xmrig | 191c9aaf33a1e4098809d5f06ecb72f1ec3211b651ad75e9480697da6edf2f17

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
14/05/2024, 09:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bbfe97d84a7f3c4942fecaf078d4da40_NeikiAnalytics.exe
Size

1.4MB
MD5

bbfe97d84a7f3c4942fecaf078d4da40
SHA1

86d3debf4ed16fc826d075c8c1401f52d66a5009
SHA256

191c9aaf33a1e4098809d5f06ecb72f1ec3211b651ad75e9480697da6edf2f17
SHA512

685ae074bb84aade2aecacbeb970a06e8047a1bbe6785f40103de06b6f31a03d22b82d73195278316a725863f6601cfe9d9d62202710a642d479d7f3d170848d
SSDEEP

24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjhnXwx8/2Pbx/mbGR+caMj0vO/q1:Lz071uv4BPMkHC0IlnASEx/RkiTQ

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 23 IoCs

miner

resource	yara_rule
behavioral2/memory/2764-76-0x00007FF6122E0000-0x00007FF6126D2000-memory.dmp	xmrig
behavioral2/memory/1996-86-0x00007FF650010000-0x00007FF650402000-memory.dmp	xmrig
behavioral2/memory/920-87-0x00007FF757A90000-0x00007FF757E82000-memory.dmp	xmrig
behavioral2/memory/1596-85-0x00007FF64B7A0000-0x00007FF64BB92000-memory.dmp	xmrig
behavioral2/memory/4800-80-0x00007FF70D160000-0x00007FF70D552000-memory.dmp	xmrig
behavioral2/memory/4964-72-0x00007FF7E3E90000-0x00007FF7E4282000-memory.dmp	xmrig
behavioral2/memory/5012-66-0x00007FF7FD6D0000-0x00007FF7FDAC2000-memory.dmp	xmrig
behavioral2/memory/1640-51-0x00007FF7F3450000-0x00007FF7F3842000-memory.dmp	xmrig
behavioral2/memory/4080-47-0x00007FF649D40000-0x00007FF64A132000-memory.dmp	xmrig
behavioral2/memory/2828-13-0x00007FF6F72C0000-0x00007FF6F76B2000-memory.dmp	xmrig
behavioral2/memory/924-164-0x00007FF689070000-0x00007FF689462000-memory.dmp	xmrig
behavioral2/memory/4364-161-0x00007FF7F0810000-0x00007FF7F0C02000-memory.dmp	xmrig
behavioral2/memory/4452-157-0x00007FF71FB50000-0x00007FF71FF42000-memory.dmp	xmrig
behavioral2/memory/628-156-0x00007FF6B6660000-0x00007FF6B6A52000-memory.dmp	xmrig
behavioral2/memory/1892-152-0x00007FF6B6D40000-0x00007FF6B7132000-memory.dmp	xmrig
behavioral2/memory/2432-129-0x00007FF65B080000-0x00007FF65B472000-memory.dmp	xmrig
behavioral2/memory/1176-115-0x00007FF610450000-0x00007FF610842000-memory.dmp	xmrig
behavioral2/memory/4820-1433-0x00007FF7C9B90000-0x00007FF7C9F82000-memory.dmp	xmrig
behavioral2/memory/2832-1444-0x00007FF690490000-0x00007FF690882000-memory.dmp	xmrig
behavioral2/memory/1752-2568-0x00007FF69CCC0000-0x00007FF69D0B2000-memory.dmp	xmrig
behavioral2/memory/2364-2720-0x00007FF6E35F0000-0x00007FF6E39E2000-memory.dmp	xmrig
behavioral2/memory/2972-3359-0x00007FF773AD0000-0x00007FF773EC2000-memory.dmp	xmrig
behavioral2/memory/3020-3362-0x00007FF61D8C0000-0x00007FF61DCB2000-memory.dmp	xmrig

Blocklisted process makes network request 5 IoCs

flow	pid	Process
10	1900	powershell.exe
12	1900	powershell.exe
16	1900	powershell.exe
17	1900	powershell.exe
20	1900	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
1900	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
2832	EGbzEiR.exe
2828	PbLLjYN.exe
4080	jjhFLlT.exe
4800	FXbPOoh.exe
1640	teKZoKF.exe
5012	itbJimu.exe
1596	unRwqLW.exe
4964	MHAhaxp.exe
2764	nMUzLjx.exe
1996	VyVocBQ.exe
1752	CRxuvFY.exe
920	jnIZTvW.exe
2364	kXxjRGH.exe
1176	RfhxdfU.exe
624	oyxkshB.exe
2432	GDwEWjT.exe
3636	Hrydups.exe
2972	huOcCUr.exe
628	VdxRElW.exe
4452	SzfJNIY.exe
3020	aoVrntV.exe
1892	RkHAeQR.exe
4364	wRvdpIm.exe
924	bfCQAlP.exe
4044	TZtoKUH.exe
4228	rjxddpq.exe
1468	nUgpgBr.exe
1036	qaqznUc.exe
1584	IhZpuQK.exe
3032	zfXtzVt.exe
1508	OqeLoFY.exe
4548	qaMAMiO.exe
4412	xDSNKGj.exe
4500	MRKOdca.exe
4324	LKvcdjA.exe
632	QWHnGRk.exe
3652	xErklqt.exe
4516	yRyvYsn.exe
3168	KapZeCB.exe
2360	jdiPjpQ.exe
4996	eiveSPj.exe
1912	eAbFmmt.exe
4428	kvkmWqt.exe
2920	dafazmq.exe
508	SXWTRVs.exe
1032	WKFGKrI.exe
812	KxZgClW.exe
2060	pMYVcoo.exe
3740	letHUls.exe
1272	jyRpGzK.exe
4760	yGubBtE.exe
3388	DCKkMXl.exe
4040	gSgJdzq.exe
4084	aujfkuY.exe
2140	MJpQpjT.exe
1848	AEdksFL.exe
2964	OhLMzQV.exe
1060	ncMfRUJ.exe
3648	LhAVJhB.exe
1464	MyocrvM.exe
5096	CtQJuVt.exe
3008	tprNUCb.exe
2256	RvNLGce.exe
680	wrmrSni.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4820-0-0x00007FF7C9B90000-0x00007FF7C9F82000-memory.dmp	upx
behavioral2/files/0x0008000000023474-5.dat	upx
behavioral2/files/0x0007000000023476-7.dat	upx
behavioral2/files/0x0007000000023477-21.dat	upx
behavioral2/files/0x0007000000023479-35.dat	upx
behavioral2/files/0x000700000002347c-46.dat	upx
behavioral2/files/0x000700000002347a-50.dat	upx
behavioral2/files/0x000700000002347d-69.dat	upx
behavioral2/memory/2764-76-0x00007FF6122E0000-0x00007FF6126D2000-memory.dmp	upx
behavioral2/files/0x000700000002347f-81.dat	upx
behavioral2/memory/1996-86-0x00007FF650010000-0x00007FF650402000-memory.dmp	upx
behavioral2/memory/920-87-0x00007FF757A90000-0x00007FF757E82000-memory.dmp	upx
behavioral2/memory/1596-85-0x00007FF64B7A0000-0x00007FF64BB92000-memory.dmp	upx
behavioral2/files/0x0007000000023480-83.dat	upx
behavioral2/memory/4800-80-0x00007FF70D160000-0x00007FF70D552000-memory.dmp	upx
behavioral2/memory/1752-79-0x00007FF69CCC0000-0x00007FF69D0B2000-memory.dmp	upx
behavioral2/memory/4964-72-0x00007FF7E3E90000-0x00007FF7E4282000-memory.dmp	upx
behavioral2/memory/5012-66-0x00007FF7FD6D0000-0x00007FF7FDAC2000-memory.dmp	upx
behavioral2/memory/1640-51-0x00007FF7F3450000-0x00007FF7F3842000-memory.dmp	upx
behavioral2/memory/4080-47-0x00007FF649D40000-0x00007FF64A132000-memory.dmp	upx
behavioral2/files/0x000700000002347b-44.dat	upx
behavioral2/files/0x0007000000023478-31.dat	upx
behavioral2/memory/2828-13-0x00007FF6F72C0000-0x00007FF6F76B2000-memory.dmp	upx
behavioral2/memory/2832-10-0x00007FF690490000-0x00007FF690882000-memory.dmp	upx
behavioral2/files/0x0007000000023475-9.dat	upx
behavioral2/files/0x0007000000023481-99.dat	upx
behavioral2/files/0x000a00000002346e-98.dat	upx
behavioral2/files/0x000800000002347e-92.dat	upx
behavioral2/memory/624-103-0x00007FF7A6870000-0x00007FF7A6C62000-memory.dmp	upx
behavioral2/files/0x0007000000023483-114.dat	upx
behavioral2/files/0x0007000000023484-128.dat	upx
behavioral2/files/0x0007000000023488-139.dat	upx
behavioral2/files/0x0007000000023489-145.dat	upx
behavioral2/files/0x000700000002348a-153.dat	upx
behavioral2/memory/924-164-0x00007FF689070000-0x00007FF689462000-memory.dmp	upx
behavioral2/files/0x000700000002348b-165.dat	upx
behavioral2/memory/4364-161-0x00007FF7F0810000-0x00007FF7F0C02000-memory.dmp	upx
behavioral2/files/0x000700000002348f-177.dat	upx
behavioral2/files/0x0007000000023491-192.dat	upx
behavioral2/files/0x0007000000023494-202.dat	upx
behavioral2/files/0x0007000000023492-200.dat	upx
behavioral2/files/0x0007000000023493-197.dat	upx
behavioral2/files/0x0007000000023490-188.dat	upx
behavioral2/files/0x000700000002348e-178.dat	upx
behavioral2/files/0x000700000002348c-172.dat	upx
behavioral2/memory/4452-157-0x00007FF71FB50000-0x00007FF71FF42000-memory.dmp	upx
behavioral2/memory/628-156-0x00007FF6B6660000-0x00007FF6B6A52000-memory.dmp	upx
behavioral2/memory/1892-152-0x00007FF6B6D40000-0x00007FF6B7132000-memory.dmp	upx
behavioral2/files/0x0007000000023486-148.dat	upx
behavioral2/memory/3020-144-0x00007FF61D8C0000-0x00007FF61DCB2000-memory.dmp	upx
behavioral2/files/0x0007000000023487-142.dat	upx
behavioral2/memory/2972-137-0x00007FF773AD0000-0x00007FF773EC2000-memory.dmp	upx
behavioral2/files/0x0007000000023485-134.dat	upx
behavioral2/memory/2432-129-0x00007FF65B080000-0x00007FF65B472000-memory.dmp	upx
behavioral2/memory/3636-125-0x00007FF6A8AE0000-0x00007FF6A8ED2000-memory.dmp	upx
behavioral2/memory/1176-115-0x00007FF610450000-0x00007FF610842000-memory.dmp	upx
behavioral2/files/0x0007000000023482-109.dat	upx
behavioral2/memory/2364-100-0x00007FF6E35F0000-0x00007FF6E39E2000-memory.dmp	upx
behavioral2/memory/4820-1433-0x00007FF7C9B90000-0x00007FF7C9F82000-memory.dmp	upx
behavioral2/memory/2832-1444-0x00007FF690490000-0x00007FF690882000-memory.dmp	upx
behavioral2/memory/1752-2568-0x00007FF69CCC0000-0x00007FF69D0B2000-memory.dmp	upx
behavioral2/memory/2364-2720-0x00007FF6E35F0000-0x00007FF6E39E2000-memory.dmp	upx
behavioral2/memory/2972-3359-0x00007FF773AD0000-0x00007FF773EC2000-memory.dmp	upx
behavioral2/memory/3020-3362-0x00007FF61D8C0000-0x00007FF61DCB2000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
9	raw.githubusercontent.com
10	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\gyedFWy.exe	bbfe97d84a7f3c4942fecaf078d4da40_NeikiAnalytics.exe
File created	C:\Windows\System\ZXBAHri.exe	bbfe97d84a7f3c4942fecaf078d4da40_NeikiAnalytics.exe
File created	C:\Windows\System\GoMTvjE.exe	bbfe97d84a7f3c4942fecaf078d4da40_NeikiAnalytics.exe
File created	C:\Windows\System\kPFSMhG.exe	bbfe97d84a7f3c4942fecaf078d4da40_NeikiAnalytics.exe
File created	C:\Windows\System\suZudIG.exe	bbfe97d84a7f3c4942fecaf078d4da40_NeikiAnalytics.exe
File created	C:\Windows\System\EJCvcCO.exe	bbfe97d84a7f3c4942fecaf078d4da40_NeikiAnalytics.exe
File created	C:\Windows\System\IggwARO.exe	bbfe97d84a7f3c4942fecaf078d4da40_NeikiAnalytics.exe
File created	C:\Windows\System\FqUPZRG.exe	bbfe97d84a7f3c4942fecaf078d4da40_NeikiAnalytics.exe
File created	C:\Windows\System\wzEAqpf.exe	bbfe97d84a7f3c4942fecaf078d4da40_NeikiAnalytics.exe
File created	C:\Windows\System\AAziptX.exe	bbfe97d84a7f3c4942fecaf078d4da40_NeikiAnalytics.exe
File created	C:\Windows\System\DZGXkBd.exe	bbfe97d84a7f3c4942fecaf078d4da40_NeikiAnalytics.exe
File created	C:\Windows\System\UMxgEOb.exe	bbfe97d84a7f3c4942fecaf078d4da40_NeikiAnalytics.exe
File created	C:\Windows\System\AUcfYGl.exe	bbfe97d84a7f3c4942fecaf078d4da40_NeikiAnalytics.exe
File created	C:\Windows\System\zTCMLvP.exe	bbfe97d84a7f3c4942fecaf078d4da40_NeikiAnalytics.exe
File created	C:\Windows\System\yWLuYpf.exe	bbfe97d84a7f3c4942fecaf078d4da40_NeikiAnalytics.exe
File created	C:\Windows\System\rjhCaTq.exe	bbfe97d84a7f3c4942fecaf078d4da40_NeikiAnalytics.exe
File created	C:\Windows\System\jbwRTpk.exe	bbfe97d84a7f3c4942fecaf078d4da40_NeikiAnalytics.exe
File created	C:\Windows\System\QAjRSGA.exe	bbfe97d84a7f3c4942fecaf078d4da40_NeikiAnalytics.exe
File created	C:\Windows\System\nFwvExr.exe	bbfe97d84a7f3c4942fecaf078d4da40_NeikiAnalytics.exe
File created	C:\Windows\System\BQBbrgt.exe	bbfe97d84a7f3c4942fecaf078d4da40_NeikiAnalytics.exe
File created	C:\Windows\System\HvwYqdA.exe	bbfe97d84a7f3c4942fecaf078d4da40_NeikiAnalytics.exe
File created	C:\Windows\System\ERPyzFJ.exe	bbfe97d84a7f3c4942fecaf078d4da40_NeikiAnalytics.exe
File created	C:\Windows\System\AkvXauv.exe	bbfe97d84a7f3c4942fecaf078d4da40_NeikiAnalytics.exe
File created	C:\Windows\System\XrHdtIV.exe	bbfe97d84a7f3c4942fecaf078d4da40_NeikiAnalytics.exe
File created	C:\Windows\System\ulcMKdF.exe	bbfe97d84a7f3c4942fecaf078d4da40_NeikiAnalytics.exe
File created	C:\Windows\System\aDswmIc.exe	bbfe97d84a7f3c4942fecaf078d4da40_NeikiAnalytics.exe
File created	C:\Windows\System\oPTvxHS.exe	bbfe97d84a7f3c4942fecaf078d4da40_NeikiAnalytics.exe
File created	C:\Windows\System\MxiAFzE.exe	bbfe97d84a7f3c4942fecaf078d4da40_NeikiAnalytics.exe
File created	C:\Windows\System\zcXqbHe.exe	bbfe97d84a7f3c4942fecaf078d4da40_NeikiAnalytics.exe
File created	C:\Windows\System\Jvzdraa.exe	bbfe97d84a7f3c4942fecaf078d4da40_NeikiAnalytics.exe
File created	C:\Windows\System\kCuOySk.exe	bbfe97d84a7f3c4942fecaf078d4da40_NeikiAnalytics.exe
File created	C:\Windows\System\hLPQqVj.exe	bbfe97d84a7f3c4942fecaf078d4da40_NeikiAnalytics.exe
File created	C:\Windows\System\tgRHcgN.exe	bbfe97d84a7f3c4942fecaf078d4da40_NeikiAnalytics.exe
File created	C:\Windows\System\RvFIiGX.exe	bbfe97d84a7f3c4942fecaf078d4da40_NeikiAnalytics.exe
File created	C:\Windows\System\AikfoBz.exe	bbfe97d84a7f3c4942fecaf078d4da40_NeikiAnalytics.exe
File created	C:\Windows\System\rUDXflr.exe	bbfe97d84a7f3c4942fecaf078d4da40_NeikiAnalytics.exe
File created	C:\Windows\System\LkZPxez.exe	bbfe97d84a7f3c4942fecaf078d4da40_NeikiAnalytics.exe
File created	C:\Windows\System\wulXPvv.exe	bbfe97d84a7f3c4942fecaf078d4da40_NeikiAnalytics.exe
File created	C:\Windows\System\pCkFdaP.exe	bbfe97d84a7f3c4942fecaf078d4da40_NeikiAnalytics.exe
File created	C:\Windows\System\eNZYqGu.exe	bbfe97d84a7f3c4942fecaf078d4da40_NeikiAnalytics.exe
File created	C:\Windows\System\wFztvOA.exe	bbfe97d84a7f3c4942fecaf078d4da40_NeikiAnalytics.exe
File created	C:\Windows\System\dTZjIII.exe	bbfe97d84a7f3c4942fecaf078d4da40_NeikiAnalytics.exe
File created	C:\Windows\System\RKySzWm.exe	bbfe97d84a7f3c4942fecaf078d4da40_NeikiAnalytics.exe
File created	C:\Windows\System\LecjjqI.exe	bbfe97d84a7f3c4942fecaf078d4da40_NeikiAnalytics.exe
File created	C:\Windows\System\vNQrxnh.exe	bbfe97d84a7f3c4942fecaf078d4da40_NeikiAnalytics.exe
File created	C:\Windows\System\hnMIcdV.exe	bbfe97d84a7f3c4942fecaf078d4da40_NeikiAnalytics.exe
File created	C:\Windows\System\OuXiUqz.exe	bbfe97d84a7f3c4942fecaf078d4da40_NeikiAnalytics.exe
File created	C:\Windows\System\ItbKzhA.exe	bbfe97d84a7f3c4942fecaf078d4da40_NeikiAnalytics.exe
File created	C:\Windows\System\NOLIoEL.exe	bbfe97d84a7f3c4942fecaf078d4da40_NeikiAnalytics.exe
File created	C:\Windows\System\MnloOmA.exe	bbfe97d84a7f3c4942fecaf078d4da40_NeikiAnalytics.exe
File created	C:\Windows\System\axQMzus.exe	bbfe97d84a7f3c4942fecaf078d4da40_NeikiAnalytics.exe
File created	C:\Windows\System\iGmPeTd.exe	bbfe97d84a7f3c4942fecaf078d4da40_NeikiAnalytics.exe
File created	C:\Windows\System\eGKKmuB.exe	bbfe97d84a7f3c4942fecaf078d4da40_NeikiAnalytics.exe
File created	C:\Windows\System\dqSTdfV.exe	bbfe97d84a7f3c4942fecaf078d4da40_NeikiAnalytics.exe
File created	C:\Windows\System\wEluDqh.exe	bbfe97d84a7f3c4942fecaf078d4da40_NeikiAnalytics.exe
File created	C:\Windows\System\QxXumcJ.exe	bbfe97d84a7f3c4942fecaf078d4da40_NeikiAnalytics.exe
File created	C:\Windows\System\yGfARrx.exe	bbfe97d84a7f3c4942fecaf078d4da40_NeikiAnalytics.exe
File created	C:\Windows\System\vjpCZVQ.exe	bbfe97d84a7f3c4942fecaf078d4da40_NeikiAnalytics.exe
File created	C:\Windows\System\ohhejXS.exe	bbfe97d84a7f3c4942fecaf078d4da40_NeikiAnalytics.exe
File created	C:\Windows\System\xnbFSAH.exe	bbfe97d84a7f3c4942fecaf078d4da40_NeikiAnalytics.exe
File created	C:\Windows\System\zYpnDFB.exe	bbfe97d84a7f3c4942fecaf078d4da40_NeikiAnalytics.exe
File created	C:\Windows\System\QMFuiAR.exe	bbfe97d84a7f3c4942fecaf078d4da40_NeikiAnalytics.exe
File created	C:\Windows\System\cABzfEt.exe	bbfe97d84a7f3c4942fecaf078d4da40_NeikiAnalytics.exe
File created	C:\Windows\System\IzOHtKS.exe	bbfe97d84a7f3c4942fecaf078d4da40_NeikiAnalytics.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1900	powershell.exe
1900	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1900	powershell.exe
Token: SeLockMemoryPrivilege	4820	bbfe97d84a7f3c4942fecaf078d4da40_NeikiAnalytics.exe
Token: SeLockMemoryPrivilege	4820	bbfe97d84a7f3c4942fecaf078d4da40_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4820 wrote to memory of 1900	4820	bbfe97d84a7f3c4942fecaf078d4da40_NeikiAnalytics.exe	84
PID 4820 wrote to memory of 1900	4820	bbfe97d84a7f3c4942fecaf078d4da40_NeikiAnalytics.exe	84
PID 4820 wrote to memory of 2832	4820	bbfe97d84a7f3c4942fecaf078d4da40_NeikiAnalytics.exe	85
PID 4820 wrote to memory of 2832	4820	bbfe97d84a7f3c4942fecaf078d4da40_NeikiAnalytics.exe	85
PID 4820 wrote to memory of 2828	4820	bbfe97d84a7f3c4942fecaf078d4da40_NeikiAnalytics.exe	86
PID 4820 wrote to memory of 2828	4820	bbfe97d84a7f3c4942fecaf078d4da40_NeikiAnalytics.exe	86
PID 4820 wrote to memory of 4080	4820	bbfe97d84a7f3c4942fecaf078d4da40_NeikiAnalytics.exe	87
PID 4820 wrote to memory of 4080	4820	bbfe97d84a7f3c4942fecaf078d4da40_NeikiAnalytics.exe	87
PID 4820 wrote to memory of 4800	4820	bbfe97d84a7f3c4942fecaf078d4da40_NeikiAnalytics.exe	88
PID 4820 wrote to memory of 4800	4820	bbfe97d84a7f3c4942fecaf078d4da40_NeikiAnalytics.exe	88
PID 4820 wrote to memory of 1640	4820	bbfe97d84a7f3c4942fecaf078d4da40_NeikiAnalytics.exe	89
PID 4820 wrote to memory of 1640	4820	bbfe97d84a7f3c4942fecaf078d4da40_NeikiAnalytics.exe	89
PID 4820 wrote to memory of 5012	4820	bbfe97d84a7f3c4942fecaf078d4da40_NeikiAnalytics.exe	90
PID 4820 wrote to memory of 5012	4820	bbfe97d84a7f3c4942fecaf078d4da40_NeikiAnalytics.exe	90
PID 4820 wrote to memory of 4964	4820	bbfe97d84a7f3c4942fecaf078d4da40_NeikiAnalytics.exe	91
PID 4820 wrote to memory of 4964	4820	bbfe97d84a7f3c4942fecaf078d4da40_NeikiAnalytics.exe	91
PID 4820 wrote to memory of 1596	4820	bbfe97d84a7f3c4942fecaf078d4da40_NeikiAnalytics.exe	92
PID 4820 wrote to memory of 1596	4820	bbfe97d84a7f3c4942fecaf078d4da40_NeikiAnalytics.exe	92
PID 4820 wrote to memory of 2764	4820	bbfe97d84a7f3c4942fecaf078d4da40_NeikiAnalytics.exe	93
PID 4820 wrote to memory of 2764	4820	bbfe97d84a7f3c4942fecaf078d4da40_NeikiAnalytics.exe	93
PID 4820 wrote to memory of 1996	4820	bbfe97d84a7f3c4942fecaf078d4da40_NeikiAnalytics.exe	94
PID 4820 wrote to memory of 1996	4820	bbfe97d84a7f3c4942fecaf078d4da40_NeikiAnalytics.exe	94
PID 4820 wrote to memory of 1752	4820	bbfe97d84a7f3c4942fecaf078d4da40_NeikiAnalytics.exe	95
PID 4820 wrote to memory of 1752	4820	bbfe97d84a7f3c4942fecaf078d4da40_NeikiAnalytics.exe	95
PID 4820 wrote to memory of 920	4820	bbfe97d84a7f3c4942fecaf078d4da40_NeikiAnalytics.exe	96
PID 4820 wrote to memory of 920	4820	bbfe97d84a7f3c4942fecaf078d4da40_NeikiAnalytics.exe	96
PID 4820 wrote to memory of 2364	4820	bbfe97d84a7f3c4942fecaf078d4da40_NeikiAnalytics.exe	97
PID 4820 wrote to memory of 2364	4820	bbfe97d84a7f3c4942fecaf078d4da40_NeikiAnalytics.exe	97
PID 4820 wrote to memory of 1176	4820	bbfe97d84a7f3c4942fecaf078d4da40_NeikiAnalytics.exe	98
PID 4820 wrote to memory of 1176	4820	bbfe97d84a7f3c4942fecaf078d4da40_NeikiAnalytics.exe	98
PID 4820 wrote to memory of 624	4820	bbfe97d84a7f3c4942fecaf078d4da40_NeikiAnalytics.exe	99
PID 4820 wrote to memory of 624	4820	bbfe97d84a7f3c4942fecaf078d4da40_NeikiAnalytics.exe	99
PID 4820 wrote to memory of 2432	4820	bbfe97d84a7f3c4942fecaf078d4da40_NeikiAnalytics.exe	100
PID 4820 wrote to memory of 2432	4820	bbfe97d84a7f3c4942fecaf078d4da40_NeikiAnalytics.exe	100
PID 4820 wrote to memory of 3636	4820	bbfe97d84a7f3c4942fecaf078d4da40_NeikiAnalytics.exe	101
PID 4820 wrote to memory of 3636	4820	bbfe97d84a7f3c4942fecaf078d4da40_NeikiAnalytics.exe	101
PID 4820 wrote to memory of 628	4820	bbfe97d84a7f3c4942fecaf078d4da40_NeikiAnalytics.exe	102
PID 4820 wrote to memory of 628	4820	bbfe97d84a7f3c4942fecaf078d4da40_NeikiAnalytics.exe	102
PID 4820 wrote to memory of 2972	4820	bbfe97d84a7f3c4942fecaf078d4da40_NeikiAnalytics.exe	103
PID 4820 wrote to memory of 2972	4820	bbfe97d84a7f3c4942fecaf078d4da40_NeikiAnalytics.exe	103
PID 4820 wrote to memory of 3020	4820	bbfe97d84a7f3c4942fecaf078d4da40_NeikiAnalytics.exe	104
PID 4820 wrote to memory of 3020	4820	bbfe97d84a7f3c4942fecaf078d4da40_NeikiAnalytics.exe	104
PID 4820 wrote to memory of 4452	4820	bbfe97d84a7f3c4942fecaf078d4da40_NeikiAnalytics.exe	105
PID 4820 wrote to memory of 4452	4820	bbfe97d84a7f3c4942fecaf078d4da40_NeikiAnalytics.exe	105
PID 4820 wrote to memory of 1892	4820	bbfe97d84a7f3c4942fecaf078d4da40_NeikiAnalytics.exe	106
PID 4820 wrote to memory of 1892	4820	bbfe97d84a7f3c4942fecaf078d4da40_NeikiAnalytics.exe	106
PID 4820 wrote to memory of 4364	4820	bbfe97d84a7f3c4942fecaf078d4da40_NeikiAnalytics.exe	107
PID 4820 wrote to memory of 4364	4820	bbfe97d84a7f3c4942fecaf078d4da40_NeikiAnalytics.exe	107
PID 4820 wrote to memory of 924	4820	bbfe97d84a7f3c4942fecaf078d4da40_NeikiAnalytics.exe	108
PID 4820 wrote to memory of 924	4820	bbfe97d84a7f3c4942fecaf078d4da40_NeikiAnalytics.exe	108
PID 4820 wrote to memory of 4044	4820	bbfe97d84a7f3c4942fecaf078d4da40_NeikiAnalytics.exe	110
PID 4820 wrote to memory of 4044	4820	bbfe97d84a7f3c4942fecaf078d4da40_NeikiAnalytics.exe	110
PID 4820 wrote to memory of 4228	4820	bbfe97d84a7f3c4942fecaf078d4da40_NeikiAnalytics.exe	111
PID 4820 wrote to memory of 4228	4820	bbfe97d84a7f3c4942fecaf078d4da40_NeikiAnalytics.exe	111
PID 4820 wrote to memory of 1468	4820	bbfe97d84a7f3c4942fecaf078d4da40_NeikiAnalytics.exe	113
PID 4820 wrote to memory of 1468	4820	bbfe97d84a7f3c4942fecaf078d4da40_NeikiAnalytics.exe	113
PID 4820 wrote to memory of 1036	4820	bbfe97d84a7f3c4942fecaf078d4da40_NeikiAnalytics.exe	114
PID 4820 wrote to memory of 1036	4820	bbfe97d84a7f3c4942fecaf078d4da40_NeikiAnalytics.exe	114
PID 4820 wrote to memory of 1584	4820	bbfe97d84a7f3c4942fecaf078d4da40_NeikiAnalytics.exe	115
PID 4820 wrote to memory of 1584	4820	bbfe97d84a7f3c4942fecaf078d4da40_NeikiAnalytics.exe	115
PID 4820 wrote to memory of 3032	4820	bbfe97d84a7f3c4942fecaf078d4da40_NeikiAnalytics.exe	116
PID 4820 wrote to memory of 3032	4820	bbfe97d84a7f3c4942fecaf078d4da40_NeikiAnalytics.exe	116
PID 4820 wrote to memory of 1508	4820	bbfe97d84a7f3c4942fecaf078d4da40_NeikiAnalytics.exe	117
PID 4820 wrote to memory of 1508	4820	bbfe97d84a7f3c4942fecaf078d4da40_NeikiAnalytics.exe	117

C:\Users\Admin\AppData\Local\Temp\bbfe97d84a7f3c4942fecaf078d4da40_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\bbfe97d84a7f3c4942fecaf078d4da40_NeikiAnalytics.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4820
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1900
- C:\Windows\System\EGbzEiR.exe
  C:\Windows\System\EGbzEiR.exe
  2⤵
  - Executes dropped EXE
  PID:2832
- C:\Windows\System\PbLLjYN.exe
  C:\Windows\System\PbLLjYN.exe
  2⤵
  - Executes dropped EXE
  PID:2828
- C:\Windows\System\jjhFLlT.exe
  C:\Windows\System\jjhFLlT.exe
  2⤵
  - Executes dropped EXE
  PID:4080
- C:\Windows\System\FXbPOoh.exe
  C:\Windows\System\FXbPOoh.exe
  2⤵
  - Executes dropped EXE
  PID:4800
- C:\Windows\System\teKZoKF.exe
  C:\Windows\System\teKZoKF.exe
  2⤵
  - Executes dropped EXE
  PID:1640
- C:\Windows\System\itbJimu.exe
  C:\Windows\System\itbJimu.exe
  2⤵
  - Executes dropped EXE
  PID:5012
- C:\Windows\System\MHAhaxp.exe
  C:\Windows\System\MHAhaxp.exe
  2⤵
  - Executes dropped EXE
  PID:4964
- C:\Windows\System\unRwqLW.exe
  C:\Windows\System\unRwqLW.exe
  2⤵
  - Executes dropped EXE
  PID:1596
- C:\Windows\System\nMUzLjx.exe
  C:\Windows\System\nMUzLjx.exe
  2⤵
  - Executes dropped EXE
  PID:2764
- C:\Windows\System\VyVocBQ.exe
  C:\Windows\System\VyVocBQ.exe
  2⤵
  - Executes dropped EXE
  PID:1996
- C:\Windows\System\CRxuvFY.exe
  C:\Windows\System\CRxuvFY.exe
  2⤵
  - Executes dropped EXE
  PID:1752
- C:\Windows\System\jnIZTvW.exe
  C:\Windows\System\jnIZTvW.exe
  2⤵
  - Executes dropped EXE
  PID:920
- C:\Windows\System\kXxjRGH.exe
  C:\Windows\System\kXxjRGH.exe
  2⤵
  - Executes dropped EXE
  PID:2364
- C:\Windows\System\RfhxdfU.exe
  C:\Windows\System\RfhxdfU.exe
  2⤵
  - Executes dropped EXE
  PID:1176
- C:\Windows\System\oyxkshB.exe
  C:\Windows\System\oyxkshB.exe
  2⤵
  - Executes dropped EXE
  PID:624
- C:\Windows\System\GDwEWjT.exe
  C:\Windows\System\GDwEWjT.exe
  2⤵
  - Executes dropped EXE
  PID:2432
- C:\Windows\System\Hrydups.exe
  C:\Windows\System\Hrydups.exe
  2⤵
  - Executes dropped EXE
  PID:3636
- C:\Windows\System\VdxRElW.exe
  C:\Windows\System\VdxRElW.exe
  2⤵
  - Executes dropped EXE
  PID:628
- C:\Windows\System\huOcCUr.exe
  C:\Windows\System\huOcCUr.exe
  2⤵
  - Executes dropped EXE
  PID:2972
- C:\Windows\System\aoVrntV.exe
  C:\Windows\System\aoVrntV.exe
  2⤵
  - Executes dropped EXE
  PID:3020
- C:\Windows\System\SzfJNIY.exe
  C:\Windows\System\SzfJNIY.exe
  2⤵
  - Executes dropped EXE
  PID:4452
- C:\Windows\System\RkHAeQR.exe
  C:\Windows\System\RkHAeQR.exe
  2⤵
  - Executes dropped EXE
  PID:1892
- C:\Windows\System\wRvdpIm.exe
  C:\Windows\System\wRvdpIm.exe
  2⤵
  - Executes dropped EXE
  PID:4364
- C:\Windows\System\bfCQAlP.exe
  C:\Windows\System\bfCQAlP.exe
  2⤵
  - Executes dropped EXE
  PID:924
- C:\Windows\System\TZtoKUH.exe
  C:\Windows\System\TZtoKUH.exe
  2⤵
  - Executes dropped EXE
  PID:4044
- C:\Windows\System\rjxddpq.exe
  C:\Windows\System\rjxddpq.exe
  2⤵
  - Executes dropped EXE
  PID:4228
- C:\Windows\System\nUgpgBr.exe
  C:\Windows\System\nUgpgBr.exe
  2⤵
  - Executes dropped EXE
  PID:1468
- C:\Windows\System\qaqznUc.exe
  C:\Windows\System\qaqznUc.exe
  2⤵
  - Executes dropped EXE
  PID:1036
- C:\Windows\System\IhZpuQK.exe
  C:\Windows\System\IhZpuQK.exe
  2⤵
  - Executes dropped EXE
  PID:1584
- C:\Windows\System\zfXtzVt.exe
  C:\Windows\System\zfXtzVt.exe
  2⤵
  - Executes dropped EXE
  PID:3032
- C:\Windows\System\OqeLoFY.exe
  C:\Windows\System\OqeLoFY.exe
  2⤵
  - Executes dropped EXE
  PID:1508
- C:\Windows\System\qaMAMiO.exe
  C:\Windows\System\qaMAMiO.exe
  2⤵
  - Executes dropped EXE
  PID:4548
- C:\Windows\System\xDSNKGj.exe
  C:\Windows\System\xDSNKGj.exe
  2⤵
  - Executes dropped EXE
  PID:4412
- C:\Windows\System\MRKOdca.exe
  C:\Windows\System\MRKOdca.exe
  2⤵
  - Executes dropped EXE
  PID:4500
- C:\Windows\System\LKvcdjA.exe
  C:\Windows\System\LKvcdjA.exe
  2⤵
  - Executes dropped EXE
  PID:4324
- C:\Windows\System\QWHnGRk.exe
  C:\Windows\System\QWHnGRk.exe
  2⤵
  - Executes dropped EXE
  PID:632
- C:\Windows\System\xErklqt.exe
  C:\Windows\System\xErklqt.exe
  2⤵
  - Executes dropped EXE
  PID:3652
- C:\Windows\System\yRyvYsn.exe
  C:\Windows\System\yRyvYsn.exe
  2⤵
  - Executes dropped EXE
  PID:4516
- C:\Windows\System\KapZeCB.exe
  C:\Windows\System\KapZeCB.exe
  2⤵
  - Executes dropped EXE
  PID:3168
- C:\Windows\System\jdiPjpQ.exe
  C:\Windows\System\jdiPjpQ.exe
  2⤵
  - Executes dropped EXE
  PID:2360
- C:\Windows\System\eiveSPj.exe
  C:\Windows\System\eiveSPj.exe
  2⤵
  - Executes dropped EXE
  PID:4996
- C:\Windows\System\eAbFmmt.exe
  C:\Windows\System\eAbFmmt.exe
  2⤵
  - Executes dropped EXE
  PID:1912
- C:\Windows\System\kvkmWqt.exe
  C:\Windows\System\kvkmWqt.exe
  2⤵
  - Executes dropped EXE
  PID:4428
- C:\Windows\System\dafazmq.exe
  C:\Windows\System\dafazmq.exe
  2⤵
  - Executes dropped EXE
  PID:2920
- C:\Windows\System\SXWTRVs.exe
  C:\Windows\System\SXWTRVs.exe
  2⤵
  - Executes dropped EXE
  PID:508
- C:\Windows\System\WKFGKrI.exe
  C:\Windows\System\WKFGKrI.exe
  2⤵
  - Executes dropped EXE
  PID:1032
- C:\Windows\System\KxZgClW.exe
  C:\Windows\System\KxZgClW.exe
  2⤵
  - Executes dropped EXE
  PID:812
- C:\Windows\System\pMYVcoo.exe
  C:\Windows\System\pMYVcoo.exe
  2⤵
  - Executes dropped EXE
  PID:2060
- C:\Windows\System\letHUls.exe
  C:\Windows\System\letHUls.exe
  2⤵
  - Executes dropped EXE
  PID:3740
- C:\Windows\System\jyRpGzK.exe
  C:\Windows\System\jyRpGzK.exe
  2⤵
  - Executes dropped EXE
  PID:1272
- C:\Windows\System\yGubBtE.exe
  C:\Windows\System\yGubBtE.exe
  2⤵
  - Executes dropped EXE
  PID:4760
- C:\Windows\System\DCKkMXl.exe
  C:\Windows\System\DCKkMXl.exe
  2⤵
  - Executes dropped EXE
  PID:3388
- C:\Windows\System\gSgJdzq.exe
  C:\Windows\System\gSgJdzq.exe
  2⤵
  - Executes dropped EXE
  PID:4040
- C:\Windows\System\aujfkuY.exe
  C:\Windows\System\aujfkuY.exe
  2⤵
  - Executes dropped EXE
  PID:4084
- C:\Windows\System\MJpQpjT.exe
  C:\Windows\System\MJpQpjT.exe
  2⤵
  - Executes dropped EXE
  PID:2140
- C:\Windows\System\AEdksFL.exe
  C:\Windows\System\AEdksFL.exe
  2⤵
  - Executes dropped EXE
  PID:1848
- C:\Windows\System\OhLMzQV.exe
  C:\Windows\System\OhLMzQV.exe
  2⤵
  - Executes dropped EXE
  PID:2964
- C:\Windows\System\ncMfRUJ.exe
  C:\Windows\System\ncMfRUJ.exe
  2⤵
  - Executes dropped EXE
  PID:1060
- C:\Windows\System\LhAVJhB.exe
  C:\Windows\System\LhAVJhB.exe
  2⤵
  - Executes dropped EXE
  PID:3648
- C:\Windows\System\MyocrvM.exe
  C:\Windows\System\MyocrvM.exe
  2⤵
  - Executes dropped EXE
  PID:1464
- C:\Windows\System\CtQJuVt.exe
  C:\Windows\System\CtQJuVt.exe
  2⤵
  - Executes dropped EXE
  PID:5096
- C:\Windows\System\tprNUCb.exe
  C:\Windows\System\tprNUCb.exe
  2⤵
  - Executes dropped EXE
  PID:3008
- C:\Windows\System\RvNLGce.exe
  C:\Windows\System\RvNLGce.exe
  2⤵
  - Executes dropped EXE
  PID:2256
- C:\Windows\System\wrmrSni.exe
  C:\Windows\System\wrmrSni.exe
  2⤵
  - Executes dropped EXE
  PID:680
- C:\Windows\System\IMZnubl.exe
  C:\Windows\System\IMZnubl.exe
  2⤵
  PID:4488
- C:\Windows\System\HDZXPUR.exe
  C:\Windows\System\HDZXPUR.exe
  2⤵
  PID:1700
- C:\Windows\System\FCcwraY.exe
  C:\Windows\System\FCcwraY.exe
  2⤵
  PID:2756
- C:\Windows\System\ytXUjap.exe
  C:\Windows\System\ytXUjap.exe
  2⤵
  PID:4580
- C:\Windows\System\ABKWhdx.exe
  C:\Windows\System\ABKWhdx.exe
  2⤵
  PID:3604
- C:\Windows\System\YVzvHOd.exe
  C:\Windows\System\YVzvHOd.exe
  2⤵
  PID:2252
- C:\Windows\System\KtdGuzf.exe
  C:\Windows\System\KtdGuzf.exe
  2⤵
  PID:412
- C:\Windows\System\LwsKeRF.exe
  C:\Windows\System\LwsKeRF.exe
  2⤵
  PID:3468
- C:\Windows\System\cBwLyAJ.exe
  C:\Windows\System\cBwLyAJ.exe
  2⤵
  PID:5124
- C:\Windows\System\mTKFxYK.exe
  C:\Windows\System\mTKFxYK.exe
  2⤵
  PID:5148
- C:\Windows\System\lUrHvjS.exe
  C:\Windows\System\lUrHvjS.exe
  2⤵
  PID:5180
- C:\Windows\System\pimHsUV.exe
  C:\Windows\System\pimHsUV.exe
  2⤵
  PID:5208
- C:\Windows\System\CLMMYlz.exe
  C:\Windows\System\CLMMYlz.exe
  2⤵
  PID:5236
- C:\Windows\System\jhnOlwZ.exe
  C:\Windows\System\jhnOlwZ.exe
  2⤵
  PID:5264
- C:\Windows\System\BScUzPN.exe
  C:\Windows\System\BScUzPN.exe
  2⤵
  PID:5292
- C:\Windows\System\KRFdrzZ.exe
  C:\Windows\System\KRFdrzZ.exe
  2⤵
  PID:5320
- C:\Windows\System\LeGEqOB.exe
  C:\Windows\System\LeGEqOB.exe
  2⤵
  PID:5348
- C:\Windows\System\ENXQCra.exe
  C:\Windows\System\ENXQCra.exe
  2⤵
  PID:5372
- C:\Windows\System\nsjvCol.exe
  C:\Windows\System\nsjvCol.exe
  2⤵
  PID:5408
- C:\Windows\System\FyqoVvP.exe
  C:\Windows\System\FyqoVvP.exe
  2⤵
  PID:5436
- C:\Windows\System\SyvUSce.exe
  C:\Windows\System\SyvUSce.exe
  2⤵
  PID:5464
- C:\Windows\System\bBVIZpo.exe
  C:\Windows\System\bBVIZpo.exe
  2⤵
  PID:5488
- C:\Windows\System\ndQOMwx.exe
  C:\Windows\System\ndQOMwx.exe
  2⤵
  PID:5516
- C:\Windows\System\CdDhUot.exe
  C:\Windows\System\CdDhUot.exe
  2⤵
  PID:5544
- C:\Windows\System\aEgnkMB.exe
  C:\Windows\System\aEgnkMB.exe
  2⤵
  PID:5572
- C:\Windows\System\MJMZkbB.exe
  C:\Windows\System\MJMZkbB.exe
  2⤵
  PID:5600
- C:\Windows\System\RkYoeWd.exe
  C:\Windows\System\RkYoeWd.exe
  2⤵
  PID:5628
- C:\Windows\System\hHzMEjB.exe
  C:\Windows\System\hHzMEjB.exe
  2⤵
  PID:5656
- C:\Windows\System\kvoJrpJ.exe
  C:\Windows\System\kvoJrpJ.exe
  2⤵
  PID:5684
- C:\Windows\System\WbLxCTg.exe
  C:\Windows\System\WbLxCTg.exe
  2⤵
  PID:5712
- C:\Windows\System\bOmMdEQ.exe
  C:\Windows\System\bOmMdEQ.exe
  2⤵
  PID:5740
- C:\Windows\System\vYRTunC.exe
  C:\Windows\System\vYRTunC.exe
  2⤵
  PID:5768
- C:\Windows\System\aQCjjve.exe
  C:\Windows\System\aQCjjve.exe
  2⤵
  PID:5796
- C:\Windows\System\ckDWNxb.exe
  C:\Windows\System\ckDWNxb.exe
  2⤵
  PID:5820
- C:\Windows\System\IicRNuq.exe
  C:\Windows\System\IicRNuq.exe
  2⤵
  PID:5876
- C:\Windows\System\aAtyhkT.exe
  C:\Windows\System\aAtyhkT.exe
  2⤵
  PID:5904
- C:\Windows\System\QFomAYn.exe
  C:\Windows\System\QFomAYn.exe
  2⤵
  PID:5920
- C:\Windows\System\NgIDDEp.exe
  C:\Windows\System\NgIDDEp.exe
  2⤵
  PID:5948
- C:\Windows\System\nuSXSvw.exe
  C:\Windows\System\nuSXSvw.exe
  2⤵
  PID:5972
- C:\Windows\System\fiBZijX.exe
  C:\Windows\System\fiBZijX.exe
  2⤵
  PID:6000
- C:\Windows\System\zxQSNnk.exe
  C:\Windows\System\zxQSNnk.exe
  2⤵
  PID:6028
- C:\Windows\System\NnurkIJ.exe
  C:\Windows\System\NnurkIJ.exe
  2⤵
  PID:6048
- C:\Windows\System\rfojsIV.exe
  C:\Windows\System\rfojsIV.exe
  2⤵
  PID:6088
- C:\Windows\System\bOesBxn.exe
  C:\Windows\System\bOesBxn.exe
  2⤵
  PID:6120
- C:\Windows\System\Hcofwlo.exe
  C:\Windows\System\Hcofwlo.exe
  2⤵
  PID:6140
- C:\Windows\System\UtvveCb.exe
  C:\Windows\System\UtvveCb.exe
  2⤵
  PID:1448
- C:\Windows\System\JMetDvV.exe
  C:\Windows\System\JMetDvV.exe
  2⤵
  PID:2800
- C:\Windows\System\REnwToc.exe
  C:\Windows\System\REnwToc.exe
  2⤵
  PID:5640
- C:\Windows\System\GAjwnOv.exe
  C:\Windows\System\GAjwnOv.exe
  2⤵
  PID:5672
- C:\Windows\System\InWXbdW.exe
  C:\Windows\System\InWXbdW.exe
  2⤵
  PID:5704
- C:\Windows\System\kdClIzK.exe
  C:\Windows\System\kdClIzK.exe
  2⤵
  PID:5784
- C:\Windows\System\jjUXMRD.exe
  C:\Windows\System\jjUXMRD.exe
  2⤵
  PID:5856
- C:\Windows\System\JXtJnmq.exe
  C:\Windows\System\JXtJnmq.exe
  2⤵
  PID:5988
- C:\Windows\System\hGyVNPq.exe
  C:\Windows\System\hGyVNPq.exe
  2⤵
  PID:4280
- C:\Windows\System\tKyhluY.exe
  C:\Windows\System\tKyhluY.exe
  2⤵
  PID:4672
- C:\Windows\System\WDUUhxB.exe
  C:\Windows\System\WDUUhxB.exe
  2⤵
  PID:6132
- C:\Windows\System\UaCjeGz.exe
  C:\Windows\System\UaCjeGz.exe
  2⤵
  PID:4600
- C:\Windows\System\xpQcFKd.exe
  C:\Windows\System\xpQcFKd.exe
  2⤵
  PID:1916
- C:\Windows\System\CAhywJJ.exe
  C:\Windows\System\CAhywJJ.exe
  2⤵
  PID:5196
- C:\Windows\System\uABhMMD.exe
  C:\Windows\System\uABhMMD.exe
  2⤵
  PID:5228
- C:\Windows\System\VTSUizU.exe
  C:\Windows\System\VTSUizU.exe
  2⤵
  PID:5280
- C:\Windows\System\sGfVgPk.exe
  C:\Windows\System\sGfVgPk.exe
  2⤵
  PID:3224
- C:\Windows\System\kmEuazq.exe
  C:\Windows\System\kmEuazq.exe
  2⤵
  PID:4432
- C:\Windows\System\GgLfBfM.exe
  C:\Windows\System\GgLfBfM.exe
  2⤵
  PID:5456
- C:\Windows\System\rBPUVbX.exe
  C:\Windows\System\rBPUVbX.exe
  2⤵
  PID:5612
- C:\Windows\System\dLkanmG.exe
  C:\Windows\System\dLkanmG.exe
  2⤵
  PID:5696
- C:\Windows\System\BmAoXqJ.exe
  C:\Windows\System\BmAoXqJ.exe
  2⤵
  PID:5760
- C:\Windows\System\CyfZBlo.exe
  C:\Windows\System\CyfZBlo.exe
  2⤵
  PID:5752
- C:\Windows\System\gotJWGu.exe
  C:\Windows\System\gotJWGu.exe
  2⤵
  PID:5996
- C:\Windows\System\Jvyhobl.exe
  C:\Windows\System\Jvyhobl.exe
  2⤵
  PID:6060
- C:\Windows\System\qyjHPCX.exe
  C:\Windows\System\qyjHPCX.exe
  2⤵
  PID:5144
- C:\Windows\System\GmCmhVJ.exe
  C:\Windows\System\GmCmhVJ.exe
  2⤵
  PID:1636
- C:\Windows\System\xFNrTSr.exe
  C:\Windows\System\xFNrTSr.exe
  2⤵
  PID:5336
- C:\Windows\System\JwqnoSU.exe
  C:\Windows\System\JwqnoSU.exe
  2⤵
  PID:5308
- C:\Windows\System\divIrYl.exe
  C:\Windows\System\divIrYl.exe
  2⤵
  PID:4308
- C:\Windows\System\SspJfaP.exe
  C:\Windows\System\SspJfaP.exe
  2⤵
  PID:4056
- C:\Windows\System\BEhMbOH.exe
  C:\Windows\System\BEhMbOH.exe
  2⤵
  PID:3628
- C:\Windows\System\pSQaCBl.exe
  C:\Windows\System\pSQaCBl.exe
  2⤵
  PID:3104
- C:\Windows\System\hwmKnZv.exe
  C:\Windows\System\hwmKnZv.exe
  2⤵
  PID:5136
- C:\Windows\System\XQdhgOT.exe
  C:\Windows\System\XQdhgOT.exe
  2⤵
  PID:5592
- C:\Windows\System\iAmWgIT.exe
  C:\Windows\System\iAmWgIT.exe
  2⤵
  PID:5140
- C:\Windows\System\sGTpWGC.exe
  C:\Windows\System\sGTpWGC.exe
  2⤵
  PID:2516
- C:\Windows\System\bzvjggT.exe
  C:\Windows\System\bzvjggT.exe
  2⤵
  PID:5224
- C:\Windows\System\mZeoPFI.exe
  C:\Windows\System\mZeoPFI.exe
  2⤵
  PID:5960
- C:\Windows\System\rVxceGZ.exe
  C:\Windows\System\rVxceGZ.exe
  2⤵
  PID:6148
- C:\Windows\System\YIfsVXa.exe
  C:\Windows\System\YIfsVXa.exe
  2⤵
  PID:6208
- C:\Windows\System\gshahFj.exe
  C:\Windows\System\gshahFj.exe
  2⤵
  PID:6244
- C:\Windows\System\TohwIKj.exe
  C:\Windows\System\TohwIKj.exe
  2⤵
  PID:6276
- C:\Windows\System\EKEugIo.exe
  C:\Windows\System\EKEugIo.exe
  2⤵
  PID:6292
- C:\Windows\System\KJWLuQv.exe
  C:\Windows\System\KJWLuQv.exe
  2⤵
  PID:6332
- C:\Windows\System\dZWdDhA.exe
  C:\Windows\System\dZWdDhA.exe
  2⤵
  PID:6352
- C:\Windows\System\vehsOTl.exe
  C:\Windows\System\vehsOTl.exe
  2⤵
  PID:6372
- C:\Windows\System\xpCLvwM.exe
  C:\Windows\System\xpCLvwM.exe
  2⤵
  PID:6396
- C:\Windows\System\sZkQLbK.exe
  C:\Windows\System\sZkQLbK.exe
  2⤵
  PID:6444
- C:\Windows\System\LpfRkzT.exe
  C:\Windows\System\LpfRkzT.exe
  2⤵
  PID:6464
- C:\Windows\System\NjsgWPj.exe
  C:\Windows\System\NjsgWPj.exe
  2⤵
  PID:6480
- C:\Windows\System\zcGBoIs.exe
  C:\Windows\System\zcGBoIs.exe
  2⤵
  PID:6500
- C:\Windows\System\sJWjxMo.exe
  C:\Windows\System\sJWjxMo.exe
  2⤵
  PID:6584
- C:\Windows\System\HmgUQPn.exe
  C:\Windows\System\HmgUQPn.exe
  2⤵
  PID:6604
- C:\Windows\System\IofMynU.exe
  C:\Windows\System\IofMynU.exe
  2⤵
  PID:6660
- C:\Windows\System\AfIJGoF.exe
  C:\Windows\System\AfIJGoF.exe
  2⤵
  PID:6680
- C:\Windows\System\cuWHfyx.exe
  C:\Windows\System\cuWHfyx.exe
  2⤵
  PID:6756
- C:\Windows\System\bEIUYwB.exe
  C:\Windows\System\bEIUYwB.exe
  2⤵
  PID:6772
- C:\Windows\System\AsNklpf.exe
  C:\Windows\System\AsNklpf.exe
  2⤵
  PID:6788
- C:\Windows\System\rKAGerj.exe
  C:\Windows\System\rKAGerj.exe
  2⤵
  PID:6808
- C:\Windows\System\MSfmuZO.exe
  C:\Windows\System\MSfmuZO.exe
  2⤵
  PID:6868
- C:\Windows\System\cgtywot.exe
  C:\Windows\System\cgtywot.exe
  2⤵
  PID:6888
- C:\Windows\System\kpkFQum.exe
  C:\Windows\System\kpkFQum.exe
  2⤵
  PID:6956
- C:\Windows\System\ItxRrgg.exe
  C:\Windows\System\ItxRrgg.exe
  2⤵
  PID:6980
- C:\Windows\System\BjoEcxs.exe
  C:\Windows\System\BjoEcxs.exe
  2⤵
  PID:6996
- C:\Windows\System\uRKaiZK.exe
  C:\Windows\System\uRKaiZK.exe
  2⤵
  PID:7060
- C:\Windows\System\CRvsqCE.exe
  C:\Windows\System\CRvsqCE.exe
  2⤵
  PID:7092
- C:\Windows\System\XFlALpB.exe
  C:\Windows\System\XFlALpB.exe
  2⤵
  PID:7112
- C:\Windows\System\TwRTraC.exe
  C:\Windows\System\TwRTraC.exe
  2⤵
  PID:5588
- C:\Windows\System\akshmMZ.exe
  C:\Windows\System\akshmMZ.exe
  2⤵
  PID:6268
- C:\Windows\System\bqTlZUP.exe
  C:\Windows\System\bqTlZUP.exe
  2⤵
  PID:6284
- C:\Windows\System\adZZdLG.exe
  C:\Windows\System\adZZdLG.exe
  2⤵
  PID:6368
- C:\Windows\System\fICzYOv.exe
  C:\Windows\System\fICzYOv.exe
  2⤵
  PID:6420
- C:\Windows\System\imWcGlP.exe
  C:\Windows\System\imWcGlP.exe
  2⤵
  PID:6436
- C:\Windows\System\OyRNkgw.exe
  C:\Windows\System\OyRNkgw.exe
  2⤵
  PID:6496
- C:\Windows\System\xFGeeNE.exe
  C:\Windows\System\xFGeeNE.exe
  2⤵
  PID:6536
- C:\Windows\System\XXuLdBm.exe
  C:\Windows\System\XXuLdBm.exe
  2⤵
  PID:6640
- C:\Windows\System\WjIYTAV.exe
  C:\Windows\System\WjIYTAV.exe
  2⤵
  PID:6716
- C:\Windows\System\olnRWzH.exe
  C:\Windows\System\olnRWzH.exe
  2⤵
  PID:4160
- C:\Windows\System\xBjUVnA.exe
  C:\Windows\System\xBjUVnA.exe
  2⤵
  PID:6752
- C:\Windows\System\yOccylW.exe
  C:\Windows\System\yOccylW.exe
  2⤵
  PID:6884
- C:\Windows\System\toPpHjD.exe
  C:\Windows\System\toPpHjD.exe
  2⤵
  PID:7008
- C:\Windows\System\JdPJvPG.exe
  C:\Windows\System\JdPJvPG.exe
  2⤵
  PID:6968
- C:\Windows\System\SkRopRT.exe
  C:\Windows\System\SkRopRT.exe
  2⤵
  PID:7104
- C:\Windows\System\UviiGHE.exe
  C:\Windows\System\UviiGHE.exe
  2⤵
  PID:7080
- C:\Windows\System\uaDyFkH.exe
  C:\Windows\System\uaDyFkH.exe
  2⤵
  PID:5932
- C:\Windows\System\dGkVIBA.exe
  C:\Windows\System\dGkVIBA.exe
  2⤵
  PID:6184
- C:\Windows\System\RYxRViq.exe
  C:\Windows\System\RYxRViq.exe
  2⤵
  PID:6252
- C:\Windows\System\lEyCXsc.exe
  C:\Windows\System\lEyCXsc.exe
  2⤵
  PID:6328
- C:\Windows\System\KtRslFh.exe
  C:\Windows\System\KtRslFh.exe
  2⤵
  PID:6388
- C:\Windows\System\pBuYXLw.exe
  C:\Windows\System\pBuYXLw.exe
  2⤵
  PID:6600
- C:\Windows\System\JsyzYZw.exe
  C:\Windows\System\JsyzYZw.exe
  2⤵
  PID:6712
- C:\Windows\System\diMwzGr.exe
  C:\Windows\System\diMwzGr.exe
  2⤵
  PID:6800
- C:\Windows\System\GmVARDb.exe
  C:\Windows\System\GmVARDb.exe
  2⤵
  PID:6880
- C:\Windows\System\PQQimkj.exe
  C:\Windows\System\PQQimkj.exe
  2⤵
  PID:6948
- C:\Windows\System\xSAcWeI.exe
  C:\Windows\System\xSAcWeI.exe
  2⤵
  PID:6928
- C:\Windows\System\FdeDpTP.exe
  C:\Windows\System\FdeDpTP.exe
  2⤵
  PID:7124
- C:\Windows\System\MsJlMkn.exe
  C:\Windows\System\MsJlMkn.exe
  2⤵
  PID:6172
- C:\Windows\System\tPKOYwd.exe
  C:\Windows\System\tPKOYwd.exe
  2⤵
  PID:6304
- C:\Windows\System\EwvAink.exe
  C:\Windows\System\EwvAink.exe
  2⤵
  PID:6556
- C:\Windows\System\FsVwCVS.exe
  C:\Windows\System\FsVwCVS.exe
  2⤵
  PID:6652
- C:\Windows\System\IXQOCmS.exe
  C:\Windows\System\IXQOCmS.exe
  2⤵
  PID:6988
- C:\Windows\System\HkeoDUn.exe
  C:\Windows\System\HkeoDUn.exe
  2⤵
  PID:7072
- C:\Windows\System\thxmduD.exe
  C:\Windows\System\thxmduD.exe
  2⤵
  PID:6572
- C:\Windows\System\AuBoiiV.exe
  C:\Windows\System\AuBoiiV.exe
  2⤵
  PID:6432
- C:\Windows\System\gtaJKHn.exe
  C:\Windows\System\gtaJKHn.exe
  2⤵
  PID:6744
- C:\Windows\System\JQhcPqO.exe
  C:\Windows\System\JQhcPqO.exe
  2⤵
  PID:7172
- C:\Windows\System\ISwxEli.exe
  C:\Windows\System\ISwxEli.exe
  2⤵
  PID:7216
- C:\Windows\System\tVNHaLt.exe
  C:\Windows\System\tVNHaLt.exe
  2⤵
  PID:7240
- C:\Windows\System\VSiwvgm.exe
  C:\Windows\System\VSiwvgm.exe
  2⤵
  PID:7264
- C:\Windows\System\YcPEVIi.exe
  C:\Windows\System\YcPEVIi.exe
  2⤵
  PID:7288
- C:\Windows\System\kYeGCFP.exe
  C:\Windows\System\kYeGCFP.exe
  2⤵
  PID:7348
- C:\Windows\System\Wmlohnt.exe
  C:\Windows\System\Wmlohnt.exe
  2⤵
  PID:7368
- C:\Windows\System\uGghzHv.exe
  C:\Windows\System\uGghzHv.exe
  2⤵
  PID:7404
- C:\Windows\System\YXBbWKr.exe
  C:\Windows\System\YXBbWKr.exe
  2⤵
  PID:7420
- C:\Windows\System\LbOLTir.exe
  C:\Windows\System\LbOLTir.exe
  2⤵
  PID:7444
- C:\Windows\System\SiSmLyp.exe
  C:\Windows\System\SiSmLyp.exe
  2⤵
  PID:7468
- C:\Windows\System\KDWlCKt.exe
  C:\Windows\System\KDWlCKt.exe
  2⤵
  PID:7488
- C:\Windows\System\NLSCMPo.exe
  C:\Windows\System\NLSCMPo.exe
  2⤵
  PID:7540
- C:\Windows\System\ppmynUo.exe
  C:\Windows\System\ppmynUo.exe
  2⤵
  PID:7572
- C:\Windows\System\pGcbEDf.exe
  C:\Windows\System\pGcbEDf.exe
  2⤵
  PID:7596
- C:\Windows\System\eFuEHmw.exe
  C:\Windows\System\eFuEHmw.exe
  2⤵
  PID:7616
- C:\Windows\System\arYEXxK.exe
  C:\Windows\System\arYEXxK.exe
  2⤵
  PID:7644
- C:\Windows\System\DWtuQUx.exe
  C:\Windows\System\DWtuQUx.exe
  2⤵
  PID:7672
- C:\Windows\System\wvCXGlC.exe
  C:\Windows\System\wvCXGlC.exe
  2⤵
  PID:7732
- C:\Windows\System\BWQCAGW.exe
  C:\Windows\System\BWQCAGW.exe
  2⤵
  PID:7764
- C:\Windows\System\IKrKxCb.exe
  C:\Windows\System\IKrKxCb.exe
  2⤵
  PID:7800
- C:\Windows\System\nnztchV.exe
  C:\Windows\System\nnztchV.exe
  2⤵
  PID:7820
- C:\Windows\System\igyEUZr.exe
  C:\Windows\System\igyEUZr.exe
  2⤵
  PID:7840
- C:\Windows\System\TtDKKQW.exe
  C:\Windows\System\TtDKKQW.exe
  2⤵
  PID:7856
- C:\Windows\System\FvOiXrB.exe
  C:\Windows\System\FvOiXrB.exe
  2⤵
  PID:7880
- C:\Windows\System\SEbktsp.exe
  C:\Windows\System\SEbktsp.exe
  2⤵
  PID:7900
- C:\Windows\System\PCvcKSm.exe
  C:\Windows\System\PCvcKSm.exe
  2⤵
  PID:7936
- C:\Windows\System\ekZSbbz.exe
  C:\Windows\System\ekZSbbz.exe
  2⤵
  PID:7988
- C:\Windows\System\RflDzbJ.exe
  C:\Windows\System\RflDzbJ.exe
  2⤵
  PID:8036
- C:\Windows\System\ZfSkqXD.exe
  C:\Windows\System\ZfSkqXD.exe
  2⤵
  PID:8060
- C:\Windows\System\ZpiYflh.exe
  C:\Windows\System\ZpiYflh.exe
  2⤵
  PID:8076
- C:\Windows\System\KRLMBNn.exe
  C:\Windows\System\KRLMBNn.exe
  2⤵
  PID:8124
- C:\Windows\System\WWhETem.exe
  C:\Windows\System\WWhETem.exe
  2⤵
  PID:8172
- C:\Windows\System\tyqUfEn.exe
  C:\Windows\System\tyqUfEn.exe
  2⤵
  PID:8188
- C:\Windows\System\PCGXLAK.exe
  C:\Windows\System\PCGXLAK.exe
  2⤵
  PID:3764
- C:\Windows\System\KbMXoJB.exe
  C:\Windows\System\KbMXoJB.exe
  2⤵
  PID:7284
- C:\Windows\System\RYltmCe.exe
  C:\Windows\System\RYltmCe.exe
  2⤵
  PID:7308
- C:\Windows\System\GliCcun.exe
  C:\Windows\System\GliCcun.exe
  2⤵
  PID:7376
- C:\Windows\System\jABvMrX.exe
  C:\Windows\System\jABvMrX.exe
  2⤵
  PID:7436
- C:\Windows\System\ikFntfD.exe
  C:\Windows\System\ikFntfD.exe
  2⤵
  PID:7388
- C:\Windows\System\IftZUcw.exe
  C:\Windows\System\IftZUcw.exe
  2⤵
  PID:7516
- C:\Windows\System\zWXwPHG.exe
  C:\Windows\System\zWXwPHG.exe
  2⤵
  PID:7532
- C:\Windows\System\kESAsux.exe
  C:\Windows\System\kESAsux.exe
  2⤵
  PID:7584
- C:\Windows\System\bAAmHFd.exe
  C:\Windows\System\bAAmHFd.exe
  2⤵
  PID:7664
- C:\Windows\System\sQtgFJb.exe
  C:\Windows\System\sQtgFJb.exe
  2⤵
  PID:7784
- C:\Windows\System\TxgrAhr.exe
  C:\Windows\System\TxgrAhr.exe
  2⤵
  PID:7828
- C:\Windows\System\AsKUzXh.exe
  C:\Windows\System\AsKUzXh.exe
  2⤵
  PID:7868
- C:\Windows\System\tfDEhhe.exe
  C:\Windows\System\tfDEhhe.exe
  2⤵
  PID:7876
- C:\Windows\System\mIcEMlc.exe
  C:\Windows\System\mIcEMlc.exe
  2⤵
  PID:7960
- C:\Windows\System\glXaCIS.exe
  C:\Windows\System\glXaCIS.exe
  2⤵
  PID:7920
- C:\Windows\System\eUohSFl.exe
  C:\Windows\System\eUohSFl.exe
  2⤵
  PID:7976
- C:\Windows\System\QGutjVF.exe
  C:\Windows\System\QGutjVF.exe
  2⤵
  PID:8020
- C:\Windows\System\CbjLDEh.exe
  C:\Windows\System\CbjLDEh.exe
  2⤵
  PID:7204
- C:\Windows\System\bBxfXpc.exe
  C:\Windows\System\bBxfXpc.exe
  2⤵
  PID:7296
- C:\Windows\System\trgXptD.exe
  C:\Windows\System\trgXptD.exe
  2⤵
  PID:7624
- C:\Windows\System\nkAnGHF.exe
  C:\Windows\System\nkAnGHF.exe
  2⤵
  PID:7416
- C:\Windows\System\EPKNbIP.exe
  C:\Windows\System\EPKNbIP.exe
  2⤵
  PID:7812
- C:\Windows\System\FTzCCiz.exe
  C:\Windows\System\FTzCCiz.exe
  2⤵
  PID:7712
- C:\Windows\System\vSuUVyi.exe
  C:\Windows\System\vSuUVyi.exe
  2⤵
  PID:8032
- C:\Windows\System\eTfOKOx.exe
  C:\Windows\System\eTfOKOx.exe
  2⤵
  PID:7892
- C:\Windows\System\QhTkbIU.exe
  C:\Windows\System\QhTkbIU.exe
  2⤵
  PID:8108
- C:\Windows\System\YajZkme.exe
  C:\Windows\System\YajZkme.exe
  2⤵
  PID:7452
- C:\Windows\System\PnvvcBH.exe
  C:\Windows\System\PnvvcBH.exe
  2⤵
  PID:7556
- C:\Windows\System\UdfwRld.exe
  C:\Windows\System\UdfwRld.exe
  2⤵
  PID:7848
- C:\Windows\System\woUuuRp.exe
  C:\Windows\System\woUuuRp.exe
  2⤵
  PID:8200
- C:\Windows\System\MVEvqLu.exe
  C:\Windows\System\MVEvqLu.exe
  2⤵
  PID:8220
- C:\Windows\System\VGOwuAw.exe
  C:\Windows\System\VGOwuAw.exe
  2⤵
  PID:8236
- C:\Windows\System\ygEdmcU.exe
  C:\Windows\System\ygEdmcU.exe
  2⤵
  PID:8260
- C:\Windows\System\ZdVIJBm.exe
  C:\Windows\System\ZdVIJBm.exe
  2⤵
  PID:8320
- C:\Windows\System\fzUXoWm.exe
  C:\Windows\System\fzUXoWm.exe
  2⤵
  PID:8340
- C:\Windows\System\ClRWwTz.exe
  C:\Windows\System\ClRWwTz.exe
  2⤵
  PID:8388
- C:\Windows\System\cewJgUa.exe
  C:\Windows\System\cewJgUa.exe
  2⤵
  PID:8424
- C:\Windows\System\FPYHZXf.exe
  C:\Windows\System\FPYHZXf.exe
  2⤵
  PID:8440
- C:\Windows\System\mZqZzoc.exe
  C:\Windows\System\mZqZzoc.exe
  2⤵
  PID:8468
- C:\Windows\System\sntLdbe.exe
  C:\Windows\System\sntLdbe.exe
  2⤵
  PID:8492
- C:\Windows\System\qUOoYJO.exe
  C:\Windows\System\qUOoYJO.exe
  2⤵
  PID:8508
- C:\Windows\System\RdkXzEt.exe
  C:\Windows\System\RdkXzEt.exe
  2⤵
  PID:8532
- C:\Windows\System\cISJTWn.exe
  C:\Windows\System\cISJTWn.exe
  2⤵
  PID:8564
- C:\Windows\System\KlyWSOr.exe
  C:\Windows\System\KlyWSOr.exe
  2⤵
  PID:8628
- C:\Windows\System\pJYYnUG.exe
  C:\Windows\System\pJYYnUG.exe
  2⤵
  PID:8644
- C:\Windows\System\ybtmUbG.exe
  C:\Windows\System\ybtmUbG.exe
  2⤵
  PID:8664
- C:\Windows\System\KwzBPWs.exe
  C:\Windows\System\KwzBPWs.exe
  2⤵
  PID:8692
- C:\Windows\System\ePWqqHD.exe
  C:\Windows\System\ePWqqHD.exe
  2⤵
  PID:8708
- C:\Windows\System\oYKQvkS.exe
  C:\Windows\System\oYKQvkS.exe
  2⤵
  PID:8740
- C:\Windows\System\DzOPeoq.exe
  C:\Windows\System\DzOPeoq.exe
  2⤵
  PID:8776
- C:\Windows\System\buXiddJ.exe
  C:\Windows\System\buXiddJ.exe
  2⤵
  PID:8804
- C:\Windows\System\pjETAaE.exe
  C:\Windows\System\pjETAaE.exe
  2⤵
  PID:8828
- C:\Windows\System\XkEajIv.exe
  C:\Windows\System\XkEajIv.exe
  2⤵
  PID:8844
- C:\Windows\System\lVOyIfR.exe
  C:\Windows\System\lVOyIfR.exe
  2⤵
  PID:8868
- C:\Windows\System\VvyjvLf.exe
  C:\Windows\System\VvyjvLf.exe
  2⤵
  PID:8888
- C:\Windows\System\gBmfRYa.exe
  C:\Windows\System\gBmfRYa.exe
  2⤵
  PID:8956
- C:\Windows\System\ydXdHxq.exe
  C:\Windows\System\ydXdHxq.exe
  2⤵
  PID:8976
- C:\Windows\System\nvAIufp.exe
  C:\Windows\System\nvAIufp.exe
  2⤵
  PID:8996
- C:\Windows\System\VKNQWyY.exe
  C:\Windows\System\VKNQWyY.exe
  2⤵
  PID:9020
- C:\Windows\System\hJHVQgC.exe
  C:\Windows\System\hJHVQgC.exe
  2⤵
  PID:9040
- C:\Windows\System\BqBTQSe.exe
  C:\Windows\System\BqBTQSe.exe
  2⤵
  PID:9084
- C:\Windows\System\wLaZQGB.exe
  C:\Windows\System\wLaZQGB.exe
  2⤵
  PID:9136
- C:\Windows\System\hOyqlcA.exe
  C:\Windows\System\hOyqlcA.exe
  2⤵
  PID:9152
- C:\Windows\System\sdZNRVP.exe
  C:\Windows\System\sdZNRVP.exe
  2⤵
  PID:9176
- C:\Windows\System\sfggtpO.exe
  C:\Windows\System\sfggtpO.exe
  2⤵
  PID:9200
- C:\Windows\System\MevlWhG.exe
  C:\Windows\System\MevlWhG.exe
  2⤵
  PID:8216
- C:\Windows\System\kILGtEe.exe
  C:\Windows\System\kILGtEe.exe
  2⤵
  PID:7792
- C:\Windows\System\fJGKIqJ.exe
  C:\Windows\System\fJGKIqJ.exe
  2⤵
  PID:8304
- C:\Windows\System\VAIxIsB.exe
  C:\Windows\System\VAIxIsB.exe
  2⤵
  PID:8300
- C:\Windows\System\FJteQFz.exe
  C:\Windows\System\FJteQFz.exe
  2⤵
  PID:8416
- C:\Windows\System\UreblSK.exe
  C:\Windows\System\UreblSK.exe
  2⤵
  PID:8432
- C:\Windows\System\yKYkxIy.exe
  C:\Windows\System\yKYkxIy.exe
  2⤵
  PID:8488
- C:\Windows\System\CZPLMxq.exe
  C:\Windows\System\CZPLMxq.exe
  2⤵
  PID:8528
- C:\Windows\System\pthQKWv.exe
  C:\Windows\System\pthQKWv.exe
  2⤵
  PID:8552
- C:\Windows\System\KWJvCur.exe
  C:\Windows\System\KWJvCur.exe
  2⤵
  PID:8620
- C:\Windows\System\XDnBThF.exe
  C:\Windows\System\XDnBThF.exe
  2⤵
  PID:8684
- C:\Windows\System\TIRkhiY.exe
  C:\Windows\System\TIRkhiY.exe
  2⤵
  PID:8748
- C:\Windows\System\AgIdtlI.exe
  C:\Windows\System\AgIdtlI.exe
  2⤵
  PID:8836
- C:\Windows\System\TRQRKwG.exe
  C:\Windows\System\TRQRKwG.exe
  2⤵
  PID:8860
- C:\Windows\System\kQuxrPg.exe
  C:\Windows\System\kQuxrPg.exe
  2⤵
  PID:8904
- C:\Windows\System\QCgPPiw.exe
  C:\Windows\System\QCgPPiw.exe
  2⤵
  PID:8964
- C:\Windows\System\FxubdzJ.exe
  C:\Windows\System\FxubdzJ.exe
  2⤵
  PID:9012
- C:\Windows\System\lYRLDWs.exe
  C:\Windows\System\lYRLDWs.exe
  2⤵
  PID:9104
- C:\Windows\System\IkeudAl.exe
  C:\Windows\System\IkeudAl.exe
  2⤵
  PID:2032
- C:\Windows\System\UdnMOzK.exe
  C:\Windows\System\UdnMOzK.exe
  2⤵
  PID:9160
- C:\Windows\System\ocHKJzG.exe
  C:\Windows\System\ocHKJzG.exe
  2⤵
  PID:7328
- C:\Windows\System\KovbjGI.exe
  C:\Windows\System\KovbjGI.exe
  2⤵
  PID:8436
- C:\Windows\System\XtUSLyv.exe
  C:\Windows\System\XtUSLyv.exe
  2⤵
  PID:8624
- C:\Windows\System\hYNnqyX.exe
  C:\Windows\System\hYNnqyX.exe
  2⤵
  PID:9148
- C:\Windows\System\XkgLJEb.exe
  C:\Windows\System\XkgLJEb.exe
  2⤵
  PID:8784
- C:\Windows\System\kvoqFcY.exe
  C:\Windows\System\kvoqFcY.exe
  2⤵
  PID:8464
- C:\Windows\System\xKtqHxa.exe
  C:\Windows\System\xKtqHxa.exe
  2⤵
  PID:9292
- C:\Windows\System\nXsrJQB.exe
  C:\Windows\System\nXsrJQB.exe
  2⤵
  PID:9308
- C:\Windows\System\sRlVPbf.exe
  C:\Windows\System\sRlVPbf.exe
  2⤵
  PID:9324
- C:\Windows\System\DSoBpxE.exe
  C:\Windows\System\DSoBpxE.exe
  2⤵
  PID:9340
- C:\Windows\System\XnCTeBD.exe
  C:\Windows\System\XnCTeBD.exe
  2⤵
  PID:9356
- C:\Windows\System\lnwDJUL.exe
  C:\Windows\System\lnwDJUL.exe
  2⤵
  PID:9372
- C:\Windows\System\wEDEaXj.exe
  C:\Windows\System\wEDEaXj.exe
  2⤵
  PID:9388
- C:\Windows\System\IIotlJK.exe
  C:\Windows\System\IIotlJK.exe
  2⤵
  PID:9404
- C:\Windows\System\SUCpQtn.exe
  C:\Windows\System\SUCpQtn.exe
  2⤵
  PID:9420
- C:\Windows\System\apFhCtf.exe
  C:\Windows\System\apFhCtf.exe
  2⤵
  PID:9436
- C:\Windows\System\OPVBPuc.exe
  C:\Windows\System\OPVBPuc.exe
  2⤵
  PID:9452
- C:\Windows\System\EFzqJLw.exe
  C:\Windows\System\EFzqJLw.exe
  2⤵
  PID:9468
- C:\Windows\System\YNGZZyg.exe
  C:\Windows\System\YNGZZyg.exe
  2⤵
  PID:9484
- C:\Windows\System\ADEMMRY.exe
  C:\Windows\System\ADEMMRY.exe
  2⤵
  PID:9524
- C:\Windows\System\wJjVnhd.exe
  C:\Windows\System\wJjVnhd.exe
  2⤵
  PID:9544
- C:\Windows\System\AjYJzOd.exe
  C:\Windows\System\AjYJzOd.exe
  2⤵
  PID:9568
- C:\Windows\System\SrwMCJa.exe
  C:\Windows\System\SrwMCJa.exe
  2⤵
  PID:9588
- C:\Windows\System\GrLQQDx.exe
  C:\Windows\System\GrLQQDx.exe
  2⤵
  PID:9604
- C:\Windows\System\iLNeIBq.exe
  C:\Windows\System\iLNeIBq.exe
  2⤵
  PID:9680
- C:\Windows\System\HZsQbkm.exe
  C:\Windows\System\HZsQbkm.exe
  2⤵
  PID:9704
- C:\Windows\System\ZJqGdoI.exe
  C:\Windows\System\ZJqGdoI.exe
  2⤵
  PID:9772
- C:\Windows\System\gvmDuwX.exe
  C:\Windows\System\gvmDuwX.exe
  2⤵
  PID:9796
- C:\Windows\System\BtdDJaD.exe
  C:\Windows\System\BtdDJaD.exe
  2⤵
  PID:9892
- C:\Windows\System\IByhFsa.exe
  C:\Windows\System\IByhFsa.exe
  2⤵
  PID:9936
- C:\Windows\System\zlyHZQD.exe
  C:\Windows\System\zlyHZQD.exe
  2⤵
  PID:9960
- C:\Windows\System\uVNapce.exe
  C:\Windows\System\uVNapce.exe
  2⤵
  PID:9980
- C:\Windows\System\ukVHjZa.exe
  C:\Windows\System\ukVHjZa.exe
  2⤵
  PID:10032
- C:\Windows\System\zbMCGPf.exe
  C:\Windows\System\zbMCGPf.exe
  2⤵
  PID:10052
- C:\Windows\System\WMYUGhz.exe
  C:\Windows\System\WMYUGhz.exe
  2⤵
  PID:10076
- C:\Windows\System\gGkRHFx.exe
  C:\Windows\System\gGkRHFx.exe
  2⤵
  PID:10096
- C:\Windows\System\MSrRbPf.exe
  C:\Windows\System\MSrRbPf.exe
  2⤵
  PID:10120
- C:\Windows\System\iCzaVLs.exe
  C:\Windows\System\iCzaVLs.exe
  2⤵
  PID:10144
- C:\Windows\System\pEjhipp.exe
  C:\Windows\System\pEjhipp.exe
  2⤵
  PID:8768
- C:\Windows\System\keOawvX.exe
  C:\Windows\System\keOawvX.exe
  2⤵
  PID:9060
- C:\Windows\System\KkezVZY.exe
  C:\Windows\System\KkezVZY.exe
  2⤵
  PID:9348
- C:\Windows\System\rJjElZn.exe
  C:\Windows\System\rJjElZn.exe
  2⤵
  PID:9240
- C:\Windows\System\mkBtRAP.exe
  C:\Windows\System\mkBtRAP.exe
  2⤵
  PID:9480
- C:\Windows\System\AQtLloT.exe
  C:\Windows\System\AQtLloT.exe
  2⤵
  PID:9536
- C:\Windows\System\TbpAcKd.exe
  C:\Windows\System\TbpAcKd.exe
  2⤵
  PID:9072
- C:\Windows\System\klWjace.exe
  C:\Windows\System\klWjace.exe
  2⤵
  PID:9416
- C:\Windows\System\rNrYAKy.exe
  C:\Windows\System\rNrYAKy.exe
  2⤵
  PID:9448
- C:\Windows\System\cBfugGN.exe
  C:\Windows\System\cBfugGN.exe
  2⤵
  PID:9504
- C:\Windows\System\gBEYgQN.exe
  C:\Windows\System\gBEYgQN.exe
  2⤵
  PID:9624
- C:\Windows\System\HKMKJpN.exe
  C:\Windows\System\HKMKJpN.exe
  2⤵
  PID:9824
- C:\Windows\System\ABgZhNs.exe
  C:\Windows\System\ABgZhNs.exe
  2⤵
  PID:9688
- C:\Windows\System\uYBKYzg.exe
  C:\Windows\System\uYBKYzg.exe
  2⤵
  PID:9760
- C:\Windows\System\mNKzJAW.exe
  C:\Windows\System\mNKzJAW.exe
  2⤵
  PID:9844
- C:\Windows\System\mcgMnKQ.exe
  C:\Windows\System\mcgMnKQ.exe
  2⤵
  PID:9888
- C:\Windows\System\sQnBlZO.exe
  C:\Windows\System\sQnBlZO.exe
  2⤵
  PID:9932
- C:\Windows\System\QwYEHnR.exe
  C:\Windows\System\QwYEHnR.exe
  2⤵
  PID:10128
- C:\Windows\System\XkXTNXv.exe
  C:\Windows\System\XkXTNXv.exe
  2⤵
  PID:10024
- C:\Windows\System\YXRwahd.exe
  C:\Windows\System\YXRwahd.exe
  2⤵
  PID:10068
- C:\Windows\System\Lfqmjji.exe
  C:\Windows\System\Lfqmjji.exe
  2⤵
  PID:10104
- C:\Windows\System\owFMLVu.exe
  C:\Windows\System\owFMLVu.exe
  2⤵
  PID:8656
- C:\Windows\System\nhlHMAM.exe
  C:\Windows\System\nhlHMAM.exe
  2⤵
  PID:9304
- C:\Windows\System\hPGNPOZ.exe
  C:\Windows\System\hPGNPOZ.exe
  2⤵
  PID:9280
- C:\Windows\System\qDApnkK.exe
  C:\Windows\System\qDApnkK.exe
  2⤵
  PID:9444
- C:\Windows\System\tOamzYo.exe
  C:\Windows\System\tOamzYo.exe
  2⤵
  PID:9552
- C:\Windows\System\WZLYmxx.exe
  C:\Windows\System\WZLYmxx.exe
  2⤵
  PID:9916
- C:\Windows\System\pMogZaf.exe
  C:\Windows\System\pMogZaf.exe
  2⤵
  PID:10092
- C:\Windows\System\Mhtlocv.exe
  C:\Windows\System\Mhtlocv.exe
  2⤵
  PID:10136
- C:\Windows\System\mmtLlgq.exe
  C:\Windows\System\mmtLlgq.exe
  2⤵
  PID:9500
- C:\Windows\System\FWdCsQt.exe
  C:\Windows\System\FWdCsQt.exe
  2⤵
  PID:9556
- C:\Windows\System\WhytSEb.exe
  C:\Windows\System\WhytSEb.exe
  2⤵
  PID:9816
- C:\Windows\System\mPUQUmg.exe
  C:\Windows\System\mPUQUmg.exe
  2⤵
  PID:9412
- C:\Windows\System\UIuSmHP.exe
  C:\Windows\System\UIuSmHP.exe
  2⤵
  PID:9064
- C:\Windows\System\WLfWXTO.exe
  C:\Windows\System\WLfWXTO.exe
  2⤵
  PID:10252
- C:\Windows\System\FihDlsg.exe
  C:\Windows\System\FihDlsg.exe
  2⤵
  PID:10268
- C:\Windows\System\dFszEzt.exe
  C:\Windows\System\dFszEzt.exe
  2⤵
  PID:10312
- C:\Windows\System\hfWamut.exe
  C:\Windows\System\hfWamut.exe
  2⤵
  PID:10328
- C:\Windows\System\jmdjgKD.exe
  C:\Windows\System\jmdjgKD.exe
  2⤵
  PID:10352
- C:\Windows\System\WwWdVLe.exe
  C:\Windows\System\WwWdVLe.exe
  2⤵
  PID:10368
- C:\Windows\System\lsIzBSE.exe
  C:\Windows\System\lsIzBSE.exe
  2⤵
  PID:10384
- C:\Windows\System\amesJzi.exe
  C:\Windows\System\amesJzi.exe
  2⤵
  PID:10416
- C:\Windows\System\NxRAARc.exe
  C:\Windows\System\NxRAARc.exe
  2⤵
  PID:10444
- C:\Windows\System\ZDDnHHF.exe
  C:\Windows\System\ZDDnHHF.exe
  2⤵
  PID:10472
- C:\Windows\System\pgetxcZ.exe
  C:\Windows\System\pgetxcZ.exe
  2⤵
  PID:10492
- C:\Windows\System\yBoNsFi.exe
  C:\Windows\System\yBoNsFi.exe
  2⤵
  PID:10540
- C:\Windows\System\WomJwjn.exe
  C:\Windows\System\WomJwjn.exe
  2⤵
  PID:10584
- C:\Windows\System\cfEHddE.exe
  C:\Windows\System\cfEHddE.exe
  2⤵
  PID:10608
- C:\Windows\System\RcrvuRW.exe
  C:\Windows\System\RcrvuRW.exe
  2⤵
  PID:10640
- C:\Windows\System\DzNvOzT.exe
  C:\Windows\System\DzNvOzT.exe
  2⤵
  PID:10656
- C:\Windows\System\QfaQrUx.exe
  C:\Windows\System\QfaQrUx.exe
  2⤵
  PID:10676
- C:\Windows\System\AJVuUHZ.exe
  C:\Windows\System\AJVuUHZ.exe
  2⤵
  PID:10712
- C:\Windows\System\gzPgTgY.exe
  C:\Windows\System\gzPgTgY.exe
  2⤵
  PID:10760
- C:\Windows\System\FDXMbOv.exe
  C:\Windows\System\FDXMbOv.exe
  2⤵
  PID:10788
- C:\Windows\System\SXIXoBj.exe
  C:\Windows\System\SXIXoBj.exe
  2⤵
  PID:10808
- C:\Windows\System\GpmJQlm.exe
  C:\Windows\System\GpmJQlm.exe
  2⤵
  PID:10836
- C:\Windows\System\xlsiMeR.exe
  C:\Windows\System\xlsiMeR.exe
  2⤵
  PID:10852
- C:\Windows\System\JVOVYNE.exe
  C:\Windows\System\JVOVYNE.exe
  2⤵
  PID:10872
- C:\Windows\System\cHiWWma.exe
  C:\Windows\System\cHiWWma.exe
  2⤵
  PID:10892
- C:\Windows\System\QqDNXgt.exe
  C:\Windows\System\QqDNXgt.exe
  2⤵
  PID:10940
- C:\Windows\System\tQHSnVv.exe
  C:\Windows\System\tQHSnVv.exe
  2⤵
  PID:10960
- C:\Windows\System\jMjDloM.exe
  C:\Windows\System\jMjDloM.exe
  2⤵
  PID:10980
- C:\Windows\System\MkWuUwc.exe
  C:\Windows\System\MkWuUwc.exe
  2⤵
  PID:11020
- C:\Windows\System\kKrlDbx.exe
  C:\Windows\System\kKrlDbx.exe
  2⤵
  PID:11048
- C:\Windows\System\wRDWBBh.exe
  C:\Windows\System\wRDWBBh.exe
  2⤵
  PID:11072
- C:\Windows\System\BQPIOpH.exe
  C:\Windows\System\BQPIOpH.exe
  2⤵
  PID:11092
- C:\Windows\System\OywzluX.exe
  C:\Windows\System\OywzluX.exe
  2⤵
  PID:11108
- C:\Windows\System\FenZRuA.exe
  C:\Windows\System\FenZRuA.exe
  2⤵
  PID:11132
- C:\Windows\System\VAAWNGI.exe
  C:\Windows\System\VAAWNGI.exe
  2⤵
  PID:11172
- C:\Windows\System\AeYEolP.exe
  C:\Windows\System\AeYEolP.exe
  2⤵
  PID:11192
- C:\Windows\System\muLrDzS.exe
  C:\Windows\System\muLrDzS.exe
  2⤵
  PID:11256
- C:\Windows\System\kKLyWfJ.exe
  C:\Windows\System\kKLyWfJ.exe
  2⤵
  PID:10336
- C:\Windows\System\BnIyOyB.exe
  C:\Windows\System\BnIyOyB.exe
  2⤵
  PID:10344
- C:\Windows\System\CizPaQn.exe
  C:\Windows\System\CizPaQn.exe
  2⤵
  PID:10380
- C:\Windows\System\TQEtPpE.exe
  C:\Windows\System\TQEtPpE.exe
  2⤵
  PID:10440
- C:\Windows\System\WEDUCpS.exe
  C:\Windows\System\WEDUCpS.exe
  2⤵
  PID:10480
- C:\Windows\System\vkXLdIV.exe
  C:\Windows\System\vkXLdIV.exe
  2⤵
  PID:10536
- C:\Windows\System\LDcqPsG.exe
  C:\Windows\System\LDcqPsG.exe
  2⤵
  PID:10604
- C:\Windows\System\ybPVNCb.exe
  C:\Windows\System\ybPVNCb.exe
  2⤵
  PID:10704
- C:\Windows\System\HWGrrRB.exe
  C:\Windows\System\HWGrrRB.exe
  2⤵
  PID:10800
- C:\Windows\System\djLRpll.exe
  C:\Windows\System\djLRpll.exe
  2⤵
  PID:10828
- C:\Windows\System\ICynSBr.exe
  C:\Windows\System\ICynSBr.exe
  2⤵
  PID:10860
- C:\Windows\System\zZDPLsr.exe
  C:\Windows\System\zZDPLsr.exe
  2⤵
  PID:10888
- C:\Windows\System\sQrygOS.exe
  C:\Windows\System\sQrygOS.exe
  2⤵
  PID:10908
- C:\Windows\System\cAokbOB.exe
  C:\Windows\System\cAokbOB.exe
  2⤵
  PID:10972
- C:\Windows\System\iaoKSjV.exe
  C:\Windows\System\iaoKSjV.exe
  2⤵
  PID:11036
- C:\Windows\System\QAArMFg.exe
  C:\Windows\System\QAArMFg.exe
  2⤵
  PID:11064
- C:\Windows\System\VbSQVpS.exe
  C:\Windows\System\VbSQVpS.exe
  2⤵
  PID:11212
- C:\Windows\System\AhqMywg.exe
  C:\Windows\System\AhqMywg.exe
  2⤵
  PID:10408
- C:\Windows\System\JpVPAVR.exe
  C:\Windows\System\JpVPAVR.exe
  2⤵
  PID:10636
- C:\Windows\System\MPVvrNj.exe
  C:\Windows\System\MPVvrNj.exe
  2⤵
  PID:10600
- C:\Windows\System\MrBEEcw.exe
  C:\Windows\System\MrBEEcw.exe
  2⤵
  PID:10992
- C:\Windows\System\ZNcrMls.exe
  C:\Windows\System\ZNcrMls.exe
  2⤵
  PID:10868
- C:\Windows\System\fkLjTgV.exe
  C:\Windows\System\fkLjTgV.exe
  2⤵
  PID:11116
- C:\Windows\System\jHeZUSI.exe
  C:\Windows\System\jHeZUSI.exe
  2⤵
  PID:11200
- C:\Windows\System\NMXNGvS.exe
  C:\Windows\System\NMXNGvS.exe
  2⤵
  PID:11252
- C:\Windows\System\DUiiNPE.exe
  C:\Windows\System\DUiiNPE.exe
  2⤵
  PID:10464
- C:\Windows\System\hEjogLf.exe
  C:\Windows\System\hEjogLf.exe
  2⤵
  PID:11128
- C:\Windows\System\URglnWJ.exe
  C:\Windows\System\URglnWJ.exe
  2⤵
  PID:11300
- C:\Windows\System\rdtYOHz.exe
  C:\Windows\System\rdtYOHz.exe
  2⤵
  PID:11336
- C:\Windows\System\pXHNtFY.exe
  C:\Windows\System\pXHNtFY.exe
  2⤵
  PID:11356
- C:\Windows\System\NPnkjiM.exe
  C:\Windows\System\NPnkjiM.exe
  2⤵
  PID:11380
- C:\Windows\System\EWjlQRh.exe
  C:\Windows\System\EWjlQRh.exe
  2⤵
  PID:11412
- C:\Windows\System\tmSPtXR.exe
  C:\Windows\System\tmSPtXR.exe
  2⤵
  PID:11432
- C:\Windows\System\zEdJvJA.exe
  C:\Windows\System\zEdJvJA.exe
  2⤵
  PID:11468
- C:\Windows\System\qmsLNlE.exe
  C:\Windows\System\qmsLNlE.exe
  2⤵
  PID:11492
- C:\Windows\System\BDqVsKl.exe
  C:\Windows\System\BDqVsKl.exe
  2⤵
  PID:11512
- C:\Windows\System\StsLyjd.exe
  C:\Windows\System\StsLyjd.exe
  2⤵
  PID:11536
- C:\Windows\System\jHHnMBX.exe
  C:\Windows\System\jHHnMBX.exe
  2⤵
  PID:11556
- C:\Windows\System\KxTMnHE.exe
  C:\Windows\System\KxTMnHE.exe
  2⤵
  PID:11596
- C:\Windows\System\MiNSuBH.exe
  C:\Windows\System\MiNSuBH.exe
  2⤵
  PID:11616
- C:\Windows\System\isKvbfr.exe
  C:\Windows\System\isKvbfr.exe
  2⤵
  PID:11652
- C:\Windows\System\bjpRItU.exe
  C:\Windows\System\bjpRItU.exe
  2⤵
  PID:11680
- C:\Windows\System\TLjuGjz.exe
  C:\Windows\System\TLjuGjz.exe
  2⤵
  PID:11704
- C:\Windows\System\CxWvtTd.exe
  C:\Windows\System\CxWvtTd.exe
  2⤵
  PID:11728
- C:\Windows\System\UkvIezH.exe
  C:\Windows\System\UkvIezH.exe
  2⤵
  PID:11748
- C:\Windows\System\Faafgah.exe
  C:\Windows\System\Faafgah.exe
  2⤵
  PID:11764
- C:\Windows\System\jfTHroI.exe
  C:\Windows\System\jfTHroI.exe
  2⤵
  PID:11784
- C:\Windows\System\vvIvRkw.exe
  C:\Windows\System\vvIvRkw.exe
  2⤵
  PID:11808
- C:\Windows\System\GmdsGNr.exe
  C:\Windows\System\GmdsGNr.exe
  2⤵
  PID:11824
- C:\Windows\System\GoSwTYo.exe
  C:\Windows\System\GoSwTYo.exe
  2⤵
  PID:11880
- C:\Windows\System\qHLXQTM.exe
  C:\Windows\System\qHLXQTM.exe
  2⤵
  PID:11896
- C:\Windows\System\bMJjIyL.exe
  C:\Windows\System\bMJjIyL.exe
  2⤵
  PID:11916
- C:\Windows\System\wMRrRRV.exe
  C:\Windows\System\wMRrRRV.exe
  2⤵
  PID:11940
- C:\Windows\System\pZhuDLc.exe
  C:\Windows\System\pZhuDLc.exe
  2⤵
  PID:11956
- C:\Windows\System\TOYLTOP.exe
  C:\Windows\System\TOYLTOP.exe
  2⤵
  PID:11988
- C:\Windows\System\vYxCbOm.exe
  C:\Windows\System\vYxCbOm.exe
  2⤵
  PID:12020
- C:\Windows\System\fXUvxVO.exe
  C:\Windows\System\fXUvxVO.exe
  2⤵
  PID:12036
- C:\Windows\System\aUoVVrF.exe
  C:\Windows\System\aUoVVrF.exe
  2⤵
  PID:12052
- C:\Windows\System\pFhmJPg.exe
  C:\Windows\System\pFhmJPg.exe
  2⤵
  PID:12084
- C:\Windows\System\XgAgMKK.exe
  C:\Windows\System\XgAgMKK.exe
  2⤵
  PID:12108
- C:\Windows\System\eWzunLM.exe
  C:\Windows\System\eWzunLM.exe
  2⤵
  PID:12224
- C:\Windows\System\FBFlAvp.exe
  C:\Windows\System\FBFlAvp.exe
  2⤵
  PID:12248
- C:\Windows\System\xgqyeVw.exe
  C:\Windows\System\xgqyeVw.exe
  2⤵
  PID:12264
- C:\Windows\System\bDZGzIN.exe
  C:\Windows\System\bDZGzIN.exe
  2⤵
  PID:12284
- C:\Windows\System\ekSrNFJ.exe
  C:\Windows\System\ekSrNFJ.exe
  2⤵
  PID:11312
- C:\Windows\System\DrmfJbW.exe
  C:\Windows\System\DrmfJbW.exe
  2⤵
  PID:11404
- C:\Windows\System\MNKsJrf.exe
  C:\Windows\System\MNKsJrf.exe
  2⤵
  PID:11480
- C:\Windows\System\jVbjglH.exe
  C:\Windows\System\jVbjglH.exe
  2⤵
  PID:11488
- C:\Windows\System\Mtebcxo.exe
  C:\Windows\System\Mtebcxo.exe
  2⤵
  PID:11624
- C:\Windows\System\Qjzcrmz.exe
  C:\Windows\System\Qjzcrmz.exe
  2⤵
  PID:11648
- C:\Windows\System\OPlkmrE.exe
  C:\Windows\System\OPlkmrE.exe
  2⤵
  PID:11724
- C:\Windows\System\owMDhlO.exe
  C:\Windows\System\owMDhlO.exe
  2⤵
  PID:11744
- C:\Windows\System\KJZQCyO.exe
  C:\Windows\System\KJZQCyO.exe
  2⤵
  PID:11816
- C:\Windows\System\tqolxJL.exe
  C:\Windows\System\tqolxJL.exe
  2⤵
  PID:11972
- C:\Windows\System\zmhOWME.exe
  C:\Windows\System\zmhOWME.exe
  2⤵
  PID:11888
- C:\Windows\System\ZDCNNoY.exe
  C:\Windows\System\ZDCNNoY.exe
  2⤵
  PID:12032
- C:\Windows\System\QwssHgx.exe
  C:\Windows\System\QwssHgx.exe
  2⤵
  PID:12104
- C:\Windows\System\Vtphifo.exe
  C:\Windows\System\Vtphifo.exe
  2⤵
  PID:12068
- C:\Windows\System\MsJZoYI.exe
  C:\Windows\System\MsJZoYI.exe
  2⤵
  PID:12208
- C:\Windows\System\gtbPWuH.exe
  C:\Windows\System\gtbPWuH.exe
  2⤵
  PID:12140
- C:\Windows\System\jkcRzSi.exe
  C:\Windows\System\jkcRzSi.exe
  2⤵
  PID:12272
- C:\Windows\System\AtZzOJB.exe
  C:\Windows\System\AtZzOJB.exe
  2⤵
  PID:11100
- C:\Windows\System\oDJjPXM.exe
  C:\Windows\System\oDJjPXM.exe
  2⤵
  PID:11568
- C:\Windows\System\kBtVeMe.exe
  C:\Windows\System\kBtVeMe.exe
  2⤵
  PID:11632
- C:\Windows\System\aEtUEhk.exe
  C:\Windows\System\aEtUEhk.exe
  2⤵
  PID:11800
- C:\Windows\System\kaMVrQB.exe
  C:\Windows\System\kaMVrQB.exe
  2⤵
  PID:11872
- C:\Windows\System\eDruMbo.exe
  C:\Windows\System\eDruMbo.exe
  2⤵
  PID:12100
- C:\Windows\System\MHfrREi.exe
  C:\Windows\System\MHfrREi.exe
  2⤵
  PID:4740
- C:\Windows\System\ALqDYNN.exe
  C:\Windows\System\ALqDYNN.exe
  2⤵
  PID:11344
- C:\Windows\System\WjpUYpK.exe
  C:\Windows\System\WjpUYpK.exe
  2⤵
  PID:11584
- C:\Windows\System\pSJmnwJ.exe
  C:\Windows\System\pSJmnwJ.exe
  2⤵
  PID:11776
- C:\Windows\System\wkXhanc.exe
  C:\Windows\System\wkXhanc.exe
  2⤵
  PID:12048
- C:\Windows\System\LyqRkbv.exe
  C:\Windows\System\LyqRkbv.exe
  2⤵
  PID:12292
- C:\Windows\System\CXtlphL.exe
  C:\Windows\System\CXtlphL.exe
  2⤵
  PID:12332
- C:\Windows\System\DrJaXZf.exe
  C:\Windows\System\DrJaXZf.exe
  2⤵
  PID:12356
- C:\Windows\System\BlVsgVh.exe
  C:\Windows\System\BlVsgVh.exe
  2⤵
  PID:12376
- C:\Windows\System\dIEifiN.exe
  C:\Windows\System\dIEifiN.exe
  2⤵
  PID:12396
- C:\Windows\System\ImKKPAD.exe
  C:\Windows\System\ImKKPAD.exe
  2⤵
  PID:12412
- C:\Windows\System\ogFNGYv.exe
  C:\Windows\System\ogFNGYv.exe
  2⤵
  PID:12476
- C:\Windows\System\ilSszJy.exe
  C:\Windows\System\ilSszJy.exe
  2⤵
  PID:12532
- C:\Windows\System\dMZbDoz.exe
  C:\Windows\System\dMZbDoz.exe
  2⤵
  PID:12560
- C:\Windows\System\SzSOKQJ.exe
  C:\Windows\System\SzSOKQJ.exe
  2⤵
  PID:12584
- C:\Windows\System\rRTZJAO.exe
  C:\Windows\System\rRTZJAO.exe
  2⤵
  PID:12600
- C:\Windows\System\UWsimQh.exe
  C:\Windows\System\UWsimQh.exe
  2⤵
  PID:12644
- C:\Windows\System\lNSMzwC.exe
  C:\Windows\System\lNSMzwC.exe
  2⤵
  PID:12668
- C:\Windows\System\hscOTSt.exe
  C:\Windows\System\hscOTSt.exe
  2⤵
  PID:12688
- C:\Windows\System\FxyVKMQ.exe
  C:\Windows\System\FxyVKMQ.exe
  2⤵
  PID:12716
- C:\Windows\System\GbPbLUS.exe
  C:\Windows\System\GbPbLUS.exe
  2⤵
  PID:12736
- C:\Windows\System\McwCiDn.exe
  C:\Windows\System\McwCiDn.exe
  2⤵
  PID:12756
- C:\Windows\System\TBcIEHW.exe
  C:\Windows\System\TBcIEHW.exe
  2⤵
  PID:12800
- C:\Windows\System\SkpbvTJ.exe
  C:\Windows\System\SkpbvTJ.exe
  2⤵
  PID:12820
- C:\Windows\System\qWjGnEo.exe
  C:\Windows\System\qWjGnEo.exe
  2⤵
  PID:12876
- C:\Windows\System\GDunUwA.exe
  C:\Windows\System\GDunUwA.exe
  2⤵
  PID:12892
- C:\Windows\System\OCprEUu.exe
  C:\Windows\System\OCprEUu.exe
  2⤵
  PID:12908
- C:\Windows\System\KcVOmJW.exe
  C:\Windows\System\KcVOmJW.exe
  2⤵
  PID:12940
- C:\Windows\System\PEqJxIg.exe
  C:\Windows\System\PEqJxIg.exe
  2⤵
  PID:12960
- C:\Windows\System\glYJTnI.exe
  C:\Windows\System\glYJTnI.exe
  2⤵
  PID:12984
- C:\Windows\System\UYsxhiD.exe
  C:\Windows\System\UYsxhiD.exe
  2⤵
  PID:13048
- C:\Windows\System\urYVarm.exe
  C:\Windows\System\urYVarm.exe
  2⤵
  PID:13100
- C:\Windows\System\QvFVcHt.exe
  C:\Windows\System\QvFVcHt.exe
  2⤵
  PID:13120
- C:\Windows\System\XYksIaO.exe
  C:\Windows\System\XYksIaO.exe
  2⤵
  PID:13140
- C:\Windows\System\gaYVbNt.exe
  C:\Windows\System\gaYVbNt.exe
  2⤵
  PID:13156
- C:\Windows\System\WeMTYKT.exe
  C:\Windows\System\WeMTYKT.exe
  2⤵
  PID:13264
- C:\Windows\System\xbKtFel.exe
  C:\Windows\System\xbKtFel.exe
  2⤵
  PID:12596
- C:\Windows\System\zEJkAkd.exe
  C:\Windows\System\zEJkAkd.exe
  2⤵
  PID:12592
- C:\Windows\System\ggqOWqH.exe
  C:\Windows\System\ggqOWqH.exe
  2⤵
  PID:13040
- C:\Windows\System\CNshYdn.exe
  C:\Windows\System\CNshYdn.exe
  2⤵
  PID:12724
- C:\Windows\System\xnGjrtK.exe
  C:\Windows\System\xnGjrtK.exe
  2⤵
  PID:13060
- C:\Windows\System\gpMRFWT.exe
  C:\Windows\System\gpMRFWT.exe
  2⤵
  PID:13080
- C:\Windows\System\kvgjIon.exe
  C:\Windows\System\kvgjIon.exe
  2⤵
  PID:13108
- C:\Windows\System\QPOOwIX.exe
  C:\Windows\System\QPOOwIX.exe
  2⤵
  PID:13116
- C:\Windows\System\rbHdInN.exe
  C:\Windows\System\rbHdInN.exe
  2⤵
  PID:13196
- C:\Windows\System\FbLRVGW.exe
  C:\Windows\System\FbLRVGW.exe
  2⤵
  PID:13184
- C:\Windows\System\qJmHqxf.exe
  C:\Windows\System\qJmHqxf.exe
  2⤵
  PID:1884
- C:\Windows\System\KZzndjy.exe
  C:\Windows\System\KZzndjy.exe
  2⤵
  PID:3064
- C:\Windows\System\IoXDVRR.exe
  C:\Windows\System\IoXDVRR.exe
  2⤵
  PID:2080
- C:\Windows\System\YNojoLj.exe
  C:\Windows\System\YNojoLj.exe
  2⤵
  PID:1252
- C:\Windows\System\yIIfMpN.exe
  C:\Windows\System\yIIfMpN.exe
  2⤵
  PID:12408
- C:\Windows\System\AISWlNp.exe
  C:\Windows\System\AISWlNp.exe
  2⤵
  PID:12388
- C:\Windows\System\TgEjdqh.exe
  C:\Windows\System\TgEjdqh.exe
  2⤵
  PID:12552
- C:\Windows\System\GYKNQIW.exe
  C:\Windows\System\GYKNQIW.exe
  2⤵
  PID:4528
- C:\Windows\System\QJlfcJT.exe
  C:\Windows\System\QJlfcJT.exe
  2⤵
  PID:12776
- C:\Windows\System\HFhqLJG.exe
  C:\Windows\System\HFhqLJG.exe
  2⤵
  PID:12888
- C:\Windows\System\fZAHEcS.exe
  C:\Windows\System\fZAHEcS.exe
  2⤵
  PID:12732
- C:\Windows\System\tVUNyQZ.exe
  C:\Windows\System\tVUNyQZ.exe
  2⤵
  PID:13036
- C:\Windows\System\iDvMCGt.exe
  C:\Windows\System\iDvMCGt.exe
  2⤵
  PID:12936
- C:\Windows\System\fonMbzN.exe
  C:\Windows\System\fonMbzN.exe
  2⤵
  PID:4352
- C:\Windows\System\kKptlWk.exe
  C:\Windows\System\kKptlWk.exe
  2⤵
  PID:1212
- C:\Windows\System\PWmGkTd.exe
  C:\Windows\System\PWmGkTd.exe
  2⤵
  PID:12256
- C:\Windows\System\jEIqSnc.exe
  C:\Windows\System\jEIqSnc.exe
  2⤵
  PID:12640
- C:\Windows\System\jlPEpYy.exe
  C:\Windows\System\jlPEpYy.exe
  2⤵
  PID:12856
- C:\Windows\System\SjWHLKs.exe
  C:\Windows\System\SjWHLKs.exe
  2⤵
  PID:13016
- C:\Windows\System\ZasxYgu.exe
  C:\Windows\System\ZasxYgu.exe
  2⤵
  PID:7316
- C:\Windows\System\uSTkLCQ.exe
  C:\Windows\System\uSTkLCQ.exe
  2⤵
  PID:13300
- C:\Windows\System\LtfgbyA.exe
  C:\Windows\System\LtfgbyA.exe
  2⤵
  PID:13224
- C:\Windows\System\YESKGQh.exe
  C:\Windows\System\YESKGQh.exe
  2⤵
  PID:13212
- C:\Windows\System\SfLptZP.exe
  C:\Windows\System\SfLptZP.exe
  2⤵
  PID:5048
- C:\Windows\System\mrMrwHY.exe
  C:\Windows\System\mrMrwHY.exe
  2⤵
  PID:12932
- C:\Windows\System\FUEyKRJ.exe
  C:\Windows\System\FUEyKRJ.exe
  2⤵
  PID:12384
- C:\Windows\System\fSnvaQo.exe
  C:\Windows\System\fSnvaQo.exe
  2⤵
  PID:4032
- C:\Windows\System\hUBQkNu.exe
  C:\Windows\System\hUBQkNu.exe
  2⤵
  PID:948
- C:\Windows\System\FeWazei.exe
  C:\Windows\System\FeWazei.exe
  2⤵
  PID:8640
- C:\Windows\System\FLgDnEN.exe
  C:\Windows\System\FLgDnEN.exe
  2⤵
  PID:4460
- C:\Windows\System\FeknlXv.exe
  C:\Windows\System\FeknlXv.exe
  2⤵
  PID:4864
- C:\Windows\System\rYfUGwT.exe
  C:\Windows\System\rYfUGwT.exe
  2⤵
  PID:7580
- C:\Windows\System\AOYclOk.exe
  C:\Windows\System\AOYclOk.exe
  2⤵
  PID:7028
- C:\Windows\System\zoFWimZ.exe
  C:\Windows\System\zoFWimZ.exe
  2⤵
  PID:12300
- C:\Windows\System\kIOFMZV.exe
  C:\Windows\System\kIOFMZV.exe
  2⤵
  PID:7148
- C:\Windows\System\eMdHuji.exe
  C:\Windows\System\eMdHuji.exe
  2⤵
  PID:3536
- C:\Windows\System\mzdyksF.exe
  C:\Windows\System\mzdyksF.exe
  2⤵
  PID:8364
- C:\Windows\System\CXjsDiw.exe
  C:\Windows\System\CXjsDiw.exe
  2⤵
  PID:6976
- C:\Windows\System\MaIdvph.exe
  C:\Windows\System\MaIdvph.exe
  2⤵
  PID:6344
- C:\Windows\System\SJPMjzf.exe
  C:\Windows\System\SJPMjzf.exe
  2⤵
  PID:12500
- C:\Windows\System\GUjPENW.exe
  C:\Windows\System\GUjPENW.exe
  2⤵
  PID:12636
- C:\Windows\System\pmyKRpf.exe
  C:\Windows\System\pmyKRpf.exe
  2⤵
  PID:4628
- C:\Windows\System\VAdtdPH.exe
  C:\Windows\System\VAdtdPH.exe
  2⤵
  PID:2628
- C:\Windows\System\fQShMfW.exe
  C:\Windows\System\fQShMfW.exe
  2⤵
  PID:3160
- C:\Windows\System\eNDOfsn.exe
  C:\Windows\System\eNDOfsn.exe
  2⤵
  PID:3140
- C:\Windows\System\UKlpggU.exe
  C:\Windows\System\UKlpggU.exe
  2⤵
  PID:5252
- C:\Windows\System\UOQmSDT.exe
  C:\Windows\System\UOQmSDT.exe
  2⤵
  PID:13004
- C:\Windows\System\sYfYMqJ.exe
  C:\Windows\System\sYfYMqJ.exe
  2⤵
  PID:12956
- C:\Windows\System\jevqBLz.exe
  C:\Windows\System\jevqBLz.exe
  2⤵
  PID:5100
- C:\Windows\System\BMHJSQS.exe
  C:\Windows\System\BMHJSQS.exe
  2⤵
  PID:876
- C:\Windows\System\KsibwPi.exe
  C:\Windows\System\KsibwPi.exe
  2⤵
  PID:5564
- C:\Windows\System\JgYWQQz.exe
  C:\Windows\System\JgYWQQz.exe
  2⤵
  PID:7336
- C:\Windows\System\AtNkOiC.exe
  C:\Windows\System\AtNkOiC.exe
  2⤵
  PID:8360
- C:\Windows\System\udgurFC.exe
  C:\Windows\System\udgurFC.exe
  2⤵
  PID:4388
- C:\Windows\System\uFMZXtT.exe
  C:\Windows\System\uFMZXtT.exe
  2⤵
  PID:4780
- C:\Windows\System\GymsjrI.exe
  C:\Windows\System\GymsjrI.exe
  2⤵
  PID:6736
- C:\Windows\System\gRhgTPo.exe
  C:\Windows\System\gRhgTPo.exe
  2⤵
  PID:2028
- C:\Windows\System\TSVBPVF.exe
  C:\Windows\System\TSVBPVF.exe
  2⤵
  PID:5060
- C:\Windows\System\PHtkTIi.exe
  C:\Windows\System\PHtkTIi.exe
  2⤵
  PID:9968
- C:\Windows\System\TUpyGGz.exe
  C:\Windows\System\TUpyGGz.exe
  2⤵
  PID:12748
- C:\Windows\System\ZLXNMqe.exe
  C:\Windows\System\ZLXNMqe.exe
  2⤵
  PID:9676
- C:\Windows\System\Gsqpzao.exe
  C:\Windows\System\Gsqpzao.exe
  2⤵
  PID:9368
- C:\Windows\System\vWosVSu.exe
  C:\Windows\System\vWosVSu.exe
  2⤵
  PID:8600
- C:\Windows\System\lJTbOqx.exe
  C:\Windows\System\lJTbOqx.exe
  2⤵
  PID:7224
- C:\Windows\System\tyKUoeT.exe
  C:\Windows\System\tyKUoeT.exe
  2⤵
  PID:10412
- C:\Windows\System\TgibAWQ.exe
  C:\Windows\System\TgibAWQ.exe
  2⤵
  PID:10432
- C:\Windows\System\lepWzvE.exe
  C:\Windows\System\lepWzvE.exe
  2⤵
  PID:7400
- C:\Windows\System\mLCYQMl.exe
  C:\Windows\System\mLCYQMl.exe
  2⤵
  PID:12664
- C:\Windows\System\Kexshlr.exe
  C:\Windows\System\Kexshlr.exe
  2⤵
  PID:1364
- C:\Windows\System\pWupUta.exe
  C:\Windows\System\pWupUta.exe
  2⤵
  PID:10728
- C:\Windows\System\TmBCbLR.exe
  C:\Windows\System\TmBCbLR.exe
  2⤵
  PID:6232
- C:\Windows\System\yTcZBxe.exe
  C:\Windows\System\yTcZBxe.exe
  2⤵
  PID:13028
- C:\Windows\System\hZQPgeq.exe
  C:\Windows\System\hZQPgeq.exe
  2⤵
  PID:10796
- C:\Windows\System\duHpTSp.exe
  C:\Windows\System\duHpTSp.exe
  2⤵
  PID:10996
- C:\Windows\System\berBHpk.exe
  C:\Windows\System\berBHpk.exe
  2⤵
  PID:5204
- C:\Windows\System\OklDwto.exe
  C:\Windows\System\OklDwto.exe
  2⤵
  PID:8044
- C:\Windows\System\cdtJxPG.exe
  C:\Windows\System\cdtJxPG.exe
  2⤵
  PID:12868
- C:\Windows\System\CejAwhU.exe
  C:\Windows\System\CejAwhU.exe
  2⤵
  PID:2532
- C:\Windows\System\pFAKPkt.exe
  C:\Windows\System\pFAKPkt.exe
  2⤵
  PID:5860
- C:\Windows\System\wYSWeEs.exe
  C:\Windows\System\wYSWeEs.exe
  2⤵
  PID:11456
- C:\Windows\System\NspFGBd.exe
  C:\Windows\System\NspFGBd.exe
  2⤵
  PID:6012
- C:\Windows\System\oatoNou.exe
  C:\Windows\System\oatoNou.exe
  2⤵
  PID:6056
- C:\Windows\System\GoYFjTB.exe
  C:\Windows\System\GoYFjTB.exe
  2⤵
  PID:4536
- C:\Windows\System\eBmPpig.exe
  C:\Windows\System\eBmPpig.exe
  2⤵
  PID:2004
- C:\Windows\System\MkxamJT.exe
  C:\Windows\System\MkxamJT.exe
  2⤵
  PID:884
- C:\Windows\System\DaPEzHH.exe
  C:\Windows\System\DaPEzHH.exe
  2⤵
  PID:6692
- C:\Windows\System\VhwjcqT.exe
  C:\Windows\System\VhwjcqT.exe
  2⤵
  PID:1248
- C:\Windows\System\JhrnbGU.exe
  C:\Windows\System\JhrnbGU.exe
  2⤵
  PID:11348
- C:\Windows\System\MpMsuEx.exe
  C:\Windows\System\MpMsuEx.exe
  2⤵
  PID:11376
- C:\Windows\System\lUJACyH.exe
  C:\Windows\System\lUJACyH.exe
  2⤵
  PID:11508
- C:\Windows\System\kximYFs.exe
  C:\Windows\System\kximYFs.exe
  2⤵
  PID:5316
- C:\Windows\System\VPWfLfl.exe
  C:\Windows\System\VPWfLfl.exe
  2⤵
  PID:10248
- C:\Windows\System\umbLLgo.exe
  C:\Windows\System\umbLLgo.exe
  2⤵
  PID:8116
- C:\Windows\System\Fnrlwrs.exe
  C:\Windows\System\Fnrlwrs.exe
  2⤵
  PID:3080
- C:\Windows\System\wuFXgoB.exe
  C:\Windows\System\wuFXgoB.exe
  2⤵
  PID:4208
- C:\Windows\System\Smftqtj.exe
  C:\Windows\System\Smftqtj.exe
  2⤵
  PID:1456
- C:\Windows\System\AACYkuk.exe
  C:\Windows\System\AACYkuk.exe
  2⤵
  PID:10884
- C:\Windows\System\LdBWMuI.exe
  C:\Windows\System\LdBWMuI.exe
  2⤵
  PID:3920
- C:\Windows\System\axaHYkv.exe
  C:\Windows\System\axaHYkv.exe
  2⤵
  PID:3448
- C:\Windows\System\DmHUIAA.exe
  C:\Windows\System\DmHUIAA.exe
  2⤵
  PID:10920
- C:\Windows\System\znGnrxC.exe
  C:\Windows\System\znGnrxC.exe
  2⤵
  PID:1208
- C:\Windows\System\muulYZg.exe
  C:\Windows\System\muulYZg.exe
  2⤵
  PID:756
- C:\Windows\System\yiMMIal.exe
  C:\Windows\System\yiMMIal.exe
  2⤵
  PID:4620
- C:\Windows\System\JAznCDt.exe
  C:\Windows\System\JAznCDt.exe
  2⤵
  PID:12660
- C:\Windows\System\OGuOAWg.exe
  C:\Windows\System\OGuOAWg.exe
  2⤵
  PID:11288
- C:\Windows\System\LsFGupU.exe
  C:\Windows\System\LsFGupU.exe
  2⤵
  PID:7256
- C:\Windows\System\IPPXHvV.exe
  C:\Windows\System\IPPXHvV.exe
  2⤵
  PID:11324
- C:\Windows\System\EOXRfoL.exe
  C:\Windows\System\EOXRfoL.exe
  2⤵
  PID:8720
- C:\Windows\System\NpjZctF.exe
  C:\Windows\System\NpjZctF.exe
  2⤵
  PID:5748
- C:\Windows\System\ZViipbh.exe
  C:\Windows\System\ZViipbh.exe
  2⤵
  PID:12468
- C:\Windows\System\mGjmBeO.exe
  C:\Windows\System\mGjmBeO.exe
  2⤵
  PID:2068
- C:\Windows\System\UXtdVKM.exe
  C:\Windows\System\UXtdVKM.exe
  2⤵
  PID:12616
- C:\Windows\System\VidrhBa.exe
  C:\Windows\System\VidrhBa.exe
  2⤵
  PID:388
- C:\Windows\System\dNYgNTF.exe
  C:\Windows\System\dNYgNTF.exe
  2⤵
  PID:12632
- C:\Windows\System\mwkRNHA.exe
  C:\Windows\System\mwkRNHA.exe
  2⤵
  PID:3120
- C:\Windows\System\TCvNeiI.exe
  C:\Windows\System\TCvNeiI.exe
  2⤵
  PID:8736
- C:\Windows\System\SVHNbeL.exe
  C:\Windows\System\SVHNbeL.exe
  2⤵
  PID:7360
- C:\Windows\System\YhZUYHS.exe
  C:\Windows\System\YhZUYHS.exe
  2⤵
  PID:7548
- C:\Windows\System\xlizDYl.exe
  C:\Windows\System\xlizDYl.exe
  2⤵
  PID:2736
- C:\Windows\System\bqYhtIv.exe
  C:\Windows\System\bqYhtIv.exe
  2⤵
  PID:1780
- C:\Windows\System\VyVCaky.exe
  C:\Windows\System\VyVCaky.exe
  2⤵
  PID:3476
- C:\Windows\System\OxjXUAZ.exe
  C:\Windows\System\OxjXUAZ.exe
  2⤵
  PID:5536
- C:\Windows\System\cwpVYmB.exe
  C:\Windows\System\cwpVYmB.exe
  2⤵
  PID:1948
- C:\Windows\System\YZghPRQ.exe
  C:\Windows\System\YZghPRQ.exe
  2⤵
  PID:10988
- C:\Windows\System\mhkLzyv.exe
  C:\Windows\System\mhkLzyv.exe
  2⤵
  PID:5936
- C:\Windows\System\mYUUaPY.exe
  C:\Windows\System\mYUUaPY.exe
  2⤵
  PID:6112
- C:\Windows\System\KJBxRqq.exe
  C:\Windows\System\KJBxRqq.exe
  2⤵
  PID:2508
- C:\Windows\System\GceXWGk.exe
  C:\Windows\System\GceXWGk.exe
  2⤵
  PID:7612
- C:\Windows\System\GIuvaMx.exe
  C:\Windows\System\GIuvaMx.exe
  2⤵
  PID:1100
- C:\Windows\System\AgJHuZF.exe
  C:\Windows\System\AgJHuZF.exe
  2⤵
  PID:5340
- C:\Windows\System\mpDQXfS.exe
  C:\Windows\System\mpDQXfS.exe
  2⤵
  PID:5300
- C:\Windows\System\YqYigfk.exe
  C:\Windows\System\YqYigfk.exe
  2⤵
  PID:10260
- C:\Windows\System\ZQFhcQy.exe
  C:\Windows\System\ZQFhcQy.exe
  2⤵
  PID:11844
- C:\Windows\System\zwSdFAB.exe
  C:\Windows\System\zwSdFAB.exe
  2⤵
  PID:12028
- C:\Windows\System\tjQZNVf.exe
  C:\Windows\System\tjQZNVf.exe
  2⤵
  PID:9600
- C:\Windows\System\wokrInl.exe
  C:\Windows\System\wokrInl.exe
  2⤵
  PID:3768
- C:\Windows\System\kDnKhxD.exe
  C:\Windows\System\kDnKhxD.exe
  2⤵
  PID:6952
- C:\Windows\System\srnBxRl.exe
  C:\Windows\System\srnBxRl.exe
  2⤵
  PID:6616
- C:\Windows\System\XuBGbCV.exe
  C:\Windows\System\XuBGbCV.exe
  2⤵
  PID:6440
- C:\Windows\System\bhBfpiI.exe
  C:\Windows\System\bhBfpiI.exe
  2⤵
  PID:5648
- C:\Windows\System\dHbsrrz.exe
  C:\Windows\System\dHbsrrz.exe
  2⤵
  PID:13168
- C:\Windows\System\JGsQQqN.exe
  C:\Windows\System\JGsQQqN.exe
  2⤵
  PID:10672
- C:\Windows\System\VOPmcVu.exe
  C:\Windows\System\VOPmcVu.exe
  2⤵
  PID:13292
- C:\Windows\System\GnbFKNj.exe
  C:\Windows\System\GnbFKNj.exe
  2⤵
  PID:6360
- C:\Windows\System\wdgkkph.exe
  C:\Windows\System\wdgkkph.exe
  2⤵
  PID:12316
- C:\Windows\System\zQlOhdC.exe
  C:\Windows\System\zQlOhdC.exe
  2⤵
  PID:1300
- C:\Windows\System\VZzbxaY.exe
  C:\Windows\System\VZzbxaY.exe
  2⤵
  PID:11924
- C:\Windows\System\mpOnHIR.exe
  C:\Windows\System\mpOnHIR.exe
  2⤵
  PID:776
- C:\Windows\System\oeieCLo.exe
  C:\Windows\System\oeieCLo.exe
  2⤵
  PID:5088
- C:\Windows\System\zseDGrB.exe
  C:\Windows\System\zseDGrB.exe
  2⤵
  PID:4220
- C:\Windows\System\eiKoZUG.exe
  C:\Windows\System\eiKoZUG.exe
  2⤵
  PID:5984
- C:\Windows\System\DWozQbf.exe
  C:\Windows\System\DWozQbf.exe
  2⤵
  PID:12620
- C:\Windows\System\GDYxITy.exe
  C:\Windows\System\GDYxITy.exe
  2⤵
  PID:3284
- C:\Windows\System\knVlKuc.exe
  C:\Windows\System\knVlKuc.exe
  2⤵
  PID:4980
- C:\Windows\System\Ebbkpji.exe
  C:\Windows\System\Ebbkpji.exe
  2⤵
  PID:13304
- C:\Windows\System\UDwVvIU.exe
  C:\Windows\System\UDwVvIU.exe
  2⤵
  PID:456
- C:\Windows\System\toddYhX.exe
  C:\Windows\System\toddYhX.exe
  2⤵
  PID:5448
- C:\Windows\System\HHjhOrC.exe
  C:\Windows\System\HHjhOrC.exe
  2⤵
  PID:6508
- C:\Windows\System\AJPouXY.exe
  C:\Windows\System\AJPouXY.exe
  2⤵
  PID:7728
- C:\Windows\System\jGXuOCP.exe
  C:\Windows\System\jGXuOCP.exe
  2⤵
  PID:7048
- C:\Windows\System\OJyrqHh.exe
  C:\Windows\System\OJyrqHh.exe
  2⤵
  PID:6704
- C:\Windows\System\pBMetPk.exe
  C:\Windows\System\pBMetPk.exe
  2⤵
  PID:6168
- C:\Windows\System\rNgOVkm.exe
  C:\Windows\System\rNgOVkm.exe
  2⤵
  PID:7260
- C:\Windows\System\nzySHNO.exe
  C:\Windows\System\nzySHNO.exe
  2⤵
  PID:5792
- C:\Windows\System\oCfuSAc.exe
  C:\Windows\System\oCfuSAc.exe
  2⤵
  PID:5764
- C:\Windows\System\EkgjUmf.exe
  C:\Windows\System\EkgjUmf.exe
  2⤵
  PID:8104
- C:\Windows\System\VDqLuLb.exe
  C:\Windows\System\VDqLuLb.exe
  2⤵
  PID:7136
- C:\Windows\System\FBmzFOD.exe
  C:\Windows\System\FBmzFOD.exe
  2⤵
  PID:7688
- C:\Windows\System\TsoyCWH.exe
  C:\Windows\System\TsoyCWH.exe
  2⤵
  PID:5980
- C:\Windows\System\RkDwQhx.exe
  C:\Windows\System\RkDwQhx.exe
  2⤵
  PID:7088
- C:\Windows\System\cNkXsWX.exe
  C:\Windows\System\cNkXsWX.exe
  2⤵
  PID:5736
- C:\Windows\System\vnpzwqA.exe
  C:\Windows\System\vnpzwqA.exe
  2⤵
  PID:7956
- C:\Windows\System\wgUjauG.exe
  C:\Windows\System\wgUjauG.exe
  2⤵
  PID:6064
- C:\Windows\System\SFgEqjN.exe
  C:\Windows\System\SFgEqjN.exe
  2⤵
  PID:5832
- C:\Windows\System\PwlOVul.exe
  C:\Windows\System\PwlOVul.exe
  2⤵
  PID:2884
- C:\Windows\System\qZlaOlY.exe
  C:\Windows\System\qZlaOlY.exe
  2⤵
  PID:11440
- C:\Windows\System\vqpAfwK.exe
  C:\Windows\System\vqpAfwK.exe
  2⤵
  PID:3672
- C:\Windows\System\dudspaU.exe
  C:\Windows\System\dudspaU.exe
  2⤵
  PID:6672
- C:\Windows\System\UAfQKtC.exe
  C:\Windows\System\UAfQKtC.exe
  2⤵
  PID:5528
- C:\Windows\System\yjAqerx.exe
  C:\Windows\System\yjAqerx.exe
  2⤵
  PID:8608
- C:\Windows\System\HrVpBfH.exe
  C:\Windows\System\HrVpBfH.exe
  2⤵
  PID:9644
- C:\Windows\System\sUfzsZF.exe
  C:\Windows\System\sUfzsZF.exe
  2⤵
  PID:9496
- C:\Windows\System\GKyiqKs.exe
  C:\Windows\System\GKyiqKs.exe
  2⤵
  PID:8348
- C:\Windows\System\mTSCkeP.exe
  C:\Windows\System\mTSCkeP.exe
  2⤵
  PID:13084
- C:\Windows\System\LNFgzsL.exe
  C:\Windows\System\LNFgzsL.exe
  2⤵
  PID:13180
- C:\Windows\System\mkiuYNa.exe
  C:\Windows\System\mkiuYNa.exe
  2⤵
  PID:7912
- C:\Windows\System\UWrqNNU.exe
  C:\Windows\System\UWrqNNU.exe
  2⤵
  PID:1152
- C:\Windows\System\HJwKVvW.exe
  C:\Windows\System\HJwKVvW.exe
  2⤵
  PID:8056
- C:\Windows\System\FqeYTCn.exe
  C:\Windows\System\FqeYTCn.exe
  2⤵
  PID:7808
- C:\Windows\System\pDMuGUQ.exe
  C:\Windows\System\pDMuGUQ.exe
  2⤵
  PID:7464
- C:\Windows\System\QvzsjdN.exe
  C:\Windows\System\QvzsjdN.exe
  2⤵
  PID:4020
- C:\Windows\System\CWfccty.exe
  C:\Windows\System\CWfccty.exe
  2⤵
  PID:5244
- C:\Windows\System\zjOVHWs.exe
  C:\Windows\System\zjOVHWs.exe
  2⤵
  PID:4568
- C:\Windows\System\QaZXXDl.exe
  C:\Windows\System\QaZXXDl.exe
  2⤵
  PID:6560
- C:\Windows\System\qlpSpkd.exe
  C:\Windows\System\qlpSpkd.exe
  2⤵
  PID:4356
- C:\Windows\System\KEadWuv.exe
  C:\Windows\System\KEadWuv.exe
  2⤵
  PID:5500
- C:\Windows\System\FDqCtAP.exe
  C:\Windows\System\FDqCtAP.exe
  2⤵
  PID:7680
- C:\Windows\System\aumBxmY.exe
  C:\Windows\System\aumBxmY.exe
  2⤵
  PID:6732
- C:\Windows\System\tgXSeqq.exe
  C:\Windows\System\tgXSeqq.exe
  2⤵
  PID:4188
- C:\Windows\System\LfmGwdU.exe
  C:\Windows\System\LfmGwdU.exe
  2⤵
  PID:7460
- C:\Windows\System\NHehqvJ.exe
  C:\Windows\System\NHehqvJ.exe
  2⤵
  PID:7432
- C:\Windows\System\HCHKQSA.exe
  C:\Windows\System\HCHKQSA.exe
  2⤵
  PID:3436
- C:\Windows\System\tqBXSVq.exe
  C:\Windows\System\tqBXSVq.exe
  2⤵
  PID:8936
- C:\Windows\System\ErXcmKS.exe
  C:\Windows\System\ErXcmKS.exe
  2⤵
  PID:10300
- C:\Windows\System\vCRyCkI.exe
  C:\Windows\System\vCRyCkI.exe
  2⤵
  PID:8788
- C:\Windows\System\uVVCrcH.exe
  C:\Windows\System\uVVCrcH.exe
  2⤵
  PID:7652
- C:\Windows\System\XYpNzrK.exe
  C:\Windows\System\XYpNzrK.exe
  2⤵
  PID:5720
- C:\Windows\System\ZFzWJHQ.exe
  C:\Windows\System\ZFzWJHQ.exe
  2⤵
  PID:12508
- C:\Windows\System\rlYsDBk.exe
  C:\Windows\System\rlYsDBk.exe
  2⤵
  PID:9172
- C:\Windows\System\uesrDCv.exe
  C:\Windows\System\uesrDCv.exe
  2⤵
  PID:8864
- C:\Windows\System\MUWdypw.exe
  C:\Windows\System\MUWdypw.exe
  2⤵
  PID:9076
- C:\Windows\System\UgXQEXl.exe
  C:\Windows\System\UgXQEXl.exe
  2⤵
  PID:8580
- C:\Windows\System\jnQwSIo.exe
  C:\Windows\System\jnQwSIo.exe
  2⤵
  PID:8652
- C:\Windows\System\MTyYzcw.exe
  C:\Windows\System\MTyYzcw.exe
  2⤵
  PID:8704
- C:\Windows\System\koJhDoe.exe
  C:\Windows\System\koJhDoe.exe
  2⤵
  PID:6908
- C:\Windows\System\TQjslul.exe
  C:\Windows\System\TQjslul.exe
  2⤵
  PID:7552
- C:\Windows\System\AgyxbES.exe
  C:\Windows\System\AgyxbES.exe
  2⤵
  PID:4332
- C:\Windows\System\xagxjkg.exe
  C:\Windows\System\xagxjkg.exe
  2⤵
  PID:9284
- C:\Windows\System\ipOZnEi.exe
  C:\Windows\System\ipOZnEi.exe
  2⤵
  PID:6472
- C:\Windows\System\XjwDVHn.exe
  C:\Windows\System\XjwDVHn.exe
  2⤵
  PID:5272
- C:\Windows\System\afiTQBl.exe
  C:\Windows\System\afiTQBl.exe
  2⤵
  PID:8504
- C:\Windows\System\lDREjwr.exe
  C:\Windows\System\lDREjwr.exe
  2⤵
  PID:6096
- C:\Windows\System\QQuNbZG.exe
  C:\Windows\System\QQuNbZG.exe
  2⤵
  PID:9852
- C:\Windows\System\NMvCcgU.exe
  C:\Windows\System\NMvCcgU.exe
  2⤵
  PID:6592
- C:\Windows\System\DOtGLMj.exe
  C:\Windows\System\DOtGLMj.exe
  2⤵
  PID:6160
- C:\Windows\System\fCSlqNb.exe
  C:\Windows\System\fCSlqNb.exe
  2⤵
  PID:448
- C:\Windows\System\nkGCFJN.exe
  C:\Windows\System\nkGCFJN.exe
  2⤵
  PID:10752
- C:\Windows\System\HICVNkr.exe
  C:\Windows\System\HICVNkr.exe
  2⤵
  PID:9668
- C:\Windows\System\hqWSdmy.exe
  C:\Windows\System\hqWSdmy.exe
  2⤵
  PID:7052
- C:\Windows\System\BuUKTNr.exe
  C:\Windows\System\BuUKTNr.exe
  2⤵
  PID:9612
- C:\Windows\System\BSeYHui.exe
  C:\Windows\System\BSeYHui.exe
  2⤵
  PID:9272
- C:\Windows\System\eRVGnFG.exe
  C:\Windows\System\eRVGnFG.exe
  2⤵
  PID:5400
- C:\Windows\System\TvEOead.exe
  C:\Windows\System\TvEOead.exe
  2⤵
  PID:9828
- C:\Windows\System\ohsMhBj.exe
  C:\Windows\System\ohsMhBj.exe
  2⤵
  PID:9736
- C:\Windows\System\LCgvfYW.exe
  C:\Windows\System\LCgvfYW.exe
  2⤵
  PID:9692
- C:\Windows\System\umxNfuV.exe
  C:\Windows\System\umxNfuV.exe
  2⤵
  PID:8100
- C:\Windows\System\qLANaNL.exe
  C:\Windows\System\qLANaNL.exe
  2⤵
  PID:932
- C:\Windows\System\wEXgNUd.exe
  C:\Windows\System\wEXgNUd.exe
  2⤵
  PID:5692
- C:\Windows\System\SIChpEC.exe
  C:\Windows\System\SIChpEC.exe
  2⤵
  PID:10064
- C:\Windows\System\ZIEmrZY.exe
  C:\Windows\System\ZIEmrZY.exe
  2⤵
  PID:9924
- C:\Windows\System\REHXQCc.exe
  C:\Windows\System\REHXQCc.exe
  2⤵
  PID:5444
- C:\Windows\System\HiESkui.exe
  C:\Windows\System\HiESkui.exe
  2⤵
  PID:7496
- C:\Windows\System\sqvxVzy.exe
  C:\Windows\System\sqvxVzy.exe
  2⤵
  PID:9224
- C:\Windows\System\kXZhgRc.exe
  C:\Windows\System\kXZhgRc.exe
  2⤵
  PID:10060
- C:\Windows\System\wXfmjNH.exe
  C:\Windows\System\wXfmjNH.exe
  2⤵
  PID:9992
- C:\Windows\System\IKITssF.exe
  C:\Windows\System\IKITssF.exe
  2⤵
  PID:8008
- C:\Windows\System\RgTEkay.exe
  C:\Windows\System\RgTEkay.exe
  2⤵
  PID:6944
- C:\Windows\System\gXcOVJf.exe
  C:\Windows\System\gXcOVJf.exe
  2⤵
  PID:10188
- C:\Windows\System\wTFkokw.exe
  C:\Windows\System\wTFkokw.exe
  2⤵
  PID:10000
- C:\Windows\System\BktiHwl.exe
  C:\Windows\System\BktiHwl.exe
  2⤵
  PID:6020
- C:\Windows\System\KNRSidD.exe
  C:\Windows\System\KNRSidD.exe
  2⤵
  PID:6696
- C:\Windows\System\KxjXjFR.exe
  C:\Windows\System\KxjXjFR.exe
  2⤵
  PID:11320
- C:\Windows\System\hVuHPiS.exe
  C:\Windows\System\hVuHPiS.exe
  2⤵
  PID:8880
- C:\Windows\System\biSwTqs.exe
  C:\Windows\System\biSwTqs.exe
  2⤵
  PID:9628
- C:\Windows\System\VyIuzrl.exe
  C:\Windows\System\VyIuzrl.exe
  2⤵
  PID:3928
- C:\Windows\System\TrEcYQi.exe
  C:\Windows\System\TrEcYQi.exe
  2⤵
  PID:7704
- C:\Windows\System\fpdJagW.exe
  C:\Windows\System\fpdJagW.exe
  2⤵
  PID:4476
- C:\Windows\System\ofEeyYY.exe
  C:\Windows\System\ofEeyYY.exe
  2⤵
  PID:7564
- C:\Windows\System\ZobUJXA.exe
  C:\Windows\System\ZobUJXA.exe
  2⤵
  PID:8772
- C:\Windows\System\IMAKyaa.exe
  C:\Windows\System\IMAKyaa.exe
  2⤵
  PID:10020
- C:\Windows\System\MvoObTO.exe
  C:\Windows\System\MvoObTO.exe
  2⤵
  PID:3960
- C:\Windows\System\GBPTIbZ.exe
  C:\Windows\System\GBPTIbZ.exe
  2⤵
  PID:12524
- C:\Windows\System\skXnfMW.exe
  C:\Windows\System\skXnfMW.exe
  2⤵
  PID:3624
- C:\Windows\System\nDocSKy.exe
  C:\Windows\System\nDocSKy.exe
  2⤵
  PID:9516
- C:\Windows\System\qBMGtAm.exe
  C:\Windows\System\qBMGtAm.exe
  2⤵
  PID:8024
- C:\Windows\System\gDDEcai.exe
  C:\Windows\System\gDDEcai.exe
  2⤵
  PID:12124
- C:\Windows\System\lmjUWbD.exe
  C:\Windows\System\lmjUWbD.exe
  2⤵
  PID:10160
- C:\Windows\System\uDjNusU.exe
  C:\Windows\System\uDjNusU.exe
  2⤵
  PID:8268
- C:\Windows\System\iDWYUqr.exe
  C:\Windows\System\iDWYUqr.exe
  2⤵
  PID:9616
- C:\Windows\System\KPawgNO.exe
  C:\Windows\System\KPawgNO.exe
  2⤵
  PID:12808
- C:\Windows\System\ADwWFSG.exe
  C:\Windows\System\ADwWFSG.exe
  2⤵
  PID:7744
- C:\Windows\System\QCvDxCh.exe
  C:\Windows\System\QCvDxCh.exe
  2⤵
  PID:9320
- C:\Windows\System\cNGjliv.exe
  C:\Windows\System\cNGjliv.exe
  2⤵
  PID:10688
- C:\Windows\System\MNrxUSq.exe
  C:\Windows\System\MNrxUSq.exe
  2⤵
  PID:8380
- C:\Windows\System\PvOsFTU.exe
  C:\Windows\System\PvOsFTU.exe
  2⤵
  PID:9264
- C:\Windows\System\UvqhgeM.exe
  C:\Windows\System\UvqhgeM.exe
  2⤵
  PID:9036
- C:\Windows\System\SDZMXTD.exe
  C:\Windows\System\SDZMXTD.exe
  2⤵
  PID:7392
- C:\Windows\System\seYrnga.exe
  C:\Windows\System\seYrnga.exe
  2⤵
  PID:10292
- C:\Windows\System\LLKPGKK.exe
  C:\Windows\System\LLKPGKK.exe
  2⤵
  PID:8928
- C:\Windows\System\wTQPCCt.exe
  C:\Windows\System\wTQPCCt.exe
  2⤵
  PID:13332
- C:\Windows\System\zBcnGka.exe
  C:\Windows\System\zBcnGka.exe
  2⤵
  PID:13360
- C:\Windows\System\veKQvYD.exe
  C:\Windows\System\veKQvYD.exe
  2⤵
  PID:13388
- C:\Windows\System\NvdGBow.exe
  C:\Windows\System\NvdGBow.exe
  2⤵
  PID:13416
- C:\Windows\System\BgnQgXT.exe
  C:\Windows\System\BgnQgXT.exe
  2⤵
  PID:13444
- C:\Windows\System\acLWuMi.exe
  C:\Windows\System\acLWuMi.exe
  2⤵
  PID:13468
- C:\Windows\System\lOZEGXz.exe
  C:\Windows\System\lOZEGXz.exe
  2⤵
  PID:13488
- C:\Windows\System\XdhCyPB.exe
  C:\Windows\System\XdhCyPB.exe
  2⤵
  PID:13752
- C:\Windows\System\PrxzRiq.exe
  C:\Windows\System\PrxzRiq.exe
  2⤵
  PID:13776
- C:\Windows\System\DRcOiBS.exe
  C:\Windows\System\DRcOiBS.exe
  2⤵
  PID:13800
- C:\Windows\System\qdWhWRd.exe
  C:\Windows\System\qdWhWRd.exe
  2⤵
  PID:13828
- C:\Windows\System\AQWkhel.exe
  C:\Windows\System\AQWkhel.exe
  2⤵
  PID:14048
- C:\Windows\System\TfbgItR.exe
  C:\Windows\System\TfbgItR.exe
  2⤵
  PID:14076
- C:\Windows\System\jzLYTvt.exe
  C:\Windows\System\jzLYTvt.exe
  2⤵
  PID:14092
- C:\Windows\System\xrlVKcq.exe
  C:\Windows\System\xrlVKcq.exe
  2⤵
  PID:14112
- C:\Windows\System\AfDNCer.exe
  C:\Windows\System\AfDNCer.exe
  2⤵
  PID:14132
- C:\Windows\System\lVbrMbB.exe
  C:\Windows\System\lVbrMbB.exe
  2⤵
  PID:14180
- C:\Windows\System\GtHqIIB.exe
  C:\Windows\System\GtHqIIB.exe
  2⤵
  PID:14216
- C:\Windows\System\sDLtRKd.exe
  C:\Windows\System\sDLtRKd.exe
  2⤵
  PID:14236
- C:\Windows\System\fEPOlhl.exe
  C:\Windows\System\fEPOlhl.exe
  2⤵
  PID:14272
- C:\Windows\System\HrVGYGs.exe
  C:\Windows\System\HrVGYGs.exe
  2⤵
  PID:14300
- C:\Windows\System\CujYBqg.exe
  C:\Windows\System\CujYBqg.exe
  2⤵
  PID:14324
- C:\Windows\System\aCWUlqr.exe
  C:\Windows\System\aCWUlqr.exe
  2⤵
  PID:3548
- C:\Windows\System\ZmrMWbl.exe
  C:\Windows\System\ZmrMWbl.exe
  2⤵
  PID:10460
- C:\Windows\System\kYdNAXQ.exe
  C:\Windows\System\kYdNAXQ.exe
  2⤵
  PID:10172
- C:\Windows\System\NRhnflh.exe
  C:\Windows\System\NRhnflh.exe
  2⤵
  PID:9748
- C:\Windows\System\KPJNSej.exe
  C:\Windows\System\KPJNSej.exe
  2⤵
  PID:1052
- C:\Windows\System\JxqXnfj.exe
  C:\Windows\System\JxqXnfj.exe
  2⤵
  PID:9732
- C:\Windows\System\ZNyUMxB.exe
  C:\Windows\System\ZNyUMxB.exe
  2⤵
  PID:9248
- C:\Windows\System\anbgDFS.exe
  C:\Windows\System\anbgDFS.exe
  2⤵
  PID:8048
- C:\Windows\System\XbCaRrr.exe
  C:\Windows\System\XbCaRrr.exe
  2⤵
  PID:10684
- C:\Windows\System\jZRWrVn.exe
  C:\Windows\System\jZRWrVn.exe
  2⤵
  PID:11080
- C:\Windows\System\bWRrJKH.exe
  C:\Windows\System\bWRrJKH.exe
  2⤵
  PID:10456
- C:\Windows\System\dXoXGUj.exe
  C:\Windows\System\dXoXGUj.exe
  2⤵
  PID:10740
- C:\Windows\System\uVHjidY.exe
  C:\Windows\System\uVHjidY.exe
  2⤵
  PID:11204
- C:\Windows\System\RRaQWoD.exe
  C:\Windows\System\RRaQWoD.exe
  2⤵
  PID:11124
- C:\Windows\System\wYCuvvx.exe
  C:\Windows\System\wYCuvvx.exe
  2⤵
  PID:8096
- C:\Windows\System\yMMYNrV.exe
  C:\Windows\System\yMMYNrV.exe
  2⤵
  PID:8244
- C:\Windows\System\sozWhZn.exe
  C:\Windows\System\sozWhZn.exe
  2⤵
  PID:10932
- C:\Windows\System\ljmRlhf.exe
  C:\Windows\System\ljmRlhf.exe
  2⤵
  PID:5332
- C:\Windows\System\SxehvFR.exe
  C:\Windows\System\SxehvFR.exe
  2⤵
  PID:13368
- C:\Windows\System\ORlhNTy.exe
  C:\Windows\System\ORlhNTy.exe
  2⤵
  PID:10224
- C:\Windows\System\sIYevkE.exe
  C:\Windows\System\sIYevkE.exe
  2⤵
  PID:3220
- C:\Windows\System\glCxwJI.exe
  C:\Windows\System\glCxwJI.exe
  2⤵
  PID:8448
- C:\Windows\System\cbPfYrI.exe
  C:\Windows\System\cbPfYrI.exe
  2⤵
  PID:11120
- C:\Windows\System\lRsPttk.exe
  C:\Windows\System\lRsPttk.exe
  2⤵
  PID:11224
- C:\Windows\System\WfMWQAN.exe
  C:\Windows\System\WfMWQAN.exe
  2⤵
  PID:9432
- C:\Windows\System\brwYSWl.exe
  C:\Windows\System\brwYSWl.exe
  2⤵
  PID:3852
- C:\Windows\System\BIZUPZt.exe
  C:\Windows\System\BIZUPZt.exe
  2⤵
  PID:10400
- C:\Windows\System\jOKYmGW.exe
  C:\Windows\System\jOKYmGW.exe
  2⤵
  PID:8292
- C:\Windows\System\PNNZUZc.exe
  C:\Windows\System\PNNZUZc.exe
  2⤵
  PID:13316
- C:\Windows\System\dWqTKeB.exe
  C:\Windows\System\dWqTKeB.exe
  2⤵
  PID:13400
- C:\Windows\System\zKTCnnQ.exe
  C:\Windows\System\zKTCnnQ.exe
  2⤵
  PID:13668
- C:\Windows\System\agGkMCO.exe
  C:\Windows\System\agGkMCO.exe
  2⤵
  PID:10468
- C:\Windows\System\lwTNDPL.exe
  C:\Windows\System\lwTNDPL.exe
  2⤵
  PID:13428
- C:\Windows\System\wBwCVNE.exe
  C:\Windows\System\wBwCVNE.exe
  2⤵
  PID:13480
- C:\Windows\System\cAJuDEH.exe
  C:\Windows\System\cAJuDEH.exe
  2⤵
  PID:6824
- C:\Windows\System\cLlWJPZ.exe
  C:\Windows\System\cLlWJPZ.exe
  2⤵
  PID:11476
- C:\Windows\System\HARpAth.exe
  C:\Windows\System\HARpAth.exe
  2⤵
  PID:9512
- C:\Windows\System\uakxzFp.exe
  C:\Windows\System\uakxzFp.exe
  2⤵
  PID:10524
- C:\Windows\System\jgVhuCQ.exe
  C:\Windows\System\jgVhuCQ.exe
  2⤵
  PID:7928
- C:\Windows\System\bnMabAn.exe
  C:\Windows\System\bnMabAn.exe
  2⤵
  PID:12276
- C:\Windows\System\OQSzxCJ.exe
  C:\Windows\System\OQSzxCJ.exe
  2⤵
  PID:11284
- C:\Windows\System\ACwhCEs.exe
  C:\Windows\System\ACwhCEs.exe
  2⤵
  PID:10816
- C:\Windows\System\Gvjnpgt.exe
  C:\Windows\System\Gvjnpgt.exe
  2⤵
  PID:13424
- C:\Windows\System\SFKgnBM.exe
  C:\Windows\System\SFKgnBM.exe
  2⤵
  PID:13732
- C:\Windows\System\aPLcVDH.exe
  C:\Windows\System\aPLcVDH.exe
  2⤵
  PID:13744
- C:\Windows\System\xdLgrKt.exe
  C:\Windows\System\xdLgrKt.exe
  2⤵
  PID:13772
- C:\Windows\System\fwfPEcd.exe
  C:\Windows\System\fwfPEcd.exe
  2⤵
  PID:13816
- C:\Windows\System\MeSwelX.exe
  C:\Windows\System\MeSwelX.exe
  2⤵
  PID:13552
- C:\Windows\System\wMMLPuZ.exe
  C:\Windows\System\wMMLPuZ.exe
  2⤵
  PID:13580
- C:\Windows\System\JSBWCtC.exe
  C:\Windows\System\JSBWCtC.exe
  2⤵
  PID:14196
- C:\Windows\System\WLlGpSo.exe
  C:\Windows\System\WLlGpSo.exe
  2⤵
  PID:14312
- C:\Windows\System\miPGDuj.exe
  C:\Windows\System\miPGDuj.exe
  2⤵
  PID:11668
- C:\Windows\System\jgziRRi.exe
  C:\Windows\System\jgziRRi.exe
  2⤵
  PID:13924
- C:\Windows\System\ipFzvNU.exe
  C:\Windows\System\ipFzvNU.exe
  2⤵
  PID:13944
- C:\Windows\System\ZWQvBpi.exe
  C:\Windows\System\ZWQvBpi.exe
  2⤵
  PID:10736
- C:\Windows\System\yZvgEmE.exe
  C:\Windows\System\yZvgEmE.exe
  2⤵
  PID:13968
- C:\Windows\System\VyCvLvP.exe
  C:\Windows\System\VyCvLvP.exe
  2⤵
  PID:10288
- C:\Windows\System\ubnpJir.exe
  C:\Windows\System\ubnpJir.exe
  2⤵
  PID:8184
- C:\Windows\System\BjOVdfg.exe
  C:\Windows\System\BjOVdfg.exe
  2⤵
  PID:1764
- C:\Windows\System\wFztvOA.exe
  C:\Windows\System\wFztvOA.exe
  2⤵
  PID:13328
- C:\Windows\System\ZlAoojv.exe
  C:\Windows\System\ZlAoojv.exe
  2⤵
  PID:14040
- C:\Windows\System\oHYZScd.exe
  C:\Windows\System\oHYZScd.exe
  2⤵
  PID:13868
- C:\Windows\System\gfxOWDS.exe
  C:\Windows\System\gfxOWDS.exe
  2⤵
  PID:14120
- C:\Windows\System\HKzFfGZ.exe
  C:\Windows\System\HKzFfGZ.exe
  2⤵
  PID:14144
- C:\Windows\System\mKRLSwz.exe
  C:\Windows\System\mKRLSwz.exe
  2⤵
  PID:12064
- C:\Windows\System\LTVuRnj.exe
  C:\Windows\System\LTVuRnj.exe
  2⤵
  PID:12172
- C:\Windows\System\IsYQktj.exe
  C:\Windows\System\IsYQktj.exe
  2⤵
  PID:11572
- C:\Windows\System\toAqTkb.exe
  C:\Windows\System\toAqTkb.exe
  2⤵
  PID:12176
- C:\Windows\System\CEYmUYN.exe
  C:\Windows\System\CEYmUYN.exe
  2⤵
  PID:11228
- C:\Windows\System\fRnPcln.exe
  C:\Windows\System\fRnPcln.exe
  2⤵
  PID:14284
- C:\Windows\System\BmryQpE.exe
  C:\Windows\System\BmryQpE.exe
  2⤵
  PID:9812
- C:\Windows\System\hcFoDMm.exe
  C:\Windows\System\hcFoDMm.exe
  2⤵
  PID:10552
- C:\Windows\System\ZaNFvaP.exe
  C:\Windows\System\ZaNFvaP.exe
  2⤵
  PID:11852
- C:\Windows\System\nlvzIOu.exe
  C:\Windows\System\nlvzIOu.exe
  2⤵
  PID:13920
- C:\Windows\System\IvXSEqH.exe
  C:\Windows\System\IvXSEqH.exe
  2⤵
  PID:10580
- C:\Windows\System\JWgGhVw.exe
  C:\Windows\System\JWgGhVw.exe
  2⤵
  PID:13948
- C:\Windows\System\LOefElj.exe
  C:\Windows\System\LOefElj.exe
  2⤵
  PID:13976
- C:\Windows\System\uSUnhey.exe
  C:\Windows\System\uSUnhey.exe
  2⤵
  PID:9856
- C:\Windows\System\SlJKwOM.exe
  C:\Windows\System\SlJKwOM.exe
  2⤵
  PID:9092
- C:\Windows\System\IoAifos.exe
  C:\Windows\System\IoAifos.exe
  2⤵
  PID:14024
- C:\Windows\System\sRMEsZQ.exe
  C:\Windows\System\sRMEsZQ.exe
  2⤵
  PID:7780
- C:\Windows\System\NCnnbQX.exe
  C:\Windows\System\NCnnbQX.exe
  2⤵
  PID:5828
- C:\Windows\System\yHXkghd.exe
  C:\Windows\System\yHXkghd.exe
  2⤵
  PID:10180
- C:\Windows\System\RwcBDSE.exe
  C:\Windows\System\RwcBDSE.exe
  2⤵
  PID:8084
- C:\Windows\System\ZFCEYDb.exe
  C:\Windows\System\ZFCEYDb.exe
  2⤵
  PID:6156
- C:\Windows\System\JarfyJH.exe
  C:\Windows\System\JarfyJH.exe
  2⤵
  PID:12444
- C:\Windows\System\ggeLnYw.exe
  C:\Windows\System\ggeLnYw.exe
  2⤵
  PID:14016
- C:\Windows\System\qfnxBmH.exe
  C:\Windows\System\qfnxBmH.exe
  2⤵
  PID:13672
- C:\Windows\System\lEBsCeD.exe
  C:\Windows\System\lEBsCeD.exe
  2⤵
  PID:13720
- C:\Windows\System\tEtMakJ.exe
  C:\Windows\System\tEtMakJ.exe
  2⤵
  PID:12676
- C:\Windows\System\XxMlHKR.exe
  C:\Windows\System\XxMlHKR.exe
  2⤵
  PID:12744
- C:\Windows\System\XCzVvIg.exe
  C:\Windows\System\XCzVvIg.exe
  2⤵
  PID:8196
- C:\Windows\System\fHIyuHG.exe
  C:\Windows\System\fHIyuHG.exe
  2⤵
  PID:11804
- C:\Windows\System\zvEgRta.exe
  C:\Windows\System\zvEgRta.exe
  2⤵
  PID:13688
- C:\Windows\System\jnEqdCe.exe
  C:\Windows\System\jnEqdCe.exe
  2⤵
  PID:13408
- C:\Windows\System\AfMGMBx.exe
  C:\Windows\System\AfMGMBx.exe
  2⤵
  PID:11232
- C:\Windows\System\rXBrKCL.exe
  C:\Windows\System\rXBrKCL.exe
  2⤵
  PID:7500
- C:\Windows\System\YprmiVZ.exe
  C:\Windows\System\YprmiVZ.exe
  2⤵
  PID:11664
- C:\Windows\System\tXpfNlx.exe
  C:\Windows\System\tXpfNlx.exe
  2⤵
  PID:7636
- C:\Windows\System\LzbVFwZ.exe
  C:\Windows\System\LzbVFwZ.exe
  2⤵
  PID:12768
- C:\Windows\System\cshvOqV.exe
  C:\Windows\System\cshvOqV.exe
  2⤵
  PID:14088
- C:\Windows\System\HCwADxe.exe
  C:\Windows\System\HCwADxe.exe
  2⤵
  PID:14364
- C:\Windows\System\ctoBBSW.exe
  C:\Windows\System\ctoBBSW.exe
  2⤵
  PID:14384
- C:\Windows\System\JAphXtP.exe
  C:\Windows\System\JAphXtP.exe
  2⤵
  PID:14404
- C:\Windows\System\gcxyrMC.exe
  C:\Windows\System\gcxyrMC.exe
  2⤵
  PID:14628
- C:\Windows\System\BzWazbo.exe
  C:\Windows\System\BzWazbo.exe
  2⤵
  PID:14656
- C:\Windows\System\FkQwMOZ.exe
  C:\Windows\System\FkQwMOZ.exe
  2⤵
  PID:14680
- C:\Windows\System\XzDFMCE.exe
  C:\Windows\System\XzDFMCE.exe
  2⤵
  PID:14704
- C:\Windows\System\KltaGcO.exe
  C:\Windows\System\KltaGcO.exe
  2⤵
  PID:14728
- C:\Windows\System\GIqcnLa.exe
  C:\Windows\System\GIqcnLa.exe
  2⤵
  PID:14756
- C:\Windows\System\MXKDqVE.exe
  C:\Windows\System\MXKDqVE.exe
  2⤵
  PID:14780
- C:\Windows\System\mYzfiBI.exe
  C:\Windows\System\mYzfiBI.exe
  2⤵
  PID:14808
- C:\Windows\System\GovjtKF.exe
  C:\Windows\System\GovjtKF.exe
  2⤵
  PID:14832
- C:\Windows\System\mlQaLNt.exe
  C:\Windows\System\mlQaLNt.exe
  2⤵
  PID:14856
- C:\Windows\System\zoaihZW.exe
  C:\Windows\System\zoaihZW.exe
  2⤵
  PID:14888
- C:\Windows\System\YnviwYW.exe
  C:\Windows\System\YnviwYW.exe
  2⤵
  PID:14928
- C:\Windows\System\dcutwPg.exe
  C:\Windows\System\dcutwPg.exe
  2⤵
  PID:14968
- C:\Windows\System\BXRsZSI.exe
  C:\Windows\System\BXRsZSI.exe
  2⤵
  PID:15008
- C:\Windows\System\LmatSTZ.exe
  C:\Windows\System\LmatSTZ.exe
  2⤵
  PID:15036
- C:\Windows\System\WzROcET.exe
  C:\Windows\System\WzROcET.exe
  2⤵
  PID:15256
- C:\Windows\System\vgQxdbi.exe
  C:\Windows\System\vgQxdbi.exe
  2⤵
  PID:15288
- C:\Windows\System\vSsVyvM.exe
  C:\Windows\System\vSsVyvM.exe
  2⤵
  PID:15328
- C:\Windows\System\vMAFMGT.exe
  C:\Windows\System\vMAFMGT.exe
  2⤵
  PID:13896
- C:\Windows\System\ukHkDYF.exe
  C:\Windows\System\ukHkDYF.exe
  2⤵
  PID:13984
- C:\Windows\System\TQPsKyl.exe
  C:\Windows\System\TQPsKyl.exe
  2⤵
  PID:12860
- C:\Windows\System\HOHXWZM.exe
  C:\Windows\System\HOHXWZM.exe
  2⤵
  PID:12452
- C:\Windows\System\jVCuIQt.exe
  C:\Windows\System\jVCuIQt.exe
  2⤵
  PID:13824
- C:\Windows\System\hTKPokm.exe
  C:\Windows\System\hTKPokm.exe
  2⤵
  PID:11928
- C:\Windows\System\WYNTUHW.exe
  C:\Windows\System\WYNTUHW.exe
  2⤵
  PID:11000
- C:\Windows\System\gHCkAXy.exe
  C:\Windows\System\gHCkAXy.exe
  2⤵
  PID:10632
- C:\Windows\System\eNRyckb.exe
  C:\Windows\System\eNRyckb.exe
  2⤵
  PID:14380
- C:\Windows\System\EKmIoQg.exe
  C:\Windows\System\EKmIoQg.exe
  2⤵
  PID:14072
- C:\Windows\System\nWpUUUy.exe
  C:\Windows\System\nWpUUUy.exe
  2⤵
  PID:12972
- C:\Windows\System\XOewcCE.exe
  C:\Windows\System\XOewcCE.exe
  2⤵
  PID:12424
- C:\Windows\System\MJoEOGN.exe
  C:\Windows\System\MJoEOGN.exe
  2⤵
  PID:6720
- C:\Windows\System\OAxZmCy.exe
  C:\Windows\System\OAxZmCy.exe
  2⤵
  PID:15052
- C:\Windows\System\PFgTvdZ.exe
  C:\Windows\System\PFgTvdZ.exe
  2⤵
  PID:14804
- C:\Windows\System\ewCrzGz.exe
  C:\Windows\System\ewCrzGz.exe
  2⤵
  PID:6836
- C:\Windows\System\QTnepry.exe
  C:\Windows\System\QTnepry.exe
  2⤵
  PID:13188
- C:\Windows\System\YKpdTel.exe
  C:\Windows\System\YKpdTel.exe
  2⤵
  PID:15044
- C:\Windows\System\eVpmJKd.exe
  C:\Windows\System\eVpmJKd.exe
  2⤵
  PID:15072
- C:\Windows\System\uPchcnA.exe
  C:\Windows\System\uPchcnA.exe
  2⤵
  PID:15120
- C:\Windows\System\qCauzOG.exe
  C:\Windows\System\qCauzOG.exe
  2⤵
  PID:14800
- C:\Windows\System\pOpDrEX.exe
  C:\Windows\System\pOpDrEX.exe
  2⤵
  PID:11612

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_tw3ihiuv.wn2.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\CRxuvFY.exe

Filesize
1.4MB

MD5
b09b9809cb898aa1bfed4f649b12b64f

SHA1
971d63fc6a90273efcc893f2951daf7c6a1c663e

SHA256
53c365fed40ecd345eba6b56024152a7fb6c64d3588658c87e51aff270c29e81

SHA512
afc0e86e404c0a03ca7dcc2ea9c3a9e6d27fb7fad0191821b060586f9388653adcb7e894a7972398629f88f1656e94254164fe8f481986ec37e873ae93129387

Download Submit
C:\Windows\System\EGbzEiR.exe

Filesize
1.4MB

MD5
bd3d58f4abb75e3d9810827bef2c979a

SHA1
5d65c5b5b4aaf885d32a23dbebd728ac1a43adf6

SHA256
dc99a3c0e28ba3717633a14c985aad5e3631121ed8dc73d52dd8f7bfd45d0caf

SHA512
3ccf6c93a1210efb1fd64813902f716d5ebd62ab09b9a2fd14709959588dd4fb231e5c354c7b49e8a68a03f1e57b5d2447e40026aa38aa214510c6859eb89d7c

Download Submit
C:\Windows\System\FXbPOoh.exe

Filesize
1.4MB

MD5
f7dfc7997d819460c8dd83d8d1acd73f

SHA1
acd713f738a6bcc5e4f7069ca8f544286edf321e

SHA256
ba1b4a03d761261016055c9bf5d4f5ecec12f65910fabec4aea0e1d8192e8475

SHA512
4ccb5c34ed98df23989ace7ed50a24350960a7f70bbec32815a2f3f5058899b96cbbbbdd529638ff103afaa7044469a802e1f21956158a4bafde3e40c17bafe2

Download Submit
C:\Windows\System\GDwEWjT.exe

Filesize
1.4MB

MD5
8fccce04e9ad5d6802b7614070e1e6e0

SHA1
ebb5ea519b382b994d72c3fd379fd0716910bc48

SHA256
73e444e0bbed24e043a8d9f286249f541757598bee2e066b170e4706bbe2bdc4

SHA512
015c4b097f155eaedf7ea2e1e87d453da45cc80f92e6d8bc15e46b1b7a4a516445cf7dab7c6b8b41cac1f346357c1eafcecf06c13e486b54b90497e0c9319928

Download Submit
C:\Windows\System\Hrydups.exe

Filesize
1.4MB

MD5
ebd51db0636d2cb5d256ec3a0f9ff165

SHA1
8bc17e7fa03149b589ecbb42382069eaf09c53af

SHA256
87ffb7be6279b40d3c3a292fc39708d6d1522b3fd025d6148f518f026cd62438

SHA512
876b41df5b288203517ab078b37b8361572dcdd1ab5f6585dcd33d4cb94681efa0fe95d799f4ddd256b3305a2d77355bde4be40743b71ef6008b99e3c0128b61

Download Submit
C:\Windows\System\IhZpuQK.exe

Filesize
1.4MB

MD5
2aa991d31b4903e4dfd364b14d2f664d

SHA1
1a50868b11a2ef944b6b352bc9dd1b1fbcefe6fe

SHA256
a42e2a00a57f9d1fbd1ed7ab482dd87e336def9deddef576964c7dd63aaa6893

SHA512
307538490d4a144fae586ac17af1f24d01bbeb500af1ac3b8a4739d9e705212f524959916e8d955d26c361168a322db883d0be3d2c4e2a8675394c0d367d8bff

Download Submit
C:\Windows\System\MHAhaxp.exe

Filesize
1.4MB

MD5
65bdab824515d80a4e17d11cb05158d4

SHA1
55bb38d581b62bf7224d785ea5d12778f7d3343a

SHA256
fe0bed34e3673b7a1c5fd58f5549665762491efb42812a48a9de4eba002fb6a7

SHA512
dd5e472f6186d8fc104e07beae0e55a5cfef09114e7a8b2d252968fac50171cb0c8653b5098e1d0353526b1853a201fce33293368ab1abcc8572020867e7b1b4

Download Submit
C:\Windows\System\OqeLoFY.exe

Filesize
1.4MB

MD5
33d0e05da79311130f587f89b1f3b3c2

SHA1
e09e7c868a8237a8c7069f557e7949df0c4f5a4f

SHA256
45a80ed02c8db97abd2669c6b6832215a9aa76058ccf9c178879be1fbec1ccf2

SHA512
5a7d15d7d789547ecd48d9ee27219f07223991012829c85e0e7651105b931fd4c27c31f11d56897cc47e2297f2ea966d19b6ef70755deba6d2ea7414f2904601

Download Submit
C:\Windows\System\PYpNFHE.exe

Filesize
18B

MD5
6411c3d97015ad018439164e6cc72d57

SHA1
a21fdfcfecfb11934b692bfe95c70467d3d79fae

SHA256
bff39d8252fc9a7568d21ba3b00ac1fb0f4e4b5566d4a69801a9b20f67c18d89

SHA512
db699d138e29f5f70986de9b05154024050049a3f4a51601ad2f9ec1f5445e06bdde3278b61fdd691f10d6feefcf18182217170ef30271dc66ae405cdd5df2d1

Download Submit
C:\Windows\System\PbLLjYN.exe

Filesize
1.4MB

MD5
6379fe0edf2dcac9394c58da0fee9fc9

SHA1
f400b604b270607384e2b91abb29b6a839b60d6d

SHA256
4a40014436404ba48dac7745006f9bb0016d6080af2f3de2fe50627d2ee084a8

SHA512
e9d71ba064124c01220019f5b92132dd15d7c24bc7ea54677d4b6661df0aa02d2c016ace26d0a913838724bd3bf150ce964f5abf42d476f6cf8a9e04f39e9094

Download Submit
C:\Windows\System\RfhxdfU.exe

Filesize
1.4MB

MD5
49d13aaba2e20a1eb2d26576f6a82365

SHA1
f06526a5b23e243d9320dfd297ab595bd6e4bc6a

SHA256
8997fa80633d049eaf66b3431faf9ad2d61e3ce98132e4a72cd4d7bfab1212dc

SHA512
2e08b231b8fb1688b94d095c5cbe905ab70a24bab88d26c6a9ef26c2f8902e51f208d4d07c41f8148d65d8aaf070a105bb24ebbc9376e789c9009628e146469a

Download Submit
C:\Windows\System\RkHAeQR.exe

Filesize
1.4MB

MD5
6136a21876400155225a1d4c4c4c312b

SHA1
59463b96c6673f814e32ffdeced18155bb338c20

SHA256
b9843a2b31d128b2d21715426a85a458e80f84f4501c3b2baeef81083766646b

SHA512
88ea54b8c269bdf5622c58214afdbe4ef9e80a6ce8d1b334d329ad631d6a912d43e15675caff540c3a7c2ef0bfb3c80001f4365de921c500af45b1fb4c295751

Download Submit
C:\Windows\System\SzfJNIY.exe

Filesize
1.4MB

MD5
b149533281b130888e7f16276d3c0ce2

SHA1
3a158820c1fcb9fa7ded576f40874685734ec524

SHA256
3fd446536ae1f23969f1246a8ffde6c9a136a6082a0cd84e8965620ba7de8187

SHA512
993881ffec4c045306a70725851b78b53102b142992b4549ffa349093a343adb04956219d5b9eeaffb3dabe5fd9c672d22ea3ee6e64e1380ecb455155d04bdb8

Download Submit
C:\Windows\System\TZtoKUH.exe

Filesize
1.4MB

MD5
873ec1667cabdf18278700f0a92efaf7

SHA1
5337fb3296f5555f595315a5bcf6b22c5b6abb23

SHA256
50c065d77aa0290f981419aab7230eaf0c826640808f43b49a24efd7539eca83

SHA512
a94e60bd234c59e4e57e1733e38b5a17d657de59f1c82010e0b15cb2a2dfce9e0ceb17afaaf7f3740b16f2cebf19ec333a4b69bb5d540a335aa2f36e4e509f51

Download Submit
C:\Windows\System\UYVEWeV.exe

Filesize
8B

MD5
b4264996759d988d82730e6958cf8074

SHA1
7bbc1f74a3ce00994d790da4622d87f15f45b523

SHA256
8ec7039187958fcd27e56e585c4d65242972777fffc8821de830bc1ff1727bca

SHA512
90e2f3e49d27ab4d11cbf031af514cf6fc3a8851362bc0086d9e25b2d97c3341159ec901fb19a665474ceb995371e4f69eda62c3d14f844ace445c61339d139c

Download Submit
C:\Windows\System\VdxRElW.exe

Filesize
1.4MB

MD5
bd79ed6b1397a9134598ea5b58283693

SHA1
443913c27d653ce9f131cc2e27ea841993ff7789

SHA256
30b79052f0fb9a3b371baef6325c87b371eea632224664e75efaeabbe9e6b3f1

SHA512
5db6b9938d9207728d560c88a1c4f2798240a66a2f5825c3b8919490fd9d830aa09380e01834226c17c308595b4411c7da3d466698fa5c52b7d5bb3b2d68f165

Download Submit
C:\Windows\System\VyVocBQ.exe

Filesize
1.4MB

MD5
5e0d64b859d2dd87a033c1882a37bd24

SHA1
6b6507f389bcaacf15afb06bdfee1c14a69d4d64

SHA256
c12cae18f6e0659a38f40c14891dc7443188ccd4c2184a9ba013e2be1293504a

SHA512
fdd6e23d8c26da36f0878e94258a8fed083898def78a2cdc99d3793c636cf9bf428be5d9f7ce1993881296430d0bee8655dca2644a850a9a4f4c3611a8fbb66e

Download Submit
C:\Windows\System\aoVrntV.exe

Filesize
1.4MB

MD5
cdb6a8f3d4cfa7ee6af5261f7cfe985f

SHA1
b86dcd9e13c4b290738ca7b4b47f47e21bb06032

SHA256
0bc6d18d8113b382a71479ed733e2198265476bd88ce6332d9487290abab1878

SHA512
e1615e228675331d0cda62bbb06eff101e38a796e54581f6a275d4ddd821ccd15835584fe1f9f36bbbb37f34087c0afebbf576c8cb7e844fee2de97341107d91

Download Submit
C:\Windows\System\bfCQAlP.exe

Filesize
1.4MB

MD5
1b640ca574bc18a894197a3a4016490f

SHA1
11cfcfa4c3c57fdc49ba10d8e4db3817a1e2a691

SHA256
6c95caa62d0397c269d6a3b2c3d17c4db96fdab21e8cf138757123d860ffc96e

SHA512
f97736f7c72d4cd7f4307503413ab14a775357cc9f8081a64de5233300004a9bd8efbad300463dfe1472d9c646e8dff069735f997719a5273ad4d2e4734d7d93

Download Submit
C:\Windows\System\huOcCUr.exe

Filesize
1.4MB

MD5
69de72b43b05eaa5f836351db682aaaf

SHA1
2eeabd0f36c3b4db922ec7fe9e3fabb6cfd8ceb1

SHA256
93387e0a2b0f3c1bdaad64215c025a6d8450974a6ae3d8b1815adaf14e424216

SHA512
60bace369c2b44eebd529dd795852776d077aa2bd657ffba34dba07ce43581d598405d706461a36c55068805ac649b30791e71a7f486c3d3b230ca92676631cf

Download Submit
C:\Windows\System\itbJimu.exe

Filesize
1.4MB

MD5
0bfb2ee6f0377ea3ad185d3b46d6c4c2

SHA1
f710801869771f4b9658e0563eb80f04dde60c60

SHA256
f4ff44fa199c273f31df87c6be4ea544b9f37ea003014e6e9c51364726fd4543

SHA512
17cd08227fd1c4fdb1ce2ba16305a71cf71e20efdb019778c10f5c3bef0506c7f754aa7421bcf837acf44bf9c341cf5592a7fa4d6466db25bc6af622a81f23e4

Download Submit
C:\Windows\System\jjhFLlT.exe

Filesize
1.4MB

MD5
cb30574fdf9abcae6bbecf9072bd203b

SHA1
e7ef147e1a968daa1883b00ea18b9cc433111752

SHA256
e96a39ce460f60f63eff186571d42211bf93b744474cb43c41a3244d4377c8d1

SHA512
0171a6ae04f6e99979df0f9adc38ee2a6ceaf40659707437ab5a1e55ec19f8e9275cebf5cf9e0ef64360122b23cd92f37a0f7870efcf456277f6a6a7fe3a3486

Download Submit
C:\Windows\System\jnIZTvW.exe

Filesize
1.4MB

MD5
b7437a0d01201bdab315a120408536c4

SHA1
23cb39672d8a3990e3f0565ed6ef90ac7d51622e

SHA256
259947d3b989b703aba19bc3ae1ed5bdd57b81318030a7b919e0d569e0b7a764

SHA512
56f5a6521ce2f7001dd526b1743cdb3772581bca1d99d7fe73dd7cfa09013d462b7177cc89d281a66c7e23927430630c977bc170fd00a6223245f2c3d7be9b3b

Download Submit
C:\Windows\System\kXxjRGH.exe

Filesize
1.4MB

MD5
f5eeff461452e65caf7e6de388de16cb

SHA1
a1d372636c0025da379a9404a62d7018753e3ed6

SHA256
44033c593b31026f6eca78375781aa028531ff1a04707fba6770c71e23e5396f

SHA512
4c451abac0c8eb442187c26f41ce407ae03c9efed8dab3591efca10b1816446c6876c904fef56c3b7edb7e371c042a1f124e1dccb854f67fef819776ae972a37

Download Submit
C:\Windows\System\nMUzLjx.exe

Filesize
1.4MB

MD5
f0fbb795dd3611d36339db7f4bf5719e

SHA1
b0bb7195473e251b9befa153c6f2ff87cbe59771

SHA256
ae1a1481e1e9d74450a3f74c0f4cb3740f1331f9035d6579c9575a9059a21edc

SHA512
dd39448aa9ef839e8e2223462f6462628f8432ce5c67252527ed37d0a5ee2b6810ee045ecdb02df448459ed35fc27db96e5b4d271b7954b80cf01369a98cbd41

Download Submit
C:\Windows\System\nUgpgBr.exe

Filesize
1.4MB

MD5
15968c6b8df484881ece29725658ef5c

SHA1
9adcae3936ca11628f965b68687d5405d7ccc11b

SHA256
b0ef1f24ab67983e42beebcff9d70c8c1956b2dc76786bef75db5a68337a3873

SHA512
b4ff5f4b285e5d88a9a30361249119f6c74536a76298ed865cd5b8ddf4cb3da7f529c6b9b402e3ea584d15a3830a8c139c35daef25ccd5758e4c6067a9781a4c

Download Submit
C:\Windows\System\oyxkshB.exe

Filesize
1.4MB

MD5
a23ac724dcd623844b0e6080af789520

SHA1
661735e1f5d8929c05106702e9191d0d3c7cb75f

SHA256
50a444082b923cc8e3f105e417c3d82d81783e56339a38bec11a2bf7f01b552b

SHA512
51351d4272db58334c501ff161aaddac6418018d4494ad2a22bdfb55b8222e89a30aba44eff285752eff07a86665f187c6a0675733b1084e3680842352198369

Download Submit
C:\Windows\System\qaMAMiO.exe

Filesize
1.4MB

MD5
a13694e7b1c545c327b30a7a21630ad0

SHA1
f759b56429dc0e22ed2d499aed7102334c6ccdc7

SHA256
0f07e4d79e645f6ad7e7c38eff8c92fa2d3bdd55fc4f362433411e0cbb20bc8d

SHA512
d77bc28ec79fe591374fbf2876db0bca53b27fe6841475edfb0ccbb614412bd2c046894942f2d8be1964a85df84d4869bf19964e7ed787d2c4eccfe8216e7178

Download Submit
C:\Windows\System\qaqznUc.exe

Filesize
1.4MB

MD5
93441f5765181d6f28f6aea4079887f6

SHA1
71605b07e9b25ff291573e09c2b5fe98ba9ce555

SHA256
4d935e2071ae3ddb06e2b8fd2ad12bbe59062c5e04ab6e52718937983d986d9a

SHA512
675c82a9ebd172f4c811c4167b5380f285cce050c5f68072eb3ccf78179ba9f853a7669e7ce416e5d78984378429d778c6b17fc8fa6dbb264a424d015e8cc01d

Download Submit
C:\Windows\System\rjxddpq.exe

Filesize
1.4MB

MD5
38b9511e09fd177daad55d19fc4cb9cb

SHA1
4056e427876e3c32eb2f0b91a82d748f03cca0e4

SHA256
78d5085f8c57f4c15a9edb241ab6f866160b221b9940dde0925ba72f8e57c02b

SHA512
9a18c0960ec67775533f145b383182d40e5ebcc179bf455312157cd37cc68efd3707f891e3751ebced5a1d2d30ee2bb1fc410e6ad83c4267e8fa329bf217dc49

Download Submit
C:\Windows\System\teKZoKF.exe

Filesize
1.4MB

MD5
9a91c06004630ea19954662851acc496

SHA1
a6ffecaf84026cbcf21ad7e7369604f6524fc370

SHA256
15f15e79ede34b967975d7da66ab756a1526d89468e3137af87948a7567f8beb

SHA512
5226b867f3096123dff281ba9fe347d51b12a19e993175e920611474c538e9f2c3d62e49f27b405cf47b1b23bbc1387add4f57510c5311e4444faf357fbc05da

Download Submit
C:\Windows\System\unRwqLW.exe

Filesize
1.4MB

MD5
b77901a17d9d2fc1a921b3fcb75ae728

SHA1
6ad176b8ee11a6a2fc23ccc83aefbf77060d5f85

SHA256
dc2a015837342aefaae708dfc5548c8c8e837598eac383ba0b15d76c567c598f

SHA512
5fe533c68fd21e674f4a5323951ca8d439640badb2ebfe6c7180ef8cc0b896562f7acf9179f64f310decd76c9cb17cb14a59912f9ce127b988640632dd3d9bea

Download Submit
C:\Windows\System\wRvdpIm.exe

Filesize
1.4MB

MD5
0a9cab2263d064685341a176b90dd867

SHA1
c562d68461597231b323fce18d39bca3eda07195

SHA256
bf1c5c3171325ce006ddf6b80dbab6c72f7d2e36985fcd10233bc7c63abe52b9

SHA512
3241ad25606cfb5bc2fce2fc9d1b69e0c7ace5366217d2b659a06c920bc2e79d5e935e3c03fbd3ca0a680252351dea0c00181555da5d41cf604721c6b2545a86

Download Submit
C:\Windows\System\xDSNKGj.exe

Filesize
1.4MB

MD5
a77e3f9361949de9ae1fcd9004ee9595

SHA1
b3d2b85de4683a5244d43adfaac32970f2fc5e5f

SHA256
e24078a366e4390800a68fc1009d9e871d24e78d4ee3df33d1cffb54e2e91716

SHA512
3a4e12c609928fc7aed48b8c8990e672e5371466f83586e1529fa24ed43965f8b37efc134323bfd6b5d05b53888d5f262f43a65fc0cf9eef4e46c4d0a6344647

Download Submit
C:\Windows\System\zfXtzVt.exe

Filesize
1.4MB

MD5
b8c7dca07c4c1cd76119f292cd390a9a

SHA1
01518812310549cde69de4a5731006a1dd563b9a

SHA256
b09298b9c19189459765405689e23e8041d7433faaad0f62d187a8b462d4b9a2

SHA512
9f5a5d4c652868fc77b6a02a70c47b2680a5cae81c282e26341db3d837017a758c51d711353f17e9237311815a60a22921e74d717fc3c1ae3ab896b018fd0e0f

Download Submit
memory/624-103-0x00007FF7A6870000-0x00007FF7A6C62000-memory.dmp

Filesize
3.9MB

Download
memory/628-156-0x00007FF6B6660000-0x00007FF6B6A52000-memory.dmp

Filesize
3.9MB

Download
memory/920-87-0x00007FF757A90000-0x00007FF757E82000-memory.dmp

Filesize
3.9MB

Download
memory/924-164-0x00007FF689070000-0x00007FF689462000-memory.dmp

Filesize
3.9MB

Download
memory/1176-115-0x00007FF610450000-0x00007FF610842000-memory.dmp

Filesize
3.9MB

Download
memory/1596-85-0x00007FF64B7A0000-0x00007FF64BB92000-memory.dmp

Filesize
3.9MB

Download
memory/1640-51-0x00007FF7F3450000-0x00007FF7F3842000-memory.dmp

Filesize
3.9MB

Download
memory/1752-79-0x00007FF69CCC0000-0x00007FF69D0B2000-memory.dmp

Filesize
3.9MB

Download
memory/1752-2568-0x00007FF69CCC0000-0x00007FF69D0B2000-memory.dmp

Filesize
3.9MB

Download
memory/1892-152-0x00007FF6B6D40000-0x00007FF6B7132000-memory.dmp

Filesize
3.9MB

Download
memory/1900-88-0x000001F552A50000-0x000001F5531F6000-memory.dmp

Filesize
7.6MB

Download
memory/1900-2538-0x00007FFF27DA3000-0x00007FFF27DA5000-memory.dmp

Filesize
8KB

Download
memory/1900-18-0x00007FFF27DA3000-0x00007FFF27DA5000-memory.dmp

Filesize
8KB

Download
memory/1900-41-0x00007FFF27DA0000-0x00007FFF28861000-memory.dmp

Filesize
10.8MB

Download
memory/1900-33-0x00007FFF27DA0000-0x00007FFF28861000-memory.dmp

Filesize
10.8MB

Download
memory/1900-52-0x000001F551DB0000-0x000001F551DD2000-memory.dmp

Filesize
136KB

Download
memory/1996-86-0x00007FF650010000-0x00007FF650402000-memory.dmp

Filesize
3.9MB

Download
memory/2364-2720-0x00007FF6E35F0000-0x00007FF6E39E2000-memory.dmp

Filesize
3.9MB

Download
memory/2364-100-0x00007FF6E35F0000-0x00007FF6E39E2000-memory.dmp

Filesize
3.9MB

Download
memory/2432-129-0x00007FF65B080000-0x00007FF65B472000-memory.dmp

Filesize
3.9MB

Download
memory/2764-76-0x00007FF6122E0000-0x00007FF6126D2000-memory.dmp

Filesize
3.9MB

Download
memory/2828-13-0x00007FF6F72C0000-0x00007FF6F76B2000-memory.dmp

Filesize
3.9MB

Download
memory/2832-10-0x00007FF690490000-0x00007FF690882000-memory.dmp

Filesize
3.9MB

Download
memory/2832-1444-0x00007FF690490000-0x00007FF690882000-memory.dmp

Filesize
3.9MB

Download
memory/2972-137-0x00007FF773AD0000-0x00007FF773EC2000-memory.dmp

Filesize
3.9MB

Download
memory/2972-3359-0x00007FF773AD0000-0x00007FF773EC2000-memory.dmp

Filesize
3.9MB

Download
memory/3020-144-0x00007FF61D8C0000-0x00007FF61DCB2000-memory.dmp

Filesize
3.9MB

Download
memory/3020-3362-0x00007FF61D8C0000-0x00007FF61DCB2000-memory.dmp

Filesize
3.9MB

Download
memory/3636-125-0x00007FF6A8AE0000-0x00007FF6A8ED2000-memory.dmp

Filesize
3.9MB

Download
memory/4080-47-0x00007FF649D40000-0x00007FF64A132000-memory.dmp

Filesize
3.9MB

Download
memory/4364-161-0x00007FF7F0810000-0x00007FF7F0C02000-memory.dmp

Filesize
3.9MB

Download
memory/4452-157-0x00007FF71FB50000-0x00007FF71FF42000-memory.dmp

Filesize
3.9MB

Download
memory/4800-80-0x00007FF70D160000-0x00007FF70D552000-memory.dmp

Filesize
3.9MB

Download
memory/4820-0-0x00007FF7C9B90000-0x00007FF7C9F82000-memory.dmp

Filesize
3.9MB

Download
memory/4820-1433-0x00007FF7C9B90000-0x00007FF7C9F82000-memory.dmp

Filesize
3.9MB

Download
memory/4820-1-0x00000270F0820000-0x00000270F0830000-memory.dmp

Filesize
64KB

Download
memory/4964-72-0x00007FF7E3E90000-0x00007FF7E4282000-memory.dmp

Filesize
3.9MB

Download
memory/5012-66-0x00007FF7FD6D0000-0x00007FF7FDAC2000-memory.dmp

Filesize
3.9MB

Download