xmrig | 1abac5118f463a5dc85ec76cd00bc43e287ba0eaa4e0b63e209c976fa98ef3f8

Analysis

max time kernel
151s
max time network
159s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
10/05/2024, 23:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2f9a47c210266b372ce59c9074c91e70_NeikiAnalytics.exe
Size

1.2MB
MD5

2f9a47c210266b372ce59c9074c91e70
SHA1

b741e68f1c874885f6b6fef35f6be5436b4875b9
SHA256

1abac5118f463a5dc85ec76cd00bc43e287ba0eaa4e0b63e209c976fa98ef3f8
SHA512

9baa16cde685d0f3d2b3ad7653223764335ab8c8b984f419bd062638ab2d9b2e6e0b5f07c0ed9d1b5d48e2cc53ff7083e124cd0a817a4a36ac6bf9db7a137a81
SSDEEP

24576:zv3/fTLF671TilQFG4P5PMkibTJH+2Q/ynKeWYsfLGrAvWWXkCRgx6eXKM2:Lz071uv4BPMkibTIA5sf6r+W4CF2

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 40 IoCs

miner

resource	yara_rule
behavioral2/memory/3996-34-0x00007FF7CE220000-0x00007FF7CE612000-memory.dmp	xmrig
behavioral2/memory/1480-35-0x00007FF7723C0000-0x00007FF7727B2000-memory.dmp	xmrig
behavioral2/memory/3580-181-0x00007FF6D57C0000-0x00007FF6D5BB2000-memory.dmp	xmrig
behavioral2/memory/1836-227-0x00007FF76AFD0000-0x00007FF76B3C2000-memory.dmp	xmrig
behavioral2/memory/5100-259-0x00007FF7271F0000-0x00007FF7275E2000-memory.dmp	xmrig
behavioral2/memory/2260-274-0x00007FF7965E0000-0x00007FF7969D2000-memory.dmp	xmrig
behavioral2/memory/3252-276-0x00007FF681680000-0x00007FF681A72000-memory.dmp	xmrig
behavioral2/memory/2524-275-0x00007FF6FF2B0000-0x00007FF6FF6A2000-memory.dmp	xmrig
behavioral2/memory/3988-273-0x00007FF6295A0000-0x00007FF629992000-memory.dmp	xmrig
behavioral2/memory/2208-258-0x00007FF64B200000-0x00007FF64B5F2000-memory.dmp	xmrig
behavioral2/memory/2964-203-0x00007FF78A400000-0x00007FF78A7F2000-memory.dmp	xmrig
behavioral2/memory/5080-190-0x00007FF762760000-0x00007FF762B52000-memory.dmp	xmrig
behavioral2/memory/2104-1075-0x00007FF7F3BE0000-0x00007FF7F3FD2000-memory.dmp	xmrig
behavioral2/memory/3168-154-0x00007FF74ADE0000-0x00007FF74B1D2000-memory.dmp	xmrig
behavioral2/memory/4368-124-0x00007FF681DE0000-0x00007FF6821D2000-memory.dmp	xmrig
behavioral2/memory/4408-113-0x00007FF6862F0000-0x00007FF6866E2000-memory.dmp	xmrig
behavioral2/memory/4828-109-0x00007FF7DC520000-0x00007FF7DC912000-memory.dmp	xmrig
behavioral2/memory/688-96-0x00007FF78AD00000-0x00007FF78B0F2000-memory.dmp	xmrig
behavioral2/memory/1480-2122-0x00007FF7723C0000-0x00007FF7727B2000-memory.dmp	xmrig
behavioral2/memory/3004-2075-0x00007FF736BE0000-0x00007FF736FD2000-memory.dmp	xmrig
behavioral2/memory/3372-2187-0x00007FF72E780000-0x00007FF72EB72000-memory.dmp	xmrig
behavioral2/memory/2916-2312-0x00007FF731180000-0x00007FF731572000-memory.dmp	xmrig
behavioral2/memory/3988-2341-0x00007FF6295A0000-0x00007FF629992000-memory.dmp	xmrig
behavioral2/memory/2260-2352-0x00007FF7965E0000-0x00007FF7969D2000-memory.dmp	xmrig
behavioral2/memory/3252-2372-0x00007FF681680000-0x00007FF681A72000-memory.dmp	xmrig
behavioral2/memory/2524-2361-0x00007FF6FF2B0000-0x00007FF6FF6A2000-memory.dmp	xmrig
behavioral2/memory/1836-2355-0x00007FF76AFD0000-0x00007FF76B3C2000-memory.dmp	xmrig
behavioral2/memory/3168-2321-0x00007FF74ADE0000-0x00007FF74B1D2000-memory.dmp	xmrig
behavioral2/memory/1604-2317-0x00007FF691CC0000-0x00007FF6920B2000-memory.dmp	xmrig
behavioral2/memory/4408-2309-0x00007FF6862F0000-0x00007FF6866E2000-memory.dmp	xmrig
behavioral2/memory/4368-2303-0x00007FF681DE0000-0x00007FF6821D2000-memory.dmp	xmrig
behavioral2/memory/2804-2300-0x00007FF74B490000-0x00007FF74B882000-memory.dmp	xmrig
behavioral2/memory/1912-2297-0x00007FF6F0A10000-0x00007FF6F0E02000-memory.dmp	xmrig
behavioral2/memory/5080-2296-0x00007FF762760000-0x00007FF762B52000-memory.dmp	xmrig
behavioral2/memory/2208-2289-0x00007FF64B200000-0x00007FF64B5F2000-memory.dmp	xmrig
behavioral2/memory/3580-2287-0x00007FF6D57C0000-0x00007FF6D5BB2000-memory.dmp	xmrig
behavioral2/memory/5100-2286-0x00007FF7271F0000-0x00007FF7275E2000-memory.dmp	xmrig
behavioral2/memory/688-2285-0x00007FF78AD00000-0x00007FF78B0F2000-memory.dmp	xmrig
behavioral2/memory/2964-2282-0x00007FF78A400000-0x00007FF78A7F2000-memory.dmp	xmrig
behavioral2/memory/2120-2306-0x00007FF6A52F0000-0x00007FF6A56E2000-memory.dmp	xmrig

Blocklisted process makes network request 2 IoCs

flow	pid	Process
13	560	powershell.exe
16	560	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
560	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
3004	ptTulXn.exe
3372	RXSjRAb.exe
3996	MOPWqfj.exe
1480	IToqHrO.exe
2120	pPbUUDt.exe
1912	RaOLHyM.exe
2916	IwkpWWh.exe
1604	TJXjAof.exe
688	HMyLOVt.exe
4828	KLgBQXf.exe
2208	bYNBQpX.exe
4408	TDbszSa.exe
4368	GyTQCwc.exe
2804	IfnZvAl.exe
5100	ueNOipA.exe
3168	VOVdEde.exe
3580	cNzroNr.exe
5080	gDRlGGy.exe
3988	ZhIARlL.exe
2964	cPdgNEW.exe
2260	iTJLPLO.exe
2524	jUdYYQr.exe
3252	EbzInMP.exe
1836	XevTSbF.exe
1788	SohxNsG.exe
5036	FRoYdLP.exe
2220	wesjeVY.exe
5020	xUwdxED.exe
1148	cNMjtrv.exe
2132	sjJdDti.exe
2844	ZZDRwJz.exe
4836	linlmjz.exe
1580	NabDCDl.exe
4260	KUSRAyt.exe
1044	MvlnKHG.exe
4816	TMocrpX.exe
2592	rtsnlMc.exe
3328	JziiHpX.exe
4648	thHhFvt.exe
4644	rjSMFLC.exe
1748	JksRZqe.exe
3256	ZNUBfcT.exe
3420	KbtkhGP.exe
3612	ATffddC.exe
2708	iTkGjRA.exe
3144	zziNEIR.exe
2776	aGfIisa.exe
2808	JXLhnai.exe
208	CvWXvMh.exe
1864	yUSJhmP.exe
1184	oSTsrIZ.exe
3944	SqOFfuR.exe
5108	RSSNIgu.exe
2600	AzgOWaz.exe
1136	YtDtrwR.exe
3984	QYSeArR.exe
4168	pKRJUBH.exe
5128	EmDEHjn.exe
5144	spjprZU.exe
5160	fyQeKVY.exe
5196	iwuhiND.exe
5288	BqzpgKZ.exe
5332	RVntwpN.exe
5524	mNiNZDE.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2104-0-0x00007FF7F3BE0000-0x00007FF7F3FD2000-memory.dmp	upx
behavioral2/files/0x0008000000023252-6.dat	upx
behavioral2/files/0x0008000000023259-8.dat	upx
behavioral2/files/0x000800000002325a-21.dat	upx
behavioral2/memory/3372-20-0x00007FF72E780000-0x00007FF72EB72000-memory.dmp	upx
behavioral2/files/0x000700000002325b-27.dat	upx
behavioral2/files/0x000700000002325c-31.dat	upx
behavioral2/files/0x0008000000023255-19.dat	upx
behavioral2/memory/3004-12-0x00007FF736BE0000-0x00007FF736FD2000-memory.dmp	upx
behavioral2/memory/3996-34-0x00007FF7CE220000-0x00007FF7CE612000-memory.dmp	upx
behavioral2/memory/1480-35-0x00007FF7723C0000-0x00007FF7727B2000-memory.dmp	upx
behavioral2/memory/1912-36-0x00007FF6F0A10000-0x00007FF6F0E02000-memory.dmp	upx
behavioral2/memory/2120-37-0x00007FF6A52F0000-0x00007FF6A56E2000-memory.dmp	upx
behavioral2/files/0x0008000000023257-42.dat	upx
behavioral2/memory/2916-43-0x00007FF731180000-0x00007FF731572000-memory.dmp	upx
behavioral2/files/0x000700000002325d-68.dat	upx
behavioral2/files/0x000800000002325f-79.dat	upx
behavioral2/files/0x0007000000023264-92.dat	upx
behavioral2/files/0x000800000002325e-91.dat	upx
behavioral2/files/0x000700000002326a-112.dat	upx
behavioral2/files/0x000700000002326b-123.dat	upx
behavioral2/memory/3580-181-0x00007FF6D57C0000-0x00007FF6D5BB2000-memory.dmp	upx
behavioral2/memory/1836-227-0x00007FF76AFD0000-0x00007FF76B3C2000-memory.dmp	upx
behavioral2/memory/5100-259-0x00007FF7271F0000-0x00007FF7275E2000-memory.dmp	upx
behavioral2/memory/2260-274-0x00007FF7965E0000-0x00007FF7969D2000-memory.dmp	upx
behavioral2/memory/3252-276-0x00007FF681680000-0x00007FF681A72000-memory.dmp	upx
behavioral2/memory/2524-275-0x00007FF6FF2B0000-0x00007FF6FF6A2000-memory.dmp	upx
behavioral2/memory/3988-273-0x00007FF6295A0000-0x00007FF629992000-memory.dmp	upx
behavioral2/memory/2208-258-0x00007FF64B200000-0x00007FF64B5F2000-memory.dmp	upx
behavioral2/memory/2964-203-0x00007FF78A400000-0x00007FF78A7F2000-memory.dmp	upx
behavioral2/files/0x0007000000023273-193.dat	upx
behavioral2/files/0x0007000000023276-191.dat	upx
behavioral2/memory/5080-190-0x00007FF762760000-0x00007FF762B52000-memory.dmp	upx
behavioral2/files/0x0007000000023279-189.dat	upx
behavioral2/files/0x0007000000023278-187.dat	upx
behavioral2/files/0x0007000000023277-186.dat	upx
behavioral2/files/0x0007000000023275-184.dat	upx
behavioral2/files/0x0007000000023272-180.dat	upx
behavioral2/files/0x0007000000023271-176.dat	upx
behavioral2/files/0x0007000000023270-174.dat	upx
behavioral2/files/0x000700000002326f-172.dat	upx
behavioral2/files/0x000700000002326e-169.dat	upx
behavioral2/files/0x000700000002326d-166.dat	upx
behavioral2/files/0x0007000000023274-165.dat	upx
behavioral2/memory/2104-1075-0x00007FF7F3BE0000-0x00007FF7F3FD2000-memory.dmp	upx
behavioral2/files/0x000700000002326c-149.dat	upx
behavioral2/memory/3168-154-0x00007FF74ADE0000-0x00007FF74B1D2000-memory.dmp	upx
behavioral2/memory/2804-144-0x00007FF74B490000-0x00007FF74B882000-memory.dmp	upx
behavioral2/files/0x0007000000023269-138.dat	upx
behavioral2/files/0x0007000000023266-129.dat	upx
behavioral2/memory/4368-124-0x00007FF681DE0000-0x00007FF6821D2000-memory.dmp	upx
behavioral2/files/0x0007000000023262-116.dat	upx
behavioral2/memory/4408-113-0x00007FF6862F0000-0x00007FF6866E2000-memory.dmp	upx
behavioral2/files/0x0007000000023268-120.dat	upx
behavioral2/files/0x0007000000023267-117.dat	upx
behavioral2/memory/4828-109-0x00007FF7DC520000-0x00007FF7DC912000-memory.dmp	upx
behavioral2/files/0x0007000000023265-101.dat	upx
behavioral2/memory/688-96-0x00007FF78AD00000-0x00007FF78B0F2000-memory.dmp	upx
behavioral2/files/0x0007000000023261-87.dat	upx
behavioral2/memory/1604-66-0x00007FF691CC0000-0x00007FF6920B2000-memory.dmp	upx
behavioral2/files/0x0007000000023260-64.dat	upx
behavioral2/memory/1480-2122-0x00007FF7723C0000-0x00007FF7727B2000-memory.dmp	upx
behavioral2/memory/3004-2075-0x00007FF736BE0000-0x00007FF736FD2000-memory.dmp	upx
behavioral2/memory/3372-2187-0x00007FF72E780000-0x00007FF72EB72000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
13	raw.githubusercontent.com
10	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\rtsnlMc.exe	2f9a47c210266b372ce59c9074c91e70_NeikiAnalytics.exe
File created	C:\Windows\System\PsFTSKA.exe	2f9a47c210266b372ce59c9074c91e70_NeikiAnalytics.exe
File created	C:\Windows\System\hSNrice.exe	2f9a47c210266b372ce59c9074c91e70_NeikiAnalytics.exe
File created	C:\Windows\System\oCjtoHH.exe	2f9a47c210266b372ce59c9074c91e70_NeikiAnalytics.exe
File created	C:\Windows\System\ZwpNIoO.exe	2f9a47c210266b372ce59c9074c91e70_NeikiAnalytics.exe
File created	C:\Windows\System\SVJGMci.exe	2f9a47c210266b372ce59c9074c91e70_NeikiAnalytics.exe
File created	C:\Windows\System\YtDtrwR.exe	2f9a47c210266b372ce59c9074c91e70_NeikiAnalytics.exe
File created	C:\Windows\System\YMVGZxl.exe	2f9a47c210266b372ce59c9074c91e70_NeikiAnalytics.exe
File created	C:\Windows\System\XIahcgZ.exe	2f9a47c210266b372ce59c9074c91e70_NeikiAnalytics.exe
File created	C:\Windows\System\jQpGepQ.exe	2f9a47c210266b372ce59c9074c91e70_NeikiAnalytics.exe
File created	C:\Windows\System\kFZfboY.exe	2f9a47c210266b372ce59c9074c91e70_NeikiAnalytics.exe
File created	C:\Windows\System\vxmyCye.exe	2f9a47c210266b372ce59c9074c91e70_NeikiAnalytics.exe
File created	C:\Windows\System\lUkxLiQ.exe	2f9a47c210266b372ce59c9074c91e70_NeikiAnalytics.exe
File created	C:\Windows\System\RSSNIgu.exe	2f9a47c210266b372ce59c9074c91e70_NeikiAnalytics.exe
File created	C:\Windows\System\RrIfzed.exe	2f9a47c210266b372ce59c9074c91e70_NeikiAnalytics.exe
File created	C:\Windows\System\bYNBQpX.exe	2f9a47c210266b372ce59c9074c91e70_NeikiAnalytics.exe
File created	C:\Windows\System\yUSJhmP.exe	2f9a47c210266b372ce59c9074c91e70_NeikiAnalytics.exe
File created	C:\Windows\System\KCSoeop.exe	2f9a47c210266b372ce59c9074c91e70_NeikiAnalytics.exe
File created	C:\Windows\System\ToDQHTo.exe	2f9a47c210266b372ce59c9074c91e70_NeikiAnalytics.exe
File created	C:\Windows\System\YgQUaaD.exe	2f9a47c210266b372ce59c9074c91e70_NeikiAnalytics.exe
File created	C:\Windows\System\DKpLKEP.exe	2f9a47c210266b372ce59c9074c91e70_NeikiAnalytics.exe
File created	C:\Windows\System\KWKXUGz.exe	2f9a47c210266b372ce59c9074c91e70_NeikiAnalytics.exe
File created	C:\Windows\System\thHhFvt.exe	2f9a47c210266b372ce59c9074c91e70_NeikiAnalytics.exe
File created	C:\Windows\System\DvlqNJL.exe	2f9a47c210266b372ce59c9074c91e70_NeikiAnalytics.exe
File created	C:\Windows\System\BjWblnV.exe	2f9a47c210266b372ce59c9074c91e70_NeikiAnalytics.exe
File created	C:\Windows\System\NgFjPGf.exe	2f9a47c210266b372ce59c9074c91e70_NeikiAnalytics.exe
File created	C:\Windows\System\ZCpWIiu.exe	2f9a47c210266b372ce59c9074c91e70_NeikiAnalytics.exe
File created	C:\Windows\System\eIucvjb.exe	2f9a47c210266b372ce59c9074c91e70_NeikiAnalytics.exe
File created	C:\Windows\System\RqKsRIV.exe	2f9a47c210266b372ce59c9074c91e70_NeikiAnalytics.exe
File created	C:\Windows\System\oDgIkxO.exe	2f9a47c210266b372ce59c9074c91e70_NeikiAnalytics.exe
File created	C:\Windows\System\VfAIqeU.exe	2f9a47c210266b372ce59c9074c91e70_NeikiAnalytics.exe
File created	C:\Windows\System\fltpkLm.exe	2f9a47c210266b372ce59c9074c91e70_NeikiAnalytics.exe
File created	C:\Windows\System\IToqHrO.exe	2f9a47c210266b372ce59c9074c91e70_NeikiAnalytics.exe
File created	C:\Windows\System\qBHFKwX.exe	2f9a47c210266b372ce59c9074c91e70_NeikiAnalytics.exe
File created	C:\Windows\System\subXiJh.exe	2f9a47c210266b372ce59c9074c91e70_NeikiAnalytics.exe
File created	C:\Windows\System\iTkGjRA.exe	2f9a47c210266b372ce59c9074c91e70_NeikiAnalytics.exe
File created	C:\Windows\System\jQIeDLS.exe	2f9a47c210266b372ce59c9074c91e70_NeikiAnalytics.exe
File created	C:\Windows\System\ihryWPr.exe	2f9a47c210266b372ce59c9074c91e70_NeikiAnalytics.exe
File created	C:\Windows\System\wQpLAeG.exe	2f9a47c210266b372ce59c9074c91e70_NeikiAnalytics.exe
File created	C:\Windows\System\ZnGgAoG.exe	2f9a47c210266b372ce59c9074c91e70_NeikiAnalytics.exe
File created	C:\Windows\System\hvFWHwB.exe	2f9a47c210266b372ce59c9074c91e70_NeikiAnalytics.exe
File created	C:\Windows\System\nDioVpu.exe	2f9a47c210266b372ce59c9074c91e70_NeikiAnalytics.exe
File created	C:\Windows\System\hMpqHRb.exe	2f9a47c210266b372ce59c9074c91e70_NeikiAnalytics.exe
File created	C:\Windows\System\KIjaCDE.exe	2f9a47c210266b372ce59c9074c91e70_NeikiAnalytics.exe
File created	C:\Windows\System\GCbudiZ.exe	2f9a47c210266b372ce59c9074c91e70_NeikiAnalytics.exe
File created	C:\Windows\System\ueNOipA.exe	2f9a47c210266b372ce59c9074c91e70_NeikiAnalytics.exe
File created	C:\Windows\System\VOVdEde.exe	2f9a47c210266b372ce59c9074c91e70_NeikiAnalytics.exe
File created	C:\Windows\System\XSWRAqC.exe	2f9a47c210266b372ce59c9074c91e70_NeikiAnalytics.exe
File created	C:\Windows\System\rskKcsn.exe	2f9a47c210266b372ce59c9074c91e70_NeikiAnalytics.exe
File created	C:\Windows\System\NbwDKHs.exe	2f9a47c210266b372ce59c9074c91e70_NeikiAnalytics.exe
File created	C:\Windows\System\LyLpZXb.exe	2f9a47c210266b372ce59c9074c91e70_NeikiAnalytics.exe
File created	C:\Windows\System\gEodXKT.exe	2f9a47c210266b372ce59c9074c91e70_NeikiAnalytics.exe
File created	C:\Windows\System\jUdYYQr.exe	2f9a47c210266b372ce59c9074c91e70_NeikiAnalytics.exe
File created	C:\Windows\System\lAnyDzQ.exe	2f9a47c210266b372ce59c9074c91e70_NeikiAnalytics.exe
File created	C:\Windows\System\lJUTPLW.exe	2f9a47c210266b372ce59c9074c91e70_NeikiAnalytics.exe
File created	C:\Windows\System\uvqsvMN.exe	2f9a47c210266b372ce59c9074c91e70_NeikiAnalytics.exe
File created	C:\Windows\System\RqyaoEd.exe	2f9a47c210266b372ce59c9074c91e70_NeikiAnalytics.exe
File created	C:\Windows\System\RXSjRAb.exe	2f9a47c210266b372ce59c9074c91e70_NeikiAnalytics.exe
File created	C:\Windows\System\CvWXvMh.exe	2f9a47c210266b372ce59c9074c91e70_NeikiAnalytics.exe
File created	C:\Windows\System\upQxwcv.exe	2f9a47c210266b372ce59c9074c91e70_NeikiAnalytics.exe
File created	C:\Windows\System\KIrkosK.exe	2f9a47c210266b372ce59c9074c91e70_NeikiAnalytics.exe
File created	C:\Windows\System\NkgjoFK.exe	2f9a47c210266b372ce59c9074c91e70_NeikiAnalytics.exe
File created	C:\Windows\System\pUmQyDt.exe	2f9a47c210266b372ce59c9074c91e70_NeikiAnalytics.exe
File created	C:\Windows\System\UNgKxqd.exe	2f9a47c210266b372ce59c9074c91e70_NeikiAnalytics.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
560	powershell.exe
560	powershell.exe
560	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2104	2f9a47c210266b372ce59c9074c91e70_NeikiAnalytics.exe
Token: SeDebugPrivilege	560	powershell.exe
Token: SeLockMemoryPrivilege	2104	2f9a47c210266b372ce59c9074c91e70_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2104 wrote to memory of 560	2104	2f9a47c210266b372ce59c9074c91e70_NeikiAnalytics.exe	91
PID 2104 wrote to memory of 560	2104	2f9a47c210266b372ce59c9074c91e70_NeikiAnalytics.exe	91
PID 2104 wrote to memory of 3004	2104	2f9a47c210266b372ce59c9074c91e70_NeikiAnalytics.exe	92
PID 2104 wrote to memory of 3004	2104	2f9a47c210266b372ce59c9074c91e70_NeikiAnalytics.exe	92
PID 2104 wrote to memory of 3372	2104	2f9a47c210266b372ce59c9074c91e70_NeikiAnalytics.exe	93
PID 2104 wrote to memory of 3372	2104	2f9a47c210266b372ce59c9074c91e70_NeikiAnalytics.exe	93
PID 2104 wrote to memory of 3996	2104	2f9a47c210266b372ce59c9074c91e70_NeikiAnalytics.exe	94
PID 2104 wrote to memory of 3996	2104	2f9a47c210266b372ce59c9074c91e70_NeikiAnalytics.exe	94
PID 2104 wrote to memory of 1480	2104	2f9a47c210266b372ce59c9074c91e70_NeikiAnalytics.exe	95
PID 2104 wrote to memory of 1480	2104	2f9a47c210266b372ce59c9074c91e70_NeikiAnalytics.exe	95
PID 2104 wrote to memory of 2120	2104	2f9a47c210266b372ce59c9074c91e70_NeikiAnalytics.exe	96
PID 2104 wrote to memory of 2120	2104	2f9a47c210266b372ce59c9074c91e70_NeikiAnalytics.exe	96
PID 2104 wrote to memory of 1912	2104	2f9a47c210266b372ce59c9074c91e70_NeikiAnalytics.exe	97
PID 2104 wrote to memory of 1912	2104	2f9a47c210266b372ce59c9074c91e70_NeikiAnalytics.exe	97
PID 2104 wrote to memory of 2916	2104	2f9a47c210266b372ce59c9074c91e70_NeikiAnalytics.exe	98
PID 2104 wrote to memory of 2916	2104	2f9a47c210266b372ce59c9074c91e70_NeikiAnalytics.exe	98
PID 2104 wrote to memory of 1604	2104	2f9a47c210266b372ce59c9074c91e70_NeikiAnalytics.exe	99
PID 2104 wrote to memory of 1604	2104	2f9a47c210266b372ce59c9074c91e70_NeikiAnalytics.exe	99
PID 2104 wrote to memory of 688	2104	2f9a47c210266b372ce59c9074c91e70_NeikiAnalytics.exe	100
PID 2104 wrote to memory of 688	2104	2f9a47c210266b372ce59c9074c91e70_NeikiAnalytics.exe	100
PID 2104 wrote to memory of 4828	2104	2f9a47c210266b372ce59c9074c91e70_NeikiAnalytics.exe	101
PID 2104 wrote to memory of 4828	2104	2f9a47c210266b372ce59c9074c91e70_NeikiAnalytics.exe	101
PID 2104 wrote to memory of 2208	2104	2f9a47c210266b372ce59c9074c91e70_NeikiAnalytics.exe	102
PID 2104 wrote to memory of 2208	2104	2f9a47c210266b372ce59c9074c91e70_NeikiAnalytics.exe	102
PID 2104 wrote to memory of 5100	2104	2f9a47c210266b372ce59c9074c91e70_NeikiAnalytics.exe	103
PID 2104 wrote to memory of 5100	2104	2f9a47c210266b372ce59c9074c91e70_NeikiAnalytics.exe	103
PID 2104 wrote to memory of 4408	2104	2f9a47c210266b372ce59c9074c91e70_NeikiAnalytics.exe	104
PID 2104 wrote to memory of 4408	2104	2f9a47c210266b372ce59c9074c91e70_NeikiAnalytics.exe	104
PID 2104 wrote to memory of 4368	2104	2f9a47c210266b372ce59c9074c91e70_NeikiAnalytics.exe	105
PID 2104 wrote to memory of 4368	2104	2f9a47c210266b372ce59c9074c91e70_NeikiAnalytics.exe	105
PID 2104 wrote to memory of 2804	2104	2f9a47c210266b372ce59c9074c91e70_NeikiAnalytics.exe	106
PID 2104 wrote to memory of 2804	2104	2f9a47c210266b372ce59c9074c91e70_NeikiAnalytics.exe	106
PID 2104 wrote to memory of 3168	2104	2f9a47c210266b372ce59c9074c91e70_NeikiAnalytics.exe	107
PID 2104 wrote to memory of 3168	2104	2f9a47c210266b372ce59c9074c91e70_NeikiAnalytics.exe	107
PID 2104 wrote to memory of 3580	2104	2f9a47c210266b372ce59c9074c91e70_NeikiAnalytics.exe	108
PID 2104 wrote to memory of 3580	2104	2f9a47c210266b372ce59c9074c91e70_NeikiAnalytics.exe	108
PID 2104 wrote to memory of 5080	2104	2f9a47c210266b372ce59c9074c91e70_NeikiAnalytics.exe	109
PID 2104 wrote to memory of 5080	2104	2f9a47c210266b372ce59c9074c91e70_NeikiAnalytics.exe	109
PID 2104 wrote to memory of 3988	2104	2f9a47c210266b372ce59c9074c91e70_NeikiAnalytics.exe	110
PID 2104 wrote to memory of 3988	2104	2f9a47c210266b372ce59c9074c91e70_NeikiAnalytics.exe	110
PID 2104 wrote to memory of 2964	2104	2f9a47c210266b372ce59c9074c91e70_NeikiAnalytics.exe	111
PID 2104 wrote to memory of 2964	2104	2f9a47c210266b372ce59c9074c91e70_NeikiAnalytics.exe	111
PID 2104 wrote to memory of 2260	2104	2f9a47c210266b372ce59c9074c91e70_NeikiAnalytics.exe	112
PID 2104 wrote to memory of 2260	2104	2f9a47c210266b372ce59c9074c91e70_NeikiAnalytics.exe	112
PID 2104 wrote to memory of 2524	2104	2f9a47c210266b372ce59c9074c91e70_NeikiAnalytics.exe	113
PID 2104 wrote to memory of 2524	2104	2f9a47c210266b372ce59c9074c91e70_NeikiAnalytics.exe	113
PID 2104 wrote to memory of 3252	2104	2f9a47c210266b372ce59c9074c91e70_NeikiAnalytics.exe	114
PID 2104 wrote to memory of 3252	2104	2f9a47c210266b372ce59c9074c91e70_NeikiAnalytics.exe	114
PID 2104 wrote to memory of 1836	2104	2f9a47c210266b372ce59c9074c91e70_NeikiAnalytics.exe	115
PID 2104 wrote to memory of 1836	2104	2f9a47c210266b372ce59c9074c91e70_NeikiAnalytics.exe	115
PID 2104 wrote to memory of 1788	2104	2f9a47c210266b372ce59c9074c91e70_NeikiAnalytics.exe	116
PID 2104 wrote to memory of 1788	2104	2f9a47c210266b372ce59c9074c91e70_NeikiAnalytics.exe	116
PID 2104 wrote to memory of 5036	2104	2f9a47c210266b372ce59c9074c91e70_NeikiAnalytics.exe	117
PID 2104 wrote to memory of 5036	2104	2f9a47c210266b372ce59c9074c91e70_NeikiAnalytics.exe	117
PID 2104 wrote to memory of 2220	2104	2f9a47c210266b372ce59c9074c91e70_NeikiAnalytics.exe	118
PID 2104 wrote to memory of 2220	2104	2f9a47c210266b372ce59c9074c91e70_NeikiAnalytics.exe	118
PID 2104 wrote to memory of 2132	2104	2f9a47c210266b372ce59c9074c91e70_NeikiAnalytics.exe	119
PID 2104 wrote to memory of 2132	2104	2f9a47c210266b372ce59c9074c91e70_NeikiAnalytics.exe	119
PID 2104 wrote to memory of 5020	2104	2f9a47c210266b372ce59c9074c91e70_NeikiAnalytics.exe	120
PID 2104 wrote to memory of 5020	2104	2f9a47c210266b372ce59c9074c91e70_NeikiAnalytics.exe	120
PID 2104 wrote to memory of 1148	2104	2f9a47c210266b372ce59c9074c91e70_NeikiAnalytics.exe	121
PID 2104 wrote to memory of 1148	2104	2f9a47c210266b372ce59c9074c91e70_NeikiAnalytics.exe	121
PID 2104 wrote to memory of 2844	2104	2f9a47c210266b372ce59c9074c91e70_NeikiAnalytics.exe	122
PID 2104 wrote to memory of 2844	2104	2f9a47c210266b372ce59c9074c91e70_NeikiAnalytics.exe	122

C:\Users\Admin\AppData\Local\Temp\2f9a47c210266b372ce59c9074c91e70_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\2f9a47c210266b372ce59c9074c91e70_NeikiAnalytics.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2104
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:560
- C:\Windows\System\ptTulXn.exe
  C:\Windows\System\ptTulXn.exe
  2⤵
  - Executes dropped EXE
  PID:3004
- C:\Windows\System\RXSjRAb.exe
  C:\Windows\System\RXSjRAb.exe
  2⤵
  - Executes dropped EXE
  PID:3372
- C:\Windows\System\MOPWqfj.exe
  C:\Windows\System\MOPWqfj.exe
  2⤵
  - Executes dropped EXE
  PID:3996
- C:\Windows\System\IToqHrO.exe
  C:\Windows\System\IToqHrO.exe
  2⤵
  - Executes dropped EXE
  PID:1480
- C:\Windows\System\pPbUUDt.exe
  C:\Windows\System\pPbUUDt.exe
  2⤵
  - Executes dropped EXE
  PID:2120
- C:\Windows\System\RaOLHyM.exe
  C:\Windows\System\RaOLHyM.exe
  2⤵
  - Executes dropped EXE
  PID:1912
- C:\Windows\System\IwkpWWh.exe
  C:\Windows\System\IwkpWWh.exe
  2⤵
  - Executes dropped EXE
  PID:2916
- C:\Windows\System\TJXjAof.exe
  C:\Windows\System\TJXjAof.exe
  2⤵
  - Executes dropped EXE
  PID:1604
- C:\Windows\System\HMyLOVt.exe
  C:\Windows\System\HMyLOVt.exe
  2⤵
  - Executes dropped EXE
  PID:688
- C:\Windows\System\KLgBQXf.exe
  C:\Windows\System\KLgBQXf.exe
  2⤵
  - Executes dropped EXE
  PID:4828
- C:\Windows\System\bYNBQpX.exe
  C:\Windows\System\bYNBQpX.exe
  2⤵
  - Executes dropped EXE
  PID:2208
- C:\Windows\System\ueNOipA.exe
  C:\Windows\System\ueNOipA.exe
  2⤵
  - Executes dropped EXE
  PID:5100
- C:\Windows\System\TDbszSa.exe
  C:\Windows\System\TDbszSa.exe
  2⤵
  - Executes dropped EXE
  PID:4408
- C:\Windows\System\GyTQCwc.exe
  C:\Windows\System\GyTQCwc.exe
  2⤵
  - Executes dropped EXE
  PID:4368
- C:\Windows\System\IfnZvAl.exe
  C:\Windows\System\IfnZvAl.exe
  2⤵
  - Executes dropped EXE
  PID:2804
- C:\Windows\System\VOVdEde.exe
  C:\Windows\System\VOVdEde.exe
  2⤵
  - Executes dropped EXE
  PID:3168
- C:\Windows\System\cNzroNr.exe
  C:\Windows\System\cNzroNr.exe
  2⤵
  - Executes dropped EXE
  PID:3580
- C:\Windows\System\gDRlGGy.exe
  C:\Windows\System\gDRlGGy.exe
  2⤵
  - Executes dropped EXE
  PID:5080
- C:\Windows\System\ZhIARlL.exe
  C:\Windows\System\ZhIARlL.exe
  2⤵
  - Executes dropped EXE
  PID:3988
- C:\Windows\System\cPdgNEW.exe
  C:\Windows\System\cPdgNEW.exe
  2⤵
  - Executes dropped EXE
  PID:2964
- C:\Windows\System\iTJLPLO.exe
  C:\Windows\System\iTJLPLO.exe
  2⤵
  - Executes dropped EXE
  PID:2260
- C:\Windows\System\jUdYYQr.exe
  C:\Windows\System\jUdYYQr.exe
  2⤵
  - Executes dropped EXE
  PID:2524
- C:\Windows\System\EbzInMP.exe
  C:\Windows\System\EbzInMP.exe
  2⤵
  - Executes dropped EXE
  PID:3252
- C:\Windows\System\XevTSbF.exe
  C:\Windows\System\XevTSbF.exe
  2⤵
  - Executes dropped EXE
  PID:1836
- C:\Windows\System\SohxNsG.exe
  C:\Windows\System\SohxNsG.exe
  2⤵
  - Executes dropped EXE
  PID:1788
- C:\Windows\System\FRoYdLP.exe
  C:\Windows\System\FRoYdLP.exe
  2⤵
  - Executes dropped EXE
  PID:5036
- C:\Windows\System\wesjeVY.exe
  C:\Windows\System\wesjeVY.exe
  2⤵
  - Executes dropped EXE
  PID:2220
- C:\Windows\System\sjJdDti.exe
  C:\Windows\System\sjJdDti.exe
  2⤵
  - Executes dropped EXE
  PID:2132
- C:\Windows\System\xUwdxED.exe
  C:\Windows\System\xUwdxED.exe
  2⤵
  - Executes dropped EXE
  PID:5020
- C:\Windows\System\cNMjtrv.exe
  C:\Windows\System\cNMjtrv.exe
  2⤵
  - Executes dropped EXE
  PID:1148
- C:\Windows\System\ZZDRwJz.exe
  C:\Windows\System\ZZDRwJz.exe
  2⤵
  - Executes dropped EXE
  PID:2844
- C:\Windows\System\linlmjz.exe
  C:\Windows\System\linlmjz.exe
  2⤵
  - Executes dropped EXE
  PID:4836
- C:\Windows\System\NabDCDl.exe
  C:\Windows\System\NabDCDl.exe
  2⤵
  - Executes dropped EXE
  PID:1580
- C:\Windows\System\KUSRAyt.exe
  C:\Windows\System\KUSRAyt.exe
  2⤵
  - Executes dropped EXE
  PID:4260
- C:\Windows\System\MvlnKHG.exe
  C:\Windows\System\MvlnKHG.exe
  2⤵
  - Executes dropped EXE
  PID:1044
- C:\Windows\System\TMocrpX.exe
  C:\Windows\System\TMocrpX.exe
  2⤵
  - Executes dropped EXE
  PID:4816
- C:\Windows\System\rtsnlMc.exe
  C:\Windows\System\rtsnlMc.exe
  2⤵
  - Executes dropped EXE
  PID:2592
- C:\Windows\System\JziiHpX.exe
  C:\Windows\System\JziiHpX.exe
  2⤵
  - Executes dropped EXE
  PID:3328
- C:\Windows\System\thHhFvt.exe
  C:\Windows\System\thHhFvt.exe
  2⤵
  - Executes dropped EXE
  PID:4648
- C:\Windows\System\rjSMFLC.exe
  C:\Windows\System\rjSMFLC.exe
  2⤵
  - Executes dropped EXE
  PID:4644
- C:\Windows\System\JksRZqe.exe
  C:\Windows\System\JksRZqe.exe
  2⤵
  - Executes dropped EXE
  PID:1748
- C:\Windows\System\ZNUBfcT.exe
  C:\Windows\System\ZNUBfcT.exe
  2⤵
  - Executes dropped EXE
  PID:3256
- C:\Windows\System\KbtkhGP.exe
  C:\Windows\System\KbtkhGP.exe
  2⤵
  - Executes dropped EXE
  PID:3420
- C:\Windows\System\ATffddC.exe
  C:\Windows\System\ATffddC.exe
  2⤵
  - Executes dropped EXE
  PID:3612
- C:\Windows\System\iTkGjRA.exe
  C:\Windows\System\iTkGjRA.exe
  2⤵
  - Executes dropped EXE
  PID:2708
- C:\Windows\System\zziNEIR.exe
  C:\Windows\System\zziNEIR.exe
  2⤵
  - Executes dropped EXE
  PID:3144
- C:\Windows\System\aGfIisa.exe
  C:\Windows\System\aGfIisa.exe
  2⤵
  - Executes dropped EXE
  PID:2776
- C:\Windows\System\JXLhnai.exe
  C:\Windows\System\JXLhnai.exe
  2⤵
  - Executes dropped EXE
  PID:2808
- C:\Windows\System\CvWXvMh.exe
  C:\Windows\System\CvWXvMh.exe
  2⤵
  - Executes dropped EXE
  PID:208
- C:\Windows\System\yUSJhmP.exe
  C:\Windows\System\yUSJhmP.exe
  2⤵
  - Executes dropped EXE
  PID:1864
- C:\Windows\System\oSTsrIZ.exe
  C:\Windows\System\oSTsrIZ.exe
  2⤵
  - Executes dropped EXE
  PID:1184
- C:\Windows\System\SqOFfuR.exe
  C:\Windows\System\SqOFfuR.exe
  2⤵
  - Executes dropped EXE
  PID:3944
- C:\Windows\System\RSSNIgu.exe
  C:\Windows\System\RSSNIgu.exe
  2⤵
  - Executes dropped EXE
  PID:5108
- C:\Windows\System\AzgOWaz.exe
  C:\Windows\System\AzgOWaz.exe
  2⤵
  - Executes dropped EXE
  PID:2600
- C:\Windows\System\YtDtrwR.exe
  C:\Windows\System\YtDtrwR.exe
  2⤵
  - Executes dropped EXE
  PID:1136
- C:\Windows\System\QYSeArR.exe
  C:\Windows\System\QYSeArR.exe
  2⤵
  - Executes dropped EXE
  PID:3984
- C:\Windows\System\pKRJUBH.exe
  C:\Windows\System\pKRJUBH.exe
  2⤵
  - Executes dropped EXE
  PID:4168
- C:\Windows\System\EmDEHjn.exe
  C:\Windows\System\EmDEHjn.exe
  2⤵
  - Executes dropped EXE
  PID:5128
- C:\Windows\System\spjprZU.exe
  C:\Windows\System\spjprZU.exe
  2⤵
  - Executes dropped EXE
  PID:5144
- C:\Windows\System\fyQeKVY.exe
  C:\Windows\System\fyQeKVY.exe
  2⤵
  - Executes dropped EXE
  PID:5160
- C:\Windows\System\iwuhiND.exe
  C:\Windows\System\iwuhiND.exe
  2⤵
  - Executes dropped EXE
  PID:5196
- C:\Windows\System\BqzpgKZ.exe
  C:\Windows\System\BqzpgKZ.exe
  2⤵
  - Executes dropped EXE
  PID:5288
- C:\Windows\System\RVntwpN.exe
  C:\Windows\System\RVntwpN.exe
  2⤵
  - Executes dropped EXE
  PID:5332
- C:\Windows\System\mNiNZDE.exe
  C:\Windows\System\mNiNZDE.exe
  2⤵
  - Executes dropped EXE
  PID:5524
- C:\Windows\System\VLKtvQZ.exe
  C:\Windows\System\VLKtvQZ.exe
  2⤵
  PID:5548
- C:\Windows\System\KdBNqZI.exe
  C:\Windows\System\KdBNqZI.exe
  2⤵
  PID:5588
- C:\Windows\System\YMVGZxl.exe
  C:\Windows\System\YMVGZxl.exe
  2⤵
  PID:5612
- C:\Windows\System\jQIeDLS.exe
  C:\Windows\System\jQIeDLS.exe
  2⤵
  PID:5652
- C:\Windows\System\nvayjpC.exe
  C:\Windows\System\nvayjpC.exe
  2⤵
  PID:5712
- C:\Windows\System\RYKDXwE.exe
  C:\Windows\System\RYKDXwE.exe
  2⤵
  PID:5732
- C:\Windows\System\PCmJjML.exe
  C:\Windows\System\PCmJjML.exe
  2⤵
  PID:5764
- C:\Windows\System\wkZtacX.exe
  C:\Windows\System\wkZtacX.exe
  2⤵
  PID:5784
- C:\Windows\System\qBHFKwX.exe
  C:\Windows\System\qBHFKwX.exe
  2⤵
  PID:5824
- C:\Windows\System\BsfxCHF.exe
  C:\Windows\System\BsfxCHF.exe
  2⤵
  PID:5892
- C:\Windows\System\QKCsfYy.exe
  C:\Windows\System\QKCsfYy.exe
  2⤵
  PID:5940
- C:\Windows\System\vQDZbou.exe
  C:\Windows\System\vQDZbou.exe
  2⤵
  PID:5956
- C:\Windows\System\eUDtJxy.exe
  C:\Windows\System\eUDtJxy.exe
  2⤵
  PID:5972
- C:\Windows\System\baBZTPG.exe
  C:\Windows\System\baBZTPG.exe
  2⤵
  PID:5988
- C:\Windows\System\jTJpHWI.exe
  C:\Windows\System\jTJpHWI.exe
  2⤵
  PID:6004
- C:\Windows\System\qWUFRdr.exe
  C:\Windows\System\qWUFRdr.exe
  2⤵
  PID:6028
- C:\Windows\System\nDbhPrk.exe
  C:\Windows\System\nDbhPrk.exe
  2⤵
  PID:6044
- C:\Windows\System\uvcOtFp.exe
  C:\Windows\System\uvcOtFp.exe
  2⤵
  PID:6072
- C:\Windows\System\QmfgBLt.exe
  C:\Windows\System\QmfgBLt.exe
  2⤵
  PID:6100
- C:\Windows\System\fPIpbAb.exe
  C:\Windows\System\fPIpbAb.exe
  2⤵
  PID:6124
- C:\Windows\System\krKHsXA.exe
  C:\Windows\System\krKHsXA.exe
  2⤵
  PID:4032
- C:\Windows\System\JXOHJQO.exe
  C:\Windows\System\JXOHJQO.exe
  2⤵
  PID:3860
- C:\Windows\System\GYTAVBF.exe
  C:\Windows\System\GYTAVBF.exe
  2⤵
  PID:5208
- C:\Windows\System\VHgsHJu.exe
  C:\Windows\System\VHgsHJu.exe
  2⤵
  PID:4804
- C:\Windows\System\QbgWqhA.exe
  C:\Windows\System\QbgWqhA.exe
  2⤵
  PID:4164
- C:\Windows\System\iPzUrnH.exe
  C:\Windows\System\iPzUrnH.exe
  2⤵
  PID:5156
- C:\Windows\System\cGNeaUx.exe
  C:\Windows\System\cGNeaUx.exe
  2⤵
  PID:5340
- C:\Windows\System\cvUkCHJ.exe
  C:\Windows\System\cvUkCHJ.exe
  2⤵
  PID:1656
- C:\Windows\System\NDjRLpV.exe
  C:\Windows\System\NDjRLpV.exe
  2⤵
  PID:1484
- C:\Windows\System\hjrkvYF.exe
  C:\Windows\System\hjrkvYF.exe
  2⤵
  PID:4996
- C:\Windows\System\rSOvBhR.exe
  C:\Windows\System\rSOvBhR.exe
  2⤵
  PID:4528
- C:\Windows\System\ODZXtnR.exe
  C:\Windows\System\ODZXtnR.exe
  2⤵
  PID:4428
- C:\Windows\System\gsFNHJL.exe
  C:\Windows\System\gsFNHJL.exe
  2⤵
  PID:3120
- C:\Windows\System\WTevhVn.exe
  C:\Windows\System\WTevhVn.exe
  2⤵
  PID:4988
- C:\Windows\System\kmQatsZ.exe
  C:\Windows\System\kmQatsZ.exe
  2⤵
  PID:5664
- C:\Windows\System\dRAaWqz.exe
  C:\Windows\System\dRAaWqz.exe
  2⤵
  PID:5676
- C:\Windows\System\PsFTSKA.exe
  C:\Windows\System\PsFTSKA.exe
  2⤵
  PID:5604
- C:\Windows\System\TtmBmhb.exe
  C:\Windows\System\TtmBmhb.exe
  2⤵
  PID:5632
- C:\Windows\System\oaHOzJt.exe
  C:\Windows\System\oaHOzJt.exe
  2⤵
  PID:5772
- C:\Windows\System\PzJyzli.exe
  C:\Windows\System\PzJyzli.exe
  2⤵
  PID:2764
- C:\Windows\System\ZrXvvjC.exe
  C:\Windows\System\ZrXvvjC.exe
  2⤵
  PID:1340
- C:\Windows\System\Wcpczxc.exe
  C:\Windows\System\Wcpczxc.exe
  2⤵
  PID:6016
- C:\Windows\System\RQgpTyA.exe
  C:\Windows\System\RQgpTyA.exe
  2⤵
  PID:6040
- C:\Windows\System\eIucvjb.exe
  C:\Windows\System\eIucvjb.exe
  2⤵
  PID:6112
- C:\Windows\System\hGNuWOx.exe
  C:\Windows\System\hGNuWOx.exe
  2⤵
  PID:2044
- C:\Windows\System\VyhjfTN.exe
  C:\Windows\System\VyhjfTN.exe
  2⤵
  PID:4100
- C:\Windows\System\weorGDy.exe
  C:\Windows\System\weorGDy.exe
  2⤵
  PID:4280
- C:\Windows\System\HPRbSOu.exe
  C:\Windows\System\HPRbSOu.exe
  2⤵
  PID:4536
- C:\Windows\System\bmizdsz.exe
  C:\Windows\System\bmizdsz.exe
  2⤵
  PID:2276
- C:\Windows\System\UlhDBPD.exe
  C:\Windows\System\UlhDBPD.exe
  2⤵
  PID:4284
- C:\Windows\System\CtfcsJQ.exe
  C:\Windows\System\CtfcsJQ.exe
  2⤵
  PID:5580
- C:\Windows\System\TfAgkvB.exe
  C:\Windows\System\TfAgkvB.exe
  2⤵
  PID:5572
- C:\Windows\System\pVljwMf.exe
  C:\Windows\System\pVljwMf.exe
  2⤵
  PID:1616
- C:\Windows\System\hSNrice.exe
  C:\Windows\System\hSNrice.exe
  2⤵
  PID:4268
- C:\Windows\System\vzDdjIF.exe
  C:\Windows\System\vzDdjIF.exe
  2⤵
  PID:6116
- C:\Windows\System\heoHdsX.exe
  C:\Windows\System\heoHdsX.exe
  2⤵
  PID:5516
- C:\Windows\System\EUxnQNi.exe
  C:\Windows\System\EUxnQNi.exe
  2⤵
  PID:5220
- C:\Windows\System\WEsWoXX.exe
  C:\Windows\System\WEsWoXX.exe
  2⤵
  PID:2096
- C:\Windows\System\lkPqhoc.exe
  C:\Windows\System\lkPqhoc.exe
  2⤵
  PID:4148
- C:\Windows\System\YQNZGGx.exe
  C:\Windows\System\YQNZGGx.exe
  2⤵
  PID:5360
- C:\Windows\System\ZwpNIoO.exe
  C:\Windows\System\ZwpNIoO.exe
  2⤵
  PID:5116
- C:\Windows\System\akbetjq.exe
  C:\Windows\System\akbetjq.exe
  2⤵
  PID:5836
- C:\Windows\System\BmpfpVL.exe
  C:\Windows\System\BmpfpVL.exe
  2⤵
  PID:5224
- C:\Windows\System\MFppiIp.exe
  C:\Windows\System\MFppiIp.exe
  2⤵
  PID:3088
- C:\Windows\System\DRIqkfk.exe
  C:\Windows\System\DRIqkfk.exe
  2⤵
  PID:5512
- C:\Windows\System\WelnTaU.exe
  C:\Windows\System\WelnTaU.exe
  2⤵
  PID:2692
- C:\Windows\System\vVABdfu.exe
  C:\Windows\System\vVABdfu.exe
  2⤵
  PID:5624
- C:\Windows\System\jKbotmW.exe
  C:\Windows\System\jKbotmW.exe
  2⤵
  PID:5792
- C:\Windows\System\BgVIvAu.exe
  C:\Windows\System\BgVIvAu.exe
  2⤵
  PID:4512
- C:\Windows\System\uTlVKaI.exe
  C:\Windows\System\uTlVKaI.exe
  2⤵
  PID:5900
- C:\Windows\System\OtGzKdl.exe
  C:\Windows\System\OtGzKdl.exe
  2⤵
  PID:6160
- C:\Windows\System\UtQndxl.exe
  C:\Windows\System\UtQndxl.exe
  2⤵
  PID:6180
- C:\Windows\System\CTfURIR.exe
  C:\Windows\System\CTfURIR.exe
  2⤵
  PID:6264
- C:\Windows\System\vGepQMB.exe
  C:\Windows\System\vGepQMB.exe
  2⤵
  PID:6292
- C:\Windows\System\VRIaAkP.exe
  C:\Windows\System\VRIaAkP.exe
  2⤵
  PID:6348
- C:\Windows\System\pGHKzal.exe
  C:\Windows\System\pGHKzal.exe
  2⤵
  PID:6368
- C:\Windows\System\kogBdEd.exe
  C:\Windows\System\kogBdEd.exe
  2⤵
  PID:6384
- C:\Windows\System\agFDzJs.exe
  C:\Windows\System\agFDzJs.exe
  2⤵
  PID:6404
- C:\Windows\System\APVDvrP.exe
  C:\Windows\System\APVDvrP.exe
  2⤵
  PID:6420
- C:\Windows\System\utQUjNT.exe
  C:\Windows\System\utQUjNT.exe
  2⤵
  PID:6436
- C:\Windows\System\XzSNFEC.exe
  C:\Windows\System\XzSNFEC.exe
  2⤵
  PID:6452
- C:\Windows\System\jeLnapy.exe
  C:\Windows\System\jeLnapy.exe
  2⤵
  PID:6484
- C:\Windows\System\aDfkLxK.exe
  C:\Windows\System\aDfkLxK.exe
  2⤵
  PID:6508
- C:\Windows\System\DotfsGw.exe
  C:\Windows\System\DotfsGw.exe
  2⤵
  PID:6528
- C:\Windows\System\ihryWPr.exe
  C:\Windows\System\ihryWPr.exe
  2⤵
  PID:6548
- C:\Windows\System\YQBPYPZ.exe
  C:\Windows\System\YQBPYPZ.exe
  2⤵
  PID:6568
- C:\Windows\System\FgohyMb.exe
  C:\Windows\System\FgohyMb.exe
  2⤵
  PID:6584
- C:\Windows\System\KCSoeop.exe
  C:\Windows\System\KCSoeop.exe
  2⤵
  PID:6600
- C:\Windows\System\cfBAbwW.exe
  C:\Windows\System\cfBAbwW.exe
  2⤵
  PID:6616
- C:\Windows\System\uJmsSzy.exe
  C:\Windows\System\uJmsSzy.exe
  2⤵
  PID:6632
- C:\Windows\System\ToDQHTo.exe
  C:\Windows\System\ToDQHTo.exe
  2⤵
  PID:6648
- C:\Windows\System\qnqRDHH.exe
  C:\Windows\System\qnqRDHH.exe
  2⤵
  PID:6664
- C:\Windows\System\sIjoCOp.exe
  C:\Windows\System\sIjoCOp.exe
  2⤵
  PID:6680
- C:\Windows\System\DvlqNJL.exe
  C:\Windows\System\DvlqNJL.exe
  2⤵
  PID:6696
- C:\Windows\System\GLDnhvz.exe
  C:\Windows\System\GLDnhvz.exe
  2⤵
  PID:6712
- C:\Windows\System\RqKsRIV.exe
  C:\Windows\System\RqKsRIV.exe
  2⤵
  PID:6728
- C:\Windows\System\XSWRAqC.exe
  C:\Windows\System\XSWRAqC.exe
  2⤵
  PID:6744
- C:\Windows\System\uiyJjxs.exe
  C:\Windows\System\uiyJjxs.exe
  2⤵
  PID:6760
- C:\Windows\System\fkGxOIr.exe
  C:\Windows\System\fkGxOIr.exe
  2⤵
  PID:6780
- C:\Windows\System\rTGTMiv.exe
  C:\Windows\System\rTGTMiv.exe
  2⤵
  PID:6796
- C:\Windows\System\GNmOpuv.exe
  C:\Windows\System\GNmOpuv.exe
  2⤵
  PID:6820
- C:\Windows\System\CRvRpbH.exe
  C:\Windows\System\CRvRpbH.exe
  2⤵
  PID:6836
- C:\Windows\System\ZfIsYtO.exe
  C:\Windows\System\ZfIsYtO.exe
  2⤵
  PID:6852
- C:\Windows\System\DmTnGoJ.exe
  C:\Windows\System\DmTnGoJ.exe
  2⤵
  PID:6868
- C:\Windows\System\mPcvobi.exe
  C:\Windows\System\mPcvobi.exe
  2⤵
  PID:6884
- C:\Windows\System\yiCuVCj.exe
  C:\Windows\System\yiCuVCj.exe
  2⤵
  PID:6900
- C:\Windows\System\ozYZzes.exe
  C:\Windows\System\ozYZzes.exe
  2⤵
  PID:6920
- C:\Windows\System\VEnilMw.exe
  C:\Windows\System\VEnilMw.exe
  2⤵
  PID:6936
- C:\Windows\System\zXdqyDl.exe
  C:\Windows\System\zXdqyDl.exe
  2⤵
  PID:6952
- C:\Windows\System\BStmQsG.exe
  C:\Windows\System\BStmQsG.exe
  2⤵
  PID:6988
- C:\Windows\System\vawnttl.exe
  C:\Windows\System\vawnttl.exe
  2⤵
  PID:7012
- C:\Windows\System\kJGYLaJ.exe
  C:\Windows\System\kJGYLaJ.exe
  2⤵
  PID:7036
- C:\Windows\System\GeLyeGc.exe
  C:\Windows\System\GeLyeGc.exe
  2⤵
  PID:7056
- C:\Windows\System\IxwHvVJ.exe
  C:\Windows\System\IxwHvVJ.exe
  2⤵
  PID:7072
- C:\Windows\System\ADWsGiS.exe
  C:\Windows\System\ADWsGiS.exe
  2⤵
  PID:7100
- C:\Windows\System\ygYJpnm.exe
  C:\Windows\System\ygYJpnm.exe
  2⤵
  PID:7116
- C:\Windows\System\oDgIkxO.exe
  C:\Windows\System\oDgIkxO.exe
  2⤵
  PID:7136
- C:\Windows\System\jffWBEF.exe
  C:\Windows\System\jffWBEF.exe
  2⤵
  PID:7152
- C:\Windows\System\OjaXJOl.exe
  C:\Windows\System\OjaXJOl.exe
  2⤵
  PID:1704
- C:\Windows\System\amCTEZr.exe
  C:\Windows\System\amCTEZr.exe
  2⤵
  PID:532
- C:\Windows\System\MeAiesy.exe
  C:\Windows\System\MeAiesy.exe
  2⤵
  PID:6176
- C:\Windows\System\UZGEBIE.exe
  C:\Windows\System\UZGEBIE.exe
  2⤵
  PID:6252
- C:\Windows\System\JKiGJHO.exe
  C:\Windows\System\JKiGJHO.exe
  2⤵
  PID:6168
- C:\Windows\System\SzfPauV.exe
  C:\Windows\System\SzfPauV.exe
  2⤵
  PID:6320
- C:\Windows\System\kbFkwQL.exe
  C:\Windows\System\kbFkwQL.exe
  2⤵
  PID:6448
- C:\Windows\System\tFtdwiC.exe
  C:\Windows\System\tFtdwiC.exe
  2⤵
  PID:6464
- C:\Windows\System\XstyZBO.exe
  C:\Windows\System\XstyZBO.exe
  2⤵
  PID:6360
- C:\Windows\System\dYhwhNU.exe
  C:\Windows\System\dYhwhNU.exe
  2⤵
  PID:6544
- C:\Windows\System\hQIRoJW.exe
  C:\Windows\System\hQIRoJW.exe
  2⤵
  PID:6428
- C:\Windows\System\RyFxNEh.exe
  C:\Windows\System\RyFxNEh.exe
  2⤵
  PID:6660
- C:\Windows\System\OcfHqXp.exe
  C:\Windows\System\OcfHqXp.exe
  2⤵
  PID:6704
- C:\Windows\System\EIUfmfK.exe
  C:\Windows\System\EIUfmfK.exe
  2⤵
  PID:6752
- C:\Windows\System\upQxwcv.exe
  C:\Windows\System\upQxwcv.exe
  2⤵
  PID:6808
- C:\Windows\System\sGiUTRc.exe
  C:\Windows\System\sGiUTRc.exe
  2⤵
  PID:6556
- C:\Windows\System\rskKcsn.exe
  C:\Windows\System\rskKcsn.exe
  2⤵
  PID:6520
- C:\Windows\System\neTABqg.exe
  C:\Windows\System\neTABqg.exe
  2⤵
  PID:6864
- C:\Windows\System\YJtcLkq.exe
  C:\Windows\System\YJtcLkq.exe
  2⤵
  PID:6656
- C:\Windows\System\JkdFcCz.exe
  C:\Windows\System\JkdFcCz.exe
  2⤵
  PID:6972
- C:\Windows\System\FMRRmwi.exe
  C:\Windows\System\FMRRmwi.exe
  2⤵
  PID:7004
- C:\Windows\System\pheRmaI.exe
  C:\Windows\System\pheRmaI.exe
  2⤵
  PID:7180
- C:\Windows\System\FKBhSIJ.exe
  C:\Windows\System\FKBhSIJ.exe
  2⤵
  PID:7196
- C:\Windows\System\WyqbOpu.exe
  C:\Windows\System\WyqbOpu.exe
  2⤵
  PID:7216
- C:\Windows\System\mgvCJuv.exe
  C:\Windows\System\mgvCJuv.exe
  2⤵
  PID:7244
- C:\Windows\System\subXiJh.exe
  C:\Windows\System\subXiJh.exe
  2⤵
  PID:7276
- C:\Windows\System\wfKuSoj.exe
  C:\Windows\System\wfKuSoj.exe
  2⤵
  PID:7296
- C:\Windows\System\jbKwglq.exe
  C:\Windows\System\jbKwglq.exe
  2⤵
  PID:7312
- C:\Windows\System\MGukZVk.exe
  C:\Windows\System\MGukZVk.exe
  2⤵
  PID:7332
- C:\Windows\System\ZKkzkPB.exe
  C:\Windows\System\ZKkzkPB.exe
  2⤵
  PID:7352
- C:\Windows\System\ebQdWAV.exe
  C:\Windows\System\ebQdWAV.exe
  2⤵
  PID:7372
- C:\Windows\System\IsCoLgQ.exe
  C:\Windows\System\IsCoLgQ.exe
  2⤵
  PID:7392
- C:\Windows\System\qOwcOiO.exe
  C:\Windows\System\qOwcOiO.exe
  2⤵
  PID:7412
- C:\Windows\System\SEwExfi.exe
  C:\Windows\System\SEwExfi.exe
  2⤵
  PID:7428
- C:\Windows\System\NrtkcnA.exe
  C:\Windows\System\NrtkcnA.exe
  2⤵
  PID:7456
- C:\Windows\System\FBqcekT.exe
  C:\Windows\System\FBqcekT.exe
  2⤵
  PID:7472
- C:\Windows\System\UhITOSq.exe
  C:\Windows\System\UhITOSq.exe
  2⤵
  PID:7492
- C:\Windows\System\wQpLAeG.exe
  C:\Windows\System\wQpLAeG.exe
  2⤵
  PID:7512
- C:\Windows\System\iZXfmAD.exe
  C:\Windows\System\iZXfmAD.exe
  2⤵
  PID:7532
- C:\Windows\System\WTENuYq.exe
  C:\Windows\System\WTENuYq.exe
  2⤵
  PID:7556
- C:\Windows\System\mhGREbq.exe
  C:\Windows\System\mhGREbq.exe
  2⤵
  PID:7576
- C:\Windows\System\YgQUaaD.exe
  C:\Windows\System\YgQUaaD.exe
  2⤵
  PID:7600
- C:\Windows\System\tVpfotA.exe
  C:\Windows\System\tVpfotA.exe
  2⤵
  PID:7620
- C:\Windows\System\dDGSONv.exe
  C:\Windows\System\dDGSONv.exe
  2⤵
  PID:7644
- C:\Windows\System\hJFLgGD.exe
  C:\Windows\System\hJFLgGD.exe
  2⤵
  PID:7660
- C:\Windows\System\jitlZMn.exe
  C:\Windows\System\jitlZMn.exe
  2⤵
  PID:7680
- C:\Windows\System\ApftQKn.exe
  C:\Windows\System\ApftQKn.exe
  2⤵
  PID:7700
- C:\Windows\System\DZnLyIz.exe
  C:\Windows\System\DZnLyIz.exe
  2⤵
  PID:7984
- C:\Windows\System\KIrkosK.exe
  C:\Windows\System\KIrkosK.exe
  2⤵
  PID:8004
- C:\Windows\System\WcOIHEW.exe
  C:\Windows\System\WcOIHEW.exe
  2⤵
  PID:8020
- C:\Windows\System\QMjEomG.exe
  C:\Windows\System\QMjEomG.exe
  2⤵
  PID:8044
- C:\Windows\System\JTfAPMY.exe
  C:\Windows\System\JTfAPMY.exe
  2⤵
  PID:8060
- C:\Windows\System\eQPZLfm.exe
  C:\Windows\System\eQPZLfm.exe
  2⤵
  PID:8084
- C:\Windows\System\heuhRwR.exe
  C:\Windows\System\heuhRwR.exe
  2⤵
  PID:8100
- C:\Windows\System\cjiSLGG.exe
  C:\Windows\System\cjiSLGG.exe
  2⤵
  PID:8124
- C:\Windows\System\NGUDhcW.exe
  C:\Windows\System\NGUDhcW.exe
  2⤵
  PID:8144
- C:\Windows\System\kTRRzdh.exe
  C:\Windows\System\kTRRzdh.exe
  2⤵
  PID:8160
- C:\Windows\System\ZxEkITy.exe
  C:\Windows\System\ZxEkITy.exe
  2⤵
  PID:7112
- C:\Windows\System\VKiOvLi.exe
  C:\Windows\System\VKiOvLi.exe
  2⤵
  PID:6052
- C:\Windows\System\sgPUJHp.exe
  C:\Windows\System\sgPUJHp.exe
  2⤵
  PID:4948
- C:\Windows\System\BjWblnV.exe
  C:\Windows\System\BjWblnV.exe
  2⤵
  PID:6288
- C:\Windows\System\aiCUxZs.exe
  C:\Windows\System\aiCUxZs.exe
  2⤵
  PID:6356
- C:\Windows\System\eALxqWr.exe
  C:\Windows\System\eALxqWr.exe
  2⤵
  PID:6644
- C:\Windows\System\lAnyDzQ.exe
  C:\Windows\System\lAnyDzQ.exe
  2⤵
  PID:6460
- C:\Windows\System\nCbrbYJ.exe
  C:\Windows\System\nCbrbYJ.exe
  2⤵
  PID:7240
- C:\Windows\System\BaArcfF.exe
  C:\Windows\System\BaArcfF.exe
  2⤵
  PID:7288
- C:\Windows\System\NkgjoFK.exe
  C:\Windows\System\NkgjoFK.exe
  2⤵
  PID:7132
- C:\Windows\System\tsXqEJk.exe
  C:\Windows\System\tsXqEJk.exe
  2⤵
  PID:7144
- C:\Windows\System\IKKeerb.exe
  C:\Windows\System\IKKeerb.exe
  2⤵
  PID:7612
- C:\Windows\System\hncKIsy.exe
  C:\Windows\System\hncKIsy.exe
  2⤵
  PID:6344
- C:\Windows\System\SVJGMci.exe
  C:\Windows\System\SVJGMci.exe
  2⤵
  PID:6676
- C:\Windows\System\okVxGFq.exe
  C:\Windows\System\okVxGFq.exe
  2⤵
  PID:6916
- C:\Windows\System\Oqjicfk.exe
  C:\Windows\System\Oqjicfk.exe
  2⤵
  PID:6524
- C:\Windows\System\hFIKNfe.exe
  C:\Windows\System\hFIKNfe.exe
  2⤵
  PID:6996
- C:\Windows\System\FbKmLmB.exe
  C:\Windows\System\FbKmLmB.exe
  2⤵
  PID:8196
- C:\Windows\System\oRJaNvt.exe
  C:\Windows\System\oRJaNvt.exe
  2⤵
  PID:8212
- C:\Windows\System\XetFEGq.exe
  C:\Windows\System\XetFEGq.exe
  2⤵
  PID:8244
- C:\Windows\System\CrCkjqq.exe
  C:\Windows\System\CrCkjqq.exe
  2⤵
  PID:8264
- C:\Windows\System\JwnySMb.exe
  C:\Windows\System\JwnySMb.exe
  2⤵
  PID:8280
- C:\Windows\System\LHclYwc.exe
  C:\Windows\System\LHclYwc.exe
  2⤵
  PID:8296
- C:\Windows\System\OktPGSK.exe
  C:\Windows\System\OktPGSK.exe
  2⤵
  PID:8312
- C:\Windows\System\yBSYuMi.exe
  C:\Windows\System\yBSYuMi.exe
  2⤵
  PID:8332
- C:\Windows\System\uAxrVmI.exe
  C:\Windows\System\uAxrVmI.exe
  2⤵
  PID:8348
- C:\Windows\System\ZsJZJlD.exe
  C:\Windows\System\ZsJZJlD.exe
  2⤵
  PID:8372
- C:\Windows\System\dJTaVuT.exe
  C:\Windows\System\dJTaVuT.exe
  2⤵
  PID:8396
- C:\Windows\System\FRCCAhb.exe
  C:\Windows\System\FRCCAhb.exe
  2⤵
  PID:8416
- C:\Windows\System\qEGJslY.exe
  C:\Windows\System\qEGJslY.exe
  2⤵
  PID:8436
- C:\Windows\System\XIahcgZ.exe
  C:\Windows\System\XIahcgZ.exe
  2⤵
  PID:8460
- C:\Windows\System\lJUTPLW.exe
  C:\Windows\System\lJUTPLW.exe
  2⤵
  PID:8476
- C:\Windows\System\uuHBeuU.exe
  C:\Windows\System\uuHBeuU.exe
  2⤵
  PID:8504
- C:\Windows\System\iHtJaqd.exe
  C:\Windows\System\iHtJaqd.exe
  2⤵
  PID:8528
- C:\Windows\System\ybhAXFP.exe
  C:\Windows\System\ybhAXFP.exe
  2⤵
  PID:8576
- C:\Windows\System\kfGztdF.exe
  C:\Windows\System\kfGztdF.exe
  2⤵
  PID:8600
- C:\Windows\System\XwGgnSa.exe
  C:\Windows\System\XwGgnSa.exe
  2⤵
  PID:8616
- C:\Windows\System\uKtkWmq.exe
  C:\Windows\System\uKtkWmq.exe
  2⤵
  PID:8648
- C:\Windows\System\miOXJYI.exe
  C:\Windows\System\miOXJYI.exe
  2⤵
  PID:8672
- C:\Windows\System\PkCYZrk.exe
  C:\Windows\System\PkCYZrk.exe
  2⤵
  PID:8696
- C:\Windows\System\pUmQyDt.exe
  C:\Windows\System\pUmQyDt.exe
  2⤵
  PID:8716
- C:\Windows\System\ykuuTEq.exe
  C:\Windows\System\ykuuTEq.exe
  2⤵
  PID:8748
- C:\Windows\System\roNMbCV.exe
  C:\Windows\System\roNMbCV.exe
  2⤵
  PID:8764
- C:\Windows\System\pRWEtLJ.exe
  C:\Windows\System\pRWEtLJ.exe
  2⤵
  PID:8780
- C:\Windows\System\EeXbkwB.exe
  C:\Windows\System\EeXbkwB.exe
  2⤵
  PID:8800
- C:\Windows\System\bPDpzDD.exe
  C:\Windows\System\bPDpzDD.exe
  2⤵
  PID:8816
- C:\Windows\System\jQpGepQ.exe
  C:\Windows\System\jQpGepQ.exe
  2⤵
  PID:8832
- C:\Windows\System\rnrNrqd.exe
  C:\Windows\System\rnrNrqd.exe
  2⤵
  PID:8852
- C:\Windows\System\pNulVwg.exe
  C:\Windows\System\pNulVwg.exe
  2⤵
  PID:8872
- C:\Windows\System\XVuKDXf.exe
  C:\Windows\System\XVuKDXf.exe
  2⤵
  PID:8896
- C:\Windows\System\rzenyCk.exe
  C:\Windows\System\rzenyCk.exe
  2⤵
  PID:8916
- C:\Windows\System\WAAViMV.exe
  C:\Windows\System\WAAViMV.exe
  2⤵
  PID:8936
- C:\Windows\System\LFXtxhX.exe
  C:\Windows\System\LFXtxhX.exe
  2⤵
  PID:8956
- C:\Windows\System\BzQcBOi.exe
  C:\Windows\System\BzQcBOi.exe
  2⤵
  PID:8976
- C:\Windows\System\kFZfboY.exe
  C:\Windows\System\kFZfboY.exe
  2⤵
  PID:9000
- C:\Windows\System\BDRiftK.exe
  C:\Windows\System\BDRiftK.exe
  2⤵
  PID:9016
- C:\Windows\System\vMlRtEp.exe
  C:\Windows\System\vMlRtEp.exe
  2⤵
  PID:9040
- C:\Windows\System\fFgwHAu.exe
  C:\Windows\System\fFgwHAu.exe
  2⤵
  PID:9060
- C:\Windows\System\TyFBPvU.exe
  C:\Windows\System\TyFBPvU.exe
  2⤵
  PID:9080
- C:\Windows\System\aRLVlMe.exe
  C:\Windows\System\aRLVlMe.exe
  2⤵
  PID:9096
- C:\Windows\System\eYYPRmW.exe
  C:\Windows\System\eYYPRmW.exe
  2⤵
  PID:9116
- C:\Windows\System\wFLNCRe.exe
  C:\Windows\System\wFLNCRe.exe
  2⤵
  PID:9136
- C:\Windows\System\LLxWByP.exe
  C:\Windows\System\LLxWByP.exe
  2⤵
  PID:9152
- C:\Windows\System\qddxIEY.exe
  C:\Windows\System\qddxIEY.exe
  2⤵
  PID:9172
- C:\Windows\System\AtJFzIt.exe
  C:\Windows\System\AtJFzIt.exe
  2⤵
  PID:9192
- C:\Windows\System\NbwDKHs.exe
  C:\Windows\System\NbwDKHs.exe
  2⤵
  PID:9208
- C:\Windows\System\KWGoJus.exe
  C:\Windows\System\KWGoJus.exe
  2⤵
  PID:7836
- C:\Windows\System\ZSumViL.exe
  C:\Windows\System\ZSumViL.exe
  2⤵
  PID:7872
- C:\Windows\System\XEfoMCp.exe
  C:\Windows\System\XEfoMCp.exe
  2⤵
  PID:7408
- C:\Windows\System\PTqmtnu.exe
  C:\Windows\System\PTqmtnu.exe
  2⤵
  PID:7484
- C:\Windows\System\tiKMgkD.exe
  C:\Windows\System\tiKMgkD.exe
  2⤵
  PID:7592
- C:\Windows\System\ZnGgAoG.exe
  C:\Windows\System\ZnGgAoG.exe
  2⤵
  PID:6300
- C:\Windows\System\QXuLtVC.exe
  C:\Windows\System\QXuLtVC.exe
  2⤵
  PID:5504
- C:\Windows\System\YgLyJJy.exe
  C:\Windows\System\YgLyJJy.exe
  2⤵
  PID:7996
- C:\Windows\System\YHcDgnW.exe
  C:\Windows\System\YHcDgnW.exe
  2⤵
  PID:6876
- C:\Windows\System\PhlpsoJ.exe
  C:\Windows\System\PhlpsoJ.exe
  2⤵
  PID:6580
- C:\Windows\System\yTzyGhn.exe
  C:\Windows\System\yTzyGhn.exe
  2⤵
  PID:436
- C:\Windows\System\CZVcutD.exe
  C:\Windows\System\CZVcutD.exe
  2⤵
  PID:6844
- C:\Windows\System\NPErMyv.exe
  C:\Windows\System\NPErMyv.exe
  2⤵
  PID:7188
- C:\Windows\System\aBjEanL.exe
  C:\Windows\System\aBjEanL.exe
  2⤵
  PID:7024
- C:\Windows\System\QFMYiGZ.exe
  C:\Windows\System\QFMYiGZ.exe
  2⤵
  PID:7224
- C:\Windows\System\KjCcelM.exe
  C:\Windows\System\KjCcelM.exe
  2⤵
  PID:7260
- C:\Windows\System\pWdLSSH.exe
  C:\Windows\System\pWdLSSH.exe
  2⤵
  PID:7824
- C:\Windows\System\EyAHLDJ.exe
  C:\Windows\System\EyAHLDJ.exe
  2⤵
  PID:8356
- C:\Windows\System\KznTjtK.exe
  C:\Windows\System\KznTjtK.exe
  2⤵
  PID:9224
- C:\Windows\System\MGSiJBo.exe
  C:\Windows\System\MGSiJBo.exe
  2⤵
  PID:9244
- C:\Windows\System\fkBDVhJ.exe
  C:\Windows\System\fkBDVhJ.exe
  2⤵
  PID:9260
- C:\Windows\System\llDymbU.exe
  C:\Windows\System\llDymbU.exe
  2⤵
  PID:9280
- C:\Windows\System\bGNRUre.exe
  C:\Windows\System\bGNRUre.exe
  2⤵
  PID:9304
- C:\Windows\System\qLnHFXL.exe
  C:\Windows\System\qLnHFXL.exe
  2⤵
  PID:9320
- C:\Windows\System\VLIAEsi.exe
  C:\Windows\System\VLIAEsi.exe
  2⤵
  PID:9340
- C:\Windows\System\jYooCbe.exe
  C:\Windows\System\jYooCbe.exe
  2⤵
  PID:9360
- C:\Windows\System\jNgAJDS.exe
  C:\Windows\System\jNgAJDS.exe
  2⤵
  PID:9376
- C:\Windows\System\tPXcPus.exe
  C:\Windows\System\tPXcPus.exe
  2⤵
  PID:9396
- C:\Windows\System\VfAIqeU.exe
  C:\Windows\System\VfAIqeU.exe
  2⤵
  PID:9416
- C:\Windows\System\JDLKQLW.exe
  C:\Windows\System\JDLKQLW.exe
  2⤵
  PID:9436
- C:\Windows\System\DNDDbky.exe
  C:\Windows\System\DNDDbky.exe
  2⤵
  PID:9460
- C:\Windows\System\pdhxlvL.exe
  C:\Windows\System\pdhxlvL.exe
  2⤵
  PID:9476
- C:\Windows\System\IKsgLnj.exe
  C:\Windows\System\IKsgLnj.exe
  2⤵
  PID:9496
- C:\Windows\System\zLallVM.exe
  C:\Windows\System\zLallVM.exe
  2⤵
  PID:9516
- C:\Windows\System\DKpLKEP.exe
  C:\Windows\System\DKpLKEP.exe
  2⤵
  PID:9532
- C:\Windows\System\RJfGrgY.exe
  C:\Windows\System\RJfGrgY.exe
  2⤵
  PID:9556
- C:\Windows\System\UYjsWvf.exe
  C:\Windows\System\UYjsWvf.exe
  2⤵
  PID:9576
- C:\Windows\System\WHemLCf.exe
  C:\Windows\System\WHemLCf.exe
  2⤵
  PID:9596
- C:\Windows\System\nbIXDEP.exe
  C:\Windows\System\nbIXDEP.exe
  2⤵
  PID:9612
- C:\Windows\System\ZqyKJrQ.exe
  C:\Windows\System\ZqyKJrQ.exe
  2⤵
  PID:9628
- C:\Windows\System\ZZZfeQi.exe
  C:\Windows\System\ZZZfeQi.exe
  2⤵
  PID:9648
- C:\Windows\System\RnUaKED.exe
  C:\Windows\System\RnUaKED.exe
  2⤵
  PID:9664
- C:\Windows\System\FlzgzMM.exe
  C:\Windows\System\FlzgzMM.exe
  2⤵
  PID:9680
- C:\Windows\System\bRvHGTB.exe
  C:\Windows\System\bRvHGTB.exe
  2⤵
  PID:9700
- C:\Windows\System\Atthxmv.exe
  C:\Windows\System\Atthxmv.exe
  2⤵
  PID:9720
- C:\Windows\System\eiiioAr.exe
  C:\Windows\System\eiiioAr.exe
  2⤵
  PID:9736
- C:\Windows\System\mQrlgbm.exe
  C:\Windows\System\mQrlgbm.exe
  2⤵
  PID:8256
- C:\Windows\System\qamTtnS.exe
  C:\Windows\System\qamTtnS.exe
  2⤵
  PID:9732
- C:\Windows\System\gxuQUrv.exe
  C:\Windows\System\gxuQUrv.exe
  2⤵
  PID:8000
- C:\Windows\System\GmLSmne.exe
  C:\Windows\System\GmLSmne.exe
  2⤵
  PID:8096
- C:\Windows\System\FZPqcNU.exe
  C:\Windows\System\FZPqcNU.exe
  2⤵
  PID:8140
- C:\Windows\System\uYeOKsq.exe
  C:\Windows\System\uYeOKsq.exe
  2⤵
  PID:6212
- C:\Windows\System\nSVMuCA.exe
  C:\Windows\System\nSVMuCA.exe
  2⤵
  PID:9828
- C:\Windows\System\pSluNZb.exe
  C:\Windows\System\pSluNZb.exe
  2⤵
  PID:7008
- C:\Windows\System\kTUlwNq.exe
  C:\Windows\System\kTUlwNq.exe
  2⤵
  PID:7064
- C:\Windows\System\TjngNgi.exe
  C:\Windows\System\TjngNgi.exe
  2⤵
  PID:7344
- C:\Windows\System\kweewGl.exe
  C:\Windows\System\kweewGl.exe
  2⤵
  PID:7672
- C:\Windows\System\WHngsGN.exe
  C:\Windows\System\WHngsGN.exe
  2⤵
  PID:6692
- C:\Windows\System\oCjtoHH.exe
  C:\Windows\System\oCjtoHH.exe
  2⤵
  PID:6804
- C:\Windows\System\jOFgusg.exe
  C:\Windows\System\jOFgusg.exe
  2⤵
  PID:8272
- C:\Windows\System\NhYOfnr.exe
  C:\Windows\System\NhYOfnr.exe
  2⤵
  PID:6740
- C:\Windows\System\wrSOdWc.exe
  C:\Windows\System\wrSOdWc.exe
  2⤵
  PID:8408
- C:\Windows\System\frXpLiS.exe
  C:\Windows\System\frXpLiS.exe
  2⤵
  PID:8496
- C:\Windows\System\PVETNZG.exe
  C:\Windows\System\PVETNZG.exe
  2⤵
  PID:9408
- C:\Windows\System\ceyvVew.exe
  C:\Windows\System\ceyvVew.exe
  2⤵
  PID:9540
- C:\Windows\System\kbGgSID.exe
  C:\Windows\System\kbGgSID.exe
  2⤵
  PID:8660
- C:\Windows\System\BXJWWFi.exe
  C:\Windows\System\BXJWWFi.exe
  2⤵
  PID:8668
- C:\Windows\System\DgGiBWD.exe
  C:\Windows\System\DgGiBWD.exe
  2⤵
  PID:8888
- C:\Windows\System\KkmAdED.exe
  C:\Windows\System\KkmAdED.exe
  2⤵
  PID:8972
- C:\Windows\System\cQLzUCG.exe
  C:\Windows\System\cQLzUCG.exe
  2⤵
  PID:9988
- C:\Windows\System\REESLUE.exe
  C:\Windows\System\REESLUE.exe
  2⤵
  PID:9032
- C:\Windows\System\rAEeIsG.exe
  C:\Windows\System\rAEeIsG.exe
  2⤵
  PID:9128
- C:\Windows\System\nDioVpu.exe
  C:\Windows\System\nDioVpu.exe
  2⤵
  PID:7812
- C:\Windows\System\FrNZndO.exe
  C:\Windows\System\FrNZndO.exe
  2⤵
  PID:7956
- C:\Windows\System\TUwpuRs.exe
  C:\Windows\System\TUwpuRs.exe
  2⤵
  PID:6608
- C:\Windows\System\CwlCdfK.exe
  C:\Windows\System\CwlCdfK.exe
  2⤵
  PID:7256
- C:\Windows\System\DKYPIBc.exe
  C:\Windows\System\DKYPIBc.exe
  2⤵
  PID:9484
- C:\Windows\System\fUZYjCC.exe
  C:\Windows\System\fUZYjCC.exe
  2⤵
  PID:9624
- C:\Windows\System\LPAuUZz.exe
  C:\Windows\System\LPAuUZz.exe
  2⤵
  PID:9452
- C:\Windows\System\cwVrnvL.exe
  C:\Windows\System\cwVrnvL.exe
  2⤵
  PID:9676
- C:\Windows\System\KWKXUGz.exe
  C:\Windows\System\KWKXUGz.exe
  2⤵
  PID:10144
- C:\Windows\System\AKXAAwv.exe
  C:\Windows\System\AKXAAwv.exe
  2⤵
  PID:8948
- C:\Windows\System\irzjNSb.exe
  C:\Windows\System\irzjNSb.exe
  2⤵
  PID:9956
- C:\Windows\System\yaaOlDo.exe
  C:\Windows\System\yaaOlDo.exe
  2⤵
  PID:9976
- C:\Windows\System\xZNPcop.exe
  C:\Windows\System\xZNPcop.exe
  2⤵
  PID:10020
- C:\Windows\System\VOgSmGz.exe
  C:\Windows\System\VOgSmGz.exe
  2⤵
  PID:9884
- C:\Windows\System\TmEJcOc.exe
  C:\Windows\System\TmEJcOc.exe
  2⤵
  PID:7856
- C:\Windows\System\DHYwdOt.exe
  C:\Windows\System\DHYwdOt.exe
  2⤵
  PID:10092
- C:\Windows\System\MwoHnHO.exe
  C:\Windows\System\MwoHnHO.exe
  2⤵
  PID:10100
- C:\Windows\System\UOGRPeL.exe
  C:\Windows\System\UOGRPeL.exe
  2⤵
  PID:8340
- C:\Windows\System\OGtzSTh.exe
  C:\Windows\System\OGtzSTh.exe
  2⤵
  PID:9168
- C:\Windows\System\Yukzjkj.exe
  C:\Windows\System\Yukzjkj.exe
  2⤵
  PID:10132
- C:\Windows\System\EXcNiiO.exe
  C:\Windows\System\EXcNiiO.exe
  2⤵
  PID:9604
- C:\Windows\System\XFzqXSq.exe
  C:\Windows\System\XFzqXSq.exe
  2⤵
  PID:10252
- C:\Windows\System\LyLpZXb.exe
  C:\Windows\System\LyLpZXb.exe
  2⤵
  PID:10272
- C:\Windows\System\RrIfzed.exe
  C:\Windows\System\RrIfzed.exe
  2⤵
  PID:10288
- C:\Windows\System\OcLjMtk.exe
  C:\Windows\System\OcLjMtk.exe
  2⤵
  PID:10308
- C:\Windows\System\GSuHjrc.exe
  C:\Windows\System\GSuHjrc.exe
  2⤵
  PID:10328
- C:\Windows\System\nCLMbpF.exe
  C:\Windows\System\nCLMbpF.exe
  2⤵
  PID:10344
- C:\Windows\System\GGMwyWA.exe
  C:\Windows\System\GGMwyWA.exe
  2⤵
  PID:10360
- C:\Windows\System\kirjCwr.exe
  C:\Windows\System\kirjCwr.exe
  2⤵
  PID:10376
- C:\Windows\System\tmVyFkp.exe
  C:\Windows\System\tmVyFkp.exe
  2⤵
  PID:10396
- C:\Windows\System\kNeaShG.exe
  C:\Windows\System\kNeaShG.exe
  2⤵
  PID:10412
- C:\Windows\System\uUknjhW.exe
  C:\Windows\System\uUknjhW.exe
  2⤵
  PID:10440
- C:\Windows\System\BhYxJTq.exe
  C:\Windows\System\BhYxJTq.exe
  2⤵
  PID:10456
- C:\Windows\System\hMpqHRb.exe
  C:\Windows\System\hMpqHRb.exe
  2⤵
  PID:10484
- C:\Windows\System\rItPWXU.exe
  C:\Windows\System\rItPWXU.exe
  2⤵
  PID:10500
- C:\Windows\System\LZnVZLa.exe
  C:\Windows\System\LZnVZLa.exe
  2⤵
  PID:10520
- C:\Windows\System\HrLVbNq.exe
  C:\Windows\System\HrLVbNq.exe
  2⤵
  PID:10536
- C:\Windows\System\dafARxi.exe
  C:\Windows\System\dafARxi.exe
  2⤵
  PID:10552
- C:\Windows\System\OKFoBTP.exe
  C:\Windows\System\OKFoBTP.exe
  2⤵
  PID:10572
- C:\Windows\System\vrbdSGd.exe
  C:\Windows\System\vrbdSGd.exe
  2⤵
  PID:10596
- C:\Windows\System\MSLJqJM.exe
  C:\Windows\System\MSLJqJM.exe
  2⤵
  PID:10620
- C:\Windows\System\NuWAbKc.exe
  C:\Windows\System\NuWAbKc.exe
  2⤵
  PID:10636
- C:\Windows\System\YZVZvDs.exe
  C:\Windows\System\YZVZvDs.exe
  2⤵
  PID:10652
- C:\Windows\System\aEbcpyB.exe
  C:\Windows\System\aEbcpyB.exe
  2⤵
  PID:10676
- C:\Windows\System\XkbXNfZ.exe
  C:\Windows\System\XkbXNfZ.exe
  2⤵
  PID:10692
- C:\Windows\System\admLCXQ.exe
  C:\Windows\System\admLCXQ.exe
  2⤵
  PID:10708
- C:\Windows\System\kcPNkGB.exe
  C:\Windows\System\kcPNkGB.exe
  2⤵
  PID:10724
- C:\Windows\System\cJdXKDW.exe
  C:\Windows\System\cJdXKDW.exe
  2⤵
  PID:10744
- C:\Windows\System\UNgKxqd.exe
  C:\Windows\System\UNgKxqd.exe
  2⤵
  PID:10768
- C:\Windows\System\lFnfsBV.exe
  C:\Windows\System\lFnfsBV.exe
  2⤵
  PID:10784
- C:\Windows\System\MGtGmuI.exe
  C:\Windows\System\MGtGmuI.exe
  2⤵
  PID:10800
- C:\Windows\System\FySzOEf.exe
  C:\Windows\System\FySzOEf.exe
  2⤵
  PID:10820
- C:\Windows\System\FHZEROo.exe
  C:\Windows\System\FHZEROo.exe
  2⤵
  PID:10860
- C:\Windows\System\cGKFYSk.exe
  C:\Windows\System\cGKFYSk.exe
  2⤵
  PID:10876
- C:\Windows\System\gjlEXpV.exe
  C:\Windows\System\gjlEXpV.exe
  2⤵
  PID:10896
- C:\Windows\System\KTmnHKc.exe
  C:\Windows\System\KTmnHKc.exe
  2⤵
  PID:10916
- C:\Windows\System\NgFjPGf.exe
  C:\Windows\System\NgFjPGf.exe
  2⤵
  PID:10932
- C:\Windows\System\qjuKoIV.exe
  C:\Windows\System\qjuKoIV.exe
  2⤵
  PID:10952
- C:\Windows\System\dvqhPbo.exe
  C:\Windows\System\dvqhPbo.exe
  2⤵
  PID:10968
- C:\Windows\System\SlFKuVr.exe
  C:\Windows\System\SlFKuVr.exe
  2⤵
  PID:10988
- C:\Windows\System\dLZVhPe.exe
  C:\Windows\System\dLZVhPe.exe
  2⤵
  PID:11004
- C:\Windows\System\tSnTfEf.exe
  C:\Windows\System\tSnTfEf.exe
  2⤵
  PID:11020
- C:\Windows\System\uvqsvMN.exe
  C:\Windows\System\uvqsvMN.exe
  2⤵
  PID:11040
- C:\Windows\System\MQOgfaz.exe
  C:\Windows\System\MQOgfaz.exe
  2⤵
  PID:7564
- C:\Windows\System\xWMwDkA.exe
  C:\Windows\System\xWMwDkA.exe
  2⤵
  PID:7212
- C:\Windows\System\FbNLvzp.exe
  C:\Windows\System\FbNLvzp.exe
  2⤵
  PID:8036
- C:\Windows\System\iRPJCPG.exe
  C:\Windows\System\iRPJCPG.exe
  2⤵
  PID:10124
- C:\Windows\System\RdKkRlw.exe
  C:\Windows\System\RdKkRlw.exe
  2⤵
  PID:9744
- C:\Windows\System\yHHEYAF.exe
  C:\Windows\System\yHHEYAF.exe
  2⤵
  PID:10688
- C:\Windows\System\ZIZCTMp.exe
  C:\Windows\System\ZIZCTMp.exe
  2⤵
  PID:8828
- C:\Windows\System\sFQEfVm.exe
  C:\Windows\System\sFQEfVm.exe
  2⤵
  PID:6480
- C:\Windows\System\fltpkLm.exe
  C:\Windows\System\fltpkLm.exe
  2⤵
  PID:7232
- C:\Windows\System\ioykzeV.exe
  C:\Windows\System\ioykzeV.exe
  2⤵
  PID:7324
- C:\Windows\System\PrPhdiy.exe
  C:\Windows\System\PrPhdiy.exe
  2⤵
  PID:11068
- C:\Windows\System\gEodXKT.exe
  C:\Windows\System\gEodXKT.exe
  2⤵
  PID:9112
- C:\Windows\System\sxpajBW.exe
  C:\Windows\System\sxpajBW.exe
  2⤵
  PID:11120
- C:\Windows\System\fLmZOXm.exe
  C:\Windows\System\fLmZOXm.exe
  2⤵
  PID:7816
- C:\Windows\System\fkfItYG.exe
  C:\Windows\System\fkfItYG.exe
  2⤵
  PID:7424
- C:\Windows\System\vVDNUqA.exe
  C:\Windows\System\vVDNUqA.exe
  2⤵
  PID:6640
- C:\Windows\System\RwqgAsr.exe
  C:\Windows\System\RwqgAsr.exe
  2⤵
  PID:10564
- C:\Windows\System\FIjpjoN.exe
  C:\Windows\System\FIjpjoN.exe
  2⤵
  PID:10628
- C:\Windows\System\dXcehtT.exe
  C:\Windows\System\dXcehtT.exe
  2⤵
  PID:10664
- C:\Windows\System\qYUZdhg.exe
  C:\Windows\System\qYUZdhg.exe
  2⤵
  PID:11276
- C:\Windows\System\STORwSU.exe
  C:\Windows\System\STORwSU.exe
  2⤵
  PID:11300
- C:\Windows\System\cvfUaxt.exe
  C:\Windows\System\cvfUaxt.exe
  2⤵
  PID:11320
- C:\Windows\System\ppWcHkC.exe
  C:\Windows\System\ppWcHkC.exe
  2⤵
  PID:11348
- C:\Windows\System\GCbudiZ.exe
  C:\Windows\System\GCbudiZ.exe
  2⤵
  PID:11376
- C:\Windows\System\WxVfZIr.exe
  C:\Windows\System\WxVfZIr.exe
  2⤵
  PID:11396
- C:\Windows\System\KIjaCDE.exe
  C:\Windows\System\KIjaCDE.exe
  2⤵
  PID:11412
- C:\Windows\System\gTOFCYz.exe
  C:\Windows\System\gTOFCYz.exe
  2⤵
  PID:11428
- C:\Windows\System\ZeXygsa.exe
  C:\Windows\System\ZeXygsa.exe
  2⤵
  PID:11448
- C:\Windows\System\vxmyCye.exe
  C:\Windows\System\vxmyCye.exe
  2⤵
  PID:11464
- C:\Windows\System\RtZPBYK.exe
  C:\Windows\System\RtZPBYK.exe
  2⤵
  PID:11484
- C:\Windows\System\OOlPiFk.exe
  C:\Windows\System\OOlPiFk.exe
  2⤵
  PID:11504
- C:\Windows\System\ABEVGXo.exe
  C:\Windows\System\ABEVGXo.exe
  2⤵
  PID:11524
- C:\Windows\System\vrgFLKI.exe
  C:\Windows\System\vrgFLKI.exe
  2⤵
  PID:11552
- C:\Windows\System\hAMkSSz.exe
  C:\Windows\System\hAMkSSz.exe
  2⤵
  PID:11572
- C:\Windows\System\TczDmrp.exe
  C:\Windows\System\TczDmrp.exe
  2⤵
  PID:11596
- C:\Windows\System\HAakTMb.exe
  C:\Windows\System\HAakTMb.exe
  2⤵
  PID:11616
- C:\Windows\System\JMkqGHc.exe
  C:\Windows\System\JMkqGHc.exe
  2⤵
  PID:11636
- C:\Windows\System\KROcsWx.exe
  C:\Windows\System\KROcsWx.exe
  2⤵
  PID:11656
- C:\Windows\System\uDnQRsx.exe
  C:\Windows\System\uDnQRsx.exe
  2⤵
  PID:11672
- C:\Windows\System\RPXwSPq.exe
  C:\Windows\System\RPXwSPq.exe
  2⤵
  PID:11692
- C:\Windows\System\sAOFSkQ.exe
  C:\Windows\System\sAOFSkQ.exe
  2⤵
  PID:11712
- C:\Windows\System\DWjxqQb.exe
  C:\Windows\System\DWjxqQb.exe
  2⤵
  PID:11728
- C:\Windows\System\olxAiqg.exe
  C:\Windows\System\olxAiqg.exe
  2⤵
  PID:11748
- C:\Windows\System\RqyaoEd.exe
  C:\Windows\System\RqyaoEd.exe
  2⤵
  PID:11764
- C:\Windows\System\wSlxpwa.exe
  C:\Windows\System\wSlxpwa.exe
  2⤵
  PID:11780
- C:\Windows\System\IyosjHF.exe
  C:\Windows\System\IyosjHF.exe
  2⤵
  PID:11796
- C:\Windows\System\ghmJCJM.exe
  C:\Windows\System\ghmJCJM.exe
  2⤵
  PID:11812
- C:\Windows\System\DErApQi.exe
  C:\Windows\System\DErApQi.exe
  2⤵
  PID:11836
- C:\Windows\System\LIEjuUn.exe
  C:\Windows\System\LIEjuUn.exe
  2⤵
  PID:11864
- C:\Windows\System\wEmiADz.exe
  C:\Windows\System\wEmiADz.exe
  2⤵
  PID:11892
- C:\Windows\System\zlbFZcU.exe
  C:\Windows\System\zlbFZcU.exe
  2⤵
  PID:11912
- C:\Windows\System\gepwHEx.exe
  C:\Windows\System\gepwHEx.exe
  2⤵
  PID:11932
- C:\Windows\System\WQjJcFp.exe
  C:\Windows\System\WQjJcFp.exe
  2⤵
  PID:11952
- C:\Windows\System\CxNzfBR.exe
  C:\Windows\System\CxNzfBR.exe
  2⤵
  PID:11028
- C:\Windows\System\NdYqjVk.exe
  C:\Windows\System\NdYqjVk.exe
  2⤵
  PID:8208
- C:\Windows\System\VqbLxVS.exe
  C:\Windows\System\VqbLxVS.exe
  2⤵
  PID:7368
- C:\Windows\System\Guymwxy.exe
  C:\Windows\System\Guymwxy.exe
  2⤵
  PID:9236
- C:\Windows\System\VaJZqHT.exe
  C:\Windows\System\VaJZqHT.exe
  2⤵
  PID:9124
- C:\Windows\System\nGfgYIR.exe
  C:\Windows\System\nGfgYIR.exe
  2⤵
  PID:9488
- C:\Windows\System\hvFWHwB.exe
  C:\Windows\System\hvFWHwB.exe
  2⤵
  PID:10320
- C:\Windows\System\RkhxspQ.exe
  C:\Windows\System\RkhxspQ.exe
  2⤵
  PID:10356
- C:\Windows\System\EeuMfsO.exe
  C:\Windows\System\EeuMfsO.exe
  2⤵
  PID:10472
- C:\Windows\System\OEUxJUw.exe
  C:\Windows\System\OEUxJUw.exe
  2⤵
  PID:9292
- C:\Windows\System\atAjnYI.exe
  C:\Windows\System\atAjnYI.exe
  2⤵
  PID:10672
- C:\Windows\System\aBjLmaL.exe
  C:\Windows\System\aBjLmaL.exe
  2⤵
  PID:10736
- C:\Windows\System\bcNAGwR.exe
  C:\Windows\System\bcNAGwR.exe
  2⤵
  PID:8392
- C:\Windows\System\ZCpWIiu.exe
  C:\Windows\System\ZCpWIiu.exe
  2⤵
  PID:9688
- C:\Windows\System\WTxuxLz.exe
  C:\Windows\System\WTxuxLz.exe
  2⤵
  PID:11284
- C:\Windows\System\zZelWYr.exe
  C:\Windows\System\zZelWYr.exe
  2⤵
  PID:11496
- C:\Windows\System\CDIrzQu.exe
  C:\Windows\System\CDIrzQu.exe
  2⤵
  PID:11612
- C:\Windows\System\UpwliVI.exe
  C:\Windows\System\UpwliVI.exe
  2⤵
  PID:10892
- C:\Windows\System\lUkxLiQ.exe
  C:\Windows\System\lUkxLiQ.exe
  2⤵
  PID:11888
- C:\Windows\System\jrrTQKJ.exe
  C:\Windows\System\jrrTQKJ.exe
  2⤵
  PID:10964
- C:\Windows\System\cZfzXre.exe
  C:\Windows\System\cZfzXre.exe
  2⤵
  PID:11844
- C:\Windows\System\lomSgYz.exe
  C:\Windows\System\lomSgYz.exe
  2⤵
  PID:12312
- C:\Windows\System\vlrJYww.exe
  C:\Windows\System\vlrJYww.exe
  2⤵
  PID:12328
- C:\Windows\System\YbBBBIS.exe
  C:\Windows\System\YbBBBIS.exe
  2⤵
  PID:12356
- C:\Windows\System\zGNIgoH.exe
  C:\Windows\System\zGNIgoH.exe
  2⤵
  PID:12376
- C:\Windows\System\qCEDLRI.exe
  C:\Windows\System\qCEDLRI.exe
  2⤵
  PID:12400
- C:\Windows\System\euLwiKP.exe
  C:\Windows\System\euLwiKP.exe
  2⤵
  PID:12416
- C:\Windows\System\gZTUKVC.exe
  C:\Windows\System\gZTUKVC.exe
  2⤵
  PID:12432
- C:\Windows\System\GuvHtku.exe
  C:\Windows\System\GuvHtku.exe
  2⤵
  PID:12448
- C:\Windows\System\lraOVgU.exe
  C:\Windows\System\lraOVgU.exe
  2⤵
  PID:12464
- C:\Windows\System\nWlIgHQ.exe
  C:\Windows\System\nWlIgHQ.exe
  2⤵
  PID:12480
- C:\Windows\System\LibnvhH.exe
  C:\Windows\System\LibnvhH.exe
  2⤵
  PID:12500
- C:\Windows\System\uIPsUyw.exe
  C:\Windows\System\uIPsUyw.exe
  2⤵
  PID:12516
- C:\Windows\System\JwDMRMq.exe
  C:\Windows\System\JwDMRMq.exe
  2⤵
  PID:12532
- C:\Windows\System\RUXbNil.exe
  C:\Windows\System\RUXbNil.exe
  2⤵
  PID:12552
- C:\Windows\System\pUAUBxZ.exe
  C:\Windows\System\pUAUBxZ.exe
  2⤵
  PID:12572
- C:\Windows\System\uuCtCOi.exe
  C:\Windows\System\uuCtCOi.exe
  2⤵
  PID:12596
- C:\Windows\System\UcrbuDY.exe
  C:\Windows\System\UcrbuDY.exe
  2⤵
  PID:12612
- C:\Windows\System\UWoykqw.exe
  C:\Windows\System\UWoykqw.exe
  2⤵
  PID:12636
- C:\Windows\System\XQrDCCr.exe
  C:\Windows\System\XQrDCCr.exe
  2⤵
  PID:12652
- C:\Windows\System\vJxxLLi.exe
  C:\Windows\System\vJxxLLi.exe
  2⤵
  PID:12684
- C:\Windows\System\MXIuVQT.exe
  C:\Windows\System\MXIuVQT.exe
  2⤵
  PID:12700
- C:\Windows\System\cdnvPeI.exe
  C:\Windows\System\cdnvPeI.exe
  2⤵
  PID:12724
- C:\Windows\System\ZzuBLtf.exe
  C:\Windows\System\ZzuBLtf.exe
  2⤵
  PID:12740
- C:\Windows\System\Ltcxoyy.exe
  C:\Windows\System\Ltcxoyy.exe
  2⤵
  PID:12768
- C:\Windows\System\EiKziqN.exe
  C:\Windows\System\EiKziqN.exe
  2⤵
  PID:12788
- C:\Windows\System\LIsaUYy.exe
  C:\Windows\System\LIsaUYy.exe
  2⤵
  PID:12808
- C:\Windows\System\jFYLDFV.exe
  C:\Windows\System\jFYLDFV.exe
  2⤵
  PID:12832
- C:\Windows\System\bBgXpOI.exe
  C:\Windows\System\bBgXpOI.exe
  2⤵
  PID:12848
- C:\Windows\System\wIAeYOZ.exe
  C:\Windows\System\wIAeYOZ.exe
  2⤵
  PID:12872
- C:\Windows\System\vCaPBAy.exe
  C:\Windows\System\vCaPBAy.exe
  2⤵
  PID:12896
- C:\Windows\System\zHoLdxw.exe
  C:\Windows\System\zHoLdxw.exe
  2⤵
  PID:12916
- C:\Windows\System\REMQWPc.exe
  C:\Windows\System\REMQWPc.exe
  2⤵
  PID:12944
- C:\Windows\System\pHxtdbf.exe
  C:\Windows\System\pHxtdbf.exe
  2⤵
  PID:12964
- C:\Windows\System\agYcZMJ.exe
  C:\Windows\System\agYcZMJ.exe
  2⤵
  PID:12984
- C:\Windows\System\yDreifd.exe
  C:\Windows\System\yDreifd.exe
  2⤵
  PID:13008
- C:\Windows\System\eRCWEFq.exe
  C:\Windows\System\eRCWEFq.exe
  2⤵
  PID:13024
- C:\Windows\System\DywiShl.exe
  C:\Windows\System\DywiShl.exe
  2⤵
  PID:13048
- C:\Windows\System\ebajHXq.exe
  C:\Windows\System\ebajHXq.exe
  2⤵
  PID:13064
- C:\Windows\System\lntjIDj.exe
  C:\Windows\System\lntjIDj.exe
  2⤵
  PID:11900
- C:\Windows\System\EMKNNQD.exe
  C:\Windows\System\EMKNNQD.exe
  2⤵
  PID:12912
- C:\Windows\System\OLmvplK.exe
  C:\Windows\System\OLmvplK.exe
  2⤵
  PID:8808
- C:\Windows\System\WtSZqLv.exe
  C:\Windows\System\WtSZqLv.exe
  2⤵
  PID:1168
- C:\Windows\System\TSaEumP.exe
  C:\Windows\System\TSaEumP.exe
  2⤵
  PID:10960
- C:\Windows\System\XZmfpEj.exe
  C:\Windows\System\XZmfpEj.exe
  2⤵
  PID:12100
- C:\Windows\System\oDfCKkr.exe
  C:\Windows\System\oDfCKkr.exe
  2⤵
  PID:12148
- C:\Windows\System\nwDrCUN.exe
  C:\Windows\System\nwDrCUN.exe
  2⤵
  PID:8308
- C:\Windows\System\MjFWxyV.exe
  C:\Windows\System\MjFWxyV.exe
  2⤵
  PID:10928
- C:\Windows\System\GTEZrBU.exe
  C:\Windows\System\GTEZrBU.exe
  2⤵
  PID:10316
- C:\Windows\System\zAhisSL.exe
  C:\Windows\System\zAhisSL.exe
  2⤵
  PID:11944
- C:\Windows\System\GzIbiiS.exe
  C:\Windows\System\GzIbiiS.exe
  2⤵
  PID:12676
- C:\Windows\System\HNVxUUT.exe
  C:\Windows\System\HNVxUUT.exe
  2⤵
  PID:12716
- C:\Windows\System\nWomUaf.exe
  C:\Windows\System\nWomUaf.exe
  2⤵
  PID:12748
- C:\Windows\System\AfuLPHn.exe
  C:\Windows\System\AfuLPHn.exe
  2⤵
  PID:12764
- C:\Windows\System\OdzTQbS.exe
  C:\Windows\System\OdzTQbS.exe
  2⤵
  PID:12864
- C:\Windows\System\gyDzcbu.exe
  C:\Windows\System\gyDzcbu.exe
  2⤵
  PID:10248
- C:\Windows\System\yDFWIYg.exe
  C:\Windows\System\yDFWIYg.exe
  2⤵
  PID:8608
- C:\Windows\System\EPzcsDs.exe
  C:\Windows\System\EPzcsDs.exe
  2⤵
  PID:12456
- C:\Windows\System\Krmghby.exe
  C:\Windows\System\Krmghby.exe
  2⤵
  PID:12736
- C:\Windows\System\CfOKAPl.exe
  C:\Windows\System\CfOKAPl.exe
  2⤵
  PID:13000
- C:\Windows\System\qylrtlv.exe
  C:\Windows\System\qylrtlv.exe
  2⤵
  PID:13296
- C:\Windows\System\THZxZaj.exe
  C:\Windows\System\THZxZaj.exe
  2⤵
  PID:7780
- C:\Windows\System\pijsDVp.exe
  C:\Windows\System\pijsDVp.exe
  2⤵
  PID:11960
- C:\Windows\System\ZlNJsbl.exe
  C:\Windows\System\ZlNJsbl.exe
  2⤵
  PID:11608
- C:\Windows\System\wYyMSbg.exe
  C:\Windows\System\wYyMSbg.exe
  2⤵
  PID:13140
- C:\Windows\System\CfdLIPh.exe
  C:\Windows\System\CfdLIPh.exe
  2⤵
  PID:8772
- C:\Windows\System\eXJUHhZ.exe
  C:\Windows\System\eXJUHhZ.exe
  2⤵
  PID:9316
- C:\Windows\System\gzMwddJ.exe
  C:\Windows\System\gzMwddJ.exe
  2⤵
  PID:12800
- C:\Windows\System\KJGccVD.exe
  C:\Windows\System\KJGccVD.exe
  2⤵
  PID:13248
- C:\Windows\System\MdXQqEI.exe
  C:\Windows\System\MdXQqEI.exe
  2⤵
  PID:10392
- C:\Windows\System\QsrxkoJ.exe
  C:\Windows\System\QsrxkoJ.exe
  2⤵
  PID:10548
- C:\Windows\System\fICAkwF.exe
  C:\Windows\System\fICAkwF.exe
  2⤵
  PID:11876
- C:\Windows\System\PGOGBMk.exe
  C:\Windows\System\PGOGBMk.exe
  2⤵
  PID:9944
- C:\Windows\System\sgtHRUY.exe
  C:\Windows\System\sgtHRUY.exe
  2⤵
  PID:11492
- C:\Windows\System\WaycXLW.exe
  C:\Windows\System\WaycXLW.exe
  2⤵
  PID:11328
- C:\Windows\System\ANesntL.exe
  C:\Windows\System\ANesntL.exe
  2⤵
  PID:13160
- C:\Windows\System\UyzJGXu.exe
  C:\Windows\System\UyzJGXu.exe
  2⤵
  PID:13220
- C:\Windows\System\ouScBbu.exe
  C:\Windows\System\ouScBbu.exe
  2⤵
  PID:13200
- C:\Windows\System\gSxUeto.exe
  C:\Windows\System\gSxUeto.exe
  2⤵
  PID:10612
- C:\Windows\System\XyygnAl.exe
  C:\Windows\System\XyygnAl.exe
  2⤵
  PID:12172
- C:\Windows\System\nGZSEyq.exe
  C:\Windows\System\nGZSEyq.exe
  2⤵
  PID:6892
- C:\Windows\System\ToqSnDC.exe
  C:\Windows\System\ToqSnDC.exe
  2⤵
  PID:11724
- C:\Windows\System\BPcnbiW.exe
  C:\Windows\System\BPcnbiW.exe
  2⤵
  PID:7636
- C:\Windows\System\fFNRRoZ.exe
  C:\Windows\System\fFNRRoZ.exe
  2⤵
  PID:10408
- C:\Windows\System\wQJDFXV.exe
  C:\Windows\System\wQJDFXV.exe
  2⤵
  PID:5232
- C:\Windows\System\zYLHsnf.exe
  C:\Windows\System\zYLHsnf.exe
  2⤵
  PID:11364
- C:\Windows\System\CkZQzDh.exe
  C:\Windows\System\CkZQzDh.exe
  2⤵
  PID:10424
- C:\Windows\System\zGnIxeg.exe
  C:\Windows\System\zGnIxeg.exe
  2⤵
  PID:13184
- C:\Windows\System\CnrJYjs.exe
  C:\Windows\System\CnrJYjs.exe
  2⤵
  PID:1540
- C:\Windows\System\xQzcmcU.exe
  C:\Windows\System\xQzcmcU.exe
  2⤵
  PID:12204
- C:\Windows\System\jfCIcKj.exe
  C:\Windows\System\jfCIcKj.exe
  2⤵
  PID:4596
- C:\Windows\System\zNeNNPI.exe
  C:\Windows\System\zNeNNPI.exe
  2⤵
  PID:13192
- C:\Windows\System\IJBVsJo.exe
  C:\Windows\System\IJBVsJo.exe
  2⤵
  PID:12476
- C:\Windows\System\cjkrlhN.exe
  C:\Windows\System\cjkrlhN.exe
  2⤵
  PID:13124
- C:\Windows\System\ZGNZTqv.exe
  C:\Windows\System\ZGNZTqv.exe
  2⤵
  PID:13280
- C:\Windows\System\kIFVAqU.exe
  C:\Windows\System\kIFVAqU.exe
  2⤵
  PID:12292
- C:\Windows\System\TwrGRmM.exe
  C:\Windows\System\TwrGRmM.exe
  2⤵
  PID:6756
- C:\Windows\System\BRqEaiI.exe
  C:\Windows\System\BRqEaiI.exe
  2⤵
  PID:9276
- C:\Windows\System\YaELxgi.exe
  C:\Windows\System\YaELxgi.exe
  2⤵
  PID:1992
- C:\Windows\System\VMDELrW.exe
  C:\Windows\System\VMDELrW.exe
  2⤵
  PID:9960
- C:\Windows\System\vmbEyBe.exe
  C:\Windows\System\vmbEyBe.exe
  2⤵
  PID:4572
- C:\Windows\System\dHNLepX.exe
  C:\Windows\System\dHNLepX.exe
  2⤵
  PID:11268
- C:\Windows\System\zirjkMI.exe
  C:\Windows\System\zirjkMI.exe
  2⤵
  PID:2272
- C:\Windows\System\JnyJitj.exe
  C:\Windows\System\JnyJitj.exe
  2⤵
  PID:13320
- C:\Windows\System\CoWSDXt.exe
  C:\Windows\System\CoWSDXt.exe
  2⤵
  PID:13336
- C:\Windows\System\EHzrrxf.exe
  C:\Windows\System\EHzrrxf.exe
  2⤵
  PID:13352
- C:\Windows\System\acyjfVu.exe
  C:\Windows\System\acyjfVu.exe
  2⤵
  PID:13368
- C:\Windows\System\kSeuNJs.exe
  C:\Windows\System\kSeuNJs.exe
  2⤵
  PID:13416
- C:\Windows\System\JwAtxxp.exe
  C:\Windows\System\JwAtxxp.exe
  2⤵
  PID:13452
- C:\Windows\System\ZiZydMq.exe
  C:\Windows\System\ZiZydMq.exe
  2⤵
  PID:13468
- C:\Windows\System\wGAbSul.exe
  C:\Windows\System\wGAbSul.exe
  2⤵
  PID:13484
- C:\Windows\System\dLBCppe.exe
  C:\Windows\System\dLBCppe.exe
  2⤵
  PID:13500
- C:\Windows\System\MLLlejJ.exe
  C:\Windows\System\MLLlejJ.exe
  2⤵
  PID:13612
- C:\Windows\System\Dgiuuwj.exe
  C:\Windows\System\Dgiuuwj.exe
  2⤵
  PID:13640
- C:\Windows\System\EbYpsYx.exe
  C:\Windows\System\EbYpsYx.exe
  2⤵
  PID:13660
- C:\Windows\System\yyuqNww.exe
  C:\Windows\System\yyuqNww.exe
  2⤵
  PID:13676
- C:\Windows\System\YRDFDoJ.exe
  C:\Windows\System\YRDFDoJ.exe
  2⤵
  PID:13692
- C:\Windows\System\aRitAwp.exe
  C:\Windows\System\aRitAwp.exe
  2⤵
  PID:13708
- C:\Windows\System\rpUQnqV.exe
  C:\Windows\System\rpUQnqV.exe
  2⤵
  PID:13728
- C:\Windows\System\tqzvNZq.exe
  C:\Windows\System\tqzvNZq.exe
  2⤵
  PID:13752
- C:\Windows\System\SfNQcMr.exe
  C:\Windows\System\SfNQcMr.exe
  2⤵
  PID:13768
- C:\Windows\System\DALHdPh.exe
  C:\Windows\System\DALHdPh.exe
  2⤵
  PID:13788
- C:\Windows\System\VgweFdj.exe
  C:\Windows\System\VgweFdj.exe
  2⤵
  PID:13808
- C:\Windows\System\EqnhHmk.exe
  C:\Windows\System\EqnhHmk.exe
  2⤵
  PID:14020
- C:\Windows\System\KUtzTKX.exe
  C:\Windows\System\KUtzTKX.exe
  2⤵
  PID:14040
- C:\Windows\System\YLPaOUP.exe
  C:\Windows\System\YLPaOUP.exe
  2⤵
  PID:14068
- C:\Windows\System\smAOkcx.exe
  C:\Windows\System\smAOkcx.exe
  2⤵
  PID:14084
- C:\Windows\System\eAaPYNl.exe
  C:\Windows\System\eAaPYNl.exe
  2⤵
  PID:14128
- C:\Windows\System\GlMdyEJ.exe
  C:\Windows\System\GlMdyEJ.exe
  2⤵
  PID:14148
- C:\Windows\System\vpxBQBl.exe
  C:\Windows\System\vpxBQBl.exe
  2⤵
  PID:14164
- C:\Windows\System\JTrksmQ.exe
  C:\Windows\System\JTrksmQ.exe
  2⤵
  PID:14192
- C:\Windows\System\lXbAFxS.exe
  C:\Windows\System\lXbAFxS.exe
  2⤵
  PID:14232
- C:\Windows\System\LHHxqfw.exe
  C:\Windows\System\LHHxqfw.exe
  2⤵
  PID:14248
- C:\Windows\System\JudhEJV.exe
  C:\Windows\System\JudhEJV.exe
  2⤵
  PID:14264
- C:\Windows\System\pIKpycc.exe
  C:\Windows\System\pIKpycc.exe
  2⤵
  PID:14280
- C:\Windows\System\IIvgzUj.exe
  C:\Windows\System\IIvgzUj.exe
  2⤵
  PID:14304
- C:\Windows\System\aIrLBjK.exe
  C:\Windows\System\aIrLBjK.exe
  2⤵
  PID:5076
- C:\Windows\System\kTJsVta.exe
  C:\Windows\System\kTJsVta.exe
  2⤵
  PID:6060
- C:\Windows\System\XMETVAI.exe
  C:\Windows\System\XMETVAI.exe
  2⤵
  PID:3404
- C:\Windows\System\mZQmFPb.exe
  C:\Windows\System\mZQmFPb.exe
  2⤵
  PID:13360
- C:\Windows\System\asZROsw.exe
  C:\Windows\System\asZROsw.exe
  2⤵
  PID:13448
- C:\Windows\System\lraeMvF.exe
  C:\Windows\System\lraeMvF.exe
  2⤵
  PID:4220
- C:\Windows\System\SRUVYME.exe
  C:\Windows\System\SRUVYME.exe
  2⤵
  PID:2176
- C:\Windows\System\xbgnljv.exe
  C:\Windows\System\xbgnljv.exe
  2⤵
  PID:13332
- C:\Windows\System\MCtBsMF.exe
  C:\Windows\System\MCtBsMF.exe
  2⤵
  PID:9088
- C:\Windows\System\ZFrwcHc.exe
  C:\Windows\System\ZFrwcHc.exe
  2⤵
  PID:1812
- C:\Windows\System\tUnNHxB.exe
  C:\Windows\System\tUnNHxB.exe
  2⤵
  PID:3620
- C:\Windows\System\sgxrhGG.exe
  C:\Windows\System\sgxrhGG.exe
  2⤵
  PID:13556
- C:\Windows\System\XkmgxOp.exe
  C:\Windows\System\XkmgxOp.exe
  2⤵
  PID:5560
- C:\Windows\System\PwMkkgH.exe
  C:\Windows\System\PwMkkgH.exe
  2⤵
  PID:4656
- C:\Windows\System\quGhvKI.exe
  C:\Windows\System\quGhvKI.exe
  2⤵
  PID:13700
- C:\Windows\System\sndyowa.exe
  C:\Windows\System\sndyowa.exe
  2⤵
  PID:13780
- C:\Windows\System\lLsIQIg.exe
  C:\Windows\System\lLsIQIg.exe
  2⤵
  PID:13576
- C:\Windows\System\PlrzkNL.exe
  C:\Windows\System\PlrzkNL.exe
  2⤵
  PID:13520
- C:\Windows\System\hKckCvz.exe
  C:\Windows\System\hKckCvz.exe
  2⤵
  PID:13300
- C:\Windows\System\dyMczyy.exe
  C:\Windows\System\dyMczyy.exe
  2⤵
  PID:4044
- C:\Windows\System\ZrqaMFL.exe
  C:\Windows\System\ZrqaMFL.exe
  2⤵
  PID:14032
- C:\Windows\System\OpsdVhy.exe
  C:\Windows\System\OpsdVhy.exe
  2⤵
  PID:13632
- C:\Windows\System\BFWfjnR.exe
  C:\Windows\System\BFWfjnR.exe
  2⤵
  PID:13720
- C:\Windows\System\qWxhuuu.exe
  C:\Windows\System\qWxhuuu.exe
  2⤵
  PID:5260
- C:\Windows\System\CEjXEwk.exe
  C:\Windows\System\CEjXEwk.exe
  2⤵
  PID:5228
- C:\Windows\System\gePGXNJ.exe
  C:\Windows\System\gePGXNJ.exe
  2⤵
  PID:13836
- C:\Windows\System\VxdVthx.exe
  C:\Windows\System\VxdVthx.exe
  2⤵
  PID:14188
- C:\Windows\System\piXEIOF.exe
  C:\Windows\System\piXEIOF.exe
  2⤵
  PID:4580
- C:\Windows\System\OIxNXhd.exe
  C:\Windows\System\OIxNXhd.exe
  2⤵
  PID:4436
- C:\Windows\System\TrtGstZ.exe
  C:\Windows\System\TrtGstZ.exe
  2⤵
  PID:13548
- C:\Windows\System\uUzTsxi.exe
  C:\Windows\System\uUzTsxi.exe
  2⤵
  PID:4676
- C:\Windows\System\tqUJCOQ.exe
  C:\Windows\System\tqUJCOQ.exe
  2⤵
  PID:4856
- C:\Windows\System\XFoXqdJ.exe
  C:\Windows\System\XFoXqdJ.exe
  2⤵
  PID:648
- C:\Windows\System\dPBtKaf.exe
  C:\Windows\System\dPBtKaf.exe
  2⤵
  PID:13620
- C:\Windows\System\LZKkZTR.exe
  C:\Windows\System\LZKkZTR.exe
  2⤵
  PID:13896
- C:\Windows\System\YcaooTg.exe
  C:\Windows\System\YcaooTg.exe
  2⤵
  PID:4472
- C:\Windows\System\qiSNgEh.exe
  C:\Windows\System\qiSNgEh.exe
  2⤵
  PID:13740
- C:\Windows\System\GDirKgj.exe
  C:\Windows\System\GDirKgj.exe
  2⤵
  PID:3828
- C:\Windows\System\jWToWqP.exe
  C:\Windows\System\jWToWqP.exe
  2⤵
  PID:13948
- C:\Windows\System\ZaFGwuw.exe
  C:\Windows\System\ZaFGwuw.exe
  2⤵
  PID:5184
- C:\Windows\System\tEubQVg.exe
  C:\Windows\System\tEubQVg.exe
  2⤵
  PID:14292
- C:\Windows\System\ODouElA.exe
  C:\Windows\System\ODouElA.exe
  2⤵
  PID:5216
- C:\Windows\System\ZSqYpyh.exe
  C:\Windows\System\ZSqYpyh.exe
  2⤵
  PID:3804
- C:\Windows\System\okKngcY.exe
  C:\Windows\System\okKngcY.exe
  2⤵
  PID:13900
- C:\Windows\System\iVBbtkn.exe
  C:\Windows\System\iVBbtkn.exe
  2⤵
  PID:4420
- C:\Windows\System\uOlvgvy.exe
  C:\Windows\System\uOlvgvy.exe
  2⤵
  PID:5384
- C:\Windows\System\goEVmkh.exe
  C:\Windows\System\goEVmkh.exe
  2⤵
  PID:14228
- C:\Windows\System\HayopwM.exe
  C:\Windows\System\HayopwM.exe
  2⤵
  PID:14136
- C:\Windows\System\RaaVWYL.exe
  C:\Windows\System\RaaVWYL.exe
  2⤵
  PID:4672
- C:\Windows\System\LgHBGDl.exe
  C:\Windows\System\LgHBGDl.exe
  2⤵
  PID:5276
- C:\Windows\System\aMRyOEM.exe
  C:\Windows\System\aMRyOEM.exe
  2⤵
  PID:5364
- C:\Windows\System\zNaCNcZ.exe
  C:\Windows\System\zNaCNcZ.exe
  2⤵
  PID:13424
- C:\Windows\System\ybVAnfC.exe
  C:\Windows\System\ybVAnfC.exe
  2⤵
  PID:2900
- C:\Windows\System\tQCBMjG.exe
  C:\Windows\System\tQCBMjG.exe
  2⤵
  PID:4240
- C:\Windows\System\rzhLuCK.exe
  C:\Windows\System\rzhLuCK.exe
  2⤵
  PID:5840
- C:\Windows\System\TUsElSx.exe
  C:\Windows\System\TUsElSx.exe
  2⤵
  PID:5584
- C:\Windows\System\PGBOcia.exe
  C:\Windows\System\PGBOcia.exe
  2⤵
  PID:5012
- C:\Windows\System\vBVnJRV.exe
  C:\Windows\System\vBVnJRV.exe
  2⤵
  PID:4484
- C:\Windows\System\LkUiGBS.exe
  C:\Windows\System\LkUiGBS.exe
  2⤵
  PID:5488
- C:\Windows\System\IfucVCp.exe
  C:\Windows\System\IfucVCp.exe
  2⤵
  PID:5480
- C:\Windows\System\gFWjUtL.exe
  C:\Windows\System\gFWjUtL.exe
  2⤵
  PID:4944
- C:\Windows\System\KFMcJuq.exe
  C:\Windows\System\KFMcJuq.exe
  2⤵
  PID:4060
- C:\Windows\System\lFwEPoC.exe
  C:\Windows\System\lFwEPoC.exe
  2⤵
  PID:5920
- C:\Windows\System\VGdDnAZ.exe
  C:\Windows\System\VGdDnAZ.exe
  2⤵
  PID:5060
- C:\Windows\System\fAtsYCD.exe
  C:\Windows\System\fAtsYCD.exe
  2⤵
  PID:13536
- C:\Windows\System\XDTIvTG.exe
  C:\Windows\System\XDTIvTG.exe
  2⤵
  PID:6140
- C:\Windows\System\JUVVCSP.exe
  C:\Windows\System\JUVVCSP.exe
  2⤵
  PID:14012
- C:\Windows\System\DqtFtpQ.exe
  C:\Windows\System\DqtFtpQ.exe
  2⤵
  PID:2156
- C:\Windows\System\EmgEOjN.exe
  C:\Windows\System\EmgEOjN.exe
  2⤵
  PID:13668
- C:\Windows\System\RTKDblG.exe
  C:\Windows\System\RTKDblG.exe
  2⤵
  PID:5448
- C:\Windows\System\BpTxAab.exe
  C:\Windows\System\BpTxAab.exe
  2⤵
  PID:6080
- C:\Windows\System\lQNOERC.exe
  C:\Windows\System\lQNOERC.exe
  2⤵
  PID:11532
- C:\Windows\System\wpDqmjr.exe
  C:\Windows\System\wpDqmjr.exe
  2⤵
  PID:6024
- C:\Windows\System\scxvjrp.exe
  C:\Windows\System\scxvjrp.exe
  2⤵
  PID:5424
- C:\Windows\System\bGbxxYR.exe
  C:\Windows\System\bGbxxYR.exe
  2⤵
  PID:2784
- C:\Windows\System\CjLYINZ.exe
  C:\Windows\System\CjLYINZ.exe
  2⤵
  PID:2432
- C:\Windows\System\twMiOdD.exe
  C:\Windows\System\twMiOdD.exe
  2⤵
  PID:2932
- C:\Windows\System\zWnNGZw.exe
  C:\Windows\System\zWnNGZw.exe
  2⤵
  PID:3556
- C:\Windows\System\qGotlSe.exe
  C:\Windows\System\qGotlSe.exe
  2⤵
  PID:14092
- C:\Windows\System\fsySOYd.exe
  C:\Windows\System\fsySOYd.exe
  2⤵
  PID:13604
- C:\Windows\System\TRYZdXc.exe
  C:\Windows\System\TRYZdXc.exe
  2⤵
  PID:5464
- C:\Windows\System\JEzNOjz.exe
  C:\Windows\System\JEzNOjz.exe
  2⤵
  PID:14172
- C:\Windows\System\rNJfLWj.exe
  C:\Windows\System\rNJfLWj.exe
  2⤵
  PID:1624
- C:\Windows\System\obnUEGh.exe
  C:\Windows\System\obnUEGh.exe
  2⤵
  PID:1460
- C:\Windows\System\TGjUzFQ.exe
  C:\Windows\System\TGjUzFQ.exe
  2⤵
  PID:4156
- C:\Windows\System\xHcTmIv.exe
  C:\Windows\System\xHcTmIv.exe
  2⤵
  PID:2332
- C:\Windows\System\CoGsLoX.exe
  C:\Windows\System\CoGsLoX.exe
  2⤵
  PID:5752
- C:\Windows\System\VwrsRdx.exe
  C:\Windows\System\VwrsRdx.exe
  2⤵
  PID:5968
- C:\Windows\System\zKbXLry.exe
  C:\Windows\System\zKbXLry.exe
  2⤵
  PID:3052
- C:\Windows\System\qujMIhj.exe
  C:\Windows\System\qujMIhj.exe
  2⤵
  PID:5916
- C:\Windows\System\sgDyXWo.exe
  C:\Windows\System\sgDyXWo.exe
  2⤵
  PID:5848
- C:\Windows\System\pvHQSoz.exe
  C:\Windows\System\pvHQSoz.exe
  2⤵
  PID:13636
- C:\Windows\System\SQNuGTD.exe
  C:\Windows\System\SQNuGTD.exe
  2⤵
  PID:10660
- C:\Windows\System\wpAjJjb.exe
  C:\Windows\System\wpAjJjb.exe
  2⤵
  PID:804
- C:\Windows\System\jBgfOOC.exe
  C:\Windows\System\jBgfOOC.exe
  2⤵
  PID:4388
- C:\Windows\System\CqklgIM.exe
  C:\Windows\System\CqklgIM.exe
  2⤵
  PID:6000
- C:\Windows\System\CnFduZC.exe
  C:\Windows\System\CnFduZC.exe
  2⤵
  PID:5880
- C:\Windows\System\VHQynqx.exe
  C:\Windows\System\VHQynqx.exe
  2⤵
  PID:6276
- C:\Windows\System\vFPFqPS.exe
  C:\Windows\System\vFPFqPS.exe
  2⤵
  PID:5728
- C:\Windows\System\CTxEOcE.exe
  C:\Windows\System\CTxEOcE.exe
  2⤵
  PID:3480
- C:\Windows\System\QTVpOCl.exe
  C:\Windows\System\QTVpOCl.exe
  2⤵
  PID:13552
- C:\Windows\System\SSrjozl.exe
  C:\Windows\System\SSrjozl.exe
  2⤵
  PID:4380
- C:\Windows\System\ajLeLgh.exe
  C:\Windows\System\ajLeLgh.exe
  2⤵
  PID:13016
- C:\Windows\System\mJjdrqn.exe
  C:\Windows\System\mJjdrqn.exe
  2⤵
  PID:764
- C:\Windows\System\vFAAQtl.exe
  C:\Windows\System\vFAAQtl.exe
  2⤵
  PID:2408
- C:\Windows\System\CtGbJBq.exe
  C:\Windows\System\CtGbJBq.exe
  2⤵
  PID:14000
- C:\Windows\System\YriGCkz.exe
  C:\Windows\System\YriGCkz.exe
  2⤵
  PID:14272
- C:\Windows\System\GhJdwhe.exe
  C:\Windows\System\GhJdwhe.exe
  2⤵
  PID:4356
- C:\Windows\System\ZFIJane.exe
  C:\Windows\System\ZFIJane.exe
  2⤵
  PID:5996
- C:\Windows\System\IjldsfL.exe
  C:\Windows\System\IjldsfL.exe
  2⤵
  PID:1008
- C:\Windows\System\NxkXvXA.exe
  C:\Windows\System\NxkXvXA.exe
  2⤵
  PID:5928
- C:\Windows\System\HFAQhWP.exe
  C:\Windows\System\HFAQhWP.exe
  2⤵
  PID:5980
- C:\Windows\System\iUgrzaA.exe
  C:\Windows\System\iUgrzaA.exe
  2⤵
  PID:14340
- C:\Windows\System\JrpMPJC.exe
  C:\Windows\System\JrpMPJC.exe
  2⤵
  PID:14360
- C:\Windows\System\yMZLQmu.exe
  C:\Windows\System\yMZLQmu.exe
  2⤵
  PID:14380
- C:\Windows\System\XRBejrj.exe
  C:\Windows\System\XRBejrj.exe
  2⤵
  PID:14400
- C:\Windows\System\raclkLu.exe
  C:\Windows\System\raclkLu.exe
  2⤵
  PID:14420
- C:\Windows\System\FLpPyHw.exe
  C:\Windows\System\FLpPyHw.exe
  2⤵
  PID:14444
- C:\Windows\System\zJSEPgP.exe
  C:\Windows\System\zJSEPgP.exe
  2⤵
  PID:14468
- C:\Windows\System\POnoJLP.exe
  C:\Windows\System\POnoJLP.exe
  2⤵
  PID:14492
- C:\Windows\System\FWEUXdb.exe
  C:\Windows\System\FWEUXdb.exe
  2⤵
  PID:14520
- C:\Windows\System\hPdOUrs.exe
  C:\Windows\System\hPdOUrs.exe
  2⤵
  PID:14540
- C:\Windows\System\ZNwdJNu.exe
  C:\Windows\System\ZNwdJNu.exe
  2⤵
  PID:14564
- C:\Windows\System\rboLxvR.exe
  C:\Windows\System\rboLxvR.exe
  2⤵
  PID:14604
- C:\Windows\System\pgMwKmH.exe
  C:\Windows\System\pgMwKmH.exe
  2⤵
  PID:14644
- C:\Windows\System\ZVTkWWl.exe
  C:\Windows\System\ZVTkWWl.exe
  2⤵
  PID:14660
- C:\Windows\System\wKWysVE.exe
  C:\Windows\System\wKWysVE.exe
  2⤵
  PID:14680
- C:\Windows\System\RvlndOU.exe
  C:\Windows\System\RvlndOU.exe
  2⤵
  PID:14696
- C:\Windows\System\DquLNNj.exe
  C:\Windows\System\DquLNNj.exe
  2⤵
  PID:14712
- C:\Windows\System\PQAzaZb.exe
  C:\Windows\System\PQAzaZb.exe
  2⤵
  PID:14740
- C:\Windows\System\rRSmfvy.exe
  C:\Windows\System\rRSmfvy.exe
  2⤵
  PID:14760
- C:\Windows\System\SLitomW.exe
  C:\Windows\System\SLitomW.exe
  2⤵
  PID:14940
- C:\Windows\System\ZIEzOrE.exe
  C:\Windows\System\ZIEzOrE.exe
  2⤵
  PID:14956
- C:\Windows\System\mcQrSQE.exe
  C:\Windows\System\mcQrSQE.exe
  2⤵
  PID:14972
- C:\Windows\System\POpcvWZ.exe
  C:\Windows\System\POpcvWZ.exe
  2⤵
  PID:14988
- C:\Windows\System\KluwTEa.exe
  C:\Windows\System\KluwTEa.exe
  2⤵
  PID:15004
- C:\Windows\System\MkcVcoZ.exe
  C:\Windows\System\MkcVcoZ.exe
  2⤵
  PID:15032
- C:\Windows\System\duIZZSN.exe
  C:\Windows\System\duIZZSN.exe
  2⤵
  PID:15048
- C:\Windows\System\NkHFGMY.exe
  C:\Windows\System\NkHFGMY.exe
  2⤵
  PID:15064
- C:\Windows\System\HFwmYCq.exe
  C:\Windows\System\HFwmYCq.exe
  2⤵
  PID:14980
- C:\Windows\System\VLrHVwZ.exe
  C:\Windows\System\VLrHVwZ.exe
  2⤵
  PID:15044
- C:\Windows\System\qZIVzaB.exe
  C:\Windows\System\qZIVzaB.exe
  2⤵
  PID:14812
- C:\Windows\System\RLnpkbf.exe
  C:\Windows\System\RLnpkbf.exe
  2⤵
  PID:14840
- C:\Windows\System\FmarBuD.exe
  C:\Windows\System\FmarBuD.exe
  2⤵
  PID:7500
- C:\Windows\System\qjpJigB.exe
  C:\Windows\System\qjpJigB.exe
  2⤵
  PID:14368
- C:\Windows\System\FJDpyrn.exe
  C:\Windows\System\FJDpyrn.exe
  2⤵
  PID:14900
- C:\Windows\System\aNHbwVv.exe
  C:\Windows\System\aNHbwVv.exe
  2⤵
  PID:7728
- C:\Windows\System\tWSpHbC.exe
  C:\Windows\System\tWSpHbC.exe
  2⤵
  PID:15140
- C:\Windows\System\CeGBuhf.exe
  C:\Windows\System\CeGBuhf.exe
  2⤵
  PID:15160
- C:\Windows\System\eRQHbKg.exe
  C:\Windows\System\eRQHbKg.exe
  2⤵
  PID:14984
- C:\Windows\System\VehDZEc.exe
  C:\Windows\System\VehDZEc.exe
  2⤵
  PID:7860
- C:\Windows\System\szgFIOn.exe
  C:\Windows\System\szgFIOn.exe
  2⤵
  PID:15336
- C:\Windows\System\renLMtZ.exe
  C:\Windows\System\renLMtZ.exe
  2⤵
  PID:15088
- C:\Windows\System\ttulPVA.exe
  C:\Windows\System\ttulPVA.exe
  2⤵
  PID:15280
- C:\Windows\System\kMzzFGf.exe
  C:\Windows\System\kMzzFGf.exe
  2⤵
  PID:15276
- C:\Windows\System\zJroOvW.exe
  C:\Windows\System\zJroOvW.exe
  2⤵
  PID:15356
- C:\Windows\System\NPMosbb.exe
  C:\Windows\System\NPMosbb.exe
  2⤵
  PID:4548
- C:\Windows\System\clTLZEi.exe
  C:\Windows\System\clTLZEi.exe
  2⤵
  PID:8240
- C:\Windows\System\HbYGUTe.exe
  C:\Windows\System\HbYGUTe.exe
  2⤵
  PID:14616
- C:\Windows\System\epgXuEA.exe
  C:\Windows\System\epgXuEA.exe
  2⤵
  PID:3020
- C:\Windows\System\tNyaTno.exe
  C:\Windows\System\tNyaTno.exe
  2⤵
  PID:6216
- C:\Windows\System\IUjWchp.exe
  C:\Windows\System\IUjWchp.exe
  2⤵
  PID:7360
- C:\Windows\System\RQiVruS.exe
  C:\Windows\System\RQiVruS.exe
  2⤵
  PID:5264
- C:\Windows\System\MoqqsLK.exe
  C:\Windows\System\MoqqsLK.exe
  2⤵
  PID:8072
- C:\Windows\System\EPgVwdi.exe
  C:\Windows\System\EPgVwdi.exe
  2⤵
  PID:14612
- C:\Windows\System\RVQKHxY.exe
  C:\Windows\System\RVQKHxY.exe
  2⤵
  PID:7688
- C:\Windows\System\WPdtmFd.exe
  C:\Windows\System\WPdtmFd.exe
  2⤵
  PID:5484
- C:\Windows\System\zvhyYfz.exe
  C:\Windows\System\zvhyYfz.exe
  2⤵
  PID:9056
- C:\Windows\System\dLOqTEm.exe
  C:\Windows\System\dLOqTEm.exe
  2⤵
  PID:14140
- C:\Windows\System\boqnSzk.exe
  C:\Windows\System\boqnSzk.exe
  2⤵
  PID:8180
- C:\Windows\System\pGGOzun.exe
  C:\Windows\System\pGGOzun.exe
  2⤵
  PID:15144
- C:\Windows\System\eyWcbNz.exe
  C:\Windows\System\eyWcbNz.exe
  2⤵
  PID:5508
- C:\Windows\System\zNrtUvk.exe
  C:\Windows\System\zNrtUvk.exe
  2⤵
  PID:15232
- C:\Windows\System\vDkVKhk.exe
  C:\Windows\System\vDkVKhk.exe
  2⤵
  PID:6496
- C:\Windows\System\kTDbVeC.exe
  C:\Windows\System\kTDbVeC.exe
  2⤵
  PID:9820
- C:\Windows\System\cFubHVk.exe
  C:\Windows\System\cFubHVk.exe
  2⤵
  PID:9788
- C:\Windows\System\ByOqxJO.exe
  C:\Windows\System\ByOqxJO.exe
  2⤵
  PID:9424
- C:\Windows\System\wxoHvth.exe
  C:\Windows\System\wxoHvth.exe
  2⤵
  PID:9980
- C:\Windows\System\WOnjkXJ.exe
  C:\Windows\System\WOnjkXJ.exe
  2⤵
  PID:9504
- C:\Windows\System\qmsVQQj.exe
  C:\Windows\System\qmsVQQj.exe
  2⤵
  PID:14864
- C:\Windows\System\UkYJAXX.exe
  C:\Windows\System\UkYJAXX.exe
  2⤵
  PID:14528
- C:\Windows\System\WsRFfVo.exe
  C:\Windows\System\WsRFfVo.exe
  2⤵
  PID:15300
- C:\Windows\System\FCdSprS.exe
  C:\Windows\System\FCdSprS.exe
  2⤵
  PID:15248
- C:\Windows\System\auBZFhn.exe
  C:\Windows\System\auBZFhn.exe
  2⤵
  PID:7480
- C:\Windows\System\dujMCea.exe
  C:\Windows\System\dujMCea.exe
  2⤵
  PID:9768
- C:\Windows\System\pfshePO.exe
  C:\Windows\System\pfshePO.exe
  2⤵
  PID:9608
- C:\Windows\System\UDbjFRo.exe
  C:\Windows\System\UDbjFRo.exe
  2⤵
  PID:7272
- C:\Windows\System\VvsPDEe.exe
  C:\Windows\System\VvsPDEe.exe
  2⤵
  PID:7252
- C:\Windows\System\faIpQEe.exe
  C:\Windows\System\faIpQEe.exe
  2⤵
  PID:7784
- C:\Windows\System\rVXSUfe.exe
  C:\Windows\System\rVXSUfe.exe
  2⤵
  PID:10076
- C:\Windows\System\qXVRPIC.exe
  C:\Windows\System\qXVRPIC.exe
  2⤵
  PID:9104
- C:\Windows\System\lxioWJe.exe
  C:\Windows\System\lxioWJe.exe
  2⤵
  PID:9036
- C:\Windows\System\RXUxyry.exe
  C:\Windows\System\RXUxyry.exe
  2⤵
  PID:6768
- C:\Windows\System\vtIcTmg.exe
  C:\Windows\System\vtIcTmg.exe
  2⤵
  PID:8736
- C:\Windows\System\MWNvhGa.exe
  C:\Windows\System\MWNvhGa.exe
  2⤵
  PID:9880
- C:\Windows\System\TtoWAJn.exe
  C:\Windows\System\TtoWAJn.exe
  2⤵
  PID:7596
- C:\Windows\System\yZljWBQ.exe
  C:\Windows\System\yZljWBQ.exe
  2⤵
  PID:7932
- C:\Windows\System\HJhZXqS.exe
  C:\Windows\System\HJhZXqS.exe
  2⤵
  PID:10120
- C:\Windows\System\qVfpskZ.exe
  C:\Windows\System\qVfpskZ.exe
  2⤵
  PID:11128
- C:\Windows\System\soypDps.exe
  C:\Windows\System\soypDps.exe
  2⤵
  PID:7052
- C:\Windows\System\MYHvxyr.exe
  C:\Windows\System\MYHvxyr.exe
  2⤵
  PID:11168
- C:\Windows\System\NMEnhDp.exe
  C:\Windows\System\NMEnhDp.exe
  2⤵
  PID:6340
- C:\Windows\System\jKybAap.exe
  C:\Windows\System\jKybAap.exe
  2⤵
  PID:15080
- C:\Windows\System\LgByFfp.exe
  C:\Windows\System\LgByFfp.exe
  2⤵
  PID:10296
- C:\Windows\System\QAjBBJb.exe
  C:\Windows\System\QAjBBJb.exe
  2⤵
  PID:8172
- C:\Windows\System\NDebppC.exe
  C:\Windows\System\NDebppC.exe
  2⤵
  PID:8656
- C:\Windows\System\TwBpUxc.exe
  C:\Windows\System\TwBpUxc.exe
  2⤵
  PID:15204
- C:\Windows\System\uvYKMdL.exe
  C:\Windows\System\uvYKMdL.exe
  2⤵
  PID:10428
- C:\Windows\System\dFvPjMQ.exe
  C:\Windows\System\dFvPjMQ.exe
  2⤵
  PID:10884
- C:\Windows\System\MBGURNd.exe
  C:\Windows\System\MBGURNd.exe
  2⤵
  PID:11224
- C:\Windows\System\yaOyaet.exe
  C:\Windows\System\yaOyaet.exe
  2⤵
  PID:8776
- C:\Windows\System\pCZccKf.exe
  C:\Windows\System\pCZccKf.exe
  2⤵
  PID:10268
- C:\Windows\System\WCtpYdZ.exe
  C:\Windows\System\WCtpYdZ.exe
  2⤵
  PID:15176
- C:\Windows\System\kuAbEiU.exe
  C:\Windows\System\kuAbEiU.exe
  2⤵
  PID:15092
- C:\Windows\System\DgKcDbU.exe
  C:\Windows\System\DgKcDbU.exe
  2⤵
  PID:11092
- C:\Windows\System\JntvdRP.exe
  C:\Windows\System\JntvdRP.exe
  2⤵
  PID:7968
- C:\Windows\System\QyPhOcv.exe
  C:\Windows\System\QyPhOcv.exe
  2⤵
  PID:10028
- C:\Windows\System\udJeXbH.exe
  C:\Windows\System\udJeXbH.exe
  2⤵
  PID:14788
- C:\Windows\System\yFJJoVM.exe
  C:\Windows\System\yFJJoVM.exe
  2⤵
  PID:10080
- C:\Windows\System\MfnEJiM.exe
  C:\Windows\System\MfnEJiM.exe
  2⤵
  PID:9356
- C:\Windows\System\GNLnljI.exe
  C:\Windows\System\GNLnljI.exe
  2⤵
  PID:11196
- C:\Windows\System\JNPtlYj.exe
  C:\Windows\System\JNPtlYj.exe
  2⤵
  PID:10604
- C:\Windows\System\XOuQTpa.exe
  C:\Windows\System\XOuQTpa.exe
  2⤵
  PID:10128
- C:\Windows\System\VQmjggI.exe
  C:\Windows\System\VQmjggI.exe
  2⤵
  PID:10040
- C:\Windows\System\umXDmgq.exe
  C:\Windows\System\umXDmgq.exe
  2⤵
  PID:7920
- C:\Windows\System\gsIfFvW.exe
  C:\Windows\System\gsIfFvW.exe
  2⤵
  PID:7308
- C:\Windows\System\icLAPZP.exe
  C:\Windows\System\icLAPZP.exe
  2⤵
  PID:9932
- C:\Windows\System\RWHQhXZ.exe
  C:\Windows\System\RWHQhXZ.exe
  2⤵
  PID:11368
- C:\Windows\System\EaukLTm.exe
  C:\Windows\System\EaukLTm.exe
  2⤵
  PID:8188
- C:\Windows\System\xSESweR.exe
  C:\Windows\System\xSESweR.exe
  2⤵
  PID:12176
- C:\Windows\System\jPPxoVu.exe
  C:\Windows\System\jPPxoVu.exe
  2⤵
  PID:12200
- C:\Windows\System\ycFVPJm.exe
  C:\Windows\System\ycFVPJm.exe
  2⤵
  PID:7792
- C:\Windows\System\CdJxOTy.exe
  C:\Windows\System\CdJxOTy.exe
  2⤵
  PID:7776
- C:\Windows\System\zWCBAMj.exe
  C:\Windows\System\zWCBAMj.exe
  2⤵
  PID:12272
- C:\Windows\System\qjrdlPt.exe
  C:\Windows\System\qjrdlPt.exe
  2⤵
  PID:12276
- C:\Windows\System\eCPlSQH.exe
  C:\Windows\System\eCPlSQH.exe
  2⤵
  PID:11332
- C:\Windows\System\XKuDsox.exe
  C:\Windows\System\XKuDsox.exe
  2⤵
  PID:10192
- C:\Windows\System\ktWAiRD.exe
  C:\Windows\System\ktWAiRD.exe
  2⤵
  PID:3712
- C:\Windows\System\cJKRhSw.exe
  C:\Windows\System\cJKRhSw.exe
  2⤵
  PID:8056
- C:\Windows\System\PsBLJrz.exe
  C:\Windows\System\PsBLJrz.exe
  2⤵
  PID:9028
- C:\Windows\System\JBTMkCC.exe
  C:\Windows\System\JBTMkCC.exe
  2⤵
  PID:9900
- C:\Windows\System\IQWCcUP.exe
  C:\Windows\System\IQWCcUP.exe
  2⤵
  PID:11512
- C:\Windows\System\qXWoZNU.exe
  C:\Windows\System\qXWoZNU.exe
  2⤵
  PID:7400
- C:\Windows\System\CkdTZuK.exe
  C:\Windows\System\CkdTZuK.exe
  2⤵
  PID:7964
- C:\Windows\System\KIpeKdi.exe
  C:\Windows\System\KIpeKdi.exe
  2⤵
  PID:9072
- C:\Windows\System\zjvctcD.exe
  C:\Windows\System\zjvctcD.exe
  2⤵
  PID:12012
- C:\Windows\System\MXdblzN.exe
  C:\Windows\System\MXdblzN.exe
  2⤵
  PID:9712
- C:\Windows\System\ryBiUtW.exe
  C:\Windows\System\ryBiUtW.exe
  2⤵
  PID:9584
- C:\Windows\System\ptWcYvn.exe
  C:\Windows\System\ptWcYvn.exe
  2⤵
  PID:12132
- C:\Windows\System\oxhIeqX.exe
  C:\Windows\System\oxhIeqX.exe
  2⤵
  PID:12076
- C:\Windows\System\KSivQfM.exe
  C:\Windows\System\KSivQfM.exe
  2⤵
  PID:4832
- C:\Windows\System\EVwTkcA.exe
  C:\Windows\System\EVwTkcA.exe
  2⤵
  PID:4600
- C:\Windows\System\cvukiQH.exe
  C:\Windows\System\cvukiQH.exe
  2⤵
  PID:12256
- C:\Windows\System\edIFaso.exe
  C:\Windows\System\edIFaso.exe
  2⤵
  PID:11216
- C:\Windows\System\MvAZiXo.exe
  C:\Windows\System\MvAZiXo.exe
  2⤵
  PID:7568
- C:\Windows\System\KpUODyc.exe
  C:\Windows\System\KpUODyc.exe
  2⤵
  PID:8884
- C:\Windows\System\zYpSbdk.exe
  C:\Windows\System\zYpSbdk.exe
  2⤵
  PID:10012
- C:\Windows\System\TMwsSMI.exe
  C:\Windows\System\TMwsSMI.exe
  2⤵
  PID:7584
- C:\Windows\System\TGWOIus.exe
  C:\Windows\System\TGWOIus.exe
  2⤵
  PID:12192
- C:\Windows\System\rRLGOgl.exe
  C:\Windows\System\rRLGOgl.exe
  2⤵
  PID:11228
- C:\Windows\System\FBLQcNR.exe
  C:\Windows\System\FBLQcNR.exe
  2⤵
  PID:12496
- C:\Windows\System\LEHBFbZ.exe
  C:\Windows\System\LEHBFbZ.exe
  2⤵
  PID:15200
- C:\Windows\System\QYnNwwx.exe
  C:\Windows\System\QYnNwwx.exe
  2⤵
  PID:11256
- C:\Windows\System\bQcXXUu.exe
  C:\Windows\System\bQcXXUu.exe
  2⤵
  PID:8288
- C:\Windows\System\VwQtksG.exe
  C:\Windows\System\VwQtksG.exe
  2⤵
  PID:10168
- C:\Windows\System\nDYLfaK.exe
  C:\Windows\System\nDYLfaK.exe
  2⤵
  PID:14576
- C:\Windows\System\HJOUazi.exe
  C:\Windows\System\HJOUazi.exe
  2⤵
  PID:8860
- C:\Windows\System\YzKEbfB.exe
  C:\Windows\System\YzKEbfB.exe
  2⤵
  PID:9852
- C:\Windows\System\IMliTGM.exe
  C:\Windows\System\IMliTGM.exe
  2⤵
  PID:12904
- C:\Windows\System\IInjUuO.exe
  C:\Windows\System\IInjUuO.exe
  2⤵
  PID:10704
- C:\Windows\System\ajVpguk.exe
  C:\Windows\System\ajVpguk.exe
  2⤵
  PID:4768
- C:\Windows\System\ULPvqVL.exe
  C:\Windows\System\ULPvqVL.exe
  2⤵
  PID:8224
- C:\Windows\System\bckFxKY.exe
  C:\Windows\System\bckFxKY.exe
  2⤵
  PID:14848
- C:\Windows\System\nrzLLEP.exe
  C:\Windows\System\nrzLLEP.exe
  2⤵
  PID:14352
- C:\Windows\System\ATMbNdJ.exe
  C:\Windows\System\ATMbNdJ.exe
  2⤵
  PID:11972
- C:\Windows\System\kagAVTh.exe
  C:\Windows\System\kagAVTh.exe
  2⤵
  PID:6416
- C:\Windows\System\fjLohlO.exe
  C:\Windows\System\fjLohlO.exe
  2⤵
  PID:12664
- C:\Windows\System\bPcovPS.exe
  C:\Windows\System\bPcovPS.exe
  2⤵
  PID:7832
- C:\Windows\System\yzQUBze.exe
  C:\Windows\System\yzQUBze.exe
  2⤵
  PID:4792
- C:\Windows\System\LugEitm.exe
  C:\Windows\System\LugEitm.exe
  2⤵
  PID:12796
- C:\Windows\System\YCcrYAG.exe
  C:\Windows\System\YCcrYAG.exe
  2⤵
  PID:12208
- C:\Windows\System\oIzyqUC.exe
  C:\Windows\System\oIzyqUC.exe
  2⤵
  PID:15028
- C:\Windows\System\XueVPeX.exe
  C:\Windows\System\XueVPeX.exe
  2⤵
  PID:14484
- C:\Windows\System\khfpBer.exe
  C:\Windows\System\khfpBer.exe
  2⤵
  PID:10232
- C:\Windows\System\LZHMFEM.exe
  C:\Windows\System\LZHMFEM.exe
  2⤵
  PID:14676
- C:\Windows\System\JOcxeXy.exe
  C:\Windows\System\JOcxeXy.exe
  2⤵
  PID:1964
- C:\Windows\System\QCttxfL.exe
  C:\Windows\System\QCttxfL.exe
  2⤵
  PID:9696
- C:\Windows\System\ZBxiEvQ.exe
  C:\Windows\System\ZBxiEvQ.exe
  2⤵
  PID:11172
- C:\Windows\System\RYYECvx.exe
  C:\Windows\System\RYYECvx.exe
  2⤵
  PID:12024
- C:\Windows\System\BDbTpNH.exe
  C:\Windows\System\BDbTpNH.exe
  2⤵
  PID:11116
- C:\Windows\System\ecMdwOK.exe
  C:\Windows\System\ecMdwOK.exe
  2⤵
  PID:9588
- C:\Windows\System\IcjacdK.exe
  C:\Windows\System\IcjacdK.exe
  2⤵
  PID:12044
- C:\Windows\System\FLxjhVZ.exe
  C:\Windows\System\FLxjhVZ.exe
  2⤵
  PID:9564
- C:\Windows\System\gfjgdmP.exe
  C:\Windows\System\gfjgdmP.exe
  2⤵
  PID:7632
- C:\Windows\System\dJSYhax.exe
  C:\Windows\System\dJSYhax.exe
  2⤵
  PID:7508
- C:\Windows\System\RXuyVIU.exe
  C:\Windows\System\RXuyVIU.exe
  2⤵
  PID:12048
- C:\Windows\System\LMLyNIk.exe
  C:\Windows\System\LMLyNIk.exe
  2⤵
  PID:8080
- C:\Windows\System\nXrbulC.exe
  C:\Windows\System\nXrbulC.exe
  2⤵
  PID:14888
- C:\Windows\System\ZolMcGg.exe
  C:\Windows\System\ZolMcGg.exe
  2⤵
  PID:11272
- C:\Windows\System\NZgbuMQ.exe
  C:\Windows\System\NZgbuMQ.exe
  2⤵
  PID:11384
- C:\Windows\System\zkDQwZP.exe
  C:\Windows\System\zkDQwZP.exe
  2⤵
  PID:8500
- C:\Windows\System\EqHJPvX.exe
  C:\Windows\System\EqHJPvX.exe
  2⤵
  PID:12252
- C:\Windows\System\NpfWwqi.exe
  C:\Windows\System\NpfWwqi.exe
  2⤵
  PID:6012
- C:\Windows\System\XUeSmIU.exe
  C:\Windows\System\XUeSmIU.exe
  2⤵
  PID:11180
- C:\Windows\System\AnBPFlS.exe
  C:\Windows\System\AnBPFlS.exe
  2⤵
  PID:8076
- C:\Windows\System\HdZkzXt.exe
  C:\Windows\System\HdZkzXt.exe
  2⤵
  PID:12668
- C:\Windows\System\GYsFSSc.exe
  C:\Windows\System\GYsFSSc.exe
  2⤵
  PID:9952
- C:\Windows\System\MWxqyqL.exe
  C:\Windows\System\MWxqyqL.exe
  2⤵
  PID:11140
- C:\Windows\System\pKHWufZ.exe
  C:\Windows\System\pKHWufZ.exe
  2⤵
  PID:12492
- C:\Windows\System\GuwEbEY.exe
  C:\Windows\System\GuwEbEY.exe
  2⤵
  PID:10912
- C:\Windows\System\LOaKzKg.exe
  C:\Windows\System\LOaKzKg.exe
  2⤵
  PID:12580
- C:\Windows\System\VDKvyNJ.exe
  C:\Windows\System\VDKvyNJ.exe
  2⤵
  PID:13148
- C:\Windows\System\gTUBqTV.exe
  C:\Windows\System\gTUBqTV.exe
  2⤵
  PID:6828
- C:\Windows\System\gNLJTlI.exe
  C:\Windows\System\gNLJTlI.exe
  2⤵
  PID:9092
- C:\Windows\System\mahJoDu.exe
  C:\Windows\System\mahJoDu.exe
  2⤵
  PID:11456
- C:\Windows\System\QHARfOx.exe
  C:\Windows\System\QHARfOx.exe
  2⤵
  PID:10088
- C:\Windows\System\BHBxvhv.exe
  C:\Windows\System\BHBxvhv.exe
  2⤵
  PID:12544
- C:\Windows\System\HCAZZYc.exe
  C:\Windows\System\HCAZZYc.exe
  2⤵
  PID:11848
- C:\Windows\System\AZYwDPS.exe
  C:\Windows\System\AZYwDPS.exe
  2⤵
  PID:13056
- C:\Windows\System\grQvDQe.exe
  C:\Windows\System\grQvDQe.exe
  2⤵
  PID:11820
- C:\Windows\System\cKRJeSd.exe
  C:\Windows\System\cKRJeSd.exe
  2⤵
  PID:11804
- C:\Windows\System\giejeOR.exe
  C:\Windows\System\giejeOR.exe
  2⤵
  PID:12628
- C:\Windows\System\IejfPMk.exe
  C:\Windows\System\IejfPMk.exe
  2⤵
  PID:11860
- C:\Windows\System\qNlUBlM.exe
  C:\Windows\System\qNlUBlM.exe
  2⤵
  PID:11704
- C:\Windows\System\kDzYBqm.exe
  C:\Windows\System\kDzYBqm.exe
  2⤵
  PID:12348
- C:\Windows\System\IjcZOez.exe
  C:\Windows\System\IjcZOez.exe
  2⤵
  PID:12368
- C:\Windows\System\KlhzeFI.exe
  C:\Windows\System\KlhzeFI.exe
  2⤵
  PID:2744
- C:\Windows\System\HeAJvbY.exe
  C:\Windows\System\HeAJvbY.exe
  2⤵
  PID:10404
- C:\Windows\System\pswYnQW.exe
  C:\Windows\System\pswYnQW.exe
  2⤵
  PID:12540
- C:\Windows\System\dJGCUtz.exe
  C:\Windows\System\dJGCUtz.exe
  2⤵
  PID:13080
- C:\Windows\System\KRJuhdk.exe
  C:\Windows\System\KRJuhdk.exe
  2⤵
  PID:11560
- C:\Windows\System\limrhcP.exe
  C:\Windows\System\limrhcP.exe
  2⤵
  PID:10764
- C:\Windows\System\ZWRDXsZ.exe
  C:\Windows\System\ZWRDXsZ.exe
  2⤵
  PID:11680
- C:\Windows\System\puFJLJb.exe
  C:\Windows\System\puFJLJb.exe
  2⤵
  PID:11740
- C:\Windows\System\moLLWkk.exe
  C:\Windows\System\moLLWkk.exe
  2⤵
  PID:12372
- C:\Windows\System\KAIYqRP.exe
  C:\Windows\System\KAIYqRP.exe
  2⤵
  PID:12028
- C:\Windows\System\TPCNzmy.exe
  C:\Windows\System\TPCNzmy.exe
  2⤵
  PID:11112
- C:\Windows\System\fvBRffM.exe
  C:\Windows\System\fvBRffM.exe
  2⤵
  PID:8344
- C:\Windows\System\dYKxAHS.exe
  C:\Windows\System\dYKxAHS.exe
  2⤵
  PID:3288
- C:\Windows\System\pOSOKfh.exe
  C:\Windows\System\pOSOKfh.exe
  2⤵
  PID:10848
- C:\Windows\System\gOKORtL.exe
  C:\Windows\System\gOKORtL.exe
  2⤵
  PID:12584
- C:\Windows\System\SkXzKLa.exe
  C:\Windows\System\SkXzKLa.exe
  2⤵
  PID:1696
- C:\Windows\System\NFsnpSp.exe
  C:\Windows\System\NFsnpSp.exe
  2⤵
  PID:12672
- C:\Windows\System\WqAjxdt.exe
  C:\Windows\System\WqAjxdt.exe
  2⤵
  PID:12512
- C:\Windows\System\GfcLnLb.exe
  C:\Windows\System\GfcLnLb.exe
  2⤵
  PID:11632
- C:\Windows\System\mqulTNE.exe
  C:\Windows\System\mqulTNE.exe
  2⤵
  PID:6848
- C:\Windows\System\OwLlbxn.exe
  C:\Windows\System\OwLlbxn.exe
  2⤵
  PID:5744
- C:\Windows\System\mUPntWh.exe
  C:\Windows\System\mUPntWh.exe
  2⤵
  PID:11736
- C:\Windows\System\IcNqPkY.exe
  C:\Windows\System\IcNqPkY.exe
  2⤵
  PID:15372
- C:\Windows\System\cnYZzPb.exe
  C:\Windows\System\cnYZzPb.exe
  2⤵
  PID:15388
- C:\Windows\System\alrFhBe.exe
  C:\Windows\System\alrFhBe.exe
  2⤵
  PID:15404
- C:\Windows\System\xVtNrbP.exe
  C:\Windows\System\xVtNrbP.exe
  2⤵
  PID:15420
- C:\Windows\System\XSQPDpi.exe
  C:\Windows\System\XSQPDpi.exe
  2⤵
  PID:15440
- C:\Windows\System\iPgFLrD.exe
  C:\Windows\System\iPgFLrD.exe
  2⤵
  PID:15476
- C:\Windows\System\ocpuJRK.exe
  C:\Windows\System\ocpuJRK.exe
  2⤵
  PID:15508
- C:\Windows\System\myHGiBI.exe
  C:\Windows\System\myHGiBI.exe
  2⤵
  PID:15524
- C:\Windows\System\SqhoZHw.exe
  C:\Windows\System\SqhoZHw.exe
  2⤵
  PID:15540
- C:\Windows\System\hErLYhn.exe
  C:\Windows\System\hErLYhn.exe
  2⤵
  PID:15560
- C:\Windows\System\nBaCUaJ.exe
  C:\Windows\System\nBaCUaJ.exe
  2⤵
  PID:15620
- C:\Windows\System\JkgrBTO.exe
  C:\Windows\System\JkgrBTO.exe
  2⤵
  PID:15640
- C:\Windows\System\uyFwxYf.exe
  C:\Windows\System\uyFwxYf.exe
  2⤵
  PID:15656
- C:\Windows\System\zlpItPU.exe
  C:\Windows\System\zlpItPU.exe
  2⤵
  PID:15712
- C:\Windows\System\TCqpjAh.exe
  C:\Windows\System\TCqpjAh.exe
  2⤵
  PID:15748
- C:\Windows\System\XwpyLjW.exe
  C:\Windows\System\XwpyLjW.exe
  2⤵
  PID:15816
- C:\Windows\System\AFyTCjk.exe
  C:\Windows\System\AFyTCjk.exe
  2⤵
  PID:15840
- C:\Windows\System\iUwjgLJ.exe
  C:\Windows\System\iUwjgLJ.exe
  2⤵
  PID:15864
- C:\Windows\System\fwBCRWE.exe
  C:\Windows\System\fwBCRWE.exe
  2⤵
  PID:15880
- C:\Windows\System\cbcJmaO.exe
  C:\Windows\System\cbcJmaO.exe
  2⤵
  PID:15904
- C:\Windows\System\ZCCzBuZ.exe
  C:\Windows\System\ZCCzBuZ.exe
  2⤵
  PID:15932
- C:\Windows\System\UpOitaG.exe
  C:\Windows\System\UpOitaG.exe
  2⤵
  PID:15988
- C:\Windows\System\sqVcQkK.exe
  C:\Windows\System\sqVcQkK.exe
  2⤵
  PID:16004
- C:\Windows\System\FQFeYBq.exe
  C:\Windows\System\FQFeYBq.exe
  2⤵
  PID:16024
- C:\Windows\System\dnDmuWs.exe
  C:\Windows\System\dnDmuWs.exe
  2⤵
  PID:16072

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_elqd1edt.rsl.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\EbzInMP.exe

Filesize
1.2MB

MD5
1a9d74206390ba6a9ab8a74b4f3078f5

SHA1
df2377b5e400215b0fecbd32d3231efa06b1d6ef

SHA256
d6ba112e9bbb749d1452b9474673d42eeeaa6855b50930f724f7f2f014ec3289

SHA512
0bc4a04578f23aa2a435a3fb134217243dc9a48c3616bc1151d9c12f4d6ded7648b7fb47c34c8c94920156d6e6f1d858710b59fad5c20cbfb2167a70b3de3b44

Download Submit
C:\Windows\System\FRoYdLP.exe

Filesize
1.2MB

MD5
3d720de49c4509a9c496b6492a2ffa50

SHA1
0db0d63ab727c57a05f8187b2906d6c4c3271f97

SHA256
668ccdf43fad392e27a585ee0847ea4079c070c5161dcdb54359ac02f1878fbc

SHA512
3fc077f7567311ffebae350eab750304790f6ea13ca24eab4a0e5af804218a93f2149f57d6585101ae64c31bc8cec5d6cc94f80c6e173a9af7d7e39541120707

Download Submit
C:\Windows\System\GyTQCwc.exe

Filesize
1.2MB

MD5
d73b2ab1bbb8d09fbbb01b1b55b22985

SHA1
c5eba299c79777b6b014c73bbaeed4142b793fb9

SHA256
e8009964c4c5680300c3bdf15b6d2c14bc6cf20978e95c392ffa123369686ff3

SHA512
1371109e320f98d8a8f0a50e4fd536bb45bf271eb6bb81c01559256637359dda98f5b8e4f09fda6d11b935df028b7ae0e1796379455ef840920f8f2d25e3e9b3

Download Submit
C:\Windows\System\HMyLOVt.exe

Filesize
1.2MB

MD5
e90908da976a051e59fa51568b3f0ea1

SHA1
186eb49be54dec61756f6e0ac9b6ac4599ac2873

SHA256
40112bf09c91fd65e79599f59ac5ba08f1a54930fb1b6143f589eb1d77c27a25

SHA512
89db8f9c11555d24b162585effded26c6d50192c81f5dfeaff481cb23e00c419b4c33c0984f0e7c118194416df6d248ff800fbca26bf99752303d72dbc623c4a

Download Submit
C:\Windows\System\IToqHrO.exe

Filesize
1.2MB

MD5
b81ed31bfec754c182f613230cfd2061

SHA1
0c5be99d3217ad5c9f2138a619e17caa868e9c1c

SHA256
5fa64e12c566d9f79c58bc1d39cfc43eb25f17d1a7b680329f9bcb8998373cc8

SHA512
48beef7b440c9240c9a671dfea5820884f113fe0934ec727702b3e04c9f85e4cf0b36056ca91dedb791e755664b37ceba3f8e8cba2e4a4e73fce1064eac115c4

Download Submit
C:\Windows\System\IfnZvAl.exe

Filesize
1.2MB

MD5
de9ef7b32b89b9729e2c1e21160f2290

SHA1
7c486bc80bde42fed17236e58fb06beb3509cdc9

SHA256
b92321ca70b8971e30bad32bc16943f321c22e8836b634da21657b08fcfe35cc

SHA512
21460f4147f01a3b9cff2cf112f709c26196f9dc7de47a18575bdd42360d55552b7c960ff9aa5529f3bc6f5f6a66c38dae18422533ba82e51414dda27e9264e6

Download Submit
C:\Windows\System\IwkpWWh.exe

Filesize
1.2MB

MD5
7ff07e45db139ba4328679719d0abd1e

SHA1
226ec4039250e96c3487327d3d69f6d7dbcfa87b

SHA256
abe176b56e953e8ccccc35640672f8e315a26c1e6ec0b8784845856b8057a4a8

SHA512
ff86d03f69ddfa3a861737b984a122bc03ed971ba7e211ddfaa74362a883112cfe291a8fce868ee504109754256fbc3dfa94b84e2f3dbfeed7946d21338589ec

Download Submit
C:\Windows\System\KLgBQXf.exe

Filesize
1.2MB

MD5
4881b390a6beaa8fa89330351f0a8d9c

SHA1
2225e922c7a20875ae5dfa81207161df34b3b243

SHA256
681d1d2a0cd9d493f8de5a475e4dec2ad14308229ee7ed60aca9655f87f81ac9

SHA512
7d21745da74240afec73426587358b543f0c7d184e2159de6c9f3ad6da9a9984bddb3217f0a20cfd071743c9e71e819aa14932e4789b7c88e4916dd831865ab3

Download Submit
C:\Windows\System\KUSRAyt.exe

Filesize
1.2MB

MD5
46bc7f52e4f838d306af5c6a89a55f1c

SHA1
73ff09b43e7ae0acc5f7b030118df0eb187130b3

SHA256
52e08693590a330094647f1068878d6b8cdb80f2f84a16c387ae6708cf7fc3b1

SHA512
47d54551b0ae9ec01753711340bcba40683f89627908ee960e8c76a1fb60ede5c5b500f8c986dca7cd4bbd97a30cd7ff298f77ea1a5cfa830f9207524354ab9e

Download Submit
C:\Windows\System\MOPWqfj.exe

Filesize
1.2MB

MD5
77ab6ab6e5591b098efcc5a59be0f324

SHA1
9420ddfed5177c71db2012bb0a879d024d35a89b

SHA256
585d85c31fd48b9a164925a19a45be26869ccbee7134aea7083103986114a6d7

SHA512
4b9cac3a79f30ea23433880548c15b9386f55e8697d3f30a8e06091d529f32f6a34c5af5e06f262096df59c401213e0e86489890c41026ad0261c1013e9fc44c

Download Submit
C:\Windows\System\MvlnKHG.exe

Filesize
1.2MB

MD5
5b3c59630a5ce8ffc0d2b0c0e5480566

SHA1
d99d1746ea339d55201a62da1520fbb4bec088a0

SHA256
f0d7f6542ed1071aa146ec2f2d95d88a213c753d2a5f6121681524468e8073cb

SHA512
edd9d14d9bc9583a3affa99dedcaca33af543e7ca1b8a719c329a6013056f48d0efa7031b98e7c2f24c7a076c697c89a4fbafe96d63c9a1e7287a12d3c88ab84

Download Submit
C:\Windows\System\NabDCDl.exe

Filesize
1.2MB

MD5
560e1c7c0d3863c74baf7bcf602880db

SHA1
57b20f1b9154046cbec9bb0ba3bb9db0991b902d

SHA256
2054fb5b8a4fa24a65b9fc241165b660c934442620a10dba67084032a7e15dc8

SHA512
de2841b1dae047b6e0d177e9b9b3b4325edfa3fced8ccbf9d0673d8028d970c62fb6f045b8b03b89b58fc2d1ef55b590c73fc06a7fca9cba1303344aea3b325f

Download Submit
C:\Windows\System\RXSjRAb.exe

Filesize
1.2MB

MD5
c5bfe42e9e34c8417a2ce5a6f848bca5

SHA1
4a081a7f440d15cd4d5ceb88ef280dec0858e10c

SHA256
1db0ce1c1baa281d62fb93b05ff5f47d1117d28f8f025891ed24e894bc4b7171

SHA512
a0aa970937c058343c2564ffffefc7081f5d267c96e5b44683d3897c8ad8d1efa15514407d7cb2438d4944535619f25f690b9b6db84f8c5ddeee606e0026971c

Download Submit
C:\Windows\System\RaOLHyM.exe

Filesize
1.2MB

MD5
1d192212146892965b9e880bb8fc5430

SHA1
d7c58c8495c48e761669ab8048b5d237ca01718e

SHA256
3282a61091cb9290bcdcb36b0caac7192a04db68a13c3ea375ab7448b982b461

SHA512
a2824f48793d42e8b4f33efa69acaa715574886e4537fcb324b62e1283f78110be0f85e0bbdb23527e7a452e5e124abcdac7554f4bd2f737083e4d894955c063

Download Submit
C:\Windows\System\SohxNsG.exe

Filesize
1.2MB

MD5
7c27773391c6a4c31ed69d3e7c96225a

SHA1
1a609a2b032f94183e6304aa56b33321a26a69df

SHA256
4aa6ec5ef36e39e62f0ae1b15a060dcdad0a6ee4b18bfdbfcb01f4953f2e4071

SHA512
09ac9a6312e19910d0f7b70962fa7fa3e4f474d07c66847c74e7fb5862e1f09a30680b9b868ee6baa5f2a272bcf7d77aea456da5be637da9bd7a46a18c592538

Download Submit
C:\Windows\System\TDbszSa.exe

Filesize
1.2MB

MD5
b0e519b6bd6526594a103596edff31ff

SHA1
1d22010bc5d87904b9bf3da3939e9141293b9023

SHA256
0efed94683b83b6310c66a54dbde051c67bc949b3d755eb23f7d746afee7acb1

SHA512
36f254528258443b76f091fa4b147c6b138f2f872dda7231af47fa263c21e4fbad81292ec2d54eeeb84b45cc852ad3a1b733c034ba595369044cc4812fb94208

Download Submit
C:\Windows\System\TJXjAof.exe

Filesize
1.2MB

MD5
4e3495fe32e9ca823d27695466225670

SHA1
05447c2fa26b5e45ba4b518ade9f4904eaf6a54c

SHA256
b1222e2559f911bfe998bff4f8814ffa7bfcd58f00af3127bd9122bc53b1cc6e

SHA512
16de9a67709535228acb898d0b259c9ea5390365d85deed31a19dc36e5acdbd429dfdcfc63ff84ccc5bbda5e605174c73d50f5b4c5393c34bb254f16c7896574

Download Submit
C:\Windows\System\VOVdEde.exe

Filesize
1.2MB

MD5
613dd2f0341709207289b82bccaa63ad

SHA1
56583521d24adf139da3b96a8e7d2aff1604f591

SHA256
d58a748fb7fd17b44ffede6e25b5ce5cb8c456d814906bc4522a9c73b959044b

SHA512
9f4b233648f2d477bb2a67535c6a3ec2fae0a530bd32011074ea5e7a84a302ae235afb2d1fd0391b1ff999916a94ca82eb069cfa232b21c53fae2c7504a86ad2

Download Submit
C:\Windows\System\XevTSbF.exe

Filesize
1.2MB

MD5
3154c9f772b897c3931e16787ac6e18d

SHA1
6daded8a8bdb1250dcc13b02f9df5d1d51b9a855

SHA256
c6b5f8ce9570e1222fc27d545bbab18a6ac371535664c2266f67bb4b6f2043d4

SHA512
37042261ab731ff7f365b884de01699b6ddcacea32a77ca4d5ad609f23cab6f64543bdf517f4d4c7ad1752a84af9612f4b9418f74920d697d2869c905c877152

Download Submit
C:\Windows\System\ZZDRwJz.exe

Filesize
1.2MB

MD5
b7ad56924af4a1cb4b951842b0418a28

SHA1
3451808525cf4e03993539f4060ca4f9d48bc499

SHA256
3ef07bc50358f41ac6de3826f97484198ff75986b3522bed7355158e4775aa6d

SHA512
5d78fa8420598ce1424908f2863ab4a281c3e4ba0353bf8a07e7279a3e1e0c26905519a581b41f854befd1472bbbd9cca435e98c342ea9013b219f9bbe09c89a

Download Submit
C:\Windows\System\ZhIARlL.exe

Filesize
1.2MB

MD5
98bcf3a5d4d869a3f316f0613e9e6c51

SHA1
5835e2e948a582ee0c781302810ab1a2c0bc387a

SHA256
18319f2070b7fe1ac3f9a8b9ed6d4571c2865a26aa45c6a220ffbb7c4b7a26f0

SHA512
ea45fe4460a3419834d8391b76745c78ac748a0f30b84d6b167ac5723f68c54791eaef6f4ed448ced4bbc063a0b7704747eebdae2cd0451050a01bbfe62c27c8

Download Submit
C:\Windows\System\bYNBQpX.exe

Filesize
1.2MB

MD5
e513fad6ecbe2ae046d71c35ec504400

SHA1
73d6d8445dd953aa1238319a232ee2705ec6c131

SHA256
88ecc356d9bcd3c827156c22cc04a2e2e94f8a43ed77e1eb82f70ce992ef5986

SHA512
f1cba21d6c485bf297fc3c8ad3414a62bb0847064a7fa513fc91d9d2ce6465ce114d9da07605b6501793b8637f4cb81c670c8ae805b4b3f7f3c7ffd31a019179

Download Submit
C:\Windows\System\cNMjtrv.exe

Filesize
1.2MB

MD5
ad157fbfdf042a44851880e30ce30adb

SHA1
ffcffdca767cce6410afc067a81d95e6399edc7e

SHA256
846b466ae29b7c7782d51d16c482cf983014bae555f4c7b54972e9642c4addc6

SHA512
4295bf687af0e7183d949ff676c052e8b1c6eec07586e37ddf5b8620e07b9d8b2a78c32ce75567c74cbb90abc100437d9a9410247a252deb924d7a1b5617145a

Download Submit
C:\Windows\System\cNzroNr.exe

Filesize
1.2MB

MD5
eab64132c3fe91c2c7c78008b3185213

SHA1
d8984b9897d6986e5b33c8678a66cdeb12ff2c83

SHA256
d4e85ea180fff68d0a12d97cca85d5683ab61526701d85d66920eb5f2991c625

SHA512
22c37e2c9195a1e565879f4e6de12e7f60f46f8bc1e1b71dd34031262b4f82852c1a2dfc2f3b3c50bbbc6caf73e116751f0c39605b621431d9939f0095093ac0

Download Submit
C:\Windows\System\cPdgNEW.exe

Filesize
1.2MB

MD5
9ba3e0d1d79549e6b7a83a30d9554953

SHA1
481eef99e80f9d8b347dcabb887452b07d8e3dae

SHA256
c04c8d68cb5c62047b71ff4e757c7499b67a8cd50bdb633dc08bdc19279f4ab1

SHA512
8c316e36ffc8d718e6db1d8d9f6ab2d097c415d758f5de1ced6dd6662309ac7bbb7cef423022538778e6972763985d973f4f7d0a9b5a58a3461f2da8836f6d28

Download Submit
C:\Windows\System\gDRlGGy.exe

Filesize
1.2MB

MD5
2fab6c7318ff31cd1808affdd0f5325f

SHA1
746144da3efeb3f6424e664e0e0434fee400ca87

SHA256
a030fa13e359bc17cfb47f53b9082567a95824f4400eb2433209bafe2fe9485d

SHA512
0d168a5ad1201de1de0e0f80e1a89299a32763fe478593e6df655e8b0bed14f14dd9d5d815138adc514726d60f38576977bb201c3db6191e182a5e66355b3692

Download Submit
C:\Windows\System\iTJLPLO.exe

Filesize
1.2MB

MD5
653e20b520f6f6ba006a1de3ab43382a

SHA1
997b7ea1bbbe434a8ef79613bdf10d0a71670be8

SHA256
2d54ae79c6fb16d47e22ffa91c867899c740a626f5bf1e6e983b38aab2e6b0bc

SHA512
dca71b00349029526e8331d95669b9982555891d24e8838a6d46a1893c1951b9eb3631f4d46a1f35d275e137a1a3ccec07eba575abd593922cd02f96b94ab73a

Download Submit
C:\Windows\System\jUdYYQr.exe

Filesize
1.2MB

MD5
cd494253e90bdd2bcd5241a87bf7eecb

SHA1
0bf87fbdd77b9f982a1c64ca3844082e747b29b8

SHA256
8ac86f71f0183ec56b9f89914d77bcd8f859a3b056a261c6e0304402f450af9a

SHA512
3c8334baee786ca015c4dc8c628868ee6c1370c13c1890a4d5db3c9e5d1fadcc4d4972a72d6e3bf734777d4b32644270662501988400bde9a6895195b417579a

Download Submit
C:\Windows\System\linlmjz.exe

Filesize
1.2MB

MD5
0c7178d3064a95784eee1acacbcc5f71

SHA1
f75b1b6a8c36417c440981fefe17e35e4e26b6dd

SHA256
370b8b9bbe04df68a2a574b803ac1ad3208408e04873a97ead09a0b03881a72f

SHA512
7632255bfb1a103a85f9148f58bbcb4748b14ec2324b3e96ac7ffcddbc85994d72f51f40153523bf851fd2275a60b5c91186603eebf235a84239d47f79542109

Download Submit
C:\Windows\System\pPbUUDt.exe

Filesize
1.2MB

MD5
25deaf31326e1df1e63147a60f80c589

SHA1
8d4f852bdf3bcb535ddc2ee792e85c828e6c1c2d

SHA256
ef184d0a202b4a1f872286a222a4991b3160b7b50cde23e2dc5ba1084ca8dd58

SHA512
be24aef7eeb1d7fbaffcb83079f3ec6fc68bc7626e45303202cbd4894d9f905e017acffe91a3147ec9cd55b8ee715f734426efea44d443f0f01e934fb2430150

Download Submit
C:\Windows\System\ptTulXn.exe

Filesize
1.2MB

MD5
d14a85d67361aa246a8c7cec97585f33

SHA1
d8d28fe15118f69af1bfd1fb89b010a7797a68a8

SHA256
82f87a4a491d57aed18f2e16f87cbe2160fdc9cb207880cfef8798a27faa5ffb

SHA512
79525396f926ba97187ff23ec9e20e42c444ebfe232d36fc249971bafeb64dbe300abcdd5080442c14fc66b1f94391593d720f91cec9931169b3b75420784959

Download Submit
C:\Windows\System\sjJdDti.exe

Filesize
1.2MB

MD5
2eeeb59e7b7e5b09c04ebf72d89fa149

SHA1
0ddf6850c4781ae7514563ef988b76a10ec85061

SHA256
26be689103027a92a683c1950504ac1887eb8668510bfa7344c391860194cf2e

SHA512
7495ed4b6484385b171a36ae6f5e34b73f774b8a8e5c4ca6f39b51df6fe8cb8142b28446c6afdc6e48db3bd1dbc6876e21b039b29d6a8e6bbaa2f6cfbd8c7195

Download Submit
C:\Windows\System\ueNOipA.exe

Filesize
1.2MB

MD5
796d557e93b6516c62c4b861e39bfe2d

SHA1
470c494bf6dc0c7dfdf6f9533ef78f902ef32559

SHA256
88905759b6f4c2f1901bbe256e840df7b74e8d7a068cc7806a4d7cd995318c5a

SHA512
abbb0851c10e18618fc5cf30376b94e40dfacc09dd2e1664c1fd0e82166dbd282a2067cd758fc54e307ef569e62d819660c414d98f324a8f6d7a6167ab8df2e6

Download Submit
C:\Windows\System\wesjeVY.exe

Filesize
1.2MB

MD5
4c25cb2d6079da7f93ba5697baf41179

SHA1
76ace155e4bfc6ff9159a2381cadfeb198c751c1

SHA256
70e5aa6b5518e54ae8119929820600f4fc31c7b86bbfafacafd1eb71356ee4c1

SHA512
1c4902bade0ed47bbf86812d3dc51436f35c0ff8565f06e4428140a15f0621d10a23d8b4c5e184b089bf4e1a9373106e2d69007e296d340caa5cedacd4a4d118

Download Submit
C:\Windows\System\xUwdxED.exe

Filesize
1.2MB

MD5
79accff32b0bd2f112a6c6cea393ee82

SHA1
31ee2019657071369f5114a7f758e99ac5c72463

SHA256
98c801f797bfff67843b4debd56f43aec85f61a6b2d5f4fc1f32de3af3600807

SHA512
b73bc39a64809ab16994bf3de2114765e6eef6c488ae2f91f5ebe30356f2881cea16c03e2bf59d1cb7b7aa16ad14639878074c61e7dd79ec968cd4e4059f52eb

Download Submit
memory/560-595-0x00000191F2EA0000-0x00000191F3646000-memory.dmp

Filesize
7.6MB

Download
memory/560-33-0x00007FFE5FD40000-0x00007FFE60801000-memory.dmp

Filesize
10.8MB

Download
memory/560-32-0x00007FFE5FD40000-0x00007FFE60801000-memory.dmp

Filesize
10.8MB

Download
memory/560-5519-0x00007FFE5FD40000-0x00007FFE60801000-memory.dmp

Filesize
10.8MB

Download
memory/560-5-0x00007FFE5FD43000-0x00007FFE5FD45000-memory.dmp

Filesize
8KB

Download
memory/560-56-0x00000191F21F0000-0x00000191F2212000-memory.dmp

Filesize
136KB

Download
memory/560-6212-0x00007FFE5FD40000-0x00007FFE60801000-memory.dmp

Filesize
10.8MB

Download
memory/688-96-0x00007FF78AD00000-0x00007FF78B0F2000-memory.dmp

Filesize
3.9MB

Download
memory/688-2285-0x00007FF78AD00000-0x00007FF78B0F2000-memory.dmp

Filesize
3.9MB

Download
memory/1480-35-0x00007FF7723C0000-0x00007FF7727B2000-memory.dmp

Filesize
3.9MB

Download
memory/1480-2122-0x00007FF7723C0000-0x00007FF7727B2000-memory.dmp

Filesize
3.9MB

Download
memory/1604-2317-0x00007FF691CC0000-0x00007FF6920B2000-memory.dmp

Filesize
3.9MB

Download
memory/1604-66-0x00007FF691CC0000-0x00007FF6920B2000-memory.dmp

Filesize
3.9MB

Download
memory/1836-2355-0x00007FF76AFD0000-0x00007FF76B3C2000-memory.dmp

Filesize
3.9MB

Download
memory/1836-227-0x00007FF76AFD0000-0x00007FF76B3C2000-memory.dmp

Filesize
3.9MB

Download
memory/1912-36-0x00007FF6F0A10000-0x00007FF6F0E02000-memory.dmp

Filesize
3.9MB

Download
memory/1912-2297-0x00007FF6F0A10000-0x00007FF6F0E02000-memory.dmp

Filesize
3.9MB

Download
memory/2104-1075-0x00007FF7F3BE0000-0x00007FF7F3FD2000-memory.dmp

Filesize
3.9MB

Download
memory/2104-0-0x00007FF7F3BE0000-0x00007FF7F3FD2000-memory.dmp

Filesize
3.9MB

Download
memory/2104-1-0x000001ABE5620000-0x000001ABE5630000-memory.dmp

Filesize
64KB

Download
memory/2120-37-0x00007FF6A52F0000-0x00007FF6A56E2000-memory.dmp

Filesize
3.9MB

Download
memory/2120-2306-0x00007FF6A52F0000-0x00007FF6A56E2000-memory.dmp

Filesize
3.9MB

Download
memory/2208-2289-0x00007FF64B200000-0x00007FF64B5F2000-memory.dmp

Filesize
3.9MB

Download
memory/2208-258-0x00007FF64B200000-0x00007FF64B5F2000-memory.dmp

Filesize
3.9MB

Download
memory/2260-274-0x00007FF7965E0000-0x00007FF7969D2000-memory.dmp

Filesize
3.9MB

Download
memory/2260-2352-0x00007FF7965E0000-0x00007FF7969D2000-memory.dmp

Filesize
3.9MB

Download
memory/2524-275-0x00007FF6FF2B0000-0x00007FF6FF6A2000-memory.dmp

Filesize
3.9MB

Download
memory/2524-2361-0x00007FF6FF2B0000-0x00007FF6FF6A2000-memory.dmp

Filesize
3.9MB

Download
memory/2804-144-0x00007FF74B490000-0x00007FF74B882000-memory.dmp

Filesize
3.9MB

Download
memory/2804-2300-0x00007FF74B490000-0x00007FF74B882000-memory.dmp

Filesize
3.9MB

Download
memory/2916-43-0x00007FF731180000-0x00007FF731572000-memory.dmp

Filesize
3.9MB

Download
memory/2916-2312-0x00007FF731180000-0x00007FF731572000-memory.dmp

Filesize
3.9MB

Download
memory/2964-2282-0x00007FF78A400000-0x00007FF78A7F2000-memory.dmp

Filesize
3.9MB

Download
memory/2964-203-0x00007FF78A400000-0x00007FF78A7F2000-memory.dmp

Filesize
3.9MB

Download
memory/3004-12-0x00007FF736BE0000-0x00007FF736FD2000-memory.dmp

Filesize
3.9MB

Download
memory/3004-2075-0x00007FF736BE0000-0x00007FF736FD2000-memory.dmp

Filesize
3.9MB

Download
memory/3168-2321-0x00007FF74ADE0000-0x00007FF74B1D2000-memory.dmp

Filesize
3.9MB

Download
memory/3168-154-0x00007FF74ADE0000-0x00007FF74B1D2000-memory.dmp

Filesize
3.9MB

Download
memory/3252-2372-0x00007FF681680000-0x00007FF681A72000-memory.dmp

Filesize
3.9MB

Download
memory/3252-276-0x00007FF681680000-0x00007FF681A72000-memory.dmp

Filesize
3.9MB

Download
memory/3372-2187-0x00007FF72E780000-0x00007FF72EB72000-memory.dmp

Filesize
3.9MB

Download
memory/3372-20-0x00007FF72E780000-0x00007FF72EB72000-memory.dmp

Filesize
3.9MB

Download
memory/3580-2287-0x00007FF6D57C0000-0x00007FF6D5BB2000-memory.dmp

Filesize
3.9MB

Download
memory/3580-181-0x00007FF6D57C0000-0x00007FF6D5BB2000-memory.dmp

Filesize
3.9MB

Download
memory/3988-2341-0x00007FF6295A0000-0x00007FF629992000-memory.dmp

Filesize
3.9MB

Download
memory/3988-273-0x00007FF6295A0000-0x00007FF629992000-memory.dmp

Filesize
3.9MB

Download
memory/3996-34-0x00007FF7CE220000-0x00007FF7CE612000-memory.dmp

Filesize
3.9MB

Download
memory/4368-124-0x00007FF681DE0000-0x00007FF6821D2000-memory.dmp

Filesize
3.9MB

Download
memory/4368-2303-0x00007FF681DE0000-0x00007FF6821D2000-memory.dmp

Filesize
3.9MB

Download
memory/4408-2309-0x00007FF6862F0000-0x00007FF6866E2000-memory.dmp

Filesize
3.9MB

Download
memory/4408-113-0x00007FF6862F0000-0x00007FF6866E2000-memory.dmp

Filesize
3.9MB

Download
memory/4828-109-0x00007FF7DC520000-0x00007FF7DC912000-memory.dmp

Filesize
3.9MB

Download
memory/5080-2296-0x00007FF762760000-0x00007FF762B52000-memory.dmp

Filesize
3.9MB

Download
memory/5080-190-0x00007FF762760000-0x00007FF762B52000-memory.dmp

Filesize
3.9MB

Download
memory/5100-2286-0x00007FF7271F0000-0x00007FF7275E2000-memory.dmp

Filesize
3.9MB

Download
memory/5100-259-0x00007FF7271F0000-0x00007FF7275E2000-memory.dmp

Filesize
3.9MB

Download