xmrig | c322ac9dcb6385b208020f0887f32cea5a2cd514d7b6e1f3d3195f588778efbf

Analysis

max time kernel
150s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
22/05/2024, 22:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
4bb0de84d1a866bc340b00c69a0b7fd0_NeikiAnalytics.exe
Size 1.6MB
Sample240522-2cgwpabc93
SHA256 c322ac9dcb6385b208020f0887f32cea5a2cd514d7b6e1f3d3195f588778efbf
MD5 4bb0de84d1a866bc340b00c69a0b7fd0
SHA1 32d296de985df4fcebcb765ea25a63084a2e2317
SHA512 e6b68a0ba269e44c4337c86f671d606e67a8751b96ab969433e83ccea7077e9f1cb25a264eb8fa42f50237a99218241154c8db1ddc0d1fd10603f201bc80dd5d
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjuJoz5XdUK6S1uBkr5Gqlfz+y7p9Dbkj:Lz071uv4BPMkHC0I6Gz3N1pHP7c
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 49 IoCs

miner

resource	yara_rule
behavioral2/memory/2512-177-0x00007FF78EFD0000-0x00007FF78F3C2000-memory.dmp	xmrig
behavioral2/memory/1912-205-0x00007FF66AF20000-0x00007FF66B312000-memory.dmp	xmrig
behavioral2/memory/1388-204-0x00007FF7574B0000-0x00007FF7578A2000-memory.dmp	xmrig
behavioral2/memory/1772-195-0x00007FF6BC2E0000-0x00007FF6BC6D2000-memory.dmp	xmrig
behavioral2/memory/4004-189-0x00007FF66B620000-0x00007FF66BA12000-memory.dmp	xmrig
behavioral2/memory/4392-183-0x00007FF662760000-0x00007FF662B52000-memory.dmp	xmrig
behavioral2/memory/1372-171-0x00007FF73E610000-0x00007FF73EA02000-memory.dmp	xmrig
behavioral2/memory/4632-160-0x00007FF718870000-0x00007FF718C62000-memory.dmp	xmrig
behavioral2/memory/3564-154-0x00007FF747470000-0x00007FF747862000-memory.dmp	xmrig
behavioral2/memory/3160-148-0x00007FF65C960000-0x00007FF65CD52000-memory.dmp	xmrig
behavioral2/memory/456-142-0x00007FF6866B0000-0x00007FF686AA2000-memory.dmp	xmrig
behavioral2/memory/1176-136-0x00007FF71B710000-0x00007FF71BB02000-memory.dmp	xmrig
behavioral2/memory/5004-130-0x00007FF659880000-0x00007FF659C72000-memory.dmp	xmrig
behavioral2/memory/2560-124-0x00007FF66BE40000-0x00007FF66C232000-memory.dmp	xmrig
behavioral2/memory/2264-113-0x00007FF6B3D90000-0x00007FF6B4182000-memory.dmp	xmrig
behavioral2/memory/1500-107-0x00007FF7ECAD0000-0x00007FF7ECEC2000-memory.dmp	xmrig
behavioral2/memory/2144-101-0x00007FF7BBB80000-0x00007FF7BBF72000-memory.dmp	xmrig
behavioral2/memory/808-97-0x00007FF764600000-0x00007FF7649F2000-memory.dmp	xmrig
behavioral2/memory/3432-89-0x00007FF7EA9D0000-0x00007FF7EADC2000-memory.dmp	xmrig
behavioral2/memory/3968-86-0x00007FF7D2750000-0x00007FF7D2B42000-memory.dmp	xmrig
behavioral2/memory/2464-82-0x00007FF724850000-0x00007FF724C42000-memory.dmp	xmrig
behavioral2/memory/3992-75-0x00007FF653020000-0x00007FF653412000-memory.dmp	xmrig
behavioral2/memory/4244-70-0x00007FF7429B0000-0x00007FF742DA2000-memory.dmp	xmrig
behavioral2/memory/1488-2748-0x00007FF69CE10000-0x00007FF69D202000-memory.dmp	xmrig
behavioral2/memory/1448-2760-0x00007FF664A10000-0x00007FF664E02000-memory.dmp	xmrig
behavioral2/memory/1448-2766-0x00007FF664A10000-0x00007FF664E02000-memory.dmp	xmrig
behavioral2/memory/2464-2770-0x00007FF724850000-0x00007FF724C42000-memory.dmp	xmrig
behavioral2/memory/2264-2769-0x00007FF6B3D90000-0x00007FF6B4182000-memory.dmp	xmrig
behavioral2/memory/3992-2776-0x00007FF653020000-0x00007FF653412000-memory.dmp	xmrig
behavioral2/memory/3432-2778-0x00007FF7EA9D0000-0x00007FF7EADC2000-memory.dmp	xmrig
behavioral2/memory/3968-2774-0x00007FF7D2750000-0x00007FF7D2B42000-memory.dmp	xmrig
behavioral2/memory/4244-2773-0x00007FF7429B0000-0x00007FF742DA2000-memory.dmp	xmrig
behavioral2/memory/1176-2787-0x00007FF71B710000-0x00007FF71BB02000-memory.dmp	xmrig
behavioral2/memory/1500-2790-0x00007FF7ECAD0000-0x00007FF7ECEC2000-memory.dmp	xmrig
behavioral2/memory/456-2792-0x00007FF6866B0000-0x00007FF686AA2000-memory.dmp	xmrig
behavioral2/memory/4632-2802-0x00007FF718870000-0x00007FF718C62000-memory.dmp	xmrig
behavioral2/memory/3564-2800-0x00007FF747470000-0x00007FF747862000-memory.dmp	xmrig
behavioral2/memory/3160-2796-0x00007FF65C960000-0x00007FF65CD52000-memory.dmp	xmrig
behavioral2/memory/5004-2788-0x00007FF659880000-0x00007FF659C72000-memory.dmp	xmrig
behavioral2/memory/2144-2785-0x00007FF7BBB80000-0x00007FF7BBF72000-memory.dmp	xmrig
behavioral2/memory/2560-2783-0x00007FF66BE40000-0x00007FF66C232000-memory.dmp	xmrig
behavioral2/memory/808-2781-0x00007FF764600000-0x00007FF7649F2000-memory.dmp	xmrig
behavioral2/memory/4004-2818-0x00007FF66B620000-0x00007FF66BA12000-memory.dmp	xmrig
behavioral2/memory/1388-2814-0x00007FF7574B0000-0x00007FF7578A2000-memory.dmp	xmrig
behavioral2/memory/1912-2810-0x00007FF66AF20000-0x00007FF66B312000-memory.dmp	xmrig
behavioral2/memory/4392-2809-0x00007FF662760000-0x00007FF662B52000-memory.dmp	xmrig
behavioral2/memory/1772-2817-0x00007FF6BC2E0000-0x00007FF6BC6D2000-memory.dmp	xmrig
behavioral2/memory/2512-2813-0x00007FF78EFD0000-0x00007FF78F3C2000-memory.dmp	xmrig
behavioral2/memory/1372-2806-0x00007FF73E610000-0x00007FF73EA02000-memory.dmp	xmrig

Blocklisted process makes network request 2 IoCs

flow	pid	Process
10	1588	powershell.exe
12	1588	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
1588	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
1448	mPwMbXS.exe
2264	YLWwwJh.exe
4244	PhdjnIF.exe
3992	wlGPxho.exe
2464	XltZrLH.exe
3968	JBzuxOT.exe
3432	AoXDPLJ.exe
2560	JKSaWdU.exe
808	MJvhwPG.exe
2144	YCqmKKH.exe
1500	XozXZGy.exe
5004	vQoqsLx.exe
1176	cUBpDWq.exe
456	CpnqRKU.exe
3160	JhJZryC.exe
3564	kyDOnvt.exe
4632	FzPxsNQ.exe
1372	KHbbkQi.exe
4392	ruXDCUN.exe
4004	LLSeDXl.exe
1772	GsxlstI.exe
1388	aJyyNlY.exe
2512	whaMVIT.exe
1912	AdGVmFR.exe
2176	qrSaZgQ.exe
3440	iZEdpQi.exe
2984	HzqdzIZ.exe
4452	cXVKlFk.exe
4528	QcQynjJ.exe
4076	nONkfmh.exe
2320	MxDBSof.exe
2332	IrVHgak.exe
3144	KiJMIgz.exe
824	XFaEnmJ.exe
2964	AcgIUFg.exe
4300	gqgpFQq.exe
1484	lzMHFpZ.exe
4136	oGPfoyq.exe
1104	diJgaYv.exe
4436	clcilUZ.exe
3292	IiJJYqZ.exe
1440	mxstCZD.exe
512	TvRyuVh.exe
4364	pcDgrfL.exe
3368	kjgCqDS.exe
4636	EZUwAqF.exe
3504	sKCUHbI.exe
3224	IuvxNaT.exe
3580	tLRrXsP.exe
3920	IHxmBGC.exe
2184	zdALgHy.exe
388	FyWyqUJ.exe
4772	GbubQKZ.exe
3352	BTncAIx.exe
2152	lXVFvmn.exe
4748	uzywXBd.exe
5072	QlvsWKc.exe
4132	ywSnGBE.exe
372	RGhjNxu.exe
4840	YQHOJcm.exe
4320	fipFTlk.exe
3204	JFTvJjo.exe
3092	HjxuJcn.exe
4852	bHieTUg.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1488-0-0x00007FF69CE10000-0x00007FF69D202000-memory.dmp	upx
behavioral2/files/0x0006000000023276-5.dat	upx
behavioral2/files/0x00080000000233c9-19.dat	upx
behavioral2/files/0x00070000000233ce-18.dat	upx
behavioral2/memory/1448-8-0x00007FF664A10000-0x00007FF664E02000-memory.dmp	upx
behavioral2/files/0x00070000000233cd-7.dat	upx
behavioral2/files/0x00070000000233cf-22.dat	upx
behavioral2/files/0x00070000000233d1-38.dat	upx
behavioral2/files/0x00070000000233d2-43.dat	upx
behavioral2/files/0x00070000000233d4-49.dat	upx
behavioral2/files/0x00070000000233d6-72.dat	upx
behavioral2/files/0x00070000000233d5-79.dat	upx
behavioral2/files/0x00080000000233ca-85.dat	upx
behavioral2/files/0x00070000000233da-104.dat	upx
behavioral2/files/0x00070000000233db-110.dat	upx
behavioral2/files/0x00070000000233dd-131.dat	upx
behavioral2/files/0x00070000000233de-137.dat	upx
behavioral2/files/0x00070000000233e1-145.dat	upx
behavioral2/files/0x00070000000233e3-166.dat	upx
behavioral2/memory/2512-177-0x00007FF78EFD0000-0x00007FF78F3C2000-memory.dmp	upx
behavioral2/files/0x00070000000233ea-198.dat	upx
behavioral2/memory/1912-205-0x00007FF66AF20000-0x00007FF66B312000-memory.dmp	upx
behavioral2/memory/1388-204-0x00007FF7574B0000-0x00007FF7578A2000-memory.dmp	upx
behavioral2/files/0x00070000000233e8-196.dat	upx
behavioral2/memory/1772-195-0x00007FF6BC2E0000-0x00007FF6BC6D2000-memory.dmp	upx
behavioral2/files/0x00070000000233e9-192.dat	upx
behavioral2/files/0x00070000000233e7-190.dat	upx
behavioral2/memory/4004-189-0x00007FF66B620000-0x00007FF66BA12000-memory.dmp	upx
behavioral2/files/0x00070000000233e6-184.dat	upx
behavioral2/memory/4392-183-0x00007FF662760000-0x00007FF662B52000-memory.dmp	upx
behavioral2/files/0x00070000000233e5-178.dat	upx
behavioral2/files/0x00070000000233e4-172.dat	upx
behavioral2/memory/1372-171-0x00007FF73E610000-0x00007FF73EA02000-memory.dmp	upx
behavioral2/files/0x00070000000233e2-161.dat	upx
behavioral2/memory/4632-160-0x00007FF718870000-0x00007FF718C62000-memory.dmp	upx
behavioral2/memory/3564-154-0x00007FF747470000-0x00007FF747862000-memory.dmp	upx
behavioral2/files/0x00070000000233e0-149.dat	upx
behavioral2/memory/3160-148-0x00007FF65C960000-0x00007FF65CD52000-memory.dmp	upx
behavioral2/files/0x00070000000233df-143.dat	upx
behavioral2/memory/456-142-0x00007FF6866B0000-0x00007FF686AA2000-memory.dmp	upx
behavioral2/memory/1176-136-0x00007FF71B710000-0x00007FF71BB02000-memory.dmp	upx
behavioral2/memory/5004-130-0x00007FF659880000-0x00007FF659C72000-memory.dmp	upx
behavioral2/files/0x00070000000233dc-125.dat	upx
behavioral2/memory/2560-124-0x00007FF66BE40000-0x00007FF66C232000-memory.dmp	upx
behavioral2/memory/2264-113-0x00007FF6B3D90000-0x00007FF6B4182000-memory.dmp	upx
behavioral2/files/0x00070000000233d9-108.dat	upx
behavioral2/memory/1500-107-0x00007FF7ECAD0000-0x00007FF7ECEC2000-memory.dmp	upx
behavioral2/files/0x00080000000233d7-102.dat	upx
behavioral2/memory/2144-101-0x00007FF7BBB80000-0x00007FF7BBF72000-memory.dmp	upx
behavioral2/memory/808-97-0x00007FF764600000-0x00007FF7649F2000-memory.dmp	upx
behavioral2/files/0x00080000000233d8-90.dat	upx
behavioral2/memory/3432-89-0x00007FF7EA9D0000-0x00007FF7EADC2000-memory.dmp	upx
behavioral2/memory/3968-86-0x00007FF7D2750000-0x00007FF7D2B42000-memory.dmp	upx
behavioral2/memory/2464-82-0x00007FF724850000-0x00007FF724C42000-memory.dmp	upx
behavioral2/memory/3992-75-0x00007FF653020000-0x00007FF653412000-memory.dmp	upx
behavioral2/memory/4244-70-0x00007FF7429B0000-0x00007FF742DA2000-memory.dmp	upx
behavioral2/files/0x00070000000233d3-67.dat	upx
behavioral2/files/0x00070000000233d0-32.dat	upx
behavioral2/memory/1488-2748-0x00007FF69CE10000-0x00007FF69D202000-memory.dmp	upx
behavioral2/memory/1448-2760-0x00007FF664A10000-0x00007FF664E02000-memory.dmp	upx
behavioral2/memory/1448-2766-0x00007FF664A10000-0x00007FF664E02000-memory.dmp	upx
behavioral2/memory/2464-2770-0x00007FF724850000-0x00007FF724C42000-memory.dmp	upx
behavioral2/memory/2264-2769-0x00007FF6B3D90000-0x00007FF6B4182000-memory.dmp	upx
behavioral2/memory/3992-2776-0x00007FF653020000-0x00007FF653412000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
9	raw.githubusercontent.com
10	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\hbteSgD.exe	4bb0de84d1a866bc340b00c69a0b7fd0_NeikiAnalytics.exe
File created	C:\Windows\System\FlpPGlQ.exe	4bb0de84d1a866bc340b00c69a0b7fd0_NeikiAnalytics.exe
File created	C:\Windows\System\TmFEEAB.exe	4bb0de84d1a866bc340b00c69a0b7fd0_NeikiAnalytics.exe
File created	C:\Windows\System\UmnzYiU.exe	4bb0de84d1a866bc340b00c69a0b7fd0_NeikiAnalytics.exe
File created	C:\Windows\System\zABZmBU.exe	4bb0de84d1a866bc340b00c69a0b7fd0_NeikiAnalytics.exe
File created	C:\Windows\System\CWVmbXC.exe	4bb0de84d1a866bc340b00c69a0b7fd0_NeikiAnalytics.exe
File created	C:\Windows\System\ardRuGW.exe	4bb0de84d1a866bc340b00c69a0b7fd0_NeikiAnalytics.exe
File created	C:\Windows\System\ongzYFE.exe	4bb0de84d1a866bc340b00c69a0b7fd0_NeikiAnalytics.exe
File created	C:\Windows\System\CKgHGLy.exe	4bb0de84d1a866bc340b00c69a0b7fd0_NeikiAnalytics.exe
File created	C:\Windows\System\ipaYjQH.exe	4bb0de84d1a866bc340b00c69a0b7fd0_NeikiAnalytics.exe
File created	C:\Windows\System\GmgVDiw.exe	4bb0de84d1a866bc340b00c69a0b7fd0_NeikiAnalytics.exe
File created	C:\Windows\System\XQmodPK.exe	4bb0de84d1a866bc340b00c69a0b7fd0_NeikiAnalytics.exe
File created	C:\Windows\System\IUzQSiv.exe	4bb0de84d1a866bc340b00c69a0b7fd0_NeikiAnalytics.exe
File created	C:\Windows\System\QNkEdLf.exe	4bb0de84d1a866bc340b00c69a0b7fd0_NeikiAnalytics.exe
File created	C:\Windows\System\VkKfIvB.exe	4bb0de84d1a866bc340b00c69a0b7fd0_NeikiAnalytics.exe
File created	C:\Windows\System\SmifRma.exe	4bb0de84d1a866bc340b00c69a0b7fd0_NeikiAnalytics.exe
File created	C:\Windows\System\gBqGKFm.exe	4bb0de84d1a866bc340b00c69a0b7fd0_NeikiAnalytics.exe
File created	C:\Windows\System\BBqpkct.exe	4bb0de84d1a866bc340b00c69a0b7fd0_NeikiAnalytics.exe
File created	C:\Windows\System\WXsgsqx.exe	4bb0de84d1a866bc340b00c69a0b7fd0_NeikiAnalytics.exe
File created	C:\Windows\System\uFpkgix.exe	4bb0de84d1a866bc340b00c69a0b7fd0_NeikiAnalytics.exe
File created	C:\Windows\System\XVIzaVW.exe	4bb0de84d1a866bc340b00c69a0b7fd0_NeikiAnalytics.exe
File created	C:\Windows\System\VeauHQD.exe	4bb0de84d1a866bc340b00c69a0b7fd0_NeikiAnalytics.exe
File created	C:\Windows\System\lTqlQml.exe	4bb0de84d1a866bc340b00c69a0b7fd0_NeikiAnalytics.exe
File created	C:\Windows\System\TWhFLzn.exe	4bb0de84d1a866bc340b00c69a0b7fd0_NeikiAnalytics.exe
File created	C:\Windows\System\wpIJLmB.exe	4bb0de84d1a866bc340b00c69a0b7fd0_NeikiAnalytics.exe
File created	C:\Windows\System\IlhNVtu.exe	4bb0de84d1a866bc340b00c69a0b7fd0_NeikiAnalytics.exe
File created	C:\Windows\System\NvwsIWC.exe	4bb0de84d1a866bc340b00c69a0b7fd0_NeikiAnalytics.exe
File created	C:\Windows\System\cTlcdQe.exe	4bb0de84d1a866bc340b00c69a0b7fd0_NeikiAnalytics.exe
File created	C:\Windows\System\tXiebcR.exe	4bb0de84d1a866bc340b00c69a0b7fd0_NeikiAnalytics.exe
File created	C:\Windows\System\bnZpjsb.exe	4bb0de84d1a866bc340b00c69a0b7fd0_NeikiAnalytics.exe
File created	C:\Windows\System\mRqHBBT.exe	4bb0de84d1a866bc340b00c69a0b7fd0_NeikiAnalytics.exe
File created	C:\Windows\System\DASwPKu.exe	4bb0de84d1a866bc340b00c69a0b7fd0_NeikiAnalytics.exe
File created	C:\Windows\System\DvgkQuY.exe	4bb0de84d1a866bc340b00c69a0b7fd0_NeikiAnalytics.exe
File created	C:\Windows\System\EXmCyAO.exe	4bb0de84d1a866bc340b00c69a0b7fd0_NeikiAnalytics.exe
File created	C:\Windows\System\YArzlJF.exe	4bb0de84d1a866bc340b00c69a0b7fd0_NeikiAnalytics.exe
File created	C:\Windows\System\SRhdpaq.exe	4bb0de84d1a866bc340b00c69a0b7fd0_NeikiAnalytics.exe
File created	C:\Windows\System\gCQuZjk.exe	4bb0de84d1a866bc340b00c69a0b7fd0_NeikiAnalytics.exe
File created	C:\Windows\System\iKRyYCk.exe	4bb0de84d1a866bc340b00c69a0b7fd0_NeikiAnalytics.exe
File created	C:\Windows\System\GpMhIMn.exe	4bb0de84d1a866bc340b00c69a0b7fd0_NeikiAnalytics.exe
File created	C:\Windows\System\icCAeQm.exe	4bb0de84d1a866bc340b00c69a0b7fd0_NeikiAnalytics.exe
File created	C:\Windows\System\WUDxhId.exe	4bb0de84d1a866bc340b00c69a0b7fd0_NeikiAnalytics.exe
File created	C:\Windows\System\ZNICscT.exe	4bb0de84d1a866bc340b00c69a0b7fd0_NeikiAnalytics.exe
File created	C:\Windows\System\IpGmPgB.exe	4bb0de84d1a866bc340b00c69a0b7fd0_NeikiAnalytics.exe
File created	C:\Windows\System\dxHGTQw.exe	4bb0de84d1a866bc340b00c69a0b7fd0_NeikiAnalytics.exe
File created	C:\Windows\System\BlfzrtS.exe	4bb0de84d1a866bc340b00c69a0b7fd0_NeikiAnalytics.exe
File created	C:\Windows\System\UDUbBqa.exe	4bb0de84d1a866bc340b00c69a0b7fd0_NeikiAnalytics.exe
File created	C:\Windows\System\DSpdrfm.exe	4bb0de84d1a866bc340b00c69a0b7fd0_NeikiAnalytics.exe
File created	C:\Windows\System\XbcXwTL.exe	4bb0de84d1a866bc340b00c69a0b7fd0_NeikiAnalytics.exe
File created	C:\Windows\System\LysRbXH.exe	4bb0de84d1a866bc340b00c69a0b7fd0_NeikiAnalytics.exe
File created	C:\Windows\System\wdJYejm.exe	4bb0de84d1a866bc340b00c69a0b7fd0_NeikiAnalytics.exe
File created	C:\Windows\System\XzOSieY.exe	4bb0de84d1a866bc340b00c69a0b7fd0_NeikiAnalytics.exe
File created	C:\Windows\System\esWiLYZ.exe	4bb0de84d1a866bc340b00c69a0b7fd0_NeikiAnalytics.exe
File created	C:\Windows\System\GnwRtcn.exe	4bb0de84d1a866bc340b00c69a0b7fd0_NeikiAnalytics.exe
File created	C:\Windows\System\AXoRsOj.exe	4bb0de84d1a866bc340b00c69a0b7fd0_NeikiAnalytics.exe
File created	C:\Windows\System\xJpEiuA.exe	4bb0de84d1a866bc340b00c69a0b7fd0_NeikiAnalytics.exe
File created	C:\Windows\System\sYifYYu.exe	4bb0de84d1a866bc340b00c69a0b7fd0_NeikiAnalytics.exe
File created	C:\Windows\System\vuSdZgY.exe	4bb0de84d1a866bc340b00c69a0b7fd0_NeikiAnalytics.exe
File created	C:\Windows\System\SQLlTAN.exe	4bb0de84d1a866bc340b00c69a0b7fd0_NeikiAnalytics.exe
File created	C:\Windows\System\sddmxeZ.exe	4bb0de84d1a866bc340b00c69a0b7fd0_NeikiAnalytics.exe
File created	C:\Windows\System\pKUHOlX.exe	4bb0de84d1a866bc340b00c69a0b7fd0_NeikiAnalytics.exe
File created	C:\Windows\System\YAMSFnW.exe	4bb0de84d1a866bc340b00c69a0b7fd0_NeikiAnalytics.exe
File created	C:\Windows\System\PXIinNL.exe	4bb0de84d1a866bc340b00c69a0b7fd0_NeikiAnalytics.exe
File created	C:\Windows\System\FaAWlZn.exe	4bb0de84d1a866bc340b00c69a0b7fd0_NeikiAnalytics.exe
File created	C:\Windows\System\lPRfNVe.exe	4bb0de84d1a866bc340b00c69a0b7fd0_NeikiAnalytics.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	wermgr.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	wermgr.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	wermgr.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
1588	powershell.exe
1588	powershell.exe
1588	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	1488	4bb0de84d1a866bc340b00c69a0b7fd0_NeikiAnalytics.exe
Token: SeLockMemoryPrivilege	1488	4bb0de84d1a866bc340b00c69a0b7fd0_NeikiAnalytics.exe
Token: SeDebugPrivilege	1588	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1488 wrote to memory of 1588	1488	4bb0de84d1a866bc340b00c69a0b7fd0_NeikiAnalytics.exe	83
PID 1488 wrote to memory of 1588	1488	4bb0de84d1a866bc340b00c69a0b7fd0_NeikiAnalytics.exe	83
PID 1488 wrote to memory of 1448	1488	4bb0de84d1a866bc340b00c69a0b7fd0_NeikiAnalytics.exe	84
PID 1488 wrote to memory of 1448	1488	4bb0de84d1a866bc340b00c69a0b7fd0_NeikiAnalytics.exe	84
PID 1488 wrote to memory of 2264	1488	4bb0de84d1a866bc340b00c69a0b7fd0_NeikiAnalytics.exe	85
PID 1488 wrote to memory of 2264	1488	4bb0de84d1a866bc340b00c69a0b7fd0_NeikiAnalytics.exe	85
PID 1488 wrote to memory of 3992	1488	4bb0de84d1a866bc340b00c69a0b7fd0_NeikiAnalytics.exe	86
PID 1488 wrote to memory of 3992	1488	4bb0de84d1a866bc340b00c69a0b7fd0_NeikiAnalytics.exe	86
PID 1488 wrote to memory of 4244	1488	4bb0de84d1a866bc340b00c69a0b7fd0_NeikiAnalytics.exe	87
PID 1488 wrote to memory of 4244	1488	4bb0de84d1a866bc340b00c69a0b7fd0_NeikiAnalytics.exe	87
PID 1488 wrote to memory of 2464	1488	4bb0de84d1a866bc340b00c69a0b7fd0_NeikiAnalytics.exe	88
PID 1488 wrote to memory of 2464	1488	4bb0de84d1a866bc340b00c69a0b7fd0_NeikiAnalytics.exe	88
PID 1488 wrote to memory of 3968	1488	4bb0de84d1a866bc340b00c69a0b7fd0_NeikiAnalytics.exe	89
PID 1488 wrote to memory of 3968	1488	4bb0de84d1a866bc340b00c69a0b7fd0_NeikiAnalytics.exe	89
PID 1488 wrote to memory of 3432	1488	4bb0de84d1a866bc340b00c69a0b7fd0_NeikiAnalytics.exe	90
PID 1488 wrote to memory of 3432	1488	4bb0de84d1a866bc340b00c69a0b7fd0_NeikiAnalytics.exe	90
PID 1488 wrote to memory of 2560	1488	4bb0de84d1a866bc340b00c69a0b7fd0_NeikiAnalytics.exe	91
PID 1488 wrote to memory of 2560	1488	4bb0de84d1a866bc340b00c69a0b7fd0_NeikiAnalytics.exe	91
PID 1488 wrote to memory of 808	1488	4bb0de84d1a866bc340b00c69a0b7fd0_NeikiAnalytics.exe	92
PID 1488 wrote to memory of 808	1488	4bb0de84d1a866bc340b00c69a0b7fd0_NeikiAnalytics.exe	92
PID 1488 wrote to memory of 2144	1488	4bb0de84d1a866bc340b00c69a0b7fd0_NeikiAnalytics.exe	93
PID 1488 wrote to memory of 2144	1488	4bb0de84d1a866bc340b00c69a0b7fd0_NeikiAnalytics.exe	93
PID 1488 wrote to memory of 1500	1488	4bb0de84d1a866bc340b00c69a0b7fd0_NeikiAnalytics.exe	94
PID 1488 wrote to memory of 1500	1488	4bb0de84d1a866bc340b00c69a0b7fd0_NeikiAnalytics.exe	94
PID 1488 wrote to memory of 5004	1488	4bb0de84d1a866bc340b00c69a0b7fd0_NeikiAnalytics.exe	95
PID 1488 wrote to memory of 5004	1488	4bb0de84d1a866bc340b00c69a0b7fd0_NeikiAnalytics.exe	95
PID 1488 wrote to memory of 1176	1488	4bb0de84d1a866bc340b00c69a0b7fd0_NeikiAnalytics.exe	96
PID 1488 wrote to memory of 1176	1488	4bb0de84d1a866bc340b00c69a0b7fd0_NeikiAnalytics.exe	96
PID 1488 wrote to memory of 456	1488	4bb0de84d1a866bc340b00c69a0b7fd0_NeikiAnalytics.exe	97
PID 1488 wrote to memory of 456	1488	4bb0de84d1a866bc340b00c69a0b7fd0_NeikiAnalytics.exe	97
PID 1488 wrote to memory of 3160	1488	4bb0de84d1a866bc340b00c69a0b7fd0_NeikiAnalytics.exe	98
PID 1488 wrote to memory of 3160	1488	4bb0de84d1a866bc340b00c69a0b7fd0_NeikiAnalytics.exe	98
PID 1488 wrote to memory of 3564	1488	4bb0de84d1a866bc340b00c69a0b7fd0_NeikiAnalytics.exe	99
PID 1488 wrote to memory of 3564	1488	4bb0de84d1a866bc340b00c69a0b7fd0_NeikiAnalytics.exe	99
PID 1488 wrote to memory of 4632	1488	4bb0de84d1a866bc340b00c69a0b7fd0_NeikiAnalytics.exe	100
PID 1488 wrote to memory of 4632	1488	4bb0de84d1a866bc340b00c69a0b7fd0_NeikiAnalytics.exe	100
PID 1488 wrote to memory of 1372	1488	4bb0de84d1a866bc340b00c69a0b7fd0_NeikiAnalytics.exe	101
PID 1488 wrote to memory of 1372	1488	4bb0de84d1a866bc340b00c69a0b7fd0_NeikiAnalytics.exe	101
PID 1488 wrote to memory of 4392	1488	4bb0de84d1a866bc340b00c69a0b7fd0_NeikiAnalytics.exe	102
PID 1488 wrote to memory of 4392	1488	4bb0de84d1a866bc340b00c69a0b7fd0_NeikiAnalytics.exe	102
PID 1488 wrote to memory of 4004	1488	4bb0de84d1a866bc340b00c69a0b7fd0_NeikiAnalytics.exe	103
PID 1488 wrote to memory of 4004	1488	4bb0de84d1a866bc340b00c69a0b7fd0_NeikiAnalytics.exe	103
PID 1488 wrote to memory of 1772	1488	4bb0de84d1a866bc340b00c69a0b7fd0_NeikiAnalytics.exe	104
PID 1488 wrote to memory of 1772	1488	4bb0de84d1a866bc340b00c69a0b7fd0_NeikiAnalytics.exe	104
PID 1488 wrote to memory of 1388	1488	4bb0de84d1a866bc340b00c69a0b7fd0_NeikiAnalytics.exe	105
PID 1488 wrote to memory of 1388	1488	4bb0de84d1a866bc340b00c69a0b7fd0_NeikiAnalytics.exe	105
PID 1488 wrote to memory of 2512	1488	4bb0de84d1a866bc340b00c69a0b7fd0_NeikiAnalytics.exe	106
PID 1488 wrote to memory of 2512	1488	4bb0de84d1a866bc340b00c69a0b7fd0_NeikiAnalytics.exe	106
PID 1488 wrote to memory of 1912	1488	4bb0de84d1a866bc340b00c69a0b7fd0_NeikiAnalytics.exe	107
PID 1488 wrote to memory of 1912	1488	4bb0de84d1a866bc340b00c69a0b7fd0_NeikiAnalytics.exe	107
PID 1488 wrote to memory of 2176	1488	4bb0de84d1a866bc340b00c69a0b7fd0_NeikiAnalytics.exe	108
PID 1488 wrote to memory of 2176	1488	4bb0de84d1a866bc340b00c69a0b7fd0_NeikiAnalytics.exe	108
PID 1488 wrote to memory of 3440	1488	4bb0de84d1a866bc340b00c69a0b7fd0_NeikiAnalytics.exe	109
PID 1488 wrote to memory of 3440	1488	4bb0de84d1a866bc340b00c69a0b7fd0_NeikiAnalytics.exe	109
PID 1488 wrote to memory of 2984	1488	4bb0de84d1a866bc340b00c69a0b7fd0_NeikiAnalytics.exe	110
PID 1488 wrote to memory of 2984	1488	4bb0de84d1a866bc340b00c69a0b7fd0_NeikiAnalytics.exe	110
PID 1488 wrote to memory of 4452	1488	4bb0de84d1a866bc340b00c69a0b7fd0_NeikiAnalytics.exe	111
PID 1488 wrote to memory of 4452	1488	4bb0de84d1a866bc340b00c69a0b7fd0_NeikiAnalytics.exe	111
PID 1488 wrote to memory of 4528	1488	4bb0de84d1a866bc340b00c69a0b7fd0_NeikiAnalytics.exe	112
PID 1488 wrote to memory of 4528	1488	4bb0de84d1a866bc340b00c69a0b7fd0_NeikiAnalytics.exe	112
PID 1488 wrote to memory of 4076	1488	4bb0de84d1a866bc340b00c69a0b7fd0_NeikiAnalytics.exe	113
PID 1488 wrote to memory of 4076	1488	4bb0de84d1a866bc340b00c69a0b7fd0_NeikiAnalytics.exe	113
PID 1488 wrote to memory of 2320	1488	4bb0de84d1a866bc340b00c69a0b7fd0_NeikiAnalytics.exe	114
PID 1488 wrote to memory of 2320	1488	4bb0de84d1a866bc340b00c69a0b7fd0_NeikiAnalytics.exe	114

C:\Users\Admin\AppData\Local\Temp\4bb0de84d1a866bc340b00c69a0b7fd0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\4bb0de84d1a866bc340b00c69a0b7fd0_NeikiAnalytics.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1488
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1588
- - C:\Windows\system32\wermgr.exe
    "C:\Windows\system32\wermgr.exe" "-outproc" "0" "1588" "3008" "2940" "3012" "0" "0" "3016" "0" "0" "0" "0" "0"
    3⤵
    - Checks processor information in registry
    - Enumerates system info in registry
    PID:13008
- C:\Windows\System\mPwMbXS.exe
  C:\Windows\System\mPwMbXS.exe
  2⤵
  - Executes dropped EXE
  PID:1448
- C:\Windows\System\YLWwwJh.exe
  C:\Windows\System\YLWwwJh.exe
  2⤵
  - Executes dropped EXE
  PID:2264
- C:\Windows\System\wlGPxho.exe
  C:\Windows\System\wlGPxho.exe
  2⤵
  - Executes dropped EXE
  PID:3992
- C:\Windows\System\PhdjnIF.exe
  C:\Windows\System\PhdjnIF.exe
  2⤵
  - Executes dropped EXE
  PID:4244
- C:\Windows\System\XltZrLH.exe
  C:\Windows\System\XltZrLH.exe
  2⤵
  - Executes dropped EXE
  PID:2464
- C:\Windows\System\JBzuxOT.exe
  C:\Windows\System\JBzuxOT.exe
  2⤵
  - Executes dropped EXE
  PID:3968
- C:\Windows\System\AoXDPLJ.exe
  C:\Windows\System\AoXDPLJ.exe
  2⤵
  - Executes dropped EXE
  PID:3432
- C:\Windows\System\JKSaWdU.exe
  C:\Windows\System\JKSaWdU.exe
  2⤵
  - Executes dropped EXE
  PID:2560
- C:\Windows\System\MJvhwPG.exe
  C:\Windows\System\MJvhwPG.exe
  2⤵
  - Executes dropped EXE
  PID:808
- C:\Windows\System\YCqmKKH.exe
  C:\Windows\System\YCqmKKH.exe
  2⤵
  - Executes dropped EXE
  PID:2144
- C:\Windows\System\XozXZGy.exe
  C:\Windows\System\XozXZGy.exe
  2⤵
  - Executes dropped EXE
  PID:1500
- C:\Windows\System\vQoqsLx.exe
  C:\Windows\System\vQoqsLx.exe
  2⤵
  - Executes dropped EXE
  PID:5004
- C:\Windows\System\cUBpDWq.exe
  C:\Windows\System\cUBpDWq.exe
  2⤵
  - Executes dropped EXE
  PID:1176
- C:\Windows\System\CpnqRKU.exe
  C:\Windows\System\CpnqRKU.exe
  2⤵
  - Executes dropped EXE
  PID:456
- C:\Windows\System\JhJZryC.exe
  C:\Windows\System\JhJZryC.exe
  2⤵
  - Executes dropped EXE
  PID:3160
- C:\Windows\System\kyDOnvt.exe
  C:\Windows\System\kyDOnvt.exe
  2⤵
  - Executes dropped EXE
  PID:3564
- C:\Windows\System\FzPxsNQ.exe
  C:\Windows\System\FzPxsNQ.exe
  2⤵
  - Executes dropped EXE
  PID:4632
- C:\Windows\System\KHbbkQi.exe
  C:\Windows\System\KHbbkQi.exe
  2⤵
  - Executes dropped EXE
  PID:1372
- C:\Windows\System\ruXDCUN.exe
  C:\Windows\System\ruXDCUN.exe
  2⤵
  - Executes dropped EXE
  PID:4392
- C:\Windows\System\LLSeDXl.exe
  C:\Windows\System\LLSeDXl.exe
  2⤵
  - Executes dropped EXE
  PID:4004
- C:\Windows\System\GsxlstI.exe
  C:\Windows\System\GsxlstI.exe
  2⤵
  - Executes dropped EXE
  PID:1772
- C:\Windows\System\aJyyNlY.exe
  C:\Windows\System\aJyyNlY.exe
  2⤵
  - Executes dropped EXE
  PID:1388
- C:\Windows\System\whaMVIT.exe
  C:\Windows\System\whaMVIT.exe
  2⤵
  - Executes dropped EXE
  PID:2512
- C:\Windows\System\AdGVmFR.exe
  C:\Windows\System\AdGVmFR.exe
  2⤵
  - Executes dropped EXE
  PID:1912
- C:\Windows\System\qrSaZgQ.exe
  C:\Windows\System\qrSaZgQ.exe
  2⤵
  - Executes dropped EXE
  PID:2176
- C:\Windows\System\iZEdpQi.exe
  C:\Windows\System\iZEdpQi.exe
  2⤵
  - Executes dropped EXE
  PID:3440
- C:\Windows\System\HzqdzIZ.exe
  C:\Windows\System\HzqdzIZ.exe
  2⤵
  - Executes dropped EXE
  PID:2984
- C:\Windows\System\cXVKlFk.exe
  C:\Windows\System\cXVKlFk.exe
  2⤵
  - Executes dropped EXE
  PID:4452
- C:\Windows\System\QcQynjJ.exe
  C:\Windows\System\QcQynjJ.exe
  2⤵
  - Executes dropped EXE
  PID:4528
- C:\Windows\System\nONkfmh.exe
  C:\Windows\System\nONkfmh.exe
  2⤵
  - Executes dropped EXE
  PID:4076
- C:\Windows\System\MxDBSof.exe
  C:\Windows\System\MxDBSof.exe
  2⤵
  - Executes dropped EXE
  PID:2320
- C:\Windows\System\IrVHgak.exe
  C:\Windows\System\IrVHgak.exe
  2⤵
  - Executes dropped EXE
  PID:2332
- C:\Windows\System\KiJMIgz.exe
  C:\Windows\System\KiJMIgz.exe
  2⤵
  - Executes dropped EXE
  PID:3144
- C:\Windows\System\XFaEnmJ.exe
  C:\Windows\System\XFaEnmJ.exe
  2⤵
  - Executes dropped EXE
  PID:824
- C:\Windows\System\AcgIUFg.exe
  C:\Windows\System\AcgIUFg.exe
  2⤵
  - Executes dropped EXE
  PID:2964
- C:\Windows\System\gqgpFQq.exe
  C:\Windows\System\gqgpFQq.exe
  2⤵
  - Executes dropped EXE
  PID:4300
- C:\Windows\System\lzMHFpZ.exe
  C:\Windows\System\lzMHFpZ.exe
  2⤵
  - Executes dropped EXE
  PID:1484
- C:\Windows\System\oGPfoyq.exe
  C:\Windows\System\oGPfoyq.exe
  2⤵
  - Executes dropped EXE
  PID:4136
- C:\Windows\System\diJgaYv.exe
  C:\Windows\System\diJgaYv.exe
  2⤵
  - Executes dropped EXE
  PID:1104
- C:\Windows\System\clcilUZ.exe
  C:\Windows\System\clcilUZ.exe
  2⤵
  - Executes dropped EXE
  PID:4436
- C:\Windows\System\IiJJYqZ.exe
  C:\Windows\System\IiJJYqZ.exe
  2⤵
  - Executes dropped EXE
  PID:3292
- C:\Windows\System\mxstCZD.exe
  C:\Windows\System\mxstCZD.exe
  2⤵
  - Executes dropped EXE
  PID:1440
- C:\Windows\System\TvRyuVh.exe
  C:\Windows\System\TvRyuVh.exe
  2⤵
  - Executes dropped EXE
  PID:512
- C:\Windows\System\pcDgrfL.exe
  C:\Windows\System\pcDgrfL.exe
  2⤵
  - Executes dropped EXE
  PID:4364
- C:\Windows\System\kjgCqDS.exe
  C:\Windows\System\kjgCqDS.exe
  2⤵
  - Executes dropped EXE
  PID:3368
- C:\Windows\System\EZUwAqF.exe
  C:\Windows\System\EZUwAqF.exe
  2⤵
  - Executes dropped EXE
  PID:4636
- C:\Windows\System\sKCUHbI.exe
  C:\Windows\System\sKCUHbI.exe
  2⤵
  - Executes dropped EXE
  PID:3504
- C:\Windows\System\IuvxNaT.exe
  C:\Windows\System\IuvxNaT.exe
  2⤵
  - Executes dropped EXE
  PID:3224
- C:\Windows\System\tLRrXsP.exe
  C:\Windows\System\tLRrXsP.exe
  2⤵
  - Executes dropped EXE
  PID:3580
- C:\Windows\System\IHxmBGC.exe
  C:\Windows\System\IHxmBGC.exe
  2⤵
  - Executes dropped EXE
  PID:3920
- C:\Windows\System\zdALgHy.exe
  C:\Windows\System\zdALgHy.exe
  2⤵
  - Executes dropped EXE
  PID:2184
- C:\Windows\System\FyWyqUJ.exe
  C:\Windows\System\FyWyqUJ.exe
  2⤵
  - Executes dropped EXE
  PID:388
- C:\Windows\System\GbubQKZ.exe
  C:\Windows\System\GbubQKZ.exe
  2⤵
  - Executes dropped EXE
  PID:4772
- C:\Windows\System\BTncAIx.exe
  C:\Windows\System\BTncAIx.exe
  2⤵
  - Executes dropped EXE
  PID:3352
- C:\Windows\System\lXVFvmn.exe
  C:\Windows\System\lXVFvmn.exe
  2⤵
  - Executes dropped EXE
  PID:2152
- C:\Windows\System\uzywXBd.exe
  C:\Windows\System\uzywXBd.exe
  2⤵
  - Executes dropped EXE
  PID:4748
- C:\Windows\System\QlvsWKc.exe
  C:\Windows\System\QlvsWKc.exe
  2⤵
  - Executes dropped EXE
  PID:5072
- C:\Windows\System\ywSnGBE.exe
  C:\Windows\System\ywSnGBE.exe
  2⤵
  - Executes dropped EXE
  PID:4132
- C:\Windows\System\RGhjNxu.exe
  C:\Windows\System\RGhjNxu.exe
  2⤵
  - Executes dropped EXE
  PID:372
- C:\Windows\System\YQHOJcm.exe
  C:\Windows\System\YQHOJcm.exe
  2⤵
  - Executes dropped EXE
  PID:4840
- C:\Windows\System\fipFTlk.exe
  C:\Windows\System\fipFTlk.exe
  2⤵
  - Executes dropped EXE
  PID:4320
- C:\Windows\System\JFTvJjo.exe
  C:\Windows\System\JFTvJjo.exe
  2⤵
  - Executes dropped EXE
  PID:3204
- C:\Windows\System\HjxuJcn.exe
  C:\Windows\System\HjxuJcn.exe
  2⤵
  - Executes dropped EXE
  PID:3092
- C:\Windows\System\bHieTUg.exe
  C:\Windows\System\bHieTUg.exe
  2⤵
  - Executes dropped EXE
  PID:4852
- C:\Windows\System\ycsgPQZ.exe
  C:\Windows\System\ycsgPQZ.exe
  2⤵
  PID:3904
- C:\Windows\System\FGrSXzJ.exe
  C:\Windows\System\FGrSXzJ.exe
  2⤵
  PID:3104
- C:\Windows\System\QHzKcxw.exe
  C:\Windows\System\QHzKcxw.exe
  2⤵
  PID:4800
- C:\Windows\System\hepjngo.exe
  C:\Windows\System\hepjngo.exe
  2⤵
  PID:4536
- C:\Windows\System\oEQVDld.exe
  C:\Windows\System\oEQVDld.exe
  2⤵
  PID:1944
- C:\Windows\System\EztYTWO.exe
  C:\Windows\System\EztYTWO.exe
  2⤵
  PID:412
- C:\Windows\System\RPAtzXV.exe
  C:\Windows\System\RPAtzXV.exe
  2⤵
  PID:5156
- C:\Windows\System\gFhtYdX.exe
  C:\Windows\System\gFhtYdX.exe
  2⤵
  PID:5180
- C:\Windows\System\JOCmIBy.exe
  C:\Windows\System\JOCmIBy.exe
  2⤵
  PID:5208
- C:\Windows\System\NNfLNcR.exe
  C:\Windows\System\NNfLNcR.exe
  2⤵
  PID:5240
- C:\Windows\System\ylwxnfk.exe
  C:\Windows\System\ylwxnfk.exe
  2⤵
  PID:5268
- C:\Windows\System\mtIZPCd.exe
  C:\Windows\System\mtIZPCd.exe
  2⤵
  PID:5300
- C:\Windows\System\DpQXtQx.exe
  C:\Windows\System\DpQXtQx.exe
  2⤵
  PID:5328
- C:\Windows\System\UtMsaaT.exe
  C:\Windows\System\UtMsaaT.exe
  2⤵
  PID:5364
- C:\Windows\System\pYAKgBN.exe
  C:\Windows\System\pYAKgBN.exe
  2⤵
  PID:5388
- C:\Windows\System\BWdSxSw.exe
  C:\Windows\System\BWdSxSw.exe
  2⤵
  PID:5420
- C:\Windows\System\DJanQyV.exe
  C:\Windows\System\DJanQyV.exe
  2⤵
  PID:5444
- C:\Windows\System\TOawqPL.exe
  C:\Windows\System\TOawqPL.exe
  2⤵
  PID:5464
- C:\Windows\System\tjgSNvA.exe
  C:\Windows\System\tjgSNvA.exe
  2⤵
  PID:5492
- C:\Windows\System\JCQFBqA.exe
  C:\Windows\System\JCQFBqA.exe
  2⤵
  PID:5520
- C:\Windows\System\WOFaiku.exe
  C:\Windows\System\WOFaiku.exe
  2⤵
  PID:5544
- C:\Windows\System\eagtHiJ.exe
  C:\Windows\System\eagtHiJ.exe
  2⤵
  PID:5576
- C:\Windows\System\fpEwhmC.exe
  C:\Windows\System\fpEwhmC.exe
  2⤵
  PID:5600
- C:\Windows\System\TAvjqml.exe
  C:\Windows\System\TAvjqml.exe
  2⤵
  PID:5632
- C:\Windows\System\RIuKaXn.exe
  C:\Windows\System\RIuKaXn.exe
  2⤵
  PID:5656
- C:\Windows\System\YaEArIN.exe
  C:\Windows\System\YaEArIN.exe
  2⤵
  PID:5692
- C:\Windows\System\zqaWULQ.exe
  C:\Windows\System\zqaWULQ.exe
  2⤵
  PID:5720
- C:\Windows\System\FZNvZlu.exe
  C:\Windows\System\FZNvZlu.exe
  2⤵
  PID:5748
- C:\Windows\System\HdEWOKI.exe
  C:\Windows\System\HdEWOKI.exe
  2⤵
  PID:5776
- C:\Windows\System\brfBQfH.exe
  C:\Windows\System\brfBQfH.exe
  2⤵
  PID:5800
- C:\Windows\System\dAZArkc.exe
  C:\Windows\System\dAZArkc.exe
  2⤵
  PID:5828
- C:\Windows\System\zpMtzJG.exe
  C:\Windows\System\zpMtzJG.exe
  2⤵
  PID:5856
- C:\Windows\System\zutRaoY.exe
  C:\Windows\System\zutRaoY.exe
  2⤵
  PID:5888
- C:\Windows\System\mSJdZFY.exe
  C:\Windows\System\mSJdZFY.exe
  2⤵
  PID:5912
- C:\Windows\System\GqHtmCz.exe
  C:\Windows\System\GqHtmCz.exe
  2⤵
  PID:5944
- C:\Windows\System\TitZLIP.exe
  C:\Windows\System\TitZLIP.exe
  2⤵
  PID:5968
- C:\Windows\System\dLInydY.exe
  C:\Windows\System\dLInydY.exe
  2⤵
  PID:5996
- C:\Windows\System\fGSJYpT.exe
  C:\Windows\System\fGSJYpT.exe
  2⤵
  PID:6028
- C:\Windows\System\hlxxZpX.exe
  C:\Windows\System\hlxxZpX.exe
  2⤵
  PID:6056
- C:\Windows\System\dnmXOMH.exe
  C:\Windows\System\dnmXOMH.exe
  2⤵
  PID:6080
- C:\Windows\System\vaPZoRR.exe
  C:\Windows\System\vaPZoRR.exe
  2⤵
  PID:6108
- C:\Windows\System\bBdSVBj.exe
  C:\Windows\System\bBdSVBj.exe
  2⤵
  PID:6140
- C:\Windows\System\WKrUwAk.exe
  C:\Windows\System\WKrUwAk.exe
  2⤵
  PID:3324
- C:\Windows\System\uFOVWvS.exe
  C:\Windows\System\uFOVWvS.exe
  2⤵
  PID:688
- C:\Windows\System\dfpqmZo.exe
  C:\Windows\System\dfpqmZo.exe
  2⤵
  PID:2228
- C:\Windows\System\ZYUdgfY.exe
  C:\Windows\System\ZYUdgfY.exe
  2⤵
  PID:1968
- C:\Windows\System\IPGeeFV.exe
  C:\Windows\System\IPGeeFV.exe
  2⤵
  PID:5148
- C:\Windows\System\NCENQvL.exe
  C:\Windows\System\NCENQvL.exe
  2⤵
  PID:5200
- C:\Windows\System\nfpJNZO.exe
  C:\Windows\System\nfpJNZO.exe
  2⤵
  PID:5260
- C:\Windows\System\zeWwCah.exe
  C:\Windows\System\zeWwCah.exe
  2⤵
  PID:5324
- C:\Windows\System\XCLUqaw.exe
  C:\Windows\System\XCLUqaw.exe
  2⤵
  PID:4184
- C:\Windows\System\LHuuFqr.exe
  C:\Windows\System\LHuuFqr.exe
  2⤵
  PID:5456
- C:\Windows\System\pHbsqSQ.exe
  C:\Windows\System\pHbsqSQ.exe
  2⤵
  PID:5512
- C:\Windows\System\qPKZjhJ.exe
  C:\Windows\System\qPKZjhJ.exe
  2⤵
  PID:5568
- C:\Windows\System\TvKYLWP.exe
  C:\Windows\System\TvKYLWP.exe
  2⤵
  PID:5644
- C:\Windows\System\DtCnqLE.exe
  C:\Windows\System\DtCnqLE.exe
  2⤵
  PID:5712
- C:\Windows\System\xLGHfbv.exe
  C:\Windows\System\xLGHfbv.exe
  2⤵
  PID:3100
- C:\Windows\System\veHeErR.exe
  C:\Windows\System\veHeErR.exe
  2⤵
  PID:5820
- C:\Windows\System\MmikuHb.exe
  C:\Windows\System\MmikuHb.exe
  2⤵
  PID:5880
- C:\Windows\System\cvqyNGg.exe
  C:\Windows\System\cvqyNGg.exe
  2⤵
  PID:5932
- C:\Windows\System\IKjfVEq.exe
  C:\Windows\System\IKjfVEq.exe
  2⤵
  PID:5984
- C:\Windows\System\sComCGa.exe
  C:\Windows\System\sComCGa.exe
  2⤵
  PID:6048
- C:\Windows\System\stMNnva.exe
  C:\Windows\System\stMNnva.exe
  2⤵
  PID:6124
- C:\Windows\System\KfFjPdP.exe
  C:\Windows\System\KfFjPdP.exe
  2⤵
  PID:1892
- C:\Windows\System\IrFibzg.exe
  C:\Windows\System\IrFibzg.exe
  2⤵
  PID:3012
- C:\Windows\System\KicMMnr.exe
  C:\Windows\System\KicMMnr.exe
  2⤵
  PID:5248
- C:\Windows\System\DwQZpSe.exe
  C:\Windows\System\DwQZpSe.exe
  2⤵
  PID:5380
- C:\Windows\System\ZEEMPTX.exe
  C:\Windows\System\ZEEMPTX.exe
  2⤵
  PID:5504
- C:\Windows\System\kpMZhMi.exe
  C:\Windows\System\kpMZhMi.exe
  2⤵
  PID:468
- C:\Windows\System\HFKbocR.exe
  C:\Windows\System\HFKbocR.exe
  2⤵
  PID:1080
- C:\Windows\System\kusQtud.exe
  C:\Windows\System\kusQtud.exe
  2⤵
  PID:5852
- C:\Windows\System\TyJcvFh.exe
  C:\Windows\System\TyJcvFh.exe
  2⤵
  PID:1852
- C:\Windows\System\vjTpbla.exe
  C:\Windows\System\vjTpbla.exe
  2⤵
  PID:6040
- C:\Windows\System\lHRLMDl.exe
  C:\Windows\System\lHRLMDl.exe
  2⤵
  PID:1576
- C:\Windows\System\YdeDuIf.exe
  C:\Windows\System\YdeDuIf.exe
  2⤵
  PID:2524
- C:\Windows\System\WrWxOLE.exe
  C:\Windows\System\WrWxOLE.exe
  2⤵
  PID:2676
- C:\Windows\System\GsjVonq.exe
  C:\Windows\System\GsjVonq.exe
  2⤵
  PID:5616
- C:\Windows\System\PpPclJS.exe
  C:\Windows\System\PpPclJS.exe
  2⤵
  PID:5032
- C:\Windows\System\yAZhYzo.exe
  C:\Windows\System\yAZhYzo.exe
  2⤵
  PID:4028
- C:\Windows\System\oHSuwdi.exe
  C:\Windows\System\oHSuwdi.exe
  2⤵
  PID:1124
- C:\Windows\System\Brkyglm.exe
  C:\Windows\System\Brkyglm.exe
  2⤵
  PID:3752
- C:\Windows\System\DTxodoJ.exe
  C:\Windows\System\DTxodoJ.exe
  2⤵
  PID:540
- C:\Windows\System\aqhZarB.exe
  C:\Windows\System\aqhZarB.exe
  2⤵
  PID:6156
- C:\Windows\System\QqQFLHo.exe
  C:\Windows\System\QqQFLHo.exe
  2⤵
  PID:6180
- C:\Windows\System\RwarMii.exe
  C:\Windows\System\RwarMii.exe
  2⤵
  PID:6212
- C:\Windows\System\LFAegtn.exe
  C:\Windows\System\LFAegtn.exe
  2⤵
  PID:6236
- C:\Windows\System\gtMxhqp.exe
  C:\Windows\System\gtMxhqp.exe
  2⤵
  PID:6264
- C:\Windows\System\mqZbjkP.exe
  C:\Windows\System\mqZbjkP.exe
  2⤵
  PID:6296
- C:\Windows\System\ZjDHGVq.exe
  C:\Windows\System\ZjDHGVq.exe
  2⤵
  PID:6324
- C:\Windows\System\wZFDiBD.exe
  C:\Windows\System\wZFDiBD.exe
  2⤵
  PID:6352
- C:\Windows\System\WDLnnvK.exe
  C:\Windows\System\WDLnnvK.exe
  2⤵
  PID:6376
- C:\Windows\System\bUDGlQJ.exe
  C:\Windows\System\bUDGlQJ.exe
  2⤵
  PID:6408
- C:\Windows\System\dNFunpO.exe
  C:\Windows\System\dNFunpO.exe
  2⤵
  PID:6436
- C:\Windows\System\JYbzpgt.exe
  C:\Windows\System\JYbzpgt.exe
  2⤵
  PID:6464
- C:\Windows\System\DAGcjSl.exe
  C:\Windows\System\DAGcjSl.exe
  2⤵
  PID:6492
- C:\Windows\System\SPOSgRv.exe
  C:\Windows\System\SPOSgRv.exe
  2⤵
  PID:6520
- C:\Windows\System\xHYrTeZ.exe
  C:\Windows\System\xHYrTeZ.exe
  2⤵
  PID:6548
- C:\Windows\System\IqQhcMd.exe
  C:\Windows\System\IqQhcMd.exe
  2⤵
  PID:6576
- C:\Windows\System\neyGJzA.exe
  C:\Windows\System\neyGJzA.exe
  2⤵
  PID:6604
- C:\Windows\System\MpNXJWM.exe
  C:\Windows\System\MpNXJWM.exe
  2⤵
  PID:6628
- C:\Windows\System\hCwPIGO.exe
  C:\Windows\System\hCwPIGO.exe
  2⤵
  PID:6660
- C:\Windows\System\AvcuiTs.exe
  C:\Windows\System\AvcuiTs.exe
  2⤵
  PID:6688
- C:\Windows\System\ekEfrpQ.exe
  C:\Windows\System\ekEfrpQ.exe
  2⤵
  PID:6712
- C:\Windows\System\ucHonFs.exe
  C:\Windows\System\ucHonFs.exe
  2⤵
  PID:6740
- C:\Windows\System\cEjXvOR.exe
  C:\Windows\System\cEjXvOR.exe
  2⤵
  PID:6772
- C:\Windows\System\qZrdamE.exe
  C:\Windows\System\qZrdamE.exe
  2⤵
  PID:6796
- C:\Windows\System\sedWcIt.exe
  C:\Windows\System\sedWcIt.exe
  2⤵
  PID:6828
- C:\Windows\System\wvbEYWK.exe
  C:\Windows\System\wvbEYWK.exe
  2⤵
  PID:6852
- C:\Windows\System\ZpeGTww.exe
  C:\Windows\System\ZpeGTww.exe
  2⤵
  PID:6880
- C:\Windows\System\jdyofTD.exe
  C:\Windows\System\jdyofTD.exe
  2⤵
  PID:6916
- C:\Windows\System\uytmIOq.exe
  C:\Windows\System\uytmIOq.exe
  2⤵
  PID:6940
- C:\Windows\System\UdOhrAh.exe
  C:\Windows\System\UdOhrAh.exe
  2⤵
  PID:6968
- C:\Windows\System\SQLlTAN.exe
  C:\Windows\System\SQLlTAN.exe
  2⤵
  PID:6996
- C:\Windows\System\oSzevzD.exe
  C:\Windows\System\oSzevzD.exe
  2⤵
  PID:7020
- C:\Windows\System\JBnsduo.exe
  C:\Windows\System\JBnsduo.exe
  2⤵
  PID:7052
- C:\Windows\System\fVnjsHg.exe
  C:\Windows\System\fVnjsHg.exe
  2⤵
  PID:7076
- C:\Windows\System\klbklrJ.exe
  C:\Windows\System\klbklrJ.exe
  2⤵
  PID:7108
- C:\Windows\System\rAraJjY.exe
  C:\Windows\System\rAraJjY.exe
  2⤵
  PID:7132
- C:\Windows\System\WraIiDq.exe
  C:\Windows\System\WraIiDq.exe
  2⤵
  PID:7160
- C:\Windows\System\rndJBlK.exe
  C:\Windows\System\rndJBlK.exe
  2⤵
  PID:1620
- C:\Windows\System\ApebDiK.exe
  C:\Windows\System\ApebDiK.exe
  2⤵
  PID:2428
- C:\Windows\System\DvgkQuY.exe
  C:\Windows\System\DvgkQuY.exe
  2⤵
  PID:4308
- C:\Windows\System\rJWQlRR.exe
  C:\Windows\System\rJWQlRR.exe
  2⤵
  PID:6172
- C:\Windows\System\EmcTACj.exe
  C:\Windows\System\EmcTACj.exe
  2⤵
  PID:6228
- C:\Windows\System\gVWkFwz.exe
  C:\Windows\System\gVWkFwz.exe
  2⤵
  PID:6284
- C:\Windows\System\IcnfCQE.exe
  C:\Windows\System\IcnfCQE.exe
  2⤵
  PID:6364
- C:\Windows\System\ffSexdp.exe
  C:\Windows\System\ffSexdp.exe
  2⤵
  PID:6424
- C:\Windows\System\QSEwhbN.exe
  C:\Windows\System\QSEwhbN.exe
  2⤵
  PID:6484
- C:\Windows\System\SCddqhz.exe
  C:\Windows\System\SCddqhz.exe
  2⤵
  PID:6560
- C:\Windows\System\NWhuyqj.exe
  C:\Windows\System\NWhuyqj.exe
  2⤵
  PID:6620
- C:\Windows\System\RcGfPcK.exe
  C:\Windows\System\RcGfPcK.exe
  2⤵
  PID:6676
- C:\Windows\System\WehPNYi.exe
  C:\Windows\System\WehPNYi.exe
  2⤵
  PID:6736
- C:\Windows\System\QGvofvp.exe
  C:\Windows\System\QGvofvp.exe
  2⤵
  PID:6812
- C:\Windows\System\EwBgkaY.exe
  C:\Windows\System\EwBgkaY.exe
  2⤵
  PID:6872
- C:\Windows\System\DdapfPK.exe
  C:\Windows\System\DdapfPK.exe
  2⤵
  PID:6936
- C:\Windows\System\VuNrjDR.exe
  C:\Windows\System\VuNrjDR.exe
  2⤵
  PID:7008
- C:\Windows\System\KxSuOIK.exe
  C:\Windows\System\KxSuOIK.exe
  2⤵
  PID:7124
- C:\Windows\System\sjXGlSz.exe
  C:\Windows\System\sjXGlSz.exe
  2⤵
  PID:4660
- C:\Windows\System\GfHQuPx.exe
  C:\Windows\System\GfHQuPx.exe
  2⤵
  PID:4940
- C:\Windows\System\rOZPUjA.exe
  C:\Windows\System\rOZPUjA.exe
  2⤵
  PID:6280
- C:\Windows\System\jGqjXSC.exe
  C:\Windows\System\jGqjXSC.exe
  2⤵
  PID:6400
- C:\Windows\System\DxcpUCh.exe
  C:\Windows\System\DxcpUCh.exe
  2⤵
  PID:6588
- C:\Windows\System\UgVZUPf.exe
  C:\Windows\System\UgVZUPf.exe
  2⤵
  PID:6652
- C:\Windows\System\zIIepZB.exe
  C:\Windows\System\zIIepZB.exe
  2⤵
  PID:6728
- C:\Windows\System\diTCKQn.exe
  C:\Windows\System\diTCKQn.exe
  2⤵
  PID:6840
- C:\Windows\System\GDhIBBy.exe
  C:\Windows\System\GDhIBBy.exe
  2⤵
  PID:6980
- C:\Windows\System\CJbfAAI.exe
  C:\Windows\System\CJbfAAI.exe
  2⤵
  PID:2300
- C:\Windows\System\ZqiAfzX.exe
  C:\Windows\System\ZqiAfzX.exe
  2⤵
  PID:904
- C:\Windows\System\zAvXYqI.exe
  C:\Windows\System\zAvXYqI.exe
  2⤵
  PID:5376
- C:\Windows\System\xsjlATo.exe
  C:\Windows\System\xsjlATo.exe
  2⤵
  PID:3552
- C:\Windows\System\quPFTVJ.exe
  C:\Windows\System\quPFTVJ.exe
  2⤵
  PID:6340
- C:\Windows\System\kTPEFqQ.exe
  C:\Windows\System\kTPEFqQ.exe
  2⤵
  PID:6708
- C:\Windows\System\KeDKxyB.exe
  C:\Windows\System\KeDKxyB.exe
  2⤵
  PID:740
- C:\Windows\System\csqZGWb.exe
  C:\Windows\System\csqZGWb.exe
  2⤵
  PID:7068
- C:\Windows\System\wPkQKfd.exe
  C:\Windows\System\wPkQKfd.exe
  2⤵
  PID:3864
- C:\Windows\System\bcQiziT.exe
  C:\Windows\System\bcQiziT.exe
  2⤵
  PID:7180
- C:\Windows\System\bsudNtm.exe
  C:\Windows\System\bsudNtm.exe
  2⤵
  PID:7212
- C:\Windows\System\jWNvwrI.exe
  C:\Windows\System\jWNvwrI.exe
  2⤵
  PID:7228
- C:\Windows\System\jVBtqIy.exe
  C:\Windows\System\jVBtqIy.exe
  2⤵
  PID:7244
- C:\Windows\System\YntCCdi.exe
  C:\Windows\System\YntCCdi.exe
  2⤵
  PID:7264
- C:\Windows\System\sYJbInO.exe
  C:\Windows\System\sYJbInO.exe
  2⤵
  PID:7284
- C:\Windows\System\FFbpFcc.exe
  C:\Windows\System\FFbpFcc.exe
  2⤵
  PID:7304
- C:\Windows\System\ChCiVoA.exe
  C:\Windows\System\ChCiVoA.exe
  2⤵
  PID:7348
- C:\Windows\System\xejHpOO.exe
  C:\Windows\System\xejHpOO.exe
  2⤵
  PID:7376
- C:\Windows\System\MUfSTsO.exe
  C:\Windows\System\MUfSTsO.exe
  2⤵
  PID:7396
- C:\Windows\System\xUQAssy.exe
  C:\Windows\System\xUQAssy.exe
  2⤵
  PID:7452
- C:\Windows\System\QElzIwc.exe
  C:\Windows\System\QElzIwc.exe
  2⤵
  PID:7484
- C:\Windows\System\xDpESqD.exe
  C:\Windows\System\xDpESqD.exe
  2⤵
  PID:7520
- C:\Windows\System\JyVvpGR.exe
  C:\Windows\System\JyVvpGR.exe
  2⤵
  PID:7540
- C:\Windows\System\NjFZrXD.exe
  C:\Windows\System\NjFZrXD.exe
  2⤵
  PID:7560
- C:\Windows\System\NySjxsw.exe
  C:\Windows\System\NySjxsw.exe
  2⤵
  PID:7588
- C:\Windows\System\kympmbm.exe
  C:\Windows\System\kympmbm.exe
  2⤵
  PID:7636
- C:\Windows\System\oevlRMz.exe
  C:\Windows\System\oevlRMz.exe
  2⤵
  PID:7672
- C:\Windows\System\ZGaYJSu.exe
  C:\Windows\System\ZGaYJSu.exe
  2⤵
  PID:7692
- C:\Windows\System\lodvFGH.exe
  C:\Windows\System\lodvFGH.exe
  2⤵
  PID:7708
- C:\Windows\System\HPoBFDR.exe
  C:\Windows\System\HPoBFDR.exe
  2⤵
  PID:7736
- C:\Windows\System\TlbeHis.exe
  C:\Windows\System\TlbeHis.exe
  2⤵
  PID:7752
- C:\Windows\System\xSBwysj.exe
  C:\Windows\System\xSBwysj.exe
  2⤵
  PID:7776
- C:\Windows\System\neSEuTC.exe
  C:\Windows\System\neSEuTC.exe
  2⤵
  PID:7796
- C:\Windows\System\EweHGWR.exe
  C:\Windows\System\EweHGWR.exe
  2⤵
  PID:7816
- C:\Windows\System\abEExlg.exe
  C:\Windows\System\abEExlg.exe
  2⤵
  PID:7836
- C:\Windows\System\GpXSTND.exe
  C:\Windows\System\GpXSTND.exe
  2⤵
  PID:7868
- C:\Windows\System\PUbjcUW.exe
  C:\Windows\System\PUbjcUW.exe
  2⤵
  PID:7892
- C:\Windows\System\nWlfWvR.exe
  C:\Windows\System\nWlfWvR.exe
  2⤵
  PID:7956
- C:\Windows\System\QohRewh.exe
  C:\Windows\System\QohRewh.exe
  2⤵
  PID:7976
- C:\Windows\System\zPhPhiA.exe
  C:\Windows\System\zPhPhiA.exe
  2⤵
  PID:8016
- C:\Windows\System\hyLVdXC.exe
  C:\Windows\System\hyLVdXC.exe
  2⤵
  PID:8044
- C:\Windows\System\eGbGCNy.exe
  C:\Windows\System\eGbGCNy.exe
  2⤵
  PID:8064
- C:\Windows\System\KXBSRZS.exe
  C:\Windows\System\KXBSRZS.exe
  2⤵
  PID:8100
- C:\Windows\System\ZyIaNtr.exe
  C:\Windows\System\ZyIaNtr.exe
  2⤵
  PID:8140
- C:\Windows\System\vumtlKE.exe
  C:\Windows\System\vumtlKE.exe
  2⤵
  PID:8160
- C:\Windows\System\JjPIrKh.exe
  C:\Windows\System\JjPIrKh.exe
  2⤵
  PID:8188
- C:\Windows\System\aVbqQRy.exe
  C:\Windows\System\aVbqQRy.exe
  2⤵
  PID:7172
- C:\Windows\System\vwqEFDN.exe
  C:\Windows\System\vwqEFDN.exe
  2⤵
  PID:7220
- C:\Windows\System\XabpBiF.exe
  C:\Windows\System\XabpBiF.exe
  2⤵
  PID:7240
- C:\Windows\System\xlQYvsS.exe
  C:\Windows\System\xlQYvsS.exe
  2⤵
  PID:7332
- C:\Windows\System\yoDfXnu.exe
  C:\Windows\System\yoDfXnu.exe
  2⤵
  PID:7344
- C:\Windows\System\iTZHjeA.exe
  C:\Windows\System\iTZHjeA.exe
  2⤵
  PID:7476
- C:\Windows\System\wVCUgjn.exe
  C:\Windows\System\wVCUgjn.exe
  2⤵
  PID:7536
- C:\Windows\System\GpMhIMn.exe
  C:\Windows\System\GpMhIMn.exe
  2⤵
  PID:7648
- C:\Windows\System\GPMIYFG.exe
  C:\Windows\System\GPMIYFG.exe
  2⤵
  PID:7688
- C:\Windows\System\CWVVvBH.exe
  C:\Windows\System\CWVVvBH.exe
  2⤵
  PID:7744
- C:\Windows\System\yspurBB.exe
  C:\Windows\System\yspurBB.exe
  2⤵
  PID:7828
- C:\Windows\System\RVTjdGs.exe
  C:\Windows\System\RVTjdGs.exe
  2⤵
  PID:7876
- C:\Windows\System\sbZAohz.exe
  C:\Windows\System\sbZAohz.exe
  2⤵
  PID:7860
- C:\Windows\System\ZTkVKDx.exe
  C:\Windows\System\ZTkVKDx.exe
  2⤵
  PID:7988
- C:\Windows\System\vReDSqH.exe
  C:\Windows\System\vReDSqH.exe
  2⤵
  PID:8008
- C:\Windows\System\WHKVqOW.exe
  C:\Windows\System\WHKVqOW.exe
  2⤵
  PID:8096
- C:\Windows\System\CCQtMZt.exe
  C:\Windows\System\CCQtMZt.exe
  2⤵
  PID:8152
- C:\Windows\System\YysnGCt.exe
  C:\Windows\System\YysnGCt.exe
  2⤵
  PID:6600
- C:\Windows\System\VuchrZV.exe
  C:\Windows\System\VuchrZV.exe
  2⤵
  PID:7300
- C:\Windows\System\qDXcLiX.exe
  C:\Windows\System\qDXcLiX.exe
  2⤵
  PID:7428
- C:\Windows\System\QmkXdiF.exe
  C:\Windows\System\QmkXdiF.exe
  2⤵
  PID:7632
- C:\Windows\System\pYDVTcW.exe
  C:\Windows\System\pYDVTcW.exe
  2⤵
  PID:7968
- C:\Windows\System\pfDyJXw.exe
  C:\Windows\System\pfDyJXw.exe
  2⤵
  PID:8112
- C:\Windows\System\MOIsplW.exe
  C:\Windows\System\MOIsplW.exe
  2⤵
  PID:8168
- C:\Windows\System\MlpfYdk.exe
  C:\Windows\System\MlpfYdk.exe
  2⤵
  PID:7280
- C:\Windows\System\fgLsvUB.exe
  C:\Windows\System\fgLsvUB.exe
  2⤵
  PID:7808
- C:\Windows\System\pJgYPYj.exe
  C:\Windows\System\pJgYPYj.exe
  2⤵
  PID:7916
- C:\Windows\System\fAioRqG.exe
  C:\Windows\System\fAioRqG.exe
  2⤵
  PID:8200
- C:\Windows\System\jNPVVqY.exe
  C:\Windows\System\jNPVVqY.exe
  2⤵
  PID:8220
- C:\Windows\System\HMVFzdG.exe
  C:\Windows\System\HMVFzdG.exe
  2⤵
  PID:8244
- C:\Windows\System\LGSpYLk.exe
  C:\Windows\System\LGSpYLk.exe
  2⤵
  PID:8284
- C:\Windows\System\JCgKReb.exe
  C:\Windows\System\JCgKReb.exe
  2⤵
  PID:8308
- C:\Windows\System\oykdLrs.exe
  C:\Windows\System\oykdLrs.exe
  2⤵
  PID:8324
- C:\Windows\System\taecjdy.exe
  C:\Windows\System\taecjdy.exe
  2⤵
  PID:8344
- C:\Windows\System\BvlRDPm.exe
  C:\Windows\System\BvlRDPm.exe
  2⤵
  PID:8368
- C:\Windows\System\svDsMuP.exe
  C:\Windows\System\svDsMuP.exe
  2⤵
  PID:8400
- C:\Windows\System\ecHJLmM.exe
  C:\Windows\System\ecHJLmM.exe
  2⤵
  PID:8416
- C:\Windows\System\cmarxPf.exe
  C:\Windows\System\cmarxPf.exe
  2⤵
  PID:8436
- C:\Windows\System\jdskdVJ.exe
  C:\Windows\System\jdskdVJ.exe
  2⤵
  PID:8492
- C:\Windows\System\QBTQypo.exe
  C:\Windows\System\QBTQypo.exe
  2⤵
  PID:8516
- C:\Windows\System\MhugiNh.exe
  C:\Windows\System\MhugiNh.exe
  2⤵
  PID:8572
- C:\Windows\System\GnHEJls.exe
  C:\Windows\System\GnHEJls.exe
  2⤵
  PID:8588
- C:\Windows\System\hoEICap.exe
  C:\Windows\System\hoEICap.exe
  2⤵
  PID:8624
- C:\Windows\System\ZujHqvC.exe
  C:\Windows\System\ZujHqvC.exe
  2⤵
  PID:8664
- C:\Windows\System\yiAMBwn.exe
  C:\Windows\System\yiAMBwn.exe
  2⤵
  PID:8692
- C:\Windows\System\RoRWasB.exe
  C:\Windows\System\RoRWasB.exe
  2⤵
  PID:8712
- C:\Windows\System\oQwehYV.exe
  C:\Windows\System\oQwehYV.exe
  2⤵
  PID:8728
- C:\Windows\System\YgmQbqQ.exe
  C:\Windows\System\YgmQbqQ.exe
  2⤵
  PID:8756
- C:\Windows\System\szSRymU.exe
  C:\Windows\System\szSRymU.exe
  2⤵
  PID:8772
- C:\Windows\System\VoiNOqx.exe
  C:\Windows\System\VoiNOqx.exe
  2⤵
  PID:8796
- C:\Windows\System\cbmggJC.exe
  C:\Windows\System\cbmggJC.exe
  2⤵
  PID:8836
- C:\Windows\System\azArsEr.exe
  C:\Windows\System\azArsEr.exe
  2⤵
  PID:8864
- C:\Windows\System\bGBIXzK.exe
  C:\Windows\System\bGBIXzK.exe
  2⤵
  PID:8880
- C:\Windows\System\iDILTBv.exe
  C:\Windows\System\iDILTBv.exe
  2⤵
  PID:8912
- C:\Windows\System\ZqnmJqt.exe
  C:\Windows\System\ZqnmJqt.exe
  2⤵
  PID:8936
- C:\Windows\System\pRpVwzz.exe
  C:\Windows\System\pRpVwzz.exe
  2⤵
  PID:8952
- C:\Windows\System\kMilYEo.exe
  C:\Windows\System\kMilYEo.exe
  2⤵
  PID:8996
- C:\Windows\System\dpqwOmX.exe
  C:\Windows\System\dpqwOmX.exe
  2⤵
  PID:9060
- C:\Windows\System\NassKzo.exe
  C:\Windows\System\NassKzo.exe
  2⤵
  PID:9080
- C:\Windows\System\pjhDUzh.exe
  C:\Windows\System\pjhDUzh.exe
  2⤵
  PID:9100
- C:\Windows\System\NcluzSX.exe
  C:\Windows\System\NcluzSX.exe
  2⤵
  PID:9140
- C:\Windows\System\rhTnLYV.exe
  C:\Windows\System\rhTnLYV.exe
  2⤵
  PID:9160
- C:\Windows\System\YZkxdlk.exe
  C:\Windows\System\YZkxdlk.exe
  2⤵
  PID:9188
- C:\Windows\System\SHqsiRf.exe
  C:\Windows\System\SHqsiRf.exe
  2⤵
  PID:9208
- C:\Windows\System\TRjMRsK.exe
  C:\Windows\System\TRjMRsK.exe
  2⤵
  PID:7260
- C:\Windows\System\hdMFFcO.exe
  C:\Windows\System\hdMFFcO.exe
  2⤵
  PID:8272
- C:\Windows\System\vzJTdMK.exe
  C:\Windows\System\vzJTdMK.exe
  2⤵
  PID:8336
- C:\Windows\System\AUlOsDC.exe
  C:\Windows\System\AUlOsDC.exe
  2⤵
  PID:8364
- C:\Windows\System\gqrOnUJ.exe
  C:\Windows\System\gqrOnUJ.exe
  2⤵
  PID:8480
- C:\Windows\System\ZcBQBgg.exe
  C:\Windows\System\ZcBQBgg.exe
  2⤵
  PID:8472
- C:\Windows\System\uOgAIaL.exe
  C:\Windows\System\uOgAIaL.exe
  2⤵
  PID:8616
- C:\Windows\System\KqsKjXP.exe
  C:\Windows\System\KqsKjXP.exe
  2⤵
  PID:8684
- C:\Windows\System\PuPYsxW.exe
  C:\Windows\System\PuPYsxW.exe
  2⤵
  PID:8700
- C:\Windows\System\DUIIOui.exe
  C:\Windows\System\DUIIOui.exe
  2⤵
  PID:8788
- C:\Windows\System\yHjGulA.exe
  C:\Windows\System\yHjGulA.exe
  2⤵
  PID:8820
- C:\Windows\System\QNkEdLf.exe
  C:\Windows\System\QNkEdLf.exe
  2⤵
  PID:8888
- C:\Windows\System\YiwRqmX.exe
  C:\Windows\System\YiwRqmX.exe
  2⤵
  PID:8988
- C:\Windows\System\PxpyXlA.exe
  C:\Windows\System\PxpyXlA.exe
  2⤵
  PID:9020
- C:\Windows\System\AveDIcG.exe
  C:\Windows\System\AveDIcG.exe
  2⤵
  PID:9116
- C:\Windows\System\vBdAZzu.exe
  C:\Windows\System\vBdAZzu.exe
  2⤵
  PID:9172
- C:\Windows\System\kOMoRRa.exe
  C:\Windows\System\kOMoRRa.exe
  2⤵
  PID:7716
- C:\Windows\System\CvHSlsu.exe
  C:\Windows\System\CvHSlsu.exe
  2⤵
  PID:8476
- C:\Windows\System\jZaePTM.exe
  C:\Windows\System\jZaePTM.exe
  2⤵
  PID:8648
- C:\Windows\System\BZadtvu.exe
  C:\Windows\System\BZadtvu.exe
  2⤵
  PID:8748
- C:\Windows\System\JfRDnyr.exe
  C:\Windows\System\JfRDnyr.exe
  2⤵
  PID:8904
- C:\Windows\System\RkCzpjL.exe
  C:\Windows\System\RkCzpjL.exe
  2⤵
  PID:9016
- C:\Windows\System\RVqAqvk.exe
  C:\Windows\System\RVqAqvk.exe
  2⤵
  PID:9156
- C:\Windows\System\scebZtn.exe
  C:\Windows\System\scebZtn.exe
  2⤵
  PID:8408
- C:\Windows\System\UFxpFzT.exe
  C:\Windows\System\UFxpFzT.exe
  2⤵
  PID:8780
- C:\Windows\System\xMxdizx.exe
  C:\Windows\System\xMxdizx.exe
  2⤵
  PID:8872
- C:\Windows\System\ezlbgeu.exe
  C:\Windows\System\ezlbgeu.exe
  2⤵
  PID:8376
- C:\Windows\System\JxfLSRp.exe
  C:\Windows\System\JxfLSRp.exe
  2⤵
  PID:9228
- C:\Windows\System\jgdDNgM.exe
  C:\Windows\System\jgdDNgM.exe
  2⤵
  PID:9252
- C:\Windows\System\XczkhVs.exe
  C:\Windows\System\XczkhVs.exe
  2⤵
  PID:9284
- C:\Windows\System\dYxKRiZ.exe
  C:\Windows\System\dYxKRiZ.exe
  2⤵
  PID:9308
- C:\Windows\System\lbUStDa.exe
  C:\Windows\System\lbUStDa.exe
  2⤵
  PID:9332
- C:\Windows\System\JgFYqdV.exe
  C:\Windows\System\JgFYqdV.exe
  2⤵
  PID:9352
- C:\Windows\System\YSeDJqh.exe
  C:\Windows\System\YSeDJqh.exe
  2⤵
  PID:9368
- C:\Windows\System\oHtpFCN.exe
  C:\Windows\System\oHtpFCN.exe
  2⤵
  PID:9412
- C:\Windows\System\EJljDrR.exe
  C:\Windows\System\EJljDrR.exe
  2⤵
  PID:9448
- C:\Windows\System\kbPXwYM.exe
  C:\Windows\System\kbPXwYM.exe
  2⤵
  PID:9468
- C:\Windows\System\TkakYdF.exe
  C:\Windows\System\TkakYdF.exe
  2⤵
  PID:9528
- C:\Windows\System\MOFzENC.exe
  C:\Windows\System\MOFzENC.exe
  2⤵
  PID:9572
- C:\Windows\System\VJFIXff.exe
  C:\Windows\System\VJFIXff.exe
  2⤵
  PID:9592
- C:\Windows\System\kYkSHDx.exe
  C:\Windows\System\kYkSHDx.exe
  2⤵
  PID:9608
- C:\Windows\System\jOKilwA.exe
  C:\Windows\System\jOKilwA.exe
  2⤵
  PID:9624
- C:\Windows\System\UVaRBfI.exe
  C:\Windows\System\UVaRBfI.exe
  2⤵
  PID:9676
- C:\Windows\System\umOData.exe
  C:\Windows\System\umOData.exe
  2⤵
  PID:9696
- C:\Windows\System\UppvBoG.exe
  C:\Windows\System\UppvBoG.exe
  2⤵
  PID:9728
- C:\Windows\System\iCFyvEV.exe
  C:\Windows\System\iCFyvEV.exe
  2⤵
  PID:9744
- C:\Windows\System\ljAyYVG.exe
  C:\Windows\System\ljAyYVG.exe
  2⤵
  PID:9776
- C:\Windows\System\pzhSidx.exe
  C:\Windows\System\pzhSidx.exe
  2⤵
  PID:9796
- C:\Windows\System\LGOKxdH.exe
  C:\Windows\System\LGOKxdH.exe
  2⤵
  PID:9824
- C:\Windows\System\gsMintJ.exe
  C:\Windows\System\gsMintJ.exe
  2⤵
  PID:9848
- C:\Windows\System\kWtvbjk.exe
  C:\Windows\System\kWtvbjk.exe
  2⤵
  PID:9884
- C:\Windows\System\dbMSgpt.exe
  C:\Windows\System\dbMSgpt.exe
  2⤵
  PID:9912
- C:\Windows\System\HlCjRKF.exe
  C:\Windows\System\HlCjRKF.exe
  2⤵
  PID:9936
- C:\Windows\System\LysRbXH.exe
  C:\Windows\System\LysRbXH.exe
  2⤵
  PID:9956
- C:\Windows\System\rEAcioB.exe
  C:\Windows\System\rEAcioB.exe
  2⤵
  PID:9976
- C:\Windows\System\KChnkLy.exe
  C:\Windows\System\KChnkLy.exe
  2⤵
  PID:9996
- C:\Windows\System\eNxeJUj.exe
  C:\Windows\System\eNxeJUj.exe
  2⤵
  PID:10020
- C:\Windows\System\zZnidfc.exe
  C:\Windows\System\zZnidfc.exe
  2⤵
  PID:10036
- C:\Windows\System\JIZscSB.exe
  C:\Windows\System\JIZscSB.exe
  2⤵
  PID:10064
- C:\Windows\System\tQwlIDg.exe
  C:\Windows\System\tQwlIDg.exe
  2⤵
  PID:10096
- C:\Windows\System\qnATSsO.exe
  C:\Windows\System\qnATSsO.exe
  2⤵
  PID:10152
- C:\Windows\System\jYsRoNo.exe
  C:\Windows\System\jYsRoNo.exe
  2⤵
  PID:10176
- C:\Windows\System\WZZTMSc.exe
  C:\Windows\System\WZZTMSc.exe
  2⤵
  PID:10200
- C:\Windows\System\VadgfpP.exe
  C:\Windows\System\VadgfpP.exe
  2⤵
  PID:9220
- C:\Windows\System\tytMSCJ.exe
  C:\Windows\System\tytMSCJ.exe
  2⤵
  PID:9236
- C:\Windows\System\qUJWTxc.exe
  C:\Windows\System\qUJWTxc.exe
  2⤵
  PID:9360
- C:\Windows\System\LTHMrrs.exe
  C:\Windows\System\LTHMrrs.exe
  2⤵
  PID:9400
- C:\Windows\System\MRkqsot.exe
  C:\Windows\System\MRkqsot.exe
  2⤵
  PID:9316
- C:\Windows\System\penUtdW.exe
  C:\Windows\System\penUtdW.exe
  2⤵
  PID:9508
- C:\Windows\System\yIqKSiL.exe
  C:\Windows\System\yIqKSiL.exe
  2⤵
  PID:9588
- C:\Windows\System\twEWvXA.exe
  C:\Windows\System\twEWvXA.exe
  2⤵
  PID:9688
- C:\Windows\System\dSgweyt.exe
  C:\Windows\System\dSgweyt.exe
  2⤵
  PID:9736
- C:\Windows\System\BKJmMUK.exe
  C:\Windows\System\BKJmMUK.exe
  2⤵
  PID:4892
- C:\Windows\System\DFuLiDW.exe
  C:\Windows\System\DFuLiDW.exe
  2⤵
  PID:9844
- C:\Windows\System\xSVnRpY.exe
  C:\Windows\System\xSVnRpY.exe
  2⤵
  PID:9948
- C:\Windows\System\QhOesfk.exe
  C:\Windows\System\QhOesfk.exe
  2⤵
  PID:9920
- C:\Windows\System\PvvBOvs.exe
  C:\Windows\System\PvvBOvs.exe
  2⤵
  PID:9972
- C:\Windows\System\vjZwXjP.exe
  C:\Windows\System\vjZwXjP.exe
  2⤵
  PID:10076
- C:\Windows\System\NBHIMIC.exe
  C:\Windows\System\NBHIMIC.exe
  2⤵
  PID:10136
- C:\Windows\System\nFXjhto.exe
  C:\Windows\System\nFXjhto.exe
  2⤵
  PID:10220
- C:\Windows\System\nreGJjo.exe
  C:\Windows\System\nreGJjo.exe
  2⤵
  PID:8972
- C:\Windows\System\SbnRIrp.exe
  C:\Windows\System\SbnRIrp.exe
  2⤵
  PID:9484
- C:\Windows\System\BkYLFtm.exe
  C:\Windows\System\BkYLFtm.exe
  2⤵
  PID:9752
- C:\Windows\System\grmoHTK.exe
  C:\Windows\System\grmoHTK.exe
  2⤵
  PID:10008
- C:\Windows\System\QHuOyEg.exe
  C:\Windows\System\QHuOyEg.exe
  2⤵
  PID:5112
- C:\Windows\System\TFqeGlF.exe
  C:\Windows\System\TFqeGlF.exe
  2⤵
  PID:9968
- C:\Windows\System\bEGVJWA.exe
  C:\Windows\System\bEGVJWA.exe
  2⤵
  PID:8352
- C:\Windows\System\TUNXPpS.exe
  C:\Windows\System\TUNXPpS.exe
  2⤵
  PID:9460
- C:\Windows\System\ECXpKfv.exe
  C:\Windows\System\ECXpKfv.exe
  2⤵
  PID:8640
- C:\Windows\System\SeCvpuH.exe
  C:\Windows\System\SeCvpuH.exe
  2⤵
  PID:2916
- C:\Windows\System\RCWCbgw.exe
  C:\Windows\System\RCWCbgw.exe
  2⤵
  PID:10252
- C:\Windows\System\XbStmCk.exe
  C:\Windows\System\XbStmCk.exe
  2⤵
  PID:10284
- C:\Windows\System\tTuWyOi.exe
  C:\Windows\System\tTuWyOi.exe
  2⤵
  PID:10320
- C:\Windows\System\BHLVBMH.exe
  C:\Windows\System\BHLVBMH.exe
  2⤵
  PID:10340
- C:\Windows\System\HKudWXb.exe
  C:\Windows\System\HKudWXb.exe
  2⤵
  PID:10412
- C:\Windows\System\orXKyRX.exe
  C:\Windows\System\orXKyRX.exe
  2⤵
  PID:10480
- C:\Windows\System\AXoRsOj.exe
  C:\Windows\System\AXoRsOj.exe
  2⤵
  PID:10516
- C:\Windows\System\OpSBpMD.exe
  C:\Windows\System\OpSBpMD.exe
  2⤵
  PID:10540
- C:\Windows\System\VyhcFdH.exe
  C:\Windows\System\VyhcFdH.exe
  2⤵
  PID:10568
- C:\Windows\System\xvukEMH.exe
  C:\Windows\System\xvukEMH.exe
  2⤵
  PID:10588
- C:\Windows\System\gErtGYC.exe
  C:\Windows\System\gErtGYC.exe
  2⤵
  PID:10616
- C:\Windows\System\IQonHWP.exe
  C:\Windows\System\IQonHWP.exe
  2⤵
  PID:10696
- C:\Windows\System\WYNYXcT.exe
  C:\Windows\System\WYNYXcT.exe
  2⤵
  PID:10716
- C:\Windows\System\icrPdzN.exe
  C:\Windows\System\icrPdzN.exe
  2⤵
  PID:10740
- C:\Windows\System\oAVbqTl.exe
  C:\Windows\System\oAVbqTl.exe
  2⤵
  PID:10772
- C:\Windows\System\rgYpyXi.exe
  C:\Windows\System\rgYpyXi.exe
  2⤵
  PID:10820
- C:\Windows\System\PtMdVeu.exe
  C:\Windows\System\PtMdVeu.exe
  2⤵
  PID:10884
- C:\Windows\System\xnbFVfu.exe
  C:\Windows\System\xnbFVfu.exe
  2⤵
  PID:10912
- C:\Windows\System\MmvVfhe.exe
  C:\Windows\System\MmvVfhe.exe
  2⤵
  PID:10944
- C:\Windows\System\xFMjyus.exe
  C:\Windows\System\xFMjyus.exe
  2⤵
  PID:10964
- C:\Windows\System\XAPUmRE.exe
  C:\Windows\System\XAPUmRE.exe
  2⤵
  PID:10984
- C:\Windows\System\pUHBSuX.exe
  C:\Windows\System\pUHBSuX.exe
  2⤵
  PID:11036
- C:\Windows\System\aJZAODH.exe
  C:\Windows\System\aJZAODH.exe
  2⤵
  PID:11056
- C:\Windows\System\ykJyNkP.exe
  C:\Windows\System\ykJyNkP.exe
  2⤵
  PID:11092
- C:\Windows\System\DDpCupp.exe
  C:\Windows\System\DDpCupp.exe
  2⤵
  PID:11112
- C:\Windows\System\ywmCDkz.exe
  C:\Windows\System\ywmCDkz.exe
  2⤵
  PID:11132
- C:\Windows\System\aqrOtOv.exe
  C:\Windows\System\aqrOtOv.exe
  2⤵
  PID:11176
- C:\Windows\System\lNNhmMX.exe
  C:\Windows\System\lNNhmMX.exe
  2⤵
  PID:11196
- C:\Windows\System\zHcTBMV.exe
  C:\Windows\System\zHcTBMV.exe
  2⤵
  PID:11212
- C:\Windows\System\zWVwgrg.exe
  C:\Windows\System\zWVwgrg.exe
  2⤵
  PID:11240
- C:\Windows\System\SinklBf.exe
  C:\Windows\System\SinklBf.exe
  2⤵
  PID:9764
- C:\Windows\System\DRVLhcM.exe
  C:\Windows\System\DRVLhcM.exe
  2⤵
  PID:2356
- C:\Windows\System\xBGjQDA.exe
  C:\Windows\System\xBGjQDA.exe
  2⤵
  PID:8384
- C:\Windows\System\yeGVUSf.exe
  C:\Windows\System\yeGVUSf.exe
  2⤵
  PID:10276
- C:\Windows\System\eMHnOKM.exe
  C:\Windows\System\eMHnOKM.exe
  2⤵
  PID:10392
- C:\Windows\System\XYnEUiS.exe
  C:\Windows\System\XYnEUiS.exe
  2⤵
  PID:9892
- C:\Windows\System\VqHHymb.exe
  C:\Windows\System\VqHHymb.exe
  2⤵
  PID:10304
- C:\Windows\System\IUxTFNW.exe
  C:\Windows\System\IUxTFNW.exe
  2⤵
  PID:10464
- C:\Windows\System\QQaOBWV.exe
  C:\Windows\System\QQaOBWV.exe
  2⤵
  PID:10396
- C:\Windows\System\aiXCxMB.exe
  C:\Windows\System\aiXCxMB.exe
  2⤵
  PID:10500
- C:\Windows\System\ZZYchzh.exe
  C:\Windows\System\ZZYchzh.exe
  2⤵
  PID:10420
- C:\Windows\System\SJebbgV.exe
  C:\Windows\System\SJebbgV.exe
  2⤵
  PID:10532
- C:\Windows\System\ptkCEiN.exe
  C:\Windows\System\ptkCEiN.exe
  2⤵
  PID:10684
- C:\Windows\System\fKBtftP.exe
  C:\Windows\System\fKBtftP.exe
  2⤵
  PID:10708
- C:\Windows\System\dubVVrB.exe
  C:\Windows\System\dubVVrB.exe
  2⤵
  PID:10800
- C:\Windows\System\wQpFvau.exe
  C:\Windows\System\wQpFvau.exe
  2⤵
  PID:3576
- C:\Windows\System\xitVTWz.exe
  C:\Windows\System\xitVTWz.exe
  2⤵
  PID:10816
- C:\Windows\System\fogpQAV.exe
  C:\Windows\System\fogpQAV.exe
  2⤵
  PID:10904
- C:\Windows\System\eGLHGma.exe
  C:\Windows\System\eGLHGma.exe
  2⤵
  PID:10960
- C:\Windows\System\OKWjDlw.exe
  C:\Windows\System\OKWjDlw.exe
  2⤵
  PID:11024
- C:\Windows\System\BcLxCAA.exe
  C:\Windows\System\BcLxCAA.exe
  2⤵
  PID:11124
- C:\Windows\System\QLXgyOb.exe
  C:\Windows\System\QLXgyOb.exe
  2⤵
  PID:11108
- C:\Windows\System\EYPvYby.exe
  C:\Windows\System\EYPvYby.exe
  2⤵
  PID:11172
- C:\Windows\System\bExxuvQ.exe
  C:\Windows\System\bExxuvQ.exe
  2⤵
  PID:11248
- C:\Windows\System\QpdJMMh.exe
  C:\Windows\System\QpdJMMh.exe
  2⤵
  PID:9836
- C:\Windows\System\GajHVHq.exe
  C:\Windows\System\GajHVHq.exe
  2⤵
  PID:10032
- C:\Windows\System\hAyEzwp.exe
  C:\Windows\System\hAyEzwp.exe
  2⤵
  PID:10448
- C:\Windows\System\RiBpkeC.exe
  C:\Windows\System\RiBpkeC.exe
  2⤵
  PID:10556
- C:\Windows\System\PdrFeir.exe
  C:\Windows\System\PdrFeir.exe
  2⤵
  PID:10728
- C:\Windows\System\FGJLKZL.exe
  C:\Windows\System\FGJLKZL.exe
  2⤵
  PID:10864
- C:\Windows\System\trtWkrw.exe
  C:\Windows\System\trtWkrw.exe
  2⤵
  PID:10932
- C:\Windows\System\xfHByWG.exe
  C:\Windows\System\xfHByWG.exe
  2⤵
  PID:11168
- C:\Windows\System\qXkreya.exe
  C:\Windows\System\qXkreya.exe
  2⤵
  PID:9900
- C:\Windows\System\GegsmKv.exe
  C:\Windows\System\GegsmKv.exe
  2⤵
  PID:11236
- C:\Windows\System\ERMBjrE.exe
  C:\Windows\System\ERMBjrE.exe
  2⤵
  PID:10548
- C:\Windows\System\bJSDZOM.exe
  C:\Windows\System\bJSDZOM.exe
  2⤵
  PID:10608
- C:\Windows\System\nksERsb.exe
  C:\Windows\System\nksERsb.exe
  2⤵
  PID:10952
- C:\Windows\System\sMtTZiG.exe
  C:\Windows\System\sMtTZiG.exe
  2⤵
  PID:10656
- C:\Windows\System\fRqZCat.exe
  C:\Windows\System\fRqZCat.exe
  2⤵
  PID:9832
- C:\Windows\System\qqaBIkb.exe
  C:\Windows\System\qqaBIkb.exe
  2⤵
  PID:11288
- C:\Windows\System\cvZYdSl.exe
  C:\Windows\System\cvZYdSl.exe
  2⤵
  PID:11304
- C:\Windows\System\oidIKLr.exe
  C:\Windows\System\oidIKLr.exe
  2⤵
  PID:11348
- C:\Windows\System\FrZmyVD.exe
  C:\Windows\System\FrZmyVD.exe
  2⤵
  PID:11372
- C:\Windows\System\HGMutfl.exe
  C:\Windows\System\HGMutfl.exe
  2⤵
  PID:11444
- C:\Windows\System\TsMvmsP.exe
  C:\Windows\System\TsMvmsP.exe
  2⤵
  PID:11460
- C:\Windows\System\WHYkxdF.exe
  C:\Windows\System\WHYkxdF.exe
  2⤵
  PID:11476
- C:\Windows\System\kGyuxNQ.exe
  C:\Windows\System\kGyuxNQ.exe
  2⤵
  PID:11500
- C:\Windows\System\CyZmcfs.exe
  C:\Windows\System\CyZmcfs.exe
  2⤵
  PID:11528
- C:\Windows\System\uEIZhZC.exe
  C:\Windows\System\uEIZhZC.exe
  2⤵
  PID:11544
- C:\Windows\System\mIPCAbF.exe
  C:\Windows\System\mIPCAbF.exe
  2⤵
  PID:11588
- C:\Windows\System\YbaYypx.exe
  C:\Windows\System\YbaYypx.exe
  2⤵
  PID:11608
- C:\Windows\System\pYbYjye.exe
  C:\Windows\System\pYbYjye.exe
  2⤵
  PID:11624
- C:\Windows\System\ktMXmDt.exe
  C:\Windows\System\ktMXmDt.exe
  2⤵
  PID:11648
- C:\Windows\System\MIRmpLo.exe
  C:\Windows\System\MIRmpLo.exe
  2⤵
  PID:11688
- C:\Windows\System\SdgYnHm.exe
  C:\Windows\System\SdgYnHm.exe
  2⤵
  PID:11704
- C:\Windows\System\kNOXkTc.exe
  C:\Windows\System\kNOXkTc.exe
  2⤵
  PID:11724
- C:\Windows\System\jxewnPb.exe
  C:\Windows\System\jxewnPb.exe
  2⤵
  PID:11748
- C:\Windows\System\bKnOYsj.exe
  C:\Windows\System\bKnOYsj.exe
  2⤵
  PID:11772
- C:\Windows\System\tnNJoJz.exe
  C:\Windows\System\tnNJoJz.exe
  2⤵
  PID:11792
- C:\Windows\System\DddLqOh.exe
  C:\Windows\System\DddLqOh.exe
  2⤵
  PID:11816
- C:\Windows\System\cCFpuib.exe
  C:\Windows\System\cCFpuib.exe
  2⤵
  PID:11856
- C:\Windows\System\cxtLLcn.exe
  C:\Windows\System\cxtLLcn.exe
  2⤵
  PID:11876
- C:\Windows\System\UrGTIXx.exe
  C:\Windows\System\UrGTIXx.exe
  2⤵
  PID:11916
- C:\Windows\System\DQZsVgg.exe
  C:\Windows\System\DQZsVgg.exe
  2⤵
  PID:11936
- C:\Windows\System\iHuFMCG.exe
  C:\Windows\System\iHuFMCG.exe
  2⤵
  PID:11980
- C:\Windows\System\vTWIWmB.exe
  C:\Windows\System\vTWIWmB.exe
  2⤵
  PID:12000
- C:\Windows\System\XRzKkUF.exe
  C:\Windows\System\XRzKkUF.exe
  2⤵
  PID:12040
- C:\Windows\System\FIyXuXa.exe
  C:\Windows\System\FIyXuXa.exe
  2⤵
  PID:12060
- C:\Windows\System\hlTbvZH.exe
  C:\Windows\System\hlTbvZH.exe
  2⤵
  PID:12080
- C:\Windows\System\NlZuUYt.exe
  C:\Windows\System\NlZuUYt.exe
  2⤵
  PID:12140
- C:\Windows\System\SUbQQNr.exe
  C:\Windows\System\SUbQQNr.exe
  2⤵
  PID:12168
- C:\Windows\System\KHcqQCq.exe
  C:\Windows\System\KHcqQCq.exe
  2⤵
  PID:12188
- C:\Windows\System\QOchchp.exe
  C:\Windows\System\QOchchp.exe
  2⤵
  PID:12208
- C:\Windows\System\BGFOIPI.exe
  C:\Windows\System\BGFOIPI.exe
  2⤵
  PID:12252
- C:\Windows\System\fWSxswU.exe
  C:\Windows\System\fWSxswU.exe
  2⤵
  PID:12276
- C:\Windows\System\ZPBOSmh.exe
  C:\Windows\System\ZPBOSmh.exe
  2⤵
  PID:11272
- C:\Windows\System\AyIfUxX.exe
  C:\Windows\System\AyIfUxX.exe
  2⤵
  PID:11344
- C:\Windows\System\WoSXzYj.exe
  C:\Windows\System\WoSXzYj.exe
  2⤵
  PID:11404
- C:\Windows\System\iwTeyBG.exe
  C:\Windows\System\iwTeyBG.exe
  2⤵
  PID:11432
- C:\Windows\System\lBdlcyw.exe
  C:\Windows\System\lBdlcyw.exe
  2⤵
  PID:11496
- C:\Windows\System\ZbHaeaj.exe
  C:\Windows\System\ZbHaeaj.exe
  2⤵
  PID:11656
- C:\Windows\System\dpLeqmG.exe
  C:\Windows\System\dpLeqmG.exe
  2⤵
  PID:11632
- C:\Windows\System\buKizjj.exe
  C:\Windows\System\buKizjj.exe
  2⤵
  PID:11740
- C:\Windows\System\MsdJIiU.exe
  C:\Windows\System\MsdJIiU.exe
  2⤵
  PID:11716
- C:\Windows\System\yrWFrWa.exe
  C:\Windows\System\yrWFrWa.exe
  2⤵
  PID:11884
- C:\Windows\System\auDacBn.exe
  C:\Windows\System\auDacBn.exe
  2⤵
  PID:11812
- C:\Windows\System\jgljDtN.exe
  C:\Windows\System\jgljDtN.exe
  2⤵
  PID:11976
- C:\Windows\System\ZucLorm.exe
  C:\Windows\System\ZucLorm.exe
  2⤵
  PID:12028
- C:\Windows\System\FDTSLfL.exe
  C:\Windows\System\FDTSLfL.exe
  2⤵
  PID:12076
- C:\Windows\System\pHDBfrK.exe
  C:\Windows\System\pHDBfrK.exe
  2⤵
  PID:12216
- C:\Windows\System\ZscwfQH.exe
  C:\Windows\System\ZscwfQH.exe
  2⤵
  PID:12260
- C:\Windows\System\TxqowLa.exe
  C:\Windows\System\TxqowLa.exe
  2⤵
  PID:12268
- C:\Windows\System\lTYHvYU.exe
  C:\Windows\System\lTYHvYU.exe
  2⤵
  PID:11300
- C:\Windows\System\xBOmiFV.exe
  C:\Windows\System\xBOmiFV.exe
  2⤵
  PID:11468
- C:\Windows\System\drWGbXE.exe
  C:\Windows\System\drWGbXE.exe
  2⤵
  PID:11696
- C:\Windows\System\zZpEWTB.exe
  C:\Windows\System\zZpEWTB.exe
  2⤵
  PID:11700
- C:\Windows\System\ddOiVMK.exe
  C:\Windows\System\ddOiVMK.exe
  2⤵
  PID:2364
- C:\Windows\System\OCRgbGB.exe
  C:\Windows\System\OCRgbGB.exe
  2⤵
  PID:11780
- C:\Windows\System\auJckWa.exe
  C:\Windows\System\auJckWa.exe
  2⤵
  PID:11988
- C:\Windows\System\gAdYXhb.exe
  C:\Windows\System\gAdYXhb.exe
  2⤵
  PID:12248
- C:\Windows\System\cnZhRAx.exe
  C:\Windows\System\cnZhRAx.exe
  2⤵
  PID:10476
- C:\Windows\System\NJGPESI.exe
  C:\Windows\System\NJGPESI.exe
  2⤵
  PID:3180
- C:\Windows\System\AhTfwkf.exe
  C:\Windows\System\AhTfwkf.exe
  2⤵
  PID:4012
- C:\Windows\System\cHegfTE.exe
  C:\Windows\System\cHegfTE.exe
  2⤵
  PID:11828
- C:\Windows\System\MnhkdAu.exe
  C:\Windows\System\MnhkdAu.exe
  2⤵
  PID:2232
- C:\Windows\System\EGthYiB.exe
  C:\Windows\System\EGthYiB.exe
  2⤵
  PID:12300
- C:\Windows\System\FEZwAiJ.exe
  C:\Windows\System\FEZwAiJ.exe
  2⤵
  PID:12316
- C:\Windows\System\rWtyhpT.exe
  C:\Windows\System\rWtyhpT.exe
  2⤵
  PID:12336
- C:\Windows\System\OjEACZl.exe
  C:\Windows\System\OjEACZl.exe
  2⤵
  PID:12356
- C:\Windows\System\ZgzijHH.exe
  C:\Windows\System\ZgzijHH.exe
  2⤵
  PID:12384
- C:\Windows\System\YRKmmll.exe
  C:\Windows\System\YRKmmll.exe
  2⤵
  PID:12424
- C:\Windows\System\hKYEIvO.exe
  C:\Windows\System\hKYEIvO.exe
  2⤵
  PID:12476
- C:\Windows\System\VuBkmCL.exe
  C:\Windows\System\VuBkmCL.exe
  2⤵
  PID:12508
- C:\Windows\System\EPZUrLz.exe
  C:\Windows\System\EPZUrLz.exe
  2⤵
  PID:12532
- C:\Windows\System\ZDBIJIP.exe
  C:\Windows\System\ZDBIJIP.exe
  2⤵
  PID:12564
- C:\Windows\System\XCEpgVu.exe
  C:\Windows\System\XCEpgVu.exe
  2⤵
  PID:12584
- C:\Windows\System\boOgiGK.exe
  C:\Windows\System\boOgiGK.exe
  2⤵
  PID:12628
- C:\Windows\System\gFEffnE.exe
  C:\Windows\System\gFEffnE.exe
  2⤵
  PID:12648
- C:\Windows\System\GPDhgEY.exe
  C:\Windows\System\GPDhgEY.exe
  2⤵
  PID:12668
- C:\Windows\System\uYskrgH.exe
  C:\Windows\System\uYskrgH.exe
  2⤵
  PID:12692
- C:\Windows\System\hyNeHqr.exe
  C:\Windows\System\hyNeHqr.exe
  2⤵
  PID:12724
- C:\Windows\System\fORGRkC.exe
  C:\Windows\System\fORGRkC.exe
  2⤵
  PID:12756
- C:\Windows\System\myRLuts.exe
  C:\Windows\System\myRLuts.exe
  2⤵
  PID:12784
- C:\Windows\System\GfwvAmL.exe
  C:\Windows\System\GfwvAmL.exe
  2⤵
  PID:12828
- C:\Windows\System\VkKfIvB.exe
  C:\Windows\System\VkKfIvB.exe
  2⤵
  PID:12860
- C:\Windows\System\cxTrcvL.exe
  C:\Windows\System\cxTrcvL.exe
  2⤵
  PID:12876
- C:\Windows\System\WnWWtMZ.exe
  C:\Windows\System\WnWWtMZ.exe
  2⤵
  PID:12896
- C:\Windows\System\xJmRsWq.exe
  C:\Windows\System\xJmRsWq.exe
  2⤵
  PID:12912
- C:\Windows\System\PSYzfcq.exe
  C:\Windows\System\PSYzfcq.exe
  2⤵
  PID:12944
- C:\Windows\System\yLkwtRo.exe
  C:\Windows\System\yLkwtRo.exe
  2⤵
  PID:12968
- C:\Windows\System\AjJsSKk.exe
  C:\Windows\System\AjJsSKk.exe
  2⤵
  PID:12988
- C:\Windows\System\UTsKUzm.exe
  C:\Windows\System\UTsKUzm.exe
  2⤵
  PID:13012
- C:\Windows\System\cEnmqlE.exe
  C:\Windows\System\cEnmqlE.exe
  2⤵
  PID:13028
- C:\Windows\System\YmoVzqU.exe
  C:\Windows\System\YmoVzqU.exe
  2⤵
  PID:13052
- C:\Windows\System\yerhDDm.exe
  C:\Windows\System\yerhDDm.exe
  2⤵
  PID:12856
- C:\Windows\System\txsMDpc.exe
  C:\Windows\System\txsMDpc.exe
  2⤵
  PID:12908
- C:\Windows\System\XPRlzxa.exe
  C:\Windows\System\XPRlzxa.exe
  2⤵
  PID:1524
- C:\Windows\System\ktZRIYQ.exe
  C:\Windows\System\ktZRIYQ.exe
  2⤵
  PID:2528
- C:\Windows\System\maNYjyR.exe
  C:\Windows\System\maNYjyR.exe
  2⤵
  PID:3236
- C:\Windows\System\GpcUCnm.exe
  C:\Windows\System\GpcUCnm.exe
  2⤵
  PID:6656
- C:\Windows\System\XqYbTaf.exe
  C:\Windows\System\XqYbTaf.exe
  2⤵
  PID:6696
- C:\Windows\System\tyRynEn.exe
  C:\Windows\System\tyRynEn.exe
  2⤵
  PID:6780
- C:\Windows\System\ardRuGW.exe
  C:\Windows\System\ardRuGW.exe
  2⤵
  PID:6836
- C:\Windows\System\afUlSdt.exe
  C:\Windows\System\afUlSdt.exe
  2⤵
  PID:6948
- C:\Windows\System\oOpiyZj.exe
  C:\Windows\System\oOpiyZj.exe
  2⤵
  PID:2088
- C:\Windows\System\yLqoWsr.exe
  C:\Windows\System\yLqoWsr.exe
  2⤵
  PID:13128
- C:\Windows\System\MdLFIiQ.exe
  C:\Windows\System\MdLFIiQ.exe
  2⤵
  PID:4428
- C:\Windows\System\RHMIeii.exe
  C:\Windows\System\RHMIeii.exe
  2⤵
  PID:13156
- C:\Windows\System\zwGpbVa.exe
  C:\Windows\System\zwGpbVa.exe
  2⤵
  PID:13220
- C:\Windows\System\MFNsaEj.exe
  C:\Windows\System\MFNsaEj.exe
  2⤵
  PID:1192
- C:\Windows\System\MqTAOde.exe
  C:\Windows\System\MqTAOde.exe
  2⤵
  PID:7116
- C:\Windows\System\pWfyKSL.exe
  C:\Windows\System\pWfyKSL.exe
  2⤵
  PID:2372
- C:\Windows\System\axwsJJa.exe
  C:\Windows\System\axwsJJa.exe
  2⤵
  PID:13200
- C:\Windows\System\hakPRhX.exe
  C:\Windows\System\hakPRhX.exe
  2⤵
  PID:12892
- C:\Windows\System\sIbRabt.exe
  C:\Windows\System\sIbRabt.exe
  2⤵
  PID:13144
- C:\Windows\System\VeGNIPS.exe
  C:\Windows\System\VeGNIPS.exe
  2⤵
  PID:13164
- C:\Windows\System\cUVltrF.exe
  C:\Windows\System\cUVltrF.exe
  2⤵
  PID:6252
- C:\Windows\System\IFmaYWu.exe
  C:\Windows\System\IFmaYWu.exe
  2⤵
  PID:6372
- C:\Windows\System\KjpGimz.exe
  C:\Windows\System\KjpGimz.exe
  2⤵
  PID:6732
- C:\Windows\System\EbcEJgH.exe
  C:\Windows\System\EbcEJgH.exe
  2⤵
  PID:6932
- C:\Windows\System\SDfnNof.exe
  C:\Windows\System\SDfnNof.exe
  2⤵
  PID:3976
- C:\Windows\System\TFTRlJc.exe
  C:\Windows\System\TFTRlJc.exe
  2⤵
  PID:7148
- C:\Windows\System\vYKRIeH.exe
  C:\Windows\System\vYKRIeH.exe
  2⤵
  PID:2196
- C:\Windows\System\OoSOLDi.exe
  C:\Windows\System\OoSOLDi.exe
  2⤵
  PID:4164
- C:\Windows\System\kDgONjX.exe
  C:\Windows\System\kDgONjX.exe
  2⤵
  PID:6644
- C:\Windows\System\cqVTzvL.exe
  C:\Windows\System\cqVTzvL.exe
  2⤵
  PID:3024
- C:\Windows\System\RxWkCMw.exe
  C:\Windows\System\RxWkCMw.exe
  2⤵
  PID:876
- C:\Windows\System\vrYCBLW.exe
  C:\Windows\System\vrYCBLW.exe
  2⤵
  PID:772
- C:\Windows\System\GeEHTHg.exe
  C:\Windows\System\GeEHTHg.exe
  2⤵
  PID:3624
- C:\Windows\System\hNFxeCt.exe
  C:\Windows\System\hNFxeCt.exe
  2⤵
  PID:1904
- C:\Windows\System\GzdgsuQ.exe
  C:\Windows\System\GzdgsuQ.exe
  2⤵
  PID:3156
- C:\Windows\System\AZMePrV.exe
  C:\Windows\System\AZMePrV.exe
  2⤵
  PID:13148
- C:\Windows\System\KSsCVbU.exe
  C:\Windows\System\KSsCVbU.exe
  2⤵
  PID:12400
- C:\Windows\System\csgPTZQ.exe
  C:\Windows\System\csgPTZQ.exe
  2⤵
  PID:4860
- C:\Windows\System\ewQieAM.exe
  C:\Windows\System\ewQieAM.exe
  2⤵
  PID:4128
- C:\Windows\System\MFWyuRo.exe
  C:\Windows\System\MFWyuRo.exe
  2⤵
  PID:4572
- C:\Windows\System\BwQLNds.exe
  C:\Windows\System\BwQLNds.exe
  2⤵
  PID:4332
- C:\Windows\System\SCTGwpm.exe
  C:\Windows\System\SCTGwpm.exe
  2⤵
  PID:2556
- C:\Windows\System\jUbuirG.exe
  C:\Windows\System\jUbuirG.exe
  2⤵
  PID:4844
- C:\Windows\System\oxynXNw.exe
  C:\Windows\System\oxynXNw.exe
  2⤵
  PID:13216
- C:\Windows\System\SxKBtzv.exe
  C:\Windows\System\SxKBtzv.exe
  2⤵
  PID:12444
- C:\Windows\System\OUdGSVL.exe
  C:\Windows\System\OUdGSVL.exe
  2⤵
  PID:12464
- C:\Windows\System\YHISFeD.exe
  C:\Windows\System\YHISFeD.exe
  2⤵
  PID:12368
- C:\Windows\System\EjnAYcQ.exe
  C:\Windows\System\EjnAYcQ.exe
  2⤵
  PID:12548
- C:\Windows\System\xrffUIp.exe
  C:\Windows\System\xrffUIp.exe
  2⤵
  PID:7432
- C:\Windows\System\YEJHygG.exe
  C:\Windows\System\YEJHygG.exe
  2⤵
  PID:5108
- C:\Windows\System\EAfPDcN.exe
  C:\Windows\System\EAfPDcN.exe
  2⤵
  PID:7492
- C:\Windows\System\LzCILTU.exe
  C:\Windows\System\LzCILTU.exe
  2⤵
  PID:12556
- C:\Windows\System\svovwNO.exe
  C:\Windows\System\svovwNO.exe
  2⤵
  PID:12624
- C:\Windows\System\aoineiq.exe
  C:\Windows\System\aoineiq.exe
  2⤵
  PID:12688
- C:\Windows\System\gEKNTrc.exe
  C:\Windows\System\gEKNTrc.exe
  2⤵
  PID:7652
- C:\Windows\System\oJocezG.exe
  C:\Windows\System\oJocezG.exe
  2⤵
  PID:7732
- C:\Windows\System\nVOvLex.exe
  C:\Windows\System\nVOvLex.exe
  2⤵
  PID:7852
- C:\Windows\System\NvooAUo.exe
  C:\Windows\System\NvooAUo.exe
  2⤵
  PID:7928
- C:\Windows\System\MbAsMJw.exe
  C:\Windows\System\MbAsMJw.exe
  2⤵
  PID:8088
- C:\Windows\System\fHTUCaM.exe
  C:\Windows\System\fHTUCaM.exe
  2⤵
  PID:12708
- C:\Windows\System\OGcBNaG.exe
  C:\Windows\System\OGcBNaG.exe
  2⤵
  PID:8124
- C:\Windows\System\OVokeOn.exe
  C:\Windows\System\OVokeOn.exe
  2⤵
  PID:5016
- C:\Windows\System\SsqimHm.exe
  C:\Windows\System\SsqimHm.exe
  2⤵
  PID:12732
- C:\Windows\System\pQvWujq.exe
  C:\Windows\System\pQvWujq.exe
  2⤵
  PID:7312
- C:\Windows\System\BiprxWS.exe
  C:\Windows\System\BiprxWS.exe
  2⤵
  PID:4880
- C:\Windows\System\iumHVEF.exe
  C:\Windows\System\iumHVEF.exe
  2⤵
  PID:3108
- C:\Windows\System\XiGkCgO.exe
  C:\Windows\System\XiGkCgO.exe
  2⤵
  PID:12844
- C:\Windows\System\LUaIGPt.exe
  C:\Windows\System\LUaIGPt.exe
  2⤵
  PID:12872
- C:\Windows\System\rbBHZec.exe
  C:\Windows\System\rbBHZec.exe
  2⤵
  PID:1720
- C:\Windows\System\sPlahux.exe
  C:\Windows\System\sPlahux.exe
  2⤵
  PID:1284
- C:\Windows\System\OwYTRka.exe
  C:\Windows\System\OwYTRka.exe
  2⤵
  PID:1088
- C:\Windows\System\zhNTycr.exe
  C:\Windows\System\zhNTycr.exe
  2⤵
  PID:7552
- C:\Windows\System\BVVtphE.exe
  C:\Windows\System\BVVtphE.exe
  2⤵
  PID:7848
- C:\Windows\System\lYPYEFa.exe
  C:\Windows\System\lYPYEFa.exe
  2⤵
  PID:1172
- C:\Windows\System\AnITFlP.exe
  C:\Windows\System\AnITFlP.exe
  2⤵
  PID:696
- C:\Windows\System\ongzYFE.exe
  C:\Windows\System\ongzYFE.exe
  2⤵
  PID:2388
- C:\Windows\System\KhdjwiH.exe
  C:\Windows\System\KhdjwiH.exe
  2⤵
  PID:1580
- C:\Windows\System\LvaWTlD.exe
  C:\Windows\System\LvaWTlD.exe
  2⤵
  PID:2832
- C:\Windows\System\IOPMHki.exe
  C:\Windows\System\IOPMHki.exe
  2⤵
  PID:3268
- C:\Windows\System\ywlHQXk.exe
  C:\Windows\System\ywlHQXk.exe
  2⤵
  PID:12380
- C:\Windows\System\THZfAPO.exe
  C:\Windows\System\THZfAPO.exe
  2⤵
  PID:6924
- C:\Windows\System\POsWgdp.exe
  C:\Windows\System\POsWgdp.exe
  2⤵
  PID:7608
- C:\Windows\System\bAxKSCV.exe
  C:\Windows\System\bAxKSCV.exe
  2⤵
  PID:4680
- C:\Windows\System\DNnOYcU.exe
  C:\Windows\System\DNnOYcU.exe
  2⤵
  PID:6612
- C:\Windows\System\tBOWbfU.exe
  C:\Windows\System\tBOWbfU.exe
  2⤵
  PID:4868
- C:\Windows\System\dmjjcYs.exe
  C:\Windows\System\dmjjcYs.exe
  2⤵
  PID:3712
- C:\Windows\System\jqTILbQ.exe
  C:\Windows\System\jqTILbQ.exe
  2⤵
  PID:4000
- C:\Windows\System\wVLOKXd.exe
  C:\Windows\System\wVLOKXd.exe
  2⤵
  PID:6892
- C:\Windows\System\dsXqdrI.exe
  C:\Windows\System\dsXqdrI.exe
  2⤵
  PID:6752
- C:\Windows\System\RHGasVL.exe
  C:\Windows\System\RHGasVL.exe
  2⤵
  PID:6904
- C:\Windows\System\HnFmsqe.exe
  C:\Windows\System\HnFmsqe.exe
  2⤵
  PID:12404
- C:\Windows\System\XRRgOEn.exe
  C:\Windows\System\XRRgOEn.exe
  2⤵
  PID:8292
- C:\Windows\System\XzOUwsh.exe
  C:\Windows\System\XzOUwsh.exe
  2⤵
  PID:8444
- C:\Windows\System\caixpAt.exe
  C:\Windows\System\caixpAt.exe
  2⤵
  PID:8500
- C:\Windows\System\qBbGXgy.exe
  C:\Windows\System\qBbGXgy.exe
  2⤵
  PID:8556
- C:\Windows\System\MSphGdn.exe
  C:\Windows\System\MSphGdn.exe
  2⤵
  PID:8604
- C:\Windows\System\gCwdxeO.exe
  C:\Windows\System\gCwdxeO.exe
  2⤵
  PID:8644
- C:\Windows\System\xPGqDGv.exe
  C:\Windows\System\xPGqDGv.exe
  2⤵
  PID:8676
- C:\Windows\System\uUerfKK.exe
  C:\Windows\System\uUerfKK.exe
  2⤵
  PID:8744
- C:\Windows\System\WCbqtrS.exe
  C:\Windows\System\WCbqtrS.exe
  2⤵
  PID:5232
- C:\Windows\System\nNqGZaT.exe
  C:\Windows\System\nNqGZaT.exe
  2⤵
  PID:6908
- C:\Windows\System\rjgPWRf.exe
  C:\Windows\System\rjgPWRf.exe
  2⤵
  PID:864
- C:\Windows\System\idqDVOE.exe
  C:\Windows\System\idqDVOE.exe
  2⤵
  PID:5084
- C:\Windows\System\NYInKPs.exe
  C:\Windows\System\NYInKPs.exe
  2⤵
  PID:4652
- C:\Windows\System\EOGsPdV.exe
  C:\Windows\System\EOGsPdV.exe
  2⤵
  PID:1492
- C:\Windows\System\hBGvCST.exe
  C:\Windows\System\hBGvCST.exe
  2⤵
  PID:3044
- C:\Windows\System\YWnWZXT.exe
  C:\Windows\System\YWnWZXT.exe
  2⤵
  PID:6928
- C:\Windows\System\hadxoiK.exe
  C:\Windows\System\hadxoiK.exe
  2⤵
  PID:13264
- C:\Windows\System\QxglpWQ.exe
  C:\Windows\System\QxglpWQ.exe
  2⤵
  PID:8848
- C:\Windows\System\Gpwmuuy.exe
  C:\Windows\System\Gpwmuuy.exe
  2⤵
  PID:2724
- C:\Windows\System\EteTgFd.exe
  C:\Windows\System\EteTgFd.exe
  2⤵
  PID:1368
- C:\Windows\System\LcUoCJT.exe
  C:\Windows\System\LcUoCJT.exe
  2⤵
  PID:376
- C:\Windows\System\GjsusUa.exe
  C:\Windows\System\GjsusUa.exe
  2⤵
  PID:13076
- C:\Windows\System\FJoMhAU.exe
  C:\Windows\System\FJoMhAU.exe
  2⤵
  PID:5336
- C:\Windows\System\LcZzzlm.exe
  C:\Windows\System\LcZzzlm.exe
  2⤵
  PID:9040
- C:\Windows\System\uVxSFDL.exe
  C:\Windows\System\uVxSFDL.exe
  2⤵
  PID:13140
- C:\Windows\System\zSChExg.exe
  C:\Windows\System\zSChExg.exe
  2⤵
  PID:13024
- C:\Windows\System\zakMnmJ.exe
  C:\Windows\System\zakMnmJ.exe
  2⤵
  PID:13132
- C:\Windows\System\ExHKApW.exe
  C:\Windows\System\ExHKApW.exe
  2⤵
  PID:5340
- C:\Windows\System\sYjWYol.exe
  C:\Windows\System\sYjWYol.exe
  2⤵
  PID:13196
- C:\Windows\System\fmIsmZI.exe
  C:\Windows\System\fmIsmZI.exe
  2⤵
  PID:5396
- C:\Windows\System\ksUZJXJ.exe
  C:\Windows\System\ksUZJXJ.exe
  2⤵
  PID:13304
- C:\Windows\System\ixBOKeC.exe
  C:\Windows\System\ixBOKeC.exe
  2⤵
  PID:9196
- C:\Windows\System\jRyswEJ.exe
  C:\Windows\System\jRyswEJ.exe
  2⤵
  PID:8208
- C:\Windows\System\siBOkFA.exe
  C:\Windows\System\siBOkFA.exe
  2⤵
  PID:6480
- C:\Windows\System\QhLYmDB.exe
  C:\Windows\System\QhLYmDB.exe
  2⤵
  PID:8396
- C:\Windows\System\cCgsduF.exe
  C:\Windows\System\cCgsduF.exe
  2⤵
  PID:8512
- C:\Windows\System\rtmXiFW.exe
  C:\Windows\System\rtmXiFW.exe
  2⤵
  PID:5488
- C:\Windows\System\HXRhcct.exe
  C:\Windows\System\HXRhcct.exe
  2⤵
  PID:5528
- C:\Windows\System\BHFLMyC.exe
  C:\Windows\System\BHFLMyC.exe
  2⤵
  PID:6896
- C:\Windows\System\TIPvdQl.exe
  C:\Windows\System\TIPvdQl.exe
  2⤵
  PID:8724
- C:\Windows\System\FwihGaB.exe
  C:\Windows\System\FwihGaB.exe
  2⤵
  PID:5556
- C:\Windows\System\ttswyMl.exe
  C:\Windows\System\ttswyMl.exe
  2⤵
  PID:7016
- C:\Windows\System\aHZqxBF.exe
  C:\Windows\System\aHZqxBF.exe
  2⤵
  PID:3988
- C:\Windows\System\sJRuzIr.exe
  C:\Windows\System\sJRuzIr.exe
  2⤵
  PID:6316
- C:\Windows\System\UGSsasT.exe
  C:\Windows\System\UGSsasT.exe
  2⤵
  PID:5612
- C:\Windows\System\FnFAeZM.exe
  C:\Windows\System\FnFAeZM.exe
  2⤵
  PID:8260
- C:\Windows\System\ddvTUKB.exe
  C:\Windows\System\ddvTUKB.exe
  2⤵
  PID:4972
- C:\Windows\System\jwalnZv.exe
  C:\Windows\System\jwalnZv.exe
  2⤵
  PID:8432
- C:\Windows\System\okhIRfW.exe
  C:\Windows\System\okhIRfW.exe
  2⤵
  PID:8660
- C:\Windows\System\TSCWzuf.exe
  C:\Windows\System\TSCWzuf.exe
  2⤵
  PID:13252
- C:\Windows\System\UofbuPN.exe
  C:\Windows\System\UofbuPN.exe
  2⤵
  PID:2284
- C:\Windows\System\IPvqbNK.exe
  C:\Windows\System\IPvqbNK.exe
  2⤵
  PID:5688
- C:\Windows\System\XAQpggm.exe
  C:\Windows\System\XAQpggm.exe
  2⤵
  PID:8240
- C:\Windows\System\PAmiwxF.exe
  C:\Windows\System\PAmiwxF.exe
  2⤵
  PID:3208
- C:\Windows\System\amuyvun.exe
  C:\Windows\System\amuyvun.exe
  2⤵
  PID:5756
- C:\Windows\System\OmQlDRY.exe
  C:\Windows\System\OmQlDRY.exe
  2⤵
  PID:6200
- C:\Windows\System\LBDlXHt.exe
  C:\Windows\System\LBDlXHt.exe
  2⤵
  PID:12976
- C:\Windows\System\IDowYuQ.exe
  C:\Windows\System\IDowYuQ.exe
  2⤵
  PID:1984
- C:\Windows\System\apBEVTo.exe
  C:\Windows\System\apBEVTo.exe
  2⤵
  PID:1240
- C:\Windows\System\ZneIcjN.exe
  C:\Windows\System\ZneIcjN.exe
  2⤵
  PID:5864
- C:\Windows\System\Xxhoczd.exe
  C:\Windows\System\Xxhoczd.exe
  2⤵
  PID:4216
- C:\Windows\System\PYTwqmW.exe
  C:\Windows\System\PYTwqmW.exe
  2⤵
  PID:5884
- C:\Windows\System\MHLbaEq.exe
  C:\Windows\System\MHLbaEq.exe
  2⤵
  PID:7292
- C:\Windows\System\yhpWojP.exe
  C:\Windows\System\yhpWojP.exe
  2⤵
  PID:4764
- C:\Windows\System\evobQTw.exe
  C:\Windows\System\evobQTw.exe
  2⤵
  PID:5940
- C:\Windows\System\YfJHqMD.exe
  C:\Windows\System\YfJHqMD.exe
  2⤵
  PID:5976
- C:\Windows\System\gKoOzIq.exe
  C:\Windows\System\gKoOzIq.exe
  2⤵
  PID:9644
- C:\Windows\System\klNELWM.exe
  C:\Windows\System\klNELWM.exe
  2⤵
  PID:9684
- C:\Windows\System\smKAQof.exe
  C:\Windows\System\smKAQof.exe
  2⤵
  PID:3652
- C:\Windows\System\BVEPxqu.exe
  C:\Windows\System\BVEPxqu.exe
  2⤵
  PID:2476
- C:\Windows\System\GMgBqKM.exe
  C:\Windows\System\GMgBqKM.exe
  2⤵
  PID:6508
- C:\Windows\System\OwkWAsm.exe
  C:\Windows\System\OwkWAsm.exe
  2⤵
  PID:2660
- C:\Windows\System\QoUkytE.exe
  C:\Windows\System\QoUkytE.exe
  2⤵
  PID:6064
- C:\Windows\System\JCagIAn.exe
  C:\Windows\System\JCagIAn.exe
  2⤵
  PID:7548
- C:\Windows\System\YYtXKSc.exe
  C:\Windows\System\YYtXKSc.exe
  2⤵
  PID:7604
- C:\Windows\System\mHKNPAt.exe
  C:\Windows\System\mHKNPAt.exe
  2⤵
  PID:7644
- C:\Windows\System\BGpUbdl.exe
  C:\Windows\System\BGpUbdl.exe
  2⤵
  PID:1784
- C:\Windows\System\uDoAadU.exe
  C:\Windows\System\uDoAadU.exe
  2⤵
  PID:7964
- C:\Windows\System\mJfPJdU.exe
  C:\Windows\System\mJfPJdU.exe
  2⤵
  PID:1076
- C:\Windows\System\VGuSSnn.exe
  C:\Windows\System\VGuSSnn.exe
  2⤵
  PID:3328
- C:\Windows\System\gbJUNdM.exe
  C:\Windows\System\gbJUNdM.exe
  2⤵
  PID:10084
- C:\Windows\System\TnsLUfZ.exe
  C:\Windows\System\TnsLUfZ.exe
  2⤵
  PID:10112
- C:\Windows\System\dxHGTQw.exe
  C:\Windows\System\dxHGTQw.exe
  2⤵
  PID:10164
- C:\Windows\System\dfCNGdj.exe
  C:\Windows\System\dfCNGdj.exe
  2⤵
  PID:9280
- C:\Windows\System\FIdGMPh.exe
  C:\Windows\System\FIdGMPh.exe
  2⤵
  PID:8000
- C:\Windows\System\qRVVooG.exe
  C:\Windows\System\qRVVooG.exe
  2⤵
  PID:10680
- C:\Windows\System\mqlDvXe.exe
  C:\Windows\System\mqlDvXe.exe
  2⤵
  PID:1152
- C:\Windows\System\hkYWdWK.exe
  C:\Windows\System\hkYWdWK.exe
  2⤵
  PID:9504
- C:\Windows\System\KreyGqi.exe
  C:\Windows\System\KreyGqi.exe
  2⤵
  PID:7512
- C:\Windows\System\qLtczfd.exe
  C:\Windows\System\qLtczfd.exe
  2⤵
  PID:7584
- C:\Windows\System\XrdQsLd.exe
  C:\Windows\System\XrdQsLd.exe
  2⤵
  PID:4884
- C:\Windows\System\YpRkFWL.exe
  C:\Windows\System\YpRkFWL.exe
  2⤵
  PID:3420
- C:\Windows\System\GuRQyaF.exe
  C:\Windows\System\GuRQyaF.exe
  2⤵
  PID:9604
- C:\Windows\System\fpuYxda.exe
  C:\Windows\System\fpuYxda.exe
  2⤵
  PID:9640
- C:\Windows\System\sCzsYKW.exe
  C:\Windows\System\sCzsYKW.exe
  2⤵
  PID:12820
- C:\Windows\System\KejMxLG.exe
  C:\Windows\System\KejMxLG.exe
  2⤵
  PID:12780
- C:\Windows\System\gDHSCla.exe
  C:\Windows\System\gDHSCla.exe
  2⤵
  PID:3340
- C:\Windows\System\brXMSVy.exe
  C:\Windows\System\brXMSVy.exe
  2⤵
  PID:5284
- C:\Windows\System\hsLjcYN.exe
  C:\Windows\System\hsLjcYN.exe
  2⤵
  PID:8092
- C:\Windows\System\exDzioV.exe
  C:\Windows\System\exDzioV.exe
  2⤵
  PID:2816
- C:\Windows\System\dNFEuYN.exe
  C:\Windows\System\dNFEuYN.exe
  2⤵
  PID:3364
- C:\Windows\System\oTmrMuK.exe
  C:\Windows\System\oTmrMuK.exe
  2⤵
  PID:7296
- C:\Windows\System\YBqJLeo.exe
  C:\Windows\System\YBqJLeo.exe
  2⤵
  PID:712
- C:\Windows\System\SpotaTq.exe
  C:\Windows\System\SpotaTq.exe
  2⤵
  PID:10132
- C:\Windows\System\UMQwdMw.exe
  C:\Windows\System\UMQwdMw.exe
  2⤵
  PID:10108
- C:\Windows\System\rvhajRP.exe
  C:\Windows\System\rvhajRP.exe
  2⤵
  PID:4876
- C:\Windows\System\vVCeqkH.exe
  C:\Windows\System\vVCeqkH.exe
  2⤵
  PID:5564
- C:\Windows\System\rfUbQKj.exe
  C:\Windows\System\rfUbQKj.exe
  2⤵
  PID:7580
- C:\Windows\System\LNkUclN.exe
  C:\Windows\System\LNkUclN.exe
  2⤵
  PID:3320
- C:\Windows\System\hLxGEaO.exe
  C:\Windows\System\hLxGEaO.exe
  2⤵
  PID:9616
- C:\Windows\System\rHxnwYU.exe
  C:\Windows\System\rHxnwYU.exe
  2⤵
  PID:12952
- C:\Windows\System\CMfzmWy.exe
  C:\Windows\System\CMfzmWy.exe
  2⤵
  PID:5732
- C:\Windows\System\yhpSNXo.exe
  C:\Windows\System\yhpSNXo.exe
  2⤵
  PID:5816
- C:\Windows\System\AQyeaJI.exe
  C:\Windows\System\AQyeaJI.exe
  2⤵
  PID:8340
- C:\Windows\System\VrdRpiV.exe
  C:\Windows\System\VrdRpiV.exe
  2⤵
  PID:8452
- C:\Windows\System\KEclHBF.exe
  C:\Windows\System\KEclHBF.exe
  2⤵
  PID:8600
- C:\Windows\System\eznJRaL.exe
  C:\Windows\System\eznJRaL.exe
  2⤵
  PID:8636
- C:\Windows\System\LUssdXZ.exe
  C:\Windows\System\LUssdXZ.exe
  2⤵
  PID:5956
- C:\Windows\System\uvGEpjl.exe
  C:\Windows\System\uvGEpjl.exe
  2⤵
  PID:5152
- C:\Windows\System\cDWllZQ.exe
  C:\Windows\System\cDWllZQ.exe
  2⤵
  PID:1804
- C:\Windows\System\rChBWZO.exe
  C:\Windows\System\rChBWZO.exe
  2⤵
  PID:2360
- C:\Windows\System\UBZUoUE.exe
  C:\Windows\System\UBZUoUE.exe
  2⤵
  PID:6072
- C:\Windows\System\ajeZjaO.exe
  C:\Windows\System\ajeZjaO.exe
  2⤵
  PID:4856
- C:\Windows\System\hwgGsJP.exe
  C:\Windows\System\hwgGsJP.exe
  2⤵
  PID:6076
- C:\Windows\System\pkcODzj.exe
  C:\Windows\System\pkcODzj.exe
  2⤵
  PID:8960
- C:\Windows\System\YrTmYCT.exe
  C:\Windows\System\YrTmYCT.exe
  2⤵
  PID:5308
- C:\Windows\System\NnvrodN.exe
  C:\Windows\System\NnvrodN.exe
  2⤵
  PID:12720
- C:\Windows\System\AVIByJe.exe
  C:\Windows\System\AVIByJe.exe
  2⤵
  PID:1380
- C:\Windows\System\yhkspGF.exe
  C:\Windows\System\yhkspGF.exe
  2⤵
  PID:9044
- C:\Windows\System\CsXgfaJ.exe
  C:\Windows\System\CsXgfaJ.exe
  2⤵
  PID:5280
- C:\Windows\System\WMBbjuJ.exe
  C:\Windows\System\WMBbjuJ.exe
  2⤵
  PID:13224
- C:\Windows\System\TXaNSPq.exe
  C:\Windows\System\TXaNSPq.exe
  2⤵
  PID:5352
- C:\Windows\System\nOenIns.exe
  C:\Windows\System\nOenIns.exe
  2⤵
  PID:13172
- C:\Windows\System\imRERvk.exe
  C:\Windows\System\imRERvk.exe
  2⤵
  PID:5400
- C:\Windows\System\EjgNAIp.exe
  C:\Windows\System\EjgNAIp.exe
  2⤵
  PID:6312
- C:\Windows\System\wipQtWs.exe
  C:\Windows\System\wipQtWs.exe
  2⤵
  PID:5676
- C:\Windows\System\IXLQmyp.exe
  C:\Windows\System\IXLQmyp.exe
  2⤵
  PID:1416
- C:\Windows\System\QyJXCAS.exe
  C:\Windows\System\QyJXCAS.exe
  2⤵
  PID:6568
- C:\Windows\System\FPxeErr.exe
  C:\Windows\System\FPxeErr.exe
  2⤵
  PID:5552
- C:\Windows\System\zRYFAwV.exe
  C:\Windows\System\zRYFAwV.exe
  2⤵
  PID:6868
- C:\Windows\System\EbDBZjE.exe
  C:\Windows\System\EbDBZjE.exe
  2⤵
  PID:5796
- C:\Windows\System\nqyYXex.exe
  C:\Windows\System\nqyYXex.exe
  2⤵
  PID:10936
- C:\Windows\System\UlpriLZ.exe
  C:\Windows\System\UlpriLZ.exe
  2⤵
  PID:13284
- C:\Windows\System\BBqpkct.exe
  C:\Windows\System\BBqpkct.exe
  2⤵
  PID:11004
- C:\Windows\System\MMgKhLC.exe
  C:\Windows\System\MMgKhLC.exe
  2⤵
  PID:7096
- C:\Windows\System\bdPfPTe.exe
  C:\Windows\System\bdPfPTe.exe
  2⤵
  PID:5964
- C:\Windows\System\kMLhVjX.exe
  C:\Windows\System\kMLhVjX.exe
  2⤵
  PID:11120
- C:\Windows\System\PjQBjZN.exe
  C:\Windows\System\PjQBjZN.exe
  2⤵
  PID:12748
- C:\Windows\System\KGGNgCZ.exe
  C:\Windows\System\KGGNgCZ.exe
  2⤵
  PID:5640
- C:\Windows\System\pCyTKxH.exe
  C:\Windows\System\pCyTKxH.exe
  2⤵
  PID:5668
- C:\Windows\System\VLocsJp.exe
  C:\Windows\System\VLocsJp.exe
  2⤵
  PID:3760
- C:\Windows\System\bGuZoJT.exe
  C:\Windows\System\bGuZoJT.exe
  2⤵
  PID:10280
- C:\Windows\System\jugLCrR.exe
  C:\Windows\System\jugLCrR.exe
  2⤵
  PID:10292
- C:\Windows\System\PnTlAgr.exe
  C:\Windows\System\PnTlAgr.exe
  2⤵
  PID:3200
- C:\Windows\System\PWTFHEE.exe
  C:\Windows\System\PWTFHEE.exe
  2⤵
  PID:5728
- C:\Windows\System\CySdISV.exe
  C:\Windows\System\CySdISV.exe
  2⤵
  PID:5772
- C:\Windows\System\wasRaNg.exe
  C:\Windows\System\wasRaNg.exe
  2⤵
  PID:5784
- C:\Windows\System\KbEciJm.exe
  C:\Windows\System\KbEciJm.exe
  2⤵
  PID:3584
- C:\Windows\System\ZZDkTyT.exe
  C:\Windows\System\ZZDkTyT.exe
  2⤵
  PID:10368
- C:\Windows\System\WigyRpI.exe
  C:\Windows\System\WigyRpI.exe
  2⤵
  PID:4980
- C:\Windows\System\iZONqpT.exe
  C:\Windows\System\iZONqpT.exe
  2⤵
  PID:13008
- C:\Windows\System\kccUHVU.exe
  C:\Windows\System\kccUHVU.exe
  2⤵
  PID:1568
- C:\Windows\System\dJSeuWP.exe
  C:\Windows\System\dJSeuWP.exe
  2⤵
  PID:10440
- C:\Windows\System\iVllXEZ.exe
  C:\Windows\System\iVllXEZ.exe
  2⤵
  PID:12460
- C:\Windows\System\SsTxQUt.exe
  C:\Windows\System\SsTxQUt.exe
  2⤵
  PID:2124
- C:\Windows\System\UCyExtK.exe
  C:\Windows\System\UCyExtK.exe
  2⤵
  PID:452
- C:\Windows\System\JoyMNqB.exe
  C:\Windows\System\JoyMNqB.exe
  2⤵
  PID:12436
- C:\Windows\System\whmTQUd.exe
  C:\Windows\System\whmTQUd.exe
  2⤵
  PID:3596
- C:\Windows\System\MJNVSIr.exe
  C:\Windows\System\MJNVSIr.exe
  2⤵
  PID:12576
- C:\Windows\System\PCVfGBN.exe
  C:\Windows\System\PCVfGBN.exe
  2⤵
  PID:4664
- C:\Windows\System\zSjRkPw.exe
  C:\Windows\System\zSjRkPw.exe
  2⤵
  PID:7576
- C:\Windows\System\XJlmJMw.exe
  C:\Windows\System\XJlmJMw.exe
  2⤵
  PID:6092
- C:\Windows\System\STGVLyG.exe
  C:\Windows\System\STGVLyG.exe
  2⤵
  PID:7720
- C:\Windows\System\HhFAzDT.exe
  C:\Windows\System\HhFAzDT.exe
  2⤵
  PID:2784
- C:\Windows\System\taFwOOD.exe
  C:\Windows\System\taFwOOD.exe
  2⤵
  PID:10444
- C:\Windows\System\TWhFLzn.exe
  C:\Windows\System\TWhFLzn.exe
  2⤵
  PID:10668
- C:\Windows\System\YXfCtqa.exe
  C:\Windows\System\YXfCtqa.exe
  2⤵
  PID:10104
- C:\Windows\System\DCPxwOZ.exe
  C:\Windows\System\DCPxwOZ.exe
  2⤵
  PID:9248
- C:\Windows\System\BdypWVo.exe
  C:\Windows\System\BdypWVo.exe
  2⤵
  PID:4676
- C:\Windows\System\xBPVVYB.exe
  C:\Windows\System\xBPVVYB.exe
  2⤵
  PID:11044
- C:\Windows\System\FxiashS.exe
  C:\Windows\System\FxiashS.exe
  2⤵
  PID:1824
- C:\Windows\System\uSBmAvo.exe
  C:\Windows\System\uSBmAvo.exe
  2⤵
  PID:9740
- C:\Windows\System\zJEgZeg.exe
  C:\Windows\System\zJEgZeg.exe
  2⤵
  PID:11128
- C:\Windows\System\RSMUECL.exe
  C:\Windows\System\RSMUECL.exe
  2⤵
  PID:10300
- C:\Windows\System\QjVvviM.exe
  C:\Windows\System\QjVvviM.exe
  2⤵
  PID:11320
- C:\Windows\System\JBAKgQb.exe
  C:\Windows\System\JBAKgQb.exe
  2⤵
  PID:10228
- C:\Windows\System\FMUpTOm.exe
  C:\Windows\System\FMUpTOm.exe
  2⤵
  PID:9388
- C:\Windows\System\VRQVoOt.exe
  C:\Windows\System\VRQVoOt.exe
  2⤵
  PID:6320
- C:\Windows\System\XFbjfsX.exe
  C:\Windows\System\XFbjfsX.exe
  2⤵
  PID:9568
- C:\Windows\System\oRjMvjy.exe
  C:\Windows\System\oRjMvjy.exe
  2⤵
  PID:636
- C:\Windows\System\GnssQFE.exe
  C:\Windows\System\GnssQFE.exe
  2⤵
  PID:3272
- C:\Windows\System\VsctUXc.exe
  C:\Windows\System\VsctUXc.exe
  2⤵
  PID:2680
- C:\Windows\System\mcOCBWG.exe
  C:\Windows\System\mcOCBWG.exe
  2⤵
  PID:11428
- C:\Windows\System\tiXbojX.exe
  C:\Windows\System\tiXbojX.exe
  2⤵
  PID:11436
- C:\Windows\System\UkzMEES.exe
  C:\Windows\System\UkzMEES.exe
  2⤵
  PID:6348
- C:\Windows\System\PxprJfQ.exe
  C:\Windows\System\PxprJfQ.exe
  2⤵
  PID:9944
- C:\Windows\System\CYYhEjI.exe
  C:\Windows\System\CYYhEjI.exe
  2⤵
  PID:1336
- C:\Windows\System\FKJlrds.exe
  C:\Windows\System\FKJlrds.exe
  2⤵
  PID:6416
- C:\Windows\System\kKHHCgD.exe
  C:\Windows\System\kKHHCgD.exe
  2⤵
  PID:11516
- C:\Windows\System\ezuSodV.exe
  C:\Windows\System\ezuSodV.exe
  2⤵
  PID:9816
- C:\Windows\System\wiRFuJf.exe
  C:\Windows\System\wiRFuJf.exe
  2⤵
  PID:6472
- C:\Windows\System\UUlEXTa.exe
  C:\Windows\System\UUlEXTa.exe
  2⤵
  PID:13100
- C:\Windows\System\xluZGNZ.exe
  C:\Windows\System\xluZGNZ.exe
  2⤵
  PID:6544
- C:\Windows\System\SboWkKu.exe
  C:\Windows\System\SboWkKu.exe
  2⤵
  PID:7704
- C:\Windows\System\uiZxZrC.exe
  C:\Windows\System\uiZxZrC.exe
  2⤵
  PID:5700
- C:\Windows\System\HkpIgcY.exe
  C:\Windows\System\HkpIgcY.exe
  2⤵
  PID:9292
- C:\Windows\System\POfKCYf.exe
  C:\Windows\System\POfKCYf.exe
  2⤵
  PID:6596
- C:\Windows\System\cqFFzWE.exe
  C:\Windows\System\cqFFzWE.exe
  2⤵
  PID:2532
- C:\Windows\System\NiVQMbU.exe
  C:\Windows\System\NiVQMbU.exe
  2⤵
  PID:2412
- C:\Windows\System\gwDsgdr.exe
  C:\Windows\System\gwDsgdr.exe
  2⤵
  PID:5760
- C:\Windows\System\RJbfhWI.exe
  C:\Windows\System\RJbfhWI.exe
  2⤵
  PID:12352
- C:\Windows\System\XnwmPPH.exe
  C:\Windows\System\XnwmPPH.exe
  2⤵
  PID:8424
- C:\Windows\System\PrXfdhj.exe
  C:\Windows\System\PrXfdhj.exe
  2⤵
  PID:6684
- C:\Windows\System\YOoxFXz.exe
  C:\Windows\System\YOoxFXz.exe
  2⤵
  PID:8656
- C:\Windows\System\RhBDRZn.exe
  C:\Windows\System\RhBDRZn.exe
  2⤵
  PID:3708
- C:\Windows\System\zrxcHUH.exe
  C:\Windows\System\zrxcHUH.exe
  2⤵
  PID:5076
- C:\Windows\System\dSFyZvJ.exe
  C:\Windows\System\dSFyZvJ.exe
  2⤵
  PID:956
- C:\Windows\System\IRDbFMN.exe
  C:\Windows\System\IRDbFMN.exe
  2⤵
  PID:5080
- C:\Windows\System\dQFtbWl.exe
  C:\Windows\System\dQFtbWl.exe
  2⤵
  PID:7768
- C:\Windows\System\pQhqPUP.exe
  C:\Windows\System\pQhqPUP.exe
  2⤵
  PID:12980
- C:\Windows\System\BtrqGBW.exe
  C:\Windows\System\BtrqGBW.exe
  2⤵
  PID:4296
- C:\Windows\System\AEmvUST.exe
  C:\Windows\System\AEmvUST.exe
  2⤵
  PID:12840
- C:\Windows\System\zAmKpWY.exe
  C:\Windows\System\zAmKpWY.exe
  2⤵
  PID:11364
- C:\Windows\System\dASTLEZ.exe
  C:\Windows\System\dASTLEZ.exe
  2⤵
  PID:13152
- C:\Windows\System\mpcfqLV.exe
  C:\Windows\System\mpcfqLV.exe
  2⤵
  PID:11520
- C:\Windows\System\RebpTrW.exe
  C:\Windows\System\RebpTrW.exe
  2⤵
  PID:6992
- C:\Windows\System\sNqJmAv.exe
  C:\Windows\System\sNqJmAv.exe
  2⤵
  PID:8456
- C:\Windows\System\jFVbDDJ.exe
  C:\Windows\System\jFVbDDJ.exe
  2⤵
  PID:5680
- C:\Windows\System\CyzpTwo.exe
  C:\Windows\System\CyzpTwo.exe
  2⤵
  PID:7048
- C:\Windows\System\nrfNnpv.exe
  C:\Windows\System\nrfNnpv.exe
  2⤵
  PID:7464
- C:\Windows\System\brHhDkP.exe
  C:\Windows\System\brHhDkP.exe
  2⤵
  PID:8944
- C:\Windows\System\iTzpEBz.exe
  C:\Windows\System\iTzpEBz.exe
  2⤵
  PID:12180
- C:\Windows\System\BHbzbaX.exe
  C:\Windows\System\BHbzbaX.exe
  2⤵
  PID:9076
- C:\Windows\System\IauZxrT.exe
  C:\Windows\System\IauZxrT.exe
  2⤵
  PID:11100
- C:\Windows\System\ahQkXku.exe
  C:\Windows\System\ahQkXku.exe
  2⤵
  PID:1072
- C:\Windows\System\QkNCkPN.exe
  C:\Windows\System\QkNCkPN.exe
  2⤵
  PID:4384
- C:\Windows\System\TUUEjLg.exe
  C:\Windows\System\TUUEjLg.exe
  2⤵
  PID:8812
- C:\Windows\System\RjVVHZV.exe
  C:\Windows\System\RjVVHZV.exe
  2⤵
  PID:5708
- C:\Windows\System\AlDskuL.exe
  C:\Windows\System\AlDskuL.exe
  2⤵
  PID:2440
- C:\Windows\System\APzxwNm.exe
  C:\Windows\System\APzxwNm.exe
  2⤵
  PID:11104
- C:\Windows\System\AaXgHsY.exe
  C:\Windows\System\AaXgHsY.exe
  2⤵
  PID:5484
- C:\Windows\System\bxDkMqW.exe
  C:\Windows\System\bxDkMqW.exe
  2⤵
  PID:5848
- C:\Windows\System\UecKUAB.exe
  C:\Windows\System\UecKUAB.exe
  2⤵
  PID:13268
- C:\Windows\System\tIEzvel.exe
  C:\Windows\System\tIEzvel.exe
  2⤵
  PID:692
- C:\Windows\System\rtluHpn.exe
  C:\Windows\System\rtluHpn.exe
  2⤵
  PID:9536
- C:\Windows\System\AXTAXOF.exe
  C:\Windows\System\AXTAXOF.exe
  2⤵
  PID:4948
- C:\Windows\System\GQEJhrT.exe
  C:\Windows\System\GQEJhrT.exe
  2⤵
  PID:6152
- C:\Windows\System\hwXPpzI.exe
  C:\Windows\System\hwXPpzI.exe
  2⤵
  PID:6008
- C:\Windows\System\XpPbAVx.exe
  C:\Windows\System\XpPbAVx.exe
  2⤵
  PID:7568
- C:\Windows\System\sMhZSLj.exe
  C:\Windows\System\sMhZSLj.exe
  2⤵
  PID:12596
- C:\Windows\System\TfOAfaY.exe
  C:\Windows\System\TfOAfaY.exe
  2⤵
  PID:4548
- C:\Windows\System\ibqiCWX.exe
  C:\Windows\System\ibqiCWX.exe
  2⤵
  PID:10724
- C:\Windows\System\XWKcwCZ.exe
  C:\Windows\System\XWKcwCZ.exe
  2⤵
  PID:7936
- C:\Windows\System\EVotcsn.exe
  C:\Windows\System\EVotcsn.exe
  2⤵
  PID:10120
- C:\Windows\System\BZsuYcL.exe
  C:\Windows\System\BZsuYcL.exe
  2⤵
  PID:12812
- C:\Windows\System\xBcAgGX.exe
  C:\Windows\System\xBcAgGX.exe
  2⤵
  PID:9340
- C:\Windows\System\IoTyxST.exe
  C:\Windows\System\IoTyxST.exe
  2⤵
  PID:11324
- C:\Windows\System\BglPYGx.exe
  C:\Windows\System\BglPYGx.exe
  2⤵
  PID:2052
- C:\Windows\System\BwwgrHR.exe
  C:\Windows\System\BwwgrHR.exe
  2⤵
  PID:12808
- C:\Windows\System\kLqDilS.exe
  C:\Windows\System\kLqDilS.exe
  2⤵
  PID:3252
- C:\Windows\System\XFhPGrZ.exe
  C:\Windows\System\XFhPGrZ.exe
  2⤵
  PID:4668
- C:\Windows\System\YtCaKbS.exe
  C:\Windows\System\YtCaKbS.exe
  2⤵
  PID:13092
- C:\Windows\System\cpzzvQZ.exe
  C:\Windows\System\cpzzvQZ.exe
  2⤵
  PID:13072
- C:\Windows\System\XXwMcAP.exe
  C:\Windows\System\XXwMcAP.exe
  2⤵
  PID:11072
- C:\Windows\System\eKcAsLg.exe
  C:\Windows\System\eKcAsLg.exe
  2⤵
  PID:11152
- C:\Windows\System\SWArYxO.exe
  C:\Windows\System\SWArYxO.exe
  2⤵
  PID:10408
- C:\Windows\System\fOHQOsl.exe
  C:\Windows\System\fOHQOsl.exe
  2⤵
  PID:6388
- C:\Windows\System\ijrlHDj.exe
  C:\Windows\System\ijrlHDj.exe
  2⤵
  PID:13096
- C:\Windows\System\fkTQJTK.exe
  C:\Windows\System\fkTQJTK.exe
  2⤵
  PID:6384
- C:\Windows\System\GFrjLGu.exe
  C:\Windows\System\GFrjLGu.exe
  2⤵
  PID:4604
- C:\Windows\System\DPaONPw.exe
  C:\Windows\System\DPaONPw.exe
  2⤵
  PID:5408
- C:\Windows\System\KrZHLom.exe
  C:\Windows\System\KrZHLom.exe
  2⤵
  PID:5348
- C:\Windows\System\AtEdmuK.exe
  C:\Windows\System\AtEdmuK.exe
  2⤵
  PID:10196
- C:\Windows\System\PniupmI.exe
  C:\Windows\System\PniupmI.exe
  2⤵
  PID:5624
- C:\Windows\System\lxCCRqQ.exe
  C:\Windows\System\lxCCRqQ.exe
  2⤵
  PID:8488
- C:\Windows\System\vgbJuMl.exe
  C:\Windows\System\vgbJuMl.exe
  2⤵
  PID:4172
- C:\Windows\System\euAtLpr.exe
  C:\Windows\System\euAtLpr.exe
  2⤵
  PID:3076
- C:\Windows\System\JEOvFtV.exe
  C:\Windows\System\JEOvFtV.exe
  2⤵
  PID:1196
- C:\Windows\System\CcMPEwm.exe
  C:\Windows\System\CcMPEwm.exe
  2⤵
  PID:2892
- C:\Windows\System\nqbbcXx.exe
  C:\Windows\System\nqbbcXx.exe
  2⤵
  PID:3260
- C:\Windows\System\YiQyIGd.exe
  C:\Windows\System\YiQyIGd.exe
  2⤵
  PID:5432
- C:\Windows\System\XnpgeqH.exe
  C:\Windows\System\XnpgeqH.exe
  2⤵
  PID:5428
- C:\Windows\System\rpLALBV.exe
  C:\Windows\System\rpLALBV.exe
  2⤵
  PID:8300
- C:\Windows\System\xnWulpJ.exe
  C:\Windows\System\xnWulpJ.exe
  2⤵
  PID:5908
- C:\Windows\System\ZnGvctt.exe
  C:\Windows\System\ZnGvctt.exe
  2⤵
  PID:11008
- C:\Windows\System\FTFvjAr.exe
  C:\Windows\System\FTFvjAr.exe
  2⤵
  PID:12132
- C:\Windows\System\iLKFnUe.exe
  C:\Windows\System\iLKFnUe.exe
  2⤵
  PID:6392
- C:\Windows\System\zFwPdrn.exe
  C:\Windows\System\zFwPdrn.exe
  2⤵
  PID:7316
- C:\Windows\System\ihvWFDy.exe
  C:\Windows\System\ihvWFDy.exe
  2⤵
  PID:7320
- C:\Windows\System\QscgKIM.exe
  C:\Windows\System\QscgKIM.exe
  2⤵
  PID:2380
- C:\Windows\System\aYSfzgR.exe
  C:\Windows\System\aYSfzgR.exe
  2⤵
  PID:8652
- C:\Windows\System\AiTAmgB.exe
  C:\Windows\System\AiTAmgB.exe
  2⤵
  PID:7424
- C:\Windows\System\xqKwcVI.exe
  C:\Windows\System\xqKwcVI.exe
  2⤵
  PID:9812
- C:\Windows\System\FTTdblq.exe
  C:\Windows\System\FTTdblq.exe
  2⤵
  PID:380
- C:\Windows\System\bfPbvsl.exe
  C:\Windows\System\bfPbvsl.exe
  2⤵
  PID:9296
- C:\Windows\System\usVSEeW.exe
  C:\Windows\System\usVSEeW.exe
  2⤵
  PID:12332
- C:\Windows\System\cxsvosf.exe
  C:\Windows\System\cxsvosf.exe
  2⤵
  PID:10488
- C:\Windows\System\mKucHgN.exe
  C:\Windows\System\mKucHgN.exe
  2⤵
  PID:9708
- C:\Windows\System\FQFaDlv.exe
  C:\Windows\System\FQFaDlv.exe
  2⤵
  PID:11016
- C:\Windows\System\TYekPGK.exe
  C:\Windows\System\TYekPGK.exe
  2⤵
  PID:3264
- C:\Windows\System\ozqcAJB.exe
  C:\Windows\System\ozqcAJB.exe
  2⤵
  PID:7856
- C:\Windows\System\azOqsAC.exe
  C:\Windows\System\azOqsAC.exe
  2⤵
  PID:6120
- C:\Windows\System\JtbsZUi.exe
  C:\Windows\System\JtbsZUi.exe
  2⤵
  PID:12920
- C:\Windows\System\TKZGfnD.exe
  C:\Windows\System\TKZGfnD.exe
  2⤵
  PID:7952
- C:\Windows\System\BBJLZcj.exe
  C:\Windows\System\BBJLZcj.exe
  2⤵
  PID:6276
- C:\Windows\System\MxsKUMg.exe
  C:\Windows\System\MxsKUMg.exe
  2⤵
  PID:4600
- C:\Windows\System\qNeqzcv.exe
  C:\Windows\System\qNeqzcv.exe
  2⤵
  PID:3372
- C:\Windows\System\iHAboOq.exe
  C:\Windows\System\iHAboOq.exe
  2⤵
  PID:13040
- C:\Windows\System\UkgREBP.exe
  C:\Windows\System\UkgREBP.exe
  2⤵
  PID:8132
- C:\Windows\System\NPlBgjs.exe
  C:\Windows\System\NPlBgjs.exe
  2⤵
  PID:13080
- C:\Windows\System\xPSsRgt.exe
  C:\Windows\System\xPSsRgt.exe
  2⤵
  PID:7200
- C:\Windows\System\JUSdWpT.exe
  C:\Windows\System\JUSdWpT.exe
  2⤵
  PID:7276
- C:\Windows\System\bgPEAbH.exe
  C:\Windows\System\bgPEAbH.exe
  2⤵
  PID:6232
- C:\Windows\System\LpgKEAQ.exe
  C:\Windows\System\LpgKEAQ.exe
  2⤵
  PID:7440
- C:\Windows\System\cdEUMjA.exe
  C:\Windows\System\cdEUMjA.exe
  2⤵
  PID:7388
- C:\Windows\System\lGqYzYl.exe
  C:\Windows\System\lGqYzYl.exe
  2⤵
  PID:11424
- C:\Windows\System\vgxgqFh.exe
  C:\Windows\System\vgxgqFh.exe
  2⤵
  PID:7760
- C:\Windows\System\afoaJKi.exe
  C:\Windows\System\afoaJKi.exe
  2⤵
  PID:4656
- C:\Windows\System\dnNnmBX.exe
  C:\Windows\System\dnNnmBX.exe
  2⤵
  PID:8012
- C:\Windows\System\ZSISZOx.exe
  C:\Windows\System\ZSISZOx.exe
  2⤵
  PID:4512
- C:\Windows\System\HAlwPAZ.exe
  C:\Windows\System\HAlwPAZ.exe
  2⤵
  PID:6584
- C:\Windows\System\yTthTcT.exe
  C:\Windows\System\yTthTcT.exe
  2⤵
  PID:4316
- C:\Windows\System\cCyAyeK.exe
  C:\Windows\System\cCyAyeK.exe
  2⤵
  PID:8608
- C:\Windows\System\vGxwHFU.exe
  C:\Windows\System\vGxwHFU.exe
  2⤵
  PID:5608
- C:\Windows\System\ksKtRxN.exe
  C:\Windows\System\ksKtRxN.exe
  2⤵
  PID:5052
- C:\Windows\System\GOLuChX.exe
  C:\Windows\System\GOLuChX.exe
  2⤵
  PID:6100
- C:\Windows\System\CumATeS.exe
  C:\Windows\System\CumATeS.exe
  2⤵
  PID:6256
- C:\Windows\System\vJWdkgE.exe
  C:\Windows\System\vJWdkgE.exe
  2⤵
  PID:12124
- C:\Windows\System\lLyBOQu.exe
  C:\Windows\System\lLyBOQu.exe
  2⤵
  PID:7572
- C:\Windows\System\toQszNW.exe
  C:\Windows\System\toQszNW.exe
  2⤵
  PID:7728
- C:\Windows\System\dOwKXbK.exe
  C:\Windows\System\dOwKXbK.exe
  2⤵
  PID:8076
- C:\Windows\System\TffeJfg.exe
  C:\Windows\System\TffeJfg.exe
  2⤵
  PID:7084
- C:\Windows\System\PABQPHD.exe
  C:\Windows\System\PABQPHD.exe
  2⤵
  PID:3980
- C:\Windows\System\osiSbxR.exe
  C:\Windows\System\osiSbxR.exe
  2⤵
  PID:4460
- C:\Windows\System\MtvnAZO.exe
  C:\Windows\System\MtvnAZO.exe
  2⤵
  PID:7088
- C:\Windows\System\TRdmsHu.exe
  C:\Windows\System\TRdmsHu.exe
  2⤵
  PID:8256
- C:\Windows\System\rNpXMwt.exe
  C:\Windows\System\rNpXMwt.exe
  2⤵
  PID:5196
- C:\Windows\System\GXrPsWy.exe
  C:\Windows\System\GXrPsWy.exe
  2⤵
  PID:3032
- C:\Windows\System\FkmIjnK.exe
  C:\Windows\System\FkmIjnK.exe
  2⤵
  PID:11208
- C:\Windows\System\dtHuADT.exe
  C:\Windows\System\dtHuADT.exe
  2⤵
  PID:3780
- C:\Windows\System\gcFDCVS.exe
  C:\Windows\System\gcFDCVS.exe
  2⤵
  PID:8
- C:\Windows\System\GhPcGQN.exe
  C:\Windows\System\GhPcGQN.exe
  2⤵
  PID:6224
- C:\Windows\System\YntUrmZ.exe
  C:\Windows\System\YntUrmZ.exe
  2⤵
  PID:7472
- C:\Windows\System\iAiVTnJ.exe
  C:\Windows\System\iAiVTnJ.exe
  2⤵
  PID:6164
- C:\Windows\System\wOJopLQ.exe
  C:\Windows\System\wOJopLQ.exe
  2⤵
  PID:10208
- C:\Windows\System\TKehxXN.exe
  C:\Windows\System\TKehxXN.exe
  2⤵
  PID:12960
- C:\Windows\System\AglvCVa.exe
  C:\Windows\System\AglvCVa.exe
  2⤵
  PID:8176
- C:\Windows\System\CmRvuQn.exe
  C:\Windows\System\CmRvuQn.exe
  2⤵
  PID:8832
- C:\Windows\System\krNXvSW.exe
  C:\Windows\System\krNXvSW.exe
  2⤵
  PID:5140
- C:\Windows\System\lFnZbqd.exe
  C:\Windows\System\lFnZbqd.exe
  2⤵
  PID:8976
- C:\Windows\System\unVaPMb.exe
  C:\Windows\System\unVaPMb.exe
  2⤵
  PID:9032
- C:\Windows\System\wMqQgzQ.exe
  C:\Windows\System\wMqQgzQ.exe
  2⤵
  PID:7372
- C:\Windows\System\klZezHI.exe
  C:\Windows\System\klZezHI.exe
  2⤵
  PID:5704
- C:\Windows\System\AjExdjW.exe
  C:\Windows\System\AjExdjW.exe
  2⤵
  PID:7812

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

__PSScriptPolicyTest_445rhdvg.enh.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_445rhdvg.enh.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

AdGVmFR.exe

Path C:\Windows\System\AdGVmFR.exe
Size 1.6MB
SHA256 6fbfadaad82b139eac4700b17c063ea4e425fca7c2c0c41c3fa90ec718d3a13b
MD5 7dce32e64a55aa9f0d4ef9b44e2daf58
SHA1 671e4319cf3c2fb3bdb546fe1115e3acc89fe064
SHA512 0e59b6e1292e5d04b907405f7c4284437870c1334a5ed7815e597a600b3116e882d6eb8fc83e88cfd776352cdff21772e12822a997e8de93997d7bead9f7d0f0
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjuJoz5XdUK6S1uBkr5Gqlfz+y7p9DbkMq:Lz071uv4BPMkHC0I6Gz3N1pHP7Fq
MD5 SHA1 SHA512 SSDEEP

Submit Download

AoXDPLJ.exe

Path C:\Windows\System\AoXDPLJ.exe
Size 1.6MB
SHA256 f152f699e9bce81c54dfbfa50f0c7ab462604035c684a2db835b4e95d84225f4
MD5 5498e2e149435f78790b62a168b243a5
SHA1 415d71ea00ceb66d716d7c7d12939d6df1d2b16f
SHA512 1f7df3d4db2d5e26bc8f38e36b9117e47b2dfe145b51e4316d71eb62589d8d45edf5e127e082d4561e3493f530b8bdee6659355b95ea798e28109b51cba34287
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjuJoz5XdUK6S1uBkr5Gqlfz+y7p9Dbky:Lz071uv4BPMkHC0I6Gz3N1pHP7Z
MD5 SHA1 SHA512 SSDEEP

Submit Download

CpnqRKU.exe

Path C:\Windows\System\CpnqRKU.exe
Size 1.6MB
SHA256 b4ad4b3563310ea450f2eb1c64bd2a30f0a1fa4ffd4e40aed71aee9ee3f514a8
MD5 d7744e95c7a88aa61c8c832f3989c396
SHA1 8acd3de18e2818eb2cb2c3787ba27c90a7b60958
SHA512 136c92f16376d1e7bfdd3eb8d13fb425b960d2cf849ffdff9765aa31dc4e032b25697b5e37b2401810c16607f886860ef2376944bbfc82d02629dfce5338144c
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjuJoz5XdUK6S1uBkr5Gqlfz+y7p9Dbk/:Lz071uv4BPMkHC0I6Gz3N1pHP7u
MD5 SHA1 SHA512 SSDEEP

Submit Download

FzPxsNQ.exe

Path C:\Windows\System\FzPxsNQ.exe
Size 1.6MB
SHA256 bddf1061d5777eb4f6deaef243ca0bcb5cc817274c6b215bb9dae768d89b5a93
MD5 5fe9d0a5451d8f0f0df9af9942cda6ea
SHA1 60ba2bd666ae5f30a922539da0b84e86bdf4563a
SHA512 de532cb9b914fe7e0d4193600286c764fc869538722d790116f2b720bb5b3a22604f31727058704cc88a068e689e064e49992316ebd82c8db60c1dcdd775773d
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjuJoz5XdUK6S1uBkr5Gqlfz+y7p9DbkA:Lz071uv4BPMkHC0I6Gz3N1pHP7X
MD5 SHA1 SHA512 SSDEEP

Submit Download

GsxlstI.exe

Path C:\Windows\System\GsxlstI.exe
Size 1.6MB
SHA256 c47393ab0d1cc45e3c9d6932586ad86e5e56e60a743c950a0108bc10b7da1326
MD5 2a67c937bbaccf499bfdbca16af10bb9
SHA1 38b89e7f8dc791cf51c7e75d08dc4eef74ffd89b
SHA512 770d5e2897f34431c65517769813bd0433131bea04a1365b8da463bd954447d8b2c1e7a887bd95fcfbc16b0e87955aefb8a6e8f9df307eea477c7b90819272bd
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjuJoz5XdUK6S1uBkr5Gqlfz+y7p9DbkNI:Lz071uv4BPMkHC0I6Gz3N1pHP7CI
MD5 SHA1 SHA512 SSDEEP

Submit Download

HzqdzIZ.exe

Path C:\Windows\System\HzqdzIZ.exe
Size 1.6MB
SHA256 66ec409dec3c015b5480514e7d55d11433309fa61136ac1abd70e7f7187f5662
MD5 551719907176d4845b76a3ce2220a273
SHA1 baa8e0a183d9d590aa94b7c087610f16082d2c56
SHA512 11e0129f8f2d2a8a381f156ca3d87d6d03cc9639591ff87b6ce86751a5637d9844ddaca1f6fe85559e3fbd521cbf5156839907319fcdfdfe3fe698d8a5f26fc5
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjuJoz5XdUK6S1uBkr5Gqlfz+y7p9DbkC:Lz071uv4BPMkHC0I6Gz3N1pHP7V
MD5 SHA1 SHA512 SSDEEP

Submit Download

IrVHgak.exe

Path C:\Windows\System\IrVHgak.exe
Size 1.6MB
SHA256 27e8da09a103fbbaa0c8d4915a1d0e8a657165146ad9a445b6f7d86513312718
MD5 72caffc8486e7d3733aca61e1dc857b2
SHA1 16f78027ba290799b1167ee4467a9fe39a31ae74
SHA512 003ee46ad9d27c1d9939d5934adb416ac5d63e5c7115bd3bfb75552046de1fed4eaff33ccbdfc700fe2bd3b3d0f32359aa8389ead749189ce4ec90450e40f599
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjuJoz5XdUK6S1uBkr5Gqlfz+y7p9Dbkj:Lz071uv4BPMkHC0I6Gz3N1pHP7y
MD5 SHA1 SHA512 SSDEEP

Submit Download

JBzuxOT.exe

Path C:\Windows\System\JBzuxOT.exe
Size 1.6MB
SHA256 7ff83135541a0e830d730aead95a5c86442a0dd0754121c7afadcaedc93d261b
MD5 fb924d991a3256e25149e23e4ed094fd
SHA1 a9de4865fd448e5f0f1a56e049091bab69b35588
SHA512 7da144efea141d5a69c033436a237c67240a301b71475788d9c840e105535e6263f94d252aa23604efd3a682a78ece409dd56624e4dda68a84658a10dd128a3d
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjuJoz5XdUK6S1uBkr5Gqlfz+y7p9Dbk8:Lz071uv4BPMkHC0I6Gz3N1pHP7h
MD5 SHA1 SHA512 SSDEEP

Submit Download

JKSaWdU.exe

Path C:\Windows\System\JKSaWdU.exe
Size 1.6MB
SHA256 f3d57d29149a62b13c590263486d0d4309890e11ef99a8166a2fd18613a0b207
MD5 ed177cbd8ae38988ff3f433f140f1114
SHA1 65d49c2fd445a8c5e685e31eb3b7f743301a918f
SHA512 d36d69f9c4e0f7e87508eb360689431f1dcdccd59af9fa2cb0449a4e983b443aeed8916d595d8ea4d4167000e5720721bd8d3df2d5a006ab06fdb4d2dd3e40dd
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjuJoz5XdUK6S1uBkr5Gqlfz+y7p9DbkE:Lz071uv4BPMkHC0I6Gz3N1pHP7B
MD5 SHA1 SHA512 SSDEEP

Submit Download

JhJZryC.exe

Path C:\Windows\System\JhJZryC.exe
Size 1.6MB
SHA256 8c82804dc89eef668034a6f42dff66f831165cbcf24dc66db9901fdafa57fa6a
MD5 4b1d115bdb5202f350b16815aa80b701
SHA1 141a06186325dba63ebd603ffdce99a6756ba863
SHA512 6dcdcefee17f08bf63c142c072f8c98ca013dc6a5affce988fde7c47277d89334dd6784e2f84c627a101b83aef7b0cde0c95cb5b8e171113ab21ab51b4d2159c
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjuJoz5XdUK6S1uBkr5Gqlfz+y7p9Dbkm:Lz071uv4BPMkHC0I6Gz3N1pHP7R
MD5 SHA1 SHA512 SSDEEP

Submit Download

KHbbkQi.exe

Path C:\Windows\System\KHbbkQi.exe
Size 1.6MB
SHA256 1cb0cde1f6882a5627e2ecb006ffd47f63fa366d182f618ab8a015df073e7831
MD5 3079f78adaacd93fa2549a0956e14490
SHA1 db76db847527ace6d14ad7686943e37e646fc1c0
SHA512 0042a2b83621be2dbd04993b3d63127f5903e058a42fab1c04b59794d270f3f430eb5caef6705759f2656158a654435e2ae66fe92073bc4fafce0a6520268f5b
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjuJoz5XdUK6S1uBkr5Gqlfz+y7p9Dbki:Lz071uv4BPMkHC0I6Gz3N1pHP7L
MD5 SHA1 SHA512 SSDEEP

Submit Download

KiJMIgz.exe

Path C:\Windows\System\KiJMIgz.exe
Size 1.6MB
SHA256 6b153c6e80a1c2d03f419c6ff3b516693996330fff359835f87f7990266ab15c
MD5 08a82e1ddb23255aee1c3845c24d99a2
SHA1 d80ffb9a40556a9331680b05f054f5102d9b3d76
SHA512 948f0a7d901734128155dfb8543e3f34444af273c179c4867f7b18607f47912d7ab3ed1ea74816bca1e67f0e7e61da233e5f89f2804d3947ea1a5a0f48cf440b
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjuJoz5XdUK6S1uBkr5Gqlfz+y7p9Dbk7L:Lz071uv4BPMkHC0I6Gz3N1pHP7YcG
MD5 SHA1 SHA512 SSDEEP

Submit Download

LLSeDXl.exe

Path C:\Windows\System\LLSeDXl.exe
Size 1.6MB
SHA256 89632b680fee38b3a1f1684b1b6313a04732cc1ec7f603f02ef82f980951b333
MD5 e453b78c1e977fccf20e1ce5abf9e0a1
SHA1 ce683cd1704589e2491a6f8c74fee81920944a5f
SHA512 607b7186019f792505ebacaf165a43853b6656a78156bc29fb995028f0837f2e6eb1a1b576e4534ff8081f0ed54ce37c24c289d9980c7d83c6a626ac57043c47
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjuJoz5XdUK6S1uBkr5Gqlfz+y7p9DbkD:Lz071uv4BPMkHC0I6Gz3N1pHP7q
MD5 SHA1 SHA512 SSDEEP

Submit Download

MJvhwPG.exe

Path C:\Windows\System\MJvhwPG.exe
Size 1.6MB
SHA256 b98d112bb1351a2d5701b13d98d979cb3436791ff3935c8c3b3a830fbdda6c9a
MD5 2f641ae27128f3c475ed784a90ee0ac0
SHA1 b8aefbba67a091ee435ee5031e133441108af314
SHA512 c324701cfe7ce6f436fbd80eb8e32c7385d75b401cbe85fb6b849cbb507c2cbaf9e6045493e698eb7e9936f01f6f8e51e2f90cc657a53b94e8a49b45db7d18d7
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjuJoz5XdUK6S1uBkr5Gqlfz+y7p9Dbkl:Lz071uv4BPMkHC0I6Gz3N1pHP7O
MD5 SHA1 SHA512 SSDEEP

Submit Download

MxDBSof.exe

Path C:\Windows\System\MxDBSof.exe
Size 1.6MB
SHA256 0e0d7718719562023301e1e2d113421c79a7ce956c63cf368c368195f7a7a8a7
MD5 feb4c41fd87b6ed41a7fee86448905b7
SHA1 fecc3022421297bd014839469120c8d444b7ff1c
SHA512 a0dbcf4426cc578ffc17009973e55bdfbfeafe094fe84006b8c03e1f71f9f0c4c462460d3e421eaa7a09718a44e3475bea482fbdfceae7b268a2ae523093e317
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjuJoz5XdUK6S1uBkr5Gqlfz+y7p9Dbkqr:Lz071uv4BPMkHC0I6Gz3N1pHP7Hr
MD5 SHA1 SHA512 SSDEEP

Submit Download

PhdjnIF.exe

Path C:\Windows\System\PhdjnIF.exe
Size 1.6MB
SHA256 9d4667b7c0deba79769d7529517fbcc796534a49adebcb74ab1a374b1b5d3702
MD5 f633ff367b533568ac446910075a3de8
SHA1 d0a11f722b97dff16a34fe46479e1e3365a9c5fa
SHA512 81b92fb56c86f0038a8c53724613cd898c82668721b6a5e51a327b550607fd564ab80e30505124ae2525c72c03419a768887ce3a93f0e3b678ac834c43a729e3
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjuJoz5XdUK6S1uBkr5Gqlfz+y7p9DbkC:Lz071uv4BPMkHC0I6Gz3N1pHP73
MD5 SHA1 SHA512 SSDEEP

Submit Download

QcQynjJ.exe

Path C:\Windows\System\QcQynjJ.exe
Size 1.6MB
SHA256 1981d800b5a1f406b943fab64b47197d9b7a6d053a6812edf186b537b4710c89
MD5 815c8f94a280e901cb35d02af63639fa
SHA1 ffe5796284a9039ce24108696d193f214b185ba2
SHA512 3b7d39f58d88e7b9d2ef2e1ae63a99b9f6f20728d6302ba7537c30fbe58489cc76633cfe5cd0f686e2678a2a1502d5779b206e41cf0cc8e49bdefc61af00ba09
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjuJoz5XdUK6S1uBkr5Gqlfz+y7p9DbkM0:Lz071uv4BPMkHC0I6Gz3N1pHP710
MD5 SHA1 SHA512 SSDEEP

Submit Download

XltZrLH.exe

Path C:\Windows\System\XltZrLH.exe
Size 1.6MB
SHA256 11f7b66a0c02d54c9944cd915b9de09ab8508215ed9d8c6eeed7a52b5453f9fd
MD5 e456c64538d069203531f24104d98194
SHA1 64a148cdb70662bcac8a427ef4a6ebff51049fe7
SHA512 5576f77fdcee8ca8304708278c49f945da280d54112594b68d6f8751a7f43939beaaa0d53b6b72cbeefc6b0cdaa749c40bda8dc0fd3f13f02b5b50ff033283fa
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjuJoz5XdUK6S1uBkr5Gqlfz+y7p9DbkX:Lz071uv4BPMkHC0I6Gz3N1pHP74
MD5 SHA1 SHA512 SSDEEP

Submit Download

XozXZGy.exe

Path C:\Windows\System\XozXZGy.exe
Size 1.6MB
SHA256 25ae14b4eec4b9aa9b3137973b1e5fd8d1c48a7939aa3817e6aaf7b286a71549
MD5 3908c7d96012e47599c6614697182bf7
SHA1 0ea2508fead394e4a70e12c31af273a05c0a2b7d
SHA512 3b93810a8c18ad0f99baafc4fd5dd1219b5bace8de14053c08afb91761d52b5c644125a3ac25bf92e2899afc7f227a36faa4d6ab2644c6e5c277f172bf114f64
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjuJoz5XdUK6S1uBkr5Gqlfz+y7p9Dbk1:Lz071uv4BPMkHC0I6Gz3N1pHP7e
MD5 SHA1 SHA512 SSDEEP

Submit Download

YCqmKKH.exe

Path C:\Windows\System\YCqmKKH.exe
Size 1.6MB
SHA256 bff7b2f01ff2b1ee2188d330cfb9c9d7111da0990277d1ca22fc767cb2d94c58
MD5 f55d0e54f2a316e4138c8b926923121f
SHA1 949a2ca751cc4fc42d1566280c72c6256c63e75e
SHA512 723ea0b584a366399c0b96bcc83be3a2f40d00b66ba2a92cb25207bffbf8dede6ec1284aa607873cf09bc94119e0d88a2d8df263069fc90a1ff2ce99c60e37f9
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjuJoz5XdUK6S1uBkr5Gqlfz+y7p9Dbk5:Lz071uv4BPMkHC0I6Gz3N1pHP7c
MD5 SHA1 SHA512 SSDEEP

Submit Download

YLWwwJh.exe

Path C:\Windows\System\YLWwwJh.exe
Size 1.6MB
SHA256 dd92d9c8cfdcdf7149a3a244cb8287d469bf677fe2b04b2d3ea165806e8a2a1f
MD5 68eaa6ab03400c8c69fece7685ae94ee
SHA1 37191796f66974a7702e8a1f9ee760cb7431ed58
SHA512 fdef8ed804e77dc0500240266e95f2896faac9aaff62737544db9064981b0f42a2a177338729e0cb7179b4e7744cc9c06a9118609166079bccdb5058c50d7b51
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjuJoz5XdUK6S1uBkr5Gqlfz+y7p9Dbk+:Lz071uv4BPMkHC0I6Gz3N1pHP73
MD5 SHA1 SHA512 SSDEEP

Submit Download

aJyyNlY.exe

Path C:\Windows\System\aJyyNlY.exe
Size 1.6MB
SHA256 8686f0c8851dc2e7de247fa613dc0d612f77d37fb8c14a45f80bd582186e2608
MD5 ba0d7b85a0f4a1a045d41b462c91c354
SHA1 cd42d3345fd5e0e859b973b7e8cd0ba242bcedaf
SHA512 e5790400dbe0a3ac16010f05e81877f01f635c81edd49da255728349d12b1630f1e577d12a12c0d44545067c84588a8f58d9962904dcc62809dbe2d6047ac928
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjuJoz5XdUK6S1uBkr5Gqlfz+y7p9DbkW:Lz071uv4BPMkHC0I6Gz3N1pHP7f
MD5 SHA1 SHA512 SSDEEP

Submit Download

cUBpDWq.exe

Path C:\Windows\System\cUBpDWq.exe
Size 1.6MB
SHA256 cebce47da11d65c2c1cb14d8fe98f51e5493b37a24f5291aa370aefb4aaa0694
MD5 766785e8e1c1cb84cf08fb314a10455f
SHA1 d11062a6f0d50cc96c57d051b1f0575046f883cd
SHA512 9b88a5939d37bfb3cc947a059fdaf533c1522060ab9f0ac9bd8c0defb05ba54d4b7403474d2d6e087aaa734167c46afd80311f3d77cc507b90eb37fde2e1d075
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjuJoz5XdUK6S1uBkr5Gqlfz+y7p9DbkN:Lz071uv4BPMkHC0I6Gz3N1pHP7C
MD5 SHA1 SHA512 SSDEEP

Submit Download

cXVKlFk.exe

Path C:\Windows\System\cXVKlFk.exe
Size 1.6MB
SHA256 0c378aee5d33a68e1e59fdfce8239223cd1a0130f9561413d2e8dfb120e6644c
MD5 2124ad19aae4230b164a08e800e2c7cd
SHA1 554f6602f4b3ed28c602078a6313c36ec63bb6a1
SHA512 e66807b86d02014d6804f22f25e03f0573889014d7a2c2234835d6065bc127931e0576136b09b72d7a149eb08d053e1ebe025ca8e3d0c9d682d7f9d2dd365a29
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjuJoz5XdUK6S1uBkr5Gqlfz+y7p9DbkE:Lz071uv4BPMkHC0I6Gz3N1pHP79
MD5 SHA1 SHA512 SSDEEP

Submit Download

iZEdpQi.exe

Path C:\Windows\System\iZEdpQi.exe
Size 1.6MB
SHA256 f7a06cd45d6ca427b3c91387d941076fcfdb023256185168dd863ee16a9f5356
MD5 7966255ee7b8715b2ba458c22835e494
SHA1 17c5fc301f6e8a841a98eb5ec59c56aee00070ad
SHA512 49b7fd32f335ff901f55c2a417b5b203006bc2fdc13df0c07040519c04f00ebb88bb1ef92942664a3ce382822c735b754b9dca054e98694023c22f6c6e46415a
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjuJoz5XdUK6S1uBkr5Gqlfz+y7p9DbkY:Lz071uv4BPMkHC0I6Gz3N1pHP7J
MD5 SHA1 SHA512 SSDEEP

Submit Download

kyDOnvt.exe

Path C:\Windows\System\kyDOnvt.exe
Size 1.6MB
SHA256 2455ce2105b2d9e470bcdeb64dcd86b37ea866006b03cb79daeb12df09ca6333
MD5 310d38bb737a8097a420cad18b892fac
SHA1 3e3f46278f88fca3dcb96cde5df6dc07540c21bb
SHA512 9ddeb7afdf3cf6e0955cc9bbe495b1460af221f226aadd83d844b0f37d2824ccc5374a6e65d37d67a914dbb2bdd645cd26a3d15797b23b05b748ed2224a2aef3
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjuJoz5XdUK6S1uBkr5Gqlfz+y7p9Dbku:Lz071uv4BPMkHC0I6Gz3N1pHP7H
MD5 SHA1 SHA512 SSDEEP

Submit Download

mPwMbXS.exe

Path C:\Windows\System\mPwMbXS.exe
Size 1.6MB
SHA256 c9f2fba874a07349fb5280aa1e05b858c315fbe3e06dba55f13e37b4c6e4542c
MD5 3d3f652d1490a07648c3934b3ead912b
SHA1 b931be6de48c2f3570675cb4a36f1540fd294020
SHA512 fffd68bbd42dee844b9ccf4bc02e9af95c6efb1d50c099bf104c4277b9a942a88edfcbb64e5259745a7ce859cc37cd7c23ca74f7b3115467a1230e8f027ea60d
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjuJoz5XdUK6S1uBkr5Gqlfz+y7p9DbkF:Lz071uv4BPMkHC0I6Gz3N1pHP7q
MD5 SHA1 SHA512 SSDEEP

Submit Download

nONkfmh.exe

Path C:\Windows\System\nONkfmh.exe
Size 1.6MB
SHA256 e436c997b9ee91e3ca252981c34ed4eba2152ad0f6c5e3259bfb61116767302f
MD5 90248b09c618695ae2a91f46fd470f60
SHA1 c4e0a6507dbd730e65b089ba0371e471c94b13bc
SHA512 0ce8868eacbca5b2e402a7965e8e72b6b17003092bebba1560cd35c6e6ac91b15c1c2661753d561e93aa4b1ce4142b1b036161355d88cd1ffd25774ba432dbc7
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjuJoz5XdUK6S1uBkr5Gqlfz+y7p9DbkG:Lz071uv4BPMkHC0I6Gz3N1pHP7P
MD5 SHA1 SHA512 SSDEEP

Submit Download

oiKRrFO.exe

Path C:\Windows\System\oiKRrFO.exe
Size 8B
SHA256 2097394cabc160a9df2f746df2b02abe3caad35caebdb855f94e869ef6004673
MD5 e216125f6ec8a71ed511fce858ed30eb
SHA1 050cc8d12c9a1af3716df8cd26567943726d3366
SHA512 1ac9f8982e0ad73ffc5075b337a3e3f491f85f11a7d1a7e27a4798e5b39f52143905d90909f5a0732fa6e625f6b0719a56e5ded5ac563b3a5f32c20c4c30e446
MD5 SHA1 SHA512

Submit Download

qrSaZgQ.exe

Path C:\Windows\System\qrSaZgQ.exe
Size 1.6MB
SHA256 d3af40f3a137f44e0e5010173e9757aaf565ed07c06647a6205f0779ee265c26
MD5 bad992ec1b4b68f54d3e5c078318f216
SHA1 f284f7adc318918c83a79efb0c0e7f78c01eed83
SHA512 2eb5ab06bdf73c5877ee4790da80f8520bddbbada064c9e2f35238f109ff5e7ddf945f4e0feae1a1eaa44615de16c4c26d771326959bc28b2b8d2467b05587ca
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjuJoz5XdUK6S1uBkr5Gqlfz+y7p9Dbku:Lz071uv4BPMkHC0I6Gz3N1pHP7F
MD5 SHA1 SHA512 SSDEEP

Submit Download

ruXDCUN.exe

Path C:\Windows\System\ruXDCUN.exe
Size 1.6MB
SHA256 7834d00d9426b51753ec75022d0a4b1a267eb96025d9035966fc7e0b75946c4d
MD5 c63ecca6d8684c3670a372ea2255ce44
SHA1 0653a36ac091183db4255f160473d3b174c3b70b
SHA512 7ca17b3d3b8f1fa46daf20410185ae1325b28bca2b851745f9626aa7fb1b8a2ce88ac50e5a5cf91099fbd9a9bf514b1322c9a48f4a59a30585ac07155d9b0d29
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjuJoz5XdUK6S1uBkr5Gqlfz+y7p9DbkT:Lz071uv4BPMkHC0I6Gz3N1pHP7k
MD5 SHA1 SHA512 SSDEEP

Submit Download

vQoqsLx.exe

Path C:\Windows\System\vQoqsLx.exe
Size 1.6MB
SHA256 ec28b5a6a4d9b3bd036ee13f8e680ee174de3de5aa8793f412311a44d84d75b5
MD5 8c78a4407b6159b3af2b64bde8fdb97f
SHA1 c3ba1db2e227ce8e493007bad9fd09ed338671f4
SHA512 683cb624a3e5d65923ca6321dfc44fa57cb7a4e8ffdf7fd8085a23ef053d6a318b12f0947fc1deac42b6122f094917dcf0c702466f3307736746f5598d37339c
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjuJoz5XdUK6S1uBkr5Gqlfz+y7p9Dbkf:Lz071uv4BPMkHC0I6Gz3N1pHP72
MD5 SHA1 SHA512 SSDEEP

Submit Download

whaMVIT.exe

Path C:\Windows\System\whaMVIT.exe
Size 1.6MB
SHA256 7efca35e43e638210811bdde78ec691fc86b25919e8bd9ff26c7fd4b8c2091f3
MD5 d180dcafda656613ffa5388e55ec5968
SHA1 c971121846e1851b6bce3559f795e9af9d3991f9
SHA512 617a0d0a73cf25fec123aa9967162fa8f5912a4ad81d083cf90a16e06f69a83ad8047192e8cdd3d9f569ca4d3121393a802149f56a7d7992fc745164e21401f4
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjuJoz5XdUK6S1uBkr5Gqlfz+y7p9DbkP:Lz071uv4BPMkHC0I6Gz3N1pHP70
MD5 SHA1 SHA512 SSDEEP

Submit Download

wlGPxho.exe

Path C:\Windows\System\wlGPxho.exe
Size 1.6MB
SHA256 bbb53a295342e90fd84d19ea4de7ed6944aad14034a780931ca20ef67b80da99
MD5 4869b7dcd38c8e4e02a0a536d7d2d368
SHA1 167a50e4e576e78b9f9759862ebab1f948375585
SHA512 02ffca77bc5f64223d644bc347d082b791c04e597659d87f127251b75b044620416b09993411f341d964e3d1fffb79810df5fbd112304d00dcae58bdc215bf70
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjuJoz5XdUK6S1uBkr5Gqlfz+y7p9DbkI:Lz071uv4BPMkHC0I6Gz3N1pHP7D
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/456-142-0x00007FF6866B0000-0x00007FF686AA2000-memory.dmp

Download

memory/456-2792-0x00007FF6866B0000-0x00007FF686AA2000-memory.dmp

Download

memory/808-97-0x00007FF764600000-0x00007FF7649F2000-memory.dmp

Download

memory/808-2781-0x00007FF764600000-0x00007FF7649F2000-memory.dmp

Download

memory/1176-136-0x00007FF71B710000-0x00007FF71BB02000-memory.dmp

Download

memory/1176-2787-0x00007FF71B710000-0x00007FF71BB02000-memory.dmp

Download

memory/1372-171-0x00007FF73E610000-0x00007FF73EA02000-memory.dmp

Download

memory/1372-2806-0x00007FF73E610000-0x00007FF73EA02000-memory.dmp

Download

memory/1388-2814-0x00007FF7574B0000-0x00007FF7578A2000-memory.dmp

Download

memory/1388-204-0x00007FF7574B0000-0x00007FF7578A2000-memory.dmp

Download

memory/1448-8-0x00007FF664A10000-0x00007FF664E02000-memory.dmp

Download

memory/1448-2760-0x00007FF664A10000-0x00007FF664E02000-memory.dmp

Download

memory/1448-2766-0x00007FF664A10000-0x00007FF664E02000-memory.dmp

Download

memory/1488-2748-0x00007FF69CE10000-0x00007FF69D202000-memory.dmp

Download

memory/1488-0-0x00007FF69CE10000-0x00007FF69D202000-memory.dmp

Download

memory/1488-1-0x000001E472E80000-0x000001E472E90000-memory.dmp

Download

memory/1500-2790-0x00007FF7ECAD0000-0x00007FF7ECEC2000-memory.dmp

Download

memory/1500-107-0x00007FF7ECAD0000-0x00007FF7ECEC2000-memory.dmp

Download

memory/1588-474-0x000001A07C660000-0x000001A07CE06000-memory.dmp

Download

memory/1588-62-0x00007FFB43780000-0x00007FFB44241000-memory.dmp

Download

memory/1588-2763-0x00007FFB43783000-0x00007FFB43785000-memory.dmp

Download

memory/1588-9-0x00007FFB43783000-0x00007FFB43785000-memory.dmp

Download

memory/1588-78-0x000001A07BB40000-0x000001A07BB62000-memory.dmp

Download

memory/1588-2840-0x00007FFB43780000-0x00007FFB44241000-memory.dmp

Download

memory/1588-41-0x00007FFB43780000-0x00007FFB44241000-memory.dmp

Download

memory/1772-195-0x00007FF6BC2E0000-0x00007FF6BC6D2000-memory.dmp

Download

memory/1772-2817-0x00007FF6BC2E0000-0x00007FF6BC6D2000-memory.dmp

Download

memory/1912-205-0x00007FF66AF20000-0x00007FF66B312000-memory.dmp

Download

memory/1912-2810-0x00007FF66AF20000-0x00007FF66B312000-memory.dmp

Download

memory/2144-2785-0x00007FF7BBB80000-0x00007FF7BBF72000-memory.dmp

Download

memory/2144-101-0x00007FF7BBB80000-0x00007FF7BBF72000-memory.dmp

Download

memory/2264-2769-0x00007FF6B3D90000-0x00007FF6B4182000-memory.dmp

Download

memory/2264-113-0x00007FF6B3D90000-0x00007FF6B4182000-memory.dmp

Download

memory/2464-2770-0x00007FF724850000-0x00007FF724C42000-memory.dmp

Download

memory/2464-82-0x00007FF724850000-0x00007FF724C42000-memory.dmp

Download

memory/2512-177-0x00007FF78EFD0000-0x00007FF78F3C2000-memory.dmp

Download

memory/2512-2813-0x00007FF78EFD0000-0x00007FF78F3C2000-memory.dmp

Download

memory/2560-2783-0x00007FF66BE40000-0x00007FF66C232000-memory.dmp

Download

memory/2560-124-0x00007FF66BE40000-0x00007FF66C232000-memory.dmp

Download

memory/3160-2796-0x00007FF65C960000-0x00007FF65CD52000-memory.dmp

Download

memory/3160-148-0x00007FF65C960000-0x00007FF65CD52000-memory.dmp

Download

memory/3432-2778-0x00007FF7EA9D0000-0x00007FF7EADC2000-memory.dmp

Download

memory/3432-89-0x00007FF7EA9D0000-0x00007FF7EADC2000-memory.dmp

Download

memory/3564-154-0x00007FF747470000-0x00007FF747862000-memory.dmp

Download

memory/3564-2800-0x00007FF747470000-0x00007FF747862000-memory.dmp

Download

memory/3968-86-0x00007FF7D2750000-0x00007FF7D2B42000-memory.dmp

Download

memory/3968-2774-0x00007FF7D2750000-0x00007FF7D2B42000-memory.dmp

Download

memory/3992-2776-0x00007FF653020000-0x00007FF653412000-memory.dmp

Download

memory/3992-75-0x00007FF653020000-0x00007FF653412000-memory.dmp

Download

memory/4004-2818-0x00007FF66B620000-0x00007FF66BA12000-memory.dmp

Download

memory/4004-189-0x00007FF66B620000-0x00007FF66BA12000-memory.dmp

Download

memory/4244-2773-0x00007FF7429B0000-0x00007FF742DA2000-memory.dmp

Download

memory/4244-70-0x00007FF7429B0000-0x00007FF742DA2000-memory.dmp

Download

memory/4392-2809-0x00007FF662760000-0x00007FF662B52000-memory.dmp

Download

memory/4392-183-0x00007FF662760000-0x00007FF662B52000-memory.dmp

Download

memory/4632-2802-0x00007FF718870000-0x00007FF718C62000-memory.dmp

Download

memory/4632-160-0x00007FF718870000-0x00007FF718C62000-memory.dmp

Download

memory/5004-130-0x00007FF659880000-0x00007FF659C72000-memory.dmp

Download

memory/5004-2788-0x00007FF659880000-0x00007FF659C72000-memory.dmp

Download