xmrig | 406c56caf38a4b2a8ce2f1a7217f3326bac6acac97f1133866e20ea42b017f30

Analysis

max time kernel
148s
max time network
154s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
07/05/2024, 23:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

61b06d8e8f56a599a5302a3c9aa81a70_NEIKI.exe
Size

1.5MB
MD5

61b06d8e8f56a599a5302a3c9aa81a70
SHA1

2c26dd1620de369d2cfd38f31e097cbf63f4a0be
SHA256

406c56caf38a4b2a8ce2f1a7217f3326bac6acac97f1133866e20ea42b017f30
SHA512

9ba1f339f98b9acb8ab20377132d33c695c23c1469bcf7dd33041606f0267646864277d8f7328b4aca7e0342142312ab403af9c3a55e93fd22f830933158f23d
SSDEEP

24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjhMgXQP9+G5KBe2ulQ9lbQHRlaEA:Lz071uv4BPMkHC0INx29L5KQ2uIbQH0

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 22 IoCs

miner

resource	yara_rule
behavioral1/memory/2504-13-0x000000013F770000-0x000000013FB62000-memory.dmp	xmrig
behavioral1/memory/552-89-0x000000013F950000-0x000000013FD42000-memory.dmp	xmrig
behavioral1/memory/1108-108-0x000000013F290000-0x000000013F682000-memory.dmp	xmrig
behavioral1/memory/2672-105-0x000000013F8D0000-0x000000013FCC2000-memory.dmp	xmrig
behavioral1/memory/2560-104-0x000000013FBF0000-0x000000013FFE2000-memory.dmp	xmrig
behavioral1/memory/2908-101-0x000000013F160000-0x000000013F552000-memory.dmp	xmrig
behavioral1/memory/2544-100-0x000000013FA80000-0x000000013FE72000-memory.dmp	xmrig
behavioral1/memory/2500-94-0x000000013FF00000-0x00000001402F2000-memory.dmp	xmrig
behavioral1/memory/2592-86-0x000000013F450000-0x000000013F842000-memory.dmp	xmrig
behavioral1/memory/1488-84-0x000000013F760000-0x000000013FB52000-memory.dmp	xmrig
behavioral1/memory/2816-82-0x000000013F030000-0x000000013F422000-memory.dmp	xmrig
behavioral1/memory/1488-1618-0x000000013F760000-0x000000013FB52000-memory.dmp	xmrig
behavioral1/memory/2500-1639-0x000000013FF00000-0x00000001402F2000-memory.dmp	xmrig
behavioral1/memory/2560-1638-0x000000013FBF0000-0x000000013FFE2000-memory.dmp	xmrig
behavioral1/memory/2544-1637-0x000000013FA80000-0x000000013FE72000-memory.dmp	xmrig
behavioral1/memory/2592-1633-0x000000013F450000-0x000000013F842000-memory.dmp	xmrig
behavioral1/memory/2908-1656-0x000000013F160000-0x000000013F552000-memory.dmp	xmrig
behavioral1/memory/2504-1680-0x000000013F770000-0x000000013FB62000-memory.dmp	xmrig
behavioral1/memory/1108-1678-0x000000013F290000-0x000000013F682000-memory.dmp	xmrig
behavioral1/memory/2816-1664-0x000000013F030000-0x000000013F422000-memory.dmp	xmrig
behavioral1/memory/552-1653-0x000000013F950000-0x000000013FD42000-memory.dmp	xmrig
behavioral1/memory/2672-1650-0x000000013F8D0000-0x000000013FCC2000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
668	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
2504	tZzhEpT.exe
1108	zOLsntj.exe
2816	PuwSBsL.exe
1488	FdftIHd.exe
2592	tXKjhJO.exe
552	IBMlOXi.exe
2500	LvoKZqp.exe
2544	YaztjQy.exe
2908	AmYHJkr.exe
2560	YPHvBlN.exe
2672	eXbjtDB.exe
2532	kApBgst.exe
2612	GPcYDfF.exe
2444	YOWkjwJ.exe
2280	EvJHDeV.exe
1264	FeQFOoR.exe
2176	QcpJKNd.exe
1252	oUHdaBp.exe
2192	vQAjgoR.exe
1924	hahAYuC.exe
2204	gYarxHC.exe
2300	bodShoJ.exe
1648	sLZoDcJ.exe
1628	HUtFAaV.exe
944	JYDQsJH.exe
1548	NhUZpfl.exe
1656	teIuRIx.exe
2368	RXzDnkL.exe
1424	XQXTEaY.exe
2016	hdhRSwz.exe
1672	iwIFgOS.exe
1272	OYHEOQF.exe
1516	upCwLBl.exe
1588	diwXcvM.exe
1880	SxDThgV.exe
1156	XUthrpv.exe
1820	woLGthb.exe
1876	XoHVvsn.exe
2040	wHKYdbr.exe
2244	AFfjJwr.exe
2024	ddcrpUa.exe
2144	gjmPjqX.exe
1772	MEMYbwP.exe
2108	TUAXAhg.exe
388	UEEcctx.exe
1584	rzlofdU.exe
1752	CwMPdPL.exe
2912	eqqPIhu.exe
372	owmeOji.exe
1572	coLPIAJ.exe
1568	nIOfFee.exe
1608	boqGoHT.exe
3008	pcazkOA.exe
2800	CRtJKRp.exe
2088	KdrPIVc.exe
2744	qdTEAqu.exe
1872	ExbhXqr.exe
2900	KvYiMRN.exe
2656	aKLuUva.exe
2524	ZCelmAc.exe
2572	TECOrJH.exe
2596	kiLbKte.exe
588	ZUrOqiv.exe
2632	flXmcbq.exe

Loads dropped DLL 64 IoCs

pid	Process
2140	61b06d8e8f56a599a5302a3c9aa81a70_NEIKI.exe
2140	61b06d8e8f56a599a5302a3c9aa81a70_NEIKI.exe
2140	61b06d8e8f56a599a5302a3c9aa81a70_NEIKI.exe
2140	61b06d8e8f56a599a5302a3c9aa81a70_NEIKI.exe
2140	61b06d8e8f56a599a5302a3c9aa81a70_NEIKI.exe
2140	61b06d8e8f56a599a5302a3c9aa81a70_NEIKI.exe
2140	61b06d8e8f56a599a5302a3c9aa81a70_NEIKI.exe
2140	61b06d8e8f56a599a5302a3c9aa81a70_NEIKI.exe
2140	61b06d8e8f56a599a5302a3c9aa81a70_NEIKI.exe
2140	61b06d8e8f56a599a5302a3c9aa81a70_NEIKI.exe
2140	61b06d8e8f56a599a5302a3c9aa81a70_NEIKI.exe
2140	61b06d8e8f56a599a5302a3c9aa81a70_NEIKI.exe
2140	61b06d8e8f56a599a5302a3c9aa81a70_NEIKI.exe
2140	61b06d8e8f56a599a5302a3c9aa81a70_NEIKI.exe
2140	61b06d8e8f56a599a5302a3c9aa81a70_NEIKI.exe
2140	61b06d8e8f56a599a5302a3c9aa81a70_NEIKI.exe
2140	61b06d8e8f56a599a5302a3c9aa81a70_NEIKI.exe
2140	61b06d8e8f56a599a5302a3c9aa81a70_NEIKI.exe
2140	61b06d8e8f56a599a5302a3c9aa81a70_NEIKI.exe
2140	61b06d8e8f56a599a5302a3c9aa81a70_NEIKI.exe
2140	61b06d8e8f56a599a5302a3c9aa81a70_NEIKI.exe
2140	61b06d8e8f56a599a5302a3c9aa81a70_NEIKI.exe
2140	61b06d8e8f56a599a5302a3c9aa81a70_NEIKI.exe
2140	61b06d8e8f56a599a5302a3c9aa81a70_NEIKI.exe
2140	61b06d8e8f56a599a5302a3c9aa81a70_NEIKI.exe
2140	61b06d8e8f56a599a5302a3c9aa81a70_NEIKI.exe
2140	61b06d8e8f56a599a5302a3c9aa81a70_NEIKI.exe
2140	61b06d8e8f56a599a5302a3c9aa81a70_NEIKI.exe
2140	61b06d8e8f56a599a5302a3c9aa81a70_NEIKI.exe
2140	61b06d8e8f56a599a5302a3c9aa81a70_NEIKI.exe
2140	61b06d8e8f56a599a5302a3c9aa81a70_NEIKI.exe
2140	61b06d8e8f56a599a5302a3c9aa81a70_NEIKI.exe
2140	61b06d8e8f56a599a5302a3c9aa81a70_NEIKI.exe
2140	61b06d8e8f56a599a5302a3c9aa81a70_NEIKI.exe
2140	61b06d8e8f56a599a5302a3c9aa81a70_NEIKI.exe
2140	61b06d8e8f56a599a5302a3c9aa81a70_NEIKI.exe
2140	61b06d8e8f56a599a5302a3c9aa81a70_NEIKI.exe
2140	61b06d8e8f56a599a5302a3c9aa81a70_NEIKI.exe
2140	61b06d8e8f56a599a5302a3c9aa81a70_NEIKI.exe
2140	61b06d8e8f56a599a5302a3c9aa81a70_NEIKI.exe
2140	61b06d8e8f56a599a5302a3c9aa81a70_NEIKI.exe
2140	61b06d8e8f56a599a5302a3c9aa81a70_NEIKI.exe
2140	61b06d8e8f56a599a5302a3c9aa81a70_NEIKI.exe
2140	61b06d8e8f56a599a5302a3c9aa81a70_NEIKI.exe
2140	61b06d8e8f56a599a5302a3c9aa81a70_NEIKI.exe
2140	61b06d8e8f56a599a5302a3c9aa81a70_NEIKI.exe
2140	61b06d8e8f56a599a5302a3c9aa81a70_NEIKI.exe
2140	61b06d8e8f56a599a5302a3c9aa81a70_NEIKI.exe
2140	61b06d8e8f56a599a5302a3c9aa81a70_NEIKI.exe
2140	61b06d8e8f56a599a5302a3c9aa81a70_NEIKI.exe
2140	61b06d8e8f56a599a5302a3c9aa81a70_NEIKI.exe
2140	61b06d8e8f56a599a5302a3c9aa81a70_NEIKI.exe
2140	61b06d8e8f56a599a5302a3c9aa81a70_NEIKI.exe
2140	61b06d8e8f56a599a5302a3c9aa81a70_NEIKI.exe
2140	61b06d8e8f56a599a5302a3c9aa81a70_NEIKI.exe
2140	61b06d8e8f56a599a5302a3c9aa81a70_NEIKI.exe
2140	61b06d8e8f56a599a5302a3c9aa81a70_NEIKI.exe
2140	61b06d8e8f56a599a5302a3c9aa81a70_NEIKI.exe
2140	61b06d8e8f56a599a5302a3c9aa81a70_NEIKI.exe
2140	61b06d8e8f56a599a5302a3c9aa81a70_NEIKI.exe
2140	61b06d8e8f56a599a5302a3c9aa81a70_NEIKI.exe
2140	61b06d8e8f56a599a5302a3c9aa81a70_NEIKI.exe
2140	61b06d8e8f56a599a5302a3c9aa81a70_NEIKI.exe
2140	61b06d8e8f56a599a5302a3c9aa81a70_NEIKI.exe

UPX packed file 55 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2140-0-0x000000013FC40000-0x0000000140032000-memory.dmp	upx
behavioral1/files/0x000d0000000122b8-3.dat	upx
behavioral1/memory/2504-13-0x000000013F770000-0x000000013FB62000-memory.dmp	upx
behavioral1/files/0x0009000000014aec-16.dat	upx
behavioral1/files/0x000f0000000006fd-24.dat	upx
behavioral1/files/0x0009000000014b6d-26.dat	upx
behavioral1/files/0x0008000000014fe1-34.dat	upx
behavioral1/files/0x0007000000015264-35.dat	upx
behavioral1/files/0x0007000000015364-41.dat	upx
behavioral1/files/0x0006000000016cf0-50.dat	upx
behavioral1/files/0x00070000000155d4-47.dat	upx
behavioral1/files/0x0006000000016d01-65.dat	upx
behavioral1/files/0x0006000000016d24-67.dat	upx
behavioral1/files/0x0006000000016d36-70.dat	upx
behavioral1/files/0x0006000000016d11-64.dat	upx
behavioral1/files/0x0006000000016d4a-96.dat	upx
behavioral1/files/0x0006000000018b4a-196.dat	upx
behavioral1/files/0x0006000000018b37-185.dat	upx
behavioral1/files/0x0006000000018ae2-173.dat	upx
behavioral1/files/0x0005000000018698-171.dat	upx
behavioral1/files/0x0006000000018b15-168.dat	upx
behavioral1/files/0x0006000000018b42-188.dat	upx
behavioral1/files/0x0006000000018b33-176.dat	upx
behavioral1/files/0x000500000001868c-147.dat	upx
behavioral1/files/0x000600000001704f-139.dat	upx
behavioral1/files/0x0006000000018ae8-163.dat	upx
behavioral1/files/0x00050000000186a0-155.dat	upx
behavioral1/files/0x0006000000017090-143.dat	upx
behavioral1/files/0x0006000000016d89-130.dat	upx
behavioral1/files/0x0006000000016e56-133.dat	upx
behavioral1/files/0x0006000000016d84-124.dat	upx
behavioral1/files/0x0006000000016d55-119.dat	upx
behavioral1/files/0x0006000000016d4f-113.dat	upx
behavioral1/memory/552-89-0x000000013F950000-0x000000013FD42000-memory.dmp	upx
behavioral1/files/0x0006000000016d41-88.dat	upx
behavioral1/memory/1108-108-0x000000013F290000-0x000000013F682000-memory.dmp	upx
behavioral1/memory/2672-105-0x000000013F8D0000-0x000000013FCC2000-memory.dmp	upx
behavioral1/memory/2560-104-0x000000013FBF0000-0x000000013FFE2000-memory.dmp	upx
behavioral1/memory/2908-101-0x000000013F160000-0x000000013F552000-memory.dmp	upx
behavioral1/memory/2544-100-0x000000013FA80000-0x000000013FE72000-memory.dmp	upx
behavioral1/memory/2500-94-0x000000013FF00000-0x00000001402F2000-memory.dmp	upx
behavioral1/memory/2592-86-0x000000013F450000-0x000000013F842000-memory.dmp	upx
behavioral1/memory/1488-84-0x000000013F760000-0x000000013FB52000-memory.dmp	upx
behavioral1/memory/2816-82-0x000000013F030000-0x000000013F422000-memory.dmp	upx
behavioral1/memory/1488-1618-0x000000013F760000-0x000000013FB52000-memory.dmp	upx
behavioral1/memory/2500-1639-0x000000013FF00000-0x00000001402F2000-memory.dmp	upx
behavioral1/memory/2560-1638-0x000000013FBF0000-0x000000013FFE2000-memory.dmp	upx
behavioral1/memory/2544-1637-0x000000013FA80000-0x000000013FE72000-memory.dmp	upx
behavioral1/memory/2592-1633-0x000000013F450000-0x000000013F842000-memory.dmp	upx
behavioral1/memory/2908-1656-0x000000013F160000-0x000000013F552000-memory.dmp	upx
behavioral1/memory/2504-1680-0x000000013F770000-0x000000013FB62000-memory.dmp	upx
behavioral1/memory/1108-1678-0x000000013F290000-0x000000013F682000-memory.dmp	upx
behavioral1/memory/2816-1664-0x000000013F030000-0x000000013F422000-memory.dmp	upx
behavioral1/memory/552-1653-0x000000013F950000-0x000000013FD42000-memory.dmp	upx
behavioral1/memory/2672-1650-0x000000013F8D0000-0x000000013FCC2000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\vHqZSsI.exe	61b06d8e8f56a599a5302a3c9aa81a70_NEIKI.exe
File created	C:\Windows\System\sBHAtjr.exe	61b06d8e8f56a599a5302a3c9aa81a70_NEIKI.exe
File created	C:\Windows\System\UDNEfmb.exe	61b06d8e8f56a599a5302a3c9aa81a70_NEIKI.exe
File created	C:\Windows\System\IXRoWwn.exe	61b06d8e8f56a599a5302a3c9aa81a70_NEIKI.exe
File created	C:\Windows\System\hnCSSQg.exe	61b06d8e8f56a599a5302a3c9aa81a70_NEIKI.exe
File created	C:\Windows\System\rHuXSoD.exe	61b06d8e8f56a599a5302a3c9aa81a70_NEIKI.exe
File created	C:\Windows\System\hUxpPZJ.exe	61b06d8e8f56a599a5302a3c9aa81a70_NEIKI.exe
File created	C:\Windows\System\VyTWEfA.exe	61b06d8e8f56a599a5302a3c9aa81a70_NEIKI.exe
File created	C:\Windows\System\rKhBqTP.exe	61b06d8e8f56a599a5302a3c9aa81a70_NEIKI.exe
File created	C:\Windows\System\TUAXAhg.exe	61b06d8e8f56a599a5302a3c9aa81a70_NEIKI.exe
File created	C:\Windows\System\QDWtNBc.exe	61b06d8e8f56a599a5302a3c9aa81a70_NEIKI.exe
File created	C:\Windows\System\OaQkqUe.exe	61b06d8e8f56a599a5302a3c9aa81a70_NEIKI.exe
File created	C:\Windows\System\aCXtinr.exe	61b06d8e8f56a599a5302a3c9aa81a70_NEIKI.exe
File created	C:\Windows\System\fwnopNB.exe	61b06d8e8f56a599a5302a3c9aa81a70_NEIKI.exe
File created	C:\Windows\System\EgFjhsy.exe	61b06d8e8f56a599a5302a3c9aa81a70_NEIKI.exe
File created	C:\Windows\System\RzqTScp.exe	61b06d8e8f56a599a5302a3c9aa81a70_NEIKI.exe
File created	C:\Windows\System\UJgzuFZ.exe	61b06d8e8f56a599a5302a3c9aa81a70_NEIKI.exe
File created	C:\Windows\System\pwvIeUW.exe	61b06d8e8f56a599a5302a3c9aa81a70_NEIKI.exe
File created	C:\Windows\System\UNTYDfJ.exe	61b06d8e8f56a599a5302a3c9aa81a70_NEIKI.exe
File created	C:\Windows\System\BFIDpgZ.exe	61b06d8e8f56a599a5302a3c9aa81a70_NEIKI.exe
File created	C:\Windows\System\tygJPep.exe	61b06d8e8f56a599a5302a3c9aa81a70_NEIKI.exe
File created	C:\Windows\System\CpjLzKD.exe	61b06d8e8f56a599a5302a3c9aa81a70_NEIKI.exe
File created	C:\Windows\System\tXYjoCq.exe	61b06d8e8f56a599a5302a3c9aa81a70_NEIKI.exe
File created	C:\Windows\System\eJLIYYb.exe	61b06d8e8f56a599a5302a3c9aa81a70_NEIKI.exe
File created	C:\Windows\System\ErbISdL.exe	61b06d8e8f56a599a5302a3c9aa81a70_NEIKI.exe
File created	C:\Windows\System\HJxQkNk.exe	61b06d8e8f56a599a5302a3c9aa81a70_NEIKI.exe
File created	C:\Windows\System\RgFnJoY.exe	61b06d8e8f56a599a5302a3c9aa81a70_NEIKI.exe
File created	C:\Windows\System\YPHvBlN.exe	61b06d8e8f56a599a5302a3c9aa81a70_NEIKI.exe
File created	C:\Windows\System\CKjBDdL.exe	61b06d8e8f56a599a5302a3c9aa81a70_NEIKI.exe
File created	C:\Windows\System\osJLkoh.exe	61b06d8e8f56a599a5302a3c9aa81a70_NEIKI.exe
File created	C:\Windows\System\LwuCUQb.exe	61b06d8e8f56a599a5302a3c9aa81a70_NEIKI.exe
File created	C:\Windows\System\zRnlIsw.exe	61b06d8e8f56a599a5302a3c9aa81a70_NEIKI.exe
File created	C:\Windows\System\UHkbcew.exe	61b06d8e8f56a599a5302a3c9aa81a70_NEIKI.exe
File created	C:\Windows\System\rpHlZNo.exe	61b06d8e8f56a599a5302a3c9aa81a70_NEIKI.exe
File created	C:\Windows\System\ADGtQCF.exe	61b06d8e8f56a599a5302a3c9aa81a70_NEIKI.exe
File created	C:\Windows\System\nIOfFee.exe	61b06d8e8f56a599a5302a3c9aa81a70_NEIKI.exe
File created	C:\Windows\System\wbWgmex.exe	61b06d8e8f56a599a5302a3c9aa81a70_NEIKI.exe
File created	C:\Windows\System\cGlfxsH.exe	61b06d8e8f56a599a5302a3c9aa81a70_NEIKI.exe
File created	C:\Windows\System\HHLOmkr.exe	61b06d8e8f56a599a5302a3c9aa81a70_NEIKI.exe
File created	C:\Windows\System\xlCTfQe.exe	61b06d8e8f56a599a5302a3c9aa81a70_NEIKI.exe
File created	C:\Windows\System\iZgTBJy.exe	61b06d8e8f56a599a5302a3c9aa81a70_NEIKI.exe
File created	C:\Windows\System\BtCkMpE.exe	61b06d8e8f56a599a5302a3c9aa81a70_NEIKI.exe
File created	C:\Windows\System\uhniwQB.exe	61b06d8e8f56a599a5302a3c9aa81a70_NEIKI.exe
File created	C:\Windows\System\AjCcLcm.exe	61b06d8e8f56a599a5302a3c9aa81a70_NEIKI.exe
File created	C:\Windows\System\NXFTMPG.exe	61b06d8e8f56a599a5302a3c9aa81a70_NEIKI.exe
File created	C:\Windows\System\PnFAxKt.exe	61b06d8e8f56a599a5302a3c9aa81a70_NEIKI.exe
File created	C:\Windows\System\tzvdbcu.exe	61b06d8e8f56a599a5302a3c9aa81a70_NEIKI.exe
File created	C:\Windows\System\CGHXICl.exe	61b06d8e8f56a599a5302a3c9aa81a70_NEIKI.exe
File created	C:\Windows\System\hRdLDkJ.exe	61b06d8e8f56a599a5302a3c9aa81a70_NEIKI.exe
File created	C:\Windows\System\OVsKkdu.exe	61b06d8e8f56a599a5302a3c9aa81a70_NEIKI.exe
File created	C:\Windows\System\aFEtMxi.exe	61b06d8e8f56a599a5302a3c9aa81a70_NEIKI.exe
File created	C:\Windows\System\RikCyOT.exe	61b06d8e8f56a599a5302a3c9aa81a70_NEIKI.exe
File created	C:\Windows\System\HFLUesi.exe	61b06d8e8f56a599a5302a3c9aa81a70_NEIKI.exe
File created	C:\Windows\System\DFFiqVv.exe	61b06d8e8f56a599a5302a3c9aa81a70_NEIKI.exe
File created	C:\Windows\System\HMDaVOD.exe	61b06d8e8f56a599a5302a3c9aa81a70_NEIKI.exe
File created	C:\Windows\System\SilRCtm.exe	61b06d8e8f56a599a5302a3c9aa81a70_NEIKI.exe
File created	C:\Windows\System\scINQiF.exe	61b06d8e8f56a599a5302a3c9aa81a70_NEIKI.exe
File created	C:\Windows\System\uwAtbPV.exe	61b06d8e8f56a599a5302a3c9aa81a70_NEIKI.exe
File created	C:\Windows\System\mhjpMPZ.exe	61b06d8e8f56a599a5302a3c9aa81a70_NEIKI.exe
File created	C:\Windows\System\EdgbZuZ.exe	61b06d8e8f56a599a5302a3c9aa81a70_NEIKI.exe
File created	C:\Windows\System\ZdZexyg.exe	61b06d8e8f56a599a5302a3c9aa81a70_NEIKI.exe
File created	C:\Windows\System\cKlaBsE.exe	61b06d8e8f56a599a5302a3c9aa81a70_NEIKI.exe
File created	C:\Windows\System\oWGjlCt.exe	61b06d8e8f56a599a5302a3c9aa81a70_NEIKI.exe
File created	C:\Windows\System\mLZvTbK.exe	61b06d8e8f56a599a5302a3c9aa81a70_NEIKI.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
668	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2140	61b06d8e8f56a599a5302a3c9aa81a70_NEIKI.exe
Token: SeDebugPrivilege	668	powershell.exe
Token: SeLockMemoryPrivilege	2140	61b06d8e8f56a599a5302a3c9aa81a70_NEIKI.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2140 wrote to memory of 668	2140	61b06d8e8f56a599a5302a3c9aa81a70_NEIKI.exe	29
PID 2140 wrote to memory of 668	2140	61b06d8e8f56a599a5302a3c9aa81a70_NEIKI.exe	29
PID 2140 wrote to memory of 668	2140	61b06d8e8f56a599a5302a3c9aa81a70_NEIKI.exe	29
PID 2140 wrote to memory of 2504	2140	61b06d8e8f56a599a5302a3c9aa81a70_NEIKI.exe	30
PID 2140 wrote to memory of 2504	2140	61b06d8e8f56a599a5302a3c9aa81a70_NEIKI.exe	30
PID 2140 wrote to memory of 2504	2140	61b06d8e8f56a599a5302a3c9aa81a70_NEIKI.exe	30
PID 2140 wrote to memory of 1108	2140	61b06d8e8f56a599a5302a3c9aa81a70_NEIKI.exe	31
PID 2140 wrote to memory of 1108	2140	61b06d8e8f56a599a5302a3c9aa81a70_NEIKI.exe	31
PID 2140 wrote to memory of 1108	2140	61b06d8e8f56a599a5302a3c9aa81a70_NEIKI.exe	31
PID 2140 wrote to memory of 2816	2140	61b06d8e8f56a599a5302a3c9aa81a70_NEIKI.exe	32
PID 2140 wrote to memory of 2816	2140	61b06d8e8f56a599a5302a3c9aa81a70_NEIKI.exe	32
PID 2140 wrote to memory of 2816	2140	61b06d8e8f56a599a5302a3c9aa81a70_NEIKI.exe	32
PID 2140 wrote to memory of 1488	2140	61b06d8e8f56a599a5302a3c9aa81a70_NEIKI.exe	33
PID 2140 wrote to memory of 1488	2140	61b06d8e8f56a599a5302a3c9aa81a70_NEIKI.exe	33
PID 2140 wrote to memory of 1488	2140	61b06d8e8f56a599a5302a3c9aa81a70_NEIKI.exe	33
PID 2140 wrote to memory of 2592	2140	61b06d8e8f56a599a5302a3c9aa81a70_NEIKI.exe	34
PID 2140 wrote to memory of 2592	2140	61b06d8e8f56a599a5302a3c9aa81a70_NEIKI.exe	34
PID 2140 wrote to memory of 2592	2140	61b06d8e8f56a599a5302a3c9aa81a70_NEIKI.exe	34
PID 2140 wrote to memory of 552	2140	61b06d8e8f56a599a5302a3c9aa81a70_NEIKI.exe	35
PID 2140 wrote to memory of 552	2140	61b06d8e8f56a599a5302a3c9aa81a70_NEIKI.exe	35
PID 2140 wrote to memory of 552	2140	61b06d8e8f56a599a5302a3c9aa81a70_NEIKI.exe	35
PID 2140 wrote to memory of 2500	2140	61b06d8e8f56a599a5302a3c9aa81a70_NEIKI.exe	36
PID 2140 wrote to memory of 2500	2140	61b06d8e8f56a599a5302a3c9aa81a70_NEIKI.exe	36
PID 2140 wrote to memory of 2500	2140	61b06d8e8f56a599a5302a3c9aa81a70_NEIKI.exe	36
PID 2140 wrote to memory of 2908	2140	61b06d8e8f56a599a5302a3c9aa81a70_NEIKI.exe	37
PID 2140 wrote to memory of 2908	2140	61b06d8e8f56a599a5302a3c9aa81a70_NEIKI.exe	37
PID 2140 wrote to memory of 2908	2140	61b06d8e8f56a599a5302a3c9aa81a70_NEIKI.exe	37
PID 2140 wrote to memory of 2544	2140	61b06d8e8f56a599a5302a3c9aa81a70_NEIKI.exe	38
PID 2140 wrote to memory of 2544	2140	61b06d8e8f56a599a5302a3c9aa81a70_NEIKI.exe	38
PID 2140 wrote to memory of 2544	2140	61b06d8e8f56a599a5302a3c9aa81a70_NEIKI.exe	38
PID 2140 wrote to memory of 2672	2140	61b06d8e8f56a599a5302a3c9aa81a70_NEIKI.exe	39
PID 2140 wrote to memory of 2672	2140	61b06d8e8f56a599a5302a3c9aa81a70_NEIKI.exe	39
PID 2140 wrote to memory of 2672	2140	61b06d8e8f56a599a5302a3c9aa81a70_NEIKI.exe	39
PID 2140 wrote to memory of 2560	2140	61b06d8e8f56a599a5302a3c9aa81a70_NEIKI.exe	40
PID 2140 wrote to memory of 2560	2140	61b06d8e8f56a599a5302a3c9aa81a70_NEIKI.exe	40
PID 2140 wrote to memory of 2560	2140	61b06d8e8f56a599a5302a3c9aa81a70_NEIKI.exe	40
PID 2140 wrote to memory of 2532	2140	61b06d8e8f56a599a5302a3c9aa81a70_NEIKI.exe	41
PID 2140 wrote to memory of 2532	2140	61b06d8e8f56a599a5302a3c9aa81a70_NEIKI.exe	41
PID 2140 wrote to memory of 2532	2140	61b06d8e8f56a599a5302a3c9aa81a70_NEIKI.exe	41
PID 2140 wrote to memory of 2612	2140	61b06d8e8f56a599a5302a3c9aa81a70_NEIKI.exe	42
PID 2140 wrote to memory of 2612	2140	61b06d8e8f56a599a5302a3c9aa81a70_NEIKI.exe	42
PID 2140 wrote to memory of 2612	2140	61b06d8e8f56a599a5302a3c9aa81a70_NEIKI.exe	42
PID 2140 wrote to memory of 2280	2140	61b06d8e8f56a599a5302a3c9aa81a70_NEIKI.exe	43
PID 2140 wrote to memory of 2280	2140	61b06d8e8f56a599a5302a3c9aa81a70_NEIKI.exe	43
PID 2140 wrote to memory of 2280	2140	61b06d8e8f56a599a5302a3c9aa81a70_NEIKI.exe	43
PID 2140 wrote to memory of 2444	2140	61b06d8e8f56a599a5302a3c9aa81a70_NEIKI.exe	44
PID 2140 wrote to memory of 2444	2140	61b06d8e8f56a599a5302a3c9aa81a70_NEIKI.exe	44
PID 2140 wrote to memory of 2444	2140	61b06d8e8f56a599a5302a3c9aa81a70_NEIKI.exe	44
PID 2140 wrote to memory of 1264	2140	61b06d8e8f56a599a5302a3c9aa81a70_NEIKI.exe	45
PID 2140 wrote to memory of 1264	2140	61b06d8e8f56a599a5302a3c9aa81a70_NEIKI.exe	45
PID 2140 wrote to memory of 1264	2140	61b06d8e8f56a599a5302a3c9aa81a70_NEIKI.exe	45
PID 2140 wrote to memory of 2176	2140	61b06d8e8f56a599a5302a3c9aa81a70_NEIKI.exe	47
PID 2140 wrote to memory of 2176	2140	61b06d8e8f56a599a5302a3c9aa81a70_NEIKI.exe	47
PID 2140 wrote to memory of 2176	2140	61b06d8e8f56a599a5302a3c9aa81a70_NEIKI.exe	47
PID 2140 wrote to memory of 1252	2140	61b06d8e8f56a599a5302a3c9aa81a70_NEIKI.exe	48
PID 2140 wrote to memory of 1252	2140	61b06d8e8f56a599a5302a3c9aa81a70_NEIKI.exe	48
PID 2140 wrote to memory of 1252	2140	61b06d8e8f56a599a5302a3c9aa81a70_NEIKI.exe	48
PID 2140 wrote to memory of 2192	2140	61b06d8e8f56a599a5302a3c9aa81a70_NEIKI.exe	49
PID 2140 wrote to memory of 2192	2140	61b06d8e8f56a599a5302a3c9aa81a70_NEIKI.exe	49
PID 2140 wrote to memory of 2192	2140	61b06d8e8f56a599a5302a3c9aa81a70_NEIKI.exe	49
PID 2140 wrote to memory of 1924	2140	61b06d8e8f56a599a5302a3c9aa81a70_NEIKI.exe	50
PID 2140 wrote to memory of 1924	2140	61b06d8e8f56a599a5302a3c9aa81a70_NEIKI.exe	50
PID 2140 wrote to memory of 1924	2140	61b06d8e8f56a599a5302a3c9aa81a70_NEIKI.exe	50
PID 2140 wrote to memory of 2204	2140	61b06d8e8f56a599a5302a3c9aa81a70_NEIKI.exe	51

C:\Users\Admin\AppData\Local\Temp\61b06d8e8f56a599a5302a3c9aa81a70_NEIKI.exe
"C:\Users\Admin\AppData\Local\Temp\61b06d8e8f56a599a5302a3c9aa81a70_NEIKI.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2140
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:668
- C:\Windows\System\tZzhEpT.exe
  C:\Windows\System\tZzhEpT.exe
  2⤵
  - Executes dropped EXE
  PID:2504
- C:\Windows\System\zOLsntj.exe
  C:\Windows\System\zOLsntj.exe
  2⤵
  - Executes dropped EXE
  PID:1108
- C:\Windows\System\PuwSBsL.exe
  C:\Windows\System\PuwSBsL.exe
  2⤵
  - Executes dropped EXE
  PID:2816
- C:\Windows\System\FdftIHd.exe
  C:\Windows\System\FdftIHd.exe
  2⤵
  - Executes dropped EXE
  PID:1488
- C:\Windows\System\tXKjhJO.exe
  C:\Windows\System\tXKjhJO.exe
  2⤵
  - Executes dropped EXE
  PID:2592
- C:\Windows\System\IBMlOXi.exe
  C:\Windows\System\IBMlOXi.exe
  2⤵
  - Executes dropped EXE
  PID:552
- C:\Windows\System\LvoKZqp.exe
  C:\Windows\System\LvoKZqp.exe
  2⤵
  - Executes dropped EXE
  PID:2500
- C:\Windows\System\AmYHJkr.exe
  C:\Windows\System\AmYHJkr.exe
  2⤵
  - Executes dropped EXE
  PID:2908
- C:\Windows\System\YaztjQy.exe
  C:\Windows\System\YaztjQy.exe
  2⤵
  - Executes dropped EXE
  PID:2544
- C:\Windows\System\eXbjtDB.exe
  C:\Windows\System\eXbjtDB.exe
  2⤵
  - Executes dropped EXE
  PID:2672
- C:\Windows\System\YPHvBlN.exe
  C:\Windows\System\YPHvBlN.exe
  2⤵
  - Executes dropped EXE
  PID:2560
- C:\Windows\System\kApBgst.exe
  C:\Windows\System\kApBgst.exe
  2⤵
  - Executes dropped EXE
  PID:2532
- C:\Windows\System\GPcYDfF.exe
  C:\Windows\System\GPcYDfF.exe
  2⤵
  - Executes dropped EXE
  PID:2612
- C:\Windows\System\EvJHDeV.exe
  C:\Windows\System\EvJHDeV.exe
  2⤵
  - Executes dropped EXE
  PID:2280
- C:\Windows\System\YOWkjwJ.exe
  C:\Windows\System\YOWkjwJ.exe
  2⤵
  - Executes dropped EXE
  PID:2444
- C:\Windows\System\FeQFOoR.exe
  C:\Windows\System\FeQFOoR.exe
  2⤵
  - Executes dropped EXE
  PID:1264
- C:\Windows\System\QcpJKNd.exe
  C:\Windows\System\QcpJKNd.exe
  2⤵
  - Executes dropped EXE
  PID:2176
- C:\Windows\System\oUHdaBp.exe
  C:\Windows\System\oUHdaBp.exe
  2⤵
  - Executes dropped EXE
  PID:1252
- C:\Windows\System\vQAjgoR.exe
  C:\Windows\System\vQAjgoR.exe
  2⤵
  - Executes dropped EXE
  PID:2192
- C:\Windows\System\hahAYuC.exe
  C:\Windows\System\hahAYuC.exe
  2⤵
  - Executes dropped EXE
  PID:1924
- C:\Windows\System\gYarxHC.exe
  C:\Windows\System\gYarxHC.exe
  2⤵
  - Executes dropped EXE
  PID:2204
- C:\Windows\System\bodShoJ.exe
  C:\Windows\System\bodShoJ.exe
  2⤵
  - Executes dropped EXE
  PID:2300
- C:\Windows\System\JYDQsJH.exe
  C:\Windows\System\JYDQsJH.exe
  2⤵
  - Executes dropped EXE
  PID:944
- C:\Windows\System\NhUZpfl.exe
  C:\Windows\System\NhUZpfl.exe
  2⤵
  - Executes dropped EXE
  PID:1548
- C:\Windows\System\sLZoDcJ.exe
  C:\Windows\System\sLZoDcJ.exe
  2⤵
  - Executes dropped EXE
  PID:1648
- C:\Windows\System\teIuRIx.exe
  C:\Windows\System\teIuRIx.exe
  2⤵
  - Executes dropped EXE
  PID:1656
- C:\Windows\System\HUtFAaV.exe
  C:\Windows\System\HUtFAaV.exe
  2⤵
  - Executes dropped EXE
  PID:1628
- C:\Windows\System\XQXTEaY.exe
  C:\Windows\System\XQXTEaY.exe
  2⤵
  - Executes dropped EXE
  PID:1424
- C:\Windows\System\RXzDnkL.exe
  C:\Windows\System\RXzDnkL.exe
  2⤵
  - Executes dropped EXE
  PID:2368
- C:\Windows\System\hdhRSwz.exe
  C:\Windows\System\hdhRSwz.exe
  2⤵
  - Executes dropped EXE
  PID:2016
- C:\Windows\System\iwIFgOS.exe
  C:\Windows\System\iwIFgOS.exe
  2⤵
  - Executes dropped EXE
  PID:1672
- C:\Windows\System\OYHEOQF.exe
  C:\Windows\System\OYHEOQF.exe
  2⤵
  - Executes dropped EXE
  PID:1272
- C:\Windows\System\upCwLBl.exe
  C:\Windows\System\upCwLBl.exe
  2⤵
  - Executes dropped EXE
  PID:1516
- C:\Windows\System\diwXcvM.exe
  C:\Windows\System\diwXcvM.exe
  2⤵
  - Executes dropped EXE
  PID:1588
- C:\Windows\System\SxDThgV.exe
  C:\Windows\System\SxDThgV.exe
  2⤵
  - Executes dropped EXE
  PID:1880
- C:\Windows\System\XUthrpv.exe
  C:\Windows\System\XUthrpv.exe
  2⤵
  - Executes dropped EXE
  PID:1156
- C:\Windows\System\woLGthb.exe
  C:\Windows\System\woLGthb.exe
  2⤵
  - Executes dropped EXE
  PID:1820
- C:\Windows\System\XoHVvsn.exe
  C:\Windows\System\XoHVvsn.exe
  2⤵
  - Executes dropped EXE
  PID:1876
- C:\Windows\System\wHKYdbr.exe
  C:\Windows\System\wHKYdbr.exe
  2⤵
  - Executes dropped EXE
  PID:2040
- C:\Windows\System\AFfjJwr.exe
  C:\Windows\System\AFfjJwr.exe
  2⤵
  - Executes dropped EXE
  PID:2244
- C:\Windows\System\ddcrpUa.exe
  C:\Windows\System\ddcrpUa.exe
  2⤵
  - Executes dropped EXE
  PID:2024
- C:\Windows\System\gjmPjqX.exe
  C:\Windows\System\gjmPjqX.exe
  2⤵
  - Executes dropped EXE
  PID:2144
- C:\Windows\System\MEMYbwP.exe
  C:\Windows\System\MEMYbwP.exe
  2⤵
  - Executes dropped EXE
  PID:1772
- C:\Windows\System\TUAXAhg.exe
  C:\Windows\System\TUAXAhg.exe
  2⤵
  - Executes dropped EXE
  PID:2108
- C:\Windows\System\UEEcctx.exe
  C:\Windows\System\UEEcctx.exe
  2⤵
  - Executes dropped EXE
  PID:388
- C:\Windows\System\rzlofdU.exe
  C:\Windows\System\rzlofdU.exe
  2⤵
  - Executes dropped EXE
  PID:1584
- C:\Windows\System\CwMPdPL.exe
  C:\Windows\System\CwMPdPL.exe
  2⤵
  - Executes dropped EXE
  PID:1752
- C:\Windows\System\owmeOji.exe
  C:\Windows\System\owmeOji.exe
  2⤵
  - Executes dropped EXE
  PID:372
- C:\Windows\System\eqqPIhu.exe
  C:\Windows\System\eqqPIhu.exe
  2⤵
  - Executes dropped EXE
  PID:2912
- C:\Windows\System\nIOfFee.exe
  C:\Windows\System\nIOfFee.exe
  2⤵
  - Executes dropped EXE
  PID:1568
- C:\Windows\System\coLPIAJ.exe
  C:\Windows\System\coLPIAJ.exe
  2⤵
  - Executes dropped EXE
  PID:1572
- C:\Windows\System\pcazkOA.exe
  C:\Windows\System\pcazkOA.exe
  2⤵
  - Executes dropped EXE
  PID:3008
- C:\Windows\System\boqGoHT.exe
  C:\Windows\System\boqGoHT.exe
  2⤵
  - Executes dropped EXE
  PID:1608
- C:\Windows\System\CRtJKRp.exe
  C:\Windows\System\CRtJKRp.exe
  2⤵
  - Executes dropped EXE
  PID:2800
- C:\Windows\System\KdrPIVc.exe
  C:\Windows\System\KdrPIVc.exe
  2⤵
  - Executes dropped EXE
  PID:2088
- C:\Windows\System\qdTEAqu.exe
  C:\Windows\System\qdTEAqu.exe
  2⤵
  - Executes dropped EXE
  PID:2744
- C:\Windows\System\ExbhXqr.exe
  C:\Windows\System\ExbhXqr.exe
  2⤵
  - Executes dropped EXE
  PID:1872
- C:\Windows\System\KvYiMRN.exe
  C:\Windows\System\KvYiMRN.exe
  2⤵
  - Executes dropped EXE
  PID:2900
- C:\Windows\System\aKLuUva.exe
  C:\Windows\System\aKLuUva.exe
  2⤵
  - Executes dropped EXE
  PID:2656
- C:\Windows\System\ZCelmAc.exe
  C:\Windows\System\ZCelmAc.exe
  2⤵
  - Executes dropped EXE
  PID:2524
- C:\Windows\System\TECOrJH.exe
  C:\Windows\System\TECOrJH.exe
  2⤵
  - Executes dropped EXE
  PID:2572
- C:\Windows\System\kiLbKte.exe
  C:\Windows\System\kiLbKte.exe
  2⤵
  - Executes dropped EXE
  PID:2596
- C:\Windows\System\ZUrOqiv.exe
  C:\Windows\System\ZUrOqiv.exe
  2⤵
  - Executes dropped EXE
  PID:588
- C:\Windows\System\flXmcbq.exe
  C:\Windows\System\flXmcbq.exe
  2⤵
  - Executes dropped EXE
  PID:2632
- C:\Windows\System\tFyGuzy.exe
  C:\Windows\System\tFyGuzy.exe
  2⤵
  PID:2428
- C:\Windows\System\wHnRDYm.exe
  C:\Windows\System\wHnRDYm.exe
  2⤵
  PID:2616
- C:\Windows\System\DhaSpzk.exe
  C:\Windows\System\DhaSpzk.exe
  2⤵
  PID:1964
- C:\Windows\System\LTIUbaI.exe
  C:\Windows\System\LTIUbaI.exe
  2⤵
  PID:2628
- C:\Windows\System\LHWTnul.exe
  C:\Windows\System\LHWTnul.exe
  2⤵
  PID:2164
- C:\Windows\System\IUaUUWU.exe
  C:\Windows\System\IUaUUWU.exe
  2⤵
  PID:1668
- C:\Windows\System\hIbjFgj.exe
  C:\Windows\System\hIbjFgj.exe
  2⤵
  PID:2212
- C:\Windows\System\HEEfPBP.exe
  C:\Windows\System\HEEfPBP.exe
  2⤵
  PID:3024
- C:\Windows\System\mmLUJkn.exe
  C:\Windows\System\mmLUJkn.exe
  2⤵
  PID:1164
- C:\Windows\System\QiBrpLf.exe
  C:\Windows\System\QiBrpLf.exe
  2⤵
  PID:3004
- C:\Windows\System\oCGQwTl.exe
  C:\Windows\System\oCGQwTl.exe
  2⤵
  PID:1140
- C:\Windows\System\TkyLwqd.exe
  C:\Windows\System\TkyLwqd.exe
  2⤵
  PID:1676
- C:\Windows\System\nGXXDtO.exe
  C:\Windows\System\nGXXDtO.exe
  2⤵
  PID:1096
- C:\Windows\System\ohicNqk.exe
  C:\Windows\System\ohicNqk.exe
  2⤵
  PID:1324
- C:\Windows\System\RikCyOT.exe
  C:\Windows\System\RikCyOT.exe
  2⤵
  PID:1708
- C:\Windows\System\rWfEtdh.exe
  C:\Windows\System\rWfEtdh.exe
  2⤵
  PID:1992
- C:\Windows\System\QDWtNBc.exe
  C:\Windows\System\QDWtNBc.exe
  2⤵
  PID:968
- C:\Windows\System\cXXCOPi.exe
  C:\Windows\System\cXXCOPi.exe
  2⤵
  PID:908
- C:\Windows\System\vQopGsH.exe
  C:\Windows\System\vQopGsH.exe
  2⤵
  PID:2132
- C:\Windows\System\tcqEbuv.exe
  C:\Windows\System\tcqEbuv.exe
  2⤵
  PID:2172
- C:\Windows\System\rKhBqTP.exe
  C:\Windows\System\rKhBqTP.exe
  2⤵
  PID:1996
- C:\Windows\System\GtoQZZT.exe
  C:\Windows\System\GtoQZZT.exe
  2⤵
  PID:2112
- C:\Windows\System\edkFPHW.exe
  C:\Windows\System\edkFPHW.exe
  2⤵
  PID:2036
- C:\Windows\System\fCIVLTU.exe
  C:\Windows\System\fCIVLTU.exe
  2⤵
  PID:1288
- C:\Windows\System\eTcgksf.exe
  C:\Windows\System\eTcgksf.exe
  2⤵
  PID:1008
- C:\Windows\System\ClejGQi.exe
  C:\Windows\System\ClejGQi.exe
  2⤵
  PID:2764
- C:\Windows\System\GHZvwwZ.exe
  C:\Windows\System\GHZvwwZ.exe
  2⤵
  PID:2488
- C:\Windows\System\rmTKucV.exe
  C:\Windows\System\rmTKucV.exe
  2⤵
  PID:2864
- C:\Windows\System\TkniwGz.exe
  C:\Windows\System\TkniwGz.exe
  2⤵
  PID:2640
- C:\Windows\System\BmBOOLv.exe
  C:\Windows\System\BmBOOLv.exe
  2⤵
  PID:2684
- C:\Windows\System\TxPONzk.exe
  C:\Windows\System\TxPONzk.exe
  2⤵
  PID:1736
- C:\Windows\System\xmBOgTD.exe
  C:\Windows\System\xmBOgTD.exe
  2⤵
  PID:2216
- C:\Windows\System\vLWCaaS.exe
  C:\Windows\System\vLWCaaS.exe
  2⤵
  PID:1692
- C:\Windows\System\cCqKiSq.exe
  C:\Windows\System\cCqKiSq.exe
  2⤵
  PID:2644
- C:\Windows\System\AsAlMMd.exe
  C:\Windows\System\AsAlMMd.exe
  2⤵
  PID:1684
- C:\Windows\System\WIDxEYM.exe
  C:\Windows\System\WIDxEYM.exe
  2⤵
  PID:1048
- C:\Windows\System\SSOOzFk.exe
  C:\Windows\System\SSOOzFk.exe
  2⤵
  PID:2436
- C:\Windows\System\PZOtWeE.exe
  C:\Windows\System\PZOtWeE.exe
  2⤵
  PID:2252
- C:\Windows\System\MyUcNWd.exe
  C:\Windows\System\MyUcNWd.exe
  2⤵
  PID:1624
- C:\Windows\System\avOBxGO.exe
  C:\Windows\System\avOBxGO.exe
  2⤵
  PID:1296
- C:\Windows\System\qWTZjeX.exe
  C:\Windows\System\qWTZjeX.exe
  2⤵
  PID:892
- C:\Windows\System\yIQezbO.exe
  C:\Windows\System\yIQezbO.exe
  2⤵
  PID:1216
- C:\Windows\System\DZztjnk.exe
  C:\Windows\System\DZztjnk.exe
  2⤵
  PID:364
- C:\Windows\System\FkYRwYM.exe
  C:\Windows\System\FkYRwYM.exe
  2⤵
  PID:1652
- C:\Windows\System\buiVesg.exe
  C:\Windows\System\buiVesg.exe
  2⤵
  PID:2348
- C:\Windows\System\lFBnUun.exe
  C:\Windows\System\lFBnUun.exe
  2⤵
  PID:1492
- C:\Windows\System\Miqypkr.exe
  C:\Windows\System\Miqypkr.exe
  2⤵
  PID:1744
- C:\Windows\System\hWhplaL.exe
  C:\Windows\System\hWhplaL.exe
  2⤵
  PID:1564
- C:\Windows\System\jjcgBdb.exe
  C:\Windows\System\jjcgBdb.exe
  2⤵
  PID:2160
- C:\Windows\System\LXdmncu.exe
  C:\Windows\System\LXdmncu.exe
  2⤵
  PID:1336
- C:\Windows\System\hjBLNVO.exe
  C:\Windows\System\hjBLNVO.exe
  2⤵
  PID:2156
- C:\Windows\System\FEsoRVT.exe
  C:\Windows\System\FEsoRVT.exe
  2⤵
  PID:2944
- C:\Windows\System\NrIApCJ.exe
  C:\Windows\System\NrIApCJ.exe
  2⤵
  PID:988
- C:\Windows\System\mIyIDKd.exe
  C:\Windows\System\mIyIDKd.exe
  2⤵
  PID:2720
- C:\Windows\System\uPMTjgX.exe
  C:\Windows\System\uPMTjgX.exe
  2⤵
  PID:1748
- C:\Windows\System\NdNGorH.exe
  C:\Windows\System\NdNGorH.exe
  2⤵
  PID:1948
- C:\Windows\System\BZEgIvF.exe
  C:\Windows\System\BZEgIvF.exe
  2⤵
  PID:548
- C:\Windows\System\ynHvtXX.exe
  C:\Windows\System\ynHvtXX.exe
  2⤵
  PID:784
- C:\Windows\System\kKoHZvr.exe
  C:\Windows\System\kKoHZvr.exe
  2⤵
  PID:284
- C:\Windows\System\MFVvsTi.exe
  C:\Windows\System\MFVvsTi.exe
  2⤵
  PID:2716
- C:\Windows\System\fwkvivZ.exe
  C:\Windows\System\fwkvivZ.exe
  2⤵
  PID:2880
- C:\Windows\System\zjyXCKu.exe
  C:\Windows\System\zjyXCKu.exe
  2⤵
  PID:2988
- C:\Windows\System\OILIgSP.exe
  C:\Windows\System\OILIgSP.exe
  2⤵
  PID:2792
- C:\Windows\System\CMRguRZ.exe
  C:\Windows\System\CMRguRZ.exe
  2⤵
  PID:2856
- C:\Windows\System\HbzJDnx.exe
  C:\Windows\System\HbzJDnx.exe
  2⤵
  PID:2224
- C:\Windows\System\drrqkjX.exe
  C:\Windows\System\drrqkjX.exe
  2⤵
  PID:2460
- C:\Windows\System\aUIWqcQ.exe
  C:\Windows\System\aUIWqcQ.exe
  2⤵
  PID:1616
- C:\Windows\System\LqjceTD.exe
  C:\Windows\System\LqjceTD.exe
  2⤵
  PID:1804
- C:\Windows\System\IWRWWRX.exe
  C:\Windows\System\IWRWWRX.exe
  2⤵
  PID:1828
- C:\Windows\System\AMylBEK.exe
  C:\Windows\System\AMylBEK.exe
  2⤵
  PID:2732
- C:\Windows\System\ITEnBxG.exe
  C:\Windows\System\ITEnBxG.exe
  2⤵
  PID:240
- C:\Windows\System\uBYMhDR.exe
  C:\Windows\System\uBYMhDR.exe
  2⤵
  PID:1464
- C:\Windows\System\hrAmLOo.exe
  C:\Windows\System\hrAmLOo.exe
  2⤵
  PID:1776
- C:\Windows\System\lUfKFDH.exe
  C:\Windows\System\lUfKFDH.exe
  2⤵
  PID:2268
- C:\Windows\System\zIyoslw.exe
  C:\Windows\System\zIyoslw.exe
  2⤵
  PID:3028
- C:\Windows\System\fUtXHDx.exe
  C:\Windows\System\fUtXHDx.exe
  2⤵
  PID:2892
- C:\Windows\System\jEPBRcg.exe
  C:\Windows\System\jEPBRcg.exe
  2⤵
  PID:2760
- C:\Windows\System\xIyCyBT.exe
  C:\Windows\System\xIyCyBT.exe
  2⤵
  PID:2588
- C:\Windows\System\TOXGLXh.exe
  C:\Windows\System\TOXGLXh.exe
  2⤵
  PID:2448
- C:\Windows\System\EsrKJTE.exe
  C:\Windows\System\EsrKJTE.exe
  2⤵
  PID:2828
- C:\Windows\System\tqVXjQU.exe
  C:\Windows\System\tqVXjQU.exe
  2⤵
  PID:2736
- C:\Windows\System\iuXnDOV.exe
  C:\Windows\System\iuXnDOV.exe
  2⤵
  PID:2692
- C:\Windows\System\dysfBOI.exe
  C:\Windows\System\dysfBOI.exe
  2⤵
  PID:1504
- C:\Windows\System\yHIlegM.exe
  C:\Windows\System\yHIlegM.exe
  2⤵
  PID:888
- C:\Windows\System\NDkfsjK.exe
  C:\Windows\System\NDkfsjK.exe
  2⤵
  PID:1304
- C:\Windows\System\mLysYyR.exe
  C:\Windows\System\mLysYyR.exe
  2⤵
  PID:1800
- C:\Windows\System\FyQxdnN.exe
  C:\Windows\System\FyQxdnN.exe
  2⤵
  PID:2680
- C:\Windows\System\cKlaBsE.exe
  C:\Windows\System\cKlaBsE.exe
  2⤵
  PID:2356
- C:\Windows\System\CrIJEGV.exe
  C:\Windows\System\CrIJEGV.exe
  2⤵
  PID:2456
- C:\Windows\System\ymJkLol.exe
  C:\Windows\System\ymJkLol.exe
  2⤵
  PID:2072
- C:\Windows\System\AguYFuL.exe
  C:\Windows\System\AguYFuL.exe
  2⤵
  PID:2320
- C:\Windows\System\oyIjQVC.exe
  C:\Windows\System\oyIjQVC.exe
  2⤵
  PID:1060
- C:\Windows\System\WsXFlIQ.exe
  C:\Windows\System\WsXFlIQ.exe
  2⤵
  PID:2052
- C:\Windows\System\eYPhCaD.exe
  C:\Windows\System\eYPhCaD.exe
  2⤵
  PID:2220
- C:\Windows\System\AUwpwuO.exe
  C:\Windows\System\AUwpwuO.exe
  2⤵
  PID:2480
- C:\Windows\System\auMEnTn.exe
  C:\Windows\System\auMEnTn.exe
  2⤵
  PID:580
- C:\Windows\System\WjFVQuT.exe
  C:\Windows\System\WjFVQuT.exe
  2⤵
  PID:2996
- C:\Windows\System\OOYhhyx.exe
  C:\Windows\System\OOYhhyx.exe
  2⤵
  PID:844
- C:\Windows\System\UxMOTpQ.exe
  C:\Windows\System\UxMOTpQ.exe
  2⤵
  PID:1576
- C:\Windows\System\uhniwQB.exe
  C:\Windows\System\uhniwQB.exe
  2⤵
  PID:3016
- C:\Windows\System\vGmJrai.exe
  C:\Windows\System\vGmJrai.exe
  2⤵
  PID:3084
- C:\Windows\System\ILPvdng.exe
  C:\Windows\System\ILPvdng.exe
  2⤵
  PID:3132
- C:\Windows\System\FAcaEsE.exe
  C:\Windows\System\FAcaEsE.exe
  2⤵
  PID:3176
- C:\Windows\System\ujYjKsb.exe
  C:\Windows\System\ujYjKsb.exe
  2⤵
  PID:3196
- C:\Windows\System\nPEdMNE.exe
  C:\Windows\System\nPEdMNE.exe
  2⤵
  PID:3212
- C:\Windows\System\WTeuQtm.exe
  C:\Windows\System\WTeuQtm.exe
  2⤵
  PID:3228
- C:\Windows\System\iUDtwwg.exe
  C:\Windows\System\iUDtwwg.exe
  2⤵
  PID:3244
- C:\Windows\System\skaMGbM.exe
  C:\Windows\System\skaMGbM.exe
  2⤵
  PID:3264
- C:\Windows\System\pLUlmLe.exe
  C:\Windows\System\pLUlmLe.exe
  2⤵
  PID:3280
- C:\Windows\System\xkAwNai.exe
  C:\Windows\System\xkAwNai.exe
  2⤵
  PID:3296
- C:\Windows\System\XBTCRUw.exe
  C:\Windows\System\XBTCRUw.exe
  2⤵
  PID:3312
- C:\Windows\System\hOhDSuT.exe
  C:\Windows\System\hOhDSuT.exe
  2⤵
  PID:3332
- C:\Windows\System\UgUfBvR.exe
  C:\Windows\System\UgUfBvR.exe
  2⤵
  PID:3376
- C:\Windows\System\rRbtTzo.exe
  C:\Windows\System\rRbtTzo.exe
  2⤵
  PID:3396
- C:\Windows\System\FJoTSzN.exe
  C:\Windows\System\FJoTSzN.exe
  2⤵
  PID:3412
- C:\Windows\System\HdzTByS.exe
  C:\Windows\System\HdzTByS.exe
  2⤵
  PID:3432
- C:\Windows\System\rNPGAcx.exe
  C:\Windows\System\rNPGAcx.exe
  2⤵
  PID:3448
- C:\Windows\System\GFdlcpq.exe
  C:\Windows\System\GFdlcpq.exe
  2⤵
  PID:3464
- C:\Windows\System\IwSKIev.exe
  C:\Windows\System\IwSKIev.exe
  2⤵
  PID:3480
- C:\Windows\System\fAYIasv.exe
  C:\Windows\System\fAYIasv.exe
  2⤵
  PID:3496
- C:\Windows\System\LNskrWP.exe
  C:\Windows\System\LNskrWP.exe
  2⤵
  PID:3512
- C:\Windows\System\COCTMyz.exe
  C:\Windows\System\COCTMyz.exe
  2⤵
  PID:3532
- C:\Windows\System\NBAwKwl.exe
  C:\Windows\System\NBAwKwl.exe
  2⤵
  PID:3548
- C:\Windows\System\fFFSthL.exe
  C:\Windows\System\fFFSthL.exe
  2⤵
  PID:3564
- C:\Windows\System\bUGvWOK.exe
  C:\Windows\System\bUGvWOK.exe
  2⤵
  PID:3604
- C:\Windows\System\ndUMduL.exe
  C:\Windows\System\ndUMduL.exe
  2⤵
  PID:3620
- C:\Windows\System\UBNAlgb.exe
  C:\Windows\System\UBNAlgb.exe
  2⤵
  PID:3636
- C:\Windows\System\DRctaDG.exe
  C:\Windows\System\DRctaDG.exe
  2⤵
  PID:3652
- C:\Windows\System\CUzlSKY.exe
  C:\Windows\System\CUzlSKY.exe
  2⤵
  PID:3668
- C:\Windows\System\ViEPpYy.exe
  C:\Windows\System\ViEPpYy.exe
  2⤵
  PID:3684
- C:\Windows\System\fIaCvUy.exe
  C:\Windows\System\fIaCvUy.exe
  2⤵
  PID:3708
- C:\Windows\System\Txsmwne.exe
  C:\Windows\System\Txsmwne.exe
  2⤵
  PID:3724
- C:\Windows\System\hHJpuEW.exe
  C:\Windows\System\hHJpuEW.exe
  2⤵
  PID:3744
- C:\Windows\System\WcRXGMx.exe
  C:\Windows\System\WcRXGMx.exe
  2⤵
  PID:3804
- C:\Windows\System\IWIHvYQ.exe
  C:\Windows\System\IWIHvYQ.exe
  2⤵
  PID:3820
- C:\Windows\System\QdZIFdh.exe
  C:\Windows\System\QdZIFdh.exe
  2⤵
  PID:3852
- C:\Windows\System\pBIITrp.exe
  C:\Windows\System\pBIITrp.exe
  2⤵
  PID:3880
- C:\Windows\System\CRlGvTY.exe
  C:\Windows\System\CRlGvTY.exe
  2⤵
  PID:3900
- C:\Windows\System\tEtvlcw.exe
  C:\Windows\System\tEtvlcw.exe
  2⤵
  PID:3916
- C:\Windows\System\tJWtpbS.exe
  C:\Windows\System\tJWtpbS.exe
  2⤵
  PID:3932
- C:\Windows\System\HUQzzIF.exe
  C:\Windows\System\HUQzzIF.exe
  2⤵
  PID:3952
- C:\Windows\System\rvMuKee.exe
  C:\Windows\System\rvMuKee.exe
  2⤵
  PID:3968
- C:\Windows\System\WnVjYWL.exe
  C:\Windows\System\WnVjYWL.exe
  2⤵
  PID:3984
- C:\Windows\System\AVngWRV.exe
  C:\Windows\System\AVngWRV.exe
  2⤵
  PID:4000
- C:\Windows\System\syGbdSD.exe
  C:\Windows\System\syGbdSD.exe
  2⤵
  PID:4016
- C:\Windows\System\XbsYdti.exe
  C:\Windows\System\XbsYdti.exe
  2⤵
  PID:4032
- C:\Windows\System\fUAUVoy.exe
  C:\Windows\System\fUAUVoy.exe
  2⤵
  PID:4056
- C:\Windows\System\YTpJPRV.exe
  C:\Windows\System\YTpJPRV.exe
  2⤵
  PID:4072
- C:\Windows\System\CKjBDdL.exe
  C:\Windows\System\CKjBDdL.exe
  2⤵
  PID:4088
- C:\Windows\System\fSGiuNg.exe
  C:\Windows\System\fSGiuNg.exe
  2⤵
  PID:1960
- C:\Windows\System\iZSymrZ.exe
  C:\Windows\System\iZSymrZ.exe
  2⤵
  PID:1360
- C:\Windows\System\LohhVCT.exe
  C:\Windows\System\LohhVCT.exe
  2⤵
  PID:1428
- C:\Windows\System\akzMvLf.exe
  C:\Windows\System\akzMvLf.exe
  2⤵
  PID:1788
- C:\Windows\System\xKFgSFa.exe
  C:\Windows\System\xKFgSFa.exe
  2⤵
  PID:3112
- C:\Windows\System\IMqwQFv.exe
  C:\Windows\System\IMqwQFv.exe
  2⤵
  PID:3124
- C:\Windows\System\eKQNEkg.exe
  C:\Windows\System\eKQNEkg.exe
  2⤵
  PID:3128
- C:\Windows\System\PbvvgvH.exe
  C:\Windows\System\PbvvgvH.exe
  2⤵
  PID:2884
- C:\Windows\System\NKcJZTo.exe
  C:\Windows\System\NKcJZTo.exe
  2⤵
  PID:2836
- C:\Windows\System\zDDSfMs.exe
  C:\Windows\System\zDDSfMs.exe
  2⤵
  PID:3140
- C:\Windows\System\TFXtkwt.exe
  C:\Windows\System\TFXtkwt.exe
  2⤵
  PID:3164
- C:\Windows\System\pHRaZgN.exe
  C:\Windows\System\pHRaZgN.exe
  2⤵
  PID:3184
- C:\Windows\System\AbXbpLP.exe
  C:\Windows\System\AbXbpLP.exe
  2⤵
  PID:3188
- C:\Windows\System\UVIIrCV.exe
  C:\Windows\System\UVIIrCV.exe
  2⤵
  PID:3224
- C:\Windows\System\zTtdMYv.exe
  C:\Windows\System\zTtdMYv.exe
  2⤵
  PID:3288
- C:\Windows\System\mRuPfve.exe
  C:\Windows\System\mRuPfve.exe
  2⤵
  PID:3276
- C:\Windows\System\aininrJ.exe
  C:\Windows\System\aininrJ.exe
  2⤵
  PID:3272
- C:\Windows\System\rcHWedO.exe
  C:\Windows\System\rcHWedO.exe
  2⤵
  PID:3356
- C:\Windows\System\JCThtuv.exe
  C:\Windows\System\JCThtuv.exe
  2⤵
  PID:3392
- C:\Windows\System\ipfLMEe.exe
  C:\Windows\System\ipfLMEe.exe
  2⤵
  PID:3352
- C:\Windows\System\uRYtWkx.exe
  C:\Windows\System\uRYtWkx.exe
  2⤵
  PID:3408
- C:\Windows\System\MxyIVVR.exe
  C:\Windows\System\MxyIVVR.exe
  2⤵
  PID:3420
- C:\Windows\System\klKwsIR.exe
  C:\Windows\System\klKwsIR.exe
  2⤵
  PID:3488
- C:\Windows\System\umKNbLq.exe
  C:\Windows\System\umKNbLq.exe
  2⤵
  PID:3556
- C:\Windows\System\hAdTQRq.exe
  C:\Windows\System\hAdTQRq.exe
  2⤵
  PID:3476
- C:\Windows\System\iQWEDzQ.exe
  C:\Windows\System\iQWEDzQ.exe
  2⤵
  PID:3576
- C:\Windows\System\RIVhrvt.exe
  C:\Windows\System\RIVhrvt.exe
  2⤵
  PID:3616
- C:\Windows\System\fOGTIAm.exe
  C:\Windows\System\fOGTIAm.exe
  2⤵
  PID:3660
- C:\Windows\System\WFFToHg.exe
  C:\Windows\System\WFFToHg.exe
  2⤵
  PID:3736
- C:\Windows\System\sGOaBJe.exe
  C:\Windows\System\sGOaBJe.exe
  2⤵
  PID:3716
- C:\Windows\System\NbFjUOa.exe
  C:\Windows\System\NbFjUOa.exe
  2⤵
  PID:3764
- C:\Windows\System\omqAjEz.exe
  C:\Windows\System\omqAjEz.exe
  2⤵
  PID:3592
- C:\Windows\System\wCSvrUj.exe
  C:\Windows\System\wCSvrUj.exe
  2⤵
  PID:3780
- C:\Windows\System\efvmlWW.exe
  C:\Windows\System\efvmlWW.exe
  2⤵
  PID:3788
- C:\Windows\System\QSmOAex.exe
  C:\Windows\System\QSmOAex.exe
  2⤵
  PID:3740
- C:\Windows\System\uetGicx.exe
  C:\Windows\System\uetGicx.exe
  2⤵
  PID:3812
- C:\Windows\System\RbRHTRK.exe
  C:\Windows\System\RbRHTRK.exe
  2⤵
  PID:3832
- C:\Windows\System\SilRCtm.exe
  C:\Windows\System\SilRCtm.exe
  2⤵
  PID:2844
- C:\Windows\System\bhogCCJ.exe
  C:\Windows\System\bhogCCJ.exe
  2⤵
  PID:2432
- C:\Windows\System\eiAzzJE.exe
  C:\Windows\System\eiAzzJE.exe
  2⤵
  PID:3864
- C:\Windows\System\IgPToxT.exe
  C:\Windows\System\IgPToxT.exe
  2⤵
  PID:3888
- C:\Windows\System\DCqOGuY.exe
  C:\Windows\System\DCqOGuY.exe
  2⤵
  PID:4024
- C:\Windows\System\XmrObqN.exe
  C:\Windows\System\XmrObqN.exe
  2⤵
  PID:3960
- C:\Windows\System\ynwLdIY.exe
  C:\Windows\System\ynwLdIY.exe
  2⤵
  PID:3908
- C:\Windows\System\ADcjQEK.exe
  C:\Windows\System\ADcjQEK.exe
  2⤵
  PID:4064
- C:\Windows\System\MwJtGim.exe
  C:\Windows\System\MwJtGim.exe
  2⤵
  PID:4008
- C:\Windows\System\tyHFRiG.exe
  C:\Windows\System\tyHFRiG.exe
  2⤵
  PID:4040
- C:\Windows\System\IUlkzQA.exe
  C:\Windows\System\IUlkzQA.exe
  2⤵
  PID:1092
- C:\Windows\System\tVRTZzA.exe
  C:\Windows\System\tVRTZzA.exe
  2⤵
  PID:3104
- C:\Windows\System\AmxqZSC.exe
  C:\Windows\System\AmxqZSC.exe
  2⤵
  PID:4052
- C:\Windows\System\lvqjOkX.exe
  C:\Windows\System\lvqjOkX.exe
  2⤵
  PID:3116
- C:\Windows\System\DbuZHHS.exe
  C:\Windows\System\DbuZHHS.exe
  2⤵
  PID:2200
- C:\Windows\System\BQPgqYM.exe
  C:\Windows\System\BQPgqYM.exe
  2⤵
  PID:1536
- C:\Windows\System\WjdzonO.exe
  C:\Windows\System\WjdzonO.exe
  2⤵
  PID:3204
- C:\Windows\System\AWJJOJa.exe
  C:\Windows\System\AWJJOJa.exe
  2⤵
  PID:3208
- C:\Windows\System\pLUFGxZ.exe
  C:\Windows\System\pLUFGxZ.exe
  2⤵
  PID:2076
- C:\Windows\System\znIHdim.exe
  C:\Windows\System\znIHdim.exe
  2⤵
  PID:3172
- C:\Windows\System\jopStod.exe
  C:\Windows\System\jopStod.exe
  2⤵
  PID:3544
- C:\Windows\System\cZrGhYc.exe
  C:\Windows\System\cZrGhYc.exe
  2⤵
  PID:3384
- C:\Windows\System\TGdgaGK.exe
  C:\Windows\System\TGdgaGK.exe
  2⤵
  PID:3440
- C:\Windows\System\YPgssBy.exe
  C:\Windows\System\YPgssBy.exe
  2⤵
  PID:3756
- C:\Windows\System\EgBduqu.exe
  C:\Windows\System\EgBduqu.exe
  2⤵
  PID:3600
- C:\Windows\System\DXMSMMX.exe
  C:\Windows\System\DXMSMMX.exe
  2⤵
  PID:3632
- C:\Windows\System\HsWPLyq.exe
  C:\Windows\System\HsWPLyq.exe
  2⤵
  PID:3528
- C:\Windows\System\BNgVTmO.exe
  C:\Windows\System\BNgVTmO.exe
  2⤵
  PID:3784
- C:\Windows\System\vHqZSsI.exe
  C:\Windows\System\vHqZSsI.exe
  2⤵
  PID:2332
- C:\Windows\System\OJyhHow.exe
  C:\Windows\System\OJyhHow.exe
  2⤵
  PID:3876
- C:\Windows\System\QhTxRex.exe
  C:\Windows\System\QhTxRex.exe
  2⤵
  PID:3944
- C:\Windows\System\stwoyyW.exe
  C:\Windows\System\stwoyyW.exe
  2⤵
  PID:3860
- C:\Windows\System\UrbhUMJ.exe
  C:\Windows\System\UrbhUMJ.exe
  2⤵
  PID:3980
- C:\Windows\System\EqClYqW.exe
  C:\Windows\System\EqClYqW.exe
  2⤵
  PID:2840
- C:\Windows\System\XBTYjrV.exe
  C:\Windows\System\XBTYjrV.exe
  2⤵
  PID:4044
- C:\Windows\System\ABCbvDk.exe
  C:\Windows\System\ABCbvDk.exe
  2⤵
  PID:1352
- C:\Windows\System\GnVQpVC.exe
  C:\Windows\System\GnVQpVC.exe
  2⤵
  PID:3236
- C:\Windows\System\jvCJBNq.exe
  C:\Windows\System\jvCJBNq.exe
  2⤵
  PID:3156
- C:\Windows\System\OnUhuZi.exe
  C:\Windows\System\OnUhuZi.exe
  2⤵
  PID:280
- C:\Windows\System\oUBFzcv.exe
  C:\Windows\System\oUBFzcv.exe
  2⤵
  PID:3220
- C:\Windows\System\aExJFMU.exe
  C:\Windows\System\aExJFMU.exe
  2⤵
  PID:3612
- C:\Windows\System\CZWpaGs.exe
  C:\Windows\System\CZWpaGs.exe
  2⤵
  PID:3540
- C:\Windows\System\FvWGENR.exe
  C:\Windows\System\FvWGENR.exe
  2⤵
  PID:3588
- C:\Windows\System\aFMjERV.exe
  C:\Windows\System\aFMjERV.exe
  2⤵
  PID:3836
- C:\Windows\System\vkrfDkp.exe
  C:\Windows\System\vkrfDkp.exe
  2⤵
  PID:2528
- C:\Windows\System\sAZiEqA.exe
  C:\Windows\System\sAZiEqA.exe
  2⤵
  PID:4048
- C:\Windows\System\mLEezNz.exe
  C:\Windows\System\mLEezNz.exe
  2⤵
  PID:2748
- C:\Windows\System\JdDIqUe.exe
  C:\Windows\System\JdDIqUe.exe
  2⤵
  PID:3848
- C:\Windows\System\MSWrMvg.exe
  C:\Windows\System\MSWrMvg.exe
  2⤵
  PID:2128
- C:\Windows\System\BbcngTy.exe
  C:\Windows\System\BbcngTy.exe
  2⤵
  PID:3508
- C:\Windows\System\GcBMFgI.exe
  C:\Windows\System\GcBMFgI.exe
  2⤵
  PID:3796
- C:\Windows\System\fcQXjmV.exe
  C:\Windows\System\fcQXjmV.exe
  2⤵
  PID:3992
- C:\Windows\System\LYfgdJM.exe
  C:\Windows\System\LYfgdJM.exe
  2⤵
  PID:2552
- C:\Windows\System\QtJTqkh.exe
  C:\Windows\System\QtJTqkh.exe
  2⤵
  PID:3844
- C:\Windows\System\zdORyEA.exe
  C:\Windows\System\zdORyEA.exe
  2⤵
  PID:2340
- C:\Windows\System\UwcFFnj.exe
  C:\Windows\System\UwcFFnj.exe
  2⤵
  PID:4108
- C:\Windows\System\rZcJhgS.exe
  C:\Windows\System\rZcJhgS.exe
  2⤵
  PID:4128
- C:\Windows\System\RKdZDxN.exe
  C:\Windows\System\RKdZDxN.exe
  2⤵
  PID:4144
- C:\Windows\System\bJxtwwv.exe
  C:\Windows\System\bJxtwwv.exe
  2⤵
  PID:4160
- C:\Windows\System\OTdEGpH.exe
  C:\Windows\System\OTdEGpH.exe
  2⤵
  PID:4176
- C:\Windows\System\yGKPBFa.exe
  C:\Windows\System\yGKPBFa.exe
  2⤵
  PID:4204
- C:\Windows\System\xeFTIMV.exe
  C:\Windows\System\xeFTIMV.exe
  2⤵
  PID:4220
- C:\Windows\System\HEtZIlE.exe
  C:\Windows\System\HEtZIlE.exe
  2⤵
  PID:4240
- C:\Windows\System\HnEnwIa.exe
  C:\Windows\System\HnEnwIa.exe
  2⤵
  PID:4272
- C:\Windows\System\RaWZajV.exe
  C:\Windows\System\RaWZajV.exe
  2⤵
  PID:4320
- C:\Windows\System\FSxuxxC.exe
  C:\Windows\System\FSxuxxC.exe
  2⤵
  PID:4336
- C:\Windows\System\krnqxpt.exe
  C:\Windows\System\krnqxpt.exe
  2⤵
  PID:4356
- C:\Windows\System\OrpgNGL.exe
  C:\Windows\System\OrpgNGL.exe
  2⤵
  PID:4380
- C:\Windows\System\XkwddeA.exe
  C:\Windows\System\XkwddeA.exe
  2⤵
  PID:4396
- C:\Windows\System\voSXZtP.exe
  C:\Windows\System\voSXZtP.exe
  2⤵
  PID:4416
- C:\Windows\System\HCgafYw.exe
  C:\Windows\System\HCgafYw.exe
  2⤵
  PID:4432
- C:\Windows\System\pChrsuF.exe
  C:\Windows\System\pChrsuF.exe
  2⤵
  PID:4452
- C:\Windows\System\JurELEI.exe
  C:\Windows\System\JurELEI.exe
  2⤵
  PID:4468
- C:\Windows\System\cyFjFrp.exe
  C:\Windows\System\cyFjFrp.exe
  2⤵
  PID:4496
- C:\Windows\System\LWtqhEj.exe
  C:\Windows\System\LWtqhEj.exe
  2⤵
  PID:4512
- C:\Windows\System\FjoFQBa.exe
  C:\Windows\System\FjoFQBa.exe
  2⤵
  PID:4528
- C:\Windows\System\OuhCBzZ.exe
  C:\Windows\System\OuhCBzZ.exe
  2⤵
  PID:4544
- C:\Windows\System\SAWmkAY.exe
  C:\Windows\System\SAWmkAY.exe
  2⤵
  PID:4560
- C:\Windows\System\lZzWZNw.exe
  C:\Windows\System\lZzWZNw.exe
  2⤵
  PID:4592
- C:\Windows\System\suuniqC.exe
  C:\Windows\System\suuniqC.exe
  2⤵
  PID:4608
- C:\Windows\System\uFdWTzz.exe
  C:\Windows\System\uFdWTzz.exe
  2⤵
  PID:4624
- C:\Windows\System\YAPyymf.exe
  C:\Windows\System\YAPyymf.exe
  2⤵
  PID:4640
- C:\Windows\System\XUQCXKa.exe
  C:\Windows\System\XUQCXKa.exe
  2⤵
  PID:4656
- C:\Windows\System\vbiuPRl.exe
  C:\Windows\System\vbiuPRl.exe
  2⤵
  PID:4672
- C:\Windows\System\crDWQRc.exe
  C:\Windows\System\crDWQRc.exe
  2⤵
  PID:4688
- C:\Windows\System\SkTYkjV.exe
  C:\Windows\System\SkTYkjV.exe
  2⤵
  PID:4704
- C:\Windows\System\jTizOZq.exe
  C:\Windows\System\jTizOZq.exe
  2⤵
  PID:4724
- C:\Windows\System\gddUMaH.exe
  C:\Windows\System\gddUMaH.exe
  2⤵
  PID:4740
- C:\Windows\System\QWVyZeR.exe
  C:\Windows\System\QWVyZeR.exe
  2⤵
  PID:4756
- C:\Windows\System\zcxcwCM.exe
  C:\Windows\System\zcxcwCM.exe
  2⤵
  PID:4776
- C:\Windows\System\CwhYlBP.exe
  C:\Windows\System\CwhYlBP.exe
  2⤵
  PID:4800
- C:\Windows\System\IAUyQDx.exe
  C:\Windows\System\IAUyQDx.exe
  2⤵
  PID:4816
- C:\Windows\System\lPoRFYg.exe
  C:\Windows\System\lPoRFYg.exe
  2⤵
  PID:4832
- C:\Windows\System\sBHAtjr.exe
  C:\Windows\System\sBHAtjr.exe
  2⤵
  PID:4848
- C:\Windows\System\XjSbnIA.exe
  C:\Windows\System\XjSbnIA.exe
  2⤵
  PID:4864
- C:\Windows\System\VyXbkYX.exe
  C:\Windows\System\VyXbkYX.exe
  2⤵
  PID:4880
- C:\Windows\System\sEMFsRF.exe
  C:\Windows\System\sEMFsRF.exe
  2⤵
  PID:4908
- C:\Windows\System\hHafvPb.exe
  C:\Windows\System\hHafvPb.exe
  2⤵
  PID:4924
- C:\Windows\System\flLpEfV.exe
  C:\Windows\System\flLpEfV.exe
  2⤵
  PID:4940
- C:\Windows\System\dxzyotN.exe
  C:\Windows\System\dxzyotN.exe
  2⤵
  PID:4956
- C:\Windows\System\fXkECgd.exe
  C:\Windows\System\fXkECgd.exe
  2⤵
  PID:4972
- C:\Windows\System\KDVSgWY.exe
  C:\Windows\System\KDVSgWY.exe
  2⤵
  PID:4988
- C:\Windows\System\DJlJmdo.exe
  C:\Windows\System\DJlJmdo.exe
  2⤵
  PID:5004
- C:\Windows\System\wfkjdyt.exe
  C:\Windows\System\wfkjdyt.exe
  2⤵
  PID:5020
- C:\Windows\System\UFtFAyx.exe
  C:\Windows\System\UFtFAyx.exe
  2⤵
  PID:5036
- C:\Windows\System\dIQnAOS.exe
  C:\Windows\System\dIQnAOS.exe
  2⤵
  PID:5052
- C:\Windows\System\AjCcLcm.exe
  C:\Windows\System\AjCcLcm.exe
  2⤵
  PID:5068
- C:\Windows\System\SFEhgWm.exe
  C:\Windows\System\SFEhgWm.exe
  2⤵
  PID:5084
- C:\Windows\System\bEuqbmX.exe
  C:\Windows\System\bEuqbmX.exe
  2⤵
  PID:5100
- C:\Windows\System\WEkrxGz.exe
  C:\Windows\System\WEkrxGz.exe
  2⤵
  PID:5116
- C:\Windows\System\oqXvZAI.exe
  C:\Windows\System\oqXvZAI.exe
  2⤵
  PID:4100
- C:\Windows\System\oYtOiQh.exe
  C:\Windows\System\oYtOiQh.exe
  2⤵
  PID:1764
- C:\Windows\System\AlWmYpW.exe
  C:\Windows\System\AlWmYpW.exe
  2⤵
  PID:4124
- C:\Windows\System\ntZCkSb.exe
  C:\Windows\System\ntZCkSb.exe
  2⤵
  PID:4156
- C:\Windows\System\dxfEIWR.exe
  C:\Windows\System\dxfEIWR.exe
  2⤵
  PID:4228
- C:\Windows\System\CNixNSF.exe
  C:\Windows\System\CNixNSF.exe
  2⤵
  PID:4192
- C:\Windows\System\BQKBqVZ.exe
  C:\Windows\System\BQKBqVZ.exe
  2⤵
  PID:4264
- C:\Windows\System\alJcaGP.exe
  C:\Windows\System\alJcaGP.exe
  2⤵
  PID:4280
- C:\Windows\System\wcANsKN.exe
  C:\Windows\System\wcANsKN.exe
  2⤵
  PID:4328
- C:\Windows\System\CGiHQYE.exe
  C:\Windows\System\CGiHQYE.exe
  2⤵
  PID:4300
- C:\Windows\System\sPLIiYg.exe
  C:\Windows\System\sPLIiYg.exe
  2⤵
  PID:4364
- C:\Windows\System\OtTgQeB.exe
  C:\Windows\System\OtTgQeB.exe
  2⤵
  PID:4352
- C:\Windows\System\CCBuexu.exe
  C:\Windows\System\CCBuexu.exe
  2⤵
  PID:4408
- C:\Windows\System\atiysEA.exe
  C:\Windows\System\atiysEA.exe
  2⤵
  PID:4348
- C:\Windows\System\DGTuEne.exe
  C:\Windows\System\DGTuEne.exe
  2⤵
  PID:4476
- C:\Windows\System\oFkQRIv.exe
  C:\Windows\System\oFkQRIv.exe
  2⤵
  PID:4460
- C:\Windows\System\sqWPRAC.exe
  C:\Windows\System\sqWPRAC.exe
  2⤵
  PID:4492
- C:\Windows\System\PuEOmhR.exe
  C:\Windows\System\PuEOmhR.exe
  2⤵
  PID:4508
- C:\Windows\System\QEaQzhL.exe
  C:\Windows\System\QEaQzhL.exe
  2⤵
  PID:4600
- C:\Windows\System\MPMTbLQ.exe
  C:\Windows\System\MPMTbLQ.exe
  2⤵
  PID:4636
- C:\Windows\System\lCVdkSM.exe
  C:\Windows\System\lCVdkSM.exe
  2⤵
  PID:4700
- C:\Windows\System\JbZOiFc.exe
  C:\Windows\System\JbZOiFc.exe
  2⤵
  PID:4736
- C:\Windows\System\tLFBApx.exe
  C:\Windows\System\tLFBApx.exe
  2⤵
  PID:4620
- C:\Windows\System\uydvMhO.exe
  C:\Windows\System\uydvMhO.exe
  2⤵
  PID:4588
- C:\Windows\System\aBejhfn.exe
  C:\Windows\System\aBejhfn.exe
  2⤵
  PID:4764
- C:\Windows\System\rEJKNAT.exe
  C:\Windows\System\rEJKNAT.exe
  2⤵
  PID:4772
- C:\Windows\System\IiemwXE.exe
  C:\Windows\System\IiemwXE.exe
  2⤵
  PID:4812
- C:\Windows\System\EYkhULd.exe
  C:\Windows\System\EYkhULd.exe
  2⤵
  PID:4872
- C:\Windows\System\IAGYsZR.exe
  C:\Windows\System\IAGYsZR.exe
  2⤵
  PID:4792
- C:\Windows\System\CxJMmFp.exe
  C:\Windows\System\CxJMmFp.exe
  2⤵
  PID:4892
- C:\Windows\System\ePSfBiI.exe
  C:\Windows\System\ePSfBiI.exe
  2⤵
  PID:4856
- C:\Windows\System\tzvdbcu.exe
  C:\Windows\System\tzvdbcu.exe
  2⤵
  PID:4980
- C:\Windows\System\hppuvml.exe
  C:\Windows\System\hppuvml.exe
  2⤵
  PID:5012
- C:\Windows\System\JWAdjlH.exe
  C:\Windows\System\JWAdjlH.exe
  2⤵
  PID:4996
- C:\Windows\System\uZZYAsK.exe
  C:\Windows\System\uZZYAsK.exe
  2⤵
  PID:5028
- C:\Windows\System\xTztFyM.exe
  C:\Windows\System\xTztFyM.exe
  2⤵
  PID:5108
- C:\Windows\System\osJLkoh.exe
  C:\Windows\System\osJLkoh.exe
  2⤵
  PID:3940
- C:\Windows\System\MoSDZel.exe
  C:\Windows\System\MoSDZel.exe
  2⤵
  PID:5064
- C:\Windows\System\HFLUesi.exe
  C:\Windows\System\HFLUesi.exe
  2⤵
  PID:4152
- C:\Windows\System\LtbRoXQ.exe
  C:\Windows\System\LtbRoXQ.exe
  2⤵
  PID:4296
- C:\Windows\System\hNNvJDC.exe
  C:\Windows\System\hNNvJDC.exe
  2⤵
  PID:4344
- C:\Windows\System\TOFfdvv.exe
  C:\Windows\System\TOFfdvv.exe
  2⤵
  PID:4464
- C:\Windows\System\zomSMKq.exe
  C:\Windows\System\zomSMKq.exe
  2⤵
  PID:4312
- C:\Windows\System\ghoIfeS.exe
  C:\Windows\System\ghoIfeS.exe
  2⤵
  PID:4404
- C:\Windows\System\cXAgHIz.exe
  C:\Windows\System\cXAgHIz.exe
  2⤵
  PID:4504
- C:\Windows\System\ghWdDdA.exe
  C:\Windows\System\ghWdDdA.exe
  2⤵
  PID:4696
- C:\Windows\System\dHIjQDs.exe
  C:\Windows\System\dHIjQDs.exe
  2⤵
  PID:4580
- C:\Windows\System\NHAnECY.exe
  C:\Windows\System\NHAnECY.exe
  2⤵
  PID:4752
- C:\Windows\System\fxHvHtS.exe
  C:\Windows\System\fxHvHtS.exe
  2⤵
  PID:4824
- C:\Windows\System\GeDumHf.exe
  C:\Windows\System\GeDumHf.exe
  2⤵
  PID:4964
- C:\Windows\System\uwFwilL.exe
  C:\Windows\System\uwFwilL.exe
  2⤵
  PID:4936
- C:\Windows\System\CJgyZGF.exe
  C:\Windows\System\CJgyZGF.exe
  2⤵
  PID:4896
- C:\Windows\System\tjkSmYD.exe
  C:\Windows\System\tjkSmYD.exe
  2⤵
  PID:5032
- C:\Windows\System\LBOzICB.exe
  C:\Windows\System\LBOzICB.exe
  2⤵
  PID:4104
- C:\Windows\System\lYyJiGX.exe
  C:\Windows\System\lYyJiGX.exe
  2⤵
  PID:4236
- C:\Windows\System\FCgqDxF.exe
  C:\Windows\System\FCgqDxF.exe
  2⤵
  PID:4260
- C:\Windows\System\GPDvAjG.exe
  C:\Windows\System\GPDvAjG.exe
  2⤵
  PID:4216
- C:\Windows\System\qUiQJoC.exe
  C:\Windows\System\qUiQJoC.exe
  2⤵
  PID:3584
- C:\Windows\System\BBuafuE.exe
  C:\Windows\System\BBuafuE.exe
  2⤵
  PID:4388
- C:\Windows\System\WYNaFyn.exe
  C:\Windows\System\WYNaFyn.exe
  2⤵
  PID:1260
- C:\Windows\System\JJPhfPR.exe
  C:\Windows\System\JJPhfPR.exe
  2⤵
  PID:4684
- C:\Windows\System\AaqpEKf.exe
  C:\Windows\System\AaqpEKf.exe
  2⤵
  PID:4668
- C:\Windows\System\pumaKaK.exe
  C:\Windows\System\pumaKaK.exe
  2⤵
  PID:4888
- C:\Windows\System\TDTUGGJ.exe
  C:\Windows\System\TDTUGGJ.exe
  2⤵
  PID:4524
- C:\Windows\System\qyUpvDu.exe
  C:\Windows\System\qyUpvDu.exe
  2⤵
  PID:4540
- C:\Windows\System\FmfUEdP.exe
  C:\Windows\System\FmfUEdP.exe
  2⤵
  PID:4900
- C:\Windows\System\neWJGwe.exe
  C:\Windows\System\neWJGwe.exe
  2⤵
  PID:4252
- C:\Windows\System\jYUwPiA.exe
  C:\Windows\System\jYUwPiA.exe
  2⤵
  PID:5076
- C:\Windows\System\LwuCUQb.exe
  C:\Windows\System\LwuCUQb.exe
  2⤵
  PID:4304
- C:\Windows\System\Kqpgmdl.exe
  C:\Windows\System\Kqpgmdl.exe
  2⤵
  PID:4172
- C:\Windows\System\synkqDt.exe
  C:\Windows\System\synkqDt.exe
  2⤵
  PID:4576
- C:\Windows\System\LLphLUX.exe
  C:\Windows\System\LLphLUX.exe
  2⤵
  PID:2712
- C:\Windows\System\OptegDP.exe
  C:\Windows\System\OptegDP.exe
  2⤵
  PID:112
- C:\Windows\System\qaRIsuq.exe
  C:\Windows\System\qaRIsuq.exe
  2⤵
  PID:4720
- C:\Windows\System\hECaMkL.exe
  C:\Windows\System\hECaMkL.exe
  2⤵
  PID:5128
- C:\Windows\System\flXJZew.exe
  C:\Windows\System\flXJZew.exe
  2⤵
  PID:5144
- C:\Windows\System\gTgTtiC.exe
  C:\Windows\System\gTgTtiC.exe
  2⤵
  PID:5184
- C:\Windows\System\joRBZGt.exe
  C:\Windows\System\joRBZGt.exe
  2⤵
  PID:5200
- C:\Windows\System\lyiLSzK.exe
  C:\Windows\System\lyiLSzK.exe
  2⤵
  PID:5216
- C:\Windows\System\fabETfP.exe
  C:\Windows\System\fabETfP.exe
  2⤵
  PID:5236
- C:\Windows\System\jhydVqd.exe
  C:\Windows\System\jhydVqd.exe
  2⤵
  PID:5252
- C:\Windows\System\ojzFICC.exe
  C:\Windows\System\ojzFICC.exe
  2⤵
  PID:5268
- C:\Windows\System\OaQkqUe.exe
  C:\Windows\System\OaQkqUe.exe
  2⤵
  PID:5284
- C:\Windows\System\zRtBNAa.exe
  C:\Windows\System\zRtBNAa.exe
  2⤵
  PID:5300
- C:\Windows\System\VAMstvd.exe
  C:\Windows\System\VAMstvd.exe
  2⤵
  PID:5316
- C:\Windows\System\NDSaCbR.exe
  C:\Windows\System\NDSaCbR.exe
  2⤵
  PID:5332
- C:\Windows\System\nWQIqip.exe
  C:\Windows\System\nWQIqip.exe
  2⤵
  PID:5348
- C:\Windows\System\fWQKtSI.exe
  C:\Windows\System\fWQKtSI.exe
  2⤵
  PID:5364
- C:\Windows\System\FpOKVRr.exe
  C:\Windows\System\FpOKVRr.exe
  2⤵
  PID:5384
- C:\Windows\System\PlKpEPq.exe
  C:\Windows\System\PlKpEPq.exe
  2⤵
  PID:5400
- C:\Windows\System\ellIqSq.exe
  C:\Windows\System\ellIqSq.exe
  2⤵
  PID:5416
- C:\Windows\System\ZZKiqKd.exe
  C:\Windows\System\ZZKiqKd.exe
  2⤵
  PID:5432
- C:\Windows\System\hYCpoSh.exe
  C:\Windows\System\hYCpoSh.exe
  2⤵
  PID:5452
- C:\Windows\System\MEwFrwE.exe
  C:\Windows\System\MEwFrwE.exe
  2⤵
  PID:5476
- C:\Windows\System\SNKikQz.exe
  C:\Windows\System\SNKikQz.exe
  2⤵
  PID:5492
- C:\Windows\System\LOYkPRj.exe
  C:\Windows\System\LOYkPRj.exe
  2⤵
  PID:5508
- C:\Windows\System\iRRTEeD.exe
  C:\Windows\System\iRRTEeD.exe
  2⤵
  PID:5532
- C:\Windows\System\iRrnRQB.exe
  C:\Windows\System\iRrnRQB.exe
  2⤵
  PID:5548
- C:\Windows\System\kMhzSpj.exe
  C:\Windows\System\kMhzSpj.exe
  2⤵
  PID:5564
- C:\Windows\System\HycFgQN.exe
  C:\Windows\System\HycFgQN.exe
  2⤵
  PID:5584
- C:\Windows\System\UDNEfmb.exe
  C:\Windows\System\UDNEfmb.exe
  2⤵
  PID:5600
- C:\Windows\System\fahNxCU.exe
  C:\Windows\System\fahNxCU.exe
  2⤵
  PID:5616
- C:\Windows\System\SNRMMKd.exe
  C:\Windows\System\SNRMMKd.exe
  2⤵
  PID:5636
- C:\Windows\System\kNXNKgB.exe
  C:\Windows\System\kNXNKgB.exe
  2⤵
  PID:5656
- C:\Windows\System\YPzdjfm.exe
  C:\Windows\System\YPzdjfm.exe
  2⤵
  PID:5676
- C:\Windows\System\FZqiwlJ.exe
  C:\Windows\System\FZqiwlJ.exe
  2⤵
  PID:5724
- C:\Windows\System\JEHuFqt.exe
  C:\Windows\System\JEHuFqt.exe
  2⤵
  PID:5740
- C:\Windows\System\DLlGRqc.exe
  C:\Windows\System\DLlGRqc.exe
  2⤵
  PID:5760
- C:\Windows\System\CxwZvks.exe
  C:\Windows\System\CxwZvks.exe
  2⤵
  PID:5776
- C:\Windows\System\aCXtinr.exe
  C:\Windows\System\aCXtinr.exe
  2⤵
  PID:5796
- C:\Windows\System\lcyLWpE.exe
  C:\Windows\System\lcyLWpE.exe
  2⤵
  PID:5816
- C:\Windows\System\RwdtZXv.exe
  C:\Windows\System\RwdtZXv.exe
  2⤵
  PID:5832
- C:\Windows\System\oVWNnUd.exe
  C:\Windows\System\oVWNnUd.exe
  2⤵
  PID:5852
- C:\Windows\System\hJWxRux.exe
  C:\Windows\System\hJWxRux.exe
  2⤵
  PID:5868
- C:\Windows\System\nCOTpjD.exe
  C:\Windows\System\nCOTpjD.exe
  2⤵
  PID:5884
- C:\Windows\System\ssMXTov.exe
  C:\Windows\System\ssMXTov.exe
  2⤵
  PID:5900
- C:\Windows\System\jFBvZur.exe
  C:\Windows\System\jFBvZur.exe
  2⤵
  PID:5920
- C:\Windows\System\BqjmPWm.exe
  C:\Windows\System\BqjmPWm.exe
  2⤵
  PID:5936
- C:\Windows\System\URKcGjS.exe
  C:\Windows\System\URKcGjS.exe
  2⤵
  PID:5952
- C:\Windows\System\GTfJgIn.exe
  C:\Windows\System\GTfJgIn.exe
  2⤵
  PID:5968
- C:\Windows\System\Khgzicc.exe
  C:\Windows\System\Khgzicc.exe
  2⤵
  PID:5984
- C:\Windows\System\scJBizU.exe
  C:\Windows\System\scJBizU.exe
  2⤵
  PID:6000
- C:\Windows\System\xUDxUVO.exe
  C:\Windows\System\xUDxUVO.exe
  2⤵
  PID:6016
- C:\Windows\System\PQkUBod.exe
  C:\Windows\System\PQkUBod.exe
  2⤵
  PID:6032
- C:\Windows\System\RbjOAHy.exe
  C:\Windows\System\RbjOAHy.exe
  2⤵
  PID:6052
- C:\Windows\System\XbCjWoA.exe
  C:\Windows\System\XbCjWoA.exe
  2⤵
  PID:6068
- C:\Windows\System\scdktSp.exe
  C:\Windows\System\scdktSp.exe
  2⤵
  PID:6084
- C:\Windows\System\vMCQFAd.exe
  C:\Windows\System\vMCQFAd.exe
  2⤵
  PID:6100
- C:\Windows\System\ZSkFLcs.exe
  C:\Windows\System\ZSkFLcs.exe
  2⤵
  PID:6116
- C:\Windows\System\lOmCSSe.exe
  C:\Windows\System\lOmCSSe.exe
  2⤵
  PID:6132
- C:\Windows\System\Nyajsbg.exe
  C:\Windows\System\Nyajsbg.exe
  2⤵
  PID:5140
- C:\Windows\System\UIIjRGh.exe
  C:\Windows\System\UIIjRGh.exe
  2⤵
  PID:5224
- C:\Windows\System\JOIJJuY.exe
  C:\Windows\System\JOIJJuY.exe
  2⤵
  PID:1844
- C:\Windows\System\DkCNyaY.exe
  C:\Windows\System\DkCNyaY.exe
  2⤵
  PID:5176
- C:\Windows\System\NvSkRIy.exe
  C:\Windows\System\NvSkRIy.exe
  2⤵
  PID:5164
- C:\Windows\System\TZhlJzV.exe
  C:\Windows\System\TZhlJzV.exe
  2⤵
  PID:5244
- C:\Windows\System\NVjdUqN.exe
  C:\Windows\System\NVjdUqN.exe
  2⤵
  PID:5324
- C:\Windows\System\ixINdgr.exe
  C:\Windows\System\ixINdgr.exe
  2⤵
  PID:5360
- C:\Windows\System\pTVTXZR.exe
  C:\Windows\System\pTVTXZR.exe
  2⤵
  PID:5428
- C:\Windows\System\HZZwcpE.exe
  C:\Windows\System\HZZwcpE.exe
  2⤵
  PID:5468
- C:\Windows\System\BKTDRcV.exe
  C:\Windows\System\BKTDRcV.exe
  2⤵
  PID:5376
- C:\Windows\System\BLzWOrW.exe
  C:\Windows\System\BLzWOrW.exe
  2⤵
  PID:5448
- C:\Windows\System\oPAGXqy.exe
  C:\Windows\System\oPAGXqy.exe
  2⤵
  PID:5408
- C:\Windows\System\ljetSkd.exe
  C:\Windows\System\ljetSkd.exe
  2⤵
  PID:5608
- C:\Windows\System\iEEeFrb.exe
  C:\Windows\System\iEEeFrb.exe
  2⤵
  PID:5560
- C:\Windows\System\rvbjsLR.exe
  C:\Windows\System\rvbjsLR.exe
  2⤵
  PID:5556
- C:\Windows\System\uFFLxMf.exe
  C:\Windows\System\uFFLxMf.exe
  2⤵
  PID:5652
- C:\Windows\System\kIJEmvE.exe
  C:\Windows\System\kIJEmvE.exe
  2⤵
  PID:5684
- C:\Windows\System\YhPeaZU.exe
  C:\Windows\System\YhPeaZU.exe
  2⤵
  PID:5672
- C:\Windows\System\jpigwEe.exe
  C:\Windows\System\jpigwEe.exe
  2⤵
  PID:5704
- C:\Windows\System\LOwnayy.exe
  C:\Windows\System\LOwnayy.exe
  2⤵
  PID:5720
- C:\Windows\System\cFgSKHs.exe
  C:\Windows\System\cFgSKHs.exe
  2⤵
  PID:5784
- C:\Windows\System\mKEKElP.exe
  C:\Windows\System\mKEKElP.exe
  2⤵
  PID:5768
- C:\Windows\System\GxPgvCX.exe
  C:\Windows\System\GxPgvCX.exe
  2⤵
  PID:5824
- C:\Windows\System\AzkOGGr.exe
  C:\Windows\System\AzkOGGr.exe
  2⤵
  PID:5840
- C:\Windows\System\AQecMXV.exe
  C:\Windows\System\AQecMXV.exe
  2⤵
  PID:5804
- C:\Windows\System\VPyuWcz.exe
  C:\Windows\System\VPyuWcz.exe
  2⤵
  PID:5876
- C:\Windows\System\cThHrpr.exe
  C:\Windows\System\cThHrpr.exe
  2⤵
  PID:5932
- C:\Windows\System\TzoTOoG.exe
  C:\Windows\System\TzoTOoG.exe
  2⤵
  PID:5948
- C:\Windows\System\FupGsSu.exe
  C:\Windows\System\FupGsSu.exe
  2⤵
  PID:5944
- C:\Windows\System\QuASIMt.exe
  C:\Windows\System\QuASIMt.exe
  2⤵
  PID:6028
- C:\Windows\System\mihEwfd.exe
  C:\Windows\System\mihEwfd.exe
  2⤵
  PID:6048
- C:\Windows\System\mJVBpHi.exe
  C:\Windows\System\mJVBpHi.exe
  2⤵
  PID:6092
- C:\Windows\System\uuwDWJq.exe
  C:\Windows\System\uuwDWJq.exe
  2⤵
  PID:6076
- C:\Windows\System\bAKwfte.exe
  C:\Windows\System\bAKwfte.exe
  2⤵
  PID:5124
- C:\Windows\System\ngBNldk.exe
  C:\Windows\System\ngBNldk.exe
  2⤵
  PID:6112
- C:\Windows\System\DtKNwHE.exe
  C:\Windows\System\DtKNwHE.exe
  2⤵
  PID:5356
- C:\Windows\System\UfAexWk.exe
  C:\Windows\System\UfAexWk.exe
  2⤵
  PID:5328
- C:\Windows\System\biaBMSu.exe
  C:\Windows\System\biaBMSu.exe
  2⤵
  PID:5232
- C:\Windows\System\KsLpEcV.exe
  C:\Windows\System\KsLpEcV.exe
  2⤵
  PID:5276
- C:\Windows\System\bGEunPG.exe
  C:\Windows\System\bGEunPG.exe
  2⤵
  PID:5340
- C:\Windows\System\SKQmSIS.exe
  C:\Windows\System\SKQmSIS.exe
  2⤵
  PID:5440
- C:\Windows\System\zRnlIsw.exe
  C:\Windows\System\zRnlIsw.exe
  2⤵
  PID:5624
- C:\Windows\System\RoRrUbm.exe
  C:\Windows\System\RoRrUbm.exe
  2⤵
  PID:5648
- C:\Windows\System\fVfgitw.exe
  C:\Windows\System\fVfgitw.exe
  2⤵
  PID:2608
- C:\Windows\System\VHqrKDx.exe
  C:\Windows\System\VHqrKDx.exe
  2⤵
  PID:5928
- C:\Windows\System\aoPEymg.exe
  C:\Windows\System\aoPEymg.exe
  2⤵
  PID:6044
- C:\Windows\System\EaejiyF.exe
  C:\Windows\System\EaejiyF.exe
  2⤵
  PID:5792
- C:\Windows\System\gLLOxlq.exe
  C:\Windows\System\gLLOxlq.exe
  2⤵
  PID:5848
- C:\Windows\System\EDytHsq.exe
  C:\Windows\System\EDytHsq.exe
  2⤵
  PID:6128
- C:\Windows\System\AoxTxkl.exe
  C:\Windows\System\AoxTxkl.exe
  2⤵
  PID:5152
- C:\Windows\System\pLKSuMv.exe
  C:\Windows\System\pLKSuMv.exe
  2⤵
  PID:5208
- C:\Windows\System\scINQiF.exe
  C:\Windows\System\scINQiF.exe
  2⤵
  PID:5580
- C:\Windows\System\qHfAmPE.exe
  C:\Windows\System\qHfAmPE.exe
  2⤵
  PID:5752
- C:\Windows\System\LgAMDnW.exe
  C:\Windows\System\LgAMDnW.exe
  2⤵
  PID:6140
- C:\Windows\System\JzomcXU.exe
  C:\Windows\System\JzomcXU.exe
  2⤵
  PID:5756
- C:\Windows\System\EtwlKKN.exe
  C:\Windows\System\EtwlKKN.exe
  2⤵
  PID:6156
- C:\Windows\System\eVJukoz.exe
  C:\Windows\System\eVJukoz.exe
  2⤵
  PID:6172
- C:\Windows\System\FbYPWTl.exe
  C:\Windows\System\FbYPWTl.exe
  2⤵
  PID:6188
- C:\Windows\System\bBUaAxR.exe
  C:\Windows\System\bBUaAxR.exe
  2⤵
  PID:6204
- C:\Windows\System\cmOkSXE.exe
  C:\Windows\System\cmOkSXE.exe
  2⤵
  PID:6224
- C:\Windows\System\KAygtyH.exe
  C:\Windows\System\KAygtyH.exe
  2⤵
  PID:6240
- C:\Windows\System\WHlbPDR.exe
  C:\Windows\System\WHlbPDR.exe
  2⤵
  PID:6256
- C:\Windows\System\dRtDKYX.exe
  C:\Windows\System\dRtDKYX.exe
  2⤵
  PID:6276
- C:\Windows\System\bNesXrs.exe
  C:\Windows\System\bNesXrs.exe
  2⤵
  PID:6292
- C:\Windows\System\pwvIeUW.exe
  C:\Windows\System\pwvIeUW.exe
  2⤵
  PID:6308
- C:\Windows\System\OvDLcqK.exe
  C:\Windows\System\OvDLcqK.exe
  2⤵
  PID:6324
- C:\Windows\System\qPOYNWA.exe
  C:\Windows\System\qPOYNWA.exe
  2⤵
  PID:6340
- C:\Windows\System\uqIyHEL.exe
  C:\Windows\System\uqIyHEL.exe
  2⤵
  PID:6376
- C:\Windows\System\yoGKUvi.exe
  C:\Windows\System\yoGKUvi.exe
  2⤵
  PID:7044
- C:\Windows\System\yesOTpf.exe
  C:\Windows\System\yesOTpf.exe
  2⤵
  PID:6264
- C:\Windows\System\gGvhjru.exe
  C:\Windows\System\gGvhjru.exe
  2⤵
  PID:6336
- C:\Windows\System\ftsJMax.exe
  C:\Windows\System\ftsJMax.exe
  2⤵
  PID:6540
- C:\Windows\System\DWOkbuY.exe
  C:\Windows\System\DWOkbuY.exe
  2⤵
  PID:6580
- C:\Windows\System\GzXKmvx.exe
  C:\Windows\System\GzXKmvx.exe
  2⤵
  PID:6592
- C:\Windows\System\EfKZlfD.exe
  C:\Windows\System\EfKZlfD.exe
  2⤵
  PID:6716
- C:\Windows\System\FRbOfbS.exe
  C:\Windows\System\FRbOfbS.exe
  2⤵
  PID:6804
- C:\Windows\System\uFdcqJC.exe
  C:\Windows\System\uFdcqJC.exe
  2⤵
  PID:6824
- C:\Windows\System\PYBQfKq.exe
  C:\Windows\System\PYBQfKq.exe
  2⤵
  PID:7024
- C:\Windows\System\ZSzNiRa.exe
  C:\Windows\System\ZSzNiRa.exe
  2⤵
  PID:6460
- C:\Windows\System\HAqdiYj.exe
  C:\Windows\System\HAqdiYj.exe
  2⤵
  PID:6992
- C:\Windows\System\ODStOlz.exe
  C:\Windows\System\ODStOlz.exe
  2⤵
  PID:6764
- C:\Windows\System\bUhAxfp.exe
  C:\Windows\System\bUhAxfp.exe
  2⤵
  PID:7092
- C:\Windows\System\VesfaoD.exe
  C:\Windows\System\VesfaoD.exe
  2⤵
  PID:2784
- C:\Windows\System\nmfJGkv.exe
  C:\Windows\System\nmfJGkv.exe
  2⤵
  PID:7100
- C:\Windows\System\gKfxJtG.exe
  C:\Windows\System\gKfxJtG.exe
  2⤵
  PID:7128
- C:\Windows\System\HwIgrQz.exe
  C:\Windows\System\HwIgrQz.exe
  2⤵
  PID:7156
- C:\Windows\System\RXMSwqL.exe
  C:\Windows\System\RXMSwqL.exe
  2⤵
  PID:5504
- C:\Windows\System\dornWDR.exe
  C:\Windows\System\dornWDR.exe
  2⤵
  PID:7116
- C:\Windows\System\HnwjgHh.exe
  C:\Windows\System\HnwjgHh.exe
  2⤵
  PID:7072
- C:\Windows\System\gQTrobn.exe
  C:\Windows\System\gQTrobn.exe
  2⤵
  PID:7140
- C:\Windows\System\MDILyxL.exe
  C:\Windows\System\MDILyxL.exe
  2⤵
  PID:5976
- C:\Windows\System\CKEuXzF.exe
  C:\Windows\System\CKEuXzF.exe
  2⤵
  PID:5844
- C:\Windows\System\OurzXVf.exe
  C:\Windows\System\OurzXVf.exe
  2⤵
  PID:6964
- C:\Windows\System\XzZGrBG.exe
  C:\Windows\System\XzZGrBG.exe
  2⤵
  PID:6108
- C:\Windows\System\FbcxdgM.exe
  C:\Windows\System\FbcxdgM.exe
  2⤵
  PID:5380
- C:\Windows\System\fBCOxtL.exe
  C:\Windows\System\fBCOxtL.exe
  2⤵
  PID:7012
- C:\Windows\System\eayuewn.exe
  C:\Windows\System\eayuewn.exe
  2⤵
  PID:6484
- C:\Windows\System\ZwPswAk.exe
  C:\Windows\System\ZwPswAk.exe
  2⤵
  PID:6488
- C:\Windows\System\UHkbcew.exe
  C:\Windows\System\UHkbcew.exe
  2⤵
  PID:6560
- C:\Windows\System\NVoQAKn.exe
  C:\Windows\System\NVoQAKn.exe
  2⤵
  PID:1080
- C:\Windows\System\TEAdIYi.exe
  C:\Windows\System\TEAdIYi.exe
  2⤵
  PID:5696
- C:\Windows\System\wyYukzm.exe
  C:\Windows\System\wyYukzm.exe
  2⤵
  PID:6372
- C:\Windows\System\qEQrcTz.exe
  C:\Windows\System\qEQrcTz.exe
  2⤵
  PID:6436
- C:\Windows\System\rDRBuZt.exe
  C:\Windows\System\rDRBuZt.exe
  2⤵
  PID:6476
- C:\Windows\System\PFWrfsE.exe
  C:\Windows\System\PFWrfsE.exe
  2⤵
  PID:6524
- C:\Windows\System\fwnopNB.exe
  C:\Windows\System\fwnopNB.exe
  2⤵
  PID:6624
- C:\Windows\System\oWGjlCt.exe
  C:\Windows\System\oWGjlCt.exe
  2⤵
  PID:6416
- C:\Windows\System\eXpfyQE.exe
  C:\Windows\System\eXpfyQE.exe
  2⤵
  PID:6600
- C:\Windows\System\rpHlZNo.exe
  C:\Windows\System\rpHlZNo.exe
  2⤵
  PID:6676
- C:\Windows\System\JhWRIvD.exe
  C:\Windows\System\JhWRIvD.exe
  2⤵
  PID:2516
- C:\Windows\System\CKqdcyf.exe
  C:\Windows\System\CKqdcyf.exe
  2⤵
  PID:6512
- C:\Windows\System\HrBADvD.exe
  C:\Windows\System\HrBADvD.exe
  2⤵
  PID:6504
- C:\Windows\System\waTZGgE.exe
  C:\Windows\System\waTZGgE.exe
  2⤵
  PID:6696
- C:\Windows\System\wjWPqOJ.exe
  C:\Windows\System\wjWPqOJ.exe
  2⤵
  PID:6816
- C:\Windows\System\LqvADtA.exe
  C:\Windows\System\LqvADtA.exe
  2⤵
  PID:6792
- C:\Windows\System\hGQTawE.exe
  C:\Windows\System\hGQTawE.exe
  2⤵
  PID:6772
- C:\Windows\System\yiKjhjr.exe
  C:\Windows\System\yiKjhjr.exe
  2⤵
  PID:6768
- C:\Windows\System\qkBXPhQ.exe
  C:\Windows\System\qkBXPhQ.exe
  2⤵
  PID:7132
- C:\Windows\System\pRnGfjr.exe
  C:\Windows\System\pRnGfjr.exe
  2⤵
  PID:5576
- C:\Windows\System\WlZMNKP.exe
  C:\Windows\System\WlZMNKP.exe
  2⤵
  PID:6928
- C:\Windows\System\qXsHCDJ.exe
  C:\Windows\System\qXsHCDJ.exe
  2⤵
  PID:6976
- C:\Windows\System\rJAQpcy.exe
  C:\Windows\System\rJAQpcy.exe
  2⤵
  PID:6860
- C:\Windows\System\kvMLdcT.exe
  C:\Windows\System\kvMLdcT.exe
  2⤵
  PID:6932
- C:\Windows\System\ZFhhbYY.exe
  C:\Windows\System\ZFhhbYY.exe
  2⤵
  PID:6220
- C:\Windows\System\IXRoWwn.exe
  C:\Windows\System\IXRoWwn.exe
  2⤵
  PID:6388
- C:\Windows\System\DFFiqVv.exe
  C:\Windows\System\DFFiqVv.exe
  2⤵
  PID:7164
- C:\Windows\System\nzwkjzH.exe
  C:\Windows\System\nzwkjzH.exe
  2⤵
  PID:6968
- C:\Windows\System\TyTiUwC.exe
  C:\Windows\System\TyTiUwC.exe
  2⤵
  PID:6124
- C:\Windows\System\EdEGyBH.exe
  C:\Windows\System\EdEGyBH.exe
  2⤵
  PID:7152
- C:\Windows\System\NSuUvNH.exe
  C:\Windows\System\NSuUvNH.exe
  2⤵
  PID:6184
- C:\Windows\System\tukdUIY.exe
  C:\Windows\System\tukdUIY.exe
  2⤵
  PID:7040
- C:\Windows\System\NtHWobo.exe
  C:\Windows\System\NtHWobo.exe
  2⤵
  PID:920
- C:\Windows\System\hrbVpTI.exe
  C:\Windows\System\hrbVpTI.exe
  2⤵
  PID:6612
- C:\Windows\System\fwDIZtK.exe
  C:\Windows\System\fwDIZtK.exe
  2⤵
  PID:7060
- C:\Windows\System\mmixrjb.exe
  C:\Windows\System\mmixrjb.exe
  2⤵
  PID:6628
- C:\Windows\System\hhTedYQ.exe
  C:\Windows\System\hhTedYQ.exe
  2⤵
  PID:7112
- C:\Windows\System\IwICNak.exe
  C:\Windows\System\IwICNak.exe
  2⤵
  PID:6532
- C:\Windows\System\hwzKhiM.exe
  C:\Windows\System\hwzKhiM.exe
  2⤵
  PID:6432
- C:\Windows\System\tgAJbtN.exe
  C:\Windows\System\tgAJbtN.exe
  2⤵
  PID:6520
- C:\Windows\System\mLZvTbK.exe
  C:\Windows\System\mLZvTbK.exe
  2⤵
  PID:6480
- C:\Windows\System\qnBMjKE.exe
  C:\Windows\System\qnBMjKE.exe
  2⤵
  PID:7104
- C:\Windows\System\tVfPBMt.exe
  C:\Windows\System\tVfPBMt.exe
  2⤵
  PID:6636
- C:\Windows\System\yHzPEMB.exe
  C:\Windows\System\yHzPEMB.exe
  2⤵
  PID:6568
- C:\Windows\System\OFbLkFR.exe
  C:\Windows\System\OFbLkFR.exe
  2⤵
  PID:5396
- C:\Windows\System\CjecBFZ.exe
  C:\Windows\System\CjecBFZ.exe
  2⤵
  PID:6492
- C:\Windows\System\wqoiFaA.exe
  C:\Windows\System\wqoiFaA.exe
  2⤵
  PID:6180
- C:\Windows\System\dhFQgyE.exe
  C:\Windows\System\dhFQgyE.exe
  2⤵
  PID:1032
- C:\Windows\System\FQRwOSg.exe
  C:\Windows\System\FQRwOSg.exe
  2⤵
  PID:6212
- C:\Windows\System\kWjfQnm.exe
  C:\Windows\System\kWjfQnm.exe
  2⤵
  PID:6800
- C:\Windows\System\qGuUhFM.exe
  C:\Windows\System\qGuUhFM.exe
  2⤵
  PID:7020
- C:\Windows\System\OwdsRPt.exe
  C:\Windows\System\OwdsRPt.exe
  2⤵
  PID:5308
- C:\Windows\System\UTaMoYe.exe
  C:\Windows\System\UTaMoYe.exe
  2⤵
  PID:6712
- C:\Windows\System\QrotslB.exe
  C:\Windows\System\QrotslB.exe
  2⤵
  PID:6908
- C:\Windows\System\SwEPEvK.exe
  C:\Windows\System\SwEPEvK.exe
  2⤵
  PID:6548
- C:\Windows\System\qgtZcsm.exe
  C:\Windows\System\qgtZcsm.exe
  2⤵
  PID:6752
- C:\Windows\System\KxaSThI.exe
  C:\Windows\System\KxaSThI.exe
  2⤵
  PID:3036
- C:\Windows\System\xEwVmvO.exe
  C:\Windows\System\xEwVmvO.exe
  2⤵
  PID:6956
- C:\Windows\System\HBjwqZo.exe
  C:\Windows\System\HBjwqZo.exe
  2⤵
  PID:7124
- C:\Windows\System\byPqyBZ.exe
  C:\Windows\System\byPqyBZ.exe
  2⤵
  PID:6736
- C:\Windows\System\nsKbiYa.exe
  C:\Windows\System\nsKbiYa.exe
  2⤵
  PID:7068
- C:\Windows\System\wbWgmex.exe
  C:\Windows\System\wbWgmex.exe
  2⤵
  PID:6748
- C:\Windows\System\aGAoCVQ.exe
  C:\Windows\System\aGAoCVQ.exe
  2⤵
  PID:7000
- C:\Windows\System\CbpStao.exe
  C:\Windows\System\CbpStao.exe
  2⤵
  PID:6168
- C:\Windows\System\EbZNvka.exe
  C:\Windows\System\EbZNvka.exe
  2⤵
  PID:952
- C:\Windows\System\ooRRVmB.exe
  C:\Windows\System\ooRRVmB.exe
  2⤵
  PID:5916
- C:\Windows\System\nGoJEbW.exe
  C:\Windows\System\nGoJEbW.exe
  2⤵
  PID:6368
- C:\Windows\System\xkVBCaX.exe
  C:\Windows\System\xkVBCaX.exe
  2⤵
  PID:7136
- C:\Windows\System\bTGgGEK.exe
  C:\Windows\System\bTGgGEK.exe
  2⤵
  PID:6572
- C:\Windows\System\xRFRinG.exe
  C:\Windows\System\xRFRinG.exe
  2⤵
  PID:6668
- C:\Windows\System\CGHXICl.exe
  C:\Windows\System\CGHXICl.exe
  2⤵
  PID:6236
- C:\Windows\System\JVpQtLZ.exe
  C:\Windows\System\JVpQtLZ.exe
  2⤵
  PID:6604
- C:\Windows\System\SGCTRBU.exe
  C:\Windows\System\SGCTRBU.exe
  2⤵
  PID:1732
- C:\Windows\System\heVuZru.exe
  C:\Windows\System\heVuZru.exe
  2⤵
  PID:5912
- C:\Windows\System\aqPPVie.exe
  C:\Windows\System\aqPPVie.exe
  2⤵
  PID:6444
- C:\Windows\System\TdCfCjH.exe
  C:\Windows\System\TdCfCjH.exe
  2⤵
  PID:6744
- C:\Windows\System\ORKGdLt.exe
  C:\Windows\System\ORKGdLt.exe
  2⤵
  PID:6692
- C:\Windows\System\qvKnZde.exe
  C:\Windows\System\qvKnZde.exe
  2⤵
  PID:6784
- C:\Windows\System\HMDaVOD.exe
  C:\Windows\System\HMDaVOD.exe
  2⤵
  PID:7004
- C:\Windows\System\xsuMIMJ.exe
  C:\Windows\System\xsuMIMJ.exe
  2⤵
  PID:6288
- C:\Windows\System\nGSbCJf.exe
  C:\Windows\System\nGSbCJf.exe
  2⤵
  PID:6284
- C:\Windows\System\hnCSSQg.exe
  C:\Windows\System\hnCSSQg.exe
  2⤵
  PID:6940
- C:\Windows\System\VQIvPeO.exe
  C:\Windows\System\VQIvPeO.exe
  2⤵
  PID:6640
- C:\Windows\System\oBfqrco.exe
  C:\Windows\System\oBfqrco.exe
  2⤵
  PID:6248
- C:\Windows\System\rHuXSoD.exe
  C:\Windows\System\rHuXSoD.exe
  2⤵
  PID:6856
- C:\Windows\System\DtNdrRv.exe
  C:\Windows\System\DtNdrRv.exe
  2⤵
  PID:6496
- C:\Windows\System\BHNwhmF.exe
  C:\Windows\System\BHNwhmF.exe
  2⤵
  PID:5484
- C:\Windows\System\meimQKM.exe
  C:\Windows\System\meimQKM.exe
  2⤵
  PID:6448
- C:\Windows\System\fdyEjzb.exe
  C:\Windows\System\fdyEjzb.exe
  2⤵
  PID:6392
- C:\Windows\System\psErQvx.exe
  C:\Windows\System\psErQvx.exe
  2⤵
  PID:6788
- C:\Windows\System\ujvjQql.exe
  C:\Windows\System\ujvjQql.exe
  2⤵
  PID:7076
- C:\Windows\System\RHPgFax.exe
  C:\Windows\System\RHPgFax.exe
  2⤵
  PID:6364
- C:\Windows\System\WajTCuG.exe
  C:\Windows\System\WajTCuG.exe
  2⤵
  PID:6920
- C:\Windows\System\kqvSGAh.exe
  C:\Windows\System\kqvSGAh.exe
  2⤵
  PID:960
- C:\Windows\System\cIhyISK.exe
  C:\Windows\System\cIhyISK.exe
  2⤵
  PID:6420
- C:\Windows\System\ZmnzNiN.exe
  C:\Windows\System\ZmnzNiN.exe
  2⤵
  PID:5688
- C:\Windows\System\ocFrxcR.exe
  C:\Windows\System\ocFrxcR.exe
  2⤵
  PID:6272
- C:\Windows\System\CrnlCsF.exe
  C:\Windows\System\CrnlCsF.exe
  2⤵
  PID:6656
- C:\Windows\System\GrwgyJY.exe
  C:\Windows\System\GrwgyJY.exe
  2⤵
  PID:6632
- C:\Windows\System\bRydzPf.exe
  C:\Windows\System\bRydzPf.exe
  2⤵
  PID:6304
- C:\Windows\System\jEWaALQ.exe
  C:\Windows\System\jEWaALQ.exe
  2⤵
  PID:6596
- C:\Windows\System\KqpleMg.exe
  C:\Windows\System\KqpleMg.exe
  2⤵
  PID:6852
- C:\Windows\System\ADGtQCF.exe
  C:\Windows\System\ADGtQCF.exe
  2⤵
  PID:7200
- C:\Windows\System\iZgTBJy.exe
  C:\Windows\System\iZgTBJy.exe
  2⤵
  PID:7232
- C:\Windows\System\ZCxneWG.exe
  C:\Windows\System\ZCxneWG.exe
  2⤵
  PID:7248
- C:\Windows\System\xfYXKJd.exe
  C:\Windows\System\xfYXKJd.exe
  2⤵
  PID:7264
- C:\Windows\System\sHLpVkU.exe
  C:\Windows\System\sHLpVkU.exe
  2⤵
  PID:7280
- C:\Windows\System\fvXdvPq.exe
  C:\Windows\System\fvXdvPq.exe
  2⤵
  PID:7304
- C:\Windows\System\QIpdnHk.exe
  C:\Windows\System\QIpdnHk.exe
  2⤵
  PID:7324
- C:\Windows\System\OEXRHYU.exe
  C:\Windows\System\OEXRHYU.exe
  2⤵
  PID:7340
- C:\Windows\System\BOXjqSy.exe
  C:\Windows\System\BOXjqSy.exe
  2⤵
  PID:7356
- C:\Windows\System\usvmIjh.exe
  C:\Windows\System\usvmIjh.exe
  2⤵
  PID:7372
- C:\Windows\System\URgtkdR.exe
  C:\Windows\System\URgtkdR.exe
  2⤵
  PID:7392
- C:\Windows\System\qZrWFGI.exe
  C:\Windows\System\qZrWFGI.exe
  2⤵
  PID:7408
- C:\Windows\System\KszZRNw.exe
  C:\Windows\System\KszZRNw.exe
  2⤵
  PID:7432
- C:\Windows\System\DfjSEAo.exe
  C:\Windows\System\DfjSEAo.exe
  2⤵
  PID:7448
- C:\Windows\System\npOUTad.exe
  C:\Windows\System\npOUTad.exe
  2⤵
  PID:7464
- C:\Windows\System\lzmEnyx.exe
  C:\Windows\System\lzmEnyx.exe
  2⤵
  PID:7480
- C:\Windows\System\ImNHpDS.exe
  C:\Windows\System\ImNHpDS.exe
  2⤵
  PID:7496
- C:\Windows\System\QxUpdOt.exe
  C:\Windows\System\QxUpdOt.exe
  2⤵
  PID:7516
- C:\Windows\System\yFiPjBg.exe
  C:\Windows\System\yFiPjBg.exe
  2⤵
  PID:7532
- C:\Windows\System\YUmGTvj.exe
  C:\Windows\System\YUmGTvj.exe
  2⤵
  PID:7556
- C:\Windows\System\oXYkfbT.exe
  C:\Windows\System\oXYkfbT.exe
  2⤵
  PID:7576
- C:\Windows\System\hfuKZab.exe
  C:\Windows\System\hfuKZab.exe
  2⤵
  PID:7592
- C:\Windows\System\eJLIYYb.exe
  C:\Windows\System\eJLIYYb.exe
  2⤵
  PID:7608
- C:\Windows\System\qFsHRXu.exe
  C:\Windows\System\qFsHRXu.exe
  2⤵
  PID:7636
- C:\Windows\System\XnJjtiG.exe
  C:\Windows\System\XnJjtiG.exe
  2⤵
  PID:7652
- C:\Windows\System\BXMDOoR.exe
  C:\Windows\System\BXMDOoR.exe
  2⤵
  PID:7668
- C:\Windows\System\gtEfdsR.exe
  C:\Windows\System\gtEfdsR.exe
  2⤵
  PID:7684
- C:\Windows\System\CuSErRr.exe
  C:\Windows\System\CuSErRr.exe
  2⤵
  PID:7700
- C:\Windows\System\uLCOaOn.exe
  C:\Windows\System\uLCOaOn.exe
  2⤵
  PID:7716
- C:\Windows\System\sOPuBrq.exe
  C:\Windows\System\sOPuBrq.exe
  2⤵
  PID:7740
- C:\Windows\System\tBsKfXZ.exe
  C:\Windows\System\tBsKfXZ.exe
  2⤵
  PID:7760
- C:\Windows\System\gKLuZVY.exe
  C:\Windows\System\gKLuZVY.exe
  2⤵
  PID:7776
- C:\Windows\System\UOiatpr.exe
  C:\Windows\System\UOiatpr.exe
  2⤵
  PID:7800
- C:\Windows\System\zIWrMvs.exe
  C:\Windows\System\zIWrMvs.exe
  2⤵
  PID:7816
- C:\Windows\System\DNdRndI.exe
  C:\Windows\System\DNdRndI.exe
  2⤵
  PID:7864
- C:\Windows\System\uFqnGlt.exe
  C:\Windows\System\uFqnGlt.exe
  2⤵
  PID:7880
- C:\Windows\System\cXPbhEF.exe
  C:\Windows\System\cXPbhEF.exe
  2⤵
  PID:7904
- C:\Windows\System\HCSwatt.exe
  C:\Windows\System\HCSwatt.exe
  2⤵
  PID:7920
- C:\Windows\System\gqQkBiK.exe
  C:\Windows\System\gqQkBiK.exe
  2⤵
  PID:7960
- C:\Windows\System\FbaqLeZ.exe
  C:\Windows\System\FbaqLeZ.exe
  2⤵
  PID:7988
- C:\Windows\System\dQpRMic.exe
  C:\Windows\System\dQpRMic.exe
  2⤵
  PID:8004
- C:\Windows\System\QostEuz.exe
  C:\Windows\System\QostEuz.exe
  2⤵
  PID:8044
- C:\Windows\System\bmKROwG.exe
  C:\Windows\System\bmKROwG.exe
  2⤵
  PID:8060
- C:\Windows\System\PbuInOw.exe
  C:\Windows\System\PbuInOw.exe
  2⤵
  PID:8080
- C:\Windows\System\ZFqhFyl.exe
  C:\Windows\System\ZFqhFyl.exe
  2⤵
  PID:8100
- C:\Windows\System\eTuZwOD.exe
  C:\Windows\System\eTuZwOD.exe
  2⤵
  PID:8116
- C:\Windows\System\wUEZPuN.exe
  C:\Windows\System\wUEZPuN.exe
  2⤵
  PID:8132
- C:\Windows\System\WHEtrlK.exe
  C:\Windows\System\WHEtrlK.exe
  2⤵
  PID:8148
- C:\Windows\System\mzGUfEv.exe
  C:\Windows\System\mzGUfEv.exe
  2⤵
  PID:8164
- C:\Windows\System\tqHGjPK.exe
  C:\Windows\System\tqHGjPK.exe
  2⤵
  PID:8180
- C:\Windows\System\HlSIWZW.exe
  C:\Windows\System\HlSIWZW.exe
  2⤵
  PID:6552
- C:\Windows\System\uwAtbPV.exe
  C:\Windows\System\uwAtbPV.exe
  2⤵
  PID:7172
- C:\Windows\System\CeXFJyI.exe
  C:\Windows\System\CeXFJyI.exe
  2⤵
  PID:7208
- C:\Windows\System\KOiYIal.exe
  C:\Windows\System\KOiYIal.exe
  2⤵
  PID:7188
- C:\Windows\System\BFIDpgZ.exe
  C:\Windows\System\BFIDpgZ.exe
  2⤵
  PID:7256
- C:\Windows\System\FwVcYyK.exe
  C:\Windows\System\FwVcYyK.exe
  2⤵
  PID:7456
- C:\Windows\System\moYntjH.exe
  C:\Windows\System\moYntjH.exe
  2⤵
  PID:7508
- C:\Windows\System\fihuOlF.exe
  C:\Windows\System\fihuOlF.exe
  2⤵
  PID:7548
- C:\Windows\System\VEhygci.exe
  C:\Windows\System\VEhygci.exe
  2⤵
  PID:7588
- C:\Windows\System\jPQUFiY.exe
  C:\Windows\System\jPQUFiY.exe
  2⤵
  PID:7528
- C:\Windows\System\WSXtWLi.exe
  C:\Windows\System\WSXtWLi.exe
  2⤵
  PID:7632
- C:\Windows\System\vGxgVjE.exe
  C:\Windows\System\vGxgVjE.exe
  2⤵
  PID:7696
- C:\Windows\System\HOqrPya.exe
  C:\Windows\System\HOqrPya.exe
  2⤵
  PID:7644
- C:\Windows\System\aNUmKRt.exe
  C:\Windows\System\aNUmKRt.exe
  2⤵
  PID:7712
- C:\Windows\System\pQmbJKw.exe
  C:\Windows\System\pQmbJKw.exe
  2⤵
  PID:7736
- C:\Windows\System\Vnqvqdg.exe
  C:\Windows\System\Vnqvqdg.exe
  2⤵
  PID:7752
- C:\Windows\System\kiKAbPv.exe
  C:\Windows\System\kiKAbPv.exe
  2⤵
  PID:7788
- C:\Windows\System\HJYBFsA.exe
  C:\Windows\System\HJYBFsA.exe
  2⤵
  PID:7824
- C:\Windows\System\cleEtHT.exe
  C:\Windows\System\cleEtHT.exe
  2⤵
  PID:7836
- C:\Windows\System\bhnKIbV.exe
  C:\Windows\System\bhnKIbV.exe
  2⤵
  PID:7848
- C:\Windows\System\BzXfbVO.exe
  C:\Windows\System\BzXfbVO.exe
  2⤵
  PID:7916
- C:\Windows\System\HpzrgqS.exe
  C:\Windows\System\HpzrgqS.exe
  2⤵
  PID:7896
- C:\Windows\System\BFPcsyd.exe
  C:\Windows\System\BFPcsyd.exe
  2⤵
  PID:7952
- C:\Windows\System\oowWLqi.exe
  C:\Windows\System\oowWLqi.exe
  2⤵
  PID:7180
- C:\Windows\System\EgFjhsy.exe
  C:\Windows\System\EgFjhsy.exe
  2⤵
  PID:7976
- C:\Windows\System\jyHLvyk.exe
  C:\Windows\System\jyHLvyk.exe
  2⤵
  PID:8016
- C:\Windows\System\foZIxcc.exe
  C:\Windows\System\foZIxcc.exe
  2⤵
  PID:8032
- C:\Windows\System\jtkrQay.exe
  C:\Windows\System\jtkrQay.exe
  2⤵
  PID:8072
- C:\Windows\System\NJplrBG.exe
  C:\Windows\System\NJplrBG.exe
  2⤵
  PID:8056
- C:\Windows\System\IBaAdWl.exe
  C:\Windows\System\IBaAdWl.exe
  2⤵
  PID:8112
- C:\Windows\System\onuijLR.exe
  C:\Windows\System\onuijLR.exe
  2⤵
  PID:8176
- C:\Windows\System\ILuGqRN.exe
  C:\Windows\System\ILuGqRN.exe
  2⤵
  PID:8096
- C:\Windows\System\cGlfxsH.exe
  C:\Windows\System\cGlfxsH.exe
  2⤵
  PID:7220
- C:\Windows\System\KQPqRPP.exe
  C:\Windows\System\KQPqRPP.exe
  2⤵
  PID:7052
- C:\Windows\System\nWPdYXh.exe
  C:\Windows\System\nWPdYXh.exe
  2⤵
  PID:8188
- C:\Windows\System\NTByYgg.exe
  C:\Windows\System\NTByYgg.exe
  2⤵
  PID:7544
- C:\Windows\System\AFTwzsn.exe
  C:\Windows\System\AFTwzsn.exe
  2⤵
  PID:7300
- C:\Windows\System\iktvryY.exe
  C:\Windows\System\iktvryY.exe
  2⤵
  PID:7444
- C:\Windows\System\TLyNdDO.exe
  C:\Windows\System\TLyNdDO.exe
  2⤵
  PID:7368
- C:\Windows\System\hUxpPZJ.exe
  C:\Windows\System\hUxpPZJ.exe
  2⤵
  PID:7276
- C:\Windows\System\qTlLKrw.exe
  C:\Windows\System\qTlLKrw.exe
  2⤵
  PID:7440
- C:\Windows\System\iXnTTRv.exe
  C:\Windows\System\iXnTTRv.exe
  2⤵
  PID:7320
- C:\Windows\System\GEKEcrj.exe
  C:\Windows\System\GEKEcrj.exe
  2⤵
  PID:7384
- C:\Windows\System\xrADaYS.exe
  C:\Windows\System\xrADaYS.exe
  2⤵
  PID:7620
- C:\Windows\System\DCpgtOX.exe
  C:\Windows\System\DCpgtOX.exe
  2⤵
  PID:7808
- C:\Windows\System\ErbISdL.exe
  C:\Windows\System\ErbISdL.exe
  2⤵
  PID:7732
- C:\Windows\System\JVWheLX.exe
  C:\Windows\System\JVWheLX.exe
  2⤵
  PID:7812
- C:\Windows\System\GoBjSeY.exe
  C:\Windows\System\GoBjSeY.exe
  2⤵
  PID:7876
- C:\Windows\System\Zteddsd.exe
  C:\Windows\System\Zteddsd.exe
  2⤵
  PID:7860
- C:\Windows\System\lronEUL.exe
  C:\Windows\System\lronEUL.exe
  2⤵
  PID:8012
- C:\Windows\System\aKsNhco.exe
  C:\Windows\System\aKsNhco.exe
  2⤵
  PID:7972
- C:\Windows\System\GaONvzO.exe
  C:\Windows\System\GaONvzO.exe
  2⤵
  PID:7932
- C:\Windows\System\lmaNZDt.exe
  C:\Windows\System\lmaNZDt.exe
  2⤵
  PID:7996
- C:\Windows\System\ttZDIwH.exe
  C:\Windows\System\ttZDIwH.exe
  2⤵
  PID:8088
- C:\Windows\System\nGeMRqO.exe
  C:\Windows\System\nGeMRqO.exe
  2⤵
  PID:7228
- C:\Windows\System\FkfgDzI.exe
  C:\Windows\System\FkfgDzI.exe
  2⤵
  PID:7296
- C:\Windows\System\rjhkZFd.exe
  C:\Windows\System\rjhkZFd.exe
  2⤵
  PID:7488
- C:\Windows\System\IluBlAt.exe
  C:\Windows\System\IluBlAt.exe
  2⤵
  PID:7244
- C:\Windows\System\DPNVLYL.exe
  C:\Windows\System\DPNVLYL.exe
  2⤵
  PID:7316
- C:\Windows\System\EltIbcM.exe
  C:\Windows\System\EltIbcM.exe
  2⤵
  PID:7420
- C:\Windows\System\YMpHidZ.exe
  C:\Windows\System\YMpHidZ.exe
  2⤵
  PID:7564
- C:\Windows\System\FTdOTkw.exe
  C:\Windows\System\FTdOTkw.exe
  2⤵
  PID:7856
- C:\Windows\System\ONjDBPX.exe
  C:\Windows\System\ONjDBPX.exe
  2⤵
  PID:7912
- C:\Windows\System\ZyRAZOX.exe
  C:\Windows\System\ZyRAZOX.exe
  2⤵
  PID:7600
- C:\Windows\System\nSbXsde.exe
  C:\Windows\System\nSbXsde.exe
  2⤵
  PID:7940
- C:\Windows\System\ynIoQHc.exe
  C:\Windows\System\ynIoQHc.exe
  2⤵
  PID:7628
- C:\Windows\System\jRplFkm.exe
  C:\Windows\System\jRplFkm.exe
  2⤵
  PID:7476
- C:\Windows\System\yPRMVmT.exe
  C:\Windows\System\yPRMVmT.exe
  2⤵
  PID:6196
- C:\Windows\System\jqNPouh.exe
  C:\Windows\System\jqNPouh.exe
  2⤵
  PID:7648
- C:\Windows\System\AvYvarc.exe
  C:\Windows\System\AvYvarc.exe
  2⤵
  PID:7784
- C:\Windows\System\vTUDQhu.exe
  C:\Windows\System\vTUDQhu.exe
  2⤵
  PID:7492
- C:\Windows\System\KfVPVsB.exe
  C:\Windows\System\KfVPVsB.exe
  2⤵
  PID:1644
- C:\Windows\System\TZXHPeD.exe
  C:\Windows\System\TZXHPeD.exe
  2⤵
  PID:6616
- C:\Windows\System\vBZaJIx.exe
  C:\Windows\System\vBZaJIx.exe
  2⤵
  PID:4632
- C:\Windows\System\HiwMprF.exe
  C:\Windows\System\HiwMprF.exe
  2⤵
  PID:8208
- C:\Windows\System\CSgLAdg.exe
  C:\Windows\System\CSgLAdg.exe
  2⤵
  PID:8224
- C:\Windows\System\eyVzgWv.exe
  C:\Windows\System\eyVzgWv.exe
  2⤵
  PID:8240
- C:\Windows\System\rJFhZRp.exe
  C:\Windows\System\rJFhZRp.exe
  2⤵
  PID:8256
- C:\Windows\System\OkbqTTF.exe
  C:\Windows\System\OkbqTTF.exe
  2⤵
  PID:8272
- C:\Windows\System\IBmgqLh.exe
  C:\Windows\System\IBmgqLh.exe
  2⤵
  PID:8296
- C:\Windows\System\FyiWsHL.exe
  C:\Windows\System\FyiWsHL.exe
  2⤵
  PID:8312
- C:\Windows\System\dfDIKbh.exe
  C:\Windows\System\dfDIKbh.exe
  2⤵
  PID:8328
- C:\Windows\System\qHOkAxT.exe
  C:\Windows\System\qHOkAxT.exe
  2⤵
  PID:8368
- C:\Windows\System\qifyhsT.exe
  C:\Windows\System\qifyhsT.exe
  2⤵
  PID:8400
- C:\Windows\System\KsEcggq.exe
  C:\Windows\System\KsEcggq.exe
  2⤵
  PID:8416
- C:\Windows\System\qbhCRuR.exe
  C:\Windows\System\qbhCRuR.exe
  2⤵
  PID:8432
- C:\Windows\System\nHeAvHf.exe
  C:\Windows\System\nHeAvHf.exe
  2⤵
  PID:8448
- C:\Windows\System\LIOouUo.exe
  C:\Windows\System\LIOouUo.exe
  2⤵
  PID:8464
- C:\Windows\System\NDNfaVc.exe
  C:\Windows\System\NDNfaVc.exe
  2⤵
  PID:8484
- C:\Windows\System\oSHluab.exe
  C:\Windows\System\oSHluab.exe
  2⤵
  PID:8500
- C:\Windows\System\RkyYAll.exe
  C:\Windows\System\RkyYAll.exe
  2⤵
  PID:8516
- C:\Windows\System\qGywlAG.exe
  C:\Windows\System\qGywlAG.exe
  2⤵
  PID:8532
- C:\Windows\System\ncVUQst.exe
  C:\Windows\System\ncVUQst.exe
  2⤵
  PID:8548
- C:\Windows\System\sGVOGQW.exe
  C:\Windows\System\sGVOGQW.exe
  2⤵
  PID:8564
- C:\Windows\System\gTbpekt.exe
  C:\Windows\System\gTbpekt.exe
  2⤵
  PID:8580
- C:\Windows\System\lCtsasF.exe
  C:\Windows\System\lCtsasF.exe
  2⤵
  PID:8596
- C:\Windows\System\rjBofOr.exe
  C:\Windows\System\rjBofOr.exe
  2⤵
  PID:8612
- C:\Windows\System\ISVKgkc.exe
  C:\Windows\System\ISVKgkc.exe
  2⤵
  PID:8628
- C:\Windows\System\yClMnHr.exe
  C:\Windows\System\yClMnHr.exe
  2⤵
  PID:8648
- C:\Windows\System\ReJKlnf.exe
  C:\Windows\System\ReJKlnf.exe
  2⤵
  PID:8664
- C:\Windows\System\ZcwoMJM.exe
  C:\Windows\System\ZcwoMJM.exe
  2⤵
  PID:8680
- C:\Windows\System\bLrFkcW.exe
  C:\Windows\System\bLrFkcW.exe
  2⤵
  PID:8696
- C:\Windows\System\pFMIntI.exe
  C:\Windows\System\pFMIntI.exe
  2⤵
  PID:8712
- C:\Windows\System\ydoluhC.exe
  C:\Windows\System\ydoluhC.exe
  2⤵
  PID:8728
- C:\Windows\System\IGoQTlM.exe
  C:\Windows\System\IGoQTlM.exe
  2⤵
  PID:8744
- C:\Windows\System\tygJPep.exe
  C:\Windows\System\tygJPep.exe
  2⤵
  PID:8760
- C:\Windows\System\MfEYtXk.exe
  C:\Windows\System\MfEYtXk.exe
  2⤵
  PID:8780
- C:\Windows\System\OqGUzyl.exe
  C:\Windows\System\OqGUzyl.exe
  2⤵
  PID:8796
- C:\Windows\System\YWzGBrC.exe
  C:\Windows\System\YWzGBrC.exe
  2⤵
  PID:8812
- C:\Windows\System\hRdLDkJ.exe
  C:\Windows\System\hRdLDkJ.exe
  2⤵
  PID:8828
- C:\Windows\System\ZaDbEjN.exe
  C:\Windows\System\ZaDbEjN.exe
  2⤵
  PID:8844
- C:\Windows\System\yVupkvU.exe
  C:\Windows\System\yVupkvU.exe
  2⤵
  PID:8860
- C:\Windows\System\MRNPpNG.exe
  C:\Windows\System\MRNPpNG.exe
  2⤵
  PID:8876
- C:\Windows\System\oIavPAT.exe
  C:\Windows\System\oIavPAT.exe
  2⤵
  PID:8892
- C:\Windows\System\SxEpPvw.exe
  C:\Windows\System\SxEpPvw.exe
  2⤵
  PID:8908
- C:\Windows\System\REqlSSV.exe
  C:\Windows\System\REqlSSV.exe
  2⤵
  PID:8924
- C:\Windows\System\xkTWXsC.exe
  C:\Windows\System\xkTWXsC.exe
  2⤵
  PID:8940
- C:\Windows\System\CHaxIGe.exe
  C:\Windows\System\CHaxIGe.exe
  2⤵
  PID:8956
- C:\Windows\System\HHLOmkr.exe
  C:\Windows\System\HHLOmkr.exe
  2⤵
  PID:8972
- C:\Windows\System\ukplput.exe
  C:\Windows\System\ukplput.exe
  2⤵
  PID:8988
- C:\Windows\System\ZcZhXmJ.exe
  C:\Windows\System\ZcZhXmJ.exe
  2⤵
  PID:9004
- C:\Windows\System\EvavBaF.exe
  C:\Windows\System\EvavBaF.exe
  2⤵
  PID:9032
- C:\Windows\System\etnqLcS.exe
  C:\Windows\System\etnqLcS.exe
  2⤵
  PID:9048
- C:\Windows\System\oJVTCPv.exe
  C:\Windows\System\oJVTCPv.exe
  2⤵
  PID:9064
- C:\Windows\System\qmfNtJT.exe
  C:\Windows\System\qmfNtJT.exe
  2⤵
  PID:9084
- C:\Windows\System\mDNNtCT.exe
  C:\Windows\System\mDNNtCT.exe
  2⤵
  PID:9104
- C:\Windows\System\dKMyVfY.exe
  C:\Windows\System\dKMyVfY.exe
  2⤵
  PID:9124
- C:\Windows\System\XLarDUB.exe
  C:\Windows\System\XLarDUB.exe
  2⤵
  PID:9148
- C:\Windows\System\ZYzOZom.exe
  C:\Windows\System\ZYzOZom.exe
  2⤵
  PID:9164
- C:\Windows\System\ogHSZYk.exe
  C:\Windows\System\ogHSZYk.exe
  2⤵
  PID:9180
- C:\Windows\System\pphrsgs.exe
  C:\Windows\System\pphrsgs.exe
  2⤵
  PID:9196
- C:\Windows\System\JjpvGTb.exe
  C:\Windows\System\JjpvGTb.exe
  2⤵
  PID:9212
- C:\Windows\System\oeKHuKE.exe
  C:\Windows\System\oeKHuKE.exe
  2⤵
  PID:8252
- C:\Windows\System\jeGwbay.exe
  C:\Windows\System\jeGwbay.exe
  2⤵
  PID:8288
- C:\Windows\System\cJLTwfD.exe
  C:\Windows\System\cJLTwfD.exe
  2⤵
  PID:8284
- C:\Windows\System\OVsKkdu.exe
  C:\Windows\System\OVsKkdu.exe
  2⤵
  PID:7336
- C:\Windows\System\Sjvhtfx.exe
  C:\Windows\System\Sjvhtfx.exe
  2⤵
  PID:7984
- C:\Windows\System\BOmAmrE.exe
  C:\Windows\System\BOmAmrE.exe
  2⤵
  PID:8304
- C:\Windows\System\tmnlMjA.exe
  C:\Windows\System\tmnlMjA.exe
  2⤵
  PID:8356
- C:\Windows\System\hNwSnnx.exe
  C:\Windows\System\hNwSnnx.exe
  2⤵
  PID:5472
- C:\Windows\System\VNFaibq.exe
  C:\Windows\System\VNFaibq.exe
  2⤵
  PID:8396
- C:\Windows\System\YJsRkDu.exe
  C:\Windows\System\YJsRkDu.exe
  2⤵
  PID:8460
- C:\Windows\System\eXPgqhA.exe
  C:\Windows\System\eXPgqhA.exe
  2⤵
  PID:8472
- C:\Windows\System\RswvVHT.exe
  C:\Windows\System\RswvVHT.exe
  2⤵
  PID:8560
- C:\Windows\System\rTdWguI.exe
  C:\Windows\System\rTdWguI.exe
  2⤵
  PID:8572
- C:\Windows\System\VyTWEfA.exe
  C:\Windows\System\VyTWEfA.exe
  2⤵
  PID:8656
- C:\Windows\System\oORueGS.exe
  C:\Windows\System\oORueGS.exe
  2⤵
  PID:8660
- C:\Windows\System\TiIeAFj.exe
  C:\Windows\System\TiIeAFj.exe
  2⤵
  PID:8692
- C:\Windows\System\SbKNDXl.exe
  C:\Windows\System\SbKNDXl.exe
  2⤵
  PID:8724
- C:\Windows\System\FOFkoRs.exe
  C:\Windows\System\FOFkoRs.exe
  2⤵
  PID:8740
- C:\Windows\System\SniIfhb.exe
  C:\Windows\System\SniIfhb.exe
  2⤵
  PID:8772
- C:\Windows\System\LVbPHBh.exe
  C:\Windows\System\LVbPHBh.exe
  2⤵
  PID:8808
- C:\Windows\System\HGORVUN.exe
  C:\Windows\System\HGORVUN.exe
  2⤵
  PID:8852
- C:\Windows\System\gADKWLD.exe
  C:\Windows\System\gADKWLD.exe
  2⤵
  PID:8916
- C:\Windows\System\NAJODZW.exe
  C:\Windows\System\NAJODZW.exe
  2⤵
  PID:8900
- C:\Windows\System\UNTYDfJ.exe
  C:\Windows\System\UNTYDfJ.exe
  2⤵
  PID:8948
- C:\Windows\System\DecoKkm.exe
  C:\Windows\System\DecoKkm.exe
  2⤵
  PID:8980
- C:\Windows\System\VtZKaxC.exe
  C:\Windows\System\VtZKaxC.exe
  2⤵
  PID:9012
- C:\Windows\System\OaAYWCo.exe
  C:\Windows\System\OaAYWCo.exe
  2⤵
  PID:9016
- C:\Windows\System\XNzkARZ.exe
  C:\Windows\System\XNzkARZ.exe
  2⤵
  PID:9096
- C:\Windows\System\MxkaHaP.exe
  C:\Windows\System\MxkaHaP.exe
  2⤵
  PID:9076
- C:\Windows\System\MubWEFg.exe
  C:\Windows\System\MubWEFg.exe
  2⤵
  PID:9072
- C:\Windows\System\LTIheJW.exe
  C:\Windows\System\LTIheJW.exe
  2⤵
  PID:9172
- C:\Windows\System\YjoBjHh.exe
  C:\Windows\System\YjoBjHh.exe
  2⤵
  PID:9160
- C:\Windows\System\mdxAmPU.exe
  C:\Windows\System\mdxAmPU.exe
  2⤵
  PID:9208
- C:\Windows\System\JCwpxMo.exe
  C:\Windows\System\JCwpxMo.exe
  2⤵
  PID:9188
- C:\Windows\System\jWhyNsY.exe
  C:\Windows\System\jWhyNsY.exe
  2⤵
  PID:8236
- C:\Windows\System\NXFTMPG.exe
  C:\Windows\System\NXFTMPG.exe
  2⤵
  PID:8220
- C:\Windows\System\kuZPSZL.exe
  C:\Windows\System\kuZPSZL.exe
  2⤵
  PID:8232
- C:\Windows\System\EURzMfZ.exe
  C:\Windows\System\EURzMfZ.exe
  2⤵
  PID:8428
- C:\Windows\System\iJgGBiZ.exe
  C:\Windows\System\iJgGBiZ.exe
  2⤵
  PID:7348
- C:\Windows\System\KEfsFAF.exe
  C:\Windows\System\KEfsFAF.exe
  2⤵
  PID:8364
- C:\Windows\System\sAIbBAw.exe
  C:\Windows\System\sAIbBAw.exe
  2⤵
  PID:8348
- C:\Windows\System\YgxkfuI.exe
  C:\Windows\System\YgxkfuI.exe
  2⤵
  PID:8480
- C:\Windows\System\tizIojS.exe
  C:\Windows\System\tizIojS.exe
  2⤵
  PID:8496
- C:\Windows\System\MzxRkTU.exe
  C:\Windows\System\MzxRkTU.exe
  2⤵
  PID:8556
- C:\Windows\System\tiOWlNn.exe
  C:\Windows\System\tiOWlNn.exe
  2⤵
  PID:8624
- C:\Windows\System\ePwXHpZ.exe
  C:\Windows\System\ePwXHpZ.exe
  2⤵
  PID:8608
- C:\Windows\System\zwGFFJD.exe
  C:\Windows\System\zwGFFJD.exe
  2⤵
  PID:8704
- C:\Windows\System\ypPVVOR.exe
  C:\Windows\System\ypPVVOR.exe
  2⤵
  PID:8708
- C:\Windows\System\otlPmiu.exe
  C:\Windows\System\otlPmiu.exe
  2⤵
  PID:8888
- C:\Windows\System\kWNxDKt.exe
  C:\Windows\System\kWNxDKt.exe
  2⤵
  PID:8840
- C:\Windows\System\HLdkZGC.exe
  C:\Windows\System\HLdkZGC.exe
  2⤵
  PID:8936
- C:\Windows\System\Vhlrqoj.exe
  C:\Windows\System\Vhlrqoj.exe
  2⤵
  PID:7708
- C:\Windows\System\ICsfENo.exe
  C:\Windows\System\ICsfENo.exe
  2⤵
  PID:9092
- C:\Windows\System\HeuXCKO.exe
  C:\Windows\System\HeuXCKO.exe
  2⤵
  PID:9120
- C:\Windows\System\uUPlnbF.exe
  C:\Windows\System\uUPlnbF.exe
  2⤵
  PID:7968
- C:\Windows\System\QvJFLmk.exe
  C:\Windows\System\QvJFLmk.exe
  2⤵
  PID:8144
- C:\Windows\System\MbROOtr.exe
  C:\Windows\System\MbROOtr.exe
  2⤵
  PID:8264
- C:\Windows\System\LnLqjiN.exe
  C:\Windows\System\LnLqjiN.exe
  2⤵
  PID:8336
- C:\Windows\System\PGmUpHg.exe
  C:\Windows\System\PGmUpHg.exe
  2⤵
  PID:8456
- C:\Windows\System\KxxEHoX.exe
  C:\Windows\System\KxxEHoX.exe
  2⤵
  PID:8392
- C:\Windows\System\gyEMtJJ.exe
  C:\Windows\System\gyEMtJJ.exe
  2⤵
  PID:8544
- C:\Windows\System\WkPLsyz.exe
  C:\Windows\System\WkPLsyz.exe
  2⤵
  PID:8592
- C:\Windows\System\UeEGqUv.exe
  C:\Windows\System\UeEGqUv.exe
  2⤵
  PID:8672
- C:\Windows\System\UeoKRdl.exe
  C:\Windows\System\UeoKRdl.exe
  2⤵
  PID:8804
- C:\Windows\System\IRTzYFF.exe
  C:\Windows\System\IRTzYFF.exe
  2⤵
  PID:8932
- C:\Windows\System\sehnSsk.exe
  C:\Windows\System\sehnSsk.exe
  2⤵
  PID:9000
- C:\Windows\System\jNbnqCP.exe
  C:\Windows\System\jNbnqCP.exe
  2⤵
  PID:9044
- C:\Windows\System\PswPmQP.exe
  C:\Windows\System\PswPmQP.exe
  2⤵
  PID:8216
- C:\Windows\System\aZZFeTT.exe
  C:\Windows\System\aZZFeTT.exe
  2⤵
  PID:8068
- C:\Windows\System\PhDeIGl.exe
  C:\Windows\System\PhDeIGl.exe
  2⤵
  PID:8528
- C:\Windows\System\MLMbZAL.exe
  C:\Windows\System\MLMbZAL.exe
  2⤵
  PID:8736
- C:\Windows\System\mmowEpZ.exe
  C:\Windows\System\mmowEpZ.exe
  2⤵
  PID:9112
- C:\Windows\System\efdtRYi.exe
  C:\Windows\System\efdtRYi.exe
  2⤵
  PID:9060
- C:\Windows\System\XypzRsD.exe
  C:\Windows\System\XypzRsD.exe
  2⤵
  PID:8872
- C:\Windows\System\poXJSQm.exe
  C:\Windows\System\poXJSQm.exe
  2⤵
  PID:8124
- C:\Windows\System\vkJHHyJ.exe
  C:\Windows\System\vkJHHyJ.exe
  2⤵
  PID:8512
- C:\Windows\System\aoJgDbR.exe
  C:\Windows\System\aoJgDbR.exe
  2⤵
  PID:9204
- C:\Windows\System\lBfDaQB.exe
  C:\Windows\System\lBfDaQB.exe
  2⤵
  PID:9228
- C:\Windows\System\IuuGDxO.exe
  C:\Windows\System\IuuGDxO.exe
  2⤵
  PID:9244
- C:\Windows\System\FosicDo.exe
  C:\Windows\System\FosicDo.exe
  2⤵
  PID:9260
- C:\Windows\System\AJshiPZ.exe
  C:\Windows\System\AJshiPZ.exe
  2⤵
  PID:9276
- C:\Windows\System\CpjLzKD.exe
  C:\Windows\System\CpjLzKD.exe
  2⤵
  PID:9292
- C:\Windows\System\fWpkBPF.exe
  C:\Windows\System\fWpkBPF.exe
  2⤵
  PID:9308
- C:\Windows\System\UymUAMr.exe
  C:\Windows\System\UymUAMr.exe
  2⤵
  PID:9324
- C:\Windows\System\PfOwkDT.exe
  C:\Windows\System\PfOwkDT.exe
  2⤵
  PID:9340
- C:\Windows\System\aJHPUNK.exe
  C:\Windows\System\aJHPUNK.exe
  2⤵
  PID:9356
- C:\Windows\System\ZBiOYLX.exe
  C:\Windows\System\ZBiOYLX.exe
  2⤵
  PID:9372
- C:\Windows\System\tLtEqTd.exe
  C:\Windows\System\tLtEqTd.exe
  2⤵
  PID:9388
- C:\Windows\System\aGYnOEq.exe
  C:\Windows\System\aGYnOEq.exe
  2⤵
  PID:9404
- C:\Windows\System\nTMXFZj.exe
  C:\Windows\System\nTMXFZj.exe
  2⤵
  PID:9420
- C:\Windows\System\AHlDfhh.exe
  C:\Windows\System\AHlDfhh.exe
  2⤵
  PID:9436
- C:\Windows\System\ihbuCld.exe
  C:\Windows\System\ihbuCld.exe
  2⤵
  PID:9452
- C:\Windows\System\NQdmndS.exe
  C:\Windows\System\NQdmndS.exe
  2⤵
  PID:9468
- C:\Windows\System\PVNOdnh.exe
  C:\Windows\System\PVNOdnh.exe
  2⤵
  PID:9484
- C:\Windows\System\dEdvAhY.exe
  C:\Windows\System\dEdvAhY.exe
  2⤵
  PID:9500
- C:\Windows\System\ZHMEnzQ.exe
  C:\Windows\System\ZHMEnzQ.exe
  2⤵
  PID:9516
- C:\Windows\System\pxyrcVm.exe
  C:\Windows\System\pxyrcVm.exe
  2⤵
  PID:9532
- C:\Windows\System\ceKmkwG.exe
  C:\Windows\System\ceKmkwG.exe
  2⤵
  PID:9548
- C:\Windows\System\MmvvtPn.exe
  C:\Windows\System\MmvvtPn.exe
  2⤵
  PID:9564
- C:\Windows\System\AqkmOID.exe
  C:\Windows\System\AqkmOID.exe
  2⤵
  PID:9580
- C:\Windows\System\UfkUYov.exe
  C:\Windows\System\UfkUYov.exe
  2⤵
  PID:9596
- C:\Windows\System\tBydDRD.exe
  C:\Windows\System\tBydDRD.exe
  2⤵
  PID:9612
- C:\Windows\System\mhjpMPZ.exe
  C:\Windows\System\mhjpMPZ.exe
  2⤵
  PID:9628
- C:\Windows\System\JgZAJHE.exe
  C:\Windows\System\JgZAJHE.exe
  2⤵
  PID:9644
- C:\Windows\System\LJegfJA.exe
  C:\Windows\System\LJegfJA.exe
  2⤵
  PID:9660
- C:\Windows\System\zbnnGir.exe
  C:\Windows\System\zbnnGir.exe
  2⤵
  PID:9676
- C:\Windows\System\nRzaoHg.exe
  C:\Windows\System\nRzaoHg.exe
  2⤵
  PID:9692
- C:\Windows\System\CJjuIBw.exe
  C:\Windows\System\CJjuIBw.exe
  2⤵
  PID:9708
- C:\Windows\System\uElmbwf.exe
  C:\Windows\System\uElmbwf.exe
  2⤵
  PID:9724
- C:\Windows\System\ENOONKe.exe
  C:\Windows\System\ENOONKe.exe
  2⤵
  PID:9740
- C:\Windows\System\RAmAqxr.exe
  C:\Windows\System\RAmAqxr.exe
  2⤵
  PID:9756
- C:\Windows\System\rZIRFuo.exe
  C:\Windows\System\rZIRFuo.exe
  2⤵
  PID:9772
- C:\Windows\System\CsoXeEH.exe
  C:\Windows\System\CsoXeEH.exe
  2⤵
  PID:9788
- C:\Windows\System\gdjXFds.exe
  C:\Windows\System\gdjXFds.exe
  2⤵
  PID:9804
- C:\Windows\System\BlCRZoP.exe
  C:\Windows\System\BlCRZoP.exe
  2⤵
  PID:9820
- C:\Windows\System\RXuuulZ.exe
  C:\Windows\System\RXuuulZ.exe
  2⤵
  PID:9836
- C:\Windows\System\koRnNKw.exe
  C:\Windows\System\koRnNKw.exe
  2⤵
  PID:9852
- C:\Windows\System\JVCUMpe.exe
  C:\Windows\System\JVCUMpe.exe
  2⤵
  PID:9868
- C:\Windows\System\rYxSOZs.exe
  C:\Windows\System\rYxSOZs.exe
  2⤵
  PID:9884
- C:\Windows\System\bghXpyb.exe
  C:\Windows\System\bghXpyb.exe
  2⤵
  PID:9900
- C:\Windows\System\JKzvUlV.exe
  C:\Windows\System\JKzvUlV.exe
  2⤵
  PID:9916
- C:\Windows\System\CpiIEVk.exe
  C:\Windows\System\CpiIEVk.exe
  2⤵
  PID:9932
- C:\Windows\System\NIPzLES.exe
  C:\Windows\System\NIPzLES.exe
  2⤵
  PID:9948
- C:\Windows\System\RzqTScp.exe
  C:\Windows\System\RzqTScp.exe
  2⤵
  PID:9964
- C:\Windows\System\EdgbZuZ.exe
  C:\Windows\System\EdgbZuZ.exe
  2⤵
  PID:9980
- C:\Windows\System\LmMBDcf.exe
  C:\Windows\System\LmMBDcf.exe
  2⤵
  PID:9996
- C:\Windows\System\tXYjoCq.exe
  C:\Windows\System\tXYjoCq.exe
  2⤵
  PID:10016
- C:\Windows\System\tPkNNYp.exe
  C:\Windows\System\tPkNNYp.exe
  2⤵
  PID:10032
- C:\Windows\System\HigOjyY.exe
  C:\Windows\System\HigOjyY.exe
  2⤵
  PID:10048
- C:\Windows\System\JbvXRsm.exe
  C:\Windows\System\JbvXRsm.exe
  2⤵
  PID:10064
- C:\Windows\System\KYyWEik.exe
  C:\Windows\System\KYyWEik.exe
  2⤵
  PID:10084
- C:\Windows\System\BHKdPKb.exe
  C:\Windows\System\BHKdPKb.exe
  2⤵
  PID:10100
- C:\Windows\System\PbKTyxo.exe
  C:\Windows\System\PbKTyxo.exe
  2⤵
  PID:10116
- C:\Windows\System\VPREfew.exe
  C:\Windows\System\VPREfew.exe
  2⤵
  PID:10132
- C:\Windows\System\UJgzuFZ.exe
  C:\Windows\System\UJgzuFZ.exe
  2⤵
  PID:10148
- C:\Windows\System\bekaCEv.exe
  C:\Windows\System\bekaCEv.exe
  2⤵
  PID:10164
- C:\Windows\System\PnFAxKt.exe
  C:\Windows\System\PnFAxKt.exe
  2⤵
  PID:10180
- C:\Windows\System\DDcXSQf.exe
  C:\Windows\System\DDcXSQf.exe
  2⤵
  PID:10196
- C:\Windows\System\vcciDvJ.exe
  C:\Windows\System\vcciDvJ.exe
  2⤵
  PID:10212
- C:\Windows\System\ConlQsr.exe
  C:\Windows\System\ConlQsr.exe
  2⤵
  PID:10228
- C:\Windows\System\mOTwJbe.exe
  C:\Windows\System\mOTwJbe.exe
  2⤵
  PID:9224
- C:\Windows\System\kqTISqw.exe
  C:\Windows\System\kqTISqw.exe
  2⤵
  PID:9252
- C:\Windows\System\gfZLEKy.exe
  C:\Windows\System\gfZLEKy.exe
  2⤵
  PID:9284
- C:\Windows\System\ZdZexyg.exe
  C:\Windows\System\ZdZexyg.exe
  2⤵
  PID:9316
- C:\Windows\System\iGXdLcz.exe
  C:\Windows\System\iGXdLcz.exe
  2⤵
  PID:9332
- C:\Windows\System\IsovJKi.exe
  C:\Windows\System\IsovJKi.exe
  2⤵
  PID:9380
- C:\Windows\System\zQlPnCZ.exe
  C:\Windows\System\zQlPnCZ.exe
  2⤵
  PID:9416
- C:\Windows\System\jEvGEih.exe
  C:\Windows\System\jEvGEih.exe
  2⤵
  PID:9444

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\FeQFOoR.exe

Filesize
1.5MB

MD5
6c5696d6504b6c2422f70a6886888b5c

SHA1
ea24271d8cf4c8e768fe19d08bba7c9096175d16

SHA256
9aa682b6d4fb48cee19127ea3dcc00e822bd2a0248b77aaea879bc926fa2d48f

SHA512
a16e10df3039d12199b1b94e51a75c67a0aa2000bcc835d13c797617bd986ed235ba34a68d3229b584b108bc8a63759605bc736647e3314d908f67542c9ca48a

Download Submit
C:\Windows\system\HUtFAaV.exe

Filesize
1.5MB

MD5
75374a1666b1646117dcdb35b1bacc55

SHA1
9aa4b517e4cd22a5c8bb70037202d8a353f111ef

SHA256
1528d89da838fa11e6a7627acd85d2709260ea181e16e6a0685318a462ce8e52

SHA512
93efb02ca1ae12bd489d0fe7b825d91d3410bd848368b5f3e0f84d2cc5b9a23940627be6ac10eddeb4b16ad76e226bc0aef9f32cb3245550014f660093082c48

Download Submit
C:\Windows\system\NhUZpfl.exe

Filesize
1.5MB

MD5
c28d230374aad7271ef4beeae30baf64

SHA1
a9e0a72482d89bdb66168745909171c29f7835a2

SHA256
3b020cc50595a45992925e264ad80ad85c25a3676b14f72b05b5fce3cdcff017

SHA512
114e23e8cc25f3d53639c3b8af2ef639825abf545a94a696d4dbbd9bd00a0b4396e46fe4e6b285c627bc5af3803e91a036ae3ec1b373516f83ad78776c3875a3

Download Submit
C:\Windows\system\OYHEOQF.exe

Filesize
1.5MB

MD5
abfbb541aec4fd2966afb587f54e1d6f

SHA1
bdba47755bc8e7a9563d63c61b68aa27daf91c18

SHA256
d0f6647f9a9b6bdcac53f86739416df04fabd46fd459ad7708696a9fb86f087e

SHA512
9791d5e4035b51e196bc52195d7a7f9f6b23e72abd901a8538f417eb6b9a48f489fd27fe66c65b92add5f8eb8f6474df9a3aa7c9f0088f2a6ed5e89fec9acf46

Download Submit
C:\Windows\system\PuwSBsL.exe

Filesize
1.5MB

MD5
ff4ef74db15bc55e57d827006e82d9ac

SHA1
ba8263133f4efe76ecf92ba0c87502dd480a98fe

SHA256
1883bce4f50168a37bd098abd6989b0a8b14e10a2b5d3f62a08764e7c98e8f9f

SHA512
296b040d92c2ad2a369b50806e94ae8d1b81733ba8c44a37dc8cf636c57e793e334e0ac020997fdbd5d1dc124a4aef26fcc8a9ec9a3af088b8e9d545f5c68197

Download Submit
C:\Windows\system\QcpJKNd.exe

Filesize
1.5MB

MD5
cbbc4a00d2886ae576a7300b4bb9d3b5

SHA1
889be03481850901fda410666bdc7bf51ab1b0ab

SHA256
5b4fece6cc28fb0e249e4505368b131c05eb53fb287837b6a9ff1a5122219605

SHA512
d226aaff264370b8ed98533bfceac720bb2025a8af2752298ee26458bdcedb046539236500a88dda9bc3b91a266e8f4c263e8f3ab5ca1e7f0ebf0c6ba4981e39

Download Submit
C:\Windows\system\RXzDnkL.exe

Filesize
1.5MB

MD5
c771e045ca5fc11fcd7668d775e67cab

SHA1
0a12b0866961d719f31843d2e507b6697f2a0796

SHA256
53db742652c3b8db03ad4af24def3f89798d0d5b439eeeaadc7e313937e0121a

SHA512
b4669927da0f23c0e23438d68894f8601a03434cf52f5924ddc7ad58352e5405be933015d2cbb0d6edc68f28818e2c770e2b7f5b9fdc81587a3c329abd34c04c

Download Submit
C:\Windows\system\YOWkjwJ.exe

Filesize
1.5MB

MD5
963f7606ff4ac469b0b7801033f11018

SHA1
39bcecea05fb52e6352f925e21b677038464f7cf

SHA256
4b43d4a4ccf0ff0cdebc7e176fb57f45b05f7ba8ec3d942873bb93403800bb50

SHA512
d93c33f5c7280756183f03b24aa4656c6433852b77e093ae80cb02ac3b23cdef79bde336f8334a6a82b73a70d472eec0349d2bd960add191a66b6ee95b25d5b1

Download Submit
C:\Windows\system\YPHvBlN.exe

Filesize
1.5MB

MD5
adef9f2b8e0a2ab2206e5bac885596cb

SHA1
66deeb17584cb16c33ee69041f14505c73f15f96

SHA256
20965d2878d50a115f3498b973034e5fddbb87205a53e9c3244c414c586d819b

SHA512
78ee2db436dd25833e8e2bbb621c99c28760e727210baa21d7d249d4120eaf3745131ab52e34bdaac1819f6cf18e60d9ccaeeddfc285b970821e0f14b0b1d194

Download Submit
C:\Windows\system\bodShoJ.exe

Filesize
1.5MB

MD5
73eb3ef4f5b80f3e5adad36cdd9349a2

SHA1
77034e35dbd915a59b4159e1571b4864442308fb

SHA256
8797cac962f313f441722782ecea47bfa5eecbb746551f2d9f8e69abd7c3f8a9

SHA512
1f092be10f15d1439f7f4189c096e08f231a326aa25e9a41b2805ffd44c844ae44490e6f5e6e283630da8606db9b045115bd4bb05220159e1263c9a57ac2aeca

Download Submit
C:\Windows\system\eXbjtDB.exe

Filesize
1.5MB

MD5
41cbb56e2efe95e7750e670ae0f0b71c

SHA1
f4ae1683ff029a8a102ae3f2fd1379ffe02ddb76

SHA256
b1ea2aba4f9f6973b1627b7ebf82983cbf10ac56ccd895d975d88296978f8245

SHA512
000a7845fca9e43253144d491a35b9748c121e105fe32f5458e070fe0973e1ac91b79dd6ba12daa64ca1605b81d9556f3755861bd8ab61c10669d82b27cf5e63

Download Submit
C:\Windows\system\gYarxHC.exe

Filesize
1.5MB

MD5
3a2e0de38714ea460ae88f933b049389

SHA1
aef31d9d67a0333bf586b2d0ac74263e4c639131

SHA256
d2eab6f4539cdcc5cf129e2d2930be0a938052f79cacfd087ad810a4468933ce

SHA512
58d95369448894007437cb85be0000173c62dc4aa9acbf39c498fcd32d41ed58e072cb4260955bd53cc02488e11f919b61fcfd92963bdd0292e2c05788dcc96e

Download Submit
C:\Windows\system\hahAYuC.exe

Filesize
1.5MB

MD5
79eb6bb5a29ded1a04372dec89c7bd0a

SHA1
c1d438f88cba01026fe018268bc0f4abe63fe1cf

SHA256
36ecedae8a4c088c6142991be89df42a714360411ccd0d1997eafd5ca6eabe7d

SHA512
c547391f2ee3ae70766fff5ed10c3fd61219f78d6f0fa60301efce9c363de001c3c90d59adfa02995f869f7b4d1107b84b9441ade1f4326f32a0f41011b14118

Download Submit
C:\Windows\system\hdhRSwz.exe

Filesize
1.5MB

MD5
eb65ede644bdc94ec5f823a4213b5e56

SHA1
c4f2be733e89d10f11445ad8ef7bc9c6a459766e

SHA256
58b61ca85a9eeaeb8532145ac5cc2e1d371cf13286949daa3d1c2425449a5328

SHA512
397d87deb22b7640058c27e9908ce4a62f7883c33adcd1e4bce50c49ded71df6adad4d5ef2bef635f98b1922981448f9d5db62c1d63436cd9c23af8b1aa4c86d

Download Submit
C:\Windows\system\iwIFgOS.exe

Filesize
1.5MB

MD5
f11169fb624df3365133d96aef3d482e

SHA1
8822908650633d114ef34f176f669640a6728cd5

SHA256
45247810f822d123e6c69874fdb33eb72a6da1d376556955f8d183e7b8db2aa3

SHA512
73e1d3d6adf1f946f8970c6611d26606402e4458311ba41bd6f2d4c7d8b4aed5dd1982b1af23b1079b2d8638ed73e3ab1e979ade84a12191d88b48fba7fffb21

Download Submit
C:\Windows\system\oUHdaBp.exe

Filesize
1.5MB

MD5
c091a487bf2957cd9d56bd8632bbe061

SHA1
c216c78caadb2f6a259108c04aed710632084783

SHA256
447a3bb7d5a907a133788d174eaf7562e4dc2245b580a3f085c5e6cf551f76b4

SHA512
6a634dfb21491a1d6ee6e1c7b7cdc11d1461f91a874c4b3c51853ab0caa9d2f0cc254ef54a1c47f44196fd2de7a9831ba2e73bbd9302f7304c9730164580adfd

Download Submit
C:\Windows\system\sLZoDcJ.exe

Filesize
1.5MB

MD5
a2aea4d54f1f2e9d3562ae420fb91f35

SHA1
1c2c3dd4fe99a5a8f663c072abfb9ee5b78b3d0e

SHA256
a01f2750607acd7ef2a10a732c0870c2bf4a4bcef1ce7ecb5d6eecbef6cc2167

SHA512
dc71290e8917aee157918d9faea9ab1b3d7f2f878340a57dd1d6904e2a720b0852b48fd5ab2a538317023b1d42707ceae165ae1574a5ef24bbb2fa34a833d1b1

Download Submit
C:\Windows\system\tXKjhJO.exe

Filesize
1.5MB

MD5
e5695135b41072efc7b24a9c29659294

SHA1
41d78517388b8f930580ce14e0076a4aef55ef32

SHA256
b129e95d6d8ce6d2702e99e59ec6d29275ffde3e8abd4145c5ef541a51bccc08

SHA512
86b1617556e5eca1d990304775c2b66c780590fd220aa7902b39f845feb9bdb062e965a1aef95d6bbb286c915b1f928a5362475e487fa1aed9cd89bddb3ff066

Download Submit
C:\Windows\system\teIuRIx.exe

Filesize
1.5MB

MD5
1aafd0319a8360a1589f38e154df056b

SHA1
ba09bf0443b12960cee7382883b9e20dffee26cb

SHA256
6daf67761ad60fccece9f588a2bb69b74305159a36c285c591966e5fb94f64e1

SHA512
6aaf1fe6a344f026bf44273dc2831c1df7b8cbfdabc12d0536bbee0337e3fa1021890f7858d772d72275a58bd01610faaf13bb22859dd95e39344cf866049fc7

Download Submit
C:\Windows\system\vQAjgoR.exe

Filesize
1.5MB

MD5
053bf67bcc5b57e9ad16b8d1cc7e2fa1

SHA1
e91674ae039d7c6ccd36acefd7a9782fac114e3f

SHA256
39e32e87bb154387a00565d1d9861fc60ae5cb990e180280aebc8857e2efa9e8

SHA512
3517944053904aca37fc2a7de200a0cebdba0b197c1c37f9018f60cb44a84832f81e0b0c9c2731f83dd2a8b84d8a20a65bf0eaed9a617334fda4a08ba1b24e4f

Download Submit
\Windows\system\AmYHJkr.exe

Filesize
1.5MB

MD5
a7f884b8b0f0da21f927eea37e9df87b

SHA1
817b7f88206a132d66d6db37ebe587f0fe4ab0ae

SHA256
198d1165ac10ed2432dac41e7443a887cf36edd563e9edad9133c4e56c4b8f6c

SHA512
d6d73584863d7d0b08750deeacb81c158390c81b90c0daf8d5818133f1ff6338289d0b92a780c1eb2c1fb4f61b6bb762ddae1f1fd2fdbd83d35f1a3e1180204c

Download Submit
\Windows\system\EvJHDeV.exe

Filesize
1.5MB

MD5
5fd2dc20634a2417c808718f42b7f127

SHA1
c0975a6378eb1b64008e7c90b582408bc0b0e6a5

SHA256
6ed14a3746e0405b688eb6b34302fa9635dc1ac6e74696ec80d7f8ea6a0139df

SHA512
417a9dd5458bb30116540bc58bdf9ee93f09fe6063e86d68a74831468ba59344650688e5fb9001d39e77141d58dddb9bec6586ecd35628a661f56b149931cc48

Download Submit
\Windows\system\FdftIHd.exe

Filesize
1.5MB

MD5
fb0bcc84007e4f3bef384a2e80a2db08

SHA1
9c1b8a7b3f700027499047a5f74fa4cd39687a46

SHA256
d0a7f58ed9347809b07d181a2a1e39132c000a6b970b4cb4b4838b17c252147c

SHA512
66d218a4196924f5135ca4ba09d9b912878eae9b81c29922c5664528f313011f052c6858c0c51ae3d8ccfa0681bb0f69a9f24ef53b02f50ea85a1114740ae517

Download Submit
\Windows\system\GPcYDfF.exe

Filesize
1.5MB

MD5
6ab866c585140e431d06aed4697a99e6

SHA1
e87efc7917f5320868efe7edacea740d27546042

SHA256
d015c52d1614b7cf33d86f4c2a0aeb834ae3d6312cf3502a49c9b5854b0ec1f1

SHA512
f07074a5db6d08a3b6c503c683db5617995d376ed7d8df7483d0c5b84f828ae7bcbc731427ece5f296119a69d168be89638d4fcfe1545cd269381cbac7b83974

Download Submit
\Windows\system\IBMlOXi.exe

Filesize
1.5MB

MD5
e84e9e74c4440e3f00cb4f02b992cb1c

SHA1
386c9c1c6db5e5f8fe300c2e90d0be98a72fd47f

SHA256
b6ae533075c59837c5ce313cb6e4348310e4d6ca1dd8fa9bac48398ddfbdaf8f

SHA512
894a8065150da598ffd384d96e1f74303ee035f640a75a9cd842786cc4b51f4dd8fb7ed74446387f23c8411ffe165291a831a2bb1f31b942b9278b43982177d1

Download Submit
\Windows\system\JYDQsJH.exe

Filesize
1.5MB

MD5
6b7b0aeae9224ed571c3a80d89ad02b9

SHA1
f4cf71d1ed78eb345c9424879e2abf6b881b1e50

SHA256
c75c7aa7420644aa7631af87f74b3926ade0554a8b1d1539f05fac1eacd5073d

SHA512
072abb2380583d3fc7872597aa7460d2d234e3d681cfdea8ad5a4fff6a607de8ab014faa6223cabd16c9de50421dabf3848bd20de51bb9f5823b38477d675813

Download Submit
\Windows\system\LvoKZqp.exe

Filesize
1.5MB

MD5
4d31b22494aaa39d2cd16ec592ccb501

SHA1
a0b193e0e0cb56d31c724f76bc6f44c0a05fc340

SHA256
6b07fd0bc35913bf6ce90e82a6cdf52384e150a36c2f9a4234f66aa696cbbede

SHA512
ff027ed38022c20f5483f6bc9a4a407e562e7ec1f58a3957b561145cabcb64abe07ea1386a8f486bd7fb3c9e5e471b619441181c34ef2fd645f58f58f918f8c0

Download Submit
\Windows\system\XQXTEaY.exe

Filesize
1.5MB

MD5
a28807e35b14596fe8019ba4d1f14a86

SHA1
4ba68f6c603e09b01c5200a946e314b057df8b8d

SHA256
03ba90496536748fd3ef464111d6c83c6b7840a276b60dd44aef9d915ebea77f

SHA512
93004b2fcccc232f56a708d9ff0c06e65969ce5ab913532f054e5d4cf80d08853e278e31a7d3dd2776dda8faf54afd4e447d41d36f69adbb4f3f4daa702009f4

Download Submit
\Windows\system\YaztjQy.exe

Filesize
1.5MB

MD5
198b4f93e668868167d8d862c88d9fc1

SHA1
3802586df6b80077dcb88af5299e9bab51b11d72

SHA256
cfd8fde1f0a3eef37edd580e9cdc49629255e0c9a0b86402b51cb0defdb5f5eb

SHA512
ad7a8e6f60345b4b949263027c9123974caa1d3f2f8faf9458fb3b5300fbd2371842ff6c200ce6e0fb1520a37351f109c21b23cf803f8257c4de737c2edf3c75

Download Submit
\Windows\system\kApBgst.exe

Filesize
1.5MB

MD5
d9334113f9b78cbac239b3e9d367ca6d

SHA1
d94f321944e12ed9347a294b376974e48b63e3d5

SHA256
63586b877274d01847f10acd69abc654df659d137d2cbf16e5e39efc27d8ccf3

SHA512
e86554d436af549116bfb7821fd65c0c67df7a5583f608620800589b92fdd6ce0ffad58b5b6699bd09c2b6af0837f075790060ca3da95373afbcb9c908adea02

Download Submit
\Windows\system\tZzhEpT.exe

Filesize
1.5MB

MD5
76a0eddcecd5ab91152fa114e3fe0ba8

SHA1
06e8c8629ce117c15afbace4ebdf3ac163d11e16

SHA256
8cbf61ae918a902bf5f50feeb44265feaf3ab16fcf0ad5d6f3ca3a3ecafd4a28

SHA512
88a52fc6f145588399ec3d03bc2a57ba043881266497ea50a93ffa39512dab2013242c28bbcb2309badf13e7f4e3c2af96761fbae8be5608438e8d000144e9d0

Download Submit
\Windows\system\zOLsntj.exe

Filesize
1.5MB

MD5
4a00d726a61420f7d921d9a99846b178

SHA1
003c596d7d1e5a79f6e168c2f45081f54d518b19

SHA256
2aa16b32716a48edbfacf729f85beeebb0c234d678beb79e407dba489a075c9c

SHA512
531b3575b4ec52e2cc70198760be7d11d6660fcda8fb57799629f07c0373b2353d3288a1dd2b4cc19b38deeb6e1de0a0a57d993c2f20bd6112bd050a294bb177

Download Submit
memory/552-89-0x000000013F950000-0x000000013FD42000-memory.dmp

Filesize
3.9MB

Download
memory/552-1653-0x000000013F950000-0x000000013FD42000-memory.dmp

Filesize
3.9MB

Download
memory/668-80-0x000007FEF53A0000-0x000007FEF5D3D000-memory.dmp

Filesize
9.6MB

Download
memory/668-194-0x000007FEF53A0000-0x000007FEF5D3D000-memory.dmp

Filesize
9.6MB

Download
memory/668-15-0x000007FEF565E000-0x000007FEF565F000-memory.dmp

Filesize
4KB

Download
memory/668-14-0x00000000024C0000-0x0000000002540000-memory.dmp

Filesize
512KB

Download
memory/668-44-0x000000001B320000-0x000000001B602000-memory.dmp

Filesize
2.9MB

Download
memory/668-46-0x0000000002490000-0x0000000002498000-memory.dmp

Filesize
32KB

Download
memory/668-75-0x000007FEF53A0000-0x000007FEF5D3D000-memory.dmp

Filesize
9.6MB

Download
memory/1108-1678-0x000000013F290000-0x000000013F682000-memory.dmp

Filesize
3.9MB

Download
memory/1108-108-0x000000013F290000-0x000000013F682000-memory.dmp

Filesize
3.9MB

Download
memory/1488-1618-0x000000013F760000-0x000000013FB52000-memory.dmp

Filesize
3.9MB

Download
memory/1488-84-0x000000013F760000-0x000000013FB52000-memory.dmp

Filesize
3.9MB

Download
memory/2140-106-0x00000000030D0000-0x00000000034C2000-memory.dmp

Filesize
3.9MB

Download
memory/2140-107-0x00000000030D0000-0x00000000034C2000-memory.dmp

Filesize
3.9MB

Download
memory/2140-1-0x00000000001F0000-0x0000000000200000-memory.dmp

Filesize
64KB

Download
memory/2140-103-0x0000000002C50000-0x0000000003042000-memory.dmp

Filesize
3.9MB

Download
memory/2140-102-0x0000000002C50000-0x0000000003042000-memory.dmp

Filesize
3.9MB

Download
memory/2140-76-0x000000013F290000-0x000000013F682000-memory.dmp

Filesize
3.9MB

Download
memory/2140-0-0x000000013FC40000-0x0000000140032000-memory.dmp

Filesize
3.9MB

Download
memory/2140-99-0x0000000002C50000-0x0000000003042000-memory.dmp

Filesize
3.9MB

Download
memory/2140-98-0x000000013F160000-0x000000013F552000-memory.dmp

Filesize
3.9MB

Download
memory/2140-81-0x000000013F030000-0x000000013F422000-memory.dmp

Filesize
3.9MB

Download
memory/2140-87-0x0000000002C50000-0x0000000003042000-memory.dmp

Filesize
3.9MB

Download
memory/2140-92-0x0000000002C50000-0x0000000003042000-memory.dmp

Filesize
3.9MB

Download
memory/2140-85-0x000000013F450000-0x000000013F842000-memory.dmp

Filesize
3.9MB

Download
memory/2140-12-0x000000013F770000-0x000000013FB62000-memory.dmp

Filesize
3.9MB

Download
memory/2140-83-0x000000013F760000-0x000000013FB52000-memory.dmp

Filesize
3.9MB

Download
memory/2500-1639-0x000000013FF00000-0x00000001402F2000-memory.dmp

Filesize
3.9MB

Download
memory/2500-94-0x000000013FF00000-0x00000001402F2000-memory.dmp

Filesize
3.9MB

Download
memory/2504-1680-0x000000013F770000-0x000000013FB62000-memory.dmp

Filesize
3.9MB

Download
memory/2504-13-0x000000013F770000-0x000000013FB62000-memory.dmp

Filesize
3.9MB

Download
memory/2544-1637-0x000000013FA80000-0x000000013FE72000-memory.dmp

Filesize
3.9MB

Download
memory/2544-100-0x000000013FA80000-0x000000013FE72000-memory.dmp

Filesize
3.9MB

Download
memory/2560-1638-0x000000013FBF0000-0x000000013FFE2000-memory.dmp

Filesize
3.9MB

Download
memory/2560-104-0x000000013FBF0000-0x000000013FFE2000-memory.dmp

Filesize
3.9MB

Download
memory/2592-1633-0x000000013F450000-0x000000013F842000-memory.dmp

Filesize
3.9MB

Download
memory/2592-86-0x000000013F450000-0x000000013F842000-memory.dmp

Filesize
3.9MB

Download
memory/2672-105-0x000000013F8D0000-0x000000013FCC2000-memory.dmp

Filesize
3.9MB

Download
memory/2672-1650-0x000000013F8D0000-0x000000013FCC2000-memory.dmp

Filesize
3.9MB

Download
memory/2816-82-0x000000013F030000-0x000000013F422000-memory.dmp

Filesize
3.9MB

Download
memory/2816-1664-0x000000013F030000-0x000000013F422000-memory.dmp

Filesize
3.9MB

Download
memory/2908-1656-0x000000013F160000-0x000000013F552000-memory.dmp

Filesize
3.9MB

Download
memory/2908-101-0x000000013F160000-0x000000013F552000-memory.dmp

Filesize
3.9MB

Download