqjrS.exe
  2⤵
  PID:4828
- C:\Windows\System\TdqUGdB.exe
  C:\Windows\System\TdqUGdB.exe
  2⤵
  PID:4860
- C:\Windows\System\NlaQUGF.exe
  C:\Windows\System\NlaQUGF.exe
  2⤵
  PID:4876
- C:\Windows\System\YeAOAsg.exe
  C:\Windows\System\YeAOAsg.exe
  2⤵
  PID:4892
- C:\Windows\System\deAkdKm.exe
  C:\Windows\System\deAkdKm.exe
  2⤵
  PID:4908
- C:\Windows\System\AvzuOxL.exe
  C:\Windows\System\AvzuOxL.exe
  2⤵
  PID:4924
- C:\Windows\System\YweMOWd.exe
  C:\Windows\System\YweMOWd.exe
  2⤵
  PID:4940
- C:\Windows\System\KaAkSRj.exe
  C:\Windows\System\KaAkSRj.exe
  2⤵
  PID:4956
- C:\Windows\System\ZisasBh.exe
  C:\Windows\System\ZisasBh.exe
  2⤵
  PID:4976
- C:\Windows\System\wzTozSh.exe
  C:\Windows\System\wzTozSh.exe
  2⤵
  PID:4992
- C:\Windows\System\bodVLmc.exe
  C:\Windows\System\bodVLmc.exe
  2⤵
  PID:5008
- C:\Windows\System\eZHFTuU.exe
  C:\Windows\System\eZHFTuU.exe
  2⤵
  PID:5024
- C:\Windows\System\ubTTjDy.exe
  C:\Windows\System\ubTTjDy.exe
  2⤵
  PID:5040
- C:\Windows\System\hwvFwdm.exe
  C:\Windows\System\hwvFwdm.exe
  2⤵
  PID:5056
- C:\Windows\System\UHyCTNo.exe
  C:\Windows\System\UHyCTNo.exe
  2⤵
  PID:5072
- C:\Windows\System\BlGRNDs.exe
  C:\Windows\System\BlGRNDs.exe
  2⤵
  PID:5088
- C:\Windows\System\CdlBftK.exe
  C:\Windows\System\CdlBftK.exe
  2⤵
  PID:5108
- C:\Windows\System\FXiIHHd.exe
  C:\Windows\System\FXiIHHd.exe
  2⤵
  PID:3148
- C:\Windows\System\MJjtqUA.exe
  C:\Windows\System\MJjtqUA.exe
  2⤵
  PID:3212
- C:\Windows\System\skllvFz.exe
  C:\Windows\System\skllvFz.exe
  2⤵
  PID:3276
- C:\Windows\System\MsPZlkJ.exe
  C:\Windows\System\MsPZlkJ.exe
  2⤵
  PID:3376
- C:\Windows\System\WMMEwfN.exe
  C:\Windows\System\WMMEwfN.exe
  2⤵
  PID:3744
- C:\Windows\System\bnrQXCH.exe
  C:\Windows\System\bnrQXCH.exe
  2⤵
  PID:1012
- C:\Windows\System\TmNFPLO.exe
  C:\Windows\System\TmNFPLO.exe
  2⤵
  PID:3948
- C:\Windows\System\wZMZyDJ.exe
  C:\Windows\System\wZMZyDJ.exe
  2⤵
  PID:1792
- C:\Windows\System\vtUUAMW.exe
  C:\Windows\System\vtUUAMW.exe
  2⤵
  PID:3864
- C:\Windows\System\XDjHdZg.exe
  C:\Windows\System\XDjHdZg.exe
  2⤵
  PID:3932
- C:\Windows\System\bjanJWv.exe
  C:\Windows\System\bjanJWv.exe
  2⤵
  PID:3992
- C:\Windows\System\hRFWPbX.exe
  C:\Windows\System\hRFWPbX.exe
  2⤵
  PID:4060
- C:\Windows\System\EHfAEbf.exe
  C:\Windows\System\EHfAEbf.exe
  2⤵
  PID:3096
- C:\Windows\System\lElxdXT.exe
  C:\Windows\System\lElxdXT.exe
  2⤵
  PID:3260
- C:\Windows\System\mQcedmi.exe
  C:\Windows\System\mQcedmi.exe
  2⤵
  PID:3364
- C:\Windows\System\xwcPVyj.exe
  C:\Windows\System\xwcPVyj.exe
  2⤵
  PID:2652
- C:\Windows\System\INYZQDu.exe
  C:\Windows\System\INYZQDu.exe
  2⤵
  PID:3740
- C:\Windows\System\aJiITid.exe
  C:\Windows\System\aJiITid.exe
  2⤵
  PID:1872
- C:\Windows\System\MxoVqic.exe
  C:\Windows\System\MxoVqic.exe
  2⤵
  PID:4112
- C:\Windows\System\fqVPUAc.exe
  C:\Windows\System\fqVPUAc.exe
  2⤵
  PID:4176
- C:\Windows\System\ALujuBL.exe
  C:\Windows\System\ALujuBL.exe
  2⤵
  PID:4244
- C:\Windows\System\SigptSN.exe
  C:\Windows\System\SigptSN.exe
  2⤵
  PID:4372
- C:\Windows\System\JmJeRIh.exe
  C:\Windows\System\JmJeRIh.exe
  2⤵
  PID:4388
- C:\Windows\System\NZodTsb.exe
  C:\Windows\System\NZodTsb.exe
  2⤵
  PID:4408
- C:\Windows\System\pSzpQmc.exe
  C:\Windows\System\pSzpQmc.exe
  2⤵
  PID:4424
- C:\Windows\System\uSIjBDe.exe
  C:\Windows\System\uSIjBDe.exe
  2⤵
  PID:4580
- C:\Windows\System\Qampnrl.exe
  C:\Windows\System\Qampnrl.exe
  2⤵
  PID:4160
- C:\Windows\System\yAOBYBM.exe
  C:\Windows\System\yAOBYBM.exe
  2⤵
  PID:4224
- C:\Windows\System\vYihiav.exe
  C:\Windows\System\vYihiav.exe
  2⤵
  PID:4272
- C:\Windows\System\nSQGaLV.exe
  C:\Windows\System\nSQGaLV.exe
  2⤵
  PID:4288
- C:\Windows\System\jrtSFUD.exe
  C:\Windows\System\jrtSFUD.exe
  2⤵
  PID:920
- C:\Windows\System\tAnkIcD.exe
  C:\Windows\System\tAnkIcD.exe
  2⤵
  PID:4308
- C:\Windows\System\khNGnSU.exe
  C:\Windows\System\khNGnSU.exe
  2⤵
  PID:4324
- C:\Windows\System\Ruhknvn.exe
  C:\Windows\System\Ruhknvn.exe
  2⤵
  PID:4344
- C:\Windows\System\yXTidOT.exe
  C:\Windows\System\yXTidOT.exe
  2⤵
  PID:3560
- C:\Windows\System\LXzGXkc.exe
  C:\Windows\System\LXzGXkc.exe
  2⤵
  PID:3816
- C:\Windows\System\SqAHeaD.exe
  C:\Windows\System\SqAHeaD.exe
  2⤵
  PID:4012
- C:\Windows\System\RWxmFyR.exe
  C:\Windows\System\RWxmFyR.exe
  2⤵
  PID:4528
- C:\Windows\System\uhpJCUR.exe
  C:\Windows\System\uhpJCUR.exe
  2⤵
  PID:4544
- C:\Windows\System\BmmyhZq.exe
  C:\Windows\System\BmmyhZq.exe
  2⤵
  PID:1304
- C:\Windows\System\SwloGLw.exe
  C:\Windows\System\SwloGLw.exe
  2⤵
  PID:3672
- C:\Windows\System\oLPCMnd.exe
  C:\Windows\System\oLPCMnd.exe
  2⤵
  PID:3080
- C:\Windows\System\iakFRzO.exe
  C:\Windows\System\iakFRzO.exe
  2⤵
  PID:2356
- C:\Windows\System\zCRfnfl.exe
  C:\Windows\System\zCRfnfl.exe
  2⤵
  PID:4628
- C:\Windows\System\QhdSLAM.exe
  C:\Windows\System\QhdSLAM.exe
  2⤵
  PID:4728
- C:\Windows\System\NsKqZNY.exe
  C:\Windows\System\NsKqZNY.exe
  2⤵
  PID:4612
- C:\Windows\System\KVgYeoj.exe
  C:\Windows\System\KVgYeoj.exe
  2⤵
  PID:4708
- C:\Windows\System\yOgqbTQ.exe
  C:\Windows\System\yOgqbTQ.exe
  2⤵
  PID:4740
- C:\Windows\System\ieQZLUp.exe
  C:\Windows\System\ieQZLUp.exe
  2⤵
  PID:4804
- C:\Windows\System\gmwaogy.exe
  C:\Windows\System\gmwaogy.exe
  2⤵
  PID:4844
- C:\Windows\System\aVgmxhW.exe
  C:\Windows\System\aVgmxhW.exe
  2⤵
  PID:4884
- C:\Windows\System\rheazax.exe
  C:\Windows\System\rheazax.exe
  2⤵
  PID:4948
- C:\Windows\System\gXPwslL.exe
  C:\Windows\System\gXPwslL.exe
  2⤵
  PID:5016
- C:\Windows\System\XhDpNok.exe
  C:\Windows\System\XhDpNok.exe
  2⤵
  PID:5080
- C:\Windows\System\zfVXSlk.exe
  C:\Windows\System\zfVXSlk.exe
  2⤵
  PID:3248
- C:\Windows\System\Yntgcal.exe
  C:\Windows\System\Yntgcal.exe
  2⤵
  PID:3412
- C:\Windows\System\pXMVpKB.exe
  C:\Windows\System\pXMVpKB.exe
  2⤵
  PID:3556
- C:\Windows\System\PzhBcEv.exe
  C:\Windows\System\PzhBcEv.exe
  2⤵
  PID:3656
- C:\Windows\System\zWQNSrG.exe
  C:\Windows\System\zWQNSrG.exe
  2⤵
  PID:3688
- C:\Windows\System\cNFIbMK.exe
  C:\Windows\System\cNFIbMK.exe
  2⤵
  PID:2128
- C:\Windows\System\jBFeIMt.exe
  C:\Windows\System\jBFeIMt.exe
  2⤵
  PID:3772
- C:\Windows\System\AWWTeOw.exe
  C:\Windows\System\AWWTeOw.exe
  2⤵
  PID:3180
- C:\Windows\System\QxBcmtd.exe
  C:\Windows\System\QxBcmtd.exe
  2⤵
  PID:4872
- C:\Windows\System\YKjEoLB.exe
  C:\Windows\System\YKjEoLB.exe
  2⤵
  PID:3348
- C:\Windows\System\COsxddL.exe
  C:\Windows\System\COsxddL.exe
  2⤵
  PID:4280
- C:\Windows\System\GRyQoBU.exe
  C:\Windows\System\GRyQoBU.exe
  2⤵
  PID:4520
- C:\Windows\System\LJHhiqv.exe
  C:\Windows\System\LJHhiqv.exe
  2⤵
  PID:2928
- C:\Windows\System\ZTKkEtc.exe
  C:\Windows\System\ZTKkEtc.exe
  2⤵
  PID:4692
- C:\Windows\System\bkQMlwj.exe
  C:\Windows\System\bkQMlwj.exe
  2⤵
  PID:4904
- C:\Windows\System\zEnpiVo.exe
  C:\Windows\System\zEnpiVo.exe
  2⤵
  PID:4968
- C:\Windows\System\zPOGRAz.exe
  C:\Windows\System\zPOGRAz.exe
  2⤵
  PID:5036
- C:\Windows\System\wKfHwvS.exe
  C:\Windows\System\wKfHwvS.exe
  2⤵
  PID:1500
- C:\Windows\System\qAVZfUi.exe
  C:\Windows\System\qAVZfUi.exe
  2⤵
  PID:3844
- C:\Windows\System\BomjuqG.exe
  C:\Windows\System\BomjuqG.exe
  2⤵
  PID:3880
- C:\Windows\System\MKGelSt.exe
  C:\Windows\System\MKGelSt.exe
  2⤵
  PID:2608
- C:\Windows\System\yAZyaCl.exe
  C:\Windows\System\yAZyaCl.exe
  2⤵
  PID:4788
- C:\Windows\System\AldAgsZ.exe
  C:\Windows\System\AldAgsZ.exe
  2⤵
  PID:3828
- C:\Windows\System\RyNaTwp.exe
  C:\Windows\System\RyNaTwp.exe
  2⤵
  PID:1624
- C:\Windows\System\HvrBqoy.exe
  C:\Windows\System\HvrBqoy.exe
  2⤵
  PID:1048
- C:\Windows\System\dBKQipI.exe
  C:\Windows\System\dBKQipI.exe
  2⤵
  PID:4384
- C:\Windows\System\kBvQUeG.exe
  C:\Windows\System\kBvQUeG.exe
  2⤵
  PID:2920
- C:\Windows\System\dTwFcWj.exe
  C:\Windows\System\dTwFcWj.exe
  2⤵
  PID:4420
- C:\Windows\System\ZoTwKwO.exe
  C:\Windows\System\ZoTwKwO.exe
  2⤵
  PID:3896
- C:\Windows\System\JHPxbbl.exe
  C:\Windows\System\JHPxbbl.exe
  2⤵
  PID:1228
- C:\Windows\System\gJrVlwV.exe
  C:\Windows\System\gJrVlwV.exe
  2⤵
  PID:4440
- C:\Windows\System\KFKSajy.exe
  C:\Windows\System\KFKSajy.exe
  2⤵
  PID:4292
- C:\Windows\System\CYSSaDs.exe
  C:\Windows\System\CYSSaDs.exe
  2⤵
  PID:4772
- C:\Windows\System\eTPmqGv.exe
  C:\Windows\System\eTPmqGv.exe
  2⤵
  PID:4856
- C:\Windows\System\FvExmQx.exe
  C:\Windows\System\FvExmQx.exe
  2⤵
  PID:2712
- C:\Windows\System\DISYEJY.exe
  C:\Windows\System\DISYEJY.exe
  2⤵
  PID:2680
- C:\Windows\System\mxdNorx.exe
  C:\Windows\System\mxdNorx.exe
  2⤵
  PID:3860
- C:\Windows\System\wqFMnHo.exe
  C:\Windows\System\wqFMnHo.exe
  2⤵
  PID:2620
- C:\Windows\System\zlzRZLh.exe
  C:\Windows\System\zlzRZLh.exe
  2⤵
  PID:5100
- C:\Windows\System\hZwlhOh.exe
  C:\Windows\System\hZwlhOh.exe
  2⤵
  PID:3652
- C:\Windows\System\cLmUhmL.exe
  C:\Windows\System\cLmUhmL.exe
  2⤵
  PID:5104
- C:\Windows\System\vfmtrpo.exe
  C:\Windows\System\vfmtrpo.exe
  2⤵
  PID:4560
- C:\Windows\System\bXQdXcm.exe
  C:\Windows\System\bXQdXcm.exe
  2⤵
  PID:1868
- C:\Windows\System\GATDVqw.exe
  C:\Windows\System\GATDVqw.exe
  2⤵
  PID:1196
- C:\Windows\System\neQsosG.exe
  C:\Windows\System\neQsosG.exe
  2⤵
  PID:4676
- C:\Windows\System\TIypjLM.exe
  C:\Windows\System\TIypjLM.exe
  2⤵
  PID:4916
- C:\Windows\System\TcAjpOf.exe
  C:\Windows\System\TcAjpOf.exe
  2⤵
  PID:596
- C:\Windows\System\SKnlVQc.exe
  C:\Windows\System\SKnlVQc.exe
  2⤵
  PID:5052
- C:\Windows\System\uHrSgvP.exe
  C:\Windows\System\uHrSgvP.exe
  2⤵
  PID:1268
- C:\Windows\System\LLATvmL.exe
  C:\Windows\System\LLATvmL.exe
  2⤵
  PID:3800
- C:\Windows\System\txzxilU.exe
  C:\Windows\System\txzxilU.exe
  2⤵
  PID:2404
- C:\Windows\System\zkFMzoG.exe
  C:\Windows\System\zkFMzoG.exe
  2⤵
  PID:1852
- C:\Windows\System\IbgqLif.exe
  C:\Windows\System\IbgqLif.exe
  2⤵
  PID:4208
- C:\Windows\System\qcroMOa.exe
  C:\Windows\System\qcroMOa.exe
  2⤵
  PID:2468
- C:\Windows\System\abClfuq.exe
  C:\Windows\System\abClfuq.exe
  2⤵
  PID:4476
- C:\Windows\System\IWopPjF.exe
  C:\Windows\System\IWopPjF.exe
  2⤵
  PID:2612
- C:\Windows\System\EfSlqte.exe
  C:\Windows\System\EfSlqte.exe
  2⤵
  PID:4028
- C:\Windows\System\GdbEmco.exe
  C:\Windows\System\GdbEmco.exe
  2⤵
  PID:3280
- C:\Windows\System\ANSltnL.exe
  C:\Windows\System\ANSltnL.exe
  2⤵
  PID:4464
- C:\Windows\System\qtePhqR.exe
  C:\Windows\System\qtePhqR.exe
  2⤵
  PID:1848
- C:\Windows\System\pAhvkIg.exe
  C:\Windows\System\pAhvkIg.exe
  2⤵
  PID:3768
- C:\Windows\System\xMQMqXv.exe
  C:\Windows\System\xMQMqXv.exe
  2⤵
  PID:1056
- C:\Windows\System\QDtvdUb.exe
  C:\Windows\System\QDtvdUb.exe
  2⤵
  PID:3496
- C:\Windows\System\zPhvDgv.exe
  C:\Windows\System\zPhvDgv.exe
  2⤵
  PID:3944
- C:\Windows\System\sWdfHvk.exe
  C:\Windows\System\sWdfHvk.exe
  2⤵
  PID:2496
- C:\Windows\System\UFrLmFB.exe
  C:\Windows\System\UFrLmFB.exe
  2⤵
  PID:3116
- C:\Windows\System\USIZoaj.exe
  C:\Windows\System\USIZoaj.exe
  2⤵
  PID:4664
- C:\Windows\System\exgNhSB.exe
  C:\Windows\System\exgNhSB.exe
  2⤵
  PID:4776
- C:\Windows\System\CTUrEGg.exe
  C:\Windows\System\CTUrEGg.exe
  2⤵
  PID:5116
- C:\Windows\System\MyTlhaN.exe
  C:\Windows\System\MyTlhaN.exe
  2⤵
  PID:2476
- C:\Windows\System\pSghyiA.exe
  C:\Windows\System\pSghyiA.exe
  2⤵
  PID:1616
- C:\Windows\System\BpRpsex.exe
  C:\Windows\System\BpRpsex.exe
  2⤵
  PID:4264
- C:\Windows\System\jwFsFDx.exe
  C:\Windows\System\jwFsFDx.exe
  2⤵
  PID:2552
- C:\Windows\System\bfsWdDo.exe
  C:\Windows\System\bfsWdDo.exe
  2⤵
  PID:872
- C:\Windows\System\KEaqfjI.exe
  C:\Windows\System\KEaqfjI.exe
  2⤵
  PID:4516
- C:\Windows\System\HhpderS.exe
  C:\Windows\System\HhpderS.exe
  2⤵
  PID:2692
- C:\Windows\System\CkXTgca.exe
  C:\Windows\System\CkXTgca.exe
  2⤵
  PID:5032
- C:\Windows\System\FJAvBex.exe
  C:\Windows\System\FJAvBex.exe
  2⤵
  PID:3620
- C:\Windows\System\VRNxGTW.exe
  C:\Windows\System\VRNxGTW.exe
  2⤵
  PID:3812
- C:\Windows\System\lWNpjaG.exe
  C:\Windows\System\lWNpjaG.exe
  2⤵
  PID:4556
- C:\Windows\System\ziISXBB.exe
  C:\Windows\System\ziISXBB.exe
  2⤵
  PID:2840
- C:\Windows\System\ofMvKyT.exe
  C:\Windows\System\ofMvKyT.exe
  2⤵
  PID:4756
- C:\Windows\System\ZOGWbcs.exe
  C:\Windows\System\ZOGWbcs.exe
  2⤵
  PID:4840
- C:\Windows\System\qsSXfkC.exe
  C:\Windows\System\qsSXfkC.exe
  2⤵
  PID:1676
- C:\Windows\System\WFTYFXD.exe
  C:\Windows\System\WFTYFXD.exe
  2⤵
  PID:2084
- C:\Windows\System\PulViNQ.exe
  C:\Windows\System\PulViNQ.exe
  2⤵
  PID:1640
- C:\Windows\System\JwZJInD.exe
  C:\Windows\System\JwZJInD.exe
  2⤵
  PID:4316
- C:\Windows\System\mQOccAW.exe
  C:\Windows\System\mQOccAW.exe
  2⤵
  PID:5124
- C:\Windows\System\jknUdJo.exe
  C:\Windows\System\jknUdJo.exe
  2⤵
  PID:5144
- C:\Windows\System\BCOGHaS.exe
  C:\Windows\System\BCOGHaS.exe
  2⤵
  PID:5200
- C:\Windows\System\QfLOdOf.exe
  C:\Windows\System\QfLOdOf.exe
  2⤵
  PID:5220
- C:\Windows\System\zkeSSWX.exe
  C:\Windows\System\zkeSSWX.exe
  2⤵
  PID:5236
- C:\Windows\System\PkrUpch.exe
  C:\Windows\System\PkrUpch.exe
  2⤵
  PID:5252
- C:\Windows\System\WbgjiKP.exe
  C:\Windows\System\WbgjiKP.exe
  2⤵
  PID:5272
- C:\Windows\System\dgeyQqn.exe
  C:\Windows\System\dgeyQqn.exe
  2⤵
  PID:5288
- C:\Windows\System\ahtxpvv.exe
  C:\Windows\System\ahtxpvv.exe
  2⤵
  PID:5308
- C:\Windows\System\OxbRcvo.exe
  C:\Windows\System\OxbRcvo.exe
  2⤵
  PID:5428
- C:\Windows\System\NFJgIyD.exe
  C:\Windows\System\NFJgIyD.exe
  2⤵
  PID:5456
- C:\Windows\System\JrwNKXw.exe
  C:\Windows\System\JrwNKXw.exe
  2⤵
  PID:5472
- C:\Windows\System\ExUegwl.exe
  C:\Windows\System\ExUegwl.exe
  2⤵
  PID:5488
- C:\Windows\System\CgqYUVl.exe
  C:\Windows\System\CgqYUVl.exe
  2⤵
  PID:5504
- C:\Windows\System\naFPHta.exe
  C:\Windows\System\naFPHta.exe
  2⤵
  PID:5524
- C:\Windows\System\NrlbDdA.exe
  C:\Windows\System\NrlbDdA.exe
  2⤵
  PID:5540
- C:\Windows\System\RVSejXC.exe
  C:\Windows\System\RVSejXC.exe
  2⤵
  PID:5556
- C:\Windows\System\QZkMydC.exe
  C:\Windows\System\QZkMydC.exe
  2⤵
  PID:5572
- C:\Windows\System\nnsvZBq.exe
  C:\Windows\System\nnsvZBq.exe
  2⤵
  PID:5588
- C:\Windows\System\AMgjArW.exe
  C:\Windows\System\AMgjArW.exe
  2⤵
  PID:5604
- C:\Windows\System\rUissLT.exe
  C:\Windows\System\rUissLT.exe
  2⤵
  PID:5620
- C:\Windows\System\twLVSAC.exe
  C:\Windows\System\twLVSAC.exe
  2⤵
  PID:5640
- C:\Windows\System\DLJPsDe.exe
  C:\Windows\System\DLJPsDe.exe
  2⤵
  PID:5656
- C:\Windows\System\FfjlwpD.exe
  C:\Windows\System\FfjlwpD.exe
  2⤵
  PID:5800
- C:\Windows\System\UKSlooU.exe
  C:\Windows\System\UKSlooU.exe
  2⤵
  PID:5828
- C:\Windows\System\tspePfP.exe
  C:\Windows\System\tspePfP.exe
  2⤵
  PID:5844
- C:\Windows\System\aEMlYWM.exe
  C:\Windows\System\aEMlYWM.exe
  2⤵
  PID:5864
- C:\Windows\System\bIQWfwT.exe
  C:\Windows\System\bIQWfwT.exe
  2⤵
  PID:5880
- C:\Windows\System\JnqNbGR.exe
  C:\Windows\System\JnqNbGR.exe
  2⤵
  PID:5896
- C:\Windows\System\GMPoRHL.exe
  C:\Windows\System\GMPoRHL.exe
  2⤵
  PID:5912
- C:\Windows\System\IxVgDVk.exe
  C:\Windows\System\IxVgDVk.exe
  2⤵
  PID:5944
- C:\Windows\System\amJVWPU.exe
  C:\Windows\System\amJVWPU.exe
  2⤵
  PID:5964
- C:\Windows\System\MoFbzoz.exe
  C:\Windows\System\MoFbzoz.exe
  2⤵
  PID:5980
- C:\Windows\System\SrrSzsr.exe
  C:\Windows\System\SrrSzsr.exe
  2⤵
  PID:5996
- C:\Windows\System\fhADgtn.exe
  C:\Windows\System\fhADgtn.exe
  2⤵
  PID:6012
- C:\Windows\System\JbnxIno.exe
  C:\Windows\System\JbnxIno.exe
  2⤵
  PID:6028
- C:\Windows\System\MIsnUAp.exe
  C:\Windows\System\MIsnUAp.exe
  2⤵
  PID:6048
- C:\Windows\System\qYlinFD.exe
  C:\Windows\System\qYlinFD.exe
  2⤵
  PID:6108
- C:\Windows\System\ddZyjpC.exe
  C:\Windows\System\ddZyjpC.exe
  2⤵
  PID:6124
- C:\Windows\System\tkNAlFH.exe
  C:\Windows\System\tkNAlFH.exe
  2⤵
  PID:6140
- C:\Windows\System\slCnsHu.exe
  C:\Windows\System\slCnsHu.exe
  2⤵
  PID:2772
- C:\Windows\System\IFWiapR.exe
  C:\Windows\System\IFWiapR.exe
  2⤵
  PID:3996
- C:\Windows\System\xokMUGh.exe
  C:\Windows\System\xokMUGh.exe
  2⤵
  PID:2008
- C:\Windows\System\zuVBkfP.exe
  C:\Windows\System\zuVBkfP.exe
  2⤵
  PID:4416
- C:\Windows\System\sZkkrBo.exe
  C:\Windows\System\sZkkrBo.exe
  2⤵
  PID:1644
- C:\Windows\System\iBOmOIr.exe
  C:\Windows\System\iBOmOIr.exe
  2⤵
  PID:4584
- C:\Windows\System\olhCXYi.exe
  C:\Windows\System\olhCXYi.exe
  2⤵
  PID:4320
- C:\Windows\System\BwumUqr.exe
  C:\Windows\System\BwumUqr.exe
  2⤵
  PID:4284
- C:\Windows\System\DtikltJ.exe
  C:\Windows\System\DtikltJ.exe
  2⤵
  PID:4648
- C:\Windows\System\sRUSEfO.exe
  C:\Windows\System\sRUSEfO.exe
  2⤵
  PID:3208
- C:\Windows\System\jlCNVGw.exe
  C:\Windows\System\jlCNVGw.exe
  2⤵
  PID:3012
- C:\Windows\System\BNQlzuL.exe
  C:\Windows\System\BNQlzuL.exe
  2⤵
  PID:2984
- C:\Windows\System\EGQTmCL.exe
  C:\Windows\System\EGQTmCL.exe
  2⤵
  PID:4712
- C:\Windows\System\jrNuxau.exe
  C:\Windows\System\jrNuxau.exe
  2⤵
  PID:5132
- C:\Windows\System\RSPpuAo.exe
  C:\Windows\System\RSPpuAo.exe
  2⤵
  PID:2768
- C:\Windows\System\riRfmcw.exe
  C:\Windows\System\riRfmcw.exe
  2⤵
  PID:4496
- C:\Windows\System\nBOKMOX.exe
  C:\Windows\System\nBOKMOX.exe
  2⤵
  PID:3032
- C:\Windows\System\VoeOnzD.exe
  C:\Windows\System\VoeOnzD.exe
  2⤵
  PID:3980
- C:\Windows\System\aRDAazA.exe
  C:\Windows\System\aRDAazA.exe
  2⤵
  PID:5156
- C:\Windows\System\ajMrQRT.exe
  C:\Windows\System\ajMrQRT.exe
  2⤵
  PID:5176
- C:\Windows\System\pDqiSSR.exe
  C:\Windows\System\pDqiSSR.exe
  2⤵
  PID:5196
- C:\Windows\System\Zpbmske.exe
  C:\Windows\System\Zpbmske.exe
  2⤵
  PID:5212
- C:\Windows\System\GqBbjMG.exe
  C:\Windows\System\GqBbjMG.exe
  2⤵
  PID:5328
- C:\Windows\System\LXvciRF.exe
  C:\Windows\System\LXvciRF.exe
  2⤵
  PID:5340
- C:\Windows\System\FvNocaA.exe
  C:\Windows\System\FvNocaA.exe
  2⤵
  PID:5356
- C:\Windows\System\WsmzAMY.exe
  C:\Windows\System\WsmzAMY.exe
  2⤵
  PID:5228
- C:\Windows\System\SkIjiev.exe
  C:\Windows\System\SkIjiev.exe
  2⤵
  PID:5316
- C:\Windows\System\PVHovmy.exe
  C:\Windows\System\PVHovmy.exe
  2⤵
  PID:5232
- C:\Windows\System\YsAnpXc.exe
  C:\Windows\System\YsAnpXc.exe
  2⤵
  PID:5372
- C:\Windows\System\aAuucbf.exe
  C:\Windows\System\aAuucbf.exe
  2⤵
  PID:5416
- C:\Windows\System\uRGUvSU.exe
  C:\Windows\System\uRGUvSU.exe
  2⤵
  PID:5400
- C:\Windows\System\PDLLujN.exe
  C:\Windows\System\PDLLujN.exe
  2⤵
  PID:5420
- C:\Windows\System\gKDCcZF.exe
  C:\Windows\System\gKDCcZF.exe
  2⤵
  PID:5424
- C:\Windows\System\VVkMrjf.exe
  C:\Windows\System\VVkMrjf.exe
  2⤵
  PID:5532
- C:\Windows\System\ZgMLxRT.exe
  C:\Windows\System\ZgMLxRT.exe
  2⤵
  PID:5464
- C:\Windows\System\TtZhqfh.exe
  C:\Windows\System\TtZhqfh.exe
  2⤵
  PID:5628
- C:\Windows\System\DRZnpnM.exe
  C:\Windows\System\DRZnpnM.exe
  2⤵
  PID:5668
- C:\Windows\System\WkdgqGl.exe
  C:\Windows\System\WkdgqGl.exe
  2⤵
  PID:5676
- C:\Windows\System\EFJypYa.exe
  C:\Windows\System\EFJypYa.exe
  2⤵
  PID:5680
- C:\Windows\System\PZuSxTf.exe
  C:\Windows\System\PZuSxTf.exe
  2⤵
  PID:5584
- C:\Windows\System\eBCwrvS.exe
  C:\Windows\System\eBCwrvS.exe
  2⤵
  PID:5480
- C:\Windows\System\TNqtMNK.exe
  C:\Windows\System\TNqtMNK.exe
  2⤵
  PID:5688
- C:\Windows\System\XznDXfz.exe
  C:\Windows\System\XznDXfz.exe
  2⤵
  PID:5704
- C:\Windows\System\dAgROyI.exe
  C:\Windows\System\dAgROyI.exe
  2⤵
  PID:5720
- C:\Windows\System\azRuZoA.exe
  C:\Windows\System\azRuZoA.exe
  2⤵
  PID:5736
- C:\Windows\System\QAojXaR.exe
  C:\Windows\System\QAojXaR.exe
  2⤵
  PID:5756
- C:\Windows\System\KVjtWXO.exe
  C:\Windows\System\KVjtWXO.exe
  2⤵
  PID:5764
- C:\Windows\System\AXzMByE.exe
  C:\Windows\System\AXzMByE.exe
  2⤵
  PID:5768
- C:\Windows\System\vfEjTrX.exe
  C:\Windows\System\vfEjTrX.exe
  2⤵
  PID:5808
- C:\Windows\System\vrnmEjN.exe
  C:\Windows\System\vrnmEjN.exe
  2⤵
  PID:5836
- C:\Windows\System\GieJUMx.exe
  C:\Windows\System\GieJUMx.exe
  2⤵
  PID:5872
- C:\Windows\System\FGGCdws.exe
  C:\Windows\System\FGGCdws.exe
  2⤵
  PID:5952
- C:\Windows\System\XZUCoEa.exe
  C:\Windows\System\XZUCoEa.exe
  2⤵
  PID:5956
- C:\Windows\System\eHLjdCX.exe
  C:\Windows\System\eHLjdCX.exe
  2⤵
  PID:6008
- C:\Windows\System\xgDFyNV.exe
  C:\Windows\System\xgDFyNV.exe
  2⤵
  PID:2524
- C:\Windows\System\zFbrsCG.exe
  C:\Windows\System\zFbrsCG.exe
  2⤵
  PID:6020
- C:\Windows\System\dIvmbIt.exe
  C:\Windows\System\dIvmbIt.exe
  2⤵
  PID:2304
- C:\Windows\System\rLtmFma.exe
  C:\Windows\System\rLtmFma.exe
  2⤵
  PID:3728
- C:\Windows\System\BZHdlAm.exe
  C:\Windows\System\BZHdlAm.exe
  2⤵
  PID:6072
- C:\Windows\System\BYVdITe.exe
  C:\Windows\System\BYVdITe.exe
  2⤵
  PID:4820
- C:\Windows\System\UYGUcfs.exe
  C:\Windows\System\UYGUcfs.exe
  2⤵
  PID:6104
- C:\Windows\System\gNWXsyO.exe
  C:\Windows\System\gNWXsyO.exe
  2⤵
  PID:4256
- C:\Windows\System\FILXcDM.exe
  C:\Windows\System\FILXcDM.exe
  2⤵
  PID:2616
- C:\Windows\System\syDnZsw.exe
  C:\Windows\System\syDnZsw.exe
  2⤵
  PID:2804
- C:\Windows\System\DoBEsZa.exe
  C:\Windows\System\DoBEsZa.exe
  2⤵
  PID:4552
- C:\Windows\System\fFbAOPN.exe
  C:\Windows\System\fFbAOPN.exe
  2⤵
  PID:3432
- C:\Windows\System\gLimpGN.exe
  C:\Windows\System\gLimpGN.exe
  2⤵
  PID:3428
- C:\Windows\System\pSlkJVy.exe
  C:\Windows\System\pSlkJVy.exe
  2⤵
  PID:5336
- C:\Windows\System\JcIrnFW.exe
  C:\Windows\System\JcIrnFW.exe
  2⤵
  PID:5248
- C:\Windows\System\TPLTCIZ.exe
  C:\Windows\System\TPLTCIZ.exe
  2⤵
  PID:5184
- C:\Windows\System\DLHWPTC.exe
  C:\Windows\System\DLHWPTC.exe
  2⤵
  PID:5348
- C:\Windows\System\umSkplS.exe
  C:\Windows\System\umSkplS.exe
  2⤵
  PID:5384
- C:\Windows\System\yNBeySS.exe
  C:\Windows\System\yNBeySS.exe
  2⤵
  PID:5408
- C:\Windows\System\YRIJdXG.exe
  C:\Windows\System\YRIJdXG.exe
  2⤵
  PID:5404
- C:\Windows\System\QcjpIoL.exe
  C:\Windows\System\QcjpIoL.exe
  2⤵
  PID:5600
- C:\Windows\System\zwpBTaE.exe
  C:\Windows\System\zwpBTaE.exe
  2⤵
  PID:5564
- C:\Windows\System\PPncjZN.exe
  C:\Windows\System\PPncjZN.exe
  2⤵
  PID:5552
- C:\Windows\System\hPBjORF.exe
  C:\Windows\System\hPBjORF.exe
  2⤵
  PID:5700
- C:\Windows\System\npKzxeR.exe
  C:\Windows\System\npKzxeR.exe
  2⤵
  PID:5740
- C:\Windows\System\zUXLdpG.exe
  C:\Windows\System\zUXLdpG.exe
  2⤵
  PID:5684
- C:\Windows\System\XYYVMsE.exe
  C:\Windows\System\XYYVMsE.exe
  2⤵
  PID:5612
- C:\Windows\System\TdYNoKG.exe
  C:\Windows\System\TdYNoKG.exe
  2⤵
  PID:5876
- C:\Windows\System\snsrufJ.exe
  C:\Windows\System\snsrufJ.exe
  2⤵
  PID:5940
- C:\Windows\System\HGqPHXJ.exe
  C:\Windows\System\HGqPHXJ.exe
  2⤵
  PID:5988
- C:\Windows\System\IhaFiRF.exe
  C:\Windows\System\IhaFiRF.exe
  2⤵
  PID:6136
- C:\Windows\System\uCMPfjA.exe
  C:\Windows\System\uCMPfjA.exe
  2⤵
  PID:6100
- C:\Windows\System\htVtBJl.exe
  C:\Windows\System\htVtBJl.exe
  2⤵
  PID:3544
- C:\Windows\System\eabtAhL.exe
  C:\Windows\System\eabtAhL.exe
  2⤵
  PID:5324
- C:\Windows\System\FrXqjbR.exe
  C:\Windows\System\FrXqjbR.exe
  2⤵
  PID:5296
- C:\Windows\System\kbCFJjy.exe
  C:\Windows\System\kbCFJjy.exe
  2⤵
  PID:5664
- C:\Windows\System\pDolBEk.exe
  C:\Windows\System\pDolBEk.exe
  2⤵
  PID:3964
- C:\Windows\System\VFrhxao.exe
  C:\Windows\System\VFrhxao.exe
  2⤵
  PID:6080
- C:\Windows\System\kGGHpRg.exe
  C:\Windows\System\kGGHpRg.exe
  2⤵
  PID:2708
- C:\Windows\System\eRKxplm.exe
  C:\Windows\System\eRKxplm.exe
  2⤵
  PID:5160
- C:\Windows\System\xWUNZfr.exe
  C:\Windows\System\xWUNZfr.exe
  2⤵
  PID:5496
- C:\Windows\System\KwyLKaM.exe
  C:\Windows\System\KwyLKaM.exe
  2⤵
  PID:5616
- C:\Windows\System\TcIsmOa.exe
  C:\Windows\System\TcIsmOa.exe
  2⤵
  PID:5788
- C:\Windows\System\sbxifkL.exe
  C:\Windows\System\sbxifkL.exe
  2⤵
  PID:5776
- C:\Windows\System\OoatySD.exe
  C:\Windows\System\OoatySD.exe
  2⤵
  PID:5860
- C:\Windows\System\FySkgzN.exe
  C:\Windows\System\FySkgzN.exe
  2⤵
  PID:5936
- C:\Windows\System\CLHIzvg.exe
  C:\Windows\System\CLHIzvg.exe
  2⤵
  PID:5920
- C:\Windows\System\MBeOgWy.exe
  C:\Windows\System\MBeOgWy.exe
  2⤵
  PID:6116
- C:\Windows\System\oaKAzPo.exe
  C:\Windows\System\oaKAzPo.exe
  2⤵
  PID:5932
- C:\Windows\System\rAxnRjj.exe
  C:\Windows\System\rAxnRjj.exe
  2⤵
  PID:4336
- C:\Windows\System\IagRfOT.exe
  C:\Windows\System\IagRfOT.exe
  2⤵
  PID:5364
- C:\Windows\System\VNDpnRh.exe
  C:\Windows\System\VNDpnRh.exe
  2⤵
  PID:3692
- C:\Windows\System\NMlsXYk.exe
  C:\Windows\System\NMlsXYk.exe
  2⤵
  PID:2932
- C:\Windows\System\kLYqOaA.exe
  C:\Windows\System\kLYqOaA.exe
  2⤵
  PID:5840
- C:\Windows\System\tJZvOGw.exe
  C:\Windows\System\tJZvOGw.exe
  2⤵
  PID:6152
- C:\Windows\System\lATTPjN.exe
  C:\Windows\System\lATTPjN.exe
  2⤵
  PID:6168
- C:\Windows\System\cWSHWLF.exe
  C:\Windows\System\cWSHWLF.exe
  2⤵
  PID:6184
- C:\Windows\System\wrmVehs.exe
  C:\Windows\System\wrmVehs.exe
  2⤵
  PID:6200
- C:\Windows\System\DFbfQNL.exe
  C:\Windows\System\DFbfQNL.exe
  2⤵
  PID:6216
- C:\Windows\System\pBBBNcB.exe
  C:\Windows\System\pBBBNcB.exe
  2⤵
  PID:6232
- C:\Windows\System\UJWbHOy.exe
  C:\Windows\System\UJWbHOy.exe
  2⤵
  PID:6248
- C:\Windows\System\xXYSEAr.exe
  C:\Windows\System\xXYSEAr.exe
  2⤵
  PID:6264
- C:\Windows\System\rmObXLS.exe
  C:\Windows\System\rmObXLS.exe
  2⤵
  PID:6280
- C:\Windows\System\PmiVNdk.exe
  C:\Windows\System\PmiVNdk.exe
  2⤵
  PID:6296
- C:\Windows\System\pONhnyL.exe
  C:\Windows\System\pONhnyL.exe
  2⤵
  PID:6316
- C:\Windows\System\smKONYA.exe
  C:\Windows\System\smKONYA.exe
  2⤵
  PID:6332
- C:\Windows\System\PIgeeyq.exe
  C:\Windows\System\PIgeeyq.exe
  2⤵
  PID:6352
- C:\Windows\System\uFPqVyn.exe
  C:\Windows\System\uFPqVyn.exe
  2⤵
  PID:6372
- C:\Windows\System\gyBvJSS.exe
  C:\Windows\System\gyBvJSS.exe
  2⤵
  PID:6388
- C:\Windows\System\FrvEuUD.exe
  C:\Windows\System\FrvEuUD.exe
  2⤵
  PID:6404
- C:\Windows\System\gkUMFft.exe
  C:\Windows\System\gkUMFft.exe
  2⤵
  PID:6524
- C:\Windows\System\KKWtBJo.exe
  C:\Windows\System\KKWtBJo.exe
  2⤵
  PID:6540
- C:\Windows\System\oCZbPOo.exe
  C:\Windows\System\oCZbPOo.exe
  2⤵
  PID:6560
- C:\Windows\System\gQYPTbg.exe
  C:\Windows\System\gQYPTbg.exe
  2⤵
  PID:6576
- C:\Windows\System\qYCvsRt.exe
  C:\Windows\System\qYCvsRt.exe
  2⤵
  PID:6592
- C:\Windows\System\lJIXuzq.exe
  C:\Windows\System\lJIXuzq.exe
  2⤵
  PID:6612
- C:\Windows\System\DPTfAth.exe
  C:\Windows\System\DPTfAth.exe
  2⤵
  PID:6628
- C:\Windows\System\qoOvEXO.exe
  C:\Windows\System\qoOvEXO.exe
  2⤵
  PID:6644
- C:\Windows\System\NawygJq.exe
  C:\Windows\System\NawygJq.exe
  2⤵
  PID:6660
- C:\Windows\System\hipyqfc.exe
  C:\Windows\System\hipyqfc.exe
  2⤵
  PID:6676
- C:\Windows\System\lIZGIfv.exe
  C:\Windows\System\lIZGIfv.exe
  2⤵
  PID:6692
- C:\Windows\System\saPkpad.exe
  C:\Windows\System\saPkpad.exe
  2⤵
  PID:6708
- C:\Windows\System\zGSZtev.exe
  C:\Windows\System\zGSZtev.exe
  2⤵
  PID:6724
- C:\Windows\System\AUsDiHo.exe
  C:\Windows\System\AUsDiHo.exe
  2⤵
  PID:6740
- C:\Windows\System\XnODOIz.exe
  C:\Windows\System\XnODOIz.exe
  2⤵
  PID:6756
- C:\Windows\System\sSgMNeT.exe
  C:\Windows\System\sSgMNeT.exe
  2⤵
  PID:6772
- C:\Windows\System\KuupiFl.exe
  C:\Windows\System\KuupiFl.exe
  2⤵
  PID:6788
- C:\Windows\System\MPbSeAd.exe
  C:\Windows\System\MPbSeAd.exe
  2⤵
  PID:6804
- C:\Windows\System\ZTNxFWk.exe
  C:\Windows\System\ZTNxFWk.exe
  2⤵
  PID:6820
- C:\Windows\System\UDmljUx.exe
  C:\Windows\System\UDmljUx.exe
  2⤵
  PID:6840
- C:\Windows\System\gklBfly.exe
  C:\Windows\System\gklBfly.exe
  2⤵
  PID:6856
- C:\Windows\System\gUSVeVj.exe
  C:\Windows\System\gUSVeVj.exe
  2⤵
  PID:6872
- C:\Windows\System\cPbMwZK.exe
  C:\Windows\System\cPbMwZK.exe
  2⤵
  PID:6892
- C:\Windows\System\nogXfSl.exe
  C:\Windows\System\nogXfSl.exe
  2⤵
  PID:6908
- C:\Windows\System\TtqcTAg.exe
  C:\Windows\System\TtqcTAg.exe
  2⤵
  PID:6924
- C:\Windows\System\jHgdcwH.exe
  C:\Windows\System\jHgdcwH.exe
  2⤵
  PID:6940
- C:\Windows\System\KixbYuH.exe
  C:\Windows\System\KixbYuH.exe
  2⤵
  PID:6956
- C:\Windows\System\ijSrNhG.exe
  C:\Windows\System\ijSrNhG.exe
  2⤵
  PID:6972
- C:\Windows\System\prTKiXf.exe
  C:\Windows\System\prTKiXf.exe
  2⤵
  PID:6988
- C:\Windows\System\FQyXXLS.exe
  C:\Windows\System\FQyXXLS.exe
  2⤵
  PID:7004
- C:\Windows\System\BGmwLFy.exe
  C:\Windows\System\BGmwLFy.exe
  2⤵
  PID:7020
- C:\Windows\System\ufryWoT.exe
  C:\Windows\System\ufryWoT.exe
  2⤵
  PID:7036
- C:\Windows\System\InEKfbG.exe
  C:\Windows\System\InEKfbG.exe
  2⤵
  PID:7052
- C:\Windows\System\MDBOBdd.exe
  C:\Windows\System\MDBOBdd.exe
  2⤵
  PID:7068
- C:\Windows\System\AGiFQAz.exe
  C:\Windows\System\AGiFQAz.exe
  2⤵
  PID:7084
- C:\Windows\System\CskUGze.exe
  C:\Windows\System\CskUGze.exe
  2⤵
  PID:7100
- C:\Windows\System\jWGsfyY.exe
  C:\Windows\System\jWGsfyY.exe
  2⤵
  PID:7116
- C:\Windows\System\xYGEoWi.exe
  C:\Windows\System\xYGEoWi.exe
  2⤵
  PID:5796
- C:\Windows\System\cEagduL.exe
  C:\Windows\System\cEagduL.exe
  2⤵
  PID:5448
- C:\Windows\System\hNLnDLb.exe
  C:\Windows\System\hNLnDLb.exe
  2⤵
  PID:6180
- C:\Windows\System\wgRMObf.exe
  C:\Windows\System\wgRMObf.exe
  2⤵
  PID:6240
- C:\Windows\System\KjaqVYz.exe
  C:\Windows\System\KjaqVYz.exe
  2⤵
  PID:5192
- C:\Windows\System\UqmdnnV.exe
  C:\Windows\System\UqmdnnV.exe
  2⤵
  PID:6304
- C:\Windows\System\jnSeNWe.exe
  C:\Windows\System\jnSeNWe.exe
  2⤵
  PID:6164
- C:\Windows\System\DHIirTg.exe
  C:\Windows\System\DHIirTg.exe
  2⤵
  PID:6344
- C:\Windows\System\qrNtLyu.exe
  C:\Windows\System\qrNtLyu.exe
  2⤵
  PID:6384
- C:\Windows\System\MZNXbga.exe
  C:\Windows\System\MZNXbga.exe
  2⤵
  PID:6224
- C:\Windows\System\DccjWKe.exe
  C:\Windows\System\DccjWKe.exe
  2⤵
  PID:6288
- C:\Windows\System\PVcTdIF.exe
  C:\Windows\System\PVcTdIF.exe
  2⤵
  PID:6360
- C:\Windows\System\utVIKDl.exe
  C:\Windows\System\utVIKDl.exe
  2⤵
  PID:6380
- C:\Windows\System\BphEqdt.exe
  C:\Windows\System\BphEqdt.exe
  2⤵
  PID:6440
- C:\Windows\System\OojnlYZ.exe
  C:\Windows\System\OojnlYZ.exe
  2⤵
  PID:6464
- C:\Windows\System\NThclBu.exe
  C:\Windows\System\NThclBu.exe
  2⤵
  PID:6480
- C:\Windows\System\VVrMAuv.exe
  C:\Windows\System\VVrMAuv.exe
  2⤵
  PID:5856
- C:\Windows\System\SUoipFg.exe
  C:\Windows\System\SUoipFg.exe
  2⤵
  PID:6512
- C:\Windows\System\QKSmsFM.exe
  C:\Windows\System\QKSmsFM.exe
  2⤵
  PID:6548
- C:\Windows\System\LOYPTrD.exe
  C:\Windows\System\LOYPTrD.exe
  2⤵
  PID:6620
- C:\Windows\System\FhHUAKh.exe
  C:\Windows\System\FhHUAKh.exe
  2⤵
  PID:6684
- C:\Windows\System\QTMMsbw.exe
  C:\Windows\System\QTMMsbw.exe
  2⤵
  PID:6720
- C:\Windows\System\HqLbGET.exe
  C:\Windows\System\HqLbGET.exe
  2⤵
  PID:6784
- C:\Windows\System\PkDITTU.exe
  C:\Windows\System\PkDITTU.exe
  2⤵
  PID:6880
- C:\Windows\System\xJdmlCL.exe
  C:\Windows\System\xJdmlCL.exe
  2⤵
  PID:6916
- C:\Windows\System\sAUkVSl.exe
  C:\Windows\System\sAUkVSl.exe
  2⤵
  PID:6948
- C:\Windows\System\rtWvJqF.exe
  C:\Windows\System\rtWvJqF.exe
  2⤵
  PID:6636
- C:\Windows\System\DeyfLEw.exe
  C:\Windows\System\DeyfLEw.exe
  2⤵
  PID:7016
- C:\Windows\System\ickBRyX.exe
  C:\Windows\System\ickBRyX.exe
  2⤵
  PID:6640
- C:\Windows\System\FjLgKeC.exe
  C:\Windows\System\FjLgKeC.exe
  2⤵
  PID:6572
- C:\Windows\System\ZvqlBYJ.exe
  C:\Windows\System\ZvqlBYJ.exe
  2⤵
  PID:6600
- C:\Windows\System\LBScikx.exe
  C:\Windows\System\LBScikx.exe
  2⤵
  PID:7080
- C:\Windows\System\WflgMqi.exe
  C:\Windows\System\WflgMqi.exe
  2⤵
  PID:6904
- C:\Windows\System\InWgoyt.exe
  C:\Windows\System\InWgoyt.exe
  2⤵
  PID:7064
- C:\Windows\System\CVfKnqF.exe
  C:\Windows\System\CVfKnqF.exe
  2⤵
  PID:6968
- C:\Windows\System\pygEGiY.exe
  C:\Windows\System\pygEGiY.exe
  2⤵
  PID:7092
- C:\Windows\System\AyhqUJO.exe
  C:\Windows\System\AyhqUJO.exe
  2⤵
  PID:7140
- C:\Windows\System\aAXWKIW.exe
  C:\Windows\System\aAXWKIW.exe
  2⤵
  PID:2884
- C:\Windows\System\TtrNcmN.exe
  C:\Windows\System\TtrNcmN.exe
  2⤵
  PID:4504
- C:\Windows\System\koulIgI.exe
  C:\Windows\System\koulIgI.exe
  2⤵
  PID:5388
- C:\Windows\System\vVAANJI.exe
  C:\Windows\System\vVAANJI.exe
  2⤵
  PID:5260
- C:\Windows\System\GPuLzPq.exe
  C:\Windows\System\GPuLzPq.exe
  2⤵
  PID:1352
- C:\Windows\System\RSuTMzU.exe
  C:\Windows\System\RSuTMzU.exe
  2⤵
  PID:4340
- C:\Windows\System\DECZBWk.exe
  C:\Windows\System\DECZBWk.exe
  2⤵
  PID:6244
- C:\Windows\System\cYgGApB.exe
  C:\Windows\System\cYgGApB.exe
  2⤵
  PID:6348
- C:\Windows\System\FvYaOlC.exe
  C:\Windows\System\FvYaOlC.exe
  2⤵
  PID:5636
- C:\Windows\System\quxosZD.exe
  C:\Windows\System\quxosZD.exe
  2⤵
  PID:6276
- C:\Windows\System\SBAYCRY.exe
  C:\Windows\System\SBAYCRY.exe
  2⤵
  PID:6412
- C:\Windows\System\wOsrxNq.exe
  C:\Windows\System\wOsrxNq.exe
  2⤵
  PID:6328
- C:\Windows\System\BKlCaur.exe
  C:\Windows\System\BKlCaur.exe
  2⤵
  PID:6432
- C:\Windows\System\uwSfPlk.exe
  C:\Windows\System\uwSfPlk.exe
  2⤵
  PID:6504
- C:\Windows\System\YIKeRgw.exe
  C:\Windows\System\YIKeRgw.exe
  2⤵
  PID:6716
- C:\Windows\System\RxClIle.exe
  C:\Windows\System\RxClIle.exe
  2⤵
  PID:6532
- C:\Windows\System\bmRwozj.exe
  C:\Windows\System\bmRwozj.exe
  2⤵
  PID:6456
- C:\Windows\System\UsyvlCI.exe
  C:\Windows\System\UsyvlCI.exe
  2⤵
  PID:6496
- C:\Windows\System\bsADTJd.exe
  C:\Windows\System\bsADTJd.exe
  2⤵
  PID:6780
- C:\Windows\System\yIOgCbN.exe
  C:\Windows\System\yIOgCbN.exe
  2⤵
  PID:6984
- C:\Windows\System\yDHBchv.exe
  C:\Windows\System\yDHBchv.exe
  2⤵
  PID:6800
- C:\Windows\System\qoLHveN.exe
  C:\Windows\System\qoLHveN.exe
  2⤵
  PID:6900
- C:\Windows\System\GCPSlWn.exe
  C:\Windows\System\GCPSlWn.exe
  2⤵
  PID:6936
- C:\Windows\System\mFeRZUY.exe
  C:\Windows\System\mFeRZUY.exe
  2⤵
  PID:7060
- C:\Windows\System\FkcuQGO.exe
  C:\Windows\System\FkcuQGO.exe
  2⤵
  PID:7000
- C:\Windows\System\HGbHJkd.exe
  C:\Windows\System\HGbHJkd.exe
  2⤵
  PID:5152
- C:\Windows\System\RZWqLct.exe
  C:\Windows\System\RZWqLct.exe
  2⤵
  PID:6212
- C:\Windows\System\yTzCfEr.exe
  C:\Windows\System\yTzCfEr.exe
  2⤵
  PID:6036
- C:\Windows\System\rREcElg.exe
  C:\Windows\System\rREcElg.exe
  2⤵
  PID:6736
- C:\Windows\System\JcYFTMS.exe
  C:\Windows\System\JcYFTMS.exe
  2⤵
  PID:5780
- C:\Windows\System\ZfPsTMd.exe
  C:\Windows\System\ZfPsTMd.exe
  2⤵
  PID:7164
- C:\Windows\System\KFLrmxP.exe
  C:\Windows\System\KFLrmxP.exe
  2⤵
  PID:5888
- C:\Windows\System\elanLID.exe
  C:\Windows\System\elanLID.exe
  2⤵
  PID:6556
- C:\Windows\System\RgZesTB.exe
  C:\Windows\System\RgZesTB.exe
  2⤵
  PID:6260
- C:\Windows\System\LFTSBjx.exe
  C:\Windows\System\LFTSBjx.exe
  2⤵
  PID:6852
- C:\Windows\System\yPbUYnd.exe
  C:\Windows\System\yPbUYnd.exe
  2⤵
  PID:6848
- C:\Windows\System\YffImuf.exe
  C:\Windows\System\YffImuf.exe
  2⤵
  PID:6952
- C:\Windows\System\pQYojPe.exe
  C:\Windows\System\pQYojPe.exe
  2⤵
  PID:6488
- C:\Windows\System\VUTvpLF.exe
  C:\Windows\System\VUTvpLF.exe
  2⤵
  PID:6964
- C:\Windows\System\ZCETwCh.exe
  C:\Windows\System\ZCETwCh.exe
  2⤵
  PID:7032
- C:\Windows\System\NjEFHvn.exe
  C:\Windows\System\NjEFHvn.exe
  2⤵
  PID:5264
- C:\Windows\System\RtCYcFh.exe
  C:\Windows\System\RtCYcFh.exe
  2⤵
  PID:6308
- C:\Windows\System\TqxLJgm.exe
  C:\Windows\System\TqxLJgm.exe
  2⤵
  PID:7124
- C:\Windows\System\UkJLHso.exe
  C:\Windows\System\UkJLHso.exe
  2⤵
  PID:5716
- C:\Windows\System\tYJjbgZ.exe
  C:\Windows\System\tYJjbgZ.exe
  2⤵
  PID:6472
- C:\Windows\System\bkYdlCU.exe
  C:\Windows\System\bkYdlCU.exe
  2⤵
  PID:6796
- C:\Windows\System\ugmzrzP.exe
  C:\Windows\System\ugmzrzP.exe
  2⤵
  PID:5172
- C:\Windows\System\YhOMidp.exe
  C:\Windows\System\YhOMidp.exe
  2⤵
  PID:6520
- C:\Windows\System\zTWzvBr.exe
  C:\Windows\System\zTWzvBr.exe
  2⤵
  PID:7108
- C:\Windows\System\jfTutnV.exe
  C:\Windows\System\jfTutnV.exe
  2⤵
  PID:6340
- C:\Windows\System\fVEIsiW.exe
  C:\Windows\System\fVEIsiW.exe
  2⤵
  PID:6888
- C:\Windows\System\ToTBrHA.exe
  C:\Windows\System\ToTBrHA.exe
  2⤵
  PID:5972
- C:\Windows\System\xKmuDlZ.exe
  C:\Windows\System\xKmuDlZ.exe
  2⤵
  PID:7136
- C:\Windows\System\tVoyowu.exe
  C:\Windows\System\tVoyowu.exe
  2⤵
  PID:6428
- C:\Windows\System\hjpyqtZ.exe
  C:\Windows\System\hjpyqtZ.exe
  2⤵
  PID:7180
- C:\Windows\System\jCcOQWK.exe
  C:\Windows\System\jCcOQWK.exe
  2⤵
  PID:7196
- C:\Windows\System\urFPreK.exe
  C:\Windows\System\urFPreK.exe
  2⤵
  PID:7212
- C:\Windows\System\XLLtlby.exe
  C:\Windows\System\XLLtlby.exe
  2⤵
  PID:7228
- C:\Windows\System\FGXiAGZ.exe
  C:\Windows\System\FGXiAGZ.exe
  2⤵
  PID:7244
- C:\Windows\System\yAbGXHs.exe
  C:\Windows\System\yAbGXHs.exe
  2⤵
  PID:7260
- C:\Windows\System\eVXgyyu.exe
  C:\Windows\System\eVXgyyu.exe
  2⤵
  PID:7276
- C:\Windows\System\Odggkmi.exe
  C:\Windows\System\Odggkmi.exe
  2⤵
  PID:7292
- C:\Windows\System\EJMSprZ.exe
  C:\Windows\System\EJMSprZ.exe
  2⤵
  PID:7308
- C:\Windows\System\hGUMmxJ.exe
  C:\Windows\System\hGUMmxJ.exe
  2⤵
  PID:7324
- C:\Windows\System\maKpVRI.exe
  C:\Windows\System\maKpVRI.exe
  2⤵
  PID:7340
- C:\Windows\System\cmKUXNQ.exe
  C:\Windows\System\cmKUXNQ.exe
  2⤵
  PID:7356
- C:\Windows\System\zaPMmNR.exe
  C:\Windows\System\zaPMmNR.exe
  2⤵
  PID:7372
- C:\Windows\System\RhgVBGO.exe
  C:\Windows\System\RhgVBGO.exe
  2⤵
  PID:7388
- C:\Windows\System\TXisndm.exe
  C:\Windows\System\TXisndm.exe
  2⤵
  PID:7404
- C:\Windows\System\otAGUYc.exe
  C:\Windows\System\otAGUYc.exe
  2⤵
  PID:7420
- C:\Windows\System\MglJhTR.exe
  C:\Windows\System\MglJhTR.exe
  2⤵
  PID:7436
- C:\Windows\System\VquUOdV.exe
  C:\Windows\System\VquUOdV.exe
  2⤵
  PID:7452
- C:\Windows\System\NmnfMKV.exe
  C:\Windows\System\NmnfMKV.exe
  2⤵
  PID:7468
- C:\Windows\System\lyhJxOS.exe
  C:\Windows\System\lyhJxOS.exe
  2⤵
  PID:7484
- C:\Windows\System\NKxrnbF.exe
  C:\Windows\System\NKxrnbF.exe
  2⤵
  PID:7500
- C:\Windows\System\vSTWGOM.exe
  C:\Windows\System\vSTWGOM.exe
  2⤵
  PID:7516
- C:\Windows\System\jLsCvWN.exe
  C:\Windows\System\jLsCvWN.exe
  2⤵
  PID:7532
- C:\Windows\System\sfEKpsI.exe
  C:\Windows\System\sfEKpsI.exe
  2⤵
  PID:7548
- C:\Windows\System\cZSjREL.exe
  C:\Windows\System\cZSjREL.exe
  2⤵
  PID:7564
- C:\Windows\System\ZDOykXg.exe
  C:\Windows\System\ZDOykXg.exe
  2⤵
  PID:7580
- C:\Windows\System\zxSNyFl.exe
  C:\Windows\System\zxSNyFl.exe
  2⤵
  PID:7600
- C:\Windows\System\KNRQMji.exe
  C:\Windows\System\KNRQMji.exe
  2⤵
  PID:7616
- C:\Windows\System\OJUxIyX.exe
  C:\Windows\System\OJUxIyX.exe
  2⤵
  PID:7632
- C:\Windows\System\WWGxaMl.exe
  C:\Windows\System\WWGxaMl.exe
  2⤵
  PID:7648
- C:\Windows\System\zvVIcbx.exe
  C:\Windows\System\zvVIcbx.exe
  2⤵
  PID:7664
- C:\Windows\System\RwAEBMF.exe
  C:\Windows\System\RwAEBMF.exe
  2⤵
  PID:7680
- C:\Windows\System\zwZptZV.exe
  C:\Windows\System\zwZptZV.exe
  2⤵
  PID:7696
- C:\Windows\System\KgFdQlj.exe
  C:\Windows\System\KgFdQlj.exe
  2⤵
  PID:7712
- C:\Windows\System\KMyBORX.exe
  C:\Windows\System\KMyBORX.exe
  2⤵
  PID:7728
- C:\Windows\System\KnNLYOU.exe
  C:\Windows\System\KnNLYOU.exe
  2⤵
  PID:7744
- C:\Windows\System\rsdtOdH.exe
  C:\Windows\System\rsdtOdH.exe
  2⤵
  PID:7760
- C:\Windows\System\qJMvqLO.exe
  C:\Windows\System\qJMvqLO.exe
  2⤵
  PID:7776
- C:\Windows\System\oiQTlOI.exe
  C:\Windows\System\oiQTlOI.exe
  2⤵
  PID:7792
- C:\Windows\System\YodThCg.exe
  C:\Windows\System\YodThCg.exe
  2⤵
  PID:7808
- C:\Windows\System\NtqAUCw.exe
  C:\Windows\System\NtqAUCw.exe
  2⤵
  PID:7824
- C:\Windows\System\HHDZtgQ.exe
  C:\Windows\System\HHDZtgQ.exe
  2⤵
  PID:7840
- C:\Windows\System\oejQNxU.exe
  C:\Windows\System\oejQNxU.exe
  2⤵
  PID:7856
- C:\Windows\System\EEeYBHJ.exe
  C:\Windows\System\EEeYBHJ.exe
  2⤵
  PID:7872
- C:\Windows\System\kcnrqtS.exe
  C:\Windows\System\kcnrqtS.exe
  2⤵
  PID:7888
- C:\Windows\System\yGJjbZC.exe
  C:\Windows\System\yGJjbZC.exe
  2⤵
  PID:7904
- C:\Windows\System\eSbmfDN.exe
  C:\Windows\System\eSbmfDN.exe
  2⤵
  PID:7920
- C:\Windows\System\qmlgWxN.exe
  C:\Windows\System\qmlgWxN.exe
  2⤵
  PID:7936
- C:\Windows\System\hOLrubr.exe
  C:\Windows\System\hOLrubr.exe
  2⤵
  PID:7952
- C:\Windows\System\twaEafp.exe
  C:\Windows\System\twaEafp.exe
  2⤵
  PID:7968
- C:\Windows\System\drQGeJg.exe
  C:\Windows\System\drQGeJg.exe
  2⤵
  PID:7984
- C:\Windows\System\NzcmqAq.exe
  C:\Windows\System\NzcmqAq.exe
  2⤵
  PID:8000
- C:\Windows\System\nxHUktm.exe
  C:\Windows\System\nxHUktm.exe
  2⤵
  PID:8016
- C:\Windows\System\LSsZcDv.exe
  C:\Windows\System\LSsZcDv.exe
  2⤵
  PID:8032
- C:\Windows\System\uFzWDBv.exe
  C:\Windows\System\uFzWDBv.exe
  2⤵
  PID:8048
- C:\Windows\System\lkWxQgx.exe
  C:\Windows\System\lkWxQgx.exe
  2⤵
  PID:8064
- C:\Windows\System\QNlvZst.exe
  C:\Windows\System\QNlvZst.exe
  2⤵
  PID:8080
- C:\Windows\System\oyXSjze.exe
  C:\Windows\System\oyXSjze.exe
  2⤵
  PID:8096
- C:\Windows\System\MBxSDDc.exe
  C:\Windows\System\MBxSDDc.exe
  2⤵
  PID:8112
- C:\Windows\System\VJtygtU.exe
  C:\Windows\System\VJtygtU.exe
  2⤵
  PID:8128
- C:\Windows\System\tvPClUE.exe
  C:\Windows\System\tvPClUE.exe
  2⤵
  PID:8144
- C:\Windows\System\NSlgVkY.exe
  C:\Windows\System\NSlgVkY.exe
  2⤵
  PID:8160
- C:\Windows\System\wVppNyZ.exe
  C:\Windows\System\wVppNyZ.exe
  2⤵
  PID:8176
- C:\Windows\System\ykuYJXx.exe
  C:\Windows\System\ykuYJXx.exe
  2⤵
  PID:7172
- C:\Windows\System\eeQpynF.exe
  C:\Windows\System\eeQpynF.exe
  2⤵
  PID:7236
- C:\Windows\System\tWGZXle.exe
  C:\Windows\System\tWGZXle.exe
  2⤵
  PID:7240
- C:\Windows\System\TVwvtDg.exe
  C:\Windows\System\TVwvtDg.exe
  2⤵
  PID:7188
- C:\Windows\System\CLZilFb.exe
  C:\Windows\System\CLZilFb.exe
  2⤵
  PID:7252
- C:\Windows\System\QPDehGB.exe
  C:\Windows\System\QPDehGB.exe
  2⤵
  PID:7332
- C:\Windows\System\dPgbDMd.exe
  C:\Windows\System\dPgbDMd.exe
  2⤵
  PID:7396
- C:\Windows\System\tCmBPxO.exe
  C:\Windows\System\tCmBPxO.exe
  2⤵
  PID:7288
- C:\Windows\System\MnZmCyd.exe
  C:\Windows\System\MnZmCyd.exe
  2⤵
  PID:7348
- C:\Windows\System\lOQnxNz.exe
  C:\Windows\System\lOQnxNz.exe
  2⤵
  PID:7464
- C:\Windows\System\uvYrrss.exe
  C:\Windows\System\uvYrrss.exe
  2⤵
  PID:7524
- C:\Windows\System\lWZXSen.exe
  C:\Windows\System\lWZXSen.exe
  2⤵
  PID:7384
- C:\Windows\System\VPuRMWI.exe
  C:\Windows\System\VPuRMWI.exe
  2⤵
  PID:7448
- C:\Windows\System\LBfzuda.exe
  C:\Windows\System\LBfzuda.exe
  2⤵
  PID:7508
- C:\Windows\System\WvoKqFu.exe
  C:\Windows\System\WvoKqFu.exe
  2⤵
  PID:7612
- C:\Windows\System\xonvbdC.exe
  C:\Windows\System\xonvbdC.exe
  2⤵
  PID:7676
- C:\Windows\System\bfnsNul.exe
  C:\Windows\System\bfnsNul.exe
  2⤵
  PID:7588
- C:\Windows\System\YLlFbJs.exe
  C:\Windows\System\YLlFbJs.exe
  2⤵
  PID:7628
- C:\Windows\System\EUvQbTJ.exe
  C:\Windows\System\EUvQbTJ.exe
  2⤵
  PID:7704
- C:\Windows\System\MgyjfqT.exe
  C:\Windows\System\MgyjfqT.exe
  2⤵
  PID:7756
- C:\Windows\System\iSfQQUx.exe
  C:\Windows\System\iSfQQUx.exe
  2⤵
  PID:7772
- C:\Windows\System\BUoVcYn.exe
  C:\Windows\System\BUoVcYn.exe
  2⤵
  PID:7848
- C:\Windows\System\BNRMbPA.exe
  C:\Windows\System\BNRMbPA.exe
  2⤵
  PID:7804
- C:\Windows\System\qrOATEm.exe
  C:\Windows\System\qrOATEm.exe
  2⤵
  PID:7868
- C:\Windows\System\FxmFYde.exe
  C:\Windows\System\FxmFYde.exe
  2⤵
  PID:7912
- C:\Windows\System\ghaRpiA.exe
  C:\Windows\System\ghaRpiA.exe
  2⤵
  PID:7900
- C:\Windows\System\OGMdyRf.exe
  C:\Windows\System\OGMdyRf.exe
  2⤵
  PID:7932
- C:\Windows\System\iWbWYol.exe
  C:\Windows\System\iWbWYol.exe
  2⤵
  PID:8012
- C:\Windows\System\qsajuhF.exe
  C:\Windows\System\qsajuhF.exe
  2⤵
  PID:8076
- C:\Windows\System\OXPmjdS.exe
  C:\Windows\System\OXPmjdS.exe
  2⤵
  PID:8136
- C:\Windows\System\prPGgio.exe
  C:\Windows\System\prPGgio.exe
  2⤵
  PID:8060
- C:\Windows\System\nACpjkH.exe
  C:\Windows\System\nACpjkH.exe
  2⤵
  PID:8124
- C:\Windows\System\PeIIdTX.exe
  C:\Windows\System\PeIIdTX.exe
  2⤵
  PID:8168
- C:\Windows\System\kVIDSxd.exe
  C:\Windows\System\kVIDSxd.exe
  2⤵
  PID:6604
- C:\Windows\System\uXaDdhe.exe
  C:\Windows\System\uXaDdhe.exe
  2⤵
  PID:7272
- C:\Windows\System\JIFNoMD.exe
  C:\Windows\System\JIFNoMD.exe
  2⤵
  PID:7304
- C:\Windows\System\GmZdxsv.exe
  C:\Windows\System\GmZdxsv.exe
  2⤵
  PID:7444
- C:\Windows\System\fIdxgMh.exe
  C:\Windows\System\fIdxgMh.exe
  2⤵
  PID:7496
- C:\Windows\System\dGSsDaf.exe
  C:\Windows\System\dGSsDaf.exe
  2⤵
  PID:7540
- C:\Windows\System\BhuvaeZ.exe
  C:\Windows\System\BhuvaeZ.exe
  2⤵
  PID:7480
- C:\Windows\System\eYaFrlU.exe
  C:\Windows\System\eYaFrlU.exe
  2⤵
  PID:7688
- C:\Windows\System\Eusrrld.exe
  C:\Windows\System\Eusrrld.exe
  2⤵
  PID:7560
- C:\Windows\System\VuRCTrN.exe
  C:\Windows\System\VuRCTrN.exe
  2⤵
  PID:7820
- C:\Windows\System\tKnUUvv.exe
  C:\Windows\System\tKnUUvv.exe
  2⤵
  PID:7864
- C:\Windows\System\YOhkOCp.exe
  C:\Windows\System\YOhkOCp.exe
  2⤵
  PID:7880
- C:\Windows\System\LXyiDqX.exe
  C:\Windows\System\LXyiDqX.exe
  2⤵
  PID:7800
- C:\Windows\System\swoGeUh.exe
  C:\Windows\System\swoGeUh.exe
  2⤵
  PID:8120
- C:\Windows\System\gKNOgXT.exe
  C:\Windows\System\gKNOgXT.exe
  2⤵
  PID:7220
- C:\Windows\System\iHRoKTR.exe
  C:\Windows\System\iHRoKTR.exe
  2⤵
  PID:7428
- C:\Windows\System\oGjPcnX.exe
  C:\Windows\System\oGjPcnX.exe
  2⤵
  PID:8108
- C:\Windows\System\SneCavi.exe
  C:\Windows\System\SneCavi.exe
  2⤵
  PID:7380
- C:\Windows\System\bCbGShP.exe
  C:\Windows\System\bCbGShP.exe
  2⤵
  PID:7608
- C:\Windows\System\NOzNjeH.exe
  C:\Windows\System\NOzNjeH.exe
  2⤵
  PID:7300
- C:\Windows\System\oBbeiqC.exe
  C:\Windows\System\oBbeiqC.exe
  2⤵
  PID:7416
- C:\Windows\System\ZOirufb.exe
  C:\Windows\System\ZOirufb.exe
  2⤵
  PID:7836
- C:\Windows\System\ECYCXok.exe
  C:\Windows\System\ECYCXok.exe
  2⤵
  PID:8044
- C:\Windows\System\ZTADTbZ.exe
  C:\Windows\System\ZTADTbZ.exe
  2⤵
  PID:8028
- C:\Windows\System\NkTicBB.exe
  C:\Windows\System\NkTicBB.exe
  2⤵
  PID:7980
- C:\Windows\System\azOGfID.exe
  C:\Windows\System\azOGfID.exe
  2⤵
  PID:7592
- C:\Windows\System\FBnRgbw.exe
  C:\Windows\System\FBnRgbw.exe
  2⤵
  PID:7204
- C:\Windows\System\vIxgeFj.exe
  C:\Windows\System\vIxgeFj.exe
  2⤵
  PID:7768
- C:\Windows\System\nSYhYlz.exe
  C:\Windows\System\nSYhYlz.exe
  2⤵
  PID:8072
- C:\Windows\System\hyPrNaG.exe
  C:\Windows\System\hyPrNaG.exe
  2⤵
  PID:7784
- C:\Windows\System\klvLqvt.exe
  C:\Windows\System\klvLqvt.exe
  2⤵
  PID:8196
- C:\Windows\System\qexSvaS.exe
  C:\Windows\System\qexSvaS.exe
  2⤵
  PID:8212
- C:\Windows\System\WciDvVy.exe
  C:\Windows\System\WciDvVy.exe
  2⤵
  PID:8228
- C:\Windows\System\xJOqUaZ.exe
  C:\Windows\System\xJOqUaZ.exe
  2⤵
  PID:8244
- C:\Windows\System\yFCyAcA.exe
  C:\Windows\System\yFCyAcA.exe
  2⤵
  PID:8260
- C:\Windows\System\eoqpMeI.exe
  C:\Windows\System\eoqpMeI.exe
  2⤵
  PID:8276
- C:\Windows\System\gagjlNN.exe
  C:\Windows\System\gagjlNN.exe
  2⤵
  PID:8292
- C:\Windows\System\AtCIxaj.exe
  C:\Windows\System\AtCIxaj.exe
  2⤵
  PID:8308
- C:\Windows\System\NxfEDaz.exe
  C:\Windows\System\NxfEDaz.exe
  2⤵
  PID:8324
- C:\Windows\System\KrDIAnq.exe
  C:\Windows\System\KrDIAnq.exe
  2⤵
  PID:8340
- C:\Windows\System\aaZASob.exe
  C:\Windows\System\aaZASob.exe
  2⤵
  PID:8356
- C:\Windows\System\ZJTlPVH.exe
  C:\Windows\System\ZJTlPVH.exe
  2⤵
  PID:8372
- C:\Windows\System\nSHKrIR.exe
  C:\Windows\System\nSHKrIR.exe
  2⤵
  PID:8388
- C:\Windows\System\QxwvMyX.exe
  C:\Windows\System\QxwvMyX.exe
  2⤵
  PID:8404
- C:\Windows\System\IRUZaYT.exe
  C:\Windows\System\IRUZaYT.exe
  2⤵
  PID:8420
- C:\Windows\System\CwgTAgA.exe
  C:\Windows\System\CwgTAgA.exe
  2⤵
  PID:8436
- C:\Windows\System\USGoVIe.exe
  C:\Windows\System\USGoVIe.exe
  2⤵
  PID:8452
- C:\Windows\System\AzVyblV.exe
  C:\Windows\System\AzVyblV.exe
  2⤵
  PID:8468
- C:\Windows\System\rYQQOQh.exe
  C:\Windows\System\rYQQOQh.exe
  2⤵
  PID:8484
- C:\Windows\System\DHyBHcG.exe
  C:\Windows\System\DHyBHcG.exe
  2⤵
  PID:8500
- C:\Windows\System\ShmfrMr.exe
  C:\Windows\System\ShmfrMr.exe
  2⤵
  PID:8516
- C:\Windows\System\jHDwnmw.exe
  C:\Windows\System\jHDwnmw.exe
  2⤵
  PID:8532
- C:\Windows\System\KudAbHt.exe
  C:\Windows\System\KudAbHt.exe
  2⤵
  PID:8548
- C:\Windows\System\mfAlyJp.exe
  C:\Windows\System\mfAlyJp.exe
  2⤵
  PID:8564
- C:\Windows\System\TVWHaxY.exe
  C:\Windows\System\TVWHaxY.exe
  2⤵
  PID:8580
- C:\Windows\System\eSQPROr.exe
  C:\Windows\System\eSQPROr.exe
  2⤵
  PID:8596
- C:\Windows\System\agHqPvb.exe
  C:\Windows\System\agHqPvb.exe
  2⤵
  PID:8612
- C:\Windows\System\QylJwNq.exe
  C:\Windows\System\QylJwNq.exe
  2⤵
  PID:8628
- C:\Windows\System\FaPSQbw.exe
  C:\Windows\System\FaPSQbw.exe
  2⤵
  PID:8644
- C:\Windows\System\HKJEPfE.exe
  C:\Windows\System\HKJEPfE.exe
  2⤵
  PID:8660
- C:\Windows\System\synPCfM.exe
  C:\Windows\System\synPCfM.exe
  2⤵
  PID:8676
- C:\Windows\System\mbPLmAZ.exe
  C:\Windows\System\mbPLmAZ.exe
  2⤵
  PID:8692
- C:\Windows\System\fSZHBPV.exe
  C:\Windows\System\fSZHBPV.exe
  2⤵
  PID:8708
- C:\Windows\System\hDZrBrf.exe
  C:\Windows\System\hDZrBrf.exe
  2⤵
  PID:8724
- C:\Windows\System\MMrFEqw.exe
  C:\Windows\System\MMrFEqw.exe
  2⤵
  PID:8740
- C:\Windows\System\obmKyQy.exe
  C:\Windows\System\obmKyQy.exe
  2⤵
  PID:8756
- C:\Windows\System\AyzwIHk.exe
  C:\Windows\System\AyzwIHk.exe
  2⤵
  PID:8772
- C:\Windows\System\KFfRJwm.exe
  C:\Windows\System\KFfRJwm.exe
  2⤵
  PID:8788
- C:\Windows\System\LcsYCPT.exe
  C:\Windows\System\LcsYCPT.exe
  2⤵
  PID:8804
- C:\Windows\System\zdslFGT.exe
  C:\Windows\System\zdslFGT.exe
  2⤵
  PID:8820
- C:\Windows\System\wHugadK.exe
  C:\Windows\System\wHugadK.exe
  2⤵
  PID:8836
- C:\Windows\System\DWjmioe.exe
  C:\Windows\System\DWjmioe.exe
  2⤵
  PID:8852
- C:\Windows\System\HZrePfB.exe
  C:\Windows\System\HZrePfB.exe
  2⤵
  PID:8868
- C:\Windows\System\ZGQcxDS.exe
  C:\Windows\System\ZGQcxDS.exe
  2⤵
  PID:8884
- C:\Windows\System\VlwUQGv.exe
  C:\Windows\System\VlwUQGv.exe
  2⤵
  PID:8900
- C:\Windows\System\VsjZebg.exe
  C:\Windows\System\VsjZebg.exe
  2⤵
  PID:8916
- C:\Windows\System\GbGieSB.exe
  C:\Windows\System\GbGieSB.exe
  2⤵
  PID:8932
- C:\Windows\System\eMegbAf.exe
  C:\Windows\System\eMegbAf.exe
  2⤵
  PID:8948
- C:\Windows\System\nqVfRtB.exe
  C:\Windows\System\nqVfRtB.exe
  2⤵
  PID:8964
- C:\Windows\System\mXeYrmk.exe
  C:\Windows\System\mXeYrmk.exe
  2⤵
  PID:8980
- C:\Windows\System\TxmOHkh.exe
  C:\Windows\System\TxmOHkh.exe
  2⤵
  PID:8996
- C:\Windows\System\QqDqqty.exe
  C:\Windows\System\QqDqqty.exe
  2⤵
  PID:9012
- C:\Windows\System\JUnazxI.exe
  C:\Windows\System\JUnazxI.exe
  2⤵
  PID:9028
- C:\Windows\System\IVAOcrc.exe
  C:\Windows\System\IVAOcrc.exe
  2⤵
  PID:9044
- C:\Windows\System\SOVGjMG.exe
  C:\Windows\System\SOVGjMG.exe
  2⤵
  PID:9060
- C:\Windows\System\SVNMtTq.exe
  C:\Windows\System\SVNMtTq.exe
  2⤵
  PID:9076
- C:\Windows\System\DYrsGCS.exe
  C:\Windows\System\DYrsGCS.exe
  2⤵
  PID:9092
- C:\Windows\System\FRftACG.exe
  C:\Windows\System\FRftACG.exe
  2⤵
  PID:9108
- C:\Windows\System\xGyFEkb.exe
  C:\Windows\System\xGyFEkb.exe
  2⤵
  PID:9124
- C:\Windows\System\cucTmAh.exe
  C:\Windows\System\cucTmAh.exe
  2⤵
  PID:9140
- C:\Windows\System\BoiPnmd.exe
  C:\Windows\System\BoiPnmd.exe
  2⤵
  PID:9156
- C:\Windows\System\eXXYnkV.exe
  C:\Windows\System\eXXYnkV.exe
  2⤵
  PID:9172
- C:\Windows\System\rJrGuAB.exe
  C:\Windows\System\rJrGuAB.exe
  2⤵
  PID:9188
- C:\Windows\System\RlqZWwd.exe
  C:\Windows\System\RlqZWwd.exe
  2⤵
  PID:9204
- C:\Windows\System\ElLRSJR.exe
  C:\Windows\System\ElLRSJR.exe
  2⤵
  PID:8284
- C:\Windows\System\xqwLaaN.exe
  C:\Windows\System\xqwLaaN.exe
  2⤵
  PID:8236
- C:\Windows\System\tsFxiQW.exe
  C:\Windows\System\tsFxiQW.exe
  2⤵
  PID:8272
- C:\Windows\System\RytAQus.exe
  C:\Windows\System\RytAQus.exe
  2⤵
  PID:8092
- C:\Windows\System\oppFgmG.exe
  C:\Windows\System\oppFgmG.exe
  2⤵
  PID:8364
- C:\Windows\System\TuZuOuB.exe
  C:\Windows\System\TuZuOuB.exe
  2⤵
  PID:8348
- C:\Windows\System\JFgHoeR.exe
  C:\Windows\System\JFgHoeR.exe
  2⤵
  PID:8428
- C:\Windows\System\uWUMXAL.exe
  C:\Windows\System\uWUMXAL.exe
  2⤵
  PID:8416
- C:\Windows\System\ecLYrSI.exe
  C:\Windows\System\ecLYrSI.exe
  2⤵
  PID:8384
- C:\Windows\System\qvMFtEp.exe
  C:\Windows\System\qvMFtEp.exe
  2⤵
  PID:8480
- C:\Windows\System\yttpFXS.exe
  C:\Windows\System\yttpFXS.exe
  2⤵
  PID:8496
- C:\Windows\System\hHobiJT.exe
  C:\Windows\System\hHobiJT.exe
  2⤵
  PID:8528
- C:\Windows\System\lDqAWPt.exe
  C:\Windows\System\lDqAWPt.exe
  2⤵
  PID:8588
- C:\Windows\System\gvxvsoT.exe
  C:\Windows\System\gvxvsoT.exe
  2⤵
  PID:8636
- C:\Windows\System\iNIciNE.exe
  C:\Windows\System\iNIciNE.exe
  2⤵
  PID:8672
- C:\Windows\System\RYpfzMF.exe
  C:\Windows\System\RYpfzMF.exe
  2⤵
  PID:8652
- C:\Windows\System\IhLGLlK.exe
  C:\Windows\System\IhLGLlK.exe
  2⤵
  PID:8764
- C:\Windows\System\BucrbYy.exe
  C:\Windows\System\BucrbYy.exe
  2⤵
  PID:8716
- C:\Windows\System\tpMvxrk.exe
  C:\Windows\System\tpMvxrk.exe
  2⤵
  PID:8796
- C:\Windows\System\IDfHrMa.exe
  C:\Windows\System\IDfHrMa.exe
  2⤵
  PID:8828
- C:\Windows\System\nHufdCR.exe
  C:\Windows\System\nHufdCR.exe
  2⤵
  PID:8892
- C:\Windows\System\OxeyNqv.exe
  C:\Windows\System\OxeyNqv.exe
  2⤵
  PID:8924
- C:\Windows\System\FtAcyFM.exe
  C:\Windows\System\FtAcyFM.exe
  2⤵
  PID:8876
- C:\Windows\System\DDCnBcF.exe
  C:\Windows\System\DDCnBcF.exe
  2⤵
  PID:8956
- C:\Windows\System\gvIHFpG.exe
  C:\Windows\System\gvIHFpG.exe
  2⤵
  PID:8944
- C:\Windows\System\RxvxqnO.exe
  C:\Windows\System\RxvxqnO.exe
  2⤵
  PID:9004
- C:\Windows\System\ktcGRqw.exe
  C:\Windows\System\ktcGRqw.exe
  2⤵
  PID:9052
- C:\Windows\System\XSXAVIG.exe
  C:\Windows\System\XSXAVIG.exe
  2⤵
  PID:9104
- C:\Windows\System\CMMmhLI.exe
  C:\Windows\System\CMMmhLI.exe
  2⤵
  PID:9196
- C:\Windows\System\hOSSQrH.exe
  C:\Windows\System\hOSSQrH.exe
  2⤵
  PID:9116
- C:\Windows\System\yuJjssG.exe
  C:\Windows\System\yuJjssG.exe
  2⤵
  PID:9180
- C:\Windows\System\IFnTSbk.exe
  C:\Windows\System\IFnTSbk.exe
  2⤵
  PID:9008
- C:\Windows\System\sJmGvRb.exe
  C:\Windows\System\sJmGvRb.exe
  2⤵
  PID:7320
- C:\Windows\System\yndvPct.exe
  C:\Windows\System\yndvPct.exe
  2⤵
  PID:8252
- C:\Windows\System\fyezjrk.exe
  C:\Windows\System\fyezjrk.exe
  2⤵
  PID:6672
- C:\Windows\System\bYTkedB.exe
  C:\Windows\System\bYTkedB.exe
  2⤵
  PID:8464
- C:\Windows\System\OqSStsP.exe
  C:\Windows\System\OqSStsP.exe
  2⤵
  PID:8288
- C:\Windows\System\IhPmNfJ.exe
  C:\Windows\System\IhPmNfJ.exe
  2⤵
  PID:8460
- C:\Windows\System\dudIqfq.exe
  C:\Windows\System\dudIqfq.exe
  2⤵
  PID:8444
- C:\Windows\System\kbtdMjc.exe
  C:\Windows\System\kbtdMjc.exe
  2⤵
  PID:8556
- C:\Windows\System\bbVPVim.exe
  C:\Windows\System\bbVPVim.exe
  2⤵
  PID:8688
- C:\Windows\System\nqlrvIT.exe
  C:\Windows\System\nqlrvIT.exe
  2⤵
  PID:8860
- C:\Windows\System\kzhVITD.exe
  C:\Windows\System\kzhVITD.exe
  2⤵
  PID:8988
- C:\Windows\System\tjCjqPc.exe
  C:\Windows\System\tjCjqPc.exe
  2⤵
  PID:8604
- C:\Windows\System\ISNUdVq.exe
  C:\Windows\System\ISNUdVq.exe
  2⤵
  PID:9072
- C:\Windows\System\DmWXKvE.exe
  C:\Windows\System\DmWXKvE.exe
  2⤵
  PID:8992
- C:\Windows\System\bQhMlsW.exe
  C:\Windows\System\bQhMlsW.exe
  2⤵
  PID:9100
- C:\Windows\System\DPJaNYu.exe
  C:\Windows\System\DPJaNYu.exe
  2⤵
  PID:9136
- C:\Windows\System\EWwOAOz.exe
  C:\Windows\System\EWwOAOz.exe
  2⤵
  PID:9164
- C:\Windows\System\IZfvwik.exe
  C:\Windows\System\IZfvwik.exe
  2⤵
  PID:8512
- C:\Windows\System\EbixsJR.exe
  C:\Windows\System\EbixsJR.exe
  2⤵
  PID:8624
- C:\Windows\System\fiDUlGv.exe
  C:\Windows\System\fiDUlGv.exe
  2⤵
  PID:9068
- C:\Windows\System\hsCaBxD.exe
  C:\Windows\System\hsCaBxD.exe
  2⤵
  PID:8316
- C:\Windows\System\vVMJzHN.exe
  C:\Windows\System\vVMJzHN.exe
  2⤵
  PID:8844
- C:\Windows\System\xfuLwuu.exe
  C:\Windows\System\xfuLwuu.exe
  2⤵
  PID:8620
- C:\Windows\System\xPANmMr.exe
  C:\Windows\System\xPANmMr.exe
  2⤵
  PID:9220
- C:\Windows\System\DLIooLU.exe
  C:\Windows\System\DLIooLU.exe
  2⤵
  PID:9236
- C:\Windows\System\wNNHmeu.exe
  C:\Windows\System\wNNHmeu.exe
  2⤵
  PID:9264
- C:\Windows\System\EeEbOGb.exe
  C:\Windows\System\EeEbOGb.exe
  2⤵
  PID:9280
- C:\Windows\System\UojWZiC.exe
  C:\Windows\System\UojWZiC.exe
  2⤵
  PID:9296
- C:\Windows\System\cehsGLt.exe
  C:\Windows\System\cehsGLt.exe
  2⤵
  PID:9312
- C:\Windows\System\jbjljtM.exe
  C:\Windows\System\jbjljtM.exe
  2⤵
  PID:9328
- C:\Windows\System\MUosIyo.exe
  C:\Windows\System\MUosIyo.exe
  2⤵
  PID:9344
- C:\Windows\System\LXQTcTv.exe
  C:\Windows\System\LXQTcTv.exe
  2⤵
  PID:9360
- C:\Windows\System\mOReVTB.exe
  C:\Windows\System\mOReVTB.exe
  2⤵
  PID:9376
- C:\Windows\System\jFuBjPb.exe
  C:\Windows\System\jFuBjPb.exe
  2⤵
  PID:9392
- C:\Windows\System\cgUPSsY.exe
  C:\Windows\System\cgUPSsY.exe
  2⤵
  PID:9416
- C:\Windows\System\GDlcgBo.exe
  C:\Windows\System\GDlcgBo.exe
  2⤵
  PID:9432
- C:\Windows\System\OnbfxhH.exe
  C:\Windows\System\OnbfxhH.exe
  2⤵
  PID:9448
- C:\Windows\System\iMWQjMC.exe
  C:\Windows\System\iMWQjMC.exe
  2⤵
  PID:9464
- C:\Windows\System\zIyruat.exe
  C:\Windows\System\zIyruat.exe
  2⤵
  PID:9480
- C:\Windows\System\yFhsGfq.exe
  C:\Windows\System\yFhsGfq.exe
  2⤵
  PID:9496
- C:\Windows\System\QAcuudV.exe
  C:\Windows\System\QAcuudV.exe
  2⤵
  PID:9512
- C:\Windows\System\OpaKySO.exe
  C:\Windows\System\OpaKySO.exe
  2⤵
  PID:9528
- C:\Windows\System\pyuZMHf.exe
  C:\Windows\System\pyuZMHf.exe
  2⤵
  PID:9544
- C:\Windows\System\BWPAMoa.exe
  C:\Windows\System\BWPAMoa.exe
  2⤵
  PID:9560
- C:\Windows\System\mgtlRrz.exe
  C:\Windows\System\mgtlRrz.exe
  2⤵
  PID:9576
- C:\Windows\System\UGbJPWT.exe
  C:\Windows\System\UGbJPWT.exe
  2⤵
  PID:9596
- C:\Windows\System\dKWpokO.exe
  C:\Windows\System\dKWpokO.exe
  2⤵
  PID:9612
- C:\Windows\System\syxaIUb.exe
  C:\Windows\System\syxaIUb.exe
  2⤵
  PID:9628
- C:\Windows\System\xQzyoJm.exe
  C:\Windows\System\xQzyoJm.exe
  2⤵
  PID:9656
- C:\Windows\System\pPDcjQq.exe
  C:\Windows\System\pPDcjQq.exe
  2⤵
  PID:9672
- C:\Windows\System\WgcqqCt.exe
  C:\Windows\System\WgcqqCt.exe
  2⤵
  PID:9688
- C:\Windows\System\mjioxSr.exe
  C:\Windows\System\mjioxSr.exe
  2⤵
  PID:9704
- C:\Windows\System\gJlOvZJ.exe
  C:\Windows\System\gJlOvZJ.exe
  2⤵
  PID:9728
- C:\Windows\System\yjzmiZX.exe
  C:\Windows\System\yjzmiZX.exe
  2⤵
  PID:9744
- C:\Windows\System\AJWmoCC.exe
  C:\Windows\System\AJWmoCC.exe
  2⤵
  PID:9760
- C:\Windows\System\OKtUuPf.exe
  C:\Windows\System\OKtUuPf.exe
  2⤵
  PID:9776
- C:\Windows\System\TuYuGfs.exe
  C:\Windows\System\TuYuGfs.exe
  2⤵
  PID:9792
- C:\Windows\System\UyVncuL.exe
  C:\Windows\System\UyVncuL.exe
  2⤵
  PID:9808
- C:\Windows\System\xNoXpZD.exe
  C:\Windows\System\xNoXpZD.exe
  2⤵
  PID:9824
- C:\Windows\System\rDwPBtZ.exe
  C:\Windows\System\rDwPBtZ.exe
  2⤵
  PID:9840
- C:\Windows\System\euJOPQT.exe
  C:\Windows\System\euJOPQT.exe
  2⤵
  PID:9856
- C:\Windows\System\QSRePaa.exe
  C:\Windows\System\QSRePaa.exe
  2⤵
  PID:9872
- C:\Windows\System\JSFgpnp.exe
  C:\Windows\System\JSFgpnp.exe
  2⤵
  PID:9888
- C:\Windows\System\sKMWSKt.exe
  C:\Windows\System\sKMWSKt.exe
  2⤵
  PID:9904
- C:\Windows\System\fENovmN.exe
  C:\Windows\System\fENovmN.exe
  2⤵
  PID:9920
- C:\Windows\System\pRGNali.exe
  C:\Windows\System\pRGNali.exe
  2⤵
  PID:9940
- C:\Windows\System\VSdhrJb.exe
  C:\Windows\System\VSdhrJb.exe
  2⤵
  PID:9956
- C:\Windows\System\LpLiqRF.exe
  C:\Windows\System\LpLiqRF.exe
  2⤵
  PID:9972
- C:\Windows\System\PCxcStR.exe
  C:\Windows\System\PCxcStR.exe
  2⤵
  PID:9988
- C:\Windows\System\TxdZYoY.exe
  C:\Windows\System\TxdZYoY.exe
  2⤵
  PID:10004
- C:\Windows\System\IQUdaXc.exe
  C:\Windows\System\IQUdaXc.exe
  2⤵
  PID:10020
- C:\Windows\System\YPjJwMk.exe
  C:\Windows\System\YPjJwMk.exe
  2⤵
  PID:10044
- C:\Windows\System\AfRsACY.exe
  C:\Windows\System\AfRsACY.exe
  2⤵
  PID:10072
- C:\Windows\System\rCvUJEp.exe
  C:\Windows\System\rCvUJEp.exe
  2⤵
  PID:10092
- C:\Windows\System\tgQTyDS.exe
  C:\Windows\System\tgQTyDS.exe
  2⤵
  PID:10112
- C:\Windows\System\ewqhxxl.exe
  C:\Windows\System\ewqhxxl.exe
  2⤵
  PID:10128
- C:\Windows\System\CaWUTZn.exe
  C:\Windows\System\CaWUTZn.exe
  2⤵
  PID:10144
- C:\Windows\System\PusMkJk.exe
  C:\Windows\System\PusMkJk.exe
  2⤵
  PID:10160
- C:\Windows\System\VZeDDBM.exe
  C:\Windows\System\VZeDDBM.exe
  2⤵
  PID:10176
- C:\Windows\System\nNbAQEQ.exe
  C:\Windows\System\nNbAQEQ.exe
  2⤵
  PID:10192
- C:\Windows\System\GUMfmFm.exe
  C:\Windows\System\GUMfmFm.exe
  2⤵
  PID:10212
- C:\Windows\System\NSwSIyP.exe
  C:\Windows\System\NSwSIyP.exe
  2⤵
  PID:10232
- C:\Windows\System\xzKzVjz.exe
  C:\Windows\System\xzKzVjz.exe
  2⤵
  PID:9040
- C:\Windows\System\QqmnXan.exe
  C:\Windows\System\QqmnXan.exe
  2⤵
  PID:8352
- C:\Windows\System\FPWFUGw.exe
  C:\Windows\System\FPWFUGw.exe
  2⤵
  PID:8700
- C:\Windows\System\DqutZJr.exe
  C:\Windows\System\DqutZJr.exe
  2⤵
  PID:8928
- C:\Windows\System\FxASDOn.exe
  C:\Windows\System\FxASDOn.exe
  2⤵
  PID:9336
- C:\Windows\System\ZvTyzJW.exe
  C:\Windows\System\ZvTyzJW.exe
  2⤵
  PID:9400
- C:\Windows\System\kKTBtvq.exe
  C:\Windows\System\kKTBtvq.exe
  2⤵
  PID:8396
- C:\Windows\System\rgYZVeI.exe
  C:\Windows\System\rgYZVeI.exe
  2⤵
  PID:7816
- C:\Windows\System\iGnxwKN.exe
  C:\Windows\System\iGnxwKN.exe
  2⤵
  PID:9472
- C:\Windows\System\ZfRDqGL.exe
  C:\Windows\System\ZfRDqGL.exe
  2⤵
  PID:8800
- C:\Windows\System\qfQCfUW.exe
  C:\Windows\System\qfQCfUW.exe
  2⤵
  PID:9508
- C:\Windows\System\pzxAelf.exe
  C:\Windows\System\pzxAelf.exe
  2⤵
  PID:9248
- C:\Windows\System\WJgIoHu.exe
  C:\Windows\System\WJgIoHu.exe
  2⤵
  PID:9292
- C:\Windows\System\xHrMUrI.exe
  C:\Windows\System\xHrMUrI.exe
  2⤵
  PID:9356
- C:\Windows\System\JvpoPTJ.exe
  C:\Windows\System\JvpoPTJ.exe
  2⤵
  PID:9428
- C:\Windows\System\QeJJIMC.exe
  C:\Windows\System\QeJJIMC.exe
  2⤵
  PID:9520
- C:\Windows\System\thbweQP.exe
  C:\Windows\System\thbweQP.exe
  2⤵
  PID:9572
- C:\Windows\System\hsEOHuk.exe
  C:\Windows\System\hsEOHuk.exe
  2⤵
  PID:9604
- C:\Windows\System\mXWJMsK.exe
  C:\Windows\System\mXWJMsK.exe
  2⤵
  PID:9644
- C:\Windows\System\ZSuTTcX.exe
  C:\Windows\System\ZSuTTcX.exe
  2⤵
  PID:9624
- C:\Windows\System\rISqLpq.exe
  C:\Windows\System\rISqLpq.exe
  2⤵
  PID:9664
- C:\Windows\System\mTPILXG.exe
  C:\Windows\System\mTPILXG.exe
  2⤵
  PID:9712
- C:\Windows\System\AcgpHCu.exe
  C:\Windows\System\AcgpHCu.exe
  2⤵
  PID:9756
- C:\Windows\System\BNjKYVO.exe
  C:\Windows\System\BNjKYVO.exe
  2⤵
  PID:9820
- C:\Windows\System\zqXppoO.exe
  C:\Windows\System\zqXppoO.exe
  2⤵
  PID:9404
- C:\Windows\System\PBYOmRF.exe
  C:\Windows\System\PBYOmRF.exe
  2⤵
  PID:9800
- C:\Windows\System\ZvoHGvL.exe
  C:\Windows\System\ZvoHGvL.exe
  2⤵
  PID:9864
- C:\Windows\System\yqoAdhU.exe
  C:\Windows\System\yqoAdhU.exe
  2⤵
  PID:9740
- C:\Windows\System\ZkWPtHc.exe
  C:\Windows\System\ZkWPtHc.exe
  2⤵
  PID:9936
- C:\Windows\System\NjumdVo.exe
  C:\Windows\System\NjumdVo.exe
  2⤵
  PID:9952
- C:\Windows\System\nflwckm.exe
  C:\Windows\System\nflwckm.exe
  2⤵
  PID:9968
- C:\Windows\System\sgOBxYM.exe
  C:\Windows\System\sgOBxYM.exe
  2⤵
  PID:9996
- C:\Windows\System\qtkoUvM.exe
  C:\Windows\System\qtkoUvM.exe
  2⤵
  PID:10060
- C:\Windows\System\NgbOvjM.exe
  C:\Windows\System\NgbOvjM.exe
  2⤵
  PID:10032
- C:\Windows\System\vthZvMn.exe
  C:\Windows\System\vthZvMn.exe
  2⤵
  PID:10108
- C:\Windows\System\HqtPWya.exe
  C:\Windows\System\HqtPWya.exe
  2⤵
  PID:10140
- C:\Windows\System\JhFSxZk.exe
  C:\Windows\System\JhFSxZk.exe
  2⤵
  PID:10204
- C:\Windows\System\NHsUATY.exe
  C:\Windows\System\NHsUATY.exe
  2⤵
  PID:10156
- C:\Windows\System\WpaGjvC.exe
  C:\Windows\System\WpaGjvC.exe
  2⤵
  PID:9024
- C:\Windows\System\VWAEgMi.exe
  C:\Windows\System\VWAEgMi.exe
  2⤵
  PID:8412

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\CNufDxO.exe

Filesize
1.8MB

MD5
a75ed533dd06dff9322bc61197db6eaf

SHA1
a3959079caece8387daa2fd8676d36244905710d

SHA256
7394bd69e655db4d5c25b80c494a18c790a92e4f5958a6e7c9b7a7fee7065177

SHA512
455e868667384f6c67a751f07259d7dc1e8cba2b264e0f3a6e97ab17bf4c3232bb3a33d9d777747409ee09692b3cdd145d72f2d1e507ba5f0f706705088a754e

Download Submit
C:\Windows\system\FTfbYKo.exe

Filesize
1.8MB

MD5
2b0d39564a95ee16c7296dd23b797de3

SHA1
670312acbdff8404e924e21e75c17a358970de64

SHA256
3978cd56ac6b77bade8ecd1f340eba0961c756917b8084a024bdc1f97b62bdb6

SHA512
202adf10799d8cdff73bc22d0ff07d9a982a886fbe580a4498577d465d8485d77d6fc199f33fbfe0a3d63c4c36e6e0b9cde6ac74a808dd2078194d7abbf17ac8

Download Submit
C:\Windows\system\HPyWnba.exe

Filesize
1.8MB

MD5
600f4faca2d29a0447a4bf96970b515f

SHA1
8e3a6969dfc729ac6f944ee41aa8ba217d5b8b13

SHA256
f21967b97c8cccd8df93b654cf5d3e035593d73688a9d4e391d21d2cfec11825

SHA512
fbe3374e7c0f33bd140c6cbf3baff99b1bae0dc75073e640e74b963ddff3bd10b0000cb19fbcc12a68ea7acce6a5761e8a453ebf98c12f3929cec1fd502aa16b

Download Submit
C:\Windows\system\HqZVabd.exe

Filesize
1.8MB

MD5
059e337c82016ab39c2d46338abcd0f4

SHA1
b4881c6bc3db8128b770450e075ce842fc7b2322

SHA256
e8f6bd1fda5300ba96e945c60c2cb63cf91b90f55f77728743abeb8816a1ad0d

SHA512
8e09d2cb75bcff85b25e087cdb3c5b35245de5c0260271f8d5d0d31ef75b131e5bcc027c6c30a5a6cfbd1c80b85ebd5c43d50b3fa9373c0416eb9f3cb8ebd400

Download Submit
C:\Windows\system\IxfBbeF.exe

Filesize
1.8MB

MD5
b34fae0edb745062c791d594f4e9a72e

SHA1
6235ca691498e6d77b6f2ac87409265be5c9e8a1

SHA256
68b22620f4cc624d458af86f7762258a9a55050768d723166a01c8e22ad2bc70

SHA512
54ed1e87b4672dd9929490746cd6bd70a2a118d2086cc0fdecb36a6e98bd21322359334db9ee4bcaf4e188ccb9bf087537c21992049e8353a5dc45e55157596c

Download Submit
C:\Windows\system\MdOgLxu.exe

Filesize
1.8MB

MD5
b962ae7962179b4364b59922223b49cc

SHA1
712b0c9e3f83888279e1a16acf9b1a0795040d69

SHA256
76bbf9b63bb6862e0caa5c89e6eadc616d784bab4ae1739edce03dc0e0b887b8

SHA512
52a38e2675b1e08ae4acfa572a04a0e29e2318ebdd48d32961c96e106caaa5e448be4910a592db1ccbd5f62b5e50ed55277d424a718564ee324ec6f91d18c846

Download Submit
C:\Windows\system\MwvmAML.exe

Filesize
1.8MB

MD5
63c56a06794999658cb0be64abd5b1e7

SHA1
a2822c171dc6e5ef2b28f3a88b5e06452e6f6347

SHA256
6fda00f510ca3d0f68a04e6526ac39ca02478234b8f47ded25d6a5f634d4a243

SHA512
73147d9c75b826016ae5a9345cb46273092bf5765160b34433511a4a1c9878680c2a184964ec79daf918c93120fdc61aed125d3d90a3d82a05d3bd676f3258e6

Download Submit
C:\Windows\system\NgoRcZm.exe

Filesize
1.8MB

MD5
212bb2092086168657236b5438192735

SHA1
bcb6661b0eaffdf14f6ca3c6a0ab45d896bc752f

SHA256
c560f0be771a763a25d9a0b1692b2ad19c2ba74093624af6b33305d7bcaa5c44

SHA512
bf741d70b952476b123659ab945fb633d0e32f11d89fa2064e1b32ec52ce5408ffb54de9346b11fea64430e4e3c673a0a9d693164acb75904c6b9413f403ce40

Download Submit
C:\Windows\system\OKHXLqc.exe

Filesize
1.8MB

MD5
f99bd83aa6de5d9c8fffe5a897fec87d

SHA1
35f5d64d34cc2aad7d3c7d6ff89b93406eb14e0f

SHA256
0735f6d50f818dd56e909402da252a3bbd3d0fc541265a660a5fdc0685a5e887

SHA512
67c0796ff3087bf05db1b1b1d1db1eefc0193ea0b4f5c6108fef31605c9dbaa8d2269f59214f1773d7ce5c7fbd8172458dd0927a6cec24a26b5cb44edb72da20

Download Submit
C:\Windows\system\PDrfhhZ.exe

Filesize
1.8MB

MD5
87d930ac08a8ba77991ec143a6810c7d

SHA1
1a9f8d0582b21bd31a1bee6241443b3ec5cb493d

SHA256
36c20f8111269283de93b6bfd10b9f2a9e0d04ab77d7c4ef5846abea4c0949be

SHA512
01abe9a3c96b71a017e804039ac530982b6d74a4adc6e77b0b00e5492e16290c9ababb63a50da01b565b4341cdcddb331189a476c9b3b00f19c6c839e59c501e

Download Submit
C:\Windows\system\QpDIfvc.exe

Filesize
1.8MB

MD5
0e7e6b98505aa6a25e9a89680dfab767

SHA1
c0f5c7a61ca5a05e32250e1dd1e02fdeb7192fa4

SHA256
529b687681b590a83aa6c3c3e7ed079e0e0dfae2517d1d844bd11e4b7b242b33

SHA512
ae71dcd4d60a44d566c27434fafe7fd77f8ab02f0d9eef732dee978109ed33304fa76984f7d94b00fb31638beda616cf4b255fecc691599851776a85f7f5eb47

Download Submit
C:\Windows\system\SsgwhNn.exe

Filesize
1.8MB

MD5
4f8eda3f444df435df273feb8f0b35aa

SHA1
83f4d9607fb94ba233dda82709c6b936c954a66c

SHA256
0b8e27407c25476e0b13befc25ea71dbf452b0ec291c7a89137449a2b5bd9825

SHA512
5d284b68690e8e743a6290aa4642a8eb6e111185ffdcef07d2853e0610e149f89dc909eed577b8862633c97af6ddfe4286ecf4c2e9caa74b1289c8a3c6499fa7

Download Submit
C:\Windows\system\XRsQxgo.exe

Filesize
1.8MB

MD5
d06b0b8895f51396734e401466effe77

SHA1
735929ff3085dd016adbdd99abd860ad02a25fb1

SHA256
01a56cdf91c44bd8ddc9a8f6eae2622bce3c3a6b6d630036d287c3292f511736

SHA512
0e351cac40cf02d3891d5dbd6dc05f299c573e3e11a46a72f9a0c6e51bcc28eee9b2d1e3a7f5d42214e000852ae076600aade0b6a191b9932104f2831d5b2d05

Download Submit
C:\Windows\system\XzaGZFz.exe

Filesize
1.8MB

MD5
bcb3b2c8353797a5e8917668bfa29347

SHA1
211438722070135281f428aaa5d716a2b143fe80

SHA256
a3972f6c196328067e812e181e9428daa7363f1e99556011f25c5fb45baebb9b

SHA512
55203fa95e0a1c20ccc1ba6598707dd83568847aee1b41dec3f52011f6eda7839b5807e58b23c94e5e9160a4adf6baeb86eb24640d689497280a6fa3df50d70d

Download Submit
C:\Windows\system\gfccxmZ.exe

Filesize
1.8MB

MD5
5a1209147bebab4e552ac7ae6f3472ef

SHA1
31143ff2bf33c2522cff39ca7a8cdc4c0d91d02a

SHA256
348f2d1a8abeed2a95b1e7f7a99e5e9049365d4b5a32f588775808766a851a35

SHA512
4216e17892abd2f7f9d6ceea0bc3c2078ff28e7b4094a15a68884117b0bf1f3d6c0fd4c69bf09e4c69040e57a98d14f474837166cd666635272224d07aa2e7b4

Download Submit
C:\Windows\system\oUnENgU.exe

Filesize
1.8MB

MD5
a41a7b9173e300ef7b75219135f24d5a

SHA1
f873daecf27382a8207e56b77eab355815274cc3

SHA256
968984e2e38826850d8934d535c52483613c56b81b45bb6e0e9201225dd06764

SHA512
ed594dbf3cbc9f4237e70052e6af58a5bf78c3334fe6b5af1be735d69822dfceb8faafed866b8f4fa19e893ac68b74794b3a61254b757d335977241e35b25b9b

Download Submit
C:\Windows\system\rhsFYqF.exe

Filesize
1.8MB

MD5
54fa0ae4b1dd490ad57661f64a992c43

SHA1
de6e9d1787168f0de3ebf6452a93830cd500fe78

SHA256
98f57a249d032eac514d676df0c64d2b5f868bd36f86b60ee0394e46e91e432b

SHA512
ed1637a5ac3e1d4673d1c9fa18a7dc10d6274f20eb55fa4eca6dd89a76d7a3a3942f2a53c69be512e95aaf5273daa31a2e05b168d80867e0d86001cb5ad3e811

Download Submit
C:\Windows\system\uFkTqkt.exe

Filesize
1.8MB

MD5
f2283c13a14107d2f7acc8a09bcba8bb

SHA1
905ea4121804c45215d6d8b8616acf6860b3d126

SHA256
338c835171d9f0dfe762438d4de27df182bef596a99c23db3c0cd3b7ddedc35c

SHA512
e3c84fd3ae7511db271b4057477f2b5662e54d18f8657fa0955aefb1427032c4e1ce30e2468577d91c33c92e03ab6d611fa5509dccd6606ac33230e9a74e1105

Download Submit
C:\Windows\system\xgECKKk.exe

Filesize
1.8MB

MD5
0eac9ebbd152dd6fce03373efe4eed4d

SHA1
aa1ccfac2e7dbdc753b7757f7330277efa9a5b24

SHA256
02d6b5f28f81427f27bf4dfacec0d8410c1ca19ac37680ce6dc9b55c946adfc7

SHA512
31c2317eed0818229d331b9548937f92fac92e6f410457e8566e91ef32f1bc8890f6e6903d83cc27e1dbe3b01935d22928d76408c20e8435a82e062ed19a1aa5

Download Submit
C:\Windows\system\ymeZFgM.exe

Filesize
1.8MB

MD5
1177c07f2e1197363b4cf554b19a021e

SHA1
e599b545707336bc8fb5f352e339892374bcf584

SHA256
0a462152dabccfbdf9220d552a01e699c8e91be84231cba2ab8d6b6be7d4b31e

SHA512
a2953f1df5dda121b06608238e3aaa987033e690dd2990e75096cc0bb2ec25a9fcb5d169a7580e2262b23349a37c7da2fe3cb36fb19b506eb069c84c21e9d86c

Download Submit
\Windows\system\DROkXoi.exe

Filesize
1.8MB

MD5
30512b3d2eb3e462b581b7df80ac0d62

SHA1
bcf7bbbee4df756dcc23455a85a98885bccc677e

SHA256
1b3cd187905f925c6f5f8f1e7128bdfb88b9f639f7173b4a75fbd989ef0e82b8

SHA512
8fc497ffe0aa6b6e01520fe0c755ab5626ec939ba05252eba33f9257f64a7754b3fa6f96e2a8c811e26673b66728a5d8d8cd4dc35518df80732b7fa6bec09ca5

Download Submit
\Windows\system\QoQgrgD.exe

Filesize
1.8MB

MD5
6bfdfb92361c74afdca854d465b77792

SHA1
093b4fdfd094d7a92efd2c7c09dbc6242a180eb4

SHA256
e2901c02b620fb6f7a46ef68f41151f6880f4775c542b21d064ee27351d6fdc7

SHA512
0c2ae7c0ee1172dc84d5f386525d038e12c748beb14ffd167e5a3f042e122c43e0885fcdf6ce493ce79f695df5b34de63480a59d0ac7dd9532c4812a7f3bde11

Download Submit
\Windows\system\RIANuoM.exe

Filesize
1.8MB

MD5
96b31aef89e12ff176d3e615c5a0fdb1

SHA1
ef1faff1ae0a8361ecb074b9c1bb80f9dbf16f9e

SHA256
58ff857f0704a1be91a8c9f5477e1c74d52130863bfa7423341a012095260d0a

SHA512
dcc2f66681a537ca93f48c2e6502dc1ff28f3cbe4922c559a639630aa1cebc2d9f6b81228cea92d4fcb683db7a51a76ec930437f645406e1b177e39b7bd9f874

Download Submit
\Windows\system\RhNaOvy.exe

Filesize
1.8MB

MD5
1e6e03d2d9297de454029bc7cc691d3b

SHA1
b144c27bd4185c2407a0adde48f639c931b7d133

SHA256
3967a1378832d4bce3dcf89205821782c9e5a4238a4e0d0a87d26e70fffc1eac

SHA512
1394a19ae3bb2e4aa5fec4b77add5f1009f32366e54357d8534caab72be675d7ac016ab3d8db91ea07ef6ae4ca64d8aeba0f2a3cc46e42cb8975993aa3b31eef

Download Submit
\Windows\system\SwHslig.exe

Filesize
1.8MB

MD5
8354401de09dd7693740ee35fffb5d4c

SHA1
128ff6a75277f09fcd67ed081ab9319ee86a775d

SHA256
570932ec8415fbbe9462061c8f45eadb35d45c89ed0f2a32b083f2e479dc90d0

SHA512
4b6bc85dd3812cf9395195b4ee4d4168d259416554265cc20aab77df94302d15533837a9be412ebb5e28cdf61bf71ba116cc84dc6eb1027b467462742d87d7d3

Download Submit
\Windows\system\aYnozhX.exe

Filesize
1.8MB

MD5
c475109faf45f8699b62c2e6752ac590

SHA1
47632d1f73f0a57aceec01232191a25d29bad194

SHA256
8386b7618563592bfd07c2843ae5398531dcbd144b3eb9a4f4266e2855d7c962

SHA512
625357ec6236fbe5bc9a70409893d8e0cf517f68b4e8de3623b0e8d48aa1e885a370afedc3f43a8697f76135108c89ae2115777f94a5bb9477b3c0a5e35b83c8

Download Submit
\Windows\system\cOmzrmZ.exe

Filesize
1.8MB

MD5
8341017b204adad239728bc60f2db8e4

SHA1
6c82047060e73dccb837df900cb02069e1cd056b

SHA256
81f0abce56f5b8306d37ef4371d09572e98f19a0687a01a895566374a80b06bb

SHA512
dc9821705564cb98334a4dd46be53dcfeced2040cea1c9fa60d60532f2d2d2cfb1bbb57f3c3842a3f3435bb068c801248c2dd4daa414f6eb8ab091e2b381016f

Download Submit
\Windows\system\cTnSZbB.exe

Filesize
1.8MB

MD5
503058a7ef22064fca495b23645d3729

SHA1
0e7787abfeccc55958d11208897f7a431a3fb1fe

SHA256
479dfc4e1b410690faf78d719a14eb0d68f3d9c8c2c6c0809ebc20ca96ec360f

SHA512
656d27c60b31779b1aae930b4a46624059f95a2c912929a56fcb2ba1160c08db5f8c698043fe97896c80b2b26fc96dd04051f8545b2a2635cde346f49f7741b8

Download Submit
\Windows\system\dfWPhnv.exe

Filesize
1.8MB

MD5
e263fd87f5468988533d7bcbf1cfade2

SHA1
e55e557fda7c108b6c12ebdd65ec60e7ffbc6516

SHA256
c9fa0c6a6b73e0ce925f834e4eda8e6d1c63dedbf0fd0de4bce6960c653b6557

SHA512
b30fcc9f3d6c4eae6dd9646e9be5a718867984d982017f2b12e2c2ae6cd39d72c107cb6e5ca6b2f90556c9a460eb090aac568f3cc17f5fab3dd08dde2e7cbaf7

Download Submit
\Windows\system\gbMDeKH.exe

Filesize
1.8MB

MD5
a8a1ae4058e7a7add59db80cc8e5b85b

SHA1
f80763820c9fa1e89083da33b394e2a42172687b

SHA256
95afe624e638b2be30fe572757249b599efbfa203fb3c92c10c3a5c93cabd795

SHA512
fcf23911297926e99a1ee86191ca5c4d33392455acb5d72af6cd69e4b64ad913f23f51ee8c19e3f13d0433432c979523c0ea6d2c251d70c600dc9cb4399670d7

Download Submit
\Windows\system\nOgYqax.exe

Filesize
1.8MB

MD5
c9f5aa5f9d711db5fb747184d08f07d4

SHA1
04ae22b6b3b1adf5975d609f54c326a4a7f93853

SHA256
8d5a8c69df1631c60553c6f2f23560f99b1f691df787e8e61b35cb697ede858e

SHA512
7c23cbf20c41893f4190c3990b23e24382993c3fee51dc2d398bdd82ffcb03e4993bf00946721b1bc8b0ccdfe9c83b14228eebd1672a48f4b921e03f8709383a

Download Submit
\Windows\system\qXpHWwu.exe

Filesize
1.8MB

MD5
01d242a7a3cd900d5783406ebed8ba04

SHA1
a4b3ee60a005aebd6c2629dbd85143db66d68693

SHA256
9e42a74016233c35d175233fc6d1feda7f09906abcfade3b6106fa3c77bc9b68

SHA512
6130b30d761398d683c7963a1635700bf2e1c8a83d607700a15eab29644eac95152df042b6d08b0ca5aae6641b3a6e0a526f73e767e2d50528336dbfb509d045

Download Submit
\Windows\system\sodZWQX.exe

Filesize
1.8MB

MD5
1503b2dd7e394e78914055a0adac6268

SHA1
ba2569f22c11add8d58bd4c0bcef34099d0e3c74

SHA256
ddfa8c665cacc9e944e94283c0478024ceadf79c8af5e8427bb165c26ab9edef

SHA512
51acd3134721701011d4846b6e73921fa52d1492d12e229762237ed9dd21c9d06d4bbb3483f493a86a9f117d409cf7c1dfda285f64e04a02e7875917f4eb01e6

Download Submit
memory/300-13-0x000000013F0F0000-0x000000013F4E2000-memory.dmp

Filesize
3.9MB

Download
memory/300-6564-0x000000013F0F0000-0x000000013F4E2000-memory.dmp

Filesize
3.9MB

Download
memory/1432-115-0x000000013FE90000-0x0000000140282000-memory.dmp

Filesize
3.9MB

Download
memory/1432-6641-0x000000013FE90000-0x0000000140282000-memory.dmp

Filesize
3.9MB

Download
memory/2088-111-0x000000013FEF0000-0x00000001402E2000-memory.dmp

Filesize
3.9MB

Download
memory/2088-6645-0x000000013FEF0000-0x00000001402E2000-memory.dmp

Filesize
3.9MB

Download
memory/2492-6643-0x000000013FCA0000-0x0000000140092000-memory.dmp

Filesize
3.9MB

Download
memory/2492-102-0x000000013FCA0000-0x0000000140092000-memory.dmp

Filesize
3.9MB

Download
memory/2500-107-0x000000013FA50000-0x000000013FE42000-memory.dmp

Filesize
3.9MB

Download
memory/2500-6647-0x000000013FA50000-0x000000013FE42000-memory.dmp

Filesize
3.9MB

Download
memory/2544-6565-0x000000013F6A0000-0x000000013FA92000-memory.dmp

Filesize
3.9MB

Download
memory/2544-80-0x000000013F6A0000-0x000000013FA92000-memory.dmp

Filesize
3.9MB

Download
memory/2556-6644-0x000000013F600000-0x000000013F9F2000-memory.dmp

Filesize
3.9MB

Download
memory/2556-86-0x000000013F600000-0x000000013F9F2000-memory.dmp

Filesize
3.9MB

Download
memory/2664-83-0x000000013F3A0000-0x000000013F792000-memory.dmp

Filesize
3.9MB

Download
memory/2812-93-0x000000013FDC0000-0x00000001401B2000-memory.dmp

Filesize
3.9MB

Download
memory/2812-6646-0x000000013FDC0000-0x00000001401B2000-memory.dmp

Filesize
3.9MB

Download
memory/2944-92-0x000000013FDC0000-0x00000001401B2000-memory.dmp

Filesize
3.9MB

Download
memory/2944-13519-0x000000013F210000-0x000000013F602000-memory.dmp

Filesize
3.9MB

Download
memory/2944-110-0x000000013FEF0000-0x00000001402E2000-memory.dmp

Filesize
3.9MB

Download
memory/2944-101-0x000000013FCA0000-0x0000000140092000-memory.dmp

Filesize
3.9MB

Download
memory/2944-87-0x000000013FFA0000-0x0000000140392000-memory.dmp

Filesize
3.9MB

Download
memory/2944-114-0x000000013FE90000-0x0000000140282000-memory.dmp

Filesize
3.9MB

Download
memory/2944-81-0x0000000003060000-0x0000000003452000-memory.dmp

Filesize
3.9MB

Download
memory/2944-0-0x00000000000F0000-0x0000000000100000-memory.dmp

Filesize
64KB

Download
memory/2944-109-0x000000013F620000-0x000000013FA12000-memory.dmp

Filesize
3.9MB

Download
memory/2944-106-0x000000013FA50000-0x000000013FE42000-memory.dmp

Filesize
3.9MB

Download
memory/2944-105-0x000000013FAA0000-0x000000013FE92000-memory.dmp

Filesize
3.9MB

Download
memory/2944-84-0x000000013FAD0000-0x000000013FEC2000-memory.dmp

Filesize
3.9MB

Download
memory/2944-113-0x000000013F8B0000-0x000000013FCA2000-memory.dmp

Filesize
3.9MB

Download
memory/2944-119-0x000000013F6A0000-0x000000013FA92000-memory.dmp

Filesize
3.9MB

Download
memory/2944-99-0x00000000031E0000-0x00000000035D2000-memory.dmp

Filesize
3.9MB

Download
memory/2944-85-0x00000000031E0000-0x00000000035D2000-memory.dmp

Filesize
3.9MB

Download
memory/2944-2-0x000000013F210000-0x000000013F602000-memory.dmp

Filesize
3.9MB

Download
memory/2944-11-0x0000000003060000-0x0000000003452000-memory.dmp

Filesize
3.9MB

Download
memory/3056-82-0x000007FEF5AB0000-0x000007FEF644D000-memory.dmp

Filesize
9.6MB

Download
memory/3056-15-0x000007FEF5D6E000-0x000007FEF5D6F000-memory.dmp

Filesize
4KB

Download
memory/3056-14-0x0000000002850000-0x00000000028D0000-memory.dmp

Filesize
512KB

Download
memory/3056-22-0x000000001B6A0000-0x000000001B982000-memory.dmp

Filesize
2.9MB

Download
memory/3056-23-0x0000000001F00000-0x0000000001F08000-memory.dmp

Filesize
32KB

Download
memory/3056-118-0x000007FEF5AB0000-0x000007FEF644D000-memory.dmp

Filesize
9.6MB

Download
memory/3056-73-0x000007FEF5AB0000-0x000007FEF644D000-memory.dmp

Filesize
9.6MB

Download
memory/3056-166-0x000007FEF5AB0000-0x000007FEF644D000-memory.dmp

Filesize
9.6MB

Download