xmrig | f922bc8bcbf08164a45e583c93196bebf4d81ef9dabcd4c14c2f790cf948ff81

Analysis

max time kernel
150s
max time network
145s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
11/06/2024, 23:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0d0f44a16d056847443af125e4bf75b0_NeikiAnalytics.exe
Size

1.5MB
MD5

0d0f44a16d056847443af125e4bf75b0
SHA1

921cda34ac14e7314d8b1af179eefd8e46427e08
SHA256

f922bc8bcbf08164a45e583c93196bebf4d81ef9dabcd4c14c2f790cf948ff81
SHA512

b69769da5aa9c4ea49d91d281b9115f0ee6fc3bd8f7fc6a1922686d1b7c216ea829bd2518bb7e687b269bec39d9d48d44ebc9d9f3847d5a1b343e2ec337220cf
SSDEEP

24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjhnXwx8/2Pbx/mbf+BogYGzi:Lz071uv4BPMkHC0IlnASEx/ml5

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 20 IoCs

miner

resource	yara_rule
behavioral1/memory/2716-99-0x000000013FA90000-0x000000013FE82000-memory.dmp	xmrig
behavioral1/memory/2564-95-0x000000013F720000-0x000000013FB12000-memory.dmp	xmrig
behavioral1/memory/2432-89-0x000000013F400000-0x000000013F7F2000-memory.dmp	xmrig
behavioral1/memory/2256-87-0x000000013F460000-0x000000013F852000-memory.dmp	xmrig
behavioral1/memory/2856-84-0x000000013FA70000-0x000000013FE62000-memory.dmp	xmrig
behavioral1/memory/2692-80-0x000000013FEB0000-0x00000001402A2000-memory.dmp	xmrig
behavioral1/memory/2520-78-0x000000013FB60000-0x000000013FF52000-memory.dmp	xmrig
behavioral1/memory/2584-72-0x000000013F5B0000-0x000000013F9A2000-memory.dmp	xmrig
behavioral1/memory/2600-64-0x000000013FE10000-0x0000000140202000-memory.dmp	xmrig
behavioral1/memory/2516-5184-0x000000013F530000-0x000000013F922000-memory.dmp	xmrig
behavioral1/memory/2692-5187-0x000000013FEB0000-0x00000001402A2000-memory.dmp	xmrig
behavioral1/memory/2520-5192-0x000000013FB60000-0x000000013FF52000-memory.dmp	xmrig
behavioral1/memory/2476-5180-0x000000013F4F0000-0x000000013F8E2000-memory.dmp	xmrig
behavioral1/memory/2564-5224-0x000000013F720000-0x000000013FB12000-memory.dmp	xmrig
behavioral1/memory/2432-5221-0x000000013F400000-0x000000013F7F2000-memory.dmp	xmrig
behavioral1/memory/2256-5220-0x000000013F460000-0x000000013F852000-memory.dmp	xmrig
behavioral1/memory/2716-5218-0x000000013FA90000-0x000000013FE82000-memory.dmp	xmrig
behavioral1/memory/2856-5217-0x000000013FA70000-0x000000013FE62000-memory.dmp	xmrig
behavioral1/memory/2600-5216-0x000000013FE10000-0x0000000140202000-memory.dmp	xmrig
behavioral1/memory/1728-8547-0x000000013FEB0000-0x00000001402A2000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
1972	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
2476	pdPmGgT.exe
2516	wrijLRt.exe
2600	BFZKQgy.exe
2584	qnWEoBa.exe
2520	zetuaCB.exe
2692	twJCMSf.exe
2564	HzeiXxz.exe
2856	iEkSeyI.exe
2256	niheioe.exe
2432	iVUydcu.exe
2716	SJlOszs.exe
320	bhxlmxh.exe
2488	dcdVfJY.exe
288	BIFOgNt.exe
1520	YLAHSCP.exe
2300	gOBUQNq.exe
1260	KlffrNS.exe
340	yDMYiTS.exe
2032	syKcxix.exe
1996	CVBLokf.exe
2804	uFyijuz.exe
2244	lMuDdEe.exe
2868	YSpAGmQ.exe
2196	jtqUdTG.exe
1944	jjwdgSv.exe
608	qDFpIKE.exe
580	pRENKgu.exe
2728	WnMSgEY.exe
656	FRttmEv.exe
2348	OGUcGNs.exe
2344	FKXwjjh.exe
3016	gCtgPDJ.exe
1128	FkApzDI.exe
2968	scpewqF.exe
2776	xjKgyNl.exe
980	lDTeThZ.exe
1472	zQqMpsA.exe
1676	DbRniLG.exe
1544	MPqzYLD.exe
944	XdasCyK.exe
916	UbUrzEf.exe
1716	MvETBjy.exe
804	ZUtCAIa.exe
2200	EdSRoPk.exe
596	FDfpKVd.exe
1932	yAOEMOk.exe
2788	HNTJAEq.exe
1704	zmZVAWP.exe
2292	XBPDjBZ.exe
1596	SeBEgXP.exe
2072	lGCysDO.exe
1508	McFjgEt.exe
1640	sixBzEa.exe
2144	jHzzURE.exe
2652	tYVojrr.exe
3020	TMZCdcz.exe
1040	TWvOqjN.exe
2644	iPXlvNg.exe
2680	hKsllet.exe
2400	IemvvnP.exe
2428	guKKbjK.exe
2964	iNGYhJu.exe
2556	eMZmOxv.exe
1636	SrrMoXl.exe

Loads dropped DLL 64 IoCs

pid	Process
1728	0d0f44a16d056847443af125e4bf75b0_NeikiAnalytics.exe
1728	0d0f44a16d056847443af125e4bf75b0_NeikiAnalytics.exe
1728	0d0f44a16d056847443af125e4bf75b0_NeikiAnalytics.exe
1728	0d0f44a16d056847443af125e4bf75b0_NeikiAnalytics.exe
1728	0d0f44a16d056847443af125e4bf75b0_NeikiAnalytics.exe
1728	0d0f44a16d056847443af125e4bf75b0_NeikiAnalytics.exe
1728	0d0f44a16d056847443af125e4bf75b0_NeikiAnalytics.exe
1728	0d0f44a16d056847443af125e4bf75b0_NeikiAnalytics.exe
1728	0d0f44a16d056847443af125e4bf75b0_NeikiAnalytics.exe
1728	0d0f44a16d056847443af125e4bf75b0_NeikiAnalytics.exe
1728	0d0f44a16d056847443af125e4bf75b0_NeikiAnalytics.exe
1728	0d0f44a16d056847443af125e4bf75b0_NeikiAnalytics.exe
1728	0d0f44a16d056847443af125e4bf75b0_NeikiAnalytics.exe
1728	0d0f44a16d056847443af125e4bf75b0_NeikiAnalytics.exe
1728	0d0f44a16d056847443af125e4bf75b0_NeikiAnalytics.exe
1728	0d0f44a16d056847443af125e4bf75b0_NeikiAnalytics.exe
1728	0d0f44a16d056847443af125e4bf75b0_NeikiAnalytics.exe
1728	0d0f44a16d056847443af125e4bf75b0_NeikiAnalytics.exe
1728	0d0f44a16d056847443af125e4bf75b0_NeikiAnalytics.exe
1728	0d0f44a16d056847443af125e4bf75b0_NeikiAnalytics.exe
1728	0d0f44a16d056847443af125e4bf75b0_NeikiAnalytics.exe
1728	0d0f44a16d056847443af125e4bf75b0_NeikiAnalytics.exe
1728	0d0f44a16d056847443af125e4bf75b0_NeikiAnalytics.exe
1728	0d0f44a16d056847443af125e4bf75b0_NeikiAnalytics.exe
1728	0d0f44a16d056847443af125e4bf75b0_NeikiAnalytics.exe
1728	0d0f44a16d056847443af125e4bf75b0_NeikiAnalytics.exe
1728	0d0f44a16d056847443af125e4bf75b0_NeikiAnalytics.exe
1728	0d0f44a16d056847443af125e4bf75b0_NeikiAnalytics.exe
1728	0d0f44a16d056847443af125e4bf75b0_NeikiAnalytics.exe
1728	0d0f44a16d056847443af125e4bf75b0_NeikiAnalytics.exe
1728	0d0f44a16d056847443af125e4bf75b0_NeikiAnalytics.exe
1728	0d0f44a16d056847443af125e4bf75b0_NeikiAnalytics.exe
1728	0d0f44a16d056847443af125e4bf75b0_NeikiAnalytics.exe
1728	0d0f44a16d056847443af125e4bf75b0_NeikiAnalytics.exe
1728	0d0f44a16d056847443af125e4bf75b0_NeikiAnalytics.exe
1728	0d0f44a16d056847443af125e4bf75b0_NeikiAnalytics.exe
1728	0d0f44a16d056847443af125e4bf75b0_NeikiAnalytics.exe
1728	0d0f44a16d056847443af125e4bf75b0_NeikiAnalytics.exe
1728	0d0f44a16d056847443af125e4bf75b0_NeikiAnalytics.exe
1728	0d0f44a16d056847443af125e4bf75b0_NeikiAnalytics.exe
1728	0d0f44a16d056847443af125e4bf75b0_NeikiAnalytics.exe
1728	0d0f44a16d056847443af125e4bf75b0_NeikiAnalytics.exe
1728	0d0f44a16d056847443af125e4bf75b0_NeikiAnalytics.exe
1728	0d0f44a16d056847443af125e4bf75b0_NeikiAnalytics.exe
1728	0d0f44a16d056847443af125e4bf75b0_NeikiAnalytics.exe
1728	0d0f44a16d056847443af125e4bf75b0_NeikiAnalytics.exe
1728	0d0f44a16d056847443af125e4bf75b0_NeikiAnalytics.exe
1728	0d0f44a16d056847443af125e4bf75b0_NeikiAnalytics.exe
1728	0d0f44a16d056847443af125e4bf75b0_NeikiAnalytics.exe
1728	0d0f44a16d056847443af125e4bf75b0_NeikiAnalytics.exe
1728	0d0f44a16d056847443af125e4bf75b0_NeikiAnalytics.exe
1728	0d0f44a16d056847443af125e4bf75b0_NeikiAnalytics.exe
1728	0d0f44a16d056847443af125e4bf75b0_NeikiAnalytics.exe
1728	0d0f44a16d056847443af125e4bf75b0_NeikiAnalytics.exe
1728	0d0f44a16d056847443af125e4bf75b0_NeikiAnalytics.exe
1728	0d0f44a16d056847443af125e4bf75b0_NeikiAnalytics.exe
1728	0d0f44a16d056847443af125e4bf75b0_NeikiAnalytics.exe
1728	0d0f44a16d056847443af125e4bf75b0_NeikiAnalytics.exe
1728	0d0f44a16d056847443af125e4bf75b0_NeikiAnalytics.exe
1728	0d0f44a16d056847443af125e4bf75b0_NeikiAnalytics.exe
1728	0d0f44a16d056847443af125e4bf75b0_NeikiAnalytics.exe
1728	0d0f44a16d056847443af125e4bf75b0_NeikiAnalytics.exe
1728	0d0f44a16d056847443af125e4bf75b0_NeikiAnalytics.exe
1728	0d0f44a16d056847443af125e4bf75b0_NeikiAnalytics.exe

UPX packed file 55 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1728-0-0x000000013FEB0000-0x00000001402A2000-memory.dmp	upx
behavioral1/files/0x000c000000015cd2-6.dat	upx
behavioral1/files/0x0031000000015d39-11.dat	upx
behavioral1/files/0x0007000000015f23-15.dat	upx
behavioral1/files/0x0007000000016013-23.dat	upx
behavioral1/files/0x0007000000016122-26.dat	upx
behavioral1/files/0x00090000000161ee-28.dat	upx
behavioral1/files/0x0007000000015fa6-19.dat	upx
behavioral1/memory/2476-29-0x000000013F4F0000-0x000000013F8E2000-memory.dmp	upx
behavioral1/files/0x0016000000005586-51.dat	upx
behavioral1/files/0x0008000000016cfd-46.dat	upx
behavioral1/files/0x0031000000015d59-52.dat	upx
behavioral1/files/0x0006000000016d21-73.dat	upx
behavioral1/files/0x0006000000016d18-66.dat	upx
behavioral1/files/0x0006000000016d81-110.dat	upx
behavioral1/files/0x000600000001738c-142.dat	upx
behavioral1/files/0x00060000000173e7-161.dat	upx
behavioral1/files/0x0006000000017472-171.dat	upx
behavioral1/files/0x000600000001748d-177.dat	upx
behavioral1/files/0x000600000001864a-190.dat	upx
behavioral1/files/0x0006000000017510-186.dat	upx
behavioral1/files/0x000600000001745d-169.dat	upx
behavioral1/files/0x00060000000173df-160.dat	upx
behavioral1/files/0x00060000000173c5-150.dat	upx
behavioral1/files/0x000600000001737e-148.dat	upx
behavioral1/files/0x00060000000173dc-155.dat	upx
behavioral1/files/0x0006000000016f7e-129.dat	upx
behavioral1/files/0x0006000000016da9-119.dat	upx
behavioral1/files/0x000600000001737b-133.dat	upx
behavioral1/files/0x0006000000016e56-124.dat	upx
behavioral1/files/0x0006000000016d85-114.dat	upx
behavioral1/files/0x0006000000016d29-100.dat	upx
behavioral1/memory/2716-99-0x000000013FA90000-0x000000013FE82000-memory.dmp	upx
behavioral1/memory/2564-95-0x000000013F720000-0x000000013FB12000-memory.dmp	upx
behavioral1/files/0x0006000000016d31-103.dat	upx
behavioral1/memory/2432-89-0x000000013F400000-0x000000013F7F2000-memory.dmp	upx
behavioral1/memory/2256-87-0x000000013F460000-0x000000013F852000-memory.dmp	upx
behavioral1/memory/2856-84-0x000000013FA70000-0x000000013FE62000-memory.dmp	upx
behavioral1/memory/2692-80-0x000000013FEB0000-0x00000001402A2000-memory.dmp	upx
behavioral1/memory/2520-78-0x000000013FB60000-0x000000013FF52000-memory.dmp	upx
behavioral1/memory/2516-54-0x000000013F530000-0x000000013F922000-memory.dmp	upx
behavioral1/memory/2584-72-0x000000013F5B0000-0x000000013F9A2000-memory.dmp	upx
behavioral1/memory/2600-64-0x000000013FE10000-0x0000000140202000-memory.dmp	upx
behavioral1/files/0x0007000000016d10-61.dat	upx
behavioral1/memory/2516-5184-0x000000013F530000-0x000000013F922000-memory.dmp	upx
behavioral1/memory/2692-5187-0x000000013FEB0000-0x00000001402A2000-memory.dmp	upx
behavioral1/memory/2520-5192-0x000000013FB60000-0x000000013FF52000-memory.dmp	upx
behavioral1/memory/2476-5180-0x000000013F4F0000-0x000000013F8E2000-memory.dmp	upx
behavioral1/memory/2564-5224-0x000000013F720000-0x000000013FB12000-memory.dmp	upx
behavioral1/memory/2432-5221-0x000000013F400000-0x000000013F7F2000-memory.dmp	upx
behavioral1/memory/2256-5220-0x000000013F460000-0x000000013F852000-memory.dmp	upx
behavioral1/memory/2716-5218-0x000000013FA90000-0x000000013FE82000-memory.dmp	upx
behavioral1/memory/2856-5217-0x000000013FA70000-0x000000013FE62000-memory.dmp	upx
behavioral1/memory/2600-5216-0x000000013FE10000-0x0000000140202000-memory.dmp	upx
behavioral1/memory/1728-8547-0x000000013FEB0000-0x00000001402A2000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\BJIqihG.exe	0d0f44a16d056847443af125e4bf75b0_NeikiAnalytics.exe
File created	C:\Windows\System\imCuKHe.exe	0d0f44a16d056847443af125e4bf75b0_NeikiAnalytics.exe
File created	C:\Windows\System\KKYCWkP.exe	0d0f44a16d056847443af125e4bf75b0_NeikiAnalytics.exe
File created	C:\Windows\System\uFGtSbI.exe	0d0f44a16d056847443af125e4bf75b0_NeikiAnalytics.exe
File created	C:\Windows\System\LujfhkB.exe	0d0f44a16d056847443af125e4bf75b0_NeikiAnalytics.exe
File created	C:\Windows\System\wQgLZuO.exe	0d0f44a16d056847443af125e4bf75b0_NeikiAnalytics.exe
File created	C:\Windows\System\uGGWQsB.exe	0d0f44a16d056847443af125e4bf75b0_NeikiAnalytics.exe
File created	C:\Windows\System\GyzuNBz.exe	0d0f44a16d056847443af125e4bf75b0_NeikiAnalytics.exe
File created	C:\Windows\System\XJzmvpv.exe	0d0f44a16d056847443af125e4bf75b0_NeikiAnalytics.exe
File created	C:\Windows\System\GxWvCfc.exe	0d0f44a16d056847443af125e4bf75b0_NeikiAnalytics.exe
File created	C:\Windows\System\cqugvXO.exe	0d0f44a16d056847443af125e4bf75b0_NeikiAnalytics.exe
File created	C:\Windows\System\wLbghtb.exe	0d0f44a16d056847443af125e4bf75b0_NeikiAnalytics.exe
File created	C:\Windows\System\QOqiOag.exe	0d0f44a16d056847443af125e4bf75b0_NeikiAnalytics.exe
File created	C:\Windows\System\xCzLUnd.exe	0d0f44a16d056847443af125e4bf75b0_NeikiAnalytics.exe
File created	C:\Windows\System\ZpegPTl.exe	0d0f44a16d056847443af125e4bf75b0_NeikiAnalytics.exe
File created	C:\Windows\System\ehvBtwY.exe	0d0f44a16d056847443af125e4bf75b0_NeikiAnalytics.exe
File created	C:\Windows\System\RnyQmTa.exe	0d0f44a16d056847443af125e4bf75b0_NeikiAnalytics.exe
File created	C:\Windows\System\TdQKhHK.exe	0d0f44a16d056847443af125e4bf75b0_NeikiAnalytics.exe
File created	C:\Windows\System\nqFikbT.exe	0d0f44a16d056847443af125e4bf75b0_NeikiAnalytics.exe
File created	C:\Windows\System\OcbFLEw.exe	0d0f44a16d056847443af125e4bf75b0_NeikiAnalytics.exe
File created	C:\Windows\System\xuLGCXq.exe	0d0f44a16d056847443af125e4bf75b0_NeikiAnalytics.exe
File created	C:\Windows\System\BnOynPz.exe	0d0f44a16d056847443af125e4bf75b0_NeikiAnalytics.exe
File created	C:\Windows\System\lxYGufk.exe	0d0f44a16d056847443af125e4bf75b0_NeikiAnalytics.exe
File created	C:\Windows\System\aDsimiD.exe	0d0f44a16d056847443af125e4bf75b0_NeikiAnalytics.exe
File created	C:\Windows\System\XXxshZx.exe	0d0f44a16d056847443af125e4bf75b0_NeikiAnalytics.exe
File created	C:\Windows\System\skeqNjX.exe	0d0f44a16d056847443af125e4bf75b0_NeikiAnalytics.exe
File created	C:\Windows\System\PepdUxg.exe	0d0f44a16d056847443af125e4bf75b0_NeikiAnalytics.exe
File created	C:\Windows\System\fmQBKqj.exe	0d0f44a16d056847443af125e4bf75b0_NeikiAnalytics.exe
File created	C:\Windows\System\wlORUgE.exe	0d0f44a16d056847443af125e4bf75b0_NeikiAnalytics.exe
File created	C:\Windows\System\CGdHary.exe	0d0f44a16d056847443af125e4bf75b0_NeikiAnalytics.exe
File created	C:\Windows\System\JbhuLQY.exe	0d0f44a16d056847443af125e4bf75b0_NeikiAnalytics.exe
File created	C:\Windows\System\lVYyKnQ.exe	0d0f44a16d056847443af125e4bf75b0_NeikiAnalytics.exe
File created	C:\Windows\System\eUdJNAP.exe	0d0f44a16d056847443af125e4bf75b0_NeikiAnalytics.exe
File created	C:\Windows\System\umByNGF.exe	0d0f44a16d056847443af125e4bf75b0_NeikiAnalytics.exe
File created	C:\Windows\System\jEzcdJA.exe	0d0f44a16d056847443af125e4bf75b0_NeikiAnalytics.exe
File created	C:\Windows\System\BMihhZa.exe	0d0f44a16d056847443af125e4bf75b0_NeikiAnalytics.exe
File created	C:\Windows\System\fiPthrH.exe	0d0f44a16d056847443af125e4bf75b0_NeikiAnalytics.exe
File created	C:\Windows\System\YjmgWJs.exe	0d0f44a16d056847443af125e4bf75b0_NeikiAnalytics.exe
File created	C:\Windows\System\GNlfFSF.exe	0d0f44a16d056847443af125e4bf75b0_NeikiAnalytics.exe
File created	C:\Windows\System\YqXtNFg.exe	0d0f44a16d056847443af125e4bf75b0_NeikiAnalytics.exe
File created	C:\Windows\System\cWFATdx.exe	0d0f44a16d056847443af125e4bf75b0_NeikiAnalytics.exe
File created	C:\Windows\System\WJNPxgP.exe	0d0f44a16d056847443af125e4bf75b0_NeikiAnalytics.exe
File created	C:\Windows\System\DyXKypz.exe	0d0f44a16d056847443af125e4bf75b0_NeikiAnalytics.exe
File created	C:\Windows\System\EJtdgeH.exe	0d0f44a16d056847443af125e4bf75b0_NeikiAnalytics.exe
File created	C:\Windows\System\QXsjBDW.exe	0d0f44a16d056847443af125e4bf75b0_NeikiAnalytics.exe
File created	C:\Windows\System\ujtVEve.exe	0d0f44a16d056847443af125e4bf75b0_NeikiAnalytics.exe
File created	C:\Windows\System\MoSVqzI.exe	0d0f44a16d056847443af125e4bf75b0_NeikiAnalytics.exe
File created	C:\Windows\System\CXgufxw.exe	0d0f44a16d056847443af125e4bf75b0_NeikiAnalytics.exe
File created	C:\Windows\System\AbsbTLq.exe	0d0f44a16d056847443af125e4bf75b0_NeikiAnalytics.exe
File created	C:\Windows\System\OWjTfNV.exe	0d0f44a16d056847443af125e4bf75b0_NeikiAnalytics.exe
File created	C:\Windows\System\ZJNRGoF.exe	0d0f44a16d056847443af125e4bf75b0_NeikiAnalytics.exe
File created	C:\Windows\System\IKClJVi.exe	0d0f44a16d056847443af125e4bf75b0_NeikiAnalytics.exe
File created	C:\Windows\System\qUoYgVE.exe	0d0f44a16d056847443af125e4bf75b0_NeikiAnalytics.exe
File created	C:\Windows\System\YcwEvBf.exe	0d0f44a16d056847443af125e4bf75b0_NeikiAnalytics.exe
File created	C:\Windows\System\EmhAZhq.exe	0d0f44a16d056847443af125e4bf75b0_NeikiAnalytics.exe
File created	C:\Windows\System\CWMioDk.exe	0d0f44a16d056847443af125e4bf75b0_NeikiAnalytics.exe
File created	C:\Windows\System\DpZNNNu.exe	0d0f44a16d056847443af125e4bf75b0_NeikiAnalytics.exe
File created	C:\Windows\System\wrzIMcv.exe	0d0f44a16d056847443af125e4bf75b0_NeikiAnalytics.exe
File created	C:\Windows\System\ByXDmGW.exe	0d0f44a16d056847443af125e4bf75b0_NeikiAnalytics.exe
File created	C:\Windows\System\VmLrIzK.exe	0d0f44a16d056847443af125e4bf75b0_NeikiAnalytics.exe
File created	C:\Windows\System\oTKvGdG.exe	0d0f44a16d056847443af125e4bf75b0_NeikiAnalytics.exe
File created	C:\Windows\System\cpCSWEu.exe	0d0f44a16d056847443af125e4bf75b0_NeikiAnalytics.exe
File created	C:\Windows\System\OtYNCeY.exe	0d0f44a16d056847443af125e4bf75b0_NeikiAnalytics.exe
File created	C:\Windows\System\KeMUOqA.exe	0d0f44a16d056847443af125e4bf75b0_NeikiAnalytics.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1972	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	1728	0d0f44a16d056847443af125e4bf75b0_NeikiAnalytics.exe
Token: SeLockMemoryPrivilege	1728	0d0f44a16d056847443af125e4bf75b0_NeikiAnalytics.exe
Token: SeDebugPrivilege	1972	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1728 wrote to memory of 1972	1728	0d0f44a16d056847443af125e4bf75b0_NeikiAnalytics.exe	30
PID 1728 wrote to memory of 1972	1728	0d0f44a16d056847443af125e4bf75b0_NeikiAnalytics.exe	30
PID 1728 wrote to memory of 1972	1728	0d0f44a16d056847443af125e4bf75b0_NeikiAnalytics.exe	30
PID 1728 wrote to memory of 2476	1728	0d0f44a16d056847443af125e4bf75b0_NeikiAnalytics.exe	31
PID 1728 wrote to memory of 2476	1728	0d0f44a16d056847443af125e4bf75b0_NeikiAnalytics.exe	31
PID 1728 wrote to memory of 2476	1728	0d0f44a16d056847443af125e4bf75b0_NeikiAnalytics.exe	31
PID 1728 wrote to memory of 2516	1728	0d0f44a16d056847443af125e4bf75b0_NeikiAnalytics.exe	32
PID 1728 wrote to memory of 2516	1728	0d0f44a16d056847443af125e4bf75b0_NeikiAnalytics.exe	32
PID 1728 wrote to memory of 2516	1728	0d0f44a16d056847443af125e4bf75b0_NeikiAnalytics.exe	32
PID 1728 wrote to memory of 2600	1728	0d0f44a16d056847443af125e4bf75b0_NeikiAnalytics.exe	33
PID 1728 wrote to memory of 2600	1728	0d0f44a16d056847443af125e4bf75b0_NeikiAnalytics.exe	33
PID 1728 wrote to memory of 2600	1728	0d0f44a16d056847443af125e4bf75b0_NeikiAnalytics.exe	33
PID 1728 wrote to memory of 2584	1728	0d0f44a16d056847443af125e4bf75b0_NeikiAnalytics.exe	34
PID 1728 wrote to memory of 2584	1728	0d0f44a16d056847443af125e4bf75b0_NeikiAnalytics.exe	34
PID 1728 wrote to memory of 2584	1728	0d0f44a16d056847443af125e4bf75b0_NeikiAnalytics.exe	34
PID 1728 wrote to memory of 2520	1728	0d0f44a16d056847443af125e4bf75b0_NeikiAnalytics.exe	35
PID 1728 wrote to memory of 2520	1728	0d0f44a16d056847443af125e4bf75b0_NeikiAnalytics.exe	35
PID 1728 wrote to memory of 2520	1728	0d0f44a16d056847443af125e4bf75b0_NeikiAnalytics.exe	35
PID 1728 wrote to memory of 2692	1728	0d0f44a16d056847443af125e4bf75b0_NeikiAnalytics.exe	36
PID 1728 wrote to memory of 2692	1728	0d0f44a16d056847443af125e4bf75b0_NeikiAnalytics.exe	36
PID 1728 wrote to memory of 2692	1728	0d0f44a16d056847443af125e4bf75b0_NeikiAnalytics.exe	36
PID 1728 wrote to memory of 2564	1728	0d0f44a16d056847443af125e4bf75b0_NeikiAnalytics.exe	37
PID 1728 wrote to memory of 2564	1728	0d0f44a16d056847443af125e4bf75b0_NeikiAnalytics.exe	37
PID 1728 wrote to memory of 2564	1728	0d0f44a16d056847443af125e4bf75b0_NeikiAnalytics.exe	37
PID 1728 wrote to memory of 2856	1728	0d0f44a16d056847443af125e4bf75b0_NeikiAnalytics.exe	38
PID 1728 wrote to memory of 2856	1728	0d0f44a16d056847443af125e4bf75b0_NeikiAnalytics.exe	38
PID 1728 wrote to memory of 2856	1728	0d0f44a16d056847443af125e4bf75b0_NeikiAnalytics.exe	38
PID 1728 wrote to memory of 2256	1728	0d0f44a16d056847443af125e4bf75b0_NeikiAnalytics.exe	39
PID 1728 wrote to memory of 2256	1728	0d0f44a16d056847443af125e4bf75b0_NeikiAnalytics.exe	39
PID 1728 wrote to memory of 2256	1728	0d0f44a16d056847443af125e4bf75b0_NeikiAnalytics.exe	39
PID 1728 wrote to memory of 320	1728	0d0f44a16d056847443af125e4bf75b0_NeikiAnalytics.exe	40
PID 1728 wrote to memory of 320	1728	0d0f44a16d056847443af125e4bf75b0_NeikiAnalytics.exe	40
PID 1728 wrote to memory of 320	1728	0d0f44a16d056847443af125e4bf75b0_NeikiAnalytics.exe	40
PID 1728 wrote to memory of 2432	1728	0d0f44a16d056847443af125e4bf75b0_NeikiAnalytics.exe	41
PID 1728 wrote to memory of 2432	1728	0d0f44a16d056847443af125e4bf75b0_NeikiAnalytics.exe	41
PID 1728 wrote to memory of 2432	1728	0d0f44a16d056847443af125e4bf75b0_NeikiAnalytics.exe	41
PID 1728 wrote to memory of 2488	1728	0d0f44a16d056847443af125e4bf75b0_NeikiAnalytics.exe	42
PID 1728 wrote to memory of 2488	1728	0d0f44a16d056847443af125e4bf75b0_NeikiAnalytics.exe	42
PID 1728 wrote to memory of 2488	1728	0d0f44a16d056847443af125e4bf75b0_NeikiAnalytics.exe	42
PID 1728 wrote to memory of 2716	1728	0d0f44a16d056847443af125e4bf75b0_NeikiAnalytics.exe	43
PID 1728 wrote to memory of 2716	1728	0d0f44a16d056847443af125e4bf75b0_NeikiAnalytics.exe	43
PID 1728 wrote to memory of 2716	1728	0d0f44a16d056847443af125e4bf75b0_NeikiAnalytics.exe	43
PID 1728 wrote to memory of 288	1728	0d0f44a16d056847443af125e4bf75b0_NeikiAnalytics.exe	44
PID 1728 wrote to memory of 288	1728	0d0f44a16d056847443af125e4bf75b0_NeikiAnalytics.exe	44
PID 1728 wrote to memory of 288	1728	0d0f44a16d056847443af125e4bf75b0_NeikiAnalytics.exe	44
PID 1728 wrote to memory of 1520	1728	0d0f44a16d056847443af125e4bf75b0_NeikiAnalytics.exe	45
PID 1728 wrote to memory of 1520	1728	0d0f44a16d056847443af125e4bf75b0_NeikiAnalytics.exe	45
PID 1728 wrote to memory of 1520	1728	0d0f44a16d056847443af125e4bf75b0_NeikiAnalytics.exe	45
PID 1728 wrote to memory of 2300	1728	0d0f44a16d056847443af125e4bf75b0_NeikiAnalytics.exe	46
PID 1728 wrote to memory of 2300	1728	0d0f44a16d056847443af125e4bf75b0_NeikiAnalytics.exe	46
PID 1728 wrote to memory of 2300	1728	0d0f44a16d056847443af125e4bf75b0_NeikiAnalytics.exe	46
PID 1728 wrote to memory of 1260	1728	0d0f44a16d056847443af125e4bf75b0_NeikiAnalytics.exe	47
PID 1728 wrote to memory of 1260	1728	0d0f44a16d056847443af125e4bf75b0_NeikiAnalytics.exe	47
PID 1728 wrote to memory of 1260	1728	0d0f44a16d056847443af125e4bf75b0_NeikiAnalytics.exe	47
PID 1728 wrote to memory of 340	1728	0d0f44a16d056847443af125e4bf75b0_NeikiAnalytics.exe	48
PID 1728 wrote to memory of 340	1728	0d0f44a16d056847443af125e4bf75b0_NeikiAnalytics.exe	48
PID 1728 wrote to memory of 340	1728	0d0f44a16d056847443af125e4bf75b0_NeikiAnalytics.exe	48
PID 1728 wrote to memory of 2032	1728	0d0f44a16d056847443af125e4bf75b0_NeikiAnalytics.exe	49
PID 1728 wrote to memory of 2032	1728	0d0f44a16d056847443af125e4bf75b0_NeikiAnalytics.exe	49
PID 1728 wrote to memory of 2032	1728	0d0f44a16d056847443af125e4bf75b0_NeikiAnalytics.exe	49
PID 1728 wrote to memory of 1996	1728	0d0f44a16d056847443af125e4bf75b0_NeikiAnalytics.exe	50
PID 1728 wrote to memory of 1996	1728	0d0f44a16d056847443af125e4bf75b0_NeikiAnalytics.exe	50
PID 1728 wrote to memory of 1996	1728	0d0f44a16d056847443af125e4bf75b0_NeikiAnalytics.exe	50
PID 1728 wrote to memory of 2804	1728	0d0f44a16d056847443af125e4bf75b0_NeikiAnalytics.exe	51

C:\Users\Admin\AppData\Local\Temp\0d0f44a16d056847443af125e4bf75b0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\0d0f44a16d056847443af125e4bf75b0_NeikiAnalytics.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1728
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1972
- C:\Windows\System\pdPmGgT.exe
  C:\Windows\System\pdPmGgT.exe
  2⤵
  - Executes dropped EXE
  PID:2476
- C:\Windows\System\wrijLRt.exe
  C:\Windows\System\wrijLRt.exe
  2⤵
  - Executes dropped EXE
  PID:2516
- C:\Windows\System\BFZKQgy.exe
  C:\Windows\System\BFZKQgy.exe
  2⤵
  - Executes dropped EXE
  PID:2600
- C:\Windows\System\qnWEoBa.exe
  C:\Windows\System\qnWEoBa.exe
  2⤵
  - Executes dropped EXE
  PID:2584
- C:\Windows\System\zetuaCB.exe
  C:\Windows\System\zetuaCB.exe
  2⤵
  - Executes dropped EXE
  PID:2520
- C:\Windows\System\twJCMSf.exe
  C:\Windows\System\twJCMSf.exe
  2⤵
  - Executes dropped EXE
  PID:2692
- C:\Windows\System\HzeiXxz.exe
  C:\Windows\System\HzeiXxz.exe
  2⤵
  - Executes dropped EXE
  PID:2564
- C:\Windows\System\iEkSeyI.exe
  C:\Windows\System\iEkSeyI.exe
  2⤵
  - Executes dropped EXE
  PID:2856
- C:\Windows\System\niheioe.exe
  C:\Windows\System\niheioe.exe
  2⤵
  - Executes dropped EXE
  PID:2256
- C:\Windows\System\bhxlmxh.exe
  C:\Windows\System\bhxlmxh.exe
  2⤵
  - Executes dropped EXE
  PID:320
- C:\Windows\System\iVUydcu.exe
  C:\Windows\System\iVUydcu.exe
  2⤵
  - Executes dropped EXE
  PID:2432
- C:\Windows\System\dcdVfJY.exe
  C:\Windows\System\dcdVfJY.exe
  2⤵
  - Executes dropped EXE
  PID:2488
- C:\Windows\System\SJlOszs.exe
  C:\Windows\System\SJlOszs.exe
  2⤵
  - Executes dropped EXE
  PID:2716
- C:\Windows\System\BIFOgNt.exe
  C:\Windows\System\BIFOgNt.exe
  2⤵
  - Executes dropped EXE
  PID:288
- C:\Windows\System\YLAHSCP.exe
  C:\Windows\System\YLAHSCP.exe
  2⤵
  - Executes dropped EXE
  PID:1520
- C:\Windows\System\gOBUQNq.exe
  C:\Windows\System\gOBUQNq.exe
  2⤵
  - Executes dropped EXE
  PID:2300
- C:\Windows\System\KlffrNS.exe
  C:\Windows\System\KlffrNS.exe
  2⤵
  - Executes dropped EXE
  PID:1260
- C:\Windows\System\yDMYiTS.exe
  C:\Windows\System\yDMYiTS.exe
  2⤵
  - Executes dropped EXE
  PID:340
- C:\Windows\System\syKcxix.exe
  C:\Windows\System\syKcxix.exe
  2⤵
  - Executes dropped EXE
  PID:2032
- C:\Windows\System\CVBLokf.exe
  C:\Windows\System\CVBLokf.exe
  2⤵
  - Executes dropped EXE
  PID:1996
- C:\Windows\System\uFyijuz.exe
  C:\Windows\System\uFyijuz.exe
  2⤵
  - Executes dropped EXE
  PID:2804
- C:\Windows\System\YSpAGmQ.exe
  C:\Windows\System\YSpAGmQ.exe
  2⤵
  - Executes dropped EXE
  PID:2868
- C:\Windows\System\lMuDdEe.exe
  C:\Windows\System\lMuDdEe.exe
  2⤵
  - Executes dropped EXE
  PID:2244
- C:\Windows\System\jtqUdTG.exe
  C:\Windows\System\jtqUdTG.exe
  2⤵
  - Executes dropped EXE
  PID:2196
- C:\Windows\System\jjwdgSv.exe
  C:\Windows\System\jjwdgSv.exe
  2⤵
  - Executes dropped EXE
  PID:1944
- C:\Windows\System\qDFpIKE.exe
  C:\Windows\System\qDFpIKE.exe
  2⤵
  - Executes dropped EXE
  PID:608
- C:\Windows\System\pRENKgu.exe
  C:\Windows\System\pRENKgu.exe
  2⤵
  - Executes dropped EXE
  PID:580
- C:\Windows\System\WnMSgEY.exe
  C:\Windows\System\WnMSgEY.exe
  2⤵
  - Executes dropped EXE
  PID:2728
- C:\Windows\System\FRttmEv.exe
  C:\Windows\System\FRttmEv.exe
  2⤵
  - Executes dropped EXE
  PID:656
- C:\Windows\System\OGUcGNs.exe
  C:\Windows\System\OGUcGNs.exe
  2⤵
  - Executes dropped EXE
  PID:2348
- C:\Windows\System\FKXwjjh.exe
  C:\Windows\System\FKXwjjh.exe
  2⤵
  - Executes dropped EXE
  PID:2344
- C:\Windows\System\gCtgPDJ.exe
  C:\Windows\System\gCtgPDJ.exe
  2⤵
  - Executes dropped EXE
  PID:3016
- C:\Windows\System\FkApzDI.exe
  C:\Windows\System\FkApzDI.exe
  2⤵
  - Executes dropped EXE
  PID:1128
- C:\Windows\System\scpewqF.exe
  C:\Windows\System\scpewqF.exe
  2⤵
  - Executes dropped EXE
  PID:2968
- C:\Windows\System\xjKgyNl.exe
  C:\Windows\System\xjKgyNl.exe
  2⤵
  - Executes dropped EXE
  PID:2776
- C:\Windows\System\lDTeThZ.exe
  C:\Windows\System\lDTeThZ.exe
  2⤵
  - Executes dropped EXE
  PID:980
- C:\Windows\System\zQqMpsA.exe
  C:\Windows\System\zQqMpsA.exe
  2⤵
  - Executes dropped EXE
  PID:1472
- C:\Windows\System\DbRniLG.exe
  C:\Windows\System\DbRniLG.exe
  2⤵
  - Executes dropped EXE
  PID:1676
- C:\Windows\System\MPqzYLD.exe
  C:\Windows\System\MPqzYLD.exe
  2⤵
  - Executes dropped EXE
  PID:1544
- C:\Windows\System\UbUrzEf.exe
  C:\Windows\System\UbUrzEf.exe
  2⤵
  - Executes dropped EXE
  PID:916
- C:\Windows\System\XdasCyK.exe
  C:\Windows\System\XdasCyK.exe
  2⤵
  - Executes dropped EXE
  PID:944
- C:\Windows\System\FDfpKVd.exe
  C:\Windows\System\FDfpKVd.exe
  2⤵
  - Executes dropped EXE
  PID:596
- C:\Windows\System\MvETBjy.exe
  C:\Windows\System\MvETBjy.exe
  2⤵
  - Executes dropped EXE
  PID:1716
- C:\Windows\System\yAOEMOk.exe
  C:\Windows\System\yAOEMOk.exe
  2⤵
  - Executes dropped EXE
  PID:1932
- C:\Windows\System\ZUtCAIa.exe
  C:\Windows\System\ZUtCAIa.exe
  2⤵
  - Executes dropped EXE
  PID:804
- C:\Windows\System\HNTJAEq.exe
  C:\Windows\System\HNTJAEq.exe
  2⤵
  - Executes dropped EXE
  PID:2788
- C:\Windows\System\EdSRoPk.exe
  C:\Windows\System\EdSRoPk.exe
  2⤵
  - Executes dropped EXE
  PID:2200
- C:\Windows\System\zmZVAWP.exe
  C:\Windows\System\zmZVAWP.exe
  2⤵
  - Executes dropped EXE
  PID:1704
- C:\Windows\System\XBPDjBZ.exe
  C:\Windows\System\XBPDjBZ.exe
  2⤵
  - Executes dropped EXE
  PID:2292
- C:\Windows\System\SeBEgXP.exe
  C:\Windows\System\SeBEgXP.exe
  2⤵
  - Executes dropped EXE
  PID:1596
- C:\Windows\System\lGCysDO.exe
  C:\Windows\System\lGCysDO.exe
  2⤵
  - Executes dropped EXE
  PID:2072
- C:\Windows\System\McFjgEt.exe
  C:\Windows\System\McFjgEt.exe
  2⤵
  - Executes dropped EXE
  PID:1508
- C:\Windows\System\sixBzEa.exe
  C:\Windows\System\sixBzEa.exe
  2⤵
  - Executes dropped EXE
  PID:1640
- C:\Windows\System\jHzzURE.exe
  C:\Windows\System\jHzzURE.exe
  2⤵
  - Executes dropped EXE
  PID:2144
- C:\Windows\System\tYVojrr.exe
  C:\Windows\System\tYVojrr.exe
  2⤵
  - Executes dropped EXE
  PID:2652
- C:\Windows\System\TWvOqjN.exe
  C:\Windows\System\TWvOqjN.exe
  2⤵
  - Executes dropped EXE
  PID:1040
- C:\Windows\System\TMZCdcz.exe
  C:\Windows\System\TMZCdcz.exe
  2⤵
  - Executes dropped EXE
  PID:3020
- C:\Windows\System\iPXlvNg.exe
  C:\Windows\System\iPXlvNg.exe
  2⤵
  - Executes dropped EXE
  PID:2644
- C:\Windows\System\hKsllet.exe
  C:\Windows\System\hKsllet.exe
  2⤵
  - Executes dropped EXE
  PID:2680
- C:\Windows\System\IemvvnP.exe
  C:\Windows\System\IemvvnP.exe
  2⤵
  - Executes dropped EXE
  PID:2400
- C:\Windows\System\guKKbjK.exe
  C:\Windows\System\guKKbjK.exe
  2⤵
  - Executes dropped EXE
  PID:2428
- C:\Windows\System\eMZmOxv.exe
  C:\Windows\System\eMZmOxv.exe
  2⤵
  - Executes dropped EXE
  PID:2556
- C:\Windows\System\iNGYhJu.exe
  C:\Windows\System\iNGYhJu.exe
  2⤵
  - Executes dropped EXE
  PID:2964
- C:\Windows\System\bSWXvMC.exe
  C:\Windows\System\bSWXvMC.exe
  2⤵
  PID:2616
- C:\Windows\System\SrrMoXl.exe
  C:\Windows\System\SrrMoXl.exe
  2⤵
  - Executes dropped EXE
  PID:1636
- C:\Windows\System\ouRXHOs.exe
  C:\Windows\System\ouRXHOs.exe
  2⤵
  PID:2708
- C:\Windows\System\FKCTOUm.exe
  C:\Windows\System\FKCTOUm.exe
  2⤵
  PID:2700
- C:\Windows\System\QbpUmyV.exe
  C:\Windows\System\QbpUmyV.exe
  2⤵
  PID:2472
- C:\Windows\System\ZHDWuvs.exe
  C:\Windows\System\ZHDWuvs.exe
  2⤵
  PID:2024
- C:\Windows\System\SfPlpud.exe
  C:\Windows\System\SfPlpud.exe
  2⤵
  PID:2128
- C:\Windows\System\VCnbNWl.exe
  C:\Windows\System\VCnbNWl.exe
  2⤵
  PID:2152
- C:\Windows\System\TNhAfKi.exe
  C:\Windows\System\TNhAfKi.exe
  2⤵
  PID:3060
- C:\Windows\System\EVYAeIm.exe
  C:\Windows\System\EVYAeIm.exe
  2⤵
  PID:1632
- C:\Windows\System\EeuiJZp.exe
  C:\Windows\System\EeuiJZp.exe
  2⤵
  PID:1400
- C:\Windows\System\gKHiizP.exe
  C:\Windows\System\gKHiizP.exe
  2⤵
  PID:396
- C:\Windows\System\fnDmwWy.exe
  C:\Windows\System\fnDmwWy.exe
  2⤵
  PID:3040
- C:\Windows\System\QYIQWji.exe
  C:\Windows\System\QYIQWji.exe
  2⤵
  PID:2332
- C:\Windows\System\GkhcRRE.exe
  C:\Windows\System\GkhcRRE.exe
  2⤵
  PID:1156
- C:\Windows\System\eOyhADa.exe
  C:\Windows\System\eOyhADa.exe
  2⤵
  PID:1868
- C:\Windows\System\LASgSKb.exe
  C:\Windows\System\LASgSKb.exe
  2⤵
  PID:2952
- C:\Windows\System\EcOutVJ.exe
  C:\Windows\System\EcOutVJ.exe
  2⤵
  PID:1560
- C:\Windows\System\jIwuhnA.exe
  C:\Windows\System\jIwuhnA.exe
  2⤵
  PID:2208
- C:\Windows\System\PLjAAPn.exe
  C:\Windows\System\PLjAAPn.exe
  2⤵
  PID:852
- C:\Windows\System\QtMCqGV.exe
  C:\Windows\System\QtMCqGV.exe
  2⤵
  PID:1320
- C:\Windows\System\bLkKCVs.exe
  C:\Windows\System\bLkKCVs.exe
  2⤵
  PID:1648
- C:\Windows\System\OXRdTED.exe
  C:\Windows\System\OXRdTED.exe
  2⤵
  PID:2356
- C:\Windows\System\bNuuAcl.exe
  C:\Windows\System\bNuuAcl.exe
  2⤵
  PID:960
- C:\Windows\System\XMAAFFr.exe
  C:\Windows\System\XMAAFFr.exe
  2⤵
  PID:2172
- C:\Windows\System\nZyNpKl.exe
  C:\Windows\System\nZyNpKl.exe
  2⤵
  PID:1884
- C:\Windows\System\RDkxwGM.exe
  C:\Windows\System\RDkxwGM.exe
  2⤵
  PID:2512
- C:\Windows\System\ZJNjnAw.exe
  C:\Windows\System\ZJNjnAw.exe
  2⤵
  PID:2384
- C:\Windows\System\DutdWxn.exe
  C:\Windows\System\DutdWxn.exe
  2⤵
  PID:2380
- C:\Windows\System\UTNhIOV.exe
  C:\Windows\System\UTNhIOV.exe
  2⤵
  PID:2820
- C:\Windows\System\StbQBFp.exe
  C:\Windows\System\StbQBFp.exe
  2⤵
  PID:2860
- C:\Windows\System\IWDoKir.exe
  C:\Windows\System\IWDoKir.exe
  2⤵
  PID:860
- C:\Windows\System\PyukHuY.exe
  C:\Windows\System\PyukHuY.exe
  2⤵
  PID:2460
- C:\Windows\System\nnTocgh.exe
  C:\Windows\System\nnTocgh.exe
  2⤵
  PID:2748
- C:\Windows\System\TmIIAEI.exe
  C:\Windows\System\TmIIAEI.exe
  2⤵
  PID:2392
- C:\Windows\System\BCbKFti.exe
  C:\Windows\System\BCbKFti.exe
  2⤵
  PID:2416
- C:\Windows\System\wNBzdpc.exe
  C:\Windows\System\wNBzdpc.exe
  2⤵
  PID:1516
- C:\Windows\System\eyeTEex.exe
  C:\Windows\System\eyeTEex.exe
  2⤵
  PID:2444
- C:\Windows\System\CMarGhM.exe
  C:\Windows\System\CMarGhM.exe
  2⤵
  PID:1880
- C:\Windows\System\LhoOjNq.exe
  C:\Windows\System\LhoOjNq.exe
  2⤵
  PID:2888
- C:\Windows\System\DPMjQbV.exe
  C:\Windows\System\DPMjQbV.exe
  2⤵
  PID:1940
- C:\Windows\System\MEVUSMb.exe
  C:\Windows\System\MEVUSMb.exe
  2⤵
  PID:1740
- C:\Windows\System\EkKRTPn.exe
  C:\Windows\System\EkKRTPn.exe
  2⤵
  PID:1864
- C:\Windows\System\btxqctO.exe
  C:\Windows\System\btxqctO.exe
  2⤵
  PID:1068
- C:\Windows\System\QXsjBDW.exe
  C:\Windows\System\QXsjBDW.exe
  2⤵
  PID:1304
- C:\Windows\System\zqbGCHo.exe
  C:\Windows\System\zqbGCHo.exe
  2⤵
  PID:800
- C:\Windows\System\bochDVC.exe
  C:\Windows\System\bochDVC.exe
  2⤵
  PID:1244
- C:\Windows\System\fVhzhGl.exe
  C:\Windows\System\fVhzhGl.exe
  2⤵
  PID:1852
- C:\Windows\System\YFMcfhX.exe
  C:\Windows\System\YFMcfhX.exe
  2⤵
  PID:1948
- C:\Windows\System\waUnsBv.exe
  C:\Windows\System\waUnsBv.exe
  2⤵
  PID:1232
- C:\Windows\System\leFrPHd.exe
  C:\Windows\System\leFrPHd.exe
  2⤵
  PID:2468
- C:\Windows\System\jLeYMsY.exe
  C:\Windows\System\jLeYMsY.exe
  2⤵
  PID:2592
- C:\Windows\System\EGbXIIv.exe
  C:\Windows\System\EGbXIIv.exe
  2⤵
  PID:2508
- C:\Windows\System\XhcREol.exe
  C:\Windows\System\XhcREol.exe
  2⤵
  PID:2268
- C:\Windows\System\sOuUEqv.exe
  C:\Windows\System\sOuUEqv.exe
  2⤵
  PID:888
- C:\Windows\System\PhJJzUw.exe
  C:\Windows\System\PhJJzUw.exe
  2⤵
  PID:868
- C:\Windows\System\LYAruwn.exe
  C:\Windows\System\LYAruwn.exe
  2⤵
  PID:1556
- C:\Windows\System\nOXYfEy.exe
  C:\Windows\System\nOXYfEy.exe
  2⤵
  PID:864
- C:\Windows\System\OAcJpPS.exe
  C:\Windows\System\OAcJpPS.exe
  2⤵
  PID:2044
- C:\Windows\System\qivjkwx.exe
  C:\Windows\System\qivjkwx.exe
  2⤵
  PID:604
- C:\Windows\System\BcLxKoH.exe
  C:\Windows\System\BcLxKoH.exe
  2⤵
  PID:2892
- C:\Windows\System\KvRnURg.exe
  C:\Windows\System\KvRnURg.exe
  2⤵
  PID:2212
- C:\Windows\System\dCFsqpK.exe
  C:\Windows\System\dCFsqpK.exe
  2⤵
  PID:2760
- C:\Windows\System\nXAAyYw.exe
  C:\Windows\System\nXAAyYw.exe
  2⤵
  PID:1480
- C:\Windows\System\baUOAhE.exe
  C:\Windows\System\baUOAhE.exe
  2⤵
  PID:576
- C:\Windows\System\SQkzHSl.exe
  C:\Windows\System\SQkzHSl.exe
  2⤵
  PID:3048
- C:\Windows\System\JaHRXAv.exe
  C:\Windows\System\JaHRXAv.exe
  2⤵
  PID:1900
- C:\Windows\System\EgfONco.exe
  C:\Windows\System\EgfONco.exe
  2⤵
  PID:2536
- C:\Windows\System\CjVNHps.exe
  C:\Windows\System\CjVNHps.exe
  2⤵
  PID:2028
- C:\Windows\System\xNgkrTD.exe
  C:\Windows\System\xNgkrTD.exe
  2⤵
  PID:2780
- C:\Windows\System\fGuVzyK.exe
  C:\Windows\System\fGuVzyK.exe
  2⤵
  PID:1540
- C:\Windows\System\EQdQNZG.exe
  C:\Windows\System\EQdQNZG.exe
  2⤵
  PID:2828
- C:\Windows\System\hnVxMQR.exe
  C:\Windows\System\hnVxMQR.exe
  2⤵
  PID:2568
- C:\Windows\System\NsEeviZ.exe
  C:\Windows\System\NsEeviZ.exe
  2⤵
  PID:3000
- C:\Windows\System\UMHqcsO.exe
  C:\Windows\System\UMHqcsO.exe
  2⤵
  PID:2864
- C:\Windows\System\okOFjHW.exe
  C:\Windows\System\okOFjHW.exe
  2⤵
  PID:652
- C:\Windows\System\tqJbShW.exe
  C:\Windows\System\tqJbShW.exe
  2⤵
  PID:760
- C:\Windows\System\pRqYguB.exe
  C:\Windows\System\pRqYguB.exe
  2⤵
  PID:3036
- C:\Windows\System\bPCDlzC.exe
  C:\Windows\System\bPCDlzC.exe
  2⤵
  PID:2020
- C:\Windows\System\bkUwQxD.exe
  C:\Windows\System\bkUwQxD.exe
  2⤵
  PID:1500
- C:\Windows\System\dQSWsOd.exe
  C:\Windows\System\dQSWsOd.exe
  2⤵
  PID:1904
- C:\Windows\System\DPBGFEK.exe
  C:\Windows\System\DPBGFEK.exe
  2⤵
  PID:2228
- C:\Windows\System\ZXDugXz.exe
  C:\Windows\System\ZXDugXz.exe
  2⤵
  PID:2036
- C:\Windows\System\kSHrjIu.exe
  C:\Windows\System\kSHrjIu.exe
  2⤵
  PID:1720
- C:\Windows\System\mVRWVdC.exe
  C:\Windows\System\mVRWVdC.exe
  2⤵
  PID:2456
- C:\Windows\System\jHhmsjG.exe
  C:\Windows\System\jHhmsjG.exe
  2⤵
  PID:2784
- C:\Windows\System\dkrGzrs.exe
  C:\Windows\System\dkrGzrs.exe
  2⤵
  PID:1576
- C:\Windows\System\YrTuOqw.exe
  C:\Windows\System\YrTuOqw.exe
  2⤵
  PID:2620
- C:\Windows\System\GNlfFSF.exe
  C:\Windows\System\GNlfFSF.exe
  2⤵
  PID:2704
- C:\Windows\System\vDhGkna.exe
  C:\Windows\System\vDhGkna.exe
  2⤵
  PID:3084
- C:\Windows\System\SFjwfte.exe
  C:\Windows\System\SFjwfte.exe
  2⤵
  PID:3100
- C:\Windows\System\fSWYAjz.exe
  C:\Windows\System\fSWYAjz.exe
  2⤵
  PID:3116
- C:\Windows\System\QcrNqiJ.exe
  C:\Windows\System\QcrNqiJ.exe
  2⤵
  PID:3132
- C:\Windows\System\FCXLpkL.exe
  C:\Windows\System\FCXLpkL.exe
  2⤵
  PID:3148
- C:\Windows\System\JvTkqqd.exe
  C:\Windows\System\JvTkqqd.exe
  2⤵
  PID:3164
- C:\Windows\System\AmLEuLh.exe
  C:\Windows\System\AmLEuLh.exe
  2⤵
  PID:3180
- C:\Windows\System\VjKHPoN.exe
  C:\Windows\System\VjKHPoN.exe
  2⤵
  PID:3196
- C:\Windows\System\imHzurO.exe
  C:\Windows\System\imHzurO.exe
  2⤵
  PID:3212
- C:\Windows\System\EdyHwZN.exe
  C:\Windows\System\EdyHwZN.exe
  2⤵
  PID:3228
- C:\Windows\System\vkgjbds.exe
  C:\Windows\System\vkgjbds.exe
  2⤵
  PID:3244
- C:\Windows\System\wynQZbH.exe
  C:\Windows\System\wynQZbH.exe
  2⤵
  PID:3264
- C:\Windows\System\XBNtzEX.exe
  C:\Windows\System\XBNtzEX.exe
  2⤵
  PID:3284
- C:\Windows\System\lhbAMNw.exe
  C:\Windows\System\lhbAMNw.exe
  2⤵
  PID:3300
- C:\Windows\System\ZTqmQwp.exe
  C:\Windows\System\ZTqmQwp.exe
  2⤵
  PID:3324
- C:\Windows\System\EAsFFiR.exe
  C:\Windows\System\EAsFFiR.exe
  2⤵
  PID:3372
- C:\Windows\System\NeqRhuI.exe
  C:\Windows\System\NeqRhuI.exe
  2⤵
  PID:3448
- C:\Windows\System\pnMJpkD.exe
  C:\Windows\System\pnMJpkD.exe
  2⤵
  PID:3472
- C:\Windows\System\kLeQXCP.exe
  C:\Windows\System\kLeQXCP.exe
  2⤵
  PID:3488
- C:\Windows\System\elzTpnU.exe
  C:\Windows\System\elzTpnU.exe
  2⤵
  PID:3504
- C:\Windows\System\WKZAVGI.exe
  C:\Windows\System\WKZAVGI.exe
  2⤵
  PID:3524
- C:\Windows\System\EQRiwPG.exe
  C:\Windows\System\EQRiwPG.exe
  2⤵
  PID:3540
- C:\Windows\System\bpvHsUW.exe
  C:\Windows\System\bpvHsUW.exe
  2⤵
  PID:3560
- C:\Windows\System\POxVrrn.exe
  C:\Windows\System\POxVrrn.exe
  2⤵
  PID:3580
- C:\Windows\System\YHygYeM.exe
  C:\Windows\System\YHygYeM.exe
  2⤵
  PID:3600
- C:\Windows\System\iPUkGnV.exe
  C:\Windows\System\iPUkGnV.exe
  2⤵
  PID:3616
- C:\Windows\System\bsZZrUI.exe
  C:\Windows\System\bsZZrUI.exe
  2⤵
  PID:3632
- C:\Windows\System\UXaMPuM.exe
  C:\Windows\System\UXaMPuM.exe
  2⤵
  PID:3648
- C:\Windows\System\UCngIQO.exe
  C:\Windows\System\UCngIQO.exe
  2⤵
  PID:3668
- C:\Windows\System\tJGKXAE.exe
  C:\Windows\System\tJGKXAE.exe
  2⤵
  PID:3688
- C:\Windows\System\QOHLebN.exe
  C:\Windows\System\QOHLebN.exe
  2⤵
  PID:3704
- C:\Windows\System\BMtXqiy.exe
  C:\Windows\System\BMtXqiy.exe
  2⤵
  PID:3720
- C:\Windows\System\vMHDbKQ.exe
  C:\Windows\System\vMHDbKQ.exe
  2⤵
  PID:3736
- C:\Windows\System\JCcviMO.exe
  C:\Windows\System\JCcviMO.exe
  2⤵
  PID:3756
- C:\Windows\System\IEtIXdX.exe
  C:\Windows\System\IEtIXdX.exe
  2⤵
  PID:3772
- C:\Windows\System\SVlrHHv.exe
  C:\Windows\System\SVlrHHv.exe
  2⤵
  PID:3788
- C:\Windows\System\GNkuOHr.exe
  C:\Windows\System\GNkuOHr.exe
  2⤵
  PID:3804
- C:\Windows\System\NsWrxLf.exe
  C:\Windows\System\NsWrxLf.exe
  2⤵
  PID:3820
- C:\Windows\System\hhgYaTO.exe
  C:\Windows\System\hhgYaTO.exe
  2⤵
  PID:3888
- C:\Windows\System\VYSkadX.exe
  C:\Windows\System\VYSkadX.exe
  2⤵
  PID:3908
- C:\Windows\System\LRKHxUd.exe
  C:\Windows\System\LRKHxUd.exe
  2⤵
  PID:3928
- C:\Windows\System\VVZKnYc.exe
  C:\Windows\System\VVZKnYc.exe
  2⤵
  PID:3944
- C:\Windows\System\RhwpTrL.exe
  C:\Windows\System\RhwpTrL.exe
  2⤵
  PID:3972
- C:\Windows\System\cCjfWiR.exe
  C:\Windows\System\cCjfWiR.exe
  2⤵
  PID:3992
- C:\Windows\System\vuNqgLY.exe
  C:\Windows\System\vuNqgLY.exe
  2⤵
  PID:4008
- C:\Windows\System\IBuyYVm.exe
  C:\Windows\System\IBuyYVm.exe
  2⤵
  PID:4032
- C:\Windows\System\vKnmTRa.exe
  C:\Windows\System\vKnmTRa.exe
  2⤵
  PID:4048
- C:\Windows\System\lUFEVra.exe
  C:\Windows\System\lUFEVra.exe
  2⤵
  PID:4072
- C:\Windows\System\DSuRHJf.exe
  C:\Windows\System\DSuRHJf.exe
  2⤵
  PID:4092
- C:\Windows\System\CQKtwrc.exe
  C:\Windows\System\CQKtwrc.exe
  2⤵
  PID:1564
- C:\Windows\System\LbYiYSG.exe
  C:\Windows\System\LbYiYSG.exe
  2⤵
  PID:2364
- C:\Windows\System\TVVSuZJ.exe
  C:\Windows\System\TVVSuZJ.exe
  2⤵
  PID:3124
- C:\Windows\System\HIzkbsW.exe
  C:\Windows\System\HIzkbsW.exe
  2⤵
  PID:1000
- C:\Windows\System\PGgWnST.exe
  C:\Windows\System\PGgWnST.exe
  2⤵
  PID:3220
- C:\Windows\System\ldIPaxL.exe
  C:\Windows\System\ldIPaxL.exe
  2⤵
  PID:3260
- C:\Windows\System\BaJuxuV.exe
  C:\Windows\System\BaJuxuV.exe
  2⤵
  PID:1748
- C:\Windows\System\RuWrDUz.exe
  C:\Windows\System\RuWrDUz.exe
  2⤵
  PID:1936
- C:\Windows\System\VXeJcrj.exe
  C:\Windows\System\VXeJcrj.exe
  2⤵
  PID:3340
- C:\Windows\System\IqapjoC.exe
  C:\Windows\System\IqapjoC.exe
  2⤵
  PID:3368
- C:\Windows\System\IIOLSWf.exe
  C:\Windows\System\IIOLSWf.exe
  2⤵
  PID:2920
- C:\Windows\System\JMxzfFt.exe
  C:\Windows\System\JMxzfFt.exe
  2⤵
  PID:292
- C:\Windows\System\kFpUMMp.exe
  C:\Windows\System\kFpUMMp.exe
  2⤵
  PID:2756
- C:\Windows\System\iTJiqeq.exe
  C:\Windows\System\iTJiqeq.exe
  2⤵
  PID:380
- C:\Windows\System\XjtkJsh.exe
  C:\Windows\System\XjtkJsh.exe
  2⤵
  PID:2628
- C:\Windows\System\QMOvdOt.exe
  C:\Windows\System\QMOvdOt.exe
  2⤵
  PID:3236
- C:\Windows\System\yQUleUg.exe
  C:\Windows\System\yQUleUg.exe
  2⤵
  PID:3312
- C:\Windows\System\PVFgFKf.exe
  C:\Windows\System\PVFgFKf.exe
  2⤵
  PID:3460
- C:\Windows\System\mlSCsaS.exe
  C:\Windows\System\mlSCsaS.exe
  2⤵
  PID:3444
- C:\Windows\System\gfRQPOn.exe
  C:\Windows\System\gfRQPOn.exe
  2⤵
  PID:3108
- C:\Windows\System\lRZOKdc.exe
  C:\Windows\System\lRZOKdc.exe
  2⤵
  PID:1712
- C:\Windows\System\rxNQdBy.exe
  C:\Windows\System\rxNQdBy.exe
  2⤵
  PID:3404
- C:\Windows\System\gGEcCyi.exe
  C:\Windows\System\gGEcCyi.exe
  2⤵
  PID:3424
- C:\Windows\System\ZwPvPLV.exe
  C:\Windows\System\ZwPvPLV.exe
  2⤵
  PID:3512
- C:\Windows\System\iqPKkKW.exe
  C:\Windows\System\iqPKkKW.exe
  2⤵
  PID:3612
- C:\Windows\System\HnLrpUg.exe
  C:\Windows\System\HnLrpUg.exe
  2⤵
  PID:3680
- C:\Windows\System\UHrqPiU.exe
  C:\Windows\System\UHrqPiU.exe
  2⤵
  PID:3548
- C:\Windows\System\OmnSeaC.exe
  C:\Windows\System\OmnSeaC.exe
  2⤵
  PID:3748
- C:\Windows\System\UNaJouM.exe
  C:\Windows\System\UNaJouM.exe
  2⤵
  PID:3664
- C:\Windows\System\kpNaMZO.exe
  C:\Windows\System\kpNaMZO.exe
  2⤵
  PID:3784
- C:\Windows\System\orvymEC.exe
  C:\Windows\System\orvymEC.exe
  2⤵
  PID:1552
- C:\Windows\System\yIQupyr.exe
  C:\Windows\System\yIQupyr.exe
  2⤵
  PID:3864
- C:\Windows\System\YMtjGZQ.exe
  C:\Windows\System\YMtjGZQ.exe
  2⤵
  PID:3764
- C:\Windows\System\wUdEWyB.exe
  C:\Windows\System\wUdEWyB.exe
  2⤵
  PID:3844
- C:\Windows\System\IUDYGLB.exe
  C:\Windows\System\IUDYGLB.exe
  2⤵
  PID:3896
- C:\Windows\System\YzZcroS.exe
  C:\Windows\System\YzZcroS.exe
  2⤵
  PID:3832
- C:\Windows\System\pfgHrgx.exe
  C:\Windows\System\pfgHrgx.exe
  2⤵
  PID:3884
- C:\Windows\System\GwFehaG.exe
  C:\Windows\System\GwFehaG.exe
  2⤵
  PID:3936
- C:\Windows\System\kECxLZt.exe
  C:\Windows\System\kECxLZt.exe
  2⤵
  PID:3940
- C:\Windows\System\hfNZdlY.exe
  C:\Windows\System\hfNZdlY.exe
  2⤵
  PID:3960
- C:\Windows\System\aauQFPR.exe
  C:\Windows\System\aauQFPR.exe
  2⤵
  PID:3988
- C:\Windows\System\iwkkXso.exe
  C:\Windows\System\iwkkXso.exe
  2⤵
  PID:4024
- C:\Windows\System\gYulzyk.exe
  C:\Windows\System\gYulzyk.exe
  2⤵
  PID:4044
- C:\Windows\System\qchBZkL.exe
  C:\Windows\System\qchBZkL.exe
  2⤵
  PID:4060
- C:\Windows\System\uzDwPww.exe
  C:\Windows\System\uzDwPww.exe
  2⤵
  PID:2008
- C:\Windows\System\CDBKyvk.exe
  C:\Windows\System\CDBKyvk.exe
  2⤵
  PID:1468
- C:\Windows\System\xJsmCzq.exe
  C:\Windows\System\xJsmCzq.exe
  2⤵
  PID:3096
- C:\Windows\System\cRgORux.exe
  C:\Windows\System\cRgORux.exe
  2⤵
  PID:3188
- C:\Windows\System\pSPEkVf.exe
  C:\Windows\System\pSPEkVf.exe
  2⤵
  PID:3256
- C:\Windows\System\NYujONt.exe
  C:\Windows\System\NYujONt.exe
  2⤵
  PID:3336
- C:\Windows\System\DbdWqHa.exe
  C:\Windows\System\DbdWqHa.exe
  2⤵
  PID:3364
- C:\Windows\System\sltxgto.exe
  C:\Windows\System\sltxgto.exe
  2⤵
  PID:2076
- C:\Windows\System\ViMLOLM.exe
  C:\Windows\System\ViMLOLM.exe
  2⤵
  PID:3384
- C:\Windows\System\PikdcdK.exe
  C:\Windows\System\PikdcdK.exe
  2⤵
  PID:1928
- C:\Windows\System\msOIQRn.exe
  C:\Windows\System\msOIQRn.exe
  2⤵
  PID:1512
- C:\Windows\System\LNCzdns.exe
  C:\Windows\System\LNCzdns.exe
  2⤵
  PID:3272
- C:\Windows\System\XkFmHJW.exe
  C:\Windows\System\XkFmHJW.exe
  2⤵
  PID:3204
- C:\Windows\System\QCrdeiz.exe
  C:\Windows\System\QCrdeiz.exe
  2⤵
  PID:3320
- C:\Windows\System\iRNFPMa.exe
  C:\Windows\System\iRNFPMa.exe
  2⤵
  PID:3464
- C:\Windows\System\MDURVyC.exe
  C:\Windows\System\MDURVyC.exe
  2⤵
  PID:3112
- C:\Windows\System\hHTkAFV.exe
  C:\Windows\System\hHTkAFV.exe
  2⤵
  PID:1964
- C:\Windows\System\CkfNnKJ.exe
  C:\Windows\System\CkfNnKJ.exe
  2⤵
  PID:3392
- C:\Windows\System\chjCKpb.exe
  C:\Windows\System\chjCKpb.exe
  2⤵
  PID:1592
- C:\Windows\System\IAwlZiM.exe
  C:\Windows\System\IAwlZiM.exe
  2⤵
  PID:3608
- C:\Windows\System\KGBSjqr.exe
  C:\Windows\System\KGBSjqr.exe
  2⤵
  PID:3712
- C:\Windows\System\PkRuBga.exe
  C:\Windows\System\PkRuBga.exe
  2⤵
  PID:3484
- C:\Windows\System\uDulZCs.exe
  C:\Windows\System\uDulZCs.exe
  2⤵
  PID:3596
- C:\Windows\System\MYveuPU.exe
  C:\Windows\System\MYveuPU.exe
  2⤵
  PID:3800
- C:\Windows\System\QtHKArs.exe
  C:\Windows\System\QtHKArs.exe
  2⤵
  PID:3860
- C:\Windows\System\LWlkiDS.exe
  C:\Windows\System\LWlkiDS.exe
  2⤵
  PID:3728
- C:\Windows\System\bdLhzeV.exe
  C:\Windows\System\bdLhzeV.exe
  2⤵
  PID:3768
- C:\Windows\System\oojAoBn.exe
  C:\Windows\System\oojAoBn.exe
  2⤵
  PID:3916
- C:\Windows\System\ExfGXTc.exe
  C:\Windows\System\ExfGXTc.exe
  2⤵
  PID:3920
- C:\Windows\System\JcUZqQH.exe
  C:\Windows\System\JcUZqQH.exe
  2⤵
  PID:4016
- C:\Windows\System\rLNMKxG.exe
  C:\Windows\System\rLNMKxG.exe
  2⤵
  PID:2844
- C:\Windows\System\QTNsWuR.exe
  C:\Windows\System\QTNsWuR.exe
  2⤵
  PID:1444
- C:\Windows\System\IoxXAvV.exe
  C:\Windows\System\IoxXAvV.exe
  2⤵
  PID:1420
- C:\Windows\System\kcYPDLX.exe
  C:\Windows\System\kcYPDLX.exe
  2⤵
  PID:3144
- C:\Windows\System\aUskFQC.exe
  C:\Windows\System\aUskFQC.exe
  2⤵
  PID:3980
- C:\Windows\System\sVzIwuM.exe
  C:\Windows\System\sVzIwuM.exe
  2⤵
  PID:240
- C:\Windows\System\rpRZKDY.exe
  C:\Windows\System\rpRZKDY.exe
  2⤵
  PID:3356
- C:\Windows\System\QiorjsA.exe
  C:\Windows\System\QiorjsA.exe
  2⤵
  PID:1316
- C:\Windows\System\PGSjorK.exe
  C:\Windows\System\PGSjorK.exe
  2⤵
  PID:3496
- C:\Windows\System\amGIpvw.exe
  C:\Windows\System\amGIpvw.exe
  2⤵
  PID:3432
- C:\Windows\System\VfzIkhG.exe
  C:\Windows\System\VfzIkhG.exe
  2⤵
  PID:3676
- C:\Windows\System\XwEmSRS.exe
  C:\Windows\System\XwEmSRS.exe
  2⤵
  PID:784
- C:\Windows\System\qCyoWQh.exe
  C:\Windows\System\qCyoWQh.exe
  2⤵
  PID:3716
- C:\Windows\System\jjtjalI.exe
  C:\Windows\System\jjtjalI.exe
  2⤵
  PID:3872
- C:\Windows\System\AYfnhmQ.exe
  C:\Windows\System\AYfnhmQ.exe
  2⤵
  PID:3852
- C:\Windows\System\BvuUwio.exe
  C:\Windows\System\BvuUwio.exe
  2⤵
  PID:3964
- C:\Windows\System\FwwYvnI.exe
  C:\Windows\System\FwwYvnI.exe
  2⤵
  PID:3500
- C:\Windows\System\YJEdxQv.exe
  C:\Windows\System\YJEdxQv.exe
  2⤵
  PID:3360
- C:\Windows\System\XpibWdD.exe
  C:\Windows\System\XpibWdD.exe
  2⤵
  PID:2164
- C:\Windows\System\TqObBIL.exe
  C:\Windows\System\TqObBIL.exe
  2⤵
  PID:3732
- C:\Windows\System\aLVBrCQ.exe
  C:\Windows\System\aLVBrCQ.exe
  2⤵
  PID:3308
- C:\Windows\System\QeuQUUu.exe
  C:\Windows\System\QeuQUUu.exe
  2⤵
  PID:4100
- C:\Windows\System\FuiToem.exe
  C:\Windows\System\FuiToem.exe
  2⤵
  PID:4116
- C:\Windows\System\xSIjiDB.exe
  C:\Windows\System\xSIjiDB.exe
  2⤵
  PID:4132
- C:\Windows\System\bSBtOCZ.exe
  C:\Windows\System\bSBtOCZ.exe
  2⤵
  PID:4148
- C:\Windows\System\cyxrGjE.exe
  C:\Windows\System\cyxrGjE.exe
  2⤵
  PID:4164
- C:\Windows\System\qNEFYBf.exe
  C:\Windows\System\qNEFYBf.exe
  2⤵
  PID:4180
- C:\Windows\System\qvsrZzd.exe
  C:\Windows\System\qvsrZzd.exe
  2⤵
  PID:4196
- C:\Windows\System\DQVQjSg.exe
  C:\Windows\System\DQVQjSg.exe
  2⤵
  PID:4212
- C:\Windows\System\urZSUhL.exe
  C:\Windows\System\urZSUhL.exe
  2⤵
  PID:4228
- C:\Windows\System\zjuXlav.exe
  C:\Windows\System\zjuXlav.exe
  2⤵
  PID:4244
- C:\Windows\System\CBSpqbm.exe
  C:\Windows\System\CBSpqbm.exe
  2⤵
  PID:4260
- C:\Windows\System\QJjSqkP.exe
  C:\Windows\System\QJjSqkP.exe
  2⤵
  PID:4276
- C:\Windows\System\vIRVyjW.exe
  C:\Windows\System\vIRVyjW.exe
  2⤵
  PID:4296
- C:\Windows\System\IVtnSNM.exe
  C:\Windows\System\IVtnSNM.exe
  2⤵
  PID:4312
- C:\Windows\System\YbdNFxj.exe
  C:\Windows\System\YbdNFxj.exe
  2⤵
  PID:4328
- C:\Windows\System\borLKcQ.exe
  C:\Windows\System\borLKcQ.exe
  2⤵
  PID:4344
- C:\Windows\System\oyGOuni.exe
  C:\Windows\System\oyGOuni.exe
  2⤵
  PID:4360
- C:\Windows\System\oYJjtmp.exe
  C:\Windows\System\oYJjtmp.exe
  2⤵
  PID:4376
- C:\Windows\System\YmbMGCd.exe
  C:\Windows\System\YmbMGCd.exe
  2⤵
  PID:4392
- C:\Windows\System\dwmdDZj.exe
  C:\Windows\System\dwmdDZj.exe
  2⤵
  PID:4408
- C:\Windows\System\luxJdKd.exe
  C:\Windows\System\luxJdKd.exe
  2⤵
  PID:4424
- C:\Windows\System\Rsfvoww.exe
  C:\Windows\System\Rsfvoww.exe
  2⤵
  PID:4440
- C:\Windows\System\NDCCEPa.exe
  C:\Windows\System\NDCCEPa.exe
  2⤵
  PID:4456
- C:\Windows\System\RtxTasc.exe
  C:\Windows\System\RtxTasc.exe
  2⤵
  PID:4576
- C:\Windows\System\YduITwf.exe
  C:\Windows\System\YduITwf.exe
  2⤵
  PID:4768
- C:\Windows\System\XFJYQFZ.exe
  C:\Windows\System\XFJYQFZ.exe
  2⤵
  PID:4792
- C:\Windows\System\BqJQwpk.exe
  C:\Windows\System\BqJQwpk.exe
  2⤵
  PID:4820
- C:\Windows\System\YQVgmgm.exe
  C:\Windows\System\YQVgmgm.exe
  2⤵
  PID:4840
- C:\Windows\System\yaXIaaN.exe
  C:\Windows\System\yaXIaaN.exe
  2⤵
  PID:4864
- C:\Windows\System\LkCyNrM.exe
  C:\Windows\System\LkCyNrM.exe
  2⤵
  PID:4908
- C:\Windows\System\BJgVVKE.exe
  C:\Windows\System\BJgVVKE.exe
  2⤵
  PID:4924
- C:\Windows\System\dNpLjWm.exe
  C:\Windows\System\dNpLjWm.exe
  2⤵
  PID:4940
- C:\Windows\System\uyPJpht.exe
  C:\Windows\System\uyPJpht.exe
  2⤵
  PID:4956
- C:\Windows\System\wBfizNU.exe
  C:\Windows\System\wBfizNU.exe
  2⤵
  PID:4972
- C:\Windows\System\ujJkTuU.exe
  C:\Windows\System\ujJkTuU.exe
  2⤵
  PID:4992
- C:\Windows\System\UNQoGOd.exe
  C:\Windows\System\UNQoGOd.exe
  2⤵
  PID:5008
- C:\Windows\System\zGWiRAm.exe
  C:\Windows\System\zGWiRAm.exe
  2⤵
  PID:5032
- C:\Windows\System\NvzqKGr.exe
  C:\Windows\System\NvzqKGr.exe
  2⤵
  PID:5052
- C:\Windows\System\QLjExKZ.exe
  C:\Windows\System\QLjExKZ.exe
  2⤵
  PID:5076
- C:\Windows\System\gGIrxJu.exe
  C:\Windows\System\gGIrxJu.exe
  2⤵
  PID:5096
- C:\Windows\System\HKKyOge.exe
  C:\Windows\System\HKKyOge.exe
  2⤵
  PID:5116
- C:\Windows\System\MJceDen.exe
  C:\Windows\System\MJceDen.exe
  2⤵
  PID:4156
- C:\Windows\System\xkZcGzh.exe
  C:\Windows\System\xkZcGzh.exe
  2⤵
  PID:4220
- C:\Windows\System\NaFOUNd.exe
  C:\Windows\System\NaFOUNd.exe
  2⤵
  PID:3880
- C:\Windows\System\ykDbSDq.exe
  C:\Windows\System\ykDbSDq.exe
  2⤵
  PID:3332
- C:\Windows\System\DodaCXt.exe
  C:\Windows\System\DodaCXt.exe
  2⤵
  PID:4356
- C:\Windows\System\HosFPWb.exe
  C:\Windows\System\HosFPWb.exe
  2⤵
  PID:2136
- C:\Windows\System\otWCtdc.exe
  C:\Windows\System\otWCtdc.exe
  2⤵
  PID:3752
- C:\Windows\System\NKGfmYC.exe
  C:\Windows\System\NKGfmYC.exe
  2⤵
  PID:484
- C:\Windows\System\HkgEupU.exe
  C:\Windows\System\HkgEupU.exe
  2⤵
  PID:3352
- C:\Windows\System\RYmwgCa.exe
  C:\Windows\System\RYmwgCa.exe
  2⤵
  PID:3456
- C:\Windows\System\FzvEaqi.exe
  C:\Windows\System\FzvEaqi.exe
  2⤵
  PID:3656
- C:\Windows\System\pmaiWYi.exe
  C:\Windows\System\pmaiWYi.exe
  2⤵
  PID:3140
- C:\Windows\System\xQvWnvI.exe
  C:\Windows\System\xQvWnvI.exe
  2⤵
  PID:4112
- C:\Windows\System\zDNXpry.exe
  C:\Windows\System\zDNXpry.exe
  2⤵
  PID:4452
- C:\Windows\System\alzLXhJ.exe
  C:\Windows\System\alzLXhJ.exe
  2⤵
  PID:4464
- C:\Windows\System\yYNVXgl.exe
  C:\Windows\System\yYNVXgl.exe
  2⤵
  PID:4508
- C:\Windows\System\jIneJqo.exe
  C:\Windows\System\jIneJqo.exe
  2⤵
  PID:4536
- C:\Windows\System\BRkBLRe.exe
  C:\Windows\System\BRkBLRe.exe
  2⤵
  PID:4552
- C:\Windows\System\VtGztOY.exe
  C:\Windows\System\VtGztOY.exe
  2⤵
  PID:4572
- C:\Windows\System\jJAnIdM.exe
  C:\Windows\System\jJAnIdM.exe
  2⤵
  PID:4596
- C:\Windows\System\rhrpDqR.exe
  C:\Windows\System\rhrpDqR.exe
  2⤵
  PID:4624
- C:\Windows\System\DnXhQkT.exe
  C:\Windows\System\DnXhQkT.exe
  2⤵
  PID:4656
- C:\Windows\System\ONuvYDj.exe
  C:\Windows\System\ONuvYDj.exe
  2⤵
  PID:4684
- C:\Windows\System\OkmntEg.exe
  C:\Windows\System\OkmntEg.exe
  2⤵
  PID:4680
- C:\Windows\System\keRTuqF.exe
  C:\Windows\System\keRTuqF.exe
  2⤵
  PID:4716
- C:\Windows\System\tRdBlnd.exe
  C:\Windows\System\tRdBlnd.exe
  2⤵
  PID:4744
- C:\Windows\System\eEnzkeM.exe
  C:\Windows\System\eEnzkeM.exe
  2⤵
  PID:4776
- C:\Windows\System\iTgRlEL.exe
  C:\Windows\System\iTgRlEL.exe
  2⤵
  PID:4800
- C:\Windows\System\DvRYcpg.exe
  C:\Windows\System\DvRYcpg.exe
  2⤵
  PID:4808
- C:\Windows\System\qyFEKFb.exe
  C:\Windows\System\qyFEKFb.exe
  2⤵
  PID:4872
- C:\Windows\System\JWYJPbg.exe
  C:\Windows\System\JWYJPbg.exe
  2⤵
  PID:4852
- C:\Windows\System\HzCtmzK.exe
  C:\Windows\System\HzCtmzK.exe
  2⤵
  PID:4876
- C:\Windows\System\vWLMUVm.exe
  C:\Windows\System\vWLMUVm.exe
  2⤵
  PID:4936
- C:\Windows\System\djyJifV.exe
  C:\Windows\System\djyJifV.exe
  2⤵
  PID:4948
- C:\Windows\System\ZpegPTl.exe
  C:\Windows\System\ZpegPTl.exe
  2⤵
  PID:4980
- C:\Windows\System\SCxbASy.exe
  C:\Windows\System\SCxbASy.exe
  2⤵
  PID:5020
- C:\Windows\System\NmlnDcD.exe
  C:\Windows\System\NmlnDcD.exe
  2⤵
  PID:5064
- C:\Windows\System\HDWtyRB.exe
  C:\Windows\System\HDWtyRB.exe
  2⤵
  PID:5104
- C:\Windows\System\YwtWecC.exe
  C:\Windows\System\YwtWecC.exe
  2⤵
  PID:5048
- C:\Windows\System\tGePkea.exe
  C:\Windows\System\tGePkea.exe
  2⤵
  PID:5092
- C:\Windows\System\YkyVzSB.exe
  C:\Windows\System\YkyVzSB.exe
  2⤵
  PID:2560
- C:\Windows\System\NVSVtRy.exe
  C:\Windows\System\NVSVtRy.exe
  2⤵
  PID:4252
- C:\Windows\System\PcDdGVM.exe
  C:\Windows\System\PcDdGVM.exe
  2⤵
  PID:4320
- C:\Windows\System\HRVdPas.exe
  C:\Windows\System\HRVdPas.exe
  2⤵
  PID:2612
- C:\Windows\System\NFDYlbj.exe
  C:\Windows\System\NFDYlbj.exe
  2⤵
  PID:4084
- C:\Windows\System\HUZhSwN.exe
  C:\Windows\System\HUZhSwN.exe
  2⤵
  PID:4272
- C:\Windows\System\moEFITG.exe
  C:\Windows\System\moEFITG.exe
  2⤵
  PID:4336
- C:\Windows\System\pdYBPuE.exe
  C:\Windows\System\pdYBPuE.exe
  2⤵
  PID:3280
- C:\Windows\System\KQUhoVh.exe
  C:\Windows\System\KQUhoVh.exe
  2⤵
  PID:4492
- C:\Windows\System\cXXWzfC.exe
  C:\Windows\System\cXXWzfC.exe
  2⤵
  PID:4548
- C:\Windows\System\HOZPINR.exe
  C:\Windows\System\HOZPINR.exe
  2⤵
  PID:4532
- C:\Windows\System\zDVpXgx.exe
  C:\Windows\System\zDVpXgx.exe
  2⤵
  PID:4600
- C:\Windows\System\kOVUICZ.exe
  C:\Windows\System\kOVUICZ.exe
  2⤵
  PID:4608
- C:\Windows\System\guiZGvl.exe
  C:\Windows\System\guiZGvl.exe
  2⤵
  PID:4628
- C:\Windows\System\kRFqZQt.exe
  C:\Windows\System\kRFqZQt.exe
  2⤵
  PID:4696
- C:\Windows\System\DvUqzZo.exe
  C:\Windows\System\DvUqzZo.exe
  2⤵
  PID:4688
- C:\Windows\System\guoBrSJ.exe
  C:\Windows\System\guoBrSJ.exe
  2⤵
  PID:4740
- C:\Windows\System\GssZcIM.exe
  C:\Windows\System\GssZcIM.exe
  2⤵
  PID:4752
- C:\Windows\System\TGrBVja.exe
  C:\Windows\System\TGrBVja.exe
  2⤵
  PID:4832
- C:\Windows\System\wlpRgSm.exe
  C:\Windows\System\wlpRgSm.exe
  2⤵
  PID:4884
- C:\Windows\System\npdbaeu.exe
  C:\Windows\System\npdbaeu.exe
  2⤵
  PID:5044
- C:\Windows\System\esGWtve.exe
  C:\Windows\System\esGWtve.exe
  2⤵
  PID:4400
- C:\Windows\System\uUxccAZ.exe
  C:\Windows\System\uUxccAZ.exe
  2⤵
  PID:4964
- C:\Windows\System\OTuZXpk.exe
  C:\Windows\System\OTuZXpk.exe
  2⤵
  PID:4524
- C:\Windows\System\PmHhCga.exe
  C:\Windows\System\PmHhCga.exe
  2⤵
  PID:4172
- C:\Windows\System\uKBViGF.exe
  C:\Windows\System\uKBViGF.exe
  2⤵
  PID:4144
- C:\Windows\System\LASFoTT.exe
  C:\Windows\System\LASFoTT.exe
  2⤵
  PID:4388
- C:\Windows\System\yalxJwA.exe
  C:\Windows\System\yalxJwA.exe
  2⤵
  PID:2116
- C:\Windows\System\qDzaOgX.exe
  C:\Windows\System\qDzaOgX.exe
  2⤵
  PID:4788
- C:\Windows\System\ZcWzdWv.exe
  C:\Windows\System\ZcWzdWv.exe
  2⤵
  PID:4636
- C:\Windows\System\HZkfypX.exe
  C:\Windows\System\HZkfypX.exe
  2⤵
  PID:4756
- C:\Windows\System\NeaSpEE.exe
  C:\Windows\System\NeaSpEE.exe
  2⤵
  PID:4968
- C:\Windows\System\AojJWrq.exe
  C:\Windows\System\AojJWrq.exe
  2⤵
  PID:5024
- C:\Windows\System\bALPSgp.exe
  C:\Windows\System\bALPSgp.exe
  2⤵
  PID:4816
- C:\Windows\System\yfqHHeI.exe
  C:\Windows\System\yfqHHeI.exe
  2⤵
  PID:4208
- C:\Windows\System\DnGTUYe.exe
  C:\Windows\System\DnGTUYe.exe
  2⤵
  PID:4932
- C:\Windows\System\lFIFdTE.exe
  C:\Windows\System\lFIFdTE.exe
  2⤵
  PID:5004
- C:\Windows\System\HmGmiWw.exe
  C:\Windows\System\HmGmiWw.exe
  2⤵
  PID:4496
- C:\Windows\System\EgbgDet.exe
  C:\Windows\System\EgbgDet.exe
  2⤵
  PID:4736
- C:\Windows\System\pyNWWiK.exe
  C:\Windows\System\pyNWWiK.exe
  2⤵
  PID:3252
- C:\Windows\System\YeFtWal.exe
  C:\Windows\System\YeFtWal.exe
  2⤵
  PID:2684
- C:\Windows\System\TNNsWDZ.exe
  C:\Windows\System\TNNsWDZ.exe
  2⤵
  PID:3344
- C:\Windows\System\qByPyaq.exe
  C:\Windows\System\qByPyaq.exe
  2⤵
  PID:4128
- C:\Windows\System\tCMHPhv.exe
  C:\Windows\System\tCMHPhv.exe
  2⤵
  PID:1616
- C:\Windows\System\qstkNAW.exe
  C:\Windows\System\qstkNAW.exe
  2⤵
  PID:4416
- C:\Windows\System\CwKnqKe.exe
  C:\Windows\System\CwKnqKe.exe
  2⤵
  PID:4920
- C:\Windows\System\fJCIOkw.exe
  C:\Windows\System\fJCIOkw.exe
  2⤵
  PID:5124
- C:\Windows\System\nBsKgdB.exe
  C:\Windows\System\nBsKgdB.exe
  2⤵
  PID:5140
- C:\Windows\System\doMAvqN.exe
  C:\Windows\System\doMAvqN.exe
  2⤵
  PID:5156
- C:\Windows\System\uvyJdWP.exe
  C:\Windows\System\uvyJdWP.exe
  2⤵
  PID:5172
- C:\Windows\System\oNDJYgy.exe
  C:\Windows\System\oNDJYgy.exe
  2⤵
  PID:5188
- C:\Windows\System\OVumcSw.exe
  C:\Windows\System\OVumcSw.exe
  2⤵
  PID:5208
- C:\Windows\System\IlHnpek.exe
  C:\Windows\System\IlHnpek.exe
  2⤵
  PID:5224
- C:\Windows\System\WsuhKBk.exe
  C:\Windows\System\WsuhKBk.exe
  2⤵
  PID:5240
- C:\Windows\System\MxSojcN.exe
  C:\Windows\System\MxSojcN.exe
  2⤵
  PID:5256
- C:\Windows\System\kutwhfs.exe
  C:\Windows\System\kutwhfs.exe
  2⤵
  PID:5272
- C:\Windows\System\xueAcgy.exe
  C:\Windows\System\xueAcgy.exe
  2⤵
  PID:5288
- C:\Windows\System\FTSciJp.exe
  C:\Windows\System\FTSciJp.exe
  2⤵
  PID:5304
- C:\Windows\System\JNVviTz.exe
  C:\Windows\System\JNVviTz.exe
  2⤵
  PID:5320
- C:\Windows\System\HpRsBFb.exe
  C:\Windows\System\HpRsBFb.exe
  2⤵
  PID:5336
- C:\Windows\System\bbJnuQF.exe
  C:\Windows\System\bbJnuQF.exe
  2⤵
  PID:5352
- C:\Windows\System\xuoWNGl.exe
  C:\Windows\System\xuoWNGl.exe
  2⤵
  PID:5368
- C:\Windows\System\eSqBLMC.exe
  C:\Windows\System\eSqBLMC.exe
  2⤵
  PID:5384
- C:\Windows\System\yiCchvo.exe
  C:\Windows\System\yiCchvo.exe
  2⤵
  PID:5400
- C:\Windows\System\XNrxFJR.exe
  C:\Windows\System\XNrxFJR.exe
  2⤵
  PID:5416
- C:\Windows\System\pNlkFlQ.exe
  C:\Windows\System\pNlkFlQ.exe
  2⤵
  PID:5432
- C:\Windows\System\gMWKsag.exe
  C:\Windows\System\gMWKsag.exe
  2⤵
  PID:5448
- C:\Windows\System\IVIrhGQ.exe
  C:\Windows\System\IVIrhGQ.exe
  2⤵
  PID:5464
- C:\Windows\System\FiZSskF.exe
  C:\Windows\System\FiZSskF.exe
  2⤵
  PID:5480
- C:\Windows\System\VIdfqer.exe
  C:\Windows\System\VIdfqer.exe
  2⤵
  PID:5496
- C:\Windows\System\JdGquee.exe
  C:\Windows\System\JdGquee.exe
  2⤵
  PID:5512
- C:\Windows\System\GoXrluI.exe
  C:\Windows\System\GoXrluI.exe
  2⤵
  PID:5528
- C:\Windows\System\elipBoW.exe
  C:\Windows\System\elipBoW.exe
  2⤵
  PID:5544
- C:\Windows\System\htEXuMW.exe
  C:\Windows\System\htEXuMW.exe
  2⤵
  PID:5560
- C:\Windows\System\NwXvbkL.exe
  C:\Windows\System\NwXvbkL.exe
  2⤵
  PID:5576
- C:\Windows\System\JuitcPO.exe
  C:\Windows\System\JuitcPO.exe
  2⤵
  PID:5592
- C:\Windows\System\mvGoSTq.exe
  C:\Windows\System\mvGoSTq.exe
  2⤵
  PID:5608
- C:\Windows\System\IKClJVi.exe
  C:\Windows\System\IKClJVi.exe
  2⤵
  PID:5624
- C:\Windows\System\NUNQKdG.exe
  C:\Windows\System\NUNQKdG.exe
  2⤵
  PID:5644
- C:\Windows\System\lwirvzH.exe
  C:\Windows\System\lwirvzH.exe
  2⤵
  PID:5660
- C:\Windows\System\rFIazAE.exe
  C:\Windows\System\rFIazAE.exe
  2⤵
  PID:5776
- C:\Windows\System\haGJiBk.exe
  C:\Windows\System\haGJiBk.exe
  2⤵
  PID:5792
- C:\Windows\System\aLzJmxa.exe
  C:\Windows\System\aLzJmxa.exe
  2⤵
  PID:5812
- C:\Windows\System\rmqnLDL.exe
  C:\Windows\System\rmqnLDL.exe
  2⤵
  PID:5828
- C:\Windows\System\MvzZhgQ.exe
  C:\Windows\System\MvzZhgQ.exe
  2⤵
  PID:5844
- C:\Windows\System\FUeTMWX.exe
  C:\Windows\System\FUeTMWX.exe
  2⤵
  PID:5864
- C:\Windows\System\XocjmzZ.exe
  C:\Windows\System\XocjmzZ.exe
  2⤵
  PID:5880
- C:\Windows\System\ZYrgBEt.exe
  C:\Windows\System\ZYrgBEt.exe
  2⤵
  PID:5896
- C:\Windows\System\YtCaufe.exe
  C:\Windows\System\YtCaufe.exe
  2⤵
  PID:5912
- C:\Windows\System\SBheCZm.exe
  C:\Windows\System\SBheCZm.exe
  2⤵
  PID:5936
- C:\Windows\System\yOsoKLY.exe
  C:\Windows\System\yOsoKLY.exe
  2⤵
  PID:5952
- C:\Windows\System\Judxwwo.exe
  C:\Windows\System\Judxwwo.exe
  2⤵
  PID:5968
- C:\Windows\System\CCGaMgo.exe
  C:\Windows\System\CCGaMgo.exe
  2⤵
  PID:5984
- C:\Windows\System\LzUGugl.exe
  C:\Windows\System\LzUGugl.exe
  2⤵
  PID:6000
- C:\Windows\System\xqwnSlr.exe
  C:\Windows\System\xqwnSlr.exe
  2⤵
  PID:6016
- C:\Windows\System\WqztPSE.exe
  C:\Windows\System\WqztPSE.exe
  2⤵
  PID:6040
- C:\Windows\System\MmVJKhx.exe
  C:\Windows\System\MmVJKhx.exe
  2⤵
  PID:6056
- C:\Windows\System\nJPaTZy.exe
  C:\Windows\System\nJPaTZy.exe
  2⤵
  PID:6072
- C:\Windows\System\cbhSFwK.exe
  C:\Windows\System\cbhSFwK.exe
  2⤵
  PID:6088
- C:\Windows\System\CfYGTce.exe
  C:\Windows\System\CfYGTce.exe
  2⤵
  PID:6104
- C:\Windows\System\KyaxRsM.exe
  C:\Windows\System\KyaxRsM.exe
  2⤵
  PID:6120
- C:\Windows\System\bYsFdTC.exe
  C:\Windows\System\bYsFdTC.exe
  2⤵
  PID:6136
- C:\Windows\System\wyPzrnX.exe
  C:\Windows\System\wyPzrnX.exe
  2⤵
  PID:4560
- C:\Windows\System\MPGRLsa.exe
  C:\Windows\System\MPGRLsa.exe
  2⤵
  PID:5060
- C:\Windows\System\XJzmvpv.exe
  C:\Windows\System\XJzmvpv.exe
  2⤵
  PID:2736
- C:\Windows\System\HjeahYh.exe
  C:\Windows\System\HjeahYh.exe
  2⤵
  PID:5136
- C:\Windows\System\ScCjksE.exe
  C:\Windows\System\ScCjksE.exe
  2⤵
  PID:5196
- C:\Windows\System\cyKCrNz.exe
  C:\Windows\System\cyKCrNz.exe
  2⤵
  PID:5220
- C:\Windows\System\qycASjS.exe
  C:\Windows\System\qycASjS.exe
  2⤵
  PID:5248
- C:\Windows\System\JYeWWFc.exe
  C:\Windows\System\JYeWWFc.exe
  2⤵
  PID:5180
- C:\Windows\System\vqOzrNF.exe
  C:\Windows\System\vqOzrNF.exe
  2⤵
  PID:4384
- C:\Windows\System\hCuOicN.exe
  C:\Windows\System\hCuOicN.exe
  2⤵
  PID:5148
- C:\Windows\System\pzJVqNW.exe
  C:\Windows\System\pzJVqNW.exe
  2⤵
  PID:5312
- C:\Windows\System\mNCEUOO.exe
  C:\Windows\System\mNCEUOO.exe
  2⤵
  PID:5268
- C:\Windows\System\nykpOzA.exe
  C:\Windows\System\nykpOzA.exe
  2⤵
  PID:5328
- C:\Windows\System\MVvdXbl.exe
  C:\Windows\System\MVvdXbl.exe
  2⤵
  PID:5396
- C:\Windows\System\yPWnlZI.exe
  C:\Windows\System\yPWnlZI.exe
  2⤵
  PID:5412
- C:\Windows\System\KSxgDuo.exe
  C:\Windows\System\KSxgDuo.exe
  2⤵
  PID:5408
- C:\Windows\System\mWXPoVs.exe
  C:\Windows\System\mWXPoVs.exe
  2⤵
  PID:5376
- C:\Windows\System\hZtfXIk.exe
  C:\Windows\System\hZtfXIk.exe
  2⤵
  PID:5488
- C:\Windows\System\pUALcaj.exe
  C:\Windows\System\pUALcaj.exe
  2⤵
  PID:5552
- C:\Windows\System\QRpqGAu.exe
  C:\Windows\System\QRpqGAu.exe
  2⤵
  PID:5604
- C:\Windows\System\WlePPiP.exe
  C:\Windows\System\WlePPiP.exe
  2⤵
  PID:5584
- C:\Windows\System\jyDEynV.exe
  C:\Windows\System\jyDEynV.exe
  2⤵
  PID:5652
- C:\Windows\System\IQbcDzK.exe
  C:\Windows\System\IQbcDzK.exe
  2⤵
  PID:5668
- C:\Windows\System\TNDTudF.exe
  C:\Windows\System\TNDTudF.exe
  2⤵
  PID:5684
- C:\Windows\System\reGiLgm.exe
  C:\Windows\System\reGiLgm.exe
  2⤵
  PID:5700
- C:\Windows\System\ziImoFG.exe
  C:\Windows\System\ziImoFG.exe
  2⤵
  PID:4712
- C:\Windows\System\kXOkXxb.exe
  C:\Windows\System\kXOkXxb.exe
  2⤵
  PID:5736
- C:\Windows\System\GsqRpYT.exe
  C:\Windows\System\GsqRpYT.exe
  2⤵
  PID:5740
- C:\Windows\System\ecSbjQI.exe
  C:\Windows\System\ecSbjQI.exe
  2⤵
  PID:5760
- C:\Windows\System\nQaIgal.exe
  C:\Windows\System\nQaIgal.exe
  2⤵
  PID:5820
- C:\Windows\System\SmzgRGq.exe
  C:\Windows\System\SmzgRGq.exe
  2⤵
  PID:5888
- C:\Windows\System\XYmbgOU.exe
  C:\Windows\System\XYmbgOU.exe
  2⤵
  PID:5928
- C:\Windows\System\CLWZZQC.exe
  C:\Windows\System\CLWZZQC.exe
  2⤵
  PID:6084
- C:\Windows\System\AzveNAk.exe
  C:\Windows\System\AzveNAk.exe
  2⤵
  PID:4240
- C:\Windows\System\sHzjSLN.exe
  C:\Windows\System\sHzjSLN.exe
  2⤵
  PID:4568
- C:\Windows\System\JJfehiO.exe
  C:\Windows\System\JJfehiO.exe
  2⤵
  PID:4588
- C:\Windows\System\cCSUxRt.exe
  C:\Windows\System\cCSUxRt.exe
  2⤵
  PID:4704
- C:\Windows\System\iuuTKFg.exe
  C:\Windows\System\iuuTKFg.exe
  2⤵
  PID:5380
- C:\Windows\System\frgcpFG.exe
  C:\Windows\System\frgcpFG.exe
  2⤵
  PID:5536
- C:\Windows\System\HKSOlKu.exe
  C:\Windows\System\HKSOlKu.exe
  2⤵
  PID:3576
- C:\Windows\System\sQgVYZE.exe
  C:\Windows\System\sQgVYZE.exe
  2⤵
  PID:5216
- C:\Windows\System\LRAVJrg.exe
  C:\Windows\System\LRAVJrg.exe
  2⤵
  PID:4860
- C:\Windows\System\bJTKbVH.exe
  C:\Windows\System\bJTKbVH.exe
  2⤵
  PID:5520
- C:\Windows\System\KtYTwKJ.exe
  C:\Windows\System\KtYTwKJ.exe
  2⤵
  PID:5600
- C:\Windows\System\FAZTldl.exe
  C:\Windows\System\FAZTldl.exe
  2⤵
  PID:5692
- C:\Windows\System\xNzLGEG.exe
  C:\Windows\System\xNzLGEG.exe
  2⤵
  PID:5724
- C:\Windows\System\xgXnRYM.exe
  C:\Windows\System\xgXnRYM.exe
  2⤵
  PID:5852
- C:\Windows\System\PQfOgSH.exe
  C:\Windows\System\PQfOgSH.exe
  2⤵
  PID:5924
- C:\Windows\System\BGPcEBa.exe
  C:\Windows\System\BGPcEBa.exe
  2⤵
  PID:5716
- C:\Windows\System\QRpoekJ.exe
  C:\Windows\System\QRpoekJ.exe
  2⤵
  PID:5680
- C:\Windows\System\DeYeKRA.exe
  C:\Windows\System\DeYeKRA.exe
  2⤵
  PID:5992
- C:\Windows\System\spHIyDz.exe
  C:\Windows\System\spHIyDz.exe
  2⤵
  PID:5976
- C:\Windows\System\NDrICcQ.exe
  C:\Windows\System\NDrICcQ.exe
  2⤵
  PID:5840
- C:\Windows\System\pMxEAAI.exe
  C:\Windows\System\pMxEAAI.exe
  2⤵
  PID:5948
- C:\Windows\System\KVKsQtx.exe
  C:\Windows\System\KVKsQtx.exe
  2⤵
  PID:5836
- C:\Windows\System\KOgxMwm.exe
  C:\Windows\System\KOgxMwm.exe
  2⤵
  PID:6052
- C:\Windows\System\YgUFTQs.exe
  C:\Windows\System\YgUFTQs.exe
  2⤵
  PID:6128
- C:\Windows\System\LpNyfpM.exe
  C:\Windows\System\LpNyfpM.exe
  2⤵
  PID:6148
- C:\Windows\System\KRyneOx.exe
  C:\Windows\System\KRyneOx.exe
  2⤵
  PID:6164
- C:\Windows\System\CQGutqo.exe
  C:\Windows\System\CQGutqo.exe
  2⤵
  PID:6184
- C:\Windows\System\aHSRinC.exe
  C:\Windows\System\aHSRinC.exe
  2⤵
  PID:6204
- C:\Windows\System\sotMRIr.exe
  C:\Windows\System\sotMRIr.exe
  2⤵
  PID:6220
- C:\Windows\System\KShyADy.exe
  C:\Windows\System\KShyADy.exe
  2⤵
  PID:6236
- C:\Windows\System\gRohumK.exe
  C:\Windows\System\gRohumK.exe
  2⤵
  PID:6252
- C:\Windows\System\WBJugTT.exe
  C:\Windows\System\WBJugTT.exe
  2⤵
  PID:6276
- C:\Windows\System\gIVEzdd.exe
  C:\Windows\System\gIVEzdd.exe
  2⤵
  PID:6300
- C:\Windows\System\RKbRHAS.exe
  C:\Windows\System\RKbRHAS.exe
  2⤵
  PID:6316
- C:\Windows\System\CSlzUVG.exe
  C:\Windows\System\CSlzUVG.exe
  2⤵
  PID:6332
- C:\Windows\System\LIgsVMZ.exe
  C:\Windows\System\LIgsVMZ.exe
  2⤵
  PID:6348
- C:\Windows\System\azQYiNH.exe
  C:\Windows\System\azQYiNH.exe
  2⤵
  PID:6364
- C:\Windows\System\uxZwlNF.exe
  C:\Windows\System\uxZwlNF.exe
  2⤵
  PID:6380
- C:\Windows\System\JUnGnKW.exe
  C:\Windows\System\JUnGnKW.exe
  2⤵
  PID:6396
- C:\Windows\System\WBEBhZb.exe
  C:\Windows\System\WBEBhZb.exe
  2⤵
  PID:6412
- C:\Windows\System\bCVCRgI.exe
  C:\Windows\System\bCVCRgI.exe
  2⤵
  PID:6428
- C:\Windows\System\OcyYYYk.exe
  C:\Windows\System\OcyYYYk.exe
  2⤵
  PID:6444
- C:\Windows\System\cithoIW.exe
  C:\Windows\System\cithoIW.exe
  2⤵
  PID:6460
- C:\Windows\System\aqGoSMA.exe
  C:\Windows\System\aqGoSMA.exe
  2⤵
  PID:6476
- C:\Windows\System\cSvHLjo.exe
  C:\Windows\System\cSvHLjo.exe
  2⤵
  PID:6492
- C:\Windows\System\rgCsjle.exe
  C:\Windows\System\rgCsjle.exe
  2⤵
  PID:6508
- C:\Windows\System\bENHjdw.exe
  C:\Windows\System\bENHjdw.exe
  2⤵
  PID:6524
- C:\Windows\System\dkfsINn.exe
  C:\Windows\System\dkfsINn.exe
  2⤵
  PID:6540
- C:\Windows\System\qExvTzg.exe
  C:\Windows\System\qExvTzg.exe
  2⤵
  PID:6556
- C:\Windows\System\XndcMbF.exe
  C:\Windows\System\XndcMbF.exe
  2⤵
  PID:6572
- C:\Windows\System\dVzSiKx.exe
  C:\Windows\System\dVzSiKx.exe
  2⤵
  PID:6588
- C:\Windows\System\GkYnGCL.exe
  C:\Windows\System\GkYnGCL.exe
  2⤵
  PID:6604
- C:\Windows\System\gYAWYhY.exe
  C:\Windows\System\gYAWYhY.exe
  2⤵
  PID:6620
- C:\Windows\System\Owxxqei.exe
  C:\Windows\System\Owxxqei.exe
  2⤵
  PID:6640
- C:\Windows\System\iEboKtE.exe
  C:\Windows\System\iEboKtE.exe
  2⤵
  PID:6660
- C:\Windows\System\toatgjk.exe
  C:\Windows\System\toatgjk.exe
  2⤵
  PID:6688
- C:\Windows\System\wdiAoZz.exe
  C:\Windows\System\wdiAoZz.exe
  2⤵
  PID:6704
- C:\Windows\System\TUFKJMl.exe
  C:\Windows\System\TUFKJMl.exe
  2⤵
  PID:6724
- C:\Windows\System\KQDtFHX.exe
  C:\Windows\System\KQDtFHX.exe
  2⤵
  PID:6740
- C:\Windows\System\UUUFZNO.exe
  C:\Windows\System\UUUFZNO.exe
  2⤵
  PID:6756
- C:\Windows\System\gPvDmWP.exe
  C:\Windows\System\gPvDmWP.exe
  2⤵
  PID:6772
- C:\Windows\System\SeLnVZC.exe
  C:\Windows\System\SeLnVZC.exe
  2⤵
  PID:6796
- C:\Windows\System\JTYLIHw.exe
  C:\Windows\System\JTYLIHw.exe
  2⤵
  PID:6812
- C:\Windows\System\dbaCTuY.exe
  C:\Windows\System\dbaCTuY.exe
  2⤵
  PID:6828
- C:\Windows\System\RZMWAvb.exe
  C:\Windows\System\RZMWAvb.exe
  2⤵
  PID:6844
- C:\Windows\System\BLLkzyk.exe
  C:\Windows\System\BLLkzyk.exe
  2⤵
  PID:6860
- C:\Windows\System\qzqoAPo.exe
  C:\Windows\System\qzqoAPo.exe
  2⤵
  PID:6876
- C:\Windows\System\fDyNFnd.exe
  C:\Windows\System\fDyNFnd.exe
  2⤵
  PID:6900
- C:\Windows\System\hIJAwPQ.exe
  C:\Windows\System\hIJAwPQ.exe
  2⤵
  PID:6916
- C:\Windows\System\JHHInOp.exe
  C:\Windows\System\JHHInOp.exe
  2⤵
  PID:6932
- C:\Windows\System\rycwcAs.exe
  C:\Windows\System\rycwcAs.exe
  2⤵
  PID:6948
- C:\Windows\System\ZKSYmtf.exe
  C:\Windows\System\ZKSYmtf.exe
  2⤵
  PID:6964
- C:\Windows\System\dFwUZkF.exe
  C:\Windows\System\dFwUZkF.exe
  2⤵
  PID:6980
- C:\Windows\System\KKGAjWs.exe
  C:\Windows\System\KKGAjWs.exe
  2⤵
  PID:6996
- C:\Windows\System\JPkAKHA.exe
  C:\Windows\System\JPkAKHA.exe
  2⤵
  PID:7012
- C:\Windows\System\cEjNejj.exe
  C:\Windows\System\cEjNejj.exe
  2⤵
  PID:7028
- C:\Windows\System\IFzjhEx.exe
  C:\Windows\System\IFzjhEx.exe
  2⤵
  PID:7044
- C:\Windows\System\PtkCEBh.exe
  C:\Windows\System\PtkCEBh.exe
  2⤵
  PID:7060
- C:\Windows\System\BTihnwe.exe
  C:\Windows\System\BTihnwe.exe
  2⤵
  PID:7080
- C:\Windows\System\GVsNPbE.exe
  C:\Windows\System\GVsNPbE.exe
  2⤵
  PID:7096
- C:\Windows\System\ECdptpF.exe
  C:\Windows\System\ECdptpF.exe
  2⤵
  PID:7112
- C:\Windows\System\EwhYCmX.exe
  C:\Windows\System\EwhYCmX.exe
  2⤵
  PID:5964
- C:\Windows\System\gvpKyRe.exe
  C:\Windows\System\gvpKyRe.exe
  2⤵
  PID:4540
- C:\Windows\System\zcjEQvD.exe
  C:\Windows\System\zcjEQvD.exe
  2⤵
  PID:6196
- C:\Windows\System\jvoGLsC.exe
  C:\Windows\System\jvoGLsC.exe
  2⤵
  PID:5252
- C:\Windows\System\RrwlGjZ.exe
  C:\Windows\System\RrwlGjZ.exe
  2⤵
  PID:6032
- C:\Windows\System\wENRMdv.exe
  C:\Windows\System\wENRMdv.exe
  2⤵
  PID:5236
- C:\Windows\System\ugDiUvW.exe
  C:\Windows\System\ugDiUvW.exe
  2⤵
  PID:5632
- C:\Windows\System\ktsyRxq.exe
  C:\Windows\System\ktsyRxq.exe
  2⤵
  PID:5712
- C:\Windows\System\GruRmuy.exe
  C:\Windows\System\GruRmuy.exe
  2⤵
  PID:5904
- C:\Windows\System\qlVWPDm.exe
  C:\Windows\System\qlVWPDm.exe
  2⤵
  PID:4612
- C:\Windows\System\QuwmhpK.exe
  C:\Windows\System\QuwmhpK.exe
  2⤵
  PID:6180
- C:\Windows\System\MaCBzTO.exe
  C:\Windows\System\MaCBzTO.exe
  2⤵
  PID:6272
- C:\Windows\System\POFfkMc.exe
  C:\Windows\System\POFfkMc.exe
  2⤵
  PID:4812
- C:\Windows\System\wWpluGy.exe
  C:\Windows\System\wWpluGy.exe
  2⤵
  PID:6064
- C:\Windows\System\SdvDozz.exe
  C:\Windows\System\SdvDozz.exe
  2⤵
  PID:5908
- C:\Windows\System\zYAPQXs.exe
  C:\Windows\System\zYAPQXs.exe
  2⤵
  PID:6360
- C:\Windows\System\wFzjgyG.exe
  C:\Windows\System\wFzjgyG.exe
  2⤵
  PID:6424
- C:\Windows\System\SWXWbCk.exe
  C:\Windows\System\SWXWbCk.exe
  2⤵
  PID:6516
- C:\Windows\System\YvWCQpV.exe
  C:\Windows\System\YvWCQpV.exe
  2⤵
  PID:6488
- C:\Windows\System\qRtYGVt.exe
  C:\Windows\System\qRtYGVt.exe
  2⤵
  PID:6580
- C:\Windows\System\RbCFdYY.exe
  C:\Windows\System\RbCFdYY.exe
  2⤵
  PID:6248
- C:\Windows\System\RslSjxy.exe
  C:\Windows\System\RslSjxy.exe
  2⤵
  PID:6268
- C:\Windows\System\SOOyHRX.exe
  C:\Windows\System\SOOyHRX.exe
  2⤵
  PID:6312
- C:\Windows\System\yeOfiqf.exe
  C:\Windows\System\yeOfiqf.exe
  2⤵
  PID:6408
- C:\Windows\System\CbCqmjw.exe
  C:\Windows\System\CbCqmjw.exe
  2⤵
  PID:6472
- C:\Windows\System\wsvSAHL.exe
  C:\Windows\System\wsvSAHL.exe
  2⤵
  PID:6532
- C:\Windows\System\papNUzk.exe
  C:\Windows\System\papNUzk.exe
  2⤵
  PID:6596
- C:\Windows\System\nBvXabI.exe
  C:\Windows\System\nBvXabI.exe
  2⤵
  PID:6696
- C:\Windows\System\VkcZmLE.exe
  C:\Windows\System\VkcZmLE.exe
  2⤵
  PID:6764
- C:\Windows\System\rpWqlue.exe
  C:\Windows\System\rpWqlue.exe
  2⤵
  PID:6804
- C:\Windows\System\LUuTBkH.exe
  C:\Windows\System\LUuTBkH.exe
  2⤵
  PID:6672
- C:\Windows\System\kiXUFjX.exe
  C:\Windows\System\kiXUFjX.exe
  2⤵
  PID:6752
- C:\Windows\System\TQKIwFx.exe
  C:\Windows\System\TQKIwFx.exe
  2⤵
  PID:6808
- C:\Windows\System\dylFCsM.exe
  C:\Windows\System\dylFCsM.exe
  2⤵
  PID:6868
- C:\Windows\System\rzPYTbG.exe
  C:\Windows\System\rzPYTbG.exe
  2⤵
  PID:6852
- C:\Windows\System\TYZbqCs.exe
  C:\Windows\System\TYZbqCs.exe
  2⤵
  PID:6884
- C:\Windows\System\kghfQcF.exe
  C:\Windows\System\kghfQcF.exe
  2⤵
  PID:6896
- C:\Windows\System\RPFHzrD.exe
  C:\Windows\System\RPFHzrD.exe
  2⤵
  PID:6956
- C:\Windows\System\ijMXNKD.exe
  C:\Windows\System\ijMXNKD.exe
  2⤵
  PID:7008
- C:\Windows\System\VEucfKU.exe
  C:\Windows\System\VEucfKU.exe
  2⤵
  PID:6992
- C:\Windows\System\MuWjImZ.exe
  C:\Windows\System\MuWjImZ.exe
  2⤵
  PID:7076
- C:\Windows\System\rBPMZdF.exe
  C:\Windows\System\rBPMZdF.exe
  2⤵
  PID:7056
- C:\Windows\System\CvCgdvH.exe
  C:\Windows\System\CvCgdvH.exe
  2⤵
  PID:7092
- C:\Windows\System\vJTBtFi.exe
  C:\Windows\System\vJTBtFi.exe
  2⤵
  PID:7128
- C:\Windows\System\LNTaOTZ.exe
  C:\Windows\System\LNTaOTZ.exe
  2⤵
  PID:7144
- C:\Windows\System\EGjMDmE.exe
  C:\Windows\System\EGjMDmE.exe
  2⤵
  PID:5460
- C:\Windows\System\aUVHKMj.exe
  C:\Windows\System\aUVHKMj.exe
  2⤵
  PID:6024
- C:\Windows\System\KziyUQA.exe
  C:\Windows\System\KziyUQA.exe
  2⤵
  PID:4404
- C:\Windows\System\wgXXAAx.exe
  C:\Windows\System\wgXXAAx.exe
  2⤵
  PID:6028
- C:\Windows\System\CbQwEfO.exe
  C:\Windows\System\CbQwEfO.exe
  2⤵
  PID:4764
- C:\Windows\System\izMDebp.exe
  C:\Windows\System\izMDebp.exe
  2⤵
  PID:6160
- C:\Windows\System\mnDkVkU.exe
  C:\Windows\System\mnDkVkU.exe
  2⤵
  PID:4896
- C:\Windows\System\TfvprPj.exe
  C:\Windows\System\TfvprPj.exe
  2⤵
  PID:5392
- C:\Windows\System\SFGbdza.exe
  C:\Windows\System\SFGbdza.exe
  2⤵
  PID:6244
- C:\Windows\System\QljyIFH.exe
  C:\Windows\System\QljyIFH.exe
  2⤵
  PID:6176
- C:\Windows\System\sRJbILd.exe
  C:\Windows\System\sRJbILd.exe
  2⤵
  PID:5332
- C:\Windows\System\eePdQrm.exe
  C:\Windows\System\eePdQrm.exe
  2⤵
  PID:5456
- C:\Windows\System\WSojwLP.exe
  C:\Windows\System\WSojwLP.exe
  2⤵
  PID:6484
- C:\Windows\System\rkHkZrE.exe
  C:\Windows\System\rkHkZrE.exe
  2⤵
  PID:6616
- C:\Windows\System\qjOAxgJ.exe
  C:\Windows\System\qjOAxgJ.exe
  2⤵
  PID:6308
- C:\Windows\System\UeqVVUk.exe
  C:\Windows\System\UeqVVUk.exe
  2⤵
  PID:6404
- C:\Windows\System\cCJxcnw.exe
  C:\Windows\System\cCJxcnw.exe
  2⤵
  PID:6680
- C:\Windows\System\JGdAWRz.exe
  C:\Windows\System\JGdAWRz.exe
  2⤵
  PID:6720
- C:\Windows\System\zutqGVL.exe
  C:\Windows\System\zutqGVL.exe
  2⤵
  PID:6788
- C:\Windows\System\foBVyjj.exe
  C:\Windows\System\foBVyjj.exe
  2⤵
  PID:6712
- C:\Windows\System\azSaLGu.exe
  C:\Windows\System\azSaLGu.exe
  2⤵
  PID:6888
- C:\Windows\System\adhtwrC.exe
  C:\Windows\System\adhtwrC.exe
  2⤵
  PID:6944
- C:\Windows\System\wECKjrR.exe
  C:\Windows\System\wECKjrR.exe
  2⤵
  PID:6976
- C:\Windows\System\tMGIboL.exe
  C:\Windows\System\tMGIboL.exe
  2⤵
  PID:7072
- C:\Windows\System\LffubQf.exe
  C:\Windows\System\LffubQf.exe
  2⤵
  PID:7124
- C:\Windows\System\aSdylGG.exe
  C:\Windows\System\aSdylGG.exe
  2⤵
  PID:6096
- C:\Windows\System\KDIgNPQ.exe
  C:\Windows\System\KDIgNPQ.exe
  2⤵
  PID:7088
- C:\Windows\System\BhxoyXx.exe
  C:\Windows\System\BhxoyXx.exe
  2⤵
  PID:6012
- C:\Windows\System\lbCYVnW.exe
  C:\Windows\System\lbCYVnW.exe
  2⤵
  PID:6132
- C:\Windows\System\apyPxUZ.exe
  C:\Windows\System\apyPxUZ.exe
  2⤵
  PID:4988
- C:\Windows\System\qziAeme.exe
  C:\Windows\System\qziAeme.exe
  2⤵
  PID:6328
- C:\Windows\System\vlKUyKh.exe
  C:\Windows\System\vlKUyKh.exe
  2⤵
  PID:6260
- C:\Windows\System\drrGrYJ.exe
  C:\Windows\System\drrGrYJ.exe
  2⤵
  PID:6652
- C:\Windows\System\pkDqdeg.exe
  C:\Windows\System\pkDqdeg.exe
  2⤵
  PID:7176
- C:\Windows\System\vcJoonp.exe
  C:\Windows\System\vcJoonp.exe
  2⤵
  PID:7192
- C:\Windows\System\ehOQaAH.exe
  C:\Windows\System\ehOQaAH.exe
  2⤵
  PID:7212
- C:\Windows\System\NFpbCmT.exe
  C:\Windows\System\NFpbCmT.exe
  2⤵
  PID:7236
- C:\Windows\System\pNGUlEE.exe
  C:\Windows\System\pNGUlEE.exe
  2⤵
  PID:7252
- C:\Windows\System\EdxTiYt.exe
  C:\Windows\System\EdxTiYt.exe
  2⤵
  PID:7268
- C:\Windows\System\BgpeEkJ.exe
  C:\Windows\System\BgpeEkJ.exe
  2⤵
  PID:7288
- C:\Windows\System\wTEPNZG.exe
  C:\Windows\System\wTEPNZG.exe
  2⤵
  PID:7304
- C:\Windows\System\wYbJRtk.exe
  C:\Windows\System\wYbJRtk.exe
  2⤵
  PID:7320
- C:\Windows\System\EWjFOaE.exe
  C:\Windows\System\EWjFOaE.exe
  2⤵
  PID:7344
- C:\Windows\System\oLNSYJg.exe
  C:\Windows\System\oLNSYJg.exe
  2⤵
  PID:7360
- C:\Windows\System\rEAwFFB.exe
  C:\Windows\System\rEAwFFB.exe
  2⤵
  PID:7376
- C:\Windows\System\BWBGtTf.exe
  C:\Windows\System\BWBGtTf.exe
  2⤵
  PID:7392
- C:\Windows\System\sahuaDB.exe
  C:\Windows\System\sahuaDB.exe
  2⤵
  PID:7408
- C:\Windows\System\idSfUvs.exe
  C:\Windows\System\idSfUvs.exe
  2⤵
  PID:7424
- C:\Windows\System\kqoihkk.exe
  C:\Windows\System\kqoihkk.exe
  2⤵
  PID:7440
- C:\Windows\System\HqJaxkh.exe
  C:\Windows\System\HqJaxkh.exe
  2⤵
  PID:7456
- C:\Windows\System\NIGqlRV.exe
  C:\Windows\System\NIGqlRV.exe
  2⤵
  PID:7472
- C:\Windows\System\pXumEKJ.exe
  C:\Windows\System\pXumEKJ.exe
  2⤵
  PID:7488
- C:\Windows\System\OkVqjNp.exe
  C:\Windows\System\OkVqjNp.exe
  2⤵
  PID:7508
- C:\Windows\System\ICXBbmM.exe
  C:\Windows\System\ICXBbmM.exe
  2⤵
  PID:7524
- C:\Windows\System\JOADfvh.exe
  C:\Windows\System\JOADfvh.exe
  2⤵
  PID:7540
- C:\Windows\System\OgWmLnX.exe
  C:\Windows\System\OgWmLnX.exe
  2⤵
  PID:7556
- C:\Windows\System\UhnuDLM.exe
  C:\Windows\System\UhnuDLM.exe
  2⤵
  PID:7572
- C:\Windows\System\NvmUiwD.exe
  C:\Windows\System\NvmUiwD.exe
  2⤵
  PID:7588
- C:\Windows\System\yefTZZX.exe
  C:\Windows\System\yefTZZX.exe
  2⤵
  PID:7604
- C:\Windows\System\clHSygW.exe
  C:\Windows\System\clHSygW.exe
  2⤵
  PID:7624
- C:\Windows\System\vAaSJzL.exe
  C:\Windows\System\vAaSJzL.exe
  2⤵
  PID:7652
- C:\Windows\System\BhNTPPg.exe
  C:\Windows\System\BhNTPPg.exe
  2⤵
  PID:7668
- C:\Windows\System\sASaDMm.exe
  C:\Windows\System\sASaDMm.exe
  2⤵
  PID:7708
- C:\Windows\System\UddCxqA.exe
  C:\Windows\System\UddCxqA.exe
  2⤵
  PID:7724
- C:\Windows\System\qZvFPnC.exe
  C:\Windows\System\qZvFPnC.exe
  2⤵
  PID:7740
- C:\Windows\System\yEAmFVP.exe
  C:\Windows\System\yEAmFVP.exe
  2⤵
  PID:7756
- C:\Windows\System\MNFOTzt.exe
  C:\Windows\System\MNFOTzt.exe
  2⤵
  PID:7776
- C:\Windows\System\IHFuNGD.exe
  C:\Windows\System\IHFuNGD.exe
  2⤵
  PID:7792
- C:\Windows\System\IohPDfW.exe
  C:\Windows\System\IohPDfW.exe
  2⤵
  PID:7808
- C:\Windows\System\JgmNORb.exe
  C:\Windows\System\JgmNORb.exe
  2⤵
  PID:7828
- C:\Windows\System\lsJOvRe.exe
  C:\Windows\System\lsJOvRe.exe
  2⤵
  PID:7844
- C:\Windows\System\hyontno.exe
  C:\Windows\System\hyontno.exe
  2⤵
  PID:7964
- C:\Windows\System\ekqqQYo.exe
  C:\Windows\System\ekqqQYo.exe
  2⤵
  PID:7980
- C:\Windows\System\aCgnuUF.exe
  C:\Windows\System\aCgnuUF.exe
  2⤵
  PID:7996
- C:\Windows\System\eYwXVjU.exe
  C:\Windows\System\eYwXVjU.exe
  2⤵
  PID:8012
- C:\Windows\System\xvcZUzS.exe
  C:\Windows\System\xvcZUzS.exe
  2⤵
  PID:8028
- C:\Windows\System\qCXtenI.exe
  C:\Windows\System\qCXtenI.exe
  2⤵
  PID:8044
- C:\Windows\System\uovHjog.exe
  C:\Windows\System\uovHjog.exe
  2⤵
  PID:8060
- C:\Windows\System\peMEBAb.exe
  C:\Windows\System\peMEBAb.exe
  2⤵
  PID:8076
- C:\Windows\System\qqROcQy.exe
  C:\Windows\System\qqROcQy.exe
  2⤵
  PID:8096
- C:\Windows\System\GhyGXgB.exe
  C:\Windows\System\GhyGXgB.exe
  2⤵
  PID:8116
- C:\Windows\System\iYppsmX.exe
  C:\Windows\System\iYppsmX.exe
  2⤵
  PID:8132
- C:\Windows\System\vBvYhlB.exe
  C:\Windows\System\vBvYhlB.exe
  2⤵
  PID:8148
- C:\Windows\System\VtItaYk.exe
  C:\Windows\System\VtItaYk.exe
  2⤵
  PID:8164
- C:\Windows\System\rNyNXvT.exe
  C:\Windows\System\rNyNXvT.exe
  2⤵
  PID:8184
- C:\Windows\System\ltoXnhb.exe
  C:\Windows\System\ltoXnhb.exe
  2⤵
  PID:6504
- C:\Windows\System\nKbJDOl.exe
  C:\Windows\System\nKbJDOl.exe
  2⤵
  PID:7104
- C:\Windows\System\hSWvtVR.exe
  C:\Windows\System\hSWvtVR.exe
  2⤵
  PID:5300
- C:\Windows\System\uQernoi.exe
  C:\Windows\System\uQernoi.exe
  2⤵
  PID:6456
- C:\Windows\System\IqugWQq.exe
  C:\Windows\System\IqugWQq.exe
  2⤵
  PID:6668
- C:\Windows\System\niumbrV.exe
  C:\Windows\System\niumbrV.exe
  2⤵
  PID:7280
- C:\Windows\System\BKobvnQ.exe
  C:\Windows\System\BKobvnQ.exe
  2⤵
  PID:7356
- C:\Windows\System\qvLpQbX.exe
  C:\Windows\System\qvLpQbX.exe
  2⤵
  PID:7420
- C:\Windows\System\NwakYID.exe
  C:\Windows\System\NwakYID.exe
  2⤵
  PID:7484
- C:\Windows\System\TZFGgpL.exe
  C:\Windows\System\TZFGgpL.exe
  2⤵
  PID:7788
- C:\Windows\System\MMdjfCV.exe
  C:\Windows\System\MMdjfCV.exe
  2⤵
  PID:6468
- C:\Windows\System\xImEnUz.exe
  C:\Windows\System\xImEnUz.exe
  2⤵
  PID:5784
- C:\Windows\System\hELkSRT.exe
  C:\Windows\System\hELkSRT.exe
  2⤵
  PID:6840
- C:\Windows\System\evrdpEB.exe
  C:\Windows\System\evrdpEB.exe
  2⤵
  PID:7164
- C:\Windows\System\uzUUzaV.exe
  C:\Windows\System\uzUUzaV.exe
  2⤵
  PID:6552
- C:\Windows\System\iROQuqs.exe
  C:\Windows\System\iROQuqs.exe
  2⤵
  PID:7204
- C:\Windows\System\GLPLcIe.exe
  C:\Windows\System\GLPLcIe.exe
  2⤵
  PID:7820
- C:\Windows\System\MrsQebV.exe
  C:\Windows\System\MrsQebV.exe
  2⤵
  PID:7872
- C:\Windows\System\BCdUxna.exe
  C:\Windows\System\BCdUxna.exe
  2⤵
  PID:7888
- C:\Windows\System\UpoIOPM.exe
  C:\Windows\System\UpoIOPM.exe
  2⤵
  PID:7908
- C:\Windows\System\xkHPbEK.exe
  C:\Windows\System\xkHPbEK.exe
  2⤵
  PID:7924
- C:\Windows\System\WluLsfR.exe
  C:\Windows\System\WluLsfR.exe
  2⤵
  PID:7232
- C:\Windows\System\wVjlzDm.exe
  C:\Windows\System\wVjlzDm.exe
  2⤵
  PID:7300
- C:\Windows\System\HhUeFfw.exe
  C:\Windows\System\HhUeFfw.exe
  2⤵
  PID:7400
- C:\Windows\System\oKqDPFF.exe
  C:\Windows\System\oKqDPFF.exe
  2⤵
  PID:7464
- C:\Windows\System\KIHMJnz.exe
  C:\Windows\System\KIHMJnz.exe
  2⤵
  PID:7804
- C:\Windows\System\AtGhQcg.exe
  C:\Windows\System\AtGhQcg.exe
  2⤵
  PID:8068
- C:\Windows\System\oOjHnUh.exe
  C:\Windows\System\oOjHnUh.exe
  2⤵
  PID:8140
- C:\Windows\System\hZCLyvU.exe
  C:\Windows\System\hZCLyvU.exe
  2⤵
  PID:8180
- C:\Windows\System\rRWonBv.exe
  C:\Windows\System\rRWonBv.exe
  2⤵
  PID:7552
- C:\Windows\System\qHBrwCP.exe
  C:\Windows\System\qHBrwCP.exe
  2⤵
  PID:7248
- C:\Windows\System\JNweLCy.exe
  C:\Windows\System\JNweLCy.exe
  2⤵
  PID:7580
- C:\Windows\System\ZUkDoHR.exe
  C:\Windows\System\ZUkDoHR.exe
  2⤵
  PID:7664
- C:\Windows\System\FJfNBoQ.exe
  C:\Windows\System\FJfNBoQ.exe
  2⤵
  PID:7936
- C:\Windows\System\wzEphzN.exe
  C:\Windows\System\wzEphzN.exe
  2⤵
  PID:7948
- C:\Windows\System\ruLRtow.exe
  C:\Windows\System\ruLRtow.exe
  2⤵
  PID:8052
- C:\Windows\System\etOMbGs.exe
  C:\Windows\System\etOMbGs.exe
  2⤵
  PID:8092
- C:\Windows\System\EdhoIyR.exe
  C:\Windows\System\EdhoIyR.exe
  2⤵
  PID:6748
- C:\Windows\System\ZezHdOA.exe
  C:\Windows\System\ZezHdOA.exe
  2⤵
  PID:5996
- C:\Windows\System\tRYOdNH.exe
  C:\Windows\System\tRYOdNH.exe
  2⤵
  PID:7884
- C:\Windows\System\PceHzgs.exe
  C:\Windows\System\PceHzgs.exe
  2⤵
  PID:7264
- C:\Windows\System\HZVtKij.exe
  C:\Windows\System\HZVtKij.exe
  2⤵
  PID:7200
- C:\Windows\System\dMYHzSt.exe
  C:\Windows\System\dMYHzSt.exe
  2⤵
  PID:7432
- C:\Windows\System\ZLlDmtE.exe
  C:\Windows\System\ZLlDmtE.exe
  2⤵
  PID:7764
- C:\Windows\System\jMZvMqA.exe
  C:\Windows\System\jMZvMqA.exe
  2⤵
  PID:7904
- C:\Windows\System\iuafoLR.exe
  C:\Windows\System\iuafoLR.exe
  2⤵
  PID:7220
- C:\Windows\System\jsnevQy.exe
  C:\Windows\System\jsnevQy.exe
  2⤵
  PID:7836
- C:\Windows\System\cjCRHnT.exe
  C:\Windows\System\cjCRHnT.exe
  2⤵
  PID:7700
- C:\Windows\System\MkxARYp.exe
  C:\Windows\System\MkxARYp.exe
  2⤵
  PID:7680
- C:\Windows\System\SXJfZZx.exe
  C:\Windows\System\SXJfZZx.exe
  2⤵
  PID:7636
- C:\Windows\System\jmnCdoc.exe
  C:\Windows\System\jmnCdoc.exe
  2⤵
  PID:7564
- C:\Windows\System\mDnSKfY.exe
  C:\Windows\System\mDnSKfY.exe
  2⤵
  PID:7504
- C:\Windows\System\lRDSMnn.exe
  C:\Windows\System\lRDSMnn.exe
  2⤵
  PID:8112
- C:\Windows\System\kbPkUSy.exe
  C:\Windows\System\kbPkUSy.exe
  2⤵
  PID:7416
- C:\Windows\System\qdcTdbq.exe
  C:\Windows\System\qdcTdbq.exe
  2⤵
  PID:7960
- C:\Windows\System\nJVuEjS.exe
  C:\Windows\System\nJVuEjS.exe
  2⤵
  PID:7988
- C:\Windows\System\CnFLqiU.exe
  C:\Windows\System\CnFLqiU.exe
  2⤵
  PID:8128
- C:\Windows\System\fHBPUry.exe
  C:\Windows\System\fHBPUry.exe
  2⤵
  PID:8160
- C:\Windows\System\wBxKpeH.exe
  C:\Windows\System\wBxKpeH.exe
  2⤵
  PID:7140
- C:\Windows\System\pXkXZra.exe
  C:\Windows\System\pXkXZra.exe
  2⤵
  PID:7352
- C:\Windows\System\tccSrKw.exe
  C:\Windows\System\tccSrKw.exe
  2⤵
  PID:7452
- C:\Windows\System\DVNijEy.exe
  C:\Windows\System\DVNijEy.exe
  2⤵
  PID:7752
- C:\Windows\System\IoPYGpS.exe
  C:\Windows\System\IoPYGpS.exe
  2⤵
  PID:7920
- C:\Windows\System\RABqIwC.exe
  C:\Windows\System\RABqIwC.exe
  2⤵
  PID:7436
- C:\Windows\System\hpHtLpU.exe
  C:\Windows\System\hpHtLpU.exe
  2⤵
  PID:6036
- C:\Windows\System\LuwiPga.exe
  C:\Windows\System\LuwiPga.exe
  2⤵
  PID:7372
- C:\Windows\System\RnWqGJe.exe
  C:\Windows\System\RnWqGJe.exe
  2⤵
  PID:7692
- C:\Windows\System\hyehCvM.exe
  C:\Windows\System\hyehCvM.exe
  2⤵
  PID:7732
- C:\Windows\System\kXaEbuo.exe
  C:\Windows\System\kXaEbuo.exe
  2⤵
  PID:7640
- C:\Windows\System\NoopDxN.exe
  C:\Windows\System\NoopDxN.exe
  2⤵
  PID:7568
- C:\Windows\System\EQlYnfF.exe
  C:\Windows\System\EQlYnfF.exe
  2⤵
  PID:7328
- C:\Windows\System\xVuQieh.exe
  C:\Windows\System\xVuQieh.exe
  2⤵
  PID:7316
- C:\Windows\System\XusiqGh.exe
  C:\Windows\System\XusiqGh.exe
  2⤵
  PID:7748
- C:\Windows\System\BYLTjzB.exe
  C:\Windows\System\BYLTjzB.exe
  2⤵
  PID:5768
- C:\Windows\System\hrEiCrY.exe
  C:\Windows\System\hrEiCrY.exe
  2⤵
  PID:7868
- C:\Windows\System\qIKCdJA.exe
  C:\Windows\System\qIKCdJA.exe
  2⤵
  PID:7684
- C:\Windows\System\cVihDAK.exe
  C:\Windows\System\cVihDAK.exe
  2⤵
  PID:7976
- C:\Windows\System\OyuCxPt.exe
  C:\Windows\System\OyuCxPt.exe
  2⤵
  PID:7840
- C:\Windows\System\EulGIfR.exe
  C:\Windows\System\EulGIfR.exe
  2⤵
  PID:6288
- C:\Windows\System\pOSXqKd.exe
  C:\Windows\System\pOSXqKd.exe
  2⤵
  PID:5476
- C:\Windows\System\rdNyZSA.exe
  C:\Windows\System\rdNyZSA.exe
  2⤵
  PID:8172
- C:\Windows\System\nPKduFe.exe
  C:\Windows\System\nPKduFe.exe
  2⤵
  PID:8020
- C:\Windows\System\qKqnNTO.exe
  C:\Windows\System\qKqnNTO.exe
  2⤵
  PID:8104
- C:\Windows\System\YcSqcLC.exe
  C:\Windows\System\YcSqcLC.exe
  2⤵
  PID:7596
- C:\Windows\System\IaaHdzh.exe
  C:\Windows\System\IaaHdzh.exe
  2⤵
  PID:7644
- C:\Windows\System\tIWeQWd.exe
  C:\Windows\System\tIWeQWd.exe
  2⤵
  PID:7172
- C:\Windows\System\GwpDuBd.exe
  C:\Windows\System\GwpDuBd.exe
  2⤵
  PID:7620
- C:\Windows\System\mwceFMN.exe
  C:\Windows\System\mwceFMN.exe
  2⤵
  PID:7944
- C:\Windows\System\XhZqIwm.exe
  C:\Windows\System\XhZqIwm.exe
  2⤵
  PID:8024
- C:\Windows\System\LkjYFSC.exe
  C:\Windows\System\LkjYFSC.exe
  2⤵
  PID:7772
- C:\Windows\System\KYvNfnj.exe
  C:\Windows\System\KYvNfnj.exe
  2⤵
  PID:8204
- C:\Windows\System\NikogaF.exe
  C:\Windows\System\NikogaF.exe
  2⤵
  PID:8220
- C:\Windows\System\tiDmTlA.exe
  C:\Windows\System\tiDmTlA.exe
  2⤵
  PID:8236
- C:\Windows\System\hvkasCX.exe
  C:\Windows\System\hvkasCX.exe
  2⤵
  PID:8252
- C:\Windows\System\wpaPlLC.exe
  C:\Windows\System\wpaPlLC.exe
  2⤵
  PID:8268
- C:\Windows\System\vfTlsCN.exe
  C:\Windows\System\vfTlsCN.exe
  2⤵
  PID:8284
- C:\Windows\System\XOyNIOh.exe
  C:\Windows\System\XOyNIOh.exe
  2⤵
  PID:8300
- C:\Windows\System\DGhuEIY.exe
  C:\Windows\System\DGhuEIY.exe
  2⤵
  PID:8316
- C:\Windows\System\yxTBsCS.exe
  C:\Windows\System\yxTBsCS.exe
  2⤵
  PID:8332
- C:\Windows\System\mbMGcHQ.exe
  C:\Windows\System\mbMGcHQ.exe
  2⤵
  PID:8348
- C:\Windows\System\dNimMga.exe
  C:\Windows\System\dNimMga.exe
  2⤵
  PID:8408
- C:\Windows\System\NyYxlgv.exe
  C:\Windows\System\NyYxlgv.exe
  2⤵
  PID:8440
- C:\Windows\System\xFeAPsf.exe
  C:\Windows\System\xFeAPsf.exe
  2⤵
  PID:8456
- C:\Windows\System\RzpgKyj.exe
  C:\Windows\System\RzpgKyj.exe
  2⤵
  PID:8472
- C:\Windows\System\Sugblza.exe
  C:\Windows\System\Sugblza.exe
  2⤵
  PID:8496
- C:\Windows\System\IPqLBse.exe
  C:\Windows\System\IPqLBse.exe
  2⤵
  PID:8512
- C:\Windows\System\quUQPFC.exe
  C:\Windows\System\quUQPFC.exe
  2⤵
  PID:8528
- C:\Windows\System\cxMZrRA.exe
  C:\Windows\System\cxMZrRA.exe
  2⤵
  PID:8564
- C:\Windows\System\HDVPnGG.exe
  C:\Windows\System\HDVPnGG.exe
  2⤵
  PID:8580
- C:\Windows\System\QXXhbVp.exe
  C:\Windows\System\QXXhbVp.exe
  2⤵
  PID:8596
- C:\Windows\System\cKnuUty.exe
  C:\Windows\System\cKnuUty.exe
  2⤵
  PID:8616
- C:\Windows\System\OLphGfh.exe
  C:\Windows\System\OLphGfh.exe
  2⤵
  PID:8632
- C:\Windows\System\zwKUNNe.exe
  C:\Windows\System\zwKUNNe.exe
  2⤵
  PID:8648
- C:\Windows\System\GHFmTyB.exe
  C:\Windows\System\GHFmTyB.exe
  2⤵
  PID:8664
- C:\Windows\System\tYmhcvE.exe
  C:\Windows\System\tYmhcvE.exe
  2⤵
  PID:8680
- C:\Windows\System\yxVeFbH.exe
  C:\Windows\System\yxVeFbH.exe
  2⤵
  PID:8700
- C:\Windows\System\rZeMmaT.exe
  C:\Windows\System\rZeMmaT.exe
  2⤵
  PID:8716
- C:\Windows\System\funhQNs.exe
  C:\Windows\System\funhQNs.exe
  2⤵
  PID:8732
- C:\Windows\System\BticlyX.exe
  C:\Windows\System\BticlyX.exe
  2⤵
  PID:8760
- C:\Windows\System\LECtjyt.exe
  C:\Windows\System\LECtjyt.exe
  2⤵
  PID:8776
- C:\Windows\System\dKoAsLu.exe
  C:\Windows\System\dKoAsLu.exe
  2⤵
  PID:8792
- C:\Windows\System\bemdECu.exe
  C:\Windows\System\bemdECu.exe
  2⤵
  PID:8808
- C:\Windows\System\CBrgtik.exe
  C:\Windows\System\CBrgtik.exe
  2⤵
  PID:8824
- C:\Windows\System\EZnskrx.exe
  C:\Windows\System\EZnskrx.exe
  2⤵
  PID:8848
- C:\Windows\System\qCnsOrT.exe
  C:\Windows\System\qCnsOrT.exe
  2⤵
  PID:8864
- C:\Windows\System\ynxxCoC.exe
  C:\Windows\System\ynxxCoC.exe
  2⤵
  PID:8880
- C:\Windows\System\eNApPFd.exe
  C:\Windows\System\eNApPFd.exe
  2⤵
  PID:8996
- C:\Windows\System\iBHuAZN.exe
  C:\Windows\System\iBHuAZN.exe
  2⤵
  PID:9016
- C:\Windows\System\AJUcCKY.exe
  C:\Windows\System\AJUcCKY.exe
  2⤵
  PID:9036
- C:\Windows\System\OUrGXrM.exe
  C:\Windows\System\OUrGXrM.exe
  2⤵
  PID:9052
- C:\Windows\System\KjEaFun.exe
  C:\Windows\System\KjEaFun.exe
  2⤵
  PID:9080
- C:\Windows\System\EvITzqp.exe
  C:\Windows\System\EvITzqp.exe
  2⤵
  PID:9100
- C:\Windows\System\qRygEkf.exe
  C:\Windows\System\qRygEkf.exe
  2⤵
  PID:9116
- C:\Windows\System\WFMceUk.exe
  C:\Windows\System\WFMceUk.exe
  2⤵
  PID:9132
- C:\Windows\System\oLuLwSa.exe
  C:\Windows\System\oLuLwSa.exe
  2⤵
  PID:9148
- C:\Windows\System\iYJaYNV.exe
  C:\Windows\System\iYJaYNV.exe
  2⤵
  PID:9164
- C:\Windows\System\WzqRZqB.exe
  C:\Windows\System\WzqRZqB.exe
  2⤵
  PID:9180
- C:\Windows\System\VRgeahI.exe
  C:\Windows\System\VRgeahI.exe
  2⤵
  PID:9196
- C:\Windows\System\CBtZqif.exe
  C:\Windows\System\CBtZqif.exe
  2⤵
  PID:7600
- C:\Windows\System\LYjxtXJ.exe
  C:\Windows\System\LYjxtXJ.exe
  2⤵
  PID:8212
- C:\Windows\System\FAgxEaD.exe
  C:\Windows\System\FAgxEaD.exe
  2⤵
  PID:8176
- C:\Windows\System\ulqcTgQ.exe
  C:\Windows\System\ulqcTgQ.exe
  2⤵
  PID:8228
- C:\Windows\System\ULJCmMp.exe
  C:\Windows\System\ULJCmMp.exe
  2⤵
  PID:8296
- C:\Windows\System\SRYYRBs.exe
  C:\Windows\System\SRYYRBs.exe
  2⤵
  PID:8264
- C:\Windows\System\ULYCgSw.exe
  C:\Windows\System\ULYCgSw.exe
  2⤵
  PID:8312
- C:\Windows\System\vkrrmbt.exe
  C:\Windows\System\vkrrmbt.exe
  2⤵
  PID:8360
- C:\Windows\System\KXILeQZ.exe
  C:\Windows\System\KXILeQZ.exe
  2⤵
  PID:8372
- C:\Windows\System\ROJJgUj.exe
  C:\Windows\System\ROJJgUj.exe
  2⤵
  PID:8384
- C:\Windows\System\YtoWPBp.exe
  C:\Windows\System\YtoWPBp.exe
  2⤵
  PID:8400
- C:\Windows\System\fivFuTA.exe
  C:\Windows\System\fivFuTA.exe
  2⤵
  PID:8436
- C:\Windows\System\edlrUyZ.exe
  C:\Windows\System\edlrUyZ.exe
  2⤵
  PID:8008
- C:\Windows\System\eZfMiVi.exe
  C:\Windows\System\eZfMiVi.exe
  2⤵
  PID:8492
- C:\Windows\System\LHkhbBe.exe
  C:\Windows\System\LHkhbBe.exe
  2⤵
  PID:8540
- C:\Windows\System\OVHzFoj.exe
  C:\Windows\System\OVHzFoj.exe
  2⤵
  PID:8660
- C:\Windows\System\UnxMjzR.exe
  C:\Windows\System\UnxMjzR.exe
  2⤵
  PID:8592
- C:\Windows\System\WihuGNw.exe
  C:\Windows\System\WihuGNw.exe
  2⤵
  PID:8728
- C:\Windows\System\kRrsAfJ.exe
  C:\Windows\System\kRrsAfJ.exe
  2⤵
  PID:8804
- C:\Windows\System\HLmOapr.exe
  C:\Windows\System\HLmOapr.exe
  2⤵
  PID:8844
- C:\Windows\System\REcRFvh.exe
  C:\Windows\System\REcRFvh.exe
  2⤵
  PID:8608
- C:\Windows\System\yuBytDp.exe
  C:\Windows\System\yuBytDp.exe
  2⤵
  PID:8708
- C:\Windows\System\orJJuao.exe
  C:\Windows\System\orJJuao.exe
  2⤵
  PID:8784
- C:\Windows\System\PoGpmEE.exe
  C:\Windows\System\PoGpmEE.exe
  2⤵
  PID:8888
- C:\Windows\System\wYkOual.exe
  C:\Windows\System\wYkOual.exe
  2⤵
  PID:8984
- C:\Windows\System\lseeugz.exe
  C:\Windows\System\lseeugz.exe
  2⤵
  PID:9048
- C:\Windows\System\bDBTKde.exe
  C:\Windows\System\bDBTKde.exe
  2⤵
  PID:9088
- C:\Windows\System\jMEDZAr.exe
  C:\Windows\System\jMEDZAr.exe
  2⤵
  PID:9024
- C:\Windows\System\CiYimNP.exe
  C:\Windows\System\CiYimNP.exe
  2⤵
  PID:9072
- C:\Windows\System\TYSKSzp.exe
  C:\Windows\System\TYSKSzp.exe
  2⤵
  PID:9156
- C:\Windows\System\kjeMJDQ.exe
  C:\Windows\System\kjeMJDQ.exe
  2⤵
  PID:9108
- C:\Windows\System\AnzkwWG.exe
  C:\Windows\System\AnzkwWG.exe
  2⤵
  PID:7688
- C:\Windows\System\fApSZoO.exe
  C:\Windows\System\fApSZoO.exe
  2⤵
  PID:9172
- C:\Windows\System\jHvJKbs.exe
  C:\Windows\System\jHvJKbs.exe
  2⤵
  PID:8200
- C:\Windows\System\FzdKayt.exe
  C:\Windows\System\FzdKayt.exe
  2⤵
  PID:8388
- C:\Windows\System\NQmkIoz.exe
  C:\Windows\System\NQmkIoz.exe
  2⤵
  PID:8520
- C:\Windows\System\gOfcSaH.exe
  C:\Windows\System\gOfcSaH.exe
  2⤵
  PID:8672
- C:\Windows\System\KBwsqeA.exe
  C:\Windows\System\KBwsqeA.exe
  2⤵
  PID:8748
- C:\Windows\System\LjgpLEm.exe
  C:\Windows\System\LjgpLEm.exe
  2⤵
  PID:8908
- C:\Windows\System\HtYkRxO.exe
  C:\Windows\System\HtYkRxO.exe
  2⤵
  PID:8752
- C:\Windows\System\kjLxorW.exe
  C:\Windows\System\kjLxorW.exe
  2⤵
  PID:8896
- C:\Windows\System\fbsnmFe.exe
  C:\Windows\System\fbsnmFe.exe
  2⤵
  PID:8432
- C:\Windows\System\bXLkdMD.exe
  C:\Windows\System\bXLkdMD.exe
  2⤵
  PID:8924
- C:\Windows\System\uAtfvnE.exe
  C:\Windows\System\uAtfvnE.exe
  2⤵
  PID:8944
- C:\Windows\System\nvUIGJS.exe
  C:\Windows\System\nvUIGJS.exe
  2⤵
  PID:8956
- C:\Windows\System\MWyzRlN.exe
  C:\Windows\System\MWyzRlN.exe
  2⤵
  PID:8980
- C:\Windows\System\ZRktYJE.exe
  C:\Windows\System\ZRktYJE.exe
  2⤵
  PID:9060
- C:\Windows\System\dyJtYBP.exe
  C:\Windows\System\dyJtYBP.exe
  2⤵
  PID:9144
- C:\Windows\System\IMlqOzU.exe
  C:\Windows\System\IMlqOzU.exe
  2⤵
  PID:9096
- C:\Windows\System\PmPvexw.exe
  C:\Windows\System\PmPvexw.exe
  2⤵
  PID:8452
- C:\Windows\System\aGUSNru.exe
  C:\Windows\System\aGUSNru.exe
  2⤵
  PID:9068
- C:\Windows\System\eyOlsmV.exe
  C:\Windows\System\eyOlsmV.exe
  2⤵
  PID:9204
- C:\Windows\System\xTBInIi.exe
  C:\Windows\System\xTBInIi.exe
  2⤵
  PID:9208
- C:\Windows\System\QfoINZh.exe
  C:\Windows\System\QfoINZh.exe
  2⤵
  PID:6928
- C:\Windows\System\LEWQjpe.exe
  C:\Windows\System\LEWQjpe.exe
  2⤵
  PID:8368
- C:\Windows\System\zLiNPwE.exe
  C:\Windows\System\zLiNPwE.exe
  2⤵
  PID:8464
- C:\Windows\System\avLbZxK.exe
  C:\Windows\System\avLbZxK.exe
  2⤵
  PID:8560
- C:\Windows\System\jcGDOIN.exe
  C:\Windows\System\jcGDOIN.exe
  2⤵
  PID:8840
- C:\Windows\System\LWkOStb.exe
  C:\Windows\System\LWkOStb.exe
  2⤵
  PID:8552
- C:\Windows\System\seBwiJG.exe
  C:\Windows\System\seBwiJG.exe
  2⤵
  PID:8612
- C:\Windows\System\rhulNhJ.exe
  C:\Windows\System\rhulNhJ.exe
  2⤵
  PID:8912
- C:\Windows\System\dBTHnYp.exe
  C:\Windows\System\dBTHnYp.exe
  2⤵
  PID:8972
- C:\Windows\System\pRFIqHw.exe
  C:\Windows\System\pRFIqHw.exe
  2⤵
  PID:9188
- C:\Windows\System\UQIcRiA.exe
  C:\Windows\System\UQIcRiA.exe
  2⤵
  PID:6736
- C:\Windows\System\fDmNtfI.exe
  C:\Windows\System\fDmNtfI.exe
  2⤵
  PID:8468
- C:\Windows\System\oThwjMc.exe
  C:\Windows\System\oThwjMc.exe
  2⤵
  PID:8836
- C:\Windows\System\nhFXtUp.exe
  C:\Windows\System\nhFXtUp.exe
  2⤵
  PID:8740
- C:\Windows\System\aQLDHqa.exe
  C:\Windows\System\aQLDHqa.exe
  2⤵
  PID:8952
- C:\Windows\System\rOFWjlz.exe
  C:\Windows\System\rOFWjlz.exe
  2⤵
  PID:8244
- C:\Windows\System\BaDoBoM.exe
  C:\Windows\System\BaDoBoM.exe
  2⤵
  PID:8992
- C:\Windows\System\aAErSLQ.exe
  C:\Windows\System\aAErSLQ.exe
  2⤵
  PID:8644
- C:\Windows\System\KPTBypA.exe
  C:\Windows\System\KPTBypA.exe
  2⤵
  PID:8588
- C:\Windows\System\eLzjZnn.exe
  C:\Windows\System\eLzjZnn.exe
  2⤵
  PID:8724
- C:\Windows\System\ZDkEzbf.exe
  C:\Windows\System\ZDkEzbf.exe
  2⤵
  PID:8628
- C:\Windows\System\LFBgezu.exe
  C:\Windows\System\LFBgezu.exe
  2⤵
  PID:8356
- C:\Windows\System\akdtuRC.exe
  C:\Windows\System\akdtuRC.exe
  2⤵
  PID:8428
- C:\Windows\System\ksdKnfm.exe
  C:\Windows\System\ksdKnfm.exe
  2⤵
  PID:9032
- C:\Windows\System\BjgeeOV.exe
  C:\Windows\System\BjgeeOV.exe
  2⤵
  PID:8276
- C:\Windows\System\HaRIkMl.exe
  C:\Windows\System\HaRIkMl.exe
  2⤵
  PID:8940
- C:\Windows\System\PpikVnM.exe
  C:\Windows\System\PpikVnM.exe
  2⤵
  PID:8544
- C:\Windows\System\OGEddlb.exe
  C:\Windows\System\OGEddlb.exe
  2⤵
  PID:9232
- C:\Windows\System\jVstPCe.exe
  C:\Windows\System\jVstPCe.exe
  2⤵
  PID:9248
- C:\Windows\System\UhWVelL.exe
  C:\Windows\System\UhWVelL.exe
  2⤵
  PID:9268
- C:\Windows\System\VwCSvaN.exe
  C:\Windows\System\VwCSvaN.exe
  2⤵
  PID:9284
- C:\Windows\System\YpgSOaS.exe
  C:\Windows\System\YpgSOaS.exe
  2⤵
  PID:9300
- C:\Windows\System\gbCaKWy.exe
  C:\Windows\System\gbCaKWy.exe
  2⤵
  PID:9320
- C:\Windows\System\qwyhaza.exe
  C:\Windows\System\qwyhaza.exe
  2⤵
  PID:9336
- C:\Windows\System\NcibAHq.exe
  C:\Windows\System\NcibAHq.exe
  2⤵
  PID:9352
- C:\Windows\System\Lytnirs.exe
  C:\Windows\System\Lytnirs.exe
  2⤵
  PID:9368
- C:\Windows\System\gJJUqiJ.exe
  C:\Windows\System\gJJUqiJ.exe
  2⤵
  PID:9384
- C:\Windows\System\SezSXGy.exe
  C:\Windows\System\SezSXGy.exe
  2⤵
  PID:9400
- C:\Windows\System\NpKdiuj.exe
  C:\Windows\System\NpKdiuj.exe
  2⤵
  PID:9424
- C:\Windows\System\eUmwtaN.exe
  C:\Windows\System\eUmwtaN.exe
  2⤵
  PID:9484
- C:\Windows\System\TVBWTow.exe
  C:\Windows\System\TVBWTow.exe
  2⤵
  PID:9500
- C:\Windows\System\TcyqYdp.exe
  C:\Windows\System\TcyqYdp.exe
  2⤵
  PID:9516
- C:\Windows\System\CYvzjfu.exe
  C:\Windows\System\CYvzjfu.exe
  2⤵
  PID:9532
- C:\Windows\System\wKYYFSN.exe
  C:\Windows\System\wKYYFSN.exe
  2⤵
  PID:9548
- C:\Windows\System\OUkYDiL.exe
  C:\Windows\System\OUkYDiL.exe
  2⤵
  PID:9564
- C:\Windows\System\toYrRim.exe
  C:\Windows\System\toYrRim.exe
  2⤵
  PID:9580
- C:\Windows\System\UoqLPZQ.exe
  C:\Windows\System\UoqLPZQ.exe
  2⤵
  PID:9596
- C:\Windows\System\lLGUHat.exe
  C:\Windows\System\lLGUHat.exe
  2⤵
  PID:9612
- C:\Windows\System\YhZOqFx.exe
  C:\Windows\System\YhZOqFx.exe
  2⤵
  PID:9632
- C:\Windows\System\meamQcp.exe
  C:\Windows\System\meamQcp.exe
  2⤵
  PID:9648
- C:\Windows\System\nBGhYtU.exe
  C:\Windows\System\nBGhYtU.exe
  2⤵
  PID:9668
- C:\Windows\System\qYkNyxQ.exe
  C:\Windows\System\qYkNyxQ.exe
  2⤵
  PID:9684
- C:\Windows\System\bMJRiBv.exe
  C:\Windows\System\bMJRiBv.exe
  2⤵
  PID:9700
- C:\Windows\System\RvEHvuZ.exe
  C:\Windows\System\RvEHvuZ.exe
  2⤵
  PID:9716
- C:\Windows\System\pCwtxSo.exe
  C:\Windows\System\pCwtxSo.exe
  2⤵
  PID:9732
- C:\Windows\System\urlaPcN.exe
  C:\Windows\System\urlaPcN.exe
  2⤵
  PID:9748
- C:\Windows\System\cdJMwXG.exe
  C:\Windows\System\cdJMwXG.exe
  2⤵
  PID:9768
- C:\Windows\System\NPijGIB.exe
  C:\Windows\System\NPijGIB.exe
  2⤵
  PID:9784
- C:\Windows\System\BIYwwPF.exe
  C:\Windows\System\BIYwwPF.exe
  2⤵
  PID:9800
- C:\Windows\System\LqVASuG.exe
  C:\Windows\System\LqVASuG.exe
  2⤵
  PID:9816
- C:\Windows\System\mDoaNRq.exe
  C:\Windows\System\mDoaNRq.exe
  2⤵
  PID:9832
- C:\Windows\System\nDMiNmf.exe
  C:\Windows\System\nDMiNmf.exe
  2⤵
  PID:9856
- C:\Windows\System\OUMNftv.exe
  C:\Windows\System\OUMNftv.exe
  2⤵
  PID:9872
- C:\Windows\System\nXcmwgX.exe
  C:\Windows\System\nXcmwgX.exe
  2⤵
  PID:9892
- C:\Windows\System\JTJeKMT.exe
  C:\Windows\System\JTJeKMT.exe
  2⤵
  PID:9928
- C:\Windows\System\DzlYStY.exe
  C:\Windows\System\DzlYStY.exe
  2⤵
  PID:9944
- C:\Windows\System\jMkzEiU.exe
  C:\Windows\System\jMkzEiU.exe
  2⤵
  PID:9960
- C:\Windows\System\zLbJFtg.exe
  C:\Windows\System\zLbJFtg.exe
  2⤵
  PID:9976
- C:\Windows\System\zwymPDt.exe
  C:\Windows\System\zwymPDt.exe
  2⤵
  PID:9992
- C:\Windows\System\NUqLbKc.exe
  C:\Windows\System\NUqLbKc.exe
  2⤵
  PID:10008
- C:\Windows\System\WbLptrb.exe
  C:\Windows\System\WbLptrb.exe
  2⤵
  PID:10028
- C:\Windows\System\oPceKrN.exe
  C:\Windows\System\oPceKrN.exe
  2⤵
  PID:10044
- C:\Windows\System\yUYiWSb.exe
  C:\Windows\System\yUYiWSb.exe
  2⤵
  PID:10064
- C:\Windows\System\bqeEKyf.exe
  C:\Windows\System\bqeEKyf.exe
  2⤵
  PID:10084
- C:\Windows\System\VUXkwXd.exe
  C:\Windows\System\VUXkwXd.exe
  2⤵
  PID:10100
- C:\Windows\System\lZliyNl.exe
  C:\Windows\System\lZliyNl.exe
  2⤵
  PID:10116
- C:\Windows\System\RaJwTiO.exe
  C:\Windows\System\RaJwTiO.exe
  2⤵
  PID:10136
- C:\Windows\System\tMJESZk.exe
  C:\Windows\System\tMJESZk.exe
  2⤵
  PID:10152
- C:\Windows\System\eqmTWmH.exe
  C:\Windows\System\eqmTWmH.exe
  2⤵
  PID:10168
- C:\Windows\System\TurnZRO.exe
  C:\Windows\System\TurnZRO.exe
  2⤵
  PID:10184
- C:\Windows\System\XBAfBXg.exe
  C:\Windows\System\XBAfBXg.exe
  2⤵
  PID:10200
- C:\Windows\System\zQGIVWf.exe
  C:\Windows\System\zQGIVWf.exe
  2⤵
  PID:10220
- C:\Windows\System\fXbZOit.exe
  C:\Windows\System\fXbZOit.exe
  2⤵
  PID:10236
- C:\Windows\System\PjTrbYc.exe
  C:\Windows\System\PjTrbYc.exe
  2⤵
  PID:9224
- C:\Windows\System\JQxIwXe.exe
  C:\Windows\System\JQxIwXe.exe
  2⤵
  PID:9264
- C:\Windows\System\ssVIxFV.exe
  C:\Windows\System\ssVIxFV.exe
  2⤵
  PID:9140
- C:\Windows\System\RyAWkxX.exe
  C:\Windows\System\RyAWkxX.exe
  2⤵
  PID:8916
- C:\Windows\System\QEvHybg.exe
  C:\Windows\System\QEvHybg.exe
  2⤵
  PID:9316
- C:\Windows\System\ivVWLSp.exe
  C:\Windows\System\ivVWLSp.exe
  2⤵
  PID:9380
- C:\Windows\System\LADYfZD.exe
  C:\Windows\System\LADYfZD.exe
  2⤵
  PID:9332
- C:\Windows\System\blgwdFL.exe
  C:\Windows\System\blgwdFL.exe
  2⤵
  PID:9432
- C:\Windows\System\hxYmaFP.exe
  C:\Windows\System\hxYmaFP.exe
  2⤵
  PID:9524
- C:\Windows\System\YggkFoz.exe
  C:\Windows\System\YggkFoz.exe
  2⤵
  PID:9480
- C:\Windows\System\bDIEDOa.exe
  C:\Windows\System\bDIEDOa.exe
  2⤵
  PID:9456
- C:\Windows\System\XIOeeYj.exe
  C:\Windows\System\XIOeeYj.exe
  2⤵
  PID:9476
- C:\Windows\System\xojWrZh.exe
  C:\Windows\System\xojWrZh.exe
  2⤵
  PID:9544
- C:\Windows\System\sGawDqU.exe
  C:\Windows\System\sGawDqU.exe
  2⤵
  PID:9572
- C:\Windows\System\fooNEfY.exe
  C:\Windows\System\fooNEfY.exe
  2⤵
  PID:9588
- C:\Windows\System\leOsWrZ.exe
  C:\Windows\System\leOsWrZ.exe
  2⤵
  PID:9628
- C:\Windows\System\yMgJoSy.exe
  C:\Windows\System\yMgJoSy.exe
  2⤵
  PID:9692
- C:\Windows\System\kplCBGV.exe
  C:\Windows\System\kplCBGV.exe
  2⤵
  PID:9756
- C:\Windows\System\MvUEFLM.exe
  C:\Windows\System\MvUEFLM.exe
  2⤵
  PID:9680
- C:\Windows\System\HygoqNy.exe
  C:\Windows\System\HygoqNy.exe
  2⤵
  PID:9864
- C:\Windows\System\QjGMQKX.exe
  C:\Windows\System\QjGMQKX.exe
  2⤵
  PID:9708
- C:\Windows\System\SYYYQcE.exe
  C:\Windows\System\SYYYQcE.exe
  2⤵
  PID:9776
- C:\Windows\System\uVbMUVS.exe
  C:\Windows\System\uVbMUVS.exe
  2⤵
  PID:9844
- C:\Windows\System\BUaQKoo.exe
  C:\Windows\System\BUaQKoo.exe
  2⤵
  PID:9900
- C:\Windows\System\BXfzDdj.exe
  C:\Windows\System\BXfzDdj.exe
  2⤵
  PID:9916

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\BFZKQgy.exe

Filesize
1.5MB

MD5
a5456c77776a979807491704690ba7f7

SHA1
5226d71bf2fd0e850b85cad70679ffb323de122c

SHA256
2b6a6be6f5216c7c5b4b991f3cd826dfdb0f47e8fda05e1a6c7a8bbdb1fd2dee

SHA512
c254b3435b9cb8faf2966c28dff9d9b2b804abe0796548f4271502223b4bd9a5171ca4cff3ea8cf6d5e155f7c5868495e1dbc532101c05d603447848364ef14d

Download Submit
C:\Windows\system\BIFOgNt.exe

Filesize
1.5MB

MD5
a30d1109b54deb3282ce7051e4a6093e

SHA1
682dba22cc3929b04f780bf7ec6a52a2516cdd6c

SHA256
3e9911d458d17d0d600b487d0813dd32a40f736b7e3365102ab48cd0e5194d9c

SHA512
3f2abd2624bfb5c2f265d0e13385ba70906bc88c69e5eb0abe6e2598a8dfcf38059fe705f282a5de9c61949492ffd2c7e3b6708d0c0031a85864789662f4b6e6

Download Submit
C:\Windows\system\CVBLokf.exe

Filesize
1.5MB

MD5
f8b16137d4d2626d5e9afa0879a20ff2

SHA1
7632d26afd0c1a5bf467673f39007f07233352c4

SHA256
ec74950731464c938ce73a109ab44e7f8e6242d3435bbecdb65f2bd352c919f5

SHA512
3783386395efb3765c2541015ec7048cd6221a121917fde9acb9f19b2a78d67981b4880dffa5cf6658b51dcab4cab32fdd4453b44b86bb2ffcf591e4b8d7017f

Download Submit
C:\Windows\system\FKXwjjh.exe

Filesize
1.5MB

MD5
38afe68e40193889eea10fd825d0b26d

SHA1
495c658d27b7ccabdf8b60e13b26e5713ee3f51a

SHA256
3dd12b69b73fa03402137ccfdd47e0803b978f566179108eb6be6fbd8534bc74

SHA512
b428595a19db1a07c0c8830873521038f2ad372903d37dd0d3b4dee5e445d82e7d5b7c9dc545a196c730193e368353fb1cc1f5c292419a091b97142748dff743

Download Submit
C:\Windows\system\KlffrNS.exe

Filesize
1.5MB

MD5
a8c84cf7ae7fab072fe0ee501ba696c0

SHA1
9950a6fa1f564dd9420210d35db80cd4db735b13

SHA256
085dad6aa31101abc1e78b8ddc2765a9bf23fdda2684b99fa166bb3ca8fdd464

SHA512
f111401f6d20c47858120f56b77ee750497d8b76f01187e72d0977da842593afd8141c80839e1b2a01f8617ecf2dd3962a10086557a1c55fa87af02fcf44a2c1

Download Submit
C:\Windows\system\SJlOszs.exe

Filesize
1.5MB

MD5
58c32a65a69ae339ca92a0987b5146b1

SHA1
ace24c88d9da1937ebfa96678ee71c4dafaf0dc8

SHA256
8eff3573b5eaf595f20245a3f473e86abbfbde7dd317b445f67e1dc959fedeee

SHA512
d7a3005235bc9b3adba85cd84f88c8ecb8e5377824ac21d3daf82303646b253fb6914e6636bc2aa0602e756a234c241ef55347d6cd997b819f0de454edcaf68a

Download Submit
C:\Windows\system\WnMSgEY.exe

Filesize
1.5MB

MD5
420257c173c2a0419129369effcb8c1a

SHA1
6449221ce6e1cc9985c057f32fc87da5139e15a5

SHA256
043efcd67a51d923358b93791a50d001011434188be44ce279c44cc102d354d8

SHA512
5d0e59a63f8a38358df228890725ffb149c679090a17b643935ab56e564abc4df7b3b8ccdf648fd8d009111c6c476f1dd47d67a120f8d0162971f9125d7e9a6e

Download Submit
C:\Windows\system\YLAHSCP.exe

Filesize
1.5MB

MD5
ce28c13683ee2468f39929b99373c799

SHA1
955162c88a32f8797b63f19c886ab6091beef34a

SHA256
0d668cfdea38bc33ff787d1c2bac02ea719ee9c8a10f75ba000829d5147b21b7

SHA512
e1175b9dec11d7d214be409b6b1a9239bf18d9d83a38ee8d3afc334280bf6f214c6f4724df363ade3852f7876667b33e316ff5a79db7fe93bd5cc6b6f3191487

Download Submit
C:\Windows\system\YSpAGmQ.exe

Filesize
1.5MB

MD5
d4894adfcdf3becb857355d3f4a73633

SHA1
bd847d83b6981019c4810198e230d58eff5f84db

SHA256
ff27df80fecc97116f591c0787bf6960362681f9d153e1c2db7b3013b03ca2d1

SHA512
9b8f0364104b87941e3cb06c0e9cee66fb82f27db37473618e9e9f10e814ed467f72e4b39db433f3e4432027ec27dce04e37cc19dee40c45e7d01b83be6f99d8

Download Submit
C:\Windows\system\gCtgPDJ.exe

Filesize
1.5MB

MD5
ebcb6e99635fd1390f6b78f2724dde25

SHA1
1f2375c970aaae2dd2aea5b4cc04733f9a1bdd10

SHA256
b84a9aab4c3b50fffe9a3bc3651f1e32b127798f6de61f7d7cffe7628071a985

SHA512
c8a2d24648f9d1ebbb457426debb04ef849c069f155ae293c72e26b2fe05f185c2d4d1ce2fef4f04dd49e72c55ac0a827030aa705dd3d6fe6b2a84553c1f1a54

Download Submit
C:\Windows\system\gOBUQNq.exe

Filesize
1.5MB

MD5
dd7ce4965cc0f9057c82a67462c79fb0

SHA1
1400b6b94813babcf906e5dbe3906195bfaff20a

SHA256
549d497dc7bfd333974436112bf3d8ab13eb70a45dd8df314920308cbf8da696

SHA512
3c6b5e78180d45cefd08525d23c11162967c4bdfb697b89d5210e295239941e6a527d84aeec81dd9f9967ef9800afae9b342e7ea7eb1e2dd1155d7a03a1a8e38

Download Submit
C:\Windows\system\iEkSeyI.exe

Filesize
1.5MB

MD5
2d9c7fe04048e3b078c53cfa74d4b6a3

SHA1
bf2aae45f2531335c0128bc2f41cb781768137f9

SHA256
8a211657518223a756808bdbb0e48e814fe60b6fe70c3af92e19ff4ea7d44138

SHA512
23e923f2a407614be348df259a78dd115b1be77dd6cf97a8af6d29ac77e16e618386b479ee65f5070baaaad0e3f91d4f9fc6e00d36bdf9362576e989703c7a33

Download Submit
C:\Windows\system\iVUydcu.exe

Filesize
1.5MB

MD5
e6483b63384cfcef8f7d32de2bd61336

SHA1
8aa15573680063bb4b717b25a75c46b19d9686e5

SHA256
e4aeae3ab05724a2d58ab63d6813a58f09902d1880cf2435742178789ad43ea1

SHA512
2875b7d5e532f8bb84c0ed84f09fafbeb76df961269ccfac93b5ab250f5f29ff7a543f097f7e4db2e7f111185fcb6d54f40ff8cbd3139a57f420110d61b27eb0

Download Submit
C:\Windows\system\jjwdgSv.exe

Filesize
1.5MB

MD5
4a0f4201622bc6393d09893be7784768

SHA1
12ae09ff21d1dc39b89e78731c4a6e0f8096a180

SHA256
94e97f9e013529054a28900880b518746153e32258dd3ee01b34e259ab5a9f28

SHA512
c1e496d076d44e94dc758f2bb4fd515215e359fda64ec23f1729b363fda4abd9f7576b8bb5a95f670b5ed3d1e9f8c3a5e94c46ab5ef2dd67064eeeaf4569905e

Download Submit
C:\Windows\system\jtqUdTG.exe

Filesize
1.5MB

MD5
02fda1b5a48f6dbe7e95c768ebe4e9df

SHA1
b08db5ce29241f79a9ea8d1eb1968050b1ecb635

SHA256
771314ee406b4b4758c8369c6b8842dbb7a42ca8bbcf2a4df6a029ebc5f8986e

SHA512
a19f60b0cd9483a350aa9e09c26ed759c1bc799b938ec14a73ad5c938a0b1d271bf0d0881f0986f0d6c37702cf40f9f31f153a174a3227fa20701b3ed92417a7

Download Submit
C:\Windows\system\lMuDdEe.exe

Filesize
1.5MB

MD5
016075379667b665d9dc0898804558ed

SHA1
c062728041ab076f3aebf1a3fbf65a85c2c47867

SHA256
d0f09b4d98cd7221881d90d3c6a6bdd8fc9e81950358807554a5e9fb7bdd3dad

SHA512
494dbd7f5ee8cbb6d21b4c119e2de99c472b918b99f877d0c333ef08f31a8ee888f44e6e0a582cd7ee3e346a015663fa4f2fd8ca5bd19138e7b8b362dd085f95

Download Submit
C:\Windows\system\niheioe.exe

Filesize
1.5MB

MD5
166f2e4267c1600b1c956f5f57cdad33

SHA1
bd2845e023f76936fceb0aa7cf53a7434e2fd218

SHA256
fcdd4150945ad879258d728dd8b86b96367e149ed8f896beffbf7531844febab

SHA512
f034f85f38d3bd5c662903404cce8f255cddcb9163038b2dda8c8fe8590deabf1d2a0d1b2836524c008cad1524fb38b5af63d847043d75ceb5411c636c4980cd

Download Submit
C:\Windows\system\pdPmGgT.exe

Filesize
1.5MB

MD5
5fc33befc5204a70c18ee2902fb97b00

SHA1
aa5aeeeb944735f4e3534ebc767ce40238feca46

SHA256
775af3511c41dc402e8ff7c237928d8144e6e7a0d19c67ea8a32460f4496c777

SHA512
3b1750c47cbcf184a8ec10abeb42019d8f55228e977ae256f54038485509ef4530fb0f6207549a14a6e8c6a144c9f8ef98019ae28a270be40aea934fad5ca904

Download Submit
C:\Windows\system\qDFpIKE.exe

Filesize
1.5MB

MD5
74e7c45f0b9505daad7859b840c85b02

SHA1
bb49095a83ba1d0d24fd267e1a1e0d365136b801

SHA256
6d4c59eabad4e0b21cebb92baaffbf03afcaf8edc6fe4278aa88105cfd91d88f

SHA512
60ac9ad3b8073c883f4b39e8e740454008f0149cc6643dc434e6baaf6ac2ef1cd5b829e4e566e960ab0dc423a18c6a1179daee469704ca06b0c45713440d3dbb

Download Submit
C:\Windows\system\qnWEoBa.exe

Filesize
1.5MB

MD5
55095c1385cf2e95eec46504db2f59c1

SHA1
1edd44407d2534ec23c6d5c6ed83e0bcfd8cafd1

SHA256
4d1e4eebfe98f0a8e63698e01de2976b76f449bf74a594d63bc617b7f580a97e

SHA512
0ca01cd6becae28ef3d6e736a49260a8c49ce1d9e622c16bac50425060302ba8d3c923c5f0d3d774ff3ed2923e8ad62f5335dfd2ff744eca16619f7972e63602

Download Submit
C:\Windows\system\syKcxix.exe

Filesize
1.5MB

MD5
25484dd2dcd8e950eac1213bd9fa56d9

SHA1
4cc690d151deba99b244c280096bea0dc80d54ee

SHA256
f87f0491ed4aa475ff0dcb45662ee5eb2cc9e2bcb4f4c6fc6f4c75fd2bf99eb1

SHA512
a83b095985c43bb18c9827e907d6b02c9a0629e195ce52ba214ac56695a44e8c497f00d67c9f273f17c47fc3aefa7ce6f11f3313c03364dbcba826e7002f6eff

Download Submit
C:\Windows\system\twJCMSf.exe

Filesize
1.5MB

MD5
1758507e89835a1c5b036b7db4d2de74

SHA1
68d2a8d2a66bd0d60e2e9b727ccd8a34cc2e27c4

SHA256
09112949ef0d9fc94ecabddba07b0b45895009cbd6cb4e629bac125093cbf6da

SHA512
f93efa697995f79141e376bb8405db7c03a24872aa7b0abc0ca1c70773b831d90d02fcc117f696244fa73e7d6ebdf836b170056f1f1e8d26c4b4d948fedeede1

Download Submit
C:\Windows\system\uFyijuz.exe

Filesize
1.5MB

MD5
9a51d01d773e8b15907e6eb6c459a046

SHA1
6743d226d851651ed911e7c5a14b522cfc0fc68c

SHA256
6370dbdbb65bceaace36805a0b4a9d40fa37807b494b0e676266da54abc6ebf1

SHA512
c0a2e797a42b2cf84683629220b20002cb0e7d089b4291c477db665c7bfbd9c1a60ccf0021cf5b3c41a757e75868774fedce0442848f41afd053ba85d05f37a5

Download Submit
C:\Windows\system\wrijLRt.exe

Filesize
1.5MB

MD5
863fd650d496376a1e738837c767df0b

SHA1
3266064fe6c7311c9f62ab37d6e357dcf979d61c

SHA256
eafed2f36a663d7bf5be22f6d87d79f5975dab4052224bd7232d621d50f97594

SHA512
cf9ad67bf71a5bd1e2679402d574b8d62d92b041ca8fff2df245bde432e80755a067581207c010b7bfe3a52a32e250bfc3a73bd4b46573d1cd40476305d1bc0e

Download Submit
C:\Windows\system\yDMYiTS.exe

Filesize
1.5MB

MD5
214e95f1a8be4d19f23f7943aeb57e88

SHA1
943dc2ae2abf3dcba38c42d4845cdee52bf65808

SHA256
18d049b9f372d047b647075c1579e711f0b466b6f1ff7ba35045e08ab3c5944a

SHA512
ce5379f5d7b20b67b1669e7b04e5e9a776db7439c12c4479a56de2049ac78a17b71324176b3772d7815f6c4e608938986e3be8750bdf2472c75dd9dfb6834b39

Download Submit
C:\Windows\system\zetuaCB.exe

Filesize
1.5MB

MD5
25514b4e1c3decc28704fe81a79548e6

SHA1
6fcbb569e7238bdbeaecbf62ae696c364aa9e548

SHA256
a367e87afc60901d48ecd2629057f34dc9e39ffa98d987f68bba6ead41264d33

SHA512
49591b6272b86fc6eb5de3e125508a2650f6f0c782234a08bcb146821897057a2266cf20f9c2bc2b4b28e171b56f5a51d333d91860efa5df035e3885c1fb5bfb

Download Submit
\Windows\system\FRttmEv.exe

Filesize
1.5MB

MD5
970e8072a664ed3627d769e863575e5c

SHA1
64dc27391fdcf2b10f27106c95df88261d26b856

SHA256
b309f622185fe2ba3bf071991c98ca501a2008ffb42a2072b681f8f83370d6b5

SHA512
85d76e7dea3742e9c6e71c1caff4e38be8218833e1a39dbbc4c8fa9c6c90198429601319dff06088d846f960efde969f63953380832c780a0ae2b5540e3c6e8e

Download Submit
\Windows\system\HzeiXxz.exe

Filesize
1.5MB

MD5
346f4f8ce0a0b7819eb89f27d9ce9e03

SHA1
d8e1ebed7bf06bcd7b581d3d8278dabff4d7e99c

SHA256
681a23ce4ae36c37d8570de09a2adc17b946dfa28c18c73aaa883606a0078bcb

SHA512
e12901a3481e7c09530c2a190a6b6716ac2c954a37b4dab20bc77233af55dc7f8d49956482749e898c0554fcb7b6bc2a61467c57e88668e4a6315e6657dd1ed4

Download Submit
\Windows\system\OGUcGNs.exe

Filesize
1.5MB

MD5
e5c811cee25b73909c269bb42649177f

SHA1
57d3e6d4847a2d17e606856fd0ccfa0c5216b80f

SHA256
61a490ac07af26f8cd75ae9992578f87717eeda8a221dd24c4237ec7eced3007

SHA512
6fae8e8adc2eeabe8f2652352f88bce82c7030ba76b640b5bf651f79f77dae472c136a9c945d832a315f03d1d92951706557f88af857509e95669dc8d9261bf9

Download Submit
\Windows\system\bhxlmxh.exe

Filesize
1.5MB

MD5
8ac462b01666a34b5a4174c5113870c2

SHA1
61cc900aaf16880d2d7a578fb31772b6f5573d34

SHA256
24e29e62c14dc5a6217abd8386826048cbff7449e1d659631a9af7bc85266d7a

SHA512
bd93345bfb51abdd9edc568f093f839b61555c4a3b9685e7aeb053208581e6525c1e018557673c597b10d20db8d33f8358efa741728cca1c07142d9dc2026442

Download Submit
\Windows\system\dcdVfJY.exe

Filesize
1.5MB

MD5
df565f7d4737a440d07f73b150da2512

SHA1
8b892c8c76ba75c347ea96637d6c75bbcf8a745e

SHA256
4cc46b818f6096901b5637ea27bf557f93984b44712d37d7dd1e6ca003f98ca3

SHA512
1289bc4f8044e833f6d8207e98a76d5faadd7b34f4cae51686042edbbaa7e7fdb9e9a3d733bf69939d55202cc511d508cacc30f4c099cdfafb6d5c301587e331

Download Submit
\Windows\system\pRENKgu.exe

Filesize
1.5MB

MD5
3b61830059e6bf78bf8118f816027a6a

SHA1
e329ad263a5e6c7d9e6631b110793cf5f34c0728

SHA256
a8ac249eb1146b5c36cfc5950cebb4d383dc98c42e01c524e630073d14f3a6bb

SHA512
710dc264832bff73314212f242ba50abdbbcd189329c49a27ace674ad4c2b54b97a9aac3ad968399d946b818fedc36047c894e3de8efc44e7f011dc56043005a

Download Submit
memory/1728-86-0x000000013F460000-0x000000013F852000-memory.dmp

Filesize
3.9MB

Download
memory/1728-8547-0x000000013FEB0000-0x00000001402A2000-memory.dmp

Filesize
3.9MB

Download
memory/1728-1-0x00000000000F0000-0x0000000000100000-memory.dmp

Filesize
64KB

Download
memory/1728-91-0x000000013F530000-0x000000013F922000-memory.dmp

Filesize
3.9MB

Download
memory/1728-88-0x000000013F4B0000-0x000000013F8A2000-memory.dmp

Filesize
3.9MB

Download
memory/1728-0-0x000000013FEB0000-0x00000001402A2000-memory.dmp

Filesize
3.9MB

Download
memory/1728-83-0x000000013FA70000-0x000000013FE62000-memory.dmp

Filesize
3.9MB

Download
memory/1728-62-0x00000000030D0000-0x00000000034C2000-memory.dmp

Filesize
3.9MB

Download
memory/1728-74-0x00000000030D0000-0x00000000034C2000-memory.dmp

Filesize
3.9MB

Download
memory/1728-9044-0x000000013F460000-0x000000013F852000-memory.dmp

Filesize
3.9MB

Download
memory/1728-98-0x000000013FA90000-0x000000013FE82000-memory.dmp

Filesize
3.9MB

Download
memory/1728-97-0x000000013F530000-0x000000013F922000-memory.dmp

Filesize
3.9MB

Download
memory/1728-96-0x000000013F400000-0x000000013F7F2000-memory.dmp

Filesize
3.9MB

Download
memory/1728-65-0x000000013F5B0000-0x000000013F9A2000-memory.dmp

Filesize
3.9MB

Download
memory/1728-7-0x000000013F4F0000-0x000000013F8E2000-memory.dmp

Filesize
3.9MB

Download
memory/1728-79-0x00000000030D0000-0x00000000034C2000-memory.dmp

Filesize
3.9MB

Download
memory/1728-82-0x000000013F720000-0x000000013FB12000-memory.dmp

Filesize
3.9MB

Download
memory/1972-568-0x0000000001F30000-0x0000000001F38000-memory.dmp

Filesize
32KB

Download
memory/1972-90-0x000000001B5E0000-0x000000001B8C2000-memory.dmp

Filesize
2.9MB

Download
memory/2256-5220-0x000000013F460000-0x000000013F852000-memory.dmp

Filesize
3.9MB

Download
memory/2256-87-0x000000013F460000-0x000000013F852000-memory.dmp

Filesize
3.9MB

Download
memory/2432-5221-0x000000013F400000-0x000000013F7F2000-memory.dmp

Filesize
3.9MB

Download
memory/2432-89-0x000000013F400000-0x000000013F7F2000-memory.dmp

Filesize
3.9MB

Download
memory/2476-5180-0x000000013F4F0000-0x000000013F8E2000-memory.dmp

Filesize
3.9MB

Download
memory/2476-29-0x000000013F4F0000-0x000000013F8E2000-memory.dmp

Filesize
3.9MB

Download
memory/2516-5184-0x000000013F530000-0x000000013F922000-memory.dmp

Filesize
3.9MB

Download
memory/2516-54-0x000000013F530000-0x000000013F922000-memory.dmp

Filesize
3.9MB

Download
memory/2520-5192-0x000000013FB60000-0x000000013FF52000-memory.dmp

Filesize
3.9MB

Download
memory/2520-78-0x000000013FB60000-0x000000013FF52000-memory.dmp

Filesize
3.9MB

Download
memory/2564-5224-0x000000013F720000-0x000000013FB12000-memory.dmp

Filesize
3.9MB

Download
memory/2564-95-0x000000013F720000-0x000000013FB12000-memory.dmp

Filesize
3.9MB

Download
memory/2584-72-0x000000013F5B0000-0x000000013F9A2000-memory.dmp

Filesize
3.9MB

Download
memory/2600-5216-0x000000013FE10000-0x0000000140202000-memory.dmp

Filesize
3.9MB

Download
memory/2600-64-0x000000013FE10000-0x0000000140202000-memory.dmp

Filesize
3.9MB

Download
memory/2692-5187-0x000000013FEB0000-0x00000001402A2000-memory.dmp

Filesize
3.9MB

Download
memory/2692-80-0x000000013FEB0000-0x00000001402A2000-memory.dmp

Filesize
3.9MB

Download
memory/2716-5218-0x000000013FA90000-0x000000013FE82000-memory.dmp

Filesize
3.9MB

Download
memory/2716-99-0x000000013FA90000-0x000000013FE82000-memory.dmp

Filesize
3.9MB

Download
memory/2856-5217-0x000000013FA70000-0x000000013FE62000-memory.dmp

Filesize
3.9MB

Download
memory/2856-84-0x000000013FA70000-0x000000013FE62000-memory.dmp

Filesize
3.9MB

Download