xmrig | ef6571ac89e6f4b32b7fe446bee430cceceb795bfc4fbf583bc5415762005525

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
14-05-2024 22:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3cbfb27b102e7235a86ab5b5f6db2990_NeikiAnalytics.exe
Size

2.9MB
MD5

3cbfb27b102e7235a86ab5b5f6db2990
SHA1

23934385bea8bf8c2bcee1c66ee34674b502f0b9
SHA256

ef6571ac89e6f4b32b7fe446bee430cceceb795bfc4fbf583bc5415762005525
SHA512

b207db8eda95a6e9de8289f154fb0bcb12edfc815f0cb5c92653abbc8968f4878b7d05e8a4a6eb88dcabd2f601c3f1b8ed825372d217c07bdda52035995b2ba7
SSDEEP

49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0INx29L5KQ2A:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2Rq

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 62 IoCs

miner

resource	yara_rule
behavioral2/memory/4296-0-0x00007FF778AC0000-0x00007FF778EB6000-memory.dmp	xmrig
behavioral2/files/0x0007000000023406-9.dat	xmrig
behavioral2/files/0x0007000000023407-22.dat	xmrig
behavioral2/files/0x0007000000023408-27.dat	xmrig
behavioral2/files/0x000700000002340a-42.dat	xmrig
behavioral2/memory/4996-56-0x00007FF7D1FE0000-0x00007FF7D23D6000-memory.dmp	xmrig
behavioral2/files/0x000700000002340b-58.dat	xmrig
behavioral2/memory/2352-61-0x00007FF611FE0000-0x00007FF6123D6000-memory.dmp	xmrig
behavioral2/memory/2248-63-0x00007FF6A8990000-0x00007FF6A8D86000-memory.dmp	xmrig
behavioral2/memory/1528-62-0x00007FF7D8130000-0x00007FF7D8526000-memory.dmp	xmrig
behavioral2/memory/2260-60-0x00007FF7EFD30000-0x00007FF7F0126000-memory.dmp	xmrig
behavioral2/memory/468-57-0x00007FF79CA60000-0x00007FF79CE56000-memory.dmp	xmrig
behavioral2/files/0x0007000000023409-44.dat	xmrig
behavioral2/memory/3476-43-0x00007FF6BF6F0000-0x00007FF6BFAE6000-memory.dmp	xmrig
behavioral2/files/0x0008000000023405-16.dat	xmrig
behavioral2/memory/696-14-0x00007FF651CD0000-0x00007FF6520C6000-memory.dmp	xmrig
behavioral2/files/0x0008000000022f51-6.dat	xmrig
behavioral2/files/0x0008000000023403-75.dat	xmrig
behavioral2/files/0x000700000002340e-79.dat	xmrig
behavioral2/files/0x0007000000023410-93.dat	xmrig
behavioral2/files/0x000700000002340f-94.dat	xmrig
behavioral2/memory/4796-90-0x00007FF6453A0000-0x00007FF645796000-memory.dmp	xmrig
behavioral2/memory/1960-86-0x00007FF6B08E0000-0x00007FF6B0CD6000-memory.dmp	xmrig
behavioral2/files/0x000800000002340c-82.dat	xmrig
behavioral2/files/0x000800000002340d-69.dat	xmrig
behavioral2/memory/2696-252-0x00007FF710D30000-0x00007FF711126000-memory.dmp	xmrig
behavioral2/files/0x0007000000023411-287.dat	xmrig
behavioral2/files/0x0007000000023451-335.dat	xmrig
behavioral2/files/0x000700000002345d-351.dat	xmrig
behavioral2/memory/2428-369-0x00007FF724550000-0x00007FF724946000-memory.dmp	xmrig
behavioral2/files/0x0007000000023458-375.dat	xmrig
behavioral2/files/0x000700000002345e-381.dat	xmrig
behavioral2/files/0x0007000000023466-388.dat	xmrig
behavioral2/memory/2288-392-0x00007FF76C900000-0x00007FF76CCF6000-memory.dmp	xmrig
behavioral2/memory/2532-397-0x00007FF77D3C0000-0x00007FF77D7B6000-memory.dmp	xmrig
behavioral2/memory/2064-394-0x00007FF6E0260000-0x00007FF6E0656000-memory.dmp	xmrig
behavioral2/memory/3356-391-0x00007FF65B930000-0x00007FF65BD26000-memory.dmp	xmrig
behavioral2/memory/4520-387-0x00007FF784A70000-0x00007FF784E66000-memory.dmp	xmrig
behavioral2/files/0x0007000000023461-385.dat	xmrig
behavioral2/memory/3664-384-0x00007FF704A00000-0x00007FF704DF6000-memory.dmp	xmrig
behavioral2/memory/512-377-0x00007FF6B9100000-0x00007FF6B94F6000-memory.dmp	xmrig
behavioral2/memory/4196-371-0x00007FF793E90000-0x00007FF794286000-memory.dmp	xmrig
behavioral2/files/0x000700000002345f-365.dat	xmrig
behavioral2/files/0x000700000002345b-364.dat	xmrig
behavioral2/files/0x000700000002344f-362.dat	xmrig
behavioral2/files/0x0007000000023455-358.dat	xmrig
behavioral2/memory/4068-338-0x00007FF7F2AF0000-0x00007FF7F2EE6000-memory.dmp	xmrig
behavioral2/files/0x0007000000023447-313.dat	xmrig
behavioral2/memory/2928-312-0x00007FF7E0960000-0x00007FF7E0D56000-memory.dmp	xmrig
behavioral2/files/0x000700000002344d-330.dat	xmrig
behavioral2/files/0x000700000002344a-316.dat	xmrig
behavioral2/memory/4880-285-0x00007FF792810000-0x00007FF792C06000-memory.dmp	xmrig
behavioral2/memory/1000-270-0x00007FF7E0DB0000-0x00007FF7E11A6000-memory.dmp	xmrig
behavioral2/files/0x0007000000023469-427.dat	xmrig
behavioral2/files/0x0007000000023490-434.dat	xmrig
behavioral2/files/0x0007000000023493-441.dat	xmrig
behavioral2/files/0x0007000000023497-447.dat	xmrig
behavioral2/memory/4296-1931-0x00007FF778AC0000-0x00007FF778EB6000-memory.dmp	xmrig
behavioral2/memory/4880-4420-0x00007FF792810000-0x00007FF792C06000-memory.dmp	xmrig
behavioral2/memory/4068-4477-0x00007FF7F2AF0000-0x00007FF7F2EE6000-memory.dmp	xmrig
behavioral2/memory/4196-4488-0x00007FF793E90000-0x00007FF794286000-memory.dmp	xmrig
behavioral2/memory/4520-4487-0x00007FF784A70000-0x00007FF784E66000-memory.dmp	xmrig

Blocklisted process makes network request 7 IoCs

flow	pid	Process
3	3876	powershell.exe
5	3876	powershell.exe
10	3876	powershell.exe
11	3876	powershell.exe
13	3876	powershell.exe
14	3876	powershell.exe
16	3876	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
3876	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
696	UnPiiKP.exe
2260	bxrCWST.exe
3476	MaUQFJf.exe
2352	wCWNSNs.exe
4996	kUsNibf.exe
1528	LOSVVFU.exe
468	xdExlUx.exe
2248	IujRotF.exe
1960	vLILqDe.exe
1000	EtYobgy.exe
4796	cgRJTPq.exe
2696	AWPkdGb.exe
4880	xGMMble.exe
2928	EBXuNCm.exe
3356	cfLbhiR.exe
2288	onGkMPL.exe
2064	QjDlEZD.exe
4068	hffCEPN.exe
2428	tXzhibf.exe
4196	pmPAHhM.exe
2532	AQegtld.exe
512	VurXQrN.exe
3664	ObKfhlP.exe
4520	yoaIalE.exe
1044	DphSCUF.exe
3396	wlMsiSj.exe
2872	wRLNopV.exe
1196	AWJftSt.exe
3564	yqmeMLi.exe
4712	ZHNdPET.exe
3388	FjdQWfl.exe
2244	RUbaWXm.exe
3592	UTmQfkF.exe
3612	ZZlDfwK.exe
1652	ioELnQg.exe
5108	jVuhAhZ.exe
3340	FmXJFfI.exe
5116	qLWlqwb.exe
2692	xMhboHc.exe
2852	lQmHFGO.exe
2700	DMvXDFt.exe
868	uSEMeEF.exe
4328	JzNmfRZ.exe
2660	WjcFvcr.exe
1724	tIzwwqi.exe
2368	ljBsTxM.exe
4848	utnlloo.exe
4476	WTFRcMb.exe
4944	tKeLCdP.exe
1028	gdTwGhs.exe
4076	kvHGqgZ.exe
4704	lBntnMY.exe
2256	PQZkmJM.exe
2456	RtXPefW.exe
5044	NdWtGTn.exe
4156	EsLvEna.exe
2320	krNprPX.exe
1760	LbvpDKL.exe
5016	SEBepbx.exe
432	TQPHEYD.exe
4388	jfoomJu.exe
2236	kwuHlVG.exe
4052	SkUbybO.exe
4856	lKRwYxQ.exe

UPX packed file 62 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4296-0-0x00007FF778AC0000-0x00007FF778EB6000-memory.dmp	upx
behavioral2/files/0x0007000000023406-9.dat	upx
behavioral2/files/0x0007000000023407-22.dat	upx
behavioral2/files/0x0007000000023408-27.dat	upx
behavioral2/files/0x000700000002340a-42.dat	upx
behavioral2/memory/4996-56-0x00007FF7D1FE0000-0x00007FF7D23D6000-memory.dmp	upx
behavioral2/files/0x000700000002340b-58.dat	upx
behavioral2/memory/2352-61-0x00007FF611FE0000-0x00007FF6123D6000-memory.dmp	upx
behavioral2/memory/2248-63-0x00007FF6A8990000-0x00007FF6A8D86000-memory.dmp	upx
behavioral2/memory/1528-62-0x00007FF7D8130000-0x00007FF7D8526000-memory.dmp	upx
behavioral2/memory/2260-60-0x00007FF7EFD30000-0x00007FF7F0126000-memory.dmp	upx
behavioral2/memory/468-57-0x00007FF79CA60000-0x00007FF79CE56000-memory.dmp	upx
behavioral2/files/0x0007000000023409-44.dat	upx
behavioral2/memory/3476-43-0x00007FF6BF6F0000-0x00007FF6BFAE6000-memory.dmp	upx
behavioral2/files/0x0008000000023405-16.dat	upx
behavioral2/memory/696-14-0x00007FF651CD0000-0x00007FF6520C6000-memory.dmp	upx
behavioral2/files/0x0008000000022f51-6.dat	upx
behavioral2/files/0x0008000000023403-75.dat	upx
behavioral2/files/0x000700000002340e-79.dat	upx
behavioral2/files/0x0007000000023410-93.dat	upx
behavioral2/files/0x000700000002340f-94.dat	upx
behavioral2/memory/4796-90-0x00007FF6453A0000-0x00007FF645796000-memory.dmp	upx
behavioral2/memory/1960-86-0x00007FF6B08E0000-0x00007FF6B0CD6000-memory.dmp	upx
behavioral2/files/0x000800000002340c-82.dat	upx
behavioral2/files/0x000800000002340d-69.dat	upx
behavioral2/memory/2696-252-0x00007FF710D30000-0x00007FF711126000-memory.dmp	upx
behavioral2/files/0x0007000000023411-287.dat	upx
behavioral2/files/0x0007000000023451-335.dat	upx
behavioral2/files/0x000700000002345d-351.dat	upx
behavioral2/memory/2428-369-0x00007FF724550000-0x00007FF724946000-memory.dmp	upx
behavioral2/files/0x0007000000023458-375.dat	upx
behavioral2/files/0x000700000002345e-381.dat	upx
behavioral2/files/0x0007000000023466-388.dat	upx
behavioral2/memory/2288-392-0x00007FF76C900000-0x00007FF76CCF6000-memory.dmp	upx
behavioral2/memory/2532-397-0x00007FF77D3C0000-0x00007FF77D7B6000-memory.dmp	upx
behavioral2/memory/2064-394-0x00007FF6E0260000-0x00007FF6E0656000-memory.dmp	upx
behavioral2/memory/3356-391-0x00007FF65B930000-0x00007FF65BD26000-memory.dmp	upx
behavioral2/memory/4520-387-0x00007FF784A70000-0x00007FF784E66000-memory.dmp	upx
behavioral2/files/0x0007000000023461-385.dat	upx
behavioral2/memory/3664-384-0x00007FF704A00000-0x00007FF704DF6000-memory.dmp	upx
behavioral2/memory/512-377-0x00007FF6B9100000-0x00007FF6B94F6000-memory.dmp	upx
behavioral2/memory/4196-371-0x00007FF793E90000-0x00007FF794286000-memory.dmp	upx
behavioral2/files/0x000700000002345f-365.dat	upx
behavioral2/files/0x000700000002345b-364.dat	upx
behavioral2/files/0x000700000002344f-362.dat	upx
behavioral2/files/0x0007000000023455-358.dat	upx
behavioral2/memory/4068-338-0x00007FF7F2AF0000-0x00007FF7F2EE6000-memory.dmp	upx
behavioral2/files/0x0007000000023447-313.dat	upx
behavioral2/memory/2928-312-0x00007FF7E0960000-0x00007FF7E0D56000-memory.dmp	upx
behavioral2/files/0x000700000002344d-330.dat	upx
behavioral2/files/0x000700000002344a-316.dat	upx
behavioral2/memory/4880-285-0x00007FF792810000-0x00007FF792C06000-memory.dmp	upx
behavioral2/memory/1000-270-0x00007FF7E0DB0000-0x00007FF7E11A6000-memory.dmp	upx
behavioral2/files/0x0007000000023469-427.dat	upx
behavioral2/files/0x0007000000023490-434.dat	upx
behavioral2/files/0x0007000000023493-441.dat	upx
behavioral2/files/0x0007000000023497-447.dat	upx
behavioral2/memory/4296-1931-0x00007FF778AC0000-0x00007FF778EB6000-memory.dmp	upx
behavioral2/memory/4880-4420-0x00007FF792810000-0x00007FF792C06000-memory.dmp	upx
behavioral2/memory/4068-4477-0x00007FF7F2AF0000-0x00007FF7F2EE6000-memory.dmp	upx
behavioral2/memory/4196-4488-0x00007FF793E90000-0x00007FF794286000-memory.dmp	upx
behavioral2/memory/4520-4487-0x00007FF784A70000-0x00007FF784E66000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
2	raw.githubusercontent.com
3	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\DgBoOuL.exe	3cbfb27b102e7235a86ab5b5f6db2990_NeikiAnalytics.exe
File created	C:\Windows\System\vmYIyxv.exe	3cbfb27b102e7235a86ab5b5f6db2990_NeikiAnalytics.exe
File created	C:\Windows\System\brYBKSo.exe	3cbfb27b102e7235a86ab5b5f6db2990_NeikiAnalytics.exe
File created	C:\Windows\System\ctbLNcn.exe	3cbfb27b102e7235a86ab5b5f6db2990_NeikiAnalytics.exe
File created	C:\Windows\System\BAuvZJm.exe	3cbfb27b102e7235a86ab5b5f6db2990_NeikiAnalytics.exe
File created	C:\Windows\System\cMpJuqi.exe	3cbfb27b102e7235a86ab5b5f6db2990_NeikiAnalytics.exe
File created	C:\Windows\System\wUvktil.exe	3cbfb27b102e7235a86ab5b5f6db2990_NeikiAnalytics.exe
File created	C:\Windows\System\TWWbDZB.exe	3cbfb27b102e7235a86ab5b5f6db2990_NeikiAnalytics.exe
File created	C:\Windows\System\tRBZfUf.exe	3cbfb27b102e7235a86ab5b5f6db2990_NeikiAnalytics.exe
File created	C:\Windows\System\Qhfponx.exe	3cbfb27b102e7235a86ab5b5f6db2990_NeikiAnalytics.exe
File created	C:\Windows\System\YNIlzQC.exe	3cbfb27b102e7235a86ab5b5f6db2990_NeikiAnalytics.exe
File created	C:\Windows\System\DPnosqT.exe	3cbfb27b102e7235a86ab5b5f6db2990_NeikiAnalytics.exe
File created	C:\Windows\System\sfHPSgo.exe	3cbfb27b102e7235a86ab5b5f6db2990_NeikiAnalytics.exe
File created	C:\Windows\System\MUQhoxP.exe	3cbfb27b102e7235a86ab5b5f6db2990_NeikiAnalytics.exe
File created	C:\Windows\System\NYUpLzW.exe	3cbfb27b102e7235a86ab5b5f6db2990_NeikiAnalytics.exe
File created	C:\Windows\System\QxnRUNw.exe	3cbfb27b102e7235a86ab5b5f6db2990_NeikiAnalytics.exe
File created	C:\Windows\System\vZawOTu.exe	3cbfb27b102e7235a86ab5b5f6db2990_NeikiAnalytics.exe
File created	C:\Windows\System\WYrOWce.exe	3cbfb27b102e7235a86ab5b5f6db2990_NeikiAnalytics.exe
File created	C:\Windows\System\qZSdubu.exe	3cbfb27b102e7235a86ab5b5f6db2990_NeikiAnalytics.exe
File created	C:\Windows\System\kRKBMze.exe	3cbfb27b102e7235a86ab5b5f6db2990_NeikiAnalytics.exe
File created	C:\Windows\System\vgIFTVa.exe	3cbfb27b102e7235a86ab5b5f6db2990_NeikiAnalytics.exe
File created	C:\Windows\System\BGtfUNj.exe	3cbfb27b102e7235a86ab5b5f6db2990_NeikiAnalytics.exe
File created	C:\Windows\System\BupCgsR.exe	3cbfb27b102e7235a86ab5b5f6db2990_NeikiAnalytics.exe
File created	C:\Windows\System\qENvJZI.exe	3cbfb27b102e7235a86ab5b5f6db2990_NeikiAnalytics.exe
File created	C:\Windows\System\YbYhoWG.exe	3cbfb27b102e7235a86ab5b5f6db2990_NeikiAnalytics.exe
File created	C:\Windows\System\LxxSiWt.exe	3cbfb27b102e7235a86ab5b5f6db2990_NeikiAnalytics.exe
File created	C:\Windows\System\qEYhCSc.exe	3cbfb27b102e7235a86ab5b5f6db2990_NeikiAnalytics.exe
File created	C:\Windows\System\tJqSTbp.exe	3cbfb27b102e7235a86ab5b5f6db2990_NeikiAnalytics.exe
File created	C:\Windows\System\rzHODNQ.exe	3cbfb27b102e7235a86ab5b5f6db2990_NeikiAnalytics.exe
File created	C:\Windows\System\uZZpmer.exe	3cbfb27b102e7235a86ab5b5f6db2990_NeikiAnalytics.exe
File created	C:\Windows\System\RBwUWaQ.exe	3cbfb27b102e7235a86ab5b5f6db2990_NeikiAnalytics.exe
File created	C:\Windows\System\XbYMeyN.exe	3cbfb27b102e7235a86ab5b5f6db2990_NeikiAnalytics.exe
File created	C:\Windows\System\giMjnuj.exe	3cbfb27b102e7235a86ab5b5f6db2990_NeikiAnalytics.exe
File created	C:\Windows\System\VYZVtIF.exe	3cbfb27b102e7235a86ab5b5f6db2990_NeikiAnalytics.exe
File created	C:\Windows\System\YxWcyjE.exe	3cbfb27b102e7235a86ab5b5f6db2990_NeikiAnalytics.exe
File created	C:\Windows\System\fVNqPUK.exe	3cbfb27b102e7235a86ab5b5f6db2990_NeikiAnalytics.exe
File created	C:\Windows\System\ehDRoZt.exe	3cbfb27b102e7235a86ab5b5f6db2990_NeikiAnalytics.exe
File created	C:\Windows\System\VkbqhOZ.exe	3cbfb27b102e7235a86ab5b5f6db2990_NeikiAnalytics.exe
File created	C:\Windows\System\arWscMO.exe	3cbfb27b102e7235a86ab5b5f6db2990_NeikiAnalytics.exe
File created	C:\Windows\System\nNtSCxZ.exe	3cbfb27b102e7235a86ab5b5f6db2990_NeikiAnalytics.exe
File created	C:\Windows\System\ZHJGKLg.exe	3cbfb27b102e7235a86ab5b5f6db2990_NeikiAnalytics.exe
File created	C:\Windows\System\jXZIYuE.exe	3cbfb27b102e7235a86ab5b5f6db2990_NeikiAnalytics.exe
File created	C:\Windows\System\GCQHcuc.exe	3cbfb27b102e7235a86ab5b5f6db2990_NeikiAnalytics.exe
File created	C:\Windows\System\YThFybq.exe	3cbfb27b102e7235a86ab5b5f6db2990_NeikiAnalytics.exe
File created	C:\Windows\System\RUMBhht.exe	3cbfb27b102e7235a86ab5b5f6db2990_NeikiAnalytics.exe
File created	C:\Windows\System\ijmGpvo.exe	3cbfb27b102e7235a86ab5b5f6db2990_NeikiAnalytics.exe
File created	C:\Windows\System\CwMFqkb.exe	3cbfb27b102e7235a86ab5b5f6db2990_NeikiAnalytics.exe
File created	C:\Windows\System\duWFyaH.exe	3cbfb27b102e7235a86ab5b5f6db2990_NeikiAnalytics.exe
File created	C:\Windows\System\zoSUjJa.exe	3cbfb27b102e7235a86ab5b5f6db2990_NeikiAnalytics.exe
File created	C:\Windows\System\fJAjiIV.exe	3cbfb27b102e7235a86ab5b5f6db2990_NeikiAnalytics.exe
File created	C:\Windows\System\mFrEJfD.exe	3cbfb27b102e7235a86ab5b5f6db2990_NeikiAnalytics.exe
File created	C:\Windows\System\gNnFfHO.exe	3cbfb27b102e7235a86ab5b5f6db2990_NeikiAnalytics.exe
File created	C:\Windows\System\RkFJzuM.exe	3cbfb27b102e7235a86ab5b5f6db2990_NeikiAnalytics.exe
File created	C:\Windows\System\bDQbtSk.exe	3cbfb27b102e7235a86ab5b5f6db2990_NeikiAnalytics.exe
File created	C:\Windows\System\gdTwGhs.exe	3cbfb27b102e7235a86ab5b5f6db2990_NeikiAnalytics.exe
File created	C:\Windows\System\TQPHEYD.exe	3cbfb27b102e7235a86ab5b5f6db2990_NeikiAnalytics.exe
File created	C:\Windows\System\icEgiWE.exe	3cbfb27b102e7235a86ab5b5f6db2990_NeikiAnalytics.exe
File created	C:\Windows\System\tRYgiut.exe	3cbfb27b102e7235a86ab5b5f6db2990_NeikiAnalytics.exe
File created	C:\Windows\System\tgyfCxa.exe	3cbfb27b102e7235a86ab5b5f6db2990_NeikiAnalytics.exe
File created	C:\Windows\System\exwFTGv.exe	3cbfb27b102e7235a86ab5b5f6db2990_NeikiAnalytics.exe
File created	C:\Windows\System\BTmRNDo.exe	3cbfb27b102e7235a86ab5b5f6db2990_NeikiAnalytics.exe
File created	C:\Windows\System\xJTukyS.exe	3cbfb27b102e7235a86ab5b5f6db2990_NeikiAnalytics.exe
File created	C:\Windows\System\MpVhDuo.exe	3cbfb27b102e7235a86ab5b5f6db2990_NeikiAnalytics.exe
File created	C:\Windows\System\jmhrsLP.exe	3cbfb27b102e7235a86ab5b5f6db2990_NeikiAnalytics.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3876	powershell.exe
3876	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	4296	3cbfb27b102e7235a86ab5b5f6db2990_NeikiAnalytics.exe
Token: SeDebugPrivilege	3876	powershell.exe
Token: SeLockMemoryPrivilege	4296	3cbfb27b102e7235a86ab5b5f6db2990_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4296 wrote to memory of 3876	4296	3cbfb27b102e7235a86ab5b5f6db2990_NeikiAnalytics.exe	83
PID 4296 wrote to memory of 3876	4296	3cbfb27b102e7235a86ab5b5f6db2990_NeikiAnalytics.exe	83
PID 4296 wrote to memory of 696	4296	3cbfb27b102e7235a86ab5b5f6db2990_NeikiAnalytics.exe	84
PID 4296 wrote to memory of 696	4296	3cbfb27b102e7235a86ab5b5f6db2990_NeikiAnalytics.exe	84
PID 4296 wrote to memory of 2260	4296	3cbfb27b102e7235a86ab5b5f6db2990_NeikiAnalytics.exe	85
PID 4296 wrote to memory of 2260	4296	3cbfb27b102e7235a86ab5b5f6db2990_NeikiAnalytics.exe	85
PID 4296 wrote to memory of 3476	4296	3cbfb27b102e7235a86ab5b5f6db2990_NeikiAnalytics.exe	86
PID 4296 wrote to memory of 3476	4296	3cbfb27b102e7235a86ab5b5f6db2990_NeikiAnalytics.exe	86
PID 4296 wrote to memory of 2352	4296	3cbfb27b102e7235a86ab5b5f6db2990_NeikiAnalytics.exe	87
PID 4296 wrote to memory of 2352	4296	3cbfb27b102e7235a86ab5b5f6db2990_NeikiAnalytics.exe	87
PID 4296 wrote to memory of 4996	4296	3cbfb27b102e7235a86ab5b5f6db2990_NeikiAnalytics.exe	88
PID 4296 wrote to memory of 4996	4296	3cbfb27b102e7235a86ab5b5f6db2990_NeikiAnalytics.exe	88
PID 4296 wrote to memory of 1528	4296	3cbfb27b102e7235a86ab5b5f6db2990_NeikiAnalytics.exe	89
PID 4296 wrote to memory of 1528	4296	3cbfb27b102e7235a86ab5b5f6db2990_NeikiAnalytics.exe	89
PID 4296 wrote to memory of 468	4296	3cbfb27b102e7235a86ab5b5f6db2990_NeikiAnalytics.exe	90
PID 4296 wrote to memory of 468	4296	3cbfb27b102e7235a86ab5b5f6db2990_NeikiAnalytics.exe	90
PID 4296 wrote to memory of 2248	4296	3cbfb27b102e7235a86ab5b5f6db2990_NeikiAnalytics.exe	91
PID 4296 wrote to memory of 2248	4296	3cbfb27b102e7235a86ab5b5f6db2990_NeikiAnalytics.exe	91
PID 4296 wrote to memory of 1960	4296	3cbfb27b102e7235a86ab5b5f6db2990_NeikiAnalytics.exe	92
PID 4296 wrote to memory of 1960	4296	3cbfb27b102e7235a86ab5b5f6db2990_NeikiAnalytics.exe	92
PID 4296 wrote to memory of 1000	4296	3cbfb27b102e7235a86ab5b5f6db2990_NeikiAnalytics.exe	94
PID 4296 wrote to memory of 1000	4296	3cbfb27b102e7235a86ab5b5f6db2990_NeikiAnalytics.exe	94
PID 4296 wrote to memory of 4796	4296	3cbfb27b102e7235a86ab5b5f6db2990_NeikiAnalytics.exe	95
PID 4296 wrote to memory of 4796	4296	3cbfb27b102e7235a86ab5b5f6db2990_NeikiAnalytics.exe	95
PID 4296 wrote to memory of 2696	4296	3cbfb27b102e7235a86ab5b5f6db2990_NeikiAnalytics.exe	96
PID 4296 wrote to memory of 2696	4296	3cbfb27b102e7235a86ab5b5f6db2990_NeikiAnalytics.exe	96
PID 4296 wrote to memory of 4880	4296	3cbfb27b102e7235a86ab5b5f6db2990_NeikiAnalytics.exe	97
PID 4296 wrote to memory of 4880	4296	3cbfb27b102e7235a86ab5b5f6db2990_NeikiAnalytics.exe	97
PID 4296 wrote to memory of 2928	4296	3cbfb27b102e7235a86ab5b5f6db2990_NeikiAnalytics.exe	98
PID 4296 wrote to memory of 2928	4296	3cbfb27b102e7235a86ab5b5f6db2990_NeikiAnalytics.exe	98
PID 4296 wrote to memory of 3356	4296	3cbfb27b102e7235a86ab5b5f6db2990_NeikiAnalytics.exe	99
PID 4296 wrote to memory of 3356	4296	3cbfb27b102e7235a86ab5b5f6db2990_NeikiAnalytics.exe	99
PID 4296 wrote to memory of 2288	4296	3cbfb27b102e7235a86ab5b5f6db2990_NeikiAnalytics.exe	101
PID 4296 wrote to memory of 2288	4296	3cbfb27b102e7235a86ab5b5f6db2990_NeikiAnalytics.exe	101
PID 4296 wrote to memory of 2064	4296	3cbfb27b102e7235a86ab5b5f6db2990_NeikiAnalytics.exe	102
PID 4296 wrote to memory of 2064	4296	3cbfb27b102e7235a86ab5b5f6db2990_NeikiAnalytics.exe	102
PID 4296 wrote to memory of 4068	4296	3cbfb27b102e7235a86ab5b5f6db2990_NeikiAnalytics.exe	103
PID 4296 wrote to memory of 4068	4296	3cbfb27b102e7235a86ab5b5f6db2990_NeikiAnalytics.exe	103
PID 4296 wrote to memory of 2428	4296	3cbfb27b102e7235a86ab5b5f6db2990_NeikiAnalytics.exe	104
PID 4296 wrote to memory of 2428	4296	3cbfb27b102e7235a86ab5b5f6db2990_NeikiAnalytics.exe	104
PID 4296 wrote to memory of 4196	4296	3cbfb27b102e7235a86ab5b5f6db2990_NeikiAnalytics.exe	105
PID 4296 wrote to memory of 4196	4296	3cbfb27b102e7235a86ab5b5f6db2990_NeikiAnalytics.exe	105
PID 4296 wrote to memory of 2532	4296	3cbfb27b102e7235a86ab5b5f6db2990_NeikiAnalytics.exe	106
PID 4296 wrote to memory of 2532	4296	3cbfb27b102e7235a86ab5b5f6db2990_NeikiAnalytics.exe	106
PID 4296 wrote to memory of 512	4296	3cbfb27b102e7235a86ab5b5f6db2990_NeikiAnalytics.exe	107
PID 4296 wrote to memory of 512	4296	3cbfb27b102e7235a86ab5b5f6db2990_NeikiAnalytics.exe	107
PID 4296 wrote to memory of 3664	4296	3cbfb27b102e7235a86ab5b5f6db2990_NeikiAnalytics.exe	108
PID 4296 wrote to memory of 3664	4296	3cbfb27b102e7235a86ab5b5f6db2990_NeikiAnalytics.exe	108
PID 4296 wrote to memory of 4520	4296	3cbfb27b102e7235a86ab5b5f6db2990_NeikiAnalytics.exe	109
PID 4296 wrote to memory of 4520	4296	3cbfb27b102e7235a86ab5b5f6db2990_NeikiAnalytics.exe	109
PID 4296 wrote to memory of 1044	4296	3cbfb27b102e7235a86ab5b5f6db2990_NeikiAnalytics.exe	110
PID 4296 wrote to memory of 1044	4296	3cbfb27b102e7235a86ab5b5f6db2990_NeikiAnalytics.exe	110
PID 4296 wrote to memory of 3396	4296	3cbfb27b102e7235a86ab5b5f6db2990_NeikiAnalytics.exe	111
PID 4296 wrote to memory of 3396	4296	3cbfb27b102e7235a86ab5b5f6db2990_NeikiAnalytics.exe	111
PID 4296 wrote to memory of 2872	4296	3cbfb27b102e7235a86ab5b5f6db2990_NeikiAnalytics.exe	112
PID 4296 wrote to memory of 2872	4296	3cbfb27b102e7235a86ab5b5f6db2990_NeikiAnalytics.exe	112
PID 4296 wrote to memory of 1196	4296	3cbfb27b102e7235a86ab5b5f6db2990_NeikiAnalytics.exe	113
PID 4296 wrote to memory of 1196	4296	3cbfb27b102e7235a86ab5b5f6db2990_NeikiAnalytics.exe	113
PID 4296 wrote to memory of 3564	4296	3cbfb27b102e7235a86ab5b5f6db2990_NeikiAnalytics.exe	115
PID 4296 wrote to memory of 3564	4296	3cbfb27b102e7235a86ab5b5f6db2990_NeikiAnalytics.exe	115
PID 4296 wrote to memory of 4712	4296	3cbfb27b102e7235a86ab5b5f6db2990_NeikiAnalytics.exe	116
PID 4296 wrote to memory of 4712	4296	3cbfb27b102e7235a86ab5b5f6db2990_NeikiAnalytics.exe	116
PID 4296 wrote to memory of 3388	4296	3cbfb27b102e7235a86ab5b5f6db2990_NeikiAnalytics.exe	117
PID 4296 wrote to memory of 3388	4296	3cbfb27b102e7235a86ab5b5f6db2990_NeikiAnalytics.exe	117

C:\Users\Admin\AppData\Local\Temp\3cbfb27b102e7235a86ab5b5f6db2990_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\3cbfb27b102e7235a86ab5b5f6db2990_NeikiAnalytics.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4296
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3876
- C:\Windows\System\UnPiiKP.exe
  C:\Windows\System\UnPiiKP.exe
  2⤵
  - Executes dropped EXE
  PID:696
- C:\Windows\System\bxrCWST.exe
  C:\Windows\System\bxrCWST.exe
  2⤵
  - Executes dropped EXE
  PID:2260
- C:\Windows\System\MaUQFJf.exe
  C:\Windows\System\MaUQFJf.exe
  2⤵
  - Executes dropped EXE
  PID:3476
- C:\Windows\System\wCWNSNs.exe
  C:\Windows\System\wCWNSNs.exe
  2⤵
  - Executes dropped EXE
  PID:2352
- C:\Windows\System\kUsNibf.exe
  C:\Windows\System\kUsNibf.exe
  2⤵
  - Executes dropped EXE
  PID:4996
- C:\Windows\System\LOSVVFU.exe
  C:\Windows\System\LOSVVFU.exe
  2⤵
  - Executes dropped EXE
  PID:1528
- C:\Windows\System\xdExlUx.exe
  C:\Windows\System\xdExlUx.exe
  2⤵
  - Executes dropped EXE
  PID:468
- C:\Windows\System\IujRotF.exe
  C:\Windows\System\IujRotF.exe
  2⤵
  - Executes dropped EXE
  PID:2248
- C:\Windows\System\vLILqDe.exe
  C:\Windows\System\vLILqDe.exe
  2⤵
  - Executes dropped EXE
  PID:1960
- C:\Windows\System\EtYobgy.exe
  C:\Windows\System\EtYobgy.exe
  2⤵
  - Executes dropped EXE
  PID:1000
- C:\Windows\System\cgRJTPq.exe
  C:\Windows\System\cgRJTPq.exe
  2⤵
  - Executes dropped EXE
  PID:4796
- C:\Windows\System\AWPkdGb.exe
  C:\Windows\System\AWPkdGb.exe
  2⤵
  - Executes dropped EXE
  PID:2696
- C:\Windows\System\xGMMble.exe
  C:\Windows\System\xGMMble.exe
  2⤵
  - Executes dropped EXE
  PID:4880
- C:\Windows\System\EBXuNCm.exe
  C:\Windows\System\EBXuNCm.exe
  2⤵
  - Executes dropped EXE
  PID:2928
- C:\Windows\System\cfLbhiR.exe
  C:\Windows\System\cfLbhiR.exe
  2⤵
  - Executes dropped EXE
  PID:3356
- C:\Windows\System\onGkMPL.exe
  C:\Windows\System\onGkMPL.exe
  2⤵
  - Executes dropped EXE
  PID:2288
- C:\Windows\System\QjDlEZD.exe
  C:\Windows\System\QjDlEZD.exe
  2⤵
  - Executes dropped EXE
  PID:2064
- C:\Windows\System\hffCEPN.exe
  C:\Windows\System\hffCEPN.exe
  2⤵
  - Executes dropped EXE
  PID:4068
- C:\Windows\System\tXzhibf.exe
  C:\Windows\System\tXzhibf.exe
  2⤵
  - Executes dropped EXE
  PID:2428
- C:\Windows\System\pmPAHhM.exe
  C:\Windows\System\pmPAHhM.exe
  2⤵
  - Executes dropped EXE
  PID:4196
- C:\Windows\System\AQegtld.exe
  C:\Windows\System\AQegtld.exe
  2⤵
  - Executes dropped EXE
  PID:2532
- C:\Windows\System\VurXQrN.exe
  C:\Windows\System\VurXQrN.exe
  2⤵
  - Executes dropped EXE
  PID:512
- C:\Windows\System\ObKfhlP.exe
  C:\Windows\System\ObKfhlP.exe
  2⤵
  - Executes dropped EXE
  PID:3664
- C:\Windows\System\yoaIalE.exe
  C:\Windows\System\yoaIalE.exe
  2⤵
  - Executes dropped EXE
  PID:4520
- C:\Windows\System\DphSCUF.exe
  C:\Windows\System\DphSCUF.exe
  2⤵
  - Executes dropped EXE
  PID:1044
- C:\Windows\System\wlMsiSj.exe
  C:\Windows\System\wlMsiSj.exe
  2⤵
  - Executes dropped EXE
  PID:3396
- C:\Windows\System\wRLNopV.exe
  C:\Windows\System\wRLNopV.exe
  2⤵
  - Executes dropped EXE
  PID:2872
- C:\Windows\System\AWJftSt.exe
  C:\Windows\System\AWJftSt.exe
  2⤵
  - Executes dropped EXE
  PID:1196
- C:\Windows\System\yqmeMLi.exe
  C:\Windows\System\yqmeMLi.exe
  2⤵
  - Executes dropped EXE
  PID:3564
- C:\Windows\System\ZHNdPET.exe
  C:\Windows\System\ZHNdPET.exe
  2⤵
  - Executes dropped EXE
  PID:4712
- C:\Windows\System\FjdQWfl.exe
  C:\Windows\System\FjdQWfl.exe
  2⤵
  - Executes dropped EXE
  PID:3388
- C:\Windows\System\RUbaWXm.exe
  C:\Windows\System\RUbaWXm.exe
  2⤵
  - Executes dropped EXE
  PID:2244
- C:\Windows\System\UTmQfkF.exe
  C:\Windows\System\UTmQfkF.exe
  2⤵
  - Executes dropped EXE
  PID:3592
- C:\Windows\System\ZZlDfwK.exe
  C:\Windows\System\ZZlDfwK.exe
  2⤵
  - Executes dropped EXE
  PID:3612
- C:\Windows\System\ioELnQg.exe
  C:\Windows\System\ioELnQg.exe
  2⤵
  - Executes dropped EXE
  PID:1652
- C:\Windows\System\jVuhAhZ.exe
  C:\Windows\System\jVuhAhZ.exe
  2⤵
  - Executes dropped EXE
  PID:5108
- C:\Windows\System\FmXJFfI.exe
  C:\Windows\System\FmXJFfI.exe
  2⤵
  - Executes dropped EXE
  PID:3340
- C:\Windows\System\qLWlqwb.exe
  C:\Windows\System\qLWlqwb.exe
  2⤵
  - Executes dropped EXE
  PID:5116
- C:\Windows\System\xMhboHc.exe
  C:\Windows\System\xMhboHc.exe
  2⤵
  - Executes dropped EXE
  PID:2692
- C:\Windows\System\lQmHFGO.exe
  C:\Windows\System\lQmHFGO.exe
  2⤵
  - Executes dropped EXE
  PID:2852
- C:\Windows\System\DMvXDFt.exe
  C:\Windows\System\DMvXDFt.exe
  2⤵
  - Executes dropped EXE
  PID:2700
- C:\Windows\System\uSEMeEF.exe
  C:\Windows\System\uSEMeEF.exe
  2⤵
  - Executes dropped EXE
  PID:868
- C:\Windows\System\JzNmfRZ.exe
  C:\Windows\System\JzNmfRZ.exe
  2⤵
  - Executes dropped EXE
  PID:4328
- C:\Windows\System\WjcFvcr.exe
  C:\Windows\System\WjcFvcr.exe
  2⤵
  - Executes dropped EXE
  PID:2660
- C:\Windows\System\tIzwwqi.exe
  C:\Windows\System\tIzwwqi.exe
  2⤵
  - Executes dropped EXE
  PID:1724
- C:\Windows\System\ljBsTxM.exe
  C:\Windows\System\ljBsTxM.exe
  2⤵
  - Executes dropped EXE
  PID:2368
- C:\Windows\System\utnlloo.exe
  C:\Windows\System\utnlloo.exe
  2⤵
  - Executes dropped EXE
  PID:4848
- C:\Windows\System\WTFRcMb.exe
  C:\Windows\System\WTFRcMb.exe
  2⤵
  - Executes dropped EXE
  PID:4476
- C:\Windows\System\tKeLCdP.exe
  C:\Windows\System\tKeLCdP.exe
  2⤵
  - Executes dropped EXE
  PID:4944
- C:\Windows\System\gdTwGhs.exe
  C:\Windows\System\gdTwGhs.exe
  2⤵
  - Executes dropped EXE
  PID:1028
- C:\Windows\System\kvHGqgZ.exe
  C:\Windows\System\kvHGqgZ.exe
  2⤵
  - Executes dropped EXE
  PID:4076
- C:\Windows\System\lBntnMY.exe
  C:\Windows\System\lBntnMY.exe
  2⤵
  - Executes dropped EXE
  PID:4704
- C:\Windows\System\PQZkmJM.exe
  C:\Windows\System\PQZkmJM.exe
  2⤵
  - Executes dropped EXE
  PID:2256
- C:\Windows\System\RtXPefW.exe
  C:\Windows\System\RtXPefW.exe
  2⤵
  - Executes dropped EXE
  PID:2456
- C:\Windows\System\NdWtGTn.exe
  C:\Windows\System\NdWtGTn.exe
  2⤵
  - Executes dropped EXE
  PID:5044
- C:\Windows\System\EsLvEna.exe
  C:\Windows\System\EsLvEna.exe
  2⤵
  - Executes dropped EXE
  PID:4156
- C:\Windows\System\krNprPX.exe
  C:\Windows\System\krNprPX.exe
  2⤵
  - Executes dropped EXE
  PID:2320
- C:\Windows\System\LbvpDKL.exe
  C:\Windows\System\LbvpDKL.exe
  2⤵
  - Executes dropped EXE
  PID:1760
- C:\Windows\System\SEBepbx.exe
  C:\Windows\System\SEBepbx.exe
  2⤵
  - Executes dropped EXE
  PID:5016
- C:\Windows\System\TQPHEYD.exe
  C:\Windows\System\TQPHEYD.exe
  2⤵
  - Executes dropped EXE
  PID:432
- C:\Windows\System\jfoomJu.exe
  C:\Windows\System\jfoomJu.exe
  2⤵
  - Executes dropped EXE
  PID:4388
- C:\Windows\System\kwuHlVG.exe
  C:\Windows\System\kwuHlVG.exe
  2⤵
  - Executes dropped EXE
  PID:2236
- C:\Windows\System\SkUbybO.exe
  C:\Windows\System\SkUbybO.exe
  2⤵
  - Executes dropped EXE
  PID:4052
- C:\Windows\System\lKRwYxQ.exe
  C:\Windows\System\lKRwYxQ.exe
  2⤵
  - Executes dropped EXE
  PID:4856
- C:\Windows\System\GBKiGXV.exe
  C:\Windows\System\GBKiGXV.exe
  2⤵
  PID:3796
- C:\Windows\System\FiBfbwS.exe
  C:\Windows\System\FiBfbwS.exe
  2⤵
  PID:2144
- C:\Windows\System\puCFNWH.exe
  C:\Windows\System\puCFNWH.exe
  2⤵
  PID:4524
- C:\Windows\System\UmCyJxL.exe
  C:\Windows\System\UmCyJxL.exe
  2⤵
  PID:4440
- C:\Windows\System\LAYCmtZ.exe
  C:\Windows\System\LAYCmtZ.exe
  2⤵
  PID:3248
- C:\Windows\System\HajpKTY.exe
  C:\Windows\System\HajpKTY.exe
  2⤵
  PID:2172
- C:\Windows\System\toScPOU.exe
  C:\Windows\System\toScPOU.exe
  2⤵
  PID:4312
- C:\Windows\System\CFgOSRw.exe
  C:\Windows\System\CFgOSRw.exe
  2⤵
  PID:464
- C:\Windows\System\dlFNnqP.exe
  C:\Windows\System\dlFNnqP.exe
  2⤵
  PID:820
- C:\Windows\System\jRfJawX.exe
  C:\Windows\System\jRfJawX.exe
  2⤵
  PID:1480
- C:\Windows\System\UmFWZpK.exe
  C:\Windows\System\UmFWZpK.exe
  2⤵
  PID:3036
- C:\Windows\System\atiieZo.exe
  C:\Windows\System\atiieZo.exe
  2⤵
  PID:3932
- C:\Windows\System\QkgrozD.exe
  C:\Windows\System\QkgrozD.exe
  2⤵
  PID:2992
- C:\Windows\System\XEpQFOl.exe
  C:\Windows\System\XEpQFOl.exe
  2⤵
  PID:1116
- C:\Windows\System\zjFiBlz.exe
  C:\Windows\System\zjFiBlz.exe
  2⤵
  PID:4184
- C:\Windows\System\yCLXvCr.exe
  C:\Windows\System\yCLXvCr.exe
  2⤵
  PID:4940
- C:\Windows\System\lxFSszv.exe
  C:\Windows\System\lxFSszv.exe
  2⤵
  PID:5140
- C:\Windows\System\jqsLJBv.exe
  C:\Windows\System\jqsLJBv.exe
  2⤵
  PID:5160
- C:\Windows\System\gXvPYOw.exe
  C:\Windows\System\gXvPYOw.exe
  2⤵
  PID:5184
- C:\Windows\System\hkXYclg.exe
  C:\Windows\System\hkXYclg.exe
  2⤵
  PID:5216
- C:\Windows\System\lqHkMtK.exe
  C:\Windows\System\lqHkMtK.exe
  2⤵
  PID:5248
- C:\Windows\System\kpqdcWs.exe
  C:\Windows\System\kpqdcWs.exe
  2⤵
  PID:5288
- C:\Windows\System\iOUlHWa.exe
  C:\Windows\System\iOUlHWa.exe
  2⤵
  PID:5312
- C:\Windows\System\zJxdMEG.exe
  C:\Windows\System\zJxdMEG.exe
  2⤵
  PID:5332
- C:\Windows\System\VftXTuG.exe
  C:\Windows\System\VftXTuG.exe
  2⤵
  PID:5356
- C:\Windows\System\LIyPRsQ.exe
  C:\Windows\System\LIyPRsQ.exe
  2⤵
  PID:5400
- C:\Windows\System\ANnSTYh.exe
  C:\Windows\System\ANnSTYh.exe
  2⤵
  PID:5424
- C:\Windows\System\BynEXvt.exe
  C:\Windows\System\BynEXvt.exe
  2⤵
  PID:5440
- C:\Windows\System\pOxKtRW.exe
  C:\Windows\System\pOxKtRW.exe
  2⤵
  PID:5480
- C:\Windows\System\UaqNYmi.exe
  C:\Windows\System\UaqNYmi.exe
  2⤵
  PID:5516
- C:\Windows\System\GmVhZwd.exe
  C:\Windows\System\GmVhZwd.exe
  2⤵
  PID:5536
- C:\Windows\System\dcJfYZg.exe
  C:\Windows\System\dcJfYZg.exe
  2⤵
  PID:5564
- C:\Windows\System\aKktcWS.exe
  C:\Windows\System\aKktcWS.exe
  2⤵
  PID:5592
- C:\Windows\System\ogWjncZ.exe
  C:\Windows\System\ogWjncZ.exe
  2⤵
  PID:5620
- C:\Windows\System\MVaCJrY.exe
  C:\Windows\System\MVaCJrY.exe
  2⤵
  PID:5644
- C:\Windows\System\vmMnlbY.exe
  C:\Windows\System\vmMnlbY.exe
  2⤵
  PID:5664
- C:\Windows\System\CuNmFhc.exe
  C:\Windows\System\CuNmFhc.exe
  2⤵
  PID:5680
- C:\Windows\System\BkBOMTq.exe
  C:\Windows\System\BkBOMTq.exe
  2⤵
  PID:5724
- C:\Windows\System\bBzxsNJ.exe
  C:\Windows\System\bBzxsNJ.exe
  2⤵
  PID:5748
- C:\Windows\System\TtSqBkN.exe
  C:\Windows\System\TtSqBkN.exe
  2⤵
  PID:5788
- C:\Windows\System\zBVkOog.exe
  C:\Windows\System\zBVkOog.exe
  2⤵
  PID:5804
- C:\Windows\System\PNQupVB.exe
  C:\Windows\System\PNQupVB.exe
  2⤵
  PID:5844
- C:\Windows\System\jdfXtIr.exe
  C:\Windows\System\jdfXtIr.exe
  2⤵
  PID:5860
- C:\Windows\System\yhbDbuh.exe
  C:\Windows\System\yhbDbuh.exe
  2⤵
  PID:5900
- C:\Windows\System\tgnlvXn.exe
  C:\Windows\System\tgnlvXn.exe
  2⤵
  PID:5932
- C:\Windows\System\BgTFScF.exe
  C:\Windows\System\BgTFScF.exe
  2⤵
  PID:5956
- C:\Windows\System\wmrOWQd.exe
  C:\Windows\System\wmrOWQd.exe
  2⤵
  PID:5984
- C:\Windows\System\KCvUCsm.exe
  C:\Windows\System\KCvUCsm.exe
  2⤵
  PID:6004
- C:\Windows\System\SQCxyob.exe
  C:\Windows\System\SQCxyob.exe
  2⤵
  PID:6040
- C:\Windows\System\OZczCqW.exe
  C:\Windows\System\OZczCqW.exe
  2⤵
  PID:6056
- C:\Windows\System\cVqWmti.exe
  C:\Windows\System\cVqWmti.exe
  2⤵
  PID:6096
- C:\Windows\System\dEpmdCc.exe
  C:\Windows\System\dEpmdCc.exe
  2⤵
  PID:6124
- C:\Windows\System\vVcUJSr.exe
  C:\Windows\System\vVcUJSr.exe
  2⤵
  PID:5132
- C:\Windows\System\zJFKeYI.exe
  C:\Windows\System\zJFKeYI.exe
  2⤵
  PID:5172
- C:\Windows\System\vPvujMT.exe
  C:\Windows\System\vPvujMT.exe
  2⤵
  PID:5228
- C:\Windows\System\duCqsxE.exe
  C:\Windows\System\duCqsxE.exe
  2⤵
  PID:5296
- C:\Windows\System\AMtcvsq.exe
  C:\Windows\System\AMtcvsq.exe
  2⤵
  PID:3244
- C:\Windows\System\dFODKEX.exe
  C:\Windows\System\dFODKEX.exe
  2⤵
  PID:5432
- C:\Windows\System\NRjzMDn.exe
  C:\Windows\System\NRjzMDn.exe
  2⤵
  PID:5500
- C:\Windows\System\mmVLJph.exe
  C:\Windows\System\mmVLJph.exe
  2⤵
  PID:5552
- C:\Windows\System\PEWhZyn.exe
  C:\Windows\System\PEWhZyn.exe
  2⤵
  PID:5660
- C:\Windows\System\pVXPkrG.exe
  C:\Windows\System\pVXPkrG.exe
  2⤵
  PID:5732
- C:\Windows\System\YkOsHNp.exe
  C:\Windows\System\YkOsHNp.exe
  2⤵
  PID:5768
- C:\Windows\System\TVpVCkx.exe
  C:\Windows\System\TVpVCkx.exe
  2⤵
  PID:5840
- C:\Windows\System\gpmUgyp.exe
  C:\Windows\System\gpmUgyp.exe
  2⤵
  PID:5884
- C:\Windows\System\FeSdJQO.exe
  C:\Windows\System\FeSdJQO.exe
  2⤵
  PID:5948
- C:\Windows\System\RpfWYcb.exe
  C:\Windows\System\RpfWYcb.exe
  2⤵
  PID:6032
- C:\Windows\System\bAOhmBN.exe
  C:\Windows\System\bAOhmBN.exe
  2⤵
  PID:6092
- C:\Windows\System\rMaHJrw.exe
  C:\Windows\System\rMaHJrw.exe
  2⤵
  PID:5128
- C:\Windows\System\iPlnMsO.exe
  C:\Windows\System\iPlnMsO.exe
  2⤵
  PID:5328
- C:\Windows\System\GoopTQu.exe
  C:\Windows\System\GoopTQu.exe
  2⤵
  PID:5416
- C:\Windows\System\tTwPZZH.exe
  C:\Windows\System\tTwPZZH.exe
  2⤵
  PID:5584
- C:\Windows\System\fIqBNor.exe
  C:\Windows\System\fIqBNor.exe
  2⤵
  PID:5744
- C:\Windows\System\vonyEdV.exe
  C:\Windows\System\vonyEdV.exe
  2⤵
  PID:5924
- C:\Windows\System\Fogqily.exe
  C:\Windows\System\Fogqily.exe
  2⤵
  PID:6024
- C:\Windows\System\LKBnxbn.exe
  C:\Windows\System\LKBnxbn.exe
  2⤵
  PID:1508
- C:\Windows\System\ZprHYSR.exe
  C:\Windows\System\ZprHYSR.exe
  2⤵
  PID:2060
- C:\Windows\System\GYfUWED.exe
  C:\Windows\System\GYfUWED.exe
  2⤵
  PID:5496
- C:\Windows\System\dBDEfnS.exe
  C:\Windows\System\dBDEfnS.exe
  2⤵
  PID:5976
- C:\Windows\System\VoCFGWA.exe
  C:\Windows\System\VoCFGWA.exe
  2⤵
  PID:5156
- C:\Windows\System\SUGGlsG.exe
  C:\Windows\System\SUGGlsG.exe
  2⤵
  PID:1844
- C:\Windows\System\ucLofhS.exe
  C:\Windows\System\ucLofhS.exe
  2⤵
  PID:6156
- C:\Windows\System\weQjheh.exe
  C:\Windows\System\weQjheh.exe
  2⤵
  PID:6188
- C:\Windows\System\BXfHChX.exe
  C:\Windows\System\BXfHChX.exe
  2⤵
  PID:6204
- C:\Windows\System\ErHAWjf.exe
  C:\Windows\System\ErHAWjf.exe
  2⤵
  PID:6228
- C:\Windows\System\WJCBVVF.exe
  C:\Windows\System\WJCBVVF.exe
  2⤵
  PID:6268
- C:\Windows\System\uThUvnz.exe
  C:\Windows\System\uThUvnz.exe
  2⤵
  PID:6324
- C:\Windows\System\OwoqyWZ.exe
  C:\Windows\System\OwoqyWZ.exe
  2⤵
  PID:6352
- C:\Windows\System\XSquBry.exe
  C:\Windows\System\XSquBry.exe
  2⤵
  PID:6380
- C:\Windows\System\oObJsab.exe
  C:\Windows\System\oObJsab.exe
  2⤵
  PID:6408
- C:\Windows\System\hhtrxFZ.exe
  C:\Windows\System\hhtrxFZ.exe
  2⤵
  PID:6436
- C:\Windows\System\GPavicY.exe
  C:\Windows\System\GPavicY.exe
  2⤵
  PID:6464
- C:\Windows\System\BpflmsP.exe
  C:\Windows\System\BpflmsP.exe
  2⤵
  PID:6488
- C:\Windows\System\ymwMybL.exe
  C:\Windows\System\ymwMybL.exe
  2⤵
  PID:6520
- C:\Windows\System\gTtcvwz.exe
  C:\Windows\System\gTtcvwz.exe
  2⤵
  PID:6548
- C:\Windows\System\jveRJtn.exe
  C:\Windows\System\jveRJtn.exe
  2⤵
  PID:6576
- C:\Windows\System\DuOPDvF.exe
  C:\Windows\System\DuOPDvF.exe
  2⤵
  PID:6604
- C:\Windows\System\IKKGGSB.exe
  C:\Windows\System\IKKGGSB.exe
  2⤵
  PID:6636
- C:\Windows\System\ciGxGEF.exe
  C:\Windows\System\ciGxGEF.exe
  2⤵
  PID:6660
- C:\Windows\System\mwizvMB.exe
  C:\Windows\System\mwizvMB.exe
  2⤵
  PID:6704
- C:\Windows\System\ZuEDcAK.exe
  C:\Windows\System\ZuEDcAK.exe
  2⤵
  PID:6724
- C:\Windows\System\BKRBrWE.exe
  C:\Windows\System\BKRBrWE.exe
  2⤵
  PID:6756
- C:\Windows\System\BkGRnOY.exe
  C:\Windows\System\BkGRnOY.exe
  2⤵
  PID:6784
- C:\Windows\System\DIZhJIx.exe
  C:\Windows\System\DIZhJIx.exe
  2⤵
  PID:6808
- C:\Windows\System\quqzHBR.exe
  C:\Windows\System\quqzHBR.exe
  2⤵
  PID:6828
- C:\Windows\System\aIizHuR.exe
  C:\Windows\System\aIizHuR.exe
  2⤵
  PID:6856
- C:\Windows\System\fSPfqoa.exe
  C:\Windows\System\fSPfqoa.exe
  2⤵
  PID:6896
- C:\Windows\System\wcTLVgO.exe
  C:\Windows\System\wcTLVgO.exe
  2⤵
  PID:6924
- C:\Windows\System\DTyjRot.exe
  C:\Windows\System\DTyjRot.exe
  2⤵
  PID:6952
- C:\Windows\System\WaOAKKI.exe
  C:\Windows\System\WaOAKKI.exe
  2⤵
  PID:6984
- C:\Windows\System\esTwhIM.exe
  C:\Windows\System\esTwhIM.exe
  2⤵
  PID:7008
- C:\Windows\System\cETmRte.exe
  C:\Windows\System\cETmRte.exe
  2⤵
  PID:7040
- C:\Windows\System\OIWxYPh.exe
  C:\Windows\System\OIWxYPh.exe
  2⤵
  PID:7060
- C:\Windows\System\OBaGlwh.exe
  C:\Windows\System\OBaGlwh.exe
  2⤵
  PID:7096
- C:\Windows\System\RFrUdcI.exe
  C:\Windows\System\RFrUdcI.exe
  2⤵
  PID:7132
- C:\Windows\System\pPguAPh.exe
  C:\Windows\System\pPguAPh.exe
  2⤵
  PID:7164
- C:\Windows\System\kiVFTAu.exe
  C:\Windows\System\kiVFTAu.exe
  2⤵
  PID:6172
- C:\Windows\System\NaHnptt.exe
  C:\Windows\System\NaHnptt.exe
  2⤵
  PID:6216
- C:\Windows\System\ZStcmEq.exe
  C:\Windows\System\ZStcmEq.exe
  2⤵
  PID:6264
- C:\Windows\System\NjTVItf.exe
  C:\Windows\System\NjTVItf.exe
  2⤵
  PID:6348
- C:\Windows\System\vaquQZP.exe
  C:\Windows\System\vaquQZP.exe
  2⤵
  PID:6392
- C:\Windows\System\wGEBxDH.exe
  C:\Windows\System\wGEBxDH.exe
  2⤵
  PID:6472
- C:\Windows\System\dMeMSkG.exe
  C:\Windows\System\dMeMSkG.exe
  2⤵
  PID:6540
- C:\Windows\System\oaYZndi.exe
  C:\Windows\System\oaYZndi.exe
  2⤵
  PID:6596
- C:\Windows\System\sVnOXcM.exe
  C:\Windows\System\sVnOXcM.exe
  2⤵
  PID:1108
- C:\Windows\System\xsFYpAZ.exe
  C:\Windows\System\xsFYpAZ.exe
  2⤵
  PID:6684
- C:\Windows\System\ZhBBlvz.exe
  C:\Windows\System\ZhBBlvz.exe
  2⤵
  PID:6772
- C:\Windows\System\UIDOzcb.exe
  C:\Windows\System\UIDOzcb.exe
  2⤵
  PID:6820
- C:\Windows\System\tuOLDZr.exe
  C:\Windows\System\tuOLDZr.exe
  2⤵
  PID:6892
- C:\Windows\System\iCFOKwm.exe
  C:\Windows\System\iCFOKwm.exe
  2⤵
  PID:6964
- C:\Windows\System\FnPrjvQ.exe
  C:\Windows\System\FnPrjvQ.exe
  2⤵
  PID:7024
- C:\Windows\System\iLHKdAW.exe
  C:\Windows\System\iLHKdAW.exe
  2⤵
  PID:7088
- C:\Windows\System\RUHIcLY.exe
  C:\Windows\System\RUHIcLY.exe
  2⤵
  PID:7140
- C:\Windows\System\RaLUkgg.exe
  C:\Windows\System\RaLUkgg.exe
  2⤵
  PID:6176
- C:\Windows\System\JhDsMIS.exe
  C:\Windows\System\JhDsMIS.exe
  2⤵
  PID:6340
- C:\Windows\System\mUysibn.exe
  C:\Windows\System\mUysibn.exe
  2⤵
  PID:6432
- C:\Windows\System\NQUnsBa.exe
  C:\Windows\System\NQUnsBa.exe
  2⤵
  PID:6680
- C:\Windows\System\hajjVEI.exe
  C:\Windows\System\hajjVEI.exe
  2⤵
  PID:1272
- C:\Windows\System\vciycdT.exe
  C:\Windows\System\vciycdT.exe
  2⤵
  PID:6824
- C:\Windows\System\jEhaiAt.exe
  C:\Windows\System\jEhaiAt.exe
  2⤵
  PID:6992
- C:\Windows\System\oJVWtyk.exe
  C:\Windows\System\oJVWtyk.exe
  2⤵
  PID:6748
- C:\Windows\System\AwGOySn.exe
  C:\Windows\System\AwGOySn.exe
  2⤵
  PID:5320
- C:\Windows\System\DnGvLwB.exe
  C:\Windows\System\DnGvLwB.exe
  2⤵
  PID:5008
- C:\Windows\System\aNsfEPO.exe
  C:\Windows\System\aNsfEPO.exe
  2⤵
  PID:6740
- C:\Windows\System\CwJrjZn.exe
  C:\Windows\System\CwJrjZn.exe
  2⤵
  PID:5796
- C:\Windows\System\HtZiglR.exe
  C:\Windows\System\HtZiglR.exe
  2⤵
  PID:2900
- C:\Windows\System\WgpOqgL.exe
  C:\Windows\System\WgpOqgL.exe
  2⤵
  PID:6644
- C:\Windows\System\lfArbYo.exe
  C:\Windows\System\lfArbYo.exe
  2⤵
  PID:7192
- C:\Windows\System\EKSVEyk.exe
  C:\Windows\System\EKSVEyk.exe
  2⤵
  PID:7224
- C:\Windows\System\MzjTdvt.exe
  C:\Windows\System\MzjTdvt.exe
  2⤵
  PID:7248
- C:\Windows\System\qIHGhKQ.exe
  C:\Windows\System\qIHGhKQ.exe
  2⤵
  PID:7264
- C:\Windows\System\iTAjcIM.exe
  C:\Windows\System\iTAjcIM.exe
  2⤵
  PID:7296
- C:\Windows\System\pGbKRjQ.exe
  C:\Windows\System\pGbKRjQ.exe
  2⤵
  PID:7340
- C:\Windows\System\GryPPyh.exe
  C:\Windows\System\GryPPyh.exe
  2⤵
  PID:7360
- C:\Windows\System\gNuljrW.exe
  C:\Windows\System\gNuljrW.exe
  2⤵
  PID:7388
- C:\Windows\System\SpFhYkK.exe
  C:\Windows\System\SpFhYkK.exe
  2⤵
  PID:7404
- C:\Windows\System\LDTVGxF.exe
  C:\Windows\System\LDTVGxF.exe
  2⤵
  PID:7444
- C:\Windows\System\QfaMJAf.exe
  C:\Windows\System\QfaMJAf.exe
  2⤵
  PID:7460
- C:\Windows\System\UNSBejJ.exe
  C:\Windows\System\UNSBejJ.exe
  2⤵
  PID:7500
- C:\Windows\System\WJpCKtT.exe
  C:\Windows\System\WJpCKtT.exe
  2⤵
  PID:7516
- C:\Windows\System\snYAnDj.exe
  C:\Windows\System\snYAnDj.exe
  2⤵
  PID:7548
- C:\Windows\System\bTFuBBF.exe
  C:\Windows\System\bTFuBBF.exe
  2⤵
  PID:7584
- C:\Windows\System\NOVkrZe.exe
  C:\Windows\System\NOVkrZe.exe
  2⤵
  PID:7604
- C:\Windows\System\EMJZqtl.exe
  C:\Windows\System\EMJZqtl.exe
  2⤵
  PID:7640
- C:\Windows\System\ulPAKEw.exe
  C:\Windows\System\ulPAKEw.exe
  2⤵
  PID:7668
- C:\Windows\System\PViLLDt.exe
  C:\Windows\System\PViLLDt.exe
  2⤵
  PID:7696
- C:\Windows\System\DAZfPSd.exe
  C:\Windows\System\DAZfPSd.exe
  2⤵
  PID:7712
- C:\Windows\System\xTqwFIZ.exe
  C:\Windows\System\xTqwFIZ.exe
  2⤵
  PID:7752
- C:\Windows\System\SBRhpOZ.exe
  C:\Windows\System\SBRhpOZ.exe
  2⤵
  PID:7768
- C:\Windows\System\HpzcQFW.exe
  C:\Windows\System\HpzcQFW.exe
  2⤵
  PID:7808
- C:\Windows\System\hihjXVh.exe
  C:\Windows\System\hihjXVh.exe
  2⤵
  PID:7836
- C:\Windows\System\nAcBRpd.exe
  C:\Windows\System\nAcBRpd.exe
  2⤵
  PID:7864
- C:\Windows\System\zYLAvTA.exe
  C:\Windows\System\zYLAvTA.exe
  2⤵
  PID:7892
- C:\Windows\System\CSVtoMa.exe
  C:\Windows\System\CSVtoMa.exe
  2⤵
  PID:7924
- C:\Windows\System\YThFybq.exe
  C:\Windows\System\YThFybq.exe
  2⤵
  PID:7940
- C:\Windows\System\jBqpPPa.exe
  C:\Windows\System\jBqpPPa.exe
  2⤵
  PID:7968
- C:\Windows\System\GIvXblN.exe
  C:\Windows\System\GIvXblN.exe
  2⤵
  PID:8012
- C:\Windows\System\kEICUEN.exe
  C:\Windows\System\kEICUEN.exe
  2⤵
  PID:8040
- C:\Windows\System\ERqBksW.exe
  C:\Windows\System\ERqBksW.exe
  2⤵
  PID:8068
- C:\Windows\System\FgQjZzO.exe
  C:\Windows\System\FgQjZzO.exe
  2⤵
  PID:8100
- C:\Windows\System\zFmFZQe.exe
  C:\Windows\System\zFmFZQe.exe
  2⤵
  PID:8128
- C:\Windows\System\DEOSlQc.exe
  C:\Windows\System\DEOSlQc.exe
  2⤵
  PID:8156
- C:\Windows\System\mKgVzPI.exe
  C:\Windows\System\mKgVzPI.exe
  2⤵
  PID:7116
- C:\Windows\System\aITZHSG.exe
  C:\Windows\System\aITZHSG.exe
  2⤵
  PID:7304
- C:\Windows\System\XZEaHwv.exe
  C:\Windows\System\XZEaHwv.exe
  2⤵
  PID:7352
- C:\Windows\System\JHMvvrg.exe
  C:\Windows\System\JHMvvrg.exe
  2⤵
  PID:7416
- C:\Windows\System\bLpicGN.exe
  C:\Windows\System\bLpicGN.exe
  2⤵
  PID:7476
- C:\Windows\System\zvoirpB.exe
  C:\Windows\System\zvoirpB.exe
  2⤵
  PID:7572
- C:\Windows\System\rUvoxPC.exe
  C:\Windows\System\rUvoxPC.exe
  2⤵
  PID:7612
- C:\Windows\System\tTwMTwi.exe
  C:\Windows\System\tTwMTwi.exe
  2⤵
  PID:7688
- C:\Windows\System\WLNjBvY.exe
  C:\Windows\System\WLNjBvY.exe
  2⤵
  PID:7744
- C:\Windows\System\iCLgkpl.exe
  C:\Windows\System\iCLgkpl.exe
  2⤵
  PID:7856
- C:\Windows\System\ygjxgbY.exe
  C:\Windows\System\ygjxgbY.exe
  2⤵
  PID:1564
- C:\Windows\System\RQHgLqf.exe
  C:\Windows\System\RQHgLqf.exe
  2⤵
  PID:1848
- C:\Windows\System\MlZgefm.exe
  C:\Windows\System\MlZgefm.exe
  2⤵
  PID:7920
- C:\Windows\System\BnhJWCJ.exe
  C:\Windows\System\BnhJWCJ.exe
  2⤵
  PID:936
- C:\Windows\System\QqLmHAc.exe
  C:\Windows\System\QqLmHAc.exe
  2⤵
  PID:7976
- C:\Windows\System\MFunpDY.exe
  C:\Windows\System\MFunpDY.exe
  2⤵
  PID:8060
- C:\Windows\System\pLHxnIJ.exe
  C:\Windows\System\pLHxnIJ.exe
  2⤵
  PID:3084
- C:\Windows\System\coKigKH.exe
  C:\Windows\System\coKigKH.exe
  2⤵
  PID:7148
- C:\Windows\System\iVfDapv.exe
  C:\Windows\System\iVfDapv.exe
  2⤵
  PID:8148
- C:\Windows\System\gvVBPzH.exe
  C:\Windows\System\gvVBPzH.exe
  2⤵
  PID:7244
- C:\Windows\System\AHijFPY.exe
  C:\Windows\System\AHijFPY.exe
  2⤵
  PID:7456
- C:\Windows\System\ruSrtlG.exe
  C:\Windows\System\ruSrtlG.exe
  2⤵
  PID:7596
- C:\Windows\System\MdlyoHr.exe
  C:\Windows\System\MdlyoHr.exe
  2⤵
  PID:7848
- C:\Windows\System\SuqKrjm.exe
  C:\Windows\System\SuqKrjm.exe
  2⤵
  PID:4072
- C:\Windows\System\FDSdtte.exe
  C:\Windows\System\FDSdtte.exe
  2⤵
  PID:7936
- C:\Windows\System\wewexis.exe
  C:\Windows\System\wewexis.exe
  2⤵
  PID:2648
- C:\Windows\System\utcWQUL.exe
  C:\Windows\System\utcWQUL.exe
  2⤵
  PID:4864
- C:\Windows\System\tFuPEzZ.exe
  C:\Windows\System\tFuPEzZ.exe
  2⤵
  PID:60
- C:\Windows\System\StcdTae.exe
  C:\Windows\System\StcdTae.exe
  2⤵
  PID:3636
- C:\Windows\System\ZNSitqI.exe
  C:\Windows\System\ZNSitqI.exe
  2⤵
  PID:1384
- C:\Windows\System\SdwFVKX.exe
  C:\Windows\System\SdwFVKX.exe
  2⤵
  PID:7800
- C:\Windows\System\CCYrdUP.exe
  C:\Windows\System\CCYrdUP.exe
  2⤵
  PID:2400
- C:\Windows\System\ZjCScRi.exe
  C:\Windows\System\ZjCScRi.exe
  2⤵
  PID:7400
- C:\Windows\System\QdIheLP.exe
  C:\Windows\System\QdIheLP.exe
  2⤵
  PID:8228
- C:\Windows\System\GAFNHKZ.exe
  C:\Windows\System\GAFNHKZ.exe
  2⤵
  PID:8256
- C:\Windows\System\uWLBpOw.exe
  C:\Windows\System\uWLBpOw.exe
  2⤵
  PID:8284
- C:\Windows\System\FvSWJuX.exe
  C:\Windows\System\FvSWJuX.exe
  2⤵
  PID:8312
- C:\Windows\System\msNseTG.exe
  C:\Windows\System\msNseTG.exe
  2⤵
  PID:8348
- C:\Windows\System\LMCgJiD.exe
  C:\Windows\System\LMCgJiD.exe
  2⤵
  PID:8376
- C:\Windows\System\KhlfjAq.exe
  C:\Windows\System\KhlfjAq.exe
  2⤵
  PID:8404
- C:\Windows\System\hMkNXtY.exe
  C:\Windows\System\hMkNXtY.exe
  2⤵
  PID:8432
- C:\Windows\System\LqngffU.exe
  C:\Windows\System\LqngffU.exe
  2⤵
  PID:8460
- C:\Windows\System\lizrYLk.exe
  C:\Windows\System\lizrYLk.exe
  2⤵
  PID:8488
- C:\Windows\System\mHKtjlm.exe
  C:\Windows\System\mHKtjlm.exe
  2⤵
  PID:8516
- C:\Windows\System\tRjrQgQ.exe
  C:\Windows\System\tRjrQgQ.exe
  2⤵
  PID:8544
- C:\Windows\System\zAxZwBv.exe
  C:\Windows\System\zAxZwBv.exe
  2⤵
  PID:8572
- C:\Windows\System\gPwFZSG.exe
  C:\Windows\System\gPwFZSG.exe
  2⤵
  PID:8600
- C:\Windows\System\yhLHmwA.exe
  C:\Windows\System\yhLHmwA.exe
  2⤵
  PID:8628
- C:\Windows\System\odhfham.exe
  C:\Windows\System\odhfham.exe
  2⤵
  PID:8656
- C:\Windows\System\YNmkgmi.exe
  C:\Windows\System\YNmkgmi.exe
  2⤵
  PID:8684
- C:\Windows\System\lxMMGek.exe
  C:\Windows\System\lxMMGek.exe
  2⤵
  PID:8712
- C:\Windows\System\NaSyZFb.exe
  C:\Windows\System\NaSyZFb.exe
  2⤵
  PID:8732
- C:\Windows\System\cZzoIjN.exe
  C:\Windows\System\cZzoIjN.exe
  2⤵
  PID:8768
- C:\Windows\System\BKxlKAb.exe
  C:\Windows\System\BKxlKAb.exe
  2⤵
  PID:8796
- C:\Windows\System\oVuCZCr.exe
  C:\Windows\System\oVuCZCr.exe
  2⤵
  PID:8824
- C:\Windows\System\dedJEwm.exe
  C:\Windows\System\dedJEwm.exe
  2⤵
  PID:8852
- C:\Windows\System\uvvzQVS.exe
  C:\Windows\System\uvvzQVS.exe
  2⤵
  PID:8880
- C:\Windows\System\YYkbslC.exe
  C:\Windows\System\YYkbslC.exe
  2⤵
  PID:8912
- C:\Windows\System\mGEoNSA.exe
  C:\Windows\System\mGEoNSA.exe
  2⤵
  PID:8940
- C:\Windows\System\TRnmmAt.exe
  C:\Windows\System\TRnmmAt.exe
  2⤵
  PID:8968
- C:\Windows\System\VMpmaNF.exe
  C:\Windows\System\VMpmaNF.exe
  2⤵
  PID:8996
- C:\Windows\System\UazngrJ.exe
  C:\Windows\System\UazngrJ.exe
  2⤵
  PID:9024
- C:\Windows\System\UwIRqBz.exe
  C:\Windows\System\UwIRqBz.exe
  2⤵
  PID:9052
- C:\Windows\System\AwZDCby.exe
  C:\Windows\System\AwZDCby.exe
  2⤵
  PID:9080
- C:\Windows\System\cvvEplA.exe
  C:\Windows\System\cvvEplA.exe
  2⤵
  PID:9116
- C:\Windows\System\cAyIHkG.exe
  C:\Windows\System\cAyIHkG.exe
  2⤵
  PID:9140
- C:\Windows\System\xBekArF.exe
  C:\Windows\System\xBekArF.exe
  2⤵
  PID:9168
- C:\Windows\System\USjGhwK.exe
  C:\Windows\System\USjGhwK.exe
  2⤵
  PID:9200
- C:\Windows\System\CtqjGON.exe
  C:\Windows\System\CtqjGON.exe
  2⤵
  PID:8212
- C:\Windows\System\JMcoZnm.exe
  C:\Windows\System\JMcoZnm.exe
  2⤵
  PID:2576
- C:\Windows\System\YrVJfjg.exe
  C:\Windows\System\YrVJfjg.exe
  2⤵
  PID:8268
- C:\Windows\System\cgjSjXK.exe
  C:\Windows\System\cgjSjXK.exe
  2⤵
  PID:8340
- C:\Windows\System\OfhjXLn.exe
  C:\Windows\System\OfhjXLn.exe
  2⤵
  PID:8396
- C:\Windows\System\dunmgPU.exe
  C:\Windows\System\dunmgPU.exe
  2⤵
  PID:8444
- C:\Windows\System\qrFxzYs.exe
  C:\Windows\System\qrFxzYs.exe
  2⤵
  PID:8528
- C:\Windows\System\OafenII.exe
  C:\Windows\System\OafenII.exe
  2⤵
  PID:8592
- C:\Windows\System\cpXNgpk.exe
  C:\Windows\System\cpXNgpk.exe
  2⤵
  PID:8648
- C:\Windows\System\jkDaYsP.exe
  C:\Windows\System\jkDaYsP.exe
  2⤵
  PID:8724
- C:\Windows\System\JzxPFiZ.exe
  C:\Windows\System\JzxPFiZ.exe
  2⤵
  PID:8788
- C:\Windows\System\meaAEuG.exe
  C:\Windows\System\meaAEuG.exe
  2⤵
  PID:8848
- C:\Windows\System\ATABwfP.exe
  C:\Windows\System\ATABwfP.exe
  2⤵
  PID:8952
- C:\Windows\System\AgqHJKE.exe
  C:\Windows\System\AgqHJKE.exe
  2⤵
  PID:8988
- C:\Windows\System\awXKRBr.exe
  C:\Windows\System\awXKRBr.exe
  2⤵
  PID:9064
- C:\Windows\System\lDSGUoT.exe
  C:\Windows\System\lDSGUoT.exe
  2⤵
  PID:9132
- C:\Windows\System\mSgrZSK.exe
  C:\Windows\System\mSgrZSK.exe
  2⤵
  PID:9196
- C:\Windows\System\jvIWZMh.exe
  C:\Windows\System\jvIWZMh.exe
  2⤵
  PID:8204
- C:\Windows\System\iLEBMtG.exe
  C:\Windows\System\iLEBMtG.exe
  2⤵
  PID:8308
- C:\Windows\System\otexlrk.exe
  C:\Windows\System\otexlrk.exe
  2⤵
  PID:8448
- C:\Windows\System\ysOpvYG.exe
  C:\Windows\System\ysOpvYG.exe
  2⤵
  PID:8584
- C:\Windows\System\ctHhntD.exe
  C:\Windows\System\ctHhntD.exe
  2⤵
  PID:8820
- C:\Windows\System\RzHgaza.exe
  C:\Windows\System\RzHgaza.exe
  2⤵
  PID:8844
- C:\Windows\System\ZxRNsiO.exe
  C:\Windows\System\ZxRNsiO.exe
  2⤵
  PID:2112
- C:\Windows\System\rBisXKJ.exe
  C:\Windows\System\rBisXKJ.exe
  2⤵
  PID:8936
- C:\Windows\System\szgWcXm.exe
  C:\Windows\System\szgWcXm.exe
  2⤵
  PID:9044
- C:\Windows\System\pQMyyXa.exe
  C:\Windows\System\pQMyyXa.exe
  2⤵
  PID:7948
- C:\Windows\System\PaVugwx.exe
  C:\Windows\System\PaVugwx.exe
  2⤵
  PID:8368
- C:\Windows\System\YmCXBPg.exe
  C:\Windows\System\YmCXBPg.exe
  2⤵
  PID:8780
- C:\Windows\System\zrCyjXs.exe
  C:\Windows\System\zrCyjXs.exe
  2⤵
  PID:9128
- C:\Windows\System\aXLGakx.exe
  C:\Windows\System\aXLGakx.exe
  2⤵
  PID:9192
- C:\Windows\System\XiMwXsQ.exe
  C:\Windows\System\XiMwXsQ.exe
  2⤵
  PID:8760
- C:\Windows\System\zQEoPCO.exe
  C:\Windows\System\zQEoPCO.exe
  2⤵
  PID:8024
- C:\Windows\System\ykNiDlV.exe
  C:\Windows\System\ykNiDlV.exe
  2⤵
  PID:9160
- C:\Windows\System\JkwQllq.exe
  C:\Windows\System\JkwQllq.exe
  2⤵
  PID:9244
- C:\Windows\System\McBsayn.exe
  C:\Windows\System\McBsayn.exe
  2⤵
  PID:9272
- C:\Windows\System\JoyyFin.exe
  C:\Windows\System\JoyyFin.exe
  2⤵
  PID:9300
- C:\Windows\System\dCfmXCx.exe
  C:\Windows\System\dCfmXCx.exe
  2⤵
  PID:9328
- C:\Windows\System\JVHAQhD.exe
  C:\Windows\System\JVHAQhD.exe
  2⤵
  PID:9356
- C:\Windows\System\cOWhxnw.exe
  C:\Windows\System\cOWhxnw.exe
  2⤵
  PID:9384
- C:\Windows\System\tTongcC.exe
  C:\Windows\System\tTongcC.exe
  2⤵
  PID:9412
- C:\Windows\System\NSdHmYo.exe
  C:\Windows\System\NSdHmYo.exe
  2⤵
  PID:9440
- C:\Windows\System\oILnnct.exe
  C:\Windows\System\oILnnct.exe
  2⤵
  PID:9468
- C:\Windows\System\MqBppMm.exe
  C:\Windows\System\MqBppMm.exe
  2⤵
  PID:9496
- C:\Windows\System\ZmemIoh.exe
  C:\Windows\System\ZmemIoh.exe
  2⤵
  PID:9524
- C:\Windows\System\FqBvLEL.exe
  C:\Windows\System\FqBvLEL.exe
  2⤵
  PID:9552
- C:\Windows\System\PiPaztB.exe
  C:\Windows\System\PiPaztB.exe
  2⤵
  PID:9592
- C:\Windows\System\BqArCul.exe
  C:\Windows\System\BqArCul.exe
  2⤵
  PID:9608
- C:\Windows\System\lLeFgnJ.exe
  C:\Windows\System\lLeFgnJ.exe
  2⤵
  PID:9636
- C:\Windows\System\OczzVfg.exe
  C:\Windows\System\OczzVfg.exe
  2⤵
  PID:9664
- C:\Windows\System\fhccKDz.exe
  C:\Windows\System\fhccKDz.exe
  2⤵
  PID:9692
- C:\Windows\System\lAGOhMx.exe
  C:\Windows\System\lAGOhMx.exe
  2⤵
  PID:9720
- C:\Windows\System\XVVEQqN.exe
  C:\Windows\System\XVVEQqN.exe
  2⤵
  PID:9748
- C:\Windows\System\LIUSVuQ.exe
  C:\Windows\System\LIUSVuQ.exe
  2⤵
  PID:9776
- C:\Windows\System\RBuyTai.exe
  C:\Windows\System\RBuyTai.exe
  2⤵
  PID:9804
- C:\Windows\System\MSCicOq.exe
  C:\Windows\System\MSCicOq.exe
  2⤵
  PID:9832
- C:\Windows\System\rJCMwgx.exe
  C:\Windows\System\rJCMwgx.exe
  2⤵
  PID:9860
- C:\Windows\System\PlsIchf.exe
  C:\Windows\System\PlsIchf.exe
  2⤵
  PID:9888
- C:\Windows\System\qByyzqs.exe
  C:\Windows\System\qByyzqs.exe
  2⤵
  PID:9916
- C:\Windows\System\tIZvmQr.exe
  C:\Windows\System\tIZvmQr.exe
  2⤵
  PID:9944
- C:\Windows\System\YtDJFiW.exe
  C:\Windows\System\YtDJFiW.exe
  2⤵
  PID:9972
- C:\Windows\System\VanEJOP.exe
  C:\Windows\System\VanEJOP.exe
  2⤵
  PID:10000
- C:\Windows\System\UqpseZS.exe
  C:\Windows\System\UqpseZS.exe
  2⤵
  PID:10032
- C:\Windows\System\cNBYXrk.exe
  C:\Windows\System\cNBYXrk.exe
  2⤵
  PID:10060
- C:\Windows\System\ESZVPfl.exe
  C:\Windows\System\ESZVPfl.exe
  2⤵
  PID:10088
- C:\Windows\System\ujJdQJr.exe
  C:\Windows\System\ujJdQJr.exe
  2⤵
  PID:10116
- C:\Windows\System\OVSfAwX.exe
  C:\Windows\System\OVSfAwX.exe
  2⤵
  PID:10144
- C:\Windows\System\cSXyFJt.exe
  C:\Windows\System\cSXyFJt.exe
  2⤵
  PID:10172
- C:\Windows\System\mThhimZ.exe
  C:\Windows\System\mThhimZ.exe
  2⤵
  PID:10200
- C:\Windows\System\qiZMMDH.exe
  C:\Windows\System\qiZMMDH.exe
  2⤵
  PID:10228
- C:\Windows\System\OTHrnkr.exe
  C:\Windows\System\OTHrnkr.exe
  2⤵
  PID:9256
- C:\Windows\System\cTTfPwG.exe
  C:\Windows\System\cTTfPwG.exe
  2⤵
  PID:9320
- C:\Windows\System\ptuTaHP.exe
  C:\Windows\System\ptuTaHP.exe
  2⤵
  PID:9380
- C:\Windows\System\EOZVwor.exe
  C:\Windows\System\EOZVwor.exe
  2⤵
  PID:9456
- C:\Windows\System\YAyZbdj.exe
  C:\Windows\System\YAyZbdj.exe
  2⤵
  PID:9516
- C:\Windows\System\osWihbH.exe
  C:\Windows\System\osWihbH.exe
  2⤵
  PID:9588
- C:\Windows\System\DrFmGVn.exe
  C:\Windows\System\DrFmGVn.exe
  2⤵
  PID:9648
- C:\Windows\System\GCAlGQm.exe
  C:\Windows\System\GCAlGQm.exe
  2⤵
  PID:9704
- C:\Windows\System\DvmzZoq.exe
  C:\Windows\System\DvmzZoq.exe
  2⤵
  PID:9772
- C:\Windows\System\MztIgdz.exe
  C:\Windows\System\MztIgdz.exe
  2⤵
  PID:9828
- C:\Windows\System\xABIdWZ.exe
  C:\Windows\System\xABIdWZ.exe
  2⤵
  PID:9900
- C:\Windows\System\DQifyuL.exe
  C:\Windows\System\DQifyuL.exe
  2⤵
  PID:9964
- C:\Windows\System\utKVrZD.exe
  C:\Windows\System\utKVrZD.exe
  2⤵
  PID:10024
- C:\Windows\System\tBXhBec.exe
  C:\Windows\System\tBXhBec.exe
  2⤵
  PID:10100
- C:\Windows\System\zCjfEro.exe
  C:\Windows\System\zCjfEro.exe
  2⤵
  PID:10164
- C:\Windows\System\iMsUMyP.exe
  C:\Windows\System\iMsUMyP.exe
  2⤵
  PID:10224
- C:\Windows\System\UPwrdhn.exe
  C:\Windows\System\UPwrdhn.exe
  2⤵
  PID:9352
- C:\Windows\System\PffDIKP.exe
  C:\Windows\System\PffDIKP.exe
  2⤵
  PID:9492
- C:\Windows\System\jAKUXPR.exe
  C:\Windows\System\jAKUXPR.exe
  2⤵
  PID:9628
- C:\Windows\System\uHXxVrj.exe
  C:\Windows\System\uHXxVrj.exe
  2⤵
  PID:9796
- C:\Windows\System\atSKvKV.exe
  C:\Windows\System\atSKvKV.exe
  2⤵
  PID:9928
- C:\Windows\System\gjAiIfg.exe
  C:\Windows\System\gjAiIfg.exe
  2⤵
  PID:10084
- C:\Windows\System\jHebPjo.exe
  C:\Windows\System\jHebPjo.exe
  2⤵
  PID:9240
- C:\Windows\System\gnCQfpM.exe
  C:\Windows\System\gnCQfpM.exe
  2⤵
  PID:9632
- C:\Windows\System\OKLhLyX.exe
  C:\Windows\System\OKLhLyX.exe
  2⤵
  PID:9936
- C:\Windows\System\GkXHNrJ.exe
  C:\Windows\System\GkXHNrJ.exe
  2⤵
  PID:9424
- C:\Windows\System\zFxqoPs.exe
  C:\Windows\System\zFxqoPs.exe
  2⤵
  PID:10212
- C:\Windows\System\xdfSNfL.exe
  C:\Windows\System\xdfSNfL.exe
  2⤵
  PID:10248
- C:\Windows\System\sQscosB.exe
  C:\Windows\System\sQscosB.exe
  2⤵
  PID:10276
- C:\Windows\System\RZVnucX.exe
  C:\Windows\System\RZVnucX.exe
  2⤵
  PID:10304
- C:\Windows\System\thBpBLw.exe
  C:\Windows\System\thBpBLw.exe
  2⤵
  PID:10340
- C:\Windows\System\RCvgnqn.exe
  C:\Windows\System\RCvgnqn.exe
  2⤵
  PID:10360
- C:\Windows\System\tusDtbJ.exe
  C:\Windows\System\tusDtbJ.exe
  2⤵
  PID:10388
- C:\Windows\System\LMVdnRb.exe
  C:\Windows\System\LMVdnRb.exe
  2⤵
  PID:10416
- C:\Windows\System\Iwqmodu.exe
  C:\Windows\System\Iwqmodu.exe
  2⤵
  PID:10444
- C:\Windows\System\yJPUrhw.exe
  C:\Windows\System\yJPUrhw.exe
  2⤵
  PID:10472
- C:\Windows\System\REKJRkJ.exe
  C:\Windows\System\REKJRkJ.exe
  2⤵
  PID:10500
- C:\Windows\System\CksdXDu.exe
  C:\Windows\System\CksdXDu.exe
  2⤵
  PID:10528
- C:\Windows\System\ROTutqa.exe
  C:\Windows\System\ROTutqa.exe
  2⤵
  PID:10556
- C:\Windows\System\LSiHSUl.exe
  C:\Windows\System\LSiHSUl.exe
  2⤵
  PID:10584
- C:\Windows\System\lcgtnwJ.exe
  C:\Windows\System\lcgtnwJ.exe
  2⤵
  PID:10612
- C:\Windows\System\ahQhHZw.exe
  C:\Windows\System\ahQhHZw.exe
  2⤵
  PID:10640
- C:\Windows\System\DQZawzG.exe
  C:\Windows\System\DQZawzG.exe
  2⤵
  PID:10672
- C:\Windows\System\MwZLZJn.exe
  C:\Windows\System\MwZLZJn.exe
  2⤵
  PID:10700
- C:\Windows\System\TRRyHNw.exe
  C:\Windows\System\TRRyHNw.exe
  2⤵
  PID:10716
- C:\Windows\System\AyjiAiW.exe
  C:\Windows\System\AyjiAiW.exe
  2⤵
  PID:10756
- C:\Windows\System\HLQTVDP.exe
  C:\Windows\System\HLQTVDP.exe
  2⤵
  PID:10784
- C:\Windows\System\MSrpybl.exe
  C:\Windows\System\MSrpybl.exe
  2⤵
  PID:10812
- C:\Windows\System\UZtTgav.exe
  C:\Windows\System\UZtTgav.exe
  2⤵
  PID:10840
- C:\Windows\System\GvjeRUc.exe
  C:\Windows\System\GvjeRUc.exe
  2⤵
  PID:10868
- C:\Windows\System\zaOpiHF.exe
  C:\Windows\System\zaOpiHF.exe
  2⤵
  PID:10896
- C:\Windows\System\hlZMyjD.exe
  C:\Windows\System\hlZMyjD.exe
  2⤵
  PID:10924
- C:\Windows\System\qGlOLZK.exe
  C:\Windows\System\qGlOLZK.exe
  2⤵
  PID:10952
- C:\Windows\System\GmykPhu.exe
  C:\Windows\System\GmykPhu.exe
  2⤵
  PID:10980
- C:\Windows\System\dobEOmg.exe
  C:\Windows\System\dobEOmg.exe
  2⤵
  PID:11008
- C:\Windows\System\DEfbUfA.exe
  C:\Windows\System\DEfbUfA.exe
  2⤵
  PID:11036
- C:\Windows\System\mcMWGSt.exe
  C:\Windows\System\mcMWGSt.exe
  2⤵
  PID:11064
- C:\Windows\System\OStPAaH.exe
  C:\Windows\System\OStPAaH.exe
  2⤵
  PID:11092
- C:\Windows\System\mCTvEof.exe
  C:\Windows\System\mCTvEof.exe
  2⤵
  PID:11120
- C:\Windows\System\XLTopKm.exe
  C:\Windows\System\XLTopKm.exe
  2⤵
  PID:11148
- C:\Windows\System\qmKFsCD.exe
  C:\Windows\System\qmKFsCD.exe
  2⤵
  PID:11176
- C:\Windows\System\aFLEUDe.exe
  C:\Windows\System\aFLEUDe.exe
  2⤵
  PID:11204
- C:\Windows\System\iRLmLQl.exe
  C:\Windows\System\iRLmLQl.exe
  2⤵
  PID:11232
- C:\Windows\System\ttpdQfX.exe
  C:\Windows\System\ttpdQfX.exe
  2⤵
  PID:11260
- C:\Windows\System\CodcVPA.exe
  C:\Windows\System\CodcVPA.exe
  2⤵
  PID:10296
- C:\Windows\System\QLwxCxZ.exe
  C:\Windows\System\QLwxCxZ.exe
  2⤵
  PID:10352
- C:\Windows\System\lsMZMnO.exe
  C:\Windows\System\lsMZMnO.exe
  2⤵
  PID:10412
- C:\Windows\System\qOBjlcq.exe
  C:\Windows\System\qOBjlcq.exe
  2⤵
  PID:10484
- C:\Windows\System\IrGWYRJ.exe
  C:\Windows\System\IrGWYRJ.exe
  2⤵
  PID:10548
- C:\Windows\System\VzHsrYj.exe
  C:\Windows\System\VzHsrYj.exe
  2⤵
  PID:10608
- C:\Windows\System\BNqySyC.exe
  C:\Windows\System\BNqySyC.exe
  2⤵
  PID:10688
- C:\Windows\System\tYkSCup.exe
  C:\Windows\System\tYkSCup.exe
  2⤵
  PID:10752
- C:\Windows\System\vcrZghT.exe
  C:\Windows\System\vcrZghT.exe
  2⤵
  PID:10808
- C:\Windows\System\sRDKdYs.exe
  C:\Windows\System\sRDKdYs.exe
  2⤵
  PID:10880
- C:\Windows\System\mRtZZno.exe
  C:\Windows\System\mRtZZno.exe
  2⤵
  PID:10944
- C:\Windows\System\uCpvSIw.exe
  C:\Windows\System\uCpvSIw.exe
  2⤵
  PID:11004
- C:\Windows\System\fheFZJf.exe
  C:\Windows\System\fheFZJf.exe
  2⤵
  PID:11080
- C:\Windows\System\GbJkfob.exe
  C:\Windows\System\GbJkfob.exe
  2⤵
  PID:11140
- C:\Windows\System\PZxjuxh.exe
  C:\Windows\System\PZxjuxh.exe
  2⤵
  PID:11200
- C:\Windows\System\BSMrgAD.exe
  C:\Windows\System\BSMrgAD.exe
  2⤵
  PID:10260
- C:\Windows\System\PvVhDWe.exe
  C:\Windows\System\PvVhDWe.exe
  2⤵
  PID:10400
- C:\Windows\System\iNXlQgd.exe
  C:\Windows\System\iNXlQgd.exe
  2⤵
  PID:10540
- C:\Windows\System\zHxMKhi.exe
  C:\Windows\System\zHxMKhi.exe
  2⤵
  PID:10696
- C:\Windows\System\VHXeken.exe
  C:\Windows\System\VHXeken.exe
  2⤵
  PID:10860
- C:\Windows\System\tZXDLZq.exe
  C:\Windows\System\tZXDLZq.exe
  2⤵
  PID:10996
- C:\Windows\System\YRDVKOf.exe
  C:\Windows\System\YRDVKOf.exe
  2⤵
  PID:11172
- C:\Windows\System\JpnuYzy.exe
  C:\Windows\System\JpnuYzy.exe
  2⤵
  PID:10348
- C:\Windows\System\nKaiEEe.exe
  C:\Windows\System\nKaiEEe.exe
  2⤵
  PID:10664
- C:\Windows\System\ODKPyic.exe
  C:\Windows\System\ODKPyic.exe
  2⤵
  PID:10992
- C:\Windows\System\zBYxivy.exe
  C:\Windows\System\zBYxivy.exe
  2⤵
  PID:10464
- C:\Windows\System\dVIwJCo.exe
  C:\Windows\System\dVIwJCo.exe
  2⤵
  PID:11256
- C:\Windows\System\AMZIxjH.exe
  C:\Windows\System\AMZIxjH.exe
  2⤵
  PID:11276
- C:\Windows\System\IWfEuhx.exe
  C:\Windows\System\IWfEuhx.exe
  2⤵
  PID:11304
- C:\Windows\System\peKwgpi.exe
  C:\Windows\System\peKwgpi.exe
  2⤵
  PID:11336
- C:\Windows\System\MnZnrWk.exe
  C:\Windows\System\MnZnrWk.exe
  2⤵
  PID:11364
- C:\Windows\System\rkUiSvd.exe
  C:\Windows\System\rkUiSvd.exe
  2⤵
  PID:11392
- C:\Windows\System\xgJoHPd.exe
  C:\Windows\System\xgJoHPd.exe
  2⤵
  PID:11420
- C:\Windows\System\PumFwUK.exe
  C:\Windows\System\PumFwUK.exe
  2⤵
  PID:11448
- C:\Windows\System\EgkGLUV.exe
  C:\Windows\System\EgkGLUV.exe
  2⤵
  PID:11476
- C:\Windows\System\PNQCRuq.exe
  C:\Windows\System\PNQCRuq.exe
  2⤵
  PID:11504
- C:\Windows\System\YPTuSkl.exe
  C:\Windows\System\YPTuSkl.exe
  2⤵
  PID:11532
- C:\Windows\System\PkrnGVF.exe
  C:\Windows\System\PkrnGVF.exe
  2⤵
  PID:11560
- C:\Windows\System\ZGBFIPv.exe
  C:\Windows\System\ZGBFIPv.exe
  2⤵
  PID:11588
- C:\Windows\System\UlKTMdc.exe
  C:\Windows\System\UlKTMdc.exe
  2⤵
  PID:11616
- C:\Windows\System\XPtvMZr.exe
  C:\Windows\System\XPtvMZr.exe
  2⤵
  PID:11644
- C:\Windows\System\ePMXboL.exe
  C:\Windows\System\ePMXboL.exe
  2⤵
  PID:11672
- C:\Windows\System\TxiHoBv.exe
  C:\Windows\System\TxiHoBv.exe
  2⤵
  PID:11700
- C:\Windows\System\RZQqnvB.exe
  C:\Windows\System\RZQqnvB.exe
  2⤵
  PID:11728
- C:\Windows\System\BDVYDcJ.exe
  C:\Windows\System\BDVYDcJ.exe
  2⤵
  PID:11756
- C:\Windows\System\GCRvloy.exe
  C:\Windows\System\GCRvloy.exe
  2⤵
  PID:11784
- C:\Windows\System\QnUpECr.exe
  C:\Windows\System\QnUpECr.exe
  2⤵
  PID:11812
- C:\Windows\System\eHJoalA.exe
  C:\Windows\System\eHJoalA.exe
  2⤵
  PID:11840
- C:\Windows\System\CKMeKYW.exe
  C:\Windows\System\CKMeKYW.exe
  2⤵
  PID:11868
- C:\Windows\System\aybmfcK.exe
  C:\Windows\System\aybmfcK.exe
  2⤵
  PID:11896
- C:\Windows\System\wiYnAQm.exe
  C:\Windows\System\wiYnAQm.exe
  2⤵
  PID:11924
- C:\Windows\System\cqruaQO.exe
  C:\Windows\System\cqruaQO.exe
  2⤵
  PID:11952
- C:\Windows\System\DyQfEdc.exe
  C:\Windows\System\DyQfEdc.exe
  2⤵
  PID:11980
- C:\Windows\System\uNPMZpb.exe
  C:\Windows\System\uNPMZpb.exe
  2⤵
  PID:12008
- C:\Windows\System\hpBtVuX.exe
  C:\Windows\System\hpBtVuX.exe
  2⤵
  PID:12036
- C:\Windows\System\OtubWkm.exe
  C:\Windows\System\OtubWkm.exe
  2⤵
  PID:12064
- C:\Windows\System\cgQbLWD.exe
  C:\Windows\System\cgQbLWD.exe
  2⤵
  PID:12092
- C:\Windows\System\ODsKJbS.exe
  C:\Windows\System\ODsKJbS.exe
  2⤵
  PID:12120
- C:\Windows\System\PBAtlDQ.exe
  C:\Windows\System\PBAtlDQ.exe
  2⤵
  PID:12148
- C:\Windows\System\IIVpsSL.exe
  C:\Windows\System\IIVpsSL.exe
  2⤵
  PID:12176
- C:\Windows\System\bKYHdNc.exe
  C:\Windows\System\bKYHdNc.exe
  2⤵
  PID:12204
- C:\Windows\System\tVEYhXy.exe
  C:\Windows\System\tVEYhXy.exe
  2⤵
  PID:12232
- C:\Windows\System\lspRZho.exe
  C:\Windows\System\lspRZho.exe
  2⤵
  PID:12260
- C:\Windows\System\urAwbxk.exe
  C:\Windows\System\urAwbxk.exe
  2⤵
  PID:10804
- C:\Windows\System\dupaYRY.exe
  C:\Windows\System\dupaYRY.exe
  2⤵
  PID:11324
- C:\Windows\System\JOBcRno.exe
  C:\Windows\System\JOBcRno.exe
  2⤵
  PID:11388
- C:\Windows\System\tBpyJMO.exe
  C:\Windows\System\tBpyJMO.exe
  2⤵
  PID:812
- C:\Windows\System\veRCISw.exe
  C:\Windows\System\veRCISw.exe
  2⤵
  PID:11444
- C:\Windows\System\eWYIZKH.exe
  C:\Windows\System\eWYIZKH.exe
  2⤵
  PID:11516
- C:\Windows\System\PjcjfXN.exe
  C:\Windows\System\PjcjfXN.exe
  2⤵
  PID:11580
- C:\Windows\System\rsoXrjU.exe
  C:\Windows\System\rsoXrjU.exe
  2⤵
  PID:11640
- C:\Windows\System\SdwgSNs.exe
  C:\Windows\System\SdwgSNs.exe
  2⤵
  PID:11712
- C:\Windows\System\eeYmXOb.exe
  C:\Windows\System\eeYmXOb.exe
  2⤵
  PID:11776
- C:\Windows\System\uTbQQUq.exe
  C:\Windows\System\uTbQQUq.exe
  2⤵
  PID:11836
- C:\Windows\System\hNsyJZA.exe
  C:\Windows\System\hNsyJZA.exe
  2⤵
  PID:11908
- C:\Windows\System\gJgQzBH.exe
  C:\Windows\System\gJgQzBH.exe
  2⤵
  PID:11964
- C:\Windows\System\OZdlQXB.exe
  C:\Windows\System\OZdlQXB.exe
  2⤵
  PID:12028
- C:\Windows\System\GNfIayU.exe
  C:\Windows\System\GNfIayU.exe
  2⤵
  PID:12088
- C:\Windows\System\wlbpmal.exe
  C:\Windows\System\wlbpmal.exe
  2⤵
  PID:12164
- C:\Windows\System\uqfWsrc.exe
  C:\Windows\System\uqfWsrc.exe
  2⤵
  PID:12196
- C:\Windows\System\hJeZtOF.exe
  C:\Windows\System\hJeZtOF.exe
  2⤵
  PID:12244
- C:\Windows\System\PCKbvGT.exe
  C:\Windows\System\PCKbvGT.exe
  2⤵
  PID:12280
- C:\Windows\System\VNqLiYz.exe
  C:\Windows\System\VNqLiYz.exe
  2⤵
  PID:4032
- C:\Windows\System\KZrFstB.exe
  C:\Windows\System\KZrFstB.exe
  2⤵
  PID:11432
- C:\Windows\System\JRLgjKy.exe
  C:\Windows\System\JRLgjKy.exe
  2⤵
  PID:11628
- C:\Windows\System\Asuedns.exe
  C:\Windows\System\Asuedns.exe
  2⤵
  PID:11808
- C:\Windows\System\DwcCVmL.exe
  C:\Windows\System\DwcCVmL.exe
  2⤵
  PID:12084
- C:\Windows\System\DFbHvfs.exe
  C:\Windows\System\DFbHvfs.exe
  2⤵
  PID:11692
- C:\Windows\System\uBPuOWn.exe
  C:\Windows\System\uBPuOWn.exe
  2⤵
  PID:12256
- C:\Windows\System\KZgQjJo.exe
  C:\Windows\System\KZgQjJo.exe
  2⤵
  PID:11356
- C:\Windows\System\UnHGhJk.exe
  C:\Windows\System\UnHGhJk.exe
  2⤵
  PID:12140
- C:\Windows\System\zwzwGzG.exe
  C:\Windows\System\zwzwGzG.exe
  2⤵
  PID:12272
- C:\Windows\System\igwswba.exe
  C:\Windows\System\igwswba.exe
  2⤵
  PID:12308
- C:\Windows\System\OFvvoND.exe
  C:\Windows\System\OFvvoND.exe
  2⤵
  PID:12336
- C:\Windows\System\zrJniNi.exe
  C:\Windows\System\zrJniNi.exe
  2⤵
  PID:12364
- C:\Windows\System\qKdwChs.exe
  C:\Windows\System\qKdwChs.exe
  2⤵
  PID:12400
- C:\Windows\System\EHikcbU.exe
  C:\Windows\System\EHikcbU.exe
  2⤵
  PID:12428
- C:\Windows\System\GWKVxxh.exe
  C:\Windows\System\GWKVxxh.exe
  2⤵
  PID:12476
- C:\Windows\System\agEiyDW.exe
  C:\Windows\System\agEiyDW.exe
  2⤵
  PID:12500
- C:\Windows\System\EibfNjr.exe
  C:\Windows\System\EibfNjr.exe
  2⤵
  PID:12528
- C:\Windows\System\pVycnGO.exe
  C:\Windows\System\pVycnGO.exe
  2⤵
  PID:12592
- C:\Windows\System\ooOrTOD.exe
  C:\Windows\System\ooOrTOD.exe
  2⤵
  PID:12620
- C:\Windows\System\ZfQCUDO.exe
  C:\Windows\System\ZfQCUDO.exe
  2⤵
  PID:12648
- C:\Windows\System\FLNrGPX.exe
  C:\Windows\System\FLNrGPX.exe
  2⤵
  PID:12688
- C:\Windows\System\sQunbJQ.exe
  C:\Windows\System\sQunbJQ.exe
  2⤵
  PID:12720
- C:\Windows\System\yYahSFv.exe
  C:\Windows\System\yYahSFv.exe
  2⤵
  PID:12760
- C:\Windows\System\NQGInQi.exe
  C:\Windows\System\NQGInQi.exe
  2⤵
  PID:12780
- C:\Windows\System\lDwibnO.exe
  C:\Windows\System\lDwibnO.exe
  2⤵
  PID:12816
- C:\Windows\System\xczSbRb.exe
  C:\Windows\System\xczSbRb.exe
  2⤵
  PID:12848
- C:\Windows\System\YvUXHdd.exe
  C:\Windows\System\YvUXHdd.exe
  2⤵
  PID:12868
- C:\Windows\System\nXYwZAK.exe
  C:\Windows\System\nXYwZAK.exe
  2⤵
  PID:12896
- C:\Windows\System\ZAFjqxT.exe
  C:\Windows\System\ZAFjqxT.exe
  2⤵
  PID:12924
- C:\Windows\System\cYgXJOU.exe
  C:\Windows\System\cYgXJOU.exe
  2⤵
  PID:12948
- C:\Windows\System\EMpakJx.exe
  C:\Windows\System\EMpakJx.exe
  2⤵
  PID:12984
- C:\Windows\System\zuZBQNA.exe
  C:\Windows\System\zuZBQNA.exe
  2⤵
  PID:13012
- C:\Windows\System\lIWOfwk.exe
  C:\Windows\System\lIWOfwk.exe
  2⤵
  PID:13056
- C:\Windows\System\mNFwLSc.exe
  C:\Windows\System\mNFwLSc.exe
  2⤵
  PID:13072
- C:\Windows\System\iNJyVYE.exe
  C:\Windows\System\iNJyVYE.exe
  2⤵
  PID:13112
- C:\Windows\System\kKOsFpq.exe
  C:\Windows\System\kKOsFpq.exe
  2⤵
  PID:13140
- C:\Windows\System\zNTLIWQ.exe
  C:\Windows\System\zNTLIWQ.exe
  2⤵
  PID:13168
- C:\Windows\System\MUjrBbH.exe
  C:\Windows\System\MUjrBbH.exe
  2⤵
  PID:12980
- C:\Windows\System\zaOpMRI.exe
  C:\Windows\System\zaOpMRI.exe
  2⤵
  PID:13020
- C:\Windows\System\llPXjzO.exe
  C:\Windows\System\llPXjzO.exe
  2⤵
  PID:13096
- C:\Windows\System\lqrFeQD.exe
  C:\Windows\System\lqrFeQD.exe
  2⤵
  PID:13180
- C:\Windows\System\vFNGcbx.exe
  C:\Windows\System\vFNGcbx.exe
  2⤵
  PID:13224
- C:\Windows\System\lhGbWDM.exe
  C:\Windows\System\lhGbWDM.exe
  2⤵
  PID:13248
- C:\Windows\System\otJhQJF.exe
  C:\Windows\System\otJhQJF.exe
  2⤵
  PID:13296
- C:\Windows\System\rljCAtl.exe
  C:\Windows\System\rljCAtl.exe
  2⤵
  PID:12300
- C:\Windows\System\duljzWL.exe
  C:\Windows\System\duljzWL.exe
  2⤵
  PID:12736
- C:\Windows\System\kZPNiFn.exe
  C:\Windows\System\kZPNiFn.exe
  2⤵
  PID:4828
- C:\Windows\System\ReYoPym.exe
  C:\Windows\System\ReYoPym.exe
  2⤵
  PID:12828
- C:\Windows\System\yNEPBEO.exe
  C:\Windows\System\yNEPBEO.exe
  2⤵
  PID:12612
- C:\Windows\System\UAoNixF.exe
  C:\Windows\System\UAoNixF.exe
  2⤵
  PID:12680
- C:\Windows\System\efRAnIQ.exe
  C:\Windows\System\efRAnIQ.exe
  2⤵
  PID:12144
- C:\Windows\System\egFuEJI.exe
  C:\Windows\System\egFuEJI.exe
  2⤵
  PID:12388
- C:\Windows\System\SlDfdsZ.exe
  C:\Windows\System\SlDfdsZ.exe
  2⤵
  PID:12560
- C:\Windows\System\tdACreL.exe
  C:\Windows\System\tdACreL.exe
  2⤵
  PID:12840
- C:\Windows\System\ApCWRSJ.exe
  C:\Windows\System\ApCWRSJ.exe
  2⤵
  PID:2120
- C:\Windows\System\bnXPLzQ.exe
  C:\Windows\System\bnXPLzQ.exe
  2⤵
  PID:12884
- C:\Windows\System\MCcWwxa.exe
  C:\Windows\System\MCcWwxa.exe
  2⤵
  PID:13232
- C:\Windows\System\JRuxXLU.exe
  C:\Windows\System\JRuxXLU.exe
  2⤵
  PID:12464
- C:\Windows\System\VwPBDrK.exe
  C:\Windows\System\VwPBDrK.exe
  2⤵
  PID:11572
- C:\Windows\System\ERVBhCW.exe
  C:\Windows\System\ERVBhCW.exe
  2⤵
  PID:11300
- C:\Windows\System\EwIqpLC.exe
  C:\Windows\System\EwIqpLC.exe
  2⤵
  PID:12496
- C:\Windows\System\rYeefEZ.exe
  C:\Windows\System\rYeefEZ.exe
  2⤵
  PID:12492
- C:\Windows\System\QUuKFbS.exe
  C:\Windows\System\QUuKFbS.exe
  2⤵
  PID:4436
- C:\Windows\System\PWrNhLJ.exe
  C:\Windows\System\PWrNhLJ.exe
  2⤵
  PID:12748
- C:\Windows\System\DTNJPhv.exe
  C:\Windows\System\DTNJPhv.exe
  2⤵
  PID:3900
- C:\Windows\System\bOhUVrJ.exe
  C:\Windows\System\bOhUVrJ.exe
  2⤵
  PID:1764
- C:\Windows\System\ZUcahjT.exe
  C:\Windows\System\ZUcahjT.exe
  2⤵
  PID:12960
- C:\Windows\System\AZJMgtR.exe
  C:\Windows\System\AZJMgtR.exe
  2⤵
  PID:3104
- C:\Windows\System\kZnUxFY.exe
  C:\Windows\System\kZnUxFY.exe
  2⤵
  PID:1536
- C:\Windows\System\dKoWixN.exe
  C:\Windows\System\dKoWixN.exe
  2⤵
  PID:13256
- C:\Windows\System\Ivkfuoo.exe
  C:\Windows\System\Ivkfuoo.exe
  2⤵
  PID:12332
- C:\Windows\System\bcKJqOG.exe
  C:\Windows\System\bcKJqOG.exe
  2⤵
  PID:12524
- C:\Windows\System\MftIhhm.exe
  C:\Windows\System\MftIhhm.exe
  2⤵
  PID:4680
- C:\Windows\System\rfQSjSu.exe
  C:\Windows\System\rfQSjSu.exe
  2⤵
  PID:12888
- C:\Windows\System\czErAbc.exe
  C:\Windows\System\czErAbc.exe
  2⤵
  PID:1940
- C:\Windows\System\ENHJJNv.exe
  C:\Windows\System\ENHJJNv.exe
  2⤵
  PID:3644
- C:\Windows\System\cpclksJ.exe
  C:\Windows\System\cpclksJ.exe
  2⤵
  PID:1816
- C:\Windows\System\FmXGyLR.exe
  C:\Windows\System\FmXGyLR.exe
  2⤵
  PID:3176
- C:\Windows\System\zxRGKyd.exe
  C:\Windows\System\zxRGKyd.exe
  2⤵
  PID:13052
- C:\Windows\System\bgqsXWS.exe
  C:\Windows\System\bgqsXWS.exe
  2⤵
  PID:5264
- C:\Windows\System\efSjYAH.exe
  C:\Windows\System\efSjYAH.exe
  2⤵
  PID:5364
- C:\Windows\System\vVefiQu.exe
  C:\Windows\System\vVefiQu.exe
  2⤵
  PID:7080
- C:\Windows\System\OEBDSDy.exe
  C:\Windows\System\OEBDSDy.exe
  2⤵
  PID:12356
- C:\Windows\System\slgtBov.exe
  C:\Windows\System\slgtBov.exe
  2⤵
  PID:8048
- C:\Windows\System\jfGIIcm.exe
  C:\Windows\System\jfGIIcm.exe
  2⤵
  PID:6980
- C:\Windows\System\OOJzucd.exe
  C:\Windows\System\OOJzucd.exe
  2⤵
  PID:4832
- C:\Windows\System\EQymsJh.exe
  C:\Windows\System\EQymsJh.exe
  2⤵
  PID:5280
- C:\Windows\System\rsTlLIa.exe
  C:\Windows\System\rsTlLIa.exe
  2⤵
  PID:5396
- C:\Windows\System\wroWdsL.exe
  C:\Windows\System\wroWdsL.exe
  2⤵
  PID:5812
- C:\Windows\System\LkdNZUd.exe
  C:\Windows\System\LkdNZUd.exe
  2⤵
  PID:5824
- C:\Windows\System\XEHvlwU.exe
  C:\Windows\System\XEHvlwU.exe
  2⤵
  PID:8984
- C:\Windows\System\yhMWRqM.exe
  C:\Windows\System\yhMWRqM.exe
  2⤵
  PID:7748
- C:\Windows\System\qznxCOK.exe
  C:\Windows\System\qznxCOK.exe
  2⤵
  PID:6104
- C:\Windows\System\vLDVCaj.exe
  C:\Windows\System\vLDVCaj.exe
  2⤵
  PID:6140
- C:\Windows\System\QXARavo.exe
  C:\Windows\System\QXARavo.exe
  2⤵
  PID:5272
- C:\Windows\System\ameWCxq.exe
  C:\Windows\System\ameWCxq.exe
  2⤵
  PID:5408
- C:\Windows\System\zAUpyWr.exe
  C:\Windows\System\zAUpyWr.exe
  2⤵
  PID:7780
- C:\Windows\System\JEuONbx.exe
  C:\Windows\System\JEuONbx.exe
  2⤵
  PID:7556
- C:\Windows\System\alhUMtE.exe
  C:\Windows\System\alhUMtE.exe
  2⤵
  PID:8248
- C:\Windows\System\RaJleha.exe
  C:\Windows\System\RaJleha.exe
  2⤵
  PID:7828
- C:\Windows\System\zuWmcUu.exe
  C:\Windows\System\zuWmcUu.exe
  2⤵
  PID:8264
- C:\Windows\System\nLWsYkU.exe
  C:\Windows\System\nLWsYkU.exe
  2⤵
  PID:6088
- C:\Windows\System\VLxqwEX.exe
  C:\Windows\System\VLxqwEX.exe
  2⤵
  PID:5204
- C:\Windows\System\juVxqFj.exe
  C:\Windows\System\juVxqFj.exe
  2⤵
  PID:8320
- C:\Windows\System\uKFmupE.exe
  C:\Windows\System\uKFmupE.exe
  2⤵
  PID:7884
- C:\Windows\System\yJUhikk.exe
  C:\Windows\System\yJUhikk.exe
  2⤵
  PID:9392
- C:\Windows\System\QcKfRyi.exe
  C:\Windows\System\QcKfRyi.exe
  2⤵
  PID:4048
- C:\Windows\System\rKytINy.exe
  C:\Windows\System\rKytINy.exe
  2⤵
  PID:8384
- C:\Windows\System\quiSnJS.exe
  C:\Windows\System\quiSnJS.exe
  2⤵
  PID:1540
- C:\Windows\System\DiNLahh.exe
  C:\Windows\System\DiNLahh.exe
  2⤵
  PID:7912
- C:\Windows\System\qQkEuKN.exe
  C:\Windows\System\qQkEuKN.exe
  2⤵
  PID:9540
- C:\Windows\System\fGmwFqE.exe
  C:\Windows\System\fGmwFqE.exe
  2⤵
  PID:13260
- C:\Windows\System\FVzWaRE.exe
  C:\Windows\System\FVzWaRE.exe
  2⤵
  PID:6292
- C:\Windows\System\mjCGSXp.exe
  C:\Windows\System\mjCGSXp.exe
  2⤵
  PID:6372
- C:\Windows\System\cElwSJZ.exe
  C:\Windows\System\cElwSJZ.exe
  2⤵
  PID:6396
- C:\Windows\System\TSZqtkW.exe
  C:\Windows\System\TSZqtkW.exe
  2⤵
  PID:3116
- C:\Windows\System\qijZdRV.exe
  C:\Windows\System\qijZdRV.exe
  2⤵
  PID:536
- C:\Windows\System\kxWeUsg.exe
  C:\Windows\System\kxWeUsg.exe
  2⤵
  PID:9680
- C:\Windows\System\oclOijM.exe
  C:\Windows\System\oclOijM.exe
  2⤵
  PID:9708
- C:\Windows\System\qwpEaDZ.exe
  C:\Windows\System\qwpEaDZ.exe
  2⤵
  PID:6452
- C:\Windows\System\aSsGYYK.exe
  C:\Windows\System\aSsGYYK.exe
  2⤵
  PID:8616
- C:\Windows\System\dTYBJuh.exe
  C:\Windows\System\dTYBJuh.exe
  2⤵
  PID:9760
- C:\Windows\System\BEvyhqE.exe
  C:\Windows\System\BEvyhqE.exe
  2⤵
  PID:6476
- C:\Windows\System\vyyvdUh.exe
  C:\Windows\System\vyyvdUh.exe
  2⤵
  PID:9820
- C:\Windows\System\VilAWrU.exe
  C:\Windows\System\VilAWrU.exe
  2⤵
  PID:1680
- C:\Windows\System\TSVKCAe.exe
  C:\Windows\System\TSVKCAe.exe
  2⤵
  PID:8708
- C:\Windows\System\LQNufnZ.exe
  C:\Windows\System\LQNufnZ.exe
  2⤵
  PID:9924
- C:\Windows\System\PFrMVgj.exe
  C:\Windows\System\PFrMVgj.exe
  2⤵
  PID:8764
- C:\Windows\System\fOZmhoi.exe
  C:\Windows\System\fOZmhoi.exe
  2⤵
  PID:9952
- C:\Windows\System\HZHNawU.exe
  C:\Windows\System\HZHNawU.exe
  2⤵
  PID:3216
- C:\Windows\System\pVSYvMk.exe
  C:\Windows\System\pVSYvMk.exe
  2⤵
  PID:6936
- C:\Windows\System\lcvYKzS.exe
  C:\Windows\System\lcvYKzS.exe
  2⤵
  PID:8812
- C:\Windows\System\bMkZuVi.exe
  C:\Windows\System\bMkZuVi.exe
  2⤵
  PID:5040
- C:\Windows\System\axBaBGn.exe
  C:\Windows\System\axBaBGn.exe
  2⤵
  PID:10104
- C:\Windows\System\npAfpBo.exe
  C:\Windows\System\npAfpBo.exe
  2⤵
  PID:3880
- C:\Windows\System\joFPNBp.exe
  C:\Windows\System\joFPNBp.exe
  2⤵
  PID:8144
- C:\Windows\System\YvTXVgb.exe
  C:\Windows\System\YvTXVgb.exe
  2⤵
  PID:6556
- C:\Windows\System\vQelKVh.exe
  C:\Windows\System\vQelKVh.exe
  2⤵
  PID:12412
- C:\Windows\System\uUsZlhi.exe
  C:\Windows\System\uUsZlhi.exe
  2⤵
  PID:10216
- C:\Windows\System\gJrxpoC.exe
  C:\Windows\System\gJrxpoC.exe
  2⤵
  PID:7212
- C:\Windows\System\eFpTdBE.exe
  C:\Windows\System\eFpTdBE.exe
  2⤵
  PID:9004
- C:\Windows\System\oyJoDOh.exe
  C:\Windows\System\oyJoDOh.exe
  2⤵
  PID:6632
- C:\Windows\System\vPahawy.exe
  C:\Windows\System\vPahawy.exe
  2⤵
  PID:7220
- C:\Windows\System\skyhrgo.exe
  C:\Windows\System\skyhrgo.exe
  2⤵
  PID:6692
- C:\Windows\System\YysnzOx.exe
  C:\Windows\System\YysnzOx.exe
  2⤵
  PID:3404
- C:\Windows\System\kHnFIOu.exe
  C:\Windows\System\kHnFIOu.exe
  2⤵
  PID:1628
- C:\Windows\System\nVRkSdq.exe
  C:\Windows\System\nVRkSdq.exe
  2⤵
  PID:2328
- C:\Windows\System\gMITuTE.exe
  C:\Windows\System\gMITuTE.exe
  2⤵
  PID:9600
- C:\Windows\System\zVKGYNr.exe
  C:\Windows\System\zVKGYNr.exe
  2⤵
  PID:1284
- C:\Windows\System\spvJFzI.exe
  C:\Windows\System\spvJFzI.exe
  2⤵
  PID:448
- C:\Windows\System\fkMrDaH.exe
  C:\Windows\System\fkMrDaH.exe
  2⤵
  PID:7568
- C:\Windows\System\QeCxUbq.exe
  C:\Windows\System\QeCxUbq.exe
  2⤵
  PID:7288
- C:\Windows\System\YCsqrOJ.exe
  C:\Windows\System\YCsqrOJ.exe
  2⤵
  PID:3516
- C:\Windows\System\vIAQDJJ.exe
  C:\Windows\System\vIAQDJJ.exe
  2⤵
  PID:7704
- C:\Windows\System\PYDHOBk.exe
  C:\Windows\System\PYDHOBk.exe
  2⤵
  PID:4400
- C:\Windows\System\ZUsbnOF.exe
  C:\Windows\System\ZUsbnOF.exe
  2⤵
  PID:10108
- C:\Windows\System\BCvFZoA.exe
  C:\Windows\System\BCvFZoA.exe
  2⤵
  PID:3004
- C:\Windows\System\UyvNvgi.exe
  C:\Windows\System\UyvNvgi.exe
  2⤵
  PID:10184
- C:\Windows\System\WGFXyAv.exe
  C:\Windows\System\WGFXyAv.exe
  2⤵
  PID:2356
- C:\Windows\System\RPqExKt.exe
  C:\Windows\System\RPqExKt.exe
  2⤵
  PID:7592
- C:\Windows\System\oOKJdIF.exe
  C:\Windows\System\oOKJdIF.exe
  2⤵
  PID:6904
- C:\Windows\System\xHHvnbi.exe
  C:\Windows\System\xHHvnbi.exe
  2⤵
  PID:9572
- C:\Windows\System\ORkWKhy.exe
  C:\Windows\System\ORkWKhy.exe
  2⤵
  PID:2912
- C:\Windows\System\MNysRTk.exe
  C:\Windows\System\MNysRTk.exe
  2⤵
  PID:9876
- C:\Windows\System\QQSMpxi.exe
  C:\Windows\System\QQSMpxi.exe
  2⤵
  PID:8500
- C:\Windows\System\mGPFmZH.exe
  C:\Windows\System\mGPFmZH.exe
  2⤵
  PID:6960
- C:\Windows\System\HhsZhqT.exe
  C:\Windows\System\HhsZhqT.exe
  2⤵
  PID:8564
- C:\Windows\System\mbIAXEy.exe
  C:\Windows\System\mbIAXEy.exe
  2⤵
  PID:4056
- C:\Windows\System\VVQJfgZ.exe
  C:\Windows\System\VVQJfgZ.exe
  2⤵
  PID:3980
- C:\Windows\System\KNeSZsZ.exe
  C:\Windows\System\KNeSZsZ.exe
  2⤵
  PID:8052
- C:\Windows\System\bJAaxOV.exe
  C:\Windows\System\bJAaxOV.exe
  2⤵
  PID:8672
- C:\Windows\System\NIfjejm.exe
  C:\Windows\System\NIfjejm.exe
  2⤵
  PID:7144
- C:\Windows\System\KPqKHgx.exe
  C:\Windows\System\KPqKHgx.exe
  2⤵
  PID:7108
- C:\Windows\System\pUcJzow.exe
  C:\Windows\System\pUcJzow.exe
  2⤵
  PID:7160
- C:\Windows\System\axCTooF.exe
  C:\Windows\System\axCTooF.exe
  2⤵
  PID:10320
- C:\Windows\System\dtsBSeg.exe
  C:\Windows\System\dtsBSeg.exe
  2⤵
  PID:13104
- C:\Windows\System\mIrmkjh.exe
  C:\Windows\System\mIrmkjh.exe
  2⤵
  PID:7524
- C:\Windows\System\dFNAwtY.exe
  C:\Windows\System\dFNAwtY.exe
  2⤵
  PID:4508
- C:\Windows\System\TVXpnqv.exe
  C:\Windows\System\TVXpnqv.exe
  2⤵
  PID:7348
- C:\Windows\System\WtugVdD.exe
  C:\Windows\System\WtugVdD.exe
  2⤵
  PID:10452
- C:\Windows\System\rgCpHYM.exe
  C:\Windows\System\rgCpHYM.exe
  2⤵
  PID:9076
- C:\Windows\System\qdGQWFi.exe
  C:\Windows\System\qdGQWFi.exe
  2⤵
  PID:5380
- C:\Windows\System\KZSfCUO.exe
  C:\Windows\System\KZSfCUO.exe
  2⤵
  PID:10572
- C:\Windows\System\juTfrfU.exe
  C:\Windows\System\juTfrfU.exe
  2⤵
  PID:3836
- C:\Windows\System\XGIZAfC.exe
  C:\Windows\System\XGIZAfC.exe
  2⤵
  PID:7600
- C:\Windows\System\rtoaqIP.exe
  C:\Windows\System\rtoaqIP.exe
  2⤵
  PID:8472
- C:\Windows\System\wnYyuDu.exe
  C:\Windows\System\wnYyuDu.exe
  2⤵
  PID:7632
- C:\Windows\System\ZKrBYim.exe
  C:\Windows\System\ZKrBYim.exe
  2⤵
  PID:6804
- C:\Windows\System\QSzpyDG.exe
  C:\Windows\System\QSzpyDG.exe
  2⤵
  PID:7648
- C:\Windows\System\fNyCCSA.exe
  C:\Windows\System\fNyCCSA.exe
  2⤵
  PID:5488
- C:\Windows\System\KqekGUa.exe
  C:\Windows\System\KqekGUa.exe
  2⤵
  PID:8652
- C:\Windows\System\BqpOnqf.exe
  C:\Windows\System\BqpOnqf.exe
  2⤵
  PID:10828
- C:\Windows\System\hhGtVME.exe
  C:\Windows\System\hhGtVME.exe
  2⤵
  PID:10876
- C:\Windows\System\rtebduA.exe
  C:\Windows\System\rtebduA.exe
  2⤵
  PID:2468
- C:\Windows\System\iuRXvGC.exe
  C:\Windows\System\iuRXvGC.exe
  2⤵
  PID:5996
- C:\Windows\System\ChcWEFI.exe
  C:\Windows\System\ChcWEFI.exe
  2⤵
  PID:9124
- C:\Windows\System\qhYuWJv.exe
  C:\Windows\System\qhYuWJv.exe
  2⤵
  PID:8252
- C:\Windows\System\GKxlBWL.exe
  C:\Windows\System\GKxlBWL.exe
  2⤵
  PID:11100
- C:\Windows\System\evlfPtz.exe
  C:\Windows\System\evlfPtz.exe
  2⤵
  PID:7332
- C:\Windows\System\OmUQwHx.exe
  C:\Windows\System\OmUQwHx.exe
  2⤵
  PID:11220
- C:\Windows\System\GGsrBcX.exe
  C:\Windows\System\GGsrBcX.exe
  2⤵
  PID:4644
- C:\Windows\System\kuAxzZv.exe
  C:\Windows\System\kuAxzZv.exe
  2⤵
  PID:8388
- C:\Windows\System\czPkRSL.exe
  C:\Windows\System\czPkRSL.exe
  2⤵
  PID:5464
- C:\Windows\System\ZAbUYAN.exe
  C:\Windows\System\ZAbUYAN.exe
  2⤵
  PID:10652
- C:\Windows\System\RaHDetu.exe
  C:\Windows\System\RaHDetu.exe
  2⤵
  PID:10780
- C:\Windows\System\JMGqsiX.exe
  C:\Windows\System\JMGqsiX.exe
  2⤵
  PID:10920
- C:\Windows\System\QjsfHmY.exe
  C:\Windows\System\QjsfHmY.exe
  2⤵
  PID:11032
- C:\Windows\System\luVKQZf.exe
  C:\Windows\System\luVKQZf.exe
  2⤵
  PID:11164
- C:\Windows\System\qjHpPOz.exe
  C:\Windows\System\qjHpPOz.exe
  2⤵
  PID:10292
- C:\Windows\System\DWAQKGg.exe
  C:\Windows\System\DWAQKGg.exe
  2⤵
  PID:10636
- C:\Windows\System\McqAagn.exe
  C:\Windows\System\McqAagn.exe
  2⤵
  PID:10908
- C:\Windows\System\xOUYVwv.exe
  C:\Windows\System\xOUYVwv.exe
  2⤵
  PID:5176
- C:\Windows\System\euZWpBo.exe
  C:\Windows\System\euZWpBo.exe
  2⤵
  PID:10668
- C:\Windows\System\PbCZtDu.exe
  C:\Windows\System\PbCZtDu.exe
  2⤵
  PID:11116
- C:\Windows\System\IBzBQAZ.exe
  C:\Windows\System\IBzBQAZ.exe
  2⤵
  PID:9376
- C:\Windows\System\zGfWfpN.exe
  C:\Windows\System\zGfWfpN.exe
  2⤵
  PID:11352
- C:\Windows\System\EiuxWxX.exe
  C:\Windows\System\EiuxWxX.exe
  2⤵
  PID:4396
- C:\Windows\System\PMXYbmt.exe
  C:\Windows\System\PMXYbmt.exe
  2⤵
  PID:11484
- C:\Windows\System\daOUTrp.exe
  C:\Windows\System\daOUTrp.exe
  2⤵
  PID:11596
- C:\Windows\System\fVYTnGJ.exe
  C:\Windows\System\fVYTnGJ.exe
  2⤵
  PID:11688
- C:\Windows\System\sXUmKiJ.exe
  C:\Windows\System\sXUmKiJ.exe
  2⤵
  PID:11792
- C:\Windows\System\HQtSfTT.exe
  C:\Windows\System\HQtSfTT.exe
  2⤵
  PID:11876
- C:\Windows\System\kbjXPwl.exe
  C:\Windows\System\kbjXPwl.exe
  2⤵
  PID:12000
- C:\Windows\System\agpvWQc.exe
  C:\Windows\System\agpvWQc.exe
  2⤵
  PID:12108
- C:\Windows\System\PbylSmf.exe
  C:\Windows\System\PbylSmf.exe
  2⤵
  PID:12188
- C:\Windows\System\tLgWDbd.exe
  C:\Windows\System\tLgWDbd.exe
  2⤵
  PID:3080
- C:\Windows\System\wgvIXKh.exe
  C:\Windows\System\wgvIXKh.exe
  2⤵
  PID:4112
- C:\Windows\System\iYAKyFk.exe
  C:\Windows\System\iYAKyFk.exe
  2⤵
  PID:11612
- C:\Windows\System\gYOUkRN.exe
  C:\Windows\System\gYOUkRN.exe
  2⤵
  PID:11796
- C:\Windows\System\aMGSkLO.exe
  C:\Windows\System\aMGSkLO.exe
  2⤵
  PID:12060
- C:\Windows\System\ebsOTwt.exe
  C:\Windows\System\ebsOTwt.exe
  2⤵
  PID:12172
- C:\Windows\System\NDZDoka.exe
  C:\Windows\System\NDZDoka.exe
  2⤵
  PID:3972
- C:\Windows\System\aAKhHEP.exe
  C:\Windows\System\aAKhHEP.exe
  2⤵
  PID:5124
- C:\Windows\System\uqtFBkg.exe
  C:\Windows\System\uqtFBkg.exe
  2⤵
  PID:5876
- C:\Windows\System\bsYqxfo.exe
  C:\Windows\System\bsYqxfo.exe
  2⤵
  PID:5892
- C:\Windows\System\CIaYdUw.exe
  C:\Windows\System\CIaYdUw.exe
  2⤵
  PID:5928
- C:\Windows\System\BxPbyeC.exe
  C:\Windows\System\BxPbyeC.exe
  2⤵
  PID:6164
- C:\Windows\System\QyWyMdV.exe
  C:\Windows\System\QyWyMdV.exe
  2⤵
  PID:6236
- C:\Windows\System\FEhsAxJ.exe
  C:\Windows\System\FEhsAxJ.exe
  2⤵
  PID:5472
- C:\Windows\System\sGhfOTl.exe
  C:\Windows\System\sGhfOTl.exe
  2⤵
  PID:5916
- C:\Windows\System\crSTuay.exe
  C:\Windows\System\crSTuay.exe
  2⤵
  PID:6116
- C:\Windows\System\vVxlPfW.exe
  C:\Windows\System\vVxlPfW.exe
  2⤵
  PID:6744
- C:\Windows\System\ZKArMzs.exe
  C:\Windows\System\ZKArMzs.exe
  2⤵
  PID:12556
- C:\Windows\System\gNnwCmb.exe
  C:\Windows\System\gNnwCmb.exe
  2⤵
  PID:12636
- C:\Windows\System\DgdEyrS.exe
  C:\Windows\System\DgdEyrS.exe
  2⤵
  PID:12696
- C:\Windows\System\OFwJnPp.exe
  C:\Windows\System\OFwJnPp.exe
  2⤵
  PID:12808
- C:\Windows\System\DiAyUjz.exe
  C:\Windows\System\DiAyUjz.exe
  2⤵
  PID:9584
- C:\Windows\System\fsPhIgj.exe
  C:\Windows\System\fsPhIgj.exe
  2⤵
  PID:12976
- C:\Windows\System\qeMPjeC.exe
  C:\Windows\System\qeMPjeC.exe
  2⤵
  PID:13088
- C:\Windows\System\wYoCQov.exe
  C:\Windows\System\wYoCQov.exe
  2⤵
  PID:13120
- C:\Windows\System\gZEHWxJ.exe
  C:\Windows\System\gZEHWxJ.exe
  2⤵
  PID:13176
- C:\Windows\System\XzmBdaO.exe
  C:\Windows\System\XzmBdaO.exe
  2⤵
  PID:1168
- C:\Windows\System\SXmUoym.exe
  C:\Windows\System\SXmUoym.exe
  2⤵
  PID:6444
- C:\Windows\System\RTNXimu.exe
  C:\Windows\System\RTNXimu.exe
  2⤵
  PID:4100
- C:\Windows\System\qFbjuEB.exe
  C:\Windows\System\qFbjuEB.exe
  2⤵
  PID:6376
- C:\Windows\System\YWphIxZ.exe
  C:\Windows\System\YWphIxZ.exe
  2⤵
  PID:9868
- C:\Windows\System\xXOvpOP.exe
  C:\Windows\System\xXOvpOP.exe
  2⤵
  PID:2708
- C:\Windows\System\DFSvubi.exe
  C:\Windows\System\DFSvubi.exe
  2⤵
  PID:6736
- C:\Windows\System\wKujGqR.exe
  C:\Windows\System\wKujGqR.exe
  2⤵
  PID:3228
- C:\Windows\System\erXHPPC.exe
  C:\Windows\System\erXHPPC.exe
  2⤵
  PID:8096
- C:\Windows\System\QrUdIFH.exe
  C:\Windows\System\QrUdIFH.exe
  2⤵
  PID:1812
- C:\Windows\System\vNMgISm.exe
  C:\Windows\System\vNMgISm.exe
  2⤵
  PID:10124
- C:\Windows\System\jtPqyrp.exe
  C:\Windows\System\jtPqyrp.exe
  2⤵
  PID:10152
- C:\Windows\System\vkhNvqp.exe
  C:\Windows\System\vkhNvqp.exe
  2⤵
  PID:10180
- C:\Windows\System\lJnaBVn.exe
  C:\Windows\System\lJnaBVn.exe
  2⤵
  PID:10236
- C:\Windows\System\iBnrOcj.exe
  C:\Windows\System\iBnrOcj.exe
  2⤵
  PID:9340
- C:\Windows\System\HuQINEo.exe
  C:\Windows\System\HuQINEo.exe
  2⤵
  PID:12512
- C:\Windows\System\GozOMCH.exe
  C:\Windows\System\GozOMCH.exe
  2⤵
  PID:3632
- C:\Windows\System\tgjSlhb.exe
  C:\Windows\System\tgjSlhb.exe
  2⤵
  PID:7564
- C:\Windows\System\DZFTtLV.exe
  C:\Windows\System\DZFTtLV.exe
  2⤵
  PID:9852
- C:\Windows\System\pAfTlaU.exe
  C:\Windows\System\pAfTlaU.exe
  2⤵
  PID:9176
- C:\Windows\System\vMHAJfT.exe
  C:\Windows\System\vMHAJfT.exe
  2⤵
  PID:7324
- C:\Windows\System\gnxvLUU.exe
  C:\Windows\System\gnxvLUU.exe
  2⤵
  PID:7328
- C:\Windows\System\uWSiXsS.exe
  C:\Windows\System\uWSiXsS.exe
  2⤵
  PID:2832
- C:\Windows\System\GCWQoEG.exe
  C:\Windows\System\GCWQoEG.exe
  2⤵
  PID:7368
- C:\Windows\System\dNarksE.exe
  C:\Windows\System\dNarksE.exe
  2⤵
  PID:6968
- C:\Windows\System\kZgbzXH.exe
  C:\Windows\System\kZgbzXH.exe
  2⤵
  PID:8612
- C:\Windows\System\DMTwVXx.exe
  C:\Windows\System\DMTwVXx.exe
  2⤵
  PID:7072
- C:\Windows\System\tPLVXEt.exe
  C:\Windows\System\tPLVXEt.exe
  2⤵
  PID:10080
- C:\Windows\System\jdLSFAF.exe
  C:\Windows\System\jdLSFAF.exe
  2⤵
  PID:13236
- C:\Windows\System\OCuDFFG.exe
  C:\Windows\System\OCuDFFG.exe
  2⤵
  PID:13292
- C:\Windows\System\WmAfIWb.exe
  C:\Windows\System\WmAfIWb.exe
  2⤵
  PID:8924
- C:\Windows\System\ZcXIkWP.exe
  C:\Windows\System\ZcXIkWP.exe
  2⤵
  PID:8140
- C:\Windows\System\FWhIhgU.exe
  C:\Windows\System\FWhIhgU.exe
  2⤵
  PID:5268
- C:\Windows\System\OZmWMjV.exe
  C:\Windows\System\OZmWMjV.exe
  2⤵
  PID:3092
- C:\Windows\System\kCCKjfD.exe
  C:\Windows\System\kCCKjfD.exe
  2⤵
  PID:10592
- C:\Windows\System\pwNyWrZ.exe
  C:\Windows\System\pwNyWrZ.exe
  2⤵
  PID:10600
- C:\Windows\System\QcLRsUL.exe
  C:\Windows\System\QcLRsUL.exe
  2⤵
  PID:7656
- C:\Windows\System\bnVhQme.exe
  C:\Windows\System\bnVhQme.exe
  2⤵
  PID:10800
- C:\Windows\System\EoSTltv.exe
  C:\Windows\System\EoSTltv.exe
  2⤵
  PID:3060
- C:\Windows\System\jFLGbZQ.exe
  C:\Windows\System\jFLGbZQ.exe
  2⤵
  PID:7664
- C:\Windows\System\cBbRwOD.exe
  C:\Windows\System\cBbRwOD.exe
  2⤵
  PID:1364
- C:\Windows\System\QYruhti.exe
  C:\Windows\System\QYruhti.exe
  2⤵
  PID:11160
- C:\Windows\System\MxdbCiC.exe
  C:\Windows\System\MxdbCiC.exe
  2⤵
  PID:10328
- C:\Windows\System\nSEmzYW.exe
  C:\Windows\System\nSEmzYW.exe
  2⤵
  PID:5588
- C:\Windows\System\DytecKu.exe
  C:\Windows\System\DytecKu.exe
  2⤵
  PID:1780
- C:\Windows\System\UqeEfpS.exe
  C:\Windows\System\UqeEfpS.exe
  2⤵
  PID:5760
- C:\Windows\System\RUYDKWV.exe
  C:\Windows\System\RUYDKWV.exe
  2⤵
  PID:10512
- C:\Windows\System\ByTilpr.exe
  C:\Windows\System\ByTilpr.exe
  2⤵
  PID:11108
- C:\Windows\System\Hdlzvse.exe
  C:\Windows\System\Hdlzvse.exe
  2⤵
  PID:6460
- C:\Windows\System\MsNjOCb.exe
  C:\Windows\System\MsNjOCb.exe
  2⤵
  PID:5828
- C:\Windows\System\BGfsdKB.exe
  C:\Windows\System\BGfsdKB.exe
  2⤵
  PID:11548
- C:\Windows\System\YsMruxn.exe
  C:\Windows\System\YsMruxn.exe
  2⤵
  PID:11764
- C:\Windows\System\Fvodfyr.exe
  C:\Windows\System\Fvodfyr.exe
  2⤵
  PID:11960
- C:\Windows\System\HIDfruk.exe
  C:\Windows\System\HIDfruk.exe
  2⤵
  PID:12220
- C:\Windows\System\yNNUEvv.exe
  C:\Windows\System\yNNUEvv.exe
  2⤵
  PID:8364
- C:\Windows\System\UFIVlGX.exe
  C:\Windows\System\UFIVlGX.exe
  2⤵
  PID:11920
- C:\Windows\System\DuRCgut.exe
  C:\Windows\System\DuRCgut.exe
  2⤵
  PID:2812
- C:\Windows\System\TltczRH.exe
  C:\Windows\System\TltczRH.exe
  2⤵
  PID:5676
- C:\Windows\System\LoFGhjM.exe
  C:\Windows\System\LoFGhjM.exe
  2⤵
  PID:6168
- C:\Windows\System\PxyrHlj.exe
  C:\Windows\System\PxyrHlj.exe
  2⤵
  PID:12972
- C:\Windows\System\olKwkSi.exe
  C:\Windows\System\olKwkSi.exe
  2⤵
  PID:11684
- C:\Windows\System\zduqFnH.exe
  C:\Windows\System\zduqFnH.exe
  2⤵
  PID:12372
- C:\Windows\System\JNoYQTP.exe
  C:\Windows\System\JNoYQTP.exe
  2⤵
  PID:11892
- C:\Windows\System\nirQfdl.exe
  C:\Windows\System\nirQfdl.exe
  2⤵
  PID:12200
- C:\Windows\System\RdZPbyM.exe
  C:\Windows\System\RdZPbyM.exe
  2⤵
  PID:11500
- C:\Windows\System\sdahfJR.exe
  C:\Windows\System\sdahfJR.exe
  2⤵
  PID:11768
- C:\Windows\System\McEUlzd.exe
  C:\Windows\System\McEUlzd.exe
  2⤵
  PID:11748
- C:\Windows\System\MhGosDe.exe
  C:\Windows\System\MhGosDe.exe
  2⤵
  PID:8568
- C:\Windows\System\KKIUNxD.exe
  C:\Windows\System\KKIUNxD.exe
  2⤵
  PID:9728
- C:\Windows\System\SBsZYki.exe
  C:\Windows\System\SBsZYki.exe
  2⤵
  PID:9840
- C:\Windows\System\uLGKEbk.exe
  C:\Windows\System\uLGKEbk.exe
  2⤵
  PID:6536
- C:\Windows\System\pmSnYfB.exe
  C:\Windows\System\pmSnYfB.exe
  2⤵
  PID:11384
- C:\Windows\System\KTdGwvS.exe
  C:\Windows\System\KTdGwvS.exe
  2⤵
  PID:8888
- C:\Windows\System\yaJGDEB.exe
  C:\Windows\System\yaJGDEB.exe
  2⤵
  PID:8164
- C:\Windows\System\qcJUkor.exe
  C:\Windows\System\qcJUkor.exe
  2⤵
  PID:12892
- C:\Windows\System\JtWanqF.exe
  C:\Windows\System\JtWanqF.exe
  2⤵
  PID:12944
- C:\Windows\System\ldsytKu.exe
  C:\Windows\System\ldsytKu.exe
  2⤵
  PID:3196
- C:\Windows\System\WWUeZyA.exe
  C:\Windows\System\WWUeZyA.exe
  2⤵
  PID:6764
- C:\Windows\System\juHkGKy.exe
  C:\Windows\System\juHkGKy.exe
  2⤵
  PID:3400
- C:\Windows\System\gcxnoTC.exe
  C:\Windows\System\gcxnoTC.exe
  2⤵
  PID:9284
- C:\Windows\System\fyZieko.exe
  C:\Windows\System\fyZieko.exe
  2⤵
  PID:8428
- C:\Windows\System\UwjqePe.exe
  C:\Windows\System\UwjqePe.exe
  2⤵
  PID:3696
- C:\Windows\System\LdvtBZl.exe
  C:\Windows\System\LdvtBZl.exe
  2⤵
  PID:1692
- C:\Windows\System\eWHVmew.exe
  C:\Windows\System\eWHVmew.exe
  2⤵
  PID:11936
- C:\Windows\System\HUYSduv.exe
  C:\Windows\System\HUYSduv.exe
  2⤵
  PID:13264
- C:\Windows\System\VyiyeTX.exe
  C:\Windows\System\VyiyeTX.exe
  2⤵
  PID:10368
- C:\Windows\System\gbxikOm.exe
  C:\Windows\System\gbxikOm.exe
  2⤵
  PID:5460
- C:\Windows\System\eXxkrFA.exe
  C:\Windows\System\eXxkrFA.exe
  2⤵
  PID:5580
- C:\Windows\System\xQQRefb.exe
  C:\Windows\System\xQQRefb.exe
  2⤵
  PID:7676
- C:\Windows\System\OwJTvxR.exe
  C:\Windows\System\OwJTvxR.exe
  2⤵
  PID:11136
- C:\Windows\System\yhzzoBp.exe
  C:\Windows\System\yhzzoBp.exe
  2⤵
  PID:8196
- C:\Windows\System\xnoLXEU.exe
  C:\Windows\System\xnoLXEU.exe
  2⤵
  PID:10964
- C:\Windows\System\hAZIwRV.exe
  C:\Windows\System\hAZIwRV.exe
  2⤵
  PID:9280
- C:\Windows\System\BkuuQCZ.exe
  C:\Windows\System\BkuuQCZ.exe
  2⤵
  PID:4316
- C:\Windows\System\lhdUXpP.exe
  C:\Windows\System\lhdUXpP.exe
  2⤵
  PID:11856
- C:\Windows\System\qdPpQmF.exe
  C:\Windows\System\qdPpQmF.exe
  2⤵
  PID:11272
- C:\Windows\System\HhefAhx.exe
  C:\Windows\System\HhefAhx.exe
  2⤵
  PID:11552
- C:\Windows\System\MjARQrj.exe
  C:\Windows\System\MjARQrj.exe
  2⤵
  PID:12644
- C:\Windows\System\OueXuBl.exe
  C:\Windows\System\OueXuBl.exe
  2⤵
  PID:12344
- C:\Windows\System\JPnTPaY.exe
  C:\Windows\System\JPnTPaY.exe
  2⤵
  PID:12716
- C:\Windows\System\cjrMRYo.exe
  C:\Windows\System\cjrMRYo.exe
  2⤵
  PID:11804
- C:\Windows\System\RmyORDm.exe
  C:\Windows\System\RmyORDm.exe
  2⤵
  PID:6416
- C:\Windows\System\jalrcDo.exe
  C:\Windows\System\jalrcDo.exe
  2⤵
  PID:8056
- C:\Windows\System\pnPoUUU.exe
  C:\Windows\System\pnPoUUU.exe
  2⤵
  PID:7484
- C:\Windows\System\OrevYaA.exe
  C:\Windows\System\OrevYaA.exe
  2⤵
  PID:9268
- C:\Windows\System\kGEevfl.exe
  C:\Windows\System\kGEevfl.exe
  2⤵
  PID:7512
- C:\Windows\System\gCJRrfr.exe
  C:\Windows\System\gCJRrfr.exe
  2⤵
  PID:6888
- C:\Windows\System\NzFLRgd.exe
  C:\Windows\System\NzFLRgd.exe
  2⤵
  PID:12416
- C:\Windows\System\WIAFdxz.exe
  C:\Windows\System\WIAFdxz.exe
  2⤵
  PID:12468
- C:\Windows\System\QIFUusV.exe
  C:\Windows\System\QIFUusV.exe
  2⤵
  PID:7280
- C:\Windows\System\IXAaFEN.exe
  C:\Windows\System\IXAaFEN.exe
  2⤵
  PID:10764
- C:\Windows\System\xIZxAMQ.exe
  C:\Windows\System\xIZxAMQ.exe
  2⤵
  PID:10384
- C:\Windows\System\vfIwtDi.exe
  C:\Windows\System\vfIwtDi.exe
  2⤵
  PID:5152
- C:\Windows\System\LUTMbWJ.exe
  C:\Windows\System\LUTMbWJ.exe
  2⤵
  PID:4464
- C:\Windows\System\whmyZxP.exe
  C:\Windows\System\whmyZxP.exe
  2⤵
  PID:5716
- C:\Windows\System\TlUwtxj.exe
  C:\Windows\System\TlUwtxj.exe
  2⤵
  PID:12376
- C:\Windows\System\wreGzya.exe
  C:\Windows\System\wreGzya.exe
  2⤵
  PID:6868
- C:\Windows\System\tNDzYbL.exe
  C:\Windows\System\tNDzYbL.exe
  2⤵
  PID:6648
- C:\Windows\System\IXKhTuq.exe
  C:\Windows\System\IXKhTuq.exe
  2⤵
  PID:6912
- C:\Windows\System\skqPhiK.exe
  C:\Windows\System\skqPhiK.exe
  2⤵
  PID:8188
- C:\Windows\System\cwTLNxu.exe
  C:\Windows\System\cwTLNxu.exe
  2⤵
  PID:10932
- C:\Windows\System\TTujBOz.exe
  C:\Windows\System\TTujBOz.exe
  2⤵
  PID:12600
- C:\Windows\System\KeAAKrU.exe
  C:\Windows\System\KeAAKrU.exe
  2⤵
  PID:13064
- C:\Windows\System\rNVikOt.exe
  C:\Windows\System\rNVikOt.exe
  2⤵
  PID:11864
- C:\Windows\System\qJfswJn.exe
  C:\Windows\System\qJfswJn.exe
  2⤵
  PID:10048
- C:\Windows\System\BzWhwcQ.exe
  C:\Windows\System\BzWhwcQ.exe
  2⤵
  PID:11248
- C:\Windows\System\KaJYWaM.exe
  C:\Windows\System\KaJYWaM.exe
  2⤵
  PID:2176
- C:\Windows\System\DvgVDym.exe
  C:\Windows\System\DvgVDym.exe
  2⤵
  PID:6752
- C:\Windows\System\XARsUVo.exe
  C:\Windows\System\XARsUVo.exe
  2⤵
  PID:13132
- C:\Windows\System\uQbckTb.exe
  C:\Windows\System\uQbckTb.exe
  2⤵
  PID:4420
- C:\Windows\System\pYhYppF.exe
  C:\Windows\System\pYhYppF.exe
  2⤵
  PID:5240
- C:\Windows\System\vyRMTxf.exe
  C:\Windows\System\vyRMTxf.exe
  2⤵
  PID:3700
- C:\Windows\System\lhiPual.exe
  C:\Windows\System\lhiPual.exe
  2⤵
  PID:6652
- C:\Windows\System\kGIoPIa.exe
  C:\Windows\System\kGIoPIa.exe
  2⤵
  PID:13328
- C:\Windows\System\pWHaMyg.exe
  C:\Windows\System\pWHaMyg.exe
  2⤵
  PID:13356
- C:\Windows\System\vcZrKJd.exe
  C:\Windows\System\vcZrKJd.exe
  2⤵
  PID:13384
- C:\Windows\System\WrFbjDh.exe
  C:\Windows\System\WrFbjDh.exe
  2⤵
  PID:13416
- C:\Windows\System\XHbpgGW.exe
  C:\Windows\System\XHbpgGW.exe
  2⤵
  PID:13444
- C:\Windows\System\GitDTTE.exe
  C:\Windows\System\GitDTTE.exe
  2⤵
  PID:13472
- C:\Windows\System\uiZJdDk.exe
  C:\Windows\System\uiZJdDk.exe
  2⤵
  PID:13500
- C:\Windows\System\RMyrzvL.exe
  C:\Windows\System\RMyrzvL.exe
  2⤵
  PID:13528
- C:\Windows\System\VXBKIZC.exe
  C:\Windows\System\VXBKIZC.exe
  2⤵
  PID:13556
- C:\Windows\System\fMDiUAz.exe
  C:\Windows\System\fMDiUAz.exe
  2⤵
  PID:13584
- C:\Windows\System\maQfPXd.exe
  C:\Windows\System\maQfPXd.exe
  2⤵
  PID:13612
- C:\Windows\System\DMXEBRD.exe
  C:\Windows\System\DMXEBRD.exe
  2⤵
  PID:13640
- C:\Windows\System\mcbFBwk.exe
  C:\Windows\System\mcbFBwk.exe
  2⤵
  PID:13668
- C:\Windows\System\oAfDhVw.exe
  C:\Windows\System\oAfDhVw.exe
  2⤵
  PID:13696
- C:\Windows\System\SSfRvxW.exe
  C:\Windows\System\SSfRvxW.exe
  2⤵
  PID:13724
- C:\Windows\System\ofrPkOQ.exe
  C:\Windows\System\ofrPkOQ.exe
  2⤵
  PID:13752
- C:\Windows\System\PddQVTq.exe
  C:\Windows\System\PddQVTq.exe
  2⤵
  PID:13780
- C:\Windows\System\etYUYfQ.exe
  C:\Windows\System\etYUYfQ.exe
  2⤵
  PID:13808
- C:\Windows\System\rQDIhLU.exe
  C:\Windows\System\rQDIhLU.exe
  2⤵
  PID:13836
- C:\Windows\System\gpyMNmK.exe
  C:\Windows\System\gpyMNmK.exe
  2⤵
  PID:13864
- C:\Windows\System\HdpAcVm.exe
  C:\Windows\System\HdpAcVm.exe
  2⤵
  PID:13896
- C:\Windows\System\yMeDrgt.exe
  C:\Windows\System\yMeDrgt.exe
  2⤵
  PID:13924
- C:\Windows\System\hbarZLS.exe
  C:\Windows\System\hbarZLS.exe
  2⤵
  PID:13952
- C:\Windows\System\QVJteal.exe
  C:\Windows\System\QVJteal.exe
  2⤵
  PID:13980
- C:\Windows\System\aJEpatF.exe
  C:\Windows\System\aJEpatF.exe
  2⤵
  PID:14008
- C:\Windows\System\ANGjXnu.exe
  C:\Windows\System\ANGjXnu.exe
  2⤵
  PID:14036
- C:\Windows\System\ddGabbX.exe
  C:\Windows\System\ddGabbX.exe
  2⤵
  PID:14064
- C:\Windows\System\QdkBdyh.exe
  C:\Windows\System\QdkBdyh.exe
  2⤵
  PID:14092
- C:\Windows\System\Wzftibc.exe
  C:\Windows\System\Wzftibc.exe
  2⤵
  PID:14120
- C:\Windows\System\KagIVPL.exe
  C:\Windows\System\KagIVPL.exe
  2⤵
  PID:14148
- C:\Windows\System\ZXiNVgu.exe
  C:\Windows\System\ZXiNVgu.exe
  2⤵
  PID:14176
- C:\Windows\System\aqCHCdV.exe
  C:\Windows\System\aqCHCdV.exe
  2⤵
  PID:14204
- C:\Windows\System\cwKOSlq.exe
  C:\Windows\System\cwKOSlq.exe
  2⤵
  PID:14232
- C:\Windows\System\mmoQlYH.exe
  C:\Windows\System\mmoQlYH.exe
  2⤵
  PID:14260
- C:\Windows\System\TnBKgtd.exe
  C:\Windows\System\TnBKgtd.exe
  2⤵
  PID:14288
- C:\Windows\System\gTGflBw.exe
  C:\Windows\System\gTGflBw.exe
  2⤵
  PID:14316
- C:\Windows\System\rBKoXYQ.exe
  C:\Windows\System\rBKoXYQ.exe
  2⤵
  PID:13336
- C:\Windows\System\dlNLTwY.exe
  C:\Windows\System\dlNLTwY.exe
  2⤵
  PID:13412
- C:\Windows\System\CUzrsPk.exe
  C:\Windows\System\CUzrsPk.exe
  2⤵
  PID:13480
- C:\Windows\System\btuklhx.exe
  C:\Windows\System\btuklhx.exe
  2⤵
  PID:13544
- C:\Windows\System\JwfgxfJ.exe
  C:\Windows\System\JwfgxfJ.exe
  2⤵
  PID:13608
- C:\Windows\System\yLRgelM.exe
  C:\Windows\System\yLRgelM.exe
  2⤵
  PID:4568
- C:\Windows\System\mhRtOJJ.exe
  C:\Windows\System\mhRtOJJ.exe
  2⤵
  PID:13720
- C:\Windows\System\zmgjOdA.exe
  C:\Windows\System\zmgjOdA.exe
  2⤵
  PID:13776
- C:\Windows\System\WRKYahP.exe
  C:\Windows\System\WRKYahP.exe
  2⤵
  PID:13844
- C:\Windows\System\IIQTxBp.exe
  C:\Windows\System\IIQTxBp.exe
  2⤵
  PID:13912
- C:\Windows\System\NTYXKrL.exe
  C:\Windows\System\NTYXKrL.exe
  2⤵
  PID:13976
- C:\Windows\System\YqPIGvl.exe
  C:\Windows\System\YqPIGvl.exe
  2⤵
  PID:14044
- C:\Windows\System\rhuwdFy.exe
  C:\Windows\System\rhuwdFy.exe
  2⤵
  PID:14108
- C:\Windows\System\NZHYLdA.exe
  C:\Windows\System\NZHYLdA.exe
  2⤵
  PID:14172
- C:\Windows\System\CarudSy.exe
  C:\Windows\System\CarudSy.exe
  2⤵
  PID:13872
- C:\Windows\System\CwqpuSa.exe
  C:\Windows\System\CwqpuSa.exe
  2⤵
  PID:14296
- C:\Windows\System\OWvguKx.exe
  C:\Windows\System\OWvguKx.exe
  2⤵
  PID:13372
- C:\Windows\System\zfKdOVE.exe
  C:\Windows\System\zfKdOVE.exe
  2⤵
  PID:13564
- C:\Windows\System\LyVXHvi.exe
  C:\Windows\System\LyVXHvi.exe
  2⤵
  PID:13692
- C:\Windows\System\igPbgNM.exe
  C:\Windows\System\igPbgNM.exe
  2⤵
  PID:13832
- C:\Windows\System\JYVXOLj.exe
  C:\Windows\System\JYVXOLj.exe
  2⤵
  PID:1600
- C:\Windows\System\CRneJAB.exe
  C:\Windows\System\CRneJAB.exe
  2⤵
  PID:14100
- C:\Windows\System\xGAGmnn.exe
  C:\Windows\System\xGAGmnn.exe
  2⤵
  PID:14228
- C:\Windows\System\sYZqZXo.exe
  C:\Windows\System\sYZqZXo.exe
  2⤵
  PID:13432
- C:\Windows\System\vxsCTfn.exe
  C:\Windows\System\vxsCTfn.exe
  2⤵
  PID:13768
- C:\Windows\System\YkAdfkl.exe
  C:\Windows\System\YkAdfkl.exe
  2⤵
  PID:14080
- C:\Windows\System\xUEitqZ.exe
  C:\Windows\System\xUEitqZ.exe
  2⤵
  PID:12392
- C:\Windows\System\VueCTIF.exe
  C:\Windows\System\VueCTIF.exe
  2⤵
  PID:2804
- C:\Windows\System\shkGGsu.exe
  C:\Windows\System\shkGGsu.exe
  2⤵
  PID:14348
- C:\Windows\System\fOBJucK.exe
  C:\Windows\System\fOBJucK.exe
  2⤵
  PID:14376
- C:\Windows\System\KeaTIMC.exe
  C:\Windows\System\KeaTIMC.exe
  2⤵
  PID:14404
- C:\Windows\System\xVdyzui.exe
  C:\Windows\System\xVdyzui.exe
  2⤵
  PID:14432
- C:\Windows\System\cAyyaeK.exe
  C:\Windows\System\cAyyaeK.exe
  2⤵
  PID:14460
- C:\Windows\System\drsjZjV.exe
  C:\Windows\System\drsjZjV.exe
  2⤵
  PID:14488
- C:\Windows\System\zNxqFPN.exe
  C:\Windows\System\zNxqFPN.exe
  2⤵
  PID:14520
- C:\Windows\System\nHrohCd.exe
  C:\Windows\System\nHrohCd.exe
  2⤵
  PID:14548
- C:\Windows\System\pDnSzpU.exe
  C:\Windows\System\pDnSzpU.exe
  2⤵
  PID:14576
- C:\Windows\System\YmQnYMU.exe
  C:\Windows\System\YmQnYMU.exe
  2⤵
  PID:14604
- C:\Windows\System\qutXmsY.exe
  C:\Windows\System\qutXmsY.exe
  2⤵
  PID:14632
- C:\Windows\System\XkpcvAp.exe
  C:\Windows\System\XkpcvAp.exe
  2⤵
  PID:14660
- C:\Windows\System\tCFeZBh.exe
  C:\Windows\System\tCFeZBh.exe
  2⤵
  PID:14688
- C:\Windows\System\PSvQVBt.exe
  C:\Windows\System\PSvQVBt.exe
  2⤵
  PID:14716
- C:\Windows\System\ynQPTfq.exe
  C:\Windows\System\ynQPTfq.exe
  2⤵
  PID:14744
- C:\Windows\System\LSVxYPx.exe
  C:\Windows\System\LSVxYPx.exe
  2⤵
  PID:14772
- C:\Windows\System\WKfDMnl.exe
  C:\Windows\System\WKfDMnl.exe
  2⤵
  PID:14800
- C:\Windows\System\HUkEtft.exe
  C:\Windows\System\HUkEtft.exe
  2⤵
  PID:14828
- C:\Windows\System\yPHguzA.exe
  C:\Windows\System\yPHguzA.exe
  2⤵
  PID:14856
- C:\Windows\System\kGmdMTy.exe
  C:\Windows\System\kGmdMTy.exe
  2⤵
  PID:15276
- C:\Windows\System\GgiNvMT.exe
  C:\Windows\System\GgiNvMT.exe
  2⤵
  PID:15308
- C:\Windows\System\MNLzHAJ.exe
  C:\Windows\System\MNLzHAJ.exe
  2⤵
  PID:14836
- C:\Windows\System\rulxEWh.exe
  C:\Windows\System\rulxEWh.exe
  2⤵
  PID:15068
- C:\Windows\System\FDzZDTw.exe
  C:\Windows\System\FDzZDTw.exe
  2⤵
  PID:5816
- C:\Windows\System\yYxRijL.exe
  C:\Windows\System\yYxRijL.exe
  2⤵
  PID:15292
- C:\Windows\System\JqLAnPD.exe
  C:\Windows\System\JqLAnPD.exe
  2⤵
  PID:15324
- C:\Windows\System\sjnlRAn.exe
  C:\Windows\System\sjnlRAn.exe
  2⤵
  PID:14344
- C:\Windows\System\NQTqSei.exe
  C:\Windows\System\NQTqSei.exe
  2⤵
  PID:14668
- C:\Windows\System\WAJACcC.exe
  C:\Windows\System\WAJACcC.exe
  2⤵
  PID:14712
- C:\Windows\System\vrbOGzm.exe
  C:\Windows\System\vrbOGzm.exe
  2⤵
  PID:15060
- C:\Windows\System\xfUyJhX.exe
  C:\Windows\System\xfUyJhX.exe
  2⤵
  PID:5000

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_o3avcl0u.4hg.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\AQegtld.exe

Filesize
2.9MB

MD5
0de116bbaf82fa96862abcb756b0ce36

SHA1
0349e6b33968e321c23bdb27361fe9a407cb114c

SHA256
b60ce58bdea4957df4aec1f7e2ae143b06cf707ee11d00cf8fe7179797c15356

SHA512
d51af29f5316455ba1fc9e446df79c29c57e3de1a91bd9d75fa508db16ecf0992f4996eab3dfca6b13604864619a54c1220d19cc94febbbfb9f581c9d749eab0

Download Submit
C:\Windows\System\AWJftSt.exe

Filesize
2.9MB

MD5
7770f8b2d379791b84b921f06a371926

SHA1
7678daf21e8698a6a0af70c1d5cfd9492d100da3

SHA256
092925e13d9b4a86c3aa1d8ea348cab20b53c17f04664bf422a86d405b886db5

SHA512
cdb59af98f67524a7aa4c8635df83394ff7d4ffaea7c42aa960e0e994b4b089673940f7cabd945f2f735f0deabb249a632e6d31608133ae28a13da6f548e5aa8

Download Submit
C:\Windows\System\AWPkdGb.exe

Filesize
2.9MB

MD5
410647f8795914a4cfd9ec691db33e04

SHA1
e90c34b63234739a25fb61787b73d3e3d0dc8760

SHA256
e0418edca9aba873c10863473c101e5607739fa466e0a24bfbdceb85f71ba199

SHA512
f774fc837a6beaf9200555c7d60f8ff6f2b95a45433de2247feb88524dc94207dacbe140c5a0d80ba31aa6d1d133ceafd21ea59e232631bfede29614033a5418

Download Submit
C:\Windows\System\DphSCUF.exe

Filesize
2.9MB

MD5
b0e7f6cf0b0a6c61e8d665a1f0537992

SHA1
ac6ba63c4d916c249099f976ff5b638d2d46d9bb

SHA256
2326066bd0e46c3f20f0a4ada5a9f1c4eddb488985117ab0883bef48b3e0440c

SHA512
a80e33e5de99d8f67f714ad1b4ed7538739b058ecea09fee5c7ed4331d4a93000cab5ab2e21486cd9a668e1f55225b1a3286c5330b69b42b37702497ca683adf

Download Submit
C:\Windows\System\EBXuNCm.exe

Filesize
2.9MB

MD5
7835a29275a644d9fb0b6601724e84b8

SHA1
fe3e89668720096a1d3737820b9f07bfb0d93b86

SHA256
15b372ea51547b79757f0448febca880800e0efa76ca58d714155889aa18a82a

SHA512
269641cfbaedd513a6974d4acfbcc84e647cb7eb32f7cce3a194d57f177454b608985f8b4698e5775cea9ed370c3fad01e9f941f4eae1657186b341bd3cc6503

Download Submit
C:\Windows\System\EtYobgy.exe

Filesize
2.9MB

MD5
d350e348578cf934d738e1d4432a8628

SHA1
f0ba276aedd11d3e82966ddd09a64f34cbe6188a

SHA256
7fe0a2b7ce5aff5e01abc808059a73a4d9e0dea4530fdf0678cbeff7509dfef1

SHA512
e6fa2ed38e8042be5a36356dbb7881225485f654f30d18b493d4ca4e8f6dbdf73dfb666253097ef868a058504c4d046ef87c1bdb81901494f4fcd36f554d9fe1

Download Submit
C:\Windows\System\FjdQWfl.exe

Filesize
2.9MB

MD5
ae6673255671b40d090ff375bcf9dd8f

SHA1
1abf7024db00923fb386f1b91af51526da1c2c1d

SHA256
c095e29b468d07590f57d0149ee038c0c5644bb6b98a197da5a299e90b149dd9

SHA512
a440d3556ef00d56bd6e09ac2bd25c66098a587e96d974f2f0305a0d2e6a2c0ba71d7964ca2b6dceb4360b8740d31c74971996eb4cf496af5b65275cdc1d90e9

Download Submit
C:\Windows\System\IujRotF.exe

Filesize
2.9MB

MD5
39d8cbbf62da1093d6eb5466a904166b

SHA1
d06171924f6eecc08f113c9b596c2c49cd4988d3

SHA256
8e17b26fa9403b2e3ec469b405de354eb1386623436a794888d932a614c97e25

SHA512
41e8910e5ce58671605b51cbaa967d77e85e45e19bf2f83f3012a15cfd691c9a20557656959ca2bb32fc04587422abf2e59b147cd638a6f2586f0585fd0c4cea

Download Submit
C:\Windows\System\LOSVVFU.exe

Filesize
2.9MB

MD5
0c6bfc36eeb6623fab6a55ddf4245e28

SHA1
5cfa9e9b9fcfa2e936c497c1406ed122c34e6fc6

SHA256
0a26ff6664e10c7eb12866fdf59f87d2adb3e436b296735dbb6672c3f4711421

SHA512
bee99a064423859fc4f2f0f2359d5edf7f59e31b12c5742bb4a998c279f6087c2564c66f6a26dafab1f7e6c2e9ecd94b335ae2635039dea6964920f344e5c2d7

Download Submit
C:\Windows\System\MaUQFJf.exe

Filesize
2.9MB

MD5
11e8b32985b9a1e74bfd2e64d6b775cb

SHA1
df95eba2acbb3bf8d221326dcedc8d814654ffad

SHA256
447d3d17b81eb6be34e518e416447161cb2b2061c4e129f4b466e00365088e1d

SHA512
cbfa52f47c3daacf2d8491df662cd674ce0e3b9f1a436f9f974a421b5cb1895e335efe92dabba5718014471eae0d718ca389fad034a2ba2796aea44ed40fb796

Download Submit
C:\Windows\System\ObKfhlP.exe

Filesize
2.9MB

MD5
ecf8e8f23b041f31fa1bbb62b7e7bb65

SHA1
82feb9b6b638bc6dfe0822666c37b433427a4f69

SHA256
90bc7421d90a99afd8d7ee2bd1431796289170991f683a4cd5169a639b31c70c

SHA512
16cfe63fef653acce66bc66ba2f86a2ad3af7f7a789cc1eac5a26ed693075182f5c8a3ece7b6b0dd8936a835f0d50c04c50b2ee9121f1d1c58e6a378ed6ab307

Download Submit
C:\Windows\System\QjDlEZD.exe

Filesize
2.9MB

MD5
6aa96e69ee8b4fcb0eb2fd8423fad222

SHA1
7ab74c88eadc6a953a15e89bbf7d4ab4895f53b8

SHA256
e327440aaf1aa53bcf9e88171be207a28b10660321b17147a13bc35fde067169

SHA512
66b9d836d8376e6f81699f350800aa7d78907e76bffb12f3cb1efcdc484e6124a79ada397d7cf791e3ff466adc8e4f41cdbd89af9250ba2a0cbc3478f3970bc4

Download Submit
C:\Windows\System\RUbaWXm.exe

Filesize
2.9MB

MD5
698c7f39644516546d463c1358ae1059

SHA1
1fde57c354eb5f4dce431eb1acfa25ff8f034b22

SHA256
da6466d3976f08ac58b9fe0149e590e1ff6547508c7e31bccbf89efdf4edbf1b

SHA512
73fd010bae0bd498f3270369aad8fbb6277b1a2b75dd88af96839a65da777b56aec86cba6b6c3d79172514ddbc82ec45404bbc3c98d312d9e42fdaa235b98505

Download Submit
C:\Windows\System\UnPiiKP.exe

Filesize
2.9MB

MD5
e78b5507cf435f77a40fa69fff82336a

SHA1
5556b4a5e3fc97ae38fb7fdc99eae222f5356a81

SHA256
aa0135f2f9406e50e6540d6133b3d26e4c4560b0db014ae936ed0b5839fe4fca

SHA512
26f7502cf92edb095f6b9d9af22729530fefb5e6109880989a781956ded3f50e6a94a5f596784cf1d29e3369ba12af5662bb14e940d557f47083a82d2d1698c6

Download Submit
C:\Windows\System\VurXQrN.exe

Filesize
2.9MB

MD5
8131e77fc9c4128d4037dbca45bec57a

SHA1
e4c3c41ba91ea7b6dfedcbd38c41b243f1afde74

SHA256
3cc4c5f51b78c4db13bbe2304fb378a5f9842f92aff7d9c70bf305da14bf9a31

SHA512
e73dbd967ea1d1df13af45b5003ebae2484c06ecbecf21a2d2d72fbb571c6d4c73c8584de4d8d465a802f9b60024c5d45c4b20cbfda69203ded1814de748493e

Download Submit
C:\Windows\System\ZHNdPET.exe

Filesize
2.9MB

MD5
2573cb3e5e695b31ee3697cca996e1b9

SHA1
4ad7cf5beb08dadf6b6b4cc778a95501f987ee61

SHA256
12ec93b1beaab1e2fe42a621141e7ecb71a38b7aae1f52a604d59ab31a0d0ec0

SHA512
f9e24740fa0cc4958fda74ae177784b4f48163e14c3fda24f2f00ab353dd68cedf6b4df4a2f3d5f271ab7d74e521e4c03237f0090a527a0ffeb1d5d93354c30f

Download Submit
C:\Windows\System\bxrCWST.exe

Filesize
2.9MB

MD5
d7cff6149d9e3980971e829aeb943114

SHA1
94127f76471d01ffac0c2c3c04b170c4bd5370d3

SHA256
43a90a45f20a3e97476ad264dae4615e825976809c000b603eeef46d949dff62

SHA512
a1194d92945daf9af62cbb99d3b4277f58a63c1f23b8cdb5b16428bb5e232160c0247657f7db0b66b1d18eba4559b13b2a8f62041d640b96538722855e7a067d

Download Submit
C:\Windows\System\cfLbhiR.exe

Filesize
2.9MB

MD5
db017347f2abf3bad904da6b6121feed

SHA1
b10828e936826279f02a3f1767c317d89888e377

SHA256
63874c2f01e607607bec1527638c5c99cca3f2cac012f725dcfbb5e29e6ab3a1

SHA512
c91d50382607fea1fa768b6c187a13363cdf3992ca305e37dd3c9e586f6fccdf376ed37c9595d3159e8ca2a12a923ae55f28207d21c1a3f1cc9559a0d143cc03

Download Submit
C:\Windows\System\cgRJTPq.exe

Filesize
2.9MB

MD5
fdc14204e2d446c12d32f6a61dd4cbbd

SHA1
74b92acae4be423e4f149de86293065f5cdbd1e6

SHA256
6d10c9266cf0c7e4c724db91f41bfb5492ee0b445b04634391c602633c59f120

SHA512
1cb0eb34b872e7a35ddd011a4f5cc8eb505309eeaddac6404c73b4df41b3a864ec98f880694beb1edef87e6e5169f9d3b7e3c974c483435aba8fb65c2e6fd97a

Download Submit
C:\Windows\System\hffCEPN.exe

Filesize
2.9MB

MD5
e2ed4403ce44442f1b46833831379923

SHA1
61ad124fac27ee5b0bd8b9172b580985f746ef43

SHA256
eb65f2f1bc458e23acf0a6a13c489fa8f912c9b4ad5dd14fbe55853fcf0ee1a5

SHA512
3c915bbe1671cee2c5fa22932b7826c2b6b70881caa9dde32b2b9dcdd59a1ea41ea9cd283a1b32cc82a947b49585f9cf67e73e97e4c52e39adf0116cfcdc6864

Download Submit
C:\Windows\System\kUsNibf.exe

Filesize
2.9MB

MD5
e110198625ab3aea0981005c4044447a

SHA1
67d4f2607cd6c890e689947d2e6999c3661cd67f

SHA256
22165bdac81303fdd328b907f496db7f5286fd0747f5639f2ae6ccae82846100

SHA512
6579660c72f4230f81760ba7e865536b2771bc127bf158a215f5c44ba1ce8c48b2be642121dace7b326eb14866a4a90923705e72c09e9edfa07033bdcf6297ae

Download Submit
C:\Windows\System\onGkMPL.exe

Filesize
2.9MB

MD5
73ac2032daf5eb75c014a4428bcaadfe

SHA1
26f975bc24b6c72fc91db0c03a7fbaea039e2164

SHA256
1042d216a99ce9f57c8f30f8c730baf0cd465301d56b7d82cd08748439d4be5a

SHA512
d5af236504efd5a1c52c5a1fe1f15429b690d137608a6154b0a25c185bad05d37f1f368775d2c22deb1888ee79d6a74f3a4b6da0e4e64e967285d1399e04d78b

Download Submit
C:\Windows\System\pTzXcwe.exe

Filesize
18B

MD5
854738547b63320c73bf9c715200ecb6

SHA1
917fd77692dbe3066d12a3f7a61f74356703a251

SHA256
a5d2f85e5e72b657d951bd8e006276e5c326f0acc3e30c906739394af81ea192

SHA512
a2208e3e56df7e95d884257186936d0fe5f463d4ba9c0fac8aef967090f22abcaf2c3a4be14816dc91af22fbe5cbfb51ddc560ed722126dc8c5d9a4ae4d973e2

Download Submit
C:\Windows\System\pmPAHhM.exe

Filesize
2.9MB

MD5
d22358e86848d0c88cad00d8dcd8f039

SHA1
2d9955125245efbd9fafb1c914bc29efd454b9c8

SHA256
1cc317bd23acbfaaa4a2912872f789f81e8165204803c554f765bd4eb27a59fa

SHA512
9e78c33e2e1b2662ee4e47797fc5add89d970714fa7c52fdea45563158d1d43b335594ddca56a5a98dd290820ae7b935a9860e09c6e76161482686a2ec937a2d

Download Submit
C:\Windows\System\tXzhibf.exe

Filesize
2.9MB

MD5
8a582e06a8b9b4aaa2b20be7bf2acd69

SHA1
a4019a22042f93fe575d2c9bb9a9706c11571c32

SHA256
e8d8cadc634c065b467145a8e55a92944c54727b4cd592c57f2bc7e388cb6aa6

SHA512
d706b64bef0bf1ece091708cb9e32777a84cf78135227803118622f06806f757e03935aa2400a9e8d68562cc78426e231260443d67bcaf2a0cce292ef1b8ca6e

Download Submit
C:\Windows\System\vLILqDe.exe

Filesize
2.9MB

MD5
1501fd25eaed7949e84fac0d9cfc50b8

SHA1
e93faabbfe6327a41f713405ef56354fee00207f

SHA256
7d13e65c26e7db57a055697d03a8a83821ea4779e36f349ffd2e456b880c7038

SHA512
67f2f3403422582e5515698ea96224c44e4802a9aa54c8d996d4fb1f4d8361a6c8b3cf5387a590697f97c4fa6a7e83d60926b79ee1d5e399190237ffd983d671

Download Submit
C:\Windows\System\wCWNSNs.exe

Filesize
2.9MB

MD5
5a8fb1e749039d002a91cfe5f16b7e8e

SHA1
5c3d9c6d73e822757cd36985d832eba716f10cc5

SHA256
ff23f45082c4f2f50cf0294f93f045454e828b724ccfda6b4bfcc9957f1e8570

SHA512
98abba4838df3f580558a3cfb7cc3d3bf2e75abb14bcb4d4fec6dd79accad020da65aefb525dd8816cf6a45dec5def242be298909fdd5369d769bb355add86e8

Download Submit
C:\Windows\System\wRLNopV.exe

Filesize
2.9MB

MD5
b40af36a02b41d6073b9031b86bceafd

SHA1
6530534609d2309ef0cd2a999588777d37468eaf

SHA256
a3cd05b7be1b821214b1d126427e35c62f23be116af166da15959b2b7349ce51

SHA512
36dbf6b6a1689f0c1165cdb93b1d4daa664a07c77b1f185a1e53ca85c64851009851895d889491b90f67b0a68ca398e65ecafa2043c1ac8d9df13394d9b62171

Download Submit
C:\Windows\System\wlMsiSj.exe

Filesize
2.9MB

MD5
5520ce2f61d0f20d4fd88555d668623c

SHA1
14f2f622852a009716bbec097e324e05e44cde2b

SHA256
5398e0bfbcfe0b85bbd65e66fd35ececfece22e044697204dcd6c84f1bae776e

SHA512
6e865d0ecedc02b9e66fded09aa4fd3b8176213678ccf3aa80c9ef05ea2d29fbb1b82b3f46bfdc354a1ffeb493a20c76050804914a512437288fdd5b955d6b15

Download Submit
C:\Windows\System\xGMMble.exe

Filesize
2.9MB

MD5
24225a35ab9ebcce9f895c400997b07a

SHA1
ecaff824cc951b0ebcfd3b072e82b89cdfc3ba5f

SHA256
934da434059de62c333a11cb46824f02366d16cd2e6eceb19cac1dcf297fbc21

SHA512
0c7e111eb130d246d2853f82c71a09938a0223efaaf86b6c879a20acf18e7b6ee95b075d282bf3ea4967b91f71c68694515833e16f6b987cbeb1617869aab4f7

Download Submit
C:\Windows\System\xdExlUx.exe

Filesize
2.9MB

MD5
4dc585b31b9bb6c51a715746689811bb

SHA1
19f90761b0e2a0d12b17ad83a0115e61994fc2ba

SHA256
2c9f78b20121a4cf13b53208022c545de5cf7bda997166635ba0509580b66669

SHA512
f6e1d32150a880b770fedcc5e441731eec92f9790ce61284062ad5cc58e278557aea4a97ade5af0918d47cc8af27ee64ca0c8e466315ebbf02f146c913e0852f

Download Submit
C:\Windows\System\yoaIalE.exe

Filesize
2.9MB

MD5
949c24c9c66aeb1646fa81ea90c52b17

SHA1
825b8a113c5cb8c6667534c19a10d3e7f84157fc

SHA256
90f6d86ec3b1f1dad98cd177396fff648a1898ae1d2a7233adaa59a9ea3d595d

SHA512
61c9ed73560adc9707e76bda7d2fb172c10d05d65a3337734a818cdbd2afe768a3193e42b8f0fce3fcb84d284d80433a19fab2819791166c251787d16d1ecd49

Download Submit
C:\Windows\System\yqmeMLi.exe

Filesize
2.9MB

MD5
e78801dc48d14e6e848dae028b58e7ca

SHA1
eb249772144edbfce7ae27fdf4469edb2c1c2950

SHA256
5050026e512d0c127dc31d8ce735466cc0ed61c32cc96868bdeef4f54e14f81f

SHA512
da3ea7726397242732853645d4da408be22d568c8b735197d60958ddfe7d72317837ee8c1f433df4932653ddb78727710e9a1c3b7b58bc21d7ce527662467765

Download Submit
memory/468-57-0x00007FF79CA60000-0x00007FF79CE56000-memory.dmp

Filesize
4.0MB

Download
memory/512-377-0x00007FF6B9100000-0x00007FF6B94F6000-memory.dmp

Filesize
4.0MB

Download
memory/696-14-0x00007FF651CD0000-0x00007FF6520C6000-memory.dmp

Filesize
4.0MB

Download
memory/1000-270-0x00007FF7E0DB0000-0x00007FF7E11A6000-memory.dmp

Filesize
4.0MB

Download
memory/1528-62-0x00007FF7D8130000-0x00007FF7D8526000-memory.dmp

Filesize
4.0MB

Download
memory/1960-86-0x00007FF6B08E0000-0x00007FF6B0CD6000-memory.dmp

Filesize
4.0MB

Download
memory/2064-394-0x00007FF6E0260000-0x00007FF6E0656000-memory.dmp

Filesize
4.0MB

Download
memory/2248-63-0x00007FF6A8990000-0x00007FF6A8D86000-memory.dmp

Filesize
4.0MB

Download
memory/2260-60-0x00007FF7EFD30000-0x00007FF7F0126000-memory.dmp

Filesize
4.0MB

Download
memory/2288-392-0x00007FF76C900000-0x00007FF76CCF6000-memory.dmp

Filesize
4.0MB

Download
memory/2352-61-0x00007FF611FE0000-0x00007FF6123D6000-memory.dmp

Filesize
4.0MB

Download
memory/2428-369-0x00007FF724550000-0x00007FF724946000-memory.dmp

Filesize
4.0MB

Download
memory/2532-397-0x00007FF77D3C0000-0x00007FF77D7B6000-memory.dmp

Filesize
4.0MB

Download
memory/2696-252-0x00007FF710D30000-0x00007FF711126000-memory.dmp

Filesize
4.0MB

Download
memory/2928-312-0x00007FF7E0960000-0x00007FF7E0D56000-memory.dmp

Filesize
4.0MB

Download
memory/3356-391-0x00007FF65B930000-0x00007FF65BD26000-memory.dmp

Filesize
4.0MB

Download
memory/3476-43-0x00007FF6BF6F0000-0x00007FF6BFAE6000-memory.dmp

Filesize
4.0MB

Download
memory/3664-384-0x00007FF704A00000-0x00007FF704DF6000-memory.dmp

Filesize
4.0MB

Download
memory/3876-2187-0x00007FFD4EDA3000-0x00007FFD4EDA5000-memory.dmp

Filesize
8KB

Download
memory/3876-15-0x00007FFD4EDA3000-0x00007FFD4EDA5000-memory.dmp

Filesize
8KB

Download
memory/3876-64-0x000001237EE00000-0x000001237F5A6000-memory.dmp

Filesize
7.6MB

Download
memory/3876-34-0x00007FFD4EDA0000-0x00007FFD4F861000-memory.dmp

Filesize
10.8MB

Download
memory/3876-1938-0x00007FFD4EDA0000-0x00007FFD4F861000-memory.dmp

Filesize
10.8MB

Download
memory/3876-50-0x000001237E580000-0x000001237E5A2000-memory.dmp

Filesize
136KB

Download
memory/3876-28-0x00007FFD4EDA0000-0x00007FFD4F861000-memory.dmp

Filesize
10.8MB

Download
memory/4068-338-0x00007FF7F2AF0000-0x00007FF7F2EE6000-memory.dmp

Filesize
4.0MB

Download
memory/4068-4477-0x00007FF7F2AF0000-0x00007FF7F2EE6000-memory.dmp

Filesize
4.0MB

Download
memory/4196-4488-0x00007FF793E90000-0x00007FF794286000-memory.dmp

Filesize
4.0MB

Download
memory/4196-371-0x00007FF793E90000-0x00007FF794286000-memory.dmp

Filesize
4.0MB

Download
memory/4296-1931-0x00007FF778AC0000-0x00007FF778EB6000-memory.dmp

Filesize
4.0MB

Download
memory/4296-0-0x00007FF778AC0000-0x00007FF778EB6000-memory.dmp

Filesize
4.0MB

Download
memory/4296-1-0x000001C25B710000-0x000001C25B720000-memory.dmp

Filesize
64KB

Download
memory/4520-387-0x00007FF784A70000-0x00007FF784E66000-memory.dmp

Filesize
4.0MB

Download
memory/4520-4487-0x00007FF784A70000-0x00007FF784E66000-memory.dmp

Filesize
4.0MB

Download
memory/4796-90-0x00007FF6453A0000-0x00007FF645796000-memory.dmp

Filesize
4.0MB

Download
memory/4880-285-0x00007FF792810000-0x00007FF792C06000-memory.dmp

Filesize
4.0MB

Download
memory/4880-4420-0x00007FF792810000-0x00007FF792C06000-memory.dmp

Filesize
4.0MB

Download
memory/4996-56-0x00007FF7D1FE0000-0x00007FF7D23D6000-memory.dmp

Filesize
4.0MB

Download