xmrig | f7e60c8b980daeed2c2cf9bd21b84366b4ec709817d162f2a10d0aa96bccd247

Analysis

max time kernel
150s
max time network
146s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
08-05-2024 23:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9b88f2bb9c66b2500b57373fe6627440_NEIKI.exe
Size

1.9MB
MD5

9b88f2bb9c66b2500b57373fe6627440
SHA1

001d399980291234a614d020c95deae9bf32e3bb
SHA256

f7e60c8b980daeed2c2cf9bd21b84366b4ec709817d162f2a10d0aa96bccd247
SHA512

12eb76350b2f4a66d159854d7db53f02dcf8ea2dbfbd6a20dc4da451c4d9d7534b5aa1996eeb2db1d8d586dc5a9f89d0bc30868fad523d47fb0ac4baf16f7baa
SSDEEP

49152:Lz071uv4BPMkibTIA5lCx7kvRWa4pCkc3Ukwf:NABb

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 16 IoCs

miner

resource	yara_rule
behavioral1/memory/2532-96-0x000000013FA30000-0x000000013FE22000-memory.dmp	xmrig
behavioral1/memory/2568-95-0x000000013FA70000-0x000000013FE62000-memory.dmp	xmrig
behavioral1/memory/2612-85-0x000000013FD90000-0x0000000140182000-memory.dmp	xmrig
behavioral1/memory/2684-84-0x000000013F6B0000-0x000000013FAA2000-memory.dmp	xmrig
behavioral1/memory/2784-83-0x000000013F950000-0x000000013FD42000-memory.dmp	xmrig
behavioral1/memory/2816-79-0x000000013FC50000-0x0000000140042000-memory.dmp	xmrig
behavioral1/memory/2360-76-0x000000013F0D0000-0x000000013F4C2000-memory.dmp	xmrig
behavioral1/memory/1732-63-0x000000013FCC0000-0x00000001400B2000-memory.dmp	xmrig
behavioral1/memory/2684-4535-0x000000013F6B0000-0x000000013FAA2000-memory.dmp	xmrig
behavioral1/memory/2784-4536-0x000000013F950000-0x000000013FD42000-memory.dmp	xmrig
behavioral1/memory/1732-4541-0x000000013FCC0000-0x00000001400B2000-memory.dmp	xmrig
behavioral1/memory/2816-4569-0x000000013FC50000-0x0000000140042000-memory.dmp	xmrig
behavioral1/memory/2568-4540-0x000000013FA70000-0x000000013FE62000-memory.dmp	xmrig
behavioral1/memory/2360-4538-0x000000013F0D0000-0x000000013F4C2000-memory.dmp	xmrig
behavioral1/memory/2532-4539-0x000000013FA30000-0x000000013FE22000-memory.dmp	xmrig
behavioral1/memory/2612-4608-0x000000013FD90000-0x0000000140182000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
1508	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
1732	MucHlIT.exe
2360	xAcIiyV.exe
2816	AJjNXBx.exe
2784	WKvvxfx.exe
2684	tszWTZQ.exe
2612	RrxgBSI.exe
2568	AcwCriD.exe
2532	fuFKxcV.exe
2692	EbaLNxX.exe
2632	rzpXDzO.exe
2676	FOTQbTR.exe
2960	ujTMWjn.exe
2560	jShhqre.exe
2768	STKjeQM.exe
2584	GRjKuOB.exe
2148	yvqtRiN.exe
1984	nDrtDeP.exe
2748	fwnHbsD.exe
1964	FrDmOYw.exe
544	cyMxeBv.exe
800	MQNwAUr.exe
2920	tjpehbw.exe
2904	UYSvMon.exe
2004	byXEiZT.exe
1752	SeTYjUL.exe
2140	mRTSawc.exe
2708	jPshAPg.exe
1064	YEmAgSu.exe
768	WIRZAoC.exe
1100	BMGDjcn.exe
684	ZsJTnJO.exe
2476	BSPWjPj.exe
1332	kfuSJtW.exe
780	obYNXlq.exe
1648	LLESLIV.exe
1988	CzryAkG.exe
1156	QYNqYIT.exe
1976	heAGVMJ.exe
3016	kmjhXDF.exe
1832	ARzXrZL.exe
1620	sypaSDv.exe
2468	BjsOdem.exe
2996	zeXvajw.exe
2604	yteIXID.exe
2152	lAgjvtr.exe
2244	ZnnYnlB.exe
2956	cVUkMgh.exe
1492	pKFFZPc.exe
2188	OwTMGVs.exe
1888	FBgMQkI.exe
2256	zcbyWAs.exe
1584	ofBGgVH.exe
2792	DHVfLFM.exe
2344	tezpKCD.exe
2552	CissmwV.exe
2672	oexoGvz.exe
2840	ogwhIhb.exe
2516	WPKXfci.exe
2264	LjsrwxP.exe
2588	MQWaVqs.exe
1628	mxaVMbr.exe
2496	JbHksQS.exe
2744	ZOFlViL.exe
2616	MncAVpp.exe

Loads dropped DLL 64 IoCs

pid	Process
1028	9b88f2bb9c66b2500b57373fe6627440_NEIKI.exe
1028	9b88f2bb9c66b2500b57373fe6627440_NEIKI.exe
1028	9b88f2bb9c66b2500b57373fe6627440_NEIKI.exe
1028	9b88f2bb9c66b2500b57373fe6627440_NEIKI.exe
1028	9b88f2bb9c66b2500b57373fe6627440_NEIKI.exe
1028	9b88f2bb9c66b2500b57373fe6627440_NEIKI.exe
1028	9b88f2bb9c66b2500b57373fe6627440_NEIKI.exe
1028	9b88f2bb9c66b2500b57373fe6627440_NEIKI.exe
1028	9b88f2bb9c66b2500b57373fe6627440_NEIKI.exe
1028	9b88f2bb9c66b2500b57373fe6627440_NEIKI.exe
1028	9b88f2bb9c66b2500b57373fe6627440_NEIKI.exe
1028	9b88f2bb9c66b2500b57373fe6627440_NEIKI.exe
1028	9b88f2bb9c66b2500b57373fe6627440_NEIKI.exe
1028	9b88f2bb9c66b2500b57373fe6627440_NEIKI.exe
1028	9b88f2bb9c66b2500b57373fe6627440_NEIKI.exe
1028	9b88f2bb9c66b2500b57373fe6627440_NEIKI.exe
1028	9b88f2bb9c66b2500b57373fe6627440_NEIKI.exe
1028	9b88f2bb9c66b2500b57373fe6627440_NEIKI.exe
1028	9b88f2bb9c66b2500b57373fe6627440_NEIKI.exe
1028	9b88f2bb9c66b2500b57373fe6627440_NEIKI.exe
1028	9b88f2bb9c66b2500b57373fe6627440_NEIKI.exe
1028	9b88f2bb9c66b2500b57373fe6627440_NEIKI.exe
1028	9b88f2bb9c66b2500b57373fe6627440_NEIKI.exe
1028	9b88f2bb9c66b2500b57373fe6627440_NEIKI.exe
1028	9b88f2bb9c66b2500b57373fe6627440_NEIKI.exe
1028	9b88f2bb9c66b2500b57373fe6627440_NEIKI.exe
1028	9b88f2bb9c66b2500b57373fe6627440_NEIKI.exe
1028	9b88f2bb9c66b2500b57373fe6627440_NEIKI.exe
1028	9b88f2bb9c66b2500b57373fe6627440_NEIKI.exe
1028	9b88f2bb9c66b2500b57373fe6627440_NEIKI.exe
1028	9b88f2bb9c66b2500b57373fe6627440_NEIKI.exe
1028	9b88f2bb9c66b2500b57373fe6627440_NEIKI.exe
1028	9b88f2bb9c66b2500b57373fe6627440_NEIKI.exe
1028	9b88f2bb9c66b2500b57373fe6627440_NEIKI.exe
1028	9b88f2bb9c66b2500b57373fe6627440_NEIKI.exe
1028	9b88f2bb9c66b2500b57373fe6627440_NEIKI.exe
1028	9b88f2bb9c66b2500b57373fe6627440_NEIKI.exe
1028	9b88f2bb9c66b2500b57373fe6627440_NEIKI.exe
1028	9b88f2bb9c66b2500b57373fe6627440_NEIKI.exe
1028	9b88f2bb9c66b2500b57373fe6627440_NEIKI.exe
1028	9b88f2bb9c66b2500b57373fe6627440_NEIKI.exe
1028	9b88f2bb9c66b2500b57373fe6627440_NEIKI.exe
1028	9b88f2bb9c66b2500b57373fe6627440_NEIKI.exe
1028	9b88f2bb9c66b2500b57373fe6627440_NEIKI.exe
1028	9b88f2bb9c66b2500b57373fe6627440_NEIKI.exe
1028	9b88f2bb9c66b2500b57373fe6627440_NEIKI.exe
1028	9b88f2bb9c66b2500b57373fe6627440_NEIKI.exe
1028	9b88f2bb9c66b2500b57373fe6627440_NEIKI.exe
1028	9b88f2bb9c66b2500b57373fe6627440_NEIKI.exe
1028	9b88f2bb9c66b2500b57373fe6627440_NEIKI.exe
1028	9b88f2bb9c66b2500b57373fe6627440_NEIKI.exe
1028	9b88f2bb9c66b2500b57373fe6627440_NEIKI.exe
1028	9b88f2bb9c66b2500b57373fe6627440_NEIKI.exe
1028	9b88f2bb9c66b2500b57373fe6627440_NEIKI.exe
1028	9b88f2bb9c66b2500b57373fe6627440_NEIKI.exe
1028	9b88f2bb9c66b2500b57373fe6627440_NEIKI.exe
1028	9b88f2bb9c66b2500b57373fe6627440_NEIKI.exe
1028	9b88f2bb9c66b2500b57373fe6627440_NEIKI.exe
1028	9b88f2bb9c66b2500b57373fe6627440_NEIKI.exe
1028	9b88f2bb9c66b2500b57373fe6627440_NEIKI.exe
1028	9b88f2bb9c66b2500b57373fe6627440_NEIKI.exe
1028	9b88f2bb9c66b2500b57373fe6627440_NEIKI.exe
1028	9b88f2bb9c66b2500b57373fe6627440_NEIKI.exe
1028	9b88f2bb9c66b2500b57373fe6627440_NEIKI.exe

UPX packed file 49 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x000c000000012263-3.dat	upx
behavioral1/files/0x0031000000015cf5-8.dat	upx
behavioral1/files/0x0006000000016d21-37.dat	upx
behavioral1/files/0x0007000000016126-36.dat	upx
behavioral1/files/0x0007000000015fbb-20.dat	upx
behavioral1/files/0x0008000000016d01-29.dat	upx
behavioral1/files/0x0008000000015d99-69.dat	upx
behavioral1/files/0x0006000000016d73-105.dat	upx
behavioral1/files/0x0006000000016fa9-118.dat	upx
behavioral1/files/0x000600000001738e-130.dat	upx
behavioral1/files/0x0006000000017577-154.dat	upx
behavioral1/files/0x00060000000175fd-188.dat	upx
behavioral1/files/0x0006000000017436-148.dat	upx
behavioral1/files/0x00060000000175f7-160.dat	upx
behavioral1/files/0x00060000000174ef-152.dat	upx
behavioral1/files/0x00060000000173e5-144.dat	upx
behavioral1/files/0x00060000000173e2-140.dat	upx
behavioral1/files/0x000600000001708c-124.dat	upx
behavioral1/files/0x000600000001738f-136.dat	upx
behavioral1/files/0x00060000000171ad-128.dat	upx
behavioral1/files/0x0006000000016d7d-116.dat	upx
behavioral1/files/0x0006000000016d79-112.dat	upx
behavioral1/files/0x0032000000015d02-108.dat	upx
behavioral1/files/0x0006000000016d5f-101.dat	upx
behavioral1/files/0x0006000000016d4f-100.dat	upx
behavioral1/files/0x0006000000016d3e-99.dat	upx
behavioral1/files/0x0006000000016d2d-98.dat	upx
behavioral1/memory/2532-96-0x000000013FA30000-0x000000013FE22000-memory.dmp	upx
behavioral1/memory/2568-95-0x000000013FA70000-0x000000013FE62000-memory.dmp	upx
behavioral1/memory/2612-85-0x000000013FD90000-0x0000000140182000-memory.dmp	upx
behavioral1/memory/2684-84-0x000000013F6B0000-0x000000013FAA2000-memory.dmp	upx
behavioral1/memory/2784-83-0x000000013F950000-0x000000013FD42000-memory.dmp	upx
behavioral1/memory/2816-79-0x000000013FC50000-0x0000000140042000-memory.dmp	upx
behavioral1/memory/2360-76-0x000000013F0D0000-0x000000013F4C2000-memory.dmp	upx
behavioral1/files/0x0007000000016020-74.dat	upx
behavioral1/files/0x0006000000016d57-67.dat	upx
behavioral1/files/0x0006000000016d46-65.dat	upx
behavioral1/files/0x0006000000016d36-64.dat	upx
behavioral1/memory/1732-63-0x000000013FCC0000-0x00000001400B2000-memory.dmp	upx
behavioral1/files/0x0008000000015d28-16.dat	upx
behavioral1/memory/1028-1-0x000000013F5A0000-0x000000013F992000-memory.dmp	upx
behavioral1/memory/2684-4535-0x000000013F6B0000-0x000000013FAA2000-memory.dmp	upx
behavioral1/memory/2784-4536-0x000000013F950000-0x000000013FD42000-memory.dmp	upx
behavioral1/memory/1732-4541-0x000000013FCC0000-0x00000001400B2000-memory.dmp	upx
behavioral1/memory/2816-4569-0x000000013FC50000-0x0000000140042000-memory.dmp	upx
behavioral1/memory/2568-4540-0x000000013FA70000-0x000000013FE62000-memory.dmp	upx
behavioral1/memory/2360-4538-0x000000013F0D0000-0x000000013F4C2000-memory.dmp	upx
behavioral1/memory/2532-4539-0x000000013FA30000-0x000000013FE22000-memory.dmp	upx
behavioral1/memory/2612-4608-0x000000013FD90000-0x0000000140182000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\BjsOdem.exe	9b88f2bb9c66b2500b57373fe6627440_NEIKI.exe
File created	C:\Windows\System\OkYnYSa.exe	9b88f2bb9c66b2500b57373fe6627440_NEIKI.exe
File created	C:\Windows\System\qqYSVlC.exe	9b88f2bb9c66b2500b57373fe6627440_NEIKI.exe
File created	C:\Windows\System\BlVunjl.exe	9b88f2bb9c66b2500b57373fe6627440_NEIKI.exe
File created	C:\Windows\System\lfdyOFG.exe	9b88f2bb9c66b2500b57373fe6627440_NEIKI.exe
File created	C:\Windows\System\eFJDWZC.exe	9b88f2bb9c66b2500b57373fe6627440_NEIKI.exe
File created	C:\Windows\System\iHtXPpG.exe	9b88f2bb9c66b2500b57373fe6627440_NEIKI.exe
File created	C:\Windows\System\SiOXnZc.exe	9b88f2bb9c66b2500b57373fe6627440_NEIKI.exe
File created	C:\Windows\System\Bojcxlk.exe	9b88f2bb9c66b2500b57373fe6627440_NEIKI.exe
File created	C:\Windows\System\wkEKGyF.exe	9b88f2bb9c66b2500b57373fe6627440_NEIKI.exe
File created	C:\Windows\System\DfoHDdz.exe	9b88f2bb9c66b2500b57373fe6627440_NEIKI.exe
File created	C:\Windows\System\aaslqNY.exe	9b88f2bb9c66b2500b57373fe6627440_NEIKI.exe
File created	C:\Windows\System\yOIMkoM.exe	9b88f2bb9c66b2500b57373fe6627440_NEIKI.exe
File created	C:\Windows\System\HyRmooS.exe	9b88f2bb9c66b2500b57373fe6627440_NEIKI.exe
File created	C:\Windows\System\gdlDtNX.exe	9b88f2bb9c66b2500b57373fe6627440_NEIKI.exe
File created	C:\Windows\System\LlZdLFp.exe	9b88f2bb9c66b2500b57373fe6627440_NEIKI.exe
File created	C:\Windows\System\CoZmObT.exe	9b88f2bb9c66b2500b57373fe6627440_NEIKI.exe
File created	C:\Windows\System\rExwGRp.exe	9b88f2bb9c66b2500b57373fe6627440_NEIKI.exe
File created	C:\Windows\System\tDyjpOC.exe	9b88f2bb9c66b2500b57373fe6627440_NEIKI.exe
File created	C:\Windows\System\zdwHSda.exe	9b88f2bb9c66b2500b57373fe6627440_NEIKI.exe
File created	C:\Windows\System\QZxRJmH.exe	9b88f2bb9c66b2500b57373fe6627440_NEIKI.exe
File created	C:\Windows\System\Atwzysq.exe	9b88f2bb9c66b2500b57373fe6627440_NEIKI.exe
File created	C:\Windows\System\qXcDKUG.exe	9b88f2bb9c66b2500b57373fe6627440_NEIKI.exe
File created	C:\Windows\System\CRuspQD.exe	9b88f2bb9c66b2500b57373fe6627440_NEIKI.exe
File created	C:\Windows\System\gdozqLw.exe	9b88f2bb9c66b2500b57373fe6627440_NEIKI.exe
File created	C:\Windows\System\WFIIddm.exe	9b88f2bb9c66b2500b57373fe6627440_NEIKI.exe
File created	C:\Windows\System\htZcLtj.exe	9b88f2bb9c66b2500b57373fe6627440_NEIKI.exe
File created	C:\Windows\System\NYPPIsz.exe	9b88f2bb9c66b2500b57373fe6627440_NEIKI.exe
File created	C:\Windows\System\gxeFQsC.exe	9b88f2bb9c66b2500b57373fe6627440_NEIKI.exe
File created	C:\Windows\System\CmTIzFK.exe	9b88f2bb9c66b2500b57373fe6627440_NEIKI.exe
File created	C:\Windows\System\MXqHuIZ.exe	9b88f2bb9c66b2500b57373fe6627440_NEIKI.exe
File created	C:\Windows\System\uZoTKRE.exe	9b88f2bb9c66b2500b57373fe6627440_NEIKI.exe
File created	C:\Windows\System\ezCXyGf.exe	9b88f2bb9c66b2500b57373fe6627440_NEIKI.exe
File created	C:\Windows\System\xEqYsvS.exe	9b88f2bb9c66b2500b57373fe6627440_NEIKI.exe
File created	C:\Windows\System\rBaqbxn.exe	9b88f2bb9c66b2500b57373fe6627440_NEIKI.exe
File created	C:\Windows\System\vXzUsFm.exe	9b88f2bb9c66b2500b57373fe6627440_NEIKI.exe
File created	C:\Windows\System\RYOfxrn.exe	9b88f2bb9c66b2500b57373fe6627440_NEIKI.exe
File created	C:\Windows\System\DgMVsFd.exe	9b88f2bb9c66b2500b57373fe6627440_NEIKI.exe
File created	C:\Windows\System\wrkfFXz.exe	9b88f2bb9c66b2500b57373fe6627440_NEIKI.exe
File created	C:\Windows\System\SkPXrMx.exe	9b88f2bb9c66b2500b57373fe6627440_NEIKI.exe
File created	C:\Windows\System\DDJLYUG.exe	9b88f2bb9c66b2500b57373fe6627440_NEIKI.exe
File created	C:\Windows\System\fbMmVqL.exe	9b88f2bb9c66b2500b57373fe6627440_NEIKI.exe
File created	C:\Windows\System\WYsJnVF.exe	9b88f2bb9c66b2500b57373fe6627440_NEIKI.exe
File created	C:\Windows\System\whLHfTQ.exe	9b88f2bb9c66b2500b57373fe6627440_NEIKI.exe
File created	C:\Windows\System\UVPTnyF.exe	9b88f2bb9c66b2500b57373fe6627440_NEIKI.exe
File created	C:\Windows\System\luLurGe.exe	9b88f2bb9c66b2500b57373fe6627440_NEIKI.exe
File created	C:\Windows\System\TPNonpl.exe	9b88f2bb9c66b2500b57373fe6627440_NEIKI.exe
File created	C:\Windows\System\UatIntC.exe	9b88f2bb9c66b2500b57373fe6627440_NEIKI.exe
File created	C:\Windows\System\HXYLTrT.exe	9b88f2bb9c66b2500b57373fe6627440_NEIKI.exe
File created	C:\Windows\System\ASfGTyX.exe	9b88f2bb9c66b2500b57373fe6627440_NEIKI.exe
File created	C:\Windows\System\QiuYUGQ.exe	9b88f2bb9c66b2500b57373fe6627440_NEIKI.exe
File created	C:\Windows\System\EAjwowf.exe	9b88f2bb9c66b2500b57373fe6627440_NEIKI.exe
File created	C:\Windows\System\PdNhTlY.exe	9b88f2bb9c66b2500b57373fe6627440_NEIKI.exe
File created	C:\Windows\System\unAxJqg.exe	9b88f2bb9c66b2500b57373fe6627440_NEIKI.exe
File created	C:\Windows\System\gjSFYXE.exe	9b88f2bb9c66b2500b57373fe6627440_NEIKI.exe
File created	C:\Windows\System\NwVDLSj.exe	9b88f2bb9c66b2500b57373fe6627440_NEIKI.exe
File created	C:\Windows\System\YBoXbYY.exe	9b88f2bb9c66b2500b57373fe6627440_NEIKI.exe
File created	C:\Windows\System\CnSuzfs.exe	9b88f2bb9c66b2500b57373fe6627440_NEIKI.exe
File created	C:\Windows\System\KzBxuUF.exe	9b88f2bb9c66b2500b57373fe6627440_NEIKI.exe
File created	C:\Windows\System\HlFVsQT.exe	9b88f2bb9c66b2500b57373fe6627440_NEIKI.exe
File created	C:\Windows\System\UwYJjow.exe	9b88f2bb9c66b2500b57373fe6627440_NEIKI.exe
File created	C:\Windows\System\tzRmIpy.exe	9b88f2bb9c66b2500b57373fe6627440_NEIKI.exe
File created	C:\Windows\System\DuqDCEK.exe	9b88f2bb9c66b2500b57373fe6627440_NEIKI.exe
File created	C:\Windows\System\muxxPPh.exe	9b88f2bb9c66b2500b57373fe6627440_NEIKI.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1508	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	1028	9b88f2bb9c66b2500b57373fe6627440_NEIKI.exe
Token: SeLockMemoryPrivilege	1028	9b88f2bb9c66b2500b57373fe6627440_NEIKI.exe
Token: SeDebugPrivilege	1508	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1028 wrote to memory of 1508	1028	9b88f2bb9c66b2500b57373fe6627440_NEIKI.exe	29
PID 1028 wrote to memory of 1508	1028	9b88f2bb9c66b2500b57373fe6627440_NEIKI.exe	29
PID 1028 wrote to memory of 1508	1028	9b88f2bb9c66b2500b57373fe6627440_NEIKI.exe	29
PID 1028 wrote to memory of 1732	1028	9b88f2bb9c66b2500b57373fe6627440_NEIKI.exe	30
PID 1028 wrote to memory of 1732	1028	9b88f2bb9c66b2500b57373fe6627440_NEIKI.exe	30
PID 1028 wrote to memory of 1732	1028	9b88f2bb9c66b2500b57373fe6627440_NEIKI.exe	30
PID 1028 wrote to memory of 2612	1028	9b88f2bb9c66b2500b57373fe6627440_NEIKI.exe	31
PID 1028 wrote to memory of 2612	1028	9b88f2bb9c66b2500b57373fe6627440_NEIKI.exe	31
PID 1028 wrote to memory of 2612	1028	9b88f2bb9c66b2500b57373fe6627440_NEIKI.exe	31
PID 1028 wrote to memory of 2360	1028	9b88f2bb9c66b2500b57373fe6627440_NEIKI.exe	32
PID 1028 wrote to memory of 2360	1028	9b88f2bb9c66b2500b57373fe6627440_NEIKI.exe	32
PID 1028 wrote to memory of 2360	1028	9b88f2bb9c66b2500b57373fe6627440_NEIKI.exe	32
PID 1028 wrote to memory of 2632	1028	9b88f2bb9c66b2500b57373fe6627440_NEIKI.exe	33
PID 1028 wrote to memory of 2632	1028	9b88f2bb9c66b2500b57373fe6627440_NEIKI.exe	33
PID 1028 wrote to memory of 2632	1028	9b88f2bb9c66b2500b57373fe6627440_NEIKI.exe	33
PID 1028 wrote to memory of 2816	1028	9b88f2bb9c66b2500b57373fe6627440_NEIKI.exe	34
PID 1028 wrote to memory of 2816	1028	9b88f2bb9c66b2500b57373fe6627440_NEIKI.exe	34
PID 1028 wrote to memory of 2816	1028	9b88f2bb9c66b2500b57373fe6627440_NEIKI.exe	34
PID 1028 wrote to memory of 2676	1028	9b88f2bb9c66b2500b57373fe6627440_NEIKI.exe	35
PID 1028 wrote to memory of 2676	1028	9b88f2bb9c66b2500b57373fe6627440_NEIKI.exe	35
PID 1028 wrote to memory of 2676	1028	9b88f2bb9c66b2500b57373fe6627440_NEIKI.exe	35
PID 1028 wrote to memory of 2784	1028	9b88f2bb9c66b2500b57373fe6627440_NEIKI.exe	36
PID 1028 wrote to memory of 2784	1028	9b88f2bb9c66b2500b57373fe6627440_NEIKI.exe	36
PID 1028 wrote to memory of 2784	1028	9b88f2bb9c66b2500b57373fe6627440_NEIKI.exe	36
PID 1028 wrote to memory of 2960	1028	9b88f2bb9c66b2500b57373fe6627440_NEIKI.exe	37
PID 1028 wrote to memory of 2960	1028	9b88f2bb9c66b2500b57373fe6627440_NEIKI.exe	37
PID 1028 wrote to memory of 2960	1028	9b88f2bb9c66b2500b57373fe6627440_NEIKI.exe	37
PID 1028 wrote to memory of 2684	1028	9b88f2bb9c66b2500b57373fe6627440_NEIKI.exe	38
PID 1028 wrote to memory of 2684	1028	9b88f2bb9c66b2500b57373fe6627440_NEIKI.exe	38
PID 1028 wrote to memory of 2684	1028	9b88f2bb9c66b2500b57373fe6627440_NEIKI.exe	38
PID 1028 wrote to memory of 2560	1028	9b88f2bb9c66b2500b57373fe6627440_NEIKI.exe	39
PID 1028 wrote to memory of 2560	1028	9b88f2bb9c66b2500b57373fe6627440_NEIKI.exe	39
PID 1028 wrote to memory of 2560	1028	9b88f2bb9c66b2500b57373fe6627440_NEIKI.exe	39
PID 1028 wrote to memory of 2568	1028	9b88f2bb9c66b2500b57373fe6627440_NEIKI.exe	40
PID 1028 wrote to memory of 2568	1028	9b88f2bb9c66b2500b57373fe6627440_NEIKI.exe	40
PID 1028 wrote to memory of 2568	1028	9b88f2bb9c66b2500b57373fe6627440_NEIKI.exe	40
PID 1028 wrote to memory of 2768	1028	9b88f2bb9c66b2500b57373fe6627440_NEIKI.exe	41
PID 1028 wrote to memory of 2768	1028	9b88f2bb9c66b2500b57373fe6627440_NEIKI.exe	41
PID 1028 wrote to memory of 2768	1028	9b88f2bb9c66b2500b57373fe6627440_NEIKI.exe	41
PID 1028 wrote to memory of 2532	1028	9b88f2bb9c66b2500b57373fe6627440_NEIKI.exe	42
PID 1028 wrote to memory of 2532	1028	9b88f2bb9c66b2500b57373fe6627440_NEIKI.exe	42
PID 1028 wrote to memory of 2532	1028	9b88f2bb9c66b2500b57373fe6627440_NEIKI.exe	42
PID 1028 wrote to memory of 2584	1028	9b88f2bb9c66b2500b57373fe6627440_NEIKI.exe	43
PID 1028 wrote to memory of 2584	1028	9b88f2bb9c66b2500b57373fe6627440_NEIKI.exe	43
PID 1028 wrote to memory of 2584	1028	9b88f2bb9c66b2500b57373fe6627440_NEIKI.exe	43
PID 1028 wrote to memory of 2692	1028	9b88f2bb9c66b2500b57373fe6627440_NEIKI.exe	44
PID 1028 wrote to memory of 2692	1028	9b88f2bb9c66b2500b57373fe6627440_NEIKI.exe	44
PID 1028 wrote to memory of 2692	1028	9b88f2bb9c66b2500b57373fe6627440_NEIKI.exe	44
PID 1028 wrote to memory of 2148	1028	9b88f2bb9c66b2500b57373fe6627440_NEIKI.exe	45
PID 1028 wrote to memory of 2148	1028	9b88f2bb9c66b2500b57373fe6627440_NEIKI.exe	45
PID 1028 wrote to memory of 2148	1028	9b88f2bb9c66b2500b57373fe6627440_NEIKI.exe	45
PID 1028 wrote to memory of 1984	1028	9b88f2bb9c66b2500b57373fe6627440_NEIKI.exe	46
PID 1028 wrote to memory of 1984	1028	9b88f2bb9c66b2500b57373fe6627440_NEIKI.exe	46
PID 1028 wrote to memory of 1984	1028	9b88f2bb9c66b2500b57373fe6627440_NEIKI.exe	46
PID 1028 wrote to memory of 2748	1028	9b88f2bb9c66b2500b57373fe6627440_NEIKI.exe	47
PID 1028 wrote to memory of 2748	1028	9b88f2bb9c66b2500b57373fe6627440_NEIKI.exe	47
PID 1028 wrote to memory of 2748	1028	9b88f2bb9c66b2500b57373fe6627440_NEIKI.exe	47
PID 1028 wrote to memory of 1964	1028	9b88f2bb9c66b2500b57373fe6627440_NEIKI.exe	48
PID 1028 wrote to memory of 1964	1028	9b88f2bb9c66b2500b57373fe6627440_NEIKI.exe	48
PID 1028 wrote to memory of 1964	1028	9b88f2bb9c66b2500b57373fe6627440_NEIKI.exe	48
PID 1028 wrote to memory of 544	1028	9b88f2bb9c66b2500b57373fe6627440_NEIKI.exe	49
PID 1028 wrote to memory of 544	1028	9b88f2bb9c66b2500b57373fe6627440_NEIKI.exe	49
PID 1028 wrote to memory of 544	1028	9b88f2bb9c66b2500b57373fe6627440_NEIKI.exe	49
PID 1028 wrote to memory of 800	1028	9b88f2bb9c66b2500b57373fe6627440_NEIKI.exe	50

C:\Users\Admin\AppData\Local\Temp\9b88f2bb9c66b2500b57373fe6627440_NEIKI.exe
"C:\Users\Admin\AppData\Local\Temp\9b88f2bb9c66b2500b57373fe6627440_NEIKI.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1028
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1508
- C:\Windows\System\MucHlIT.exe
  C:\Windows\System\MucHlIT.exe
  2⤵
  - Executes dropped EXE
  PID:1732
- C:\Windows\System\RrxgBSI.exe
  C:\Windows\System\RrxgBSI.exe
  2⤵
  - Executes dropped EXE
  PID:2612
- C:\Windows\System\xAcIiyV.exe
  C:\Windows\System\xAcIiyV.exe
  2⤵
  - Executes dropped EXE
  PID:2360
- C:\Windows\System\rzpXDzO.exe
  C:\Windows\System\rzpXDzO.exe
  2⤵
  - Executes dropped EXE
  PID:2632
- C:\Windows\System\AJjNXBx.exe
  C:\Windows\System\AJjNXBx.exe
  2⤵
  - Executes dropped EXE
  PID:2816
- C:\Windows\System\FOTQbTR.exe
  C:\Windows\System\FOTQbTR.exe
  2⤵
  - Executes dropped EXE
  PID:2676
- C:\Windows\System\WKvvxfx.exe
  C:\Windows\System\WKvvxfx.exe
  2⤵
  - Executes dropped EXE
  PID:2784
- C:\Windows\System\ujTMWjn.exe
  C:\Windows\System\ujTMWjn.exe
  2⤵
  - Executes dropped EXE
  PID:2960
- C:\Windows\System\tszWTZQ.exe
  C:\Windows\System\tszWTZQ.exe
  2⤵
  - Executes dropped EXE
  PID:2684
- C:\Windows\System\jShhqre.exe
  C:\Windows\System\jShhqre.exe
  2⤵
  - Executes dropped EXE
  PID:2560
- C:\Windows\System\AcwCriD.exe
  C:\Windows\System\AcwCriD.exe
  2⤵
  - Executes dropped EXE
  PID:2568
- C:\Windows\System\STKjeQM.exe
  C:\Windows\System\STKjeQM.exe
  2⤵
  - Executes dropped EXE
  PID:2768
- C:\Windows\System\fuFKxcV.exe
  C:\Windows\System\fuFKxcV.exe
  2⤵
  - Executes dropped EXE
  PID:2532
- C:\Windows\System\GRjKuOB.exe
  C:\Windows\System\GRjKuOB.exe
  2⤵
  - Executes dropped EXE
  PID:2584
- C:\Windows\System\EbaLNxX.exe
  C:\Windows\System\EbaLNxX.exe
  2⤵
  - Executes dropped EXE
  PID:2692
- C:\Windows\System\yvqtRiN.exe
  C:\Windows\System\yvqtRiN.exe
  2⤵
  - Executes dropped EXE
  PID:2148
- C:\Windows\System\nDrtDeP.exe
  C:\Windows\System\nDrtDeP.exe
  2⤵
  - Executes dropped EXE
  PID:1984
- C:\Windows\System\fwnHbsD.exe
  C:\Windows\System\fwnHbsD.exe
  2⤵
  - Executes dropped EXE
  PID:2748
- C:\Windows\System\FrDmOYw.exe
  C:\Windows\System\FrDmOYw.exe
  2⤵
  - Executes dropped EXE
  PID:1964
- C:\Windows\System\cyMxeBv.exe
  C:\Windows\System\cyMxeBv.exe
  2⤵
  - Executes dropped EXE
  PID:544
- C:\Windows\System\MQNwAUr.exe
  C:\Windows\System\MQNwAUr.exe
  2⤵
  - Executes dropped EXE
  PID:800
- C:\Windows\System\tjpehbw.exe
  C:\Windows\System\tjpehbw.exe
  2⤵
  - Executes dropped EXE
  PID:2920
- C:\Windows\System\UYSvMon.exe
  C:\Windows\System\UYSvMon.exe
  2⤵
  - Executes dropped EXE
  PID:2904
- C:\Windows\System\byXEiZT.exe
  C:\Windows\System\byXEiZT.exe
  2⤵
  - Executes dropped EXE
  PID:2004
- C:\Windows\System\SeTYjUL.exe
  C:\Windows\System\SeTYjUL.exe
  2⤵
  - Executes dropped EXE
  PID:1752
- C:\Windows\System\mRTSawc.exe
  C:\Windows\System\mRTSawc.exe
  2⤵
  - Executes dropped EXE
  PID:2140
- C:\Windows\System\jPshAPg.exe
  C:\Windows\System\jPshAPg.exe
  2⤵
  - Executes dropped EXE
  PID:2708
- C:\Windows\System\YEmAgSu.exe
  C:\Windows\System\YEmAgSu.exe
  2⤵
  - Executes dropped EXE
  PID:1064
- C:\Windows\System\WIRZAoC.exe
  C:\Windows\System\WIRZAoC.exe
  2⤵
  - Executes dropped EXE
  PID:768
- C:\Windows\System\BMGDjcn.exe
  C:\Windows\System\BMGDjcn.exe
  2⤵
  - Executes dropped EXE
  PID:1100
- C:\Windows\System\ZsJTnJO.exe
  C:\Windows\System\ZsJTnJO.exe
  2⤵
  - Executes dropped EXE
  PID:684
- C:\Windows\System\BSPWjPj.exe
  C:\Windows\System\BSPWjPj.exe
  2⤵
  - Executes dropped EXE
  PID:2476
- C:\Windows\System\kfuSJtW.exe
  C:\Windows\System\kfuSJtW.exe
  2⤵
  - Executes dropped EXE
  PID:1332
- C:\Windows\System\obYNXlq.exe
  C:\Windows\System\obYNXlq.exe
  2⤵
  - Executes dropped EXE
  PID:780
- C:\Windows\System\LLESLIV.exe
  C:\Windows\System\LLESLIV.exe
  2⤵
  - Executes dropped EXE
  PID:1648
- C:\Windows\System\CzryAkG.exe
  C:\Windows\System\CzryAkG.exe
  2⤵
  - Executes dropped EXE
  PID:1988
- C:\Windows\System\QYNqYIT.exe
  C:\Windows\System\QYNqYIT.exe
  2⤵
  - Executes dropped EXE
  PID:1156
- C:\Windows\System\heAGVMJ.exe
  C:\Windows\System\heAGVMJ.exe
  2⤵
  - Executes dropped EXE
  PID:1976
- C:\Windows\System\kmjhXDF.exe
  C:\Windows\System\kmjhXDF.exe
  2⤵
  - Executes dropped EXE
  PID:3016
- C:\Windows\System\ARzXrZL.exe
  C:\Windows\System\ARzXrZL.exe
  2⤵
  - Executes dropped EXE
  PID:1832
- C:\Windows\System\sypaSDv.exe
  C:\Windows\System\sypaSDv.exe
  2⤵
  - Executes dropped EXE
  PID:1620
- C:\Windows\System\BjsOdem.exe
  C:\Windows\System\BjsOdem.exe
  2⤵
  - Executes dropped EXE
  PID:2468
- C:\Windows\System\zeXvajw.exe
  C:\Windows\System\zeXvajw.exe
  2⤵
  - Executes dropped EXE
  PID:2996
- C:\Windows\System\yteIXID.exe
  C:\Windows\System\yteIXID.exe
  2⤵
  - Executes dropped EXE
  PID:2604
- C:\Windows\System\lAgjvtr.exe
  C:\Windows\System\lAgjvtr.exe
  2⤵
  - Executes dropped EXE
  PID:2152
- C:\Windows\System\ZnnYnlB.exe
  C:\Windows\System\ZnnYnlB.exe
  2⤵
  - Executes dropped EXE
  PID:2244
- C:\Windows\System\cVUkMgh.exe
  C:\Windows\System\cVUkMgh.exe
  2⤵
  - Executes dropped EXE
  PID:2956
- C:\Windows\System\pKFFZPc.exe
  C:\Windows\System\pKFFZPc.exe
  2⤵
  - Executes dropped EXE
  PID:1492
- C:\Windows\System\OwTMGVs.exe
  C:\Windows\System\OwTMGVs.exe
  2⤵
  - Executes dropped EXE
  PID:2188
- C:\Windows\System\FBgMQkI.exe
  C:\Windows\System\FBgMQkI.exe
  2⤵
  - Executes dropped EXE
  PID:1888
- C:\Windows\System\zcbyWAs.exe
  C:\Windows\System\zcbyWAs.exe
  2⤵
  - Executes dropped EXE
  PID:2256
- C:\Windows\System\ofBGgVH.exe
  C:\Windows\System\ofBGgVH.exe
  2⤵
  - Executes dropped EXE
  PID:1584
- C:\Windows\System\DHVfLFM.exe
  C:\Windows\System\DHVfLFM.exe
  2⤵
  - Executes dropped EXE
  PID:2792
- C:\Windows\System\tezpKCD.exe
  C:\Windows\System\tezpKCD.exe
  2⤵
  - Executes dropped EXE
  PID:2344
- C:\Windows\System\CissmwV.exe
  C:\Windows\System\CissmwV.exe
  2⤵
  - Executes dropped EXE
  PID:2552
- C:\Windows\System\oexoGvz.exe
  C:\Windows\System\oexoGvz.exe
  2⤵
  - Executes dropped EXE
  PID:2672
- C:\Windows\System\ogwhIhb.exe
  C:\Windows\System\ogwhIhb.exe
  2⤵
  - Executes dropped EXE
  PID:2840
- C:\Windows\System\WPKXfci.exe
  C:\Windows\System\WPKXfci.exe
  2⤵
  - Executes dropped EXE
  PID:2516
- C:\Windows\System\LjsrwxP.exe
  C:\Windows\System\LjsrwxP.exe
  2⤵
  - Executes dropped EXE
  PID:2264
- C:\Windows\System\mxaVMbr.exe
  C:\Windows\System\mxaVMbr.exe
  2⤵
  - Executes dropped EXE
  PID:1628
- C:\Windows\System\MQWaVqs.exe
  C:\Windows\System\MQWaVqs.exe
  2⤵
  - Executes dropped EXE
  PID:2588
- C:\Windows\System\JbHksQS.exe
  C:\Windows\System\JbHksQS.exe
  2⤵
  - Executes dropped EXE
  PID:2496
- C:\Windows\System\ZOFlViL.exe
  C:\Windows\System\ZOFlViL.exe
  2⤵
  - Executes dropped EXE
  PID:2744
- C:\Windows\System\MncAVpp.exe
  C:\Windows\System\MncAVpp.exe
  2⤵
  - Executes dropped EXE
  PID:2616
- C:\Windows\System\gNAmMvH.exe
  C:\Windows\System\gNAmMvH.exe
  2⤵
  PID:1624
- C:\Windows\System\OCpcceM.exe
  C:\Windows\System\OCpcceM.exe
  2⤵
  PID:1672
- C:\Windows\System\ROLSqkZ.exe
  C:\Windows\System\ROLSqkZ.exe
  2⤵
  PID:2832
- C:\Windows\System\mLtfVxk.exe
  C:\Windows\System\mLtfVxk.exe
  2⤵
  PID:2972
- C:\Windows\System\nyvUnvF.exe
  C:\Windows\System\nyvUnvF.exe
  2⤵
  PID:2872
- C:\Windows\System\ymsKLxU.exe
  C:\Windows\System\ymsKLxU.exe
  2⤵
  PID:2540
- C:\Windows\System\StnfPzu.exe
  C:\Windows\System\StnfPzu.exe
  2⤵
  PID:1516
- C:\Windows\System\kWLzxuu.exe
  C:\Windows\System\kWLzxuu.exe
  2⤵
  PID:548
- C:\Windows\System\yILpFfN.exe
  C:\Windows\System\yILpFfN.exe
  2⤵
  PID:444
- C:\Windows\System\QxKNQsA.exe
  C:\Windows\System\QxKNQsA.exe
  2⤵
  PID:2328
- C:\Windows\System\wfTtGgF.exe
  C:\Windows\System\wfTtGgF.exe
  2⤵
  PID:1528
- C:\Windows\System\OGdRMfc.exe
  C:\Windows\System\OGdRMfc.exe
  2⤵
  PID:1352
- C:\Windows\System\ovxawsa.exe
  C:\Windows\System\ovxawsa.exe
  2⤵
  PID:3008
- C:\Windows\System\yVrcBDE.exe
  C:\Windows\System\yVrcBDE.exe
  2⤵
  PID:1936
- C:\Windows\System\LJoUdeb.exe
  C:\Windows\System\LJoUdeb.exe
  2⤵
  PID:2368
- C:\Windows\System\StEQImI.exe
  C:\Windows\System\StEQImI.exe
  2⤵
  PID:2284
- C:\Windows\System\hHnLuLp.exe
  C:\Windows\System\hHnLuLp.exe
  2⤵
  PID:1944
- C:\Windows\System\oJhOFqo.exe
  C:\Windows\System\oJhOFqo.exe
  2⤵
  PID:2120
- C:\Windows\System\AAThnfP.exe
  C:\Windows\System\AAThnfP.exe
  2⤵
  PID:2944
- C:\Windows\System\TFPWwTP.exe
  C:\Windows\System\TFPWwTP.exe
  2⤵
  PID:2392
- C:\Windows\System\rjvxubj.exe
  C:\Windows\System\rjvxubj.exe
  2⤵
  PID:1968
- C:\Windows\System\wgHnNTW.exe
  C:\Windows\System\wgHnNTW.exe
  2⤵
  PID:2700
- C:\Windows\System\LxHmsOD.exe
  C:\Windows\System\LxHmsOD.exe
  2⤵
  PID:2984
- C:\Windows\System\SWZCoqs.exe
  C:\Windows\System\SWZCoqs.exe
  2⤵
  PID:2844
- C:\Windows\System\KhgnTdM.exe
  C:\Windows\System\KhgnTdM.exe
  2⤵
  PID:1632
- C:\Windows\System\lGDWBxR.exe
  C:\Windows\System\lGDWBxR.exe
  2⤵
  PID:2340
- C:\Windows\System\wVckjpd.exe
  C:\Windows\System\wVckjpd.exe
  2⤵
  PID:1636
- C:\Windows\System\jsrRkPK.exe
  C:\Windows\System\jsrRkPK.exe
  2⤵
  PID:1948
- C:\Windows\System\kTgrCvM.exe
  C:\Windows\System\kTgrCvM.exe
  2⤵
  PID:2688
- C:\Windows\System\lePMIPi.exe
  C:\Windows\System\lePMIPi.exe
  2⤵
  PID:2524
- C:\Windows\System\mvwPoUV.exe
  C:\Windows\System\mvwPoUV.exe
  2⤵
  PID:2856
- C:\Windows\System\NYPPIsz.exe
  C:\Windows\System\NYPPIsz.exe
  2⤵
  PID:2412
- C:\Windows\System\qTRQTqB.exe
  C:\Windows\System\qTRQTqB.exe
  2⤵
  PID:1316
- C:\Windows\System\QXTVzXW.exe
  C:\Windows\System\QXTVzXW.exe
  2⤵
  PID:2760
- C:\Windows\System\fOjQAxW.exe
  C:\Windows\System\fOjQAxW.exe
  2⤵
  PID:1668
- C:\Windows\System\jfyJizZ.exe
  C:\Windows\System\jfyJizZ.exe
  2⤵
  PID:1872
- C:\Windows\System\ZYLyjmi.exe
  C:\Windows\System\ZYLyjmi.exe
  2⤵
  PID:2764
- C:\Windows\System\YKwsAUB.exe
  C:\Windows\System\YKwsAUB.exe
  2⤵
  PID:1828
- C:\Windows\System\kPEFCmP.exe
  C:\Windows\System\kPEFCmP.exe
  2⤵
  PID:1088
- C:\Windows\System\ihzyKSM.exe
  C:\Windows\System\ihzyKSM.exe
  2⤵
  PID:1244
- C:\Windows\System\BoVyiVd.exe
  C:\Windows\System\BoVyiVd.exe
  2⤵
  PID:1768
- C:\Windows\System\fEzoKww.exe
  C:\Windows\System\fEzoKww.exe
  2⤵
  PID:1592
- C:\Windows\System\sExQsRV.exe
  C:\Windows\System\sExQsRV.exe
  2⤵
  PID:916
- C:\Windows\System\ayfOjeh.exe
  C:\Windows\System\ayfOjeh.exe
  2⤵
  PID:1164
- C:\Windows\System\TLkyivo.exe
  C:\Windows\System\TLkyivo.exe
  2⤵
  PID:1500
- C:\Windows\System\apgyrmz.exe
  C:\Windows\System\apgyrmz.exe
  2⤵
  PID:1572
- C:\Windows\System\xIxcczI.exe
  C:\Windows\System\xIxcczI.exe
  2⤵
  PID:2408
- C:\Windows\System\HjKlTPm.exe
  C:\Windows\System\HjKlTPm.exe
  2⤵
  PID:584
- C:\Windows\System\rFehFvb.exe
  C:\Windows\System\rFehFvb.exe
  2⤵
  PID:1052
- C:\Windows\System\WznnzkX.exe
  C:\Windows\System\WznnzkX.exe
  2⤵
  PID:1192
- C:\Windows\System\yXvMsJJ.exe
  C:\Windows\System\yXvMsJJ.exe
  2⤵
  PID:2796
- C:\Windows\System\OyzipDP.exe
  C:\Windows\System\OyzipDP.exe
  2⤵
  PID:2780
- C:\Windows\System\Dwthogf.exe
  C:\Windows\System\Dwthogf.exe
  2⤵
  PID:2732
- C:\Windows\System\unklCbq.exe
  C:\Windows\System\unklCbq.exe
  2⤵
  PID:1660
- C:\Windows\System\SuLfbeQ.exe
  C:\Windows\System\SuLfbeQ.exe
  2⤵
  PID:2068
- C:\Windows\System\nbQSgOV.exe
  C:\Windows\System\nbQSgOV.exe
  2⤵
  PID:1820
- C:\Windows\System\kJrVOBW.exe
  C:\Windows\System\kJrVOBW.exe
  2⤵
  PID:1712
- C:\Windows\System\boVRwxS.exe
  C:\Windows\System\boVRwxS.exe
  2⤵
  PID:1708
- C:\Windows\System\esSsyeX.exe
  C:\Windows\System\esSsyeX.exe
  2⤵
  PID:2620
- C:\Windows\System\KohPhAM.exe
  C:\Windows\System\KohPhAM.exe
  2⤵
  PID:2640
- C:\Windows\System\uJtQfSW.exe
  C:\Windows\System\uJtQfSW.exe
  2⤵
  PID:2660
- C:\Windows\System\ZXqBufQ.exe
  C:\Windows\System\ZXqBufQ.exe
  2⤵
  PID:2212
- C:\Windows\System\NBSLKfm.exe
  C:\Windows\System\NBSLKfm.exe
  2⤵
  PID:2928
- C:\Windows\System\FRyrtPU.exe
  C:\Windows\System\FRyrtPU.exe
  2⤵
  PID:2860
- C:\Windows\System\RwundhW.exe
  C:\Windows\System\RwundhW.exe
  2⤵
  PID:1764
- C:\Windows\System\OkYnYSa.exe
  C:\Windows\System\OkYnYSa.exe
  2⤵
  PID:2912
- C:\Windows\System\MmivHcw.exe
  C:\Windows\System\MmivHcw.exe
  2⤵
  PID:468
- C:\Windows\System\STTVblz.exe
  C:\Windows\System\STTVblz.exe
  2⤵
  PID:2040
- C:\Windows\System\RqbuYhK.exe
  C:\Windows\System\RqbuYhK.exe
  2⤵
  PID:2820
- C:\Windows\System\MqLHxTT.exe
  C:\Windows\System\MqLHxTT.exe
  2⤵
  PID:1412
- C:\Windows\System\HlAMZZS.exe
  C:\Windows\System\HlAMZZS.exe
  2⤵
  PID:872
- C:\Windows\System\iLeKwhU.exe
  C:\Windows\System\iLeKwhU.exe
  2⤵
  PID:280
- C:\Windows\System\kBFKPch.exe
  C:\Windows\System\kBFKPch.exe
  2⤵
  PID:572
- C:\Windows\System\IKiJArd.exe
  C:\Windows\System\IKiJArd.exe
  2⤵
  PID:2080
- C:\Windows\System\blngqip.exe
  C:\Windows\System\blngqip.exe
  2⤵
  PID:752
- C:\Windows\System\OhMcxYX.exe
  C:\Windows\System\OhMcxYX.exe
  2⤵
  PID:1536
- C:\Windows\System\xYpBXIg.exe
  C:\Windows\System\xYpBXIg.exe
  2⤵
  PID:2168
- C:\Windows\System\MudXXzU.exe
  C:\Windows\System\MudXXzU.exe
  2⤵
  PID:1276
- C:\Windows\System\bIYPgqS.exe
  C:\Windows\System\bIYPgqS.exe
  2⤵
  PID:1264
- C:\Windows\System\ZaSSYee.exe
  C:\Windows\System\ZaSSYee.exe
  2⤵
  PID:380
- C:\Windows\System\IIyityQ.exe
  C:\Windows\System\IIyityQ.exe
  2⤵
  PID:1260
- C:\Windows\System\FAQotxI.exe
  C:\Windows\System\FAQotxI.exe
  2⤵
  PID:3000
- C:\Windows\System\mNHPdTF.exe
  C:\Windows\System\mNHPdTF.exe
  2⤵
  PID:2156
- C:\Windows\System\ohwsIWW.exe
  C:\Windows\System\ohwsIWW.exe
  2⤵
  PID:2720
- C:\Windows\System\dTBFurF.exe
  C:\Windows\System\dTBFurF.exe
  2⤵
  PID:1836
- C:\Windows\System\IhDOlGd.exe
  C:\Windows\System\IhDOlGd.exe
  2⤵
  PID:1736
- C:\Windows\System\njXvnYw.exe
  C:\Windows\System\njXvnYw.exe
  2⤵
  PID:2736
- C:\Windows\System\ARkEzfb.exe
  C:\Windows\System\ARkEzfb.exe
  2⤵
  PID:1012
- C:\Windows\System\fcorDpx.exe
  C:\Windows\System\fcorDpx.exe
  2⤵
  PID:2292
- C:\Windows\System\HdUuhKk.exe
  C:\Windows\System\HdUuhKk.exe
  2⤵
  PID:1228
- C:\Windows\System\JpMLIyL.exe
  C:\Windows\System\JpMLIyL.exe
  2⤵
  PID:696
- C:\Windows\System\PGLIjna.exe
  C:\Windows\System\PGLIjna.exe
  2⤵
  PID:948
- C:\Windows\System\OpmpAFw.exe
  C:\Windows\System\OpmpAFw.exe
  2⤵
  PID:2740
- C:\Windows\System\qkrrLWW.exe
  C:\Windows\System\qkrrLWW.exe
  2⤵
  PID:1720
- C:\Windows\System\ELwZEKg.exe
  C:\Windows\System\ELwZEKg.exe
  2⤵
  PID:1676
- C:\Windows\System\UVPTnyF.exe
  C:\Windows\System\UVPTnyF.exe
  2⤵
  PID:2028
- C:\Windows\System\iSSEgtJ.exe
  C:\Windows\System\iSSEgtJ.exe
  2⤵
  PID:1152
- C:\Windows\System\klzEIqu.exe
  C:\Windows\System\klzEIqu.exe
  2⤵
  PID:3080
- C:\Windows\System\yEHZZnp.exe
  C:\Windows\System\yEHZZnp.exe
  2⤵
  PID:3096
- C:\Windows\System\OEomYcE.exe
  C:\Windows\System\OEomYcE.exe
  2⤵
  PID:3112
- C:\Windows\System\UQdLfZC.exe
  C:\Windows\System\UQdLfZC.exe
  2⤵
  PID:3128
- C:\Windows\System\FaqnGOY.exe
  C:\Windows\System\FaqnGOY.exe
  2⤵
  PID:3144
- C:\Windows\System\OBHXNoK.exe
  C:\Windows\System\OBHXNoK.exe
  2⤵
  PID:3160
- C:\Windows\System\XoqFukf.exe
  C:\Windows\System\XoqFukf.exe
  2⤵
  PID:3176
- C:\Windows\System\MvsspFY.exe
  C:\Windows\System\MvsspFY.exe
  2⤵
  PID:3192
- C:\Windows\System\pxFBtPb.exe
  C:\Windows\System\pxFBtPb.exe
  2⤵
  PID:3208
- C:\Windows\System\dFTtikN.exe
  C:\Windows\System\dFTtikN.exe
  2⤵
  PID:3224
- C:\Windows\System\bfePGqn.exe
  C:\Windows\System\bfePGqn.exe
  2⤵
  PID:3240
- C:\Windows\System\jBIVGOo.exe
  C:\Windows\System\jBIVGOo.exe
  2⤵
  PID:3256
- C:\Windows\System\ogbKbhE.exe
  C:\Windows\System\ogbKbhE.exe
  2⤵
  PID:3272
- C:\Windows\System\HPIWvol.exe
  C:\Windows\System\HPIWvol.exe
  2⤵
  PID:3288
- C:\Windows\System\jiyWVEH.exe
  C:\Windows\System\jiyWVEH.exe
  2⤵
  PID:3304
- C:\Windows\System\labTLwF.exe
  C:\Windows\System\labTLwF.exe
  2⤵
  PID:3320
- C:\Windows\System\yrBFLhD.exe
  C:\Windows\System\yrBFLhD.exe
  2⤵
  PID:3336
- C:\Windows\System\khzGXjo.exe
  C:\Windows\System\khzGXjo.exe
  2⤵
  PID:3352
- C:\Windows\System\lqzTBsC.exe
  C:\Windows\System\lqzTBsC.exe
  2⤵
  PID:3368
- C:\Windows\System\HwVAvkY.exe
  C:\Windows\System\HwVAvkY.exe
  2⤵
  PID:3384
- C:\Windows\System\ZJLalcs.exe
  C:\Windows\System\ZJLalcs.exe
  2⤵
  PID:3400
- C:\Windows\System\PyrQsbr.exe
  C:\Windows\System\PyrQsbr.exe
  2⤵
  PID:3416
- C:\Windows\System\BoSgHqd.exe
  C:\Windows\System\BoSgHqd.exe
  2⤵
  PID:3432
- C:\Windows\System\qeLmHoR.exe
  C:\Windows\System\qeLmHoR.exe
  2⤵
  PID:3448
- C:\Windows\System\yLnHnPc.exe
  C:\Windows\System\yLnHnPc.exe
  2⤵
  PID:3464
- C:\Windows\System\ZPYEpJR.exe
  C:\Windows\System\ZPYEpJR.exe
  2⤵
  PID:3480
- C:\Windows\System\aoRbazW.exe
  C:\Windows\System\aoRbazW.exe
  2⤵
  PID:3496
- C:\Windows\System\HUwyGEr.exe
  C:\Windows\System\HUwyGEr.exe
  2⤵
  PID:3512
- C:\Windows\System\zgThPVx.exe
  C:\Windows\System\zgThPVx.exe
  2⤵
  PID:3528
- C:\Windows\System\NCFbOSl.exe
  C:\Windows\System\NCFbOSl.exe
  2⤵
  PID:3544
- C:\Windows\System\JhVFOFd.exe
  C:\Windows\System\JhVFOFd.exe
  2⤵
  PID:3560
- C:\Windows\System\PxamORS.exe
  C:\Windows\System\PxamORS.exe
  2⤵
  PID:3576
- C:\Windows\System\hIbHmXW.exe
  C:\Windows\System\hIbHmXW.exe
  2⤵
  PID:3592
- C:\Windows\System\TtdwlUo.exe
  C:\Windows\System\TtdwlUo.exe
  2⤵
  PID:3608
- C:\Windows\System\YIQIcoy.exe
  C:\Windows\System\YIQIcoy.exe
  2⤵
  PID:3624
- C:\Windows\System\qVsoDUV.exe
  C:\Windows\System\qVsoDUV.exe
  2⤵
  PID:3640
- C:\Windows\System\bqUxbzH.exe
  C:\Windows\System\bqUxbzH.exe
  2⤵
  PID:3656
- C:\Windows\System\tpgnFLL.exe
  C:\Windows\System\tpgnFLL.exe
  2⤵
  PID:3672
- C:\Windows\System\qLCkIxU.exe
  C:\Windows\System\qLCkIxU.exe
  2⤵
  PID:3688
- C:\Windows\System\THJkQIi.exe
  C:\Windows\System\THJkQIi.exe
  2⤵
  PID:3704
- C:\Windows\System\bRLlZOb.exe
  C:\Windows\System\bRLlZOb.exe
  2⤵
  PID:3720
- C:\Windows\System\VdHafiI.exe
  C:\Windows\System\VdHafiI.exe
  2⤵
  PID:3736
- C:\Windows\System\ghcJecz.exe
  C:\Windows\System\ghcJecz.exe
  2⤵
  PID:3752
- C:\Windows\System\pDFnbKQ.exe
  C:\Windows\System\pDFnbKQ.exe
  2⤵
  PID:3768
- C:\Windows\System\DztUYNk.exe
  C:\Windows\System\DztUYNk.exe
  2⤵
  PID:3784
- C:\Windows\System\YkekzhH.exe
  C:\Windows\System\YkekzhH.exe
  2⤵
  PID:3800
- C:\Windows\System\PNFQmMa.exe
  C:\Windows\System\PNFQmMa.exe
  2⤵
  PID:3816
- C:\Windows\System\paODeMj.exe
  C:\Windows\System\paODeMj.exe
  2⤵
  PID:3832
- C:\Windows\System\NxGnxMu.exe
  C:\Windows\System\NxGnxMu.exe
  2⤵
  PID:3848
- C:\Windows\System\XfIlhPJ.exe
  C:\Windows\System\XfIlhPJ.exe
  2⤵
  PID:3864
- C:\Windows\System\OVzUwZm.exe
  C:\Windows\System\OVzUwZm.exe
  2⤵
  PID:3880
- C:\Windows\System\qTnNHLR.exe
  C:\Windows\System\qTnNHLR.exe
  2⤵
  PID:3896
- C:\Windows\System\xbsqvAD.exe
  C:\Windows\System\xbsqvAD.exe
  2⤵
  PID:3912
- C:\Windows\System\JaApubd.exe
  C:\Windows\System\JaApubd.exe
  2⤵
  PID:3928
- C:\Windows\System\VXzlHJI.exe
  C:\Windows\System\VXzlHJI.exe
  2⤵
  PID:3944
- C:\Windows\System\xnRRNza.exe
  C:\Windows\System\xnRRNza.exe
  2⤵
  PID:3960
- C:\Windows\System\AMwBiEp.exe
  C:\Windows\System\AMwBiEp.exe
  2⤵
  PID:3976
- C:\Windows\System\BoQtRdR.exe
  C:\Windows\System\BoQtRdR.exe
  2⤵
  PID:3992
- C:\Windows\System\oYlAtxF.exe
  C:\Windows\System\oYlAtxF.exe
  2⤵
  PID:4008
- C:\Windows\System\yBtuYNC.exe
  C:\Windows\System\yBtuYNC.exe
  2⤵
  PID:4024
- C:\Windows\System\cwNfizm.exe
  C:\Windows\System\cwNfizm.exe
  2⤵
  PID:4040
- C:\Windows\System\sQGsLOz.exe
  C:\Windows\System\sQGsLOz.exe
  2⤵
  PID:4056
- C:\Windows\System\StoPecV.exe
  C:\Windows\System\StoPecV.exe
  2⤵
  PID:4072
- C:\Windows\System\GfVlgmN.exe
  C:\Windows\System\GfVlgmN.exe
  2⤵
  PID:4088
- C:\Windows\System\ezCXyGf.exe
  C:\Windows\System\ezCXyGf.exe
  2⤵
  PID:2756
- C:\Windows\System\IkSdwZn.exe
  C:\Windows\System\IkSdwZn.exe
  2⤵
  PID:2704
- C:\Windows\System\mpIwoMv.exe
  C:\Windows\System\mpIwoMv.exe
  2⤵
  PID:2260
- C:\Windows\System\PyLWAAV.exe
  C:\Windows\System\PyLWAAV.exe
  2⤵
  PID:3184
- C:\Windows\System\qryYEoA.exe
  C:\Windows\System\qryYEoA.exe
  2⤵
  PID:3232
- C:\Windows\System\sIsPbJR.exe
  C:\Windows\System\sIsPbJR.exe
  2⤵
  PID:3264
- C:\Windows\System\vhuPLav.exe
  C:\Windows\System\vhuPLav.exe
  2⤵
  PID:3268
- C:\Windows\System\bfZjAJz.exe
  C:\Windows\System\bfZjAJz.exe
  2⤵
  PID:3312
- C:\Windows\System\aYMnIiN.exe
  C:\Windows\System\aYMnIiN.exe
  2⤵
  PID:3360
- C:\Windows\System\YBpZCEa.exe
  C:\Windows\System\YBpZCEa.exe
  2⤵
  PID:3376
- C:\Windows\System\aNwgIpw.exe
  C:\Windows\System\aNwgIpw.exe
  2⤵
  PID:3424
- C:\Windows\System\GtQQzSN.exe
  C:\Windows\System\GtQQzSN.exe
  2⤵
  PID:3456
- C:\Windows\System\kLooFDq.exe
  C:\Windows\System\kLooFDq.exe
  2⤵
  PID:3472
- C:\Windows\System\fDNmNhJ.exe
  C:\Windows\System\fDNmNhJ.exe
  2⤵
  PID:3520
- C:\Windows\System\XRbmlWW.exe
  C:\Windows\System\XRbmlWW.exe
  2⤵
  PID:3536
- C:\Windows\System\EbfjcLg.exe
  C:\Windows\System\EbfjcLg.exe
  2⤵
  PID:3584
- C:\Windows\System\aSLHozK.exe
  C:\Windows\System\aSLHozK.exe
  2⤵
  PID:3600
- C:\Windows\System\YFYnnRh.exe
  C:\Windows\System\YFYnnRh.exe
  2⤵
  PID:2824
- C:\Windows\System\Smdpcgq.exe
  C:\Windows\System\Smdpcgq.exe
  2⤵
  PID:3636
- C:\Windows\System\JTZdakr.exe
  C:\Windows\System\JTZdakr.exe
  2⤵
  PID:3668
- C:\Windows\System\kjTxTXX.exe
  C:\Windows\System\kjTxTXX.exe
  2⤵
  PID:3700
- C:\Windows\System\xSOLMKu.exe
  C:\Windows\System\xSOLMKu.exe
  2⤵
  PID:3748
- C:\Windows\System\qrtFEan.exe
  C:\Windows\System\qrtFEan.exe
  2⤵
  PID:3764
- C:\Windows\System\xsWBXig.exe
  C:\Windows\System\xsWBXig.exe
  2⤵
  PID:3796
- C:\Windows\System\VYKQnWh.exe
  C:\Windows\System\VYKQnWh.exe
  2⤵
  PID:3844
- C:\Windows\System\eKuEJjJ.exe
  C:\Windows\System\eKuEJjJ.exe
  2⤵
  PID:3876
- C:\Windows\System\wYEMORo.exe
  C:\Windows\System\wYEMORo.exe
  2⤵
  PID:3936
- C:\Windows\System\PSXPmJW.exe
  C:\Windows\System\PSXPmJW.exe
  2⤵
  PID:3892
- C:\Windows\System\FqNeQZH.exe
  C:\Windows\System\FqNeQZH.exe
  2⤵
  PID:4004
- C:\Windows\System\fLrpNDk.exe
  C:\Windows\System\fLrpNDk.exe
  2⤵
  PID:3988
- C:\Windows\System\JUMDkol.exe
  C:\Windows\System\JUMDkol.exe
  2⤵
  PID:3952
- C:\Windows\System\HVAmGoC.exe
  C:\Windows\System\HVAmGoC.exe
  2⤵
  PID:2876
- C:\Windows\System\nybywRQ.exe
  C:\Windows\System\nybywRQ.exe
  2⤵
  PID:2908
- C:\Windows\System\MTFMtAP.exe
  C:\Windows\System\MTFMtAP.exe
  2⤵
  PID:4052
- C:\Windows\System\iyPtEiF.exe
  C:\Windows\System\iyPtEiF.exe
  2⤵
  PID:2628
- C:\Windows\System\bXsCLMn.exe
  C:\Windows\System\bXsCLMn.exe
  2⤵
  PID:3136
- C:\Windows\System\fIbAIpn.exe
  C:\Windows\System\fIbAIpn.exe
  2⤵
  PID:3680
- C:\Windows\System\EqaHhKs.exe
  C:\Windows\System\EqaHhKs.exe
  2⤵
  PID:3808
- C:\Windows\System\ayqiCKd.exe
  C:\Windows\System\ayqiCKd.exe
  2⤵
  PID:1400
- C:\Windows\System\jRrRcDD.exe
  C:\Windows\System\jRrRcDD.exe
  2⤵
  PID:3956
- C:\Windows\System\GgsUTxk.exe
  C:\Windows\System\GgsUTxk.exe
  2⤵
  PID:3108
- C:\Windows\System\usnJVSZ.exe
  C:\Windows\System\usnJVSZ.exe
  2⤵
  PID:2104
- C:\Windows\System\zFaopDf.exe
  C:\Windows\System\zFaopDf.exe
  2⤵
  PID:4068
- C:\Windows\System\cwZKNkz.exe
  C:\Windows\System\cwZKNkz.exe
  2⤵
  PID:3204
- C:\Windows\System\DtrqAns.exe
  C:\Windows\System\DtrqAns.exe
  2⤵
  PID:3380
- C:\Windows\System\aEKKJrL.exe
  C:\Windows\System\aEKKJrL.exe
  2⤵
  PID:3504
- C:\Windows\System\kqoOoKv.exe
  C:\Windows\System\kqoOoKv.exe
  2⤵
  PID:3648
- C:\Windows\System\SrhynBa.exe
  C:\Windows\System\SrhynBa.exe
  2⤵
  PID:3776
- C:\Windows\System\sONYncF.exe
  C:\Windows\System\sONYncF.exe
  2⤵
  PID:4000
- C:\Windows\System\rBgKFDT.exe
  C:\Windows\System\rBgKFDT.exe
  2⤵
  PID:2600
- C:\Windows\System\xmVOTeb.exe
  C:\Windows\System\xmVOTeb.exe
  2⤵
  PID:3168
- C:\Windows\System\SVqUJsL.exe
  C:\Windows\System\SVqUJsL.exe
  2⤵
  PID:1596
- C:\Windows\System\riEwFsq.exe
  C:\Windows\System\riEwFsq.exe
  2⤵
  PID:812
- C:\Windows\System\nsYsfCW.exe
  C:\Windows\System\nsYsfCW.exe
  2⤵
  PID:3040
- C:\Windows\System\WTGarMz.exe
  C:\Windows\System\WTGarMz.exe
  2⤵
  PID:3092
- C:\Windows\System\JcFlzpH.exe
  C:\Windows\System\JcFlzpH.exe
  2⤵
  PID:3300
- C:\Windows\System\kEJUpjk.exe
  C:\Windows\System\kEJUpjk.exe
  2⤵
  PID:3428
- C:\Windows\System\YBoXbYY.exe
  C:\Windows\System\YBoXbYY.exe
  2⤵
  PID:3540
- C:\Windows\System\WqEWXvp.exe
  C:\Windows\System\WqEWXvp.exe
  2⤵
  PID:3872
- C:\Windows\System\WFIIddm.exe
  C:\Windows\System\WFIIddm.exe
  2⤵
  PID:3920
- C:\Windows\System\fzphkPO.exe
  C:\Windows\System\fzphkPO.exe
  2⤵
  PID:4064
- C:\Windows\System\cpHsCNj.exe
  C:\Windows\System\cpHsCNj.exe
  2⤵
  PID:1544
- C:\Windows\System\jLArLvQ.exe
  C:\Windows\System\jLArLvQ.exe
  2⤵
  PID:3572
- C:\Windows\System\kceIrzk.exe
  C:\Windows\System\kceIrzk.exe
  2⤵
  PID:3152
- C:\Windows\System\MbaWRyK.exe
  C:\Windows\System\MbaWRyK.exe
  2⤵
  PID:3032
- C:\Windows\System\pvVdsEb.exe
  C:\Windows\System\pvVdsEb.exe
  2⤵
  PID:3712
- C:\Windows\System\kfmIkrm.exe
  C:\Windows\System\kfmIkrm.exe
  2⤵
  PID:3060
- C:\Windows\System\VLyCKYt.exe
  C:\Windows\System\VLyCKYt.exe
  2⤵
  PID:3732
- C:\Windows\System\JZcWIgo.exe
  C:\Windows\System\JZcWIgo.exe
  2⤵
  PID:3588
- C:\Windows\System\orXwEsQ.exe
  C:\Windows\System\orXwEsQ.exe
  2⤵
  PID:4048
- C:\Windows\System\ilWVFVO.exe
  C:\Windows\System\ilWVFVO.exe
  2⤵
  PID:3140
- C:\Windows\System\kopcJKe.exe
  C:\Windows\System\kopcJKe.exe
  2⤵
  PID:3556
- C:\Windows\System\KlrcNCp.exe
  C:\Windows\System\KlrcNCp.exe
  2⤵
  PID:4036
- C:\Windows\System\bjfBWoe.exe
  C:\Windows\System\bjfBWoe.exe
  2⤵
  PID:3316
- C:\Windows\System\lQboZvS.exe
  C:\Windows\System\lQboZvS.exe
  2⤵
  PID:3460
- C:\Windows\System\NooOVed.exe
  C:\Windows\System\NooOVed.exe
  2⤵
  PID:4104
- C:\Windows\System\wDbrbMc.exe
  C:\Windows\System\wDbrbMc.exe
  2⤵
  PID:4120
- C:\Windows\System\MrIXKXl.exe
  C:\Windows\System\MrIXKXl.exe
  2⤵
  PID:4136
- C:\Windows\System\aKbhOAX.exe
  C:\Windows\System\aKbhOAX.exe
  2⤵
  PID:4152
- C:\Windows\System\MCVwQlP.exe
  C:\Windows\System\MCVwQlP.exe
  2⤵
  PID:4168
- C:\Windows\System\wkWRjNH.exe
  C:\Windows\System\wkWRjNH.exe
  2⤵
  PID:4188
- C:\Windows\System\crwMkFY.exe
  C:\Windows\System\crwMkFY.exe
  2⤵
  PID:4204
- C:\Windows\System\DvCCnHT.exe
  C:\Windows\System\DvCCnHT.exe
  2⤵
  PID:4220
- C:\Windows\System\LURvOdo.exe
  C:\Windows\System\LURvOdo.exe
  2⤵
  PID:4236
- C:\Windows\System\NSWKhsa.exe
  C:\Windows\System\NSWKhsa.exe
  2⤵
  PID:4252
- C:\Windows\System\IsmoDAh.exe
  C:\Windows\System\IsmoDAh.exe
  2⤵
  PID:4268
- C:\Windows\System\eogFlvc.exe
  C:\Windows\System\eogFlvc.exe
  2⤵
  PID:4284
- C:\Windows\System\FzStCDL.exe
  C:\Windows\System\FzStCDL.exe
  2⤵
  PID:4300
- C:\Windows\System\zEhRYRn.exe
  C:\Windows\System\zEhRYRn.exe
  2⤵
  PID:4316
- C:\Windows\System\LigkqXU.exe
  C:\Windows\System\LigkqXU.exe
  2⤵
  PID:4332
- C:\Windows\System\zJFnpeu.exe
  C:\Windows\System\zJFnpeu.exe
  2⤵
  PID:4348
- C:\Windows\System\PieQIwg.exe
  C:\Windows\System\PieQIwg.exe
  2⤵
  PID:4364
- C:\Windows\System\xEChPcp.exe
  C:\Windows\System\xEChPcp.exe
  2⤵
  PID:4380
- C:\Windows\System\SUjNDsn.exe
  C:\Windows\System\SUjNDsn.exe
  2⤵
  PID:4396
- C:\Windows\System\gKiQrTu.exe
  C:\Windows\System\gKiQrTu.exe
  2⤵
  PID:4412
- C:\Windows\System\HbcwRSx.exe
  C:\Windows\System\HbcwRSx.exe
  2⤵
  PID:4428
- C:\Windows\System\dUuowYV.exe
  C:\Windows\System\dUuowYV.exe
  2⤵
  PID:4444
- C:\Windows\System\hTUgNaH.exe
  C:\Windows\System\hTUgNaH.exe
  2⤵
  PID:4460
- C:\Windows\System\mMkozeg.exe
  C:\Windows\System\mMkozeg.exe
  2⤵
  PID:4476
- C:\Windows\System\aTEPLwL.exe
  C:\Windows\System\aTEPLwL.exe
  2⤵
  PID:4492
- C:\Windows\System\kyttcKy.exe
  C:\Windows\System\kyttcKy.exe
  2⤵
  PID:4508
- C:\Windows\System\QTLBfVl.exe
  C:\Windows\System\QTLBfVl.exe
  2⤵
  PID:4524
- C:\Windows\System\hTGbJrF.exe
  C:\Windows\System\hTGbJrF.exe
  2⤵
  PID:4540
- C:\Windows\System\gLHCvkl.exe
  C:\Windows\System\gLHCvkl.exe
  2⤵
  PID:4556
- C:\Windows\System\bNZLSpz.exe
  C:\Windows\System\bNZLSpz.exe
  2⤵
  PID:4572
- C:\Windows\System\TxAaVOL.exe
  C:\Windows\System\TxAaVOL.exe
  2⤵
  PID:4588
- C:\Windows\System\XKSEsUH.exe
  C:\Windows\System\XKSEsUH.exe
  2⤵
  PID:4604
- C:\Windows\System\mkVwfqs.exe
  C:\Windows\System\mkVwfqs.exe
  2⤵
  PID:4620
- C:\Windows\System\QvMKraU.exe
  C:\Windows\System\QvMKraU.exe
  2⤵
  PID:4636
- C:\Windows\System\llgmRLT.exe
  C:\Windows\System\llgmRLT.exe
  2⤵
  PID:4652
- C:\Windows\System\RmaHwML.exe
  C:\Windows\System\RmaHwML.exe
  2⤵
  PID:4668
- C:\Windows\System\BSmqbQI.exe
  C:\Windows\System\BSmqbQI.exe
  2⤵
  PID:4684
- C:\Windows\System\KRjKmtX.exe
  C:\Windows\System\KRjKmtX.exe
  2⤵
  PID:4700
- C:\Windows\System\zNoPjZA.exe
  C:\Windows\System\zNoPjZA.exe
  2⤵
  PID:4716
- C:\Windows\System\tTAFhOb.exe
  C:\Windows\System\tTAFhOb.exe
  2⤵
  PID:4732
- C:\Windows\System\NiQYANz.exe
  C:\Windows\System\NiQYANz.exe
  2⤵
  PID:4748
- C:\Windows\System\TZSAynR.exe
  C:\Windows\System\TZSAynR.exe
  2⤵
  PID:4764
- C:\Windows\System\fIRSfnT.exe
  C:\Windows\System\fIRSfnT.exe
  2⤵
  PID:4780
- C:\Windows\System\xqlnpkZ.exe
  C:\Windows\System\xqlnpkZ.exe
  2⤵
  PID:4796
- C:\Windows\System\BdfCYsc.exe
  C:\Windows\System\BdfCYsc.exe
  2⤵
  PID:4812
- C:\Windows\System\QkqXEua.exe
  C:\Windows\System\QkqXEua.exe
  2⤵
  PID:4828
- C:\Windows\System\CtgJHwN.exe
  C:\Windows\System\CtgJHwN.exe
  2⤵
  PID:4844
- C:\Windows\System\WlaCDXV.exe
  C:\Windows\System\WlaCDXV.exe
  2⤵
  PID:4860
- C:\Windows\System\RKQtTaQ.exe
  C:\Windows\System\RKQtTaQ.exe
  2⤵
  PID:4876
- C:\Windows\System\HwfcRWa.exe
  C:\Windows\System\HwfcRWa.exe
  2⤵
  PID:4892
- C:\Windows\System\eviXbba.exe
  C:\Windows\System\eviXbba.exe
  2⤵
  PID:4908
- C:\Windows\System\rwRShfs.exe
  C:\Windows\System\rwRShfs.exe
  2⤵
  PID:4924
- C:\Windows\System\jauVyJo.exe
  C:\Windows\System\jauVyJo.exe
  2⤵
  PID:4940
- C:\Windows\System\VRlkBaE.exe
  C:\Windows\System\VRlkBaE.exe
  2⤵
  PID:4956
- C:\Windows\System\ZpBtNIN.exe
  C:\Windows\System\ZpBtNIN.exe
  2⤵
  PID:4972
- C:\Windows\System\mFGiOhl.exe
  C:\Windows\System\mFGiOhl.exe
  2⤵
  PID:4988
- C:\Windows\System\aaslqNY.exe
  C:\Windows\System\aaslqNY.exe
  2⤵
  PID:5004
- C:\Windows\System\UPROAKj.exe
  C:\Windows\System\UPROAKj.exe
  2⤵
  PID:5020
- C:\Windows\System\FWUSByf.exe
  C:\Windows\System\FWUSByf.exe
  2⤵
  PID:5036
- C:\Windows\System\VUSaVIX.exe
  C:\Windows\System\VUSaVIX.exe
  2⤵
  PID:5052
- C:\Windows\System\iNqXeHC.exe
  C:\Windows\System\iNqXeHC.exe
  2⤵
  PID:5068
- C:\Windows\System\NpqEaXf.exe
  C:\Windows\System\NpqEaXf.exe
  2⤵
  PID:5084
- C:\Windows\System\tXhFIpY.exe
  C:\Windows\System\tXhFIpY.exe
  2⤵
  PID:5100
- C:\Windows\System\SAwNikw.exe
  C:\Windows\System\SAwNikw.exe
  2⤵
  PID:5116
- C:\Windows\System\DhsoErH.exe
  C:\Windows\System\DhsoErH.exe
  2⤵
  PID:3052
- C:\Windows\System\islAAfi.exe
  C:\Windows\System\islAAfi.exe
  2⤵
  PID:3236
- C:\Windows\System\xUlxylt.exe
  C:\Windows\System\xUlxylt.exe
  2⤵
  PID:4116
- C:\Windows\System\EBEoBjm.exe
  C:\Windows\System\EBEoBjm.exe
  2⤵
  PID:348
- C:\Windows\System\lZsHPhy.exe
  C:\Windows\System\lZsHPhy.exe
  2⤵
  PID:2020
- C:\Windows\System\yARLOQS.exe
  C:\Windows\System\yARLOQS.exe
  2⤵
  PID:4180
- C:\Windows\System\jdtVWQC.exe
  C:\Windows\System\jdtVWQC.exe
  2⤵
  PID:4216
- C:\Windows\System\OdoMUAL.exe
  C:\Windows\System\OdoMUAL.exe
  2⤵
  PID:4248
- C:\Windows\System\kAWkkXs.exe
  C:\Windows\System\kAWkkXs.exe
  2⤵
  PID:4292
- C:\Windows\System\PujBVsA.exe
  C:\Windows\System\PujBVsA.exe
  2⤵
  PID:4296
- C:\Windows\System\oOlmJoo.exe
  C:\Windows\System\oOlmJoo.exe
  2⤵
  PID:4372
- C:\Windows\System\VMDaIZe.exe
  C:\Windows\System\VMDaIZe.exe
  2⤵
  PID:4376
- C:\Windows\System\yuJnRaC.exe
  C:\Windows\System\yuJnRaC.exe
  2⤵
  PID:4440
- C:\Windows\System\MnYKaIU.exe
  C:\Windows\System\MnYKaIU.exe
  2⤵
  PID:4388
- C:\Windows\System\bezsEfE.exe
  C:\Windows\System\bezsEfE.exe
  2⤵
  PID:4424
- C:\Windows\System\fbkPvJA.exe
  C:\Windows\System\fbkPvJA.exe
  2⤵
  PID:4392
- C:\Windows\System\NRJZGPP.exe
  C:\Windows\System\NRJZGPP.exe
  2⤵
  PID:4520
- C:\Windows\System\eLFdGCc.exe
  C:\Windows\System\eLFdGCc.exe
  2⤵
  PID:4568
- C:\Windows\System\SrQmEbb.exe
  C:\Windows\System\SrQmEbb.exe
  2⤵
  PID:4584
- C:\Windows\System\JaFtIDS.exe
  C:\Windows\System\JaFtIDS.exe
  2⤵
  PID:4644
- C:\Windows\System\wRzHbGq.exe
  C:\Windows\System\wRzHbGq.exe
  2⤵
  PID:4664
- C:\Windows\System\RYOfxrn.exe
  C:\Windows\System\RYOfxrn.exe
  2⤵
  PID:4696
- C:\Windows\System\VWcgzHa.exe
  C:\Windows\System\VWcgzHa.exe
  2⤵
  PID:4728
- C:\Windows\System\HXPZVsk.exe
  C:\Windows\System\HXPZVsk.exe
  2⤵
  PID:4744
- C:\Windows\System\pRVIhZZ.exe
  C:\Windows\System\pRVIhZZ.exe
  2⤵
  PID:4804
- C:\Windows\System\iJgwbKq.exe
  C:\Windows\System\iJgwbKq.exe
  2⤵
  PID:4852
- C:\Windows\System\mRFUVui.exe
  C:\Windows\System\mRFUVui.exe
  2⤵
  PID:4840
- C:\Windows\System\LnmNhRT.exe
  C:\Windows\System\LnmNhRT.exe
  2⤵
  PID:4916
- C:\Windows\System\CXpaRYC.exe
  C:\Windows\System\CXpaRYC.exe
  2⤵
  PID:4900
- C:\Windows\System\UIuxKCE.exe
  C:\Windows\System\UIuxKCE.exe
  2⤵
  PID:5016
- C:\Windows\System\mNAsNLY.exe
  C:\Windows\System\mNAsNLY.exe
  2⤵
  PID:4968
- C:\Windows\System\FkxWeTv.exe
  C:\Windows\System\FkxWeTv.exe
  2⤵
  PID:5032
- C:\Windows\System\PLJBTVH.exe
  C:\Windows\System\PLJBTVH.exe
  2⤵
  PID:5060
- C:\Windows\System\CynUhFw.exe
  C:\Windows\System\CynUhFw.exe
  2⤵
  PID:5092
- C:\Windows\System\JWkYFNE.exe
  C:\Windows\System\JWkYFNE.exe
  2⤵
  PID:2868
- C:\Windows\System\wZhoVbF.exe
  C:\Windows\System\wZhoVbF.exe
  2⤵
  PID:1128
- C:\Windows\System\hZRgedI.exe
  C:\Windows\System\hZRgedI.exe
  2⤵
  PID:4100
- C:\Windows\System\IKanSur.exe
  C:\Windows\System\IKanSur.exe
  2⤵
  PID:2332
- C:\Windows\System\KDxXOva.exe
  C:\Windows\System\KDxXOva.exe
  2⤵
  PID:4232
- C:\Windows\System\OVeumsD.exe
  C:\Windows\System\OVeumsD.exe
  2⤵
  PID:4200
- C:\Windows\System\jhbSkLu.exe
  C:\Windows\System\jhbSkLu.exe
  2⤵
  PID:4468
- C:\Windows\System\PNyNiMU.exe
  C:\Windows\System\PNyNiMU.exe
  2⤵
  PID:4344
- C:\Windows\System\wstVLTo.exe
  C:\Windows\System\wstVLTo.exe
  2⤵
  PID:4280
- C:\Windows\System\MzUvpQU.exe
  C:\Windows\System\MzUvpQU.exe
  2⤵
  PID:4552
- C:\Windows\System\HSydcnp.exe
  C:\Windows\System\HSydcnp.exe
  2⤵
  PID:4484
- C:\Windows\System\ieDFkal.exe
  C:\Windows\System\ieDFkal.exe
  2⤵
  PID:4548
- C:\Windows\System\MAhScsg.exe
  C:\Windows\System\MAhScsg.exe
  2⤵
  PID:4676
- C:\Windows\System\mBOzvBd.exe
  C:\Windows\System\mBOzvBd.exe
  2⤵
  PID:4740
- C:\Windows\System\rXPZuDp.exe
  C:\Windows\System\rXPZuDp.exe
  2⤵
  PID:4836
- C:\Windows\System\ZZjOFTu.exe
  C:\Windows\System\ZZjOFTu.exe
  2⤵
  PID:4808
- C:\Windows\System\wGvDQTd.exe
  C:\Windows\System\wGvDQTd.exe
  2⤵
  PID:4984
- C:\Windows\System\KzmdwjH.exe
  C:\Windows\System\KzmdwjH.exe
  2⤵
  PID:5080
- C:\Windows\System\bkDjkrZ.exe
  C:\Windows\System\bkDjkrZ.exe
  2⤵
  PID:4932
- C:\Windows\System\xmdKvEf.exe
  C:\Windows\System\xmdKvEf.exe
  2⤵
  PID:4312
- C:\Windows\System\FpJhPYE.exe
  C:\Windows\System\FpJhPYE.exe
  2⤵
  PID:5096
- C:\Windows\System\JwQdotJ.exe
  C:\Windows\System\JwQdotJ.exe
  2⤵
  PID:4936
- C:\Windows\System\ykTgqyd.exe
  C:\Windows\System\ykTgqyd.exe
  2⤵
  PID:4132
- C:\Windows\System\ReLAHPr.exe
  C:\Windows\System\ReLAHPr.exe
  2⤵
  PID:4276
- C:\Windows\System\DzkvQOu.exe
  C:\Windows\System\DzkvQOu.exe
  2⤵
  PID:4504
- C:\Windows\System\GlmbtYC.exe
  C:\Windows\System\GlmbtYC.exe
  2⤵
  PID:4724
- C:\Windows\System\ButTGKp.exe
  C:\Windows\System\ButTGKp.exe
  2⤵
  PID:4824
- C:\Windows\System\DgNtdkH.exe
  C:\Windows\System\DgNtdkH.exe
  2⤵
  PID:4308
- C:\Windows\System\KXwMPGI.exe
  C:\Windows\System\KXwMPGI.exe
  2⤵
  PID:4948
- C:\Windows\System\cQIklHa.exe
  C:\Windows\System\cQIklHa.exe
  2⤵
  PID:4536
- C:\Windows\System\wVBZIhj.exe
  C:\Windows\System\wVBZIhj.exe
  2⤵
  PID:4712
- C:\Windows\System\YJNGEUh.exe
  C:\Windows\System\YJNGEUh.exe
  2⤵
  PID:4632
- C:\Windows\System\QOpyWJm.exe
  C:\Windows\System\QOpyWJm.exe
  2⤵
  PID:3156
- C:\Windows\System\FPFfYKr.exe
  C:\Windows\System\FPFfYKr.exe
  2⤵
  PID:5136
- C:\Windows\System\cQOQGsN.exe
  C:\Windows\System\cQOQGsN.exe
  2⤵
  PID:5152
- C:\Windows\System\HXYLTrT.exe
  C:\Windows\System\HXYLTrT.exe
  2⤵
  PID:5168
- C:\Windows\System\uxRBixF.exe
  C:\Windows\System\uxRBixF.exe
  2⤵
  PID:5184
- C:\Windows\System\dnhDdXj.exe
  C:\Windows\System\dnhDdXj.exe
  2⤵
  PID:5200
- C:\Windows\System\gHjMPCF.exe
  C:\Windows\System\gHjMPCF.exe
  2⤵
  PID:5216
- C:\Windows\System\PCXVxnb.exe
  C:\Windows\System\PCXVxnb.exe
  2⤵
  PID:5236
- C:\Windows\System\VcmuCvT.exe
  C:\Windows\System\VcmuCvT.exe
  2⤵
  PID:5252
- C:\Windows\System\PviKMjn.exe
  C:\Windows\System\PviKMjn.exe
  2⤵
  PID:5268
- C:\Windows\System\MiaDaju.exe
  C:\Windows\System\MiaDaju.exe
  2⤵
  PID:5284
- C:\Windows\System\wlbitZy.exe
  C:\Windows\System\wlbitZy.exe
  2⤵
  PID:5300
- C:\Windows\System\tgtTnsW.exe
  C:\Windows\System\tgtTnsW.exe
  2⤵
  PID:5316
- C:\Windows\System\sdphgfy.exe
  C:\Windows\System\sdphgfy.exe
  2⤵
  PID:5332
- C:\Windows\System\znpluHt.exe
  C:\Windows\System\znpluHt.exe
  2⤵
  PID:5348
- C:\Windows\System\cynrvTC.exe
  C:\Windows\System\cynrvTC.exe
  2⤵
  PID:5364
- C:\Windows\System\nlchQlS.exe
  C:\Windows\System\nlchQlS.exe
  2⤵
  PID:5384
- C:\Windows\System\aBQqCkr.exe
  C:\Windows\System\aBQqCkr.exe
  2⤵
  PID:5404
- C:\Windows\System\jEHZgFK.exe
  C:\Windows\System\jEHZgFK.exe
  2⤵
  PID:5420
- C:\Windows\System\hOWonmE.exe
  C:\Windows\System\hOWonmE.exe
  2⤵
  PID:5436
- C:\Windows\System\MMXzhmr.exe
  C:\Windows\System\MMXzhmr.exe
  2⤵
  PID:5452
- C:\Windows\System\BSIHLSj.exe
  C:\Windows\System\BSIHLSj.exe
  2⤵
  PID:5468
- C:\Windows\System\PuZQYfN.exe
  C:\Windows\System\PuZQYfN.exe
  2⤵
  PID:5488
- C:\Windows\System\SoqMmVS.exe
  C:\Windows\System\SoqMmVS.exe
  2⤵
  PID:5504
- C:\Windows\System\EsxWuGE.exe
  C:\Windows\System\EsxWuGE.exe
  2⤵
  PID:5520
- C:\Windows\System\sxuJuvD.exe
  C:\Windows\System\sxuJuvD.exe
  2⤵
  PID:5536
- C:\Windows\System\STOPnen.exe
  C:\Windows\System\STOPnen.exe
  2⤵
  PID:5552
- C:\Windows\System\UOXfjAj.exe
  C:\Windows\System\UOXfjAj.exe
  2⤵
  PID:5568
- C:\Windows\System\JAFFDxX.exe
  C:\Windows\System\JAFFDxX.exe
  2⤵
  PID:5584
- C:\Windows\System\ziCSnSX.exe
  C:\Windows\System\ziCSnSX.exe
  2⤵
  PID:5600
- C:\Windows\System\okquMNw.exe
  C:\Windows\System\okquMNw.exe
  2⤵
  PID:5616
- C:\Windows\System\xxvjzOo.exe
  C:\Windows\System\xxvjzOo.exe
  2⤵
  PID:5632
- C:\Windows\System\fIjHEbk.exe
  C:\Windows\System\fIjHEbk.exe
  2⤵
  PID:5648
- C:\Windows\System\zDItTXG.exe
  C:\Windows\System\zDItTXG.exe
  2⤵
  PID:5672
- C:\Windows\System\uByDoCj.exe
  C:\Windows\System\uByDoCj.exe
  2⤵
  PID:5688
- C:\Windows\System\YqRwsIR.exe
  C:\Windows\System\YqRwsIR.exe
  2⤵
  PID:5704
- C:\Windows\System\fFynKWH.exe
  C:\Windows\System\fFynKWH.exe
  2⤵
  PID:5720
- C:\Windows\System\gTRAaRg.exe
  C:\Windows\System\gTRAaRg.exe
  2⤵
  PID:5736
- C:\Windows\System\lzWRFSy.exe
  C:\Windows\System\lzWRFSy.exe
  2⤵
  PID:5752
- C:\Windows\System\pFgwhxX.exe
  C:\Windows\System\pFgwhxX.exe
  2⤵
  PID:5768
- C:\Windows\System\NtbpuJF.exe
  C:\Windows\System\NtbpuJF.exe
  2⤵
  PID:5784
- C:\Windows\System\KLXmtgS.exe
  C:\Windows\System\KLXmtgS.exe
  2⤵
  PID:5800
- C:\Windows\System\OcwFHYf.exe
  C:\Windows\System\OcwFHYf.exe
  2⤵
  PID:5816
- C:\Windows\System\grMjaHT.exe
  C:\Windows\System\grMjaHT.exe
  2⤵
  PID:5832
- C:\Windows\System\IxVTmBO.exe
  C:\Windows\System\IxVTmBO.exe
  2⤵
  PID:5856
- C:\Windows\System\UmNiaWy.exe
  C:\Windows\System\UmNiaWy.exe
  2⤵
  PID:5872
- C:\Windows\System\YiiVKhP.exe
  C:\Windows\System\YiiVKhP.exe
  2⤵
  PID:5888
- C:\Windows\System\TTFMoub.exe
  C:\Windows\System\TTFMoub.exe
  2⤵
  PID:5904
- C:\Windows\System\oRKsYCR.exe
  C:\Windows\System\oRKsYCR.exe
  2⤵
  PID:5920
- C:\Windows\System\xqTXwQv.exe
  C:\Windows\System\xqTXwQv.exe
  2⤵
  PID:5936
- C:\Windows\System\UjrvBzl.exe
  C:\Windows\System\UjrvBzl.exe
  2⤵
  PID:5952
- C:\Windows\System\MWBQRah.exe
  C:\Windows\System\MWBQRah.exe
  2⤵
  PID:5968
- C:\Windows\System\jcIguJr.exe
  C:\Windows\System\jcIguJr.exe
  2⤵
  PID:5984
- C:\Windows\System\aIEepDw.exe
  C:\Windows\System\aIEepDw.exe
  2⤵
  PID:6000
- C:\Windows\System\yBFCcoI.exe
  C:\Windows\System\yBFCcoI.exe
  2⤵
  PID:6016
- C:\Windows\System\HuEDpzw.exe
  C:\Windows\System\HuEDpzw.exe
  2⤵
  PID:6032
- C:\Windows\System\iMlVzRy.exe
  C:\Windows\System\iMlVzRy.exe
  2⤵
  PID:6048
- C:\Windows\System\TJasLNb.exe
  C:\Windows\System\TJasLNb.exe
  2⤵
  PID:6064
- C:\Windows\System\VBnNdMp.exe
  C:\Windows\System\VBnNdMp.exe
  2⤵
  PID:6080
- C:\Windows\System\hykEVSh.exe
  C:\Windows\System\hykEVSh.exe
  2⤵
  PID:6096
- C:\Windows\System\GtKmfYO.exe
  C:\Windows\System\GtKmfYO.exe
  2⤵
  PID:6116
- C:\Windows\System\zcmcMlB.exe
  C:\Windows\System\zcmcMlB.exe
  2⤵
  PID:6132
- C:\Windows\System\rgFqeXZ.exe
  C:\Windows\System\rgFqeXZ.exe
  2⤵
  PID:5132
- C:\Windows\System\QHyTvZH.exe
  C:\Windows\System\QHyTvZH.exe
  2⤵
  PID:4112
- C:\Windows\System\QgGcdzO.exe
  C:\Windows\System\QgGcdzO.exe
  2⤵
  PID:4792
- C:\Windows\System\xkiRUeG.exe
  C:\Windows\System\xkiRUeG.exe
  2⤵
  PID:5144
- C:\Windows\System\LYWajaI.exe
  C:\Windows\System\LYWajaI.exe
  2⤵
  PID:5176
- C:\Windows\System\DsPoFTG.exe
  C:\Windows\System\DsPoFTG.exe
  2⤵
  PID:5196
- C:\Windows\System\rbupeCv.exe
  C:\Windows\System\rbupeCv.exe
  2⤵
  PID:5228
- C:\Windows\System\CSrpBCI.exe
  C:\Windows\System\CSrpBCI.exe
  2⤵
  PID:5296
- C:\Windows\System\PcLsbFh.exe
  C:\Windows\System\PcLsbFh.exe
  2⤵
  PID:5392
- C:\Windows\System\ragavZz.exe
  C:\Windows\System\ragavZz.exe
  2⤵
  PID:5400
- C:\Windows\System\kDRbWxX.exe
  C:\Windows\System\kDRbWxX.exe
  2⤵
  PID:5428
- C:\Windows\System\IImNtuV.exe
  C:\Windows\System\IImNtuV.exe
  2⤵
  PID:5432
- C:\Windows\System\gaJkzwZ.exe
  C:\Windows\System\gaJkzwZ.exe
  2⤵
  PID:5464
- C:\Windows\System\bRypNyv.exe
  C:\Windows\System\bRypNyv.exe
  2⤵
  PID:5380
- C:\Windows\System\DQMmrBL.exe
  C:\Windows\System\DQMmrBL.exe
  2⤵
  PID:5476
- C:\Windows\System\iTlxRDA.exe
  C:\Windows\System\iTlxRDA.exe
  2⤵
  PID:5500
- C:\Windows\System\QrENuTE.exe
  C:\Windows\System\QrENuTE.exe
  2⤵
  PID:5564
- C:\Windows\System\raqKQqc.exe
  C:\Windows\System\raqKQqc.exe
  2⤵
  PID:5628
- C:\Windows\System\uBSJYNi.exe
  C:\Windows\System\uBSJYNi.exe
  2⤵
  PID:5576
- C:\Windows\System\eiTawJP.exe
  C:\Windows\System\eiTawJP.exe
  2⤵
  PID:5640
- C:\Windows\System\bXeTFea.exe
  C:\Windows\System\bXeTFea.exe
  2⤵
  PID:5612
- C:\Windows\System\knmKKCa.exe
  C:\Windows\System\knmKKCa.exe
  2⤵
  PID:5700
- C:\Windows\System\uQrqFdu.exe
  C:\Windows\System\uQrqFdu.exe
  2⤵
  PID:5792
- C:\Windows\System\ASfGTyX.exe
  C:\Windows\System\ASfGTyX.exe
  2⤵
  PID:5712
- C:\Windows\System\bqmIolL.exe
  C:\Windows\System\bqmIolL.exe
  2⤵
  PID:5868
- C:\Windows\System\KcOCnyj.exe
  C:\Windows\System\KcOCnyj.exe
  2⤵
  PID:6024
- C:\Windows\System\APggaAl.exe
  C:\Windows\System\APggaAl.exe
  2⤵
  PID:6056
- C:\Windows\System\MuLmcam.exe
  C:\Windows\System\MuLmcam.exe
  2⤵
  PID:5744
- C:\Windows\System\KMwNvLB.exe
  C:\Windows\System\KMwNvLB.exe
  2⤵
  PID:6128
- C:\Windows\System\WTAFSWN.exe
  C:\Windows\System\WTAFSWN.exe
  2⤵
  PID:5112
- C:\Windows\System\bNtFNcI.exe
  C:\Windows\System\bNtFNcI.exe
  2⤵
  PID:5884
- C:\Windows\System\vZQnnff.exe
  C:\Windows\System\vZQnnff.exe
  2⤵
  PID:5948
- C:\Windows\System\fweTiyz.exe
  C:\Windows\System\fweTiyz.exe
  2⤵
  PID:6040
- C:\Windows\System\CmKEHNZ.exe
  C:\Windows\System\CmKEHNZ.exe
  2⤵
  PID:5128
- C:\Windows\System\NvHojPZ.exe
  C:\Windows\System\NvHojPZ.exe
  2⤵
  PID:6112
- C:\Windows\System\xjvtuDI.exe
  C:\Windows\System\xjvtuDI.exe
  2⤵
  PID:5292
- C:\Windows\System\QKxxZhu.exe
  C:\Windows\System\QKxxZhu.exe
  2⤵
  PID:5192
- C:\Windows\System\gNAcGCq.exe
  C:\Windows\System\gNAcGCq.exe
  2⤵
  PID:5356
- C:\Windows\System\AonTPhN.exe
  C:\Windows\System\AonTPhN.exe
  2⤵
  PID:5412
- C:\Windows\System\sPDEhxI.exe
  C:\Windows\System\sPDEhxI.exe
  2⤵
  PID:5624
- C:\Windows\System\azELHtZ.exe
  C:\Windows\System\azELHtZ.exe
  2⤵
  PID:5696
- C:\Windows\System\EyVErbm.exe
  C:\Windows\System\EyVErbm.exe
  2⤵
  PID:5812
- C:\Windows\System\gTPAbWj.exe
  C:\Windows\System\gTPAbWj.exe
  2⤵
  PID:2440
- C:\Windows\System\vqCiaBi.exe
  C:\Windows\System\vqCiaBi.exe
  2⤵
  PID:5532
- C:\Windows\System\mXJjanU.exe
  C:\Windows\System\mXJjanU.exe
  2⤵
  PID:5516
- C:\Windows\System\oqSFlUn.exe
  C:\Windows\System\oqSFlUn.exe
  2⤵
  PID:5764
- C:\Windows\System\bdaLtTC.exe
  C:\Windows\System\bdaLtTC.exe
  2⤵
  PID:5864
- C:\Windows\System\LfVikuu.exe
  C:\Windows\System\LfVikuu.exe
  2⤵
  PID:5996
- C:\Windows\System\NTylzsk.exe
  C:\Windows\System\NTylzsk.exe
  2⤵
  PID:5444
- C:\Windows\System\DlRhzlf.exe
  C:\Windows\System\DlRhzlf.exe
  2⤵
  PID:5916
- C:\Windows\System\ttrHLkZ.exe
  C:\Windows\System\ttrHLkZ.exe
  2⤵
  PID:5164
- C:\Windows\System\GGwROaG.exe
  C:\Windows\System\GGwROaG.exe
  2⤵
  PID:5328
- C:\Windows\System\WzwNACR.exe
  C:\Windows\System\WzwNACR.exe
  2⤵
  PID:6012
- C:\Windows\System\vdthpwR.exe
  C:\Windows\System\vdthpwR.exe
  2⤵
  PID:5852
- C:\Windows\System\lZgiiuL.exe
  C:\Windows\System\lZgiiuL.exe
  2⤵
  PID:5416
- C:\Windows\System\sBOwxNI.exe
  C:\Windows\System\sBOwxNI.exe
  2⤵
  PID:5668
- C:\Windows\System\swUwiKZ.exe
  C:\Windows\System\swUwiKZ.exe
  2⤵
  PID:5344
- C:\Windows\System\eSHIGdg.exe
  C:\Windows\System\eSHIGdg.exe
  2⤵
  PID:5732
- C:\Windows\System\etNkYnN.exe
  C:\Windows\System\etNkYnN.exe
  2⤵
  PID:5808
- C:\Windows\System\zXPYlXT.exe
  C:\Windows\System\zXPYlXT.exe
  2⤵
  PID:6088
- C:\Windows\System\OUWkTMk.exe
  C:\Windows\System\OUWkTMk.exe
  2⤵
  PID:5748
- C:\Windows\System\xmHouEZ.exe
  C:\Windows\System\xmHouEZ.exe
  2⤵
  PID:5212
- C:\Windows\System\OxFJNjm.exe
  C:\Windows\System\OxFJNjm.exe
  2⤵
  PID:5728
- C:\Windows\System\jJqSyRz.exe
  C:\Windows\System\jJqSyRz.exe
  2⤵
  PID:6160
- C:\Windows\System\fxOngWN.exe
  C:\Windows\System\fxOngWN.exe
  2⤵
  PID:6176
- C:\Windows\System\NBGkpwW.exe
  C:\Windows\System\NBGkpwW.exe
  2⤵
  PID:6192
- C:\Windows\System\GzCvqob.exe
  C:\Windows\System\GzCvqob.exe
  2⤵
  PID:6208
- C:\Windows\System\pIjjSjj.exe
  C:\Windows\System\pIjjSjj.exe
  2⤵
  PID:6240
- C:\Windows\System\YhJKQvI.exe
  C:\Windows\System\YhJKQvI.exe
  2⤵
  PID:6260
- C:\Windows\System\mxOsIQw.exe
  C:\Windows\System\mxOsIQw.exe
  2⤵
  PID:6276
- C:\Windows\System\PcTJMTG.exe
  C:\Windows\System\PcTJMTG.exe
  2⤵
  PID:6296
- C:\Windows\System\AKEcbvp.exe
  C:\Windows\System\AKEcbvp.exe
  2⤵
  PID:6312
- C:\Windows\System\xwcogMa.exe
  C:\Windows\System\xwcogMa.exe
  2⤵
  PID:6328
- C:\Windows\System\QgHRRBq.exe
  C:\Windows\System\QgHRRBq.exe
  2⤵
  PID:6344
- C:\Windows\System\rfqqWxy.exe
  C:\Windows\System\rfqqWxy.exe
  2⤵
  PID:6360
- C:\Windows\System\BYdEfui.exe
  C:\Windows\System\BYdEfui.exe
  2⤵
  PID:6376
- C:\Windows\System\IXiHrzJ.exe
  C:\Windows\System\IXiHrzJ.exe
  2⤵
  PID:6392
- C:\Windows\System\VsOdOze.exe
  C:\Windows\System\VsOdOze.exe
  2⤵
  PID:6408
- C:\Windows\System\UMnYlrK.exe
  C:\Windows\System\UMnYlrK.exe
  2⤵
  PID:6424
- C:\Windows\System\qzuesqr.exe
  C:\Windows\System\qzuesqr.exe
  2⤵
  PID:6440
- C:\Windows\System\bmYhMYm.exe
  C:\Windows\System\bmYhMYm.exe
  2⤵
  PID:6456
- C:\Windows\System\DvbkMXb.exe
  C:\Windows\System\DvbkMXb.exe
  2⤵
  PID:6472
- C:\Windows\System\pNfXWQm.exe
  C:\Windows\System\pNfXWQm.exe
  2⤵
  PID:6488
- C:\Windows\System\luKKwHZ.exe
  C:\Windows\System\luKKwHZ.exe
  2⤵
  PID:6504
- C:\Windows\System\YHGkUuC.exe
  C:\Windows\System\YHGkUuC.exe
  2⤵
  PID:6520
- C:\Windows\System\yjuvifT.exe
  C:\Windows\System\yjuvifT.exe
  2⤵
  PID:6536
- C:\Windows\System\bvbVepo.exe
  C:\Windows\System\bvbVepo.exe
  2⤵
  PID:6552
- C:\Windows\System\wzlMHov.exe
  C:\Windows\System\wzlMHov.exe
  2⤵
  PID:6568
- C:\Windows\System\HNLkeQf.exe
  C:\Windows\System\HNLkeQf.exe
  2⤵
  PID:6584
- C:\Windows\System\IAwOkKf.exe
  C:\Windows\System\IAwOkKf.exe
  2⤵
  PID:6600
- C:\Windows\System\BHpRtdX.exe
  C:\Windows\System\BHpRtdX.exe
  2⤵
  PID:6616
- C:\Windows\System\zCPKDOe.exe
  C:\Windows\System\zCPKDOe.exe
  2⤵
  PID:6632
- C:\Windows\System\sBFSPST.exe
  C:\Windows\System\sBFSPST.exe
  2⤵
  PID:6648
- C:\Windows\System\ACeiVoE.exe
  C:\Windows\System\ACeiVoE.exe
  2⤵
  PID:6664
- C:\Windows\System\jxehdXg.exe
  C:\Windows\System\jxehdXg.exe
  2⤵
  PID:6680
- C:\Windows\System\XJdFjbw.exe
  C:\Windows\System\XJdFjbw.exe
  2⤵
  PID:6696
- C:\Windows\System\CvToJvE.exe
  C:\Windows\System\CvToJvE.exe
  2⤵
  PID:6712
- C:\Windows\System\vmvPfsx.exe
  C:\Windows\System\vmvPfsx.exe
  2⤵
  PID:6728
- C:\Windows\System\ZGGaUpe.exe
  C:\Windows\System\ZGGaUpe.exe
  2⤵
  PID:6744
- C:\Windows\System\iWfcqdo.exe
  C:\Windows\System\iWfcqdo.exe
  2⤵
  PID:6760
- C:\Windows\System\XbaLNTe.exe
  C:\Windows\System\XbaLNTe.exe
  2⤵
  PID:6776
- C:\Windows\System\OrvERFM.exe
  C:\Windows\System\OrvERFM.exe
  2⤵
  PID:6792
- C:\Windows\System\QXMLRRm.exe
  C:\Windows\System\QXMLRRm.exe
  2⤵
  PID:6808
- C:\Windows\System\UHrWsXJ.exe
  C:\Windows\System\UHrWsXJ.exe
  2⤵
  PID:6824
- C:\Windows\System\ZLvITJK.exe
  C:\Windows\System\ZLvITJK.exe
  2⤵
  PID:6840
- C:\Windows\System\UkXqZBa.exe
  C:\Windows\System\UkXqZBa.exe
  2⤵
  PID:6856
- C:\Windows\System\RNOrUek.exe
  C:\Windows\System\RNOrUek.exe
  2⤵
  PID:6872
- C:\Windows\System\jjSJxzg.exe
  C:\Windows\System\jjSJxzg.exe
  2⤵
  PID:6888
- C:\Windows\System\zHvDrGu.exe
  C:\Windows\System\zHvDrGu.exe
  2⤵
  PID:6904
- C:\Windows\System\ogXCpuY.exe
  C:\Windows\System\ogXCpuY.exe
  2⤵
  PID:6924
- C:\Windows\System\yEerlRv.exe
  C:\Windows\System\yEerlRv.exe
  2⤵
  PID:6940
- C:\Windows\System\DMXRlEe.exe
  C:\Windows\System\DMXRlEe.exe
  2⤵
  PID:6956
- C:\Windows\System\MceUmra.exe
  C:\Windows\System\MceUmra.exe
  2⤵
  PID:6972
- C:\Windows\System\EMUDoeQ.exe
  C:\Windows\System\EMUDoeQ.exe
  2⤵
  PID:6988
- C:\Windows\System\HRuwNEV.exe
  C:\Windows\System\HRuwNEV.exe
  2⤵
  PID:7004
- C:\Windows\System\nyNPoIL.exe
  C:\Windows\System\nyNPoIL.exe
  2⤵
  PID:7032
- C:\Windows\System\aDwEcjO.exe
  C:\Windows\System\aDwEcjO.exe
  2⤵
  PID:7048
- C:\Windows\System\MilOmDX.exe
  C:\Windows\System\MilOmDX.exe
  2⤵
  PID:7064
- C:\Windows\System\CpoVggp.exe
  C:\Windows\System\CpoVggp.exe
  2⤵
  PID:7080
- C:\Windows\System\DiDwIVL.exe
  C:\Windows\System\DiDwIVL.exe
  2⤵
  PID:7096
- C:\Windows\System\aOThiJw.exe
  C:\Windows\System\aOThiJw.exe
  2⤵
  PID:7112
- C:\Windows\System\XvIOOGc.exe
  C:\Windows\System\XvIOOGc.exe
  2⤵
  PID:7128
- C:\Windows\System\gkXilvh.exe
  C:\Windows\System\gkXilvh.exe
  2⤵
  PID:7144
- C:\Windows\System\Bojcxlk.exe
  C:\Windows\System\Bojcxlk.exe
  2⤵
  PID:7160
- C:\Windows\System\wDkVIbI.exe
  C:\Windows\System\wDkVIbI.exe
  2⤵
  PID:5980
- C:\Windows\System\NMvHgzU.exe
  C:\Windows\System\NMvHgzU.exe
  2⤵
  PID:6184
- C:\Windows\System\IRIjvHx.exe
  C:\Windows\System\IRIjvHx.exe
  2⤵
  PID:6224
- C:\Windows\System\IXIRyEK.exe
  C:\Windows\System\IXIRyEK.exe
  2⤵
  PID:6236
- C:\Windows\System\BBSvwFk.exe
  C:\Windows\System\BBSvwFk.exe
  2⤵
  PID:6072
- C:\Windows\System\zxocaVM.exe
  C:\Windows\System\zxocaVM.exe
  2⤵
  PID:5780
- C:\Windows\System\ITEQjMM.exe
  C:\Windows\System\ITEQjMM.exe
  2⤵
  PID:6308
- C:\Windows\System\zOpJRUv.exe
  C:\Windows\System\zOpJRUv.exe
  2⤵
  PID:5828
- C:\Windows\System\hSVMQFX.exe
  C:\Windows\System\hSVMQFX.exe
  2⤵
  PID:6008
- C:\Windows\System\cbhcQtn.exe
  C:\Windows\System\cbhcQtn.exe
  2⤵
  PID:6204
- C:\Windows\System\XcEsndg.exe
  C:\Windows\System\XcEsndg.exe
  2⤵
  PID:6372
- C:\Windows\System\DuzYdSR.exe
  C:\Windows\System\DuzYdSR.exe
  2⤵
  PID:6356
- C:\Windows\System\CTxEWAa.exe
  C:\Windows\System\CTxEWAa.exe
  2⤵
  PID:6284
- C:\Windows\System\PetmiHN.exe
  C:\Windows\System\PetmiHN.exe
  2⤵
  PID:6436
- C:\Windows\System\cDJLUIC.exe
  C:\Windows\System\cDJLUIC.exe
  2⤵
  PID:6468
- C:\Windows\System\QrJbKyJ.exe
  C:\Windows\System\QrJbKyJ.exe
  2⤵
  PID:6532
- C:\Windows\System\WhSoGol.exe
  C:\Windows\System\WhSoGol.exe
  2⤵
  PID:6592
- C:\Windows\System\aBZkFxz.exe
  C:\Windows\System\aBZkFxz.exe
  2⤵
  PID:6516
- C:\Windows\System\VtFKYpv.exe
  C:\Windows\System\VtFKYpv.exe
  2⤵
  PID:6580
- C:\Windows\System\uTRZXkR.exe
  C:\Windows\System\uTRZXkR.exe
  2⤵
  PID:6448
- C:\Windows\System\aAYsLxe.exe
  C:\Windows\System\aAYsLxe.exe
  2⤵
  PID:6656
- C:\Windows\System\lsbmLYy.exe
  C:\Windows\System\lsbmLYy.exe
  2⤵
  PID:6752
- C:\Windows\System\eWRjsdm.exe
  C:\Windows\System\eWRjsdm.exe
  2⤵
  PID:6816
- C:\Windows\System\QVGJJFB.exe
  C:\Windows\System\QVGJJFB.exe
  2⤵
  PID:6880
- C:\Windows\System\SnliHFv.exe
  C:\Windows\System\SnliHFv.exe
  2⤵
  PID:6916
- C:\Windows\System\zZKQEVe.exe
  C:\Windows\System\zZKQEVe.exe
  2⤵
  PID:6800
- C:\Windows\System\sUrHktH.exe
  C:\Windows\System\sUrHktH.exe
  2⤵
  PID:6672
- C:\Windows\System\yUQXSJe.exe
  C:\Windows\System\yUQXSJe.exe
  2⤵
  PID:6804
- C:\Windows\System\jCYcovh.exe
  C:\Windows\System\jCYcovh.exe
  2⤵
  PID:6708
- C:\Windows\System\HxEbEgr.exe
  C:\Windows\System\HxEbEgr.exe
  2⤵
  PID:6952
- C:\Windows\System\TIvfvlw.exe
  C:\Windows\System\TIvfvlw.exe
  2⤵
  PID:7016
- C:\Windows\System\ZUouoCl.exe
  C:\Windows\System\ZUouoCl.exe
  2⤵
  PID:7020
- C:\Windows\System\jDsIapo.exe
  C:\Windows\System\jDsIapo.exe
  2⤵
  PID:7056
- C:\Windows\System\GovDicN.exe
  C:\Windows\System\GovDicN.exe
  2⤵
  PID:7060
- C:\Windows\System\zAfVKHF.exe
  C:\Windows\System\zAfVKHF.exe
  2⤵
  PID:7124
- C:\Windows\System\dlsyNJx.exe
  C:\Windows\System\dlsyNJx.exe
  2⤵
  PID:6156
- C:\Windows\System\LsAUxZz.exe
  C:\Windows\System\LsAUxZz.exe
  2⤵
  PID:6272
- C:\Windows\System\SsOHWxK.exe
  C:\Windows\System\SsOHWxK.exe
  2⤵
  PID:7076
- C:\Windows\System\KijSECr.exe
  C:\Windows\System\KijSECr.exe
  2⤵
  PID:6388
- C:\Windows\System\CHCsDmD.exe
  C:\Windows\System\CHCsDmD.exe
  2⤵
  PID:5932
- C:\Windows\System\bsxgYDt.exe
  C:\Windows\System\bsxgYDt.exe
  2⤵
  PID:6340
- C:\Windows\System\sXiMKFp.exe
  C:\Windows\System\sXiMKFp.exe
  2⤵
  PID:6220
- C:\Windows\System\LMpOMNd.exe
  C:\Windows\System\LMpOMNd.exe
  2⤵
  PID:6528
- C:\Windows\System\ujpVZcK.exe
  C:\Windows\System\ujpVZcK.exe
  2⤵
  PID:6688
- C:\Windows\System\kcOaUes.exe
  C:\Windows\System\kcOaUes.exe
  2⤵
  PID:6724
- C:\Windows\System\dKYexpt.exe
  C:\Windows\System\dKYexpt.exe
  2⤵
  PID:5544
- C:\Windows\System\GLKpAcG.exe
  C:\Windows\System\GLKpAcG.exe
  2⤵
  PID:6836
- C:\Windows\System\mnSPtac.exe
  C:\Windows\System\mnSPtac.exe
  2⤵
  PID:6968
- C:\Windows\System\JHHcwDM.exe
  C:\Windows\System\JHHcwDM.exe
  2⤵
  PID:6576
- C:\Windows\System\HRRPmhp.exe
  C:\Windows\System\HRRPmhp.exe
  2⤵
  PID:6736
- C:\Windows\System\otbDCUj.exe
  C:\Windows\System\otbDCUj.exe
  2⤵
  PID:7012
- C:\Windows\System\IDMQxtb.exe
  C:\Windows\System\IDMQxtb.exe
  2⤵
  PID:7044
- C:\Windows\System\XWuXNHn.exe
  C:\Windows\System\XWuXNHn.exe
  2⤵
  PID:6200
- C:\Windows\System\OEYatlI.exe
  C:\Windows\System\OEYatlI.exe
  2⤵
  PID:6432
- C:\Windows\System\ymzaevd.exe
  C:\Windows\System\ymzaevd.exe
  2⤵
  PID:6704
- C:\Windows\System\nkvEoDq.exe
  C:\Windows\System\nkvEoDq.exe
  2⤵
  PID:6252
- C:\Windows\System\WMGZiDm.exe
  C:\Windows\System\WMGZiDm.exe
  2⤵
  PID:6612
- C:\Windows\System\hOGbMXn.exe
  C:\Windows\System\hOGbMXn.exe
  2⤵
  PID:6900
- C:\Windows\System\KoIjzbN.exe
  C:\Windows\System\KoIjzbN.exe
  2⤵
  PID:6932
- C:\Windows\System\WLxmfHX.exe
  C:\Windows\System\WLxmfHX.exe
  2⤵
  PID:7028
- C:\Windows\System\qWSXftm.exe
  C:\Windows\System\qWSXftm.exe
  2⤵
  PID:6720
- C:\Windows\System\MsHOJat.exe
  C:\Windows\System\MsHOJat.exe
  2⤵
  PID:6548
- C:\Windows\System\SLbppGJ.exe
  C:\Windows\System\SLbppGJ.exe
  2⤵
  PID:6740
- C:\Windows\System\LXIjCPk.exe
  C:\Windows\System\LXIjCPk.exe
  2⤵
  PID:6948
- C:\Windows\System\UXwYUAs.exe
  C:\Windows\System\UXwYUAs.exe
  2⤵
  PID:7104
- C:\Windows\System\rymKvfZ.exe
  C:\Windows\System\rymKvfZ.exe
  2⤵
  PID:6500
- C:\Windows\System\CCvBCTV.exe
  C:\Windows\System\CCvBCTV.exe
  2⤵
  PID:5148
- C:\Windows\System\GeojCSk.exe
  C:\Windows\System\GeojCSk.exe
  2⤵
  PID:6868
- C:\Windows\System\msLnJxY.exe
  C:\Windows\System\msLnJxY.exe
  2⤵
  PID:6936
- C:\Windows\System\bswlyuP.exe
  C:\Windows\System\bswlyuP.exe
  2⤵
  PID:7072
- C:\Windows\System\rrQbjrB.exe
  C:\Windows\System\rrQbjrB.exe
  2⤵
  PID:6676
- C:\Windows\System\dmeOtuc.exe
  C:\Windows\System\dmeOtuc.exe
  2⤵
  PID:7188
- C:\Windows\System\sobzHDb.exe
  C:\Windows\System\sobzHDb.exe
  2⤵
  PID:7204
- C:\Windows\System\eJYrtHN.exe
  C:\Windows\System\eJYrtHN.exe
  2⤵
  PID:7220
- C:\Windows\System\GXKrCEk.exe
  C:\Windows\System\GXKrCEk.exe
  2⤵
  PID:7236
- C:\Windows\System\sLcifsy.exe
  C:\Windows\System\sLcifsy.exe
  2⤵
  PID:7252
- C:\Windows\System\jwefBhM.exe
  C:\Windows\System\jwefBhM.exe
  2⤵
  PID:7268
- C:\Windows\System\ekRVidl.exe
  C:\Windows\System\ekRVidl.exe
  2⤵
  PID:7284
- C:\Windows\System\aFrVCay.exe
  C:\Windows\System\aFrVCay.exe
  2⤵
  PID:7300
- C:\Windows\System\noclCze.exe
  C:\Windows\System\noclCze.exe
  2⤵
  PID:7316
- C:\Windows\System\QbrqgsE.exe
  C:\Windows\System\QbrqgsE.exe
  2⤵
  PID:7332
- C:\Windows\System\fFtjcUO.exe
  C:\Windows\System\fFtjcUO.exe
  2⤵
  PID:7348
- C:\Windows\System\kSgzDIK.exe
  C:\Windows\System\kSgzDIK.exe
  2⤵
  PID:7364
- C:\Windows\System\MzbqYkM.exe
  C:\Windows\System\MzbqYkM.exe
  2⤵
  PID:7380
- C:\Windows\System\UcITXUM.exe
  C:\Windows\System\UcITXUM.exe
  2⤵
  PID:7396
- C:\Windows\System\rGhTZfE.exe
  C:\Windows\System\rGhTZfE.exe
  2⤵
  PID:7412
- C:\Windows\System\ovlgxJu.exe
  C:\Windows\System\ovlgxJu.exe
  2⤵
  PID:7428
- C:\Windows\System\pWBofQL.exe
  C:\Windows\System\pWBofQL.exe
  2⤵
  PID:7448
- C:\Windows\System\BxStIew.exe
  C:\Windows\System\BxStIew.exe
  2⤵
  PID:7464
- C:\Windows\System\zyrQOjL.exe
  C:\Windows\System\zyrQOjL.exe
  2⤵
  PID:7480
- C:\Windows\System\nlclPSB.exe
  C:\Windows\System\nlclPSB.exe
  2⤵
  PID:7496
- C:\Windows\System\ouSfUBG.exe
  C:\Windows\System\ouSfUBG.exe
  2⤵
  PID:7512
- C:\Windows\System\dGVHnXm.exe
  C:\Windows\System\dGVHnXm.exe
  2⤵
  PID:7528
- C:\Windows\System\ynmumlI.exe
  C:\Windows\System\ynmumlI.exe
  2⤵
  PID:7544
- C:\Windows\System\aRYXRHq.exe
  C:\Windows\System\aRYXRHq.exe
  2⤵
  PID:7560
- C:\Windows\System\vtEVhfR.exe
  C:\Windows\System\vtEVhfR.exe
  2⤵
  PID:7576
- C:\Windows\System\fFRbceK.exe
  C:\Windows\System\fFRbceK.exe
  2⤵
  PID:7592
- C:\Windows\System\yBhbgkJ.exe
  C:\Windows\System\yBhbgkJ.exe
  2⤵
  PID:7608
- C:\Windows\System\OJoloDl.exe
  C:\Windows\System\OJoloDl.exe
  2⤵
  PID:7624
- C:\Windows\System\UeiUPOl.exe
  C:\Windows\System\UeiUPOl.exe
  2⤵
  PID:7640
- C:\Windows\System\UkJYLHR.exe
  C:\Windows\System\UkJYLHR.exe
  2⤵
  PID:7688
- C:\Windows\System\eKLtkkL.exe
  C:\Windows\System\eKLtkkL.exe
  2⤵
  PID:7756
- C:\Windows\System\QiuYUGQ.exe
  C:\Windows\System\QiuYUGQ.exe
  2⤵
  PID:7792
- C:\Windows\System\JTZPJUf.exe
  C:\Windows\System\JTZPJUf.exe
  2⤵
  PID:7808
- C:\Windows\System\wjLCLCV.exe
  C:\Windows\System\wjLCLCV.exe
  2⤵
  PID:7824
- C:\Windows\System\ZdWzgdb.exe
  C:\Windows\System\ZdWzgdb.exe
  2⤵
  PID:7840
- C:\Windows\System\GQOIVua.exe
  C:\Windows\System\GQOIVua.exe
  2⤵
  PID:7856
- C:\Windows\System\hkByGDT.exe
  C:\Windows\System\hkByGDT.exe
  2⤵
  PID:7932
- C:\Windows\System\eRyPVnF.exe
  C:\Windows\System\eRyPVnF.exe
  2⤵
  PID:7964
- C:\Windows\System\nJrPNHd.exe
  C:\Windows\System\nJrPNHd.exe
  2⤵
  PID:8004
- C:\Windows\System\MLwkkRw.exe
  C:\Windows\System\MLwkkRw.exe
  2⤵
  PID:8020
- C:\Windows\System\ouJSRxG.exe
  C:\Windows\System\ouJSRxG.exe
  2⤵
  PID:8036
- C:\Windows\System\YzSzjyq.exe
  C:\Windows\System\YzSzjyq.exe
  2⤵
  PID:8100
- C:\Windows\System\xciboEv.exe
  C:\Windows\System\xciboEv.exe
  2⤵
  PID:8164
- C:\Windows\System\hBwjcrN.exe
  C:\Windows\System\hBwjcrN.exe
  2⤵
  PID:6268
- C:\Windows\System\KtrOoVg.exe
  C:\Windows\System\KtrOoVg.exe
  2⤵
  PID:7244
- C:\Windows\System\gYyiebi.exe
  C:\Windows\System\gYyiebi.exe
  2⤵
  PID:7308
- C:\Windows\System\FQLIxXF.exe
  C:\Windows\System\FQLIxXF.exe
  2⤵
  PID:7408
- C:\Windows\System\SkPXrMx.exe
  C:\Windows\System\SkPXrMx.exe
  2⤵
  PID:7292
- C:\Windows\System\iUUlgmT.exe
  C:\Windows\System\iUUlgmT.exe
  2⤵
  PID:7296
- C:\Windows\System\wVefXqb.exe
  C:\Windows\System\wVefXqb.exe
  2⤵
  PID:7328
- C:\Windows\System\loePTop.exe
  C:\Windows\System\loePTop.exe
  2⤵
  PID:7460
- C:\Windows\System\hWhgieo.exe
  C:\Windows\System\hWhgieo.exe
  2⤵
  PID:7524
- C:\Windows\System\cCOFkkf.exe
  C:\Windows\System\cCOFkkf.exe
  2⤵
  PID:7572
- C:\Windows\System\iBJXhxF.exe
  C:\Windows\System\iBJXhxF.exe
  2⤵
  PID:7636
- C:\Windows\System\iipsfYV.exe
  C:\Windows\System\iipsfYV.exe
  2⤵
  PID:7656
- C:\Windows\System\CeVRcgR.exe
  C:\Windows\System\CeVRcgR.exe
  2⤵
  PID:7556
- C:\Windows\System\QiJrEHR.exe
  C:\Windows\System\QiJrEHR.exe
  2⤵
  PID:7668
- C:\Windows\System\wcepMwM.exe
  C:\Windows\System\wcepMwM.exe
  2⤵
  PID:7684
- C:\Windows\System\lSeUQHT.exe
  C:\Windows\System\lSeUQHT.exe
  2⤵
  PID:7768
- C:\Windows\System\SXKSHnQ.exe
  C:\Windows\System\SXKSHnQ.exe
  2⤵
  PID:7784
- C:\Windows\System\qVWJpGr.exe
  C:\Windows\System\qVWJpGr.exe
  2⤵
  PID:7836
- C:\Windows\System\GxMaPez.exe
  C:\Windows\System\GxMaPez.exe
  2⤵
  PID:7848
- C:\Windows\System\XlzvmdG.exe
  C:\Windows\System\XlzvmdG.exe
  2⤵
  PID:7876
- C:\Windows\System\MwCYKwe.exe
  C:\Windows\System\MwCYKwe.exe
  2⤵
  PID:7892
- C:\Windows\System\OqUnyBc.exe
  C:\Windows\System\OqUnyBc.exe
  2⤵
  PID:7900
- C:\Windows\System\YbIwxnf.exe
  C:\Windows\System\YbIwxnf.exe
  2⤵
  PID:7916
- C:\Windows\System\iFgTbKI.exe
  C:\Windows\System\iFgTbKI.exe
  2⤵
  PID:7948
- C:\Windows\System\DQDKncO.exe
  C:\Windows\System\DQDKncO.exe
  2⤵
  PID:7960
- C:\Windows\System\RMwWvhH.exe
  C:\Windows\System\RMwWvhH.exe
  2⤵
  PID:7980
- C:\Windows\System\qQQJVfY.exe
  C:\Windows\System\qQQJVfY.exe
  2⤵
  PID:8044
- C:\Windows\System\bEOBNdR.exe
  C:\Windows\System\bEOBNdR.exe
  2⤵
  PID:8048
- C:\Windows\System\ReSlqKl.exe
  C:\Windows\System\ReSlqKl.exe
  2⤵
  PID:7992
- C:\Windows\System\ZoMIXkO.exe
  C:\Windows\System\ZoMIXkO.exe
  2⤵
  PID:8072
- C:\Windows\System\ECvdFvg.exe
  C:\Windows\System\ECvdFvg.exe
  2⤵
  PID:8088
- C:\Windows\System\ubxddED.exe
  C:\Windows\System\ubxddED.exe
  2⤵
  PID:8092
- C:\Windows\System\utwBEgD.exe
  C:\Windows\System\utwBEgD.exe
  2⤵
  PID:8132
- C:\Windows\System\fhrUJPj.exe
  C:\Windows\System\fhrUJPj.exe
  2⤵
  PID:8152
- C:\Windows\System\ejghxCA.exe
  C:\Windows\System\ejghxCA.exe
  2⤵
  PID:7972
- C:\Windows\System\HFMdjkr.exe
  C:\Windows\System\HFMdjkr.exe
  2⤵
  PID:7180
- C:\Windows\System\atYLdMi.exe
  C:\Windows\System\atYLdMi.exe
  2⤵
  PID:7372
- C:\Windows\System\NWNXvcT.exe
  C:\Windows\System\NWNXvcT.exe
  2⤵
  PID:7340
- C:\Windows\System\BuZCpCQ.exe
  C:\Windows\System\BuZCpCQ.exe
  2⤵
  PID:7108
- C:\Windows\System\eOjQGGz.exe
  C:\Windows\System\eOjQGGz.exe
  2⤵
  PID:6368
- C:\Windows\System\WvUKEck.exe
  C:\Windows\System\WvUKEck.exe
  2⤵
  PID:5840
- C:\Windows\System\MNSZZQK.exe
  C:\Windows\System\MNSZZQK.exe
  2⤵
  PID:7440
- C:\Windows\System\mgHtQMo.exe
  C:\Windows\System\mgHtQMo.exe
  2⤵
  PID:7420
- C:\Windows\System\MejjAtl.exe
  C:\Windows\System\MejjAtl.exe
  2⤵
  PID:7508
- C:\Windows\System\efjEhQU.exe
  C:\Windows\System\efjEhQU.exe
  2⤵
  PID:7652
- C:\Windows\System\YFdIINM.exe
  C:\Windows\System\YFdIINM.exe
  2⤵
  PID:7928
- C:\Windows\System\sEYsBpg.exe
  C:\Windows\System\sEYsBpg.exe
  2⤵
  PID:7664
- C:\Windows\System\BoOUzUb.exe
  C:\Windows\System\BoOUzUb.exe
  2⤵
  PID:7816
- C:\Windows\System\hxNEzUq.exe
  C:\Windows\System\hxNEzUq.exe
  2⤵
  PID:7984
- C:\Windows\System\UzRzTFy.exe
  C:\Windows\System\UzRzTFy.exe
  2⤵
  PID:8140
- C:\Windows\System\cWWLxeN.exe
  C:\Windows\System\cWWLxeN.exe
  2⤵
  PID:7956
- C:\Windows\System\zBnQNKw.exe
  C:\Windows\System\zBnQNKw.exe
  2⤵
  PID:8172
- C:\Windows\System\jbfLvkZ.exe
  C:\Windows\System\jbfLvkZ.exe
  2⤵
  PID:6248
- C:\Windows\System\jCZehzS.exe
  C:\Windows\System\jCZehzS.exe
  2⤵
  PID:7216
- C:\Windows\System\nmHpdTl.exe
  C:\Windows\System\nmHpdTl.exe
  2⤵
  PID:7676
- C:\Windows\System\RbVuDOc.exe
  C:\Windows\System\RbVuDOc.exe
  2⤵
  PID:7884
- C:\Windows\System\facfScR.exe
  C:\Windows\System\facfScR.exe
  2⤵
  PID:7988
- C:\Windows\System\oucVySw.exe
  C:\Windows\System\oucVySw.exe
  2⤵
  PID:8160
- C:\Windows\System\bUtnwFV.exe
  C:\Windows\System\bUtnwFV.exe
  2⤵
  PID:7232
- C:\Windows\System\eokezlo.exe
  C:\Windows\System\eokezlo.exe
  2⤵
  PID:8112
- C:\Windows\System\wXBdWdi.exe
  C:\Windows\System\wXBdWdi.exe
  2⤵
  PID:7752
- C:\Windows\System\CfFDLpi.exe
  C:\Windows\System\CfFDLpi.exe
  2⤵
  PID:8068
- C:\Windows\System\ltKYmAg.exe
  C:\Windows\System\ltKYmAg.exe
  2⤵
  PID:8124
- C:\Windows\System\aKQDTDr.exe
  C:\Windows\System\aKQDTDr.exe
  2⤵
  PID:7788
- C:\Windows\System\ZneKgHu.exe
  C:\Windows\System\ZneKgHu.exe
  2⤵
  PID:7588
- C:\Windows\System\dVMpHnl.exe
  C:\Windows\System\dVMpHnl.exe
  2⤵
  PID:6784
- C:\Windows\System\ZsugMBg.exe
  C:\Windows\System\ZsugMBg.exe
  2⤵
  PID:7492
- C:\Windows\System\JxoiPQm.exe
  C:\Windows\System\JxoiPQm.exe
  2⤵
  PID:7940
- C:\Windows\System\IeIceJx.exe
  C:\Windows\System\IeIceJx.exe
  2⤵
  PID:7584
- C:\Windows\System\MEymqeD.exe
  C:\Windows\System\MEymqeD.exe
  2⤵
  PID:7424
- C:\Windows\System\bHYHHjk.exe
  C:\Windows\System\bHYHHjk.exe
  2⤵
  PID:7896
- C:\Windows\System\DlznPdV.exe
  C:\Windows\System\DlznPdV.exe
  2⤵
  PID:7520
- C:\Windows\System\TmRiTax.exe
  C:\Windows\System\TmRiTax.exe
  2⤵
  PID:7568
- C:\Windows\System\CQxGhIs.exe
  C:\Windows\System\CQxGhIs.exe
  2⤵
  PID:8064
- C:\Windows\System\hLBAsaz.exe
  C:\Windows\System\hLBAsaz.exe
  2⤵
  PID:8028
- C:\Windows\System\mZcTFti.exe
  C:\Windows\System\mZcTFti.exe
  2⤵
  PID:7872
- C:\Windows\System\bSdzqUx.exe
  C:\Windows\System\bSdzqUx.exe
  2⤵
  PID:8208
- C:\Windows\System\BPmRDCh.exe
  C:\Windows\System\BPmRDCh.exe
  2⤵
  PID:8224
- C:\Windows\System\OaSDyrk.exe
  C:\Windows\System\OaSDyrk.exe
  2⤵
  PID:8240
- C:\Windows\System\GUyutUA.exe
  C:\Windows\System\GUyutUA.exe
  2⤵
  PID:8256
- C:\Windows\System\iWpXlVw.exe
  C:\Windows\System\iWpXlVw.exe
  2⤵
  PID:8272
- C:\Windows\System\fwiyIly.exe
  C:\Windows\System\fwiyIly.exe
  2⤵
  PID:8288
- C:\Windows\System\qFFtSLf.exe
  C:\Windows\System\qFFtSLf.exe
  2⤵
  PID:8304
- C:\Windows\System\NCrEpKZ.exe
  C:\Windows\System\NCrEpKZ.exe
  2⤵
  PID:8320
- C:\Windows\System\KtOmFAA.exe
  C:\Windows\System\KtOmFAA.exe
  2⤵
  PID:8336
- C:\Windows\System\FwpTcsa.exe
  C:\Windows\System\FwpTcsa.exe
  2⤵
  PID:8352
- C:\Windows\System\dSTKWuj.exe
  C:\Windows\System\dSTKWuj.exe
  2⤵
  PID:8368
- C:\Windows\System\ijTxTxK.exe
  C:\Windows\System\ijTxTxK.exe
  2⤵
  PID:8384
- C:\Windows\System\wDoMuEW.exe
  C:\Windows\System\wDoMuEW.exe
  2⤵
  PID:8400
- C:\Windows\System\raZDiNt.exe
  C:\Windows\System\raZDiNt.exe
  2⤵
  PID:8416
- C:\Windows\System\NuxYDdS.exe
  C:\Windows\System\NuxYDdS.exe
  2⤵
  PID:8432
- C:\Windows\System\BjuHQrw.exe
  C:\Windows\System\BjuHQrw.exe
  2⤵
  PID:8448
- C:\Windows\System\RUwrCVd.exe
  C:\Windows\System\RUwrCVd.exe
  2⤵
  PID:8464
- C:\Windows\System\KHMtaer.exe
  C:\Windows\System\KHMtaer.exe
  2⤵
  PID:8480
- C:\Windows\System\ZmBDCNJ.exe
  C:\Windows\System\ZmBDCNJ.exe
  2⤵
  PID:8496
- C:\Windows\System\xNlvPMW.exe
  C:\Windows\System\xNlvPMW.exe
  2⤵
  PID:8512
- C:\Windows\System\kTvRexG.exe
  C:\Windows\System\kTvRexG.exe
  2⤵
  PID:8528
- C:\Windows\System\rbtARcS.exe
  C:\Windows\System\rbtARcS.exe
  2⤵
  PID:8544
- C:\Windows\System\uwovfqK.exe
  C:\Windows\System\uwovfqK.exe
  2⤵
  PID:8560
- C:\Windows\System\YMORnUC.exe
  C:\Windows\System\YMORnUC.exe
  2⤵
  PID:8576
- C:\Windows\System\GExDceK.exe
  C:\Windows\System\GExDceK.exe
  2⤵
  PID:8592
- C:\Windows\System\dVwdzYq.exe
  C:\Windows\System\dVwdzYq.exe
  2⤵
  PID:8608
- C:\Windows\System\mBrBBYp.exe
  C:\Windows\System\mBrBBYp.exe
  2⤵
  PID:8624
- C:\Windows\System\psIgKFc.exe
  C:\Windows\System\psIgKFc.exe
  2⤵
  PID:8640
- C:\Windows\System\rxMHZGq.exe
  C:\Windows\System\rxMHZGq.exe
  2⤵
  PID:8656
- C:\Windows\System\BcMNdhH.exe
  C:\Windows\System\BcMNdhH.exe
  2⤵
  PID:8672
- C:\Windows\System\bNMPqpt.exe
  C:\Windows\System\bNMPqpt.exe
  2⤵
  PID:8688
- C:\Windows\System\ShpZhvK.exe
  C:\Windows\System\ShpZhvK.exe
  2⤵
  PID:8704
- C:\Windows\System\UhpnJvK.exe
  C:\Windows\System\UhpnJvK.exe
  2⤵
  PID:8720
- C:\Windows\System\HLCbkzR.exe
  C:\Windows\System\HLCbkzR.exe
  2⤵
  PID:8736
- C:\Windows\System\CUxfpXj.exe
  C:\Windows\System\CUxfpXj.exe
  2⤵
  PID:8752
- C:\Windows\System\IaEjDhX.exe
  C:\Windows\System\IaEjDhX.exe
  2⤵
  PID:8768
- C:\Windows\System\avqjUVi.exe
  C:\Windows\System\avqjUVi.exe
  2⤵
  PID:8788
- C:\Windows\System\BBeZHAH.exe
  C:\Windows\System\BBeZHAH.exe
  2⤵
  PID:8804
- C:\Windows\System\XnzSNRC.exe
  C:\Windows\System\XnzSNRC.exe
  2⤵
  PID:8820
- C:\Windows\System\lgkdFPh.exe
  C:\Windows\System\lgkdFPh.exe
  2⤵
  PID:8836
- C:\Windows\System\zVKYcmK.exe
  C:\Windows\System\zVKYcmK.exe
  2⤵
  PID:8852
- C:\Windows\System\pXVIGTD.exe
  C:\Windows\System\pXVIGTD.exe
  2⤵
  PID:8868
- C:\Windows\System\DxYfdIV.exe
  C:\Windows\System\DxYfdIV.exe
  2⤵
  PID:8888
- C:\Windows\System\YXlwDzL.exe
  C:\Windows\System\YXlwDzL.exe
  2⤵
  PID:8904
- C:\Windows\System\sjRldTO.exe
  C:\Windows\System\sjRldTO.exe
  2⤵
  PID:8920
- C:\Windows\System\agENwqB.exe
  C:\Windows\System\agENwqB.exe
  2⤵
  PID:8936
- C:\Windows\System\kawPAvS.exe
  C:\Windows\System\kawPAvS.exe
  2⤵
  PID:8952
- C:\Windows\System\blLfhYA.exe
  C:\Windows\System\blLfhYA.exe
  2⤵
  PID:8968
- C:\Windows\System\QbMDPLU.exe
  C:\Windows\System\QbMDPLU.exe
  2⤵
  PID:8984
- C:\Windows\System\ujNlyRl.exe
  C:\Windows\System\ujNlyRl.exe
  2⤵
  PID:9000
- C:\Windows\System\maRWkRm.exe
  C:\Windows\System\maRWkRm.exe
  2⤵
  PID:9016
- C:\Windows\System\jnOPrgl.exe
  C:\Windows\System\jnOPrgl.exe
  2⤵
  PID:9032
- C:\Windows\System\YAjEsIU.exe
  C:\Windows\System\YAjEsIU.exe
  2⤵
  PID:9048
- C:\Windows\System\KNKNMce.exe
  C:\Windows\System\KNKNMce.exe
  2⤵
  PID:9064
- C:\Windows\System\ZnWuLez.exe
  C:\Windows\System\ZnWuLez.exe
  2⤵
  PID:9080
- C:\Windows\System\WmTDlAf.exe
  C:\Windows\System\WmTDlAf.exe
  2⤵
  PID:9096
- C:\Windows\System\OtUUFfJ.exe
  C:\Windows\System\OtUUFfJ.exe
  2⤵
  PID:9112
- C:\Windows\System\BOAeVLA.exe
  C:\Windows\System\BOAeVLA.exe
  2⤵
  PID:9128
- C:\Windows\System\nqAJjDl.exe
  C:\Windows\System\nqAJjDl.exe
  2⤵
  PID:9144
- C:\Windows\System\FJDiUmY.exe
  C:\Windows\System\FJDiUmY.exe
  2⤵
  PID:9160
- C:\Windows\System\wUmChHc.exe
  C:\Windows\System\wUmChHc.exe
  2⤵
  PID:9176
- C:\Windows\System\hQWRdSw.exe
  C:\Windows\System\hQWRdSw.exe
  2⤵
  PID:9192
- C:\Windows\System\PDUsxkH.exe
  C:\Windows\System\PDUsxkH.exe
  2⤵
  PID:9208
- C:\Windows\System\nYBMiJT.exe
  C:\Windows\System\nYBMiJT.exe
  2⤵
  PID:6152
- C:\Windows\System\RbLjvKV.exe
  C:\Windows\System\RbLjvKV.exe
  2⤵
  PID:7356
- C:\Windows\System\gWHowXH.exe
  C:\Windows\System\gWHowXH.exe
  2⤵
  PID:8248
- C:\Windows\System\NwFaYdM.exe
  C:\Windows\System\NwFaYdM.exe
  2⤵
  PID:6628
- C:\Windows\System\iVekwNf.exe
  C:\Windows\System\iVekwNf.exe
  2⤵
  PID:8316
- C:\Windows\System\RIIzkST.exe
  C:\Windows\System\RIIzkST.exe
  2⤵
  PID:8380
- C:\Windows\System\cpFgFuF.exe
  C:\Windows\System\cpFgFuF.exe
  2⤵
  PID:8440
- C:\Windows\System\BfLUype.exe
  C:\Windows\System\BfLUype.exe
  2⤵
  PID:8332
- C:\Windows\System\PXiuOmM.exe
  C:\Windows\System\PXiuOmM.exe
  2⤵
  PID:8396
- C:\Windows\System\svwFqGJ.exe
  C:\Windows\System\svwFqGJ.exe
  2⤵
  PID:8200
- C:\Windows\System\kEjjfsS.exe
  C:\Windows\System\kEjjfsS.exe
  2⤵
  PID:8264
- C:\Windows\System\nifumoj.exe
  C:\Windows\System\nifumoj.exe
  2⤵
  PID:8540
- C:\Windows\System\YRDwjBu.exe
  C:\Windows\System\YRDwjBu.exe
  2⤵
  PID:8460
- C:\Windows\System\MaKmZBV.exe
  C:\Windows\System\MaKmZBV.exe
  2⤵
  PID:8668
- C:\Windows\System\TJdiBTW.exe
  C:\Windows\System\TJdiBTW.exe
  2⤵
  PID:8728
- C:\Windows\System\zXTKpwb.exe
  C:\Windows\System\zXTKpwb.exe
  2⤵
  PID:8300
- C:\Windows\System\kQsyhko.exe
  C:\Windows\System\kQsyhko.exe
  2⤵
  PID:8796
- C:\Windows\System\mnwOxSy.exe
  C:\Windows\System\mnwOxSy.exe
  2⤵
  PID:8524
- C:\Windows\System\uUEzhRD.exe
  C:\Windows\System\uUEzhRD.exe
  2⤵
  PID:8712
- C:\Windows\System\PGwSJBt.exe
  C:\Windows\System\PGwSJBt.exe
  2⤵
  PID:8864
- C:\Windows\System\DcxgWYo.exe
  C:\Windows\System\DcxgWYo.exe
  2⤵
  PID:8960
- C:\Windows\System\tnGqtSP.exe
  C:\Windows\System\tnGqtSP.exe
  2⤵
  PID:8992
- C:\Windows\System\URVxAlN.exe
  C:\Windows\System\URVxAlN.exe
  2⤵
  PID:8588
- C:\Windows\System\ekklauG.exe
  C:\Windows\System\ekklauG.exe
  2⤵
  PID:8652
- C:\Windows\System\qweCrLO.exe
  C:\Windows\System\qweCrLO.exe
  2⤵
  PID:9056
- C:\Windows\System\DbXhSWv.exe
  C:\Windows\System\DbXhSWv.exe
  2⤵
  PID:8784
- C:\Windows\System\wWUbNha.exe
  C:\Windows\System\wWUbNha.exe
  2⤵
  PID:8180
- C:\Windows\System\tIqGkSq.exe
  C:\Windows\System\tIqGkSq.exe
  2⤵
  PID:9156
- C:\Windows\System\ilhnstc.exe
  C:\Windows\System\ilhnstc.exe
  2⤵
  PID:8848
- C:\Windows\System\wVZQkZW.exe
  C:\Windows\System\wVZQkZW.exe
  2⤵
  PID:8916
- C:\Windows\System\bYEeAFz.exe
  C:\Windows\System\bYEeAFz.exe
  2⤵
  PID:8976
- C:\Windows\System\qVaFdbg.exe
  C:\Windows\System\qVaFdbg.exe
  2⤵
  PID:9136
- C:\Windows\System\xwihOMa.exe
  C:\Windows\System\xwihOMa.exe
  2⤵
  PID:9012
- C:\Windows\System\GEobUNQ.exe
  C:\Windows\System\GEobUNQ.exe
  2⤵
  PID:9072
- C:\Windows\System\mYzZUeU.exe
  C:\Windows\System\mYzZUeU.exe
  2⤵
  PID:8312
- C:\Windows\System\GsdwskJ.exe
  C:\Windows\System\GsdwskJ.exe
  2⤵
  PID:9204
- C:\Windows\System\uuaPQPV.exe
  C:\Windows\System\uuaPQPV.exe
  2⤵
  PID:7172
- C:\Windows\System\vMMdVAc.exe
  C:\Windows\System\vMMdVAc.exe
  2⤵
  PID:8364
- C:\Windows\System\AciEukw.exe
  C:\Windows\System\AciEukw.exe
  2⤵
  PID:8204
- C:\Windows\System\iXckqmC.exe
  C:\Windows\System\iXckqmC.exe
  2⤵
  PID:8508
- C:\Windows\System\EwsslnK.exe
  C:\Windows\System\EwsslnK.exe
  2⤵
  PID:8696
- C:\Windows\System\lcneBds.exe
  C:\Windows\System\lcneBds.exe
  2⤵
  PID:8536
- C:\Windows\System\hzRSfnK.exe
  C:\Windows\System\hzRSfnK.exe
  2⤵
  PID:8928
- C:\Windows\System\PBERBut.exe
  C:\Windows\System\PBERBut.exe
  2⤵
  PID:9092
- C:\Windows\System\jhJDsZc.exe
  C:\Windows\System\jhJDsZc.exe
  2⤵
  PID:8632
- C:\Windows\System\DjfKBaC.exe
  C:\Windows\System\DjfKBaC.exe
  2⤵
  PID:8816
- C:\Windows\System\gTLfOmf.exe
  C:\Windows\System\gTLfOmf.exe
  2⤵
  PID:8948
- C:\Windows\System\fWwLhKx.exe
  C:\Windows\System\fWwLhKx.exe
  2⤵
  PID:8216
- C:\Windows\System\MFYxOLo.exe
  C:\Windows\System\MFYxOLo.exe
  2⤵
  PID:9076
- C:\Windows\System\WldfUnO.exe
  C:\Windows\System\WldfUnO.exe
  2⤵
  PID:8328
- C:\Windows\System\OVtiPyx.exe
  C:\Windows\System\OVtiPyx.exe
  2⤵
  PID:8716
- C:\Windows\System\NVGmtkl.exe
  C:\Windows\System\NVGmtkl.exe
  2⤵
  PID:8488
- C:\Windows\System\qqYSVlC.exe
  C:\Windows\System\qqYSVlC.exe
  2⤵
  PID:8944
- C:\Windows\System\ecoeOuo.exe
  C:\Windows\System\ecoeOuo.exe
  2⤵
  PID:8648
- C:\Windows\System\QSQwdXL.exe
  C:\Windows\System\QSQwdXL.exe
  2⤵
  PID:1540
- C:\Windows\System\AAazntk.exe
  C:\Windows\System\AAazntk.exe
  2⤵
  PID:9028
- C:\Windows\System\VlwtzmF.exe
  C:\Windows\System\VlwtzmF.exe
  2⤵
  PID:7344
- C:\Windows\System\SxOYCZq.exe
  C:\Windows\System\SxOYCZq.exe
  2⤵
  PID:8444
- C:\Windows\System\JKmuNoU.exe
  C:\Windows\System\JKmuNoU.exe
  2⤵
  PID:8412
- C:\Windows\System\kmvIiZa.exe
  C:\Windows\System\kmvIiZa.exe
  2⤵
  PID:9108
- C:\Windows\System\mLIdntc.exe
  C:\Windows\System\mLIdntc.exe
  2⤵
  PID:8296
- C:\Windows\System\wGCncAo.exe
  C:\Windows\System\wGCncAo.exe
  2⤵
  PID:8884
- C:\Windows\System\msBVXfU.exe
  C:\Windows\System\msBVXfU.exe
  2⤵
  PID:8844
- C:\Windows\System\wqAEqaR.exe
  C:\Windows\System\wqAEqaR.exe
  2⤵
  PID:8584
- C:\Windows\System\xYZrFvo.exe
  C:\Windows\System\xYZrFvo.exe
  2⤵
  PID:8680
- C:\Windows\System\EInonER.exe
  C:\Windows\System\EInonER.exe
  2⤵
  PID:9232
- C:\Windows\System\agMeJMb.exe
  C:\Windows\System\agMeJMb.exe
  2⤵
  PID:9248
- C:\Windows\System\leJLtdx.exe
  C:\Windows\System\leJLtdx.exe
  2⤵
  PID:9264
- C:\Windows\System\aFuhQrs.exe
  C:\Windows\System\aFuhQrs.exe
  2⤵
  PID:9280
- C:\Windows\System\zwkgclc.exe
  C:\Windows\System\zwkgclc.exe
  2⤵
  PID:9296
- C:\Windows\System\vmxIVWs.exe
  C:\Windows\System\vmxIVWs.exe
  2⤵
  PID:9316
- C:\Windows\System\nsojUnz.exe
  C:\Windows\System\nsojUnz.exe
  2⤵
  PID:9408
- C:\Windows\System\rSONrhD.exe
  C:\Windows\System\rSONrhD.exe
  2⤵
  PID:9424
- C:\Windows\System\cignqHj.exe
  C:\Windows\System\cignqHj.exe
  2⤵
  PID:9440
- C:\Windows\System\mjZLfsM.exe
  C:\Windows\System\mjZLfsM.exe
  2⤵
  PID:9456
- C:\Windows\System\HzqEeYP.exe
  C:\Windows\System\HzqEeYP.exe
  2⤵
  PID:9472
- C:\Windows\System\OpXpRJM.exe
  C:\Windows\System\OpXpRJM.exe
  2⤵
  PID:9488
- C:\Windows\System\ELIbRKR.exe
  C:\Windows\System\ELIbRKR.exe
  2⤵
  PID:9504
- C:\Windows\System\wMKHqHD.exe
  C:\Windows\System\wMKHqHD.exe
  2⤵
  PID:9520
- C:\Windows\System\QPMXxHx.exe
  C:\Windows\System\QPMXxHx.exe
  2⤵
  PID:9536
- C:\Windows\System\UZovWEI.exe
  C:\Windows\System\UZovWEI.exe
  2⤵
  PID:9552
- C:\Windows\System\EDGnoCu.exe
  C:\Windows\System\EDGnoCu.exe
  2⤵
  PID:9568
- C:\Windows\System\ZABXaIU.exe
  C:\Windows\System\ZABXaIU.exe
  2⤵
  PID:9584
- C:\Windows\System\HLSmkYN.exe
  C:\Windows\System\HLSmkYN.exe
  2⤵
  PID:9600
- C:\Windows\System\wDxdKuo.exe
  C:\Windows\System\wDxdKuo.exe
  2⤵
  PID:9616
- C:\Windows\System\sqOKifr.exe
  C:\Windows\System\sqOKifr.exe
  2⤵
  PID:9636
- C:\Windows\System\GEvEHHo.exe
  C:\Windows\System\GEvEHHo.exe
  2⤵
  PID:9652
- C:\Windows\System\YzsufLp.exe
  C:\Windows\System\YzsufLp.exe
  2⤵
  PID:9668
- C:\Windows\System\FYldFYF.exe
  C:\Windows\System\FYldFYF.exe
  2⤵
  PID:9684
- C:\Windows\System\mzsVnIT.exe
  C:\Windows\System\mzsVnIT.exe
  2⤵
  PID:9700
- C:\Windows\System\uWgJHbh.exe
  C:\Windows\System\uWgJHbh.exe
  2⤵
  PID:9716
- C:\Windows\System\YYbYTdE.exe
  C:\Windows\System\YYbYTdE.exe
  2⤵
  PID:9732
- C:\Windows\System\ztGWnSN.exe
  C:\Windows\System\ztGWnSN.exe
  2⤵
  PID:9756
- C:\Windows\System\IDWULYE.exe
  C:\Windows\System\IDWULYE.exe
  2⤵
  PID:9772
- C:\Windows\System\GkSmenv.exe
  C:\Windows\System\GkSmenv.exe
  2⤵
  PID:9788
- C:\Windows\System\Zbjnpdh.exe
  C:\Windows\System\Zbjnpdh.exe
  2⤵
  PID:9804
- C:\Windows\System\FUgOdLI.exe
  C:\Windows\System\FUgOdLI.exe
  2⤵
  PID:9820
- C:\Windows\System\SIRiSen.exe
  C:\Windows\System\SIRiSen.exe
  2⤵
  PID:9836
- C:\Windows\System\MXFTqpt.exe
  C:\Windows\System\MXFTqpt.exe
  2⤵
  PID:9852
- C:\Windows\System\iZqKCjf.exe
  C:\Windows\System\iZqKCjf.exe
  2⤵
  PID:9868
- C:\Windows\System\yGdWrCJ.exe
  C:\Windows\System\yGdWrCJ.exe
  2⤵
  PID:9884
- C:\Windows\System\CMtnUyg.exe
  C:\Windows\System\CMtnUyg.exe
  2⤵
  PID:9900
- C:\Windows\System\fbLUooZ.exe
  C:\Windows\System\fbLUooZ.exe
  2⤵
  PID:9920
- C:\Windows\System\nyCDMCM.exe
  C:\Windows\System\nyCDMCM.exe
  2⤵
  PID:9936
- C:\Windows\System\kxZUjFk.exe
  C:\Windows\System\kxZUjFk.exe
  2⤵
  PID:9956
- C:\Windows\System\ffPHJst.exe
  C:\Windows\System\ffPHJst.exe
  2⤵
  PID:9972
- C:\Windows\System\JtBLSYL.exe
  C:\Windows\System\JtBLSYL.exe
  2⤵
  PID:9992
- C:\Windows\System\dSOiUYN.exe
  C:\Windows\System\dSOiUYN.exe
  2⤵
  PID:10008
- C:\Windows\System\wqhEuMj.exe
  C:\Windows\System\wqhEuMj.exe
  2⤵
  PID:10024
- C:\Windows\System\SBVLyFn.exe
  C:\Windows\System\SBVLyFn.exe
  2⤵
  PID:10040
- C:\Windows\System\HPjmoYQ.exe
  C:\Windows\System\HPjmoYQ.exe
  2⤵
  PID:10056
- C:\Windows\System\GtIjwKb.exe
  C:\Windows\System\GtIjwKb.exe
  2⤵
  PID:10076
- C:\Windows\System\zDDYeYY.exe
  C:\Windows\System\zDDYeYY.exe
  2⤵
  PID:10092
- C:\Windows\System\BGUBEft.exe
  C:\Windows\System\BGUBEft.exe
  2⤵
  PID:10108
- C:\Windows\System\VDSvYXw.exe
  C:\Windows\System\VDSvYXw.exe
  2⤵
  PID:10124
- C:\Windows\System\xEtfdKn.exe
  C:\Windows\System\xEtfdKn.exe
  2⤵
  PID:10140
- C:\Windows\System\NcaRsmB.exe
  C:\Windows\System\NcaRsmB.exe
  2⤵
  PID:10156
- C:\Windows\System\wymANHj.exe
  C:\Windows\System\wymANHj.exe
  2⤵
  PID:10172
- C:\Windows\System\yfHMJRo.exe
  C:\Windows\System\yfHMJRo.exe
  2⤵
  PID:10192
- C:\Windows\System\aknFUQA.exe
  C:\Windows\System\aknFUQA.exe
  2⤵
  PID:10208
- C:\Windows\System\oHfpnLS.exe
  C:\Windows\System\oHfpnLS.exe
  2⤵
  PID:10224
- C:\Windows\System\nxSLPFC.exe
  C:\Windows\System\nxSLPFC.exe
  2⤵
  PID:9044
- C:\Windows\System\xBwlOSt.exe
  C:\Windows\System\xBwlOSt.exe
  2⤵
  PID:9276
- C:\Windows\System\uCvhjyD.exe
  C:\Windows\System\uCvhjyD.exe
  2⤵
  PID:9312
- C:\Windows\System\fopMisf.exe
  C:\Windows\System\fopMisf.exe
  2⤵
  PID:9292
- C:\Windows\System\kVbnwic.exe
  C:\Windows\System\kVbnwic.exe
  2⤵
  PID:9224
- C:\Windows\System\TpCzBDt.exe
  C:\Windows\System\TpCzBDt.exe
  2⤵
  PID:9348
- C:\Windows\System\xQcDJBJ.exe
  C:\Windows\System\xQcDJBJ.exe
  2⤵
  PID:9364
- C:\Windows\System\MhzLUUN.exe
  C:\Windows\System\MhzLUUN.exe
  2⤵
  PID:9388
- C:\Windows\System\UGCvPgd.exe
  C:\Windows\System\UGCvPgd.exe
  2⤵
  PID:9396
- C:\Windows\System\sdtnoWS.exe
  C:\Windows\System\sdtnoWS.exe
  2⤵
  PID:9452
- C:\Windows\System\CKQudPx.exe
  C:\Windows\System\CKQudPx.exe
  2⤵
  PID:9544
- C:\Windows\System\AQKuxWn.exe
  C:\Windows\System\AQKuxWn.exe
  2⤵
  PID:9404
- C:\Windows\System\gvfTxEz.exe
  C:\Windows\System\gvfTxEz.exe
  2⤵
  PID:9560
- C:\Windows\System\XHcZpBM.exe
  C:\Windows\System\XHcZpBM.exe
  2⤵
  PID:9468
- C:\Windows\System\DEmBWrm.exe
  C:\Windows\System\DEmBWrm.exe
  2⤵
  PID:9612
- C:\Windows\System\ARhOTqn.exe
  C:\Windows\System\ARhOTqn.exe
  2⤵
  PID:9632
- C:\Windows\System\ZZLOKPs.exe
  C:\Windows\System\ZZLOKPs.exe
  2⤵
  PID:9676
- C:\Windows\System\cRvWVFg.exe
  C:\Windows\System\cRvWVFg.exe
  2⤵
  PID:9740
- C:\Windows\System\PQHnhnX.exe
  C:\Windows\System\PQHnhnX.exe
  2⤵
  PID:9784
- C:\Windows\System\vzDnUCl.exe
  C:\Windows\System\vzDnUCl.exe
  2⤵
  PID:9848
- C:\Windows\System\CiVMPoM.exe
  C:\Windows\System\CiVMPoM.exe
  2⤵
  PID:9728
- C:\Windows\System\CgWJnTV.exe
  C:\Windows\System\CgWJnTV.exe
  2⤵
  PID:9796
- C:\Windows\System\wpqxuTq.exe
  C:\Windows\System\wpqxuTq.exe
  2⤵
  PID:9880
- C:\Windows\System\hzPBNHM.exe
  C:\Windows\System\hzPBNHM.exe
  2⤵
  PID:9944
- C:\Windows\System\wDqhJVu.exe
  C:\Windows\System\wDqhJVu.exe
  2⤵
  PID:9968
- C:\Windows\System\AedIEkg.exe
  C:\Windows\System\AedIEkg.exe
  2⤵
  PID:9984
- C:\Windows\System\nYKdtpS.exe
  C:\Windows\System\nYKdtpS.exe
  2⤵
  PID:9892
- C:\Windows\System\EwNuDnV.exe
  C:\Windows\System\EwNuDnV.exe
  2⤵
  PID:10052
- C:\Windows\System\jIRKriU.exe
  C:\Windows\System\jIRKriU.exe
  2⤵
  PID:10072
- C:\Windows\System\BwPhIJf.exe
  C:\Windows\System\BwPhIJf.exe
  2⤵
  PID:10120
- C:\Windows\System\CEBfxYB.exe
  C:\Windows\System\CEBfxYB.exe
  2⤵
  PID:10184
- C:\Windows\System\xhVVzcA.exe
  C:\Windows\System\xhVVzcA.exe
  2⤵
  PID:10036

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\AJjNXBx.exe

Filesize
1.9MB

MD5
9efb381ad2367048201daf0d831f341e

SHA1
84280cfbc85a289ecf9d71bee615ce010f67be43

SHA256
a37572458761db58dbd2c5cc216b725cec1e45aa725965defeb1be63d4d413b9

SHA512
300e3dc15b9aeed54eb42dab87df444a49b8f5c98000ebe367b1c12336df57b3cc2f1170fecd9f470d723877f12a60d46b6c04994c06d7ec0b0d3f1cb813ee0e

Download Submit
C:\Windows\system\AcwCriD.exe

Filesize
1.9MB

MD5
e69089de3cc09c96e8b85803bd4498f7

SHA1
357b0a2a239ee509d421215e968b8e70f6e9ce72

SHA256
70bfdd21ba0cfac113c2b00049775c3b42303902c4085d8107e9448adb3954ff

SHA512
0714eb0cbc4a8e80d71ed34210207f8f35f2fe78e6cbc7a2ec892d254a00cf5d146810de09c69734283631e4cc36fb3bae5b8090b5170755fa3b2f8036858032

Download Submit
C:\Windows\system\BSPWjPj.exe

Filesize
1.9MB

MD5
1885c5fa36ca8a418910be26f586c7d7

SHA1
df111caadc330d8e58285b8144e3aed2712f52df

SHA256
d095efebcabcb04c424c1243ddd3486d2df792e48a5afd7f536edf0f21792d9a

SHA512
32255faee857c2bf8074a0fbf65a8e4e2d2d2448bc8be3db886f82423c10474a5799ec588b6f9d8c970da9bfe55ef78d6595ed1e00e0371a48388b966d452437

Download Submit
C:\Windows\system\EbaLNxX.exe

Filesize
1.9MB

MD5
577ca74dd4dd6c118ff24bbd4d743462

SHA1
1fdbefa12cb3b39ef4c3aa19b147d63316bdc2d7

SHA256
94a254154ba6593b0234d287aec4bf6885fce5183a55b6908e0affa5fca4dfcd

SHA512
3bbb8a5fc7efc5a287f8603e9a5ad59e04acf59c2f8bf8d6e48453ffa2aace0f86f3f8eafe59de2b43eb5042a4d63d118551f4a53292f3f416baa47bc05effdb

Download Submit
C:\Windows\system\FOTQbTR.exe

Filesize
1.9MB

MD5
30818733d170bd2e44b29528b6963b5e

SHA1
2af60681c6916782b8a64f938f6cca17cccc98a4

SHA256
5dd70cfb5ece77f18f6391ef8bb46321fca64fd600dfd86ebbf3b2d3e3943094

SHA512
ba374a85e6851bc4d09c26d3a019ca69099813acb4c42c633349ea7a3a07ded765bfd709d623dbd007b4cecc05e034e96630fc1aa0ff0f6b673ec47b2c562b40

Download Submit
C:\Windows\system\FrDmOYw.exe

Filesize
1.9MB

MD5
2c42d3c6acd75f50abed587f7b774ace

SHA1
c613a0492ea9bc83409a029c3e48fff8bcf9c206

SHA256
ca9f7d5af0f92a8aa1e0d0e40a05a3508c1f39a4b34ea76207c895ca77caf0ae

SHA512
26b0359f46382c9e3e0150aee997aa0e372d3e8011881e25b48a8686c7ba384f234eef68a93566d5fcd62abef2e9a4c63b66957f30c9df65a682ee2fbe9b399f

Download Submit
C:\Windows\system\GRjKuOB.exe

Filesize
1.9MB

MD5
4f6dfce6cdfcdcbeeb270ca04b369da9

SHA1
2956649420e4e4641230c135e81bff70dba691b0

SHA256
c98981a19cb35588ed6241405e8c380fca91452777bd3586f505a6b3eb68f333

SHA512
8dca3ddd39898ee8c8b148d055797a7eaa349f828d02b3bddbfdf4225e36d39602eba32dcb980a66bc20ef05e0cbbe3e7013602be36e6a687dd7f828b0817e05

Download Submit
C:\Windows\system\STKjeQM.exe

Filesize
1.9MB

MD5
cf59e5b3317527cf422c9acd52954eac

SHA1
8f76abc4a207546f546bd6b2ec928ddfd9a2fad7

SHA256
60ed7227be8fef276eaca025099156ded49cd09076de36065952a2ed5a1835df

SHA512
bdfd9c1a97f8be60e7c2d17a0f91046dacef1dc351704cb705ead7ea0a15133292805f234c574f2337651516b1967f9dbe2672da036f9431612e2a633532884a

Download Submit
C:\Windows\system\SeTYjUL.exe

Filesize
1.9MB

MD5
db8a1e1ae1c66a844af5d7de7af15b63

SHA1
cb4fff62524f45b57c8d3521166fbdd522d0e8dd

SHA256
9338a55454c7771fd3285648444055e5dd2433b617f24b17c2f8e0f0d1318cb3

SHA512
3a7cc63c769c161b5befdadf522b2a6378e1eeaf0a601c05a7e0154dbfe71280e0aee3ea587f03906fcc19accdc2876b8c66ed4aabfaa06a8a7f3a2de2880cdf

Download Submit
C:\Windows\system\UYSvMon.exe

Filesize
1.9MB

MD5
7864be7f6120455e85e6485cfcc827cb

SHA1
42671590e55d7b7c3aa48f24399bcebfbd64a0b8

SHA256
3ce15db118a75194be61334cd6b8e91de65d895c5c281c11568d26081becb4b2

SHA512
5c9239f712402b8a7a1069545cc4fa9e9cf02fa4a25261aa341a4fd98457f319669d747936bc7aba9162e5d6681e861ec66908f81eebc5e745623dcf369598e6

Download Submit
C:\Windows\system\WIRZAoC.exe

Filesize
1.9MB

MD5
3a750142fd7e4d1fbefaad198f1bfc6c

SHA1
aea83ba644dbec52b817ebcf00253262c9e1a67e

SHA256
3e76b0c2cc49e02524049b6cedce9f8a4704d52e97e86b1ad03d42ceb103dca0

SHA512
b7a14a48d3cd592cfed2ff8996cb504f1f73933c4c7e0289d1cec1ea26bf30908ce52454700b198593562de1e1cf5b71ef9662ef15035435833cef38eb19fc70

Download Submit
C:\Windows\system\WKvvxfx.exe

Filesize
1.9MB

MD5
bc6bad3f6e26a6172f35e1365899a3da

SHA1
873330ce6ec43b4eac394100f053086348c47ab0

SHA256
d158a6848252555e48c9885b163f39928c7f08704a60c174340e2d4039ecf735

SHA512
979b61116e04e137997b1925ecb1ee482807c237a05c71af7848bf81a9b6d8606e32bc9a10e8f0b5a0da34971004cdb92cc25db02f2e4f9f4eeeb089f2dd323c

Download Submit
C:\Windows\system\YEmAgSu.exe

Filesize
1.9MB

MD5
c283ce24e1e149fb30b60adf391fee28

SHA1
a6eb0ef24c2eff7fbbe48bac1e9a3abc0a263ca8

SHA256
c8efa5531efb0bdf4c9910e744871d31d380086aa9c4fffdc89b0d7af4bb437c

SHA512
b0b6582b906e76fb0235a51e18c2e4e023ed098707e0430a8d6aad56b6e01ce314a9c099061f300d020afb1415d00c6d850a3f9b62f7a0f0e9a3aca80756c641

Download Submit
C:\Windows\system\ZsJTnJO.exe

Filesize
1.9MB

MD5
d54df348a582a30a0d6fe78d36dcaed8

SHA1
2e02218bf399f71f65621d2a6253bc933d40e102

SHA256
cf3b52ce6ce9201f9c27d5cddfd2fe878a4d89254af91f5716ba5e71a04a56b0

SHA512
9fa134476adc112df4db32c7fe492d0255ecc1e168497c7faac353fa589a698ed3de1b7cb34e7aefed52b77c7140b0c5400928d341e8a4a75393afab9729bf86

Download Submit
C:\Windows\system\cyMxeBv.exe

Filesize
1.9MB

MD5
db3d8b0f1eb17503fbfb9c12d4849279

SHA1
5ad37fc653e9c1412325e3c180dc53a709b1eb96

SHA256
6b23759e8859dc74075304c1c1461bc4b22eec15e5c46a19b4a1dd9f24db4a41

SHA512
a27b1fc6f8ac053ddf7bcf1b594f9f5e14ca08dd223072773fe316772f46fcb74aa262dc02a1f079e53a2d8fc7620fc164fe8a1db8f6fd949226b5c240fb09b4

Download Submit
C:\Windows\system\fuFKxcV.exe

Filesize
1.9MB

MD5
75ff82c6a1bd59b855e3ebdb953ae68f

SHA1
e2e18ed070679fea4504d53ca59607da6d56f0b1

SHA256
df08ead141a22061ff60d2cee4d8be1b857eea5878d23dd326c9cdf1e8badfe7

SHA512
e890a32b154da76b7f1735f73ac187e8639644b3fd966135ef8b82232df1e8f68fa47b52c0adabc8e81d063ebd12c10bc03b5ebf9bf5570f6841042b484ad904

Download Submit
C:\Windows\system\fwnHbsD.exe

Filesize
1.9MB

MD5
ebc0b8b6f6f64200ee76313464abdfad

SHA1
3864b5ebc3a17453ea1b95cf9cc75fb874386c5a

SHA256
c6890931a7c6c047044be9043012bbab36fe2ef76045e414f508c64ea25aee14

SHA512
4647502065acd4d6316d5e298e15d40cb46a1db193717cc280810c14bd0ae831e7962df712665fb13a5e9d0face0af121f21fa42809188fbed010562c61a28dd

Download Submit
C:\Windows\system\jPshAPg.exe

Filesize
1.9MB

MD5
1e50a70d602a52f87c2f61b06e47d05e

SHA1
2a4f71638667409da4caa745eb0deb8044c3048d

SHA256
2c8490d57086e1834afd2deab6147a50d943c3bf940b9229131594adc2a3e42b

SHA512
d4d93b9a769821f839e2549f5320f125492e124a50657979c43af705cff10393af9f8e08862110f531818b9b382cbbb67b18eab781bee0907497ceb61b8effd0

Download Submit
C:\Windows\system\jShhqre.exe

Filesize
1.9MB

MD5
f64a9b99dea63efadef8b74f27d3756d

SHA1
f776b132348fd9629afd77aa2b4fe672b819ca3a

SHA256
4c5b4b623436f015479ec69b0ba57cdfe8244769b586a45b7378e57fb658b164

SHA512
c2d4548d3fe9583a300e27a5c3213e1efc371c146b6cb2d635d961511d68c65ab91053e660a7e1020d404bd14a53d965660db1b94a59c57cfcdb9b29e5228fb7

Download Submit
C:\Windows\system\mRTSawc.exe

Filesize
1.9MB

MD5
2c297c087111305a6acd5e319719ea15

SHA1
f760a594a90e7f9aa2e2c184e0c926708780a2bd

SHA256
f930d0cc172da41cc485b6d070e92991f67060481127e600c22d9f5801030eae

SHA512
5d5a930142ef90e58c45dee15c63adca458774e7ce21f473616b43d134fb08549d8edf2c60b1e9a7afe7a3d17d3e79d7badd918e4f0ab0fcf00faf9a9ab87931

Download Submit
C:\Windows\system\nDrtDeP.exe

Filesize
1.9MB

MD5
26eb5eee8af00b114423ffb7c5f3624e

SHA1
aed86c7f39bead21fc58a2601fd5f4f9f4fd3ded

SHA256
99a42e22894a1662a699a2df87e5d80d697a4493853ab01bb32aaaf56fc95106

SHA512
356a968a3dfd35e5ae11e5de398a44219eb9054a244208f69a3755b5c04c61108a8e62d7937bd3c190daaf849a70dcfea77ad65cc76405275f473e66694f1984

Download Submit
C:\Windows\system\rzpXDzO.exe

Filesize
1.9MB

MD5
2f648a83f117bd20ec7c43489f610c3a

SHA1
9179e143cc143bd6abc081528d84d48d4049a17f

SHA256
c9b62ad4d66f143999314ac7a55ac6a8e7953cedb84375b3ac9120d826e855cc

SHA512
f640ee4bf0ea649d0874ca4ae67d66524f69e6c0aef08911ea739f5d1ea87cf47f5c213a5a34fa96b8bb97b9b0fa3dfa7bb943e85f67123eb1ea9e6573d38fed

Download Submit
C:\Windows\system\tjpehbw.exe

Filesize
1.9MB

MD5
69b56b3549231fb2747c6431a24c5343

SHA1
ea54558c19d651b74ed3c35405c9587245e47af5

SHA256
d993cbd6d24314789d2b595e7afa296ac3063187898e8e324be7aadec6f68609

SHA512
e69585a958510a2d4874b48a229e0764d653e65da849072501f3efc0fef1dd7b2751b313625373b980d3079bb9858913664bcdcd4d46258a2435b08ffca708fc

Download Submit
C:\Windows\system\tszWTZQ.exe

Filesize
1.9MB

MD5
522416436c5cea639af8ce75f0ffa9c4

SHA1
48b730dab6df4ced9b0add41448d3d335a7a45b6

SHA256
66e2640eeb2dc7b0e5b48317c3c6a42daf75d5f2e7624a124019ceb1c633efdd

SHA512
40354972e59cd6c1a2929b8fb632e43b0a7f21320ba448af07b6cf75d1eea56a12f02d3effd8860dd15ee49b36e9e54acaaf63766ba9a009b2f1311bdae44e51

Download Submit
C:\Windows\system\xAcIiyV.exe

Filesize
1.9MB

MD5
1e37d813023398febdf06a2a94b2aa44

SHA1
b4e5f4c62f9c302f5cf890cf67f490af3ad6d055

SHA256
dec41816a8f65ccc163c4b170dc448fb448b210af5bf3081a955b29024399662

SHA512
8f4b3d776c3dfad134a0811bcd42961267fea44f862c1f74eb9ed16cb8547f69bb890e50f240695f2b4619b6a4e3a0801cc2cb926642e1d944d16a31b9cf42ce

Download Submit
C:\Windows\system\yvqtRiN.exe

Filesize
1.9MB

MD5
2c3fd83cab86d2252596463a930ce56b

SHA1
143aa49d9fb637e2097396a4a1a3a4cdba087c50

SHA256
aff56a90620fd8f4670258422ae71dd4660a0f3585f7fd162a9c6c0cffb9c5c9

SHA512
a7a962a62fa60fbfda0118d63d5c7a0813ac8b269066389677ebfbc1316d168a488798adf544818a42c2a7cd61ed1ac8b211ee82e6d4420aad5893c8f09f9765

Download Submit
\Windows\system\BMGDjcn.exe

Filesize
1.9MB

MD5
7a3c1a563f74dedd130aaf7c86c2e281

SHA1
537a86e7c9f23ee6b19895a96f98f8f96debd9eb

SHA256
148716e41bc0f46fcdc26f98702c19ea9c6d5cc4688ea6e5764b0583a29bfc05

SHA512
08b6f1dd45abb48a765d70a48c49d9b0e84f73318ccf10df6a2edf8e8426e01e1067d430cb8867f81dac59062b7ecc1b55802bed119c02717e549886a4c16b50

Download Submit
\Windows\system\MQNwAUr.exe

Filesize
1.9MB

MD5
54f1258d36e7baae2e235bcf79cbb7b5

SHA1
13cf9d74b7fff5437256e962ad58676b0d76fb2a

SHA256
03e17b1c6e4bab80a4ed72e95863e2ac135cbe0639df18e63ebd2e4a8fd8cafb

SHA512
c4cc78c8a3c1befc8988b233096b93a69773eddaa805ecf5d9b30b40f13bbd4c1b9174650192af9a74def6579cfdbe5e38914194ac70c60b5e01c58c436bf774

Download Submit
\Windows\system\MucHlIT.exe

Filesize
1.9MB

MD5
9b90c016a460ed12b1925eec61c42a9a

SHA1
eaaf468f15e8067892a8f5c98948481a6e20e300

SHA256
725d281cdba734115b2f12ae2d0955d12066bc560cf447b917488185de2f2a44

SHA512
00ba3e92ea8ebbcd20f3efef87dd2d660d3975eb9a9b6ef3c9b1ad57aff3024588ca80ce4fb2a1226e5b2e8ebd193718ba058fd271cc05be64d911d8fbba0491

Download Submit
\Windows\system\RrxgBSI.exe

Filesize
1.9MB

MD5
9a9c1c1f9ee6be14dc827c45c9467ddf

SHA1
a547ba886a893f60f1981fd77870445898daf7db

SHA256
a61c950d409cb85c4f4a250942da725278d199c7a4bdec5b2ddca486065efef6

SHA512
5a4879c20c66e6ab99869f2baf88932b1eefde422fb3fdc47f6b53362bc7874c78a314e920a417e054749a6cdb93c67602fef60b435b084264e76248226b0f12

Download Submit
\Windows\system\byXEiZT.exe

Filesize
1.9MB

MD5
90cbf1148ae94480714b10313d3008bf

SHA1
9f98216772f2fbe207f063b515472bd13c8d4b8d

SHA256
ec0a67640a7338f49cbe615398a3a032b79d84a10cc8c84dcf68c035f1189270

SHA512
0eb2df30cf9fb383e61acef0ee574f5b8525ec03c9903530e070f0f0ee9af81a4f522acd3dcc8e03cd25efae645d0e7d70199cbbc4b4822f0dc3b98d4140c434

Download Submit
\Windows\system\ujTMWjn.exe

Filesize
1.9MB

MD5
f8c9ba40342e3731769972546cefdab0

SHA1
9e809db75a532d9e82bdab199a5aa97b3e8381d5

SHA256
ef773e74996c2b47ab65159758289034c6766d8f4ad25cc842c09253e3daaff1

SHA512
3482562c3e506dd45a8afd849252f125d99015fd91f62ca396c13593b10bc82ff5b8d45bd4e6b862acb355c442fa214b8ae821a1eeb50f6112ce53d48393e790

Download Submit
memory/1028-92-0x0000000002530000-0x0000000002922000-memory.dmp

Filesize
3.9MB

Download
memory/1028-82-0x0000000002530000-0x0000000002922000-memory.dmp

Filesize
3.9MB

Download
memory/1028-0-0x0000000000100000-0x0000000000110000-memory.dmp

Filesize
64KB

Download
memory/1028-91-0x000000013FBB0000-0x000000013FFA2000-memory.dmp

Filesize
3.9MB

Download
memory/1028-90-0x000000013FA30000-0x000000013FE22000-memory.dmp

Filesize
3.9MB

Download
memory/1028-89-0x0000000002530000-0x0000000002922000-memory.dmp

Filesize
3.9MB

Download
memory/1028-88-0x000000013FA70000-0x000000013FE62000-memory.dmp

Filesize
3.9MB

Download
memory/1028-87-0x0000000002530000-0x0000000002922000-memory.dmp

Filesize
3.9MB

Download
memory/1028-73-0x000000013F0D0000-0x000000013F4C2000-memory.dmp

Filesize
3.9MB

Download
memory/1028-1-0x000000013F5A0000-0x000000013F992000-memory.dmp

Filesize
3.9MB

Download
memory/1028-5-0x000000013FCC0000-0x00000001400B2000-memory.dmp

Filesize
3.9MB

Download
memory/1028-97-0x000000013FD90000-0x0000000140182000-memory.dmp

Filesize
3.9MB

Download
memory/1028-81-0x000000013FD00000-0x00000001400F2000-memory.dmp

Filesize
3.9MB

Download
memory/1028-80-0x0000000002530000-0x0000000002922000-memory.dmp

Filesize
3.9MB

Download
memory/1028-75-0x000000013FE20000-0x0000000140212000-memory.dmp

Filesize
3.9MB

Download
memory/1028-78-0x000000013FA10000-0x000000013FE02000-memory.dmp

Filesize
3.9MB

Download
memory/1028-77-0x000000013FC50000-0x0000000140042000-memory.dmp

Filesize
3.9MB

Download
memory/1028-94-0x0000000002530000-0x0000000002922000-memory.dmp

Filesize
3.9MB

Download
memory/1508-253-0x0000000002870000-0x0000000002878000-memory.dmp

Filesize
32KB

Download
memory/1508-252-0x000000001B730000-0x000000001BA12000-memory.dmp

Filesize
2.9MB

Download
memory/1732-63-0x000000013FCC0000-0x00000001400B2000-memory.dmp

Filesize
3.9MB

Download
memory/1732-4541-0x000000013FCC0000-0x00000001400B2000-memory.dmp

Filesize
3.9MB

Download
memory/2360-76-0x000000013F0D0000-0x000000013F4C2000-memory.dmp

Filesize
3.9MB

Download
memory/2360-4538-0x000000013F0D0000-0x000000013F4C2000-memory.dmp

Filesize
3.9MB

Download
memory/2532-96-0x000000013FA30000-0x000000013FE22000-memory.dmp

Filesize
3.9MB

Download
memory/2532-4539-0x000000013FA30000-0x000000013FE22000-memory.dmp

Filesize
3.9MB

Download
memory/2568-4540-0x000000013FA70000-0x000000013FE62000-memory.dmp

Filesize
3.9MB

Download
memory/2568-95-0x000000013FA70000-0x000000013FE62000-memory.dmp

Filesize
3.9MB

Download
memory/2612-4608-0x000000013FD90000-0x0000000140182000-memory.dmp

Filesize
3.9MB

Download
memory/2612-85-0x000000013FD90000-0x0000000140182000-memory.dmp

Filesize
3.9MB

Download
memory/2684-84-0x000000013F6B0000-0x000000013FAA2000-memory.dmp

Filesize
3.9MB

Download
memory/2684-4535-0x000000013F6B0000-0x000000013FAA2000-memory.dmp

Filesize
3.9MB

Download
memory/2784-83-0x000000013F950000-0x000000013FD42000-memory.dmp

Filesize
3.9MB

Download
memory/2784-4536-0x000000013F950000-0x000000013FD42000-memory.dmp

Filesize
3.9MB

Download
memory/2816-4569-0x000000013FC50000-0x0000000140042000-memory.dmp

Filesize
3.9MB

Download
memory/2816-79-0x000000013FC50000-0x0000000140042000-memory.dmp

Filesize
3.9MB

Download