xmrig | cd80f6a1d3297074133f4db3adf1d7594cc85b5da509498c9ec22b7426ce2cc0

Analysis

max time kernel
150s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
24-05-2024 03:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a1b0a364b42c2fc882b526ffba6a7100_NeikiAnalytics.exe
Size

2.9MB
MD5

a1b0a364b42c2fc882b526ffba6a7100
SHA1

a400e02a83f8b3fe3d9ab4e091150e5791a112b2
SHA256

cd80f6a1d3297074133f4db3adf1d7594cc85b5da509498c9ec22b7426ce2cc0
SHA512

bd2f56fafabcb175041bae6dcd8b9e1952b68a7bc69733efec99f8275d44400f4a1c5dbd9b3084beed019153b3a8ae9e070ec64acb5a6ebe6569385fe43742bd
SSDEEP

49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkFfdg6NsNtJViKE:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2RY

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 64 IoCs

miner

Processes:

resource	yara_rule
behavioral2/memory/4324-0-0x00007FF7D9050000-0x00007FF7D9446000-memory.dmp	xmrig
C:\Windows\System\MtLkUJp.exe	xmrig
C:\Windows\System\lUXcoJo.exe	xmrig
C:\Windows\System\dsyrXWK.exe	xmrig
C:\Windows\System\XurdfUk.exe	xmrig
C:\Windows\System\FmZNBPT.exe	xmrig
C:\Windows\System\ronsnyc.exe	xmrig
C:\Windows\System\mDNUcDC.exe	xmrig
behavioral2/memory/2416-75-0x00007FF6E2FF0000-0x00007FF6E33E6000-memory.dmp	xmrig
behavioral2/memory/4168-78-0x00007FF6587A0000-0x00007FF658B96000-memory.dmp	xmrig
behavioral2/memory/3144-80-0x00007FF7CA0E0000-0x00007FF7CA4D6000-memory.dmp	xmrig
behavioral2/memory/3924-81-0x00007FF7EBEE0000-0x00007FF7EC2D6000-memory.dmp	xmrig
behavioral2/memory/1220-79-0x00007FF6624F0000-0x00007FF6628E6000-memory.dmp	xmrig
C:\Windows\System\NqqMCfg.exe	xmrig
behavioral2/memory/4936-71-0x00007FF670B00000-0x00007FF670EF6000-memory.dmp	xmrig
C:\Windows\System\RlHXRKb.exe	xmrig
behavioral2/memory/2512-67-0x00007FF662820000-0x00007FF662C16000-memory.dmp	xmrig
behavioral2/memory/2044-63-0x00007FF68BD90000-0x00007FF68C186000-memory.dmp	xmrig
behavioral2/memory/4964-59-0x00007FF6F5A00000-0x00007FF6F5DF6000-memory.dmp	xmrig
C:\Windows\System\NQPROAr.exe	xmrig
behavioral2/memory/2688-52-0x00007FF75DE90000-0x00007FF75E286000-memory.dmp	xmrig
behavioral2/memory/3364-46-0x00007FF646840000-0x00007FF646C36000-memory.dmp	xmrig
C:\Windows\System\TSCzWob.exe	xmrig
C:\Windows\System\JxQYQdI.exe	xmrig
behavioral2/memory/3748-126-0x00007FF6A7E40000-0x00007FF6A8236000-memory.dmp	xmrig
behavioral2/memory/4788-147-0x00007FF60A550000-0x00007FF60A946000-memory.dmp	xmrig
C:\Windows\System\mHSHVUy.exe	xmrig
C:\Windows\System\JTYEStR.exe	xmrig
C:\Windows\System\ADdcPvP.exe	xmrig
C:\Windows\System\NNXsZAU.exe	xmrig
behavioral2/memory/5024-224-0x00007FF7F61F0000-0x00007FF7F65E6000-memory.dmp	xmrig
behavioral2/memory/856-230-0x00007FF76C230000-0x00007FF76C626000-memory.dmp	xmrig
behavioral2/memory/1556-241-0x00007FF7898A0000-0x00007FF789C96000-memory.dmp	xmrig
behavioral2/memory/4056-251-0x00007FF6F2C50000-0x00007FF6F3046000-memory.dmp	xmrig
behavioral2/memory/1660-259-0x00007FF6D9E30000-0x00007FF6DA226000-memory.dmp	xmrig
behavioral2/memory/2980-258-0x00007FF7EABF0000-0x00007FF7EAFE6000-memory.dmp	xmrig
C:\Windows\System\zEWqZUx.exe	xmrig
C:\Windows\System\nPtEuBq.exe	xmrig
C:\Windows\System\qEhdZAg.exe	xmrig
C:\Windows\System\GMGTNuJ.exe	xmrig
C:\Windows\System\LZegYwJ.exe	xmrig
C:\Windows\System\DvKczsG.exe	xmrig
C:\Windows\System\vobsHYd.exe	xmrig
C:\Windows\System\eAZQMJe.exe	xmrig
C:\Windows\System\aUznMrY.exe	xmrig
behavioral2/memory/4464-248-0x00007FF663780000-0x00007FF663B76000-memory.dmp	xmrig
C:\Windows\System\kBqTnsx.exe	xmrig
C:\Windows\System\aYjVFDL.exe	xmrig
behavioral2/memory/4080-211-0x00007FF6BFE60000-0x00007FF6C0256000-memory.dmp	xmrig
C:\Windows\System\NbasLuA.exe	xmrig
behavioral2/memory/2744-193-0x00007FF6CD370000-0x00007FF6CD766000-memory.dmp	xmrig
C:\Windows\System\wgISyOg.exe	xmrig
C:\Windows\System\XzbUEhh.exe	xmrig
C:\Windows\System\tMMTuew.exe	xmrig
behavioral2/memory/1624-178-0x00007FF659110000-0x00007FF659506000-memory.dmp	xmrig
behavioral2/memory/396-154-0x00007FF7128E0000-0x00007FF712CD6000-memory.dmp	xmrig
C:\Windows\System\ygJiZDy.exe	xmrig
C:\Windows\System\lTTrisV.exe	xmrig
behavioral2/memory/4324-2105-0x00007FF7D9050000-0x00007FF7D9446000-memory.dmp	xmrig
behavioral2/memory/2512-2108-0x00007FF662820000-0x00007FF662C16000-memory.dmp	xmrig
behavioral2/memory/4788-2109-0x00007FF60A550000-0x00007FF60A946000-memory.dmp	xmrig
behavioral2/memory/1624-2110-0x00007FF659110000-0x00007FF659506000-memory.dmp	xmrig
behavioral2/memory/4080-2112-0x00007FF6BFE60000-0x00007FF6C0256000-memory.dmp	xmrig
behavioral2/memory/5024-2113-0x00007FF7F61F0000-0x00007FF7F65E6000-memory.dmp	xmrig

Blocklisted process makes network request 7 IoCs

Processes:

powershell.exe

flow	pid	process
10	1944	powershell.exe
12	1944	powershell.exe
14	1944	powershell.exe
15	1944	powershell.exe
17	1944	powershell.exe
21	1944	powershell.exe
22	1944	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Powershell Invoke Web Request.
execution

PowerShell
T1059.001

Processes:

powershell.exe

pid process

1944 powershell.exe

pid	process
1944	powershell.exe

Executes dropped EXE 64 IoCs

Processes:

MtLkUJp.exedsyrXWK.exelUXcoJo.exeXurdfUk.exeFmZNBPT.exeNQPROAr.exeTSCzWob.exeRlHXRKb.exeronsnyc.exemDNUcDC.exeNqqMCfg.exeJxQYQdI.exelTTrisV.exeygJiZDy.exetMMTuew.exeXzbUEhh.exemHSHVUy.exewgISyOg.exeNbasLuA.exeJTYEStR.exeADdcPvP.exeNNXsZAU.exeaYjVFDL.exekBqTnsx.exezEWqZUx.exeaUznMrY.exeeAZQMJe.exevobsHYd.exenPtEuBq.exeDvKczsG.exeGMGTNuJ.exeLZegYwJ.exeqEhdZAg.exeKmHwysN.exeDCxyChW.exeEpzhjuw.exeOSefqeN.exeLqydMMz.exeWXvfUHr.exeWjNgRbK.exelVjxyUt.exeGVgIBVb.exeKoXjfbG.exerHRCmbr.exeptgmraP.exeajLTHBg.exefRaewiI.exejGdYHHF.exeDmlehqA.exewNITwfr.exeANoHpZU.exemvSfevo.exeZVSjiEX.exeVWCIqHm.exeiGLdLtw.exeYaCMCLA.exeJAEIQIa.exeufRehqG.exeDUmWsJp.exeUolkZYD.exeaUtfWZS.exeYOnAXaK.exeKZVFmlD.exewPYcYDo.exe

pid	process
4936	MtLkUJp.exe
3364	dsyrXWK.exe
2416	lUXcoJo.exe
2688	XurdfUk.exe
4168	FmZNBPT.exe
4964	NQPROAr.exe
2044	TSCzWob.exe
1220	RlHXRKb.exe
2512	ronsnyc.exe
3144	mDNUcDC.exe
3924	NqqMCfg.exe
3748	JxQYQdI.exe
856	lTTrisV.exe
4788	ygJiZDy.exe
1556	tMMTuew.exe
396	XzbUEhh.exe
1624	mHSHVUy.exe
4464	wgISyOg.exe
2744	NbasLuA.exe
4080	JTYEStR.exe
4056	ADdcPvP.exe
2980	NNXsZAU.exe
5024	aYjVFDL.exe
1660	kBqTnsx.exe
3064	zEWqZUx.exe
3960	aUznMrY.exe
1424	eAZQMJe.exe
4804	vobsHYd.exe
2468	nPtEuBq.exe
1000	DvKczsG.exe
3516	GMGTNuJ.exe
432	LZegYwJ.exe
5060	qEhdZAg.exe
1832	KmHwysN.exe
2032	DCxyChW.exe
3312	Epzhjuw.exe
4808	OSefqeN.exe
4260	LqydMMz.exe
3492	WXvfUHr.exe
1200	WjNgRbK.exe
2332	lVjxyUt.exe
2756	GVgIBVb.exe
1908	KoXjfbG.exe
3400	rHRCmbr.exe
1360	ptgmraP.exe
2284	ajLTHBg.exe
2092	fRaewiI.exe
512	jGdYHHF.exe
3468	DmlehqA.exe
4668	wNITwfr.exe
2256	ANoHpZU.exe
3384	mvSfevo.exe
1920	ZVSjiEX.exe
3120	VWCIqHm.exe
216	iGLdLtw.exe
3184	YaCMCLA.exe
2528	JAEIQIa.exe
4100	ufRehqG.exe
556	DUmWsJp.exe
220	UolkZYD.exe
1008	aUtfWZS.exe
5072	YOnAXaK.exe
3008	KZVFmlD.exe
2176	wPYcYDo.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/4324-0-0x00007FF7D9050000-0x00007FF7D9446000-memory.dmp	upx
C:\Windows\System\MtLkUJp.exe	upx
C:\Windows\System\lUXcoJo.exe	upx
C:\Windows\System\dsyrXWK.exe	upx
C:\Windows\System\XurdfUk.exe	upx
C:\Windows\System\FmZNBPT.exe	upx
C:\Windows\System\ronsnyc.exe	upx
C:\Windows\System\mDNUcDC.exe	upx
behavioral2/memory/2416-75-0x00007FF6E2FF0000-0x00007FF6E33E6000-memory.dmp	upx
behavioral2/memory/4168-78-0x00007FF6587A0000-0x00007FF658B96000-memory.dmp	upx
behavioral2/memory/3144-80-0x00007FF7CA0E0000-0x00007FF7CA4D6000-memory.dmp	upx
behavioral2/memory/3924-81-0x00007FF7EBEE0000-0x00007FF7EC2D6000-memory.dmp	upx
behavioral2/memory/1220-79-0x00007FF6624F0000-0x00007FF6628E6000-memory.dmp	upx
C:\Windows\System\NqqMCfg.exe	upx
behavioral2/memory/4936-71-0x00007FF670B00000-0x00007FF670EF6000-memory.dmp	upx
C:\Windows\System\RlHXRKb.exe	upx
behavioral2/memory/2512-67-0x00007FF662820000-0x00007FF662C16000-memory.dmp	upx
behavioral2/memory/2044-63-0x00007FF68BD90000-0x00007FF68C186000-memory.dmp	upx
behavioral2/memory/4964-59-0x00007FF6F5A00000-0x00007FF6F5DF6000-memory.dmp	upx
C:\Windows\System\NQPROAr.exe	upx
behavioral2/memory/2688-52-0x00007FF75DE90000-0x00007FF75E286000-memory.dmp	upx
behavioral2/memory/3364-46-0x00007FF646840000-0x00007FF646C36000-memory.dmp	upx
C:\Windows\System\TSCzWob.exe	upx
C:\Windows\System\JxQYQdI.exe	upx
behavioral2/memory/3748-126-0x00007FF6A7E40000-0x00007FF6A8236000-memory.dmp	upx
behavioral2/memory/4788-147-0x00007FF60A550000-0x00007FF60A946000-memory.dmp	upx
C:\Windows\System\mHSHVUy.exe	upx
C:\Windows\System\JTYEStR.exe	upx
C:\Windows\System\ADdcPvP.exe	upx
C:\Windows\System\NNXsZAU.exe	upx
behavioral2/memory/5024-224-0x00007FF7F61F0000-0x00007FF7F65E6000-memory.dmp	upx
behavioral2/memory/856-230-0x00007FF76C230000-0x00007FF76C626000-memory.dmp	upx
behavioral2/memory/1556-241-0x00007FF7898A0000-0x00007FF789C96000-memory.dmp	upx
behavioral2/memory/4056-251-0x00007FF6F2C50000-0x00007FF6F3046000-memory.dmp	upx
behavioral2/memory/1660-259-0x00007FF6D9E30000-0x00007FF6DA226000-memory.dmp	upx
behavioral2/memory/2980-258-0x00007FF7EABF0000-0x00007FF7EAFE6000-memory.dmp	upx
C:\Windows\System\zEWqZUx.exe	upx
C:\Windows\System\nPtEuBq.exe	upx
C:\Windows\System\qEhdZAg.exe	upx
C:\Windows\System\GMGTNuJ.exe	upx
C:\Windows\System\LZegYwJ.exe	upx
C:\Windows\System\DvKczsG.exe	upx
C:\Windows\System\vobsHYd.exe	upx
C:\Windows\System\eAZQMJe.exe	upx
C:\Windows\System\aUznMrY.exe	upx
behavioral2/memory/4464-248-0x00007FF663780000-0x00007FF663B76000-memory.dmp	upx
C:\Windows\System\kBqTnsx.exe	upx
C:\Windows\System\aYjVFDL.exe	upx
behavioral2/memory/4080-211-0x00007FF6BFE60000-0x00007FF6C0256000-memory.dmp	upx
C:\Windows\System\NbasLuA.exe	upx
behavioral2/memory/2744-193-0x00007FF6CD370000-0x00007FF6CD766000-memory.dmp	upx
C:\Windows\System\wgISyOg.exe	upx
C:\Windows\System\XzbUEhh.exe	upx
C:\Windows\System\tMMTuew.exe	upx
behavioral2/memory/1624-178-0x00007FF659110000-0x00007FF659506000-memory.dmp	upx
behavioral2/memory/396-154-0x00007FF7128E0000-0x00007FF712CD6000-memory.dmp	upx
C:\Windows\System\ygJiZDy.exe	upx
C:\Windows\System\lTTrisV.exe	upx
behavioral2/memory/4324-2105-0x00007FF7D9050000-0x00007FF7D9446000-memory.dmp	upx
behavioral2/memory/2512-2108-0x00007FF662820000-0x00007FF662C16000-memory.dmp	upx
behavioral2/memory/4788-2109-0x00007FF60A550000-0x00007FF60A946000-memory.dmp	upx
behavioral2/memory/1624-2110-0x00007FF659110000-0x00007FF659506000-memory.dmp	upx
behavioral2/memory/4080-2112-0x00007FF6BFE60000-0x00007FF6C0256000-memory.dmp	upx
behavioral2/memory/5024-2113-0x00007FF7F61F0000-0x00007FF7F65E6000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service
T1102

Processes:

flow ioc

10 raw.githubusercontent.com
9 raw.githubusercontent.com

flow	ioc
10	raw.githubusercontent.com
9	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

Processes:

a1b0a364b42c2fc882b526ffba6a7100_NeikiAnalytics.exe

description	ioc	process
File created	C:\Windows\System\gLRsXQt.exe	a1b0a364b42c2fc882b526ffba6a7100_NeikiAnalytics.exe
File created	C:\Windows\System\ryYnniE.exe	a1b0a364b42c2fc882b526ffba6a7100_NeikiAnalytics.exe
File created	C:\Windows\System\jlLcKRO.exe	a1b0a364b42c2fc882b526ffba6a7100_NeikiAnalytics.exe
File created	C:\Windows\System\WvXFhdf.exe	a1b0a364b42c2fc882b526ffba6a7100_NeikiAnalytics.exe
File created	C:\Windows\System\wlzREOr.exe	a1b0a364b42c2fc882b526ffba6a7100_NeikiAnalytics.exe
File created	C:\Windows\System\TjJzTTd.exe	a1b0a364b42c2fc882b526ffba6a7100_NeikiAnalytics.exe
File created	C:\Windows\System\ttECoRs.exe	a1b0a364b42c2fc882b526ffba6a7100_NeikiAnalytics.exe
File created	C:\Windows\System\bVTfJQB.exe	a1b0a364b42c2fc882b526ffba6a7100_NeikiAnalytics.exe
File created	C:\Windows\System\iZkuQVM.exe	a1b0a364b42c2fc882b526ffba6a7100_NeikiAnalytics.exe
File created	C:\Windows\System\bHlHffQ.exe	a1b0a364b42c2fc882b526ffba6a7100_NeikiAnalytics.exe
File created	C:\Windows\System\iTHpmzx.exe	a1b0a364b42c2fc882b526ffba6a7100_NeikiAnalytics.exe
File created	C:\Windows\System\DWUOBZd.exe	a1b0a364b42c2fc882b526ffba6a7100_NeikiAnalytics.exe
File created	C:\Windows\System\JDzEGZJ.exe	a1b0a364b42c2fc882b526ffba6a7100_NeikiAnalytics.exe
File created	C:\Windows\System\QWalGHz.exe	a1b0a364b42c2fc882b526ffba6a7100_NeikiAnalytics.exe
File created	C:\Windows\System\wYfqdxb.exe	a1b0a364b42c2fc882b526ffba6a7100_NeikiAnalytics.exe
File created	C:\Windows\System\LMSsKFR.exe	a1b0a364b42c2fc882b526ffba6a7100_NeikiAnalytics.exe
File created	C:\Windows\System\aFLoOTQ.exe	a1b0a364b42c2fc882b526ffba6a7100_NeikiAnalytics.exe
File created	C:\Windows\System\FEAFAoH.exe	a1b0a364b42c2fc882b526ffba6a7100_NeikiAnalytics.exe
File created	C:\Windows\System\Mwhmzxt.exe	a1b0a364b42c2fc882b526ffba6a7100_NeikiAnalytics.exe
File created	C:\Windows\System\JsCNBFA.exe	a1b0a364b42c2fc882b526ffba6a7100_NeikiAnalytics.exe
File created	C:\Windows\System\oCrZKIN.exe	a1b0a364b42c2fc882b526ffba6a7100_NeikiAnalytics.exe
File created	C:\Windows\System\CyavAKM.exe	a1b0a364b42c2fc882b526ffba6a7100_NeikiAnalytics.exe
File created	C:\Windows\System\MARgkBU.exe	a1b0a364b42c2fc882b526ffba6a7100_NeikiAnalytics.exe
File created	C:\Windows\System\azCODxn.exe	a1b0a364b42c2fc882b526ffba6a7100_NeikiAnalytics.exe
File created	C:\Windows\System\vyiaaCG.exe	a1b0a364b42c2fc882b526ffba6a7100_NeikiAnalytics.exe
File created	C:\Windows\System\VWVueMu.exe	a1b0a364b42c2fc882b526ffba6a7100_NeikiAnalytics.exe
File created	C:\Windows\System\CYaNSyg.exe	a1b0a364b42c2fc882b526ffba6a7100_NeikiAnalytics.exe
File created	C:\Windows\System\GIbqKKm.exe	a1b0a364b42c2fc882b526ffba6a7100_NeikiAnalytics.exe
File created	C:\Windows\System\kKAGbHw.exe	a1b0a364b42c2fc882b526ffba6a7100_NeikiAnalytics.exe
File created	C:\Windows\System\wQqMtTX.exe	a1b0a364b42c2fc882b526ffba6a7100_NeikiAnalytics.exe
File created	C:\Windows\System\llAaqhU.exe	a1b0a364b42c2fc882b526ffba6a7100_NeikiAnalytics.exe
File created	C:\Windows\System\lqPEmPI.exe	a1b0a364b42c2fc882b526ffba6a7100_NeikiAnalytics.exe
File created	C:\Windows\System\jAkWTPG.exe	a1b0a364b42c2fc882b526ffba6a7100_NeikiAnalytics.exe
File created	C:\Windows\System\uEkpHRs.exe	a1b0a364b42c2fc882b526ffba6a7100_NeikiAnalytics.exe
File created	C:\Windows\System\rRcLaFI.exe	a1b0a364b42c2fc882b526ffba6a7100_NeikiAnalytics.exe
File created	C:\Windows\System\OMKadLS.exe	a1b0a364b42c2fc882b526ffba6a7100_NeikiAnalytics.exe
File created	C:\Windows\System\rGFZbda.exe	a1b0a364b42c2fc882b526ffba6a7100_NeikiAnalytics.exe
File created	C:\Windows\System\lwzRNon.exe	a1b0a364b42c2fc882b526ffba6a7100_NeikiAnalytics.exe
File created	C:\Windows\System\UIvvBlQ.exe	a1b0a364b42c2fc882b526ffba6a7100_NeikiAnalytics.exe
File created	C:\Windows\System\PIBermt.exe	a1b0a364b42c2fc882b526ffba6a7100_NeikiAnalytics.exe
File created	C:\Windows\System\xymlfBa.exe	a1b0a364b42c2fc882b526ffba6a7100_NeikiAnalytics.exe
File created	C:\Windows\System\jCTlZqI.exe	a1b0a364b42c2fc882b526ffba6a7100_NeikiAnalytics.exe
File created	C:\Windows\System\fkYjGGI.exe	a1b0a364b42c2fc882b526ffba6a7100_NeikiAnalytics.exe
File created	C:\Windows\System\DUKrBYE.exe	a1b0a364b42c2fc882b526ffba6a7100_NeikiAnalytics.exe
File created	C:\Windows\System\xnLGZUa.exe	a1b0a364b42c2fc882b526ffba6a7100_NeikiAnalytics.exe
File created	C:\Windows\System\pCYenew.exe	a1b0a364b42c2fc882b526ffba6a7100_NeikiAnalytics.exe
File created	C:\Windows\System\NeiFzTZ.exe	a1b0a364b42c2fc882b526ffba6a7100_NeikiAnalytics.exe
File created	C:\Windows\System\ChEvztb.exe	a1b0a364b42c2fc882b526ffba6a7100_NeikiAnalytics.exe
File created	C:\Windows\System\YRAMlXU.exe	a1b0a364b42c2fc882b526ffba6a7100_NeikiAnalytics.exe
File created	C:\Windows\System\MldxCSg.exe	a1b0a364b42c2fc882b526ffba6a7100_NeikiAnalytics.exe
File created	C:\Windows\System\MfhNncv.exe	a1b0a364b42c2fc882b526ffba6a7100_NeikiAnalytics.exe
File created	C:\Windows\System\qfNqcrh.exe	a1b0a364b42c2fc882b526ffba6a7100_NeikiAnalytics.exe
File created	C:\Windows\System\MsjjBYi.exe	a1b0a364b42c2fc882b526ffba6a7100_NeikiAnalytics.exe
File created	C:\Windows\System\nyGFMkQ.exe	a1b0a364b42c2fc882b526ffba6a7100_NeikiAnalytics.exe
File created	C:\Windows\System\SkWjUUV.exe	a1b0a364b42c2fc882b526ffba6a7100_NeikiAnalytics.exe
File created	C:\Windows\System\jcuLLbx.exe	a1b0a364b42c2fc882b526ffba6a7100_NeikiAnalytics.exe
File created	C:\Windows\System\nTPMyUz.exe	a1b0a364b42c2fc882b526ffba6a7100_NeikiAnalytics.exe
File created	C:\Windows\System\fHkUiVj.exe	a1b0a364b42c2fc882b526ffba6a7100_NeikiAnalytics.exe
File created	C:\Windows\System\VvABHod.exe	a1b0a364b42c2fc882b526ffba6a7100_NeikiAnalytics.exe
File created	C:\Windows\System\JDqQCsH.exe	a1b0a364b42c2fc882b526ffba6a7100_NeikiAnalytics.exe
File created	C:\Windows\System\nqqzrnC.exe	a1b0a364b42c2fc882b526ffba6a7100_NeikiAnalytics.exe
File created	C:\Windows\System\OFyGzIw.exe	a1b0a364b42c2fc882b526ffba6a7100_NeikiAnalytics.exe
File created	C:\Windows\System\TzrFmrh.exe	a1b0a364b42c2fc882b526ffba6a7100_NeikiAnalytics.exe
File created	C:\Windows\System\mlOYZkR.exe	a1b0a364b42c2fc882b526ffba6a7100_NeikiAnalytics.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU

Modifies data under HKEY_USERS 18 IoCs

Processes:

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates
Key created	\REGISTRY\USER\.DEFAULT\Software
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

powershell.exe

pid process

1944 powershell.exe
1944 powershell.exe

pid	process
1944	powershell.exe
1944	powershell.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

Processes:

powershell.exea1b0a364b42c2fc882b526ffba6a7100_NeikiAnalytics.exe

description	pid	process
Token: SeDebugPrivilege	1944	powershell.exe
Token: SeLockMemoryPrivilege	4324	a1b0a364b42c2fc882b526ffba6a7100_NeikiAnalytics.exe
Token: SeLockMemoryPrivilege	4324	a1b0a364b42c2fc882b526ffba6a7100_NeikiAnalytics.exe
Token: SeCreateGlobalPrivilege	17312
Token: SeChangeNotifyPrivilege	17312
Token: 33	17312
Token: SeIncBasePriorityPrivilege	17312

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

a1b0a364b42c2fc882b526ffba6a7100_NeikiAnalytics.exe

description	pid	process	target process
PID 4324 wrote to memory of 1944	4324	a1b0a364b42c2fc882b526ffba6a7100_NeikiAnalytics.exe	powershell.exe
PID 4324 wrote to memory of 1944	4324	a1b0a364b42c2fc882b526ffba6a7100_NeikiAnalytics.exe	powershell.exe
PID 4324 wrote to memory of 4936	4324	a1b0a364b42c2fc882b526ffba6a7100_NeikiAnalytics.exe	MtLkUJp.exe
PID 4324 wrote to memory of 4936	4324	a1b0a364b42c2fc882b526ffba6a7100_NeikiAnalytics.exe	MtLkUJp.exe
PID 4324 wrote to memory of 3364	4324	a1b0a364b42c2fc882b526ffba6a7100_NeikiAnalytics.exe	dsyrXWK.exe
PID 4324 wrote to memory of 3364	4324	a1b0a364b42c2fc882b526ffba6a7100_NeikiAnalytics.exe	dsyrXWK.exe
PID 4324 wrote to memory of 2416	4324	a1b0a364b42c2fc882b526ffba6a7100_NeikiAnalytics.exe	lUXcoJo.exe
PID 4324 wrote to memory of 2416	4324	a1b0a364b42c2fc882b526ffba6a7100_NeikiAnalytics.exe	lUXcoJo.exe
PID 4324 wrote to memory of 2688	4324	a1b0a364b42c2fc882b526ffba6a7100_NeikiAnalytics.exe	XurdfUk.exe
PID 4324 wrote to memory of 2688	4324	a1b0a364b42c2fc882b526ffba6a7100_NeikiAnalytics.exe	XurdfUk.exe
PID 4324 wrote to memory of 4168	4324	a1b0a364b42c2fc882b526ffba6a7100_NeikiAnalytics.exe	FmZNBPT.exe
PID 4324 wrote to memory of 4168	4324	a1b0a364b42c2fc882b526ffba6a7100_NeikiAnalytics.exe	FmZNBPT.exe
PID 4324 wrote to memory of 4964	4324	a1b0a364b42c2fc882b526ffba6a7100_NeikiAnalytics.exe	NQPROAr.exe
PID 4324 wrote to memory of 4964	4324	a1b0a364b42c2fc882b526ffba6a7100_NeikiAnalytics.exe	NQPROAr.exe
PID 4324 wrote to memory of 2044	4324	a1b0a364b42c2fc882b526ffba6a7100_NeikiAnalytics.exe	TSCzWob.exe
PID 4324 wrote to memory of 2044	4324	a1b0a364b42c2fc882b526ffba6a7100_NeikiAnalytics.exe	TSCzWob.exe
PID 4324 wrote to memory of 1220	4324	a1b0a364b42c2fc882b526ffba6a7100_NeikiAnalytics.exe	RlHXRKb.exe
PID 4324 wrote to memory of 1220	4324	a1b0a364b42c2fc882b526ffba6a7100_NeikiAnalytics.exe	RlHXRKb.exe
PID 4324 wrote to memory of 2512	4324	a1b0a364b42c2fc882b526ffba6a7100_NeikiAnalytics.exe	ronsnyc.exe
PID 4324 wrote to memory of 2512	4324	a1b0a364b42c2fc882b526ffba6a7100_NeikiAnalytics.exe	ronsnyc.exe
PID 4324 wrote to memory of 3144	4324	a1b0a364b42c2fc882b526ffba6a7100_NeikiAnalytics.exe	mDNUcDC.exe
PID 4324 wrote to memory of 3144	4324	a1b0a364b42c2fc882b526ffba6a7100_NeikiAnalytics.exe	mDNUcDC.exe
PID 4324 wrote to memory of 3924	4324	a1b0a364b42c2fc882b526ffba6a7100_NeikiAnalytics.exe	NqqMCfg.exe
PID 4324 wrote to memory of 3924	4324	a1b0a364b42c2fc882b526ffba6a7100_NeikiAnalytics.exe	NqqMCfg.exe
PID 4324 wrote to memory of 3748	4324	a1b0a364b42c2fc882b526ffba6a7100_NeikiAnalytics.exe	JxQYQdI.exe
PID 4324 wrote to memory of 3748	4324	a1b0a364b42c2fc882b526ffba6a7100_NeikiAnalytics.exe	JxQYQdI.exe
PID 4324 wrote to memory of 856	4324	a1b0a364b42c2fc882b526ffba6a7100_NeikiAnalytics.exe	lTTrisV.exe
PID 4324 wrote to memory of 856	4324	a1b0a364b42c2fc882b526ffba6a7100_NeikiAnalytics.exe	lTTrisV.exe
PID 4324 wrote to memory of 4788	4324	a1b0a364b42c2fc882b526ffba6a7100_NeikiAnalytics.exe	ygJiZDy.exe
PID 4324 wrote to memory of 4788	4324	a1b0a364b42c2fc882b526ffba6a7100_NeikiAnalytics.exe	ygJiZDy.exe
PID 4324 wrote to memory of 1556	4324	a1b0a364b42c2fc882b526ffba6a7100_NeikiAnalytics.exe	tMMTuew.exe
PID 4324 wrote to memory of 1556	4324	a1b0a364b42c2fc882b526ffba6a7100_NeikiAnalytics.exe	tMMTuew.exe
PID 4324 wrote to memory of 396	4324	a1b0a364b42c2fc882b526ffba6a7100_NeikiAnalytics.exe	XzbUEhh.exe
PID 4324 wrote to memory of 396	4324	a1b0a364b42c2fc882b526ffba6a7100_NeikiAnalytics.exe	XzbUEhh.exe
PID 4324 wrote to memory of 1624	4324	a1b0a364b42c2fc882b526ffba6a7100_NeikiAnalytics.exe	mHSHVUy.exe
PID 4324 wrote to memory of 1624	4324	a1b0a364b42c2fc882b526ffba6a7100_NeikiAnalytics.exe	mHSHVUy.exe
PID 4324 wrote to memory of 4464	4324	a1b0a364b42c2fc882b526ffba6a7100_NeikiAnalytics.exe	wgISyOg.exe
PID 4324 wrote to memory of 4464	4324	a1b0a364b42c2fc882b526ffba6a7100_NeikiAnalytics.exe	wgISyOg.exe
PID 4324 wrote to memory of 2744	4324	a1b0a364b42c2fc882b526ffba6a7100_NeikiAnalytics.exe	NbasLuA.exe
PID 4324 wrote to memory of 2744	4324	a1b0a364b42c2fc882b526ffba6a7100_NeikiAnalytics.exe	NbasLuA.exe
PID 4324 wrote to memory of 4080	4324	a1b0a364b42c2fc882b526ffba6a7100_NeikiAnalytics.exe	JTYEStR.exe
PID 4324 wrote to memory of 4080	4324	a1b0a364b42c2fc882b526ffba6a7100_NeikiAnalytics.exe	JTYEStR.exe
PID 4324 wrote to memory of 4056	4324	a1b0a364b42c2fc882b526ffba6a7100_NeikiAnalytics.exe	ADdcPvP.exe
PID 4324 wrote to memory of 4056	4324	a1b0a364b42c2fc882b526ffba6a7100_NeikiAnalytics.exe	ADdcPvP.exe
PID 4324 wrote to memory of 2980	4324	a1b0a364b42c2fc882b526ffba6a7100_NeikiAnalytics.exe	NNXsZAU.exe
PID 4324 wrote to memory of 2980	4324	a1b0a364b42c2fc882b526ffba6a7100_NeikiAnalytics.exe	NNXsZAU.exe
PID 4324 wrote to memory of 5024	4324	a1b0a364b42c2fc882b526ffba6a7100_NeikiAnalytics.exe	aYjVFDL.exe
PID 4324 wrote to memory of 5024	4324	a1b0a364b42c2fc882b526ffba6a7100_NeikiAnalytics.exe	aYjVFDL.exe
PID 4324 wrote to memory of 1660	4324	a1b0a364b42c2fc882b526ffba6a7100_NeikiAnalytics.exe	kBqTnsx.exe
PID 4324 wrote to memory of 1660	4324	a1b0a364b42c2fc882b526ffba6a7100_NeikiAnalytics.exe	kBqTnsx.exe
PID 4324 wrote to memory of 3064	4324	a1b0a364b42c2fc882b526ffba6a7100_NeikiAnalytics.exe	zEWqZUx.exe
PID 4324 wrote to memory of 3064	4324	a1b0a364b42c2fc882b526ffba6a7100_NeikiAnalytics.exe	zEWqZUx.exe
PID 4324 wrote to memory of 3960	4324	a1b0a364b42c2fc882b526ffba6a7100_NeikiAnalytics.exe	aUznMrY.exe
PID 4324 wrote to memory of 3960	4324	a1b0a364b42c2fc882b526ffba6a7100_NeikiAnalytics.exe	aUznMrY.exe
PID 4324 wrote to memory of 1424	4324	a1b0a364b42c2fc882b526ffba6a7100_NeikiAnalytics.exe	eAZQMJe.exe
PID 4324 wrote to memory of 1424	4324	a1b0a364b42c2fc882b526ffba6a7100_NeikiAnalytics.exe	eAZQMJe.exe
PID 4324 wrote to memory of 4804	4324	a1b0a364b42c2fc882b526ffba6a7100_NeikiAnalytics.exe	vobsHYd.exe
PID 4324 wrote to memory of 4804	4324	a1b0a364b42c2fc882b526ffba6a7100_NeikiAnalytics.exe	vobsHYd.exe
PID 4324 wrote to memory of 2468	4324	a1b0a364b42c2fc882b526ffba6a7100_NeikiAnalytics.exe	nPtEuBq.exe
PID 4324 wrote to memory of 2468	4324	a1b0a364b42c2fc882b526ffba6a7100_NeikiAnalytics.exe	nPtEuBq.exe
PID 4324 wrote to memory of 1000	4324	a1b0a364b42c2fc882b526ffba6a7100_NeikiAnalytics.exe	DvKczsG.exe
PID 4324 wrote to memory of 1000	4324	a1b0a364b42c2fc882b526ffba6a7100_NeikiAnalytics.exe	DvKczsG.exe
PID 4324 wrote to memory of 3516	4324	a1b0a364b42c2fc882b526ffba6a7100_NeikiAnalytics.exe	GMGTNuJ.exe
PID 4324 wrote to memory of 3516	4324	a1b0a364b42c2fc882b526ffba6a7100_NeikiAnalytics.exe	GMGTNuJ.exe

C:\Users\Admin\AppData\Local\Temp\a1b0a364b42c2fc882b526ffba6a7100_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\a1b0a364b42c2fc882b526ffba6a7100_NeikiAnalytics.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4324
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1944
- C:\Windows\System\MtLkUJp.exe
  C:\Windows\System\MtLkUJp.exe
  2⤵
  - Executes dropped EXE
  PID:4936
- C:\Windows\System\dsyrXWK.exe
  C:\Windows\System\dsyrXWK.exe
  2⤵
  - Executes dropped EXE
  PID:3364
- C:\Windows\System\lUXcoJo.exe
  C:\Windows\System\lUXcoJo.exe
  2⤵
  - Executes dropped EXE
  PID:2416
- C:\Windows\System\XurdfUk.exe
  C:\Windows\System\XurdfUk.exe
  2⤵
  - Executes dropped EXE
  PID:2688
- C:\Windows\System\FmZNBPT.exe
  C:\Windows\System\FmZNBPT.exe
  2⤵
  - Executes dropped EXE
  PID:4168
- C:\Windows\System\NQPROAr.exe
  C:\Windows\System\NQPROAr.exe
  2⤵
  - Executes dropped EXE
  PID:4964
- C:\Windows\System\TSCzWob.exe
  C:\Windows\System\TSCzWob.exe
  2⤵
  - Executes dropped EXE
  PID:2044
- C:\Windows\System\RlHXRKb.exe
  C:\Windows\System\RlHXRKb.exe
  2⤵
  - Executes dropped EXE
  PID:1220
- C:\Windows\System\ronsnyc.exe
  C:\Windows\System\ronsnyc.exe
  2⤵
  - Executes dropped EXE
  PID:2512
- C:\Windows\System\mDNUcDC.exe
  C:\Windows\System\mDNUcDC.exe
  2⤵
  - Executes dropped EXE
  PID:3144
- C:\Windows\System\NqqMCfg.exe
  C:\Windows\System\NqqMCfg.exe
  2⤵
  - Executes dropped EXE
  PID:3924
- C:\Windows\System\JxQYQdI.exe
  C:\Windows\System\JxQYQdI.exe
  2⤵
  - Executes dropped EXE
  PID:3748
- C:\Windows\System\lTTrisV.exe
  C:\Windows\System\lTTrisV.exe
  2⤵
  - Executes dropped EXE
  PID:856
- C:\Windows\System\ygJiZDy.exe
  C:\Windows\System\ygJiZDy.exe
  2⤵
  - Executes dropped EXE
  PID:4788
- C:\Windows\System\tMMTuew.exe
  C:\Windows\System\tMMTuew.exe
  2⤵
  - Executes dropped EXE
  PID:1556
- C:\Windows\System\XzbUEhh.exe
  C:\Windows\System\XzbUEhh.exe
  2⤵
  - Executes dropped EXE
  PID:396
- C:\Windows\System\mHSHVUy.exe
  C:\Windows\System\mHSHVUy.exe
  2⤵
  - Executes dropped EXE
  PID:1624
- C:\Windows\System\wgISyOg.exe
  C:\Windows\System\wgISyOg.exe
  2⤵
  - Executes dropped EXE
  PID:4464
- C:\Windows\System\NbasLuA.exe
  C:\Windows\System\NbasLuA.exe
  2⤵
  - Executes dropped EXE
  PID:2744
- C:\Windows\System\JTYEStR.exe
  C:\Windows\System\JTYEStR.exe
  2⤵
  - Executes dropped EXE
  PID:4080
- C:\Windows\System\ADdcPvP.exe
  C:\Windows\System\ADdcPvP.exe
  2⤵
  - Executes dropped EXE
  PID:4056
- C:\Windows\System\NNXsZAU.exe
  C:\Windows\System\NNXsZAU.exe
  2⤵
  - Executes dropped EXE
  PID:2980
- C:\Windows\System\aYjVFDL.exe
  C:\Windows\System\aYjVFDL.exe
  2⤵
  - Executes dropped EXE
  PID:5024
- C:\Windows\System\kBqTnsx.exe
  C:\Windows\System\kBqTnsx.exe
  2⤵
  - Executes dropped EXE
  PID:1660
- C:\Windows\System\zEWqZUx.exe
  C:\Windows\System\zEWqZUx.exe
  2⤵
  - Executes dropped EXE
  PID:3064
- C:\Windows\System\aUznMrY.exe
  C:\Windows\System\aUznMrY.exe
  2⤵
  - Executes dropped EXE
  PID:3960
- C:\Windows\System\eAZQMJe.exe
  C:\Windows\System\eAZQMJe.exe
  2⤵
  - Executes dropped EXE
  PID:1424
- C:\Windows\System\vobsHYd.exe
  C:\Windows\System\vobsHYd.exe
  2⤵
  - Executes dropped EXE
  PID:4804
- C:\Windows\System\nPtEuBq.exe
  C:\Windows\System\nPtEuBq.exe
  2⤵
  - Executes dropped EXE
  PID:2468
- C:\Windows\System\DvKczsG.exe
  C:\Windows\System\DvKczsG.exe
  2⤵
  - Executes dropped EXE
  PID:1000
- C:\Windows\System\GMGTNuJ.exe
  C:\Windows\System\GMGTNuJ.exe
  2⤵
  - Executes dropped EXE
  PID:3516
- C:\Windows\System\LZegYwJ.exe
  C:\Windows\System\LZegYwJ.exe
  2⤵
  - Executes dropped EXE
  PID:432
- C:\Windows\System\qEhdZAg.exe
  C:\Windows\System\qEhdZAg.exe
  2⤵
  - Executes dropped EXE
  PID:5060
- C:\Windows\System\KmHwysN.exe
  C:\Windows\System\KmHwysN.exe
  2⤵
  - Executes dropped EXE
  PID:1832
- C:\Windows\System\DCxyChW.exe
  C:\Windows\System\DCxyChW.exe
  2⤵
  - Executes dropped EXE
  PID:2032
- C:\Windows\System\Epzhjuw.exe
  C:\Windows\System\Epzhjuw.exe
  2⤵
  - Executes dropped EXE
  PID:3312
- C:\Windows\System\OSefqeN.exe
  C:\Windows\System\OSefqeN.exe
  2⤵
  - Executes dropped EXE
  PID:4808
- C:\Windows\System\LqydMMz.exe
  C:\Windows\System\LqydMMz.exe
  2⤵
  - Executes dropped EXE
  PID:4260
- C:\Windows\System\WXvfUHr.exe
  C:\Windows\System\WXvfUHr.exe
  2⤵
  - Executes dropped EXE
  PID:3492
- C:\Windows\System\WjNgRbK.exe
  C:\Windows\System\WjNgRbK.exe
  2⤵
  - Executes dropped EXE
  PID:1200
- C:\Windows\System\lVjxyUt.exe
  C:\Windows\System\lVjxyUt.exe
  2⤵
  - Executes dropped EXE
  PID:2332
- C:\Windows\System\GVgIBVb.exe
  C:\Windows\System\GVgIBVb.exe
  2⤵
  - Executes dropped EXE
  PID:2756
- C:\Windows\System\KoXjfbG.exe
  C:\Windows\System\KoXjfbG.exe
  2⤵
  - Executes dropped EXE
  PID:1908
- C:\Windows\System\rHRCmbr.exe
  C:\Windows\System\rHRCmbr.exe
  2⤵
  - Executes dropped EXE
  PID:3400
- C:\Windows\System\ptgmraP.exe
  C:\Windows\System\ptgmraP.exe
  2⤵
  - Executes dropped EXE
  PID:1360
- C:\Windows\System\ajLTHBg.exe
  C:\Windows\System\ajLTHBg.exe
  2⤵
  - Executes dropped EXE
  PID:2284
- C:\Windows\System\fRaewiI.exe
  C:\Windows\System\fRaewiI.exe
  2⤵
  - Executes dropped EXE
  PID:2092
- C:\Windows\System\jGdYHHF.exe
  C:\Windows\System\jGdYHHF.exe
  2⤵
  - Executes dropped EXE
  PID:512
- C:\Windows\System\DmlehqA.exe
  C:\Windows\System\DmlehqA.exe
  2⤵
  - Executes dropped EXE
  PID:3468
- C:\Windows\System\wNITwfr.exe
  C:\Windows\System\wNITwfr.exe
  2⤵
  - Executes dropped EXE
  PID:4668
- C:\Windows\System\ANoHpZU.exe
  C:\Windows\System\ANoHpZU.exe
  2⤵
  - Executes dropped EXE
  PID:2256
- C:\Windows\System\mvSfevo.exe
  C:\Windows\System\mvSfevo.exe
  2⤵
  - Executes dropped EXE
  PID:3384
- C:\Windows\System\ZVSjiEX.exe
  C:\Windows\System\ZVSjiEX.exe
  2⤵
  - Executes dropped EXE
  PID:1920
- C:\Windows\System\VWCIqHm.exe
  C:\Windows\System\VWCIqHm.exe
  2⤵
  - Executes dropped EXE
  PID:3120
- C:\Windows\System\iGLdLtw.exe
  C:\Windows\System\iGLdLtw.exe
  2⤵
  - Executes dropped EXE
  PID:216
- C:\Windows\System\YaCMCLA.exe
  C:\Windows\System\YaCMCLA.exe
  2⤵
  - Executes dropped EXE
  PID:3184
- C:\Windows\System\JAEIQIa.exe
  C:\Windows\System\JAEIQIa.exe
  2⤵
  - Executes dropped EXE
  PID:2528
- C:\Windows\System\ufRehqG.exe
  C:\Windows\System\ufRehqG.exe
  2⤵
  - Executes dropped EXE
  PID:4100
- C:\Windows\System\DUmWsJp.exe
  C:\Windows\System\DUmWsJp.exe
  2⤵
  - Executes dropped EXE
  PID:556
- C:\Windows\System\UolkZYD.exe
  C:\Windows\System\UolkZYD.exe
  2⤵
  - Executes dropped EXE
  PID:220
- C:\Windows\System\aUtfWZS.exe
  C:\Windows\System\aUtfWZS.exe
  2⤵
  - Executes dropped EXE
  PID:1008
- C:\Windows\System\YOnAXaK.exe
  C:\Windows\System\YOnAXaK.exe
  2⤵
  - Executes dropped EXE
  PID:5072
- C:\Windows\System\KZVFmlD.exe
  C:\Windows\System\KZVFmlD.exe
  2⤵
  - Executes dropped EXE
  PID:3008
- C:\Windows\System\wPYcYDo.exe
  C:\Windows\System\wPYcYDo.exe
  2⤵
  - Executes dropped EXE
  PID:2176
- C:\Windows\System\GcMQUma.exe
  C:\Windows\System\GcMQUma.exe
  2⤵
  PID:3892
- C:\Windows\System\qfKuztt.exe
  C:\Windows\System\qfKuztt.exe
  2⤵
  PID:2488
- C:\Windows\System\RkxBfaq.exe
  C:\Windows\System\RkxBfaq.exe
  2⤵
  PID:3976
- C:\Windows\System\IIKnVHS.exe
  C:\Windows\System\IIKnVHS.exe
  2⤵
  PID:3272
- C:\Windows\System\MXUeumg.exe
  C:\Windows\System\MXUeumg.exe
  2⤵
  PID:4980
- C:\Windows\System\GUmRhPJ.exe
  C:\Windows\System\GUmRhPJ.exe
  2⤵
  PID:672
- C:\Windows\System\etdWqwY.exe
  C:\Windows\System\etdWqwY.exe
  2⤵
  PID:2896
- C:\Windows\System\rPfMqjx.exe
  C:\Windows\System\rPfMqjx.exe
  2⤵
  PID:4896
- C:\Windows\System\XgalSGq.exe
  C:\Windows\System\XgalSGq.exe
  2⤵
  PID:4356
- C:\Windows\System\CGRiKGY.exe
  C:\Windows\System\CGRiKGY.exe
  2⤵
  PID:5148
- C:\Windows\System\RBWrGUh.exe
  C:\Windows\System\RBWrGUh.exe
  2⤵
  PID:5176
- C:\Windows\System\TsCDenU.exe
  C:\Windows\System\TsCDenU.exe
  2⤵
  PID:5216
- C:\Windows\System\LeDjDdR.exe
  C:\Windows\System\LeDjDdR.exe
  2⤵
  PID:5260
- C:\Windows\System\BwgwqsC.exe
  C:\Windows\System\BwgwqsC.exe
  2⤵
  PID:5284
- C:\Windows\System\tNbWjYH.exe
  C:\Windows\System\tNbWjYH.exe
  2⤵
  PID:5312
- C:\Windows\System\vqKmbTB.exe
  C:\Windows\System\vqKmbTB.exe
  2⤵
  PID:5340
- C:\Windows\System\YwXKZNb.exe
  C:\Windows\System\YwXKZNb.exe
  2⤵
  PID:5392
- C:\Windows\System\tUUTvQa.exe
  C:\Windows\System\tUUTvQa.exe
  2⤵
  PID:5420
- C:\Windows\System\HFKptIc.exe
  C:\Windows\System\HFKptIc.exe
  2⤵
  PID:5448
- C:\Windows\System\UBssauv.exe
  C:\Windows\System\UBssauv.exe
  2⤵
  PID:5476
- C:\Windows\System\yfmAlIv.exe
  C:\Windows\System\yfmAlIv.exe
  2⤵
  PID:5516
- C:\Windows\System\qKgZUDA.exe
  C:\Windows\System\qKgZUDA.exe
  2⤵
  PID:5544
- C:\Windows\System\apqRxtX.exe
  C:\Windows\System\apqRxtX.exe
  2⤵
  PID:5572
- C:\Windows\System\ardPsQu.exe
  C:\Windows\System\ardPsQu.exe
  2⤵
  PID:5600
- C:\Windows\System\IHqYpaH.exe
  C:\Windows\System\IHqYpaH.exe
  2⤵
  PID:5640
- C:\Windows\System\rQkZkBm.exe
  C:\Windows\System\rQkZkBm.exe
  2⤵
  PID:5668
- C:\Windows\System\wYWbpNs.exe
  C:\Windows\System\wYWbpNs.exe
  2⤵
  PID:5696
- C:\Windows\System\RNeQOwE.exe
  C:\Windows\System\RNeQOwE.exe
  2⤵
  PID:5724
- C:\Windows\System\FPQiXUu.exe
  C:\Windows\System\FPQiXUu.exe
  2⤵
  PID:5752
- C:\Windows\System\SZFvhLq.exe
  C:\Windows\System\SZFvhLq.exe
  2⤵
  PID:5784
- C:\Windows\System\ZfkDaZL.exe
  C:\Windows\System\ZfkDaZL.exe
  2⤵
  PID:5812
- C:\Windows\System\aInEvQk.exe
  C:\Windows\System\aInEvQk.exe
  2⤵
  PID:5840
- C:\Windows\System\JQaqbjy.exe
  C:\Windows\System\JQaqbjy.exe
  2⤵
  PID:5868
- C:\Windows\System\hAjShYN.exe
  C:\Windows\System\hAjShYN.exe
  2⤵
  PID:5908
- C:\Windows\System\ttoSMyx.exe
  C:\Windows\System\ttoSMyx.exe
  2⤵
  PID:5936
- C:\Windows\System\DBuNeTu.exe
  C:\Windows\System\DBuNeTu.exe
  2⤵
  PID:5964
- C:\Windows\System\wPYKVDR.exe
  C:\Windows\System\wPYKVDR.exe
  2⤵
  PID:5992
- C:\Windows\System\tHvYFaA.exe
  C:\Windows\System\tHvYFaA.exe
  2⤵
  PID:6028
- C:\Windows\System\caEbjMa.exe
  C:\Windows\System\caEbjMa.exe
  2⤵
  PID:6056
- C:\Windows\System\ZEklUoh.exe
  C:\Windows\System\ZEklUoh.exe
  2⤵
  PID:6080
- C:\Windows\System\ZAAChgF.exe
  C:\Windows\System\ZAAChgF.exe
  2⤵
  PID:6112
- C:\Windows\System\qkqzVZA.exe
  C:\Windows\System\qkqzVZA.exe
  2⤵
  PID:6140
- C:\Windows\System\bEWAIRP.exe
  C:\Windows\System\bEWAIRP.exe
  2⤵
  PID:4488
- C:\Windows\System\opxubdN.exe
  C:\Windows\System\opxubdN.exe
  2⤵
  PID:3040
- C:\Windows\System\YXZgbih.exe
  C:\Windows\System\YXZgbih.exe
  2⤵
  PID:1112
- C:\Windows\System\vuYlAYb.exe
  C:\Windows\System\vuYlAYb.exe
  2⤵
  PID:1760
- C:\Windows\System\zIIUTUn.exe
  C:\Windows\System\zIIUTUn.exe
  2⤵
  PID:2920
- C:\Windows\System\TmufLWU.exe
  C:\Windows\System\TmufLWU.exe
  2⤵
  PID:5164
- C:\Windows\System\ZRAAzNF.exe
  C:\Windows\System\ZRAAzNF.exe
  2⤵
  PID:5208
- C:\Windows\System\nXrsXZT.exe
  C:\Windows\System\nXrsXZT.exe
  2⤵
  PID:5268
- C:\Windows\System\YaMDKXU.exe
  C:\Windows\System\YaMDKXU.exe
  2⤵
  PID:5328
- C:\Windows\System\GaROTCf.exe
  C:\Windows\System\GaROTCf.exe
  2⤵
  PID:5372
- C:\Windows\System\mqOrMWT.exe
  C:\Windows\System\mqOrMWT.exe
  2⤵
  PID:5432
- C:\Windows\System\TVGXuFi.exe
  C:\Windows\System\TVGXuFi.exe
  2⤵
  PID:5492
- C:\Windows\System\MjrhEgK.exe
  C:\Windows\System\MjrhEgK.exe
  2⤵
  PID:5536
- C:\Windows\System\LLBzmrH.exe
  C:\Windows\System\LLBzmrH.exe
  2⤵
  PID:5612
- C:\Windows\System\smAPAWy.exe
  C:\Windows\System\smAPAWy.exe
  2⤵
  PID:5660
- C:\Windows\System\bUgRyuz.exe
  C:\Windows\System\bUgRyuz.exe
  2⤵
  PID:5736
- C:\Windows\System\YNBCKLP.exe
  C:\Windows\System\YNBCKLP.exe
  2⤵
  PID:5796
- C:\Windows\System\dRxxvYY.exe
  C:\Windows\System\dRxxvYY.exe
  2⤵
  PID:5856
- C:\Windows\System\tqUUSIT.exe
  C:\Windows\System\tqUUSIT.exe
  2⤵
  PID:5920
- C:\Windows\System\SkbjIas.exe
  C:\Windows\System\SkbjIas.exe
  2⤵
  PID:5980
- C:\Windows\System\GdOjpfl.exe
  C:\Windows\System\GdOjpfl.exe
  2⤵
  PID:6040
- C:\Windows\System\inHYYxC.exe
  C:\Windows\System\inHYYxC.exe
  2⤵
  PID:6104
- C:\Windows\System\SSpogvj.exe
  C:\Windows\System\SSpogvj.exe
  2⤵
  PID:1740
- C:\Windows\System\PbHAhcP.exe
  C:\Windows\System\PbHAhcP.exe
  2⤵
  PID:1956
- C:\Windows\System\ZtUUhzL.exe
  C:\Windows\System\ZtUUhzL.exe
  2⤵
  PID:5136
- C:\Windows\System\cGTqObw.exe
  C:\Windows\System\cGTqObw.exe
  2⤵
  PID:5296
- C:\Windows\System\uNxWmkQ.exe
  C:\Windows\System\uNxWmkQ.exe
  2⤵
  PID:5404
- C:\Windows\System\hvySsnW.exe
  C:\Windows\System\hvySsnW.exe
  2⤵
  PID:5508
- C:\Windows\System\LezOqyh.exe
  C:\Windows\System\LezOqyh.exe
  2⤵
  PID:5632
- C:\Windows\System\EWiAEQB.exe
  C:\Windows\System\EWiAEQB.exe
  2⤵
  PID:5824
- C:\Windows\System\BfFXknE.exe
  C:\Windows\System\BfFXknE.exe
  2⤵
  PID:5948
- C:\Windows\System\uqOOnHU.exe
  C:\Windows\System\uqOOnHU.exe
  2⤵
  PID:6096
- C:\Windows\System\pGrxEXK.exe
  C:\Windows\System\pGrxEXK.exe
  2⤵
  PID:704
- C:\Windows\System\WNITjOI.exe
  C:\Windows\System\WNITjOI.exe
  2⤵
  PID:5232
- C:\Windows\System\cbgAeVI.exe
  C:\Windows\System\cbgAeVI.exe
  2⤵
  PID:6152
- C:\Windows\System\ZayhKHX.exe
  C:\Windows\System\ZayhKHX.exe
  2⤵
  PID:6180
- C:\Windows\System\KVZSbYy.exe
  C:\Windows\System\KVZSbYy.exe
  2⤵
  PID:6204
- C:\Windows\System\zrSygkY.exe
  C:\Windows\System\zrSygkY.exe
  2⤵
  PID:6232
- C:\Windows\System\WsSKpfE.exe
  C:\Windows\System\WsSKpfE.exe
  2⤵
  PID:6264
- C:\Windows\System\WUHHxxr.exe
  C:\Windows\System\WUHHxxr.exe
  2⤵
  PID:6292
- C:\Windows\System\JRGpxKK.exe
  C:\Windows\System\JRGpxKK.exe
  2⤵
  PID:6316
- C:\Windows\System\BGCJFYz.exe
  C:\Windows\System\BGCJFYz.exe
  2⤵
  PID:6344
- C:\Windows\System\LRhNLcK.exe
  C:\Windows\System\LRhNLcK.exe
  2⤵
  PID:6372
- C:\Windows\System\cTcuaTF.exe
  C:\Windows\System\cTcuaTF.exe
  2⤵
  PID:6404
- C:\Windows\System\TqTquol.exe
  C:\Windows\System\TqTquol.exe
  2⤵
  PID:6436
- C:\Windows\System\cPQZHDL.exe
  C:\Windows\System\cPQZHDL.exe
  2⤵
  PID:6464
- C:\Windows\System\yAgrsRF.exe
  C:\Windows\System\yAgrsRF.exe
  2⤵
  PID:6496
- C:\Windows\System\EdBFmzT.exe
  C:\Windows\System\EdBFmzT.exe
  2⤵
  PID:6524
- C:\Windows\System\MybwMoN.exe
  C:\Windows\System\MybwMoN.exe
  2⤵
  PID:6552
- C:\Windows\System\tSaxoEY.exe
  C:\Windows\System\tSaxoEY.exe
  2⤵
  PID:6580
- C:\Windows\System\KfpODrJ.exe
  C:\Windows\System\KfpODrJ.exe
  2⤵
  PID:6612
- C:\Windows\System\vDiWKnw.exe
  C:\Windows\System\vDiWKnw.exe
  2⤵
  PID:6636
- C:\Windows\System\KBZaaVa.exe
  C:\Windows\System\KBZaaVa.exe
  2⤵
  PID:6668
- C:\Windows\System\EExOLKV.exe
  C:\Windows\System\EExOLKV.exe
  2⤵
  PID:6696
- C:\Windows\System\BUhAIDs.exe
  C:\Windows\System\BUhAIDs.exe
  2⤵
  PID:6728
- C:\Windows\System\ovYHFiX.exe
  C:\Windows\System\ovYHFiX.exe
  2⤵
  PID:6760
- C:\Windows\System\DYvcIGr.exe
  C:\Windows\System\DYvcIGr.exe
  2⤵
  PID:6784
- C:\Windows\System\PvqSBtg.exe
  C:\Windows\System\PvqSBtg.exe
  2⤵
  PID:6816
- C:\Windows\System\uqPyRbc.exe
  C:\Windows\System\uqPyRbc.exe
  2⤵
  PID:6844
- C:\Windows\System\ogzrJEG.exe
  C:\Windows\System\ogzrJEG.exe
  2⤵
  PID:6872
- C:\Windows\System\AXvvXOx.exe
  C:\Windows\System\AXvvXOx.exe
  2⤵
  PID:6900
- C:\Windows\System\wGdTmcT.exe
  C:\Windows\System\wGdTmcT.exe
  2⤵
  PID:6928
- C:\Windows\System\hPgbDKh.exe
  C:\Windows\System\hPgbDKh.exe
  2⤵
  PID:6956
- C:\Windows\System\pZGMiZv.exe
  C:\Windows\System\pZGMiZv.exe
  2⤵
  PID:6988
- C:\Windows\System\GiZamWL.exe
  C:\Windows\System\GiZamWL.exe
  2⤵
  PID:7016
- C:\Windows\System\GGznlFb.exe
  C:\Windows\System\GGznlFb.exe
  2⤵
  PID:7044
- C:\Windows\System\DmedFJZ.exe
  C:\Windows\System\DmedFJZ.exe
  2⤵
  PID:7072
- C:\Windows\System\LUHqYny.exe
  C:\Windows\System\LUHqYny.exe
  2⤵
  PID:7104
- C:\Windows\System\KpdNNqS.exe
  C:\Windows\System\KpdNNqS.exe
  2⤵
  PID:7132
- C:\Windows\System\bjAoFhu.exe
  C:\Windows\System\bjAoFhu.exe
  2⤵
  PID:7156
- C:\Windows\System\wCKCcpu.exe
  C:\Windows\System\wCKCcpu.exe
  2⤵
  PID:5588
- C:\Windows\System\OnYeoOV.exe
  C:\Windows\System\OnYeoOV.exe
  2⤵
  PID:5888
- C:\Windows\System\PYRilcQ.exe
  C:\Windows\System\PYRilcQ.exe
  2⤵
  PID:1592
- C:\Windows\System\sViNULm.exe
  C:\Windows\System\sViNULm.exe
  2⤵
  PID:6168
- C:\Windows\System\LEjFPsw.exe
  C:\Windows\System\LEjFPsw.exe
  2⤵
  PID:6228
- C:\Windows\System\KTJKfUn.exe
  C:\Windows\System\KTJKfUn.exe
  2⤵
  PID:6312
- C:\Windows\System\JXeyscu.exe
  C:\Windows\System\JXeyscu.exe
  2⤵
  PID:6384
- C:\Windows\System\jFFAYaF.exe
  C:\Windows\System\jFFAYaF.exe
  2⤵
  PID:6448
- C:\Windows\System\tvAJDxK.exe
  C:\Windows\System\tvAJDxK.exe
  2⤵
  PID:6512
- C:\Windows\System\vOnudxf.exe
  C:\Windows\System\vOnudxf.exe
  2⤵
  PID:6572
- C:\Windows\System\BXEUmsn.exe
  C:\Windows\System\BXEUmsn.exe
  2⤵
  PID:6628
- C:\Windows\System\IsPmJZD.exe
  C:\Windows\System\IsPmJZD.exe
  2⤵
  PID:6684
- C:\Windows\System\EuRPQqL.exe
  C:\Windows\System\EuRPQqL.exe
  2⤵
  PID:3256
- C:\Windows\System\JNemZms.exe
  C:\Windows\System\JNemZms.exe
  2⤵
  PID:6796
- C:\Windows\System\ohhQrBs.exe
  C:\Windows\System\ohhQrBs.exe
  2⤵
  PID:6856
- C:\Windows\System\NfXLJNa.exe
  C:\Windows\System\NfXLJNa.exe
  2⤵
  PID:1620
- C:\Windows\System\nrArvuG.exe
  C:\Windows\System\nrArvuG.exe
  2⤵
  PID:6948
- C:\Windows\System\wxkLwGv.exe
  C:\Windows\System\wxkLwGv.exe
  2⤵
  PID:7008
- C:\Windows\System\AXkqwLC.exe
  C:\Windows\System\AXkqwLC.exe
  2⤵
  PID:7084
- C:\Windows\System\RuXdrYP.exe
  C:\Windows\System\RuXdrYP.exe
  2⤵
  PID:7144
- C:\Windows\System\QBawbWq.exe
  C:\Windows\System\QBawbWq.exe
  2⤵
  PID:5884
- C:\Windows\System\SlqcqAR.exe
  C:\Windows\System\SlqcqAR.exe
  2⤵
  PID:5364
- C:\Windows\System\efTepdT.exe
  C:\Windows\System\efTepdT.exe
  2⤵
  PID:6540
- C:\Windows\System\hbjagDB.exe
  C:\Windows\System\hbjagDB.exe
  2⤵
  PID:6720
- C:\Windows\System\lgmMOqS.exe
  C:\Windows\System\lgmMOqS.exe
  2⤵
  PID:6884
- C:\Windows\System\tAQtREK.exe
  C:\Windows\System\tAQtREK.exe
  2⤵
  PID:768
- C:\Windows\System\RvJYvxh.exe
  C:\Windows\System\RvJYvxh.exe
  2⤵
  PID:6976
- C:\Windows\System\vmbwUCs.exe
  C:\Windows\System\vmbwUCs.exe
  2⤵
  PID:7060
- C:\Windows\System\xwKLDYh.exe
  C:\Windows\System\xwKLDYh.exe
  2⤵
  PID:5764
- C:\Windows\System\DILfaPZ.exe
  C:\Windows\System\DILfaPZ.exe
  2⤵
  PID:4760
- C:\Windows\System\JMpdzdy.exe
  C:\Windows\System\JMpdzdy.exe
  2⤵
  PID:2700
- C:\Windows\System\Swadiwt.exe
  C:\Windows\System\Swadiwt.exe
  2⤵
  PID:6476
- C:\Windows\System\PHveoWx.exe
  C:\Windows\System\PHveoWx.exe
  2⤵
  PID:6600
- C:\Windows\System\HyARwyL.exe
  C:\Windows\System\HyARwyL.exe
  2⤵
  PID:4452
- C:\Windows\System\KhPzmuq.exe
  C:\Windows\System\KhPzmuq.exe
  2⤵
  PID:6768
- C:\Windows\System\rejqIHO.exe
  C:\Windows\System\rejqIHO.exe
  2⤵
  PID:6892
- C:\Windows\System\MTIMgnD.exe
  C:\Windows\System\MTIMgnD.exe
  2⤵
  PID:7000
- C:\Windows\System\EruDMRy.exe
  C:\Windows\System\EruDMRy.exe
  2⤵
  PID:1528
- C:\Windows\System\GpbvCcC.exe
  C:\Windows\System\GpbvCcC.exe
  2⤵
  PID:4968
- C:\Windows\System\pvftUyS.exe
  C:\Windows\System\pvftUyS.exe
  2⤵
  PID:4664
- C:\Windows\System\qtQJnUQ.exe
  C:\Windows\System\qtQJnUQ.exe
  2⤵
  PID:2372
- C:\Windows\System\xAzHGQK.exe
  C:\Windows\System\xAzHGQK.exe
  2⤵
  PID:6716
- C:\Windows\System\hFQDZWZ.exe
  C:\Windows\System\hFQDZWZ.exe
  2⤵
  PID:7172
- C:\Windows\System\ipiLKqB.exe
  C:\Windows\System\ipiLKqB.exe
  2⤵
  PID:7200
- C:\Windows\System\DBaQUNK.exe
  C:\Windows\System\DBaQUNK.exe
  2⤵
  PID:7240
- C:\Windows\System\FDiRegJ.exe
  C:\Windows\System\FDiRegJ.exe
  2⤵
  PID:7268
- C:\Windows\System\ZqUCWWJ.exe
  C:\Windows\System\ZqUCWWJ.exe
  2⤵
  PID:7284
- C:\Windows\System\DZjxZwh.exe
  C:\Windows\System\DZjxZwh.exe
  2⤵
  PID:7308
- C:\Windows\System\XXASloi.exe
  C:\Windows\System\XXASloi.exe
  2⤵
  PID:7328
- C:\Windows\System\SiehXzV.exe
  C:\Windows\System\SiehXzV.exe
  2⤵
  PID:7344
- C:\Windows\System\MhHBeWf.exe
  C:\Windows\System\MhHBeWf.exe
  2⤵
  PID:7412
- C:\Windows\System\xNObMxf.exe
  C:\Windows\System\xNObMxf.exe
  2⤵
  PID:7428
- C:\Windows\System\vmKNvWW.exe
  C:\Windows\System\vmKNvWW.exe
  2⤵
  PID:7468
- C:\Windows\System\WHGfVwd.exe
  C:\Windows\System\WHGfVwd.exe
  2⤵
  PID:7500
- C:\Windows\System\NDcLGSx.exe
  C:\Windows\System\NDcLGSx.exe
  2⤵
  PID:7520
- C:\Windows\System\fNqoBPT.exe
  C:\Windows\System\fNqoBPT.exe
  2⤵
  PID:7540
- C:\Windows\System\AAeRxiO.exe
  C:\Windows\System\AAeRxiO.exe
  2⤵
  PID:7568
- C:\Windows\System\dPqolnZ.exe
  C:\Windows\System\dPqolnZ.exe
  2⤵
  PID:7588
- C:\Windows\System\eYBDGed.exe
  C:\Windows\System\eYBDGed.exe
  2⤵
  PID:7624
- C:\Windows\System\KaMzByO.exe
  C:\Windows\System\KaMzByO.exe
  2⤵
  PID:7668
- C:\Windows\System\qmYjIwM.exe
  C:\Windows\System\qmYjIwM.exe
  2⤵
  PID:7704
- C:\Windows\System\vppIwUy.exe
  C:\Windows\System\vppIwUy.exe
  2⤵
  PID:7720
- C:\Windows\System\NKBHOFT.exe
  C:\Windows\System\NKBHOFT.exe
  2⤵
  PID:7744
- C:\Windows\System\eSDfceD.exe
  C:\Windows\System\eSDfceD.exe
  2⤵
  PID:7776
- C:\Windows\System\CDTXlHs.exe
  C:\Windows\System\CDTXlHs.exe
  2⤵
  PID:7804
- C:\Windows\System\ZTMziuS.exe
  C:\Windows\System\ZTMziuS.exe
  2⤵
  PID:7844
- C:\Windows\System\iTKnZcu.exe
  C:\Windows\System\iTKnZcu.exe
  2⤵
  PID:7872
- C:\Windows\System\jfDgdhP.exe
  C:\Windows\System\jfDgdhP.exe
  2⤵
  PID:7900
- C:\Windows\System\oXMmhdx.exe
  C:\Windows\System\oXMmhdx.exe
  2⤵
  PID:7928
- C:\Windows\System\HZvRGjt.exe
  C:\Windows\System\HZvRGjt.exe
  2⤵
  PID:7956
- C:\Windows\System\OSHPooa.exe
  C:\Windows\System\OSHPooa.exe
  2⤵
  PID:7984
- C:\Windows\System\FwRgTbF.exe
  C:\Windows\System\FwRgTbF.exe
  2⤵
  PID:8012
- C:\Windows\System\wzyMFSL.exe
  C:\Windows\System\wzyMFSL.exe
  2⤵
  PID:8040
- C:\Windows\System\oZrBFLq.exe
  C:\Windows\System\oZrBFLq.exe
  2⤵
  PID:8056
- C:\Windows\System\hzUMkrD.exe
  C:\Windows\System\hzUMkrD.exe
  2⤵
  PID:8084
- C:\Windows\System\czMTDHa.exe
  C:\Windows\System\czMTDHa.exe
  2⤵
  PID:8128
- C:\Windows\System\jKeYMrd.exe
  C:\Windows\System\jKeYMrd.exe
  2⤵
  PID:8144
- C:\Windows\System\KdTpeEM.exe
  C:\Windows\System\KdTpeEM.exe
  2⤵
  PID:8184
- C:\Windows\System\zUYeIxz.exe
  C:\Windows\System\zUYeIxz.exe
  2⤵
  PID:6424
- C:\Windows\System\HdkUIkS.exe
  C:\Windows\System\HdkUIkS.exe
  2⤵
  PID:7232
- C:\Windows\System\GLlviWt.exe
  C:\Windows\System\GLlviWt.exe
  2⤵
  PID:7320
- C:\Windows\System\ojGhBjZ.exe
  C:\Windows\System\ojGhBjZ.exe
  2⤵
  PID:7372
- C:\Windows\System\PrBtoeD.exe
  C:\Windows\System\PrBtoeD.exe
  2⤵
  PID:7424
- C:\Windows\System\caWgYSS.exe
  C:\Windows\System\caWgYSS.exe
  2⤵
  PID:7492
- C:\Windows\System\RRLACSM.exe
  C:\Windows\System\RRLACSM.exe
  2⤵
  PID:2180
- C:\Windows\System\YGglYGD.exe
  C:\Windows\System\YGglYGD.exe
  2⤵
  PID:7664
- C:\Windows\System\iHeKAJt.exe
  C:\Windows\System\iHeKAJt.exe
  2⤵
  PID:7712
- C:\Windows\System\SkIqaCG.exe
  C:\Windows\System\SkIqaCG.exe
  2⤵
  PID:7768
- C:\Windows\System\KZRGwua.exe
  C:\Windows\System\KZRGwua.exe
  2⤵
  PID:7824
- C:\Windows\System\sWKZRUf.exe
  C:\Windows\System\sWKZRUf.exe
  2⤵
  PID:7888
- C:\Windows\System\IyvSMXr.exe
  C:\Windows\System\IyvSMXr.exe
  2⤵
  PID:7968
- C:\Windows\System\mlOYZkR.exe
  C:\Windows\System\mlOYZkR.exe
  2⤵
  PID:8036
- C:\Windows\System\iDglJuS.exe
  C:\Windows\System\iDglJuS.exe
  2⤵
  PID:8112
- C:\Windows\System\fFyZBAv.exe
  C:\Windows\System\fFyZBAv.exe
  2⤵
  PID:8156
- C:\Windows\System\yPwNTLD.exe
  C:\Windows\System\yPwNTLD.exe
  2⤵
  PID:7296
- C:\Windows\System\RTLxvXd.exe
  C:\Windows\System\RTLxvXd.exe
  2⤵
  PID:7264
- C:\Windows\System\ZBHufeD.exe
  C:\Windows\System\ZBHufeD.exe
  2⤵
  PID:4900
- C:\Windows\System\zpRhKGy.exe
  C:\Windows\System\zpRhKGy.exe
  2⤵
  PID:7556
- C:\Windows\System\bDdbpOG.exe
  C:\Windows\System\bDdbpOG.exe
  2⤵
  PID:7736
- C:\Windows\System\PqSHKfD.exe
  C:\Windows\System\PqSHKfD.exe
  2⤵
  PID:7884
- C:\Windows\System\EHwuGFr.exe
  C:\Windows\System\EHwuGFr.exe
  2⤵
  PID:8068
- C:\Windows\System\WqTcOnk.exe
  C:\Windows\System\WqTcOnk.exe
  2⤵
  PID:7184
- C:\Windows\System\WIZMmlR.exe
  C:\Windows\System\WIZMmlR.exe
  2⤵
  PID:7488
- C:\Windows\System\BJkUSnH.exe
  C:\Windows\System\BJkUSnH.exe
  2⤵
  PID:7756
- C:\Windows\System\IZAwaVY.exe
  C:\Windows\System\IZAwaVY.exe
  2⤵
  PID:7972
- C:\Windows\System\YIlXzzM.exe
  C:\Windows\System\YIlXzzM.exe
  2⤵
  PID:644
- C:\Windows\System\VFLMvwk.exe
  C:\Windows\System\VFLMvwk.exe
  2⤵
  PID:7816
- C:\Windows\System\twoMIoi.exe
  C:\Windows\System\twoMIoi.exe
  2⤵
  PID:7580
- C:\Windows\System\TMjAWaO.exe
  C:\Windows\System\TMjAWaO.exe
  2⤵
  PID:8228
- C:\Windows\System\BzNwLeY.exe
  C:\Windows\System\BzNwLeY.exe
  2⤵
  PID:8244
- C:\Windows\System\FKRptQA.exe
  C:\Windows\System\FKRptQA.exe
  2⤵
  PID:8284
- C:\Windows\System\gzKDNRg.exe
  C:\Windows\System\gzKDNRg.exe
  2⤵
  PID:8308
- C:\Windows\System\DpwAKjq.exe
  C:\Windows\System\DpwAKjq.exe
  2⤵
  PID:8328
- C:\Windows\System\NQgGTUp.exe
  C:\Windows\System\NQgGTUp.exe
  2⤵
  PID:8356
- C:\Windows\System\hDgjJEW.exe
  C:\Windows\System\hDgjJEW.exe
  2⤵
  PID:8384
- C:\Windows\System\kPQsSKn.exe
  C:\Windows\System\kPQsSKn.exe
  2⤵
  PID:8424
- C:\Windows\System\xPGiDoP.exe
  C:\Windows\System\xPGiDoP.exe
  2⤵
  PID:8452
- C:\Windows\System\pGPKBUg.exe
  C:\Windows\System\pGPKBUg.exe
  2⤵
  PID:8480
- C:\Windows\System\YKkXsrK.exe
  C:\Windows\System\YKkXsrK.exe
  2⤵
  PID:8508
- C:\Windows\System\iBjndlS.exe
  C:\Windows\System\iBjndlS.exe
  2⤵
  PID:8536
- C:\Windows\System\INfrGic.exe
  C:\Windows\System\INfrGic.exe
  2⤵
  PID:8564
- C:\Windows\System\zmeeyVG.exe
  C:\Windows\System\zmeeyVG.exe
  2⤵
  PID:8592
- C:\Windows\System\RzOqMxe.exe
  C:\Windows\System\RzOqMxe.exe
  2⤵
  PID:8608
- C:\Windows\System\rVEXSke.exe
  C:\Windows\System\rVEXSke.exe
  2⤵
  PID:8648
- C:\Windows\System\UbjYpSC.exe
  C:\Windows\System\UbjYpSC.exe
  2⤵
  PID:8676
- C:\Windows\System\mqOOHVL.exe
  C:\Windows\System\mqOOHVL.exe
  2⤵
  PID:8704
- C:\Windows\System\POfMYmf.exe
  C:\Windows\System\POfMYmf.exe
  2⤵
  PID:8732
- C:\Windows\System\ElKNZDu.exe
  C:\Windows\System\ElKNZDu.exe
  2⤵
  PID:8760
- C:\Windows\System\panNOyL.exe
  C:\Windows\System\panNOyL.exe
  2⤵
  PID:8788
- C:\Windows\System\jImLWhu.exe
  C:\Windows\System\jImLWhu.exe
  2⤵
  PID:8816
- C:\Windows\System\pHcqHsm.exe
  C:\Windows\System\pHcqHsm.exe
  2⤵
  PID:8832
- C:\Windows\System\YMRLBHX.exe
  C:\Windows\System\YMRLBHX.exe
  2⤵
  PID:8872
- C:\Windows\System\cXKYoUM.exe
  C:\Windows\System\cXKYoUM.exe
  2⤵
  PID:8892
- C:\Windows\System\VBvICsg.exe
  C:\Windows\System\VBvICsg.exe
  2⤵
  PID:8908
- C:\Windows\System\OYPwDGT.exe
  C:\Windows\System\OYPwDGT.exe
  2⤵
  PID:8924
- C:\Windows\System\gdZhoIg.exe
  C:\Windows\System\gdZhoIg.exe
  2⤵
  PID:8964
- C:\Windows\System\UWySkDZ.exe
  C:\Windows\System\UWySkDZ.exe
  2⤵
  PID:9016
- C:\Windows\System\DNoyvZf.exe
  C:\Windows\System\DNoyvZf.exe
  2⤵
  PID:9044
- C:\Windows\System\dEpzDKQ.exe
  C:\Windows\System\dEpzDKQ.exe
  2⤵
  PID:9072
- C:\Windows\System\CBjFJKy.exe
  C:\Windows\System\CBjFJKy.exe
  2⤵
  PID:9104
- C:\Windows\System\FswTSUH.exe
  C:\Windows\System\FswTSUH.exe
  2⤵
  PID:9132
- C:\Windows\System\RMQseTB.exe
  C:\Windows\System\RMQseTB.exe
  2⤵
  PID:9160
- C:\Windows\System\EpcoxeQ.exe
  C:\Windows\System\EpcoxeQ.exe
  2⤵
  PID:9188
- C:\Windows\System\Qbmvwjg.exe
  C:\Windows\System\Qbmvwjg.exe
  2⤵
  PID:9204
- C:\Windows\System\mnVXJDp.exe
  C:\Windows\System\mnVXJDp.exe
  2⤵
  PID:8224
- C:\Windows\System\IbtoIzL.exe
  C:\Windows\System\IbtoIzL.exe
  2⤵
  PID:8300
- C:\Windows\System\mXyayYM.exe
  C:\Windows\System\mXyayYM.exe
  2⤵
  PID:8340
- C:\Windows\System\MwIzMNC.exe
  C:\Windows\System\MwIzMNC.exe
  2⤵
  PID:8464
- C:\Windows\System\OONiuez.exe
  C:\Windows\System\OONiuez.exe
  2⤵
  PID:8548
- C:\Windows\System\MWdqtSL.exe
  C:\Windows\System\MWdqtSL.exe
  2⤵
  PID:8604
- C:\Windows\System\gCTGaOI.exe
  C:\Windows\System\gCTGaOI.exe
  2⤵
  PID:8672
- C:\Windows\System\iDSAxDj.exe
  C:\Windows\System\iDSAxDj.exe
  2⤵
  PID:8748
- C:\Windows\System\dOwIlWW.exe
  C:\Windows\System\dOwIlWW.exe
  2⤵
  PID:8812
- C:\Windows\System\HeBUuQb.exe
  C:\Windows\System\HeBUuQb.exe
  2⤵
  PID:8864
- C:\Windows\System\reCyCsr.exe
  C:\Windows\System\reCyCsr.exe
  2⤵
  PID:8904
- C:\Windows\System\aYvURqf.exe
  C:\Windows\System\aYvURqf.exe
  2⤵
  PID:8948
- C:\Windows\System\qbbccXZ.exe
  C:\Windows\System\qbbccXZ.exe
  2⤵
  PID:9064
- C:\Windows\System\QtorYOO.exe
  C:\Windows\System\QtorYOO.exe
  2⤵
  PID:9084
- C:\Windows\System\MldxCSg.exe
  C:\Windows\System\MldxCSg.exe
  2⤵
  PID:9172
- C:\Windows\System\MDxIcOD.exe
  C:\Windows\System\MDxIcOD.exe
  2⤵
  PID:7696
- C:\Windows\System\VmyyhPi.exe
  C:\Windows\System\VmyyhPi.exe
  2⤵
  PID:8532
- C:\Windows\System\LZbbNFj.exe
  C:\Windows\System\LZbbNFj.exe
  2⤵
  PID:8800
- C:\Windows\System\ANnlOdw.exe
  C:\Windows\System\ANnlOdw.exe
  2⤵
  PID:8952
- C:\Windows\System\FUgYIVs.exe
  C:\Windows\System\FUgYIVs.exe
  2⤵
  PID:6656
- C:\Windows\System\AfQFGOJ.exe
  C:\Windows\System\AfQFGOJ.exe
  2⤵
  PID:8664
- C:\Windows\System\tASGbTX.exe
  C:\Windows\System\tASGbTX.exe
  2⤵
  PID:8920
- C:\Windows\System\lqHpFAQ.exe
  C:\Windows\System\lqHpFAQ.exe
  2⤵
  PID:8884
- C:\Windows\System\BAlwtzj.exe
  C:\Windows\System\BAlwtzj.exe
  2⤵
  PID:9224
- C:\Windows\System\zruLgwo.exe
  C:\Windows\System\zruLgwo.exe
  2⤵
  PID:9248
- C:\Windows\System\UYwhOeA.exe
  C:\Windows\System\UYwhOeA.exe
  2⤵
  PID:9280
- C:\Windows\System\ZKGwzkd.exe
  C:\Windows\System\ZKGwzkd.exe
  2⤵
  PID:9312
- C:\Windows\System\eBFZhkw.exe
  C:\Windows\System\eBFZhkw.exe
  2⤵
  PID:9340
- C:\Windows\System\wsReiSU.exe
  C:\Windows\System\wsReiSU.exe
  2⤵
  PID:9368
- C:\Windows\System\fJDfrCD.exe
  C:\Windows\System\fJDfrCD.exe
  2⤵
  PID:9396
- C:\Windows\System\Gyplsnt.exe
  C:\Windows\System\Gyplsnt.exe
  2⤵
  PID:9424
- C:\Windows\System\KaqMSVd.exe
  C:\Windows\System\KaqMSVd.exe
  2⤵
  PID:9452
- C:\Windows\System\sWAmGCq.exe
  C:\Windows\System\sWAmGCq.exe
  2⤵
  PID:9468
- C:\Windows\System\SqbMQrj.exe
  C:\Windows\System\SqbMQrj.exe
  2⤵
  PID:9508
- C:\Windows\System\dGhfGuk.exe
  C:\Windows\System\dGhfGuk.exe
  2⤵
  PID:9536
- C:\Windows\System\avJhEzH.exe
  C:\Windows\System\avJhEzH.exe
  2⤵
  PID:9564
- C:\Windows\System\SBqZsJe.exe
  C:\Windows\System\SBqZsJe.exe
  2⤵
  PID:9592
- C:\Windows\System\BUPJgus.exe
  C:\Windows\System\BUPJgus.exe
  2⤵
  PID:9620
- C:\Windows\System\hlTzacH.exe
  C:\Windows\System\hlTzacH.exe
  2⤵
  PID:9652
- C:\Windows\System\kuFAryc.exe
  C:\Windows\System\kuFAryc.exe
  2⤵
  PID:9672
- C:\Windows\System\pYTZTfy.exe
  C:\Windows\System\pYTZTfy.exe
  2⤵
  PID:9728
- C:\Windows\System\OqYFIlB.exe
  C:\Windows\System\OqYFIlB.exe
  2⤵
  PID:9744
- C:\Windows\System\YrPbbvi.exe
  C:\Windows\System\YrPbbvi.exe
  2⤵
  PID:9784
- C:\Windows\System\ynSwaHq.exe
  C:\Windows\System\ynSwaHq.exe
  2⤵
  PID:9816
- C:\Windows\System\qqiujqm.exe
  C:\Windows\System\qqiujqm.exe
  2⤵
  PID:9864
- C:\Windows\System\CphNSws.exe
  C:\Windows\System\CphNSws.exe
  2⤵
  PID:9928
- C:\Windows\System\CGIOZvR.exe
  C:\Windows\System\CGIOZvR.exe
  2⤵
  PID:9960
- C:\Windows\System\neiBoXg.exe
  C:\Windows\System\neiBoXg.exe
  2⤵
  PID:9980
- C:\Windows\System\ddZnaxC.exe
  C:\Windows\System\ddZnaxC.exe
  2⤵
  PID:10020
- C:\Windows\System\UHIUkEw.exe
  C:\Windows\System\UHIUkEw.exe
  2⤵
  PID:10048
- C:\Windows\System\UhKnSii.exe
  C:\Windows\System\UhKnSii.exe
  2⤵
  PID:10068
- C:\Windows\System\nsHqJHF.exe
  C:\Windows\System\nsHqJHF.exe
  2⤵
  PID:10116
- C:\Windows\System\sUlFMPS.exe
  C:\Windows\System\sUlFMPS.exe
  2⤵
  PID:10160
- C:\Windows\System\xFVEVnL.exe
  C:\Windows\System\xFVEVnL.exe
  2⤵
  PID:10204
- C:\Windows\System\bZFdqJk.exe
  C:\Windows\System\bZFdqJk.exe
  2⤵
  PID:10220
- C:\Windows\System\qefhyMh.exe
  C:\Windows\System\qefhyMh.exe
  2⤵
  PID:10236
- C:\Windows\System\fFWFKmg.exe
  C:\Windows\System\fFWFKmg.exe
  2⤵
  PID:9308
- C:\Windows\System\TCaNLtb.exe
  C:\Windows\System\TCaNLtb.exe
  2⤵
  PID:9448
- C:\Windows\System\dRmfYIx.exe
  C:\Windows\System\dRmfYIx.exe
  2⤵
  PID:9504
- C:\Windows\System\pHtuaHC.exe
  C:\Windows\System\pHtuaHC.exe
  2⤵
  PID:9580
- C:\Windows\System\HaKsIbK.exe
  C:\Windows\System\HaKsIbK.exe
  2⤵
  PID:9644
- C:\Windows\System\iqKPSLW.exe
  C:\Windows\System\iqKPSLW.exe
  2⤵
  PID:9736
- C:\Windows\System\fScuSYA.exe
  C:\Windows\System\fScuSYA.exe
  2⤵
  PID:9856
- C:\Windows\System\BvYMakE.exe
  C:\Windows\System\BvYMakE.exe
  2⤵
  PID:9952
- C:\Windows\System\IZIznNt.exe
  C:\Windows\System\IZIznNt.exe
  2⤵
  PID:10012
- C:\Windows\System\gMkqQuT.exe
  C:\Windows\System\gMkqQuT.exe
  2⤵
  PID:10100
- C:\Windows\System\MRjWSJz.exe
  C:\Windows\System\MRjWSJz.exe
  2⤵
  PID:1176
- C:\Windows\System\aCUGXpn.exe
  C:\Windows\System\aCUGXpn.exe
  2⤵
  PID:9276
- C:\Windows\System\vJsSgNi.exe
  C:\Windows\System\vJsSgNi.exe
  2⤵
  PID:4848
- C:\Windows\System\luIQiqj.exe
  C:\Windows\System\luIQiqj.exe
  2⤵
  PID:9660
- C:\Windows\System\fYYOMxP.exe
  C:\Windows\System\fYYOMxP.exe
  2⤵
  PID:9780
- C:\Windows\System\KGkkywK.exe
  C:\Windows\System\KGkkywK.exe
  2⤵
  PID:10044
- C:\Windows\System\ddRBGom.exe
  C:\Windows\System\ddRBGom.exe
  2⤵
  PID:10180
- C:\Windows\System\VGlFxuS.exe
  C:\Windows\System\VGlFxuS.exe
  2⤵
  PID:9264
- C:\Windows\System\GnBIjHu.exe
  C:\Windows\System\GnBIjHu.exe
  2⤵
  PID:9740
- C:\Windows\System\wWWlZCO.exe
  C:\Windows\System\wWWlZCO.exe
  2⤵
  PID:10112
- C:\Windows\System\ecLyiHa.exe
  C:\Windows\System\ecLyiHa.exe
  2⤵
  PID:10252
- C:\Windows\System\nAwOHmh.exe
  C:\Windows\System\nAwOHmh.exe
  2⤵
  PID:10292
- C:\Windows\System\ANKFsCG.exe
  C:\Windows\System\ANKFsCG.exe
  2⤵
  PID:10324
- C:\Windows\System\ywbgAfZ.exe
  C:\Windows\System\ywbgAfZ.exe
  2⤵
  PID:10340
- C:\Windows\System\OTQCzVN.exe
  C:\Windows\System\OTQCzVN.exe
  2⤵
  PID:10356
- C:\Windows\System\bahQNWS.exe
  C:\Windows\System\bahQNWS.exe
  2⤵
  PID:10384
- C:\Windows\System\wlWxErw.exe
  C:\Windows\System\wlWxErw.exe
  2⤵
  PID:10444
- C:\Windows\System\IOtJCfi.exe
  C:\Windows\System\IOtJCfi.exe
  2⤵
  PID:10460
- C:\Windows\System\jtljXfS.exe
  C:\Windows\System\jtljXfS.exe
  2⤵
  PID:10484
- C:\Windows\System\WVcTkgy.exe
  C:\Windows\System\WVcTkgy.exe
  2⤵
  PID:10536
- C:\Windows\System\ZnayIbk.exe
  C:\Windows\System\ZnayIbk.exe
  2⤵
  PID:10564
- C:\Windows\System\JsaHbHe.exe
  C:\Windows\System\JsaHbHe.exe
  2⤵
  PID:10584
- C:\Windows\System\cNiquHV.exe
  C:\Windows\System\cNiquHV.exe
  2⤵
  PID:10612
- C:\Windows\System\POYRilM.exe
  C:\Windows\System\POYRilM.exe
  2⤵
  PID:10644
- C:\Windows\System\sdNCFEo.exe
  C:\Windows\System\sdNCFEo.exe
  2⤵
  PID:10684
- C:\Windows\System\cWsTaxD.exe
  C:\Windows\System\cWsTaxD.exe
  2⤵
  PID:10720
- C:\Windows\System\POQOsJF.exe
  C:\Windows\System\POQOsJF.exe
  2⤵
  PID:10748
- C:\Windows\System\evnmKaK.exe
  C:\Windows\System\evnmKaK.exe
  2⤵
  PID:10764
- C:\Windows\System\SMAdbQK.exe
  C:\Windows\System\SMAdbQK.exe
  2⤵
  PID:10804
- C:\Windows\System\vKLKEkp.exe
  C:\Windows\System\vKLKEkp.exe
  2⤵
  PID:10832
- C:\Windows\System\DiaMynG.exe
  C:\Windows\System\DiaMynG.exe
  2⤵
  PID:10860
- C:\Windows\System\MNnRzKZ.exe
  C:\Windows\System\MNnRzKZ.exe
  2⤵
  PID:10888
- C:\Windows\System\OObaxGM.exe
  C:\Windows\System\OObaxGM.exe
  2⤵
  PID:10916
- C:\Windows\System\omkbaqQ.exe
  C:\Windows\System\omkbaqQ.exe
  2⤵
  PID:10944
- C:\Windows\System\ykHviJL.exe
  C:\Windows\System\ykHviJL.exe
  2⤵
  PID:10972
- C:\Windows\System\zxixHVE.exe
  C:\Windows\System\zxixHVE.exe
  2⤵
  PID:11000
- C:\Windows\System\XvpXUjR.exe
  C:\Windows\System\XvpXUjR.exe
  2⤵
  PID:11020
- C:\Windows\System\SMwcnOx.exe
  C:\Windows\System\SMwcnOx.exe
  2⤵
  PID:11044
- C:\Windows\System\AXRasut.exe
  C:\Windows\System\AXRasut.exe
  2⤵
  PID:11084
- C:\Windows\System\QDFHsFH.exe
  C:\Windows\System\QDFHsFH.exe
  2⤵
  PID:11112
- C:\Windows\System\GdJGots.exe
  C:\Windows\System\GdJGots.exe
  2⤵
  PID:11140
- C:\Windows\System\DJvMybb.exe
  C:\Windows\System\DJvMybb.exe
  2⤵
  PID:11168
- C:\Windows\System\kJWHcil.exe
  C:\Windows\System\kJWHcil.exe
  2⤵
  PID:11196
- C:\Windows\System\LEubAoy.exe
  C:\Windows\System\LEubAoy.exe
  2⤵
  PID:11232
- C:\Windows\System\XknEluL.exe
  C:\Windows\System\XknEluL.exe
  2⤵
  PID:11260
- C:\Windows\System\lvDmwKt.exe
  C:\Windows\System\lvDmwKt.exe
  2⤵
  PID:10276
- C:\Windows\System\rLWiiSZ.exe
  C:\Windows\System\rLWiiSZ.exe
  2⤵
  PID:10332
- C:\Windows\System\GuPnzFB.exe
  C:\Windows\System\GuPnzFB.exe
  2⤵
  PID:10372
- C:\Windows\System\iblqXgE.exe
  C:\Windows\System\iblqXgE.exe
  2⤵
  PID:10452
- C:\Windows\System\HXDWEtb.exe
  C:\Windows\System\HXDWEtb.exe
  2⤵
  PID:10560
- C:\Windows\System\nzoUSxu.exe
  C:\Windows\System\nzoUSxu.exe
  2⤵
  PID:10636
- C:\Windows\System\joLzgOO.exe
  C:\Windows\System\joLzgOO.exe
  2⤵
  PID:10708
- C:\Windows\System\WGKOpSi.exe
  C:\Windows\System\WGKOpSi.exe
  2⤵
  PID:10756
- C:\Windows\System\bdQfSzF.exe
  C:\Windows\System\bdQfSzF.exe
  2⤵
  PID:10852
- C:\Windows\System\qOHwLaH.exe
  C:\Windows\System\qOHwLaH.exe
  2⤵
  PID:10884
- C:\Windows\System\idYuYpG.exe
  C:\Windows\System\idYuYpG.exe
  2⤵
  PID:10996
- C:\Windows\System\kwEquyw.exe
  C:\Windows\System\kwEquyw.exe
  2⤵
  PID:11036
- C:\Windows\System\CXakyMT.exe
  C:\Windows\System\CXakyMT.exe
  2⤵
  PID:11104
- C:\Windows\System\deqDtWx.exe
  C:\Windows\System\deqDtWx.exe
  2⤵
  PID:11160
- C:\Windows\System\wsgvVws.exe
  C:\Windows\System\wsgvVws.exe
  2⤵
  PID:11248
- C:\Windows\System\bryQbfO.exe
  C:\Windows\System\bryQbfO.exe
  2⤵
  PID:9584
- C:\Windows\System\CYjIhVn.exe
  C:\Windows\System\CYjIhVn.exe
  2⤵
  PID:10476
- C:\Windows\System\gLJcZsO.exe
  C:\Windows\System\gLJcZsO.exe
  2⤵
  PID:10604
- C:\Windows\System\raUuNgF.exe
  C:\Windows\System\raUuNgF.exe
  2⤵
  PID:10744
- C:\Windows\System\SbBAjVo.exe
  C:\Windows\System\SbBAjVo.exe
  2⤵
  PID:10968
- C:\Windows\System\JbmOzmI.exe
  C:\Windows\System\JbmOzmI.exe
  2⤵
  PID:11076
- C:\Windows\System\rNXMnWX.exe
  C:\Windows\System\rNXMnWX.exe
  2⤵
  PID:10264
- C:\Windows\System\kUGJXUk.exe
  C:\Windows\System\kUGJXUk.exe
  2⤵
  PID:10676
- C:\Windows\System\IlWqGcH.exe
  C:\Windows\System\IlWqGcH.exe
  2⤵
  PID:11040
- C:\Windows\System\CznbVYo.exe
  C:\Windows\System\CznbVYo.exe
  2⤵
  PID:10380
- C:\Windows\System\fjATOUr.exe
  C:\Windows\System\fjATOUr.exe
  2⤵
  PID:10532
- C:\Windows\System\jQdgafr.exe
  C:\Windows\System\jQdgafr.exe
  2⤵
  PID:11276
- C:\Windows\System\cBVNpSM.exe
  C:\Windows\System\cBVNpSM.exe
  2⤵
  PID:11296
- C:\Windows\System\DLBpNjd.exe
  C:\Windows\System\DLBpNjd.exe
  2⤵
  PID:11336
- C:\Windows\System\dybulfO.exe
  C:\Windows\System\dybulfO.exe
  2⤵
  PID:11364
- C:\Windows\System\HyzwVGN.exe
  C:\Windows\System\HyzwVGN.exe
  2⤵
  PID:11392
- C:\Windows\System\ylsRLzx.exe
  C:\Windows\System\ylsRLzx.exe
  2⤵
  PID:11408
- C:\Windows\System\vWaDdAw.exe
  C:\Windows\System\vWaDdAw.exe
  2⤵
  PID:11448
- C:\Windows\System\ViMyhJm.exe
  C:\Windows\System\ViMyhJm.exe
  2⤵
  PID:11476
- C:\Windows\System\icYCXYQ.exe
  C:\Windows\System\icYCXYQ.exe
  2⤵
  PID:11504
- C:\Windows\System\cuVPMEM.exe
  C:\Windows\System\cuVPMEM.exe
  2⤵
  PID:11540
- C:\Windows\System\FKwPjnw.exe
  C:\Windows\System\FKwPjnw.exe
  2⤵
  PID:11564
- C:\Windows\System\PgWveHi.exe
  C:\Windows\System\PgWveHi.exe
  2⤵
  PID:11596
- C:\Windows\System\wZldcNy.exe
  C:\Windows\System\wZldcNy.exe
  2⤵
  PID:11636
- C:\Windows\System\yrRbfgE.exe
  C:\Windows\System\yrRbfgE.exe
  2⤵
  PID:11680
- C:\Windows\System\JRZweej.exe
  C:\Windows\System\JRZweej.exe
  2⤵
  PID:11708
- C:\Windows\System\WXJBnHq.exe
  C:\Windows\System\WXJBnHq.exe
  2⤵
  PID:11736
- C:\Windows\System\mFsogqN.exe
  C:\Windows\System\mFsogqN.exe
  2⤵
  PID:11768
- C:\Windows\System\HsepMWD.exe
  C:\Windows\System\HsepMWD.exe
  2⤵
  PID:11796
- C:\Windows\System\YyKRana.exe
  C:\Windows\System\YyKRana.exe
  2⤵
  PID:11820
- C:\Windows\System\DwbsUXJ.exe
  C:\Windows\System\DwbsUXJ.exe
  2⤵
  PID:11852
- C:\Windows\System\vAxhOsb.exe
  C:\Windows\System\vAxhOsb.exe
  2⤵
  PID:11880
- C:\Windows\System\beiZtNr.exe
  C:\Windows\System\beiZtNr.exe
  2⤵
  PID:11908
- C:\Windows\System\wIoOxDz.exe
  C:\Windows\System\wIoOxDz.exe
  2⤵
  PID:11936
- C:\Windows\System\ftfWmhD.exe
  C:\Windows\System\ftfWmhD.exe
  2⤵
  PID:11964
- C:\Windows\System\ROvAjMx.exe
  C:\Windows\System\ROvAjMx.exe
  2⤵
  PID:11988
- C:\Windows\System\lkOLhKP.exe
  C:\Windows\System\lkOLhKP.exe
  2⤵
  PID:12012
- C:\Windows\System\ddegDWW.exe
  C:\Windows\System\ddegDWW.exe
  2⤵
  PID:12036
- C:\Windows\System\qARubMY.exe
  C:\Windows\System\qARubMY.exe
  2⤵
  PID:12056
- C:\Windows\System\rNrhlWW.exe
  C:\Windows\System\rNrhlWW.exe
  2⤵
  PID:12080
- C:\Windows\System\DUxzuzf.exe
  C:\Windows\System\DUxzuzf.exe
  2⤵
  PID:12132
- C:\Windows\System\HDrdcic.exe
  C:\Windows\System\HDrdcic.exe
  2⤵
  PID:12160
- C:\Windows\System\dhqxEVV.exe
  C:\Windows\System\dhqxEVV.exe
  2⤵
  PID:12184
- C:\Windows\System\axELJob.exe
  C:\Windows\System\axELJob.exe
  2⤵
  PID:12216
- C:\Windows\System\MMrsrpN.exe
  C:\Windows\System\MMrsrpN.exe
  2⤵
  PID:12244
- C:\Windows\System\FObtRNI.exe
  C:\Windows\System\FObtRNI.exe
  2⤵
  PID:12272
- C:\Windows\System\pKSKxxe.exe
  C:\Windows\System\pKSKxxe.exe
  2⤵
  PID:11268
- C:\Windows\System\TpbpuhU.exe
  C:\Windows\System\TpbpuhU.exe
  2⤵
  PID:11356
- C:\Windows\System\FBxOlSK.exe
  C:\Windows\System\FBxOlSK.exe
  2⤵
  PID:11420
- C:\Windows\System\OKUeOkw.exe
  C:\Windows\System\OKUeOkw.exe
  2⤵
  PID:11488
- C:\Windows\System\vIJMxUW.exe
  C:\Windows\System\vIJMxUW.exe
  2⤵
  PID:11556
- C:\Windows\System\DDaFECE.exe
  C:\Windows\System\DDaFECE.exe
  2⤵
  PID:11608
- C:\Windows\System\zXhLGUY.exe
  C:\Windows\System\zXhLGUY.exe
  2⤵
  PID:11700
- C:\Windows\System\odKJvTC.exe
  C:\Windows\System\odKJvTC.exe
  2⤵
  PID:11764
- C:\Windows\System\KSQgWHB.exe
  C:\Windows\System\KSQgWHB.exe
  2⤵
  PID:11844
- C:\Windows\System\adKbmKm.exe
  C:\Windows\System\adKbmKm.exe
  2⤵
  PID:11900
- C:\Windows\System\KZaUoXJ.exe
  C:\Windows\System\KZaUoXJ.exe
  2⤵
  PID:11956
- C:\Windows\System\hwHnIyo.exe
  C:\Windows\System\hwHnIyo.exe
  2⤵
  PID:12028
- C:\Windows\System\PrYTgbW.exe
  C:\Windows\System\PrYTgbW.exe
  2⤵
  PID:1020
- C:\Windows\System\kAWKPIn.exe
  C:\Windows\System\kAWKPIn.exe
  2⤵
  PID:12104
- C:\Windows\System\XwjLrOZ.exe
  C:\Windows\System\XwjLrOZ.exe
  2⤵
  PID:12120
- C:\Windows\System\VytSKrI.exe
  C:\Windows\System\VytSKrI.exe
  2⤵
  PID:12192
- C:\Windows\System\CXZtvkC.exe
  C:\Windows\System\CXZtvkC.exe
  2⤵
  PID:11312
- C:\Windows\System\nQMqoDT.exe
  C:\Windows\System\nQMqoDT.exe
  2⤵
  PID:11400
- C:\Windows\System\NeXqPPI.exe
  C:\Windows\System\NeXqPPI.exe
  2⤵
  PID:11536
- C:\Windows\System\LWCpzRt.exe
  C:\Windows\System\LWCpzRt.exe
  2⤵
  PID:11672
- C:\Windows\System\VkCQWMv.exe
  C:\Windows\System\VkCQWMv.exe
  2⤵
  PID:11872
- C:\Windows\System\uVwEBqf.exe
  C:\Windows\System\uVwEBqf.exe
  2⤵
  PID:12000
- C:\Windows\System\bzIcilE.exe
  C:\Windows\System\bzIcilE.exe
  2⤵
  PID:12064
- C:\Windows\System\qDglute.exe
  C:\Windows\System\qDglute.exe
  2⤵
  PID:12256
- C:\Windows\System\faMBZrq.exe
  C:\Windows\System\faMBZrq.exe
  2⤵
  PID:11516
- C:\Windows\System\xGiLriB.exe
  C:\Windows\System\xGiLriB.exe
  2⤵
  PID:11952
- C:\Windows\System\PukmDxI.exe
  C:\Windows\System\PukmDxI.exe
  2⤵
  PID:12212
- C:\Windows\System\tBvDBrA.exe
  C:\Windows\System\tBvDBrA.exe
  2⤵
  PID:11864
- C:\Windows\System\DFuuOwV.exe
  C:\Windows\System\DFuuOwV.exe
  2⤵
  PID:12156
- C:\Windows\System\YXKlIIv.exe
  C:\Windows\System\YXKlIIv.exe
  2⤵
  PID:12308
- C:\Windows\System\eBKbcMo.exe
  C:\Windows\System\eBKbcMo.exe
  2⤵
  PID:12324
- C:\Windows\System\VQWiotU.exe
  C:\Windows\System\VQWiotU.exe
  2⤵
  PID:12364
- C:\Windows\System\kBcEORJ.exe
  C:\Windows\System\kBcEORJ.exe
  2⤵
  PID:12380
- C:\Windows\System\dTxTzcW.exe
  C:\Windows\System\dTxTzcW.exe
  2⤵
  PID:12420
- C:\Windows\System\ZQutZCM.exe
  C:\Windows\System\ZQutZCM.exe
  2⤵
  PID:12436
- C:\Windows\System\ZiZQjbf.exe
  C:\Windows\System\ZiZQjbf.exe
  2⤵
  PID:12476
- C:\Windows\System\SVujOha.exe
  C:\Windows\System\SVujOha.exe
  2⤵
  PID:12504
- C:\Windows\System\YbMHbQV.exe
  C:\Windows\System\YbMHbQV.exe
  2⤵
  PID:12524
- C:\Windows\System\zBxfZAZ.exe
  C:\Windows\System\zBxfZAZ.exe
  2⤵
  PID:12560
- C:\Windows\System\giWAAgX.exe
  C:\Windows\System\giWAAgX.exe
  2⤵
  PID:12588
- C:\Windows\System\xgQdHtw.exe
  C:\Windows\System\xgQdHtw.exe
  2⤵
  PID:12616
- C:\Windows\System\EtkvJUL.exe
  C:\Windows\System\EtkvJUL.exe
  2⤵
  PID:12652
- C:\Windows\System\diKRFSt.exe
  C:\Windows\System\diKRFSt.exe
  2⤵
  PID:12692
- C:\Windows\System\IfnPigL.exe
  C:\Windows\System\IfnPigL.exe
  2⤵
  PID:12724
- C:\Windows\System\qbDYoRo.exe
  C:\Windows\System\qbDYoRo.exe
  2⤵
  PID:12772
- C:\Windows\System\IWhRkOa.exe
  C:\Windows\System\IWhRkOa.exe
  2⤵
  PID:12800
- C:\Windows\System\KJbvhcg.exe
  C:\Windows\System\KJbvhcg.exe
  2⤵
  PID:12816
- C:\Windows\System\BhOeqbW.exe
  C:\Windows\System\BhOeqbW.exe
  2⤵
  PID:12856
- C:\Windows\System\WvXFhdf.exe
  C:\Windows\System\WvXFhdf.exe
  2⤵
  PID:12888
- C:\Windows\System\BgvBZLo.exe
  C:\Windows\System\BgvBZLo.exe
  2⤵
  PID:12916
- C:\Windows\System\FnytfEG.exe
  C:\Windows\System\FnytfEG.exe
  2⤵
  PID:12944
- C:\Windows\System\QCxxHcE.exe
  C:\Windows\System\QCxxHcE.exe
  2⤵
  PID:12972
- C:\Windows\System\RDSdxUt.exe
  C:\Windows\System\RDSdxUt.exe
  2⤵
  PID:13000
- C:\Windows\System\BbYJaVX.exe
  C:\Windows\System\BbYJaVX.exe
  2⤵
  PID:13032
- C:\Windows\System\ledCPBF.exe
  C:\Windows\System\ledCPBF.exe
  2⤵
  PID:13060
- C:\Windows\System\fqfmgXg.exe
  C:\Windows\System\fqfmgXg.exe
  2⤵
  PID:13092
- C:\Windows\System\aFPQVXP.exe
  C:\Windows\System\aFPQVXP.exe
  2⤵
  PID:13120
- C:\Windows\System\wUTUzbb.exe
  C:\Windows\System\wUTUzbb.exe
  2⤵
  PID:13148
- C:\Windows\System\PIkMEOd.exe
  C:\Windows\System\PIkMEOd.exe
  2⤵
  PID:12648
- C:\Windows\System\qeEKhbl.exe
  C:\Windows\System\qeEKhbl.exe
  2⤵
  PID:12712
- C:\Windows\System\ljONIsH.exe
  C:\Windows\System\ljONIsH.exe
  2⤵
  PID:12792
- C:\Windows\System\wlMbClD.exe
  C:\Windows\System\wlMbClD.exe
  2⤵
  PID:12908
- C:\Windows\System\HjAboaX.exe
  C:\Windows\System\HjAboaX.exe
  2⤵
  PID:13052
- C:\Windows\System\CohVHCa.exe
  C:\Windows\System\CohVHCa.exe
  2⤵
  PID:13104
- C:\Windows\System\wDgpXSo.exe
  C:\Windows\System\wDgpXSo.exe
  2⤵
  PID:13144
- C:\Windows\System\QaIXwOc.exe
  C:\Windows\System\QaIXwOc.exe
  2⤵
  PID:9908
- C:\Windows\System\eeSzpru.exe
  C:\Windows\System\eeSzpru.exe
  2⤵
  PID:13192
- C:\Windows\System\dtOgYlv.exe
  C:\Windows\System\dtOgYlv.exe
  2⤵
  PID:13232
- C:\Windows\System\wICDuzR.exe
  C:\Windows\System\wICDuzR.exe
  2⤵
  PID:13304
- C:\Windows\System\NBFUHNP.exe
  C:\Windows\System\NBFUHNP.exe
  2⤵
  PID:9600
- C:\Windows\System\AdHXPoU.exe
  C:\Windows\System\AdHXPoU.exe
  2⤵
  PID:3196
- C:\Windows\System\dmRypLX.exe
  C:\Windows\System\dmRypLX.exe
  2⤵
  PID:4332
- C:\Windows\System\bpybzNp.exe
  C:\Windows\System\bpybzNp.exe
  2⤵
  PID:12428
- C:\Windows\System\TwYJhEr.exe
  C:\Windows\System\TwYJhEr.exe
  2⤵
  PID:5336
- C:\Windows\System\znoCfgG.exe
  C:\Windows\System\znoCfgG.exe
  2⤵
  PID:12492
- C:\Windows\System\hBScxPe.exe
  C:\Windows\System\hBScxPe.exe
  2⤵
  PID:12496
- C:\Windows\System\gYimPTO.exe
  C:\Windows\System\gYimPTO.exe
  2⤵
  PID:1440
- C:\Windows\System\AWYzhAJ.exe
  C:\Windows\System\AWYzhAJ.exe
  2⤵
  PID:5620
- C:\Windows\System\PBGqJYP.exe
  C:\Windows\System\PBGqJYP.exe
  2⤵
  PID:1448
- C:\Windows\System\IieffXp.exe
  C:\Windows\System\IieffXp.exe
  2⤵
  PID:5880
- C:\Windows\System\fRuSJUS.exe
  C:\Windows\System\fRuSJUS.exe
  2⤵
  PID:1508
- C:\Windows\System\LpTSgnH.exe
  C:\Windows\System\LpTSgnH.exe
  2⤵
  PID:5304
- C:\Windows\System\ZZZIVyA.exe
  C:\Windows\System\ZZZIVyA.exe
  2⤵
  PID:12580
- C:\Windows\System\CNiakoJ.exe
  C:\Windows\System\CNiakoJ.exe
  2⤵
  PID:12664
- C:\Windows\System\QbXpxQm.exe
  C:\Windows\System\QbXpxQm.exe
  2⤵
  PID:12748
- C:\Windows\System\yNMVcav.exe
  C:\Windows\System\yNMVcav.exe
  2⤵
  PID:4072
- C:\Windows\System\gtUNADY.exe
  C:\Windows\System\gtUNADY.exe
  2⤵
  PID:8780
- C:\Windows\System\FEDluVq.exe
  C:\Windows\System\FEDluVq.exe
  2⤵
  PID:9704
- C:\Windows\System\GqfpKWc.exe
  C:\Windows\System\GqfpKWc.exe
  2⤵
  PID:12876
- C:\Windows\System\aWijOoD.exe
  C:\Windows\System\aWijOoD.exe
  2⤵
  PID:6212
- C:\Windows\System\LLlZTvJ.exe
  C:\Windows\System\LLlZTvJ.exe
  2⤵
  PID:6244
- C:\Windows\System\hinysIn.exe
  C:\Windows\System\hinysIn.exe
  2⤵
  PID:13028
- C:\Windows\System\OMNynyo.exe
  C:\Windows\System\OMNynyo.exe
  2⤵
  PID:13180
- C:\Windows\System\CKYjgdX.exe
  C:\Windows\System\CKYjgdX.exe
  2⤵
  PID:3708
- C:\Windows\System\tpZaPCX.exe
  C:\Windows\System\tpZaPCX.exe
  2⤵
  PID:13296
- C:\Windows\System\IBLwXOr.exe
  C:\Windows\System\IBLwXOr.exe
  2⤵
  PID:12356
- C:\Windows\System\TYCcgNs.exe
  C:\Windows\System\TYCcgNs.exe
  2⤵
  PID:12984
- C:\Windows\System\sGjKLOt.exe
  C:\Windows\System\sGjKLOt.exe
  2⤵
  PID:5256
- C:\Windows\System\UcmDRog.exe
  C:\Windows\System\UcmDRog.exe
  2⤵
  PID:5380
- C:\Windows\System\RRRyOpl.exe
  C:\Windows\System\RRRyOpl.exe
  2⤵
  PID:2344
- C:\Windows\System\zfeqTkR.exe
  C:\Windows\System\zfeqTkR.exe
  2⤵
  PID:5384
- C:\Windows\System\vPXwogj.exe
  C:\Windows\System\vPXwogj.exe
  2⤵
  PID:6176
- C:\Windows\System\XFBsYeO.exe
  C:\Windows\System\XFBsYeO.exe
  2⤵
  PID:6216
- C:\Windows\System\shQIbIG.exe
  C:\Windows\System\shQIbIG.exe
  2⤵
  PID:13084
- C:\Windows\System\JmqLMiu.exe
  C:\Windows\System\JmqLMiu.exe
  2⤵
  PID:532
- C:\Windows\System\HQEdMvq.exe
  C:\Windows\System\HQEdMvq.exe
  2⤵
  PID:1980
- C:\Windows\System\YgtPIOM.exe
  C:\Windows\System\YgtPIOM.exe
  2⤵
  PID:5684
- C:\Windows\System\gGqcsgD.exe
  C:\Windows\System\gGqcsgD.exe
  2⤵
  PID:12412
- C:\Windows\System\rsSoYkQ.exe
  C:\Windows\System\rsSoYkQ.exe
  2⤵
  PID:4416
- C:\Windows\System\DBfFdZF.exe
  C:\Windows\System\DBfFdZF.exe
  2⤵
  PID:1392
- C:\Windows\System\lAkIOcd.exe
  C:\Windows\System\lAkIOcd.exe
  2⤵
  PID:4976
- C:\Windows\System\CgEOwjM.exe
  C:\Windows\System\CgEOwjM.exe
  2⤵
  PID:5244
- C:\Windows\System\CnqZhHy.exe
  C:\Windows\System\CnqZhHy.exe
  2⤵
  PID:8632
- C:\Windows\System\eegyRmc.exe
  C:\Windows\System\eegyRmc.exe
  2⤵
  PID:12996
- C:\Windows\System\YynZaZD.exe
  C:\Windows\System\YynZaZD.exe
  2⤵
  PID:13048
- C:\Windows\System\rWNPnzr.exe
  C:\Windows\System\rWNPnzr.exe
  2⤵
  PID:5272
- C:\Windows\System\cFYQKhJ.exe
  C:\Windows\System\cFYQKhJ.exe
  2⤵
  PID:3720
- C:\Windows\System\QbDQTPg.exe
  C:\Windows\System\QbDQTPg.exe
  2⤵
  PID:5084
- C:\Windows\System\kCkpick.exe
  C:\Windows\System\kCkpick.exe
  2⤵
  PID:7276
- C:\Windows\System\dkMWThH.exe
  C:\Windows\System\dkMWThH.exe
  2⤵
  PID:7452
- C:\Windows\System\bnjSCwo.exe
  C:\Windows\System\bnjSCwo.exe
  2⤵
  PID:7180
- C:\Windows\System\tLpiwIN.exe
  C:\Windows\System\tLpiwIN.exe
  2⤵
  PID:7224
- C:\Windows\System\hRjGCmg.exe
  C:\Windows\System\hRjGCmg.exe
  2⤵
  PID:7784
- C:\Windows\System\KmRdCMM.exe
  C:\Windows\System\KmRdCMM.exe
  2⤵
  PID:6828
- C:\Windows\System\JigdryG.exe
  C:\Windows\System\JigdryG.exe
  2⤵
  PID:7868
- C:\Windows\System\JvCrMjj.exe
  C:\Windows\System\JvCrMjj.exe
  2⤵
  PID:1716
- C:\Windows\System\BHzMbeC.exe
  C:\Windows\System\BHzMbeC.exe
  2⤵
  PID:7892
- C:\Windows\System\SipVpbr.exe
  C:\Windows\System\SipVpbr.exe
  2⤵
  PID:7368
- C:\Windows\System\fgQsvBS.exe
  C:\Windows\System\fgQsvBS.exe
  2⤵
  PID:6804
- C:\Windows\System\eqjLQUx.exe
  C:\Windows\System\eqjLQUx.exe
  2⤵
  PID:7992
- C:\Windows\System\xQlMtNq.exe
  C:\Windows\System\xQlMtNq.exe
  2⤵
  PID:7700
- C:\Windows\System\tHWiwGk.exe
  C:\Windows\System\tHWiwGk.exe
  2⤵
  PID:428
- C:\Windows\System\gfcYVBf.exe
  C:\Windows\System\gfcYVBf.exe
  2⤵
  PID:7256
- C:\Windows\System\MaYODSM.exe
  C:\Windows\System\MaYODSM.exe
  2⤵
  PID:228
- C:\Windows\System\eykEzGD.exe
  C:\Windows\System\eykEzGD.exe
  2⤵
  PID:8124
- C:\Windows\System\fqnBdEh.exe
  C:\Windows\System\fqnBdEh.exe
  2⤵
  PID:8168
- C:\Windows\System\keBwhmE.exe
  C:\Windows\System\keBwhmE.exe
  2⤵
  PID:1536
- C:\Windows\System\hcBgujA.exe
  C:\Windows\System\hcBgujA.exe
  2⤵
  PID:8380
- C:\Windows\System\EIpuNeI.exe
  C:\Windows\System\EIpuNeI.exe
  2⤵
  PID:8392
- C:\Windows\System\XaFNOJp.exe
  C:\Windows\System\XaFNOJp.exe
  2⤵
  PID:7616
- C:\Windows\System\zXvXutY.exe
  C:\Windows\System\zXvXutY.exe
  2⤵
  PID:8528
- C:\Windows\System\EydkygK.exe
  C:\Windows\System\EydkygK.exe
  2⤵
  PID:8544
- C:\Windows\System\xIsflrB.exe
  C:\Windows\System\xIsflrB.exe
  2⤵
  PID:8572
- C:\Windows\System\NzrVfPj.exe
  C:\Windows\System\NzrVfPj.exe
  2⤵
  PID:7036
- C:\Windows\System\ALrzKPm.exe
  C:\Windows\System\ALrzKPm.exe
  2⤵
  PID:8940
- C:\Windows\System\cJoSgDa.exe
  C:\Windows\System\cJoSgDa.exe
  2⤵
  PID:9024
- C:\Windows\System\zvIYNsS.exe
  C:\Windows\System\zvIYNsS.exe
  2⤵
  PID:7456
- C:\Windows\System\ZgQvxsq.exe
  C:\Windows\System\ZgQvxsq.exe
  2⤵
  PID:9176
- C:\Windows\System\nKVIELW.exe
  C:\Windows\System\nKVIELW.exe
  2⤵
  PID:8220
- C:\Windows\System\ZhNUQDv.exe
  C:\Windows\System\ZhNUQDv.exe
  2⤵
  PID:2164
- C:\Windows\System\hmcJQPi.exe
  C:\Windows\System\hmcJQPi.exe
  2⤵
  PID:8520
- C:\Windows\System\UDzUqWj.exe
  C:\Windows\System\UDzUqWj.exe
  2⤵
  PID:8552
- C:\Windows\System\BpPkNVd.exe
  C:\Windows\System\BpPkNVd.exe
  2⤵
  PID:7944
- C:\Windows\System\raDdYzm.exe
  C:\Windows\System\raDdYzm.exe
  2⤵
  PID:2368
- C:\Windows\System\RChhuVI.exe
  C:\Windows\System\RChhuVI.exe
  2⤵
  PID:7460
- C:\Windows\System\zVyDyrp.exe
  C:\Windows\System\zVyDyrp.exe
  2⤵
  PID:3088
- C:\Windows\System\GSlERHL.exe
  C:\Windows\System\GSlERHL.exe
  2⤵
  PID:8916
- C:\Windows\System\gsPTlLk.exe
  C:\Windows\System\gsPTlLk.exe
  2⤵
  PID:4952
- C:\Windows\System\qZdfweg.exe
  C:\Windows\System\qZdfweg.exe
  2⤵
  PID:4552
- C:\Windows\System\FhiSCBI.exe
  C:\Windows\System\FhiSCBI.exe
  2⤵
  PID:8092
- C:\Windows\System\YasmcSn.exe
  C:\Windows\System\YasmcSn.exe
  2⤵
  PID:312
- C:\Windows\System\NnYgYCQ.exe
  C:\Windows\System\NnYgYCQ.exe
  2⤵
  PID:8600
- C:\Windows\System\PPjBNKR.exe
  C:\Windows\System\PPjBNKR.exe
  2⤵
  PID:8900
- C:\Windows\System\DIBPzWR.exe
  C:\Windows\System\DIBPzWR.exe
  2⤵
  PID:3536
- C:\Windows\System\ZDofgEC.exe
  C:\Windows\System\ZDofgEC.exe
  2⤵
  PID:8460
- C:\Windows\System\jTCmOoj.exe
  C:\Windows\System\jTCmOoj.exe
  2⤵
  PID:5052
- C:\Windows\System\EKyvXVi.exe
  C:\Windows\System\EKyvXVi.exe
  2⤵
  PID:8644
- C:\Windows\System\WFFpxxJ.exe
  C:\Windows\System\WFFpxxJ.exe
  2⤵
  PID:3328
- C:\Windows\System\MnFqdnt.exe
  C:\Windows\System\MnFqdnt.exe
  2⤵
  PID:4152
- C:\Windows\System\wwhgEyJ.exe
  C:\Windows\System\wwhgEyJ.exe
  2⤵
  PID:8740
- C:\Windows\System\cHyWKuK.exe
  C:\Windows\System\cHyWKuK.exe
  2⤵
  PID:7788
- C:\Windows\System\rorwhTl.exe
  C:\Windows\System\rorwhTl.exe
  2⤵
  PID:8492
- C:\Windows\System\RJpjPke.exe
  C:\Windows\System\RJpjPke.exe
  2⤵
  PID:8856
- C:\Windows\System\yzdQSrS.exe
  C:\Windows\System\yzdQSrS.exe
  2⤵
  PID:3636
- C:\Windows\System\PFYesVA.exe
  C:\Windows\System\PFYesVA.exe
  2⤵
  PID:2304
- C:\Windows\System\bIvQyHS.exe
  C:\Windows\System\bIvQyHS.exe
  2⤵
  PID:7920
- C:\Windows\System\WsRGPeY.exe
  C:\Windows\System\WsRGPeY.exe
  2⤵
  PID:9140
- C:\Windows\System\SxFJkBs.exe
  C:\Windows\System\SxFJkBs.exe
  2⤵
  PID:3800
- C:\Windows\System\EUrIHZS.exe
  C:\Windows\System\EUrIHZS.exe
  2⤵
  PID:10148
- C:\Windows\System\QCHVSqs.exe
  C:\Windows\System\QCHVSqs.exe
  2⤵
  PID:8444
- C:\Windows\System\cQvznlM.exe
  C:\Windows\System\cQvznlM.exe
  2⤵
  PID:9488
- C:\Windows\System\GsTJgVY.exe
  C:\Windows\System\GsTJgVY.exe
  2⤵
  PID:7440
- C:\Windows\System\INyRTPD.exe
  C:\Windows\System\INyRTPD.exe
  2⤵
  PID:4352
- C:\Windows\System\TNEhUfr.exe
  C:\Windows\System\TNEhUfr.exe
  2⤵
  PID:2388
- C:\Windows\System\KaGOuFC.exe
  C:\Windows\System\KaGOuFC.exe
  2⤵
  PID:9628
- C:\Windows\System\JmtXloB.exe
  C:\Windows\System\JmtXloB.exe
  2⤵
  PID:9700
- C:\Windows\System\dPFEyCa.exe
  C:\Windows\System\dPFEyCa.exe
  2⤵
  PID:2652
- C:\Windows\System\RqyeaXZ.exe
  C:\Windows\System\RqyeaXZ.exe
  2⤵
  PID:8108
- C:\Windows\System\BHyFvmh.exe
  C:\Windows\System\BHyFvmh.exe
  2⤵
  PID:3284
- C:\Windows\System\yqtDnts.exe
  C:\Windows\System\yqtDnts.exe
  2⤵
  PID:9876
- C:\Windows\System\MOFGbWX.exe
  C:\Windows\System\MOFGbWX.exe
  2⤵
  PID:8400
- C:\Windows\System\sgFVjbd.exe
  C:\Windows\System\sgFVjbd.exe
  2⤵
  PID:10004
- C:\Windows\System\GZjlpdw.exe
  C:\Windows\System\GZjlpdw.exe
  2⤵
  PID:2220
- C:\Windows\System\KGyHTQz.exe
  C:\Windows\System\KGyHTQz.exe
  2⤵
  PID:3464
- C:\Windows\System\CbAdZxC.exe
  C:\Windows\System\CbAdZxC.exe
  2⤵
  PID:8560
- C:\Windows\System\DXQYfxo.exe
  C:\Windows\System\DXQYfxo.exe
  2⤵
  PID:10152
- C:\Windows\System\uFKrrrN.exe
  C:\Windows\System\uFKrrrN.exe
  2⤵
  PID:8616
- C:\Windows\System\pSiToSF.exe
  C:\Windows\System\pSiToSF.exe
  2⤵
  PID:6756
- C:\Windows\System\XGjTVrD.exe
  C:\Windows\System\XGjTVrD.exe
  2⤵
  PID:9124
- C:\Windows\System\KYWUSKH.exe
  C:\Windows\System\KYWUSKH.exe
  2⤵
  PID:5248
- C:\Windows\System\bJPoiGq.exe
  C:\Windows\System\bJPoiGq.exe
  2⤵
  PID:9464
- C:\Windows\System\NAQnBoZ.exe
  C:\Windows\System\NAQnBoZ.exe
  2⤵
  PID:8960
- C:\Windows\System\kaLUtnb.exe
  C:\Windows\System\kaLUtnb.exe
  2⤵
  PID:3816
- C:\Windows\System\fFZRKYW.exe
  C:\Windows\System\fFZRKYW.exe
  2⤵
  PID:3880
- C:\Windows\System\PDhpXig.exe
  C:\Windows\System\PDhpXig.exe
  2⤵
  PID:5416
- C:\Windows\System\Ycuejmd.exe
  C:\Windows\System\Ycuejmd.exe
  2⤵
  PID:9128
- C:\Windows\System\knVvfGM.exe
  C:\Windows\System\knVvfGM.exe
  2⤵
  PID:4868
- C:\Windows\System\HqIjeQc.exe
  C:\Windows\System\HqIjeQc.exe
  2⤵
  PID:9804
- C:\Windows\System\Xeempoy.exe
  C:\Windows\System\Xeempoy.exe
  2⤵
  PID:1896
- C:\Windows\System\JfpgATw.exe
  C:\Windows\System\JfpgATw.exe
  2⤵
  PID:5608
- C:\Windows\System\EudFheO.exe
  C:\Windows\System\EudFheO.exe
  2⤵
  PID:9548
- C:\Windows\System\nJmXVqx.exe
  C:\Windows\System\nJmXVqx.exe
  2⤵
  PID:7484
- C:\Windows\System\JJDhJqv.exe
  C:\Windows\System\JJDhJqv.exe
  2⤵
  PID:9036
- C:\Windows\System\OdvSAOl.exe
  C:\Windows\System\OdvSAOl.exe
  2⤵
  PID:5720
- C:\Windows\System\ZFAVrfK.exe
  C:\Windows\System\ZFAVrfK.exe
  2⤵
  PID:2168
- C:\Windows\System\uDmDlqb.exe
  C:\Windows\System\uDmDlqb.exe
  2⤵
  PID:10416
- C:\Windows\System\tgstKBR.exe
  C:\Windows\System\tgstKBR.exe
  2⤵
  PID:9800
- C:\Windows\System\VWMTbzw.exe
  C:\Windows\System\VWMTbzw.exe
  2⤵
  PID:10472
- C:\Windows\System\MaRMwkv.exe
  C:\Windows\System\MaRMwkv.exe
  2⤵
  PID:10508
- C:\Windows\System\TOaevxL.exe
  C:\Windows\System\TOaevxL.exe
  2⤵
  PID:1748
- C:\Windows\System\LoSiXQD.exe
  C:\Windows\System\LoSiXQD.exe
  2⤵
  PID:6164
- C:\Windows\System\KtgrqNI.exe
  C:\Windows\System\KtgrqNI.exe
  2⤵
  PID:10668
- C:\Windows\System\VysCQih.exe
  C:\Windows\System\VysCQih.exe
  2⤵
  PID:10016
- C:\Windows\System\teTYhAr.exe
  C:\Windows\System\teTYhAr.exe
  2⤵
  PID:5960
- C:\Windows\System\eyFgBSM.exe
  C:\Windows\System\eyFgBSM.exe
  2⤵
  PID:10792
- C:\Windows\System\DatWXPz.exe
  C:\Windows\System\DatWXPz.exe
  2⤵
  PID:3888
- C:\Windows\System\dqwAhDY.exe
  C:\Windows\System\dqwAhDY.exe
  2⤵
  PID:6064
- C:\Windows\System\posxlIT.exe
  C:\Windows\System\posxlIT.exe
  2⤵
  PID:10840
- C:\Windows\System\BUCrknb.exe
  C:\Windows\System\BUCrknb.exe
  2⤵
  PID:7512
- C:\Windows\System\VAwqfff.exe
  C:\Windows\System\VAwqfff.exe
  2⤵
  PID:1572
- C:\Windows\System\wLqtJBB.exe
  C:\Windows\System\wLqtJBB.exe
  2⤵
  PID:10924
- C:\Windows\System\iSKENSX.exe
  C:\Windows\System\iSKENSX.exe
  2⤵
  PID:11012
- C:\Windows\System\FjBHaBh.exe
  C:\Windows\System\FjBHaBh.exe
  2⤵
  PID:9068
- C:\Windows\System\KqcMTVG.exe
  C:\Windows\System\KqcMTVG.exe
  2⤵
  PID:9052
- C:\Windows\System\mLFZnbS.exe
  C:\Windows\System\mLFZnbS.exe
  2⤵
  PID:10040
- C:\Windows\System\OGrGTvS.exe
  C:\Windows\System\OGrGTvS.exe
  2⤵
  PID:5472
- C:\Windows\System\qFlAinV.exe
  C:\Windows\System\qFlAinV.exe
  2⤵
  PID:5204
- C:\Windows\System\HIHICWf.exe
  C:\Windows\System\HIHICWf.exe
  2⤵
  PID:5484
- C:\Windows\System\jKSHqNV.exe
  C:\Windows\System\jKSHqNV.exe
  2⤵
  PID:9352
- C:\Windows\System\kESrmex.exe
  C:\Windows\System\kESrmex.exe
  2⤵
  PID:5228
- C:\Windows\System\XBZrtNt.exe
  C:\Windows\System\XBZrtNt.exe
  2⤵
  PID:5324
- C:\Windows\System\mbbrscu.exe
  C:\Windows\System\mbbrscu.exe
  2⤵
  PID:10132
- C:\Windows\System\KFUhCBF.exe
  C:\Windows\System\KFUhCBF.exe
  2⤵
  PID:5568
- C:\Windows\System\REwiQtp.exe
  C:\Windows\System\REwiQtp.exe
  2⤵
  PID:10780
- C:\Windows\System\bLJZZkR.exe
  C:\Windows\System\bLJZZkR.exe
  2⤵
  PID:9500
- C:\Windows\System\CCItIOb.exe
  C:\Windows\System\CCItIOb.exe
  2⤵
  PID:5532
- C:\Windows\System\IVqKJVr.exe
  C:\Windows\System\IVqKJVr.exe
  2⤵
  PID:10992
- C:\Windows\System\wAlzUxz.exe
  C:\Windows\System\wAlzUxz.exe
  2⤵
  PID:10408
- C:\Windows\System\nfrRuah.exe
  C:\Windows\System\nfrRuah.exe
  2⤵
  PID:5092
- C:\Windows\System\MYDCKzZ.exe
  C:\Windows\System\MYDCKzZ.exe
  2⤵
  PID:6100
- C:\Windows\System\XRcgCjw.exe
  C:\Windows\System\XRcgCjw.exe
  2⤵
  PID:5848
- C:\Windows\System\QWlFvrj.exe
  C:\Windows\System\QWlFvrj.exe
  2⤵
  PID:10704
- C:\Windows\System\NQeNluY.exe
  C:\Windows\System\NQeNluY.exe
  2⤵
  PID:5876
- C:\Windows\System\rXjEorI.exe
  C:\Windows\System\rXjEorI.exe
  2⤵
  PID:6336
- C:\Windows\System\WNybOua.exe
  C:\Windows\System\WNybOua.exe
  2⤵
  PID:11228
- C:\Windows\System\VPCgdYt.exe
  C:\Windows\System\VPCgdYt.exe
  2⤵
  PID:4588
- C:\Windows\System\tGjDQXO.exe
  C:\Windows\System\tGjDQXO.exe
  2⤵
  PID:10868
- C:\Windows\System\QynNepi.exe
  C:\Windows\System\QynNepi.exe
  2⤵
  PID:7192
- C:\Windows\System\tdowrlF.exe
  C:\Windows\System\tdowrlF.exe
  2⤵
  PID:9436
- C:\Windows\System\AciYMrc.exe
  C:\Windows\System\AciYMrc.exe
  2⤵
  PID:11432
- C:\Windows\System\KeWrduD.exe
  C:\Windows\System\KeWrduD.exe
  2⤵
  PID:5956
- C:\Windows\System\fjcCNvB.exe
  C:\Windows\System\fjcCNvB.exe
  2⤵
  PID:3788
- C:\Windows\System\OzonUtA.exe
  C:\Windows\System\OzonUtA.exe
  2⤵
  PID:1996
- C:\Windows\System\MNmBfva.exe
  C:\Windows\System\MNmBfva.exe
  2⤵
  PID:11688
- C:\Windows\System\qjsmWnv.exe
  C:\Windows\System\qjsmWnv.exe
  2⤵
  PID:11120
- C:\Windows\System\JSsOQkX.exe
  C:\Windows\System\JSsOQkX.exe
  2⤵
  PID:6272
- C:\Windows\System\UKQeALB.exe
  C:\Windows\System\UKQeALB.exe
  2⤵
  PID:6300
- C:\Windows\System\qXJwlkm.exe
  C:\Windows\System\qXJwlkm.exe
  2⤵
  PID:6352
- C:\Windows\System\sDoziIZ.exe
  C:\Windows\System\sDoziIZ.exe
  2⤵
  PID:11868
- C:\Windows\System\BnXfRpb.exe
  C:\Windows\System\BnXfRpb.exe
  2⤵
  PID:10556
- C:\Windows\System\YRwTNUH.exe
  C:\Windows\System\YRwTNUH.exe
  2⤵
  PID:6432
- C:\Windows\System\mlxuQqv.exe
  C:\Windows\System\mlxuQqv.exe
  2⤵
  PID:10956
- C:\Windows\System\prSjaWW.exe
  C:\Windows\System\prSjaWW.exe
  2⤵
  PID:10244
- C:\Windows\System\MrPgMbq.exe
  C:\Windows\System\MrPgMbq.exe
  2⤵
  PID:12112
- C:\Windows\System\DqCVRug.exe
  C:\Windows\System\DqCVRug.exe
  2⤵
  PID:9680
- C:\Windows\System\HsbiLVt.exe
  C:\Windows\System\HsbiLVt.exe
  2⤵
  PID:12196
- C:\Windows\System\auxytMr.exe
  C:\Windows\System\auxytMr.exe
  2⤵
  PID:12268
- C:\Windows\System\qJzQKdZ.exe
  C:\Windows\System\qJzQKdZ.exe
  2⤵
  PID:10940
- C:\Windows\System\SafOfdu.exe
  C:\Windows\System\SafOfdu.exe
  2⤵
  PID:10772
- C:\Windows\System\WHXQGto.exe
  C:\Windows\System\WHXQGto.exe
  2⤵
  PID:6000
- C:\Windows\System\FaoNizl.exe
  C:\Windows\System\FaoNizl.exe
  2⤵
  PID:5172
- C:\Windows\System\glSnxqN.exe
  C:\Windows\System\glSnxqN.exe
  2⤵
  PID:1964
- C:\Windows\System\WBZbPKZ.exe
  C:\Windows\System\WBZbPKZ.exe
  2⤵
  PID:5116
- C:\Windows\System\SzGTxbS.exe
  C:\Windows\System\SzGTxbS.exe
  2⤵
  PID:5896
- C:\Windows\System\yCfxMDm.exe
  C:\Windows\System\yCfxMDm.exe
  2⤵
  PID:12228
- C:\Windows\System\YMwdIXE.exe
  C:\Windows\System\YMwdIXE.exe
  2⤵
  PID:440
- C:\Windows\System\RhxmPvr.exe
  C:\Windows\System\RhxmPvr.exe
  2⤵
  PID:7012
- C:\Windows\System\WobPfZO.exe
  C:\Windows\System\WobPfZO.exe
  2⤵
  PID:12052
- C:\Windows\System\KkUCCwK.exe
  C:\Windows\System\KkUCCwK.exe
  2⤵
  PID:11580
- C:\Windows\System\Zdrtbuf.exe
  C:\Windows\System\Zdrtbuf.exe
  2⤵
  PID:11380
- C:\Windows\System\zvlxDPh.exe
  C:\Windows\System\zvlxDPh.exe
  2⤵
  PID:11792
- C:\Windows\System\obkCaZW.exe
  C:\Windows\System\obkCaZW.exe
  2⤵
  PID:11240
- C:\Windows\System\hrhyUSo.exe
  C:\Windows\System\hrhyUSo.exe
  2⤵
  PID:7140
- C:\Windows\System\qZPYpDH.exe
  C:\Windows\System\qZPYpDH.exe
  2⤵
  PID:6356
- C:\Windows\System\NSkWNUV.exe
  C:\Windows\System\NSkWNUV.exe
  2⤵
  PID:11888
- C:\Windows\System\lGntCpb.exe
  C:\Windows\System\lGntCpb.exe
  2⤵
  PID:6016
- C:\Windows\System\BcyyaQt.exe
  C:\Windows\System\BcyyaQt.exe
  2⤵
  PID:12396
- C:\Windows\System\LKAuGoz.exe
  C:\Windows\System\LKAuGoz.exe
  2⤵
  PID:9516
- C:\Windows\System\FEvkixd.exe
  C:\Windows\System\FEvkixd.exe
  2⤵
  PID:5196
- C:\Windows\System\YqAyrSi.exe
  C:\Windows\System\YqAyrSi.exe
  2⤵
  PID:6460
- C:\Windows\System\yTyCgYl.exe
  C:\Windows\System\yTyCgYl.exe
  2⤵
  PID:12488
- C:\Windows\System\SVCOBMb.exe
  C:\Windows\System\SVCOBMb.exe
  2⤵
  PID:6256
- C:\Windows\System\WSUBvuh.exe
  C:\Windows\System\WSUBvuh.exe
  2⤵
  PID:6360
- C:\Windows\System\XddpREr.exe
  C:\Windows\System\XddpREr.exe
  2⤵
  PID:12596
- C:\Windows\System\mjUezpW.exe
  C:\Windows\System\mjUezpW.exe
  2⤵
  PID:12660
- C:\Windows\System\zEiScmt.exe
  C:\Windows\System\zEiScmt.exe
  2⤵
  PID:6644
- C:\Windows\System\JDYEbBR.exe
  C:\Windows\System\JDYEbBR.exe
  2⤵
  PID:4312
- C:\Windows\System\yCzQlPc.exe
  C:\Windows\System\yCzQlPc.exe
  2⤵
  PID:6664
- C:\Windows\System\tvcmLuM.exe
  C:\Windows\System\tvcmLuM.exe
  2⤵
  PID:10628
- C:\Windows\System\zyqqtpU.exe
  C:\Windows\System\zyqqtpU.exe
  2⤵
  PID:11080
- C:\Windows\System\hmkUhdz.exe
  C:\Windows\System\hmkUhdz.exe
  2⤵
  PID:10084
- C:\Windows\System\qGhHPyr.exe
  C:\Windows\System\qGhHPyr.exe
  2⤵
  PID:12864
- C:\Windows\System\ghtjmiU.exe
  C:\Windows\System\ghtjmiU.exe
  2⤵
  PID:6708
- C:\Windows\System\FrSBdhH.exe
  C:\Windows\System\FrSBdhH.exe
  2⤵
  PID:12988
- C:\Windows\System\xULIKIA.exe
  C:\Windows\System\xULIKIA.exe
  2⤵
  PID:6972
- C:\Windows\System\gXXONpc.exe
  C:\Windows\System\gXXONpc.exe
  2⤵
  PID:10412
- C:\Windows\System\GtudXNR.exe
  C:\Windows\System\GtudXNR.exe
  2⤵
  PID:1864
- C:\Windows\System\VIYTuhi.exe
  C:\Windows\System\VIYTuhi.exe
  2⤵
  PID:13108
- C:\Windows\System\nQyTfLh.exe
  C:\Windows\System\nQyTfLh.exe
  2⤵
  PID:13128
- C:\Windows\System\zYpZLok.exe
  C:\Windows\System\zYpZLok.exe
  2⤵
  PID:6908
- C:\Windows\System\hvHIasi.exe
  C:\Windows\System\hvHIasi.exe
  2⤵
  PID:12236
- C:\Windows\System\ZHPngdo.exe
  C:\Windows\System\ZHPngdo.exe
  2⤵
  PID:6072
- C:\Windows\System\SlFQkZj.exe
  C:\Windows\System\SlFQkZj.exe
  2⤵
  PID:11804
- C:\Windows\System\xVRAQpa.exe
  C:\Windows\System\xVRAQpa.exe
  2⤵
  PID:5160
- C:\Windows\System\jEQemWi.exe
  C:\Windows\System\jEQemWi.exe
  2⤵
  PID:7068
- C:\Windows\System\AmjMaVs.exe
  C:\Windows\System\AmjMaVs.exe
  2⤵
  PID:11696
- C:\Windows\System\ZctIutT.exe
  C:\Windows\System\ZctIutT.exe
  2⤵
  PID:9348
- C:\Windows\System\LhFkPjK.exe
  C:\Windows\System\LhFkPjK.exe
  2⤵
  PID:9432
- C:\Windows\System\brIWWmL.exe
  C:\Windows\System\brIWWmL.exe
  2⤵
  PID:5712
- C:\Windows\System\ZRWLWNN.exe
  C:\Windows\System\ZRWLWNN.exe
  2⤵
  PID:2936
- C:\Windows\System\MgouCIT.exe
  C:\Windows\System\MgouCIT.exe
  2⤵
  PID:5584
- C:\Windows\System\ORicDUK.exe
  C:\Windows\System\ORicDUK.exe
  2⤵
  PID:6284
- C:\Windows\System\CiQCzXR.exe
  C:\Windows\System\CiQCzXR.exe
  2⤵
  PID:12624
- C:\Windows\System\OzMoenx.exe
  C:\Windows\System\OzMoenx.exe
  2⤵
  PID:6396
- C:\Windows\System\qvBUerf.exe
  C:\Windows\System\qvBUerf.exe
  2⤵
  PID:10524
- C:\Windows\System\zIxjLVq.exe
  C:\Windows\System\zIxjLVq.exe
  2⤵
  PID:6004
- C:\Windows\System\plsZZnD.exe
  C:\Windows\System\plsZZnD.exe
  2⤵
  PID:11524
- C:\Windows\System\LefFyGh.exe
  C:\Windows\System\LefFyGh.exe
  2⤵
  PID:7324
- C:\Windows\System\PeOgLdz.exe
  C:\Windows\System\PeOgLdz.exe
  2⤵
  PID:12840
- C:\Windows\System\hRcQtCG.exe
  C:\Windows\System\hRcQtCG.exe
  2⤵
  PID:7644
- C:\Windows\System\dNYhyCr.exe
  C:\Windows\System\dNYhyCr.exe
  2⤵
  PID:7552
- C:\Windows\System\OKokKzy.exe
  C:\Windows\System\OKokKzy.exe
  2⤵
  PID:6864
- C:\Windows\System\duDUPJa.exe
  C:\Windows\System\duDUPJa.exe
  2⤵
  PID:7116
- C:\Windows\System\kYeJoyR.exe
  C:\Windows\System\kYeJoyR.exe
  2⤵
  PID:7760
- C:\Windows\System\RbukYEO.exe
  C:\Windows\System\RbukYEO.exe
  2⤵
  PID:13132
- C:\Windows\System\hKpJYmg.exe
  C:\Windows\System\hKpJYmg.exe
  2⤵
  PID:9260
- C:\Windows\System\weyaFCx.exe
  C:\Windows\System\weyaFCx.exe
  2⤵
  PID:11052
- C:\Windows\System\StRgoxR.exe
  C:\Windows\System\StRgoxR.exe
  2⤵
  PID:6400
- C:\Windows\System\odgHoSz.exe
  C:\Windows\System\odgHoSz.exe
  2⤵
  PID:11776
- C:\Windows\System\wjbxRNa.exe
  C:\Windows\System\wjbxRNa.exe
  2⤵
  PID:12332
- C:\Windows\System\gzhENYf.exe
  C:\Windows\System\gzhENYf.exe
  2⤵
  PID:6252
- C:\Windows\System\mcbcyex.exe
  C:\Windows\System\mcbcyex.exe
  2⤵
  PID:1040
- C:\Windows\System\rzfqDuF.exe
  C:\Windows\System\rzfqDuF.exe
  2⤵
  PID:11316
- C:\Windows\System\rbMwAlz.exe
  C:\Windows\System\rbMwAlz.exe
  2⤵
  PID:6676
- C:\Windows\System\AoBeCGq.exe
  C:\Windows\System\AoBeCGq.exe
  2⤵
  PID:1168
- C:\Windows\System\VEXsmXn.exe
  C:\Windows\System\VEXsmXn.exe
  2⤵
  PID:13044
- C:\Windows\System\TSVyYPg.exe
  C:\Windows\System\TSVyYPg.exe
  2⤵
  PID:10984
- C:\Windows\System\LbIaaPj.exe
  C:\Windows\System\LbIaaPj.exe
  2⤵
  PID:11632
- C:\Windows\System\mFjEOZk.exe
  C:\Windows\System\mFjEOZk.exe
  2⤵
  PID:8256
- C:\Windows\System\kspwLkJ.exe
  C:\Windows\System\kspwLkJ.exe
  2⤵
  PID:11184
- C:\Windows\System\fBpmSHX.exe
  C:\Windows\System\fBpmSHX.exe
  2⤵
  PID:12872
- C:\Windows\System\xdejVuG.exe
  C:\Windows\System\xdejVuG.exe
  2⤵
  PID:7792
- C:\Windows\System\PwGiZKR.exe
  C:\Windows\System\PwGiZKR.exe
  2⤵
  PID:8252
- C:\Windows\System\IyVlPCv.exe
  C:\Windows\System\IyVlPCv.exe
  2⤵
  PID:8212
- C:\Windows\System\WXgNCjb.exe
  C:\Windows\System\WXgNCjb.exe
  2⤵
  PID:6744
- C:\Windows\System\hrFTzEU.exe
  C:\Windows\System\hrFTzEU.exe
  2⤵
  PID:13348
- C:\Windows\System\iOEtPoY.exe
  C:\Windows\System\iOEtPoY.exe
  2⤵
  PID:13380
- C:\Windows\System\ggumpto.exe
  C:\Windows\System\ggumpto.exe
  2⤵
  PID:13440
- C:\Windows\System\WDpkBap.exe
  C:\Windows\System\WDpkBap.exe
  2⤵
  PID:13476
- C:\Windows\System\gYFUNIX.exe
  C:\Windows\System\gYFUNIX.exe
  2⤵
  PID:13512
- C:\Windows\System\MIleYVX.exe
  C:\Windows\System\MIleYVX.exe
  2⤵
  PID:13544
- C:\Windows\System\PcXLCcK.exe
  C:\Windows\System\PcXLCcK.exe
  2⤵
  PID:13576
- C:\Windows\System\WspgGQv.exe
  C:\Windows\System\WspgGQv.exe
  2⤵
  PID:13592
- C:\Windows\System\YoHPYoG.exe
  C:\Windows\System\YoHPYoG.exe
  2⤵
  PID:13616
- C:\Windows\System\mXjGnAH.exe
  C:\Windows\System\mXjGnAH.exe
  2⤵
  PID:13644
- C:\Windows\System\EgEkULJ.exe
  C:\Windows\System\EgEkULJ.exe
  2⤵
  PID:13668
- C:\Windows\System\JxRscJh.exe
  C:\Windows\System\JxRscJh.exe
  2⤵
  PID:13684
- C:\Windows\System\fyyURTg.exe
  C:\Windows\System\fyyURTg.exe
  2⤵
  PID:13732
- C:\Windows\System\puynXoU.exe
  C:\Windows\System\puynXoU.exe
  2⤵
  PID:13772
- C:\Windows\System\ZbPIBnH.exe
  C:\Windows\System\ZbPIBnH.exe
  2⤵
  PID:13800
- C:\Windows\System\sUrAnLW.exe
  C:\Windows\System\sUrAnLW.exe
  2⤵
  PID:13828
- C:\Windows\System\LIzhapf.exe
  C:\Windows\System\LIzhapf.exe
  2⤵
  PID:13852
- C:\Windows\System\uhrjEnh.exe
  C:\Windows\System\uhrjEnh.exe
  2⤵
  PID:13896
- C:\Windows\System\UUorXiR.exe
  C:\Windows\System\UUorXiR.exe
  2⤵
  PID:13912
- C:\Windows\System\FwdbPrQ.exe
  C:\Windows\System\FwdbPrQ.exe
  2⤵
  PID:13940
- C:\Windows\System\WDNEKyv.exe
  C:\Windows\System\WDNEKyv.exe
  2⤵
  PID:13980
- C:\Windows\System\OwNDdQy.exe
  C:\Windows\System\OwNDdQy.exe
  2⤵
  PID:14008
- C:\Windows\System\qkTLrYW.exe
  C:\Windows\System\qkTLrYW.exe
  2⤵
  PID:14036
- C:\Windows\System\CLtpTTd.exe
  C:\Windows\System\CLtpTTd.exe
  2⤵
  PID:14068
- C:\Windows\System\OddhzMK.exe
  C:\Windows\System\OddhzMK.exe
  2⤵
  PID:14092
- C:\Windows\System\PwjXKqr.exe
  C:\Windows\System\PwjXKqr.exe
  2⤵
  PID:14120
- C:\Windows\System\siHzjGs.exe
  C:\Windows\System\siHzjGs.exe
  2⤵
  PID:14152
- C:\Windows\System\ANmDnOP.exe
  C:\Windows\System\ANmDnOP.exe
  2⤵
  PID:14180
- C:\Windows\System\UVWYVRD.exe
  C:\Windows\System\UVWYVRD.exe
  2⤵
  PID:14208
- C:\Windows\System\pQkIhzX.exe
  C:\Windows\System\pQkIhzX.exe
  2⤵
  PID:14236
- C:\Windows\System\atvJuFL.exe
  C:\Windows\System\atvJuFL.exe
  2⤵
  PID:14272
- C:\Windows\System\eEHTCGB.exe
  C:\Windows\System\eEHTCGB.exe
  2⤵
  PID:14292
- C:\Windows\System\HLHwfeX.exe
  C:\Windows\System\HLHwfeX.exe
  2⤵
  PID:14320
- C:\Windows\System\syVkwHm.exe
  C:\Windows\System\syVkwHm.exe
  2⤵
  PID:8280
- C:\Windows\System\jkHsLpq.exe
  C:\Windows\System\jkHsLpq.exe
  2⤵
  PID:13452
- C:\Windows\System\FdJVbfI.exe
  C:\Windows\System\FdJVbfI.exe
  2⤵
  PID:2308
- C:\Windows\System\VZGXghE.exe
  C:\Windows\System\VZGXghE.exe
  2⤵
  PID:13588
- C:\Windows\System\nmKpIHG.exe
  C:\Windows\System\nmKpIHG.exe
  2⤵
  PID:13680
- C:\Windows\System\pGROQCF.exe
  C:\Windows\System\pGROQCF.exe
  2⤵
  PID:13716
- C:\Windows\System\oxzazmB.exe
  C:\Windows\System\oxzazmB.exe
  2⤵
  PID:13816
- C:\Windows\System\vkYWJHn.exe
  C:\Windows\System\vkYWJHn.exe
  2⤵
  PID:9212
- C:\Windows\System\cvfmJhU.exe
  C:\Windows\System\cvfmJhU.exe
  2⤵
  PID:13844
- C:\Windows\System\mvQkOhf.exe
  C:\Windows\System\mvQkOhf.exe
  2⤵
  PID:13932
- C:\Windows\System\rZVPjVX.exe
  C:\Windows\System\rZVPjVX.exe
  2⤵
  PID:14004
- C:\Windows\System\XEsOCvO.exe
  C:\Windows\System\XEsOCvO.exe
  2⤵
  PID:14056
- C:\Windows\System\llktsHY.exe
  C:\Windows\System\llktsHY.exe
  2⤵
  PID:14116
- C:\Windows\System\SgqefTa.exe
  C:\Windows\System\SgqefTa.exe
  2⤵
  PID:14192
- C:\Windows\System\SNgHoxv.exe
  C:\Windows\System\SNgHoxv.exe
  2⤵
  PID:14280
- C:\Windows\System\tLfDzuX.exe
  C:\Windows\System\tLfDzuX.exe
  2⤵
  PID:8324
- C:\Windows\System\umtaXxa.exe
  C:\Windows\System\umtaXxa.exe
  2⤵
  PID:13888
- C:\Windows\System\RezkmmJ.exe
  C:\Windows\System\RezkmmJ.exe
  2⤵
  PID:14032
- C:\Windows\System\RnFhTbF.exe
  C:\Windows\System\RnFhTbF.exe
  2⤵
  PID:14256
- C:\Windows\System\GmROUHv.exe
  C:\Windows\System\GmROUHv.exe
  2⤵
  PID:13388
- C:\Windows\System\cifTrmF.exe
  C:\Windows\System\cifTrmF.exe
  2⤵
  PID:13504
- C:\Windows\System\mWdhmXf.exe
  C:\Windows\System\mWdhmXf.exe
  2⤵
  PID:13636
- C:\Windows\System\sPhWBXx.exe
  C:\Windows\System\sPhWBXx.exe
  2⤵
  PID:13628
- C:\Windows\System\EHFgCMv.exe
  C:\Windows\System\EHFgCMv.exe
  2⤵
  PID:14148
- C:\Windows\System\aUYcDEX.exe
  C:\Windows\System\aUYcDEX.exe
  2⤵
  PID:13492
- C:\Windows\System\vZjiNxv.exe
  C:\Windows\System\vZjiNxv.exe
  2⤵
  PID:13744
- C:\Windows\System\qBrTuOy.exe
  C:\Windows\System\qBrTuOy.exe
  2⤵
  PID:9616
- C:\Windows\System\Vtqwyum.exe
  C:\Windows\System\Vtqwyum.exe
  2⤵
  PID:14344
- C:\Windows\System\gSNTYBX.exe
  C:\Windows\System\gSNTYBX.exe
  2⤵
  PID:14364
- C:\Windows\System\VIZiwLG.exe
  C:\Windows\System\VIZiwLG.exe
  2⤵
  PID:14404
- C:\Windows\System\UpHiwVw.exe
  C:\Windows\System\UpHiwVw.exe
  2⤵
  PID:14444
- C:\Windows\System\bOvfNvh.exe
  C:\Windows\System\bOvfNvh.exe
  2⤵
  PID:14472
- C:\Windows\System\UQEsULs.exe
  C:\Windows\System\UQEsULs.exe
  2⤵
  PID:14504
- C:\Windows\System\ipRyjfa.exe
  C:\Windows\System\ipRyjfa.exe
  2⤵
  PID:14536
- C:\Windows\System\xOLsitz.exe
  C:\Windows\System\xOLsitz.exe
  2⤵
  PID:14568
- C:\Windows\System\GkqoELE.exe
  C:\Windows\System\GkqoELE.exe
  2⤵
  PID:14600
- C:\Windows\System\kKMVdFT.exe
  C:\Windows\System\kKMVdFT.exe
  2⤵
  PID:14624
- C:\Windows\System\UzBqVvC.exe
  C:\Windows\System\UzBqVvC.exe
  2⤵
  PID:14656
- C:\Windows\System\kZrYtWK.exe
  C:\Windows\System\kZrYtWK.exe
  2⤵
  PID:14680
- C:\Windows\System\eXlHVkb.exe
  C:\Windows\System\eXlHVkb.exe
  2⤵
  PID:14708
- C:\Windows\System\tJhEBZk.exe
  C:\Windows\System\tJhEBZk.exe
  2⤵
  PID:14744
- C:\Windows\System\mrXtFiw.exe
  C:\Windows\System\mrXtFiw.exe
  2⤵
  PID:14768
- C:\Windows\System\dzgVUSX.exe
  C:\Windows\System\dzgVUSX.exe
  2⤵
  PID:14792
- C:\Windows\System\mkfltVu.exe
  C:\Windows\System\mkfltVu.exe
  2⤵
  PID:14824
- C:\Windows\System\fZTzIao.exe
  C:\Windows\System\fZTzIao.exe
  2⤵
  PID:14848
- C:\Windows\System\LzjWKdA.exe
  C:\Windows\System\LzjWKdA.exe
  2⤵
  PID:14876
- C:\Windows\System\hUaLRRj.exe
  C:\Windows\System\hUaLRRj.exe
  2⤵
  PID:14904
- C:\Windows\System\pAcZIzm.exe
  C:\Windows\System\pAcZIzm.exe
  2⤵
  PID:14932
- C:\Windows\System\rBXjtBO.exe
  C:\Windows\System\rBXjtBO.exe
  2⤵
  PID:14960
- C:\Windows\System\zcJRTkP.exe
  C:\Windows\System\zcJRTkP.exe
  2⤵
  PID:14988
- C:\Windows\System\xPnwRgg.exe
  C:\Windows\System\xPnwRgg.exe
  2⤵
  PID:15016
- C:\Windows\System\fOaAwEr.exe
  C:\Windows\System\fOaAwEr.exe
  2⤵
  PID:15044
- C:\Windows\System\jxwhivR.exe
  C:\Windows\System\jxwhivR.exe
  2⤵
  PID:15080
- C:\Windows\System\mBbuOBB.exe
  C:\Windows\System\mBbuOBB.exe
  2⤵
  PID:15104
- C:\Windows\System\jAkWTPG.exe
  C:\Windows\System\jAkWTPG.exe
  2⤵
  PID:15144
- C:\Windows\System\uyGAwSr.exe
  C:\Windows\System\uyGAwSr.exe
  2⤵
  PID:15164
- C:\Windows\System\oLuNiDw.exe
  C:\Windows\System\oLuNiDw.exe
  2⤵
  PID:15188
- C:\Windows\System\mmCriQl.exe
  C:\Windows\System\mmCriQl.exe
  2⤵
  PID:15220
- C:\Windows\System\XodHJAM.exe
  C:\Windows\System\XodHJAM.exe
  2⤵
  PID:15244
- C:\Windows\System\EAlfzjO.exe
  C:\Windows\System\EAlfzjO.exe
  2⤵
  PID:15276
- C:\Windows\System\QHpROlQ.exe
  C:\Windows\System\QHpROlQ.exe
  2⤵
  PID:15304
- C:\Windows\System\zxgCGnX.exe
  C:\Windows\System\zxgCGnX.exe
  2⤵
  PID:15336
- C:\Windows\System\StsdxMP.exe
  C:\Windows\System\StsdxMP.exe
  2⤵
  PID:14340
- C:\Windows\System\uEkpHRs.exe
  C:\Windows\System\uEkpHRs.exe
  2⤵
  PID:14440
- C:\Windows\System\OqbgAYk.exe
  C:\Windows\System\OqbgAYk.exe
  2⤵
  PID:14500
- C:\Windows\System\BMzIWlW.exe
  C:\Windows\System\BMzIWlW.exe
  2⤵
  PID:14564
- C:\Windows\System\AjhjNlo.exe
  C:\Windows\System\AjhjNlo.exe
  2⤵
  PID:14692
- C:\Windows\System\JZpjrcO.exe
  C:\Windows\System\JZpjrcO.exe
  2⤵
  PID:14752
- C:\Windows\System\nkvJsEN.exe
  C:\Windows\System\nkvJsEN.exe
  2⤵
  PID:9328
- C:\Windows\System\qjDhuoM.exe
  C:\Windows\System\qjDhuoM.exe
  2⤵
  PID:9560
- C:\Windows\System\JZyDqGX.exe
  C:\Windows\System\JZyDqGX.exe
  2⤵
  PID:14916
- C:\Windows\System\TVcbDRW.exe
  C:\Windows\System\TVcbDRW.exe
  2⤵
  PID:10008
- C:\Windows\System\udITnUg.exe
  C:\Windows\System\udITnUg.exe
  2⤵
  PID:15028
- C:\Windows\System\YdHBvgF.exe
  C:\Windows\System\YdHBvgF.exe
  2⤵
  PID:15088
- C:\Windows\System\nnJJFJT.exe
  C:\Windows\System\nnJJFJT.exe
  2⤵
  PID:15140
- C:\Windows\System\wCksMte.exe
  C:\Windows\System\wCksMte.exe
  2⤵
  PID:15200
- C:\Windows\System\FBkkboK.exe
  C:\Windows\System\FBkkboK.exe
  2⤵
  PID:15236
- C:\Windows\System\nAbTUjz.exe
  C:\Windows\System\nAbTUjz.exe
  2⤵
  PID:10216
- C:\Windows\System\DVJwjEa.exe
  C:\Windows\System\DVJwjEa.exe
  2⤵
  PID:15332
- C:\Windows\System\CPFkPKV.exe
  C:\Windows\System\CPFkPKV.exe
  2⤵
  PID:14376
- C:\Windows\System\mVxHMSV.exe
  C:\Windows\System\mVxHMSV.exe
  2⤵
  PID:14560
- C:\Windows\System\cDHPzsc.exe
  C:\Windows\System\cDHPzsc.exe
  2⤵
  PID:14648
- C:\Windows\System\AqFPMeQ.exe
  C:\Windows\System\AqFPMeQ.exe
  2⤵
  PID:14812
- C:\Windows\System\uBLFByl.exe
  C:\Windows\System\uBLFByl.exe
  2⤵
  PID:15228
- C:\Windows\System\FDZBJTJ.exe
  C:\Windows\System\FDZBJTJ.exe
  2⤵
  PID:10812
- C:\Windows\System\mxJeIOs.exe
  C:\Windows\System\mxJeIOs.exe
  2⤵
  PID:14356
- C:\Windows\System\lVkwlqj.exe
  C:\Windows\System\lVkwlqj.exe
  2⤵
  PID:14532
- C:\Windows\System\BjeOdHK.exe
  C:\Windows\System\BjeOdHK.exe
  2⤵
  PID:14720
- C:\Windows\System\rBlzeYi.exe
  C:\Windows\System\rBlzeYi.exe
  2⤵
  PID:11124
- C:\Windows\System\jGobvar.exe
  C:\Windows\System\jGobvar.exe
  2⤵
  PID:14484
- C:\Windows\System\jYJcytP.exe
  C:\Windows\System\jYJcytP.exe
  2⤵
  PID:10580
- C:\Windows\System\OjsXYCh.exe
  C:\Windows\System\OjsXYCh.exe
  2⤵
  PID:920
- C:\Windows\System\lyqgdKZ.exe
  C:\Windows\System\lyqgdKZ.exe
  2⤵
  PID:10904
- C:\Windows\System\rqBlRVG.exe
  C:\Windows\System\rqBlRVG.exe
  2⤵
  PID:15012
- C:\Windows\System\yYKMUIw.exe
  C:\Windows\System\yYKMUIw.exe
  2⤵
  PID:15372
- C:\Windows\System\aCEFEmK.exe
  C:\Windows\System\aCEFEmK.exe
  2⤵
  PID:15416
- C:\Windows\System\aQuWzlt.exe
  C:\Windows\System\aQuWzlt.exe
  2⤵
  PID:15444
- C:\Windows\System\KwjexNT.exe
  C:\Windows\System\KwjexNT.exe
  2⤵
  PID:15460
- C:\Windows\System\qEqEBdR.exe
  C:\Windows\System\qEqEBdR.exe
  2⤵
  PID:15500
- C:\Windows\System\wXAQTTR.exe
  C:\Windows\System\wXAQTTR.exe
  2⤵
  PID:15516
- C:\Windows\System\Hwkhamr.exe
  C:\Windows\System\Hwkhamr.exe
  2⤵
  PID:15544
- C:\Windows\System\ZhovBUe.exe
  C:\Windows\System\ZhovBUe.exe
  2⤵
  PID:15572
- C:\Windows\System\RshILMo.exe
  C:\Windows\System\RshILMo.exe
  2⤵
  PID:15600
- C:\Windows\System\zPeDNHA.exe
  C:\Windows\System\zPeDNHA.exe
  2⤵
  PID:15640
- C:\Windows\System\JQchjvr.exe
  C:\Windows\System\JQchjvr.exe
  2⤵
  PID:15668
- C:\Windows\System\kVEzVma.exe
  C:\Windows\System\kVEzVma.exe
  2⤵
  PID:15696
- C:\Windows\System\MIrftOb.exe
  C:\Windows\System\MIrftOb.exe
  2⤵
  PID:15724
- C:\Windows\System\bvBWZEh.exe
  C:\Windows\System\bvBWZEh.exe
  2⤵
  PID:15760
- C:\Windows\System\dZlPzOn.exe
  C:\Windows\System\dZlPzOn.exe
  2⤵
  PID:15780
- C:\Windows\System\mVevmdl.exe
  C:\Windows\System\mVevmdl.exe
  2⤵
  PID:15808
- C:\Windows\System\TKgiWQo.exe
  C:\Windows\System\TKgiWQo.exe
  2⤵
  PID:15824
- C:\Windows\System\LXPLCjz.exe
  C:\Windows\System\LXPLCjz.exe
  2⤵
  PID:15840
- C:\Windows\System\kfUKGJR.exe
  C:\Windows\System\kfUKGJR.exe
  2⤵
  PID:15868
- C:\Windows\System\wwIyPlP.exe
  C:\Windows\System\wwIyPlP.exe
  2⤵
  PID:15896
- C:\Windows\System\tKbyDxt.exe
  C:\Windows\System\tKbyDxt.exe
  2⤵
  PID:15948
- C:\Windows\System\gSZDQen.exe
  C:\Windows\System\gSZDQen.exe
  2⤵
  PID:15988
- C:\Windows\System\DCdxrqq.exe
  C:\Windows\System\DCdxrqq.exe
  2⤵
  PID:16004
- C:\Windows\System\EknmLAg.exe
  C:\Windows\System\EknmLAg.exe
  2⤵
  PID:16032
- C:\Windows\System\VRTPsLc.exe
  C:\Windows\System\VRTPsLc.exe
  2⤵
  PID:16060
- C:\Windows\System\gaNxXQD.exe
  C:\Windows\System\gaNxXQD.exe
  2⤵
  PID:16088
- C:\Windows\System\VebJOJQ.exe
  C:\Windows\System\VebJOJQ.exe
  2⤵
  PID:16124
- C:\Windows\System\BPlaNNA.exe
  C:\Windows\System\BPlaNNA.exe
  2⤵
  PID:16152
- C:\Windows\System\dAktRhz.exe
  C:\Windows\System\dAktRhz.exe
  2⤵
  PID:16180
- C:\Windows\System\uajRWTp.exe
  C:\Windows\System\uajRWTp.exe
  2⤵
  PID:16208
- C:\Windows\System\Wmjtutc.exe
  C:\Windows\System\Wmjtutc.exe
  2⤵
  PID:16236
- C:\Windows\System\NmuUkJg.exe
  C:\Windows\System\NmuUkJg.exe
  2⤵
  PID:16268
- C:\Windows\System\VDsQqby.exe
  C:\Windows\System\VDsQqby.exe
  2⤵
  PID:16296
- C:\Windows\System\vzAsfqT.exe
  C:\Windows\System\vzAsfqT.exe
  2⤵
  PID:16328
- C:\Windows\System\vBYBFwa.exe
  C:\Windows\System\vBYBFwa.exe
  2⤵
  PID:16356
- C:\Windows\System\IiORywf.exe
  C:\Windows\System\IiORywf.exe
  2⤵
  PID:14872
- C:\Windows\System\mIntLaR.exe
  C:\Windows\System\mIntLaR.exe
  2⤵
  PID:15432
- C:\Windows\System\qNmYnnt.exe
  C:\Windows\System\qNmYnnt.exe
  2⤵
  PID:15536

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_vm11pmhr.ddh.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\ADdcPvP.exe

Filesize
2.9MB

MD5
a404ebde5562d1d443e7dd2074d01460

SHA1
4c7f30471ed21f6e598290f2fe54146a16b32e9a

SHA256
e26b51d361db5a3114c281ccf6625e9c3624ec44e9c2bad3ecdaa69d3a438ce6

SHA512
968b3628bf61bd1fbe2049e25f96cae9c60acfd0cbd25a572037eee4632512adf1a1be3d4a383fb06388f49a3047575c4009c49931536b7d56731cb0d9b31ba9

Download Submit
C:\Windows\System\DeUfMtc.exe

Filesize
8B

MD5
f249cce64f1edf5dc7bee5be6e2d5ad9

SHA1
0d569e38ec2ee4118bd367894784a63582261e47

SHA256
c376b4c1019dfb02d31ea3137efb150405ef95ba0305dcf5e026248ffc8d7cc2

SHA512
fdeb5b006eba899c911e624dadfb6c7b2eb030236757e187df8ba8d194a5a42df30b590d0fcf3f859b2532e60fc00c33154f75c1e6481913447ff2fa15b08be2

Download Submit
C:\Windows\System\DvKczsG.exe

Filesize
2.9MB

MD5
cf74f70947b1b6db3107a2fcb81a9d2e

SHA1
0ff369287cf13e4f357e63cc3f0e181db77b87b4

SHA256
9bf32fb24fea302fc6abb6e222f33558e5f32d273de318e30c3d1d2329e0e381

SHA512
860d9ab0a3fb2c36d6a0db9775215f64dffc27deba20224d87b2c098158c46e9aa2be124573d1294a3f8928004e075923703d3fc9b2a22f82d4dc67b2298b95a

Download Submit
C:\Windows\System\FmZNBPT.exe

Filesize
2.9MB

MD5
112a4bca3a0dfcc1de5a04769d67f517

SHA1
ff17f091558f3f4be70451d32aae109d82a0ba06

SHA256
dc708c236a2ed76e9464abdffc85254b18d9a03e7eaa103a1281e08468f881eb

SHA512
4f1443574622968481eb87db8e13668820b45229585464cd382b63f46c82d0ca025147d1f5d8518f43576d5c1f7d721fc3cfd7d1b6013dcd0ed6f95c1664986f

Download Submit
C:\Windows\System\GMGTNuJ.exe

Filesize
2.9MB

MD5
0e20c90ce4fe6cf3ae81a43a3e112499

SHA1
95d37b6e24bd9cb51ddd461febe1cf7018d51a4d

SHA256
f1b01fd7c72228d7968829845ec574c32a1e38a52f38b06f180560405033b777

SHA512
0e7455efa665add372b81bcda38e88235e73f2b8df44a19f85e99257aa6105408c76e5d226505f0e64f5462874459a2d69822b6da29bd2939ebd8ad2f7a7b013

Download Submit
C:\Windows\System\JTYEStR.exe

Filesize
2.9MB

MD5
35c0b4e47796dcc6078118c553c7251f

SHA1
8037b0a55dba1b47406bae4ef27c182e63d1b945

SHA256
891570ea950bc0d47eca7b74d603b1d837c576376cafdc578af1714be04e2ad3

SHA512
c726655e9c72471260af0a9eaf83e7798db41920f957d8da5581a4ea43ecfc66fec1d131300b65bc00edc56b5c1cdd8b3023c2c2421bfd96185a312b28979032

Download Submit
C:\Windows\System\JxQYQdI.exe

Filesize
2.9MB

MD5
a4d4742470c048b73d8b5b8f62835422

SHA1
1d8feeadfd51d681d0b4354c38e1f01ab4ef93cf

SHA256
17b846816d982bf1c787a1a1bbcf62aa66b8b1c260c7ca773be5c76061ee6f41

SHA512
e1d4cfbd8c659e53e9bda5731c7e7bd54ce1b374f81d458a07e65be425924ad609a2e669dd2467897685c3e41ebb07df2af042ba5338695ab9ed1aeb336fd92c

Download Submit
C:\Windows\System\LZegYwJ.exe

Filesize
2.9MB

MD5
f6d920291b0f0e8f60a7d33953a5d8dd

SHA1
b4f92f6b9c922cd0244c193c37c1bd7da1358fc4

SHA256
b56077f6b62c2eb935f799238725e4fc3d644260efc892c3662bf63227f539fe

SHA512
2d147afd0ffdc459bf422a84aa7a32bd0b3311049e3eea4580a3857b0bc25d203c08e2788dc5507c1a31cfdd24f6236fb693e97be8a90946d84c0cabd8e2a213

Download Submit
C:\Windows\System\MtLkUJp.exe

Filesize
2.9MB

MD5
0591bc1a182b5275241684682d77ec6e

SHA1
30391ed80b2cf46e27cb6a7355b6c77680b5474f

SHA256
1bdd75ba01a686931e3843eecfab9ba319f78357c0bfdf54d51fa96be1daef3d

SHA512
b84a822591304dc43d8325b66a3cacb44b49aaec404be7a408ead231e8555426ca0aa8cfa9e4bb15aad52bd8e5eb9974af06e2a1409632d492766912653a4307

Download Submit
C:\Windows\System\NNXsZAU.exe

Filesize
2.9MB

MD5
c7d5066e059629856460b8237ba8a77e

SHA1
6acf1ac5b0bc1b1b9f983a9e5db307c5c8fe6a75

SHA256
2fb3c240988fccad01206f376c520df1ccf95167185bbf1530ef280b10b860da

SHA512
7cdf785822dc6c3c1020d09bef4662d05fc90da34d5987784bd9492fd360bd87684793246cdcdc00043e2f10220a14163bb78565226df39ebc3857913cea25e4

Download Submit
C:\Windows\System\NQPROAr.exe

Filesize
2.9MB

MD5
2788288fc45faabca3fc59e689ac75eb

SHA1
c702f7c1cdd8c86c4463447a500c028fb3f822f5

SHA256
2a1cf727359714512128dfb12f4597945f4839c2f07307523bb203e0402b1e04

SHA512
b08b9ca59f71a21ad057164e29226b6ad6727378eb00a96d030b571785a26b97fab5ade93af739c1b6e59601a1c6413968a1c8967ca450bb8580e447462c8bae

Download Submit
C:\Windows\System\NbasLuA.exe

Filesize
2.9MB

MD5
fc40d5e3c1385af2d880b67daac6a127

SHA1
fe29f0084950f1de9c539cb1477e6ae32f5d08ea

SHA256
fd741206b551526be9baebb65754d0ef332415cc61f58026606666fe8df16d7d

SHA512
92845c42da5a05f22dbcd195e1d56f86e2c73807ad9b4f2c0e719f61a1748c9cbf832b822ec9ebfdd523c462435b76a49596bb5606d4cd0f38cb92d687c14bef

Download Submit
C:\Windows\System\NqqMCfg.exe

Filesize
2.9MB

MD5
c250708a2f97bfb95b58fa316783f4d9

SHA1
d86fa80dbc072ed6bcf273944a5f1d28f1b983fb

SHA256
0bf7c4a42c08faf46928b03cd579780958c939279a9e4a0e81d7328c113d36f8

SHA512
434df1a1e30338dbce7dc6b5f0f98d5325d777b5ab4e236e602153c969eff289513e3d4521c8cf54b73bf0e11632f778727da84ed0e3d25a3e12fb7f37d835ee

Download Submit
C:\Windows\System\RlHXRKb.exe

Filesize
2.9MB

MD5
34aecff75c4cb4a5ef0e06340d152d89

SHA1
79c806bde0636f6dd41fd3511c64617e0e734d7b

SHA256
f889c88574779d2bdd0d4f196733a6fa847681f4dc275e6259a106683e8c9cf2

SHA512
3ed0a15b4faadef3e8ca4c02ccfa60aab5fc36fd5a4e13deee353bafe6268d53e110838148f90ae2321e3629e9e804aa6867a13b3a4d4250b66f28c0be725b63

Download Submit
C:\Windows\System\TSCzWob.exe

Filesize
2.9MB

MD5
0c87d83d90f27d3d257fcd0242db6fd1

SHA1
f2e1f639bf33f75bfa1d9c0e06a6a126f06ed5ec

SHA256
50a82487eec7a5bee33dd36207984e86efd426c4586f9578cd3254fe9311d714

SHA512
af18b781e0098f54951fe83c65331991c7b4cd03eabc65a83b6b7cf5379e2ce4a9bff346c2105c824a911c1af2b7de4568a39fc8b0369d7ec17f15b36375e53b

Download Submit
C:\Windows\System\XurdfUk.exe

Filesize
2.9MB

MD5
3c9c7e97a437e70fbaf3034715db22b6

SHA1
60eaa044eb508d7453659351178e7a32b4ddd673

SHA256
ea5f67ffbbbb5b15f1b7b9f22915e1298668425ab7f5a0118e5422de7fb1dd70

SHA512
371ef002963b0f47d2ad5f74d189cc14a360183992e29dc143cdb1b82fc22105fe2a00c9e5ba1385695c6f3f58af90926fcc16c945e28d4278c12b727ac28436

Download Submit
C:\Windows\System\XzbUEhh.exe

Filesize
2.9MB

MD5
6b90b4048c21dfd7b546f61d0fff6f1a

SHA1
09db459515186a8c9ebd29674cf3486d2e718e40

SHA256
476fe09cdb7cbcef8b39525174c85562be2f9440e1186694e5109cd1a210f1fd

SHA512
8ea775feae391b6a58bca922908246b80729e5625a1bf8ce778a2c4a2eb0eb8b2b8b53f22122b19f7337a790b8b8cd978cb9d4ef22504e35c33afa7978c5ff49

Download Submit
C:\Windows\System\Zjbnnjh.exe

Filesize
18B

MD5
15dc6af7faadf9f056674434750f301f

SHA1
786a1466ec663a8f39f1cb6ae0553a8131107212

SHA256
22e5134ab5dd7b72c321d1d70a8f322fc70112702dd452292f6b4f315f8e1f75

SHA512
3534bfb65bd19eec58c8053bcce9caca4e02063bbe00500206951854ed2c6e1889e5a2eba58d2f95464bc3ddf5b518b5aef67c7acb8a34075a21ec73da48446a

Download Submit
C:\Windows\System\aUznMrY.exe

Filesize
2.9MB

MD5
8a11d8f1fac6d8856dae33649e57393f

SHA1
53fcc6d33531188ffbcd239ac23d863b2c72dd21

SHA256
f72b577a478ef31d2a9f1e632beabdb9b771e63338ce38d1790685c5fdb71900

SHA512
a1c2c959694f15ddd203bcc7676b3711c5052ca4c92ca6f6c07898d746e263aa40f771c9b4ff15317cea47218349d806810a810a39a8ab5431bf4d30209b7e76

Download Submit
C:\Windows\System\aYjVFDL.exe

Filesize
2.9MB

MD5
a30c1f38cce93d2ef8a7fe4548253b54

SHA1
70a88896adcb26e607a74c490043ec8e252294f7

SHA256
553021b839a17bb569ec9c523ac69c3b6a133424e152c49fe8d42fccf35f9d19

SHA512
5bfe43d53c59a4481a2b676815ea45e839076179f37fe3f4d38b5fb982c95f298ba131565f746e360d4b88c14f312c874d7def9e0f16e82cdcbbb6aad5ccbd67

Download Submit
C:\Windows\System\dsyrXWK.exe

Filesize
2.9MB

MD5
36dc58fa41df2eb9bb95aa5b94a97157

SHA1
9230e0f46a0d078739d076ff3445efa12d36f465

SHA256
3e0d19b269b9cd8844be1204c44bc08fcd1cd11338fca2f9227fbb0a5f74c55b

SHA512
771bb7217691f47afc5673bef571ec7aa4c3fc7f9be9abba072902b72c900e992242b1bc0c0abbe93cc5d7b91a84e39303de53bcba02fc88370455a32819b7cb

Download Submit
C:\Windows\System\eAZQMJe.exe

Filesize
2.9MB

MD5
4d19226def10be7ec92166dd4ab8bc9b

SHA1
8fdf89a157dec8eed66526d874f2f62c1f724ddb

SHA256
3756ecf835def60e5e6ba29d2b608369725607326eb54f6b913ab17b0ca30ab3

SHA512
4fe21afba91a4f0b80da72d331c6d0d0decb4b19fb6e83a958bcce1ec5f969485313f90d31f9c4a8a6a6971c57410d5622983ea24271eb824f1b9be235c88fe3

Download Submit
C:\Windows\System\kBqTnsx.exe

Filesize
2.9MB

MD5
9c3a855e3e3f6da5ead39383acb3539b

SHA1
1ee32105c31069b4759e50b88c3d56585cfb377f

SHA256
16fbbfd1a6cee6ba003a9528eb9ac7e2b7f09d41ab9f017a9a83a6e5d609277c

SHA512
f9f8e9e8805a15836daec2dd24d7ae4599f9905a5f5303a964dcc43af10744c85dc6dc6e8c7ba00d2e7434d930be02096f6c8bc06a3468087b03d1c26dd18532

Download Submit
C:\Windows\System\lTTrisV.exe

Filesize
2.9MB

MD5
c14915011c85bcfb7dd55434400d082b

SHA1
ffdc3622aa4e206186dc67e73119eb3a90fdcf4e

SHA256
b656df5d76e2f77a8fd6fd8118e2ac7a06903c5ace04c6cbd8990ce7be831241

SHA512
a2f32c057f6643a415dcd31bec93d4932ce3e043d77af8b56c6a77cc2c89d1f1d7ea191febb180502b9abfe627e4ab16fe4d4b162129050fa3c78db730595047

Download Submit
C:\Windows\System\lUXcoJo.exe

Filesize
2.9MB

MD5
2cafb2f3e18d48e2d739e1c5318dbb67

SHA1
8ba43b2beaa9c8e69fda4b97b1ca713d323b1ae4

SHA256
7307a1f3b4ddc164088f14a67868768a10a469ae1eb9563091ee8d7f181bc470

SHA512
3bfcf4ea67282bcfac77270bd2ee8350b0f6a264015572c4ff250e567369f6a72680d193d7a23a0363649a2a2b3ebc7b1ed3a98900cab78199433465e2e0aa06

Download Submit
C:\Windows\System\mDNUcDC.exe

Filesize
2.9MB

MD5
95daaefab5da4949247d4274ecfb583e

SHA1
cbba2c8fdb81afdc8de87766139f518820910c57

SHA256
0dd4e6666ee74ef4c9eb94a1612e840cd16e583675944bed9e7f849a71a3796c

SHA512
4f005d7178d6d8c9dd25ff9d64d1fbc3869860d694c6a99e63eb3452469389a17c3d3e099cee807eeb807faf207fcf341c6ea846f0eab6527aae551b7cba6542

Download Submit
C:\Windows\System\mHSHVUy.exe

Filesize
2.9MB

MD5
e53772b1de5a98f3adb917d3254a4eec

SHA1
c1beb6706cde036631d607a70dd94022b21ce336

SHA256
4ce94095b86e0b11d07350b7ad7d5a3358fc00f97c3c06fb59ece27257999fdd

SHA512
0e1c385f5db19a0fe0ac3a7244b6c3a27b2d11ea5cbe18e5814cbcd76f05ee0ba65d59c9406266a50e6c95a2ae6514c020a52674b02a27839212b90702f830d7

Download Submit
C:\Windows\System\nPtEuBq.exe

Filesize
2.9MB

MD5
15ebef98f851c4b7b5ad674989e32360

SHA1
2522fa456caee4a83daaf52a47b265ece93ece57

SHA256
bead6a244578c51d3fda74808054aa6413e7cb1ab5a818ed6a8f176e5c819f73

SHA512
e75ca3626238da7119cdba9e9ff89b7300f984f1ddcaffecc03846a382bb4a82725577048fa3b7f792a3629dc50594dc66fee1e6df9607c3895ca727e16dd0dd

Download Submit
C:\Windows\System\qEhdZAg.exe

Filesize
2.9MB

MD5
cc4bd1cb7c63b5f0aecf5cdf63cfbfb0

SHA1
7daf327afadef09c6400d87c0c600cd7c4417540

SHA256
0d59865899026b5b670e39e985bef863893f2365bf45ecddccb4d8cb4429c715

SHA512
824569d12ef07681385979a5a9d304bad4f6b76ff90ffcf9ffcc8719553830a3896df26f2741b4114c9df2a755598baef595670cedbbb66676189d42138fa09b

Download Submit
C:\Windows\System\ronsnyc.exe

Filesize
2.9MB

MD5
f2db3df6be17cdb6cee83ed2650b8110

SHA1
404dfde6cdde93f39694da74439d7a7e1e296e84

SHA256
67ad51ab5f0557b06b704496c57c668ac6069b2d0125a45e7e2fd8760f50ab0f

SHA512
be1b1e3eb08de0cb3d83632c820dc34c560bdf92435a9faf0b22bbe4e861a61b88a9e16b4bcad7a7272687efea2046475c7e3017ad9a9687e2f50d0874de773c

Download Submit
C:\Windows\System\tMMTuew.exe

Filesize
2.9MB

MD5
f50ac6a0a9915b3600f996db89f70970

SHA1
fdfee9758d81f8d50452a259c57dd5e90a433fb0

SHA256
0a1ffeace948492562dffa369d210af24c30fc86fd9c56b11463ac51c9d74e99

SHA512
1fee8d6d1d241cb2e227d86ca01074cb5e1de85c71481e7687527d98c3ee34d134a088ad502f0db1a671343793afee59deb4d31cfdcc6d58ab1ef7f74cf86879

Download Submit
C:\Windows\System\vobsHYd.exe

Filesize
2.9MB

MD5
6f7e9df7bba137582af74724302edafc

SHA1
db9af5816b53f4aff29db6e5a1a3da321a3cfe1d

SHA256
82b633a24d488f47e5ff6d0b2a8d55c19ce0c0f3b613019b0c546bd4cea247ab

SHA512
b4671dd26f329ad019a96202fa8002e873bbf974fdbf6be2c6d6fe95002aa7113f61c385c6a9d0ed5c8b7ca4bf559d47bb9e62fac78c4938f1dfcefe94ee229b

Download Submit
C:\Windows\System\wgISyOg.exe

Filesize
2.9MB

MD5
83a2399cbb63b56468bc8d24b4de93ef

SHA1
206bec6c96c9bf47f166accc63264c83c4d6d9cb

SHA256
4923720a8a3e8278b1e9f25594fd7ffed98a7f6af5630eab1d9e2117be9e3103

SHA512
48869b6b7197d0298d849bebab28b84dfbd21cad7f8fa2d6c3030f0491f969c0cdbbee3c9725b41428bdc072cd3305019577435ae6c9731b1fdf39e6d30731e4

Download Submit
C:\Windows\System\ygJiZDy.exe

Filesize
2.9MB

MD5
91be83e6a6d5d6229e192bb4439ca319

SHA1
134780ff477121eb105eff663bd176ea804e1a72

SHA256
ceed34a2ed40c7e0cc5a17c69e6b961573b9dca5b917de908671289eae3bb562

SHA512
ffa6a2ee2e72a88638a3c4622b7b85c4219bfe949c025684d0ff22d828a9e848ea300ba718ea1133dc3e2137504a9704d17574065cf521315191c1a07b043770

Download Submit
C:\Windows\System\zEWqZUx.exe

Filesize
2.9MB

MD5
9a2a9648faba559407115702d40c22e9

SHA1
267da891688fa230d48892132e0480ac163c68ca

SHA256
e5117ed091c6030f4287dc1b22586fbc13db54b7229dd84c640c0bc2659988e7

SHA512
a93406e51dfeb0889a96d80d0719e5075aec361dc4e60a52a191c6120151b3f01da301de4abeb5d316049f2a7caebcdc1e4ae8adb4128b9d65c213e7ee9d726d

Download Submit
memory/396-2115-0x00007FF7128E0000-0x00007FF712CD6000-memory.dmp

Filesize
4.0MB

Download
memory/396-154-0x00007FF7128E0000-0x00007FF712CD6000-memory.dmp

Filesize
4.0MB

Download
memory/856-230-0x00007FF76C230000-0x00007FF76C626000-memory.dmp

Filesize
4.0MB

Download
memory/1220-79-0x00007FF6624F0000-0x00007FF6628E6000-memory.dmp

Filesize
4.0MB

Download
memory/1220-2124-0x00007FF6624F0000-0x00007FF6628E6000-memory.dmp

Filesize
4.0MB

Download
memory/1556-2703-0x00007FF7898A0000-0x00007FF789C96000-memory.dmp

Filesize
4.0MB

Download
memory/1556-241-0x00007FF7898A0000-0x00007FF789C96000-memory.dmp

Filesize
4.0MB

Download
memory/1624-178-0x00007FF659110000-0x00007FF659506000-memory.dmp

Filesize
4.0MB

Download
memory/1624-2110-0x00007FF659110000-0x00007FF659506000-memory.dmp

Filesize
4.0MB

Download
memory/1660-2715-0x00007FF6D9E30000-0x00007FF6DA226000-memory.dmp

Filesize
4.0MB

Download
memory/1660-259-0x00007FF6D9E30000-0x00007FF6DA226000-memory.dmp

Filesize
4.0MB

Download
memory/1944-82-0x000001FC21750000-0x000001FC21EF6000-memory.dmp

Filesize
7.6MB

Download
memory/1944-12-0x00007FF947470000-0x00007FF947F31000-memory.dmp

Filesize
10.8MB

Download
memory/1944-35-0x00007FF947470000-0x00007FF947F31000-memory.dmp

Filesize
10.8MB

Download
memory/1944-2107-0x00007FF947473000-0x00007FF947475000-memory.dmp

Filesize
8KB

Download
memory/1944-32-0x000001FC20720000-0x000001FC20742000-memory.dmp

Filesize
136KB

Download
memory/1944-3-0x00007FF947473000-0x00007FF947475000-memory.dmp

Filesize
8KB

Download
memory/2044-2121-0x00007FF68BD90000-0x00007FF68C186000-memory.dmp

Filesize
4.0MB

Download
memory/2044-63-0x00007FF68BD90000-0x00007FF68C186000-memory.dmp

Filesize
4.0MB

Download
memory/2416-2118-0x00007FF6E2FF0000-0x00007FF6E33E6000-memory.dmp

Filesize
4.0MB

Download
memory/2416-75-0x00007FF6E2FF0000-0x00007FF6E33E6000-memory.dmp

Filesize
4.0MB

Download
memory/2512-2123-0x00007FF662820000-0x00007FF662C16000-memory.dmp

Filesize
4.0MB

Download
memory/2512-2108-0x00007FF662820000-0x00007FF662C16000-memory.dmp

Filesize
4.0MB

Download
memory/2512-67-0x00007FF662820000-0x00007FF662C16000-memory.dmp

Filesize
4.0MB

Download
memory/2688-52-0x00007FF75DE90000-0x00007FF75E286000-memory.dmp

Filesize
4.0MB

Download
memory/2688-2119-0x00007FF75DE90000-0x00007FF75E286000-memory.dmp

Filesize
4.0MB

Download
memory/2744-2111-0x00007FF6CD370000-0x00007FF6CD766000-memory.dmp

Filesize
4.0MB

Download
memory/2744-193-0x00007FF6CD370000-0x00007FF6CD766000-memory.dmp

Filesize
4.0MB

Download
memory/2980-258-0x00007FF7EABF0000-0x00007FF7EAFE6000-memory.dmp

Filesize
4.0MB

Download
memory/2980-2705-0x00007FF7EABF0000-0x00007FF7EAFE6000-memory.dmp

Filesize
4.0MB

Download
memory/3144-2125-0x00007FF7CA0E0000-0x00007FF7CA4D6000-memory.dmp

Filesize
4.0MB

Download
memory/3144-80-0x00007FF7CA0E0000-0x00007FF7CA4D6000-memory.dmp

Filesize
4.0MB

Download
memory/3364-46-0x00007FF646840000-0x00007FF646C36000-memory.dmp

Filesize
4.0MB

Download
memory/3364-2117-0x00007FF646840000-0x00007FF646C36000-memory.dmp

Filesize
4.0MB

Download
memory/3748-2676-0x00007FF6A7E40000-0x00007FF6A8236000-memory.dmp

Filesize
4.0MB

Download
memory/3748-2114-0x00007FF6A7E40000-0x00007FF6A8236000-memory.dmp

Filesize
4.0MB

Download
memory/3748-126-0x00007FF6A7E40000-0x00007FF6A8236000-memory.dmp

Filesize
4.0MB

Download
memory/3924-2130-0x00007FF7EBEE0000-0x00007FF7EC2D6000-memory.dmp

Filesize
4.0MB

Download
memory/3924-81-0x00007FF7EBEE0000-0x00007FF7EC2D6000-memory.dmp

Filesize
4.0MB

Download
memory/4056-251-0x00007FF6F2C50000-0x00007FF6F3046000-memory.dmp

Filesize
4.0MB

Download
memory/4080-2112-0x00007FF6BFE60000-0x00007FF6C0256000-memory.dmp

Filesize
4.0MB

Download
memory/4080-211-0x00007FF6BFE60000-0x00007FF6C0256000-memory.dmp

Filesize
4.0MB

Download
memory/4168-2120-0x00007FF6587A0000-0x00007FF658B96000-memory.dmp

Filesize
4.0MB

Download
memory/4168-78-0x00007FF6587A0000-0x00007FF658B96000-memory.dmp

Filesize
4.0MB

Download
memory/4324-0-0x00007FF7D9050000-0x00007FF7D9446000-memory.dmp

Filesize
4.0MB

Download
memory/4324-1-0x00000196D47F0000-0x00000196D4800000-memory.dmp

Filesize
64KB

Download
memory/4324-2105-0x00007FF7D9050000-0x00007FF7D9446000-memory.dmp

Filesize
4.0MB

Download
memory/4464-248-0x00007FF663780000-0x00007FF663B76000-memory.dmp

Filesize
4.0MB

Download
memory/4788-147-0x00007FF60A550000-0x00007FF60A946000-memory.dmp

Filesize
4.0MB

Download
memory/4788-2109-0x00007FF60A550000-0x00007FF60A946000-memory.dmp

Filesize
4.0MB

Download
memory/4936-2116-0x00007FF670B00000-0x00007FF670EF6000-memory.dmp

Filesize
4.0MB

Download
memory/4936-71-0x00007FF670B00000-0x00007FF670EF6000-memory.dmp

Filesize
4.0MB

Download
memory/4964-59-0x00007FF6F5A00000-0x00007FF6F5DF6000-memory.dmp

Filesize
4.0MB

Download
memory/4964-2122-0x00007FF6F5A00000-0x00007FF6F5DF6000-memory.dmp

Filesize
4.0MB

Download
memory/5024-2113-0x00007FF7F61F0000-0x00007FF7F65E6000-memory.dmp

Filesize
4.0MB

Download
memory/5024-224-0x00007FF7F61F0000-0x00007FF7F65E6000-memory.dmp

Filesize
4.0MB

Download