xmrig | 02061b2acfec187a3c0eef23f8675c7d8800280849c83bcf1719eb576752ce00

Analysis

max time kernel
150s
max time network
146s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
08/05/2024, 09:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

41d18a1be43460e187d7d0112cfc3070_NEIKI.exe
Size

1.9MB
MD5

41d18a1be43460e187d7d0112cfc3070
SHA1

ad6c21e5337aa26989a4a1d2aa0d298e0e242530
SHA256

02061b2acfec187a3c0eef23f8675c7d8800280849c83bcf1719eb576752ce00
SHA512

c0963ee800d283f131d155466e0e09b7cc8954ded3b3b4ea8fe61e905532bab9bfaecd9391a1869e019f6f735d7cc1950c474415dd377330a6b8a4bdc85be258
SSDEEP

49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1V6Gmjxj:NAB5

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 22 IoCs

miner

resource	yara_rule
behavioral1/memory/2984-9-0x000000013FDA0000-0x0000000140192000-memory.dmp	xmrig
behavioral1/memory/2884-44-0x000000013F6D0000-0x000000013FAC2000-memory.dmp	xmrig
behavioral1/memory/2632-39-0x000000013FAC0000-0x000000013FEB2000-memory.dmp	xmrig
behavioral1/memory/1640-32-0x000000013FA90000-0x000000013FE82000-memory.dmp	xmrig
behavioral1/memory/2920-51-0x0000000003120000-0x0000000003512000-memory.dmp	xmrig
behavioral1/memory/2872-54-0x000000013FE10000-0x0000000140202000-memory.dmp	xmrig
behavioral1/memory/2748-56-0x000000013F0C0000-0x000000013F4B2000-memory.dmp	xmrig
behavioral1/memory/2420-59-0x000000013F0B0000-0x000000013F4A2000-memory.dmp	xmrig
behavioral1/memory/2456-61-0x000000013F620000-0x000000013FA12000-memory.dmp	xmrig
behavioral1/memory/2824-83-0x000000013F030000-0x000000013F422000-memory.dmp	xmrig
behavioral1/memory/1808-85-0x000000013FF60000-0x0000000140352000-memory.dmp	xmrig
behavioral1/memory/2696-139-0x000000013F1C0000-0x000000013F5B2000-memory.dmp	xmrig
behavioral1/memory/2076-79-0x000000013FB70000-0x000000013FF62000-memory.dmp	xmrig
behavioral1/memory/2920-3666-0x000000013FDD0000-0x00000001401C2000-memory.dmp	xmrig
behavioral1/memory/2872-4199-0x000000013FE10000-0x0000000140202000-memory.dmp	xmrig
behavioral1/memory/2456-4228-0x000000013F620000-0x000000013FA12000-memory.dmp	xmrig
behavioral1/memory/1640-4216-0x000000013FA90000-0x000000013FE82000-memory.dmp	xmrig
behavioral1/memory/2748-4260-0x000000013F0C0000-0x000000013F4B2000-memory.dmp	xmrig
behavioral1/memory/2420-4264-0x000000013F0B0000-0x000000013F4A2000-memory.dmp	xmrig
behavioral1/memory/2076-4274-0x000000013FB70000-0x000000013FF62000-memory.dmp	xmrig
behavioral1/memory/1808-4284-0x000000013FF60000-0x0000000140352000-memory.dmp	xmrig
behavioral1/memory/2824-4277-0x000000013F030000-0x000000013F422000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
2744	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
2984	dCTbcpg.exe
1640	wqAqhHl.exe
2632	mxXedPj.exe
2884	sdlgxRE.exe
2872	khunVTa.exe
2748	ManuvAL.exe
2456	UcDdGne.exe
2420	xOwaDWy.exe
2076	vvmlyMo.exe
2824	mWHYTiK.exe
1808	OXwVfDs.exe
2696	PBjSZiT.exe
1968	YtGHJwM.exe
2168	ksWWzXC.exe
2668	fuGxLnj.exe
2508	vkTLJdT.exe
1516	JRblQCR.exe
2520	FOQSrMa.exe
2008	eEacCbj.exe
1556	BFuFOCc.exe
2600	vGjTyOl.exe
344	HcFeuWU.exe
1420	RZFhbtD.exe
1912	wXyBZxG.exe
2252	IBKTqYz.exe
2612	sGWWFxn.exe
1928	RXdfzQq.exe
268	NZMsLZp.exe
776	rutVwxw.exe
1172	AMFrBqT.exe
1484	LcuwlSE.exe
2084	suyLldU.exe
580	ZryRJLD.exe
1856	UzmGGpI.exe
1944	qLSWTiM.exe
412	hqUtQTq.exe
1140	czVNkow.exe
1164	YZzNcyq.exe
2368	dcdJCXx.exe
1312	aYyaKxf.exe
1372	KoeofMQ.exe
1984	ZGfJqik.exe
1568	VmdjxTN.exe
1348	uuvTKSF.exe
1868	BVyAHfv.exe
1992	YGFfvpH.exe
2912	pCriMDy.exe
1428	zkDxuyL.exe
2040	leAgPlE.exe
880	oQhzqVQ.exe
1692	SoEIKbN.exe
2380	CTmKPSc.exe
1548	hpiicBU.exe
2272	RpbWVsf.exe
2088	HjmVjOs.exe
2652	CcFPQFM.exe
2732	NaWHxGv.exe
2940	nKVstuf.exe
2716	GszmZns.exe
2464	GfJfTWa.exe
2568	wOnnNFc.exe
2484	TDUJKPZ.exe
2828	hKJqfyk.exe
848	dJsYkWF.exe

Loads dropped DLL 64 IoCs

pid	Process
2920	41d18a1be43460e187d7d0112cfc3070_NEIKI.exe
2920	41d18a1be43460e187d7d0112cfc3070_NEIKI.exe
2920	41d18a1be43460e187d7d0112cfc3070_NEIKI.exe
2920	41d18a1be43460e187d7d0112cfc3070_NEIKI.exe
2920	41d18a1be43460e187d7d0112cfc3070_NEIKI.exe
2920	41d18a1be43460e187d7d0112cfc3070_NEIKI.exe
2920	41d18a1be43460e187d7d0112cfc3070_NEIKI.exe
2920	41d18a1be43460e187d7d0112cfc3070_NEIKI.exe
2920	41d18a1be43460e187d7d0112cfc3070_NEIKI.exe
2920	41d18a1be43460e187d7d0112cfc3070_NEIKI.exe
2920	41d18a1be43460e187d7d0112cfc3070_NEIKI.exe
2920	41d18a1be43460e187d7d0112cfc3070_NEIKI.exe
2920	41d18a1be43460e187d7d0112cfc3070_NEIKI.exe
2920	41d18a1be43460e187d7d0112cfc3070_NEIKI.exe
2920	41d18a1be43460e187d7d0112cfc3070_NEIKI.exe
2920	41d18a1be43460e187d7d0112cfc3070_NEIKI.exe
2920	41d18a1be43460e187d7d0112cfc3070_NEIKI.exe
2920	41d18a1be43460e187d7d0112cfc3070_NEIKI.exe
2920	41d18a1be43460e187d7d0112cfc3070_NEIKI.exe
2920	41d18a1be43460e187d7d0112cfc3070_NEIKI.exe
2920	41d18a1be43460e187d7d0112cfc3070_NEIKI.exe
2920	41d18a1be43460e187d7d0112cfc3070_NEIKI.exe
2920	41d18a1be43460e187d7d0112cfc3070_NEIKI.exe
2920	41d18a1be43460e187d7d0112cfc3070_NEIKI.exe
2920	41d18a1be43460e187d7d0112cfc3070_NEIKI.exe
2920	41d18a1be43460e187d7d0112cfc3070_NEIKI.exe
2920	41d18a1be43460e187d7d0112cfc3070_NEIKI.exe
2920	41d18a1be43460e187d7d0112cfc3070_NEIKI.exe
2920	41d18a1be43460e187d7d0112cfc3070_NEIKI.exe
2920	41d18a1be43460e187d7d0112cfc3070_NEIKI.exe
2920	41d18a1be43460e187d7d0112cfc3070_NEIKI.exe
2920	41d18a1be43460e187d7d0112cfc3070_NEIKI.exe
2920	41d18a1be43460e187d7d0112cfc3070_NEIKI.exe
2920	41d18a1be43460e187d7d0112cfc3070_NEIKI.exe
2920	41d18a1be43460e187d7d0112cfc3070_NEIKI.exe
2920	41d18a1be43460e187d7d0112cfc3070_NEIKI.exe
2920	41d18a1be43460e187d7d0112cfc3070_NEIKI.exe
2920	41d18a1be43460e187d7d0112cfc3070_NEIKI.exe
2920	41d18a1be43460e187d7d0112cfc3070_NEIKI.exe
2920	41d18a1be43460e187d7d0112cfc3070_NEIKI.exe
2920	41d18a1be43460e187d7d0112cfc3070_NEIKI.exe
2920	41d18a1be43460e187d7d0112cfc3070_NEIKI.exe
2920	41d18a1be43460e187d7d0112cfc3070_NEIKI.exe
2920	41d18a1be43460e187d7d0112cfc3070_NEIKI.exe
2920	41d18a1be43460e187d7d0112cfc3070_NEIKI.exe
2920	41d18a1be43460e187d7d0112cfc3070_NEIKI.exe
2920	41d18a1be43460e187d7d0112cfc3070_NEIKI.exe
2920	41d18a1be43460e187d7d0112cfc3070_NEIKI.exe
2920	41d18a1be43460e187d7d0112cfc3070_NEIKI.exe
2920	41d18a1be43460e187d7d0112cfc3070_NEIKI.exe
2920	41d18a1be43460e187d7d0112cfc3070_NEIKI.exe
2920	41d18a1be43460e187d7d0112cfc3070_NEIKI.exe
2920	41d18a1be43460e187d7d0112cfc3070_NEIKI.exe
2920	41d18a1be43460e187d7d0112cfc3070_NEIKI.exe
2920	41d18a1be43460e187d7d0112cfc3070_NEIKI.exe
2920	41d18a1be43460e187d7d0112cfc3070_NEIKI.exe
2920	41d18a1be43460e187d7d0112cfc3070_NEIKI.exe
2920	41d18a1be43460e187d7d0112cfc3070_NEIKI.exe
2920	41d18a1be43460e187d7d0112cfc3070_NEIKI.exe
2920	41d18a1be43460e187d7d0112cfc3070_NEIKI.exe
2920	41d18a1be43460e187d7d0112cfc3070_NEIKI.exe
2920	41d18a1be43460e187d7d0112cfc3070_NEIKI.exe
2920	41d18a1be43460e187d7d0112cfc3070_NEIKI.exe
2920	41d18a1be43460e187d7d0112cfc3070_NEIKI.exe

UPX packed file 54 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2920-1-0x000000013FDD0000-0x00000001401C2000-memory.dmp	upx
behavioral1/files/0x000b0000000160cc-4.dat	upx
behavioral1/memory/2984-9-0x000000013FDA0000-0x0000000140192000-memory.dmp	upx
behavioral1/files/0x0033000000016813-13.dat	upx
behavioral1/files/0x0007000000016c42-17.dat	upx
behavioral1/files/0x0007000000016c8c-18.dat	upx
behavioral1/files/0x0007000000016cb2-25.dat	upx
behavioral1/files/0x0007000000016ce4-28.dat	upx
behavioral1/files/0x0009000000016cfd-30.dat	upx
behavioral1/memory/2884-44-0x000000013F6D0000-0x000000013FAC2000-memory.dmp	upx
behavioral1/files/0x000600000001744c-47.dat	upx
behavioral1/memory/2632-39-0x000000013FAC0000-0x000000013FEB2000-memory.dmp	upx
behavioral1/memory/1640-32-0x000000013FA90000-0x000000013FE82000-memory.dmp	upx
behavioral1/memory/2872-54-0x000000013FE10000-0x0000000140202000-memory.dmp	upx
behavioral1/memory/2748-56-0x000000013F0C0000-0x000000013F4B2000-memory.dmp	upx
behavioral1/memory/2420-59-0x000000013F0B0000-0x000000013F4A2000-memory.dmp	upx
behavioral1/memory/2456-61-0x000000013F620000-0x000000013FA12000-memory.dmp	upx
behavioral1/files/0x00070000000173e5-76.dat	upx
behavioral1/memory/2824-83-0x000000013F030000-0x000000013F422000-memory.dmp	upx
behavioral1/memory/1808-85-0x000000013FF60000-0x0000000140352000-memory.dmp	upx
behavioral1/files/0x0009000000018640-135.dat	upx
behavioral1/files/0x00050000000186d3-119.dat	upx
behavioral1/files/0x000500000001874c-142.dat	upx
behavioral1/files/0x0005000000019223-150.dat	upx
behavioral1/files/0x0005000000019227-154.dat	upx
behavioral1/files/0x0005000000019233-158.dat	upx
behavioral1/files/0x0005000000019248-164.dat	upx
behavioral1/files/0x0005000000019331-174.dat	upx
behavioral1/files/0x0005000000019254-170.dat	upx
behavioral1/files/0x0005000000019235-162.dat	upx
behavioral1/files/0x0005000000018700-141.dat	upx
behavioral1/memory/2696-139-0x000000013F1C0000-0x000000013F5B2000-memory.dmp	upx
behavioral1/files/0x00050000000186c1-138.dat	upx
behavioral1/files/0x00050000000191eb-136.dat	upx
behavioral1/files/0x00050000000191ed-145.dat	upx
behavioral1/files/0x00060000000175b8-130.dat	upx
behavioral1/files/0x000500000001874a-129.dat	upx
behavioral1/files/0x000500000001865a-118.dat	upx
behavioral1/files/0x00060000000175ac-89.dat	upx
behavioral1/files/0x0006000000018bba-133.dat	upx
behavioral1/files/0x001500000001863c-101.dat	upx
behavioral1/files/0x00060000000175b2-92.dat	upx
behavioral1/files/0x0033000000016a6f-81.dat	upx
behavioral1/memory/2076-79-0x000000013FB70000-0x000000013FF62000-memory.dmp	upx
behavioral1/files/0x001800000000558a-67.dat	upx
behavioral1/memory/2920-3666-0x000000013FDD0000-0x00000001401C2000-memory.dmp	upx
behavioral1/memory/2872-4199-0x000000013FE10000-0x0000000140202000-memory.dmp	upx
behavioral1/memory/2456-4228-0x000000013F620000-0x000000013FA12000-memory.dmp	upx
behavioral1/memory/1640-4216-0x000000013FA90000-0x000000013FE82000-memory.dmp	upx
behavioral1/memory/2748-4260-0x000000013F0C0000-0x000000013F4B2000-memory.dmp	upx
behavioral1/memory/2420-4264-0x000000013F0B0000-0x000000013F4A2000-memory.dmp	upx
behavioral1/memory/2076-4274-0x000000013FB70000-0x000000013FF62000-memory.dmp	upx
behavioral1/memory/1808-4284-0x000000013FF60000-0x0000000140352000-memory.dmp	upx
behavioral1/memory/2824-4277-0x000000013F030000-0x000000013F422000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\sFxiEMs.exe	41d18a1be43460e187d7d0112cfc3070_NEIKI.exe
File created	C:\Windows\System\eEmJFqH.exe	41d18a1be43460e187d7d0112cfc3070_NEIKI.exe
File created	C:\Windows\System\SkKYnQy.exe	41d18a1be43460e187d7d0112cfc3070_NEIKI.exe
File created	C:\Windows\System\QTbcgkz.exe	41d18a1be43460e187d7d0112cfc3070_NEIKI.exe
File created	C:\Windows\System\zSotqVk.exe	41d18a1be43460e187d7d0112cfc3070_NEIKI.exe
File created	C:\Windows\System\nJwpqIA.exe	41d18a1be43460e187d7d0112cfc3070_NEIKI.exe
File created	C:\Windows\System\ZrVcFBq.exe	41d18a1be43460e187d7d0112cfc3070_NEIKI.exe
File created	C:\Windows\System\hyWCveI.exe	41d18a1be43460e187d7d0112cfc3070_NEIKI.exe
File created	C:\Windows\System\TDUJKPZ.exe	41d18a1be43460e187d7d0112cfc3070_NEIKI.exe
File created	C:\Windows\System\fzGrnsq.exe	41d18a1be43460e187d7d0112cfc3070_NEIKI.exe
File created	C:\Windows\System\NaORyCD.exe	41d18a1be43460e187d7d0112cfc3070_NEIKI.exe
File created	C:\Windows\System\VFXXOyo.exe	41d18a1be43460e187d7d0112cfc3070_NEIKI.exe
File created	C:\Windows\System\SYDtsPm.exe	41d18a1be43460e187d7d0112cfc3070_NEIKI.exe
File created	C:\Windows\System\dQSUDBg.exe	41d18a1be43460e187d7d0112cfc3070_NEIKI.exe
File created	C:\Windows\System\TQIMceJ.exe	41d18a1be43460e187d7d0112cfc3070_NEIKI.exe
File created	C:\Windows\System\lZXTbuR.exe	41d18a1be43460e187d7d0112cfc3070_NEIKI.exe
File created	C:\Windows\System\qTaCwvw.exe	41d18a1be43460e187d7d0112cfc3070_NEIKI.exe
File created	C:\Windows\System\XWTMrHC.exe	41d18a1be43460e187d7d0112cfc3070_NEIKI.exe
File created	C:\Windows\System\aYyaKxf.exe	41d18a1be43460e187d7d0112cfc3070_NEIKI.exe
File created	C:\Windows\System\lzPcRpf.exe	41d18a1be43460e187d7d0112cfc3070_NEIKI.exe
File created	C:\Windows\System\xyKcYqz.exe	41d18a1be43460e187d7d0112cfc3070_NEIKI.exe
File created	C:\Windows\System\ileCySM.exe	41d18a1be43460e187d7d0112cfc3070_NEIKI.exe
File created	C:\Windows\System\eypibSS.exe	41d18a1be43460e187d7d0112cfc3070_NEIKI.exe
File created	C:\Windows\System\fNTlsNN.exe	41d18a1be43460e187d7d0112cfc3070_NEIKI.exe
File created	C:\Windows\System\aDCUaIz.exe	41d18a1be43460e187d7d0112cfc3070_NEIKI.exe
File created	C:\Windows\System\OsAPooM.exe	41d18a1be43460e187d7d0112cfc3070_NEIKI.exe
File created	C:\Windows\System\VXNqmmy.exe	41d18a1be43460e187d7d0112cfc3070_NEIKI.exe
File created	C:\Windows\System\rcCJUsT.exe	41d18a1be43460e187d7d0112cfc3070_NEIKI.exe
File created	C:\Windows\System\YRQDOce.exe	41d18a1be43460e187d7d0112cfc3070_NEIKI.exe
File created	C:\Windows\System\PTRuLHc.exe	41d18a1be43460e187d7d0112cfc3070_NEIKI.exe
File created	C:\Windows\System\uXokqhx.exe	41d18a1be43460e187d7d0112cfc3070_NEIKI.exe
File created	C:\Windows\System\xCksscA.exe	41d18a1be43460e187d7d0112cfc3070_NEIKI.exe
File created	C:\Windows\System\OXwVfDs.exe	41d18a1be43460e187d7d0112cfc3070_NEIKI.exe
File created	C:\Windows\System\mXgPXWU.exe	41d18a1be43460e187d7d0112cfc3070_NEIKI.exe
File created	C:\Windows\System\gPMFOTX.exe	41d18a1be43460e187d7d0112cfc3070_NEIKI.exe
File created	C:\Windows\System\jmokKxb.exe	41d18a1be43460e187d7d0112cfc3070_NEIKI.exe
File created	C:\Windows\System\FXDwphn.exe	41d18a1be43460e187d7d0112cfc3070_NEIKI.exe
File created	C:\Windows\System\LfmyeYZ.exe	41d18a1be43460e187d7d0112cfc3070_NEIKI.exe
File created	C:\Windows\System\rndremG.exe	41d18a1be43460e187d7d0112cfc3070_NEIKI.exe
File created	C:\Windows\System\XjIcJIE.exe	41d18a1be43460e187d7d0112cfc3070_NEIKI.exe
File created	C:\Windows\System\mHZMIOn.exe	41d18a1be43460e187d7d0112cfc3070_NEIKI.exe
File created	C:\Windows\System\YNPSBmz.exe	41d18a1be43460e187d7d0112cfc3070_NEIKI.exe
File created	C:\Windows\System\MoFMBgO.exe	41d18a1be43460e187d7d0112cfc3070_NEIKI.exe
File created	C:\Windows\System\xWfFsOO.exe	41d18a1be43460e187d7d0112cfc3070_NEIKI.exe
File created	C:\Windows\System\IHfhGhV.exe	41d18a1be43460e187d7d0112cfc3070_NEIKI.exe
File created	C:\Windows\System\USRrQMn.exe	41d18a1be43460e187d7d0112cfc3070_NEIKI.exe
File created	C:\Windows\System\egDyhoo.exe	41d18a1be43460e187d7d0112cfc3070_NEIKI.exe
File created	C:\Windows\System\bwKstPH.exe	41d18a1be43460e187d7d0112cfc3070_NEIKI.exe
File created	C:\Windows\System\YAXPBFO.exe	41d18a1be43460e187d7d0112cfc3070_NEIKI.exe
File created	C:\Windows\System\PWwogZP.exe	41d18a1be43460e187d7d0112cfc3070_NEIKI.exe
File created	C:\Windows\System\RAxcwfB.exe	41d18a1be43460e187d7d0112cfc3070_NEIKI.exe
File created	C:\Windows\System\evKwZdu.exe	41d18a1be43460e187d7d0112cfc3070_NEIKI.exe
File created	C:\Windows\System\ojcLcBq.exe	41d18a1be43460e187d7d0112cfc3070_NEIKI.exe
File created	C:\Windows\System\TqYdYMY.exe	41d18a1be43460e187d7d0112cfc3070_NEIKI.exe
File created	C:\Windows\System\PkAXtFi.exe	41d18a1be43460e187d7d0112cfc3070_NEIKI.exe
File created	C:\Windows\System\utDnxKh.exe	41d18a1be43460e187d7d0112cfc3070_NEIKI.exe
File created	C:\Windows\System\HFensYY.exe	41d18a1be43460e187d7d0112cfc3070_NEIKI.exe
File created	C:\Windows\System\riuCUJO.exe	41d18a1be43460e187d7d0112cfc3070_NEIKI.exe
File created	C:\Windows\System\sexhzap.exe	41d18a1be43460e187d7d0112cfc3070_NEIKI.exe
File created	C:\Windows\System\LFuMZZn.exe	41d18a1be43460e187d7d0112cfc3070_NEIKI.exe
File created	C:\Windows\System\YkTrRAk.exe	41d18a1be43460e187d7d0112cfc3070_NEIKI.exe
File created	C:\Windows\System\MfeRNKu.exe	41d18a1be43460e187d7d0112cfc3070_NEIKI.exe
File created	C:\Windows\System\PYyXAfw.exe	41d18a1be43460e187d7d0112cfc3070_NEIKI.exe
File created	C:\Windows\System\KTjpEKK.exe	41d18a1be43460e187d7d0112cfc3070_NEIKI.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2744	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2920	41d18a1be43460e187d7d0112cfc3070_NEIKI.exe
Token: SeLockMemoryPrivilege	2920	41d18a1be43460e187d7d0112cfc3070_NEIKI.exe
Token: SeDebugPrivilege	2744	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2920 wrote to memory of 2744	2920	41d18a1be43460e187d7d0112cfc3070_NEIKI.exe	29
PID 2920 wrote to memory of 2744	2920	41d18a1be43460e187d7d0112cfc3070_NEIKI.exe	29
PID 2920 wrote to memory of 2744	2920	41d18a1be43460e187d7d0112cfc3070_NEIKI.exe	29
PID 2920 wrote to memory of 2984	2920	41d18a1be43460e187d7d0112cfc3070_NEIKI.exe	30
PID 2920 wrote to memory of 2984	2920	41d18a1be43460e187d7d0112cfc3070_NEIKI.exe	30
PID 2920 wrote to memory of 2984	2920	41d18a1be43460e187d7d0112cfc3070_NEIKI.exe	30
PID 2920 wrote to memory of 1640	2920	41d18a1be43460e187d7d0112cfc3070_NEIKI.exe	31
PID 2920 wrote to memory of 1640	2920	41d18a1be43460e187d7d0112cfc3070_NEIKI.exe	31
PID 2920 wrote to memory of 1640	2920	41d18a1be43460e187d7d0112cfc3070_NEIKI.exe	31
PID 2920 wrote to memory of 2632	2920	41d18a1be43460e187d7d0112cfc3070_NEIKI.exe	32
PID 2920 wrote to memory of 2632	2920	41d18a1be43460e187d7d0112cfc3070_NEIKI.exe	32
PID 2920 wrote to memory of 2632	2920	41d18a1be43460e187d7d0112cfc3070_NEIKI.exe	32
PID 2920 wrote to memory of 2884	2920	41d18a1be43460e187d7d0112cfc3070_NEIKI.exe	33
PID 2920 wrote to memory of 2884	2920	41d18a1be43460e187d7d0112cfc3070_NEIKI.exe	33
PID 2920 wrote to memory of 2884	2920	41d18a1be43460e187d7d0112cfc3070_NEIKI.exe	33
PID 2920 wrote to memory of 2872	2920	41d18a1be43460e187d7d0112cfc3070_NEIKI.exe	34
PID 2920 wrote to memory of 2872	2920	41d18a1be43460e187d7d0112cfc3070_NEIKI.exe	34
PID 2920 wrote to memory of 2872	2920	41d18a1be43460e187d7d0112cfc3070_NEIKI.exe	34
PID 2920 wrote to memory of 2748	2920	41d18a1be43460e187d7d0112cfc3070_NEIKI.exe	35
PID 2920 wrote to memory of 2748	2920	41d18a1be43460e187d7d0112cfc3070_NEIKI.exe	35
PID 2920 wrote to memory of 2748	2920	41d18a1be43460e187d7d0112cfc3070_NEIKI.exe	35
PID 2920 wrote to memory of 2456	2920	41d18a1be43460e187d7d0112cfc3070_NEIKI.exe	36
PID 2920 wrote to memory of 2456	2920	41d18a1be43460e187d7d0112cfc3070_NEIKI.exe	36
PID 2920 wrote to memory of 2456	2920	41d18a1be43460e187d7d0112cfc3070_NEIKI.exe	36
PID 2920 wrote to memory of 2420	2920	41d18a1be43460e187d7d0112cfc3070_NEIKI.exe	37
PID 2920 wrote to memory of 2420	2920	41d18a1be43460e187d7d0112cfc3070_NEIKI.exe	37
PID 2920 wrote to memory of 2420	2920	41d18a1be43460e187d7d0112cfc3070_NEIKI.exe	37
PID 2920 wrote to memory of 2076	2920	41d18a1be43460e187d7d0112cfc3070_NEIKI.exe	38
PID 2920 wrote to memory of 2076	2920	41d18a1be43460e187d7d0112cfc3070_NEIKI.exe	38
PID 2920 wrote to memory of 2076	2920	41d18a1be43460e187d7d0112cfc3070_NEIKI.exe	38
PID 2920 wrote to memory of 1808	2920	41d18a1be43460e187d7d0112cfc3070_NEIKI.exe	39
PID 2920 wrote to memory of 1808	2920	41d18a1be43460e187d7d0112cfc3070_NEIKI.exe	39
PID 2920 wrote to memory of 1808	2920	41d18a1be43460e187d7d0112cfc3070_NEIKI.exe	39
PID 2920 wrote to memory of 2824	2920	41d18a1be43460e187d7d0112cfc3070_NEIKI.exe	40
PID 2920 wrote to memory of 2824	2920	41d18a1be43460e187d7d0112cfc3070_NEIKI.exe	40
PID 2920 wrote to memory of 2824	2920	41d18a1be43460e187d7d0112cfc3070_NEIKI.exe	40
PID 2920 wrote to memory of 2696	2920	41d18a1be43460e187d7d0112cfc3070_NEIKI.exe	41
PID 2920 wrote to memory of 2696	2920	41d18a1be43460e187d7d0112cfc3070_NEIKI.exe	41
PID 2920 wrote to memory of 2696	2920	41d18a1be43460e187d7d0112cfc3070_NEIKI.exe	41
PID 2920 wrote to memory of 1968	2920	41d18a1be43460e187d7d0112cfc3070_NEIKI.exe	42
PID 2920 wrote to memory of 1968	2920	41d18a1be43460e187d7d0112cfc3070_NEIKI.exe	42
PID 2920 wrote to memory of 1968	2920	41d18a1be43460e187d7d0112cfc3070_NEIKI.exe	42
PID 2920 wrote to memory of 2520	2920	41d18a1be43460e187d7d0112cfc3070_NEIKI.exe	43
PID 2920 wrote to memory of 2520	2920	41d18a1be43460e187d7d0112cfc3070_NEIKI.exe	43
PID 2920 wrote to memory of 2520	2920	41d18a1be43460e187d7d0112cfc3070_NEIKI.exe	43
PID 2920 wrote to memory of 2168	2920	41d18a1be43460e187d7d0112cfc3070_NEIKI.exe	44
PID 2920 wrote to memory of 2168	2920	41d18a1be43460e187d7d0112cfc3070_NEIKI.exe	44
PID 2920 wrote to memory of 2168	2920	41d18a1be43460e187d7d0112cfc3070_NEIKI.exe	44
PID 2920 wrote to memory of 1556	2920	41d18a1be43460e187d7d0112cfc3070_NEIKI.exe	45
PID 2920 wrote to memory of 1556	2920	41d18a1be43460e187d7d0112cfc3070_NEIKI.exe	45
PID 2920 wrote to memory of 1556	2920	41d18a1be43460e187d7d0112cfc3070_NEIKI.exe	45
PID 2920 wrote to memory of 2668	2920	41d18a1be43460e187d7d0112cfc3070_NEIKI.exe	46
PID 2920 wrote to memory of 2668	2920	41d18a1be43460e187d7d0112cfc3070_NEIKI.exe	46
PID 2920 wrote to memory of 2668	2920	41d18a1be43460e187d7d0112cfc3070_NEIKI.exe	46
PID 2920 wrote to memory of 2600	2920	41d18a1be43460e187d7d0112cfc3070_NEIKI.exe	47
PID 2920 wrote to memory of 2600	2920	41d18a1be43460e187d7d0112cfc3070_NEIKI.exe	47
PID 2920 wrote to memory of 2600	2920	41d18a1be43460e187d7d0112cfc3070_NEIKI.exe	47
PID 2920 wrote to memory of 2508	2920	41d18a1be43460e187d7d0112cfc3070_NEIKI.exe	48
PID 2920 wrote to memory of 2508	2920	41d18a1be43460e187d7d0112cfc3070_NEIKI.exe	48
PID 2920 wrote to memory of 2508	2920	41d18a1be43460e187d7d0112cfc3070_NEIKI.exe	48
PID 2920 wrote to memory of 344	2920	41d18a1be43460e187d7d0112cfc3070_NEIKI.exe	49
PID 2920 wrote to memory of 344	2920	41d18a1be43460e187d7d0112cfc3070_NEIKI.exe	49
PID 2920 wrote to memory of 344	2920	41d18a1be43460e187d7d0112cfc3070_NEIKI.exe	49
PID 2920 wrote to memory of 1516	2920	41d18a1be43460e187d7d0112cfc3070_NEIKI.exe	50

C:\Users\Admin\AppData\Local\Temp\41d18a1be43460e187d7d0112cfc3070_NEIKI.exe
"C:\Users\Admin\AppData\Local\Temp\41d18a1be43460e187d7d0112cfc3070_NEIKI.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2920
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2744
- C:\Windows\System\dCTbcpg.exe
  C:\Windows\System\dCTbcpg.exe
  2⤵
  - Executes dropped EXE
  PID:2984
- C:\Windows\System\wqAqhHl.exe
  C:\Windows\System\wqAqhHl.exe
  2⤵
  - Executes dropped EXE
  PID:1640
- C:\Windows\System\mxXedPj.exe
  C:\Windows\System\mxXedPj.exe
  2⤵
  - Executes dropped EXE
  PID:2632
- C:\Windows\System\sdlgxRE.exe
  C:\Windows\System\sdlgxRE.exe
  2⤵
  - Executes dropped EXE
  PID:2884
- C:\Windows\System\khunVTa.exe
  C:\Windows\System\khunVTa.exe
  2⤵
  - Executes dropped EXE
  PID:2872
- C:\Windows\System\ManuvAL.exe
  C:\Windows\System\ManuvAL.exe
  2⤵
  - Executes dropped EXE
  PID:2748
- C:\Windows\System\UcDdGne.exe
  C:\Windows\System\UcDdGne.exe
  2⤵
  - Executes dropped EXE
  PID:2456
- C:\Windows\System\xOwaDWy.exe
  C:\Windows\System\xOwaDWy.exe
  2⤵
  - Executes dropped EXE
  PID:2420
- C:\Windows\System\vvmlyMo.exe
  C:\Windows\System\vvmlyMo.exe
  2⤵
  - Executes dropped EXE
  PID:2076
- C:\Windows\System\OXwVfDs.exe
  C:\Windows\System\OXwVfDs.exe
  2⤵
  - Executes dropped EXE
  PID:1808
- C:\Windows\System\mWHYTiK.exe
  C:\Windows\System\mWHYTiK.exe
  2⤵
  - Executes dropped EXE
  PID:2824
- C:\Windows\System\PBjSZiT.exe
  C:\Windows\System\PBjSZiT.exe
  2⤵
  - Executes dropped EXE
  PID:2696
- C:\Windows\System\YtGHJwM.exe
  C:\Windows\System\YtGHJwM.exe
  2⤵
  - Executes dropped EXE
  PID:1968
- C:\Windows\System\FOQSrMa.exe
  C:\Windows\System\FOQSrMa.exe
  2⤵
  - Executes dropped EXE
  PID:2520
- C:\Windows\System\ksWWzXC.exe
  C:\Windows\System\ksWWzXC.exe
  2⤵
  - Executes dropped EXE
  PID:2168
- C:\Windows\System\BFuFOCc.exe
  C:\Windows\System\BFuFOCc.exe
  2⤵
  - Executes dropped EXE
  PID:1556
- C:\Windows\System\fuGxLnj.exe
  C:\Windows\System\fuGxLnj.exe
  2⤵
  - Executes dropped EXE
  PID:2668
- C:\Windows\System\vGjTyOl.exe
  C:\Windows\System\vGjTyOl.exe
  2⤵
  - Executes dropped EXE
  PID:2600
- C:\Windows\System\vkTLJdT.exe
  C:\Windows\System\vkTLJdT.exe
  2⤵
  - Executes dropped EXE
  PID:2508
- C:\Windows\System\HcFeuWU.exe
  C:\Windows\System\HcFeuWU.exe
  2⤵
  - Executes dropped EXE
  PID:344
- C:\Windows\System\JRblQCR.exe
  C:\Windows\System\JRblQCR.exe
  2⤵
  - Executes dropped EXE
  PID:1516
- C:\Windows\System\RZFhbtD.exe
  C:\Windows\System\RZFhbtD.exe
  2⤵
  - Executes dropped EXE
  PID:1420
- C:\Windows\System\eEacCbj.exe
  C:\Windows\System\eEacCbj.exe
  2⤵
  - Executes dropped EXE
  PID:2008
- C:\Windows\System\IBKTqYz.exe
  C:\Windows\System\IBKTqYz.exe
  2⤵
  - Executes dropped EXE
  PID:2252
- C:\Windows\System\wXyBZxG.exe
  C:\Windows\System\wXyBZxG.exe
  2⤵
  - Executes dropped EXE
  PID:1912
- C:\Windows\System\sGWWFxn.exe
  C:\Windows\System\sGWWFxn.exe
  2⤵
  - Executes dropped EXE
  PID:2612
- C:\Windows\System\RXdfzQq.exe
  C:\Windows\System\RXdfzQq.exe
  2⤵
  - Executes dropped EXE
  PID:1928
- C:\Windows\System\NZMsLZp.exe
  C:\Windows\System\NZMsLZp.exe
  2⤵
  - Executes dropped EXE
  PID:268
- C:\Windows\System\rutVwxw.exe
  C:\Windows\System\rutVwxw.exe
  2⤵
  - Executes dropped EXE
  PID:776
- C:\Windows\System\AMFrBqT.exe
  C:\Windows\System\AMFrBqT.exe
  2⤵
  - Executes dropped EXE
  PID:1172
- C:\Windows\System\LcuwlSE.exe
  C:\Windows\System\LcuwlSE.exe
  2⤵
  - Executes dropped EXE
  PID:1484
- C:\Windows\System\suyLldU.exe
  C:\Windows\System\suyLldU.exe
  2⤵
  - Executes dropped EXE
  PID:2084
- C:\Windows\System\ZryRJLD.exe
  C:\Windows\System\ZryRJLD.exe
  2⤵
  - Executes dropped EXE
  PID:580
- C:\Windows\System\UzmGGpI.exe
  C:\Windows\System\UzmGGpI.exe
  2⤵
  - Executes dropped EXE
  PID:1856
- C:\Windows\System\qLSWTiM.exe
  C:\Windows\System\qLSWTiM.exe
  2⤵
  - Executes dropped EXE
  PID:1944
- C:\Windows\System\hqUtQTq.exe
  C:\Windows\System\hqUtQTq.exe
  2⤵
  - Executes dropped EXE
  PID:412
- C:\Windows\System\czVNkow.exe
  C:\Windows\System\czVNkow.exe
  2⤵
  - Executes dropped EXE
  PID:1140
- C:\Windows\System\YZzNcyq.exe
  C:\Windows\System\YZzNcyq.exe
  2⤵
  - Executes dropped EXE
  PID:1164
- C:\Windows\System\dcdJCXx.exe
  C:\Windows\System\dcdJCXx.exe
  2⤵
  - Executes dropped EXE
  PID:2368
- C:\Windows\System\aYyaKxf.exe
  C:\Windows\System\aYyaKxf.exe
  2⤵
  - Executes dropped EXE
  PID:1312
- C:\Windows\System\KoeofMQ.exe
  C:\Windows\System\KoeofMQ.exe
  2⤵
  - Executes dropped EXE
  PID:1372
- C:\Windows\System\ZGfJqik.exe
  C:\Windows\System\ZGfJqik.exe
  2⤵
  - Executes dropped EXE
  PID:1984
- C:\Windows\System\VmdjxTN.exe
  C:\Windows\System\VmdjxTN.exe
  2⤵
  - Executes dropped EXE
  PID:1568
- C:\Windows\System\uuvTKSF.exe
  C:\Windows\System\uuvTKSF.exe
  2⤵
  - Executes dropped EXE
  PID:1348
- C:\Windows\System\BVyAHfv.exe
  C:\Windows\System\BVyAHfv.exe
  2⤵
  - Executes dropped EXE
  PID:1868
- C:\Windows\System\YGFfvpH.exe
  C:\Windows\System\YGFfvpH.exe
  2⤵
  - Executes dropped EXE
  PID:1992
- C:\Windows\System\pCriMDy.exe
  C:\Windows\System\pCriMDy.exe
  2⤵
  - Executes dropped EXE
  PID:2912
- C:\Windows\System\leAgPlE.exe
  C:\Windows\System\leAgPlE.exe
  2⤵
  - Executes dropped EXE
  PID:2040
- C:\Windows\System\zkDxuyL.exe
  C:\Windows\System\zkDxuyL.exe
  2⤵
  - Executes dropped EXE
  PID:1428
- C:\Windows\System\oQhzqVQ.exe
  C:\Windows\System\oQhzqVQ.exe
  2⤵
  - Executes dropped EXE
  PID:880
- C:\Windows\System\SoEIKbN.exe
  C:\Windows\System\SoEIKbN.exe
  2⤵
  - Executes dropped EXE
  PID:1692
- C:\Windows\System\CTmKPSc.exe
  C:\Windows\System\CTmKPSc.exe
  2⤵
  - Executes dropped EXE
  PID:2380
- C:\Windows\System\hpiicBU.exe
  C:\Windows\System\hpiicBU.exe
  2⤵
  - Executes dropped EXE
  PID:1548
- C:\Windows\System\RpbWVsf.exe
  C:\Windows\System\RpbWVsf.exe
  2⤵
  - Executes dropped EXE
  PID:2272
- C:\Windows\System\HjmVjOs.exe
  C:\Windows\System\HjmVjOs.exe
  2⤵
  - Executes dropped EXE
  PID:2088
- C:\Windows\System\CcFPQFM.exe
  C:\Windows\System\CcFPQFM.exe
  2⤵
  - Executes dropped EXE
  PID:2652
- C:\Windows\System\NaWHxGv.exe
  C:\Windows\System\NaWHxGv.exe
  2⤵
  - Executes dropped EXE
  PID:2732
- C:\Windows\System\nKVstuf.exe
  C:\Windows\System\nKVstuf.exe
  2⤵
  - Executes dropped EXE
  PID:2940
- C:\Windows\System\GszmZns.exe
  C:\Windows\System\GszmZns.exe
  2⤵
  - Executes dropped EXE
  PID:2716
- C:\Windows\System\GfJfTWa.exe
  C:\Windows\System\GfJfTWa.exe
  2⤵
  - Executes dropped EXE
  PID:2464
- C:\Windows\System\wOnnNFc.exe
  C:\Windows\System\wOnnNFc.exe
  2⤵
  - Executes dropped EXE
  PID:2568
- C:\Windows\System\TDUJKPZ.exe
  C:\Windows\System\TDUJKPZ.exe
  2⤵
  - Executes dropped EXE
  PID:2484
- C:\Windows\System\hKJqfyk.exe
  C:\Windows\System\hKJqfyk.exe
  2⤵
  - Executes dropped EXE
  PID:2828
- C:\Windows\System\dJsYkWF.exe
  C:\Windows\System\dJsYkWF.exe
  2⤵
  - Executes dropped EXE
  PID:848
- C:\Windows\System\FzmwdYs.exe
  C:\Windows\System\FzmwdYs.exe
  2⤵
  PID:2768
- C:\Windows\System\PUmYtBY.exe
  C:\Windows\System\PUmYtBY.exe
  2⤵
  PID:2996
- C:\Windows\System\dgdglZW.exe
  C:\Windows\System\dgdglZW.exe
  2⤵
  PID:2700
- C:\Windows\System\ADjcKYE.exe
  C:\Windows\System\ADjcKYE.exe
  2⤵
  PID:1532
- C:\Windows\System\JqGJzjb.exe
  C:\Windows\System\JqGJzjb.exe
  2⤵
  PID:2812
- C:\Windows\System\GSQFAAM.exe
  C:\Windows\System\GSQFAAM.exe
  2⤵
  PID:1264
- C:\Windows\System\RpCmbEa.exe
  C:\Windows\System\RpCmbEa.exe
  2⤵
  PID:1672
- C:\Windows\System\xLtNJTL.exe
  C:\Windows\System\xLtNJTL.exe
  2⤵
  PID:2764
- C:\Windows\System\ahgGPIx.exe
  C:\Windows\System\ahgGPIx.exe
  2⤵
  PID:1916
- C:\Windows\System\cNHcQWI.exe
  C:\Windows\System\cNHcQWI.exe
  2⤵
  PID:2880
- C:\Windows\System\ZsCCDOl.exe
  C:\Windows\System\ZsCCDOl.exe
  2⤵
  PID:992
- C:\Windows\System\FZXrBnw.exe
  C:\Windows\System\FZXrBnw.exe
  2⤵
  PID:1492
- C:\Windows\System\YLekXpx.exe
  C:\Windows\System\YLekXpx.exe
  2⤵
  PID:844
- C:\Windows\System\YOrDejQ.exe
  C:\Windows\System\YOrDejQ.exe
  2⤵
  PID:2440
- C:\Windows\System\mwSNDrm.exe
  C:\Windows\System\mwSNDrm.exe
  2⤵
  PID:2304
- C:\Windows\System\mqiSbDT.exe
  C:\Windows\System\mqiSbDT.exe
  2⤵
  PID:2388
- C:\Windows\System\dHrNhyH.exe
  C:\Windows\System\dHrNhyH.exe
  2⤵
  PID:2016
- C:\Windows\System\FwxfZcf.exe
  C:\Windows\System\FwxfZcf.exe
  2⤵
  PID:2236
- C:\Windows\System\xRrmSmu.exe
  C:\Windows\System\xRrmSmu.exe
  2⤵
  PID:1028
- C:\Windows\System\PnnSlzd.exe
  C:\Windows\System\PnnSlzd.exe
  2⤵
  PID:916
- C:\Windows\System\KaWGLxw.exe
  C:\Windows\System\KaWGLxw.exe
  2⤵
  PID:1100
- C:\Windows\System\IJMmMoQ.exe
  C:\Windows\System\IJMmMoQ.exe
  2⤵
  PID:2036
- C:\Windows\System\CGQcUZh.exe
  C:\Windows\System\CGQcUZh.exe
  2⤵
  PID:1220
- C:\Windows\System\shThkln.exe
  C:\Windows\System\shThkln.exe
  2⤵
  PID:1732
- C:\Windows\System\NGXiXOJ.exe
  C:\Windows\System\NGXiXOJ.exe
  2⤵
  PID:1668
- C:\Windows\System\TZKiZdf.exe
  C:\Windows\System\TZKiZdf.exe
  2⤵
  PID:1624
- C:\Windows\System\EGJQPaN.exe
  C:\Windows\System\EGJQPaN.exe
  2⤵
  PID:2332
- C:\Windows\System\RpTlIbD.exe
  C:\Windows\System\RpTlIbD.exe
  2⤵
  PID:1936
- C:\Windows\System\DwmNhbs.exe
  C:\Windows\System\DwmNhbs.exe
  2⤵
  PID:2372
- C:\Windows\System\ysegaqK.exe
  C:\Windows\System\ysegaqK.exe
  2⤵
  PID:984
- C:\Windows\System\XjAOwOk.exe
  C:\Windows\System\XjAOwOk.exe
  2⤵
  PID:764
- C:\Windows\System\pqdCAhW.exe
  C:\Windows\System\pqdCAhW.exe
  2⤵
  PID:2864
- C:\Windows\System\GuHFAoR.exe
  C:\Windows\System\GuHFAoR.exe
  2⤵
  PID:3016
- C:\Windows\System\IfaDZpu.exe
  C:\Windows\System\IfaDZpu.exe
  2⤵
  PID:1576
- C:\Windows\System\UcvICLN.exe
  C:\Windows\System\UcvICLN.exe
  2⤵
  PID:2548
- C:\Windows\System\SBAsDMA.exe
  C:\Windows\System\SBAsDMA.exe
  2⤵
  PID:2648
- C:\Windows\System\BMdtPQv.exe
  C:\Windows\System\BMdtPQv.exe
  2⤵
  PID:2476
- C:\Windows\System\DatiLAZ.exe
  C:\Windows\System\DatiLAZ.exe
  2⤵
  PID:1728
- C:\Windows\System\WUjnvky.exe
  C:\Windows\System\WUjnvky.exe
  2⤵
  PID:2432
- C:\Windows\System\xbVxIJz.exe
  C:\Windows\System\xbVxIJz.exe
  2⤵
  PID:2492
- C:\Windows\System\kNznIbf.exe
  C:\Windows\System\kNznIbf.exe
  2⤵
  PID:2948
- C:\Windows\System\UlXvtJG.exe
  C:\Windows\System\UlXvtJG.exe
  2⤵
  PID:1680
- C:\Windows\System\oYxeTYa.exe
  C:\Windows\System\oYxeTYa.exe
  2⤵
  PID:1956
- C:\Windows\System\HdzBzWO.exe
  C:\Windows\System\HdzBzWO.exe
  2⤵
  PID:2792
- C:\Windows\System\TpBRUHc.exe
  C:\Windows\System\TpBRUHc.exe
  2⤵
  PID:308
- C:\Windows\System\aWvuKUm.exe
  C:\Windows\System\aWvuKUm.exe
  2⤵
  PID:2800
- C:\Windows\System\FbYMClw.exe
  C:\Windows\System\FbYMClw.exe
  2⤵
  PID:2116
- C:\Windows\System\PzMfdXB.exe
  C:\Windows\System\PzMfdXB.exe
  2⤵
  PID:1768
- C:\Windows\System\hmSwlbR.exe
  C:\Windows\System\hmSwlbR.exe
  2⤵
  PID:1436
- C:\Windows\System\sEtDDVZ.exe
  C:\Windows\System\sEtDDVZ.exe
  2⤵
  PID:2100
- C:\Windows\System\xfbjVGr.exe
  C:\Windows\System\xfbjVGr.exe
  2⤵
  PID:1040
- C:\Windows\System\qruusgc.exe
  C:\Windows\System\qruusgc.exe
  2⤵
  PID:576
- C:\Windows\System\eiOEdNo.exe
  C:\Windows\System\eiOEdNo.exe
  2⤵
  PID:2204
- C:\Windows\System\dOvKoxT.exe
  C:\Windows\System\dOvKoxT.exe
  2⤵
  PID:2836
- C:\Windows\System\OIjPaom.exe
  C:\Windows\System\OIjPaom.exe
  2⤵
  PID:1604
- C:\Windows\System\heUJhpX.exe
  C:\Windows\System\heUJhpX.exe
  2⤵
  PID:2340
- C:\Windows\System\pfThffO.exe
  C:\Windows\System\pfThffO.exe
  2⤵
  PID:2032
- C:\Windows\System\uyyyaiM.exe
  C:\Windows\System\uyyyaiM.exe
  2⤵
  PID:1236
- C:\Windows\System\qzAWfuw.exe
  C:\Windows\System\qzAWfuw.exe
  2⤵
  PID:1036
- C:\Windows\System\uqDhtnx.exe
  C:\Windows\System\uqDhtnx.exe
  2⤵
  PID:1656
- C:\Windows\System\KXmgIyX.exe
  C:\Windows\System\KXmgIyX.exe
  2⤵
  PID:3024
- C:\Windows\System\obZzPfF.exe
  C:\Windows\System\obZzPfF.exe
  2⤵
  PID:2068
- C:\Windows\System\ZfgvpAA.exe
  C:\Windows\System\ZfgvpAA.exe
  2⤵
  PID:2528
- C:\Windows\System\CtphEbE.exe
  C:\Windows\System\CtphEbE.exe
  2⤵
  PID:2572
- C:\Windows\System\zTEcDHJ.exe
  C:\Windows\System\zTEcDHJ.exe
  2⤵
  PID:2856
- C:\Windows\System\BpYJLgy.exe
  C:\Windows\System\BpYJLgy.exe
  2⤵
  PID:628
- C:\Windows\System\xcoqwBb.exe
  C:\Windows\System\xcoqwBb.exe
  2⤵
  PID:2604
- C:\Windows\System\CqduPOc.exe
  C:\Windows\System\CqduPOc.exe
  2⤵
  PID:1252
- C:\Windows\System\fnDfIkn.exe
  C:\Windows\System\fnDfIkn.exe
  2⤵
  PID:1852
- C:\Windows\System\phcNtPy.exe
  C:\Windows\System\phcNtPy.exe
  2⤵
  PID:2944
- C:\Windows\System\pZtCdVn.exe
  C:\Windows\System\pZtCdVn.exe
  2⤵
  PID:828
- C:\Windows\System\NHHlGdr.exe
  C:\Windows\System\NHHlGdr.exe
  2⤵
  PID:1776
- C:\Windows\System\ntReUjk.exe
  C:\Windows\System\ntReUjk.exe
  2⤵
  PID:2124
- C:\Windows\System\TcIpnKn.exe
  C:\Windows\System\TcIpnKn.exe
  2⤵
  PID:1612
- C:\Windows\System\YBegidT.exe
  C:\Windows\System\YBegidT.exe
  2⤵
  PID:2344
- C:\Windows\System\lCeHezK.exe
  C:\Windows\System\lCeHezK.exe
  2⤵
  PID:2152
- C:\Windows\System\EmEVLMh.exe
  C:\Windows\System\EmEVLMh.exe
  2⤵
  PID:1092
- C:\Windows\System\ZgpXKOj.exe
  C:\Windows\System\ZgpXKOj.exe
  2⤵
  PID:1816
- C:\Windows\System\OyNjKTE.exe
  C:\Windows\System\OyNjKTE.exe
  2⤵
  PID:500
- C:\Windows\System\sTHTjei.exe
  C:\Windows\System\sTHTjei.exe
  2⤵
  PID:1964
- C:\Windows\System\xKrrSlE.exe
  C:\Windows\System\xKrrSlE.exe
  2⤵
  PID:1780
- C:\Windows\System\EZjoZQw.exe
  C:\Windows\System\EZjoZQw.exe
  2⤵
  PID:684
- C:\Windows\System\HakRMoA.exe
  C:\Windows\System\HakRMoA.exe
  2⤵
  PID:1056
- C:\Windows\System\sYsBcrA.exe
  C:\Windows\System\sYsBcrA.exe
  2⤵
  PID:3008
- C:\Windows\System\TFjiRmz.exe
  C:\Windows\System\TFjiRmz.exe
  2⤵
  PID:1800
- C:\Windows\System\lfSxgDz.exe
  C:\Windows\System\lfSxgDz.exe
  2⤵
  PID:2012
- C:\Windows\System\YqNUnnD.exe
  C:\Windows\System\YqNUnnD.exe
  2⤵
  PID:1628
- C:\Windows\System\QapILIG.exe
  C:\Windows\System\QapILIG.exe
  2⤵
  PID:1788
- C:\Windows\System\NaahNad.exe
  C:\Windows\System\NaahNad.exe
  2⤵
  PID:2616
- C:\Windows\System\XkAKAKG.exe
  C:\Windows\System\XkAKAKG.exe
  2⤵
  PID:2756
- C:\Windows\System\wAnGleC.exe
  C:\Windows\System\wAnGleC.exe
  2⤵
  PID:2892
- C:\Windows\System\ULBEtUu.exe
  C:\Windows\System\ULBEtUu.exe
  2⤵
  PID:1416
- C:\Windows\System\vWMyHmn.exe
  C:\Windows\System\vWMyHmn.exe
  2⤵
  PID:1792
- C:\Windows\System\JLLTyGL.exe
  C:\Windows\System\JLLTyGL.exe
  2⤵
  PID:1268
- C:\Windows\System\AdRysBe.exe
  C:\Windows\System\AdRysBe.exe
  2⤵
  PID:2644
- C:\Windows\System\ZaOxdYC.exe
  C:\Windows\System\ZaOxdYC.exe
  2⤵
  PID:900
- C:\Windows\System\JaThIsY.exe
  C:\Windows\System\JaThIsY.exe
  2⤵
  PID:1504
- C:\Windows\System\NKXdubg.exe
  C:\Windows\System\NKXdubg.exe
  2⤵
  PID:2284
- C:\Windows\System\WyECTRy.exe
  C:\Windows\System\WyECTRy.exe
  2⤵
  PID:592
- C:\Windows\System\RhilyEc.exe
  C:\Windows\System\RhilyEc.exe
  2⤵
  PID:1740
- C:\Windows\System\jxDSVCd.exe
  C:\Windows\System\jxDSVCd.exe
  2⤵
  PID:908
- C:\Windows\System\kCzmKYK.exe
  C:\Windows\System\kCzmKYK.exe
  2⤵
  PID:3044
- C:\Windows\System\YTFYZVI.exe
  C:\Windows\System\YTFYZVI.exe
  2⤵
  PID:2080
- C:\Windows\System\PpCFkWD.exe
  C:\Windows\System\PpCFkWD.exe
  2⤵
  PID:884
- C:\Windows\System\voUUlSe.exe
  C:\Windows\System\voUUlSe.exe
  2⤵
  PID:2956
- C:\Windows\System\aDUNNaL.exe
  C:\Windows\System\aDUNNaL.exe
  2⤵
  PID:2000
- C:\Windows\System\npuqinF.exe
  C:\Windows\System\npuqinF.exe
  2⤵
  PID:2140
- C:\Windows\System\qhqGbPB.exe
  C:\Windows\System\qhqGbPB.exe
  2⤵
  PID:2560
- C:\Windows\System\JpSbrUn.exe
  C:\Windows\System\JpSbrUn.exe
  2⤵
  PID:1952
- C:\Windows\System\iKNrqbh.exe
  C:\Windows\System\iKNrqbh.exe
  2⤵
  PID:1500
- C:\Windows\System\qaoFoWk.exe
  C:\Windows\System\qaoFoWk.exe
  2⤵
  PID:2364
- C:\Windows\System\trSziCW.exe
  C:\Windows\System\trSziCW.exe
  2⤵
  PID:2208
- C:\Windows\System\CiPSQvx.exe
  C:\Windows\System\CiPSQvx.exe
  2⤵
  PID:2992
- C:\Windows\System\tbHljYO.exe
  C:\Windows\System\tbHljYO.exe
  2⤵
  PID:3076
- C:\Windows\System\RKDfvPl.exe
  C:\Windows\System\RKDfvPl.exe
  2⤵
  PID:3096
- C:\Windows\System\xdggVqW.exe
  C:\Windows\System\xdggVqW.exe
  2⤵
  PID:3112
- C:\Windows\System\vpbIITs.exe
  C:\Windows\System\vpbIITs.exe
  2⤵
  PID:3128
- C:\Windows\System\YZLtmWg.exe
  C:\Windows\System\YZLtmWg.exe
  2⤵
  PID:3144
- C:\Windows\System\zLUDBmF.exe
  C:\Windows\System\zLUDBmF.exe
  2⤵
  PID:3160
- C:\Windows\System\boFYnPG.exe
  C:\Windows\System\boFYnPG.exe
  2⤵
  PID:3180
- C:\Windows\System\kmyeljO.exe
  C:\Windows\System\kmyeljO.exe
  2⤵
  PID:3196
- C:\Windows\System\lpgoClV.exe
  C:\Windows\System\lpgoClV.exe
  2⤵
  PID:3212
- C:\Windows\System\XliSiOv.exe
  C:\Windows\System\XliSiOv.exe
  2⤵
  PID:3228
- C:\Windows\System\bjFGGJg.exe
  C:\Windows\System\bjFGGJg.exe
  2⤵
  PID:3244
- C:\Windows\System\UTDRyAi.exe
  C:\Windows\System\UTDRyAi.exe
  2⤵
  PID:3260
- C:\Windows\System\rExAvma.exe
  C:\Windows\System\rExAvma.exe
  2⤵
  PID:3280
- C:\Windows\System\QpSrSio.exe
  C:\Windows\System\QpSrSio.exe
  2⤵
  PID:3296
- C:\Windows\System\vMqznmm.exe
  C:\Windows\System\vMqznmm.exe
  2⤵
  PID:3312
- C:\Windows\System\AISLIFH.exe
  C:\Windows\System\AISLIFH.exe
  2⤵
  PID:3328
- C:\Windows\System\grwMbRP.exe
  C:\Windows\System\grwMbRP.exe
  2⤵
  PID:3344
- C:\Windows\System\RqcJMSD.exe
  C:\Windows\System\RqcJMSD.exe
  2⤵
  PID:3364
- C:\Windows\System\qHVLJgS.exe
  C:\Windows\System\qHVLJgS.exe
  2⤵
  PID:3380
- C:\Windows\System\pctLiHv.exe
  C:\Windows\System\pctLiHv.exe
  2⤵
  PID:3396
- C:\Windows\System\fxHNGJK.exe
  C:\Windows\System\fxHNGJK.exe
  2⤵
  PID:3412
- C:\Windows\System\riOQrCC.exe
  C:\Windows\System\riOQrCC.exe
  2⤵
  PID:3428
- C:\Windows\System\GkqhyNr.exe
  C:\Windows\System\GkqhyNr.exe
  2⤵
  PID:3560
- C:\Windows\System\yKRZtuA.exe
  C:\Windows\System\yKRZtuA.exe
  2⤵
  PID:3576
- C:\Windows\System\JKdZhrp.exe
  C:\Windows\System\JKdZhrp.exe
  2⤵
  PID:3592
- C:\Windows\System\viLCbgE.exe
  C:\Windows\System\viLCbgE.exe
  2⤵
  PID:3632
- C:\Windows\System\npxeOIJ.exe
  C:\Windows\System\npxeOIJ.exe
  2⤵
  PID:3648
- C:\Windows\System\YkTrRAk.exe
  C:\Windows\System\YkTrRAk.exe
  2⤵
  PID:3664
- C:\Windows\System\NUOWOUQ.exe
  C:\Windows\System\NUOWOUQ.exe
  2⤵
  PID:3680
- C:\Windows\System\MeTXmie.exe
  C:\Windows\System\MeTXmie.exe
  2⤵
  PID:3696
- C:\Windows\System\ZEypcbU.exe
  C:\Windows\System\ZEypcbU.exe
  2⤵
  PID:3712
- C:\Windows\System\LyesbvP.exe
  C:\Windows\System\LyesbvP.exe
  2⤵
  PID:3728
- C:\Windows\System\TSPtoFA.exe
  C:\Windows\System\TSPtoFA.exe
  2⤵
  PID:3744
- C:\Windows\System\dfalZsV.exe
  C:\Windows\System\dfalZsV.exe
  2⤵
  PID:3764
- C:\Windows\System\MGMffjk.exe
  C:\Windows\System\MGMffjk.exe
  2⤵
  PID:3780
- C:\Windows\System\YJkslUY.exe
  C:\Windows\System\YJkslUY.exe
  2⤵
  PID:3796
- C:\Windows\System\xfTElie.exe
  C:\Windows\System\xfTElie.exe
  2⤵
  PID:3812
- C:\Windows\System\UDhFKNn.exe
  C:\Windows\System\UDhFKNn.exe
  2⤵
  PID:3828
- C:\Windows\System\FaBDJRo.exe
  C:\Windows\System\FaBDJRo.exe
  2⤵
  PID:3848
- C:\Windows\System\KsdnnuS.exe
  C:\Windows\System\KsdnnuS.exe
  2⤵
  PID:3864
- C:\Windows\System\KvDblFQ.exe
  C:\Windows\System\KvDblFQ.exe
  2⤵
  PID:3880
- C:\Windows\System\pSRFlHr.exe
  C:\Windows\System\pSRFlHr.exe
  2⤵
  PID:3896
- C:\Windows\System\kmWGLRv.exe
  C:\Windows\System\kmWGLRv.exe
  2⤵
  PID:3912
- C:\Windows\System\jQXfIjJ.exe
  C:\Windows\System\jQXfIjJ.exe
  2⤵
  PID:3928
- C:\Windows\System\refVzJI.exe
  C:\Windows\System\refVzJI.exe
  2⤵
  PID:4048
- C:\Windows\System\IIYNwJB.exe
  C:\Windows\System\IIYNwJB.exe
  2⤵
  PID:4064
- C:\Windows\System\eZQNIse.exe
  C:\Windows\System\eZQNIse.exe
  2⤵
  PID:4084
- C:\Windows\System\rESODMt.exe
  C:\Windows\System\rESODMt.exe
  2⤵
  PID:1804
- C:\Windows\System\CKtIanw.exe
  C:\Windows\System\CKtIanw.exe
  2⤵
  PID:2868
- C:\Windows\System\omOVXqq.exe
  C:\Windows\System\omOVXqq.exe
  2⤵
  PID:2540
- C:\Windows\System\HzcqObU.exe
  C:\Windows\System\HzcqObU.exe
  2⤵
  PID:2952
- C:\Windows\System\FFCwwSG.exe
  C:\Windows\System\FFCwwSG.exe
  2⤵
  PID:2816
- C:\Windows\System\TecxldA.exe
  C:\Windows\System\TecxldA.exe
  2⤵
  PID:3092
- C:\Windows\System\lSeknZn.exe
  C:\Windows\System\lSeknZn.exe
  2⤵
  PID:3156
- C:\Windows\System\ivzliRe.exe
  C:\Windows\System\ivzliRe.exe
  2⤵
  PID:2656
- C:\Windows\System\ykLMeZK.exe
  C:\Windows\System\ykLMeZK.exe
  2⤵
  PID:3140
- C:\Windows\System\RZKUnNm.exe
  C:\Windows\System\RZKUnNm.exe
  2⤵
  PID:3204
- C:\Windows\System\KGcPYUo.exe
  C:\Windows\System\KGcPYUo.exe
  2⤵
  PID:3408
- C:\Windows\System\XHMOkLo.exe
  C:\Windows\System\XHMOkLo.exe
  2⤵
  PID:3456
- C:\Windows\System\zBDyMUm.exe
  C:\Windows\System\zBDyMUm.exe
  2⤵
  PID:3472
- C:\Windows\System\RVBDKhS.exe
  C:\Windows\System\RVBDKhS.exe
  2⤵
  PID:3488
- C:\Windows\System\BqMRpjV.exe
  C:\Windows\System\BqMRpjV.exe
  2⤵
  PID:3504
- C:\Windows\System\aQNzlMx.exe
  C:\Windows\System\aQNzlMx.exe
  2⤵
  PID:3520
- C:\Windows\System\hTomkjq.exe
  C:\Windows\System\hTomkjq.exe
  2⤵
  PID:3320
- C:\Windows\System\GylXlYp.exe
  C:\Windows\System\GylXlYp.exe
  2⤵
  PID:3548
- C:\Windows\System\hFjfnmW.exe
  C:\Windows\System\hFjfnmW.exe
  2⤵
  PID:3556
- C:\Windows\System\usuxrcY.exe
  C:\Windows\System\usuxrcY.exe
  2⤵
  PID:3088
- C:\Windows\System\QJBvBir.exe
  C:\Windows\System\QJBvBir.exe
  2⤵
  PID:3188
- C:\Windows\System\oRVaVDS.exe
  C:\Windows\System\oRVaVDS.exe
  2⤵
  PID:3256
- C:\Windows\System\nPQSkHG.exe
  C:\Windows\System\nPQSkHG.exe
  2⤵
  PID:3352
- C:\Windows\System\GSPQkCD.exe
  C:\Windows\System\GSPQkCD.exe
  2⤵
  PID:3600
- C:\Windows\System\UDMdTyo.exe
  C:\Windows\System\UDMdTyo.exe
  2⤵
  PID:3640
- C:\Windows\System\NUYrYdc.exe
  C:\Windows\System\NUYrYdc.exe
  2⤵
  PID:3692
- C:\Windows\System\DTdjbca.exe
  C:\Windows\System\DTdjbca.exe
  2⤵
  PID:3724
- C:\Windows\System\PphhMVp.exe
  C:\Windows\System\PphhMVp.exe
  2⤵
  PID:3792
- C:\Windows\System\bGRaNjb.exe
  C:\Windows\System\bGRaNjb.exe
  2⤵
  PID:3856
- C:\Windows\System\AnkEcNc.exe
  C:\Windows\System\AnkEcNc.exe
  2⤵
  PID:3736
- C:\Windows\System\JNgNMHR.exe
  C:\Windows\System\JNgNMHR.exe
  2⤵
  PID:3808
- C:\Windows\System\kLgdPLX.exe
  C:\Windows\System\kLgdPLX.exe
  2⤵
  PID:3872
- C:\Windows\System\ieqUanO.exe
  C:\Windows\System\ieqUanO.exe
  2⤵
  PID:3936
- C:\Windows\System\TztrOnv.exe
  C:\Windows\System\TztrOnv.exe
  2⤵
  PID:3956
- C:\Windows\System\FpBQLpj.exe
  C:\Windows\System\FpBQLpj.exe
  2⤵
  PID:3976
- C:\Windows\System\wuseKCZ.exe
  C:\Windows\System\wuseKCZ.exe
  2⤵
  PID:3992
- C:\Windows\System\XoBHfkm.exe
  C:\Windows\System\XoBHfkm.exe
  2⤵
  PID:3628
- C:\Windows\System\bDmjXsO.exe
  C:\Windows\System\bDmjXsO.exe
  2⤵
  PID:4000
- C:\Windows\System\fUTJRiS.exe
  C:\Windows\System\fUTJRiS.exe
  2⤵
  PID:4044
- C:\Windows\System\ePmiPPF.exe
  C:\Windows\System\ePmiPPF.exe
  2⤵
  PID:4080
- C:\Windows\System\rigarYd.exe
  C:\Windows\System\rigarYd.exe
  2⤵
  PID:1756
- C:\Windows\System\gTsDwDa.exe
  C:\Windows\System\gTsDwDa.exe
  2⤵
  PID:3452
- C:\Windows\System\bTGZiqJ.exe
  C:\Windows\System\bTGZiqJ.exe
  2⤵
  PID:2620
- C:\Windows\System\DqCDjbG.exe
  C:\Windows\System\DqCDjbG.exe
  2⤵
  PID:3552
- C:\Windows\System\ZlWWRam.exe
  C:\Windows\System\ZlWWRam.exe
  2⤵
  PID:3588
- C:\Windows\System\KRizFWJ.exe
  C:\Windows\System\KRizFWJ.exe
  2⤵
  PID:3572
- C:\Windows\System\NrMqaJm.exe
  C:\Windows\System\NrMqaJm.exe
  2⤵
  PID:4056
- C:\Windows\System\LrJYQth.exe
  C:\Windows\System\LrJYQth.exe
  2⤵
  PID:3824
- C:\Windows\System\bElgRtq.exe
  C:\Windows\System\bElgRtq.exe
  2⤵
  PID:3776
- C:\Windows\System\irsQVkj.exe
  C:\Windows\System\irsQVkj.exe
  2⤵
  PID:3968
- C:\Windows\System\HwKdAtm.exe
  C:\Windows\System\HwKdAtm.exe
  2⤵
  PID:4092
- C:\Windows\System\WmnrTuN.exe
  C:\Windows\System\WmnrTuN.exe
  2⤵
  PID:3532
- C:\Windows\System\NkvCncQ.exe
  C:\Windows\System\NkvCncQ.exe
  2⤵
  PID:3388
- C:\Windows\System\qcHQjIH.exe
  C:\Windows\System\qcHQjIH.exe
  2⤵
  PID:3084
- C:\Windows\System\TCMetuw.exe
  C:\Windows\System\TCMetuw.exe
  2⤵
  PID:3220
- C:\Windows\System\BKlThLJ.exe
  C:\Windows\System\BKlThLJ.exe
  2⤵
  PID:3688
- C:\Windows\System\SvXMNdQ.exe
  C:\Windows\System\SvXMNdQ.exe
  2⤵
  PID:3708
- C:\Windows\System\qSzpsmV.exe
  C:\Windows\System\qSzpsmV.exe
  2⤵
  PID:3952
- C:\Windows\System\BsNIUOD.exe
  C:\Windows\System\BsNIUOD.exe
  2⤵
  PID:3236
- C:\Windows\System\zLyXRiU.exe
  C:\Windows\System\zLyXRiU.exe
  2⤵
  PID:1872
- C:\Windows\System\bqDBKVy.exe
  C:\Windows\System\bqDBKVy.exe
  2⤵
  PID:1696
- C:\Windows\System\zYpqkgz.exe
  C:\Windows\System\zYpqkgz.exe
  2⤵
  PID:3392
- C:\Windows\System\iYnPsXp.exe
  C:\Windows\System\iYnPsXp.exe
  2⤵
  PID:3920
- C:\Windows\System\rwryWNV.exe
  C:\Windows\System\rwryWNV.exe
  2⤵
  PID:3984
- C:\Windows\System\zboWzEK.exe
  C:\Windows\System\zboWzEK.exe
  2⤵
  PID:3772
- C:\Windows\System\bUIoDgs.exe
  C:\Windows\System\bUIoDgs.exe
  2⤵
  PID:3544
- C:\Windows\System\uOyVobG.exe
  C:\Windows\System\uOyVobG.exe
  2⤵
  PID:3172
- C:\Windows\System\uPJsxfN.exe
  C:\Windows\System\uPJsxfN.exe
  2⤵
  PID:3704
- C:\Windows\System\DleCaUe.exe
  C:\Windows\System\DleCaUe.exe
  2⤵
  PID:3276
- C:\Windows\System\wtMTkdf.exe
  C:\Windows\System\wtMTkdf.exe
  2⤵
  PID:3676
- C:\Windows\System\oQSWdBj.exe
  C:\Windows\System\oQSWdBj.exe
  2⤵
  PID:3240
- C:\Windows\System\MhiynqQ.exe
  C:\Windows\System\MhiynqQ.exe
  2⤵
  PID:3512
- C:\Windows\System\SqSyDPc.exe
  C:\Windows\System\SqSyDPc.exe
  2⤵
  PID:3304
- C:\Windows\System\vKWovll.exe
  C:\Windows\System\vKWovll.exe
  2⤵
  PID:3540
- C:\Windows\System\xWfFsOO.exe
  C:\Windows\System\xWfFsOO.exe
  2⤵
  PID:3124
- C:\Windows\System\vnpswCB.exe
  C:\Windows\System\vnpswCB.exe
  2⤵
  PID:2228
- C:\Windows\System\hcNpMVo.exe
  C:\Windows\System\hcNpMVo.exe
  2⤵
  PID:1276
- C:\Windows\System\thFyJLM.exe
  C:\Windows\System\thFyJLM.exe
  2⤵
  PID:4112
- C:\Windows\System\XQnnXEU.exe
  C:\Windows\System\XQnnXEU.exe
  2⤵
  PID:4128
- C:\Windows\System\sLqUebE.exe
  C:\Windows\System\sLqUebE.exe
  2⤵
  PID:4200
- C:\Windows\System\juAZDvz.exe
  C:\Windows\System\juAZDvz.exe
  2⤵
  PID:4216
- C:\Windows\System\zJBpNtY.exe
  C:\Windows\System\zJBpNtY.exe
  2⤵
  PID:4232
- C:\Windows\System\JTFUBmG.exe
  C:\Windows\System\JTFUBmG.exe
  2⤵
  PID:4248
- C:\Windows\System\AdOcshA.exe
  C:\Windows\System\AdOcshA.exe
  2⤵
  PID:4264
- C:\Windows\System\RAxcwfB.exe
  C:\Windows\System\RAxcwfB.exe
  2⤵
  PID:4284
- C:\Windows\System\DzPqNPV.exe
  C:\Windows\System\DzPqNPV.exe
  2⤵
  PID:4304
- C:\Windows\System\cBbUjAv.exe
  C:\Windows\System\cBbUjAv.exe
  2⤵
  PID:4320
- C:\Windows\System\okCEzPc.exe
  C:\Windows\System\okCEzPc.exe
  2⤵
  PID:4356
- C:\Windows\System\fNWzeqf.exe
  C:\Windows\System\fNWzeqf.exe
  2⤵
  PID:4372
- C:\Windows\System\paoTMyz.exe
  C:\Windows\System\paoTMyz.exe
  2⤵
  PID:4396
- C:\Windows\System\bIdVTcQ.exe
  C:\Windows\System\bIdVTcQ.exe
  2⤵
  PID:4412
- C:\Windows\System\thhjJaA.exe
  C:\Windows\System\thhjJaA.exe
  2⤵
  PID:4428
- C:\Windows\System\tefsbJk.exe
  C:\Windows\System\tefsbJk.exe
  2⤵
  PID:4468
- C:\Windows\System\XHrihUU.exe
  C:\Windows\System\XHrihUU.exe
  2⤵
  PID:4484
- C:\Windows\System\kuUqmTw.exe
  C:\Windows\System\kuUqmTw.exe
  2⤵
  PID:4504
- C:\Windows\System\MussBWH.exe
  C:\Windows\System\MussBWH.exe
  2⤵
  PID:4524
- C:\Windows\System\fzGrnsq.exe
  C:\Windows\System\fzGrnsq.exe
  2⤵
  PID:4544
- C:\Windows\System\ywnDifb.exe
  C:\Windows\System\ywnDifb.exe
  2⤵
  PID:4592
- C:\Windows\System\ZPPwThu.exe
  C:\Windows\System\ZPPwThu.exe
  2⤵
  PID:4608
- C:\Windows\System\MOrArHh.exe
  C:\Windows\System\MOrArHh.exe
  2⤵
  PID:4628
- C:\Windows\System\xISHFaP.exe
  C:\Windows\System\xISHFaP.exe
  2⤵
  PID:4648
- C:\Windows\System\hGDMcWw.exe
  C:\Windows\System\hGDMcWw.exe
  2⤵
  PID:4664
- C:\Windows\System\xZaIYWH.exe
  C:\Windows\System\xZaIYWH.exe
  2⤵
  PID:4684
- C:\Windows\System\nLbfmqL.exe
  C:\Windows\System\nLbfmqL.exe
  2⤵
  PID:4704
- C:\Windows\System\KeaRkHT.exe
  C:\Windows\System\KeaRkHT.exe
  2⤵
  PID:4728
- C:\Windows\System\nkUdVQz.exe
  C:\Windows\System\nkUdVQz.exe
  2⤵
  PID:4744
- C:\Windows\System\erRFLhI.exe
  C:\Windows\System\erRFLhI.exe
  2⤵
  PID:4764
- C:\Windows\System\OwfGojb.exe
  C:\Windows\System\OwfGojb.exe
  2⤵
  PID:4784
- C:\Windows\System\RKfpvGk.exe
  C:\Windows\System\RKfpvGk.exe
  2⤵
  PID:4800
- C:\Windows\System\mMhDNgf.exe
  C:\Windows\System\mMhDNgf.exe
  2⤵
  PID:4832
- C:\Windows\System\rRkUesz.exe
  C:\Windows\System\rRkUesz.exe
  2⤵
  PID:4852
- C:\Windows\System\VLOnGZN.exe
  C:\Windows\System\VLOnGZN.exe
  2⤵
  PID:4868
- C:\Windows\System\hciKPOe.exe
  C:\Windows\System\hciKPOe.exe
  2⤵
  PID:4892
- C:\Windows\System\dQTnwot.exe
  C:\Windows\System\dQTnwot.exe
  2⤵
  PID:4912
- C:\Windows\System\VsuWKsF.exe
  C:\Windows\System\VsuWKsF.exe
  2⤵
  PID:4928
- C:\Windows\System\CAxZmFA.exe
  C:\Windows\System\CAxZmFA.exe
  2⤵
  PID:4964
- C:\Windows\System\CXvRcqw.exe
  C:\Windows\System\CXvRcqw.exe
  2⤵
  PID:4980
- C:\Windows\System\CiKIcSh.exe
  C:\Windows\System\CiKIcSh.exe
  2⤵
  PID:4996
- C:\Windows\System\jDzdpfr.exe
  C:\Windows\System\jDzdpfr.exe
  2⤵
  PID:5012
- C:\Windows\System\SxzHnzl.exe
  C:\Windows\System\SxzHnzl.exe
  2⤵
  PID:5028
- C:\Windows\System\cscXYcE.exe
  C:\Windows\System\cscXYcE.exe
  2⤵
  PID:5064
- C:\Windows\System\uAgPpJC.exe
  C:\Windows\System\uAgPpJC.exe
  2⤵
  PID:5080
- C:\Windows\System\RVCMhWr.exe
  C:\Windows\System\RVCMhWr.exe
  2⤵
  PID:5096
- C:\Windows\System\UmWquSr.exe
  C:\Windows\System\UmWquSr.exe
  2⤵
  PID:5112
- C:\Windows\System\gnRwbhC.exe
  C:\Windows\System\gnRwbhC.exe
  2⤵
  PID:3804
- C:\Windows\System\FHDeNOL.exe
  C:\Windows\System\FHDeNOL.exe
  2⤵
  PID:3948
- C:\Windows\System\iuOzcyO.exe
  C:\Windows\System\iuOzcyO.exe
  2⤵
  PID:3840
- C:\Windows\System\synAhAj.exe
  C:\Windows\System\synAhAj.exe
  2⤵
  PID:3844
- C:\Windows\System\oIlFDvd.exe
  C:\Windows\System\oIlFDvd.exe
  2⤵
  PID:2452
- C:\Windows\System\IDlYjDD.exe
  C:\Windows\System\IDlYjDD.exe
  2⤵
  PID:4120
- C:\Windows\System\MGPBcrU.exe
  C:\Windows\System\MGPBcrU.exe
  2⤵
  PID:3268
- C:\Windows\System\bYNihyI.exe
  C:\Windows\System\bYNihyI.exe
  2⤵
  PID:4152
- C:\Windows\System\tdzVeXt.exe
  C:\Windows\System\tdzVeXt.exe
  2⤵
  PID:4176
- C:\Windows\System\zFvzjZb.exe
  C:\Windows\System\zFvzjZb.exe
  2⤵
  PID:4192
- C:\Windows\System\VrOfAhZ.exe
  C:\Windows\System\VrOfAhZ.exe
  2⤵
  PID:4224
- C:\Windows\System\rSSEZMV.exe
  C:\Windows\System\rSSEZMV.exe
  2⤵
  PID:4260
- C:\Windows\System\sywnJBu.exe
  C:\Windows\System\sywnJBu.exe
  2⤵
  PID:4276
- C:\Windows\System\SrmUOjz.exe
  C:\Windows\System\SrmUOjz.exe
  2⤵
  PID:4312
- C:\Windows\System\JqHHvWL.exe
  C:\Windows\System\JqHHvWL.exe
  2⤵
  PID:4340
- C:\Windows\System\cEtFNRD.exe
  C:\Windows\System\cEtFNRD.exe
  2⤵
  PID:4424
- C:\Windows\System\cfFIxTt.exe
  C:\Windows\System\cfFIxTt.exe
  2⤵
  PID:4404
- C:\Windows\System\oiQjJEb.exe
  C:\Windows\System\oiQjJEb.exe
  2⤵
  PID:4560
- C:\Windows\System\ejFIVFT.exe
  C:\Windows\System\ejFIVFT.exe
  2⤵
  PID:4496
- C:\Windows\System\KDXJdLJ.exe
  C:\Windows\System\KDXJdLJ.exe
  2⤵
  PID:4580
- C:\Windows\System\OnTnzCW.exe
  C:\Windows\System\OnTnzCW.exe
  2⤵
  PID:4604
- C:\Windows\System\cjqYrhK.exe
  C:\Windows\System\cjqYrhK.exe
  2⤵
  PID:4660
- C:\Windows\System\dtERVsp.exe
  C:\Windows\System\dtERVsp.exe
  2⤵
  PID:4820
- C:\Windows\System\pnWWCaB.exe
  C:\Windows\System\pnWWCaB.exe
  2⤵
  PID:4848
- C:\Windows\System\LGBtyNa.exe
  C:\Windows\System\LGBtyNa.exe
  2⤵
  PID:4864
- C:\Windows\System\jmwdwCW.exe
  C:\Windows\System\jmwdwCW.exe
  2⤵
  PID:4900
- C:\Windows\System\gUxZaBO.exe
  C:\Windows\System\gUxZaBO.exe
  2⤵
  PID:4924
- C:\Windows\System\LhHdAWw.exe
  C:\Windows\System\LhHdAWw.exe
  2⤵
  PID:4948
- C:\Windows\System\gpCkwdP.exe
  C:\Windows\System\gpCkwdP.exe
  2⤵
  PID:4972
- C:\Windows\System\dMyIOhh.exe
  C:\Windows\System\dMyIOhh.exe
  2⤵
  PID:5008
- C:\Windows\System\cdTTRtg.exe
  C:\Windows\System\cdTTRtg.exe
  2⤵
  PID:5024
- C:\Windows\System\JvAQfOX.exe
  C:\Windows\System\JvAQfOX.exe
  2⤵
  PID:5056
- C:\Windows\System\YVTfLkU.exe
  C:\Windows\System\YVTfLkU.exe
  2⤵
  PID:5072
- C:\Windows\System\MFAHmDg.exe
  C:\Windows\System\MFAHmDg.exe
  2⤵
  PID:5104
- C:\Windows\System\VJkmUQn.exe
  C:\Windows\System\VJkmUQn.exe
  2⤵
  PID:4184
- C:\Windows\System\yockeyL.exe
  C:\Windows\System\yockeyL.exe
  2⤵
  PID:3516
- C:\Windows\System\KRVhltP.exe
  C:\Windows\System\KRVhltP.exe
  2⤵
  PID:5092
- C:\Windows\System\hAOjhlJ.exe
  C:\Windows\System\hAOjhlJ.exe
  2⤵
  PID:3440
- C:\Windows\System\ZpGIuoE.exe
  C:\Windows\System\ZpGIuoE.exe
  2⤵
  PID:4136
- C:\Windows\System\DYopRES.exe
  C:\Windows\System\DYopRES.exe
  2⤵
  PID:4408
- C:\Windows\System\skPsGKU.exe
  C:\Windows\System\skPsGKU.exe
  2⤵
  PID:4420
- C:\Windows\System\VXUTlvG.exe
  C:\Windows\System\VXUTlvG.exe
  2⤵
  PID:4168
- C:\Windows\System\xbtmyut.exe
  C:\Windows\System\xbtmyut.exe
  2⤵
  PID:4444
- C:\Windows\System\MqCVwPX.exe
  C:\Windows\System\MqCVwPX.exe
  2⤵
  PID:4492
- C:\Windows\System\fZcQWYq.exe
  C:\Windows\System\fZcQWYq.exe
  2⤵
  PID:4516
- C:\Windows\System\GtNvtaT.exe
  C:\Windows\System\GtNvtaT.exe
  2⤵
  PID:4640
- C:\Windows\System\WTyWjWy.exe
  C:\Windows\System\WTyWjWy.exe
  2⤵
  PID:4620
- C:\Windows\System\CszQYSa.exe
  C:\Windows\System\CszQYSa.exe
  2⤵
  PID:4676
- C:\Windows\System\ubeRIrk.exe
  C:\Windows\System\ubeRIrk.exe
  2⤵
  PID:4752
- C:\Windows\System\UsMByBL.exe
  C:\Windows\System\UsMByBL.exe
  2⤵
  PID:4720
- C:\Windows\System\EeEwmaV.exe
  C:\Windows\System\EeEwmaV.exe
  2⤵
  PID:4772
- C:\Windows\System\vWQXqqI.exe
  C:\Windows\System\vWQXqqI.exe
  2⤵
  PID:4792
- C:\Windows\System\pVfbtTU.exe
  C:\Windows\System\pVfbtTU.exe
  2⤵
  PID:4840
- C:\Windows\System\MoKeByK.exe
  C:\Windows\System\MoKeByK.exe
  2⤵
  PID:4940
- C:\Windows\System\jbskltM.exe
  C:\Windows\System\jbskltM.exe
  2⤵
  PID:5044
- C:\Windows\System\EjizuAn.exe
  C:\Windows\System\EjizuAn.exe
  2⤵
  PID:3336
- C:\Windows\System\PSoIyVL.exe
  C:\Windows\System\PSoIyVL.exe
  2⤵
  PID:4296
- C:\Windows\System\bTJahUA.exe
  C:\Windows\System\bTJahUA.exe
  2⤵
  PID:4380
- C:\Windows\System\SdUfsze.exe
  C:\Windows\System\SdUfsze.exe
  2⤵
  PID:4960
- C:\Windows\System\XEqkPMc.exe
  C:\Windows\System\XEqkPMc.exe
  2⤵
  PID:3888
- C:\Windows\System\UTMVSvM.exe
  C:\Windows\System\UTMVSvM.exe
  2⤵
  PID:3964
- C:\Windows\System\iqaCsVR.exe
  C:\Windows\System\iqaCsVR.exe
  2⤵
  PID:4124
- C:\Windows\System\ueEFQcJ.exe
  C:\Windows\System\ueEFQcJ.exe
  2⤵
  PID:4348
- C:\Windows\System\POsYwiT.exe
  C:\Windows\System\POsYwiT.exe
  2⤵
  PID:5052
- C:\Windows\System\wPnDqjN.exe
  C:\Windows\System\wPnDqjN.exe
  2⤵
  PID:4328
- C:\Windows\System\aYFoCZj.exe
  C:\Windows\System\aYFoCZj.exe
  2⤵
  PID:4440
- C:\Windows\System\lyTCYgk.exe
  C:\Windows\System\lyTCYgk.exe
  2⤵
  PID:5004
- C:\Windows\System\xcoGPZA.exe
  C:\Windows\System\xcoGPZA.exe
  2⤵
  PID:4272
- C:\Windows\System\sTVnSqZ.exe
  C:\Windows\System\sTVnSqZ.exe
  2⤵
  PID:4576
- C:\Windows\System\dBiIkfR.exe
  C:\Windows\System\dBiIkfR.exe
  2⤵
  PID:4724
- C:\Windows\System\CiZGugd.exe
  C:\Windows\System\CiZGugd.exe
  2⤵
  PID:4552
- C:\Windows\System\LTYmIMX.exe
  C:\Windows\System\LTYmIMX.exe
  2⤵
  PID:4712
- C:\Windows\System\ssCNgPk.exe
  C:\Windows\System\ssCNgPk.exe
  2⤵
  PID:4716
- C:\Windows\System\sTBdSIN.exe
  C:\Windows\System\sTBdSIN.exe
  2⤵
  PID:5076
- C:\Windows\System\JsICSMX.exe
  C:\Windows\System\JsICSMX.exe
  2⤵
  PID:5060
- C:\Windows\System\SfzyWQF.exe
  C:\Windows\System\SfzyWQF.exe
  2⤵
  PID:4480
- C:\Windows\System\IbpDLPK.exe
  C:\Windows\System\IbpDLPK.exe
  2⤵
  PID:4144
- C:\Windows\System\JIgFziJ.exe
  C:\Windows\System\JIgFziJ.exe
  2⤵
  PID:3308
- C:\Windows\System\oyYBfXz.exe
  C:\Windows\System\oyYBfXz.exe
  2⤵
  PID:3660
- C:\Windows\System\EeAsqUu.exe
  C:\Windows\System\EeAsqUu.exe
  2⤵
  PID:4740
- C:\Windows\System\KuaRkTZ.exe
  C:\Windows\System\KuaRkTZ.exe
  2⤵
  PID:4888
- C:\Windows\System\VNqXqeT.exe
  C:\Windows\System\VNqXqeT.exe
  2⤵
  PID:5128
- C:\Windows\System\cRyDUtf.exe
  C:\Windows\System\cRyDUtf.exe
  2⤵
  PID:5144
- C:\Windows\System\IeBfCGW.exe
  C:\Windows\System\IeBfCGW.exe
  2⤵
  PID:5164
- C:\Windows\System\btxzbxW.exe
  C:\Windows\System\btxzbxW.exe
  2⤵
  PID:5180
- C:\Windows\System\xFUcnmy.exe
  C:\Windows\System\xFUcnmy.exe
  2⤵
  PID:5196
- C:\Windows\System\SuozYDr.exe
  C:\Windows\System\SuozYDr.exe
  2⤵
  PID:5216
- C:\Windows\System\QEFLjnr.exe
  C:\Windows\System\QEFLjnr.exe
  2⤵
  PID:5232
- C:\Windows\System\gdzrBtW.exe
  C:\Windows\System\gdzrBtW.exe
  2⤵
  PID:5248
- C:\Windows\System\OwAWjSH.exe
  C:\Windows\System\OwAWjSH.exe
  2⤵
  PID:5264
- C:\Windows\System\eleUilG.exe
  C:\Windows\System\eleUilG.exe
  2⤵
  PID:5284
- C:\Windows\System\iigCPGH.exe
  C:\Windows\System\iigCPGH.exe
  2⤵
  PID:5300
- C:\Windows\System\jParXzU.exe
  C:\Windows\System\jParXzU.exe
  2⤵
  PID:5316
- C:\Windows\System\RRNNime.exe
  C:\Windows\System\RRNNime.exe
  2⤵
  PID:5332
- C:\Windows\System\caVOhws.exe
  C:\Windows\System\caVOhws.exe
  2⤵
  PID:5404
- C:\Windows\System\vayLRiL.exe
  C:\Windows\System\vayLRiL.exe
  2⤵
  PID:5420
- C:\Windows\System\GvkbZIC.exe
  C:\Windows\System\GvkbZIC.exe
  2⤵
  PID:5440
- C:\Windows\System\zEpGDZR.exe
  C:\Windows\System\zEpGDZR.exe
  2⤵
  PID:5456
- C:\Windows\System\klPgebc.exe
  C:\Windows\System\klPgebc.exe
  2⤵
  PID:5472
- C:\Windows\System\TuKQMLN.exe
  C:\Windows\System\TuKQMLN.exe
  2⤵
  PID:5488
- C:\Windows\System\fsjSnSa.exe
  C:\Windows\System\fsjSnSa.exe
  2⤵
  PID:5508
- C:\Windows\System\MkSomgr.exe
  C:\Windows\System\MkSomgr.exe
  2⤵
  PID:5528
- C:\Windows\System\GSjuTfB.exe
  C:\Windows\System\GSjuTfB.exe
  2⤵
  PID:5544
- C:\Windows\System\wYRUrUI.exe
  C:\Windows\System\wYRUrUI.exe
  2⤵
  PID:5560
- C:\Windows\System\KLGGhbw.exe
  C:\Windows\System\KLGGhbw.exe
  2⤵
  PID:5576
- C:\Windows\System\IRMRPIK.exe
  C:\Windows\System\IRMRPIK.exe
  2⤵
  PID:5596
- C:\Windows\System\EGPHstE.exe
  C:\Windows\System\EGPHstE.exe
  2⤵
  PID:5612
- C:\Windows\System\xwesHib.exe
  C:\Windows\System\xwesHib.exe
  2⤵
  PID:5628
- C:\Windows\System\fhkRrie.exe
  C:\Windows\System\fhkRrie.exe
  2⤵
  PID:5648
- C:\Windows\System\VavLjHJ.exe
  C:\Windows\System\VavLjHJ.exe
  2⤵
  PID:5664
- C:\Windows\System\NLsXwUM.exe
  C:\Windows\System\NLsXwUM.exe
  2⤵
  PID:5680
- C:\Windows\System\VaWhxAF.exe
  C:\Windows\System\VaWhxAF.exe
  2⤵
  PID:5696
- C:\Windows\System\acZqWGs.exe
  C:\Windows\System\acZqWGs.exe
  2⤵
  PID:5712
- C:\Windows\System\PiJjSmM.exe
  C:\Windows\System\PiJjSmM.exe
  2⤵
  PID:5728
- C:\Windows\System\vIGeqow.exe
  C:\Windows\System\vIGeqow.exe
  2⤵
  PID:5748
- C:\Windows\System\ipHbwpn.exe
  C:\Windows\System\ipHbwpn.exe
  2⤵
  PID:5764
- C:\Windows\System\oQafzYi.exe
  C:\Windows\System\oQafzYi.exe
  2⤵
  PID:5780
- C:\Windows\System\DXfCIab.exe
  C:\Windows\System\DXfCIab.exe
  2⤵
  PID:5796
- C:\Windows\System\yCOnuHu.exe
  C:\Windows\System\yCOnuHu.exe
  2⤵
  PID:5812
- C:\Windows\System\sozHmOk.exe
  C:\Windows\System\sozHmOk.exe
  2⤵
  PID:5832
- C:\Windows\System\JYiwruM.exe
  C:\Windows\System\JYiwruM.exe
  2⤵
  PID:5868
- C:\Windows\System\ftajzlA.exe
  C:\Windows\System\ftajzlA.exe
  2⤵
  PID:5884
- C:\Windows\System\nVRPbrK.exe
  C:\Windows\System\nVRPbrK.exe
  2⤵
  PID:5900
- C:\Windows\System\cuhKdnn.exe
  C:\Windows\System\cuhKdnn.exe
  2⤵
  PID:5916
- C:\Windows\System\uUwWRFW.exe
  C:\Windows\System\uUwWRFW.exe
  2⤵
  PID:5932
- C:\Windows\System\SfGdRCk.exe
  C:\Windows\System\SfGdRCk.exe
  2⤵
  PID:5948
- C:\Windows\System\HybacYW.exe
  C:\Windows\System\HybacYW.exe
  2⤵
  PID:5964
- C:\Windows\System\ksCFqJA.exe
  C:\Windows\System\ksCFqJA.exe
  2⤵
  PID:5980
- C:\Windows\System\JornzrM.exe
  C:\Windows\System\JornzrM.exe
  2⤵
  PID:5996
- C:\Windows\System\EetxbCW.exe
  C:\Windows\System\EetxbCW.exe
  2⤵
  PID:6012
- C:\Windows\System\dTvbICD.exe
  C:\Windows\System\dTvbICD.exe
  2⤵
  PID:6028
- C:\Windows\System\WeiIiok.exe
  C:\Windows\System\WeiIiok.exe
  2⤵
  PID:6044
- C:\Windows\System\CMNruxm.exe
  C:\Windows\System\CMNruxm.exe
  2⤵
  PID:6060
- C:\Windows\System\qCtZsty.exe
  C:\Windows\System\qCtZsty.exe
  2⤵
  PID:6076
- C:\Windows\System\lNQbeCq.exe
  C:\Windows\System\lNQbeCq.exe
  2⤵
  PID:6092
- C:\Windows\System\VzDwQfU.exe
  C:\Windows\System\VzDwQfU.exe
  2⤵
  PID:6108
- C:\Windows\System\GkdBwup.exe
  C:\Windows\System\GkdBwup.exe
  2⤵
  PID:6124
- C:\Windows\System\TCTHSfL.exe
  C:\Windows\System\TCTHSfL.exe
  2⤵
  PID:6140
- C:\Windows\System\OaikZHX.exe
  C:\Windows\System\OaikZHX.exe
  2⤵
  PID:4920
- C:\Windows\System\NbdFoto.exe
  C:\Windows\System\NbdFoto.exe
  2⤵
  PID:5040
- C:\Windows\System\XOZpcof.exe
  C:\Windows\System\XOZpcof.exe
  2⤵
  PID:4336
- C:\Windows\System\kIKvaPd.exe
  C:\Windows\System\kIKvaPd.exe
  2⤵
  PID:4692
- C:\Windows\System\kpedyLq.exe
  C:\Windows\System\kpedyLq.exe
  2⤵
  PID:5224
- C:\Windows\System\VbXfzLq.exe
  C:\Windows\System\VbXfzLq.exe
  2⤵
  PID:5324
- C:\Windows\System\BUHeyxs.exe
  C:\Windows\System\BUHeyxs.exe
  2⤵
  PID:5228
- C:\Windows\System\YeTFCaF.exe
  C:\Windows\System\YeTFCaF.exe
  2⤵
  PID:2196
- C:\Windows\System\QfKxasR.exe
  C:\Windows\System\QfKxasR.exe
  2⤵
  PID:5308
- C:\Windows\System\DAdeBFm.exe
  C:\Windows\System\DAdeBFm.exe
  2⤵
  PID:5244
- C:\Windows\System\PsGyLbw.exe
  C:\Windows\System\PsGyLbw.exe
  2⤵
  PID:5240
- C:\Windows\System\KHPMRwa.exe
  C:\Windows\System\KHPMRwa.exe
  2⤵
  PID:5176
- C:\Windows\System\ezmWowc.exe
  C:\Windows\System\ezmWowc.exe
  2⤵
  PID:5352
- C:\Windows\System\mJXqRTG.exe
  C:\Windows\System\mJXqRTG.exe
  2⤵
  PID:5368
- C:\Windows\System\RvGlDPe.exe
  C:\Windows\System\RvGlDPe.exe
  2⤵
  PID:5384
- C:\Windows\System\raDmPhi.exe
  C:\Windows\System\raDmPhi.exe
  2⤵
  PID:5412
- C:\Windows\System\WkGVdxz.exe
  C:\Windows\System\WkGVdxz.exe
  2⤵
  PID:5448
- C:\Windows\System\tKiEMcl.exe
  C:\Windows\System\tKiEMcl.exe
  2⤵
  PID:5484
- C:\Windows\System\wytleFO.exe
  C:\Windows\System\wytleFO.exe
  2⤵
  PID:5656
- C:\Windows\System\FfFfFpq.exe
  C:\Windows\System\FfFfFpq.exe
  2⤵
  PID:5516
- C:\Windows\System\BqthDJD.exe
  C:\Windows\System\BqthDJD.exe
  2⤵
  PID:5468
- C:\Windows\System\TCrxrpd.exe
  C:\Windows\System\TCrxrpd.exe
  2⤵
  PID:5592
- C:\Windows\System\ltmPhOg.exe
  C:\Windows\System\ltmPhOg.exe
  2⤵
  PID:5608
- C:\Windows\System\AahchWw.exe
  C:\Windows\System\AahchWw.exe
  2⤵
  PID:5496
- C:\Windows\System\CAEUhrW.exe
  C:\Windows\System\CAEUhrW.exe
  2⤵
  PID:5852
- C:\Windows\System\UcBRBmT.exe
  C:\Windows\System\UcBRBmT.exe
  2⤵
  PID:5640
- C:\Windows\System\uRMyBSh.exe
  C:\Windows\System\uRMyBSh.exe
  2⤵
  PID:5860
- C:\Windows\System\EDfhMBA.exe
  C:\Windows\System\EDfhMBA.exe
  2⤵
  PID:5820
- C:\Windows\System\OXIfmdV.exe
  C:\Windows\System\OXIfmdV.exe
  2⤵
  PID:5828
- C:\Windows\System\yZhCcAY.exe
  C:\Windows\System\yZhCcAY.exe
  2⤵
  PID:5676
- C:\Windows\System\NaORyCD.exe
  C:\Windows\System\NaORyCD.exe
  2⤵
  PID:5736
- C:\Windows\System\oifOYtv.exe
  C:\Windows\System\oifOYtv.exe
  2⤵
  PID:5708
- C:\Windows\System\IvkarfA.exe
  C:\Windows\System\IvkarfA.exe
  2⤵
  PID:5912
- C:\Windows\System\avanlye.exe
  C:\Windows\System\avanlye.exe
  2⤵
  PID:5940
- C:\Windows\System\NWkQBTE.exe
  C:\Windows\System\NWkQBTE.exe
  2⤵
  PID:6008
- C:\Windows\System\oGCKbFb.exe
  C:\Windows\System\oGCKbFb.exe
  2⤵
  PID:6068
- C:\Windows\System\BibUMkh.exe
  C:\Windows\System\BibUMkh.exe
  2⤵
  PID:6104
- C:\Windows\System\utQdqLW.exe
  C:\Windows\System\utQdqLW.exe
  2⤵
  PID:5956
- C:\Windows\System\Hctjjnr.exe
  C:\Windows\System\Hctjjnr.exe
  2⤵
  PID:6024
- C:\Windows\System\hqySGbu.exe
  C:\Windows\System\hqySGbu.exe
  2⤵
  PID:6132
- C:\Windows\System\kLoQvhk.exe
  C:\Windows\System\kLoQvhk.exe
  2⤵
  PID:4644
- C:\Windows\System\IgjcQSg.exe
  C:\Windows\System\IgjcQSg.exe
  2⤵
  PID:4208
- C:\Windows\System\pVdFxUC.exe
  C:\Windows\System\pVdFxUC.exe
  2⤵
  PID:4884
- C:\Windows\System\HDcDabK.exe
  C:\Windows\System\HDcDabK.exe
  2⤵
  PID:5192
- C:\Windows\System\ANShufb.exe
  C:\Windows\System\ANShufb.exe
  2⤵
  PID:5312
- C:\Windows\System\CzXpxUZ.exe
  C:\Windows\System\CzXpxUZ.exe
  2⤵
  PID:5140
- C:\Windows\System\qaRJtwh.exe
  C:\Windows\System\qaRJtwh.exe
  2⤵
  PID:5416
- C:\Windows\System\poHOwpJ.exe
  C:\Windows\System\poHOwpJ.exe
  2⤵
  PID:5624
- C:\Windows\System\aXxCrPY.exe
  C:\Windows\System\aXxCrPY.exe
  2⤵
  PID:5464
- C:\Windows\System\dITtlwZ.exe
  C:\Windows\System\dITtlwZ.exe
  2⤵
  PID:5604
- C:\Windows\System\SCiNMHo.exe
  C:\Windows\System\SCiNMHo.exe
  2⤵
  PID:5672
- C:\Windows\System\qkmBtGt.exe
  C:\Windows\System\qkmBtGt.exe
  2⤵
  PID:5776
- C:\Windows\System\zqLEcFr.exe
  C:\Windows\System\zqLEcFr.exe
  2⤵
  PID:5760
- C:\Windows\System\cUfkMFu.exe
  C:\Windows\System\cUfkMFu.exe
  2⤵
  PID:5720
- C:\Windows\System\KEDjGzh.exe
  C:\Windows\System\KEDjGzh.exe
  2⤵
  PID:5892
- C:\Windows\System\xKIsAst.exe
  C:\Windows\System\xKIsAst.exe
  2⤵
  PID:6036
- C:\Windows\System\bKvzJjs.exe
  C:\Windows\System\bKvzJjs.exe
  2⤵
  PID:5988
- C:\Windows\System\gnybgkD.exe
  C:\Windows\System\gnybgkD.exe
  2⤵
  PID:6088
- C:\Windows\System\rCrmHzM.exe
  C:\Windows\System\rCrmHzM.exe
  2⤵
  PID:4160
- C:\Windows\System\QjNvWdT.exe
  C:\Windows\System\QjNvWdT.exe
  2⤵
  PID:5172
- C:\Windows\System\vkwqcny.exe
  C:\Windows\System\vkwqcny.exe
  2⤵
  PID:5392
- C:\Windows\System\MpUVQka.exe
  C:\Windows\System\MpUVQka.exe
  2⤵
  PID:5432
- C:\Windows\System\tCSuque.exe
  C:\Windows\System\tCSuque.exe
  2⤵
  PID:5152
- C:\Windows\System\RnzHhST.exe
  C:\Windows\System\RnzHhST.exe
  2⤵
  PID:6100
- C:\Windows\System\Seaxfqc.exe
  C:\Windows\System\Seaxfqc.exe
  2⤵
  PID:4672
- C:\Windows\System\QPltpcj.exe
  C:\Windows\System\QPltpcj.exe
  2⤵
  PID:5272
- C:\Windows\System\EakCilV.exe
  C:\Windows\System\EakCilV.exe
  2⤵
  PID:5620
- C:\Windows\System\DwuZmGA.exe
  C:\Windows\System\DwuZmGA.exe
  2⤵
  PID:6004
- C:\Windows\System\gsWJezQ.exe
  C:\Windows\System\gsWJezQ.exe
  2⤵
  PID:5292
- C:\Windows\System\NNUfERk.exe
  C:\Windows\System\NNUfERk.exe
  2⤵
  PID:5212
- C:\Windows\System\MmqLWwP.exe
  C:\Windows\System\MmqLWwP.exe
  2⤵
  PID:5972
- C:\Windows\System\NFDmOfz.exe
  C:\Windows\System\NFDmOfz.exe
  2⤵
  PID:5856
- C:\Windows\System\WopKEok.exe
  C:\Windows\System\WopKEok.exe
  2⤵
  PID:6168
- C:\Windows\System\lDmGuXN.exe
  C:\Windows\System\lDmGuXN.exe
  2⤵
  PID:6184
- C:\Windows\System\RGbnTdu.exe
  C:\Windows\System\RGbnTdu.exe
  2⤵
  PID:6200
- C:\Windows\System\wwXpKwl.exe
  C:\Windows\System\wwXpKwl.exe
  2⤵
  PID:6216
- C:\Windows\System\XostzHN.exe
  C:\Windows\System\XostzHN.exe
  2⤵
  PID:6232
- C:\Windows\System\hZhgzme.exe
  C:\Windows\System\hZhgzme.exe
  2⤵
  PID:6248
- C:\Windows\System\fEGUaSg.exe
  C:\Windows\System\fEGUaSg.exe
  2⤵
  PID:6264
- C:\Windows\System\mTeBWDa.exe
  C:\Windows\System\mTeBWDa.exe
  2⤵
  PID:6280
- C:\Windows\System\chJJpol.exe
  C:\Windows\System\chJJpol.exe
  2⤵
  PID:6296
- C:\Windows\System\MSKfvPy.exe
  C:\Windows\System\MSKfvPy.exe
  2⤵
  PID:6312
- C:\Windows\System\PLLOsvZ.exe
  C:\Windows\System\PLLOsvZ.exe
  2⤵
  PID:6328
- C:\Windows\System\dPCpNpt.exe
  C:\Windows\System\dPCpNpt.exe
  2⤵
  PID:6344
- C:\Windows\System\SeWBfrV.exe
  C:\Windows\System\SeWBfrV.exe
  2⤵
  PID:6360
- C:\Windows\System\OFUhhcD.exe
  C:\Windows\System\OFUhhcD.exe
  2⤵
  PID:6376
- C:\Windows\System\oLGQTSG.exe
  C:\Windows\System\oLGQTSG.exe
  2⤵
  PID:6392
- C:\Windows\System\UhIdWjE.exe
  C:\Windows\System\UhIdWjE.exe
  2⤵
  PID:6416
- C:\Windows\System\NrKMLqt.exe
  C:\Windows\System\NrKMLqt.exe
  2⤵
  PID:6432
- C:\Windows\System\VRlvwTk.exe
  C:\Windows\System\VRlvwTk.exe
  2⤵
  PID:6448
- C:\Windows\System\DowgvCi.exe
  C:\Windows\System\DowgvCi.exe
  2⤵
  PID:6464
- C:\Windows\System\DOmLRID.exe
  C:\Windows\System\DOmLRID.exe
  2⤵
  PID:6480
- C:\Windows\System\vsbCDgg.exe
  C:\Windows\System\vsbCDgg.exe
  2⤵
  PID:6496
- C:\Windows\System\PAAqSEY.exe
  C:\Windows\System\PAAqSEY.exe
  2⤵
  PID:6512
- C:\Windows\System\DgjwWXu.exe
  C:\Windows\System\DgjwWXu.exe
  2⤵
  PID:6528
- C:\Windows\System\TLhNCmh.exe
  C:\Windows\System\TLhNCmh.exe
  2⤵
  PID:6544
- C:\Windows\System\PCAEiip.exe
  C:\Windows\System\PCAEiip.exe
  2⤵
  PID:6560
- C:\Windows\System\TIITpwk.exe
  C:\Windows\System\TIITpwk.exe
  2⤵
  PID:6576
- C:\Windows\System\EimiTbK.exe
  C:\Windows\System\EimiTbK.exe
  2⤵
  PID:6592
- C:\Windows\System\zmebNEU.exe
  C:\Windows\System\zmebNEU.exe
  2⤵
  PID:6608
- C:\Windows\System\lhvzdFN.exe
  C:\Windows\System\lhvzdFN.exe
  2⤵
  PID:6624
- C:\Windows\System\YyljoAU.exe
  C:\Windows\System\YyljoAU.exe
  2⤵
  PID:6640
- C:\Windows\System\IHfhGhV.exe
  C:\Windows\System\IHfhGhV.exe
  2⤵
  PID:6656
- C:\Windows\System\hvFVSHJ.exe
  C:\Windows\System\hvFVSHJ.exe
  2⤵
  PID:6676
- C:\Windows\System\HFVovzV.exe
  C:\Windows\System\HFVovzV.exe
  2⤵
  PID:6692
- C:\Windows\System\SagWTIB.exe
  C:\Windows\System\SagWTIB.exe
  2⤵
  PID:6708
- C:\Windows\System\znnabcj.exe
  C:\Windows\System\znnabcj.exe
  2⤵
  PID:6724
- C:\Windows\System\WavAVWt.exe
  C:\Windows\System\WavAVWt.exe
  2⤵
  PID:6740
- C:\Windows\System\vEfZoYr.exe
  C:\Windows\System\vEfZoYr.exe
  2⤵
  PID:6756
- C:\Windows\System\zLNmBas.exe
  C:\Windows\System\zLNmBas.exe
  2⤵
  PID:6772
- C:\Windows\System\MnqCeBR.exe
  C:\Windows\System\MnqCeBR.exe
  2⤵
  PID:6788
- C:\Windows\System\JSnYySM.exe
  C:\Windows\System\JSnYySM.exe
  2⤵
  PID:6804
- C:\Windows\System\nisArGO.exe
  C:\Windows\System\nisArGO.exe
  2⤵
  PID:6820
- C:\Windows\System\eGNIvmR.exe
  C:\Windows\System\eGNIvmR.exe
  2⤵
  PID:6836
- C:\Windows\System\YBMjHFg.exe
  C:\Windows\System\YBMjHFg.exe
  2⤵
  PID:6852
- C:\Windows\System\KFgqiKK.exe
  C:\Windows\System\KFgqiKK.exe
  2⤵
  PID:6868
- C:\Windows\System\kedqJIm.exe
  C:\Windows\System\kedqJIm.exe
  2⤵
  PID:6884
- C:\Windows\System\hhHdOnd.exe
  C:\Windows\System\hhHdOnd.exe
  2⤵
  PID:6900
- C:\Windows\System\bfxoQGi.exe
  C:\Windows\System\bfxoQGi.exe
  2⤵
  PID:6916
- C:\Windows\System\vQXCmdN.exe
  C:\Windows\System\vQXCmdN.exe
  2⤵
  PID:6932
- C:\Windows\System\QbxmhIZ.exe
  C:\Windows\System\QbxmhIZ.exe
  2⤵
  PID:6948
- C:\Windows\System\RoGjIVy.exe
  C:\Windows\System\RoGjIVy.exe
  2⤵
  PID:6964
- C:\Windows\System\dhNbvAD.exe
  C:\Windows\System\dhNbvAD.exe
  2⤵
  PID:6980
- C:\Windows\System\BUeKCie.exe
  C:\Windows\System\BUeKCie.exe
  2⤵
  PID:6996
- C:\Windows\System\qatgYVo.exe
  C:\Windows\System\qatgYVo.exe
  2⤵
  PID:7012
- C:\Windows\System\CVlpoaB.exe
  C:\Windows\System\CVlpoaB.exe
  2⤵
  PID:7028
- C:\Windows\System\EonDGPa.exe
  C:\Windows\System\EonDGPa.exe
  2⤵
  PID:7044
- C:\Windows\System\JWXFxwD.exe
  C:\Windows\System\JWXFxwD.exe
  2⤵
  PID:7060
- C:\Windows\System\LMqUSki.exe
  C:\Windows\System\LMqUSki.exe
  2⤵
  PID:7076
- C:\Windows\System\jzVJcFs.exe
  C:\Windows\System\jzVJcFs.exe
  2⤵
  PID:7092
- C:\Windows\System\LgrhQmE.exe
  C:\Windows\System\LgrhQmE.exe
  2⤵
  PID:7108
- C:\Windows\System\DzPUqWP.exe
  C:\Windows\System\DzPUqWP.exe
  2⤵
  PID:7124
- C:\Windows\System\MfeRNKu.exe
  C:\Windows\System\MfeRNKu.exe
  2⤵
  PID:7140
- C:\Windows\System\DghzJSC.exe
  C:\Windows\System\DghzJSC.exe
  2⤵
  PID:7156
- C:\Windows\System\fjDZDpA.exe
  C:\Windows\System\fjDZDpA.exe
  2⤵
  PID:5524
- C:\Windows\System\gxOuXbX.exe
  C:\Windows\System\gxOuXbX.exe
  2⤵
  PID:5360
- C:\Windows\System\yKkFTmk.exe
  C:\Windows\System\yKkFTmk.exe
  2⤵
  PID:6116
- C:\Windows\System\QVUCKyf.exe
  C:\Windows\System\QVUCKyf.exe
  2⤵
  PID:5908
- C:\Windows\System\QlCLcny.exe
  C:\Windows\System\QlCLcny.exe
  2⤵
  PID:5136
- C:\Windows\System\BkYzkSw.exe
  C:\Windows\System\BkYzkSw.exe
  2⤵
  PID:6208
- C:\Windows\System\EIoFIfI.exe
  C:\Windows\System\EIoFIfI.exe
  2⤵
  PID:6244
- C:\Windows\System\DexAlqD.exe
  C:\Windows\System\DexAlqD.exe
  2⤵
  PID:6304
- C:\Windows\System\ZRHLArS.exe
  C:\Windows\System\ZRHLArS.exe
  2⤵
  PID:6256
- C:\Windows\System\fZzOahr.exe
  C:\Windows\System\fZzOahr.exe
  2⤵
  PID:6192
- C:\Windows\System\cvcUxfQ.exe
  C:\Windows\System\cvcUxfQ.exe
  2⤵
  PID:6288
- C:\Windows\System\cRTCVQO.exe
  C:\Windows\System\cRTCVQO.exe
  2⤵
  PID:6320
- C:\Windows\System\oBglgAp.exe
  C:\Windows\System\oBglgAp.exe
  2⤵
  PID:6356
- C:\Windows\System\JcYYoyc.exe
  C:\Windows\System\JcYYoyc.exe
  2⤵
  PID:5864
- C:\Windows\System\fSsixCe.exe
  C:\Windows\System\fSsixCe.exe
  2⤵
  PID:6472
- C:\Windows\System\eJLEEzb.exe
  C:\Windows\System\eJLEEzb.exe
  2⤵
  PID:6536
- C:\Windows\System\zQqZkUO.exe
  C:\Windows\System\zQqZkUO.exe
  2⤵
  PID:6524
- C:\Windows\System\KlOMcsp.exe
  C:\Windows\System\KlOMcsp.exe
  2⤵
  PID:6492
- C:\Windows\System\nleCmhp.exe
  C:\Windows\System\nleCmhp.exe
  2⤵
  PID:6520
- C:\Windows\System\LSSFpeY.exe
  C:\Windows\System\LSSFpeY.exe
  2⤵
  PID:6600
- C:\Windows\System\LdfxdOH.exe
  C:\Windows\System\LdfxdOH.exe
  2⤵
  PID:6616
- C:\Windows\System\rNxixcq.exe
  C:\Windows\System\rNxixcq.exe
  2⤵
  PID:6664
- C:\Windows\System\EsvlKJW.exe
  C:\Windows\System\EsvlKJW.exe
  2⤵
  PID:6700
- C:\Windows\System\CQeesPW.exe
  C:\Windows\System\CQeesPW.exe
  2⤵
  PID:6736
- C:\Windows\System\WiaErVL.exe
  C:\Windows\System\WiaErVL.exe
  2⤵
  PID:6800
- C:\Windows\System\nDOXYOh.exe
  C:\Windows\System\nDOXYOh.exe
  2⤵
  PID:6864
- C:\Windows\System\TqYdYMY.exe
  C:\Windows\System\TqYdYMY.exe
  2⤵
  PID:6896
- C:\Windows\System\lqfPLbB.exe
  C:\Windows\System\lqfPLbB.exe
  2⤵
  PID:6960
- C:\Windows\System\CecLpQS.exe
  C:\Windows\System\CecLpQS.exe
  2⤵
  PID:7024
- C:\Windows\System\qdQgZJw.exe
  C:\Windows\System\qdQgZJw.exe
  2⤵
  PID:7088
- C:\Windows\System\BPIVhgc.exe
  C:\Windows\System\BPIVhgc.exe
  2⤵
  PID:7152
- C:\Windows\System\FcVTNCf.exe
  C:\Windows\System\FcVTNCf.exe
  2⤵
  PID:5296
- C:\Windows\System\ZWmoTZG.exe
  C:\Windows\System\ZWmoTZG.exe
  2⤵
  PID:6160
- C:\Windows\System\gyICbCN.exe
  C:\Windows\System\gyICbCN.exe
  2⤵
  PID:6372
- C:\Windows\System\cvtusnj.exe
  C:\Windows\System\cvtusnj.exe
  2⤵
  PID:6876
- C:\Windows\System\JrfIXMV.exe
  C:\Windows\System\JrfIXMV.exe
  2⤵
  PID:6752
- C:\Windows\System\gXgVdbt.exe
  C:\Windows\System\gXgVdbt.exe
  2⤵
  PID:7004
- C:\Windows\System\qQfaHvS.exe
  C:\Windows\System\qQfaHvS.exe
  2⤵
  PID:6152
- C:\Windows\System\KuNRfLm.exe
  C:\Windows\System\KuNRfLm.exe
  2⤵
  PID:6812
- C:\Windows\System\tpTWqPg.exe
  C:\Windows\System\tpTWqPg.exe
  2⤵
  PID:5704
- C:\Windows\System\OcrcdmZ.exe
  C:\Windows\System\OcrcdmZ.exe
  2⤵
  PID:6848
- C:\Windows\System\LICcMaH.exe
  C:\Windows\System\LICcMaH.exe
  2⤵
  PID:7008
- C:\Windows\System\unGUHJC.exe
  C:\Windows\System\unGUHJC.exe
  2⤵
  PID:7104
- C:\Windows\System\cQcDACZ.exe
  C:\Windows\System\cQcDACZ.exe
  2⤵
  PID:5436
- C:\Windows\System\MXkDmmx.exe
  C:\Windows\System\MXkDmmx.exe
  2⤵
  PID:5848
- C:\Windows\System\zprfGlK.exe
  C:\Windows\System\zprfGlK.exe
  2⤵
  PID:6388
- C:\Windows\System\xJzZkxR.exe
  C:\Windows\System\xJzZkxR.exe
  2⤵
  PID:6428
- C:\Windows\System\pQyaZqt.exe
  C:\Windows\System\pQyaZqt.exe
  2⤵
  PID:6648
- C:\Windows\System\keUiHCq.exe
  C:\Windows\System\keUiHCq.exe
  2⤵
  PID:6672
- C:\Windows\System\cHEzfmi.exe
  C:\Windows\System\cHEzfmi.exe
  2⤵
  PID:6860
- C:\Windows\System\jlrPepE.exe
  C:\Windows\System\jlrPepE.exe
  2⤵
  PID:6768
- C:\Windows\System\npUwGdj.exe
  C:\Windows\System\npUwGdj.exe
  2⤵
  PID:6992
- C:\Windows\System\dyOTraj.exe
  C:\Windows\System\dyOTraj.exe
  2⤵
  PID:4976
- C:\Windows\System\HdkhYlF.exe
  C:\Windows\System\HdkhYlF.exe
  2⤵
  PID:6180
- C:\Windows\System\BsvMCYu.exe
  C:\Windows\System\BsvMCYu.exe
  2⤵
  PID:6504
- C:\Windows\System\TSosgPt.exe
  C:\Windows\System\TSosgPt.exe
  2⤵
  PID:6972
- C:\Windows\System\fqWRlyx.exe
  C:\Windows\System\fqWRlyx.exe
  2⤵
  PID:7072
- C:\Windows\System\eyWTBuJ.exe
  C:\Windows\System\eyWTBuJ.exe
  2⤵
  PID:7164
- C:\Windows\System\HXFWdyR.exe
  C:\Windows\System\HXFWdyR.exe
  2⤵
  PID:6572
- C:\Windows\System\ririxfF.exe
  C:\Windows\System\ririxfF.exe
  2⤵
  PID:6716
- C:\Windows\System\vUUfqyQ.exe
  C:\Windows\System\vUUfqyQ.exe
  2⤵
  PID:6748
- C:\Windows\System\mGBzbYt.exe
  C:\Windows\System\mGBzbYt.exe
  2⤵
  PID:6552
- C:\Windows\System\kdEDKWC.exe
  C:\Windows\System\kdEDKWC.exe
  2⤵
  PID:6912
- C:\Windows\System\TpNFPYu.exe
  C:\Windows\System\TpNFPYu.exe
  2⤵
  PID:6632
- C:\Windows\System\SQQInIB.exe
  C:\Windows\System\SQQInIB.exe
  2⤵
  PID:5396
- C:\Windows\System\FOsIbqb.exe
  C:\Windows\System\FOsIbqb.exe
  2⤵
  PID:6444
- C:\Windows\System\FZZXxZN.exe
  C:\Windows\System\FZZXxZN.exe
  2⤵
  PID:7084
- C:\Windows\System\qimyHrZ.exe
  C:\Windows\System\qimyHrZ.exe
  2⤵
  PID:6568
- C:\Windows\System\mNRusYO.exe
  C:\Windows\System\mNRusYO.exe
  2⤵
  PID:6940
- C:\Windows\System\fZnlFdp.exe
  C:\Windows\System\fZnlFdp.exe
  2⤵
  PID:6148
- C:\Windows\System\EQASbJv.exe
  C:\Windows\System\EQASbJv.exe
  2⤵
  PID:7172
- C:\Windows\System\mRMHjdG.exe
  C:\Windows\System\mRMHjdG.exe
  2⤵
  PID:7188
- C:\Windows\System\XCNUsSG.exe
  C:\Windows\System\XCNUsSG.exe
  2⤵
  PID:7204
- C:\Windows\System\WUMuWLp.exe
  C:\Windows\System\WUMuWLp.exe
  2⤵
  PID:7220
- C:\Windows\System\mKGihqN.exe
  C:\Windows\System\mKGihqN.exe
  2⤵
  PID:7236
- C:\Windows\System\TBpqZjy.exe
  C:\Windows\System\TBpqZjy.exe
  2⤵
  PID:7252
- C:\Windows\System\IVceDtP.exe
  C:\Windows\System\IVceDtP.exe
  2⤵
  PID:7268
- C:\Windows\System\msjvECF.exe
  C:\Windows\System\msjvECF.exe
  2⤵
  PID:7284
- C:\Windows\System\wlXvdgj.exe
  C:\Windows\System\wlXvdgj.exe
  2⤵
  PID:7300
- C:\Windows\System\lWaKKVs.exe
  C:\Windows\System\lWaKKVs.exe
  2⤵
  PID:7316
- C:\Windows\System\mJXjePF.exe
  C:\Windows\System\mJXjePF.exe
  2⤵
  PID:7332
- C:\Windows\System\OfbOVdb.exe
  C:\Windows\System\OfbOVdb.exe
  2⤵
  PID:7348
- C:\Windows\System\PYFapnO.exe
  C:\Windows\System\PYFapnO.exe
  2⤵
  PID:7364
- C:\Windows\System\tyosgGT.exe
  C:\Windows\System\tyosgGT.exe
  2⤵
  PID:7380
- C:\Windows\System\kPhAoNu.exe
  C:\Windows\System\kPhAoNu.exe
  2⤵
  PID:7396
- C:\Windows\System\CbuOyyN.exe
  C:\Windows\System\CbuOyyN.exe
  2⤵
  PID:7412
- C:\Windows\System\pwAtAvs.exe
  C:\Windows\System\pwAtAvs.exe
  2⤵
  PID:7428
- C:\Windows\System\HSLfvmE.exe
  C:\Windows\System\HSLfvmE.exe
  2⤵
  PID:7444
- C:\Windows\System\FYZADtc.exe
  C:\Windows\System\FYZADtc.exe
  2⤵
  PID:7460
- C:\Windows\System\ScOYxlB.exe
  C:\Windows\System\ScOYxlB.exe
  2⤵
  PID:7476
- C:\Windows\System\GUusHVo.exe
  C:\Windows\System\GUusHVo.exe
  2⤵
  PID:7492
- C:\Windows\System\qDrsrER.exe
  C:\Windows\System\qDrsrER.exe
  2⤵
  PID:7508
- C:\Windows\System\ShJPTUf.exe
  C:\Windows\System\ShJPTUf.exe
  2⤵
  PID:7524
- C:\Windows\System\iwCyrww.exe
  C:\Windows\System\iwCyrww.exe
  2⤵
  PID:7540
- C:\Windows\System\dNrpDta.exe
  C:\Windows\System\dNrpDta.exe
  2⤵
  PID:7556
- C:\Windows\System\pMQDirj.exe
  C:\Windows\System\pMQDirj.exe
  2⤵
  PID:7572
- C:\Windows\System\ChxTKqO.exe
  C:\Windows\System\ChxTKqO.exe
  2⤵
  PID:7588
- C:\Windows\System\AqyNgue.exe
  C:\Windows\System\AqyNgue.exe
  2⤵
  PID:7604
- C:\Windows\System\MUQoEcX.exe
  C:\Windows\System\MUQoEcX.exe
  2⤵
  PID:7620
- C:\Windows\System\ctyfies.exe
  C:\Windows\System\ctyfies.exe
  2⤵
  PID:7636
- C:\Windows\System\bYsLkCw.exe
  C:\Windows\System\bYsLkCw.exe
  2⤵
  PID:7652
- C:\Windows\System\COEZLJD.exe
  C:\Windows\System\COEZLJD.exe
  2⤵
  PID:7668
- C:\Windows\System\cYZiFEk.exe
  C:\Windows\System\cYZiFEk.exe
  2⤵
  PID:7684
- C:\Windows\System\udkVWMB.exe
  C:\Windows\System\udkVWMB.exe
  2⤵
  PID:7700
- C:\Windows\System\oYqmGKH.exe
  C:\Windows\System\oYqmGKH.exe
  2⤵
  PID:7716
- C:\Windows\System\otAMyFc.exe
  C:\Windows\System\otAMyFc.exe
  2⤵
  PID:7732
- C:\Windows\System\kFrDnnX.exe
  C:\Windows\System\kFrDnnX.exe
  2⤵
  PID:7748
- C:\Windows\System\tlkQzHE.exe
  C:\Windows\System\tlkQzHE.exe
  2⤵
  PID:7764
- C:\Windows\System\Llkepvn.exe
  C:\Windows\System\Llkepvn.exe
  2⤵
  PID:7780
- C:\Windows\System\LJSZUpZ.exe
  C:\Windows\System\LJSZUpZ.exe
  2⤵
  PID:7796
- C:\Windows\System\foTxRHP.exe
  C:\Windows\System\foTxRHP.exe
  2⤵
  PID:7812
- C:\Windows\System\aYclnUT.exe
  C:\Windows\System\aYclnUT.exe
  2⤵
  PID:7828
- C:\Windows\System\FRksVYN.exe
  C:\Windows\System\FRksVYN.exe
  2⤵
  PID:7844
- C:\Windows\System\nchehux.exe
  C:\Windows\System\nchehux.exe
  2⤵
  PID:7860
- C:\Windows\System\wNwrSlI.exe
  C:\Windows\System\wNwrSlI.exe
  2⤵
  PID:7876
- C:\Windows\System\ddLhSuo.exe
  C:\Windows\System\ddLhSuo.exe
  2⤵
  PID:7892
- C:\Windows\System\EZKOIPt.exe
  C:\Windows\System\EZKOIPt.exe
  2⤵
  PID:7908
- C:\Windows\System\FhjVFeW.exe
  C:\Windows\System\FhjVFeW.exe
  2⤵
  PID:7924
- C:\Windows\System\YOTsXRr.exe
  C:\Windows\System\YOTsXRr.exe
  2⤵
  PID:7940
- C:\Windows\System\RdbxIgz.exe
  C:\Windows\System\RdbxIgz.exe
  2⤵
  PID:7956
- C:\Windows\System\yoWclrD.exe
  C:\Windows\System\yoWclrD.exe
  2⤵
  PID:7972
- C:\Windows\System\yscGBYk.exe
  C:\Windows\System\yscGBYk.exe
  2⤵
  PID:7988
- C:\Windows\System\tcbKgfV.exe
  C:\Windows\System\tcbKgfV.exe
  2⤵
  PID:8004
- C:\Windows\System\mlprhnp.exe
  C:\Windows\System\mlprhnp.exe
  2⤵
  PID:8020
- C:\Windows\System\LNRExZN.exe
  C:\Windows\System\LNRExZN.exe
  2⤵
  PID:8036
- C:\Windows\System\qdIrmMd.exe
  C:\Windows\System\qdIrmMd.exe
  2⤵
  PID:8052
- C:\Windows\System\gfzgFXW.exe
  C:\Windows\System\gfzgFXW.exe
  2⤵
  PID:8068
- C:\Windows\System\RcAaAAe.exe
  C:\Windows\System\RcAaAAe.exe
  2⤵
  PID:8084
- C:\Windows\System\GRiUJwM.exe
  C:\Windows\System\GRiUJwM.exe
  2⤵
  PID:8100
- C:\Windows\System\QyqFEBN.exe
  C:\Windows\System\QyqFEBN.exe
  2⤵
  PID:8116
- C:\Windows\System\pvuUIjH.exe
  C:\Windows\System\pvuUIjH.exe
  2⤵
  PID:8132
- C:\Windows\System\xXjMrRh.exe
  C:\Windows\System\xXjMrRh.exe
  2⤵
  PID:8148
- C:\Windows\System\zQGLcZk.exe
  C:\Windows\System\zQGLcZk.exe
  2⤵
  PID:8164
- C:\Windows\System\pZiocuW.exe
  C:\Windows\System\pZiocuW.exe
  2⤵
  PID:8180
- C:\Windows\System\dQavwYx.exe
  C:\Windows\System\dQavwYx.exe
  2⤵
  PID:7184
- C:\Windows\System\ENbZhjx.exe
  C:\Windows\System\ENbZhjx.exe
  2⤵
  PID:7100
- C:\Windows\System\VTYAKOO.exe
  C:\Windows\System\VTYAKOO.exe
  2⤵
  PID:7200
- C:\Windows\System\EirdCZI.exe
  C:\Windows\System\EirdCZI.exe
  2⤵
  PID:7040
- C:\Windows\System\bLmaNAm.exe
  C:\Windows\System\bLmaNAm.exe
  2⤵
  PID:7276
- C:\Windows\System\bbzPCLo.exe
  C:\Windows\System\bbzPCLo.exe
  2⤵
  PID:7340
- C:\Windows\System\yPEnKKK.exe
  C:\Windows\System\yPEnKKK.exe
  2⤵
  PID:7228
- C:\Windows\System\OAkYXvO.exe
  C:\Windows\System\OAkYXvO.exe
  2⤵
  PID:7260
- C:\Windows\System\JEvtEjG.exe
  C:\Windows\System\JEvtEjG.exe
  2⤵
  PID:7328
- C:\Windows\System\aCUKJrK.exe
  C:\Windows\System\aCUKJrK.exe
  2⤵
  PID:7408
- C:\Windows\System\OiWWPHE.exe
  C:\Windows\System\OiWWPHE.exe
  2⤵
  PID:7472
- C:\Windows\System\PbnXDFS.exe
  C:\Windows\System\PbnXDFS.exe
  2⤵
  PID:7536
- C:\Windows\System\lFLeLJB.exe
  C:\Windows\System\lFLeLJB.exe
  2⤵
  PID:7424
- C:\Windows\System\rCPPxoR.exe
  C:\Windows\System\rCPPxoR.exe
  2⤵
  PID:7516
- C:\Windows\System\YWvKaYK.exe
  C:\Windows\System\YWvKaYK.exe
  2⤵
  PID:7584
- C:\Windows\System\OJUSppe.exe
  C:\Windows\System\OJUSppe.exe
  2⤵
  PID:7612
- C:\Windows\System\CvWlvvd.exe
  C:\Windows\System\CvWlvvd.exe
  2⤵
  PID:7820
- C:\Windows\System\PKoExcc.exe
  C:\Windows\System\PKoExcc.exe
  2⤵
  PID:7596
- C:\Windows\System\sJahoHj.exe
  C:\Windows\System\sJahoHj.exe
  2⤵
  PID:7660
- C:\Windows\System\LbKzgRz.exe
  C:\Windows\System\LbKzgRz.exe
  2⤵
  PID:7724
- C:\Windows\System\vgYaXHo.exe
  C:\Windows\System\vgYaXHo.exe
  2⤵
  PID:7788
- C:\Windows\System\sohOhbY.exe
  C:\Windows\System\sohOhbY.exe
  2⤵
  PID:7916
- C:\Windows\System\YBCRmrU.exe
  C:\Windows\System\YBCRmrU.exe
  2⤵
  PID:7952
- C:\Windows\System\KXmsboy.exe
  C:\Windows\System\KXmsboy.exe
  2⤵
  PID:7740
- C:\Windows\System\FDGRnUT.exe
  C:\Windows\System\FDGRnUT.exe
  2⤵
  PID:7836
- C:\Windows\System\OeLlYgE.exe
  C:\Windows\System\OeLlYgE.exe
  2⤵
  PID:8044
- C:\Windows\System\ggSPLGd.exe
  C:\Windows\System\ggSPLGd.exe
  2⤵
  PID:7616
- C:\Windows\System\mYzrlxV.exe
  C:\Windows\System\mYzrlxV.exe
  2⤵
  PID:7936
- C:\Windows\System\ViKQVIg.exe
  C:\Windows\System\ViKQVIg.exe
  2⤵
  PID:8000
- C:\Windows\System\DmLbTFS.exe
  C:\Windows\System\DmLbTFS.exe
  2⤵
  PID:8032
- C:\Windows\System\YTzIehd.exe
  C:\Windows\System\YTzIehd.exe
  2⤵
  PID:8112
- C:\Windows\System\lYKcphv.exe
  C:\Windows\System\lYKcphv.exe
  2⤵
  PID:8060
- C:\Windows\System\QBNcNum.exe
  C:\Windows\System\QBNcNum.exe
  2⤵
  PID:8124
- C:\Windows\System\pOAuOwX.exe
  C:\Windows\System\pOAuOwX.exe
  2⤵
  PID:8176
- C:\Windows\System\GFaWNfA.exe
  C:\Windows\System\GFaWNfA.exe
  2⤵
  PID:6292
- C:\Windows\System\unNxEtK.exe
  C:\Windows\System\unNxEtK.exe
  2⤵
  PID:7376
- C:\Windows\System\XNsMvdh.exe
  C:\Windows\System\XNsMvdh.exe
  2⤵
  PID:6368
- C:\Windows\System\LhaQbOq.exe
  C:\Windows\System\LhaQbOq.exe
  2⤵
  PID:7372
- C:\Windows\System\MmzwlPu.exe
  C:\Windows\System\MmzwlPu.exe
  2⤵
  PID:7324
- C:\Windows\System\IUDAXHr.exe
  C:\Windows\System\IUDAXHr.exe
  2⤵
  PID:7488
- C:\Windows\System\wPLRNvs.exe
  C:\Windows\System\wPLRNvs.exe
  2⤵
  PID:7884
- C:\Windows\System\OClmSJd.exe
  C:\Windows\System\OClmSJd.exe
  2⤵
  PID:7392
- C:\Windows\System\rIpnkAn.exe
  C:\Windows\System\rIpnkAn.exe
  2⤵
  PID:7420
- C:\Windows\System\kfFYjGx.exe
  C:\Windows\System\kfFYjGx.exe
  2⤵
  PID:7756
- C:\Windows\System\LTgWfxN.exe
  C:\Windows\System\LTgWfxN.exe
  2⤵
  PID:7888
- C:\Windows\System\PJTXVgM.exe
  C:\Windows\System\PJTXVgM.exe
  2⤵
  PID:8016
- C:\Windows\System\EKpzIgn.exe
  C:\Windows\System\EKpzIgn.exe
  2⤵
  PID:7904
- C:\Windows\System\zcYZfQr.exe
  C:\Windows\System\zcYZfQr.exe
  2⤵
  PID:8144
- C:\Windows\System\bnosNYA.exe
  C:\Windows\System\bnosNYA.exe
  2⤵
  PID:7760
- C:\Windows\System\RhBoRkF.exe
  C:\Windows\System\RhBoRkF.exe
  2⤵
  PID:7244
- C:\Windows\System\tBLTUqg.exe
  C:\Windows\System\tBLTUqg.exe
  2⤵
  PID:8096
- C:\Windows\System\YTFthtw.exe
  C:\Windows\System\YTFthtw.exe
  2⤵
  PID:8048
- C:\Windows\System\NCEhHYu.exe
  C:\Windows\System\NCEhHYu.exe
  2⤵
  PID:7456
- C:\Windows\System\eIRpico.exe
  C:\Windows\System\eIRpico.exe
  2⤵
  PID:7468
- C:\Windows\System\kwsAbNg.exe
  C:\Windows\System\kwsAbNg.exe
  2⤵
  PID:7628
- C:\Windows\System\FwwIfhh.exe
  C:\Windows\System\FwwIfhh.exe
  2⤵
  PID:7852
- C:\Windows\System\ENLDyWl.exe
  C:\Windows\System\ENLDyWl.exe
  2⤵
  PID:7484
- C:\Windows\System\SZShKxc.exe
  C:\Windows\System\SZShKxc.exe
  2⤵
  PID:8172
- C:\Windows\System\peecmiL.exe
  C:\Windows\System\peecmiL.exe
  2⤵
  PID:7708
- C:\Windows\System\GrvJBUg.exe
  C:\Windows\System\GrvJBUg.exe
  2⤵
  PID:6956
- C:\Windows\System\ACWrblu.exe
  C:\Windows\System\ACWrblu.exe
  2⤵
  PID:7996
- C:\Windows\System\UkwZZVZ.exe
  C:\Windows\System\UkwZZVZ.exe
  2⤵
  PID:7932
- C:\Windows\System\RMnzZaL.exe
  C:\Windows\System\RMnzZaL.exe
  2⤵
  PID:8092
- C:\Windows\System\HUbgJdN.exe
  C:\Windows\System\HUbgJdN.exe
  2⤵
  PID:7440
- C:\Windows\System\vzBljuS.exe
  C:\Windows\System\vzBljuS.exe
  2⤵
  PID:7404
- C:\Windows\System\UHZiIyy.exe
  C:\Windows\System\UHZiIyy.exe
  2⤵
  PID:8196
- C:\Windows\System\jnAabsR.exe
  C:\Windows\System\jnAabsR.exe
  2⤵
  PID:8212
- C:\Windows\System\HpKSuOt.exe
  C:\Windows\System\HpKSuOt.exe
  2⤵
  PID:8232
- C:\Windows\System\pCyFBOB.exe
  C:\Windows\System\pCyFBOB.exe
  2⤵
  PID:8248
- C:\Windows\System\WKogexm.exe
  C:\Windows\System\WKogexm.exe
  2⤵
  PID:8264
- C:\Windows\System\hOaqNCp.exe
  C:\Windows\System\hOaqNCp.exe
  2⤵
  PID:8280
- C:\Windows\System\LjtVMNp.exe
  C:\Windows\System\LjtVMNp.exe
  2⤵
  PID:8296
- C:\Windows\System\HuIYlkh.exe
  C:\Windows\System\HuIYlkh.exe
  2⤵
  PID:8312
- C:\Windows\System\sTQpnYJ.exe
  C:\Windows\System\sTQpnYJ.exe
  2⤵
  PID:8328
- C:\Windows\System\haKhZhd.exe
  C:\Windows\System\haKhZhd.exe
  2⤵
  PID:8344
- C:\Windows\System\LsrWVpS.exe
  C:\Windows\System\LsrWVpS.exe
  2⤵
  PID:8360
- C:\Windows\System\lztfWvs.exe
  C:\Windows\System\lztfWvs.exe
  2⤵
  PID:8376
- C:\Windows\System\AeozJLv.exe
  C:\Windows\System\AeozJLv.exe
  2⤵
  PID:8392
- C:\Windows\System\uMnKVek.exe
  C:\Windows\System\uMnKVek.exe
  2⤵
  PID:8408
- C:\Windows\System\yfzmnim.exe
  C:\Windows\System\yfzmnim.exe
  2⤵
  PID:8424
- C:\Windows\System\XOpSllI.exe
  C:\Windows\System\XOpSllI.exe
  2⤵
  PID:8440
- C:\Windows\System\wjvDbnV.exe
  C:\Windows\System\wjvDbnV.exe
  2⤵
  PID:8456
- C:\Windows\System\HOHGkmy.exe
  C:\Windows\System\HOHGkmy.exe
  2⤵
  PID:8472
- C:\Windows\System\SDAhmYF.exe
  C:\Windows\System\SDAhmYF.exe
  2⤵
  PID:8492
- C:\Windows\System\iRYOyYm.exe
  C:\Windows\System\iRYOyYm.exe
  2⤵
  PID:8508
- C:\Windows\System\porJKvD.exe
  C:\Windows\System\porJKvD.exe
  2⤵
  PID:8524
- C:\Windows\System\ZvtFoOz.exe
  C:\Windows\System\ZvtFoOz.exe
  2⤵
  PID:8540
- C:\Windows\System\VFXXOyo.exe
  C:\Windows\System\VFXXOyo.exe
  2⤵
  PID:8556
- C:\Windows\System\egDyhoo.exe
  C:\Windows\System\egDyhoo.exe
  2⤵
  PID:8572
- C:\Windows\System\FpdZeIH.exe
  C:\Windows\System\FpdZeIH.exe
  2⤵
  PID:8592
- C:\Windows\System\haQfuyr.exe
  C:\Windows\System\haQfuyr.exe
  2⤵
  PID:8608
- C:\Windows\System\voIwWco.exe
  C:\Windows\System\voIwWco.exe
  2⤵
  PID:8624
- C:\Windows\System\tGgOyzB.exe
  C:\Windows\System\tGgOyzB.exe
  2⤵
  PID:8640
- C:\Windows\System\SelLSur.exe
  C:\Windows\System\SelLSur.exe
  2⤵
  PID:8656
- C:\Windows\System\QoWLdvm.exe
  C:\Windows\System\QoWLdvm.exe
  2⤵
  PID:8672
- C:\Windows\System\NaBARKv.exe
  C:\Windows\System\NaBARKv.exe
  2⤵
  PID:8688
- C:\Windows\System\vCiGbmm.exe
  C:\Windows\System\vCiGbmm.exe
  2⤵
  PID:8704
- C:\Windows\System\lcMJTgG.exe
  C:\Windows\System\lcMJTgG.exe
  2⤵
  PID:8720
- C:\Windows\System\shzVOpt.exe
  C:\Windows\System\shzVOpt.exe
  2⤵
  PID:8736
- C:\Windows\System\LfmyeYZ.exe
  C:\Windows\System\LfmyeYZ.exe
  2⤵
  PID:8752
- C:\Windows\System\lXPYbnw.exe
  C:\Windows\System\lXPYbnw.exe
  2⤵
  PID:8768
- C:\Windows\System\BmFWKTI.exe
  C:\Windows\System\BmFWKTI.exe
  2⤵
  PID:8784
- C:\Windows\System\SUtAEbL.exe
  C:\Windows\System\SUtAEbL.exe
  2⤵
  PID:8800
- C:\Windows\System\RTeLFWg.exe
  C:\Windows\System\RTeLFWg.exe
  2⤵
  PID:8816
- C:\Windows\System\BdJanQY.exe
  C:\Windows\System\BdJanQY.exe
  2⤵
  PID:8832
- C:\Windows\System\YuyPlzl.exe
  C:\Windows\System\YuyPlzl.exe
  2⤵
  PID:8848
- C:\Windows\System\wiUjaFg.exe
  C:\Windows\System\wiUjaFg.exe
  2⤵
  PID:8864
- C:\Windows\System\DjoUZpF.exe
  C:\Windows\System\DjoUZpF.exe
  2⤵
  PID:8880
- C:\Windows\System\ISLLIYj.exe
  C:\Windows\System\ISLLIYj.exe
  2⤵
  PID:8896
- C:\Windows\System\plsphYW.exe
  C:\Windows\System\plsphYW.exe
  2⤵
  PID:8912
- C:\Windows\System\jQLHFoz.exe
  C:\Windows\System\jQLHFoz.exe
  2⤵
  PID:8928
- C:\Windows\System\JIlCIof.exe
  C:\Windows\System\JIlCIof.exe
  2⤵
  PID:8944
- C:\Windows\System\eURCWwr.exe
  C:\Windows\System\eURCWwr.exe
  2⤵
  PID:8960
- C:\Windows\System\UQebxsJ.exe
  C:\Windows\System\UQebxsJ.exe
  2⤵
  PID:8976
- C:\Windows\System\sOlXlGp.exe
  C:\Windows\System\sOlXlGp.exe
  2⤵
  PID:8992
- C:\Windows\System\UBRKpCx.exe
  C:\Windows\System\UBRKpCx.exe
  2⤵
  PID:9008
- C:\Windows\System\zGcDOdd.exe
  C:\Windows\System\zGcDOdd.exe
  2⤵
  PID:9024
- C:\Windows\System\SOaIRAW.exe
  C:\Windows\System\SOaIRAW.exe
  2⤵
  PID:9040
- C:\Windows\System\DJvWCUD.exe
  C:\Windows\System\DJvWCUD.exe
  2⤵
  PID:9056
- C:\Windows\System\pOilLkV.exe
  C:\Windows\System\pOilLkV.exe
  2⤵
  PID:9072
- C:\Windows\System\ZKoSxHP.exe
  C:\Windows\System\ZKoSxHP.exe
  2⤵
  PID:9088
- C:\Windows\System\UPvjgdH.exe
  C:\Windows\System\UPvjgdH.exe
  2⤵
  PID:9104
- C:\Windows\System\kaydoCt.exe
  C:\Windows\System\kaydoCt.exe
  2⤵
  PID:9120
- C:\Windows\System\KduXqrM.exe
  C:\Windows\System\KduXqrM.exe
  2⤵
  PID:9136
- C:\Windows\System\AaERiOK.exe
  C:\Windows\System\AaERiOK.exe
  2⤵
  PID:9152
- C:\Windows\System\bwKstPH.exe
  C:\Windows\System\bwKstPH.exe
  2⤵
  PID:9168
- C:\Windows\System\BhjGeSj.exe
  C:\Windows\System\BhjGeSj.exe
  2⤵
  PID:9184
- C:\Windows\System\VAJkodA.exe
  C:\Windows\System\VAJkodA.exe
  2⤵
  PID:9200
- C:\Windows\System\wyNLMsS.exe
  C:\Windows\System\wyNLMsS.exe
  2⤵
  PID:7312
- C:\Windows\System\KGhtqkM.exe
  C:\Windows\System\KGhtqkM.exe
  2⤵
  PID:7856
- C:\Windows\System\BiOQZbz.exe
  C:\Windows\System\BiOQZbz.exe
  2⤵
  PID:7644
- C:\Windows\System\xBoqnGW.exe
  C:\Windows\System\xBoqnGW.exe
  2⤵
  PID:8260
- C:\Windows\System\uLViNcg.exe
  C:\Windows\System\uLViNcg.exe
  2⤵
  PID:8240
- C:\Windows\System\eERysIv.exe
  C:\Windows\System\eERysIv.exe
  2⤵
  PID:8308
- C:\Windows\System\nLQUxmK.exe
  C:\Windows\System\nLQUxmK.exe
  2⤵
  PID:8352
- C:\Windows\System\cSkePeQ.exe
  C:\Windows\System\cSkePeQ.exe
  2⤵
  PID:8336
- C:\Windows\System\kUbXraX.exe
  C:\Windows\System\kUbXraX.exe
  2⤵
  PID:8416
- C:\Windows\System\hlAHyhF.exe
  C:\Windows\System\hlAHyhF.exe
  2⤵
  PID:8436
- C:\Windows\System\wiHZeRC.exe
  C:\Windows\System\wiHZeRC.exe
  2⤵
  PID:8516
- C:\Windows\System\SjRUbgL.exe
  C:\Windows\System\SjRUbgL.exe
  2⤵
  PID:8464
- C:\Windows\System\nzGMBwN.exe
  C:\Windows\System\nzGMBwN.exe
  2⤵
  PID:8504
- C:\Windows\System\nJScqIr.exe
  C:\Windows\System\nJScqIr.exe
  2⤵
  PID:8580
- C:\Windows\System\NuPSAIa.exe
  C:\Windows\System\NuPSAIa.exe
  2⤵
  PID:8620
- C:\Windows\System\OMHgahC.exe
  C:\Windows\System\OMHgahC.exe
  2⤵
  PID:8664
- C:\Windows\System\glpkZwz.exe
  C:\Windows\System\glpkZwz.exe
  2⤵
  PID:8668
- C:\Windows\System\wSSgiMX.exe
  C:\Windows\System\wSSgiMX.exe
  2⤵
  PID:8700
- C:\Windows\System\PTqlSDw.exe
  C:\Windows\System\PTqlSDw.exe
  2⤵
  PID:8748
- C:\Windows\System\Plexsmh.exe
  C:\Windows\System\Plexsmh.exe
  2⤵
  PID:8812
- C:\Windows\System\LMANVsZ.exe
  C:\Windows\System\LMANVsZ.exe
  2⤵
  PID:8872
- C:\Windows\System\bsCIshZ.exe
  C:\Windows\System\bsCIshZ.exe
  2⤵
  PID:8904
- C:\Windows\System\bqfJrFk.exe
  C:\Windows\System\bqfJrFk.exe
  2⤵
  PID:8940
- C:\Windows\System\xblffGk.exe
  C:\Windows\System\xblffGk.exe
  2⤵
  PID:9000
- C:\Windows\System\qBoPNNj.exe
  C:\Windows\System\qBoPNNj.exe
  2⤵
  PID:9068
- C:\Windows\System\nSpJIIO.exe
  C:\Windows\System\nSpJIIO.exe
  2⤵
  PID:9132
- C:\Windows\System\noPEbRR.exe
  C:\Windows\System\noPEbRR.exe
  2⤵
  PID:9020
- C:\Windows\System\SOLsnad.exe
  C:\Windows\System\SOLsnad.exe
  2⤵
  PID:8796
- C:\Windows\System\mXgPXWU.exe
  C:\Windows\System\mXgPXWU.exe
  2⤵
  PID:8224
- C:\Windows\System\BCIcjIr.exe
  C:\Windows\System\BCIcjIr.exe
  2⤵
  PID:8860
- C:\Windows\System\hObVsBB.exe
  C:\Windows\System\hObVsBB.exe
  2⤵
  PID:8320
- C:\Windows\System\KPJgnOd.exe
  C:\Windows\System\KPJgnOd.exe
  2⤵
  PID:9052
- C:\Windows\System\OfJJUYS.exe
  C:\Windows\System\OfJJUYS.exe
  2⤵
  PID:8956
- C:\Windows\System\QFiYncH.exe
  C:\Windows\System\QFiYncH.exe
  2⤵
  PID:9148
- C:\Windows\System\SEdOCGF.exe
  C:\Windows\System\SEdOCGF.exe
  2⤵
  PID:9208
- C:\Windows\System\eMhVAGF.exe
  C:\Windows\System\eMhVAGF.exe
  2⤵
  PID:8108
- C:\Windows\System\NuaLfBd.exe
  C:\Windows\System\NuaLfBd.exe
  2⤵
  PID:8340
- C:\Windows\System\etUATFI.exe
  C:\Windows\System\etUATFI.exe
  2⤵
  PID:8448
- C:\Windows\System\PYyXAfw.exe
  C:\Windows\System\PYyXAfw.exe
  2⤵
  PID:8568
- C:\Windows\System\BGZuOvx.exe
  C:\Windows\System\BGZuOvx.exe
  2⤵
  PID:8552
- C:\Windows\System\jDMQPrs.exe
  C:\Windows\System\jDMQPrs.exe
  2⤵
  PID:8480
- C:\Windows\System\ULxiMwC.exe
  C:\Windows\System\ULxiMwC.exe
  2⤵
  PID:8632
- C:\Windows\System\avLXyrQ.exe
  C:\Windows\System\avLXyrQ.exe
  2⤵
  PID:8908
- C:\Windows\System\gtOMbBT.exe
  C:\Windows\System\gtOMbBT.exe
  2⤵
  PID:9196
- C:\Windows\System\jGtHdzC.exe
  C:\Windows\System\jGtHdzC.exe
  2⤵
  PID:9064
- C:\Windows\System\HAewQWF.exe
  C:\Windows\System\HAewQWF.exe
  2⤵
  PID:9164
- C:\Windows\System\UIwWqEk.exe
  C:\Windows\System\UIwWqEk.exe
  2⤵
  PID:8892
- C:\Windows\System\LjAwulu.exe
  C:\Windows\System\LjAwulu.exe
  2⤵
  PID:8384
- C:\Windows\System\xtEYZmR.exe
  C:\Windows\System\xtEYZmR.exe
  2⤵
  PID:8368
- C:\Windows\System\cfyQqEZ.exe
  C:\Windows\System\cfyQqEZ.exe
  2⤵
  PID:8520
- C:\Windows\System\zSxDofQ.exe
  C:\Windows\System\zSxDofQ.exe
  2⤵
  PID:8616
- C:\Windows\System\jDYGyuA.exe
  C:\Windows\System\jDYGyuA.exe
  2⤵
  PID:9100
- C:\Windows\System\bIALWVQ.exe
  C:\Windows\System\bIALWVQ.exe
  2⤵
  PID:8488
- C:\Windows\System\ekofzIn.exe
  C:\Windows\System\ekofzIn.exe
  2⤵
  PID:8856
- C:\Windows\System\wXVuIOQ.exe
  C:\Windows\System\wXVuIOQ.exe
  2⤵
  PID:8824
- C:\Windows\System\ZnsnRsr.exe
  C:\Windows\System\ZnsnRsr.exe
  2⤵
  PID:9116
- C:\Windows\System\KbCuGeE.exe
  C:\Windows\System\KbCuGeE.exe
  2⤵
  PID:8684
- C:\Windows\System\NTHbadX.exe
  C:\Windows\System\NTHbadX.exe
  2⤵
  PID:9112
- C:\Windows\System\QlkmsTW.exe
  C:\Windows\System\QlkmsTW.exe
  2⤵
  PID:8276
- C:\Windows\System\PtJLrlu.exe
  C:\Windows\System\PtJLrlu.exe
  2⤵
  PID:9220
- C:\Windows\System\rwihtfE.exe
  C:\Windows\System\rwihtfE.exe
  2⤵
  PID:9236
- C:\Windows\System\mAyfvit.exe
  C:\Windows\System\mAyfvit.exe
  2⤵
  PID:9252
- C:\Windows\System\EUmzbag.exe
  C:\Windows\System\EUmzbag.exe
  2⤵
  PID:9268
- C:\Windows\System\LirZFrC.exe
  C:\Windows\System\LirZFrC.exe
  2⤵
  PID:9284
- C:\Windows\System\ZoOeThx.exe
  C:\Windows\System\ZoOeThx.exe
  2⤵
  PID:9300
- C:\Windows\System\iYlaJdz.exe
  C:\Windows\System\iYlaJdz.exe
  2⤵
  PID:9316
- C:\Windows\System\YaIXFIh.exe
  C:\Windows\System\YaIXFIh.exe
  2⤵
  PID:9332
- C:\Windows\System\BXtkvPd.exe
  C:\Windows\System\BXtkvPd.exe
  2⤵
  PID:9348
- C:\Windows\System\RhUaqNl.exe
  C:\Windows\System\RhUaqNl.exe
  2⤵
  PID:9364
- C:\Windows\System\yOrMIib.exe
  C:\Windows\System\yOrMIib.exe
  2⤵
  PID:9380
- C:\Windows\System\fKoUtWc.exe
  C:\Windows\System\fKoUtWc.exe
  2⤵
  PID:9396
- C:\Windows\System\NMIQgTS.exe
  C:\Windows\System\NMIQgTS.exe
  2⤵
  PID:9412
- C:\Windows\System\OWqnQWI.exe
  C:\Windows\System\OWqnQWI.exe
  2⤵
  PID:9428
- C:\Windows\System\YdQbViq.exe
  C:\Windows\System\YdQbViq.exe
  2⤵
  PID:9444
- C:\Windows\System\MSFZprm.exe
  C:\Windows\System\MSFZprm.exe
  2⤵
  PID:9460
- C:\Windows\System\KMTAFfq.exe
  C:\Windows\System\KMTAFfq.exe
  2⤵
  PID:9476
- C:\Windows\System\PghbJxz.exe
  C:\Windows\System\PghbJxz.exe
  2⤵
  PID:9492
- C:\Windows\System\ZwUVGvL.exe
  C:\Windows\System\ZwUVGvL.exe
  2⤵
  PID:9508
- C:\Windows\System\rPmwvih.exe
  C:\Windows\System\rPmwvih.exe
  2⤵
  PID:9524
- C:\Windows\System\XRsiIBs.exe
  C:\Windows\System\XRsiIBs.exe
  2⤵
  PID:9540
- C:\Windows\System\xTKanNd.exe
  C:\Windows\System\xTKanNd.exe
  2⤵
  PID:9556
- C:\Windows\System\NHXhtiz.exe
  C:\Windows\System\NHXhtiz.exe
  2⤵
  PID:9572
- C:\Windows\System\eryXyGl.exe
  C:\Windows\System\eryXyGl.exe
  2⤵
  PID:9588
- C:\Windows\System\PUrEKNi.exe
  C:\Windows\System\PUrEKNi.exe
  2⤵
  PID:9604
- C:\Windows\System\HBHDlMR.exe
  C:\Windows\System\HBHDlMR.exe
  2⤵
  PID:9620
- C:\Windows\System\dgjPBdR.exe
  C:\Windows\System\dgjPBdR.exe
  2⤵
  PID:9636
- C:\Windows\System\sHJLqrx.exe
  C:\Windows\System\sHJLqrx.exe
  2⤵
  PID:9652
- C:\Windows\System\VMMfNHM.exe
  C:\Windows\System\VMMfNHM.exe
  2⤵
  PID:9668
- C:\Windows\System\bmvNwBS.exe
  C:\Windows\System\bmvNwBS.exe
  2⤵
  PID:9684
- C:\Windows\System\eNNqGsT.exe
  C:\Windows\System\eNNqGsT.exe
  2⤵
  PID:9700
- C:\Windows\System\MRkePUC.exe
  C:\Windows\System\MRkePUC.exe
  2⤵
  PID:9716
- C:\Windows\System\uRlOwIf.exe
  C:\Windows\System\uRlOwIf.exe
  2⤵
  PID:9732
- C:\Windows\System\eKEzodI.exe
  C:\Windows\System\eKEzodI.exe
  2⤵
  PID:9748
- C:\Windows\System\ECoVqoG.exe
  C:\Windows\System\ECoVqoG.exe
  2⤵
  PID:9764
- C:\Windows\System\lOEhvbM.exe
  C:\Windows\System\lOEhvbM.exe
  2⤵
  PID:9780
- C:\Windows\System\arTNPGq.exe
  C:\Windows\System\arTNPGq.exe
  2⤵
  PID:9796
- C:\Windows\System\xjpsCbd.exe
  C:\Windows\System\xjpsCbd.exe
  2⤵
  PID:9812
- C:\Windows\System\yPoYYzU.exe
  C:\Windows\System\yPoYYzU.exe
  2⤵
  PID:9828
- C:\Windows\System\BvQXTkH.exe
  C:\Windows\System\BvQXTkH.exe
  2⤵
  PID:9844
- C:\Windows\System\SzkTXMm.exe
  C:\Windows\System\SzkTXMm.exe
  2⤵
  PID:9860
- C:\Windows\System\arTQkmW.exe
  C:\Windows\System\arTQkmW.exe
  2⤵
  PID:9876
- C:\Windows\System\MppzfZA.exe
  C:\Windows\System\MppzfZA.exe
  2⤵
  PID:9892
- C:\Windows\System\qpOpfKv.exe
  C:\Windows\System\qpOpfKv.exe
  2⤵
  PID:9908
- C:\Windows\System\WVRHQOM.exe
  C:\Windows\System\WVRHQOM.exe
  2⤵
  PID:9924
- C:\Windows\System\dIoWwwS.exe
  C:\Windows\System\dIoWwwS.exe
  2⤵
  PID:9940
- C:\Windows\System\qyUXnsX.exe
  C:\Windows\System\qyUXnsX.exe
  2⤵
  PID:9956
- C:\Windows\System\QhAgcos.exe
  C:\Windows\System\QhAgcos.exe
  2⤵
  PID:9972
- C:\Windows\System\rErtJji.exe
  C:\Windows\System\rErtJji.exe
  2⤵
  PID:9988
- C:\Windows\System\QlTdfaG.exe
  C:\Windows\System\QlTdfaG.exe
  2⤵
  PID:10004
- C:\Windows\System\tCFDoqG.exe
  C:\Windows\System\tCFDoqG.exe
  2⤵
  PID:10020
- C:\Windows\System\HBpTTXm.exe
  C:\Windows\System\HBpTTXm.exe
  2⤵
  PID:10036
- C:\Windows\System\Vhwqnlg.exe
  C:\Windows\System\Vhwqnlg.exe
  2⤵
  PID:10052
- C:\Windows\System\xFAmqif.exe
  C:\Windows\System\xFAmqif.exe
  2⤵
  PID:10068
- C:\Windows\System\TBZLfXb.exe
  C:\Windows\System\TBZLfXb.exe
  2⤵
  PID:10088
- C:\Windows\System\juhpxfn.exe
  C:\Windows\System\juhpxfn.exe
  2⤵
  PID:10104
- C:\Windows\System\vUKcqaX.exe
  C:\Windows\System\vUKcqaX.exe
  2⤵
  PID:10120
- C:\Windows\System\SjyiRdV.exe
  C:\Windows\System\SjyiRdV.exe
  2⤵
  PID:10228
- C:\Windows\System\OZnbTrL.exe
  C:\Windows\System\OZnbTrL.exe
  2⤵
  PID:9248
- C:\Windows\System\cfyNDle.exe
  C:\Windows\System\cfyNDle.exe
  2⤵
  PID:8744
- C:\Windows\System\VZgKpyI.exe
  C:\Windows\System\VZgKpyI.exe
  2⤵
  PID:9312
- C:\Windows\System\iniiWKw.exe
  C:\Windows\System\iniiWKw.exe
  2⤵
  PID:9488
- C:\Windows\System\wILWIkc.exe
  C:\Windows\System\wILWIkc.exe
  2⤵
  PID:9568
- C:\Windows\System\EIbgnyb.exe
  C:\Windows\System\EIbgnyb.exe
  2⤵
  PID:9584
- C:\Windows\System\fzPPIrw.exe
  C:\Windows\System\fzPPIrw.exe
  2⤵
  PID:9632
- C:\Windows\System\kggAtgG.exe
  C:\Windows\System\kggAtgG.exe
  2⤵
  PID:9692
- C:\Windows\System\dEefDTy.exe
  C:\Windows\System\dEefDTy.exe
  2⤵
  PID:9680
- C:\Windows\System\MlVXwNm.exe
  C:\Windows\System\MlVXwNm.exe
  2⤵
  PID:9756
- C:\Windows\System\yJPytTz.exe
  C:\Windows\System\yJPytTz.exe
  2⤵
  PID:9820
- C:\Windows\System\TDAGhTs.exe
  C:\Windows\System\TDAGhTs.exe
  2⤵
  PID:9856
- C:\Windows\System\cSxmcar.exe
  C:\Windows\System\cSxmcar.exe
  2⤵
  PID:9840
- C:\Windows\System\GpEWMrx.exe
  C:\Windows\System\GpEWMrx.exe
  2⤵
  PID:9772
- C:\Windows\System\XPNVnzk.exe
  C:\Windows\System\XPNVnzk.exe
  2⤵
  PID:9952
- C:\Windows\System\KNFNmCf.exe
  C:\Windows\System\KNFNmCf.exe
  2⤵
  PID:9808
- C:\Windows\System\CfjMqga.exe
  C:\Windows\System\CfjMqga.exe
  2⤵
  PID:9872
- C:\Windows\System\xyMbstf.exe
  C:\Windows\System\xyMbstf.exe
  2⤵
  PID:9964
- C:\Windows\System\ObxHIrP.exe
  C:\Windows\System\ObxHIrP.exe
  2⤵
  PID:9968
- C:\Windows\System\LLHsPzY.exe
  C:\Windows\System\LLHsPzY.exe
  2⤵
  PID:10064
- C:\Windows\System\uHKmgeh.exe
  C:\Windows\System\uHKmgeh.exe
  2⤵
  PID:10096
- C:\Windows\System\AFQfKep.exe
  C:\Windows\System\AFQfKep.exe
  2⤵
  PID:9308
- C:\Windows\System\sGAPcul.exe
  C:\Windows\System\sGAPcul.exe
  2⤵
  PID:9280

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\BFuFOCc.exe

Filesize
1.9MB

MD5
28ce3507952d104b2b09577f12836b0d

SHA1
ec1e75a714b2f13a203ec4a889d0c8256609ff2c

SHA256
88a23c99523f8460d5dda6581470eeb7d6ec8d7d5e0b2a1096b9a88cf6f3215f

SHA512
fe80c21cfe7616485c04ea8ce38972d16212c12633bee5c844b3b51bd776c656ce46f9de10d48f501f31b2607f276bb56afc0d667ce9a344497f9a41a6967508

Download Submit
C:\Windows\system\FOQSrMa.exe

Filesize
1.9MB

MD5
91981e8d2ff868242a791f1c1ce94b06

SHA1
493b4f7fe76dcb2c98c8e35104bf34e4e4d613b6

SHA256
bdae7b3f9f25e7125aab367ccabf222d1d79970008cf4b9de22eaf462833b56a

SHA512
5f28c20956b339b60e798cebf1ae68961e04fcb9f1380e9a3b35747ec56e0d6094a20ebdacf613d1ef999a40c1499f18f68dce0750caa76405927d9e9518bd01

Download Submit
C:\Windows\system\HcFeuWU.exe

Filesize
1.9MB

MD5
8212c8ee0464d94d21fbb82aa4235975

SHA1
9cbdfd1b80c15120568d39cc8ac90ded1640461c

SHA256
5aee2f7ba9df41daa20cb65a0423bb819f97dba512c7f4fffe6c7626fa7720fc

SHA512
7230b19fa8a2226539c97311b71bd77dabb845b27e238eeee6f33252b98b813bd0c76fad977dda40ec2849f3c23acd9bc25f64abd4718fcf179c38f32f3dfc45

Download Submit
C:\Windows\system\JRblQCR.exe

Filesize
1.9MB

MD5
2de5268b425b5a8b646ae19815767e9d

SHA1
f014b7aff723717c53b41c1fd038acb847e09d8d

SHA256
6a8e3ff233fb98d2f4bf7cc66ed0d711079da70e73d124304749d9515e899ca5

SHA512
30585015e80896ac2ff707a76edfe0a7a76d5983f03f562a68e415ee1ea506cdee6af2f12d905be07eff021777995e8fc99ed338e5e3b161dda53c6906cf4729

Download Submit
C:\Windows\system\LcuwlSE.exe

Filesize
1.9MB

MD5
2f44b972d3fdd19efa6d5c0e9ee3d45e

SHA1
549aed2aaad8c1ba48ceaa04af72d0ad40bd14c5

SHA256
0628acdba316de1005ae9e01e27383a1df21e8066fb6a589aea7020c1eb06677

SHA512
80b891a8b5de8c09b463df83c89903851f46c7fbc92d41915be5753790a2d186df5552f10341a3b3ca50cf44be8ad5f9a92249d661c734c6b65e2699f0308df1

Download Submit
C:\Windows\system\ManuvAL.exe

Filesize
1.9MB

MD5
72be829441a80062b24cc3dd98bdaa43

SHA1
b4cc7754dbe66b3d1b70d1aa7a3fc387ab877c28

SHA256
20c9ad735633d38fd61e28bb89739abdb638d2a6b30ec8e8bb5d9958a3b27d46

SHA512
702c466002e44807a7ebbabc510ed2f1a37a99c68bc5248c6b2964f2279cb28d3250ab3d71cd91311eecbb6324c0472a6240937ee33fa980306327c41ac0370b

Download Submit
C:\Windows\system\NZMsLZp.exe

Filesize
1.9MB

MD5
ad5c9754e3e43e45fbca6eac16918777

SHA1
9614d491618ceea64168c55dc5253a3180c81e6a

SHA256
171c53bfe003f8502d189e999b50c9e76e60f6d783c407372a6054c037452616

SHA512
125a404980f309b6324ab9ff690a2cab8862eb33f9d1c7b1d8de9c6984b337e7ca189b94300e0f3771c8ab483cde06fb1074fbea2369e0728c247d7ff08b655f

Download Submit
C:\Windows\system\OXwVfDs.exe

Filesize
1.9MB

MD5
b6d9b750b284b1b32cb068c53e79c458

SHA1
12354d298a5b5f05be4f6225fa9322daf6455e48

SHA256
a3c5cf07d3495d57d46cd43a3ed60a8feecaf717cf998fe1aafeba08d9eafed4

SHA512
de03b042306e947fdc43deb54cc405ebfcf30323e9bf2b0397b1150e63a408f4ba6e249b59b9e52f172b14f47d6f6c8f7596a822fa731cd5a0c394ffa9578e60

Download Submit
C:\Windows\system\PBjSZiT.exe

Filesize
1.9MB

MD5
d5b0b37e530dd8ef19a67ebbd5ad633d

SHA1
be8af3232356fa1b40a61faa942aabf5436e0ca9

SHA256
a4e4c464d408bee14b01da03ebb9683a4e8409cfcfc35619ef20eb3f1c60e132

SHA512
6fc1a5d9d254b81e3f76a6f996124df5b746c589493415458faa04b0ef781ead04956c1716bcd3ad83c28cfde6e529ac5ce25da2c9eae44613ec98fc91e3af5c

Download Submit
C:\Windows\system\RXdfzQq.exe

Filesize
1.9MB

MD5
a4adf62b8421a5b0648df33331b6e91d

SHA1
65f4ab931fa582d309c1d0eadc53ec914adbd2aa

SHA256
73834e098a3d5195d1a7635ceae9b0d9c20ffcaaaaa6cb2ae8b3398d3170b87b

SHA512
08739cf349e2a15dc640f758f0ac51ae8cce239a3b043b17d719b2976ad186c308351617210118d588a90a7d1b3f0389b4a8219ea4533a3a45474d6ea68e6e0b

Download Submit
C:\Windows\system\RZFhbtD.exe

Filesize
1.9MB

MD5
9e04e4b8d77ef02c3efaf3c17a8660a2

SHA1
7095d61ef8d04498639bba59993f811ee50010cd

SHA256
705a4c4bc7af39d504d88ab0f112a9ef8e139228a635f84cc87108acdd79cf18

SHA512
f758cd51670f928b292b6f774acb9d18fde2daee48d94b3ce6e67a04e757d13b7cfb82f169ee2c2ea9ec772d8d9280d20de9c31bf8a04e2c2d9ed37179ccb3eb

Download Submit
C:\Windows\system\YtGHJwM.exe

Filesize
1.9MB

MD5
be04d6728eba85784bc7265b4aed75a8

SHA1
2bde1856d727c35e5ab2e6597862a626863debe4

SHA256
43f6d5cd0813ad621b93dd765ed6d214018496732eac701d25933c4d45b833b4

SHA512
1807670708390a70c68783c66de1cd3dfcfbc68090bb2d3f2eeb57af4659677226e523889333d0a8e72f642f4c0d181bd99f119d22df7281015f379461191e96

Download Submit
C:\Windows\system\dCTbcpg.exe

Filesize
1.9MB

MD5
8edaa15dd4947dfcd5e6174dbffae9db

SHA1
14714c6edec3c90e05d9fd6a72683d89cbbb16be

SHA256
ca3bf2f01406899156eb7e51c1d241011757a7b38ecdd193ced3b5389eb07831

SHA512
ce1a836fb96bf38fa7fd7229e148434b265cbd116b6acf89af0820ff5156294c909e63a0f5a1a7e4a32235ed33047146c24f5bd02f12fd74edcfdb9dbeaf0042

Download Submit
C:\Windows\system\eEacCbj.exe

Filesize
1.9MB

MD5
8c843294ea7104c7840ad6e39620bdb1

SHA1
4a7eb3868c1c0d2de450bf1e7418051a3841dd4d

SHA256
4cdfa563dd18634fddb537f52d888719506d36e8e600f6718c13f60ea84175db

SHA512
03fb7fb9caf710df425106140fc423cce0d429c4cfa535078f7ab83d9c58d2551da167b9643a122b3287b4d097b5076460f33ee4a8b818d653ec85724d614212

Download Submit
C:\Windows\system\eNiXnTc.exe

Filesize
8B

MD5
0a09bd2e5542320a20ec8eafd2246c28

SHA1
7106c9c7587e96586e92363c5ef70ad925a395b7

SHA256
a2d90ea83d8a1ec8d2d933492892f6a19aa1f0a0628b1cc62b162e5271ee863b

SHA512
994b306b70fd71b0a462a50b9fc03457eac19be8a156ca56f4b5a47c058947eb0f9ce4c706b5ff16df4ad9b5c6da35585e95b3f5ce9ff8ead75dc92e4757e9c1

Download Submit
C:\Windows\system\fuGxLnj.exe

Filesize
1.9MB

MD5
03cd441fce1d647c6dd9e82967025144

SHA1
2f2794aaea3ae1d7f867598a0d88a9fc6d30bc26

SHA256
d3d82db1e3a42833bb3aac139cd29346e38e9b77a2072ed6e04e60e2d8dda6c8

SHA512
4407502e31fa8f16e497a809d7240463094880e4fc1c53562cd58b6cbd8c7ef7a5f3a6142513a1496298fb0097a09f9008d76b3bcb7e8d47bae7b2879e25883b

Download Submit
C:\Windows\system\khunVTa.exe

Filesize
1.9MB

MD5
8e7ad0b3e2a98a68762b2b8de696b330

SHA1
0bfdaf9bf4f9d220ba4b44540f9ae768fd443363

SHA256
b03987acf797fdc76de113cf8cfbb4ba6115e5cbc16732b4ca3955680a2a628f

SHA512
b72575e7ff202372de98527476a82d52ecdbfa8ece6b01a03a207a5058754d66865af137c1bd66d7a209f832ec63be7de78adbc8e110d2ca62cd6f29de9c9964

Download Submit
C:\Windows\system\ksWWzXC.exe

Filesize
1.9MB

MD5
6525a1c6ab674b4301bb39a6d1fe5b1b

SHA1
591bab4765ffb1c3b8a22e7129c5ee7571027350

SHA256
548447a19d5722f442fa712c8cccd3c610833504f4dd8ed38aad4fc99757d24b

SHA512
751a6de354bba20b720e50053ce715aad10965c128305edff5777717d6ff2cf4bb2c8062f6f80b956157bb90d160569a0576895bf589a32f1d2c258de72d907a

Download Submit
C:\Windows\system\mWHYTiK.exe

Filesize
1.9MB

MD5
73a98efbdba02b3954aff241f8b7ac22

SHA1
bec1637e3a2cbab86bf071309dfba63bb1b99b64

SHA256
b713b8f8d23866c50516d76cb895916db824ac1c89766a7c0be152de67495156

SHA512
e641c3f57f2dd169afa8a074c611673c188ee31139af4f73ef779f038a8119132fff4fb09f3a671540f4da72dd631fdb31e4456d347b13c819ff96c709cdc041

Download Submit
C:\Windows\system\mxXedPj.exe

Filesize
1.9MB

MD5
4e26fabcb3d1fd537de6d23409ec7038

SHA1
7a88b5c412db8c2dc15f9ea8ad344de6f7eb2a5c

SHA256
898b9e9c9c81e90638a5b20e5b82fd49c534e078aec052bd7dda4d17049f8278

SHA512
bf327c0a0585dc13a6cef5bb15745d33739c14c59edd1abdb8c56801af5c48db219d0b1dc8c95f397772c392c69855ad19b238a34f5dd7db8270d42d2c4f0a75

Download Submit
C:\Windows\system\rutVwxw.exe

Filesize
1.9MB

MD5
ee9148e1ff9a1e8491b23a6eb628afcf

SHA1
b7590a0f6e3e0c11d84f67c3ccea5aa06707275f

SHA256
3d9fa61069f1d2ee3423cef4a96dc1dc27f42fa26132e2d44e8835e364ca648b

SHA512
e1383f3853f279c7402518a60a47b8e32cedbc65d8ea53c936db53d62d0e19b453869342d01c7ea6ff622d5eebef9b0dde35e1c284856d882786df967ca16f4a

Download Submit
C:\Windows\system\sGWWFxn.exe

Filesize
1.9MB

MD5
8e79b5b261da0b222098b7b0fa639082

SHA1
42548b2339736189abb1317ef9ef665b59f34963

SHA256
763ffe3f6ceb51ad1fcf3b6c58855f65e44afac43817bf1ff74c817e550ce512

SHA512
25ea78e308c5950e7fd381a1bb39c19c4e52fc47b347a29f4b8b2126513bfde4ad5bde3b12d8a4712f9e2ccc2a51d2ba43bcc11c3794e180751d96d493dba00c

Download Submit
C:\Windows\system\suyLldU.exe

Filesize
1.9MB

MD5
917c77d60a104e5dee41435fce474a88

SHA1
0817a209813d3ffda4d1c680e132692c86913d28

SHA256
1dc54056000a1affede3a43fe75a3efd2e44103b2acbcc1ce99e3f42d4d8abc5

SHA512
9bc23baddf614aa4075ac2bfb394a3d1b33a74809456ebc6d25f9bbbe3ff72be0f2e8567235f6e15da0947cce6eb73485fa4b30e15a85f80dd332e0af049ef29

Download Submit
C:\Windows\system\vGjTyOl.exe

Filesize
1.9MB

MD5
12c05a82e31d3f29116877d91c9d9efd

SHA1
16fc7462c4f8ef49c0954ba5f368266bb58794ed

SHA256
2fc3f4697116f405ea42ed42bf9782a2e139e55324bcd098769e5d4cfe6663fe

SHA512
095c06f0d70306d8976b4ebaebb02e42ee9999726b5ae865fedb9583c28a8b7bc0baf570fd54d955438d4b7ce7bbd44ad85930454c606ee2ad70542247e79c27

Download Submit
C:\Windows\system\vkTLJdT.exe

Filesize
1.9MB

MD5
50ea32820a696176aae2bfd46a0212dc

SHA1
a5f0995bde4f2cd6c93027f379aee65dc4edbb36

SHA256
cfe899531af93c5ef515b996a28b6235cb992a8e84309b4aec5bc6ded1449ff0

SHA512
e21719f1b4afa6e0789efc156debb5df60d3e1a82c65e50bfcec0422e1bcfc6b79f889748efc80937a39037ce212daeb7d038bacf691a45d8c23e33452289a32

Download Submit
C:\Windows\system\vvmlyMo.exe

Filesize
1.9MB

MD5
7cd8c78b001fdfcd451eea2a78b705ec

SHA1
bb47661774042cd109dc6de210b8afb9710c6a52

SHA256
031ae535c9b56e32c750236c4d834d2686e52689042c52e84a3f4ba49f38a1ae

SHA512
852715b5dcf8730f579219c45cbedbac47eb527e94eccfb3fc05c817b7ee79da661dc36c59cdae1273c593a4e6ecf71395c1a506f5477b5e79c7c70a21b9321f

Download Submit
C:\Windows\system\wXyBZxG.exe

Filesize
1.9MB

MD5
db768e82b85983ef1d4e9e1205ea43ad

SHA1
1eb57a7682418bea728d662b2baf917ec11032bd

SHA256
7b2a545e1a3e025e657d66a5cd5d656507ac3bd6524fa3d439985e8753b0434e

SHA512
fa31c6e9d6895dfd34c09f23a14e7bd6f3ad49b4409e5956e632f697f22585386411a726fda80eb61ec108f090f60cdd7e042d82a4d8ac85ef9ad3e124a41277

Download Submit
C:\Windows\system\wqAqhHl.exe

Filesize
1.9MB

MD5
cad9d46cab72b2b7be2a9afe6e035370

SHA1
fe04ae3fd5dd974a4808653d038bb44f21bb7886

SHA256
a3dc1c20227e2f22d558e9cf9d7738b873d9840f4bbc98305bbe8cd79db9b511

SHA512
8eee976ee505af44e88b8db23b8439742afffed87f61c09f2c281bada4ecdab5385d351b66a769b7625a1248e2eeed4da04394ca2bfdcdda4940a47db20459df

Download Submit
\Windows\system\AMFrBqT.exe

Filesize
1.9MB

MD5
10c0a9310b0a3d3c46f00b266f481aa4

SHA1
7c5a9e6f6df0c72dc373657f6477a9c2cfff144b

SHA256
93af398251193de7d0aef30eac8d01b601f9f14bf3f76b6334828cb596be2e06

SHA512
5301e9994d9319f08e578aa7fd111436d8667fa86e017a0fc0a3a18f9630146ab61361a67be8c940f9355fd5e4f01f218bfa0de8d73d4cccda5a3db2239eb145

Download Submit
\Windows\system\IBKTqYz.exe

Filesize
1.9MB

MD5
09620a74b2e5a8bd13c5ace83e6507c8

SHA1
9388a6c849a7d47b9ee1c1a4a0c30efba1eb70b5

SHA256
910cf980103d108dc63a2c6aaf0258feb85c58da2abd63da64d99a8ab4a7667b

SHA512
79fa18c0136c391c6b702e2eeedcb8f17f49b98796864cbdaf995822ac5936ca7ba025ed6ce49a72562f3cc28abcffcf8f8b1ca34d0eaae7bd7f27b3333ae43e

Download Submit
\Windows\system\UcDdGne.exe

Filesize
1.9MB

MD5
dd6d6e139305e1fa9c5d372c3368a724

SHA1
9f1ee9efbad96f4c1b67a2c9f82ef5d172fafaeb

SHA256
b3cb1f9ec99cd40cf35b65b020c4bfe8e5afa05bcdf7b6854b01d0ccb3b985dd

SHA512
522b06a70e6c44a89526363adf26eea4323d5f2937922b30e3504a43deea774bd3d20044a19713f3ae272fb54b9c9f4873bde353a81a25e211d974c97a31c198

Download Submit
\Windows\system\sdlgxRE.exe

Filesize
1.9MB

MD5
e318ec0612974ff30421d0e48cbd9f40

SHA1
f71e8c9c335f5ebf64732872b2ac58ca5ca3076c

SHA256
8311f4b3ce351867374e326447c5957f9230699674de2e802ffe81acdd7598ff

SHA512
9b124e34903b81cb8ff84db3093f79fef24ca24caff9371b39a75ccb70f4c91793b6c963abc669626ba299a6a06a76e4d3a1d6eb3a99e9dfb4c2cc6a97000d2a

Download Submit
\Windows\system\xOwaDWy.exe

Filesize
1.9MB

MD5
8539f98230bdece40f4f012c82bc7f04

SHA1
d6dabd964a64913a6f2b2846a1a092f532400336

SHA256
af881a946c79610b7bd1bc4518a6843a0bd44dc2952c6a0a7faa9c4d16f0c212

SHA512
1cde18e8be873350b36e8581ee6344abfc000adfc28fd7c2c0835b42d710f0d593d6ecc511f527a323ae1c84a890e796900c8b0af8543ecd7c151dbc129dabac

Download Submit
memory/1640-4216-0x000000013FA90000-0x000000013FE82000-memory.dmp

Filesize
3.9MB

Download
memory/1640-32-0x000000013FA90000-0x000000013FE82000-memory.dmp

Filesize
3.9MB

Download
memory/1808-85-0x000000013FF60000-0x0000000140352000-memory.dmp

Filesize
3.9MB

Download
memory/1808-4284-0x000000013FF60000-0x0000000140352000-memory.dmp

Filesize
3.9MB

Download
memory/2076-79-0x000000013FB70000-0x000000013FF62000-memory.dmp

Filesize
3.9MB

Download
memory/2076-4274-0x000000013FB70000-0x000000013FF62000-memory.dmp

Filesize
3.9MB

Download
memory/2420-59-0x000000013F0B0000-0x000000013F4A2000-memory.dmp

Filesize
3.9MB

Download
memory/2420-4264-0x000000013F0B0000-0x000000013F4A2000-memory.dmp

Filesize
3.9MB

Download
memory/2456-4228-0x000000013F620000-0x000000013FA12000-memory.dmp

Filesize
3.9MB

Download
memory/2456-61-0x000000013F620000-0x000000013FA12000-memory.dmp

Filesize
3.9MB

Download
memory/2632-39-0x000000013FAC0000-0x000000013FEB2000-memory.dmp

Filesize
3.9MB

Download
memory/2696-139-0x000000013F1C0000-0x000000013F5B2000-memory.dmp

Filesize
3.9MB

Download
memory/2744-63-0x000000001B5C0000-0x000000001B8A2000-memory.dmp

Filesize
2.9MB

Download
memory/2744-72-0x0000000001F70000-0x0000000001F78000-memory.dmp

Filesize
32KB

Download
memory/2748-56-0x000000013F0C0000-0x000000013F4B2000-memory.dmp

Filesize
3.9MB

Download
memory/2748-4260-0x000000013F0C0000-0x000000013F4B2000-memory.dmp

Filesize
3.9MB

Download
memory/2824-4277-0x000000013F030000-0x000000013F422000-memory.dmp

Filesize
3.9MB

Download
memory/2824-83-0x000000013F030000-0x000000013F422000-memory.dmp

Filesize
3.9MB

Download
memory/2872-54-0x000000013FE10000-0x0000000140202000-memory.dmp

Filesize
3.9MB

Download
memory/2872-4199-0x000000013FE10000-0x0000000140202000-memory.dmp

Filesize
3.9MB

Download
memory/2884-44-0x000000013F6D0000-0x000000013FAC2000-memory.dmp

Filesize
3.9MB

Download
memory/2920-55-0x000000013F0C0000-0x000000013F4B2000-memory.dmp

Filesize
3.9MB

Download
memory/2920-1-0x000000013FDD0000-0x00000001401C2000-memory.dmp

Filesize
3.9MB

Download
memory/2920-80-0x0000000003690000-0x0000000003A82000-memory.dmp

Filesize
3.9MB

Download
memory/2920-78-0x0000000003690000-0x0000000003A82000-memory.dmp

Filesize
3.9MB

Download
memory/2920-43-0x000000013F6D0000-0x000000013FAC2000-memory.dmp

Filesize
3.9MB

Download
memory/2920-3666-0x000000013FDD0000-0x00000001401C2000-memory.dmp

Filesize
3.9MB

Download
memory/2920-8-0x0000000003120000-0x0000000003512000-memory.dmp

Filesize
3.9MB

Download
memory/2920-82-0x000000013F030000-0x000000013F422000-memory.dmp

Filesize
3.9MB

Download
memory/2920-31-0x0000000003120000-0x0000000003512000-memory.dmp

Filesize
3.9MB

Download
memory/2920-8753-0x0000000003690000-0x0000000003A82000-memory.dmp

Filesize
3.9MB

Download
memory/2920-51-0x0000000003120000-0x0000000003512000-memory.dmp

Filesize
3.9MB

Download
memory/2920-62-0x000000013F0B0000-0x000000013F4A2000-memory.dmp

Filesize
3.9MB

Download
memory/2920-60-0x0000000003120000-0x0000000003512000-memory.dmp

Filesize
3.9MB

Download
memory/2920-0-0x00000000001F0000-0x0000000000200000-memory.dmp

Filesize
64KB

Download
memory/2920-58-0x000000013F620000-0x000000013FA12000-memory.dmp

Filesize
3.9MB

Download
memory/2920-4825-0x000000013F0C0000-0x000000013F4B2000-memory.dmp

Filesize
3.9MB

Download
memory/2920-8573-0x0000000003690000-0x0000000003A82000-memory.dmp

Filesize
3.9MB

Download
memory/2984-9-0x000000013FDA0000-0x0000000140192000-memory.dmp

Filesize
3.9MB

Download