xmrig | 4ea0f2785a0e5a9f524542648316563cd994a7055b49892fac519c87fefe778e

Analysis

max time kernel
150s
max time network
142s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
07/06/2024, 09:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
4b5463b66f5a9c46a4a43fc9827319a0_NeikiAnalytics.exe
Size 1.5MB
Sample240607-lqm2vsed7x
SHA256 4ea0f2785a0e5a9f524542648316563cd994a7055b49892fac519c87fefe778e
MD5 4b5463b66f5a9c46a4a43fc9827319a0
SHA1 da312adea2b6b6d536fb808457983dfeca0240dd
SHA512 61733f96f1a5dffdc0e42442d0e017cb137a89c2118eb614884d74320d7f00f5f012aaf0b616967cdd1319dc52aec4a865213197b97a6e96f1a728dd4af00d7c
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkibTJH+2Q/ynKeWYXYcstOyl5EDbjpvZ7u:Lz071uv4BPMkibTIA5UIy
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 26 IoCs

miner

resource	yara_rule
behavioral1/memory/2740-97-0x0000000003270000-0x0000000003662000-memory.dmp	xmrig
behavioral1/memory/2480-96-0x000000013F7E0000-0x000000013FBD2000-memory.dmp	xmrig
behavioral1/memory/2992-4568-0x000000013FAB0000-0x000000013FEA2000-memory.dmp	xmrig
behavioral1/memory/2480-4603-0x000000013F7E0000-0x000000013FBD2000-memory.dmp	xmrig
behavioral1/memory/2624-4693-0x000000013F740000-0x000000013FB32000-memory.dmp	xmrig
behavioral1/memory/2496-4708-0x000000013F4F0000-0x000000013F8E2000-memory.dmp	xmrig
behavioral1/memory/2684-4824-0x000000013F7D0000-0x000000013FBC2000-memory.dmp	xmrig
behavioral1/memory/2576-4690-0x000000013F790000-0x000000013FB82000-memory.dmp	xmrig
behavioral1/memory/2452-4689-0x000000013FDD0000-0x00000001401C2000-memory.dmp	xmrig
behavioral1/memory/1920-4687-0x000000013FEC0000-0x00000001402B2000-memory.dmp	xmrig
behavioral1/memory/2608-4685-0x000000013F800000-0x000000013FBF2000-memory.dmp	xmrig
behavioral1/memory/1312-4574-0x000000013F240000-0x000000013F632000-memory.dmp	xmrig
behavioral1/memory/2448-4573-0x000000013F5A0000-0x000000013F992000-memory.dmp	xmrig
behavioral1/memory/2668-4570-0x000000013F330000-0x000000013F722000-memory.dmp	xmrig
behavioral1/memory/2496-103-0x000000013F4F0000-0x000000013F8E2000-memory.dmp	xmrig
behavioral1/memory/2740-117-0x0000000003270000-0x0000000003662000-memory.dmp	xmrig
behavioral1/memory/2624-115-0x000000013F740000-0x000000013FB32000-memory.dmp	xmrig
behavioral1/memory/1920-112-0x000000013FEC0000-0x00000001402B2000-memory.dmp	xmrig
behavioral1/memory/2684-109-0x000000013F7D0000-0x000000013FBC2000-memory.dmp	xmrig
behavioral1/memory/2608-107-0x000000013F800000-0x000000013FBF2000-memory.dmp	xmrig
behavioral1/memory/2452-105-0x000000013FDD0000-0x00000001401C2000-memory.dmp	xmrig
behavioral1/memory/1312-94-0x000000013F240000-0x000000013F632000-memory.dmp	xmrig
behavioral1/memory/2448-71-0x000000013F5A0000-0x000000013F992000-memory.dmp	xmrig
behavioral1/memory/2668-68-0x000000013F330000-0x000000013F722000-memory.dmp	xmrig
behavioral1/memory/2992-13-0x000000013FAB0000-0x000000013FEA2000-memory.dmp	xmrig
behavioral1/memory/2740-8491-0x000000013F5B0000-0x000000013F9A2000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
2196	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
2992	liOXSuc.exe
2668	jgpFdaM.exe
2448	lkZfMzm.exe
1312	MkhDeQW.exe
2480	SQSrnfC.exe
2576	geXQyXb.exe
2496	tbcTSDH.exe
2452	tXiZvAB.exe
2608	jcdVSTU.exe
2684	lMRKviW.exe
1920	NkITXeV.exe
2624	yqogJXn.exe
2796	Wwxzvhf.exe
548	KtAtOAG.exe
2784	SKoPhwZ.exe
1592	DHZebdW.exe
860	yznZRhJ.exe
1328	wMxFdDa.exe
2096	OZIvahH.exe
2984	AXACKOg.exe
1192	SaRCGEm.exe
2656	HjtIXUC.exe
2424	PRehVhD.exe
684	gcuBNvU.exe
2024	gjWTcZC.exe
584	CnBGjxh.exe
1828	WFXZANh.exe
1860	QxePlXO.exe
1020	RCzArfN.exe
848	LhQmOxO.exe
2044	ychNngB.exe
2092	BjyKrSr.exe
1340	DCbHoDf.exe
1960	yVPlRFB.exe
1304	UsqUXLs.exe
1060	TiNhhIZ.exe
2912	RAVzyaW.exe
1788	WptAdeJ.exe
928	pfEyhna.exe
280	DEvRUos.exe
2008	Mvmciem.exe
2928	uayHuzZ.exe
2052	vocujEj.exe
980	NyzUVfi.exe
2944	uSnIXXp.exe
2872	dKzxrVA.exe
892	jNxNBjb.exe
1064	RoXtezX.exe
2324	qHUBSIZ.exe
1264	eCHcagk.exe
1604	OvFBzFO.exe
2548	paOJBsM.exe
3040	raGVjJA.exe
2556	HRrRmRZ.exe
2720	nlsNlKV.exe
2468	RVgDOHW.exe
2444	niLSxZv.exe
2064	vtrewjl.exe
2672	NJgyafp.exe
2700	CPGGRHx.exe
2012	pxuhQUX.exe
1996	JCtsTDA.exe
1552	YhFthZn.exe
2932	thWEVWS.exe

Loads dropped DLL 64 IoCs

pid	Process
2740	4b5463b66f5a9c46a4a43fc9827319a0_NeikiAnalytics.exe
2740	4b5463b66f5a9c46a4a43fc9827319a0_NeikiAnalytics.exe
2740	4b5463b66f5a9c46a4a43fc9827319a0_NeikiAnalytics.exe
2740	4b5463b66f5a9c46a4a43fc9827319a0_NeikiAnalytics.exe
2740	4b5463b66f5a9c46a4a43fc9827319a0_NeikiAnalytics.exe
2740	4b5463b66f5a9c46a4a43fc9827319a0_NeikiAnalytics.exe
2740	4b5463b66f5a9c46a4a43fc9827319a0_NeikiAnalytics.exe
2740	4b5463b66f5a9c46a4a43fc9827319a0_NeikiAnalytics.exe
2740	4b5463b66f5a9c46a4a43fc9827319a0_NeikiAnalytics.exe
2740	4b5463b66f5a9c46a4a43fc9827319a0_NeikiAnalytics.exe
2740	4b5463b66f5a9c46a4a43fc9827319a0_NeikiAnalytics.exe
2740	4b5463b66f5a9c46a4a43fc9827319a0_NeikiAnalytics.exe
2740	4b5463b66f5a9c46a4a43fc9827319a0_NeikiAnalytics.exe
2740	4b5463b66f5a9c46a4a43fc9827319a0_NeikiAnalytics.exe
2740	4b5463b66f5a9c46a4a43fc9827319a0_NeikiAnalytics.exe
2740	4b5463b66f5a9c46a4a43fc9827319a0_NeikiAnalytics.exe
2740	4b5463b66f5a9c46a4a43fc9827319a0_NeikiAnalytics.exe
2740	4b5463b66f5a9c46a4a43fc9827319a0_NeikiAnalytics.exe
2740	4b5463b66f5a9c46a4a43fc9827319a0_NeikiAnalytics.exe
2740	4b5463b66f5a9c46a4a43fc9827319a0_NeikiAnalytics.exe
2740	4b5463b66f5a9c46a4a43fc9827319a0_NeikiAnalytics.exe
2740	4b5463b66f5a9c46a4a43fc9827319a0_NeikiAnalytics.exe
2740	4b5463b66f5a9c46a4a43fc9827319a0_NeikiAnalytics.exe
2740	4b5463b66f5a9c46a4a43fc9827319a0_NeikiAnalytics.exe
2740	4b5463b66f5a9c46a4a43fc9827319a0_NeikiAnalytics.exe
2740	4b5463b66f5a9c46a4a43fc9827319a0_NeikiAnalytics.exe
2740	4b5463b66f5a9c46a4a43fc9827319a0_NeikiAnalytics.exe
2740	4b5463b66f5a9c46a4a43fc9827319a0_NeikiAnalytics.exe
2740	4b5463b66f5a9c46a4a43fc9827319a0_NeikiAnalytics.exe
2740	4b5463b66f5a9c46a4a43fc9827319a0_NeikiAnalytics.exe
2740	4b5463b66f5a9c46a4a43fc9827319a0_NeikiAnalytics.exe
2740	4b5463b66f5a9c46a4a43fc9827319a0_NeikiAnalytics.exe
2740	4b5463b66f5a9c46a4a43fc9827319a0_NeikiAnalytics.exe
2740	4b5463b66f5a9c46a4a43fc9827319a0_NeikiAnalytics.exe
2740	4b5463b66f5a9c46a4a43fc9827319a0_NeikiAnalytics.exe
2740	4b5463b66f5a9c46a4a43fc9827319a0_NeikiAnalytics.exe
2740	4b5463b66f5a9c46a4a43fc9827319a0_NeikiAnalytics.exe
2740	4b5463b66f5a9c46a4a43fc9827319a0_NeikiAnalytics.exe
2740	4b5463b66f5a9c46a4a43fc9827319a0_NeikiAnalytics.exe
2740	4b5463b66f5a9c46a4a43fc9827319a0_NeikiAnalytics.exe
2740	4b5463b66f5a9c46a4a43fc9827319a0_NeikiAnalytics.exe
2740	4b5463b66f5a9c46a4a43fc9827319a0_NeikiAnalytics.exe
2740	4b5463b66f5a9c46a4a43fc9827319a0_NeikiAnalytics.exe
2740	4b5463b66f5a9c46a4a43fc9827319a0_NeikiAnalytics.exe
2740	4b5463b66f5a9c46a4a43fc9827319a0_NeikiAnalytics.exe
2740	4b5463b66f5a9c46a4a43fc9827319a0_NeikiAnalytics.exe
2740	4b5463b66f5a9c46a4a43fc9827319a0_NeikiAnalytics.exe
2740	4b5463b66f5a9c46a4a43fc9827319a0_NeikiAnalytics.exe
2740	4b5463b66f5a9c46a4a43fc9827319a0_NeikiAnalytics.exe
2740	4b5463b66f5a9c46a4a43fc9827319a0_NeikiAnalytics.exe
2740	4b5463b66f5a9c46a4a43fc9827319a0_NeikiAnalytics.exe
2740	4b5463b66f5a9c46a4a43fc9827319a0_NeikiAnalytics.exe
2740	4b5463b66f5a9c46a4a43fc9827319a0_NeikiAnalytics.exe
2740	4b5463b66f5a9c46a4a43fc9827319a0_NeikiAnalytics.exe
2740	4b5463b66f5a9c46a4a43fc9827319a0_NeikiAnalytics.exe
2740	4b5463b66f5a9c46a4a43fc9827319a0_NeikiAnalytics.exe
2740	4b5463b66f5a9c46a4a43fc9827319a0_NeikiAnalytics.exe
2740	4b5463b66f5a9c46a4a43fc9827319a0_NeikiAnalytics.exe
2740	4b5463b66f5a9c46a4a43fc9827319a0_NeikiAnalytics.exe
2740	4b5463b66f5a9c46a4a43fc9827319a0_NeikiAnalytics.exe
2740	4b5463b66f5a9c46a4a43fc9827319a0_NeikiAnalytics.exe
2740	4b5463b66f5a9c46a4a43fc9827319a0_NeikiAnalytics.exe
2740	4b5463b66f5a9c46a4a43fc9827319a0_NeikiAnalytics.exe
2740	4b5463b66f5a9c46a4a43fc9827319a0_NeikiAnalytics.exe

UPX packed file 62 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x000b00000001565d-5.dat	upx
behavioral1/files/0x000e0000000054ab-23.dat	upx
behavioral1/files/0x0007000000015d42-36.dat	upx
behavioral1/files/0x0007000000015d4e-39.dat	upx
behavioral1/files/0x0009000000015d56-45.dat	upx
behavioral1/files/0x000800000001658a-48.dat	upx
behavioral1/files/0x0006000000016616-55.dat	upx
behavioral1/files/0x0006000000016851-60.dat	upx
behavioral1/files/0x0006000000016c5e-78.dat	upx
behavioral1/files/0x0006000000016c5e-76.dat	upx
behavioral1/files/0x0006000000016cb0-84.dat	upx
behavioral1/files/0x0006000000016c44-74.dat	upx
behavioral1/files/0x0006000000016c64-90.dat	upx
behavioral1/memory/2480-96-0x000000013F7E0000-0x000000013FBD2000-memory.dmp	upx
behavioral1/files/0x0006000000016cdc-98.dat	upx
behavioral1/memory/2576-101-0x000000013F790000-0x000000013FB82000-memory.dmp	upx
behavioral1/files/0x0006000000016d07-126.dat	upx
behavioral1/files/0x0006000000016d5f-157.dat	upx
behavioral1/files/0x0006000000016d8e-170.dat	upx
behavioral1/files/0x0006000000016db9-187.dat	upx
behavioral1/memory/2992-4568-0x000000013FAB0000-0x000000013FEA2000-memory.dmp	upx
behavioral1/memory/2480-4603-0x000000013F7E0000-0x000000013FBD2000-memory.dmp	upx
behavioral1/memory/2624-4693-0x000000013F740000-0x000000013FB32000-memory.dmp	upx
behavioral1/memory/2496-4708-0x000000013F4F0000-0x000000013F8E2000-memory.dmp	upx
behavioral1/memory/2684-4824-0x000000013F7D0000-0x000000013FBC2000-memory.dmp	upx
behavioral1/memory/2576-4690-0x000000013F790000-0x000000013FB82000-memory.dmp	upx
behavioral1/memory/2452-4689-0x000000013FDD0000-0x00000001401C2000-memory.dmp	upx
behavioral1/memory/1920-4687-0x000000013FEC0000-0x00000001402B2000-memory.dmp	upx
behavioral1/memory/2608-4685-0x000000013F800000-0x000000013FBF2000-memory.dmp	upx
behavioral1/memory/1312-4574-0x000000013F240000-0x000000013F632000-memory.dmp	upx
behavioral1/memory/2448-4573-0x000000013F5A0000-0x000000013F992000-memory.dmp	upx
behavioral1/memory/2668-4570-0x000000013F330000-0x000000013F722000-memory.dmp	upx
behavioral1/memory/2496-103-0x000000013F4F0000-0x000000013F8E2000-memory.dmp	upx
behavioral1/files/0x0006000000016dbe-196.dat	upx
behavioral1/files/0x0006000000016db1-186.dat	upx
behavioral1/files/0x0006000000016da5-183.dat	upx
behavioral1/files/0x0006000000016d9d-176.dat	upx
behavioral1/files/0x0006000000016d74-166.dat	upx
behavioral1/files/0x0006000000016d43-163.dat	upx
behavioral1/files/0x0006000000016d3a-145.dat	upx
behavioral1/files/0x0006000000016d3a-143.dat	upx
behavioral1/files/0x0006000000016d3e-150.dat	upx
behavioral1/files/0x0006000000016d34-140.dat	upx
behavioral1/files/0x0006000000016d34-138.dat	upx
behavioral1/files/0x0006000000016d20-136.dat	upx
behavioral1/memory/2624-115-0x000000013F740000-0x000000013FB32000-memory.dmp	upx
behavioral1/memory/1920-112-0x000000013FEC0000-0x00000001402B2000-memory.dmp	upx
behavioral1/files/0x0006000000016d18-129.dat	upx
behavioral1/files/0x0006000000016d18-127.dat	upx
behavioral1/files/0x0034000000015ccd-120.dat	upx
behavioral1/memory/2684-109-0x000000013F7D0000-0x000000013FBC2000-memory.dmp	upx
behavioral1/memory/2608-107-0x000000013F800000-0x000000013FBF2000-memory.dmp	upx
behavioral1/memory/2452-105-0x000000013FDD0000-0x00000001401C2000-memory.dmp	upx
behavioral1/memory/1312-94-0x000000013F240000-0x000000013F632000-memory.dmp	upx
behavioral1/memory/2448-71-0x000000013F5A0000-0x000000013F992000-memory.dmp	upx
behavioral1/memory/2668-68-0x000000013F330000-0x000000013F722000-memory.dmp	upx
behavioral1/files/0x0006000000016adc-66.dat	upx
behavioral1/files/0x0008000000015d20-30.dat	upx
behavioral1/files/0x0034000000015cb6-18.dat	upx
behavioral1/memory/2992-13-0x000000013FAB0000-0x000000013FEA2000-memory.dmp	upx
behavioral1/memory/2740-1-0x000000013F5B0000-0x000000013F9A2000-memory.dmp	upx
behavioral1/memory/2740-8491-0x000000013F5B0000-0x000000013F9A2000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\YrdIANn.exe	4b5463b66f5a9c46a4a43fc9827319a0_NeikiAnalytics.exe
File created	C:\Windows\System\vglSoTs.exe	4b5463b66f5a9c46a4a43fc9827319a0_NeikiAnalytics.exe
File created	C:\Windows\System\oQGzjcz.exe	4b5463b66f5a9c46a4a43fc9827319a0_NeikiAnalytics.exe
File created	C:\Windows\System\QJUhDYz.exe	4b5463b66f5a9c46a4a43fc9827319a0_NeikiAnalytics.exe
File created	C:\Windows\System\IWRezaC.exe	4b5463b66f5a9c46a4a43fc9827319a0_NeikiAnalytics.exe
File created	C:\Windows\System\FjJCczW.exe	4b5463b66f5a9c46a4a43fc9827319a0_NeikiAnalytics.exe
File created	C:\Windows\System\IyKfOyy.exe	4b5463b66f5a9c46a4a43fc9827319a0_NeikiAnalytics.exe
File created	C:\Windows\System\oSgKQev.exe	4b5463b66f5a9c46a4a43fc9827319a0_NeikiAnalytics.exe
File created	C:\Windows\System\FTRJDrE.exe	4b5463b66f5a9c46a4a43fc9827319a0_NeikiAnalytics.exe
File created	C:\Windows\System\yPXiFTT.exe	4b5463b66f5a9c46a4a43fc9827319a0_NeikiAnalytics.exe
File created	C:\Windows\System\vBtuixz.exe	4b5463b66f5a9c46a4a43fc9827319a0_NeikiAnalytics.exe
File created	C:\Windows\System\mtpaWmY.exe	4b5463b66f5a9c46a4a43fc9827319a0_NeikiAnalytics.exe
File created	C:\Windows\System\nFDRseJ.exe	4b5463b66f5a9c46a4a43fc9827319a0_NeikiAnalytics.exe
File created	C:\Windows\System\eVzgCgb.exe	4b5463b66f5a9c46a4a43fc9827319a0_NeikiAnalytics.exe
File created	C:\Windows\System\GMlrkcu.exe	4b5463b66f5a9c46a4a43fc9827319a0_NeikiAnalytics.exe
File created	C:\Windows\System\rLJriTu.exe	4b5463b66f5a9c46a4a43fc9827319a0_NeikiAnalytics.exe
File created	C:\Windows\System\zpDoJYF.exe	4b5463b66f5a9c46a4a43fc9827319a0_NeikiAnalytics.exe
File created	C:\Windows\System\RbZCNWa.exe	4b5463b66f5a9c46a4a43fc9827319a0_NeikiAnalytics.exe
File created	C:\Windows\System\oxvuuna.exe	4b5463b66f5a9c46a4a43fc9827319a0_NeikiAnalytics.exe
File created	C:\Windows\System\aeczVXr.exe	4b5463b66f5a9c46a4a43fc9827319a0_NeikiAnalytics.exe
File created	C:\Windows\System\fYTLEeo.exe	4b5463b66f5a9c46a4a43fc9827319a0_NeikiAnalytics.exe
File created	C:\Windows\System\FcEIcDx.exe	4b5463b66f5a9c46a4a43fc9827319a0_NeikiAnalytics.exe
File created	C:\Windows\System\nwAPaUr.exe	4b5463b66f5a9c46a4a43fc9827319a0_NeikiAnalytics.exe
File created	C:\Windows\System\RXdjLGK.exe	4b5463b66f5a9c46a4a43fc9827319a0_NeikiAnalytics.exe
File created	C:\Windows\System\ivVoJka.exe	4b5463b66f5a9c46a4a43fc9827319a0_NeikiAnalytics.exe
File created	C:\Windows\System\dhmKiTL.exe	4b5463b66f5a9c46a4a43fc9827319a0_NeikiAnalytics.exe
File created	C:\Windows\System\xdHBUcL.exe	4b5463b66f5a9c46a4a43fc9827319a0_NeikiAnalytics.exe
File created	C:\Windows\System\yxMcfRs.exe	4b5463b66f5a9c46a4a43fc9827319a0_NeikiAnalytics.exe
File created	C:\Windows\System\CYqFxRZ.exe	4b5463b66f5a9c46a4a43fc9827319a0_NeikiAnalytics.exe
File created	C:\Windows\System\pKwqvkO.exe	4b5463b66f5a9c46a4a43fc9827319a0_NeikiAnalytics.exe
File created	C:\Windows\System\hAzXpJv.exe	4b5463b66f5a9c46a4a43fc9827319a0_NeikiAnalytics.exe
File created	C:\Windows\System\zrQUpUa.exe	4b5463b66f5a9c46a4a43fc9827319a0_NeikiAnalytics.exe
File created	C:\Windows\System\PJKajTc.exe	4b5463b66f5a9c46a4a43fc9827319a0_NeikiAnalytics.exe
File created	C:\Windows\System\ryumAHl.exe	4b5463b66f5a9c46a4a43fc9827319a0_NeikiAnalytics.exe
File created	C:\Windows\System\foxvCKH.exe	4b5463b66f5a9c46a4a43fc9827319a0_NeikiAnalytics.exe
File created	C:\Windows\System\SQSWQHf.exe	4b5463b66f5a9c46a4a43fc9827319a0_NeikiAnalytics.exe
File created	C:\Windows\System\ParwHku.exe	4b5463b66f5a9c46a4a43fc9827319a0_NeikiAnalytics.exe
File created	C:\Windows\System\cGNkvIO.exe	4b5463b66f5a9c46a4a43fc9827319a0_NeikiAnalytics.exe
File created	C:\Windows\System\OPbdgbw.exe	4b5463b66f5a9c46a4a43fc9827319a0_NeikiAnalytics.exe
File created	C:\Windows\System\TWzNWtX.exe	4b5463b66f5a9c46a4a43fc9827319a0_NeikiAnalytics.exe
File created	C:\Windows\System\JksCIqS.exe	4b5463b66f5a9c46a4a43fc9827319a0_NeikiAnalytics.exe
File created	C:\Windows\System\ezHrEVR.exe	4b5463b66f5a9c46a4a43fc9827319a0_NeikiAnalytics.exe
File created	C:\Windows\System\jOJbEOr.exe	4b5463b66f5a9c46a4a43fc9827319a0_NeikiAnalytics.exe
File created	C:\Windows\System\IuGYBmN.exe	4b5463b66f5a9c46a4a43fc9827319a0_NeikiAnalytics.exe
File created	C:\Windows\System\hXitSpY.exe	4b5463b66f5a9c46a4a43fc9827319a0_NeikiAnalytics.exe
File created	C:\Windows\System\CLdPjWw.exe	4b5463b66f5a9c46a4a43fc9827319a0_NeikiAnalytics.exe
File created	C:\Windows\System\TgFkIMY.exe	4b5463b66f5a9c46a4a43fc9827319a0_NeikiAnalytics.exe
File created	C:\Windows\System\ygdIiKP.exe	4b5463b66f5a9c46a4a43fc9827319a0_NeikiAnalytics.exe
File created	C:\Windows\System\IyQLDuc.exe	4b5463b66f5a9c46a4a43fc9827319a0_NeikiAnalytics.exe
File created	C:\Windows\System\FtJqQrI.exe	4b5463b66f5a9c46a4a43fc9827319a0_NeikiAnalytics.exe
File created	C:\Windows\System\VsUbvlK.exe	4b5463b66f5a9c46a4a43fc9827319a0_NeikiAnalytics.exe
File created	C:\Windows\System\vqpdpRy.exe	4b5463b66f5a9c46a4a43fc9827319a0_NeikiAnalytics.exe
File created	C:\Windows\System\SJvtIjm.exe	4b5463b66f5a9c46a4a43fc9827319a0_NeikiAnalytics.exe
File created	C:\Windows\System\vFgDqiZ.exe	4b5463b66f5a9c46a4a43fc9827319a0_NeikiAnalytics.exe
File created	C:\Windows\System\AwNjJxN.exe	4b5463b66f5a9c46a4a43fc9827319a0_NeikiAnalytics.exe
File created	C:\Windows\System\pPCsTtj.exe	4b5463b66f5a9c46a4a43fc9827319a0_NeikiAnalytics.exe
File created	C:\Windows\System\oNRWhYI.exe	4b5463b66f5a9c46a4a43fc9827319a0_NeikiAnalytics.exe
File created	C:\Windows\System\OnEtBKs.exe	4b5463b66f5a9c46a4a43fc9827319a0_NeikiAnalytics.exe
File created	C:\Windows\System\ezRlAYD.exe	4b5463b66f5a9c46a4a43fc9827319a0_NeikiAnalytics.exe
File created	C:\Windows\System\XRzUkcE.exe	4b5463b66f5a9c46a4a43fc9827319a0_NeikiAnalytics.exe
File created	C:\Windows\System\KaXfbxr.exe	4b5463b66f5a9c46a4a43fc9827319a0_NeikiAnalytics.exe
File created	C:\Windows\System\vidFJHQ.exe	4b5463b66f5a9c46a4a43fc9827319a0_NeikiAnalytics.exe
File created	C:\Windows\System\TfKvvBF.exe	4b5463b66f5a9c46a4a43fc9827319a0_NeikiAnalytics.exe
File created	C:\Windows\System\edhhAUB.exe	4b5463b66f5a9c46a4a43fc9827319a0_NeikiAnalytics.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2196	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2740	4b5463b66f5a9c46a4a43fc9827319a0_NeikiAnalytics.exe
Token: SeLockMemoryPrivilege	2740	4b5463b66f5a9c46a4a43fc9827319a0_NeikiAnalytics.exe
Token: SeDebugPrivilege	2196	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2740 wrote to memory of 2196	2740	4b5463b66f5a9c46a4a43fc9827319a0_NeikiAnalytics.exe	29
PID 2740 wrote to memory of 2196	2740	4b5463b66f5a9c46a4a43fc9827319a0_NeikiAnalytics.exe	29
PID 2740 wrote to memory of 2196	2740	4b5463b66f5a9c46a4a43fc9827319a0_NeikiAnalytics.exe	29
PID 2740 wrote to memory of 2992	2740	4b5463b66f5a9c46a4a43fc9827319a0_NeikiAnalytics.exe	30
PID 2740 wrote to memory of 2992	2740	4b5463b66f5a9c46a4a43fc9827319a0_NeikiAnalytics.exe	30
PID 2740 wrote to memory of 2992	2740	4b5463b66f5a9c46a4a43fc9827319a0_NeikiAnalytics.exe	30
PID 2740 wrote to memory of 2668	2740	4b5463b66f5a9c46a4a43fc9827319a0_NeikiAnalytics.exe	31
PID 2740 wrote to memory of 2668	2740	4b5463b66f5a9c46a4a43fc9827319a0_NeikiAnalytics.exe	31
PID 2740 wrote to memory of 2668	2740	4b5463b66f5a9c46a4a43fc9827319a0_NeikiAnalytics.exe	31
PID 2740 wrote to memory of 2448	2740	4b5463b66f5a9c46a4a43fc9827319a0_NeikiAnalytics.exe	32
PID 2740 wrote to memory of 2448	2740	4b5463b66f5a9c46a4a43fc9827319a0_NeikiAnalytics.exe	32
PID 2740 wrote to memory of 2448	2740	4b5463b66f5a9c46a4a43fc9827319a0_NeikiAnalytics.exe	32
PID 2740 wrote to memory of 1312	2740	4b5463b66f5a9c46a4a43fc9827319a0_NeikiAnalytics.exe	33
PID 2740 wrote to memory of 1312	2740	4b5463b66f5a9c46a4a43fc9827319a0_NeikiAnalytics.exe	33
PID 2740 wrote to memory of 1312	2740	4b5463b66f5a9c46a4a43fc9827319a0_NeikiAnalytics.exe	33
PID 2740 wrote to memory of 2480	2740	4b5463b66f5a9c46a4a43fc9827319a0_NeikiAnalytics.exe	34
PID 2740 wrote to memory of 2480	2740	4b5463b66f5a9c46a4a43fc9827319a0_NeikiAnalytics.exe	34
PID 2740 wrote to memory of 2480	2740	4b5463b66f5a9c46a4a43fc9827319a0_NeikiAnalytics.exe	34
PID 2740 wrote to memory of 2576	2740	4b5463b66f5a9c46a4a43fc9827319a0_NeikiAnalytics.exe	35
PID 2740 wrote to memory of 2576	2740	4b5463b66f5a9c46a4a43fc9827319a0_NeikiAnalytics.exe	35
PID 2740 wrote to memory of 2576	2740	4b5463b66f5a9c46a4a43fc9827319a0_NeikiAnalytics.exe	35
PID 2740 wrote to memory of 2496	2740	4b5463b66f5a9c46a4a43fc9827319a0_NeikiAnalytics.exe	36
PID 2740 wrote to memory of 2496	2740	4b5463b66f5a9c46a4a43fc9827319a0_NeikiAnalytics.exe	36
PID 2740 wrote to memory of 2496	2740	4b5463b66f5a9c46a4a43fc9827319a0_NeikiAnalytics.exe	36
PID 2740 wrote to memory of 2452	2740	4b5463b66f5a9c46a4a43fc9827319a0_NeikiAnalytics.exe	37
PID 2740 wrote to memory of 2452	2740	4b5463b66f5a9c46a4a43fc9827319a0_NeikiAnalytics.exe	37
PID 2740 wrote to memory of 2452	2740	4b5463b66f5a9c46a4a43fc9827319a0_NeikiAnalytics.exe	37
PID 2740 wrote to memory of 2608	2740	4b5463b66f5a9c46a4a43fc9827319a0_NeikiAnalytics.exe	38
PID 2740 wrote to memory of 2608	2740	4b5463b66f5a9c46a4a43fc9827319a0_NeikiAnalytics.exe	38
PID 2740 wrote to memory of 2608	2740	4b5463b66f5a9c46a4a43fc9827319a0_NeikiAnalytics.exe	38
PID 2740 wrote to memory of 2684	2740	4b5463b66f5a9c46a4a43fc9827319a0_NeikiAnalytics.exe	39
PID 2740 wrote to memory of 2684	2740	4b5463b66f5a9c46a4a43fc9827319a0_NeikiAnalytics.exe	39
PID 2740 wrote to memory of 2684	2740	4b5463b66f5a9c46a4a43fc9827319a0_NeikiAnalytics.exe	39
PID 2740 wrote to memory of 1920	2740	4b5463b66f5a9c46a4a43fc9827319a0_NeikiAnalytics.exe	40
PID 2740 wrote to memory of 1920	2740	4b5463b66f5a9c46a4a43fc9827319a0_NeikiAnalytics.exe	40
PID 2740 wrote to memory of 1920	2740	4b5463b66f5a9c46a4a43fc9827319a0_NeikiAnalytics.exe	40
PID 2740 wrote to memory of 2624	2740	4b5463b66f5a9c46a4a43fc9827319a0_NeikiAnalytics.exe	41
PID 2740 wrote to memory of 2624	2740	4b5463b66f5a9c46a4a43fc9827319a0_NeikiAnalytics.exe	41
PID 2740 wrote to memory of 2624	2740	4b5463b66f5a9c46a4a43fc9827319a0_NeikiAnalytics.exe	41
PID 2740 wrote to memory of 2796	2740	4b5463b66f5a9c46a4a43fc9827319a0_NeikiAnalytics.exe	42
PID 2740 wrote to memory of 2796	2740	4b5463b66f5a9c46a4a43fc9827319a0_NeikiAnalytics.exe	42
PID 2740 wrote to memory of 2796	2740	4b5463b66f5a9c46a4a43fc9827319a0_NeikiAnalytics.exe	42
PID 2740 wrote to memory of 2784	2740	4b5463b66f5a9c46a4a43fc9827319a0_NeikiAnalytics.exe	43
PID 2740 wrote to memory of 2784	2740	4b5463b66f5a9c46a4a43fc9827319a0_NeikiAnalytics.exe	43
PID 2740 wrote to memory of 2784	2740	4b5463b66f5a9c46a4a43fc9827319a0_NeikiAnalytics.exe	43
PID 2740 wrote to memory of 548	2740	4b5463b66f5a9c46a4a43fc9827319a0_NeikiAnalytics.exe	44
PID 2740 wrote to memory of 548	2740	4b5463b66f5a9c46a4a43fc9827319a0_NeikiAnalytics.exe	44
PID 2740 wrote to memory of 548	2740	4b5463b66f5a9c46a4a43fc9827319a0_NeikiAnalytics.exe	44
PID 2740 wrote to memory of 1592	2740	4b5463b66f5a9c46a4a43fc9827319a0_NeikiAnalytics.exe	45
PID 2740 wrote to memory of 1592	2740	4b5463b66f5a9c46a4a43fc9827319a0_NeikiAnalytics.exe	45
PID 2740 wrote to memory of 1592	2740	4b5463b66f5a9c46a4a43fc9827319a0_NeikiAnalytics.exe	45
PID 2740 wrote to memory of 860	2740	4b5463b66f5a9c46a4a43fc9827319a0_NeikiAnalytics.exe	46
PID 2740 wrote to memory of 860	2740	4b5463b66f5a9c46a4a43fc9827319a0_NeikiAnalytics.exe	46
PID 2740 wrote to memory of 860	2740	4b5463b66f5a9c46a4a43fc9827319a0_NeikiAnalytics.exe	46
PID 2740 wrote to memory of 1328	2740	4b5463b66f5a9c46a4a43fc9827319a0_NeikiAnalytics.exe	47
PID 2740 wrote to memory of 1328	2740	4b5463b66f5a9c46a4a43fc9827319a0_NeikiAnalytics.exe	47
PID 2740 wrote to memory of 1328	2740	4b5463b66f5a9c46a4a43fc9827319a0_NeikiAnalytics.exe	47
PID 2740 wrote to memory of 2096	2740	4b5463b66f5a9c46a4a43fc9827319a0_NeikiAnalytics.exe	48
PID 2740 wrote to memory of 2096	2740	4b5463b66f5a9c46a4a43fc9827319a0_NeikiAnalytics.exe	48
PID 2740 wrote to memory of 2096	2740	4b5463b66f5a9c46a4a43fc9827319a0_NeikiAnalytics.exe	48
PID 2740 wrote to memory of 2984	2740	4b5463b66f5a9c46a4a43fc9827319a0_NeikiAnalytics.exe	49
PID 2740 wrote to memory of 2984	2740	4b5463b66f5a9c46a4a43fc9827319a0_NeikiAnalytics.exe	49
PID 2740 wrote to memory of 2984	2740	4b5463b66f5a9c46a4a43fc9827319a0_NeikiAnalytics.exe	49
PID 2740 wrote to memory of 1192	2740	4b5463b66f5a9c46a4a43fc9827319a0_NeikiAnalytics.exe	50

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:1688

C:\Users\Admin\AppData\Local\Temp\1805754841\zmstage.exe
C:\Users\Admin\AppData\Local\Temp\1805754841\zmstage.exe
1⤵
PID:2068

C:\Users\Admin\AppData\Local\Temp\4b5463b66f5a9c46a4a43fc9827319a0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\4b5463b66f5a9c46a4a43fc9827319a0_NeikiAnalytics.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2740
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2196
- C:\Windows\System\liOXSuc.exe
  C:\Windows\System\liOXSuc.exe
  2⤵
  - Executes dropped EXE
  PID:2992
- C:\Windows\System\jgpFdaM.exe
  C:\Windows\System\jgpFdaM.exe
  2⤵
  - Executes dropped EXE
  PID:2668
- C:\Windows\System\lkZfMzm.exe
  C:\Windows\System\lkZfMzm.exe
  2⤵
  - Executes dropped EXE
  PID:2448
- C:\Windows\System\MkhDeQW.exe
  C:\Windows\System\MkhDeQW.exe
  2⤵
  - Executes dropped EXE
  PID:1312
- C:\Windows\System\SQSrnfC.exe
  C:\Windows\System\SQSrnfC.exe
  2⤵
  - Executes dropped EXE
  PID:2480
- C:\Windows\System\geXQyXb.exe
  C:\Windows\System\geXQyXb.exe
  2⤵
  - Executes dropped EXE
  PID:2576
- C:\Windows\System\tbcTSDH.exe
  C:\Windows\System\tbcTSDH.exe
  2⤵
  - Executes dropped EXE
  PID:2496
- C:\Windows\System\tXiZvAB.exe
  C:\Windows\System\tXiZvAB.exe
  2⤵
  - Executes dropped EXE
  PID:2452
- C:\Windows\System\jcdVSTU.exe
  C:\Windows\System\jcdVSTU.exe
  2⤵
  - Executes dropped EXE
  PID:2608
- C:\Windows\System\lMRKviW.exe
  C:\Windows\System\lMRKviW.exe
  2⤵
  - Executes dropped EXE
  PID:2684
- C:\Windows\System\NkITXeV.exe
  C:\Windows\System\NkITXeV.exe
  2⤵
  - Executes dropped EXE
  PID:1920
- C:\Windows\System\yqogJXn.exe
  C:\Windows\System\yqogJXn.exe
  2⤵
  - Executes dropped EXE
  PID:2624
- C:\Windows\System\Wwxzvhf.exe
  C:\Windows\System\Wwxzvhf.exe
  2⤵
  - Executes dropped EXE
  PID:2796
- C:\Windows\System\SKoPhwZ.exe
  C:\Windows\System\SKoPhwZ.exe
  2⤵
  - Executes dropped EXE
  PID:2784
- C:\Windows\System\KtAtOAG.exe
  C:\Windows\System\KtAtOAG.exe
  2⤵
  - Executes dropped EXE
  PID:548
- C:\Windows\System\DHZebdW.exe
  C:\Windows\System\DHZebdW.exe
  2⤵
  - Executes dropped EXE
  PID:1592
- C:\Windows\System\yznZRhJ.exe
  C:\Windows\System\yznZRhJ.exe
  2⤵
  - Executes dropped EXE
  PID:860
- C:\Windows\System\wMxFdDa.exe
  C:\Windows\System\wMxFdDa.exe
  2⤵
  - Executes dropped EXE
  PID:1328
- C:\Windows\System\OZIvahH.exe
  C:\Windows\System\OZIvahH.exe
  2⤵
  - Executes dropped EXE
  PID:2096
- C:\Windows\System\AXACKOg.exe
  C:\Windows\System\AXACKOg.exe
  2⤵
  - Executes dropped EXE
  PID:2984
- C:\Windows\System\SaRCGEm.exe
  C:\Windows\System\SaRCGEm.exe
  2⤵
  - Executes dropped EXE
  PID:1192
- C:\Windows\System\HjtIXUC.exe
  C:\Windows\System\HjtIXUC.exe
  2⤵
  - Executes dropped EXE
  PID:2656
- C:\Windows\System\PRehVhD.exe
  C:\Windows\System\PRehVhD.exe
  2⤵
  - Executes dropped EXE
  PID:2424
- C:\Windows\System\gjWTcZC.exe
  C:\Windows\System\gjWTcZC.exe
  2⤵
  - Executes dropped EXE
  PID:2024
- C:\Windows\System\gcuBNvU.exe
  C:\Windows\System\gcuBNvU.exe
  2⤵
  - Executes dropped EXE
  PID:684
- C:\Windows\System\CnBGjxh.exe
  C:\Windows\System\CnBGjxh.exe
  2⤵
  - Executes dropped EXE
  PID:584
- C:\Windows\System\WFXZANh.exe
  C:\Windows\System\WFXZANh.exe
  2⤵
  - Executes dropped EXE
  PID:1828
- C:\Windows\System\QxePlXO.exe
  C:\Windows\System\QxePlXO.exe
  2⤵
  - Executes dropped EXE
  PID:1860
- C:\Windows\System\RCzArfN.exe
  C:\Windows\System\RCzArfN.exe
  2⤵
  - Executes dropped EXE
  PID:1020
- C:\Windows\System\LhQmOxO.exe
  C:\Windows\System\LhQmOxO.exe
  2⤵
  - Executes dropped EXE
  PID:848
- C:\Windows\System\ychNngB.exe
  C:\Windows\System\ychNngB.exe
  2⤵
  - Executes dropped EXE
  PID:2044
- C:\Windows\System\BjyKrSr.exe
  C:\Windows\System\BjyKrSr.exe
  2⤵
  - Executes dropped EXE
  PID:2092
- C:\Windows\System\DCbHoDf.exe
  C:\Windows\System\DCbHoDf.exe
  2⤵
  - Executes dropped EXE
  PID:1340
- C:\Windows\System\yVPlRFB.exe
  C:\Windows\System\yVPlRFB.exe
  2⤵
  - Executes dropped EXE
  PID:1960
- C:\Windows\System\UsqUXLs.exe
  C:\Windows\System\UsqUXLs.exe
  2⤵
  - Executes dropped EXE
  PID:1304
- C:\Windows\System\TiNhhIZ.exe
  C:\Windows\System\TiNhhIZ.exe
  2⤵
  - Executes dropped EXE
  PID:1060
- C:\Windows\System\RAVzyaW.exe
  C:\Windows\System\RAVzyaW.exe
  2⤵
  - Executes dropped EXE
  PID:2912
- C:\Windows\System\WptAdeJ.exe
  C:\Windows\System\WptAdeJ.exe
  2⤵
  - Executes dropped EXE
  PID:1788
- C:\Windows\System\pfEyhna.exe
  C:\Windows\System\pfEyhna.exe
  2⤵
  - Executes dropped EXE
  PID:928
- C:\Windows\System\DEvRUos.exe
  C:\Windows\System\DEvRUos.exe
  2⤵
  - Executes dropped EXE
  PID:280
- C:\Windows\System\Mvmciem.exe
  C:\Windows\System\Mvmciem.exe
  2⤵
  - Executes dropped EXE
  PID:2008
- C:\Windows\System\uayHuzZ.exe
  C:\Windows\System\uayHuzZ.exe
  2⤵
  - Executes dropped EXE
  PID:2928
- C:\Windows\System\vocujEj.exe
  C:\Windows\System\vocujEj.exe
  2⤵
  - Executes dropped EXE
  PID:2052
- C:\Windows\System\NyzUVfi.exe
  C:\Windows\System\NyzUVfi.exe
  2⤵
  - Executes dropped EXE
  PID:980
- C:\Windows\System\uSnIXXp.exe
  C:\Windows\System\uSnIXXp.exe
  2⤵
  - Executes dropped EXE
  PID:2944
- C:\Windows\System\dKzxrVA.exe
  C:\Windows\System\dKzxrVA.exe
  2⤵
  - Executes dropped EXE
  PID:2872
- C:\Windows\System\jNxNBjb.exe
  C:\Windows\System\jNxNBjb.exe
  2⤵
  - Executes dropped EXE
  PID:892
- C:\Windows\System\RoXtezX.exe
  C:\Windows\System\RoXtezX.exe
  2⤵
  - Executes dropped EXE
  PID:1064
- C:\Windows\System\qHUBSIZ.exe
  C:\Windows\System\qHUBSIZ.exe
  2⤵
  - Executes dropped EXE
  PID:2324
- C:\Windows\System\eCHcagk.exe
  C:\Windows\System\eCHcagk.exe
  2⤵
  - Executes dropped EXE
  PID:1264
- C:\Windows\System\OvFBzFO.exe
  C:\Windows\System\OvFBzFO.exe
  2⤵
  - Executes dropped EXE
  PID:1604
- C:\Windows\System\paOJBsM.exe
  C:\Windows\System\paOJBsM.exe
  2⤵
  - Executes dropped EXE
  PID:2548
- C:\Windows\System\raGVjJA.exe
  C:\Windows\System\raGVjJA.exe
  2⤵
  - Executes dropped EXE
  PID:3040
- C:\Windows\System\HRrRmRZ.exe
  C:\Windows\System\HRrRmRZ.exe
  2⤵
  - Executes dropped EXE
  PID:2556
- C:\Windows\System\nlsNlKV.exe
  C:\Windows\System\nlsNlKV.exe
  2⤵
  - Executes dropped EXE
  PID:2720
- C:\Windows\System\RVgDOHW.exe
  C:\Windows\System\RVgDOHW.exe
  2⤵
  - Executes dropped EXE
  PID:2468
- C:\Windows\System\niLSxZv.exe
  C:\Windows\System\niLSxZv.exe
  2⤵
  - Executes dropped EXE
  PID:2444
- C:\Windows\System\vtrewjl.exe
  C:\Windows\System\vtrewjl.exe
  2⤵
  - Executes dropped EXE
  PID:2064
- C:\Windows\System\NJgyafp.exe
  C:\Windows\System\NJgyafp.exe
  2⤵
  - Executes dropped EXE
  PID:2672
- C:\Windows\System\CPGGRHx.exe
  C:\Windows\System\CPGGRHx.exe
  2⤵
  - Executes dropped EXE
  PID:2700
- C:\Windows\System\pxuhQUX.exe
  C:\Windows\System\pxuhQUX.exe
  2⤵
  - Executes dropped EXE
  PID:2012
- C:\Windows\System\JCtsTDA.exe
  C:\Windows\System\JCtsTDA.exe
  2⤵
  - Executes dropped EXE
  PID:1996
- C:\Windows\System\YhFthZn.exe
  C:\Windows\System\YhFthZn.exe
  2⤵
  - Executes dropped EXE
  PID:1552
- C:\Windows\System\thWEVWS.exe
  C:\Windows\System\thWEVWS.exe
  2⤵
  - Executes dropped EXE
  PID:2932
- C:\Windows\System\NHdNqvc.exe
  C:\Windows\System\NHdNqvc.exe
  2⤵
  PID:1520
- C:\Windows\System\QCeNQNl.exe
  C:\Windows\System\QCeNQNl.exe
  2⤵
  PID:1764
- C:\Windows\System\vrURiKP.exe
  C:\Windows\System\vrURiKP.exe
  2⤵
  PID:2000
- C:\Windows\System\NxnwkHK.exe
  C:\Windows\System\NxnwkHK.exe
  2⤵
  PID:2776
- C:\Windows\System\oSgKQev.exe
  C:\Windows\System\oSgKQev.exe
  2⤵
  PID:1932
- C:\Windows\System\boEprtN.exe
  C:\Windows\System\boEprtN.exe
  2⤵
  PID:2848
- C:\Windows\System\sfICThz.exe
  C:\Windows\System\sfICThz.exe
  2⤵
  PID:596
- C:\Windows\System\jmgzrov.exe
  C:\Windows\System\jmgzrov.exe
  2⤵
  PID:960
- C:\Windows\System\mQEoDsb.exe
  C:\Windows\System\mQEoDsb.exe
  2⤵
  PID:2292
- C:\Windows\System\jxyuWGD.exe
  C:\Windows\System\jxyuWGD.exe
  2⤵
  PID:2152
- C:\Windows\System\RLswefr.exe
  C:\Windows\System\RLswefr.exe
  2⤵
  PID:1092
- C:\Windows\System\jZXNfNJ.exe
  C:\Windows\System\jZXNfNJ.exe
  2⤵
  PID:2104
- C:\Windows\System\egTZAwM.exe
  C:\Windows\System\egTZAwM.exe
  2⤵
  PID:1748
- C:\Windows\System\gxbcnyy.exe
  C:\Windows\System\gxbcnyy.exe
  2⤵
  PID:884
- C:\Windows\System\qtBLOQg.exe
  C:\Windows\System\qtBLOQg.exe
  2⤵
  PID:2140
- C:\Windows\System\tvKBmAz.exe
  C:\Windows\System\tvKBmAz.exe
  2⤵
  PID:2920
- C:\Windows\System\rzdFuHL.exe
  C:\Windows\System\rzdFuHL.exe
  2⤵
  PID:620
- C:\Windows\System\GFdNulW.exe
  C:\Windows\System\GFdNulW.exe
  2⤵
  PID:2072
- C:\Windows\System\zuaoLWE.exe
  C:\Windows\System\zuaoLWE.exe
  2⤵
  PID:1000
- C:\Windows\System\gYCDsrl.exe
  C:\Windows\System\gYCDsrl.exe
  2⤵
  PID:896
- C:\Windows\System\VXMBLel.exe
  C:\Windows\System\VXMBLel.exe
  2⤵
  PID:2068
- C:\Windows\System\PTkMyrC.exe
  C:\Windows\System\PTkMyrC.exe
  2⤵
  PID:1612
- C:\Windows\System\jAADXoq.exe
  C:\Windows\System\jAADXoq.exe
  2⤵
  PID:1396
- C:\Windows\System\fiHqBkv.exe
  C:\Windows\System\fiHqBkv.exe
  2⤵
  PID:1240
- C:\Windows\System\JbsfsxH.exe
  C:\Windows\System\JbsfsxH.exe
  2⤵
  PID:2880
- C:\Windows\System\OqewNZC.exe
  C:\Windows\System\OqewNZC.exe
  2⤵
  PID:2832
- C:\Windows\System\JxfgZRD.exe
  C:\Windows\System\JxfgZRD.exe
  2⤵
  PID:2440
- C:\Windows\System\LrUktcv.exe
  C:\Windows\System\LrUktcv.exe
  2⤵
  PID:1208
- C:\Windows\System\CmMbJxp.exe
  C:\Windows\System\CmMbJxp.exe
  2⤵
  PID:2404
- C:\Windows\System\GXerHQG.exe
  C:\Windows\System\GXerHQG.exe
  2⤵
  PID:2704
- C:\Windows\System\DbnqQdm.exe
  C:\Windows\System\DbnqQdm.exe
  2⤵
  PID:2580
- C:\Windows\System\MGFhuXi.exe
  C:\Windows\System\MGFhuXi.exe
  2⤵
  PID:2844
- C:\Windows\System\OdoMoDx.exe
  C:\Windows\System\OdoMoDx.exe
  2⤵
  PID:2620
- C:\Windows\System\jajohAy.exe
  C:\Windows\System\jajohAy.exe
  2⤵
  PID:772
- C:\Windows\System\qJLhWnU.exe
  C:\Windows\System\qJLhWnU.exe
  2⤵
  PID:2120
- C:\Windows\System\zdZsESB.exe
  C:\Windows\System\zdZsESB.exe
  2⤵
  PID:1108
- C:\Windows\System\mvfshLd.exe
  C:\Windows\System\mvfshLd.exe
  2⤵
  PID:1140
- C:\Windows\System\okPsKkG.exe
  C:\Windows\System\okPsKkG.exe
  2⤵
  PID:1544
- C:\Windows\System\RrnGEaM.exe
  C:\Windows\System\RrnGEaM.exe
  2⤵
  PID:964
- C:\Windows\System\xhkKJkd.exe
  C:\Windows\System\xhkKJkd.exe
  2⤵
  PID:1332
- C:\Windows\System\QzhXqIG.exe
  C:\Windows\System\QzhXqIG.exe
  2⤵
  PID:3032
- C:\Windows\System\WAMBHpc.exe
  C:\Windows\System\WAMBHpc.exe
  2⤵
  PID:916
- C:\Windows\System\ibhBJWj.exe
  C:\Windows\System\ibhBJWj.exe
  2⤵
  PID:2380
- C:\Windows\System\EVHeZSN.exe
  C:\Windows\System\EVHeZSN.exe
  2⤵
  PID:2604
- C:\Windows\System\mywypiG.exe
  C:\Windows\System\mywypiG.exe
  2⤵
  PID:2172
- C:\Windows\System\vuqCvne.exe
  C:\Windows\System\vuqCvne.exe
  2⤵
  PID:1512
- C:\Windows\System\qkEZaKY.exe
  C:\Windows\System\qkEZaKY.exe
  2⤵
  PID:2564
- C:\Windows\System\CFZeAgq.exe
  C:\Windows\System\CFZeAgq.exe
  2⤵
  PID:2728
- C:\Windows\System\dBcRcsN.exe
  C:\Windows\System\dBcRcsN.exe
  2⤵
  PID:636
- C:\Windows\System\sfWcUWA.exe
  C:\Windows\System\sfWcUWA.exe
  2⤵
  PID:552
- C:\Windows\System\nXftqWz.exe
  C:\Windows\System\nXftqWz.exe
  2⤵
  PID:2660
- C:\Windows\System\UByVcwg.exe
  C:\Windows\System\UByVcwg.exe
  2⤵
  PID:2892
- C:\Windows\System\kEhmUpE.exe
  C:\Windows\System\kEhmUpE.exe
  2⤵
  PID:1528
- C:\Windows\System\abLfZTQ.exe
  C:\Windows\System\abLfZTQ.exe
  2⤵
  PID:1244
- C:\Windows\System\AIFcLDu.exe
  C:\Windows\System\AIFcLDu.exe
  2⤵
  PID:2512
- C:\Windows\System\hbLRlKp.exe
  C:\Windows\System\hbLRlKp.exe
  2⤵
  PID:2420
- C:\Windows\System\JhFdqMX.exe
  C:\Windows\System\JhFdqMX.exe
  2⤵
  PID:1556
- C:\Windows\System\NRhldZU.exe
  C:\Windows\System\NRhldZU.exe
  2⤵
  PID:1772
- C:\Windows\System\mSIHKaE.exe
  C:\Windows\System\mSIHKaE.exe
  2⤵
  PID:660
- C:\Windows\System\SKEfHYr.exe
  C:\Windows\System\SKEfHYr.exe
  2⤵
  PID:2412
- C:\Windows\System\OVlbMaX.exe
  C:\Windows\System\OVlbMaX.exe
  2⤵
  PID:2264
- C:\Windows\System\xcbNxzd.exe
  C:\Windows\System\xcbNxzd.exe
  2⤵
  PID:1980
- C:\Windows\System\wuesDly.exe
  C:\Windows\System\wuesDly.exe
  2⤵
  PID:2612
- C:\Windows\System\eCVFbRu.exe
  C:\Windows\System\eCVFbRu.exe
  2⤵
  PID:2400
- C:\Windows\System\zJUIPPE.exe
  C:\Windows\System\zJUIPPE.exe
  2⤵
  PID:2156
- C:\Windows\System\ZJpgOoW.exe
  C:\Windows\System\ZJpgOoW.exe
  2⤵
  PID:2572
- C:\Windows\System\dkApeKT.exe
  C:\Windows\System\dkApeKT.exe
  2⤵
  PID:2756
- C:\Windows\System\MKpSMlk.exe
  C:\Windows\System\MKpSMlk.exe
  2⤵
  PID:2260
- C:\Windows\System\PaftfBL.exe
  C:\Windows\System\PaftfBL.exe
  2⤵
  PID:2256
- C:\Windows\System\RqMfOmc.exe
  C:\Windows\System\RqMfOmc.exe
  2⤵
  PID:1872
- C:\Windows\System\NzqystV.exe
  C:\Windows\System\NzqystV.exe
  2⤵
  PID:2856
- C:\Windows\System\ZSrgpwH.exe
  C:\Windows\System\ZSrgpwH.exe
  2⤵
  PID:2016
- C:\Windows\System\LgHZhwM.exe
  C:\Windows\System\LgHZhwM.exe
  2⤵
  PID:2376
- C:\Windows\System\iwtIHOQ.exe
  C:\Windows\System\iwtIHOQ.exe
  2⤵
  PID:2904
- C:\Windows\System\HTNoXfE.exe
  C:\Windows\System\HTNoXfE.exe
  2⤵
  PID:2560
- C:\Windows\System\vVuDFWZ.exe
  C:\Windows\System\vVuDFWZ.exe
  2⤵
  PID:2988
- C:\Windows\System\jjLmDnt.exe
  C:\Windows\System\jjLmDnt.exe
  2⤵
  PID:1576
- C:\Windows\System\UJXjtxs.exe
  C:\Windows\System\UJXjtxs.exe
  2⤵
  PID:1496
- C:\Windows\System\AChrjio.exe
  C:\Windows\System\AChrjio.exe
  2⤵
  PID:2588
- C:\Windows\System\sFRAYHX.exe
  C:\Windows\System\sFRAYHX.exe
  2⤵
  PID:2788
- C:\Windows\System\OquvMje.exe
  C:\Windows\System\OquvMje.exe
  2⤵
  PID:564
- C:\Windows\System\oRmYtfW.exe
  C:\Windows\System\oRmYtfW.exe
  2⤵
  PID:1924
- C:\Windows\System\ZWbvryd.exe
  C:\Windows\System\ZWbvryd.exe
  2⤵
  PID:2356
- C:\Windows\System\aRIuKfv.exe
  C:\Windows\System\aRIuKfv.exe
  2⤵
  PID:1976
- C:\Windows\System\IylzinX.exe
  C:\Windows\System\IylzinX.exe
  2⤵
  PID:2772
- C:\Windows\System\WjyhGcY.exe
  C:\Windows\System\WjyhGcY.exe
  2⤵
  PID:1368
- C:\Windows\System\CLdPjWw.exe
  C:\Windows\System\CLdPjWw.exe
  2⤵
  PID:2524
- C:\Windows\System\KgAwNjG.exe
  C:\Windows\System\KgAwNjG.exe
  2⤵
  PID:2136
- C:\Windows\System\AmSfsWL.exe
  C:\Windows\System\AmSfsWL.exe
  2⤵
  PID:2204
- C:\Windows\System\HjkMUtz.exe
  C:\Windows\System\HjkMUtz.exe
  2⤵
  PID:1688
- C:\Windows\System\dPvyltB.exe
  C:\Windows\System\dPvyltB.exe
  2⤵
  PID:1284
- C:\Windows\System\dKmtWaK.exe
  C:\Windows\System\dKmtWaK.exe
  2⤵
  PID:1952
- C:\Windows\System\cpKdCLJ.exe
  C:\Windows\System\cpKdCLJ.exe
  2⤵
  PID:1032
- C:\Windows\System\nlYobZA.exe
  C:\Windows\System\nlYobZA.exe
  2⤵
  PID:1320
- C:\Windows\System\SiWzeEE.exe
  C:\Windows\System\SiWzeEE.exe
  2⤵
  PID:2584
- C:\Windows\System\TgFkIMY.exe
  C:\Windows\System\TgFkIMY.exe
  2⤵
  PID:3084
- C:\Windows\System\otFKBVd.exe
  C:\Windows\System\otFKBVd.exe
  2⤵
  PID:3100
- C:\Windows\System\QkcDkvj.exe
  C:\Windows\System\QkcDkvj.exe
  2⤵
  PID:3116
- C:\Windows\System\NVGCzmk.exe
  C:\Windows\System\NVGCzmk.exe
  2⤵
  PID:3132
- C:\Windows\System\SNppUPp.exe
  C:\Windows\System\SNppUPp.exe
  2⤵
  PID:3152
- C:\Windows\System\vfzcMVv.exe
  C:\Windows\System\vfzcMVv.exe
  2⤵
  PID:3168
- C:\Windows\System\tgmltYA.exe
  C:\Windows\System\tgmltYA.exe
  2⤵
  PID:3216
- C:\Windows\System\EPVnXzK.exe
  C:\Windows\System\EPVnXzK.exe
  2⤵
  PID:3236
- C:\Windows\System\YRyvcAu.exe
  C:\Windows\System\YRyvcAu.exe
  2⤵
  PID:3256
- C:\Windows\System\XjPYCco.exe
  C:\Windows\System\XjPYCco.exe
  2⤵
  PID:3272
- C:\Windows\System\fBcFkPr.exe
  C:\Windows\System\fBcFkPr.exe
  2⤵
  PID:3288
- C:\Windows\System\WxDbWcf.exe
  C:\Windows\System\WxDbWcf.exe
  2⤵
  PID:3308
- C:\Windows\System\FFNNxwl.exe
  C:\Windows\System\FFNNxwl.exe
  2⤵
  PID:3324
- C:\Windows\System\zbXjdOX.exe
  C:\Windows\System\zbXjdOX.exe
  2⤵
  PID:3340
- C:\Windows\System\NlNBwkV.exe
  C:\Windows\System\NlNBwkV.exe
  2⤵
  PID:3356
- C:\Windows\System\QvaPTTz.exe
  C:\Windows\System\QvaPTTz.exe
  2⤵
  PID:3372
- C:\Windows\System\vVFGthI.exe
  C:\Windows\System\vVFGthI.exe
  2⤵
  PID:3388
- C:\Windows\System\kSmdqXf.exe
  C:\Windows\System\kSmdqXf.exe
  2⤵
  PID:3404
- C:\Windows\System\feqvlMI.exe
  C:\Windows\System\feqvlMI.exe
  2⤵
  PID:3420
- C:\Windows\System\FWeInio.exe
  C:\Windows\System\FWeInio.exe
  2⤵
  PID:3436
- C:\Windows\System\FMNWrXt.exe
  C:\Windows\System\FMNWrXt.exe
  2⤵
  PID:3456
- C:\Windows\System\hgzGrUQ.exe
  C:\Windows\System\hgzGrUQ.exe
  2⤵
  PID:3472
- C:\Windows\System\MFXeFLY.exe
  C:\Windows\System\MFXeFLY.exe
  2⤵
  PID:3488
- C:\Windows\System\JfDExCw.exe
  C:\Windows\System\JfDExCw.exe
  2⤵
  PID:3504
- C:\Windows\System\UkcGaGF.exe
  C:\Windows\System\UkcGaGF.exe
  2⤵
  PID:3520
- C:\Windows\System\CMelNGU.exe
  C:\Windows\System\CMelNGU.exe
  2⤵
  PID:3536
- C:\Windows\System\wDkTUvf.exe
  C:\Windows\System\wDkTUvf.exe
  2⤵
  PID:3552
- C:\Windows\System\ENVqiEc.exe
  C:\Windows\System\ENVqiEc.exe
  2⤵
  PID:3572
- C:\Windows\System\JkCWugv.exe
  C:\Windows\System\JkCWugv.exe
  2⤵
  PID:3588
- C:\Windows\System\wXidKIn.exe
  C:\Windows\System\wXidKIn.exe
  2⤵
  PID:3604
- C:\Windows\System\EXJgYlL.exe
  C:\Windows\System\EXJgYlL.exe
  2⤵
  PID:3620
- C:\Windows\System\bDCYpOz.exe
  C:\Windows\System\bDCYpOz.exe
  2⤵
  PID:3636
- C:\Windows\System\YtaVdgP.exe
  C:\Windows\System\YtaVdgP.exe
  2⤵
  PID:3656
- C:\Windows\System\cKvlEUT.exe
  C:\Windows\System\cKvlEUT.exe
  2⤵
  PID:3672
- C:\Windows\System\jrVFmLa.exe
  C:\Windows\System\jrVFmLa.exe
  2⤵
  PID:3688
- C:\Windows\System\gfNddJH.exe
  C:\Windows\System\gfNddJH.exe
  2⤵
  PID:3704
- C:\Windows\System\iIOZUMw.exe
  C:\Windows\System\iIOZUMw.exe
  2⤵
  PID:3720
- C:\Windows\System\eoIqolP.exe
  C:\Windows\System\eoIqolP.exe
  2⤵
  PID:3736
- C:\Windows\System\uUkzBVd.exe
  C:\Windows\System\uUkzBVd.exe
  2⤵
  PID:3752
- C:\Windows\System\JPZoOLc.exe
  C:\Windows\System\JPZoOLc.exe
  2⤵
  PID:3768
- C:\Windows\System\gNssaNI.exe
  C:\Windows\System\gNssaNI.exe
  2⤵
  PID:3784
- C:\Windows\System\bYNWLVC.exe
  C:\Windows\System\bYNWLVC.exe
  2⤵
  PID:3800
- C:\Windows\System\RWCqLfx.exe
  C:\Windows\System\RWCqLfx.exe
  2⤵
  PID:3816
- C:\Windows\System\plsMPDG.exe
  C:\Windows\System\plsMPDG.exe
  2⤵
  PID:3832
- C:\Windows\System\GIFPoBC.exe
  C:\Windows\System\GIFPoBC.exe
  2⤵
  PID:3848
- C:\Windows\System\IfwTkay.exe
  C:\Windows\System\IfwTkay.exe
  2⤵
  PID:3864
- C:\Windows\System\SwdOITU.exe
  C:\Windows\System\SwdOITU.exe
  2⤵
  PID:3880
- C:\Windows\System\WDBbUOl.exe
  C:\Windows\System\WDBbUOl.exe
  2⤵
  PID:3900
- C:\Windows\System\MxaiAOA.exe
  C:\Windows\System\MxaiAOA.exe
  2⤵
  PID:3916
- C:\Windows\System\bFGaKln.exe
  C:\Windows\System\bFGaKln.exe
  2⤵
  PID:3932
- C:\Windows\System\AQZvjth.exe
  C:\Windows\System\AQZvjth.exe
  2⤵
  PID:3948
- C:\Windows\System\TfZSyvy.exe
  C:\Windows\System\TfZSyvy.exe
  2⤵
  PID:3964
- C:\Windows\System\nzJVhxv.exe
  C:\Windows\System\nzJVhxv.exe
  2⤵
  PID:3980
- C:\Windows\System\orbxJxN.exe
  C:\Windows\System\orbxJxN.exe
  2⤵
  PID:3996
- C:\Windows\System\rGMSGHQ.exe
  C:\Windows\System\rGMSGHQ.exe
  2⤵
  PID:4016
- C:\Windows\System\IuqIrCr.exe
  C:\Windows\System\IuqIrCr.exe
  2⤵
  PID:4032
- C:\Windows\System\OHwJkuy.exe
  C:\Windows\System\OHwJkuy.exe
  2⤵
  PID:3248
- C:\Windows\System\SVjLJJJ.exe
  C:\Windows\System\SVjLJJJ.exe
  2⤵
  PID:3364
- C:\Windows\System\FyIUHCc.exe
  C:\Windows\System\FyIUHCc.exe
  2⤵
  PID:3284
- C:\Windows\System\hDqjcie.exe
  C:\Windows\System\hDqjcie.exe
  2⤵
  PID:3596
- C:\Windows\System\ZBYIreT.exe
  C:\Windows\System\ZBYIreT.exe
  2⤵
  PID:3664
- C:\Windows\System\TaSOhul.exe
  C:\Windows\System\TaSOhul.exe
  2⤵
  PID:3760
- C:\Windows\System\EUOXxgH.exe
  C:\Windows\System\EUOXxgH.exe
  2⤵
  PID:3796
- C:\Windows\System\sAcGoZE.exe
  C:\Windows\System\sAcGoZE.exe
  2⤵
  PID:3888
- C:\Windows\System\TsLZBdW.exe
  C:\Windows\System\TsLZBdW.exe
  2⤵
  PID:3928
- C:\Windows\System\ksGNyeG.exe
  C:\Windows\System\ksGNyeG.exe
  2⤵
  PID:3380
- C:\Windows\System\CxQAVCf.exe
  C:\Windows\System\CxQAVCf.exe
  2⤵
  PID:3416
- C:\Windows\System\gzahXqz.exe
  C:\Windows\System\gzahXqz.exe
  2⤵
  PID:3516
- C:\Windows\System\rAoWwVc.exe
  C:\Windows\System\rAoWwVc.exe
  2⤵
  PID:3612
- C:\Windows\System\hqdftmJ.exe
  C:\Windows\System\hqdftmJ.exe
  2⤵
  PID:3808
- C:\Windows\System\lsvrsqw.exe
  C:\Windows\System\lsvrsqw.exe
  2⤵
  PID:3912
- C:\Windows\System\ZzItseH.exe
  C:\Windows\System\ZzItseH.exe
  2⤵
  PID:3976
- C:\Windows\System\vrKiHRS.exe
  C:\Windows\System\vrKiHRS.exe
  2⤵
  PID:4040
- C:\Windows\System\IbNGumj.exe
  C:\Windows\System\IbNGumj.exe
  2⤵
  PID:4064
- C:\Windows\System\tIRFTFa.exe
  C:\Windows\System\tIRFTFa.exe
  2⤵
  PID:4088
- C:\Windows\System\OEDQpnu.exe
  C:\Windows\System\OEDQpnu.exe
  2⤵
  PID:3076
- C:\Windows\System\hIYVGcb.exe
  C:\Windows\System\hIYVGcb.exe
  2⤵
  PID:2308
- C:\Windows\System\JirSABj.exe
  C:\Windows\System\JirSABj.exe
  2⤵
  PID:3176
- C:\Windows\System\pRPlSPG.exe
  C:\Windows\System\pRPlSPG.exe
  2⤵
  PID:3828
- C:\Windows\System\duMaEHH.exe
  C:\Windows\System\duMaEHH.exe
  2⤵
  PID:2132
- C:\Windows\System\heSmcaC.exe
  C:\Windows\System\heSmcaC.exe
  2⤵
  PID:3196
- C:\Windows\System\pvtaIEz.exe
  C:\Windows\System\pvtaIEz.exe
  2⤵
  PID:3992
- C:\Windows\System\mbkBcWn.exe
  C:\Windows\System\mbkBcWn.exe
  2⤵
  PID:3956
- C:\Windows\System\YyXOvDY.exe
  C:\Windows\System\YyXOvDY.exe
  2⤵
  PID:3496
- C:\Windows\System\FMwAmQU.exe
  C:\Windows\System\FMwAmQU.exe
  2⤵
  PID:3264
- C:\Windows\System\XXCFkcM.exe
  C:\Windows\System\XXCFkcM.exe
  2⤵
  PID:3304
- C:\Windows\System\MDvGBBD.exe
  C:\Windows\System\MDvGBBD.exe
  2⤵
  PID:3396
- C:\Windows\System\EiIivDA.exe
  C:\Windows\System\EiIivDA.exe
  2⤵
  PID:3300
- C:\Windows\System\JeiruJU.exe
  C:\Windows\System\JeiruJU.exe
  2⤵
  PID:3896
- C:\Windows\System\VvjGkCm.exe
  C:\Windows\System\VvjGkCm.exe
  2⤵
  PID:3352
- C:\Windows\System\IopwdZF.exe
  C:\Windows\System\IopwdZF.exe
  2⤵
  PID:3568
- C:\Windows\System\XuNxUev.exe
  C:\Windows\System\XuNxUev.exe
  2⤵
  PID:3680
- C:\Windows\System\aLrRpdQ.exe
  C:\Windows\System\aLrRpdQ.exe
  2⤵
  PID:3748
- C:\Windows\System\rHdJvHi.exe
  C:\Windows\System\rHdJvHi.exe
  2⤵
  PID:3872
- C:\Windows\System\mpnrQuk.exe
  C:\Windows\System\mpnrQuk.exe
  2⤵
  PID:4008
- C:\Windows\System\MzyRgaS.exe
  C:\Windows\System\MzyRgaS.exe
  2⤵
  PID:4056
- C:\Windows\System\KZxsdTf.exe
  C:\Windows\System\KZxsdTf.exe
  2⤵
  PID:876
- C:\Windows\System\ovxqxTn.exe
  C:\Windows\System\ovxqxTn.exe
  2⤵
  PID:2616
- C:\Windows\System\SLEmdmu.exe
  C:\Windows\System\SLEmdmu.exe
  2⤵
  PID:3124
- C:\Windows\System\YQsUzlG.exe
  C:\Windows\System\YQsUzlG.exe
  2⤵
  PID:3112
- C:\Windows\System\TlvZVJV.exe
  C:\Windows\System\TlvZVJV.exe
  2⤵
  PID:3148
- C:\Windows\System\LInrBov.exe
  C:\Windows\System\LInrBov.exe
  2⤵
  PID:3960
- C:\Windows\System\RdcQoSY.exe
  C:\Windows\System\RdcQoSY.exe
  2⤵
  PID:3528
- C:\Windows\System\gLHvtsy.exe
  C:\Windows\System\gLHvtsy.exe
  2⤵
  PID:1400
- C:\Windows\System\ouHjKZo.exe
  C:\Windows\System\ouHjKZo.exe
  2⤵
  PID:1580
- C:\Windows\System\SobwWQm.exe
  C:\Windows\System\SobwWQm.exe
  2⤵
  PID:816
- C:\Windows\System\FGwzRjp.exe
  C:\Windows\System\FGwzRjp.exe
  2⤵
  PID:3412
- C:\Windows\System\PeJHKgn.exe
  C:\Windows\System\PeJHKgn.exe
  2⤵
  PID:3856
- C:\Windows\System\vgrbIVF.exe
  C:\Windows\System\vgrbIVF.exe
  2⤵
  PID:3580
- C:\Windows\System\OVXuRyO.exe
  C:\Windows\System\OVXuRyO.exe
  2⤵
  PID:3712
- C:\Windows\System\IcIXMnS.exe
  C:\Windows\System\IcIXMnS.exe
  2⤵
  PID:3840
- C:\Windows\System\JMJIOhg.exe
  C:\Windows\System\JMJIOhg.exe
  2⤵
  PID:3144
- C:\Windows\System\QMoeXFn.exe
  C:\Windows\System\QMoeXFn.exe
  2⤵
  PID:2708
- C:\Windows\System\Qoeiphm.exe
  C:\Windows\System\Qoeiphm.exe
  2⤵
  PID:2764
- C:\Windows\System\bcWxzzk.exe
  C:\Windows\System\bcWxzzk.exe
  2⤵
  PID:1988
- C:\Windows\System\OLAIDbO.exe
  C:\Windows\System\OLAIDbO.exe
  2⤵
  PID:1912
- C:\Windows\System\CgKWJJJ.exe
  C:\Windows\System\CgKWJJJ.exe
  2⤵
  PID:3044
- C:\Windows\System\QvXxOmC.exe
  C:\Windows\System\QvXxOmC.exe
  2⤵
  PID:3468
- C:\Windows\System\XitNipt.exe
  C:\Windows\System\XitNipt.exe
  2⤵
  PID:2800
- C:\Windows\System\xBHKMgr.exe
  C:\Windows\System\xBHKMgr.exe
  2⤵
  PID:3180
- C:\Windows\System\nABpRSR.exe
  C:\Windows\System\nABpRSR.exe
  2⤵
  PID:1784
- C:\Windows\System\OsEJimY.exe
  C:\Windows\System\OsEJimY.exe
  2⤵
  PID:3744
- C:\Windows\System\nXujEak.exe
  C:\Windows\System\nXujEak.exe
  2⤵
  PID:3908
- C:\Windows\System\SZWARCn.exe
  C:\Windows\System\SZWARCn.exe
  2⤵
  PID:1388
- C:\Windows\System\QDNEcVR.exe
  C:\Windows\System\QDNEcVR.exe
  2⤵
  PID:3160
- C:\Windows\System\GFnKfcc.exe
  C:\Windows\System\GFnKfcc.exe
  2⤵
  PID:2300
- C:\Windows\System\vLjznOU.exe
  C:\Windows\System\vLjznOU.exe
  2⤵
  PID:2968
- C:\Windows\System\kLNqwwK.exe
  C:\Windows\System\kLNqwwK.exe
  2⤵
  PID:3564
- C:\Windows\System\EKPOFes.exe
  C:\Windows\System\EKPOFes.exe
  2⤵
  PID:3544
- C:\Windows\System\zbWZEct.exe
  C:\Windows\System\zbWZEct.exe
  2⤵
  PID:3860
- C:\Windows\System\RYFQVxP.exe
  C:\Windows\System\RYFQVxP.exe
  2⤵
  PID:2184
- C:\Windows\System\IAgvWey.exe
  C:\Windows\System\IAgvWey.exe
  2⤵
  PID:4072
- C:\Windows\System\zMPFFVY.exe
  C:\Windows\System\zMPFFVY.exe
  2⤵
  PID:2528
- C:\Windows\System\nTNKEgC.exe
  C:\Windows\System\nTNKEgC.exe
  2⤵
  PID:2804
- C:\Windows\System\oUpWUKx.exe
  C:\Windows\System\oUpWUKx.exe
  2⤵
  PID:1536
- C:\Windows\System\FnZYFoB.exe
  C:\Windows\System\FnZYFoB.exe
  2⤵
  PID:1752
- C:\Windows\System\bbERoVi.exe
  C:\Windows\System\bbERoVi.exe
  2⤵
  PID:3548
- C:\Windows\System\QzXxwjU.exe
  C:\Windows\System\QzXxwjU.exe
  2⤵
  PID:3140
- C:\Windows\System\jRcfBYw.exe
  C:\Windows\System\jRcfBYw.exe
  2⤵
  PID:2692
- C:\Windows\System\zCIcLNx.exe
  C:\Windows\System\zCIcLNx.exe
  2⤵
  PID:2908
- C:\Windows\System\EkimYSD.exe
  C:\Windows\System\EkimYSD.exe
  2⤵
  PID:2948
- C:\Windows\System\bIVBORf.exe
  C:\Windows\System\bIVBORf.exe
  2⤵
  PID:3628
- C:\Windows\System\TlqeMkw.exe
  C:\Windows\System\TlqeMkw.exe
  2⤵
  PID:4100
- C:\Windows\System\kBxWDoJ.exe
  C:\Windows\System\kBxWDoJ.exe
  2⤵
  PID:4116
- C:\Windows\System\IuRsGYk.exe
  C:\Windows\System\IuRsGYk.exe
  2⤵
  PID:4132
- C:\Windows\System\YVzpDLg.exe
  C:\Windows\System\YVzpDLg.exe
  2⤵
  PID:4148
- C:\Windows\System\CWbOZcm.exe
  C:\Windows\System\CWbOZcm.exe
  2⤵
  PID:4168
- C:\Windows\System\ndZHGYU.exe
  C:\Windows\System\ndZHGYU.exe
  2⤵
  PID:4184
- C:\Windows\System\IzjnObR.exe
  C:\Windows\System\IzjnObR.exe
  2⤵
  PID:4200
- C:\Windows\System\qrLPpor.exe
  C:\Windows\System\qrLPpor.exe
  2⤵
  PID:4216
- C:\Windows\System\nFzkqiq.exe
  C:\Windows\System\nFzkqiq.exe
  2⤵
  PID:4280
- C:\Windows\System\iKloOCV.exe
  C:\Windows\System\iKloOCV.exe
  2⤵
  PID:4296
- C:\Windows\System\mmGqZtD.exe
  C:\Windows\System\mmGqZtD.exe
  2⤵
  PID:4312
- C:\Windows\System\bagNvUf.exe
  C:\Windows\System\bagNvUf.exe
  2⤵
  PID:4328
- C:\Windows\System\ZeDtWYP.exe
  C:\Windows\System\ZeDtWYP.exe
  2⤵
  PID:4348
- C:\Windows\System\SlFjwdW.exe
  C:\Windows\System\SlFjwdW.exe
  2⤵
  PID:4368
- C:\Windows\System\PKUFlNP.exe
  C:\Windows\System\PKUFlNP.exe
  2⤵
  PID:4404
- C:\Windows\System\PxdVetp.exe
  C:\Windows\System\PxdVetp.exe
  2⤵
  PID:4420
- C:\Windows\System\WwIXAoB.exe
  C:\Windows\System\WwIXAoB.exe
  2⤵
  PID:4436
- C:\Windows\System\AEpTDoG.exe
  C:\Windows\System\AEpTDoG.exe
  2⤵
  PID:4452
- C:\Windows\System\NYleALa.exe
  C:\Windows\System\NYleALa.exe
  2⤵
  PID:4468
- C:\Windows\System\aZHdcZJ.exe
  C:\Windows\System\aZHdcZJ.exe
  2⤵
  PID:4484
- C:\Windows\System\ZcQuWFm.exe
  C:\Windows\System\ZcQuWFm.exe
  2⤵
  PID:4500
- C:\Windows\System\lDVWTpZ.exe
  C:\Windows\System\lDVWTpZ.exe
  2⤵
  PID:4516
- C:\Windows\System\WvAiqRg.exe
  C:\Windows\System\WvAiqRg.exe
  2⤵
  PID:4532
- C:\Windows\System\vKXPUsy.exe
  C:\Windows\System\vKXPUsy.exe
  2⤵
  PID:4548
- C:\Windows\System\nsbNYlE.exe
  C:\Windows\System\nsbNYlE.exe
  2⤵
  PID:4568
- C:\Windows\System\pHECwGo.exe
  C:\Windows\System\pHECwGo.exe
  2⤵
  PID:4584
- C:\Windows\System\QtrVIWk.exe
  C:\Windows\System\QtrVIWk.exe
  2⤵
  PID:4600
- C:\Windows\System\rVlgCSI.exe
  C:\Windows\System\rVlgCSI.exe
  2⤵
  PID:4616
- C:\Windows\System\KQMECfZ.exe
  C:\Windows\System\KQMECfZ.exe
  2⤵
  PID:4632
- C:\Windows\System\TVbMLYv.exe
  C:\Windows\System\TVbMLYv.exe
  2⤵
  PID:4648
- C:\Windows\System\TEllEVp.exe
  C:\Windows\System\TEllEVp.exe
  2⤵
  PID:4664
- C:\Windows\System\paAgARC.exe
  C:\Windows\System\paAgARC.exe
  2⤵
  PID:4680
- C:\Windows\System\zkpkhRp.exe
  C:\Windows\System\zkpkhRp.exe
  2⤵
  PID:4704
- C:\Windows\System\glwTxlp.exe
  C:\Windows\System\glwTxlp.exe
  2⤵
  PID:4720
- C:\Windows\System\hskzkZb.exe
  C:\Windows\System\hskzkZb.exe
  2⤵
  PID:4836
- C:\Windows\System\XsGrove.exe
  C:\Windows\System\XsGrove.exe
  2⤵
  PID:4852
- C:\Windows\System\AScJatz.exe
  C:\Windows\System\AScJatz.exe
  2⤵
  PID:4872
- C:\Windows\System\alNxPwW.exe
  C:\Windows\System\alNxPwW.exe
  2⤵
  PID:4888
- C:\Windows\System\wCbTGrA.exe
  C:\Windows\System\wCbTGrA.exe
  2⤵
  PID:4908
- C:\Windows\System\dwJlNYn.exe
  C:\Windows\System\dwJlNYn.exe
  2⤵
  PID:4928
- C:\Windows\System\OfHhAlH.exe
  C:\Windows\System\OfHhAlH.exe
  2⤵
  PID:4944
- C:\Windows\System\sYgJqEW.exe
  C:\Windows\System\sYgJqEW.exe
  2⤵
  PID:4960
- C:\Windows\System\McoMdaD.exe
  C:\Windows\System\McoMdaD.exe
  2⤵
  PID:4980
- C:\Windows\System\ZAosPxx.exe
  C:\Windows\System\ZAosPxx.exe
  2⤵
  PID:4996
- C:\Windows\System\FTRJDrE.exe
  C:\Windows\System\FTRJDrE.exe
  2⤵
  PID:5016
- C:\Windows\System\PFjHhvf.exe
  C:\Windows\System\PFjHhvf.exe
  2⤵
  PID:5036
- C:\Windows\System\yKmhTBV.exe
  C:\Windows\System\yKmhTBV.exe
  2⤵
  PID:5052
- C:\Windows\System\GWiCYbW.exe
  C:\Windows\System\GWiCYbW.exe
  2⤵
  PID:5072
- C:\Windows\System\kSksVJj.exe
  C:\Windows\System\kSksVJj.exe
  2⤵
  PID:5088
- C:\Windows\System\fHCHnhV.exe
  C:\Windows\System\fHCHnhV.exe
  2⤵
  PID:5104
- C:\Windows\System\ZuIujkZ.exe
  C:\Windows\System\ZuIujkZ.exe
  2⤵
  PID:3844
- C:\Windows\System\dbeinZO.exe
  C:\Windows\System\dbeinZO.exe
  2⤵
  PID:2428
- C:\Windows\System\BFcMoQD.exe
  C:\Windows\System\BFcMoQD.exe
  2⤵
  PID:4192
- C:\Windows\System\hiotEOV.exe
  C:\Windows\System\hiotEOV.exe
  2⤵
  PID:4208
- C:\Windows\System\aTeFfEC.exe
  C:\Windows\System\aTeFfEC.exe
  2⤵
  PID:4108
- C:\Windows\System\rGyLyGz.exe
  C:\Windows\System\rGyLyGz.exe
  2⤵
  PID:2980
- C:\Windows\System\tAyyhIs.exe
  C:\Windows\System\tAyyhIs.exe
  2⤵
  PID:4244
- C:\Windows\System\UTbtazU.exe
  C:\Windows\System\UTbtazU.exe
  2⤵
  PID:4260
- C:\Windows\System\TFHHLCF.exe
  C:\Windows\System\TFHHLCF.exe
  2⤵
  PID:2500
- C:\Windows\System\TQtJWua.exe
  C:\Windows\System\TQtJWua.exe
  2⤵
  PID:4304
- C:\Windows\System\CwJptOx.exe
  C:\Windows\System\CwJptOx.exe
  2⤵
  PID:4344
- C:\Windows\System\hyPLfAn.exe
  C:\Windows\System\hyPLfAn.exe
  2⤵
  PID:4360
- C:\Windows\System\ZksFDGc.exe
  C:\Windows\System\ZksFDGc.exe
  2⤵
  PID:4392
- C:\Windows\System\aYZPKgn.exe
  C:\Windows\System\aYZPKgn.exe
  2⤵
  PID:3648
- C:\Windows\System\oNfwfnQ.exe
  C:\Windows\System\oNfwfnQ.exe
  2⤵
  PID:4428
- C:\Windows\System\iwqrGAR.exe
  C:\Windows\System\iwqrGAR.exe
  2⤵
  PID:4476
- C:\Windows\System\vvmmLxF.exe
  C:\Windows\System\vvmmLxF.exe
  2⤵
  PID:4540
- C:\Windows\System\zGckHsX.exe
  C:\Windows\System\zGckHsX.exe
  2⤵
  PID:4612
- C:\Windows\System\zQUySeM.exe
  C:\Windows\System\zQUySeM.exe
  2⤵
  PID:4696
- C:\Windows\System\zyFEPBE.exe
  C:\Windows\System\zyFEPBE.exe
  2⤵
  PID:4556
- C:\Windows\System\JnVPvsj.exe
  C:\Windows\System\JnVPvsj.exe
  2⤵
  PID:4624
- C:\Windows\System\xylgUQW.exe
  C:\Windows\System\xylgUQW.exe
  2⤵
  PID:4672
- C:\Windows\System\NzVWntA.exe
  C:\Windows\System\NzVWntA.exe
  2⤵
  PID:4644
- C:\Windows\System\GdlkmjQ.exe
  C:\Windows\System\GdlkmjQ.exe
  2⤵
  PID:4732
- C:\Windows\System\TdXJGIx.exe
  C:\Windows\System\TdXJGIx.exe
  2⤵
  PID:4736
- C:\Windows\System\bZkUPot.exe
  C:\Windows\System\bZkUPot.exe
  2⤵
  PID:4760
- C:\Windows\System\qyrQxrR.exe
  C:\Windows\System\qyrQxrR.exe
  2⤵
  PID:4776
- C:\Windows\System\qikUkss.exe
  C:\Windows\System\qikUkss.exe
  2⤵
  PID:4792
- C:\Windows\System\GVZTaKw.exe
  C:\Windows\System\GVZTaKw.exe
  2⤵
  PID:4800
- C:\Windows\System\XRzUkcE.exe
  C:\Windows\System\XRzUkcE.exe
  2⤵
  PID:4824
- C:\Windows\System\JjQJpFp.exe
  C:\Windows\System\JjQJpFp.exe
  2⤵
  PID:4884
- C:\Windows\System\iysrHRM.exe
  C:\Windows\System\iysrHRM.exe
  2⤵
  PID:4956
- C:\Windows\System\MKzYduB.exe
  C:\Windows\System\MKzYduB.exe
  2⤵
  PID:5024
- C:\Windows\System\vGNlbVo.exe
  C:\Windows\System\vGNlbVo.exe
  2⤵
  PID:5064
- C:\Windows\System\FIVRCVZ.exe
  C:\Windows\System\FIVRCVZ.exe
  2⤵
  PID:1480
- C:\Windows\System\WUQMqdX.exe
  C:\Windows\System\WUQMqdX.exe
  2⤵
  PID:4196
- C:\Windows\System\wRcBorJ.exe
  C:\Windows\System\wRcBorJ.exe
  2⤵
  PID:4256
- C:\Windows\System\teJyRwB.exe
  C:\Windows\System\teJyRwB.exe
  2⤵
  PID:4868
- C:\Windows\System\XuyARuO.exe
  C:\Windows\System\XuyARuO.exe
  2⤵
  PID:5112
- C:\Windows\System\Fkhncrd.exe
  C:\Windows\System\Fkhncrd.exe
  2⤵
  PID:4904
- C:\Windows\System\latXFab.exe
  C:\Windows\System\latXFab.exe
  2⤵
  PID:4968
- C:\Windows\System\PFiZeSH.exe
  C:\Windows\System\PFiZeSH.exe
  2⤵
  PID:5044
- C:\Windows\System\rgFrmEN.exe
  C:\Windows\System\rgFrmEN.exe
  2⤵
  PID:4444
- C:\Windows\System\qWztzBA.exe
  C:\Windows\System\qWztzBA.exe
  2⤵
  PID:4492
- C:\Windows\System\REWQdSz.exe
  C:\Windows\System\REWQdSz.exe
  2⤵
  PID:4464
- C:\Windows\System\sNGiJNh.exe
  C:\Windows\System\sNGiJNh.exe
  2⤵
  PID:4640
- C:\Windows\System\SgXnGeK.exe
  C:\Windows\System\SgXnGeK.exe
  2⤵
  PID:4740
- C:\Windows\System\duzvEwM.exe
  C:\Windows\System\duzvEwM.exe
  2⤵
  PID:4112
- C:\Windows\System\XnpyoES.exe
  C:\Windows\System\XnpyoES.exe
  2⤵
  PID:4272
- C:\Windows\System\UUyREPo.exe
  C:\Windows\System\UUyREPo.exe
  2⤵
  PID:4388
- C:\Windows\System\lvYxEYF.exe
  C:\Windows\System\lvYxEYF.exe
  2⤵
  PID:4508
- C:\Windows\System\aRkdyZN.exe
  C:\Windows\System\aRkdyZN.exe
  2⤵
  PID:4564
- C:\Windows\System\cfPuvvx.exe
  C:\Windows\System\cfPuvvx.exe
  2⤵
  PID:4712
- C:\Windows\System\KYUAPOE.exe
  C:\Windows\System\KYUAPOE.exe
  2⤵
  PID:4772
- C:\Windows\System\vXDXiqc.exe
  C:\Windows\System\vXDXiqc.exe
  2⤵
  PID:4880
- C:\Windows\System\ZIYlMaV.exe
  C:\Windows\System\ZIYlMaV.exe
  2⤵
  PID:4952
- C:\Windows\System\eKcWABt.exe
  C:\Windows\System\eKcWABt.exe
  2⤵
  PID:4160
- C:\Windows\System\rrgQOeI.exe
  C:\Windows\System\rrgQOeI.exe
  2⤵
  PID:4176
- C:\Windows\System\ZcmaOHj.exe
  C:\Windows\System\ZcmaOHj.exe
  2⤵
  PID:5008
- C:\Windows\System\VMnyswz.exe
  C:\Windows\System\VMnyswz.exe
  2⤵
  PID:4860
- C:\Windows\System\KBuDioy.exe
  C:\Windows\System\KBuDioy.exe
  2⤵
  PID:2296
- C:\Windows\System\mtnsfNh.exe
  C:\Windows\System\mtnsfNh.exe
  2⤵
  PID:4212
- C:\Windows\System\IJsGRjL.exe
  C:\Windows\System\IJsGRjL.exe
  2⤵
  PID:2200
- C:\Windows\System\VyvhQUu.exe
  C:\Windows\System\VyvhQUu.exe
  2⤵
  PID:4268
- C:\Windows\System\LQPFrtm.exe
  C:\Windows\System\LQPFrtm.exe
  2⤵
  PID:4788
- C:\Windows\System\pjptiwQ.exe
  C:\Windows\System\pjptiwQ.exe
  2⤵
  PID:4796
- C:\Windows\System\VkwDhgG.exe
  C:\Windows\System\VkwDhgG.exe
  2⤵
  PID:4832
- C:\Windows\System\yqVmsGj.exe
  C:\Windows\System\yqVmsGj.exe
  2⤵
  PID:5084
- C:\Windows\System\zLcylZx.exe
  C:\Windows\System\zLcylZx.exe
  2⤵
  PID:5136
- C:\Windows\System\eYwcbYH.exe
  C:\Windows\System\eYwcbYH.exe
  2⤵
  PID:5156
- C:\Windows\System\hYLYawd.exe
  C:\Windows\System\hYLYawd.exe
  2⤵
  PID:5172
- C:\Windows\System\NIQyxZG.exe
  C:\Windows\System\NIQyxZG.exe
  2⤵
  PID:5188
- C:\Windows\System\YhUoWbQ.exe
  C:\Windows\System\YhUoWbQ.exe
  2⤵
  PID:5204
- C:\Windows\System\ggSvkPK.exe
  C:\Windows\System\ggSvkPK.exe
  2⤵
  PID:5220
- C:\Windows\System\NpHCgVb.exe
  C:\Windows\System\NpHCgVb.exe
  2⤵
  PID:5236
- C:\Windows\System\bcAOnzd.exe
  C:\Windows\System\bcAOnzd.exe
  2⤵
  PID:5252
- C:\Windows\System\lwdsWAP.exe
  C:\Windows\System\lwdsWAP.exe
  2⤵
  PID:5356
- C:\Windows\System\ytqBtIq.exe
  C:\Windows\System\ytqBtIq.exe
  2⤵
  PID:5376
- C:\Windows\System\AlVAilC.exe
  C:\Windows\System\AlVAilC.exe
  2⤵
  PID:5392
- C:\Windows\System\mvLaZeS.exe
  C:\Windows\System\mvLaZeS.exe
  2⤵
  PID:5408
- C:\Windows\System\nXcKafW.exe
  C:\Windows\System\nXcKafW.exe
  2⤵
  PID:5424
- C:\Windows\System\sgedfYo.exe
  C:\Windows\System\sgedfYo.exe
  2⤵
  PID:5440
- C:\Windows\System\ADPqlBK.exe
  C:\Windows\System\ADPqlBK.exe
  2⤵
  PID:5456
- C:\Windows\System\YtXfrSj.exe
  C:\Windows\System\YtXfrSj.exe
  2⤵
  PID:5472
- C:\Windows\System\dvwxNrb.exe
  C:\Windows\System\dvwxNrb.exe
  2⤵
  PID:5488
- C:\Windows\System\prtcJEg.exe
  C:\Windows\System\prtcJEg.exe
  2⤵
  PID:5504
- C:\Windows\System\qRgeyND.exe
  C:\Windows\System\qRgeyND.exe
  2⤵
  PID:5520
- C:\Windows\System\VNRMGSl.exe
  C:\Windows\System\VNRMGSl.exe
  2⤵
  PID:5536
- C:\Windows\System\aOzHaoL.exe
  C:\Windows\System\aOzHaoL.exe
  2⤵
  PID:5552
- C:\Windows\System\OFMtEXc.exe
  C:\Windows\System\OFMtEXc.exe
  2⤵
  PID:5568
- C:\Windows\System\TlxbyBO.exe
  C:\Windows\System\TlxbyBO.exe
  2⤵
  PID:5584
- C:\Windows\System\SqIImnG.exe
  C:\Windows\System\SqIImnG.exe
  2⤵
  PID:5616
- C:\Windows\System\bYZevKS.exe
  C:\Windows\System\bYZevKS.exe
  2⤵
  PID:5632
- C:\Windows\System\EnDiMfC.exe
  C:\Windows\System\EnDiMfC.exe
  2⤵
  PID:5648
- C:\Windows\System\mGkzDgu.exe
  C:\Windows\System\mGkzDgu.exe
  2⤵
  PID:5664
- C:\Windows\System\rPHDUXg.exe
  C:\Windows\System\rPHDUXg.exe
  2⤵
  PID:5680
- C:\Windows\System\kVTQZCY.exe
  C:\Windows\System\kVTQZCY.exe
  2⤵
  PID:5700
- C:\Windows\System\nAqKODN.exe
  C:\Windows\System\nAqKODN.exe
  2⤵
  PID:5716
- C:\Windows\System\RvoMpIA.exe
  C:\Windows\System\RvoMpIA.exe
  2⤵
  PID:5872
- C:\Windows\System\LIIATpB.exe
  C:\Windows\System\LIIATpB.exe
  2⤵
  PID:5892
- C:\Windows\System\NaENXWH.exe
  C:\Windows\System\NaENXWH.exe
  2⤵
  PID:5908
- C:\Windows\System\XAgwJIf.exe
  C:\Windows\System\XAgwJIf.exe
  2⤵
  PID:5924
- C:\Windows\System\KwgIqhm.exe
  C:\Windows\System\KwgIqhm.exe
  2⤵
  PID:5940
- C:\Windows\System\YAitdGj.exe
  C:\Windows\System\YAitdGj.exe
  2⤵
  PID:5960
- C:\Windows\System\qGpEdLu.exe
  C:\Windows\System\qGpEdLu.exe
  2⤵
  PID:6004
- C:\Windows\System\aWfjXcY.exe
  C:\Windows\System\aWfjXcY.exe
  2⤵
  PID:6020
- C:\Windows\System\piElEpk.exe
  C:\Windows\System\piElEpk.exe
  2⤵
  PID:6036
- C:\Windows\System\DdBJOyf.exe
  C:\Windows\System\DdBJOyf.exe
  2⤵
  PID:6060
- C:\Windows\System\boEwSdX.exe
  C:\Windows\System\boEwSdX.exe
  2⤵
  PID:6076
- C:\Windows\System\ISiPeZV.exe
  C:\Windows\System\ISiPeZV.exe
  2⤵
  PID:6092
- C:\Windows\System\PgcvwAI.exe
  C:\Windows\System\PgcvwAI.exe
  2⤵
  PID:6112
- C:\Windows\System\Jjussto.exe
  C:\Windows\System\Jjussto.exe
  2⤵
  PID:6128
- C:\Windows\System\JMdcLQg.exe
  C:\Windows\System\JMdcLQg.exe
  2⤵
  PID:4940
- C:\Windows\System\xLlYxFX.exe
  C:\Windows\System\xLlYxFX.exe
  2⤵
  PID:4128
- C:\Windows\System\WOdYwef.exe
  C:\Windows\System\WOdYwef.exe
  2⤵
  PID:4240
- C:\Windows\System\XXtcLLk.exe
  C:\Windows\System\XXtcLLk.exe
  2⤵
  PID:5200
- C:\Windows\System\sZPGZZo.exe
  C:\Windows\System\sZPGZZo.exe
  2⤵
  PID:5260
- C:\Windows\System\xqNRYAc.exe
  C:\Windows\System\xqNRYAc.exe
  2⤵
  PID:4384
- C:\Windows\System\KXYdMqC.exe
  C:\Windows\System\KXYdMqC.exe
  2⤵
  PID:5332
- C:\Windows\System\KLguOWH.exe
  C:\Windows\System\KLguOWH.exe
  2⤵
  PID:2508
- C:\Windows\System\BGOchxb.exe
  C:\Windows\System\BGOchxb.exe
  2⤵
  PID:5400
- C:\Windows\System\DHgphas.exe
  C:\Windows\System\DHgphas.exe
  2⤵
  PID:5464
- C:\Windows\System\lsoyTwq.exe
  C:\Windows\System\lsoyTwq.exe
  2⤵
  PID:5528
- C:\Windows\System\AAMYBtb.exe
  C:\Windows\System\AAMYBtb.exe
  2⤵
  PID:5512
- C:\Windows\System\tEWvxdx.exe
  C:\Windows\System\tEWvxdx.exe
  2⤵
  PID:5420
- C:\Windows\System\DbJShor.exe
  C:\Windows\System\DbJShor.exe
  2⤵
  PID:5544
- C:\Windows\System\ngstQXN.exe
  C:\Windows\System\ngstQXN.exe
  2⤵
  PID:5452
- C:\Windows\System\hZQABBQ.exe
  C:\Windows\System\hZQABBQ.exe
  2⤵
  PID:5600
- C:\Windows\System\lcQnjLr.exe
  C:\Windows\System\lcQnjLr.exe
  2⤵
  PID:5672
- C:\Windows\System\cPMcSBM.exe
  C:\Windows\System\cPMcSBM.exe
  2⤵
  PID:5660
- C:\Windows\System\CteopXR.exe
  C:\Windows\System\CteopXR.exe
  2⤵
  PID:5724
- C:\Windows\System\gRkGXGV.exe
  C:\Windows\System\gRkGXGV.exe
  2⤵
  PID:5728
- C:\Windows\System\vvJswve.exe
  C:\Windows\System\vvJswve.exe
  2⤵
  PID:5744
- C:\Windows\System\TvBvfmw.exe
  C:\Windows\System\TvBvfmw.exe
  2⤵
  PID:5760
- C:\Windows\System\HZjiryj.exe
  C:\Windows\System\HZjiryj.exe
  2⤵
  PID:5784
- C:\Windows\System\JopBcJV.exe
  C:\Windows\System\JopBcJV.exe
  2⤵
  PID:5796
- C:\Windows\System\ibWBuID.exe
  C:\Windows\System\ibWBuID.exe
  2⤵
  PID:5812
- C:\Windows\System\YlqRbxQ.exe
  C:\Windows\System\YlqRbxQ.exe
  2⤵
  PID:5824
- C:\Windows\System\JorWZIQ.exe
  C:\Windows\System\JorWZIQ.exe
  2⤵
  PID:5844
- C:\Windows\System\OcCHVuD.exe
  C:\Windows\System\OcCHVuD.exe
  2⤵
  PID:5852
- C:\Windows\System\nMedGYH.exe
  C:\Windows\System\nMedGYH.exe
  2⤵
  PID:5900
- C:\Windows\System\OBgZnEp.exe
  C:\Windows\System\OBgZnEp.exe
  2⤵
  PID:5888
- C:\Windows\System\bVeAysl.exe
  C:\Windows\System\bVeAysl.exe
  2⤵
  PID:5936
- C:\Windows\System\dSkxtGB.exe
  C:\Windows\System\dSkxtGB.exe
  2⤵
  PID:5972
- C:\Windows\System\gxESEAW.exe
  C:\Windows\System\gxESEAW.exe
  2⤵
  PID:5992
- C:\Windows\System\DKPbIdO.exe
  C:\Windows\System\DKPbIdO.exe
  2⤵
  PID:6012
- C:\Windows\System\ehXBmYQ.exe
  C:\Windows\System\ehXBmYQ.exe
  2⤵
  PID:6084
- C:\Windows\System\ZaWqhbW.exe
  C:\Windows\System\ZaWqhbW.exe
  2⤵
  PID:4336
- C:\Windows\System\IbJHrxg.exe
  C:\Windows\System\IbJHrxg.exe
  2⤵
  PID:5196
- C:\Windows\System\JWjkNIS.exe
  C:\Windows\System\JWjkNIS.exe
  2⤵
  PID:6052
- C:\Windows\System\lkSTlkg.exe
  C:\Windows\System\lkSTlkg.exe
  2⤵
  PID:6100
- C:\Windows\System\PUUCsjn.exe
  C:\Windows\System\PUUCsjn.exe
  2⤵
  PID:6140
- C:\Windows\System\IFHIxkZ.exe
  C:\Windows\System\IFHIxkZ.exe
  2⤵
  PID:5264
- C:\Windows\System\khISNbt.exe
  C:\Windows\System\khISNbt.exe
  2⤵
  PID:5148
- C:\Windows\System\xucMLUP.exe
  C:\Windows\System\xucMLUP.exe
  2⤵
  PID:4784
- C:\Windows\System\TjmIWmb.exe
  C:\Windows\System\TjmIWmb.exe
  2⤵
  PID:5348
- C:\Windows\System\DrFSdYO.exe
  C:\Windows\System\DrFSdYO.exe
  2⤵
  PID:5560
- C:\Windows\System\NcsbgCE.exe
  C:\Windows\System\NcsbgCE.exe
  2⤵
  PID:5280
- C:\Windows\System\OmwbNhN.exe
  C:\Windows\System\OmwbNhN.exe
  2⤵
  PID:6152
- C:\Windows\System\LYhNqjJ.exe
  C:\Windows\System\LYhNqjJ.exe
  2⤵
  PID:6168
- C:\Windows\System\VaokEpe.exe
  C:\Windows\System\VaokEpe.exe
  2⤵
  PID:6184
- C:\Windows\System\xCDgOHc.exe
  C:\Windows\System\xCDgOHc.exe
  2⤵
  PID:6200
- C:\Windows\System\mTVNKEf.exe
  C:\Windows\System\mTVNKEf.exe
  2⤵
  PID:6220
- C:\Windows\System\eZtvHVH.exe
  C:\Windows\System\eZtvHVH.exe
  2⤵
  PID:6236
- C:\Windows\System\MgMRusn.exe
  C:\Windows\System\MgMRusn.exe
  2⤵
  PID:6252
- C:\Windows\System\edhhAUB.exe
  C:\Windows\System\edhhAUB.exe
  2⤵
  PID:6272
- C:\Windows\System\sXiaYHP.exe
  C:\Windows\System\sXiaYHP.exe
  2⤵
  PID:6288
- C:\Windows\System\VJzAmbr.exe
  C:\Windows\System\VJzAmbr.exe
  2⤵
  PID:6304
- C:\Windows\System\ArqbrkI.exe
  C:\Windows\System\ArqbrkI.exe
  2⤵
  PID:6324
- C:\Windows\System\rqQKxoX.exe
  C:\Windows\System\rqQKxoX.exe
  2⤵
  PID:6340
- C:\Windows\System\PyJzJCD.exe
  C:\Windows\System\PyJzJCD.exe
  2⤵
  PID:6356
- C:\Windows\System\oqEwznz.exe
  C:\Windows\System\oqEwznz.exe
  2⤵
  PID:6376
- C:\Windows\System\SUUlMGw.exe
  C:\Windows\System\SUUlMGw.exe
  2⤵
  PID:6392
- C:\Windows\System\glMPUhP.exe
  C:\Windows\System\glMPUhP.exe
  2⤵
  PID:6408
- C:\Windows\System\zcVgSIQ.exe
  C:\Windows\System\zcVgSIQ.exe
  2⤵
  PID:6424
- C:\Windows\System\rNIupkN.exe
  C:\Windows\System\rNIupkN.exe
  2⤵
  PID:6444
- C:\Windows\System\kCVdwcT.exe
  C:\Windows\System\kCVdwcT.exe
  2⤵
  PID:6460
- C:\Windows\System\HzTEKOk.exe
  C:\Windows\System\HzTEKOk.exe
  2⤵
  PID:6476
- C:\Windows\System\IiRrfxQ.exe
  C:\Windows\System\IiRrfxQ.exe
  2⤵
  PID:6492
- C:\Windows\System\IDTKCoH.exe
  C:\Windows\System\IDTKCoH.exe
  2⤵
  PID:6512
- C:\Windows\System\dveLTeg.exe
  C:\Windows\System\dveLTeg.exe
  2⤵
  PID:6528
- C:\Windows\System\LqELcqo.exe
  C:\Windows\System\LqELcqo.exe
  2⤵
  PID:6544
- C:\Windows\System\pgUcXkJ.exe
  C:\Windows\System\pgUcXkJ.exe
  2⤵
  PID:6604
- C:\Windows\System\VjrMadG.exe
  C:\Windows\System\VjrMadG.exe
  2⤵
  PID:6620
- C:\Windows\System\IXqItFZ.exe
  C:\Windows\System\IXqItFZ.exe
  2⤵
  PID:6636
- C:\Windows\System\iWkMJPu.exe
  C:\Windows\System\iWkMJPu.exe
  2⤵
  PID:6652
- C:\Windows\System\pechCxJ.exe
  C:\Windows\System\pechCxJ.exe
  2⤵
  PID:6668
- C:\Windows\System\bTqNFan.exe
  C:\Windows\System\bTqNFan.exe
  2⤵
  PID:6684
- C:\Windows\System\acOjdUq.exe
  C:\Windows\System\acOjdUq.exe
  2⤵
  PID:6700
- C:\Windows\System\NuVWdLk.exe
  C:\Windows\System\NuVWdLk.exe
  2⤵
  PID:6716
- C:\Windows\System\cbExZdc.exe
  C:\Windows\System\cbExZdc.exe
  2⤵
  PID:6732
- C:\Windows\System\AVoMeFc.exe
  C:\Windows\System\AVoMeFc.exe
  2⤵
  PID:6748
- C:\Windows\System\cTWYYVv.exe
  C:\Windows\System\cTWYYVv.exe
  2⤵
  PID:6764
- C:\Windows\System\NvvZXsh.exe
  C:\Windows\System\NvvZXsh.exe
  2⤵
  PID:6780
- C:\Windows\System\vURZcvn.exe
  C:\Windows\System\vURZcvn.exe
  2⤵
  PID:6796
- C:\Windows\System\LpMBsWz.exe
  C:\Windows\System\LpMBsWz.exe
  2⤵
  PID:6812
- C:\Windows\System\RLnIYgd.exe
  C:\Windows\System\RLnIYgd.exe
  2⤵
  PID:6832
- C:\Windows\System\kdKKNsb.exe
  C:\Windows\System\kdKKNsb.exe
  2⤵
  PID:6848
- C:\Windows\System\sNjiWzb.exe
  C:\Windows\System\sNjiWzb.exe
  2⤵
  PID:6864
- C:\Windows\System\wZlcbTh.exe
  C:\Windows\System\wZlcbTh.exe
  2⤵
  PID:6880
- C:\Windows\System\kkuUKNm.exe
  C:\Windows\System\kkuUKNm.exe
  2⤵
  PID:6896
- C:\Windows\System\ruXNPan.exe
  C:\Windows\System\ruXNPan.exe
  2⤵
  PID:6916
- C:\Windows\System\iZJNmbU.exe
  C:\Windows\System\iZJNmbU.exe
  2⤵
  PID:6936
- C:\Windows\System\RmaktRI.exe
  C:\Windows\System\RmaktRI.exe
  2⤵
  PID:6956
- C:\Windows\System\EFTOObB.exe
  C:\Windows\System\EFTOObB.exe
  2⤵
  PID:6972
- C:\Windows\System\nfREbIX.exe
  C:\Windows\System\nfREbIX.exe
  2⤵
  PID:6988
- C:\Windows\System\sdiyXJi.exe
  C:\Windows\System\sdiyXJi.exe
  2⤵
  PID:7004
- C:\Windows\System\rKwmCYN.exe
  C:\Windows\System\rKwmCYN.exe
  2⤵
  PID:7020
- C:\Windows\System\FtFJlSK.exe
  C:\Windows\System\FtFJlSK.exe
  2⤵
  PID:7036
- C:\Windows\System\poPmSRm.exe
  C:\Windows\System\poPmSRm.exe
  2⤵
  PID:7052
- C:\Windows\System\lVNSDyR.exe
  C:\Windows\System\lVNSDyR.exe
  2⤵
  PID:7068
- C:\Windows\System\mJvAagY.exe
  C:\Windows\System\mJvAagY.exe
  2⤵
  PID:7084
- C:\Windows\System\FHGnlUj.exe
  C:\Windows\System\FHGnlUj.exe
  2⤵
  PID:7100
- C:\Windows\System\jPKKoQQ.exe
  C:\Windows\System\jPKKoQQ.exe
  2⤵
  PID:7116
- C:\Windows\System\uGUZgNW.exe
  C:\Windows\System\uGUZgNW.exe
  2⤵
  PID:7132
- C:\Windows\System\TcollzH.exe
  C:\Windows\System\TcollzH.exe
  2⤵
  PID:7148
- C:\Windows\System\kGuouoi.exe
  C:\Windows\System\kGuouoi.exe
  2⤵
  PID:7164
- C:\Windows\System\kIbtPOo.exe
  C:\Windows\System\kIbtPOo.exe
  2⤵
  PID:5788
- C:\Windows\System\gJJZZPI.exe
  C:\Windows\System\gJJZZPI.exe
  2⤵
  PID:5860
- C:\Windows\System\UXlKltJ.exe
  C:\Windows\System\UXlKltJ.exe
  2⤵
  PID:5880
- C:\Windows\System\uaYjrgg.exe
  C:\Windows\System\uaYjrgg.exe
  2⤵
  PID:5996
- C:\Windows\System\baunOlh.exe
  C:\Windows\System\baunOlh.exe
  2⤵
  PID:6120
- C:\Windows\System\FRQUMIp.exe
  C:\Windows\System\FRQUMIp.exe
  2⤵
  PID:5300
- C:\Windows\System\FWTcIWc.exe
  C:\Windows\System\FWTcIWc.exe
  2⤵
  PID:5144
- C:\Windows\System\yGPXhpY.exe
  C:\Windows\System\yGPXhpY.exe
  2⤵
  PID:5484
- C:\Windows\System\uEPXrNw.exe
  C:\Windows\System\uEPXrNw.exe
  2⤵
  PID:5656
- C:\Windows\System\IxbKSYh.exe
  C:\Windows\System\IxbKSYh.exe
  2⤵
  PID:5696
- C:\Windows\System\MBhaCyR.exe
  C:\Windows\System\MBhaCyR.exe
  2⤵
  PID:6260
- C:\Windows\System\STPjCkI.exe
  C:\Windows\System\STPjCkI.exe
  2⤵
  PID:6336
- C:\Windows\System\dXUulhn.exe
  C:\Windows\System\dXUulhn.exe
  2⤵
  PID:6400
- C:\Windows\System\IVcUHmC.exe
  C:\Windows\System\IVcUHmC.exe
  2⤵
  PID:6440
- C:\Windows\System\FGXowyw.exe
  C:\Windows\System\FGXowyw.exe
  2⤵
  PID:6524
- C:\Windows\System\vaNiENf.exe
  C:\Windows\System\vaNiENf.exe
  2⤵
  PID:5320
- C:\Windows\System\jTouLif.exe
  C:\Windows\System\jTouLif.exe
  2⤵
  PID:5372
- C:\Windows\System\yNPswfR.exe
  C:\Windows\System\yNPswfR.exe
  2⤵
  PID:5368
- C:\Windows\System\uBRnHse.exe
  C:\Windows\System\uBRnHse.exe
  2⤵
  PID:5576
- C:\Windows\System\RFFAnKP.exe
  C:\Windows\System\RFFAnKP.exe
  2⤵
  PID:6592
- C:\Windows\System\eWPaGBG.exe
  C:\Windows\System\eWPaGBG.exe
  2⤵
  PID:6616
- C:\Windows\System\RgqyZTq.exe
  C:\Windows\System\RgqyZTq.exe
  2⤵
  PID:6680
- C:\Windows\System\cGStCxF.exe
  C:\Windows\System\cGStCxF.exe
  2⤵
  PID:5772
- C:\Windows\System\DUImEPd.exe
  C:\Windows\System\DUImEPd.exe
  2⤵
  PID:6772
- C:\Windows\System\VDKakZP.exe
  C:\Windows\System\VDKakZP.exe
  2⤵
  PID:5920
- C:\Windows\System\DZpQJsi.exe
  C:\Windows\System\DZpQJsi.exe
  2⤵
  PID:6016
- C:\Windows\System\rJXzJFJ.exe
  C:\Windows\System\rJXzJFJ.exe
  2⤵
  PID:5060
- C:\Windows\System\ytthOwa.exe
  C:\Windows\System\ytthOwa.exe
  2⤵
  PID:5184
- C:\Windows\System\LsEriVD.exe
  C:\Windows\System\LsEriVD.exe
  2⤵
  PID:6804
- C:\Windows\System\mEfVXwS.exe
  C:\Windows\System\mEfVXwS.exe
  2⤵
  PID:6148
- C:\Windows\System\qPugCZT.exe
  C:\Windows\System\qPugCZT.exe
  2⤵
  PID:6244
- C:\Windows\System\QEPQXBq.exe
  C:\Windows\System\QEPQXBq.exe
  2⤵
  PID:6312
- C:\Windows\System\ASHLdbG.exe
  C:\Windows\System\ASHLdbG.exe
  2⤵
  PID:6352
- C:\Windows\System\WimoAev.exe
  C:\Windows\System\WimoAev.exe
  2⤵
  PID:6844
- C:\Windows\System\XUGxXnO.exe
  C:\Windows\System\XUGxXnO.exe
  2⤵
  PID:6876
- C:\Windows\System\mvdRitw.exe
  C:\Windows\System\mvdRitw.exe
  2⤵
  PID:6452
- C:\Windows\System\rwLSoWm.exe
  C:\Windows\System\rwLSoWm.exe
  2⤵
  PID:6600
- C:\Windows\System\kvwTqZm.exe
  C:\Windows\System\kvwTqZm.exe
  2⤵
  PID:6580
- C:\Windows\System\ecXFJSy.exe
  C:\Windows\System\ecXFJSy.exe
  2⤵
  PID:6560
- C:\Windows\System\wrRghbH.exe
  C:\Windows\System\wrRghbH.exe
  2⤵
  PID:6908
- C:\Windows\System\OrBzcdk.exe
  C:\Windows\System\OrBzcdk.exe
  2⤵
  PID:6632
- C:\Windows\System\VSaqtLN.exe
  C:\Windows\System\VSaqtLN.exe
  2⤵
  PID:6756
- C:\Windows\System\CIWzErU.exe
  C:\Windows\System\CIWzErU.exe
  2⤵
  PID:6820
- C:\Windows\System\qzQcUgd.exe
  C:\Windows\System\qzQcUgd.exe
  2⤵
  PID:6888
- C:\Windows\System\hoGsiWb.exe
  C:\Windows\System\hoGsiWb.exe
  2⤵
  PID:6136
- C:\Windows\System\AWiHpJl.exe
  C:\Windows\System\AWiHpJl.exe
  2⤵
  PID:6980
- C:\Windows\System\RWtdTXL.exe
  C:\Windows\System\RWtdTXL.exe
  2⤵
  PID:7048
- C:\Windows\System\LLASoyQ.exe
  C:\Windows\System\LLASoyQ.exe
  2⤵
  PID:6968
- C:\Windows\System\sWLdcKk.exe
  C:\Windows\System\sWLdcKk.exe
  2⤵
  PID:7140
- C:\Windows\System\TtUDUmt.exe
  C:\Windows\System\TtUDUmt.exe
  2⤵
  PID:6996
- C:\Windows\System\tSsIgEl.exe
  C:\Windows\System\tSsIgEl.exe
  2⤵
  PID:7064
- C:\Windows\System\gtHVjHd.exe
  C:\Windows\System\gtHVjHd.exe
  2⤵
  PID:7156
- C:\Windows\System\cEvPWke.exe
  C:\Windows\System\cEvPWke.exe
  2⤵
  PID:5956
- C:\Windows\System\XWvtgxA.exe
  C:\Windows\System\XWvtgxA.exe
  2⤵
  PID:5276
- C:\Windows\System\HdzPsUb.exe
  C:\Windows\System\HdzPsUb.exe
  2⤵
  PID:6232
- C:\Windows\System\LbkzMwq.exe
  C:\Windows\System\LbkzMwq.exe
  2⤵
  PID:4412
- C:\Windows\System\iSnugOn.exe
  C:\Windows\System\iSnugOn.exe
  2⤵
  PID:4864
- C:\Windows\System\kDpjaNi.exe
  C:\Windows\System\kDpjaNi.exe
  2⤵
  PID:6192
- C:\Windows\System\VKptSae.exe
  C:\Windows\System\VKptSae.exe
  2⤵
  PID:6436
- C:\Windows\System\lvjvNiE.exe
  C:\Windows\System\lvjvNiE.exe
  2⤵
  PID:4728
- C:\Windows\System\sOLkdYB.exe
  C:\Windows\System\sOLkdYB.exe
  2⤵
  PID:5180
- C:\Windows\System\Dxawsda.exe
  C:\Windows\System\Dxawsda.exe
  2⤵
  PID:5640
- C:\Windows\System\eIyBjZV.exe
  C:\Windows\System\eIyBjZV.exe
  2⤵
  PID:6540
- C:\Windows\System\oFWreMz.exe
  C:\Windows\System\oFWreMz.exe
  2⤵
  PID:5840
- C:\Windows\System\bkSVyTc.exe
  C:\Windows\System\bkSVyTc.exe
  2⤵
  PID:5708
- C:\Windows\System\AejxTys.exe
  C:\Windows\System\AejxTys.exe
  2⤵
  PID:5904
- C:\Windows\System\TVuETcl.exe
  C:\Windows\System\TVuETcl.exe
  2⤵
  PID:5592
- C:\Windows\System\PGolOmj.exe
  C:\Windows\System\PGolOmj.exe
  2⤵
  PID:6320
- C:\Windows\System\ezLjaYu.exe
  C:\Windows\System\ezLjaYu.exe
  2⤵
  PID:6712
- C:\Windows\System\KQHGrFP.exe
  C:\Windows\System\KQHGrFP.exe
  2⤵
  PID:6284
- C:\Windows\System\uIBseHR.exe
  C:\Windows\System\uIBseHR.exe
  2⤵
  PID:5352
- C:\Windows\System\wPERFJi.exe
  C:\Windows\System\wPERFJi.exe
  2⤵
  PID:6648
- C:\Windows\System\VmbzshG.exe
  C:\Windows\System\VmbzshG.exe
  2⤵
  PID:5984
- C:\Windows\System\yezJhwX.exe
  C:\Windows\System\yezJhwX.exe
  2⤵
  PID:6676
- C:\Windows\System\MzaIjGS.exe
  C:\Windows\System\MzaIjGS.exe
  2⤵
  PID:6596
- C:\Windows\System\udiqWKv.exe
  C:\Windows\System\udiqWKv.exe
  2⤵
  PID:6788
- C:\Windows\System\FwwpRdk.exe
  C:\Windows\System\FwwpRdk.exe
  2⤵
  PID:7044
- C:\Windows\System\jMNbCUa.exe
  C:\Windows\System\jMNbCUa.exe
  2⤵
  PID:7028
- C:\Windows\System\MqmOmfT.exe
  C:\Windows\System\MqmOmfT.exe
  2⤵
  PID:5244
- C:\Windows\System\aIOcTmQ.exe
  C:\Windows\System\aIOcTmQ.exe
  2⤵
  PID:5344
- C:\Windows\System\CkTfCKA.exe
  C:\Windows\System\CkTfCKA.exe
  2⤵
  PID:6576
- C:\Windows\System\WRXfmUX.exe
  C:\Windows\System\WRXfmUX.exe
  2⤵
  PID:6000
- C:\Windows\System\EiTgRRR.exe
  C:\Windows\System\EiTgRRR.exe
  2⤵
  PID:6660
- C:\Windows\System\aZdvOkX.exe
  C:\Windows\System\aZdvOkX.exe
  2⤵
  PID:6856
- C:\Windows\System\blMkmFw.exe
  C:\Windows\System\blMkmFw.exe
  2⤵
  PID:4844
- C:\Windows\System\CZeJYYp.exe
  C:\Windows\System\CZeJYYp.exe
  2⤵
  PID:4676
- C:\Windows\System\cMTNcMF.exe
  C:\Windows\System\cMTNcMF.exe
  2⤵
  PID:6164
- C:\Windows\System\vjICSTy.exe
  C:\Windows\System\vjICSTy.exe
  2⤵
  PID:6504
- C:\Windows\System\dMwNDRb.exe
  C:\Windows\System\dMwNDRb.exe
  2⤵
  PID:5296
- C:\Windows\System\PmYYtDW.exe
  C:\Windows\System\PmYYtDW.exe
  2⤵
  PID:5436
- C:\Windows\System\FdEIOrD.exe
  C:\Windows\System\FdEIOrD.exe
  2⤵
  PID:6072
- C:\Windows\System\tQcxRFB.exe
  C:\Windows\System\tQcxRFB.exe
  2⤵
  PID:5644
- C:\Windows\System\XpRSKXi.exe
  C:\Windows\System\XpRSKXi.exe
  2⤵
  PID:5768
- C:\Windows\System\hpPPnrp.exe
  C:\Windows\System\hpPPnrp.exe
  2⤵
  PID:6644
- C:\Windows\System\CrVJeUV.exe
  C:\Windows\System\CrVJeUV.exe
  2⤵
  PID:6388
- C:\Windows\System\UyCXkOL.exe
  C:\Windows\System\UyCXkOL.exe
  2⤵
  PID:5980
- C:\Windows\System\YWpkqhz.exe
  C:\Windows\System\YWpkqhz.exe
  2⤵
  PID:4580
- C:\Windows\System\IIpJpbN.exe
  C:\Windows\System\IIpJpbN.exe
  2⤵
  PID:6932
- C:\Windows\System\gfcEUQY.exe
  C:\Windows\System\gfcEUQY.exe
  2⤵
  PID:6824
- C:\Windows\System\BDALIsc.exe
  C:\Windows\System\BDALIsc.exe
  2⤵
  PID:6300
- C:\Windows\System\CcidCGS.exe
  C:\Windows\System\CcidCGS.exe
  2⤵
  PID:5216
- C:\Windows\System\XSXdwns.exe
  C:\Windows\System\XSXdwns.exe
  2⤵
  PID:6744
- C:\Windows\System\uUnUQyN.exe
  C:\Windows\System\uUnUQyN.exe
  2⤵
  PID:7124
- C:\Windows\System\IWfkMpW.exe
  C:\Windows\System\IWfkMpW.exe
  2⤵
  PID:7060
- C:\Windows\System\YzDSdwh.exe
  C:\Windows\System\YzDSdwh.exe
  2⤵
  PID:1392
- C:\Windows\System\MVZtFLf.exe
  C:\Windows\System\MVZtFLf.exe
  2⤵
  PID:6728
- C:\Windows\System\eRmojLl.exe
  C:\Windows\System\eRmojLl.exe
  2⤵
  PID:5388
- C:\Windows\System\CjsecpP.exe
  C:\Windows\System\CjsecpP.exe
  2⤵
  PID:6208
- C:\Windows\System\LabFxFC.exe
  C:\Windows\System\LabFxFC.exe
  2⤵
  PID:6420
- C:\Windows\System\OHShcKc.exe
  C:\Windows\System\OHShcKc.exe
  2⤵
  PID:6572
- C:\Windows\System\RfkTkZv.exe
  C:\Windows\System\RfkTkZv.exe
  2⤵
  PID:5328
- C:\Windows\System\fjPQpHZ.exe
  C:\Windows\System\fjPQpHZ.exe
  2⤵
  PID:5288
- C:\Windows\System\UTKvFzr.exe
  C:\Windows\System\UTKvFzr.exe
  2⤵
  PID:6564
- C:\Windows\System\BGwwOlZ.exe
  C:\Windows\System\BGwwOlZ.exe
  2⤵
  PID:7172
- C:\Windows\System\uFPzGTt.exe
  C:\Windows\System\uFPzGTt.exe
  2⤵
  PID:7188
- C:\Windows\System\eKPBoKu.exe
  C:\Windows\System\eKPBoKu.exe
  2⤵
  PID:7204
- C:\Windows\System\KGiJLAT.exe
  C:\Windows\System\KGiJLAT.exe
  2⤵
  PID:7220
- C:\Windows\System\OGiJynx.exe
  C:\Windows\System\OGiJynx.exe
  2⤵
  PID:7240
- C:\Windows\System\CBGyWqH.exe
  C:\Windows\System\CBGyWqH.exe
  2⤵
  PID:7256
- C:\Windows\System\JvNhmmN.exe
  C:\Windows\System\JvNhmmN.exe
  2⤵
  PID:7272
- C:\Windows\System\CsDzfGC.exe
  C:\Windows\System\CsDzfGC.exe
  2⤵
  PID:7288
- C:\Windows\System\MvWLTAn.exe
  C:\Windows\System\MvWLTAn.exe
  2⤵
  PID:7304
- C:\Windows\System\AaahwQY.exe
  C:\Windows\System\AaahwQY.exe
  2⤵
  PID:7320
- C:\Windows\System\LTshcie.exe
  C:\Windows\System\LTshcie.exe
  2⤵
  PID:7336
- C:\Windows\System\DnOttFy.exe
  C:\Windows\System\DnOttFy.exe
  2⤵
  PID:7352
- C:\Windows\System\FQzItOQ.exe
  C:\Windows\System\FQzItOQ.exe
  2⤵
  PID:7368
- C:\Windows\System\vkdiWwM.exe
  C:\Windows\System\vkdiWwM.exe
  2⤵
  PID:7384
- C:\Windows\System\ZyYeEpI.exe
  C:\Windows\System\ZyYeEpI.exe
  2⤵
  PID:7400
- C:\Windows\System\sItSBte.exe
  C:\Windows\System\sItSBte.exe
  2⤵
  PID:7416
- C:\Windows\System\UNXcDGk.exe
  C:\Windows\System\UNXcDGk.exe
  2⤵
  PID:7432
- C:\Windows\System\iBNcHPG.exe
  C:\Windows\System\iBNcHPG.exe
  2⤵
  PID:7452
- C:\Windows\System\TRSgmyP.exe
  C:\Windows\System\TRSgmyP.exe
  2⤵
  PID:7468
- C:\Windows\System\tiVBdPv.exe
  C:\Windows\System\tiVBdPv.exe
  2⤵
  PID:7484
- C:\Windows\System\mIWFfwK.exe
  C:\Windows\System\mIWFfwK.exe
  2⤵
  PID:7500
- C:\Windows\System\mtONdZr.exe
  C:\Windows\System\mtONdZr.exe
  2⤵
  PID:7516
- C:\Windows\System\bTqaLpr.exe
  C:\Windows\System\bTqaLpr.exe
  2⤵
  PID:7532
- C:\Windows\System\bsHdffR.exe
  C:\Windows\System\bsHdffR.exe
  2⤵
  PID:7548
- C:\Windows\System\lMVMyMM.exe
  C:\Windows\System\lMVMyMM.exe
  2⤵
  PID:7564
- C:\Windows\System\sfQRrLm.exe
  C:\Windows\System\sfQRrLm.exe
  2⤵
  PID:7580
- C:\Windows\System\xXEGDzU.exe
  C:\Windows\System\xXEGDzU.exe
  2⤵
  PID:7596
- C:\Windows\System\xDuQMeN.exe
  C:\Windows\System\xDuQMeN.exe
  2⤵
  PID:7616
- C:\Windows\System\sTqoKUw.exe
  C:\Windows\System\sTqoKUw.exe
  2⤵
  PID:7632
- C:\Windows\System\hAGQdWD.exe
  C:\Windows\System\hAGQdWD.exe
  2⤵
  PID:7648
- C:\Windows\System\SYgtZQa.exe
  C:\Windows\System\SYgtZQa.exe
  2⤵
  PID:7664
- C:\Windows\System\DdvBpkA.exe
  C:\Windows\System\DdvBpkA.exe
  2⤵
  PID:7680
- C:\Windows\System\OkMqLpd.exe
  C:\Windows\System\OkMqLpd.exe
  2⤵
  PID:7696
- C:\Windows\System\zinguPL.exe
  C:\Windows\System\zinguPL.exe
  2⤵
  PID:7712
- C:\Windows\System\NecYGXJ.exe
  C:\Windows\System\NecYGXJ.exe
  2⤵
  PID:7728
- C:\Windows\System\eCOVZtN.exe
  C:\Windows\System\eCOVZtN.exe
  2⤵
  PID:7744
- C:\Windows\System\uGBGFHe.exe
  C:\Windows\System\uGBGFHe.exe
  2⤵
  PID:7760
- C:\Windows\System\imYaWtU.exe
  C:\Windows\System\imYaWtU.exe
  2⤵
  PID:7776
- C:\Windows\System\UoxUjAT.exe
  C:\Windows\System\UoxUjAT.exe
  2⤵
  PID:7792
- C:\Windows\System\EUlQKMR.exe
  C:\Windows\System\EUlQKMR.exe
  2⤵
  PID:7808
- C:\Windows\System\bCwMoiX.exe
  C:\Windows\System\bCwMoiX.exe
  2⤵
  PID:7824
- C:\Windows\System\lIjPtYx.exe
  C:\Windows\System\lIjPtYx.exe
  2⤵
  PID:7840
- C:\Windows\System\XmLNuki.exe
  C:\Windows\System\XmLNuki.exe
  2⤵
  PID:7856
- C:\Windows\System\kzdAGap.exe
  C:\Windows\System\kzdAGap.exe
  2⤵
  PID:7872
- C:\Windows\System\XKSpNDm.exe
  C:\Windows\System\XKSpNDm.exe
  2⤵
  PID:7888
- C:\Windows\System\RzjaAph.exe
  C:\Windows\System\RzjaAph.exe
  2⤵
  PID:7904
- C:\Windows\System\ZiHFIKb.exe
  C:\Windows\System\ZiHFIKb.exe
  2⤵
  PID:7920
- C:\Windows\System\DqoNvly.exe
  C:\Windows\System\DqoNvly.exe
  2⤵
  PID:7936
- C:\Windows\System\jgWeYZT.exe
  C:\Windows\System\jgWeYZT.exe
  2⤵
  PID:7956
- C:\Windows\System\RsTmART.exe
  C:\Windows\System\RsTmART.exe
  2⤵
  PID:7972
- C:\Windows\System\OKjzGpN.exe
  C:\Windows\System\OKjzGpN.exe
  2⤵
  PID:7988
- C:\Windows\System\KaXfbxr.exe
  C:\Windows\System\KaXfbxr.exe
  2⤵
  PID:8004
- C:\Windows\System\YatJaoF.exe
  C:\Windows\System\YatJaoF.exe
  2⤵
  PID:8024
- C:\Windows\System\dEaYrgi.exe
  C:\Windows\System\dEaYrgi.exe
  2⤵
  PID:8040
- C:\Windows\System\FvqmmzV.exe
  C:\Windows\System\FvqmmzV.exe
  2⤵
  PID:8056
- C:\Windows\System\WjACwqT.exe
  C:\Windows\System\WjACwqT.exe
  2⤵
  PID:8072
- C:\Windows\System\fXdnvDA.exe
  C:\Windows\System\fXdnvDA.exe
  2⤵
  PID:8088
- C:\Windows\System\jITVIsx.exe
  C:\Windows\System\jITVIsx.exe
  2⤵
  PID:8104
- C:\Windows\System\IAFQykK.exe
  C:\Windows\System\IAFQykK.exe
  2⤵
  PID:8120
- C:\Windows\System\OqqVDfd.exe
  C:\Windows\System\OqqVDfd.exe
  2⤵
  PID:8136
- C:\Windows\System\ngsgotB.exe
  C:\Windows\System\ngsgotB.exe
  2⤵
  PID:8152
- C:\Windows\System\PMrmhqE.exe
  C:\Windows\System\PMrmhqE.exe
  2⤵
  PID:8168
- C:\Windows\System\LCwNYhD.exe
  C:\Windows\System\LCwNYhD.exe
  2⤵
  PID:8184
- C:\Windows\System\DBlmeqT.exe
  C:\Windows\System\DBlmeqT.exe
  2⤵
  PID:7180
- C:\Windows\System\AivJOAQ.exe
  C:\Windows\System\AivJOAQ.exe
  2⤵
  PID:5756
- C:\Windows\System\jpkJSXa.exe
  C:\Windows\System\jpkJSXa.exe
  2⤵
  PID:6724
- C:\Windows\System\byymHbx.exe
  C:\Windows\System\byymHbx.exe
  2⤵
  PID:5736
- C:\Windows\System\JWMdfEV.exe
  C:\Windows\System\JWMdfEV.exe
  2⤵
  PID:7196
- C:\Windows\System\nLeqkfe.exe
  C:\Windows\System\nLeqkfe.exe
  2⤵
  PID:7252
- C:\Windows\System\rpNaYWk.exe
  C:\Windows\System\rpNaYWk.exe
  2⤵
  PID:7296
- C:\Windows\System\ganVOgk.exe
  C:\Windows\System\ganVOgk.exe
  2⤵
  PID:7316
- C:\Windows\System\AHqdLEj.exe
  C:\Windows\System\AHqdLEj.exe
  2⤵
  PID:7300
- C:\Windows\System\YVhebbz.exe
  C:\Windows\System\YVhebbz.exe
  2⤵
  PID:7440
- C:\Windows\System\LHfoVJC.exe
  C:\Windows\System\LHfoVJC.exe
  2⤵
  PID:7448
- C:\Windows\System\csAoVTK.exe
  C:\Windows\System\csAoVTK.exe
  2⤵
  PID:7392
- C:\Windows\System\iHSRAiX.exe
  C:\Windows\System\iHSRAiX.exe
  2⤵
  PID:7460
- C:\Windows\System\fHPySFr.exe
  C:\Windows\System\fHPySFr.exe
  2⤵
  PID:7512
- C:\Windows\System\HcDRmiB.exe
  C:\Windows\System\HcDRmiB.exe
  2⤵
  PID:7528
- C:\Windows\System\GSHzVZQ.exe
  C:\Windows\System\GSHzVZQ.exe
  2⤵
  PID:7556
- C:\Windows\System\sEHMBSi.exe
  C:\Windows\System\sEHMBSi.exe
  2⤵
  PID:7588
- C:\Windows\System\VGRPyJT.exe
  C:\Windows\System\VGRPyJT.exe
  2⤵
  PID:7640
- C:\Windows\System\BrdAqfC.exe
  C:\Windows\System\BrdAqfC.exe
  2⤵
  PID:7704
- C:\Windows\System\ChtMiNe.exe
  C:\Windows\System\ChtMiNe.exe
  2⤵
  PID:7740
- C:\Windows\System\dTEbTXv.exe
  C:\Windows\System\dTEbTXv.exe
  2⤵
  PID:7800
- C:\Windows\System\FAQZUaH.exe
  C:\Windows\System\FAQZUaH.exe
  2⤵
  PID:7660
- C:\Windows\System\cjaHxmS.exe
  C:\Windows\System\cjaHxmS.exe
  2⤵
  PID:7864
- C:\Windows\System\SxGOAhQ.exe
  C:\Windows\System\SxGOAhQ.exe
  2⤵
  PID:7932
- C:\Windows\System\AfWQdcu.exe
  C:\Windows\System\AfWQdcu.exe
  2⤵
  PID:7820
- C:\Windows\System\pxgGGEu.exe
  C:\Windows\System\pxgGGEu.exe
  2⤵
  PID:7756
- C:\Windows\System\Vlkdqjz.exe
  C:\Windows\System\Vlkdqjz.exe
  2⤵
  PID:7816
- C:\Windows\System\DuCsFNe.exe
  C:\Windows\System\DuCsFNe.exe
  2⤵
  PID:7916
- C:\Windows\System\mYyFRKp.exe
  C:\Windows\System\mYyFRKp.exe
  2⤵
  PID:7964
- C:\Windows\System\xyDlDeM.exe
  C:\Windows\System\xyDlDeM.exe
  2⤵
  PID:7984
- C:\Windows\System\dVFYdEy.exe
  C:\Windows\System\dVFYdEy.exe
  2⤵
  PID:8064
- C:\Windows\System\CGbGeZn.exe
  C:\Windows\System\CGbGeZn.exe
  2⤵
  PID:8128
- C:\Windows\System\jyiVtlV.exe
  C:\Windows\System\jyiVtlV.exe
  2⤵
  PID:6432
- C:\Windows\System\rNjsObG.exe
  C:\Windows\System\rNjsObG.exe
  2⤵
  PID:8080
- C:\Windows\System\jEFcikJ.exe
  C:\Windows\System\jEFcikJ.exe
  2⤵
  PID:8116
- C:\Windows\System\YzEZeFZ.exe
  C:\Windows\System\YzEZeFZ.exe
  2⤵
  PID:8020
- C:\Windows\System\JaWxqaq.exe
  C:\Windows\System\JaWxqaq.exe
  2⤵
  PID:8176
- C:\Windows\System\UmJfJkl.exe
  C:\Windows\System\UmJfJkl.exe
  2⤵
  PID:7212
- C:\Windows\System\jYltRVQ.exe
  C:\Windows\System\jYltRVQ.exe
  2⤵
  PID:4768
- C:\Windows\System\mjsijEI.exe
  C:\Windows\System\mjsijEI.exe
  2⤵
  PID:7268
- C:\Windows\System\NAyFCxE.exe
  C:\Windows\System\NAyFCxE.exe
  2⤵
  PID:7248
- C:\Windows\System\ojRLZBb.exe
  C:\Windows\System\ojRLZBb.exe
  2⤵
  PID:7544
- C:\Windows\System\JZDCkOC.exe
  C:\Windows\System\JZDCkOC.exe
  2⤵
  PID:7672
- C:\Windows\System\rxJHrFN.exe
  C:\Windows\System\rxJHrFN.exe
  2⤵
  PID:7836
- C:\Windows\System\NjeiUEI.exe
  C:\Windows\System\NjeiUEI.exe
  2⤵
  PID:7868
- C:\Windows\System\QXwBGlM.exe
  C:\Windows\System\QXwBGlM.exe
  2⤵
  PID:7884
- C:\Windows\System\HzRlZgf.exe
  C:\Windows\System\HzRlZgf.exe
  2⤵
  PID:7360
- C:\Windows\System\fBhmeuv.exe
  C:\Windows\System\fBhmeuv.exe
  2⤵
  PID:7880
- C:\Windows\System\wmaMhvm.exe
  C:\Windows\System\wmaMhvm.exe
  2⤵
  PID:7980
- C:\Windows\System\KmxmeuA.exe
  C:\Windows\System\KmxmeuA.exe
  2⤵
  PID:8012
- C:\Windows\System\OfljerA.exe
  C:\Windows\System\OfljerA.exe
  2⤵
  PID:7264
- C:\Windows\System\CCtcwxY.exe
  C:\Windows\System\CCtcwxY.exe
  2⤵
  PID:8100
- C:\Windows\System\yWVYWgT.exe
  C:\Windows\System\yWVYWgT.exe
  2⤵
  PID:5496
- C:\Windows\System\cdzetyD.exe
  C:\Windows\System\cdzetyD.exe
  2⤵
  PID:7444
- C:\Windows\System\XQwsHEc.exe
  C:\Windows\System\XQwsHEc.exe
  2⤵
  PID:6472
- C:\Windows\System\ymOwaJo.exe
  C:\Windows\System\ymOwaJo.exe
  2⤵
  PID:7948
- C:\Windows\System\icFnfhD.exe
  C:\Windows\System\icFnfhD.exe
  2⤵
  PID:1572
- C:\Windows\System\nnrVRLN.exe
  C:\Windows\System\nnrVRLN.exe
  2⤵
  PID:7572
- C:\Windows\System\gRiUwdC.exe
  C:\Windows\System\gRiUwdC.exe
  2⤵
  PID:7480
- C:\Windows\System\pExIwOX.exe
  C:\Windows\System\pExIwOX.exe
  2⤵
  PID:5100
- C:\Windows\System\uQaAXGz.exe
  C:\Windows\System\uQaAXGz.exe
  2⤵
  PID:8036
- C:\Windows\System\OZDcFmP.exe
  C:\Windows\System\OZDcFmP.exe
  2⤵
  PID:8084
- C:\Windows\System\lpOerML.exe
  C:\Windows\System\lpOerML.exe
  2⤵
  PID:7576
- C:\Windows\System\UfuceOf.exe
  C:\Windows\System\UfuceOf.exe
  2⤵
  PID:7424
- C:\Windows\System\gmoiZkp.exe
  C:\Windows\System\gmoiZkp.exe
  2⤵
  PID:7524
- C:\Windows\System\bgXYJwj.exe
  C:\Windows\System\bgXYJwj.exe
  2⤵
  PID:7624
- C:\Windows\System\xEqyZPd.exe
  C:\Windows\System\xEqyZPd.exe
  2⤵
  PID:7952
- C:\Windows\System\XbtgNaZ.exe
  C:\Windows\System\XbtgNaZ.exe
  2⤵
  PID:7996
- C:\Windows\System\gtidOFq.exe
  C:\Windows\System\gtidOFq.exe
  2⤵
  PID:8196
- C:\Windows\System\iwtAIli.exe
  C:\Windows\System\iwtAIli.exe
  2⤵
  PID:8212
- C:\Windows\System\gBYPAZL.exe
  C:\Windows\System\gBYPAZL.exe
  2⤵
  PID:8228
- C:\Windows\System\kqTkmmX.exe
  C:\Windows\System\kqTkmmX.exe
  2⤵
  PID:8244
- C:\Windows\System\chZJzAF.exe
  C:\Windows\System\chZJzAF.exe
  2⤵
  PID:8260
- C:\Windows\System\pShFqWT.exe
  C:\Windows\System\pShFqWT.exe
  2⤵
  PID:8276
- C:\Windows\System\gjjGVTb.exe
  C:\Windows\System\gjjGVTb.exe
  2⤵
  PID:8292
- C:\Windows\System\cEwkmnP.exe
  C:\Windows\System\cEwkmnP.exe
  2⤵
  PID:8312
- C:\Windows\System\loYIFeb.exe
  C:\Windows\System\loYIFeb.exe
  2⤵
  PID:8328
- C:\Windows\System\rKokoTM.exe
  C:\Windows\System\rKokoTM.exe
  2⤵
  PID:8412
- C:\Windows\System\ygdIiKP.exe
  C:\Windows\System\ygdIiKP.exe
  2⤵
  PID:8428
- C:\Windows\System\sjgkNuo.exe
  C:\Windows\System\sjgkNuo.exe
  2⤵
  PID:8444
- C:\Windows\System\zFIgxNT.exe
  C:\Windows\System\zFIgxNT.exe
  2⤵
  PID:8460
- C:\Windows\System\axwsHYS.exe
  C:\Windows\System\axwsHYS.exe
  2⤵
  PID:8476
- C:\Windows\System\VvTzkmq.exe
  C:\Windows\System\VvTzkmq.exe
  2⤵
  PID:8492
- C:\Windows\System\zFXOrNy.exe
  C:\Windows\System\zFXOrNy.exe
  2⤵
  PID:8508
- C:\Windows\System\BaSfveP.exe
  C:\Windows\System\BaSfveP.exe
  2⤵
  PID:8524
- C:\Windows\System\mDifFBW.exe
  C:\Windows\System\mDifFBW.exe
  2⤵
  PID:8540
- C:\Windows\System\ZlPTuhE.exe
  C:\Windows\System\ZlPTuhE.exe
  2⤵
  PID:8556
- C:\Windows\System\GhvRset.exe
  C:\Windows\System\GhvRset.exe
  2⤵
  PID:8572
- C:\Windows\System\XRlLpWp.exe
  C:\Windows\System\XRlLpWp.exe
  2⤵
  PID:8588
- C:\Windows\System\FIFPAkO.exe
  C:\Windows\System\FIFPAkO.exe
  2⤵
  PID:8604
- C:\Windows\System\WRSUDQy.exe
  C:\Windows\System\WRSUDQy.exe
  2⤵
  PID:8620
- C:\Windows\System\ngwKHmi.exe
  C:\Windows\System\ngwKHmi.exe
  2⤵
  PID:8636
- C:\Windows\System\IDzaxzh.exe
  C:\Windows\System\IDzaxzh.exe
  2⤵
  PID:8652
- C:\Windows\System\LVjIgeZ.exe
  C:\Windows\System\LVjIgeZ.exe
  2⤵
  PID:8668
- C:\Windows\System\jSvJFPp.exe
  C:\Windows\System\jSvJFPp.exe
  2⤵
  PID:8684
- C:\Windows\System\vidFJHQ.exe
  C:\Windows\System\vidFJHQ.exe
  2⤵
  PID:8700
- C:\Windows\System\xrIGGTY.exe
  C:\Windows\System\xrIGGTY.exe
  2⤵
  PID:8716
- C:\Windows\System\dEwlUkj.exe
  C:\Windows\System\dEwlUkj.exe
  2⤵
  PID:8732
- C:\Windows\System\DfYToeD.exe
  C:\Windows\System\DfYToeD.exe
  2⤵
  PID:8748
- C:\Windows\System\UEjkgJe.exe
  C:\Windows\System\UEjkgJe.exe
  2⤵
  PID:8764
- C:\Windows\System\IbkBuyv.exe
  C:\Windows\System\IbkBuyv.exe
  2⤵
  PID:8780
- C:\Windows\System\BHkObXZ.exe
  C:\Windows\System\BHkObXZ.exe
  2⤵
  PID:8796
- C:\Windows\System\OSltFvG.exe
  C:\Windows\System\OSltFvG.exe
  2⤵
  PID:8812
- C:\Windows\System\cdJnmUt.exe
  C:\Windows\System\cdJnmUt.exe
  2⤵
  PID:8828
- C:\Windows\System\RBXHWUZ.exe
  C:\Windows\System\RBXHWUZ.exe
  2⤵
  PID:8844
- C:\Windows\System\VCIwpAO.exe
  C:\Windows\System\VCIwpAO.exe
  2⤵
  PID:8860
- C:\Windows\System\BvugokT.exe
  C:\Windows\System\BvugokT.exe
  2⤵
  PID:8876
- C:\Windows\System\GfqNcoB.exe
  C:\Windows\System\GfqNcoB.exe
  2⤵
  PID:8892
- C:\Windows\System\jOICkPC.exe
  C:\Windows\System\jOICkPC.exe
  2⤵
  PID:8908
- C:\Windows\System\IgKSEqL.exe
  C:\Windows\System\IgKSEqL.exe
  2⤵
  PID:8924
- C:\Windows\System\TYSJwta.exe
  C:\Windows\System\TYSJwta.exe
  2⤵
  PID:8940
- C:\Windows\System\VNFOPnz.exe
  C:\Windows\System\VNFOPnz.exe
  2⤵
  PID:8956
- C:\Windows\System\sLHEwPE.exe
  C:\Windows\System\sLHEwPE.exe
  2⤵
  PID:8972
- C:\Windows\System\xzVFDcJ.exe
  C:\Windows\System\xzVFDcJ.exe
  2⤵
  PID:8988
- C:\Windows\System\ZQrYnde.exe
  C:\Windows\System\ZQrYnde.exe
  2⤵
  PID:9004
- C:\Windows\System\BSPiwul.exe
  C:\Windows\System\BSPiwul.exe
  2⤵
  PID:9020
- C:\Windows\System\nEBErUz.exe
  C:\Windows\System\nEBErUz.exe
  2⤵
  PID:9036
- C:\Windows\System\bFlIlLC.exe
  C:\Windows\System\bFlIlLC.exe
  2⤵
  PID:9052
- C:\Windows\System\bseewit.exe
  C:\Windows\System\bseewit.exe
  2⤵
  PID:9068
- C:\Windows\System\NvNRpzS.exe
  C:\Windows\System\NvNRpzS.exe
  2⤵
  PID:9084
- C:\Windows\System\QcyZmrE.exe
  C:\Windows\System\QcyZmrE.exe
  2⤵
  PID:9100
- C:\Windows\System\nxHpInd.exe
  C:\Windows\System\nxHpInd.exe
  2⤵
  PID:9116
- C:\Windows\System\NRbrTSZ.exe
  C:\Windows\System\NRbrTSZ.exe
  2⤵
  PID:9136
- C:\Windows\System\tJcBitm.exe
  C:\Windows\System\tJcBitm.exe
  2⤵
  PID:9152
- C:\Windows\System\aoYfPxV.exe
  C:\Windows\System\aoYfPxV.exe
  2⤵
  PID:9168
- C:\Windows\System\ICZSPVE.exe
  C:\Windows\System\ICZSPVE.exe
  2⤵
  PID:9184
- C:\Windows\System\EPZXGtM.exe
  C:\Windows\System\EPZXGtM.exe
  2⤵
  PID:9200
- C:\Windows\System\xyzDXgc.exe
  C:\Windows\System\xyzDXgc.exe
  2⤵
  PID:6928
- C:\Windows\System\XrfrsMp.exe
  C:\Windows\System\XrfrsMp.exe
  2⤵
  PID:8220
- C:\Windows\System\HYYTOPa.exe
  C:\Windows\System\HYYTOPa.exe
  2⤵
  PID:8268
- C:\Windows\System\UdqOLSZ.exe
  C:\Windows\System\UdqOLSZ.exe
  2⤵
  PID:7784
- C:\Windows\System\ZgUQJzc.exe
  C:\Windows\System\ZgUQJzc.exe
  2⤵
  PID:7736
- C:\Windows\System\MqTkbmu.exe
  C:\Windows\System\MqTkbmu.exe
  2⤵
  PID:8304
- C:\Windows\System\AdQfLJH.exe
  C:\Windows\System\AdQfLJH.exe
  2⤵
  PID:8352
- C:\Windows\System\idSBMmk.exe
  C:\Windows\System\idSBMmk.exe
  2⤵
  PID:8320
- C:\Windows\System\glljXhl.exe
  C:\Windows\System\glljXhl.exe
  2⤵
  PID:8360
- C:\Windows\System\kwQRgSJ.exe
  C:\Windows\System\kwQRgSJ.exe
  2⤵
  PID:8376
- C:\Windows\System\vMfGniy.exe
  C:\Windows\System\vMfGniy.exe
  2⤵
  PID:8392
- C:\Windows\System\VxkoLhb.exe
  C:\Windows\System\VxkoLhb.exe
  2⤵
  PID:8408
- C:\Windows\System\KNnywhq.exe
  C:\Windows\System\KNnywhq.exe
  2⤵
  PID:8456
- C:\Windows\System\eoLqNLf.exe
  C:\Windows\System\eoLqNLf.exe
  2⤵
  PID:8440
- C:\Windows\System\aRkgLLK.exe
  C:\Windows\System\aRkgLLK.exe
  2⤵
  PID:8516
- C:\Windows\System\sNOpzYr.exe
  C:\Windows\System\sNOpzYr.exe
  2⤵
  PID:8548
- C:\Windows\System\fXrcbeX.exe
  C:\Windows\System\fXrcbeX.exe
  2⤵
  PID:8564
- C:\Windows\System\ItikiXO.exe
  C:\Windows\System\ItikiXO.exe
  2⤵
  PID:8616
- C:\Windows\System\cXFJjwl.exe
  C:\Windows\System\cXFJjwl.exe
  2⤵
  PID:8648
- C:\Windows\System\WNGpUix.exe
  C:\Windows\System\WNGpUix.exe
  2⤵
  PID:8632
- C:\Windows\System\LtYVRwP.exe
  C:\Windows\System\LtYVRwP.exe
  2⤵
  PID:8696
- C:\Windows\System\KvlHCyT.exe
  C:\Windows\System\KvlHCyT.exe
  2⤵
  PID:8744
- C:\Windows\System\WPIBfHT.exe
  C:\Windows\System\WPIBfHT.exe
  2⤵
  PID:8776
- C:\Windows\System\QbjDvCz.exe
  C:\Windows\System\QbjDvCz.exe
  2⤵
  PID:8804
- C:\Windows\System\KXGHaON.exe
  C:\Windows\System\KXGHaON.exe
  2⤵
  PID:8820
- C:\Windows\System\FcEIcDx.exe
  C:\Windows\System\FcEIcDx.exe
  2⤵
  PID:8872
- C:\Windows\System\upTfNcH.exe
  C:\Windows\System\upTfNcH.exe
  2⤵
  PID:8900
- C:\Windows\System\EMlOnhK.exe
  C:\Windows\System\EMlOnhK.exe
  2⤵
  PID:8932
- C:\Windows\System\KbFGWgc.exe
  C:\Windows\System\KbFGWgc.exe
  2⤵
  PID:8968
- C:\Windows\System\PQySgsx.exe
  C:\Windows\System\PQySgsx.exe
  2⤵
  PID:9000
- C:\Windows\System\hgbAKAg.exe
  C:\Windows\System\hgbAKAg.exe
  2⤵
  PID:9060
- C:\Windows\System\ETiCShL.exe
  C:\Windows\System\ETiCShL.exe
  2⤵
  PID:9016
- C:\Windows\System\RIUAvhU.exe
  C:\Windows\System\RIUAvhU.exe
  2⤵
  PID:9048
- C:\Windows\System\GlLbrEY.exe
  C:\Windows\System\GlLbrEY.exe
  2⤵
  PID:9080
- C:\Windows\System\XdbmBqA.exe
  C:\Windows\System\XdbmBqA.exe
  2⤵
  PID:9196
- C:\Windows\System\wxRRxMI.exe
  C:\Windows\System\wxRRxMI.exe
  2⤵
  PID:7832
- C:\Windows\System\UYpgNIN.exe
  C:\Windows\System\UYpgNIN.exe
  2⤵
  PID:8308
- C:\Windows\System\pfzYNzA.exe
  C:\Windows\System\pfzYNzA.exe
  2⤵
  PID:8324
- C:\Windows\System\BgOuRoH.exe
  C:\Windows\System\BgOuRoH.exe
  2⤵
  PID:7492
- C:\Windows\System\osdBBil.exe
  C:\Windows\System\osdBBil.exe
  2⤵
  PID:8404
- C:\Windows\System\ypcDDVx.exe
  C:\Windows\System\ypcDDVx.exe
  2⤵
  PID:8284
- C:\Windows\System\cWYqLuU.exe
  C:\Windows\System\cWYqLuU.exe
  2⤵
  PID:8488
- C:\Windows\System\HcVhYgy.exe
  C:\Windows\System\HcVhYgy.exe
  2⤵
  PID:8388
- C:\Windows\System\SoFxcmj.exe
  C:\Windows\System\SoFxcmj.exe
  2⤵
  PID:8472
- C:\Windows\System\cuDBehH.exe
  C:\Windows\System\cuDBehH.exe
  2⤵
  PID:8612
- C:\Windows\System\ujpCzSn.exe
  C:\Windows\System\ujpCzSn.exe
  2⤵
  PID:8680
- C:\Windows\System\qRQRvZZ.exe
  C:\Windows\System\qRQRvZZ.exe
  2⤵
  PID:8536
- C:\Windows\System\JUveDcX.exe
  C:\Windows\System\JUveDcX.exe
  2⤵
  PID:8772
- C:\Windows\System\coaJHci.exe
  C:\Windows\System\coaJHci.exe
  2⤵
  PID:8840
- C:\Windows\System\nzgxItY.exe
  C:\Windows\System\nzgxItY.exe
  2⤵
  PID:8904
- C:\Windows\System\KxHTqRh.exe
  C:\Windows\System\KxHTqRh.exe
  2⤵
  PID:8936
- C:\Windows\System\YDTgjmj.exe
  C:\Windows\System\YDTgjmj.exe
  2⤵
  PID:8984
- C:\Windows\System\KqQxEWQ.exe
  C:\Windows\System\KqQxEWQ.exe
  2⤵
  PID:9076
- C:\Windows\System\kovgDgi.exe
  C:\Windows\System\kovgDgi.exe
  2⤵
  PID:9164
- C:\Windows\System\kNjDBuE.exe
  C:\Windows\System\kNjDBuE.exe
  2⤵
  PID:9148
- C:\Windows\System\KsUNyCi.exe
  C:\Windows\System\KsUNyCi.exe
  2⤵
  PID:8368
- C:\Windows\System\vCwhLKI.exe
  C:\Windows\System\vCwhLKI.exe
  2⤵
  PID:7332
- C:\Windows\System\uRuVjHU.exe
  C:\Windows\System\uRuVjHU.exe
  2⤵
  PID:8580
- C:\Windows\System\lNUhjoy.exe
  C:\Windows\System\lNUhjoy.exe
  2⤵
  PID:8664
- C:\Windows\System\Imptkjp.exe
  C:\Windows\System\Imptkjp.exe
  2⤵
  PID:8980
- C:\Windows\System\fWnzGra.exe
  C:\Windows\System\fWnzGra.exe
  2⤵
  PID:8452
- C:\Windows\System\zrQUpUa.exe
  C:\Windows\System\zrQUpUa.exe
  2⤵
  PID:8868
- C:\Windows\System\NjicRvR.exe
  C:\Windows\System\NjicRvR.exe
  2⤵
  PID:8788
- C:\Windows\System\fwXKhAe.exe
  C:\Windows\System\fwXKhAe.exe
  2⤵
  PID:9220
- C:\Windows\System\PXUWWCU.exe
  C:\Windows\System\PXUWWCU.exe
  2⤵
  PID:9236
- C:\Windows\System\OVheTFe.exe
  C:\Windows\System\OVheTFe.exe
  2⤵
  PID:9252
- C:\Windows\System\garBSLo.exe
  C:\Windows\System\garBSLo.exe
  2⤵
  PID:9268
- C:\Windows\System\rIAybOE.exe
  C:\Windows\System\rIAybOE.exe
  2⤵
  PID:9284
- C:\Windows\System\mNiEJCX.exe
  C:\Windows\System\mNiEJCX.exe
  2⤵
  PID:9300
- C:\Windows\System\hgJvrqf.exe
  C:\Windows\System\hgJvrqf.exe
  2⤵
  PID:9316
- C:\Windows\System\VqaXMjN.exe
  C:\Windows\System\VqaXMjN.exe
  2⤵
  PID:9332
- C:\Windows\System\wSsdIAO.exe
  C:\Windows\System\wSsdIAO.exe
  2⤵
  PID:9348
- C:\Windows\System\JBkNUjP.exe
  C:\Windows\System\JBkNUjP.exe
  2⤵
  PID:9364
- C:\Windows\System\CXSPVzW.exe
  C:\Windows\System\CXSPVzW.exe
  2⤵
  PID:9380
- C:\Windows\System\RZnWvlp.exe
  C:\Windows\System\RZnWvlp.exe
  2⤵
  PID:9396
- C:\Windows\System\qNuoAzP.exe
  C:\Windows\System\qNuoAzP.exe
  2⤵
  PID:9412
- C:\Windows\System\rOCMySv.exe
  C:\Windows\System\rOCMySv.exe
  2⤵
  PID:9428
- C:\Windows\System\fCkTEUD.exe
  C:\Windows\System\fCkTEUD.exe
  2⤵
  PID:9444
- C:\Windows\System\XwnBGIm.exe
  C:\Windows\System\XwnBGIm.exe
  2⤵
  PID:9460
- C:\Windows\System\YFXGoxB.exe
  C:\Windows\System\YFXGoxB.exe
  2⤵
  PID:9476
- C:\Windows\System\ywrykzW.exe
  C:\Windows\System\ywrykzW.exe
  2⤵
  PID:9492
- C:\Windows\System\YdjeEmX.exe
  C:\Windows\System\YdjeEmX.exe
  2⤵
  PID:9508
- C:\Windows\System\zPQsiwn.exe
  C:\Windows\System\zPQsiwn.exe
  2⤵
  PID:9524
- C:\Windows\System\zCLXveo.exe
  C:\Windows\System\zCLXveo.exe
  2⤵
  PID:9540
- C:\Windows\System\tRmIbpq.exe
  C:\Windows\System\tRmIbpq.exe
  2⤵
  PID:9556
- C:\Windows\System\UqJGUyG.exe
  C:\Windows\System\UqJGUyG.exe
  2⤵
  PID:9572
- C:\Windows\System\JbZtijp.exe
  C:\Windows\System\JbZtijp.exe
  2⤵
  PID:9588
- C:\Windows\System\eCDBJaD.exe
  C:\Windows\System\eCDBJaD.exe
  2⤵
  PID:9604
- C:\Windows\System\DkXxPHs.exe
  C:\Windows\System\DkXxPHs.exe
  2⤵
  PID:9620
- C:\Windows\System\yzeypOP.exe
  C:\Windows\System\yzeypOP.exe
  2⤵
  PID:9636
- C:\Windows\System\vMXGJxL.exe
  C:\Windows\System\vMXGJxL.exe
  2⤵
  PID:9652
- C:\Windows\System\DsDDBKV.exe
  C:\Windows\System\DsDDBKV.exe
  2⤵
  PID:9668
- C:\Windows\System\smeaKpj.exe
  C:\Windows\System\smeaKpj.exe
  2⤵
  PID:9684
- C:\Windows\System\ejapNtg.exe
  C:\Windows\System\ejapNtg.exe
  2⤵
  PID:9700
- C:\Windows\System\JfrFQlM.exe
  C:\Windows\System\JfrFQlM.exe
  2⤵
  PID:9716
- C:\Windows\System\QdTBwRy.exe
  C:\Windows\System\QdTBwRy.exe
  2⤵
  PID:9732
- C:\Windows\System\cQQJEik.exe
  C:\Windows\System\cQQJEik.exe
  2⤵
  PID:9748
- C:\Windows\System\CKFupbW.exe
  C:\Windows\System\CKFupbW.exe
  2⤵
  PID:9764
- C:\Windows\System\isfpowI.exe
  C:\Windows\System\isfpowI.exe
  2⤵
  PID:9780
- C:\Windows\System\dlfSBlR.exe
  C:\Windows\System\dlfSBlR.exe
  2⤵
  PID:9796
- C:\Windows\System\SOvpMMa.exe
  C:\Windows\System\SOvpMMa.exe
  2⤵
  PID:9812
- C:\Windows\System\ZBEZaUI.exe
  C:\Windows\System\ZBEZaUI.exe
  2⤵
  PID:9828
- C:\Windows\System\bNorMPa.exe
  C:\Windows\System\bNorMPa.exe
  2⤵
  PID:9844
- C:\Windows\System\tydrqMC.exe
  C:\Windows\System\tydrqMC.exe
  2⤵
  PID:9860
- C:\Windows\System\dLQTOtc.exe
  C:\Windows\System\dLQTOtc.exe
  2⤵
  PID:9876
- C:\Windows\System\dykbdZc.exe
  C:\Windows\System\dykbdZc.exe
  2⤵
  PID:9892
- C:\Windows\System\KrMppfJ.exe
  C:\Windows\System\KrMppfJ.exe
  2⤵
  PID:9908
- C:\Windows\System\UjDhuQr.exe
  C:\Windows\System\UjDhuQr.exe
  2⤵
  PID:9924
- C:\Windows\System\YBwqpsv.exe
  C:\Windows\System\YBwqpsv.exe
  2⤵
  PID:9940
- C:\Windows\System\ZqjxdZN.exe
  C:\Windows\System\ZqjxdZN.exe
  2⤵
  PID:9956
- C:\Windows\System\nfFMXif.exe
  C:\Windows\System\nfFMXif.exe
  2⤵
  PID:9972
- C:\Windows\System\TJsxnOJ.exe
  C:\Windows\System\TJsxnOJ.exe
  2⤵
  PID:9988
- C:\Windows\System\QxJMtRh.exe
  C:\Windows\System\QxJMtRh.exe
  2⤵
  PID:10004
- C:\Windows\System\IElrIFe.exe
  C:\Windows\System\IElrIFe.exe
  2⤵
  PID:10020
- C:\Windows\System\rWuggHp.exe
  C:\Windows\System\rWuggHp.exe
  2⤵
  PID:10036
- C:\Windows\System\oNRWhYI.exe
  C:\Windows\System\oNRWhYI.exe
  2⤵
  PID:10052
- C:\Windows\System\JCNmAsM.exe
  C:\Windows\System\JCNmAsM.exe
  2⤵
  PID:10068
- C:\Windows\System\yyGqaLB.exe
  C:\Windows\System\yyGqaLB.exe
  2⤵
  PID:10084
- C:\Windows\System\gtYPuXO.exe
  C:\Windows\System\gtYPuXO.exe
  2⤵
  PID:10100
- C:\Windows\System\XQmhwRu.exe
  C:\Windows\System\XQmhwRu.exe
  2⤵
  PID:10116
- C:\Windows\System\LIKgXxq.exe
  C:\Windows\System\LIKgXxq.exe
  2⤵
  PID:10136
- C:\Windows\System\GOGtgRU.exe
  C:\Windows\System\GOGtgRU.exe
  2⤵
  PID:10152
- C:\Windows\System\SvXUcEp.exe
  C:\Windows\System\SvXUcEp.exe
  2⤵
  PID:10168
- C:\Windows\System\HqdKsgg.exe
  C:\Windows\System\HqdKsgg.exe
  2⤵
  PID:10184
- C:\Windows\System\kvijqbU.exe
  C:\Windows\System\kvijqbU.exe
  2⤵
  PID:10200
- C:\Windows\System\UfhFVHQ.exe
  C:\Windows\System\UfhFVHQ.exe
  2⤵
  PID:10216
- C:\Windows\System\sJIkPmh.exe
  C:\Windows\System\sJIkPmh.exe
  2⤵
  PID:10232
- C:\Windows\System\QasFFhm.exe
  C:\Windows\System\QasFFhm.exe
  2⤵
  PID:9248
- C:\Windows\System\CLUfQvI.exe
  C:\Windows\System\CLUfQvI.exe
  2⤵
  PID:9312
- C:\Windows\System\nWCtnpo.exe
  C:\Windows\System\nWCtnpo.exe
  2⤵
  PID:9128
- C:\Windows\System\JOQWcfO.exe
  C:\Windows\System\JOQWcfO.exe
  2⤵
  PID:9404
- C:\Windows\System\blDkyqX.exe
  C:\Windows\System\blDkyqX.exe
  2⤵
  PID:5292
- C:\Windows\System\FCkmKMJ.exe
  C:\Windows\System\FCkmKMJ.exe
  2⤵
  PID:8568
- C:\Windows\System\OtNcNDj.exe
  C:\Windows\System\OtNcNDj.exe
  2⤵
  PID:9292
- C:\Windows\System\dvwthEC.exe
  C:\Windows\System\dvwthEC.exe
  2⤵
  PID:9328
- C:\Windows\System\EGNReBi.exe
  C:\Windows\System\EGNReBi.exe
  2⤵
  PID:9472
- C:\Windows\System\jItmimQ.exe
  C:\Windows\System\jItmimQ.exe
  2⤵
  PID:8708
- C:\Windows\System\aNoybJC.exe
  C:\Windows\System\aNoybJC.exe
  2⤵
  PID:9232
- C:\Windows\System\QEEKqJY.exe
  C:\Windows\System\QEEKqJY.exe
  2⤵
  PID:9392
- C:\Windows\System\ETHkfxz.exe
  C:\Windows\System\ETHkfxz.exe
  2⤵
  PID:9452
- C:\Windows\System\SbtflcO.exe
  C:\Windows\System\SbtflcO.exe
  2⤵
  PID:9568
- C:\Windows\System\IiHkdNC.exe
  C:\Windows\System\IiHkdNC.exe
  2⤵
  PID:9456
- C:\Windows\System\DgGvesE.exe
  C:\Windows\System\DgGvesE.exe
  2⤵
  PID:9660
- C:\Windows\System\GGbdCzY.exe
  C:\Windows\System\GGbdCzY.exe
  2⤵
  PID:9516
- C:\Windows\System\yQJMfkV.exe
  C:\Windows\System\yQJMfkV.exe
  2⤵
  PID:9552
- C:\Windows\System\fWLRyjB.exe
  C:\Windows\System\fWLRyjB.exe
  2⤵
  PID:9488
- C:\Windows\System\SowXbAV.exe
  C:\Windows\System\SowXbAV.exe
  2⤵
  PID:9788
- C:\Windows\System\FtyPdCT.exe
  C:\Windows\System\FtyPdCT.exe
  2⤵
  PID:9852
- C:\Windows\System\mJapWHP.exe
  C:\Windows\System\mJapWHP.exe
  2⤵
  PID:9708

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

AXACKOg.exe

Path C:\Windows\system\AXACKOg.exe
Size 1.5MB
SHA256 16e64b6ce2760e6ef6e439729470ad9244abb76d5c6998733cb1a1d235d72cd9
MD5 77520b75ddf3626d7a261db1a4126a73
SHA1 3d4bb7d14660075e5ac9eaf99e4405c0aa76d97d
SHA512 6e972eefb95126acf6c191c28c86b57b6cfce6cd3f012091ecdbebb2ad347a67c9ab452ccc6faaf54c4a6dc5c6fa44a6f9e026b513da903324ffc8df9525641e
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkibTJH+2Q/ynKeWYXYcstOyl5EDbjpvZ7Z:Lz071uv4BPMkibTIA5UIV
MD5 SHA1 SHA512 SSDEEP

Submit Download

BjyKrSr.exe

Path C:\Windows\system\BjyKrSr.exe
Size 1.5MB
SHA256 ea6eeefdbf909e9a22aa258024fa7c327fd066b08a113d9f8704c0b222ac821f
MD5 76b20674af6f519ee6700750942317af
SHA1 61fe63177ab5417d5fca07d9dbdbd6fbaf2c3a09
SHA512 91303424188333ea6bded68b6537c2faee558212add07b60ca8505ba0d88bf0d49cf7c9dc78e106c7af966389e777dce146682bb05e483b0b2d71ef79abd9475
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkibTJH+2Q/ynKeWYXYcstOyl5EDbjpvZ78E:Lz071uv4BPMkibTIA5UIH
MD5 SHA1 SHA512 SSDEEP

Submit Download

CnBGjxh.exe

Path C:\Windows\system\CnBGjxh.exe
Size 1.5MB
SHA256 0e1049f9d085da7d3ddc947bfef4f440a699691990487745b0da9fe755bad646
MD5 c218dc94c4a03334d04ec641f009fbca
SHA1 0680ee3dad9ef2ed8a22d604ff9b1b4082cf0e5b
SHA512 3235c5f46dbac9902e127a66e7eeb3befd037f7977171f91270c9bc40c934537c5e59ae8f899565a6ea9c29e472c2e564c648491799d75a857f12eff7e5afa3b
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkibTJH+2Q/ynKeWYXYcstOyl5EDbjpvZ7Z:Lz071uv4BPMkibTIA5UIN
MD5 SHA1 SHA512 SSDEEP

Submit Download

HjtIXUC.exe

Path C:\Windows\system\HjtIXUC.exe
Size 1.5MB
SHA256 1e87591130242dbb13bcba1245dc0d2e8acc83c48b2921c0e922dbc8c001f8d8
MD5 380fc6806e9a5747bc05ddaf3ce0991e
SHA1 2064ffce16ad64ba187a26b073760f383db6ce53
SHA512 f9a5c582de74a89b1fc0d2dc325976c239549ba4f1dd6cbe8aa079cdd344bac19ac62acb3b7c410bcfe0553ab530d1cb49d38d4e8cbc14d5ba4fbf17d6a8836b
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkibTJH+2Q/ynKeWYXYcstOyl5EDbjpvZ7AB:Lz071uv4BPMkibTIA5UIk
MD5 SHA1 SHA512 SSDEEP

Submit Download

JEcXOfY.exe

Path C:\Windows\system\JEcXOfY.exe
Size 8B
SHA256 44dda0d0cfe87b066fcb3ae3e2b0cbc86f86ca0fdd14c7ce736c7a63fedce1f4
MD5 30a9dfceb37577cb23b97b50ee0ca790
SHA1 b56360a546aafbfa7ce003cd05916a7ab7239259
SHA512 f1ae1743e6029aabc9e7387b476be46b30f000874bca6e0907b605cfb329a40abfc7d4eb3d891027c469be0356b370267e0531be7c50ab8183a5aad8ce1cbe57
MD5 SHA1 SHA512

Submit Download

LhQmOxO.exe

Path C:\Windows\system\LhQmOxO.exe
Size 1.5MB
SHA256 4c89e84bb22ab0826f8f91c0a0660052da97a8ac346ec3c2b562329f77c05c8b
MD5 f3ca5da6973ab18cabd36e88cd94b685
SHA1 bbc849d6fc092668c3149f43a780d3f24c0f90cf
SHA512 697a10d8a8704f98f2531c383d3bc1c034c37c44aa9b7557a1a9e700139c4f082fe4c786759315e7f399761c2c12825c7ca593c070c0acc20e1566650f1b0d6e
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkibTJH+2Q/ynKeWYXYcstOyl5EDbjpvZ7B:Lz071uv4BPMkibTIA5UIF
MD5 SHA1 SHA512 SSDEEP

Submit Download

MkhDeQW.exe

Path C:\Windows\system\MkhDeQW.exe
Size 1.5MB
SHA256 54266f0aaf83df5a4f3cedadfa0f0f5d19d4480666fbdeb5a6ff498b47a091f7
MD5 3c1193e313ec603d091a46b51959756a
SHA1 11b63c1722b87682102ce67b0d5bfe9d5b6ef1af
SHA512 a82366bd406c87197a788140b7ed1f7e28b7122d807cf357d39418454aeff41cff62e2680247a0dc9982ce3d5c31bcfb4dfda90e5fc0d08166d7ad317f6e36c8
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkibTJH+2Q/ynKeWYXYcstOyl5EDbjpvZ7M:Lz071uv4BPMkibTIA5UIA
MD5 SHA1 SHA512 SSDEEP

Submit Download

NkITXeV.exe

Path C:\Windows\system\NkITXeV.exe
Size 1.5MB
SHA256 6d19716ff87ccd3ebc39558d249833150df66ec447c2f7b87ccfaf27f29df425
MD5 1f224af69b32731953daf701871a4986
SHA1 4e90f9e0d91c0ab7e520578df98d6f4eae251977
SHA512 f5ae6293f5010a450c5c317c881584aca61d19c816b610ef99e4bcc273ae8693ff8897fe81b96f178bfccc55ae02127a22382962938cfd4e765111137f6f8fb1
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkibTJH+2Q/ynKeWYXYcstOyl5EDbjpvZ7o:Lz071uv4BPMkibTIA5UIc
MD5 SHA1 SHA512 SSDEEP

Submit Download

OZIvahH.exe

Path C:\Windows\system\OZIvahH.exe
Size 1.5MB
SHA256 b7d9614af7a0e84a0b14939314c216c2adbd325417ad99f88b1a3093f75caade
MD5 5f4c0c1f43571591716fbf2c0ff9ffa5
SHA1 26ec224d62eb0b2298a537b9c9bcaeed1b7a0b87
SHA512 502ad9b0136f4b72424885f7dfe524d5fc2377791af45669694048605488867694f8bb131a71bb4c116deec4960adb8c281196a243f950b282072f5b7a5e170f
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkibTJH+2Q/ynKeWYXYcstOyl5EDbjpvZ7J:Lz071uv4BPMkibTIA5UIV
MD5 SHA1 SHA512 SSDEEP

Submit Download

PRehVhD.exe

Path C:\Windows\system\PRehVhD.exe
Size 1.5MB
SHA256 2c81fa27a159ec12ce3dad1c9f6f1104eeae3a88f383c80f63f70a73b6000b1f
MD5 eba8542e63ebec5509fb4fd711e2f123
SHA1 c384056279412d04ab6b651db527c83a8f49de37
SHA512 c9360439382652562e39e32faa9253433405f2b3ffef54f9040ee99961473853375d4b3d11094fc5b6b3912309deb19d58ebca6335d858c7fb29e02802f86a37
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkibTJH+2Q/ynKeWYXYcstOyl5EDbjpvZ7z:Lz071uv4BPMkibTIA5UIX
MD5 SHA1 SHA512 SSDEEP

Submit Download

QxePlXO.exe

Path C:\Windows\system\QxePlXO.exe
Size 1.5MB
SHA256 c6bdc47585059ea0af67d72bafacc7cf48c767a00524f92570c1be432129081e
MD5 77830519d1839d7c7afdb16b7b8c9e23
SHA1 4f2f18fb93ed61283ee540e3225cdd78230729e6
SHA512 2bee5375f0f6872a5e39e7dcefe2f097cf819fb8db814f4ceb7eb46af98be40d706b47afd8856433ec231293165fb518a0f608bc34f49a9faa739c000a01c7d6
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkibTJH+2Q/ynKeWYXYcstOyl5EDbjpvZ7j:Lz071uv4BPMkibTIA5UIf
MD5 SHA1 SHA512 SSDEEP

Submit Download

RCzArfN.exe

Path C:\Windows\system\RCzArfN.exe
Size 1.5MB
SHA256 cf21db64877b640d0d3431a440f270e5b9b76725e05506c90841abbc8939fb33
MD5 86754215b440bf4f0487752c786dc5c4
SHA1 4dda2e371c3ad863f0906b03fa03cb865f250a23
SHA512 edf95fd9545802a0e4be2f46d0d905d2188528d8f01237fbdecd93f23cc6d6371901b8152c36ec93b356bb5a8e6c65a4ceb43ca826e6c9b3d0cd72ca4971242c
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkibTJH+2Q/ynKeWYXYcstOyl5EDbjpvZ7hc:Lz071uv4BPMkibTIA5UIa
MD5 SHA1 SHA512 SSDEEP

Submit Download

SKoPhwZ.exe

Path C:\Windows\system\SKoPhwZ.exe
Size 1.5MB
SHA256 7c8603c2187e095b81caeb3cc80206edf00e6163c3b2b7e7071d3e0ec6aee046
MD5 883660884967fa43c777bed21b86634e
SHA1 d9a6f39c9cda85ec7ec894fd43bd2dce370c19b6
SHA512 fb7c076e2ad0d62185d4de839e1a4d4bdcc5b4d9c2ed0bdb43fac3c1c74658560dff76b4b47333464651c64f00c5325e6587050e28f3b2c7960fa3d7ef58ccc5
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkibTJH+2Q/ynKeWYXYcstOyl5EDbjpvZ7M:Lz071uv4BPMkibTIA5UI4
MD5 SHA1 SHA512 SSDEEP

Submit Download

SQSrnfC.exe

Path C:\Windows\system\SQSrnfC.exe
Size 1.5MB
SHA256 b55f24558386769b63bee2d2ddec88155af6aa37c28b2d4b7368e4e9e4e637be
MD5 147e55dc4787139165f8f287742f40d9
SHA1 09d51af1b553335aa39b75e96e71a1eac6b31b81
SHA512 81b24d1674e4d5dc53480e030300b453a85f09009bccf40b7ae6c3589c7f2cfc40bbaba8110a56e5b87bf7a4fb8a92edaf68bfeced8abf0880240378ba6ba488
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkibTJH+2Q/ynKeWYXYcstOyl5EDbjpvZ7e:Lz071uv4BPMkibTIA5UIy
MD5 SHA1 SHA512 SSDEEP

Submit Download

SaRCGEm.exe

Path C:\Windows\system\SaRCGEm.exe
Size 1.5MB
SHA256 d3e5c466c8c43b88f9422d0d39a2e73bc8c0be1b023dfb58fbc7e32ed49f5a8a
MD5 b4af96f80fce41f474b0484d2899edcf
SHA1 0f9c9beb0e2bf874df2bd570daeb7c05ac087e76
SHA512 f5537b6e39732f5ffb25f2a8c7a948f3173157788bbda472b8d1cf0782779dd1334dd983d425010c44743db5e1e3753289a01eb8f34d3b295f19855d2265a9cd
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkibTJH+2Q/ynKeWYXYcstOyl5EDbjpvZ7x:Lz071uv4BPMkibTIA5UI1
MD5 SHA1 SHA512 SSDEEP

Submit Download

WFXZANh.exe

Path C:\Windows\system\WFXZANh.exe
Size 1.5MB
SHA256 1c7dff01f48e6c478ab8f2847b77b251620cedad118fd15bad54f8a9bbce0bc7
MD5 499cb5714912be0729fd5ed6e8838823
SHA1 fa0eaf051508106423d2018527d234e340cae023
SHA512 35b5bcd8736386ff631ca7b880057ff17e158710a472ce6e3d6caa2c4c0ca7b42535bbd8b12ff37c90b4b6ea7cc6d46f1102848ff9d50e3f990172870dde1d17
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkibTJH+2Q/ynKeWYXYcstOyl5EDbjpvZ7D:Lz071uv4BPMkibTIA5UIv
MD5 SHA1 SHA512 SSDEEP

Submit Download

Wwxzvhf.exe

Path C:\Windows\system\Wwxzvhf.exe
Size 1.5MB
SHA256 8dd4f257efc2b39496aab53a0706c9823c6543f1099b94d4c1df4d22749a8e7a
MD5 6b6d8092a4abc675f1f50697aca528ee
SHA1 78a4cca39c265bc61c2679d6c5e1ee55147da0e5
SHA512 3300297569ece888e55857fde929c0936fcdf2d2ab1133dd83ea60685cd86d5f881804596efbfcc6c9964a7ed6acbf27b457f99ba858e54574edb65149bcd0b6
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkibTJH+2Q/ynKeWYXYcstOyl5EDbjpvZ77:Lz071uv4BPMkibTIA5UIX
MD5 SHA1 SHA512 SSDEEP

Submit Download

gcuBNvU.exe

Path C:\Windows\system\gcuBNvU.exe
Size 1.5MB
SHA256 c5a492b8fd60e694ef05fb27b803a9b02cb34835cae89ab76b2e76491e493216
MD5 76f087969549005a2125237ad9e971ba
SHA1 158844298f84d2cfd09aab8dc32084b8b66f165d
SHA512 35cf6ddfe20ed1505956b2f126ded7e8889548025ce3e4c99c7a6894b8e95edd7b07659176a0656327b2414988397c14cf4f0a6be328b523b11a64d1842d0bfd
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkibTJH+2Q/ynKeWYXYcstOyl5EDbjpvZ7Y:Lz071uv4BPMkibTIA5UIs
MD5 SHA1 SHA512 SSDEEP

Submit Download

geXQyXb.exe

Path C:\Windows\system\geXQyXb.exe
Size 1.5MB
SHA256 116383c9f2533b81871419d9f3793aefd6457e21d019344529b21c11d9edb51c
MD5 893f1f5881cdc364db0906c05c4f0c87
SHA1 e3146cdd14870225e38714d8e416ff7bbd4e28ad
SHA512 f7b4a4aa042643d5409f0c81a378c782d1b7c671e34552335d451594c2a52c33f1bbf7c113d0e362f1dbebb614e88e8b443ef2c7138fda32cb22c7dd8b5924ae
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkibTJH+2Q/ynKeWYXYcstOyl5EDbjpvZ7E:Lz071uv4BPMkibTIA5UIY
MD5 SHA1 SHA512 SSDEEP

Submit Download

gjWTcZC.exe

Path C:\Windows\system\gjWTcZC.exe
Size 1.5MB
SHA256 e14ebeeeca53b47b41fd00718fcd263f47a6ddfbcd96266a649ea5184fdf244e
MD5 fee667c0fa1c2f0715753c79f1caea6c
SHA1 fd7c156e985dbec60fda57c2033c8a764c0e2b5d
SHA512 f3d023af40403242231375dc5e126bff0428630d6e03a90a28df547183c212ad6146fc90bc5c261913836c237a88a96729a2b962ae1aed17b21b7dcb197a6f53
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkibTJH+2Q/ynKeWYXYcstOyl5EDbjpvZ7o:Lz071uv4BPMkibTIA5UIc
MD5 SHA1 SHA512 SSDEEP

Submit Download

jcdVSTU.exe

Path C:\Windows\system\jcdVSTU.exe
Size 1.5MB
SHA256 aba8ef200041bfc4c36e7a6cff63c0534f8f20a6136188efb3e183325b1dae51
MD5 3b844df0a8f189130e8134ca5df281fb
SHA1 d3f5517dc33f538023a75f8bfca14b0c22f572ef
SHA512 e710a70561ab0ff9633d28dff3015aff3c79ae72bf0b0f645c43810976a7a8baed88a96f722b89bb83680d68c84f79623e913ebddac2eff2b7b5322b7cefb059
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkibTJH+2Q/ynKeWYXYcstOyl5EDbjpvZ7S:Lz071uv4BPMkibTIA5UIu
MD5 SHA1 SHA512 SSDEEP

Submit Download

jgpFdaM.exe

Path C:\Windows\system\jgpFdaM.exe
Size 1.5MB
SHA256 395fc16a3aa99e3dd5415368c89fec3be61d2a5609ae991076fbfa1f9f9c61a9
MD5 24d916713af4b190497ec7206f46a611
SHA1 b92db0e88354b1db15a4bdb475fd7e639ea906c3
SHA512 682d3ab7e73854751e13112550356dd3436b08d5fb1b7d15bf7ebaa2db0d220b5d4aee27ea8fa9ef2c8686a540ba750494a3a54a9956ea352d3b48282793f9b1
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkibTJH+2Q/ynKeWYXYcstOyl5EDbjpvZ7r:Lz071uv4BPMkibTIA5UI3
MD5 SHA1 SHA512 SSDEEP

Submit Download

lMRKviW.exe

Path C:\Windows\system\lMRKviW.exe
Size 1.5MB
SHA256 37b3e19b8a4ade0551995dc691ff2247eb00786e9fdc757f3b53975e41e2bfa4
MD5 8a1e5d66b77650d2470222ddcb3644d8
SHA1 0051a9fcae067c6af8c2324ebcfb9707e73cc91e
SHA512 e1a2b2868cf2d7d188c5524002b9a762b9387371888b725b878e63fe999a1ccccf72bad928401ddae408d3dbc8cc80ee9159a2e04c143673afc452e4150bd1a5
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkibTJH+2Q/ynKeWYXYcstOyl5EDbjpvZ7w:Lz071uv4BPMkibTIA5UIU
MD5 SHA1 SHA512 SSDEEP

Submit Download

liOXSuc.exe

Path C:\Windows\system\liOXSuc.exe
Size 1.5MB
SHA256 0ea1185551fe39748edbc9e4b5585db9f3a4394b0ccdda915365352839393058
MD5 2a62f92f694d1e27dc7bef87768e0a07
SHA1 51fab3d33efd740f645a55cf34c8726cf07cd766
SHA512 eac107343f1d625c91acd12bcd5627d6ff2257eb2d99fbedb2cb4da79a445fa906ebdf38dfcd4737fefb388b26875e48d6fc892802e339918cb6843bbba42793
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkibTJH+2Q/ynKeWYXYcstOyl5EDbjpvZ7H:Lz071uv4BPMkibTIA5UIj
MD5 SHA1 SHA512 SSDEEP

Submit Download

lkZfMzm.exe

Path C:\Windows\system\lkZfMzm.exe
Size 1.5MB
SHA256 e788b7a364f61fd5f938d364436b9c7a80f8bd2a1dde79e27f6143a72ec2f38e
MD5 1d43215971eb1cd62447725b441cc757
SHA1 64754f7bafac9c5a244a8c8dad792be3bb3a871c
SHA512 d34c98faa5f8e079705df807cbaa2abe6f09851170f968554f29ebea355b13387fb18c7923c032b2e35ef4118d97a8a9dfc35027eda1d84495771a9f64954760
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkibTJH+2Q/ynKeWYXYcstOyl5EDbjpvZ77:Lz071uv4BPMkibTIA5UIH
MD5 SHA1 SHA512 SSDEEP

Submit Download

tXiZvAB.exe

Path C:\Windows\system\tXiZvAB.exe
Size 1.5MB
SHA256 a3301f97002d28c3f55d29deee2ee088b6fe3dc768d62d70462522de81f618c3
MD5 97711b2ef7aee506a13178bb92969ec7
SHA1 2d1a8cb33b6746775751154c790291e3ff743a64
SHA512 634dc7c51668028c36adca384faf3c8dee048971263c75e0d38011fdb3391f671efb390047806271b59e0c2ed521b4ed10e703eb410c4b3ff530c33d53590167
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkibTJH+2Q/ynKeWYXYcstOyl5EDbjpvZ7H:Lz071uv4BPMkibTIA5UIb
MD5 SHA1 SHA512 SSDEEP

Submit Download

tbcTSDH.exe

Path C:\Windows\system\tbcTSDH.exe
Size 1.5MB
SHA256 664a7ed0fe7fdb5f20dd6236e4a643263d7fc938701d3fc7a10ffa42645ab78f
MD5 e9310bcab65942e33db2d3452ad83891
SHA1 13bf78ef975ad670fb1d32047188f034390b2310
SHA512 bfeeb633d918a0dedacc8586b3ebed81d64d36e5fcf40cd126d8dd91e3eab8ef448bc26a5e300fbc4a0ea80625d46d9c3811a8db8523ee9aed5930e77e927d6d
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkibTJH+2Q/ynKeWYXYcstOyl5EDbjpvZ7D:Lz071uv4BPMkibTIA5UI3
MD5 SHA1 SHA512 SSDEEP

Submit Download

wMxFdDa.exe

Path C:\Windows\system\wMxFdDa.exe
Size 1.5MB
SHA256 49207bfcf0674f59c71d6a7f1cb5b865fb5e0a30db6481df6cecdffb16742114
MD5 56a5089b43d7370fd80b9551d2e8dc7d
SHA1 12e5ef70846103af8ca2a5d4bfb200fd1f650396
SHA512 93a9c8e76f776bbc7766e52b51ab8f41f18bce289af08147a63f54703caa7c446739aa4d2bb5b578be21f75736ccf92bd9e1c1f4fff2cb9bb08b09648174e668
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkibTJH+2Q/ynKeWYXYcstOyl5EDbjpvZ7L4:Lz071uv4BPMkibTIA5UIX4
MD5 SHA1 SHA512 SSDEEP

Submit Download

yqogJXn.exe

Path C:\Windows\system\yqogJXn.exe
Size 1.5MB
SHA256 759de2520e197f9b5b66a2fdadb945d27fec8cb620405b9edfe5846b6aba3397
MD5 609c7aac5bf716bdaf84001b529441bb
SHA1 8d50cb114997280dac76d3212e188407a9b2aa70
SHA512 83d0cb72c65354978554388e5922ed004a75ee9a4a2ffe97564d2c2fbb67f308a664d68bec1fb36934430485d4b50858ee9f3b2174e5cc33e8176113f3eae88d
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkibTJH+2Q/ynKeWYXYcstOyl5EDbjpvZ7R:Lz071uv4BPMkibTIA5UI9
MD5 SHA1 SHA512 SSDEEP

Submit Download

yznZRhJ.exe

Path C:\Windows\system\yznZRhJ.exe
Size 1.5MB
SHA256 19b97a5e602b366fc1712e1f622d17df6ac46ece3162313dc462623a16ce1454
MD5 caee31705e882448b70c351d87adeb1d
SHA1 45e98cedcdd2b5421f36d1faab141c3a1f109fd3
SHA512 507b590ca452a18b6c23455b892bb301a7a2e068dbb33b9cc0b6bdeef8ac0e969e32c0e9f65e6ed1d4e6f429a7580e830b8b6d759512926c40ef2c76e978d669
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkibTJH+2Q/ynKeWYXYcstOyl5EDbjpvZ7laU:Lz071uv4BPMkibTIA5UIJx
MD5 SHA1 SHA512 SSDEEP

Submit Download

DHZebdW.exe

Path \Windows\system\DHZebdW.exe
Size 1.5MB
SHA256 eb4ee239c2cf45fcd9ad51c397d09384a744650ade48b6da54b0834018672dbf
MD5 8c46f4c6994a13cc06930ecd504263cd
SHA1 f7a0638b2378cf2812916b8766c014258eb5ac1c
SHA512 17530822d8df326ad8ecf0e7cd32025f0161560cf59da6ab15653c0ff3232ced81e7b0fca6813264b00f6466f9b2ea9bd18351f22523679250172971b4aee0e2
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkibTJH+2Q/ynKeWYXYcstOyl5EDbjpvZ7Bp:Lz071uv4BPMkibTIA5UI/
MD5 SHA1 SHA512 SSDEEP

Submit Download

HjtIXUC.exe

Path \Windows\system\HjtIXUC.exe
Size 1.2MB
SHA256 d1a8829eea2de52fce57f027320fcc5df91a5780487631d2ab99baec6421c88f
MD5 50ed8e339403fe5f458df67aebddffa2
SHA1 a8b174a8aab1c291e93aad28008a4b3a3b24a377
SHA512 c1f706d6d673a1fede5b8e54aca435badbc29a3afd11fc713b842e561dbe839fe915a8c7bd88b4ebc1442441835619228d9c3d8db7a03b9e1428d56fcf70e67e
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkibTJH+2Q/ynKeWYXYcstOyl5j:Lz071uv4BPMkibTIA5UH
MD5 SHA1 SHA512 SSDEEP

Submit Download

KtAtOAG.exe

Path \Windows\system\KtAtOAG.exe
Size 1.5MB
SHA256 f6d3a1b374687fa615ccde13490d566cf9fd8ff19d85237a9813cc2b99cc4d17
MD5 61a16dd60f959358f01d813645df5f1e
SHA1 850f5c9450c9ab6bacae84d519c5974a372f59d7
SHA512 c1b29764395626d35c45a02867a9785c23d4915aa772982b698bdf18ab15f53a7c887cd563d90a658217b759fe02a319704060be05f43c29ded53a06d650ae0f
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkibTJH+2Q/ynKeWYXYcstOyl5EDbjpvZ7+:Lz071uv4BPMkibTIA5UIS
MD5 SHA1 SHA512 SSDEEP

Submit Download

OZIvahH.exe

Path \Windows\system\OZIvahH.exe
Size 1.1MB
SHA256 c9d2017096a5794320158ddc4ee5781e0f407702430787b1e442d629aa6ece15
MD5 cadeec7d600c24c8d8f9dc57acf05b30
SHA1 a4fc720c8c69b2c5c7cee64104627d65cef273c0
SHA512 446e9c15367498aeed714f8506d770b5b953bb6b076268031fd62372a28ca2686e30c7a317b3c7c6cf03105478c99d43dd39ab00522f27995b95ab2015f06654
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkibTJH+2Q/ynKeWYXYcsv:Lz071uv4BPMkibTIA5w
MD5 SHA1 SHA512 SSDEEP

Submit Download

SaRCGEm.exe

Path \Windows\system\SaRCGEm.exe
Size 1.4MB
SHA256 6f9e04ea05cf130bb2611f57894bc776c0ddfde8bcf13b187bad44cc9ce4df88
MD5 039eef7f28f42f5c5e8be175ddb970a3
SHA1 128072bf6058b854ce9d19cfdd41f5261dcb2f53
SHA512 86908a5aae79932e9991abf2558840ccd77beee8559201f71aec176ac6335017193bbdb81f45211a184c4f1b9111ce764051f7eb89963b2d47596d3a0edf87f4
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkibTJH+2Q/ynKeWYXYcstOyl5EDbjpvZM:Lz071uv4BPMkibTIA5UIU
MD5 SHA1 SHA512 SSDEEP

Submit Download

Wwxzvhf.exe

Path \Windows\system\Wwxzvhf.exe
Size 1.1MB
SHA256 3a996644484a8d05fc40b16bd75a1c5deb8289323f3ff480b3edfaa967d6b3ca
MD5 aef478be21a2080c6d22ed0151a0a7ef
SHA1 fbb917454c0122cbf18ab76852faaa5f9481ce63
SHA512 ff1a08fee46ccb01986fc86391d1401dd14aa96fae826bbb33a027bc9179a9c3476c3d1b11091623b62d27696958fff8aa18e3893fda6e5bd73e4671e01e2f56
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkibTJH+2Q/ynKeWYXYcstOyl54:Lz071uv4BPMkibTIA5U8
MD5 SHA1 SHA512 SSDEEP

Submit Download

ychNngB.exe

Path \Windows\system\ychNngB.exe
Size 1.5MB
SHA256 ee63c7c49b2ab6caa6475301351d617926f2c738885116e457e2ef1bef8b53f7
MD5 5aabde85a479efc24b1f17889b05f565
SHA1 4afa0b2b955f6c0506f89d2984160a7d5076d08e
SHA512 b6693877359b02b1995f539a3d1874e67d11ce08f366a2d2192044bda9de5b212625f90832c752214f72a952ee572df3e450e22cd9147102c82eeacfb0034fc2
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkibTJH+2Q/ynKeWYXYcstOyl5EDbjpvZ7Y:Lz071uv4BPMkibTIA5UIE
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1312-4574-0x000000013F240000-0x000000013F632000-memory.dmp

Download

memory/1312-94-0x000000013F240000-0x000000013F632000-memory.dmp

Download

memory/1920-4687-0x000000013FEC0000-0x00000001402B2000-memory.dmp

Download

memory/1920-112-0x000000013FEC0000-0x00000001402B2000-memory.dmp

Download

memory/2196-91-0x000007FEF5D60000-0x000007FEF66FD000-memory.dmp

Download

memory/2196-31-0x0000000001FC0000-0x0000000001FC8000-memory.dmp

Download

memory/2196-114-0x000007FEF5D60000-0x000007FEF66FD000-memory.dmp

Download

memory/2196-67-0x000007FEF5D60000-0x000007FEF66FD000-memory.dmp

Download

memory/2196-25-0x000000001B690000-0x000000001B972000-memory.dmp

Download

memory/2196-15-0x000007FEF601E000-0x000007FEF601F000-memory.dmp

Download

memory/2196-14-0x0000000002910000-0x0000000002990000-memory.dmp

Download

memory/2448-71-0x000000013F5A0000-0x000000013F992000-memory.dmp

Download

memory/2448-4573-0x000000013F5A0000-0x000000013F992000-memory.dmp

Download

memory/2452-105-0x000000013FDD0000-0x00000001401C2000-memory.dmp

Download

memory/2452-4689-0x000000013FDD0000-0x00000001401C2000-memory.dmp

Download

memory/2480-4603-0x000000013F7E0000-0x000000013FBD2000-memory.dmp

Download

memory/2480-96-0x000000013F7E0000-0x000000013FBD2000-memory.dmp

Download

memory/2496-4708-0x000000013F4F0000-0x000000013F8E2000-memory.dmp

Download

memory/2496-103-0x000000013F4F0000-0x000000013F8E2000-memory.dmp

Download

memory/2576-4690-0x000000013F790000-0x000000013FB82000-memory.dmp

Download

memory/2576-101-0x000000013F790000-0x000000013FB82000-memory.dmp

Download

memory/2608-4685-0x000000013F800000-0x000000013FBF2000-memory.dmp

Download

memory/2608-107-0x000000013F800000-0x000000013FBF2000-memory.dmp

Download

memory/2624-4693-0x000000013F740000-0x000000013FB32000-memory.dmp

Download

memory/2624-115-0x000000013F740000-0x000000013FB32000-memory.dmp

Download

memory/2668-4570-0x000000013F330000-0x000000013F722000-memory.dmp

Download

memory/2668-68-0x000000013F330000-0x000000013F722000-memory.dmp

Download

memory/2684-109-0x000000013F7D0000-0x000000013FBC2000-memory.dmp

Download

memory/2684-4824-0x000000013F7D0000-0x000000013FBC2000-memory.dmp

Download

memory/2740-117-0x0000000003270000-0x0000000003662000-memory.dmp

Download

memory/2740-116-0x0000000003270000-0x0000000003662000-memory.dmp

Download

memory/2740-93-0x0000000003270000-0x0000000003662000-memory.dmp

Download

memory/2740-95-0x0000000003270000-0x0000000003662000-memory.dmp

Download

memory/2740-111-0x000000013FEC0000-0x00000001402B2000-memory.dmp

Download

memory/2740-104-0x000000013FDD0000-0x00000001401C2000-memory.dmp

Download

memory/2740-70-0x0000000003270000-0x0000000003662000-memory.dmp

Download

memory/2740-11596-0x0000000003270000-0x0000000003662000-memory.dmp

Download

memory/2740-102-0x0000000003270000-0x0000000003662000-memory.dmp

Download

memory/2740-97-0x0000000003270000-0x0000000003662000-memory.dmp

Download

memory/2740-11-0x000000013FAB0000-0x000000013FEA2000-memory.dmp

Download

memory/2740-108-0x0000000003270000-0x0000000003662000-memory.dmp

Download

memory/2740-106-0x0000000003270000-0x0000000003662000-memory.dmp

Download

memory/2740-11593-0x0000000003270000-0x0000000003662000-memory.dmp

Download

memory/2740-1-0x000000013F5B0000-0x000000013F9A2000-memory.dmp

Download

memory/2740-0-0x00000000001F0000-0x0000000000200000-memory.dmp

Download

memory/2740-8491-0x000000013F5B0000-0x000000013F9A2000-memory.dmp

Download

memory/2740-9704-0x0000000003270000-0x0000000003662000-memory.dmp

Download

memory/2992-13-0x000000013FAB0000-0x000000013FEA2000-memory.dmp

Download

memory/2992-4568-0x000000013FAB0000-0x000000013FEA2000-memory.dmp

Download