xmrig | f4410654c249ef51a47784f538c26676671aba86cc0c5e7fb6f1174c29a6f72b

Analysis

max time kernel
150s
max time network
148s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
10/06/2024, 14:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

191f157dda35363ac8f6b1f300b62e30_NeikiAnalytics.exe
Size

2.8MB
MD5

191f157dda35363ac8f6b1f300b62e30
SHA1

5bd0a411567a80fdcc7b763863016d7c19d3ad22
SHA256

f4410654c249ef51a47784f538c26676671aba86cc0c5e7fb6f1174c29a6f72b
SHA512

bf58c54619fd4273af1dc3a21455841122d70cf0603b500e8e2140dcf66b759c1c288a3e582e18927dc5fc35a2cbbae45b42c70649df145f775848d5b6d80d36
SSDEEP

49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0IlnASEx/Rib:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R1

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 54 IoCs

miner

resource	yara_rule
behavioral1/memory/2432-1-0x000000013F3F0000-0x000000013F7E6000-memory.dmp	xmrig
behavioral1/files/0x000c00000001227b-3.dat	xmrig
behavioral1/files/0x00080000000145d4-13.dat	xmrig
behavioral1/files/0x000700000001474b-27.dat	xmrig
behavioral1/files/0x000700000001475f-28.dat	xmrig
behavioral1/memory/2676-37-0x000000013FEE0000-0x00000001402D6000-memory.dmp	xmrig
behavioral1/memory/2572-50-0x000000013F740000-0x000000013FB36000-memory.dmp	xmrig
behavioral1/memory/3032-72-0x000000013FE50000-0x0000000140246000-memory.dmp	xmrig
behavioral1/files/0x0007000000015ced-89.dat	xmrig
behavioral1/files/0x0006000000015cc2-51.dat	xmrig
behavioral1/files/0x0006000000015d99-132.dat	xmrig
behavioral1/files/0x000600000001650f-172.dat	xmrig
behavioral1/files/0x000600000001640f-167.dat	xmrig
behavioral1/files/0x0006000000016591-180.dat	xmrig
behavioral1/files/0x0006000000016a3a-186.dat	xmrig
behavioral1/files/0x0006000000016c3a-189.dat	xmrig
behavioral1/files/0x00060000000167e8-184.dat	xmrig
behavioral1/files/0x003000000001451d-162.dat	xmrig
behavioral1/files/0x0006000000016228-158.dat	xmrig
behavioral1/files/0x0006000000016020-147.dat	xmrig
behavioral1/files/0x0006000000015f40-137.dat	xmrig
behavioral1/files/0x0006000000016126-152.dat	xmrig
behavioral1/files/0x0006000000015fbb-142.dat	xmrig
behavioral1/files/0x0006000000015d89-127.dat	xmrig
behavioral1/files/0x0006000000015d28-122.dat	xmrig
behavioral1/files/0x0006000000015d1e-118.dat	xmrig
behavioral1/files/0x0006000000015d02-116.dat	xmrig
behavioral1/files/0x00130000000054a8-114.dat	xmrig
behavioral1/files/0x0006000000015cd8-112.dat	xmrig
behavioral1/memory/2792-96-0x000000013FBE0000-0x000000013FFD6000-memory.dmp	xmrig
behavioral1/memory/2432-95-0x000000013FBA0000-0x000000013FF96000-memory.dmp	xmrig
behavioral1/memory/2196-85-0x000000013F6B0000-0x000000013FAA6000-memory.dmp	xmrig
behavioral1/files/0x0007000000015c9b-46.dat	xmrig
behavioral1/files/0x00070000000148af-44.dat	xmrig
behavioral1/files/0x0006000000015d13-103.dat	xmrig
behavioral1/files/0x00080000000146a7-32.dat	xmrig
behavioral1/memory/2748-30-0x000000013F150000-0x000000013F546000-memory.dmp	xmrig
behavioral1/memory/2580-92-0x000000013FAC0000-0x000000013FEB6000-memory.dmp	xmrig
behavioral1/memory/2396-83-0x000000013FA80000-0x000000013FE76000-memory.dmp	xmrig
behavioral1/files/0x0006000000015cf5-82.dat	xmrig
behavioral1/memory/2692-78-0x000000013F9B0000-0x000000013FDA6000-memory.dmp	xmrig
behavioral1/memory/2832-76-0x000000013FF10000-0x0000000140306000-memory.dmp	xmrig
behavioral1/files/0x0006000000015cca-59.dat	xmrig
behavioral1/files/0x0006000000015ca9-58.dat	xmrig
behavioral1/memory/3056-21-0x000000013F940000-0x000000013FD36000-memory.dmp	xmrig
behavioral1/files/0x00310000000144d6-19.dat	xmrig
behavioral1/memory/2676-6547-0x000000013FEE0000-0x00000001402D6000-memory.dmp	xmrig
behavioral1/memory/2692-6563-0x000000013F9B0000-0x000000013FDA6000-memory.dmp	xmrig
behavioral1/memory/3032-6573-0x000000013FE50000-0x0000000140246000-memory.dmp	xmrig
behavioral1/memory/2396-6572-0x000000013FA80000-0x000000013FE76000-memory.dmp	xmrig
behavioral1/memory/2196-6612-0x000000013F6B0000-0x000000013FAA6000-memory.dmp	xmrig
behavioral1/memory/2832-6605-0x000000013FF10000-0x0000000140306000-memory.dmp	xmrig
behavioral1/memory/2792-6604-0x000000013FBE0000-0x000000013FFD6000-memory.dmp	xmrig
behavioral1/memory/2432-6634-0x000000013F3F0000-0x000000013F7E6000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
2188	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
3056	HrPnvDG.exe
2748	qarKSXg.exe
2676	nAQySpf.exe
2832	TSvXbgr.exe
2692	EHjBVjW.exe
2572	rBmRtDI.exe
2396	EHeqwsB.exe
2196	BManMjD.exe
2580	VtahboA.exe
3032	JXvwuGQ.exe
2792	fnEZazH.exe
2340	jHpqMtH.exe
2016	kFIBpNT.exe
2704	aoyOPPz.exe
608	duhlYKh.exe
2972	KyLejch.exe
1804	lKylMmn.exe
1864	ZOrFwnB.exe
2404	MOwNMSP.exe
308	jWcobHm.exe
1680	fauOUdx.exe
2632	vSPOYcG.exe
2300	yuZcGYX.exe
1376	FfoOfMG.exe
2924	dZamctf.exe
1292	YywYACZ.exe
576	KapoxYy.exe
1484	FRIXCVw.exe
1792	liFtjNP.exe
2064	GEQhyWY.exe
2504	mqfdbzY.exe
956	eIrkdbL.exe
1556	sJzCCbJ.exe
1328	bBMykZn.exe
1904	amBwbSX.exe
1908	JushFAW.exe
1148	YxdtVtI.exe
1688	mDKHjuQ.exe
980	gUrRiBF.exe
2108	wCsxnyM.exe
2092	HceyfJN.exe
2952	AyIstZM.exe
3048	IBznzEQ.exe
1584	ftgBiVC.exe
2736	NbvrHsT.exe
2608	mfEXCys.exe
348	xgVtIQi.exe
2896	BRgtPLB.exe
2812	KwRzzUD.exe
2784	abkAxER.exe
2448	KFDyaOW.exe
324	WGbYcQC.exe
2112	DBUhsww.exe
1720	gCeUFLK.exe
1940	zZgVhJK.exe
1228	PZrlWZk.exe
3040	nXnwVYX.exe
2256	WaRTDIR.exe
2684	OrWrawr.exe
2540	MVSFPbd.exe
2056	ehQaKCe.exe
3012	qpxKAwB.exe
3080	SWUWtwB.exe
3112	IzxIKWs.exe

Loads dropped DLL 64 IoCs

pid	Process
2432	191f157dda35363ac8f6b1f300b62e30_NeikiAnalytics.exe
2432	191f157dda35363ac8f6b1f300b62e30_NeikiAnalytics.exe
2432	191f157dda35363ac8f6b1f300b62e30_NeikiAnalytics.exe
2432	191f157dda35363ac8f6b1f300b62e30_NeikiAnalytics.exe
2432	191f157dda35363ac8f6b1f300b62e30_NeikiAnalytics.exe
2432	191f157dda35363ac8f6b1f300b62e30_NeikiAnalytics.exe
2432	191f157dda35363ac8f6b1f300b62e30_NeikiAnalytics.exe
2432	191f157dda35363ac8f6b1f300b62e30_NeikiAnalytics.exe
2432	191f157dda35363ac8f6b1f300b62e30_NeikiAnalytics.exe
2432	191f157dda35363ac8f6b1f300b62e30_NeikiAnalytics.exe
2432	191f157dda35363ac8f6b1f300b62e30_NeikiAnalytics.exe
2432	191f157dda35363ac8f6b1f300b62e30_NeikiAnalytics.exe
2432	191f157dda35363ac8f6b1f300b62e30_NeikiAnalytics.exe
2432	191f157dda35363ac8f6b1f300b62e30_NeikiAnalytics.exe
2432	191f157dda35363ac8f6b1f300b62e30_NeikiAnalytics.exe
2432	191f157dda35363ac8f6b1f300b62e30_NeikiAnalytics.exe
2432	191f157dda35363ac8f6b1f300b62e30_NeikiAnalytics.exe
2432	191f157dda35363ac8f6b1f300b62e30_NeikiAnalytics.exe
2432	191f157dda35363ac8f6b1f300b62e30_NeikiAnalytics.exe
2432	191f157dda35363ac8f6b1f300b62e30_NeikiAnalytics.exe
2432	191f157dda35363ac8f6b1f300b62e30_NeikiAnalytics.exe
2432	191f157dda35363ac8f6b1f300b62e30_NeikiAnalytics.exe
2432	191f157dda35363ac8f6b1f300b62e30_NeikiAnalytics.exe
2432	191f157dda35363ac8f6b1f300b62e30_NeikiAnalytics.exe
2432	191f157dda35363ac8f6b1f300b62e30_NeikiAnalytics.exe
2432	191f157dda35363ac8f6b1f300b62e30_NeikiAnalytics.exe
2432	191f157dda35363ac8f6b1f300b62e30_NeikiAnalytics.exe
2432	191f157dda35363ac8f6b1f300b62e30_NeikiAnalytics.exe
2432	191f157dda35363ac8f6b1f300b62e30_NeikiAnalytics.exe
2432	191f157dda35363ac8f6b1f300b62e30_NeikiAnalytics.exe
2432	191f157dda35363ac8f6b1f300b62e30_NeikiAnalytics.exe
2432	191f157dda35363ac8f6b1f300b62e30_NeikiAnalytics.exe
2432	191f157dda35363ac8f6b1f300b62e30_NeikiAnalytics.exe
2432	191f157dda35363ac8f6b1f300b62e30_NeikiAnalytics.exe
2432	191f157dda35363ac8f6b1f300b62e30_NeikiAnalytics.exe
2432	191f157dda35363ac8f6b1f300b62e30_NeikiAnalytics.exe
2432	191f157dda35363ac8f6b1f300b62e30_NeikiAnalytics.exe
2432	191f157dda35363ac8f6b1f300b62e30_NeikiAnalytics.exe
2432	191f157dda35363ac8f6b1f300b62e30_NeikiAnalytics.exe
2432	191f157dda35363ac8f6b1f300b62e30_NeikiAnalytics.exe
2432	191f157dda35363ac8f6b1f300b62e30_NeikiAnalytics.exe
2432	191f157dda35363ac8f6b1f300b62e30_NeikiAnalytics.exe
2432	191f157dda35363ac8f6b1f300b62e30_NeikiAnalytics.exe
2432	191f157dda35363ac8f6b1f300b62e30_NeikiAnalytics.exe
2432	191f157dda35363ac8f6b1f300b62e30_NeikiAnalytics.exe
2432	191f157dda35363ac8f6b1f300b62e30_NeikiAnalytics.exe
2432	191f157dda35363ac8f6b1f300b62e30_NeikiAnalytics.exe
2432	191f157dda35363ac8f6b1f300b62e30_NeikiAnalytics.exe
2432	191f157dda35363ac8f6b1f300b62e30_NeikiAnalytics.exe
2432	191f157dda35363ac8f6b1f300b62e30_NeikiAnalytics.exe
2432	191f157dda35363ac8f6b1f300b62e30_NeikiAnalytics.exe
2432	191f157dda35363ac8f6b1f300b62e30_NeikiAnalytics.exe
2432	191f157dda35363ac8f6b1f300b62e30_NeikiAnalytics.exe
2432	191f157dda35363ac8f6b1f300b62e30_NeikiAnalytics.exe
2432	191f157dda35363ac8f6b1f300b62e30_NeikiAnalytics.exe
2432	191f157dda35363ac8f6b1f300b62e30_NeikiAnalytics.exe
2432	191f157dda35363ac8f6b1f300b62e30_NeikiAnalytics.exe
2432	191f157dda35363ac8f6b1f300b62e30_NeikiAnalytics.exe
2432	191f157dda35363ac8f6b1f300b62e30_NeikiAnalytics.exe
2432	191f157dda35363ac8f6b1f300b62e30_NeikiAnalytics.exe
2432	191f157dda35363ac8f6b1f300b62e30_NeikiAnalytics.exe
2432	191f157dda35363ac8f6b1f300b62e30_NeikiAnalytics.exe
2432	191f157dda35363ac8f6b1f300b62e30_NeikiAnalytics.exe
2432	191f157dda35363ac8f6b1f300b62e30_NeikiAnalytics.exe

UPX packed file 53 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2432-1-0x000000013F3F0000-0x000000013F7E6000-memory.dmp	upx
behavioral1/files/0x000c00000001227b-3.dat	upx
behavioral1/files/0x00080000000145d4-13.dat	upx
behavioral1/files/0x000700000001474b-27.dat	upx
behavioral1/files/0x000700000001475f-28.dat	upx
behavioral1/memory/2676-37-0x000000013FEE0000-0x00000001402D6000-memory.dmp	upx
behavioral1/memory/2572-50-0x000000013F740000-0x000000013FB36000-memory.dmp	upx
behavioral1/memory/3032-72-0x000000013FE50000-0x0000000140246000-memory.dmp	upx
behavioral1/files/0x0007000000015ced-89.dat	upx
behavioral1/files/0x0006000000015cc2-51.dat	upx
behavioral1/files/0x0006000000015d99-132.dat	upx
behavioral1/files/0x000600000001650f-172.dat	upx
behavioral1/files/0x000600000001640f-167.dat	upx
behavioral1/files/0x0006000000016591-180.dat	upx
behavioral1/files/0x0006000000016a3a-186.dat	upx
behavioral1/files/0x0006000000016c3a-189.dat	upx
behavioral1/files/0x00060000000167e8-184.dat	upx
behavioral1/files/0x003000000001451d-162.dat	upx
behavioral1/files/0x0006000000016228-158.dat	upx
behavioral1/files/0x0006000000016020-147.dat	upx
behavioral1/files/0x0006000000015f40-137.dat	upx
behavioral1/files/0x0006000000016126-152.dat	upx
behavioral1/files/0x0006000000015fbb-142.dat	upx
behavioral1/files/0x0006000000015d89-127.dat	upx
behavioral1/files/0x0006000000015d28-122.dat	upx
behavioral1/files/0x0006000000015d1e-118.dat	upx
behavioral1/files/0x0006000000015d02-116.dat	upx
behavioral1/files/0x00130000000054a8-114.dat	upx
behavioral1/files/0x0006000000015cd8-112.dat	upx
behavioral1/memory/2792-96-0x000000013FBE0000-0x000000013FFD6000-memory.dmp	upx
behavioral1/memory/2196-85-0x000000013F6B0000-0x000000013FAA6000-memory.dmp	upx
behavioral1/files/0x0007000000015c9b-46.dat	upx
behavioral1/files/0x00070000000148af-44.dat	upx
behavioral1/files/0x0006000000015d13-103.dat	upx
behavioral1/files/0x00080000000146a7-32.dat	upx
behavioral1/memory/2748-30-0x000000013F150000-0x000000013F546000-memory.dmp	upx
behavioral1/memory/2580-92-0x000000013FAC0000-0x000000013FEB6000-memory.dmp	upx
behavioral1/memory/2396-83-0x000000013FA80000-0x000000013FE76000-memory.dmp	upx
behavioral1/files/0x0006000000015cf5-82.dat	upx
behavioral1/memory/2692-78-0x000000013F9B0000-0x000000013FDA6000-memory.dmp	upx
behavioral1/memory/2832-76-0x000000013FF10000-0x0000000140306000-memory.dmp	upx
behavioral1/files/0x0006000000015cca-59.dat	upx
behavioral1/files/0x0006000000015ca9-58.dat	upx
behavioral1/memory/3056-21-0x000000013F940000-0x000000013FD36000-memory.dmp	upx
behavioral1/files/0x00310000000144d6-19.dat	upx
behavioral1/memory/2676-6547-0x000000013FEE0000-0x00000001402D6000-memory.dmp	upx
behavioral1/memory/2692-6563-0x000000013F9B0000-0x000000013FDA6000-memory.dmp	upx
behavioral1/memory/3032-6573-0x000000013FE50000-0x0000000140246000-memory.dmp	upx
behavioral1/memory/2396-6572-0x000000013FA80000-0x000000013FE76000-memory.dmp	upx
behavioral1/memory/2196-6612-0x000000013F6B0000-0x000000013FAA6000-memory.dmp	upx
behavioral1/memory/2832-6605-0x000000013FF10000-0x0000000140306000-memory.dmp	upx
behavioral1/memory/2792-6604-0x000000013FBE0000-0x000000013FFD6000-memory.dmp	upx
behavioral1/memory/2432-6634-0x000000013F3F0000-0x000000013F7E6000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\hPyZYPl.exe	191f157dda35363ac8f6b1f300b62e30_NeikiAnalytics.exe
File created	C:\Windows\System\gRfOhMb.exe	191f157dda35363ac8f6b1f300b62e30_NeikiAnalytics.exe
File created	C:\Windows\System\vDnjEcB.exe	191f157dda35363ac8f6b1f300b62e30_NeikiAnalytics.exe
File created	C:\Windows\System\NFSOwuH.exe	191f157dda35363ac8f6b1f300b62e30_NeikiAnalytics.exe
File created	C:\Windows\System\cUODhjf.exe	191f157dda35363ac8f6b1f300b62e30_NeikiAnalytics.exe
File created	C:\Windows\System\BmkTwwE.exe	191f157dda35363ac8f6b1f300b62e30_NeikiAnalytics.exe
File created	C:\Windows\System\rhcDHgm.exe	191f157dda35363ac8f6b1f300b62e30_NeikiAnalytics.exe
File created	C:\Windows\System\IMGFQEl.exe	191f157dda35363ac8f6b1f300b62e30_NeikiAnalytics.exe
File created	C:\Windows\System\apoYUch.exe	191f157dda35363ac8f6b1f300b62e30_NeikiAnalytics.exe
File created	C:\Windows\System\wvqpLPo.exe	191f157dda35363ac8f6b1f300b62e30_NeikiAnalytics.exe
File created	C:\Windows\System\zQVaNCO.exe	191f157dda35363ac8f6b1f300b62e30_NeikiAnalytics.exe
File created	C:\Windows\System\aEDyxwG.exe	191f157dda35363ac8f6b1f300b62e30_NeikiAnalytics.exe
File created	C:\Windows\System\NpcgLeu.exe	191f157dda35363ac8f6b1f300b62e30_NeikiAnalytics.exe
File created	C:\Windows\System\FWigfwo.exe	191f157dda35363ac8f6b1f300b62e30_NeikiAnalytics.exe
File created	C:\Windows\System\IDcAlLj.exe	191f157dda35363ac8f6b1f300b62e30_NeikiAnalytics.exe
File created	C:\Windows\System\EzThfmj.exe	191f157dda35363ac8f6b1f300b62e30_NeikiAnalytics.exe
File created	C:\Windows\System\ZpHupMD.exe	191f157dda35363ac8f6b1f300b62e30_NeikiAnalytics.exe
File created	C:\Windows\System\VMcibjS.exe	191f157dda35363ac8f6b1f300b62e30_NeikiAnalytics.exe
File created	C:\Windows\System\GOKbWNr.exe	191f157dda35363ac8f6b1f300b62e30_NeikiAnalytics.exe
File created	C:\Windows\System\vfyLWXL.exe	191f157dda35363ac8f6b1f300b62e30_NeikiAnalytics.exe
File created	C:\Windows\System\EDaiMHA.exe	191f157dda35363ac8f6b1f300b62e30_NeikiAnalytics.exe
File created	C:\Windows\System\NFETmZY.exe	191f157dda35363ac8f6b1f300b62e30_NeikiAnalytics.exe
File created	C:\Windows\System\ZMhrfOL.exe	191f157dda35363ac8f6b1f300b62e30_NeikiAnalytics.exe
File created	C:\Windows\System\CgaTlgR.exe	191f157dda35363ac8f6b1f300b62e30_NeikiAnalytics.exe
File created	C:\Windows\System\qwNZnnL.exe	191f157dda35363ac8f6b1f300b62e30_NeikiAnalytics.exe
File created	C:\Windows\System\RLYaOrT.exe	191f157dda35363ac8f6b1f300b62e30_NeikiAnalytics.exe
File created	C:\Windows\System\VgWRbxk.exe	191f157dda35363ac8f6b1f300b62e30_NeikiAnalytics.exe
File created	C:\Windows\System\BIyfTqH.exe	191f157dda35363ac8f6b1f300b62e30_NeikiAnalytics.exe
File created	C:\Windows\System\QvKAWPU.exe	191f157dda35363ac8f6b1f300b62e30_NeikiAnalytics.exe
File created	C:\Windows\System\lWriCIY.exe	191f157dda35363ac8f6b1f300b62e30_NeikiAnalytics.exe
File created	C:\Windows\System\DyOjieZ.exe	191f157dda35363ac8f6b1f300b62e30_NeikiAnalytics.exe
File created	C:\Windows\System\oMSwaFt.exe	191f157dda35363ac8f6b1f300b62e30_NeikiAnalytics.exe
File created	C:\Windows\System\tXLwwWl.exe	191f157dda35363ac8f6b1f300b62e30_NeikiAnalytics.exe
File created	C:\Windows\System\ctWmlBl.exe	191f157dda35363ac8f6b1f300b62e30_NeikiAnalytics.exe
File created	C:\Windows\System\LernBhu.exe	191f157dda35363ac8f6b1f300b62e30_NeikiAnalytics.exe
File created	C:\Windows\System\DSSPcEH.exe	191f157dda35363ac8f6b1f300b62e30_NeikiAnalytics.exe
File created	C:\Windows\System\FKINHlh.exe	191f157dda35363ac8f6b1f300b62e30_NeikiAnalytics.exe
File created	C:\Windows\System\nqfTNRF.exe	191f157dda35363ac8f6b1f300b62e30_NeikiAnalytics.exe
File created	C:\Windows\System\LDyfFHq.exe	191f157dda35363ac8f6b1f300b62e30_NeikiAnalytics.exe
File created	C:\Windows\System\ffNCmeY.exe	191f157dda35363ac8f6b1f300b62e30_NeikiAnalytics.exe
File created	C:\Windows\System\DrbBWeA.exe	191f157dda35363ac8f6b1f300b62e30_NeikiAnalytics.exe
File created	C:\Windows\System\BTajKFE.exe	191f157dda35363ac8f6b1f300b62e30_NeikiAnalytics.exe
File created	C:\Windows\System\zZxvupC.exe	191f157dda35363ac8f6b1f300b62e30_NeikiAnalytics.exe
File created	C:\Windows\System\GsNPocl.exe	191f157dda35363ac8f6b1f300b62e30_NeikiAnalytics.exe
File created	C:\Windows\System\bzZuteU.exe	191f157dda35363ac8f6b1f300b62e30_NeikiAnalytics.exe
File created	C:\Windows\System\lUUKdAk.exe	191f157dda35363ac8f6b1f300b62e30_NeikiAnalytics.exe
File created	C:\Windows\System\CGnhtOL.exe	191f157dda35363ac8f6b1f300b62e30_NeikiAnalytics.exe
File created	C:\Windows\System\fZuvyaa.exe	191f157dda35363ac8f6b1f300b62e30_NeikiAnalytics.exe
File created	C:\Windows\System\okvWpHu.exe	191f157dda35363ac8f6b1f300b62e30_NeikiAnalytics.exe
File created	C:\Windows\System\PFouVAy.exe	191f157dda35363ac8f6b1f300b62e30_NeikiAnalytics.exe
File created	C:\Windows\System\WthNLSX.exe	191f157dda35363ac8f6b1f300b62e30_NeikiAnalytics.exe
File created	C:\Windows\System\PCdDfbI.exe	191f157dda35363ac8f6b1f300b62e30_NeikiAnalytics.exe
File created	C:\Windows\System\HKoSWwH.exe	191f157dda35363ac8f6b1f300b62e30_NeikiAnalytics.exe
File created	C:\Windows\System\AUxwefo.exe	191f157dda35363ac8f6b1f300b62e30_NeikiAnalytics.exe
File created	C:\Windows\System\NHRoZKW.exe	191f157dda35363ac8f6b1f300b62e30_NeikiAnalytics.exe
File created	C:\Windows\System\GxzAbEh.exe	191f157dda35363ac8f6b1f300b62e30_NeikiAnalytics.exe
File created	C:\Windows\System\xprufKn.exe	191f157dda35363ac8f6b1f300b62e30_NeikiAnalytics.exe
File created	C:\Windows\System\aowHcaq.exe	191f157dda35363ac8f6b1f300b62e30_NeikiAnalytics.exe
File created	C:\Windows\System\JydEQPh.exe	191f157dda35363ac8f6b1f300b62e30_NeikiAnalytics.exe
File created	C:\Windows\System\JKxbaHN.exe	191f157dda35363ac8f6b1f300b62e30_NeikiAnalytics.exe
File created	C:\Windows\System\VxgEEUm.exe	191f157dda35363ac8f6b1f300b62e30_NeikiAnalytics.exe
File created	C:\Windows\System\DioJLXF.exe	191f157dda35363ac8f6b1f300b62e30_NeikiAnalytics.exe
File created	C:\Windows\System\JTRGjTL.exe	191f157dda35363ac8f6b1f300b62e30_NeikiAnalytics.exe
File created	C:\Windows\System\cQmyAEq.exe	191f157dda35363ac8f6b1f300b62e30_NeikiAnalytics.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2188	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2432	191f157dda35363ac8f6b1f300b62e30_NeikiAnalytics.exe
Token: SeDebugPrivilege	2188	powershell.exe
Token: SeLockMemoryPrivilege	2432	191f157dda35363ac8f6b1f300b62e30_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2432 wrote to memory of 2188	2432	191f157dda35363ac8f6b1f300b62e30_NeikiAnalytics.exe	29
PID 2432 wrote to memory of 2188	2432	191f157dda35363ac8f6b1f300b62e30_NeikiAnalytics.exe	29
PID 2432 wrote to memory of 2188	2432	191f157dda35363ac8f6b1f300b62e30_NeikiAnalytics.exe	29
PID 2432 wrote to memory of 3056	2432	191f157dda35363ac8f6b1f300b62e30_NeikiAnalytics.exe	30
PID 2432 wrote to memory of 3056	2432	191f157dda35363ac8f6b1f300b62e30_NeikiAnalytics.exe	30
PID 2432 wrote to memory of 3056	2432	191f157dda35363ac8f6b1f300b62e30_NeikiAnalytics.exe	30
PID 2432 wrote to memory of 2676	2432	191f157dda35363ac8f6b1f300b62e30_NeikiAnalytics.exe	31
PID 2432 wrote to memory of 2676	2432	191f157dda35363ac8f6b1f300b62e30_NeikiAnalytics.exe	31
PID 2432 wrote to memory of 2676	2432	191f157dda35363ac8f6b1f300b62e30_NeikiAnalytics.exe	31
PID 2432 wrote to memory of 2748	2432	191f157dda35363ac8f6b1f300b62e30_NeikiAnalytics.exe	32
PID 2432 wrote to memory of 2748	2432	191f157dda35363ac8f6b1f300b62e30_NeikiAnalytics.exe	32
PID 2432 wrote to memory of 2748	2432	191f157dda35363ac8f6b1f300b62e30_NeikiAnalytics.exe	32
PID 2432 wrote to memory of 2692	2432	191f157dda35363ac8f6b1f300b62e30_NeikiAnalytics.exe	33
PID 2432 wrote to memory of 2692	2432	191f157dda35363ac8f6b1f300b62e30_NeikiAnalytics.exe	33
PID 2432 wrote to memory of 2692	2432	191f157dda35363ac8f6b1f300b62e30_NeikiAnalytics.exe	33
PID 2432 wrote to memory of 2832	2432	191f157dda35363ac8f6b1f300b62e30_NeikiAnalytics.exe	34
PID 2432 wrote to memory of 2832	2432	191f157dda35363ac8f6b1f300b62e30_NeikiAnalytics.exe	34
PID 2432 wrote to memory of 2832	2432	191f157dda35363ac8f6b1f300b62e30_NeikiAnalytics.exe	34
PID 2432 wrote to memory of 2572	2432	191f157dda35363ac8f6b1f300b62e30_NeikiAnalytics.exe	35
PID 2432 wrote to memory of 2572	2432	191f157dda35363ac8f6b1f300b62e30_NeikiAnalytics.exe	35
PID 2432 wrote to memory of 2572	2432	191f157dda35363ac8f6b1f300b62e30_NeikiAnalytics.exe	35
PID 2432 wrote to memory of 2396	2432	191f157dda35363ac8f6b1f300b62e30_NeikiAnalytics.exe	36
PID 2432 wrote to memory of 2396	2432	191f157dda35363ac8f6b1f300b62e30_NeikiAnalytics.exe	36
PID 2432 wrote to memory of 2396	2432	191f157dda35363ac8f6b1f300b62e30_NeikiAnalytics.exe	36
PID 2432 wrote to memory of 2196	2432	191f157dda35363ac8f6b1f300b62e30_NeikiAnalytics.exe	37
PID 2432 wrote to memory of 2196	2432	191f157dda35363ac8f6b1f300b62e30_NeikiAnalytics.exe	37
PID 2432 wrote to memory of 2196	2432	191f157dda35363ac8f6b1f300b62e30_NeikiAnalytics.exe	37
PID 2432 wrote to memory of 2580	2432	191f157dda35363ac8f6b1f300b62e30_NeikiAnalytics.exe	38
PID 2432 wrote to memory of 2580	2432	191f157dda35363ac8f6b1f300b62e30_NeikiAnalytics.exe	38
PID 2432 wrote to memory of 2580	2432	191f157dda35363ac8f6b1f300b62e30_NeikiAnalytics.exe	38
PID 2432 wrote to memory of 2704	2432	191f157dda35363ac8f6b1f300b62e30_NeikiAnalytics.exe	39
PID 2432 wrote to memory of 2704	2432	191f157dda35363ac8f6b1f300b62e30_NeikiAnalytics.exe	39
PID 2432 wrote to memory of 2704	2432	191f157dda35363ac8f6b1f300b62e30_NeikiAnalytics.exe	39
PID 2432 wrote to memory of 3032	2432	191f157dda35363ac8f6b1f300b62e30_NeikiAnalytics.exe	40
PID 2432 wrote to memory of 3032	2432	191f157dda35363ac8f6b1f300b62e30_NeikiAnalytics.exe	40
PID 2432 wrote to memory of 3032	2432	191f157dda35363ac8f6b1f300b62e30_NeikiAnalytics.exe	40
PID 2432 wrote to memory of 608	2432	191f157dda35363ac8f6b1f300b62e30_NeikiAnalytics.exe	41
PID 2432 wrote to memory of 608	2432	191f157dda35363ac8f6b1f300b62e30_NeikiAnalytics.exe	41
PID 2432 wrote to memory of 608	2432	191f157dda35363ac8f6b1f300b62e30_NeikiAnalytics.exe	41
PID 2432 wrote to memory of 2792	2432	191f157dda35363ac8f6b1f300b62e30_NeikiAnalytics.exe	42
PID 2432 wrote to memory of 2792	2432	191f157dda35363ac8f6b1f300b62e30_NeikiAnalytics.exe	42
PID 2432 wrote to memory of 2792	2432	191f157dda35363ac8f6b1f300b62e30_NeikiAnalytics.exe	42
PID 2432 wrote to memory of 2972	2432	191f157dda35363ac8f6b1f300b62e30_NeikiAnalytics.exe	43
PID 2432 wrote to memory of 2972	2432	191f157dda35363ac8f6b1f300b62e30_NeikiAnalytics.exe	43
PID 2432 wrote to memory of 2972	2432	191f157dda35363ac8f6b1f300b62e30_NeikiAnalytics.exe	43
PID 2432 wrote to memory of 2340	2432	191f157dda35363ac8f6b1f300b62e30_NeikiAnalytics.exe	44
PID 2432 wrote to memory of 2340	2432	191f157dda35363ac8f6b1f300b62e30_NeikiAnalytics.exe	44
PID 2432 wrote to memory of 2340	2432	191f157dda35363ac8f6b1f300b62e30_NeikiAnalytics.exe	44
PID 2432 wrote to memory of 1804	2432	191f157dda35363ac8f6b1f300b62e30_NeikiAnalytics.exe	45
PID 2432 wrote to memory of 1804	2432	191f157dda35363ac8f6b1f300b62e30_NeikiAnalytics.exe	45
PID 2432 wrote to memory of 1804	2432	191f157dda35363ac8f6b1f300b62e30_NeikiAnalytics.exe	45
PID 2432 wrote to memory of 2016	2432	191f157dda35363ac8f6b1f300b62e30_NeikiAnalytics.exe	46
PID 2432 wrote to memory of 2016	2432	191f157dda35363ac8f6b1f300b62e30_NeikiAnalytics.exe	46
PID 2432 wrote to memory of 2016	2432	191f157dda35363ac8f6b1f300b62e30_NeikiAnalytics.exe	46
PID 2432 wrote to memory of 1864	2432	191f157dda35363ac8f6b1f300b62e30_NeikiAnalytics.exe	47
PID 2432 wrote to memory of 1864	2432	191f157dda35363ac8f6b1f300b62e30_NeikiAnalytics.exe	47
PID 2432 wrote to memory of 1864	2432	191f157dda35363ac8f6b1f300b62e30_NeikiAnalytics.exe	47
PID 2432 wrote to memory of 2404	2432	191f157dda35363ac8f6b1f300b62e30_NeikiAnalytics.exe	48
PID 2432 wrote to memory of 2404	2432	191f157dda35363ac8f6b1f300b62e30_NeikiAnalytics.exe	48
PID 2432 wrote to memory of 2404	2432	191f157dda35363ac8f6b1f300b62e30_NeikiAnalytics.exe	48
PID 2432 wrote to memory of 308	2432	191f157dda35363ac8f6b1f300b62e30_NeikiAnalytics.exe	49
PID 2432 wrote to memory of 308	2432	191f157dda35363ac8f6b1f300b62e30_NeikiAnalytics.exe	49
PID 2432 wrote to memory of 308	2432	191f157dda35363ac8f6b1f300b62e30_NeikiAnalytics.exe	49
PID 2432 wrote to memory of 1680	2432	191f157dda35363ac8f6b1f300b62e30_NeikiAnalytics.exe	50

C:\Users\Admin\AppData\Local\Temp\191f157dda35363ac8f6b1f300b62e30_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\191f157dda35363ac8f6b1f300b62e30_NeikiAnalytics.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2432
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2188
- C:\Windows\System\HrPnvDG.exe
  C:\Windows\System\HrPnvDG.exe
  2⤵
  - Executes dropped EXE
  PID:3056
- C:\Windows\System\nAQySpf.exe
  C:\Windows\System\nAQySpf.exe
  2⤵
  - Executes dropped EXE
  PID:2676
- C:\Windows\System\qarKSXg.exe
  C:\Windows\System\qarKSXg.exe
  2⤵
  - Executes dropped EXE
  PID:2748
- C:\Windows\System\EHjBVjW.exe
  C:\Windows\System\EHjBVjW.exe
  2⤵
  - Executes dropped EXE
  PID:2692
- C:\Windows\System\TSvXbgr.exe
  C:\Windows\System\TSvXbgr.exe
  2⤵
  - Executes dropped EXE
  PID:2832
- C:\Windows\System\rBmRtDI.exe
  C:\Windows\System\rBmRtDI.exe
  2⤵
  - Executes dropped EXE
  PID:2572
- C:\Windows\System\EHeqwsB.exe
  C:\Windows\System\EHeqwsB.exe
  2⤵
  - Executes dropped EXE
  PID:2396
- C:\Windows\System\BManMjD.exe
  C:\Windows\System\BManMjD.exe
  2⤵
  - Executes dropped EXE
  PID:2196
- C:\Windows\System\VtahboA.exe
  C:\Windows\System\VtahboA.exe
  2⤵
  - Executes dropped EXE
  PID:2580
- C:\Windows\System\aoyOPPz.exe
  C:\Windows\System\aoyOPPz.exe
  2⤵
  - Executes dropped EXE
  PID:2704
- C:\Windows\System\JXvwuGQ.exe
  C:\Windows\System\JXvwuGQ.exe
  2⤵
  - Executes dropped EXE
  PID:3032
- C:\Windows\System\duhlYKh.exe
  C:\Windows\System\duhlYKh.exe
  2⤵
  - Executes dropped EXE
  PID:608
- C:\Windows\System\fnEZazH.exe
  C:\Windows\System\fnEZazH.exe
  2⤵
  - Executes dropped EXE
  PID:2792
- C:\Windows\System\KyLejch.exe
  C:\Windows\System\KyLejch.exe
  2⤵
  - Executes dropped EXE
  PID:2972
- C:\Windows\System\jHpqMtH.exe
  C:\Windows\System\jHpqMtH.exe
  2⤵
  - Executes dropped EXE
  PID:2340
- C:\Windows\System\lKylMmn.exe
  C:\Windows\System\lKylMmn.exe
  2⤵
  - Executes dropped EXE
  PID:1804
- C:\Windows\System\kFIBpNT.exe
  C:\Windows\System\kFIBpNT.exe
  2⤵
  - Executes dropped EXE
  PID:2016
- C:\Windows\System\ZOrFwnB.exe
  C:\Windows\System\ZOrFwnB.exe
  2⤵
  - Executes dropped EXE
  PID:1864
- C:\Windows\System\MOwNMSP.exe
  C:\Windows\System\MOwNMSP.exe
  2⤵
  - Executes dropped EXE
  PID:2404
- C:\Windows\System\jWcobHm.exe
  C:\Windows\System\jWcobHm.exe
  2⤵
  - Executes dropped EXE
  PID:308
- C:\Windows\System\fauOUdx.exe
  C:\Windows\System\fauOUdx.exe
  2⤵
  - Executes dropped EXE
  PID:1680
- C:\Windows\System\vSPOYcG.exe
  C:\Windows\System\vSPOYcG.exe
  2⤵
  - Executes dropped EXE
  PID:2632
- C:\Windows\System\yuZcGYX.exe
  C:\Windows\System\yuZcGYX.exe
  2⤵
  - Executes dropped EXE
  PID:2300
- C:\Windows\System\FfoOfMG.exe
  C:\Windows\System\FfoOfMG.exe
  2⤵
  - Executes dropped EXE
  PID:1376
- C:\Windows\System\dZamctf.exe
  C:\Windows\System\dZamctf.exe
  2⤵
  - Executes dropped EXE
  PID:2924
- C:\Windows\System\YywYACZ.exe
  C:\Windows\System\YywYACZ.exe
  2⤵
  - Executes dropped EXE
  PID:1292
- C:\Windows\System\KapoxYy.exe
  C:\Windows\System\KapoxYy.exe
  2⤵
  - Executes dropped EXE
  PID:576
- C:\Windows\System\FRIXCVw.exe
  C:\Windows\System\FRIXCVw.exe
  2⤵
  - Executes dropped EXE
  PID:1484
- C:\Windows\System\liFtjNP.exe
  C:\Windows\System\liFtjNP.exe
  2⤵
  - Executes dropped EXE
  PID:1792
- C:\Windows\System\GEQhyWY.exe
  C:\Windows\System\GEQhyWY.exe
  2⤵
  - Executes dropped EXE
  PID:2064
- C:\Windows\System\mqfdbzY.exe
  C:\Windows\System\mqfdbzY.exe
  2⤵
  - Executes dropped EXE
  PID:2504
- C:\Windows\System\JLwxBvQ.exe
  C:\Windows\System\JLwxBvQ.exe
  2⤵
  PID:1152
- C:\Windows\System\eIrkdbL.exe
  C:\Windows\System\eIrkdbL.exe
  2⤵
  - Executes dropped EXE
  PID:956
- C:\Windows\System\rdSHjoO.exe
  C:\Windows\System\rdSHjoO.exe
  2⤵
  PID:1760
- C:\Windows\System\sJzCCbJ.exe
  C:\Windows\System\sJzCCbJ.exe
  2⤵
  - Executes dropped EXE
  PID:1556
- C:\Windows\System\OwJbUfI.exe
  C:\Windows\System\OwJbUfI.exe
  2⤵
  PID:2040
- C:\Windows\System\bBMykZn.exe
  C:\Windows\System\bBMykZn.exe
  2⤵
  - Executes dropped EXE
  PID:1328
- C:\Windows\System\ReHZdHO.exe
  C:\Windows\System\ReHZdHO.exe
  2⤵
  PID:284
- C:\Windows\System\amBwbSX.exe
  C:\Windows\System\amBwbSX.exe
  2⤵
  - Executes dropped EXE
  PID:1904
- C:\Windows\System\oHUqwrH.exe
  C:\Windows\System\oHUqwrH.exe
  2⤵
  PID:1876
- C:\Windows\System\JushFAW.exe
  C:\Windows\System\JushFAW.exe
  2⤵
  - Executes dropped EXE
  PID:1908
- C:\Windows\System\eBFqlmW.exe
  C:\Windows\System\eBFqlmW.exe
  2⤵
  PID:824
- C:\Windows\System\YxdtVtI.exe
  C:\Windows\System\YxdtVtI.exe
  2⤵
  - Executes dropped EXE
  PID:1148
- C:\Windows\System\pQdEFwE.exe
  C:\Windows\System\pQdEFwE.exe
  2⤵
  PID:2080
- C:\Windows\System\mDKHjuQ.exe
  C:\Windows\System\mDKHjuQ.exe
  2⤵
  - Executes dropped EXE
  PID:1688
- C:\Windows\System\jIKVNym.exe
  C:\Windows\System\jIKVNym.exe
  2⤵
  PID:1836
- C:\Windows\System\gUrRiBF.exe
  C:\Windows\System\gUrRiBF.exe
  2⤵
  - Executes dropped EXE
  PID:980
- C:\Windows\System\UwKVAhr.exe
  C:\Windows\System\UwKVAhr.exe
  2⤵
  PID:2156
- C:\Windows\System\wCsxnyM.exe
  C:\Windows\System\wCsxnyM.exe
  2⤵
  - Executes dropped EXE
  PID:2108
- C:\Windows\System\BtlJjxk.exe
  C:\Windows\System\BtlJjxk.exe
  2⤵
  PID:816
- C:\Windows\System\HceyfJN.exe
  C:\Windows\System\HceyfJN.exe
  2⤵
  - Executes dropped EXE
  PID:2092
- C:\Windows\System\mNvHreh.exe
  C:\Windows\System\mNvHreh.exe
  2⤵
  PID:868
- C:\Windows\System\AyIstZM.exe
  C:\Windows\System\AyIstZM.exe
  2⤵
  - Executes dropped EXE
  PID:2952
- C:\Windows\System\XUTaggo.exe
  C:\Windows\System\XUTaggo.exe
  2⤵
  PID:1244
- C:\Windows\System\IBznzEQ.exe
  C:\Windows\System\IBznzEQ.exe
  2⤵
  - Executes dropped EXE
  PID:3048
- C:\Windows\System\MHyMZHi.exe
  C:\Windows\System\MHyMZHi.exe
  2⤵
  PID:1616
- C:\Windows\System\ftgBiVC.exe
  C:\Windows\System\ftgBiVC.exe
  2⤵
  - Executes dropped EXE
  PID:1584
- C:\Windows\System\YGIqFPw.exe
  C:\Windows\System\YGIqFPw.exe
  2⤵
  PID:876
- C:\Windows\System\NbvrHsT.exe
  C:\Windows\System\NbvrHsT.exe
  2⤵
  - Executes dropped EXE
  PID:2736
- C:\Windows\System\fxsAPDg.exe
  C:\Windows\System\fxsAPDg.exe
  2⤵
  PID:2776
- C:\Windows\System\mfEXCys.exe
  C:\Windows\System\mfEXCys.exe
  2⤵
  - Executes dropped EXE
  PID:2608
- C:\Windows\System\rqSNxXA.exe
  C:\Windows\System\rqSNxXA.exe
  2⤵
  PID:2020
- C:\Windows\System\xgVtIQi.exe
  C:\Windows\System\xgVtIQi.exe
  2⤵
  - Executes dropped EXE
  PID:348
- C:\Windows\System\lOpQsMT.exe
  C:\Windows\System\lOpQsMT.exe
  2⤵
  PID:2808
- C:\Windows\System\BRgtPLB.exe
  C:\Windows\System\BRgtPLB.exe
  2⤵
  - Executes dropped EXE
  PID:2896
- C:\Windows\System\qGtPBSe.exe
  C:\Windows\System\qGtPBSe.exe
  2⤵
  PID:1796
- C:\Windows\System\KwRzzUD.exe
  C:\Windows\System\KwRzzUD.exe
  2⤵
  - Executes dropped EXE
  PID:2812
- C:\Windows\System\brAnHHn.exe
  C:\Windows\System\brAnHHn.exe
  2⤵
  PID:1808
- C:\Windows\System\abkAxER.exe
  C:\Windows\System\abkAxER.exe
  2⤵
  - Executes dropped EXE
  PID:2784
- C:\Windows\System\TxpZtyl.exe
  C:\Windows\System\TxpZtyl.exe
  2⤵
  PID:2024
- C:\Windows\System\KFDyaOW.exe
  C:\Windows\System\KFDyaOW.exe
  2⤵
  - Executes dropped EXE
  PID:2448
- C:\Windows\System\ScxHuqL.exe
  C:\Windows\System\ScxHuqL.exe
  2⤵
  PID:1772
- C:\Windows\System\WGbYcQC.exe
  C:\Windows\System\WGbYcQC.exe
  2⤵
  - Executes dropped EXE
  PID:324
- C:\Windows\System\fqfHKNq.exe
  C:\Windows\System\fqfHKNq.exe
  2⤵
  PID:2272
- C:\Windows\System\DBUhsww.exe
  C:\Windows\System\DBUhsww.exe
  2⤵
  - Executes dropped EXE
  PID:2112
- C:\Windows\System\oRfCxhL.exe
  C:\Windows\System\oRfCxhL.exe
  2⤵
  PID:1652
- C:\Windows\System\gCeUFLK.exe
  C:\Windows\System\gCeUFLK.exe
  2⤵
  - Executes dropped EXE
  PID:1720
- C:\Windows\System\UTgeQpq.exe
  C:\Windows\System\UTgeQpq.exe
  2⤵
  PID:2516
- C:\Windows\System\zZgVhJK.exe
  C:\Windows\System\zZgVhJK.exe
  2⤵
  - Executes dropped EXE
  PID:1940
- C:\Windows\System\vvELdYa.exe
  C:\Windows\System\vvELdYa.exe
  2⤵
  PID:1408
- C:\Windows\System\PZrlWZk.exe
  C:\Windows\System\PZrlWZk.exe
  2⤵
  - Executes dropped EXE
  PID:1228
- C:\Windows\System\agzSZnH.exe
  C:\Windows\System\agzSZnH.exe
  2⤵
  PID:2936
- C:\Windows\System\nXnwVYX.exe
  C:\Windows\System\nXnwVYX.exe
  2⤵
  - Executes dropped EXE
  PID:3040
- C:\Windows\System\QTdNNen.exe
  C:\Windows\System\QTdNNen.exe
  2⤵
  PID:1100
- C:\Windows\System\WaRTDIR.exe
  C:\Windows\System\WaRTDIR.exe
  2⤵
  - Executes dropped EXE
  PID:2256
- C:\Windows\System\gwTRKbS.exe
  C:\Windows\System\gwTRKbS.exe
  2⤵
  PID:1608
- C:\Windows\System\OrWrawr.exe
  C:\Windows\System\OrWrawr.exe
  2⤵
  - Executes dropped EXE
  PID:2684
- C:\Windows\System\sTxCCXc.exe
  C:\Windows\System\sTxCCXc.exe
  2⤵
  PID:2856
- C:\Windows\System\MVSFPbd.exe
  C:\Windows\System\MVSFPbd.exe
  2⤵
  - Executes dropped EXE
  PID:2540
- C:\Windows\System\DFIHaME.exe
  C:\Windows\System\DFIHaME.exe
  2⤵
  PID:2216
- C:\Windows\System\ehQaKCe.exe
  C:\Windows\System\ehQaKCe.exe
  2⤵
  - Executes dropped EXE
  PID:2056
- C:\Windows\System\CjpbVGy.exe
  C:\Windows\System\CjpbVGy.exe
  2⤵
  PID:648
- C:\Windows\System\qpxKAwB.exe
  C:\Windows\System\qpxKAwB.exe
  2⤵
  - Executes dropped EXE
  PID:3012
- C:\Windows\System\KZUgQxs.exe
  C:\Windows\System\KZUgQxs.exe
  2⤵
  PID:2992
- C:\Windows\System\SWUWtwB.exe
  C:\Windows\System\SWUWtwB.exe
  2⤵
  - Executes dropped EXE
  PID:3080
- C:\Windows\System\TkHyazC.exe
  C:\Windows\System\TkHyazC.exe
  2⤵
  PID:3096
- C:\Windows\System\IzxIKWs.exe
  C:\Windows\System\IzxIKWs.exe
  2⤵
  - Executes dropped EXE
  PID:3112
- C:\Windows\System\CaWrYFM.exe
  C:\Windows\System\CaWrYFM.exe
  2⤵
  PID:3128
- C:\Windows\System\YfFStsz.exe
  C:\Windows\System\YfFStsz.exe
  2⤵
  PID:3144
- C:\Windows\System\bLobCqg.exe
  C:\Windows\System\bLobCqg.exe
  2⤵
  PID:3160
- C:\Windows\System\YPhZynL.exe
  C:\Windows\System\YPhZynL.exe
  2⤵
  PID:3176
- C:\Windows\System\YsfgehS.exe
  C:\Windows\System\YsfgehS.exe
  2⤵
  PID:3192
- C:\Windows\System\uUKlAJx.exe
  C:\Windows\System\uUKlAJx.exe
  2⤵
  PID:3208
- C:\Windows\System\KKJByyj.exe
  C:\Windows\System\KKJByyj.exe
  2⤵
  PID:3224
- C:\Windows\System\YjQVhhF.exe
  C:\Windows\System\YjQVhhF.exe
  2⤵
  PID:3240
- C:\Windows\System\VnTYguC.exe
  C:\Windows\System\VnTYguC.exe
  2⤵
  PID:3256
- C:\Windows\System\NsOTyFa.exe
  C:\Windows\System\NsOTyFa.exe
  2⤵
  PID:3272
- C:\Windows\System\iqOulZn.exe
  C:\Windows\System\iqOulZn.exe
  2⤵
  PID:3288
- C:\Windows\System\KRjynmu.exe
  C:\Windows\System\KRjynmu.exe
  2⤵
  PID:3304
- C:\Windows\System\GpzeshQ.exe
  C:\Windows\System\GpzeshQ.exe
  2⤵
  PID:3320
- C:\Windows\System\btMjnIa.exe
  C:\Windows\System\btMjnIa.exe
  2⤵
  PID:3336
- C:\Windows\System\kKlJjpk.exe
  C:\Windows\System\kKlJjpk.exe
  2⤵
  PID:3352
- C:\Windows\System\DkpwgCU.exe
  C:\Windows\System\DkpwgCU.exe
  2⤵
  PID:3368
- C:\Windows\System\VCIShpS.exe
  C:\Windows\System\VCIShpS.exe
  2⤵
  PID:3384
- C:\Windows\System\NMkVFDB.exe
  C:\Windows\System\NMkVFDB.exe
  2⤵
  PID:3400
- C:\Windows\System\bneHtcd.exe
  C:\Windows\System\bneHtcd.exe
  2⤵
  PID:3416
- C:\Windows\System\JvnXnVa.exe
  C:\Windows\System\JvnXnVa.exe
  2⤵
  PID:3432
- C:\Windows\System\vfyLWXL.exe
  C:\Windows\System\vfyLWXL.exe
  2⤵
  PID:3448
- C:\Windows\System\JeXfKkF.exe
  C:\Windows\System\JeXfKkF.exe
  2⤵
  PID:3464
- C:\Windows\System\PixsZFR.exe
  C:\Windows\System\PixsZFR.exe
  2⤵
  PID:3480
- C:\Windows\System\HdrcYLJ.exe
  C:\Windows\System\HdrcYLJ.exe
  2⤵
  PID:3496
- C:\Windows\System\JKxbaHN.exe
  C:\Windows\System\JKxbaHN.exe
  2⤵
  PID:3512
- C:\Windows\System\ogUuLgZ.exe
  C:\Windows\System\ogUuLgZ.exe
  2⤵
  PID:3528
- C:\Windows\System\dDMNFOb.exe
  C:\Windows\System\dDMNFOb.exe
  2⤵
  PID:3544
- C:\Windows\System\UmaDMlW.exe
  C:\Windows\System\UmaDMlW.exe
  2⤵
  PID:3560
- C:\Windows\System\EneJybp.exe
  C:\Windows\System\EneJybp.exe
  2⤵
  PID:3576
- C:\Windows\System\oiAJPzO.exe
  C:\Windows\System\oiAJPzO.exe
  2⤵
  PID:3592
- C:\Windows\System\xQxvomu.exe
  C:\Windows\System\xQxvomu.exe
  2⤵
  PID:3608
- C:\Windows\System\qDEdQJB.exe
  C:\Windows\System\qDEdQJB.exe
  2⤵
  PID:3624
- C:\Windows\System\ORQLjzZ.exe
  C:\Windows\System\ORQLjzZ.exe
  2⤵
  PID:3640
- C:\Windows\System\SNyajKR.exe
  C:\Windows\System\SNyajKR.exe
  2⤵
  PID:3656
- C:\Windows\System\IHhdylG.exe
  C:\Windows\System\IHhdylG.exe
  2⤵
  PID:3672
- C:\Windows\System\dhbUrsu.exe
  C:\Windows\System\dhbUrsu.exe
  2⤵
  PID:3688
- C:\Windows\System\VpzjCrc.exe
  C:\Windows\System\VpzjCrc.exe
  2⤵
  PID:3704
- C:\Windows\System\DzMHlKk.exe
  C:\Windows\System\DzMHlKk.exe
  2⤵
  PID:3720
- C:\Windows\System\oZVuuWK.exe
  C:\Windows\System\oZVuuWK.exe
  2⤵
  PID:3736
- C:\Windows\System\GivYDeq.exe
  C:\Windows\System\GivYDeq.exe
  2⤵
  PID:3752
- C:\Windows\System\gxRDUvN.exe
  C:\Windows\System\gxRDUvN.exe
  2⤵
  PID:3768
- C:\Windows\System\qFlscms.exe
  C:\Windows\System\qFlscms.exe
  2⤵
  PID:3784
- C:\Windows\System\qYFZjfr.exe
  C:\Windows\System\qYFZjfr.exe
  2⤵
  PID:3800
- C:\Windows\System\JXVzKzU.exe
  C:\Windows\System\JXVzKzU.exe
  2⤵
  PID:3816
- C:\Windows\System\hZpgJhs.exe
  C:\Windows\System\hZpgJhs.exe
  2⤵
  PID:3832
- C:\Windows\System\tknZEMK.exe
  C:\Windows\System\tknZEMK.exe
  2⤵
  PID:3848
- C:\Windows\System\WakHUKl.exe
  C:\Windows\System\WakHUKl.exe
  2⤵
  PID:3864
- C:\Windows\System\MtRGwEX.exe
  C:\Windows\System\MtRGwEX.exe
  2⤵
  PID:3880
- C:\Windows\System\PlczFXk.exe
  C:\Windows\System\PlczFXk.exe
  2⤵
  PID:3896
- C:\Windows\System\uWwHcXC.exe
  C:\Windows\System\uWwHcXC.exe
  2⤵
  PID:3912
- C:\Windows\System\kDSAnPq.exe
  C:\Windows\System\kDSAnPq.exe
  2⤵
  PID:3928
- C:\Windows\System\JchbRmN.exe
  C:\Windows\System\JchbRmN.exe
  2⤵
  PID:3944
- C:\Windows\System\rqrVcor.exe
  C:\Windows\System\rqrVcor.exe
  2⤵
  PID:3960
- C:\Windows\System\QMmwnJh.exe
  C:\Windows\System\QMmwnJh.exe
  2⤵
  PID:3976
- C:\Windows\System\HlzGUFX.exe
  C:\Windows\System\HlzGUFX.exe
  2⤵
  PID:3992
- C:\Windows\System\yNRcYiR.exe
  C:\Windows\System\yNRcYiR.exe
  2⤵
  PID:4008
- C:\Windows\System\WOWxuTq.exe
  C:\Windows\System\WOWxuTq.exe
  2⤵
  PID:4024
- C:\Windows\System\vDdjhke.exe
  C:\Windows\System\vDdjhke.exe
  2⤵
  PID:4040
- C:\Windows\System\JkqRxSC.exe
  C:\Windows\System\JkqRxSC.exe
  2⤵
  PID:4056
- C:\Windows\System\BTjebDy.exe
  C:\Windows\System\BTjebDy.exe
  2⤵
  PID:4072
- C:\Windows\System\kpwNQfh.exe
  C:\Windows\System\kpwNQfh.exe
  2⤵
  PID:4088
- C:\Windows\System\dzNRhaU.exe
  C:\Windows\System\dzNRhaU.exe
  2⤵
  PID:2868
- C:\Windows\System\OnQryPr.exe
  C:\Windows\System\OnQryPr.exe
  2⤵
  PID:3092
- C:\Windows\System\MoAOfHT.exe
  C:\Windows\System\MoAOfHT.exe
  2⤵
  PID:3156
- C:\Windows\System\yEjWruv.exe
  C:\Windows\System\yEjWruv.exe
  2⤵
  PID:3220
- C:\Windows\System\QnciWeF.exe
  C:\Windows\System\QnciWeF.exe
  2⤵
  PID:3284
- C:\Windows\System\clmIKkV.exe
  C:\Windows\System\clmIKkV.exe
  2⤵
  PID:3348
- C:\Windows\System\aPdXfey.exe
  C:\Windows\System\aPdXfey.exe
  2⤵
  PID:3412
- C:\Windows\System\GeHkjdM.exe
  C:\Windows\System\GeHkjdM.exe
  2⤵
  PID:3472
- C:\Windows\System\oaTSdSc.exe
  C:\Windows\System\oaTSdSc.exe
  2⤵
  PID:3508
- C:\Windows\System\QXwEwRa.exe
  C:\Windows\System\QXwEwRa.exe
  2⤵
  PID:3572
- C:\Windows\System\NIwNNUy.exe
  C:\Windows\System\NIwNNUy.exe
  2⤵
  PID:3636
- C:\Windows\System\lICOpvz.exe
  C:\Windows\System\lICOpvz.exe
  2⤵
  PID:3700
- C:\Windows\System\yFVIKhs.exe
  C:\Windows\System\yFVIKhs.exe
  2⤵
  PID:3764
- C:\Windows\System\plwhZcU.exe
  C:\Windows\System\plwhZcU.exe
  2⤵
  PID:3824
- C:\Windows\System\clttyCM.exe
  C:\Windows\System\clttyCM.exe
  2⤵
  PID:3860
- C:\Windows\System\cvQAveW.exe
  C:\Windows\System\cvQAveW.exe
  2⤵
  PID:3924
- C:\Windows\System\oFReulS.exe
  C:\Windows\System\oFReulS.exe
  2⤵
  PID:3988
- C:\Windows\System\lblrSyp.exe
  C:\Windows\System\lblrSyp.exe
  2⤵
  PID:4052
- C:\Windows\System\bGBsCfd.exe
  C:\Windows\System\bGBsCfd.exe
  2⤵
  PID:1344
- C:\Windows\System\jJnKiNX.exe
  C:\Windows\System\jJnKiNX.exe
  2⤵
  PID:3316
- C:\Windows\System\tSfvWac.exe
  C:\Windows\System\tSfvWac.exe
  2⤵
  PID:3444
- C:\Windows\System\aOoETrD.exe
  C:\Windows\System\aOoETrD.exe
  2⤵
  PID:3696
- C:\Windows\System\zioVpKz.exe
  C:\Windows\System\zioVpKz.exe
  2⤵
  PID:4108
- C:\Windows\System\lzfOUXz.exe
  C:\Windows\System\lzfOUXz.exe
  2⤵
  PID:4124
- C:\Windows\System\NjjYhTM.exe
  C:\Windows\System\NjjYhTM.exe
  2⤵
  PID:4140
- C:\Windows\System\nwLcsjb.exe
  C:\Windows\System\nwLcsjb.exe
  2⤵
  PID:4156
- C:\Windows\System\GtiAKcV.exe
  C:\Windows\System\GtiAKcV.exe
  2⤵
  PID:4172
- C:\Windows\System\WEkiiHN.exe
  C:\Windows\System\WEkiiHN.exe
  2⤵
  PID:4188
- C:\Windows\System\TnBVFcb.exe
  C:\Windows\System\TnBVFcb.exe
  2⤵
  PID:4204
- C:\Windows\System\mkNHvuv.exe
  C:\Windows\System\mkNHvuv.exe
  2⤵
  PID:4220
- C:\Windows\System\jWbeAwH.exe
  C:\Windows\System\jWbeAwH.exe
  2⤵
  PID:4236
- C:\Windows\System\cMpCYZb.exe
  C:\Windows\System\cMpCYZb.exe
  2⤵
  PID:4252
- C:\Windows\System\SJjeHtr.exe
  C:\Windows\System\SJjeHtr.exe
  2⤵
  PID:4268
- C:\Windows\System\yMrZTER.exe
  C:\Windows\System\yMrZTER.exe
  2⤵
  PID:4284
- C:\Windows\System\JNIpmhP.exe
  C:\Windows\System\JNIpmhP.exe
  2⤵
  PID:4300
- C:\Windows\System\nnwqwAn.exe
  C:\Windows\System\nnwqwAn.exe
  2⤵
  PID:4316
- C:\Windows\System\KYABZff.exe
  C:\Windows\System\KYABZff.exe
  2⤵
  PID:4332
- C:\Windows\System\TYFsiKC.exe
  C:\Windows\System\TYFsiKC.exe
  2⤵
  PID:4348
- C:\Windows\System\JabwbAX.exe
  C:\Windows\System\JabwbAX.exe
  2⤵
  PID:4364
- C:\Windows\System\qksmESx.exe
  C:\Windows\System\qksmESx.exe
  2⤵
  PID:4380
- C:\Windows\System\XhNCMhM.exe
  C:\Windows\System\XhNCMhM.exe
  2⤵
  PID:4396
- C:\Windows\System\GdPIYxh.exe
  C:\Windows\System\GdPIYxh.exe
  2⤵
  PID:4412
- C:\Windows\System\IrHBxfs.exe
  C:\Windows\System\IrHBxfs.exe
  2⤵
  PID:4428
- C:\Windows\System\OLqWsBr.exe
  C:\Windows\System\OLqWsBr.exe
  2⤵
  PID:4444
- C:\Windows\System\xoxmoVc.exe
  C:\Windows\System\xoxmoVc.exe
  2⤵
  PID:4460
- C:\Windows\System\qWuJOLl.exe
  C:\Windows\System\qWuJOLl.exe
  2⤵
  PID:4476
- C:\Windows\System\fOiSmzq.exe
  C:\Windows\System\fOiSmzq.exe
  2⤵
  PID:4492
- C:\Windows\System\UjVunzP.exe
  C:\Windows\System\UjVunzP.exe
  2⤵
  PID:4508
- C:\Windows\System\pSlGGwA.exe
  C:\Windows\System\pSlGGwA.exe
  2⤵
  PID:4524
- C:\Windows\System\dYxnVYo.exe
  C:\Windows\System\dYxnVYo.exe
  2⤵
  PID:4540
- C:\Windows\System\MuLZnwT.exe
  C:\Windows\System\MuLZnwT.exe
  2⤵
  PID:4556
- C:\Windows\System\NLGeDPt.exe
  C:\Windows\System\NLGeDPt.exe
  2⤵
  PID:4572
- C:\Windows\System\GEOEaFB.exe
  C:\Windows\System\GEOEaFB.exe
  2⤵
  PID:4588
- C:\Windows\System\WTePyCj.exe
  C:\Windows\System\WTePyCj.exe
  2⤵
  PID:4604
- C:\Windows\System\RBCDaUY.exe
  C:\Windows\System\RBCDaUY.exe
  2⤵
  PID:4620
- C:\Windows\System\JAqaDku.exe
  C:\Windows\System\JAqaDku.exe
  2⤵
  PID:4636
- C:\Windows\System\iVhChFt.exe
  C:\Windows\System\iVhChFt.exe
  2⤵
  PID:4652
- C:\Windows\System\bGXZhEV.exe
  C:\Windows\System\bGXZhEV.exe
  2⤵
  PID:4668
- C:\Windows\System\OtMUAwu.exe
  C:\Windows\System\OtMUAwu.exe
  2⤵
  PID:4684
- C:\Windows\System\ydqipxV.exe
  C:\Windows\System\ydqipxV.exe
  2⤵
  PID:4700
- C:\Windows\System\xLgzjvW.exe
  C:\Windows\System\xLgzjvW.exe
  2⤵
  PID:4716
- C:\Windows\System\TOeECzT.exe
  C:\Windows\System\TOeECzT.exe
  2⤵
  PID:4732
- C:\Windows\System\gTSphWv.exe
  C:\Windows\System\gTSphWv.exe
  2⤵
  PID:4748
- C:\Windows\System\JCTHAis.exe
  C:\Windows\System\JCTHAis.exe
  2⤵
  PID:4764
- C:\Windows\System\WMZMVDM.exe
  C:\Windows\System\WMZMVDM.exe
  2⤵
  PID:4780
- C:\Windows\System\KoDnYTj.exe
  C:\Windows\System\KoDnYTj.exe
  2⤵
  PID:4796
- C:\Windows\System\nkJlBmw.exe
  C:\Windows\System\nkJlBmw.exe
  2⤵
  PID:4812
- C:\Windows\System\bdiVSjB.exe
  C:\Windows\System\bdiVSjB.exe
  2⤵
  PID:4828
- C:\Windows\System\BpJcBrz.exe
  C:\Windows\System\BpJcBrz.exe
  2⤵
  PID:4844
- C:\Windows\System\vYwdGTw.exe
  C:\Windows\System\vYwdGTw.exe
  2⤵
  PID:4860
- C:\Windows\System\sgmsCEl.exe
  C:\Windows\System\sgmsCEl.exe
  2⤵
  PID:4876
- C:\Windows\System\OUyVpPP.exe
  C:\Windows\System\OUyVpPP.exe
  2⤵
  PID:4892
- C:\Windows\System\BwXVKph.exe
  C:\Windows\System\BwXVKph.exe
  2⤵
  PID:4908
- C:\Windows\System\rGxeYVB.exe
  C:\Windows\System\rGxeYVB.exe
  2⤵
  PID:4924
- C:\Windows\System\dJjTimp.exe
  C:\Windows\System\dJjTimp.exe
  2⤵
  PID:4940
- C:\Windows\System\dXfCVHX.exe
  C:\Windows\System\dXfCVHX.exe
  2⤵
  PID:4956
- C:\Windows\System\DBVztZZ.exe
  C:\Windows\System\DBVztZZ.exe
  2⤵
  PID:4972
- C:\Windows\System\SsVtGli.exe
  C:\Windows\System\SsVtGli.exe
  2⤵
  PID:4988
- C:\Windows\System\CXoarSW.exe
  C:\Windows\System\CXoarSW.exe
  2⤵
  PID:5004
- C:\Windows\System\YlQPDZj.exe
  C:\Windows\System\YlQPDZj.exe
  2⤵
  PID:5020
- C:\Windows\System\IyZGtsi.exe
  C:\Windows\System\IyZGtsi.exe
  2⤵
  PID:5036
- C:\Windows\System\jRjoDeC.exe
  C:\Windows\System\jRjoDeC.exe
  2⤵
  PID:5052
- C:\Windows\System\PcBphPE.exe
  C:\Windows\System\PcBphPE.exe
  2⤵
  PID:5068
- C:\Windows\System\ZWlJGBw.exe
  C:\Windows\System\ZWlJGBw.exe
  2⤵
  PID:5084
- C:\Windows\System\pHVkRVv.exe
  C:\Windows\System\pHVkRVv.exe
  2⤵
  PID:5100
- C:\Windows\System\UcSGnpe.exe
  C:\Windows\System\UcSGnpe.exe
  2⤵
  PID:5116
- C:\Windows\System\RInlNqU.exe
  C:\Windows\System\RInlNqU.exe
  2⤵
  PID:2820
- C:\Windows\System\qHBFPGR.exe
  C:\Windows\System\qHBFPGR.exe
  2⤵
  PID:3216
- C:\Windows\System\ngiqFkk.exe
  C:\Windows\System\ngiqFkk.exe
  2⤵
  PID:4120
- C:\Windows\System\TjSvKOJ.exe
  C:\Windows\System\TjSvKOJ.exe
  2⤵
  PID:4184
- C:\Windows\System\EtVRGvL.exe
  C:\Windows\System\EtVRGvL.exe
  2⤵
  PID:4248
- C:\Windows\System\dpwEYAt.exe
  C:\Windows\System\dpwEYAt.exe
  2⤵
  PID:4312
- C:\Windows\System\foxiDUY.exe
  C:\Windows\System\foxiDUY.exe
  2⤵
  PID:4376
- C:\Windows\System\hONraYZ.exe
  C:\Windows\System\hONraYZ.exe
  2⤵
  PID:4440
- C:\Windows\System\WxdFzkf.exe
  C:\Windows\System\WxdFzkf.exe
  2⤵
  PID:4500
- C:\Windows\System\OhUkOCD.exe
  C:\Windows\System\OhUkOCD.exe
  2⤵
  PID:2600
- C:\Windows\System\akdorxO.exe
  C:\Windows\System\akdorxO.exe
  2⤵
  PID:4600
- C:\Windows\System\cqbXxfH.exe
  C:\Windows\System\cqbXxfH.exe
  2⤵
  PID:4664
- C:\Windows\System\PnQygLG.exe
  C:\Windows\System\PnQygLG.exe
  2⤵
  PID:2456
- C:\Windows\System\QLykEZw.exe
  C:\Windows\System\QLykEZw.exe
  2⤵
  PID:4724
- C:\Windows\System\Ltjbalh.exe
  C:\Windows\System\Ltjbalh.exe
  2⤵
  PID:4788
- C:\Windows\System\SdsoaEQ.exe
  C:\Windows\System\SdsoaEQ.exe
  2⤵
  PID:4852
- C:\Windows\System\CNxiBho.exe
  C:\Windows\System\CNxiBho.exe
  2⤵
  PID:4916
- C:\Windows\System\aVpRqnr.exe
  C:\Windows\System\aVpRqnr.exe
  2⤵
  PID:4980
- C:\Windows\System\BfpNIVe.exe
  C:\Windows\System\BfpNIVe.exe
  2⤵
  PID:2876
- C:\Windows\System\xnGBGto.exe
  C:\Windows\System\xnGBGto.exe
  2⤵
  PID:5080
- C:\Windows\System\uIevBNc.exe
  C:\Windows\System\uIevBNc.exe
  2⤵
  PID:5112
- C:\Windows\System\lnncDsl.exe
  C:\Windows\System\lnncDsl.exe
  2⤵
  PID:4180
- C:\Windows\System\tAOEGvU.exe
  C:\Windows\System\tAOEGvU.exe
  2⤵
  PID:4436
- C:\Windows\System\xZvtRdA.exe
  C:\Windows\System\xZvtRdA.exe
  2⤵
  PID:2904
- C:\Windows\System\JAkXdos.exe
  C:\Windows\System\JAkXdos.exe
  2⤵
  PID:2180
- C:\Windows\System\OtByNrd.exe
  C:\Windows\System\OtByNrd.exe
  2⤵
  PID:4948
- C:\Windows\System\JpEAuOI.exe
  C:\Windows\System\JpEAuOI.exe
  2⤵
  PID:5076
- C:\Windows\System\RLYaOrT.exe
  C:\Windows\System\RLYaOrT.exe
  2⤵
  PID:2332
- C:\Windows\System\PadBSLx.exe
  C:\Windows\System\PadBSLx.exe
  2⤵
  PID:4824
- C:\Windows\System\nfrtALK.exe
  C:\Windows\System\nfrtALK.exe
  2⤵
  PID:5136
- C:\Windows\System\GvqdXoo.exe
  C:\Windows\System\GvqdXoo.exe
  2⤵
  PID:5152
- C:\Windows\System\XcdYFzh.exe
  C:\Windows\System\XcdYFzh.exe
  2⤵
  PID:5168
- C:\Windows\System\mTGhVDD.exe
  C:\Windows\System\mTGhVDD.exe
  2⤵
  PID:5184
- C:\Windows\System\KCuwKlX.exe
  C:\Windows\System\KCuwKlX.exe
  2⤵
  PID:5200
- C:\Windows\System\JCpcbTR.exe
  C:\Windows\System\JCpcbTR.exe
  2⤵
  PID:5216
- C:\Windows\System\XUtoHCK.exe
  C:\Windows\System\XUtoHCK.exe
  2⤵
  PID:5232
- C:\Windows\System\BBKSyAJ.exe
  C:\Windows\System\BBKSyAJ.exe
  2⤵
  PID:5264
- C:\Windows\System\PTHCPkW.exe
  C:\Windows\System\PTHCPkW.exe
  2⤵
  PID:5280
- C:\Windows\System\ztsCEVx.exe
  C:\Windows\System\ztsCEVx.exe
  2⤵
  PID:5296
- C:\Windows\System\QUCArDG.exe
  C:\Windows\System\QUCArDG.exe
  2⤵
  PID:5312
- C:\Windows\System\jFbTdVg.exe
  C:\Windows\System\jFbTdVg.exe
  2⤵
  PID:5332
- C:\Windows\System\xHKmcYZ.exe
  C:\Windows\System\xHKmcYZ.exe
  2⤵
  PID:5348
- C:\Windows\System\qAxJdiW.exe
  C:\Windows\System\qAxJdiW.exe
  2⤵
  PID:5364
- C:\Windows\System\yjfptfI.exe
  C:\Windows\System\yjfptfI.exe
  2⤵
  PID:5380
- C:\Windows\System\oUHtbUC.exe
  C:\Windows\System\oUHtbUC.exe
  2⤵
  PID:5396
- C:\Windows\System\RwHSChm.exe
  C:\Windows\System\RwHSChm.exe
  2⤵
  PID:5412
- C:\Windows\System\KJfBMZt.exe
  C:\Windows\System\KJfBMZt.exe
  2⤵
  PID:5428
- C:\Windows\System\kKCICxZ.exe
  C:\Windows\System\kKCICxZ.exe
  2⤵
  PID:5444
- C:\Windows\System\rgdQYHw.exe
  C:\Windows\System\rgdQYHw.exe
  2⤵
  PID:5460
- C:\Windows\System\ZmZvXvM.exe
  C:\Windows\System\ZmZvXvM.exe
  2⤵
  PID:1828
- C:\Windows\System\kWDNRjf.exe
  C:\Windows\System\kWDNRjf.exe
  2⤵
  PID:1032
- C:\Windows\System\SHPLyQP.exe
  C:\Windows\System\SHPLyQP.exe
  2⤵
  PID:1200
- C:\Windows\System\jizeYBN.exe
  C:\Windows\System\jizeYBN.exe
  2⤵
  PID:380
- C:\Windows\System\mQmuvsr.exe
  C:\Windows\System\mQmuvsr.exe
  2⤵
  PID:5588
- C:\Windows\System\uibXOGv.exe
  C:\Windows\System\uibXOGv.exe
  2⤵
  PID:5604
- C:\Windows\System\yjCincr.exe
  C:\Windows\System\yjCincr.exe
  2⤵
  PID:5624
- C:\Windows\System\NfJDPLz.exe
  C:\Windows\System\NfJDPLz.exe
  2⤵
  PID:5644
- C:\Windows\System\MjoDIGd.exe
  C:\Windows\System\MjoDIGd.exe
  2⤵
  PID:5660
- C:\Windows\System\TLFWRWx.exe
  C:\Windows\System\TLFWRWx.exe
  2⤵
  PID:5684
- C:\Windows\System\JOTdfGC.exe
  C:\Windows\System\JOTdfGC.exe
  2⤵
  PID:5700
- C:\Windows\System\dzYsBBN.exe
  C:\Windows\System\dzYsBBN.exe
  2⤵
  PID:5720
- C:\Windows\System\oGgTNOQ.exe
  C:\Windows\System\oGgTNOQ.exe
  2⤵
  PID:5740
- C:\Windows\System\JBvwvzV.exe
  C:\Windows\System\JBvwvzV.exe
  2⤵
  PID:5760
- C:\Windows\System\gzbVaGI.exe
  C:\Windows\System\gzbVaGI.exe
  2⤵
  PID:5780
- C:\Windows\System\krLJTHZ.exe
  C:\Windows\System\krLJTHZ.exe
  2⤵
  PID:5800
- C:\Windows\System\CcCSXCE.exe
  C:\Windows\System\CcCSXCE.exe
  2⤵
  PID:5820
- C:\Windows\System\AhFNuya.exe
  C:\Windows\System\AhFNuya.exe
  2⤵
  PID:5836
- C:\Windows\System\nJOAalu.exe
  C:\Windows\System\nJOAalu.exe
  2⤵
  PID:5852
- C:\Windows\System\stvnVIX.exe
  C:\Windows\System\stvnVIX.exe
  2⤵
  PID:5868
- C:\Windows\System\EDqeNdF.exe
  C:\Windows\System\EDqeNdF.exe
  2⤵
  PID:5888
- C:\Windows\System\kjWbrNV.exe
  C:\Windows\System\kjWbrNV.exe
  2⤵
  PID:5908
- C:\Windows\System\XIkgOJB.exe
  C:\Windows\System\XIkgOJB.exe
  2⤵
  PID:5928
- C:\Windows\System\mawmdvE.exe
  C:\Windows\System\mawmdvE.exe
  2⤵
  PID:5948
- C:\Windows\System\zuvkdhU.exe
  C:\Windows\System\zuvkdhU.exe
  2⤵
  PID:5972
- C:\Windows\System\eyiTQHD.exe
  C:\Windows\System\eyiTQHD.exe
  2⤵
  PID:5992
- C:\Windows\System\POMfRdd.exe
  C:\Windows\System\POMfRdd.exe
  2⤵
  PID:6012
- C:\Windows\System\QinpaYo.exe
  C:\Windows\System\QinpaYo.exe
  2⤵
  PID:6032
- C:\Windows\System\OVFdWLi.exe
  C:\Windows\System\OVFdWLi.exe
  2⤵
  PID:6048
- C:\Windows\System\twIASDG.exe
  C:\Windows\System\twIASDG.exe
  2⤵
  PID:6064
- C:\Windows\System\DREmDBT.exe
  C:\Windows\System\DREmDBT.exe
  2⤵
  PID:6080
- C:\Windows\System\TKJoTSl.exe
  C:\Windows\System\TKJoTSl.exe
  2⤵
  PID:6096
- C:\Windows\System\Ahuypib.exe
  C:\Windows\System\Ahuypib.exe
  2⤵
  PID:2996
- C:\Windows\System\GZletHp.exe
  C:\Windows\System\GZletHp.exe
  2⤵
  PID:6116
- C:\Windows\System\tEviqAy.exe
  C:\Windows\System\tEviqAy.exe
  2⤵
  PID:6128
- C:\Windows\System\tyRLhdZ.exe
  C:\Windows\System\tyRLhdZ.exe
  2⤵
  PID:3300
- C:\Windows\System\gZTlBDz.exe
  C:\Windows\System\gZTlBDz.exe
  2⤵
  PID:1732
- C:\Windows\System\yjEgDCi.exe
  C:\Windows\System\yjEgDCi.exe
  2⤵
  PID:3460
- C:\Windows\System\zosXdxt.exe
  C:\Windows\System\zosXdxt.exe
  2⤵
  PID:5132
- C:\Windows\System\AXULSkJ.exe
  C:\Windows\System\AXULSkJ.exe
  2⤵
  PID:5160
- C:\Windows\System\eTkzsuH.exe
  C:\Windows\System\eTkzsuH.exe
  2⤵
  PID:3780
- C:\Windows\System\GcJsqiZ.exe
  C:\Windows\System\GcJsqiZ.exe
  2⤵
  PID:3840
- C:\Windows\System\qFIpVRF.exe
  C:\Windows\System\qFIpVRF.exe
  2⤵
  PID:820
- C:\Windows\System\AuiiGck.exe
  C:\Windows\System\AuiiGck.exe
  2⤵
  PID:5228
- C:\Windows\System\uKELwga.exe
  C:\Windows\System\uKELwga.exe
  2⤵
  PID:3252
- C:\Windows\System\DdMVCfu.exe
  C:\Windows\System\DdMVCfu.exe
  2⤵
  PID:2988
- C:\Windows\System\GtQSKuN.exe
  C:\Windows\System\GtQSKuN.exe
  2⤵
  PID:3956
- C:\Windows\System\PUjPrit.exe
  C:\Windows\System\PUjPrit.exe
  2⤵
  PID:2796
- C:\Windows\System\RkAvadZ.exe
  C:\Windows\System\RkAvadZ.exe
  2⤵
  PID:1500
- C:\Windows\System\gTEQCPw.exe
  C:\Windows\System\gTEQCPw.exe
  2⤵
  PID:4228
- C:\Windows\System\wlVFtlg.exe
  C:\Windows\System\wlVFtlg.exe
  2⤵
  PID:1132
- C:\Windows\System\KNQVgSp.exe
  C:\Windows\System\KNQVgSp.exe
  2⤵
  PID:4580
- C:\Windows\System\IKKhbuA.exe
  C:\Windows\System\IKKhbuA.exe
  2⤵
  PID:4708
- C:\Windows\System\JFDZvYY.exe
  C:\Windows\System\JFDZvYY.exe
  2⤵
  PID:5304
- C:\Windows\System\PWZZhYq.exe
  C:\Windows\System\PWZZhYq.exe
  2⤵
  PID:2376
- C:\Windows\System\rdlEQpQ.exe
  C:\Windows\System\rdlEQpQ.exe
  2⤵
  PID:1332
- C:\Windows\System\vssGmML.exe
  C:\Windows\System\vssGmML.exe
  2⤵
  PID:2880
- C:\Windows\System\ZtZvmLi.exe
  C:\Windows\System\ZtZvmLi.exe
  2⤵
  PID:3668
- C:\Windows\System\TEZLBMk.exe
  C:\Windows\System\TEZLBMk.exe
  2⤵
  PID:5440
- C:\Windows\System\sxYWyHG.exe
  C:\Windows\System\sxYWyHG.exe
  2⤵
  PID:4568
- C:\Windows\System\zRhbKCr.exe
  C:\Windows\System\zRhbKCr.exe
  2⤵
  PID:5472
- C:\Windows\System\IrbaRXu.exe
  C:\Windows\System\IrbaRXu.exe
  2⤵
  PID:5484
- C:\Windows\System\RpjZMUD.exe
  C:\Windows\System\RpjZMUD.exe
  2⤵
  PID:5500
- C:\Windows\System\eOFLNdK.exe
  C:\Windows\System\eOFLNdK.exe
  2⤵
  PID:5508
- C:\Windows\System\vQwTWNX.exe
  C:\Windows\System\vQwTWNX.exe
  2⤵
  PID:5532
- C:\Windows\System\iYPCEij.exe
  C:\Windows\System\iYPCEij.exe
  2⤵
  PID:4000
- C:\Windows\System\ievPEEJ.exe
  C:\Windows\System\ievPEEJ.exe
  2⤵
  PID:5528
- C:\Windows\System\UXNmqWD.exe
  C:\Windows\System\UXNmqWD.exe
  2⤵
  PID:892
- C:\Windows\System\zPulIsm.exe
  C:\Windows\System\zPulIsm.exe
  2⤵
  PID:1888
- C:\Windows\System\lOKlCOD.exe
  C:\Windows\System\lOKlCOD.exe
  2⤵
  PID:1784
- C:\Windows\System\NmSNBxQ.exe
  C:\Windows\System\NmSNBxQ.exe
  2⤵
  PID:2628
- C:\Windows\System\EesDSro.exe
  C:\Windows\System\EesDSro.exe
  2⤵
  PID:2212
- C:\Windows\System\ZhrcqhQ.exe
  C:\Windows\System\ZhrcqhQ.exe
  2⤵
  PID:3108
- C:\Windows\System\AskNFhx.exe
  C:\Windows\System\AskNFhx.exe
  2⤵
  PID:3204
- C:\Windows\System\EhkxZni.exe
  C:\Windows\System\EhkxZni.exe
  2⤵
  PID:3360
- C:\Windows\System\KZPDlVP.exe
  C:\Windows\System\KZPDlVP.exe
  2⤵
  PID:3428
- C:\Windows\System\nHJJGWE.exe
  C:\Windows\System\nHJJGWE.exe
  2⤵
  PID:3524
- C:\Windows\System\vCwXwGr.exe
  C:\Windows\System\vCwXwGr.exe
  2⤵
  PID:3588
- C:\Windows\System\TSwGToq.exe
  C:\Windows\System\TSwGToq.exe
  2⤵
  PID:3652
- C:\Windows\System\whJgFsl.exe
  C:\Windows\System\whJgFsl.exe
  2⤵
  PID:3716
- C:\Windows\System\ZMSEPZZ.exe
  C:\Windows\System\ZMSEPZZ.exe
  2⤵
  PID:3812
- C:\Windows\System\wbcuffB.exe
  C:\Windows\System\wbcuffB.exe
  2⤵
  PID:3904
- C:\Windows\System\YYMJRjL.exe
  C:\Windows\System\YYMJRjL.exe
  2⤵
  PID:4004
- C:\Windows\System\vhNniLI.exe
  C:\Windows\System\vhNniLI.exe
  2⤵
  PID:1812
- C:\Windows\System\jsmupVs.exe
  C:\Windows\System\jsmupVs.exe
  2⤵
  PID:3280
- C:\Windows\System\tYNnhJK.exe
  C:\Windows\System\tYNnhJK.exe
  2⤵
  PID:3604
- C:\Windows\System\XGYhmMy.exe
  C:\Windows\System\XGYhmMy.exe
  2⤵
  PID:3856
- C:\Windows\System\fJmfxaw.exe
  C:\Windows\System\fJmfxaw.exe
  2⤵
  PID:2836
- C:\Windows\System\yPVYldL.exe
  C:\Windows\System\yPVYldL.exe
  2⤵
  PID:4136
- C:\Windows\System\ntkzdDp.exe
  C:\Windows\System\ntkzdDp.exe
  2⤵
  PID:4260
- C:\Windows\System\mMaCEIH.exe
  C:\Windows\System\mMaCEIH.exe
  2⤵
  PID:4356
- C:\Windows\System\PQWhOyy.exe
  C:\Windows\System\PQWhOyy.exe
  2⤵
  PID:4420
- C:\Windows\System\cxeFyIr.exe
  C:\Windows\System\cxeFyIr.exe
  2⤵
  PID:4452
- C:\Windows\System\glLcwJr.exe
  C:\Windows\System\glLcwJr.exe
  2⤵
  PID:4520
- C:\Windows\System\OGfMdco.exe
  C:\Windows\System\OGfMdco.exe
  2⤵
  PID:4644
- C:\Windows\System\FReRXCF.exe
  C:\Windows\System\FReRXCF.exe
  2⤵
  PID:4744
- C:\Windows\System\GlbEsoR.exe
  C:\Windows\System\GlbEsoR.exe
  2⤵
  PID:4808
- C:\Windows\System\FfdvGIG.exe
  C:\Windows\System\FfdvGIG.exe
  2⤵
  PID:4900
- C:\Windows\System\maGqwkM.exe
  C:\Windows\System\maGqwkM.exe
  2⤵
  PID:4968
- C:\Windows\System\wXIUpsr.exe
  C:\Windows\System\wXIUpsr.exe
  2⤵
  PID:5032
- C:\Windows\System\cBkttpo.exe
  C:\Windows\System\cBkttpo.exe
  2⤵
  PID:5096
- C:\Windows\System\PUhECkZ.exe
  C:\Windows\System\PUhECkZ.exe
  2⤵
  PID:4244
- C:\Windows\System\jDECRIM.exe
  C:\Windows\System\jDECRIM.exe
  2⤵
  PID:4760
- C:\Windows\System\sheDCBq.exe
  C:\Windows\System\sheDCBq.exe
  2⤵
  PID:760
- C:\Windows\System\xdsFYCA.exe
  C:\Windows\System\xdsFYCA.exe
  2⤵
  PID:4696
- C:\Windows\System\fbOMqBc.exe
  C:\Windows\System\fbOMqBc.exe
  2⤵
  PID:5208
- C:\Windows\System\fdOeSUG.exe
  C:\Windows\System\fdOeSUG.exe
  2⤵
  PID:2932
- C:\Windows\System\QfDIWfu.exe
  C:\Windows\System\QfDIWfu.exe
  2⤵
  PID:5292
- C:\Windows\System\mDAMyAu.exe
  C:\Windows\System\mDAMyAu.exe
  2⤵
  PID:5360
- C:\Windows\System\gJTzIio.exe
  C:\Windows\System\gJTzIio.exe
  2⤵
  PID:5424
- C:\Windows\System\JqLxuXX.exe
  C:\Windows\System\JqLxuXX.exe
  2⤵
  PID:5456
- C:\Windows\System\hqBbUhn.exe
  C:\Windows\System\hqBbUhn.exe
  2⤵
  PID:5144
- C:\Windows\System\qzfbOfh.exe
  C:\Windows\System\qzfbOfh.exe
  2⤵
  PID:5544
- C:\Windows\System\NkypNRI.exe
  C:\Windows\System\NkypNRI.exe
  2⤵
  PID:5556
- C:\Windows\System\RoapxYZ.exe
  C:\Windows\System\RoapxYZ.exe
  2⤵
  PID:1256
- C:\Windows\System\WthNLSX.exe
  C:\Windows\System\WthNLSX.exe
  2⤵
  PID:5616
- C:\Windows\System\KUarGJV.exe
  C:\Windows\System\KUarGJV.exe
  2⤵
  PID:2552
- C:\Windows\System\tgWyxeT.exe
  C:\Windows\System\tgWyxeT.exe
  2⤵
  PID:5692
- C:\Windows\System\xcgYUgk.exe
  C:\Windows\System\xcgYUgk.exe
  2⤵
  PID:1232
- C:\Windows\System\MfVICYz.exe
  C:\Windows\System\MfVICYz.exe
  2⤵
  PID:1568
- C:\Windows\System\MtSjTun.exe
  C:\Windows\System\MtSjTun.exe
  2⤵
  PID:1872
- C:\Windows\System\WXgBACX.exe
  C:\Windows\System\WXgBACX.exe
  2⤵
  PID:5776
- C:\Windows\System\AvcYjJv.exe
  C:\Windows\System\AvcYjJv.exe
  2⤵
  PID:1740
- C:\Windows\System\zpVhStI.exe
  C:\Windows\System\zpVhStI.exe
  2⤵
  PID:5844
- C:\Windows\System\GURHIks.exe
  C:\Windows\System\GURHIks.exe
  2⤵
  PID:5880
- C:\Windows\System\LzFuchP.exe
  C:\Windows\System\LzFuchP.exe
  2⤵
  PID:5920
- C:\Windows\System\fsPKaiL.exe
  C:\Windows\System\fsPKaiL.exe
  2⤵
  PID:5956
- C:\Windows\System\SmjCAwo.exe
  C:\Windows\System\SmjCAwo.exe
  2⤵
  PID:6000
- C:\Windows\System\InKzGCH.exe
  C:\Windows\System\InKzGCH.exe
  2⤵
  PID:1824
- C:\Windows\System\rLPpbkx.exe
  C:\Windows\System\rLPpbkx.exe
  2⤵
  PID:6040
- C:\Windows\System\PLYKfsj.exe
  C:\Windows\System\PLYKfsj.exe
  2⤵
  PID:6076
- C:\Windows\System\otAbxSa.exe
  C:\Windows\System\otAbxSa.exe
  2⤵
  PID:5668
- C:\Windows\System\pkYTHZd.exe
  C:\Windows\System\pkYTHZd.exe
  2⤵
  PID:5708
- C:\Windows\System\sUbWRvQ.exe
  C:\Windows\System\sUbWRvQ.exe
  2⤵
  PID:6100
- C:\Windows\System\fRWkktI.exe
  C:\Windows\System\fRWkktI.exe
  2⤵
  PID:5828
- C:\Windows\System\ArBSrgx.exe
  C:\Windows\System\ArBSrgx.exe
  2⤵
  PID:5896
- C:\Windows\System\GHiHMnC.exe
  C:\Windows\System\GHiHMnC.exe
  2⤵
  PID:5940
- C:\Windows\System\YtLYazG.exe
  C:\Windows\System\YtLYazG.exe
  2⤵
  PID:5984
- C:\Windows\System\XNLYWYN.exe
  C:\Windows\System\XNLYWYN.exe
  2⤵
  PID:6028
- C:\Windows\System\BwywObz.exe
  C:\Windows\System\BwywObz.exe
  2⤵
  PID:6136
- C:\Windows\System\TfHlxXo.exe
  C:\Windows\System\TfHlxXo.exe
  2⤵
  PID:3136
- C:\Windows\System\hVySrpB.exe
  C:\Windows\System\hVySrpB.exe
  2⤵
  PID:6140
- C:\Windows\System\sllvwAb.exe
  C:\Windows\System\sllvwAb.exe
  2⤵
  PID:1892
- C:\Windows\System\EAUrMgh.exe
  C:\Windows\System\EAUrMgh.exe
  2⤵
  PID:1592
- C:\Windows\System\qISqkao.exe
  C:\Windows\System\qISqkao.exe
  2⤵
  PID:2916
- C:\Windows\System\acqDFLG.exe
  C:\Windows\System\acqDFLG.exe
  2⤵
  PID:2656
- C:\Windows\System\eCwZees.exe
  C:\Windows\System\eCwZees.exe
  2⤵
  PID:1928
- C:\Windows\System\sBmvzEz.exe
  C:\Windows\System\sBmvzEz.exe
  2⤵
  PID:4084
- C:\Windows\System\ETTmbKb.exe
  C:\Windows\System\ETTmbKb.exe
  2⤵
  PID:1492
- C:\Windows\System\KLWyzKe.exe
  C:\Windows\System\KLWyzKe.exe
  2⤵
  PID:2860
- C:\Windows\System\msvEnxJ.exe
  C:\Windows\System\msvEnxJ.exe
  2⤵
  PID:5340
- C:\Windows\System\AehTYyz.exe
  C:\Windows\System\AehTYyz.exe
  2⤵
  PID:1060
- C:\Windows\System\EMHiBEE.exe
  C:\Windows\System\EMHiBEE.exe
  2⤵
  PID:5376
- C:\Windows\System\UxRlDVx.exe
  C:\Windows\System\UxRlDVx.exe
  2⤵
  PID:2260
- C:\Windows\System\NJjZiik.exe
  C:\Windows\System\NJjZiik.exe
  2⤵
  PID:5496
- C:\Windows\System\BjYmCrn.exe
  C:\Windows\System\BjYmCrn.exe
  2⤵
  PID:5512
- C:\Windows\System\PPFgCKn.exe
  C:\Windows\System\PPFgCKn.exe
  2⤵
  PID:1768
- C:\Windows\System\XhsXBTI.exe
  C:\Windows\System\XhsXBTI.exe
  2⤵
  PID:3036
- C:\Windows\System\wztkHxf.exe
  C:\Windows\System\wztkHxf.exe
  2⤵
  PID:668
- C:\Windows\System\vqZBtLx.exe
  C:\Windows\System\vqZBtLx.exe
  2⤵
  PID:3104
- C:\Windows\System\BaffEXU.exe
  C:\Windows\System\BaffEXU.exe
  2⤵
  PID:3332
- C:\Windows\System\zSkGYPo.exe
  C:\Windows\System\zSkGYPo.exe
  2⤵
  PID:3520
- C:\Windows\System\DmSYFgm.exe
  C:\Windows\System\DmSYFgm.exe
  2⤵
  PID:3584
- C:\Windows\System\VgWRbxk.exe
  C:\Windows\System\VgWRbxk.exe
  2⤵
  PID:3808
- C:\Windows\System\IMGFQEl.exe
  C:\Windows\System\IMGFQEl.exe
  2⤵
  PID:3876
- C:\Windows\System\FeyrEHr.exe
  C:\Windows\System\FeyrEHr.exe
  2⤵
  PID:3152
- C:\Windows\System\lCMryIs.exe
  C:\Windows\System\lCMryIs.exe
  2⤵
  PID:3760
- C:\Windows\System\cUttpNC.exe
  C:\Windows\System\cUttpNC.exe
  2⤵
  PID:4104
- C:\Windows\System\DbaEMga.exe
  C:\Windows\System\DbaEMga.exe
  2⤵
  PID:4168
- C:\Windows\System\WuXaoic.exe
  C:\Windows\System\WuXaoic.exe
  2⤵
  PID:4392
- C:\Windows\System\dXiqDmc.exe
  C:\Windows\System\dXiqDmc.exe
  2⤵
  PID:4772
- C:\Windows\System\HMHXzlw.exe
  C:\Windows\System\HMHXzlw.exe
  2⤵
  PID:4936
- C:\Windows\System\CddoHlJ.exe
  C:\Windows\System\CddoHlJ.exe
  2⤵
  PID:4756
- C:\Windows\System\jHgVQRd.exe
  C:\Windows\System\jHgVQRd.exe
  2⤵
  PID:4964
- C:\Windows\System\dTuNIzy.exe
  C:\Windows\System\dTuNIzy.exe
  2⤵
  PID:4216
- C:\Windows\System\gzyLvnJ.exe
  C:\Windows\System\gzyLvnJ.exe
  2⤵
  PID:4408
- C:\Windows\System\rdRZQXD.exe
  C:\Windows\System\rdRZQXD.exe
  2⤵
  PID:3016
- C:\Windows\System\pCwXZte.exe
  C:\Windows\System\pCwXZte.exe
  2⤵
  PID:5288
- C:\Windows\System\YVwVozZ.exe
  C:\Windows\System\YVwVozZ.exe
  2⤵
  PID:5452
- C:\Windows\System\hGCWiRb.exe
  C:\Windows\System\hGCWiRb.exe
  2⤵
  PID:2052
- C:\Windows\System\BMcEkgm.exe
  C:\Windows\System\BMcEkgm.exe
  2⤵
  PID:5568
- C:\Windows\System\BEPnyhx.exe
  C:\Windows\System\BEPnyhx.exe
  2⤵
  PID:2668
- C:\Windows\System\RrbzHOM.exe
  C:\Windows\System\RrbzHOM.exe
  2⤵
  PID:5736
- C:\Windows\System\FLvEioT.exe
  C:\Windows\System\FLvEioT.exe
  2⤵
  PID:5772
- C:\Windows\System\rusOyWh.exe
  C:\Windows\System\rusOyWh.exe
  2⤵
  PID:1736
- C:\Windows\System\GALxbju.exe
  C:\Windows\System\GALxbju.exe
  2⤵
  PID:5876
- C:\Windows\System\ehFhYhC.exe
  C:\Windows\System\ehFhYhC.exe
  2⤵
  PID:5600
- C:\Windows\System\getkyRH.exe
  C:\Windows\System\getkyRH.exe
  2⤵
  PID:2560
- C:\Windows\System\tuWSUil.exe
  C:\Windows\System\tuWSUil.exe
  2⤵
  PID:1672
- C:\Windows\System\iCsAePv.exe
  C:\Windows\System\iCsAePv.exe
  2⤵
  PID:5680
- C:\Windows\System\dnIcced.exe
  C:\Windows\System\dnIcced.exe
  2⤵
  PID:5796
- C:\Windows\System\vBPHKfC.exe
  C:\Windows\System\vBPHKfC.exe
  2⤵
  PID:5936
- C:\Windows\System\bhUtyYd.exe
  C:\Windows\System\bhUtyYd.exe
  2⤵
  PID:5988
- C:\Windows\System\WVqUcwQ.exe
  C:\Windows\System\WVqUcwQ.exe
  2⤵
  PID:6092
- C:\Windows\System\QjzMGQN.exe
  C:\Windows\System\QjzMGQN.exe
  2⤵
  PID:3456
- C:\Windows\System\amWSFYv.exe
  C:\Windows\System\amWSFYv.exe
  2⤵
  PID:3776
- C:\Windows\System\wHXUuKo.exe
  C:\Windows\System\wHXUuKo.exe
  2⤵
  PID:2804
- C:\Windows\System\sAaeWsI.exe
  C:\Windows\System\sAaeWsI.exe
  2⤵
  PID:4132
- C:\Windows\System\jkeFHeN.exe
  C:\Windows\System\jkeFHeN.exe
  2⤵
  PID:5436
- C:\Windows\System\sWTQjhV.exe
  C:\Windows\System\sWTQjhV.exe
  2⤵
  PID:5492
- C:\Windows\System\hZNzCah.exe
  C:\Windows\System\hZNzCah.exe
  2⤵
  PID:4372
- C:\Windows\System\CCucvWh.exe
  C:\Windows\System\CCucvWh.exe
  2⤵
  PID:5504
- C:\Windows\System\UgwmlUJ.exe
  C:\Windows\System\UgwmlUJ.exe
  2⤵
  PID:2620
- C:\Windows\System\jCQRjEZ.exe
  C:\Windows\System\jCQRjEZ.exe
  2⤵
  PID:2496
- C:\Windows\System\Ltvljbj.exe
  C:\Windows\System\Ltvljbj.exe
  2⤵
  PID:3936
- C:\Windows\System\vuhDNYW.exe
  C:\Windows\System\vuhDNYW.exe
  2⤵
  PID:3124
- C:\Windows\System\IUNyijV.exe
  C:\Windows\System\IUNyijV.exe
  2⤵
  PID:4100
- C:\Windows\System\pOZAbtY.exe
  C:\Windows\System\pOZAbtY.exe
  2⤵
  PID:4612
- C:\Windows\System\ZheGNVB.exe
  C:\Windows\System\ZheGNVB.exe
  2⤵
  PID:4840
- C:\Windows\System\bFAiHEB.exe
  C:\Windows\System\bFAiHEB.exe
  2⤵
  PID:5000
- C:\Windows\System\dqKoeZg.exe
  C:\Windows\System\dqKoeZg.exe
  2⤵
  PID:5260
- C:\Windows\System\oyTJtLn.exe
  C:\Windows\System\oyTJtLn.exe
  2⤵
  PID:5012
- C:\Windows\System\hPyZYPl.exe
  C:\Windows\System\hPyZYPl.exe
  2⤵
  PID:5564
- C:\Windows\System\plkBfPO.exe
  C:\Windows\System\plkBfPO.exe
  2⤵
  PID:5728
- C:\Windows\System\MrxgoEl.exe
  C:\Windows\System\MrxgoEl.exe
  2⤵
  PID:5768
- C:\Windows\System\taByyKe.exe
  C:\Windows\System\taByyKe.exe
  2⤵
  PID:5848
- C:\Windows\System\ZxJBeNa.exe
  C:\Windows\System\ZxJBeNa.exe
  2⤵
  PID:6004
- C:\Windows\System\TExDidj.exe
  C:\Windows\System\TExDidj.exe
  2⤵
  PID:5672
- C:\Windows\System\CzAjKhV.exe
  C:\Windows\System\CzAjKhV.exe
  2⤵
  PID:6024
- C:\Windows\System\KyvIeSZ.exe
  C:\Windows\System\KyvIeSZ.exe
  2⤵
  PID:3296
- C:\Windows\System\rAFPPXU.exe
  C:\Windows\System\rAFPPXU.exe
  2⤵
  PID:3940
- C:\Windows\System\aSqdoNU.exe
  C:\Windows\System\aSqdoNU.exe
  2⤵
  PID:2852
- C:\Windows\System\NwTRqQQ.exe
  C:\Windows\System\NwTRqQQ.exe
  2⤵
  PID:3168
- C:\Windows\System\SaBoSIQ.exe
  C:\Windows\System\SaBoSIQ.exe
  2⤵
  PID:3648
- C:\Windows\System\MmnMBJB.exe
  C:\Windows\System\MmnMBJB.exe
  2⤵
  PID:3504
- C:\Windows\System\sYrmDXU.exe
  C:\Windows\System\sYrmDXU.exe
  2⤵
  PID:5064
- C:\Windows\System\gRkyRoL.exe
  C:\Windows\System\gRkyRoL.exe
  2⤵
  PID:5924
- C:\Windows\System\BecUUAG.exe
  C:\Windows\System\BecUUAG.exe
  2⤵
  PID:2164
- C:\Windows\System\tgnMJHZ.exe
  C:\Windows\System\tgnMJHZ.exe
  2⤵
  PID:4868
- C:\Windows\System\PrCZQKZ.exe
  C:\Windows\System\PrCZQKZ.exe
  2⤵
  PID:3972
- C:\Windows\System\raXgoPe.exe
  C:\Windows\System\raXgoPe.exe
  2⤵
  PID:5420
- C:\Windows\System\peKDOCy.exe
  C:\Windows\System\peKDOCy.exe
  2⤵
  PID:4872
- C:\Windows\System\bdpshRO.exe
  C:\Windows\System\bdpshRO.exe
  2⤵
  PID:2604
- C:\Windows\System\UaYJepu.exe
  C:\Windows\System\UaYJepu.exe
  2⤵
  PID:5860
- C:\Windows\System\TnzayRk.exe
  C:\Windows\System\TnzayRk.exe
  2⤵
  PID:3172
- C:\Windows\System\QcDrFcd.exe
  C:\Windows\System\QcDrFcd.exe
  2⤵
  PID:2688
- C:\Windows\System\fOkcPuJ.exe
  C:\Windows\System\fOkcPuJ.exe
  2⤵
  PID:6148
- C:\Windows\System\WTirvAS.exe
  C:\Windows\System\WTirvAS.exe
  2⤵
  PID:6164
- C:\Windows\System\pIgyWID.exe
  C:\Windows\System\pIgyWID.exe
  2⤵
  PID:6180
- C:\Windows\System\HKLOZLm.exe
  C:\Windows\System\HKLOZLm.exe
  2⤵
  PID:6196
- C:\Windows\System\WEOftxm.exe
  C:\Windows\System\WEOftxm.exe
  2⤵
  PID:6212
- C:\Windows\System\DPWTqre.exe
  C:\Windows\System\DPWTqre.exe
  2⤵
  PID:6228
- C:\Windows\System\WIwMWCF.exe
  C:\Windows\System\WIwMWCF.exe
  2⤵
  PID:6244
- C:\Windows\System\COLYqZg.exe
  C:\Windows\System\COLYqZg.exe
  2⤵
  PID:6260
- C:\Windows\System\wysNEXy.exe
  C:\Windows\System\wysNEXy.exe
  2⤵
  PID:6276
- C:\Windows\System\aqCzVEG.exe
  C:\Windows\System\aqCzVEG.exe
  2⤵
  PID:6296
- C:\Windows\System\kxRsPaF.exe
  C:\Windows\System\kxRsPaF.exe
  2⤵
  PID:6312
- C:\Windows\System\TGWuhgu.exe
  C:\Windows\System\TGWuhgu.exe
  2⤵
  PID:6328
- C:\Windows\System\dMRBtUM.exe
  C:\Windows\System\dMRBtUM.exe
  2⤵
  PID:6344
- C:\Windows\System\MFZTanS.exe
  C:\Windows\System\MFZTanS.exe
  2⤵
  PID:6360
- C:\Windows\System\RkosoWJ.exe
  C:\Windows\System\RkosoWJ.exe
  2⤵
  PID:6376
- C:\Windows\System\MfZdvDQ.exe
  C:\Windows\System\MfZdvDQ.exe
  2⤵
  PID:6392
- C:\Windows\System\lJNAPnZ.exe
  C:\Windows\System\lJNAPnZ.exe
  2⤵
  PID:6408
- C:\Windows\System\KyhmrNb.exe
  C:\Windows\System\KyhmrNb.exe
  2⤵
  PID:6424
- C:\Windows\System\xyYfPoM.exe
  C:\Windows\System\xyYfPoM.exe
  2⤵
  PID:6440
- C:\Windows\System\MhUcCOz.exe
  C:\Windows\System\MhUcCOz.exe
  2⤵
  PID:7100
- C:\Windows\System\gsGUvVh.exe
  C:\Windows\System\gsGUvVh.exe
  2⤵
  PID:7124
- C:\Windows\System\MsAxlSl.exe
  C:\Windows\System\MsAxlSl.exe
  2⤵
  PID:7152
- C:\Windows\System\KcYaTIi.exe
  C:\Windows\System\KcYaTIi.exe
  2⤵
  PID:4068
- C:\Windows\System\PUgtFca.exe
  C:\Windows\System\PUgtFca.exe
  2⤵
  PID:5276
- C:\Windows\System\TlEUevW.exe
  C:\Windows\System\TlEUevW.exe
  2⤵
  PID:6172
- C:\Windows\System\BeCWKpn.exe
  C:\Windows\System\BeCWKpn.exe
  2⤵
  PID:6208
- C:\Windows\System\JAZvnak.exe
  C:\Windows\System\JAZvnak.exe
  2⤵
  PID:4468
- C:\Windows\System\WqDaCyx.exe
  C:\Windows\System\WqDaCyx.exe
  2⤵
  PID:2768
- C:\Windows\System\nrfDSEB.exe
  C:\Windows\System\nrfDSEB.exe
  2⤵
  PID:2900
- C:\Windows\System\HkZBqwi.exe
  C:\Windows\System\HkZBqwi.exe
  2⤵
  PID:6272
- C:\Windows\System\UOyrsFj.exe
  C:\Windows\System\UOyrsFj.exe
  2⤵
  PID:2720
- C:\Windows\System\nVOgVyI.exe
  C:\Windows\System\nVOgVyI.exe
  2⤵
  PID:6464
- C:\Windows\System\VxgEEUm.exe
  C:\Windows\System\VxgEEUm.exe
  2⤵
  PID:6484
- C:\Windows\System\ORLghvn.exe
  C:\Windows\System\ORLghvn.exe
  2⤵
  PID:6496
- C:\Windows\System\rXRZobc.exe
  C:\Windows\System\rXRZobc.exe
  2⤵
  PID:6532
- C:\Windows\System\nmkgszT.exe
  C:\Windows\System\nmkgszT.exe
  2⤵
  PID:6552
- C:\Windows\System\MKWQTeP.exe
  C:\Windows\System\MKWQTeP.exe
  2⤵
  PID:6568
- C:\Windows\System\rHaqqvx.exe
  C:\Windows\System\rHaqqvx.exe
  2⤵
  PID:6584
- C:\Windows\System\EEhzdxI.exe
  C:\Windows\System\EEhzdxI.exe
  2⤵
  PID:6596
- C:\Windows\System\TzLcvZu.exe
  C:\Windows\System\TzLcvZu.exe
  2⤵
  PID:6604
- C:\Windows\System\miKnDws.exe
  C:\Windows\System\miKnDws.exe
  2⤵
  PID:6628
- C:\Windows\System\chfqxwe.exe
  C:\Windows\System\chfqxwe.exe
  2⤵
  PID:6648
- C:\Windows\System\hFXNWZv.exe
  C:\Windows\System\hFXNWZv.exe
  2⤵
  PID:6644
- C:\Windows\System\krLoiaJ.exe
  C:\Windows\System\krLoiaJ.exe
  2⤵
  PID:6712
- C:\Windows\System\UnOFDNu.exe
  C:\Windows\System\UnOFDNu.exe
  2⤵
  PID:6720
- C:\Windows\System\lXyvhHW.exe
  C:\Windows\System\lXyvhHW.exe
  2⤵
  PID:6736
- C:\Windows\System\LkYAxEm.exe
  C:\Windows\System\LkYAxEm.exe
  2⤵
  PID:6752
- C:\Windows\System\pZQzrfM.exe
  C:\Windows\System\pZQzrfM.exe
  2⤵
  PID:6768
- C:\Windows\System\fGXZYtb.exe
  C:\Windows\System\fGXZYtb.exe
  2⤵
  PID:6784
- C:\Windows\System\rShPifE.exe
  C:\Windows\System\rShPifE.exe
  2⤵
  PID:6804
- C:\Windows\System\FVhTRpe.exe
  C:\Windows\System\FVhTRpe.exe
  2⤵
  PID:6820
- C:\Windows\System\KvPqGaz.exe
  C:\Windows\System\KvPqGaz.exe
  2⤵
  PID:6844
- C:\Windows\System\oLChWMD.exe
  C:\Windows\System\oLChWMD.exe
  2⤵
  PID:272
- C:\Windows\System\jXtLGGu.exe
  C:\Windows\System\jXtLGGu.exe
  2⤵
  PID:6876
- C:\Windows\System\fxrHQco.exe
  C:\Windows\System\fxrHQco.exe
  2⤵
  PID:6900
- C:\Windows\System\nzxsLVF.exe
  C:\Windows\System\nzxsLVF.exe
  2⤵
  PID:6916
- C:\Windows\System\DShpBmB.exe
  C:\Windows\System\DShpBmB.exe
  2⤵
  PID:6928
- C:\Windows\System\ibnCotP.exe
  C:\Windows\System\ibnCotP.exe
  2⤵
  PID:6944
- C:\Windows\System\HxGyaby.exe
  C:\Windows\System\HxGyaby.exe
  2⤵
  PID:6964
- C:\Windows\System\SmZoeni.exe
  C:\Windows\System\SmZoeni.exe
  2⤵
  PID:6992
- C:\Windows\System\mcXFbMT.exe
  C:\Windows\System\mcXFbMT.exe
  2⤵
  PID:7012
- C:\Windows\System\QVcJoqi.exe
  C:\Windows\System\QVcJoqi.exe
  2⤵
  PID:7032
- C:\Windows\System\bhCMnwR.exe
  C:\Windows\System\bhCMnwR.exe
  2⤵
  PID:7056
- C:\Windows\System\slzFTWr.exe
  C:\Windows\System\slzFTWr.exe
  2⤵
  PID:7072
- C:\Windows\System\IZEGFfL.exe
  C:\Windows\System\IZEGFfL.exe
  2⤵
  PID:7088
- C:\Windows\System\dBefRrz.exe
  C:\Windows\System\dBefRrz.exe
  2⤵
  PID:3028
- C:\Windows\System\nlqgMIN.exe
  C:\Windows\System\nlqgMIN.exe
  2⤵
  PID:3000
- C:\Windows\System\Pnbclej.exe
  C:\Windows\System\Pnbclej.exe
  2⤵
  PID:2208
- C:\Windows\System\XykTwZb.exe
  C:\Windows\System\XykTwZb.exe
  2⤵
  PID:4292
- C:\Windows\System\gVffvUL.exe
  C:\Windows\System\gVffvUL.exe
  2⤵
  PID:7164
- C:\Windows\System\qVKhCJh.exe
  C:\Windows\System\qVKhCJh.exe
  2⤵
  PID:6252
- C:\Windows\System\SXEfbjn.exe
  C:\Windows\System\SXEfbjn.exe
  2⤵
  PID:6156
- C:\Windows\System\EiVkXSm.exe
  C:\Windows\System\EiVkXSm.exe
  2⤵
  PID:6308
- C:\Windows\System\Hfbqvbw.exe
  C:\Windows\System\Hfbqvbw.exe
  2⤵
  PID:5612
- C:\Windows\System\mjDhHwU.exe
  C:\Windows\System\mjDhHwU.exe
  2⤵
  PID:6288
- C:\Windows\System\CiLoqIY.exe
  C:\Windows\System\CiLoqIY.exe
  2⤵
  PID:6384
- C:\Windows\System\uJaetsx.exe
  C:\Windows\System\uJaetsx.exe
  2⤵
  PID:6416
- C:\Windows\System\pTrVhsw.exe
  C:\Windows\System\pTrVhsw.exe
  2⤵
  PID:6476
- C:\Windows\System\AWYKqHY.exe
  C:\Windows\System\AWYKqHY.exe
  2⤵
  PID:6508
- C:\Windows\System\CYhOwby.exe
  C:\Windows\System\CYhOwby.exe
  2⤵
  PID:6524
- C:\Windows\System\arWJBdY.exe
  C:\Windows\System\arWJBdY.exe
  2⤵
  PID:6592
- C:\Windows\System\zFrrqbq.exe
  C:\Windows\System\zFrrqbq.exe
  2⤵
  PID:6660
- C:\Windows\System\kmMYLhh.exe
  C:\Windows\System\kmMYLhh.exe
  2⤵
  PID:5832
- C:\Windows\System\mgTQhCY.exe
  C:\Windows\System\mgTQhCY.exe
  2⤵
  PID:6456
- C:\Windows\System\AHPsVzO.exe
  C:\Windows\System\AHPsVzO.exe
  2⤵
  PID:2624
- C:\Windows\System\haDquun.exe
  C:\Windows\System\haDquun.exe
  2⤵
  PID:6576
- C:\Windows\System\xQyqTNW.exe
  C:\Windows\System\xQyqTNW.exe
  2⤵
  PID:1544
- C:\Windows\System\XBdSyeb.exe
  C:\Windows\System\XBdSyeb.exe
  2⤵
  PID:6636
- C:\Windows\System\XhLcOBU.exe
  C:\Windows\System\XhLcOBU.exe
  2⤵
  PID:6688
- C:\Windows\System\veslZKb.exe
  C:\Windows\System\veslZKb.exe
  2⤵
  PID:7140
- C:\Windows\System\fzMCkPQ.exe
  C:\Windows\System\fzMCkPQ.exe
  2⤵
  PID:6728
- C:\Windows\System\fhUifLx.exe
  C:\Windows\System\fhUifLx.exe
  2⤵
  PID:6668
- C:\Windows\System\TmdJNYH.exe
  C:\Windows\System\TmdJNYH.exe
  2⤵
  PID:6708
- C:\Windows\System\nhnYxch.exe
  C:\Windows\System\nhnYxch.exe
  2⤵
  PID:6812
- C:\Windows\System\KRpDseC.exe
  C:\Windows\System\KRpDseC.exe
  2⤵
  PID:6792
- C:\Windows\System\agXUEDF.exe
  C:\Windows\System\agXUEDF.exe
  2⤵
  PID:6796
- C:\Windows\System\KHbeglN.exe
  C:\Windows\System\KHbeglN.exe
  2⤵
  PID:6860
- C:\Windows\System\OWyEITP.exe
  C:\Windows\System\OWyEITP.exe
  2⤵
  PID:6884
- C:\Windows\System\BmFSbeC.exe
  C:\Windows\System\BmFSbeC.exe
  2⤵
  PID:6908
- C:\Windows\System\hccEUIa.exe
  C:\Windows\System\hccEUIa.exe
  2⤵
  PID:6972
- C:\Windows\System\ImhGSeS.exe
  C:\Windows\System\ImhGSeS.exe
  2⤵
  PID:6988
- C:\Windows\System\tFTzuZX.exe
  C:\Windows\System\tFTzuZX.exe
  2⤵
  PID:6960
- C:\Windows\System\kZBYvkM.exe
  C:\Windows\System\kZBYvkM.exe
  2⤵
  PID:7000
- C:\Windows\System\IToXiBx.exe
  C:\Windows\System\IToXiBx.exe
  2⤵
  PID:7068
- C:\Windows\System\QEdUJVJ.exe
  C:\Windows\System\QEdUJVJ.exe
  2⤵
  PID:7044
- C:\Windows\System\nihGSBJ.exe
  C:\Windows\System\nihGSBJ.exe
  2⤵
  PID:7116
- C:\Windows\System\oApUxwn.exe
  C:\Windows\System\oApUxwn.exe
  2⤵
  PID:2984
- C:\Windows\System\XnbVBKs.exe
  C:\Windows\System\XnbVBKs.exe
  2⤵
  PID:1604
- C:\Windows\System\qYTeNWY.exe
  C:\Windows\System\qYTeNWY.exe
  2⤵
  PID:6304
- C:\Windows\System\JXmUVAv.exe
  C:\Windows\System\JXmUVAv.exe
  2⤵
  PID:6340
- C:\Windows\System\snFwibC.exe
  C:\Windows\System\snFwibC.exe
  2⤵
  PID:6324
- C:\Windows\System\zgKzBWJ.exe
  C:\Windows\System\zgKzBWJ.exe
  2⤵
  PID:1264
- C:\Windows\System\QjXFTTH.exe
  C:\Windows\System\QjXFTTH.exe
  2⤵
  PID:6400
- C:\Windows\System\LozDHhD.exe
  C:\Windows\System\LozDHhD.exe
  2⤵
  PID:6512
- C:\Windows\System\fXnepYZ.exe
  C:\Windows\System\fXnepYZ.exe
  2⤵
  PID:6504
- C:\Windows\System\evTExTS.exe
  C:\Windows\System\evTExTS.exe
  2⤵
  PID:6448
- C:\Windows\System\sQpAAmT.exe
  C:\Windows\System\sQpAAmT.exe
  2⤵
  PID:6204
- C:\Windows\System\NyMSqzt.exe
  C:\Windows\System\NyMSqzt.exe
  2⤵
  PID:7148
- C:\Windows\System\ZkgHhpo.exe
  C:\Windows\System\ZkgHhpo.exe
  2⤵
  PID:6224
- C:\Windows\System\MZaJSYK.exe
  C:\Windows\System\MZaJSYK.exe
  2⤵
  PID:6776
- C:\Windows\System\ZDcmced.exe
  C:\Windows\System\ZDcmced.exe
  2⤵
  PID:6492
- C:\Windows\System\qgemNok.exe
  C:\Windows\System\qgemNok.exe
  2⤵
  PID:6680
- C:\Windows\System\NlBmdCP.exe
  C:\Windows\System\NlBmdCP.exe
  2⤵
  PID:6872
- C:\Windows\System\NMlMJkp.exe
  C:\Windows\System\NMlMJkp.exe
  2⤵
  PID:6940
- C:\Windows\System\sSFcRgO.exe
  C:\Windows\System\sSFcRgO.exe
  2⤵
  PID:2556
- C:\Windows\System\jxIqHln.exe
  C:\Windows\System\jxIqHln.exe
  2⤵
  PID:764
- C:\Windows\System\yZPujPV.exe
  C:\Windows\System\yZPujPV.exe
  2⤵
  PID:1820
- C:\Windows\System\DyqLeFa.exe
  C:\Windows\System\DyqLeFa.exe
  2⤵
  PID:7120
- C:\Windows\System\CjScWgy.exe
  C:\Windows\System\CjScWgy.exe
  2⤵
  PID:6388
- C:\Windows\System\RFoiqGb.exe
  C:\Windows\System\RFoiqGb.exe
  2⤵
  PID:6656
- C:\Windows\System\kSTgHCt.exe
  C:\Windows\System\kSTgHCt.exe
  2⤵
  PID:1488
- C:\Windows\System\faUpglc.exe
  C:\Windows\System\faUpglc.exe
  2⤵
  PID:6852
- C:\Windows\System\rxpczAN.exe
  C:\Windows\System\rxpczAN.exe
  2⤵
  PID:1800
- C:\Windows\System\PLQRtSl.exe
  C:\Windows\System\PLQRtSl.exe
  2⤵
  PID:2548
- C:\Windows\System\akeqQJI.exe
  C:\Windows\System\akeqQJI.exe
  2⤵
  PID:6984
- C:\Windows\System\dQowMkI.exe
  C:\Windows\System\dQowMkI.exe
  2⤵
  PID:7084
- C:\Windows\System\osYDwaC.exe
  C:\Windows\System\osYDwaC.exe
  2⤵
  PID:6472
- C:\Windows\System\hShQfuF.exe
  C:\Windows\System\hShQfuF.exe
  2⤵
  PID:2568
- C:\Windows\System\uupIchs.exe
  C:\Windows\System\uupIchs.exe
  2⤵
  PID:6816
- C:\Windows\System\pVqResL.exe
  C:\Windows\System\pVqResL.exe
  2⤵
  PID:7108
- C:\Windows\System\ZzLjlyr.exe
  C:\Windows\System\ZzLjlyr.exe
  2⤵
  PID:7064
- C:\Windows\System\ZMZMukc.exe
  C:\Windows\System\ZMZMukc.exe
  2⤵
  PID:6528
- C:\Windows\System\IGmULkm.exe
  C:\Windows\System\IGmULkm.exe
  2⤵
  PID:6676
- C:\Windows\System\XdchuFO.exe
  C:\Windows\System\XdchuFO.exe
  2⤵
  PID:1692
- C:\Windows\System\THFaabM.exe
  C:\Windows\System\THFaabM.exe
  2⤵
  PID:6192
- C:\Windows\System\cKHXZle.exe
  C:\Windows\System\cKHXZle.exe
  2⤵
  PID:6404
- C:\Windows\System\tBXCjfj.exe
  C:\Windows\System\tBXCjfj.exe
  2⤵
  PID:6980
- C:\Windows\System\ZQIXXFU.exe
  C:\Windows\System\ZQIXXFU.exe
  2⤵
  PID:6760
- C:\Windows\System\HOMVTAN.exe
  C:\Windows\System\HOMVTAN.exe
  2⤵
  PID:7112
- C:\Windows\System\YhEBcID.exe
  C:\Windows\System\YhEBcID.exe
  2⤵
  PID:2220
- C:\Windows\System\gOOGphq.exe
  C:\Windows\System\gOOGphq.exe
  2⤵
  PID:6284
- C:\Windows\System\dryjHKp.exe
  C:\Windows\System\dryjHKp.exe
  2⤵
  PID:7188
- C:\Windows\System\YenaIKt.exe
  C:\Windows\System\YenaIKt.exe
  2⤵
  PID:7208
- C:\Windows\System\RckWWbW.exe
  C:\Windows\System\RckWWbW.exe
  2⤵
  PID:7228
- C:\Windows\System\jjeqVDS.exe
  C:\Windows\System\jjeqVDS.exe
  2⤵
  PID:7248
- C:\Windows\System\ybHqnYM.exe
  C:\Windows\System\ybHqnYM.exe
  2⤵
  PID:7268
- C:\Windows\System\KxaMemX.exe
  C:\Windows\System\KxaMemX.exe
  2⤵
  PID:7284
- C:\Windows\System\prgAYGF.exe
  C:\Windows\System\prgAYGF.exe
  2⤵
  PID:7304
- C:\Windows\System\cSjSsMQ.exe
  C:\Windows\System\cSjSsMQ.exe
  2⤵
  PID:7320
- C:\Windows\System\YvtxvpP.exe
  C:\Windows\System\YvtxvpP.exe
  2⤵
  PID:7340
- C:\Windows\System\FvonCOr.exe
  C:\Windows\System\FvonCOr.exe
  2⤵
  PID:7360
- C:\Windows\System\qhGLyaX.exe
  C:\Windows\System\qhGLyaX.exe
  2⤵
  PID:7376
- C:\Windows\System\JKEgmPB.exe
  C:\Windows\System\JKEgmPB.exe
  2⤵
  PID:7392
- C:\Windows\System\nkKTihg.exe
  C:\Windows\System\nkKTihg.exe
  2⤵
  PID:7428
- C:\Windows\System\cXfJWTz.exe
  C:\Windows\System\cXfJWTz.exe
  2⤵
  PID:7448
- C:\Windows\System\CTsNOFG.exe
  C:\Windows\System\CTsNOFG.exe
  2⤵
  PID:7464
- C:\Windows\System\kHQIvrD.exe
  C:\Windows\System\kHQIvrD.exe
  2⤵
  PID:7480
- C:\Windows\System\gkQwSSH.exe
  C:\Windows\System\gkQwSSH.exe
  2⤵
  PID:7496
- C:\Windows\System\nPAoqnr.exe
  C:\Windows\System\nPAoqnr.exe
  2⤵
  PID:7512
- C:\Windows\System\bOQiGyM.exe
  C:\Windows\System\bOQiGyM.exe
  2⤵
  PID:7528
- C:\Windows\System\FmCbtyg.exe
  C:\Windows\System\FmCbtyg.exe
  2⤵
  PID:7544
- C:\Windows\System\KsIOCWq.exe
  C:\Windows\System\KsIOCWq.exe
  2⤵
  PID:7564
- C:\Windows\System\jCnZIBH.exe
  C:\Windows\System\jCnZIBH.exe
  2⤵
  PID:7580
- C:\Windows\System\gXJGObO.exe
  C:\Windows\System\gXJGObO.exe
  2⤵
  PID:7596
- C:\Windows\System\mQgrqrO.exe
  C:\Windows\System\mQgrqrO.exe
  2⤵
  PID:7612
- C:\Windows\System\TTTEAnk.exe
  C:\Windows\System\TTTEAnk.exe
  2⤵
  PID:7632
- C:\Windows\System\yyIJNhm.exe
  C:\Windows\System\yyIJNhm.exe
  2⤵
  PID:7652
- C:\Windows\System\NbmvDUW.exe
  C:\Windows\System\NbmvDUW.exe
  2⤵
  PID:7668
- C:\Windows\System\LYIDetr.exe
  C:\Windows\System\LYIDetr.exe
  2⤵
  PID:7684
- C:\Windows\System\nspYigM.exe
  C:\Windows\System\nspYigM.exe
  2⤵
  PID:7700
- C:\Windows\System\SdonueZ.exe
  C:\Windows\System\SdonueZ.exe
  2⤵
  PID:7716
- C:\Windows\System\GhhtuOy.exe
  C:\Windows\System\GhhtuOy.exe
  2⤵
  PID:7732
- C:\Windows\System\VFDLYlw.exe
  C:\Windows\System\VFDLYlw.exe
  2⤵
  PID:7748
- C:\Windows\System\DvnTaFR.exe
  C:\Windows\System\DvnTaFR.exe
  2⤵
  PID:7764
- C:\Windows\System\ciVKxRc.exe
  C:\Windows\System\ciVKxRc.exe
  2⤵
  PID:7780
- C:\Windows\System\SXWiibV.exe
  C:\Windows\System\SXWiibV.exe
  2⤵
  PID:7796
- C:\Windows\System\rJPGQLB.exe
  C:\Windows\System\rJPGQLB.exe
  2⤵
  PID:7812
- C:\Windows\System\HZfnexE.exe
  C:\Windows\System\HZfnexE.exe
  2⤵
  PID:7828
- C:\Windows\System\UZiXgbn.exe
  C:\Windows\System\UZiXgbn.exe
  2⤵
  PID:7844
- C:\Windows\System\lwvwvSO.exe
  C:\Windows\System\lwvwvSO.exe
  2⤵
  PID:7860
- C:\Windows\System\XINnCvV.exe
  C:\Windows\System\XINnCvV.exe
  2⤵
  PID:7884
- C:\Windows\System\kkZrOvg.exe
  C:\Windows\System\kkZrOvg.exe
  2⤵
  PID:7900
- C:\Windows\System\tWCYRxg.exe
  C:\Windows\System\tWCYRxg.exe
  2⤵
  PID:7920
- C:\Windows\System\qvzZNij.exe
  C:\Windows\System\qvzZNij.exe
  2⤵
  PID:7940
- C:\Windows\System\zQQYHGv.exe
  C:\Windows\System\zQQYHGv.exe
  2⤵
  PID:7956
- C:\Windows\System\pnzdWws.exe
  C:\Windows\System\pnzdWws.exe
  2⤵
  PID:7976
- C:\Windows\System\GoZKqQp.exe
  C:\Windows\System\GoZKqQp.exe
  2⤵
  PID:7996
- C:\Windows\System\uFtLEbK.exe
  C:\Windows\System\uFtLEbK.exe
  2⤵
  PID:8012
- C:\Windows\System\bGbaaEL.exe
  C:\Windows\System\bGbaaEL.exe
  2⤵
  PID:8028
- C:\Windows\System\GpHpeje.exe
  C:\Windows\System\GpHpeje.exe
  2⤵
  PID:8048
- C:\Windows\System\tctZUZR.exe
  C:\Windows\System\tctZUZR.exe
  2⤵
  PID:8064
- C:\Windows\System\TXVFqta.exe
  C:\Windows\System\TXVFqta.exe
  2⤵
  PID:8080
- C:\Windows\System\RlqkWXT.exe
  C:\Windows\System\RlqkWXT.exe
  2⤵
  PID:8096
- C:\Windows\System\VmSkVkg.exe
  C:\Windows\System\VmSkVkg.exe
  2⤵
  PID:8116
- C:\Windows\System\blzuuXz.exe
  C:\Windows\System\blzuuXz.exe
  2⤵
  PID:8132
- C:\Windows\System\zWapeBN.exe
  C:\Windows\System\zWapeBN.exe
  2⤵
  PID:8148
- C:\Windows\System\QoOJaOn.exe
  C:\Windows\System\QoOJaOn.exe
  2⤵
  PID:8164
- C:\Windows\System\PqbNhFI.exe
  C:\Windows\System\PqbNhFI.exe
  2⤵
  PID:8180
- C:\Windows\System\JUtZJGW.exe
  C:\Windows\System\JUtZJGW.exe
  2⤵
  PID:7176
- C:\Windows\System\uRZXtgs.exe
  C:\Windows\System\uRZXtgs.exe
  2⤵
  PID:7216
- C:\Windows\System\RpKNMDb.exe
  C:\Windows\System\RpKNMDb.exe
  2⤵
  PID:7264
- C:\Windows\System\QzudkUc.exe
  C:\Windows\System\QzudkUc.exe
  2⤵
  PID:6892
- C:\Windows\System\lxcraDJ.exe
  C:\Windows\System\lxcraDJ.exe
  2⤵
  PID:7300
- C:\Windows\System\OsydvsF.exe
  C:\Windows\System\OsydvsF.exe
  2⤵
  PID:7236
- C:\Windows\System\sevxOCy.exe
  C:\Windows\System\sevxOCy.exe
  2⤵
  PID:7280
- C:\Windows\System\mluOVYA.exe
  C:\Windows\System\mluOVYA.exe
  2⤵
  PID:7328
- C:\Windows\System\FuVwhXW.exe
  C:\Windows\System\FuVwhXW.exe
  2⤵
  PID:7200
- C:\Windows\System\blxHNsU.exe
  C:\Windows\System\blxHNsU.exe
  2⤵
  PID:7368
- C:\Windows\System\ZjEzbRt.exe
  C:\Windows\System\ZjEzbRt.exe
  2⤵
  PID:7400
- C:\Windows\System\tOcEhJr.exe
  C:\Windows\System\tOcEhJr.exe
  2⤵
  PID:7388
- C:\Windows\System\zPHgXKU.exe
  C:\Windows\System\zPHgXKU.exe
  2⤵
  PID:7420
- C:\Windows\System\OBVgQvu.exe
  C:\Windows\System\OBVgQvu.exe
  2⤵
  PID:7404
- C:\Windows\System\fmqtydB.exe
  C:\Windows\System\fmqtydB.exe
  2⤵
  PID:7488
- C:\Windows\System\hXtPXmf.exe
  C:\Windows\System\hXtPXmf.exe
  2⤵
  PID:7620
- C:\Windows\System\ciHrrcZ.exe
  C:\Windows\System\ciHrrcZ.exe
  2⤵
  PID:7664
- C:\Windows\System\PfcBKCT.exe
  C:\Windows\System\PfcBKCT.exe
  2⤵
  PID:7724
- C:\Windows\System\DZDrnKB.exe
  C:\Windows\System\DZDrnKB.exe
  2⤵
  PID:7536
- C:\Windows\System\HDqVvLi.exe
  C:\Windows\System\HDqVvLi.exe
  2⤵
  PID:7788
- C:\Windows\System\aQyCmrq.exe
  C:\Windows\System\aQyCmrq.exe
  2⤵
  PID:7540
- C:\Windows\System\qJksPeM.exe
  C:\Windows\System\qJksPeM.exe
  2⤵
  PID:7608
- C:\Windows\System\FUIIFPC.exe
  C:\Windows\System\FUIIFPC.exe
  2⤵
  PID:7708
- C:\Windows\System\KxnGyii.exe
  C:\Windows\System\KxnGyii.exe
  2⤵
  PID:7744
- C:\Windows\System\qcesico.exe
  C:\Windows\System\qcesico.exe
  2⤵
  PID:7808
- C:\Windows\System\AgYxUIq.exe
  C:\Windows\System\AgYxUIq.exe
  2⤵
  PID:7876
- C:\Windows\System\NtTDlBr.exe
  C:\Windows\System\NtTDlBr.exe
  2⤵
  PID:7896
- C:\Windows\System\XQLZziv.exe
  C:\Windows\System\XQLZziv.exe
  2⤵
  PID:7936
- C:\Windows\System\GETULTI.exe
  C:\Windows\System\GETULTI.exe
  2⤵
  PID:7972
- C:\Windows\System\ZOcBzfK.exe
  C:\Windows\System\ZOcBzfK.exe
  2⤵
  PID:8008
- C:\Windows\System\lTslZKW.exe
  C:\Windows\System\lTslZKW.exe
  2⤵
  PID:7952
- C:\Windows\System\DiwnnzB.exe
  C:\Windows\System\DiwnnzB.exe
  2⤵
  PID:7988
- C:\Windows\System\cfvMpMh.exe
  C:\Windows\System\cfvMpMh.exe
  2⤵
  PID:8112
- C:\Windows\System\nBaCUaJ.exe
  C:\Windows\System\nBaCUaJ.exe
  2⤵
  PID:8172
- C:\Windows\System\vuUULxW.exe
  C:\Windows\System\vuUULxW.exe
  2⤵
  PID:6836
- C:\Windows\System\xAbghWi.exe
  C:\Windows\System\xAbghWi.exe
  2⤵
  PID:8188
- C:\Windows\System\HOOsiEM.exe
  C:\Windows\System\HOOsiEM.exe
  2⤵
  PID:2712
- C:\Windows\System\BMDJTYR.exe
  C:\Windows\System\BMDJTYR.exe
  2⤵
  PID:6748
- C:\Windows\System\RMDpjeU.exe
  C:\Windows\System\RMDpjeU.exe
  2⤵
  PID:6896
- C:\Windows\System\ZdIPiIi.exe
  C:\Windows\System\ZdIPiIi.exe
  2⤵
  PID:7260
- C:\Windows\System\HbkeZZL.exe
  C:\Windows\System\HbkeZZL.exe
  2⤵
  PID:7196
- C:\Windows\System\nhYgRbl.exe
  C:\Windows\System\nhYgRbl.exe
  2⤵
  PID:7412
- C:\Windows\System\bZhkpKe.exe
  C:\Windows\System\bZhkpKe.exe
  2⤵
  PID:7560
- C:\Windows\System\zjexJzz.exe
  C:\Windows\System\zjexJzz.exe
  2⤵
  PID:7348
- C:\Windows\System\DwHITBF.exe
  C:\Windows\System\DwHITBF.exe
  2⤵
  PID:7624
- C:\Windows\System\tYWIbpq.exe
  C:\Windows\System\tYWIbpq.exe
  2⤵
  PID:7676
- C:\Windows\System\cAJTjCM.exe
  C:\Windows\System\cAJTjCM.exe
  2⤵
  PID:7912
- C:\Windows\System\jpcnynC.exe
  C:\Windows\System\jpcnynC.exe
  2⤵
  PID:7824
- C:\Windows\System\pzXkbOh.exe
  C:\Windows\System\pzXkbOh.exe
  2⤵
  PID:7892
- C:\Windows\System\LUomuiv.exe
  C:\Windows\System\LUomuiv.exe
  2⤵
  PID:7992
- C:\Windows\System\pmQGUIW.exe
  C:\Windows\System\pmQGUIW.exe
  2⤵
  PID:8020
- C:\Windows\System\ODDRuwU.exe
  C:\Windows\System\ODDRuwU.exe
  2⤵
  PID:8040
- C:\Windows\System\oLdtrHT.exe
  C:\Windows\System\oLdtrHT.exe
  2⤵
  PID:8108
- C:\Windows\System\KrxDPKc.exe
  C:\Windows\System\KrxDPKc.exe
  2⤵
  PID:7292
- C:\Windows\System\slimmUa.exe
  C:\Windows\System\slimmUa.exe
  2⤵
  PID:7352
- C:\Windows\System\qerIxoK.exe
  C:\Windows\System\qerIxoK.exe
  2⤵
  PID:6620
- C:\Windows\System\TTjSLxA.exe
  C:\Windows\System\TTjSLxA.exe
  2⤵
  PID:7696
- C:\Windows\System\umOJUJe.exe
  C:\Windows\System\umOJUJe.exe
  2⤵
  PID:7648
- C:\Windows\System\GkXdkYG.exe
  C:\Windows\System\GkXdkYG.exe
  2⤵
  PID:7096
- C:\Windows\System\KcYUPkm.exe
  C:\Windows\System\KcYUPkm.exe
  2⤵
  PID:7760
- C:\Windows\System\cLDeQJJ.exe
  C:\Windows\System\cLDeQJJ.exe
  2⤵
  PID:7932
- C:\Windows\System\ksjOkhc.exe
  C:\Windows\System\ksjOkhc.exe
  2⤵
  PID:7872
- C:\Windows\System\NULEMPR.exe
  C:\Windows\System\NULEMPR.exe
  2⤵
  PID:6868
- C:\Windows\System\uXVuYgj.exe
  C:\Windows\System\uXVuYgj.exe
  2⤵
  PID:1728
- C:\Windows\System\fUGkLcR.exe
  C:\Windows\System\fUGkLcR.exe
  2⤵
  PID:7984
- C:\Windows\System\FuMlwPP.exe
  C:\Windows\System\FuMlwPP.exe
  2⤵
  PID:7508
- C:\Windows\System\EAgluut.exe
  C:\Windows\System\EAgluut.exe
  2⤵
  PID:7244
- C:\Windows\System\EQWavsQ.exe
  C:\Windows\System\EQWavsQ.exe
  2⤵
  PID:7504
- C:\Windows\System\lUUKdAk.exe
  C:\Windows\System\lUUKdAk.exe
  2⤵
  PID:7316
- C:\Windows\System\uXTCWKJ.exe
  C:\Windows\System\uXTCWKJ.exe
  2⤵
  PID:7840
- C:\Windows\System\oUfDWaC.exe
  C:\Windows\System\oUfDWaC.exe
  2⤵
  PID:8156
- C:\Windows\System\JbbuIJF.exe
  C:\Windows\System\JbbuIJF.exe
  2⤵
  PID:7476
- C:\Windows\System\TspUwVz.exe
  C:\Windows\System\TspUwVz.exe
  2⤵
  PID:7740
- C:\Windows\System\vvEfsey.exe
  C:\Windows\System\vvEfsey.exe
  2⤵
  PID:7524
- C:\Windows\System\WjGeFBn.exe
  C:\Windows\System\WjGeFBn.exe
  2⤵
  PID:8212
- C:\Windows\System\xTGCOqZ.exe
  C:\Windows\System\xTGCOqZ.exe
  2⤵
  PID:8228
- C:\Windows\System\IqAKJAX.exe
  C:\Windows\System\IqAKJAX.exe
  2⤵
  PID:8244
- C:\Windows\System\hDWWRpC.exe
  C:\Windows\System\hDWWRpC.exe
  2⤵
  PID:8260
- C:\Windows\System\mzmSXyS.exe
  C:\Windows\System\mzmSXyS.exe
  2⤵
  PID:8280
- C:\Windows\System\ImqfkBx.exe
  C:\Windows\System\ImqfkBx.exe
  2⤵
  PID:8296
- C:\Windows\System\jWfXGlq.exe
  C:\Windows\System\jWfXGlq.exe
  2⤵
  PID:8312
- C:\Windows\System\hKIeddH.exe
  C:\Windows\System\hKIeddH.exe
  2⤵
  PID:8328
- C:\Windows\System\gNhErXz.exe
  C:\Windows\System\gNhErXz.exe
  2⤵
  PID:8344
- C:\Windows\System\fXHKXwQ.exe
  C:\Windows\System\fXHKXwQ.exe
  2⤵
  PID:8360
- C:\Windows\System\HOgLuQX.exe
  C:\Windows\System\HOgLuQX.exe
  2⤵
  PID:8376
- C:\Windows\System\MzkYsua.exe
  C:\Windows\System\MzkYsua.exe
  2⤵
  PID:8392
- C:\Windows\System\PCdDfbI.exe
  C:\Windows\System\PCdDfbI.exe
  2⤵
  PID:8412
- C:\Windows\System\zaKuzsW.exe
  C:\Windows\System\zaKuzsW.exe
  2⤵
  PID:8428
- C:\Windows\System\OUpWLKw.exe
  C:\Windows\System\OUpWLKw.exe
  2⤵
  PID:8444
- C:\Windows\System\iEjeJlE.exe
  C:\Windows\System\iEjeJlE.exe
  2⤵
  PID:8460
- C:\Windows\System\QgIdxjc.exe
  C:\Windows\System\QgIdxjc.exe
  2⤵
  PID:8476
- C:\Windows\System\POMQVXR.exe
  C:\Windows\System\POMQVXR.exe
  2⤵
  PID:8492
- C:\Windows\System\YWLFjzG.exe
  C:\Windows\System\YWLFjzG.exe
  2⤵
  PID:8508
- C:\Windows\System\CGnhtOL.exe
  C:\Windows\System\CGnhtOL.exe
  2⤵
  PID:8524
- C:\Windows\System\RoOjvtZ.exe
  C:\Windows\System\RoOjvtZ.exe
  2⤵
  PID:8540
- C:\Windows\System\MSQeuAX.exe
  C:\Windows\System\MSQeuAX.exe
  2⤵
  PID:8556
- C:\Windows\System\XanTEeb.exe
  C:\Windows\System\XanTEeb.exe
  2⤵
  PID:8572
- C:\Windows\System\yqUMJZv.exe
  C:\Windows\System\yqUMJZv.exe
  2⤵
  PID:8588
- C:\Windows\System\lAlKJLS.exe
  C:\Windows\System\lAlKJLS.exe
  2⤵
  PID:8604
- C:\Windows\System\PuoPjXT.exe
  C:\Windows\System\PuoPjXT.exe
  2⤵
  PID:8620
- C:\Windows\System\qXQaFYt.exe
  C:\Windows\System\qXQaFYt.exe
  2⤵
  PID:8636
- C:\Windows\System\KPMPtbd.exe
  C:\Windows\System\KPMPtbd.exe
  2⤵
  PID:8652
- C:\Windows\System\OtVbsng.exe
  C:\Windows\System\OtVbsng.exe
  2⤵
  PID:8668
- C:\Windows\System\KbsDHWA.exe
  C:\Windows\System\KbsDHWA.exe
  2⤵
  PID:8684
- C:\Windows\System\oCIEUgm.exe
  C:\Windows\System\oCIEUgm.exe
  2⤵
  PID:8700
- C:\Windows\System\RMQSqOt.exe
  C:\Windows\System\RMQSqOt.exe
  2⤵
  PID:8716
- C:\Windows\System\dVrbNDc.exe
  C:\Windows\System\dVrbNDc.exe
  2⤵
  PID:8732
- C:\Windows\System\DvXzQMF.exe
  C:\Windows\System\DvXzQMF.exe
  2⤵
  PID:8748
- C:\Windows\System\FnPuscp.exe
  C:\Windows\System\FnPuscp.exe
  2⤵
  PID:8764
- C:\Windows\System\EQBcEbB.exe
  C:\Windows\System\EQBcEbB.exe
  2⤵
  PID:8780
- C:\Windows\System\lPCuHKz.exe
  C:\Windows\System\lPCuHKz.exe
  2⤵
  PID:8796
- C:\Windows\System\miiBjRv.exe
  C:\Windows\System\miiBjRv.exe
  2⤵
  PID:8812
- C:\Windows\System\pDqbMwz.exe
  C:\Windows\System\pDqbMwz.exe
  2⤵
  PID:8828
- C:\Windows\System\RnHTSZm.exe
  C:\Windows\System\RnHTSZm.exe
  2⤵
  PID:8844
- C:\Windows\System\OrZxxsL.exe
  C:\Windows\System\OrZxxsL.exe
  2⤵
  PID:8860
- C:\Windows\System\VENHJkP.exe
  C:\Windows\System\VENHJkP.exe
  2⤵
  PID:8880
- C:\Windows\System\YjpVgLi.exe
  C:\Windows\System\YjpVgLi.exe
  2⤵
  PID:8900
- C:\Windows\System\CNVgvbL.exe
  C:\Windows\System\CNVgvbL.exe
  2⤵
  PID:8920
- C:\Windows\System\OfCMAAA.exe
  C:\Windows\System\OfCMAAA.exe
  2⤵
  PID:8940
- C:\Windows\System\kHdgkrT.exe
  C:\Windows\System\kHdgkrT.exe
  2⤵
  PID:8956
- C:\Windows\System\pnfWUES.exe
  C:\Windows\System\pnfWUES.exe
  2⤵
  PID:8972
- C:\Windows\System\eTxxYom.exe
  C:\Windows\System\eTxxYom.exe
  2⤵
  PID:8988
- C:\Windows\System\bHfvvSw.exe
  C:\Windows\System\bHfvvSw.exe
  2⤵
  PID:9004
- C:\Windows\System\rNnCnBj.exe
  C:\Windows\System\rNnCnBj.exe
  2⤵
  PID:9020
- C:\Windows\System\bRyvqiQ.exe
  C:\Windows\System\bRyvqiQ.exe
  2⤵
  PID:9036
- C:\Windows\System\HyEFWvI.exe
  C:\Windows\System\HyEFWvI.exe
  2⤵
  PID:9052
- C:\Windows\System\rqunlFi.exe
  C:\Windows\System\rqunlFi.exe
  2⤵
  PID:9068
- C:\Windows\System\bpfssgc.exe
  C:\Windows\System\bpfssgc.exe
  2⤵
  PID:9084
- C:\Windows\System\LSpVnKX.exe
  C:\Windows\System\LSpVnKX.exe
  2⤵
  PID:9100
- C:\Windows\System\slJnemF.exe
  C:\Windows\System\slJnemF.exe
  2⤵
  PID:9124
- C:\Windows\System\dYeuwPY.exe
  C:\Windows\System\dYeuwPY.exe
  2⤵
  PID:9144
- C:\Windows\System\dDTeEMT.exe
  C:\Windows\System\dDTeEMT.exe
  2⤵
  PID:9160
- C:\Windows\System\MTwvGoL.exe
  C:\Windows\System\MTwvGoL.exe
  2⤵
  PID:9176
- C:\Windows\System\xbQUCrm.exe
  C:\Windows\System\xbQUCrm.exe
  2⤵
  PID:9192
- C:\Windows\System\icnsgPx.exe
  C:\Windows\System\icnsgPx.exe
  2⤵
  PID:9212
- C:\Windows\System\oKqXnTc.exe
  C:\Windows\System\oKqXnTc.exe
  2⤵
  PID:8224
- C:\Windows\System\xMGQqjn.exe
  C:\Windows\System\xMGQqjn.exe
  2⤵
  PID:8292
- C:\Windows\System\zYQzdbM.exe
  C:\Windows\System\zYQzdbM.exe
  2⤵
  PID:7204
- C:\Windows\System\azHlsUh.exe
  C:\Windows\System\azHlsUh.exe
  2⤵
  PID:7592
- C:\Windows\System\Brmzmsr.exe
  C:\Windows\System\Brmzmsr.exe
  2⤵
  PID:8236
- C:\Windows\System\HxREnMw.exe
  C:\Windows\System\HxREnMw.exe
  2⤵
  PID:8308
- C:\Windows\System\gtPZqyv.exe
  C:\Windows\System\gtPZqyv.exe
  2⤵
  PID:8384
- C:\Windows\System\ujxbicn.exe
  C:\Windows\System\ujxbicn.exe
  2⤵
  PID:8452
- C:\Windows\System\xSyjhKg.exe
  C:\Windows\System\xSyjhKg.exe
  2⤵
  PID:8516
- C:\Windows\System\cFodEKL.exe
  C:\Windows\System\cFodEKL.exe
  2⤵
  PID:8548
- C:\Windows\System\XApyCdW.exe
  C:\Windows\System\XApyCdW.exe
  2⤵
  PID:8368
- C:\Windows\System\clLVFeT.exe
  C:\Windows\System\clLVFeT.exe
  2⤵
  PID:8468
- C:\Windows\System\YeOaxOF.exe
  C:\Windows\System\YeOaxOF.exe
  2⤵
  PID:8580
- C:\Windows\System\GvRuLQB.exe
  C:\Windows\System\GvRuLQB.exe
  2⤵
  PID:8616
- C:\Windows\System\YRYGjYf.exe
  C:\Windows\System\YRYGjYf.exe
  2⤵
  PID:8648
- C:\Windows\System\lzlpyOu.exe
  C:\Windows\System\lzlpyOu.exe
  2⤵
  PID:8632
- C:\Windows\System\LMRCAEh.exe
  C:\Windows\System\LMRCAEh.exe
  2⤵
  PID:8696
- C:\Windows\System\vZhMUoB.exe
  C:\Windows\System\vZhMUoB.exe
  2⤵
  PID:8744
- C:\Windows\System\oumXRzi.exe
  C:\Windows\System\oumXRzi.exe
  2⤵
  PID:8756
- C:\Windows\System\iTgoKmG.exe
  C:\Windows\System\iTgoKmG.exe
  2⤵
  PID:8788
- C:\Windows\System\JmKdjnR.exe
  C:\Windows\System\JmKdjnR.exe
  2⤵
  PID:8824
- C:\Windows\System\cQmyAEq.exe
  C:\Windows\System\cQmyAEq.exe
  2⤵
  PID:8876
- C:\Windows\System\smNbkDL.exe
  C:\Windows\System\smNbkDL.exe
  2⤵
  PID:8856
- C:\Windows\System\BTajKFE.exe
  C:\Windows\System\BTajKFE.exe
  2⤵
  PID:8984
- C:\Windows\System\xJcDLEa.exe
  C:\Windows\System\xJcDLEa.exe
  2⤵
  PID:8896
- C:\Windows\System\aLlcSJV.exe
  C:\Windows\System\aLlcSJV.exe
  2⤵
  PID:9080
- C:\Windows\System\NAMpEUR.exe
  C:\Windows\System\NAMpEUR.exe
  2⤵
  PID:8936
- C:\Windows\System\RtdGoyc.exe
  C:\Windows\System\RtdGoyc.exe
  2⤵
  PID:9028
- C:\Windows\System\SOOYodI.exe
  C:\Windows\System\SOOYodI.exe
  2⤵
  PID:9092
- C:\Windows\System\EQJdijv.exe
  C:\Windows\System\EQJdijv.exe
  2⤵
  PID:9136
- C:\Windows\System\zuwKvdb.exe
  C:\Windows\System\zuwKvdb.exe
  2⤵
  PID:9140
- C:\Windows\System\zNhjfzi.exe
  C:\Windows\System\zNhjfzi.exe
  2⤵
  PID:9188
- C:\Windows\System\uWLFllH.exe
  C:\Windows\System\uWLFllH.exe
  2⤵
  PID:9204
- C:\Windows\System\QTqBdks.exe
  C:\Windows\System\QTqBdks.exe
  2⤵
  PID:8204
- C:\Windows\System\Tipebik.exe
  C:\Windows\System\Tipebik.exe
  2⤵
  PID:7460
- C:\Windows\System\WNIrTjT.exe
  C:\Windows\System\WNIrTjT.exe
  2⤵
  PID:8420
- C:\Windows\System\vOOPFuj.exe
  C:\Windows\System\vOOPFuj.exe
  2⤵
  PID:8424
- C:\Windows\System\BeItINq.exe
  C:\Windows\System\BeItINq.exe
  2⤵
  PID:8472
- C:\Windows\System\hIzSmSY.exe
  C:\Windows\System\hIzSmSY.exe
  2⤵
  PID:8628
- C:\Windows\System\LcJVuRS.exe
  C:\Windows\System\LcJVuRS.exe
  2⤵
  PID:8440
- C:\Windows\System\bwYgJNJ.exe
  C:\Windows\System\bwYgJNJ.exe
  2⤵
  PID:8612
- C:\Windows\System\JgWhTZY.exe
  C:\Windows\System\JgWhTZY.exe
  2⤵
  PID:8664
- C:\Windows\System\EjXrVJh.exe
  C:\Windows\System\EjXrVJh.exe
  2⤵
  PID:8728
- C:\Windows\System\RJxlfyG.exe
  C:\Windows\System\RJxlfyG.exe
  2⤵
  PID:8820
- C:\Windows\System\UkxZboi.exe
  C:\Windows\System\UkxZboi.exe
  2⤵
  PID:8916
- C:\Windows\System\LSgyNmv.exe
  C:\Windows\System\LSgyNmv.exe
  2⤵
  PID:9016
- C:\Windows\System\oDZODGB.exe
  C:\Windows\System\oDZODGB.exe
  2⤵
  PID:8928
- C:\Windows\System\MbMdNLK.exe
  C:\Windows\System\MbMdNLK.exe
  2⤵
  PID:8932
- C:\Windows\System\RswFcIK.exe
  C:\Windows\System\RswFcIK.exe
  2⤵
  PID:9112
- C:\Windows\System\AGEBIgg.exe
  C:\Windows\System\AGEBIgg.exe
  2⤵
  PID:8268
- C:\Windows\System\TyuHvYd.exe
  C:\Windows\System\TyuHvYd.exe
  2⤵
  PID:9184
- C:\Windows\System\BGDvfvf.exe
  C:\Windows\System\BGDvfvf.exe
  2⤵
  PID:8288
- C:\Windows\System\NhYrVJM.exe
  C:\Windows\System\NhYrVJM.exe
  2⤵
  PID:8532
- C:\Windows\System\dzyRBlJ.exe
  C:\Windows\System\dzyRBlJ.exe
  2⤵
  PID:8680
- C:\Windows\System\NYQNxTX.exe
  C:\Windows\System\NYQNxTX.exe
  2⤵
  PID:8888
- C:\Windows\System\efadEqm.exe
  C:\Windows\System\efadEqm.exe
  2⤵
  PID:9156
- C:\Windows\System\WmNXJDW.exe
  C:\Windows\System\WmNXJDW.exe
  2⤵
  PID:8272
- C:\Windows\System\irqyGpd.exe
  C:\Windows\System\irqyGpd.exe
  2⤵
  PID:8908
- C:\Windows\System\TysLXYz.exe
  C:\Windows\System\TysLXYz.exe
  2⤵
  PID:9120
- C:\Windows\System\lcgUHGx.exe
  C:\Windows\System\lcgUHGx.exe
  2⤵
  PID:8692
- C:\Windows\System\KgaaEIu.exe
  C:\Windows\System\KgaaEIu.exe
  2⤵
  PID:8872
- C:\Windows\System\dnXxmNp.exe
  C:\Windows\System\dnXxmNp.exe
  2⤵
  PID:9208
- C:\Windows\System\fGAIvtY.exe
  C:\Windows\System\fGAIvtY.exe
  2⤵
  PID:9168
- C:\Windows\System\DvmgxAo.exe
  C:\Windows\System\DvmgxAo.exe
  2⤵
  PID:8808
- C:\Windows\System\YMmVTMl.exe
  C:\Windows\System\YMmVTMl.exe
  2⤵
  PID:2944
- C:\Windows\System\UWBnigb.exe
  C:\Windows\System\UWBnigb.exe
  2⤵
  PID:9200
- C:\Windows\System\jzyxYtW.exe
  C:\Windows\System\jzyxYtW.exe
  2⤵
  PID:8408
- C:\Windows\System\tHYeYsa.exe
  C:\Windows\System\tHYeYsa.exe
  2⤵
  PID:9076
- C:\Windows\System\qRjroVN.exe
  C:\Windows\System\qRjroVN.exe
  2⤵
  PID:9240
- C:\Windows\System\AJBvSby.exe
  C:\Windows\System\AJBvSby.exe
  2⤵
  PID:9256
- C:\Windows\System\oTzKYwt.exe
  C:\Windows\System\oTzKYwt.exe
  2⤵
  PID:9272
- C:\Windows\System\addjgSk.exe
  C:\Windows\System\addjgSk.exe
  2⤵
  PID:9348
- C:\Windows\System\iRlVCxR.exe
  C:\Windows\System\iRlVCxR.exe
  2⤵
  PID:9380
- C:\Windows\System\FyMftAQ.exe
  C:\Windows\System\FyMftAQ.exe
  2⤵
  PID:9396
- C:\Windows\System\qkEKDNQ.exe
  C:\Windows\System\qkEKDNQ.exe
  2⤵
  PID:9412
- C:\Windows\System\jRtfvYc.exe
  C:\Windows\System\jRtfvYc.exe
  2⤵
  PID:9428
- C:\Windows\System\JimtiIS.exe
  C:\Windows\System\JimtiIS.exe
  2⤵
  PID:9444
- C:\Windows\System\MoOaBiB.exe
  C:\Windows\System\MoOaBiB.exe
  2⤵
  PID:9460
- C:\Windows\System\YYnMpQF.exe
  C:\Windows\System\YYnMpQF.exe
  2⤵
  PID:9476
- C:\Windows\System\sSJaNus.exe
  C:\Windows\System\sSJaNus.exe
  2⤵
  PID:9492
- C:\Windows\System\etzHGGh.exe
  C:\Windows\System\etzHGGh.exe
  2⤵
  PID:9508
- C:\Windows\System\QhUJTGx.exe
  C:\Windows\System\QhUJTGx.exe
  2⤵
  PID:9524
- C:\Windows\System\TfYDbcj.exe
  C:\Windows\System\TfYDbcj.exe
  2⤵
  PID:9540
- C:\Windows\System\GnowUgK.exe
  C:\Windows\System\GnowUgK.exe
  2⤵
  PID:9556
- C:\Windows\System\bUmKzQu.exe
  C:\Windows\System\bUmKzQu.exe
  2⤵
  PID:9572
- C:\Windows\System\rSxVNIA.exe
  C:\Windows\System\rSxVNIA.exe
  2⤵
  PID:9588
- C:\Windows\System\umzhzfU.exe
  C:\Windows\System\umzhzfU.exe
  2⤵
  PID:9604
- C:\Windows\System\NdXTFxq.exe
  C:\Windows\System\NdXTFxq.exe
  2⤵
  PID:9620
- C:\Windows\System\IlbJEZY.exe
  C:\Windows\System\IlbJEZY.exe
  2⤵
  PID:9636
- C:\Windows\System\qGNoivb.exe
  C:\Windows\System\qGNoivb.exe
  2⤵
  PID:9656
- C:\Windows\System\Boppqzu.exe
  C:\Windows\System\Boppqzu.exe
  2⤵
  PID:9676
- C:\Windows\System\obwXvos.exe
  C:\Windows\System\obwXvos.exe
  2⤵
  PID:9692
- C:\Windows\System\JNGFYHN.exe
  C:\Windows\System\JNGFYHN.exe
  2⤵
  PID:9708
- C:\Windows\System\NiCtzHX.exe
  C:\Windows\System\NiCtzHX.exe
  2⤵
  PID:9808
- C:\Windows\System\eqYSGYS.exe
  C:\Windows\System\eqYSGYS.exe
  2⤵
  PID:9884
- C:\Windows\System\xqOnRUp.exe
  C:\Windows\System\xqOnRUp.exe
  2⤵
  PID:10132
- C:\Windows\System\IACUfbd.exe
  C:\Windows\System\IACUfbd.exe
  2⤵
  PID:10148
- C:\Windows\System\OGWypEe.exe
  C:\Windows\System\OGWypEe.exe
  2⤵
  PID:10164
- C:\Windows\System\muciiOg.exe
  C:\Windows\System\muciiOg.exe
  2⤵
  PID:10180
- C:\Windows\System\GZRcRwZ.exe
  C:\Windows\System\GZRcRwZ.exe
  2⤵
  PID:10196
- C:\Windows\System\pTOfgLE.exe
  C:\Windows\System\pTOfgLE.exe
  2⤵
  PID:10216
- C:\Windows\System\gVrpOVR.exe
  C:\Windows\System\gVrpOVR.exe
  2⤵
  PID:10232
- C:\Windows\System\ZcJNUUi.exe
  C:\Windows\System\ZcJNUUi.exe
  2⤵
  PID:8400
- C:\Windows\System\WrSCnRA.exe
  C:\Windows\System\WrSCnRA.exe
  2⤵
  PID:9264
- C:\Windows\System\aqGFDvF.exe
  C:\Windows\System\aqGFDvF.exe
  2⤵
  PID:9316
- C:\Windows\System\iAEqBLI.exe
  C:\Windows\System\iAEqBLI.exe
  2⤵
  PID:9672
- C:\Windows\System\vClyjtb.exe
  C:\Windows\System\vClyjtb.exe
  2⤵
  PID:9652
- C:\Windows\System\vjkSBDi.exe
  C:\Windows\System\vjkSBDi.exe
  2⤵
  PID:9720
- C:\Windows\System\PFiOrkJ.exe
  C:\Windows\System\PFiOrkJ.exe
  2⤵
  PID:9740
- C:\Windows\System\UCrZnbR.exe
  C:\Windows\System\UCrZnbR.exe
  2⤵
  PID:9752
- C:\Windows\System\lCAVAvb.exe
  C:\Windows\System\lCAVAvb.exe
  2⤵
  PID:9768
- C:\Windows\System\XNwKNbH.exe
  C:\Windows\System\XNwKNbH.exe
  2⤵
  PID:9788
- C:\Windows\System\lKGvwzj.exe
  C:\Windows\System\lKGvwzj.exe
  2⤵
  PID:9820
- C:\Windows\System\UrjbukG.exe
  C:\Windows\System\UrjbukG.exe
  2⤵
  PID:9852
- C:\Windows\System\QIIpNIA.exe
  C:\Windows\System\QIIpNIA.exe
  2⤵
  PID:9836
- C:\Windows\System\rhrjLSr.exe
  C:\Windows\System\rhrjLSr.exe
  2⤵
  PID:9872
- C:\Windows\System\vWHXOuY.exe
  C:\Windows\System\vWHXOuY.exe
  2⤵
  PID:9908
- C:\Windows\System\ZRohgeD.exe
  C:\Windows\System\ZRohgeD.exe
  2⤵
  PID:9932
- C:\Windows\System\eesuYay.exe
  C:\Windows\System\eesuYay.exe
  2⤵
  PID:9976
- C:\Windows\System\NdJbWQO.exe
  C:\Windows\System\NdJbWQO.exe
  2⤵
  PID:9992
- C:\Windows\System\sgisiXr.exe
  C:\Windows\System\sgisiXr.exe
  2⤵
  PID:10008
- C:\Windows\System\DhZWHQS.exe
  C:\Windows\System\DhZWHQS.exe
  2⤵
  PID:10024
- C:\Windows\System\oOETyIQ.exe
  C:\Windows\System\oOETyIQ.exe
  2⤵
  PID:10040
- C:\Windows\System\PsuTXGk.exe
  C:\Windows\System\PsuTXGk.exe
  2⤵
  PID:10052
- C:\Windows\System\knDMPEJ.exe
  C:\Windows\System\knDMPEJ.exe
  2⤵
  PID:10084
- C:\Windows\System\JmiXkRs.exe
  C:\Windows\System\JmiXkRs.exe
  2⤵
  PID:10088
- C:\Windows\System\zVIswWc.exe
  C:\Windows\System\zVIswWc.exe
  2⤵
  PID:10104
- C:\Windows\System\SHWgstm.exe
  C:\Windows\System\SHWgstm.exe
  2⤵
  PID:10120
- C:\Windows\System\EGtVQbH.exe
  C:\Windows\System\EGtVQbH.exe
  2⤵
  PID:10144
- C:\Windows\System\MzeJyiT.exe
  C:\Windows\System\MzeJyiT.exe
  2⤵
  PID:10192
- C:\Windows\System\wcqOrDH.exe
  C:\Windows\System\wcqOrDH.exe
  2⤵
  PID:9224
- C:\Windows\System\GHJHViY.exe
  C:\Windows\System\GHJHViY.exe
  2⤵
  PID:10212
- C:\Windows\System\fAeuFrO.exe
  C:\Windows\System\fAeuFrO.exe
  2⤵
  PID:10172
- C:\Windows\System\wQYIarW.exe
  C:\Windows\System\wQYIarW.exe
  2⤵
  PID:9324
- C:\Windows\System\MVbbnZS.exe
  C:\Windows\System\MVbbnZS.exe
  2⤵
  PID:9296
- C:\Windows\System\ztiiAXc.exe
  C:\Windows\System\ztiiAXc.exe
  2⤵
  PID:9328
- C:\Windows\System\FVlPtjY.exe
  C:\Windows\System\FVlPtjY.exe
  2⤵
  PID:9356
- C:\Windows\System\KIVAQOQ.exe
  C:\Windows\System\KIVAQOQ.exe
  2⤵
  PID:9372
- C:\Windows\System\KeVoNtK.exe
  C:\Windows\System\KeVoNtK.exe
  2⤵
  PID:9408
- C:\Windows\System\QZCfpHv.exe
  C:\Windows\System\QZCfpHv.exe
  2⤵
  PID:9472
- C:\Windows\System\HVMvtua.exe
  C:\Windows\System\HVMvtua.exe
  2⤵
  PID:9904
- C:\Windows\System\JOLrsmO.exe
  C:\Windows\System\JOLrsmO.exe
  2⤵
  PID:9516
- C:\Windows\System\CGegZTY.exe
  C:\Windows\System\CGegZTY.exe
  2⤵
  PID:9392
- C:\Windows\System\nTwGSjx.exe
  C:\Windows\System\nTwGSjx.exe
  2⤵
  PID:9616
- C:\Windows\System\LPhmlbi.exe
  C:\Windows\System\LPhmlbi.exe
  2⤵
  PID:9612
- C:\Windows\System\qHrNVUo.exe
  C:\Windows\System\qHrNVUo.exe
  2⤵
  PID:1580
- C:\Windows\System\OZbTYqY.exe
  C:\Windows\System\OZbTYqY.exe
  2⤵
  PID:9716
- C:\Windows\System\sGgpnQD.exe
  C:\Windows\System\sGgpnQD.exe
  2⤵
  PID:9748
- C:\Windows\System\iNYuNpK.exe
  C:\Windows\System\iNYuNpK.exe
  2⤵
  PID:9896
- C:\Windows\System\VcHdfCH.exe
  C:\Windows\System\VcHdfCH.exe
  2⤵
  PID:9796

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\BManMjD.exe

Filesize
2.8MB

MD5
c9db1b14532d23b8c2cfd0230e2430f1

SHA1
cf7965f125e20734dce1f758c194ba9b3a782244

SHA256
e26aa1da02a5177269d25a02f95dba3c4a86d1956d2b6829e33791ad1c852987

SHA512
4b5245eb866d7080615735f334c34ee0ad379e351b0772f13b6c077e2c48513f520605ff5875a4179200fe2e104e6e5a07f710a5c3f459d00d7f75303b8634f2

Download Submit
C:\Windows\system\EHeqwsB.exe

Filesize
2.8MB

MD5
30bb3e75690f60703e56a7755f31a2f1

SHA1
65aa3fce207710d0206dbd43ea435bf893affeff

SHA256
dd3051bbb29ace2bf05042d4d14f356bac0062ff54ccbc2fcedde2539043e411

SHA512
42e44715eb52c154873b9d1c4f550839b46a0199e4ced7f0011bdecc53798fecfa8a3a59fc273e24a1a345b09e76c1fa810f126dc7bb3cd351995eb2bfffe1a9

Download Submit
C:\Windows\system\EHjBVjW.exe

Filesize
2.8MB

MD5
aa84290776567bace414cff64edfe94e

SHA1
1f295e05db1708e83bbf47addd39a7ab62632bae

SHA256
846d07301e5e7e3f40dbcec41c132c3cc6180a3dfcfda8aa0b104546749471e1

SHA512
86efa84a92b3a8f2460168590d65f10668b4ea16e56211968f6424a8faf22f11c4d2bf35088a43a89e65475f26422d8450d26b5731127f964d1629f9251214b3

Download Submit
C:\Windows\system\FRIXCVw.exe

Filesize
2.8MB

MD5
8946ac9087387847105612eb665e0a69

SHA1
1d33209c9e72274f2b58adb6d5862be56af0630f

SHA256
067ded07633878a95b1cb4464fa6d2f10630a1a6830589d5567310894f8289f9

SHA512
0d8b308819efa7cb25aa0102da263d24748c367b37350ac1208308b08e5a8714813aaf6b9154c4c39b2fe8f439c913d0ac0c3f216b2e5a402bb9c3b4f078e166

Download Submit
C:\Windows\system\FfoOfMG.exe

Filesize
2.8MB

MD5
b0dfcdb55b3f19cd7ed2a3b150949ac5

SHA1
6a8f23bf2b7aefb24bd0594ed4447d2b63d2c5c6

SHA256
d6da443a1dfdfea25c738442ae26a8e016c6ece119f18bd21745fad62d6b415c

SHA512
08315807a5f244d9e5561beb201c3d032243046f0865f3785ba4a20a36a56f28480a96f0f835dc67d4c8653b6c7e8447490f7e7cb600a7981562c7e1a90af549

Download Submit
C:\Windows\system\GEQhyWY.exe

Filesize
2.8MB

MD5
2a5d2c5f7bfc47dfe429b514613902bb

SHA1
22db62b98299fcee8726f1a8a18900a217eb02d4

SHA256
7b0f350228b7cf6c71633af1e8bb510aef132f77889468adcbd84e9627f84b89

SHA512
0557d8ddcd177180f2dd5c890a720f6a1b31178700ec31a5d39e1673c817a17a100695afb8661cb8b72d2219286c353ac263e994855edcd8efb8dce42aa5ad82

Download Submit
C:\Windows\system\JXvwuGQ.exe

Filesize
2.8MB

MD5
88a87e2cab760c930729ff9796ad90a7

SHA1
b12e1be0fc4695a4721d6e463acfc0db079bfdba

SHA256
fb0c29016924e9cce821c565a806154727bde110b83986a702709a71e162e270

SHA512
bf484f27876316b3645c23502d529bebb110ff7a7d8b1f5a32b3553f8ec0442019fcfc5b81fec4b4da08728a828a1bfe3da86fe43a52f95402e5d7898a7d80db

Download Submit
C:\Windows\system\KapoxYy.exe

Filesize
2.8MB

MD5
6735e4fe620cae510df6cda4bb5761ec

SHA1
c733a091e20c4aaed89bae2b0aeea8f2df58d93f

SHA256
4ecfacfee04c0e37122aa6a3c393e3854e43cd6e1f0583ab2a29cd4c57353428

SHA512
3c0a2587332a77d21faca4d8723acfa4e2634056bca80dfa2285c8b336eeabc2e5743fcd5d28ead5f298431b4d20cbbe6c9ee0b7a8e46438ac22b7ea6ae1c8af

Download Submit
C:\Windows\system\KyLejch.exe

Filesize
2.8MB

MD5
6b2612663e6790d89dbe53818b097554

SHA1
88a0a9ad8ee555a9bb175c5d91bcd48e08f919fb

SHA256
f001cba9653fa19ed4de2ec4d120e3fe496e786c8b9335e0e6eb8a01e3c1c39b

SHA512
8d656a07f617cd057470fe9fb05f73e97c5a06fb194959b645846a397eb1ff08207fa214de7adddc481e84fb8374c700652d191a2700e65668f69ddf3ca77477

Download Submit
C:\Windows\system\MOwNMSP.exe

Filesize
2.8MB

MD5
458bc07a848f7c2104182d14ed8e31e5

SHA1
5be9528074fbf65a8c5269eef5c47c382baf30f3

SHA256
48d0433a1c5e0ead35698e08fc11f29866fba3100dd2676ae5c149a3ba0a7020

SHA512
506c0623b4ab63566c98e538818ab4bdbc6eae4189a953b7d2406b77f619507af04302727d334218679785b8fe70a5648c4daf1ef4791e3f436fcb23460c1a29

Download Submit
C:\Windows\system\TSvXbgr.exe

Filesize
2.8MB

MD5
de27fb2063d0eacf23198eed29f674ce

SHA1
52649000c146be324c95ba6078ea8cf3ca306193

SHA256
de73be5a820840ed2cc2ac6264bd84b79d39f2c6bbfe93dcc38c7acf376fec88

SHA512
b4cdb1ae462d44298f53dfd85b37e84ac2c1f2ef5a731393a22a7ab67de8cb9b8b6ba78b7cd51d2c88965a718c600fd35dabf41594ef25e1cd4b2612d6d13b2e

Download Submit
C:\Windows\system\VtahboA.exe

Filesize
2.8MB

MD5
cd5b1e11b61382e3da7beb24a2f9b097

SHA1
cf038492f8e9b3baf7d6aac4a17d8b14e621c621

SHA256
9581c1f0b0c814410951c7b3ffd4c27a7d8bbb9c963eca2edf1636a059adfea4

SHA512
55b661269cf3dc28abed60531f57e99e7544785ec7bafbc2ba0e725e2d911cc83c09355a7993c1531b750cca8bc36a8bd24b5cd95b92a98e86104f74e2edeecd

Download Submit
C:\Windows\system\YywYACZ.exe

Filesize
2.8MB

MD5
47da62fe433c55202455ef758a17f1c1

SHA1
8cd1726aad40b4baa253c39c69ca0579896a23ef

SHA256
edc04565f542622c1aa9b1bda578bc3f89debeffaa01a1c77629dbae856125b0

SHA512
22f3b9bfe9a45b8c6fa4e5a8d491d780ace5ef26888e132d08e61ce296f381e1b28ca24197d15988c5b0bcb85c5bcc522b2f9e46a14af86fddeafdb338f5c0a3

Download Submit
C:\Windows\system\ZOrFwnB.exe

Filesize
2.8MB

MD5
3cba5829fe181351a7bf739bf4148fc7

SHA1
d02e021a55b394a7f8a03c01084ff80e6f2131e2

SHA256
e2c5893fcb90dec575dd7f96fca16bc918ff64638c85a74b545dd6928dcd25ea

SHA512
f6d2a80510da565f10c13786b513f24fafbc200b970f777228d60dd74c2749f45f95430c5e3426fb0d8c84d79199bbea7abe5abd07f21dcc3420eb1fb4b8f449

Download Submit
C:\Windows\system\dZamctf.exe

Filesize
2.8MB

MD5
873a6179750b5bb5419526b23bb2a46e

SHA1
452d08963a1d692bcbec99d8a85653561864d9e2

SHA256
0583fc083135c25741e6113351d06f63aac4deb739cd53b8058eb24465b50d82

SHA512
84fa3910c7bf8a1bd621d6bc9962e2c528b6eb0ec18ce0957121fe226425259506167300a06591e69703c02b29ae3733181d40b73adcb3ac615f7863ca7d3a60

Download Submit
C:\Windows\system\duhlYKh.exe

Filesize
2.8MB

MD5
99116ce0e657d1331d7e413c36164a69

SHA1
882608f9028ed5ce42ad57b9afe97526a8077042

SHA256
042c7348adda5e2811ae7116fe0dbc4cb698b62ed78c3a1597665779b6ebb126

SHA512
34cd5c06df7c924e4309e87ceb7cecb930e1c95483bf1883712444e7e892e5eecadb3a2987c19658e148aa2a29f916d78f8d051ca5a28d68d191f26b00e888bf

Download Submit
C:\Windows\system\fauOUdx.exe

Filesize
2.8MB

MD5
8bf371470f45aa0988f28eedf73a920a

SHA1
f5c6b1115844862e59501c56fdaeb57e26adca88

SHA256
5bf91a434854c2e3386446fe827478457269c12d07c61256e7f100c7955041fd

SHA512
79aef960dd1d307f682fd9f7062af289410c7bdcd6f29c86c81d3ce4129f776bdcf9801982a5cc9f03354dfa62cf827493cb8abaf94018d55c40fc4bf0ef0f7b

Download Submit
C:\Windows\system\fnEZazH.exe

Filesize
2.8MB

MD5
23e951ce4b63c50076e679fe09bbf4e5

SHA1
eb347d85afd7a81f06dd126fe8e7ebb4623c39cc

SHA256
8139db98b7b022aa8215df348ef735cce421a3e55e707522e1bb2d3b41dd3b24

SHA512
b250558d7ba1735df54b437f8e36c60c98af179314c2b0e21a503b25a84105ceeaa6e3acd02b0a5ec3e894d73acf5d8a29ab977b08396ad78bc4ed01e8c88bc5

Download Submit
C:\Windows\system\jWcobHm.exe

Filesize
2.8MB

MD5
ef0c135ca66e23b09fbd276618e8eaf0

SHA1
adaa07d6bd30a1287bbc47a56b11a0999e1c2c06

SHA256
d779fecdda23b4768208904b98994406b46cdd60d91b213fa02170e36f69fc72

SHA512
74dd5a695dffad5f7553408a3630513d0122a29bbb911b624afe677ff490c929afbcc9cde5e86ecb22d532e557ed08bad71f91319a3e3ed0a42a601dfd6c4254

Download Submit
C:\Windows\system\kFIBpNT.exe

Filesize
2.8MB

MD5
779106f23f62bc050361c7dbc5019d6d

SHA1
5f1b669cbc2b697c917c14d859bdc9adf2c2d4ee

SHA256
fdd1d6661c216dcbcae1fb860508e480a105e20d9a3be670eb38280780cfb4bf

SHA512
18832c884e8b0c902b6b7853216e7115110b502cf4dd17c7e847ba615c1380784c5445424d7c822e33a642fad89163bbad3633c4148a8fca0a8a0279d87ffb65

Download Submit
C:\Windows\system\lKylMmn.exe

Filesize
2.8MB

MD5
06a2540fcc8e13895b1672a7a518eb30

SHA1
ee5ab3983d33cdafc3bf472176d56e8fb4423cdf

SHA256
a536dc36a103637f540baf62290bcb73e07afb4e6fa10c9d05417780194d43fb

SHA512
ca8f0e129e1019da0501a7520df8b58cdd90a17d4aa6862cdd88ea1692aadf6f781ca62dff1d718c2568372983ae31693a21a26445b855af4035aa404705f92c

Download Submit
C:\Windows\system\liFtjNP.exe

Filesize
2.8MB

MD5
102b31f4be27dd35552e624fd21e27bc

SHA1
1c74a412d12bc45d2152075a58b2f1060633ab66

SHA256
e49d95763ad0e2fa4fedc05122c8d47cd7ae70d25bfe1d2f48b811589d778977

SHA512
70d324a75fd662d6510e588a7b7e463e3add00f4381188a536d1b76aec251ef724c2d773ab3259805fd7fad3074088b2507ada65673df9bf6d94b9bb04d503d5

Download Submit
C:\Windows\system\mqfdbzY.exe

Filesize
2.8MB

MD5
45eabd2e4de85122cd59e187046d49da

SHA1
8c05d370cab496ee24877fbbd5845a6a9c6381a0

SHA256
dc9d52910c7f0eff09e7a7bb88bcae88c77d9586b71d4fd53fbc6ccfaae51731

SHA512
394e15af404ef99ded2a4a274a6a39dc51dd3915e2993a7080a4d43f944da5707c913bb79c12ed18a704ce716df137009e47ee3311eb17a4f3e88e290215522f

Download Submit
C:\Windows\system\nAQySpf.exe

Filesize
2.8MB

MD5
e0d5a6fb6e39b49392315a32a5ada98e

SHA1
164d83b868fcdbfc831dc63bc1832dca0b924c79

SHA256
043919b3c817ef4ccc3f238c35ef8e32b97f142ce97a6531a67b88f8b6081086

SHA512
25eb14728895902e9b0e303de0a026e865d202a0a7f61d30c22407a82678edd631fbfb30fba6ce4aceaf86cd8f7e20c6337b5137dad3a1c83b4fb757f0921616

Download Submit
C:\Windows\system\qarKSXg.exe

Filesize
2.8MB

MD5
d3e7007c3d3cd6ff4a41070e0af81a68

SHA1
40cbb415817875a0a5b39e3ae98cb105221cc164

SHA256
405d2b6664f69e079187f78b00517c6f13b535a98e4cdaac0fa02527ccdc8e3c

SHA512
a922235359bd35978f20dd85242e6c6232a82bed1f94972ef9c784f4d14c5e1776ed07ea2827803bd848dbb0bd2ecc2fb23f075f339b2414b27223fed4a4a628

Download Submit
C:\Windows\system\vSPOYcG.exe

Filesize
2.8MB

MD5
356f6192586d401232ed138292ee04b3

SHA1
82ae0e321df5873b01701f3ec3fc2c8040db5b33

SHA256
32d1984e3a24a1a63788f58697e5cbb668a335c93fc3eda8eb41dac9d7e6ebb6

SHA512
289c85bbb2d0a40e8635e554c91f35d51363677f10c6b0509830e995e8ceba1fc68ba3c3e9c117b96b5f9ae1880a8d02723452b2717803dc7ae03e3c0464028e

Download Submit
C:\Windows\system\yuZcGYX.exe

Filesize
2.8MB

MD5
098b2e2e9980a0c2a7253b7439429e1e

SHA1
63fe937b6f417bf35364cf2a7c60ac1b418a3011

SHA256
6480b786478e3c0f54b141537daefc00d57a07ae0a5d68c46537dd6aa6da3ca6

SHA512
2dad6bbef04b3e9e115c041e966104445c6f75eec61bf55ba67b8c6ff750ecafad60b55cb762b53474c371198ce4b11dab92a3de69f30fe2a649591206f9ed8d

Download Submit
\Windows\system\HrPnvDG.exe

Filesize
2.8MB

MD5
b83af2f8ab453ae8d90cfa6f7af8e8eb

SHA1
fc7a7ff7dcb325a9f059a2b84570b5c85fb4195a

SHA256
e249950a33d5ed6653129a679da19813adc1e6e327f141686beb774134e4572e

SHA512
242077ccdbfb71f751d1bd671f6ab07f4af3fd551d35dfa8c826a40200f5a806c18a74173f002d101e84cf601315b014a59ee4e7e0916676f54b8748da6bfb64

Download Submit
\Windows\system\JLwxBvQ.exe

Filesize
2.8MB

MD5
d87bbe9652b441e5d83aec39efcaa15b

SHA1
b81b085bb283836597737ca0db0c499372f5a63c

SHA256
c1b41dc5becfea91571befd19ef467741ed0aa16d02151ca1dd11fadd3589427

SHA512
c26e31b4d4318de0d68c91ad790a7153e8b7a305ab764f2a696b075c9c7a628b475e8f40da7c5447112b9ce31316d76cb1fa84a6a24db8dad147a9fa9405849a

Download Submit
\Windows\system\aoyOPPz.exe

Filesize
2.8MB

MD5
0a0a55b3479e43eb20f0ac1cf484433f

SHA1
af2488eccb44be87240f0af4b3c9a5d5fead3584

SHA256
1770b241a7d9c2f8f7e31d0a67139d6670c6599ca74ac7a5d7f4ec1e6d8861ed

SHA512
02a6d87f4dfbb20ecb65bd3f9dea70d63117c8a29b6123950d69f3c8ad5f1fbbda6bd95ff3ad62cbb406bcc6a4ad358256fa6aaae4746c0f17c54202a4d82d28

Download Submit
\Windows\system\eIrkdbL.exe

Filesize
2.8MB

MD5
994c64730cda2fac510a5e5adbcf7fea

SHA1
bdde1d2a77fa3c600ae5872cd710353ba789a6d8

SHA256
e3dd9832ed683541c45a38184c64c6791289c9abd92688c5c106d46ed3c98f4c

SHA512
d4653c38eb216a43b431fb8dc2aad142faa448b1c6b14820e80097512d316d1472820257a3a2ed232d5acc709ef8d586dda255445c23f6ce20cf4bcbcde25446

Download Submit
\Windows\system\jHpqMtH.exe

Filesize
2.8MB

MD5
6084f4027e9a5e012be60dad0a1cf9de

SHA1
7b76eecfbecd5dd1a528f191917e8ffbe6b9fed5

SHA256
86a3c4cc40ef3534df6f88573f77fa25a23c896f4086088a475271a0e61e5ed8

SHA512
519deb59ee48e9a62a4061388899d4c0bf6e21b2e56d7290a395568f32123c30ad4ee03979b5285cc69c011b7230773e67b89e1caf5711f6340f302d64285946

Download Submit
\Windows\system\rBmRtDI.exe

Filesize
2.8MB

MD5
0bb3aeba5c4af9793b29fabe93c67015

SHA1
54113cb1f75d71440c9fd0f449b9e0a7810c60ff

SHA256
96d653a33ec1f0ef76a3295791e43058502ed80f513d33531fed2f6c27c11a3e

SHA512
0f88650185a49c7be4ba04424958114b9fac6f70848ebb3edf52b79a4e6f3a92ae07ccebd6120065750c75ba0654ff69dd4e4beb59a0caf5fa918c882176f07a

Download Submit
memory/2188-176-0x00000000028F0000-0x00000000028F8000-memory.dmp

Filesize
32KB

Download
memory/2188-175-0x000000001B720000-0x000000001BA02000-memory.dmp

Filesize
2.9MB

Download
memory/2196-6612-0x000000013F6B0000-0x000000013FAA6000-memory.dmp

Filesize
4.0MB

Download
memory/2196-85-0x000000013F6B0000-0x000000013FAA6000-memory.dmp

Filesize
4.0MB

Download
memory/2396-83-0x000000013FA80000-0x000000013FE76000-memory.dmp

Filesize
4.0MB

Download
memory/2396-6572-0x000000013FA80000-0x000000013FE76000-memory.dmp

Filesize
4.0MB

Download
memory/2432-26-0x00000000031C0000-0x00000000035B6000-memory.dmp

Filesize
4.0MB

Download
memory/2432-56-0x000000013FA80000-0x000000013FE76000-memory.dmp

Filesize
4.0MB

Download
memory/2432-8702-0x00000000031C0000-0x00000000035B6000-memory.dmp

Filesize
4.0MB

Download
memory/2432-60-0x000000013FAC0000-0x000000013FEB6000-memory.dmp

Filesize
4.0MB

Download
memory/2432-8694-0x00000000031C0000-0x00000000035B6000-memory.dmp

Filesize
4.0MB

Download
memory/2432-7284-0x000000013FAC0000-0x000000013FEB6000-memory.dmp

Filesize
4.0MB

Download
memory/2432-6760-0x00000000031C0000-0x00000000035B6000-memory.dmp

Filesize
4.0MB

Download
memory/2432-74-0x000000013FEE0000-0x00000001402D6000-memory.dmp

Filesize
4.0MB

Download
memory/2432-6634-0x000000013F3F0000-0x000000013F7E6000-memory.dmp

Filesize
4.0MB

Download
memory/2432-79-0x00000000031C0000-0x00000000035B6000-memory.dmp

Filesize
4.0MB

Download
memory/2432-1-0x000000013F3F0000-0x000000013F7E6000-memory.dmp

Filesize
4.0MB

Download
memory/2432-95-0x000000013FBA0000-0x000000013FF96000-memory.dmp

Filesize
4.0MB

Download
memory/2432-75-0x000000013FF10000-0x0000000140306000-memory.dmp

Filesize
4.0MB

Download
memory/2432-73-0x000000013FBE0000-0x000000013FFD6000-memory.dmp

Filesize
4.0MB

Download
memory/2432-61-0x000000013FE50000-0x0000000140246000-memory.dmp

Filesize
4.0MB

Download
memory/2432-86-0x00000000031C0000-0x00000000035B6000-memory.dmp

Filesize
4.0MB

Download
memory/2432-15-0x000000013F940000-0x000000013FD36000-memory.dmp

Filesize
4.0MB

Download
memory/2432-45-0x00000000031C0000-0x00000000035B6000-memory.dmp

Filesize
4.0MB

Download
memory/2432-0-0x00000000002F0000-0x0000000000300000-memory.dmp

Filesize
64KB

Download
memory/2572-50-0x000000013F740000-0x000000013FB36000-memory.dmp

Filesize
4.0MB

Download
memory/2580-92-0x000000013FAC0000-0x000000013FEB6000-memory.dmp

Filesize
4.0MB

Download
memory/2676-37-0x000000013FEE0000-0x00000001402D6000-memory.dmp

Filesize
4.0MB

Download
memory/2676-6547-0x000000013FEE0000-0x00000001402D6000-memory.dmp

Filesize
4.0MB

Download
memory/2692-6563-0x000000013F9B0000-0x000000013FDA6000-memory.dmp

Filesize
4.0MB

Download
memory/2692-78-0x000000013F9B0000-0x000000013FDA6000-memory.dmp

Filesize
4.0MB

Download
memory/2748-30-0x000000013F150000-0x000000013F546000-memory.dmp

Filesize
4.0MB

Download
memory/2792-96-0x000000013FBE0000-0x000000013FFD6000-memory.dmp

Filesize
4.0MB

Download
memory/2792-6604-0x000000013FBE0000-0x000000013FFD6000-memory.dmp

Filesize
4.0MB

Download
memory/2832-6605-0x000000013FF10000-0x0000000140306000-memory.dmp

Filesize
4.0MB

Download
memory/2832-76-0x000000013FF10000-0x0000000140306000-memory.dmp

Filesize
4.0MB

Download
memory/3032-6573-0x000000013FE50000-0x0000000140246000-memory.dmp

Filesize
4.0MB

Download
memory/3032-72-0x000000013FE50000-0x0000000140246000-memory.dmp

Filesize
4.0MB

Download
memory/3056-21-0x000000013F940000-0x000000013FD36000-memory.dmp

Filesize
4.0MB

Download