xmrig | 4108a249086745b2716c4b59647d31a4885660a054ca2db0b1f2a2a7db29628a

Analysis

max time kernel
147s
max time network
141s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
08/05/2024, 04:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c61a7b6ad568db85a9246222ca01e5c0_NEIKI.exe
Size

3.3MB
MD5

c61a7b6ad568db85a9246222ca01e5c0
SHA1

ebc6e3378dda3b913ec3d316a6c9ee2660b81c34
SHA256

4108a249086745b2716c4b59647d31a4885660a054ca2db0b1f2a2a7db29628a
SHA512

c7a988880b6c663f4e3656e939a5e8d051a3942a1923e2e6053dbef1421442863a73b9aa6f8399cf6cab54c7c94e3cc824023d39aaf7c0862b0c83c9759cc2a6
SSDEEP

98304:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWS:SbBeSFkm

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 46 IoCs

miner

resource	yara_rule
behavioral1/memory/2876-1-0x000000013F2D0000-0x000000013F6C6000-memory.dmp	xmrig
behavioral1/files/0x000d000000013413-3.dat	xmrig
behavioral1/files/0x0036000000013a3a-8.dat	xmrig
behavioral1/memory/3048-17-0x000000013F180000-0x000000013F576000-memory.dmp	xmrig
behavioral1/files/0x000e0000000054ab-20.dat	xmrig
behavioral1/files/0x0007000000014175-33.dat	xmrig
behavioral1/files/0x000800000001415f-27.dat	xmrig
behavioral1/files/0x0007000000014186-37.dat	xmrig
behavioral1/files/0x0009000000014228-41.dat	xmrig
behavioral1/files/0x0008000000014246-59.dat	xmrig
behavioral1/files/0x0006000000014bbc-74.dat	xmrig
behavioral1/files/0x0006000000014b18-67.dat	xmrig
behavioral1/files/0x000600000001487f-57.dat	xmrig
behavioral1/files/0x000600000001471a-51.dat	xmrig
behavioral1/files/0x0006000000014826-54.dat	xmrig
behavioral1/files/0x0006000000014fa2-96.dat	xmrig
behavioral1/memory/2456-104-0x000000013F3A0000-0x000000013F796000-memory.dmp	xmrig
behavioral1/memory/2876-106-0x0000000003640000-0x0000000003A36000-memory.dmp	xmrig
behavioral1/memory/2532-109-0x000000013F560000-0x000000013F956000-memory.dmp	xmrig
behavioral1/files/0x0006000000014e71-79.dat	xmrig
behavioral1/memory/2716-95-0x000000013F610000-0x000000013FA06000-memory.dmp	xmrig
behavioral1/files/0x000600000001564f-125.dat	xmrig
behavioral1/files/0x0036000000013a46-135.dat	xmrig
behavioral1/files/0x0006000000015c87-160.dat	xmrig
behavioral1/files/0x0006000000015cd9-185.dat	xmrig
behavioral1/files/0x0006000000015cff-195.dat	xmrig
behavioral1/files/0x0006000000015ce3-190.dat	xmrig
behavioral1/files/0x0006000000015cb6-175.dat	xmrig
behavioral1/files/0x0006000000015ccd-180.dat	xmrig
behavioral1/files/0x0006000000015c9e-166.dat	xmrig
behavioral1/files/0x0006000000015cae-170.dat	xmrig
behavioral1/files/0x0006000000015684-155.dat	xmrig
behavioral1/files/0x0006000000015677-150.dat	xmrig
behavioral1/files/0x000600000001565d-145.dat	xmrig
behavioral1/files/0x0006000000015653-140.dat	xmrig
behavioral1/memory/296-116-0x000000013F6E0000-0x000000013FAD6000-memory.dmp	xmrig
behavioral1/files/0x0006000000014b4c-115.dat	xmrig
behavioral1/memory/2892-114-0x000000013F420000-0x000000013F816000-memory.dmp	xmrig
behavioral1/files/0x000600000001535e-111.dat	xmrig
behavioral1/memory/2728-92-0x000000013F5C0000-0x000000013F9B6000-memory.dmp	xmrig
behavioral1/memory/2064-90-0x000000013F400000-0x000000013F7F6000-memory.dmp	xmrig
behavioral1/memory/2812-86-0x000000013F7C0000-0x000000013FBB6000-memory.dmp	xmrig
behavioral1/memory/2660-85-0x000000013F470000-0x000000013F866000-memory.dmp	xmrig
behavioral1/files/0x0006000000014a9a-62.dat	xmrig
behavioral1/memory/2876-3606-0x000000013F2D0000-0x000000013F6C6000-memory.dmp	xmrig
behavioral1/memory/3048-3607-0x000000013F180000-0x000000013F576000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
2936	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
3048	CsutGkA.exe
2660	AufDvXz.exe
2812	MPxeQSy.exe
2064	oPTckVY.exe
2728	UUWoVEx.exe
2716	yvCMBtR.exe
2456	PGoLVCZ.exe
2532	WmbaDoR.exe
2892	HOoPwjR.exe
296	gMGAVfG.exe
2756	CrobDVm.exe
2872	mQTvOUx.exe
1204	VRvHmQC.exe
1456	YIpGmUH.exe
1284	ncsUdtO.exe
2776	BfAddNd.exe
748	SQACTLL.exe
2292	URevfTy.exe
2284	lThjjVj.exe
2832	IHfWdfh.exe
1956	inhxwdy.exe
2828	QlwnzXp.exe
2312	eNTHYGO.exe
488	xILjVfM.exe
648	UAmwyhu.exe
924	HCFBLmV.exe
1512	KCuTiUV.exe
784	elLTwFR.exe
696	JrcHJKW.exe
2428	YlyCUrk.exe
2176	ZJeTGNO.exe
1360	adcrDXF.exe
1352	EPeRPax.exe
944	CBDzQAG.exe
764	jWWwRgj.exe
1280	oCVUQlA.exe
2092	UXTHuut.exe
1676	PEwFGsg.exe
848	UuKokdA.exe
684	znyeFNi.exe
1268	AoehvZP.exe
1568	tswFOOA.exe
1752	fOlfsGy.exe
604	OCLbdfC.exe
544	wJCPksA.exe
2004	UOAoRtP.exe
2544	ZPkoHTi.exe
2852	RRLeOeF.exe
1624	aDaoYgf.exe
1848	EWSUHbh.exe
2932	LVBMrRL.exe
2700	iHCzXMg.exe
2648	djyQLUi.exe
2592	VmOsZuT.exe
2788	LoSJpTU.exe
2492	UKGDsAS.exe
2500	FhzsyEO.exe
2692	SqVRKEk.exe
2236	dZhNsyr.exe
2780	KiMGjKU.exe
3028	jbwLiyr.exe
908	yAzIsZN.exe
2056	IHfyPGF.exe
2156	lWObloe.exe

Loads dropped DLL 64 IoCs

pid	Process
2876	c61a7b6ad568db85a9246222ca01e5c0_NEIKI.exe
2876	c61a7b6ad568db85a9246222ca01e5c0_NEIKI.exe
2876	c61a7b6ad568db85a9246222ca01e5c0_NEIKI.exe
2876	c61a7b6ad568db85a9246222ca01e5c0_NEIKI.exe
2876	c61a7b6ad568db85a9246222ca01e5c0_NEIKI.exe
2876	c61a7b6ad568db85a9246222ca01e5c0_NEIKI.exe
2876	c61a7b6ad568db85a9246222ca01e5c0_NEIKI.exe
2876	c61a7b6ad568db85a9246222ca01e5c0_NEIKI.exe
2876	c61a7b6ad568db85a9246222ca01e5c0_NEIKI.exe
2876	c61a7b6ad568db85a9246222ca01e5c0_NEIKI.exe
2876	c61a7b6ad568db85a9246222ca01e5c0_NEIKI.exe
2876	c61a7b6ad568db85a9246222ca01e5c0_NEIKI.exe
2876	c61a7b6ad568db85a9246222ca01e5c0_NEIKI.exe
2876	c61a7b6ad568db85a9246222ca01e5c0_NEIKI.exe
2876	c61a7b6ad568db85a9246222ca01e5c0_NEIKI.exe
2876	c61a7b6ad568db85a9246222ca01e5c0_NEIKI.exe
2876	c61a7b6ad568db85a9246222ca01e5c0_NEIKI.exe
2876	c61a7b6ad568db85a9246222ca01e5c0_NEIKI.exe
2876	c61a7b6ad568db85a9246222ca01e5c0_NEIKI.exe
2876	c61a7b6ad568db85a9246222ca01e5c0_NEIKI.exe
2876	c61a7b6ad568db85a9246222ca01e5c0_NEIKI.exe
2876	c61a7b6ad568db85a9246222ca01e5c0_NEIKI.exe
2876	c61a7b6ad568db85a9246222ca01e5c0_NEIKI.exe
2876	c61a7b6ad568db85a9246222ca01e5c0_NEIKI.exe
2876	c61a7b6ad568db85a9246222ca01e5c0_NEIKI.exe
2876	c61a7b6ad568db85a9246222ca01e5c0_NEIKI.exe
2876	c61a7b6ad568db85a9246222ca01e5c0_NEIKI.exe
2876	c61a7b6ad568db85a9246222ca01e5c0_NEIKI.exe
2876	c61a7b6ad568db85a9246222ca01e5c0_NEIKI.exe
2876	c61a7b6ad568db85a9246222ca01e5c0_NEIKI.exe
2876	c61a7b6ad568db85a9246222ca01e5c0_NEIKI.exe
2876	c61a7b6ad568db85a9246222ca01e5c0_NEIKI.exe
2876	c61a7b6ad568db85a9246222ca01e5c0_NEIKI.exe
2876	c61a7b6ad568db85a9246222ca01e5c0_NEIKI.exe
2876	c61a7b6ad568db85a9246222ca01e5c0_NEIKI.exe
2876	c61a7b6ad568db85a9246222ca01e5c0_NEIKI.exe
2876	c61a7b6ad568db85a9246222ca01e5c0_NEIKI.exe
2876	c61a7b6ad568db85a9246222ca01e5c0_NEIKI.exe
2876	c61a7b6ad568db85a9246222ca01e5c0_NEIKI.exe
2876	c61a7b6ad568db85a9246222ca01e5c0_NEIKI.exe
2876	c61a7b6ad568db85a9246222ca01e5c0_NEIKI.exe
2876	c61a7b6ad568db85a9246222ca01e5c0_NEIKI.exe
2876	c61a7b6ad568db85a9246222ca01e5c0_NEIKI.exe
2876	c61a7b6ad568db85a9246222ca01e5c0_NEIKI.exe
2876	c61a7b6ad568db85a9246222ca01e5c0_NEIKI.exe
2876	c61a7b6ad568db85a9246222ca01e5c0_NEIKI.exe
2876	c61a7b6ad568db85a9246222ca01e5c0_NEIKI.exe
2876	c61a7b6ad568db85a9246222ca01e5c0_NEIKI.exe
2876	c61a7b6ad568db85a9246222ca01e5c0_NEIKI.exe
2876	c61a7b6ad568db85a9246222ca01e5c0_NEIKI.exe
2876	c61a7b6ad568db85a9246222ca01e5c0_NEIKI.exe
2876	c61a7b6ad568db85a9246222ca01e5c0_NEIKI.exe
2876	c61a7b6ad568db85a9246222ca01e5c0_NEIKI.exe
2876	c61a7b6ad568db85a9246222ca01e5c0_NEIKI.exe
2876	c61a7b6ad568db85a9246222ca01e5c0_NEIKI.exe
2876	c61a7b6ad568db85a9246222ca01e5c0_NEIKI.exe
2876	c61a7b6ad568db85a9246222ca01e5c0_NEIKI.exe
2876	c61a7b6ad568db85a9246222ca01e5c0_NEIKI.exe
2876	c61a7b6ad568db85a9246222ca01e5c0_NEIKI.exe
2876	c61a7b6ad568db85a9246222ca01e5c0_NEIKI.exe
2876	c61a7b6ad568db85a9246222ca01e5c0_NEIKI.exe
2876	c61a7b6ad568db85a9246222ca01e5c0_NEIKI.exe
2876	c61a7b6ad568db85a9246222ca01e5c0_NEIKI.exe
2876	c61a7b6ad568db85a9246222ca01e5c0_NEIKI.exe

UPX packed file 45 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2876-1-0x000000013F2D0000-0x000000013F6C6000-memory.dmp	upx
behavioral1/files/0x000d000000013413-3.dat	upx
behavioral1/files/0x0036000000013a3a-8.dat	upx
behavioral1/memory/3048-17-0x000000013F180000-0x000000013F576000-memory.dmp	upx
behavioral1/files/0x000e0000000054ab-20.dat	upx
behavioral1/files/0x0007000000014175-33.dat	upx
behavioral1/files/0x000800000001415f-27.dat	upx
behavioral1/files/0x0007000000014186-37.dat	upx
behavioral1/files/0x0009000000014228-41.dat	upx
behavioral1/files/0x0008000000014246-59.dat	upx
behavioral1/files/0x0006000000014bbc-74.dat	upx
behavioral1/files/0x0006000000014b18-67.dat	upx
behavioral1/files/0x000600000001487f-57.dat	upx
behavioral1/files/0x000600000001471a-51.dat	upx
behavioral1/files/0x0006000000014826-54.dat	upx
behavioral1/files/0x0006000000014fa2-96.dat	upx
behavioral1/memory/2456-104-0x000000013F3A0000-0x000000013F796000-memory.dmp	upx
behavioral1/memory/2532-109-0x000000013F560000-0x000000013F956000-memory.dmp	upx
behavioral1/files/0x0006000000014e71-79.dat	upx
behavioral1/memory/2716-95-0x000000013F610000-0x000000013FA06000-memory.dmp	upx
behavioral1/files/0x000600000001564f-125.dat	upx
behavioral1/files/0x0036000000013a46-135.dat	upx
behavioral1/files/0x0006000000015c87-160.dat	upx
behavioral1/files/0x0006000000015cd9-185.dat	upx
behavioral1/files/0x0006000000015cff-195.dat	upx
behavioral1/files/0x0006000000015ce3-190.dat	upx
behavioral1/files/0x0006000000015cb6-175.dat	upx
behavioral1/files/0x0006000000015ccd-180.dat	upx
behavioral1/files/0x0006000000015c9e-166.dat	upx
behavioral1/files/0x0006000000015cae-170.dat	upx
behavioral1/files/0x0006000000015684-155.dat	upx
behavioral1/files/0x0006000000015677-150.dat	upx
behavioral1/files/0x000600000001565d-145.dat	upx
behavioral1/files/0x0006000000015653-140.dat	upx
behavioral1/memory/296-116-0x000000013F6E0000-0x000000013FAD6000-memory.dmp	upx
behavioral1/files/0x0006000000014b4c-115.dat	upx
behavioral1/memory/2892-114-0x000000013F420000-0x000000013F816000-memory.dmp	upx
behavioral1/files/0x000600000001535e-111.dat	upx
behavioral1/memory/2728-92-0x000000013F5C0000-0x000000013F9B6000-memory.dmp	upx
behavioral1/memory/2064-90-0x000000013F400000-0x000000013F7F6000-memory.dmp	upx
behavioral1/memory/2812-86-0x000000013F7C0000-0x000000013FBB6000-memory.dmp	upx
behavioral1/memory/2660-85-0x000000013F470000-0x000000013F866000-memory.dmp	upx
behavioral1/files/0x0006000000014a9a-62.dat	upx
behavioral1/memory/2876-3606-0x000000013F2D0000-0x000000013F6C6000-memory.dmp	upx
behavioral1/memory/3048-3607-0x000000013F180000-0x000000013F576000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\LdmqSgo.exe	c61a7b6ad568db85a9246222ca01e5c0_NEIKI.exe
File created	C:\Windows\System\uxMZFIf.exe	c61a7b6ad568db85a9246222ca01e5c0_NEIKI.exe
File created	C:\Windows\System\drqgfGu.exe	c61a7b6ad568db85a9246222ca01e5c0_NEIKI.exe
File created	C:\Windows\System\tlnfQfm.exe	c61a7b6ad568db85a9246222ca01e5c0_NEIKI.exe
File created	C:\Windows\System\vCiPeef.exe	c61a7b6ad568db85a9246222ca01e5c0_NEIKI.exe
File created	C:\Windows\System\enRGvjS.exe	c61a7b6ad568db85a9246222ca01e5c0_NEIKI.exe
File created	C:\Windows\System\aEAVxKH.exe	c61a7b6ad568db85a9246222ca01e5c0_NEIKI.exe
File created	C:\Windows\System\hwolgoQ.exe	c61a7b6ad568db85a9246222ca01e5c0_NEIKI.exe
File created	C:\Windows\System\qRRKmnv.exe	c61a7b6ad568db85a9246222ca01e5c0_NEIKI.exe
File created	C:\Windows\System\AaSsyJU.exe	c61a7b6ad568db85a9246222ca01e5c0_NEIKI.exe
File created	C:\Windows\System\UCedpDU.exe	c61a7b6ad568db85a9246222ca01e5c0_NEIKI.exe
File created	C:\Windows\System\QBIfQoA.exe	c61a7b6ad568db85a9246222ca01e5c0_NEIKI.exe
File created	C:\Windows\System\wCxqlag.exe	c61a7b6ad568db85a9246222ca01e5c0_NEIKI.exe
File created	C:\Windows\System\bXCKZQd.exe	c61a7b6ad568db85a9246222ca01e5c0_NEIKI.exe
File created	C:\Windows\System\soORCMZ.exe	c61a7b6ad568db85a9246222ca01e5c0_NEIKI.exe
File created	C:\Windows\System\jXlKrGM.exe	c61a7b6ad568db85a9246222ca01e5c0_NEIKI.exe
File created	C:\Windows\System\QNbKumA.exe	c61a7b6ad568db85a9246222ca01e5c0_NEIKI.exe
File created	C:\Windows\System\VOhYvTU.exe	c61a7b6ad568db85a9246222ca01e5c0_NEIKI.exe
File created	C:\Windows\System\ULMWscY.exe	c61a7b6ad568db85a9246222ca01e5c0_NEIKI.exe
File created	C:\Windows\System\xkzWWRk.exe	c61a7b6ad568db85a9246222ca01e5c0_NEIKI.exe
File created	C:\Windows\System\sUUpHGN.exe	c61a7b6ad568db85a9246222ca01e5c0_NEIKI.exe
File created	C:\Windows\System\wkUvOGK.exe	c61a7b6ad568db85a9246222ca01e5c0_NEIKI.exe
File created	C:\Windows\System\ChsQMCK.exe	c61a7b6ad568db85a9246222ca01e5c0_NEIKI.exe
File created	C:\Windows\System\gHVEpov.exe	c61a7b6ad568db85a9246222ca01e5c0_NEIKI.exe
File created	C:\Windows\System\aYZmOfp.exe	c61a7b6ad568db85a9246222ca01e5c0_NEIKI.exe
File created	C:\Windows\System\WSXicob.exe	c61a7b6ad568db85a9246222ca01e5c0_NEIKI.exe
File created	C:\Windows\System\lfwytPG.exe	c61a7b6ad568db85a9246222ca01e5c0_NEIKI.exe
File created	C:\Windows\System\JRmRJry.exe	c61a7b6ad568db85a9246222ca01e5c0_NEIKI.exe
File created	C:\Windows\System\wNQLygv.exe	c61a7b6ad568db85a9246222ca01e5c0_NEIKI.exe
File created	C:\Windows\System\ylTbVpu.exe	c61a7b6ad568db85a9246222ca01e5c0_NEIKI.exe
File created	C:\Windows\System\BLqIebq.exe	c61a7b6ad568db85a9246222ca01e5c0_NEIKI.exe
File created	C:\Windows\System\iTFglDk.exe	c61a7b6ad568db85a9246222ca01e5c0_NEIKI.exe
File created	C:\Windows\System\JlbotDZ.exe	c61a7b6ad568db85a9246222ca01e5c0_NEIKI.exe
File created	C:\Windows\System\PDYCeqG.exe	c61a7b6ad568db85a9246222ca01e5c0_NEIKI.exe
File created	C:\Windows\System\tHXqGBc.exe	c61a7b6ad568db85a9246222ca01e5c0_NEIKI.exe
File created	C:\Windows\System\daNCvzg.exe	c61a7b6ad568db85a9246222ca01e5c0_NEIKI.exe
File created	C:\Windows\System\hJSZSAv.exe	c61a7b6ad568db85a9246222ca01e5c0_NEIKI.exe
File created	C:\Windows\System\dIavlGM.exe	c61a7b6ad568db85a9246222ca01e5c0_NEIKI.exe
File created	C:\Windows\System\ciuAAEr.exe	c61a7b6ad568db85a9246222ca01e5c0_NEIKI.exe
File created	C:\Windows\System\gjUbpMv.exe	c61a7b6ad568db85a9246222ca01e5c0_NEIKI.exe
File created	C:\Windows\System\VrCpJGY.exe	c61a7b6ad568db85a9246222ca01e5c0_NEIKI.exe
File created	C:\Windows\System\BaIwcwS.exe	c61a7b6ad568db85a9246222ca01e5c0_NEIKI.exe
File created	C:\Windows\System\enjVUMp.exe	c61a7b6ad568db85a9246222ca01e5c0_NEIKI.exe
File created	C:\Windows\System\lifWTSv.exe	c61a7b6ad568db85a9246222ca01e5c0_NEIKI.exe
File created	C:\Windows\System\NxfxXab.exe	c61a7b6ad568db85a9246222ca01e5c0_NEIKI.exe
File created	C:\Windows\System\CfGuVOk.exe	c61a7b6ad568db85a9246222ca01e5c0_NEIKI.exe
File created	C:\Windows\System\eDRIBdk.exe	c61a7b6ad568db85a9246222ca01e5c0_NEIKI.exe
File created	C:\Windows\System\piCeHga.exe	c61a7b6ad568db85a9246222ca01e5c0_NEIKI.exe
File created	C:\Windows\System\NMsNOBk.exe	c61a7b6ad568db85a9246222ca01e5c0_NEIKI.exe
File created	C:\Windows\System\TlrpitW.exe	c61a7b6ad568db85a9246222ca01e5c0_NEIKI.exe
File created	C:\Windows\System\GyoTBAA.exe	c61a7b6ad568db85a9246222ca01e5c0_NEIKI.exe
File created	C:\Windows\System\zouZfWG.exe	c61a7b6ad568db85a9246222ca01e5c0_NEIKI.exe
File created	C:\Windows\System\tXthMyr.exe	c61a7b6ad568db85a9246222ca01e5c0_NEIKI.exe
File created	C:\Windows\System\OmXDymV.exe	c61a7b6ad568db85a9246222ca01e5c0_NEIKI.exe
File created	C:\Windows\System\QDFXQCO.exe	c61a7b6ad568db85a9246222ca01e5c0_NEIKI.exe
File created	C:\Windows\System\FrJHIsx.exe	c61a7b6ad568db85a9246222ca01e5c0_NEIKI.exe
File created	C:\Windows\System\WVgzIeo.exe	c61a7b6ad568db85a9246222ca01e5c0_NEIKI.exe
File created	C:\Windows\System\dsaqXsB.exe	c61a7b6ad568db85a9246222ca01e5c0_NEIKI.exe
File created	C:\Windows\System\cairMKL.exe	c61a7b6ad568db85a9246222ca01e5c0_NEIKI.exe
File created	C:\Windows\System\dlJioIQ.exe	c61a7b6ad568db85a9246222ca01e5c0_NEIKI.exe
File created	C:\Windows\System\kWaEVEo.exe	c61a7b6ad568db85a9246222ca01e5c0_NEIKI.exe
File created	C:\Windows\System\vbvVIap.exe	c61a7b6ad568db85a9246222ca01e5c0_NEIKI.exe
File created	C:\Windows\System\DOtqbfm.exe	c61a7b6ad568db85a9246222ca01e5c0_NEIKI.exe
File created	C:\Windows\System\RuNFqFF.exe	c61a7b6ad568db85a9246222ca01e5c0_NEIKI.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2936	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2876	c61a7b6ad568db85a9246222ca01e5c0_NEIKI.exe
Token: SeLockMemoryPrivilege	2876	c61a7b6ad568db85a9246222ca01e5c0_NEIKI.exe
Token: SeDebugPrivilege	2936	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2876 wrote to memory of 2936	2876	c61a7b6ad568db85a9246222ca01e5c0_NEIKI.exe	29
PID 2876 wrote to memory of 2936	2876	c61a7b6ad568db85a9246222ca01e5c0_NEIKI.exe	29
PID 2876 wrote to memory of 2936	2876	c61a7b6ad568db85a9246222ca01e5c0_NEIKI.exe	29
PID 2876 wrote to memory of 3048	2876	c61a7b6ad568db85a9246222ca01e5c0_NEIKI.exe	30
PID 2876 wrote to memory of 3048	2876	c61a7b6ad568db85a9246222ca01e5c0_NEIKI.exe	30
PID 2876 wrote to memory of 3048	2876	c61a7b6ad568db85a9246222ca01e5c0_NEIKI.exe	30
PID 2876 wrote to memory of 2660	2876	c61a7b6ad568db85a9246222ca01e5c0_NEIKI.exe	31
PID 2876 wrote to memory of 2660	2876	c61a7b6ad568db85a9246222ca01e5c0_NEIKI.exe	31
PID 2876 wrote to memory of 2660	2876	c61a7b6ad568db85a9246222ca01e5c0_NEIKI.exe	31
PID 2876 wrote to memory of 2812	2876	c61a7b6ad568db85a9246222ca01e5c0_NEIKI.exe	32
PID 2876 wrote to memory of 2812	2876	c61a7b6ad568db85a9246222ca01e5c0_NEIKI.exe	32
PID 2876 wrote to memory of 2812	2876	c61a7b6ad568db85a9246222ca01e5c0_NEIKI.exe	32
PID 2876 wrote to memory of 2064	2876	c61a7b6ad568db85a9246222ca01e5c0_NEIKI.exe	33
PID 2876 wrote to memory of 2064	2876	c61a7b6ad568db85a9246222ca01e5c0_NEIKI.exe	33
PID 2876 wrote to memory of 2064	2876	c61a7b6ad568db85a9246222ca01e5c0_NEIKI.exe	33
PID 2876 wrote to memory of 2728	2876	c61a7b6ad568db85a9246222ca01e5c0_NEIKI.exe	34
PID 2876 wrote to memory of 2728	2876	c61a7b6ad568db85a9246222ca01e5c0_NEIKI.exe	34
PID 2876 wrote to memory of 2728	2876	c61a7b6ad568db85a9246222ca01e5c0_NEIKI.exe	34
PID 2876 wrote to memory of 2716	2876	c61a7b6ad568db85a9246222ca01e5c0_NEIKI.exe	35
PID 2876 wrote to memory of 2716	2876	c61a7b6ad568db85a9246222ca01e5c0_NEIKI.exe	35
PID 2876 wrote to memory of 2716	2876	c61a7b6ad568db85a9246222ca01e5c0_NEIKI.exe	35
PID 2876 wrote to memory of 2456	2876	c61a7b6ad568db85a9246222ca01e5c0_NEIKI.exe	36
PID 2876 wrote to memory of 2456	2876	c61a7b6ad568db85a9246222ca01e5c0_NEIKI.exe	36
PID 2876 wrote to memory of 2456	2876	c61a7b6ad568db85a9246222ca01e5c0_NEIKI.exe	36
PID 2876 wrote to memory of 2532	2876	c61a7b6ad568db85a9246222ca01e5c0_NEIKI.exe	37
PID 2876 wrote to memory of 2532	2876	c61a7b6ad568db85a9246222ca01e5c0_NEIKI.exe	37
PID 2876 wrote to memory of 2532	2876	c61a7b6ad568db85a9246222ca01e5c0_NEIKI.exe	37
PID 2876 wrote to memory of 2892	2876	c61a7b6ad568db85a9246222ca01e5c0_NEIKI.exe	38
PID 2876 wrote to memory of 2892	2876	c61a7b6ad568db85a9246222ca01e5c0_NEIKI.exe	38
PID 2876 wrote to memory of 2892	2876	c61a7b6ad568db85a9246222ca01e5c0_NEIKI.exe	38
PID 2876 wrote to memory of 1204	2876	c61a7b6ad568db85a9246222ca01e5c0_NEIKI.exe	39
PID 2876 wrote to memory of 1204	2876	c61a7b6ad568db85a9246222ca01e5c0_NEIKI.exe	39
PID 2876 wrote to memory of 1204	2876	c61a7b6ad568db85a9246222ca01e5c0_NEIKI.exe	39
PID 2876 wrote to memory of 296	2876	c61a7b6ad568db85a9246222ca01e5c0_NEIKI.exe	40
PID 2876 wrote to memory of 296	2876	c61a7b6ad568db85a9246222ca01e5c0_NEIKI.exe	40
PID 2876 wrote to memory of 296	2876	c61a7b6ad568db85a9246222ca01e5c0_NEIKI.exe	40
PID 2876 wrote to memory of 1456	2876	c61a7b6ad568db85a9246222ca01e5c0_NEIKI.exe	41
PID 2876 wrote to memory of 1456	2876	c61a7b6ad568db85a9246222ca01e5c0_NEIKI.exe	41
PID 2876 wrote to memory of 1456	2876	c61a7b6ad568db85a9246222ca01e5c0_NEIKI.exe	41
PID 2876 wrote to memory of 2756	2876	c61a7b6ad568db85a9246222ca01e5c0_NEIKI.exe	42
PID 2876 wrote to memory of 2756	2876	c61a7b6ad568db85a9246222ca01e5c0_NEIKI.exe	42
PID 2876 wrote to memory of 2756	2876	c61a7b6ad568db85a9246222ca01e5c0_NEIKI.exe	42
PID 2876 wrote to memory of 2776	2876	c61a7b6ad568db85a9246222ca01e5c0_NEIKI.exe	43
PID 2876 wrote to memory of 2776	2876	c61a7b6ad568db85a9246222ca01e5c0_NEIKI.exe	43
PID 2876 wrote to memory of 2776	2876	c61a7b6ad568db85a9246222ca01e5c0_NEIKI.exe	43
PID 2876 wrote to memory of 2872	2876	c61a7b6ad568db85a9246222ca01e5c0_NEIKI.exe	44
PID 2876 wrote to memory of 2872	2876	c61a7b6ad568db85a9246222ca01e5c0_NEIKI.exe	44
PID 2876 wrote to memory of 2872	2876	c61a7b6ad568db85a9246222ca01e5c0_NEIKI.exe	44
PID 2876 wrote to memory of 748	2876	c61a7b6ad568db85a9246222ca01e5c0_NEIKI.exe	45
PID 2876 wrote to memory of 748	2876	c61a7b6ad568db85a9246222ca01e5c0_NEIKI.exe	45
PID 2876 wrote to memory of 748	2876	c61a7b6ad568db85a9246222ca01e5c0_NEIKI.exe	45
PID 2876 wrote to memory of 1284	2876	c61a7b6ad568db85a9246222ca01e5c0_NEIKI.exe	46
PID 2876 wrote to memory of 1284	2876	c61a7b6ad568db85a9246222ca01e5c0_NEIKI.exe	46
PID 2876 wrote to memory of 1284	2876	c61a7b6ad568db85a9246222ca01e5c0_NEIKI.exe	46
PID 2876 wrote to memory of 2292	2876	c61a7b6ad568db85a9246222ca01e5c0_NEIKI.exe	47
PID 2876 wrote to memory of 2292	2876	c61a7b6ad568db85a9246222ca01e5c0_NEIKI.exe	47
PID 2876 wrote to memory of 2292	2876	c61a7b6ad568db85a9246222ca01e5c0_NEIKI.exe	47
PID 2876 wrote to memory of 2284	2876	c61a7b6ad568db85a9246222ca01e5c0_NEIKI.exe	48
PID 2876 wrote to memory of 2284	2876	c61a7b6ad568db85a9246222ca01e5c0_NEIKI.exe	48
PID 2876 wrote to memory of 2284	2876	c61a7b6ad568db85a9246222ca01e5c0_NEIKI.exe	48
PID 2876 wrote to memory of 2832	2876	c61a7b6ad568db85a9246222ca01e5c0_NEIKI.exe	49
PID 2876 wrote to memory of 2832	2876	c61a7b6ad568db85a9246222ca01e5c0_NEIKI.exe	49
PID 2876 wrote to memory of 2832	2876	c61a7b6ad568db85a9246222ca01e5c0_NEIKI.exe	49
PID 2876 wrote to memory of 1956	2876	c61a7b6ad568db85a9246222ca01e5c0_NEIKI.exe	50

C:\Users\Admin\AppData\Local\Temp\c61a7b6ad568db85a9246222ca01e5c0_NEIKI.exe
"C:\Users\Admin\AppData\Local\Temp\c61a7b6ad568db85a9246222ca01e5c0_NEIKI.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2876
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2936
- C:\Windows\System\CsutGkA.exe
  C:\Windows\System\CsutGkA.exe
  2⤵
  - Executes dropped EXE
  PID:3048
- C:\Windows\System\AufDvXz.exe
  C:\Windows\System\AufDvXz.exe
  2⤵
  - Executes dropped EXE
  PID:2660
- C:\Windows\System\MPxeQSy.exe
  C:\Windows\System\MPxeQSy.exe
  2⤵
  - Executes dropped EXE
  PID:2812
- C:\Windows\System\oPTckVY.exe
  C:\Windows\System\oPTckVY.exe
  2⤵
  - Executes dropped EXE
  PID:2064
- C:\Windows\System\UUWoVEx.exe
  C:\Windows\System\UUWoVEx.exe
  2⤵
  - Executes dropped EXE
  PID:2728
- C:\Windows\System\yvCMBtR.exe
  C:\Windows\System\yvCMBtR.exe
  2⤵
  - Executes dropped EXE
  PID:2716
- C:\Windows\System\PGoLVCZ.exe
  C:\Windows\System\PGoLVCZ.exe
  2⤵
  - Executes dropped EXE
  PID:2456
- C:\Windows\System\WmbaDoR.exe
  C:\Windows\System\WmbaDoR.exe
  2⤵
  - Executes dropped EXE
  PID:2532
- C:\Windows\System\HOoPwjR.exe
  C:\Windows\System\HOoPwjR.exe
  2⤵
  - Executes dropped EXE
  PID:2892
- C:\Windows\System\VRvHmQC.exe
  C:\Windows\System\VRvHmQC.exe
  2⤵
  - Executes dropped EXE
  PID:1204
- C:\Windows\System\gMGAVfG.exe
  C:\Windows\System\gMGAVfG.exe
  2⤵
  - Executes dropped EXE
  PID:296
- C:\Windows\System\YIpGmUH.exe
  C:\Windows\System\YIpGmUH.exe
  2⤵
  - Executes dropped EXE
  PID:1456
- C:\Windows\System\CrobDVm.exe
  C:\Windows\System\CrobDVm.exe
  2⤵
  - Executes dropped EXE
  PID:2756
- C:\Windows\System\BfAddNd.exe
  C:\Windows\System\BfAddNd.exe
  2⤵
  - Executes dropped EXE
  PID:2776
- C:\Windows\System\mQTvOUx.exe
  C:\Windows\System\mQTvOUx.exe
  2⤵
  - Executes dropped EXE
  PID:2872
- C:\Windows\System\SQACTLL.exe
  C:\Windows\System\SQACTLL.exe
  2⤵
  - Executes dropped EXE
  PID:748
- C:\Windows\System\ncsUdtO.exe
  C:\Windows\System\ncsUdtO.exe
  2⤵
  - Executes dropped EXE
  PID:1284
- C:\Windows\System\URevfTy.exe
  C:\Windows\System\URevfTy.exe
  2⤵
  - Executes dropped EXE
  PID:2292
- C:\Windows\System\lThjjVj.exe
  C:\Windows\System\lThjjVj.exe
  2⤵
  - Executes dropped EXE
  PID:2284
- C:\Windows\System\IHfWdfh.exe
  C:\Windows\System\IHfWdfh.exe
  2⤵
  - Executes dropped EXE
  PID:2832
- C:\Windows\System\inhxwdy.exe
  C:\Windows\System\inhxwdy.exe
  2⤵
  - Executes dropped EXE
  PID:1956
- C:\Windows\System\QlwnzXp.exe
  C:\Windows\System\QlwnzXp.exe
  2⤵
  - Executes dropped EXE
  PID:2828
- C:\Windows\System\eNTHYGO.exe
  C:\Windows\System\eNTHYGO.exe
  2⤵
  - Executes dropped EXE
  PID:2312
- C:\Windows\System\xILjVfM.exe
  C:\Windows\System\xILjVfM.exe
  2⤵
  - Executes dropped EXE
  PID:488
- C:\Windows\System\UAmwyhu.exe
  C:\Windows\System\UAmwyhu.exe
  2⤵
  - Executes dropped EXE
  PID:648
- C:\Windows\System\HCFBLmV.exe
  C:\Windows\System\HCFBLmV.exe
  2⤵
  - Executes dropped EXE
  PID:924
- C:\Windows\System\KCuTiUV.exe
  C:\Windows\System\KCuTiUV.exe
  2⤵
  - Executes dropped EXE
  PID:1512
- C:\Windows\System\elLTwFR.exe
  C:\Windows\System\elLTwFR.exe
  2⤵
  - Executes dropped EXE
  PID:784
- C:\Windows\System\JrcHJKW.exe
  C:\Windows\System\JrcHJKW.exe
  2⤵
  - Executes dropped EXE
  PID:696
- C:\Windows\System\YlyCUrk.exe
  C:\Windows\System\YlyCUrk.exe
  2⤵
  - Executes dropped EXE
  PID:2428
- C:\Windows\System\ZJeTGNO.exe
  C:\Windows\System\ZJeTGNO.exe
  2⤵
  - Executes dropped EXE
  PID:2176
- C:\Windows\System\adcrDXF.exe
  C:\Windows\System\adcrDXF.exe
  2⤵
  - Executes dropped EXE
  PID:1360
- C:\Windows\System\EPeRPax.exe
  C:\Windows\System\EPeRPax.exe
  2⤵
  - Executes dropped EXE
  PID:1352
- C:\Windows\System\CBDzQAG.exe
  C:\Windows\System\CBDzQAG.exe
  2⤵
  - Executes dropped EXE
  PID:944
- C:\Windows\System\jWWwRgj.exe
  C:\Windows\System\jWWwRgj.exe
  2⤵
  - Executes dropped EXE
  PID:764
- C:\Windows\System\oCVUQlA.exe
  C:\Windows\System\oCVUQlA.exe
  2⤵
  - Executes dropped EXE
  PID:1280
- C:\Windows\System\UXTHuut.exe
  C:\Windows\System\UXTHuut.exe
  2⤵
  - Executes dropped EXE
  PID:2092
- C:\Windows\System\PEwFGsg.exe
  C:\Windows\System\PEwFGsg.exe
  2⤵
  - Executes dropped EXE
  PID:1676
- C:\Windows\System\UuKokdA.exe
  C:\Windows\System\UuKokdA.exe
  2⤵
  - Executes dropped EXE
  PID:848
- C:\Windows\System\znyeFNi.exe
  C:\Windows\System\znyeFNi.exe
  2⤵
  - Executes dropped EXE
  PID:684
- C:\Windows\System\AoehvZP.exe
  C:\Windows\System\AoehvZP.exe
  2⤵
  - Executes dropped EXE
  PID:1268
- C:\Windows\System\tswFOOA.exe
  C:\Windows\System\tswFOOA.exe
  2⤵
  - Executes dropped EXE
  PID:1568
- C:\Windows\System\fOlfsGy.exe
  C:\Windows\System\fOlfsGy.exe
  2⤵
  - Executes dropped EXE
  PID:1752
- C:\Windows\System\OCLbdfC.exe
  C:\Windows\System\OCLbdfC.exe
  2⤵
  - Executes dropped EXE
  PID:604
- C:\Windows\System\wJCPksA.exe
  C:\Windows\System\wJCPksA.exe
  2⤵
  - Executes dropped EXE
  PID:544
- C:\Windows\System\RRLeOeF.exe
  C:\Windows\System\RRLeOeF.exe
  2⤵
  - Executes dropped EXE
  PID:2852
- C:\Windows\System\UOAoRtP.exe
  C:\Windows\System\UOAoRtP.exe
  2⤵
  - Executes dropped EXE
  PID:2004
- C:\Windows\System\EWSUHbh.exe
  C:\Windows\System\EWSUHbh.exe
  2⤵
  - Executes dropped EXE
  PID:1848
- C:\Windows\System\ZPkoHTi.exe
  C:\Windows\System\ZPkoHTi.exe
  2⤵
  - Executes dropped EXE
  PID:2544
- C:\Windows\System\LVBMrRL.exe
  C:\Windows\System\LVBMrRL.exe
  2⤵
  - Executes dropped EXE
  PID:2932
- C:\Windows\System\aDaoYgf.exe
  C:\Windows\System\aDaoYgf.exe
  2⤵
  - Executes dropped EXE
  PID:1624
- C:\Windows\System\djyQLUi.exe
  C:\Windows\System\djyQLUi.exe
  2⤵
  - Executes dropped EXE
  PID:2648
- C:\Windows\System\iHCzXMg.exe
  C:\Windows\System\iHCzXMg.exe
  2⤵
  - Executes dropped EXE
  PID:2700
- C:\Windows\System\VmOsZuT.exe
  C:\Windows\System\VmOsZuT.exe
  2⤵
  - Executes dropped EXE
  PID:2592
- C:\Windows\System\LoSJpTU.exe
  C:\Windows\System\LoSJpTU.exe
  2⤵
  - Executes dropped EXE
  PID:2788
- C:\Windows\System\SqVRKEk.exe
  C:\Windows\System\SqVRKEk.exe
  2⤵
  - Executes dropped EXE
  PID:2692
- C:\Windows\System\UKGDsAS.exe
  C:\Windows\System\UKGDsAS.exe
  2⤵
  - Executes dropped EXE
  PID:2492
- C:\Windows\System\KiMGjKU.exe
  C:\Windows\System\KiMGjKU.exe
  2⤵
  - Executes dropped EXE
  PID:2780
- C:\Windows\System\FhzsyEO.exe
  C:\Windows\System\FhzsyEO.exe
  2⤵
  - Executes dropped EXE
  PID:2500
- C:\Windows\System\yAzIsZN.exe
  C:\Windows\System\yAzIsZN.exe
  2⤵
  - Executes dropped EXE
  PID:908
- C:\Windows\System\dZhNsyr.exe
  C:\Windows\System\dZhNsyr.exe
  2⤵
  - Executes dropped EXE
  PID:2236
- C:\Windows\System\wxyRPWg.exe
  C:\Windows\System\wxyRPWg.exe
  2⤵
  PID:1052
- C:\Windows\System\jbwLiyr.exe
  C:\Windows\System\jbwLiyr.exe
  2⤵
  - Executes dropped EXE
  PID:3028
- C:\Windows\System\pJBZAJl.exe
  C:\Windows\System\pJBZAJl.exe
  2⤵
  PID:2680
- C:\Windows\System\IHfyPGF.exe
  C:\Windows\System\IHfyPGF.exe
  2⤵
  - Executes dropped EXE
  PID:2056
- C:\Windows\System\UKSPYvf.exe
  C:\Windows\System\UKSPYvf.exe
  2⤵
  PID:1560
- C:\Windows\System\lWObloe.exe
  C:\Windows\System\lWObloe.exe
  2⤵
  - Executes dropped EXE
  PID:2156
- C:\Windows\System\VadJbiw.exe
  C:\Windows\System\VadJbiw.exe
  2⤵
  PID:540
- C:\Windows\System\aJbOBsW.exe
  C:\Windows\System\aJbOBsW.exe
  2⤵
  PID:612
- C:\Windows\System\RurrGdf.exe
  C:\Windows\System\RurrGdf.exe
  2⤵
  PID:1032
- C:\Windows\System\VCobRYh.exe
  C:\Windows\System\VCobRYh.exe
  2⤵
  PID:1904
- C:\Windows\System\RIilvub.exe
  C:\Windows\System\RIilvub.exe
  2⤵
  PID:2424
- C:\Windows\System\vkSxSRy.exe
  C:\Windows\System\vkSxSRy.exe
  2⤵
  PID:1688
- C:\Windows\System\hNWGsMB.exe
  C:\Windows\System\hNWGsMB.exe
  2⤵
  PID:1776
- C:\Windows\System\sJHCLGY.exe
  C:\Windows\System\sJHCLGY.exe
  2⤵
  PID:2096
- C:\Windows\System\rMETgnP.exe
  C:\Windows\System\rMETgnP.exe
  2⤵
  PID:1668
- C:\Windows\System\yoANryw.exe
  C:\Windows\System\yoANryw.exe
  2⤵
  PID:876
- C:\Windows\System\exYQsdK.exe
  C:\Windows\System\exYQsdK.exe
  2⤵
  PID:896
- C:\Windows\System\BShfgMv.exe
  C:\Windows\System\BShfgMv.exe
  2⤵
  PID:1252
- C:\Windows\System\muJMRJG.exe
  C:\Windows\System\muJMRJG.exe
  2⤵
  PID:872
- C:\Windows\System\SxHTnqD.exe
  C:\Windows\System\SxHTnqD.exe
  2⤵
  PID:1616
- C:\Windows\System\QgeUDmN.exe
  C:\Windows\System\QgeUDmN.exe
  2⤵
  PID:3060
- C:\Windows\System\ICyABcs.exe
  C:\Windows\System\ICyABcs.exe
  2⤵
  PID:1964
- C:\Windows\System\xCOrOVU.exe
  C:\Windows\System\xCOrOVU.exe
  2⤵
  PID:2008
- C:\Windows\System\DOLrGfN.exe
  C:\Windows\System\DOLrGfN.exe
  2⤵
  PID:2752
- C:\Windows\System\FKrHUWL.exe
  C:\Windows\System\FKrHUWL.exe
  2⤵
  PID:2684
- C:\Windows\System\vxOFaXf.exe
  C:\Windows\System\vxOFaXf.exe
  2⤵
  PID:1244
- C:\Windows\System\LZvDYQN.exe
  C:\Windows\System\LZvDYQN.exe
  2⤵
  PID:2688
- C:\Windows\System\zpqFpvZ.exe
  C:\Windows\System\zpqFpvZ.exe
  2⤵
  PID:1588
- C:\Windows\System\QGObhaM.exe
  C:\Windows\System\QGObhaM.exe
  2⤵
  PID:1080
- C:\Windows\System\kXVLUDf.exe
  C:\Windows\System\kXVLUDf.exe
  2⤵
  PID:2484
- C:\Windows\System\EohiMne.exe
  C:\Windows\System\EohiMne.exe
  2⤵
  PID:2020
- C:\Windows\System\iHhiDxM.exe
  C:\Windows\System\iHhiDxM.exe
  2⤵
  PID:2248
- C:\Windows\System\ISifkSv.exe
  C:\Windows\System\ISifkSv.exe
  2⤵
  PID:2896
- C:\Windows\System\WJXLJjQ.exe
  C:\Windows\System\WJXLJjQ.exe
  2⤵
  PID:1376
- C:\Windows\System\mBVRbDS.exe
  C:\Windows\System\mBVRbDS.exe
  2⤵
  PID:1996
- C:\Windows\System\MDpufYh.exe
  C:\Windows\System\MDpufYh.exe
  2⤵
  PID:1636
- C:\Windows\System\AAZoRIW.exe
  C:\Windows\System\AAZoRIW.exe
  2⤵
  PID:2296
- C:\Windows\System\LIryHhX.exe
  C:\Windows\System\LIryHhX.exe
  2⤵
  PID:1232
- C:\Windows\System\jmjyVVD.exe
  C:\Windows\System\jmjyVVD.exe
  2⤵
  PID:1124
- C:\Windows\System\rNeEkEJ.exe
  C:\Windows\System\rNeEkEJ.exe
  2⤵
  PID:2396
- C:\Windows\System\olcMFES.exe
  C:\Windows\System\olcMFES.exe
  2⤵
  PID:824
- C:\Windows\System\uaGSpjl.exe
  C:\Windows\System\uaGSpjl.exe
  2⤵
  PID:1720
- C:\Windows\System\MpJGlHY.exe
  C:\Windows\System\MpJGlHY.exe
  2⤵
  PID:2900
- C:\Windows\System\tOMuNYu.exe
  C:\Windows\System\tOMuNYu.exe
  2⤵
  PID:2904
- C:\Windows\System\VRlEdgV.exe
  C:\Windows\System\VRlEdgV.exe
  2⤵
  PID:1736
- C:\Windows\System\kwMtEnr.exe
  C:\Windows\System\kwMtEnr.exe
  2⤵
  PID:1152
- C:\Windows\System\xiGCBnT.exe
  C:\Windows\System\xiGCBnT.exe
  2⤵
  PID:1820
- C:\Windows\System\TdCubxD.exe
  C:\Windows\System\TdCubxD.exe
  2⤵
  PID:2908
- C:\Windows\System\mfoPeKA.exe
  C:\Windows\System\mfoPeKA.exe
  2⤵
  PID:2140
- C:\Windows\System\tOpgaPN.exe
  C:\Windows\System\tOpgaPN.exe
  2⤵
  PID:1144
- C:\Windows\System\lUlRXGG.exe
  C:\Windows\System\lUlRXGG.exe
  2⤵
  PID:1564
- C:\Windows\System\uFlPYXP.exe
  C:\Windows\System\uFlPYXP.exe
  2⤵
  PID:3076
- C:\Windows\System\aahXjbP.exe
  C:\Windows\System\aahXjbP.exe
  2⤵
  PID:3092
- C:\Windows\System\kWSerDI.exe
  C:\Windows\System\kWSerDI.exe
  2⤵
  PID:3116
- C:\Windows\System\sMAdHFk.exe
  C:\Windows\System\sMAdHFk.exe
  2⤵
  PID:3132
- C:\Windows\System\QWhxbYS.exe
  C:\Windows\System\QWhxbYS.exe
  2⤵
  PID:3156
- C:\Windows\System\dlEMJEV.exe
  C:\Windows\System\dlEMJEV.exe
  2⤵
  PID:3176
- C:\Windows\System\IvNaIdb.exe
  C:\Windows\System\IvNaIdb.exe
  2⤵
  PID:3196
- C:\Windows\System\YqRaJNZ.exe
  C:\Windows\System\YqRaJNZ.exe
  2⤵
  PID:3212
- C:\Windows\System\nnHCgeL.exe
  C:\Windows\System\nnHCgeL.exe
  2⤵
  PID:3280
- C:\Windows\System\QSfXLcK.exe
  C:\Windows\System\QSfXLcK.exe
  2⤵
  PID:3296
- C:\Windows\System\kXUUOdo.exe
  C:\Windows\System\kXUUOdo.exe
  2⤵
  PID:3320
- C:\Windows\System\QiyRtUk.exe
  C:\Windows\System\QiyRtUk.exe
  2⤵
  PID:3336
- C:\Windows\System\pEuuulN.exe
  C:\Windows\System\pEuuulN.exe
  2⤵
  PID:3356
- C:\Windows\System\ISSUVWF.exe
  C:\Windows\System\ISSUVWF.exe
  2⤵
  PID:3372
- C:\Windows\System\SgfoIGy.exe
  C:\Windows\System\SgfoIGy.exe
  2⤵
  PID:3392
- C:\Windows\System\JpAWrmQ.exe
  C:\Windows\System\JpAWrmQ.exe
  2⤵
  PID:3408
- C:\Windows\System\ZpdbbCp.exe
  C:\Windows\System\ZpdbbCp.exe
  2⤵
  PID:3424
- C:\Windows\System\BAkZMbL.exe
  C:\Windows\System\BAkZMbL.exe
  2⤵
  PID:3444
- C:\Windows\System\oUfWTZD.exe
  C:\Windows\System\oUfWTZD.exe
  2⤵
  PID:3468
- C:\Windows\System\mYBkwdb.exe
  C:\Windows\System\mYBkwdb.exe
  2⤵
  PID:3484
- C:\Windows\System\GkwGEEo.exe
  C:\Windows\System\GkwGEEo.exe
  2⤵
  PID:3508
- C:\Windows\System\FpiKAHw.exe
  C:\Windows\System\FpiKAHw.exe
  2⤵
  PID:3524
- C:\Windows\System\bOhgAXM.exe
  C:\Windows\System\bOhgAXM.exe
  2⤵
  PID:3544
- C:\Windows\System\FdlSPMK.exe
  C:\Windows\System\FdlSPMK.exe
  2⤵
  PID:3560
- C:\Windows\System\gasUlZH.exe
  C:\Windows\System\gasUlZH.exe
  2⤵
  PID:3584
- C:\Windows\System\KTNkSUN.exe
  C:\Windows\System\KTNkSUN.exe
  2⤵
  PID:3600
- C:\Windows\System\rkQfKhA.exe
  C:\Windows\System\rkQfKhA.exe
  2⤵
  PID:3624
- C:\Windows\System\qQIAMzG.exe
  C:\Windows\System\qQIAMzG.exe
  2⤵
  PID:3640
- C:\Windows\System\MTkRCCk.exe
  C:\Windows\System\MTkRCCk.exe
  2⤵
  PID:3664
- C:\Windows\System\EjDvNGe.exe
  C:\Windows\System\EjDvNGe.exe
  2⤵
  PID:3680
- C:\Windows\System\ckxTRBA.exe
  C:\Windows\System\ckxTRBA.exe
  2⤵
  PID:3696
- C:\Windows\System\IJGsUKZ.exe
  C:\Windows\System\IJGsUKZ.exe
  2⤵
  PID:3712
- C:\Windows\System\hpXuboE.exe
  C:\Windows\System\hpXuboE.exe
  2⤵
  PID:3728
- C:\Windows\System\qAlwDBx.exe
  C:\Windows\System\qAlwDBx.exe
  2⤵
  PID:3744
- C:\Windows\System\OkFDEam.exe
  C:\Windows\System\OkFDEam.exe
  2⤵
  PID:3772
- C:\Windows\System\mNKQuwe.exe
  C:\Windows\System\mNKQuwe.exe
  2⤵
  PID:3820
- C:\Windows\System\KKLcfMO.exe
  C:\Windows\System\KKLcfMO.exe
  2⤵
  PID:3836
- C:\Windows\System\jTcTLGZ.exe
  C:\Windows\System\jTcTLGZ.exe
  2⤵
  PID:3860
- C:\Windows\System\sHiUiVo.exe
  C:\Windows\System\sHiUiVo.exe
  2⤵
  PID:3876
- C:\Windows\System\EsXurUX.exe
  C:\Windows\System\EsXurUX.exe
  2⤵
  PID:3896
- C:\Windows\System\DuYKiaL.exe
  C:\Windows\System\DuYKiaL.exe
  2⤵
  PID:3916
- C:\Windows\System\DXLnWKg.exe
  C:\Windows\System\DXLnWKg.exe
  2⤵
  PID:3932
- C:\Windows\System\MVIznaH.exe
  C:\Windows\System\MVIznaH.exe
  2⤵
  PID:3948
- C:\Windows\System\ujxBqPH.exe
  C:\Windows\System\ujxBqPH.exe
  2⤵
  PID:3964
- C:\Windows\System\dUlYOov.exe
  C:\Windows\System\dUlYOov.exe
  2⤵
  PID:3992
- C:\Windows\System\ETLMnXx.exe
  C:\Windows\System\ETLMnXx.exe
  2⤵
  PID:4008
- C:\Windows\System\jlwwSTS.exe
  C:\Windows\System\jlwwSTS.exe
  2⤵
  PID:4028
- C:\Windows\System\zyBGIOk.exe
  C:\Windows\System\zyBGIOk.exe
  2⤵
  PID:4044
- C:\Windows\System\jPNMKzR.exe
  C:\Windows\System\jPNMKzR.exe
  2⤵
  PID:4064
- C:\Windows\System\JFvPKLv.exe
  C:\Windows\System\JFvPKLv.exe
  2⤵
  PID:4084
- C:\Windows\System\pYwbRyk.exe
  C:\Windows\System\pYwbRyk.exe
  2⤵
  PID:1356
- C:\Windows\System\yzxJNvC.exe
  C:\Windows\System\yzxJNvC.exe
  2⤵
  PID:2512
- C:\Windows\System\kwBMqBZ.exe
  C:\Windows\System\kwBMqBZ.exe
  2⤵
  PID:1700
- C:\Windows\System\KGFPbFn.exe
  C:\Windows\System\KGFPbFn.exe
  2⤵
  PID:1960
- C:\Windows\System\ginxRbq.exe
  C:\Windows\System\ginxRbq.exe
  2⤵
  PID:1860
- C:\Windows\System\gQfNBhE.exe
  C:\Windows\System\gQfNBhE.exe
  2⤵
  PID:2116
- C:\Windows\System\NorruBA.exe
  C:\Windows\System\NorruBA.exe
  2⤵
  PID:3168
- C:\Windows\System\DXpVpSA.exe
  C:\Windows\System\DXpVpSA.exe
  2⤵
  PID:2596
- C:\Windows\System\IkOFVwJ.exe
  C:\Windows\System\IkOFVwJ.exe
  2⤵
  PID:2356
- C:\Windows\System\AhflGMX.exe
  C:\Windows\System\AhflGMX.exe
  2⤵
  PID:2940
- C:\Windows\System\ZLBsvFc.exe
  C:\Windows\System\ZLBsvFc.exe
  2⤵
  PID:3364
- C:\Windows\System\HpHRJIh.exe
  C:\Windows\System\HpHRJIh.exe
  2⤵
  PID:3404
- C:\Windows\System\SdbQFLN.exe
  C:\Windows\System\SdbQFLN.exe
  2⤵
  PID:2672
- C:\Windows\System\MlXpkhw.exe
  C:\Windows\System\MlXpkhw.exe
  2⤵
  PID:3520
- C:\Windows\System\APESfYw.exe
  C:\Windows\System\APESfYw.exe
  2⤵
  PID:3636
- C:\Windows\System\HFnISqD.exe
  C:\Windows\System\HFnISqD.exe
  2⤵
  PID:3708
- C:\Windows\System\puibBRj.exe
  C:\Windows\System\puibBRj.exe
  2⤵
  PID:2612
- C:\Windows\System\PMXeqXG.exe
  C:\Windows\System\PMXeqXG.exe
  2⤵
  PID:3100
- C:\Windows\System\hnXZDDN.exe
  C:\Windows\System\hnXZDDN.exe
  2⤵
  PID:3148
- C:\Windows\System\gIfMDPH.exe
  C:\Windows\System\gIfMDPH.exe
  2⤵
  PID:3220
- C:\Windows\System\imlHlES.exe
  C:\Windows\System\imlHlES.exe
  2⤵
  PID:3248
- C:\Windows\System\kAkKshs.exe
  C:\Windows\System\kAkKshs.exe
  2⤵
  PID:3316
- C:\Windows\System\KUhhGju.exe
  C:\Windows\System\KUhhGju.exe
  2⤵
  PID:3784
- C:\Windows\System\sUNjXhV.exe
  C:\Windows\System\sUNjXhV.exe
  2⤵
  PID:3420
- C:\Windows\System\BpEHTJq.exe
  C:\Windows\System\BpEHTJq.exe
  2⤵
  PID:3464
- C:\Windows\System\fNaWsYK.exe
  C:\Windows\System\fNaWsYK.exe
  2⤵
  PID:3500
- C:\Windows\System\TkOldch.exe
  C:\Windows\System\TkOldch.exe
  2⤵
  PID:3800
- C:\Windows\System\cvcoRvB.exe
  C:\Windows\System\cvcoRvB.exe
  2⤵
  PID:3804
- C:\Windows\System\VSbVIhv.exe
  C:\Windows\System\VSbVIhv.exe
  2⤵
  PID:3620
- C:\Windows\System\YXByODQ.exe
  C:\Windows\System\YXByODQ.exe
  2⤵
  PID:3692
- C:\Windows\System\LTDSMkl.exe
  C:\Windows\System\LTDSMkl.exe
  2⤵
  PID:3720
- C:\Windows\System\wDSeJaZ.exe
  C:\Windows\System\wDSeJaZ.exe
  2⤵
  PID:3760
- C:\Windows\System\ZqMwNmw.exe
  C:\Windows\System\ZqMwNmw.exe
  2⤵
  PID:3608
- C:\Windows\System\rGGuDCB.exe
  C:\Windows\System\rGGuDCB.exe
  2⤵
  PID:3928
- C:\Windows\System\QAUdQPX.exe
  C:\Windows\System\QAUdQPX.exe
  2⤵
  PID:4004
- C:\Windows\System\AgJhlzx.exe
  C:\Windows\System\AgJhlzx.exe
  2⤵
  PID:3904
- C:\Windows\System\CaelMEK.exe
  C:\Windows\System\CaelMEK.exe
  2⤵
  PID:4072
- C:\Windows\System\YbTCvpm.exe
  C:\Windows\System\YbTCvpm.exe
  2⤵
  PID:3980
- C:\Windows\System\IQAALXe.exe
  C:\Windows\System\IQAALXe.exe
  2⤵
  PID:4020
- C:\Windows\System\FevEonK.exe
  C:\Windows\System\FevEonK.exe
  2⤵
  PID:4052
- C:\Windows\System\goAqcAs.exe
  C:\Windows\System\goAqcAs.exe
  2⤵
  PID:3940
- C:\Windows\System\WHCJfto.exe
  C:\Windows\System\WHCJfto.exe
  2⤵
  PID:940
- C:\Windows\System\hYSkuuV.exe
  C:\Windows\System\hYSkuuV.exe
  2⤵
  PID:3088
- C:\Windows\System\ZZefBNl.exe
  C:\Windows\System\ZZefBNl.exe
  2⤵
  PID:380
- C:\Windows\System\HdtbjQE.exe
  C:\Windows\System\HdtbjQE.exe
  2⤵
  PID:3400
- C:\Windows\System\ovdHfbW.exe
  C:\Windows\System\ovdHfbW.exe
  2⤵
  PID:1664
- C:\Windows\System\tFYlFYB.exe
  C:\Windows\System\tFYlFYB.exe
  2⤵
  PID:3128
- C:\Windows\System\ZevXizW.exe
  C:\Windows\System\ZevXizW.exe
  2⤵
  PID:240
- C:\Windows\System\OTsNvYt.exe
  C:\Windows\System\OTsNvYt.exe
  2⤵
  PID:3676
- C:\Windows\System\LjDSzJj.exe
  C:\Windows\System\LjDSzJj.exe
  2⤵
  PID:3632
- C:\Windows\System\gLnAxtj.exe
  C:\Windows\System\gLnAxtj.exe
  2⤵
  PID:3276
- C:\Windows\System\oAhfkYC.exe
  C:\Windows\System\oAhfkYC.exe
  2⤵
  PID:2744
- C:\Windows\System\xiXXQeQ.exe
  C:\Windows\System\xiXXQeQ.exe
  2⤵
  PID:3576
- C:\Windows\System\UIRbesH.exe
  C:\Windows\System\UIRbesH.exe
  2⤵
  PID:3656
- C:\Windows\System\eSzcpHY.exe
  C:\Windows\System\eSzcpHY.exe
  2⤵
  PID:2888
- C:\Windows\System\wVezYFW.exe
  C:\Windows\System\wVezYFW.exe
  2⤵
  PID:3344
- C:\Windows\System\rEJFesE.exe
  C:\Windows\System\rEJFesE.exe
  2⤵
  PID:3568
- C:\Windows\System\FZBlGIX.exe
  C:\Windows\System\FZBlGIX.exe
  2⤵
  PID:3868
- C:\Windows\System\qHAtgfL.exe
  C:\Windows\System\qHAtgfL.exe
  2⤵
  PID:1612
- C:\Windows\System\krejZdO.exe
  C:\Windows\System\krejZdO.exe
  2⤵
  PID:2088
- C:\Windows\System\MgXaJAv.exe
  C:\Windows\System\MgXaJAv.exe
  2⤵
  PID:2432
- C:\Windows\System\fkoqBBv.exe
  C:\Windows\System\fkoqBBv.exe
  2⤵
  PID:2624
- C:\Windows\System\PzXfCHk.exe
  C:\Windows\System\PzXfCHk.exe
  2⤵
  PID:3612
- C:\Windows\System\bXkdLKp.exe
  C:\Windows\System\bXkdLKp.exe
  2⤵
  PID:3460
- C:\Windows\System\xCrHXnf.exe
  C:\Windows\System\xCrHXnf.exe
  2⤵
  PID:3812
- C:\Windows\System\lPgAkyg.exe
  C:\Windows\System\lPgAkyg.exe
  2⤵
  PID:3768
- C:\Windows\System\DVGiUaX.exe
  C:\Windows\System\DVGiUaX.exe
  2⤵
  PID:3960
- C:\Windows\System\MfmzSLK.exe
  C:\Windows\System\MfmzSLK.exe
  2⤵
  PID:2184
- C:\Windows\System\zZuFmBJ.exe
  C:\Windows\System\zZuFmBJ.exe
  2⤵
  PID:336
- C:\Windows\System\dRdSJSM.exe
  C:\Windows\System\dRdSJSM.exe
  2⤵
  PID:2072
- C:\Windows\System\hCzhsDN.exe
  C:\Windows\System\hCzhsDN.exe
  2⤵
  PID:3068
- C:\Windows\System\UHhtpjg.exe
  C:\Windows\System\UHhtpjg.exe
  2⤵
  PID:3596
- C:\Windows\System\GNsXZsl.exe
  C:\Windows\System\GNsXZsl.exe
  2⤵
  PID:2676
- C:\Windows\System\jZlhCXf.exe
  C:\Windows\System\jZlhCXf.exe
  2⤵
  PID:3652
- C:\Windows\System\puPkzsh.exe
  C:\Windows\System\puPkzsh.exe
  2⤵
  PID:2628
- C:\Windows\System\NyDTmYC.exe
  C:\Windows\System\NyDTmYC.exe
  2⤵
  PID:3244
- C:\Windows\System\DUrNPwx.exe
  C:\Windows\System\DUrNPwx.exe
  2⤵
  PID:360
- C:\Windows\System\xbsjlUn.exe
  C:\Windows\System\xbsjlUn.exe
  2⤵
  PID:2384
- C:\Windows\System\hZPmgjr.exe
  C:\Windows\System\hZPmgjr.exe
  2⤵
  PID:3140
- C:\Windows\System\mSJwucN.exe
  C:\Windows\System\mSJwucN.exe
  2⤵
  PID:4040
- C:\Windows\System\swkKcCj.exe
  C:\Windows\System\swkKcCj.exe
  2⤵
  PID:3016
- C:\Windows\System\SMOBamu.exe
  C:\Windows\System\SMOBamu.exe
  2⤵
  PID:3892
- C:\Windows\System\kOEUTiR.exe
  C:\Windows\System\kOEUTiR.exe
  2⤵
  PID:4076
- C:\Windows\System\siPVTUT.exe
  C:\Windows\System\siPVTUT.exe
  2⤵
  PID:3384
- C:\Windows\System\vYntYZb.exe
  C:\Windows\System\vYntYZb.exe
  2⤵
  PID:2408
- C:\Windows\System\ybSNnNo.exe
  C:\Windows\System\ybSNnNo.exe
  2⤵
  PID:3736
- C:\Windows\System\ecBemIp.exe
  C:\Windows\System\ecBemIp.exe
  2⤵
  PID:3416
- C:\Windows\System\ufaCjvt.exe
  C:\Windows\System\ufaCjvt.exe
  2⤵
  PID:3532
- C:\Windows\System\JafUvKS.exe
  C:\Windows\System\JafUvKS.exe
  2⤵
  PID:3440
- C:\Windows\System\VbfolaM.exe
  C:\Windows\System\VbfolaM.exe
  2⤵
  PID:2504
- C:\Windows\System\rqRjkiO.exe
  C:\Windows\System\rqRjkiO.exe
  2⤵
  PID:3972
- C:\Windows\System\FfDgLCH.exe
  C:\Windows\System\FfDgLCH.exe
  2⤵
  PID:1240
- C:\Windows\System\wDFbuxL.exe
  C:\Windows\System\wDFbuxL.exe
  2⤵
  PID:2708
- C:\Windows\System\wemNBQG.exe
  C:\Windows\System\wemNBQG.exe
  2⤵
  PID:3184
- C:\Windows\System\QIzEkTP.exe
  C:\Windows\System\QIzEkTP.exe
  2⤵
  PID:3756
- C:\Windows\System\OMLiilU.exe
  C:\Windows\System\OMLiilU.exe
  2⤵
  PID:4116
- C:\Windows\System\tjzRPGz.exe
  C:\Windows\System\tjzRPGz.exe
  2⤵
  PID:4140
- C:\Windows\System\koMyAka.exe
  C:\Windows\System\koMyAka.exe
  2⤵
  PID:4156
- C:\Windows\System\saXjEuU.exe
  C:\Windows\System\saXjEuU.exe
  2⤵
  PID:4176
- C:\Windows\System\wLRpEBM.exe
  C:\Windows\System\wLRpEBM.exe
  2⤵
  PID:4200
- C:\Windows\System\sxpXHWn.exe
  C:\Windows\System\sxpXHWn.exe
  2⤵
  PID:4216
- C:\Windows\System\wOUwgaz.exe
  C:\Windows\System\wOUwgaz.exe
  2⤵
  PID:4232
- C:\Windows\System\cNBIbCF.exe
  C:\Windows\System\cNBIbCF.exe
  2⤵
  PID:4256
- C:\Windows\System\fPfviyl.exe
  C:\Windows\System\fPfviyl.exe
  2⤵
  PID:4272
- C:\Windows\System\GWjsHyO.exe
  C:\Windows\System\GWjsHyO.exe
  2⤵
  PID:4292
- C:\Windows\System\NmkMHFl.exe
  C:\Windows\System\NmkMHFl.exe
  2⤵
  PID:4316
- C:\Windows\System\EmgNZRr.exe
  C:\Windows\System\EmgNZRr.exe
  2⤵
  PID:4332
- C:\Windows\System\LauEvhg.exe
  C:\Windows\System\LauEvhg.exe
  2⤵
  PID:4348
- C:\Windows\System\zujdMYg.exe
  C:\Windows\System\zujdMYg.exe
  2⤵
  PID:4364
- C:\Windows\System\WCUUmUw.exe
  C:\Windows\System\WCUUmUw.exe
  2⤵
  PID:4380
- C:\Windows\System\QceNFSc.exe
  C:\Windows\System\QceNFSc.exe
  2⤵
  PID:4408
- C:\Windows\System\AJZkGQY.exe
  C:\Windows\System\AJZkGQY.exe
  2⤵
  PID:4428
- C:\Windows\System\UwSOKZl.exe
  C:\Windows\System\UwSOKZl.exe
  2⤵
  PID:4448
- C:\Windows\System\QIVlzzf.exe
  C:\Windows\System\QIVlzzf.exe
  2⤵
  PID:4464
- C:\Windows\System\cTyKbue.exe
  C:\Windows\System\cTyKbue.exe
  2⤵
  PID:4480
- C:\Windows\System\GMEFLki.exe
  C:\Windows\System\GMEFLki.exe
  2⤵
  PID:4496
- C:\Windows\System\XQdDUPL.exe
  C:\Windows\System\XQdDUPL.exe
  2⤵
  PID:4512
- C:\Windows\System\ZqnvFsr.exe
  C:\Windows\System\ZqnvFsr.exe
  2⤵
  PID:4528
- C:\Windows\System\FbrmSqR.exe
  C:\Windows\System\FbrmSqR.exe
  2⤵
  PID:4544
- C:\Windows\System\vSBcLIt.exe
  C:\Windows\System\vSBcLIt.exe
  2⤵
  PID:4560
- C:\Windows\System\fuGBYCa.exe
  C:\Windows\System\fuGBYCa.exe
  2⤵
  PID:4576
- C:\Windows\System\TbjFkLN.exe
  C:\Windows\System\TbjFkLN.exe
  2⤵
  PID:4592
- C:\Windows\System\JMjMbFJ.exe
  C:\Windows\System\JMjMbFJ.exe
  2⤵
  PID:4608
- C:\Windows\System\dbpRYAj.exe
  C:\Windows\System\dbpRYAj.exe
  2⤵
  PID:4624
- C:\Windows\System\ZHTJnjn.exe
  C:\Windows\System\ZHTJnjn.exe
  2⤵
  PID:4696
- C:\Windows\System\Itjourz.exe
  C:\Windows\System\Itjourz.exe
  2⤵
  PID:4712
- C:\Windows\System\HTBGhpO.exe
  C:\Windows\System\HTBGhpO.exe
  2⤵
  PID:4732
- C:\Windows\System\cHZOsFl.exe
  C:\Windows\System\cHZOsFl.exe
  2⤵
  PID:4756
- C:\Windows\System\klGRJYq.exe
  C:\Windows\System\klGRJYq.exe
  2⤵
  PID:4776
- C:\Windows\System\cmpMIXp.exe
  C:\Windows\System\cmpMIXp.exe
  2⤵
  PID:4792
- C:\Windows\System\ccrjuGm.exe
  C:\Windows\System\ccrjuGm.exe
  2⤵
  PID:4812
- C:\Windows\System\JjFQkHt.exe
  C:\Windows\System\JjFQkHt.exe
  2⤵
  PID:4828
- C:\Windows\System\NhdlmEk.exe
  C:\Windows\System\NhdlmEk.exe
  2⤵
  PID:4848
- C:\Windows\System\tzpCmCK.exe
  C:\Windows\System\tzpCmCK.exe
  2⤵
  PID:4872
- C:\Windows\System\evAUJLV.exe
  C:\Windows\System\evAUJLV.exe
  2⤵
  PID:4888
- C:\Windows\System\SlvvWEp.exe
  C:\Windows\System\SlvvWEp.exe
  2⤵
  PID:4904
- C:\Windows\System\mjQNKAR.exe
  C:\Windows\System\mjQNKAR.exe
  2⤵
  PID:4920
- C:\Windows\System\rrMikPx.exe
  C:\Windows\System\rrMikPx.exe
  2⤵
  PID:4936
- C:\Windows\System\GbgHuME.exe
  C:\Windows\System\GbgHuME.exe
  2⤵
  PID:4952
- C:\Windows\System\qDoOoFS.exe
  C:\Windows\System\qDoOoFS.exe
  2⤵
  PID:4972
- C:\Windows\System\BrLfPwA.exe
  C:\Windows\System\BrLfPwA.exe
  2⤵
  PID:4992
- C:\Windows\System\kzQAaiw.exe
  C:\Windows\System\kzQAaiw.exe
  2⤵
  PID:5020
- C:\Windows\System\XywyMMq.exe
  C:\Windows\System\XywyMMq.exe
  2⤵
  PID:5036
- C:\Windows\System\LoCnCtk.exe
  C:\Windows\System\LoCnCtk.exe
  2⤵
  PID:5052
- C:\Windows\System\NESEPgz.exe
  C:\Windows\System\NESEPgz.exe
  2⤵
  PID:5068
- C:\Windows\System\xAvEtMW.exe
  C:\Windows\System\xAvEtMW.exe
  2⤵
  PID:5100
- C:\Windows\System\sygivIy.exe
  C:\Windows\System\sygivIy.exe
  2⤵
  PID:5116
- C:\Windows\System\AUcLtjz.exe
  C:\Windows\System\AUcLtjz.exe
  2⤵
  PID:4092
- C:\Windows\System\JaaLFIw.exe
  C:\Windows\System\JaaLFIw.exe
  2⤵
  PID:2328
- C:\Windows\System\fjEqytc.exe
  C:\Windows\System\fjEqytc.exe
  2⤵
  PID:1864
- C:\Windows\System\ZcpaMcr.exe
  C:\Windows\System\ZcpaMcr.exe
  2⤵
  PID:3848
- C:\Windows\System\KwCfTnC.exe
  C:\Windows\System\KwCfTnC.exe
  2⤵
  PID:568
- C:\Windows\System\aEBEkSq.exe
  C:\Windows\System\aEBEkSq.exe
  2⤵
  PID:3752
- C:\Windows\System\shpzQyc.exe
  C:\Windows\System\shpzQyc.exe
  2⤵
  PID:3516
- C:\Windows\System\thjwaYM.exe
  C:\Windows\System\thjwaYM.exe
  2⤵
  PID:4188
- C:\Windows\System\BPjlzPN.exe
  C:\Windows\System\BPjlzPN.exe
  2⤵
  PID:2912
- C:\Windows\System\vzPuGuz.exe
  C:\Windows\System\vzPuGuz.exe
  2⤵
  PID:4300
- C:\Windows\System\vIqbwMl.exe
  C:\Windows\System\vIqbwMl.exe
  2⤵
  PID:4212
- C:\Windows\System\SagEeEB.exe
  C:\Windows\System\SagEeEB.exe
  2⤵
  PID:4416
- C:\Windows\System\RjeILDQ.exe
  C:\Windows\System\RjeILDQ.exe
  2⤵
  PID:4488
- C:\Windows\System\uRNNxvb.exe
  C:\Windows\System\uRNNxvb.exe
  2⤵
  PID:4616
- C:\Windows\System\yyXaLLP.exe
  C:\Windows\System\yyXaLLP.exe
  2⤵
  PID:4284
- C:\Windows\System\TuBfoIl.exe
  C:\Windows\System\TuBfoIl.exe
  2⤵
  PID:4400
- C:\Windows\System\UUXSAIu.exe
  C:\Windows\System\UUXSAIu.exe
  2⤵
  PID:4536
- C:\Windows\System\Xsdmsyn.exe
  C:\Windows\System\Xsdmsyn.exe
  2⤵
  PID:4600
- C:\Windows\System\TLIVMWB.exe
  C:\Windows\System\TLIVMWB.exe
  2⤵
  PID:4740
- C:\Windows\System\luXtgTH.exe
  C:\Windows\System\luXtgTH.exe
  2⤵
  PID:4644
- C:\Windows\System\WGjpItk.exe
  C:\Windows\System\WGjpItk.exe
  2⤵
  PID:2076
- C:\Windows\System\vRZVqMR.exe
  C:\Windows\System\vRZVqMR.exe
  2⤵
  PID:4660
- C:\Windows\System\lZsvWCZ.exe
  C:\Windows\System\lZsvWCZ.exe
  2⤵
  PID:4476
- C:\Windows\System\takCtkT.exe
  C:\Windows\System\takCtkT.exe
  2⤵
  PID:4392
- C:\Windows\System\kWfxDHt.exe
  C:\Windows\System\kWfxDHt.exe
  2⤵
  PID:4692
- C:\Windows\System\qfmHveu.exe
  C:\Windows\System\qfmHveu.exe
  2⤵
  PID:4800
- C:\Windows\System\zKiRdgn.exe
  C:\Windows\System\zKiRdgn.exe
  2⤵
  PID:4856
- C:\Windows\System\EnZCotm.exe
  C:\Windows\System\EnZCotm.exe
  2⤵
  PID:2524
- C:\Windows\System\UeNoWij.exe
  C:\Windows\System\UeNoWij.exe
  2⤵
  PID:4960
- C:\Windows\System\YPPRxWW.exe
  C:\Windows\System\YPPRxWW.exe
  2⤵
  PID:5000
- C:\Windows\System\NWFoRXr.exe
  C:\Windows\System\NWFoRXr.exe
  2⤵
  PID:5044
- C:\Windows\System\KDQrtuR.exe
  C:\Windows\System\KDQrtuR.exe
  2⤵
  PID:4772
- C:\Windows\System\EMUbxlm.exe
  C:\Windows\System\EMUbxlm.exe
  2⤵
  PID:4980
- C:\Windows\System\EmVMDrp.exe
  C:\Windows\System\EmVMDrp.exe
  2⤵
  PID:5084
- C:\Windows\System\ECEShzc.exe
  C:\Windows\System\ECEShzc.exe
  2⤵
  PID:4056
- C:\Windows\System\ZiYlVWA.exe
  C:\Windows\System\ZiYlVWA.exe
  2⤵
  PID:2820
- C:\Windows\System\QgyNVvM.exe
  C:\Windows\System\QgyNVvM.exe
  2⤵
  PID:4148
- C:\Windows\System\KpicnMV.exe
  C:\Windows\System\KpicnMV.exe
  2⤵
  PID:4268
- C:\Windows\System\ipaCljv.exe
  C:\Windows\System\ipaCljv.exe
  2⤵
  PID:4340
- C:\Windows\System\HyoSarD.exe
  C:\Windows\System\HyoSarD.exe
  2⤵
  PID:4456
- C:\Windows\System\uTehdOK.exe
  C:\Windows\System\uTehdOK.exe
  2⤵
  PID:4208
- C:\Windows\System\SpAoSPT.exe
  C:\Windows\System\SpAoSPT.exe
  2⤵
  PID:5060
- C:\Windows\System\AToNTVM.exe
  C:\Windows\System\AToNTVM.exe
  2⤵
  PID:3884
- C:\Windows\System\mKRqaZf.exe
  C:\Windows\System\mKRqaZf.exe
  2⤵
  PID:4108
- C:\Windows\System\iAUGtfy.exe
  C:\Windows\System\iAUGtfy.exe
  2⤵
  PID:4192
- C:\Windows\System\QmkJbvz.exe
  C:\Windows\System\QmkJbvz.exe
  2⤵
  PID:1692
- C:\Windows\System\cibQSBp.exe
  C:\Windows\System\cibQSBp.exe
  2⤵
  PID:4784
- C:\Windows\System\EIOegHS.exe
  C:\Windows\System\EIOegHS.exe
  2⤵
  PID:4356
- C:\Windows\System\bDFRYJv.exe
  C:\Windows\System\bDFRYJv.exe
  2⤵
  PID:5032
- C:\Windows\System\gvKacJu.exe
  C:\Windows\System\gvKacJu.exe
  2⤵
  PID:4524
- C:\Windows\System\rDhoKHU.exe
  C:\Windows\System\rDhoKHU.exe
  2⤵
  PID:4680
- C:\Windows\System\KXLrYJp.exe
  C:\Windows\System\KXLrYJp.exe
  2⤵
  PID:2080
- C:\Windows\System\XFAQqIX.exe
  C:\Windows\System\XFAQqIX.exe
  2⤵
  PID:2216
- C:\Windows\System\EkYArYb.exe
  C:\Windows\System\EkYArYb.exe
  2⤵
  PID:4724
- C:\Windows\System\bygfbZL.exe
  C:\Windows\System\bygfbZL.exe
  2⤵
  PID:4916
- C:\Windows\System\uikhKjw.exe
  C:\Windows\System\uikhKjw.exe
  2⤵
  PID:2180
- C:\Windows\System\gsyNxoZ.exe
  C:\Windows\System\gsyNxoZ.exe
  2⤵
  PID:4572
- C:\Windows\System\CRwVdIG.exe
  C:\Windows\System\CRwVdIG.exe
  2⤵
  PID:4436
- C:\Windows\System\SkAHfUq.exe
  C:\Windows\System\SkAHfUq.exe
  2⤵
  PID:2304
- C:\Windows\System\xPanJWA.exe
  C:\Windows\System\xPanJWA.exe
  2⤵
  PID:2372
- C:\Windows\System\aUmQmuH.exe
  C:\Windows\System\aUmQmuH.exe
  2⤵
  PID:2128
- C:\Windows\System\IRzQLYN.exe
  C:\Windows\System\IRzQLYN.exe
  2⤵
  PID:5088
- C:\Windows\System\NjBzmrV.exe
  C:\Windows\System\NjBzmrV.exe
  2⤵
  PID:4264
- C:\Windows\System\bfkKzrQ.exe
  C:\Windows\System\bfkKzrQ.exe
  2⤵
  PID:4880
- C:\Windows\System\oavJere.exe
  C:\Windows\System\oavJere.exe
  2⤵
  PID:5028
- C:\Windows\System\eEWSVAP.exe
  C:\Windows\System\eEWSVAP.exe
  2⤵
  PID:4708
- C:\Windows\System\JOkSeEK.exe
  C:\Windows\System\JOkSeEK.exe
  2⤵
  PID:1804
- C:\Windows\System\JEDgBJE.exe
  C:\Windows\System\JEDgBJE.exe
  2⤵
  PID:4252
- C:\Windows\System\QvpegYU.exe
  C:\Windows\System\QvpegYU.exe
  2⤵
  PID:4840
- C:\Windows\System\uIPKhBM.exe
  C:\Windows\System\uIPKhBM.exe
  2⤵
  PID:4744
- C:\Windows\System\CypGOzX.exe
  C:\Windows\System\CypGOzX.exe
  2⤵
  PID:4168
- C:\Windows\System\CvkzdOr.exe
  C:\Windows\System\CvkzdOr.exe
  2⤵
  PID:3232
- C:\Windows\System\Gqtvexu.exe
  C:\Windows\System\Gqtvexu.exe
  2⤵
  PID:5112
- C:\Windows\System\LsPllqK.exe
  C:\Windows\System\LsPllqK.exe
  2⤵
  PID:4376
- C:\Windows\System\sSdjjoR.exe
  C:\Windows\System\sSdjjoR.exe
  2⤵
  PID:4584
- C:\Windows\System\YWiQODZ.exe
  C:\Windows\System\YWiQODZ.exe
  2⤵
  PID:2488
- C:\Windows\System\DDhBQNt.exe
  C:\Windows\System\DDhBQNt.exe
  2⤵
  PID:4808
- C:\Windows\System\CVbrvKN.exe
  C:\Windows\System\CVbrvKN.exe
  2⤵
  PID:4688
- C:\Windows\System\XfrnJtO.exe
  C:\Windows\System\XfrnJtO.exe
  2⤵
  PID:5076
- C:\Windows\System\ffSuYGv.exe
  C:\Windows\System\ffSuYGv.exe
  2⤵
  PID:4324
- C:\Windows\System\ImtgzYg.exe
  C:\Windows\System\ImtgzYg.exe
  2⤵
  PID:4864
- C:\Windows\System\JWSlTgL.exe
  C:\Windows\System\JWSlTgL.exe
  2⤵
  PID:4652
- C:\Windows\System\kSQNsjc.exe
  C:\Windows\System\kSQNsjc.exe
  2⤵
  PID:4884
- C:\Windows\System\KPSOEBP.exe
  C:\Windows\System\KPSOEBP.exe
  2⤵
  PID:4588
- C:\Windows\System\YWGJvfx.exe
  C:\Windows\System\YWGJvfx.exe
  2⤵
  PID:692
- C:\Windows\System\HSigJlJ.exe
  C:\Windows\System\HSigJlJ.exe
  2⤵
  PID:3832
- C:\Windows\System\VHAevYU.exe
  C:\Windows\System\VHAevYU.exe
  2⤵
  PID:1788
- C:\Windows\System\oMoFdPH.exe
  C:\Windows\System\oMoFdPH.exe
  2⤵
  PID:5016
- C:\Windows\System\OPivlfO.exe
  C:\Windows\System\OPivlfO.exe
  2⤵
  PID:2468
- C:\Windows\System\NXmJQeI.exe
  C:\Windows\System\NXmJQeI.exe
  2⤵
  PID:4948
- C:\Windows\System\NtnzADv.exe
  C:\Windows\System\NtnzADv.exe
  2⤵
  PID:5128
- C:\Windows\System\ACOnEeQ.exe
  C:\Windows\System\ACOnEeQ.exe
  2⤵
  PID:5144
- C:\Windows\System\CZRqmbQ.exe
  C:\Windows\System\CZRqmbQ.exe
  2⤵
  PID:5164
- C:\Windows\System\aHYbQTV.exe
  C:\Windows\System\aHYbQTV.exe
  2⤵
  PID:5180
- C:\Windows\System\jLRMFRF.exe
  C:\Windows\System\jLRMFRF.exe
  2⤵
  PID:5196
- C:\Windows\System\iypqvCe.exe
  C:\Windows\System\iypqvCe.exe
  2⤵
  PID:5212
- C:\Windows\System\OHFikIo.exe
  C:\Windows\System\OHFikIo.exe
  2⤵
  PID:5236
- C:\Windows\System\uvZtzMS.exe
  C:\Windows\System\uvZtzMS.exe
  2⤵
  PID:5252
- C:\Windows\System\NzQbwKT.exe
  C:\Windows\System\NzQbwKT.exe
  2⤵
  PID:5268
- C:\Windows\System\heutrIP.exe
  C:\Windows\System\heutrIP.exe
  2⤵
  PID:5284
- C:\Windows\System\fTPQzVl.exe
  C:\Windows\System\fTPQzVl.exe
  2⤵
  PID:5300
- C:\Windows\System\qlIiiJK.exe
  C:\Windows\System\qlIiiJK.exe
  2⤵
  PID:5316
- C:\Windows\System\ZCWALus.exe
  C:\Windows\System\ZCWALus.exe
  2⤵
  PID:5332
- C:\Windows\System\yOJihxn.exe
  C:\Windows\System\yOJihxn.exe
  2⤵
  PID:5392
- C:\Windows\System\GGodJZV.exe
  C:\Windows\System\GGodJZV.exe
  2⤵
  PID:5408
- C:\Windows\System\QjrDTNh.exe
  C:\Windows\System\QjrDTNh.exe
  2⤵
  PID:5424
- C:\Windows\System\OmpsUvT.exe
  C:\Windows\System\OmpsUvT.exe
  2⤵
  PID:5440
- C:\Windows\System\uYtzFWw.exe
  C:\Windows\System\uYtzFWw.exe
  2⤵
  PID:5464
- C:\Windows\System\HPyoidn.exe
  C:\Windows\System\HPyoidn.exe
  2⤵
  PID:5484
- C:\Windows\System\fxlFFvl.exe
  C:\Windows\System\fxlFFvl.exe
  2⤵
  PID:5504
- C:\Windows\System\zdmhfZQ.exe
  C:\Windows\System\zdmhfZQ.exe
  2⤵
  PID:5520
- C:\Windows\System\xmVRmKr.exe
  C:\Windows\System\xmVRmKr.exe
  2⤵
  PID:5536
- C:\Windows\System\ZWHLilw.exe
  C:\Windows\System\ZWHLilw.exe
  2⤵
  PID:5560
- C:\Windows\System\PpfnQET.exe
  C:\Windows\System\PpfnQET.exe
  2⤵
  PID:5580
- C:\Windows\System\vYchPqM.exe
  C:\Windows\System\vYchPqM.exe
  2⤵
  PID:5604
- C:\Windows\System\fQubNIz.exe
  C:\Windows\System\fQubNIz.exe
  2⤵
  PID:5624
- C:\Windows\System\GpVcuNu.exe
  C:\Windows\System\GpVcuNu.exe
  2⤵
  PID:5644
- C:\Windows\System\wCOfATV.exe
  C:\Windows\System\wCOfATV.exe
  2⤵
  PID:5660
- C:\Windows\System\eIhxBUU.exe
  C:\Windows\System\eIhxBUU.exe
  2⤵
  PID:5676
- C:\Windows\System\gzQZCxl.exe
  C:\Windows\System\gzQZCxl.exe
  2⤵
  PID:5696
- C:\Windows\System\KwpJcIU.exe
  C:\Windows\System\KwpJcIU.exe
  2⤵
  PID:5712
- C:\Windows\System\UrXAVTX.exe
  C:\Windows\System\UrXAVTX.exe
  2⤵
  PID:5728
- C:\Windows\System\Vfqldyc.exe
  C:\Windows\System\Vfqldyc.exe
  2⤵
  PID:5744
- C:\Windows\System\PMNVBKt.exe
  C:\Windows\System\PMNVBKt.exe
  2⤵
  PID:5768
- C:\Windows\System\nVCAbXF.exe
  C:\Windows\System\nVCAbXF.exe
  2⤵
  PID:5788
- C:\Windows\System\lwKDOBg.exe
  C:\Windows\System\lwKDOBg.exe
  2⤵
  PID:5804
- C:\Windows\System\sqIXdbT.exe
  C:\Windows\System\sqIXdbT.exe
  2⤵
  PID:5844
- C:\Windows\System\QzCpfQP.exe
  C:\Windows\System\QzCpfQP.exe
  2⤵
  PID:5864
- C:\Windows\System\czSQslo.exe
  C:\Windows\System\czSQslo.exe
  2⤵
  PID:5932
- C:\Windows\System\kxXiyOO.exe
  C:\Windows\System\kxXiyOO.exe
  2⤵
  PID:5948
- C:\Windows\System\makhhzu.exe
  C:\Windows\System\makhhzu.exe
  2⤵
  PID:5964
- C:\Windows\System\VDCacIQ.exe
  C:\Windows\System\VDCacIQ.exe
  2⤵
  PID:5980
- C:\Windows\System\NPwhQIY.exe
  C:\Windows\System\NPwhQIY.exe
  2⤵
  PID:5996
- C:\Windows\System\fxvMqVb.exe
  C:\Windows\System\fxvMqVb.exe
  2⤵
  PID:6012
- C:\Windows\System\NPNmNiW.exe
  C:\Windows\System\NPNmNiW.exe
  2⤵
  PID:6028
- C:\Windows\System\cNAhEMr.exe
  C:\Windows\System\cNAhEMr.exe
  2⤵
  PID:6044
- C:\Windows\System\TlrpitW.exe
  C:\Windows\System\TlrpitW.exe
  2⤵
  PID:6060
- C:\Windows\System\WLcBtaQ.exe
  C:\Windows\System\WLcBtaQ.exe
  2⤵
  PID:6080
- C:\Windows\System\nfMlqHq.exe
  C:\Windows\System\nfMlqHq.exe
  2⤵
  PID:6104
- C:\Windows\System\uDxdQnl.exe
  C:\Windows\System\uDxdQnl.exe
  2⤵
  PID:6132
- C:\Windows\System\rlPcxDU.exe
  C:\Windows\System\rlPcxDU.exe
  2⤵
  PID:1484
- C:\Windows\System\UOnEeqD.exe
  C:\Windows\System\UOnEeqD.exe
  2⤵
  PID:2712
- C:\Windows\System\pPBoAwZ.exe
  C:\Windows\System\pPBoAwZ.exe
  2⤵
  PID:5172
- C:\Windows\System\uxvfNsr.exe
  C:\Windows\System\uxvfNsr.exe
  2⤵
  PID:4656
- C:\Windows\System\MnJWceN.exe
  C:\Windows\System\MnJWceN.exe
  2⤵
  PID:5260
- C:\Windows\System\IoMZojV.exe
  C:\Windows\System\IoMZojV.exe
  2⤵
  PID:5124
- C:\Windows\System\fqunRKJ.exe
  C:\Windows\System\fqunRKJ.exe
  2⤵
  PID:5192
- C:\Windows\System\mXyIfmn.exe
  C:\Windows\System\mXyIfmn.exe
  2⤵
  PID:5264
- C:\Windows\System\UkAUptO.exe
  C:\Windows\System\UkAUptO.exe
  2⤵
  PID:5328
- C:\Windows\System\wtGCIaC.exe
  C:\Windows\System\wtGCIaC.exe
  2⤵
  PID:5308
- C:\Windows\System\UJeiGdy.exe
  C:\Windows\System\UJeiGdy.exe
  2⤵
  PID:5360
- C:\Windows\System\xrDidJd.exe
  C:\Windows\System\xrDidJd.exe
  2⤵
  PID:5380
- C:\Windows\System\QXyxpcS.exe
  C:\Windows\System\QXyxpcS.exe
  2⤵
  PID:5472
- C:\Windows\System\tvrgjTY.exe
  C:\Windows\System\tvrgjTY.exe
  2⤵
  PID:5516
- C:\Windows\System\qUHBMTB.exe
  C:\Windows\System\qUHBMTB.exe
  2⤵
  PID:5588
- C:\Windows\System\swXBPVI.exe
  C:\Windows\System\swXBPVI.exe
  2⤵
  PID:5632
- C:\Windows\System\yRIfTLd.exe
  C:\Windows\System\yRIfTLd.exe
  2⤵
  PID:5672
- C:\Windows\System\GwPLUrk.exe
  C:\Windows\System\GwPLUrk.exe
  2⤵
  PID:5416
- C:\Windows\System\gjjpPIn.exe
  C:\Windows\System\gjjpPIn.exe
  2⤵
  PID:5776
- C:\Windows\System\sWtQmNs.exe
  C:\Windows\System\sWtQmNs.exe
  2⤵
  PID:5820
- C:\Windows\System\kybJWxh.exe
  C:\Windows\System\kybJWxh.exe
  2⤵
  PID:5836
- C:\Windows\System\wcyjOXP.exe
  C:\Windows\System\wcyjOXP.exe
  2⤵
  PID:5872
- C:\Windows\System\dyjbEtH.exe
  C:\Windows\System\dyjbEtH.exe
  2⤵
  PID:5888
- C:\Windows\System\NReBLsF.exe
  C:\Windows\System\NReBLsF.exe
  2⤵
  PID:5352
- C:\Windows\System\lUnZiDT.exe
  C:\Windows\System\lUnZiDT.exe
  2⤵
  PID:5900
- C:\Windows\System\dTGrlfv.exe
  C:\Windows\System\dTGrlfv.exe
  2⤵
  PID:5912
- C:\Windows\System\QLXecpV.exe
  C:\Windows\System\QLXecpV.exe
  2⤵
  PID:5916
- C:\Windows\System\IEpeQCU.exe
  C:\Windows\System\IEpeQCU.exe
  2⤵
  PID:5492
- C:\Windows\System\rVjhuhG.exe
  C:\Windows\System\rVjhuhG.exe
  2⤵
  PID:5500
- C:\Windows\System\ltOgLBO.exe
  C:\Windows\System\ltOgLBO.exe
  2⤵
  PID:5572
- C:\Windows\System\GkZGOwq.exe
  C:\Windows\System\GkZGOwq.exe
  2⤵
  PID:5616
- C:\Windows\System\GebAahP.exe
  C:\Windows\System\GebAahP.exe
  2⤵
  PID:6052
- C:\Windows\System\SMAhnLK.exe
  C:\Windows\System\SMAhnLK.exe
  2⤵
  PID:6004
- C:\Windows\System\YNJHkaT.exe
  C:\Windows\System\YNJHkaT.exe
  2⤵
  PID:6140
- C:\Windows\System\jbRnxzm.exe
  C:\Windows\System\jbRnxzm.exe
  2⤵
  PID:4504
- C:\Windows\System\htvpMCR.exe
  C:\Windows\System\htvpMCR.exe
  2⤵
  PID:6120
- C:\Windows\System\zBtdqmJ.exe
  C:\Windows\System\zBtdqmJ.exe
  2⤵
  PID:4520
- C:\Windows\System\trGBKMP.exe
  C:\Windows\System\trGBKMP.exe
  2⤵
  PID:4868
- C:\Windows\System\xwitLWd.exe
  C:\Windows\System\xwitLWd.exe
  2⤵
  PID:6072
- C:\Windows\System\oYDXApJ.exe
  C:\Windows\System\oYDXApJ.exe
  2⤵
  PID:3984
- C:\Windows\System\fwpmfwq.exe
  C:\Windows\System\fwpmfwq.exe
  2⤵
  PID:5160
- C:\Windows\System\yxIApix.exe
  C:\Windows\System\yxIApix.exe
  2⤵
  PID:2464
- C:\Windows\System\qWXXCGA.exe
  C:\Windows\System\qWXXCGA.exe
  2⤵
  PID:5340
- C:\Windows\System\dpywqPT.exe
  C:\Windows\System\dpywqPT.exe
  2⤵
  PID:4556
- C:\Windows\System\gnVGGil.exe
  C:\Windows\System\gnVGGil.exe
  2⤵
  PID:5232
- C:\Windows\System\RhmzDjX.exe
  C:\Windows\System\RhmzDjX.exe
  2⤵
  PID:4668
- C:\Windows\System\fwwSCvc.exe
  C:\Windows\System\fwwSCvc.exe
  2⤵
  PID:5368
- C:\Windows\System\tEVTKHN.exe
  C:\Windows\System\tEVTKHN.exe
  2⤵
  PID:1496
- C:\Windows\System\jkMKnQv.exe
  C:\Windows\System\jkMKnQv.exe
  2⤵
  PID:5512
- C:\Windows\System\kAtZBVg.exe
  C:\Windows\System\kAtZBVg.exe
  2⤵
  PID:5552
- C:\Windows\System\YQNwCJU.exe
  C:\Windows\System\YQNwCJU.exe
  2⤵
  PID:5740
- C:\Windows\System\QYsenqg.exe
  C:\Windows\System\QYsenqg.exe
  2⤵
  PID:5832
- C:\Windows\System\MkDcZtp.exe
  C:\Windows\System\MkDcZtp.exe
  2⤵
  PID:5372
- C:\Windows\System\eKxGSCM.exe
  C:\Windows\System\eKxGSCM.exe
  2⤵
  PID:5924
- C:\Windows\System\knXKpNG.exe
  C:\Windows\System\knXKpNG.exe
  2⤵
  PID:5448
- C:\Windows\System\xqyEkEY.exe
  C:\Windows\System\xqyEkEY.exe
  2⤵
  PID:5908
- C:\Windows\System\rJdiZDI.exe
  C:\Windows\System\rJdiZDI.exe
  2⤵
  PID:5656
- C:\Windows\System\PwXHojX.exe
  C:\Windows\System\PwXHojX.exe
  2⤵
  PID:5736
- C:\Windows\System\QwXjnfQ.exe
  C:\Windows\System\QwXjnfQ.exe
  2⤵
  PID:5692
- C:\Windows\System\pCbRzFF.exe
  C:\Windows\System\pCbRzFF.exe
  2⤵
  PID:5720
- C:\Windows\System\gczEhSJ.exe
  C:\Windows\System\gczEhSJ.exe
  2⤵
  PID:5860
- C:\Windows\System\KjOKctp.exe
  C:\Windows\System\KjOKctp.exe
  2⤵
  PID:5992
- C:\Windows\System\otFTmSE.exe
  C:\Windows\System\otFTmSE.exe
  2⤵
  PID:6088
- C:\Windows\System\QLCCQBs.exe
  C:\Windows\System\QLCCQBs.exe
  2⤵
  PID:4388
- C:\Windows\System\BcBSTsT.exe
  C:\Windows\System\BcBSTsT.exe
  2⤵
  PID:4112
- C:\Windows\System\AxLHEtW.exe
  C:\Windows\System\AxLHEtW.exe
  2⤵
  PID:4240
- C:\Windows\System\KgvmScb.exe
  C:\Windows\System\KgvmScb.exe
  2⤵
  PID:5600
- C:\Windows\System\ruuDJVM.exe
  C:\Windows\System\ruuDJVM.exe
  2⤵
  PID:2376
- C:\Windows\System\gkKhEyo.exe
  C:\Windows\System\gkKhEyo.exe
  2⤵
  PID:6160
- C:\Windows\System\jagdjgH.exe
  C:\Windows\System\jagdjgH.exe
  2⤵
  PID:6180
- C:\Windows\System\sULYuKm.exe
  C:\Windows\System\sULYuKm.exe
  2⤵
  PID:6200
- C:\Windows\System\nTTPTzz.exe
  C:\Windows\System\nTTPTzz.exe
  2⤵
  PID:6224
- C:\Windows\System\irGuwjx.exe
  C:\Windows\System\irGuwjx.exe
  2⤵
  PID:6244
- C:\Windows\System\vmtKsTJ.exe
  C:\Windows\System\vmtKsTJ.exe
  2⤵
  PID:6268
- C:\Windows\System\AiFzvbw.exe
  C:\Windows\System\AiFzvbw.exe
  2⤵
  PID:6284
- C:\Windows\System\kANeNvX.exe
  C:\Windows\System\kANeNvX.exe
  2⤵
  PID:6304
- C:\Windows\System\meSofLh.exe
  C:\Windows\System\meSofLh.exe
  2⤵
  PID:6324
- C:\Windows\System\BepMcmk.exe
  C:\Windows\System\BepMcmk.exe
  2⤵
  PID:6348
- C:\Windows\System\ISSNrOf.exe
  C:\Windows\System\ISSNrOf.exe
  2⤵
  PID:6368
- C:\Windows\System\QaygMZc.exe
  C:\Windows\System\QaygMZc.exe
  2⤵
  PID:6384
- C:\Windows\System\JTmfjAg.exe
  C:\Windows\System\JTmfjAg.exe
  2⤵
  PID:6408
- C:\Windows\System\wEZCLfZ.exe
  C:\Windows\System\wEZCLfZ.exe
  2⤵
  PID:6428
- C:\Windows\System\WcKCrZn.exe
  C:\Windows\System\WcKCrZn.exe
  2⤵
  PID:6448
- C:\Windows\System\ckwRUpP.exe
  C:\Windows\System\ckwRUpP.exe
  2⤵
  PID:6464
- C:\Windows\System\mVydtbq.exe
  C:\Windows\System\mVydtbq.exe
  2⤵
  PID:6480
- C:\Windows\System\GxhyDTq.exe
  C:\Windows\System\GxhyDTq.exe
  2⤵
  PID:6500
- C:\Windows\System\vmmikzf.exe
  C:\Windows\System\vmmikzf.exe
  2⤵
  PID:6520
- C:\Windows\System\EfCKUlC.exe
  C:\Windows\System\EfCKUlC.exe
  2⤵
  PID:6544
- C:\Windows\System\QjqWFJy.exe
  C:\Windows\System\QjqWFJy.exe
  2⤵
  PID:6560
- C:\Windows\System\eTcuZDu.exe
  C:\Windows\System\eTcuZDu.exe
  2⤵
  PID:6584
- C:\Windows\System\bzJlPzc.exe
  C:\Windows\System\bzJlPzc.exe
  2⤵
  PID:6600
- C:\Windows\System\AnIPXLK.exe
  C:\Windows\System\AnIPXLK.exe
  2⤵
  PID:6616
- C:\Windows\System\Ubnfmgj.exe
  C:\Windows\System\Ubnfmgj.exe
  2⤵
  PID:6644
- C:\Windows\System\rOnBJSH.exe
  C:\Windows\System\rOnBJSH.exe
  2⤵
  PID:6760
- C:\Windows\System\VKUXPVb.exe
  C:\Windows\System\VKUXPVb.exe
  2⤵
  PID:6780
- C:\Windows\System\vQqhtqy.exe
  C:\Windows\System\vQqhtqy.exe
  2⤵
  PID:6796
- C:\Windows\System\zmpERcG.exe
  C:\Windows\System\zmpERcG.exe
  2⤵
  PID:6812
- C:\Windows\System\XCkwaRT.exe
  C:\Windows\System\XCkwaRT.exe
  2⤵
  PID:6828
- C:\Windows\System\fJzhuLA.exe
  C:\Windows\System\fJzhuLA.exe
  2⤵
  PID:6848
- C:\Windows\System\fqcBHNg.exe
  C:\Windows\System\fqcBHNg.exe
  2⤵
  PID:6864
- C:\Windows\System\aUYMdYI.exe
  C:\Windows\System\aUYMdYI.exe
  2⤵
  PID:6880
- C:\Windows\System\cJKgOxu.exe
  C:\Windows\System\cJKgOxu.exe
  2⤵
  PID:6896
- C:\Windows\System\VEHfMNX.exe
  C:\Windows\System\VEHfMNX.exe
  2⤵
  PID:6912
- C:\Windows\System\pXdoOwZ.exe
  C:\Windows\System\pXdoOwZ.exe
  2⤵
  PID:6928
- C:\Windows\System\WskLQws.exe
  C:\Windows\System\WskLQws.exe
  2⤵
  PID:6944
- C:\Windows\System\DKtQXBu.exe
  C:\Windows\System\DKtQXBu.exe
  2⤵
  PID:6960
- C:\Windows\System\mrjKIYn.exe
  C:\Windows\System\mrjKIYn.exe
  2⤵
  PID:6976
- C:\Windows\System\vUsBDxG.exe
  C:\Windows\System\vUsBDxG.exe
  2⤵
  PID:6992
- C:\Windows\System\qzegNqS.exe
  C:\Windows\System\qzegNqS.exe
  2⤵
  PID:7012
- C:\Windows\System\DSvDPZL.exe
  C:\Windows\System\DSvDPZL.exe
  2⤵
  PID:7028
- C:\Windows\System\GixFIMZ.exe
  C:\Windows\System\GixFIMZ.exe
  2⤵
  PID:7044
- C:\Windows\System\jkuWOeh.exe
  C:\Windows\System\jkuWOeh.exe
  2⤵
  PID:7112
- C:\Windows\System\ltuXvIq.exe
  C:\Windows\System\ltuXvIq.exe
  2⤵
  PID:7128
- C:\Windows\System\KKTNxdK.exe
  C:\Windows\System\KKTNxdK.exe
  2⤵
  PID:7152
- C:\Windows\System\saitZVk.exe
  C:\Windows\System\saitZVk.exe
  2⤵
  PID:5348
- C:\Windows\System\NmBqQnJ.exe
  C:\Windows\System\NmBqQnJ.exe
  2⤵
  PID:5752
- C:\Windows\System\khoIgiB.exe
  C:\Windows\System\khoIgiB.exe
  2⤵
  PID:5140
- C:\Windows\System\segrYnd.exe
  C:\Windows\System\segrYnd.exe
  2⤵
  PID:5976
- C:\Windows\System\xCNGpnv.exe
  C:\Windows\System\xCNGpnv.exe
  2⤵
  PID:5436
- C:\Windows\System\NtXnjiG.exe
  C:\Windows\System\NtXnjiG.exe
  2⤵
  PID:1028
- C:\Windows\System\AJaVGny.exe
  C:\Windows\System\AJaVGny.exe
  2⤵
  PID:6208
- C:\Windows\System\ttRGpus.exe
  C:\Windows\System\ttRGpus.exe
  2⤵
  PID:6092
- C:\Windows\System\zMeMzpV.exe
  C:\Windows\System\zMeMzpV.exe
  2⤵
  PID:6296
- C:\Windows\System\ssmoTxT.exe
  C:\Windows\System\ssmoTxT.exe
  2⤵
  PID:1812
- C:\Windows\System\ZqPEOFY.exe
  C:\Windows\System\ZqPEOFY.exe
  2⤵
  PID:6332
- C:\Windows\System\CilDtNd.exe
  C:\Windows\System\CilDtNd.exe
  2⤵
  PID:2244
- C:\Windows\System\ngFTiNr.exe
  C:\Windows\System\ngFTiNr.exe
  2⤵
  PID:904
- C:\Windows\System\qXfQydu.exe
  C:\Windows\System\qXfQydu.exe
  2⤵
  PID:6536
- C:\Windows\System\xtpfYFg.exe
  C:\Windows\System\xtpfYFg.exe
  2⤵
  PID:6568
- C:\Windows\System\dhilnzv.exe
  C:\Windows\System\dhilnzv.exe
  2⤵
  PID:6612
- C:\Windows\System\AoHYtyM.exe
  C:\Windows\System\AoHYtyM.exe
  2⤵
  PID:6668
- C:\Windows\System\dwRyCKK.exe
  C:\Windows\System\dwRyCKK.exe
  2⤵
  PID:5796
- C:\Windows\System\oxEotMH.exe
  C:\Windows\System\oxEotMH.exe
  2⤵
  PID:5856
- C:\Windows\System\eUQCovo.exe
  C:\Windows\System\eUQCovo.exe
  2⤵
  PID:6708
- C:\Windows\System\csEQXFV.exe
  C:\Windows\System\csEQXFV.exe
  2⤵
  PID:6356
- C:\Windows\System\UqJapHp.exe
  C:\Windows\System\UqJapHp.exe
  2⤵
  PID:6728
- C:\Windows\System\msGazMt.exe
  C:\Windows\System\msGazMt.exe
  2⤵
  PID:5432
- C:\Windows\System\RsYpvLk.exe
  C:\Windows\System\RsYpvLk.exe
  2⤵
  PID:6628
- C:\Windows\System\JApJjWp.exe
  C:\Windows\System\JApJjWp.exe
  2⤵
  PID:6664
- C:\Windows\System\BGXdCtv.exe
  C:\Windows\System\BGXdCtv.exe
  2⤵
  PID:6040
- C:\Windows\System\khcMbPP.exe
  C:\Windows\System\khcMbPP.exe
  2⤵
  PID:4636
- C:\Windows\System\IpdwEPz.exe
  C:\Windows\System\IpdwEPz.exe
  2⤵
  PID:6472
- C:\Windows\System\ddUnHty.exe
  C:\Windows\System\ddUnHty.exe
  2⤵
  PID:5556
- C:\Windows\System\JEuPijT.exe
  C:\Windows\System\JEuPijT.exe
  2⤵
  PID:5816
- C:\Windows\System\WCPhYsQ.exe
  C:\Windows\System\WCPhYsQ.exe
  2⤵
  PID:5800
- C:\Windows\System\ZBzELvH.exe
  C:\Windows\System\ZBzELvH.exe
  2⤵
  PID:2212
- C:\Windows\System\srFXdof.exe
  C:\Windows\System\srFXdof.exe
  2⤵
  PID:6152
- C:\Windows\System\ivOobXH.exe
  C:\Windows\System\ivOobXH.exe
  2⤵
  PID:6232
- C:\Windows\System\RQaJfTu.exe
  C:\Windows\System\RQaJfTu.exe
  2⤵
  PID:6508
- C:\Windows\System\gRxNRxp.exe
  C:\Windows\System\gRxNRxp.exe
  2⤵
  PID:6636
- C:\Windows\System\LUTnUVR.exe
  C:\Windows\System\LUTnUVR.exe
  2⤵
  PID:6776
- C:\Windows\System\lGYAkEe.exe
  C:\Windows\System\lGYAkEe.exe
  2⤵
  PID:6820
- C:\Windows\System\qsZlfWT.exe
  C:\Windows\System\qsZlfWT.exe
  2⤵
  PID:6888
- C:\Windows\System\ldozUza.exe
  C:\Windows\System\ldozUza.exe
  2⤵
  PID:6956
- C:\Windows\System\WfoxXmO.exe
  C:\Windows\System\WfoxXmO.exe
  2⤵
  PID:2060
- C:\Windows\System\SICAGUZ.exe
  C:\Windows\System\SICAGUZ.exe
  2⤵
  PID:7072
- C:\Windows\System\VpUQELj.exe
  C:\Windows\System\VpUQELj.exe
  2⤵
  PID:7088
- C:\Windows\System\xrgqxJD.exe
  C:\Windows\System\xrgqxJD.exe
  2⤵
  PID:5012
- C:\Windows\System\FDGWpmx.exe
  C:\Windows\System\FDGWpmx.exe
  2⤵
  PID:6904
- C:\Windows\System\XGGEPAj.exe
  C:\Windows\System\XGGEPAj.exe
  2⤵
  PID:6808
- C:\Windows\System\LKlKqRT.exe
  C:\Windows\System\LKlKqRT.exe
  2⤵
  PID:6872
- C:\Windows\System\UyvbFYB.exe
  C:\Windows\System\UyvbFYB.exe
  2⤵
  PID:7004
- C:\Windows\System\TLFgJLY.exe
  C:\Windows\System\TLFgJLY.exe
  2⤵
  PID:7148
- C:\Windows\System\jFkLxgd.exe
  C:\Windows\System\jFkLxgd.exe
  2⤵
  PID:6096
- C:\Windows\System\MWNARZP.exe
  C:\Windows\System\MWNARZP.exe
  2⤵
  PID:6220
- C:\Windows\System\sKnXJVd.exe
  C:\Windows\System\sKnXJVd.exe
  2⤵
  PID:7164
- C:\Windows\System\AzjUVou.exe
  C:\Windows\System\AzjUVou.exe
  2⤵
  PID:984
- C:\Windows\System\KmUyBwF.exe
  C:\Windows\System\KmUyBwF.exe
  2⤵
  PID:6264
- C:\Windows\System\XCWrBrm.exe
  C:\Windows\System\XCWrBrm.exe
  2⤵
  PID:1592
- C:\Windows\System\ZltKELE.exe
  C:\Windows\System\ZltKELE.exe
  2⤵
  PID:6580
- C:\Windows\System\rIPmEBJ.exe
  C:\Windows\System\rIPmEBJ.exe
  2⤵
  PID:6292
- C:\Windows\System\flZpHuO.exe
  C:\Windows\System\flZpHuO.exe
  2⤵
  PID:1648
- C:\Windows\System\ImlGOjN.exe
  C:\Windows\System\ImlGOjN.exe
  2⤵
  PID:6392
- C:\Windows\System\ZPlAWgx.exe
  C:\Windows\System\ZPlAWgx.exe
  2⤵
  PID:6744
- C:\Windows\System\cqkLNUX.exe
  C:\Windows\System\cqkLNUX.exe
  2⤵
  PID:6380
- C:\Windows\System\xrhqEfT.exe
  C:\Windows\System\xrhqEfT.exe
  2⤵
  PID:6404
- C:\Windows\System\gDmrQfO.exe
  C:\Windows\System\gDmrQfO.exe
  2⤵
  PID:6660
- C:\Windows\System\OahUpYY.exe
  C:\Windows\System\OahUpYY.exe
  2⤵
  PID:6688
- C:\Windows\System\MEYEzyc.exe
  C:\Windows\System\MEYEzyc.exe
  2⤵
  PID:6400
- C:\Windows\System\wGFNwnU.exe
  C:\Windows\System\wGFNwnU.exe
  2⤵
  PID:6552
- C:\Windows\System\RJfhwgY.exe
  C:\Windows\System\RJfhwgY.exe
  2⤵
  PID:6924
- C:\Windows\System\CuQYwSV.exe
  C:\Windows\System\CuQYwSV.exe
  2⤵
  PID:7068
- C:\Windows\System\YjStNxa.exe
  C:\Windows\System\YjStNxa.exe
  2⤵
  PID:5684
- C:\Windows\System\FfVDcGg.exe
  C:\Windows\System\FfVDcGg.exe
  2⤵
  PID:5356
- C:\Windows\System\TSaTaGN.exe
  C:\Windows\System\TSaTaGN.exe
  2⤵
  PID:6968
- C:\Windows\System\dvnzuwO.exe
  C:\Windows\System\dvnzuwO.exe
  2⤵
  PID:5400
- C:\Windows\System\GYumVZd.exe
  C:\Windows\System\GYumVZd.exe
  2⤵
  PID:7000
- C:\Windows\System\hfLCySL.exe
  C:\Windows\System\hfLCySL.exe
  2⤵
  PID:6320
- C:\Windows\System\OYpQliJ.exe
  C:\Windows\System\OYpQliJ.exe
  2⤵
  PID:1828
- C:\Windows\System\BFVVMjI.exe
  C:\Windows\System\BFVVMjI.exe
  2⤵
  PID:7008
- C:\Windows\System\NaNBxXT.exe
  C:\Windows\System\NaNBxXT.exe
  2⤵
  PID:2024
- C:\Windows\System\FqmDnqk.exe
  C:\Windows\System\FqmDnqk.exe
  2⤵
  PID:7084
- C:\Windows\System\fQAOGCV.exe
  C:\Windows\System\fQAOGCV.exe
  2⤵
  PID:6772
- C:\Windows\System\GcUhhml.exe
  C:\Windows\System\GcUhhml.exe
  2⤵
  PID:7136
- C:\Windows\System\OLIYnqw.exe
  C:\Windows\System\OLIYnqw.exe
  2⤵
  PID:6216
- C:\Windows\System\yfHbWSR.exe
  C:\Windows\System\yfHbWSR.exe
  2⤵
  PID:2000
- C:\Windows\System\JVnkEjG.exe
  C:\Windows\System\JVnkEjG.exe
  2⤵
  PID:6496
- C:\Windows\System\FIaIgbk.exe
  C:\Windows\System\FIaIgbk.exe
  2⤵
  PID:6460
- C:\Windows\System\ldgeErc.exe
  C:\Windows\System\ldgeErc.exe
  2⤵
  PID:6740
- C:\Windows\System\BNZKyYK.exe
  C:\Windows\System\BNZKyYK.exe
  2⤵
  PID:6532
- C:\Windows\System\tjedGVu.exe
  C:\Windows\System\tjedGVu.exe
  2⤵
  PID:6684
- C:\Windows\System\cnpDKTJ.exe
  C:\Windows\System\cnpDKTJ.exe
  2⤵
  PID:4752
- C:\Windows\System\lImrEQo.exe
  C:\Windows\System\lImrEQo.exe
  2⤵
  PID:4824
- C:\Windows\System\xSPKWKg.exe
  C:\Windows\System\xSPKWKg.exe
  2⤵
  PID:5460
- C:\Windows\System\mQzcadY.exe
  C:\Windows\System\mQzcadY.exe
  2⤵
  PID:6240
- C:\Windows\System\IcJlFZp.exe
  C:\Windows\System\IcJlFZp.exe
  2⤵
  PID:6316
- C:\Windows\System\UapRHzb.exe
  C:\Windows\System\UapRHzb.exe
  2⤵
  PID:6792
- C:\Windows\System\ZRzfHDV.exe
  C:\Windows\System\ZRzfHDV.exe
  2⤵
  PID:6252
- C:\Windows\System\YPXKsjd.exe
  C:\Windows\System\YPXKsjd.exe
  2⤵
  PID:7096
- C:\Windows\System\AzMoTKm.exe
  C:\Windows\System\AzMoTKm.exe
  2⤵
  PID:6716
- C:\Windows\System\CfLeGAy.exe
  C:\Windows\System\CfLeGAy.exe
  2⤵
  PID:1604
- C:\Windows\System\jMIytyM.exe
  C:\Windows\System\jMIytyM.exe
  2⤵
  PID:5812
- C:\Windows\System\PKMTzhF.exe
  C:\Windows\System\PKMTzhF.exe
  2⤵
  PID:6196
- C:\Windows\System\ilWlKZK.exe
  C:\Windows\System\ilWlKZK.exe
  2⤵
  PID:6936
- C:\Windows\System\dQIvwew.exe
  C:\Windows\System\dQIvwew.exe
  2⤵
  PID:6276
- C:\Windows\System\dQTKioR.exe
  C:\Windows\System\dQTKioR.exe
  2⤵
  PID:6592
- C:\Windows\System\imqyqiM.exe
  C:\Windows\System\imqyqiM.exe
  2⤵
  PID:5480
- C:\Windows\System\eEfkojy.exe
  C:\Windows\System\eEfkojy.exe
  2⤵
  PID:1784
- C:\Windows\System\FjNxaSY.exe
  C:\Windows\System\FjNxaSY.exe
  2⤵
  PID:6344
- C:\Windows\System\CebbqcJ.exe
  C:\Windows\System\CebbqcJ.exe
  2⤵
  PID:7176
- C:\Windows\System\nTqbkBK.exe
  C:\Windows\System\nTqbkBK.exe
  2⤵
  PID:7192
- C:\Windows\System\vIDAniy.exe
  C:\Windows\System\vIDAniy.exe
  2⤵
  PID:7212
- C:\Windows\System\vtDwvOA.exe
  C:\Windows\System\vtDwvOA.exe
  2⤵
  PID:7232
- C:\Windows\System\nLrzWcM.exe
  C:\Windows\System\nLrzWcM.exe
  2⤵
  PID:7252
- C:\Windows\System\ovALkFu.exe
  C:\Windows\System\ovALkFu.exe
  2⤵
  PID:7268
- C:\Windows\System\Xbgdguz.exe
  C:\Windows\System\Xbgdguz.exe
  2⤵
  PID:7292
- C:\Windows\System\jsQPqKE.exe
  C:\Windows\System\jsQPqKE.exe
  2⤵
  PID:7312
- C:\Windows\System\RWAPUuK.exe
  C:\Windows\System\RWAPUuK.exe
  2⤵
  PID:7336
- C:\Windows\System\XcPETzI.exe
  C:\Windows\System\XcPETzI.exe
  2⤵
  PID:7360
- C:\Windows\System\TfJjtmy.exe
  C:\Windows\System\TfJjtmy.exe
  2⤵
  PID:7396
- C:\Windows\System\kTePiSj.exe
  C:\Windows\System\kTePiSj.exe
  2⤵
  PID:7412
- C:\Windows\System\nhwEbek.exe
  C:\Windows\System\nhwEbek.exe
  2⤵
  PID:7428
- C:\Windows\System\jmXtutC.exe
  C:\Windows\System\jmXtutC.exe
  2⤵
  PID:7452
- C:\Windows\System\mqUvWpD.exe
  C:\Windows\System\mqUvWpD.exe
  2⤵
  PID:7468
- C:\Windows\System\XVRuzra.exe
  C:\Windows\System\XVRuzra.exe
  2⤵
  PID:7484
- C:\Windows\System\WQtoHXU.exe
  C:\Windows\System\WQtoHXU.exe
  2⤵
  PID:7500
- C:\Windows\System\SRAYCaM.exe
  C:\Windows\System\SRAYCaM.exe
  2⤵
  PID:7520
- C:\Windows\System\TYARiZL.exe
  C:\Windows\System\TYARiZL.exe
  2⤵
  PID:7536
- C:\Windows\System\wjrAPAq.exe
  C:\Windows\System\wjrAPAq.exe
  2⤵
  PID:7552
- C:\Windows\System\MGUSAFh.exe
  C:\Windows\System\MGUSAFh.exe
  2⤵
  PID:7568
- C:\Windows\System\aPWNlns.exe
  C:\Windows\System\aPWNlns.exe
  2⤵
  PID:7584
- C:\Windows\System\LUhOZvQ.exe
  C:\Windows\System\LUhOZvQ.exe
  2⤵
  PID:7600
- C:\Windows\System\wxQuiFq.exe
  C:\Windows\System\wxQuiFq.exe
  2⤵
  PID:7616
- C:\Windows\System\aoACRDA.exe
  C:\Windows\System\aoACRDA.exe
  2⤵
  PID:7632
- C:\Windows\System\JBvyUBf.exe
  C:\Windows\System\JBvyUBf.exe
  2⤵
  PID:7648
- C:\Windows\System\cWqzWOw.exe
  C:\Windows\System\cWqzWOw.exe
  2⤵
  PID:7664
- C:\Windows\System\xGmWZOt.exe
  C:\Windows\System\xGmWZOt.exe
  2⤵
  PID:7684
- C:\Windows\System\ZIZQznV.exe
  C:\Windows\System\ZIZQznV.exe
  2⤵
  PID:7700
- C:\Windows\System\XlFsXsV.exe
  C:\Windows\System\XlFsXsV.exe
  2⤵
  PID:7752
- C:\Windows\System\DzMWIaC.exe
  C:\Windows\System\DzMWIaC.exe
  2⤵
  PID:7768
- C:\Windows\System\KnPdpeY.exe
  C:\Windows\System\KnPdpeY.exe
  2⤵
  PID:7784
- C:\Windows\System\MBIWmyD.exe
  C:\Windows\System\MBIWmyD.exe
  2⤵
  PID:7840
- C:\Windows\System\juUhSAe.exe
  C:\Windows\System\juUhSAe.exe
  2⤵
  PID:7856
- C:\Windows\System\pfiEdKP.exe
  C:\Windows\System\pfiEdKP.exe
  2⤵
  PID:7872
- C:\Windows\System\MVIvdld.exe
  C:\Windows\System\MVIvdld.exe
  2⤵
  PID:7888
- C:\Windows\System\fRGetwo.exe
  C:\Windows\System\fRGetwo.exe
  2⤵
  PID:7904
- C:\Windows\System\wsPcAiQ.exe
  C:\Windows\System\wsPcAiQ.exe
  2⤵
  PID:7920
- C:\Windows\System\EDZhcsP.exe
  C:\Windows\System\EDZhcsP.exe
  2⤵
  PID:7936
- C:\Windows\System\QqOvbDQ.exe
  C:\Windows\System\QqOvbDQ.exe
  2⤵
  PID:7952
- C:\Windows\System\RwPDHud.exe
  C:\Windows\System\RwPDHud.exe
  2⤵
  PID:7968
- C:\Windows\System\ZRIJiQL.exe
  C:\Windows\System\ZRIJiQL.exe
  2⤵
  PID:7984
- C:\Windows\System\cRZapRv.exe
  C:\Windows\System\cRZapRv.exe
  2⤵
  PID:8000
- C:\Windows\System\BcXHtpR.exe
  C:\Windows\System\BcXHtpR.exe
  2⤵
  PID:8016
- C:\Windows\System\bkdjESL.exe
  C:\Windows\System\bkdjESL.exe
  2⤵
  PID:8032
- C:\Windows\System\NHwnZNV.exe
  C:\Windows\System\NHwnZNV.exe
  2⤵
  PID:8048
- C:\Windows\System\OEKLKfy.exe
  C:\Windows\System\OEKLKfy.exe
  2⤵
  PID:8064
- C:\Windows\System\dtktwrP.exe
  C:\Windows\System\dtktwrP.exe
  2⤵
  PID:8084
- C:\Windows\System\WYPGTTK.exe
  C:\Windows\System\WYPGTTK.exe
  2⤵
  PID:8108
- C:\Windows\System\wbYdyVN.exe
  C:\Windows\System\wbYdyVN.exe
  2⤵
  PID:8128
- C:\Windows\System\cOjrBxu.exe
  C:\Windows\System\cOjrBxu.exe
  2⤵
  PID:8160
- C:\Windows\System\lYGwqRN.exe
  C:\Windows\System\lYGwqRN.exe
  2⤵
  PID:8180
- C:\Windows\System\mSBbHwW.exe
  C:\Windows\System\mSBbHwW.exe
  2⤵
  PID:7172
- C:\Windows\System\BWKGliH.exe
  C:\Windows\System\BWKGliH.exe
  2⤵
  PID:7108
- C:\Windows\System\orEDrtm.exe
  C:\Windows\System\orEDrtm.exe
  2⤵
  PID:7248
- C:\Windows\System\YqVZAes.exe
  C:\Windows\System\YqVZAes.exe
  2⤵
  PID:7324
- C:\Windows\System\uPlvEoj.exe
  C:\Windows\System\uPlvEoj.exe
  2⤵
  PID:5940
- C:\Windows\System\KfqIhgr.exe
  C:\Windows\System\KfqIhgr.exe
  2⤵
  PID:6168
- C:\Windows\System\JIgtFmr.exe
  C:\Windows\System\JIgtFmr.exe
  2⤵
  PID:5956
- C:\Windows\System\VZjtQgx.exe
  C:\Windows\System\VZjtQgx.exe
  2⤵
  PID:5296
- C:\Windows\System\tZXJeSX.exe
  C:\Windows\System\tZXJeSX.exe
  2⤵
  PID:5756
- C:\Windows\System\QZWahHC.exe
  C:\Windows\System\QZWahHC.exe
  2⤵
  PID:4440
- C:\Windows\System\NYCzrbY.exe
  C:\Windows\System\NYCzrbY.exe
  2⤵
  PID:7080
- C:\Windows\System\cSeCHNp.exe
  C:\Windows\System\cSeCHNp.exe
  2⤵
  PID:7188
- C:\Windows\System\MaLwNbO.exe
  C:\Windows\System\MaLwNbO.exe
  2⤵
  PID:7264
- C:\Windows\System\gcuymsg.exe
  C:\Windows\System\gcuymsg.exe
  2⤵
  PID:7348
- C:\Windows\System\hkDzLMg.exe
  C:\Windows\System\hkDzLMg.exe
  2⤵
  PID:7392
- C:\Windows\System\MJLRhKc.exe
  C:\Windows\System\MJLRhKc.exe
  2⤵
  PID:7436
- C:\Windows\System\wsByMWM.exe
  C:\Windows\System\wsByMWM.exe
  2⤵
  PID:7476
- C:\Windows\System\XHyCShp.exe
  C:\Windows\System\XHyCShp.exe
  2⤵
  PID:7496
- C:\Windows\System\MtpZTja.exe
  C:\Windows\System\MtpZTja.exe
  2⤵
  PID:7576
- C:\Windows\System\rdpwVqX.exe
  C:\Windows\System\rdpwVqX.exe
  2⤵
  PID:7612
- C:\Windows\System\FEaWzgx.exe
  C:\Windows\System\FEaWzgx.exe
  2⤵
  PID:7676
- C:\Windows\System\dSapEKN.exe
  C:\Windows\System\dSapEKN.exe
  2⤵
  PID:7716
- C:\Windows\System\WvQMgwP.exe
  C:\Windows\System\WvQMgwP.exe
  2⤵
  PID:7732
- C:\Windows\System\DAxpvMA.exe
  C:\Windows\System\DAxpvMA.exe
  2⤵
  PID:7736
- C:\Windows\System\skBTmBG.exe
  C:\Windows\System\skBTmBG.exe
  2⤵
  PID:7760
- C:\Windows\System\ATjuTcr.exe
  C:\Windows\System\ATjuTcr.exe
  2⤵
  PID:7776
- C:\Windows\System\lcjbTCP.exe
  C:\Windows\System\lcjbTCP.exe
  2⤵
  PID:7816
- C:\Windows\System\npwzDDr.exe
  C:\Windows\System\npwzDDr.exe
  2⤵
  PID:7828
- C:\Windows\System\XlEJgMO.exe
  C:\Windows\System\XlEJgMO.exe
  2⤵
  PID:7868
- C:\Windows\System\tfhcXKK.exe
  C:\Windows\System\tfhcXKK.exe
  2⤵
  PID:8144
- C:\Windows\System\dAQLFII.exe
  C:\Windows\System\dAQLFII.exe
  2⤵
  PID:7896
- C:\Windows\System\KTdzRYb.exe
  C:\Windows\System\KTdzRYb.exe
  2⤵
  PID:8188
- C:\Windows\System\fNxvuFq.exe
  C:\Windows\System\fNxvuFq.exe
  2⤵
  PID:8100
- C:\Windows\System\CVRqiSv.exe
  C:\Windows\System\CVRqiSv.exe
  2⤵
  PID:8028
- C:\Windows\System\nTwmdWg.exe
  C:\Windows\System\nTwmdWg.exe
  2⤵
  PID:7960
- C:\Windows\System\YWNCgCI.exe
  C:\Windows\System\YWNCgCI.exe
  2⤵
  PID:8168
- C:\Windows\System\moGeCTx.exe
  C:\Windows\System\moGeCTx.exe
  2⤵
  PID:7916
- C:\Windows\System\WckgFvk.exe
  C:\Windows\System\WckgFvk.exe
  2⤵
  PID:7980
- C:\Windows\System\bZctSIv.exe
  C:\Windows\System\bZctSIv.exe
  2⤵
  PID:8072
- C:\Windows\System\EeRuxzi.exe
  C:\Windows\System\EeRuxzi.exe
  2⤵
  PID:8124
- C:\Windows\System\BeFhgug.exe
  C:\Windows\System\BeFhgug.exe
  2⤵
  PID:1808
- C:\Windows\System\yCrIJWu.exe
  C:\Windows\System\yCrIJWu.exe
  2⤵
  PID:6988
- C:\Windows\System\koUBaLe.exe
  C:\Windows\System\koUBaLe.exe
  2⤵
  PID:7332
- C:\Windows\System\VzloXOq.exe
  C:\Windows\System\VzloXOq.exe
  2⤵
  PID:7320
- C:\Windows\System\FXApxFJ.exe
  C:\Windows\System\FXApxFJ.exe
  2⤵
  PID:7288
- C:\Windows\System\hzkOFMJ.exe
  C:\Windows\System\hzkOFMJ.exe
  2⤵
  PID:7260
- C:\Windows\System\ChxbsDE.exe
  C:\Windows\System\ChxbsDE.exe
  2⤵
  PID:7356
- C:\Windows\System\GBiSdPU.exe
  C:\Windows\System\GBiSdPU.exe
  2⤵
  PID:7448
- C:\Windows\System\mjTaiZI.exe
  C:\Windows\System\mjTaiZI.exe
  2⤵
  PID:1684
- C:\Windows\System\GGgMeKU.exe
  C:\Windows\System\GGgMeKU.exe
  2⤵
  PID:7492
- C:\Windows\System\MNJDPVj.exe
  C:\Windows\System\MNJDPVj.exe
  2⤵
  PID:7408
- C:\Windows\System\vxpwSHK.exe
  C:\Windows\System\vxpwSHK.exe
  2⤵
  PID:7596
- C:\Windows\System\TTXVYmK.exe
  C:\Windows\System\TTXVYmK.exe
  2⤵
  PID:7592
- C:\Windows\System\qYZSiWH.exe
  C:\Windows\System\qYZSiWH.exe
  2⤵
  PID:7548
- C:\Windows\System\oRQZJgd.exe
  C:\Windows\System\oRQZJgd.exe
  2⤵
  PID:7800
- C:\Windows\System\CgNmeTr.exe
  C:\Windows\System\CgNmeTr.exe
  2⤵
  PID:7848
- C:\Windows\System\EKDcpPS.exe
  C:\Windows\System\EKDcpPS.exe
  2⤵
  PID:7708
- C:\Windows\System\wtinARY.exe
  C:\Windows\System\wtinARY.exe
  2⤵
  PID:7672
- C:\Windows\System\qTKSSCN.exe
  C:\Windows\System\qTKSSCN.exe
  2⤵
  PID:7832
- C:\Windows\System\ORosBvd.exe
  C:\Windows\System\ORosBvd.exe
  2⤵
  PID:7748
- C:\Windows\System\uvptDHR.exe
  C:\Windows\System\uvptDHR.exe
  2⤵
  PID:7240
- C:\Windows\System\fJBvZec.exe
  C:\Windows\System\fJBvZec.exe
  2⤵
  PID:7368
- C:\Windows\System\psthOib.exe
  C:\Windows\System\psthOib.exe
  2⤵
  PID:7228
- C:\Windows\System\YserCSc.exe
  C:\Windows\System\YserCSc.exe
  2⤵
  PID:7460
- C:\Windows\System\OeYEQGv.exe
  C:\Windows\System\OeYEQGv.exe
  2⤵
  PID:7724
- C:\Windows\System\QuxMSNe.exe
  C:\Windows\System\QuxMSNe.exe
  2⤵
  PID:8148
- C:\Windows\System\HpfETnb.exe
  C:\Windows\System\HpfETnb.exe
  2⤵
  PID:7516
- C:\Windows\System\HdYIlVF.exe
  C:\Windows\System\HdYIlVF.exe
  2⤵
  PID:8152
- C:\Windows\System\mHciXhO.exe
  C:\Windows\System\mHciXhO.exe
  2⤵
  PID:7992
- C:\Windows\System\NpWneRw.exe
  C:\Windows\System\NpWneRw.exe
  2⤵
  PID:7912
- C:\Windows\System\fUbXvtH.exe
  C:\Windows\System\fUbXvtH.exe
  2⤵
  PID:6632
- C:\Windows\System\TwCTIcS.exe
  C:\Windows\System\TwCTIcS.exe
  2⤵
  PID:7976
- C:\Windows\System\qKEQVyM.exe
  C:\Windows\System\qKEQVyM.exe
  2⤵
  PID:1792
- C:\Windows\System\UrKZRrO.exe
  C:\Windows\System\UrKZRrO.exe
  2⤵
  PID:6312
- C:\Windows\System\jffEjSz.exe
  C:\Windows\System\jffEjSz.exe
  2⤵
  PID:7388
- C:\Windows\System\cBhbbJw.exe
  C:\Windows\System\cBhbbJw.exe
  2⤵
  PID:7656
- C:\Windows\System\QsCtFrV.exe
  C:\Windows\System\QsCtFrV.exe
  2⤵
  PID:8136
- C:\Windows\System\qBmCmph.exe
  C:\Windows\System\qBmCmph.exe
  2⤵
  PID:7764
- C:\Windows\System\vMceJEV.exe
  C:\Windows\System\vMceJEV.exe
  2⤵
  PID:7052
- C:\Windows\System\nSrUjFJ.exe
  C:\Windows\System\nSrUjFJ.exe
  2⤵
  PID:8044
- C:\Windows\System\xAFrMdP.exe
  C:\Windows\System\xAFrMdP.exe
  2⤵
  PID:6528
- C:\Windows\System\hzPYQJq.exe
  C:\Windows\System\hzPYQJq.exe
  2⤵
  PID:8056
- C:\Windows\System\kOBoqdL.exe
  C:\Windows\System\kOBoqdL.exe
  2⤵
  PID:8012
- C:\Windows\System\baisqQZ.exe
  C:\Windows\System\baisqQZ.exe
  2⤵
  PID:7464
- C:\Windows\System\zjUIOpV.exe
  C:\Windows\System\zjUIOpV.exe
  2⤵
  PID:7608
- C:\Windows\System\AnmjXDR.exe
  C:\Windows\System\AnmjXDR.exe
  2⤵
  PID:6260
- C:\Windows\System\eLBxJty.exe
  C:\Windows\System\eLBxJty.exe
  2⤵
  PID:7560
- C:\Windows\System\fYDexWr.exe
  C:\Windows\System\fYDexWr.exe
  2⤵
  PID:7280
- C:\Windows\System\yavjYSD.exe
  C:\Windows\System\yavjYSD.exe
  2⤵
  PID:7040
- C:\Windows\System\MtSdUBl.exe
  C:\Windows\System\MtSdUBl.exe
  2⤵
  PID:2124
- C:\Windows\System\GnANdTN.exe
  C:\Windows\System\GnANdTN.exe
  2⤵
  PID:6364
- C:\Windows\System\kFYZaUT.exe
  C:\Windows\System\kFYZaUT.exe
  2⤵
  PID:8204
- C:\Windows\System\NnqJJQC.exe
  C:\Windows\System\NnqJJQC.exe
  2⤵
  PID:8220
- C:\Windows\System\rdfrjtj.exe
  C:\Windows\System\rdfrjtj.exe
  2⤵
  PID:8236
- C:\Windows\System\fnOKtIE.exe
  C:\Windows\System\fnOKtIE.exe
  2⤵
  PID:8252
- C:\Windows\System\XDTVHzw.exe
  C:\Windows\System\XDTVHzw.exe
  2⤵
  PID:8268
- C:\Windows\System\VPuwjHV.exe
  C:\Windows\System\VPuwjHV.exe
  2⤵
  PID:8284
- C:\Windows\System\EkrNjIu.exe
  C:\Windows\System\EkrNjIu.exe
  2⤵
  PID:8300
- C:\Windows\System\hnPlBom.exe
  C:\Windows\System\hnPlBom.exe
  2⤵
  PID:8316
- C:\Windows\System\civhcUQ.exe
  C:\Windows\System\civhcUQ.exe
  2⤵
  PID:8372
- C:\Windows\System\gJfEPTr.exe
  C:\Windows\System\gJfEPTr.exe
  2⤵
  PID:8412
- C:\Windows\System\XsrroKB.exe
  C:\Windows\System\XsrroKB.exe
  2⤵
  PID:8432
- C:\Windows\System\NkohAAU.exe
  C:\Windows\System\NkohAAU.exe
  2⤵
  PID:8456
- C:\Windows\System\VXzApXs.exe
  C:\Windows\System\VXzApXs.exe
  2⤵
  PID:8476
- C:\Windows\System\OvnzQXf.exe
  C:\Windows\System\OvnzQXf.exe
  2⤵
  PID:8492
- C:\Windows\System\oYIWCMU.exe
  C:\Windows\System\oYIWCMU.exe
  2⤵
  PID:8508
- C:\Windows\System\uvTOYoI.exe
  C:\Windows\System\uvTOYoI.exe
  2⤵
  PID:8524
- C:\Windows\System\VBwDrmP.exe
  C:\Windows\System\VBwDrmP.exe
  2⤵
  PID:8540
- C:\Windows\System\BMnTNcA.exe
  C:\Windows\System\BMnTNcA.exe
  2⤵
  PID:8560
- C:\Windows\System\WcVEyCs.exe
  C:\Windows\System\WcVEyCs.exe
  2⤵
  PID:8576
- C:\Windows\System\yrAWFqB.exe
  C:\Windows\System\yrAWFqB.exe
  2⤵
  PID:8596
- C:\Windows\System\ODDVVsD.exe
  C:\Windows\System\ODDVVsD.exe
  2⤵
  PID:8620
- C:\Windows\System\FxBntLu.exe
  C:\Windows\System\FxBntLu.exe
  2⤵
  PID:8644
- C:\Windows\System\XaVMgKF.exe
  C:\Windows\System\XaVMgKF.exe
  2⤵
  PID:8664
- C:\Windows\System\bkQHmCE.exe
  C:\Windows\System\bkQHmCE.exe
  2⤵
  PID:8680
- C:\Windows\System\tEtBGvH.exe
  C:\Windows\System\tEtBGvH.exe
  2⤵
  PID:8696
- C:\Windows\System\ukHzlis.exe
  C:\Windows\System\ukHzlis.exe
  2⤵
  PID:8716
- C:\Windows\System\ffocgCv.exe
  C:\Windows\System\ffocgCv.exe
  2⤵
  PID:8732
- C:\Windows\System\PJNFPpe.exe
  C:\Windows\System\PJNFPpe.exe
  2⤵
  PID:8748
- C:\Windows\System\OfaIrtv.exe
  C:\Windows\System\OfaIrtv.exe
  2⤵
  PID:8764
- C:\Windows\System\OEWeQlR.exe
  C:\Windows\System\OEWeQlR.exe
  2⤵
  PID:8780
- C:\Windows\System\sUzNnNw.exe
  C:\Windows\System\sUzNnNw.exe
  2⤵
  PID:8796
- C:\Windows\System\ootcKJl.exe
  C:\Windows\System\ootcKJl.exe
  2⤵
  PID:8812
- C:\Windows\System\WscYttS.exe
  C:\Windows\System\WscYttS.exe
  2⤵
  PID:8828
- C:\Windows\System\IEXKYvR.exe
  C:\Windows\System\IEXKYvR.exe
  2⤵
  PID:8844
- C:\Windows\System\VCvVOBL.exe
  C:\Windows\System\VCvVOBL.exe
  2⤵
  PID:8860
- C:\Windows\System\JGNMuxK.exe
  C:\Windows\System\JGNMuxK.exe
  2⤵
  PID:8876
- C:\Windows\System\mtkwrjo.exe
  C:\Windows\System\mtkwrjo.exe
  2⤵
  PID:8892
- C:\Windows\System\ruECjvO.exe
  C:\Windows\System\ruECjvO.exe
  2⤵
  PID:8908
- C:\Windows\System\qkONjzP.exe
  C:\Windows\System\qkONjzP.exe
  2⤵
  PID:8924
- C:\Windows\System\kVdQvFh.exe
  C:\Windows\System\kVdQvFh.exe
  2⤵
  PID:8996
- C:\Windows\System\JHsxYSF.exe
  C:\Windows\System\JHsxYSF.exe
  2⤵
  PID:9012
- C:\Windows\System\dJzAGrT.exe
  C:\Windows\System\dJzAGrT.exe
  2⤵
  PID:9032
- C:\Windows\System\QpLmAnk.exe
  C:\Windows\System\QpLmAnk.exe
  2⤵
  PID:9048
- C:\Windows\System\SOXQqRq.exe
  C:\Windows\System\SOXQqRq.exe
  2⤵
  PID:9108
- C:\Windows\System\LUsmQNc.exe
  C:\Windows\System\LUsmQNc.exe
  2⤵
  PID:9124
- C:\Windows\System\OLawFvd.exe
  C:\Windows\System\OLawFvd.exe
  2⤵
  PID:9140
- C:\Windows\System\WeRusaH.exe
  C:\Windows\System\WeRusaH.exe
  2⤵
  PID:9156
- C:\Windows\System\qqMkzNg.exe
  C:\Windows\System\qqMkzNg.exe
  2⤵
  PID:9172
- C:\Windows\System\EQxZIOX.exe
  C:\Windows\System\EQxZIOX.exe
  2⤵
  PID:9188
- C:\Windows\System\GrJApKM.exe
  C:\Windows\System\GrJApKM.exe
  2⤵
  PID:9204
- C:\Windows\System\XqAKpTW.exe
  C:\Windows\System\XqAKpTW.exe
  2⤵
  PID:6172
- C:\Windows\System\WnWuBZt.exe
  C:\Windows\System\WnWuBZt.exe
  2⤵
  PID:8248
- C:\Windows\System\cdtOtgn.exe
  C:\Windows\System\cdtOtgn.exe
  2⤵
  PID:8296
- C:\Windows\System\ekhfCet.exe
  C:\Windows\System\ekhfCet.exe
  2⤵
  PID:8312
- C:\Windows\System\BWDEWIP.exe
  C:\Windows\System\BWDEWIP.exe
  2⤵
  PID:8196
- C:\Windows\System\BjQuZGw.exe
  C:\Windows\System\BjQuZGw.exe
  2⤵
  PID:8232
- C:\Windows\System\gmNyZIq.exe
  C:\Windows\System\gmNyZIq.exe
  2⤵
  PID:8292
- C:\Windows\System\kRsVRfq.exe
  C:\Windows\System\kRsVRfq.exe
  2⤵
  PID:8340
- C:\Windows\System\HUzdIao.exe
  C:\Windows\System\HUzdIao.exe
  2⤵
  PID:8356
- C:\Windows\System\lvuHjDp.exe
  C:\Windows\System\lvuHjDp.exe
  2⤵
  PID:8400
- C:\Windows\System\uNjtKvL.exe
  C:\Windows\System\uNjtKvL.exe
  2⤵
  PID:8424
- C:\Windows\System\QTrzUpE.exe
  C:\Windows\System\QTrzUpE.exe
  2⤵
  PID:8440
- C:\Windows\System\lGRfRDc.exe
  C:\Windows\System\lGRfRDc.exe
  2⤵
  PID:8464
- C:\Windows\System\ZFxmTEH.exe
  C:\Windows\System\ZFxmTEH.exe
  2⤵
  PID:8500
- C:\Windows\System\dYxfbnB.exe
  C:\Windows\System\dYxfbnB.exe
  2⤵
  PID:8532
- C:\Windows\System\KLIYmob.exe
  C:\Windows\System\KLIYmob.exe
  2⤵
  PID:8568
- C:\Windows\System\iuiUlED.exe
  C:\Windows\System\iuiUlED.exe
  2⤵
  PID:8592
- C:\Windows\System\GfIFsWv.exe
  C:\Windows\System\GfIFsWv.exe
  2⤵
  PID:8608
- C:\Windows\System\VKPdZeL.exe
  C:\Windows\System\VKPdZeL.exe
  2⤵
  PID:8632
- C:\Windows\System\ItVKtGA.exe
  C:\Windows\System\ItVKtGA.exe
  2⤵
  PID:8676
- C:\Windows\System\oEEDYSr.exe
  C:\Windows\System\oEEDYSr.exe
  2⤵
  PID:8740
- C:\Windows\System\pyBulKZ.exe
  C:\Windows\System\pyBulKZ.exe
  2⤵
  PID:8808
- C:\Windows\System\NXeCSkw.exe
  C:\Windows\System\NXeCSkw.exe
  2⤵
  PID:8900
- C:\Windows\System\XbAVYie.exe
  C:\Windows\System\XbAVYie.exe
  2⤵
  PID:8936
- C:\Windows\System\QOKLZAx.exe
  C:\Windows\System\QOKLZAx.exe
  2⤵
  PID:8692
- C:\Windows\System\ADJZcFp.exe
  C:\Windows\System\ADJZcFp.exe
  2⤵
  PID:8688
- C:\Windows\System\RXRZCUn.exe
  C:\Windows\System\RXRZCUn.exe
  2⤵
  PID:8788
- C:\Windows\System\qvddJRB.exe
  C:\Windows\System\qvddJRB.exe
  2⤵
  PID:8964
- C:\Windows\System\fYErLVH.exe
  C:\Windows\System\fYErLVH.exe
  2⤵
  PID:8820
- C:\Windows\System\HwmtuQj.exe
  C:\Windows\System\HwmtuQj.exe
  2⤵
  PID:8952
- C:\Windows\System\NUcgxFQ.exe
  C:\Windows\System\NUcgxFQ.exe
  2⤵
  PID:8992
- C:\Windows\System\eqVfxvQ.exe
  C:\Windows\System\eqVfxvQ.exe
  2⤵
  PID:9060
- C:\Windows\System\wgDzqRC.exe
  C:\Windows\System\wgDzqRC.exe
  2⤵
  PID:9064
- C:\Windows\System\CINrFCt.exe
  C:\Windows\System\CINrFCt.exe
  2⤵
  PID:9068
- C:\Windows\System\wrDCBNo.exe
  C:\Windows\System\wrDCBNo.exe
  2⤵
  PID:9088
- C:\Windows\System\gfckiOk.exe
  C:\Windows\System\gfckiOk.exe
  2⤵
  PID:9136
- C:\Windows\System\uXVBClA.exe
  C:\Windows\System\uXVBClA.exe
  2⤵
  PID:9196
- C:\Windows\System\fgnOKbq.exe
  C:\Windows\System\fgnOKbq.exe
  2⤵
  PID:8244
- C:\Windows\System\rSaTIdA.exe
  C:\Windows\System\rSaTIdA.exe
  2⤵
  PID:8228
- C:\Windows\System\QOxCKJk.exe
  C:\Windows\System\QOxCKJk.exe
  2⤵
  PID:8392
- C:\Windows\System\UKHfLsN.exe
  C:\Windows\System\UKHfLsN.exe
  2⤵
  PID:8468
- C:\Windows\System\XBAdvkv.exe
  C:\Windows\System\XBAdvkv.exe
  2⤵
  PID:8276
- C:\Windows\System\IumFxWX.exe
  C:\Windows\System\IumFxWX.exe
  2⤵
  PID:8604
- C:\Windows\System\zhiJhsT.exe
  C:\Windows\System\zhiJhsT.exe
  2⤵
  PID:8352
- C:\Windows\System\jujzOka.exe
  C:\Windows\System\jujzOka.exe
  2⤵
  PID:8420
- C:\Windows\System\oqbUisu.exe
  C:\Windows\System\oqbUisu.exe
  2⤵
  PID:8156
- C:\Windows\System\XIqBzVn.exe
  C:\Windows\System\XIqBzVn.exe
  2⤵
  PID:9212
- C:\Windows\System\gaAuRDf.exe
  C:\Windows\System\gaAuRDf.exe
  2⤵
  PID:8872
- C:\Windows\System\YEHcZSx.exe
  C:\Windows\System\YEHcZSx.exe
  2⤵
  PID:8984
- C:\Windows\System\pnmAMiF.exe
  C:\Windows\System\pnmAMiF.exe
  2⤵
  PID:9040
- C:\Windows\System\xVOUjUJ.exe
  C:\Windows\System\xVOUjUJ.exe
  2⤵
  PID:8448
- C:\Windows\System\YatIhtA.exe
  C:\Windows\System\YatIhtA.exe
  2⤵
  PID:8520
- C:\Windows\System\pgjswhs.exe
  C:\Windows\System\pgjswhs.exe
  2⤵
  PID:8972
- C:\Windows\System\beqvrXN.exe
  C:\Windows\System\beqvrXN.exe
  2⤵
  PID:9072
- C:\Windows\System\PdKNdFd.exe
  C:\Windows\System\PdKNdFd.exe
  2⤵
  PID:8804
- C:\Windows\System\KEJgdcx.exe
  C:\Windows\System\KEJgdcx.exe
  2⤵
  PID:9200
- C:\Windows\System\TCxxsfX.exe
  C:\Windows\System\TCxxsfX.exe
  2⤵
  PID:8636
- C:\Windows\System\QNAbXzU.exe
  C:\Windows\System\QNAbXzU.exe
  2⤵
  PID:8080
- C:\Windows\System\yjthpVU.exe
  C:\Windows\System\yjthpVU.exe
  2⤵
  PID:8728
- C:\Windows\System\XrFBwWd.exe
  C:\Windows\System\XrFBwWd.exe
  2⤵
  PID:9168
- C:\Windows\System\yOeuDtl.exe
  C:\Windows\System\yOeuDtl.exe
  2⤵
  PID:9020
- C:\Windows\System\cswDnDp.exe
  C:\Windows\System\cswDnDp.exe
  2⤵
  PID:8708
- C:\Windows\System\XaKALFV.exe
  C:\Windows\System\XaKALFV.exe
  2⤵
  PID:9116
- C:\Windows\System\nYjdRsV.exe
  C:\Windows\System\nYjdRsV.exe
  2⤵
  PID:8672
- C:\Windows\System\pWXbtbd.exe
  C:\Windows\System\pWXbtbd.exe
  2⤵
  PID:8920
- C:\Windows\System\cexXcQI.exe
  C:\Windows\System\cexXcQI.exe
  2⤵
  PID:8884
- C:\Windows\System\yGHKvrf.exe
  C:\Windows\System\yGHKvrf.exe
  2⤵
  PID:7532
- C:\Windows\System\TsfBmYO.exe
  C:\Windows\System\TsfBmYO.exe
  2⤵
  PID:9008
- C:\Windows\System\WGfjsrO.exe
  C:\Windows\System\WGfjsrO.exe
  2⤵
  PID:8552
- C:\Windows\System\FDurYKL.exe
  C:\Windows\System\FDurYKL.exe
  2⤵
  PID:8368
- C:\Windows\System\YCFUjJm.exe
  C:\Windows\System\YCFUjJm.exe
  2⤵
  PID:8772
- C:\Windows\System\mTgQUfY.exe
  C:\Windows\System\mTgQUfY.exe
  2⤵
  PID:9120
- C:\Windows\System\OsNUfPO.exe
  C:\Windows\System\OsNUfPO.exe
  2⤵
  PID:8660
- C:\Windows\System\JulakSz.exe
  C:\Windows\System\JulakSz.exe
  2⤵
  PID:8212
- C:\Windows\System\HTjzQgX.exe
  C:\Windows\System\HTjzQgX.exe
  2⤵
  PID:8968
- C:\Windows\System\BBPwOSb.exe
  C:\Windows\System\BBPwOSb.exe
  2⤵
  PID:9220
- C:\Windows\System\RIGUDAU.exe
  C:\Windows\System\RIGUDAU.exe
  2⤵
  PID:9248
- C:\Windows\System\yUctZwn.exe
  C:\Windows\System\yUctZwn.exe
  2⤵
  PID:9264
- C:\Windows\System\FPneiXf.exe
  C:\Windows\System\FPneiXf.exe
  2⤵
  PID:9300
- C:\Windows\System\tcYFLoR.exe
  C:\Windows\System\tcYFLoR.exe
  2⤵
  PID:9320
- C:\Windows\System\xXuNZar.exe
  C:\Windows\System\xXuNZar.exe
  2⤵
  PID:9340
- C:\Windows\System\UKEBptl.exe
  C:\Windows\System\UKEBptl.exe
  2⤵
  PID:9356
- C:\Windows\System\mubQzdu.exe
  C:\Windows\System\mubQzdu.exe
  2⤵
  PID:9380
- C:\Windows\System\TypxGLi.exe
  C:\Windows\System\TypxGLi.exe
  2⤵
  PID:9400
- C:\Windows\System\vnwApkp.exe
  C:\Windows\System\vnwApkp.exe
  2⤵
  PID:9424
- C:\Windows\System\XFhKVzF.exe
  C:\Windows\System\XFhKVzF.exe
  2⤵
  PID:9440
- C:\Windows\System\VauzeKP.exe
  C:\Windows\System\VauzeKP.exe
  2⤵
  PID:9456
- C:\Windows\System\OsXVakL.exe
  C:\Windows\System\OsXVakL.exe
  2⤵
  PID:9472
- C:\Windows\System\ZpXrdmQ.exe
  C:\Windows\System\ZpXrdmQ.exe
  2⤵
  PID:9488
- C:\Windows\System\LdftLgF.exe
  C:\Windows\System\LdftLgF.exe
  2⤵
  PID:9504
- C:\Windows\System\KkBBiLv.exe
  C:\Windows\System\KkBBiLv.exe
  2⤵
  PID:9524
- C:\Windows\System\vYtopUL.exe
  C:\Windows\System\vYtopUL.exe
  2⤵
  PID:9540
- C:\Windows\System\EVzKBSo.exe
  C:\Windows\System\EVzKBSo.exe
  2⤵
  PID:9564
- C:\Windows\System\GybfENH.exe
  C:\Windows\System\GybfENH.exe
  2⤵
  PID:9584
- C:\Windows\System\wCKBOZw.exe
  C:\Windows\System\wCKBOZw.exe
  2⤵
  PID:9604
- C:\Windows\System\GGiaRuO.exe
  C:\Windows\System\GGiaRuO.exe
  2⤵
  PID:9620
- C:\Windows\System\KczaTSb.exe
  C:\Windows\System\KczaTSb.exe
  2⤵
  PID:9644
- C:\Windows\System\fpDEGIA.exe
  C:\Windows\System\fpDEGIA.exe
  2⤵
  PID:9668
- C:\Windows\System\IpqSCyW.exe
  C:\Windows\System\IpqSCyW.exe
  2⤵
  PID:9688
- C:\Windows\System\fBsKhTZ.exe
  C:\Windows\System\fBsKhTZ.exe
  2⤵
  PID:9708
- C:\Windows\System\nawKUHX.exe
  C:\Windows\System\nawKUHX.exe
  2⤵
  PID:9728
- C:\Windows\System\SbUkFrS.exe
  C:\Windows\System\SbUkFrS.exe
  2⤵
  PID:9748
- C:\Windows\System\KzcNxZs.exe
  C:\Windows\System\KzcNxZs.exe
  2⤵
  PID:9764
- C:\Windows\System\XSGFnzR.exe
  C:\Windows\System\XSGFnzR.exe
  2⤵
  PID:9780
- C:\Windows\System\dAEiObr.exe
  C:\Windows\System\dAEiObr.exe
  2⤵
  PID:9796
- C:\Windows\System\TAbuJsm.exe
  C:\Windows\System\TAbuJsm.exe
  2⤵
  PID:9816
- C:\Windows\System\AMygiGA.exe
  C:\Windows\System\AMygiGA.exe
  2⤵
  PID:9836
- C:\Windows\System\pyLsAxI.exe
  C:\Windows\System\pyLsAxI.exe
  2⤵
  PID:9852
- C:\Windows\System\QACzOjN.exe
  C:\Windows\System\QACzOjN.exe
  2⤵
  PID:9900
- C:\Windows\System\aKArCSE.exe
  C:\Windows\System\aKArCSE.exe
  2⤵
  PID:9920
- C:\Windows\System\gftGjma.exe
  C:\Windows\System\gftGjma.exe
  2⤵
  PID:9936
- C:\Windows\System\qTwYOeN.exe
  C:\Windows\System\qTwYOeN.exe
  2⤵
  PID:9952
- C:\Windows\System\LtAjOIB.exe
  C:\Windows\System\LtAjOIB.exe
  2⤵
  PID:9972
- C:\Windows\System\eYUUooS.exe
  C:\Windows\System\eYUUooS.exe
  2⤵
  PID:9988
- C:\Windows\System\nlrWHtP.exe
  C:\Windows\System\nlrWHtP.exe
  2⤵
  PID:10004
- C:\Windows\System\BBQzAsG.exe
  C:\Windows\System\BBQzAsG.exe
  2⤵
  PID:10024
- C:\Windows\System\ClTfiHP.exe
  C:\Windows\System\ClTfiHP.exe
  2⤵
  PID:10040
- C:\Windows\System\JkWArkJ.exe
  C:\Windows\System\JkWArkJ.exe
  2⤵
  PID:10056
- C:\Windows\System\avpToWj.exe
  C:\Windows\System\avpToWj.exe
  2⤵
  PID:10076
- C:\Windows\System\pJGvhoA.exe
  C:\Windows\System\pJGvhoA.exe
  2⤵
  PID:10096
- C:\Windows\System\KWsCzle.exe
  C:\Windows\System\KWsCzle.exe
  2⤵
  PID:10116
- C:\Windows\System\zDfizHm.exe
  C:\Windows\System\zDfizHm.exe
  2⤵
  PID:10136
- C:\Windows\System\uOVKmgo.exe
  C:\Windows\System\uOVKmgo.exe
  2⤵
  PID:10152
- C:\Windows\System\wwyqEPv.exe
  C:\Windows\System\wwyqEPv.exe
  2⤵
  PID:10168
- C:\Windows\System\tgHJfcI.exe
  C:\Windows\System\tgHJfcI.exe
  2⤵
  PID:10188
- C:\Windows\System\QfjVndT.exe
  C:\Windows\System\QfjVndT.exe
  2⤵
  PID:10208
- C:\Windows\System\TIwDZeL.exe
  C:\Windows\System\TIwDZeL.exe
  2⤵
  PID:10224
- C:\Windows\System\mfDRJTH.exe
  C:\Windows\System\mfDRJTH.exe
  2⤵
  PID:9284
- C:\Windows\System\veXJsZk.exe
  C:\Windows\System\veXJsZk.exe
  2⤵
  PID:9244
- C:\Windows\System\vtGIUVv.exe
  C:\Windows\System\vtGIUVv.exe
  2⤵
  PID:2944
- C:\Windows\System\IwQNBVL.exe
  C:\Windows\System\IwQNBVL.exe
  2⤵
  PID:9352
- C:\Windows\System\wnenwQb.exe
  C:\Windows\System\wnenwQb.exe
  2⤵
  PID:9388
- C:\Windows\System\azBdaCu.exe
  C:\Windows\System\azBdaCu.exe
  2⤵
  PID:9364
- C:\Windows\System\vMTewzT.exe
  C:\Windows\System\vMTewzT.exe
  2⤵
  PID:9416
- C:\Windows\System\xeSmqXd.exe
  C:\Windows\System\xeSmqXd.exe
  2⤵
  PID:9532
- C:\Windows\System\TUXlcgX.exe
  C:\Windows\System\TUXlcgX.exe
  2⤵
  PID:9468
- C:\Windows\System\VggHwBz.exe
  C:\Windows\System\VggHwBz.exe
  2⤵
  PID:9480
- C:\Windows\System\hFlZAzU.exe
  C:\Windows\System\hFlZAzU.exe
  2⤵
  PID:9556
- C:\Windows\System\mPqwVJp.exe
  C:\Windows\System\mPqwVJp.exe
  2⤵
  PID:9576
- C:\Windows\System\LSxNaka.exe
  C:\Windows\System\LSxNaka.exe
  2⤵
  PID:9656
- C:\Windows\System\DTjPUVJ.exe
  C:\Windows\System\DTjPUVJ.exe
  2⤵
  PID:9700
- C:\Windows\System\BEPXnEb.exe
  C:\Windows\System\BEPXnEb.exe
  2⤵
  PID:9744
- C:\Windows\System\uiXNjis.exe
  C:\Windows\System\uiXNjis.exe
  2⤵
  PID:9776
- C:\Windows\System\PHclEHQ.exe
  C:\Windows\System\PHclEHQ.exe
  2⤵
  PID:9596
- C:\Windows\System\sgjzfdN.exe
  C:\Windows\System\sgjzfdN.exe
  2⤵
  PID:9632
- C:\Windows\System\jEcpQOC.exe
  C:\Windows\System\jEcpQOC.exe
  2⤵
  PID:9724
- C:\Windows\System\IXFmybj.exe
  C:\Windows\System\IXFmybj.exe
  2⤵
  PID:9884
- C:\Windows\System\KjaUwFg.exe
  C:\Windows\System\KjaUwFg.exe
  2⤵
  PID:9908
- C:\Windows\System\bnwcGSl.exe
  C:\Windows\System\bnwcGSl.exe
  2⤵
  PID:9980
- C:\Windows\System\QHVtCNC.exe
  C:\Windows\System\QHVtCNC.exe
  2⤵
  PID:10020
- C:\Windows\System\qmzlkhl.exe
  C:\Windows\System\qmzlkhl.exe
  2⤵
  PID:9676
- C:\Windows\System\meezXXY.exe
  C:\Windows\System\meezXXY.exe
  2⤵
  PID:9892
- C:\Windows\System\SPEjHLG.exe
  C:\Windows\System\SPEjHLG.exe
  2⤵
  PID:10200
- C:\Windows\System\uCSnocY.exe
  C:\Windows\System\uCSnocY.exe
  2⤵
  PID:10108
- C:\Windows\System\yqNLbPo.exe
  C:\Windows\System\yqNLbPo.exe
  2⤵
  PID:10148
- C:\Windows\System\AnivOST.exe
  C:\Windows\System\AnivOST.exe
  2⤵
  PID:10220
- C:\Windows\System\YEiMmvF.exe
  C:\Windows\System\YEiMmvF.exe
  2⤵
  PID:8980
- C:\Windows\System\CeEsakU.exe
  C:\Windows\System\CeEsakU.exe
  2⤵
  PID:9132
- C:\Windows\System\UDAuQWa.exe
  C:\Windows\System\UDAuQWa.exe
  2⤵
  PID:9232
- C:\Windows\System\fbjPVAg.exe
  C:\Windows\System\fbjPVAg.exe
  2⤵
  PID:9276
- C:\Windows\System\kwPWPIL.exe
  C:\Windows\System\kwPWPIL.exe
  2⤵
  PID:9308

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\BfAddNd.exe

Filesize
3.3MB

MD5
0a721a84498a319430fc157971a7cd0c

SHA1
aeb5b26c7c1b5921536753cf4628fff3dd0264d7

SHA256
06548df662dc052ddfef91f9b24b08ac79b481d1bd178d8847a47ba32c11b4ff

SHA512
b17fb63afb1ceb6d384ccd2c0c8da7d6549d88bf6d384666c167e082dff6489b0bbc42bb563df32fbd00695bb5e7da7b7708b812d979331b95c926ce0899b83b

Download Submit
C:\Windows\system\FGkTbGy.exe

Filesize
8B

MD5
30a9dfceb37577cb23b97b50ee0ca790

SHA1
b56360a546aafbfa7ce003cd05916a7ab7239259

SHA256
44dda0d0cfe87b066fcb3ae3e2b0cbc86f86ca0fdd14c7ce736c7a63fedce1f4

SHA512
f1ae1743e6029aabc9e7387b476be46b30f000874bca6e0907b605cfb329a40abfc7d4eb3d891027c469be0356b370267e0531be7c50ab8183a5aad8ce1cbe57

Download Submit
C:\Windows\system\HCFBLmV.exe

Filesize
3.3MB

MD5
0e5f574735bda116d9fa7457b29b5174

SHA1
3acb08226a157d862c5a916929bf7995f4778a56

SHA256
64ac7731a30942fccf49c844540fa35086b950359c41a91c6ff90605a69ccc55

SHA512
579bc760df9144d0e2ea7c3ca3c9b064f8065d73a1662177f0f45bd20eba1c5238f4394df76d1b88d7ea8a45a47e40a5481f3fdaa0e04f237bcacd85f6b4f4fe

Download Submit
C:\Windows\system\IHfWdfh.exe

Filesize
3.3MB

MD5
45d9ce4f2ed38c90786f77bc0b163931

SHA1
0cf568601dfc242eb568e2f4f215a0e1f9ec5edd

SHA256
f632c6cbbfe0818abc8dbdd4ebae4930598127a773ee56771e45e02f2afec975

SHA512
071cb4b7b90db305fa0c2add80ce07004f207e7cefe54edf17551636924f411fd238e0d8d9efb22f054dd038cf197d746aed0c5266a9ed01080d842188f2bc69

Download Submit
C:\Windows\system\JrcHJKW.exe

Filesize
3.3MB

MD5
f07179b957bcc75db6baa34435f9e8a9

SHA1
63427d2460d6d7516e2476b800fea890619bc65e

SHA256
4bd32cb80a628d373b646a90f2374480e17e749c3511e46b9fa4a1c1d98e78ed

SHA512
ead599073b1080cdfedabb14d41cd81b9ed367cd82af7445f04c00e070d2c1ef1df79b8a9c3a1820bfeaac835acdd91de5ff10e7c533ac6e9817fa906aad8935

Download Submit
C:\Windows\system\KCuTiUV.exe

Filesize
3.3MB

MD5
30a7bced359156217a48346978cc3804

SHA1
ba7b4514882d8d73cb17e7838f8567b02160304e

SHA256
2c2f0287975f755d0efec67df8cffbb4b8d3c28c191988c061eac683a0007737

SHA512
c324b7c832e876fdcd8a060f5d3c7978cc06aa3ea447a91fd8bd483fe68dd9cfa4a7241e6c825176993260b70f9a76d1d8ebc2cd3b99452d526d815002aa9b41

Download Submit
C:\Windows\system\QlwnzXp.exe

Filesize
3.3MB

MD5
76db243429ba2060cf31919b36336c69

SHA1
2f9d774337c9591dbf3bfdc32d026925fd1b8cf8

SHA256
70bfd0070116babdc93c79dfe5fbcf9e1da4bb61429de1cf5dcde1e5dd16c617

SHA512
873f467783f9fca865f2c3986209f02075e680818aa1df0ce1c9037f2b76ed59e18114fa2f3d2ff3875b83d4c025bf1b067364ead601a4117f35bb74afd7db5b

Download Submit
C:\Windows\system\UAmwyhu.exe

Filesize
3.3MB

MD5
78a48f9f406ef973962b510cb4545e76

SHA1
9a66aa99ed57e79238f199541a8aca84259508bc

SHA256
27bf7a2e86f3ebb5c5bc956b1eb1487848e7c3fd81332946008670420ceff13b

SHA512
a9a0ee47fa0763b4b97747a522a91aeb801798156fd9cd86fc16fd56d7194eea0426a52b558ce03e651495a4eb9cb9b09fd2a1dd9c92c43dffb3519298510574

Download Submit
C:\Windows\system\UUWoVEx.exe

Filesize
3.3MB

MD5
fb2d30c699e446f10f54f3f7fac1ecc3

SHA1
594918b9d27930a702f8424ce32fa9c602040f13

SHA256
cc2cfdeeb780b9ae668079f1d1225369b5fbf6735c81dd856f6dde75180dc86f

SHA512
66d2af8c6b5cb8c577d1e048a2ca6bcc0b3e740b4c5341c93b094f9006d2f7d7c160208e675bd953e908f897bd2da8642336b4e8f4e3f7ac9fc22d2859addd93

Download Submit
C:\Windows\system\WmbaDoR.exe

Filesize
3.3MB

MD5
762b0fde89d6e40e67988d4d14333099

SHA1
a967b809f0689c2027d9536e30da9b3a5b63a82e

SHA256
b937d09878014d447cc9b4a38dca9e9ec87accb0e559e6b4dc70bf36af803421

SHA512
ef7ff41a6bc569d4e665823988db18579f3d02a201a609c6fb4fa035d90f4d9b3f9b2397a8ccc78c296bf18444d3e462d826f6ba75e2fc0cf912ab676e140913

Download Submit
C:\Windows\system\YlyCUrk.exe

Filesize
3.3MB

MD5
e753df8b4c415604c5cfbe2b2e698312

SHA1
8deeef7611a293ca7ca91b6f7ead72d8dc3f59c1

SHA256
4e0928106aefb55fd20eff4869f52c7ec1c13c032bc548b9675ebbeda0dc869b

SHA512
73de35e7a9d73b75cfbe476606221ba12e1fb3d5d0229a14ac0d419cb3b1826899736f9fbe5ecc5208370eabf3b3eb913e5fd282a0a5141e5bc33c2a9dc5e2c4

Download Submit
C:\Windows\system\ZJeTGNO.exe

Filesize
3.3MB

MD5
89844ad1b8498cbb5a198dc1d5d4e60e

SHA1
d084b276456e6ee69b6afaf62a3feef623aee291

SHA256
f8c4ae9f80b4570f9c1c68c02314f19bafd0785e99fc49bcde23bff4fef9f7c0

SHA512
e1b0ef16a4fcc8784ebf1416ef64d9d7fc57dfb6a31160ad42ce04728f8f53d354050f7490aae9a529c9fe787d7a9734b364a9cacc686a7563daf6a7098aead7

Download Submit
C:\Windows\system\adcrDXF.exe

Filesize
3.3MB

MD5
75cb4850b0e71ab1a8c793e6433b79a7

SHA1
e4e6b610c1557a985ce5e8748a81419d36941930

SHA256
9d454c66aba31ab9f8703094fbd32a7e83fe70e1ef6ccbc51422c3d9deae3bce

SHA512
78695fddb720716957b46b0623affe2c52f3b8b474abf3f8a1d17510b5e029e20869d6621fb351dd115923f20e6650b105bcd5fbca40f32e2a01851ea1fcc94a

Download Submit
C:\Windows\system\eNTHYGO.exe

Filesize
3.3MB

MD5
ba6e7c07f95c14cc7379c27770d0063f

SHA1
fd5626774feb55fc8a228c6f3ab674a9b02b9470

SHA256
f435f57a4e06b6777018b15e6952057f39a34a3369adcc9a56b505576977c5f3

SHA512
44d85622892807fae588d4e01ab083ab8b3fe978d1da7cf8893f117d128b740f30965dbd4052d844147be72d45c38c2177965ecdda43131b4cefc8c74ffbb9ed

Download Submit
C:\Windows\system\elLTwFR.exe

Filesize
3.3MB

MD5
b55ac3e6d50422f5c3263f44fa7e7c8b

SHA1
4ee89492f7f272cef4e09cc270dd8d235f1319dd

SHA256
af915968df06780b0670078d098f804b56242f813dc792db3fc437d9f5556fca

SHA512
5ad4454f2f28a03d9a897af3b83ed99a44015e4922835ec12ff7db4ae547ba34769b5cc105dc7071036826d66548b2fb8b4d1b0ba00e2545b3f81975472cb086

Download Submit
C:\Windows\system\inhxwdy.exe

Filesize
3.3MB

MD5
20bd7beb0f2bc40b5e407c8cb704e686

SHA1
e7325dea328a2cceafddd71474e1ceb8015acd19

SHA256
1f1b024b8c529d0c8186fe1cbcfaed4aa7e5ceded5bd1e06fb068ac6994ee9ba

SHA512
8450f05b9cf98517f0f7c76fd31c98028f3f9a516f950e5226ba45d2510d2491ca622d1fdf90c4a09ba632b18c76d7b0eea7e02aab2ccef91700b49efa9dc338

Download Submit
C:\Windows\system\oPTckVY.exe

Filesize
3.3MB

MD5
e83aece98f04e78c5c6031a9b587e64e

SHA1
773cd0b506ba2e2757f0876fa50579879fc69c6b

SHA256
724fb00cf72fea9a2678e99cbb81eeeff7dfc107c2b16a55b10440597a92b3b7

SHA512
24e5c121e0e3758d7b3393957e1a2239321ef8c4e8677d85bfa0782ffeac6be77e25e5471cd31902423b26ad26da7f006db96198685440bf15a025f2f98d74d5

Download Submit
C:\Windows\system\xILjVfM.exe

Filesize
3.3MB

MD5
7ab3e1bb78b50fe0a3239179a8d79e96

SHA1
f591871b84d7af954840ac8037acdf5ee734eab3

SHA256
0de58b5a4285aa44a9a0c25b7781c132fd786627659c3891e47dbe422b1d5064

SHA512
05f43ca39ab66cf4f15602eb860cbbc339342dd16f7a406dbea21ed58459e9c37b05b5c8ea9b5e6367f09755eaec08cab7bb71ca05bfa89c4422d1025b534e30

Download Submit
C:\Windows\system\yvCMBtR.exe

Filesize
3.3MB

MD5
813cd04cfb974c1f11d42c2e4542f554

SHA1
097e0227450f2510d7fba73cfd83e54ba09a04ee

SHA256
67fa19f9bd9f09a50163fc2df8a6494c2df2071b214433aaba4c6e8ee536a265

SHA512
52ec9e28eb6e51e999b1fe3b873d7026368e0d1b66dd85063d4b2dbdb9dd4db3bec2ef120c2588e47bc0205936373d8ced3260cb4b11a7adf5415e9811bac958

Download Submit
\Windows\system\AufDvXz.exe

Filesize
3.3MB

MD5
df8c03d8ac8eee63968b2b1451d51033

SHA1
4ddac421852dde63053fba5ff8b14f6a4948bc8e

SHA256
125e0ab66b8f5128cbad4605bded7a6c580bf5ce37ab0309e190f211ef9ba40f

SHA512
d50b6fd856e83f8791e81b8e3e35d9f4e9521e5faf3ad87784dd8c0079c5dedbed8f2b2d7eeac820187907127d8b5a2b34e28e4fe13326d0330434d9c3386d75

Download Submit
\Windows\system\CrobDVm.exe

Filesize
3.3MB

MD5
84bf28f1a1af10fc4aaf07bbcd7a578c

SHA1
c13a115c8ec55e000026a4efbebfe12308aefeb4

SHA256
879d904c9b6be0f009ab7215d2f1c8b10d5b073b13fa6ab4fbe6fd2998c63244

SHA512
e508b8d38df65c162a7ac5e21ac5850edbbfc7fb05cf8cb837420b967507ae3d838597c63d4278e14730cbea8b807139b85c2dbec070af853cdfab74c1b0f7e2

Download Submit
\Windows\system\CsutGkA.exe

Filesize
3.3MB

MD5
07167dba61d2c4ca871dd3241ba4ac94

SHA1
1eae8885a9b14dc8e132e1891d9c4cf4fa441a42

SHA256
20632d89653fab641aa8c154bd1bb2fa2287a5e4c6f7f4aaf83a65f0be581886

SHA512
25471f9d7276a57fb952b22db9c860342314a0ef8d5003cb19ea7bb924eef0ec801a8df2059d32530d9c453e526bd1d8ab66485047428b70ca32b8ae64616e0c

Download Submit
\Windows\system\HOoPwjR.exe

Filesize
3.3MB

MD5
591afa669cea294128f61b861a045bbc

SHA1
f92f8f5af47bf043d1469a11ed3290ae3b7162e6

SHA256
b18dbc69d589832bde847f8df35dcc0a3e5ade7e7e514c217307866b89db7ef9

SHA512
0e8a43561b6818e309d9d80ddb4f2d219ae0f92d4d13ec8e56004060a23d2ea5a0a013a17d768a66ebd397ace9c84bcf4407817df8865c9ff5236fd8a354c733

Download Submit
\Windows\system\MPxeQSy.exe

Filesize
3.3MB

MD5
590581b746c6a4752047d47a09141d79

SHA1
222b10098223e659ef815cffe4e552c37dfad6b2

SHA256
c21bc9b3436d74241647b5f7d0c982460a227a26a3c0fd72a1688c50561ae5e3

SHA512
073519036241ceb0cec7f09e31fbdf9333e16d14937ac7cfde2144c372c9e247567a8b7d2f597c270d8018c4132cfb3e8aef399b673fd5f255b830d48ec4cf1e

Download Submit
\Windows\system\PGoLVCZ.exe

Filesize
3.3MB

MD5
8fb418eb4697fd8fda1979032f0cc269

SHA1
4bbf3e2b4c55fc7ac18cf2e084d2dc454ae5f132

SHA256
c47cbf93c63e6c41e27b8fc04dd8445abf8201676ba41d5d89dce8dbda27a0d7

SHA512
759912d489aff802efb323f8ead8ad926372c5ce4a5f462524f21c7b4f9e778498cde123930b71e877c4f538e42f5827832ec908edb7326fd9c8bafc64a5526b

Download Submit
\Windows\system\SQACTLL.exe

Filesize
3.3MB

MD5
54d1a23317d1cd7952dcea38c2b5dd22

SHA1
06c94f465df2025a2b06f8d439cf9f36c1e1f891

SHA256
2cce2f824abe08b8b9086ab52bbadb473e1e9329291d419bcab3eea4551dd2e1

SHA512
2d29cb2554131a53a11d3438a0f6b128fc629ebbb7372dd0d2cadf92934bfe5dbdc0fbe5e58f8f8d59d7d7de88e441a1023ea6c7d61ad13cedb9092fcd662b21

Download Submit
\Windows\system\URevfTy.exe

Filesize
3.3MB

MD5
ede0ba88ce438ae861efd67719f1591e

SHA1
0af1f3e980a3c8b14588a4e33a70f8456d1d9275

SHA256
3e6ddb6162b9abfd45fba37a3890af5ad53162337c9b96fcf9f0c3cdd3a92967

SHA512
bc524868d2f5acabe57e3364a07ff1138a866ec1ab2be0659f0fdfdef94d51a2e13d68d67904af5224ad14ccdd68f51cc72cda71b7619a3aec48242ea2999daa

Download Submit
\Windows\system\VRvHmQC.exe

Filesize
3.3MB

MD5
7598ba65effc4c548794259d4218cae8

SHA1
e13402ff253cf132f5429e02f211096c6f6d094b

SHA256
3df18782b2251d2999ab8104bd3689d67b86823f173537b98eb415d81291ba0d

SHA512
60af5905b273c5542ec51d16ce87dc63265d1289c33bfc9154ae68995a53f2cbd0d5d1c2e2265b3652c98406d13c471e49ef63f5c743c6bd32b36e6ad33e649f

Download Submit
\Windows\system\YIpGmUH.exe

Filesize
3.3MB

MD5
e2afcdafb7be583bef8eeace8bab0409

SHA1
be399640b094bc40d43f307abe3748c009dc8ac4

SHA256
96c6e6a336b5861030e08c9952ee6c1ebcbd1c50b28540928eb53fe38fa299a7

SHA512
6f3796a127519d97bad2d91301d2610395c1e7b1d04bc998f0d4651407b588f9b9632f64b7d5de5b182286024815e4ec30d6dad827f0db21a814d087f51b69ac

Download Submit
\Windows\system\gMGAVfG.exe

Filesize
3.3MB

MD5
14ddcff3ecb0ff72503b776c86afeb24

SHA1
049722a0e14661be5c6dee306214dd1ac998a7aa

SHA256
82ce9a9b70ed66643245514203ada8f23dc14d4a7ff0fd5a042440903b671f20

SHA512
b7fc7029658ad12aabc478a18331c8fe90b0fc399684aadb7899c28b0ece3d4c4829db666cf1db1dbed004d75935b5caccc4da537fa80d66ef4f4a295d3e3d75

Download Submit
\Windows\system\lThjjVj.exe

Filesize
3.3MB

MD5
3f9fad992cb508c2f618e4789cb38904

SHA1
2d75968d7273264a139e1af1781b92e0f3adbb88

SHA256
33c65f4ad1e9fcbf858efbfbc8bf87424d13f96669f55e8fa7fbfb5adf718357

SHA512
9d47825b6c78d104d5bf4fc84c819443cc5e6d879e2868cc8cbddc9694b308ac883b12555ca3b31162b1b69b617a35f012efd24fc5a264051b7e35c24b9922e2

Download Submit
\Windows\system\mQTvOUx.exe

Filesize
3.3MB

MD5
bf123751ca7e657fbd0ed31ebc0efce4

SHA1
e90708e680a896d4815ef646fda16be44d26ce73

SHA256
608d1d265cd8656096eb6df76e64d2a3efacd081ff025cec858c0f4c3cf0bd9d

SHA512
6dfb18b2d40c3f5094ab55b9883f9fb60eece185532dc9910ae8de6c006c3b5ac15089f1d2e624fbf8b3c6a5c5f566e16838664f06f1cb7a6b3ce5afe37910be

Download Submit
\Windows\system\ncsUdtO.exe

Filesize
3.3MB

MD5
2ce85c0fd1a80d5819c91be0e4d97a4b

SHA1
4699a70cbd4ee2f9840727712ae89e9a665c7586

SHA256
b88e1860808a1c61bd645096294e3059b6fca38b47175eede4b01c038fe785b2

SHA512
dad1eeaac8eb7eb40faa66825825cc56f46beb1cff748076234ddc8d9fa9a4b2e8a859ddd0e938c1b01eef1c5aa31019f0d0c3df32a81394301984386a28ba1b

Download Submit
memory/296-116-0x000000013F6E0000-0x000000013FAD6000-memory.dmp

Filesize
4.0MB

Download
memory/2064-90-0x000000013F400000-0x000000013F7F6000-memory.dmp

Filesize
4.0MB

Download
memory/2456-104-0x000000013F3A0000-0x000000013F796000-memory.dmp

Filesize
4.0MB

Download
memory/2532-109-0x000000013F560000-0x000000013F956000-memory.dmp

Filesize
4.0MB

Download
memory/2660-85-0x000000013F470000-0x000000013F866000-memory.dmp

Filesize
4.0MB

Download
memory/2716-95-0x000000013F610000-0x000000013FA06000-memory.dmp

Filesize
4.0MB

Download
memory/2728-92-0x000000013F5C0000-0x000000013F9B6000-memory.dmp

Filesize
4.0MB

Download
memory/2812-86-0x000000013F7C0000-0x000000013FBB6000-memory.dmp

Filesize
4.0MB

Download
memory/2876-124-0x0000000003640000-0x0000000003A36000-memory.dmp

Filesize
4.0MB

Download
memory/2876-93-0x0000000003640000-0x0000000003A36000-memory.dmp

Filesize
4.0MB

Download
memory/2876-4615-0x0000000003640000-0x0000000003A36000-memory.dmp

Filesize
4.0MB

Download
memory/2876-4597-0x000000013F7C0000-0x000000013FBB6000-memory.dmp

Filesize
4.0MB

Download
memory/2876-4598-0x0000000003640000-0x0000000003A36000-memory.dmp

Filesize
4.0MB

Download
memory/2876-3986-0x0000000003640000-0x0000000003A36000-memory.dmp

Filesize
4.0MB

Download
memory/2876-120-0x0000000003420000-0x0000000003816000-memory.dmp

Filesize
4.0MB

Download
memory/2876-119-0x0000000003640000-0x0000000003A36000-memory.dmp

Filesize
4.0MB

Download
memory/2876-0-0x0000000000180000-0x0000000000190000-memory.dmp

Filesize
64KB

Download
memory/2876-7-0x0000000003420000-0x0000000003816000-memory.dmp

Filesize
4.0MB

Download
memory/2876-1-0x000000013F2D0000-0x000000013F6C6000-memory.dmp

Filesize
4.0MB

Download
memory/2876-103-0x0000000003640000-0x0000000003A36000-memory.dmp

Filesize
4.0MB

Download
memory/2876-123-0x0000000003640000-0x0000000003A36000-memory.dmp

Filesize
4.0MB

Download
memory/2876-122-0x000000013F7C0000-0x000000013FBB6000-memory.dmp

Filesize
4.0MB

Download
memory/2876-3606-0x000000013F2D0000-0x000000013F6C6000-memory.dmp

Filesize
4.0MB

Download
memory/2876-106-0x0000000003640000-0x0000000003A36000-memory.dmp

Filesize
4.0MB

Download
memory/2876-108-0x000000013F6E0000-0x000000013FAD6000-memory.dmp

Filesize
4.0MB

Download
memory/2876-89-0x0000000003640000-0x0000000003A36000-memory.dmp

Filesize
4.0MB

Download
memory/2876-91-0x0000000003640000-0x0000000003A36000-memory.dmp

Filesize
4.0MB

Download
memory/2876-110-0x000000013FCC0000-0x00000001400B6000-memory.dmp

Filesize
4.0MB

Download
memory/2892-114-0x000000013F420000-0x000000013F816000-memory.dmp

Filesize
4.0MB

Download
memory/2936-84-0x000007FEF5E20000-0x000007FEF67BD000-memory.dmp

Filesize
9.6MB

Download
memory/2936-50-0x000007FEF5E20000-0x000007FEF67BD000-memory.dmp

Filesize
9.6MB

Download
memory/2936-45-0x0000000002340000-0x0000000002348000-memory.dmp

Filesize
32KB

Download
memory/2936-100-0x000007FEF5E20000-0x000007FEF67BD000-memory.dmp

Filesize
9.6MB

Download
memory/2936-40-0x000000001B630000-0x000000001B912000-memory.dmp

Filesize
2.9MB

Download
memory/2936-132-0x000007FEF5E20000-0x000007FEF67BD000-memory.dmp

Filesize
9.6MB

Download
memory/2936-18-0x000007FEF60DE000-0x000007FEF60DF000-memory.dmp

Filesize
4KB

Download
memory/2936-70-0x000007FEF5E20000-0x000007FEF67BD000-memory.dmp

Filesize
9.6MB

Download
memory/3048-3607-0x000000013F180000-0x000000013F576000-memory.dmp

Filesize
4.0MB

Download
memory/3048-17-0x000000013F180000-0x000000013F576000-memory.dmp

Filesize
4.0MB

Download