xmrig | 69e3ed60e49f0ac6a664628aa928029ec05f25edf22ab2782df2c22453c785b7

Analysis

max time kernel
150s
max time network
143s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
08/05/2024, 02:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

a439d9bbe72b0270761a229e5f878270_NEIKI.exe
Size

1.5MB
MD5

a439d9bbe72b0270761a229e5f878270
SHA1

15b173bbdda030428974a0ae8d5a034c16c6ecf9
SHA256

69e3ed60e49f0ac6a664628aa928029ec05f25edf22ab2782df2c22453c785b7
SHA512

456ced3b271c847fa59c1c1335fd3fce5494f048da879e1b021ac7f6168b920ef7c0768318077eb3a7904fdbe0c2adbcb8ad2a29e503f518d2cabc50ea0b60a9
SSDEEP

24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjhMgXQP9+G5KBe2ulQ91Ok8:Lz071uv4BPMkHC0INx29L5KQ2uoOb

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 24 IoCs

miner

resource	yara_rule
behavioral1/memory/2536-87-0x000000013FA00000-0x000000013FDF2000-memory.dmp	xmrig
behavioral1/memory/1664-112-0x000000013FFD0000-0x00000001403C2000-memory.dmp	xmrig
behavioral1/memory/2420-141-0x000000013FDB0000-0x00000001401A2000-memory.dmp	xmrig
behavioral1/memory/2644-132-0x000000013FD30000-0x0000000140122000-memory.dmp	xmrig
behavioral1/memory/1200-154-0x000000013FE70000-0x0000000140262000-memory.dmp	xmrig
behavioral1/memory/644-153-0x000000013F7F0000-0x000000013FBE2000-memory.dmp	xmrig
behavioral1/memory/1664-151-0x000000013FE70000-0x0000000140262000-memory.dmp	xmrig
behavioral1/memory/1964-150-0x000000013F8A0000-0x000000013FC92000-memory.dmp	xmrig
behavioral1/memory/2480-147-0x000000013FA80000-0x000000013FE72000-memory.dmp	xmrig
behavioral1/memory/2312-118-0x000000013FFD0000-0x00000001403C2000-memory.dmp	xmrig
behavioral1/memory/2620-103-0x000000013F5D0000-0x000000013F9C2000-memory.dmp	xmrig
behavioral1/memory/2520-90-0x000000013FBD0000-0x000000013FFC2000-memory.dmp	xmrig
behavioral1/memory/2936-13-0x000000013FDD0000-0x00000001401C2000-memory.dmp	xmrig
behavioral1/memory/2520-5779-0x000000013FBD0000-0x000000013FFC2000-memory.dmp	xmrig
behavioral1/memory/2480-5805-0x000000013FA80000-0x000000013FE72000-memory.dmp	xmrig
behavioral1/memory/2420-5868-0x000000013FDB0000-0x00000001401A2000-memory.dmp	xmrig
behavioral1/memory/644-5905-0x000000013F7F0000-0x000000013FBE2000-memory.dmp	xmrig
behavioral1/memory/2620-5831-0x000000013F5D0000-0x000000013F9C2000-memory.dmp	xmrig
behavioral1/memory/1964-5816-0x000000013F8A0000-0x000000013FC92000-memory.dmp	xmrig
behavioral1/memory/1200-5808-0x000000013FE70000-0x0000000140262000-memory.dmp	xmrig
behavioral1/memory/2312-5803-0x000000013FFD0000-0x00000001403C2000-memory.dmp	xmrig
behavioral1/memory/2644-5801-0x000000013FD30000-0x0000000140122000-memory.dmp	xmrig
behavioral1/memory/2936-5762-0x000000013FDD0000-0x00000001401C2000-memory.dmp	xmrig
behavioral1/memory/2536-5750-0x000000013FA00000-0x000000013FDF2000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
1980	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
2936	mVuyaQY.exe
2536	vzSYjbt.exe
2520	cDAPpRs.exe
2620	AeEbsYS.exe
2312	KQveTir.exe
2644	XbBRnEl.exe
2420	FZyAOJt.exe
2480	sSEYtjn.exe
1964	qUlqMrU.exe
644	XVBobKe.exe
1200	WFTXmNJ.exe
2684	ODLuPec.exe
2760	jpUhIZR.exe
2680	czIxjWc.exe
1620	diOuVkS.exe
1844	rlHQjig.exe
1544	jnfPSMZ.exe
2152	LRaLdAS.exe
1708	kvrqDHV.exe
2236	AbMZKtf.exe
2388	fQrigTe.exe
792	brVhKnO.exe
2504	nNpcWsI.exe
2296	SlDGlGi.exe
1796	LaOKGHH.exe
1552	AMFGPBs.exe
2160	DCcMvWn.exe
2112	xBkdLSH.exe
472	NfyHsLZ.exe
3060	SuvHcVd.exe
2228	kgEpwzl.exe
604	ZvCAUof.exe
1892	ZkfFwWf.exe
1932	DVfgHnr.exe
1840	YjTAfXc.exe
2364	rllBEZM.exe
1164	XqYfnOc.exe
1888	zoYSaHG.exe
936	VemanUS.exe
2352	IyZLVxf.exe
780	piNulUp.exe
344	MJhMmre.exe
2188	rLKwSnD.exe
932	oXWHosS.exe
1668	ZRyiStG.exe
576	MkXNuYe.exe
1604	YdjoQrm.exe
1940	UUWVMTI.exe
2796	ZjHbFSn.exe
1652	pjUhHaF.exe
2548	PskUMxQ.exe
2416	NDyUOKf.exe
2280	smCXYLa.exe
912	wBYBEgq.exe
1560	JBwfwMj.exe
2940	riytUtr.exe
2780	NWnHpQX.exe
1536	rVbEjbn.exe
2688	ZHUMwqk.exe
2568	LpuTpCX.exe
2672	bwifePE.exe
2208	jETirGN.exe
2716	URraYun.exe
836	QXqsgwc.exe

Loads dropped DLL 64 IoCs

pid	Process
1664	a439d9bbe72b0270761a229e5f878270_NEIKI.exe
1664	a439d9bbe72b0270761a229e5f878270_NEIKI.exe
1664	a439d9bbe72b0270761a229e5f878270_NEIKI.exe
1664	a439d9bbe72b0270761a229e5f878270_NEIKI.exe
1664	a439d9bbe72b0270761a229e5f878270_NEIKI.exe
1664	a439d9bbe72b0270761a229e5f878270_NEIKI.exe
1664	a439d9bbe72b0270761a229e5f878270_NEIKI.exe
1664	a439d9bbe72b0270761a229e5f878270_NEIKI.exe
1664	a439d9bbe72b0270761a229e5f878270_NEIKI.exe
1664	a439d9bbe72b0270761a229e5f878270_NEIKI.exe
1664	a439d9bbe72b0270761a229e5f878270_NEIKI.exe
1664	a439d9bbe72b0270761a229e5f878270_NEIKI.exe
1664	a439d9bbe72b0270761a229e5f878270_NEIKI.exe
1664	a439d9bbe72b0270761a229e5f878270_NEIKI.exe
1664	a439d9bbe72b0270761a229e5f878270_NEIKI.exe
1664	a439d9bbe72b0270761a229e5f878270_NEIKI.exe
1664	a439d9bbe72b0270761a229e5f878270_NEIKI.exe
1664	a439d9bbe72b0270761a229e5f878270_NEIKI.exe
1664	a439d9bbe72b0270761a229e5f878270_NEIKI.exe
1664	a439d9bbe72b0270761a229e5f878270_NEIKI.exe
1664	a439d9bbe72b0270761a229e5f878270_NEIKI.exe
1664	a439d9bbe72b0270761a229e5f878270_NEIKI.exe
1664	a439d9bbe72b0270761a229e5f878270_NEIKI.exe
1664	a439d9bbe72b0270761a229e5f878270_NEIKI.exe
1664	a439d9bbe72b0270761a229e5f878270_NEIKI.exe
1664	a439d9bbe72b0270761a229e5f878270_NEIKI.exe
1664	a439d9bbe72b0270761a229e5f878270_NEIKI.exe
1664	a439d9bbe72b0270761a229e5f878270_NEIKI.exe
1664	a439d9bbe72b0270761a229e5f878270_NEIKI.exe
1664	a439d9bbe72b0270761a229e5f878270_NEIKI.exe
1664	a439d9bbe72b0270761a229e5f878270_NEIKI.exe
1664	a439d9bbe72b0270761a229e5f878270_NEIKI.exe
1664	a439d9bbe72b0270761a229e5f878270_NEIKI.exe
1664	a439d9bbe72b0270761a229e5f878270_NEIKI.exe
1664	a439d9bbe72b0270761a229e5f878270_NEIKI.exe
1664	a439d9bbe72b0270761a229e5f878270_NEIKI.exe
1664	a439d9bbe72b0270761a229e5f878270_NEIKI.exe
1664	a439d9bbe72b0270761a229e5f878270_NEIKI.exe
1664	a439d9bbe72b0270761a229e5f878270_NEIKI.exe
1664	a439d9bbe72b0270761a229e5f878270_NEIKI.exe
1664	a439d9bbe72b0270761a229e5f878270_NEIKI.exe
1664	a439d9bbe72b0270761a229e5f878270_NEIKI.exe
1664	a439d9bbe72b0270761a229e5f878270_NEIKI.exe
1664	a439d9bbe72b0270761a229e5f878270_NEIKI.exe
1664	a439d9bbe72b0270761a229e5f878270_NEIKI.exe
1664	a439d9bbe72b0270761a229e5f878270_NEIKI.exe
1664	a439d9bbe72b0270761a229e5f878270_NEIKI.exe
1664	a439d9bbe72b0270761a229e5f878270_NEIKI.exe
1664	a439d9bbe72b0270761a229e5f878270_NEIKI.exe
1664	a439d9bbe72b0270761a229e5f878270_NEIKI.exe
1664	a439d9bbe72b0270761a229e5f878270_NEIKI.exe
1664	a439d9bbe72b0270761a229e5f878270_NEIKI.exe
1664	a439d9bbe72b0270761a229e5f878270_NEIKI.exe
1664	a439d9bbe72b0270761a229e5f878270_NEIKI.exe
1664	a439d9bbe72b0270761a229e5f878270_NEIKI.exe
1664	a439d9bbe72b0270761a229e5f878270_NEIKI.exe
1664	a439d9bbe72b0270761a229e5f878270_NEIKI.exe
1664	a439d9bbe72b0270761a229e5f878270_NEIKI.exe
1664	a439d9bbe72b0270761a229e5f878270_NEIKI.exe
1664	a439d9bbe72b0270761a229e5f878270_NEIKI.exe
1664	a439d9bbe72b0270761a229e5f878270_NEIKI.exe
1664	a439d9bbe72b0270761a229e5f878270_NEIKI.exe
1664	a439d9bbe72b0270761a229e5f878270_NEIKI.exe
1664	a439d9bbe72b0270761a229e5f878270_NEIKI.exe

UPX packed file 56 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1664-0-0x000000013F470000-0x000000013F862000-memory.dmp	upx
behavioral1/files/0x000b0000000144e0-6.dat	upx
behavioral1/files/0x003400000001480e-16.dat	upx
behavioral1/files/0x001800000000558a-18.dat	upx
behavioral1/files/0x0007000000014eb9-34.dat	upx
behavioral1/files/0x0008000000014dae-29.dat	upx
behavioral1/files/0x000700000001502c-38.dat	upx
behavioral1/files/0x00070000000153c7-44.dat	upx
behavioral1/files/0x000900000001540d-49.dat	upx
behavioral1/files/0x0006000000015ce3-61.dat	upx
behavioral1/files/0x0006000000015cf5-64.dat	upx
behavioral1/files/0x0006000000015d44-81.dat	upx
behavioral1/memory/2536-87-0x000000013FA00000-0x000000013FDF2000-memory.dmp	upx
behavioral1/files/0x000600000001654a-126.dat	upx
behavioral1/files/0x0006000000016813-137.dat	upx
behavioral1/files/0x0006000000016c1d-148.dat	upx
behavioral1/files/0x0006000000015d4c-174.dat	upx
behavioral1/files/0x0006000000016476-185.dat	upx
behavioral1/files/0x00060000000161b3-183.dat	upx
behavioral1/files/0x0006000000015fa7-181.dat	upx
behavioral1/files/0x0006000000015e6d-178.dat	upx
behavioral1/files/0x0006000000016c8c-175.dat	upx
behavioral1/files/0x0006000000016c3a-157.dat	upx
behavioral1/memory/2420-141-0x000000013FDB0000-0x00000001401A2000-memory.dmp	upx
behavioral1/files/0x0006000000016a6f-139.dat	upx
behavioral1/memory/2644-132-0x000000013FD30000-0x0000000140122000-memory.dmp	upx
behavioral1/files/0x00060000000165f0-129.dat	upx
behavioral1/files/0x00060000000162c9-123.dat	upx
behavioral1/files/0x00060000000160cc-122.dat	upx
behavioral1/files/0x0006000000015f3c-108.dat	upx
behavioral1/files/0x0006000000015e09-107.dat	upx
behavioral1/files/0x0006000000016cb2-191.dat	upx
behavioral1/files/0x0006000000015d24-73.dat	upx
behavioral1/files/0x0006000000016c42-162.dat	upx
behavioral1/memory/1200-154-0x000000013FE70000-0x0000000140262000-memory.dmp	upx
behavioral1/memory/644-153-0x000000013F7F0000-0x000000013FBE2000-memory.dmp	upx
behavioral1/memory/1964-150-0x000000013F8A0000-0x000000013FC92000-memory.dmp	upx
behavioral1/memory/2480-147-0x000000013FA80000-0x000000013FE72000-memory.dmp	upx
behavioral1/memory/2312-118-0x000000013FFD0000-0x00000001403C2000-memory.dmp	upx
behavioral1/memory/2620-103-0x000000013F5D0000-0x000000013F9C2000-memory.dmp	upx
behavioral1/memory/2520-90-0x000000013FBD0000-0x000000013FFC2000-memory.dmp	upx
behavioral1/files/0x0006000000015cd9-68.dat	upx
behavioral1/files/0x0006000000015d0c-71.dat	upx
behavioral1/files/0x0008000000015cce-55.dat	upx
behavioral1/memory/2936-13-0x000000013FDD0000-0x00000001401C2000-memory.dmp	upx
behavioral1/memory/2520-5779-0x000000013FBD0000-0x000000013FFC2000-memory.dmp	upx
behavioral1/memory/2480-5805-0x000000013FA80000-0x000000013FE72000-memory.dmp	upx
behavioral1/memory/2420-5868-0x000000013FDB0000-0x00000001401A2000-memory.dmp	upx
behavioral1/memory/644-5905-0x000000013F7F0000-0x000000013FBE2000-memory.dmp	upx
behavioral1/memory/2620-5831-0x000000013F5D0000-0x000000013F9C2000-memory.dmp	upx
behavioral1/memory/1964-5816-0x000000013F8A0000-0x000000013FC92000-memory.dmp	upx
behavioral1/memory/1200-5808-0x000000013FE70000-0x0000000140262000-memory.dmp	upx
behavioral1/memory/2312-5803-0x000000013FFD0000-0x00000001403C2000-memory.dmp	upx
behavioral1/memory/2644-5801-0x000000013FD30000-0x0000000140122000-memory.dmp	upx
behavioral1/memory/2936-5762-0x000000013FDD0000-0x00000001401C2000-memory.dmp	upx
behavioral1/memory/2536-5750-0x000000013FA00000-0x000000013FDF2000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\LvgcmXD.exe	a439d9bbe72b0270761a229e5f878270_NEIKI.exe
File created	C:\Windows\System\LQJUEOH.exe	a439d9bbe72b0270761a229e5f878270_NEIKI.exe
File created	C:\Windows\System\DhzTIBq.exe	a439d9bbe72b0270761a229e5f878270_NEIKI.exe
File created	C:\Windows\System\TgYavAc.exe	a439d9bbe72b0270761a229e5f878270_NEIKI.exe
File created	C:\Windows\System\hGpqMTa.exe	a439d9bbe72b0270761a229e5f878270_NEIKI.exe
File created	C:\Windows\System\UqchqXV.exe	a439d9bbe72b0270761a229e5f878270_NEIKI.exe
File created	C:\Windows\System\HjoWRSf.exe	a439d9bbe72b0270761a229e5f878270_NEIKI.exe
File created	C:\Windows\System\gmtkBmS.exe	a439d9bbe72b0270761a229e5f878270_NEIKI.exe
File created	C:\Windows\System\XADNhog.exe	a439d9bbe72b0270761a229e5f878270_NEIKI.exe
File created	C:\Windows\System\IPnLqkG.exe	a439d9bbe72b0270761a229e5f878270_NEIKI.exe
File created	C:\Windows\System\lhmpwzs.exe	a439d9bbe72b0270761a229e5f878270_NEIKI.exe
File created	C:\Windows\System\nDmSGoF.exe	a439d9bbe72b0270761a229e5f878270_NEIKI.exe
File created	C:\Windows\System\iNAOJWq.exe	a439d9bbe72b0270761a229e5f878270_NEIKI.exe
File created	C:\Windows\System\UYXULqk.exe	a439d9bbe72b0270761a229e5f878270_NEIKI.exe
File created	C:\Windows\System\XWQRknk.exe	a439d9bbe72b0270761a229e5f878270_NEIKI.exe
File created	C:\Windows\System\PJcemCZ.exe	a439d9bbe72b0270761a229e5f878270_NEIKI.exe
File created	C:\Windows\System\iMrJczd.exe	a439d9bbe72b0270761a229e5f878270_NEIKI.exe
File created	C:\Windows\System\SpawSPn.exe	a439d9bbe72b0270761a229e5f878270_NEIKI.exe
File created	C:\Windows\System\zZIGhLM.exe	a439d9bbe72b0270761a229e5f878270_NEIKI.exe
File created	C:\Windows\System\feQNLWs.exe	a439d9bbe72b0270761a229e5f878270_NEIKI.exe
File created	C:\Windows\System\LaiPjWP.exe	a439d9bbe72b0270761a229e5f878270_NEIKI.exe
File created	C:\Windows\System\SeWXjZf.exe	a439d9bbe72b0270761a229e5f878270_NEIKI.exe
File created	C:\Windows\System\fYPzfAE.exe	a439d9bbe72b0270761a229e5f878270_NEIKI.exe
File created	C:\Windows\System\DXzzwtb.exe	a439d9bbe72b0270761a229e5f878270_NEIKI.exe
File created	C:\Windows\System\URrhPLE.exe	a439d9bbe72b0270761a229e5f878270_NEIKI.exe
File created	C:\Windows\System\JTfXLvQ.exe	a439d9bbe72b0270761a229e5f878270_NEIKI.exe
File created	C:\Windows\System\BGBEKXC.exe	a439d9bbe72b0270761a229e5f878270_NEIKI.exe
File created	C:\Windows\System\xDtPESm.exe	a439d9bbe72b0270761a229e5f878270_NEIKI.exe
File created	C:\Windows\System\hUbhKog.exe	a439d9bbe72b0270761a229e5f878270_NEIKI.exe
File created	C:\Windows\System\vSHbbmS.exe	a439d9bbe72b0270761a229e5f878270_NEIKI.exe
File created	C:\Windows\System\PwwISRi.exe	a439d9bbe72b0270761a229e5f878270_NEIKI.exe
File created	C:\Windows\System\TeoNHVM.exe	a439d9bbe72b0270761a229e5f878270_NEIKI.exe
File created	C:\Windows\System\qUBLSGW.exe	a439d9bbe72b0270761a229e5f878270_NEIKI.exe
File created	C:\Windows\System\LmxjQrN.exe	a439d9bbe72b0270761a229e5f878270_NEIKI.exe
File created	C:\Windows\System\VHAFEuZ.exe	a439d9bbe72b0270761a229e5f878270_NEIKI.exe
File created	C:\Windows\System\YMsrCQK.exe	a439d9bbe72b0270761a229e5f878270_NEIKI.exe
File created	C:\Windows\System\KYuEjzP.exe	a439d9bbe72b0270761a229e5f878270_NEIKI.exe
File created	C:\Windows\System\gwAwmad.exe	a439d9bbe72b0270761a229e5f878270_NEIKI.exe
File created	C:\Windows\System\LrNixkb.exe	a439d9bbe72b0270761a229e5f878270_NEIKI.exe
File created	C:\Windows\System\gFhnzNn.exe	a439d9bbe72b0270761a229e5f878270_NEIKI.exe
File created	C:\Windows\System\MHigVqT.exe	a439d9bbe72b0270761a229e5f878270_NEIKI.exe
File created	C:\Windows\System\CNCXrdF.exe	a439d9bbe72b0270761a229e5f878270_NEIKI.exe
File created	C:\Windows\System\HpReThI.exe	a439d9bbe72b0270761a229e5f878270_NEIKI.exe
File created	C:\Windows\System\yUyEwvE.exe	a439d9bbe72b0270761a229e5f878270_NEIKI.exe
File created	C:\Windows\System\ulzZQxz.exe	a439d9bbe72b0270761a229e5f878270_NEIKI.exe
File created	C:\Windows\System\RmJpFih.exe	a439d9bbe72b0270761a229e5f878270_NEIKI.exe
File created	C:\Windows\System\tErEHHf.exe	a439d9bbe72b0270761a229e5f878270_NEIKI.exe
File created	C:\Windows\System\aYIFjiH.exe	a439d9bbe72b0270761a229e5f878270_NEIKI.exe
File created	C:\Windows\System\zHxzogR.exe	a439d9bbe72b0270761a229e5f878270_NEIKI.exe
File created	C:\Windows\System\fLKVEke.exe	a439d9bbe72b0270761a229e5f878270_NEIKI.exe
File created	C:\Windows\System\SCmLkhl.exe	a439d9bbe72b0270761a229e5f878270_NEIKI.exe
File created	C:\Windows\System\YPGJAEh.exe	a439d9bbe72b0270761a229e5f878270_NEIKI.exe
File created	C:\Windows\System\mdxxnar.exe	a439d9bbe72b0270761a229e5f878270_NEIKI.exe
File created	C:\Windows\System\DLNswmU.exe	a439d9bbe72b0270761a229e5f878270_NEIKI.exe
File created	C:\Windows\System\EfbuKii.exe	a439d9bbe72b0270761a229e5f878270_NEIKI.exe
File created	C:\Windows\System\QRjwenF.exe	a439d9bbe72b0270761a229e5f878270_NEIKI.exe
File created	C:\Windows\System\zmCFooz.exe	a439d9bbe72b0270761a229e5f878270_NEIKI.exe
File created	C:\Windows\System\HlqZZks.exe	a439d9bbe72b0270761a229e5f878270_NEIKI.exe
File created	C:\Windows\System\mXZylkW.exe	a439d9bbe72b0270761a229e5f878270_NEIKI.exe
File created	C:\Windows\System\oPqbdlD.exe	a439d9bbe72b0270761a229e5f878270_NEIKI.exe
File created	C:\Windows\System\MAAaNXa.exe	a439d9bbe72b0270761a229e5f878270_NEIKI.exe
File created	C:\Windows\System\lQjoyig.exe	a439d9bbe72b0270761a229e5f878270_NEIKI.exe
File created	C:\Windows\System\vFMouDb.exe	a439d9bbe72b0270761a229e5f878270_NEIKI.exe
File created	C:\Windows\System\yGugSYR.exe	a439d9bbe72b0270761a229e5f878270_NEIKI.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1980	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	1664	a439d9bbe72b0270761a229e5f878270_NEIKI.exe
Token: SeDebugPrivilege	1980	powershell.exe
Token: SeLockMemoryPrivilege	1664	a439d9bbe72b0270761a229e5f878270_NEIKI.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1664 wrote to memory of 1980	1664	a439d9bbe72b0270761a229e5f878270_NEIKI.exe	29
PID 1664 wrote to memory of 1980	1664	a439d9bbe72b0270761a229e5f878270_NEIKI.exe	29
PID 1664 wrote to memory of 1980	1664	a439d9bbe72b0270761a229e5f878270_NEIKI.exe	29
PID 1664 wrote to memory of 2936	1664	a439d9bbe72b0270761a229e5f878270_NEIKI.exe	30
PID 1664 wrote to memory of 2936	1664	a439d9bbe72b0270761a229e5f878270_NEIKI.exe	30
PID 1664 wrote to memory of 2936	1664	a439d9bbe72b0270761a229e5f878270_NEIKI.exe	30
PID 1664 wrote to memory of 2536	1664	a439d9bbe72b0270761a229e5f878270_NEIKI.exe	31
PID 1664 wrote to memory of 2536	1664	a439d9bbe72b0270761a229e5f878270_NEIKI.exe	31
PID 1664 wrote to memory of 2536	1664	a439d9bbe72b0270761a229e5f878270_NEIKI.exe	31
PID 1664 wrote to memory of 2520	1664	a439d9bbe72b0270761a229e5f878270_NEIKI.exe	32
PID 1664 wrote to memory of 2520	1664	a439d9bbe72b0270761a229e5f878270_NEIKI.exe	32
PID 1664 wrote to memory of 2520	1664	a439d9bbe72b0270761a229e5f878270_NEIKI.exe	32
PID 1664 wrote to memory of 2620	1664	a439d9bbe72b0270761a229e5f878270_NEIKI.exe	33
PID 1664 wrote to memory of 2620	1664	a439d9bbe72b0270761a229e5f878270_NEIKI.exe	33
PID 1664 wrote to memory of 2620	1664	a439d9bbe72b0270761a229e5f878270_NEIKI.exe	33
PID 1664 wrote to memory of 2312	1664	a439d9bbe72b0270761a229e5f878270_NEIKI.exe	34
PID 1664 wrote to memory of 2312	1664	a439d9bbe72b0270761a229e5f878270_NEIKI.exe	34
PID 1664 wrote to memory of 2312	1664	a439d9bbe72b0270761a229e5f878270_NEIKI.exe	34
PID 1664 wrote to memory of 2644	1664	a439d9bbe72b0270761a229e5f878270_NEIKI.exe	35
PID 1664 wrote to memory of 2644	1664	a439d9bbe72b0270761a229e5f878270_NEIKI.exe	35
PID 1664 wrote to memory of 2644	1664	a439d9bbe72b0270761a229e5f878270_NEIKI.exe	35
PID 1664 wrote to memory of 2420	1664	a439d9bbe72b0270761a229e5f878270_NEIKI.exe	36
PID 1664 wrote to memory of 2420	1664	a439d9bbe72b0270761a229e5f878270_NEIKI.exe	36
PID 1664 wrote to memory of 2420	1664	a439d9bbe72b0270761a229e5f878270_NEIKI.exe	36
PID 1664 wrote to memory of 2480	1664	a439d9bbe72b0270761a229e5f878270_NEIKI.exe	37
PID 1664 wrote to memory of 2480	1664	a439d9bbe72b0270761a229e5f878270_NEIKI.exe	37
PID 1664 wrote to memory of 2480	1664	a439d9bbe72b0270761a229e5f878270_NEIKI.exe	37
PID 1664 wrote to memory of 1964	1664	a439d9bbe72b0270761a229e5f878270_NEIKI.exe	38
PID 1664 wrote to memory of 1964	1664	a439d9bbe72b0270761a229e5f878270_NEIKI.exe	38
PID 1664 wrote to memory of 1964	1664	a439d9bbe72b0270761a229e5f878270_NEIKI.exe	38
PID 1664 wrote to memory of 1200	1664	a439d9bbe72b0270761a229e5f878270_NEIKI.exe	39
PID 1664 wrote to memory of 1200	1664	a439d9bbe72b0270761a229e5f878270_NEIKI.exe	39
PID 1664 wrote to memory of 1200	1664	a439d9bbe72b0270761a229e5f878270_NEIKI.exe	39
PID 1664 wrote to memory of 644	1664	a439d9bbe72b0270761a229e5f878270_NEIKI.exe	40
PID 1664 wrote to memory of 644	1664	a439d9bbe72b0270761a229e5f878270_NEIKI.exe	40
PID 1664 wrote to memory of 644	1664	a439d9bbe72b0270761a229e5f878270_NEIKI.exe	40
PID 1664 wrote to memory of 2680	1664	a439d9bbe72b0270761a229e5f878270_NEIKI.exe	41
PID 1664 wrote to memory of 2680	1664	a439d9bbe72b0270761a229e5f878270_NEIKI.exe	41
PID 1664 wrote to memory of 2680	1664	a439d9bbe72b0270761a229e5f878270_NEIKI.exe	41
PID 1664 wrote to memory of 2684	1664	a439d9bbe72b0270761a229e5f878270_NEIKI.exe	42
PID 1664 wrote to memory of 2684	1664	a439d9bbe72b0270761a229e5f878270_NEIKI.exe	42
PID 1664 wrote to memory of 2684	1664	a439d9bbe72b0270761a229e5f878270_NEIKI.exe	42
PID 1664 wrote to memory of 2504	1664	a439d9bbe72b0270761a229e5f878270_NEIKI.exe	43
PID 1664 wrote to memory of 2504	1664	a439d9bbe72b0270761a229e5f878270_NEIKI.exe	43
PID 1664 wrote to memory of 2504	1664	a439d9bbe72b0270761a229e5f878270_NEIKI.exe	43
PID 1664 wrote to memory of 2760	1664	a439d9bbe72b0270761a229e5f878270_NEIKI.exe	44
PID 1664 wrote to memory of 2760	1664	a439d9bbe72b0270761a229e5f878270_NEIKI.exe	44
PID 1664 wrote to memory of 2760	1664	a439d9bbe72b0270761a229e5f878270_NEIKI.exe	44
PID 1664 wrote to memory of 2296	1664	a439d9bbe72b0270761a229e5f878270_NEIKI.exe	45
PID 1664 wrote to memory of 2296	1664	a439d9bbe72b0270761a229e5f878270_NEIKI.exe	45
PID 1664 wrote to memory of 2296	1664	a439d9bbe72b0270761a229e5f878270_NEIKI.exe	45
PID 1664 wrote to memory of 1620	1664	a439d9bbe72b0270761a229e5f878270_NEIKI.exe	46
PID 1664 wrote to memory of 1620	1664	a439d9bbe72b0270761a229e5f878270_NEIKI.exe	46
PID 1664 wrote to memory of 1620	1664	a439d9bbe72b0270761a229e5f878270_NEIKI.exe	46
PID 1664 wrote to memory of 1796	1664	a439d9bbe72b0270761a229e5f878270_NEIKI.exe	47
PID 1664 wrote to memory of 1796	1664	a439d9bbe72b0270761a229e5f878270_NEIKI.exe	47
PID 1664 wrote to memory of 1796	1664	a439d9bbe72b0270761a229e5f878270_NEIKI.exe	47
PID 1664 wrote to memory of 1844	1664	a439d9bbe72b0270761a229e5f878270_NEIKI.exe	48
PID 1664 wrote to memory of 1844	1664	a439d9bbe72b0270761a229e5f878270_NEIKI.exe	48
PID 1664 wrote to memory of 1844	1664	a439d9bbe72b0270761a229e5f878270_NEIKI.exe	48
PID 1664 wrote to memory of 1552	1664	a439d9bbe72b0270761a229e5f878270_NEIKI.exe	49
PID 1664 wrote to memory of 1552	1664	a439d9bbe72b0270761a229e5f878270_NEIKI.exe	49
PID 1664 wrote to memory of 1552	1664	a439d9bbe72b0270761a229e5f878270_NEIKI.exe	49
PID 1664 wrote to memory of 1544	1664	a439d9bbe72b0270761a229e5f878270_NEIKI.exe	50

C:\Users\Admin\AppData\Local\Temp\a439d9bbe72b0270761a229e5f878270_NEIKI.exe
"C:\Users\Admin\AppData\Local\Temp\a439d9bbe72b0270761a229e5f878270_NEIKI.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1664
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1980
- C:\Windows\System\mVuyaQY.exe
  C:\Windows\System\mVuyaQY.exe
  2⤵
  - Executes dropped EXE
  PID:2936
- C:\Windows\System\vzSYjbt.exe
  C:\Windows\System\vzSYjbt.exe
  2⤵
  - Executes dropped EXE
  PID:2536
- C:\Windows\System\cDAPpRs.exe
  C:\Windows\System\cDAPpRs.exe
  2⤵
  - Executes dropped EXE
  PID:2520
- C:\Windows\System\AeEbsYS.exe
  C:\Windows\System\AeEbsYS.exe
  2⤵
  - Executes dropped EXE
  PID:2620
- C:\Windows\System\KQveTir.exe
  C:\Windows\System\KQveTir.exe
  2⤵
  - Executes dropped EXE
  PID:2312
- C:\Windows\System\XbBRnEl.exe
  C:\Windows\System\XbBRnEl.exe
  2⤵
  - Executes dropped EXE
  PID:2644
- C:\Windows\System\FZyAOJt.exe
  C:\Windows\System\FZyAOJt.exe
  2⤵
  - Executes dropped EXE
  PID:2420
- C:\Windows\System\sSEYtjn.exe
  C:\Windows\System\sSEYtjn.exe
  2⤵
  - Executes dropped EXE
  PID:2480
- C:\Windows\System\qUlqMrU.exe
  C:\Windows\System\qUlqMrU.exe
  2⤵
  - Executes dropped EXE
  PID:1964
- C:\Windows\System\WFTXmNJ.exe
  C:\Windows\System\WFTXmNJ.exe
  2⤵
  - Executes dropped EXE
  PID:1200
- C:\Windows\System\XVBobKe.exe
  C:\Windows\System\XVBobKe.exe
  2⤵
  - Executes dropped EXE
  PID:644
- C:\Windows\System\czIxjWc.exe
  C:\Windows\System\czIxjWc.exe
  2⤵
  - Executes dropped EXE
  PID:2680
- C:\Windows\System\ODLuPec.exe
  C:\Windows\System\ODLuPec.exe
  2⤵
  - Executes dropped EXE
  PID:2684
- C:\Windows\System\nNpcWsI.exe
  C:\Windows\System\nNpcWsI.exe
  2⤵
  - Executes dropped EXE
  PID:2504
- C:\Windows\System\jpUhIZR.exe
  C:\Windows\System\jpUhIZR.exe
  2⤵
  - Executes dropped EXE
  PID:2760
- C:\Windows\System\SlDGlGi.exe
  C:\Windows\System\SlDGlGi.exe
  2⤵
  - Executes dropped EXE
  PID:2296
- C:\Windows\System\diOuVkS.exe
  C:\Windows\System\diOuVkS.exe
  2⤵
  - Executes dropped EXE
  PID:1620
- C:\Windows\System\LaOKGHH.exe
  C:\Windows\System\LaOKGHH.exe
  2⤵
  - Executes dropped EXE
  PID:1796
- C:\Windows\System\rlHQjig.exe
  C:\Windows\System\rlHQjig.exe
  2⤵
  - Executes dropped EXE
  PID:1844
- C:\Windows\System\AMFGPBs.exe
  C:\Windows\System\AMFGPBs.exe
  2⤵
  - Executes dropped EXE
  PID:1552
- C:\Windows\System\jnfPSMZ.exe
  C:\Windows\System\jnfPSMZ.exe
  2⤵
  - Executes dropped EXE
  PID:1544
- C:\Windows\System\DCcMvWn.exe
  C:\Windows\System\DCcMvWn.exe
  2⤵
  - Executes dropped EXE
  PID:2160
- C:\Windows\System\LRaLdAS.exe
  C:\Windows\System\LRaLdAS.exe
  2⤵
  - Executes dropped EXE
  PID:2152
- C:\Windows\System\xBkdLSH.exe
  C:\Windows\System\xBkdLSH.exe
  2⤵
  - Executes dropped EXE
  PID:2112
- C:\Windows\System\kvrqDHV.exe
  C:\Windows\System\kvrqDHV.exe
  2⤵
  - Executes dropped EXE
  PID:1708
- C:\Windows\System\NfyHsLZ.exe
  C:\Windows\System\NfyHsLZ.exe
  2⤵
  - Executes dropped EXE
  PID:472
- C:\Windows\System\AbMZKtf.exe
  C:\Windows\System\AbMZKtf.exe
  2⤵
  - Executes dropped EXE
  PID:2236
- C:\Windows\System\kgEpwzl.exe
  C:\Windows\System\kgEpwzl.exe
  2⤵
  - Executes dropped EXE
  PID:2228
- C:\Windows\System\fQrigTe.exe
  C:\Windows\System\fQrigTe.exe
  2⤵
  - Executes dropped EXE
  PID:2388
- C:\Windows\System\ZvCAUof.exe
  C:\Windows\System\ZvCAUof.exe
  2⤵
  - Executes dropped EXE
  PID:604
- C:\Windows\System\brVhKnO.exe
  C:\Windows\System\brVhKnO.exe
  2⤵
  - Executes dropped EXE
  PID:792
- C:\Windows\System\ZkfFwWf.exe
  C:\Windows\System\ZkfFwWf.exe
  2⤵
  - Executes dropped EXE
  PID:1892
- C:\Windows\System\SuvHcVd.exe
  C:\Windows\System\SuvHcVd.exe
  2⤵
  - Executes dropped EXE
  PID:3060
- C:\Windows\System\DVfgHnr.exe
  C:\Windows\System\DVfgHnr.exe
  2⤵
  - Executes dropped EXE
  PID:1932
- C:\Windows\System\YjTAfXc.exe
  C:\Windows\System\YjTAfXc.exe
  2⤵
  - Executes dropped EXE
  PID:1840
- C:\Windows\System\piNulUp.exe
  C:\Windows\System\piNulUp.exe
  2⤵
  - Executes dropped EXE
  PID:780
- C:\Windows\System\rllBEZM.exe
  C:\Windows\System\rllBEZM.exe
  2⤵
  - Executes dropped EXE
  PID:2364
- C:\Windows\System\MJhMmre.exe
  C:\Windows\System\MJhMmre.exe
  2⤵
  - Executes dropped EXE
  PID:344
- C:\Windows\System\XqYfnOc.exe
  C:\Windows\System\XqYfnOc.exe
  2⤵
  - Executes dropped EXE
  PID:1164
- C:\Windows\System\oXWHosS.exe
  C:\Windows\System\oXWHosS.exe
  2⤵
  - Executes dropped EXE
  PID:932
- C:\Windows\System\zoYSaHG.exe
  C:\Windows\System\zoYSaHG.exe
  2⤵
  - Executes dropped EXE
  PID:1888
- C:\Windows\System\ZRyiStG.exe
  C:\Windows\System\ZRyiStG.exe
  2⤵
  - Executes dropped EXE
  PID:1668
- C:\Windows\System\VemanUS.exe
  C:\Windows\System\VemanUS.exe
  2⤵
  - Executes dropped EXE
  PID:936
- C:\Windows\System\MkXNuYe.exe
  C:\Windows\System\MkXNuYe.exe
  2⤵
  - Executes dropped EXE
  PID:576
- C:\Windows\System\IyZLVxf.exe
  C:\Windows\System\IyZLVxf.exe
  2⤵
  - Executes dropped EXE
  PID:2352
- C:\Windows\System\smCXYLa.exe
  C:\Windows\System\smCXYLa.exe
  2⤵
  - Executes dropped EXE
  PID:2280
- C:\Windows\System\rLKwSnD.exe
  C:\Windows\System\rLKwSnD.exe
  2⤵
  - Executes dropped EXE
  PID:2188
- C:\Windows\System\wBYBEgq.exe
  C:\Windows\System\wBYBEgq.exe
  2⤵
  - Executes dropped EXE
  PID:912
- C:\Windows\System\YdjoQrm.exe
  C:\Windows\System\YdjoQrm.exe
  2⤵
  - Executes dropped EXE
  PID:1604
- C:\Windows\System\riytUtr.exe
  C:\Windows\System\riytUtr.exe
  2⤵
  - Executes dropped EXE
  PID:2940
- C:\Windows\System\UUWVMTI.exe
  C:\Windows\System\UUWVMTI.exe
  2⤵
  - Executes dropped EXE
  PID:1940
- C:\Windows\System\NWnHpQX.exe
  C:\Windows\System\NWnHpQX.exe
  2⤵
  - Executes dropped EXE
  PID:2780
- C:\Windows\System\ZjHbFSn.exe
  C:\Windows\System\ZjHbFSn.exe
  2⤵
  - Executes dropped EXE
  PID:2796
- C:\Windows\System\rVbEjbn.exe
  C:\Windows\System\rVbEjbn.exe
  2⤵
  - Executes dropped EXE
  PID:1536
- C:\Windows\System\pjUhHaF.exe
  C:\Windows\System\pjUhHaF.exe
  2⤵
  - Executes dropped EXE
  PID:1652
- C:\Windows\System\ZHUMwqk.exe
  C:\Windows\System\ZHUMwqk.exe
  2⤵
  - Executes dropped EXE
  PID:2688
- C:\Windows\System\PskUMxQ.exe
  C:\Windows\System\PskUMxQ.exe
  2⤵
  - Executes dropped EXE
  PID:2548
- C:\Windows\System\LpuTpCX.exe
  C:\Windows\System\LpuTpCX.exe
  2⤵
  - Executes dropped EXE
  PID:2568
- C:\Windows\System\NDyUOKf.exe
  C:\Windows\System\NDyUOKf.exe
  2⤵
  - Executes dropped EXE
  PID:2416
- C:\Windows\System\bwifePE.exe
  C:\Windows\System\bwifePE.exe
  2⤵
  - Executes dropped EXE
  PID:2672
- C:\Windows\System\JBwfwMj.exe
  C:\Windows\System\JBwfwMj.exe
  2⤵
  - Executes dropped EXE
  PID:1560
- C:\Windows\System\jETirGN.exe
  C:\Windows\System\jETirGN.exe
  2⤵
  - Executes dropped EXE
  PID:2208
- C:\Windows\System\URraYun.exe
  C:\Windows\System\URraYun.exe
  2⤵
  - Executes dropped EXE
  PID:2716
- C:\Windows\System\QXqsgwc.exe
  C:\Windows\System\QXqsgwc.exe
  2⤵
  - Executes dropped EXE
  PID:836
- C:\Windows\System\uLIQxOE.exe
  C:\Windows\System\uLIQxOE.exe
  2⤵
  PID:1436
- C:\Windows\System\lbrPYoi.exe
  C:\Windows\System\lbrPYoi.exe
  2⤵
  PID:3052
- C:\Windows\System\qTglJJC.exe
  C:\Windows\System\qTglJJC.exe
  2⤵
  PID:2772
- C:\Windows\System\zWOIwFb.exe
  C:\Windows\System\zWOIwFb.exe
  2⤵
  PID:2708
- C:\Windows\System\CRUbVXt.exe
  C:\Windows\System\CRUbVXt.exe
  2⤵
  PID:2468
- C:\Windows\System\pLVxMSe.exe
  C:\Windows\System\pLVxMSe.exe
  2⤵
  PID:380
- C:\Windows\System\EOGQpmt.exe
  C:\Windows\System\EOGQpmt.exe
  2⤵
  PID:2472
- C:\Windows\System\zCMMiZI.exe
  C:\Windows\System\zCMMiZI.exe
  2⤵
  PID:1632
- C:\Windows\System\lkjugkg.exe
  C:\Windows\System\lkjugkg.exe
  2⤵
  PID:1488
- C:\Windows\System\IuMzEIh.exe
  C:\Windows\System\IuMzEIh.exe
  2⤵
  PID:1256
- C:\Windows\System\EkNkfSa.exe
  C:\Windows\System\EkNkfSa.exe
  2⤵
  PID:1588
- C:\Windows\System\MNtnqKV.exe
  C:\Windows\System\MNtnqKV.exe
  2⤵
  PID:3068
- C:\Windows\System\ROKJUhr.exe
  C:\Windows\System\ROKJUhr.exe
  2⤵
  PID:2116
- C:\Windows\System\zZIGhLM.exe
  C:\Windows\System\zZIGhLM.exe
  2⤵
  PID:868
- C:\Windows\System\muaVtWi.exe
  C:\Windows\System\muaVtWi.exe
  2⤵
  PID:1064
- C:\Windows\System\qqVQtxz.exe
  C:\Windows\System\qqVQtxz.exe
  2⤵
  PID:2924
- C:\Windows\System\yOZEopK.exe
  C:\Windows\System\yOZEopK.exe
  2⤵
  PID:2212
- C:\Windows\System\QHDelyz.exe
  C:\Windows\System\QHDelyz.exe
  2⤵
  PID:284
- C:\Windows\System\mhRwfjm.exe
  C:\Windows\System\mhRwfjm.exe
  2⤵
  PID:2508
- C:\Windows\System\NyqBxVn.exe
  C:\Windows\System\NyqBxVn.exe
  2⤵
  PID:2912
- C:\Windows\System\aRibhtM.exe
  C:\Windows\System\aRibhtM.exe
  2⤵
  PID:1284
- C:\Windows\System\OLZdcSg.exe
  C:\Windows\System\OLZdcSg.exe
  2⤵
  PID:2876
- C:\Windows\System\Apcfdcj.exe
  C:\Windows\System\Apcfdcj.exe
  2⤵
  PID:2456
- C:\Windows\System\sKwnqmi.exe
  C:\Windows\System\sKwnqmi.exe
  2⤵
  PID:1744
- C:\Windows\System\JEjATmx.exe
  C:\Windows\System\JEjATmx.exe
  2⤵
  PID:784
- C:\Windows\System\zfDVVlM.exe
  C:\Windows\System\zfDVVlM.exe
  2⤵
  PID:952
- C:\Windows\System\CtEzlUG.exe
  C:\Windows\System\CtEzlUG.exe
  2⤵
  PID:1424
- C:\Windows\System\WssokNa.exe
  C:\Windows\System\WssokNa.exe
  2⤵
  PID:2792
- C:\Windows\System\JNxhnMQ.exe
  C:\Windows\System\JNxhnMQ.exe
  2⤵
  PID:2484
- C:\Windows\System\PVwnIEo.exe
  C:\Windows\System\PVwnIEo.exe
  2⤵
  PID:1624
- C:\Windows\System\kwZlSKn.exe
  C:\Windows\System\kwZlSKn.exe
  2⤵
  PID:2600
- C:\Windows\System\wZnaMOB.exe
  C:\Windows\System\wZnaMOB.exe
  2⤵
  PID:2604
- C:\Windows\System\TEVftUT.exe
  C:\Windows\System\TEVftUT.exe
  2⤵
  PID:1584
- C:\Windows\System\CBmmrlr.exe
  C:\Windows\System\CBmmrlr.exe
  2⤵
  PID:1656
- C:\Windows\System\rrttRVp.exe
  C:\Windows\System\rrttRVp.exe
  2⤵
  PID:1448
- C:\Windows\System\oFbxqak.exe
  C:\Windows\System\oFbxqak.exe
  2⤵
  PID:2996
- C:\Windows\System\ndVcdtO.exe
  C:\Windows\System\ndVcdtO.exe
  2⤵
  PID:1580
- C:\Windows\System\CBWPQmF.exe
  C:\Windows\System\CBWPQmF.exe
  2⤵
  PID:3032
- C:\Windows\System\kBXOdKE.exe
  C:\Windows\System\kBXOdKE.exe
  2⤵
  PID:2884
- C:\Windows\System\gbobDJF.exe
  C:\Windows\System\gbobDJF.exe
  2⤵
  PID:2916
- C:\Windows\System\XREXdip.exe
  C:\Windows\System\XREXdip.exe
  2⤵
  PID:2748
- C:\Windows\System\KdOEkgq.exe
  C:\Windows\System\KdOEkgq.exe
  2⤵
  PID:1148
- C:\Windows\System\JYZMocD.exe
  C:\Windows\System\JYZMocD.exe
  2⤵
  PID:2752
- C:\Windows\System\OICzwrp.exe
  C:\Windows\System\OICzwrp.exe
  2⤵
  PID:2788
- C:\Windows\System\AyVNcew.exe
  C:\Windows\System\AyVNcew.exe
  2⤵
  PID:1952
- C:\Windows\System\SkcOqkS.exe
  C:\Windows\System\SkcOqkS.exe
  2⤵
  PID:2712
- C:\Windows\System\PrInMYu.exe
  C:\Windows\System\PrInMYu.exe
  2⤵
  PID:304
- C:\Windows\System\jJxADwz.exe
  C:\Windows\System\jJxADwz.exe
  2⤵
  PID:2700
- C:\Windows\System\xoOkFoD.exe
  C:\Windows\System\xoOkFoD.exe
  2⤵
  PID:2764
- C:\Windows\System\enMwWFa.exe
  C:\Windows\System\enMwWFa.exe
  2⤵
  PID:2880
- C:\Windows\System\BMOgqOk.exe
  C:\Windows\System\BMOgqOk.exe
  2⤵
  PID:996
- C:\Windows\System\usYhgpb.exe
  C:\Windows\System\usYhgpb.exe
  2⤵
  PID:2492
- C:\Windows\System\bAORIva.exe
  C:\Windows\System\bAORIva.exe
  2⤵
  PID:1784
- C:\Windows\System\uGpLhLu.exe
  C:\Windows\System\uGpLhLu.exe
  2⤵
  PID:1720
- C:\Windows\System\YslJKwR.exe
  C:\Windows\System\YslJKwR.exe
  2⤵
  PID:968
- C:\Windows\System\JhWZJwx.exe
  C:\Windows\System\JhWZJwx.exe
  2⤵
  PID:2616
- C:\Windows\System\xDuyfSs.exe
  C:\Windows\System\xDuyfSs.exe
  2⤵
  PID:2704
- C:\Windows\System\MknKynP.exe
  C:\Windows\System\MknKynP.exe
  2⤵
  PID:1788
- C:\Windows\System\KvmTOUs.exe
  C:\Windows\System\KvmTOUs.exe
  2⤵
  PID:2588
- C:\Windows\System\jmQlxkF.exe
  C:\Windows\System\jmQlxkF.exe
  2⤵
  PID:2608
- C:\Windows\System\wrsZGjT.exe
  C:\Windows\System\wrsZGjT.exe
  2⤵
  PID:2804
- C:\Windows\System\OskOSWd.exe
  C:\Windows\System\OskOSWd.exe
  2⤵
  PID:1988
- C:\Windows\System\wrHYhuO.exe
  C:\Windows\System\wrHYhuO.exe
  2⤵
  PID:1496
- C:\Windows\System\ObKrwgP.exe
  C:\Windows\System\ObKrwgP.exe
  2⤵
  PID:2100
- C:\Windows\System\HZKGXXk.exe
  C:\Windows\System\HZKGXXk.exe
  2⤵
  PID:2448
- C:\Windows\System\hUbhKog.exe
  C:\Windows\System\hUbhKog.exe
  2⤵
  PID:2256
- C:\Windows\System\nIQVeiB.exe
  C:\Windows\System\nIQVeiB.exe
  2⤵
  PID:1820
- C:\Windows\System\dxsVjnz.exe
  C:\Windows\System\dxsVjnz.exe
  2⤵
  PID:2944
- C:\Windows\System\VwEzuED.exe
  C:\Windows\System\VwEzuED.exe
  2⤵
  PID:2744
- C:\Windows\System\LqzzHuX.exe
  C:\Windows\System\LqzzHuX.exe
  2⤵
  PID:816
- C:\Windows\System\fHPrSKs.exe
  C:\Windows\System\fHPrSKs.exe
  2⤵
  PID:1444
- C:\Windows\System\JPwkArp.exe
  C:\Windows\System\JPwkArp.exe
  2⤵
  PID:2344
- C:\Windows\System\bHyzBdO.exe
  C:\Windows\System\bHyzBdO.exe
  2⤵
  PID:2368
- C:\Windows\System\vdDOHmW.exe
  C:\Windows\System\vdDOHmW.exe
  2⤵
  PID:820
- C:\Windows\System\zELaMOY.exe
  C:\Windows\System\zELaMOY.exe
  2⤵
  PID:2636
- C:\Windows\System\IGPVnrM.exe
  C:\Windows\System\IGPVnrM.exe
  2⤵
  PID:1472
- C:\Windows\System\hDEqykL.exe
  C:\Windows\System\hDEqykL.exe
  2⤵
  PID:2840
- C:\Windows\System\mAVmnvH.exe
  C:\Windows\System\mAVmnvH.exe
  2⤵
  PID:3064
- C:\Windows\System\JvNqnBr.exe
  C:\Windows\System\JvNqnBr.exe
  2⤵
  PID:856
- C:\Windows\System\gwlAYkt.exe
  C:\Windows\System\gwlAYkt.exe
  2⤵
  PID:2736
- C:\Windows\System\zUNGyyF.exe
  C:\Windows\System\zUNGyyF.exe
  2⤵
  PID:2596
- C:\Windows\System\oKaAJsw.exe
  C:\Windows\System\oKaAJsw.exe
  2⤵
  PID:704
- C:\Windows\System\YKPfYnJ.exe
  C:\Windows\System\YKPfYnJ.exe
  2⤵
  PID:324
- C:\Windows\System\SIEBYnx.exe
  C:\Windows\System\SIEBYnx.exe
  2⤵
  PID:2948
- C:\Windows\System\bIxTEjf.exe
  C:\Windows\System\bIxTEjf.exe
  2⤵
  PID:900
- C:\Windows\System\pPIKGXN.exe
  C:\Windows\System\pPIKGXN.exe
  2⤵
  PID:980
- C:\Windows\System\pwTouGP.exe
  C:\Windows\System\pwTouGP.exe
  2⤵
  PID:296
- C:\Windows\System\RxHjJeW.exe
  C:\Windows\System\RxHjJeW.exe
  2⤵
  PID:1700
- C:\Windows\System\dNRuluJ.exe
  C:\Windows\System\dNRuluJ.exe
  2⤵
  PID:2184
- C:\Windows\System\fogmPSh.exe
  C:\Windows\System\fogmPSh.exe
  2⤵
  PID:2128
- C:\Windows\System\qEUnNPz.exe
  C:\Windows\System\qEUnNPz.exe
  2⤵
  PID:2264
- C:\Windows\System\oMlnaJv.exe
  C:\Windows\System\oMlnaJv.exe
  2⤵
  PID:2224
- C:\Windows\System\tPHfTFm.exe
  C:\Windows\System\tPHfTFm.exe
  2⤵
  PID:2304
- C:\Windows\System\MWnUqXU.exe
  C:\Windows\System\MWnUqXU.exe
  2⤵
  PID:2052
- C:\Windows\System\MeZyAqL.exe
  C:\Windows\System\MeZyAqL.exe
  2⤵
  PID:2176
- C:\Windows\System\lciycWI.exe
  C:\Windows\System\lciycWI.exe
  2⤵
  PID:2376
- C:\Windows\System\zmIcsSf.exe
  C:\Windows\System\zmIcsSf.exe
  2⤵
  PID:2560
- C:\Windows\System\TTzEiof.exe
  C:\Windows\System\TTzEiof.exe
  2⤵
  PID:2064
- C:\Windows\System\xuScksC.exe
  C:\Windows\System\xuScksC.exe
  2⤵
  PID:540
- C:\Windows\System\ucmFWBy.exe
  C:\Windows\System\ucmFWBy.exe
  2⤵
  PID:2200
- C:\Windows\System\YLEAEex.exe
  C:\Windows\System\YLEAEex.exe
  2⤵
  PID:2068
- C:\Windows\System\EEEeBeX.exe
  C:\Windows\System\EEEeBeX.exe
  2⤵
  PID:1992
- C:\Windows\System\lIyyJYm.exe
  C:\Windows\System\lIyyJYm.exe
  2⤵
  PID:1836
- C:\Windows\System\WSQefsR.exe
  C:\Windows\System\WSQefsR.exe
  2⤵
  PID:1804
- C:\Windows\System\keiEpTk.exe
  C:\Windows\System\keiEpTk.exe
  2⤵
  PID:872
- C:\Windows\System\cnZEXmA.exe
  C:\Windows\System\cnZEXmA.exe
  2⤵
  PID:876
- C:\Windows\System\jsHnhAp.exe
  C:\Windows\System\jsHnhAp.exe
  2⤵
  PID:2120
- C:\Windows\System\IUUxMHk.exe
  C:\Windows\System\IUUxMHk.exe
  2⤵
  PID:1464
- C:\Windows\System\xgFKkHz.exe
  C:\Windows\System\xgFKkHz.exe
  2⤵
  PID:384
- C:\Windows\System\HdPNLrh.exe
  C:\Windows\System\HdPNLrh.exe
  2⤵
  PID:1704
- C:\Windows\System\qYIqIso.exe
  C:\Windows\System\qYIqIso.exe
  2⤵
  PID:2204
- C:\Windows\System\xOlRfLG.exe
  C:\Windows\System\xOlRfLG.exe
  2⤵
  PID:1896
- C:\Windows\System\XzbZDfP.exe
  C:\Windows\System\XzbZDfP.exe
  2⤵
  PID:2040
- C:\Windows\System\CftmrdB.exe
  C:\Windows\System\CftmrdB.exe
  2⤵
  PID:2556
- C:\Windows\System\YiYmxcu.exe
  C:\Windows\System\YiYmxcu.exe
  2⤵
  PID:2808
- C:\Windows\System\QCevZQv.exe
  C:\Windows\System\QCevZQv.exe
  2⤵
  PID:2332
- C:\Windows\System\bScBHJH.exe
  C:\Windows\System\bScBHJH.exe
  2⤵
  PID:1948
- C:\Windows\System\ZOpXtpQ.exe
  C:\Windows\System\ZOpXtpQ.exe
  2⤵
  PID:2656
- C:\Windows\System\bFubTtE.exe
  C:\Windows\System\bFubTtE.exe
  2⤵
  PID:3092
- C:\Windows\System\XxKluVM.exe
  C:\Windows\System\XxKluVM.exe
  2⤵
  PID:3108
- C:\Windows\System\AqCQkRr.exe
  C:\Windows\System\AqCQkRr.exe
  2⤵
  PID:3128
- C:\Windows\System\zMGMMIw.exe
  C:\Windows\System\zMGMMIw.exe
  2⤵
  PID:3160
- C:\Windows\System\tdxcOrV.exe
  C:\Windows\System\tdxcOrV.exe
  2⤵
  PID:3176
- C:\Windows\System\zPXFabc.exe
  C:\Windows\System\zPXFabc.exe
  2⤵
  PID:3192
- C:\Windows\System\umXWzqo.exe
  C:\Windows\System\umXWzqo.exe
  2⤵
  PID:3216
- C:\Windows\System\xPBPoLt.exe
  C:\Windows\System\xPBPoLt.exe
  2⤵
  PID:3240
- C:\Windows\System\YYUzpuk.exe
  C:\Windows\System\YYUzpuk.exe
  2⤵
  PID:3256
- C:\Windows\System\eJwkVED.exe
  C:\Windows\System\eJwkVED.exe
  2⤵
  PID:3280
- C:\Windows\System\fqmRIRi.exe
  C:\Windows\System\fqmRIRi.exe
  2⤵
  PID:3296
- C:\Windows\System\bHGaUIw.exe
  C:\Windows\System\bHGaUIw.exe
  2⤵
  PID:3316
- C:\Windows\System\lkuDjuh.exe
  C:\Windows\System\lkuDjuh.exe
  2⤵
  PID:3336
- C:\Windows\System\DDsIbwL.exe
  C:\Windows\System\DDsIbwL.exe
  2⤵
  PID:3360
- C:\Windows\System\BlSZZkP.exe
  C:\Windows\System\BlSZZkP.exe
  2⤵
  PID:3376
- C:\Windows\System\aJRllbG.exe
  C:\Windows\System\aJRllbG.exe
  2⤵
  PID:3400
- C:\Windows\System\iMBYRGi.exe
  C:\Windows\System\iMBYRGi.exe
  2⤵
  PID:3416
- C:\Windows\System\kKquVts.exe
  C:\Windows\System\kKquVts.exe
  2⤵
  PID:3436
- C:\Windows\System\mizhNRE.exe
  C:\Windows\System\mizhNRE.exe
  2⤵
  PID:3456
- C:\Windows\System\hhKohzs.exe
  C:\Windows\System\hhKohzs.exe
  2⤵
  PID:3472
- C:\Windows\System\VyRvZdi.exe
  C:\Windows\System\VyRvZdi.exe
  2⤵
  PID:3488
- C:\Windows\System\cArUHya.exe
  C:\Windows\System\cArUHya.exe
  2⤵
  PID:3504
- C:\Windows\System\gFZhzqU.exe
  C:\Windows\System\gFZhzqU.exe
  2⤵
  PID:3520
- C:\Windows\System\hPrtjZu.exe
  C:\Windows\System\hPrtjZu.exe
  2⤵
  PID:3536
- C:\Windows\System\NHufQhb.exe
  C:\Windows\System\NHufQhb.exe
  2⤵
  PID:3552
- C:\Windows\System\lsdCIfE.exe
  C:\Windows\System\lsdCIfE.exe
  2⤵
  PID:3568
- C:\Windows\System\cTftVuz.exe
  C:\Windows\System\cTftVuz.exe
  2⤵
  PID:3588
- C:\Windows\System\RGFdVCx.exe
  C:\Windows\System\RGFdVCx.exe
  2⤵
  PID:3604
- C:\Windows\System\AxbkhXu.exe
  C:\Windows\System\AxbkhXu.exe
  2⤵
  PID:3620
- C:\Windows\System\PqHqejy.exe
  C:\Windows\System\PqHqejy.exe
  2⤵
  PID:3636
- C:\Windows\System\SlKwTAV.exe
  C:\Windows\System\SlKwTAV.exe
  2⤵
  PID:3652
- C:\Windows\System\IjsVDiU.exe
  C:\Windows\System\IjsVDiU.exe
  2⤵
  PID:3668
- C:\Windows\System\GfrFWtl.exe
  C:\Windows\System\GfrFWtl.exe
  2⤵
  PID:3684
- C:\Windows\System\glpOIav.exe
  C:\Windows\System\glpOIav.exe
  2⤵
  PID:3700
- C:\Windows\System\SWPJVMz.exe
  C:\Windows\System\SWPJVMz.exe
  2⤵
  PID:3716
- C:\Windows\System\tbrNYCn.exe
  C:\Windows\System\tbrNYCn.exe
  2⤵
  PID:3796
- C:\Windows\System\rUWudtl.exe
  C:\Windows\System\rUWudtl.exe
  2⤵
  PID:3812
- C:\Windows\System\WrDjiqu.exe
  C:\Windows\System\WrDjiqu.exe
  2⤵
  PID:3828
- C:\Windows\System\HbEDuBt.exe
  C:\Windows\System\HbEDuBt.exe
  2⤵
  PID:3848
- C:\Windows\System\SvPFDfH.exe
  C:\Windows\System\SvPFDfH.exe
  2⤵
  PID:3864
- C:\Windows\System\tmTEwvH.exe
  C:\Windows\System\tmTEwvH.exe
  2⤵
  PID:3880
- C:\Windows\System\sIUolSl.exe
  C:\Windows\System\sIUolSl.exe
  2⤵
  PID:3896
- C:\Windows\System\zblRJhH.exe
  C:\Windows\System\zblRJhH.exe
  2⤵
  PID:3912
- C:\Windows\System\uLEkupa.exe
  C:\Windows\System\uLEkupa.exe
  2⤵
  PID:3928
- C:\Windows\System\gWiqHJN.exe
  C:\Windows\System\gWiqHJN.exe
  2⤵
  PID:3944
- C:\Windows\System\gzuaryH.exe
  C:\Windows\System\gzuaryH.exe
  2⤵
  PID:3960
- C:\Windows\System\wuykGaF.exe
  C:\Windows\System\wuykGaF.exe
  2⤵
  PID:4004
- C:\Windows\System\vTbrvQU.exe
  C:\Windows\System\vTbrvQU.exe
  2⤵
  PID:4044
- C:\Windows\System\mXTjncE.exe
  C:\Windows\System\mXTjncE.exe
  2⤵
  PID:4060
- C:\Windows\System\XpVbuce.exe
  C:\Windows\System\XpVbuce.exe
  2⤵
  PID:4076
- C:\Windows\System\VyRCYVZ.exe
  C:\Windows\System\VyRCYVZ.exe
  2⤵
  PID:4092
- C:\Windows\System\VSzzifr.exe
  C:\Windows\System\VSzzifr.exe
  2⤵
  PID:3100
- C:\Windows\System\UtlquDo.exe
  C:\Windows\System\UtlquDo.exe
  2⤵
  PID:3124
- C:\Windows\System\qvesLhm.exe
  C:\Windows\System\qvesLhm.exe
  2⤵
  PID:3144
- C:\Windows\System\ZrXFjrr.exe
  C:\Windows\System\ZrXFjrr.exe
  2⤵
  PID:3148
- C:\Windows\System\lmAWSrL.exe
  C:\Windows\System\lmAWSrL.exe
  2⤵
  PID:3188
- C:\Windows\System\eblxxZu.exe
  C:\Windows\System\eblxxZu.exe
  2⤵
  PID:3204
- C:\Windows\System\YMsdiFF.exe
  C:\Windows\System\YMsdiFF.exe
  2⤵
  PID:3236
- C:\Windows\System\YdNGEDX.exe
  C:\Windows\System\YdNGEDX.exe
  2⤵
  PID:3272
- C:\Windows\System\ZIKPpxB.exe
  C:\Windows\System\ZIKPpxB.exe
  2⤵
  PID:3304
- C:\Windows\System\BeqTkKV.exe
  C:\Windows\System\BeqTkKV.exe
  2⤵
  PID:3332
- C:\Windows\System\pnSiYAJ.exe
  C:\Windows\System\pnSiYAJ.exe
  2⤵
  PID:3356
- C:\Windows\System\FKVISGl.exe
  C:\Windows\System\FKVISGl.exe
  2⤵
  PID:3384
- C:\Windows\System\hOxTfEJ.exe
  C:\Windows\System\hOxTfEJ.exe
  2⤵
  PID:3408
- C:\Windows\System\CJtgVXv.exe
  C:\Windows\System\CJtgVXv.exe
  2⤵
  PID:3428
- C:\Windows\System\HCSPYnL.exe
  C:\Windows\System\HCSPYnL.exe
  2⤵
  PID:3516
- C:\Windows\System\XxQbPya.exe
  C:\Windows\System\XxQbPya.exe
  2⤵
  PID:3584
- C:\Windows\System\hVlRJsa.exe
  C:\Windows\System\hVlRJsa.exe
  2⤵
  PID:3724
- C:\Windows\System\ClbIDtT.exe
  C:\Windows\System\ClbIDtT.exe
  2⤵
  PID:3752
- C:\Windows\System\TEUVtvf.exe
  C:\Windows\System\TEUVtvf.exe
  2⤵
  PID:3772
- C:\Windows\System\NKlCksW.exe
  C:\Windows\System\NKlCksW.exe
  2⤵
  PID:3788
- C:\Windows\System\dqMdjOP.exe
  C:\Windows\System\dqMdjOP.exe
  2⤵
  PID:3712
- C:\Windows\System\xpSfKZl.exe
  C:\Windows\System\xpSfKZl.exe
  2⤵
  PID:2756
- C:\Windows\System\ksKzxkT.exe
  C:\Windows\System\ksKzxkT.exe
  2⤵
  PID:3836
- C:\Windows\System\rcPwytf.exe
  C:\Windows\System\rcPwytf.exe
  2⤵
  PID:3876
- C:\Windows\System\DnQtKop.exe
  C:\Windows\System\DnQtKop.exe
  2⤵
  PID:3892
- C:\Windows\System\uNwEsie.exe
  C:\Windows\System\uNwEsie.exe
  2⤵
  PID:3956
- C:\Windows\System\VuVrKVp.exe
  C:\Windows\System\VuVrKVp.exe
  2⤵
  PID:3988
- C:\Windows\System\ADkOnoI.exe
  C:\Windows\System\ADkOnoI.exe
  2⤵
  PID:4000
- C:\Windows\System\oAVUkGx.exe
  C:\Windows\System\oAVUkGx.exe
  2⤵
  PID:4088
- C:\Windows\System\RlsZLJf.exe
  C:\Windows\System\RlsZLJf.exe
  2⤵
  PID:3212
- C:\Windows\System\evcrymE.exe
  C:\Windows\System\evcrymE.exe
  2⤵
  PID:3308
- C:\Windows\System\cMEzred.exe
  C:\Windows\System\cMEzred.exe
  2⤵
  PID:3432
- C:\Windows\System\FDwocdg.exe
  C:\Windows\System\FDwocdg.exe
  2⤵
  PID:3208
- C:\Windows\System\YiSfnUm.exe
  C:\Windows\System\YiSfnUm.exe
  2⤵
  PID:3452
- C:\Windows\System\kxUXIPc.exe
  C:\Windows\System\kxUXIPc.exe
  2⤵
  PID:4068
- C:\Windows\System\hVxUsEG.exe
  C:\Windows\System\hVxUsEG.exe
  2⤵
  PID:3080
- C:\Windows\System\ViqKVAf.exe
  C:\Windows\System\ViqKVAf.exe
  2⤵
  PID:3184
- C:\Windows\System\UmfRvzG.exe
  C:\Windows\System\UmfRvzG.exe
  2⤵
  PID:3288
- C:\Windows\System\IyEUHBJ.exe
  C:\Windows\System\IyEUHBJ.exe
  2⤵
  PID:3644
- C:\Windows\System\qRZZTPo.exe
  C:\Windows\System\qRZZTPo.exe
  2⤵
  PID:3464
- C:\Windows\System\lQbBZzI.exe
  C:\Windows\System\lQbBZzI.exe
  2⤵
  PID:3532
- C:\Windows\System\qJzgqTP.exe
  C:\Windows\System\qJzgqTP.exe
  2⤵
  PID:3600
- C:\Windows\System\tXjvLYS.exe
  C:\Windows\System\tXjvLYS.exe
  2⤵
  PID:3696
- C:\Windows\System\PwrpvFz.exe
  C:\Windows\System\PwrpvFz.exe
  2⤵
  PID:3484
- C:\Windows\System\XOAXmmX.exe
  C:\Windows\System\XOAXmmX.exe
  2⤵
  PID:3784
- C:\Windows\System\gNpocij.exe
  C:\Windows\System\gNpocij.exe
  2⤵
  PID:4032
- C:\Windows\System\hPGTgVB.exe
  C:\Windows\System\hPGTgVB.exe
  2⤵
  PID:3104
- C:\Windows\System\SGjYHIZ.exe
  C:\Windows\System\SGjYHIZ.exe
  2⤵
  PID:3232
- C:\Windows\System\uPaTmyG.exe
  C:\Windows\System\uPaTmyG.exe
  2⤵
  PID:3496
- C:\Windows\System\IzwfmvU.exe
  C:\Windows\System\IzwfmvU.exe
  2⤵
  PID:3156
- C:\Windows\System\tqiHUFA.exe
  C:\Windows\System\tqiHUFA.exe
  2⤵
  PID:3564
- C:\Windows\System\HIgeKtK.exe
  C:\Windows\System\HIgeKtK.exe
  2⤵
  PID:3528
- C:\Windows\System\zkoSxRt.exe
  C:\Windows\System\zkoSxRt.exe
  2⤵
  PID:3140
- C:\Windows\System\NzuqyHV.exe
  C:\Windows\System\NzuqyHV.exe
  2⤵
  PID:3748
- C:\Windows\System\FOSJeSa.exe
  C:\Windows\System\FOSJeSa.exe
  2⤵
  PID:3844
- C:\Windows\System\MMOyJtq.exe
  C:\Windows\System\MMOyJtq.exe
  2⤵
  PID:3980
- C:\Windows\System\nMLiuHp.exe
  C:\Windows\System\nMLiuHp.exe
  2⤵
  PID:3860
- C:\Windows\System\uABqWrU.exe
  C:\Windows\System\uABqWrU.exe
  2⤵
  PID:3996
- C:\Windows\System\rpsPTJX.exe
  C:\Windows\System\rpsPTJX.exe
  2⤵
  PID:3940
- C:\Windows\System\KjQaUhP.exe
  C:\Windows\System\KjQaUhP.exe
  2⤵
  PID:3768
- C:\Windows\System\FNrgIkh.exe
  C:\Windows\System\FNrgIkh.exe
  2⤵
  PID:3764
- C:\Windows\System\zpAhTJB.exe
  C:\Windows\System\zpAhTJB.exe
  2⤵
  PID:4012
- C:\Windows\System\WbwfmTR.exe
  C:\Windows\System\WbwfmTR.exe
  2⤵
  PID:4020
- C:\Windows\System\hiNlBZm.exe
  C:\Windows\System\hiNlBZm.exe
  2⤵
  PID:3352
- C:\Windows\System\EOMxUMT.exe
  C:\Windows\System\EOMxUMT.exe
  2⤵
  PID:4084
- C:\Windows\System\bPlnnyA.exe
  C:\Windows\System\bPlnnyA.exe
  2⤵
  PID:3872
- C:\Windows\System\FJZkMwD.exe
  C:\Windows\System\FJZkMwD.exe
  2⤵
  PID:3344
- C:\Windows\System\vsRyvnX.exe
  C:\Windows\System\vsRyvnX.exe
  2⤵
  PID:3252
- C:\Windows\System\WHVGzGc.exe
  C:\Windows\System\WHVGzGc.exe
  2⤵
  PID:3396
- C:\Windows\System\pDTNlkG.exe
  C:\Windows\System\pDTNlkG.exe
  2⤵
  PID:3888
- C:\Windows\System\KhvXqUy.exe
  C:\Windows\System\KhvXqUy.exe
  2⤵
  PID:3372
- C:\Windows\System\SzYwnRC.exe
  C:\Windows\System\SzYwnRC.exe
  2⤵
  PID:4116
- C:\Windows\System\eTNenAL.exe
  C:\Windows\System\eTNenAL.exe
  2⤵
  PID:4140
- C:\Windows\System\QrEqrzZ.exe
  C:\Windows\System\QrEqrzZ.exe
  2⤵
  PID:4156
- C:\Windows\System\fQPtlCj.exe
  C:\Windows\System\fQPtlCj.exe
  2⤵
  PID:4188
- C:\Windows\System\NfRGViv.exe
  C:\Windows\System\NfRGViv.exe
  2⤵
  PID:4204
- C:\Windows\System\IBKJvyN.exe
  C:\Windows\System\IBKJvyN.exe
  2⤵
  PID:4220
- C:\Windows\System\KRdzKqo.exe
  C:\Windows\System\KRdzKqo.exe
  2⤵
  PID:4244
- C:\Windows\System\VhlHtQs.exe
  C:\Windows\System\VhlHtQs.exe
  2⤵
  PID:4260
- C:\Windows\System\BjyHVkf.exe
  C:\Windows\System\BjyHVkf.exe
  2⤵
  PID:4292
- C:\Windows\System\gQMAnUt.exe
  C:\Windows\System\gQMAnUt.exe
  2⤵
  PID:4308
- C:\Windows\System\pGxHjHb.exe
  C:\Windows\System\pGxHjHb.exe
  2⤵
  PID:4324
- C:\Windows\System\HVhqeVh.exe
  C:\Windows\System\HVhqeVh.exe
  2⤵
  PID:4376
- C:\Windows\System\OdPQWpR.exe
  C:\Windows\System\OdPQWpR.exe
  2⤵
  PID:4392
- C:\Windows\System\AhwypLV.exe
  C:\Windows\System\AhwypLV.exe
  2⤵
  PID:4412
- C:\Windows\System\SZGHNJJ.exe
  C:\Windows\System\SZGHNJJ.exe
  2⤵
  PID:4428
- C:\Windows\System\wZvySPK.exe
  C:\Windows\System\wZvySPK.exe
  2⤵
  PID:4444
- C:\Windows\System\sIxouiY.exe
  C:\Windows\System\sIxouiY.exe
  2⤵
  PID:4472
- C:\Windows\System\mhlnUny.exe
  C:\Windows\System\mhlnUny.exe
  2⤵
  PID:4488
- C:\Windows\System\UvZsVZo.exe
  C:\Windows\System\UvZsVZo.exe
  2⤵
  PID:4508
- C:\Windows\System\gLDmagv.exe
  C:\Windows\System\gLDmagv.exe
  2⤵
  PID:4524
- C:\Windows\System\xjJxBLC.exe
  C:\Windows\System\xjJxBLC.exe
  2⤵
  PID:4540
- C:\Windows\System\WiVryjr.exe
  C:\Windows\System\WiVryjr.exe
  2⤵
  PID:4556
- C:\Windows\System\dVEOaxQ.exe
  C:\Windows\System\dVEOaxQ.exe
  2⤵
  PID:4572
- C:\Windows\System\qdgKobp.exe
  C:\Windows\System\qdgKobp.exe
  2⤵
  PID:4588
- C:\Windows\System\HmTibRG.exe
  C:\Windows\System\HmTibRG.exe
  2⤵
  PID:4620
- C:\Windows\System\zTIfTOZ.exe
  C:\Windows\System\zTIfTOZ.exe
  2⤵
  PID:4636
- C:\Windows\System\KcmxsTb.exe
  C:\Windows\System\KcmxsTb.exe
  2⤵
  PID:4656
- C:\Windows\System\AVCrIJZ.exe
  C:\Windows\System\AVCrIJZ.exe
  2⤵
  PID:4672
- C:\Windows\System\gvohWui.exe
  C:\Windows\System\gvohWui.exe
  2⤵
  PID:4688
- C:\Windows\System\cNuTxlw.exe
  C:\Windows\System\cNuTxlw.exe
  2⤵
  PID:4704
- C:\Windows\System\gtWzQPg.exe
  C:\Windows\System\gtWzQPg.exe
  2⤵
  PID:4720
- C:\Windows\System\cpagnsG.exe
  C:\Windows\System\cpagnsG.exe
  2⤵
  PID:4740
- C:\Windows\System\bjotrec.exe
  C:\Windows\System\bjotrec.exe
  2⤵
  PID:4756
- C:\Windows\System\nMsINgs.exe
  C:\Windows\System\nMsINgs.exe
  2⤵
  PID:4772
- C:\Windows\System\GXpmXuG.exe
  C:\Windows\System\GXpmXuG.exe
  2⤵
  PID:4788
- C:\Windows\System\mAoYViJ.exe
  C:\Windows\System\mAoYViJ.exe
  2⤵
  PID:4804
- C:\Windows\System\jsXkKNS.exe
  C:\Windows\System\jsXkKNS.exe
  2⤵
  PID:4820
- C:\Windows\System\rJmnQgM.exe
  C:\Windows\System\rJmnQgM.exe
  2⤵
  PID:4836
- C:\Windows\System\FPbrAgZ.exe
  C:\Windows\System\FPbrAgZ.exe
  2⤵
  PID:4856
- C:\Windows\System\QvXjvbM.exe
  C:\Windows\System\QvXjvbM.exe
  2⤵
  PID:4872
- C:\Windows\System\fOswElW.exe
  C:\Windows\System\fOswElW.exe
  2⤵
  PID:4888
- C:\Windows\System\IZnMAuO.exe
  C:\Windows\System\IZnMAuO.exe
  2⤵
  PID:4904
- C:\Windows\System\CmxbyUI.exe
  C:\Windows\System\CmxbyUI.exe
  2⤵
  PID:4920
- C:\Windows\System\nsWsUCO.exe
  C:\Windows\System\nsWsUCO.exe
  2⤵
  PID:4936
- C:\Windows\System\CgPgNps.exe
  C:\Windows\System\CgPgNps.exe
  2⤵
  PID:4952
- C:\Windows\System\ZwfVqMf.exe
  C:\Windows\System\ZwfVqMf.exe
  2⤵
  PID:4972
- C:\Windows\System\SjmsLoH.exe
  C:\Windows\System\SjmsLoH.exe
  2⤵
  PID:4988
- C:\Windows\System\gyrxzgp.exe
  C:\Windows\System\gyrxzgp.exe
  2⤵
  PID:5004
- C:\Windows\System\IRNZSTg.exe
  C:\Windows\System\IRNZSTg.exe
  2⤵
  PID:5020
- C:\Windows\System\fveXDcl.exe
  C:\Windows\System\fveXDcl.exe
  2⤵
  PID:5036
- C:\Windows\System\ZLwlxoZ.exe
  C:\Windows\System\ZLwlxoZ.exe
  2⤵
  PID:5056
- C:\Windows\System\pmWVJNG.exe
  C:\Windows\System\pmWVJNG.exe
  2⤵
  PID:5072
- C:\Windows\System\umBnytC.exe
  C:\Windows\System\umBnytC.exe
  2⤵
  PID:5088
- C:\Windows\System\QXUJmas.exe
  C:\Windows\System\QXUJmas.exe
  2⤵
  PID:5104
- C:\Windows\System\xHzTics.exe
  C:\Windows\System\xHzTics.exe
  2⤵
  PID:3676
- C:\Windows\System\WKuyZNg.exe
  C:\Windows\System\WKuyZNg.exe
  2⤵
  PID:4100
- C:\Windows\System\iemoESZ.exe
  C:\Windows\System\iemoESZ.exe
  2⤵
  PID:4180
- C:\Windows\System\RlVNbtc.exe
  C:\Windows\System\RlVNbtc.exe
  2⤵
  PID:4360
- C:\Windows\System\XsxzdsR.exe
  C:\Windows\System\XsxzdsR.exe
  2⤵
  PID:4384
- C:\Windows\System\fUFwKts.exe
  C:\Windows\System\fUFwKts.exe
  2⤵
  PID:4404
- C:\Windows\System\Djhbmmp.exe
  C:\Windows\System\Djhbmmp.exe
  2⤵
  PID:4452
- C:\Windows\System\UHsEfVM.exe
  C:\Windows\System\UHsEfVM.exe
  2⤵
  PID:4480
- C:\Windows\System\NCPeDgu.exe
  C:\Windows\System\NCPeDgu.exe
  2⤵
  PID:4504
- C:\Windows\System\uHgBupQ.exe
  C:\Windows\System\uHgBupQ.exe
  2⤵
  PID:4568
- C:\Windows\System\XksrgxE.exe
  C:\Windows\System\XksrgxE.exe
  2⤵
  PID:4612
- C:\Windows\System\ZDIHZPp.exe
  C:\Windows\System\ZDIHZPp.exe
  2⤵
  PID:4752
- C:\Windows\System\VJMMmwO.exe
  C:\Windows\System\VJMMmwO.exe
  2⤵
  PID:4580
- C:\Windows\System\sNQltZk.exe
  C:\Windows\System\sNQltZk.exe
  2⤵
  PID:4696
- C:\Windows\System\gGZSRCb.exe
  C:\Windows\System\gGZSRCb.exe
  2⤵
  PID:4912
- C:\Windows\System\HgROhEQ.exe
  C:\Windows\System\HgROhEQ.exe
  2⤵
  PID:4680
- C:\Windows\System\qRiGxkR.exe
  C:\Windows\System\qRiGxkR.exe
  2⤵
  PID:4684
- C:\Windows\System\yZDXTQa.exe
  C:\Windows\System\yZDXTQa.exe
  2⤵
  PID:4632
- C:\Windows\System\wpBboEL.exe
  C:\Windows\System\wpBboEL.exe
  2⤵
  PID:4716
- C:\Windows\System\eZNyBEq.exe
  C:\Windows\System\eZNyBEq.exe
  2⤵
  PID:4796
- C:\Windows\System\iBlUjsj.exe
  C:\Windows\System\iBlUjsj.exe
  2⤵
  PID:4864
- C:\Windows\System\wZUvyga.exe
  C:\Windows\System\wZUvyga.exe
  2⤵
  PID:4104
- C:\Windows\System\udjhsHt.exe
  C:\Windows\System\udjhsHt.exe
  2⤵
  PID:5052
- C:\Windows\System\YrtpJZy.exe
  C:\Windows\System\YrtpJZy.exe
  2⤵
  PID:5080
- C:\Windows\System\SxisDvc.exe
  C:\Windows\System\SxisDvc.exe
  2⤵
  PID:4968
- C:\Windows\System\WfMvLml.exe
  C:\Windows\System\WfMvLml.exe
  2⤵
  PID:4984
- C:\Windows\System\lhFRVVj.exe
  C:\Windows\System\lhFRVVj.exe
  2⤵
  PID:4168
- C:\Windows\System\HRKbeiZ.exe
  C:\Windows\System\HRKbeiZ.exe
  2⤵
  PID:5100
- C:\Windows\System\BTdXiAk.exe
  C:\Windows\System\BTdXiAk.exe
  2⤵
  PID:4196
- C:\Windows\System\nZiGBtk.exe
  C:\Windows\System\nZiGBtk.exe
  2⤵
  PID:4200
- C:\Windows\System\oUhTgyd.exe
  C:\Windows\System\oUhTgyd.exe
  2⤵
  PID:4268
- C:\Windows\System\dsTzSlU.exe
  C:\Windows\System\dsTzSlU.exe
  2⤵
  PID:4280
- C:\Windows\System\IBaRonj.exe
  C:\Windows\System\IBaRonj.exe
  2⤵
  PID:4276
- C:\Windows\System\EZMMurP.exe
  C:\Windows\System\EZMMurP.exe
  2⤵
  PID:4336
- C:\Windows\System\WLmOtdp.exe
  C:\Windows\System\WLmOtdp.exe
  2⤵
  PID:4352
- C:\Windows\System\HskEyeD.exe
  C:\Windows\System\HskEyeD.exe
  2⤵
  PID:4372
- C:\Windows\System\aflChtU.exe
  C:\Windows\System\aflChtU.exe
  2⤵
  PID:4424
- C:\Windows\System\ZxNTSNZ.exe
  C:\Windows\System\ZxNTSNZ.exe
  2⤵
  PID:4496
- C:\Windows\System\hLSkoLe.exe
  C:\Windows\System\hLSkoLe.exe
  2⤵
  PID:4596
- C:\Windows\System\kLndvjn.exe
  C:\Windows\System\kLndvjn.exe
  2⤵
  PID:4616
- C:\Windows\System\QUiGzoh.exe
  C:\Windows\System\QUiGzoh.exe
  2⤵
  PID:4780
- C:\Windows\System\rSHOnZg.exe
  C:\Windows\System\rSHOnZg.exe
  2⤵
  PID:4812
- C:\Windows\System\VItytGY.exe
  C:\Windows\System\VItytGY.exe
  2⤵
  PID:4848
- C:\Windows\System\vFcldVK.exe
  C:\Windows\System\vFcldVK.exe
  2⤵
  PID:4648
- C:\Windows\System\tWjPsJe.exe
  C:\Windows\System\tWjPsJe.exe
  2⤵
  PID:4960
- C:\Windows\System\UwrHpLA.exe
  C:\Windows\System\UwrHpLA.exe
  2⤵
  PID:4256
- C:\Windows\System\gCyFRRn.exe
  C:\Windows\System\gCyFRRn.exe
  2⤵
  PID:4944
- C:\Windows\System\GYGPnnF.exe
  C:\Windows\System\GYGPnnF.exe
  2⤵
  PID:4996
- C:\Windows\System\PAjWqYd.exe
  C:\Windows\System\PAjWqYd.exe
  2⤵
  PID:4748
- C:\Windows\System\WUqyfmJ.exe
  C:\Windows\System\WUqyfmJ.exe
  2⤵
  PID:4436
- C:\Windows\System\YSehWce.exe
  C:\Windows\System\YSehWce.exe
  2⤵
  PID:4300
- C:\Windows\System\tEAvqiz.exe
  C:\Windows\System\tEAvqiz.exe
  2⤵
  PID:4388
- C:\Windows\System\GchWGxt.exe
  C:\Windows\System\GchWGxt.exe
  2⤵
  PID:4880
- C:\Windows\System\FTPSnQu.exe
  C:\Windows\System\FTPSnQu.exe
  2⤵
  PID:4124
- C:\Windows\System\yIhYFUH.exe
  C:\Windows\System\yIhYFUH.exe
  2⤵
  PID:4184
- C:\Windows\System\zwCEhxn.exe
  C:\Windows\System\zwCEhxn.exe
  2⤵
  PID:4948
- C:\Windows\System\PTnUWik.exe
  C:\Windows\System\PTnUWik.exe
  2⤵
  PID:4148
- C:\Windows\System\eDCLIPV.exe
  C:\Windows\System\eDCLIPV.exe
  2⤵
  PID:4304
- C:\Windows\System\JBdgeTx.exe
  C:\Windows\System\JBdgeTx.exe
  2⤵
  PID:5032
- C:\Windows\System\BoAzrdv.exe
  C:\Windows\System\BoAzrdv.exe
  2⤵
  PID:4516
- C:\Windows\System\LQZrcFP.exe
  C:\Windows\System\LQZrcFP.exe
  2⤵
  PID:4768
- C:\Windows\System\grKvcbU.exe
  C:\Windows\System\grKvcbU.exe
  2⤵
  PID:4320
- C:\Windows\System\oCQyNgV.exe
  C:\Windows\System\oCQyNgV.exe
  2⤵
  PID:4828
- C:\Windows\System\eJTHnQb.exe
  C:\Windows\System\eJTHnQb.exe
  2⤵
  PID:4228
- C:\Windows\System\zxPhHxI.exe
  C:\Windows\System\zxPhHxI.exe
  2⤵
  PID:4548
- C:\Windows\System\NbvPFox.exe
  C:\Windows\System\NbvPFox.exe
  2⤵
  PID:4132
- C:\Windows\System\vioExKQ.exe
  C:\Windows\System\vioExKQ.exe
  2⤵
  PID:4136
- C:\Windows\System\EVcouZL.exe
  C:\Windows\System\EVcouZL.exe
  2⤵
  PID:4628
- C:\Windows\System\uFjdWqs.exe
  C:\Windows\System\uFjdWqs.exe
  2⤵
  PID:4732
- C:\Windows\System\tuzZrsL.exe
  C:\Windows\System\tuzZrsL.exe
  2⤵
  PID:5132
- C:\Windows\System\xHNRehl.exe
  C:\Windows\System\xHNRehl.exe
  2⤵
  PID:5148
- C:\Windows\System\ujcusrr.exe
  C:\Windows\System\ujcusrr.exe
  2⤵
  PID:5164
- C:\Windows\System\pRnUIec.exe
  C:\Windows\System\pRnUIec.exe
  2⤵
  PID:5180
- C:\Windows\System\ACdoOvz.exe
  C:\Windows\System\ACdoOvz.exe
  2⤵
  PID:5196
- C:\Windows\System\FxxCzSx.exe
  C:\Windows\System\FxxCzSx.exe
  2⤵
  PID:5212
- C:\Windows\System\altcMOd.exe
  C:\Windows\System\altcMOd.exe
  2⤵
  PID:5228
- C:\Windows\System\BCToNho.exe
  C:\Windows\System\BCToNho.exe
  2⤵
  PID:5248
- C:\Windows\System\ahjOCGM.exe
  C:\Windows\System\ahjOCGM.exe
  2⤵
  PID:5264
- C:\Windows\System\sXXBcaE.exe
  C:\Windows\System\sXXBcaE.exe
  2⤵
  PID:5280
- C:\Windows\System\nrJNRJn.exe
  C:\Windows\System\nrJNRJn.exe
  2⤵
  PID:5296
- C:\Windows\System\xpBinnJ.exe
  C:\Windows\System\xpBinnJ.exe
  2⤵
  PID:5312
- C:\Windows\System\gUgcRoR.exe
  C:\Windows\System\gUgcRoR.exe
  2⤵
  PID:5328
- C:\Windows\System\fySAySz.exe
  C:\Windows\System\fySAySz.exe
  2⤵
  PID:5348
- C:\Windows\System\ujFebzw.exe
  C:\Windows\System\ujFebzw.exe
  2⤵
  PID:5364
- C:\Windows\System\itNcMJV.exe
  C:\Windows\System\itNcMJV.exe
  2⤵
  PID:5380
- C:\Windows\System\cFQhTle.exe
  C:\Windows\System\cFQhTle.exe
  2⤵
  PID:5396
- C:\Windows\System\HWLhpQD.exe
  C:\Windows\System\HWLhpQD.exe
  2⤵
  PID:5412
- C:\Windows\System\gRPoXle.exe
  C:\Windows\System\gRPoXle.exe
  2⤵
  PID:5428
- C:\Windows\System\ndsevuf.exe
  C:\Windows\System\ndsevuf.exe
  2⤵
  PID:5444
- C:\Windows\System\TnXiAwV.exe
  C:\Windows\System\TnXiAwV.exe
  2⤵
  PID:5460
- C:\Windows\System\ONpaRRC.exe
  C:\Windows\System\ONpaRRC.exe
  2⤵
  PID:5476
- C:\Windows\System\RDdCBYt.exe
  C:\Windows\System\RDdCBYt.exe
  2⤵
  PID:5572
- C:\Windows\System\sVIojnk.exe
  C:\Windows\System\sVIojnk.exe
  2⤵
  PID:5588
- C:\Windows\System\RmmvWQf.exe
  C:\Windows\System\RmmvWQf.exe
  2⤵
  PID:5608
- C:\Windows\System\xjJwiBy.exe
  C:\Windows\System\xjJwiBy.exe
  2⤵
  PID:5624
- C:\Windows\System\HqGbYpY.exe
  C:\Windows\System\HqGbYpY.exe
  2⤵
  PID:5640
- C:\Windows\System\scAcPmy.exe
  C:\Windows\System\scAcPmy.exe
  2⤵
  PID:5656
- C:\Windows\System\EnnELbO.exe
  C:\Windows\System\EnnELbO.exe
  2⤵
  PID:5672
- C:\Windows\System\VlXKBvH.exe
  C:\Windows\System\VlXKBvH.exe
  2⤵
  PID:5768
- C:\Windows\System\dvcUZCt.exe
  C:\Windows\System\dvcUZCt.exe
  2⤵
  PID:5788
- C:\Windows\System\AEcODTH.exe
  C:\Windows\System\AEcODTH.exe
  2⤵
  PID:5812
- C:\Windows\System\tpxxeiU.exe
  C:\Windows\System\tpxxeiU.exe
  2⤵
  PID:5832
- C:\Windows\System\okrOGMA.exe
  C:\Windows\System\okrOGMA.exe
  2⤵
  PID:5848
- C:\Windows\System\kNurwki.exe
  C:\Windows\System\kNurwki.exe
  2⤵
  PID:5864
- C:\Windows\System\UHvuYSx.exe
  C:\Windows\System\UHvuYSx.exe
  2⤵
  PID:5880
- C:\Windows\System\QwfffWU.exe
  C:\Windows\System\QwfffWU.exe
  2⤵
  PID:5896
- C:\Windows\System\LFfzJUO.exe
  C:\Windows\System\LFfzJUO.exe
  2⤵
  PID:5912
- C:\Windows\System\anXRlqc.exe
  C:\Windows\System\anXRlqc.exe
  2⤵
  PID:5928
- C:\Windows\System\tckDOgP.exe
  C:\Windows\System\tckDOgP.exe
  2⤵
  PID:5944
- C:\Windows\System\Sgeygdd.exe
  C:\Windows\System\Sgeygdd.exe
  2⤵
  PID:5960
- C:\Windows\System\IhsWVVI.exe
  C:\Windows\System\IhsWVVI.exe
  2⤵
  PID:5976
- C:\Windows\System\OfGsIhR.exe
  C:\Windows\System\OfGsIhR.exe
  2⤵
  PID:5996
- C:\Windows\System\hiQSSCA.exe
  C:\Windows\System\hiQSSCA.exe
  2⤵
  PID:6012
- C:\Windows\System\lnxbDsi.exe
  C:\Windows\System\lnxbDsi.exe
  2⤵
  PID:6032
- C:\Windows\System\xBxqTIm.exe
  C:\Windows\System\xBxqTIm.exe
  2⤵
  PID:6084
- C:\Windows\System\QSIFABN.exe
  C:\Windows\System\QSIFABN.exe
  2⤵
  PID:6100
- C:\Windows\System\pPIDLeX.exe
  C:\Windows\System\pPIDLeX.exe
  2⤵
  PID:6120
- C:\Windows\System\YYlozce.exe
  C:\Windows\System\YYlozce.exe
  2⤵
  PID:5224
- C:\Windows\System\ZHubVHe.exe
  C:\Windows\System\ZHubVHe.exe
  2⤵
  PID:4284
- C:\Windows\System\BUXXiYn.exe
  C:\Windows\System\BUXXiYn.exe
  2⤵
  PID:5324
- C:\Windows\System\YWFDeOE.exe
  C:\Windows\System\YWFDeOE.exe
  2⤵
  PID:5064
- C:\Windows\System\xOZcpRO.exe
  C:\Windows\System\xOZcpRO.exe
  2⤵
  PID:5340
- C:\Windows\System\mlWHEwK.exe
  C:\Windows\System\mlWHEwK.exe
  2⤵
  PID:5372
- C:\Windows\System\cqldTFp.exe
  C:\Windows\System\cqldTFp.exe
  2⤵
  PID:4464
- C:\Windows\System\PfyIviP.exe
  C:\Windows\System\PfyIviP.exe
  2⤵
  PID:5156
- C:\Windows\System\nwjSDqa.exe
  C:\Windows\System\nwjSDqa.exe
  2⤵
  PID:5424
- C:\Windows\System\AMrEIaq.exe
  C:\Windows\System\AMrEIaq.exe
  2⤵
  PID:5456
- C:\Windows\System\BiuOihE.exe
  C:\Windows\System\BiuOihE.exe
  2⤵
  PID:4900
- C:\Windows\System\gOoAZjW.exe
  C:\Windows\System\gOoAZjW.exe
  2⤵
  PID:5504
- C:\Windows\System\KZkrBOL.exe
  C:\Windows\System\KZkrBOL.exe
  2⤵
  PID:5320
- C:\Windows\System\wtDEEqG.exe
  C:\Windows\System\wtDEEqG.exe
  2⤵
  PID:5616
- C:\Windows\System\uKnRxBm.exe
  C:\Windows\System\uKnRxBm.exe
  2⤵
  PID:5680
- C:\Windows\System\HZpuIcj.exe
  C:\Windows\System\HZpuIcj.exe
  2⤵
  PID:5692
- C:\Windows\System\UXqWGgu.exe
  C:\Windows\System\UXqWGgu.exe
  2⤵
  PID:5496
- C:\Windows\System\dtYviMx.exe
  C:\Windows\System\dtYviMx.exe
  2⤵
  PID:5520
- C:\Windows\System\gbBdrOd.exe
  C:\Windows\System\gbBdrOd.exe
  2⤵
  PID:5536
- C:\Windows\System\xfkaCVO.exe
  C:\Windows\System\xfkaCVO.exe
  2⤵
  PID:5144
- C:\Windows\System\QksjSkX.exe
  C:\Windows\System\QksjSkX.exe
  2⤵
  PID:5696
- C:\Windows\System\LaPFMBJ.exe
  C:\Windows\System\LaPFMBJ.exe
  2⤵
  PID:5556
- C:\Windows\System\msqfSQK.exe
  C:\Windows\System\msqfSQK.exe
  2⤵
  PID:5604
- C:\Windows\System\qAWPdxM.exe
  C:\Windows\System\qAWPdxM.exe
  2⤵
  PID:5752
- C:\Windows\System\kpXPehP.exe
  C:\Windows\System\kpXPehP.exe
  2⤵
  PID:5780
- C:\Windows\System\HdhLEKm.exe
  C:\Windows\System\HdhLEKm.exe
  2⤵
  PID:5756
- C:\Windows\System\zVVMoPM.exe
  C:\Windows\System\zVVMoPM.exe
  2⤵
  PID:6024
- C:\Windows\System\xQgiejU.exe
  C:\Windows\System\xQgiejU.exe
  2⤵
  PID:5840
- C:\Windows\System\xbtVGAB.exe
  C:\Windows\System\xbtVGAB.exe
  2⤵
  PID:5936
- C:\Windows\System\XDDKexK.exe
  C:\Windows\System\XDDKexK.exe
  2⤵
  PID:6068
- C:\Windows\System\nPZVVOu.exe
  C:\Windows\System\nPZVVOu.exe
  2⤵
  PID:6092
- C:\Windows\System\vfjLQJQ.exe
  C:\Windows\System\vfjLQJQ.exe
  2⤵
  PID:6140
- C:\Windows\System\hUhEzUO.exe
  C:\Windows\System\hUhEzUO.exe
  2⤵
  PID:6136
- C:\Windows\System\rmOfzNh.exe
  C:\Windows\System\rmOfzNh.exe
  2⤵
  PID:4108
- C:\Windows\System\kmWQfCR.exe
  C:\Windows\System\kmWQfCR.exe
  2⤵
  PID:4212
- C:\Windows\System\lUOwZLE.exe
  C:\Windows\System\lUOwZLE.exe
  2⤵
  PID:5140
- C:\Windows\System\uVVgBab.exe
  C:\Windows\System\uVVgBab.exe
  2⤵
  PID:5580
- C:\Windows\System\WkrMQoA.exe
  C:\Windows\System\WkrMQoA.exe
  2⤵
  PID:5688
- C:\Windows\System\eJgkjOm.exe
  C:\Windows\System\eJgkjOm.exe
  2⤵
  PID:5636
- C:\Windows\System\NtDDVBK.exe
  C:\Windows\System\NtDDVBK.exe
  2⤵
  PID:5220
- C:\Windows\System\szkNpQK.exe
  C:\Windows\System\szkNpQK.exe
  2⤵
  PID:5760
- C:\Windows\System\oQfDBvD.exe
  C:\Windows\System\oQfDBvD.exe
  2⤵
  PID:5044
- C:\Windows\System\mXOEQOf.exe
  C:\Windows\System\mXOEQOf.exe
  2⤵
  PID:5568
- C:\Windows\System\MTkDNvH.exe
  C:\Windows\System\MTkDNvH.exe
  2⤵
  PID:5128
- C:\Windows\System\amJgNHa.exe
  C:\Windows\System\amJgNHa.exe
  2⤵
  PID:5648
- C:\Windows\System\tKFqTrp.exe
  C:\Windows\System\tKFqTrp.exe
  2⤵
  PID:5724
- C:\Windows\System\KrKDcqJ.exe
  C:\Windows\System\KrKDcqJ.exe
  2⤵
  PID:4964
- C:\Windows\System\UiJclNv.exe
  C:\Windows\System\UiJclNv.exe
  2⤵
  PID:5828
- C:\Windows\System\SVeqoZK.exe
  C:\Windows\System\SVeqoZK.exe
  2⤵
  PID:5860
- C:\Windows\System\hCAzsdv.exe
  C:\Windows\System\hCAzsdv.exe
  2⤵
  PID:5952
- C:\Windows\System\EStaaaI.exe
  C:\Windows\System\EStaaaI.exe
  2⤵
  PID:5940
- C:\Windows\System\khFCkPY.exe
  C:\Windows\System\khFCkPY.exe
  2⤵
  PID:6020
- C:\Windows\System\fRuTfnh.exe
  C:\Windows\System\fRuTfnh.exe
  2⤵
  PID:5992
- C:\Windows\System\JlBpcEQ.exe
  C:\Windows\System\JlBpcEQ.exe
  2⤵
  PID:6060
- C:\Windows\System\mIaHiqT.exe
  C:\Windows\System\mIaHiqT.exe
  2⤵
  PID:5160
- C:\Windows\System\IWAxnCx.exe
  C:\Windows\System\IWAxnCx.exe
  2⤵
  PID:5392
- C:\Windows\System\EQHBkMq.exe
  C:\Windows\System\EQHBkMq.exe
  2⤵
  PID:6040
- C:\Windows\System\yqttZUT.exe
  C:\Windows\System\yqttZUT.exe
  2⤵
  PID:5172
- C:\Windows\System\uZXdIrA.exe
  C:\Windows\System\uZXdIrA.exe
  2⤵
  PID:5684
- C:\Windows\System\eDyPddL.exe
  C:\Windows\System\eDyPddL.exe
  2⤵
  PID:5748
- C:\Windows\System\jQvnTZh.exe
  C:\Windows\System\jQvnTZh.exe
  2⤵
  PID:5420
- C:\Windows\System\HMdYqqA.exe
  C:\Windows\System\HMdYqqA.exe
  2⤵
  PID:5516
- C:\Windows\System\xEbBeUY.exe
  C:\Windows\System\xEbBeUY.exe
  2⤵
  PID:5808
- C:\Windows\System\FUWvsXa.exe
  C:\Windows\System\FUWvsXa.exe
  2⤵
  PID:5924
- C:\Windows\System\bKRXuCV.exe
  C:\Windows\System\bKRXuCV.exe
  2⤵
  PID:5824
- C:\Windows\System\mHeVldc.exe
  C:\Windows\System\mHeVldc.exe
  2⤵
  PID:5292
- C:\Windows\System\DzVTRUZ.exe
  C:\Windows\System\DzVTRUZ.exe
  2⤵
  PID:5804
- C:\Windows\System\xiMwpQX.exe
  C:\Windows\System\xiMwpQX.exe
  2⤵
  PID:6112
- C:\Windows\System\fDvrynE.exe
  C:\Windows\System\fDvrynE.exe
  2⤵
  PID:4536
- C:\Windows\System\vcoorDB.exe
  C:\Windows\System\vcoorDB.exe
  2⤵
  PID:6080
- C:\Windows\System\WeJqgdh.exe
  C:\Windows\System\WeJqgdh.exe
  2⤵
  PID:5708
- C:\Windows\System\NHGTrCz.exe
  C:\Windows\System\NHGTrCz.exe
  2⤵
  PID:5388
- C:\Windows\System\GZNezvC.exe
  C:\Windows\System\GZNezvC.exe
  2⤵
  PID:5820
- C:\Windows\System\KMZdmoI.exe
  C:\Windows\System\KMZdmoI.exe
  2⤵
  PID:5484
- C:\Windows\System\wHfmPnh.exe
  C:\Windows\System\wHfmPnh.exe
  2⤵
  PID:5764
- C:\Windows\System\CHTESeT.exe
  C:\Windows\System\CHTESeT.exe
  2⤵
  PID:5972
- C:\Windows\System\CdkuJvN.exe
  C:\Windows\System\CdkuJvN.exe
  2⤵
  PID:4152
- C:\Windows\System\ufYlSJr.exe
  C:\Windows\System\ufYlSJr.exe
  2⤵
  PID:5560
- C:\Windows\System\VmlyZBL.exe
  C:\Windows\System\VmlyZBL.exe
  2⤵
  PID:6156
- C:\Windows\System\iOumxxs.exe
  C:\Windows\System\iOumxxs.exe
  2⤵
  PID:6172
- C:\Windows\System\LNFQoKr.exe
  C:\Windows\System\LNFQoKr.exe
  2⤵
  PID:6188
- C:\Windows\System\gYyvuym.exe
  C:\Windows\System\gYyvuym.exe
  2⤵
  PID:6344
- C:\Windows\System\iWzUlTf.exe
  C:\Windows\System\iWzUlTf.exe
  2⤵
  PID:6360
- C:\Windows\System\ZVTEiPT.exe
  C:\Windows\System\ZVTEiPT.exe
  2⤵
  PID:6376
- C:\Windows\System\qHDAaJN.exe
  C:\Windows\System\qHDAaJN.exe
  2⤵
  PID:6392
- C:\Windows\System\hrGuURs.exe
  C:\Windows\System\hrGuURs.exe
  2⤵
  PID:6408
- C:\Windows\System\LqCNBmU.exe
  C:\Windows\System\LqCNBmU.exe
  2⤵
  PID:6424
- C:\Windows\System\GHLhwBE.exe
  C:\Windows\System\GHLhwBE.exe
  2⤵
  PID:6440
- C:\Windows\System\uMNZQuu.exe
  C:\Windows\System\uMNZQuu.exe
  2⤵
  PID:6456
- C:\Windows\System\QFpjoFC.exe
  C:\Windows\System\QFpjoFC.exe
  2⤵
  PID:6472
- C:\Windows\System\nzTvUGF.exe
  C:\Windows\System\nzTvUGF.exe
  2⤵
  PID:6488
- C:\Windows\System\xaMPzJa.exe
  C:\Windows\System\xaMPzJa.exe
  2⤵
  PID:6504
- C:\Windows\System\XZAgsYW.exe
  C:\Windows\System\XZAgsYW.exe
  2⤵
  PID:6568
- C:\Windows\System\CTmszmg.exe
  C:\Windows\System\CTmszmg.exe
  2⤵
  PID:6584
- C:\Windows\System\DhzTIBq.exe
  C:\Windows\System\DhzTIBq.exe
  2⤵
  PID:6600
- C:\Windows\System\DaJktCc.exe
  C:\Windows\System\DaJktCc.exe
  2⤵
  PID:6616
- C:\Windows\System\eELDlcw.exe
  C:\Windows\System\eELDlcw.exe
  2⤵
  PID:6632
- C:\Windows\System\dfzoxhZ.exe
  C:\Windows\System\dfzoxhZ.exe
  2⤵
  PID:6648
- C:\Windows\System\AHfdlpv.exe
  C:\Windows\System\AHfdlpv.exe
  2⤵
  PID:6664
- C:\Windows\System\CjWncil.exe
  C:\Windows\System\CjWncil.exe
  2⤵
  PID:6680
- C:\Windows\System\SkXFfAR.exe
  C:\Windows\System\SkXFfAR.exe
  2⤵
  PID:6696
- C:\Windows\System\gENKNrd.exe
  C:\Windows\System\gENKNrd.exe
  2⤵
  PID:6712
- C:\Windows\System\BiRkOEd.exe
  C:\Windows\System\BiRkOEd.exe
  2⤵
  PID:6728
- C:\Windows\System\EKkyivR.exe
  C:\Windows\System\EKkyivR.exe
  2⤵
  PID:6744
- C:\Windows\System\Hnurrag.exe
  C:\Windows\System\Hnurrag.exe
  2⤵
  PID:6768
- C:\Windows\System\eKVxkNG.exe
  C:\Windows\System\eKVxkNG.exe
  2⤵
  PID:6784
- C:\Windows\System\lIgCuNG.exe
  C:\Windows\System\lIgCuNG.exe
  2⤵
  PID:6800
- C:\Windows\System\YtVjBNM.exe
  C:\Windows\System\YtVjBNM.exe
  2⤵
  PID:6816
- C:\Windows\System\myXtnGw.exe
  C:\Windows\System\myXtnGw.exe
  2⤵
  PID:6836
- C:\Windows\System\ImQYwsy.exe
  C:\Windows\System\ImQYwsy.exe
  2⤵
  PID:6852
- C:\Windows\System\wdPFDyf.exe
  C:\Windows\System\wdPFDyf.exe
  2⤵
  PID:6868
- C:\Windows\System\KOppyiF.exe
  C:\Windows\System\KOppyiF.exe
  2⤵
  PID:6884
- C:\Windows\System\bgYxgqP.exe
  C:\Windows\System\bgYxgqP.exe
  2⤵
  PID:6904
- C:\Windows\System\BOAfmVj.exe
  C:\Windows\System\BOAfmVj.exe
  2⤵
  PID:6920
- C:\Windows\System\gDiaDlV.exe
  C:\Windows\System\gDiaDlV.exe
  2⤵
  PID:6936
- C:\Windows\System\oXonNBv.exe
  C:\Windows\System\oXonNBv.exe
  2⤵
  PID:6952
- C:\Windows\System\tWgVwsD.exe
  C:\Windows\System\tWgVwsD.exe
  2⤵
  PID:6968
- C:\Windows\System\DOtcglB.exe
  C:\Windows\System\DOtcglB.exe
  2⤵
  PID:6988
- C:\Windows\System\BWfoXBk.exe
  C:\Windows\System\BWfoXBk.exe
  2⤵
  PID:7008
- C:\Windows\System\QnXCJcw.exe
  C:\Windows\System\QnXCJcw.exe
  2⤵
  PID:7028
- C:\Windows\System\aHNCPRq.exe
  C:\Windows\System\aHNCPRq.exe
  2⤵
  PID:7044
- C:\Windows\System\CRBeRjD.exe
  C:\Windows\System\CRBeRjD.exe
  2⤵
  PID:7060
- C:\Windows\System\ieunWUS.exe
  C:\Windows\System\ieunWUS.exe
  2⤵
  PID:7076
- C:\Windows\System\cPJkVuk.exe
  C:\Windows\System\cPJkVuk.exe
  2⤵
  PID:7096
- C:\Windows\System\nyEtfXZ.exe
  C:\Windows\System\nyEtfXZ.exe
  2⤵
  PID:5700
- C:\Windows\System\keKOXOJ.exe
  C:\Windows\System\keKOXOJ.exe
  2⤵
  PID:3856
- C:\Windows\System\AFhoBCd.exe
  C:\Windows\System\AFhoBCd.exe
  2⤵
  PID:5600
- C:\Windows\System\MWDWxDn.exe
  C:\Windows\System\MWDWxDn.exe
  2⤵
  PID:6180
- C:\Windows\System\SeWXjZf.exe
  C:\Windows\System\SeWXjZf.exe
  2⤵
  PID:6220
- C:\Windows\System\xVSVVDK.exe
  C:\Windows\System\xVSVVDK.exe
  2⤵
  PID:6232
- C:\Windows\System\NWAQqez.exe
  C:\Windows\System\NWAQqez.exe
  2⤵
  PID:6248
- C:\Windows\System\KUVBGYW.exe
  C:\Windows\System\KUVBGYW.exe
  2⤵
  PID:6264
- C:\Windows\System\LBRVDBH.exe
  C:\Windows\System\LBRVDBH.exe
  2⤵
  PID:6284
- C:\Windows\System\ATDAhYM.exe
  C:\Windows\System\ATDAhYM.exe
  2⤵
  PID:6288
- C:\Windows\System\ynUmwMa.exe
  C:\Windows\System\ynUmwMa.exe
  2⤵
  PID:6312
- C:\Windows\System\OpxInFo.exe
  C:\Windows\System\OpxInFo.exe
  2⤵
  PID:6336
- C:\Windows\System\dFADdVq.exe
  C:\Windows\System\dFADdVq.exe
  2⤵
  PID:6368
- C:\Windows\System\bNeEpGj.exe
  C:\Windows\System\bNeEpGj.exe
  2⤵
  PID:6432
- C:\Windows\System\HcdeDrd.exe
  C:\Windows\System\HcdeDrd.exe
  2⤵
  PID:6384
- C:\Windows\System\UPiFVkX.exe
  C:\Windows\System\UPiFVkX.exe
  2⤵
  PID:6448
- C:\Windows\System\LqWPBIC.exe
  C:\Windows\System\LqWPBIC.exe
  2⤵
  PID:6516
- C:\Windows\System\jqaDJdM.exe
  C:\Windows\System\jqaDJdM.exe
  2⤵
  PID:6532
- C:\Windows\System\raGscMh.exe
  C:\Windows\System\raGscMh.exe
  2⤵
  PID:6740
- C:\Windows\System\btmsvWe.exe
  C:\Windows\System\btmsvWe.exe
  2⤵
  PID:6808
- C:\Windows\System\iyGHnGY.exe
  C:\Windows\System\iyGHnGY.exe
  2⤵
  PID:6876
- C:\Windows\System\ghwGaUt.exe
  C:\Windows\System\ghwGaUt.exe
  2⤵
  PID:7052
- C:\Windows\System\YJeghlD.exe
  C:\Windows\System\YJeghlD.exe
  2⤵
  PID:6984
- C:\Windows\System\dXHktdX.exe
  C:\Windows\System\dXHktdX.exe
  2⤵
  PID:6944
- C:\Windows\System\HnBQrFT.exe
  C:\Windows\System\HnBQrFT.exe
  2⤵
  PID:6624
- C:\Windows\System\PXrzhba.exe
  C:\Windows\System\PXrzhba.exe
  2⤵
  PID:6720
- C:\Windows\System\bElBTXf.exe
  C:\Windows\System\bElBTXf.exe
  2⤵
  PID:6760
- C:\Windows\System\TxQhYdi.exe
  C:\Windows\System\TxQhYdi.exe
  2⤵
  PID:6824
- C:\Windows\System\wTrjbIb.exe
  C:\Windows\System\wTrjbIb.exe
  2⤵
  PID:6864
- C:\Windows\System\DGtWYzy.exe
  C:\Windows\System\DGtWYzy.exe
  2⤵
  PID:6932
- C:\Windows\System\jsiAfgZ.exe
  C:\Windows\System\jsiAfgZ.exe
  2⤵
  PID:7000
- C:\Windows\System\tdypnJj.exe
  C:\Windows\System\tdypnJj.exe
  2⤵
  PID:7072
- C:\Windows\System\UMLWfTg.exe
  C:\Windows\System\UMLWfTg.exe
  2⤵
  PID:7116
- C:\Windows\System\pUmLLxN.exe
  C:\Windows\System\pUmLLxN.exe
  2⤵
  PID:7132
- C:\Windows\System\VwFsCnP.exe
  C:\Windows\System\VwFsCnP.exe
  2⤵
  PID:7152
- C:\Windows\System\QMiQyRp.exe
  C:\Windows\System\QMiQyRp.exe
  2⤵
  PID:5652
- C:\Windows\System\zmGfcSS.exe
  C:\Windows\System\zmGfcSS.exe
  2⤵
  PID:6168
- C:\Windows\System\FBZLEJK.exe
  C:\Windows\System\FBZLEJK.exe
  2⤵
  PID:6128
- C:\Windows\System\VswediB.exe
  C:\Windows\System\VswediB.exe
  2⤵
  PID:6152
- C:\Windows\System\rJbavqJ.exe
  C:\Windows\System\rJbavqJ.exe
  2⤵
  PID:5204
- C:\Windows\System\xtEUkxh.exe
  C:\Windows\System\xtEUkxh.exe
  2⤵
  PID:6244
- C:\Windows\System\drdWohJ.exe
  C:\Windows\System\drdWohJ.exe
  2⤵
  PID:6352
- C:\Windows\System\akeXMhk.exe
  C:\Windows\System\akeXMhk.exe
  2⤵
  PID:6328
- C:\Windows\System\hooDYVF.exe
  C:\Windows\System\hooDYVF.exe
  2⤵
  PID:6452
- C:\Windows\System\THWWGBO.exe
  C:\Windows\System\THWWGBO.exe
  2⤵
  PID:6260
- C:\Windows\System\hCNFbrx.exe
  C:\Windows\System\hCNFbrx.exe
  2⤵
  PID:6076
- C:\Windows\System\wkKBqOf.exe
  C:\Windows\System\wkKBqOf.exe
  2⤵
  PID:6612
- C:\Windows\System\UYXULqk.exe
  C:\Windows\System\UYXULqk.exe
  2⤵
  PID:6592
- C:\Windows\System\AhbaSFG.exe
  C:\Windows\System\AhbaSFG.exe
  2⤵
  PID:6644
- C:\Windows\System\DisGmTN.exe
  C:\Windows\System\DisGmTN.exe
  2⤵
  PID:6676
- C:\Windows\System\tNAlPph.exe
  C:\Windows\System\tNAlPph.exe
  2⤵
  PID:6780
- C:\Windows\System\eYBxUiX.exe
  C:\Windows\System\eYBxUiX.exe
  2⤵
  PID:6916
- C:\Windows\System\oiMUnpb.exe
  C:\Windows\System\oiMUnpb.exe
  2⤵
  PID:6796
- C:\Windows\System\KkfZsBk.exe
  C:\Windows\System\KkfZsBk.exe
  2⤵
  PID:7040
- C:\Windows\System\Zvgiuyt.exe
  C:\Windows\System\Zvgiuyt.exe
  2⤵
  PID:7128
- C:\Windows\System\dEYZtgM.exe
  C:\Windows\System\dEYZtgM.exe
  2⤵
  PID:6164
- C:\Windows\System\UGarsUe.exe
  C:\Windows\System\UGarsUe.exe
  2⤵
  PID:6056
- C:\Windows\System\htCjngN.exe
  C:\Windows\System\htCjngN.exe
  2⤵
  PID:6524
- C:\Windows\System\BtYLPBC.exe
  C:\Windows\System\BtYLPBC.exe
  2⤵
  PID:6416
- C:\Windows\System\rZGaahs.exe
  C:\Windows\System\rZGaahs.exe
  2⤵
  PID:6564
- C:\Windows\System\wOUPMIt.exe
  C:\Windows\System\wOUPMIt.exe
  2⤵
  PID:6928
- C:\Windows\System\ENFetGs.exe
  C:\Windows\System\ENFetGs.exe
  2⤵
  PID:7144
- C:\Windows\System\yMtNZWw.exe
  C:\Windows\System\yMtNZWw.exe
  2⤵
  PID:7088
- C:\Windows\System\fvVWoxh.exe
  C:\Windows\System\fvVWoxh.exe
  2⤵
  PID:5192
- C:\Windows\System\FiMCjop.exe
  C:\Windows\System\FiMCjop.exe
  2⤵
  PID:7016
- C:\Windows\System\moRmCLO.exe
  C:\Windows\System\moRmCLO.exe
  2⤵
  PID:7148
- C:\Windows\System\tDWWbUi.exe
  C:\Windows\System\tDWWbUi.exe
  2⤵
  PID:6276
- C:\Windows\System\JiwfWmV.exe
  C:\Windows\System\JiwfWmV.exe
  2⤵
  PID:6512
- C:\Windows\System\pPPryyM.exe
  C:\Windows\System\pPPryyM.exe
  2⤵
  PID:6544
- C:\Windows\System\yYkDBxd.exe
  C:\Windows\System\yYkDBxd.exe
  2⤵
  PID:6976
- C:\Windows\System\PMoFSCE.exe
  C:\Windows\System\PMoFSCE.exe
  2⤵
  PID:6216
- C:\Windows\System\oPqbdlD.exe
  C:\Windows\System\oPqbdlD.exe
  2⤵
  PID:6240
- C:\Windows\System\pNRyBuP.exe
  C:\Windows\System\pNRyBuP.exe
  2⤵
  PID:7164
- C:\Windows\System\pOLutKS.exe
  C:\Windows\System\pOLutKS.exe
  2⤵
  PID:6860
- C:\Windows\System\YefgdTU.exe
  C:\Windows\System\YefgdTU.exe
  2⤵
  PID:7140
- C:\Windows\System\ogzdCRz.exe
  C:\Windows\System\ogzdCRz.exe
  2⤵
  PID:6688
- C:\Windows\System\AJQMpCk.exe
  C:\Windows\System\AJQMpCk.exe
  2⤵
  PID:6964
- C:\Windows\System\FzCmEMj.exe
  C:\Windows\System\FzCmEMj.exe
  2⤵
  PID:6776
- C:\Windows\System\OoIbcJc.exe
  C:\Windows\System\OoIbcJc.exe
  2⤵
  PID:6500
- C:\Windows\System\nvCKbrP.exe
  C:\Windows\System\nvCKbrP.exe
  2⤵
  PID:6832
- C:\Windows\System\mKMPthL.exe
  C:\Windows\System\mKMPthL.exe
  2⤵
  PID:6848
- C:\Windows\System\RYkhHzL.exe
  C:\Windows\System\RYkhHzL.exe
  2⤵
  PID:6756
- C:\Windows\System\etmukLc.exe
  C:\Windows\System\etmukLc.exe
  2⤵
  PID:7124
- C:\Windows\System\zFuJJfJ.exe
  C:\Windows\System\zFuJJfJ.exe
  2⤵
  PID:6560
- C:\Windows\System\pSMLIzY.exe
  C:\Windows\System\pSMLIzY.exe
  2⤵
  PID:7112
- C:\Windows\System\HYcHzmU.exe
  C:\Windows\System\HYcHzmU.exe
  2⤵
  PID:7184
- C:\Windows\System\Cvfsjhf.exe
  C:\Windows\System\Cvfsjhf.exe
  2⤵
  PID:7200
- C:\Windows\System\uwAQSGm.exe
  C:\Windows\System\uwAQSGm.exe
  2⤵
  PID:7220
- C:\Windows\System\FFySTNL.exe
  C:\Windows\System\FFySTNL.exe
  2⤵
  PID:7236
- C:\Windows\System\lGYslfE.exe
  C:\Windows\System\lGYslfE.exe
  2⤵
  PID:7260
- C:\Windows\System\gdbsKZz.exe
  C:\Windows\System\gdbsKZz.exe
  2⤵
  PID:7280
- C:\Windows\System\jQYkcUt.exe
  C:\Windows\System\jQYkcUt.exe
  2⤵
  PID:7296
- C:\Windows\System\GayLZvE.exe
  C:\Windows\System\GayLZvE.exe
  2⤵
  PID:7312
- C:\Windows\System\wmQHkin.exe
  C:\Windows\System\wmQHkin.exe
  2⤵
  PID:7328
- C:\Windows\System\fhLkYyY.exe
  C:\Windows\System\fhLkYyY.exe
  2⤵
  PID:7392
- C:\Windows\System\ZnBzBSn.exe
  C:\Windows\System\ZnBzBSn.exe
  2⤵
  PID:7408
- C:\Windows\System\zEdKFpg.exe
  C:\Windows\System\zEdKFpg.exe
  2⤵
  PID:7428
- C:\Windows\System\dXvyqJd.exe
  C:\Windows\System\dXvyqJd.exe
  2⤵
  PID:7448
- C:\Windows\System\GZafZVR.exe
  C:\Windows\System\GZafZVR.exe
  2⤵
  PID:7464
- C:\Windows\System\wuCTjxr.exe
  C:\Windows\System\wuCTjxr.exe
  2⤵
  PID:7484
- C:\Windows\System\wlmzOae.exe
  C:\Windows\System\wlmzOae.exe
  2⤵
  PID:7500
- C:\Windows\System\fpdFeAI.exe
  C:\Windows\System\fpdFeAI.exe
  2⤵
  PID:7516
- C:\Windows\System\FQvTIwx.exe
  C:\Windows\System\FQvTIwx.exe
  2⤵
  PID:7532
- C:\Windows\System\NsVfDgg.exe
  C:\Windows\System\NsVfDgg.exe
  2⤵
  PID:7548
- C:\Windows\System\urYeaaW.exe
  C:\Windows\System\urYeaaW.exe
  2⤵
  PID:7564
- C:\Windows\System\SpSBxwd.exe
  C:\Windows\System\SpSBxwd.exe
  2⤵
  PID:7580
- C:\Windows\System\poGlbqF.exe
  C:\Windows\System\poGlbqF.exe
  2⤵
  PID:7596
- C:\Windows\System\VxkGyme.exe
  C:\Windows\System\VxkGyme.exe
  2⤵
  PID:7612
- C:\Windows\System\mXShLWG.exe
  C:\Windows\System\mXShLWG.exe
  2⤵
  PID:7632
- C:\Windows\System\zcZICUK.exe
  C:\Windows\System\zcZICUK.exe
  2⤵
  PID:7648
- C:\Windows\System\bstocws.exe
  C:\Windows\System\bstocws.exe
  2⤵
  PID:7676
- C:\Windows\System\gJqaALX.exe
  C:\Windows\System\gJqaALX.exe
  2⤵
  PID:7692
- C:\Windows\System\dJuJAkC.exe
  C:\Windows\System\dJuJAkC.exe
  2⤵
  PID:7716
- C:\Windows\System\zGCkjcQ.exe
  C:\Windows\System\zGCkjcQ.exe
  2⤵
  PID:7732
- C:\Windows\System\zarnvLs.exe
  C:\Windows\System\zarnvLs.exe
  2⤵
  PID:7756
- C:\Windows\System\JrYPOzf.exe
  C:\Windows\System\JrYPOzf.exe
  2⤵
  PID:7772
- C:\Windows\System\tRkbjhP.exe
  C:\Windows\System\tRkbjhP.exe
  2⤵
  PID:7792
- C:\Windows\System\yUIuiEC.exe
  C:\Windows\System\yUIuiEC.exe
  2⤵
  PID:7808
- C:\Windows\System\JYfXzdZ.exe
  C:\Windows\System\JYfXzdZ.exe
  2⤵
  PID:7828
- C:\Windows\System\RxRDfWh.exe
  C:\Windows\System\RxRDfWh.exe
  2⤵
  PID:7848
- C:\Windows\System\KvqaxkW.exe
  C:\Windows\System\KvqaxkW.exe
  2⤵
  PID:7864
- C:\Windows\System\cFZPPwA.exe
  C:\Windows\System\cFZPPwA.exe
  2⤵
  PID:7880
- C:\Windows\System\ELgaULI.exe
  C:\Windows\System\ELgaULI.exe
  2⤵
  PID:7896
- C:\Windows\System\EpfMEOt.exe
  C:\Windows\System\EpfMEOt.exe
  2⤵
  PID:7912
- C:\Windows\System\GgQoHtv.exe
  C:\Windows\System\GgQoHtv.exe
  2⤵
  PID:7928
- C:\Windows\System\QHXpdsG.exe
  C:\Windows\System\QHXpdsG.exe
  2⤵
  PID:7944
- C:\Windows\System\Glydzys.exe
  C:\Windows\System\Glydzys.exe
  2⤵
  PID:7960
- C:\Windows\System\lzyZVFZ.exe
  C:\Windows\System\lzyZVFZ.exe
  2⤵
  PID:7976
- C:\Windows\System\BDoGUIr.exe
  C:\Windows\System\BDoGUIr.exe
  2⤵
  PID:7992
- C:\Windows\System\XKUtHCO.exe
  C:\Windows\System\XKUtHCO.exe
  2⤵
  PID:8008
- C:\Windows\System\UfTuKVZ.exe
  C:\Windows\System\UfTuKVZ.exe
  2⤵
  PID:8024
- C:\Windows\System\ccbvPdv.exe
  C:\Windows\System\ccbvPdv.exe
  2⤵
  PID:8040
- C:\Windows\System\YPyQrYM.exe
  C:\Windows\System\YPyQrYM.exe
  2⤵
  PID:8056
- C:\Windows\System\tJGRaKe.exe
  C:\Windows\System\tJGRaKe.exe
  2⤵
  PID:8072
- C:\Windows\System\yrlDbnM.exe
  C:\Windows\System\yrlDbnM.exe
  2⤵
  PID:8088
- C:\Windows\System\lMJJjPn.exe
  C:\Windows\System\lMJJjPn.exe
  2⤵
  PID:8104
- C:\Windows\System\VOwVmmk.exe
  C:\Windows\System\VOwVmmk.exe
  2⤵
  PID:8120
- C:\Windows\System\HklIYWy.exe
  C:\Windows\System\HklIYWy.exe
  2⤵
  PID:8136
- C:\Windows\System\dXcRqOP.exe
  C:\Windows\System\dXcRqOP.exe
  2⤵
  PID:8152
- C:\Windows\System\MJAfOwe.exe
  C:\Windows\System\MJAfOwe.exe
  2⤵
  PID:8168
- C:\Windows\System\AgxJgAC.exe
  C:\Windows\System\AgxJgAC.exe
  2⤵
  PID:8184
- C:\Windows\System\ygmyDVV.exe
  C:\Windows\System\ygmyDVV.exe
  2⤵
  PID:6208
- C:\Windows\System\NQMInQn.exe
  C:\Windows\System\NQMInQn.exe
  2⤵
  PID:7232
- C:\Windows\System\tzEYGby.exe
  C:\Windows\System\tzEYGby.exe
  2⤵
  PID:7308
- C:\Windows\System\wiBZKdN.exe
  C:\Windows\System\wiBZKdN.exe
  2⤵
  PID:7348
- C:\Windows\System\eFgQSSN.exe
  C:\Windows\System\eFgQSSN.exe
  2⤵
  PID:7376
- C:\Windows\System\oJlVfGs.exe
  C:\Windows\System\oJlVfGs.exe
  2⤵
  PID:7364
- C:\Windows\System\kDcIvjp.exe
  C:\Windows\System\kDcIvjp.exe
  2⤵
  PID:7496
- C:\Windows\System\QuUPAOD.exe
  C:\Windows\System\QuUPAOD.exe
  2⤵
  PID:7180
- C:\Windows\System\TMArLPh.exe
  C:\Windows\System\TMArLPh.exe
  2⤵
  PID:7244
- C:\Windows\System\RFwKXeO.exe
  C:\Windows\System\RFwKXeO.exe
  2⤵
  PID:7288
- C:\Windows\System\KxWIkYh.exe
  C:\Windows\System\KxWIkYh.exe
  2⤵
  PID:7404
- C:\Windows\System\uJmvwtf.exe
  C:\Windows\System\uJmvwtf.exe
  2⤵
  PID:7472
- C:\Windows\System\kSrfiMZ.exe
  C:\Windows\System\kSrfiMZ.exe
  2⤵
  PID:7512
- C:\Windows\System\sPNpVtF.exe
  C:\Windows\System\sPNpVtF.exe
  2⤵
  PID:7672
- C:\Windows\System\VMzSUnh.exe
  C:\Windows\System\VMzSUnh.exe
  2⤵
  PID:7728
- C:\Windows\System\JYzSZdv.exe
  C:\Windows\System\JYzSZdv.exe
  2⤵
  PID:7800
- C:\Windows\System\PWCQIoG.exe
  C:\Windows\System\PWCQIoG.exe
  2⤵
  PID:7836
- C:\Windows\System\nKUuPzO.exe
  C:\Windows\System\nKUuPzO.exe
  2⤵
  PID:7620
- C:\Windows\System\qEFaohr.exe
  C:\Windows\System\qEFaohr.exe
  2⤵
  PID:7560
- C:\Windows\System\QidFHoA.exe
  C:\Windows\System\QidFHoA.exe
  2⤵
  PID:7660
- C:\Windows\System\dbJyWXM.exe
  C:\Windows\System\dbJyWXM.exe
  2⤵
  PID:7744
- C:\Windows\System\MwGkzat.exe
  C:\Windows\System\MwGkzat.exe
  2⤵
  PID:7784
- C:\Windows\System\mzBAQQq.exe
  C:\Windows\System\mzBAQQq.exe
  2⤵
  PID:7840
- C:\Windows\System\drAJWLm.exe
  C:\Windows\System\drAJWLm.exe
  2⤵
  PID:7908
- C:\Windows\System\bHIGknz.exe
  C:\Windows\System\bHIGknz.exe
  2⤵
  PID:7888
- C:\Windows\System\dAuusIZ.exe
  C:\Windows\System\dAuusIZ.exe
  2⤵
  PID:7940
- C:\Windows\System\GVhPVLi.exe
  C:\Windows\System\GVhPVLi.exe
  2⤵
  PID:8004
- C:\Windows\System\tYbXjrQ.exe
  C:\Windows\System\tYbXjrQ.exe
  2⤵
  PID:8036
- C:\Windows\System\oDMqhlz.exe
  C:\Windows\System\oDMqhlz.exe
  2⤵
  PID:7984
- C:\Windows\System\ryVlCvK.exe
  C:\Windows\System\ryVlCvK.exe
  2⤵
  PID:8068
- C:\Windows\System\OunQEWM.exe
  C:\Windows\System\OunQEWM.exe
  2⤵
  PID:8132
- C:\Windows\System\NKotfRN.exe
  C:\Windows\System\NKotfRN.exe
  2⤵
  PID:6736
- C:\Windows\System\XzYOxhc.exe
  C:\Windows\System\XzYOxhc.exe
  2⤵
  PID:7372
- C:\Windows\System\XUivpYM.exe
  C:\Windows\System\XUivpYM.exe
  2⤵
  PID:8148
- C:\Windows\System\pPmcmve.exe
  C:\Windows\System\pPmcmve.exe
  2⤵
  PID:8116
- C:\Windows\System\fTNXKer.exe
  C:\Windows\System\fTNXKer.exe
  2⤵
  PID:8176
- C:\Windows\System\vJAQKam.exe
  C:\Windows\System\vJAQKam.exe
  2⤵
  PID:7216
- C:\Windows\System\QJeIKid.exe
  C:\Windows\System\QJeIKid.exe
  2⤵
  PID:6356
- C:\Windows\System\lgGoorf.exe
  C:\Windows\System\lgGoorf.exe
  2⤵
  PID:7440
- C:\Windows\System\CPCUuWx.exe
  C:\Windows\System\CPCUuWx.exe
  2⤵
  PID:7576
- C:\Windows\System\PFZNFnF.exe
  C:\Windows\System\PFZNFnF.exe
  2⤵
  PID:7644
- C:\Windows\System\innsehX.exe
  C:\Windows\System\innsehX.exe
  2⤵
  PID:7528
- C:\Windows\System\aqIqvtl.exe
  C:\Windows\System\aqIqvtl.exe
  2⤵
  PID:7712
- C:\Windows\System\FFqgZDb.exe
  C:\Windows\System\FFqgZDb.exe
  2⤵
  PID:7856
- C:\Windows\System\KAUQeCW.exe
  C:\Windows\System\KAUQeCW.exe
  2⤵
  PID:7668
- C:\Windows\System\hBbetuM.exe
  C:\Windows\System\hBbetuM.exe
  2⤵
  PID:7708
- C:\Windows\System\XKgdGrM.exe
  C:\Windows\System\XKgdGrM.exe
  2⤵
  PID:7752
- C:\Windows\System\FqRmkTE.exe
  C:\Windows\System\FqRmkTE.exe
  2⤵
  PID:7904
- C:\Windows\System\WjtztRZ.exe
  C:\Windows\System\WjtztRZ.exe
  2⤵
  PID:7920
- C:\Windows\System\OJckvrY.exe
  C:\Windows\System\OJckvrY.exe
  2⤵
  PID:7356
- C:\Windows\System\fWxUgXA.exe
  C:\Windows\System\fWxUgXA.exe
  2⤵
  PID:8048
- C:\Windows\System\TuyIgYv.exe
  C:\Windows\System\TuyIgYv.exe
  2⤵
  PID:8112
- C:\Windows\System\RPliKTZ.exe
  C:\Windows\System\RPliKTZ.exe
  2⤵
  PID:7460
- C:\Windows\System\lwOpdTp.exe
  C:\Windows\System\lwOpdTp.exe
  2⤵
  PID:7252
- C:\Windows\System\VzKBMcf.exe
  C:\Windows\System\VzKBMcf.exe
  2⤵
  PID:7640
- C:\Windows\System\DrmlGIU.exe
  C:\Windows\System\DrmlGIU.exe
  2⤵
  PID:8196
- C:\Windows\System\KjbZKfL.exe
  C:\Windows\System\KjbZKfL.exe
  2⤵
  PID:8212
- C:\Windows\System\cMrOjNb.exe
  C:\Windows\System\cMrOjNb.exe
  2⤵
  PID:8232
- C:\Windows\System\jmhcCoL.exe
  C:\Windows\System\jmhcCoL.exe
  2⤵
  PID:8248
- C:\Windows\System\npXDIHX.exe
  C:\Windows\System\npXDIHX.exe
  2⤵
  PID:8264
- C:\Windows\System\wijXosK.exe
  C:\Windows\System\wijXosK.exe
  2⤵
  PID:8284
- C:\Windows\System\XNxAzlr.exe
  C:\Windows\System\XNxAzlr.exe
  2⤵
  PID:8300
- C:\Windows\System\DEQlOKj.exe
  C:\Windows\System\DEQlOKj.exe
  2⤵
  PID:8316
- C:\Windows\System\HDAItnH.exe
  C:\Windows\System\HDAItnH.exe
  2⤵
  PID:8332
- C:\Windows\System\pWMhLVr.exe
  C:\Windows\System\pWMhLVr.exe
  2⤵
  PID:8348
- C:\Windows\System\YLpCFcg.exe
  C:\Windows\System\YLpCFcg.exe
  2⤵
  PID:8368
- C:\Windows\System\favubSr.exe
  C:\Windows\System\favubSr.exe
  2⤵
  PID:8400
- C:\Windows\System\gFpeyZc.exe
  C:\Windows\System\gFpeyZc.exe
  2⤵
  PID:8420
- C:\Windows\System\IqJTEHr.exe
  C:\Windows\System\IqJTEHr.exe
  2⤵
  PID:8436
- C:\Windows\System\gXvUvIt.exe
  C:\Windows\System\gXvUvIt.exe
  2⤵
  PID:8452
- C:\Windows\System\cfBOeGa.exe
  C:\Windows\System\cfBOeGa.exe
  2⤵
  PID:8472
- C:\Windows\System\PygHBah.exe
  C:\Windows\System\PygHBah.exe
  2⤵
  PID:8488
- C:\Windows\System\eOKGbEb.exe
  C:\Windows\System\eOKGbEb.exe
  2⤵
  PID:8504
- C:\Windows\System\MDjXhmo.exe
  C:\Windows\System\MDjXhmo.exe
  2⤵
  PID:8520
- C:\Windows\System\ztBxNAy.exe
  C:\Windows\System\ztBxNAy.exe
  2⤵
  PID:8540
- C:\Windows\System\IXybVwp.exe
  C:\Windows\System\IXybVwp.exe
  2⤵
  PID:8556
- C:\Windows\System\ewHmmjY.exe
  C:\Windows\System\ewHmmjY.exe
  2⤵
  PID:8572
- C:\Windows\System\yHhpcCr.exe
  C:\Windows\System\yHhpcCr.exe
  2⤵
  PID:8588
- C:\Windows\System\NaNyQqy.exe
  C:\Windows\System\NaNyQqy.exe
  2⤵
  PID:8604
- C:\Windows\System\vaRbYrO.exe
  C:\Windows\System\vaRbYrO.exe
  2⤵
  PID:8620
- C:\Windows\System\ddMSEtq.exe
  C:\Windows\System\ddMSEtq.exe
  2⤵
  PID:8636
- C:\Windows\System\DqCYwdP.exe
  C:\Windows\System\DqCYwdP.exe
  2⤵
  PID:8652
- C:\Windows\System\ClaSiyZ.exe
  C:\Windows\System\ClaSiyZ.exe
  2⤵
  PID:8668
- C:\Windows\System\YSRHSOi.exe
  C:\Windows\System\YSRHSOi.exe
  2⤵
  PID:8684
- C:\Windows\System\gmEjIGf.exe
  C:\Windows\System\gmEjIGf.exe
  2⤵
  PID:8700
- C:\Windows\System\IclgOTx.exe
  C:\Windows\System\IclgOTx.exe
  2⤵
  PID:8716
- C:\Windows\System\mBHwdzf.exe
  C:\Windows\System\mBHwdzf.exe
  2⤵
  PID:8732
- C:\Windows\System\ysqShqN.exe
  C:\Windows\System\ysqShqN.exe
  2⤵
  PID:8748
- C:\Windows\System\CWqBTCv.exe
  C:\Windows\System\CWqBTCv.exe
  2⤵
  PID:8768
- C:\Windows\System\qvHpXKU.exe
  C:\Windows\System\qvHpXKU.exe
  2⤵
  PID:8784
- C:\Windows\System\sThtOEL.exe
  C:\Windows\System\sThtOEL.exe
  2⤵
  PID:8800
- C:\Windows\System\GldGFzH.exe
  C:\Windows\System\GldGFzH.exe
  2⤵
  PID:8816
- C:\Windows\System\VNTjmTB.exe
  C:\Windows\System\VNTjmTB.exe
  2⤵
  PID:8832
- C:\Windows\System\qdQMZXl.exe
  C:\Windows\System\qdQMZXl.exe
  2⤵
  PID:8848
- C:\Windows\System\iaxFuXM.exe
  C:\Windows\System\iaxFuXM.exe
  2⤵
  PID:8868
- C:\Windows\System\JZPZRJU.exe
  C:\Windows\System\JZPZRJU.exe
  2⤵
  PID:8884
- C:\Windows\System\tIKzQOf.exe
  C:\Windows\System\tIKzQOf.exe
  2⤵
  PID:8900
- C:\Windows\System\GvcwgZf.exe
  C:\Windows\System\GvcwgZf.exe
  2⤵
  PID:8916
- C:\Windows\System\NcPGaUv.exe
  C:\Windows\System\NcPGaUv.exe
  2⤵
  PID:8932
- C:\Windows\System\oODnxQF.exe
  C:\Windows\System\oODnxQF.exe
  2⤵
  PID:8948
- C:\Windows\System\KQMPOCs.exe
  C:\Windows\System\KQMPOCs.exe
  2⤵
  PID:8964
- C:\Windows\System\PmsQSQD.exe
  C:\Windows\System\PmsQSQD.exe
  2⤵
  PID:8980
- C:\Windows\System\YOvbjWt.exe
  C:\Windows\System\YOvbjWt.exe
  2⤵
  PID:8996
- C:\Windows\System\PENNXRX.exe
  C:\Windows\System\PENNXRX.exe
  2⤵
  PID:9012
- C:\Windows\System\TkqXXii.exe
  C:\Windows\System\TkqXXii.exe
  2⤵
  PID:9028
- C:\Windows\System\KDUCHbZ.exe
  C:\Windows\System\KDUCHbZ.exe
  2⤵
  PID:9044
- C:\Windows\System\OKcOxVc.exe
  C:\Windows\System\OKcOxVc.exe
  2⤵
  PID:9060
- C:\Windows\System\zZxNmep.exe
  C:\Windows\System\zZxNmep.exe
  2⤵
  PID:9076
- C:\Windows\System\xLMlbmD.exe
  C:\Windows\System\xLMlbmD.exe
  2⤵
  PID:9092
- C:\Windows\System\YWZSSAp.exe
  C:\Windows\System\YWZSSAp.exe
  2⤵
  PID:9108
- C:\Windows\System\wBjgUnj.exe
  C:\Windows\System\wBjgUnj.exe
  2⤵
  PID:9124
- C:\Windows\System\YkfxLPt.exe
  C:\Windows\System\YkfxLPt.exe
  2⤵
  PID:9140
- C:\Windows\System\bIWjNrt.exe
  C:\Windows\System\bIWjNrt.exe
  2⤵
  PID:9156
- C:\Windows\System\rhfBiuj.exe
  C:\Windows\System\rhfBiuj.exe
  2⤵
  PID:9172
- C:\Windows\System\aRcsFne.exe
  C:\Windows\System\aRcsFne.exe
  2⤵
  PID:9188
- C:\Windows\System\Pnvhlsv.exe
  C:\Windows\System\Pnvhlsv.exe
  2⤵
  PID:9204
- C:\Windows\System\DwPnoJe.exe
  C:\Windows\System\DwPnoJe.exe
  2⤵
  PID:8000
- C:\Windows\System\ZbxCwwC.exe
  C:\Windows\System\ZbxCwwC.exe
  2⤵
  PID:7956
- C:\Windows\System\IIMytnU.exe
  C:\Windows\System\IIMytnU.exe
  2⤵
  PID:8016
- C:\Windows\System\urPcLqO.exe
  C:\Windows\System\urPcLqO.exe
  2⤵
  PID:7608
- C:\Windows\System\moTLvcy.exe
  C:\Windows\System\moTLvcy.exe
  2⤵
  PID:8244
- C:\Windows\System\funRIOu.exe
  C:\Windows\System\funRIOu.exe
  2⤵
  PID:8308
- C:\Windows\System\RbiUQRe.exe
  C:\Windows\System\RbiUQRe.exe
  2⤵
  PID:7572
- C:\Windows\System\vFMouDb.exe
  C:\Windows\System\vFMouDb.exe
  2⤵
  PID:7724
- C:\Windows\System\WMfGyjp.exe
  C:\Windows\System\WMfGyjp.exe
  2⤵
  PID:8324
- C:\Windows\System\cdhTcrg.exe
  C:\Windows\System\cdhTcrg.exe
  2⤵
  PID:7872
- C:\Windows\System\osYVSUB.exe
  C:\Windows\System\osYVSUB.exe
  2⤵
  PID:7416
- C:\Windows\System\rKvHXQg.exe
  C:\Windows\System\rKvHXQg.exe
  2⤵
  PID:7816
- C:\Windows\System\WSOzyCD.exe
  C:\Windows\System\WSOzyCD.exe
  2⤵
  PID:8396
- C:\Windows\System\QiXgRPw.exe
  C:\Windows\System\QiXgRPw.exe
  2⤵
  PID:7388
- C:\Windows\System\SZjNPho.exe
  C:\Windows\System\SZjNPho.exe
  2⤵
  PID:7340
- C:\Windows\System\xhhOTNd.exe
  C:\Windows\System\xhhOTNd.exe
  2⤵
  PID:7524
- C:\Windows\System\qnnYQaU.exe
  C:\Windows\System\qnnYQaU.exe
  2⤵
  PID:8256
- C:\Windows\System\iupJvhP.exe
  C:\Windows\System\iupJvhP.exe
  2⤵
  PID:8356
- C:\Windows\System\OYizUCE.exe
  C:\Windows\System\OYizUCE.exe
  2⤵
  PID:8416
- C:\Windows\System\HxtgxYP.exe
  C:\Windows\System\HxtgxYP.exe
  2⤵
  PID:8448
- C:\Windows\System\rKAfktC.exe
  C:\Windows\System\rKAfktC.exe
  2⤵
  PID:8532
- C:\Windows\System\WoqexCZ.exe
  C:\Windows\System\WoqexCZ.exe
  2⤵
  PID:8512
- C:\Windows\System\gZlnkpD.exe
  C:\Windows\System\gZlnkpD.exe
  2⤵
  PID:8596
- C:\Windows\System\pqQNWXI.exe
  C:\Windows\System\pqQNWXI.exe
  2⤵
  PID:8660
- C:\Windows\System\drkFkTr.exe
  C:\Windows\System\drkFkTr.exe
  2⤵
  PID:8724
- C:\Windows\System\CkNYXmL.exe
  C:\Windows\System\CkNYXmL.exe
  2⤵
  PID:8764
- C:\Windows\System\UqSpoIU.exe
  C:\Windows\System\UqSpoIU.exe
  2⤵
  PID:8828
- C:\Windows\System\uUAgMEk.exe
  C:\Windows\System\uUAgMEk.exe
  2⤵
  PID:8860
- C:\Windows\System\wVQsJGj.exe
  C:\Windows\System\wVQsJGj.exe
  2⤵
  PID:8928
- C:\Windows\System\ESKjPRb.exe
  C:\Windows\System\ESKjPRb.exe
  2⤵
  PID:8992
- C:\Windows\System\zKcqOMX.exe
  C:\Windows\System\zKcqOMX.exe
  2⤵
  PID:9052
- C:\Windows\System\RMUTInt.exe
  C:\Windows\System\RMUTInt.exe
  2⤵
  PID:8708
- C:\Windows\System\kxlBdrI.exe
  C:\Windows\System\kxlBdrI.exe
  2⤵
  PID:8584
- C:\Windows\System\nqjzZcH.exe
  C:\Windows\System\nqjzZcH.exe
  2⤵
  PID:8776
- C:\Windows\System\lhJyTNw.exe
  C:\Windows\System\lhJyTNw.exe
  2⤵
  PID:9088
- C:\Windows\System\sWOpNHv.exe
  C:\Windows\System\sWOpNHv.exe
  2⤵
  PID:8944
- C:\Windows\System\OTIfiVo.exe
  C:\Windows\System\OTIfiVo.exe
  2⤵
  PID:9036
- C:\Windows\System\DTZkLVS.exe
  C:\Windows\System\DTZkLVS.exe
  2⤵
  PID:9072
- C:\Windows\System\eQDHoTr.exe
  C:\Windows\System\eQDHoTr.exe
  2⤵
  PID:8912
- C:\Windows\System\uFCIPuL.exe
  C:\Windows\System\uFCIPuL.exe
  2⤵
  PID:9068
- C:\Windows\System\nKvIxrR.exe
  C:\Windows\System\nKvIxrR.exe
  2⤵
  PID:9180
- C:\Windows\System\QRltknd.exe
  C:\Windows\System\QRltknd.exe
  2⤵
  PID:9212
- C:\Windows\System\Mjahgzo.exe
  C:\Windows\System\Mjahgzo.exe
  2⤵
  PID:7228
- C:\Windows\System\BvjjlTW.exe
  C:\Windows\System\BvjjlTW.exe
  2⤵
  PID:7656
- C:\Windows\System\xqvScef.exe
  C:\Windows\System\xqvScef.exe
  2⤵
  PID:8340
- C:\Windows\System\emfFYhp.exe
  C:\Windows\System\emfFYhp.exe
  2⤵
  PID:8380
- C:\Windows\System\WttaJDP.exe
  C:\Windows\System\WttaJDP.exe
  2⤵
  PID:8392
- C:\Windows\System\PfkGLtk.exe
  C:\Windows\System\PfkGLtk.exe
  2⤵
  PID:8376
- C:\Windows\System\mjccFDw.exe
  C:\Windows\System\mjccFDw.exe
  2⤵
  PID:8408
- C:\Windows\System\skBHONd.exe
  C:\Windows\System\skBHONd.exe
  2⤵
  PID:8276
- C:\Windows\System\xuftJlk.exe
  C:\Windows\System\xuftJlk.exe
  2⤵
  PID:7704
- C:\Windows\System\BZtWaKI.exe
  C:\Windows\System\BZtWaKI.exe
  2⤵
  PID:8432
- C:\Windows\System\ZAVbKUf.exe
  C:\Windows\System\ZAVbKUf.exe
  2⤵
  PID:8692
- C:\Windows\System\LemVqDN.exe
  C:\Windows\System\LemVqDN.exe
  2⤵
  PID:8824
- C:\Windows\System\zekehDi.exe
  C:\Windows\System\zekehDi.exe
  2⤵
  PID:8412
- C:\Windows\System\bjzZjRl.exe
  C:\Windows\System\bjzZjRl.exe
  2⤵
  PID:9024
- C:\Windows\System\LFyTGHg.exe
  C:\Windows\System\LFyTGHg.exe
  2⤵
  PID:8616
- C:\Windows\System\pcmQwqo.exe
  C:\Windows\System\pcmQwqo.exe
  2⤵
  PID:8988
- C:\Windows\System\AJGfmPc.exe
  C:\Windows\System\AJGfmPc.exe
  2⤵
  PID:8892
- C:\Windows\System\mZWUNgU.exe
  C:\Windows\System\mZWUNgU.exe
  2⤵
  PID:9008
- C:\Windows\System\hLmNuMX.exe
  C:\Windows\System\hLmNuMX.exe
  2⤵
  PID:9116
- C:\Windows\System\LFXmGiU.exe
  C:\Windows\System\LFXmGiU.exe
  2⤵
  PID:9040
- C:\Windows\System\sQZMEEf.exe
  C:\Windows\System\sQZMEEf.exe
  2⤵
  PID:9004
- C:\Windows\System\RFodNTs.exe
  C:\Windows\System\RFodNTs.exe
  2⤵
  PID:6672
- C:\Windows\System\hgOIjBQ.exe
  C:\Windows\System\hgOIjBQ.exe
  2⤵
  PID:8080
- C:\Windows\System\fYPzfAE.exe
  C:\Windows\System\fYPzfAE.exe
  2⤵
  PID:8468
- C:\Windows\System\RjtWrlK.exe
  C:\Windows\System\RjtWrlK.exe
  2⤵
  PID:8220
- C:\Windows\System\KGSaqJc.exe
  C:\Windows\System\KGSaqJc.exe
  2⤵
  PID:7384
- C:\Windows\System\rZOhkEi.exe
  C:\Windows\System\rZOhkEi.exe
  2⤵
  PID:8924
- C:\Windows\System\CjjtoQz.exe
  C:\Windows\System\CjjtoQz.exe
  2⤵
  PID:8428
- C:\Windows\System\voAwjNQ.exe
  C:\Windows\System\voAwjNQ.exe
  2⤵
  PID:8696
- C:\Windows\System\OspvMqH.exe
  C:\Windows\System\OspvMqH.exe
  2⤵
  PID:8864
- C:\Windows\System\UJgePTE.exe
  C:\Windows\System\UJgePTE.exe
  2⤵
  PID:8676
- C:\Windows\System\qiMnmET.exe
  C:\Windows\System\qiMnmET.exe
  2⤵
  PID:9200
- C:\Windows\System\DqagGSg.exe
  C:\Windows\System\DqagGSg.exe
  2⤵
  PID:9104
- C:\Windows\System\aMgOgnP.exe
  C:\Windows\System\aMgOgnP.exe
  2⤵
  PID:9168
- C:\Windows\System\dXPfSyo.exe
  C:\Windows\System\dXPfSyo.exe
  2⤵
  PID:7508
- C:\Windows\System\TFPIXLM.exe
  C:\Windows\System\TFPIXLM.exe
  2⤵
  PID:8908
- C:\Windows\System\AXXNJrw.exe
  C:\Windows\System\AXXNJrw.exe
  2⤵
  PID:8960
- C:\Windows\System\RTTALIL.exe
  C:\Windows\System\RTTALIL.exe
  2⤵
  PID:8296
- C:\Windows\System\ogHgyaw.exe
  C:\Windows\System\ogHgyaw.exe
  2⤵
  PID:8644
- C:\Windows\System\KLFdrbS.exe
  C:\Windows\System\KLFdrbS.exe
  2⤵
  PID:8280
- C:\Windows\System\ZDKWONc.exe
  C:\Windows\System\ZDKWONc.exe
  2⤵
  PID:8680
- C:\Windows\System\WAoWTgv.exe
  C:\Windows\System\WAoWTgv.exe
  2⤵
  PID:8128
- C:\Windows\System\SDBPtty.exe
  C:\Windows\System\SDBPtty.exe
  2⤵
  PID:9232
- C:\Windows\System\ZVLVjdt.exe
  C:\Windows\System\ZVLVjdt.exe
  2⤵
  PID:9248
- C:\Windows\System\ZlKGqMS.exe
  C:\Windows\System\ZlKGqMS.exe
  2⤵
  PID:9264
- C:\Windows\System\QKWmPdg.exe
  C:\Windows\System\QKWmPdg.exe
  2⤵
  PID:9280
- C:\Windows\System\sZOlwCJ.exe
  C:\Windows\System\sZOlwCJ.exe
  2⤵
  PID:9296
- C:\Windows\System\YzHWHRw.exe
  C:\Windows\System\YzHWHRw.exe
  2⤵
  PID:9312
- C:\Windows\System\EnXmMhr.exe
  C:\Windows\System\EnXmMhr.exe
  2⤵
  PID:9328
- C:\Windows\System\phPqmGF.exe
  C:\Windows\System\phPqmGF.exe
  2⤵
  PID:9344
- C:\Windows\System\aeIkJrB.exe
  C:\Windows\System\aeIkJrB.exe
  2⤵
  PID:9360
- C:\Windows\System\hqfWBme.exe
  C:\Windows\System\hqfWBme.exe
  2⤵
  PID:9376
- C:\Windows\System\nbHPRUM.exe
  C:\Windows\System\nbHPRUM.exe
  2⤵
  PID:9392
- C:\Windows\System\UXDWLIB.exe
  C:\Windows\System\UXDWLIB.exe
  2⤵
  PID:9408
- C:\Windows\System\QDqmbmp.exe
  C:\Windows\System\QDqmbmp.exe
  2⤵
  PID:9424
- C:\Windows\System\INUVUIN.exe
  C:\Windows\System\INUVUIN.exe
  2⤵
  PID:9440
- C:\Windows\System\VuxHYLX.exe
  C:\Windows\System\VuxHYLX.exe
  2⤵
  PID:9456
- C:\Windows\System\xDjgfNI.exe
  C:\Windows\System\xDjgfNI.exe
  2⤵
  PID:9472
- C:\Windows\System\FWcMJbz.exe
  C:\Windows\System\FWcMJbz.exe
  2⤵
  PID:9488
- C:\Windows\System\EBwQWKv.exe
  C:\Windows\System\EBwQWKv.exe
  2⤵
  PID:9504
- C:\Windows\System\QMpBJTn.exe
  C:\Windows\System\QMpBJTn.exe
  2⤵
  PID:9520
- C:\Windows\System\LCyIpWw.exe
  C:\Windows\System\LCyIpWw.exe
  2⤵
  PID:9540
- C:\Windows\System\VPBHDwh.exe
  C:\Windows\System\VPBHDwh.exe
  2⤵
  PID:9556
- C:\Windows\System\fQFNALK.exe
  C:\Windows\System\fQFNALK.exe
  2⤵
  PID:9572
- C:\Windows\System\IWKvWqa.exe
  C:\Windows\System\IWKvWqa.exe
  2⤵
  PID:9588
- C:\Windows\System\sJVdjHX.exe
  C:\Windows\System\sJVdjHX.exe
  2⤵
  PID:9604
- C:\Windows\System\LbQbrJs.exe
  C:\Windows\System\LbQbrJs.exe
  2⤵
  PID:9620
- C:\Windows\System\tAfuDZO.exe
  C:\Windows\System\tAfuDZO.exe
  2⤵
  PID:9636
- C:\Windows\System\WtpimHL.exe
  C:\Windows\System\WtpimHL.exe
  2⤵
  PID:9652
- C:\Windows\System\YJQDuCU.exe
  C:\Windows\System\YJQDuCU.exe
  2⤵
  PID:9668
- C:\Windows\System\XhyJLWH.exe
  C:\Windows\System\XhyJLWH.exe
  2⤵
  PID:9684
- C:\Windows\System\EMJkKGt.exe
  C:\Windows\System\EMJkKGt.exe
  2⤵
  PID:9700
- C:\Windows\System\YQCGAog.exe
  C:\Windows\System\YQCGAog.exe
  2⤵
  PID:9716
- C:\Windows\System\CauQHxs.exe
  C:\Windows\System\CauQHxs.exe
  2⤵
  PID:9732
- C:\Windows\System\KKTHZie.exe
  C:\Windows\System\KKTHZie.exe
  2⤵
  PID:9748
- C:\Windows\System\ExlNAMd.exe
  C:\Windows\System\ExlNAMd.exe
  2⤵
  PID:9764
- C:\Windows\System\QCarvHn.exe
  C:\Windows\System\QCarvHn.exe
  2⤵
  PID:9780
- C:\Windows\System\NTEXczZ.exe
  C:\Windows\System\NTEXczZ.exe
  2⤵
  PID:9796
- C:\Windows\System\uLBdPaX.exe
  C:\Windows\System\uLBdPaX.exe
  2⤵
  PID:9812
- C:\Windows\System\ggKJpHP.exe
  C:\Windows\System\ggKJpHP.exe
  2⤵
  PID:9828
- C:\Windows\System\FswXBfK.exe
  C:\Windows\System\FswXBfK.exe
  2⤵
  PID:9844
- C:\Windows\System\NGrgwfj.exe
  C:\Windows\System\NGrgwfj.exe
  2⤵
  PID:9860
- C:\Windows\System\CflbnVN.exe
  C:\Windows\System\CflbnVN.exe
  2⤵
  PID:9880
- C:\Windows\System\oEdcYkZ.exe
  C:\Windows\System\oEdcYkZ.exe
  2⤵
  PID:9896
- C:\Windows\System\DGvNluE.exe
  C:\Windows\System\DGvNluE.exe
  2⤵
  PID:9916
- C:\Windows\System\StYrWqj.exe
  C:\Windows\System\StYrWqj.exe
  2⤵
  PID:9932
- C:\Windows\System\HsSDBqY.exe
  C:\Windows\System\HsSDBqY.exe
  2⤵
  PID:9952
- C:\Windows\System\WusJSIj.exe
  C:\Windows\System\WusJSIj.exe
  2⤵
  PID:9968
- C:\Windows\System\FbBMIDC.exe
  C:\Windows\System\FbBMIDC.exe
  2⤵
  PID:9984
- C:\Windows\System\VMdeUyZ.exe
  C:\Windows\System\VMdeUyZ.exe
  2⤵
  PID:10004
- C:\Windows\System\HFUAAUf.exe
  C:\Windows\System\HFUAAUf.exe
  2⤵
  PID:10020
- C:\Windows\System\ZbtCifs.exe
  C:\Windows\System\ZbtCifs.exe
  2⤵
  PID:10040
- C:\Windows\System\tovxVeR.exe
  C:\Windows\System\tovxVeR.exe
  2⤵
  PID:10056
- C:\Windows\System\eoBhyJB.exe
  C:\Windows\System\eoBhyJB.exe
  2⤵
  PID:10072
- C:\Windows\System\uamHmqp.exe
  C:\Windows\System\uamHmqp.exe
  2⤵
  PID:10092
- C:\Windows\System\fqmDvKP.exe
  C:\Windows\System\fqmDvKP.exe
  2⤵
  PID:10108
- C:\Windows\System\MSYNrIk.exe
  C:\Windows\System\MSYNrIk.exe
  2⤵
  PID:10124
- C:\Windows\System\ySWuzzR.exe
  C:\Windows\System\ySWuzzR.exe
  2⤵
  PID:10140
- C:\Windows\System\WOaahle.exe
  C:\Windows\System\WOaahle.exe
  2⤵
  PID:10156
- C:\Windows\System\TjLwHkD.exe
  C:\Windows\System\TjLwHkD.exe
  2⤵
  PID:10172
- C:\Windows\System\fNKZgqn.exe
  C:\Windows\System\fNKZgqn.exe
  2⤵
  PID:10188
- C:\Windows\System\fKRxUzp.exe
  C:\Windows\System\fKRxUzp.exe
  2⤵
  PID:10204
- C:\Windows\System\agLOnof.exe
  C:\Windows\System\agLOnof.exe
  2⤵
  PID:10220
- C:\Windows\System\USdovgL.exe
  C:\Windows\System\USdovgL.exe
  2⤵
  PID:10236
- C:\Windows\System\XsdoVkU.exe
  C:\Windows\System\XsdoVkU.exe
  2⤵
  PID:8976
- C:\Windows\System\eHwdbpf.exe
  C:\Windows\System\eHwdbpf.exe
  2⤵
  PID:9260
- C:\Windows\System\fexOCZz.exe
  C:\Windows\System\fexOCZz.exe
  2⤵
  PID:9292
- C:\Windows\System\AhZkIFN.exe
  C:\Windows\System\AhZkIFN.exe
  2⤵
  PID:9356
- C:\Windows\System\mQBZtEx.exe
  C:\Windows\System\mQBZtEx.exe
  2⤵
  PID:9420
- C:\Windows\System\VQapgbl.exe
  C:\Windows\System\VQapgbl.exe
  2⤵
  PID:9484
- C:\Windows\System\fnZanty.exe
  C:\Windows\System\fnZanty.exe
  2⤵
  PID:9500
- C:\Windows\System\NHxOSQB.exe
  C:\Windows\System\NHxOSQB.exe
  2⤵
  PID:9584
- C:\Windows\System\XeKuEvQ.exe
  C:\Windows\System\XeKuEvQ.exe
  2⤵
  PID:9616
- C:\Windows\System\kGxwjeV.exe
  C:\Windows\System\kGxwjeV.exe
  2⤵
  PID:9676
- C:\Windows\System\KaaCKMc.exe
  C:\Windows\System\KaaCKMc.exe
  2⤵
  PID:9740
- C:\Windows\System\JllqwVp.exe
  C:\Windows\System\JllqwVp.exe
  2⤵
  PID:9628
- C:\Windows\System\gLjEtmI.exe
  C:\Windows\System\gLjEtmI.exe
  2⤵
  PID:9696
- C:\Windows\System\WAsASle.exe
  C:\Windows\System\WAsASle.exe
  2⤵
  PID:9788
- C:\Windows\System\xVJlQSt.exe
  C:\Windows\System\xVJlQSt.exe
  2⤵
  PID:9856
- C:\Windows\System\jaRBDIx.exe
  C:\Windows\System\jaRBDIx.exe
  2⤵
  PID:9840
- C:\Windows\System\EFRjOIj.exe
  C:\Windows\System\EFRjOIj.exe
  2⤵
  PID:9876
- C:\Windows\System\zHxzogR.exe
  C:\Windows\System\zHxzogR.exe
  2⤵
  PID:9940
- C:\Windows\System\SmQHjUS.exe
  C:\Windows\System\SmQHjUS.exe
  2⤵
  PID:9980
- C:\Windows\System\BoVhPEL.exe
  C:\Windows\System\BoVhPEL.exe
  2⤵
  PID:10048

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\AMFGPBs.exe

Filesize
1.5MB

MD5
349d4f996e997c498c3db7940a72e72e

SHA1
4b823387343e28ab949842ee42b9f80b5d10a547

SHA256
d86f6c78bc7b61d6b866e62351e580aee943fe14db41de66dd5d32ec52c3fe58

SHA512
a67e3a6b9437fe5bca535895b6fe80ac3775d0f793eb4d2dd70cdc0f1e9fd9f8da308e5b35496dbae6b19e9b796143e337c949c29eb21607a9994749af7247f3

Download Submit
C:\Windows\system\AbMZKtf.exe

Filesize
1.5MB

MD5
a8e01526c6b7d81513d889c93012371a

SHA1
c6ffef8f83334b0dd4e7ada286964b53c393689d

SHA256
65950b4274ed589ef8d543a47face8537bb474b9adb93195c7affd7e4c2b58cf

SHA512
3b89a38a95cd6718fb25ec5b69241a6fdb7f2a779f15f392bb0cf5fa57c83018da232a92e6afee56aa5b14836fef5bdd1e98311769644b81527d2e7f7f1ff972

Download Submit
C:\Windows\system\AeEbsYS.exe

Filesize
1.5MB

MD5
242bf96fb90105d9e35e8a19c846cbae

SHA1
c256ebf703bf7b13ffa725f20b43cf0476194af8

SHA256
7ff304722a31aa01ac9f742e2124ca35fac6429f27c96e23188d05b57552ccd4

SHA512
088854d06e2bebf27e05d1f7741f48782159cfa82fa483a4741d4f57dbb48eca6895a7095ea077495c9c0d286083b63ad35cb4f18e6ebbdc45224c7faa7b3ba5

Download Submit
C:\Windows\system\DCcMvWn.exe

Filesize
1.5MB

MD5
5d8aa57f94c646d91d900f0621f8bd5f

SHA1
5d8a88ac323c6021df853ad4fb7c557008127399

SHA256
2f298135772d2d56f4b25a9eb7ab745d9dff293c593f8c7023c6cf7378b69752

SHA512
21ced2adac0a9fe9f791ef74f5a17e6f039559438face7aefe7957f2ec62aafbf1532e09ebc973ec7fe9f704d10ec01ad8103ccdebd2b53bf2cf369596653a22

Download Submit
C:\Windows\system\FZyAOJt.exe

Filesize
1.5MB

MD5
342a8da899cf0747dba1b2d336e60b18

SHA1
74f8c69303ac97acdd756a1f7250b99999da6e50

SHA256
839d0758452dbca90efda0fec1e17e2629be5cf75fb02f721100d5f1afb7570a

SHA512
cfbd2e7ff591f089b549b2f80b8c1ff98381d11f4c95a1191275e0881982cd7209b66a8a880ccfc1d61921cdfff37e7de9a8e94bd262258013a9435c833e7587

Download Submit
C:\Windows\system\HarlgKL.exe

Filesize
18B

MD5
fa4d37a3ab3b6ca9c9c91d235533ef0a

SHA1
d29f90f510df157d4841a0d6797ede517c143136

SHA256
63a37ee2a31ee48f022baeb482a578778e1732cd70008fe0380859d54f4cd04d

SHA512
ea4e1cb8a045b29f9dbed328df2aac47d7547626219995ffe96daa736464ecc20b704c77dc4660196e9d616a9f5e506a36f6084325a807400c8f26a04426f363

Download Submit
C:\Windows\system\KQveTir.exe

Filesize
1.5MB

MD5
d18bab26526f2caea6d24281fe930f1c

SHA1
04d0ca00e40967b678e10615eb314605e9378e0a

SHA256
9b8c60768eb2392a7c8abd7b8798de7b22e273c6369d2089de1f6acf25dac4da

SHA512
9a9c41fd54d3117180c347fee559fe281dfe49d07a74e8bc7a1d1f23c7063261b7ba0377a833b230cde04090054fb7c7833dbc0185e94d6771389fa5e6536225

Download Submit
C:\Windows\system\LRaLdAS.exe

Filesize
1.5MB

MD5
8d7cd77f48bf49cb79136f520ea15166

SHA1
ecf7dde2e19b101e412a158201a4ac46d50c5883

SHA256
ad7edbb09342d484279f384a1a18445814c1f8b0ffac7c4c7faefab635776784

SHA512
203b1daa1557ad21cc51396568fa06d8e7aa53ac23019d3c1c840d3cdcec0db8c37b9afe413831cc5ca894c1ae4745bfc9937377effb6fff25a28fadf2f60f8d

Download Submit
C:\Windows\system\LaOKGHH.exe

Filesize
1.5MB

MD5
efaf21ee55f2d241aa32673a73759c93

SHA1
978fe02265fb210aa60d01c8b7cd32753a0dd605

SHA256
244d382424758185d8a871e48fafed0862318ed84ac35da9bf197869359c04f3

SHA512
99246c4915adf84f176bc062c078e359f05b1848a22eb18430406e604956950b837e9edabe279c61d4a45f3032669e4f8665d3015f050b68a98f5dceb791cce1

Download Submit
C:\Windows\system\ODLuPec.exe

Filesize
1.5MB

MD5
5b8436401f4e2dff153182fb76fe2a94

SHA1
fe0ac14147b20069bd5a1a36be7f78be67b62b8b

SHA256
7e73dbc616bd71fe2fbbbfb44721a4b969744449cf597c162dfccd78979f70d9

SHA512
3b2fb11134cd4bd1fbdb13b8b466ddc5c42ba2dd70bc227552894745d7f00d3836b57552ea2216b9ef168cb34fc8ec1c328897929b8f2cb18064e69648fb6b30

Download Submit
C:\Windows\system\SlDGlGi.exe

Filesize
1.5MB

MD5
de97b3ed8a14f5039e9df0f9908fe646

SHA1
af1be15889001823609deda4bf5845eb078f7ac5

SHA256
43b02cde2198d3ec417fb774a1d14978be39ca5b8bc25cdd4519d623623a12a9

SHA512
fa57bffa67255c04e53e3535ea865ba6efdc8bfdb90cc766b574b5f1e838be93a1fbaeb1be6754811aec8101cd1c873456d31cfae3792819c5b1cb0463d3b941

Download Submit
C:\Windows\system\SuvHcVd.exe

Filesize
1.5MB

MD5
753e20a6ddc469f93b22839a03fd8874

SHA1
c1acd28eac299ea3f1081d1214691da589461f53

SHA256
5e5230fa3ff449c248c8ee5c112a8b1626d8e1804fe5deb191ff6d8d52d769fb

SHA512
eb955aa11bf07d8cfebd5e36ea046edf6fe606e67ce2129119c10ad54230b8ca467c7c3f421b5e1109085072ff34bf75d944c355415d4c7f99ffb2c823260bcf

Download Submit
C:\Windows\system\WFTXmNJ.exe

Filesize
1.5MB

MD5
7da825522fb3923d7f3d01266b845349

SHA1
1463103aab0a79b326a39e206a529ca673a53baf

SHA256
eb02e4555d68a15199f916dad1a6f440ba2131d3810e2fee9d79ccf18db61f4f

SHA512
71cdcd9cbc04cbaafa91a7dea5c8c37fc2c11f7025b8f00164059d1a7486d82e4408bf4b1259fddb3d0f38d63bbf289b2ecf4e78bb3805a6623ec1c2f3e9b578

Download Submit
C:\Windows\system\XbBRnEl.exe

Filesize
1.5MB

MD5
b5acc2c8e823c3dd5a5f32ed8c6406f3

SHA1
742bbcdaec60fdf341dd785a9d0e459359422a1a

SHA256
32f51dcc43012caed8c6a6100aa75c6341f00ad7775eb82f15e2e855175e1da0

SHA512
1833bd08b9ff30d289231a12f313b24a3f3eef9ff26edeab1ccce9c2f8ac65a3b57fb6369852427ec3938495236f5b93b47c8e08cf4bde352b303fb0f370bf6b

Download Submit
C:\Windows\system\brVhKnO.exe

Filesize
1.5MB

MD5
75e2a821bafb8ae7abe61a16f0e3f3df

SHA1
50106d61d8287729d2505c50c6d25fd3cb5b68cb

SHA256
40dfb58c2018929f7113b9a9d0de3911388c7c0fc09433bfdc1b00f3c58ba916

SHA512
4a9422bf1c9e2c9f14dcede13155134212262bd7b0776a15657c2e59728353cf9aa584a01b95a775ec1fbad9d1a1f8961fbbfef4eeeb35068bd3092b2d10d2d9

Download Submit
C:\Windows\system\cDAPpRs.exe

Filesize
1.5MB

MD5
000d12a9db3f8079c2b2eb14eb1455b8

SHA1
24df26a767e602b59603e9f0eea75c5e3cc9a0bb

SHA256
d56f146a4b4755bede74d6c093c747b3b54c30bd7da976f5e46354a78e450fcd

SHA512
d1bdf6a561c3199eb279b825c3ee7e2381f0caca1c5fdaa7fddc52f922cc47601740d2e3ce20179567b9431bdac3525de3e966d33c8a637d6f5a76ca91700e4d

Download Submit
C:\Windows\system\diOuVkS.exe

Filesize
1.5MB

MD5
0f175992210bbed5d536e882854cb956

SHA1
f6ac65abdeaf86b713b630c58aab7ec322c2bc36

SHA256
22d56510df2c3b9977c64ad0ada26cc1128bb3c39e5821a112fe8aea090ac85f

SHA512
97962955637b429d741905596a2197965a072ba8c77dc29b1169e9734efb5ac50455567c7f795004cadc410100639130422925304a4cd6ea642639c708c5a1bd

Download Submit
C:\Windows\system\fQrigTe.exe

Filesize
1.5MB

MD5
f1ea893a2b1717d0065b361fe99da185

SHA1
a95b9f26515dbf8669798abeca785953808e8881

SHA256
7a00d42d797a1e2f780da187627cccfbbe7f2170e98c30d62755cfa2c65eacd8

SHA512
651c129e6d2aa82b288ab227bed695c972301995b4461348f421475fa88896079657d8c4b2449be76848b978e798eebbdfa3b9a481f21d3886c959d298a03b07

Download Submit
C:\Windows\system\jnfPSMZ.exe

Filesize
1.5MB

MD5
8d87bc57dfc12de396faa601a2500b82

SHA1
2f44d8d0a2e0543828980495f55db351201c5891

SHA256
8c86550e8dc3ad6e92bdeea32f846179e55c21b5a20f7cbc0cf8e31d4c79cbe6

SHA512
c695306bdf749f9e39d1db5039503a191fe6c1bc4c323bed9c9c63e7b156879af8e0272e155887b7dd750c9a865452dfe463aad30ae36543da54246f3435682a

Download Submit
C:\Windows\system\jpUhIZR.exe

Filesize
1.5MB

MD5
50d6e2508453ff17e17549747befa4ee

SHA1
124654c3a57b1cfe839c65deda818701c40db87f

SHA256
64f271065649ce10c4b9bf2a92e9eae8eaec27d7830739fe6287a894b51a58be

SHA512
37b7352831081f808fe4db522df1a17973ac86b86caeca0df1d6a9aca0f5703d71247f561863fb46fde98b1ce0556078170d704b21ac1dc5d4e0d36fd0632457

Download Submit
C:\Windows\system\mVuyaQY.exe

Filesize
1.5MB

MD5
3acca90d6865f1468dde2e5cd86c596d

SHA1
fd4c11ca9dc80fb808096e5ed52aee58220ff421

SHA256
05cdb86895cf352a33796b1feb908ca27a06b496fae9b01303f6131020c7a121

SHA512
5ba71f2407960a741ac12ae593c187f39d20c7c2389a00f459bd4beeb449dfd442c1f688eb43c22469277273aaa48b8963a5fc4a85aaa4fd6e9c04e7cdb2c6d9

Download Submit
C:\Windows\system\qUlqMrU.exe

Filesize
1.5MB

MD5
2d983e193062621766f7e46c861ac1e1

SHA1
e369b9dea2c0af4256add5433210260ae4771162

SHA256
7730a6faa33c71f4a2edd4167a40feeb7a4c560e4d70dfdd7fb6ea3a96c93ff3

SHA512
0e7c328c2ffc23aa3c9eb6a8996309733857a0d9a43cbf8cce0c058db92260ddcabfa72d4ccd9e16e89146959ee3e1a84cad6828544de135de3df904ec64e1b9

Download Submit
C:\Windows\system\rlHQjig.exe

Filesize
1.5MB

MD5
040fed6507bb79756ff65a9e7d9303a9

SHA1
0ac19dff98c68b500cb9e608d1bc1e92ae041e4c

SHA256
bd6d893e9f3fb657823e6df3e7786875ee946ddef118d384d7a350f4c4a7f6fe

SHA512
279be19b67d4d52baab02e3852520b094a1b76e8cf9f3656011126341fa8322120a07e9531b4afbe6355e90464fd5d3bc5289f861bacf32b96053fd1a85ce5e1

Download Submit
C:\Windows\system\sSEYtjn.exe

Filesize
1.5MB

MD5
d3c1df3400ee91d56af7e9801fbe169a

SHA1
0cfac7e9214c957ba2b3564f65ee4ab535d166a6

SHA256
ff84b3cad02a906fa2748c417e4071a9bee0716868a1818479b68d20dba5d849

SHA512
c16166acfe7d19e0e877b4ad693c36985cec17075639ffd9fbc710b2547dc262a1cf90a82c1802493b3c048e132fd6bc928df6e3e5a96edae3305cfd4e39d36f

Download Submit
C:\Windows\system\xBkdLSH.exe

Filesize
1.5MB

MD5
2f30b467420afe0db28b9e4c4f4580a1

SHA1
882dcac019f338e787624dbba6aeccfd249e4ec9

SHA256
d527ad59ffdab4b4bdd7a21f04557a2a64b92e22647dad906fd02a58799d8aa2

SHA512
b0f29d2bde7654ce189e29c5b2b6fba3475121226851c0672dd660235abe8a2fd78fbc8f489e6b983d6adba242018dfec24e98c2486e603be911311ee1e21b15

Download Submit
\Windows\system\NfyHsLZ.exe

Filesize
1.5MB

MD5
06032f34a6a66acd7ff0acfa4625bcc4

SHA1
1f17ac761ce2fdc5c2f9c204ed0004232074188e

SHA256
0fe0a60514ba892a5f2913c616a62df38f3bc8ccd951efc9f8aa9cccab113ed7

SHA512
eea34b762427526925e778990a4d130a021185e49af143a5d3ec6c47ba5475eff0d1686926525ae9bc0f35f6e96e4c2730ff79002692ed75d0b5c9d506f065c9

Download Submit
\Windows\system\XVBobKe.exe

Filesize
1.5MB

MD5
2dc1c848e3947f7858c22499dd8b21d3

SHA1
a3f933ecd9c2a969811ef4a676f6104bf7d15faa

SHA256
cdc04bc7b0a86c428c7cc440eaf1e8990b5c91faf4368fbf7793515d1132c330

SHA512
4adfbd61ee48342925e9ecdc36972d47ec6c81149cf627eb9601f44951516916ead77f6e939124dbaac3cdd1f26b2649fa0e22e109cffb7a9c6267b1131484fb

Download Submit
\Windows\system\ZkfFwWf.exe

Filesize
1.5MB

MD5
8da52c470efa912791e7f92f684d7283

SHA1
c17411887dafd1bef9441d00906074238ca826d0

SHA256
4aa10e250141bade451e40ea15c6963d0fdc3fd2d47540bb4cc9eae7736b5bad

SHA512
df46f6e53514750bfe22464db5880b8ad63873143a7bb948a6370a31126ffe0ab55ff8eca2321bb11c42394d511a8ea75d7ff7eb05e51e3bcfef84403093f6c4

Download Submit
\Windows\system\ZvCAUof.exe

Filesize
1.5MB

MD5
a02c11794ce73d0cbac7e7378cc2eaaa

SHA1
aa9a0f18d0cc1301d24c202b67cbcbcfddaa2be0

SHA256
08c8b8ba2c81a862ff2d06a0c0f3f599b48a906e1ac261b327783dcea4241d0a

SHA512
033cfc4dba99865c6bfe697b2e7d743124efceee308ccda1ef723ffeb0153c8e39eaae1f13a9697eb27eb54feeebc0a455f786ac9e0cec0149efc1f860058629

Download Submit
\Windows\system\czIxjWc.exe

Filesize
1.5MB

MD5
be923854ac741b4d11ff066dfc5291b1

SHA1
4246094ca5ad7588f10f28857e19668cabf22f76

SHA256
90403fe4baac38fcd1bd712342a5e4794154f1652c469b1f11011eb7cc3f1cf4

SHA512
c56c082b8afbb7ad07a545679b631e642b34086edee25e65ee8bb10d749ea51640cdba6f6ca2754818cbb597e14581809eb24a8e5b11a444d12407a04781b9e1

Download Submit
\Windows\system\kgEpwzl.exe

Filesize
1.5MB

MD5
3b5df465c9f44ffd662badc2388ecfd9

SHA1
a2e991c23d80132750e2f3027b8bbc3a064248d5

SHA256
e6b9dc686263120de2e9fa2b834f82248cf568c5ec226d33f1efe43531b96df9

SHA512
24f79a26eea1280efeaab102cf17d856e1ba79a587e3d8eac8c673a2f5b0e9f9f8f651233739e1b3bd52a8ca34e364f865ece7866e106c63ef18653f4f044d91

Download Submit
\Windows\system\kvrqDHV.exe

Filesize
1.5MB

MD5
dfe2c9f942508ad15d0adcd485526b16

SHA1
a92edbdc7a505adb1fb6b792612b91391aec64c2

SHA256
ec241f58ecc9f20864db19e901c55748e71ce6809b6a076246809c83b8f91a26

SHA512
b56db88824e6106dd5a64adce169cb649c2084903d7e5cc2284111208add6f16fd7e15fd41f1458135efcc6154da0bbc2e366296fead84d31564beffb0de7fe5

Download Submit
\Windows\system\nNpcWsI.exe

Filesize
1.5MB

MD5
cf157d9e2fd515b4d3894c5220e5b156

SHA1
c8bcca669a4e09c0f19ff3736b5a910930e2fa79

SHA256
6667f1f8f26a794c92d060ea67d71f5edcd206d8309a3f6a815a68f7f602e551

SHA512
963121a21dca9c23ec66f087317e758290c176e52e14d1c5799120010b4d4bcd7975bd377d084997f72158e9b3e6dec24d41bf7cc0f8eb5bb8a47c2b2c37d424

Download Submit
\Windows\system\vzSYjbt.exe

Filesize
1.5MB

MD5
32fe0be2bf86a52fc497a071af15f023

SHA1
99a9f80f661e9ea6d08442730b75aa97843e3244

SHA256
93829101cf8910242f424b05db41ff1f73c801d71078fbc9ff14a2b47c07b25a

SHA512
d206d06e5dd71ee541dbeaf1bbf7e27a92fa9831d8be8cf66d972e3dc63818904a0921c1679e26e46bdfd764debe912392b8db319664f6c31cfe931a003c3eff

Download Submit
memory/644-5905-0x000000013F7F0000-0x000000013FBE2000-memory.dmp

Filesize
3.9MB

Download
memory/644-153-0x000000013F7F0000-0x000000013FBE2000-memory.dmp

Filesize
3.9MB

Download
memory/1200-5808-0x000000013FE70000-0x0000000140262000-memory.dmp

Filesize
3.9MB

Download
memory/1200-154-0x000000013FE70000-0x0000000140262000-memory.dmp

Filesize
3.9MB

Download
memory/1664-156-0x000000013FA00000-0x000000013FDF2000-memory.dmp

Filesize
3.9MB

Download
memory/1664-1-0x0000000000300000-0x0000000000310000-memory.dmp

Filesize
64KB

Download
memory/1664-112-0x000000013FFD0000-0x00000001403C2000-memory.dmp

Filesize
3.9MB

Download
memory/1664-155-0x00000000030A0000-0x0000000003492000-memory.dmp

Filesize
3.9MB

Download
memory/1664-146-0x000000013FA80000-0x000000013FE72000-memory.dmp

Filesize
3.9MB

Download
memory/1664-89-0x000000013FBD0000-0x000000013FFC2000-memory.dmp

Filesize
3.9MB

Download
memory/1664-8-0x000000013FDD0000-0x00000001401C2000-memory.dmp

Filesize
3.9MB

Download
memory/1664-0-0x000000013F470000-0x000000013F862000-memory.dmp

Filesize
3.9MB

Download
memory/1664-138-0x000000013FDB0000-0x00000001401A2000-memory.dmp

Filesize
3.9MB

Download
memory/1664-125-0x000000013FD30000-0x0000000140122000-memory.dmp

Filesize
3.9MB

Download
memory/1664-152-0x00000000030A0000-0x0000000003492000-memory.dmp

Filesize
3.9MB

Download
memory/1664-151-0x000000013FE70000-0x0000000140262000-memory.dmp

Filesize
3.9MB

Download
memory/1664-149-0x000000013F8A0000-0x000000013FC92000-memory.dmp

Filesize
3.9MB

Download
memory/1964-150-0x000000013F8A0000-0x000000013FC92000-memory.dmp

Filesize
3.9MB

Download
memory/1964-5816-0x000000013F8A0000-0x000000013FC92000-memory.dmp

Filesize
3.9MB

Download
memory/1980-280-0x000007FEF5A90000-0x000007FEF642D000-memory.dmp

Filesize
9.6MB

Download
memory/1980-79-0x000007FEF5A90000-0x000007FEF642D000-memory.dmp

Filesize
9.6MB

Download
memory/1980-50-0x000000001B5D0000-0x000000001B8B2000-memory.dmp

Filesize
2.9MB

Download
memory/1980-14-0x0000000002AF0000-0x0000000002B70000-memory.dmp

Filesize
512KB

Download
memory/1980-15-0x000007FEF5D4E000-0x000007FEF5D4F000-memory.dmp

Filesize
4KB

Download
memory/1980-51-0x0000000002820000-0x0000000002828000-memory.dmp

Filesize
32KB

Download
memory/1980-82-0x000007FEF5A90000-0x000007FEF642D000-memory.dmp

Filesize
9.6MB

Download
memory/2312-118-0x000000013FFD0000-0x00000001403C2000-memory.dmp

Filesize
3.9MB

Download
memory/2312-5803-0x000000013FFD0000-0x00000001403C2000-memory.dmp

Filesize
3.9MB

Download
memory/2420-5868-0x000000013FDB0000-0x00000001401A2000-memory.dmp

Filesize
3.9MB

Download
memory/2420-141-0x000000013FDB0000-0x00000001401A2000-memory.dmp

Filesize
3.9MB

Download
memory/2480-5805-0x000000013FA80000-0x000000013FE72000-memory.dmp

Filesize
3.9MB

Download
memory/2480-147-0x000000013FA80000-0x000000013FE72000-memory.dmp

Filesize
3.9MB

Download
memory/2520-5779-0x000000013FBD0000-0x000000013FFC2000-memory.dmp

Filesize
3.9MB

Download
memory/2520-90-0x000000013FBD0000-0x000000013FFC2000-memory.dmp

Filesize
3.9MB

Download
memory/2536-87-0x000000013FA00000-0x000000013FDF2000-memory.dmp

Filesize
3.9MB

Download
memory/2536-5750-0x000000013FA00000-0x000000013FDF2000-memory.dmp

Filesize
3.9MB

Download
memory/2620-5831-0x000000013F5D0000-0x000000013F9C2000-memory.dmp

Filesize
3.9MB

Download
memory/2620-103-0x000000013F5D0000-0x000000013F9C2000-memory.dmp

Filesize
3.9MB

Download
memory/2644-132-0x000000013FD30000-0x0000000140122000-memory.dmp

Filesize
3.9MB

Download
memory/2644-5801-0x000000013FD30000-0x0000000140122000-memory.dmp

Filesize
3.9MB

Download
memory/2936-5762-0x000000013FDD0000-0x00000001401C2000-memory.dmp

Filesize
3.9MB

Download
memory/2936-13-0x000000013FDD0000-0x00000001401C2000-memory.dmp

Filesize
3.9MB

Download