xmrig | 2043786b8499d4eb3da7039a5bc70936ae2d4e1299532a6f972503dab91d64e9

Analysis

max time kernel
150s
max time network
123s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
09/05/2024, 09:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

06d3b8b32030bc1f95a58fb2ba310ab0_NEIKI.exe
Size

2.6MB
MD5

06d3b8b32030bc1f95a58fb2ba310ab0
SHA1

f083e25f9921e70014b5d4d2b2851b182ccde49a
SHA256

2043786b8499d4eb3da7039a5bc70936ae2d4e1299532a6f972503dab91d64e9
SHA512

f264c5182488e6e512473014b655601e2786d6ba113f11312715caf910867fe6d07f83801fc0a2bba2b31100adc3c2780d054005d44a9f78c38d09da5bdaa7bb
SSDEEP

49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkibTIA5VOl1:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2Rw

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 55 IoCs

miner

resource	yara_rule
behavioral1/files/0x00060000000190bc-195.dat	xmrig
behavioral1/files/0x000500000001877f-192.dat	xmrig
behavioral1/files/0x0005000000018674-183.dat	xmrig
behavioral1/files/0x00060000000190b3-186.dat	xmrig
behavioral1/memory/2604-156-0x000000013FBD0000-0x000000013FFC6000-memory.dmp	xmrig
behavioral1/memory/2476-154-0x000000013F250000-0x000000013F646000-memory.dmp	xmrig
behavioral1/memory/2396-152-0x000000013F510000-0x000000013F906000-memory.dmp	xmrig
behavioral1/memory/2452-149-0x000000013F810000-0x000000013FC06000-memory.dmp	xmrig
behavioral1/files/0x000600000001864a-146.dat	xmrig
behavioral1/files/0x0010000000015f23-176.dat	xmrig
behavioral1/memory/2680-169-0x000000013FA30000-0x000000013FE26000-memory.dmp	xmrig
behavioral1/memory/2708-167-0x000000013F840000-0x000000013FC36000-memory.dmp	xmrig
behavioral1/memory/1852-165-0x000000013FB50000-0x000000013FF46000-memory.dmp	xmrig
behavioral1/memory/2892-162-0x000000013F090000-0x000000013F486000-memory.dmp	xmrig
behavioral1/files/0x000d00000001865b-160.dat	xmrig
behavioral1/memory/2700-145-0x000000013F810000-0x000000013FC06000-memory.dmp	xmrig
behavioral1/memory/2760-144-0x000000013F8A0000-0x000000013FC96000-memory.dmp	xmrig
behavioral1/memory/2284-142-0x000000013F2A0000-0x000000013F696000-memory.dmp	xmrig
behavioral1/memory/2348-140-0x000000013FE40000-0x0000000140236000-memory.dmp	xmrig
behavioral1/files/0x0006000000017510-137.dat	xmrig
behavioral1/files/0x000600000001748d-128.dat	xmrig
behavioral1/files/0x000600000001745d-117.dat	xmrig
behavioral1/files/0x0006000000017472-121.dat	xmrig
behavioral1/files/0x00060000000173e7-112.dat	xmrig
behavioral1/files/0x00060000000173df-107.dat	xmrig
behavioral1/files/0x00060000000173dc-103.dat	xmrig
behavioral1/files/0x00060000000173c5-97.dat	xmrig
behavioral1/files/0x000600000001738c-92.dat	xmrig
behavioral1/files/0x000600000001737e-87.dat	xmrig
behavioral1/files/0x000600000001737b-82.dat	xmrig
behavioral1/files/0x0006000000016f7e-77.dat	xmrig
behavioral1/files/0x0006000000016e56-72.dat	xmrig
behavioral1/files/0x0006000000016da9-67.dat	xmrig
behavioral1/files/0x0006000000016d85-62.dat	xmrig
behavioral1/files/0x0006000000016d81-57.dat	xmrig
behavioral1/files/0x0006000000016d31-52.dat	xmrig
behavioral1/files/0x0006000000016d29-47.dat	xmrig
behavioral1/files/0x0007000000016d21-42.dat	xmrig
behavioral1/files/0x0007000000016575-37.dat	xmrig
behavioral1/files/0x00070000000164ec-33.dat	xmrig
behavioral1/files/0x00080000000163eb-28.dat	xmrig
behavioral1/files/0x0016000000005586-16.dat	xmrig
behavioral1/files/0x0031000000015d9c-18.dat	xmrig
behavioral1/memory/2544-15-0x000000013F420000-0x000000013F816000-memory.dmp	xmrig
behavioral1/files/0x000b00000001431b-5.dat	xmrig
behavioral1/memory/2700-1-0x000000013F330000-0x000000013F726000-memory.dmp	xmrig
behavioral1/memory/2544-4646-0x000000013F420000-0x000000013F816000-memory.dmp	xmrig
behavioral1/memory/2544-7093-0x000000013F420000-0x000000013F816000-memory.dmp	xmrig
behavioral1/memory/2680-7099-0x000000013FA30000-0x000000013FE26000-memory.dmp	xmrig
behavioral1/memory/2476-7108-0x000000013F250000-0x000000013F646000-memory.dmp	xmrig
behavioral1/memory/2604-7107-0x000000013FBD0000-0x000000013FFC6000-memory.dmp	xmrig
behavioral1/memory/2452-7106-0x000000013F810000-0x000000013FC06000-memory.dmp	xmrig
behavioral1/memory/2892-7115-0x000000013F090000-0x000000013F486000-memory.dmp	xmrig
behavioral1/memory/1852-7119-0x000000013FB50000-0x000000013FF46000-memory.dmp	xmrig
behavioral1/memory/2708-7112-0x000000013F840000-0x000000013FC36000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
2508	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
2544	nLCqzyD.exe
2680	EwJNcEz.exe
2348	AXIzFOP.exe
2284	vbyLkfj.exe
2760	EyNYWoW.exe
2452	glYlkoL.exe
2396	cbiZVlF.exe
2476	OrOdksR.exe
2604	bRjjuzG.exe
2892	ISGlqFw.exe
1852	mXKNWhu.exe
2708	AGBhsfN.exe
2728	JVzVfRn.exe
2204	qjVQmii.exe
2196	lSBVIlg.exe
1492	JwxWImY.exe
2216	gwSnvwd.exe
1556	iMaPGXC.exe
1564	SKMPKXX.exe
2768	iphcczV.exe
1288	iOhPgqA.exe
336	MbcWHqn.exe
1324	YCWExnS.exe
2020	NseKHux.exe
2040	mQUBlvv.exe
544	fSYkZaS.exe
584	JvOUOkM.exe
2816	sGYMawr.exe
3056	PRQMDvO.exe
2324	fXlvXBt.exe
692	PfqMOcJ.exe
1572	ThQyeBc.exe
1304	ruvdFzC.exe
2916	fEmXVkX.exe
380	GlIAaNH.exe
1016	LiQkSfZ.exe
968	CgxZvrV.exe
108	BRkiPgR.exe
2868	BOxdCMN.exe
1876	SjIBHdC.exe
1760	caBxvHo.exe
792	CkDIqsV.exe
856	fQjIGbW.exe
1884	dTmPdCc.exe
1668	SZlALGS.exe
2092	VwDkqUf.exe
884	ScDpNpN.exe
1504	ManFIrL.exe
2540	EHkIzAK.exe
2848	hYJLqPR.exe
2524	ZeynKBx.exe
2484	VlupKBQ.exe
2572	ygAFwUg.exe
2328	vtriqjZ.exe
1540	jvdheQj.exe
2152	RoqxlpD.exe
328	KDvvRyn.exe
1580	bEGZHdT.exe
2644	XjewfGL.exe
2716	IhwAJAk.exe
2400	ZdfdBVj.exe
2876	ECSEBnI.exe
2188	jvGyNqh.exe
2220	AbLnsUC.exe

Loads dropped DLL 64 IoCs

pid	Process
2700	06d3b8b32030bc1f95a58fb2ba310ab0_NEIKI.exe
2700	06d3b8b32030bc1f95a58fb2ba310ab0_NEIKI.exe
2700	06d3b8b32030bc1f95a58fb2ba310ab0_NEIKI.exe
2700	06d3b8b32030bc1f95a58fb2ba310ab0_NEIKI.exe
2700	06d3b8b32030bc1f95a58fb2ba310ab0_NEIKI.exe
2700	06d3b8b32030bc1f95a58fb2ba310ab0_NEIKI.exe
2700	06d3b8b32030bc1f95a58fb2ba310ab0_NEIKI.exe
2700	06d3b8b32030bc1f95a58fb2ba310ab0_NEIKI.exe
2700	06d3b8b32030bc1f95a58fb2ba310ab0_NEIKI.exe
2700	06d3b8b32030bc1f95a58fb2ba310ab0_NEIKI.exe
2700	06d3b8b32030bc1f95a58fb2ba310ab0_NEIKI.exe
2700	06d3b8b32030bc1f95a58fb2ba310ab0_NEIKI.exe
2700	06d3b8b32030bc1f95a58fb2ba310ab0_NEIKI.exe
2700	06d3b8b32030bc1f95a58fb2ba310ab0_NEIKI.exe
2700	06d3b8b32030bc1f95a58fb2ba310ab0_NEIKI.exe
2700	06d3b8b32030bc1f95a58fb2ba310ab0_NEIKI.exe
2700	06d3b8b32030bc1f95a58fb2ba310ab0_NEIKI.exe
2700	06d3b8b32030bc1f95a58fb2ba310ab0_NEIKI.exe
2700	06d3b8b32030bc1f95a58fb2ba310ab0_NEIKI.exe
2700	06d3b8b32030bc1f95a58fb2ba310ab0_NEIKI.exe
2700	06d3b8b32030bc1f95a58fb2ba310ab0_NEIKI.exe
2700	06d3b8b32030bc1f95a58fb2ba310ab0_NEIKI.exe
2700	06d3b8b32030bc1f95a58fb2ba310ab0_NEIKI.exe
2700	06d3b8b32030bc1f95a58fb2ba310ab0_NEIKI.exe
2700	06d3b8b32030bc1f95a58fb2ba310ab0_NEIKI.exe
2700	06d3b8b32030bc1f95a58fb2ba310ab0_NEIKI.exe
2700	06d3b8b32030bc1f95a58fb2ba310ab0_NEIKI.exe
2700	06d3b8b32030bc1f95a58fb2ba310ab0_NEIKI.exe
2700	06d3b8b32030bc1f95a58fb2ba310ab0_NEIKI.exe
2700	06d3b8b32030bc1f95a58fb2ba310ab0_NEIKI.exe
2700	06d3b8b32030bc1f95a58fb2ba310ab0_NEIKI.exe
2700	06d3b8b32030bc1f95a58fb2ba310ab0_NEIKI.exe
2700	06d3b8b32030bc1f95a58fb2ba310ab0_NEIKI.exe
2700	06d3b8b32030bc1f95a58fb2ba310ab0_NEIKI.exe
2700	06d3b8b32030bc1f95a58fb2ba310ab0_NEIKI.exe
2700	06d3b8b32030bc1f95a58fb2ba310ab0_NEIKI.exe
2700	06d3b8b32030bc1f95a58fb2ba310ab0_NEIKI.exe
2700	06d3b8b32030bc1f95a58fb2ba310ab0_NEIKI.exe
2700	06d3b8b32030bc1f95a58fb2ba310ab0_NEIKI.exe
2700	06d3b8b32030bc1f95a58fb2ba310ab0_NEIKI.exe
2700	06d3b8b32030bc1f95a58fb2ba310ab0_NEIKI.exe
2700	06d3b8b32030bc1f95a58fb2ba310ab0_NEIKI.exe
2700	06d3b8b32030bc1f95a58fb2ba310ab0_NEIKI.exe
2700	06d3b8b32030bc1f95a58fb2ba310ab0_NEIKI.exe
2700	06d3b8b32030bc1f95a58fb2ba310ab0_NEIKI.exe
2700	06d3b8b32030bc1f95a58fb2ba310ab0_NEIKI.exe
2700	06d3b8b32030bc1f95a58fb2ba310ab0_NEIKI.exe
2700	06d3b8b32030bc1f95a58fb2ba310ab0_NEIKI.exe
2700	06d3b8b32030bc1f95a58fb2ba310ab0_NEIKI.exe
2700	06d3b8b32030bc1f95a58fb2ba310ab0_NEIKI.exe
2700	06d3b8b32030bc1f95a58fb2ba310ab0_NEIKI.exe
2700	06d3b8b32030bc1f95a58fb2ba310ab0_NEIKI.exe
2700	06d3b8b32030bc1f95a58fb2ba310ab0_NEIKI.exe
2700	06d3b8b32030bc1f95a58fb2ba310ab0_NEIKI.exe
2700	06d3b8b32030bc1f95a58fb2ba310ab0_NEIKI.exe
2700	06d3b8b32030bc1f95a58fb2ba310ab0_NEIKI.exe
2700	06d3b8b32030bc1f95a58fb2ba310ab0_NEIKI.exe
2700	06d3b8b32030bc1f95a58fb2ba310ab0_NEIKI.exe
2700	06d3b8b32030bc1f95a58fb2ba310ab0_NEIKI.exe
2700	06d3b8b32030bc1f95a58fb2ba310ab0_NEIKI.exe
2700	06d3b8b32030bc1f95a58fb2ba310ab0_NEIKI.exe
2700	06d3b8b32030bc1f95a58fb2ba310ab0_NEIKI.exe
2700	06d3b8b32030bc1f95a58fb2ba310ab0_NEIKI.exe
2700	06d3b8b32030bc1f95a58fb2ba310ab0_NEIKI.exe

UPX packed file 54 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x00060000000190bc-195.dat	upx
behavioral1/files/0x000500000001877f-192.dat	upx
behavioral1/files/0x0005000000018674-183.dat	upx
behavioral1/files/0x00060000000190b3-186.dat	upx
behavioral1/memory/2604-156-0x000000013FBD0000-0x000000013FFC6000-memory.dmp	upx
behavioral1/memory/2476-154-0x000000013F250000-0x000000013F646000-memory.dmp	upx
behavioral1/memory/2396-152-0x000000013F510000-0x000000013F906000-memory.dmp	upx
behavioral1/memory/2452-149-0x000000013F810000-0x000000013FC06000-memory.dmp	upx
behavioral1/files/0x000600000001864a-146.dat	upx
behavioral1/files/0x0010000000015f23-176.dat	upx
behavioral1/memory/2680-169-0x000000013FA30000-0x000000013FE26000-memory.dmp	upx
behavioral1/memory/2708-167-0x000000013F840000-0x000000013FC36000-memory.dmp	upx
behavioral1/memory/1852-165-0x000000013FB50000-0x000000013FF46000-memory.dmp	upx
behavioral1/memory/2892-162-0x000000013F090000-0x000000013F486000-memory.dmp	upx
behavioral1/files/0x000d00000001865b-160.dat	upx
behavioral1/memory/2760-144-0x000000013F8A0000-0x000000013FC96000-memory.dmp	upx
behavioral1/memory/2284-142-0x000000013F2A0000-0x000000013F696000-memory.dmp	upx
behavioral1/memory/2348-140-0x000000013FE40000-0x0000000140236000-memory.dmp	upx
behavioral1/files/0x0006000000017510-137.dat	upx
behavioral1/files/0x000600000001748d-128.dat	upx
behavioral1/files/0x000600000001745d-117.dat	upx
behavioral1/files/0x0006000000017472-121.dat	upx
behavioral1/files/0x00060000000173e7-112.dat	upx
behavioral1/files/0x00060000000173df-107.dat	upx
behavioral1/files/0x00060000000173dc-103.dat	upx
behavioral1/files/0x00060000000173c5-97.dat	upx
behavioral1/files/0x000600000001738c-92.dat	upx
behavioral1/files/0x000600000001737e-87.dat	upx
behavioral1/files/0x000600000001737b-82.dat	upx
behavioral1/files/0x0006000000016f7e-77.dat	upx
behavioral1/files/0x0006000000016e56-72.dat	upx
behavioral1/files/0x0006000000016da9-67.dat	upx
behavioral1/files/0x0006000000016d85-62.dat	upx
behavioral1/files/0x0006000000016d81-57.dat	upx
behavioral1/files/0x0006000000016d31-52.dat	upx
behavioral1/files/0x0006000000016d29-47.dat	upx
behavioral1/files/0x0007000000016d21-42.dat	upx
behavioral1/files/0x0007000000016575-37.dat	upx
behavioral1/files/0x00070000000164ec-33.dat	upx
behavioral1/files/0x00080000000163eb-28.dat	upx
behavioral1/files/0x0016000000005586-16.dat	upx
behavioral1/files/0x0031000000015d9c-18.dat	upx
behavioral1/memory/2544-15-0x000000013F420000-0x000000013F816000-memory.dmp	upx
behavioral1/files/0x000b00000001431b-5.dat	upx
behavioral1/memory/2700-1-0x000000013F330000-0x000000013F726000-memory.dmp	upx
behavioral1/memory/2544-4646-0x000000013F420000-0x000000013F816000-memory.dmp	upx
behavioral1/memory/2544-7093-0x000000013F420000-0x000000013F816000-memory.dmp	upx
behavioral1/memory/2680-7099-0x000000013FA30000-0x000000013FE26000-memory.dmp	upx
behavioral1/memory/2476-7108-0x000000013F250000-0x000000013F646000-memory.dmp	upx
behavioral1/memory/2604-7107-0x000000013FBD0000-0x000000013FFC6000-memory.dmp	upx
behavioral1/memory/2452-7106-0x000000013F810000-0x000000013FC06000-memory.dmp	upx
behavioral1/memory/2892-7115-0x000000013F090000-0x000000013F486000-memory.dmp	upx
behavioral1/memory/1852-7119-0x000000013FB50000-0x000000013FF46000-memory.dmp	upx
behavioral1/memory/2708-7112-0x000000013F840000-0x000000013FC36000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\mMAveHJ.exe	06d3b8b32030bc1f95a58fb2ba310ab0_NEIKI.exe
File created	C:\Windows\System\SIfpYzO.exe	06d3b8b32030bc1f95a58fb2ba310ab0_NEIKI.exe
File created	C:\Windows\System\gmmJFMR.exe	06d3b8b32030bc1f95a58fb2ba310ab0_NEIKI.exe
File created	C:\Windows\System\qIHeCLR.exe	06d3b8b32030bc1f95a58fb2ba310ab0_NEIKI.exe
File created	C:\Windows\System\LMltFfF.exe	06d3b8b32030bc1f95a58fb2ba310ab0_NEIKI.exe
File created	C:\Windows\System\zhXCiUe.exe	06d3b8b32030bc1f95a58fb2ba310ab0_NEIKI.exe
File created	C:\Windows\System\JlhRrnZ.exe	06d3b8b32030bc1f95a58fb2ba310ab0_NEIKI.exe
File created	C:\Windows\System\rDsFtJK.exe	06d3b8b32030bc1f95a58fb2ba310ab0_NEIKI.exe
File created	C:\Windows\System\jNMsRSc.exe	06d3b8b32030bc1f95a58fb2ba310ab0_NEIKI.exe
File created	C:\Windows\System\YfdmeVa.exe	06d3b8b32030bc1f95a58fb2ba310ab0_NEIKI.exe
File created	C:\Windows\System\ZFwhvjT.exe	06d3b8b32030bc1f95a58fb2ba310ab0_NEIKI.exe
File created	C:\Windows\System\kVSVGoC.exe	06d3b8b32030bc1f95a58fb2ba310ab0_NEIKI.exe
File created	C:\Windows\System\eakFrIa.exe	06d3b8b32030bc1f95a58fb2ba310ab0_NEIKI.exe
File created	C:\Windows\System\CBqZvmC.exe	06d3b8b32030bc1f95a58fb2ba310ab0_NEIKI.exe
File created	C:\Windows\System\HwTQxgy.exe	06d3b8b32030bc1f95a58fb2ba310ab0_NEIKI.exe
File created	C:\Windows\System\AcKoaHb.exe	06d3b8b32030bc1f95a58fb2ba310ab0_NEIKI.exe
File created	C:\Windows\System\OCVicKp.exe	06d3b8b32030bc1f95a58fb2ba310ab0_NEIKI.exe
File created	C:\Windows\System\AbeqraW.exe	06d3b8b32030bc1f95a58fb2ba310ab0_NEIKI.exe
File created	C:\Windows\System\bXMWjNd.exe	06d3b8b32030bc1f95a58fb2ba310ab0_NEIKI.exe
File created	C:\Windows\System\zsjWKUR.exe	06d3b8b32030bc1f95a58fb2ba310ab0_NEIKI.exe
File created	C:\Windows\System\lcuOTGL.exe	06d3b8b32030bc1f95a58fb2ba310ab0_NEIKI.exe
File created	C:\Windows\System\OuHniRM.exe	06d3b8b32030bc1f95a58fb2ba310ab0_NEIKI.exe
File created	C:\Windows\System\rdcbxBF.exe	06d3b8b32030bc1f95a58fb2ba310ab0_NEIKI.exe
File created	C:\Windows\System\MkUeZjl.exe	06d3b8b32030bc1f95a58fb2ba310ab0_NEIKI.exe
File created	C:\Windows\System\DLCRUpl.exe	06d3b8b32030bc1f95a58fb2ba310ab0_NEIKI.exe
File created	C:\Windows\System\Lznkuxt.exe	06d3b8b32030bc1f95a58fb2ba310ab0_NEIKI.exe
File created	C:\Windows\System\qLVrxLj.exe	06d3b8b32030bc1f95a58fb2ba310ab0_NEIKI.exe
File created	C:\Windows\System\RBDqGAt.exe	06d3b8b32030bc1f95a58fb2ba310ab0_NEIKI.exe
File created	C:\Windows\System\bDYvFTH.exe	06d3b8b32030bc1f95a58fb2ba310ab0_NEIKI.exe
File created	C:\Windows\System\oZgNjyC.exe	06d3b8b32030bc1f95a58fb2ba310ab0_NEIKI.exe
File created	C:\Windows\System\fflkReA.exe	06d3b8b32030bc1f95a58fb2ba310ab0_NEIKI.exe
File created	C:\Windows\System\GAPzzbk.exe	06d3b8b32030bc1f95a58fb2ba310ab0_NEIKI.exe
File created	C:\Windows\System\UsUyaDj.exe	06d3b8b32030bc1f95a58fb2ba310ab0_NEIKI.exe
File created	C:\Windows\System\FBFOTGC.exe	06d3b8b32030bc1f95a58fb2ba310ab0_NEIKI.exe
File created	C:\Windows\System\zdlqXdD.exe	06d3b8b32030bc1f95a58fb2ba310ab0_NEIKI.exe
File created	C:\Windows\System\hiFPxGW.exe	06d3b8b32030bc1f95a58fb2ba310ab0_NEIKI.exe
File created	C:\Windows\System\DZQSzZc.exe	06d3b8b32030bc1f95a58fb2ba310ab0_NEIKI.exe
File created	C:\Windows\System\yJxtCWd.exe	06d3b8b32030bc1f95a58fb2ba310ab0_NEIKI.exe
File created	C:\Windows\System\BbGnqxG.exe	06d3b8b32030bc1f95a58fb2ba310ab0_NEIKI.exe
File created	C:\Windows\System\igyabwO.exe	06d3b8b32030bc1f95a58fb2ba310ab0_NEIKI.exe
File created	C:\Windows\System\BbBnjhs.exe	06d3b8b32030bc1f95a58fb2ba310ab0_NEIKI.exe
File created	C:\Windows\System\LBSFvFY.exe	06d3b8b32030bc1f95a58fb2ba310ab0_NEIKI.exe
File created	C:\Windows\System\lCMXDtL.exe	06d3b8b32030bc1f95a58fb2ba310ab0_NEIKI.exe
File created	C:\Windows\System\RhIqeEL.exe	06d3b8b32030bc1f95a58fb2ba310ab0_NEIKI.exe
File created	C:\Windows\System\tpARSkF.exe	06d3b8b32030bc1f95a58fb2ba310ab0_NEIKI.exe
File created	C:\Windows\System\yaKzZTr.exe	06d3b8b32030bc1f95a58fb2ba310ab0_NEIKI.exe
File created	C:\Windows\System\ceiaocN.exe	06d3b8b32030bc1f95a58fb2ba310ab0_NEIKI.exe
File created	C:\Windows\System\riEwUjA.exe	06d3b8b32030bc1f95a58fb2ba310ab0_NEIKI.exe
File created	C:\Windows\System\IEDUiVf.exe	06d3b8b32030bc1f95a58fb2ba310ab0_NEIKI.exe
File created	C:\Windows\System\gMOXAUY.exe	06d3b8b32030bc1f95a58fb2ba310ab0_NEIKI.exe
File created	C:\Windows\System\qOonAuD.exe	06d3b8b32030bc1f95a58fb2ba310ab0_NEIKI.exe
File created	C:\Windows\System\guHZzLz.exe	06d3b8b32030bc1f95a58fb2ba310ab0_NEIKI.exe
File created	C:\Windows\System\lirpZTJ.exe	06d3b8b32030bc1f95a58fb2ba310ab0_NEIKI.exe
File created	C:\Windows\System\IEyiHlq.exe	06d3b8b32030bc1f95a58fb2ba310ab0_NEIKI.exe
File created	C:\Windows\System\emOgGca.exe	06d3b8b32030bc1f95a58fb2ba310ab0_NEIKI.exe
File created	C:\Windows\System\FShnIQB.exe	06d3b8b32030bc1f95a58fb2ba310ab0_NEIKI.exe
File created	C:\Windows\System\MwMpcMT.exe	06d3b8b32030bc1f95a58fb2ba310ab0_NEIKI.exe
File created	C:\Windows\System\bhCTKQE.exe	06d3b8b32030bc1f95a58fb2ba310ab0_NEIKI.exe
File created	C:\Windows\System\HbzruhP.exe	06d3b8b32030bc1f95a58fb2ba310ab0_NEIKI.exe
File created	C:\Windows\System\uUmPXIl.exe	06d3b8b32030bc1f95a58fb2ba310ab0_NEIKI.exe
File created	C:\Windows\System\OCRPtNi.exe	06d3b8b32030bc1f95a58fb2ba310ab0_NEIKI.exe
File created	C:\Windows\System\XVkUGkk.exe	06d3b8b32030bc1f95a58fb2ba310ab0_NEIKI.exe
File created	C:\Windows\System\vvwRLHB.exe	06d3b8b32030bc1f95a58fb2ba310ab0_NEIKI.exe
File created	C:\Windows\System\wdqymhW.exe	06d3b8b32030bc1f95a58fb2ba310ab0_NEIKI.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2508	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2700	06d3b8b32030bc1f95a58fb2ba310ab0_NEIKI.exe
Token: SeLockMemoryPrivilege	2700	06d3b8b32030bc1f95a58fb2ba310ab0_NEIKI.exe
Token: SeDebugPrivilege	2508	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2700 wrote to memory of 2508	2700	06d3b8b32030bc1f95a58fb2ba310ab0_NEIKI.exe	29
PID 2700 wrote to memory of 2508	2700	06d3b8b32030bc1f95a58fb2ba310ab0_NEIKI.exe	29
PID 2700 wrote to memory of 2508	2700	06d3b8b32030bc1f95a58fb2ba310ab0_NEIKI.exe	29
PID 2700 wrote to memory of 2544	2700	06d3b8b32030bc1f95a58fb2ba310ab0_NEIKI.exe	30
PID 2700 wrote to memory of 2544	2700	06d3b8b32030bc1f95a58fb2ba310ab0_NEIKI.exe	30
PID 2700 wrote to memory of 2544	2700	06d3b8b32030bc1f95a58fb2ba310ab0_NEIKI.exe	30
PID 2700 wrote to memory of 2680	2700	06d3b8b32030bc1f95a58fb2ba310ab0_NEIKI.exe	31
PID 2700 wrote to memory of 2680	2700	06d3b8b32030bc1f95a58fb2ba310ab0_NEIKI.exe	31
PID 2700 wrote to memory of 2680	2700	06d3b8b32030bc1f95a58fb2ba310ab0_NEIKI.exe	31
PID 2700 wrote to memory of 2348	2700	06d3b8b32030bc1f95a58fb2ba310ab0_NEIKI.exe	32
PID 2700 wrote to memory of 2348	2700	06d3b8b32030bc1f95a58fb2ba310ab0_NEIKI.exe	32
PID 2700 wrote to memory of 2348	2700	06d3b8b32030bc1f95a58fb2ba310ab0_NEIKI.exe	32
PID 2700 wrote to memory of 2284	2700	06d3b8b32030bc1f95a58fb2ba310ab0_NEIKI.exe	33
PID 2700 wrote to memory of 2284	2700	06d3b8b32030bc1f95a58fb2ba310ab0_NEIKI.exe	33
PID 2700 wrote to memory of 2284	2700	06d3b8b32030bc1f95a58fb2ba310ab0_NEIKI.exe	33
PID 2700 wrote to memory of 2760	2700	06d3b8b32030bc1f95a58fb2ba310ab0_NEIKI.exe	34
PID 2700 wrote to memory of 2760	2700	06d3b8b32030bc1f95a58fb2ba310ab0_NEIKI.exe	34
PID 2700 wrote to memory of 2760	2700	06d3b8b32030bc1f95a58fb2ba310ab0_NEIKI.exe	34
PID 2700 wrote to memory of 2452	2700	06d3b8b32030bc1f95a58fb2ba310ab0_NEIKI.exe	35
PID 2700 wrote to memory of 2452	2700	06d3b8b32030bc1f95a58fb2ba310ab0_NEIKI.exe	35
PID 2700 wrote to memory of 2452	2700	06d3b8b32030bc1f95a58fb2ba310ab0_NEIKI.exe	35
PID 2700 wrote to memory of 2396	2700	06d3b8b32030bc1f95a58fb2ba310ab0_NEIKI.exe	36
PID 2700 wrote to memory of 2396	2700	06d3b8b32030bc1f95a58fb2ba310ab0_NEIKI.exe	36
PID 2700 wrote to memory of 2396	2700	06d3b8b32030bc1f95a58fb2ba310ab0_NEIKI.exe	36
PID 2700 wrote to memory of 2476	2700	06d3b8b32030bc1f95a58fb2ba310ab0_NEIKI.exe	37
PID 2700 wrote to memory of 2476	2700	06d3b8b32030bc1f95a58fb2ba310ab0_NEIKI.exe	37
PID 2700 wrote to memory of 2476	2700	06d3b8b32030bc1f95a58fb2ba310ab0_NEIKI.exe	37
PID 2700 wrote to memory of 2604	2700	06d3b8b32030bc1f95a58fb2ba310ab0_NEIKI.exe	38
PID 2700 wrote to memory of 2604	2700	06d3b8b32030bc1f95a58fb2ba310ab0_NEIKI.exe	38
PID 2700 wrote to memory of 2604	2700	06d3b8b32030bc1f95a58fb2ba310ab0_NEIKI.exe	38
PID 2700 wrote to memory of 2892	2700	06d3b8b32030bc1f95a58fb2ba310ab0_NEIKI.exe	39
PID 2700 wrote to memory of 2892	2700	06d3b8b32030bc1f95a58fb2ba310ab0_NEIKI.exe	39
PID 2700 wrote to memory of 2892	2700	06d3b8b32030bc1f95a58fb2ba310ab0_NEIKI.exe	39
PID 2700 wrote to memory of 1852	2700	06d3b8b32030bc1f95a58fb2ba310ab0_NEIKI.exe	40
PID 2700 wrote to memory of 1852	2700	06d3b8b32030bc1f95a58fb2ba310ab0_NEIKI.exe	40
PID 2700 wrote to memory of 1852	2700	06d3b8b32030bc1f95a58fb2ba310ab0_NEIKI.exe	40
PID 2700 wrote to memory of 2708	2700	06d3b8b32030bc1f95a58fb2ba310ab0_NEIKI.exe	41
PID 2700 wrote to memory of 2708	2700	06d3b8b32030bc1f95a58fb2ba310ab0_NEIKI.exe	41
PID 2700 wrote to memory of 2708	2700	06d3b8b32030bc1f95a58fb2ba310ab0_NEIKI.exe	41
PID 2700 wrote to memory of 2728	2700	06d3b8b32030bc1f95a58fb2ba310ab0_NEIKI.exe	42
PID 2700 wrote to memory of 2728	2700	06d3b8b32030bc1f95a58fb2ba310ab0_NEIKI.exe	42
PID 2700 wrote to memory of 2728	2700	06d3b8b32030bc1f95a58fb2ba310ab0_NEIKI.exe	42
PID 2700 wrote to memory of 2204	2700	06d3b8b32030bc1f95a58fb2ba310ab0_NEIKI.exe	43
PID 2700 wrote to memory of 2204	2700	06d3b8b32030bc1f95a58fb2ba310ab0_NEIKI.exe	43
PID 2700 wrote to memory of 2204	2700	06d3b8b32030bc1f95a58fb2ba310ab0_NEIKI.exe	43
PID 2700 wrote to memory of 2196	2700	06d3b8b32030bc1f95a58fb2ba310ab0_NEIKI.exe	44
PID 2700 wrote to memory of 2196	2700	06d3b8b32030bc1f95a58fb2ba310ab0_NEIKI.exe	44
PID 2700 wrote to memory of 2196	2700	06d3b8b32030bc1f95a58fb2ba310ab0_NEIKI.exe	44
PID 2700 wrote to memory of 1492	2700	06d3b8b32030bc1f95a58fb2ba310ab0_NEIKI.exe	45
PID 2700 wrote to memory of 1492	2700	06d3b8b32030bc1f95a58fb2ba310ab0_NEIKI.exe	45
PID 2700 wrote to memory of 1492	2700	06d3b8b32030bc1f95a58fb2ba310ab0_NEIKI.exe	45
PID 2700 wrote to memory of 2216	2700	06d3b8b32030bc1f95a58fb2ba310ab0_NEIKI.exe	46
PID 2700 wrote to memory of 2216	2700	06d3b8b32030bc1f95a58fb2ba310ab0_NEIKI.exe	46
PID 2700 wrote to memory of 2216	2700	06d3b8b32030bc1f95a58fb2ba310ab0_NEIKI.exe	46
PID 2700 wrote to memory of 1556	2700	06d3b8b32030bc1f95a58fb2ba310ab0_NEIKI.exe	47
PID 2700 wrote to memory of 1556	2700	06d3b8b32030bc1f95a58fb2ba310ab0_NEIKI.exe	47
PID 2700 wrote to memory of 1556	2700	06d3b8b32030bc1f95a58fb2ba310ab0_NEIKI.exe	47
PID 2700 wrote to memory of 1564	2700	06d3b8b32030bc1f95a58fb2ba310ab0_NEIKI.exe	48
PID 2700 wrote to memory of 1564	2700	06d3b8b32030bc1f95a58fb2ba310ab0_NEIKI.exe	48
PID 2700 wrote to memory of 1564	2700	06d3b8b32030bc1f95a58fb2ba310ab0_NEIKI.exe	48
PID 2700 wrote to memory of 2768	2700	06d3b8b32030bc1f95a58fb2ba310ab0_NEIKI.exe	49
PID 2700 wrote to memory of 2768	2700	06d3b8b32030bc1f95a58fb2ba310ab0_NEIKI.exe	49
PID 2700 wrote to memory of 2768	2700	06d3b8b32030bc1f95a58fb2ba310ab0_NEIKI.exe	49
PID 2700 wrote to memory of 1288	2700	06d3b8b32030bc1f95a58fb2ba310ab0_NEIKI.exe	50

C:\Users\Admin\AppData\Local\Temp\06d3b8b32030bc1f95a58fb2ba310ab0_NEIKI.exe
"C:\Users\Admin\AppData\Local\Temp\06d3b8b32030bc1f95a58fb2ba310ab0_NEIKI.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2700
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2508
- C:\Windows\System\nLCqzyD.exe
  C:\Windows\System\nLCqzyD.exe
  2⤵
  - Executes dropped EXE
  PID:2544
- C:\Windows\System\EwJNcEz.exe
  C:\Windows\System\EwJNcEz.exe
  2⤵
  - Executes dropped EXE
  PID:2680
- C:\Windows\System\AXIzFOP.exe
  C:\Windows\System\AXIzFOP.exe
  2⤵
  - Executes dropped EXE
  PID:2348
- C:\Windows\System\vbyLkfj.exe
  C:\Windows\System\vbyLkfj.exe
  2⤵
  - Executes dropped EXE
  PID:2284
- C:\Windows\System\EyNYWoW.exe
  C:\Windows\System\EyNYWoW.exe
  2⤵
  - Executes dropped EXE
  PID:2760
- C:\Windows\System\glYlkoL.exe
  C:\Windows\System\glYlkoL.exe
  2⤵
  - Executes dropped EXE
  PID:2452
- C:\Windows\System\cbiZVlF.exe
  C:\Windows\System\cbiZVlF.exe
  2⤵
  - Executes dropped EXE
  PID:2396
- C:\Windows\System\OrOdksR.exe
  C:\Windows\System\OrOdksR.exe
  2⤵
  - Executes dropped EXE
  PID:2476
- C:\Windows\System\bRjjuzG.exe
  C:\Windows\System\bRjjuzG.exe
  2⤵
  - Executes dropped EXE
  PID:2604
- C:\Windows\System\ISGlqFw.exe
  C:\Windows\System\ISGlqFw.exe
  2⤵
  - Executes dropped EXE
  PID:2892
- C:\Windows\System\mXKNWhu.exe
  C:\Windows\System\mXKNWhu.exe
  2⤵
  - Executes dropped EXE
  PID:1852
- C:\Windows\System\AGBhsfN.exe
  C:\Windows\System\AGBhsfN.exe
  2⤵
  - Executes dropped EXE
  PID:2708
- C:\Windows\System\JVzVfRn.exe
  C:\Windows\System\JVzVfRn.exe
  2⤵
  - Executes dropped EXE
  PID:2728
- C:\Windows\System\qjVQmii.exe
  C:\Windows\System\qjVQmii.exe
  2⤵
  - Executes dropped EXE
  PID:2204
- C:\Windows\System\lSBVIlg.exe
  C:\Windows\System\lSBVIlg.exe
  2⤵
  - Executes dropped EXE
  PID:2196
- C:\Windows\System\JwxWImY.exe
  C:\Windows\System\JwxWImY.exe
  2⤵
  - Executes dropped EXE
  PID:1492
- C:\Windows\System\gwSnvwd.exe
  C:\Windows\System\gwSnvwd.exe
  2⤵
  - Executes dropped EXE
  PID:2216
- C:\Windows\System\iMaPGXC.exe
  C:\Windows\System\iMaPGXC.exe
  2⤵
  - Executes dropped EXE
  PID:1556
- C:\Windows\System\SKMPKXX.exe
  C:\Windows\System\SKMPKXX.exe
  2⤵
  - Executes dropped EXE
  PID:1564
- C:\Windows\System\iphcczV.exe
  C:\Windows\System\iphcczV.exe
  2⤵
  - Executes dropped EXE
  PID:2768
- C:\Windows\System\iOhPgqA.exe
  C:\Windows\System\iOhPgqA.exe
  2⤵
  - Executes dropped EXE
  PID:1288
- C:\Windows\System\MbcWHqn.exe
  C:\Windows\System\MbcWHqn.exe
  2⤵
  - Executes dropped EXE
  PID:336
- C:\Windows\System\YCWExnS.exe
  C:\Windows\System\YCWExnS.exe
  2⤵
  - Executes dropped EXE
  PID:1324
- C:\Windows\System\NseKHux.exe
  C:\Windows\System\NseKHux.exe
  2⤵
  - Executes dropped EXE
  PID:2020
- C:\Windows\System\mQUBlvv.exe
  C:\Windows\System\mQUBlvv.exe
  2⤵
  - Executes dropped EXE
  PID:2040
- C:\Windows\System\JvOUOkM.exe
  C:\Windows\System\JvOUOkM.exe
  2⤵
  - Executes dropped EXE
  PID:584
- C:\Windows\System\fSYkZaS.exe
  C:\Windows\System\fSYkZaS.exe
  2⤵
  - Executes dropped EXE
  PID:544
- C:\Windows\System\PRQMDvO.exe
  C:\Windows\System\PRQMDvO.exe
  2⤵
  - Executes dropped EXE
  PID:3056
- C:\Windows\System\sGYMawr.exe
  C:\Windows\System\sGYMawr.exe
  2⤵
  - Executes dropped EXE
  PID:2816
- C:\Windows\System\PfqMOcJ.exe
  C:\Windows\System\PfqMOcJ.exe
  2⤵
  - Executes dropped EXE
  PID:692
- C:\Windows\System\fXlvXBt.exe
  C:\Windows\System\fXlvXBt.exe
  2⤵
  - Executes dropped EXE
  PID:2324
- C:\Windows\System\ThQyeBc.exe
  C:\Windows\System\ThQyeBc.exe
  2⤵
  - Executes dropped EXE
  PID:1572
- C:\Windows\System\ruvdFzC.exe
  C:\Windows\System\ruvdFzC.exe
  2⤵
  - Executes dropped EXE
  PID:1304
- C:\Windows\System\fEmXVkX.exe
  C:\Windows\System\fEmXVkX.exe
  2⤵
  - Executes dropped EXE
  PID:2916
- C:\Windows\System\GlIAaNH.exe
  C:\Windows\System\GlIAaNH.exe
  2⤵
  - Executes dropped EXE
  PID:380
- C:\Windows\System\LiQkSfZ.exe
  C:\Windows\System\LiQkSfZ.exe
  2⤵
  - Executes dropped EXE
  PID:1016
- C:\Windows\System\CgxZvrV.exe
  C:\Windows\System\CgxZvrV.exe
  2⤵
  - Executes dropped EXE
  PID:968
- C:\Windows\System\BRkiPgR.exe
  C:\Windows\System\BRkiPgR.exe
  2⤵
  - Executes dropped EXE
  PID:108
- C:\Windows\System\BOxdCMN.exe
  C:\Windows\System\BOxdCMN.exe
  2⤵
  - Executes dropped EXE
  PID:2868
- C:\Windows\System\SjIBHdC.exe
  C:\Windows\System\SjIBHdC.exe
  2⤵
  - Executes dropped EXE
  PID:1876
- C:\Windows\System\caBxvHo.exe
  C:\Windows\System\caBxvHo.exe
  2⤵
  - Executes dropped EXE
  PID:1760
- C:\Windows\System\CkDIqsV.exe
  C:\Windows\System\CkDIqsV.exe
  2⤵
  - Executes dropped EXE
  PID:792
- C:\Windows\System\fQjIGbW.exe
  C:\Windows\System\fQjIGbW.exe
  2⤵
  - Executes dropped EXE
  PID:856
- C:\Windows\System\dTmPdCc.exe
  C:\Windows\System\dTmPdCc.exe
  2⤵
  - Executes dropped EXE
  PID:1884
- C:\Windows\System\SZlALGS.exe
  C:\Windows\System\SZlALGS.exe
  2⤵
  - Executes dropped EXE
  PID:1668
- C:\Windows\System\ScDpNpN.exe
  C:\Windows\System\ScDpNpN.exe
  2⤵
  - Executes dropped EXE
  PID:884
- C:\Windows\System\VwDkqUf.exe
  C:\Windows\System\VwDkqUf.exe
  2⤵
  - Executes dropped EXE
  PID:2092
- C:\Windows\System\hYJLqPR.exe
  C:\Windows\System\hYJLqPR.exe
  2⤵
  - Executes dropped EXE
  PID:2848
- C:\Windows\System\ManFIrL.exe
  C:\Windows\System\ManFIrL.exe
  2⤵
  - Executes dropped EXE
  PID:1504
- C:\Windows\System\VlupKBQ.exe
  C:\Windows\System\VlupKBQ.exe
  2⤵
  - Executes dropped EXE
  PID:2484
- C:\Windows\System\EHkIzAK.exe
  C:\Windows\System\EHkIzAK.exe
  2⤵
  - Executes dropped EXE
  PID:2540
- C:\Windows\System\XjewfGL.exe
  C:\Windows\System\XjewfGL.exe
  2⤵
  - Executes dropped EXE
  PID:2644
- C:\Windows\System\ZeynKBx.exe
  C:\Windows\System\ZeynKBx.exe
  2⤵
  - Executes dropped EXE
  PID:2524
- C:\Windows\System\IhwAJAk.exe
  C:\Windows\System\IhwAJAk.exe
  2⤵
  - Executes dropped EXE
  PID:2716
- C:\Windows\System\ygAFwUg.exe
  C:\Windows\System\ygAFwUg.exe
  2⤵
  - Executes dropped EXE
  PID:2572
- C:\Windows\System\ZdfdBVj.exe
  C:\Windows\System\ZdfdBVj.exe
  2⤵
  - Executes dropped EXE
  PID:2400
- C:\Windows\System\vtriqjZ.exe
  C:\Windows\System\vtriqjZ.exe
  2⤵
  - Executes dropped EXE
  PID:2328
- C:\Windows\System\ECSEBnI.exe
  C:\Windows\System\ECSEBnI.exe
  2⤵
  - Executes dropped EXE
  PID:2876
- C:\Windows\System\jvdheQj.exe
  C:\Windows\System\jvdheQj.exe
  2⤵
  - Executes dropped EXE
  PID:1540
- C:\Windows\System\jvGyNqh.exe
  C:\Windows\System\jvGyNqh.exe
  2⤵
  - Executes dropped EXE
  PID:2188
- C:\Windows\System\RoqxlpD.exe
  C:\Windows\System\RoqxlpD.exe
  2⤵
  - Executes dropped EXE
  PID:2152
- C:\Windows\System\AbLnsUC.exe
  C:\Windows\System\AbLnsUC.exe
  2⤵
  - Executes dropped EXE
  PID:2220
- C:\Windows\System\KDvvRyn.exe
  C:\Windows\System\KDvvRyn.exe
  2⤵
  - Executes dropped EXE
  PID:328
- C:\Windows\System\sXBxZiL.exe
  C:\Windows\System\sXBxZiL.exe
  2⤵
  PID:840
- C:\Windows\System\bEGZHdT.exe
  C:\Windows\System\bEGZHdT.exe
  2⤵
  - Executes dropped EXE
  PID:1580
- C:\Windows\System\XItNdQb.exe
  C:\Windows\System\XItNdQb.exe
  2⤵
  PID:2496
- C:\Windows\System\XnHvfzr.exe
  C:\Windows\System\XnHvfzr.exe
  2⤵
  PID:1376
- C:\Windows\System\DbuyBrx.exe
  C:\Windows\System\DbuyBrx.exe
  2⤵
  PID:1636
- C:\Windows\System\faMJObK.exe
  C:\Windows\System\faMJObK.exe
  2⤵
  PID:1456
- C:\Windows\System\dqeryxy.exe
  C:\Windows\System\dqeryxy.exe
  2⤵
  PID:2952
- C:\Windows\System\sOVDmDY.exe
  C:\Windows\System\sOVDmDY.exe
  2⤵
  PID:972
- C:\Windows\System\wRDGTTc.exe
  C:\Windows\System\wRDGTTc.exe
  2⤵
  PID:1028
- C:\Windows\System\WJSLFFb.exe
  C:\Windows\System\WJSLFFb.exe
  2⤵
  PID:1688
- C:\Windows\System\ZknjTjn.exe
  C:\Windows\System\ZknjTjn.exe
  2⤵
  PID:2276
- C:\Windows\System\ScXKinr.exe
  C:\Windows\System\ScXKinr.exe
  2⤵
  PID:2212
- C:\Windows\System\gZNECUB.exe
  C:\Windows\System\gZNECUB.exe
  2⤵
  PID:1364
- C:\Windows\System\cRrqLJE.exe
  C:\Windows\System\cRrqLJE.exe
  2⤵
  PID:1528
- C:\Windows\System\tDcomNk.exe
  C:\Windows\System\tDcomNk.exe
  2⤵
  PID:920
- C:\Windows\System\meRdiKq.exe
  C:\Windows\System\meRdiKq.exe
  2⤵
  PID:3064
- C:\Windows\System\eCqumQm.exe
  C:\Windows\System\eCqumQm.exe
  2⤵
  PID:1616
- C:\Windows\System\UQykodm.exe
  C:\Windows\System\UQykodm.exe
  2⤵
  PID:1560
- C:\Windows\System\ScyvVLn.exe
  C:\Windows\System\ScyvVLn.exe
  2⤵
  PID:568
- C:\Windows\System\YSFBoCm.exe
  C:\Windows\System\YSFBoCm.exe
  2⤵
  PID:1632
- C:\Windows\System\taTmVCO.exe
  C:\Windows\System\taTmVCO.exe
  2⤵
  PID:2308
- C:\Windows\System\JvfGtQo.exe
  C:\Windows\System\JvfGtQo.exe
  2⤵
  PID:2156
- C:\Windows\System\ZXZMGAC.exe
  C:\Windows\System\ZXZMGAC.exe
  2⤵
  PID:2404
- C:\Windows\System\NFGMEiu.exe
  C:\Windows\System\NFGMEiu.exe
  2⤵
  PID:2808
- C:\Windows\System\kvjykSZ.exe
  C:\Windows\System\kvjykSZ.exe
  2⤵
  PID:1924
- C:\Windows\System\iHcjXDx.exe
  C:\Windows\System\iHcjXDx.exe
  2⤵
  PID:2016
- C:\Windows\System\RjUShfR.exe
  C:\Windows\System\RjUShfR.exe
  2⤵
  PID:1604
- C:\Windows\System\YyOaHZp.exe
  C:\Windows\System\YyOaHZp.exe
  2⤵
  PID:2424
- C:\Windows\System\IwJojnc.exe
  C:\Windows\System\IwJojnc.exe
  2⤵
  PID:1168
- C:\Windows\System\PUUsbDc.exe
  C:\Windows\System\PUUsbDc.exe
  2⤵
  PID:2828
- C:\Windows\System\rTSKxsZ.exe
  C:\Windows\System\rTSKxsZ.exe
  2⤵
  PID:744
- C:\Windows\System\FuhAubY.exe
  C:\Windows\System\FuhAubY.exe
  2⤵
  PID:1192
- C:\Windows\System\HTsBcaN.exe
  C:\Windows\System\HTsBcaN.exe
  2⤵
  PID:1444
- C:\Windows\System\CnIRJXA.exe
  C:\Windows\System\CnIRJXA.exe
  2⤵
  PID:1672
- C:\Windows\System\uIUZnWH.exe
  C:\Windows\System\uIUZnWH.exe
  2⤵
  PID:2904
- C:\Windows\System\RuxxJHn.exe
  C:\Windows\System\RuxxJHn.exe
  2⤵
  PID:2232
- C:\Windows\System\OiajHDV.exe
  C:\Windows\System\OiajHDV.exe
  2⤵
  PID:2888
- C:\Windows\System\fXwROFi.exe
  C:\Windows\System\fXwROFi.exe
  2⤵
  PID:1536
- C:\Windows\System\YGTHhqC.exe
  C:\Windows\System\YGTHhqC.exe
  2⤵
  PID:704
- C:\Windows\System\ePXEdMh.exe
  C:\Windows\System\ePXEdMh.exe
  2⤵
  PID:2620
- C:\Windows\System\ktXHKKF.exe
  C:\Windows\System\ktXHKKF.exe
  2⤵
  PID:2272
- C:\Windows\System\YznKhMZ.exe
  C:\Windows\System\YznKhMZ.exe
  2⤵
  PID:2776
- C:\Windows\System\ulvBFOm.exe
  C:\Windows\System\ulvBFOm.exe
  2⤵
  PID:2444
- C:\Windows\System\woJQMhY.exe
  C:\Windows\System\woJQMhY.exe
  2⤵
  PID:1692
- C:\Windows\System\RAifFaZ.exe
  C:\Windows\System\RAifFaZ.exe
  2⤵
  PID:616
- C:\Windows\System\ByzykDR.exe
  C:\Windows\System\ByzykDR.exe
  2⤵
  PID:2088
- C:\Windows\System\hteEgSU.exe
  C:\Windows\System\hteEgSU.exe
  2⤵
  PID:2096
- C:\Windows\System\RsFEMOP.exe
  C:\Windows\System\RsFEMOP.exe
  2⤵
  PID:2200
- C:\Windows\System\DgXefNU.exe
  C:\Windows\System\DgXefNU.exe
  2⤵
  PID:2112
- C:\Windows\System\rVVxZti.exe
  C:\Windows\System\rVVxZti.exe
  2⤵
  PID:1872
- C:\Windows\System\BusCtCw.exe
  C:\Windows\System\BusCtCw.exe
  2⤵
  PID:600
- C:\Windows\System\arjGmUY.exe
  C:\Windows\System\arjGmUY.exe
  2⤵
  PID:3092
- C:\Windows\System\sgNlHVS.exe
  C:\Windows\System\sgNlHVS.exe
  2⤵
  PID:3108
- C:\Windows\System\FRgFxjD.exe
  C:\Windows\System\FRgFxjD.exe
  2⤵
  PID:3124
- C:\Windows\System\ghraknB.exe
  C:\Windows\System\ghraknB.exe
  2⤵
  PID:3152
- C:\Windows\System\pRgPZuc.exe
  C:\Windows\System\pRgPZuc.exe
  2⤵
  PID:3168
- C:\Windows\System\TEaSKFm.exe
  C:\Windows\System\TEaSKFm.exe
  2⤵
  PID:3192
- C:\Windows\System\AmSyeuH.exe
  C:\Windows\System\AmSyeuH.exe
  2⤵
  PID:3208
- C:\Windows\System\uAAtPhi.exe
  C:\Windows\System\uAAtPhi.exe
  2⤵
  PID:3224
- C:\Windows\System\PaAaiGT.exe
  C:\Windows\System\PaAaiGT.exe
  2⤵
  PID:3240
- C:\Windows\System\RcnYiNj.exe
  C:\Windows\System\RcnYiNj.exe
  2⤵
  PID:3268
- C:\Windows\System\gDEPcaT.exe
  C:\Windows\System\gDEPcaT.exe
  2⤵
  PID:3296
- C:\Windows\System\JLzwQbe.exe
  C:\Windows\System\JLzwQbe.exe
  2⤵
  PID:3312
- C:\Windows\System\XPlYYpr.exe
  C:\Windows\System\XPlYYpr.exe
  2⤵
  PID:3328
- C:\Windows\System\inpmqrq.exe
  C:\Windows\System\inpmqrq.exe
  2⤵
  PID:3352
- C:\Windows\System\NDhZraY.exe
  C:\Windows\System\NDhZraY.exe
  2⤵
  PID:3368
- C:\Windows\System\dktLYcm.exe
  C:\Windows\System\dktLYcm.exe
  2⤵
  PID:3396
- C:\Windows\System\SIfpYzO.exe
  C:\Windows\System\SIfpYzO.exe
  2⤵
  PID:3416
- C:\Windows\System\AzBQeYx.exe
  C:\Windows\System\AzBQeYx.exe
  2⤵
  PID:3432
- C:\Windows\System\pnHDpmd.exe
  C:\Windows\System\pnHDpmd.exe
  2⤵
  PID:3448
- C:\Windows\System\rPDMsfV.exe
  C:\Windows\System\rPDMsfV.exe
  2⤵
  PID:3464
- C:\Windows\System\SxTdLNo.exe
  C:\Windows\System\SxTdLNo.exe
  2⤵
  PID:3480
- C:\Windows\System\SrEVneC.exe
  C:\Windows\System\SrEVneC.exe
  2⤵
  PID:3504
- C:\Windows\System\mUQXJAg.exe
  C:\Windows\System\mUQXJAg.exe
  2⤵
  PID:3524
- C:\Windows\System\bzsvJwV.exe
  C:\Windows\System\bzsvJwV.exe
  2⤵
  PID:3548
- C:\Windows\System\hfFFLkL.exe
  C:\Windows\System\hfFFLkL.exe
  2⤵
  PID:3568
- C:\Windows\System\GjkmrrP.exe
  C:\Windows\System\GjkmrrP.exe
  2⤵
  PID:3592
- C:\Windows\System\uXzFhUq.exe
  C:\Windows\System\uXzFhUq.exe
  2⤵
  PID:3608
- C:\Windows\System\yxfxSsE.exe
  C:\Windows\System\yxfxSsE.exe
  2⤵
  PID:3628
- C:\Windows\System\RKgqElN.exe
  C:\Windows\System\RKgqElN.exe
  2⤵
  PID:3656
- C:\Windows\System\eMUIBKb.exe
  C:\Windows\System\eMUIBKb.exe
  2⤵
  PID:3676
- C:\Windows\System\SCMghrH.exe
  C:\Windows\System\SCMghrH.exe
  2⤵
  PID:3696
- C:\Windows\System\lGfhxab.exe
  C:\Windows\System\lGfhxab.exe
  2⤵
  PID:3712
- C:\Windows\System\uGSdPLY.exe
  C:\Windows\System\uGSdPLY.exe
  2⤵
  PID:3728
- C:\Windows\System\MaDTomP.exe
  C:\Windows\System\MaDTomP.exe
  2⤵
  PID:3744
- C:\Windows\System\HINLrBy.exe
  C:\Windows\System\HINLrBy.exe
  2⤵
  PID:3768
- C:\Windows\System\ceiaocN.exe
  C:\Windows\System\ceiaocN.exe
  2⤵
  PID:3784
- C:\Windows\System\RExYDbv.exe
  C:\Windows\System\RExYDbv.exe
  2⤵
  PID:3804
- C:\Windows\System\zDFdJEE.exe
  C:\Windows\System\zDFdJEE.exe
  2⤵
  PID:3824
- C:\Windows\System\omeVgsr.exe
  C:\Windows\System\omeVgsr.exe
  2⤵
  PID:3848
- C:\Windows\System\JQuCtFx.exe
  C:\Windows\System\JQuCtFx.exe
  2⤵
  PID:3868
- C:\Windows\System\WHNFDzS.exe
  C:\Windows\System\WHNFDzS.exe
  2⤵
  PID:3896
- C:\Windows\System\DqIlicO.exe
  C:\Windows\System\DqIlicO.exe
  2⤵
  PID:3916
- C:\Windows\System\mrRarCP.exe
  C:\Windows\System\mrRarCP.exe
  2⤵
  PID:3936
- C:\Windows\System\hJVNSOx.exe
  C:\Windows\System\hJVNSOx.exe
  2⤵
  PID:3956
- C:\Windows\System\YpHNpDC.exe
  C:\Windows\System\YpHNpDC.exe
  2⤵
  PID:3976
- C:\Windows\System\niRhvCV.exe
  C:\Windows\System\niRhvCV.exe
  2⤵
  PID:3992
- C:\Windows\System\WyZZpIr.exe
  C:\Windows\System\WyZZpIr.exe
  2⤵
  PID:4012
- C:\Windows\System\wpSMCjx.exe
  C:\Windows\System\wpSMCjx.exe
  2⤵
  PID:4028
- C:\Windows\System\Lznkuxt.exe
  C:\Windows\System\Lznkuxt.exe
  2⤵
  PID:4052
- C:\Windows\System\ytKOgAn.exe
  C:\Windows\System\ytKOgAn.exe
  2⤵
  PID:4068
- C:\Windows\System\XCsvLXX.exe
  C:\Windows\System\XCsvLXX.exe
  2⤵
  PID:4084
- C:\Windows\System\KZBsPQX.exe
  C:\Windows\System\KZBsPQX.exe
  2⤵
  PID:1584
- C:\Windows\System\ocRgoVZ.exe
  C:\Windows\System\ocRgoVZ.exe
  2⤵
  PID:2000
- C:\Windows\System\hwzvHOm.exe
  C:\Windows\System\hwzvHOm.exe
  2⤵
  PID:576
- C:\Windows\System\RsEISFP.exe
  C:\Windows\System\RsEISFP.exe
  2⤵
  PID:896
- C:\Windows\System\xqJEGHl.exe
  C:\Windows\System\xqJEGHl.exe
  2⤵
  PID:2568
- C:\Windows\System\JCfXQRd.exe
  C:\Windows\System\JCfXQRd.exe
  2⤵
  PID:3104
- C:\Windows\System\MYIghLX.exe
  C:\Windows\System\MYIghLX.exe
  2⤵
  PID:3144
- C:\Windows\System\zJKiazH.exe
  C:\Windows\System\zJKiazH.exe
  2⤵
  PID:3180
- C:\Windows\System\iUfyaET.exe
  C:\Windows\System\iUfyaET.exe
  2⤵
  PID:3252
- C:\Windows\System\HQhpOuU.exe
  C:\Windows\System\HQhpOuU.exe
  2⤵
  PID:3116
- C:\Windows\System\WlhrZqi.exe
  C:\Windows\System\WlhrZqi.exe
  2⤵
  PID:3336
- C:\Windows\System\PvZeOvN.exe
  C:\Windows\System\PvZeOvN.exe
  2⤵
  PID:3120
- C:\Windows\System\osTZyfL.exe
  C:\Windows\System\osTZyfL.exe
  2⤵
  PID:3376
- C:\Windows\System\LLXbbTd.exe
  C:\Windows\System\LLXbbTd.exe
  2⤵
  PID:3276
- C:\Windows\System\eInTrCd.exe
  C:\Windows\System\eInTrCd.exe
  2⤵
  PID:3424
- C:\Windows\System\JRHFfHT.exe
  C:\Windows\System\JRHFfHT.exe
  2⤵
  PID:3320
- C:\Windows\System\VjBZrzT.exe
  C:\Windows\System\VjBZrzT.exe
  2⤵
  PID:3488
- C:\Windows\System\pFypxRW.exe
  C:\Windows\System\pFypxRW.exe
  2⤵
  PID:3404
- C:\Windows\System\SdWqNps.exe
  C:\Windows\System\SdWqNps.exe
  2⤵
  PID:3544
- C:\Windows\System\zOoONyW.exe
  C:\Windows\System\zOoONyW.exe
  2⤵
  PID:3580
- C:\Windows\System\bIbtqWj.exe
  C:\Windows\System\bIbtqWj.exe
  2⤵
  PID:2804
- C:\Windows\System\ZarsBvV.exe
  C:\Windows\System\ZarsBvV.exe
  2⤵
  PID:3476
- C:\Windows\System\VvmPIYW.exe
  C:\Windows\System\VvmPIYW.exe
  2⤵
  PID:3664
- C:\Windows\System\XubeEOa.exe
  C:\Windows\System\XubeEOa.exe
  2⤵
  PID:3708
- C:\Windows\System\TThxsYT.exe
  C:\Windows\System\TThxsYT.exe
  2⤵
  PID:3564
- C:\Windows\System\ZJoCyaB.exe
  C:\Windows\System\ZJoCyaB.exe
  2⤵
  PID:3644
- C:\Windows\System\IsfiYTE.exe
  C:\Windows\System\IsfiYTE.exe
  2⤵
  PID:3684
- C:\Windows\System\IKbsbLe.exe
  C:\Windows\System\IKbsbLe.exe
  2⤵
  PID:3816
- C:\Windows\System\jRWfIiP.exe
  C:\Windows\System\jRWfIiP.exe
  2⤵
  PID:3756
- C:\Windows\System\MqjdKqY.exe
  C:\Windows\System\MqjdKqY.exe
  2⤵
  PID:3800
- C:\Windows\System\bySTCmo.exe
  C:\Windows\System\bySTCmo.exe
  2⤵
  PID:3880
- C:\Windows\System\LJDEonz.exe
  C:\Windows\System\LJDEonz.exe
  2⤵
  PID:3832
- C:\Windows\System\zWaNhKB.exe
  C:\Windows\System\zWaNhKB.exe
  2⤵
  PID:4024
- C:\Windows\System\lbQzTsF.exe
  C:\Windows\System\lbQzTsF.exe
  2⤵
  PID:2624
- C:\Windows\System\HbKmZXr.exe
  C:\Windows\System\HbKmZXr.exe
  2⤵
  PID:3924
- C:\Windows\System\sKEHTka.exe
  C:\Windows\System\sKEHTka.exe
  2⤵
  PID:3972
- C:\Windows\System\AWKhxdR.exe
  C:\Windows\System\AWKhxdR.exe
  2⤵
  PID:2612
- C:\Windows\System\cHruiMd.exe
  C:\Windows\System\cHruiMd.exe
  2⤵
  PID:3256
- C:\Windows\System\JNOdxLp.exe
  C:\Windows\System\JNOdxLp.exe
  2⤵
  PID:3392
- C:\Windows\System\IiJKgdn.exe
  C:\Windows\System\IiJKgdn.exe
  2⤵
  PID:3540
- C:\Windows\System\gfgNqhL.exe
  C:\Windows\System\gfgNqhL.exe
  2⤵
  PID:4040
- C:\Windows\System\WliayhE.exe
  C:\Windows\System\WliayhE.exe
  2⤵
  PID:4076
- C:\Windows\System\aYWhCDC.exe
  C:\Windows\System\aYWhCDC.exe
  2⤵
  PID:2556
- C:\Windows\System\KUSVpiY.exe
  C:\Windows\System\KUSVpiY.exe
  2⤵
  PID:3600
- C:\Windows\System\sBAZmVx.exe
  C:\Windows\System\sBAZmVx.exe
  2⤵
  PID:2692
- C:\Windows\System\nvheooo.exe
  C:\Windows\System\nvheooo.exe
  2⤵
  PID:2632
- C:\Windows\System\OCnlQzJ.exe
  C:\Windows\System\OCnlQzJ.exe
  2⤵
  PID:3176
- C:\Windows\System\dCoffFc.exe
  C:\Windows\System\dCoffFc.exe
  2⤵
  PID:3160
- C:\Windows\System\wUJZHkW.exe
  C:\Windows\System\wUJZHkW.exe
  2⤵
  PID:3280
- C:\Windows\System\aebQVAl.exe
  C:\Windows\System\aebQVAl.exe
  2⤵
  PID:3904
- C:\Windows\System\VkPKZlt.exe
  C:\Windows\System\VkPKZlt.exe
  2⤵
  PID:3588
- C:\Windows\System\IMreoPH.exe
  C:\Windows\System\IMreoPH.exe
  2⤵
  PID:3560
- C:\Windows\System\EXtlvCL.exe
  C:\Windows\System\EXtlvCL.exe
  2⤵
  PID:2564
- C:\Windows\System\aaNXgbW.exe
  C:\Windows\System\aaNXgbW.exe
  2⤵
  PID:2756
- C:\Windows\System\MzrqGWO.exe
  C:\Windows\System\MzrqGWO.exe
  2⤵
  PID:3704
- C:\Windows\System\ZQXTMnt.exe
  C:\Windows\System\ZQXTMnt.exe
  2⤵
  PID:3576
- C:\Windows\System\sujnoNC.exe
  C:\Windows\System\sujnoNC.exe
  2⤵
  PID:3948
- C:\Windows\System\pPkiwkC.exe
  C:\Windows\System\pPkiwkC.exe
  2⤵
  PID:4020
- C:\Windows\System\rGWglGc.exe
  C:\Windows\System\rGWglGc.exe
  2⤵
  PID:2960
- C:\Windows\System\gxAUQHn.exe
  C:\Windows\System\gxAUQHn.exe
  2⤵
  PID:4000
- C:\Windows\System\WvuRvwx.exe
  C:\Windows\System\WvuRvwx.exe
  2⤵
  PID:4092
- C:\Windows\System\ZiCRFBO.exe
  C:\Windows\System\ZiCRFBO.exe
  2⤵
  PID:3232
- C:\Windows\System\MghRNjZ.exe
  C:\Windows\System\MghRNjZ.exe
  2⤵
  PID:276
- C:\Windows\System\bLUrNpu.exe
  C:\Windows\System\bLUrNpu.exe
  2⤵
  PID:3220
- C:\Windows\System\wQuCkQm.exe
  C:\Windows\System\wQuCkQm.exe
  2⤵
  PID:1004
- C:\Windows\System\lHdByju.exe
  C:\Windows\System\lHdByju.exe
  2⤵
  PID:4048
- C:\Windows\System\yMPmqNu.exe
  C:\Windows\System\yMPmqNu.exe
  2⤵
  PID:3088
- C:\Windows\System\QfkWSci.exe
  C:\Windows\System\QfkWSci.exe
  2⤵
  PID:3164
- C:\Windows\System\kwLpdPT.exe
  C:\Windows\System\kwLpdPT.exe
  2⤵
  PID:3912
- C:\Windows\System\aQuriJs.exe
  C:\Windows\System\aQuriJs.exe
  2⤵
  PID:3084
- C:\Windows\System\UrhpsNN.exe
  C:\Windows\System\UrhpsNN.exe
  2⤵
  PID:3860
- C:\Windows\System\gUWobqI.exe
  C:\Windows\System\gUWobqI.exe
  2⤵
  PID:3692
- C:\Windows\System\FMwRvzP.exe
  C:\Windows\System\FMwRvzP.exe
  2⤵
  PID:3292
- C:\Windows\System\SifZPmO.exe
  C:\Windows\System\SifZPmO.exe
  2⤵
  PID:3944
- C:\Windows\System\LQPSwbe.exe
  C:\Windows\System\LQPSwbe.exe
  2⤵
  PID:3888
- C:\Windows\System\ShTWevl.exe
  C:\Windows\System\ShTWevl.exe
  2⤵
  PID:4064
- C:\Windows\System\LoCGJfs.exe
  C:\Windows\System\LoCGJfs.exe
  2⤵
  PID:3952
- C:\Windows\System\kZfCdNF.exe
  C:\Windows\System\kZfCdNF.exe
  2⤵
  PID:540
- C:\Windows\System\yfHemPe.exe
  C:\Windows\System\yfHemPe.exe
  2⤵
  PID:548
- C:\Windows\System\FmqEKPJ.exe
  C:\Windows\System\FmqEKPJ.exe
  2⤵
  PID:2416
- C:\Windows\System\JhxvdsV.exe
  C:\Windows\System\JhxvdsV.exe
  2⤵
  PID:2408
- C:\Windows\System\jdLrqhQ.exe
  C:\Windows\System\jdLrqhQ.exe
  2⤵
  PID:3764
- C:\Windows\System\knTMdkZ.exe
  C:\Windows\System\knTMdkZ.exe
  2⤵
  PID:2584
- C:\Windows\System\HicKLrW.exe
  C:\Windows\System\HicKLrW.exe
  2⤵
  PID:3780
- C:\Windows\System\whWiPnC.exe
  C:\Windows\System\whWiPnC.exe
  2⤵
  PID:3884
- C:\Windows\System\EbjthHD.exe
  C:\Windows\System\EbjthHD.exe
  2⤵
  PID:4100
- C:\Windows\System\DKvuYtu.exe
  C:\Windows\System\DKvuYtu.exe
  2⤵
  PID:4120
- C:\Windows\System\lHrwWpr.exe
  C:\Windows\System\lHrwWpr.exe
  2⤵
  PID:4144
- C:\Windows\System\PiOJXRI.exe
  C:\Windows\System\PiOJXRI.exe
  2⤵
  PID:4164
- C:\Windows\System\kqvjhXK.exe
  C:\Windows\System\kqvjhXK.exe
  2⤵
  PID:4180
- C:\Windows\System\KrAIZuM.exe
  C:\Windows\System\KrAIZuM.exe
  2⤵
  PID:4200
- C:\Windows\System\loHoSuo.exe
  C:\Windows\System\loHoSuo.exe
  2⤵
  PID:4224
- C:\Windows\System\xQYSikv.exe
  C:\Windows\System\xQYSikv.exe
  2⤵
  PID:4248
- C:\Windows\System\WqsINwM.exe
  C:\Windows\System\WqsINwM.exe
  2⤵
  PID:4264
- C:\Windows\System\EjafDBx.exe
  C:\Windows\System\EjafDBx.exe
  2⤵
  PID:4284
- C:\Windows\System\RsfrxYf.exe
  C:\Windows\System\RsfrxYf.exe
  2⤵
  PID:4308
- C:\Windows\System\lIQDGSF.exe
  C:\Windows\System\lIQDGSF.exe
  2⤵
  PID:4328
- C:\Windows\System\vAotPBy.exe
  C:\Windows\System\vAotPBy.exe
  2⤵
  PID:4344
- C:\Windows\System\cQhdhoe.exe
  C:\Windows\System\cQhdhoe.exe
  2⤵
  PID:4360
- C:\Windows\System\szrXuZR.exe
  C:\Windows\System\szrXuZR.exe
  2⤵
  PID:4380
- C:\Windows\System\xUkBGsd.exe
  C:\Windows\System\xUkBGsd.exe
  2⤵
  PID:4396
- C:\Windows\System\uoShmju.exe
  C:\Windows\System\uoShmju.exe
  2⤵
  PID:4420
- C:\Windows\System\eliEmAY.exe
  C:\Windows\System\eliEmAY.exe
  2⤵
  PID:4448
- C:\Windows\System\tTWRyqD.exe
  C:\Windows\System\tTWRyqD.exe
  2⤵
  PID:4464
- C:\Windows\System\bDvOBic.exe
  C:\Windows\System\bDvOBic.exe
  2⤵
  PID:4488
- C:\Windows\System\YPWebio.exe
  C:\Windows\System\YPWebio.exe
  2⤵
  PID:4504
- C:\Windows\System\ydNLEjY.exe
  C:\Windows\System\ydNLEjY.exe
  2⤵
  PID:4520
- C:\Windows\System\rdeiGim.exe
  C:\Windows\System\rdeiGim.exe
  2⤵
  PID:4548
- C:\Windows\System\ndifKKx.exe
  C:\Windows\System\ndifKKx.exe
  2⤵
  PID:4568
- C:\Windows\System\zybarkD.exe
  C:\Windows\System\zybarkD.exe
  2⤵
  PID:4584
- C:\Windows\System\ZAQobWM.exe
  C:\Windows\System\ZAQobWM.exe
  2⤵
  PID:4608
- C:\Windows\System\faUUtpw.exe
  C:\Windows\System\faUUtpw.exe
  2⤵
  PID:4624
- C:\Windows\System\apPvBie.exe
  C:\Windows\System\apPvBie.exe
  2⤵
  PID:4648
- C:\Windows\System\QDrcTPr.exe
  C:\Windows\System\QDrcTPr.exe
  2⤵
  PID:4668
- C:\Windows\System\eGaMmyE.exe
  C:\Windows\System\eGaMmyE.exe
  2⤵
  PID:4684
- C:\Windows\System\lJndhKr.exe
  C:\Windows\System\lJndhKr.exe
  2⤵
  PID:4704
- C:\Windows\System\DWphTGM.exe
  C:\Windows\System\DWphTGM.exe
  2⤵
  PID:4724
- C:\Windows\System\nJxnPvM.exe
  C:\Windows\System\nJxnPvM.exe
  2⤵
  PID:4744
- C:\Windows\System\WgPvglu.exe
  C:\Windows\System\WgPvglu.exe
  2⤵
  PID:4760
- C:\Windows\System\vtwdeUW.exe
  C:\Windows\System\vtwdeUW.exe
  2⤵
  PID:4776
- C:\Windows\System\RKPyxtk.exe
  C:\Windows\System\RKPyxtk.exe
  2⤵
  PID:4796
- C:\Windows\System\TEkMKay.exe
  C:\Windows\System\TEkMKay.exe
  2⤵
  PID:4816
- C:\Windows\System\zXNloty.exe
  C:\Windows\System\zXNloty.exe
  2⤵
  PID:4832
- C:\Windows\System\MeRkTiH.exe
  C:\Windows\System\MeRkTiH.exe
  2⤵
  PID:4848
- C:\Windows\System\zqCVerZ.exe
  C:\Windows\System\zqCVerZ.exe
  2⤵
  PID:4872
- C:\Windows\System\CmpFxlu.exe
  C:\Windows\System\CmpFxlu.exe
  2⤵
  PID:4888
- C:\Windows\System\nBaYdWc.exe
  C:\Windows\System\nBaYdWc.exe
  2⤵
  PID:4904
- C:\Windows\System\KhZltRb.exe
  C:\Windows\System\KhZltRb.exe
  2⤵
  PID:4924
- C:\Windows\System\ZeRPRBN.exe
  C:\Windows\System\ZeRPRBN.exe
  2⤵
  PID:4940
- C:\Windows\System\nWwhQeH.exe
  C:\Windows\System\nWwhQeH.exe
  2⤵
  PID:4956
- C:\Windows\System\vOQqKcc.exe
  C:\Windows\System\vOQqKcc.exe
  2⤵
  PID:4972
- C:\Windows\System\EauMaop.exe
  C:\Windows\System\EauMaop.exe
  2⤵
  PID:4992
- C:\Windows\System\TEuchGj.exe
  C:\Windows\System\TEuchGj.exe
  2⤵
  PID:5012
- C:\Windows\System\GoJZJoC.exe
  C:\Windows\System\GoJZJoC.exe
  2⤵
  PID:5028
- C:\Windows\System\Sxhuitc.exe
  C:\Windows\System\Sxhuitc.exe
  2⤵
  PID:5044
- C:\Windows\System\ilWotNH.exe
  C:\Windows\System\ilWotNH.exe
  2⤵
  PID:5060
- C:\Windows\System\aeDcAnk.exe
  C:\Windows\System\aeDcAnk.exe
  2⤵
  PID:5080
- C:\Windows\System\jsRKsrE.exe
  C:\Windows\System\jsRKsrE.exe
  2⤵
  PID:5108
- C:\Windows\System\RjbDOCZ.exe
  C:\Windows\System\RjbDOCZ.exe
  2⤵
  PID:3620
- C:\Windows\System\WNZXuPJ.exe
  C:\Windows\System\WNZXuPJ.exe
  2⤵
  PID:1684
- C:\Windows\System\RkKNFuc.exe
  C:\Windows\System\RkKNFuc.exe
  2⤵
  PID:3364
- C:\Windows\System\YpxjAvj.exe
  C:\Windows\System\YpxjAvj.exe
  2⤵
  PID:2688
- C:\Windows\System\wxmoJGr.exe
  C:\Windows\System\wxmoJGr.exe
  2⤵
  PID:1992
- C:\Windows\System\NwiJuuj.exe
  C:\Windows\System\NwiJuuj.exe
  2⤵
  PID:3080
- C:\Windows\System\hqYKnqY.exe
  C:\Windows\System\hqYKnqY.exe
  2⤵
  PID:2388
- C:\Windows\System\GfWJBKK.exe
  C:\Windows\System\GfWJBKK.exe
  2⤵
  PID:4108
- C:\Windows\System\RJcELao.exe
  C:\Windows\System\RJcELao.exe
  2⤵
  PID:4160
- C:\Windows\System\tUXellC.exe
  C:\Windows\System\tUXellC.exe
  2⤵
  PID:4192
- C:\Windows\System\YqOSaDA.exe
  C:\Windows\System\YqOSaDA.exe
  2⤵
  PID:4244
- C:\Windows\System\WNIkXLa.exe
  C:\Windows\System\WNIkXLa.exe
  2⤵
  PID:4136
- C:\Windows\System\iMXRxTK.exe
  C:\Windows\System\iMXRxTK.exe
  2⤵
  PID:4280
- C:\Windows\System\kpvMhTz.exe
  C:\Windows\System\kpvMhTz.exe
  2⤵
  PID:4176
- C:\Windows\System\FMWGOIa.exe
  C:\Windows\System\FMWGOIa.exe
  2⤵
  PID:4216
- C:\Windows\System\yXMlbuh.exe
  C:\Windows\System\yXMlbuh.exe
  2⤵
  PID:4296
- C:\Windows\System\XqfIyRW.exe
  C:\Windows\System\XqfIyRW.exe
  2⤵
  PID:4440
- C:\Windows\System\vyCsVSK.exe
  C:\Windows\System\vyCsVSK.exe
  2⤵
  PID:4376
- C:\Windows\System\WsKDmJO.exe
  C:\Windows\System\WsKDmJO.exe
  2⤵
  PID:1756
- C:\Windows\System\zexUupr.exe
  C:\Windows\System\zexUupr.exe
  2⤵
  PID:4564
- C:\Windows\System\KMVSCNK.exe
  C:\Windows\System\KMVSCNK.exe
  2⤵
  PID:4412
- C:\Windows\System\upQpooS.exe
  C:\Windows\System\upQpooS.exe
  2⤵
  PID:4596
- C:\Windows\System\smhkHIz.exe
  C:\Windows\System\smhkHIz.exe
  2⤵
  PID:4680
- C:\Windows\System\NIuPbKH.exe
  C:\Windows\System\NIuPbKH.exe
  2⤵
  PID:4716
- C:\Windows\System\ouIvmME.exe
  C:\Windows\System\ouIvmME.exe
  2⤵
  PID:4740
- C:\Windows\System\tAsPEDN.exe
  C:\Windows\System\tAsPEDN.exe
  2⤵
  PID:4772
- C:\Windows\System\yqkvFHm.exe
  C:\Windows\System\yqkvFHm.exe
  2⤵
  PID:4692
- C:\Windows\System\BrKnAOt.exe
  C:\Windows\System\BrKnAOt.exe
  2⤵
  PID:4840
- C:\Windows\System\ZZlfiKH.exe
  C:\Windows\System\ZZlfiKH.exe
  2⤵
  PID:4880
- C:\Windows\System\uYxOBOe.exe
  C:\Windows\System\uYxOBOe.exe
  2⤵
  PID:4920
- C:\Windows\System\wDODEJJ.exe
  C:\Windows\System\wDODEJJ.exe
  2⤵
  PID:4984
- C:\Windows\System\DVMLIvR.exe
  C:\Windows\System\DVMLIvR.exe
  2⤵
  PID:5024
- C:\Windows\System\BfdHNOQ.exe
  C:\Windows\System\BfdHNOQ.exe
  2⤵
  PID:5092
- C:\Windows\System\WhkLhPV.exe
  C:\Windows\System\WhkLhPV.exe
  2⤵
  PID:1516
- C:\Windows\System\leQnXvB.exe
  C:\Windows\System\leQnXvB.exe
  2⤵
  PID:3344
- C:\Windows\System\flzokjs.exe
  C:\Windows\System\flzokjs.exe
  2⤵
  PID:2648
- C:\Windows\System\pqlOaZf.exe
  C:\Windows\System\pqlOaZf.exe
  2⤵
  PID:4900
- C:\Windows\System\ITkogUa.exe
  C:\Windows\System\ITkogUa.exe
  2⤵
  PID:4188
- C:\Windows\System\qSzyGIo.exe
  C:\Windows\System\qSzyGIo.exe
  2⤵
  PID:4172
- C:\Windows\System\YmSgQzm.exe
  C:\Windows\System\YmSgQzm.exe
  2⤵
  PID:4556
- C:\Windows\System\gxxxcyb.exe
  C:\Windows\System\gxxxcyb.exe
  2⤵
  PID:5000
- C:\Windows\System\YVNLhnD.exe
  C:\Windows\System\YVNLhnD.exe
  2⤵
  PID:5040
- C:\Windows\System\BiVssFk.exe
  C:\Windows\System\BiVssFk.exe
  2⤵
  PID:5116
- C:\Windows\System\vuWlPnl.exe
  C:\Windows\System\vuWlPnl.exe
  2⤵
  PID:3188
- C:\Windows\System\jTvgLdS.exe
  C:\Windows\System\jTvgLdS.exe
  2⤵
  PID:4140
- C:\Windows\System\FUXqTkJ.exe
  C:\Windows\System\FUXqTkJ.exe
  2⤵
  PID:2920
- C:\Windows\System\MWaBySu.exe
  C:\Windows\System\MWaBySu.exe
  2⤵
  PID:4304
- C:\Windows\System\jEeBbKD.exe
  C:\Windows\System\jEeBbKD.exe
  2⤵
  PID:4408
- C:\Windows\System\WFMMkny.exe
  C:\Windows\System\WFMMkny.exe
  2⤵
  PID:2772
- C:\Windows\System\pzNYyfQ.exe
  C:\Windows\System\pzNYyfQ.exe
  2⤵
  PID:4500
- C:\Windows\System\IKmzSiP.exe
  C:\Windows\System\IKmzSiP.exe
  2⤵
  PID:4536
- C:\Windows\System\PfIyLss.exe
  C:\Windows\System\PfIyLss.exe
  2⤵
  PID:4580
- C:\Windows\System\wpqbgLj.exe
  C:\Windows\System\wpqbgLj.exe
  2⤵
  PID:4460
- C:\Windows\System\RouCbcY.exe
  C:\Windows\System\RouCbcY.exe
  2⤵
  PID:4824
- C:\Windows\System\HgXhJjQ.exe
  C:\Windows\System\HgXhJjQ.exe
  2⤵
  PID:4736
- C:\Windows\System\qPVpFaZ.exe
  C:\Windows\System\qPVpFaZ.exe
  2⤵
  PID:4804
- C:\Windows\System\HwaUENd.exe
  C:\Windows\System\HwaUENd.exe
  2⤵
  PID:4912
- C:\Windows\System\XgHKecx.exe
  C:\Windows\System\XgHKecx.exe
  2⤵
  PID:4128
- C:\Windows\System\xplVvUi.exe
  C:\Windows\System\xplVvUi.exe
  2⤵
  PID:5100
- C:\Windows\System\KVVSCNT.exe
  C:\Windows\System\KVVSCNT.exe
  2⤵
  PID:4720
- C:\Windows\System\uuPvNWo.exe
  C:\Windows\System\uuPvNWo.exe
  2⤵
  PID:4968
- C:\Windows\System\CzLCtud.exe
  C:\Windows\System\CzLCtud.exe
  2⤵
  PID:4112
- C:\Windows\System\EfYTZIa.exe
  C:\Windows\System\EfYTZIa.exe
  2⤵
  PID:4292
- C:\Windows\System\RlBaJSD.exe
  C:\Windows\System\RlBaJSD.exe
  2⤵
  PID:332
- C:\Windows\System\CwXDlZX.exe
  C:\Windows\System\CwXDlZX.exe
  2⤵
  PID:4272
- C:\Windows\System\UEgoClW.exe
  C:\Windows\System\UEgoClW.exe
  2⤵
  PID:2180
- C:\Windows\System\bGXyXRj.exe
  C:\Windows\System\bGXyXRj.exe
  2⤵
  PID:4372
- C:\Windows\System\ktmuqbo.exe
  C:\Windows\System\ktmuqbo.exe
  2⤵
  PID:4388
- C:\Windows\System\cCcaQyo.exe
  C:\Windows\System\cCcaQyo.exe
  2⤵
  PID:4232
- C:\Windows\System\gLDDcRD.exe
  C:\Windows\System\gLDDcRD.exe
  2⤵
  PID:4436
- C:\Windows\System\QamwEpM.exe
  C:\Windows\System\QamwEpM.exe
  2⤵
  PID:4540
- C:\Windows\System\jhocxtm.exe
  C:\Windows\System\jhocxtm.exe
  2⤵
  PID:1240
- C:\Windows\System\SRWKCQG.exe
  C:\Windows\System\SRWKCQG.exe
  2⤵
  PID:448
- C:\Windows\System\pKkmDMr.exe
  C:\Windows\System\pKkmDMr.exe
  2⤵
  PID:4636
- C:\Windows\System\ZhvYieF.exe
  C:\Windows\System\ZhvYieF.exe
  2⤵
  PID:1892
- C:\Windows\System\kwdVqSl.exe
  C:\Windows\System\kwdVqSl.exe
  2⤵
  PID:4756
- C:\Windows\System\jBGENSP.exe
  C:\Windows\System\jBGENSP.exe
  2⤵
  PID:4616
- C:\Windows\System\tVMNOdN.exe
  C:\Windows\System\tVMNOdN.exe
  2⤵
  PID:3040
- C:\Windows\System\hdAvtbc.exe
  C:\Windows\System\hdAvtbc.exe
  2⤵
  PID:3792
- C:\Windows\System\ZuLqMqY.exe
  C:\Windows\System\ZuLqMqY.exe
  2⤵
  PID:1544
- C:\Windows\System\kneqmqU.exe
  C:\Windows\System\kneqmqU.exe
  2⤵
  PID:1284
- C:\Windows\System\HmcMfvt.exe
  C:\Windows\System\HmcMfvt.exe
  2⤵
  PID:1188
- C:\Windows\System\zFVVTtv.exe
  C:\Windows\System\zFVVTtv.exe
  2⤵
  PID:3360
- C:\Windows\System\oXPHNpx.exe
  C:\Windows\System\oXPHNpx.exe
  2⤵
  PID:4936
- C:\Windows\System\GcGhuSn.exe
  C:\Windows\System\GcGhuSn.exe
  2⤵
  PID:4392
- C:\Windows\System\jDeUBTQ.exe
  C:\Windows\System\jDeUBTQ.exe
  2⤵
  PID:4352
- C:\Windows\System\hrcqPGh.exe
  C:\Windows\System\hrcqPGh.exe
  2⤵
  PID:1676
- C:\Windows\System\mnCeiJK.exe
  C:\Windows\System\mnCeiJK.exe
  2⤵
  PID:4496
- C:\Windows\System\cBYCZfY.exe
  C:\Windows\System\cBYCZfY.exe
  2⤵
  PID:1436
- C:\Windows\System\gPwTeXt.exe
  C:\Windows\System\gPwTeXt.exe
  2⤵
  PID:4808
- C:\Windows\System\mpvTKYD.exe
  C:\Windows\System\mpvTKYD.exe
  2⤵
  PID:5036
- C:\Windows\System\miWKwnw.exe
  C:\Windows\System\miWKwnw.exe
  2⤵
  PID:5020
- C:\Windows\System\VnWauxb.exe
  C:\Windows\System\VnWauxb.exe
  2⤵
  PID:5128
- C:\Windows\System\TDkpZJD.exe
  C:\Windows\System\TDkpZJD.exe
  2⤵
  PID:5144
- C:\Windows\System\LmiEetK.exe
  C:\Windows\System\LmiEetK.exe
  2⤵
  PID:5160
- C:\Windows\System\dhqDwDu.exe
  C:\Windows\System\dhqDwDu.exe
  2⤵
  PID:5188
- C:\Windows\System\MyVKeIr.exe
  C:\Windows\System\MyVKeIr.exe
  2⤵
  PID:5204
- C:\Windows\System\qcxUBKE.exe
  C:\Windows\System\qcxUBKE.exe
  2⤵
  PID:5220
- C:\Windows\System\nYrBNXX.exe
  C:\Windows\System\nYrBNXX.exe
  2⤵
  PID:5236
- C:\Windows\System\DCPkyRd.exe
  C:\Windows\System\DCPkyRd.exe
  2⤵
  PID:5252
- C:\Windows\System\jvQUIqL.exe
  C:\Windows\System\jvQUIqL.exe
  2⤵
  PID:5272
- C:\Windows\System\JFleJhc.exe
  C:\Windows\System\JFleJhc.exe
  2⤵
  PID:5292
- C:\Windows\System\LlClYIm.exe
  C:\Windows\System\LlClYIm.exe
  2⤵
  PID:5312
- C:\Windows\System\aJXFush.exe
  C:\Windows\System\aJXFush.exe
  2⤵
  PID:5328
- C:\Windows\System\lapMkNQ.exe
  C:\Windows\System\lapMkNQ.exe
  2⤵
  PID:5344
- C:\Windows\System\oYtdwhZ.exe
  C:\Windows\System\oYtdwhZ.exe
  2⤵
  PID:5360
- C:\Windows\System\roCFbQq.exe
  C:\Windows\System\roCFbQq.exe
  2⤵
  PID:5376
- C:\Windows\System\iTbJiVN.exe
  C:\Windows\System\iTbJiVN.exe
  2⤵
  PID:5392
- C:\Windows\System\QFdhNzH.exe
  C:\Windows\System\QFdhNzH.exe
  2⤵
  PID:5416
- C:\Windows\System\vIOxJbD.exe
  C:\Windows\System\vIOxJbD.exe
  2⤵
  PID:5440
- C:\Windows\System\EJYoWUV.exe
  C:\Windows\System\EJYoWUV.exe
  2⤵
  PID:5456
- C:\Windows\System\RLfLdKk.exe
  C:\Windows\System\RLfLdKk.exe
  2⤵
  PID:5472
- C:\Windows\System\lYLpGYw.exe
  C:\Windows\System\lYLpGYw.exe
  2⤵
  PID:5488
- C:\Windows\System\MLIIYoW.exe
  C:\Windows\System\MLIIYoW.exe
  2⤵
  PID:5504
- C:\Windows\System\xInXYzk.exe
  C:\Windows\System\xInXYzk.exe
  2⤵
  PID:5520
- C:\Windows\System\kBJqPqh.exe
  C:\Windows\System\kBJqPqh.exe
  2⤵
  PID:5536
- C:\Windows\System\jFRzfhX.exe
  C:\Windows\System\jFRzfhX.exe
  2⤵
  PID:5552
- C:\Windows\System\UsYMybz.exe
  C:\Windows\System\UsYMybz.exe
  2⤵
  PID:5568
- C:\Windows\System\bYgPlis.exe
  C:\Windows\System\bYgPlis.exe
  2⤵
  PID:5584
- C:\Windows\System\IkhqSXg.exe
  C:\Windows\System\IkhqSXg.exe
  2⤵
  PID:5600
- C:\Windows\System\bkENcat.exe
  C:\Windows\System\bkENcat.exe
  2⤵
  PID:5616
- C:\Windows\System\yJaNKbx.exe
  C:\Windows\System\yJaNKbx.exe
  2⤵
  PID:5632
- C:\Windows\System\jyNNGxs.exe
  C:\Windows\System\jyNNGxs.exe
  2⤵
  PID:5648
- C:\Windows\System\ZXeRtKj.exe
  C:\Windows\System\ZXeRtKj.exe
  2⤵
  PID:5664
- C:\Windows\System\XCEgPjI.exe
  C:\Windows\System\XCEgPjI.exe
  2⤵
  PID:5680
- C:\Windows\System\zOQnWHx.exe
  C:\Windows\System\zOQnWHx.exe
  2⤵
  PID:5696
- C:\Windows\System\DQUqBrE.exe
  C:\Windows\System\DQUqBrE.exe
  2⤵
  PID:5712
- C:\Windows\System\CFLvBCu.exe
  C:\Windows\System\CFLvBCu.exe
  2⤵
  PID:5728
- C:\Windows\System\yRvUhTT.exe
  C:\Windows\System\yRvUhTT.exe
  2⤵
  PID:5744
- C:\Windows\System\nzfZNQM.exe
  C:\Windows\System\nzfZNQM.exe
  2⤵
  PID:5760
- C:\Windows\System\hspRaao.exe
  C:\Windows\System\hspRaao.exe
  2⤵
  PID:5776
- C:\Windows\System\gapPhnr.exe
  C:\Windows\System\gapPhnr.exe
  2⤵
  PID:5792
- C:\Windows\System\ZnApCza.exe
  C:\Windows\System\ZnApCza.exe
  2⤵
  PID:5808
- C:\Windows\System\akwooKx.exe
  C:\Windows\System\akwooKx.exe
  2⤵
  PID:5824
- C:\Windows\System\ghOPNCk.exe
  C:\Windows\System\ghOPNCk.exe
  2⤵
  PID:5840
- C:\Windows\System\uJBeUgl.exe
  C:\Windows\System\uJBeUgl.exe
  2⤵
  PID:5856
- C:\Windows\System\PeQeDoW.exe
  C:\Windows\System\PeQeDoW.exe
  2⤵
  PID:5872
- C:\Windows\System\KfsTwJg.exe
  C:\Windows\System\KfsTwJg.exe
  2⤵
  PID:5888
- C:\Windows\System\YNUAMcN.exe
  C:\Windows\System\YNUAMcN.exe
  2⤵
  PID:5904
- C:\Windows\System\xAKwbku.exe
  C:\Windows\System\xAKwbku.exe
  2⤵
  PID:5920
- C:\Windows\System\WFsnRWU.exe
  C:\Windows\System\WFsnRWU.exe
  2⤵
  PID:5936
- C:\Windows\System\PhahZRC.exe
  C:\Windows\System\PhahZRC.exe
  2⤵
  PID:5952
- C:\Windows\System\mVVELMj.exe
  C:\Windows\System\mVVELMj.exe
  2⤵
  PID:5968
- C:\Windows\System\ZJlUVbw.exe
  C:\Windows\System\ZJlUVbw.exe
  2⤵
  PID:5988
- C:\Windows\System\UZmejfH.exe
  C:\Windows\System\UZmejfH.exe
  2⤵
  PID:6004
- C:\Windows\System\JxEMpGV.exe
  C:\Windows\System\JxEMpGV.exe
  2⤵
  PID:6020
- C:\Windows\System\LDlOuEv.exe
  C:\Windows\System\LDlOuEv.exe
  2⤵
  PID:6036
- C:\Windows\System\tilcVtp.exe
  C:\Windows\System\tilcVtp.exe
  2⤵
  PID:6052
- C:\Windows\System\rUidRES.exe
  C:\Windows\System\rUidRES.exe
  2⤵
  PID:6068
- C:\Windows\System\MRsFvJI.exe
  C:\Windows\System\MRsFvJI.exe
  2⤵
  PID:6084
- C:\Windows\System\YPSMPyL.exe
  C:\Windows\System\YPSMPyL.exe
  2⤵
  PID:6100
- C:\Windows\System\MCOUFJd.exe
  C:\Windows\System\MCOUFJd.exe
  2⤵
  PID:6116
- C:\Windows\System\QNFkJNn.exe
  C:\Windows\System\QNFkJNn.exe
  2⤵
  PID:6132
- C:\Windows\System\BqzPTHF.exe
  C:\Windows\System\BqzPTHF.exe
  2⤵
  PID:1896
- C:\Windows\System\lpkCIxu.exe
  C:\Windows\System\lpkCIxu.exe
  2⤵
  PID:3076
- C:\Windows\System\UTnIVgc.exe
  C:\Windows\System\UTnIVgc.exe
  2⤵
  PID:4432
- C:\Windows\System\fpeNqFw.exe
  C:\Windows\System\fpeNqFw.exe
  2⤵
  PID:5172
- C:\Windows\System\vmXbTEz.exe
  C:\Windows\System\vmXbTEz.exe
  2⤵
  PID:4404
- C:\Windows\System\gcuBZeZ.exe
  C:\Windows\System\gcuBZeZ.exe
  2⤵
  PID:5088
- C:\Windows\System\UlNEEzA.exe
  C:\Windows\System\UlNEEzA.exe
  2⤵
  PID:2032
- C:\Windows\System\WWyXydY.exe
  C:\Windows\System\WWyXydY.exe
  2⤵
  PID:572
- C:\Windows\System\FCtlwZI.exe
  C:\Windows\System\FCtlwZI.exe
  2⤵
  PID:1084
- C:\Windows\System\IrriZec.exe
  C:\Windows\System\IrriZec.exe
  2⤵
  PID:4152
- C:\Windows\System\LIobuOb.exe
  C:\Windows\System\LIobuOb.exe
  2⤵
  PID:5152
- C:\Windows\System\rTpfCTH.exe
  C:\Windows\System\rTpfCTH.exe
  2⤵
  PID:5248
- C:\Windows\System\RczaIeH.exe
  C:\Windows\System\RczaIeH.exe
  2⤵
  PID:3736
- C:\Windows\System\yoHTEJQ.exe
  C:\Windows\System\yoHTEJQ.exe
  2⤵
  PID:5356
- C:\Windows\System\yMXBOOe.exe
  C:\Windows\System\yMXBOOe.exe
  2⤵
  PID:5200
- C:\Windows\System\uLmCeqA.exe
  C:\Windows\System\uLmCeqA.exe
  2⤵
  PID:5264
- C:\Windows\System\mfJjDcW.exe
  C:\Windows\System\mfJjDcW.exe
  2⤵
  PID:5308
- C:\Windows\System\FWAoIOi.exe
  C:\Windows\System\FWAoIOi.exe
  2⤵
  PID:5372
- C:\Windows\System\hyCXNGX.exe
  C:\Windows\System\hyCXNGX.exe
  2⤵
  PID:5412
- C:\Windows\System\QbaOSpF.exe
  C:\Windows\System\QbaOSpF.exe
  2⤵
  PID:5484
- C:\Windows\System\gBiiURD.exe
  C:\Windows\System\gBiiURD.exe
  2⤵
  PID:5576
- C:\Windows\System\uiEPGPw.exe
  C:\Windows\System\uiEPGPw.exe
  2⤵
  PID:5424
- C:\Windows\System\RlXpmkq.exe
  C:\Windows\System\RlXpmkq.exe
  2⤵
  PID:5464
- C:\Windows\System\rtfcWQZ.exe
  C:\Windows\System\rtfcWQZ.exe
  2⤵
  PID:5500
- C:\Windows\System\BCekaLM.exe
  C:\Windows\System\BCekaLM.exe
  2⤵
  PID:5592
- C:\Windows\System\tGlxwkr.exe
  C:\Windows\System\tGlxwkr.exe
  2⤵
  PID:5656
- C:\Windows\System\ZAhUovc.exe
  C:\Windows\System\ZAhUovc.exe
  2⤵
  PID:5720
- C:\Windows\System\rQiSaoc.exe
  C:\Windows\System\rQiSaoc.exe
  2⤵
  PID:5612
- C:\Windows\System\jSPgndo.exe
  C:\Windows\System\jSPgndo.exe
  2⤵
  PID:5788
- C:\Windows\System\wDXthOl.exe
  C:\Windows\System\wDXthOl.exe
  2⤵
  PID:5704
- C:\Windows\System\KIAunCX.exe
  C:\Windows\System\KIAunCX.exe
  2⤵
  PID:5768
- C:\Windows\System\TRfYppX.exe
  C:\Windows\System\TRfYppX.exe
  2⤵
  PID:5820
- C:\Windows\System\MpMjBey.exe
  C:\Windows\System\MpMjBey.exe
  2⤵
  PID:5884
- C:\Windows\System\dhWSjZw.exe
  C:\Windows\System\dhWSjZw.exe
  2⤵
  PID:5948
- C:\Windows\System\lirpZTJ.exe
  C:\Windows\System\lirpZTJ.exe
  2⤵
  PID:6012
- C:\Windows\System\VRflsWx.exe
  C:\Windows\System\VRflsWx.exe
  2⤵
  PID:6048
- C:\Windows\System\bOSFxPc.exe
  C:\Windows\System\bOSFxPc.exe
  2⤵
  PID:3024
- C:\Windows\System\tXHNRzm.exe
  C:\Windows\System\tXHNRzm.exe
  2⤵
  PID:5832
- C:\Windows\System\bgswpya.exe
  C:\Windows\System\bgswpya.exe
  2⤵
  PID:5896
- C:\Windows\System\LstUEfO.exe
  C:\Windows\System\LstUEfO.exe
  2⤵
  PID:5960
- C:\Windows\System\IhsHIcy.exe
  C:\Windows\System\IhsHIcy.exe
  2⤵
  PID:6028
- C:\Windows\System\mQjvTvo.exe
  C:\Windows\System\mQjvTvo.exe
  2⤵
  PID:6096
- C:\Windows\System\UVEyNOl.exe
  C:\Windows\System\UVEyNOl.exe
  2⤵
  PID:6140
- C:\Windows\System\XmTzQaN.exe
  C:\Windows\System\XmTzQaN.exe
  2⤵
  PID:5168
- C:\Windows\System\lJyHhma.exe
  C:\Windows\System\lJyHhma.exe
  2⤵
  PID:5180
- C:\Windows\System\efxyaDF.exe
  C:\Windows\System\efxyaDF.exe
  2⤵
  PID:3472
- C:\Windows\System\ydspCxa.exe
  C:\Windows\System\ydspCxa.exe
  2⤵
  PID:808
- C:\Windows\System\IEXMucl.exe
  C:\Windows\System\IEXMucl.exe
  2⤵
  PID:5244
- C:\Windows\System\Zrfflym.exe
  C:\Windows\System\Zrfflym.exe
  2⤵
  PID:5124
- C:\Windows\System\QDGOfxr.exe
  C:\Windows\System\QDGOfxr.exe
  2⤵
  PID:4444
- C:\Windows\System\ShNyxFi.exe
  C:\Windows\System\ShNyxFi.exe
  2⤵
  PID:4356
- C:\Windows\System\WsASpju.exe
  C:\Windows\System\WsASpju.exe
  2⤵
  PID:5400
- C:\Windows\System\MmEzNpO.exe
  C:\Windows\System\MmEzNpO.exe
  2⤵
  PID:2600
- C:\Windows\System\oAwVlav.exe
  C:\Windows\System\oAwVlav.exe
  2⤵
  PID:5468
- C:\Windows\System\LvCmShI.exe
  C:\Windows\System\LvCmShI.exe
  2⤵
  PID:5692
- C:\Windows\System\ggmgBKS.exe
  C:\Windows\System\ggmgBKS.exe
  2⤵
  PID:1648
- C:\Windows\System\AIGcbpe.exe
  C:\Windows\System\AIGcbpe.exe
  2⤵
  PID:5232
- C:\Windows\System\AqlpqKa.exe
  C:\Windows\System\AqlpqKa.exe
  2⤵
  PID:5608
- C:\Windows\System\pyxiLPY.exe
  C:\Windows\System\pyxiLPY.exe
  2⤵
  PID:5624
- C:\Windows\System\aStgHUp.exe
  C:\Windows\System\aStgHUp.exe
  2⤵
  PID:5736
- C:\Windows\System\MVPpjWX.exe
  C:\Windows\System\MVPpjWX.exe
  2⤵
  PID:5800
- C:\Windows\System\cmiiPHO.exe
  C:\Windows\System\cmiiPHO.exe
  2⤵
  PID:5984
- C:\Windows\System\crgrQmI.exe
  C:\Windows\System\crgrQmI.exe
  2⤵
  PID:6080
- C:\Windows\System\UDisQTd.exe
  C:\Windows\System\UDisQTd.exe
  2⤵
  PID:6044
- C:\Windows\System\bYsgQlT.exe
  C:\Windows\System\bYsgQlT.exe
  2⤵
  PID:5996
- C:\Windows\System\RzBWIdw.exe
  C:\Windows\System\RzBWIdw.exe
  2⤵
  PID:6128
- C:\Windows\System\tMxUwDA.exe
  C:\Windows\System\tMxUwDA.exe
  2⤵
  PID:4896
- C:\Windows\System\CaxhBbp.exe
  C:\Windows\System\CaxhBbp.exe
  2⤵
  PID:5928
- C:\Windows\System\PXIKzBt.exe
  C:\Windows\System\PXIKzBt.exe
  2⤵
  PID:4532
- C:\Windows\System\KFgGuwE.exe
  C:\Windows\System\KFgGuwE.exe
  2⤵
  PID:5352
- C:\Windows\System\UrslUgq.exe
  C:\Windows\System\UrslUgq.exe
  2⤵
  PID:1228
- C:\Windows\System\gDURDix.exe
  C:\Windows\System\gDURDix.exe
  2⤵
  PID:5212
- C:\Windows\System\cwYKuSt.exe
  C:\Windows\System\cwYKuSt.exe
  2⤵
  PID:2812
- C:\Windows\System\JbPYvQf.exe
  C:\Windows\System\JbPYvQf.exe
  2⤵
  PID:5368
- C:\Windows\System\SjlHXmt.exe
  C:\Windows\System\SjlHXmt.exe
  2⤵
  PID:2360
- C:\Windows\System\ZiSdjaw.exe
  C:\Windows\System\ZiSdjaw.exe
  2⤵
  PID:5916
- C:\Windows\System\ZsFEoyK.exe
  C:\Windows\System\ZsFEoyK.exe
  2⤵
  PID:5804
- C:\Windows\System\XOvHdDs.exe
  C:\Windows\System\XOvHdDs.exe
  2⤵
  PID:5140
- C:\Windows\System\nRluHFe.exe
  C:\Windows\System\nRluHFe.exe
  2⤵
  PID:5672
- C:\Windows\System\yyrFmwK.exe
  C:\Windows\System\yyrFmwK.exe
  2⤵
  PID:2064
- C:\Windows\System\aQPyisJ.exe
  C:\Windows\System\aQPyisJ.exe
  2⤵
  PID:2356
- C:\Windows\System\aCWpWuS.exe
  C:\Windows\System\aCWpWuS.exe
  2⤵
  PID:4516
- C:\Windows\System\UKYQPLM.exe
  C:\Windows\System\UKYQPLM.exe
  2⤵
  PID:2252
- C:\Windows\System\gsFwctP.exe
  C:\Windows\System\gsFwctP.exe
  2⤵
  PID:5480
- C:\Windows\System\lHjJNiC.exe
  C:\Windows\System\lHjJNiC.exe
  2⤵
  PID:6092
- C:\Windows\System\tzKKaUw.exe
  C:\Windows\System\tzKKaUw.exe
  2⤵
  PID:4660
- C:\Windows\System\qHRHSeZ.exe
  C:\Windows\System\qHRHSeZ.exe
  2⤵
  PID:2036
- C:\Windows\System\xTAiIjx.exe
  C:\Windows\System\xTAiIjx.exe
  2⤵
  PID:2072
- C:\Windows\System\zEaFUPz.exe
  C:\Windows\System\zEaFUPz.exe
  2⤵
  PID:5216
- C:\Windows\System\pyMphAB.exe
  C:\Windows\System\pyMphAB.exe
  2⤵
  PID:1420
- C:\Windows\System\FwPYvPe.exe
  C:\Windows\System\FwPYvPe.exe
  2⤵
  PID:2652
- C:\Windows\System\xOCqVwF.exe
  C:\Windows\System\xOCqVwF.exe
  2⤵
  PID:2940
- C:\Windows\System\FIGDOVE.exe
  C:\Windows\System\FIGDOVE.exe
  2⤵
  PID:6152
- C:\Windows\System\LGBTwri.exe
  C:\Windows\System\LGBTwri.exe
  2⤵
  PID:6168
- C:\Windows\System\DTxrHBj.exe
  C:\Windows\System\DTxrHBj.exe
  2⤵
  PID:6184
- C:\Windows\System\WjLhkMQ.exe
  C:\Windows\System\WjLhkMQ.exe
  2⤵
  PID:6200
- C:\Windows\System\PVtOYug.exe
  C:\Windows\System\PVtOYug.exe
  2⤵
  PID:6216
- C:\Windows\System\KhfCCpf.exe
  C:\Windows\System\KhfCCpf.exe
  2⤵
  PID:6232
- C:\Windows\System\vmZgbKF.exe
  C:\Windows\System\vmZgbKF.exe
  2⤵
  PID:6248
- C:\Windows\System\CsFjVez.exe
  C:\Windows\System\CsFjVez.exe
  2⤵
  PID:6264
- C:\Windows\System\XYhqheS.exe
  C:\Windows\System\XYhqheS.exe
  2⤵
  PID:6280
- C:\Windows\System\UygoxPt.exe
  C:\Windows\System\UygoxPt.exe
  2⤵
  PID:6296
- C:\Windows\System\TCgpNkf.exe
  C:\Windows\System\TCgpNkf.exe
  2⤵
  PID:6312
- C:\Windows\System\yIDyrXs.exe
  C:\Windows\System\yIDyrXs.exe
  2⤵
  PID:6328
- C:\Windows\System\umYgeVZ.exe
  C:\Windows\System\umYgeVZ.exe
  2⤵
  PID:6344
- C:\Windows\System\bNxrSuD.exe
  C:\Windows\System\bNxrSuD.exe
  2⤵
  PID:6360
- C:\Windows\System\fEEQTgu.exe
  C:\Windows\System\fEEQTgu.exe
  2⤵
  PID:6376
- C:\Windows\System\EdlGhZA.exe
  C:\Windows\System\EdlGhZA.exe
  2⤵
  PID:6392
- C:\Windows\System\HoAUEyG.exe
  C:\Windows\System\HoAUEyG.exe
  2⤵
  PID:6408
- C:\Windows\System\REzlSCX.exe
  C:\Windows\System\REzlSCX.exe
  2⤵
  PID:6424
- C:\Windows\System\AMKQwvn.exe
  C:\Windows\System\AMKQwvn.exe
  2⤵
  PID:6440
- C:\Windows\System\UwfkGyj.exe
  C:\Windows\System\UwfkGyj.exe
  2⤵
  PID:6456
- C:\Windows\System\lGUceVp.exe
  C:\Windows\System\lGUceVp.exe
  2⤵
  PID:6472
- C:\Windows\System\DNAeopf.exe
  C:\Windows\System\DNAeopf.exe
  2⤵
  PID:6488
- C:\Windows\System\jwkJNZo.exe
  C:\Windows\System\jwkJNZo.exe
  2⤵
  PID:6504
- C:\Windows\System\YqWqAtp.exe
  C:\Windows\System\YqWqAtp.exe
  2⤵
  PID:6520
- C:\Windows\System\YdHwbnw.exe
  C:\Windows\System\YdHwbnw.exe
  2⤵
  PID:6536
- C:\Windows\System\RnGDmRQ.exe
  C:\Windows\System\RnGDmRQ.exe
  2⤵
  PID:6552
- C:\Windows\System\nAmkbUp.exe
  C:\Windows\System\nAmkbUp.exe
  2⤵
  PID:6568
- C:\Windows\System\wkHFpVj.exe
  C:\Windows\System\wkHFpVj.exe
  2⤵
  PID:6584
- C:\Windows\System\JKUZcZv.exe
  C:\Windows\System\JKUZcZv.exe
  2⤵
  PID:6600
- C:\Windows\System\fqCPYYD.exe
  C:\Windows\System\fqCPYYD.exe
  2⤵
  PID:6616
- C:\Windows\System\ZThHfpJ.exe
  C:\Windows\System\ZThHfpJ.exe
  2⤵
  PID:6632
- C:\Windows\System\DvKwudc.exe
  C:\Windows\System\DvKwudc.exe
  2⤵
  PID:6648
- C:\Windows\System\sqznQeE.exe
  C:\Windows\System\sqznQeE.exe
  2⤵
  PID:6664
- C:\Windows\System\yoSUyFy.exe
  C:\Windows\System\yoSUyFy.exe
  2⤵
  PID:6680
- C:\Windows\System\NAwKCAZ.exe
  C:\Windows\System\NAwKCAZ.exe
  2⤵
  PID:6696
- C:\Windows\System\bhYCnXZ.exe
  C:\Windows\System\bhYCnXZ.exe
  2⤵
  PID:6712
- C:\Windows\System\zsMhAsR.exe
  C:\Windows\System\zsMhAsR.exe
  2⤵
  PID:6728
- C:\Windows\System\kVCFxkc.exe
  C:\Windows\System\kVCFxkc.exe
  2⤵
  PID:6744
- C:\Windows\System\hjLicSS.exe
  C:\Windows\System\hjLicSS.exe
  2⤵
  PID:6760
- C:\Windows\System\fiKoklT.exe
  C:\Windows\System\fiKoklT.exe
  2⤵
  PID:6776
- C:\Windows\System\CJRAMdy.exe
  C:\Windows\System\CJRAMdy.exe
  2⤵
  PID:6792
- C:\Windows\System\ChJsgUb.exe
  C:\Windows\System\ChJsgUb.exe
  2⤵
  PID:6808
- C:\Windows\System\nBlifzd.exe
  C:\Windows\System\nBlifzd.exe
  2⤵
  PID:6824
- C:\Windows\System\eaWaRJP.exe
  C:\Windows\System\eaWaRJP.exe
  2⤵
  PID:6840
- C:\Windows\System\CotMdvS.exe
  C:\Windows\System\CotMdvS.exe
  2⤵
  PID:6856
- C:\Windows\System\GpEhvlh.exe
  C:\Windows\System\GpEhvlh.exe
  2⤵
  PID:6872
- C:\Windows\System\tXPdmqh.exe
  C:\Windows\System\tXPdmqh.exe
  2⤵
  PID:6888
- C:\Windows\System\EMdgdKm.exe
  C:\Windows\System\EMdgdKm.exe
  2⤵
  PID:6904
- C:\Windows\System\pNbIORv.exe
  C:\Windows\System\pNbIORv.exe
  2⤵
  PID:6920
- C:\Windows\System\VzuSVyz.exe
  C:\Windows\System\VzuSVyz.exe
  2⤵
  PID:6936
- C:\Windows\System\FpHLLCU.exe
  C:\Windows\System\FpHLLCU.exe
  2⤵
  PID:6952
- C:\Windows\System\WCmKHML.exe
  C:\Windows\System\WCmKHML.exe
  2⤵
  PID:6968
- C:\Windows\System\ftjRJFc.exe
  C:\Windows\System\ftjRJFc.exe
  2⤵
  PID:6984
- C:\Windows\System\bLZYqqo.exe
  C:\Windows\System\bLZYqqo.exe
  2⤵
  PID:7000
- C:\Windows\System\LHQqKSE.exe
  C:\Windows\System\LHQqKSE.exe
  2⤵
  PID:7016
- C:\Windows\System\HfblZuq.exe
  C:\Windows\System\HfblZuq.exe
  2⤵
  PID:7032
- C:\Windows\System\GCICwqw.exe
  C:\Windows\System\GCICwqw.exe
  2⤵
  PID:7048
- C:\Windows\System\fzgKtex.exe
  C:\Windows\System\fzgKtex.exe
  2⤵
  PID:7064
- C:\Windows\System\onGVnGY.exe
  C:\Windows\System\onGVnGY.exe
  2⤵
  PID:7080
- C:\Windows\System\ixNNPdk.exe
  C:\Windows\System\ixNNPdk.exe
  2⤵
  PID:7096
- C:\Windows\System\LhUFZku.exe
  C:\Windows\System\LhUFZku.exe
  2⤵
  PID:7112
- C:\Windows\System\pnnfYbN.exe
  C:\Windows\System\pnnfYbN.exe
  2⤵
  PID:7128
- C:\Windows\System\YehOzKv.exe
  C:\Windows\System\YehOzKv.exe
  2⤵
  PID:7144
- C:\Windows\System\wTReftn.exe
  C:\Windows\System\wTReftn.exe
  2⤵
  PID:7160
- C:\Windows\System\KXGsyFL.exe
  C:\Windows\System\KXGsyFL.exe
  2⤵
  PID:6176
- C:\Windows\System\kghRHOc.exe
  C:\Windows\System\kghRHOc.exe
  2⤵
  PID:6212
- C:\Windows\System\JxtwDSE.exe
  C:\Windows\System\JxtwDSE.exe
  2⤵
  PID:6276
- C:\Windows\System\xincNac.exe
  C:\Windows\System\xincNac.exe
  2⤵
  PID:6032
- C:\Windows\System\YfksiDi.exe
  C:\Windows\System\YfksiDi.exe
  2⤵
  PID:6224
- C:\Windows\System\OvtcWzx.exe
  C:\Windows\System\OvtcWzx.exe
  2⤵
  PID:6160
- C:\Windows\System\KLTFKMV.exe
  C:\Windows\System\KLTFKMV.exe
  2⤵
  PID:6340
- C:\Windows\System\gJGAqfd.exe
  C:\Windows\System\gJGAqfd.exe
  2⤵
  PID:6260
- C:\Windows\System\eakFrIa.exe
  C:\Windows\System\eakFrIa.exe
  2⤵
  PID:6356
- C:\Windows\System\UEkcEhh.exe
  C:\Windows\System\UEkcEhh.exe
  2⤵
  PID:908
- C:\Windows\System\AYHisvg.exe
  C:\Windows\System\AYHisvg.exe
  2⤵
  PID:6464
- C:\Windows\System\GJBedbk.exe
  C:\Windows\System\GJBedbk.exe
  2⤵
  PID:6420
- C:\Windows\System\SqGREoh.exe
  C:\Windows\System\SqGREoh.exe
  2⤵
  PID:6560
- C:\Windows\System\nbYMSlc.exe
  C:\Windows\System\nbYMSlc.exe
  2⤵
  PID:6448
- C:\Windows\System\NBgXHVJ.exe
  C:\Windows\System\NBgXHVJ.exe
  2⤵
  PID:6596
- C:\Windows\System\intxuGg.exe
  C:\Windows\System\intxuGg.exe
  2⤵
  PID:6660
- C:\Windows\System\IArMFNl.exe
  C:\Windows\System\IArMFNl.exe
  2⤵
  PID:6484
- C:\Windows\System\KxLsCNh.exe
  C:\Windows\System\KxLsCNh.exe
  2⤵
  PID:6548
- C:\Windows\System\LqPjeWh.exe
  C:\Windows\System\LqPjeWh.exe
  2⤵
  PID:6656
- C:\Windows\System\QwvjIkD.exe
  C:\Windows\System\QwvjIkD.exe
  2⤵
  PID:6724
- C:\Windows\System\LkARqgl.exe
  C:\Windows\System\LkARqgl.exe
  2⤵
  PID:6704
- C:\Windows\System\tIPIbtj.exe
  C:\Windows\System\tIPIbtj.exe
  2⤵
  PID:6788
- C:\Windows\System\nnkDzgl.exe
  C:\Windows\System\nnkDzgl.exe
  2⤵
  PID:6848
- C:\Windows\System\jUIZaIU.exe
  C:\Windows\System\jUIZaIU.exe
  2⤵
  PID:2820
- C:\Windows\System\FdqWLJB.exe
  C:\Windows\System\FdqWLJB.exe
  2⤵
  PID:6772
- C:\Windows\System\nxrcrdl.exe
  C:\Windows\System\nxrcrdl.exe
  2⤵
  PID:6864
- C:\Windows\System\tcwqDsy.exe
  C:\Windows\System\tcwqDsy.exe
  2⤵
  PID:6912
- C:\Windows\System\IKVrzvT.exe
  C:\Windows\System\IKVrzvT.exe
  2⤵
  PID:6948
- C:\Windows\System\YXEVJfo.exe
  C:\Windows\System\YXEVJfo.exe
  2⤵
  PID:6932
- C:\Windows\System\fvzyEIL.exe
  C:\Windows\System\fvzyEIL.exe
  2⤵
  PID:6992
- C:\Windows\System\IdRqwGl.exe
  C:\Windows\System\IdRqwGl.exe
  2⤵
  PID:7012
- C:\Windows\System\NkeAoCE.exe
  C:\Windows\System\NkeAoCE.exe
  2⤵
  PID:7056
- C:\Windows\System\jAjzHCE.exe
  C:\Windows\System\jAjzHCE.exe
  2⤵
  PID:7108
- C:\Windows\System\hZruJoS.exe
  C:\Windows\System\hZruJoS.exe
  2⤵
  PID:7088
- C:\Windows\System\AIrRwzN.exe
  C:\Windows\System\AIrRwzN.exe
  2⤵
  PID:5196
- C:\Windows\System\NJnypKM.exe
  C:\Windows\System\NJnypKM.exe
  2⤵
  PID:6288
- C:\Windows\System\RoPlgYz.exe
  C:\Windows\System\RoPlgYz.exe
  2⤵
  PID:6336
- C:\Windows\System\utxSMeP.exe
  C:\Windows\System\utxSMeP.exe
  2⤵
  PID:6324
- C:\Windows\System\ZDSirgi.exe
  C:\Windows\System\ZDSirgi.exe
  2⤵
  PID:6564
- C:\Windows\System\SJmQTVt.exe
  C:\Windows\System\SJmQTVt.exe
  2⤵
  PID:924
- C:\Windows\System\mIKMLJm.exe
  C:\Windows\System\mIKMLJm.exe
  2⤵
  PID:6496
- C:\Windows\System\flwJhYf.exe
  C:\Windows\System\flwJhYf.exe
  2⤵
  PID:6480
- C:\Windows\System\OmprimF.exe
  C:\Windows\System\OmprimF.exe
  2⤵
  PID:2576
- C:\Windows\System\LpBVeIR.exe
  C:\Windows\System\LpBVeIR.exe
  2⤵
  PID:6688
- C:\Windows\System\xwshmuo.exe
  C:\Windows\System\xwshmuo.exe
  2⤵
  PID:1740
- C:\Windows\System\KkCoEmZ.exe
  C:\Windows\System\KkCoEmZ.exe
  2⤵
  PID:6768
- C:\Windows\System\DtainFf.exe
  C:\Windows\System\DtainFf.exe
  2⤵
  PID:6976
- C:\Windows\System\RdSPpXc.exe
  C:\Windows\System\RdSPpXc.exe
  2⤵
  PID:7028
- C:\Windows\System\sLbrpIn.exe
  C:\Windows\System\sLbrpIn.exe
  2⤵
  PID:6608
- C:\Windows\System\FzUxVTw.exe
  C:\Windows\System\FzUxVTw.exe
  2⤵
  PID:6756
- C:\Windows\System\GBncrru.exe
  C:\Windows\System\GBncrru.exe
  2⤵
  PID:7072
- C:\Windows\System\ZHEqWjm.exe
  C:\Windows\System\ZHEqWjm.exe
  2⤵
  PID:6928
- C:\Windows\System\GAPzzbk.exe
  C:\Windows\System\GAPzzbk.exe
  2⤵
  PID:7060
- C:\Windows\System\TxAhsdk.exe
  C:\Windows\System\TxAhsdk.exe
  2⤵
  PID:6532
- C:\Windows\System\JFwTixW.exe
  C:\Windows\System\JFwTixW.exe
  2⤵
  PID:5432
- C:\Windows\System\XCwfpEu.exe
  C:\Windows\System\XCwfpEu.exe
  2⤵
  PID:6884
- C:\Windows\System\KWFiUBk.exe
  C:\Windows\System\KWFiUBk.exe
  2⤵
  PID:6964
- C:\Windows\System\NzkhkEO.exe
  C:\Windows\System\NzkhkEO.exe
  2⤵
  PID:7156
- C:\Windows\System\NvNDLrk.exe
  C:\Windows\System\NvNDLrk.exe
  2⤵
  PID:7180
- C:\Windows\System\MdnDzDp.exe
  C:\Windows\System\MdnDzDp.exe
  2⤵
  PID:7196
- C:\Windows\System\QaCemiG.exe
  C:\Windows\System\QaCemiG.exe
  2⤵
  PID:7212
- C:\Windows\System\cEXfsVV.exe
  C:\Windows\System\cEXfsVV.exe
  2⤵
  PID:7228
- C:\Windows\System\YEMSFUK.exe
  C:\Windows\System\YEMSFUK.exe
  2⤵
  PID:7244
- C:\Windows\System\xzSiEoN.exe
  C:\Windows\System\xzSiEoN.exe
  2⤵
  PID:7260
- C:\Windows\System\kATbsMI.exe
  C:\Windows\System\kATbsMI.exe
  2⤵
  PID:7276
- C:\Windows\System\CkUbOSj.exe
  C:\Windows\System\CkUbOSj.exe
  2⤵
  PID:7292
- C:\Windows\System\tLwNLbl.exe
  C:\Windows\System\tLwNLbl.exe
  2⤵
  PID:7308
- C:\Windows\System\HqQhDvW.exe
  C:\Windows\System\HqQhDvW.exe
  2⤵
  PID:7324
- C:\Windows\System\utuLwOR.exe
  C:\Windows\System\utuLwOR.exe
  2⤵
  PID:7340
- C:\Windows\System\XtAvAhR.exe
  C:\Windows\System\XtAvAhR.exe
  2⤵
  PID:7356
- C:\Windows\System\QmKcHeO.exe
  C:\Windows\System\QmKcHeO.exe
  2⤵
  PID:7372
- C:\Windows\System\rOZmGGQ.exe
  C:\Windows\System\rOZmGGQ.exe
  2⤵
  PID:7388
- C:\Windows\System\hegKrxx.exe
  C:\Windows\System\hegKrxx.exe
  2⤵
  PID:7404
- C:\Windows\System\ipXvrYy.exe
  C:\Windows\System\ipXvrYy.exe
  2⤵
  PID:7420
- C:\Windows\System\jUgjbnO.exe
  C:\Windows\System\jUgjbnO.exe
  2⤵
  PID:7436
- C:\Windows\System\hPIcQlH.exe
  C:\Windows\System\hPIcQlH.exe
  2⤵
  PID:7452
- C:\Windows\System\QxTnOfJ.exe
  C:\Windows\System\QxTnOfJ.exe
  2⤵
  PID:7472
- C:\Windows\System\riEwUjA.exe
  C:\Windows\System\riEwUjA.exe
  2⤵
  PID:7488
- C:\Windows\System\zTdVFpP.exe
  C:\Windows\System\zTdVFpP.exe
  2⤵
  PID:7504
- C:\Windows\System\lcsITDl.exe
  C:\Windows\System\lcsITDl.exe
  2⤵
  PID:7520
- C:\Windows\System\hhXtTOW.exe
  C:\Windows\System\hhXtTOW.exe
  2⤵
  PID:7536
- C:\Windows\System\loVEZSU.exe
  C:\Windows\System\loVEZSU.exe
  2⤵
  PID:7552
- C:\Windows\System\cjeiMST.exe
  C:\Windows\System\cjeiMST.exe
  2⤵
  PID:7568
- C:\Windows\System\PKokcpK.exe
  C:\Windows\System\PKokcpK.exe
  2⤵
  PID:7584
- C:\Windows\System\jaDlKhB.exe
  C:\Windows\System\jaDlKhB.exe
  2⤵
  PID:7600
- C:\Windows\System\MZvUzvZ.exe
  C:\Windows\System\MZvUzvZ.exe
  2⤵
  PID:7616
- C:\Windows\System\TIgKiCw.exe
  C:\Windows\System\TIgKiCw.exe
  2⤵
  PID:7632
- C:\Windows\System\wogBhZQ.exe
  C:\Windows\System\wogBhZQ.exe
  2⤵
  PID:7648
- C:\Windows\System\gdSyAmR.exe
  C:\Windows\System\gdSyAmR.exe
  2⤵
  PID:7664
- C:\Windows\System\OdGywbC.exe
  C:\Windows\System\OdGywbC.exe
  2⤵
  PID:7680
- C:\Windows\System\gLlUyKA.exe
  C:\Windows\System\gLlUyKA.exe
  2⤵
  PID:7696
- C:\Windows\System\fgjsLIJ.exe
  C:\Windows\System\fgjsLIJ.exe
  2⤵
  PID:7712
- C:\Windows\System\AHKSqab.exe
  C:\Windows\System\AHKSqab.exe
  2⤵
  PID:7728
- C:\Windows\System\yStvxAu.exe
  C:\Windows\System\yStvxAu.exe
  2⤵
  PID:7744
- C:\Windows\System\XQOUzCA.exe
  C:\Windows\System\XQOUzCA.exe
  2⤵
  PID:7760
- C:\Windows\System\pjFIdJh.exe
  C:\Windows\System\pjFIdJh.exe
  2⤵
  PID:7776
- C:\Windows\System\bLUtowz.exe
  C:\Windows\System\bLUtowz.exe
  2⤵
  PID:7792
- C:\Windows\System\aVAcPkX.exe
  C:\Windows\System\aVAcPkX.exe
  2⤵
  PID:7808
- C:\Windows\System\EDBYNfj.exe
  C:\Windows\System\EDBYNfj.exe
  2⤵
  PID:7824
- C:\Windows\System\HmWALtt.exe
  C:\Windows\System\HmWALtt.exe
  2⤵
  PID:7840
- C:\Windows\System\IUoCAxy.exe
  C:\Windows\System\IUoCAxy.exe
  2⤵
  PID:7856
- C:\Windows\System\ESTZhMw.exe
  C:\Windows\System\ESTZhMw.exe
  2⤵
  PID:7872
- C:\Windows\System\VkFoqlB.exe
  C:\Windows\System\VkFoqlB.exe
  2⤵
  PID:7896
- C:\Windows\System\nktThyI.exe
  C:\Windows\System\nktThyI.exe
  2⤵
  PID:7912
- C:\Windows\System\YwkKYUs.exe
  C:\Windows\System\YwkKYUs.exe
  2⤵
  PID:7940
- C:\Windows\System\yPKLVWc.exe
  C:\Windows\System\yPKLVWc.exe
  2⤵
  PID:7956
- C:\Windows\System\sevBlbZ.exe
  C:\Windows\System\sevBlbZ.exe
  2⤵
  PID:7972
- C:\Windows\System\oqkLsKB.exe
  C:\Windows\System\oqkLsKB.exe
  2⤵
  PID:7988
- C:\Windows\System\dqSLIOf.exe
  C:\Windows\System\dqSLIOf.exe
  2⤵
  PID:8004
- C:\Windows\System\GDshiRA.exe
  C:\Windows\System\GDshiRA.exe
  2⤵
  PID:8020
- C:\Windows\System\tbJtxyd.exe
  C:\Windows\System\tbJtxyd.exe
  2⤵
  PID:8040
- C:\Windows\System\nqyeqpP.exe
  C:\Windows\System\nqyeqpP.exe
  2⤵
  PID:6820
- C:\Windows\System\fbzfSxV.exe
  C:\Windows\System\fbzfSxV.exe
  2⤵
  PID:6836
- C:\Windows\System\GygcoQt.exe
  C:\Windows\System\GygcoQt.exe
  2⤵
  PID:7192
- C:\Windows\System\cMNBeGY.exe
  C:\Windows\System\cMNBeGY.exe
  2⤵
  PID:7468
- C:\Windows\System\ENzMKys.exe
  C:\Windows\System\ENzMKys.exe
  2⤵
  PID:7352
- C:\Windows\System\TzIeJKM.exe
  C:\Windows\System\TzIeJKM.exe
  2⤵
  PID:7448
- C:\Windows\System\TosxjTo.exe
  C:\Windows\System\TosxjTo.exe
  2⤵
  PID:7624
- C:\Windows\System\PxgyQXv.exe
  C:\Windows\System\PxgyQXv.exe
  2⤵
  PID:7544
- C:\Windows\System\tNDlpHi.exe
  C:\Windows\System\tNDlpHi.exe
  2⤵
  PID:7580
- C:\Windows\System\RrIvWgL.exe
  C:\Windows\System\RrIvWgL.exe
  2⤵
  PID:7752
- C:\Windows\System\OVCJrgA.exe
  C:\Windows\System\OVCJrgA.exe
  2⤵
  PID:7708
- C:\Windows\System\eaXCWtQ.exe
  C:\Windows\System\eaXCWtQ.exe
  2⤵
  PID:7740
- C:\Windows\System\BuWmCzV.exe
  C:\Windows\System\BuWmCzV.exe
  2⤵
  PID:7784
- C:\Windows\System\HpiGOVj.exe
  C:\Windows\System\HpiGOVj.exe
  2⤵
  PID:7816
- C:\Windows\System\jIfKaKG.exe
  C:\Windows\System\jIfKaKG.exe
  2⤵
  PID:7888
- C:\Windows\System\zQHAFCI.exe
  C:\Windows\System\zQHAFCI.exe
  2⤵
  PID:7904
- C:\Windows\System\kKOGOvA.exe
  C:\Windows\System\kKOGOvA.exe
  2⤵
  PID:7964
- C:\Windows\System\ciowzSA.exe
  C:\Windows\System\ciowzSA.exe
  2⤵
  PID:7320
- C:\Windows\System\OQGycCm.exe
  C:\Windows\System\OQGycCm.exe
  2⤵
  PID:7884
- C:\Windows\System\mLJKqeL.exe
  C:\Windows\System\mLJKqeL.exe
  2⤵
  PID:7868
- C:\Windows\System\BYZMDAr.exe
  C:\Windows\System\BYZMDAr.exe
  2⤵
  PID:7996
- C:\Windows\System\ahauSiY.exe
  C:\Windows\System\ahauSiY.exe
  2⤵
  PID:1428
- C:\Windows\System\DEvlryA.exe
  C:\Windows\System\DEvlryA.exe
  2⤵
  PID:8012
- C:\Windows\System\ZdqKVSb.exe
  C:\Windows\System\ZdqKVSb.exe
  2⤵
  PID:8064
- C:\Windows\System\EejMzNr.exe
  C:\Windows\System\EejMzNr.exe
  2⤵
  PID:8096
- C:\Windows\System\wuUJNpP.exe
  C:\Windows\System\wuUJNpP.exe
  2⤵
  PID:8184
- C:\Windows\System\qFMHlUr.exe
  C:\Windows\System\qFMHlUr.exe
  2⤵
  PID:8172
- C:\Windows\System\rsToVtd.exe
  C:\Windows\System\rsToVtd.exe
  2⤵
  PID:8152
- C:\Windows\System\QOEBJas.exe
  C:\Windows\System\QOEBJas.exe
  2⤵
  PID:7204
- C:\Windows\System\MrrNHge.exe
  C:\Windows\System\MrrNHge.exe
  2⤵
  PID:7172
- C:\Windows\System\LXRyvYK.exe
  C:\Windows\System\LXRyvYK.exe
  2⤵
  PID:8140
- C:\Windows\System\JSupUAE.exe
  C:\Windows\System\JSupUAE.exe
  2⤵
  PID:8132
- C:\Windows\System\SAFbLCC.exe
  C:\Windows\System\SAFbLCC.exe
  2⤵
  PID:8116
- C:\Windows\System\uvjdbHp.exe
  C:\Windows\System\uvjdbHp.exe
  2⤵
  PID:7268
- C:\Windows\System\dLXHpkP.exe
  C:\Windows\System\dLXHpkP.exe
  2⤵
  PID:7336
- C:\Windows\System\fLQdVbq.exe
  C:\Windows\System\fLQdVbq.exe
  2⤵
  PID:7400
- C:\Windows\System\mMOqNNv.exe
  C:\Windows\System\mMOqNNv.exe
  2⤵
  PID:7464
- C:\Windows\System\sWUmqvN.exe
  C:\Windows\System\sWUmqvN.exe
  2⤵
  PID:6736
- C:\Windows\System\qHPzpRh.exe
  C:\Windows\System\qHPzpRh.exe
  2⤵
  PID:6244
- C:\Windows\System\naZckIv.exe
  C:\Windows\System\naZckIv.exe
  2⤵
  PID:6228
- C:\Windows\System\zouhLrZ.exe
  C:\Windows\System\zouhLrZ.exe
  2⤵
  PID:6164
- C:\Windows\System\ovTVXmH.exe
  C:\Windows\System\ovTVXmH.exe
  2⤵
  PID:7496
- C:\Windows\System\IdIPNNc.exe
  C:\Windows\System\IdIPNNc.exe
  2⤵
  PID:7416
- C:\Windows\System\ZKMnWMf.exe
  C:\Windows\System\ZKMnWMf.exe
  2⤵
  PID:7564
- C:\Windows\System\trSjMUq.exe
  C:\Windows\System\trSjMUq.exe
  2⤵
  PID:7692
- C:\Windows\System\iqMTaOO.exe
  C:\Windows\System\iqMTaOO.exe
  2⤵
  PID:7736
- C:\Windows\System\Etkzkvr.exe
  C:\Windows\System\Etkzkvr.exe
  2⤵
  PID:2676
- C:\Windows\System\WosrHxZ.exe
  C:\Windows\System\WosrHxZ.exe
  2⤵
  PID:2528
- C:\Windows\System\DKGwyNe.exe
  C:\Windows\System\DKGwyNe.exe
  2⤵
  PID:7832
- C:\Windows\System\lgiVGSk.exe
  C:\Windows\System\lgiVGSk.exe
  2⤵
  PID:8048
- C:\Windows\System\JVzHlNB.exe
  C:\Windows\System\JVzHlNB.exe
  2⤵
  PID:8088
- C:\Windows\System\qpyLaxR.exe
  C:\Windows\System\qpyLaxR.exe
  2⤵
  PID:8108
- C:\Windows\System\RIpcMHB.exe
  C:\Windows\System\RIpcMHB.exe
  2⤵
  PID:8164
- C:\Windows\System\ZOgTwTu.exe
  C:\Windows\System\ZOgTwTu.exe
  2⤵
  PID:8028
- C:\Windows\System\CUDWjQB.exe
  C:\Windows\System\CUDWjQB.exe
  2⤵
  PID:8188
- C:\Windows\System\BOFREdD.exe
  C:\Windows\System\BOFREdD.exe
  2⤵
  PID:8124
- C:\Windows\System\hhCHHnM.exe
  C:\Windows\System\hhCHHnM.exe
  2⤵
  PID:7396
- C:\Windows\System\nNbuyKl.exe
  C:\Windows\System\nNbuyKl.exe
  2⤵
  PID:7188
- C:\Windows\System\XdDtiMq.exe
  C:\Windows\System\XdDtiMq.exe
  2⤵
  PID:7252
- C:\Windows\System\zpsubxO.exe
  C:\Windows\System\zpsubxO.exe
  2⤵
  PID:6208
- C:\Windows\System\xgsKbjQ.exe
  C:\Windows\System\xgsKbjQ.exe
  2⤵
  PID:7560
- C:\Windows\System\vgvpNfC.exe
  C:\Windows\System\vgvpNfC.exe
  2⤵
  PID:5980
- C:\Windows\System\yYLYzwm.exe
  C:\Windows\System\yYLYzwm.exe
  2⤵
  PID:8148
- C:\Windows\System\XntyRrN.exe
  C:\Windows\System\XntyRrN.exe
  2⤵
  PID:8072
- C:\Windows\System\rFxlSFv.exe
  C:\Windows\System\rFxlSFv.exe
  2⤵
  PID:1736
- C:\Windows\System\mATWduW.exe
  C:\Windows\System\mATWduW.exe
  2⤵
  PID:8208
- C:\Windows\System\NwmcXDz.exe
  C:\Windows\System\NwmcXDz.exe
  2⤵
  PID:8224
- C:\Windows\System\PFeqhFw.exe
  C:\Windows\System\PFeqhFw.exe
  2⤵
  PID:8240
- C:\Windows\System\vgTocjd.exe
  C:\Windows\System\vgTocjd.exe
  2⤵
  PID:8260
- C:\Windows\System\BNBBuLF.exe
  C:\Windows\System\BNBBuLF.exe
  2⤵
  PID:8284
- C:\Windows\System\XJlekcd.exe
  C:\Windows\System\XJlekcd.exe
  2⤵
  PID:8300
- C:\Windows\System\olJnMkj.exe
  C:\Windows\System\olJnMkj.exe
  2⤵
  PID:8316
- C:\Windows\System\UGtqJPH.exe
  C:\Windows\System\UGtqJPH.exe
  2⤵
  PID:8332
- C:\Windows\System\tivvGSd.exe
  C:\Windows\System\tivvGSd.exe
  2⤵
  PID:8348
- C:\Windows\System\MuEpVBP.exe
  C:\Windows\System\MuEpVBP.exe
  2⤵
  PID:8368
- C:\Windows\System\qgIMdUN.exe
  C:\Windows\System\qgIMdUN.exe
  2⤵
  PID:8388
- C:\Windows\System\lkFQiXL.exe
  C:\Windows\System\lkFQiXL.exe
  2⤵
  PID:8404
- C:\Windows\System\wkYzqSI.exe
  C:\Windows\System\wkYzqSI.exe
  2⤵
  PID:8420
- C:\Windows\System\BAMamSH.exe
  C:\Windows\System\BAMamSH.exe
  2⤵
  PID:8436
- C:\Windows\System\dlvUCbh.exe
  C:\Windows\System\dlvUCbh.exe
  2⤵
  PID:8980
- C:\Windows\System\NtangEb.exe
  C:\Windows\System\NtangEb.exe
  2⤵
  PID:9012
- C:\Windows\System\vLmYSwm.exe
  C:\Windows\System\vLmYSwm.exe
  2⤵
  PID:9048
- C:\Windows\System\pTYfFqh.exe
  C:\Windows\System\pTYfFqh.exe
  2⤵
  PID:9068
- C:\Windows\System\fOPhQvy.exe
  C:\Windows\System\fOPhQvy.exe
  2⤵
  PID:9084
- C:\Windows\System\vNpRjCw.exe
  C:\Windows\System\vNpRjCw.exe
  2⤵
  PID:9100
- C:\Windows\System\XpLOpym.exe
  C:\Windows\System\XpLOpym.exe
  2⤵
  PID:9116
- C:\Windows\System\nyeFCem.exe
  C:\Windows\System\nyeFCem.exe
  2⤵
  PID:9132
- C:\Windows\System\jdHSCZr.exe
  C:\Windows\System\jdHSCZr.exe
  2⤵
  PID:9148
- C:\Windows\System\ColGIJb.exe
  C:\Windows\System\ColGIJb.exe
  2⤵
  PID:9164
- C:\Windows\System\YYsTLSB.exe
  C:\Windows\System\YYsTLSB.exe
  2⤵
  PID:9180
- C:\Windows\System\FyaePHk.exe
  C:\Windows\System\FyaePHk.exe
  2⤵
  PID:9196
- C:\Windows\System\uLYHzrw.exe
  C:\Windows\System\uLYHzrw.exe
  2⤵
  PID:9212
- C:\Windows\System\hNprMRL.exe
  C:\Windows\System\hNprMRL.exe
  2⤵
  PID:7948
- C:\Windows\System\GAmmoQw.exe
  C:\Windows\System\GAmmoQw.exe
  2⤵
  PID:8232
- C:\Windows\System\XuRbErD.exe
  C:\Windows\System\XuRbErD.exe
  2⤵
  PID:8276
- C:\Windows\System\lbdeHmA.exe
  C:\Windows\System\lbdeHmA.exe
  2⤵
  PID:8340
- C:\Windows\System\TGYaQLo.exe
  C:\Windows\System\TGYaQLo.exe
  2⤵
  PID:8384
- C:\Windows\System\nZfjjcv.exe
  C:\Windows\System\nZfjjcv.exe
  2⤵
  PID:8488
- C:\Windows\System\QegwKVJ.exe
  C:\Windows\System\QegwKVJ.exe
  2⤵
  PID:7300
- C:\Windows\System\QkcfgIH.exe
  C:\Windows\System\QkcfgIH.exe
  2⤵
  PID:6256
- C:\Windows\System\bOcAZGn.exe
  C:\Windows\System\bOcAZGn.exe
  2⤵
  PID:7484
- C:\Windows\System\LmMwhao.exe
  C:\Windows\System\LmMwhao.exe
  2⤵
  PID:7672
- C:\Windows\System\aligekf.exe
  C:\Windows\System\aligekf.exe
  2⤵
  PID:8156
- C:\Windows\System\PPDpghe.exe
  C:\Windows\System\PPDpghe.exe
  2⤵
  PID:7208
- C:\Windows\System\zzAuruQ.exe
  C:\Windows\System\zzAuruQ.exe
  2⤵
  PID:8516
- C:\Windows\System\ysVdtkz.exe
  C:\Windows\System\ysVdtkz.exe
  2⤵
  PID:8496
- C:\Windows\System\DfGFxgL.exe
  C:\Windows\System\DfGFxgL.exe
  2⤵
  PID:8580
- C:\Windows\System\oESsPDi.exe
  C:\Windows\System\oESsPDi.exe
  2⤵
  PID:8664
- C:\Windows\System\BMgYWGF.exe
  C:\Windows\System\BMgYWGF.exe
  2⤵
  PID:8604
- C:\Windows\System\zSPIYhb.exe
  C:\Windows\System\zSPIYhb.exe
  2⤵
  PID:8624
- C:\Windows\System\EiOwdTx.exe
  C:\Windows\System\EiOwdTx.exe
  2⤵
  PID:8672
- C:\Windows\System\qMqYbGw.exe
  C:\Windows\System\qMqYbGw.exe
  2⤵
  PID:8800
- C:\Windows\System\sVUHWzc.exe
  C:\Windows\System\sVUHWzc.exe
  2⤵
  PID:8824
- C:\Windows\System\NwAyzoD.exe
  C:\Windows\System\NwAyzoD.exe
  2⤵
  PID:8884
- C:\Windows\System\aCBerbo.exe
  C:\Windows\System\aCBerbo.exe
  2⤵
  PID:8936
- C:\Windows\System\zbejqgc.exe
  C:\Windows\System\zbejqgc.exe
  2⤵
  PID:8788
- C:\Windows\System\TXKsrbP.exe
  C:\Windows\System\TXKsrbP.exe
  2⤵
  PID:8696
- C:\Windows\System\YfjVTEz.exe
  C:\Windows\System\YfjVTEz.exe
  2⤵
  PID:8716
- C:\Windows\System\AtynLpU.exe
  C:\Windows\System\AtynLpU.exe
  2⤵
  PID:8748
- C:\Windows\System\MauHMnk.exe
  C:\Windows\System\MauHMnk.exe
  2⤵
  PID:8772
- C:\Windows\System\RjDAuzh.exe
  C:\Windows\System\RjDAuzh.exe
  2⤵
  PID:8856
- C:\Windows\System\hWayiEY.exe
  C:\Windows\System\hWayiEY.exe
  2⤵
  PID:8880
- C:\Windows\System\MoIsFME.exe
  C:\Windows\System\MoIsFME.exe
  2⤵
  PID:8908
- C:\Windows\System\BvNLgTN.exe
  C:\Windows\System\BvNLgTN.exe
  2⤵
  PID:8932
- C:\Windows\System\LRTzSWa.exe
  C:\Windows\System\LRTzSWa.exe
  2⤵
  PID:8964
- C:\Windows\System\NiaxpVb.exe
  C:\Windows\System\NiaxpVb.exe
  2⤵
  PID:8992
- C:\Windows\System\cvVBCHH.exe
  C:\Windows\System\cvVBCHH.exe
  2⤵
  PID:9008
- C:\Windows\System\dgWdeln.exe
  C:\Windows\System\dgWdeln.exe
  2⤵
  PID:9056
- C:\Windows\System\YlVLRBO.exe
  C:\Windows\System\YlVLRBO.exe
  2⤵
  PID:9032
- C:\Windows\System\yCcPCPB.exe
  C:\Windows\System\yCcPCPB.exe
  2⤵
  PID:9112
- C:\Windows\System\kqyHPKQ.exe
  C:\Windows\System\kqyHPKQ.exe
  2⤵
  PID:9096
- C:\Windows\System\yMomIMB.exe
  C:\Windows\System\yMomIMB.exe
  2⤵
  PID:9160
- C:\Windows\System\QukZzZa.exe
  C:\Windows\System\QukZzZa.exe
  2⤵
  PID:9076
- C:\Windows\System\meOamFW.exe
  C:\Windows\System\meOamFW.exe
  2⤵
  PID:9204
- C:\Windows\System\ZDDSCEl.exe
  C:\Windows\System\ZDDSCEl.exe
  2⤵
  PID:8380
- C:\Windows\System\hWBZcZx.exe
  C:\Windows\System\hWBZcZx.exe
  2⤵
  PID:8416
- C:\Windows\System\EFuVjKJ.exe
  C:\Windows\System\EFuVjKJ.exe
  2⤵
  PID:9188
- C:\Windows\System\bHolPfC.exe
  C:\Windows\System\bHolPfC.exe
  2⤵
  PID:8472
- C:\Windows\System\HpfjIIT.exe
  C:\Windows\System\HpfjIIT.exe
  2⤵
  PID:1904
- C:\Windows\System\ZLhADqI.exe
  C:\Windows\System\ZLhADqI.exe
  2⤵
  PID:7224
- C:\Windows\System\WKhoWDi.exe
  C:\Windows\System\WKhoWDi.exe
  2⤵
  PID:6320
- C:\Windows\System\oNSVnSy.exe
  C:\Windows\System\oNSVnSy.exe
  2⤵
  PID:7612
- C:\Windows\System\zDYPhes.exe
  C:\Windows\System\zDYPhes.exe
  2⤵
  PID:7804
- C:\Windows\System\PCFeDds.exe
  C:\Windows\System\PCFeDds.exe
  2⤵
  PID:6720
- C:\Windows\System\lRwUzgc.exe
  C:\Windows\System\lRwUzgc.exe
  2⤵
  PID:7368
- C:\Windows\System\SxFrwXD.exe
  C:\Windows\System\SxFrwXD.exe
  2⤵
  PID:8000
- C:\Windows\System\KSfQHkA.exe
  C:\Windows\System\KSfQHkA.exe
  2⤵
  PID:8220
- C:\Windows\System\oOqtTtQ.exe
  C:\Windows\System\oOqtTtQ.exe
  2⤵
  PID:8252
- C:\Windows\System\PszpoYR.exe
  C:\Windows\System\PszpoYR.exe
  2⤵
  PID:8528
- C:\Windows\System\iXLsfZe.exe
  C:\Windows\System\iXLsfZe.exe
  2⤵
  PID:8612
- C:\Windows\System\QsLzERc.exe
  C:\Windows\System\QsLzERc.exe
  2⤵
  PID:8660
- C:\Windows\System\gbyQCrs.exe
  C:\Windows\System\gbyQCrs.exe
  2⤵
  PID:8592
- C:\Windows\System\EHzhEDe.exe
  C:\Windows\System\EHzhEDe.exe
  2⤵
  PID:8684
- C:\Windows\System\vijXdAD.exe
  C:\Windows\System\vijXdAD.exe
  2⤵
  PID:7724
- C:\Windows\System\wcHwBzs.exe
  C:\Windows\System\wcHwBzs.exe
  2⤵
  PID:8780
- C:\Windows\System\gUBDnSb.exe
  C:\Windows\System\gUBDnSb.exe
  2⤵
  PID:8740
- C:\Windows\System\XVStZYh.exe
  C:\Windows\System\XVStZYh.exe
  2⤵
  PID:8764
- C:\Windows\System\lnsNXjP.exe
  C:\Windows\System\lnsNXjP.exe
  2⤵
  PID:8752
- C:\Windows\System\AHLHDkp.exe
  C:\Windows\System\AHLHDkp.exe
  2⤵
  PID:8828
- C:\Windows\System\ZdQhubz.exe
  C:\Windows\System\ZdQhubz.exe
  2⤵
  PID:8852
- C:\Windows\System\zqGSrHp.exe
  C:\Windows\System\zqGSrHp.exe
  2⤵
  PID:9024
- C:\Windows\System\TyVSqsk.exe
  C:\Windows\System\TyVSqsk.exe
  2⤵
  PID:8948
- C:\Windows\System\yFnjqhC.exe
  C:\Windows\System\yFnjqhC.exe
  2⤵
  PID:8268
- C:\Windows\System\LxHGMaK.exe
  C:\Windows\System\LxHGMaK.exe
  2⤵
  PID:7688
- C:\Windows\System\MYqtgOw.exe
  C:\Windows\System\MYqtgOw.exe
  2⤵
  PID:8480
- C:\Windows\System\kySGqCK.exe
  C:\Windows\System\kySGqCK.exe
  2⤵
  PID:2616
- C:\Windows\System\txcGGUT.exe
  C:\Windows\System\txcGGUT.exe
  2⤵
  PID:8996
- C:\Windows\System\dUrVZpI.exe
  C:\Windows\System\dUrVZpI.exe
  2⤵
  PID:6900
- C:\Windows\System\enSEpQw.exe
  C:\Windows\System\enSEpQw.exe
  2⤵
  PID:8468
- C:\Windows\System\zykrMdf.exe
  C:\Windows\System\zykrMdf.exe
  2⤵
  PID:7332
- C:\Windows\System\jUTMTVv.exe
  C:\Windows\System\jUTMTVv.exe
  2⤵
  PID:8640
- C:\Windows\System\qSqDLyg.exe
  C:\Windows\System\qSqDLyg.exe
  2⤵
  PID:8360
- C:\Windows\System\mZmVety.exe
  C:\Windows\System\mZmVety.exe
  2⤵
  PID:8432
- C:\Windows\System\MQrwnud.exe
  C:\Windows\System\MQrwnud.exe
  2⤵
  PID:8564
- C:\Windows\System\qAZoZYj.exe
  C:\Windows\System\qAZoZYj.exe
  2⤵
  PID:8540
- C:\Windows\System\nhYtkxj.exe
  C:\Windows\System\nhYtkxj.exe
  2⤵
  PID:8632
- C:\Windows\System\CQeXjnL.exe
  C:\Windows\System\CQeXjnL.exe
  2⤵
  PID:8924
- C:\Windows\System\LNNkAru.exe
  C:\Windows\System\LNNkAru.exe
  2⤵
  PID:8952
- C:\Windows\System\siSiTvf.exe
  C:\Windows\System\siSiTvf.exe
  2⤵
  PID:8656
- C:\Windows\System\ADbXKIi.exe
  C:\Windows\System\ADbXKIi.exe
  2⤵
  PID:8712
- C:\Windows\System\fETGVXc.exe
  C:\Windows\System\fETGVXc.exe
  2⤵
  PID:8820
- C:\Windows\System\xXgyVaF.exe
  C:\Windows\System\xXgyVaF.exe
  2⤵
  PID:8784
- C:\Windows\System\qWrAYvf.exe
  C:\Windows\System\qWrAYvf.exe
  2⤵
  PID:8456
- C:\Windows\System\CVxruzZ.exe
  C:\Windows\System\CVxruzZ.exe
  2⤵
  PID:9028
- C:\Windows\System\PbLdHfv.exe
  C:\Windows\System\PbLdHfv.exe
  2⤵
  PID:9092
- C:\Windows\System\liYwplq.exe
  C:\Windows\System\liYwplq.exe
  2⤵
  PID:9064
- C:\Windows\System\GRGRmoe.exe
  C:\Windows\System\GRGRmoe.exe
  2⤵
  PID:8324
- C:\Windows\System\JXmfPSl.exe
  C:\Windows\System\JXmfPSl.exe
  2⤵
  PID:7516
- C:\Windows\System\VxlRGNi.exe
  C:\Windows\System\VxlRGNi.exe
  2⤵
  PID:6628
- C:\Windows\System\oFyMUqe.exe
  C:\Windows\System\oFyMUqe.exe
  2⤵
  PID:8524
- C:\Windows\System\tpLuimc.exe
  C:\Windows\System\tpLuimc.exe
  2⤵
  PID:8396
- C:\Windows\System\QufsBLk.exe
  C:\Windows\System\QufsBLk.exe
  2⤵
  PID:8556
- C:\Windows\System\WErJLUw.exe
  C:\Windows\System\WErJLUw.exe
  2⤵
  PID:8816
- C:\Windows\System\kKIzIHA.exe
  C:\Windows\System\kKIzIHA.exe
  2⤵
  PID:8796
- C:\Windows\System\byQpWcw.exe
  C:\Windows\System\byQpWcw.exe
  2⤵
  PID:8588
- C:\Windows\System\kClGtoz.exe
  C:\Windows\System\kClGtoz.exe
  2⤵
  PID:8792
- C:\Windows\System\eLqIbfR.exe
  C:\Windows\System\eLqIbfR.exe
  2⤵
  PID:8204
- C:\Windows\System\tVokmMh.exe
  C:\Windows\System\tVokmMh.exe
  2⤵
  PID:8200
- C:\Windows\System\upebZLJ.exe
  C:\Windows\System\upebZLJ.exe
  2⤵
  PID:8216
- C:\Windows\System\UGMXbnz.exe
  C:\Windows\System\UGMXbnz.exe
  2⤵
  PID:8500
- C:\Windows\System\mWKRyio.exe
  C:\Windows\System\mWKRyio.exe
  2⤵
  PID:8848
- C:\Windows\System\hSatQOy.exe
  C:\Windows\System\hSatQOy.exe
  2⤵
  PID:8552
- C:\Windows\System\yJxtCWd.exe
  C:\Windows\System\yJxtCWd.exe
  2⤵
  PID:8584
- C:\Windows\System\xEhKGkk.exe
  C:\Windows\System\xEhKGkk.exe
  2⤵
  PID:8328
- C:\Windows\System\aHRVVqc.exe
  C:\Windows\System\aHRVVqc.exe
  2⤵
  PID:9232
- C:\Windows\System\NLYqCVA.exe
  C:\Windows\System\NLYqCVA.exe
  2⤵
  PID:9252
- C:\Windows\System\hmlwKda.exe
  C:\Windows\System\hmlwKda.exe
  2⤵
  PID:9272
- C:\Windows\System\GSRDMwV.exe
  C:\Windows\System\GSRDMwV.exe
  2⤵
  PID:9288
- C:\Windows\System\BSzULQY.exe
  C:\Windows\System\BSzULQY.exe
  2⤵
  PID:9304
- C:\Windows\System\HTTSZLc.exe
  C:\Windows\System\HTTSZLc.exe
  2⤵
  PID:9324
- C:\Windows\System\wPMOJWU.exe
  C:\Windows\System\wPMOJWU.exe
  2⤵
  PID:9344
- C:\Windows\System\JbxLcvB.exe
  C:\Windows\System\JbxLcvB.exe
  2⤵
  PID:9368
- C:\Windows\System\kWMcQnO.exe
  C:\Windows\System\kWMcQnO.exe
  2⤵
  PID:9384
- C:\Windows\System\BBkMsnJ.exe
  C:\Windows\System\BBkMsnJ.exe
  2⤵
  PID:9412
- C:\Windows\System\AbpGTLc.exe
  C:\Windows\System\AbpGTLc.exe
  2⤵
  PID:9428
- C:\Windows\System\yokaUGt.exe
  C:\Windows\System\yokaUGt.exe
  2⤵
  PID:9448
- C:\Windows\System\NjRruZb.exe
  C:\Windows\System\NjRruZb.exe
  2⤵
  PID:9464
- C:\Windows\System\XEAPSEe.exe
  C:\Windows\System\XEAPSEe.exe
  2⤵
  PID:9484
- C:\Windows\System\pZSJuvF.exe
  C:\Windows\System\pZSJuvF.exe
  2⤵
  PID:9508
- C:\Windows\System\KvLapBY.exe
  C:\Windows\System\KvLapBY.exe
  2⤵
  PID:9532
- C:\Windows\System\IFBvBEs.exe
  C:\Windows\System\IFBvBEs.exe
  2⤵
  PID:9560
- C:\Windows\System\MmmZQWy.exe
  C:\Windows\System\MmmZQWy.exe
  2⤵
  PID:9600
- C:\Windows\System\AZzRLBR.exe
  C:\Windows\System\AZzRLBR.exe
  2⤵
  PID:9624
- C:\Windows\System\nSCxhpO.exe
  C:\Windows\System\nSCxhpO.exe
  2⤵
  PID:9640
- C:\Windows\System\ysQIYdU.exe
  C:\Windows\System\ysQIYdU.exe
  2⤵
  PID:9656
- C:\Windows\System\EqDWExl.exe
  C:\Windows\System\EqDWExl.exe
  2⤵
  PID:9680
- C:\Windows\System\JTNHKVH.exe
  C:\Windows\System\JTNHKVH.exe
  2⤵
  PID:9700
- C:\Windows\System\IfWASwv.exe
  C:\Windows\System\IfWASwv.exe
  2⤵
  PID:9716
- C:\Windows\System\SibqyEX.exe
  C:\Windows\System\SibqyEX.exe
  2⤵
  PID:9736
- C:\Windows\System\lLoDtpC.exe
  C:\Windows\System\lLoDtpC.exe
  2⤵
  PID:9752
- C:\Windows\System\zmbLsfl.exe
  C:\Windows\System\zmbLsfl.exe
  2⤵
  PID:9772
- C:\Windows\System\sdJhqOS.exe
  C:\Windows\System\sdJhqOS.exe
  2⤵
  PID:9788
- C:\Windows\System\ogYdFNe.exe
  C:\Windows\System\ogYdFNe.exe
  2⤵
  PID:9808
- C:\Windows\System\hnSNXbr.exe
  C:\Windows\System\hnSNXbr.exe
  2⤵
  PID:9828
- C:\Windows\System\ogWXNjz.exe
  C:\Windows\System\ogWXNjz.exe
  2⤵
  PID:9844
- C:\Windows\System\jVHUtTd.exe
  C:\Windows\System\jVHUtTd.exe
  2⤵
  PID:9860
- C:\Windows\System\Zarmdca.exe
  C:\Windows\System\Zarmdca.exe
  2⤵
  PID:9876
- C:\Windows\System\mTsuSuO.exe
  C:\Windows\System\mTsuSuO.exe
  2⤵
  PID:9892
- C:\Windows\System\IINWCdA.exe
  C:\Windows\System\IINWCdA.exe
  2⤵
  PID:9908
- C:\Windows\System\dNdFgUe.exe
  C:\Windows\System\dNdFgUe.exe
  2⤵
  PID:9928
- C:\Windows\System\nTyWuSo.exe
  C:\Windows\System\nTyWuSo.exe
  2⤵
  PID:9948
- C:\Windows\System\bavHBwB.exe
  C:\Windows\System\bavHBwB.exe
  2⤵
  PID:9964
- C:\Windows\System\HpLRjcT.exe
  C:\Windows\System\HpLRjcT.exe
  2⤵
  PID:9980
- C:\Windows\System\ZswqXLG.exe
  C:\Windows\System\ZswqXLG.exe
  2⤵
  PID:9996
- C:\Windows\System\JHzrwZh.exe
  C:\Windows\System\JHzrwZh.exe
  2⤵
  PID:10016
- C:\Windows\System\tJNOQoh.exe
  C:\Windows\System\tJNOQoh.exe
  2⤵
  PID:10032
- C:\Windows\System\tXJPGZI.exe
  C:\Windows\System\tXJPGZI.exe
  2⤵
  PID:10048
- C:\Windows\System\AcWYicj.exe
  C:\Windows\System\AcWYicj.exe
  2⤵
  PID:10064
- C:\Windows\System\YQzDSyg.exe
  C:\Windows\System\YQzDSyg.exe
  2⤵
  PID:10096
- C:\Windows\System\ypYiEDi.exe
  C:\Windows\System\ypYiEDi.exe
  2⤵
  PID:10120
- C:\Windows\System\epXTgdF.exe
  C:\Windows\System\epXTgdF.exe
  2⤵
  PID:10148
- C:\Windows\System\QostPoM.exe
  C:\Windows\System\QostPoM.exe
  2⤵
  PID:10164
- C:\Windows\System\YJmHKKr.exe
  C:\Windows\System\YJmHKKr.exe
  2⤵
  PID:10180
- C:\Windows\System\uCraNyH.exe
  C:\Windows\System\uCraNyH.exe
  2⤵
  PID:10196
- C:\Windows\System\CkoFWsw.exe
  C:\Windows\System\CkoFWsw.exe
  2⤵
  PID:10212
- C:\Windows\System\BvZXgpB.exe
  C:\Windows\System\BvZXgpB.exe
  2⤵
  PID:10232
- C:\Windows\System\okNqfCx.exe
  C:\Windows\System\okNqfCx.exe
  2⤵
  PID:9172
- C:\Windows\System\oaCfexc.exe
  C:\Windows\System\oaCfexc.exe
  2⤵
  PID:8460
- C:\Windows\System\ESdWzXB.exe
  C:\Windows\System\ESdWzXB.exe
  2⤵
  PID:9264
- C:\Windows\System\lszoAbD.exe
  C:\Windows\System\lszoAbD.exe
  2⤵
  PID:9228
- C:\Windows\System\paifAbU.exe
  C:\Windows\System\paifAbU.exe
  2⤵
  PID:9380
- C:\Windows\System\kcWAcnb.exe
  C:\Windows\System\kcWAcnb.exe
  2⤵
  PID:9424
- C:\Windows\System\aJBylGx.exe
  C:\Windows\System\aJBylGx.exe
  2⤵
  PID:8900
- C:\Windows\System\QgixqDq.exe
  C:\Windows\System\QgixqDq.exe
  2⤵
  PID:9404
- C:\Windows\System\EUPHzlV.exe
  C:\Windows\System\EUPHzlV.exe
  2⤵
  PID:9248
- C:\Windows\System\QtzVtHq.exe
  C:\Windows\System\QtzVtHq.exe
  2⤵
  PID:9316
- C:\Windows\System\aoWggUE.exe
  C:\Windows\System\aoWggUE.exe
  2⤵
  PID:9360
- C:\Windows\System\AROPHZi.exe
  C:\Windows\System\AROPHZi.exe
  2⤵
  PID:9400
- C:\Windows\System\rbIKYKc.exe
  C:\Windows\System\rbIKYKc.exe
  2⤵
  PID:9444
- C:\Windows\System\rPfhLmY.exe
  C:\Windows\System\rPfhLmY.exe
  2⤵
  PID:9476
- C:\Windows\System\jyficza.exe
  C:\Windows\System\jyficza.exe
  2⤵
  PID:9524
- C:\Windows\System\ryADjEH.exe
  C:\Windows\System\ryADjEH.exe
  2⤵
  PID:9556
- C:\Windows\System\sAzhhKv.exe
  C:\Windows\System\sAzhhKv.exe
  2⤵
  PID:9584
- C:\Windows\System\hnTdqQO.exe
  C:\Windows\System\hnTdqQO.exe
  2⤵
  PID:9608
- C:\Windows\System\kkrwrNg.exe
  C:\Windows\System\kkrwrNg.exe
  2⤵
  PID:9648
- C:\Windows\System\SIdKyoQ.exe
  C:\Windows\System\SIdKyoQ.exe
  2⤵
  PID:9728
- C:\Windows\System\CrrbEIA.exe
  C:\Windows\System\CrrbEIA.exe
  2⤵
  PID:9800
- C:\Windows\System\HhijGFO.exe
  C:\Windows\System\HhijGFO.exe
  2⤵
  PID:9900
- C:\Windows\System\objcUoD.exe
  C:\Windows\System\objcUoD.exe
  2⤵
  PID:9936
- C:\Windows\System\iJBkHSb.exe
  C:\Windows\System\iJBkHSb.exe
  2⤵
  PID:9780
- C:\Windows\System\eQgyuGD.exe
  C:\Windows\System\eQgyuGD.exe
  2⤵
  PID:9944
- C:\Windows\System\OEojLky.exe
  C:\Windows\System\OEojLky.exe
  2⤵
  PID:10012
- C:\Windows\System\cJdHnNy.exe
  C:\Windows\System\cJdHnNy.exe
  2⤵
  PID:9884
- C:\Windows\System\XmJHAbs.exe
  C:\Windows\System\XmJHAbs.exe
  2⤵
  PID:10092
- C:\Windows\System\dMLBddz.exe
  C:\Windows\System\dMLBddz.exe
  2⤵
  PID:10140
- C:\Windows\System\KPhLanD.exe
  C:\Windows\System\KPhLanD.exe
  2⤵
  PID:10136
- C:\Windows\System\dtHFEtF.exe
  C:\Windows\System\dtHFEtF.exe
  2⤵
  PID:7880
- C:\Windows\System\zTdgwot.exe
  C:\Windows\System\zTdgwot.exe
  2⤵
  PID:8920
- C:\Windows\System\KOHcTai.exe
  C:\Windows\System\KOHcTai.exe
  2⤵
  PID:9240
- C:\Windows\System\qJuKaYP.exe
  C:\Windows\System\qJuKaYP.exe
  2⤵
  PID:9440
- C:\Windows\System\OfBPGHs.exe
  C:\Windows\System\OfBPGHs.exe
  2⤵
  PID:9516
- C:\Windows\System\qWOXKwb.exe
  C:\Windows\System\qWOXKwb.exe
  2⤵
  PID:9576
- C:\Windows\System\SHnMcuy.exe
  C:\Windows\System\SHnMcuy.exe
  2⤵
  PID:10160
- C:\Windows\System\KFzGpHa.exe
  C:\Windows\System\KFzGpHa.exe
  2⤵
  PID:9916
- C:\Windows\System\pBiZMNx.exe
  C:\Windows\System\pBiZMNx.exe
  2⤵
  PID:9988
- C:\Windows\System\pWfOzwx.exe
  C:\Windows\System\pWfOzwx.exe
  2⤵
  PID:10060
- C:\Windows\System\yOTIOey.exe
  C:\Windows\System\yOTIOey.exe
  2⤵
  PID:10116
- C:\Windows\System\lUCsqKY.exe
  C:\Windows\System\lUCsqKY.exe
  2⤵
  PID:10224
- C:\Windows\System\UjsyHGd.exe
  C:\Windows\System\UjsyHGd.exe
  2⤵
  PID:8520

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\AGBhsfN.exe

Filesize
2.6MB

MD5
17ac8322b2305ff73c2076c3115341c7

SHA1
f049e62285925e5fe6cfa2e028406f4bce088f8b

SHA256
18ded87c0c92038104b1f5f2643da35891ff41763482831000ffae3f48d59e27

SHA512
7a486c59323691289e22d947ff96a0887b50f1457524becbc5f637532ca4d0dcd6bbfde571e961e3b68b2e377588d71c0983d9e9bf01bbcc1fe952963f8babde

Download Submit
C:\Windows\system\AXIzFOP.exe

Filesize
2.6MB

MD5
e3b7db23c16742692ee8734b46e162fa

SHA1
c0c125256d6e24df3c53bf2d82cff659f58c1668

SHA256
24937dbc3eb96ee47b7f254a55bfd6716eec7124be4219267f563ca86e8acbc0

SHA512
aeefa51dbeb84c2e54b8a2fd603addcedc43d0a2cdb95a5d29543cfb8960676d5edf0a0953cab809e727555842eb6e1e28c07aa3d846579dd954d39b354f2784

Download Submit
C:\Windows\system\EwJNcEz.exe

Filesize
2.6MB

MD5
6017c7be891570eae1f8d82b5c90418a

SHA1
8e948b0f3abff9b6e8360d96ad799f123f83c5df

SHA256
0beee0e5514fdca58c5965ea4313578e3e09ae5740b254be843a26d605b75748

SHA512
9f4a42f24e1d2bb28ca5607403005b35eaac7f929f6a505b71569e839b40829ff6c47d45d161060032b4b77949a463c429ab39fbd28806117b6f967b3f89ea85

Download Submit
C:\Windows\system\EyNYWoW.exe

Filesize
2.6MB

MD5
f81c13a2d41da9ba6d2b19a03b56c4e0

SHA1
c58a98d21e27a3777b7b6a64e70ed6188693f37e

SHA256
d08d05463c0562f19dc9f69325fc1aa87d608c912bc500527c28350bceb1ae6f

SHA512
e67fd9125c5c1e0c1abfdab5cdfde0a98d9710af3ad4c01663dcc169f5d71f7748846718343883f1eaf008bdc683720011e726802a71bcd3d4df65250587170f

Download Submit
C:\Windows\system\ISGlqFw.exe

Filesize
2.6MB

MD5
07f7d00d5253b2daa0e545c4ba5326af

SHA1
a947feea19d7f586a45b1472cff7cf6f0656b590

SHA256
84086f1a1fa2b527c8034327fc6c426d8c3cfaf5f794a335ff26925c154cebbd

SHA512
ad56cdbf7d8d5d45a71595aa5606cd8044abccb497ffe1603876e54d4f97a579bd6929a0dd99659cf620737a62c61c3fd3f00633417352613349a5494f804df1

Download Submit
C:\Windows\system\JVzVfRn.exe

Filesize
2.6MB

MD5
71dd3e193ff154585c6dcbd0d235c1de

SHA1
6c48d7c676c2ccb912523c30f7a737d9b042a9c5

SHA256
8ddcf35566e4d61722683ffa6ea45a4f33326c2b211d9831e90da2728e11a5a2

SHA512
1a5c99627299fb709b5bc73ba1da441edc47cd150b828fbe67253c12b7053ded479df49f6d085cc0d8a7732f5f34e6e4170fa15d2865a54b56e54018548a2f7c

Download Submit
C:\Windows\system\JwxWImY.exe

Filesize
2.6MB

MD5
57cd0b349917e5f9d41dfe9714099e6c

SHA1
6f3af743782394cb42cbd75e1499a62e8c72bbf7

SHA256
a8e51efad3a72ed879ef77981ada1df2476c6726d48ac44b4fe54c76bb772645

SHA512
1e1dc880797d015bf180cad71352bce92a98b79079fefb0a2274596ee81725d852b9dbf1ee324bbf5d091970d997ea4270a1818f027c7d70acd6afa42761d5f7

Download Submit
C:\Windows\system\MbcWHqn.exe

Filesize
2.6MB

MD5
b35999fdd08ba690b7c595799b8ad5f6

SHA1
06d4ce87fba5ab57ebff72430172e9148a1a399f

SHA256
b32c0223f6d934f4bce7059088a80aa818f9bd4a36cec15d918b1d5f099a401e

SHA512
05206841792cb6bc12f0b6f1aaf466bfd3dbaac44689daa569fc17fabc7b72cffbf394aa0b4fccd0636ad370c0f48837bad67c3ba9982b3d846aefce171cec52

Download Submit
C:\Windows\system\NseKHux.exe

Filesize
2.6MB

MD5
431f99e4dc0aaed4dc8ddaeca4ca8de8

SHA1
ce80ea4ce83a3177bf9985e4ce9fdc6a87991fcd

SHA256
1c8825ade842863e83ba6254b1601eab54a11e632da4525076e421273d7c76cc

SHA512
7b00d7052cd24d35fc20bc774fa90df785b0f68200805974f1b21fb32a6a567a34b755b5eb22941e4f51347a23514e46fa76344c2fb19606e6f20f5fcb958c69

Download Submit
C:\Windows\system\OrOdksR.exe

Filesize
2.6MB

MD5
5469c8fe403a3a461d6eb3a376c09e0b

SHA1
04c215a2ddcbafe4196b8ddc262f9524fd59efc0

SHA256
0f24ee4e386d56992e8ddb8c14eacae1aab3c1f402996ff077b760ce0ad8a63f

SHA512
2f238f52dfae93652ff98ddbd7229b2931c3c251648f611f7f5675a7f7906198601bb4930997766815de1dd9bf9a238a85af31e7d88d83fb961d058eabafd7fa

Download Submit
C:\Windows\system\PRQMDvO.exe

Filesize
2.6MB

MD5
e12d3bd5db21937b0acfc7d295c78246

SHA1
90147b34275a4ae37b1a27b5968982086847fc52

SHA256
849cd41f1fc2639971b7561e8f5c39a78416e8089eb562760f198364f0f7d7c9

SHA512
e5632803b68d90c4dd8abc00e7afe91408d32d0f15b54e1b4fc57b83b167afaba6e4b4acd542cd67936a6e3966a0299f2e79767b8e7ab8e96e7d893964a1e115

Download Submit
C:\Windows\system\PfqMOcJ.exe

Filesize
2.6MB

MD5
7b3639c7fa3861e883095468ba9aabac

SHA1
ecf66673757e1bfe1cd43dccf2a50757860a73a1

SHA256
f6a0da8664f316d0551f1d3d5afc7fb4d2362cebc7f6b19691fa6d5de21f14c9

SHA512
24c74c0af8c5b2c645f0e2dce91501e60f196d259af3f875eff4e5fbccb2960599b7993c095fb1b8a9e34c54a435e5580ce06cb65c1f314fe8d76fc8d93d34ff

Download Submit
C:\Windows\system\SKMPKXX.exe

Filesize
2.6MB

MD5
1e7eab45b83567358aec07a2a81f18a6

SHA1
c91c770dd853f7a05ce2e10b2247e0af27f3c790

SHA256
f2337799f9ba4cb19cf81fdab28e7d3e08fbddaf5ce4f72bc8298480502b1ba0

SHA512
06b7a0ffe52f9b90e6b0722ab7c678397ff1ae076ea86815230bebbb6a64d53eea9b1e6ff331649cd943594adc9cb1e126542ff04acf192aaf70172e62c8bd0f

Download Submit
C:\Windows\system\ThQyeBc.exe

Filesize
2.6MB

MD5
a5d583263f593d2859d3d4c1e158b3dd

SHA1
d3ae3e82b753e34887d9ec351d3142b75a057664

SHA256
92ab397da5d1fd9862a42ea2d86f84ec018d17fe5e802bd1c1a35762c3a2b577

SHA512
c185f670a985f2dd4c5b491f6e19fc3bb102c51567714d08bc18dca938d83cb184bc6bb4188c47aed404b12d1bb72658f31dd90015a682771d81cd034c751d22

Download Submit
C:\Windows\system\YCWExnS.exe

Filesize
2.6MB

MD5
0f9c06669e51676f2e49a9053665886c

SHA1
c08a64e94da1c95ff44f3760d223655e1d329b52

SHA256
92071ea46599d71998ec83b173239bab4a02f2b6bbc928c9146d5bb4b6dc3139

SHA512
15cac00714e72144eac6e0f28b6350e35e90d7049962490c6f5cf485c5c6ea78cdaba4e083ad590a5f652209694e0e30801c972ae6979300f7762cc734a1ae4b

Download Submit
C:\Windows\system\bRjjuzG.exe

Filesize
2.6MB

MD5
704b535c87c15607000538e2dcbc12c7

SHA1
9b3af4a61a469380b9ba340045cc4ee6abdcd988

SHA256
c26ae3b8693cd75149587973b01b11a33ab6c1dfe9084c86af8e0a2aef3fc504

SHA512
b4dba6da1b6350d1496b3cbc5f04d759af3ca2473d74f4ac32417db34ee4d9d7aaa6544da0e4dcd56e2952318dff69a9e5b3400eb5485031df56cefa8aac7400

Download Submit
C:\Windows\system\cbiZVlF.exe

Filesize
2.6MB

MD5
8063a5f3450d88da66503d8ab3c3fb57

SHA1
7320437ea7e20c6f6b86f04056197398947d6cb8

SHA256
6ab8d15d64b39a84c082fd0e837863feacbffbaef5a6225d5f92efe8d46dfbe5

SHA512
b5446cc3b157207e2f80dddd6050f8694cee3d264988499ecb530eb4057f8a41afb4a7b1ee373016406e4de1409c6200b6bcbfae5e70011ce53dd67ef7f03f05

Download Submit
C:\Windows\system\fSYkZaS.exe

Filesize
2.6MB

MD5
0a7be563c7d727fb5840f7bb03feb123

SHA1
240b3c14e5394f9eed8a93d86a24206ec033dbb8

SHA256
9b53e2141907b8d6689780dcd3a0994b62167059b626870176251d73a75f0b16

SHA512
cf9bbf240ffe09065f62eb0ea58d27ec6ce1ad96c3c59ea0585316656efe4eb8ee4843e575460dcdcbf73cee483c415a6e840101186743917bb2f9e85fdaec70

Download Submit
C:\Windows\system\fXlvXBt.exe

Filesize
2.6MB

MD5
60bb50651c4ef9f74c3c0425a44905f8

SHA1
ec76593f151714ef59508d576ba07ca869652ec3

SHA256
ce5889b426657dd75e180799838071de355bcef4d75822638612bc8bbc0e81d6

SHA512
56baea2dc4b52a22ed7c85cb36ca3b8430320b932922f1b0b71aacb2e7ae5fe983d878ec338a423c9a6291541c82bb53ce105bf9b5906443dacc31d615c37ede

Download Submit
C:\Windows\system\glYlkoL.exe

Filesize
2.6MB

MD5
0dbe2a280ac81f85aaeb19e484af0a98

SHA1
664b6c462c284a03562f4de8ed876716c9ce5991

SHA256
a8f6a998c68a45e21cbcfc488296632864f09758e943e522e36a79fd97da26fa

SHA512
2a2ed60ee065db3a5a3db955abc7f991b40a05d9ce3bedeaab3b76a4ba8be85bf31a9dd2b48e2527c988ff65f7e0a8f6e48a85365c323097d59675324de14845

Download Submit
C:\Windows\system\gwSnvwd.exe

Filesize
2.6MB

MD5
0f4519b83bc813bb5e6a65dfe05c00ee

SHA1
d5915369d6ea74973cd7ba19642204e8fdfce8b8

SHA256
d62910079ca6468e7a9309ec90831ff0019a4e9edd97653cf253219383373601

SHA512
222e4a0891668d3b8c85daccdf802aae66af8d121fae88ef95660416ec9296610061cd97b9ea0fecb177c440db057287527342a0cae971d0dfb4a501138a3196

Download Submit
C:\Windows\system\iMaPGXC.exe

Filesize
2.6MB

MD5
c4ec83446314426241dfed7ceb7cbb30

SHA1
1939d79f29d2b7cdb99d9450b68a4f90039263b4

SHA256
d78b65e4d51156d4662eaeac461a17882b400f093f0c3d761c6c0823d5230f7f

SHA512
b954f8d342a3a439303382d33df45245915c2cb16f42c578e7f1ea9df47a29c7ca574139831f76b1af83e1673383f4e9ef8af4dd523984a4f5bb1b69fd08435d

Download Submit
C:\Windows\system\iOhPgqA.exe

Filesize
2.6MB

MD5
90cb64e734649c512a253bcfbadfae01

SHA1
4bd900e48b6c216a51e7b563378d501995c859a3

SHA256
4febcb02c0ffb4d1f8be86013c76f484b5f67b75dc2dcf4247b6abaa0a3ca496

SHA512
f4beaba701ad4b731dab8f8fc9334062359b822809da90817fbfba6326eee2ddcb3a61ba799375d149010a192a21827784e90192ff2ab7f20277bb73a0cf89d0

Download Submit
C:\Windows\system\iphcczV.exe

Filesize
2.6MB

MD5
d1360572019ce3006c89ffa127899a63

SHA1
2c4d6503cd7ed9aeaafbafca65ff8b41537f59cf

SHA256
25d3eb11a35a824c3b4468e285e33e70efb3816e09a8cf47265536c45ca74b21

SHA512
aa49d7fe7505b594f40d7c9a7b7d75ec40d747b38a52d11488fe22889f633ecfb9ba42d60d1d6a3f72474655a3cc00cd8ea83d0f0aad5d0a8cc7eda123453d9e

Download Submit
C:\Windows\system\lSBVIlg.exe

Filesize
2.6MB

MD5
14079c98ba15f49b9d110e6d10dd1dd3

SHA1
2e761703b97f9b7d14d2810473919ea63536ff33

SHA256
7ae7085e1e26dee36bcac6c870391ca361b282286952616db5e9899556c22f16

SHA512
2696ff21e11b9bf71d8cc04441d35373bc0a52a6523f19e59471542b467dd5f1db58df7b1fef4fd9ee29ebfd41aef4e9fd0aefe577433c480694ea619180b0a3

Download Submit
C:\Windows\system\mQUBlvv.exe

Filesize
2.6MB

MD5
164815ed584762b41fdae9efc6ed51bc

SHA1
5997e18d55862ce0efb146dcc722e9b441630cc1

SHA256
610faf8e88bf92f0288b2313a4ac21fc3d1537aa901aa36baf749310b7ea1244

SHA512
688a656cb2970f81d7ec61578ebb5279e8f1ef6db08d00a16882df6877582f0e8cbd7d21ebc9a1550e0981d6e4ce574b5db1c02dc8af87da815969d45591fcdb

Download Submit
C:\Windows\system\mXKNWhu.exe

Filesize
2.6MB

MD5
c0fcd6c39d77f92c1877e4300c93edda

SHA1
c9241825dd48a13d57f37f96ce802bce48e0ccef

SHA256
c50e34c789a11f49a2840ebd7b3229df8605cf3fc83333d0ba898dca30148ce8

SHA512
a587ac3fd47b0bba27a13cc9f335d7ebbc82ce0bf666ee90895f8a7b4f15cc6a3d7a5dd7694768fde492d8a0d60b324bb0c2921d46e3e0e5bc4a7849943ce8db

Download Submit
C:\Windows\system\nLCqzyD.exe

Filesize
2.6MB

MD5
0461f6ee790d2b7b99bbb71f8933e728

SHA1
d72034f444121243aab6047aa9fa60f69f8b4d7b

SHA256
e7b968f30ef6a0daebfdb452f752479090eb72747b3c5c00cfcf6a5e53b3ed58

SHA512
85ebb1fac833ec51a90b71db152860aedce3e6dfec68ba0c442e0db538d267c0903f3c906bbd775777e50bc30ddb2c7ff1eb5d6a7afa9547e1e7b09b26742404

Download Submit
C:\Windows\system\qjVQmii.exe

Filesize
2.6MB

MD5
9b4ad69abc52cb9de5105aedd9eba3d6

SHA1
46becf061ad92ba5c21a13e3812f4aacf801a959

SHA256
960bd9eddd4b2df7dd0af3e3d534722159db4bd113f185790e3812e8dc565469

SHA512
3c1937160d9ae1ee38ec0d90c141e5b8afd4add415572ed44440081d6d61635a1cb8af1912c969e77fffb8637982979bd65f1bf045b1193665b510ab30633dbb

Download Submit
C:\Windows\system\sGYMawr.exe

Filesize
2.6MB

MD5
c78d2da4359e9363d875d65656c4c446

SHA1
ba181faa32a982f8bb8f2cf536050b4dced74f4d

SHA256
dc545552f7fe5a35f3d530fff6a3b102b5334cb6418b59dae79e7ae9c73cd254

SHA512
c0e2664bebf311190e771d771ed85e8869979dd3e7ff5947dff1fb5ff30f309b5beb2354649f9d445ac0b38ef2eac37ffae128b688c2826e9086df0ee13e7d69

Download Submit
C:\Windows\system\vbyLkfj.exe

Filesize
2.6MB

MD5
681ebe245e6ae3556962e8ab6c446f88

SHA1
570d3b1001599e5976d1d86acaf52fcbde38989c

SHA256
f2034021848bb3b85222b0ddb07c3d4a2fd9007bff6473a211de864f110bbd26

SHA512
a8d196a4ade81d6c9bb2223b74d6b317941de3532258394168026f5ebfe188b06bd5fc19765c2709c880d87008db89dfd2052492499ec204ee231b7b46307db9

Download Submit
\Windows\system\JvOUOkM.exe

Filesize
2.6MB

MD5
43d3ba99072f7e6b6943f8f91737bd76

SHA1
84b8b6f5b02577b56eba37f4c05179b45cc4af93

SHA256
c48fd9755c102f559de656f2f41f400e594cb1565cd27e363e0ecc0cbb2497d8

SHA512
4bab73873e80da308dc4f18b3a4b078445d35557309d3443b4a231ad4b1951bfcdb8fa118dcf1835ad48a822ee5b1d1b4ab42e34902766ca780e7716f3f1f463

Download Submit
memory/1852-7119-0x000000013FB50000-0x000000013FF46000-memory.dmp

Filesize
4.0MB

Download
memory/1852-165-0x000000013FB50000-0x000000013FF46000-memory.dmp

Filesize
4.0MB

Download
memory/2284-142-0x000000013F2A0000-0x000000013F696000-memory.dmp

Filesize
4.0MB

Download
memory/2348-140-0x000000013FE40000-0x0000000140236000-memory.dmp

Filesize
4.0MB

Download
memory/2396-152-0x000000013F510000-0x000000013F906000-memory.dmp

Filesize
4.0MB

Download
memory/2452-149-0x000000013F810000-0x000000013FC06000-memory.dmp

Filesize
4.0MB

Download
memory/2452-7106-0x000000013F810000-0x000000013FC06000-memory.dmp

Filesize
4.0MB

Download
memory/2476-154-0x000000013F250000-0x000000013F646000-memory.dmp

Filesize
4.0MB

Download
memory/2476-7108-0x000000013F250000-0x000000013F646000-memory.dmp

Filesize
4.0MB

Download
memory/2508-138-0x000007FEF57D0000-0x000007FEF616D000-memory.dmp

Filesize
9.6MB

Download
memory/2508-136-0x000007FEF57D0000-0x000007FEF616D000-memory.dmp

Filesize
9.6MB

Download
memory/2508-17-0x000007FEF5A8E000-0x000007FEF5A8F000-memory.dmp

Filesize
4KB

Download
memory/2508-130-0x000000001B670000-0x000000001B952000-memory.dmp

Filesize
2.9MB

Download
memory/2508-131-0x0000000001E00000-0x0000000001E08000-memory.dmp

Filesize
32KB

Download
memory/2508-133-0x000007FEF57D0000-0x000007FEF616D000-memory.dmp

Filesize
9.6MB

Download
memory/2508-2181-0x000007FEF57D0000-0x000007FEF616D000-memory.dmp

Filesize
9.6MB

Download
memory/2544-7093-0x000000013F420000-0x000000013F816000-memory.dmp

Filesize
4.0MB

Download
memory/2544-4646-0x000000013F420000-0x000000013F816000-memory.dmp

Filesize
4.0MB

Download
memory/2544-15-0x000000013F420000-0x000000013F816000-memory.dmp

Filesize
4.0MB

Download
memory/2604-156-0x000000013FBD0000-0x000000013FFC6000-memory.dmp

Filesize
4.0MB

Download
memory/2604-7107-0x000000013FBD0000-0x000000013FFC6000-memory.dmp

Filesize
4.0MB

Download
memory/2680-169-0x000000013FA30000-0x000000013FE26000-memory.dmp

Filesize
4.0MB

Download
memory/2680-7099-0x000000013FA30000-0x000000013FE26000-memory.dmp

Filesize
4.0MB

Download
memory/2700-153-0x0000000003320000-0x0000000003716000-memory.dmp

Filesize
4.0MB

Download
memory/2700-0-0x00000000000F0000-0x0000000000100000-memory.dmp

Filesize
64KB

Download
memory/2700-157-0x0000000003320000-0x0000000003716000-memory.dmp

Filesize
4.0MB

Download
memory/2700-166-0x000000013F840000-0x000000013FC36000-memory.dmp

Filesize
4.0MB

Download
memory/2700-141-0x0000000003320000-0x0000000003716000-memory.dmp

Filesize
4.0MB

Download
memory/2700-155-0x000000013FBD0000-0x000000013FFC6000-memory.dmp

Filesize
4.0MB

Download
memory/2700-6-0x0000000003320000-0x0000000003716000-memory.dmp

Filesize
4.0MB

Download
memory/2700-145-0x000000013F810000-0x000000013FC06000-memory.dmp

Filesize
4.0MB

Download
memory/2700-1-0x000000013F330000-0x000000013F726000-memory.dmp

Filesize
4.0MB

Download
memory/2700-143-0x000000013F8A0000-0x000000013FC96000-memory.dmp

Filesize
4.0MB

Download
memory/2700-139-0x000000013FE40000-0x0000000140236000-memory.dmp

Filesize
4.0MB

Download
memory/2700-164-0x000000013FB50000-0x000000013FF46000-memory.dmp

Filesize
4.0MB

Download
memory/2700-151-0x0000000003320000-0x0000000003716000-memory.dmp

Filesize
4.0MB

Download
memory/2700-168-0x000000013FA30000-0x000000013FE26000-memory.dmp

Filesize
4.0MB

Download
memory/2708-167-0x000000013F840000-0x000000013FC36000-memory.dmp

Filesize
4.0MB

Download
memory/2708-7112-0x000000013F840000-0x000000013FC36000-memory.dmp

Filesize
4.0MB

Download
memory/2760-144-0x000000013F8A0000-0x000000013FC96000-memory.dmp

Filesize
4.0MB

Download
memory/2892-162-0x000000013F090000-0x000000013F486000-memory.dmp

Filesize
4.0MB

Download
memory/2892-7115-0x000000013F090000-0x000000013F486000-memory.dmp

Filesize
4.0MB

Download