xmrig | 02061b2acfec187a3c0eef23f8675c7d8800280849c83bcf1719eb576752ce00

Analysis

max time kernel
152s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
08/05/2024, 09:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

41d18a1be43460e187d7d0112cfc3070_NEIKI.exe
Size

1.9MB
MD5

41d18a1be43460e187d7d0112cfc3070
SHA1

ad6c21e5337aa26989a4a1d2aa0d298e0e242530
SHA256

02061b2acfec187a3c0eef23f8675c7d8800280849c83bcf1719eb576752ce00
SHA512

c0963ee800d283f131d155466e0e09b7cc8954ded3b3b4ea8fe61e905532bab9bfaecd9391a1869e019f6f735d7cc1950c474415dd377330a6b8a4bdc85be258
SSDEEP

49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1V6Gmjxj:NAB5

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 44 IoCs

miner

resource	yara_rule
behavioral2/memory/3656-57-0x00007FF7432D0000-0x00007FF7436C2000-memory.dmp	xmrig
behavioral2/memory/4216-55-0x00007FF729B00000-0x00007FF729EF2000-memory.dmp	xmrig
behavioral2/memory/2684-58-0x00007FF700B10000-0x00007FF700F02000-memory.dmp	xmrig
behavioral2/memory/2460-59-0x00007FF72A4A0000-0x00007FF72A892000-memory.dmp	xmrig
behavioral2/memory/632-60-0x00007FF69DD70000-0x00007FF69E162000-memory.dmp	xmrig
behavioral2/memory/3176-61-0x00007FF729D60000-0x00007FF72A152000-memory.dmp	xmrig
behavioral2/memory/4992-139-0x00007FF721A00000-0x00007FF721DF2000-memory.dmp	xmrig
behavioral2/memory/564-140-0x00007FF7250F0000-0x00007FF7254E2000-memory.dmp	xmrig
behavioral2/memory/3524-146-0x00007FF69C160000-0x00007FF69C552000-memory.dmp	xmrig
behavioral2/memory/3608-178-0x00007FF639FA0000-0x00007FF63A392000-memory.dmp	xmrig
behavioral2/memory/4224-181-0x00007FF631330000-0x00007FF631722000-memory.dmp	xmrig
behavioral2/memory/2648-185-0x00007FF725660000-0x00007FF725A52000-memory.dmp	xmrig
behavioral2/memory/3924-187-0x00007FF65CDF0000-0x00007FF65D1E2000-memory.dmp	xmrig
behavioral2/memory/1576-183-0x00007FF67B7C0000-0x00007FF67BBB2000-memory.dmp	xmrig
behavioral2/memory/3208-182-0x00007FF6C0110000-0x00007FF6C0502000-memory.dmp	xmrig
behavioral2/memory/2312-180-0x00007FF662360000-0x00007FF662752000-memory.dmp	xmrig
behavioral2/memory/4176-179-0x00007FF69F640000-0x00007FF69FA32000-memory.dmp	xmrig
behavioral2/memory/3680-142-0x00007FF686DD0000-0x00007FF6871C2000-memory.dmp	xmrig
behavioral2/memory/1136-141-0x00007FF72ADB0000-0x00007FF72B1A2000-memory.dmp	xmrig
behavioral2/memory/2460-1981-0x00007FF72A4A0000-0x00007FF72A892000-memory.dmp	xmrig
behavioral2/memory/2684-1973-0x00007FF700B10000-0x00007FF700F02000-memory.dmp	xmrig
behavioral2/memory/4992-1985-0x00007FF721A00000-0x00007FF721DF2000-memory.dmp	xmrig
behavioral2/memory/564-1990-0x00007FF7250F0000-0x00007FF7254E2000-memory.dmp	xmrig
behavioral2/memory/3924-1991-0x00007FF65CDF0000-0x00007FF65D1E2000-memory.dmp	xmrig
behavioral2/memory/3176-1989-0x00007FF729D60000-0x00007FF72A152000-memory.dmp	xmrig
behavioral2/memory/4216-1988-0x00007FF729B00000-0x00007FF729EF2000-memory.dmp	xmrig
behavioral2/memory/632-1987-0x00007FF69DD70000-0x00007FF69E162000-memory.dmp	xmrig
behavioral2/memory/3656-1986-0x00007FF7432D0000-0x00007FF7436C2000-memory.dmp	xmrig
behavioral2/memory/3680-2129-0x00007FF686DD0000-0x00007FF6871C2000-memory.dmp	xmrig
behavioral2/memory/3524-2133-0x00007FF69C160000-0x00007FF69C552000-memory.dmp	xmrig
behavioral2/memory/2312-2135-0x00007FF662360000-0x00007FF662752000-memory.dmp	xmrig
behavioral2/memory/3208-2143-0x00007FF6C0110000-0x00007FF6C0502000-memory.dmp	xmrig
behavioral2/memory/2648-2141-0x00007FF725660000-0x00007FF725A52000-memory.dmp	xmrig
behavioral2/memory/3608-2146-0x00007FF639FA0000-0x00007FF63A392000-memory.dmp	xmrig
behavioral2/memory/1136-2060-0x00007FF72ADB0000-0x00007FF72B1A2000-memory.dmp	xmrig
behavioral2/memory/944-2213-0x00007FF624CF0000-0x00007FF6250E2000-memory.dmp	xmrig
behavioral2/memory/1576-2181-0x00007FF67B7C0000-0x00007FF67BBB2000-memory.dmp	xmrig
behavioral2/memory/3952-2168-0x00007FF74C260000-0x00007FF74C652000-memory.dmp	xmrig
behavioral2/memory/4176-2188-0x00007FF69F640000-0x00007FF69FA32000-memory.dmp	xmrig
behavioral2/memory/4224-2184-0x00007FF631330000-0x00007FF631722000-memory.dmp	xmrig
behavioral2/memory/5024-2178-0x00007FF7C3E70000-0x00007FF7C4262000-memory.dmp	xmrig
behavioral2/memory/4412-2647-0x00007FF74FE40000-0x00007FF750232000-memory.dmp	xmrig
behavioral2/memory/2664-2528-0x00007FF7C9720000-0x00007FF7C9B12000-memory.dmp	xmrig
behavioral2/memory/4500-2507-0x00007FF7362F0000-0x00007FF7366E2000-memory.dmp	xmrig

Blocklisted process makes network request 7 IoCs

flow	pid	Process
3	3768	powershell.exe
5	3768	powershell.exe
8	3768	powershell.exe
7	3768	powershell.exe
12	3768	powershell.exe
13	3768	powershell.exe
20	3768	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
3768	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
4992	pQvwKrr.exe
4216	XmNULem.exe
3656	BEpQIXm.exe
2684	HqNOeXe.exe
2460	nXqreaL.exe
632	QSLKllC.exe
564	wDfWxgF.exe
3176	pToIrwt.exe
3924	OduZLIa.exe
1136	dHBwZgb.exe
3680	IxIYKZv.exe
5024	QRMkjjH.exe
3524	cHgxXQu.exe
944	OEngzms.exe
3952	KBthqbn.exe
3608	MCRQYHc.exe
4176	pvJSQQr.exe
2312	EbfyCWs.exe
4224	pRYarxO.exe
3208	BiXreLC.exe
1576	iiEGbwU.exe
2664	rjEWRJS.exe
2648	xsswRnL.exe
4500	AzJGxrb.exe
404	klSptYf.exe
664	hszwQHT.exe
1888	RSODZYb.exe
2924	iOLtrCp.exe
2104	aCPdsJi.exe
4644	FZnZCiu.exe
4556	jbFVJrw.exe
4640	ZBpMeWS.exe
764	lONWItR.exe
3812	MDnsSqC.exe
2572	fULcoCF.exe
2172	FFClsxv.exe
4580	CgJDRMZ.exe
1168	trzzHfM.exe
4368	aRgdgAV.exe
2304	EYZEVFo.exe
2632	xLTEXbq.exe
3016	uXnsCfJ.exe
752	DpSZVIF.exe
4372	SXmCVwP.exe
4572	Exqkyrz.exe
3580	HDBXNMD.exe
3272	iBoqIpk.exe
2568	NHebQPX.exe
4840	LnVcBuV.exe
4052	xzgRras.exe
932	EsKaHFm.exe
1948	escUxxq.exe
2452	DmrQKSb.exe
3612	DJbkHyA.exe
3720	SdFGWyR.exe
2880	FkOiANV.exe
1932	gUMwCsg.exe
2740	ZnvZnQr.exe
4928	wCCthAd.exe
2712	OksWCdI.exe
2280	qbArpAa.exe
1556	SmSdakP.exe
2960	FtvujoY.exe
4944	cZjWSRW.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4412-0-0x00007FF74FE40000-0x00007FF750232000-memory.dmp	upx
behavioral2/files/0x0010000000023259-7.dat	upx
behavioral2/files/0x0008000000023266-21.dat	upx
behavioral2/files/0x0008000000023267-20.dat	upx
behavioral2/files/0x0007000000023269-34.dat	upx
behavioral2/files/0x0008000000023268-32.dat	upx
behavioral2/files/0x0008000000023264-42.dat	upx
behavioral2/files/0x000700000002326c-52.dat	upx
behavioral2/files/0x000700000002326a-51.dat	upx
behavioral2/memory/3656-57-0x00007FF7432D0000-0x00007FF7436C2000-memory.dmp	upx
behavioral2/memory/4216-55-0x00007FF729B00000-0x00007FF729EF2000-memory.dmp	upx
behavioral2/memory/2684-58-0x00007FF700B10000-0x00007FF700F02000-memory.dmp	upx
behavioral2/memory/2460-59-0x00007FF72A4A0000-0x00007FF72A892000-memory.dmp	upx
behavioral2/memory/632-60-0x00007FF69DD70000-0x00007FF69E162000-memory.dmp	upx
behavioral2/memory/3176-61-0x00007FF729D60000-0x00007FF72A152000-memory.dmp	upx
behavioral2/files/0x000700000002326e-67.dat	upx
behavioral2/files/0x000700000002326d-73.dat	upx
behavioral2/files/0x0007000000023270-76.dat	upx
behavioral2/files/0x0007000000023271-79.dat	upx
behavioral2/files/0x0007000000023276-94.dat	upx
behavioral2/files/0x0007000000023277-97.dat	upx
behavioral2/files/0x0007000000023275-91.dat	upx
behavioral2/files/0x0007000000023278-100.dat	upx
behavioral2/files/0x0007000000023279-103.dat	upx
behavioral2/files/0x000700000002327b-109.dat	upx
behavioral2/files/0x000700000002327c-112.dat	upx
behavioral2/files/0x000700000002327f-121.dat	upx
behavioral2/memory/4992-139-0x00007FF721A00000-0x00007FF721DF2000-memory.dmp	upx
behavioral2/memory/564-140-0x00007FF7250F0000-0x00007FF7254E2000-memory.dmp	upx
behavioral2/memory/5024-143-0x00007FF7C3E70000-0x00007FF7C4262000-memory.dmp	upx
behavioral2/memory/3524-146-0x00007FF69C160000-0x00007FF69C552000-memory.dmp	upx
behavioral2/files/0x0007000000023281-166.dat	upx
behavioral2/memory/3608-178-0x00007FF639FA0000-0x00007FF63A392000-memory.dmp	upx
behavioral2/memory/4224-181-0x00007FF631330000-0x00007FF631722000-memory.dmp	upx
behavioral2/memory/2648-185-0x00007FF725660000-0x00007FF725A52000-memory.dmp	upx
behavioral2/memory/3924-187-0x00007FF65CDF0000-0x00007FF65D1E2000-memory.dmp	upx
behavioral2/memory/4500-186-0x00007FF7362F0000-0x00007FF7366E2000-memory.dmp	upx
behavioral2/memory/2664-184-0x00007FF7C9720000-0x00007FF7C9B12000-memory.dmp	upx
behavioral2/memory/1576-183-0x00007FF67B7C0000-0x00007FF67BBB2000-memory.dmp	upx
behavioral2/memory/3208-182-0x00007FF6C0110000-0x00007FF6C0502000-memory.dmp	upx
behavioral2/memory/2312-180-0x00007FF662360000-0x00007FF662752000-memory.dmp	upx
behavioral2/memory/4176-179-0x00007FF69F640000-0x00007FF69FA32000-memory.dmp	upx
behavioral2/files/0x000700000002327a-175.dat	upx
behavioral2/files/0x0007000000023282-174.dat	upx
behavioral2/memory/3952-171-0x00007FF74C260000-0x00007FF74C652000-memory.dmp	upx
behavioral2/files/0x0007000000023272-160.dat	upx
behavioral2/files/0x000700000002327e-157.dat	upx
behavioral2/files/0x000700000002327d-152.dat	upx
behavioral2/memory/944-148-0x00007FF624CF0000-0x00007FF6250E2000-memory.dmp	upx
behavioral2/memory/3680-142-0x00007FF686DD0000-0x00007FF6871C2000-memory.dmp	upx
behavioral2/memory/1136-141-0x00007FF72ADB0000-0x00007FF72B1A2000-memory.dmp	upx
behavioral2/files/0x0007000000023273-134.dat	upx
behavioral2/files/0x0007000000023280-126.dat	upx
behavioral2/files/0x0007000000023274-135.dat	upx
behavioral2/files/0x0007000000023283-194.dat	upx
behavioral2/files/0x0007000000023284-200.dat	upx
behavioral2/files/0x0007000000023285-203.dat	upx
behavioral2/files/0x000700000002326f-72.dat	upx
behavioral2/memory/2460-1981-0x00007FF72A4A0000-0x00007FF72A892000-memory.dmp	upx
behavioral2/memory/2684-1973-0x00007FF700B10000-0x00007FF700F02000-memory.dmp	upx
behavioral2/memory/4992-1985-0x00007FF721A00000-0x00007FF721DF2000-memory.dmp	upx
behavioral2/memory/564-1990-0x00007FF7250F0000-0x00007FF7254E2000-memory.dmp	upx
behavioral2/memory/3924-1991-0x00007FF65CDF0000-0x00007FF65D1E2000-memory.dmp	upx
behavioral2/memory/3176-1989-0x00007FF729D60000-0x00007FF72A152000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
2	raw.githubusercontent.com
3	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\PCfRRNa.exe	41d18a1be43460e187d7d0112cfc3070_NEIKI.exe
File created	C:\Windows\System\liwrQqc.exe	41d18a1be43460e187d7d0112cfc3070_NEIKI.exe
File created	C:\Windows\System\NYAOBHO.exe	41d18a1be43460e187d7d0112cfc3070_NEIKI.exe
File created	C:\Windows\System\teGQBwk.exe	41d18a1be43460e187d7d0112cfc3070_NEIKI.exe
File created	C:\Windows\System\HsACyXp.exe	41d18a1be43460e187d7d0112cfc3070_NEIKI.exe
File created	C:\Windows\System\FeftkhV.exe	41d18a1be43460e187d7d0112cfc3070_NEIKI.exe
File created	C:\Windows\System\DobcVzm.exe	41d18a1be43460e187d7d0112cfc3070_NEIKI.exe
File created	C:\Windows\System\XIzFhic.exe	41d18a1be43460e187d7d0112cfc3070_NEIKI.exe
File created	C:\Windows\System\pqmQifV.exe	41d18a1be43460e187d7d0112cfc3070_NEIKI.exe
File created	C:\Windows\System\uaNWHlc.exe	41d18a1be43460e187d7d0112cfc3070_NEIKI.exe
File created	C:\Windows\System\aXBcrOw.exe	41d18a1be43460e187d7d0112cfc3070_NEIKI.exe
File created	C:\Windows\System\gLdtpdN.exe	41d18a1be43460e187d7d0112cfc3070_NEIKI.exe
File created	C:\Windows\System\aKlaTbC.exe	41d18a1be43460e187d7d0112cfc3070_NEIKI.exe
File created	C:\Windows\System\KmrbzDa.exe	41d18a1be43460e187d7d0112cfc3070_NEIKI.exe
File created	C:\Windows\System\rluSlvH.exe	41d18a1be43460e187d7d0112cfc3070_NEIKI.exe
File created	C:\Windows\System\iZajBHn.exe	41d18a1be43460e187d7d0112cfc3070_NEIKI.exe
File created	C:\Windows\System\TEJnZLS.exe	41d18a1be43460e187d7d0112cfc3070_NEIKI.exe
File created	C:\Windows\System\KcGUiSU.exe	41d18a1be43460e187d7d0112cfc3070_NEIKI.exe
File created	C:\Windows\System\fzoDxJZ.exe	41d18a1be43460e187d7d0112cfc3070_NEIKI.exe
File created	C:\Windows\System\oDtJqEs.exe	41d18a1be43460e187d7d0112cfc3070_NEIKI.exe
File created	C:\Windows\System\kmhwNxW.exe	41d18a1be43460e187d7d0112cfc3070_NEIKI.exe
File created	C:\Windows\System\fvllKgm.exe	41d18a1be43460e187d7d0112cfc3070_NEIKI.exe
File created	C:\Windows\System\pIMONez.exe	41d18a1be43460e187d7d0112cfc3070_NEIKI.exe
File created	C:\Windows\System\lUlhooV.exe	41d18a1be43460e187d7d0112cfc3070_NEIKI.exe
File created	C:\Windows\System\cSLDECU.exe	41d18a1be43460e187d7d0112cfc3070_NEIKI.exe
File created	C:\Windows\System\sJcfxSz.exe	41d18a1be43460e187d7d0112cfc3070_NEIKI.exe
File created	C:\Windows\System\YQTOKuX.exe	41d18a1be43460e187d7d0112cfc3070_NEIKI.exe
File created	C:\Windows\System\zvEqvTB.exe	41d18a1be43460e187d7d0112cfc3070_NEIKI.exe
File created	C:\Windows\System\iHoRRGp.exe	41d18a1be43460e187d7d0112cfc3070_NEIKI.exe
File created	C:\Windows\System\ogUfoAt.exe	41d18a1be43460e187d7d0112cfc3070_NEIKI.exe
File created	C:\Windows\System\iweAAtC.exe	41d18a1be43460e187d7d0112cfc3070_NEIKI.exe
File created	C:\Windows\System\ZWevHRT.exe	41d18a1be43460e187d7d0112cfc3070_NEIKI.exe
File created	C:\Windows\System\qWyKXIP.exe	41d18a1be43460e187d7d0112cfc3070_NEIKI.exe
File created	C:\Windows\System\TApYlrG.exe	41d18a1be43460e187d7d0112cfc3070_NEIKI.exe
File created	C:\Windows\System\amSxmnu.exe	41d18a1be43460e187d7d0112cfc3070_NEIKI.exe
File created	C:\Windows\System\tsBQxqt.exe	41d18a1be43460e187d7d0112cfc3070_NEIKI.exe
File created	C:\Windows\System\RABYHgZ.exe	41d18a1be43460e187d7d0112cfc3070_NEIKI.exe
File created	C:\Windows\System\kzlZOZP.exe	41d18a1be43460e187d7d0112cfc3070_NEIKI.exe
File created	C:\Windows\System\EwhWhqT.exe	41d18a1be43460e187d7d0112cfc3070_NEIKI.exe
File created	C:\Windows\System\OkzYNwl.exe	41d18a1be43460e187d7d0112cfc3070_NEIKI.exe
File created	C:\Windows\System\oeQHfAp.exe	41d18a1be43460e187d7d0112cfc3070_NEIKI.exe
File created	C:\Windows\System\HeJCEmF.exe	41d18a1be43460e187d7d0112cfc3070_NEIKI.exe
File created	C:\Windows\System\VHwXZoL.exe	41d18a1be43460e187d7d0112cfc3070_NEIKI.exe
File created	C:\Windows\System\ZeQBuMv.exe	41d18a1be43460e187d7d0112cfc3070_NEIKI.exe
File created	C:\Windows\System\xPmyGbT.exe	41d18a1be43460e187d7d0112cfc3070_NEIKI.exe
File created	C:\Windows\System\ErqZrnm.exe	41d18a1be43460e187d7d0112cfc3070_NEIKI.exe
File created	C:\Windows\System\wbwROom.exe	41d18a1be43460e187d7d0112cfc3070_NEIKI.exe
File created	C:\Windows\System\fcMTrdL.exe	41d18a1be43460e187d7d0112cfc3070_NEIKI.exe
File created	C:\Windows\System\cHvZSgP.exe	41d18a1be43460e187d7d0112cfc3070_NEIKI.exe
File created	C:\Windows\System\SxEvfMx.exe	41d18a1be43460e187d7d0112cfc3070_NEIKI.exe
File created	C:\Windows\System\uWtLmIS.exe	41d18a1be43460e187d7d0112cfc3070_NEIKI.exe
File created	C:\Windows\System\WnTBfTw.exe	41d18a1be43460e187d7d0112cfc3070_NEIKI.exe
File created	C:\Windows\System\ArkMnTR.exe	41d18a1be43460e187d7d0112cfc3070_NEIKI.exe
File created	C:\Windows\System\YXmSOuD.exe	41d18a1be43460e187d7d0112cfc3070_NEIKI.exe
File created	C:\Windows\System\GnwKoZV.exe	41d18a1be43460e187d7d0112cfc3070_NEIKI.exe
File created	C:\Windows\System\QpdSayt.exe	41d18a1be43460e187d7d0112cfc3070_NEIKI.exe
File created	C:\Windows\System\JvvWXir.exe	41d18a1be43460e187d7d0112cfc3070_NEIKI.exe
File created	C:\Windows\System\ZbOIQLP.exe	41d18a1be43460e187d7d0112cfc3070_NEIKI.exe
File created	C:\Windows\System\bndSKGI.exe	41d18a1be43460e187d7d0112cfc3070_NEIKI.exe
File created	C:\Windows\System\RHpShkx.exe	41d18a1be43460e187d7d0112cfc3070_NEIKI.exe
File created	C:\Windows\System\pVKcJPU.exe	41d18a1be43460e187d7d0112cfc3070_NEIKI.exe
File created	C:\Windows\System\GSKXyOg.exe	41d18a1be43460e187d7d0112cfc3070_NEIKI.exe
File created	C:\Windows\System\vvQryyz.exe	41d18a1be43460e187d7d0112cfc3070_NEIKI.exe
File created	C:\Windows\System\tmezBAh.exe	41d18a1be43460e187d7d0112cfc3070_NEIKI.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3768	powershell.exe
3768	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	4412	41d18a1be43460e187d7d0112cfc3070_NEIKI.exe
Token: SeDebugPrivilege	3768	powershell.exe
Token: SeLockMemoryPrivilege	4412	41d18a1be43460e187d7d0112cfc3070_NEIKI.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4412 wrote to memory of 3768	4412	41d18a1be43460e187d7d0112cfc3070_NEIKI.exe	92
PID 4412 wrote to memory of 3768	4412	41d18a1be43460e187d7d0112cfc3070_NEIKI.exe	92
PID 4412 wrote to memory of 4992	4412	41d18a1be43460e187d7d0112cfc3070_NEIKI.exe	93
PID 4412 wrote to memory of 4992	4412	41d18a1be43460e187d7d0112cfc3070_NEIKI.exe	93
PID 4412 wrote to memory of 4216	4412	41d18a1be43460e187d7d0112cfc3070_NEIKI.exe	94
PID 4412 wrote to memory of 4216	4412	41d18a1be43460e187d7d0112cfc3070_NEIKI.exe	94
PID 4412 wrote to memory of 3656	4412	41d18a1be43460e187d7d0112cfc3070_NEIKI.exe	95
PID 4412 wrote to memory of 3656	4412	41d18a1be43460e187d7d0112cfc3070_NEIKI.exe	95
PID 4412 wrote to memory of 2684	4412	41d18a1be43460e187d7d0112cfc3070_NEIKI.exe	96
PID 4412 wrote to memory of 2684	4412	41d18a1be43460e187d7d0112cfc3070_NEIKI.exe	96
PID 4412 wrote to memory of 2460	4412	41d18a1be43460e187d7d0112cfc3070_NEIKI.exe	97
PID 4412 wrote to memory of 2460	4412	41d18a1be43460e187d7d0112cfc3070_NEIKI.exe	97
PID 4412 wrote to memory of 632	4412	41d18a1be43460e187d7d0112cfc3070_NEIKI.exe	98
PID 4412 wrote to memory of 632	4412	41d18a1be43460e187d7d0112cfc3070_NEIKI.exe	98
PID 4412 wrote to memory of 3176	4412	41d18a1be43460e187d7d0112cfc3070_NEIKI.exe	99
PID 4412 wrote to memory of 3176	4412	41d18a1be43460e187d7d0112cfc3070_NEIKI.exe	99
PID 4412 wrote to memory of 564	4412	41d18a1be43460e187d7d0112cfc3070_NEIKI.exe	100
PID 4412 wrote to memory of 564	4412	41d18a1be43460e187d7d0112cfc3070_NEIKI.exe	100
PID 4412 wrote to memory of 3680	4412	41d18a1be43460e187d7d0112cfc3070_NEIKI.exe	101
PID 4412 wrote to memory of 3680	4412	41d18a1be43460e187d7d0112cfc3070_NEIKI.exe	101
PID 4412 wrote to memory of 3924	4412	41d18a1be43460e187d7d0112cfc3070_NEIKI.exe	102
PID 4412 wrote to memory of 3924	4412	41d18a1be43460e187d7d0112cfc3070_NEIKI.exe	102
PID 4412 wrote to memory of 1136	4412	41d18a1be43460e187d7d0112cfc3070_NEIKI.exe	103
PID 4412 wrote to memory of 1136	4412	41d18a1be43460e187d7d0112cfc3070_NEIKI.exe	103
PID 4412 wrote to memory of 5024	4412	41d18a1be43460e187d7d0112cfc3070_NEIKI.exe	104
PID 4412 wrote to memory of 5024	4412	41d18a1be43460e187d7d0112cfc3070_NEIKI.exe	104
PID 4412 wrote to memory of 3524	4412	41d18a1be43460e187d7d0112cfc3070_NEIKI.exe	105
PID 4412 wrote to memory of 3524	4412	41d18a1be43460e187d7d0112cfc3070_NEIKI.exe	105
PID 4412 wrote to memory of 944	4412	41d18a1be43460e187d7d0112cfc3070_NEIKI.exe	106
PID 4412 wrote to memory of 944	4412	41d18a1be43460e187d7d0112cfc3070_NEIKI.exe	106
PID 4412 wrote to memory of 3952	4412	41d18a1be43460e187d7d0112cfc3070_NEIKI.exe	107
PID 4412 wrote to memory of 3952	4412	41d18a1be43460e187d7d0112cfc3070_NEIKI.exe	107
PID 4412 wrote to memory of 3608	4412	41d18a1be43460e187d7d0112cfc3070_NEIKI.exe	108
PID 4412 wrote to memory of 3608	4412	41d18a1be43460e187d7d0112cfc3070_NEIKI.exe	108
PID 4412 wrote to memory of 4176	4412	41d18a1be43460e187d7d0112cfc3070_NEIKI.exe	109
PID 4412 wrote to memory of 4176	4412	41d18a1be43460e187d7d0112cfc3070_NEIKI.exe	109
PID 4412 wrote to memory of 2312	4412	41d18a1be43460e187d7d0112cfc3070_NEIKI.exe	110
PID 4412 wrote to memory of 2312	4412	41d18a1be43460e187d7d0112cfc3070_NEIKI.exe	110
PID 4412 wrote to memory of 4224	4412	41d18a1be43460e187d7d0112cfc3070_NEIKI.exe	111
PID 4412 wrote to memory of 4224	4412	41d18a1be43460e187d7d0112cfc3070_NEIKI.exe	111
PID 4412 wrote to memory of 3208	4412	41d18a1be43460e187d7d0112cfc3070_NEIKI.exe	112
PID 4412 wrote to memory of 3208	4412	41d18a1be43460e187d7d0112cfc3070_NEIKI.exe	112
PID 4412 wrote to memory of 1576	4412	41d18a1be43460e187d7d0112cfc3070_NEIKI.exe	113
PID 4412 wrote to memory of 1576	4412	41d18a1be43460e187d7d0112cfc3070_NEIKI.exe	113
PID 4412 wrote to memory of 2664	4412	41d18a1be43460e187d7d0112cfc3070_NEIKI.exe	114
PID 4412 wrote to memory of 2664	4412	41d18a1be43460e187d7d0112cfc3070_NEIKI.exe	114
PID 4412 wrote to memory of 2648	4412	41d18a1be43460e187d7d0112cfc3070_NEIKI.exe	115
PID 4412 wrote to memory of 2648	4412	41d18a1be43460e187d7d0112cfc3070_NEIKI.exe	115
PID 4412 wrote to memory of 4500	4412	41d18a1be43460e187d7d0112cfc3070_NEIKI.exe	116
PID 4412 wrote to memory of 4500	4412	41d18a1be43460e187d7d0112cfc3070_NEIKI.exe	116
PID 4412 wrote to memory of 404	4412	41d18a1be43460e187d7d0112cfc3070_NEIKI.exe	117
PID 4412 wrote to memory of 404	4412	41d18a1be43460e187d7d0112cfc3070_NEIKI.exe	117
PID 4412 wrote to memory of 664	4412	41d18a1be43460e187d7d0112cfc3070_NEIKI.exe	118
PID 4412 wrote to memory of 664	4412	41d18a1be43460e187d7d0112cfc3070_NEIKI.exe	118
PID 4412 wrote to memory of 1888	4412	41d18a1be43460e187d7d0112cfc3070_NEIKI.exe	119
PID 4412 wrote to memory of 1888	4412	41d18a1be43460e187d7d0112cfc3070_NEIKI.exe	119
PID 4412 wrote to memory of 2924	4412	41d18a1be43460e187d7d0112cfc3070_NEIKI.exe	120
PID 4412 wrote to memory of 2924	4412	41d18a1be43460e187d7d0112cfc3070_NEIKI.exe	120
PID 4412 wrote to memory of 2104	4412	41d18a1be43460e187d7d0112cfc3070_NEIKI.exe	121
PID 4412 wrote to memory of 2104	4412	41d18a1be43460e187d7d0112cfc3070_NEIKI.exe	121
PID 4412 wrote to memory of 4644	4412	41d18a1be43460e187d7d0112cfc3070_NEIKI.exe	122
PID 4412 wrote to memory of 4644	4412	41d18a1be43460e187d7d0112cfc3070_NEIKI.exe	122
PID 4412 wrote to memory of 4556	4412	41d18a1be43460e187d7d0112cfc3070_NEIKI.exe	123
PID 4412 wrote to memory of 4556	4412	41d18a1be43460e187d7d0112cfc3070_NEIKI.exe	123

C:\Users\Admin\AppData\Local\Temp\41d18a1be43460e187d7d0112cfc3070_NEIKI.exe
"C:\Users\Admin\AppData\Local\Temp\41d18a1be43460e187d7d0112cfc3070_NEIKI.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4412
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3768
- C:\Windows\System\pQvwKrr.exe
  C:\Windows\System\pQvwKrr.exe
  2⤵
  - Executes dropped EXE
  PID:4992
- C:\Windows\System\XmNULem.exe
  C:\Windows\System\XmNULem.exe
  2⤵
  - Executes dropped EXE
  PID:4216
- C:\Windows\System\BEpQIXm.exe
  C:\Windows\System\BEpQIXm.exe
  2⤵
  - Executes dropped EXE
  PID:3656
- C:\Windows\System\HqNOeXe.exe
  C:\Windows\System\HqNOeXe.exe
  2⤵
  - Executes dropped EXE
  PID:2684
- C:\Windows\System\nXqreaL.exe
  C:\Windows\System\nXqreaL.exe
  2⤵
  - Executes dropped EXE
  PID:2460
- C:\Windows\System\QSLKllC.exe
  C:\Windows\System\QSLKllC.exe
  2⤵
  - Executes dropped EXE
  PID:632
- C:\Windows\System\pToIrwt.exe
  C:\Windows\System\pToIrwt.exe
  2⤵
  - Executes dropped EXE
  PID:3176
- C:\Windows\System\wDfWxgF.exe
  C:\Windows\System\wDfWxgF.exe
  2⤵
  - Executes dropped EXE
  PID:564
- C:\Windows\System\IxIYKZv.exe
  C:\Windows\System\IxIYKZv.exe
  2⤵
  - Executes dropped EXE
  PID:3680
- C:\Windows\System\OduZLIa.exe
  C:\Windows\System\OduZLIa.exe
  2⤵
  - Executes dropped EXE
  PID:3924
- C:\Windows\System\dHBwZgb.exe
  C:\Windows\System\dHBwZgb.exe
  2⤵
  - Executes dropped EXE
  PID:1136
- C:\Windows\System\QRMkjjH.exe
  C:\Windows\System\QRMkjjH.exe
  2⤵
  - Executes dropped EXE
  PID:5024
- C:\Windows\System\cHgxXQu.exe
  C:\Windows\System\cHgxXQu.exe
  2⤵
  - Executes dropped EXE
  PID:3524
- C:\Windows\System\OEngzms.exe
  C:\Windows\System\OEngzms.exe
  2⤵
  - Executes dropped EXE
  PID:944
- C:\Windows\System\KBthqbn.exe
  C:\Windows\System\KBthqbn.exe
  2⤵
  - Executes dropped EXE
  PID:3952
- C:\Windows\System\MCRQYHc.exe
  C:\Windows\System\MCRQYHc.exe
  2⤵
  - Executes dropped EXE
  PID:3608
- C:\Windows\System\pvJSQQr.exe
  C:\Windows\System\pvJSQQr.exe
  2⤵
  - Executes dropped EXE
  PID:4176
- C:\Windows\System\EbfyCWs.exe
  C:\Windows\System\EbfyCWs.exe
  2⤵
  - Executes dropped EXE
  PID:2312
- C:\Windows\System\pRYarxO.exe
  C:\Windows\System\pRYarxO.exe
  2⤵
  - Executes dropped EXE
  PID:4224
- C:\Windows\System\BiXreLC.exe
  C:\Windows\System\BiXreLC.exe
  2⤵
  - Executes dropped EXE
  PID:3208
- C:\Windows\System\iiEGbwU.exe
  C:\Windows\System\iiEGbwU.exe
  2⤵
  - Executes dropped EXE
  PID:1576
- C:\Windows\System\rjEWRJS.exe
  C:\Windows\System\rjEWRJS.exe
  2⤵
  - Executes dropped EXE
  PID:2664
- C:\Windows\System\xsswRnL.exe
  C:\Windows\System\xsswRnL.exe
  2⤵
  - Executes dropped EXE
  PID:2648
- C:\Windows\System\AzJGxrb.exe
  C:\Windows\System\AzJGxrb.exe
  2⤵
  - Executes dropped EXE
  PID:4500
- C:\Windows\System\klSptYf.exe
  C:\Windows\System\klSptYf.exe
  2⤵
  - Executes dropped EXE
  PID:404
- C:\Windows\System\hszwQHT.exe
  C:\Windows\System\hszwQHT.exe
  2⤵
  - Executes dropped EXE
  PID:664
- C:\Windows\System\RSODZYb.exe
  C:\Windows\System\RSODZYb.exe
  2⤵
  - Executes dropped EXE
  PID:1888
- C:\Windows\System\iOLtrCp.exe
  C:\Windows\System\iOLtrCp.exe
  2⤵
  - Executes dropped EXE
  PID:2924
- C:\Windows\System\aCPdsJi.exe
  C:\Windows\System\aCPdsJi.exe
  2⤵
  - Executes dropped EXE
  PID:2104
- C:\Windows\System\FZnZCiu.exe
  C:\Windows\System\FZnZCiu.exe
  2⤵
  - Executes dropped EXE
  PID:4644
- C:\Windows\System\jbFVJrw.exe
  C:\Windows\System\jbFVJrw.exe
  2⤵
  - Executes dropped EXE
  PID:4556
- C:\Windows\System\ZBpMeWS.exe
  C:\Windows\System\ZBpMeWS.exe
  2⤵
  - Executes dropped EXE
  PID:4640
- C:\Windows\System\lONWItR.exe
  C:\Windows\System\lONWItR.exe
  2⤵
  - Executes dropped EXE
  PID:764
- C:\Windows\System\MDnsSqC.exe
  C:\Windows\System\MDnsSqC.exe
  2⤵
  - Executes dropped EXE
  PID:3812
- C:\Windows\System\fULcoCF.exe
  C:\Windows\System\fULcoCF.exe
  2⤵
  - Executes dropped EXE
  PID:2572
- C:\Windows\System\FFClsxv.exe
  C:\Windows\System\FFClsxv.exe
  2⤵
  - Executes dropped EXE
  PID:2172
- C:\Windows\System\CgJDRMZ.exe
  C:\Windows\System\CgJDRMZ.exe
  2⤵
  - Executes dropped EXE
  PID:4580
- C:\Windows\System\trzzHfM.exe
  C:\Windows\System\trzzHfM.exe
  2⤵
  - Executes dropped EXE
  PID:1168
- C:\Windows\System\aRgdgAV.exe
  C:\Windows\System\aRgdgAV.exe
  2⤵
  - Executes dropped EXE
  PID:4368
- C:\Windows\System\EYZEVFo.exe
  C:\Windows\System\EYZEVFo.exe
  2⤵
  - Executes dropped EXE
  PID:2304
- C:\Windows\System\uXnsCfJ.exe
  C:\Windows\System\uXnsCfJ.exe
  2⤵
  - Executes dropped EXE
  PID:3016
- C:\Windows\System\xLTEXbq.exe
  C:\Windows\System\xLTEXbq.exe
  2⤵
  - Executes dropped EXE
  PID:2632
- C:\Windows\System\DpSZVIF.exe
  C:\Windows\System\DpSZVIF.exe
  2⤵
  - Executes dropped EXE
  PID:752
- C:\Windows\System\SXmCVwP.exe
  C:\Windows\System\SXmCVwP.exe
  2⤵
  - Executes dropped EXE
  PID:4372
- C:\Windows\System\Exqkyrz.exe
  C:\Windows\System\Exqkyrz.exe
  2⤵
  - Executes dropped EXE
  PID:4572
- C:\Windows\System\HDBXNMD.exe
  C:\Windows\System\HDBXNMD.exe
  2⤵
  - Executes dropped EXE
  PID:3580
- C:\Windows\System\iBoqIpk.exe
  C:\Windows\System\iBoqIpk.exe
  2⤵
  - Executes dropped EXE
  PID:3272
- C:\Windows\System\NHebQPX.exe
  C:\Windows\System\NHebQPX.exe
  2⤵
  - Executes dropped EXE
  PID:2568
- C:\Windows\System\LnVcBuV.exe
  C:\Windows\System\LnVcBuV.exe
  2⤵
  - Executes dropped EXE
  PID:4840
- C:\Windows\System\xzgRras.exe
  C:\Windows\System\xzgRras.exe
  2⤵
  - Executes dropped EXE
  PID:4052
- C:\Windows\System\EsKaHFm.exe
  C:\Windows\System\EsKaHFm.exe
  2⤵
  - Executes dropped EXE
  PID:932
- C:\Windows\System\escUxxq.exe
  C:\Windows\System\escUxxq.exe
  2⤵
  - Executes dropped EXE
  PID:1948
- C:\Windows\System\DmrQKSb.exe
  C:\Windows\System\DmrQKSb.exe
  2⤵
  - Executes dropped EXE
  PID:2452
- C:\Windows\System\DJbkHyA.exe
  C:\Windows\System\DJbkHyA.exe
  2⤵
  - Executes dropped EXE
  PID:3612
- C:\Windows\System\SdFGWyR.exe
  C:\Windows\System\SdFGWyR.exe
  2⤵
  - Executes dropped EXE
  PID:3720
- C:\Windows\System\FkOiANV.exe
  C:\Windows\System\FkOiANV.exe
  2⤵
  - Executes dropped EXE
  PID:2880
- C:\Windows\System\gUMwCsg.exe
  C:\Windows\System\gUMwCsg.exe
  2⤵
  - Executes dropped EXE
  PID:1932
- C:\Windows\System\ZnvZnQr.exe
  C:\Windows\System\ZnvZnQr.exe
  2⤵
  - Executes dropped EXE
  PID:2740
- C:\Windows\System\wCCthAd.exe
  C:\Windows\System\wCCthAd.exe
  2⤵
  - Executes dropped EXE
  PID:4928
- C:\Windows\System\OksWCdI.exe
  C:\Windows\System\OksWCdI.exe
  2⤵
  - Executes dropped EXE
  PID:2712
- C:\Windows\System\qbArpAa.exe
  C:\Windows\System\qbArpAa.exe
  2⤵
  - Executes dropped EXE
  PID:2280
- C:\Windows\System\SmSdakP.exe
  C:\Windows\System\SmSdakP.exe
  2⤵
  - Executes dropped EXE
  PID:1556
- C:\Windows\System\FtvujoY.exe
  C:\Windows\System\FtvujoY.exe
  2⤵
  - Executes dropped EXE
  PID:2960
- C:\Windows\System\cZjWSRW.exe
  C:\Windows\System\cZjWSRW.exe
  2⤵
  - Executes dropped EXE
  PID:4944
- C:\Windows\System\udRxDer.exe
  C:\Windows\System\udRxDer.exe
  2⤵
  PID:2696
- C:\Windows\System\LjoYaDb.exe
  C:\Windows\System\LjoYaDb.exe
  2⤵
  PID:64
- C:\Windows\System\iWsgziQ.exe
  C:\Windows\System\iWsgziQ.exe
  2⤵
  PID:5148
- C:\Windows\System\xBCWrWT.exe
  C:\Windows\System\xBCWrWT.exe
  2⤵
  PID:5212
- C:\Windows\System\GTNVBzW.exe
  C:\Windows\System\GTNVBzW.exe
  2⤵
  PID:5240
- C:\Windows\System\YjRiyRS.exe
  C:\Windows\System\YjRiyRS.exe
  2⤵
  PID:5296
- C:\Windows\System\uzCaylY.exe
  C:\Windows\System\uzCaylY.exe
  2⤵
  PID:5340
- C:\Windows\System\rXonmBJ.exe
  C:\Windows\System\rXonmBJ.exe
  2⤵
  PID:5424
- C:\Windows\System\NLRVcOj.exe
  C:\Windows\System\NLRVcOj.exe
  2⤵
  PID:5516
- C:\Windows\System\PkvUTAa.exe
  C:\Windows\System\PkvUTAa.exe
  2⤵
  PID:5564
- C:\Windows\System\qpkXaJp.exe
  C:\Windows\System\qpkXaJp.exe
  2⤵
  PID:5608
- C:\Windows\System\DsBobTg.exe
  C:\Windows\System\DsBobTg.exe
  2⤵
  PID:5672
- C:\Windows\System\FXqKyrI.exe
  C:\Windows\System\FXqKyrI.exe
  2⤵
  PID:5716
- C:\Windows\System\hMHAiSm.exe
  C:\Windows\System\hMHAiSm.exe
  2⤵
  PID:5740
- C:\Windows\System\BjMCKAP.exe
  C:\Windows\System\BjMCKAP.exe
  2⤵
  PID:5760
- C:\Windows\System\tRsKgdT.exe
  C:\Windows\System\tRsKgdT.exe
  2⤵
  PID:5808
- C:\Windows\System\syDJjMA.exe
  C:\Windows\System\syDJjMA.exe
  2⤵
  PID:5856
- C:\Windows\System\WIKZlSN.exe
  C:\Windows\System\WIKZlSN.exe
  2⤵
  PID:5896
- C:\Windows\System\asYkvor.exe
  C:\Windows\System\asYkvor.exe
  2⤵
  PID:5988
- C:\Windows\System\uINHXUw.exe
  C:\Windows\System\uINHXUw.exe
  2⤵
  PID:6020
- C:\Windows\System\HxCMrmS.exe
  C:\Windows\System\HxCMrmS.exe
  2⤵
  PID:6048
- C:\Windows\System\hVicFgO.exe
  C:\Windows\System\hVicFgO.exe
  2⤵
  PID:6088
- C:\Windows\System\iXattZy.exe
  C:\Windows\System\iXattZy.exe
  2⤵
  PID:6124
- C:\Windows\System\LbueRUH.exe
  C:\Windows\System\LbueRUH.exe
  2⤵
  PID:5164
- C:\Windows\System\chrlXaf.exe
  C:\Windows\System\chrlXaf.exe
  2⤵
  PID:5184
- C:\Windows\System\aHpRInN.exe
  C:\Windows\System\aHpRInN.exe
  2⤵
  PID:5224
- C:\Windows\System\KuCDvRf.exe
  C:\Windows\System\KuCDvRf.exe
  2⤵
  PID:5264
- C:\Windows\System\wXNoLnv.exe
  C:\Windows\System\wXNoLnv.exe
  2⤵
  PID:5308
- C:\Windows\System\GSKXyOg.exe
  C:\Windows\System\GSKXyOg.exe
  2⤵
  PID:5332
- C:\Windows\System\LYXsQTx.exe
  C:\Windows\System\LYXsQTx.exe
  2⤵
  PID:5376
- C:\Windows\System\QzLEzMn.exe
  C:\Windows\System\QzLEzMn.exe
  2⤵
  PID:5436
- C:\Windows\System\skfZUVA.exe
  C:\Windows\System\skfZUVA.exe
  2⤵
  PID:5492
- C:\Windows\System\MBIwAGM.exe
  C:\Windows\System\MBIwAGM.exe
  2⤵
  PID:5508
- C:\Windows\System\bWUGJqC.exe
  C:\Windows\System\bWUGJqC.exe
  2⤵
  PID:1296
- C:\Windows\System\DfkzYTW.exe
  C:\Windows\System\DfkzYTW.exe
  2⤵
  PID:5584
- C:\Windows\System\RRMrveh.exe
  C:\Windows\System\RRMrveh.exe
  2⤵
  PID:5632
- C:\Windows\System\KzsqemY.exe
  C:\Windows\System\KzsqemY.exe
  2⤵
  PID:5680
- C:\Windows\System\DdeFotO.exe
  C:\Windows\System\DdeFotO.exe
  2⤵
  PID:5704
- C:\Windows\System\HEhnFRk.exe
  C:\Windows\System\HEhnFRk.exe
  2⤵
  PID:5780
- C:\Windows\System\vvQryyz.exe
  C:\Windows\System\vvQryyz.exe
  2⤵
  PID:5788
- C:\Windows\System\PkyFSkA.exe
  C:\Windows\System\PkyFSkA.exe
  2⤵
  PID:5840
- C:\Windows\System\YxYkRoD.exe
  C:\Windows\System\YxYkRoD.exe
  2⤵
  PID:5872
- C:\Windows\System\NwtcMLl.exe
  C:\Windows\System\NwtcMLl.exe
  2⤵
  PID:5884
- C:\Windows\System\lBheiQv.exe
  C:\Windows\System\lBheiQv.exe
  2⤵
  PID:5964
- C:\Windows\System\BrSHVtI.exe
  C:\Windows\System\BrSHVtI.exe
  2⤵
  PID:6008
- C:\Windows\System\xTkONIJ.exe
  C:\Windows\System\xTkONIJ.exe
  2⤵
  PID:6064
- C:\Windows\System\nVMpjVW.exe
  C:\Windows\System\nVMpjVW.exe
  2⤵
  PID:6108
- C:\Windows\System\kbRZvCO.exe
  C:\Windows\System\kbRZvCO.exe
  2⤵
  PID:5176
- C:\Windows\System\VTQEIbP.exe
  C:\Windows\System\VTQEIbP.exe
  2⤵
  PID:5248
- C:\Windows\System\nqgzuVA.exe
  C:\Windows\System\nqgzuVA.exe
  2⤵
  PID:5348
- C:\Windows\System\NVEHjTx.exe
  C:\Windows\System\NVEHjTx.exe
  2⤵
  PID:5400
- C:\Windows\System\SPvaRQv.exe
  C:\Windows\System\SPvaRQv.exe
  2⤵
  PID:544
- C:\Windows\System\lEBbEKq.exe
  C:\Windows\System\lEBbEKq.exe
  2⤵
  PID:5552
- C:\Windows\System\TcWzjcu.exe
  C:\Windows\System\TcWzjcu.exe
  2⤵
  PID:5500
- C:\Windows\System\DbLmDJs.exe
  C:\Windows\System\DbLmDJs.exe
  2⤵
  PID:5624
- C:\Windows\System\nmJyQAJ.exe
  C:\Windows\System\nmJyQAJ.exe
  2⤵
  PID:5832
- C:\Windows\System\czsHRmk.exe
  C:\Windows\System\czsHRmk.exe
  2⤵
  PID:5916
- C:\Windows\System\ESVWVaZ.exe
  C:\Windows\System\ESVWVaZ.exe
  2⤵
  PID:6044
- C:\Windows\System\maqiUlm.exe
  C:\Windows\System\maqiUlm.exe
  2⤵
  PID:5136
- C:\Windows\System\QoQBKSi.exe
  C:\Windows\System\QoQBKSi.exe
  2⤵
  PID:5504
- C:\Windows\System\mVEbkcY.exe
  C:\Windows\System\mVEbkcY.exe
  2⤵
  PID:5700
- C:\Windows\System\kIeretV.exe
  C:\Windows\System\kIeretV.exe
  2⤵
  PID:5800
- C:\Windows\System\hmJeVnd.exe
  C:\Windows\System\hmJeVnd.exe
  2⤵
  PID:5768
- C:\Windows\System\VUdPPqh.exe
  C:\Windows\System\VUdPPqh.exe
  2⤵
  PID:6040
- C:\Windows\System\UBJxqaA.exe
  C:\Windows\System\UBJxqaA.exe
  2⤵
  PID:5432
- C:\Windows\System\BAeMKLW.exe
  C:\Windows\System\BAeMKLW.exe
  2⤵
  PID:5852
- C:\Windows\System\WnTBfTw.exe
  C:\Windows\System\WnTBfTw.exe
  2⤵
  PID:5876
- C:\Windows\System\nGdpFVz.exe
  C:\Windows\System\nGdpFVz.exe
  2⤵
  PID:6180
- C:\Windows\System\jmoJwmS.exe
  C:\Windows\System\jmoJwmS.exe
  2⤵
  PID:6204
- C:\Windows\System\Uzhlvkd.exe
  C:\Windows\System\Uzhlvkd.exe
  2⤵
  PID:6256
- C:\Windows\System\oRWIFjK.exe
  C:\Windows\System\oRWIFjK.exe
  2⤵
  PID:6276
- C:\Windows\System\GPsYDJz.exe
  C:\Windows\System\GPsYDJz.exe
  2⤵
  PID:6308
- C:\Windows\System\TnTmtrG.exe
  C:\Windows\System\TnTmtrG.exe
  2⤵
  PID:6332
- C:\Windows\System\nXUAPvU.exe
  C:\Windows\System\nXUAPvU.exe
  2⤵
  PID:6404
- C:\Windows\System\lEXoAZu.exe
  C:\Windows\System\lEXoAZu.exe
  2⤵
  PID:6432
- C:\Windows\System\TBLgxch.exe
  C:\Windows\System\TBLgxch.exe
  2⤵
  PID:6480
- C:\Windows\System\WrQMmAw.exe
  C:\Windows\System\WrQMmAw.exe
  2⤵
  PID:6496
- C:\Windows\System\YPozfOL.exe
  C:\Windows\System\YPozfOL.exe
  2⤵
  PID:6528
- C:\Windows\System\RMASomi.exe
  C:\Windows\System\RMASomi.exe
  2⤵
  PID:6564
- C:\Windows\System\hxbpZmP.exe
  C:\Windows\System\hxbpZmP.exe
  2⤵
  PID:6584
- C:\Windows\System\MXKyJrU.exe
  C:\Windows\System\MXKyJrU.exe
  2⤵
  PID:6648
- C:\Windows\System\HFsyAEB.exe
  C:\Windows\System\HFsyAEB.exe
  2⤵
  PID:6664
- C:\Windows\System\njJfcOd.exe
  C:\Windows\System\njJfcOd.exe
  2⤵
  PID:6680
- C:\Windows\System\dABHOVz.exe
  C:\Windows\System\dABHOVz.exe
  2⤵
  PID:6700
- C:\Windows\System\CMQTtbS.exe
  C:\Windows\System\CMQTtbS.exe
  2⤵
  PID:6720
- C:\Windows\System\HKGVgAG.exe
  C:\Windows\System\HKGVgAG.exe
  2⤵
  PID:6740
- C:\Windows\System\nMeJnIK.exe
  C:\Windows\System\nMeJnIK.exe
  2⤵
  PID:6756
- C:\Windows\System\AYqIZmB.exe
  C:\Windows\System\AYqIZmB.exe
  2⤵
  PID:6776
- C:\Windows\System\FkPtIQz.exe
  C:\Windows\System\FkPtIQz.exe
  2⤵
  PID:6900
- C:\Windows\System\ezjOYho.exe
  C:\Windows\System\ezjOYho.exe
  2⤵
  PID:6928
- C:\Windows\System\lFOtFAx.exe
  C:\Windows\System\lFOtFAx.exe
  2⤵
  PID:6948
- C:\Windows\System\GncLJpB.exe
  C:\Windows\System\GncLJpB.exe
  2⤵
  PID:6968
- C:\Windows\System\tOYhZqI.exe
  C:\Windows\System\tOYhZqI.exe
  2⤵
  PID:6992
- C:\Windows\System\ZxldxoL.exe
  C:\Windows\System\ZxldxoL.exe
  2⤵
  PID:7060
- C:\Windows\System\mtWJMly.exe
  C:\Windows\System\mtWJMly.exe
  2⤵
  PID:7076
- C:\Windows\System\iuFHPfk.exe
  C:\Windows\System\iuFHPfk.exe
  2⤵
  PID:7132
- C:\Windows\System\QthOiMG.exe
  C:\Windows\System\QthOiMG.exe
  2⤵
  PID:7152
- C:\Windows\System\gFwtWVg.exe
  C:\Windows\System\gFwtWVg.exe
  2⤵
  PID:6176
- C:\Windows\System\WKsOsrJ.exe
  C:\Windows\System\WKsOsrJ.exe
  2⤵
  PID:6160
- C:\Windows\System\CPzkhbU.exe
  C:\Windows\System\CPzkhbU.exe
  2⤵
  PID:6240
- C:\Windows\System\lXySvzR.exe
  C:\Windows\System\lXySvzR.exe
  2⤵
  PID:6328
- C:\Windows\System\WtPyjGc.exe
  C:\Windows\System\WtPyjGc.exe
  2⤵
  PID:6340
- C:\Windows\System\mpMAlGq.exe
  C:\Windows\System\mpMAlGq.exe
  2⤵
  PID:6392
- C:\Windows\System\YFKHUlE.exe
  C:\Windows\System\YFKHUlE.exe
  2⤵
  PID:6372
- C:\Windows\System\pTslkBr.exe
  C:\Windows\System\pTslkBr.exe
  2⤵
  PID:6472
- C:\Windows\System\VodRsIh.exe
  C:\Windows\System\VodRsIh.exe
  2⤵
  PID:6524
- C:\Windows\System\aenZMvG.exe
  C:\Windows\System\aenZMvG.exe
  2⤵
  PID:6448
- C:\Windows\System\ddLViBs.exe
  C:\Windows\System\ddLViBs.exe
  2⤵
  PID:6624
- C:\Windows\System\wpesZdD.exe
  C:\Windows\System\wpesZdD.exe
  2⤵
  PID:6752
- C:\Windows\System\gYUBjYS.exe
  C:\Windows\System\gYUBjYS.exe
  2⤵
  PID:6612
- C:\Windows\System\ZaxKBAC.exe
  C:\Windows\System\ZaxKBAC.exe
  2⤵
  PID:6644
- C:\Windows\System\ZeQBuMv.exe
  C:\Windows\System\ZeQBuMv.exe
  2⤵
  PID:6856
- C:\Windows\System\bBtDFst.exe
  C:\Windows\System\bBtDFst.exe
  2⤵
  PID:6812
- C:\Windows\System\nxEDOqS.exe
  C:\Windows\System\nxEDOqS.exe
  2⤵
  PID:7068
- C:\Windows\System\NLexBIm.exe
  C:\Windows\System\NLexBIm.exe
  2⤵
  PID:7128
- C:\Windows\System\bIsiQTP.exe
  C:\Windows\System\bIsiQTP.exe
  2⤵
  PID:3060
- C:\Windows\System\dvDTwEG.exe
  C:\Windows\System\dvDTwEG.exe
  2⤵
  PID:6420
- C:\Windows\System\vWCyhJT.exe
  C:\Windows\System\vWCyhJT.exe
  2⤵
  PID:6520
- C:\Windows\System\xPmyGbT.exe
  C:\Windows\System\xPmyGbT.exe
  2⤵
  PID:6608
- C:\Windows\System\zwzGlOd.exe
  C:\Windows\System\zwzGlOd.exe
  2⤵
  PID:6380
- C:\Windows\System\lQOqAEw.exe
  C:\Windows\System\lQOqAEw.exe
  2⤵
  PID:6604
- C:\Windows\System\FeftkhV.exe
  C:\Windows\System\FeftkhV.exe
  2⤵
  PID:6824
- C:\Windows\System\qdlEoRR.exe
  C:\Windows\System\qdlEoRR.exe
  2⤵
  PID:6876
- C:\Windows\System\zPKvejj.exe
  C:\Windows\System\zPKvejj.exe
  2⤵
  PID:7040
- C:\Windows\System\YMwojvf.exe
  C:\Windows\System\YMwojvf.exe
  2⤵
  PID:6196
- C:\Windows\System\uhiMwOv.exe
  C:\Windows\System\uhiMwOv.exe
  2⤵
  PID:6592
- C:\Windows\System\xlKSdqy.exe
  C:\Windows\System\xlKSdqy.exe
  2⤵
  PID:6460
- C:\Windows\System\kDLORxl.exe
  C:\Windows\System\kDLORxl.exe
  2⤵
  PID:6944
- C:\Windows\System\SynEMFE.exe
  C:\Windows\System\SynEMFE.exe
  2⤵
  PID:5368
- C:\Windows\System\tBEqPJm.exe
  C:\Windows\System\tBEqPJm.exe
  2⤵
  PID:6424
- C:\Windows\System\IIVXsqu.exe
  C:\Windows\System\IIVXsqu.exe
  2⤵
  PID:6872
- C:\Windows\System\mdJgXgH.exe
  C:\Windows\System\mdJgXgH.exe
  2⤵
  PID:6292
- C:\Windows\System\bSreQYE.exe
  C:\Windows\System\bSreQYE.exe
  2⤵
  PID:7208
- C:\Windows\System\pQPHJTB.exe
  C:\Windows\System\pQPHJTB.exe
  2⤵
  PID:7228
- C:\Windows\System\bdzEKgk.exe
  C:\Windows\System\bdzEKgk.exe
  2⤵
  PID:7252
- C:\Windows\System\TEJnZLS.exe
  C:\Windows\System\TEJnZLS.exe
  2⤵
  PID:7288
- C:\Windows\System\xlcVZYp.exe
  C:\Windows\System\xlcVZYp.exe
  2⤵
  PID:7312
- C:\Windows\System\uGJyAwT.exe
  C:\Windows\System\uGJyAwT.exe
  2⤵
  PID:7336
- C:\Windows\System\TjBhCCc.exe
  C:\Windows\System\TjBhCCc.exe
  2⤵
  PID:7356
- C:\Windows\System\vMgLroB.exe
  C:\Windows\System\vMgLroB.exe
  2⤵
  PID:7384
- C:\Windows\System\MDGYrPx.exe
  C:\Windows\System\MDGYrPx.exe
  2⤵
  PID:7404
- C:\Windows\System\vMgNnas.exe
  C:\Windows\System\vMgNnas.exe
  2⤵
  PID:7424
- C:\Windows\System\hzWtBbE.exe
  C:\Windows\System\hzWtBbE.exe
  2⤵
  PID:7448
- C:\Windows\System\kExxrJA.exe
  C:\Windows\System\kExxrJA.exe
  2⤵
  PID:7484
- C:\Windows\System\ZqQDtjk.exe
  C:\Windows\System\ZqQDtjk.exe
  2⤵
  PID:7508
- C:\Windows\System\GmeoUEm.exe
  C:\Windows\System\GmeoUEm.exe
  2⤵
  PID:7528
- C:\Windows\System\KDRoyRl.exe
  C:\Windows\System\KDRoyRl.exe
  2⤵
  PID:7580
- C:\Windows\System\cnfxZaF.exe
  C:\Windows\System\cnfxZaF.exe
  2⤵
  PID:7600
- C:\Windows\System\EDeDWWL.exe
  C:\Windows\System\EDeDWWL.exe
  2⤵
  PID:7644
- C:\Windows\System\ydrlRTB.exe
  C:\Windows\System\ydrlRTB.exe
  2⤵
  PID:7704
- C:\Windows\System\JXAUwuM.exe
  C:\Windows\System\JXAUwuM.exe
  2⤵
  PID:7724
- C:\Windows\System\kUnXCDd.exe
  C:\Windows\System\kUnXCDd.exe
  2⤵
  PID:7748
- C:\Windows\System\GJrfUWP.exe
  C:\Windows\System\GJrfUWP.exe
  2⤵
  PID:7772
- C:\Windows\System\gLdtpdN.exe
  C:\Windows\System\gLdtpdN.exe
  2⤵
  PID:7796
- C:\Windows\System\KNNkLVl.exe
  C:\Windows\System\KNNkLVl.exe
  2⤵
  PID:7836
- C:\Windows\System\OpolNWW.exe
  C:\Windows\System\OpolNWW.exe
  2⤵
  PID:7852
- C:\Windows\System\SmtRtDC.exe
  C:\Windows\System\SmtRtDC.exe
  2⤵
  PID:7872
- C:\Windows\System\gclKgmd.exe
  C:\Windows\System\gclKgmd.exe
  2⤵
  PID:7896
- C:\Windows\System\lywWojF.exe
  C:\Windows\System\lywWojF.exe
  2⤵
  PID:7912
- C:\Windows\System\qRHrnzl.exe
  C:\Windows\System\qRHrnzl.exe
  2⤵
  PID:7960
- C:\Windows\System\JkIiPZM.exe
  C:\Windows\System\JkIiPZM.exe
  2⤵
  PID:8004
- C:\Windows\System\YQTOKuX.exe
  C:\Windows\System\YQTOKuX.exe
  2⤵
  PID:8040
- C:\Windows\System\QCMzRxu.exe
  C:\Windows\System\QCMzRxu.exe
  2⤵
  PID:8060
- C:\Windows\System\bjVBmYO.exe
  C:\Windows\System\bjVBmYO.exe
  2⤵
  PID:8084
- C:\Windows\System\STdoVaI.exe
  C:\Windows\System\STdoVaI.exe
  2⤵
  PID:8100
- C:\Windows\System\JbRdBDt.exe
  C:\Windows\System\JbRdBDt.exe
  2⤵
  PID:8128
- C:\Windows\System\VlworMA.exe
  C:\Windows\System\VlworMA.exe
  2⤵
  PID:8144
- C:\Windows\System\RLwseeq.exe
  C:\Windows\System\RLwseeq.exe
  2⤵
  PID:8168
- C:\Windows\System\DobcVzm.exe
  C:\Windows\System\DobcVzm.exe
  2⤵
  PID:7200
- C:\Windows\System\KrtPDmV.exe
  C:\Windows\System\KrtPDmV.exe
  2⤵
  PID:7240
- C:\Windows\System\lRpftKN.exe
  C:\Windows\System\lRpftKN.exe
  2⤵
  PID:7280
- C:\Windows\System\xPicURM.exe
  C:\Windows\System\xPicURM.exe
  2⤵
  PID:7364
- C:\Windows\System\uIpeWPL.exe
  C:\Windows\System\uIpeWPL.exe
  2⤵
  PID:7468
- C:\Windows\System\YkKilUv.exe
  C:\Windows\System\YkKilUv.exe
  2⤵
  PID:7496
- C:\Windows\System\ICLfNDj.exe
  C:\Windows\System\ICLfNDj.exe
  2⤵
  PID:7652
- C:\Windows\System\ZSSFyMK.exe
  C:\Windows\System\ZSSFyMK.exe
  2⤵
  PID:7664
- C:\Windows\System\mdneAmn.exe
  C:\Windows\System\mdneAmn.exe
  2⤵
  PID:7736
- C:\Windows\System\akgbWSK.exe
  C:\Windows\System\akgbWSK.exe
  2⤵
  PID:7768
- C:\Windows\System\TUgcDSl.exe
  C:\Windows\System\TUgcDSl.exe
  2⤵
  PID:7864
- C:\Windows\System\EEnypez.exe
  C:\Windows\System\EEnypez.exe
  2⤵
  PID:7940
- C:\Windows\System\IqcjQIY.exe
  C:\Windows\System\IqcjQIY.exe
  2⤵
  PID:7996
- C:\Windows\System\suszhuo.exe
  C:\Windows\System\suszhuo.exe
  2⤵
  PID:8068
- C:\Windows\System\bVORUuC.exe
  C:\Windows\System\bVORUuC.exe
  2⤵
  PID:8092
- C:\Windows\System\mLVXiNc.exe
  C:\Windows\System\mLVXiNc.exe
  2⤵
  PID:8156
- C:\Windows\System\HseYcSk.exe
  C:\Windows\System\HseYcSk.exe
  2⤵
  PID:7440
- C:\Windows\System\RyosYOv.exe
  C:\Windows\System\RyosYOv.exe
  2⤵
  PID:7476
- C:\Windows\System\RpgfBzJ.exe
  C:\Windows\System\RpgfBzJ.exe
  2⤵
  PID:7680
- C:\Windows\System\LQigApd.exe
  C:\Windows\System\LQigApd.exe
  2⤵
  PID:7720
- C:\Windows\System\pSXiTgv.exe
  C:\Windows\System\pSXiTgv.exe
  2⤵
  PID:4748
- C:\Windows\System\NbZIxPB.exe
  C:\Windows\System\NbZIxPB.exe
  2⤵
  PID:7992
- C:\Windows\System\CrQokOC.exe
  C:\Windows\System\CrQokOC.exe
  2⤵
  PID:8108
- C:\Windows\System\tNsGHmb.exe
  C:\Windows\System\tNsGHmb.exe
  2⤵
  PID:7296
- C:\Windows\System\hyLyURT.exe
  C:\Windows\System\hyLyURT.exe
  2⤵
  PID:7332
- C:\Windows\System\pKuFwws.exe
  C:\Windows\System\pKuFwws.exe
  2⤵
  PID:7712
- C:\Windows\System\VCjuxbF.exe
  C:\Windows\System\VCjuxbF.exe
  2⤵
  PID:7908
- C:\Windows\System\BGryvgP.exe
  C:\Windows\System\BGryvgP.exe
  2⤵
  PID:8204
- C:\Windows\System\OLZIkkH.exe
  C:\Windows\System\OLZIkkH.exe
  2⤵
  PID:8220
- C:\Windows\System\GHuJzjc.exe
  C:\Windows\System\GHuJzjc.exe
  2⤵
  PID:8244
- C:\Windows\System\OUGYJqO.exe
  C:\Windows\System\OUGYJqO.exe
  2⤵
  PID:8260
- C:\Windows\System\GEpiXAH.exe
  C:\Windows\System\GEpiXAH.exe
  2⤵
  PID:8284
- C:\Windows\System\ERWQkFX.exe
  C:\Windows\System\ERWQkFX.exe
  2⤵
  PID:8304
- C:\Windows\System\ollMZSo.exe
  C:\Windows\System\ollMZSo.exe
  2⤵
  PID:8336
- C:\Windows\System\MdfLJCg.exe
  C:\Windows\System\MdfLJCg.exe
  2⤵
  PID:8360
- C:\Windows\System\kaJdGgR.exe
  C:\Windows\System\kaJdGgR.exe
  2⤵
  PID:8384
- C:\Windows\System\OXjgsAI.exe
  C:\Windows\System\OXjgsAI.exe
  2⤵
  PID:8404
- C:\Windows\System\gHEypil.exe
  C:\Windows\System\gHEypil.exe
  2⤵
  PID:8424
- C:\Windows\System\yglrhQT.exe
  C:\Windows\System\yglrhQT.exe
  2⤵
  PID:8444
- C:\Windows\System\lkTyFxM.exe
  C:\Windows\System\lkTyFxM.exe
  2⤵
  PID:8512
- C:\Windows\System\uvmnkmr.exe
  C:\Windows\System\uvmnkmr.exe
  2⤵
  PID:8552
- C:\Windows\System\BfnTIGE.exe
  C:\Windows\System\BfnTIGE.exe
  2⤵
  PID:8568
- C:\Windows\System\cbZVEvn.exe
  C:\Windows\System\cbZVEvn.exe
  2⤵
  PID:8596
- C:\Windows\System\zcSntgm.exe
  C:\Windows\System\zcSntgm.exe
  2⤵
  PID:8620
- C:\Windows\System\AiTYxQG.exe
  C:\Windows\System\AiTYxQG.exe
  2⤵
  PID:8640
- C:\Windows\System\yeBERDo.exe
  C:\Windows\System\yeBERDo.exe
  2⤵
  PID:8672
- C:\Windows\System\fcMTrdL.exe
  C:\Windows\System\fcMTrdL.exe
  2⤵
  PID:8692
- C:\Windows\System\yVibAKu.exe
  C:\Windows\System\yVibAKu.exe
  2⤵
  PID:8720
- C:\Windows\System\kjCZGAe.exe
  C:\Windows\System\kjCZGAe.exe
  2⤵
  PID:8736
- C:\Windows\System\FjGNvXX.exe
  C:\Windows\System\FjGNvXX.exe
  2⤵
  PID:8764
- C:\Windows\System\ilwzugS.exe
  C:\Windows\System\ilwzugS.exe
  2⤵
  PID:8780
- C:\Windows\System\KcfhBAr.exe
  C:\Windows\System\KcfhBAr.exe
  2⤵
  PID:8796
- C:\Windows\System\yrapNjR.exe
  C:\Windows\System\yrapNjR.exe
  2⤵
  PID:8812
- C:\Windows\System\LFeWWfP.exe
  C:\Windows\System\LFeWWfP.exe
  2⤵
  PID:8836
- C:\Windows\System\YMqimAb.exe
  C:\Windows\System\YMqimAb.exe
  2⤵
  PID:8864
- C:\Windows\System\BQsfMOc.exe
  C:\Windows\System\BQsfMOc.exe
  2⤵
  PID:8880
- C:\Windows\System\aMEaLrq.exe
  C:\Windows\System\aMEaLrq.exe
  2⤵
  PID:8904
- C:\Windows\System\rnbbMUI.exe
  C:\Windows\System\rnbbMUI.exe
  2⤵
  PID:8924
- C:\Windows\System\ABYseOA.exe
  C:\Windows\System\ABYseOA.exe
  2⤵
  PID:8948
- C:\Windows\System\MhTMBeT.exe
  C:\Windows\System\MhTMBeT.exe
  2⤵
  PID:8972
- C:\Windows\System\XIPvEao.exe
  C:\Windows\System\XIPvEao.exe
  2⤵
  PID:8992
- C:\Windows\System\IAyMeFW.exe
  C:\Windows\System\IAyMeFW.exe
  2⤵
  PID:9012
- C:\Windows\System\YqaTweZ.exe
  C:\Windows\System\YqaTweZ.exe
  2⤵
  PID:9036
- C:\Windows\System\gumWAZd.exe
  C:\Windows\System\gumWAZd.exe
  2⤵
  PID:9056
- C:\Windows\System\GfcepQY.exe
  C:\Windows\System\GfcepQY.exe
  2⤵
  PID:9076
- C:\Windows\System\kCVevOH.exe
  C:\Windows\System\kCVevOH.exe
  2⤵
  PID:9096
- C:\Windows\System\bgTCWOd.exe
  C:\Windows\System\bgTCWOd.exe
  2⤵
  PID:9120
- C:\Windows\System\yrnhZKA.exe
  C:\Windows\System\yrnhZKA.exe
  2⤵
  PID:9136
- C:\Windows\System\TapZUPE.exe
  C:\Windows\System\TapZUPE.exe
  2⤵
  PID:9164
- C:\Windows\System\JCWbckr.exe
  C:\Windows\System\JCWbckr.exe
  2⤵
  PID:9184
- C:\Windows\System\gkvzkHD.exe
  C:\Windows\System\gkvzkHD.exe
  2⤵
  PID:9212
- C:\Windows\System\MiorvdO.exe
  C:\Windows\System\MiorvdO.exe
  2⤵
  PID:7352
- C:\Windows\System\JDmzLEg.exe
  C:\Windows\System\JDmzLEg.exe
  2⤵
  PID:8236
- C:\Windows\System\zzvRqDP.exe
  C:\Windows\System\zzvRqDP.exe
  2⤵
  PID:8200
- C:\Windows\System\UmSglbm.exe
  C:\Windows\System\UmSglbm.exe
  2⤵
  PID:8268
- C:\Windows\System\Kmjalev.exe
  C:\Windows\System\Kmjalev.exe
  2⤵
  PID:8480
- C:\Windows\System\qqlFVOA.exe
  C:\Windows\System\qqlFVOA.exe
  2⤵
  PID:8492
- C:\Windows\System\OkzYNwl.exe
  C:\Windows\System\OkzYNwl.exe
  2⤵
  PID:8612
- C:\Windows\System\qFgPUhA.exe
  C:\Windows\System\qFgPUhA.exe
  2⤵
  PID:8616
- C:\Windows\System\YJrOsnI.exe
  C:\Windows\System\YJrOsnI.exe
  2⤵
  PID:8604
- C:\Windows\System\xivJQVv.exe
  C:\Windows\System\xivJQVv.exe
  2⤵
  PID:8804
- C:\Windows\System\byRwkta.exe
  C:\Windows\System\byRwkta.exe
  2⤵
  PID:8844
- C:\Windows\System\WBzAjsT.exe
  C:\Windows\System\WBzAjsT.exe
  2⤵
  PID:8872
- C:\Windows\System\LyTUIGh.exe
  C:\Windows\System\LyTUIGh.exe
  2⤵
  PID:9088
- C:\Windows\System\IUuaAuV.exe
  C:\Windows\System\IUuaAuV.exe
  2⤵
  PID:8184
- C:\Windows\System\tPBnMJr.exe
  C:\Windows\System\tPBnMJr.exe
  2⤵
  PID:9208
- C:\Windows\System\kmgGuZu.exe
  C:\Windows\System\kmgGuZu.exe
  2⤵
  PID:8324
- C:\Windows\System\ZwdjSmH.exe
  C:\Windows\System\ZwdjSmH.exe
  2⤵
  PID:8648
- C:\Windows\System\xQgPrdX.exe
  C:\Windows\System\xQgPrdX.exe
  2⤵
  PID:8792
- C:\Windows\System\HQLxiGw.exe
  C:\Windows\System\HQLxiGw.exe
  2⤵
  PID:8376
- C:\Windows\System\dwMCOim.exe
  C:\Windows\System\dwMCOim.exe
  2⤵
  PID:9112
- C:\Windows\System\dpyfWHW.exe
  C:\Windows\System\dpyfWHW.exe
  2⤵
  PID:8412
- C:\Windows\System\oDjLBic.exe
  C:\Windows\System\oDjLBic.exe
  2⤵
  PID:8588
- C:\Windows\System\opPRruP.exe
  C:\Windows\System\opPRruP.exe
  2⤵
  PID:9244
- C:\Windows\System\OUvLwzn.exe
  C:\Windows\System\OUvLwzn.exe
  2⤵
  PID:9264
- C:\Windows\System\phMTGap.exe
  C:\Windows\System\phMTGap.exe
  2⤵
  PID:9280
- C:\Windows\System\HPJGxvN.exe
  C:\Windows\System\HPJGxvN.exe
  2⤵
  PID:9308
- C:\Windows\System\YYlUwLz.exe
  C:\Windows\System\YYlUwLz.exe
  2⤵
  PID:9436
- C:\Windows\System\nMpTRvl.exe
  C:\Windows\System\nMpTRvl.exe
  2⤵
  PID:9480
- C:\Windows\System\BVJSQdR.exe
  C:\Windows\System\BVJSQdR.exe
  2⤵
  PID:9512
- C:\Windows\System\egwqqQw.exe
  C:\Windows\System\egwqqQw.exe
  2⤵
  PID:9536
- C:\Windows\System\cQzmCKd.exe
  C:\Windows\System\cQzmCKd.exe
  2⤵
  PID:9560
- C:\Windows\System\UDitLmE.exe
  C:\Windows\System\UDitLmE.exe
  2⤵
  PID:9584
- C:\Windows\System\xkRkkgN.exe
  C:\Windows\System\xkRkkgN.exe
  2⤵
  PID:9612
- C:\Windows\System\vKHuhWX.exe
  C:\Windows\System\vKHuhWX.exe
  2⤵
  PID:9896
- C:\Windows\System\dlEfxfU.exe
  C:\Windows\System\dlEfxfU.exe
  2⤵
  PID:9964
- C:\Windows\System\AmUrjym.exe
  C:\Windows\System\AmUrjym.exe
  2⤵
  PID:9988
- C:\Windows\System\wPvThpw.exe
  C:\Windows\System\wPvThpw.exe
  2⤵
  PID:10008
- C:\Windows\System\HVXbIHi.exe
  C:\Windows\System\HVXbIHi.exe
  2⤵
  PID:10032
- C:\Windows\System\mVqqgCj.exe
  C:\Windows\System\mVqqgCj.exe
  2⤵
  PID:10052
- C:\Windows\System\qTBkVwZ.exe
  C:\Windows\System\qTBkVwZ.exe
  2⤵
  PID:10076
- C:\Windows\System\vxGsuGh.exe
  C:\Windows\System\vxGsuGh.exe
  2⤵
  PID:10096
- C:\Windows\System\KEyliXZ.exe
  C:\Windows\System\KEyliXZ.exe
  2⤵
  PID:10120
- C:\Windows\System\pAXOdkM.exe
  C:\Windows\System\pAXOdkM.exe
  2⤵
  PID:10140
- C:\Windows\System\FpWoyJx.exe
  C:\Windows\System\FpWoyJx.exe
  2⤵
  PID:10156
- C:\Windows\System\SSeNvRX.exe
  C:\Windows\System\SSeNvRX.exe
  2⤵
  PID:10172
- C:\Windows\System\xXvvmhe.exe
  C:\Windows\System\xXvvmhe.exe
  2⤵
  PID:10196
- C:\Windows\System\zBRFDsU.exe
  C:\Windows\System\zBRFDsU.exe
  2⤵
  PID:10220
- C:\Windows\System\IFrKTKZ.exe
  C:\Windows\System\IFrKTKZ.exe
  2⤵
  PID:8548
- C:\Windows\System\zTsxxOw.exe
  C:\Windows\System\zTsxxOw.exe
  2⤵
  PID:9232
- C:\Windows\System\gLatBFr.exe
  C:\Windows\System\gLatBFr.exe
  2⤵
  PID:9332
- C:\Windows\System\QfSdaBX.exe
  C:\Windows\System\QfSdaBX.exe
  2⤵
  PID:9200
- C:\Windows\System\HpfTlEE.exe
  C:\Windows\System\HpfTlEE.exe
  2⤵
  PID:8464
- C:\Windows\System\zugvsnY.exe
  C:\Windows\System\zugvsnY.exe
  2⤵
  PID:9300
- C:\Windows\System\ZAgafdK.exe
  C:\Windows\System\ZAgafdK.exe
  2⤵
  PID:9316
- C:\Windows\System\JqTfBHu.exe
  C:\Windows\System\JqTfBHu.exe
  2⤵
  PID:8856
- C:\Windows\System\ZqRmMXS.exe
  C:\Windows\System\ZqRmMXS.exe
  2⤵
  PID:8940
- C:\Windows\System\hxzOUSf.exe
  C:\Windows\System\hxzOUSf.exe
  2⤵
  PID:9588
- C:\Windows\System\mRSTvGe.exe
  C:\Windows\System\mRSTvGe.exe
  2⤵
  PID:9532
- C:\Windows\System\KKFzzYL.exe
  C:\Windows\System\KKFzzYL.exe
  2⤵
  PID:9636
- C:\Windows\System\TDZuwtP.exe
  C:\Windows\System\TDZuwtP.exe
  2⤵
  PID:9764
- C:\Windows\System\IWhuVOf.exe
  C:\Windows\System\IWhuVOf.exe
  2⤵
  PID:9800
- C:\Windows\System\aJXRmiA.exe
  C:\Windows\System\aJXRmiA.exe
  2⤵
  PID:9828
- C:\Windows\System\uWbDDNA.exe
  C:\Windows\System\uWbDDNA.exe
  2⤵
  PID:9856
- C:\Windows\System\IpBaGej.exe
  C:\Windows\System\IpBaGej.exe
  2⤵
  PID:9884
- C:\Windows\System\RaSSIJQ.exe
  C:\Windows\System\RaSSIJQ.exe
  2⤵
  PID:9872
- C:\Windows\System\hcIUYOl.exe
  C:\Windows\System\hcIUYOl.exe
  2⤵
  PID:9940
- C:\Windows\System\fveTYai.exe
  C:\Windows\System\fveTYai.exe
  2⤵
  PID:9908
- C:\Windows\System\XIzFhic.exe
  C:\Windows\System\XIzFhic.exe
  2⤵
  PID:2944
- C:\Windows\System\AeEsgRq.exe
  C:\Windows\System\AeEsgRq.exe
  2⤵
  PID:10028
- C:\Windows\System\bRyIezh.exe
  C:\Windows\System\bRyIezh.exe
  2⤵
  PID:10024
- C:\Windows\System\RsZELeR.exe
  C:\Windows\System\RsZELeR.exe
  2⤵
  PID:10068
- C:\Windows\System\JzMQYTO.exe
  C:\Windows\System\JzMQYTO.exe
  2⤵
  PID:10136
- C:\Windows\System\IgkdSjW.exe
  C:\Windows\System\IgkdSjW.exe
  2⤵
  PID:10104
- C:\Windows\System\wuiRezt.exe
  C:\Windows\System\wuiRezt.exe
  2⤵
  PID:10204
- C:\Windows\System\AveyUvb.exe
  C:\Windows\System\AveyUvb.exe
  2⤵
  PID:9008
- C:\Windows\System\zNJZZqv.exe
  C:\Windows\System\zNJZZqv.exe
  2⤵
  PID:9340
- C:\Windows\System\cbFYcQl.exe
  C:\Windows\System\cbFYcQl.exe
  2⤵
  PID:9844
- C:\Windows\System\WXFKZjB.exe
  C:\Windows\System\WXFKZjB.exe
  2⤵
  PID:9568
- C:\Windows\System\lOeCmKw.exe
  C:\Windows\System\lOeCmKw.exe
  2⤵
  PID:9024
- C:\Windows\System\ekdeqlu.exe
  C:\Windows\System\ekdeqlu.exe
  2⤵
  PID:9868
- C:\Windows\System\gzalxvY.exe
  C:\Windows\System\gzalxvY.exe
  2⤵
  PID:9624
- C:\Windows\System\lonbcwS.exe
  C:\Windows\System\lonbcwS.exe
  2⤵
  PID:4860
- C:\Windows\System\glMuYyt.exe
  C:\Windows\System\glMuYyt.exe
  2⤵
  PID:10092
- C:\Windows\System\rFhrFjc.exe
  C:\Windows\System\rFhrFjc.exe
  2⤵
  PID:10168
- C:\Windows\System\OLXfbnp.exe
  C:\Windows\System\OLXfbnp.exe
  2⤵
  PID:10248
- C:\Windows\System\UfEIOlf.exe
  C:\Windows\System\UfEIOlf.exe
  2⤵
  PID:10268
- C:\Windows\System\nIahtWh.exe
  C:\Windows\System\nIahtWh.exe
  2⤵
  PID:10292
- C:\Windows\System\DTFUIJI.exe
  C:\Windows\System\DTFUIJI.exe
  2⤵
  PID:10312
- C:\Windows\System\GevhmWy.exe
  C:\Windows\System\GevhmWy.exe
  2⤵
  PID:10336
- C:\Windows\System\jsSbYhm.exe
  C:\Windows\System\jsSbYhm.exe
  2⤵
  PID:10364
- C:\Windows\System\DPZByOb.exe
  C:\Windows\System\DPZByOb.exe
  2⤵
  PID:10384
- C:\Windows\System\dPWAtXk.exe
  C:\Windows\System\dPWAtXk.exe
  2⤵
  PID:10408
- C:\Windows\System\ryaWZqQ.exe
  C:\Windows\System\ryaWZqQ.exe
  2⤵
  PID:10476
- C:\Windows\System\wdNQoRy.exe
  C:\Windows\System\wdNQoRy.exe
  2⤵
  PID:10492
- C:\Windows\System\avPJSzR.exe
  C:\Windows\System\avPJSzR.exe
  2⤵
  PID:10508
- C:\Windows\System\fhBxAYC.exe
  C:\Windows\System\fhBxAYC.exe
  2⤵
  PID:10524
- C:\Windows\System\kcjPbNz.exe
  C:\Windows\System\kcjPbNz.exe
  2⤵
  PID:10540
- C:\Windows\System\SoRwOeR.exe
  C:\Windows\System\SoRwOeR.exe
  2⤵
  PID:10556
- C:\Windows\System\UaplXBm.exe
  C:\Windows\System\UaplXBm.exe
  2⤵
  PID:10584
- C:\Windows\System\rCXnTMz.exe
  C:\Windows\System\rCXnTMz.exe
  2⤵
  PID:10648
- C:\Windows\System\EQWjLbs.exe
  C:\Windows\System\EQWjLbs.exe
  2⤵
  PID:10668
- C:\Windows\System\tVIaMho.exe
  C:\Windows\System\tVIaMho.exe
  2⤵
  PID:10696
- C:\Windows\System\buMIFet.exe
  C:\Windows\System\buMIFet.exe
  2⤵
  PID:10712
- C:\Windows\System\isjlRPj.exe
  C:\Windows\System\isjlRPj.exe
  2⤵
  PID:10736
- C:\Windows\System\GilSRVW.exe
  C:\Windows\System\GilSRVW.exe
  2⤵
  PID:10752
- C:\Windows\System\ajnNamA.exe
  C:\Windows\System\ajnNamA.exe
  2⤵
  PID:10772
- C:\Windows\System\AoDAsGZ.exe
  C:\Windows\System\AoDAsGZ.exe
  2⤵
  PID:10796
- C:\Windows\System\bpkWexN.exe
  C:\Windows\System\bpkWexN.exe
  2⤵
  PID:10820
- C:\Windows\System\ruAoDvn.exe
  C:\Windows\System\ruAoDvn.exe
  2⤵
  PID:10836
- C:\Windows\System\eMwGoxh.exe
  C:\Windows\System\eMwGoxh.exe
  2⤵
  PID:10856
- C:\Windows\System\MDhrOqd.exe
  C:\Windows\System\MDhrOqd.exe
  2⤵
  PID:10880
- C:\Windows\System\tApYrfu.exe
  C:\Windows\System\tApYrfu.exe
  2⤵
  PID:10896
- C:\Windows\System\XKNnadG.exe
  C:\Windows\System\XKNnadG.exe
  2⤵
  PID:11060
- C:\Windows\System\rEejqDP.exe
  C:\Windows\System\rEejqDP.exe
  2⤵
  PID:11084
- C:\Windows\System\cPIdVlv.exe
  C:\Windows\System\cPIdVlv.exe
  2⤵
  PID:11100
- C:\Windows\System\klinnAN.exe
  C:\Windows\System\klinnAN.exe
  2⤵
  PID:11116
- C:\Windows\System\GUiAwBl.exe
  C:\Windows\System\GUiAwBl.exe
  2⤵
  PID:11132
- C:\Windows\System\fARXDeK.exe
  C:\Windows\System\fARXDeK.exe
  2⤵
  PID:11148
- C:\Windows\System\uvTAzIq.exe
  C:\Windows\System\uvTAzIq.exe
  2⤵
  PID:11168
- C:\Windows\System\ewCLmVT.exe
  C:\Windows\System\ewCLmVT.exe
  2⤵
  PID:11188
- C:\Windows\System\ajciwiC.exe
  C:\Windows\System\ajciwiC.exe
  2⤵
  PID:11208
- C:\Windows\System\iIGgArX.exe
  C:\Windows\System\iIGgArX.exe
  2⤵
  PID:11228
- C:\Windows\System\OpEEVAU.exe
  C:\Windows\System\OpEEVAU.exe
  2⤵
  PID:9496
- C:\Windows\System\WWSwbqP.exe
  C:\Windows\System\WWSwbqP.exe
  2⤵
  PID:9816
- C:\Windows\System\aKlaTbC.exe
  C:\Windows\System\aKlaTbC.exe
  2⤵
  PID:4852
- C:\Windows\System\MHSjset.exe
  C:\Windows\System\MHSjset.exe
  2⤵
  PID:2932
- C:\Windows\System\shyRIdT.exe
  C:\Windows\System\shyRIdT.exe
  2⤵
  PID:3248
- C:\Windows\System\JfFMSeO.exe
  C:\Windows\System\JfFMSeO.exe
  2⤵
  PID:2744
- C:\Windows\System\pWHFGHb.exe
  C:\Windows\System\pWHFGHb.exe
  2⤵
  PID:9808
- C:\Windows\System\KmrbzDa.exe
  C:\Windows\System\KmrbzDa.exe
  2⤵
  PID:10420
- C:\Windows\System\CzdbiMv.exe
  C:\Windows\System\CzdbiMv.exe
  2⤵
  PID:10536
- C:\Windows\System\mKMXVWc.exe
  C:\Windows\System\mKMXVWc.exe
  2⤵
  PID:10332
- C:\Windows\System\gAsFBZc.exe
  C:\Windows\System\gAsFBZc.exe
  2⤵
  PID:10464
- C:\Windows\System\aMGRgNI.exe
  C:\Windows\System\aMGRgNI.exe
  2⤵
  PID:10628
- C:\Windows\System\oeQHfAp.exe
  C:\Windows\System\oeQHfAp.exe
  2⤵
  PID:10644
- C:\Windows\System\hnOANGz.exe
  C:\Windows\System\hnOANGz.exe
  2⤵
  PID:10744
- C:\Windows\System\fzRaaZt.exe
  C:\Windows\System\fzRaaZt.exe
  2⤵
  PID:10484
- C:\Windows\System\rgCsGSs.exe
  C:\Windows\System\rgCsGSs.exe
  2⤵
  PID:10592
- C:\Windows\System\MzWNGXC.exe
  C:\Windows\System\MzWNGXC.exe
  2⤵
  PID:2380
- C:\Windows\System\pNjIjqU.exe
  C:\Windows\System\pNjIjqU.exe
  2⤵
  PID:10964
- C:\Windows\System\hqKueix.exe
  C:\Windows\System\hqKueix.exe
  2⤵
  PID:10852
- C:\Windows\System\iqnofKi.exe
  C:\Windows\System\iqnofKi.exe
  2⤵
  PID:10924
- C:\Windows\System\ejenfEM.exe
  C:\Windows\System\ejenfEM.exe
  2⤵
  PID:10968
- C:\Windows\System\BIMSpxp.exe
  C:\Windows\System\BIMSpxp.exe
  2⤵
  PID:10328
- C:\Windows\System\uuaYZbv.exe
  C:\Windows\System\uuaYZbv.exe
  2⤵
  PID:10532
- C:\Windows\System\WinTdkU.exe
  C:\Windows\System\WinTdkU.exe
  2⤵
  PID:9052
- C:\Windows\System\vHAAgkk.exe
  C:\Windows\System\vHAAgkk.exe
  2⤵
  PID:10692
- C:\Windows\System\gDaWYDN.exe
  C:\Windows\System\gDaWYDN.exe
  2⤵
  PID:10276
- C:\Windows\System\bKKeDmQ.exe
  C:\Windows\System\bKKeDmQ.exe
  2⤵
  PID:11272
- C:\Windows\System\mAlxYsn.exe
  C:\Windows\System\mAlxYsn.exe
  2⤵
  PID:11368
- C:\Windows\System\eSiLCCX.exe
  C:\Windows\System\eSiLCCX.exe
  2⤵
  PID:11452
- C:\Windows\System\kspVIfg.exe
  C:\Windows\System\kspVIfg.exe
  2⤵
  PID:11476
- C:\Windows\System\FKOISZz.exe
  C:\Windows\System\FKOISZz.exe
  2⤵
  PID:11492
- C:\Windows\System\ISdLiyA.exe
  C:\Windows\System\ISdLiyA.exe
  2⤵
  PID:11508
- C:\Windows\System\InUHKop.exe
  C:\Windows\System\InUHKop.exe
  2⤵
  PID:11560
- C:\Windows\System\pzzOett.exe
  C:\Windows\System\pzzOett.exe
  2⤵
  PID:11576
- C:\Windows\System\CiRRtbj.exe
  C:\Windows\System\CiRRtbj.exe
  2⤵
  PID:11592
- C:\Windows\System\KdBUjFO.exe
  C:\Windows\System\KdBUjFO.exe
  2⤵
  PID:11608
- C:\Windows\System\Ashbcwp.exe
  C:\Windows\System\Ashbcwp.exe
  2⤵
  PID:11664
- C:\Windows\System\aQdhglj.exe
  C:\Windows\System\aQdhglj.exe
  2⤵
  PID:11704
- C:\Windows\System\hAcALgM.exe
  C:\Windows\System\hAcALgM.exe
  2⤵
  PID:11732
- C:\Windows\System\lDtNQWo.exe
  C:\Windows\System\lDtNQWo.exe
  2⤵
  PID:11752
- C:\Windows\System\yYdXxWV.exe
  C:\Windows\System\yYdXxWV.exe
  2⤵
  PID:11772
- C:\Windows\System\MupUfIG.exe
  C:\Windows\System\MupUfIG.exe
  2⤵
  PID:11792
- C:\Windows\System\mLOKrst.exe
  C:\Windows\System\mLOKrst.exe
  2⤵
  PID:11816
- C:\Windows\System\dUkvcIc.exe
  C:\Windows\System\dUkvcIc.exe
  2⤵
  PID:11836
- C:\Windows\System\opMYheT.exe
  C:\Windows\System\opMYheT.exe
  2⤵
  PID:11860
- C:\Windows\System\Owbpcas.exe
  C:\Windows\System\Owbpcas.exe
  2⤵
  PID:11876
- C:\Windows\System\ZzoCYng.exe
  C:\Windows\System\ZzoCYng.exe
  2⤵
  PID:11900
- C:\Windows\System\tIGQzgK.exe
  C:\Windows\System\tIGQzgK.exe
  2⤵
  PID:11932
- C:\Windows\System\tEXwEfh.exe
  C:\Windows\System\tEXwEfh.exe
  2⤵
  PID:11996
- C:\Windows\System\XRWlnKD.exe
  C:\Windows\System\XRWlnKD.exe
  2⤵
  PID:12012
- C:\Windows\System\lQDOmxn.exe
  C:\Windows\System\lQDOmxn.exe
  2⤵
  PID:12040
- C:\Windows\System\mhkaqnZ.exe
  C:\Windows\System\mhkaqnZ.exe
  2⤵
  PID:12064
- C:\Windows\System\RSccQja.exe
  C:\Windows\System\RSccQja.exe
  2⤵
  PID:12084
- C:\Windows\System\mVVlBZr.exe
  C:\Windows\System\mVVlBZr.exe
  2⤵
  PID:12112
- C:\Windows\System\NZVvdhy.exe
  C:\Windows\System\NZVvdhy.exe
  2⤵
  PID:12132
- C:\Windows\System\CTPkFdI.exe
  C:\Windows\System\CTPkFdI.exe
  2⤵
  PID:12152
- C:\Windows\System\rmbuQyh.exe
  C:\Windows\System\rmbuQyh.exe
  2⤵
  PID:12172
- C:\Windows\System\BZsMzzw.exe
  C:\Windows\System\BZsMzzw.exe
  2⤵
  PID:12192
- C:\Windows\System\RFVNLXR.exe
  C:\Windows\System\RFVNLXR.exe
  2⤵
  PID:12216
- C:\Windows\System\vFiJXxL.exe
  C:\Windows\System\vFiJXxL.exe
  2⤵
  PID:12232
- C:\Windows\System\vmssPeC.exe
  C:\Windows\System\vmssPeC.exe
  2⤵
  PID:12280
- C:\Windows\System\PQdcjrP.exe
  C:\Windows\System\PQdcjrP.exe
  2⤵
  PID:10520
- C:\Windows\System\EqlkwIK.exe
  C:\Windows\System\EqlkwIK.exe
  2⤵
  PID:11284
- C:\Windows\System\PWckYVk.exe
  C:\Windows\System\PWckYVk.exe
  2⤵
  PID:11312
- C:\Windows\System\tdrXeKn.exe
  C:\Windows\System\tdrXeKn.exe
  2⤵
  PID:3600
- C:\Windows\System\IFyOulh.exe
  C:\Windows\System\IFyOulh.exe
  2⤵
  PID:10888
- C:\Windows\System\RVuRoIV.exe
  C:\Windows\System\RVuRoIV.exe
  2⤵
  PID:11384
- C:\Windows\System\hmQNotL.exe
  C:\Windows\System\hmQNotL.exe
  2⤵
  PID:11392
- C:\Windows\System\uZvDjeb.exe
  C:\Windows\System\uZvDjeb.exe
  2⤵
  PID:11464
- C:\Windows\System\ijGxJOJ.exe
  C:\Windows\System\ijGxJOJ.exe
  2⤵
  PID:11500
- C:\Windows\System\XqkyATA.exe
  C:\Windows\System\XqkyATA.exe
  2⤵
  PID:11468
- C:\Windows\System\TLbaRey.exe
  C:\Windows\System\TLbaRey.exe
  2⤵
  PID:11504
- C:\Windows\System\TCXIMcd.exe
  C:\Windows\System\TCXIMcd.exe
  2⤵
  PID:12008
- C:\Windows\System\SUkihqJ.exe
  C:\Windows\System\SUkihqJ.exe
  2⤵
  PID:11360
- C:\Windows\System\LYlmNlT.exe
  C:\Windows\System\LYlmNlT.exe
  2⤵
  PID:12028
- C:\Windows\System\bchqbKU.exe
  C:\Windows\System\bchqbKU.exe
  2⤵
  PID:12184
- C:\Windows\System\YjQVmeF.exe
  C:\Windows\System\YjQVmeF.exe
  2⤵
  PID:12212
- C:\Windows\System\GiJDiOl.exe
  C:\Windows\System\GiJDiOl.exe
  2⤵
  PID:12108
- C:\Windows\System\kmhwNxW.exe
  C:\Windows\System\kmhwNxW.exe
  2⤵
  PID:12164
- C:\Windows\System\TcUjRxK.exe
  C:\Windows\System\TcUjRxK.exe
  2⤵
  PID:12092
- C:\Windows\System\KYuVTcK.exe
  C:\Windows\System\KYuVTcK.exe
  2⤵
  PID:10392
- C:\Windows\System\nydfDNb.exe
  C:\Windows\System\nydfDNb.exe
  2⤵
  PID:11472
- C:\Windows\System\TgYwiwJ.exe
  C:\Windows\System\TgYwiwJ.exe
  2⤵
  PID:11548
- C:\Windows\System\SNZydUd.exe
  C:\Windows\System\SNZydUd.exe
  2⤵
  PID:11672
- C:\Windows\System\IWrAuBV.exe
  C:\Windows\System\IWrAuBV.exe
  2⤵
  PID:11892
- C:\Windows\System\ciEFbJk.exe
  C:\Windows\System\ciEFbJk.exe
  2⤵
  PID:11336
- C:\Windows\System\GGRcuwP.exe
  C:\Windows\System\GGRcuwP.exe
  2⤵
  PID:11920
- C:\Windows\System\HmlhnJW.exe
  C:\Windows\System\HmlhnJW.exe
  2⤵
  PID:652
- C:\Windows\System\xVczfBJ.exe
  C:\Windows\System\xVczfBJ.exe
  2⤵
  PID:4076
- C:\Windows\System\jdSiXIW.exe
  C:\Windows\System\jdSiXIW.exe
  2⤵
  PID:3620
- C:\Windows\System\REjISiG.exe
  C:\Windows\System\REjISiG.exe
  2⤵
  PID:4264
- C:\Windows\System\kMukTMV.exe
  C:\Windows\System\kMukTMV.exe
  2⤵
  PID:2920
- C:\Windows\System\qKYtauw.exe
  C:\Windows\System\qKYtauw.exe
  2⤵
  PID:12240
- C:\Windows\System\mDeOaKs.exe
  C:\Windows\System\mDeOaKs.exe
  2⤵
  PID:11588
- C:\Windows\System\zLZkzKH.exe
  C:\Windows\System\zLZkzKH.exe
  2⤵
  PID:3900
- C:\Windows\System\dfGWLMB.exe
  C:\Windows\System\dfGWLMB.exe
  2⤵
  PID:3304
- C:\Windows\System\kGnWGnJ.exe
  C:\Windows\System\kGnWGnJ.exe
  2⤵
  PID:460
- C:\Windows\System\oyjJTlX.exe
  C:\Windows\System\oyjJTlX.exe
  2⤵
  PID:12304
- C:\Windows\System\RABYHgZ.exe
  C:\Windows\System\RABYHgZ.exe
  2⤵
  PID:12324
- C:\Windows\System\ladBSWg.exe
  C:\Windows\System\ladBSWg.exe
  2⤵
  PID:12340
- C:\Windows\System\bDshJYk.exe
  C:\Windows\System\bDshJYk.exe
  2⤵
  PID:12360
- C:\Windows\System\hJDcqrQ.exe
  C:\Windows\System\hJDcqrQ.exe
  2⤵
  PID:12380
- C:\Windows\System\IUkxIpZ.exe
  C:\Windows\System\IUkxIpZ.exe
  2⤵
  PID:12404
- C:\Windows\System\MJSCOaS.exe
  C:\Windows\System\MJSCOaS.exe
  2⤵
  PID:12432
- C:\Windows\System\PGBrQxS.exe
  C:\Windows\System\PGBrQxS.exe
  2⤵
  PID:12468
- C:\Windows\System\QKcKIaG.exe
  C:\Windows\System\QKcKIaG.exe
  2⤵
  PID:12484
- C:\Windows\System\EsMoeqN.exe
  C:\Windows\System\EsMoeqN.exe
  2⤵
  PID:12508
- C:\Windows\System\UgXltOp.exe
  C:\Windows\System\UgXltOp.exe
  2⤵
  PID:12576
- C:\Windows\System\emNYreQ.exe
  C:\Windows\System\emNYreQ.exe
  2⤵
  PID:12608
- C:\Windows\System\LNtQehp.exe
  C:\Windows\System\LNtQehp.exe
  2⤵
  PID:12624
- C:\Windows\System\BUqqtao.exe
  C:\Windows\System\BUqqtao.exe
  2⤵
  PID:12728
- C:\Windows\System\ijHaMzj.exe
  C:\Windows\System\ijHaMzj.exe
  2⤵
  PID:12752
- C:\Windows\System\spzsACO.exe
  C:\Windows\System\spzsACO.exe
  2⤵
  PID:12772
- C:\Windows\System\liUaJmr.exe
  C:\Windows\System\liUaJmr.exe
  2⤵
  PID:12796
- C:\Windows\System\cBwjsvb.exe
  C:\Windows\System\cBwjsvb.exe
  2⤵
  PID:12816
- C:\Windows\System\ZWscwfn.exe
  C:\Windows\System\ZWscwfn.exe
  2⤵
  PID:12836
- C:\Windows\System\XITQxVm.exe
  C:\Windows\System\XITQxVm.exe
  2⤵
  PID:12852
- C:\Windows\System\oLcVPqP.exe
  C:\Windows\System\oLcVPqP.exe
  2⤵
  PID:12984
- C:\Windows\System\lWCoaMK.exe
  C:\Windows\System\lWCoaMK.exe
  2⤵
  PID:13264
- C:\Windows\System\HeJCEmF.exe
  C:\Windows\System\HeJCEmF.exe
  2⤵
  PID:13300
- C:\Windows\System\KuEribc.exe
  C:\Windows\System\KuEribc.exe
  2⤵
  PID:12076
- C:\Windows\System\cKfJoQt.exe
  C:\Windows\System\cKfJoQt.exe
  2⤵
  PID:960
- C:\Windows\System\owtoGgv.exe
  C:\Windows\System\owtoGgv.exe
  2⤵
  PID:11700
- C:\Windows\System\sFuakoU.exe
  C:\Windows\System\sFuakoU.exe
  2⤵
  PID:4056
- C:\Windows\System\PeFmllF.exe
  C:\Windows\System\PeFmllF.exe
  2⤵
  PID:1708
- C:\Windows\System\IBmjmMd.exe
  C:\Windows\System\IBmjmMd.exe
  2⤵
  PID:12448
- C:\Windows\System\wmUknAv.exe
  C:\Windows\System\wmUknAv.exe
  2⤵
  PID:11640
- C:\Windows\System\LAuieEw.exe
  C:\Windows\System\LAuieEw.exe
  2⤵
  PID:4468
- C:\Windows\System\DeGULGn.exe
  C:\Windows\System\DeGULGn.exe
  2⤵
  PID:12548
- C:\Windows\System\yXrJJiA.exe
  C:\Windows\System\yXrJJiA.exe
  2⤵
  PID:5208
- C:\Windows\System\HELSgjm.exe
  C:\Windows\System\HELSgjm.exe
  2⤵
  PID:1256
- C:\Windows\System\KTtsQTt.exe
  C:\Windows\System\KTtsQTt.exe
  2⤵
  PID:12312
- C:\Windows\System\ZWevHRT.exe
  C:\Windows\System\ZWevHRT.exe
  2⤵
  PID:12348
- C:\Windows\System\UFxCXkx.exe
  C:\Windows\System\UFxCXkx.exe
  2⤵
  PID:12376
- C:\Windows\System\VklDFFU.exe
  C:\Windows\System\VklDFFU.exe
  2⤵
  PID:12544
- C:\Windows\System\NHYrkvz.exe
  C:\Windows\System\NHYrkvz.exe
  2⤵
  PID:12444
- C:\Windows\System\FkKekUi.exe
  C:\Windows\System\FkKekUi.exe
  2⤵
  PID:2472
- C:\Windows\System\sUlqrag.exe
  C:\Windows\System\sUlqrag.exe
  2⤵
  PID:12588
- C:\Windows\System\EBSLXap.exe
  C:\Windows\System\EBSLXap.exe
  2⤵
  PID:12636
- C:\Windows\System\aEYqBax.exe
  C:\Windows\System\aEYqBax.exe
  2⤵
  PID:12492
- C:\Windows\System\YIFFXoM.exe
  C:\Windows\System\YIFFXoM.exe
  2⤵
  PID:12560
- C:\Windows\System\KcGUiSU.exe
  C:\Windows\System\KcGUiSU.exe
  2⤵
  PID:12924
- C:\Windows\System\NeMXVOV.exe
  C:\Windows\System\NeMXVOV.exe
  2⤵
  PID:12632
- C:\Windows\System\hNdGDAq.exe
  C:\Windows\System\hNdGDAq.exe
  2⤵
  PID:5468
- C:\Windows\System\VlwMNLt.exe
  C:\Windows\System\VlwMNLt.exe
  2⤵
  PID:12848
- C:\Windows\System\vhGnDWp.exe
  C:\Windows\System\vhGnDWp.exe
  2⤵
  PID:12744
- C:\Windows\System\YCijnJN.exe
  C:\Windows\System\YCijnJN.exe
  2⤵
  PID:12688
- C:\Windows\System\ytDuumw.exe
  C:\Windows\System\ytDuumw.exe
  2⤵
  PID:5144
- C:\Windows\System\xYVVzTx.exe
  C:\Windows\System\xYVVzTx.exe
  2⤵
  PID:13084
- C:\Windows\System\TApYlrG.exe
  C:\Windows\System\TApYlrG.exe
  2⤵
  PID:12464
- C:\Windows\System\fjwatWb.exe
  C:\Windows\System\fjwatWb.exe
  2⤵
  PID:3672
- C:\Windows\System\IYmxolv.exe
  C:\Windows\System\IYmxolv.exe
  2⤵
  PID:11972
- C:\Windows\System\zjgZcQo.exe
  C:\Windows\System\zjgZcQo.exe
  2⤵
  PID:5328
- C:\Windows\System\VhlfZtH.exe
  C:\Windows\System\VhlfZtH.exe
  2⤵
  PID:4332
- C:\Windows\System\OEqgwVp.exe
  C:\Windows\System\OEqgwVp.exe
  2⤵
  PID:4304
- C:\Windows\System\NfZIBFI.exe
  C:\Windows\System\NfZIBFI.exe
  2⤵
  PID:13280
- C:\Windows\System\OltqsfO.exe
  C:\Windows\System\OltqsfO.exe
  2⤵
  PID:5548
- C:\Windows\System\sklOnOF.exe
  C:\Windows\System\sklOnOF.exe
  2⤵
  PID:3280
- C:\Windows\System\cEWYyQJ.exe
  C:\Windows\System\cEWYyQJ.exe
  2⤵
  PID:12480
- C:\Windows\System\ljTZuOK.exe
  C:\Windows\System\ljTZuOK.exe
  2⤵
  PID:12540
- C:\Windows\System\ltOUQGH.exe
  C:\Windows\System\ltOUQGH.exe
  2⤵
  PID:12568
- C:\Windows\System\jAqMcFa.exe
  C:\Windows\System\jAqMcFa.exe
  2⤵
  PID:6116
- C:\Windows\System\alTNQqP.exe
  C:\Windows\System\alTNQqP.exe
  2⤵
  PID:12780
- C:\Windows\System\vnirQfd.exe
  C:\Windows\System\vnirQfd.exe
  2⤵
  PID:4544
- C:\Windows\System\XPKxsVG.exe
  C:\Windows\System\XPKxsVG.exe
  2⤵
  PID:1632
- C:\Windows\System\uqrrGNm.exe
  C:\Windows\System\uqrrGNm.exe
  2⤵
  PID:4524
- C:\Windows\System\tgPPxws.exe
  C:\Windows\System\tgPPxws.exe
  2⤵
  PID:12832
- C:\Windows\System\cZKXAdl.exe
  C:\Windows\System\cZKXAdl.exe
  2⤵
  PID:12804
- C:\Windows\System\bOklxtS.exe
  C:\Windows\System\bOklxtS.exe
  2⤵
  PID:1976
- C:\Windows\System\txtpLWG.exe
  C:\Windows\System\txtpLWG.exe
  2⤵
  PID:4324
- C:\Windows\System\AQPNruJ.exe
  C:\Windows\System\AQPNruJ.exe
  2⤵
  PID:848
- C:\Windows\System\zuadDjn.exe
  C:\Windows\System\zuadDjn.exe
  2⤵
  PID:4356
- C:\Windows\System\UOTqEzD.exe
  C:\Windows\System\UOTqEzD.exe
  2⤵
  PID:4864
- C:\Windows\System\JWbqSxf.exe
  C:\Windows\System\JWbqSxf.exe
  2⤵
  PID:5480
- C:\Windows\System\cKIqyaC.exe
  C:\Windows\System\cKIqyaC.exe
  2⤵
  PID:12428
- C:\Windows\System\BGcSTuV.exe
  C:\Windows\System\BGcSTuV.exe
  2⤵
  PID:12868
- C:\Windows\System\jnJWdGc.exe
  C:\Windows\System\jnJWdGc.exe
  2⤵
  PID:4952
- C:\Windows\System\lxTQNWt.exe
  C:\Windows\System\lxTQNWt.exe
  2⤵
  PID:5260
- C:\Windows\System\SlHNaXc.exe
  C:\Windows\System\SlHNaXc.exe
  2⤵
  PID:12892
- C:\Windows\System\LAKkItf.exe
  C:\Windows\System\LAKkItf.exe
  2⤵
  PID:12640
- C:\Windows\System\bztaMMJ.exe
  C:\Windows\System\bztaMMJ.exe
  2⤵
  PID:3372
- C:\Windows\System\DgCbenz.exe
  C:\Windows\System\DgCbenz.exe
  2⤵
  PID:2240
- C:\Windows\System\WEqSyjJ.exe
  C:\Windows\System\WEqSyjJ.exe
  2⤵
  PID:12700
- C:\Windows\System\jntJDmP.exe
  C:\Windows\System\jntJDmP.exe
  2⤵
  PID:7456
- C:\Windows\System\nuUQjZr.exe
  C:\Windows\System\nuUQjZr.exe
  2⤵
  PID:12520
- C:\Windows\System\JnEVkZj.exe
  C:\Windows\System\JnEVkZj.exe
  2⤵
  PID:2176
- C:\Windows\System\dtmLNIK.exe
  C:\Windows\System\dtmLNIK.exe
  2⤵
  PID:12396
- C:\Windows\System\cgpwkXx.exe
  C:\Windows\System\cgpwkXx.exe
  2⤵
  PID:11660
- C:\Windows\System\vzApZfw.exe
  C:\Windows\System\vzApZfw.exe
  2⤵
  PID:12208
- C:\Windows\System\KgwoEHH.exe
  C:\Windows\System\KgwoEHH.exe
  2⤵
  PID:3560
- C:\Windows\System\dIPAFMz.exe
  C:\Windows\System\dIPAFMz.exe
  2⤵
  PID:4960
- C:\Windows\System\SaYXtAa.exe
  C:\Windows\System\SaYXtAa.exe
  2⤵
  PID:1760
- C:\Windows\System\mjhPCqu.exe
  C:\Windows\System\mjhPCqu.exe
  2⤵
  PID:3104
- C:\Windows\System\izAURRw.exe
  C:\Windows\System\izAURRw.exe
  2⤵
  PID:12664
- C:\Windows\System\TgCQOef.exe
  C:\Windows\System\TgCQOef.exe
  2⤵
  PID:3904
- C:\Windows\System\ZVOYqjB.exe
  C:\Windows\System\ZVOYqjB.exe
  2⤵
  PID:5356
- C:\Windows\System\NvplFxm.exe
  C:\Windows\System\NvplFxm.exe
  2⤵
  PID:12440
- C:\Windows\System\FsRYAEY.exe
  C:\Windows\System\FsRYAEY.exe
  2⤵
  PID:2192
- C:\Windows\System\rluSlvH.exe
  C:\Windows\System\rluSlvH.exe
  2⤵
  PID:5664
- C:\Windows\System\zJENhrK.exe
  C:\Windows\System\zJENhrK.exe
  2⤵
  PID:4208
- C:\Windows\System\RgoXCpo.exe
  C:\Windows\System\RgoXCpo.exe
  2⤵
  PID:868
- C:\Windows\System\WjUuXSa.exe
  C:\Windows\System\WjUuXSa.exe
  2⤵
  PID:1012
- C:\Windows\System\GZagLOY.exe
  C:\Windows\System\GZagLOY.exe
  2⤵
  PID:3076
- C:\Windows\System\LAPxRKj.exe
  C:\Windows\System\LAPxRKj.exe
  2⤵
  PID:12696
- C:\Windows\System\grkgrxv.exe
  C:\Windows\System\grkgrxv.exe
  2⤵
  PID:5324
- C:\Windows\System\CHVdqor.exe
  C:\Windows\System\CHVdqor.exe
  2⤵
  PID:12460
- C:\Windows\System\txyIZHG.exe
  C:\Windows\System\txyIZHG.exe
  2⤵
  PID:4536
- C:\Windows\System\pNeveRN.exe
  C:\Windows\System\pNeveRN.exe
  2⤵
  PID:3292
- C:\Windows\System\nQPZVCn.exe
  C:\Windows\System\nQPZVCn.exe
  2⤵
  PID:13080
- C:\Windows\System\RTYoaGU.exe
  C:\Windows\System\RTYoaGU.exe
  2⤵
  PID:452
- C:\Windows\System\nJyUqPZ.exe
  C:\Windows\System\nJyUqPZ.exe
  2⤵
  PID:5132
- C:\Windows\System\AoBxkBB.exe
  C:\Windows\System\AoBxkBB.exe
  2⤵
  PID:13316
- C:\Windows\System\KbchnvL.exe
  C:\Windows\System\KbchnvL.exe
  2⤵
  PID:13332
- C:\Windows\System\xWCKvSS.exe
  C:\Windows\System\xWCKvSS.exe
  2⤵
  PID:13376
- C:\Windows\System\sPqBeYR.exe
  C:\Windows\System\sPqBeYR.exe
  2⤵
  PID:13412
- C:\Windows\System\RtymVgP.exe
  C:\Windows\System\RtymVgP.exe
  2⤵
  PID:13440
- C:\Windows\System\jmfgjgn.exe
  C:\Windows\System\jmfgjgn.exe
  2⤵
  PID:13456
- C:\Windows\System\lDuTuId.exe
  C:\Windows\System\lDuTuId.exe
  2⤵
  PID:13648
- C:\Windows\System\nCZBAQG.exe
  C:\Windows\System\nCZBAQG.exe
  2⤵
  PID:13672
- C:\Windows\System\VDKazBT.exe
  C:\Windows\System\VDKazBT.exe
  2⤵
  PID:13732
- C:\Windows\System\QpdSayt.exe
  C:\Windows\System\QpdSayt.exe
  2⤵
  PID:13752
- C:\Windows\System\ErqZrnm.exe
  C:\Windows\System\ErqZrnm.exe
  2⤵
  PID:13852
- C:\Windows\System\NPDZklU.exe
  C:\Windows\System\NPDZklU.exe
  2⤵
  PID:13992
- C:\Windows\System\KNUuWSL.exe
  C:\Windows\System\KNUuWSL.exe
  2⤵
  PID:14100
- C:\Windows\System\RauldVz.exe
  C:\Windows\System\RauldVz.exe
  2⤵
  PID:14128
- C:\Windows\System\xcHdKTn.exe
  C:\Windows\System\xcHdKTn.exe
  2⤵
  PID:14160
- C:\Windows\System\yGWYBBI.exe
  C:\Windows\System\yGWYBBI.exe
  2⤵
  PID:14184
- C:\Windows\System\cAjjiXB.exe
  C:\Windows\System\cAjjiXB.exe
  2⤵
  PID:14208
- C:\Windows\System\YChLylA.exe
  C:\Windows\System\YChLylA.exe
  2⤵
  PID:14228
- C:\Windows\System\mrwAuTJ.exe
  C:\Windows\System\mrwAuTJ.exe
  2⤵
  PID:14264
- C:\Windows\System\UzVokzN.exe
  C:\Windows\System\UzVokzN.exe
  2⤵
  PID:14284
- C:\Windows\System\vGOHBGa.exe
  C:\Windows\System\vGOHBGa.exe
  2⤵
  PID:14324
- C:\Windows\System\tPQxzNu.exe
  C:\Windows\System\tPQxzNu.exe
  2⤵
  PID:12372
- C:\Windows\System\PifWUam.exe
  C:\Windows\System\PifWUam.exe
  2⤵
  PID:13436
- C:\Windows\System\jhgPHoj.exe
  C:\Windows\System\jhgPHoj.exe
  2⤵
  PID:3216
- C:\Windows\System\CPZKnLq.exe
  C:\Windows\System\CPZKnLq.exe
  2⤵
  PID:13352
- C:\Windows\System\hPXPqbx.exe
  C:\Windows\System\hPXPqbx.exe
  2⤵
  PID:13372
- C:\Windows\System\iHoRRGp.exe
  C:\Windows\System\iHoRRGp.exe
  2⤵
  PID:5940
- C:\Windows\System\uWtLmIS.exe
  C:\Windows\System\uWtLmIS.exe
  2⤵
  PID:13928
- C:\Windows\System\MVbgJni.exe
  C:\Windows\System\MVbgJni.exe
  2⤵
  PID:14040
- C:\Windows\System\FjzTYEt.exe
  C:\Windows\System\FjzTYEt.exe
  2⤵
  PID:100
- C:\Windows\System\bNxPtBA.exe
  C:\Windows\System\bNxPtBA.exe
  2⤵
  PID:13828
- C:\Windows\System\ZWJAJaA.exe
  C:\Windows\System\ZWJAJaA.exe
  2⤵
  PID:13880
- C:\Windows\System\qlAaoPL.exe
  C:\Windows\System\qlAaoPL.exe
  2⤵
  PID:14240
- C:\Windows\System\RNbDbeF.exe
  C:\Windows\System\RNbDbeF.exe
  2⤵
  PID:14060
- C:\Windows\System\KmzMQJL.exe
  C:\Windows\System\KmzMQJL.exe
  2⤵
  PID:13588
- C:\Windows\System\witIiBR.exe
  C:\Windows\System\witIiBR.exe
  2⤵
  PID:4988
- C:\Windows\System\ENSJHnw.exe
  C:\Windows\System\ENSJHnw.exe
  2⤵
  PID:5968
- C:\Windows\System\MMOFzLY.exe
  C:\Windows\System\MMOFzLY.exe
  2⤵
  PID:2652
- C:\Windows\System\QtYGYAW.exe
  C:\Windows\System\QtYGYAW.exe
  2⤵
  PID:14316
- C:\Windows\System\ZIvinPH.exe
  C:\Windows\System\ZIvinPH.exe
  2⤵
  PID:14272
- C:\Windows\System\EBTvJtl.exe
  C:\Windows\System\EBTvJtl.exe
  2⤵
  PID:14244
- C:\Windows\System\wLLzycZ.exe
  C:\Windows\System\wLLzycZ.exe
  2⤵
  PID:14216
- C:\Windows\System\IRNkQpT.exe
  C:\Windows\System\IRNkQpT.exe
  2⤵
  PID:14152
- C:\Windows\System\djjVQNW.exe
  C:\Windows\System\djjVQNW.exe
  2⤵
  PID:14116
- C:\Windows\System\gjwFosb.exe
  C:\Windows\System\gjwFosb.exe
  2⤵
  PID:6388
- C:\Windows\System\PqmpCbY.exe
  C:\Windows\System\PqmpCbY.exe
  2⤵
  PID:13568
- C:\Windows\System\jOkecVF.exe
  C:\Windows\System\jOkecVF.exe
  2⤵
  PID:13644
- C:\Windows\System\JicEOrZ.exe
  C:\Windows\System\JicEOrZ.exe
  2⤵
  PID:6320
- C:\Windows\System\cAlboYB.exe
  C:\Windows\System\cAlboYB.exe
  2⤵
  PID:5628
- C:\Windows\System\YJmUTZd.exe
  C:\Windows\System\YJmUTZd.exe
  2⤵
  PID:6132
- C:\Windows\System\orzcgma.exe
  C:\Windows\System\orzcgma.exe
  2⤵
  PID:5932
- C:\Windows\System\TRtxiRS.exe
  C:\Windows\System\TRtxiRS.exe
  2⤵
  PID:13696
- C:\Windows\System\nhyahRf.exe
  C:\Windows\System\nhyahRf.exe
  2⤵
  PID:13424
- C:\Windows\System\RIoHWCb.exe
  C:\Windows\System\RIoHWCb.exe
  2⤵
  PID:6616
- C:\Windows\System\XebKnaB.exe
  C:\Windows\System\XebKnaB.exe
  2⤵
  PID:6036
- C:\Windows\System\ETEsXtf.exe
  C:\Windows\System\ETEsXtf.exe
  2⤵
  PID:9792
- C:\Windows\System\RZKCndZ.exe
  C:\Windows\System\RZKCndZ.exe
  2⤵
  PID:6084
- C:\Windows\System\QlQpIln.exe
  C:\Windows\System\QlQpIln.exe
  2⤵
  PID:1092
- C:\Windows\System\NmXIpGw.exe
  C:\Windows\System\NmXIpGw.exe
  2⤵
  PID:13776
- C:\Windows\System\wwADMoJ.exe
  C:\Windows\System\wwADMoJ.exe
  2⤵
  PID:6164
- C:\Windows\System\nrwbzvN.exe
  C:\Windows\System\nrwbzvN.exe
  2⤵
  PID:13788
- C:\Windows\System\lulgPTp.exe
  C:\Windows\System\lulgPTp.exe
  2⤵
  PID:13748
- C:\Windows\System\nhsbgJe.exe
  C:\Windows\System\nhsbgJe.exe
  2⤵
  PID:13980
- C:\Windows\System\HqPEjBD.exe
  C:\Windows\System\HqPEjBD.exe
  2⤵
  PID:6168
- C:\Windows\System\mcyIPWk.exe
  C:\Windows\System\mcyIPWk.exe
  2⤵
  PID:7016
- C:\Windows\System\hPDEnci.exe
  C:\Windows\System\hPDEnci.exe
  2⤵
  PID:6732
- C:\Windows\System\ITPDWbq.exe
  C:\Windows\System\ITPDWbq.exe
  2⤵
  PID:2672
- C:\Windows\System\oOjPnCw.exe
  C:\Windows\System\oOjPnCw.exe
  2⤵
  PID:6840
- C:\Windows\System\UrnQNNd.exe
  C:\Windows\System\UrnQNNd.exe
  2⤵
  PID:7084
- C:\Windows\System\FvORgoT.exe
  C:\Windows\System\FvORgoT.exe
  2⤵
  PID:5560
- C:\Windows\System\CjiydJE.exe
  C:\Windows\System\CjiydJE.exe
  2⤵
  PID:6236
- C:\Windows\System\wGbApFH.exe
  C:\Windows\System\wGbApFH.exe
  2⤵
  PID:1700
- C:\Windows\System\obWeBEI.exe
  C:\Windows\System\obWeBEI.exe
  2⤵
  PID:6076
- C:\Windows\System\FmqVnjO.exe
  C:\Windows\System\FmqVnjO.exe
  2⤵
  PID:6964
- C:\Windows\System\tVZBGRe.exe
  C:\Windows\System\tVZBGRe.exe
  2⤵
  PID:6248
- C:\Windows\System\XsyUHzE.exe
  C:\Windows\System\XsyUHzE.exe
  2⤵
  PID:6716
- C:\Windows\System\FUysJrp.exe
  C:\Windows\System\FUysJrp.exe
  2⤵
  PID:6324
- C:\Windows\System\vgpctFk.exe
  C:\Windows\System\vgpctFk.exe
  2⤵
  PID:6148
- C:\Windows\System\VAxqdWX.exe
  C:\Windows\System\VAxqdWX.exe
  2⤵
  PID:6492
- C:\Windows\System\MjxnVCo.exe
  C:\Windows\System\MjxnVCo.exe
  2⤵
  PID:6960
- C:\Windows\System\hXABtGe.exe
  C:\Windows\System\hXABtGe.exe
  2⤵
  PID:14156
- C:\Windows\System\lRWEgUo.exe
  C:\Windows\System\lRWEgUo.exe
  2⤵
  PID:6216
- C:\Windows\System\XeZJGrB.exe
  C:\Windows\System\XeZJGrB.exe
  2⤵
  PID:7684
- C:\Windows\System\yYuwSFL.exe
  C:\Windows\System\yYuwSFL.exe
  2⤵
  PID:6516
- C:\Windows\System\YUBcwXa.exe
  C:\Windows\System\YUBcwXa.exe
  2⤵
  PID:7112
- C:\Windows\System\ACEcmFr.exe
  C:\Windows\System\ACEcmFr.exe
  2⤵
  PID:7472
- C:\Windows\System\MqwAIcB.exe
  C:\Windows\System\MqwAIcB.exe
  2⤵
  PID:7624
- C:\Windows\System\NJXlrxY.exe
  C:\Windows\System\NJXlrxY.exe
  2⤵
  PID:7668
- C:\Windows\System\veTwtRI.exe
  C:\Windows\System\veTwtRI.exe
  2⤵
  PID:7536
- C:\Windows\System\ZdTtRrT.exe
  C:\Windows\System\ZdTtRrT.exe
  2⤵
  PID:5976
- C:\Windows\System\mnxVclL.exe
  C:\Windows\System\mnxVclL.exe
  2⤵
  PID:6676
- C:\Windows\System\vdJXmwv.exe
  C:\Windows\System\vdJXmwv.exe
  2⤵
  PID:13540
- C:\Windows\System\ABUaEKP.exe
  C:\Windows\System\ABUaEKP.exe
  2⤵
  PID:5572
- C:\Windows\System\waNIlmw.exe
  C:\Windows\System\waNIlmw.exe
  2⤵
  PID:6012
- C:\Windows\System\tFmsiGH.exe
  C:\Windows\System\tFmsiGH.exe
  2⤵
  PID:7380
- C:\Windows\System\XEgPlYw.exe
  C:\Windows\System\XEgPlYw.exe
  2⤵
  PID:6456
- C:\Windows\System\OPIwvcV.exe
  C:\Windows\System\OPIwvcV.exe
  2⤵
  PID:7184
- C:\Windows\System\JVOAIEO.exe
  C:\Windows\System\JVOAIEO.exe
  2⤵
  PID:14292
- C:\Windows\System\ylJmEFt.exe
  C:\Windows\System\ylJmEFt.exe
  2⤵
  PID:7744
- C:\Windows\System\TyILfFH.exe
  C:\Windows\System\TyILfFH.exe
  2⤵
  PID:7052
- C:\Windows\System\LTCaynq.exe
  C:\Windows\System\LTCaynq.exe
  2⤵
  PID:13476
- C:\Windows\System\VHwXZoL.exe
  C:\Windows\System\VHwXZoL.exe
  2⤵
  PID:8000
- C:\Windows\System\asFBcnI.exe
  C:\Windows\System\asFBcnI.exe
  2⤵
  PID:6512
- C:\Windows\System\gPTUMZi.exe
  C:\Windows\System\gPTUMZi.exe
  2⤵
  PID:6544
- C:\Windows\System\ATpAueI.exe
  C:\Windows\System\ATpAueI.exe
  2⤵
  PID:7596
- C:\Windows\System\NxUoHbi.exe
  C:\Windows\System\NxUoHbi.exe
  2⤵
  PID:7276
- C:\Windows\System\RqnpYLr.exe
  C:\Windows\System\RqnpYLr.exe
  2⤵
  PID:6940
- C:\Windows\System\JudKzbG.exe
  C:\Windows\System\JudKzbG.exe
  2⤵
  PID:7108
- C:\Windows\System\XBrIXDH.exe
  C:\Windows\System\XBrIXDH.exe
  2⤵
  PID:7740
- C:\Windows\System\BCoNaRe.exe
  C:\Windows\System\BCoNaRe.exe
  2⤵
  PID:7844
- C:\Windows\System\fwGcPrq.exe
  C:\Windows\System\fwGcPrq.exe
  2⤵
  PID:7224
- C:\Windows\System\cTiheDp.exe
  C:\Windows\System\cTiheDp.exe
  2⤵
  PID:5692
- C:\Windows\System\EUMIFhw.exe
  C:\Windows\System\EUMIFhw.exe
  2⤵
  PID:13288
- C:\Windows\System\LELmLwF.exe
  C:\Windows\System\LELmLwF.exe
  2⤵
  PID:412
- C:\Windows\System\XqnVzyC.exe
  C:\Windows\System\XqnVzyC.exe
  2⤵
  PID:7444
- C:\Windows\System\KtEPjQI.exe
  C:\Windows\System\KtEPjQI.exe
  2⤵
  PID:7656
- C:\Windows\System\TGFYMnG.exe
  C:\Windows\System\TGFYMnG.exe
  2⤵
  PID:14280
- C:\Windows\System\Hzzqutr.exe
  C:\Windows\System\Hzzqutr.exe
  2⤵
  PID:1052
- C:\Windows\System\qOZMVcU.exe
  C:\Windows\System\qOZMVcU.exe
  2⤵
  PID:13708
- C:\Windows\System\IXEUuGD.exe
  C:\Windows\System\IXEUuGD.exe
  2⤵
  PID:6984
- C:\Windows\System\bqiwnaK.exe
  C:\Windows\System\bqiwnaK.exe
  2⤵
  PID:6924
- C:\Windows\System\XhOToZf.exe
  C:\Windows\System\XhOToZf.exe
  2⤵
  PID:5236
- C:\Windows\System\rLCkAqV.exe
  C:\Windows\System\rLCkAqV.exe
  2⤵
  PID:7816
- C:\Windows\System\RsvzByC.exe
  C:\Windows\System\RsvzByC.exe
  2⤵
  PID:7220
- C:\Windows\System\zlEcQci.exe
  C:\Windows\System\zlEcQci.exe
  2⤵
  PID:6156
- C:\Windows\System\yYPwziv.exe
  C:\Windows\System\yYPwziv.exe
  2⤵
  PID:7760
- C:\Windows\System\vwZHnty.exe
  C:\Windows\System\vwZHnty.exe
  2⤵
  PID:7828
- C:\Windows\System\EQbDmgc.exe
  C:\Windows\System\EQbDmgc.exe
  2⤵
  PID:8188
- C:\Windows\System\lmkLANN.exe
  C:\Windows\System\lmkLANN.exe
  2⤵
  PID:8956
- C:\Windows\System\NYAOBHO.exe
  C:\Windows\System\NYAOBHO.exe
  2⤵
  PID:14248
- C:\Windows\System\XlGRlzT.exe
  C:\Windows\System\XlGRlzT.exe
  2⤵
  PID:8112
- C:\Windows\System\NMTRTds.exe
  C:\Windows\System\NMTRTds.exe
  2⤵
  PID:8152
- C:\Windows\System\CwrBTFu.exe
  C:\Windows\System\CwrBTFu.exe
  2⤵
  PID:4012
- C:\Windows\System\TwUwZfu.exe
  C:\Windows\System\TwUwZfu.exe
  2⤵
  PID:14080
- C:\Windows\System\rjGWqFB.exe
  C:\Windows\System\rjGWqFB.exe
  2⤵
  PID:14028
- C:\Windows\System\MDeIjbB.exe
  C:\Windows\System\MDeIjbB.exe
  2⤵
  PID:7044
- C:\Windows\System\CBIGpNY.exe
  C:\Windows\System\CBIGpNY.exe
  2⤵
  PID:13848
- C:\Windows\System\PCrtPNd.exe
  C:\Windows\System\PCrtPNd.exe
  2⤵
  PID:8660
- C:\Windows\System\DUXdttH.exe
  C:\Windows\System\DUXdttH.exe
  2⤵
  PID:7884
- C:\Windows\System\crfykDv.exe
  C:\Windows\System\crfykDv.exe
  2⤵
  PID:6000
- C:\Windows\System\FgooyVd.exe
  C:\Windows\System\FgooyVd.exe
  2⤵
  PID:8476
- C:\Windows\System\oDdYRPM.exe
  C:\Windows\System\oDdYRPM.exe
  2⤵
  PID:2296
- C:\Windows\System\fyHnvHp.exe
  C:\Windows\System\fyHnvHp.exe
  2⤵
  PID:13884
- C:\Windows\System\JLRkNme.exe
  C:\Windows\System\JLRkNme.exe
  2⤵
  PID:7544
- C:\Windows\System\knhMDhf.exe
  C:\Windows\System\knhMDhf.exe
  2⤵
  PID:12004
- C:\Windows\System\YlNslNo.exe
  C:\Windows\System\YlNslNo.exe
  2⤵
  PID:8140
- C:\Windows\System\JpKqVno.exe
  C:\Windows\System\JpKqVno.exe
  2⤵
  PID:7892
- C:\Windows\System\CvhxGfG.exe
  C:\Windows\System\CvhxGfG.exe
  2⤵
  PID:7008
- C:\Windows\System\qkqOjFi.exe
  C:\Windows\System\qkqOjFi.exe
  2⤵
  PID:1488
- C:\Windows\System\LySCUDk.exe
  C:\Windows\System\LySCUDk.exe
  2⤵
  PID:14348
- C:\Windows\System\LfgDabn.exe
  C:\Windows\System\LfgDabn.exe
  2⤵
  PID:14376
- C:\Windows\System\uerjDVc.exe
  C:\Windows\System\uerjDVc.exe
  2⤵
  PID:14396
- C:\Windows\System\XRChLSS.exe
  C:\Windows\System\XRChLSS.exe
  2⤵
  PID:14428
- C:\Windows\System\irpGsDf.exe
  C:\Windows\System\irpGsDf.exe
  2⤵
  PID:14448
- C:\Windows\System\FlvPpIs.exe
  C:\Windows\System\FlvPpIs.exe
  2⤵
  PID:14464
- C:\Windows\System\hCmcXYW.exe
  C:\Windows\System\hCmcXYW.exe
  2⤵
  PID:14484
- C:\Windows\System\ZhfkOqA.exe
  C:\Windows\System\ZhfkOqA.exe
  2⤵
  PID:14504
- C:\Windows\System\BclllWh.exe
  C:\Windows\System\BclllWh.exe
  2⤵
  PID:14524
- C:\Windows\System\XWHcIug.exe
  C:\Windows\System\XWHcIug.exe
  2⤵
  PID:14556
- C:\Windows\System\LGZbcro.exe
  C:\Windows\System\LGZbcro.exe
  2⤵
  PID:14580
- C:\Windows\System\UivQspp.exe
  C:\Windows\System\UivQspp.exe
  2⤵
  PID:14608
- C:\Windows\System\ZeJKmly.exe
  C:\Windows\System\ZeJKmly.exe
  2⤵
  PID:14624
- C:\Windows\System\cbSwjmP.exe
  C:\Windows\System\cbSwjmP.exe
  2⤵
  PID:14644
- C:\Windows\System\OyYgOEr.exe
  C:\Windows\System\OyYgOEr.exe
  2⤵
  PID:14664
- C:\Windows\System\ogUfoAt.exe
  C:\Windows\System\ogUfoAt.exe
  2⤵
  PID:14688
- C:\Windows\System\PhZEjCD.exe
  C:\Windows\System\PhZEjCD.exe
  2⤵
  PID:14708
- C:\Windows\System\voLHqEE.exe
  C:\Windows\System\voLHqEE.exe
  2⤵
  PID:14736
- C:\Windows\System\duReUVV.exe
  C:\Windows\System\duReUVV.exe
  2⤵
  PID:14760
- C:\Windows\System\QTrAFOR.exe
  C:\Windows\System\QTrAFOR.exe
  2⤵
  PID:14784
- C:\Windows\System\tHBYvhb.exe
  C:\Windows\System\tHBYvhb.exe
  2⤵
  PID:14816
- C:\Windows\System\beMHkOQ.exe
  C:\Windows\System\beMHkOQ.exe
  2⤵
  PID:14836
- C:\Windows\System\alwZMpY.exe
  C:\Windows\System\alwZMpY.exe
  2⤵
  PID:14856
- C:\Windows\System\wqVyKzQ.exe
  C:\Windows\System\wqVyKzQ.exe
  2⤵
  PID:14880
- C:\Windows\System\whSBVco.exe
  C:\Windows\System\whSBVco.exe
  2⤵
  PID:14900
- C:\Windows\System\LQUdozV.exe
  C:\Windows\System\LQUdozV.exe
  2⤵
  PID:14924
- C:\Windows\System\QggRSoJ.exe
  C:\Windows\System\QggRSoJ.exe
  2⤵
  PID:15172
- C:\Windows\System\LwMwjVl.exe
  C:\Windows\System\LwMwjVl.exe
  2⤵
  PID:15188
- C:\Windows\System\WYpKNvg.exe
  C:\Windows\System\WYpKNvg.exe
  2⤵
  PID:15204
- C:\Windows\System\EwhWhqT.exe
  C:\Windows\System\EwhWhqT.exe
  2⤵
  PID:15220
- C:\Windows\System\oKvKHeI.exe
  C:\Windows\System\oKvKHeI.exe
  2⤵
  PID:15236
- C:\Windows\System\wOPOrho.exe
  C:\Windows\System\wOPOrho.exe
  2⤵
  PID:15252
- C:\Windows\System\vJduOCQ.exe
  C:\Windows\System\vJduOCQ.exe
  2⤵
  PID:15268
- C:\Windows\System\EHjZkOx.exe
  C:\Windows\System\EHjZkOx.exe
  2⤵
  PID:15284
- C:\Windows\System\CBDZggP.exe
  C:\Windows\System\CBDZggP.exe
  2⤵
  PID:15300
- C:\Windows\System\NHBYYjs.exe
  C:\Windows\System\NHBYYjs.exe
  2⤵
  PID:15316
- C:\Windows\System\KHBciod.exe
  C:\Windows\System\KHBciod.exe
  2⤵
  PID:15332
- C:\Windows\System\vXbUaTk.exe
  C:\Windows\System\vXbUaTk.exe
  2⤵
  PID:15352
- C:\Windows\System\iBKuMnA.exe
  C:\Windows\System\iBKuMnA.exe
  2⤵
  PID:13920
- C:\Windows\System\SqPwwvY.exe
  C:\Windows\System\SqPwwvY.exe
  2⤵
  PID:11632
- C:\Windows\System\aSFdbaG.exe
  C:\Windows\System\aSFdbaG.exe
  2⤵
  PID:8372
- C:\Windows\System\nEHOlph.exe
  C:\Windows\System\nEHOlph.exe
  2⤵
  PID:7632
- C:\Windows\System\qhCjdQT.exe
  C:\Windows\System\qhCjdQT.exe
  2⤵
  PID:13868
- C:\Windows\System\MGiglPV.exe
  C:\Windows\System\MGiglPV.exe
  2⤵
  PID:7032
- C:\Windows\System\hpuOIKp.exe
  C:\Windows\System\hpuOIKp.exe
  2⤵
  PID:7180
- C:\Windows\System\EqsnFVo.exe
  C:\Windows\System\EqsnFVo.exe
  2⤵
  PID:8292
- C:\Windows\System\SsTdFoV.exe
  C:\Windows\System\SsTdFoV.exe
  2⤵
  PID:14176
- C:\Windows\System\SBfqZGL.exe
  C:\Windows\System\SBfqZGL.exe
  2⤵
  PID:6152
- C:\Windows\System\KvcQEEa.exe
  C:\Windows\System\KvcQEEa.exe
  2⤵
  PID:14544
- C:\Windows\System\MreUsUV.exe
  C:\Windows\System\MreUsUV.exe
  2⤵
  PID:8164
- C:\Windows\System\VUYUhlZ.exe
  C:\Windows\System\VUYUhlZ.exe
  2⤵
  PID:14684
- C:\Windows\System\cHvZSgP.exe
  C:\Windows\System\cHvZSgP.exe
  2⤵
  PID:14392
- C:\Windows\System\KkNoKHX.exe
  C:\Windows\System\KkNoKHX.exe
  2⤵
  PID:14696
- C:\Windows\System\mOiYHuM.exe
  C:\Windows\System\mOiYHuM.exe
  2⤵
  PID:14844
- C:\Windows\System\gUMuleM.exe
  C:\Windows\System\gUMuleM.exe
  2⤵
  PID:14896
- C:\Windows\System\fvllKgm.exe
  C:\Windows\System\fvllKgm.exe
  2⤵
  PID:14916
- C:\Windows\System\GWIHUuF.exe
  C:\Windows\System\GWIHUuF.exe
  2⤵
  PID:14960
- C:\Windows\System\hEOOWzp.exe
  C:\Windows\System\hEOOWzp.exe
  2⤵
  PID:14992
- C:\Windows\System\kPLltvV.exe
  C:\Windows\System\kPLltvV.exe
  2⤵
  PID:7988
- C:\Windows\System\sAEVOuL.exe
  C:\Windows\System\sAEVOuL.exe
  2⤵
  PID:14364
- C:\Windows\System\OitVAdl.exe
  C:\Windows\System\OitVAdl.exe
  2⤵
  PID:14700
- C:\Windows\System\AvhDjPT.exe
  C:\Windows\System\AvhDjPT.exe
  2⤵
  PID:14728
- C:\Windows\System\ziAvhJv.exe
  C:\Windows\System\ziAvhJv.exe
  2⤵
  PID:8664
- C:\Windows\System\GzddGDc.exe
  C:\Windows\System\GzddGDc.exe
  2⤵
  PID:14796
- C:\Windows\System\juPDGSR.exe
  C:\Windows\System\juPDGSR.exe
  2⤵
  PID:15160
- C:\Windows\System\RUVliCD.exe
  C:\Windows\System\RUVliCD.exe
  2⤵
  PID:15212
- C:\Windows\System\deVhjix.exe
  C:\Windows\System\deVhjix.exe
  2⤵
  PID:14964
- C:\Windows\System\WNvwfeu.exe
  C:\Windows\System\WNvwfeu.exe
  2⤵
  PID:8964
- C:\Windows\System\SLQNRRX.exe
  C:\Windows\System\SLQNRRX.exe
  2⤵
  PID:15308
- C:\Windows\System\aPblUXr.exe
  C:\Windows\System\aPblUXr.exe
  2⤵
  PID:6892
- C:\Windows\System\qjoMyLk.exe
  C:\Windows\System\qjoMyLk.exe
  2⤵
  PID:10040
- C:\Windows\System\AbcPBDi.exe
  C:\Windows\System\AbcPBDi.exe
  2⤵
  PID:14920
- C:\Windows\System\HebBhiO.exe
  C:\Windows\System\HebBhiO.exe
  2⤵
  PID:15196
- C:\Windows\System\JFxKwdJ.exe
  C:\Windows\System\JFxKwdJ.exe
  2⤵
  PID:15280
- C:\Windows\System\wDOLiQZ.exe
  C:\Windows\System\wDOLiQZ.exe
  2⤵
  PID:14496
- C:\Windows\System\DyceDEc.exe
  C:\Windows\System\DyceDEc.exe
  2⤵
  PID:9520
- C:\Windows\System\AZRnyRp.exe
  C:\Windows\System\AZRnyRp.exe
  2⤵
  PID:9396
- C:\Windows\System\cXhuikr.exe
  C:\Windows\System\cXhuikr.exe
  2⤵
  PID:9236
- C:\Windows\System\QosHTyi.exe
  C:\Windows\System\QosHTyi.exe
  2⤵
  PID:8576
- C:\Windows\System\bstZWiY.exe
  C:\Windows\System\bstZWiY.exe
  2⤵
  PID:9428
- C:\Windows\System\fqpCVtv.exe
  C:\Windows\System\fqpCVtv.exe
  2⤵
  PID:9552
- C:\Windows\System\IhyGJhz.exe
  C:\Windows\System\IhyGJhz.exe
  2⤵
  PID:15096
- C:\Windows\System\zoWIoWB.exe
  C:\Windows\System\zoWIoWB.exe
  2⤵
  PID:8916
- C:\Windows\System\IkfKtGh.exe
  C:\Windows\System\IkfKtGh.exe
  2⤵
  PID:9364
- C:\Windows\System\xosaQKi.exe
  C:\Windows\System\xosaQKi.exe
  2⤵
  PID:9408
- C:\Windows\System\HGLhwOS.exe
  C:\Windows\System\HGLhwOS.exe
  2⤵
  PID:9660
- C:\Windows\System\ZyAmjNV.exe
  C:\Windows\System\ZyAmjNV.exe
  2⤵
  PID:9700
- C:\Windows\System\GqJkwVd.exe
  C:\Windows\System\GqJkwVd.exe
  2⤵
  PID:10180
- C:\Windows\System\ZbOIQLP.exe
  C:\Windows\System\ZbOIQLP.exe
  2⤵
  PID:15340
- C:\Windows\System\fhMjmLC.exe
  C:\Windows\System\fhMjmLC.exe
  2⤵
  PID:9288
- C:\Windows\System\lfrORCO.exe
  C:\Windows\System\lfrORCO.exe
  2⤵
  PID:9296
- C:\Windows\System\fSVejFU.exe
  C:\Windows\System\fSVejFU.exe
  2⤵
  PID:10436
- C:\Windows\System\UyvUFVN.exe
  C:\Windows\System\UyvUFVN.exe
  2⤵
  PID:1564
- C:\Windows\System\dGenPDA.exe
  C:\Windows\System\dGenPDA.exe
  2⤵
  PID:5996
- C:\Windows\System\usWogvH.exe
  C:\Windows\System\usWogvH.exe
  2⤵
  PID:8468
- C:\Windows\System\zlnxCoY.exe
  C:\Windows\System\zlnxCoY.exe
  2⤵
  PID:6556
- C:\Windows\System\sRdhiQi.exe
  C:\Windows\System\sRdhiQi.exe
  2⤵
  PID:14576
- C:\Windows\System\ZZagtal.exe
  C:\Windows\System\ZZagtal.exe
  2⤵
  PID:1236
- C:\Windows\System\ablxiTA.exe
  C:\Windows\System\ablxiTA.exe
  2⤵
  PID:14720
- C:\Windows\System\nCSumTS.exe
  C:\Windows\System\nCSumTS.exe
  2⤵
  PID:4816
- C:\Windows\System\QpYqhul.exe
  C:\Windows\System\QpYqhul.exe
  2⤵
  PID:9936
- C:\Windows\System\MWPrMBj.exe
  C:\Windows\System\MWPrMBj.exe
  2⤵
  PID:9600
- C:\Windows\System\HsabYfy.exe
  C:\Windows\System\HsabYfy.exe
  2⤵
  PID:9416
- C:\Windows\System\FOoYsjz.exe
  C:\Windows\System\FOoYsjz.exe
  2⤵
  PID:4144
- C:\Windows\System\rTVqvXh.exe
  C:\Windows\System\rTVqvXh.exe
  2⤵
  PID:9860
- C:\Windows\System\eNBPQLH.exe
  C:\Windows\System\eNBPQLH.exe
  2⤵
  PID:10448
- C:\Windows\System\aGMfgFW.exe
  C:\Windows\System\aGMfgFW.exe
  2⤵
  PID:10600
- C:\Windows\System\enpzJQL.exe
  C:\Windows\System\enpzJQL.exe
  2⤵
  PID:3344
- C:\Windows\System\sgQzFLT.exe
  C:\Windows\System\sgQzFLT.exe
  2⤵
  PID:9780
- C:\Windows\System\bnlJAMF.exe
  C:\Windows\System\bnlJAMF.exe
  2⤵
  PID:14984
- C:\Windows\System\iYTfwCG.exe
  C:\Windows\System\iYTfwCG.exe
  2⤵
  PID:9116
- C:\Windows\System\zlVXXxY.exe
  C:\Windows\System\zlVXXxY.exe
  2⤵
  PID:11040
- C:\Windows\System\zezXkOH.exe
  C:\Windows\System\zezXkOH.exe
  2⤵
  PID:8700
- C:\Windows\System\tcDIRjn.exe
  C:\Windows\System\tcDIRjn.exe
  2⤵
  PID:11164
- C:\Windows\System\VDosDUp.exe
  C:\Windows\System\VDosDUp.exe
  2⤵
  PID:3624
- C:\Windows\System\hOyudfc.exe
  C:\Windows\System\hOyudfc.exe
  2⤵
  PID:14876
- C:\Windows\System\sXQZOLT.exe
  C:\Windows\System\sXQZOLT.exe
  2⤵
  PID:8540
- C:\Windows\System\bzlMVZi.exe
  C:\Windows\System\bzlMVZi.exe
  2⤵
  PID:8592
- C:\Windows\System\XFyBxEZ.exe
  C:\Windows\System\XFyBxEZ.exe
  2⤵
  PID:10992
- C:\Windows\System\yZBZeoA.exe
  C:\Windows\System\yZBZeoA.exe
  2⤵
  PID:11024
- C:\Windows\System\hklzmHD.exe
  C:\Windows\System\hklzmHD.exe
  2⤵
  PID:8776
- C:\Windows\System\ibpXMrQ.exe
  C:\Windows\System\ibpXMrQ.exe
  2⤵
  PID:11216
- C:\Windows\System\AvsSgqk.exe
  C:\Windows\System\AvsSgqk.exe
  2⤵
  PID:6868
- C:\Windows\System\PyznTTq.exe
  C:\Windows\System\PyznTTq.exe
  2⤵
  PID:15376
- C:\Windows\System\wMuUgJO.exe
  C:\Windows\System\wMuUgJO.exe
  2⤵
  PID:15400
- C:\Windows\System\doXcNNT.exe
  C:\Windows\System\doXcNNT.exe
  2⤵
  PID:15424
- C:\Windows\System\nDcwhSE.exe
  C:\Windows\System\nDcwhSE.exe
  2⤵
  PID:15448
- C:\Windows\System\ImOHkPZ.exe
  C:\Windows\System\ImOHkPZ.exe
  2⤵
  PID:15472
- C:\Windows\System\BALhDyv.exe
  C:\Windows\System\BALhDyv.exe
  2⤵
  PID:15496
- C:\Windows\System\qvSlUdO.exe
  C:\Windows\System\qvSlUdO.exe
  2⤵
  PID:15520
- C:\Windows\System\pdaHTDm.exe
  C:\Windows\System\pdaHTDm.exe
  2⤵
  PID:15544
- C:\Windows\System\KIYCLWx.exe
  C:\Windows\System\KIYCLWx.exe
  2⤵
  PID:15572
- C:\Windows\System\YwCjAYW.exe
  C:\Windows\System\YwCjAYW.exe
  2⤵
  PID:15600
- C:\Windows\System\iEhFJIo.exe
  C:\Windows\System\iEhFJIo.exe
  2⤵
  PID:15652
- C:\Windows\System\DDIinZM.exe
  C:\Windows\System\DDIinZM.exe
  2⤵
  PID:15672
- C:\Windows\System\POWCTos.exe
  C:\Windows\System\POWCTos.exe
  2⤵
  PID:15704
- C:\Windows\System\FhqaTSj.exe
  C:\Windows\System\FhqaTSj.exe
  2⤵
  PID:15720
- C:\Windows\System\lYlPsDc.exe
  C:\Windows\System\lYlPsDc.exe
  2⤵
  PID:15752
- C:\Windows\System\DgTzjIc.exe
  C:\Windows\System\DgTzjIc.exe
  2⤵
  PID:15888
- C:\Windows\System\HycLOnI.exe
  C:\Windows\System\HycLOnI.exe
  2⤵
  PID:15908
- C:\Windows\System\lepwKXN.exe
  C:\Windows\System\lepwKXN.exe
  2⤵
  PID:15924
- C:\Windows\System\ScGFoBr.exe
  C:\Windows\System\ScGFoBr.exe
  2⤵
  PID:15940
- C:\Windows\System\VnRzvdE.exe
  C:\Windows\System\VnRzvdE.exe
  2⤵
  PID:15956
- C:\Windows\System\xHhDjwA.exe
  C:\Windows\System\xHhDjwA.exe
  2⤵
  PID:15972
- C:\Windows\System\JaOhUlG.exe
  C:\Windows\System\JaOhUlG.exe
  2⤵
  PID:15988
- C:\Windows\System\qmDJCJI.exe
  C:\Windows\System\qmDJCJI.exe
  2⤵
  PID:16004
- C:\Windows\System\VqXkzPq.exe
  C:\Windows\System\VqXkzPq.exe
  2⤵
  PID:16020
- C:\Windows\System\FHuUKkF.exe
  C:\Windows\System\FHuUKkF.exe
  2⤵
  PID:16036
- C:\Windows\System\zwpVKtb.exe
  C:\Windows\System\zwpVKtb.exe
  2⤵
  PID:16052
- C:\Windows\System\zWHiGJe.exe
  C:\Windows\System\zWHiGJe.exe
  2⤵
  PID:16072
- C:\Windows\System\XASvxMh.exe
  C:\Windows\System\XASvxMh.exe
  2⤵
  PID:16088
- C:\Windows\System\roVvzee.exe
  C:\Windows\System\roVvzee.exe
  2⤵
  PID:16112
- C:\Windows\System\uJMnnRU.exe
  C:\Windows\System\uJMnnRU.exe
  2⤵
  PID:16132
- C:\Windows\System\CqeIFnI.exe
  C:\Windows\System\CqeIFnI.exe
  2⤵
  PID:16152
- C:\Windows\System\OLfCKHJ.exe
  C:\Windows\System\OLfCKHJ.exe
  2⤵
  PID:16168
- C:\Windows\System\HNMazUf.exe
  C:\Windows\System\HNMazUf.exe
  2⤵
  PID:16188
- C:\Windows\System\atRLCSq.exe
  C:\Windows\System\atRLCSq.exe
  2⤵
  PID:16204
- C:\Windows\System\LEftesc.exe
  C:\Windows\System\LEftesc.exe
  2⤵
  PID:16220
- C:\Windows\System\RtFPwMJ.exe
  C:\Windows\System\RtFPwMJ.exe
  2⤵
  PID:16236
- C:\Windows\System\jPETYWM.exe
  C:\Windows\System\jPETYWM.exe
  2⤵
  PID:16260
- C:\Windows\System\bndSKGI.exe
  C:\Windows\System\bndSKGI.exe
  2⤵
  PID:16284
- C:\Windows\System\JOlNDgm.exe
  C:\Windows\System\JOlNDgm.exe
  2⤵
  PID:16324
- C:\Windows\System\OywOnzB.exe
  C:\Windows\System\OywOnzB.exe
  2⤵
  PID:16352
- C:\Windows\System\YgYZnCq.exe
  C:\Windows\System\YgYZnCq.exe
  2⤵
  PID:16368
- C:\Windows\System\XOZSquB.exe
  C:\Windows\System\XOZSquB.exe
  2⤵
  PID:760
- C:\Windows\System\nCvMoVE.exe
  C:\Windows\System\nCvMoVE.exe
  2⤵
  PID:9752
- C:\Windows\System\FCUvMHq.exe
  C:\Windows\System\FCUvMHq.exe
  2⤵
  PID:6980
- C:\Windows\System\LZLkyFs.exe
  C:\Windows\System\LZLkyFs.exe
  2⤵
  PID:9064
- C:\Windows\System\EhiDvcN.exe
  C:\Windows\System\EhiDvcN.exe
  2⤵
  PID:13932
- C:\Windows\System\eLmRlBt.exe
  C:\Windows\System\eLmRlBt.exe
  2⤵
  PID:11176
- C:\Windows\System\qQvznvJ.exe
  C:\Windows\System\qQvznvJ.exe
  2⤵
  PID:9400
- C:\Windows\System\CdPgiZt.exe
  C:\Windows\System\CdPgiZt.exe
  2⤵
  PID:14532
- C:\Windows\System\cfiUHCo.exe
  C:\Windows\System\cfiUHCo.exe
  2⤵
  PID:7792
- C:\Windows\System\cqBJzRv.exe
  C:\Windows\System\cqBJzRv.exe
  2⤵
  PID:9176
- C:\Windows\System\UARPBAu.exe
  C:\Windows\System\UARPBAu.exe
  2⤵
  PID:11044
- C:\Windows\System\cwOWLDV.exe
  C:\Windows\System\cwOWLDV.exe
  2⤵
  PID:10440
- C:\Windows\System\fQHJNGz.exe
  C:\Windows\System\fQHJNGz.exe
  2⤵
  PID:10792
- C:\Windows\System\xmEaMFa.exe
  C:\Windows\System\xmEaMFa.exe
  2⤵
  PID:7824
- C:\Windows\System\CQbJvdq.exe
  C:\Windows\System\CQbJvdq.exe
  2⤵
  PID:15488
- C:\Windows\System\QNogsRL.exe
  C:\Windows\System\QNogsRL.exe
  2⤵
  PID:15556
- C:\Windows\System\EcZDNeb.exe
  C:\Windows\System\EcZDNeb.exe
  2⤵
  PID:11140
- C:\Windows\System\eDXFOBx.exe
  C:\Windows\System\eDXFOBx.exe
  2⤵
  PID:15408
- C:\Windows\System\RMLmjvl.exe
  C:\Windows\System\RMLmjvl.exe
  2⤵
  PID:15540
- C:\Windows\System\BQIGeGd.exe
  C:\Windows\System\BQIGeGd.exe
  2⤵
  PID:9932
- C:\Windows\System\UodVgme.exe
  C:\Windows\System\UodVgme.exe
  2⤵
  PID:8688
- C:\Windows\System\AdNgEZU.exe
  C:\Windows\System\AdNgEZU.exe
  2⤵
  PID:10804
- C:\Windows\System\CsPikJE.exe
  C:\Windows\System\CsPikJE.exe
  2⤵
  PID:15692
- C:\Windows\System\IokhoAd.exe
  C:\Windows\System\IokhoAd.exe
  2⤵
  PID:10360
- C:\Windows\System\PZhRpfT.exe
  C:\Windows\System\PZhRpfT.exe
  2⤵
  PID:9608
- C:\Windows\System\gWPIGBG.exe
  C:\Windows\System\gWPIGBG.exe
  2⤵
  PID:16160
- C:\Windows\System\fzoDxJZ.exe
  C:\Windows\System\fzoDxJZ.exe
  2⤵
  PID:16044
- C:\Windows\System\ucRWrGN.exe
  C:\Windows\System\ucRWrGN.exe
  2⤵
  PID:15932
- C:\Windows\System\zaAQiEl.exe
  C:\Windows\System\zaAQiEl.exe
  2⤵
  PID:15860
- C:\Windows\System\APLLSWZ.exe
  C:\Windows\System\APLLSWZ.exe
  2⤵
  PID:15904
- C:\Windows\System\DgewrKX.exe
  C:\Windows\System\DgewrKX.exe
  2⤵
  PID:14912
- C:\Windows\System\xccYhMH.exe
  C:\Windows\System\xccYhMH.exe
  2⤵
  PID:16176
- C:\Windows\System\JlqxMsz.exe
  C:\Windows\System\JlqxMsz.exe
  2⤵
  PID:9000
- C:\Windows\System\YFZWQIn.exe
  C:\Windows\System\YFZWQIn.exe
  2⤵
  PID:15984
- C:\Windows\System\ExDqEET.exe
  C:\Windows\System\ExDqEET.exe
  2⤵
  PID:16084
- C:\Windows\System\GKRyZeu.exe
  C:\Windows\System\GKRyZeu.exe
  2⤵
  PID:16164
- C:\Windows\System\VwZjqhG.exe
  C:\Windows\System\VwZjqhG.exe
  2⤵
  PID:16232
- C:\Windows\System\RbncGZo.exe
  C:\Windows\System\RbncGZo.exe
  2⤵
  PID:10972
- C:\Windows\System\PLclxbL.exe
  C:\Windows\System\PLclxbL.exe
  2⤵
  PID:10920
- C:\Windows\System\XkXisSu.exe
  C:\Windows\System\XkXisSu.exe
  2⤵
  PID:10944
- C:\Windows\System\qDXteKw.exe
  C:\Windows\System\qDXteKw.exe
  2⤵
  PID:11692
- C:\Windows\System\lKyNfBM.exe
  C:\Windows\System\lKyNfBM.exe
  2⤵
  PID:11696
- C:\Windows\System\NIcYpRt.exe
  C:\Windows\System\NIcYpRt.exe
  2⤵
  PID:11656
- C:\Windows\System\NWsrhXJ.exe
  C:\Windows\System\NWsrhXJ.exe
  2⤵
  PID:11944
- C:\Windows\System\mYswTDP.exe
  C:\Windows\System\mYswTDP.exe
  2⤵
  PID:9272
- C:\Windows\System\MZSMzLK.exe
  C:\Windows\System\MZSMzLK.exe
  2⤵
  PID:11308
- C:\Windows\System\KyjIeWB.exe
  C:\Windows\System\KyjIeWB.exe
  2⤵
  PID:11960
- C:\Windows\System\kKWgJzQ.exe
  C:\Windows\System\kKWgJzQ.exe
  2⤵
  PID:9768
- C:\Windows\System\MPAdupK.exe
  C:\Windows\System\MPAdupK.exe
  2⤵
  PID:10284
- C:\Windows\System\zkjTwIx.exe
  C:\Windows\System\zkjTwIx.exe
  2⤵
  PID:9740
- C:\Windows\System\BMicVdM.exe
  C:\Windows\System\BMicVdM.exe
  2⤵
  PID:11644
- C:\Windows\System\wpKIwen.exe
  C:\Windows\System\wpKIwen.exe
  2⤵
  PID:11684
- C:\Windows\System\LKGpdCk.exe
  C:\Windows\System\LKGpdCk.exe
  2⤵
  PID:15456
- C:\Windows\System\wMWrFqQ.exe
  C:\Windows\System\wMWrFqQ.exe
  2⤵
  PID:16016
- C:\Windows\System\LxbgZuK.exe
  C:\Windows\System\LxbgZuK.exe
  2⤵
  PID:11856
- C:\Windows\System\LWiXkGr.exe
  C:\Windows\System\LWiXkGr.exe
  2⤵
  PID:11948
- C:\Windows\System\tBdQpjR.exe
  C:\Windows\System\tBdQpjR.exe
  2⤵
  PID:10912
- C:\Windows\System\hThruBD.exe
  C:\Windows\System\hThruBD.exe
  2⤵
  PID:7464
- C:\Windows\System\OLoMGuz.exe
  C:\Windows\System\OLoMGuz.exe
  2⤵
  PID:12268
- C:\Windows\System\fyBbRuA.exe
  C:\Windows\System\fyBbRuA.exe
  2⤵
  PID:8276
- C:\Windows\System\McnFnzI.exe
  C:\Windows\System\McnFnzI.exe
  2⤵
  PID:11600
- C:\Windows\System\EDOIPtg.exe
  C:\Windows\System\EDOIPtg.exe
  2⤵
  PID:10372
- C:\Windows\System\mQmQMUs.exe
  C:\Windows\System\mQmQMUs.exe
  2⤵
  PID:16068
- C:\Windows\System\QSJuNCI.exe
  C:\Windows\System\QSJuNCI.exe
  2⤵
  PID:11036
- C:\Windows\System\EelCsAI.exe
  C:\Windows\System\EelCsAI.exe
  2⤵
  PID:11552
- C:\Windows\System\gdeNZtB.exe
  C:\Windows\System\gdeNZtB.exe
  2⤵
  PID:12060
- C:\Windows\System\ENpOTYo.exe
  C:\Windows\System\ENpOTYo.exe
  2⤵
  PID:12252
- C:\Windows\System\cjbFFfe.exe
  C:\Windows\System\cjbFFfe.exe
  2⤵
  PID:15648
- C:\Windows\System\MjrLQuc.exe
  C:\Windows\System\MjrLQuc.exe
  2⤵
  PID:15744
- C:\Windows\System\EGKFemt.exe
  C:\Windows\System\EGKFemt.exe
  2⤵
  PID:11408
- C:\Windows\System\zFcLZos.exe
  C:\Windows\System\zFcLZos.exe
  2⤵
  PID:11252
- C:\Windows\System\sFwQXeR.exe
  C:\Windows\System\sFwQXeR.exe
  2⤵
  PID:15920
- C:\Windows\System\vzekRIL.exe
  C:\Windows\System\vzekRIL.exe
  2⤵
  PID:15232

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\BHC2O5WS\site-d059d883a114[1].css

Filesize
66KB

MD5
06ad9bc6321c6fed15c64dd375c36d90

SHA1
2abef97ab0621a1d832c6ca784721adad5bc8315

SHA256
74439e916848a6d30f2933b4e7c5a88b41d8ca3a1593f68a82596379806d4ae6

SHA512
d059d883a114193dd05c54c9d3db4f1552bba29320d529b3abed354152a17bcd773dfdec46afc8c2f2d7fd7f13ff85042fa697d761cb7a3447a8488349c81e2b

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_2zw4alic.gf1.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\AzJGxrb.exe

Filesize
1.9MB

MD5
dcba2a32ff0198692451c8e04eb2de98

SHA1
225059eab91f1a804d55ef35cd3314bb3bc637bc

SHA256
4d5cbf8632762ce07ff5ec05583fc4d2e6839f2d5b6dba83ed9061666e23c8f7

SHA512
9c78189aede0d67524aa24efa89afd104927b4d8462c9b4f98b78c2bb7df79b735ed370eb69b04c8605e21bf5cb8d9198c8af5e2cf61afa738aa8b9fd5cc52c9

Download Submit
C:\Windows\System\BEpQIXm.exe

Filesize
1.9MB

MD5
e369b9d6f546a8db010e8a2d3b61b039

SHA1
c39384c7f097fe5bd74bdc13b81325701c629ffd

SHA256
4de786ea595ce5b62111a8a7da53db370a113e0d0ec3fd3ae2d856920de22fe6

SHA512
02a50e644b47be3e3da2ae6c26354c4680cb75d5434ae6fd4aa434b7922b9062400174c6c9a49511c55f309931c67a4344bcbdfe9aff9a50a3c939d77182e52d

Download Submit
C:\Windows\System\BiXreLC.exe

Filesize
1.9MB

MD5
2708ac209ebd20dd7997c9c552b36dcc

SHA1
9fd911cb654b3fabd755c252e0758b47d0e486c5

SHA256
95cef34da906a35cdad37c7308537e6d9c22fac06a02c3421308e071aa960f2f

SHA512
d5192b31ced31339c5b31fe49ed82e2191d82f11c36c051fcf5ca7185dec80665e841c59c95bb957226e62c278dddb14fd6683623a8e6ecba3af215a11a03623

Download Submit
C:\Windows\System\EbfyCWs.exe

Filesize
1.9MB

MD5
d755dc5c287be67b5950562fab8286d5

SHA1
52a8803a810bba7c89109cd162d0b206a41319de

SHA256
bfce773a7d0fd4be8d93ebfac28a1553d94068fc3d10a6568d1aac6700a251ec

SHA512
b69b5157a0c42ed0997aef08351951cf31e5abecffb4dd9a76a11520605b12cd51b9fc38c6aa714115e8f204ec8df0f0144a9c126d3b59678977563478e848f8

Download Submit
C:\Windows\System\FZnZCiu.exe

Filesize
1.9MB

MD5
301b7021c5ed4006915f81ec6912f402

SHA1
ce1f9b242083090fad1ff90bbfc08dfdcf32d197

SHA256
6c41dcd67d893f68ced97f6aac2468a76c62c5312716a2099ca7bce93389fcbd

SHA512
79f0b3a2cbfc966d0f8896d54cdedc6e6f1abfba9f63bd6d834e5cde4592f2f1ae35d7cc1b2890fc53b26404dc2a4951be3298fa729883260403db74d7dcd67c

Download Submit
C:\Windows\System\HqNOeXe.exe

Filesize
1.9MB

MD5
69622966794eb03ebed77712c7a484ab

SHA1
41a797425ea6aa1fba923f4fcbe7dbfb9bcebf58

SHA256
48d7f39cb7782266311a0460351dbedc6f1658f1f4660fb7f6d78e3e0cebd31c

SHA512
cebfca18b3dacddd64e9b9f55ea7f08dcce7bd3b4c6a750588933ce2b0bcc516cfda0bfb004182ae311587ac474706760bd34a4153fa455307faa1fe5e4fdc31

Download Submit
C:\Windows\System\IxIYKZv.exe

Filesize
1.9MB

MD5
afd8d8413054be14dbcc51722790f5ff

SHA1
a3f79540d4a0de3490762e13e5c56fbfc7c2e753

SHA256
7b0aacd84b9fe068257ce866266f5e887b9970fbf08a4ec256e0994d1449d5b2

SHA512
643d1f84afe0fa4875cb29a6d672b2d0f8b18b3a7496f9d3d77a8e60f6b5128b0a1a1635b6eaa2194e22950f6900c51eed65e45f35f79d85a7bea6ded36dd1db

Download Submit
C:\Windows\System\KBthqbn.exe

Filesize
1.9MB

MD5
9f98eb365bac1f6468e1a297ad9c3cb2

SHA1
9ca72dff22c5ec91ca1fafa199cc696d3c49de17

SHA256
2794ff1b1a19350cb8d9d34716b11bc6b996701af5ccbe29418a9155291a5fe8

SHA512
a15551ea06a67c34a086172065f7b74a4f34914f66d72e25ac4aaaa74ca4406c43745747d2a5b07e91b034e782ab57624e63c6b3055f4180e65084611d9fa144

Download Submit
C:\Windows\System\MCRQYHc.exe

Filesize
1.9MB

MD5
e0ea657fec222673354e1a5fa5493c53

SHA1
f7b240e4931617ab0e25dc3270a953129d57dbba

SHA256
f15799425c1402ec1384613012a0eaa90d698e95c14a1d5a11602736f649e662

SHA512
81a138bfe0078c3605bcbe05473d05986706e328fd74babd10671c3ce33c9f77861bc20c0015a4218132d2f247bb2288776cf2b3b4232aaf9a16f8bc421e6854

Download Submit
C:\Windows\System\OEngzms.exe

Filesize
1.9MB

MD5
dab3e1de3c43f21c7429ac570158650a

SHA1
38289bda6c55c208de4e4684026e504c9f76bd86

SHA256
c43f423d08a4a0834549478bc35ba272f8e74a9d9369ef1e50ea3ff8fda7af22

SHA512
8d8b165e46f34186b2b92c25f4b4f57a1b437afdec3eecc078cb316e534a6938970152b88c2811d18b6224726124ad5e88f0d7b2ebdd0add6100fb44da5acb08

Download Submit
C:\Windows\System\OduZLIa.exe

Filesize
1.9MB

MD5
bcda81baeacafb9a36e8637df6f0929f

SHA1
3a4dba53c9cbe1fd01bdbd8ddce2e584c6ef553b

SHA256
59345b3a731d1b7bcb3247bc1122d93a76f2bc69062c315948ac1455182b2aba

SHA512
9bf004925f09233e9b98a13c5001b8a61cadbbbe96055084cad04e01f79c6d4f5921c09d69e311623115331f5f2fd331b971f03f29123ac6c5cf841cf91f72e8

Download Submit
C:\Windows\System\QRMkjjH.exe

Filesize
1.9MB

MD5
ff8468a38f645b2f8df77287e312db88

SHA1
4297fd60d84a20d7163d3a400b2a9f459130b2a5

SHA256
dcabecde6475aad86ee0b6eecb6cf0dcd988985dbaaea607dec1c1b74f582076

SHA512
5c4c29a48904bfb3329bfa2e79ca135bb99a90096036e73142e8ab85904be611445c896344a13514dcf68ea3038a3a11382897df69192f78eeba747c2b4c1f5f

Download Submit
C:\Windows\System\QSLKllC.exe

Filesize
1.9MB

MD5
d56cc52bb50c055b637c4ce2bc540e5e

SHA1
8631dcdf0ccd8816641db8719663f66f6a943cc3

SHA256
3c2d4549e100d87845bad041c148a01d11240a2889a30708e56af95f0f90cdb0

SHA512
a7b3a0a26da4e921299dd170e2f666f040e7f1275554828ad487400d5dbc5ec88c267a4963d07627fa40aa5161e9c43ad73df2ccdf1394b7a6d98f58cb0ae97c

Download Submit
C:\Windows\System\RSODZYb.exe

Filesize
1.9MB

MD5
f3c89a7b0b66e1a0ef72b3a90ac304c9

SHA1
13dcf6d52880d6822c6a9e1e8bc185f0d9030f56

SHA256
c58b9d81857f9f99ddfe336109b88df8c8e8eff72e84c87826624be4092e8fd4

SHA512
e5d5b9169b812c66c9e7c4ddd15a5990b313e5641106d7f8be23bd83400c0f82a09beb8a737f8ebdf4a06273b2c4b39b4bf31b37ae5f410969268b7a44ff6462

Download Submit
C:\Windows\System\XmNULem.exe

Filesize
1.9MB

MD5
c3d37815adbd670a5395ee9bdea0bf9d

SHA1
2c070ac4756eea7fec0e1b8452ee812dc06bb3a1

SHA256
a04579d478f90b60ecd8e0cfaf5cba050b3cdab03066f93cf4b5c9481f466027

SHA512
a6bbb2c5449d5b5c777f79371dd678bac7ba68162e4b4fc1cf90614b133b4ed9002971ff8fc4d242869eba13834ee1233da84d1ef3d3795d0fba42f1d8314409

Download Submit
C:\Windows\System\ZBpMeWS.exe

Filesize
1.9MB

MD5
5829dd97414c858ddeb26be2fdb19a7b

SHA1
c4f3150be3351c4a95d68a19ce05f414a0c309da

SHA256
c221fe46ab29d751387836b89956b68561b168b0a7a6f3d9e42a44a0f7df2bdc

SHA512
9e55d36ecad9437f4a1407e663f99cf0afd7dc3d16e11044b50bf2841d24614b05e9a1d5e07c43c4f97ad74d0137e507fa53e430539c62bb31b9b0f38d73e518

Download Submit
C:\Windows\System\aCPdsJi.exe

Filesize
1.9MB

MD5
f65f4784ea8090866bc54e9ba6c79fae

SHA1
9e4cf183d98b2436f1097f8226b53539cae5fc6f

SHA256
50153299d19a819b291139a4aef03458aba92d8233b4b4d6e62def0fd7851ad5

SHA512
9443ffda3ddec6f91cec0e7685024668e55794a1c3cb76cfd02f5a1222ba37fefbdcc27219e7dc3b9dfbd6eac2ba7869a82cc0a1ff31ca792ac63cf8d46ff306

Download Submit
C:\Windows\System\cHgxXQu.exe

Filesize
1.9MB

MD5
a6e5a2810d414463d0a8397b79c2f98a

SHA1
88437c8d6dc0d5eb65ddf3416d637277b84bad1a

SHA256
400e31e875e7f0605904856fd0ab23492ca1bc2bc51faa55c609d57d9df33e2a

SHA512
563e826f96c293187bec0d561242469aa68b9af9cf7c6dd5cf0109e2bf3d4a9e6d8fc93836d74e60c5161eb7dd07e5fe2fc3ad176f60d08f026db107d41a7bbc

Download Submit
C:\Windows\System\dHBwZgb.exe

Filesize
1.9MB

MD5
3e5075307549e944f8525dc98279b4c6

SHA1
bf1b4de090bfc732199508facabd39ae412d2831

SHA256
5369c61c961f59c78adee5cd1d7d4747e4368fff5aed3f821674d4e697f4e719

SHA512
e11b16c2026ef6718a79869a614d6f9d8ae2b02bb25f2618858d6cf9ee6a5e9e949bc4f504086dc270fd4006e3930cfe1aef18174013a07bfc1e24cf23bd81c9

Download Submit
C:\Windows\System\hszwQHT.exe

Filesize
1.9MB

MD5
64dc7db0bc05285c16bac4ab6efd2ade

SHA1
2475730c12319823a9d65c70603ed4516bfd2a0a

SHA256
e765d7910aa72946d1de17a31964281ca2479bd6e18f226cd3ea76845e62656f

SHA512
04c2a3376853e11ab1a897eb85c29f5df0291a54b49c7ff49c71aae0a8e7fd77a0bf59f4e9b4210486c4d9d594f211217fe496b60cc9e3e275d2bc4234d3eed4

Download Submit
C:\Windows\System\iOLtrCp.exe

Filesize
1.9MB

MD5
91a39bc9fc74731e24eb52e33c418c4b

SHA1
76dd6abecd37fe599b61ebfdbddae0b8dab4735d

SHA256
012e5013a14c3fd06c386c0aad7ec5fee026c3fe964140ad3e5b983880702dd0

SHA512
4640be8837cea0de6ee0d6ef2b42c9eac24c98df4e849106cbd2c2b8a7139d66206801ee4eff9b894c4a623ba3a67685ebcc7d49f51696729a41d142c0acc270

Download Submit
C:\Windows\System\iiEGbwU.exe

Filesize
1.9MB

MD5
44c7fc2aac61a623e94f87b93edfe803

SHA1
eab90e8f1f04376835aff514c7ceba60ad2cf9ce

SHA256
ad6ebbc5f685e47f52172cc99a176295a174bc5619f24c398b9524c8ff40a37e

SHA512
63f05676a3eafbe2422ca9a64ca22865411b70866279f545680985f4dc04a0f09381da384ce3540afccae6c000413112f4b90551e0e36aec2fa2da148bd47a9f

Download Submit
C:\Windows\System\jbFVJrw.exe

Filesize
1.9MB

MD5
97e57a44a88db87cb764fc01244f122d

SHA1
0e427f8aedac12455532feff40435d637ae929b4

SHA256
ad4015dc2a16e89195b12b5d3e80714d72c5a270c4da172f099d4aba3d644a0f

SHA512
fe5280a822738af5e1bd3326e0a41e7de6f13eb27a06207fc5578d23feb0f2f7df9da0ced8856b8aeb033ca8061da44896ffbe9c9bad87e323b95fb4ab3b221c

Download Submit
C:\Windows\System\klSptYf.exe

Filesize
1.9MB

MD5
90eb7842bec48c3a8019f6b1e60b76fe

SHA1
55b10cd46c1fcd1fe401e6a14770cdaece0fa92e

SHA256
00cc8eba98202de841bdd58a4896f6405900f7369fb03b0dd114f70729b094f2

SHA512
62453581dc54be225bdb625a40bf118db26dcb367664377a361c6906f48f30264f494f8240eb374a68698fbf324d2222f5e6eeed0e3cf1777cd3bbb4464c980c

Download Submit
C:\Windows\System\lONWItR.exe

Filesize
1.9MB

MD5
35b8329792c771c9ac72b4e03307ef3d

SHA1
371bd1cc16953c6d7242c32a09d12d564f23ae4d

SHA256
f57d3b18f8b89f022b39bac6c0ade24a1352de0142747b7e545f6752b5a72131

SHA512
3ae19e26fbd9604c958c10308ce4f73a38d023b88e11f7cf5b48de9068ab76d97ff3cdb60c86fbf7cb6598c7a7a24125e2dcd4f529bf7235f969ba8344bc0aff

Download Submit
C:\Windows\System\nXqreaL.exe

Filesize
1.9MB

MD5
0c6e6cbe265b5b2f849c672f721edd69

SHA1
48009e27532ea3a9323742d10d445381367ee35e

SHA256
0fffd60f89d448dbb4bff0ae9819da1487a0ba838d7ad9060bd3634da785b322

SHA512
4306e6496c339364de36e5e8d8bbcc4c6dd88974ab9720e5a5451998fffe3a023011d0ce72097cfa8d96c141a5831416defda44fe8605d193229587895257a0c

Download Submit
C:\Windows\System\pQvwKrr.exe

Filesize
1.9MB

MD5
5be471303f02bcd380c875fe420f19fb

SHA1
672167cde3a329314d2490337a2a95c97eacf076

SHA256
cd0f0d20d65d9bbe29a74802a16e8ed635d5e23f6adfcab7dd1c22aac072b641

SHA512
8e1e0dd59b11e1c11b30fe0895f756fc4c220204136ce1d17256dad4a293e5c9ef483dabdffe217286e6f18d05bc616bb0edb1dc75da2f35ccd8fec0d7c592a5

Download Submit
C:\Windows\System\pRYarxO.exe

Filesize
1.9MB

MD5
ec40ea244b4bbd212f7bbd3436912a2a

SHA1
81b5025b1fa4e6fec322f43db69b3539b81e2a0f

SHA256
499c9febcb129fcf798dfb3a0edb24aadbf971f0ae58ed2ee2977a231c55d98d

SHA512
c3cf894eaf16903d9601a17715ffdd925262290b8895255deef8e96c2cc6503a9ce9c02a883dc7ba9ed2aa1014e29af54d553bea000f9eabb49d574f409eb9d9

Download Submit
C:\Windows\System\pToIrwt.exe

Filesize
1.9MB

MD5
5f5c719bcf8eba70c02062b489042783

SHA1
1c06a7ab9e18dd59d245e0cf0d5cde730c18afec

SHA256
3c5f43c0131ccb6e802b361fbc2c01b1c7a51257aea7ab3f4db16446f83f9cdb

SHA512
fa9d548006e7853be2c302d09ac26f669a267032a6c74c808b6dcd5dc9dcd880d2baac84e44c08cb0af909ee82b86d50c198639a21ac8312131db22d819d29e3

Download Submit
C:\Windows\System\pvJSQQr.exe

Filesize
1.9MB

MD5
db8385f19881190449dd8b82e1717373

SHA1
904674401dd96e78dae39c95dd98000282eb6b6b

SHA256
0b7db30d260ee20d37c88512a1a11618416f8d2b14ec1be01f5b43958a2d539a

SHA512
c2f9efe205f013b6ea0ead48aae84537d4429e34fb71da8802df8f50f84eadb41dd40b2065de740b4f94f1676b91a5ca31fd030172d4cef955d6956509dffd94

Download Submit
C:\Windows\System\rjEWRJS.exe

Filesize
1.9MB

MD5
b31ae79c3cf4f1f79a73ecd5031ec648

SHA1
6075ef10b92d3d066dcf8e60bbbcc70ecb6ab950

SHA256
c1467e58029d5b417a108a031c3c3d66d765054965c6c51f6385bb69429bd878

SHA512
3a088cd68ca68756dec731c0c11dc8f4484abd331da22dac7bb002d700aa2ac5149d6a354fb91f5ec93b4d47b3baf9ae7fd2bd70d3fce011f4577c99446fe5f8

Download Submit
C:\Windows\System\wDfWxgF.exe

Filesize
1.9MB

MD5
4837d17777b90c38a6ea160cabf2a188

SHA1
50a2944fc8b032c95dc56a291990b4922b32c868

SHA256
3ac7a561eafdedd66bbc004e34f4d80162c46406b78b1beda974a49991822fd7

SHA512
37ec8f8134bb1611ed8948e60ae85131c74e273696e72da1b4c683227800cff9ded6bcdf553e4a14f3124b9e253768134201d3880f1676b4a609c8b6b7cf9a80

Download Submit
C:\Windows\System\xsswRnL.exe

Filesize
1.9MB

MD5
c9d5a2595b7ae15020dab471c0330504

SHA1
8a48c51705a81903c6689b3244bc553e351da9f6

SHA256
298351b632d21ae031f307bf417df1867b2d65df03de2073451d5e4f735ab9b7

SHA512
aa7f5d0ef98ca975e618e7987454e83c581bd0662eacac9177c1a32a5b4eb70d1e5c7b8ed47ac622f1f3b2d95ef61d6333dd769d135ca8e0a21df1b1c8c89fa3

Download Submit
memory/564-140-0x00007FF7250F0000-0x00007FF7254E2000-memory.dmp

Filesize
3.9MB

Download
memory/564-1990-0x00007FF7250F0000-0x00007FF7254E2000-memory.dmp

Filesize
3.9MB

Download
memory/632-60-0x00007FF69DD70000-0x00007FF69E162000-memory.dmp

Filesize
3.9MB

Download
memory/632-1987-0x00007FF69DD70000-0x00007FF69E162000-memory.dmp

Filesize
3.9MB

Download
memory/944-2213-0x00007FF624CF0000-0x00007FF6250E2000-memory.dmp

Filesize
3.9MB

Download
memory/944-148-0x00007FF624CF0000-0x00007FF6250E2000-memory.dmp

Filesize
3.9MB

Download
memory/1136-141-0x00007FF72ADB0000-0x00007FF72B1A2000-memory.dmp

Filesize
3.9MB

Download
memory/1136-2060-0x00007FF72ADB0000-0x00007FF72B1A2000-memory.dmp

Filesize
3.9MB

Download
memory/1576-2181-0x00007FF67B7C0000-0x00007FF67BBB2000-memory.dmp

Filesize
3.9MB

Download
memory/1576-183-0x00007FF67B7C0000-0x00007FF67BBB2000-memory.dmp

Filesize
3.9MB

Download
memory/2312-2135-0x00007FF662360000-0x00007FF662752000-memory.dmp

Filesize
3.9MB

Download
memory/2312-180-0x00007FF662360000-0x00007FF662752000-memory.dmp

Filesize
3.9MB

Download
memory/2460-59-0x00007FF72A4A0000-0x00007FF72A892000-memory.dmp

Filesize
3.9MB

Download
memory/2460-1981-0x00007FF72A4A0000-0x00007FF72A892000-memory.dmp

Filesize
3.9MB

Download
memory/2648-2141-0x00007FF725660000-0x00007FF725A52000-memory.dmp

Filesize
3.9MB

Download
memory/2648-185-0x00007FF725660000-0x00007FF725A52000-memory.dmp

Filesize
3.9MB

Download
memory/2664-184-0x00007FF7C9720000-0x00007FF7C9B12000-memory.dmp

Filesize
3.9MB

Download
memory/2664-2528-0x00007FF7C9720000-0x00007FF7C9B12000-memory.dmp

Filesize
3.9MB

Download
memory/2684-1973-0x00007FF700B10000-0x00007FF700F02000-memory.dmp

Filesize
3.9MB

Download
memory/2684-58-0x00007FF700B10000-0x00007FF700F02000-memory.dmp

Filesize
3.9MB

Download
memory/3176-61-0x00007FF729D60000-0x00007FF72A152000-memory.dmp

Filesize
3.9MB

Download
memory/3176-1989-0x00007FF729D60000-0x00007FF72A152000-memory.dmp

Filesize
3.9MB

Download
memory/3208-2143-0x00007FF6C0110000-0x00007FF6C0502000-memory.dmp

Filesize
3.9MB

Download
memory/3208-182-0x00007FF6C0110000-0x00007FF6C0502000-memory.dmp

Filesize
3.9MB

Download
memory/3524-2133-0x00007FF69C160000-0x00007FF69C552000-memory.dmp

Filesize
3.9MB

Download
memory/3524-146-0x00007FF69C160000-0x00007FF69C552000-memory.dmp

Filesize
3.9MB

Download
memory/3608-178-0x00007FF639FA0000-0x00007FF63A392000-memory.dmp

Filesize
3.9MB

Download
memory/3608-2146-0x00007FF639FA0000-0x00007FF63A392000-memory.dmp

Filesize
3.9MB

Download
memory/3656-57-0x00007FF7432D0000-0x00007FF7436C2000-memory.dmp

Filesize
3.9MB

Download
memory/3656-1986-0x00007FF7432D0000-0x00007FF7436C2000-memory.dmp

Filesize
3.9MB

Download
memory/3680-2129-0x00007FF686DD0000-0x00007FF6871C2000-memory.dmp

Filesize
3.9MB

Download
memory/3680-142-0x00007FF686DD0000-0x00007FF6871C2000-memory.dmp

Filesize
3.9MB

Download
memory/3768-3-0x00007FFE94223000-0x00007FFE94225000-memory.dmp

Filesize
8KB

Download
memory/3768-48-0x00007FFE94220000-0x00007FFE94CE1000-memory.dmp

Filesize
10.8MB

Download
memory/3768-6320-0x00007FFE94220000-0x00007FFE94CE1000-memory.dmp

Filesize
10.8MB

Download
memory/3768-5334-0x00007FFE94223000-0x00007FFE94225000-memory.dmp

Filesize
8KB

Download
memory/3768-188-0x000002C1DC3E0000-0x000002C1DCB86000-memory.dmp

Filesize
7.6MB

Download
memory/3768-9-0x000002C1C1580000-0x000002C1C15A2000-memory.dmp

Filesize
136KB

Download
memory/3768-40-0x00007FFE94220000-0x00007FFE94CE1000-memory.dmp

Filesize
10.8MB

Download
memory/3768-130-0x00007FFE94220000-0x00007FFE94CE1000-memory.dmp

Filesize
10.8MB

Download
memory/3924-1991-0x00007FF65CDF0000-0x00007FF65D1E2000-memory.dmp

Filesize
3.9MB

Download
memory/3924-187-0x00007FF65CDF0000-0x00007FF65D1E2000-memory.dmp

Filesize
3.9MB

Download
memory/3952-2168-0x00007FF74C260000-0x00007FF74C652000-memory.dmp

Filesize
3.9MB

Download
memory/3952-171-0x00007FF74C260000-0x00007FF74C652000-memory.dmp

Filesize
3.9MB

Download
memory/4176-2188-0x00007FF69F640000-0x00007FF69FA32000-memory.dmp

Filesize
3.9MB

Download
memory/4176-179-0x00007FF69F640000-0x00007FF69FA32000-memory.dmp

Filesize
3.9MB

Download
memory/4216-55-0x00007FF729B00000-0x00007FF729EF2000-memory.dmp

Filesize
3.9MB

Download
memory/4216-1988-0x00007FF729B00000-0x00007FF729EF2000-memory.dmp

Filesize
3.9MB

Download
memory/4224-2184-0x00007FF631330000-0x00007FF631722000-memory.dmp

Filesize
3.9MB

Download
memory/4224-181-0x00007FF631330000-0x00007FF631722000-memory.dmp

Filesize
3.9MB

Download
memory/4412-0-0x00007FF74FE40000-0x00007FF750232000-memory.dmp

Filesize
3.9MB

Download
memory/4412-2647-0x00007FF74FE40000-0x00007FF750232000-memory.dmp

Filesize
3.9MB

Download
memory/4412-1-0x000001D3BE3B0000-0x000001D3BE3C0000-memory.dmp

Filesize
64KB

Download
memory/4500-186-0x00007FF7362F0000-0x00007FF7366E2000-memory.dmp

Filesize
3.9MB

Download
memory/4500-2507-0x00007FF7362F0000-0x00007FF7366E2000-memory.dmp

Filesize
3.9MB

Download
memory/4992-139-0x00007FF721A00000-0x00007FF721DF2000-memory.dmp

Filesize
3.9MB

Download
memory/4992-1985-0x00007FF721A00000-0x00007FF721DF2000-memory.dmp

Filesize
3.9MB

Download
memory/5024-143-0x00007FF7C3E70000-0x00007FF7C4262000-memory.dmp

Filesize
3.9MB

Download
memory/5024-2178-0x00007FF7C3E70000-0x00007FF7C4262000-memory.dmp

Filesize
3.9MB

Download