xmrig | 87c760e974c54d3d83f9c0c648ca45497aab8f8c2341aca072d5ec95c8042bd6

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
09/05/2024, 00:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

abfe601e3274f0ed27ccfb804a6902c0_NEIKI.exe
Size

3.1MB
MD5

abfe601e3274f0ed27ccfb804a6902c0
SHA1

859e794951b782eafaad7e5f61770b8a26a003f1
SHA256

87c760e974c54d3d83f9c0c648ca45497aab8f8c2341aca072d5ec95c8042bd6
SHA512

2239fff3f66c832b489592d930b888f7070af6a3c7428af3f97e92946acecc726abad7bf6f35446ae3f1b4f3d12f0a7cf4045c5ef6f64c34aed0cfcd48936e8d
SSDEEP

98304:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWM:SbBeSFkI

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 54 IoCs

miner

resource	yara_rule
behavioral1/files/0x00080000000155f7-22.dat	xmrig
behavioral1/files/0x0008000000015c52-39.dat	xmrig
behavioral1/files/0x0006000000015c9f-55.dat	xmrig
behavioral1/files/0x0009000000015626-62.dat	xmrig
behavioral1/memory/3012-53-0x000000013F320000-0x000000013F716000-memory.dmp	xmrig
behavioral1/files/0x0006000000015cce-78.dat	xmrig
behavioral1/files/0x0006000000015cee-83.dat	xmrig
behavioral1/files/0x0006000000015cfe-93.dat	xmrig
behavioral1/files/0x0006000000015d1a-108.dat	xmrig
behavioral1/files/0x0006000000015d31-123.dat	xmrig
behavioral1/memory/2160-118-0x000000013F430000-0x000000013F826000-memory.dmp	xmrig
behavioral1/files/0x0006000000015f7a-159.dat	xmrig
behavioral1/memory/2996-4696-0x000000013F580000-0x000000013F976000-memory.dmp	xmrig
behavioral1/memory/2628-4698-0x000000013FFD0000-0x00000001403C6000-memory.dmp	xmrig
behavioral1/memory/2488-4702-0x000000013F070000-0x000000013F466000-memory.dmp	xmrig
behavioral1/memory/2752-4701-0x000000013FFC0000-0x00000001403B6000-memory.dmp	xmrig
behavioral1/memory/2704-4700-0x000000013F7A0000-0x000000013FB96000-memory.dmp	xmrig
behavioral1/memory/2640-4699-0x000000013F660000-0x000000013FA56000-memory.dmp	xmrig
behavioral1/memory/2616-4697-0x000000013FF60000-0x0000000140356000-memory.dmp	xmrig
behavioral1/memory/2772-4695-0x000000013F570000-0x000000013F966000-memory.dmp	xmrig
behavioral1/memory/2160-4694-0x000000013F430000-0x000000013F826000-memory.dmp	xmrig
behavioral1/memory/3012-4693-0x000000013F320000-0x000000013F716000-memory.dmp	xmrig
behavioral1/files/0x000600000001650c-184.dat	xmrig
behavioral1/files/0x0006000000016448-177.dat	xmrig
behavioral1/files/0x0006000000016287-172.dat	xmrig
behavioral1/files/0x0006000000016176-169.dat	xmrig
behavioral1/files/0x00060000000160af-164.dat	xmrig
behavioral1/files/0x0006000000015f01-154.dat	xmrig
behavioral1/files/0x0006000000015d98-145.dat	xmrig
behavioral1/memory/2640-144-0x000000013F660000-0x000000013FA56000-memory.dmp	xmrig
behavioral1/memory/2616-143-0x000000013FF60000-0x0000000140356000-memory.dmp	xmrig
behavioral1/memory/2772-142-0x000000013F570000-0x000000013F966000-memory.dmp	xmrig
behavioral1/files/0x0006000000015df1-148.dat	xmrig
behavioral1/memory/2996-120-0x000000013F580000-0x000000013F976000-memory.dmp	xmrig
behavioral1/memory/2704-136-0x000000013F7A0000-0x000000013FB96000-memory.dmp	xmrig
behavioral1/memory/2488-135-0x000000013F070000-0x000000013F466000-memory.dmp	xmrig
behavioral1/memory/2752-130-0x000000013FFC0000-0x00000001403B6000-memory.dmp	xmrig
behavioral1/memory/2628-126-0x000000013FFD0000-0x00000001403C6000-memory.dmp	xmrig
behavioral1/files/0x0006000000015d27-113.dat	xmrig
behavioral1/files/0x0006000000015d0f-103.dat	xmrig
behavioral1/files/0x0006000000015d07-98.dat	xmrig
behavioral1/files/0x0006000000015cf6-88.dat	xmrig
behavioral1/files/0x0006000000015cb6-74.dat	xmrig
behavioral1/files/0x0006000000015c83-72.dat	xmrig
behavioral1/files/0x0007000000015c6b-70.dat	xmrig
behavioral1/files/0x0008000000015c3d-66.dat	xmrig
behavioral1/files/0x0009000000015b6f-38.dat	xmrig
behavioral1/files/0x0007000000015605-29.dat	xmrig
behavioral1/files/0x0009000000015626-23.dat	xmrig
behavioral1/files/0x00090000000149f5-18.dat	xmrig
behavioral1/files/0x0007000000015c78-57.dat	xmrig
behavioral1/files/0x000a000000015616-33.dat	xmrig
behavioral1/files/0x0009000000015018-11.dat	xmrig
behavioral1/memory/2888-1-0x000000013F530000-0x000000013F926000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
2768	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
3012	HDlgbEf.exe
2772	cIKxfIs.exe
2160	FudWoFG.exe
2996	tqMxKOI.exe
2616	KWSmnOB.exe
2628	WsZktZu.exe
2752	ePlrXEe.exe
2640	NhkUbFe.exe
2488	uOdzASO.exe
2704	NgpVCTs.exe
2104	IVGaOfz.exe
2776	sgJsONj.exe
2724	PqHmUWF.exe
2796	qvKuPiI.exe
1060	NVFxYud.exe
2176	VAeoFeM.exe
2804	wWjmION.exe
2352	HKHiMZP.exe
816	qcvsEhv.exe
1168	cHXzWeH.exe
1672	VhYRMhO.exe
2676	hJeUNXt.exe
1756	TXtaXQg.exe
2112	GQUDGjB.exe
1752	QusLTxe.exe
2652	voGwOLs.exe
596	tPHJytM.exe
1448	rxVDnbX.exe
576	MTbpOqL.exe
2304	eeHPjrB.exe
1716	YduAkuk.exe
1556	StKshOr.exe
444	ULrHUOq.exe
2444	mmqMjhK.exe
2364	cUmRPsN.exe
3040	CIlgAZf.exe
1532	nQuBYQH.exe
1800	UisGtCP.exe
616	XPddeyY.exe
1164	VZzsFMW.exe
1924	nqhYRRi.exe
1664	dHPKJlf.exe
1888	RPvlOPX.exe
1048	JhBPvJE.exe
1144	doUvMxH.exe
1648	klYNxna.exe
1580	eefswBq.exe
1116	hlnmpGG.exe
2972	EObgFfw.exe
2316	jhmRdhH.exe
1768	yOSPFXX.exe
2200	qOxZNKp.exe
2172	TyLxXBN.exe
1612	TzpaFBC.exe
1728	DXncetq.exe
3008	XvTYGGE.exe
2600	SUxEOdk.exe
2520	twbqHaR.exe
3032	KrlEJqh.exe
2792	nnAsrAo.exe
2592	ODMUbnX.exe
2476	CgqIcZP.exe
3056	tSswosT.exe
1984	tIjEykV.exe

Loads dropped DLL 64 IoCs

pid	Process
2888	abfe601e3274f0ed27ccfb804a6902c0_NEIKI.exe
2888	abfe601e3274f0ed27ccfb804a6902c0_NEIKI.exe
2888	abfe601e3274f0ed27ccfb804a6902c0_NEIKI.exe
2888	abfe601e3274f0ed27ccfb804a6902c0_NEIKI.exe
2888	abfe601e3274f0ed27ccfb804a6902c0_NEIKI.exe
2888	abfe601e3274f0ed27ccfb804a6902c0_NEIKI.exe
2888	abfe601e3274f0ed27ccfb804a6902c0_NEIKI.exe
2888	abfe601e3274f0ed27ccfb804a6902c0_NEIKI.exe
2888	abfe601e3274f0ed27ccfb804a6902c0_NEIKI.exe
2888	abfe601e3274f0ed27ccfb804a6902c0_NEIKI.exe
2888	abfe601e3274f0ed27ccfb804a6902c0_NEIKI.exe
2888	abfe601e3274f0ed27ccfb804a6902c0_NEIKI.exe
2888	abfe601e3274f0ed27ccfb804a6902c0_NEIKI.exe
2888	abfe601e3274f0ed27ccfb804a6902c0_NEIKI.exe
2888	abfe601e3274f0ed27ccfb804a6902c0_NEIKI.exe
2888	abfe601e3274f0ed27ccfb804a6902c0_NEIKI.exe
2888	abfe601e3274f0ed27ccfb804a6902c0_NEIKI.exe
2888	abfe601e3274f0ed27ccfb804a6902c0_NEIKI.exe
2888	abfe601e3274f0ed27ccfb804a6902c0_NEIKI.exe
2888	abfe601e3274f0ed27ccfb804a6902c0_NEIKI.exe
2888	abfe601e3274f0ed27ccfb804a6902c0_NEIKI.exe
2888	abfe601e3274f0ed27ccfb804a6902c0_NEIKI.exe
2888	abfe601e3274f0ed27ccfb804a6902c0_NEIKI.exe
2888	abfe601e3274f0ed27ccfb804a6902c0_NEIKI.exe
2888	abfe601e3274f0ed27ccfb804a6902c0_NEIKI.exe
2888	abfe601e3274f0ed27ccfb804a6902c0_NEIKI.exe
2888	abfe601e3274f0ed27ccfb804a6902c0_NEIKI.exe
2888	abfe601e3274f0ed27ccfb804a6902c0_NEIKI.exe
2888	abfe601e3274f0ed27ccfb804a6902c0_NEIKI.exe
2888	abfe601e3274f0ed27ccfb804a6902c0_NEIKI.exe
2888	abfe601e3274f0ed27ccfb804a6902c0_NEIKI.exe
2888	abfe601e3274f0ed27ccfb804a6902c0_NEIKI.exe
2888	abfe601e3274f0ed27ccfb804a6902c0_NEIKI.exe
2888	abfe601e3274f0ed27ccfb804a6902c0_NEIKI.exe
2888	abfe601e3274f0ed27ccfb804a6902c0_NEIKI.exe
2888	abfe601e3274f0ed27ccfb804a6902c0_NEIKI.exe
2888	abfe601e3274f0ed27ccfb804a6902c0_NEIKI.exe
2888	abfe601e3274f0ed27ccfb804a6902c0_NEIKI.exe
2888	abfe601e3274f0ed27ccfb804a6902c0_NEIKI.exe
2888	abfe601e3274f0ed27ccfb804a6902c0_NEIKI.exe
2888	abfe601e3274f0ed27ccfb804a6902c0_NEIKI.exe
2888	abfe601e3274f0ed27ccfb804a6902c0_NEIKI.exe
2888	abfe601e3274f0ed27ccfb804a6902c0_NEIKI.exe
2888	abfe601e3274f0ed27ccfb804a6902c0_NEIKI.exe
2888	abfe601e3274f0ed27ccfb804a6902c0_NEIKI.exe
2888	abfe601e3274f0ed27ccfb804a6902c0_NEIKI.exe
2888	abfe601e3274f0ed27ccfb804a6902c0_NEIKI.exe
2888	abfe601e3274f0ed27ccfb804a6902c0_NEIKI.exe
2888	abfe601e3274f0ed27ccfb804a6902c0_NEIKI.exe
2888	abfe601e3274f0ed27ccfb804a6902c0_NEIKI.exe
2888	abfe601e3274f0ed27ccfb804a6902c0_NEIKI.exe
2888	abfe601e3274f0ed27ccfb804a6902c0_NEIKI.exe
2888	abfe601e3274f0ed27ccfb804a6902c0_NEIKI.exe
2888	abfe601e3274f0ed27ccfb804a6902c0_NEIKI.exe
2888	abfe601e3274f0ed27ccfb804a6902c0_NEIKI.exe
2888	abfe601e3274f0ed27ccfb804a6902c0_NEIKI.exe
2888	abfe601e3274f0ed27ccfb804a6902c0_NEIKI.exe
2888	abfe601e3274f0ed27ccfb804a6902c0_NEIKI.exe
2888	abfe601e3274f0ed27ccfb804a6902c0_NEIKI.exe
2888	abfe601e3274f0ed27ccfb804a6902c0_NEIKI.exe
2888	abfe601e3274f0ed27ccfb804a6902c0_NEIKI.exe
2888	abfe601e3274f0ed27ccfb804a6902c0_NEIKI.exe
2888	abfe601e3274f0ed27ccfb804a6902c0_NEIKI.exe
2888	abfe601e3274f0ed27ccfb804a6902c0_NEIKI.exe

UPX packed file 55 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x00080000000155f7-22.dat	upx
behavioral1/files/0x0008000000015c52-39.dat	upx
behavioral1/files/0x0006000000015c9f-55.dat	upx
behavioral1/files/0x0009000000015626-62.dat	upx
behavioral1/memory/3012-53-0x000000013F320000-0x000000013F716000-memory.dmp	upx
behavioral1/files/0x0006000000015cce-78.dat	upx
behavioral1/files/0x0006000000015cee-83.dat	upx
behavioral1/files/0x0006000000015cfe-93.dat	upx
behavioral1/files/0x0006000000015d1a-108.dat	upx
behavioral1/files/0x0006000000015d31-123.dat	upx
behavioral1/memory/2160-118-0x000000013F430000-0x000000013F826000-memory.dmp	upx
behavioral1/files/0x0006000000015f7a-159.dat	upx
behavioral1/memory/2996-4696-0x000000013F580000-0x000000013F976000-memory.dmp	upx
behavioral1/memory/2628-4698-0x000000013FFD0000-0x00000001403C6000-memory.dmp	upx
behavioral1/memory/2488-4702-0x000000013F070000-0x000000013F466000-memory.dmp	upx
behavioral1/memory/2752-4701-0x000000013FFC0000-0x00000001403B6000-memory.dmp	upx
behavioral1/memory/2704-4700-0x000000013F7A0000-0x000000013FB96000-memory.dmp	upx
behavioral1/memory/2640-4699-0x000000013F660000-0x000000013FA56000-memory.dmp	upx
behavioral1/memory/2616-4697-0x000000013FF60000-0x0000000140356000-memory.dmp	upx
behavioral1/memory/2772-4695-0x000000013F570000-0x000000013F966000-memory.dmp	upx
behavioral1/memory/2160-4694-0x000000013F430000-0x000000013F826000-memory.dmp	upx
behavioral1/memory/3012-4693-0x000000013F320000-0x000000013F716000-memory.dmp	upx
behavioral1/files/0x000600000001650c-184.dat	upx
behavioral1/files/0x0006000000016448-179.dat	upx
behavioral1/files/0x0006000000016448-177.dat	upx
behavioral1/files/0x0006000000016287-172.dat	upx
behavioral1/files/0x0006000000016176-169.dat	upx
behavioral1/files/0x00060000000160af-164.dat	upx
behavioral1/files/0x0006000000015f01-154.dat	upx
behavioral1/files/0x0006000000015d98-145.dat	upx
behavioral1/memory/2640-144-0x000000013F660000-0x000000013FA56000-memory.dmp	upx
behavioral1/memory/2616-143-0x000000013FF60000-0x0000000140356000-memory.dmp	upx
behavioral1/memory/2772-142-0x000000013F570000-0x000000013F966000-memory.dmp	upx
behavioral1/files/0x0006000000015df1-148.dat	upx
behavioral1/memory/2996-120-0x000000013F580000-0x000000013F976000-memory.dmp	upx
behavioral1/memory/2704-136-0x000000013F7A0000-0x000000013FB96000-memory.dmp	upx
behavioral1/memory/2488-135-0x000000013F070000-0x000000013F466000-memory.dmp	upx
behavioral1/memory/2752-130-0x000000013FFC0000-0x00000001403B6000-memory.dmp	upx
behavioral1/memory/2628-126-0x000000013FFD0000-0x00000001403C6000-memory.dmp	upx
behavioral1/files/0x0006000000015d27-113.dat	upx
behavioral1/files/0x0006000000015d0f-103.dat	upx
behavioral1/files/0x0006000000015d07-98.dat	upx
behavioral1/files/0x0006000000015cf6-88.dat	upx
behavioral1/files/0x0006000000015cb6-74.dat	upx
behavioral1/files/0x0006000000015c83-72.dat	upx
behavioral1/files/0x0007000000015c6b-70.dat	upx
behavioral1/files/0x0008000000015c3d-66.dat	upx
behavioral1/files/0x0009000000015b6f-38.dat	upx
behavioral1/files/0x0007000000015605-29.dat	upx
behavioral1/files/0x0009000000015626-23.dat	upx
behavioral1/files/0x00090000000149f5-18.dat	upx
behavioral1/files/0x0007000000015c78-57.dat	upx
behavioral1/files/0x000a000000015616-33.dat	upx
behavioral1/files/0x0009000000015018-11.dat	upx
behavioral1/memory/2888-1-0x000000013F530000-0x000000013F926000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\TiatkkH.exe	abfe601e3274f0ed27ccfb804a6902c0_NEIKI.exe
File created	C:\Windows\System\eJesjjU.exe	abfe601e3274f0ed27ccfb804a6902c0_NEIKI.exe
File created	C:\Windows\System\mJyiBTo.exe	abfe601e3274f0ed27ccfb804a6902c0_NEIKI.exe
File created	C:\Windows\System\aSlWmdt.exe	abfe601e3274f0ed27ccfb804a6902c0_NEIKI.exe
File created	C:\Windows\System\yAsxflz.exe	abfe601e3274f0ed27ccfb804a6902c0_NEIKI.exe
File created	C:\Windows\System\pEGAADZ.exe	abfe601e3274f0ed27ccfb804a6902c0_NEIKI.exe
File created	C:\Windows\System\rnepqBT.exe	abfe601e3274f0ed27ccfb804a6902c0_NEIKI.exe
File created	C:\Windows\System\idRZBKy.exe	abfe601e3274f0ed27ccfb804a6902c0_NEIKI.exe
File created	C:\Windows\System\lEzAlHt.exe	abfe601e3274f0ed27ccfb804a6902c0_NEIKI.exe
File created	C:\Windows\System\VBuQqRF.exe	abfe601e3274f0ed27ccfb804a6902c0_NEIKI.exe
File created	C:\Windows\System\SVIQcxa.exe	abfe601e3274f0ed27ccfb804a6902c0_NEIKI.exe
File created	C:\Windows\System\wpMeOkR.exe	abfe601e3274f0ed27ccfb804a6902c0_NEIKI.exe
File created	C:\Windows\System\FudWoFG.exe	abfe601e3274f0ed27ccfb804a6902c0_NEIKI.exe
File created	C:\Windows\System\mNJLvjF.exe	abfe601e3274f0ed27ccfb804a6902c0_NEIKI.exe
File created	C:\Windows\System\xSTQoTX.exe	abfe601e3274f0ed27ccfb804a6902c0_NEIKI.exe
File created	C:\Windows\System\FtWVrJe.exe	abfe601e3274f0ed27ccfb804a6902c0_NEIKI.exe
File created	C:\Windows\System\lgHOKVC.exe	abfe601e3274f0ed27ccfb804a6902c0_NEIKI.exe
File created	C:\Windows\System\XGyhJLY.exe	abfe601e3274f0ed27ccfb804a6902c0_NEIKI.exe
File created	C:\Windows\System\UcwJCep.exe	abfe601e3274f0ed27ccfb804a6902c0_NEIKI.exe
File created	C:\Windows\System\adeXuZO.exe	abfe601e3274f0ed27ccfb804a6902c0_NEIKI.exe
File created	C:\Windows\System\tdZiIWy.exe	abfe601e3274f0ed27ccfb804a6902c0_NEIKI.exe
File created	C:\Windows\System\iDcpRmw.exe	abfe601e3274f0ed27ccfb804a6902c0_NEIKI.exe
File created	C:\Windows\System\TyLxXBN.exe	abfe601e3274f0ed27ccfb804a6902c0_NEIKI.exe
File created	C:\Windows\System\qhJtgkS.exe	abfe601e3274f0ed27ccfb804a6902c0_NEIKI.exe
File created	C:\Windows\System\ZHzuOKh.exe	abfe601e3274f0ed27ccfb804a6902c0_NEIKI.exe
File created	C:\Windows\System\ULvMTtL.exe	abfe601e3274f0ed27ccfb804a6902c0_NEIKI.exe
File created	C:\Windows\System\ieIrabd.exe	abfe601e3274f0ed27ccfb804a6902c0_NEIKI.exe
File created	C:\Windows\System\VWcyAaP.exe	abfe601e3274f0ed27ccfb804a6902c0_NEIKI.exe
File created	C:\Windows\System\TcgAiZT.exe	abfe601e3274f0ed27ccfb804a6902c0_NEIKI.exe
File created	C:\Windows\System\nrtcUDC.exe	abfe601e3274f0ed27ccfb804a6902c0_NEIKI.exe
File created	C:\Windows\System\bxFRpWD.exe	abfe601e3274f0ed27ccfb804a6902c0_NEIKI.exe
File created	C:\Windows\System\LNxXXZR.exe	abfe601e3274f0ed27ccfb804a6902c0_NEIKI.exe
File created	C:\Windows\System\tVDUnvN.exe	abfe601e3274f0ed27ccfb804a6902c0_NEIKI.exe
File created	C:\Windows\System\bexdjxM.exe	abfe601e3274f0ed27ccfb804a6902c0_NEIKI.exe
File created	C:\Windows\System\yqZfYmf.exe	abfe601e3274f0ed27ccfb804a6902c0_NEIKI.exe
File created	C:\Windows\System\DrZWwLG.exe	abfe601e3274f0ed27ccfb804a6902c0_NEIKI.exe
File created	C:\Windows\System\AhxXbjb.exe	abfe601e3274f0ed27ccfb804a6902c0_NEIKI.exe
File created	C:\Windows\System\ZjjkAuN.exe	abfe601e3274f0ed27ccfb804a6902c0_NEIKI.exe
File created	C:\Windows\System\LabjqWN.exe	abfe601e3274f0ed27ccfb804a6902c0_NEIKI.exe
File created	C:\Windows\System\nQuBYQH.exe	abfe601e3274f0ed27ccfb804a6902c0_NEIKI.exe
File created	C:\Windows\System\HHYXUOC.exe	abfe601e3274f0ed27ccfb804a6902c0_NEIKI.exe
File created	C:\Windows\System\JesyZCj.exe	abfe601e3274f0ed27ccfb804a6902c0_NEIKI.exe
File created	C:\Windows\System\ATLoIrO.exe	abfe601e3274f0ed27ccfb804a6902c0_NEIKI.exe
File created	C:\Windows\System\yRLSbmr.exe	abfe601e3274f0ed27ccfb804a6902c0_NEIKI.exe
File created	C:\Windows\System\wCgrKii.exe	abfe601e3274f0ed27ccfb804a6902c0_NEIKI.exe
File created	C:\Windows\System\FDbcdSU.exe	abfe601e3274f0ed27ccfb804a6902c0_NEIKI.exe
File created	C:\Windows\System\QlMavMZ.exe	abfe601e3274f0ed27ccfb804a6902c0_NEIKI.exe
File created	C:\Windows\System\ZIJRHwP.exe	abfe601e3274f0ed27ccfb804a6902c0_NEIKI.exe
File created	C:\Windows\System\lwZTksy.exe	abfe601e3274f0ed27ccfb804a6902c0_NEIKI.exe
File created	C:\Windows\System\atDghbt.exe	abfe601e3274f0ed27ccfb804a6902c0_NEIKI.exe
File created	C:\Windows\System\qoLVGxG.exe	abfe601e3274f0ed27ccfb804a6902c0_NEIKI.exe
File created	C:\Windows\System\YZRVvKf.exe	abfe601e3274f0ed27ccfb804a6902c0_NEIKI.exe
File created	C:\Windows\System\mdqBdQk.exe	abfe601e3274f0ed27ccfb804a6902c0_NEIKI.exe
File created	C:\Windows\System\JedUSqV.exe	abfe601e3274f0ed27ccfb804a6902c0_NEIKI.exe
File created	C:\Windows\System\BUmiOxF.exe	abfe601e3274f0ed27ccfb804a6902c0_NEIKI.exe
File created	C:\Windows\System\IPjjQci.exe	abfe601e3274f0ed27ccfb804a6902c0_NEIKI.exe
File created	C:\Windows\System\caOEOLl.exe	abfe601e3274f0ed27ccfb804a6902c0_NEIKI.exe
File created	C:\Windows\System\SnjAhaS.exe	abfe601e3274f0ed27ccfb804a6902c0_NEIKI.exe
File created	C:\Windows\System\zsQbqPO.exe	abfe601e3274f0ed27ccfb804a6902c0_NEIKI.exe
File created	C:\Windows\System\uGDQMtD.exe	abfe601e3274f0ed27ccfb804a6902c0_NEIKI.exe
File created	C:\Windows\System\mHYcTsk.exe	abfe601e3274f0ed27ccfb804a6902c0_NEIKI.exe
File created	C:\Windows\System\NxMIScl.exe	abfe601e3274f0ed27ccfb804a6902c0_NEIKI.exe
File created	C:\Windows\System\PeSqMgj.exe	abfe601e3274f0ed27ccfb804a6902c0_NEIKI.exe
File created	C:\Windows\System\kIAXaCl.exe	abfe601e3274f0ed27ccfb804a6902c0_NEIKI.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2768	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2888	abfe601e3274f0ed27ccfb804a6902c0_NEIKI.exe
Token: SeLockMemoryPrivilege	2888	abfe601e3274f0ed27ccfb804a6902c0_NEIKI.exe
Token: SeDebugPrivilege	2768	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2888 wrote to memory of 2768	2888	abfe601e3274f0ed27ccfb804a6902c0_NEIKI.exe	29
PID 2888 wrote to memory of 2768	2888	abfe601e3274f0ed27ccfb804a6902c0_NEIKI.exe	29
PID 2888 wrote to memory of 2768	2888	abfe601e3274f0ed27ccfb804a6902c0_NEIKI.exe	29
PID 2888 wrote to memory of 2772	2888	abfe601e3274f0ed27ccfb804a6902c0_NEIKI.exe	30
PID 2888 wrote to memory of 2772	2888	abfe601e3274f0ed27ccfb804a6902c0_NEIKI.exe	30
PID 2888 wrote to memory of 2772	2888	abfe601e3274f0ed27ccfb804a6902c0_NEIKI.exe	30
PID 2888 wrote to memory of 3012	2888	abfe601e3274f0ed27ccfb804a6902c0_NEIKI.exe	31
PID 2888 wrote to memory of 3012	2888	abfe601e3274f0ed27ccfb804a6902c0_NEIKI.exe	31
PID 2888 wrote to memory of 3012	2888	abfe601e3274f0ed27ccfb804a6902c0_NEIKI.exe	31
PID 2888 wrote to memory of 2160	2888	abfe601e3274f0ed27ccfb804a6902c0_NEIKI.exe	32
PID 2888 wrote to memory of 2160	2888	abfe601e3274f0ed27ccfb804a6902c0_NEIKI.exe	32
PID 2888 wrote to memory of 2160	2888	abfe601e3274f0ed27ccfb804a6902c0_NEIKI.exe	32
PID 2888 wrote to memory of 2996	2888	abfe601e3274f0ed27ccfb804a6902c0_NEIKI.exe	33
PID 2888 wrote to memory of 2996	2888	abfe601e3274f0ed27ccfb804a6902c0_NEIKI.exe	33
PID 2888 wrote to memory of 2996	2888	abfe601e3274f0ed27ccfb804a6902c0_NEIKI.exe	33
PID 2888 wrote to memory of 2616	2888	abfe601e3274f0ed27ccfb804a6902c0_NEIKI.exe	34
PID 2888 wrote to memory of 2616	2888	abfe601e3274f0ed27ccfb804a6902c0_NEIKI.exe	34
PID 2888 wrote to memory of 2616	2888	abfe601e3274f0ed27ccfb804a6902c0_NEIKI.exe	34
PID 2888 wrote to memory of 2704	2888	abfe601e3274f0ed27ccfb804a6902c0_NEIKI.exe	35
PID 2888 wrote to memory of 2704	2888	abfe601e3274f0ed27ccfb804a6902c0_NEIKI.exe	35
PID 2888 wrote to memory of 2704	2888	abfe601e3274f0ed27ccfb804a6902c0_NEIKI.exe	35
PID 2888 wrote to memory of 2628	2888	abfe601e3274f0ed27ccfb804a6902c0_NEIKI.exe	36
PID 2888 wrote to memory of 2628	2888	abfe601e3274f0ed27ccfb804a6902c0_NEIKI.exe	36
PID 2888 wrote to memory of 2628	2888	abfe601e3274f0ed27ccfb804a6902c0_NEIKI.exe	36
PID 2888 wrote to memory of 2104	2888	abfe601e3274f0ed27ccfb804a6902c0_NEIKI.exe	37
PID 2888 wrote to memory of 2104	2888	abfe601e3274f0ed27ccfb804a6902c0_NEIKI.exe	37
PID 2888 wrote to memory of 2104	2888	abfe601e3274f0ed27ccfb804a6902c0_NEIKI.exe	37
PID 2888 wrote to memory of 2752	2888	abfe601e3274f0ed27ccfb804a6902c0_NEIKI.exe	38
PID 2888 wrote to memory of 2752	2888	abfe601e3274f0ed27ccfb804a6902c0_NEIKI.exe	38
PID 2888 wrote to memory of 2752	2888	abfe601e3274f0ed27ccfb804a6902c0_NEIKI.exe	38
PID 2888 wrote to memory of 2776	2888	abfe601e3274f0ed27ccfb804a6902c0_NEIKI.exe	39
PID 2888 wrote to memory of 2776	2888	abfe601e3274f0ed27ccfb804a6902c0_NEIKI.exe	39
PID 2888 wrote to memory of 2776	2888	abfe601e3274f0ed27ccfb804a6902c0_NEIKI.exe	39
PID 2888 wrote to memory of 2640	2888	abfe601e3274f0ed27ccfb804a6902c0_NEIKI.exe	40
PID 2888 wrote to memory of 2640	2888	abfe601e3274f0ed27ccfb804a6902c0_NEIKI.exe	40
PID 2888 wrote to memory of 2640	2888	abfe601e3274f0ed27ccfb804a6902c0_NEIKI.exe	40
PID 2888 wrote to memory of 2724	2888	abfe601e3274f0ed27ccfb804a6902c0_NEIKI.exe	41
PID 2888 wrote to memory of 2724	2888	abfe601e3274f0ed27ccfb804a6902c0_NEIKI.exe	41
PID 2888 wrote to memory of 2724	2888	abfe601e3274f0ed27ccfb804a6902c0_NEIKI.exe	41
PID 2888 wrote to memory of 2488	2888	abfe601e3274f0ed27ccfb804a6902c0_NEIKI.exe	42
PID 2888 wrote to memory of 2488	2888	abfe601e3274f0ed27ccfb804a6902c0_NEIKI.exe	42
PID 2888 wrote to memory of 2488	2888	abfe601e3274f0ed27ccfb804a6902c0_NEIKI.exe	42
PID 2888 wrote to memory of 2796	2888	abfe601e3274f0ed27ccfb804a6902c0_NEIKI.exe	43
PID 2888 wrote to memory of 2796	2888	abfe601e3274f0ed27ccfb804a6902c0_NEIKI.exe	43
PID 2888 wrote to memory of 2796	2888	abfe601e3274f0ed27ccfb804a6902c0_NEIKI.exe	43
PID 2888 wrote to memory of 1060	2888	abfe601e3274f0ed27ccfb804a6902c0_NEIKI.exe	44
PID 2888 wrote to memory of 1060	2888	abfe601e3274f0ed27ccfb804a6902c0_NEIKI.exe	44
PID 2888 wrote to memory of 1060	2888	abfe601e3274f0ed27ccfb804a6902c0_NEIKI.exe	44
PID 2888 wrote to memory of 2176	2888	abfe601e3274f0ed27ccfb804a6902c0_NEIKI.exe	45
PID 2888 wrote to memory of 2176	2888	abfe601e3274f0ed27ccfb804a6902c0_NEIKI.exe	45
PID 2888 wrote to memory of 2176	2888	abfe601e3274f0ed27ccfb804a6902c0_NEIKI.exe	45
PID 2888 wrote to memory of 2804	2888	abfe601e3274f0ed27ccfb804a6902c0_NEIKI.exe	46
PID 2888 wrote to memory of 2804	2888	abfe601e3274f0ed27ccfb804a6902c0_NEIKI.exe	46
PID 2888 wrote to memory of 2804	2888	abfe601e3274f0ed27ccfb804a6902c0_NEIKI.exe	46
PID 2888 wrote to memory of 2352	2888	abfe601e3274f0ed27ccfb804a6902c0_NEIKI.exe	47
PID 2888 wrote to memory of 2352	2888	abfe601e3274f0ed27ccfb804a6902c0_NEIKI.exe	47
PID 2888 wrote to memory of 2352	2888	abfe601e3274f0ed27ccfb804a6902c0_NEIKI.exe	47
PID 2888 wrote to memory of 816	2888	abfe601e3274f0ed27ccfb804a6902c0_NEIKI.exe	48
PID 2888 wrote to memory of 816	2888	abfe601e3274f0ed27ccfb804a6902c0_NEIKI.exe	48
PID 2888 wrote to memory of 816	2888	abfe601e3274f0ed27ccfb804a6902c0_NEIKI.exe	48
PID 2888 wrote to memory of 1168	2888	abfe601e3274f0ed27ccfb804a6902c0_NEIKI.exe	49
PID 2888 wrote to memory of 1168	2888	abfe601e3274f0ed27ccfb804a6902c0_NEIKI.exe	49
PID 2888 wrote to memory of 1168	2888	abfe601e3274f0ed27ccfb804a6902c0_NEIKI.exe	49
PID 2888 wrote to memory of 1672	2888	abfe601e3274f0ed27ccfb804a6902c0_NEIKI.exe	50

C:\Users\Admin\AppData\Local\Temp\abfe601e3274f0ed27ccfb804a6902c0_NEIKI.exe
"C:\Users\Admin\AppData\Local\Temp\abfe601e3274f0ed27ccfb804a6902c0_NEIKI.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2888
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2768
- C:\Windows\System\cIKxfIs.exe
  C:\Windows\System\cIKxfIs.exe
  2⤵
  - Executes dropped EXE
  PID:2772
- C:\Windows\System\HDlgbEf.exe
  C:\Windows\System\HDlgbEf.exe
  2⤵
  - Executes dropped EXE
  PID:3012
- C:\Windows\System\FudWoFG.exe
  C:\Windows\System\FudWoFG.exe
  2⤵
  - Executes dropped EXE
  PID:2160
- C:\Windows\System\tqMxKOI.exe
  C:\Windows\System\tqMxKOI.exe
  2⤵
  - Executes dropped EXE
  PID:2996
- C:\Windows\System\KWSmnOB.exe
  C:\Windows\System\KWSmnOB.exe
  2⤵
  - Executes dropped EXE
  PID:2616
- C:\Windows\System\NgpVCTs.exe
  C:\Windows\System\NgpVCTs.exe
  2⤵
  - Executes dropped EXE
  PID:2704
- C:\Windows\System\WsZktZu.exe
  C:\Windows\System\WsZktZu.exe
  2⤵
  - Executes dropped EXE
  PID:2628
- C:\Windows\System\IVGaOfz.exe
  C:\Windows\System\IVGaOfz.exe
  2⤵
  - Executes dropped EXE
  PID:2104
- C:\Windows\System\ePlrXEe.exe
  C:\Windows\System\ePlrXEe.exe
  2⤵
  - Executes dropped EXE
  PID:2752
- C:\Windows\System\sgJsONj.exe
  C:\Windows\System\sgJsONj.exe
  2⤵
  - Executes dropped EXE
  PID:2776
- C:\Windows\System\NhkUbFe.exe
  C:\Windows\System\NhkUbFe.exe
  2⤵
  - Executes dropped EXE
  PID:2640
- C:\Windows\System\PqHmUWF.exe
  C:\Windows\System\PqHmUWF.exe
  2⤵
  - Executes dropped EXE
  PID:2724
- C:\Windows\System\uOdzASO.exe
  C:\Windows\System\uOdzASO.exe
  2⤵
  - Executes dropped EXE
  PID:2488
- C:\Windows\System\qvKuPiI.exe
  C:\Windows\System\qvKuPiI.exe
  2⤵
  - Executes dropped EXE
  PID:2796
- C:\Windows\System\NVFxYud.exe
  C:\Windows\System\NVFxYud.exe
  2⤵
  - Executes dropped EXE
  PID:1060
- C:\Windows\System\VAeoFeM.exe
  C:\Windows\System\VAeoFeM.exe
  2⤵
  - Executes dropped EXE
  PID:2176
- C:\Windows\System\wWjmION.exe
  C:\Windows\System\wWjmION.exe
  2⤵
  - Executes dropped EXE
  PID:2804
- C:\Windows\System\HKHiMZP.exe
  C:\Windows\System\HKHiMZP.exe
  2⤵
  - Executes dropped EXE
  PID:2352
- C:\Windows\System\qcvsEhv.exe
  C:\Windows\System\qcvsEhv.exe
  2⤵
  - Executes dropped EXE
  PID:816
- C:\Windows\System\cHXzWeH.exe
  C:\Windows\System\cHXzWeH.exe
  2⤵
  - Executes dropped EXE
  PID:1168
- C:\Windows\System\VhYRMhO.exe
  C:\Windows\System\VhYRMhO.exe
  2⤵
  - Executes dropped EXE
  PID:1672
- C:\Windows\System\hJeUNXt.exe
  C:\Windows\System\hJeUNXt.exe
  2⤵
  - Executes dropped EXE
  PID:2676
- C:\Windows\System\TXtaXQg.exe
  C:\Windows\System\TXtaXQg.exe
  2⤵
  - Executes dropped EXE
  PID:1756
- C:\Windows\System\GQUDGjB.exe
  C:\Windows\System\GQUDGjB.exe
  2⤵
  - Executes dropped EXE
  PID:2112
- C:\Windows\System\QusLTxe.exe
  C:\Windows\System\QusLTxe.exe
  2⤵
  - Executes dropped EXE
  PID:1752
- C:\Windows\System\voGwOLs.exe
  C:\Windows\System\voGwOLs.exe
  2⤵
  - Executes dropped EXE
  PID:2652
- C:\Windows\System\tPHJytM.exe
  C:\Windows\System\tPHJytM.exe
  2⤵
  - Executes dropped EXE
  PID:596
- C:\Windows\System\rxVDnbX.exe
  C:\Windows\System\rxVDnbX.exe
  2⤵
  - Executes dropped EXE
  PID:1448
- C:\Windows\System\MTbpOqL.exe
  C:\Windows\System\MTbpOqL.exe
  2⤵
  - Executes dropped EXE
  PID:576
- C:\Windows\System\eeHPjrB.exe
  C:\Windows\System\eeHPjrB.exe
  2⤵
  - Executes dropped EXE
  PID:2304
- C:\Windows\System\YduAkuk.exe
  C:\Windows\System\YduAkuk.exe
  2⤵
  - Executes dropped EXE
  PID:1716
- C:\Windows\System\StKshOr.exe
  C:\Windows\System\StKshOr.exe
  2⤵
  - Executes dropped EXE
  PID:1556
- C:\Windows\System\ULrHUOq.exe
  C:\Windows\System\ULrHUOq.exe
  2⤵
  - Executes dropped EXE
  PID:444
- C:\Windows\System\mmqMjhK.exe
  C:\Windows\System\mmqMjhK.exe
  2⤵
  - Executes dropped EXE
  PID:2444
- C:\Windows\System\cUmRPsN.exe
  C:\Windows\System\cUmRPsN.exe
  2⤵
  - Executes dropped EXE
  PID:2364
- C:\Windows\System\CIlgAZf.exe
  C:\Windows\System\CIlgAZf.exe
  2⤵
  - Executes dropped EXE
  PID:3040
- C:\Windows\System\nQuBYQH.exe
  C:\Windows\System\nQuBYQH.exe
  2⤵
  - Executes dropped EXE
  PID:1532
- C:\Windows\System\UisGtCP.exe
  C:\Windows\System\UisGtCP.exe
  2⤵
  - Executes dropped EXE
  PID:1800
- C:\Windows\System\XPddeyY.exe
  C:\Windows\System\XPddeyY.exe
  2⤵
  - Executes dropped EXE
  PID:616
- C:\Windows\System\VZzsFMW.exe
  C:\Windows\System\VZzsFMW.exe
  2⤵
  - Executes dropped EXE
  PID:1164
- C:\Windows\System\nqhYRRi.exe
  C:\Windows\System\nqhYRRi.exe
  2⤵
  - Executes dropped EXE
  PID:1924
- C:\Windows\System\RPvlOPX.exe
  C:\Windows\System\RPvlOPX.exe
  2⤵
  - Executes dropped EXE
  PID:1888
- C:\Windows\System\dHPKJlf.exe
  C:\Windows\System\dHPKJlf.exe
  2⤵
  - Executes dropped EXE
  PID:1664
- C:\Windows\System\JhBPvJE.exe
  C:\Windows\System\JhBPvJE.exe
  2⤵
  - Executes dropped EXE
  PID:1048
- C:\Windows\System\doUvMxH.exe
  C:\Windows\System\doUvMxH.exe
  2⤵
  - Executes dropped EXE
  PID:1144
- C:\Windows\System\klYNxna.exe
  C:\Windows\System\klYNxna.exe
  2⤵
  - Executes dropped EXE
  PID:1648
- C:\Windows\System\eefswBq.exe
  C:\Windows\System\eefswBq.exe
  2⤵
  - Executes dropped EXE
  PID:1580
- C:\Windows\System\hlnmpGG.exe
  C:\Windows\System\hlnmpGG.exe
  2⤵
  - Executes dropped EXE
  PID:1116
- C:\Windows\System\EObgFfw.exe
  C:\Windows\System\EObgFfw.exe
  2⤵
  - Executes dropped EXE
  PID:2972
- C:\Windows\System\jhmRdhH.exe
  C:\Windows\System\jhmRdhH.exe
  2⤵
  - Executes dropped EXE
  PID:2316
- C:\Windows\System\yOSPFXX.exe
  C:\Windows\System\yOSPFXX.exe
  2⤵
  - Executes dropped EXE
  PID:1768
- C:\Windows\System\qOxZNKp.exe
  C:\Windows\System\qOxZNKp.exe
  2⤵
  - Executes dropped EXE
  PID:2200
- C:\Windows\System\TyLxXBN.exe
  C:\Windows\System\TyLxXBN.exe
  2⤵
  - Executes dropped EXE
  PID:2172
- C:\Windows\System\TzpaFBC.exe
  C:\Windows\System\TzpaFBC.exe
  2⤵
  - Executes dropped EXE
  PID:1612
- C:\Windows\System\DXncetq.exe
  C:\Windows\System\DXncetq.exe
  2⤵
  - Executes dropped EXE
  PID:1728
- C:\Windows\System\XvTYGGE.exe
  C:\Windows\System\XvTYGGE.exe
  2⤵
  - Executes dropped EXE
  PID:3008
- C:\Windows\System\SUxEOdk.exe
  C:\Windows\System\SUxEOdk.exe
  2⤵
  - Executes dropped EXE
  PID:2600
- C:\Windows\System\twbqHaR.exe
  C:\Windows\System\twbqHaR.exe
  2⤵
  - Executes dropped EXE
  PID:2520
- C:\Windows\System\KrlEJqh.exe
  C:\Windows\System\KrlEJqh.exe
  2⤵
  - Executes dropped EXE
  PID:3032
- C:\Windows\System\nnAsrAo.exe
  C:\Windows\System\nnAsrAo.exe
  2⤵
  - Executes dropped EXE
  PID:2792
- C:\Windows\System\ODMUbnX.exe
  C:\Windows\System\ODMUbnX.exe
  2⤵
  - Executes dropped EXE
  PID:2592
- C:\Windows\System\CgqIcZP.exe
  C:\Windows\System\CgqIcZP.exe
  2⤵
  - Executes dropped EXE
  PID:2476
- C:\Windows\System\tSswosT.exe
  C:\Windows\System\tSswosT.exe
  2⤵
  - Executes dropped EXE
  PID:3056
- C:\Windows\System\wpekbPX.exe
  C:\Windows\System\wpekbPX.exe
  2⤵
  PID:2036
- C:\Windows\System\tIjEykV.exe
  C:\Windows\System\tIjEykV.exe
  2⤵
  - Executes dropped EXE
  PID:1984
- C:\Windows\System\rlYamIH.exe
  C:\Windows\System\rlYamIH.exe
  2⤵
  PID:1816
- C:\Windows\System\olPWjkd.exe
  C:\Windows\System\olPWjkd.exe
  2⤵
  PID:928
- C:\Windows\System\FAeLTYf.exe
  C:\Windows\System\FAeLTYf.exe
  2⤵
  PID:764
- C:\Windows\System\QRZJqrc.exe
  C:\Windows\System\QRZJqrc.exe
  2⤵
  PID:2272
- C:\Windows\System\byUurEv.exe
  C:\Windows\System\byUurEv.exe
  2⤵
  PID:1548
- C:\Windows\System\MXIBLai.exe
  C:\Windows\System\MXIBLai.exe
  2⤵
  PID:2296
- C:\Windows\System\qmTrRRo.exe
  C:\Windows\System\qmTrRRo.exe
  2⤵
  PID:1292
- C:\Windows\System\DsrCGbX.exe
  C:\Windows\System\DsrCGbX.exe
  2⤵
  PID:1496
- C:\Windows\System\AyfAMFB.exe
  C:\Windows\System\AyfAMFB.exe
  2⤵
  PID:2372
- C:\Windows\System\hkeoUHw.exe
  C:\Windows\System\hkeoUHw.exe
  2⤵
  PID:2436
- C:\Windows\System\YwDTOzW.exe
  C:\Windows\System\YwDTOzW.exe
  2⤵
  PID:2432
- C:\Windows\System\sBUJjhA.exe
  C:\Windows\System\sBUJjhA.exe
  2⤵
  PID:1560
- C:\Windows\System\LtCpvyx.exe
  C:\Windows\System\LtCpvyx.exe
  2⤵
  PID:2092
- C:\Windows\System\VLvsQGK.exe
  C:\Windows\System\VLvsQGK.exe
  2⤵
  PID:1904
- C:\Windows\System\TryDEVK.exe
  C:\Windows\System\TryDEVK.exe
  2⤵
  PID:844
- C:\Windows\System\bxFRpWD.exe
  C:\Windows\System\bxFRpWD.exe
  2⤵
  PID:1700
- C:\Windows\System\StDkpVR.exe
  C:\Windows\System\StDkpVR.exe
  2⤵
  PID:1892
- C:\Windows\System\RiApVFe.exe
  C:\Windows\System\RiApVFe.exe
  2⤵
  PID:564
- C:\Windows\System\AtAbvLi.exe
  C:\Windows\System\AtAbvLi.exe
  2⤵
  PID:1092
- C:\Windows\System\UoEJFVG.exe
  C:\Windows\System\UoEJFVG.exe
  2⤵
  PID:2872
- C:\Windows\System\UtrdEtq.exe
  C:\Windows\System\UtrdEtq.exe
  2⤵
  PID:2180
- C:\Windows\System\oNaMvqe.exe
  C:\Windows\System\oNaMvqe.exe
  2⤵
  PID:2952
- C:\Windows\System\iWqPgos.exe
  C:\Windows\System\iWqPgos.exe
  2⤵
  PID:1760
- C:\Windows\System\gTtnhnd.exe
  C:\Windows\System\gTtnhnd.exe
  2⤵
  PID:2728
- C:\Windows\System\zgDAVje.exe
  C:\Windows\System\zgDAVje.exe
  2⤵
  PID:2140
- C:\Windows\System\NwtezrF.exe
  C:\Windows\System\NwtezrF.exe
  2⤵
  PID:2504
- C:\Windows\System\gwQttqy.exe
  C:\Windows\System\gwQttqy.exe
  2⤵
  PID:1992
- C:\Windows\System\AWwaUMv.exe
  C:\Windows\System\AWwaUMv.exe
  2⤵
  PID:1972
- C:\Windows\System\GHBEyJx.exe
  C:\Windows\System\GHBEyJx.exe
  2⤵
  PID:3024
- C:\Windows\System\uddLyKr.exe
  C:\Windows\System\uddLyKr.exe
  2⤵
  PID:2920
- C:\Windows\System\ZbilCyj.exe
  C:\Windows\System\ZbilCyj.exe
  2⤵
  PID:1036
- C:\Windows\System\bmcABVF.exe
  C:\Windows\System\bmcABVF.exe
  2⤵
  PID:1776
- C:\Windows\System\hjuSKKR.exe
  C:\Windows\System\hjuSKKR.exe
  2⤵
  PID:556
- C:\Windows\System\CTNtWjC.exe
  C:\Windows\System\CTNtWjC.exe
  2⤵
  PID:3048
- C:\Windows\System\EtbJjLI.exe
  C:\Windows\System\EtbJjLI.exe
  2⤵
  PID:1976
- C:\Windows\System\hNgycEW.exe
  C:\Windows\System\hNgycEW.exe
  2⤵
  PID:752
- C:\Windows\System\jfwhROD.exe
  C:\Windows\System\jfwhROD.exe
  2⤵
  PID:2340
- C:\Windows\System\xuSvsMb.exe
  C:\Windows\System\xuSvsMb.exe
  2⤵
  PID:1712
- C:\Windows\System\WiJBsed.exe
  C:\Windows\System\WiJBsed.exe
  2⤵
  PID:2056
- C:\Windows\System\wIdcdWN.exe
  C:\Windows\System\wIdcdWN.exe
  2⤵
  PID:2568
- C:\Windows\System\aSlWmdt.exe
  C:\Windows\System\aSlWmdt.exe
  2⤵
  PID:2348
- C:\Windows\System\OjJIIud.exe
  C:\Windows\System\OjJIIud.exe
  2⤵
  PID:2460
- C:\Windows\System\DsEmhAw.exe
  C:\Windows\System\DsEmhAw.exe
  2⤵
  PID:496
- C:\Windows\System\muZuXcr.exe
  C:\Windows\System\muZuXcr.exe
  2⤵
  PID:3088
- C:\Windows\System\skeiCxn.exe
  C:\Windows\System\skeiCxn.exe
  2⤵
  PID:3108
- C:\Windows\System\bOaBusJ.exe
  C:\Windows\System\bOaBusJ.exe
  2⤵
  PID:3128
- C:\Windows\System\veLAeXx.exe
  C:\Windows\System\veLAeXx.exe
  2⤵
  PID:3144
- C:\Windows\System\pAtzxWY.exe
  C:\Windows\System\pAtzxWY.exe
  2⤵
  PID:3168
- C:\Windows\System\UEAOqdP.exe
  C:\Windows\System\UEAOqdP.exe
  2⤵
  PID:3188
- C:\Windows\System\QzlMRAI.exe
  C:\Windows\System\QzlMRAI.exe
  2⤵
  PID:3212
- C:\Windows\System\oQSYJGO.exe
  C:\Windows\System\oQSYJGO.exe
  2⤵
  PID:3232
- C:\Windows\System\nTWsBjS.exe
  C:\Windows\System\nTWsBjS.exe
  2⤵
  PID:3248
- C:\Windows\System\BaaxDKk.exe
  C:\Windows\System\BaaxDKk.exe
  2⤵
  PID:3264
- C:\Windows\System\bhaLLVM.exe
  C:\Windows\System\bhaLLVM.exe
  2⤵
  PID:3292
- C:\Windows\System\CRHgkEF.exe
  C:\Windows\System\CRHgkEF.exe
  2⤵
  PID:3308
- C:\Windows\System\OazZhLS.exe
  C:\Windows\System\OazZhLS.exe
  2⤵
  PID:3332
- C:\Windows\System\NaXcbxW.exe
  C:\Windows\System\NaXcbxW.exe
  2⤵
  PID:3396
- C:\Windows\System\fdqDcja.exe
  C:\Windows\System\fdqDcja.exe
  2⤵
  PID:3424
- C:\Windows\System\jmZLthW.exe
  C:\Windows\System\jmZLthW.exe
  2⤵
  PID:3440
- C:\Windows\System\hevBNBR.exe
  C:\Windows\System\hevBNBR.exe
  2⤵
  PID:3464
- C:\Windows\System\tafGwQj.exe
  C:\Windows\System\tafGwQj.exe
  2⤵
  PID:3488
- C:\Windows\System\UVfSdYf.exe
  C:\Windows\System\UVfSdYf.exe
  2⤵
  PID:3504
- C:\Windows\System\XFWspLT.exe
  C:\Windows\System\XFWspLT.exe
  2⤵
  PID:3520
- C:\Windows\System\eeQkCyJ.exe
  C:\Windows\System\eeQkCyJ.exe
  2⤵
  PID:3540
- C:\Windows\System\RKJwAic.exe
  C:\Windows\System\RKJwAic.exe
  2⤵
  PID:3556
- C:\Windows\System\ZjvCmYM.exe
  C:\Windows\System\ZjvCmYM.exe
  2⤵
  PID:3576
- C:\Windows\System\JccHZRG.exe
  C:\Windows\System\JccHZRG.exe
  2⤵
  PID:3620
- C:\Windows\System\XwHrgNh.exe
  C:\Windows\System\XwHrgNh.exe
  2⤵
  PID:3636
- C:\Windows\System\VFhwVEg.exe
  C:\Windows\System\VFhwVEg.exe
  2⤵
  PID:3652
- C:\Windows\System\aWDjVCQ.exe
  C:\Windows\System\aWDjVCQ.exe
  2⤵
  PID:3668
- C:\Windows\System\yDSgovV.exe
  C:\Windows\System\yDSgovV.exe
  2⤵
  PID:3684
- C:\Windows\System\DzdSniK.exe
  C:\Windows\System\DzdSniK.exe
  2⤵
  PID:3704
- C:\Windows\System\GYhQuOP.exe
  C:\Windows\System\GYhQuOP.exe
  2⤵
  PID:3740
- C:\Windows\System\LFQFxSC.exe
  C:\Windows\System\LFQFxSC.exe
  2⤵
  PID:3756
- C:\Windows\System\pktSRYy.exe
  C:\Windows\System\pktSRYy.exe
  2⤵
  PID:3772
- C:\Windows\System\Auqgutf.exe
  C:\Windows\System\Auqgutf.exe
  2⤵
  PID:3788
- C:\Windows\System\jMPqElu.exe
  C:\Windows\System\jMPqElu.exe
  2⤵
  PID:3804
- C:\Windows\System\wVikMIK.exe
  C:\Windows\System\wVikMIK.exe
  2⤵
  PID:3820
- C:\Windows\System\OOdvbIN.exe
  C:\Windows\System\OOdvbIN.exe
  2⤵
  PID:3836
- C:\Windows\System\CVQSAJk.exe
  C:\Windows\System\CVQSAJk.exe
  2⤵
  PID:3852
- C:\Windows\System\GzHNams.exe
  C:\Windows\System\GzHNams.exe
  2⤵
  PID:3884
- C:\Windows\System\nPEqEit.exe
  C:\Windows\System\nPEqEit.exe
  2⤵
  PID:3908
- C:\Windows\System\ctSaqXJ.exe
  C:\Windows\System\ctSaqXJ.exe
  2⤵
  PID:3924
- C:\Windows\System\FDuaVBD.exe
  C:\Windows\System\FDuaVBD.exe
  2⤵
  PID:3940
- C:\Windows\System\kWkYVit.exe
  C:\Windows\System\kWkYVit.exe
  2⤵
  PID:3980
- C:\Windows\System\xAMEOAv.exe
  C:\Windows\System\xAMEOAv.exe
  2⤵
  PID:4004
- C:\Windows\System\IMsfKmc.exe
  C:\Windows\System\IMsfKmc.exe
  2⤵
  PID:4020
- C:\Windows\System\DlxlFjH.exe
  C:\Windows\System\DlxlFjH.exe
  2⤵
  PID:4040
- C:\Windows\System\ILnkPgb.exe
  C:\Windows\System\ILnkPgb.exe
  2⤵
  PID:4056
- C:\Windows\System\HHYXUOC.exe
  C:\Windows\System\HHYXUOC.exe
  2⤵
  PID:4072
- C:\Windows\System\AfYqoho.exe
  C:\Windows\System\AfYqoho.exe
  2⤵
  PID:4088
- C:\Windows\System\uMkgiPX.exe
  C:\Windows\System\uMkgiPX.exe
  2⤵
  PID:1008
- C:\Windows\System\pFUmnOQ.exe
  C:\Windows\System\pFUmnOQ.exe
  2⤵
  PID:2612
- C:\Windows\System\vGtpxdw.exe
  C:\Windows\System\vGtpxdw.exe
  2⤵
  PID:3060
- C:\Windows\System\qiOrGEz.exe
  C:\Windows\System\qiOrGEz.exe
  2⤵
  PID:3100
- C:\Windows\System\ubhYVjZ.exe
  C:\Windows\System\ubhYVjZ.exe
  2⤵
  PID:1152
- C:\Windows\System\WsRhXkk.exe
  C:\Windows\System\WsRhXkk.exe
  2⤵
  PID:3064
- C:\Windows\System\mYWZxXb.exe
  C:\Windows\System\mYWZxXb.exe
  2⤵
  PID:2020
- C:\Windows\System\qsGAULw.exe
  C:\Windows\System\qsGAULw.exe
  2⤵
  PID:3140
- C:\Windows\System\VWlWUgD.exe
  C:\Windows\System\VWlWUgD.exe
  2⤵
  PID:2244
- C:\Windows\System\PAZWLuC.exe
  C:\Windows\System\PAZWLuC.exe
  2⤵
  PID:3076
- C:\Windows\System\PPXiIKF.exe
  C:\Windows\System\PPXiIKF.exe
  2⤵
  PID:3116
- C:\Windows\System\piWarBR.exe
  C:\Windows\System\piWarBR.exe
  2⤵
  PID:1544
- C:\Windows\System\YEiRfmg.exe
  C:\Windows\System\YEiRfmg.exe
  2⤵
  PID:3196
- C:\Windows\System\Vdacqhg.exe
  C:\Windows\System\Vdacqhg.exe
  2⤵
  PID:1836
- C:\Windows\System\RGmPnjQ.exe
  C:\Windows\System\RGmPnjQ.exe
  2⤵
  PID:1808
- C:\Windows\System\kpAmezv.exe
  C:\Windows\System\kpAmezv.exe
  2⤵
  PID:1860
- C:\Windows\System\cXUoetI.exe
  C:\Windows\System\cXUoetI.exe
  2⤵
  PID:1724
- C:\Windows\System\gTNoYKi.exe
  C:\Windows\System\gTNoYKi.exe
  2⤵
  PID:2448
- C:\Windows\System\IbFhiaG.exe
  C:\Windows\System\IbFhiaG.exe
  2⤵
  PID:2816
- C:\Windows\System\bexdjxM.exe
  C:\Windows\System\bexdjxM.exe
  2⤵
  PID:1704
- C:\Windows\System\qaorLBj.exe
  C:\Windows\System\qaorLBj.exe
  2⤵
  PID:3220
- C:\Windows\System\sJYwOmZ.exe
  C:\Windows\System\sJYwOmZ.exe
  2⤵
  PID:3304
- C:\Windows\System\ocyBAlB.exe
  C:\Windows\System\ocyBAlB.exe
  2⤵
  PID:2644
- C:\Windows\System\SKQtqRa.exe
  C:\Windows\System\SKQtqRa.exe
  2⤵
  PID:2608
- C:\Windows\System\RPgjbeT.exe
  C:\Windows\System\RPgjbeT.exe
  2⤵
  PID:2152
- C:\Windows\System\ieIrabd.exe
  C:\Windows\System\ieIrabd.exe
  2⤵
  PID:3348
- C:\Windows\System\wNaZKcI.exe
  C:\Windows\System\wNaZKcI.exe
  2⤵
  PID:3364
- C:\Windows\System\vOtoSiL.exe
  C:\Windows\System\vOtoSiL.exe
  2⤵
  PID:3380
- C:\Windows\System\dUuUWVT.exe
  C:\Windows\System\dUuUWVT.exe
  2⤵
  PID:3432
- C:\Windows\System\fDTRHVw.exe
  C:\Windows\System\fDTRHVw.exe
  2⤵
  PID:3456
- C:\Windows\System\tyRhmUw.exe
  C:\Windows\System\tyRhmUw.exe
  2⤵
  PID:3328
- C:\Windows\System\bOHdFlg.exe
  C:\Windows\System\bOHdFlg.exe
  2⤵
  PID:3320
- C:\Windows\System\uwbPrpg.exe
  C:\Windows\System\uwbPrpg.exe
  2⤵
  PID:3472
- C:\Windows\System\QZgGOXN.exe
  C:\Windows\System\QZgGOXN.exe
  2⤵
  PID:3516
- C:\Windows\System\nsbuzie.exe
  C:\Windows\System\nsbuzie.exe
  2⤵
  PID:2016
- C:\Windows\System\lFtXUDD.exe
  C:\Windows\System\lFtXUDD.exe
  2⤵
  PID:3600
- C:\Windows\System\fpubZQb.exe
  C:\Windows\System\fpubZQb.exe
  2⤵
  PID:1652
- C:\Windows\System\hmKbxVZ.exe
  C:\Windows\System\hmKbxVZ.exe
  2⤵
  PID:1680
- C:\Windows\System\UBSmpNQ.exe
  C:\Windows\System\UBSmpNQ.exe
  2⤵
  PID:2512
- C:\Windows\System\YVfZxFj.exe
  C:\Windows\System\YVfZxFj.exe
  2⤵
  PID:3616
- C:\Windows\System\ECbiilB.exe
  C:\Windows\System\ECbiilB.exe
  2⤵
  PID:3496
- C:\Windows\System\eVuUtTR.exe
  C:\Windows\System\eVuUtTR.exe
  2⤵
  PID:3632
- C:\Windows\System\LPvAKht.exe
  C:\Windows\System\LPvAKht.exe
  2⤵
  PID:3712
- C:\Windows\System\rzBhavH.exe
  C:\Windows\System\rzBhavH.exe
  2⤵
  PID:3692
- C:\Windows\System\vvkxZYf.exe
  C:\Windows\System\vvkxZYf.exe
  2⤵
  PID:3780
- C:\Windows\System\SYkMoQb.exe
  C:\Windows\System\SYkMoQb.exe
  2⤵
  PID:3848
- C:\Windows\System\jeguxZd.exe
  C:\Windows\System\jeguxZd.exe
  2⤵
  PID:3904
- C:\Windows\System\SuHAjYk.exe
  C:\Windows\System\SuHAjYk.exe
  2⤵
  PID:3736
- C:\Windows\System\dzHrcPa.exe
  C:\Windows\System\dzHrcPa.exe
  2⤵
  PID:3768
- C:\Windows\System\nEVmLHE.exe
  C:\Windows\System\nEVmLHE.exe
  2⤵
  PID:3876
- C:\Windows\System\LNxXXZR.exe
  C:\Windows\System\LNxXXZR.exe
  2⤵
  PID:3948
- C:\Windows\System\ebejhlZ.exe
  C:\Windows\System\ebejhlZ.exe
  2⤵
  PID:3860
- C:\Windows\System\AmfJtfo.exe
  C:\Windows\System\AmfJtfo.exe
  2⤵
  PID:3968
- C:\Windows\System\UlEHicM.exe
  C:\Windows\System\UlEHicM.exe
  2⤵
  PID:996
- C:\Windows\System\VbffwJV.exe
  C:\Windows\System\VbffwJV.exe
  2⤵
  PID:4104
- C:\Windows\System\LWFqmqh.exe
  C:\Windows\System\LWFqmqh.exe
  2⤵
  PID:4120
- C:\Windows\System\fxETwLF.exe
  C:\Windows\System\fxETwLF.exe
  2⤵
  PID:4136
- C:\Windows\System\TBeJjqL.exe
  C:\Windows\System\TBeJjqL.exe
  2⤵
  PID:4160
- C:\Windows\System\pEiCqBX.exe
  C:\Windows\System\pEiCqBX.exe
  2⤵
  PID:4180
- C:\Windows\System\kkorshA.exe
  C:\Windows\System\kkorshA.exe
  2⤵
  PID:4200
- C:\Windows\System\GEztXij.exe
  C:\Windows\System\GEztXij.exe
  2⤵
  PID:4220
- C:\Windows\System\bZGkgPS.exe
  C:\Windows\System\bZGkgPS.exe
  2⤵
  PID:4240
- C:\Windows\System\OavDguk.exe
  C:\Windows\System\OavDguk.exe
  2⤵
  PID:4260
- C:\Windows\System\TbMhNKt.exe
  C:\Windows\System\TbMhNKt.exe
  2⤵
  PID:4280
- C:\Windows\System\OuaSTPw.exe
  C:\Windows\System\OuaSTPw.exe
  2⤵
  PID:4300
- C:\Windows\System\MEHDBGV.exe
  C:\Windows\System\MEHDBGV.exe
  2⤵
  PID:4320
- C:\Windows\System\sMmsSnp.exe
  C:\Windows\System\sMmsSnp.exe
  2⤵
  PID:4340
- C:\Windows\System\ofwVerE.exe
  C:\Windows\System\ofwVerE.exe
  2⤵
  PID:4360
- C:\Windows\System\sEDeiQZ.exe
  C:\Windows\System\sEDeiQZ.exe
  2⤵
  PID:4380
- C:\Windows\System\xsjXlLr.exe
  C:\Windows\System\xsjXlLr.exe
  2⤵
  PID:4396
- C:\Windows\System\XhGBfxd.exe
  C:\Windows\System\XhGBfxd.exe
  2⤵
  PID:4412
- C:\Windows\System\cDxNjPq.exe
  C:\Windows\System\cDxNjPq.exe
  2⤵
  PID:4428
- C:\Windows\System\bhpPkGk.exe
  C:\Windows\System\bhpPkGk.exe
  2⤵
  PID:4444
- C:\Windows\System\uXWeREA.exe
  C:\Windows\System\uXWeREA.exe
  2⤵
  PID:4460
- C:\Windows\System\MsigRjV.exe
  C:\Windows\System\MsigRjV.exe
  2⤵
  PID:4476
- C:\Windows\System\pxefOpR.exe
  C:\Windows\System\pxefOpR.exe
  2⤵
  PID:4492
- C:\Windows\System\UcwJCep.exe
  C:\Windows\System\UcwJCep.exe
  2⤵
  PID:4512
- C:\Windows\System\xoNGGuo.exe
  C:\Windows\System\xoNGGuo.exe
  2⤵
  PID:4528
- C:\Windows\System\SNdeFNL.exe
  C:\Windows\System\SNdeFNL.exe
  2⤵
  PID:4648
- C:\Windows\System\ArhgEAB.exe
  C:\Windows\System\ArhgEAB.exe
  2⤵
  PID:4664
- C:\Windows\System\sHyPsaN.exe
  C:\Windows\System\sHyPsaN.exe
  2⤵
  PID:4680
- C:\Windows\System\gMVIgtQ.exe
  C:\Windows\System\gMVIgtQ.exe
  2⤵
  PID:4696
- C:\Windows\System\tecPPiK.exe
  C:\Windows\System\tecPPiK.exe
  2⤵
  PID:4712
- C:\Windows\System\YxRDjos.exe
  C:\Windows\System\YxRDjos.exe
  2⤵
  PID:4728
- C:\Windows\System\eKbFLjM.exe
  C:\Windows\System\eKbFLjM.exe
  2⤵
  PID:4744
- C:\Windows\System\syjGnBm.exe
  C:\Windows\System\syjGnBm.exe
  2⤵
  PID:4760
- C:\Windows\System\WPSGTcL.exe
  C:\Windows\System\WPSGTcL.exe
  2⤵
  PID:4776
- C:\Windows\System\LODRxsc.exe
  C:\Windows\System\LODRxsc.exe
  2⤵
  PID:4792
- C:\Windows\System\QnhuMOq.exe
  C:\Windows\System\QnhuMOq.exe
  2⤵
  PID:4808
- C:\Windows\System\HLrnImw.exe
  C:\Windows\System\HLrnImw.exe
  2⤵
  PID:4828
- C:\Windows\System\MVywDfr.exe
  C:\Windows\System\MVywDfr.exe
  2⤵
  PID:4844
- C:\Windows\System\SCSgbCK.exe
  C:\Windows\System\SCSgbCK.exe
  2⤵
  PID:4860
- C:\Windows\System\cIeJouX.exe
  C:\Windows\System\cIeJouX.exe
  2⤵
  PID:4880
- C:\Windows\System\fXknvGn.exe
  C:\Windows\System\fXknvGn.exe
  2⤵
  PID:4896
- C:\Windows\System\xSTQoTX.exe
  C:\Windows\System\xSTQoTX.exe
  2⤵
  PID:4912
- C:\Windows\System\aHCFugE.exe
  C:\Windows\System\aHCFugE.exe
  2⤵
  PID:4928
- C:\Windows\System\RBXFsmE.exe
  C:\Windows\System\RBXFsmE.exe
  2⤵
  PID:4948
- C:\Windows\System\DpWclsC.exe
  C:\Windows\System\DpWclsC.exe
  2⤵
  PID:4964
- C:\Windows\System\qtoFGIU.exe
  C:\Windows\System\qtoFGIU.exe
  2⤵
  PID:4980
- C:\Windows\System\wASHCdQ.exe
  C:\Windows\System\wASHCdQ.exe
  2⤵
  PID:5000
- C:\Windows\System\DpRINsH.exe
  C:\Windows\System\DpRINsH.exe
  2⤵
  PID:5016
- C:\Windows\System\OypuyxT.exe
  C:\Windows\System\OypuyxT.exe
  2⤵
  PID:5032
- C:\Windows\System\stjuDfQ.exe
  C:\Windows\System\stjuDfQ.exe
  2⤵
  PID:5048
- C:\Windows\System\oHTNqIH.exe
  C:\Windows\System\oHTNqIH.exe
  2⤵
  PID:5064
- C:\Windows\System\GLzlHRT.exe
  C:\Windows\System\GLzlHRT.exe
  2⤵
  PID:5088
- C:\Windows\System\GmfTTFU.exe
  C:\Windows\System\GmfTTFU.exe
  2⤵
  PID:5104
- C:\Windows\System\UBnTozh.exe
  C:\Windows\System\UBnTozh.exe
  2⤵
  PID:3352
- C:\Windows\System\GVNuZgG.exe
  C:\Windows\System\GVNuZgG.exe
  2⤵
  PID:3452
- C:\Windows\System\XbQeVcU.exe
  C:\Windows\System\XbQeVcU.exe
  2⤵
  PID:3584
- C:\Windows\System\vgzYmnH.exe
  C:\Windows\System\vgzYmnH.exe
  2⤵
  PID:3596
- C:\Windows\System\VSyXZOZ.exe
  C:\Windows\System\VSyXZOZ.exe
  2⤵
  PID:3680
- C:\Windows\System\eYpbmnZ.exe
  C:\Windows\System\eYpbmnZ.exe
  2⤵
  PID:3896
- C:\Windows\System\oHqJCdd.exe
  C:\Windows\System\oHqJCdd.exe
  2⤵
  PID:3800
- C:\Windows\System\yFekApq.exe
  C:\Windows\System\yFekApq.exe
  2⤵
  PID:4052
- C:\Windows\System\yOBEXue.exe
  C:\Windows\System\yOBEXue.exe
  2⤵
  PID:3964
- C:\Windows\System\pEOmfTR.exe
  C:\Windows\System\pEOmfTR.exe
  2⤵
  PID:4032
- C:\Windows\System\KRuSrgm.exe
  C:\Windows\System\KRuSrgm.exe
  2⤵
  PID:2496
- C:\Windows\System\MRFNjHE.exe
  C:\Windows\System\MRFNjHE.exe
  2⤵
  PID:3084
- C:\Windows\System\qyMQHsh.exe
  C:\Windows\System\qyMQHsh.exe
  2⤵
  PID:2072
- C:\Windows\System\qtohIUV.exe
  C:\Windows\System\qtohIUV.exe
  2⤵
  PID:3244
- C:\Windows\System\PyPcEFA.exe
  C:\Windows\System\PyPcEFA.exe
  2⤵
  PID:3228
- C:\Windows\System\NMNIsZn.exe
  C:\Windows\System\NMNIsZn.exe
  2⤵
  PID:2624
- C:\Windows\System\MBQiLBF.exe
  C:\Windows\System\MBQiLBF.exe
  2⤵
  PID:4100
- C:\Windows\System\FgibZJR.exe
  C:\Windows\System\FgibZJR.exe
  2⤵
  PID:952
- C:\Windows\System\pYNoeBS.exe
  C:\Windows\System\pYNoeBS.exe
  2⤵
  PID:3124
- C:\Windows\System\wvvkeOB.exe
  C:\Windows\System\wvvkeOB.exe
  2⤵
  PID:1592
- C:\Windows\System\LEcccvD.exe
  C:\Windows\System\LEcccvD.exe
  2⤵
  PID:1280
- C:\Windows\System\jFxSvXB.exe
  C:\Windows\System\jFxSvXB.exe
  2⤵
  PID:2508
- C:\Windows\System\TuPgopa.exe
  C:\Windows\System\TuPgopa.exe
  2⤵
  PID:3376
- C:\Windows\System\mdXvxBh.exe
  C:\Windows\System\mdXvxBh.exe
  2⤵
  PID:3484
- C:\Windows\System\UDTpAMv.exe
  C:\Windows\System\UDTpAMv.exe
  2⤵
  PID:2032
- C:\Windows\System\gPYzOjt.exe
  C:\Windows\System\gPYzOjt.exe
  2⤵
  PID:4132
- C:\Windows\System\SzCaZUr.exe
  C:\Windows\System\SzCaZUr.exe
  2⤵
  PID:3664
- C:\Windows\System\xzHqioA.exe
  C:\Windows\System\xzHqioA.exe
  2⤵
  PID:3868
- C:\Windows\System\ythhZzQ.exe
  C:\Windows\System\ythhZzQ.exe
  2⤵
  PID:4068
- C:\Windows\System\hDNIrOU.exe
  C:\Windows\System\hDNIrOU.exe
  2⤵
  PID:4144
- C:\Windows\System\KcscvZO.exe
  C:\Windows\System\KcscvZO.exe
  2⤵
  PID:4188
- C:\Windows\System\cLYQOOo.exe
  C:\Windows\System\cLYQOOo.exe
  2⤵
  PID:4236
- C:\Windows\System\crswYSY.exe
  C:\Windows\System\crswYSY.exe
  2⤵
  PID:4308
- C:\Windows\System\aMAoEne.exe
  C:\Windows\System\aMAoEne.exe
  2⤵
  PID:4352
- C:\Windows\System\ENaXvEg.exe
  C:\Windows\System\ENaXvEg.exe
  2⤵
  PID:4420
- C:\Windows\System\kZPcZbU.exe
  C:\Windows\System\kZPcZbU.exe
  2⤵
  PID:4452
- C:\Windows\System\seXZqRb.exe
  C:\Windows\System\seXZqRb.exe
  2⤵
  PID:4168
- C:\Windows\System\BRqVkcV.exe
  C:\Windows\System\BRqVkcV.exe
  2⤵
  PID:4368
- C:\Windows\System\WOqqqlr.exe
  C:\Windows\System\WOqqqlr.exe
  2⤵
  PID:1676
- C:\Windows\System\HldnuAh.exe
  C:\Windows\System\HldnuAh.exe
  2⤵
  PID:4500
- C:\Windows\System\BNYSOuc.exe
  C:\Windows\System\BNYSOuc.exe
  2⤵
  PID:4536
- C:\Windows\System\sTAhiAs.exe
  C:\Windows\System\sTAhiAs.exe
  2⤵
  PID:4552
- C:\Windows\System\iHLlEMH.exe
  C:\Windows\System\iHLlEMH.exe
  2⤵
  PID:4576
- C:\Windows\System\LGljvJJ.exe
  C:\Windows\System\LGljvJJ.exe
  2⤵
  PID:760
- C:\Windows\System\NWYLeAC.exe
  C:\Windows\System\NWYLeAC.exe
  2⤵
  PID:4212
- C:\Windows\System\ojyKWFo.exe
  C:\Windows\System\ojyKWFo.exe
  2⤵
  PID:4600
- C:\Windows\System\UhsBSrQ.exe
  C:\Windows\System\UhsBSrQ.exe
  2⤵
  PID:4328
- C:\Windows\System\HRaubtS.exe
  C:\Windows\System\HRaubtS.exe
  2⤵
  PID:4376
- C:\Windows\System\PLnlhIl.exe
  C:\Windows\System\PLnlhIl.exe
  2⤵
  PID:4628
- C:\Windows\System\eSmAIfZ.exe
  C:\Windows\System\eSmAIfZ.exe
  2⤵
  PID:4640
- C:\Windows\System\CUHBdOd.exe
  C:\Windows\System\CUHBdOd.exe
  2⤵
  PID:4216
- C:\Windows\System\deNqqEO.exe
  C:\Windows\System\deNqqEO.exe
  2⤵
  PID:4740
- C:\Windows\System\POzXuzy.exe
  C:\Windows\System\POzXuzy.exe
  2⤵
  PID:4800
- C:\Windows\System\FRxYaOf.exe
  C:\Windows\System\FRxYaOf.exe
  2⤵
  PID:4840
- C:\Windows\System\lRRTlwU.exe
  C:\Windows\System\lRRTlwU.exe
  2⤵
  PID:4908
- C:\Windows\System\RWYAGBR.exe
  C:\Windows\System\RWYAGBR.exe
  2⤵
  PID:4944
- C:\Windows\System\cmNRXpI.exe
  C:\Windows\System\cmNRXpI.exe
  2⤵
  PID:5040
- C:\Windows\System\IxmLjfG.exe
  C:\Windows\System\IxmLjfG.exe
  2⤵
  PID:5112
- C:\Windows\System\TqIPeQv.exe
  C:\Windows\System\TqIPeQv.exe
  2⤵
  PID:3552
- C:\Windows\System\FtWVrJe.exe
  C:\Windows\System\FtWVrJe.exe
  2⤵
  PID:3764
- C:\Windows\System\tFzexyN.exe
  C:\Windows\System\tFzexyN.exe
  2⤵
  PID:3828
- C:\Windows\System\uWMfNXN.exe
  C:\Windows\System\uWMfNXN.exe
  2⤵
  PID:1180
- C:\Windows\System\GQIxgjB.exe
  C:\Windows\System\GQIxgjB.exe
  2⤵
  PID:3240
- C:\Windows\System\fluYivp.exe
  C:\Windows\System\fluYivp.exe
  2⤵
  PID:2148
- C:\Windows\System\UcRsUdP.exe
  C:\Windows\System\UcRsUdP.exe
  2⤵
  PID:3528
- C:\Windows\System\iUpbamS.exe
  C:\Windows\System\iUpbamS.exe
  2⤵
  PID:2392
- C:\Windows\System\fhpNPgu.exe
  C:\Windows\System\fhpNPgu.exe
  2⤵
  PID:2964
- C:\Windows\System\inoMHTr.exe
  C:\Windows\System\inoMHTr.exe
  2⤵
  PID:4520
- C:\Windows\System\otHcAEF.exe
  C:\Windows\System\otHcAEF.exe
  2⤵
  PID:1480
- C:\Windows\System\jnFxKpw.exe
  C:\Windows\System\jnFxKpw.exe
  2⤵
  PID:2760
- C:\Windows\System\RNMcEEC.exe
  C:\Windows\System\RNMcEEC.exe
  2⤵
  PID:5100
- C:\Windows\System\dQBLaxe.exe
  C:\Windows\System\dQBLaxe.exe
  2⤵
  PID:3104
- C:\Windows\System\UQCzoVe.exe
  C:\Windows\System\UQCzoVe.exe
  2⤵
  PID:4660
- C:\Windows\System\pHgSNpi.exe
  C:\Windows\System\pHgSNpi.exe
  2⤵
  PID:3412
- C:\Windows\System\MwHqXRr.exe
  C:\Windows\System\MwHqXRr.exe
  2⤵
  PID:4724
- C:\Windows\System\poYqSLR.exe
  C:\Windows\System\poYqSLR.exe
  2⤵
  PID:4820
- C:\Windows\System\QwsViIe.exe
  C:\Windows\System\QwsViIe.exe
  2⤵
  PID:4888
- C:\Windows\System\JILVnVv.exe
  C:\Windows\System\JILVnVv.exe
  2⤵
  PID:4956
- C:\Windows\System\AOypKpj.exe
  C:\Windows\System\AOypKpj.exe
  2⤵
  PID:4996
- C:\Windows\System\EtwFtfT.exe
  C:\Windows\System\EtwFtfT.exe
  2⤵
  PID:5060
- C:\Windows\System\EcslSwe.exe
  C:\Windows\System\EcslSwe.exe
  2⤵
  PID:3536
- C:\Windows\System\crfbKyT.exe
  C:\Windows\System\crfbKyT.exe
  2⤵
  PID:4012
- C:\Windows\System\YlvsHqX.exe
  C:\Windows\System\YlvsHqX.exe
  2⤵
  PID:3344
- C:\Windows\System\GPfIrfM.exe
  C:\Windows\System\GPfIrfM.exe
  2⤵
  PID:1840
- C:\Windows\System\lBApXNP.exe
  C:\Windows\System\lBApXNP.exe
  2⤵
  PID:3408
- C:\Windows\System\SMulPXX.exe
  C:\Windows\System\SMulPXX.exe
  2⤵
  PID:3844
- C:\Windows\System\uuSaFol.exe
  C:\Windows\System\uuSaFol.exe
  2⤵
  PID:4112
- C:\Windows\System\oewovXs.exe
  C:\Windows\System\oewovXs.exe
  2⤵
  PID:4316
- C:\Windows\System\UvUdYdp.exe
  C:\Windows\System\UvUdYdp.exe
  2⤵
  PID:4176
- C:\Windows\System\BzvhicH.exe
  C:\Windows\System\BzvhicH.exe
  2⤵
  PID:4544
- C:\Windows\System\cmWIxjD.exe
  C:\Windows\System\cmWIxjD.exe
  2⤵
  PID:3280
- C:\Windows\System\byqZSJt.exe
  C:\Windows\System\byqZSJt.exe
  2⤵
  PID:4620
- C:\Windows\System\acaNuHP.exe
  C:\Windows\System\acaNuHP.exe
  2⤵
  PID:4656
- C:\Windows\System\lVOlJQH.exe
  C:\Windows\System\lVOlJQH.exe
  2⤵
  PID:3460
- C:\Windows\System\zaNCylM.exe
  C:\Windows\System\zaNCylM.exe
  2⤵
  PID:3920
- C:\Windows\System\igLfMHz.exe
  C:\Windows\System\igLfMHz.exe
  2⤵
  PID:4248
- C:\Windows\System\BacOgBC.exe
  C:\Windows\System\BacOgBC.exe
  2⤵
  PID:2368
- C:\Windows\System\mxIuNpg.exe
  C:\Windows\System\mxIuNpg.exe
  2⤵
  PID:4472
- C:\Windows\System\HMtXdFq.exe
  C:\Windows\System\HMtXdFq.exe
  2⤵
  PID:2808
- C:\Windows\System\DBnjMmU.exe
  C:\Windows\System\DBnjMmU.exe
  2⤵
  PID:4708
- C:\Windows\System\sbjggxQ.exe
  C:\Windows\System\sbjggxQ.exe
  2⤵
  PID:4872
- C:\Windows\System\kVPUlwk.exe
  C:\Windows\System\kVPUlwk.exe
  2⤵
  PID:1332
- C:\Windows\System\RFOtIxq.exe
  C:\Windows\System\RFOtIxq.exe
  2⤵
  PID:4152
- C:\Windows\System\aMSsheU.exe
  C:\Windows\System\aMSsheU.exe
  2⤵
  PID:3200
- C:\Windows\System\JedUSqV.exe
  C:\Windows\System\JedUSqV.exe
  2⤵
  PID:4392
- C:\Windows\System\cYqnCKd.exe
  C:\Windows\System\cYqnCKd.exe
  2⤵
  PID:4816
- C:\Windows\System\NxMIScl.exe
  C:\Windows\System\NxMIScl.exe
  2⤵
  PID:4720
- C:\Windows\System\nlGVKpU.exe
  C:\Windows\System\nlGVKpU.exe
  2⤵
  PID:4988
- C:\Windows\System\ugWsNZy.exe
  C:\Windows\System\ugWsNZy.exe
  2⤵
  PID:1320
- C:\Windows\System\hUKqYyM.exe
  C:\Windows\System\hUKqYyM.exe
  2⤵
  PID:1624
- C:\Windows\System\nbCwmiI.exe
  C:\Windows\System\nbCwmiI.exe
  2⤵
  PID:2936
- C:\Windows\System\TApurWG.exe
  C:\Windows\System\TApurWG.exe
  2⤵
  PID:4756
- C:\Windows\System\iOxNpBd.exe
  C:\Windows\System\iOxNpBd.exe
  2⤵
  PID:1296
- C:\Windows\System\bsVQhIx.exe
  C:\Windows\System\bsVQhIx.exe
  2⤵
  PID:2344
- C:\Windows\System\BKUaGBa.exe
  C:\Windows\System\BKUaGBa.exe
  2⤵
  PID:4768
- C:\Windows\System\UMgwYPy.exe
  C:\Windows\System\UMgwYPy.exe
  2⤵
  PID:4276
- C:\Windows\System\awyynLe.exe
  C:\Windows\System\awyynLe.exe
  2⤵
  PID:1872
- C:\Windows\System\QItkKgU.exe
  C:\Windows\System\QItkKgU.exe
  2⤵
  PID:2540
- C:\Windows\System\rgOJhfx.exe
  C:\Windows\System\rgOJhfx.exe
  2⤵
  PID:4920
- C:\Windows\System\TcHiAlz.exe
  C:\Windows\System\TcHiAlz.exe
  2⤵
  PID:3892
- C:\Windows\System\iFromJj.exe
  C:\Windows\System\iFromJj.exe
  2⤵
  PID:3604
- C:\Windows\System\OmcjBfk.exe
  C:\Windows\System\OmcjBfk.exe
  2⤵
  PID:3960
- C:\Windows\System\WUMUWzc.exe
  C:\Windows\System\WUMUWzc.exe
  2⤵
  PID:4208
- C:\Windows\System\uaOYYYZ.exe
  C:\Windows\System\uaOYYYZ.exe
  2⤵
  PID:2028
- C:\Windows\System\dfeyKqr.exe
  C:\Windows\System\dfeyKqr.exe
  2⤵
  PID:5044
- C:\Windows\System\lydTyIy.exe
  C:\Windows\System\lydTyIy.exe
  2⤵
  PID:4504
- C:\Windows\System\YbJoFJT.exe
  C:\Windows\System\YbJoFJT.exe
  2⤵
  PID:4852
- C:\Windows\System\ngkjvrh.exe
  C:\Windows\System\ngkjvrh.exe
  2⤵
  PID:3724
- C:\Windows\System\NFCfVhI.exe
  C:\Windows\System\NFCfVhI.exe
  2⤵
  PID:4876
- C:\Windows\System\wxzsIVe.exe
  C:\Windows\System\wxzsIVe.exe
  2⤵
  PID:4336
- C:\Windows\System\qBqeGzg.exe
  C:\Windows\System\qBqeGzg.exe
  2⤵
  PID:4604
- C:\Windows\System\jEoszBY.exe
  C:\Windows\System\jEoszBY.exe
  2⤵
  PID:3156
- C:\Windows\System\tAHxYkW.exe
  C:\Windows\System\tAHxYkW.exe
  2⤵
  PID:1516
- C:\Windows\System\qElBYCi.exe
  C:\Windows\System\qElBYCi.exe
  2⤵
  PID:4564
- C:\Windows\System\TDIrhNj.exe
  C:\Windows\System\TDIrhNj.exe
  2⤵
  PID:4568
- C:\Windows\System\wjoVyxR.exe
  C:\Windows\System\wjoVyxR.exe
  2⤵
  PID:884
- C:\Windows\System\mrDwQgA.exe
  C:\Windows\System\mrDwQgA.exe
  2⤵
  PID:5056
- C:\Windows\System\quafaBb.exe
  C:\Windows\System\quafaBb.exe
  2⤵
  PID:4736
- C:\Windows\System\hZsMhZn.exe
  C:\Windows\System\hZsMhZn.exe
  2⤵
  PID:4588
- C:\Windows\System\gjSdyAm.exe
  C:\Windows\System\gjSdyAm.exe
  2⤵
  PID:3988
- C:\Windows\System\EhOrcOc.exe
  C:\Windows\System\EhOrcOc.exe
  2⤵
  PID:5124
- C:\Windows\System\jIXAQxT.exe
  C:\Windows\System\jIXAQxT.exe
  2⤵
  PID:5140
- C:\Windows\System\UNLDZWj.exe
  C:\Windows\System\UNLDZWj.exe
  2⤵
  PID:5156
- C:\Windows\System\aHpcVMw.exe
  C:\Windows\System\aHpcVMw.exe
  2⤵
  PID:5172
- C:\Windows\System\fnIJnrS.exe
  C:\Windows\System\fnIJnrS.exe
  2⤵
  PID:5188
- C:\Windows\System\QpfLaVh.exe
  C:\Windows\System\QpfLaVh.exe
  2⤵
  PID:5204
- C:\Windows\System\CcDbGDg.exe
  C:\Windows\System\CcDbGDg.exe
  2⤵
  PID:5224
- C:\Windows\System\qvxcTos.exe
  C:\Windows\System\qvxcTos.exe
  2⤵
  PID:5244
- C:\Windows\System\BJTSmhT.exe
  C:\Windows\System\BJTSmhT.exe
  2⤵
  PID:5264
- C:\Windows\System\wXAXYyT.exe
  C:\Windows\System\wXAXYyT.exe
  2⤵
  PID:5284
- C:\Windows\System\PFcgtzg.exe
  C:\Windows\System\PFcgtzg.exe
  2⤵
  PID:5304
- C:\Windows\System\adeXuZO.exe
  C:\Windows\System\adeXuZO.exe
  2⤵
  PID:5324
- C:\Windows\System\ktDGWwh.exe
  C:\Windows\System\ktDGWwh.exe
  2⤵
  PID:5340
- C:\Windows\System\kxtnJfl.exe
  C:\Windows\System\kxtnJfl.exe
  2⤵
  PID:5360
- C:\Windows\System\pfCcbOe.exe
  C:\Windows\System\pfCcbOe.exe
  2⤵
  PID:5380
- C:\Windows\System\OrvwLES.exe
  C:\Windows\System\OrvwLES.exe
  2⤵
  PID:5396
- C:\Windows\System\sOXZoID.exe
  C:\Windows\System\sOXZoID.exe
  2⤵
  PID:5412
- C:\Windows\System\FYbtgdN.exe
  C:\Windows\System\FYbtgdN.exe
  2⤵
  PID:5428
- C:\Windows\System\eHpHgeH.exe
  C:\Windows\System\eHpHgeH.exe
  2⤵
  PID:5448
- C:\Windows\System\IeCJYHk.exe
  C:\Windows\System\IeCJYHk.exe
  2⤵
  PID:5464
- C:\Windows\System\MDYmKAG.exe
  C:\Windows\System\MDYmKAG.exe
  2⤵
  PID:5480
- C:\Windows\System\XaMvqhD.exe
  C:\Windows\System\XaMvqhD.exe
  2⤵
  PID:5500
- C:\Windows\System\mAMFhqj.exe
  C:\Windows\System\mAMFhqj.exe
  2⤵
  PID:5516
- C:\Windows\System\RlihCSW.exe
  C:\Windows\System\RlihCSW.exe
  2⤵
  PID:5532
- C:\Windows\System\ebWLEHR.exe
  C:\Windows\System\ebWLEHR.exe
  2⤵
  PID:5552
- C:\Windows\System\kHtFInF.exe
  C:\Windows\System\kHtFInF.exe
  2⤵
  PID:5568
- C:\Windows\System\aujcJeR.exe
  C:\Windows\System\aujcJeR.exe
  2⤵
  PID:5588
- C:\Windows\System\sIIzyUK.exe
  C:\Windows\System\sIIzyUK.exe
  2⤵
  PID:5612
- C:\Windows\System\NHPtssp.exe
  C:\Windows\System\NHPtssp.exe
  2⤵
  PID:5628
- C:\Windows\System\zxHNhUr.exe
  C:\Windows\System\zxHNhUr.exe
  2⤵
  PID:5644
- C:\Windows\System\ckpRbXm.exe
  C:\Windows\System\ckpRbXm.exe
  2⤵
  PID:5660
- C:\Windows\System\xvhEJfs.exe
  C:\Windows\System\xvhEJfs.exe
  2⤵
  PID:5676
- C:\Windows\System\tNZKbni.exe
  C:\Windows\System\tNZKbni.exe
  2⤵
  PID:5692
- C:\Windows\System\hXnwseu.exe
  C:\Windows\System\hXnwseu.exe
  2⤵
  PID:5708
- C:\Windows\System\rQaIrJE.exe
  C:\Windows\System\rQaIrJE.exe
  2⤵
  PID:5732
- C:\Windows\System\bgmkSDR.exe
  C:\Windows\System\bgmkSDR.exe
  2⤵
  PID:5748
- C:\Windows\System\tGvODdk.exe
  C:\Windows\System\tGvODdk.exe
  2⤵
  PID:5764
- C:\Windows\System\LxWFhza.exe
  C:\Windows\System\LxWFhza.exe
  2⤵
  PID:5780
- C:\Windows\System\vJZqqgB.exe
  C:\Windows\System\vJZqqgB.exe
  2⤵
  PID:5804
- C:\Windows\System\FFGCnrv.exe
  C:\Windows\System\FFGCnrv.exe
  2⤵
  PID:5820
- C:\Windows\System\niEuQqS.exe
  C:\Windows\System\niEuQqS.exe
  2⤵
  PID:5836
- C:\Windows\System\ihZqlUI.exe
  C:\Windows\System\ihZqlUI.exe
  2⤵
  PID:5852
- C:\Windows\System\SnmzZUa.exe
  C:\Windows\System\SnmzZUa.exe
  2⤵
  PID:5868
- C:\Windows\System\cffvNIQ.exe
  C:\Windows\System\cffvNIQ.exe
  2⤵
  PID:5884
- C:\Windows\System\rJOcHwg.exe
  C:\Windows\System\rJOcHwg.exe
  2⤵
  PID:5900
- C:\Windows\System\WLFjlIb.exe
  C:\Windows\System\WLFjlIb.exe
  2⤵
  PID:5916
- C:\Windows\System\dfsbmNl.exe
  C:\Windows\System\dfsbmNl.exe
  2⤵
  PID:5932
- C:\Windows\System\gjJLAXB.exe
  C:\Windows\System\gjJLAXB.exe
  2⤵
  PID:5948
- C:\Windows\System\etcnTUV.exe
  C:\Windows\System\etcnTUV.exe
  2⤵
  PID:5964
- C:\Windows\System\zrKesFS.exe
  C:\Windows\System\zrKesFS.exe
  2⤵
  PID:5980
- C:\Windows\System\Pdgzdxf.exe
  C:\Windows\System\Pdgzdxf.exe
  2⤵
  PID:5996
- C:\Windows\System\ydAEOHo.exe
  C:\Windows\System\ydAEOHo.exe
  2⤵
  PID:6012
- C:\Windows\System\QKRQgJX.exe
  C:\Windows\System\QKRQgJX.exe
  2⤵
  PID:6028
- C:\Windows\System\cpYWBBW.exe
  C:\Windows\System\cpYWBBW.exe
  2⤵
  PID:6044
- C:\Windows\System\xVcxPJk.exe
  C:\Windows\System\xVcxPJk.exe
  2⤵
  PID:6064
- C:\Windows\System\hdyhEDu.exe
  C:\Windows\System\hdyhEDu.exe
  2⤵
  PID:6080
- C:\Windows\System\DFVCywQ.exe
  C:\Windows\System\DFVCywQ.exe
  2⤵
  PID:6096
- C:\Windows\System\hOpvIiL.exe
  C:\Windows\System\hOpvIiL.exe
  2⤵
  PID:6112
- C:\Windows\System\TJLfCyQ.exe
  C:\Windows\System\TJLfCyQ.exe
  2⤵
  PID:6128
- C:\Windows\System\yYkVgbe.exe
  C:\Windows\System\yYkVgbe.exe
  2⤵
  PID:5028
- C:\Windows\System\DXxTNKJ.exe
  C:\Windows\System\DXxTNKJ.exe
  2⤵
  PID:4584
- C:\Windows\System\eUZjHPd.exe
  C:\Windows\System\eUZjHPd.exe
  2⤵
  PID:2164
- C:\Windows\System\ielvArR.exe
  C:\Windows\System\ielvArR.exe
  2⤵
  PID:5216
- C:\Windows\System\VRefBrw.exe
  C:\Windows\System\VRefBrw.exe
  2⤵
  PID:3996
- C:\Windows\System\JuDoyVT.exe
  C:\Windows\System\JuDoyVT.exe
  2⤵
  PID:4156
- C:\Windows\System\FuwBPpD.exe
  C:\Windows\System\FuwBPpD.exe
  2⤵
  PID:5136
- C:\Windows\System\knvYLwj.exe
  C:\Windows\System\knvYLwj.exe
  2⤵
  PID:5272
- C:\Windows\System\vmByegl.exe
  C:\Windows\System\vmByegl.exe
  2⤵
  PID:5456
- C:\Windows\System\lgkopUo.exe
  C:\Windows\System\lgkopUo.exe
  2⤵
  PID:5388
- C:\Windows\System\bKJIOEw.exe
  C:\Windows\System\bKJIOEw.exe
  2⤵
  PID:5460
- C:\Windows\System\bXvMWLC.exe
  C:\Windows\System\bXvMWLC.exe
  2⤵
  PID:5372
- C:\Windows\System\QCyhHXt.exe
  C:\Windows\System\QCyhHXt.exe
  2⤵
  PID:5476
- C:\Windows\System\fgMUldA.exe
  C:\Windows\System\fgMUldA.exe
  2⤵
  PID:5548
- C:\Windows\System\KMLynwr.exe
  C:\Windows\System\KMLynwr.exe
  2⤵
  PID:5560
- C:\Windows\System\BGxeFoU.exe
  C:\Windows\System\BGxeFoU.exe
  2⤵
  PID:5576
- C:\Windows\System\vRsxXZd.exe
  C:\Windows\System\vRsxXZd.exe
  2⤵
  PID:5620
- C:\Windows\System\rHSKpbo.exe
  C:\Windows\System\rHSKpbo.exe
  2⤵
  PID:5716
- C:\Windows\System\xnyFneR.exe
  C:\Windows\System\xnyFneR.exe
  2⤵
  PID:5604
- C:\Windows\System\KpbOnXc.exe
  C:\Windows\System\KpbOnXc.exe
  2⤵
  PID:5672
- C:\Windows\System\XfUTzwU.exe
  C:\Windows\System\XfUTzwU.exe
  2⤵
  PID:5740
- C:\Windows\System\ETFuFSA.exe
  C:\Windows\System\ETFuFSA.exe
  2⤵
  PID:5760
- C:\Windows\System\ZoSONlK.exe
  C:\Windows\System\ZoSONlK.exe
  2⤵
  PID:5776
- C:\Windows\System\WbnlWZS.exe
  C:\Windows\System\WbnlWZS.exe
  2⤵
  PID:2928
- C:\Windows\System\yRWpSec.exe
  C:\Windows\System\yRWpSec.exe
  2⤵
  PID:5864
- C:\Windows\System\kNhQGhQ.exe
  C:\Windows\System\kNhQGhQ.exe
  2⤵
  PID:5924
- C:\Windows\System\JuetLCC.exe
  C:\Windows\System\JuetLCC.exe
  2⤵
  PID:5992
- C:\Windows\System\VMseHmH.exe
  C:\Windows\System\VMseHmH.exe
  2⤵
  PID:6052
- C:\Windows\System\ovcvEYU.exe
  C:\Windows\System\ovcvEYU.exe
  2⤵
  PID:6060
- C:\Windows\System\JesyZCj.exe
  C:\Windows\System\JesyZCj.exe
  2⤵
  PID:784
- C:\Windows\System\fVocMAB.exe
  C:\Windows\System\fVocMAB.exe
  2⤵
  PID:5220
- C:\Windows\System\pXQLihN.exe
  C:\Windows\System\pXQLihN.exe
  2⤵
  PID:4592
- C:\Windows\System\KZeEwQr.exe
  C:\Windows\System\KZeEwQr.exe
  2⤵
  PID:5280
- C:\Windows\System\YuBXMNY.exe
  C:\Windows\System\YuBXMNY.exe
  2⤵
  PID:5436
- C:\Windows\System\PEWQPIJ.exe
  C:\Windows\System\PEWQPIJ.exe
  2⤵
  PID:1636
- C:\Windows\System\bsTUtZO.exe
  C:\Windows\System\bsTUtZO.exe
  2⤵
  PID:5688
- C:\Windows\System\IcTuAqY.exe
  C:\Windows\System\IcTuAqY.exe
  2⤵
  PID:5812
- C:\Windows\System\pZfbtiP.exe
  C:\Windows\System\pZfbtiP.exe
  2⤵
  PID:5880
- C:\Windows\System\hccslZS.exe
  C:\Windows\System\hccslZS.exe
  2⤵
  PID:5944
- C:\Windows\System\ULZTrqx.exe
  C:\Windows\System\ULZTrqx.exe
  2⤵
  PID:6008
- C:\Windows\System\iunZODH.exe
  C:\Windows\System\iunZODH.exe
  2⤵
  PID:6076
- C:\Windows\System\YoWGigt.exe
  C:\Windows\System\YoWGigt.exe
  2⤵
  PID:6140
- C:\Windows\System\QahdBgn.exe
  C:\Windows\System\QahdBgn.exe
  2⤵
  PID:5252
- C:\Windows\System\khfUnJT.exe
  C:\Windows\System\khfUnJT.exe
  2⤵
  PID:4836
- C:\Windows\System\vWCxFtc.exe
  C:\Windows\System\vWCxFtc.exe
  2⤵
  PID:5348
- C:\Windows\System\iPxRwxn.exe
  C:\Windows\System\iPxRwxn.exe
  2⤵
  PID:5492
- C:\Windows\System\gWWvxUD.exe
  C:\Windows\System\gWWvxUD.exe
  2⤵
  PID:5608
- C:\Windows\System\jYcddZo.exe
  C:\Windows\System\jYcddZo.exe
  2⤵
  PID:5744
- C:\Windows\System\ZrvpCCb.exe
  C:\Windows\System\ZrvpCCb.exe
  2⤵
  PID:3416
- C:\Windows\System\gSFvNGo.exe
  C:\Windows\System\gSFvNGo.exe
  2⤵
  PID:5756
- C:\Windows\System\nylMGSC.exe
  C:\Windows\System\nylMGSC.exe
  2⤵
  PID:6124
- C:\Windows\System\IsZsxio.exe
  C:\Windows\System\IsZsxio.exe
  2⤵
  PID:5320
- C:\Windows\System\wTPybvN.exe
  C:\Windows\System\wTPybvN.exe
  2⤵
  PID:5656
- C:\Windows\System\suzrwmc.exe
  C:\Windows\System\suzrwmc.exe
  2⤵
  PID:5896
- C:\Windows\System\tVZeUBU.exe
  C:\Windows\System\tVZeUBU.exe
  2⤵
  PID:6004
- C:\Windows\System\ELKvxGi.exe
  C:\Windows\System\ELKvxGi.exe
  2⤵
  PID:6136
- C:\Windows\System\uLYPKhx.exe
  C:\Windows\System\uLYPKhx.exe
  2⤵
  PID:5772
- C:\Windows\System\sUoDxcJ.exe
  C:\Windows\System\sUoDxcJ.exe
  2⤵
  PID:5988
- C:\Windows\System\uUbTWXw.exe
  C:\Windows\System\uUbTWXw.exe
  2⤵
  PID:5212
- C:\Windows\System\DGerVDT.exe
  C:\Windows\System\DGerVDT.exe
  2⤵
  PID:5704
- C:\Windows\System\BSLJMfg.exe
  C:\Windows\System\BSLJMfg.exe
  2⤵
  PID:5296
- C:\Windows\System\zhybRRW.exe
  C:\Windows\System\zhybRRW.exe
  2⤵
  PID:5540
- C:\Windows\System\IAqDxqG.exe
  C:\Windows\System\IAqDxqG.exe
  2⤵
  PID:5912
- C:\Windows\System\ExpebpT.exe
  C:\Windows\System\ExpebpT.exe
  2⤵
  PID:5148
- C:\Windows\System\wNdvLxy.exe
  C:\Windows\System\wNdvLxy.exe
  2⤵
  PID:5232
- C:\Windows\System\YNnkrXh.exe
  C:\Windows\System\YNnkrXh.exe
  2⤵
  PID:5624
- C:\Windows\System\CZUTTlY.exe
  C:\Windows\System\CZUTTlY.exe
  2⤵
  PID:6024
- C:\Windows\System\fJDdVtu.exe
  C:\Windows\System\fJDdVtu.exe
  2⤵
  PID:5792
- C:\Windows\System\vpKNfiL.exe
  C:\Windows\System\vpKNfiL.exe
  2⤵
  PID:5960
- C:\Windows\System\gxfyPRC.exe
  C:\Windows\System\gxfyPRC.exe
  2⤵
  PID:6092
- C:\Windows\System\XBesbbx.exe
  C:\Windows\System\XBesbbx.exe
  2⤵
  PID:5472
- C:\Windows\System\DANqRHA.exe
  C:\Windows\System\DANqRHA.exe
  2⤵
  PID:5200
- C:\Windows\System\carRNoY.exe
  C:\Windows\System\carRNoY.exe
  2⤵
  PID:6072
- C:\Windows\System\QmVxBJY.exe
  C:\Windows\System\QmVxBJY.exe
  2⤵
  PID:1772
- C:\Windows\System\CKWVqNT.exe
  C:\Windows\System\CKWVqNT.exe
  2⤵
  PID:5444
- C:\Windows\System\hszusWI.exe
  C:\Windows\System\hszusWI.exe
  2⤵
  PID:2388
- C:\Windows\System\HAyFXnb.exe
  C:\Windows\System\HAyFXnb.exe
  2⤵
  PID:2052
- C:\Windows\System\bqLBHjJ.exe
  C:\Windows\System\bqLBHjJ.exe
  2⤵
  PID:2924
- C:\Windows\System\wiCsApp.exe
  C:\Windows\System\wiCsApp.exe
  2⤵
  PID:5080
- C:\Windows\System\BvBAVes.exe
  C:\Windows\System\BvBAVes.exe
  2⤵
  PID:5876
- C:\Windows\System\ACOwiRU.exe
  C:\Windows\System\ACOwiRU.exe
  2⤵
  PID:6040
- C:\Windows\System\KXZcGZF.exe
  C:\Windows\System\KXZcGZF.exe
  2⤵
  PID:5584
- C:\Windows\System\TMlXOTM.exe
  C:\Windows\System\TMlXOTM.exe
  2⤵
  PID:6156
- C:\Windows\System\LcYussN.exe
  C:\Windows\System\LcYussN.exe
  2⤵
  PID:6172
- C:\Windows\System\uPGLuVL.exe
  C:\Windows\System\uPGLuVL.exe
  2⤵
  PID:6188
- C:\Windows\System\aUmHpFh.exe
  C:\Windows\System\aUmHpFh.exe
  2⤵
  PID:6204
- C:\Windows\System\hNIeEYC.exe
  C:\Windows\System\hNIeEYC.exe
  2⤵
  PID:6224
- C:\Windows\System\HycqUIT.exe
  C:\Windows\System\HycqUIT.exe
  2⤵
  PID:6240
- C:\Windows\System\zVevpVn.exe
  C:\Windows\System\zVevpVn.exe
  2⤵
  PID:6256
- C:\Windows\System\TAiBzZC.exe
  C:\Windows\System\TAiBzZC.exe
  2⤵
  PID:6272
- C:\Windows\System\dZqWUUV.exe
  C:\Windows\System\dZqWUUV.exe
  2⤵
  PID:6288
- C:\Windows\System\vSVYmkx.exe
  C:\Windows\System\vSVYmkx.exe
  2⤵
  PID:6304
- C:\Windows\System\YFMmeie.exe
  C:\Windows\System\YFMmeie.exe
  2⤵
  PID:6320
- C:\Windows\System\OwNeVep.exe
  C:\Windows\System\OwNeVep.exe
  2⤵
  PID:6340
- C:\Windows\System\yAsxflz.exe
  C:\Windows\System\yAsxflz.exe
  2⤵
  PID:6392
- C:\Windows\System\JfPbaAZ.exe
  C:\Windows\System\JfPbaAZ.exe
  2⤵
  PID:6412
- C:\Windows\System\cUlfInW.exe
  C:\Windows\System\cUlfInW.exe
  2⤵
  PID:6428
- C:\Windows\System\XuvbZOV.exe
  C:\Windows\System\XuvbZOV.exe
  2⤵
  PID:6444
- C:\Windows\System\QXzeppo.exe
  C:\Windows\System\QXzeppo.exe
  2⤵
  PID:6460
- C:\Windows\System\FBywpTs.exe
  C:\Windows\System\FBywpTs.exe
  2⤵
  PID:6476
- C:\Windows\System\tVDUnvN.exe
  C:\Windows\System\tVDUnvN.exe
  2⤵
  PID:6492
- C:\Windows\System\DYohqfk.exe
  C:\Windows\System\DYohqfk.exe
  2⤵
  PID:6508
- C:\Windows\System\wRiKQbl.exe
  C:\Windows\System\wRiKQbl.exe
  2⤵
  PID:6524
- C:\Windows\System\rmDjmkG.exe
  C:\Windows\System\rmDjmkG.exe
  2⤵
  PID:6560
- C:\Windows\System\RFEvbqX.exe
  C:\Windows\System\RFEvbqX.exe
  2⤵
  PID:6576
- C:\Windows\System\aKCQHKx.exe
  C:\Windows\System\aKCQHKx.exe
  2⤵
  PID:6592
- C:\Windows\System\WGDGUxl.exe
  C:\Windows\System\WGDGUxl.exe
  2⤵
  PID:6608
- C:\Windows\System\RCqwBmU.exe
  C:\Windows\System\RCqwBmU.exe
  2⤵
  PID:6624
- C:\Windows\System\bxdfmbS.exe
  C:\Windows\System\bxdfmbS.exe
  2⤵
  PID:6640
- C:\Windows\System\uuIgdFl.exe
  C:\Windows\System\uuIgdFl.exe
  2⤵
  PID:6656
- C:\Windows\System\KVIhqvE.exe
  C:\Windows\System\KVIhqvE.exe
  2⤵
  PID:6672
- C:\Windows\System\OZgLYMX.exe
  C:\Windows\System\OZgLYMX.exe
  2⤵
  PID:6732
- C:\Windows\System\WZoSyDh.exe
  C:\Windows\System\WZoSyDh.exe
  2⤵
  PID:6748
- C:\Windows\System\NYpIxPj.exe
  C:\Windows\System\NYpIxPj.exe
  2⤵
  PID:6764
- C:\Windows\System\TcgAiZT.exe
  C:\Windows\System\TcgAiZT.exe
  2⤵
  PID:6780
- C:\Windows\System\WuToxCG.exe
  C:\Windows\System\WuToxCG.exe
  2⤵
  PID:6796
- C:\Windows\System\JyzSvZy.exe
  C:\Windows\System\JyzSvZy.exe
  2⤵
  PID:6812
- C:\Windows\System\ouWIwCP.exe
  C:\Windows\System\ouWIwCP.exe
  2⤵
  PID:6828
- C:\Windows\System\CxIVdkx.exe
  C:\Windows\System\CxIVdkx.exe
  2⤵
  PID:6844
- C:\Windows\System\fAGzIYj.exe
  C:\Windows\System\fAGzIYj.exe
  2⤵
  PID:6864
- C:\Windows\System\NytYMbl.exe
  C:\Windows\System\NytYMbl.exe
  2⤵
  PID:6880
- C:\Windows\System\DYIJPVO.exe
  C:\Windows\System\DYIJPVO.exe
  2⤵
  PID:6896
- C:\Windows\System\RXVFmdy.exe
  C:\Windows\System\RXVFmdy.exe
  2⤵
  PID:6912
- C:\Windows\System\pptepHc.exe
  C:\Windows\System\pptepHc.exe
  2⤵
  PID:6928
- C:\Windows\System\iZDmnYD.exe
  C:\Windows\System\iZDmnYD.exe
  2⤵
  PID:6944
- C:\Windows\System\lpqVLsZ.exe
  C:\Windows\System\lpqVLsZ.exe
  2⤵
  PID:6960
- C:\Windows\System\vQUBUYM.exe
  C:\Windows\System\vQUBUYM.exe
  2⤵
  PID:6976
- C:\Windows\System\vkplrBl.exe
  C:\Windows\System\vkplrBl.exe
  2⤵
  PID:6992
- C:\Windows\System\WgCHkek.exe
  C:\Windows\System\WgCHkek.exe
  2⤵
  PID:7020
- C:\Windows\System\lnusHrT.exe
  C:\Windows\System\lnusHrT.exe
  2⤵
  PID:7044
- C:\Windows\System\lplYDEf.exe
  C:\Windows\System\lplYDEf.exe
  2⤵
  PID:7060
- C:\Windows\System\PVaRECB.exe
  C:\Windows\System\PVaRECB.exe
  2⤵
  PID:7076
- C:\Windows\System\PBjXynu.exe
  C:\Windows\System\PBjXynu.exe
  2⤵
  PID:7092
- C:\Windows\System\JUVUNtF.exe
  C:\Windows\System\JUVUNtF.exe
  2⤵
  PID:7108
- C:\Windows\System\EEghFFt.exe
  C:\Windows\System\EEghFFt.exe
  2⤵
  PID:7124
- C:\Windows\System\HdmLeTy.exe
  C:\Windows\System\HdmLeTy.exe
  2⤵
  PID:7140
- C:\Windows\System\pDovdyV.exe
  C:\Windows\System\pDovdyV.exe
  2⤵
  PID:7156
- C:\Windows\System\yoPYroU.exe
  C:\Windows\System\yoPYroU.exe
  2⤵
  PID:5352
- C:\Windows\System\gJaJdvj.exe
  C:\Windows\System\gJaJdvj.exe
  2⤵
  PID:6168
- C:\Windows\System\yOQjTko.exe
  C:\Windows\System\yOQjTko.exe
  2⤵
  PID:6232
- C:\Windows\System\QlMavMZ.exe
  C:\Windows\System\QlMavMZ.exe
  2⤵
  PID:6296
- C:\Windows\System\wnavRWP.exe
  C:\Windows\System\wnavRWP.exe
  2⤵
  PID:896
- C:\Windows\System\qaiDXBB.exe
  C:\Windows\System\qaiDXBB.exe
  2⤵
  PID:6248
- C:\Windows\System\aYnTUOF.exe
  C:\Windows\System\aYnTUOF.exe
  2⤵
  PID:6280
- C:\Windows\System\gQRSKAV.exe
  C:\Windows\System\gQRSKAV.exe
  2⤵
  PID:6368
- C:\Windows\System\JoRgZlh.exe
  C:\Windows\System\JoRgZlh.exe
  2⤵
  PID:6388
- C:\Windows\System\DQKuEcx.exe
  C:\Windows\System\DQKuEcx.exe
  2⤵
  PID:6452
- C:\Windows\System\LYOJfEY.exe
  C:\Windows\System\LYOJfEY.exe
  2⤵
  PID:6516
- C:\Windows\System\qqgedfX.exe
  C:\Windows\System\qqgedfX.exe
  2⤵
  PID:6436
- C:\Windows\System\BDuUVZL.exe
  C:\Windows\System\BDuUVZL.exe
  2⤵
  PID:6472
- C:\Windows\System\sHfXgbk.exe
  C:\Windows\System\sHfXgbk.exe
  2⤵
  PID:6540
- C:\Windows\System\bcDAZtz.exe
  C:\Windows\System\bcDAZtz.exe
  2⤵
  PID:6552
- C:\Windows\System\jjcMlGQ.exe
  C:\Windows\System\jjcMlGQ.exe
  2⤵
  PID:1508
- C:\Windows\System\mAUnmFu.exe
  C:\Windows\System\mAUnmFu.exe
  2⤵
  PID:6648
- C:\Windows\System\LzOAUHp.exe
  C:\Windows\System\LzOAUHp.exe
  2⤵
  PID:6572
- C:\Windows\System\dlCpDGh.exe
  C:\Windows\System\dlCpDGh.exe
  2⤵
  PID:6652
- C:\Windows\System\OmPRbZS.exe
  C:\Windows\System\OmPRbZS.exe
  2⤵
  PID:6680
- C:\Windows\System\ARPRpLZ.exe
  C:\Windows\System\ARPRpLZ.exe
  2⤵
  PID:6712
- C:\Windows\System\AdgYCCZ.exe
  C:\Windows\System\AdgYCCZ.exe
  2⤵
  PID:6728
- C:\Windows\System\HWZiykb.exe
  C:\Windows\System\HWZiykb.exe
  2⤵
  PID:6824
- C:\Windows\System\lfcMmWg.exe
  C:\Windows\System\lfcMmWg.exe
  2⤵
  PID:6920
- C:\Windows\System\VzDmwlE.exe
  C:\Windows\System\VzDmwlE.exe
  2⤵
  PID:6956
- C:\Windows\System\IBEoDjw.exe
  C:\Windows\System\IBEoDjw.exe
  2⤵
  PID:6840
- C:\Windows\System\DkhsSPJ.exe
  C:\Windows\System\DkhsSPJ.exe
  2⤵
  PID:6772
- C:\Windows\System\IMKflkr.exe
  C:\Windows\System\IMKflkr.exe
  2⤵
  PID:6836
- C:\Windows\System\yOYDrgO.exe
  C:\Windows\System\yOYDrgO.exe
  2⤵
  PID:6940
- C:\Windows\System\zTQylUL.exe
  C:\Windows\System\zTQylUL.exe
  2⤵
  PID:7008
- C:\Windows\System\cMTXBKU.exe
  C:\Windows\System\cMTXBKU.exe
  2⤵
  PID:7028
- C:\Windows\System\gsTEuUq.exe
  C:\Windows\System\gsTEuUq.exe
  2⤵
  PID:7068
- C:\Windows\System\TBKgdnc.exe
  C:\Windows\System\TBKgdnc.exe
  2⤵
  PID:7132
- C:\Windows\System\TpYjbbX.exe
  C:\Windows\System\TpYjbbX.exe
  2⤵
  PID:1696
- C:\Windows\System\mtSuWeD.exe
  C:\Windows\System\mtSuWeD.exe
  2⤵
  PID:6184
- C:\Windows\System\dcjeIvo.exe
  C:\Windows\System\dcjeIvo.exe
  2⤵
  PID:5848
- C:\Windows\System\oFBkMqj.exe
  C:\Windows\System\oFBkMqj.exe
  2⤵
  PID:7052
- C:\Windows\System\LNmyllQ.exe
  C:\Windows\System\LNmyllQ.exe
  2⤵
  PID:7088
- C:\Windows\System\WMweHcG.exe
  C:\Windows\System\WMweHcG.exe
  2⤵
  PID:6220
- C:\Windows\System\yMONDjB.exe
  C:\Windows\System\yMONDjB.exe
  2⤵
  PID:1596
- C:\Windows\System\ysefSYY.exe
  C:\Windows\System\ysefSYY.exe
  2⤵
  PID:6400
- C:\Windows\System\PWltepb.exe
  C:\Windows\System\PWltepb.exe
  2⤵
  PID:6404
- C:\Windows\System\kodyDSu.exe
  C:\Windows\System\kodyDSu.exe
  2⤵
  PID:6620
- C:\Windows\System\AVNVmjE.exe
  C:\Windows\System\AVNVmjE.exe
  2⤵
  PID:6636
- C:\Windows\System\yJHhcrw.exe
  C:\Windows\System\yJHhcrw.exe
  2⤵
  PID:2832
- C:\Windows\System\fKzyRmY.exe
  C:\Windows\System\fKzyRmY.exe
  2⤵
  PID:6704
- C:\Windows\System\DUJKfrM.exe
  C:\Windows\System\DUJKfrM.exe
  2⤵
  PID:6820
- C:\Windows\System\rOurUMs.exe
  C:\Windows\System\rOurUMs.exe
  2⤵
  PID:6792
- C:\Windows\System\RdwgPjt.exe
  C:\Windows\System\RdwgPjt.exe
  2⤵
  PID:6720
- C:\Windows\System\dVBPCNY.exe
  C:\Windows\System\dVBPCNY.exe
  2⤵
  PID:6876
- C:\Windows\System\zMpUrzE.exe
  C:\Windows\System\zMpUrzE.exe
  2⤵
  PID:6568
- C:\Windows\System\lLBraan.exe
  C:\Windows\System\lLBraan.exe
  2⤵
  PID:6804
- C:\Windows\System\kwoWUPA.exe
  C:\Windows\System\kwoWUPA.exe
  2⤵
  PID:1632
- C:\Windows\System\hluVNit.exe
  C:\Windows\System\hluVNit.exe
  2⤵
  PID:2904
- C:\Windows\System\UjAFrCN.exe
  C:\Windows\System\UjAFrCN.exe
  2⤵
  PID:7120
- C:\Windows\System\TcfWqey.exe
  C:\Windows\System\TcfWqey.exe
  2⤵
  PID:6312
- C:\Windows\System\dbyVNeg.exe
  C:\Windows\System\dbyVNeg.exe
  2⤵
  PID:6380
- C:\Windows\System\ZJccTVn.exe
  C:\Windows\System\ZJccTVn.exe
  2⤵
  PID:6384
- C:\Windows\System\HmqPQiz.exe
  C:\Windows\System\HmqPQiz.exe
  2⤵
  PID:2468
- C:\Windows\System\lIwOrdW.exe
  C:\Windows\System\lIwOrdW.exe
  2⤵
  PID:6408
- C:\Windows\System\TGOSlwW.exe
  C:\Windows\System\TGOSlwW.exe
  2⤵
  PID:876
- C:\Windows\System\FhfhZig.exe
  C:\Windows\System\FhfhZig.exe
  2⤵
  PID:6700
- C:\Windows\System\QJhtjho.exe
  C:\Windows\System\QJhtjho.exe
  2⤵
  PID:6904
- C:\Windows\System\dBvfDku.exe
  C:\Windows\System\dBvfDku.exe
  2⤵
  PID:6988
- C:\Windows\System\bQGdyri.exe
  C:\Windows\System\bQGdyri.exe
  2⤵
  PID:6584
- C:\Windows\System\TQEegGo.exe
  C:\Windows\System\TQEegGo.exe
  2⤵
  PID:6972
- C:\Windows\System\yoSTMCK.exe
  C:\Windows\System\yoSTMCK.exe
  2⤵
  PID:6760
- C:\Windows\System\KNZHKrs.exe
  C:\Windows\System\KNZHKrs.exe
  2⤵
  PID:572
- C:\Windows\System\ecjMuuu.exe
  C:\Windows\System\ecjMuuu.exe
  2⤵
  PID:6856
- C:\Windows\System\nCDJjFR.exe
  C:\Windows\System\nCDJjFR.exe
  2⤵
  PID:6328
- C:\Windows\System\RrLxOGX.exe
  C:\Windows\System\RrLxOGX.exe
  2⤵
  PID:1968
- C:\Windows\System\YvxKAGN.exe
  C:\Windows\System\YvxKAGN.exe
  2⤵
  PID:680
- C:\Windows\System\rViypBI.exe
  C:\Windows\System\rViypBI.exe
  2⤵
  PID:6376
- C:\Windows\System\UzDlhbq.exe
  C:\Windows\System\UzDlhbq.exe
  2⤵
  PID:1784
- C:\Windows\System\WiRScPV.exe
  C:\Windows\System\WiRScPV.exe
  2⤵
  PID:2892
- C:\Windows\System\Eogiwyj.exe
  C:\Windows\System\Eogiwyj.exe
  2⤵
  PID:6708
- C:\Windows\System\ZuZEdiZ.exe
  C:\Windows\System\ZuZEdiZ.exe
  2⤵
  PID:7176
- C:\Windows\System\zSDDaMB.exe
  C:\Windows\System\zSDDaMB.exe
  2⤵
  PID:7192
- C:\Windows\System\EyiSSuR.exe
  C:\Windows\System\EyiSSuR.exe
  2⤵
  PID:7208
- C:\Windows\System\smJioGA.exe
  C:\Windows\System\smJioGA.exe
  2⤵
  PID:7224
- C:\Windows\System\wyHQrvF.exe
  C:\Windows\System\wyHQrvF.exe
  2⤵
  PID:7240
- C:\Windows\System\DQYOwLa.exe
  C:\Windows\System\DQYOwLa.exe
  2⤵
  PID:7256
- C:\Windows\System\uOMzNbN.exe
  C:\Windows\System\uOMzNbN.exe
  2⤵
  PID:7272
- C:\Windows\System\GSNMkiO.exe
  C:\Windows\System\GSNMkiO.exe
  2⤵
  PID:7288
- C:\Windows\System\kxttwps.exe
  C:\Windows\System\kxttwps.exe
  2⤵
  PID:7304
- C:\Windows\System\KqAlYpp.exe
  C:\Windows\System\KqAlYpp.exe
  2⤵
  PID:7320
- C:\Windows\System\OYpGCKI.exe
  C:\Windows\System\OYpGCKI.exe
  2⤵
  PID:7336
- C:\Windows\System\GEAUNXN.exe
  C:\Windows\System\GEAUNXN.exe
  2⤵
  PID:7352
- C:\Windows\System\ktnCNoC.exe
  C:\Windows\System\ktnCNoC.exe
  2⤵
  PID:7368
- C:\Windows\System\MtffJGk.exe
  C:\Windows\System\MtffJGk.exe
  2⤵
  PID:7384
- C:\Windows\System\FzRldbk.exe
  C:\Windows\System\FzRldbk.exe
  2⤵
  PID:7400
- C:\Windows\System\AncFimB.exe
  C:\Windows\System\AncFimB.exe
  2⤵
  PID:7416
- C:\Windows\System\XkqBIfs.exe
  C:\Windows\System\XkqBIfs.exe
  2⤵
  PID:7432
- C:\Windows\System\SvTZnJc.exe
  C:\Windows\System\SvTZnJc.exe
  2⤵
  PID:7448
- C:\Windows\System\bmOfIun.exe
  C:\Windows\System\bmOfIun.exe
  2⤵
  PID:7464
- C:\Windows\System\exhfXqQ.exe
  C:\Windows\System\exhfXqQ.exe
  2⤵
  PID:7480
- C:\Windows\System\tKriBEB.exe
  C:\Windows\System\tKriBEB.exe
  2⤵
  PID:7496
- C:\Windows\System\AjIQaje.exe
  C:\Windows\System\AjIQaje.exe
  2⤵
  PID:7512
- C:\Windows\System\eEWanMd.exe
  C:\Windows\System\eEWanMd.exe
  2⤵
  PID:7528
- C:\Windows\System\cdTZNgH.exe
  C:\Windows\System\cdTZNgH.exe
  2⤵
  PID:7544
- C:\Windows\System\rnuwQhy.exe
  C:\Windows\System\rnuwQhy.exe
  2⤵
  PID:7560
- C:\Windows\System\IZBVKqr.exe
  C:\Windows\System\IZBVKqr.exe
  2⤵
  PID:7576
- C:\Windows\System\MzyZqcy.exe
  C:\Windows\System\MzyZqcy.exe
  2⤵
  PID:7592
- C:\Windows\System\eTEeejN.exe
  C:\Windows\System\eTEeejN.exe
  2⤵
  PID:7608
- C:\Windows\System\GwvYZnU.exe
  C:\Windows\System\GwvYZnU.exe
  2⤵
  PID:7624
- C:\Windows\System\FqABFrd.exe
  C:\Windows\System\FqABFrd.exe
  2⤵
  PID:7640
- C:\Windows\System\qIERiEN.exe
  C:\Windows\System\qIERiEN.exe
  2⤵
  PID:7656
- C:\Windows\System\ZiTtsnv.exe
  C:\Windows\System\ZiTtsnv.exe
  2⤵
  PID:7672
- C:\Windows\System\iDHWsJY.exe
  C:\Windows\System\iDHWsJY.exe
  2⤵
  PID:7688
- C:\Windows\System\sLbMNPu.exe
  C:\Windows\System\sLbMNPu.exe
  2⤵
  PID:7704
- C:\Windows\System\tvCuyzS.exe
  C:\Windows\System\tvCuyzS.exe
  2⤵
  PID:7720
- C:\Windows\System\pXkRRcV.exe
  C:\Windows\System\pXkRRcV.exe
  2⤵
  PID:7740
- C:\Windows\System\XDtKcDX.exe
  C:\Windows\System\XDtKcDX.exe
  2⤵
  PID:7756
- C:\Windows\System\DRcJRGP.exe
  C:\Windows\System\DRcJRGP.exe
  2⤵
  PID:7772
- C:\Windows\System\AxdHexr.exe
  C:\Windows\System\AxdHexr.exe
  2⤵
  PID:7788
- C:\Windows\System\WdSPhZf.exe
  C:\Windows\System\WdSPhZf.exe
  2⤵
  PID:7804
- C:\Windows\System\lidENcU.exe
  C:\Windows\System\lidENcU.exe
  2⤵
  PID:7820
- C:\Windows\System\bfuQTCo.exe
  C:\Windows\System\bfuQTCo.exe
  2⤵
  PID:7836
- C:\Windows\System\aAqRKsZ.exe
  C:\Windows\System\aAqRKsZ.exe
  2⤵
  PID:7852
- C:\Windows\System\EJqeuGF.exe
  C:\Windows\System\EJqeuGF.exe
  2⤵
  PID:7868
- C:\Windows\System\hzapEoU.exe
  C:\Windows\System\hzapEoU.exe
  2⤵
  PID:7884
- C:\Windows\System\PnjFWyn.exe
  C:\Windows\System\PnjFWyn.exe
  2⤵
  PID:7900
- C:\Windows\System\eYagFKA.exe
  C:\Windows\System\eYagFKA.exe
  2⤵
  PID:7916
- C:\Windows\System\AfPNZEb.exe
  C:\Windows\System\AfPNZEb.exe
  2⤵
  PID:7932
- C:\Windows\System\zPlgeDS.exe
  C:\Windows\System\zPlgeDS.exe
  2⤵
  PID:7948
- C:\Windows\System\hviqaqq.exe
  C:\Windows\System\hviqaqq.exe
  2⤵
  PID:7964
- C:\Windows\System\vTwnYvT.exe
  C:\Windows\System\vTwnYvT.exe
  2⤵
  PID:7980
- C:\Windows\System\xZaVmBo.exe
  C:\Windows\System\xZaVmBo.exe
  2⤵
  PID:7996
- C:\Windows\System\AiVYjFK.exe
  C:\Windows\System\AiVYjFK.exe
  2⤵
  PID:8012
- C:\Windows\System\PRNLSux.exe
  C:\Windows\System\PRNLSux.exe
  2⤵
  PID:8028
- C:\Windows\System\KYtoTWw.exe
  C:\Windows\System\KYtoTWw.exe
  2⤵
  PID:8044
- C:\Windows\System\iRkIEqr.exe
  C:\Windows\System\iRkIEqr.exe
  2⤵
  PID:8060
- C:\Windows\System\TouWcPR.exe
  C:\Windows\System\TouWcPR.exe
  2⤵
  PID:8076
- C:\Windows\System\bDItUzC.exe
  C:\Windows\System\bDItUzC.exe
  2⤵
  PID:8092
- C:\Windows\System\atDghbt.exe
  C:\Windows\System\atDghbt.exe
  2⤵
  PID:8108
- C:\Windows\System\EUeYIXs.exe
  C:\Windows\System\EUeYIXs.exe
  2⤵
  PID:8124
- C:\Windows\System\VYAizFZ.exe
  C:\Windows\System\VYAizFZ.exe
  2⤵
  PID:8140
- C:\Windows\System\DBxbOno.exe
  C:\Windows\System\DBxbOno.exe
  2⤵
  PID:8156
- C:\Windows\System\KkYcShi.exe
  C:\Windows\System\KkYcShi.exe
  2⤵
  PID:8172
- C:\Windows\System\HBeCHKj.exe
  C:\Windows\System\HBeCHKj.exe
  2⤵
  PID:8188
- C:\Windows\System\jUeCgZk.exe
  C:\Windows\System\jUeCgZk.exe
  2⤵
  PID:2944
- C:\Windows\System\xiwpCts.exe
  C:\Windows\System\xiwpCts.exe
  2⤵
  PID:1140
- C:\Windows\System\bGGgDZP.exe
  C:\Windows\System\bGGgDZP.exe
  2⤵
  PID:7232
- C:\Windows\System\gJkzsur.exe
  C:\Windows\System\gJkzsur.exe
  2⤵
  PID:6424
- C:\Windows\System\aAWDtlq.exe
  C:\Windows\System\aAWDtlq.exe
  2⤵
  PID:7300
- C:\Windows\System\YIAYrFU.exe
  C:\Windows\System\YIAYrFU.exe
  2⤵
  PID:7364
- C:\Windows\System\rTfgJAe.exe
  C:\Windows\System\rTfgJAe.exe
  2⤵
  PID:1916
- C:\Windows\System\cdJeNPS.exe
  C:\Windows\System\cdJeNPS.exe
  2⤵
  PID:7460
- C:\Windows\System\CJZNXdd.exe
  C:\Windows\System\CJZNXdd.exe
  2⤵
  PID:7252
- C:\Windows\System\UxSdHTr.exe
  C:\Windows\System\UxSdHTr.exe
  2⤵
  PID:6724
- C:\Windows\System\HBkplZb.exe
  C:\Windows\System\HBkplZb.exe
  2⤵
  PID:7444
- C:\Windows\System\fJFJuQg.exe
  C:\Windows\System\fJFJuQg.exe
  2⤵
  PID:700
- C:\Windows\System\tJXtXuv.exe
  C:\Windows\System\tJXtXuv.exe
  2⤵
  PID:2572
- C:\Windows\System\PBkWqCB.exe
  C:\Windows\System\PBkWqCB.exe
  2⤵
  PID:6532
- C:\Windows\System\mUdwNOm.exe
  C:\Windows\System\mUdwNOm.exe
  2⤵
  PID:7312
- C:\Windows\System\aAcUIas.exe
  C:\Windows\System\aAcUIas.exe
  2⤵
  PID:7412
- C:\Windows\System\qcjjoLk.exe
  C:\Windows\System\qcjjoLk.exe
  2⤵
  PID:7508
- C:\Windows\System\gXHVXUr.exe
  C:\Windows\System\gXHVXUr.exe
  2⤵
  PID:7540
- C:\Windows\System\DGTbTrm.exe
  C:\Windows\System\DGTbTrm.exe
  2⤵
  PID:7588
- C:\Windows\System\svxsRCA.exe
  C:\Windows\System\svxsRCA.exe
  2⤵
  PID:7604
- C:\Windows\System\CoErPbB.exe
  C:\Windows\System\CoErPbB.exe
  2⤵
  PID:7652
- C:\Windows\System\MgGZIvW.exe
  C:\Windows\System\MgGZIvW.exe
  2⤵
  PID:7684
- C:\Windows\System\GlKEvmy.exe
  C:\Windows\System\GlKEvmy.exe
  2⤵
  PID:7700
- C:\Windows\System\pqKgRaX.exe
  C:\Windows\System\pqKgRaX.exe
  2⤵
  PID:7752
- C:\Windows\System\UNkkyBC.exe
  C:\Windows\System\UNkkyBC.exe
  2⤵
  PID:7768
- C:\Windows\System\RbUWtaA.exe
  C:\Windows\System\RbUWtaA.exe
  2⤵
  PID:7816
- C:\Windows\System\nBWTYub.exe
  C:\Windows\System\nBWTYub.exe
  2⤵
  PID:7844
- C:\Windows\System\KMbROFK.exe
  C:\Windows\System\KMbROFK.exe
  2⤵
  PID:7908
- C:\Windows\System\ZqkUCim.exe
  C:\Windows\System\ZqkUCim.exe
  2⤵
  PID:7912
- C:\Windows\System\pCKKopH.exe
  C:\Windows\System\pCKKopH.exe
  2⤵
  PID:7976
- C:\Windows\System\jhoXrSr.exe
  C:\Windows\System\jhoXrSr.exe
  2⤵
  PID:7892
- C:\Windows\System\vPqMnQK.exe
  C:\Windows\System\vPqMnQK.exe
  2⤵
  PID:8040
- C:\Windows\System\PgWDbUm.exe
  C:\Windows\System\PgWDbUm.exe
  2⤵
  PID:7992
- C:\Windows\System\YaglMjH.exe
  C:\Windows\System\YaglMjH.exe
  2⤵
  PID:7924
- C:\Windows\System\IVWucZU.exe
  C:\Windows\System\IVWucZU.exe
  2⤵
  PID:7956
- C:\Windows\System\vdjEgsB.exe
  C:\Windows\System\vdjEgsB.exe
  2⤵
  PID:8120
- C:\Windows\System\RKqqLCk.exe
  C:\Windows\System\RKqqLCk.exe
  2⤵
  PID:8088
- C:\Windows\System\PdiPpsj.exe
  C:\Windows\System\PdiPpsj.exe
  2⤵
  PID:8148
- C:\Windows\System\RnitDzM.exe
  C:\Windows\System\RnitDzM.exe
  2⤵
  PID:7204
- C:\Windows\System\ECdYUtA.exe
  C:\Windows\System\ECdYUtA.exe
  2⤵
  PID:2308
- C:\Windows\System\DPluGKl.exe
  C:\Windows\System\DPluGKl.exe
  2⤵
  PID:7268
- C:\Windows\System\ETJAXKK.exe
  C:\Windows\System\ETJAXKK.exe
  2⤵
  PID:7360
- C:\Windows\System\eZekdra.exe
  C:\Windows\System\eZekdra.exe
  2⤵
  PID:7248
- C:\Windows\System\QzplcoA.exe
  C:\Windows\System\QzplcoA.exe
  2⤵
  PID:7488
- C:\Windows\System\VhjDNWO.exe
  C:\Windows\System\VhjDNWO.exe
  2⤵
  PID:7184
- C:\Windows\System\qVfmRhB.exe
  C:\Windows\System\qVfmRhB.exe
  2⤵
  PID:6588
- C:\Windows\System\hfOCBQn.exe
  C:\Windows\System\hfOCBQn.exe
  2⤵
  PID:7568
- C:\Windows\System\YMITCkY.exe
  C:\Windows\System\YMITCkY.exe
  2⤵
  PID:7648
- C:\Windows\System\UvbWOXI.exe
  C:\Windows\System\UvbWOXI.exe
  2⤵
  PID:7036
- C:\Windows\System\OHyOdly.exe
  C:\Windows\System\OHyOdly.exe
  2⤵
  PID:7616
- C:\Windows\System\UpQBMnn.exe
  C:\Windows\System\UpQBMnn.exe
  2⤵
  PID:7748
- C:\Windows\System\lxWtzJO.exe
  C:\Windows\System\lxWtzJO.exe
  2⤵
  PID:7812
- C:\Windows\System\NwpZlGC.exe
  C:\Windows\System\NwpZlGC.exe
  2⤵
  PID:7828
- C:\Windows\System\SOQAYrv.exe
  C:\Windows\System\SOQAYrv.exe
  2⤵
  PID:7972
- C:\Windows\System\mOwTnGr.exe
  C:\Windows\System\mOwTnGr.exe
  2⤵
  PID:3564
- C:\Windows\System\YXXZjnj.exe
  C:\Windows\System\YXXZjnj.exe
  2⤵
  PID:8132
- C:\Windows\System\tWIIApl.exe
  C:\Windows\System\tWIIApl.exe
  2⤵
  PID:7988
- C:\Windows\System\seuDzJv.exe
  C:\Windows\System\seuDzJv.exe
  2⤵
  PID:8052
- C:\Windows\System\YDUrXGg.exe
  C:\Windows\System\YDUrXGg.exe
  2⤵
  PID:7264
- C:\Windows\System\rFHEdbp.exe
  C:\Windows\System\rFHEdbp.exe
  2⤵
  PID:7332
- C:\Windows\System\ilyIifx.exe
  C:\Windows\System\ilyIifx.exe
  2⤵
  PID:7316
- C:\Windows\System\MqPivYq.exe
  C:\Windows\System\MqPivYq.exe
  2⤵
  PID:7476
- C:\Windows\System\ZDItSGt.exe
  C:\Windows\System\ZDItSGt.exe
  2⤵
  PID:7408
- C:\Windows\System\shjhNkh.exe
  C:\Windows\System\shjhNkh.exe
  2⤵
  PID:7552
- C:\Windows\System\XhOXDBg.exe
  C:\Windows\System\XhOXDBg.exe
  2⤵
  PID:7800
- C:\Windows\System\LcRhDpi.exe
  C:\Windows\System\LcRhDpi.exe
  2⤵
  PID:8024
- C:\Windows\System\zeOCrRe.exe
  C:\Windows\System\zeOCrRe.exe
  2⤵
  PID:8104
- C:\Windows\System\fyalFVc.exe
  C:\Windows\System\fyalFVc.exe
  2⤵
  PID:8184
- C:\Windows\System\gwWjBGy.exe
  C:\Windows\System\gwWjBGy.exe
  2⤵
  PID:1600
- C:\Windows\System\eIbqWbS.exe
  C:\Windows\System\eIbqWbS.exe
  2⤵
  PID:7796
- C:\Windows\System\AhizfnX.exe
  C:\Windows\System\AhizfnX.exe
  2⤵
  PID:7736
- C:\Windows\System\XrYuhuX.exe
  C:\Windows\System\XrYuhuX.exe
  2⤵
  PID:8208
- C:\Windows\System\RnsBKFe.exe
  C:\Windows\System\RnsBKFe.exe
  2⤵
  PID:8224
- C:\Windows\System\pNAeUpI.exe
  C:\Windows\System\pNAeUpI.exe
  2⤵
  PID:8240
- C:\Windows\System\qhJtgkS.exe
  C:\Windows\System\qhJtgkS.exe
  2⤵
  PID:8256
- C:\Windows\System\ToWhVwV.exe
  C:\Windows\System\ToWhVwV.exe
  2⤵
  PID:8272
- C:\Windows\System\fhQGDHn.exe
  C:\Windows\System\fhQGDHn.exe
  2⤵
  PID:8292
- C:\Windows\System\zMEhzou.exe
  C:\Windows\System\zMEhzou.exe
  2⤵
  PID:8308
- C:\Windows\System\PeSqMgj.exe
  C:\Windows\System\PeSqMgj.exe
  2⤵
  PID:8324
- C:\Windows\System\apLjNzX.exe
  C:\Windows\System\apLjNzX.exe
  2⤵
  PID:8340
- C:\Windows\System\iMKREMI.exe
  C:\Windows\System\iMKREMI.exe
  2⤵
  PID:8356
- C:\Windows\System\WxvENPc.exe
  C:\Windows\System\WxvENPc.exe
  2⤵
  PID:8372
- C:\Windows\System\EVXjJmG.exe
  C:\Windows\System\EVXjJmG.exe
  2⤵
  PID:8388
- C:\Windows\System\ZGRTZmj.exe
  C:\Windows\System\ZGRTZmj.exe
  2⤵
  PID:8404
- C:\Windows\System\imKReaY.exe
  C:\Windows\System\imKReaY.exe
  2⤵
  PID:8420
- C:\Windows\System\lgHOKVC.exe
  C:\Windows\System\lgHOKVC.exe
  2⤵
  PID:8436
- C:\Windows\System\WnIdQYJ.exe
  C:\Windows\System\WnIdQYJ.exe
  2⤵
  PID:8452
- C:\Windows\System\rOHTBxj.exe
  C:\Windows\System\rOHTBxj.exe
  2⤵
  PID:8468
- C:\Windows\System\LJiINpu.exe
  C:\Windows\System\LJiINpu.exe
  2⤵
  PID:8484
- C:\Windows\System\VXQNdps.exe
  C:\Windows\System\VXQNdps.exe
  2⤵
  PID:8500
- C:\Windows\System\cepyGWs.exe
  C:\Windows\System\cepyGWs.exe
  2⤵
  PID:8516
- C:\Windows\System\peOaMTf.exe
  C:\Windows\System\peOaMTf.exe
  2⤵
  PID:8532
- C:\Windows\System\JtzhkcY.exe
  C:\Windows\System\JtzhkcY.exe
  2⤵
  PID:8548
- C:\Windows\System\rtvfDFB.exe
  C:\Windows\System\rtvfDFB.exe
  2⤵
  PID:8564
- C:\Windows\System\wrUvuuz.exe
  C:\Windows\System\wrUvuuz.exe
  2⤵
  PID:8580
- C:\Windows\System\LSBsgCN.exe
  C:\Windows\System\LSBsgCN.exe
  2⤵
  PID:8596
- C:\Windows\System\hpzYhQg.exe
  C:\Windows\System\hpzYhQg.exe
  2⤵
  PID:8612
- C:\Windows\System\cGOFYKu.exe
  C:\Windows\System\cGOFYKu.exe
  2⤵
  PID:8628
- C:\Windows\System\GOpCqnr.exe
  C:\Windows\System\GOpCqnr.exe
  2⤵
  PID:8644
- C:\Windows\System\IkySoiX.exe
  C:\Windows\System\IkySoiX.exe
  2⤵
  PID:8660
- C:\Windows\System\nqdQgAD.exe
  C:\Windows\System\nqdQgAD.exe
  2⤵
  PID:8676
- C:\Windows\System\RAHdkvU.exe
  C:\Windows\System\RAHdkvU.exe
  2⤵
  PID:8692
- C:\Windows\System\NiTRNYE.exe
  C:\Windows\System\NiTRNYE.exe
  2⤵
  PID:8708
- C:\Windows\System\olYyuDl.exe
  C:\Windows\System\olYyuDl.exe
  2⤵
  PID:8724
- C:\Windows\System\ULvMTtL.exe
  C:\Windows\System\ULvMTtL.exe
  2⤵
  PID:8740
- C:\Windows\System\NLNfNhS.exe
  C:\Windows\System\NLNfNhS.exe
  2⤵
  PID:8756
- C:\Windows\System\MFpsUcP.exe
  C:\Windows\System\MFpsUcP.exe
  2⤵
  PID:8772
- C:\Windows\System\MDgeLpd.exe
  C:\Windows\System\MDgeLpd.exe
  2⤵
  PID:8788
- C:\Windows\System\QUszcSP.exe
  C:\Windows\System\QUszcSP.exe
  2⤵
  PID:8804
- C:\Windows\System\vxnXHle.exe
  C:\Windows\System\vxnXHle.exe
  2⤵
  PID:8820
- C:\Windows\System\kIAXaCl.exe
  C:\Windows\System\kIAXaCl.exe
  2⤵
  PID:8836
- C:\Windows\System\LMgqfJy.exe
  C:\Windows\System\LMgqfJy.exe
  2⤵
  PID:8852
- C:\Windows\System\vnYQSwS.exe
  C:\Windows\System\vnYQSwS.exe
  2⤵
  PID:8868
- C:\Windows\System\tTOjFTh.exe
  C:\Windows\System\tTOjFTh.exe
  2⤵
  PID:8884
- C:\Windows\System\raIDYIf.exe
  C:\Windows\System\raIDYIf.exe
  2⤵
  PID:8904
- C:\Windows\System\gPynKAG.exe
  C:\Windows\System\gPynKAG.exe
  2⤵
  PID:8920
- C:\Windows\System\xTpRtng.exe
  C:\Windows\System\xTpRtng.exe
  2⤵
  PID:8936
- C:\Windows\System\euGmGpe.exe
  C:\Windows\System\euGmGpe.exe
  2⤵
  PID:8952
- C:\Windows\System\tEvtxwa.exe
  C:\Windows\System\tEvtxwa.exe
  2⤵
  PID:8968
- C:\Windows\System\XVbilkI.exe
  C:\Windows\System\XVbilkI.exe
  2⤵
  PID:8984
- C:\Windows\System\woZmdxN.exe
  C:\Windows\System\woZmdxN.exe
  2⤵
  PID:9000
- C:\Windows\System\ECYnUSu.exe
  C:\Windows\System\ECYnUSu.exe
  2⤵
  PID:9016
- C:\Windows\System\AEZGkaH.exe
  C:\Windows\System\AEZGkaH.exe
  2⤵
  PID:9032
- C:\Windows\System\GMRSzeA.exe
  C:\Windows\System\GMRSzeA.exe
  2⤵
  PID:9048
- C:\Windows\System\kGwRXkD.exe
  C:\Windows\System\kGwRXkD.exe
  2⤵
  PID:9064
- C:\Windows\System\SzTNEqx.exe
  C:\Windows\System\SzTNEqx.exe
  2⤵
  PID:9080
- C:\Windows\System\TUAYjmS.exe
  C:\Windows\System\TUAYjmS.exe
  2⤵
  PID:9096
- C:\Windows\System\bUTJquz.exe
  C:\Windows\System\bUTJquz.exe
  2⤵
  PID:9112
- C:\Windows\System\NpQAyVs.exe
  C:\Windows\System\NpQAyVs.exe
  2⤵
  PID:9128
- C:\Windows\System\hufrKEL.exe
  C:\Windows\System\hufrKEL.exe
  2⤵
  PID:9144
- C:\Windows\System\xFcETat.exe
  C:\Windows\System\xFcETat.exe
  2⤵
  PID:9160
- C:\Windows\System\yoKOQnU.exe
  C:\Windows\System\yoKOQnU.exe
  2⤵
  PID:9176
- C:\Windows\System\pYSafik.exe
  C:\Windows\System\pYSafik.exe
  2⤵
  PID:9192
- C:\Windows\System\PqVchbl.exe
  C:\Windows\System\PqVchbl.exe
  2⤵
  PID:9208
- C:\Windows\System\oJqQqtm.exe
  C:\Windows\System\oJqQqtm.exe
  2⤵
  PID:6548
- C:\Windows\System\vsJtNSl.exe
  C:\Windows\System\vsJtNSl.exe
  2⤵
  PID:7504
- C:\Windows\System\qBSlEXD.exe
  C:\Windows\System\qBSlEXD.exe
  2⤵
  PID:7944
- C:\Windows\System\KKSSuFI.exe
  C:\Windows\System\KKSSuFI.exe
  2⤵
  PID:7780
- C:\Windows\System\ehRxaVR.exe
  C:\Windows\System\ehRxaVR.exe
  2⤵
  PID:8200
- C:\Windows\System\rsczpTq.exe
  C:\Windows\System\rsczpTq.exe
  2⤵
  PID:8268
- C:\Windows\System\sTipwfl.exe
  C:\Windows\System\sTipwfl.exe
  2⤵
  PID:8300
- C:\Windows\System\RLTQHmk.exe
  C:\Windows\System\RLTQHmk.exe
  2⤵
  PID:8316
- C:\Windows\System\EdAdvJe.exe
  C:\Windows\System\EdAdvJe.exe
  2⤵
  PID:8384
- C:\Windows\System\XxASJkb.exe
  C:\Windows\System\XxASJkb.exe
  2⤵
  PID:8352
- C:\Windows\System\sjEfnyY.exe
  C:\Windows\System\sjEfnyY.exe
  2⤵
  PID:8544
- C:\Windows\System\QgwdohZ.exe
  C:\Windows\System\QgwdohZ.exe
  2⤵
  PID:8512
- C:\Windows\System\UMCzzJS.exe
  C:\Windows\System\UMCzzJS.exe
  2⤵
  PID:8608
- C:\Windows\System\Gvahvoc.exe
  C:\Windows\System\Gvahvoc.exe
  2⤵
  PID:8672
- C:\Windows\System\KGthDAp.exe
  C:\Windows\System\KGthDAp.exe
  2⤵
  PID:8396
- C:\Windows\System\wvqHwET.exe
  C:\Windows\System\wvqHwET.exe
  2⤵
  PID:8752
- C:\Windows\System\JtevHEv.exe
  C:\Windows\System\JtevHEv.exe
  2⤵
  PID:8844
- C:\Windows\System\jiXyJts.exe
  C:\Windows\System\jiXyJts.exe
  2⤵
  PID:8592
- C:\Windows\System\fcWoDTj.exe
  C:\Windows\System\fcWoDTj.exe
  2⤵
  PID:8428
- C:\Windows\System\JfdCibS.exe
  C:\Windows\System\JfdCibS.exe
  2⤵
  PID:8828
- C:\Windows\System\vbDNLmy.exe
  C:\Windows\System\vbDNLmy.exe
  2⤵
  PID:8764
- C:\Windows\System\kxSJDQm.exe
  C:\Windows\System\kxSJDQm.exe
  2⤵
  PID:8464
- C:\Windows\System\vgipAYT.exe
  C:\Windows\System\vgipAYT.exe
  2⤵
  PID:8556
- C:\Windows\System\iXnYNZl.exe
  C:\Windows\System\iXnYNZl.exe
  2⤵
  PID:8652
- C:\Windows\System\UCdFiiy.exe
  C:\Windows\System\UCdFiiy.exe
  2⤵
  PID:8876
- C:\Windows\System\VBuQqRF.exe
  C:\Windows\System\VBuQqRF.exe
  2⤵
  PID:8960
- C:\Windows\System\uUSygBe.exe
  C:\Windows\System\uUSygBe.exe
  2⤵
  PID:9028
- C:\Windows\System\rDEqulI.exe
  C:\Windows\System\rDEqulI.exe
  2⤵
  PID:9092
- C:\Windows\System\YSPDcDr.exe
  C:\Windows\System\YSPDcDr.exe
  2⤵
  PID:8880
- C:\Windows\System\ltiSKHk.exe
  C:\Windows\System\ltiSKHk.exe
  2⤵
  PID:8976
- C:\Windows\System\QDXoCaF.exe
  C:\Windows\System\QDXoCaF.exe
  2⤵
  PID:8892
- C:\Windows\System\caOEOLl.exe
  C:\Windows\System\caOEOLl.exe
  2⤵
  PID:9184
- C:\Windows\System\JKSLqQW.exe
  C:\Windows\System\JKSLqQW.exe
  2⤵
  PID:9012
- C:\Windows\System\BEMbLNj.exe
  C:\Windows\System\BEMbLNj.exe
  2⤵
  PID:9076
- C:\Windows\System\ZKMGzxw.exe
  C:\Windows\System\ZKMGzxw.exe
  2⤵
  PID:9168
- C:\Windows\System\aNmwowV.exe
  C:\Windows\System\aNmwowV.exe
  2⤵
  PID:7880
- C:\Windows\System\rYXMvtd.exe
  C:\Windows\System\rYXMvtd.exe
  2⤵
  PID:7712
- C:\Windows\System\QfZsoWY.exe
  C:\Windows\System\QfZsoWY.exe
  2⤵
  PID:8332
- C:\Windows\System\SgCFcKm.exe
  C:\Windows\System\SgCFcKm.exe
  2⤵
  PID:7188
- C:\Windows\System\tpdkdWR.exe
  C:\Windows\System\tpdkdWR.exe
  2⤵
  PID:8540
- C:\Windows\System\SpOVkaK.exe
  C:\Windows\System\SpOVkaK.exe
  2⤵
  PID:8480
- C:\Windows\System\bYDZPkk.exe
  C:\Windows\System\bYDZPkk.exe
  2⤵
  PID:8784
- C:\Windows\System\gVPzFPl.exe
  C:\Windows\System\gVPzFPl.exe
  2⤵
  PID:8720
- C:\Windows\System\xksjPEr.exe
  C:\Windows\System\xksjPEr.exe
  2⤵
  PID:8688
- C:\Windows\System\PiaCUKk.exe
  C:\Windows\System\PiaCUKk.exe
  2⤵
  PID:8528
- C:\Windows\System\HqLcnSJ.exe
  C:\Windows\System\HqLcnSJ.exe
  2⤵
  PID:8860
- C:\Windows\System\pwWLnyg.exe
  C:\Windows\System\pwWLnyg.exe
  2⤵
  PID:8964
- C:\Windows\System\blvbnFl.exe
  C:\Windows\System\blvbnFl.exe
  2⤵
  PID:2232
- C:\Windows\System\YjsclWf.exe
  C:\Windows\System\YjsclWf.exe
  2⤵
  PID:8912
- C:\Windows\System\MhLvGHB.exe
  C:\Windows\System\MhLvGHB.exe
  2⤵
  PID:9072
- C:\Windows\System\dtdohxu.exe
  C:\Windows\System\dtdohxu.exe
  2⤵
  PID:8248
- C:\Windows\System\rWDWPag.exe
  C:\Windows\System\rWDWPag.exe
  2⤵
  PID:8288
- C:\Windows\System\aTEZaGf.exe
  C:\Windows\System\aTEZaGf.exe
  2⤵
  PID:8640
- C:\Windows\System\BTDHEET.exe
  C:\Windows\System\BTDHEET.exe
  2⤵
  PID:8864
- C:\Windows\System\wEMMqJI.exe
  C:\Windows\System\wEMMqJI.exe
  2⤵
  PID:9204
- C:\Windows\System\amagIuo.exe
  C:\Windows\System\amagIuo.exe
  2⤵
  PID:8928
- C:\Windows\System\ayxOmKD.exe
  C:\Windows\System\ayxOmKD.exe
  2⤵
  PID:8524
- C:\Windows\System\cOSJoil.exe
  C:\Windows\System\cOSJoil.exe
  2⤵
  PID:9124
- C:\Windows\System\YARlQjB.exe
  C:\Windows\System\YARlQjB.exe
  2⤵
  PID:9200
- C:\Windows\System\WCZEuiW.exe
  C:\Windows\System\WCZEuiW.exe
  2⤵
  PID:9024
- C:\Windows\System\Ivpaykp.exe
  C:\Windows\System\Ivpaykp.exe
  2⤵
  PID:8448
- C:\Windows\System\dPaxZIO.exe
  C:\Windows\System\dPaxZIO.exe
  2⤵
  PID:8816
- C:\Windows\System\eKMbmJi.exe
  C:\Windows\System\eKMbmJi.exe
  2⤵
  PID:8444
- C:\Windows\System\JQdXbrY.exe
  C:\Windows\System\JQdXbrY.exe
  2⤵
  PID:8684
- C:\Windows\System\kWKfjHs.exe
  C:\Windows\System\kWKfjHs.exe
  2⤵
  PID:8280
- C:\Windows\System\edFotnr.exe
  C:\Windows\System\edFotnr.exe
  2⤵
  PID:8812
- C:\Windows\System\pSKhaxC.exe
  C:\Windows\System\pSKhaxC.exe
  2⤵
  PID:8252
- C:\Windows\System\OYOQOly.exe
  C:\Windows\System\OYOQOly.exe
  2⤵
  PID:9228
- C:\Windows\System\YDwRhnu.exe
  C:\Windows\System\YDwRhnu.exe
  2⤵
  PID:9244
- C:\Windows\System\LBCrSZB.exe
  C:\Windows\System\LBCrSZB.exe
  2⤵
  PID:9260
- C:\Windows\System\wlBWQGu.exe
  C:\Windows\System\wlBWQGu.exe
  2⤵
  PID:9284
- C:\Windows\System\wcJjvyT.exe
  C:\Windows\System\wcJjvyT.exe
  2⤵
  PID:9300
- C:\Windows\System\YJyTJBI.exe
  C:\Windows\System\YJyTJBI.exe
  2⤵
  PID:9316
- C:\Windows\System\CkxVVXY.exe
  C:\Windows\System\CkxVVXY.exe
  2⤵
  PID:9332
- C:\Windows\System\zltWmFV.exe
  C:\Windows\System\zltWmFV.exe
  2⤵
  PID:9348
- C:\Windows\System\REOHlhs.exe
  C:\Windows\System\REOHlhs.exe
  2⤵
  PID:9364
- C:\Windows\System\hWTDMmj.exe
  C:\Windows\System\hWTDMmj.exe
  2⤵
  PID:9380
- C:\Windows\System\DkLQCWg.exe
  C:\Windows\System\DkLQCWg.exe
  2⤵
  PID:9396
- C:\Windows\System\WLkYiRp.exe
  C:\Windows\System\WLkYiRp.exe
  2⤵
  PID:9412
- C:\Windows\System\QiAVxEV.exe
  C:\Windows\System\QiAVxEV.exe
  2⤵
  PID:9432
- C:\Windows\System\MpswDrz.exe
  C:\Windows\System\MpswDrz.exe
  2⤵
  PID:9448
- C:\Windows\System\dkiGcya.exe
  C:\Windows\System\dkiGcya.exe
  2⤵
  PID:9464
- C:\Windows\System\RvtAFaE.exe
  C:\Windows\System\RvtAFaE.exe
  2⤵
  PID:9480
- C:\Windows\System\EwfKylX.exe
  C:\Windows\System\EwfKylX.exe
  2⤵
  PID:9504
- C:\Windows\System\AegoUDc.exe
  C:\Windows\System\AegoUDc.exe
  2⤵
  PID:9524
- C:\Windows\System\SmPjdEP.exe
  C:\Windows\System\SmPjdEP.exe
  2⤵
  PID:9544
- C:\Windows\System\CVNWZQO.exe
  C:\Windows\System\CVNWZQO.exe
  2⤵
  PID:9564
- C:\Windows\System\bUFmHTk.exe
  C:\Windows\System\bUFmHTk.exe
  2⤵
  PID:9580
- C:\Windows\System\QnaREdo.exe
  C:\Windows\System\QnaREdo.exe
  2⤵
  PID:9600
- C:\Windows\System\EHScbpK.exe
  C:\Windows\System\EHScbpK.exe
  2⤵
  PID:9616
- C:\Windows\System\oHVDCzW.exe
  C:\Windows\System\oHVDCzW.exe
  2⤵
  PID:9636
- C:\Windows\System\CyrFJKF.exe
  C:\Windows\System\CyrFJKF.exe
  2⤵
  PID:9652
- C:\Windows\System\RePXFjv.exe
  C:\Windows\System\RePXFjv.exe
  2⤵
  PID:9668
- C:\Windows\System\enfMyYA.exe
  C:\Windows\System\enfMyYA.exe
  2⤵
  PID:9684
- C:\Windows\System\gNHyaLi.exe
  C:\Windows\System\gNHyaLi.exe
  2⤵
  PID:9700
- C:\Windows\System\hADuYUD.exe
  C:\Windows\System\hADuYUD.exe
  2⤵
  PID:9716
- C:\Windows\System\lDoAPHr.exe
  C:\Windows\System\lDoAPHr.exe
  2⤵
  PID:9732
- C:\Windows\System\xasAFxi.exe
  C:\Windows\System\xasAFxi.exe
  2⤵
  PID:9748
- C:\Windows\System\tsDtDjj.exe
  C:\Windows\System\tsDtDjj.exe
  2⤵
  PID:9764
- C:\Windows\System\KbcvsFT.exe
  C:\Windows\System\KbcvsFT.exe
  2⤵
  PID:9780
- C:\Windows\System\gGflQkT.exe
  C:\Windows\System\gGflQkT.exe
  2⤵
  PID:9796
- C:\Windows\System\TRFFbiL.exe
  C:\Windows\System\TRFFbiL.exe
  2⤵
  PID:9812
- C:\Windows\System\tuBhWlQ.exe
  C:\Windows\System\tuBhWlQ.exe
  2⤵
  PID:9828
- C:\Windows\System\SoSJXwo.exe
  C:\Windows\System\SoSJXwo.exe
  2⤵
  PID:9844
- C:\Windows\System\ocsaByN.exe
  C:\Windows\System\ocsaByN.exe
  2⤵
  PID:9864
- C:\Windows\System\QrFRnXL.exe
  C:\Windows\System\QrFRnXL.exe
  2⤵
  PID:9880
- C:\Windows\System\qehlorY.exe
  C:\Windows\System\qehlorY.exe
  2⤵
  PID:9932
- C:\Windows\System\IvKpbVz.exe
  C:\Windows\System\IvKpbVz.exe
  2⤵
  PID:9948
- C:\Windows\System\ZifIDtR.exe
  C:\Windows\System\ZifIDtR.exe
  2⤵
  PID:9964
- C:\Windows\System\CGZWlAu.exe
  C:\Windows\System\CGZWlAu.exe
  2⤵
  PID:9984
- C:\Windows\System\RVLeqUT.exe
  C:\Windows\System\RVLeqUT.exe
  2⤵
  PID:10000
- C:\Windows\System\uTGAYNt.exe
  C:\Windows\System\uTGAYNt.exe
  2⤵
  PID:10016
- C:\Windows\System\ncAiSbH.exe
  C:\Windows\System\ncAiSbH.exe
  2⤵
  PID:10032
- C:\Windows\System\TNBNwnL.exe
  C:\Windows\System\TNBNwnL.exe
  2⤵
  PID:10048
- C:\Windows\System\YVDuYzc.exe
  C:\Windows\System\YVDuYzc.exe
  2⤵
  PID:10068
- C:\Windows\System\GgbeLJk.exe
  C:\Windows\System\GgbeLJk.exe
  2⤵
  PID:10084
- C:\Windows\System\JCSYWgE.exe
  C:\Windows\System\JCSYWgE.exe
  2⤵
  PID:10100
- C:\Windows\System\vAmheCw.exe
  C:\Windows\System\vAmheCw.exe
  2⤵
  PID:10116
- C:\Windows\System\BUDYSgY.exe
  C:\Windows\System\BUDYSgY.exe
  2⤵
  PID:10132
- C:\Windows\System\oVnoXSx.exe
  C:\Windows\System\oVnoXSx.exe
  2⤵
  PID:10152
- C:\Windows\System\jpjhPId.exe
  C:\Windows\System\jpjhPId.exe
  2⤵
  PID:10168
- C:\Windows\System\KUvqYaI.exe
  C:\Windows\System\KUvqYaI.exe
  2⤵
  PID:10184
- C:\Windows\System\NKpnSCf.exe
  C:\Windows\System\NKpnSCf.exe
  2⤵
  PID:10200
- C:\Windows\System\DHoOBXA.exe
  C:\Windows\System\DHoOBXA.exe
  2⤵
  PID:10216
- C:\Windows\System\JIMxpcZ.exe
  C:\Windows\System\JIMxpcZ.exe
  2⤵
  PID:10232
- C:\Windows\System\UrbCwAH.exe
  C:\Windows\System\UrbCwAH.exe
  2⤵
  PID:9236
- C:\Windows\System\bZpHPjZ.exe
  C:\Windows\System\bZpHPjZ.exe
  2⤵
  PID:9224
- C:\Windows\System\QtoVRtk.exe
  C:\Windows\System\QtoVRtk.exe
  2⤵
  PID:8944
- C:\Windows\System\ozzwGgQ.exe
  C:\Windows\System\ozzwGgQ.exe
  2⤵
  PID:9276
- C:\Windows\System\SVIQcxa.exe
  C:\Windows\System\SVIQcxa.exe
  2⤵
  PID:9296
- C:\Windows\System\JqYNoNB.exe
  C:\Windows\System\JqYNoNB.exe
  2⤵
  PID:9356
- C:\Windows\System\eDJUrAv.exe
  C:\Windows\System\eDJUrAv.exe
  2⤵
  PID:9312
- C:\Windows\System\Mxiuirn.exe
  C:\Windows\System\Mxiuirn.exe
  2⤵
  PID:9388
- C:\Windows\System\OLCRGzK.exe
  C:\Windows\System\OLCRGzK.exe
  2⤵
  PID:9392
- C:\Windows\System\AlsxclF.exe
  C:\Windows\System\AlsxclF.exe
  2⤵
  PID:9472
- C:\Windows\System\VhBibmK.exe
  C:\Windows\System\VhBibmK.exe
  2⤵
  PID:9520
- C:\Windows\System\EGRHEZk.exe
  C:\Windows\System\EGRHEZk.exe
  2⤵
  PID:9556
- C:\Windows\System\mzrIRTF.exe
  C:\Windows\System\mzrIRTF.exe
  2⤵
  PID:9576
- C:\Windows\System\gCEgVlT.exe
  C:\Windows\System\gCEgVlT.exe
  2⤵
  PID:9608
- C:\Windows\System\qVgoAFJ.exe
  C:\Windows\System\qVgoAFJ.exe
  2⤵
  PID:9560
- C:\Windows\System\jPnUdTZ.exe
  C:\Windows\System\jPnUdTZ.exe
  2⤵
  PID:9592
- C:\Windows\System\vHByDTz.exe
  C:\Windows\System\vHByDTz.exe
  2⤵
  PID:9676
- C:\Windows\System\iqcBiNf.exe
  C:\Windows\System\iqcBiNf.exe
  2⤵
  PID:9772
- C:\Windows\System\qgxaiJj.exe
  C:\Windows\System\qgxaiJj.exe
  2⤵
  PID:9696
- C:\Windows\System\CvMXBym.exe
  C:\Windows\System\CvMXBym.exe
  2⤵
  PID:9740
- C:\Windows\System\JdzFbFY.exe
  C:\Windows\System\JdzFbFY.exe
  2⤵
  PID:9996
- C:\Windows\System\xtiMzCO.exe
  C:\Windows\System\xtiMzCO.exe
  2⤵
  PID:10192
- C:\Windows\System\rLNTflD.exe
  C:\Windows\System\rLNTflD.exe
  2⤵
  PID:9328
- C:\Windows\System\eobURCr.exe
  C:\Windows\System\eobURCr.exe
  2⤵
  PID:9980
- C:\Windows\System\QvwqrPY.exe
  C:\Windows\System\QvwqrPY.exe
  2⤵
  PID:9488

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\FudWoFG.exe

Filesize
3.1MB

MD5
f4ae1e3780ff20694e83b851eced2750

SHA1
0f55549d08c69e6a494b1c55dd390a90b6515c06

SHA256
a06fea801c9d2f4fcde17fb143188d0b50580abdb1f9cb56356192a0a9ec1e47

SHA512
c09a473f92984749886720f04506a79e4dbd40074569c2af1ec625fbce3ae3a79d2b08f728964c4dd127311589b880eafd0c6aa74054479e263a4ff5820a0292

Download Submit
C:\Windows\system\GQUDGjB.exe

Filesize
3.1MB

MD5
386d062806eb3b94e3e9cd80239fc190

SHA1
1f4230b9177aa1c9fc2c4dc7489fb584b0c5bfdd

SHA256
f56b13f9162a191d54ab701e6c1a3381a7030d19a1cc9e859ceacbdb155e83cf

SHA512
be4ecd29660472afce86b30ebd1ebcfd9965dd6d2434cb4f47e47c2afb7c9e804ff9f4163b221e00e91b3d06bd999a16ee6acd0d682e70c2c4664f05c6fcd7e7

Download Submit
C:\Windows\system\GXiuGTV.exe

Filesize
8B

MD5
a8f2921c80c15a3d426e5fdff8a56196

SHA1
4dc21bf95e22427a9dafcd4930e81b62e77d5fda

SHA256
7e9bbeeba45dae16f8c444596ee4180d7313e899e46fa6263fde6904f32d92a1

SHA512
996666f646b1878ee129a778184f9520541ee458797b8bfaefed6e1f152a5436e0ff19d28744463b706ffe3e24e429f5af102aa1e7733dbeeb6210754c828802

Download Submit
C:\Windows\system\HDlgbEf.exe

Filesize
3.1MB

MD5
5d0a39a52818153768ecf52b9fb7987a

SHA1
4fdf122f15ec482f92666cf13b61c31669842b98

SHA256
76c49933d678f5391f6808ad9f4f7e4190c9053c8dfb4b75f315cf31de0169bd

SHA512
ae0d0db50e73588d70f54f85c51cb04a2d3d2dcd85081698c3b586667168ca1294649aa0ffcecf3bb7a33214f378977d638fafd09fd511d7b6f3207eed6f6f23

Download Submit
C:\Windows\system\HKHiMZP.exe

Filesize
3.1MB

MD5
823a84266ed0116509ecbcefd2741513

SHA1
ebfae7cb519fdc25cccee92a6f88bfbaaf7a7e87

SHA256
f2b73928b66548087cbfbbd68df817230c68e176ba31f4a3d80a5273369fd75e

SHA512
35519e932f07e72d0472d989be299c206adfacdfdcc74788e705d4861ad9658de267e6e74fa9eec8dc01bf97f77c2e51bac64208987afb29c9c23a7a8623b0ef

Download Submit
C:\Windows\system\IVGaOfz.exe

Filesize
3.1MB

MD5
04f8595d4bf38da937be01a366e298df

SHA1
9dbc2a44da6d0bf2b3ec68f9fe6f5c85d5a6d962

SHA256
3ad73a158ce247fcad17a3726e2f034ec23a01621182460b355de7332e86fb13

SHA512
b47cf387b5f69ccbff4ddcf620c16b96426ffdf68baf7c912f91c6351281bb15d3c9368d777901558cdfe59933b7ef1f84d375962dfcb1d48f1a0b30db1de251

Download Submit
C:\Windows\system\KWSmnOB.exe

Filesize
3.1MB

MD5
d3ec3de3b6e849976ecc75767213a54c

SHA1
375df387291948b05fb3ccd44aa40be0e211d2eb

SHA256
73900051c76c84fed53882cfcd56e8165fd8f4821c408e78db8ca50592ebe865

SHA512
c93ae00f5afa8e209f093ec2901c45909a04a3720ab349ac389d171cb24580a5a6274acb82fbeedc7c2986f476946be62823289c4327229fc1aab6e25c389147

Download Submit
C:\Windows\system\MTbpOqL.exe

Filesize
3.1MB

MD5
e1ae80060a385598b9f4071a82eaef45

SHA1
8ed11657b636b657c9b0dcfb3e23b48c121a1c10

SHA256
bf9cf03f8185c85c347a9b139566e338ba7dcbd6b86cb9ca19f26f7592f2ced3

SHA512
a171f3cc3f8ed27ea3e0956c98c2b94173bf16ef52b8e82d6191608ee65526f9d2217171ee1719c2616cde7fa12dd6d90f4ba58da2cc040dca0bdc6842539cf6

Download Submit
C:\Windows\system\NVFxYud.exe

Filesize
3.1MB

MD5
317264cfe35b37e4d7dcfc1512e6fbb5

SHA1
10f0e7b101bbc7a66782bc0e06e3c624d6db0cae

SHA256
3bbd551ff7009623500dd4cc133b46c1eb9b9b91397cead9c72725f1e7e45923

SHA512
4fdc386afbe2428eb864cba12f617d6427d5162c8939f9ac1c72ebb6da93330dfec57b71a7b162fd182d884221189cac8a9e0ea066f3332310f43dcfc961c4c8

Download Submit
C:\Windows\system\NgpVCTs.exe

Filesize
3.1MB

MD5
0d6d93fb1e63dbcda9affb1556800d67

SHA1
8adb490d63ccffe4ab24f1acc5ef7cd924b9b366

SHA256
ae9528d44676c5cf7a42bc79493352af2c4fec8597c8bf6eac20770f2588d681

SHA512
c305b76de15bc856efeecacee824cf8d14d4a97802a4c3089f3de3bc49e71d2638d5d361f924dfd83ac8d55358a7915c1e2a7fd47e4e814904f92788898d498d

Download Submit
C:\Windows\system\NhkUbFe.exe

Filesize
3.1MB

MD5
f618f9874fd8baba30abc7ed5223324a

SHA1
3e40e313da10ac236814722baa53d0a9bf070ddd

SHA256
5321ace3214c068b2ecec0b5d571c624e4df4b8d4e9f6f34c839b517c9a0a25a

SHA512
96d535fb38b59c846fc45962d1dc8257c65b984d87035aaa4fcbd4c9022393b17335325e27523f5fdb7113cf1040a6fcd8ccef607f0c6287ade69575b58ad1f8

Download Submit
C:\Windows\system\PqHmUWF.exe

Filesize
3.1MB

MD5
abb89775b9d8a9e2a58a1abbcee59e1c

SHA1
9a8c6c4bcc457f5d139f73805d16dcbb42ae7d9f

SHA256
0e4f8ab4ecb480174f87b7bdf27f4c308cf0aad730962e74d4ffa7b46363e28e

SHA512
d569929fe79d39b9ad8e36bf2b1f3f56514de0e024dc50621b8549e78216eac1fcecd0cc0fb29166cef9a6a18585cc819b44db664e46f0df78094341067ee002

Download Submit
C:\Windows\system\QusLTxe.exe

Filesize
3.1MB

MD5
08d3ccaf0e529bbd9c529a9d491c6924

SHA1
cd7232b65d1c71f404e52e14829c9760ac1fdd78

SHA256
b12dcc6f4c85309c051d3fea6dc310187226c72a9dfda3c7f8cc80c5dc55743c

SHA512
0820f47b11e906621b964bbbb41d3e5955db482346e86dd1235e00ee6fbf280d4cfed2e73bf34f51d03f8d2806cb033160a0381c10664accc4f3cfe3b3781e31

Download Submit
C:\Windows\system\StKshOr.exe

Filesize
3.1MB

MD5
c352d96314092073ad252208b02d2d99

SHA1
b15b62fdc97e63ae54f99f98af772daa12b46df3

SHA256
358622e57012137a5c24bb139718cf64b7727e6d27b5b69253b34ee4804cc22f

SHA512
20028c163511b5b537a840603f62d827b417077c17d2193a60e55c6774a68fc7217a5765cd63e95b102fe64aa522bb011b5848ef711bca81014bd1217c5af2ca

Download Submit
C:\Windows\system\VAeoFeM.exe

Filesize
3.1MB

MD5
70025600df6824bef7c6c6b239f2c19e

SHA1
03c643533151aac0109abdc07d71cc9167a66f2c

SHA256
a9f07ba4b33feb337fc0ff217c2d64f00e90873873931738792d2d822ecc8e00

SHA512
16b3f5f3c3b6a2d5d6ebe9760c8d0774be47c89b2472aba39470b990d6917e30cd32ba471f1cfe0c145aeb03cc246664de9546c4eb6b8c5b5d6d1dc249a34d59

Download Submit
C:\Windows\system\VhYRMhO.exe

Filesize
3.1MB

MD5
7f9763fb9a066493f34fb2ab5d14182a

SHA1
f5d37f4e14c9c488e4f8174ee9167e4823c6dcc8

SHA256
06f29ec68dba9ea5684e01a517aa5134f19bc034a1e6491a6867fcc9d416a05d

SHA512
233eb91b871bd443bf9fd641e219826a516052be493cf1a553e5b5c181e307f18b75c4650602f97606ac5e7d7365f166ea1bf3cc4aeb71088e32ab178be4caef

Download Submit
C:\Windows\system\WsZktZu.exe

Filesize
3.1MB

MD5
03ca1e087642c75856c8bf608cd29559

SHA1
98f33c6f9707e3b5ab03dadb0f6ff09dc09fb744

SHA256
c5ea57db2681c9b9726e1fa05e90fff7cad68420c6160da906af426dc5c3f6f2

SHA512
18840d7ad671e99e8570726f1447c4c54d394134e16b3c30fe304a4884448ca251bd062f65a40e3131cc89d884451e1694105e0baee6474877146d227f11c85f

Download Submit
C:\Windows\system\YduAkuk.exe

Filesize
1.1MB

MD5
153b8ae141907f468179073fca5869c3

SHA1
3112e61d0879026aeeb160ddac250777b2be012f

SHA256
34fe9f400a6e97af045befd3271d7b8978c50144a79249607bb5a255fa9f1858

SHA512
e7fa23204cfd27c43b1a4aeeacb5a5d77548b127049c3fd133d4b3f2f752681339bfc43cc119763bd7720b9c1380318f49ebd4ce780c0ff41e0adf54802ee494

Download Submit
C:\Windows\system\cHXzWeH.exe

Filesize
3.1MB

MD5
bd7d30251ca22cf5297e3b3f29d6d527

SHA1
5a58e8da4ed4a2c54e42f48ae7c7ae96800be8ab

SHA256
b2b606a2070ccd5d2f10e6de1918ee44cb6b6a124e009a769533e83aee60738b

SHA512
9a5cf53bea70e7002d818df7744ba9880bad6624508eb653589826c3322f683c334d5e1ff8620446c97a56e69d24d8ced05d1d07310472aaf4c137817a0a8881

Download Submit
C:\Windows\system\cIKxfIs.exe

Filesize
3.1MB

MD5
a67ea348d33c2accf0a77d0323a8975c

SHA1
da493b902eb6b4637e31db306f19ff118072d2b9

SHA256
0203bb6a5a05c73e8a70806f8e5295184d817c21106093dc71bd6ce2c3fbbda3

SHA512
c5c747abe240adfff817ccdfecbdff64f59192dd6d07d3ceec79be0365168bc15128a0493c9df59531e3958561499693119fb0ac21ceed14b0df99ca9b85baad

Download Submit
C:\Windows\system\hJeUNXt.exe

Filesize
3.1MB

MD5
dbe9f16c501eb0a22e6d4303ef003ec7

SHA1
7be2c8a50b01a9c19ab6821fc59dc0f388b8a687

SHA256
165c5d2b8dd222621e5098e41e2264ddd6eafd2c9a8f14e247569d15d806449c

SHA512
52a9f312095252d16b731806035dba2f433eee263443630645864c320fbc48908dece134e563a438e04c35a0e1a2c4332bd9620ef4ad6ba40e7215058544abfe

Download Submit
C:\Windows\system\qcvsEhv.exe

Filesize
3.1MB

MD5
ca6d1f7d82aeff7d486982c2eca04436

SHA1
44d178ae8202064d6bd2c6e907cf766f3b2e1ab3

SHA256
0231eba0991fca99a38815fa91be04f8ed2607c63c5c027eaa24c42cb8254514

SHA512
ac791f10d73a0d9ac175f0ef248abc3a4a9bceb0c3b31d3feb5ab2791bfeaa75e371733a87f5c69965cbfa6242de0ca548b63d920262db283aff6827d60f529c

Download Submit
C:\Windows\system\qvKuPiI.exe

Filesize
3.1MB

MD5
2a35765b5220b98c2409ea5f383d5ff2

SHA1
c344afb5b235618a8b6971ff85b5cc65cc92eb9e

SHA256
0bb3bfdaaded6155ffa3b376d56ecaee9acdbdbf725df92c0199686a18d97b70

SHA512
974c3fe997f7bd4c7a8135d6b234ebe152f9e3c38fd9a0b8ebac7349c077f192c00cca71ab8c3aedfdeac595c105035f408f7ab0b5b4720ac12818e71a8ee185

Download Submit
C:\Windows\system\rxVDnbX.exe

Filesize
3.1MB

MD5
a658703b07217be29019913327e80df1

SHA1
e4ca1e897643e469830e8b213cff3ddc6d7ce180

SHA256
50bfc302274af63012f9eb91da9fc9fe693b5850fe1616fe60e5d744f1b418f7

SHA512
d2e39237ca83e7e1064dd497b5a8eccf41f75af820d564aa38740578b6d22dbbaf2add10291107a4f59c365b6f5e559a170fce177c579d6a87042dfd0d05c1e6

Download Submit
C:\Windows\system\sgJsONj.exe

Filesize
3.1MB

MD5
37ab45a71afe04887aa15369a4c91f27

SHA1
de459430d698d681bf1078359bc8456b0289de49

SHA256
060a2593f212016c0ec4fecfe0d5ff341370b59876e5cbdb6ffa74cb3ec5fa22

SHA512
e0bea67d3d91cf2208361c76c4a464cd8efc245408ff260611a0e6a23359f83eb6f467dcc45262a9a20bbd6245a0eeaaaad8535f5563de0fb33c6977956ae103

Download Submit
C:\Windows\system\tPHJytM.exe

Filesize
3.1MB

MD5
663d62ab8d48b06369ef07e34c7bd095

SHA1
51d85947ff44cd94a73b570d005c589bbe5e354f

SHA256
23baffcae1c8efd064056b3f88bd51dc6be1f92585f6fc438119de571e3765fe

SHA512
14e6814a2b4825f7903bee70be483aa2fd52d29462b8f05c2f7ae10ab8b42b9081b2637fed1f357189221ee6180affd83b2df14eefbd1b5819b9a15a40aa55ee

Download Submit
C:\Windows\system\tqMxKOI.exe

Filesize
3.1MB

MD5
d2be1e4c22f4fb7c103b3b28467f2546

SHA1
4326919bff6aa4cf39df753ce6fe340993022078

SHA256
e1251dbad4ff26ef05187908362fbb869fcd6d0af125b9f87415c4a0aab04cef

SHA512
99b0f6f11b1c2bc8f89854861de2fafb9242312d7c1a8befed76d70d92c143d169dcd16289b7a08b19dfa4dec5b670c1c1e68bfc031363486378c89f1056caf1

Download Submit
C:\Windows\system\voGwOLs.exe

Filesize
3.1MB

MD5
c0c31057e3c4d40149c2169b499a6ec9

SHA1
ac9c978dfbd6a0aab0714db41f67c710a859b8c1

SHA256
4549f8473d460dea3dd1e47ac46977406bcdfaad3841c329d98235d5bc7ef5b0

SHA512
1714596aefee6a562194dab0f454652b125e644f363edba539b2b62f5f24171103f77c4f601cc367c3e9000ef4c011232d43d6c280a2ea74a2272b240cd4be8e

Download Submit
C:\Windows\system\wWjmION.exe

Filesize
3.1MB

MD5
7bd8ff58b56ea577cffd55c30b38e039

SHA1
290f1e614c82c0058e5c2948eecd6b2b43e13398

SHA256
a3df2466eff41bf2b9ff049b5ebdc50be194e63c5cb5ea84c6e3bc085e39b308

SHA512
09e8de6b54913e527bd2d27c9b0844258c41d086f37e57bb273e3607b50b4b849e695c05f2eb8fe172a85e33f46bc4bb60b90d3acd3e515f181bb7a3739ca2f0

Download Submit
\Windows\system\NgpVCTs.exe

Filesize
2.9MB

MD5
9244735aca0c2acc0d8e0547de217dde

SHA1
25cec5009b6f5b04ce2c0a7ecf3889ed0178eacd

SHA256
eda163b2b6e30f42c4640f1b8a05a9daea746e055334d8c30d8409e5a04f746d

SHA512
c2a16c8abb819bba4527482cd8d6eb3d3a852f1eace941764cafa838ebf6a0bccaca9c7b1d4fba26c75d16052821647f908becae1468a6b940115783d9ed3eb0

Download Submit
\Windows\system\TXtaXQg.exe

Filesize
3.1MB

MD5
46e320fe889efc93b784f955e758a034

SHA1
a6637a05144b502d3ba5b73217d3dbf2f39218c3

SHA256
90eeda3efa8133c1006238c2373f8ed55d465ec48a500256f01139720044d202

SHA512
1b7b381a820562eb891297ff75c93f682e358c56f58a4c8d22707aa65d7094d0a62524c3ae8596ad696af41ac8d6acdf741dd3076c8053adfa7616dc2e2bfc75

Download Submit
\Windows\system\YduAkuk.exe

Filesize
3.1MB

MD5
4f7c5db2e3aecf3e34df167311300ad9

SHA1
33c88383bc9f3796cfc85c2ee7422a074cdf4e54

SHA256
edfad41c5ae7de0096c8c4ffdee4de2770b58533f17d7676753d7064edae51dc

SHA512
37d947b4d0e3e9420e890686cf31b7b8ab097342e7225e5c2de3644579f7f901d12a18cf8779ed1b8ae3cef35bec5f62f8f3ef90d2eb63c5d38fe08228595159

Download Submit
\Windows\system\ePlrXEe.exe

Filesize
3.1MB

MD5
07978e5a6d9ac67f483113a88e960c94

SHA1
eecf35c116af498957c076bf667dddd66999db32

SHA256
da06c3c3618f8ba40eb50aa1da91f2768b5793c1bd93c15d43b98aa227e0cc74

SHA512
baaf10e13c254baf13ce8b8e84ede3040a0aeca914476009049d41829d6866afce4a8a8b7411492fc2fbbd3b48d88bf89a74a99f7f85994da16a6a20043a7f56

Download Submit
\Windows\system\eeHPjrB.exe

Filesize
1.5MB

MD5
ce7069685850a0ff9a6ed404fb6546f3

SHA1
fd92b42a34b882910139a5a48d9fbf260d4207aa

SHA256
dbcd846f674679f4baea2ed5b6ef9501763545b12c4658984e9ecac30c093cff

SHA512
e6da9299ed2532a8259e68b2872dcc5f698e73aa1175626c805585ea3eaf879d67f909c82fdd01bf5916d8d8c8595add5b778fa3638f94f91f8eee63812de5db

Download Submit
\Windows\system\uOdzASO.exe

Filesize
3.1MB

MD5
4705cec018e1c0599329b40f88adec94

SHA1
17ee87f99cd387c69618f3520ee04fd2a5bfcaaf

SHA256
8f44391afe018f4949e2c378d010fa38dc957a462263cd0a971e550e16de3e1b

SHA512
23d45190c9d4052da406822d3597b649f70ebdb5e7eabfc0bfef4287efc564711c8f89014e7653b2c19d0a54142fdb802925c3a3a3ea0b3166d6b4d10e0a0335

Download Submit
memory/2160-118-0x000000013F430000-0x000000013F826000-memory.dmp

Filesize
4.0MB

Download
memory/2160-4694-0x000000013F430000-0x000000013F826000-memory.dmp

Filesize
4.0MB

Download
memory/2488-135-0x000000013F070000-0x000000013F466000-memory.dmp

Filesize
4.0MB

Download
memory/2488-4702-0x000000013F070000-0x000000013F466000-memory.dmp

Filesize
4.0MB

Download
memory/2616-143-0x000000013FF60000-0x0000000140356000-memory.dmp

Filesize
4.0MB

Download
memory/2616-4697-0x000000013FF60000-0x0000000140356000-memory.dmp

Filesize
4.0MB

Download
memory/2628-4698-0x000000013FFD0000-0x00000001403C6000-memory.dmp

Filesize
4.0MB

Download
memory/2628-126-0x000000013FFD0000-0x00000001403C6000-memory.dmp

Filesize
4.0MB

Download
memory/2640-4699-0x000000013F660000-0x000000013FA56000-memory.dmp

Filesize
4.0MB

Download
memory/2640-144-0x000000013F660000-0x000000013FA56000-memory.dmp

Filesize
4.0MB

Download
memory/2704-4700-0x000000013F7A0000-0x000000013FB96000-memory.dmp

Filesize
4.0MB

Download
memory/2704-136-0x000000013F7A0000-0x000000013FB96000-memory.dmp

Filesize
4.0MB

Download
memory/2752-4701-0x000000013FFC0000-0x00000001403B6000-memory.dmp

Filesize
4.0MB

Download
memory/2752-130-0x000000013FFC0000-0x00000001403B6000-memory.dmp

Filesize
4.0MB

Download
memory/2768-478-0x000000001B6A0000-0x000000001B982000-memory.dmp

Filesize
2.9MB

Download
memory/2768-543-0x0000000002960000-0x0000000002968000-memory.dmp

Filesize
32KB

Download
memory/2772-142-0x000000013F570000-0x000000013F966000-memory.dmp

Filesize
4.0MB

Download
memory/2772-4695-0x000000013F570000-0x000000013F966000-memory.dmp

Filesize
4.0MB

Download
memory/2888-116-0x0000000002630000-0x0000000002A26000-memory.dmp

Filesize
4.0MB

Download
memory/2888-122-0x000000013F940000-0x000000013FD36000-memory.dmp

Filesize
4.0MB

Download
memory/2888-141-0x0000000002630000-0x0000000002A26000-memory.dmp

Filesize
4.0MB

Download
memory/2888-0-0x00000000000F0000-0x0000000000100000-memory.dmp

Filesize
64KB

Download
memory/2888-131-0x0000000002E40000-0x0000000003236000-memory.dmp

Filesize
4.0MB

Download
memory/2888-132-0x0000000002E40000-0x0000000003236000-memory.dmp

Filesize
4.0MB

Download
memory/2888-1-0x000000013F530000-0x000000013F926000-memory.dmp

Filesize
4.0MB

Download
memory/2888-129-0x0000000002E40000-0x0000000003236000-memory.dmp

Filesize
4.0MB

Download
memory/2888-127-0x000000013FFC0000-0x00000001403B6000-memory.dmp

Filesize
4.0MB

Download
memory/2888-121-0x000000013FFD0000-0x00000001403C6000-memory.dmp

Filesize
4.0MB

Download
memory/2888-13-0x0000000002630000-0x0000000002A26000-memory.dmp

Filesize
4.0MB

Download
memory/2888-28-0x0000000002630000-0x0000000002A26000-memory.dmp

Filesize
4.0MB

Download
memory/2888-117-0x000000013FF60000-0x0000000140356000-memory.dmp

Filesize
4.0MB

Download
memory/2888-119-0x0000000002630000-0x0000000002A26000-memory.dmp

Filesize
4.0MB

Download
memory/2888-137-0x000000013FCF0000-0x00000001400E6000-memory.dmp

Filesize
4.0MB

Download
memory/2888-133-0x000000013F070000-0x000000013F466000-memory.dmp

Filesize
4.0MB

Download
memory/2996-4696-0x000000013F580000-0x000000013F976000-memory.dmp

Filesize
4.0MB

Download
memory/2996-120-0x000000013F580000-0x000000013F976000-memory.dmp

Filesize
4.0MB

Download
memory/3012-53-0x000000013F320000-0x000000013F716000-memory.dmp

Filesize
4.0MB

Download
memory/3012-4693-0x000000013F320000-0x000000013F716000-memory.dmp

Filesize
4.0MB

Download