xmrig | 82ac6f28a1de7a8f0c92a53cc3e0b3cf1bde6fd8ae7400360cc840c9a2be9a55

Analysis

max time kernel
135s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
09-05-2024 13:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3cf5848c4c25b27d11280b8a349ea1a0_NeikiAnalytics.exe
Size

1.6MB
MD5

3cf5848c4c25b27d11280b8a349ea1a0
SHA1

0bb0286762d1bc70b2c35571bb0990b3364aa10e
SHA256

82ac6f28a1de7a8f0c92a53cc3e0b3cf1bde6fd8ae7400360cc840c9a2be9a55
SHA512

2787cc5e142df988b36148730f419b579bf426dcf3f70749bff612fc8bef030d45408b168e464d3d72031910cb840936ac4ff780e0bdf80274a06a0628118aba
SSDEEP

24576:zv3/fTLF671TilQFG4P5PMkibTJH+2Q/ynKeWYlZ3pBjqlx7TovQmVV4dThen9zD:Lz071uv4BPMkibTIA5lCx7kvRWa4pXYz

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 39 IoCs

miner

resource	yara_rule
behavioral2/memory/1028-50-0x00007FF66A2F0000-0x00007FF66A6E2000-memory.dmp	xmrig
behavioral2/memory/3968-35-0x00007FF6280A0000-0x00007FF628492000-memory.dmp	xmrig
behavioral2/memory/996-421-0x00007FF75B000000-0x00007FF75B3F2000-memory.dmp	xmrig
behavioral2/memory/968-452-0x00007FF6F1F30000-0x00007FF6F2322000-memory.dmp	xmrig
behavioral2/memory/4820-512-0x00007FF64B730000-0x00007FF64BB22000-memory.dmp	xmrig
behavioral2/memory/4464-475-0x00007FF69AAA0000-0x00007FF69AE92000-memory.dmp	xmrig
behavioral2/memory/3688-455-0x00007FF707A30000-0x00007FF707E22000-memory.dmp	xmrig
behavioral2/memory/4560-420-0x00007FF7AD7E0000-0x00007FF7ADBD2000-memory.dmp	xmrig
behavioral2/memory/3808-351-0x00007FF6D1620000-0x00007FF6D1A12000-memory.dmp	xmrig
behavioral2/memory/2804-327-0x00007FF78A510000-0x00007FF78A902000-memory.dmp	xmrig
behavioral2/memory/1920-279-0x00007FF74A1A0000-0x00007FF74A592000-memory.dmp	xmrig
behavioral2/memory/1660-280-0x00007FF732370000-0x00007FF732762000-memory.dmp	xmrig
behavioral2/memory/3152-248-0x00007FF60BDD0000-0x00007FF60C1C2000-memory.dmp	xmrig
behavioral2/memory/2016-230-0x00007FF799A00000-0x00007FF799DF2000-memory.dmp	xmrig
behavioral2/memory/4264-225-0x00007FF6BC840000-0x00007FF6BCC32000-memory.dmp	xmrig
behavioral2/memory/4848-195-0x00007FF691260000-0x00007FF691652000-memory.dmp	xmrig
behavioral2/memory/1456-164-0x00007FF667CF0000-0x00007FF6680E2000-memory.dmp	xmrig
behavioral2/memory/3112-144-0x00007FF743EB0000-0x00007FF7442A2000-memory.dmp	xmrig
behavioral2/memory/4912-131-0x00007FF7ECB50000-0x00007FF7ECF42000-memory.dmp	xmrig
behavioral2/memory/3636-77-0x00007FF7541B0000-0x00007FF7545A2000-memory.dmp	xmrig
behavioral2/memory/4612-20-0x00007FF62F9B0000-0x00007FF62FDA2000-memory.dmp	xmrig
behavioral2/memory/4908-26-0x00007FF799F90000-0x00007FF79A382000-memory.dmp	xmrig
behavioral2/memory/4144-5454-0x00007FF6CEC40000-0x00007FF6CF032000-memory.dmp	xmrig
behavioral2/memory/2756-5458-0x00007FF684990000-0x00007FF684D82000-memory.dmp	xmrig
behavioral2/memory/4908-5899-0x00007FF799F90000-0x00007FF79A382000-memory.dmp	xmrig
behavioral2/memory/996-5929-0x00007FF75B000000-0x00007FF75B3F2000-memory.dmp	xmrig
behavioral2/memory/1028-5907-0x00007FF66A2F0000-0x00007FF66A6E2000-memory.dmp	xmrig
behavioral2/memory/4464-6264-0x00007FF69AAA0000-0x00007FF69AE92000-memory.dmp	xmrig
behavioral2/memory/1660-6335-0x00007FF732370000-0x00007FF732762000-memory.dmp	xmrig
behavioral2/memory/4820-6336-0x00007FF64B730000-0x00007FF64BB22000-memory.dmp	xmrig
behavioral2/memory/4560-6350-0x00007FF7AD7E0000-0x00007FF7ADBD2000-memory.dmp	xmrig
behavioral2/memory/1920-6340-0x00007FF74A1A0000-0x00007FF74A592000-memory.dmp	xmrig
behavioral2/memory/4848-6315-0x00007FF691260000-0x00007FF691652000-memory.dmp	xmrig
behavioral2/memory/3808-6311-0x00007FF6D1620000-0x00007FF6D1A12000-memory.dmp	xmrig
behavioral2/memory/2804-6317-0x00007FF78A510000-0x00007FF78A902000-memory.dmp	xmrig
behavioral2/memory/4912-6212-0x00007FF7ECB50000-0x00007FF7ECF42000-memory.dmp	xmrig
behavioral2/memory/968-6134-0x00007FF6F1F30000-0x00007FF6F2322000-memory.dmp	xmrig
behavioral2/memory/2756-6116-0x00007FF684990000-0x00007FF684D82000-memory.dmp	xmrig
behavioral2/memory/3688-6113-0x00007FF707A30000-0x00007FF707E22000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
228	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
4612	kAHAyHY.exe
4908	hASgGUr.exe
3968	LwLItxf.exe
1028	gIOJBbp.exe
996	FxFIkgf.exe
4144	KVFGJGf.exe
968	kMpLWmM.exe
3636	kfqhwTZ.exe
2756	SGuYrlK.exe
3688	CHVJLRX.exe
4912	wKiMVhr.exe
3112	lQSaXfS.exe
1456	cajPCtH.exe
4464	igwqQkE.exe
4848	HEAnsKa.exe
4264	WalIMTI.exe
2016	YeEjWyB.exe
3152	KrvGzZH.exe
4820	qLEgdzq.exe
1920	ZfiiPoV.exe
1660	cZEhAWM.exe
2804	vahGQFl.exe
3808	BzxQeGn.exe
4560	dzhtuWK.exe
908	lASCXOR.exe
916	iqclcsw.exe
2656	YeqFiEQ.exe
4484	WIbfCNF.exe
1848	tvGEHan.exe
364	ySgPCny.exe
3240	SFcZkPj.exe
2128	rhNPbuq.exe
2800	YMOEYJB.exe
4712	xssTYuO.exe
4776	brrkZhn.exe
4696	JryaRQB.exe
3964	yyTITZL.exe
4744	AiXIlSi.exe
4300	bGDRVDA.exe
4468	kBKSoOX.exe
4188	qWjqUAG.exe
3396	nQzZQKE.exe
3940	fVmrSvt.exe
712	BrMrWOs.exe
4940	YmptEFz.exe
3304	SLunbcq.exe
3668	jssOPsK.exe
3948	tPvsjTU.exe
1432	mbQsajU.exe
4472	rZQRxXb.exe
4532	uzZuFud.exe
4392	jHKXqPJ.exe
3788	MHbIrjc.exe
2932	awQjvis.exe
4600	yUIDeYf.exe
4876	rctALcG.exe
1536	pgrKWQG.exe
4788	noQcCpz.exe
4732	HrgZYPs.exe
1960	bZshFdz.exe
2364	oWWDptu.exe
1400	zSEaVZO.exe
4636	UdxuBaw.exe
5132	WXvHrPA.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1196-0-0x00007FF6C14D0000-0x00007FF6C18C2000-memory.dmp	upx
behavioral2/files/0x000800000002342d-5.dat	upx
behavioral2/files/0x0007000000023431-8.dat	upx
behavioral2/files/0x0007000000023432-7.dat	upx
behavioral2/files/0x0007000000023433-25.dat	upx
behavioral2/files/0x0007000000023436-41.dat	upx
behavioral2/memory/1028-50-0x00007FF66A2F0000-0x00007FF66A6E2000-memory.dmp	upx
behavioral2/files/0x0007000000023438-49.dat	upx
behavioral2/files/0x0007000000023437-47.dat	upx
behavioral2/files/0x0007000000023434-38.dat	upx
behavioral2/memory/3968-35-0x00007FF6280A0000-0x00007FF628492000-memory.dmp	upx
behavioral2/files/0x0007000000023435-28.dat	upx
behavioral2/files/0x0007000000023439-52.dat	upx
behavioral2/files/0x000700000002343c-68.dat	upx
behavioral2/files/0x0007000000023441-122.dat	upx
behavioral2/memory/996-421-0x00007FF75B000000-0x00007FF75B3F2000-memory.dmp	upx
behavioral2/memory/968-452-0x00007FF6F1F30000-0x00007FF6F2322000-memory.dmp	upx
behavioral2/memory/4820-512-0x00007FF64B730000-0x00007FF64BB22000-memory.dmp	upx
behavioral2/memory/4464-475-0x00007FF69AAA0000-0x00007FF69AE92000-memory.dmp	upx
behavioral2/memory/3688-455-0x00007FF707A30000-0x00007FF707E22000-memory.dmp	upx
behavioral2/memory/4560-420-0x00007FF7AD7E0000-0x00007FF7ADBD2000-memory.dmp	upx
behavioral2/memory/3808-351-0x00007FF6D1620000-0x00007FF6D1A12000-memory.dmp	upx
behavioral2/memory/2804-327-0x00007FF78A510000-0x00007FF78A902000-memory.dmp	upx
behavioral2/memory/1920-279-0x00007FF74A1A0000-0x00007FF74A592000-memory.dmp	upx
behavioral2/memory/1660-280-0x00007FF732370000-0x00007FF732762000-memory.dmp	upx
behavioral2/memory/3152-248-0x00007FF60BDD0000-0x00007FF60C1C2000-memory.dmp	upx
behavioral2/memory/2016-230-0x00007FF799A00000-0x00007FF799DF2000-memory.dmp	upx
behavioral2/memory/4264-225-0x00007FF6BC840000-0x00007FF6BCC32000-memory.dmp	upx
behavioral2/memory/4848-195-0x00007FF691260000-0x00007FF691652000-memory.dmp	upx
behavioral2/files/0x0007000000023452-191.dat	upx
behavioral2/files/0x000700000002344a-190.dat	upx
behavioral2/files/0x0007000000023449-186.dat	upx
behavioral2/files/0x0007000000023448-180.dat	upx
behavioral2/files/0x0007000000023442-177.dat	upx
behavioral2/files/0x0007000000023446-172.dat	upx
behavioral2/files/0x0007000000023445-167.dat	upx
behavioral2/files/0x0007000000023451-160.dat	upx
behavioral2/files/0x0007000000023450-158.dat	upx
behavioral2/files/0x000700000002344f-155.dat	upx
behavioral2/files/0x0007000000023443-150.dat	upx
behavioral2/files/0x0007000000023447-171.dat	upx
behavioral2/files/0x0007000000023440-148.dat	upx
behavioral2/files/0x000700000002343f-170.dat	upx
behavioral2/memory/1456-164-0x00007FF667CF0000-0x00007FF6680E2000-memory.dmp	upx
behavioral2/memory/3112-144-0x00007FF743EB0000-0x00007FF7442A2000-memory.dmp	upx
behavioral2/files/0x000700000002344c-137.dat	upx
behavioral2/files/0x000700000002344b-135.dat	upx
behavioral2/memory/4912-131-0x00007FF7ECB50000-0x00007FF7ECF42000-memory.dmp	upx
behavioral2/files/0x0007000000023444-128.dat	upx
behavioral2/files/0x000700000002343d-125.dat	upx
behavioral2/files/0x000700000002343a-115.dat	upx
behavioral2/files/0x000700000002344e-147.dat	upx
behavioral2/files/0x000700000002344d-146.dat	upx
behavioral2/memory/2756-107-0x00007FF684990000-0x00007FF684D82000-memory.dmp	upx
behavioral2/files/0x000700000002343b-98.dat	upx
behavioral2/files/0x000700000002343e-110.dat	upx
behavioral2/memory/3636-77-0x00007FF7541B0000-0x00007FF7545A2000-memory.dmp	upx
behavioral2/memory/4144-53-0x00007FF6CEC40000-0x00007FF6CF032000-memory.dmp	upx
behavioral2/memory/4612-20-0x00007FF62F9B0000-0x00007FF62FDA2000-memory.dmp	upx
behavioral2/memory/4908-26-0x00007FF799F90000-0x00007FF79A382000-memory.dmp	upx
behavioral2/memory/4144-5454-0x00007FF6CEC40000-0x00007FF6CF032000-memory.dmp	upx
behavioral2/memory/2756-5458-0x00007FF684990000-0x00007FF684D82000-memory.dmp	upx
behavioral2/memory/4908-5899-0x00007FF799F90000-0x00007FF79A382000-memory.dmp	upx
behavioral2/memory/996-5929-0x00007FF75B000000-0x00007FF75B3F2000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\hgTgXnx.exe	3cf5848c4c25b27d11280b8a349ea1a0_NeikiAnalytics.exe
File created	C:\Windows\System\azJqIWY.exe	3cf5848c4c25b27d11280b8a349ea1a0_NeikiAnalytics.exe
File created	C:\Windows\System\yHwjaes.exe	3cf5848c4c25b27d11280b8a349ea1a0_NeikiAnalytics.exe
File created	C:\Windows\System\SwMpiEi.exe	3cf5848c4c25b27d11280b8a349ea1a0_NeikiAnalytics.exe
File created	C:\Windows\System\AcOFzti.exe	3cf5848c4c25b27d11280b8a349ea1a0_NeikiAnalytics.exe
File created	C:\Windows\System\URTwbjA.exe	3cf5848c4c25b27d11280b8a349ea1a0_NeikiAnalytics.exe
File created	C:\Windows\System\YLVpSpZ.exe	3cf5848c4c25b27d11280b8a349ea1a0_NeikiAnalytics.exe
File created	C:\Windows\System\AgohXGp.exe	3cf5848c4c25b27d11280b8a349ea1a0_NeikiAnalytics.exe
File created	C:\Windows\System\EiezHwx.exe	3cf5848c4c25b27d11280b8a349ea1a0_NeikiAnalytics.exe
File created	C:\Windows\System\HSMNZas.exe	3cf5848c4c25b27d11280b8a349ea1a0_NeikiAnalytics.exe
File created	C:\Windows\System\KoZqtOI.exe	3cf5848c4c25b27d11280b8a349ea1a0_NeikiAnalytics.exe
File created	C:\Windows\System\nqsjnBm.exe	3cf5848c4c25b27d11280b8a349ea1a0_NeikiAnalytics.exe
File created	C:\Windows\System\hCSeciO.exe	3cf5848c4c25b27d11280b8a349ea1a0_NeikiAnalytics.exe
File created	C:\Windows\System\MTXUmdV.exe	3cf5848c4c25b27d11280b8a349ea1a0_NeikiAnalytics.exe
File created	C:\Windows\System\SGYhLyf.exe	3cf5848c4c25b27d11280b8a349ea1a0_NeikiAnalytics.exe
File created	C:\Windows\System\CpQGwZo.exe	3cf5848c4c25b27d11280b8a349ea1a0_NeikiAnalytics.exe
File created	C:\Windows\System\oLcwnva.exe	3cf5848c4c25b27d11280b8a349ea1a0_NeikiAnalytics.exe
File created	C:\Windows\System\oYhYeic.exe	3cf5848c4c25b27d11280b8a349ea1a0_NeikiAnalytics.exe
File created	C:\Windows\System\CyuPdVb.exe	3cf5848c4c25b27d11280b8a349ea1a0_NeikiAnalytics.exe
File created	C:\Windows\System\hRCQeXo.exe	3cf5848c4c25b27d11280b8a349ea1a0_NeikiAnalytics.exe
File created	C:\Windows\System\DyRlVzv.exe	3cf5848c4c25b27d11280b8a349ea1a0_NeikiAnalytics.exe
File created	C:\Windows\System\ypXyHRK.exe	3cf5848c4c25b27d11280b8a349ea1a0_NeikiAnalytics.exe
File created	C:\Windows\System\CVrSENJ.exe	3cf5848c4c25b27d11280b8a349ea1a0_NeikiAnalytics.exe
File created	C:\Windows\System\aRJsuGj.exe	3cf5848c4c25b27d11280b8a349ea1a0_NeikiAnalytics.exe
File created	C:\Windows\System\yWMnSHr.exe	3cf5848c4c25b27d11280b8a349ea1a0_NeikiAnalytics.exe
File created	C:\Windows\System\DtuRlFK.exe	3cf5848c4c25b27d11280b8a349ea1a0_NeikiAnalytics.exe
File created	C:\Windows\System\gqaXaUs.exe	3cf5848c4c25b27d11280b8a349ea1a0_NeikiAnalytics.exe
File created	C:\Windows\System\LHFnHak.exe	3cf5848c4c25b27d11280b8a349ea1a0_NeikiAnalytics.exe
File created	C:\Windows\System\MdtneUN.exe	3cf5848c4c25b27d11280b8a349ea1a0_NeikiAnalytics.exe
File created	C:\Windows\System\RUAPCrC.exe	3cf5848c4c25b27d11280b8a349ea1a0_NeikiAnalytics.exe
File created	C:\Windows\System\QcRGwzd.exe	3cf5848c4c25b27d11280b8a349ea1a0_NeikiAnalytics.exe
File created	C:\Windows\System\KirkSvN.exe	3cf5848c4c25b27d11280b8a349ea1a0_NeikiAnalytics.exe
File created	C:\Windows\System\PximSeb.exe	3cf5848c4c25b27d11280b8a349ea1a0_NeikiAnalytics.exe
File created	C:\Windows\System\moHHkyV.exe	3cf5848c4c25b27d11280b8a349ea1a0_NeikiAnalytics.exe
File created	C:\Windows\System\nDEDjQt.exe	3cf5848c4c25b27d11280b8a349ea1a0_NeikiAnalytics.exe
File created	C:\Windows\System\KFXrZaI.exe	3cf5848c4c25b27d11280b8a349ea1a0_NeikiAnalytics.exe
File created	C:\Windows\System\dvZynGD.exe	3cf5848c4c25b27d11280b8a349ea1a0_NeikiAnalytics.exe
File created	C:\Windows\System\vKayASQ.exe	3cf5848c4c25b27d11280b8a349ea1a0_NeikiAnalytics.exe
File created	C:\Windows\System\oQbaqsz.exe	3cf5848c4c25b27d11280b8a349ea1a0_NeikiAnalytics.exe
File created	C:\Windows\System\vUGKecX.exe	3cf5848c4c25b27d11280b8a349ea1a0_NeikiAnalytics.exe
File created	C:\Windows\System\uEcMlzO.exe	3cf5848c4c25b27d11280b8a349ea1a0_NeikiAnalytics.exe
File created	C:\Windows\System\zuRXwdF.exe	3cf5848c4c25b27d11280b8a349ea1a0_NeikiAnalytics.exe
File created	C:\Windows\System\JltcQsx.exe	3cf5848c4c25b27d11280b8a349ea1a0_NeikiAnalytics.exe
File created	C:\Windows\System\UUFWrOD.exe	3cf5848c4c25b27d11280b8a349ea1a0_NeikiAnalytics.exe
File created	C:\Windows\System\apdpBuG.exe	3cf5848c4c25b27d11280b8a349ea1a0_NeikiAnalytics.exe
File created	C:\Windows\System\WsJBzlh.exe	3cf5848c4c25b27d11280b8a349ea1a0_NeikiAnalytics.exe
File created	C:\Windows\System\rUewRbD.exe	3cf5848c4c25b27d11280b8a349ea1a0_NeikiAnalytics.exe
File created	C:\Windows\System\KgzVwUi.exe	3cf5848c4c25b27d11280b8a349ea1a0_NeikiAnalytics.exe
File created	C:\Windows\System\xrwbQqi.exe	3cf5848c4c25b27d11280b8a349ea1a0_NeikiAnalytics.exe
File created	C:\Windows\System\sFRIvzC.exe	3cf5848c4c25b27d11280b8a349ea1a0_NeikiAnalytics.exe
File created	C:\Windows\System\PTQRABd.exe	3cf5848c4c25b27d11280b8a349ea1a0_NeikiAnalytics.exe
File created	C:\Windows\System\YtxHQHJ.exe	3cf5848c4c25b27d11280b8a349ea1a0_NeikiAnalytics.exe
File created	C:\Windows\System\GIndpVq.exe	3cf5848c4c25b27d11280b8a349ea1a0_NeikiAnalytics.exe
File created	C:\Windows\System\OUCTvUq.exe	3cf5848c4c25b27d11280b8a349ea1a0_NeikiAnalytics.exe
File created	C:\Windows\System\YdIquWG.exe	3cf5848c4c25b27d11280b8a349ea1a0_NeikiAnalytics.exe
File created	C:\Windows\System\PaPoGSJ.exe	3cf5848c4c25b27d11280b8a349ea1a0_NeikiAnalytics.exe
File created	C:\Windows\System\bwsWuXl.exe	3cf5848c4c25b27d11280b8a349ea1a0_NeikiAnalytics.exe
File created	C:\Windows\System\PwavqdB.exe	3cf5848c4c25b27d11280b8a349ea1a0_NeikiAnalytics.exe
File created	C:\Windows\System\UOBXyOX.exe	3cf5848c4c25b27d11280b8a349ea1a0_NeikiAnalytics.exe
File created	C:\Windows\System\eEIpUGW.exe	3cf5848c4c25b27d11280b8a349ea1a0_NeikiAnalytics.exe
File created	C:\Windows\System\aIZNITD.exe	3cf5848c4c25b27d11280b8a349ea1a0_NeikiAnalytics.exe
File created	C:\Windows\System\rqyYWSV.exe	3cf5848c4c25b27d11280b8a349ea1a0_NeikiAnalytics.exe
File created	C:\Windows\System\eKqbEVn.exe	3cf5848c4c25b27d11280b8a349ea1a0_NeikiAnalytics.exe
File created	C:\Windows\System\WaKyrqe.exe	3cf5848c4c25b27d11280b8a349ea1a0_NeikiAnalytics.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
228	powershell.exe
228	powershell.exe
228	powershell.exe
228	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	1196	3cf5848c4c25b27d11280b8a349ea1a0_NeikiAnalytics.exe
Token: SeLockMemoryPrivilege	1196	3cf5848c4c25b27d11280b8a349ea1a0_NeikiAnalytics.exe
Token: SeDebugPrivilege	228	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1196 wrote to memory of 228	1196	3cf5848c4c25b27d11280b8a349ea1a0_NeikiAnalytics.exe	86
PID 1196 wrote to memory of 228	1196	3cf5848c4c25b27d11280b8a349ea1a0_NeikiAnalytics.exe	86
PID 1196 wrote to memory of 4612	1196	3cf5848c4c25b27d11280b8a349ea1a0_NeikiAnalytics.exe	87
PID 1196 wrote to memory of 4612	1196	3cf5848c4c25b27d11280b8a349ea1a0_NeikiAnalytics.exe	87
PID 1196 wrote to memory of 4908	1196	3cf5848c4c25b27d11280b8a349ea1a0_NeikiAnalytics.exe	88
PID 1196 wrote to memory of 4908	1196	3cf5848c4c25b27d11280b8a349ea1a0_NeikiAnalytics.exe	88
PID 1196 wrote to memory of 3968	1196	3cf5848c4c25b27d11280b8a349ea1a0_NeikiAnalytics.exe	89
PID 1196 wrote to memory of 3968	1196	3cf5848c4c25b27d11280b8a349ea1a0_NeikiAnalytics.exe	89
PID 1196 wrote to memory of 1028	1196	3cf5848c4c25b27d11280b8a349ea1a0_NeikiAnalytics.exe	90
PID 1196 wrote to memory of 1028	1196	3cf5848c4c25b27d11280b8a349ea1a0_NeikiAnalytics.exe	90
PID 1196 wrote to memory of 996	1196	3cf5848c4c25b27d11280b8a349ea1a0_NeikiAnalytics.exe	91
PID 1196 wrote to memory of 996	1196	3cf5848c4c25b27d11280b8a349ea1a0_NeikiAnalytics.exe	91
PID 1196 wrote to memory of 4144	1196	3cf5848c4c25b27d11280b8a349ea1a0_NeikiAnalytics.exe	92
PID 1196 wrote to memory of 4144	1196	3cf5848c4c25b27d11280b8a349ea1a0_NeikiAnalytics.exe	92
PID 1196 wrote to memory of 968	1196	3cf5848c4c25b27d11280b8a349ea1a0_NeikiAnalytics.exe	93
PID 1196 wrote to memory of 968	1196	3cf5848c4c25b27d11280b8a349ea1a0_NeikiAnalytics.exe	93
PID 1196 wrote to memory of 3636	1196	3cf5848c4c25b27d11280b8a349ea1a0_NeikiAnalytics.exe	94
PID 1196 wrote to memory of 3636	1196	3cf5848c4c25b27d11280b8a349ea1a0_NeikiAnalytics.exe	94
PID 1196 wrote to memory of 2756	1196	3cf5848c4c25b27d11280b8a349ea1a0_NeikiAnalytics.exe	95
PID 1196 wrote to memory of 2756	1196	3cf5848c4c25b27d11280b8a349ea1a0_NeikiAnalytics.exe	95
PID 1196 wrote to memory of 3688	1196	3cf5848c4c25b27d11280b8a349ea1a0_NeikiAnalytics.exe	96
PID 1196 wrote to memory of 3688	1196	3cf5848c4c25b27d11280b8a349ea1a0_NeikiAnalytics.exe	96
PID 1196 wrote to memory of 3112	1196	3cf5848c4c25b27d11280b8a349ea1a0_NeikiAnalytics.exe	97
PID 1196 wrote to memory of 3112	1196	3cf5848c4c25b27d11280b8a349ea1a0_NeikiAnalytics.exe	97
PID 1196 wrote to memory of 4912	1196	3cf5848c4c25b27d11280b8a349ea1a0_NeikiAnalytics.exe	98
PID 1196 wrote to memory of 4912	1196	3cf5848c4c25b27d11280b8a349ea1a0_NeikiAnalytics.exe	98
PID 1196 wrote to memory of 1456	1196	3cf5848c4c25b27d11280b8a349ea1a0_NeikiAnalytics.exe	99
PID 1196 wrote to memory of 1456	1196	3cf5848c4c25b27d11280b8a349ea1a0_NeikiAnalytics.exe	99
PID 1196 wrote to memory of 2016	1196	3cf5848c4c25b27d11280b8a349ea1a0_NeikiAnalytics.exe	100
PID 1196 wrote to memory of 2016	1196	3cf5848c4c25b27d11280b8a349ea1a0_NeikiAnalytics.exe	100
PID 1196 wrote to memory of 4464	1196	3cf5848c4c25b27d11280b8a349ea1a0_NeikiAnalytics.exe	101
PID 1196 wrote to memory of 4464	1196	3cf5848c4c25b27d11280b8a349ea1a0_NeikiAnalytics.exe	101
PID 1196 wrote to memory of 1920	1196	3cf5848c4c25b27d11280b8a349ea1a0_NeikiAnalytics.exe	102
PID 1196 wrote to memory of 1920	1196	3cf5848c4c25b27d11280b8a349ea1a0_NeikiAnalytics.exe	102
PID 1196 wrote to memory of 4848	1196	3cf5848c4c25b27d11280b8a349ea1a0_NeikiAnalytics.exe	103
PID 1196 wrote to memory of 4848	1196	3cf5848c4c25b27d11280b8a349ea1a0_NeikiAnalytics.exe	103
PID 1196 wrote to memory of 4264	1196	3cf5848c4c25b27d11280b8a349ea1a0_NeikiAnalytics.exe	104
PID 1196 wrote to memory of 4264	1196	3cf5848c4c25b27d11280b8a349ea1a0_NeikiAnalytics.exe	104
PID 1196 wrote to memory of 3808	1196	3cf5848c4c25b27d11280b8a349ea1a0_NeikiAnalytics.exe	105
PID 1196 wrote to memory of 3808	1196	3cf5848c4c25b27d11280b8a349ea1a0_NeikiAnalytics.exe	105
PID 1196 wrote to memory of 3152	1196	3cf5848c4c25b27d11280b8a349ea1a0_NeikiAnalytics.exe	106
PID 1196 wrote to memory of 3152	1196	3cf5848c4c25b27d11280b8a349ea1a0_NeikiAnalytics.exe	106
PID 1196 wrote to memory of 2656	1196	3cf5848c4c25b27d11280b8a349ea1a0_NeikiAnalytics.exe	107
PID 1196 wrote to memory of 2656	1196	3cf5848c4c25b27d11280b8a349ea1a0_NeikiAnalytics.exe	107
PID 1196 wrote to memory of 4820	1196	3cf5848c4c25b27d11280b8a349ea1a0_NeikiAnalytics.exe	108
PID 1196 wrote to memory of 4820	1196	3cf5848c4c25b27d11280b8a349ea1a0_NeikiAnalytics.exe	108
PID 1196 wrote to memory of 1660	1196	3cf5848c4c25b27d11280b8a349ea1a0_NeikiAnalytics.exe	109
PID 1196 wrote to memory of 1660	1196	3cf5848c4c25b27d11280b8a349ea1a0_NeikiAnalytics.exe	109
PID 1196 wrote to memory of 2804	1196	3cf5848c4c25b27d11280b8a349ea1a0_NeikiAnalytics.exe	110
PID 1196 wrote to memory of 2804	1196	3cf5848c4c25b27d11280b8a349ea1a0_NeikiAnalytics.exe	110
PID 1196 wrote to memory of 4560	1196	3cf5848c4c25b27d11280b8a349ea1a0_NeikiAnalytics.exe	111
PID 1196 wrote to memory of 4560	1196	3cf5848c4c25b27d11280b8a349ea1a0_NeikiAnalytics.exe	111
PID 1196 wrote to memory of 908	1196	3cf5848c4c25b27d11280b8a349ea1a0_NeikiAnalytics.exe	112
PID 1196 wrote to memory of 908	1196	3cf5848c4c25b27d11280b8a349ea1a0_NeikiAnalytics.exe	112
PID 1196 wrote to memory of 916	1196	3cf5848c4c25b27d11280b8a349ea1a0_NeikiAnalytics.exe	113
PID 1196 wrote to memory of 916	1196	3cf5848c4c25b27d11280b8a349ea1a0_NeikiAnalytics.exe	113
PID 1196 wrote to memory of 4484	1196	3cf5848c4c25b27d11280b8a349ea1a0_NeikiAnalytics.exe	114
PID 1196 wrote to memory of 4484	1196	3cf5848c4c25b27d11280b8a349ea1a0_NeikiAnalytics.exe	114
PID 1196 wrote to memory of 1848	1196	3cf5848c4c25b27d11280b8a349ea1a0_NeikiAnalytics.exe	115
PID 1196 wrote to memory of 1848	1196	3cf5848c4c25b27d11280b8a349ea1a0_NeikiAnalytics.exe	115
PID 1196 wrote to memory of 364	1196	3cf5848c4c25b27d11280b8a349ea1a0_NeikiAnalytics.exe	116
PID 1196 wrote to memory of 364	1196	3cf5848c4c25b27d11280b8a349ea1a0_NeikiAnalytics.exe	116
PID 1196 wrote to memory of 3240	1196	3cf5848c4c25b27d11280b8a349ea1a0_NeikiAnalytics.exe	117
PID 1196 wrote to memory of 3240	1196	3cf5848c4c25b27d11280b8a349ea1a0_NeikiAnalytics.exe	117

C:\Users\Admin\AppData\Local\Temp\3cf5848c4c25b27d11280b8a349ea1a0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\3cf5848c4c25b27d11280b8a349ea1a0_NeikiAnalytics.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1196
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:228
- C:\Windows\System\kAHAyHY.exe
  C:\Windows\System\kAHAyHY.exe
  2⤵
  - Executes dropped EXE
  PID:4612
- C:\Windows\System\hASgGUr.exe
  C:\Windows\System\hASgGUr.exe
  2⤵
  - Executes dropped EXE
  PID:4908
- C:\Windows\System\LwLItxf.exe
  C:\Windows\System\LwLItxf.exe
  2⤵
  - Executes dropped EXE
  PID:3968
- C:\Windows\System\gIOJBbp.exe
  C:\Windows\System\gIOJBbp.exe
  2⤵
  - Executes dropped EXE
  PID:1028
- C:\Windows\System\FxFIkgf.exe
  C:\Windows\System\FxFIkgf.exe
  2⤵
  - Executes dropped EXE
  PID:996
- C:\Windows\System\KVFGJGf.exe
  C:\Windows\System\KVFGJGf.exe
  2⤵
  - Executes dropped EXE
  PID:4144
- C:\Windows\System\kMpLWmM.exe
  C:\Windows\System\kMpLWmM.exe
  2⤵
  - Executes dropped EXE
  PID:968
- C:\Windows\System\kfqhwTZ.exe
  C:\Windows\System\kfqhwTZ.exe
  2⤵
  - Executes dropped EXE
  PID:3636
- C:\Windows\System\SGuYrlK.exe
  C:\Windows\System\SGuYrlK.exe
  2⤵
  - Executes dropped EXE
  PID:2756
- C:\Windows\System\CHVJLRX.exe
  C:\Windows\System\CHVJLRX.exe
  2⤵
  - Executes dropped EXE
  PID:3688
- C:\Windows\System\lQSaXfS.exe
  C:\Windows\System\lQSaXfS.exe
  2⤵
  - Executes dropped EXE
  PID:3112
- C:\Windows\System\wKiMVhr.exe
  C:\Windows\System\wKiMVhr.exe
  2⤵
  - Executes dropped EXE
  PID:4912
- C:\Windows\System\cajPCtH.exe
  C:\Windows\System\cajPCtH.exe
  2⤵
  - Executes dropped EXE
  PID:1456
- C:\Windows\System\YeEjWyB.exe
  C:\Windows\System\YeEjWyB.exe
  2⤵
  - Executes dropped EXE
  PID:2016
- C:\Windows\System\igwqQkE.exe
  C:\Windows\System\igwqQkE.exe
  2⤵
  - Executes dropped EXE
  PID:4464
- C:\Windows\System\ZfiiPoV.exe
  C:\Windows\System\ZfiiPoV.exe
  2⤵
  - Executes dropped EXE
  PID:1920
- C:\Windows\System\HEAnsKa.exe
  C:\Windows\System\HEAnsKa.exe
  2⤵
  - Executes dropped EXE
  PID:4848
- C:\Windows\System\WalIMTI.exe
  C:\Windows\System\WalIMTI.exe
  2⤵
  - Executes dropped EXE
  PID:4264
- C:\Windows\System\BzxQeGn.exe
  C:\Windows\System\BzxQeGn.exe
  2⤵
  - Executes dropped EXE
  PID:3808
- C:\Windows\System\KrvGzZH.exe
  C:\Windows\System\KrvGzZH.exe
  2⤵
  - Executes dropped EXE
  PID:3152
- C:\Windows\System\YeqFiEQ.exe
  C:\Windows\System\YeqFiEQ.exe
  2⤵
  - Executes dropped EXE
  PID:2656
- C:\Windows\System\qLEgdzq.exe
  C:\Windows\System\qLEgdzq.exe
  2⤵
  - Executes dropped EXE
  PID:4820
- C:\Windows\System\cZEhAWM.exe
  C:\Windows\System\cZEhAWM.exe
  2⤵
  - Executes dropped EXE
  PID:1660
- C:\Windows\System\vahGQFl.exe
  C:\Windows\System\vahGQFl.exe
  2⤵
  - Executes dropped EXE
  PID:2804
- C:\Windows\System\dzhtuWK.exe
  C:\Windows\System\dzhtuWK.exe
  2⤵
  - Executes dropped EXE
  PID:4560
- C:\Windows\System\lASCXOR.exe
  C:\Windows\System\lASCXOR.exe
  2⤵
  - Executes dropped EXE
  PID:908
- C:\Windows\System\iqclcsw.exe
  C:\Windows\System\iqclcsw.exe
  2⤵
  - Executes dropped EXE
  PID:916
- C:\Windows\System\WIbfCNF.exe
  C:\Windows\System\WIbfCNF.exe
  2⤵
  - Executes dropped EXE
  PID:4484
- C:\Windows\System\tvGEHan.exe
  C:\Windows\System\tvGEHan.exe
  2⤵
  - Executes dropped EXE
  PID:1848
- C:\Windows\System\ySgPCny.exe
  C:\Windows\System\ySgPCny.exe
  2⤵
  - Executes dropped EXE
  PID:364
- C:\Windows\System\SFcZkPj.exe
  C:\Windows\System\SFcZkPj.exe
  2⤵
  - Executes dropped EXE
  PID:3240
- C:\Windows\System\rhNPbuq.exe
  C:\Windows\System\rhNPbuq.exe
  2⤵
  - Executes dropped EXE
  PID:2128
- C:\Windows\System\yyTITZL.exe
  C:\Windows\System\yyTITZL.exe
  2⤵
  - Executes dropped EXE
  PID:3964
- C:\Windows\System\YMOEYJB.exe
  C:\Windows\System\YMOEYJB.exe
  2⤵
  - Executes dropped EXE
  PID:2800
- C:\Windows\System\xssTYuO.exe
  C:\Windows\System\xssTYuO.exe
  2⤵
  - Executes dropped EXE
  PID:4712
- C:\Windows\System\brrkZhn.exe
  C:\Windows\System\brrkZhn.exe
  2⤵
  - Executes dropped EXE
  PID:4776
- C:\Windows\System\JryaRQB.exe
  C:\Windows\System\JryaRQB.exe
  2⤵
  - Executes dropped EXE
  PID:4696
- C:\Windows\System\AiXIlSi.exe
  C:\Windows\System\AiXIlSi.exe
  2⤵
  - Executes dropped EXE
  PID:4744
- C:\Windows\System\SLunbcq.exe
  C:\Windows\System\SLunbcq.exe
  2⤵
  - Executes dropped EXE
  PID:3304
- C:\Windows\System\bGDRVDA.exe
  C:\Windows\System\bGDRVDA.exe
  2⤵
  - Executes dropped EXE
  PID:4300
- C:\Windows\System\kBKSoOX.exe
  C:\Windows\System\kBKSoOX.exe
  2⤵
  - Executes dropped EXE
  PID:4468
- C:\Windows\System\qWjqUAG.exe
  C:\Windows\System\qWjqUAG.exe
  2⤵
  - Executes dropped EXE
  PID:4188
- C:\Windows\System\nQzZQKE.exe
  C:\Windows\System\nQzZQKE.exe
  2⤵
  - Executes dropped EXE
  PID:3396
- C:\Windows\System\fVmrSvt.exe
  C:\Windows\System\fVmrSvt.exe
  2⤵
  - Executes dropped EXE
  PID:3940
- C:\Windows\System\BrMrWOs.exe
  C:\Windows\System\BrMrWOs.exe
  2⤵
  - Executes dropped EXE
  PID:712
- C:\Windows\System\YmptEFz.exe
  C:\Windows\System\YmptEFz.exe
  2⤵
  - Executes dropped EXE
  PID:4940
- C:\Windows\System\jssOPsK.exe
  C:\Windows\System\jssOPsK.exe
  2⤵
  - Executes dropped EXE
  PID:3668
- C:\Windows\System\tPvsjTU.exe
  C:\Windows\System\tPvsjTU.exe
  2⤵
  - Executes dropped EXE
  PID:3948
- C:\Windows\System\mbQsajU.exe
  C:\Windows\System\mbQsajU.exe
  2⤵
  - Executes dropped EXE
  PID:1432
- C:\Windows\System\rZQRxXb.exe
  C:\Windows\System\rZQRxXb.exe
  2⤵
  - Executes dropped EXE
  PID:4472
- C:\Windows\System\uzZuFud.exe
  C:\Windows\System\uzZuFud.exe
  2⤵
  - Executes dropped EXE
  PID:4532
- C:\Windows\System\jHKXqPJ.exe
  C:\Windows\System\jHKXqPJ.exe
  2⤵
  - Executes dropped EXE
  PID:4392
- C:\Windows\System\MHbIrjc.exe
  C:\Windows\System\MHbIrjc.exe
  2⤵
  - Executes dropped EXE
  PID:3788
- C:\Windows\System\awQjvis.exe
  C:\Windows\System\awQjvis.exe
  2⤵
  - Executes dropped EXE
  PID:2932
- C:\Windows\System\yUIDeYf.exe
  C:\Windows\System\yUIDeYf.exe
  2⤵
  - Executes dropped EXE
  PID:4600
- C:\Windows\System\rctALcG.exe
  C:\Windows\System\rctALcG.exe
  2⤵
  - Executes dropped EXE
  PID:4876
- C:\Windows\System\pgrKWQG.exe
  C:\Windows\System\pgrKWQG.exe
  2⤵
  - Executes dropped EXE
  PID:1536
- C:\Windows\System\noQcCpz.exe
  C:\Windows\System\noQcCpz.exe
  2⤵
  - Executes dropped EXE
  PID:4788
- C:\Windows\System\HrgZYPs.exe
  C:\Windows\System\HrgZYPs.exe
  2⤵
  - Executes dropped EXE
  PID:4732
- C:\Windows\System\bZshFdz.exe
  C:\Windows\System\bZshFdz.exe
  2⤵
  - Executes dropped EXE
  PID:1960
- C:\Windows\System\oWWDptu.exe
  C:\Windows\System\oWWDptu.exe
  2⤵
  - Executes dropped EXE
  PID:2364
- C:\Windows\System\zSEaVZO.exe
  C:\Windows\System\zSEaVZO.exe
  2⤵
  - Executes dropped EXE
  PID:1400
- C:\Windows\System\UdxuBaw.exe
  C:\Windows\System\UdxuBaw.exe
  2⤵
  - Executes dropped EXE
  PID:4636
- C:\Windows\System\WXvHrPA.exe
  C:\Windows\System\WXvHrPA.exe
  2⤵
  - Executes dropped EXE
  PID:5132
- C:\Windows\System\vFNvQVd.exe
  C:\Windows\System\vFNvQVd.exe
  2⤵
  PID:5152
- C:\Windows\System\gSmscov.exe
  C:\Windows\System\gSmscov.exe
  2⤵
  PID:5200
- C:\Windows\System\nXofAsR.exe
  C:\Windows\System\nXofAsR.exe
  2⤵
  PID:5216
- C:\Windows\System\ZGXmCuw.exe
  C:\Windows\System\ZGXmCuw.exe
  2⤵
  PID:5244
- C:\Windows\System\lLRDmBO.exe
  C:\Windows\System\lLRDmBO.exe
  2⤵
  PID:5268
- C:\Windows\System\vgoImdR.exe
  C:\Windows\System\vgoImdR.exe
  2⤵
  PID:5284
- C:\Windows\System\gRKxsFb.exe
  C:\Windows\System\gRKxsFb.exe
  2⤵
  PID:5304
- C:\Windows\System\oRhJRPB.exe
  C:\Windows\System\oRhJRPB.exe
  2⤵
  PID:5324
- C:\Windows\System\TcSzuWE.exe
  C:\Windows\System\TcSzuWE.exe
  2⤵
  PID:5352
- C:\Windows\System\LZGhjxS.exe
  C:\Windows\System\LZGhjxS.exe
  2⤵
  PID:5384
- C:\Windows\System\YeOZFgp.exe
  C:\Windows\System\YeOZFgp.exe
  2⤵
  PID:5400
- C:\Windows\System\dHvoOrt.exe
  C:\Windows\System\dHvoOrt.exe
  2⤵
  PID:5424
- C:\Windows\System\OvsZLMd.exe
  C:\Windows\System\OvsZLMd.exe
  2⤵
  PID:5472
- C:\Windows\System\eYxXEcG.exe
  C:\Windows\System\eYxXEcG.exe
  2⤵
  PID:5488
- C:\Windows\System\erhWtRF.exe
  C:\Windows\System\erhWtRF.exe
  2⤵
  PID:5516
- C:\Windows\System\mjVQhdj.exe
  C:\Windows\System\mjVQhdj.exe
  2⤵
  PID:5576
- C:\Windows\System\nTuGzMI.exe
  C:\Windows\System\nTuGzMI.exe
  2⤵
  PID:5604
- C:\Windows\System\XAltEKZ.exe
  C:\Windows\System\XAltEKZ.exe
  2⤵
  PID:5620
- C:\Windows\System\NIoGOFF.exe
  C:\Windows\System\NIoGOFF.exe
  2⤵
  PID:5644
- C:\Windows\System\PQqhkOV.exe
  C:\Windows\System\PQqhkOV.exe
  2⤵
  PID:5672
- C:\Windows\System\VnURxzC.exe
  C:\Windows\System\VnURxzC.exe
  2⤵
  PID:5688
- C:\Windows\System\ggoxgiE.exe
  C:\Windows\System\ggoxgiE.exe
  2⤵
  PID:5708
- C:\Windows\System\mchwYpM.exe
  C:\Windows\System\mchwYpM.exe
  2⤵
  PID:5728
- C:\Windows\System\wslUfIe.exe
  C:\Windows\System\wslUfIe.exe
  2⤵
  PID:5748
- C:\Windows\System\APLQccd.exe
  C:\Windows\System\APLQccd.exe
  2⤵
  PID:5776
- C:\Windows\System\YuRWCIf.exe
  C:\Windows\System\YuRWCIf.exe
  2⤵
  PID:5796
- C:\Windows\System\opNvGQN.exe
  C:\Windows\System\opNvGQN.exe
  2⤵
  PID:5812
- C:\Windows\System\UzVLRwp.exe
  C:\Windows\System\UzVLRwp.exe
  2⤵
  PID:5832
- C:\Windows\System\ZnDkBXq.exe
  C:\Windows\System\ZnDkBXq.exe
  2⤵
  PID:5848
- C:\Windows\System\SvyPTEJ.exe
  C:\Windows\System\SvyPTEJ.exe
  2⤵
  PID:5872
- C:\Windows\System\eitxTrF.exe
  C:\Windows\System\eitxTrF.exe
  2⤵
  PID:5896
- C:\Windows\System\NfoGCEt.exe
  C:\Windows\System\NfoGCEt.exe
  2⤵
  PID:5916
- C:\Windows\System\dNvwiMP.exe
  C:\Windows\System\dNvwiMP.exe
  2⤵
  PID:6140
- C:\Windows\System\AvpdMIB.exe
  C:\Windows\System\AvpdMIB.exe
  2⤵
  PID:2900
- C:\Windows\System\yZwQJnp.exe
  C:\Windows\System\yZwQJnp.exe
  2⤵
  PID:3920
- C:\Windows\System\IRyDEWm.exe
  C:\Windows\System\IRyDEWm.exe
  2⤵
  PID:2676
- C:\Windows\System\ppyosel.exe
  C:\Windows\System\ppyosel.exe
  2⤵
  PID:2060
- C:\Windows\System\iekegGz.exe
  C:\Windows\System\iekegGz.exe
  2⤵
  PID:4528
- C:\Windows\System\ECHRIPq.exe
  C:\Windows\System\ECHRIPq.exe
  2⤵
  PID:5164
- C:\Windows\System\wmYXgiE.exe
  C:\Windows\System\wmYXgiE.exe
  2⤵
  PID:1444
- C:\Windows\System\PNfjCXe.exe
  C:\Windows\System\PNfjCXe.exe
  2⤵
  PID:856
- C:\Windows\System\BzezEwU.exe
  C:\Windows\System\BzezEwU.exe
  2⤵
  PID:2020
- C:\Windows\System\VafIHXl.exe
  C:\Windows\System\VafIHXl.exe
  2⤵
  PID:5524
- C:\Windows\System\axvnRxg.exe
  C:\Windows\System\axvnRxg.exe
  2⤵
  PID:5932
- C:\Windows\System\gBUzVDK.exe
  C:\Windows\System\gBUzVDK.exe
  2⤵
  PID:5968
- C:\Windows\System\kseAhSC.exe
  C:\Windows\System\kseAhSC.exe
  2⤵
  PID:5988
- C:\Windows\System\eYwTFyC.exe
  C:\Windows\System\eYwTFyC.exe
  2⤵
  PID:6008
- C:\Windows\System\BajGhBE.exe
  C:\Windows\System\BajGhBE.exe
  2⤵
  PID:6028
- C:\Windows\System\fiooHGl.exe
  C:\Windows\System\fiooHGl.exe
  2⤵
  PID:6044
- C:\Windows\System\YgIpfAl.exe
  C:\Windows\System\YgIpfAl.exe
  2⤵
  PID:6072
- C:\Windows\System\vpYKdoX.exe
  C:\Windows\System\vpYKdoX.exe
  2⤵
  PID:6092
- C:\Windows\System\gonroeD.exe
  C:\Windows\System\gonroeD.exe
  2⤵
  PID:6132
- C:\Windows\System\ErbcqCl.exe
  C:\Windows\System\ErbcqCl.exe
  2⤵
  PID:4936
- C:\Windows\System\oqOwbuu.exe
  C:\Windows\System\oqOwbuu.exe
  2⤵
  PID:5224
- C:\Windows\System\iJOZFLF.exe
  C:\Windows\System\iJOZFLF.exe
  2⤵
  PID:6164
- C:\Windows\System\SvEFzFH.exe
  C:\Windows\System\SvEFzFH.exe
  2⤵
  PID:6180
- C:\Windows\System\qedovCX.exe
  C:\Windows\System\qedovCX.exe
  2⤵
  PID:6204
- C:\Windows\System\ROMwZAT.exe
  C:\Windows\System\ROMwZAT.exe
  2⤵
  PID:6220
- C:\Windows\System\vCijhET.exe
  C:\Windows\System\vCijhET.exe
  2⤵
  PID:6240
- C:\Windows\System\vnSBfsA.exe
  C:\Windows\System\vnSBfsA.exe
  2⤵
  PID:6260
- C:\Windows\System\hMnNBUl.exe
  C:\Windows\System\hMnNBUl.exe
  2⤵
  PID:6276
- C:\Windows\System\geKVsyn.exe
  C:\Windows\System\geKVsyn.exe
  2⤵
  PID:6300
- C:\Windows\System\gKBTZHh.exe
  C:\Windows\System\gKBTZHh.exe
  2⤵
  PID:6368
- C:\Windows\System\HhnWWCd.exe
  C:\Windows\System\HhnWWCd.exe
  2⤵
  PID:6388
- C:\Windows\System\LsIEQOU.exe
  C:\Windows\System\LsIEQOU.exe
  2⤵
  PID:6424
- C:\Windows\System\ZXAAeOU.exe
  C:\Windows\System\ZXAAeOU.exe
  2⤵
  PID:6448
- C:\Windows\System\VZDNbEo.exe
  C:\Windows\System\VZDNbEo.exe
  2⤵
  PID:6464
- C:\Windows\System\fNYOZxf.exe
  C:\Windows\System\fNYOZxf.exe
  2⤵
  PID:6484
- C:\Windows\System\YVjGUgd.exe
  C:\Windows\System\YVjGUgd.exe
  2⤵
  PID:6500
- C:\Windows\System\YFYvKrh.exe
  C:\Windows\System\YFYvKrh.exe
  2⤵
  PID:6524
- C:\Windows\System\LfbqbHg.exe
  C:\Windows\System\LfbqbHg.exe
  2⤵
  PID:6544
- C:\Windows\System\OPChtNd.exe
  C:\Windows\System\OPChtNd.exe
  2⤵
  PID:6568
- C:\Windows\System\kbIPEbc.exe
  C:\Windows\System\kbIPEbc.exe
  2⤵
  PID:6584
- C:\Windows\System\ReqiHFe.exe
  C:\Windows\System\ReqiHFe.exe
  2⤵
  PID:6604
- C:\Windows\System\dIzkIih.exe
  C:\Windows\System\dIzkIih.exe
  2⤵
  PID:6620
- C:\Windows\System\VqdLUku.exe
  C:\Windows\System\VqdLUku.exe
  2⤵
  PID:6640
- C:\Windows\System\vXMPzIE.exe
  C:\Windows\System\vXMPzIE.exe
  2⤵
  PID:6660
- C:\Windows\System\noXhoQH.exe
  C:\Windows\System\noXhoQH.exe
  2⤵
  PID:6680
- C:\Windows\System\MHXRgIl.exe
  C:\Windows\System\MHXRgIl.exe
  2⤵
  PID:6704
- C:\Windows\System\ZxXPXPf.exe
  C:\Windows\System\ZxXPXPf.exe
  2⤵
  PID:6720
- C:\Windows\System\wPciNBw.exe
  C:\Windows\System\wPciNBw.exe
  2⤵
  PID:6744
- C:\Windows\System\xxoXMOv.exe
  C:\Windows\System\xxoXMOv.exe
  2⤵
  PID:6760
- C:\Windows\System\CYKhMCL.exe
  C:\Windows\System\CYKhMCL.exe
  2⤵
  PID:6852
- C:\Windows\System\jueCCyv.exe
  C:\Windows\System\jueCCyv.exe
  2⤵
  PID:6872
- C:\Windows\System\IjWBILB.exe
  C:\Windows\System\IjWBILB.exe
  2⤵
  PID:6896
- C:\Windows\System\WqIIYXl.exe
  C:\Windows\System\WqIIYXl.exe
  2⤵
  PID:6916
- C:\Windows\System\rwcyGkm.exe
  C:\Windows\System\rwcyGkm.exe
  2⤵
  PID:6936
- C:\Windows\System\IFWydow.exe
  C:\Windows\System\IFWydow.exe
  2⤵
  PID:6952
- C:\Windows\System\KxZxYGc.exe
  C:\Windows\System\KxZxYGc.exe
  2⤵
  PID:6976
- C:\Windows\System\FHOCcMt.exe
  C:\Windows\System\FHOCcMt.exe
  2⤵
  PID:6992
- C:\Windows\System\cnYtLyr.exe
  C:\Windows\System\cnYtLyr.exe
  2⤵
  PID:7016
- C:\Windows\System\iwgnuvU.exe
  C:\Windows\System\iwgnuvU.exe
  2⤵
  PID:7040
- C:\Windows\System\XjzQXBG.exe
  C:\Windows\System\XjzQXBG.exe
  2⤵
  PID:7056
- C:\Windows\System\VdxNJuz.exe
  C:\Windows\System\VdxNJuz.exe
  2⤵
  PID:7080
- C:\Windows\System\KLfLfuR.exe
  C:\Windows\System\KLfLfuR.exe
  2⤵
  PID:7096
- C:\Windows\System\MBlSNrQ.exe
  C:\Windows\System\MBlSNrQ.exe
  2⤵
  PID:5276
- C:\Windows\System\gwYufDa.exe
  C:\Windows\System\gwYufDa.exe
  2⤵
  PID:5300
- C:\Windows\System\ueHjIsG.exe
  C:\Windows\System\ueHjIsG.exe
  2⤵
  PID:5360
- C:\Windows\System\FduoKBk.exe
  C:\Windows\System\FduoKBk.exe
  2⤵
  PID:5408
- C:\Windows\System\OUBvMys.exe
  C:\Windows\System\OUBvMys.exe
  2⤵
  PID:5440
- C:\Windows\System\CyuPdVb.exe
  C:\Windows\System\CyuPdVb.exe
  2⤵
  PID:6068
- C:\Windows\System\CjHrciL.exe
  C:\Windows\System\CjHrciL.exe
  2⤵
  PID:6172
- C:\Windows\System\JCplKQk.exe
  C:\Windows\System\JCplKQk.exe
  2⤵
  PID:6216
- C:\Windows\System\DBJqiHF.exe
  C:\Windows\System\DBJqiHF.exe
  2⤵
  PID:6272
- C:\Windows\System\xjxWyvA.exe
  C:\Windows\System\xjxWyvA.exe
  2⤵
  PID:5596
- C:\Windows\System\jkjrkli.exe
  C:\Windows\System\jkjrkli.exe
  2⤵
  PID:5652
- C:\Windows\System\BHWLoez.exe
  C:\Windows\System\BHWLoez.exe
  2⤵
  PID:5680
- C:\Windows\System\cupsWCr.exe
  C:\Windows\System\cupsWCr.exe
  2⤵
  PID:5720
- C:\Windows\System\RXDDLWJ.exe
  C:\Windows\System\RXDDLWJ.exe
  2⤵
  PID:5764
- C:\Windows\System\nygFkSA.exe
  C:\Windows\System\nygFkSA.exe
  2⤵
  PID:5808
- C:\Windows\System\RYMLxzi.exe
  C:\Windows\System\RYMLxzi.exe
  2⤵
  PID:5840
- C:\Windows\System\HsOtPga.exe
  C:\Windows\System\HsOtPga.exe
  2⤵
  PID:5888
- C:\Windows\System\HixVBQw.exe
  C:\Windows\System\HixVBQw.exe
  2⤵
  PID:5924
- C:\Windows\System\IKzNFfz.exe
  C:\Windows\System\IKzNFfz.exe
  2⤵
  PID:2784
- C:\Windows\System\BnxzOfl.exe
  C:\Windows\System\BnxzOfl.exe
  2⤵
  PID:4172
- C:\Windows\System\MDhxTfk.exe
  C:\Windows\System\MDhxTfk.exe
  2⤵
  PID:4812
- C:\Windows\System\qXecUKG.exe
  C:\Windows\System\qXecUKG.exe
  2⤵
  PID:4552
- C:\Windows\System\mcQwwJW.exe
  C:\Windows\System\mcQwwJW.exe
  2⤵
  PID:3924
- C:\Windows\System\ZQdCFJB.exe
  C:\Windows\System\ZQdCFJB.exe
  2⤵
  PID:6756
- C:\Windows\System\mulpEwh.exe
  C:\Windows\System\mulpEwh.exe
  2⤵
  PID:4604
- C:\Windows\System\SCIMtfP.exe
  C:\Windows\System\SCIMtfP.exe
  2⤵
  PID:5480
- C:\Windows\System\hbTfnMT.exe
  C:\Windows\System\hbTfnMT.exe
  2⤵
  PID:5016
- C:\Windows\System\JEnJqeQ.exe
  C:\Windows\System\JEnJqeQ.exe
  2⤵
  PID:5952
- C:\Windows\System\jTtzKGw.exe
  C:\Windows\System\jTtzKGw.exe
  2⤵
  PID:5984
- C:\Windows\System\fFWnpFN.exe
  C:\Windows\System\fFWnpFN.exe
  2⤵
  PID:6040
- C:\Windows\System\FTqjtzy.exe
  C:\Windows\System\FTqjtzy.exe
  2⤵
  PID:5212
- C:\Windows\System\MIduKAJ.exe
  C:\Windows\System\MIduKAJ.exe
  2⤵
  PID:6248
- C:\Windows\System\FamSAGH.exe
  C:\Windows\System\FamSAGH.exe
  2⤵
  PID:3824
- C:\Windows\System\ykLHyWa.exe
  C:\Windows\System\ykLHyWa.exe
  2⤵
  PID:7104
- C:\Windows\System\EfZMYQR.exe
  C:\Windows\System\EfZMYQR.exe
  2⤵
  PID:7176
- C:\Windows\System\pXJEyRI.exe
  C:\Windows\System\pXJEyRI.exe
  2⤵
  PID:7200
- C:\Windows\System\kMunayg.exe
  C:\Windows\System\kMunayg.exe
  2⤵
  PID:7216
- C:\Windows\System\MZPlOjc.exe
  C:\Windows\System\MZPlOjc.exe
  2⤵
  PID:7240
- C:\Windows\System\RCxNzDQ.exe
  C:\Windows\System\RCxNzDQ.exe
  2⤵
  PID:7256
- C:\Windows\System\KqBOoMb.exe
  C:\Windows\System\KqBOoMb.exe
  2⤵
  PID:7280
- C:\Windows\System\ObZqywK.exe
  C:\Windows\System\ObZqywK.exe
  2⤵
  PID:7304
- C:\Windows\System\svOpbPH.exe
  C:\Windows\System\svOpbPH.exe
  2⤵
  PID:7328
- C:\Windows\System\VZkXCXj.exe
  C:\Windows\System\VZkXCXj.exe
  2⤵
  PID:7344
- C:\Windows\System\ENYmtSl.exe
  C:\Windows\System\ENYmtSl.exe
  2⤵
  PID:7368
- C:\Windows\System\NNnLnVK.exe
  C:\Windows\System\NNnLnVK.exe
  2⤵
  PID:7384
- C:\Windows\System\VRelvxn.exe
  C:\Windows\System\VRelvxn.exe
  2⤵
  PID:7408
- C:\Windows\System\wlCZJfy.exe
  C:\Windows\System\wlCZJfy.exe
  2⤵
  PID:7432
- C:\Windows\System\bQSBhzo.exe
  C:\Windows\System\bQSBhzo.exe
  2⤵
  PID:7452
- C:\Windows\System\uLjJZGq.exe
  C:\Windows\System\uLjJZGq.exe
  2⤵
  PID:7476
- C:\Windows\System\zIYRAFK.exe
  C:\Windows\System\zIYRAFK.exe
  2⤵
  PID:7492
- C:\Windows\System\tMGdkXq.exe
  C:\Windows\System\tMGdkXq.exe
  2⤵
  PID:7516
- C:\Windows\System\aHPwPLW.exe
  C:\Windows\System\aHPwPLW.exe
  2⤵
  PID:7532
- C:\Windows\System\DpylSZa.exe
  C:\Windows\System\DpylSZa.exe
  2⤵
  PID:7556
- C:\Windows\System\oXahHsR.exe
  C:\Windows\System\oXahHsR.exe
  2⤵
  PID:7580
- C:\Windows\System\EEVdrgN.exe
  C:\Windows\System\EEVdrgN.exe
  2⤵
  PID:7600
- C:\Windows\System\kBjyiuj.exe
  C:\Windows\System\kBjyiuj.exe
  2⤵
  PID:7628
- C:\Windows\System\tezNbhC.exe
  C:\Windows\System\tezNbhC.exe
  2⤵
  PID:7648
- C:\Windows\System\gfpclqQ.exe
  C:\Windows\System\gfpclqQ.exe
  2⤵
  PID:7664
- C:\Windows\System\PoyZjVo.exe
  C:\Windows\System\PoyZjVo.exe
  2⤵
  PID:7680
- C:\Windows\System\llinTtO.exe
  C:\Windows\System\llinTtO.exe
  2⤵
  PID:7696
- C:\Windows\System\UmHAgcl.exe
  C:\Windows\System\UmHAgcl.exe
  2⤵
  PID:7784
- C:\Windows\System\WpKkNsz.exe
  C:\Windows\System\WpKkNsz.exe
  2⤵
  PID:7808
- C:\Windows\System\EsdKIWM.exe
  C:\Windows\System\EsdKIWM.exe
  2⤵
  PID:7836
- C:\Windows\System\ViGXdpl.exe
  C:\Windows\System\ViGXdpl.exe
  2⤵
  PID:7860
- C:\Windows\System\ZtFizws.exe
  C:\Windows\System\ZtFizws.exe
  2⤵
  PID:7880
- C:\Windows\System\PAtCJdf.exe
  C:\Windows\System\PAtCJdf.exe
  2⤵
  PID:7900
- C:\Windows\System\hbsxgSg.exe
  C:\Windows\System\hbsxgSg.exe
  2⤵
  PID:7920
- C:\Windows\System\ZIwZCJo.exe
  C:\Windows\System\ZIwZCJo.exe
  2⤵
  PID:7940
- C:\Windows\System\LduqhJA.exe
  C:\Windows\System\LduqhJA.exe
  2⤵
  PID:8000
- C:\Windows\System\RebuDeM.exe
  C:\Windows\System\RebuDeM.exe
  2⤵
  PID:8028
- C:\Windows\System\DZuVmQd.exe
  C:\Windows\System\DZuVmQd.exe
  2⤵
  PID:8056
- C:\Windows\System\OcTzqRB.exe
  C:\Windows\System\OcTzqRB.exe
  2⤵
  PID:8080
- C:\Windows\System\vjEIwsO.exe
  C:\Windows\System\vjEIwsO.exe
  2⤵
  PID:8120
- C:\Windows\System\vJvgAyc.exe
  C:\Windows\System\vJvgAyc.exe
  2⤵
  PID:8168
- C:\Windows\System\RLuoDjV.exe
  C:\Windows\System\RLuoDjV.exe
  2⤵
  PID:8188
- C:\Windows\System\iYkmqCa.exe
  C:\Windows\System\iYkmqCa.exe
  2⤵
  PID:6380
- C:\Windows\System\qEfYMSw.exe
  C:\Windows\System\qEfYMSw.exe
  2⤵
  PID:6516
- C:\Windows\System\kfIcMlB.exe
  C:\Windows\System\kfIcMlB.exe
  2⤵
  PID:6552
- C:\Windows\System\iujIoBR.exe
  C:\Windows\System\iujIoBR.exe
  2⤵
  PID:6592
- C:\Windows\System\PqRsjfY.exe
  C:\Windows\System\PqRsjfY.exe
  2⤵
  PID:6752
- C:\Windows\System\iqoQInE.exe
  C:\Windows\System\iqoQInE.exe
  2⤵
  PID:2152
- C:\Windows\System\CAnFdmy.exe
  C:\Windows\System\CAnFdmy.exe
  2⤵
  PID:1448
- C:\Windows\System\YsEJeOm.exe
  C:\Windows\System\YsEJeOm.exe
  2⤵
  PID:4164
- C:\Windows\System\twpTeek.exe
  C:\Windows\System\twpTeek.exe
  2⤵
  PID:636
- C:\Windows\System\cCoVQEL.exe
  C:\Windows\System\cCoVQEL.exe
  2⤵
  PID:7300
- C:\Windows\System\RejobcY.exe
  C:\Windows\System\RejobcY.exe
  2⤵
  PID:7380
- C:\Windows\System\bvjTnHK.exe
  C:\Windows\System\bvjTnHK.exe
  2⤵
  PID:7424
- C:\Windows\System\EoMtQmP.exe
  C:\Windows\System\EoMtQmP.exe
  2⤵
  PID:7548
- C:\Windows\System\ogkagvD.exe
  C:\Windows\System\ogkagvD.exe
  2⤵
  PID:7592
- C:\Windows\System\CfXOBjB.exe
  C:\Windows\System\CfXOBjB.exe
  2⤵
  PID:5148
- C:\Windows\System\yrQrFed.exe
  C:\Windows\System\yrQrFed.exe
  2⤵
  PID:6864
- C:\Windows\System\BVrPvlJ.exe
  C:\Windows\System\BVrPvlJ.exe
  2⤵
  PID:6912
- C:\Windows\System\PrpsXeX.exe
  C:\Windows\System\PrpsXeX.exe
  2⤵
  PID:6944
- C:\Windows\System\rSsRwjO.exe
  C:\Windows\System\rSsRwjO.exe
  2⤵
  PID:7028
- C:\Windows\System\NRaLTjR.exe
  C:\Windows\System\NRaLTjR.exe
  2⤵
  PID:6188
- C:\Windows\System\fLirVYY.exe
  C:\Windows\System\fLirVYY.exe
  2⤵
  PID:5948
- C:\Windows\System\ZmnCTvt.exe
  C:\Windows\System\ZmnCTvt.exe
  2⤵
  PID:2772
- C:\Windows\System\gRvQxOX.exe
  C:\Windows\System\gRvQxOX.exe
  2⤵
  PID:7340
- C:\Windows\System\IqxQBYv.exe
  C:\Windows\System\IqxQBYv.exe
  2⤵
  PID:4020
- C:\Windows\System\ebuHobw.exe
  C:\Windows\System\ebuHobw.exe
  2⤵
  PID:8076
- C:\Windows\System\FhVzQjA.exe
  C:\Windows\System\FhVzQjA.exe
  2⤵
  PID:3092
- C:\Windows\System\JVCgPIA.exe
  C:\Windows\System\JVCgPIA.exe
  2⤵
  PID:3484
- C:\Windows\System\ZtmUdbC.exe
  C:\Windows\System\ZtmUdbC.exe
  2⤵
  PID:7596
- C:\Windows\System\FSrXXMB.exe
  C:\Windows\System\FSrXXMB.exe
  2⤵
  PID:6360
- C:\Windows\System\HbkOVoc.exe
  C:\Windows\System\HbkOVoc.exe
  2⤵
  PID:8204
- C:\Windows\System\XdgqXWt.exe
  C:\Windows\System\XdgqXWt.exe
  2⤵
  PID:8220
- C:\Windows\System\jkdjhxh.exe
  C:\Windows\System\jkdjhxh.exe
  2⤵
  PID:8244
- C:\Windows\System\sIDWrim.exe
  C:\Windows\System\sIDWrim.exe
  2⤵
  PID:8268
- C:\Windows\System\BqquxZE.exe
  C:\Windows\System\BqquxZE.exe
  2⤵
  PID:8284
- C:\Windows\System\cXeDSbb.exe
  C:\Windows\System\cXeDSbb.exe
  2⤵
  PID:8308
- C:\Windows\System\ArhnQSQ.exe
  C:\Windows\System\ArhnQSQ.exe
  2⤵
  PID:8332
- C:\Windows\System\xHVgzBl.exe
  C:\Windows\System\xHVgzBl.exe
  2⤵
  PID:8348
- C:\Windows\System\kYCYizX.exe
  C:\Windows\System\kYCYizX.exe
  2⤵
  PID:8372
- C:\Windows\System\PmEhIks.exe
  C:\Windows\System\PmEhIks.exe
  2⤵
  PID:8388
- C:\Windows\System\KvXnTlx.exe
  C:\Windows\System\KvXnTlx.exe
  2⤵
  PID:8412
- C:\Windows\System\OayStpB.exe
  C:\Windows\System\OayStpB.exe
  2⤵
  PID:8436
- C:\Windows\System\jqaiYgJ.exe
  C:\Windows\System\jqaiYgJ.exe
  2⤵
  PID:8456
- C:\Windows\System\SBpltml.exe
  C:\Windows\System\SBpltml.exe
  2⤵
  PID:8480
- C:\Windows\System\xkGcDPs.exe
  C:\Windows\System\xkGcDPs.exe
  2⤵
  PID:8504
- C:\Windows\System\tvurnvL.exe
  C:\Windows\System\tvurnvL.exe
  2⤵
  PID:8524
- C:\Windows\System\blufhbw.exe
  C:\Windows\System\blufhbw.exe
  2⤵
  PID:8556
- C:\Windows\System\eHkNIKQ.exe
  C:\Windows\System\eHkNIKQ.exe
  2⤵
  PID:8584
- C:\Windows\System\XjUBsHo.exe
  C:\Windows\System\XjUBsHo.exe
  2⤵
  PID:8612
- C:\Windows\System\zdXBMQR.exe
  C:\Windows\System\zdXBMQR.exe
  2⤵
  PID:8632
- C:\Windows\System\mtXXrFx.exe
  C:\Windows\System\mtXXrFx.exe
  2⤵
  PID:8656
- C:\Windows\System\HfkZfRc.exe
  C:\Windows\System\HfkZfRc.exe
  2⤵
  PID:8680
- C:\Windows\System\GRlxWlA.exe
  C:\Windows\System\GRlxWlA.exe
  2⤵
  PID:8748
- C:\Windows\System\YtWtpSX.exe
  C:\Windows\System\YtWtpSX.exe
  2⤵
  PID:8768
- C:\Windows\System\YlUFdCF.exe
  C:\Windows\System\YlUFdCF.exe
  2⤵
  PID:8784
- C:\Windows\System\pSfQZJT.exe
  C:\Windows\System\pSfQZJT.exe
  2⤵
  PID:8820
- C:\Windows\System\OIPLTEP.exe
  C:\Windows\System\OIPLTEP.exe
  2⤵
  PID:8840
- C:\Windows\System\DCjuiCw.exe
  C:\Windows\System\DCjuiCw.exe
  2⤵
  PID:8864
- C:\Windows\System\DKTDUjf.exe
  C:\Windows\System\DKTDUjf.exe
  2⤵
  PID:8880
- C:\Windows\System\ZqQegnz.exe
  C:\Windows\System\ZqQegnz.exe
  2⤵
  PID:8904
- C:\Windows\System\zdlGdVu.exe
  C:\Windows\System\zdlGdVu.exe
  2⤵
  PID:8928
- C:\Windows\System\rziwAAw.exe
  C:\Windows\System\rziwAAw.exe
  2⤵
  PID:8948
- C:\Windows\System\NQhPmbg.exe
  C:\Windows\System\NQhPmbg.exe
  2⤵
  PID:8968
- C:\Windows\System\ZdCcPZL.exe
  C:\Windows\System\ZdCcPZL.exe
  2⤵
  PID:8984
- C:\Windows\System\mpkZqqd.exe
  C:\Windows\System\mpkZqqd.exe
  2⤵
  PID:9008
- C:\Windows\System\xrZZPTC.exe
  C:\Windows\System\xrZZPTC.exe
  2⤵
  PID:9028
- C:\Windows\System\HwvqEVc.exe
  C:\Windows\System\HwvqEVc.exe
  2⤵
  PID:9048
- C:\Windows\System\MqoUReB.exe
  C:\Windows\System\MqoUReB.exe
  2⤵
  PID:9072
- C:\Windows\System\oCHWuzE.exe
  C:\Windows\System\oCHWuzE.exe
  2⤵
  PID:9088
- C:\Windows\System\ZVjEWfM.exe
  C:\Windows\System\ZVjEWfM.exe
  2⤵
  PID:9112
- C:\Windows\System\jmIzlcb.exe
  C:\Windows\System\jmIzlcb.exe
  2⤵
  PID:9140
- C:\Windows\System\dHxCKrn.exe
  C:\Windows\System\dHxCKrn.exe
  2⤵
  PID:9164
- C:\Windows\System\rUDZPLm.exe
  C:\Windows\System\rUDZPLm.exe
  2⤵
  PID:9192
- C:\Windows\System\aAsAGLk.exe
  C:\Windows\System\aAsAGLk.exe
  2⤵
  PID:7152
- C:\Windows\System\kbjwyso.exe
  C:\Windows\System\kbjwyso.exe
  2⤵
  PID:5292
- C:\Windows\System\KgjYNSr.exe
  C:\Windows\System\KgjYNSr.exe
  2⤵
  PID:5344
- C:\Windows\System\MQbXQsD.exe
  C:\Windows\System\MQbXQsD.exe
  2⤵
  PID:5436
- C:\Windows\System\vQgZMPA.exe
  C:\Windows\System\vQgZMPA.exe
  2⤵
  PID:6120
- C:\Windows\System\PZjyLUq.exe
  C:\Windows\System\PZjyLUq.exe
  2⤵
  PID:5568
- C:\Windows\System\VJQCzbZ.exe
  C:\Windows\System\VJQCzbZ.exe
  2⤵
  PID:5636
- C:\Windows\System\sSErTAX.exe
  C:\Windows\System\sSErTAX.exe
  2⤵
  PID:5724
- C:\Windows\System\XtJpvSq.exe
  C:\Windows\System\XtJpvSq.exe
  2⤵
  PID:5828
- C:\Windows\System\yViSFjI.exe
  C:\Windows\System\yViSFjI.exe
  2⤵
  PID:5912
- C:\Windows\System\ltRgoKI.exe
  C:\Windows\System\ltRgoKI.exe
  2⤵
  PID:4544
- C:\Windows\System\yMSIoZV.exe
  C:\Windows\System\yMSIoZV.exe
  2⤵
  PID:5944
- C:\Windows\System\pksednB.exe
  C:\Windows\System\pksednB.exe
  2⤵
  PID:6036
- C:\Windows\System\mhnxsNY.exe
  C:\Windows\System\mhnxsNY.exe
  2⤵
  PID:6648
- C:\Windows\System\aXbTBAi.exe
  C:\Windows\System\aXbTBAi.exe
  2⤵
  PID:2996
- C:\Windows\System\NRcAaNu.exe
  C:\Windows\System\NRcAaNu.exe
  2⤵
  PID:964
- C:\Windows\System\NDFyuWJ.exe
  C:\Windows\System\NDFyuWJ.exe
  2⤵
  PID:7172
- C:\Windows\System\SkAhkCS.exe
  C:\Windows\System\SkAhkCS.exe
  2⤵
  PID:7208
- C:\Windows\System\AcsnsSh.exe
  C:\Windows\System\AcsnsSh.exe
  2⤵
  PID:7236
- C:\Windows\System\xNYyNyy.exe
  C:\Windows\System\xNYyNyy.exe
  2⤵
  PID:7276
- C:\Windows\System\gDeWsHq.exe
  C:\Windows\System\gDeWsHq.exe
  2⤵
  PID:8052
- C:\Windows\System\OutzVJe.exe
  C:\Windows\System\OutzVJe.exe
  2⤵
  PID:7336
- C:\Windows\System\jHsVhEt.exe
  C:\Windows\System\jHsVhEt.exe
  2⤵
  PID:7488
- C:\Windows\System\WCtMMJj.exe
  C:\Windows\System\WCtMMJj.exe
  2⤵
  PID:8140
- C:\Windows\System\iPVNAIM.exe
  C:\Windows\System\iPVNAIM.exe
  2⤵
  PID:6812
- C:\Windows\System\MoavcoZ.exe
  C:\Windows\System\MoavcoZ.exe
  2⤵
  PID:7692
- C:\Windows\System\dAyCRLU.exe
  C:\Windows\System\dAyCRLU.exe
  2⤵
  PID:3504
- C:\Windows\System\YPNgdgp.exe
  C:\Windows\System\YPNgdgp.exe
  2⤵
  PID:9236
- C:\Windows\System\SOhNPhx.exe
  C:\Windows\System\SOhNPhx.exe
  2⤵
  PID:9256
- C:\Windows\System\sQLzSkw.exe
  C:\Windows\System\sQLzSkw.exe
  2⤵
  PID:9280
- C:\Windows\System\qKoUCSI.exe
  C:\Windows\System\qKoUCSI.exe
  2⤵
  PID:9304
- C:\Windows\System\tqqSiAN.exe
  C:\Windows\System\tqqSiAN.exe
  2⤵
  PID:9324
- C:\Windows\System\JDIZWBJ.exe
  C:\Windows\System\JDIZWBJ.exe
  2⤵
  PID:9348
- C:\Windows\System\qrgyPNm.exe
  C:\Windows\System\qrgyPNm.exe
  2⤵
  PID:9372
- C:\Windows\System\mLaVjZe.exe
  C:\Windows\System\mLaVjZe.exe
  2⤵
  PID:9396
- C:\Windows\System\lCJCMqd.exe
  C:\Windows\System\lCJCMqd.exe
  2⤵
  PID:9424
- C:\Windows\System\lfafiPG.exe
  C:\Windows\System\lfafiPG.exe
  2⤵
  PID:9440
- C:\Windows\System\oUTyiGk.exe
  C:\Windows\System\oUTyiGk.exe
  2⤵
  PID:9464
- C:\Windows\System\XLZlZZS.exe
  C:\Windows\System\XLZlZZS.exe
  2⤵
  PID:9484
- C:\Windows\System\xiuJiOo.exe
  C:\Windows\System\xiuJiOo.exe
  2⤵
  PID:9512
- C:\Windows\System\rFHfzRZ.exe
  C:\Windows\System\rFHfzRZ.exe
  2⤵
  PID:9528
- C:\Windows\System\nqYYxgc.exe
  C:\Windows\System\nqYYxgc.exe
  2⤵
  PID:9552
- C:\Windows\System\mgUxDWS.exe
  C:\Windows\System\mgUxDWS.exe
  2⤵
  PID:9572
- C:\Windows\System\AOyWBcO.exe
  C:\Windows\System\AOyWBcO.exe
  2⤵
  PID:9592
- C:\Windows\System\PqmOWTr.exe
  C:\Windows\System\PqmOWTr.exe
  2⤵
  PID:9620
- C:\Windows\System\gwJFHoi.exe
  C:\Windows\System\gwJFHoi.exe
  2⤵
  PID:9640
- C:\Windows\System\DgWdGFR.exe
  C:\Windows\System\DgWdGFR.exe
  2⤵
  PID:9660
- C:\Windows\System\lUsiZnW.exe
  C:\Windows\System\lUsiZnW.exe
  2⤵
  PID:9680
- C:\Windows\System\HTKDeba.exe
  C:\Windows\System\HTKDeba.exe
  2⤵
  PID:9708
- C:\Windows\System\AdYtpkJ.exe
  C:\Windows\System\AdYtpkJ.exe
  2⤵
  PID:9724
- C:\Windows\System\zszJkWq.exe
  C:\Windows\System\zszJkWq.exe
  2⤵
  PID:9748
- C:\Windows\System\ztpNOGG.exe
  C:\Windows\System\ztpNOGG.exe
  2⤵
  PID:9776
- C:\Windows\System\HGlafzb.exe
  C:\Windows\System\HGlafzb.exe
  2⤵
  PID:9792
- C:\Windows\System\lImiLCj.exe
  C:\Windows\System\lImiLCj.exe
  2⤵
  PID:9812
- C:\Windows\System\aWZCMPh.exe
  C:\Windows\System\aWZCMPh.exe
  2⤵
  PID:9852
- C:\Windows\System\QntGgSO.exe
  C:\Windows\System\QntGgSO.exe
  2⤵
  PID:9880
- C:\Windows\System\GdUAoxC.exe
  C:\Windows\System\GdUAoxC.exe
  2⤵
  PID:9896
- C:\Windows\System\MgbSSEu.exe
  C:\Windows\System\MgbSSEu.exe
  2⤵
  PID:9924
- C:\Windows\System\ehnZiUu.exe
  C:\Windows\System\ehnZiUu.exe
  2⤵
  PID:9948
- C:\Windows\System\GAXxVgW.exe
  C:\Windows\System\GAXxVgW.exe
  2⤵
  PID:9968
- C:\Windows\System\yFhCmNj.exe
  C:\Windows\System\yFhCmNj.exe
  2⤵
  PID:9992
- C:\Windows\System\WaHqOeK.exe
  C:\Windows\System\WaHqOeK.exe
  2⤵
  PID:10032
- C:\Windows\System\IDoOpea.exe
  C:\Windows\System\IDoOpea.exe
  2⤵
  PID:10052
- C:\Windows\System\aEGdbEu.exe
  C:\Windows\System\aEGdbEu.exe
  2⤵
  PID:10080
- C:\Windows\System\VjphOhs.exe
  C:\Windows\System\VjphOhs.exe
  2⤵
  PID:10104
- C:\Windows\System\XVSoPvZ.exe
  C:\Windows\System\XVSoPvZ.exe
  2⤵
  PID:10120
- C:\Windows\System\UuiUOmy.exe
  C:\Windows\System\UuiUOmy.exe
  2⤵
  PID:10144
- C:\Windows\System\lWLhntg.exe
  C:\Windows\System\lWLhntg.exe
  2⤵
  PID:10164
- C:\Windows\System\NuhkOqg.exe
  C:\Windows\System\NuhkOqg.exe
  2⤵
  PID:10188
- C:\Windows\System\QZzfyOG.exe
  C:\Windows\System\QZzfyOG.exe
  2⤵
  PID:10212
- C:\Windows\System\kNkxCZd.exe
  C:\Windows\System\kNkxCZd.exe
  2⤵
  PID:10236
- C:\Windows\System\ZIyPYwl.exe
  C:\Windows\System\ZIyPYwl.exe
  2⤵
  PID:8252
- C:\Windows\System\ikxfmHY.exe
  C:\Windows\System\ikxfmHY.exe
  2⤵
  PID:8280
- C:\Windows\System\poPipOk.exe
  C:\Windows\System\poPipOk.exe
  2⤵
  PID:8356
- C:\Windows\System\QrkmSuG.exe
  C:\Windows\System\QrkmSuG.exe
  2⤵
  PID:8404
- C:\Windows\System\dYUUxUR.exe
  C:\Windows\System\dYUUxUR.exe
  2⤵
  PID:8464
- C:\Windows\System\oFeYndh.exe
  C:\Windows\System\oFeYndh.exe
  2⤵
  PID:8564
- C:\Windows\System\xodxCUz.exe
  C:\Windows\System\xodxCUz.exe
  2⤵
  PID:8620
- C:\Windows\System\sCQNcmY.exe
  C:\Windows\System\sCQNcmY.exe
  2⤵
  PID:8672
- C:\Windows\System\tedAWHV.exe
  C:\Windows\System\tedAWHV.exe
  2⤵
  PID:7800
- C:\Windows\System\ZCPtXWK.exe
  C:\Windows\System\ZCPtXWK.exe
  2⤵
  PID:7856
- C:\Windows\System\KfIhqxf.exe
  C:\Windows\System\KfIhqxf.exe
  2⤵
  PID:7892
- C:\Windows\System\ZiICZtO.exe
  C:\Windows\System\ZiICZtO.exe
  2⤵
  PID:7928
- C:\Windows\System\sqSqLNp.exe
  C:\Windows\System\sqSqLNp.exe
  2⤵
  PID:8800
- C:\Windows\System\ipOIada.exe
  C:\Windows\System\ipOIada.exe
  2⤵
  PID:8916
- C:\Windows\System\GgYwUXV.exe
  C:\Windows\System\GgYwUXV.exe
  2⤵
  PID:8980
- C:\Windows\System\CLfeFpE.exe
  C:\Windows\System\CLfeFpE.exe
  2⤵
  PID:9000
- C:\Windows\System\XXTOeKZ.exe
  C:\Windows\System\XXTOeKZ.exe
  2⤵
  PID:9128
- C:\Windows\System\RJVoYnW.exe
  C:\Windows\System\RJVoYnW.exe
  2⤵
  PID:9212
- C:\Windows\System\Pnuusqp.exe
  C:\Windows\System\Pnuusqp.exe
  2⤵
  PID:6064
- C:\Windows\System\cVAwYfl.exe
  C:\Windows\System\cVAwYfl.exe
  2⤵
  PID:5616
- C:\Windows\System\ETpWfoE.exe
  C:\Windows\System\ETpWfoE.exe
  2⤵
  PID:1516
- C:\Windows\System\kPqEYBo.exe
  C:\Windows\System\kPqEYBo.exe
  2⤵
  PID:6024
- C:\Windows\System\JPfKPDF.exe
  C:\Windows\System\JPfKPDF.exe
  2⤵
  PID:8180
- C:\Windows\System\paxxCzu.exe
  C:\Windows\System\paxxCzu.exe
  2⤵
  PID:7048
- C:\Windows\System\WjggQoa.exe
  C:\Windows\System\WjggQoa.exe
  2⤵
  PID:3224
- C:\Windows\System\AMIgIRC.exe
  C:\Windows\System\AMIgIRC.exe
  2⤵
  PID:7512
- C:\Windows\System\JZeXYKB.exe
  C:\Windows\System\JZeXYKB.exe
  2⤵
  PID:7404
- C:\Windows\System\DAeWgpf.exe
  C:\Windows\System\DAeWgpf.exe
  2⤵
  PID:6844
- C:\Windows\System\ywHRngk.exe
  C:\Windows\System\ywHRngk.exe
  2⤵
  PID:9228
- C:\Windows\System\ZDLxmKD.exe
  C:\Windows\System\ZDLxmKD.exe
  2⤵
  PID:7708
- C:\Windows\System\qKfNHfE.exe
  C:\Windows\System\qKfNHfE.exe
  2⤵
  PID:8292
- C:\Windows\System\INaufLu.exe
  C:\Windows\System\INaufLu.exe
  2⤵
  PID:9432
- C:\Windows\System\kkVpLCp.exe
  C:\Windows\System\kkVpLCp.exe
  2⤵
  PID:9476
- C:\Windows\System\RIBmzrR.exe
  C:\Windows\System\RIBmzrR.exe
  2⤵
  PID:10248
- C:\Windows\System\EbVUITV.exe
  C:\Windows\System\EbVUITV.exe
  2⤵
  PID:10272
- C:\Windows\System\igCegNs.exe
  C:\Windows\System\igCegNs.exe
  2⤵
  PID:10296
- C:\Windows\System\SBvFuxr.exe
  C:\Windows\System\SBvFuxr.exe
  2⤵
  PID:10312
- C:\Windows\System\psCoJvi.exe
  C:\Windows\System\psCoJvi.exe
  2⤵
  PID:10328
- C:\Windows\System\SeBWgcw.exe
  C:\Windows\System\SeBWgcw.exe
  2⤵
  PID:10352
- C:\Windows\System\FkObGQD.exe
  C:\Windows\System\FkObGQD.exe
  2⤵
  PID:10376
- C:\Windows\System\FbhsgwB.exe
  C:\Windows\System\FbhsgwB.exe
  2⤵
  PID:10392
- C:\Windows\System\IkrwVOT.exe
  C:\Windows\System\IkrwVOT.exe
  2⤵
  PID:10420
- C:\Windows\System\ktGHjdt.exe
  C:\Windows\System\ktGHjdt.exe
  2⤵
  PID:10444
- C:\Windows\System\XelUNhe.exe
  C:\Windows\System\XelUNhe.exe
  2⤵
  PID:10464
- C:\Windows\System\enuSEKE.exe
  C:\Windows\System\enuSEKE.exe
  2⤵
  PID:10484
- C:\Windows\System\bTtPgtn.exe
  C:\Windows\System\bTtPgtn.exe
  2⤵
  PID:10532
- C:\Windows\System\icclYzi.exe
  C:\Windows\System\icclYzi.exe
  2⤵
  PID:10548
- C:\Windows\System\LMCWXLd.exe
  C:\Windows\System\LMCWXLd.exe
  2⤵
  PID:10592
- C:\Windows\System\XEBHygH.exe
  C:\Windows\System\XEBHygH.exe
  2⤵
  PID:10612
- C:\Windows\System\ALRIcUq.exe
  C:\Windows\System\ALRIcUq.exe
  2⤵
  PID:10628
- C:\Windows\System\JWnshdL.exe
  C:\Windows\System\JWnshdL.exe
  2⤵
  PID:10652
- C:\Windows\System\CLQhrXk.exe
  C:\Windows\System\CLQhrXk.exe
  2⤵
  PID:10672
- C:\Windows\System\nHrnCge.exe
  C:\Windows\System\nHrnCge.exe
  2⤵
  PID:10692
- C:\Windows\System\XfUGZzt.exe
  C:\Windows\System\XfUGZzt.exe
  2⤵
  PID:10720
- C:\Windows\System\WYpBuye.exe
  C:\Windows\System\WYpBuye.exe
  2⤵
  PID:10740
- C:\Windows\System\zEEctJU.exe
  C:\Windows\System\zEEctJU.exe
  2⤵
  PID:10760
- C:\Windows\System\YTLGEPr.exe
  C:\Windows\System\YTLGEPr.exe
  2⤵
  PID:10776
- C:\Windows\System\alRaBNB.exe
  C:\Windows\System\alRaBNB.exe
  2⤵
  PID:10800
- C:\Windows\System\eIzTUhM.exe
  C:\Windows\System\eIzTUhM.exe
  2⤵
  PID:10824
- C:\Windows\System\EevJgre.exe
  C:\Windows\System\EevJgre.exe
  2⤵
  PID:10844
- C:\Windows\System\JwgOLAH.exe
  C:\Windows\System\JwgOLAH.exe
  2⤵
  PID:10868
- C:\Windows\System\XuOpZZS.exe
  C:\Windows\System\XuOpZZS.exe
  2⤵
  PID:10888
- C:\Windows\System\zdnAFdy.exe
  C:\Windows\System\zdnAFdy.exe
  2⤵
  PID:10912
- C:\Windows\System\bVWFDjz.exe
  C:\Windows\System\bVWFDjz.exe
  2⤵
  PID:10932
- C:\Windows\System\vCrbFcQ.exe
  C:\Windows\System\vCrbFcQ.exe
  2⤵
  PID:10952
- C:\Windows\System\CThGGub.exe
  C:\Windows\System\CThGGub.exe
  2⤵
  PID:10972
- C:\Windows\System\nsYVngr.exe
  C:\Windows\System\nsYVngr.exe
  2⤵
  PID:10996
- C:\Windows\System\ZRKJpjg.exe
  C:\Windows\System\ZRKJpjg.exe
  2⤵
  PID:11020
- C:\Windows\System\ZlxyBdj.exe
  C:\Windows\System\ZlxyBdj.exe
  2⤵
  PID:11040
- C:\Windows\System\GsNHXTc.exe
  C:\Windows\System\GsNHXTc.exe
  2⤵
  PID:11056
- C:\Windows\System\KFXCDJn.exe
  C:\Windows\System\KFXCDJn.exe
  2⤵
  PID:11080
- C:\Windows\System\laSMIip.exe
  C:\Windows\System\laSMIip.exe
  2⤵
  PID:11100
- C:\Windows\System\SnAteGh.exe
  C:\Windows\System\SnAteGh.exe
  2⤵
  PID:11116
- C:\Windows\System\QMTscEZ.exe
  C:\Windows\System\QMTscEZ.exe
  2⤵
  PID:11132
- C:\Windows\System\FPoLBfj.exe
  C:\Windows\System\FPoLBfj.exe
  2⤵
  PID:11148
- C:\Windows\System\czryRdM.exe
  C:\Windows\System\czryRdM.exe
  2⤵
  PID:11164
- C:\Windows\System\vkdQOKT.exe
  C:\Windows\System\vkdQOKT.exe
  2⤵
  PID:11184
- C:\Windows\System\fISnVPQ.exe
  C:\Windows\System\fISnVPQ.exe
  2⤵
  PID:11200
- C:\Windows\System\sRSsfao.exe
  C:\Windows\System\sRSsfao.exe
  2⤵
  PID:11220
- C:\Windows\System\QHQFSVW.exe
  C:\Windows\System\QHQFSVW.exe
  2⤵
  PID:11240
- C:\Windows\System\lcTjAAB.exe
  C:\Windows\System\lcTjAAB.exe
  2⤵
  PID:11260
- C:\Windows\System\CqkzMfB.exe
  C:\Windows\System\CqkzMfB.exe
  2⤵
  PID:8640
- C:\Windows\System\hgbLGHb.exe
  C:\Windows\System\hgbLGHb.exe
  2⤵
  PID:9756
- C:\Windows\System\YcIHKVX.exe
  C:\Windows\System\YcIHKVX.exe
  2⤵
  PID:9808
- C:\Windows\System\HlqXjsh.exe
  C:\Windows\System\HlqXjsh.exe
  2⤵
  PID:6536
- C:\Windows\System\pJPtsQN.exe
  C:\Windows\System\pJPtsQN.exe
  2⤵
  PID:6612
- C:\Windows\System\NlqpnfM.exe
  C:\Windows\System\NlqpnfM.exe
  2⤵
  PID:8896
- C:\Windows\System\zAfoTsj.exe
  C:\Windows\System\zAfoTsj.exe
  2⤵
  PID:9068
- C:\Windows\System\grwiemX.exe
  C:\Windows\System\grwiemX.exe
  2⤵
  PID:10004
- C:\Windows\System\GQfwZvX.exe
  C:\Windows\System\GQfwZvX.exe
  2⤵
  PID:10116
- C:\Windows\System\ANkvbCU.exe
  C:\Windows\System\ANkvbCU.exe
  2⤵
  PID:10204
- C:\Windows\System\isBOhzF.exe
  C:\Windows\System\isBOhzF.exe
  2⤵
  PID:7484
- C:\Windows\System\mbXPMpC.exe
  C:\Windows\System\mbXPMpC.exe
  2⤵
  PID:8368
- C:\Windows\System\VFRxNEr.exe
  C:\Windows\System\VFRxNEr.exe
  2⤵
  PID:4512
- C:\Windows\System\BSOMIgE.exe
  C:\Windows\System\BSOMIgE.exe
  2⤵
  PID:8600
- C:\Windows\System\lgfGrIe.exe
  C:\Windows\System\lgfGrIe.exe
  2⤵
  PID:7196
- C:\Windows\System\FJkKoDH.exe
  C:\Windows\System\FJkKoDH.exe
  2⤵
  PID:7252
- C:\Windows\System\FyFwemu.exe
  C:\Windows\System\FyFwemu.exe
  2⤵
  PID:7420
- C:\Windows\System\cajegNh.exe
  C:\Windows\System\cajegNh.exe
  2⤵
  PID:9024
- C:\Windows\System\krTjoxb.exe
  C:\Windows\System\krTjoxb.exe
  2⤵
  PID:9124
- C:\Windows\System\fZGSwaS.exe
  C:\Windows\System\fZGSwaS.exe
  2⤵
  PID:9204
- C:\Windows\System\fbApORw.exe
  C:\Windows\System\fbApORw.exe
  2⤵
  PID:6356
- C:\Windows\System\tLrGVhO.exe
  C:\Windows\System\tLrGVhO.exe
  2⤵
  PID:8
- C:\Windows\System\WpiYqra.exe
  C:\Windows\System\WpiYqra.exe
  2⤵
  PID:6968
- C:\Windows\System\vNcnaKe.exe
  C:\Windows\System\vNcnaKe.exe
  2⤵
  PID:11276
- C:\Windows\System\HnHBUGe.exe
  C:\Windows\System\HnHBUGe.exe
  2⤵
  PID:11296
- C:\Windows\System\DCNuHsI.exe
  C:\Windows\System\DCNuHsI.exe
  2⤵
  PID:11320
- C:\Windows\System\wutwZmi.exe
  C:\Windows\System\wutwZmi.exe
  2⤵
  PID:11344
- C:\Windows\System\pNUhptV.exe
  C:\Windows\System\pNUhptV.exe
  2⤵
  PID:11364
- C:\Windows\System\HVBlWef.exe
  C:\Windows\System\HVBlWef.exe
  2⤵
  PID:11388
- C:\Windows\System\hjmoMxl.exe
  C:\Windows\System\hjmoMxl.exe
  2⤵
  PID:11412
- C:\Windows\System\vQOwLjU.exe
  C:\Windows\System\vQOwLjU.exe
  2⤵
  PID:11432
- C:\Windows\System\gjXYMfA.exe
  C:\Windows\System\gjXYMfA.exe
  2⤵
  PID:11456
- C:\Windows\System\kIqLINb.exe
  C:\Windows\System\kIqLINb.exe
  2⤵
  PID:11476
- C:\Windows\System\xlUQWei.exe
  C:\Windows\System\xlUQWei.exe
  2⤵
  PID:11500
- C:\Windows\System\jgcenzu.exe
  C:\Windows\System\jgcenzu.exe
  2⤵
  PID:11520
- C:\Windows\System\UPZalsF.exe
  C:\Windows\System\UPZalsF.exe
  2⤵
  PID:11536
- C:\Windows\System\AZzEBHC.exe
  C:\Windows\System\AZzEBHC.exe
  2⤵
  PID:11560
- C:\Windows\System\sSVMxiT.exe
  C:\Windows\System\sSVMxiT.exe
  2⤵
  PID:11576
- C:\Windows\System\NKskoXU.exe
  C:\Windows\System\NKskoXU.exe
  2⤵
  PID:11596
- C:\Windows\System\rdTyvzB.exe
  C:\Windows\System\rdTyvzB.exe
  2⤵
  PID:11620
- C:\Windows\System\gHjQfZL.exe
  C:\Windows\System\gHjQfZL.exe
  2⤵
  PID:11640
- C:\Windows\System\gMAjkfd.exe
  C:\Windows\System\gMAjkfd.exe
  2⤵
  PID:11672
- C:\Windows\System\KlXNcVK.exe
  C:\Windows\System\KlXNcVK.exe
  2⤵
  PID:11688
- C:\Windows\System\lgacUXQ.exe
  C:\Windows\System\lgacUXQ.exe
  2⤵
  PID:11716
- C:\Windows\System\gyYZODU.exe
  C:\Windows\System\gyYZODU.exe
  2⤵
  PID:11732
- C:\Windows\System\MjVFYBL.exe
  C:\Windows\System\MjVFYBL.exe
  2⤵
  PID:12176
- C:\Windows\System\drbgiXT.exe
  C:\Windows\System\drbgiXT.exe
  2⤵
  PID:12232
- C:\Windows\System\OyTkmmo.exe
  C:\Windows\System\OyTkmmo.exe
  2⤵
  PID:12256
- C:\Windows\System\dIDQYBS.exe
  C:\Windows\System\dIDQYBS.exe
  2⤵
  PID:12276
- C:\Windows\System\tlzWaSU.exe
  C:\Windows\System\tlzWaSU.exe
  2⤵
  PID:9408
- C:\Windows\System\EBfEPiU.exe
  C:\Windows\System\EBfEPiU.exe
  2⤵
  PID:9492
- C:\Windows\System\MzgCelE.exe
  C:\Windows\System\MzgCelE.exe
  2⤵
  PID:9452
- C:\Windows\System\vnRBMXB.exe
  C:\Windows\System\vnRBMXB.exe
  2⤵
  PID:8540
- C:\Windows\System\IuGSLSY.exe
  C:\Windows\System\IuGSLSY.exe
  2⤵
  PID:10256
- C:\Windows\System\yUQOxeA.exe
  C:\Windows\System\yUQOxeA.exe
  2⤵
  PID:8624
- C:\Windows\System\sCvtaPe.exe
  C:\Windows\System\sCvtaPe.exe
  2⤵
  PID:9744
- C:\Windows\System\vVarlif.exe
  C:\Windows\System\vVarlif.exe
  2⤵
  PID:4700
- C:\Windows\System\plxzOsV.exe
  C:\Windows\System\plxzOsV.exe
  2⤵
  PID:8724
- C:\Windows\System\EzxGADz.exe
  C:\Windows\System\EzxGADz.exe
  2⤵
  PID:8744
- C:\Windows\System\yPZMXGv.exe
  C:\Windows\System\yPZMXGv.exe
  2⤵
  PID:8792
- C:\Windows\System\VFTZzbk.exe
  C:\Windows\System\VFTZzbk.exe
  2⤵
  PID:8956
- C:\Windows\System\MdvqVbl.exe
  C:\Windows\System\MdvqVbl.exe
  2⤵
  PID:5316
- C:\Windows\System\rJNqJZO.exe
  C:\Windows\System\rJNqJZO.exe
  2⤵
  PID:5804
- C:\Windows\System\lPTcFPp.exe
  C:\Windows\System\lPTcFPp.exe
  2⤵
  PID:8276
- C:\Windows\System\ZTmTELx.exe
  C:\Windows\System\ZTmTELx.exe
  2⤵
  PID:8380
- C:\Windows\System\fhMSerA.exe
  C:\Windows\System\fhMSerA.exe
  2⤵
  PID:6632
- C:\Windows\System\aqjSwTV.exe
  C:\Windows\System\aqjSwTV.exe
  2⤵
  PID:11172
- C:\Windows\System\qjEZIre.exe
  C:\Windows\System\qjEZIre.exe
  2⤵
  PID:11092
- C:\Windows\System\NslUAzd.exe
  C:\Windows\System\NslUAzd.exe
  2⤵
  PID:10664
- C:\Windows\System\ZPAhCwv.exe
  C:\Windows\System\ZPAhCwv.exe
  2⤵
  PID:11256
- C:\Windows\System\VSCpSTL.exe
  C:\Windows\System\VSCpSTL.exe
  2⤵
  PID:9628
- C:\Windows\System\kzTVowV.exe
  C:\Windows\System\kzTVowV.exe
  2⤵
  PID:6580
- C:\Windows\System\tHFXFGF.exe
  C:\Windows\System\tHFXFGF.exe
  2⤵
  PID:6288
- C:\Windows\System\uWokzwV.exe
  C:\Windows\System\uWokzwV.exe
  2⤵
  PID:6800
- C:\Windows\System\fPSjWlE.exe
  C:\Windows\System\fPSjWlE.exe
  2⤵
  PID:8176
- C:\Windows\System\GYSinlP.exe
  C:\Windows\System\GYSinlP.exe
  2⤵
  PID:6908
- C:\Windows\System\UgvoMlx.exe
  C:\Windows\System\UgvoMlx.exe
  2⤵
  PID:11288
- C:\Windows\System\eKgrILG.exe
  C:\Windows\System\eKgrILG.exe
  2⤵
  PID:11284
- C:\Windows\System\psqvkUP.exe
  C:\Windows\System\psqvkUP.exe
  2⤵
  PID:4704
- C:\Windows\System\nltGISF.exe
  C:\Windows\System\nltGISF.exe
  2⤵
  PID:11424
- C:\Windows\System\KHdTZnQ.exe
  C:\Windows\System\KHdTZnQ.exe
  2⤵
  PID:7568
- C:\Windows\System\kVeJKuD.exe
  C:\Windows\System\kVeJKuD.exe
  2⤵
  PID:9364
- C:\Windows\System\LVvEMGf.exe
  C:\Windows\System\LVvEMGf.exe
  2⤵
  PID:12300
- C:\Windows\System\wtkVwCI.exe
  C:\Windows\System\wtkVwCI.exe
  2⤵
  PID:12320
- C:\Windows\System\YHdMUMN.exe
  C:\Windows\System\YHdMUMN.exe
  2⤵
  PID:12336
- C:\Windows\System\DXMyCPB.exe
  C:\Windows\System\DXMyCPB.exe
  2⤵
  PID:12360
- C:\Windows\System\rXWHBgZ.exe
  C:\Windows\System\rXWHBgZ.exe
  2⤵
  PID:12376
- C:\Windows\System\GaZlPVn.exe
  C:\Windows\System\GaZlPVn.exe
  2⤵
  PID:12396
- C:\Windows\System\kmRSqHl.exe
  C:\Windows\System\kmRSqHl.exe
  2⤵
  PID:12416
- C:\Windows\System\esMHpvi.exe
  C:\Windows\System\esMHpvi.exe
  2⤵
  PID:12432
- C:\Windows\System\raMzEoz.exe
  C:\Windows\System\raMzEoz.exe
  2⤵
  PID:12448
- C:\Windows\System\zRKWPbZ.exe
  C:\Windows\System\zRKWPbZ.exe
  2⤵
  PID:12464
- C:\Windows\System\qELOmad.exe
  C:\Windows\System\qELOmad.exe
  2⤵
  PID:12480
- C:\Windows\System\icGrVYe.exe
  C:\Windows\System\icGrVYe.exe
  2⤵
  PID:12496
- C:\Windows\System\nEokxSZ.exe
  C:\Windows\System\nEokxSZ.exe
  2⤵
  PID:12516
- C:\Windows\System\faQSliT.exe
  C:\Windows\System\faQSliT.exe
  2⤵
  PID:12532
- C:\Windows\System\BsVjoKh.exe
  C:\Windows\System\BsVjoKh.exe
  2⤵
  PID:12560
- C:\Windows\System\VFiiNSU.exe
  C:\Windows\System\VFiiNSU.exe
  2⤵
  PID:12584
- C:\Windows\System\CkPzrAZ.exe
  C:\Windows\System\CkPzrAZ.exe
  2⤵
  PID:12604
- C:\Windows\System\FEXIxDv.exe
  C:\Windows\System\FEXIxDv.exe
  2⤵
  PID:12628
- C:\Windows\System\kMPNmfp.exe
  C:\Windows\System\kMPNmfp.exe
  2⤵
  PID:12652
- C:\Windows\System\InjTBfw.exe
  C:\Windows\System\InjTBfw.exe
  2⤵
  PID:12680
- C:\Windows\System\vxlbvUz.exe
  C:\Windows\System\vxlbvUz.exe
  2⤵
  PID:12700
- C:\Windows\System\cudvjQL.exe
  C:\Windows\System\cudvjQL.exe
  2⤵
  PID:12716
- C:\Windows\System\kXUBuaF.exe
  C:\Windows\System\kXUBuaF.exe
  2⤵
  PID:12736
- C:\Windows\System\yyhyxPa.exe
  C:\Windows\System\yyhyxPa.exe
  2⤵
  PID:12760
- C:\Windows\System\RMaOtQP.exe
  C:\Windows\System\RMaOtQP.exe
  2⤵
  PID:12784
- C:\Windows\System\kxsFPhI.exe
  C:\Windows\System\kxsFPhI.exe
  2⤵
  PID:13144
- C:\Windows\System\ZPWaUQX.exe
  C:\Windows\System\ZPWaUQX.exe
  2⤵
  PID:13164
- C:\Windows\System\qZqSKLx.exe
  C:\Windows\System\qZqSKLx.exe
  2⤵
  PID:13184
- C:\Windows\System\DpOAWPy.exe
  C:\Windows\System\DpOAWPy.exe
  2⤵
  PID:13208
- C:\Windows\System\UadsuRt.exe
  C:\Windows\System\UadsuRt.exe
  2⤵
  PID:13240
- C:\Windows\System\lJLLbyu.exe
  C:\Windows\System\lJLLbyu.exe
  2⤵
  PID:13260
- C:\Windows\System\nXdBDSw.exe
  C:\Windows\System\nXdBDSw.exe
  2⤵
  PID:13280
- C:\Windows\System\sdmPINo.exe
  C:\Windows\System\sdmPINo.exe
  2⤵
  PID:13300
- C:\Windows\System\vfHhNsz.exe
  C:\Windows\System\vfHhNsz.exe
  2⤵
  PID:11636
- C:\Windows\System\RQlVHDQ.exe
  C:\Windows\System\RQlVHDQ.exe
  2⤵
  PID:9604
- C:\Windows\System\AFpOYRS.exe
  C:\Windows\System\AFpOYRS.exe
  2⤵
  PID:10368
- C:\Windows\System\XuTKEVa.exe
  C:\Windows\System\XuTKEVa.exe
  2⤵
  PID:10416
- C:\Windows\System\gNwahcL.exe
  C:\Windows\System\gNwahcL.exe
  2⤵
  PID:9860
- C:\Windows\System\RWAvBKX.exe
  C:\Windows\System\RWAvBKX.exe
  2⤵
  PID:9892
- C:\Windows\System\QvTBkoq.exe
  C:\Windows\System\QvTBkoq.exe
  2⤵
  PID:9960
- C:\Windows\System\FfxpQtu.exe
  C:\Windows\System\FfxpQtu.exe
  2⤵
  PID:10024
- C:\Windows\System\NbqemqW.exe
  C:\Windows\System\NbqemqW.exe
  2⤵
  PID:10076
- C:\Windows\System\yyFysza.exe
  C:\Windows\System\yyFysza.exe
  2⤵
  PID:13512
- C:\Windows\System\gSRJcOg.exe
  C:\Windows\System\gSRJcOg.exe
  2⤵
  PID:12216
- C:\Windows\System\SMyMtLr.exe
  C:\Windows\System\SMyMtLr.exe
  2⤵
  PID:12248
- C:\Windows\System\GPeBRqm.exe
  C:\Windows\System\GPeBRqm.exe
  2⤵
  PID:9544
- C:\Windows\System\NLqSzZd.exe
  C:\Windows\System\NLqSzZd.exe
  2⤵
  PID:8696
- C:\Windows\System\vREmRaO.exe
  C:\Windows\System\vREmRaO.exe
  2⤵
  PID:8736
- C:\Windows\System\PVAVqIQ.exe
  C:\Windows\System\PVAVqIQ.exe
  2⤵
  PID:8832
- C:\Windows\System\lxiKoxk.exe
  C:\Windows\System\lxiKoxk.exe
  2⤵
  PID:3216
- C:\Windows\System\YafWEtw.exe
  C:\Windows\System\YafWEtw.exe
  2⤵
  PID:2416
- C:\Windows\System\LjbszaK.exe
  C:\Windows\System\LjbszaK.exe
  2⤵
  PID:7688
- C:\Windows\System\YcXwXIq.exe
  C:\Windows\System\YcXwXIq.exe
  2⤵
  PID:12316
- C:\Windows\System\XJaFMNE.exe
  C:\Windows\System\XJaFMNE.exe
  2⤵
  PID:12388
- C:\Windows\System\htixwEF.exe
  C:\Windows\System\htixwEF.exe
  2⤵
  PID:12456
- C:\Windows\System\abkDnSe.exe
  C:\Windows\System\abkDnSe.exe
  2⤵
  PID:12528
- C:\Windows\System\XpUTmte.exe
  C:\Windows\System\XpUTmte.exe
  2⤵
  PID:12596
- C:\Windows\System\SAcRekM.exe
  C:\Windows\System\SAcRekM.exe
  2⤵
  PID:12728
- C:\Windows\System\GvjaPvA.exe
  C:\Windows\System\GvjaPvA.exe
  2⤵
  PID:12768
- C:\Windows\System\OYYywnn.exe
  C:\Windows\System\OYYywnn.exe
  2⤵
  PID:3612
- C:\Windows\System\moXrsHg.exe
  C:\Windows\System\moXrsHg.exe
  2⤵
  PID:1428
- C:\Windows\System\qzLnRpX.exe
  C:\Windows\System\qzLnRpX.exe
  2⤵
  PID:12444
- C:\Windows\System\NfNiWbl.exe
  C:\Windows\System\NfNiWbl.exe
  2⤵
  PID:11740
- C:\Windows\System\riaJFdA.exe
  C:\Windows\System\riaJFdA.exe
  2⤵
  PID:12856
- C:\Windows\System\vsoxVEv.exe
  C:\Windows\System\vsoxVEv.exe
  2⤵
  PID:12900
- C:\Windows\System\gjjLRBC.exe
  C:\Windows\System\gjjLRBC.exe
  2⤵
  PID:12944
- C:\Windows\System\GsEDoNj.exe
  C:\Windows\System\GsEDoNj.exe
  2⤵
  PID:13424
- C:\Windows\System\uJmUWZk.exe
  C:\Windows\System\uJmUWZk.exe
  2⤵
  PID:13100
- C:\Windows\System\DOSBpTm.exe
  C:\Windows\System\DOSBpTm.exe
  2⤵
  PID:216
- C:\Windows\System\kAKtbKr.exe
  C:\Windows\System\kAKtbKr.exe
  2⤵
  PID:10460
- C:\Windows\System\TjLxxtA.exe
  C:\Windows\System\TjLxxtA.exe
  2⤵
  PID:13256
- C:\Windows\System\yGygcrK.exe
  C:\Windows\System\yGygcrK.exe
  2⤵
  PID:13276
- C:\Windows\System\LPXJuFW.exe
  C:\Windows\System\LPXJuFW.exe
  2⤵
  PID:9844
- C:\Windows\System\YZmTNoo.exe
  C:\Windows\System\YZmTNoo.exe
  2⤵
  PID:9944
- C:\Windows\System\VvpdCHX.exe
  C:\Windows\System\VvpdCHX.exe
  2⤵
  PID:1552
- C:\Windows\System\YUTWncq.exe
  C:\Windows\System\YUTWncq.exe
  2⤵
  PID:7916
- C:\Windows\System\NiSAqjW.exe
  C:\Windows\System\NiSAqjW.exe
  2⤵
  PID:6480
- C:\Windows\System\kppwjqT.exe
  C:\Windows\System\kppwjqT.exe
  2⤵
  PID:8648
- C:\Windows\System\DpMrOGZ.exe
  C:\Windows\System\DpMrOGZ.exe
  2⤵
  PID:11192
- C:\Windows\System\ZwpgIBg.exe
  C:\Windows\System\ZwpgIBg.exe
  2⤵
  PID:11492
- C:\Windows\System\EuldNSl.exe
  C:\Windows\System\EuldNSl.exe
  2⤵
  PID:13536
- C:\Windows\System\gwhhhTZ.exe
  C:\Windows\System\gwhhhTZ.exe
  2⤵
  PID:692
- C:\Windows\System\jiFpKEX.exe
  C:\Windows\System\jiFpKEX.exe
  2⤵
  PID:3068
- C:\Windows\System\bIWGdfW.exe
  C:\Windows\System\bIWGdfW.exe
  2⤵
  PID:10456
- C:\Windows\System\FPMgyib.exe
  C:\Windows\System\FPMgyib.exe
  2⤵
  PID:9004
- C:\Windows\System\XPLWOvB.exe
  C:\Windows\System\XPLWOvB.exe
  2⤵
  PID:4368
- C:\Windows\System\DedbtBB.exe
  C:\Windows\System\DedbtBB.exe
  2⤵
  PID:14180
- C:\Windows\System\lXsUCjA.exe
  C:\Windows\System\lXsUCjA.exe
  2⤵
  PID:220
- C:\Windows\System\dWhYGTe.exe
  C:\Windows\System\dWhYGTe.exe
  2⤵
  PID:12172
- C:\Windows\System\iZGIWGM.exe
  C:\Windows\System\iZGIWGM.exe
  2⤵
  PID:11448
- C:\Windows\System\omIbCKO.exe
  C:\Windows\System\omIbCKO.exe
  2⤵
  PID:10812
- C:\Windows\System\tWldlfl.exe
  C:\Windows\System\tWldlfl.exe
  2⤵
  PID:14276
- C:\Windows\System\PFjBILJ.exe
  C:\Windows\System\PFjBILJ.exe
  2⤵
  PID:9160
- C:\Windows\System\IUvFFyh.exe
  C:\Windows\System\IUvFFyh.exe
  2⤵
  PID:9676
- C:\Windows\System\DtdqHlU.exe
  C:\Windows\System\DtdqHlU.exe
  2⤵
  PID:11196
- C:\Windows\System\CIIHaHy.exe
  C:\Windows\System\CIIHaHy.exe
  2⤵
  PID:12012
- C:\Windows\System\YjyiyqD.exe
  C:\Windows\System\YjyiyqD.exe
  2⤵
  PID:2288
- C:\Windows\System\mletwDQ.exe
  C:\Windows\System\mletwDQ.exe
  2⤵
  PID:10172
- C:\Windows\System\eVeeGSR.exe
  C:\Windows\System\eVeeGSR.exe
  2⤵
  PID:4360
- C:\Windows\System\QbOptHX.exe
  C:\Windows\System\QbOptHX.exe
  2⤵
  PID:3256
- C:\Windows\System\yyqylEh.exe
  C:\Windows\System\yyqylEh.exe
  2⤵
  PID:8760
- C:\Windows\System\CGXyuXb.exe
  C:\Windows\System\CGXyuXb.exe
  2⤵
  PID:3896
- C:\Windows\System\waibwcK.exe
  C:\Windows\System\waibwcK.exe
  2⤵
  PID:10100
- C:\Windows\System\okVMWta.exe
  C:\Windows\System\okVMWta.exe
  2⤵
  PID:14100
- C:\Windows\System\hipntRs.exe
  C:\Windows\System\hipntRs.exe
  2⤵
  PID:12512
- C:\Windows\System\jGsTkIy.exe
  C:\Windows\System\jGsTkIy.exe
  2⤵
  PID:12592
- C:\Windows\System\LvoRYjT.exe
  C:\Windows\System\LvoRYjT.exe
  2⤵
  PID:11272
- C:\Windows\System\wQerUTS.exe
  C:\Windows\System\wQerUTS.exe
  2⤵
  PID:12660
- C:\Windows\System\IyBRraQ.exe
  C:\Windows\System\IyBRraQ.exe
  2⤵
  PID:12504
- C:\Windows\System\eQggsYJ.exe
  C:\Windows\System\eQggsYJ.exe
  2⤵
  PID:10840
- C:\Windows\System\cHuPPAW.exe
  C:\Windows\System\cHuPPAW.exe
  2⤵
  PID:11400
- C:\Windows\System\QoDmPsx.exe
  C:\Windows\System\QoDmPsx.exe
  2⤵
  PID:13576
- C:\Windows\System\KcxWQuX.exe
  C:\Windows\System\KcxWQuX.exe
  2⤵
  PID:13408
- C:\Windows\System\bMXxXRZ.exe
  C:\Windows\System\bMXxXRZ.exe
  2⤵
  PID:13420
- C:\Windows\System\XRmRWMQ.exe
  C:\Windows\System\XRmRWMQ.exe
  2⤵
  PID:8888
- C:\Windows\System\etEplYA.exe
  C:\Windows\System\etEplYA.exe
  2⤵
  PID:10224
- C:\Windows\System\mDdlhCS.exe
  C:\Windows\System\mDdlhCS.exe
  2⤵
  PID:14056
- C:\Windows\System\inyNMRR.exe
  C:\Windows\System\inyNMRR.exe
  2⤵
  PID:13708
- C:\Windows\System\guPLCch.exe
  C:\Windows\System\guPLCch.exe
  2⤵
  PID:12960
- C:\Windows\System\ROjxKRS.exe
  C:\Windows\System\ROjxKRS.exe
  2⤵
  PID:11088
- C:\Windows\System\QGqPiqU.exe
  C:\Windows\System\QGqPiqU.exe
  2⤵
  PID:5236
- C:\Windows\System\KbXdEXY.exe
  C:\Windows\System\KbXdEXY.exe
  2⤵
  PID:13428
- C:\Windows\System\JNyAyeo.exe
  C:\Windows\System\JNyAyeo.exe
  2⤵
  PID:14216
- C:\Windows\System\WuoVaJS.exe
  C:\Windows\System\WuoVaJS.exe
  2⤵
  PID:14312
- C:\Windows\System\OYdKTaB.exe
  C:\Windows\System\OYdKTaB.exe
  2⤵
  PID:7360
- C:\Windows\System\cSZaVoS.exe
  C:\Windows\System\cSZaVoS.exe
  2⤵
  PID:4488
- C:\Windows\System\lmWeGkZ.exe
  C:\Windows\System\lmWeGkZ.exe
  2⤵
  PID:12240
- C:\Windows\System\BEamAvN.exe
  C:\Windows\System\BEamAvN.exe
  2⤵
  PID:10772
- C:\Windows\System\XPVLnda.exe
  C:\Windows\System\XPVLnda.exe
  2⤵
  PID:12620
- C:\Windows\System\tExSWuA.exe
  C:\Windows\System\tExSWuA.exe
  2⤵
  PID:13292
- C:\Windows\System\DoVJcxi.exe
  C:\Windows\System\DoVJcxi.exe
  2⤵
  PID:13316
- C:\Windows\System\bvfMdiJ.exe
  C:\Windows\System\bvfMdiJ.exe
  2⤵
  PID:6804
- C:\Windows\System\qedjZLd.exe
  C:\Windows\System\qedjZLd.exe
  2⤵
  PID:14084
- C:\Windows\System\XWVtNDf.exe
  C:\Windows\System\XWVtNDf.exe
  2⤵
  PID:13804
- C:\Windows\System\DrguZHR.exe
  C:\Windows\System\DrguZHR.exe
  2⤵
  PID:12296
- C:\Windows\System\HekhWdR.exe
  C:\Windows\System\HekhWdR.exe
  2⤵
  PID:3972
- C:\Windows\System\spnIJGx.exe
  C:\Windows\System\spnIJGx.exe
  2⤵
  PID:12940
- C:\Windows\System\JYKuCfJ.exe
  C:\Windows\System\JYKuCfJ.exe
  2⤵
  PID:14168
- C:\Windows\System\ScMxOYv.exe
  C:\Windows\System\ScMxOYv.exe
  2⤵
  PID:12120
- C:\Windows\System\MPZDJTy.exe
  C:\Windows\System\MPZDJTy.exe
  2⤵
  PID:3524
- C:\Windows\System\nFqOrYD.exe
  C:\Windows\System\nFqOrYD.exe
  2⤵
  PID:3212
- C:\Windows\System\zhMAiRA.exe
  C:\Windows\System\zhMAiRA.exe
  2⤵
  PID:392
- C:\Windows\System\RoikHJU.exe
  C:\Windows\System\RoikHJU.exe
  2⤵
  PID:808
- C:\Windows\System\eBqkXTk.exe
  C:\Windows\System\eBqkXTk.exe
  2⤵
  PID:5460
- C:\Windows\System\nLVKuWm.exe
  C:\Windows\System\nLVKuWm.exe
  2⤵
  PID:5880
- C:\Windows\System\aVIIGyC.exe
  C:\Windows\System\aVIIGyC.exe
  2⤵
  PID:8720
- C:\Windows\System\NNuipdK.exe
  C:\Windows\System\NNuipdK.exe
  2⤵
  PID:14120
- C:\Windows\System\rlwxnWH.exe
  C:\Windows\System\rlwxnWH.exe
  2⤵
  PID:1956
- C:\Windows\System\tYnvzUq.exe
  C:\Windows\System\tYnvzUq.exe
  2⤵
  PID:11616
- C:\Windows\System\CxsuOUv.exe
  C:\Windows\System\CxsuOUv.exe
  2⤵
  PID:4160
- C:\Windows\System\ZppwGHu.exe
  C:\Windows\System\ZppwGHu.exe
  2⤵
  PID:3344
- C:\Windows\System\wTLpWJF.exe
  C:\Windows\System\wTLpWJF.exe
  2⤵
  PID:9296
- C:\Windows\System\YESfgkr.exe
  C:\Windows\System\YESfgkr.exe
  2⤵
  PID:7764
- C:\Windows\System\eOPsVew.exe
  C:\Windows\System\eOPsVew.exe
  2⤵
  PID:13464
- C:\Windows\System\wIHyjBz.exe
  C:\Windows\System\wIHyjBz.exe
  2⤵
  PID:14124
- C:\Windows\System\MVWJhHQ.exe
  C:\Windows\System\MVWJhHQ.exe
  2⤵
  PID:13384
- C:\Windows\System\QhFcNJx.exe
  C:\Windows\System\QhFcNJx.exe
  2⤵
  PID:13568
- C:\Windows\System\AIRvthg.exe
  C:\Windows\System\AIRvthg.exe
  2⤵
  PID:404
- C:\Windows\System\VfPSJII.exe
  C:\Windows\System\VfPSJII.exe
  2⤵
  PID:14116
- C:\Windows\System\CsVUNok.exe
  C:\Windows\System\CsVUNok.exe
  2⤵
  PID:10980
- C:\Windows\System\nehJlRA.exe
  C:\Windows\System\nehJlRA.exe
  2⤵
  PID:5076
- C:\Windows\System\OaZidoo.exe
  C:\Windows\System\OaZidoo.exe
  2⤵
  PID:6312
- C:\Windows\System\NdkdhBq.exe
  C:\Windows\System\NdkdhBq.exe
  2⤵
  PID:10412
- C:\Windows\System\qakhReA.exe
  C:\Windows\System\qakhReA.exe
  2⤵
  PID:2528
- C:\Windows\System\sexqBSt.exe
  C:\Windows\System\sexqBSt.exe
  2⤵
  PID:13720
- C:\Windows\System\OhmflsS.exe
  C:\Windows\System\OhmflsS.exe
  2⤵
  PID:4980
- C:\Windows\System\viFDKhQ.exe
  C:\Windows\System\viFDKhQ.exe
  2⤵
  PID:11704
- C:\Windows\System\IWajpfd.exe
  C:\Windows\System\IWajpfd.exe
  2⤵
  PID:4400
- C:\Windows\System\lWTPHzX.exe
  C:\Windows\System\lWTPHzX.exe
  2⤵
  PID:2744
- C:\Windows\System\ceSKHqM.exe
  C:\Windows\System\ceSKHqM.exe
  2⤵
  PID:14072
- C:\Windows\System\HFvkLzE.exe
  C:\Windows\System\HFvkLzE.exe
  2⤵
  PID:1908
- C:\Windows\System\CsPuxRj.exe
  C:\Windows\System\CsPuxRj.exe
  2⤵
  PID:13448
- C:\Windows\System\atDAJEz.exe
  C:\Windows\System\atDAJEz.exe
  2⤵
  PID:1040
- C:\Windows\System\haVEnSE.exe
  C:\Windows\System\haVEnSE.exe
  2⤵
  PID:14240
- C:\Windows\System\lRyJWzP.exe
  C:\Windows\System\lRyJWzP.exe
  2⤵
  PID:3600
- C:\Windows\System\BVJbkIh.exe
  C:\Windows\System\BVJbkIh.exe
  2⤵
  PID:2244
- C:\Windows\System\mBJAOdq.exe
  C:\Windows\System\mBJAOdq.exe
  2⤵
  PID:13528
- C:\Windows\System\CtgcMkY.exe
  C:\Windows\System\CtgcMkY.exe
  2⤵
  PID:4872
- C:\Windows\System\mLltNdh.exe
  C:\Windows\System\mLltNdh.exe
  2⤵
  PID:13416
- C:\Windows\System\sXKrVnF.exe
  C:\Windows\System\sXKrVnF.exe
  2⤵
  PID:3596
- C:\Windows\System\rqBDfBr.exe
  C:\Windows\System\rqBDfBr.exe
  2⤵
  PID:13844
- C:\Windows\System\GaiaxEi.exe
  C:\Windows\System\GaiaxEi.exe
  2⤵
  PID:1224
- C:\Windows\System\xCQzkjg.exe
  C:\Windows\System\xCQzkjg.exe
  2⤵
  PID:3624
- C:\Windows\System\iYVHimT.exe
  C:\Windows\System\iYVHimT.exe
  2⤵
  PID:6308
- C:\Windows\System\UnKBiHP.exe
  C:\Windows\System\UnKBiHP.exe
  2⤵
  PID:4180
- C:\Windows\System\asxVveu.exe
  C:\Windows\System\asxVveu.exe
  2⤵
  PID:14064
- C:\Windows\System\gTwKiHY.exe
  C:\Windows\System\gTwKiHY.exe
  2⤵
  PID:12184
- C:\Windows\System\VJbZRBf.exe
  C:\Windows\System\VJbZRBf.exe
  2⤵
  PID:4416
- C:\Windows\System\WGTsefU.exe
  C:\Windows\System\WGTsefU.exe
  2⤵
  PID:5760
- C:\Windows\System\UZdbXfy.exe
  C:\Windows\System\UZdbXfy.exe
  2⤵
  PID:3200
- C:\Windows\System\jzdCEHI.exe
  C:\Windows\System\jzdCEHI.exe
  2⤵
  PID:4196
- C:\Windows\System\jUvTcwA.exe
  C:\Windows\System\jUvTcwA.exe
  2⤵
  PID:4828
- C:\Windows\System\yxJtCPx.exe
  C:\Windows\System\yxJtCPx.exe
  2⤵
  PID:6400
- C:\Windows\System\ZffUsQO.exe
  C:\Windows\System\ZffUsQO.exe
  2⤵
  PID:3772
- C:\Windows\System\nBDgbqC.exe
  C:\Windows\System\nBDgbqC.exe
  2⤵
  PID:4104
- C:\Windows\System\DWdWjbv.exe
  C:\Windows\System\DWdWjbv.exe
  2⤵
  PID:6668
- C:\Windows\System\SfjPOiu.exe
  C:\Windows\System\SfjPOiu.exe
  2⤵
  PID:7620
- C:\Windows\System\TEcynpn.exe
  C:\Windows\System\TEcynpn.exe
  2⤵
  PID:2596
- C:\Windows\System\ohBvSgt.exe
  C:\Windows\System\ohBvSgt.exe
  2⤵
  PID:13828
- C:\Windows\System\MKqeCdP.exe
  C:\Windows\System\MKqeCdP.exe
  2⤵
  PID:7068
- C:\Windows\System\SAsenPq.exe
  C:\Windows\System\SAsenPq.exe
  2⤵
  PID:7156
- C:\Windows\System\WFdhagK.exe
  C:\Windows\System\WFdhagK.exe
  2⤵
  PID:7732
- C:\Windows\System\RnTAuPk.exe
  C:\Windows\System\RnTAuPk.exe
  2⤵
  PID:976
- C:\Windows\System\ZEGBpeZ.exe
  C:\Windows\System\ZEGBpeZ.exe
  2⤵
  PID:7768
- C:\Windows\System\fivlPMT.exe
  C:\Windows\System\fivlPMT.exe
  2⤵
  PID:14060
- C:\Windows\System\vfrpThz.exe
  C:\Windows\System\vfrpThz.exe
  2⤵
  PID:8024
- C:\Windows\System\NHkxVbX.exe
  C:\Windows\System\NHkxVbX.exe
  2⤵
  PID:8064
- C:\Windows\System\OLyqqOc.exe
  C:\Windows\System\OLyqqOc.exe
  2⤵
  PID:9688
- C:\Windows\System\nXkhjFs.exe
  C:\Windows\System\nXkhjFs.exe
  2⤵
  PID:5380
- C:\Windows\System\yiIsARZ.exe
  C:\Windows\System\yiIsARZ.exe
  2⤵
  PID:5500
- C:\Windows\System\IISHwme.exe
  C:\Windows\System\IISHwme.exe
  2⤵
  PID:6492
- C:\Windows\System\rMDvifu.exe
  C:\Windows\System\rMDvifu.exe
  2⤵
  PID:5448
- C:\Windows\System\hYqZQKl.exe
  C:\Windows\System\hYqZQKl.exe
  2⤵
  PID:7952
- C:\Windows\System\rHXFDMT.exe
  C:\Windows\System\rHXFDMT.exe
  2⤵
  PID:13792
- C:\Windows\System\tfSvOPc.exe
  C:\Windows\System\tfSvOPc.exe
  2⤵
  PID:4772
- C:\Windows\System\pXRkCmX.exe
  C:\Windows\System\pXRkCmX.exe
  2⤵
  PID:9276
- C:\Windows\System\KfyRatB.exe
  C:\Windows\System\KfyRatB.exe
  2⤵
  PID:460
- C:\Windows\System\LPMKNtP.exe
  C:\Windows\System\LPMKNtP.exe
  2⤵
  PID:9480
- C:\Windows\System\InNnEmb.exe
  C:\Windows\System\InNnEmb.exe
  2⤵
  PID:9616
- C:\Windows\System\JuOBZXJ.exe
  C:\Windows\System\JuOBZXJ.exe
  2⤵
  PID:6336
- C:\Windows\System\GyVSkcv.exe
  C:\Windows\System\GyVSkcv.exe
  2⤵
  PID:9956
- C:\Windows\System\FJaSVYx.exe
  C:\Windows\System\FJaSVYx.exe
  2⤵
  PID:10072
- C:\Windows\System\LJYeyZy.exe
  C:\Windows\System\LJYeyZy.exe
  2⤵
  PID:6656
- C:\Windows\System\fPVjBFd.exe
  C:\Windows\System\fPVjBFd.exe
  2⤵
  PID:1488
- C:\Windows\System\BcZdoGS.exe
  C:\Windows\System\BcZdoGS.exe
  2⤵
  PID:10196
- C:\Windows\System\ZybfsNq.exe
  C:\Windows\System\ZybfsNq.exe
  2⤵
  PID:6924
- C:\Windows\System\VyfltGr.exe
  C:\Windows\System\VyfltGr.exe
  2⤵
  PID:9252
- C:\Windows\System\EWobxIb.exe
  C:\Windows\System\EWobxIb.exe
  2⤵
  PID:9412
- C:\Windows\System\EGYLKfi.exe
  C:\Windows\System\EGYLKfi.exe
  2⤵
  PID:8448
- C:\Windows\System\hQntfgf.exe
  C:\Windows\System\hQntfgf.exe
  2⤵
  PID:10372
- C:\Windows\System\JApNFco.exe
  C:\Windows\System\JApNFco.exe
  2⤵
  PID:7748
- C:\Windows\System\jfORNax.exe
  C:\Windows\System\jfORNax.exe
  2⤵
  PID:6052
- C:\Windows\System\SjJvoti.exe
  C:\Windows\System\SjJvoti.exe
  2⤵
  PID:4988
- C:\Windows\System\XOsGewk.exe
  C:\Windows\System\XOsGewk.exe
  2⤵
  PID:10704
- C:\Windows\System\LUmoOgO.exe
  C:\Windows\System\LUmoOgO.exe
  2⤵
  PID:10908
- C:\Windows\System\mjxjItE.exe
  C:\Windows\System\mjxjItE.exe
  2⤵
  PID:6628
- C:\Windows\System\EqbgKDK.exe
  C:\Windows\System\EqbgKDK.exe
  2⤵
  PID:11608
- C:\Windows\System\YwrPsVC.exe
  C:\Windows\System\YwrPsVC.exe
  2⤵
  PID:7440
- C:\Windows\System\DRpmrAI.exe
  C:\Windows\System\DRpmrAI.exe
  2⤵
  PID:5228
- C:\Windows\System\djIHFil.exe
  C:\Windows\System\djIHFil.exe
  2⤵
  PID:11028
- C:\Windows\System\riRYFdk.exe
  C:\Windows\System\riRYFdk.exe
  2⤵
  PID:13740
- C:\Windows\System\LsHHQbd.exe
  C:\Windows\System\LsHHQbd.exe
  2⤵
  PID:4136
- C:\Windows\System\LyqILVz.exe
  C:\Windows\System\LyqILVz.exe
  2⤵
  PID:5572
- C:\Windows\System\nXEFBFw.exe
  C:\Windows\System\nXEFBFw.exe
  2⤵
  PID:3588
- C:\Windows\System\Cnidylt.exe
  C:\Windows\System\Cnidylt.exe
  2⤵
  PID:9056
- C:\Windows\System\RWuVGAY.exe
  C:\Windows\System\RWuVGAY.exe
  2⤵
  PID:6016
- C:\Windows\System\MhsxhFL.exe
  C:\Windows\System\MhsxhFL.exe
  2⤵
  PID:11096
- C:\Windows\System\iuoqfHa.exe
  C:\Windows\System\iuoqfHa.exe
  2⤵
  PID:11484
- C:\Windows\System\MwSufeO.exe
  C:\Windows\System\MwSufeO.exe
  2⤵
  PID:11628
- C:\Windows\System\UjRKEjJ.exe
  C:\Windows\System\UjRKEjJ.exe
  2⤵
  PID:11812
- C:\Windows\System\BRaPvMp.exe
  C:\Windows\System\BRaPvMp.exe
  2⤵
  PID:11848
- C:\Windows\System\FmIozCn.exe
  C:\Windows\System\FmIozCn.exe
  2⤵
  PID:7088
- C:\Windows\System\gqqhDdN.exe
  C:\Windows\System\gqqhDdN.exe
  2⤵
  PID:8816
- C:\Windows\System\vTFBOwN.exe
  C:\Windows\System\vTFBOwN.exe
  2⤵
  PID:12972
- C:\Windows\System\HkANBdk.exe
  C:\Windows\System\HkANBdk.exe
  2⤵
  PID:12032
- C:\Windows\System\cdyUxmi.exe
  C:\Windows\System\cdyUxmi.exe
  2⤵
  PID:12056
- C:\Windows\System\ydqCLze.exe
  C:\Windows\System\ydqCLze.exe
  2⤵
  PID:13068
- C:\Windows\System\dUzyCJf.exe
  C:\Windows\System\dUzyCJf.exe
  2⤵
  PID:3080
- C:\Windows\System\ibsndiX.exe
  C:\Windows\System\ibsndiX.exe
  2⤵
  PID:12188
- C:\Windows\System\JShFBav.exe
  C:\Windows\System\JShFBav.exe
  2⤵
  PID:9548
- C:\Windows\System\akwzlje.exe
  C:\Windows\System\akwzlje.exe
  2⤵
  PID:8324
- C:\Windows\System\caPETjq.exe
  C:\Windows\System\caPETjq.exe
  2⤵
  PID:8216
- C:\Windows\System\XSDYJcI.exe
  C:\Windows\System\XSDYJcI.exe
  2⤵
  PID:9508
- C:\Windows\System\xjXlWNQ.exe
  C:\Windows\System\xjXlWNQ.exe
  2⤵
  PID:9648
- C:\Windows\System\kQsrMtT.exe
  C:\Windows\System\kQsrMtT.exe
  2⤵
  PID:12572
- C:\Windows\System\lYTLqcB.exe
  C:\Windows\System\lYTLqcB.exe
  2⤵
  PID:8184
- C:\Windows\System\hlvjNfF.exe
  C:\Windows\System\hlvjNfF.exe
  2⤵
  PID:8892
- C:\Windows\System\shcaIst.exe
  C:\Windows\System\shcaIst.exe
  2⤵
  PID:12860
- C:\Windows\System\VFpyLme.exe
  C:\Windows\System\VFpyLme.exe
  2⤵
  PID:12888
- C:\Windows\System\wgUvKJV.exe
  C:\Windows\System\wgUvKJV.exe
  2⤵
  PID:11864
- C:\Windows\System\GbxQsKL.exe
  C:\Windows\System\GbxQsKL.exe
  2⤵
  PID:9100
- C:\Windows\System\yTraJTt.exe
  C:\Windows\System\yTraJTt.exe
  2⤵
  PID:6732
- C:\Windows\System\keVVmbz.exe
  C:\Windows\System\keVVmbz.exe
  2⤵
  PID:13060
- C:\Windows\System\rUPsNjo.exe
  C:\Windows\System\rUPsNjo.exe
  2⤵
  PID:9208
- C:\Windows\System\qfpIozH.exe
  C:\Windows\System\qfpIozH.exe
  2⤵
  PID:13136
- C:\Windows\System\vnnSQtI.exe
  C:\Windows\System\vnnSQtI.exe
  2⤵
  PID:13248
- C:\Windows\System\BDQkMGt.exe
  C:\Windows\System\BDQkMGt.exe
  2⤵
  PID:12780
- C:\Windows\System\qFXXsOx.exe
  C:\Windows\System\qFXXsOx.exe
  2⤵
  PID:8552
- C:\Windows\System\GEnSdIl.exe
  C:\Windows\System\GEnSdIl.exe
  2⤵
  PID:2568
- C:\Windows\System\gxilHsX.exe
  C:\Windows\System\gxilHsX.exe
  2⤵
  PID:13772
- C:\Windows\System\QskrJYH.exe
  C:\Windows\System\QskrJYH.exe
  2⤵
  PID:7716
- C:\Windows\System\kSKihvW.exe
  C:\Windows\System\kSKihvW.exe
  2⤵
  PID:13988
- C:\Windows\System\NWTwjRK.exe
  C:\Windows\System\NWTwjRK.exe
  2⤵
  PID:9848
- C:\Windows\System\BYLBDrN.exe
  C:\Windows\System\BYLBDrN.exe
  2⤵
  PID:13892
- C:\Windows\System\fCXpVrg.exe
  C:\Windows\System\fCXpVrg.exe
  2⤵
  PID:7752
- C:\Windows\System\xfQyzpv.exe
  C:\Windows\System\xfQyzpv.exe
  2⤵
  PID:10040
- C:\Windows\System\SqKMmtu.exe
  C:\Windows\System\SqKMmtu.exe
  2⤵
  PID:14296
- C:\Windows\System\ZrtBEuE.exe
  C:\Windows\System\ZrtBEuE.exe
  2⤵
  PID:14184
- C:\Windows\System\pSLqFph.exe
  C:\Windows\System\pSLqFph.exe
  2⤵
  PID:10176
- C:\Windows\System\SatyvtE.exe
  C:\Windows\System\SatyvtE.exe
  2⤵
  PID:11592
- C:\Windows\System\lwGuyab.exe
  C:\Windows\System\lwGuyab.exe
  2⤵
  PID:14268
- C:\Windows\System\QmGUuLq.exe
  C:\Windows\System\QmGUuLq.exe
  2⤵
  PID:14292
- C:\Windows\System\FaCQfLE.exe
  C:\Windows\System\FaCQfLE.exe
  2⤵
  PID:884
- C:\Windows\System\cHeSABo.exe
  C:\Windows\System\cHeSABo.exe
  2⤵
  PID:7844
- C:\Windows\System\IzzcxcN.exe
  C:\Windows\System\IzzcxcN.exe
  2⤵
  PID:5116
- C:\Windows\System\KJKvEza.exe
  C:\Windows\System\KJKvEza.exe
  2⤵
  PID:11360
- C:\Windows\System\OHnqALS.exe
  C:\Windows\System\OHnqALS.exe
  2⤵
  PID:10860
- C:\Windows\System\sdJaBWM.exe
  C:\Windows\System\sdJaBWM.exe
  2⤵
  PID:6332
- C:\Windows\System\iWtXKcg.exe
  C:\Windows\System\iWtXKcg.exe
  2⤵
  PID:9588
- C:\Windows\System\kRnAPRA.exe
  C:\Windows\System\kRnAPRA.exe
  2⤵
  PID:13656
- C:\Windows\System\lWsUFaN.exe
  C:\Windows\System\lWsUFaN.exe
  2⤵
  PID:3976
- C:\Windows\System\qItrONz.exe
  C:\Windows\System\qItrONz.exe
  2⤵
  PID:7192
- C:\Windows\System\COuIuMR.exe
  C:\Windows\System\COuIuMR.exe
  2⤵
  PID:11548
- C:\Windows\System\qBygOmk.exe
  C:\Windows\System\qBygOmk.exe
  2⤵
  PID:10428
- C:\Windows\System\QiugZbU.exe
  C:\Windows\System\QiugZbU.exe
  2⤵
  PID:5172
- C:\Windows\System\qAkXHYa.exe
  C:\Windows\System\qAkXHYa.exe
  2⤵
  PID:11700
- C:\Windows\System\zNnHBCA.exe
  C:\Windows\System\zNnHBCA.exe
  2⤵
  PID:11632
- C:\Windows\System\MxSCbzB.exe
  C:\Windows\System\MxSCbzB.exe
  2⤵
  PID:11836
- C:\Windows\System\CVJKAcr.exe
  C:\Windows\System\CVJKAcr.exe
  2⤵
  PID:8940
- C:\Windows\System\stqPkEn.exe
  C:\Windows\System\stqPkEn.exe
  2⤵
  PID:12020
- C:\Windows\System\FoidRlW.exe
  C:\Windows\System\FoidRlW.exe
  2⤵
  PID:2764
- C:\Windows\System\bNhmrmK.exe
  C:\Windows\System\bNhmrmK.exe
  2⤵
  PID:11904
- C:\Windows\System\PgHWxKD.exe
  C:\Windows\System\PgHWxKD.exe
  2⤵
  PID:11928
- C:\Windows\System\InOBzOj.exe
  C:\Windows\System\InOBzOj.exe
  2⤵
  PID:13220
- C:\Windows\System\WldBaxB.exe
  C:\Windows\System\WldBaxB.exe
  2⤵
  PID:7544
- C:\Windows\System\BOdPFpN.exe
  C:\Windows\System\BOdPFpN.exe
  2⤵
  PID:12048
- C:\Windows\System\LnTrbKq.exe
  C:\Windows\System\LnTrbKq.exe
  2⤵
  PID:12104
- C:\Windows\System\FtqeXVf.exe
  C:\Windows\System\FtqeXVf.exe
  2⤵
  PID:10784
- C:\Windows\System\wyGaVTL.exe
  C:\Windows\System\wyGaVTL.exe
  2⤵
  PID:10984
- C:\Windows\System\HsfzSXE.exe
  C:\Windows\System\HsfzSXE.exe
  2⤵
  PID:12348
- C:\Windows\System\ClcqMha.exe
  C:\Windows\System\ClcqMha.exe
  2⤵
  PID:10948
- C:\Windows\System\byduTNr.exe
  C:\Windows\System\byduTNr.exe
  2⤵
  PID:8780
- C:\Windows\System\rUNSEGa.exe
  C:\Windows\System\rUNSEGa.exe
  2⤵
  PID:9984
- C:\Windows\System\eBBIFxt.exe
  C:\Windows\System\eBBIFxt.exe
  2⤵
  PID:9336
- C:\Windows\System\keCxzHq.exe
  C:\Windows\System\keCxzHq.exe
  2⤵
  PID:1340
- C:\Windows\System\PDqZAFr.exe
  C:\Windows\System\PDqZAFr.exe
  2⤵
  PID:6496
- C:\Windows\System\fvKrQvP.exe
  C:\Windows\System\fvKrQvP.exe
  2⤵
  PID:13128
- C:\Windows\System\KBTFcTZ.exe
  C:\Windows\System\KBTFcTZ.exe
  2⤵
  PID:13520
- C:\Windows\System\NzVsHIn.exe
  C:\Windows\System\NzVsHIn.exe
  2⤵
  PID:6476
- C:\Windows\System\lHKGkvc.exe
  C:\Windows\System\lHKGkvc.exe
  2⤵
  PID:5144
- C:\Windows\System\kBKBRNA.exe
  C:\Windows\System\kBKBRNA.exe
  2⤵
  PID:10260
- C:\Windows\System\nUaicGW.exe
  C:\Windows\System\nUaicGW.exe
  2⤵
  PID:5892
- C:\Windows\System\cNQNuuw.exe
  C:\Windows\System\cNQNuuw.exe
  2⤵
  PID:11756
- C:\Windows\System\ncMIzlh.exe
  C:\Windows\System\ncMIzlh.exe
  2⤵
  PID:6988
- C:\Windows\System\zxBCLus.exe
  C:\Windows\System\zxBCLus.exe
  2⤵
  PID:11800
- C:\Windows\System\cEKYoPv.exe
  C:\Windows\System\cEKYoPv.exe
  2⤵
  PID:12816
- C:\Windows\System\YDFpTjA.exe
  C:\Windows\System\YDFpTjA.exe
  2⤵
  PID:13584
- C:\Windows\System\iudxSjq.exe
  C:\Windows\System\iudxSjq.exe
  2⤵
  PID:12948
- C:\Windows\System\goQhaEu.exe
  C:\Windows\System\goQhaEu.exe
  2⤵
  PID:11956
- C:\Windows\System\CBPdUHU.exe
  C:\Windows\System\CBPdUHU.exe
  2⤵
  PID:11992
- C:\Windows\System\JrkOMxJ.exe
  C:\Windows\System\JrkOMxJ.exe
  2⤵
  PID:12000
- C:\Windows\System\BtIlLEa.exe
  C:\Windows\System\BtIlLEa.exe
  2⤵
  PID:13032
- C:\Windows\System\btKrzry.exe
  C:\Windows\System\btKrzry.exe
  2⤵
  PID:6768
- C:\Windows\System\wAaEScX.exe
  C:\Windows\System\wAaEScX.exe
  2⤵
  PID:12076
- C:\Windows\System\BLneCQj.exe
  C:\Windows\System\BLneCQj.exe
  2⤵
  PID:13392
- C:\Windows\System\XOjEYwQ.exe
  C:\Windows\System\XOjEYwQ.exe
  2⤵
  PID:4992
- C:\Windows\System\ZjiWuRS.exe
  C:\Windows\System\ZjiWuRS.exe
  2⤵
  PID:7024
- C:\Windows\System\AlUwGjQ.exe
  C:\Windows\System\AlUwGjQ.exe
  2⤵
  PID:1644
- C:\Windows\System\Mzbqdhm.exe
  C:\Windows\System\Mzbqdhm.exe
  2⤵
  PID:9732
- C:\Windows\System\BEzpuLT.exe
  C:\Windows\System\BEzpuLT.exe
  2⤵
  PID:6376
- C:\Windows\System\VprsGHB.exe
  C:\Windows\System\VprsGHB.exe
  2⤵
  PID:9368
- C:\Windows\System\lAbYerg.exe
  C:\Windows\System\lAbYerg.exe
  2⤵
  PID:10884
- C:\Windows\System\waAbLMF.exe
  C:\Windows\System\waAbLMF.exe
  2⤵
  PID:14196
- C:\Windows\System\gSofdJz.exe
  C:\Windows\System\gSofdJz.exe
  2⤵
  PID:8360
- C:\Windows\System\coFvPHV.exe
  C:\Windows\System\coFvPHV.exe
  2⤵
  PID:13800
- C:\Windows\System\LIMtdHX.exe
  C:\Windows\System\LIMtdHX.exe
  2⤵
  PID:14132
- C:\Windows\System\npFCmOi.exe
  C:\Windows\System\npFCmOi.exe
  2⤵
  PID:7932
- C:\Windows\System\bpajupu.exe
  C:\Windows\System\bpajupu.exe
  2⤵
  PID:14148
- C:\Windows\System\BOIHxKG.exe
  C:\Windows\System\BOIHxKG.exe
  2⤵
  PID:11232
- C:\Windows\System\qfxbOzL.exe
  C:\Windows\System\qfxbOzL.exe
  2⤵
  PID:11656
- C:\Windows\System\QMKEVuN.exe
  C:\Windows\System\QMKEVuN.exe
  2⤵
  PID:6404
- C:\Windows\System\eALAHeT.exe
  C:\Windows\System\eALAHeT.exe
  2⤵
  PID:2228
- C:\Windows\System\ZEZxGvg.exe
  C:\Windows\System\ZEZxGvg.exe
  2⤵
  PID:8148
- C:\Windows\System\ymRUkKL.exe
  C:\Windows\System\ymRUkKL.exe
  2⤵
  PID:10796
- C:\Windows\System\XaepIQD.exe
  C:\Windows\System\XaepIQD.exe
  2⤵
  PID:8144
- C:\Windows\System\rsAGlqS.exe
  C:\Windows\System\rsAGlqS.exe
  2⤵
  PID:8704
- C:\Windows\System\qbhZAGu.exe
  C:\Windows\System\qbhZAGu.exe
  2⤵
  PID:1264
- C:\Windows\System\NMuPadg.exe
  C:\Windows\System\NMuPadg.exe
  2⤵
  PID:11488
- C:\Windows\System\ksjvvsK.exe
  C:\Windows\System\ksjvvsK.exe
  2⤵
  PID:8924
- C:\Windows\System\ldXtdIK.exe
  C:\Windows\System\ldXtdIK.exe
  2⤵
  PID:6824
- C:\Windows\System\aScmtsa.exe
  C:\Windows\System\aScmtsa.exe
  2⤵
  PID:6432
- C:\Windows\System\JOXSVWt.exe
  C:\Windows\System\JOXSVWt.exe
  2⤵
  PID:13236
- C:\Windows\System\rrPAJeV.exe
  C:\Windows\System\rrPAJeV.exe
  2⤵
  PID:7120
- C:\Windows\System\VOnhPxZ.exe
  C:\Windows\System\VOnhPxZ.exe
  2⤵
  PID:9456
- C:\Windows\System\ncmiNIh.exe
  C:\Windows\System\ncmiNIh.exe
  2⤵
  PID:1576
- C:\Windows\System\uYXIyDq.exe
  C:\Windows\System\uYXIyDq.exe
  2⤵
  PID:13508
- C:\Windows\System\dKziAiS.exe
  C:\Windows\System\dKziAiS.exe
  2⤵
  PID:13644
- C:\Windows\System\pHlSycx.exe
  C:\Windows\System\pHlSycx.exe
  2⤵
  PID:12800
- C:\Windows\System\ZAomabm.exe
  C:\Windows\System\ZAomabm.exe
  2⤵
  PID:4804
- C:\Windows\System\wpuKtTh.exe
  C:\Windows\System\wpuKtTh.exe
  2⤵
  PID:11336
- C:\Windows\System\TgSzmRY.exe
  C:\Windows\System\TgSzmRY.exe
  2⤵
  PID:13992
- C:\Windows\System\JFujwTO.exe
  C:\Windows\System\JFujwTO.exe
  2⤵
  PID:14284
- C:\Windows\System\CJlhtnH.exe
  C:\Windows\System\CJlhtnH.exe
  2⤵
  PID:13636
- C:\Windows\System\vDebdiN.exe
  C:\Windows\System\vDebdiN.exe
  2⤵
  PID:9600
- C:\Windows\System\YbdXDjX.exe
  C:\Windows\System\YbdXDjX.exe
  2⤵
  PID:1944
- C:\Windows\System\ZptrnEc.exe
  C:\Windows\System\ZptrnEc.exe
  2⤵
  PID:6236
- C:\Windows\System\lEunuVj.exe
  C:\Windows\System\lEunuVj.exe
  2⤵
  PID:11572
- C:\Windows\System\zDTmUqS.exe
  C:\Windows\System\zDTmUqS.exe
  2⤵
  PID:5188
- C:\Windows\System\qPDWOts.exe
  C:\Windows\System\qPDWOts.exe
  2⤵
  PID:11944
- C:\Windows\System\RUbSrFq.exe
  C:\Windows\System\RUbSrFq.exe
  2⤵
  PID:8740
- C:\Windows\System\iklYYBX.exe
  C:\Windows\System\iklYYBX.exe
  2⤵
  PID:1052
- C:\Windows\System\NMvoCbI.exe
  C:\Windows\System\NMvoCbI.exe
  2⤵
  PID:10968
- C:\Windows\System\GdIgXBC.exe
  C:\Windows\System\GdIgXBC.exe
  2⤵
  PID:860
- C:\Windows\System\yFekULQ.exe
  C:\Windows\System\yFekULQ.exe
  2⤵
  PID:1588
- C:\Windows\System\bVrfKGf.exe
  C:\Windows\System\bVrfKGf.exe
  2⤵
  PID:4580
- C:\Windows\System\JGciEBm.exe
  C:\Windows\System\JGciEBm.exe
  2⤵
  PID:12476
- C:\Windows\System\YTsDAuF.exe
  C:\Windows\System\YTsDAuF.exe
  2⤵
  PID:13080
- C:\Windows\System\OEtKTtD.exe
  C:\Windows\System\OEtKTtD.exe
  2⤵
  PID:7660
- C:\Windows\System\FhvaDih.exe
  C:\Windows\System\FhvaDih.exe
  2⤵
  PID:13436
- C:\Windows\System\EhNINdQ.exe
  C:\Windows\System\EhNINdQ.exe
  2⤵
  PID:5612
- C:\Windows\System\akzRpGe.exe
  C:\Windows\System\akzRpGe.exe
  2⤵
  PID:5628
- C:\Windows\System\vakiqEZ.exe
  C:\Windows\System\vakiqEZ.exe
  2⤵
  PID:7776
- C:\Windows\System\JTVLqIF.exe
  C:\Windows\System\JTVLqIF.exe
  2⤵
  PID:11996
- C:\Windows\System\pDNynve.exe
  C:\Windows\System\pDNynve.exe
  2⤵
  PID:12440
- C:\Windows\System\JSCTWNT.exe
  C:\Windows\System\JSCTWNT.exe
  2⤵
  PID:5392
- C:\Windows\System\XcxXcPV.exe
  C:\Windows\System\XcxXcPV.exe
  2⤵
  PID:6472
- C:\Windows\System\KThKJFt.exe
  C:\Windows\System\KThKJFt.exe
  2⤵
  PID:11464
- C:\Windows\System\OvXDbnE.exe
  C:\Windows\System\OvXDbnE.exe
  2⤵
  PID:7268
- C:\Windows\System\SeapsgW.exe
  C:\Windows\System\SeapsgW.exe
  2⤵
  PID:13140
- C:\Windows\System\wlNYOug.exe
  C:\Windows\System\wlNYOug.exe
  2⤵
  PID:3140
- C:\Windows\System\HggZWVs.exe
  C:\Windows\System\HggZWVs.exe
  2⤵
  PID:1048
- C:\Windows\System\nzpdMFX.exe
  C:\Windows\System\nzpdMFX.exe
  2⤵
  PID:11708
- C:\Windows\System\pgJYCUj.exe
  C:\Windows\System\pgJYCUj.exe
  2⤵
  PID:13492
- C:\Windows\System\pjZZHfb.exe
  C:\Windows\System\pjZZHfb.exe
  2⤵
  PID:13856
- C:\Windows\System\zLmTWOl.exe
  C:\Windows\System\zLmTWOl.exe
  2⤵
  PID:4628
- C:\Windows\System\dxHPwoM.exe
  C:\Windows\System\dxHPwoM.exe
  2⤵
  PID:12664
- C:\Windows\System\AQVCfXu.exe
  C:\Windows\System\AQVCfXu.exe
  2⤵
  PID:12744
- C:\Windows\System\mRGvNUQ.exe
  C:\Windows\System\mRGvNUQ.exe
  2⤵
  PID:5444
- C:\Windows\System\RiRXVKd.exe
  C:\Windows\System\RiRXVKd.exe
  2⤵
  PID:8876
- C:\Windows\System\puBtoqS.exe
  C:\Windows\System\puBtoqS.exe
  2⤵
  PID:11932
- C:\Windows\System\tWevPJA.exe
  C:\Windows\System\tWevPJA.exe
  2⤵
  PID:3508
- C:\Windows\System\reGsQIm.exe
  C:\Windows\System\reGsQIm.exe
  2⤵
  PID:2344
- C:\Windows\System\gjrpKvK.exe
  C:\Windows\System\gjrpKvK.exe
  2⤵
  PID:212
- C:\Windows\System\yMBtsim.exe
  C:\Windows\System\yMBtsim.exe
  2⤵
  PID:552
- C:\Windows\System\jXbWDHo.exe
  C:\Windows\System\jXbWDHo.exe
  2⤵
  PID:952
- C:\Windows\System\VlkSmyE.exe
  C:\Windows\System\VlkSmyE.exe
  2⤵
  PID:6636
- C:\Windows\System\uLNjuWf.exe
  C:\Windows\System\uLNjuWf.exe
  2⤵
  PID:4260
- C:\Windows\System\SDPDNdl.exe
  C:\Windows\System\SDPDNdl.exe
  2⤵
  PID:6788
- C:\Windows\System\VBnQcUh.exe
  C:\Windows\System\VBnQcUh.exe
  2⤵
  PID:11124
- C:\Windows\System\nQfHDbW.exe
  C:\Windows\System\nQfHDbW.exe
  2⤵
  PID:6256
- C:\Windows\System\wRKlpVF.exe
  C:\Windows\System\wRKlpVF.exe
  2⤵
  PID:8476
- C:\Windows\System\tCqjJnW.exe
  C:\Windows\System\tCqjJnW.exe
  2⤵
  PID:9156
- C:\Windows\System\ibwrwyH.exe
  C:\Windows\System\ibwrwyH.exe
  2⤵
  PID:5128
- C:\Windows\System\UOxvSsp.exe
  C:\Windows\System\UOxvSsp.exe
  2⤵
  PID:8296
- C:\Windows\System\WSmFChc.exe
  C:\Windows\System\WSmFChc.exe
  2⤵
  PID:12424
- C:\Windows\System\FXzeJmZ.exe
  C:\Windows\System\FXzeJmZ.exe
  2⤵
  PID:14264
- C:\Windows\System\EJSuyDQ.exe
  C:\Windows\System\EJSuyDQ.exe
  2⤵
  PID:4200
- C:\Windows\System\zRiUElU.exe
  C:\Windows\System\zRiUElU.exe
  2⤵
  PID:4720
- C:\Windows\System\HIQKtMG.exe
  C:\Windows\System\HIQKtMG.exe
  2⤵
  PID:2988
- C:\Windows\System\bUkFzYg.exe
  C:\Windows\System\bUkFzYg.exe
  2⤵
  PID:1164
- C:\Windows\System\UijYCKq.exe
  C:\Windows\System\UijYCKq.exe
  2⤵
  PID:8496
- C:\Windows\System\NQNHAjf.exe
  C:\Windows\System\NQNHAjf.exe
  2⤵
  PID:2124
- C:\Windows\System\wRFMFMr.exe
  C:\Windows\System\wRFMFMr.exe
  2⤵
  PID:14212
- C:\Windows\System\fYLIthn.exe
  C:\Windows\System\fYLIthn.exe
  2⤵
  PID:10472
- C:\Windows\System\RegVHem.exe
  C:\Windows\System\RegVHem.exe
  2⤵
  PID:9916
- C:\Windows\System\QBGYvjI.exe
  C:\Windows\System\QBGYvjI.exe
  2⤵
  PID:13780
- C:\Windows\System\haZFENs.exe
  C:\Windows\System\haZFENs.exe
  2⤵
  PID:5588
- C:\Windows\System\lFvcrJp.exe
  C:\Windows\System\lFvcrJp.exe
  2⤵
  PID:13432
- C:\Windows\System\mfggIrP.exe
  C:\Windows\System\mfggIrP.exe
  2⤵
  PID:4836
- C:\Windows\System\rMujOqE.exe
  C:\Windows\System\rMujOqE.exe
  2⤵
  PID:11660
- C:\Windows\System\tueaVRu.exe
  C:\Windows\System\tueaVRu.exe
  2⤵
  PID:1652
- C:\Windows\System\xSfuqYU.exe
  C:\Windows\System\xSfuqYU.exe
  2⤵
  PID:13672
- C:\Windows\System\hgyHoHJ.exe
  C:\Windows\System\hgyHoHJ.exe
  2⤵
  PID:10068
- C:\Windows\System\KeLZpAG.exe
  C:\Windows\System\KeLZpAG.exe
  2⤵
  PID:13928
- C:\Windows\System\GdWWRwQ.exe
  C:\Windows\System\GdWWRwQ.exe
  2⤵
  PID:6560
- C:\Windows\System\jnKXoUC.exe
  C:\Windows\System\jnKXoUC.exe
  2⤵
  PID:12124
- C:\Windows\System\KdgMkKG.exe
  C:\Windows\System\KdgMkKG.exe
  2⤵
  PID:7988
- C:\Windows\System\AtSqgwc.exe
  C:\Windows\System\AtSqgwc.exe
  2⤵
  PID:9224
- C:\Windows\System\sNYQsKY.exe
  C:\Windows\System\sNYQsKY.exe
  2⤵
  PID:13056
- C:\Windows\System\cmMGWRQ.exe
  C:\Windows\System\cmMGWRQ.exe
  2⤵
  PID:3292
- C:\Windows\System\YshnKtP.exe
  C:\Windows\System\YshnKtP.exe
  2⤵
  PID:7272
- C:\Windows\System\nDgoMmH.exe
  C:\Windows\System\nDgoMmH.exe
  2⤵
  PID:3132
- C:\Windows\System\tbuZWQn.exe
  C:\Windows\System\tbuZWQn.exe
  2⤵
  PID:4496
- C:\Windows\System\yWgDUzA.exe
  C:\Windows\System\yWgDUzA.exe
  2⤵
  PID:912
- C:\Windows\System\udxmPOV.exe
  C:\Windows\System\udxmPOV.exe
  2⤵
  PID:7092
- C:\Windows\System\VMPYDCc.exe
  C:\Windows\System\VMPYDCc.exe
  2⤵
  PID:13700
- C:\Windows\System\jdTmIkH.exe
  C:\Windows\System\jdTmIkH.exe
  2⤵
  PID:4708
- C:\Windows\System\QuBfgJX.exe
  C:\Windows\System\QuBfgJX.exe
  2⤵
  PID:13908
- C:\Windows\System\HlgjfVG.exe
  C:\Windows\System\HlgjfVG.exe
  2⤵
  PID:7264
- C:\Windows\System\YUJqCto.exe
  C:\Windows\System\YUJqCto.exe
  2⤵
  PID:10000
- C:\Windows\System\WPjgqjo.exe
  C:\Windows\System\WPjgqjo.exe
  2⤵
  PID:12952
- C:\Windows\System\SMKqvIh.exe
  C:\Windows\System\SMKqvIh.exe
  2⤵
  PID:12292
- C:\Windows\System\czwqnFd.exe
  C:\Windows\System\czwqnFd.exe
  2⤵
  PID:1604
- C:\Windows\System\JLvoOit.exe
  C:\Windows\System\JLvoOit.exe
  2⤵
  PID:13044
- C:\Windows\System\fWbnPdJ.exe
  C:\Windows\System\fWbnPdJ.exe
  2⤵
  PID:12508
- C:\Windows\System\bmzLmqF.exe
  C:\Windows\System\bmzLmqF.exe
  2⤵
  PID:1620
- C:\Windows\System\sShzhoO.exe
  C:\Windows\System\sShzhoO.exe
  2⤵
  PID:4440
- C:\Windows\System\uzKTXli.exe
  C:\Windows\System\uzKTXli.exe
  2⤵
  PID:1708
- C:\Windows\System\yMfmzHW.exe
  C:\Windows\System\yMfmzHW.exe
  2⤵
  PID:6808
- C:\Windows\System\EvKrifV.exe
  C:\Windows\System\EvKrifV.exe
  2⤵
  PID:4336
- C:\Windows\System\FQqAXQE.exe
  C:\Windows\System\FQqAXQE.exe
  2⤵
  PID:4844
- C:\Windows\System\yQtyJgv.exe
  C:\Windows\System\yQtyJgv.exe
  2⤵
  PID:6836

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_usyerui3.5xw.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\BzxQeGn.exe

Filesize
1.6MB

MD5
3b8829df76170dd6b74498257098d5aa

SHA1
b9452a7d1531e1fd30aea7d8c1d12c59298f78e7

SHA256
354ebc97fd3d1fa33f3217749600558f553b46731e041ee36d5b092e225e67a5

SHA512
ee219194d5da25289e3d0d1d350ea0249edaf6c701b69ff8b6d2299c6c620d6d93cd412ad391f9bde285dd5d6128959163494f09e85ad9fd0ab46b1257012274

Download Submit
C:\Windows\System\CHVJLRX.exe

Filesize
1.6MB

MD5
0d05cbf2f4ebd850fd8beeebc18040d9

SHA1
4b418f6285e29f6c8d80e6608e9829bde632b5d8

SHA256
5a82fec74b1fb8a4d21eb62f5e953c35eeb15910dc02b90ead7a08d526534242

SHA512
071e9dd6e4e8c544285f77c726a01f1c74474cdba8a1e12e63a2af0a90617cce21912b2fb90ee259e3aa9361b74264f4cf8c04b8101f2317b117bbd5c74f114a

Download Submit
C:\Windows\System\FxFIkgf.exe

Filesize
1.6MB

MD5
7bc7089c53e8fc817c116d332049a38a

SHA1
c76c2639dd1aba99284403438ee9bab63234133d

SHA256
43f0a03484fa5ec50d4489d91a866e3e9799eab9c7e0671db89acb7736209669

SHA512
a61c6a915491eb5d6d96d35916ed15590ede81d1d0a0bc1e5d5d732d08bdc136af375983df5a9ebd2039ed565bc6f37cbbac523f81f9ede8afd13d8294b5087c

Download Submit
C:\Windows\System\HEAnsKa.exe

Filesize
1.6MB

MD5
d4e5fd819b64cc414cf735501ccca19c

SHA1
5fa503201d9c7245cf278e89114d3532549892e7

SHA256
892612f8ec722767f49ab61495a41da8d88c4261e0fed09bf73b8acfe767f954

SHA512
16e8b74ff24860ed8560933c64a31d1aa0798aac58a98ff4cf5277ff5685bfaae938b46c7aa603fa04a12b61b0e585265f1b309ecadfa1d72ae066901c4b95d6

Download Submit
C:\Windows\System\KVFGJGf.exe

Filesize
1.6MB

MD5
0f4ba76fbb4101161c697e5a850d88c8

SHA1
c3d4d8b93416342c0f39d23fb5cd39df74c0e506

SHA256
9419acdb02665f01d595b7af7b253124e40b502ec84d0521849bc7be451a8750

SHA512
ff235d8dbb9b4e775001fabbfc11f5d237bf2a8cb8c8c2198ab44fb0a7459dbc833bb05b9c188ec720ccea4166813d64a636481496b6511b7c7134d562196a29

Download Submit
C:\Windows\System\KrvGzZH.exe

Filesize
1.6MB

MD5
4aafd193bd3dd8c7d2c0ed0c722fac7d

SHA1
856cb3c586e0abdc788768543e12eb22e6467450

SHA256
373c21767fb32b8f6d804c9108c34cf256a1ac49b67b02ef35438c51a8191a80

SHA512
c1db57d12f4cf715652d28976c238d3f5e59399d7a2014c18ba58b5260cf49a7a05ea67d9d420e5f20f22fd5300fdef4eab60c59aab507c644e55703f8bfde50

Download Submit
C:\Windows\System\LwLItxf.exe

Filesize
1.6MB

MD5
3997ee4c14e40da91c4dfea8b6656836

SHA1
23137f287ed41bc41df828def56c25e728a3930d

SHA256
b7dbe8e32ac9693b7687167f9d492d5a77a127ba8f82b285890231751147cfd5

SHA512
913fc86e9743487fe30cd3b08703a3f150c579b0d813b67538c5c95547affc28001d860f97516143056e782e0730c0ba77d93dd02ddae753227f6fadb21a8756

Download Submit
C:\Windows\System\SFcZkPj.exe

Filesize
1.6MB

MD5
0cdccd527e1e8d837d93d23156169d59

SHA1
165f79b704bb6c819d16e38fc271000b59d2a293

SHA256
98514547286feb1871a173fb912eb3dbc8b08e3674435775ddebc0da7e65b07b

SHA512
9790905d759b55ca9692fd706ce994d8d92794264b94c37895f93032880758db7e68f6b0849ee8f6aa6d21b0b933b3f9bb6db1087b9141d229a7d72fda21d3db

Download Submit
C:\Windows\System\SGuYrlK.exe

Filesize
1.6MB

MD5
6763d26d5c0f05663c0c0ce97de349bb

SHA1
535dd6ffe44fb82c5e9a2bb92dbc3565d27b7313

SHA256
ed0a33ab2c846885ed1c6335840024a270f655b089fef5656b1e8a49064bda39

SHA512
bd0cafe5cda791405d74b71c5b75cf8f5154624c24e47e754cef6204f2542d328ddd7e168db4ce2f9f29b7417dfcc3aaa70140a0fd4f8243d4851c7eddcbbece

Download Submit
C:\Windows\System\WIbfCNF.exe

Filesize
1.6MB

MD5
89f0488964a03e31a152b32b9da89535

SHA1
6d0247e481c9968496513e525f309827d80212fd

SHA256
0f9ec6791d3242aabbd74482f97ae178514ee0784efbbc97ead8e4048daee788

SHA512
a623f724022cfb7272681c6aaa1d98c1d6df90d29902ee7c92de0350285334d0fd4225abf7fcea1d379759217fde869d739bfaea9706ae31e8abd7fc4b490603

Download Submit
C:\Windows\System\WalIMTI.exe

Filesize
1.6MB

MD5
aff41a8dc3dfb1f7e3ca069a33193269

SHA1
174ae8bbeb70fcdd11b9149a97c829426218804d

SHA256
f73b35bed7a68e2447382d20ce3625ca8fbda19fe2af2eb83e65d8266e90f2b8

SHA512
b05013e67ea35c3c0064ad20630c8b271676d9bdb522c7cc4b891b01caf6b6af65e56a47e3389a26f2aa718961c65d5c25ebccf429cd27607db3f16e81450a74

Download Submit
C:\Windows\System\YMOEYJB.exe

Filesize
1.6MB

MD5
c81e47f55069bbd4e10ef56380a4e4e0

SHA1
6a0fc567e06459a06ba01bbdaee8883cf997d817

SHA256
1b5acafa6e1214ec59d766b165b35f18aba8f02baf42c36c8b568e5e705f40dd

SHA512
b73dc4402e6d82ed9b9e84767ef82111c46a078367b04969c78364c99fda514f1eb320ed41ce85964f60b89457bd88d64183d3cdd0e363a6edebdd0b45cb329a

Download Submit
C:\Windows\System\YeEjWyB.exe

Filesize
1.6MB

MD5
bce586c5aece092075121b15b93709f0

SHA1
5150856de3456cfbcf15a28181726c26df178785

SHA256
4b8b7d002f9f1749b53e9b09435b547ae15095f5b4b2cae56f79c7d89d5276a7

SHA512
104da6c4ce88b2384affe7f90f143233bb1ef0b0dbc99b118ae3c19823323e6ac769ee28cadb551be064a21e5038ac8df80afbb436fda874b44a96558c15f254

Download Submit
C:\Windows\System\YeqFiEQ.exe

Filesize
1.6MB

MD5
9ded3f0ba31e2b6a4d426d3887921931

SHA1
500c9cdc9426e1f04187633d60d41a5f195e9e0f

SHA256
d874766fe4df332fa09538b70950f92169e5266d36e2770ff0fd4945078388b4

SHA512
7b91e2d9e648cb93daf74c6bc8c0de080e093445bea3742fda045ba3d316d010babf8942b463777449d25ee5ac69d30fdfd26c72d12369538ff38c15241c372e

Download Submit
C:\Windows\System\ZIgWpTp.exe

Filesize
18B

MD5
a2a8c31bfe674b2e51cc8c1e80154c36

SHA1
6eefb96252fb13dd347c4f09c8a67395771a54ac

SHA256
2a66120ff3f2505c7abec7468e6a93e728ab64fc27fd29e4a6d78ddb9330f4a1

SHA512
24bb2dc2797f030569b87e7efe894cb89aa16df5459f9c05da2f55cab827a557421455be6ec06073dcdfca856439a1738ef3a0fc0b90f141b648e6e8dfbdbf25

Download Submit
C:\Windows\System\ZfiiPoV.exe

Filesize
1.6MB

MD5
3364dbf7a71315568951725c3bf37d45

SHA1
64de16c39de1adf4c86f3486bc620cf73da92a91

SHA256
f727ee36de7a3127b8213d8b8c65eb442f7f915764a36dc93128667049fb2eb2

SHA512
e060f6eef920e16d74afa755b44f569ad3163f9442b1790c20af1b346f33672dc2f2e29eaeed074c2a4a9471b5b3cfba5a679a86637a5054d53b71c88857eba5

Download Submit
C:\Windows\System\brrkZhn.exe

Filesize
1.6MB

MD5
bf1e48a36a587b1a2ce7014154bebbbb

SHA1
ddde74a37243d5196975d1b2de6eb217bac80f31

SHA256
832a5cec1cf2946b4d594f652d5e42f6d6362fe097e04f8e435c8346373c6f97

SHA512
be29c30c258baaa67b40b336fd6a24535839cc408c94d70e657097b6c7cac86b1150e0edb17ceb559b9ef2a813d6f4bc881d362fd03ba084d5ecdf21e262170d

Download Submit
C:\Windows\System\cZEhAWM.exe

Filesize
1.6MB

MD5
32468d34df3a397dcac9df52257acf5e

SHA1
e7dfe92d8cee52cedffcaf3fdd8cc0b6f372a4d5

SHA256
b67576eaca2c09772b3691adcb77835d0017058ddb9ffcb24aa9e803d3a89f6e

SHA512
ee60b8bec83a799432ec135d03df56070dac3aae3a53c341cbb5a76d4b40b28046f45a106485d4fb7c1a1540933e83b87eb2ed9ef2685fde1ad81234641b3b51

Download Submit
C:\Windows\System\cajPCtH.exe

Filesize
1.6MB

MD5
1a732d4ee8ef1f8f2a819c66c85f68ba

SHA1
3ea782e9023ef9bf1417683f5d6caadd3a86f0ef

SHA256
d391cd1a6c09d0010b4b35e7d9dd1e80c5990a67af1d7f3a1acac28957eb01f0

SHA512
45ca81cbbb893e70f00f465d0f02f3b159d011537d0b6df2b40e93aff2559c5c087a6bbd14505f235792fa936886e80855d53f2dc141cecc4541f5249cff55b2

Download Submit
C:\Windows\System\dzhtuWK.exe

Filesize
1.6MB

MD5
dbb2a70d67d070e3bc236066ff229c25

SHA1
1f5f11ea545a16cd3aa5b6969d16dd01367309b9

SHA256
fe8799a4a8ed8dcf754bf871b933f5be9df5dabc68278cf84e0a5c67d91479f3

SHA512
2db498020c9d66e7a299f9a4524b62cc01de12bd1ef3cb45826badf62e4af8a419ee6e9668fc31be91664576d47ed2c472d2b2fe678a6a616da3b7b7b52c9a50

Download Submit
C:\Windows\System\eDWQszG.exe

Filesize
8B

MD5
8e1226661f8ca09fc62a1fef1fd7fcb8

SHA1
5b44def3d0e8d434236fee53ad977e411181a3d8

SHA256
7c2ccee11204a3d84ff9c71237bbe484161717fa152009f68b3a2efb0ad9c1c9

SHA512
45cc72f2ca6df3fbb9deac023207f7093a2e236cf6702146e776d1f3b55a9e5f29fbb748ba3deb570ab4a7bdfa68cee4df84414f0ac4a063de36a2a303bd6323

Download Submit
C:\Windows\System\gIOJBbp.exe

Filesize
1.6MB

MD5
c6e1979f07d9ea7ce13b7508c49f0c81

SHA1
ffb1581f9ecccd79fed74bd2e233381ffa1aabc7

SHA256
33c335bfca0c0d9c5003047660f8ef40e9a43b521d4b959ec45fb782fcb74ca5

SHA512
b7df1e7050083001df8341241243e966b57cc95847c01ee02418171af53ea560ae408af93deac861b898d785457b2b0a349783f77e2769adf82dba90f9b7ca63

Download Submit
C:\Windows\System\hASgGUr.exe

Filesize
1.6MB

MD5
36379907433c7bc09041892c32a71b34

SHA1
d539b701654c7e83a7870080f560c87b1feca01f

SHA256
8b151c9db5271476e170c6336fdfce532a88ba05ec88120a78580aeefb940832

SHA512
bd91d092c5e4c60d33738137a211d904fdbe471dba7ddd90dbbae000f2c868a234781778235234a2fd61c576cea7f99987b86bad3d1f226a83b8e1f4f394cda5

Download Submit
C:\Windows\System\igwqQkE.exe

Filesize
1.6MB

MD5
6d879d098ec394c9b8b2b77c5e5e8f8a

SHA1
fcb4a1b72e2a6725df53032695d5d14890040825

SHA256
259325e59a4322f5804ee7c67e2a9e4831065458c57fd70f5af3a322c80ee382

SHA512
e0db33390dfd71f7878dd56091a9988e2bd62ec6ede818b224bb9b47ad2a3abb9affc2859526d49862f203f86a41ca8ba41ee2a684d0b1bf4c980e794f5f890f

Download Submit
C:\Windows\System\iqclcsw.exe

Filesize
1.6MB

MD5
2999ba08883ea173ce8f5eb90c50d19c

SHA1
c2fbd7ae60206dfbd92e97c693fb595a7d13981d

SHA256
c1cf19d1d82fabe26c455b6544d40e445d6cbbd39321f516c8aaffc76120a6ea

SHA512
23e7ed545961ba09f242b7a46b7b6eb850245ca67e200bec0d811caa70650bdde2e42ebd10b2251deca577e341b9b34bc46745828b80ce053496a988ebac9311

Download Submit
C:\Windows\System\kAHAyHY.exe

Filesize
1.6MB

MD5
0dfb6860ef48b861d62c46e2012cc030

SHA1
855657b2ba0b7b9411e16bd7ec31c65d1aab79a8

SHA256
4b54dbac9c44b56ca7734c33d0b41e590887ce0aa5a8a318557bc87ca502704a

SHA512
6860c759e3a36a99ed2018ddaf7dfe2832ff04cfed036797533b547e04e165cf4029e6f730e87718bdd58dee7771932e7317d214b5fd7491cc03d2ae4eb85a17

Download Submit
C:\Windows\System\kMpLWmM.exe

Filesize
1.6MB

MD5
470abe96fb493f196797b0b66441211d

SHA1
1b00080ebedd44269af8ca27a872fff2e13f063a

SHA256
2f01ff6b504af07f4768f051db0266f8669c9132c7f87851b6348f3f46d665bc

SHA512
3fe47b008918309bc9cfdd6763b2a6c9fa47e57bf9aa9e38b77878e6107eeaecb15e554d35ce52c42f68b1a7ad416f02c333b5a04fc1db4c1615d4c61470a087

Download Submit
C:\Windows\System\kfqhwTZ.exe

Filesize
1.6MB

MD5
a4ba65bb032ee17deff203b0579d75d9

SHA1
2042907e057bcc9428b655ffca62cc3b47ffaae0

SHA256
60265f3b8b6dc76524270eb7b38dcdb5f81e73104821b04dfd08d13dd45b7680

SHA512
e24194596b18975cf5daa1360ec069103a7f6720ad9371fe17a3b96e0540eefcc0d54214d3031777ab3d2eeb0ddfa59cdd355a9e22c936e4a673c46bc4c88c20

Download Submit
C:\Windows\System\lASCXOR.exe

Filesize
1.6MB

MD5
718883d5ae233dba98fe62aee5954613

SHA1
9d3feb7ee8a91fa3476be4385d5a81e1205ddbac

SHA256
e4b7c667b124c6c4418af71082629bba0b3497a7b65f115a73e37c78ca756be2

SHA512
98f577a4fcf533ad68dcbcda9a03448fc859d98a0d04f5ccd9001b7880bfed7299d606f69b4162812c3dd6ba5c2d7ea7bd9326ac7099d4dce040295375436459

Download Submit
C:\Windows\System\lQSaXfS.exe

Filesize
1.6MB

MD5
248bad1c4f0d107df25176dbbbcfe8bf

SHA1
af9d6f11cdeb63cfe66d0598770383416f8dd793

SHA256
f335ea6bbe4c0c79aebfbb6a1cbfc2c98a842f8969812c221d19c6ccf8c7c738

SHA512
b91ff1d69e4205903e026d715d26ebefd4bf842af83263079b252b0556b7473dd2803c29493d78a2ce3368924df624ae6dfc1c77a461db7aa90b87905c40caac

Download Submit
C:\Windows\System\qLEgdzq.exe

Filesize
1.6MB

MD5
28f2aa62a9f520584f8f7c06a0dfb2c6

SHA1
7468d73fe4c7d4bf5e845c0d4b255ee5f2f0c6da

SHA256
c63d7bac6c0bd9ad4a0678dc2e0fa1eb04179f06e7221e897911b22c2a20886a

SHA512
95d1aefde2971b0868e67e1724d7cba1f2cb59b30f8872759bb254989e8f67bd523d31d68c3a800b06eaeab78b5ab9bd827dc6703310f8c77376ab09c182072a

Download Submit
C:\Windows\System\rhNPbuq.exe

Filesize
1.6MB

MD5
0d46139b96759966df4a857da135b67f

SHA1
f04444876e9850d678779bf9d78e269fb0b29895

SHA256
d722cf78bc04b20c5c6b288ec08b5d309e250018462c8c29f33376e3b8d2bd5e

SHA512
fe4b5f2d931fa5a2ea96d85e03ef44da1d1b0a35e81e0b8d0690ecbefd1b7e649704b6e0f1ee8e7f080f0225a6402eade1f53635b8183215be6342de2723a0a7

Download Submit
C:\Windows\System\tvGEHan.exe

Filesize
1.6MB

MD5
78e31bc867e43a227303588bb9cc14f2

SHA1
cf5bcddcaa8110e93a0b32336cf988e4aaed568d

SHA256
19371f6aac47c2d61e35d0b6bb20751733c533bfdf7dfe840fca435163fce878

SHA512
c90f8123744a4e0e770ee101ad098bc0a2dcaf6ae92a3471ae496846326de2c0b68f03921f0d30db9ff7e1a01534eea0fe4d8cb9f9e24a9c1b7f5b24329614bc

Download Submit
C:\Windows\System\vahGQFl.exe

Filesize
1.6MB

MD5
cb7a7331fe866426eec33727d344bbc8

SHA1
9db156ea75e136ffc9ab2c4b043d262cd4a622e4

SHA256
3a43265b7f12845f27311476421dcc73a9073fc3c638005a1a283e5199381960

SHA512
fb1b01d6135bae4e2c08a330b5b961889f0a0217a0fc3cc267660c4c31574265b6c56e4fd07855ccb09058da01170b56bd65cfdd668d524fac5b9d4b8c6cdfe0

Download Submit
C:\Windows\System\wKiMVhr.exe

Filesize
1.6MB

MD5
9ac6fc183a9a4aa4491138f73010a0d1

SHA1
3d33ce86d50317dae930dafb49dfc932e66458a9

SHA256
b9696d949d5d41243a4eff6980970509ac5bcdf1e12c80997705a50a26dc1f45

SHA512
0ebb801a4ac6763e6fefdc2e9a392cacd6f8d7630197e44d840e1079d4b9cbb18418668975e64fe42f6fbec8438a44cd644f5805103b3693ae9ea967892b5f0c

Download Submit
C:\Windows\System\xssTYuO.exe

Filesize
1.6MB

MD5
0468ad6b5fd03f0ce9ff6cc4c8f91308

SHA1
9e62944598c5fd69fe02936800b487592e906a25

SHA256
850d023b513d282c1a360709b32f3dc63e02fcd008c035ce88f7152a5370d487

SHA512
61e9554dd1686fc95bef94408c0acc7a0c1fb1def4cf38faa624b08be04781b58755147bdb7c1fa672b49c9fbfb567d8fcc85fc169c7f1be6eedcf3028b907a4

Download Submit
C:\Windows\System\ySgPCny.exe

Filesize
1.6MB

MD5
8674542be3ecb43f76f6aa66115fa8f5

SHA1
d3e2dcf3bf82b815bb78367f865a474c41f6f8b6

SHA256
00cc27e92e6575c85b7f640b179be0fd9ea42b76cafadcf670c2f4382018182c

SHA512
59072ebcfe7a2dcba737838c5f5eb86776a1386c2b9fd6e9f930a4e31597e6a9e193768c17185bd5da649898f3021a3d9be6edb944565e2ddadaa8d5541c2c79

Download Submit
memory/228-376-0x000001D5F9240000-0x000001D5F9262000-memory.dmp

Filesize
136KB

Download
memory/968-452-0x00007FF6F1F30000-0x00007FF6F2322000-memory.dmp

Filesize
3.9MB

Download
memory/968-6134-0x00007FF6F1F30000-0x00007FF6F2322000-memory.dmp

Filesize
3.9MB

Download
memory/996-421-0x00007FF75B000000-0x00007FF75B3F2000-memory.dmp

Filesize
3.9MB

Download
memory/996-5929-0x00007FF75B000000-0x00007FF75B3F2000-memory.dmp

Filesize
3.9MB

Download
memory/1028-5907-0x00007FF66A2F0000-0x00007FF66A6E2000-memory.dmp

Filesize
3.9MB

Download
memory/1028-50-0x00007FF66A2F0000-0x00007FF66A6E2000-memory.dmp

Filesize
3.9MB

Download
memory/1196-0-0x00007FF6C14D0000-0x00007FF6C18C2000-memory.dmp

Filesize
3.9MB

Download
memory/1196-1-0x000001C3068F0000-0x000001C306900000-memory.dmp

Filesize
64KB

Download
memory/1456-164-0x00007FF667CF0000-0x00007FF6680E2000-memory.dmp

Filesize
3.9MB

Download
memory/1660-6335-0x00007FF732370000-0x00007FF732762000-memory.dmp

Filesize
3.9MB

Download
memory/1660-280-0x00007FF732370000-0x00007FF732762000-memory.dmp

Filesize
3.9MB

Download
memory/1920-6340-0x00007FF74A1A0000-0x00007FF74A592000-memory.dmp

Filesize
3.9MB

Download
memory/1920-279-0x00007FF74A1A0000-0x00007FF74A592000-memory.dmp

Filesize
3.9MB

Download
memory/2016-230-0x00007FF799A00000-0x00007FF799DF2000-memory.dmp

Filesize
3.9MB

Download
memory/2756-5458-0x00007FF684990000-0x00007FF684D82000-memory.dmp

Filesize
3.9MB

Download
memory/2756-6116-0x00007FF684990000-0x00007FF684D82000-memory.dmp

Filesize
3.9MB

Download
memory/2756-107-0x00007FF684990000-0x00007FF684D82000-memory.dmp

Filesize
3.9MB

Download
memory/2804-6317-0x00007FF78A510000-0x00007FF78A902000-memory.dmp

Filesize
3.9MB

Download
memory/2804-327-0x00007FF78A510000-0x00007FF78A902000-memory.dmp

Filesize
3.9MB

Download
memory/3112-144-0x00007FF743EB0000-0x00007FF7442A2000-memory.dmp

Filesize
3.9MB

Download
memory/3152-248-0x00007FF60BDD0000-0x00007FF60C1C2000-memory.dmp

Filesize
3.9MB

Download
memory/3636-77-0x00007FF7541B0000-0x00007FF7545A2000-memory.dmp

Filesize
3.9MB

Download
memory/3688-6113-0x00007FF707A30000-0x00007FF707E22000-memory.dmp

Filesize
3.9MB

Download
memory/3688-455-0x00007FF707A30000-0x00007FF707E22000-memory.dmp

Filesize
3.9MB

Download
memory/3808-6311-0x00007FF6D1620000-0x00007FF6D1A12000-memory.dmp

Filesize
3.9MB

Download
memory/3808-351-0x00007FF6D1620000-0x00007FF6D1A12000-memory.dmp

Filesize
3.9MB

Download
memory/3968-35-0x00007FF6280A0000-0x00007FF628492000-memory.dmp

Filesize
3.9MB

Download
memory/4144-53-0x00007FF6CEC40000-0x00007FF6CF032000-memory.dmp

Filesize
3.9MB

Download
memory/4144-5454-0x00007FF6CEC40000-0x00007FF6CF032000-memory.dmp

Filesize
3.9MB

Download
memory/4264-225-0x00007FF6BC840000-0x00007FF6BCC32000-memory.dmp

Filesize
3.9MB

Download
memory/4464-475-0x00007FF69AAA0000-0x00007FF69AE92000-memory.dmp

Filesize
3.9MB

Download
memory/4464-6264-0x00007FF69AAA0000-0x00007FF69AE92000-memory.dmp

Filesize
3.9MB

Download
memory/4560-420-0x00007FF7AD7E0000-0x00007FF7ADBD2000-memory.dmp

Filesize
3.9MB

Download
memory/4560-6350-0x00007FF7AD7E0000-0x00007FF7ADBD2000-memory.dmp

Filesize
3.9MB

Download
memory/4612-20-0x00007FF62F9B0000-0x00007FF62FDA2000-memory.dmp

Filesize
3.9MB

Download
memory/4820-6336-0x00007FF64B730000-0x00007FF64BB22000-memory.dmp

Filesize
3.9MB

Download
memory/4820-512-0x00007FF64B730000-0x00007FF64BB22000-memory.dmp

Filesize
3.9MB

Download
memory/4848-6315-0x00007FF691260000-0x00007FF691652000-memory.dmp

Filesize
3.9MB

Download
memory/4848-195-0x00007FF691260000-0x00007FF691652000-memory.dmp

Filesize
3.9MB

Download
memory/4908-5899-0x00007FF799F90000-0x00007FF79A382000-memory.dmp

Filesize
3.9MB

Download
memory/4908-26-0x00007FF799F90000-0x00007FF79A382000-memory.dmp

Filesize
3.9MB

Download
memory/4912-131-0x00007FF7ECB50000-0x00007FF7ECF42000-memory.dmp

Filesize
3.9MB

Download
memory/4912-6212-0x00007FF7ECB50000-0x00007FF7ECF42000-memory.dmp

Filesize
3.9MB

Download