xmrig | 176cecf0df21f2d1252505f864f0f30c457bb1f7f7b593f2b6caaaf9d2985806

Analysis

max time kernel
150s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
30/05/2024, 22:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6a1bd98d25a4b0cfc348f6d4a2be53f0_NeikiAnalytics.exe
Size

1.6MB
MD5

6a1bd98d25a4b0cfc348f6d4a2be53f0
SHA1

86b61eeff7defc3af1c3702464cd04cddcbed71f
SHA256

176cecf0df21f2d1252505f864f0f30c457bb1f7f7b593f2b6caaaf9d2985806
SHA512

9151f81d2e6857208bd5cc90effe90162e8fe207f51b6e2182112a6c3914bfac381e0409c9c5a8198f6ec1bd5ddcab88d0f61f8e8998b84c498653d5db5223d8
SSDEEP

24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjFkTVnfuDPFFWqreoYCB23XYp53yrVMj:Lz071uv4BPMkHC0IEFTon5388

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 32 IoCs

miner

resource	yara_rule
behavioral2/memory/772-127-0x00007FF730790000-0x00007FF730B82000-memory.dmp	xmrig
behavioral2/memory/4280-122-0x00007FF7F8490000-0x00007FF7F8882000-memory.dmp	xmrig
behavioral2/memory/4088-115-0x00007FF7FE670000-0x00007FF7FEA62000-memory.dmp	xmrig
behavioral2/memory/628-300-0x00007FF688780000-0x00007FF688B72000-memory.dmp	xmrig
behavioral2/memory/4048-299-0x00007FF7FCA60000-0x00007FF7FCE52000-memory.dmp	xmrig
behavioral2/memory/4204-301-0x00007FF7A9BF0000-0x00007FF7A9FE2000-memory.dmp	xmrig
behavioral2/memory/528-302-0x00007FF75E740000-0x00007FF75EB32000-memory.dmp	xmrig
behavioral2/memory/4728-303-0x00007FF6AE5E0000-0x00007FF6AE9D2000-memory.dmp	xmrig
behavioral2/memory/4380-79-0x00007FF6EA430000-0x00007FF6EA822000-memory.dmp	xmrig
behavioral2/memory/2664-37-0x00007FF7FB950000-0x00007FF7FBD42000-memory.dmp	xmrig
behavioral2/memory/4904-28-0x00007FF7C4420000-0x00007FF7C4812000-memory.dmp	xmrig
behavioral2/memory/3256-1386-0x00007FF7C5780000-0x00007FF7C5B72000-memory.dmp	xmrig
behavioral2/memory/3748-1387-0x00007FF6B9CC0000-0x00007FF6BA0B2000-memory.dmp	xmrig
behavioral2/memory/2016-1390-0x00007FF7D5510000-0x00007FF7D5902000-memory.dmp	xmrig
behavioral2/memory/4036-2345-0x00007FF77DD80000-0x00007FF77E172000-memory.dmp	xmrig
behavioral2/memory/2728-2357-0x00007FF7E5A40000-0x00007FF7E5E32000-memory.dmp	xmrig
behavioral2/memory/1000-2351-0x00007FF6CEA00000-0x00007FF6CEDF2000-memory.dmp	xmrig
behavioral2/memory/3076-2349-0x00007FF7F24B0000-0x00007FF7F28A2000-memory.dmp	xmrig
behavioral2/memory/732-2667-0x00007FF6E8860000-0x00007FF6E8C52000-memory.dmp	xmrig
behavioral2/memory/3936-2913-0x00007FF60F1C0000-0x00007FF60F5B2000-memory.dmp	xmrig
behavioral2/memory/4760-2915-0x00007FF6CED00000-0x00007FF6CF0F2000-memory.dmp	xmrig
behavioral2/memory/4116-4066-0x00007FF64B9A0000-0x00007FF64BD92000-memory.dmp	xmrig
behavioral2/memory/4088-4509-0x00007FF7FE670000-0x00007FF7FEA62000-memory.dmp	xmrig
behavioral2/memory/4280-4513-0x00007FF7F8490000-0x00007FF7F8882000-memory.dmp	xmrig
behavioral2/memory/772-4519-0x00007FF730790000-0x00007FF730B82000-memory.dmp	xmrig
behavioral2/memory/4116-4526-0x00007FF64B9A0000-0x00007FF64BD92000-memory.dmp	xmrig
behavioral2/memory/3104-4529-0x00007FF61A9F0000-0x00007FF61ADE2000-memory.dmp	xmrig
behavioral2/memory/628-4650-0x00007FF688780000-0x00007FF688B72000-memory.dmp	xmrig
behavioral2/memory/4204-4653-0x00007FF7A9BF0000-0x00007FF7A9FE2000-memory.dmp	xmrig
behavioral2/memory/528-4658-0x00007FF75E740000-0x00007FF75EB32000-memory.dmp	xmrig
behavioral2/memory/4728-4660-0x00007FF6AE5E0000-0x00007FF6AE9D2000-memory.dmp	xmrig
behavioral2/memory/2196-4950-0x00007FF6D7DD0000-0x00007FF6D81C2000-memory.dmp	xmrig

Blocklisted process makes network request 2 IoCs

flow	pid	Process
8	760	powershell.exe
10	760	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
760	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
3748	rReHASK.exe
2016	DsDPVBH.exe
4904	HnVBXig.exe
2664	eEuLKtw.exe
4036	zveAWDO.exe
4048	EMRPVps.exe
3076	rBAYwZX.exe
1000	QZbSMcL.exe
4380	BidSvmZ.exe
732	bUgoFps.exe
2728	cfAOIUZ.exe
4760	LfjXHUm.exe
3936	cyTBExw.exe
3712	bxHQWls.exe
4088	nMAFmpG.exe
4280	futdxck.exe
2196	jaDYwHA.exe
772	fNCAUHr.exe
3104	ylroFNk.exe
4116	xnMtXwd.exe
628	lCWCKMv.exe
4204	jBeNdjb.exe
528	wPTPJNa.exe
4728	XsCkuYf.exe
2300	HoikZra.exe
1540	dpGbiEG.exe
1576	tItvRWw.exe
836	YTogQtY.exe
912	HuYNhKa.exe
5016	WLFblsw.exe
3588	Vzskgeu.exe
4352	ZurkQoW.exe
4708	OhAsUnA.exe
3584	DhYjHgs.exe
4244	zFtnqAm.exe
540	AzQYfvy.exe
2240	XxufrpS.exe
2416	oqGOsLE.exe
4600	uSWMZHY.exe
1492	yITWwlb.exe
2408	DnkrSBa.exe
4544	isyHcBj.exe
2412	fxUGMoL.exe
2580	nLQGWus.exe
4504	TZItyfx.exe
4960	LRkWplB.exe
3576	fbqSIVP.exe
3344	luDIGsw.exe
4840	pWbKbGH.exe
3956	qYDJFsc.exe
3644	apatmFs.exe
5032	MxwKZjD.exe
2428	ZxYKIwE.exe
372	yaWtmgw.exe
3092	tYRvUKC.exe
4564	YhvWhUy.exe
4080	caUYTjB.exe
4332	wWbblYN.exe
3060	AGrnpya.exe
1464	bRQibsL.exe
3848	VQRrimF.exe
2332	YbuWucI.exe
3108	wBItuUp.exe
2212	HUXcuFP.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3256-0-0x00007FF7C5780000-0x00007FF7C5B72000-memory.dmp	upx
behavioral2/files/0x0007000000023433-7.dat	upx
behavioral2/files/0x000800000002342f-10.dat	upx
behavioral2/files/0x000800000002342c-13.dat	upx
behavioral2/files/0x0007000000023435-29.dat	upx
behavioral2/files/0x0007000000023436-30.dat	upx
behavioral2/files/0x0007000000023438-44.dat	upx
behavioral2/memory/1000-65-0x00007FF6CEA00000-0x00007FF6CEDF2000-memory.dmp	upx
behavioral2/files/0x000700000002343e-80.dat	upx
behavioral2/files/0x000700000002343a-83.dat	upx
behavioral2/files/0x0008000000023430-94.dat	upx
behavioral2/files/0x000800000002343c-98.dat	upx
behavioral2/files/0x0007000000023440-105.dat	upx
behavioral2/files/0x0007000000023441-112.dat	upx
behavioral2/files/0x000800000002343b-119.dat	upx
behavioral2/memory/4116-128-0x00007FF64B9A0000-0x00007FF64BD92000-memory.dmp	upx
behavioral2/memory/3104-133-0x00007FF61A9F0000-0x00007FF61ADE2000-memory.dmp	upx
behavioral2/files/0x0007000000023442-131.dat	upx
behavioral2/files/0x0007000000023443-129.dat	upx
behavioral2/memory/772-127-0x00007FF730790000-0x00007FF730B82000-memory.dmp	upx
behavioral2/memory/4280-122-0x00007FF7F8490000-0x00007FF7F8882000-memory.dmp	upx
behavioral2/memory/4088-115-0x00007FF7FE670000-0x00007FF7FEA62000-memory.dmp	upx
behavioral2/memory/2196-110-0x00007FF6D7DD0000-0x00007FF6D81C2000-memory.dmp	upx
behavioral2/files/0x0007000000023444-141.dat	upx
behavioral2/files/0x0007000000023445-147.dat	upx
behavioral2/files/0x000700000002344d-181.dat	upx
behavioral2/memory/628-300-0x00007FF688780000-0x00007FF688B72000-memory.dmp	upx
behavioral2/memory/4048-299-0x00007FF7FCA60000-0x00007FF7FCE52000-memory.dmp	upx
behavioral2/files/0x0007000000023450-196.dat	upx
behavioral2/files/0x000700000002344e-194.dat	upx
behavioral2/files/0x000700000002344f-191.dat	upx
behavioral2/files/0x000700000002344c-184.dat	upx
behavioral2/files/0x000700000002344b-179.dat	upx
behavioral2/files/0x000700000002344a-174.dat	upx
behavioral2/memory/4204-301-0x00007FF7A9BF0000-0x00007FF7A9FE2000-memory.dmp	upx
behavioral2/files/0x0007000000023449-166.dat	upx
behavioral2/memory/528-302-0x00007FF75E740000-0x00007FF75EB32000-memory.dmp	upx
behavioral2/memory/4728-303-0x00007FF6AE5E0000-0x00007FF6AE9D2000-memory.dmp	upx
behavioral2/files/0x0007000000023448-162.dat	upx
behavioral2/files/0x0007000000023447-157.dat	upx
behavioral2/files/0x0007000000023446-152.dat	upx
behavioral2/memory/3712-103-0x00007FF6F99A0000-0x00007FF6F9D92000-memory.dmp	upx
behavioral2/memory/4760-97-0x00007FF6CED00000-0x00007FF6CF0F2000-memory.dmp	upx
behavioral2/files/0x000700000002343f-91.dat	upx
behavioral2/files/0x000700000002343d-88.dat	upx
behavioral2/memory/3936-87-0x00007FF60F1C0000-0x00007FF60F5B2000-memory.dmp	upx
behavioral2/memory/732-82-0x00007FF6E8860000-0x00007FF6E8C52000-memory.dmp	upx
behavioral2/memory/4380-79-0x00007FF6EA430000-0x00007FF6EA822000-memory.dmp	upx
behavioral2/memory/2728-75-0x00007FF7E5A40000-0x00007FF7E5E32000-memory.dmp	upx
behavioral2/files/0x0007000000023439-71.dat	upx
behavioral2/files/0x0007000000023437-50.dat	upx
behavioral2/memory/3076-47-0x00007FF7F24B0000-0x00007FF7F28A2000-memory.dmp	upx
behavioral2/memory/4036-41-0x00007FF77DD80000-0x00007FF77E172000-memory.dmp	upx
behavioral2/memory/2664-37-0x00007FF7FB950000-0x00007FF7FBD42000-memory.dmp	upx
behavioral2/files/0x0007000000023434-31.dat	upx
behavioral2/memory/4048-35-0x00007FF7FCA60000-0x00007FF7FCE52000-memory.dmp	upx
behavioral2/memory/4904-28-0x00007FF7C4420000-0x00007FF7C4812000-memory.dmp	upx
behavioral2/memory/2016-22-0x00007FF7D5510000-0x00007FF7D5902000-memory.dmp	upx
behavioral2/memory/3748-17-0x00007FF6B9CC0000-0x00007FF6BA0B2000-memory.dmp	upx
behavioral2/memory/3256-1386-0x00007FF7C5780000-0x00007FF7C5B72000-memory.dmp	upx
behavioral2/memory/3748-1387-0x00007FF6B9CC0000-0x00007FF6BA0B2000-memory.dmp	upx
behavioral2/memory/2016-1390-0x00007FF7D5510000-0x00007FF7D5902000-memory.dmp	upx
behavioral2/memory/4036-2345-0x00007FF77DD80000-0x00007FF77E172000-memory.dmp	upx
behavioral2/memory/2728-2357-0x00007FF7E5A40000-0x00007FF7E5E32000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
7	raw.githubusercontent.com
8	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\HUxVWJP.exe	6a1bd98d25a4b0cfc348f6d4a2be53f0_NeikiAnalytics.exe
File created	C:\Windows\System\XkBdqwP.exe	6a1bd98d25a4b0cfc348f6d4a2be53f0_NeikiAnalytics.exe
File created	C:\Windows\System\wVfseNX.exe	6a1bd98d25a4b0cfc348f6d4a2be53f0_NeikiAnalytics.exe
File created	C:\Windows\System\chcOTYK.exe	6a1bd98d25a4b0cfc348f6d4a2be53f0_NeikiAnalytics.exe
File created	C:\Windows\System\VuzFTLP.exe	6a1bd98d25a4b0cfc348f6d4a2be53f0_NeikiAnalytics.exe
File created	C:\Windows\System\kRUelQO.exe	6a1bd98d25a4b0cfc348f6d4a2be53f0_NeikiAnalytics.exe
File created	C:\Windows\System\ZpUrsID.exe	6a1bd98d25a4b0cfc348f6d4a2be53f0_NeikiAnalytics.exe
File created	C:\Windows\System\VVWfhOv.exe	6a1bd98d25a4b0cfc348f6d4a2be53f0_NeikiAnalytics.exe
File created	C:\Windows\System\UZeLXcS.exe	6a1bd98d25a4b0cfc348f6d4a2be53f0_NeikiAnalytics.exe
File created	C:\Windows\System\HbqvwBv.exe	6a1bd98d25a4b0cfc348f6d4a2be53f0_NeikiAnalytics.exe
File created	C:\Windows\System\lcpJyNy.exe	6a1bd98d25a4b0cfc348f6d4a2be53f0_NeikiAnalytics.exe
File created	C:\Windows\System\AMuGoUk.exe	6a1bd98d25a4b0cfc348f6d4a2be53f0_NeikiAnalytics.exe
File created	C:\Windows\System\TMwwTnJ.exe	6a1bd98d25a4b0cfc348f6d4a2be53f0_NeikiAnalytics.exe
File created	C:\Windows\System\CidShBT.exe	6a1bd98d25a4b0cfc348f6d4a2be53f0_NeikiAnalytics.exe
File created	C:\Windows\System\NHXNipB.exe	6a1bd98d25a4b0cfc348f6d4a2be53f0_NeikiAnalytics.exe
File created	C:\Windows\System\WYnBvAm.exe	6a1bd98d25a4b0cfc348f6d4a2be53f0_NeikiAnalytics.exe
File created	C:\Windows\System\lHBaBZv.exe	6a1bd98d25a4b0cfc348f6d4a2be53f0_NeikiAnalytics.exe
File created	C:\Windows\System\tLlrVnr.exe	6a1bd98d25a4b0cfc348f6d4a2be53f0_NeikiAnalytics.exe
File created	C:\Windows\System\uEKPRsQ.exe	6a1bd98d25a4b0cfc348f6d4a2be53f0_NeikiAnalytics.exe
File created	C:\Windows\System\uiVRuZY.exe	6a1bd98d25a4b0cfc348f6d4a2be53f0_NeikiAnalytics.exe
File created	C:\Windows\System\vQRhHzf.exe	6a1bd98d25a4b0cfc348f6d4a2be53f0_NeikiAnalytics.exe
File created	C:\Windows\System\zrLntNq.exe	6a1bd98d25a4b0cfc348f6d4a2be53f0_NeikiAnalytics.exe
File created	C:\Windows\System\EeJALVn.exe	6a1bd98d25a4b0cfc348f6d4a2be53f0_NeikiAnalytics.exe
File created	C:\Windows\System\VldJgaO.exe	6a1bd98d25a4b0cfc348f6d4a2be53f0_NeikiAnalytics.exe
File created	C:\Windows\System\MDQpvNP.exe	6a1bd98d25a4b0cfc348f6d4a2be53f0_NeikiAnalytics.exe
File created	C:\Windows\System\VEEPqwc.exe	6a1bd98d25a4b0cfc348f6d4a2be53f0_NeikiAnalytics.exe
File created	C:\Windows\System\oTtQtPp.exe	6a1bd98d25a4b0cfc348f6d4a2be53f0_NeikiAnalytics.exe
File created	C:\Windows\System\qbUZgoI.exe	6a1bd98d25a4b0cfc348f6d4a2be53f0_NeikiAnalytics.exe
File created	C:\Windows\System\TETmCNd.exe	6a1bd98d25a4b0cfc348f6d4a2be53f0_NeikiAnalytics.exe
File created	C:\Windows\System\wNuAypK.exe	6a1bd98d25a4b0cfc348f6d4a2be53f0_NeikiAnalytics.exe
File created	C:\Windows\System\MeYvplZ.exe	6a1bd98d25a4b0cfc348f6d4a2be53f0_NeikiAnalytics.exe
File created	C:\Windows\System\TjKOvQp.exe	6a1bd98d25a4b0cfc348f6d4a2be53f0_NeikiAnalytics.exe
File created	C:\Windows\System\lvbpKNp.exe	6a1bd98d25a4b0cfc348f6d4a2be53f0_NeikiAnalytics.exe
File created	C:\Windows\System\GVjhJyz.exe	6a1bd98d25a4b0cfc348f6d4a2be53f0_NeikiAnalytics.exe
File created	C:\Windows\System\bHmQLzA.exe	6a1bd98d25a4b0cfc348f6d4a2be53f0_NeikiAnalytics.exe
File created	C:\Windows\System\yNdQxJN.exe	6a1bd98d25a4b0cfc348f6d4a2be53f0_NeikiAnalytics.exe
File created	C:\Windows\System\zdLEIBu.exe	6a1bd98d25a4b0cfc348f6d4a2be53f0_NeikiAnalytics.exe
File created	C:\Windows\System\IqacEBT.exe	6a1bd98d25a4b0cfc348f6d4a2be53f0_NeikiAnalytics.exe
File created	C:\Windows\System\tQIFGue.exe	6a1bd98d25a4b0cfc348f6d4a2be53f0_NeikiAnalytics.exe
File created	C:\Windows\System\jNkBgFY.exe	6a1bd98d25a4b0cfc348f6d4a2be53f0_NeikiAnalytics.exe
File created	C:\Windows\System\epKsYQx.exe	6a1bd98d25a4b0cfc348f6d4a2be53f0_NeikiAnalytics.exe
File created	C:\Windows\System\VPAhgsr.exe	6a1bd98d25a4b0cfc348f6d4a2be53f0_NeikiAnalytics.exe
File created	C:\Windows\System\GXqBQqo.exe	6a1bd98d25a4b0cfc348f6d4a2be53f0_NeikiAnalytics.exe
File created	C:\Windows\System\cpvomlC.exe	6a1bd98d25a4b0cfc348f6d4a2be53f0_NeikiAnalytics.exe
File created	C:\Windows\System\kyIasgN.exe	6a1bd98d25a4b0cfc348f6d4a2be53f0_NeikiAnalytics.exe
File created	C:\Windows\System\ICZuFJU.exe	6a1bd98d25a4b0cfc348f6d4a2be53f0_NeikiAnalytics.exe
File created	C:\Windows\System\lBPgUnH.exe	6a1bd98d25a4b0cfc348f6d4a2be53f0_NeikiAnalytics.exe
File created	C:\Windows\System\JtiSUdY.exe	6a1bd98d25a4b0cfc348f6d4a2be53f0_NeikiAnalytics.exe
File created	C:\Windows\System\RQRWbnX.exe	6a1bd98d25a4b0cfc348f6d4a2be53f0_NeikiAnalytics.exe
File created	C:\Windows\System\pvmTqwK.exe	6a1bd98d25a4b0cfc348f6d4a2be53f0_NeikiAnalytics.exe
File created	C:\Windows\System\CXcIZnh.exe	6a1bd98d25a4b0cfc348f6d4a2be53f0_NeikiAnalytics.exe
File created	C:\Windows\System\gFTPYzA.exe	6a1bd98d25a4b0cfc348f6d4a2be53f0_NeikiAnalytics.exe
File created	C:\Windows\System\vyVnqhB.exe	6a1bd98d25a4b0cfc348f6d4a2be53f0_NeikiAnalytics.exe
File created	C:\Windows\System\BtwmICI.exe	6a1bd98d25a4b0cfc348f6d4a2be53f0_NeikiAnalytics.exe
File created	C:\Windows\System\tbeGRNo.exe	6a1bd98d25a4b0cfc348f6d4a2be53f0_NeikiAnalytics.exe
File created	C:\Windows\System\XlgOzLN.exe	6a1bd98d25a4b0cfc348f6d4a2be53f0_NeikiAnalytics.exe
File created	C:\Windows\System\LEySmAR.exe	6a1bd98d25a4b0cfc348f6d4a2be53f0_NeikiAnalytics.exe
File created	C:\Windows\System\Loubzuy.exe	6a1bd98d25a4b0cfc348f6d4a2be53f0_NeikiAnalytics.exe
File created	C:\Windows\System\DrXQcqF.exe	6a1bd98d25a4b0cfc348f6d4a2be53f0_NeikiAnalytics.exe
File created	C:\Windows\System\InIwvio.exe	6a1bd98d25a4b0cfc348f6d4a2be53f0_NeikiAnalytics.exe
File created	C:\Windows\System\KPSxshj.exe	6a1bd98d25a4b0cfc348f6d4a2be53f0_NeikiAnalytics.exe
File created	C:\Windows\System\VmhjOAq.exe	6a1bd98d25a4b0cfc348f6d4a2be53f0_NeikiAnalytics.exe
File created	C:\Windows\System\OeGQCSs.exe	6a1bd98d25a4b0cfc348f6d4a2be53f0_NeikiAnalytics.exe
File created	C:\Windows\System\hFtvmwu.exe	6a1bd98d25a4b0cfc348f6d4a2be53f0_NeikiAnalytics.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
760	powershell.exe
760	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	760	powershell.exe
Token: SeLockMemoryPrivilege	3256	6a1bd98d25a4b0cfc348f6d4a2be53f0_NeikiAnalytics.exe
Token: SeLockMemoryPrivilege	3256	6a1bd98d25a4b0cfc348f6d4a2be53f0_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3256 wrote to memory of 760	3256	6a1bd98d25a4b0cfc348f6d4a2be53f0_NeikiAnalytics.exe	83
PID 3256 wrote to memory of 760	3256	6a1bd98d25a4b0cfc348f6d4a2be53f0_NeikiAnalytics.exe	83
PID 3256 wrote to memory of 3748	3256	6a1bd98d25a4b0cfc348f6d4a2be53f0_NeikiAnalytics.exe	84
PID 3256 wrote to memory of 3748	3256	6a1bd98d25a4b0cfc348f6d4a2be53f0_NeikiAnalytics.exe	84
PID 3256 wrote to memory of 2016	3256	6a1bd98d25a4b0cfc348f6d4a2be53f0_NeikiAnalytics.exe	85
PID 3256 wrote to memory of 2016	3256	6a1bd98d25a4b0cfc348f6d4a2be53f0_NeikiAnalytics.exe	85
PID 3256 wrote to memory of 4904	3256	6a1bd98d25a4b0cfc348f6d4a2be53f0_NeikiAnalytics.exe	86
PID 3256 wrote to memory of 4904	3256	6a1bd98d25a4b0cfc348f6d4a2be53f0_NeikiAnalytics.exe	86
PID 3256 wrote to memory of 2664	3256	6a1bd98d25a4b0cfc348f6d4a2be53f0_NeikiAnalytics.exe	87
PID 3256 wrote to memory of 2664	3256	6a1bd98d25a4b0cfc348f6d4a2be53f0_NeikiAnalytics.exe	87
PID 3256 wrote to memory of 4036	3256	6a1bd98d25a4b0cfc348f6d4a2be53f0_NeikiAnalytics.exe	88
PID 3256 wrote to memory of 4036	3256	6a1bd98d25a4b0cfc348f6d4a2be53f0_NeikiAnalytics.exe	88
PID 3256 wrote to memory of 4048	3256	6a1bd98d25a4b0cfc348f6d4a2be53f0_NeikiAnalytics.exe	89
PID 3256 wrote to memory of 4048	3256	6a1bd98d25a4b0cfc348f6d4a2be53f0_NeikiAnalytics.exe	89
PID 3256 wrote to memory of 3076	3256	6a1bd98d25a4b0cfc348f6d4a2be53f0_NeikiAnalytics.exe	90
PID 3256 wrote to memory of 3076	3256	6a1bd98d25a4b0cfc348f6d4a2be53f0_NeikiAnalytics.exe	90
PID 3256 wrote to memory of 1000	3256	6a1bd98d25a4b0cfc348f6d4a2be53f0_NeikiAnalytics.exe	91
PID 3256 wrote to memory of 1000	3256	6a1bd98d25a4b0cfc348f6d4a2be53f0_NeikiAnalytics.exe	91
PID 3256 wrote to memory of 4380	3256	6a1bd98d25a4b0cfc348f6d4a2be53f0_NeikiAnalytics.exe	92
PID 3256 wrote to memory of 4380	3256	6a1bd98d25a4b0cfc348f6d4a2be53f0_NeikiAnalytics.exe	92
PID 3256 wrote to memory of 732	3256	6a1bd98d25a4b0cfc348f6d4a2be53f0_NeikiAnalytics.exe	93
PID 3256 wrote to memory of 732	3256	6a1bd98d25a4b0cfc348f6d4a2be53f0_NeikiAnalytics.exe	93
PID 3256 wrote to memory of 2728	3256	6a1bd98d25a4b0cfc348f6d4a2be53f0_NeikiAnalytics.exe	94
PID 3256 wrote to memory of 2728	3256	6a1bd98d25a4b0cfc348f6d4a2be53f0_NeikiAnalytics.exe	94
PID 3256 wrote to memory of 4760	3256	6a1bd98d25a4b0cfc348f6d4a2be53f0_NeikiAnalytics.exe	95
PID 3256 wrote to memory of 4760	3256	6a1bd98d25a4b0cfc348f6d4a2be53f0_NeikiAnalytics.exe	95
PID 3256 wrote to memory of 3936	3256	6a1bd98d25a4b0cfc348f6d4a2be53f0_NeikiAnalytics.exe	96
PID 3256 wrote to memory of 3936	3256	6a1bd98d25a4b0cfc348f6d4a2be53f0_NeikiAnalytics.exe	96
PID 3256 wrote to memory of 3712	3256	6a1bd98d25a4b0cfc348f6d4a2be53f0_NeikiAnalytics.exe	97
PID 3256 wrote to memory of 3712	3256	6a1bd98d25a4b0cfc348f6d4a2be53f0_NeikiAnalytics.exe	97
PID 3256 wrote to memory of 4088	3256	6a1bd98d25a4b0cfc348f6d4a2be53f0_NeikiAnalytics.exe	98
PID 3256 wrote to memory of 4088	3256	6a1bd98d25a4b0cfc348f6d4a2be53f0_NeikiAnalytics.exe	98
PID 3256 wrote to memory of 4280	3256	6a1bd98d25a4b0cfc348f6d4a2be53f0_NeikiAnalytics.exe	99
PID 3256 wrote to memory of 4280	3256	6a1bd98d25a4b0cfc348f6d4a2be53f0_NeikiAnalytics.exe	99
PID 3256 wrote to memory of 2196	3256	6a1bd98d25a4b0cfc348f6d4a2be53f0_NeikiAnalytics.exe	100
PID 3256 wrote to memory of 2196	3256	6a1bd98d25a4b0cfc348f6d4a2be53f0_NeikiAnalytics.exe	100
PID 3256 wrote to memory of 772	3256	6a1bd98d25a4b0cfc348f6d4a2be53f0_NeikiAnalytics.exe	101
PID 3256 wrote to memory of 772	3256	6a1bd98d25a4b0cfc348f6d4a2be53f0_NeikiAnalytics.exe	101
PID 3256 wrote to memory of 4116	3256	6a1bd98d25a4b0cfc348f6d4a2be53f0_NeikiAnalytics.exe	102
PID 3256 wrote to memory of 4116	3256	6a1bd98d25a4b0cfc348f6d4a2be53f0_NeikiAnalytics.exe	102
PID 3256 wrote to memory of 3104	3256	6a1bd98d25a4b0cfc348f6d4a2be53f0_NeikiAnalytics.exe	103
PID 3256 wrote to memory of 3104	3256	6a1bd98d25a4b0cfc348f6d4a2be53f0_NeikiAnalytics.exe	103
PID 3256 wrote to memory of 628	3256	6a1bd98d25a4b0cfc348f6d4a2be53f0_NeikiAnalytics.exe	104
PID 3256 wrote to memory of 628	3256	6a1bd98d25a4b0cfc348f6d4a2be53f0_NeikiAnalytics.exe	104
PID 3256 wrote to memory of 4204	3256	6a1bd98d25a4b0cfc348f6d4a2be53f0_NeikiAnalytics.exe	105
PID 3256 wrote to memory of 4204	3256	6a1bd98d25a4b0cfc348f6d4a2be53f0_NeikiAnalytics.exe	105
PID 3256 wrote to memory of 528	3256	6a1bd98d25a4b0cfc348f6d4a2be53f0_NeikiAnalytics.exe	106
PID 3256 wrote to memory of 528	3256	6a1bd98d25a4b0cfc348f6d4a2be53f0_NeikiAnalytics.exe	106
PID 3256 wrote to memory of 4728	3256	6a1bd98d25a4b0cfc348f6d4a2be53f0_NeikiAnalytics.exe	107
PID 3256 wrote to memory of 4728	3256	6a1bd98d25a4b0cfc348f6d4a2be53f0_NeikiAnalytics.exe	107
PID 3256 wrote to memory of 2300	3256	6a1bd98d25a4b0cfc348f6d4a2be53f0_NeikiAnalytics.exe	108
PID 3256 wrote to memory of 2300	3256	6a1bd98d25a4b0cfc348f6d4a2be53f0_NeikiAnalytics.exe	108
PID 3256 wrote to memory of 1540	3256	6a1bd98d25a4b0cfc348f6d4a2be53f0_NeikiAnalytics.exe	109
PID 3256 wrote to memory of 1540	3256	6a1bd98d25a4b0cfc348f6d4a2be53f0_NeikiAnalytics.exe	109
PID 3256 wrote to memory of 1576	3256	6a1bd98d25a4b0cfc348f6d4a2be53f0_NeikiAnalytics.exe	110
PID 3256 wrote to memory of 1576	3256	6a1bd98d25a4b0cfc348f6d4a2be53f0_NeikiAnalytics.exe	110
PID 3256 wrote to memory of 836	3256	6a1bd98d25a4b0cfc348f6d4a2be53f0_NeikiAnalytics.exe	111
PID 3256 wrote to memory of 836	3256	6a1bd98d25a4b0cfc348f6d4a2be53f0_NeikiAnalytics.exe	111
PID 3256 wrote to memory of 912	3256	6a1bd98d25a4b0cfc348f6d4a2be53f0_NeikiAnalytics.exe	112
PID 3256 wrote to memory of 912	3256	6a1bd98d25a4b0cfc348f6d4a2be53f0_NeikiAnalytics.exe	112
PID 3256 wrote to memory of 5016	3256	6a1bd98d25a4b0cfc348f6d4a2be53f0_NeikiAnalytics.exe	113
PID 3256 wrote to memory of 5016	3256	6a1bd98d25a4b0cfc348f6d4a2be53f0_NeikiAnalytics.exe	113
PID 3256 wrote to memory of 3588	3256	6a1bd98d25a4b0cfc348f6d4a2be53f0_NeikiAnalytics.exe	114
PID 3256 wrote to memory of 3588	3256	6a1bd98d25a4b0cfc348f6d4a2be53f0_NeikiAnalytics.exe	114

C:\Users\Admin\AppData\Local\Temp\6a1bd98d25a4b0cfc348f6d4a2be53f0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\6a1bd98d25a4b0cfc348f6d4a2be53f0_NeikiAnalytics.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3256
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:760
- C:\Windows\System\rReHASK.exe
  C:\Windows\System\rReHASK.exe
  2⤵
  - Executes dropped EXE
  PID:3748
- C:\Windows\System\DsDPVBH.exe
  C:\Windows\System\DsDPVBH.exe
  2⤵
  - Executes dropped EXE
  PID:2016
- C:\Windows\System\HnVBXig.exe
  C:\Windows\System\HnVBXig.exe
  2⤵
  - Executes dropped EXE
  PID:4904
- C:\Windows\System\eEuLKtw.exe
  C:\Windows\System\eEuLKtw.exe
  2⤵
  - Executes dropped EXE
  PID:2664
- C:\Windows\System\zveAWDO.exe
  C:\Windows\System\zveAWDO.exe
  2⤵
  - Executes dropped EXE
  PID:4036
- C:\Windows\System\EMRPVps.exe
  C:\Windows\System\EMRPVps.exe
  2⤵
  - Executes dropped EXE
  PID:4048
- C:\Windows\System\rBAYwZX.exe
  C:\Windows\System\rBAYwZX.exe
  2⤵
  - Executes dropped EXE
  PID:3076
- C:\Windows\System\QZbSMcL.exe
  C:\Windows\System\QZbSMcL.exe
  2⤵
  - Executes dropped EXE
  PID:1000
- C:\Windows\System\BidSvmZ.exe
  C:\Windows\System\BidSvmZ.exe
  2⤵
  - Executes dropped EXE
  PID:4380
- C:\Windows\System\bUgoFps.exe
  C:\Windows\System\bUgoFps.exe
  2⤵
  - Executes dropped EXE
  PID:732
- C:\Windows\System\cfAOIUZ.exe
  C:\Windows\System\cfAOIUZ.exe
  2⤵
  - Executes dropped EXE
  PID:2728
- C:\Windows\System\LfjXHUm.exe
  C:\Windows\System\LfjXHUm.exe
  2⤵
  - Executes dropped EXE
  PID:4760
- C:\Windows\System\cyTBExw.exe
  C:\Windows\System\cyTBExw.exe
  2⤵
  - Executes dropped EXE
  PID:3936
- C:\Windows\System\bxHQWls.exe
  C:\Windows\System\bxHQWls.exe
  2⤵
  - Executes dropped EXE
  PID:3712
- C:\Windows\System\nMAFmpG.exe
  C:\Windows\System\nMAFmpG.exe
  2⤵
  - Executes dropped EXE
  PID:4088
- C:\Windows\System\futdxck.exe
  C:\Windows\System\futdxck.exe
  2⤵
  - Executes dropped EXE
  PID:4280
- C:\Windows\System\jaDYwHA.exe
  C:\Windows\System\jaDYwHA.exe
  2⤵
  - Executes dropped EXE
  PID:2196
- C:\Windows\System\fNCAUHr.exe
  C:\Windows\System\fNCAUHr.exe
  2⤵
  - Executes dropped EXE
  PID:772
- C:\Windows\System\xnMtXwd.exe
  C:\Windows\System\xnMtXwd.exe
  2⤵
  - Executes dropped EXE
  PID:4116
- C:\Windows\System\ylroFNk.exe
  C:\Windows\System\ylroFNk.exe
  2⤵
  - Executes dropped EXE
  PID:3104
- C:\Windows\System\lCWCKMv.exe
  C:\Windows\System\lCWCKMv.exe
  2⤵
  - Executes dropped EXE
  PID:628
- C:\Windows\System\jBeNdjb.exe
  C:\Windows\System\jBeNdjb.exe
  2⤵
  - Executes dropped EXE
  PID:4204
- C:\Windows\System\wPTPJNa.exe
  C:\Windows\System\wPTPJNa.exe
  2⤵
  - Executes dropped EXE
  PID:528
- C:\Windows\System\XsCkuYf.exe
  C:\Windows\System\XsCkuYf.exe
  2⤵
  - Executes dropped EXE
  PID:4728
- C:\Windows\System\HoikZra.exe
  C:\Windows\System\HoikZra.exe
  2⤵
  - Executes dropped EXE
  PID:2300
- C:\Windows\System\dpGbiEG.exe
  C:\Windows\System\dpGbiEG.exe
  2⤵
  - Executes dropped EXE
  PID:1540
- C:\Windows\System\tItvRWw.exe
  C:\Windows\System\tItvRWw.exe
  2⤵
  - Executes dropped EXE
  PID:1576
- C:\Windows\System\YTogQtY.exe
  C:\Windows\System\YTogQtY.exe
  2⤵
  - Executes dropped EXE
  PID:836
- C:\Windows\System\HuYNhKa.exe
  C:\Windows\System\HuYNhKa.exe
  2⤵
  - Executes dropped EXE
  PID:912
- C:\Windows\System\WLFblsw.exe
  C:\Windows\System\WLFblsw.exe
  2⤵
  - Executes dropped EXE
  PID:5016
- C:\Windows\System\Vzskgeu.exe
  C:\Windows\System\Vzskgeu.exe
  2⤵
  - Executes dropped EXE
  PID:3588
- C:\Windows\System\ZurkQoW.exe
  C:\Windows\System\ZurkQoW.exe
  2⤵
  - Executes dropped EXE
  PID:4352
- C:\Windows\System\OhAsUnA.exe
  C:\Windows\System\OhAsUnA.exe
  2⤵
  - Executes dropped EXE
  PID:4708
- C:\Windows\System\DhYjHgs.exe
  C:\Windows\System\DhYjHgs.exe
  2⤵
  - Executes dropped EXE
  PID:3584
- C:\Windows\System\zFtnqAm.exe
  C:\Windows\System\zFtnqAm.exe
  2⤵
  - Executes dropped EXE
  PID:4244
- C:\Windows\System\AzQYfvy.exe
  C:\Windows\System\AzQYfvy.exe
  2⤵
  - Executes dropped EXE
  PID:540
- C:\Windows\System\XxufrpS.exe
  C:\Windows\System\XxufrpS.exe
  2⤵
  - Executes dropped EXE
  PID:2240
- C:\Windows\System\oqGOsLE.exe
  C:\Windows\System\oqGOsLE.exe
  2⤵
  - Executes dropped EXE
  PID:2416
- C:\Windows\System\uSWMZHY.exe
  C:\Windows\System\uSWMZHY.exe
  2⤵
  - Executes dropped EXE
  PID:4600
- C:\Windows\System\yITWwlb.exe
  C:\Windows\System\yITWwlb.exe
  2⤵
  - Executes dropped EXE
  PID:1492
- C:\Windows\System\DnkrSBa.exe
  C:\Windows\System\DnkrSBa.exe
  2⤵
  - Executes dropped EXE
  PID:2408
- C:\Windows\System\isyHcBj.exe
  C:\Windows\System\isyHcBj.exe
  2⤵
  - Executes dropped EXE
  PID:4544
- C:\Windows\System\fxUGMoL.exe
  C:\Windows\System\fxUGMoL.exe
  2⤵
  - Executes dropped EXE
  PID:2412
- C:\Windows\System\nLQGWus.exe
  C:\Windows\System\nLQGWus.exe
  2⤵
  - Executes dropped EXE
  PID:2580
- C:\Windows\System\TZItyfx.exe
  C:\Windows\System\TZItyfx.exe
  2⤵
  - Executes dropped EXE
  PID:4504
- C:\Windows\System\LRkWplB.exe
  C:\Windows\System\LRkWplB.exe
  2⤵
  - Executes dropped EXE
  PID:4960
- C:\Windows\System\fbqSIVP.exe
  C:\Windows\System\fbqSIVP.exe
  2⤵
  - Executes dropped EXE
  PID:3576
- C:\Windows\System\luDIGsw.exe
  C:\Windows\System\luDIGsw.exe
  2⤵
  - Executes dropped EXE
  PID:3344
- C:\Windows\System\pWbKbGH.exe
  C:\Windows\System\pWbKbGH.exe
  2⤵
  - Executes dropped EXE
  PID:4840
- C:\Windows\System\qYDJFsc.exe
  C:\Windows\System\qYDJFsc.exe
  2⤵
  - Executes dropped EXE
  PID:3956
- C:\Windows\System\apatmFs.exe
  C:\Windows\System\apatmFs.exe
  2⤵
  - Executes dropped EXE
  PID:3644
- C:\Windows\System\MxwKZjD.exe
  C:\Windows\System\MxwKZjD.exe
  2⤵
  - Executes dropped EXE
  PID:5032
- C:\Windows\System\ZxYKIwE.exe
  C:\Windows\System\ZxYKIwE.exe
  2⤵
  - Executes dropped EXE
  PID:2428
- C:\Windows\System\yaWtmgw.exe
  C:\Windows\System\yaWtmgw.exe
  2⤵
  - Executes dropped EXE
  PID:372
- C:\Windows\System\tYRvUKC.exe
  C:\Windows\System\tYRvUKC.exe
  2⤵
  - Executes dropped EXE
  PID:3092
- C:\Windows\System\YhvWhUy.exe
  C:\Windows\System\YhvWhUy.exe
  2⤵
  - Executes dropped EXE
  PID:4564
- C:\Windows\System\caUYTjB.exe
  C:\Windows\System\caUYTjB.exe
  2⤵
  - Executes dropped EXE
  PID:4080
- C:\Windows\System\wWbblYN.exe
  C:\Windows\System\wWbblYN.exe
  2⤵
  - Executes dropped EXE
  PID:4332
- C:\Windows\System\AGrnpya.exe
  C:\Windows\System\AGrnpya.exe
  2⤵
  - Executes dropped EXE
  PID:3060
- C:\Windows\System\bRQibsL.exe
  C:\Windows\System\bRQibsL.exe
  2⤵
  - Executes dropped EXE
  PID:1464
- C:\Windows\System\VQRrimF.exe
  C:\Windows\System\VQRrimF.exe
  2⤵
  - Executes dropped EXE
  PID:3848
- C:\Windows\System\YbuWucI.exe
  C:\Windows\System\YbuWucI.exe
  2⤵
  - Executes dropped EXE
  PID:2332
- C:\Windows\System\wBItuUp.exe
  C:\Windows\System\wBItuUp.exe
  2⤵
  - Executes dropped EXE
  PID:3108
- C:\Windows\System\HUXcuFP.exe
  C:\Windows\System\HUXcuFP.exe
  2⤵
  - Executes dropped EXE
  PID:2212
- C:\Windows\System\nRfAYVB.exe
  C:\Windows\System\nRfAYVB.exe
  2⤵
  PID:1620
- C:\Windows\System\fEqeBXd.exe
  C:\Windows\System\fEqeBXd.exe
  2⤵
  PID:2448
- C:\Windows\System\fZfIoHc.exe
  C:\Windows\System\fZfIoHc.exe
  2⤵
  PID:2680
- C:\Windows\System\AWLOzfi.exe
  C:\Windows\System\AWLOzfi.exe
  2⤵
  PID:1032
- C:\Windows\System\BWvUWjd.exe
  C:\Windows\System\BWvUWjd.exe
  2⤵
  PID:2708
- C:\Windows\System\zrODWrL.exe
  C:\Windows\System\zrODWrL.exe
  2⤵
  PID:2372
- C:\Windows\System\TNtwxbm.exe
  C:\Windows\System\TNtwxbm.exe
  2⤵
  PID:2060
- C:\Windows\System\hSpABxA.exe
  C:\Windows\System\hSpABxA.exe
  2⤵
  PID:1408
- C:\Windows\System\MTTWqUa.exe
  C:\Windows\System\MTTWqUa.exe
  2⤵
  PID:3528
- C:\Windows\System\eKxrkmD.exe
  C:\Windows\System\eKxrkmD.exe
  2⤵
  PID:4948
- C:\Windows\System\RbmhCfT.exe
  C:\Windows\System\RbmhCfT.exe
  2⤵
  PID:2440
- C:\Windows\System\hFiJvFk.exe
  C:\Windows\System\hFiJvFk.exe
  2⤵
  PID:3744
- C:\Windows\System\lLYJsqM.exe
  C:\Windows\System\lLYJsqM.exe
  2⤵
  PID:3788
- C:\Windows\System\gaYHERB.exe
  C:\Windows\System\gaYHERB.exe
  2⤵
  PID:1340
- C:\Windows\System\PDfikJC.exe
  C:\Windows\System\PDfikJC.exe
  2⤵
  PID:2188
- C:\Windows\System\vklNUKZ.exe
  C:\Windows\System\vklNUKZ.exe
  2⤵
  PID:1556
- C:\Windows\System\TDrTQwi.exe
  C:\Windows\System\TDrTQwi.exe
  2⤵
  PID:3516
- C:\Windows\System\PfAstbW.exe
  C:\Windows\System\PfAstbW.exe
  2⤵
  PID:3924
- C:\Windows\System\DmADrsQ.exe
  C:\Windows\System\DmADrsQ.exe
  2⤵
  PID:1904
- C:\Windows\System\aayIMcX.exe
  C:\Windows\System\aayIMcX.exe
  2⤵
  PID:1228
- C:\Windows\System\eHhTSoh.exe
  C:\Windows\System\eHhTSoh.exe
  2⤵
  PID:4604
- C:\Windows\System\iYWUGYN.exe
  C:\Windows\System\iYWUGYN.exe
  2⤵
  PID:4620
- C:\Windows\System\xtvWLLZ.exe
  C:\Windows\System\xtvWLLZ.exe
  2⤵
  PID:3212
- C:\Windows\System\YEzTPvE.exe
  C:\Windows\System\YEzTPvE.exe
  2⤵
  PID:4064
- C:\Windows\System\CyvIssk.exe
  C:\Windows\System\CyvIssk.exe
  2⤵
  PID:1760
- C:\Windows\System\pnoRUzP.exe
  C:\Windows\System\pnoRUzP.exe
  2⤵
  PID:64
- C:\Windows\System\bMYQxLQ.exe
  C:\Windows\System\bMYQxLQ.exe
  2⤵
  PID:3288
- C:\Windows\System\mrPymyX.exe
  C:\Windows\System\mrPymyX.exe
  2⤵
  PID:1316
- C:\Windows\System\MtkeWkW.exe
  C:\Windows\System\MtkeWkW.exe
  2⤵
  PID:1744
- C:\Windows\System\sCNVtQV.exe
  C:\Windows\System\sCNVtQV.exe
  2⤵
  PID:3476
- C:\Windows\System\Fmuruga.exe
  C:\Windows\System\Fmuruga.exe
  2⤵
  PID:3300
- C:\Windows\System\LOZLDmm.exe
  C:\Windows\System\LOZLDmm.exe
  2⤵
  PID:3544
- C:\Windows\System\bAFwyZc.exe
  C:\Windows\System\bAFwyZc.exe
  2⤵
  PID:3392
- C:\Windows\System\KsYezvZ.exe
  C:\Windows\System\KsYezvZ.exe
  2⤵
  PID:640
- C:\Windows\System\VSgGblF.exe
  C:\Windows\System\VSgGblF.exe
  2⤵
  PID:4032
- C:\Windows\System\jRdKGBl.exe
  C:\Windows\System\jRdKGBl.exe
  2⤵
  PID:5160
- C:\Windows\System\uNDlVrF.exe
  C:\Windows\System\uNDlVrF.exe
  2⤵
  PID:5176
- C:\Windows\System\RfMJrtc.exe
  C:\Windows\System\RfMJrtc.exe
  2⤵
  PID:5204
- C:\Windows\System\ejdUTbu.exe
  C:\Windows\System\ejdUTbu.exe
  2⤵
  PID:5244
- C:\Windows\System\iQnYUoO.exe
  C:\Windows\System\iQnYUoO.exe
  2⤵
  PID:5276
- C:\Windows\System\lrIkllK.exe
  C:\Windows\System\lrIkllK.exe
  2⤵
  PID:5312
- C:\Windows\System\GgTcuJn.exe
  C:\Windows\System\GgTcuJn.exe
  2⤵
  PID:5344
- C:\Windows\System\cjNfAVC.exe
  C:\Windows\System\cjNfAVC.exe
  2⤵
  PID:5372
- C:\Windows\System\FdBcrlV.exe
  C:\Windows\System\FdBcrlV.exe
  2⤵
  PID:5392
- C:\Windows\System\femZyBn.exe
  C:\Windows\System\femZyBn.exe
  2⤵
  PID:5412
- C:\Windows\System\wkTaEvM.exe
  C:\Windows\System\wkTaEvM.exe
  2⤵
  PID:5452
- C:\Windows\System\FUNtNkk.exe
  C:\Windows\System\FUNtNkk.exe
  2⤵
  PID:5468
- C:\Windows\System\RtrifIZ.exe
  C:\Windows\System\RtrifIZ.exe
  2⤵
  PID:5496
- C:\Windows\System\vqQoWnq.exe
  C:\Windows\System\vqQoWnq.exe
  2⤵
  PID:5528
- C:\Windows\System\tCfVuQV.exe
  C:\Windows\System\tCfVuQV.exe
  2⤵
  PID:5544
- C:\Windows\System\GyinKSB.exe
  C:\Windows\System\GyinKSB.exe
  2⤵
  PID:5564
- C:\Windows\System\dxnRnBQ.exe
  C:\Windows\System\dxnRnBQ.exe
  2⤵
  PID:5596
- C:\Windows\System\LwzZuqa.exe
  C:\Windows\System\LwzZuqa.exe
  2⤵
  PID:5644
- C:\Windows\System\XDKDuQr.exe
  C:\Windows\System\XDKDuQr.exe
  2⤵
  PID:5672
- C:\Windows\System\GyYDLiI.exe
  C:\Windows\System\GyYDLiI.exe
  2⤵
  PID:5696
- C:\Windows\System\cdqkOjl.exe
  C:\Windows\System\cdqkOjl.exe
  2⤵
  PID:5716
- C:\Windows\System\DAQMcSy.exe
  C:\Windows\System\DAQMcSy.exe
  2⤵
  PID:5736
- C:\Windows\System\luoKdOO.exe
  C:\Windows\System\luoKdOO.exe
  2⤵
  PID:5760
- C:\Windows\System\OoYqvha.exe
  C:\Windows\System\OoYqvha.exe
  2⤵
  PID:5784
- C:\Windows\System\aZOguvN.exe
  C:\Windows\System\aZOguvN.exe
  2⤵
  PID:5808
- C:\Windows\System\hPfvnZo.exe
  C:\Windows\System\hPfvnZo.exe
  2⤵
  PID:5832
- C:\Windows\System\Jzltmpc.exe
  C:\Windows\System\Jzltmpc.exe
  2⤵
  PID:5860
- C:\Windows\System\mGWDKqR.exe
  C:\Windows\System\mGWDKqR.exe
  2⤵
  PID:5880
- C:\Windows\System\GtlCnKb.exe
  C:\Windows\System\GtlCnKb.exe
  2⤵
  PID:5900
- C:\Windows\System\TXJjJHK.exe
  C:\Windows\System\TXJjJHK.exe
  2⤵
  PID:5924
- C:\Windows\System\ouQNpTg.exe
  C:\Windows\System\ouQNpTg.exe
  2⤵
  PID:6012
- C:\Windows\System\ouIbBhR.exe
  C:\Windows\System\ouIbBhR.exe
  2⤵
  PID:6028
- C:\Windows\System\NmWMpVW.exe
  C:\Windows\System\NmWMpVW.exe
  2⤵
  PID:6060
- C:\Windows\System\cljZGwk.exe
  C:\Windows\System\cljZGwk.exe
  2⤵
  PID:6076
- C:\Windows\System\JDDhwtI.exe
  C:\Windows\System\JDDhwtI.exe
  2⤵
  PID:6096
- C:\Windows\System\zbCFLVg.exe
  C:\Windows\System\zbCFLVg.exe
  2⤵
  PID:6128
- C:\Windows\System\PWlqVcJ.exe
  C:\Windows\System\PWlqVcJ.exe
  2⤵
  PID:5124
- C:\Windows\System\isVtmMi.exe
  C:\Windows\System\isVtmMi.exe
  2⤵
  PID:5188
- C:\Windows\System\ncpeswH.exe
  C:\Windows\System\ncpeswH.exe
  2⤵
  PID:5224
- C:\Windows\System\aHyIEiW.exe
  C:\Windows\System\aHyIEiW.exe
  2⤵
  PID:5264
- C:\Windows\System\SMOkiOM.exe
  C:\Windows\System\SMOkiOM.exe
  2⤵
  PID:5380
- C:\Windows\System\UinUoUF.exe
  C:\Windows\System\UinUoUF.exe
  2⤵
  PID:5440
- C:\Windows\System\EtRLsEc.exe
  C:\Windows\System\EtRLsEc.exe
  2⤵
  PID:5480
- C:\Windows\System\UPnMXDI.exe
  C:\Windows\System\UPnMXDI.exe
  2⤵
  PID:5536
- C:\Windows\System\UZogjMe.exe
  C:\Windows\System\UZogjMe.exe
  2⤵
  PID:5592
- C:\Windows\System\nVcltBj.exe
  C:\Windows\System\nVcltBj.exe
  2⤵
  PID:5628
- C:\Windows\System\ppVcOEN.exe
  C:\Windows\System\ppVcOEN.exe
  2⤵
  PID:5664
- C:\Windows\System\HrmOPxL.exe
  C:\Windows\System\HrmOPxL.exe
  2⤵
  PID:5732
- C:\Windows\System\xIhqEbV.exe
  C:\Windows\System\xIhqEbV.exe
  2⤵
  PID:5800
- C:\Windows\System\NncwOeE.exe
  C:\Windows\System\NncwOeE.exe
  2⤵
  PID:5820
- C:\Windows\System\YgrZgwa.exe
  C:\Windows\System\YgrZgwa.exe
  2⤵
  PID:5804
- C:\Windows\System\akcPLUr.exe
  C:\Windows\System\akcPLUr.exe
  2⤵
  PID:5912
- C:\Windows\System\vrIOhrB.exe
  C:\Windows\System\vrIOhrB.exe
  2⤵
  PID:5980
- C:\Windows\System\aJlFSxZ.exe
  C:\Windows\System\aJlFSxZ.exe
  2⤵
  PID:6068
- C:\Windows\System\zlxqVEw.exe
  C:\Windows\System\zlxqVEw.exe
  2⤵
  PID:6120
- C:\Windows\System\eHBFRZE.exe
  C:\Windows\System\eHBFRZE.exe
  2⤵
  PID:5508
- C:\Windows\System\JHfpiGU.exe
  C:\Windows\System\JHfpiGU.exe
  2⤵
  PID:5688
- C:\Windows\System\wQOnGkv.exe
  C:\Windows\System\wQOnGkv.exe
  2⤵
  PID:5816
- C:\Windows\System\pKuBWDI.exe
  C:\Windows\System\pKuBWDI.exe
  2⤵
  PID:6136
- C:\Windows\System\uyVIWuT.exe
  C:\Windows\System\uyVIWuT.exe
  2⤵
  PID:5148
- C:\Windows\System\UMTnmlS.exe
  C:\Windows\System\UMTnmlS.exe
  2⤵
  PID:5300
- C:\Windows\System\ldznGeX.exe
  C:\Windows\System\ldznGeX.exe
  2⤵
  PID:5464
- C:\Windows\System\GCiFLnO.exe
  C:\Windows\System\GCiFLnO.exe
  2⤵
  PID:6148
- C:\Windows\System\OzeVsAY.exe
  C:\Windows\System\OzeVsAY.exe
  2⤵
  PID:6196
- C:\Windows\System\qzcWPyf.exe
  C:\Windows\System\qzcWPyf.exe
  2⤵
  PID:6228
- C:\Windows\System\Khaomrt.exe
  C:\Windows\System\Khaomrt.exe
  2⤵
  PID:6264
- C:\Windows\System\lCSTkWb.exe
  C:\Windows\System\lCSTkWb.exe
  2⤵
  PID:6284
- C:\Windows\System\SOkOizf.exe
  C:\Windows\System\SOkOizf.exe
  2⤵
  PID:6308
- C:\Windows\System\HUVKIXN.exe
  C:\Windows\System\HUVKIXN.exe
  2⤵
  PID:6328
- C:\Windows\System\XVAjuvd.exe
  C:\Windows\System\XVAjuvd.exe
  2⤵
  PID:6348
- C:\Windows\System\AbLGbBj.exe
  C:\Windows\System\AbLGbBj.exe
  2⤵
  PID:6392
- C:\Windows\System\LoBIffZ.exe
  C:\Windows\System\LoBIffZ.exe
  2⤵
  PID:6424
- C:\Windows\System\OBbZLrt.exe
  C:\Windows\System\OBbZLrt.exe
  2⤵
  PID:6444
- C:\Windows\System\FdykuDD.exe
  C:\Windows\System\FdykuDD.exe
  2⤵
  PID:6468
- C:\Windows\System\ALiXhAn.exe
  C:\Windows\System\ALiXhAn.exe
  2⤵
  PID:6492
- C:\Windows\System\TOovHnM.exe
  C:\Windows\System\TOovHnM.exe
  2⤵
  PID:6508
- C:\Windows\System\XIxnMSX.exe
  C:\Windows\System\XIxnMSX.exe
  2⤵
  PID:6528
- C:\Windows\System\kWlFOLt.exe
  C:\Windows\System\kWlFOLt.exe
  2⤵
  PID:6548
- C:\Windows\System\WLpJzFG.exe
  C:\Windows\System\WLpJzFG.exe
  2⤵
  PID:6564
- C:\Windows\System\dzmWRja.exe
  C:\Windows\System\dzmWRja.exe
  2⤵
  PID:6596
- C:\Windows\System\uNzOqLL.exe
  C:\Windows\System\uNzOqLL.exe
  2⤵
  PID:6620
- C:\Windows\System\zJJorax.exe
  C:\Windows\System\zJJorax.exe
  2⤵
  PID:6636
- C:\Windows\System\zWMvPEa.exe
  C:\Windows\System\zWMvPEa.exe
  2⤵
  PID:6656
- C:\Windows\System\uyEdvNy.exe
  C:\Windows\System\uyEdvNy.exe
  2⤵
  PID:6684
- C:\Windows\System\avsfXMQ.exe
  C:\Windows\System\avsfXMQ.exe
  2⤵
  PID:6708
- C:\Windows\System\mDwzKIm.exe
  C:\Windows\System\mDwzKIm.exe
  2⤵
  PID:6736
- C:\Windows\System\PloJElP.exe
  C:\Windows\System\PloJElP.exe
  2⤵
  PID:6756
- C:\Windows\System\OUNBEin.exe
  C:\Windows\System\OUNBEin.exe
  2⤵
  PID:6812
- C:\Windows\System\wqQouIy.exe
  C:\Windows\System\wqQouIy.exe
  2⤵
  PID:6844
- C:\Windows\System\YhjcnRA.exe
  C:\Windows\System\YhjcnRA.exe
  2⤵
  PID:6860
- C:\Windows\System\GHpyEyn.exe
  C:\Windows\System\GHpyEyn.exe
  2⤵
  PID:6896
- C:\Windows\System\AFNHFXc.exe
  C:\Windows\System\AFNHFXc.exe
  2⤵
  PID:6916
- C:\Windows\System\btaPMfQ.exe
  C:\Windows\System\btaPMfQ.exe
  2⤵
  PID:6936
- C:\Windows\System\iqDcTQG.exe
  C:\Windows\System\iqDcTQG.exe
  2⤵
  PID:7012
- C:\Windows\System\IAARVbI.exe
  C:\Windows\System\IAARVbI.exe
  2⤵
  PID:7032
- C:\Windows\System\nxHDGcq.exe
  C:\Windows\System\nxHDGcq.exe
  2⤵
  PID:7080
- C:\Windows\System\aDoPgCq.exe
  C:\Windows\System\aDoPgCq.exe
  2⤵
  PID:7116
- C:\Windows\System\dGWaFuU.exe
  C:\Windows\System\dGWaFuU.exe
  2⤵
  PID:7140
- C:\Windows\System\fMmeLNw.exe
  C:\Windows\System\fMmeLNw.exe
  2⤵
  PID:5352
- C:\Windows\System\CyzgrZU.exe
  C:\Windows\System\CyzgrZU.exe
  2⤵
  PID:6184
- C:\Windows\System\oKsQtkq.exe
  C:\Windows\System\oKsQtkq.exe
  2⤵
  PID:6256
- C:\Windows\System\wDTVjIF.exe
  C:\Windows\System\wDTVjIF.exe
  2⤵
  PID:6304
- C:\Windows\System\pJkOCDf.exe
  C:\Windows\System\pJkOCDf.exe
  2⤵
  PID:6324
- C:\Windows\System\GVWDdjC.exe
  C:\Windows\System\GVWDdjC.exe
  2⤵
  PID:6368
- C:\Windows\System\PwmueNA.exe
  C:\Windows\System\PwmueNA.exe
  2⤵
  PID:6440
- C:\Windows\System\dlUYLLj.exe
  C:\Windows\System\dlUYLLj.exe
  2⤵
  PID:6648
- C:\Windows\System\EdmeCbF.exe
  C:\Windows\System\EdmeCbF.exe
  2⤵
  PID:6616
- C:\Windows\System\sDPhYlg.exe
  C:\Windows\System\sDPhYlg.exe
  2⤵
  PID:6776
- C:\Windows\System\iVpMaIY.exe
  C:\Windows\System\iVpMaIY.exe
  2⤵
  PID:6840
- C:\Windows\System\OkidYxb.exe
  C:\Windows\System\OkidYxb.exe
  2⤵
  PID:6808
- C:\Windows\System\pltEqRV.exe
  C:\Windows\System\pltEqRV.exe
  2⤵
  PID:6868
- C:\Windows\System\gseYSQe.exe
  C:\Windows\System\gseYSQe.exe
  2⤵
  PID:6932
- C:\Windows\System\YMZVSEW.exe
  C:\Windows\System\YMZVSEW.exe
  2⤵
  PID:7088
- C:\Windows\System\JWJhVMz.exe
  C:\Windows\System\JWJhVMz.exe
  2⤵
  PID:7132
- C:\Windows\System\SlMokHC.exe
  C:\Windows\System\SlMokHC.exe
  2⤵
  PID:6292
- C:\Windows\System\CkKqkhk.exe
  C:\Windows\System\CkKqkhk.exe
  2⤵
  PID:6224
- C:\Windows\System\AxWBVJz.exe
  C:\Windows\System\AxWBVJz.exe
  2⤵
  PID:6340
- C:\Windows\System\MEAxFUQ.exe
  C:\Windows\System\MEAxFUQ.exe
  2⤵
  PID:6664
- C:\Windows\System\KVQIdNl.exe
  C:\Windows\System\KVQIdNl.exe
  2⤵
  PID:6804
- C:\Windows\System\zVlGMMh.exe
  C:\Windows\System\zVlGMMh.exe
  2⤵
  PID:6956
- C:\Windows\System\zZQmrtE.exe
  C:\Windows\System\zZQmrtE.exe
  2⤵
  PID:6216
- C:\Windows\System\tGgLGYV.exe
  C:\Windows\System\tGgLGYV.exe
  2⤵
  PID:6572
- C:\Windows\System\JzwLJWD.exe
  C:\Windows\System\JzwLJWD.exe
  2⤵
  PID:6188
- C:\Windows\System\RfMTLms.exe
  C:\Windows\System\RfMTLms.exe
  2⤵
  PID:6700
- C:\Windows\System\CmfzZRs.exe
  C:\Windows\System\CmfzZRs.exe
  2⤵
  PID:6964
- C:\Windows\System\meuDDnI.exe
  C:\Windows\System\meuDDnI.exe
  2⤵
  PID:7184
- C:\Windows\System\QgwgOso.exe
  C:\Windows\System\QgwgOso.exe
  2⤵
  PID:7208
- C:\Windows\System\PymhQzI.exe
  C:\Windows\System\PymhQzI.exe
  2⤵
  PID:7232
- C:\Windows\System\BazFFHT.exe
  C:\Windows\System\BazFFHT.exe
  2⤵
  PID:7252
- C:\Windows\System\ssgvMQq.exe
  C:\Windows\System\ssgvMQq.exe
  2⤵
  PID:7280
- C:\Windows\System\tJATqCc.exe
  C:\Windows\System\tJATqCc.exe
  2⤵
  PID:7320
- C:\Windows\System\ZJYnzBW.exe
  C:\Windows\System\ZJYnzBW.exe
  2⤵
  PID:7348
- C:\Windows\System\OjRckbN.exe
  C:\Windows\System\OjRckbN.exe
  2⤵
  PID:7368
- C:\Windows\System\VJutopD.exe
  C:\Windows\System\VJutopD.exe
  2⤵
  PID:7388
- C:\Windows\System\LGsbTro.exe
  C:\Windows\System\LGsbTro.exe
  2⤵
  PID:7408
- C:\Windows\System\DYMZuzt.exe
  C:\Windows\System\DYMZuzt.exe
  2⤵
  PID:7432
- C:\Windows\System\DymMvIs.exe
  C:\Windows\System\DymMvIs.exe
  2⤵
  PID:7448
- C:\Windows\System\gsxINbK.exe
  C:\Windows\System\gsxINbK.exe
  2⤵
  PID:7484
- C:\Windows\System\UcmXXVo.exe
  C:\Windows\System\UcmXXVo.exe
  2⤵
  PID:7508
- C:\Windows\System\lKhmuIq.exe
  C:\Windows\System\lKhmuIq.exe
  2⤵
  PID:7560
- C:\Windows\System\ietxYoC.exe
  C:\Windows\System\ietxYoC.exe
  2⤵
  PID:7588
- C:\Windows\System\tPbAEOy.exe
  C:\Windows\System\tPbAEOy.exe
  2⤵
  PID:7628
- C:\Windows\System\FPumUUo.exe
  C:\Windows\System\FPumUUo.exe
  2⤵
  PID:7652
- C:\Windows\System\psYERGY.exe
  C:\Windows\System\psYERGY.exe
  2⤵
  PID:7672
- C:\Windows\System\qPbpDxu.exe
  C:\Windows\System\qPbpDxu.exe
  2⤵
  PID:7712
- C:\Windows\System\syxDkLR.exe
  C:\Windows\System\syxDkLR.exe
  2⤵
  PID:7732
- C:\Windows\System\zyRZuvH.exe
  C:\Windows\System\zyRZuvH.exe
  2⤵
  PID:7752
- C:\Windows\System\enkNlzG.exe
  C:\Windows\System\enkNlzG.exe
  2⤵
  PID:7796
- C:\Windows\System\BtwmICI.exe
  C:\Windows\System\BtwmICI.exe
  2⤵
  PID:7820
- C:\Windows\System\tQVkGVM.exe
  C:\Windows\System\tQVkGVM.exe
  2⤵
  PID:7840
- C:\Windows\System\UHipiUh.exe
  C:\Windows\System\UHipiUh.exe
  2⤵
  PID:7864
- C:\Windows\System\MgAkhjk.exe
  C:\Windows\System\MgAkhjk.exe
  2⤵
  PID:7884
- C:\Windows\System\VMXDwZt.exe
  C:\Windows\System\VMXDwZt.exe
  2⤵
  PID:7904
- C:\Windows\System\nWdBTdM.exe
  C:\Windows\System\nWdBTdM.exe
  2⤵
  PID:7924
- C:\Windows\System\flZtMKQ.exe
  C:\Windows\System\flZtMKQ.exe
  2⤵
  PID:7956
- C:\Windows\System\CtBRhfK.exe
  C:\Windows\System\CtBRhfK.exe
  2⤵
  PID:7976
- C:\Windows\System\mkRZUyR.exe
  C:\Windows\System\mkRZUyR.exe
  2⤵
  PID:7996
- C:\Windows\System\tlbEXbp.exe
  C:\Windows\System\tlbEXbp.exe
  2⤵
  PID:8024
- C:\Windows\System\sZqUgpk.exe
  C:\Windows\System\sZqUgpk.exe
  2⤵
  PID:8040
- C:\Windows\System\rkYGuok.exe
  C:\Windows\System\rkYGuok.exe
  2⤵
  PID:8060
- C:\Windows\System\ehgYhFv.exe
  C:\Windows\System\ehgYhFv.exe
  2⤵
  PID:8084
- C:\Windows\System\kyDLBFN.exe
  C:\Windows\System\kyDLBFN.exe
  2⤵
  PID:8128
- C:\Windows\System\ZmBVhFD.exe
  C:\Windows\System\ZmBVhFD.exe
  2⤵
  PID:8168
- C:\Windows\System\xWqyVZr.exe
  C:\Windows\System\xWqyVZr.exe
  2⤵
  PID:8184
- C:\Windows\System\FUyesBB.exe
  C:\Windows\System\FUyesBB.exe
  2⤵
  PID:7196
- C:\Windows\System\mfXXKIe.exe
  C:\Windows\System\mfXXKIe.exe
  2⤵
  PID:7216
- C:\Windows\System\pNBuZns.exe
  C:\Windows\System\pNBuZns.exe
  2⤵
  PID:7420
- C:\Windows\System\vDXDmxP.exe
  C:\Windows\System\vDXDmxP.exe
  2⤵
  PID:7472
- C:\Windows\System\MyDKrAl.exe
  C:\Windows\System\MyDKrAl.exe
  2⤵
  PID:7492
- C:\Windows\System\DUdISPh.exe
  C:\Windows\System\DUdISPh.exe
  2⤵
  PID:7580
- C:\Windows\System\vyhnRRS.exe
  C:\Windows\System\vyhnRRS.exe
  2⤵
  PID:7640
- C:\Windows\System\blrTeqk.exe
  C:\Windows\System\blrTeqk.exe
  2⤵
  PID:7740
- C:\Windows\System\SBFQAhH.exe
  C:\Windows\System\SBFQAhH.exe
  2⤵
  PID:7692
- C:\Windows\System\VQEHZbx.exe
  C:\Windows\System\VQEHZbx.exe
  2⤵
  PID:7744
- C:\Windows\System\eBAxzNx.exe
  C:\Windows\System\eBAxzNx.exe
  2⤵
  PID:7808
- C:\Windows\System\vvOOhrX.exe
  C:\Windows\System\vvOOhrX.exe
  2⤵
  PID:7872
- C:\Windows\System\WUuHVtS.exe
  C:\Windows\System\WUuHVtS.exe
  2⤵
  PID:8004
- C:\Windows\System\oglmsHn.exe
  C:\Windows\System\oglmsHn.exe
  2⤵
  PID:7936
- C:\Windows\System\IYWlSiU.exe
  C:\Windows\System\IYWlSiU.exe
  2⤵
  PID:8076
- C:\Windows\System\mdBHnNg.exe
  C:\Windows\System\mdBHnNg.exe
  2⤵
  PID:5680
- C:\Windows\System\SLMUyXB.exe
  C:\Windows\System\SLMUyXB.exe
  2⤵
  PID:7224
- C:\Windows\System\PFIrRbe.exe
  C:\Windows\System\PFIrRbe.exe
  2⤵
  PID:7340
- C:\Windows\System\YtmpSrf.exe
  C:\Windows\System\YtmpSrf.exe
  2⤵
  PID:7536
- C:\Windows\System\NuLbnYL.exe
  C:\Windows\System\NuLbnYL.exe
  2⤵
  PID:8160
- C:\Windows\System\oTJuWoS.exe
  C:\Windows\System\oTJuWoS.exe
  2⤵
  PID:8140
- C:\Windows\System\LyHAyVX.exe
  C:\Windows\System\LyHAyVX.exe
  2⤵
  PID:7608
- C:\Windows\System\GZuDeTI.exe
  C:\Windows\System\GZuDeTI.exe
  2⤵
  PID:7552
- C:\Windows\System\xdQIWmj.exe
  C:\Windows\System\xdQIWmj.exe
  2⤵
  PID:7804
- C:\Windows\System\trlyPih.exe
  C:\Windows\System\trlyPih.exe
  2⤵
  PID:8212
- C:\Windows\System\HMBmmaw.exe
  C:\Windows\System\HMBmmaw.exe
  2⤵
  PID:8260
- C:\Windows\System\gQYkqib.exe
  C:\Windows\System\gQYkqib.exe
  2⤵
  PID:8276
- C:\Windows\System\vcpkMEU.exe
  C:\Windows\System\vcpkMEU.exe
  2⤵
  PID:8296
- C:\Windows\System\njTVNaO.exe
  C:\Windows\System\njTVNaO.exe
  2⤵
  PID:8320
- C:\Windows\System\XusPIFf.exe
  C:\Windows\System\XusPIFf.exe
  2⤵
  PID:8340
- C:\Windows\System\syTwGRo.exe
  C:\Windows\System\syTwGRo.exe
  2⤵
  PID:8356
- C:\Windows\System\HqUuNSV.exe
  C:\Windows\System\HqUuNSV.exe
  2⤵
  PID:8380
- C:\Windows\System\Ctcmftu.exe
  C:\Windows\System\Ctcmftu.exe
  2⤵
  PID:8400
- C:\Windows\System\HpXEMJY.exe
  C:\Windows\System\HpXEMJY.exe
  2⤵
  PID:8448
- C:\Windows\System\HQdFXBR.exe
  C:\Windows\System\HQdFXBR.exe
  2⤵
  PID:8464
- C:\Windows\System\ZXFPhTC.exe
  C:\Windows\System\ZXFPhTC.exe
  2⤵
  PID:8484
- C:\Windows\System\XMWlSoV.exe
  C:\Windows\System\XMWlSoV.exe
  2⤵
  PID:8508
- C:\Windows\System\VJHYTnf.exe
  C:\Windows\System\VJHYTnf.exe
  2⤵
  PID:8540
- C:\Windows\System\PVzxbUP.exe
  C:\Windows\System\PVzxbUP.exe
  2⤵
  PID:8568
- C:\Windows\System\iuyogVr.exe
  C:\Windows\System\iuyogVr.exe
  2⤵
  PID:8620
- C:\Windows\System\DeRTIzd.exe
  C:\Windows\System\DeRTIzd.exe
  2⤵
  PID:8648
- C:\Windows\System\tyhdncx.exe
  C:\Windows\System\tyhdncx.exe
  2⤵
  PID:8676
- C:\Windows\System\JDeusrP.exe
  C:\Windows\System\JDeusrP.exe
  2⤵
  PID:8696
- C:\Windows\System\XbgXDmC.exe
  C:\Windows\System\XbgXDmC.exe
  2⤵
  PID:8724
- C:\Windows\System\bmweNBi.exe
  C:\Windows\System\bmweNBi.exe
  2⤵
  PID:8744
- C:\Windows\System\nOIThhN.exe
  C:\Windows\System\nOIThhN.exe
  2⤵
  PID:8772
- C:\Windows\System\ybAhnle.exe
  C:\Windows\System\ybAhnle.exe
  2⤵
  PID:8788
- C:\Windows\System\xoZvlZV.exe
  C:\Windows\System\xoZvlZV.exe
  2⤵
  PID:8832
- C:\Windows\System\eibdsBt.exe
  C:\Windows\System\eibdsBt.exe
  2⤵
  PID:8872
- C:\Windows\System\HRTrzeu.exe
  C:\Windows\System\HRTrzeu.exe
  2⤵
  PID:8932
- C:\Windows\System\OgIZIZg.exe
  C:\Windows\System\OgIZIZg.exe
  2⤵
  PID:8952
- C:\Windows\System\zfesJyK.exe
  C:\Windows\System\zfesJyK.exe
  2⤵
  PID:8968
- C:\Windows\System\vLjzEFj.exe
  C:\Windows\System\vLjzEFj.exe
  2⤵
  PID:8984
- C:\Windows\System\pPaazjs.exe
  C:\Windows\System\pPaazjs.exe
  2⤵
  PID:9004
- C:\Windows\System\PcheqxV.exe
  C:\Windows\System\PcheqxV.exe
  2⤵
  PID:9020
- C:\Windows\System\PiBtnTa.exe
  C:\Windows\System\PiBtnTa.exe
  2⤵
  PID:9068
- C:\Windows\System\OHvnoqI.exe
  C:\Windows\System\OHvnoqI.exe
  2⤵
  PID:9104
- C:\Windows\System\faCJtfK.exe
  C:\Windows\System\faCJtfK.exe
  2⤵
  PID:9128
- C:\Windows\System\HFoMrAx.exe
  C:\Windows\System\HFoMrAx.exe
  2⤵
  PID:9200
- C:\Windows\System\pKxWqJj.exe
  C:\Windows\System\pKxWqJj.exe
  2⤵
  PID:8304
- C:\Windows\System\OMQsoMM.exe
  C:\Windows\System\OMQsoMM.exe
  2⤵
  PID:8388
- C:\Windows\System\saLlLBD.exe
  C:\Windows\System\saLlLBD.exe
  2⤵
  PID:8420
- C:\Windows\System\fhEmzLQ.exe
  C:\Windows\System\fhEmzLQ.exe
  2⤵
  PID:8436
- C:\Windows\System\nrQGcUE.exe
  C:\Windows\System\nrQGcUE.exe
  2⤵
  PID:8524
- C:\Windows\System\kCbcQXo.exe
  C:\Windows\System\kCbcQXo.exe
  2⤵
  PID:8580
- C:\Windows\System\PvLYnuu.exe
  C:\Windows\System\PvLYnuu.exe
  2⤵
  PID:8616
- C:\Windows\System\mZJdbga.exe
  C:\Windows\System\mZJdbga.exe
  2⤵
  PID:8672
- C:\Windows\System\drQqeJM.exe
  C:\Windows\System\drQqeJM.exe
  2⤵
  PID:8752
- C:\Windows\System\coNAPVy.exe
  C:\Windows\System\coNAPVy.exe
  2⤵
  PID:8840
- C:\Windows\System\LdHEQkY.exe
  C:\Windows\System\LdHEQkY.exe
  2⤵
  PID:8900
- C:\Windows\System\WUkCuio.exe
  C:\Windows\System\WUkCuio.exe
  2⤵
  PID:9016
- C:\Windows\System\OBwIyDa.exe
  C:\Windows\System\OBwIyDa.exe
  2⤵
  PID:8880
- C:\Windows\System\APUvyjS.exe
  C:\Windows\System\APUvyjS.exe
  2⤵
  PID:9116
- C:\Windows\System\LFDvrRa.exe
  C:\Windows\System\LFDvrRa.exe
  2⤵
  PID:9192
- C:\Windows\System\lcpJyNy.exe
  C:\Windows\System\lcpJyNy.exe
  2⤵
  PID:9076
- C:\Windows\System\AGQRcED.exe
  C:\Windows\System\AGQRcED.exe
  2⤵
  PID:9136
- C:\Windows\System\wJTDfRE.exe
  C:\Windows\System\wJTDfRE.exe
  2⤵
  PID:8272
- C:\Windows\System\bCzAjgw.exe
  C:\Windows\System\bCzAjgw.exe
  2⤵
  PID:8536
- C:\Windows\System\pklZlPJ.exe
  C:\Windows\System\pklZlPJ.exe
  2⤵
  PID:8712
- C:\Windows\System\dkYyorO.exe
  C:\Windows\System\dkYyorO.exe
  2⤵
  PID:8668
- C:\Windows\System\pPojeGg.exe
  C:\Windows\System\pPojeGg.exe
  2⤵
  PID:8928
- C:\Windows\System\RwczbZj.exe
  C:\Windows\System\RwczbZj.exe
  2⤵
  PID:9100
- C:\Windows\System\bYLjGTi.exe
  C:\Windows\System\bYLjGTi.exe
  2⤵
  PID:9060
- C:\Windows\System\lvcFhyV.exe
  C:\Windows\System\lvcFhyV.exe
  2⤵
  PID:8312
- C:\Windows\System\tTXbzBD.exe
  C:\Windows\System\tTXbzBD.exe
  2⤵
  PID:7332
- C:\Windows\System\PiuNRAe.exe
  C:\Windows\System\PiuNRAe.exe
  2⤵
  PID:8860
- C:\Windows\System\qZNKMAr.exe
  C:\Windows\System\qZNKMAr.exe
  2⤵
  PID:8548
- C:\Windows\System\cNQjLJt.exe
  C:\Windows\System\cNQjLJt.exe
  2⤵
  PID:9232
- C:\Windows\System\WHyqEdw.exe
  C:\Windows\System\WHyqEdw.exe
  2⤵
  PID:9272
- C:\Windows\System\PkNSHlH.exe
  C:\Windows\System\PkNSHlH.exe
  2⤵
  PID:9296
- C:\Windows\System\hoiQEiC.exe
  C:\Windows\System\hoiQEiC.exe
  2⤵
  PID:9340
- C:\Windows\System\kqXUTCJ.exe
  C:\Windows\System\kqXUTCJ.exe
  2⤵
  PID:9368
- C:\Windows\System\lVLsTJs.exe
  C:\Windows\System\lVLsTJs.exe
  2⤵
  PID:9384
- C:\Windows\System\ULTedYR.exe
  C:\Windows\System\ULTedYR.exe
  2⤵
  PID:9404
- C:\Windows\System\YUrkALW.exe
  C:\Windows\System\YUrkALW.exe
  2⤵
  PID:9428
- C:\Windows\System\ZzOHpHJ.exe
  C:\Windows\System\ZzOHpHJ.exe
  2⤵
  PID:9448
- C:\Windows\System\EXicyUr.exe
  C:\Windows\System\EXicyUr.exe
  2⤵
  PID:9504
- C:\Windows\System\UiVWqRj.exe
  C:\Windows\System\UiVWqRj.exe
  2⤵
  PID:9548
- C:\Windows\System\lUkHLhT.exe
  C:\Windows\System\lUkHLhT.exe
  2⤵
  PID:9568
- C:\Windows\System\QlIcLJH.exe
  C:\Windows\System\QlIcLJH.exe
  2⤵
  PID:9588
- C:\Windows\System\HbGoiXV.exe
  C:\Windows\System\HbGoiXV.exe
  2⤵
  PID:9612
- C:\Windows\System\AybMdVs.exe
  C:\Windows\System\AybMdVs.exe
  2⤵
  PID:9656
- C:\Windows\System\aMkBtGV.exe
  C:\Windows\System\aMkBtGV.exe
  2⤵
  PID:9680
- C:\Windows\System\vYrEbAu.exe
  C:\Windows\System\vYrEbAu.exe
  2⤵
  PID:9696
- C:\Windows\System\JuqJswA.exe
  C:\Windows\System\JuqJswA.exe
  2⤵
  PID:9736
- C:\Windows\System\KyYgEaf.exe
  C:\Windows\System\KyYgEaf.exe
  2⤵
  PID:9784
- C:\Windows\System\OdErDcf.exe
  C:\Windows\System\OdErDcf.exe
  2⤵
  PID:9804
- C:\Windows\System\CxAZOXW.exe
  C:\Windows\System\CxAZOXW.exe
  2⤵
  PID:9828
- C:\Windows\System\aqtVdkG.exe
  C:\Windows\System\aqtVdkG.exe
  2⤵
  PID:9876
- C:\Windows\System\sBCayce.exe
  C:\Windows\System\sBCayce.exe
  2⤵
  PID:9904
- C:\Windows\System\BVncNWE.exe
  C:\Windows\System\BVncNWE.exe
  2⤵
  PID:9928
- C:\Windows\System\UsyAzJC.exe
  C:\Windows\System\UsyAzJC.exe
  2⤵
  PID:9952
- C:\Windows\System\YOgtAZf.exe
  C:\Windows\System\YOgtAZf.exe
  2⤵
  PID:9980
- C:\Windows\System\xgOMKpB.exe
  C:\Windows\System\xgOMKpB.exe
  2⤵
  PID:10008
- C:\Windows\System\SpgZiED.exe
  C:\Windows\System\SpgZiED.exe
  2⤵
  PID:10032
- C:\Windows\System\gdqbmWE.exe
  C:\Windows\System\gdqbmWE.exe
  2⤵
  PID:10068
- C:\Windows\System\wUXKaMj.exe
  C:\Windows\System\wUXKaMj.exe
  2⤵
  PID:10088
- C:\Windows\System\UGGjuiq.exe
  C:\Windows\System\UGGjuiq.exe
  2⤵
  PID:10120
- C:\Windows\System\LELKFPL.exe
  C:\Windows\System\LELKFPL.exe
  2⤵
  PID:10136
- C:\Windows\System\gzhvihx.exe
  C:\Windows\System\gzhvihx.exe
  2⤵
  PID:10156
- C:\Windows\System\ItjNUnS.exe
  C:\Windows\System\ItjNUnS.exe
  2⤵
  PID:10184
- C:\Windows\System\usiJYxG.exe
  C:\Windows\System\usiJYxG.exe
  2⤵
  PID:10212
- C:\Windows\System\HUIvhwy.exe
  C:\Windows\System\HUIvhwy.exe
  2⤵
  PID:8456
- C:\Windows\System\hwAWVXO.exe
  C:\Windows\System\hwAWVXO.exe
  2⤵
  PID:8736
- C:\Windows\System\CFwxpnT.exe
  C:\Windows\System\CFwxpnT.exe
  2⤵
  PID:9112
- C:\Windows\System\WtNCybJ.exe
  C:\Windows\System\WtNCybJ.exe
  2⤵
  PID:9280
- C:\Windows\System\kGMdgpc.exe
  C:\Windows\System\kGMdgpc.exe
  2⤵
  PID:9332
- C:\Windows\System\VGwIAig.exe
  C:\Windows\System\VGwIAig.exe
  2⤵
  PID:9392
- C:\Windows\System\NnKWOff.exe
  C:\Windows\System\NnKWOff.exe
  2⤵
  PID:9584
- C:\Windows\System\MZXrpvE.exe
  C:\Windows\System\MZXrpvE.exe
  2⤵
  PID:9608
- C:\Windows\System\tfDNJDw.exe
  C:\Windows\System\tfDNJDw.exe
  2⤵
  PID:9688
- C:\Windows\System\lvbpKNp.exe
  C:\Windows\System\lvbpKNp.exe
  2⤵
  PID:9716
- C:\Windows\System\gsEgkOV.exe
  C:\Windows\System\gsEgkOV.exe
  2⤵
  PID:9812
- C:\Windows\System\wFhUmOn.exe
  C:\Windows\System\wFhUmOn.exe
  2⤵
  PID:9852
- C:\Windows\System\ZQbvkOm.exe
  C:\Windows\System\ZQbvkOm.exe
  2⤵
  PID:9900
- C:\Windows\System\hRCXgCH.exe
  C:\Windows\System\hRCXgCH.exe
  2⤵
  PID:9968
- C:\Windows\System\PIdHHiu.exe
  C:\Windows\System\PIdHHiu.exe
  2⤵
  PID:10016
- C:\Windows\System\xYyNjme.exe
  C:\Windows\System\xYyNjme.exe
  2⤵
  PID:10180
- C:\Windows\System\RisCyCM.exe
  C:\Windows\System\RisCyCM.exe
  2⤵
  PID:10204
- C:\Windows\System\GkkQClR.exe
  C:\Windows\System\GkkQClR.exe
  2⤵
  PID:10236
- C:\Windows\System\GkwSmoE.exe
  C:\Windows\System\GkwSmoE.exe
  2⤵
  PID:9380
- C:\Windows\System\JiEJVmx.exe
  C:\Windows\System\JiEJVmx.exe
  2⤵
  PID:9576
- C:\Windows\System\qAtWiMZ.exe
  C:\Windows\System\qAtWiMZ.exe
  2⤵
  PID:9676
- C:\Windows\System\cTbMSZv.exe
  C:\Windows\System\cTbMSZv.exe
  2⤵
  PID:9704
- C:\Windows\System\vjraRng.exe
  C:\Windows\System\vjraRng.exe
  2⤵
  PID:10004
- C:\Windows\System\PnZOjOO.exe
  C:\Windows\System\PnZOjOO.exe
  2⤵
  PID:10128
- C:\Windows\System\TyGtRDG.exe
  C:\Windows\System\TyGtRDG.exe
  2⤵
  PID:9228
- C:\Windows\System\fuUWjIQ.exe
  C:\Windows\System\fuUWjIQ.exe
  2⤵
  PID:9564
- C:\Windows\System\qIGXVKb.exe
  C:\Windows\System\qIGXVKb.exe
  2⤵
  PID:9692
- C:\Windows\System\tmDrcHO.exe
  C:\Windows\System\tmDrcHO.exe
  2⤵
  PID:10220
- C:\Windows\System\tyVOIMt.exe
  C:\Windows\System\tyVOIMt.exe
  2⤵
  PID:9264
- C:\Windows\System\WZJVFLB.exe
  C:\Windows\System\WZJVFLB.exe
  2⤵
  PID:10280
- C:\Windows\System\Jvaeqwn.exe
  C:\Windows\System\Jvaeqwn.exe
  2⤵
  PID:10300
- C:\Windows\System\HomJpXQ.exe
  C:\Windows\System\HomJpXQ.exe
  2⤵
  PID:10404
- C:\Windows\System\oKovnSm.exe
  C:\Windows\System\oKovnSm.exe
  2⤵
  PID:10424
- C:\Windows\System\efLvvBn.exe
  C:\Windows\System\efLvvBn.exe
  2⤵
  PID:10452
- C:\Windows\System\ygEhuqE.exe
  C:\Windows\System\ygEhuqE.exe
  2⤵
  PID:10468
- C:\Windows\System\nbdhRMX.exe
  C:\Windows\System\nbdhRMX.exe
  2⤵
  PID:10504
- C:\Windows\System\WzcCvxk.exe
  C:\Windows\System\WzcCvxk.exe
  2⤵
  PID:10536
- C:\Windows\System\TuISSPh.exe
  C:\Windows\System\TuISSPh.exe
  2⤵
  PID:10552
- C:\Windows\System\YHWKRgR.exe
  C:\Windows\System\YHWKRgR.exe
  2⤵
  PID:10592
- C:\Windows\System\gJgeVMF.exe
  C:\Windows\System\gJgeVMF.exe
  2⤵
  PID:10612
- C:\Windows\System\JECNTCm.exe
  C:\Windows\System\JECNTCm.exe
  2⤵
  PID:10636
- C:\Windows\System\xuTuNQt.exe
  C:\Windows\System\xuTuNQt.exe
  2⤵
  PID:10664
- C:\Windows\System\DvTBkqb.exe
  C:\Windows\System\DvTBkqb.exe
  2⤵
  PID:10680
- C:\Windows\System\ESCgvsq.exe
  C:\Windows\System\ESCgvsq.exe
  2⤵
  PID:10712
- C:\Windows\System\EcqfIUq.exe
  C:\Windows\System\EcqfIUq.exe
  2⤵
  PID:10740
- C:\Windows\System\AHpGDTc.exe
  C:\Windows\System\AHpGDTc.exe
  2⤵
  PID:10760
- C:\Windows\System\tFzLjGY.exe
  C:\Windows\System\tFzLjGY.exe
  2⤵
  PID:10784
- C:\Windows\System\Crsxfec.exe
  C:\Windows\System\Crsxfec.exe
  2⤵
  PID:10808
- C:\Windows\System\yCZriqf.exe
  C:\Windows\System\yCZriqf.exe
  2⤵
  PID:10824
- C:\Windows\System\TvuskyV.exe
  C:\Windows\System\TvuskyV.exe
  2⤵
  PID:10848
- C:\Windows\System\uDcajTc.exe
  C:\Windows\System\uDcajTc.exe
  2⤵
  PID:10884
- C:\Windows\System\ynaRehU.exe
  C:\Windows\System\ynaRehU.exe
  2⤵
  PID:10928
- C:\Windows\System\cFuwteJ.exe
  C:\Windows\System\cFuwteJ.exe
  2⤵
  PID:10968
- C:\Windows\System\jYAueoq.exe
  C:\Windows\System\jYAueoq.exe
  2⤵
  PID:10996
- C:\Windows\System\MxQgrCB.exe
  C:\Windows\System\MxQgrCB.exe
  2⤵
  PID:11032
- C:\Windows\System\nIZEToA.exe
  C:\Windows\System\nIZEToA.exe
  2⤵
  PID:11064
- C:\Windows\System\nlCJkDj.exe
  C:\Windows\System\nlCJkDj.exe
  2⤵
  PID:11084
- C:\Windows\System\iWNjlDT.exe
  C:\Windows\System\iWNjlDT.exe
  2⤵
  PID:11116
- C:\Windows\System\lJcLlOK.exe
  C:\Windows\System\lJcLlOK.exe
  2⤵
  PID:11136
- C:\Windows\System\EpdkczL.exe
  C:\Windows\System\EpdkczL.exe
  2⤵
  PID:11152
- C:\Windows\System\SxJXehh.exe
  C:\Windows\System\SxJXehh.exe
  2⤵
  PID:11196
- C:\Windows\System\IvvQzXP.exe
  C:\Windows\System\IvvQzXP.exe
  2⤵
  PID:11220
- C:\Windows\System\IpjrLty.exe
  C:\Windows\System\IpjrLty.exe
  2⤵
  PID:11240
- C:\Windows\System\vorrSmZ.exe
  C:\Windows\System\vorrSmZ.exe
  2⤵
  PID:11256
- C:\Windows\System\ZuWPAtI.exe
  C:\Windows\System\ZuWPAtI.exe
  2⤵
  PID:10296
- C:\Windows\System\HcNdQTm.exe
  C:\Windows\System\HcNdQTm.exe
  2⤵
  PID:10332
- C:\Windows\System\eiZlTwk.exe
  C:\Windows\System\eiZlTwk.exe
  2⤵
  PID:10312
- C:\Windows\System\GzecMVk.exe
  C:\Windows\System\GzecMVk.exe
  2⤵
  PID:10436
- C:\Windows\System\UrRGCOK.exe
  C:\Windows\System\UrRGCOK.exe
  2⤵
  PID:10500
- C:\Windows\System\rpAczEH.exe
  C:\Windows\System\rpAczEH.exe
  2⤵
  PID:10528
- C:\Windows\System\wTEkhLI.exe
  C:\Windows\System\wTEkhLI.exe
  2⤵
  PID:10632
- C:\Windows\System\MQdjlgt.exe
  C:\Windows\System\MQdjlgt.exe
  2⤵
  PID:10660
- C:\Windows\System\CEpdaWv.exe
  C:\Windows\System\CEpdaWv.exe
  2⤵
  PID:10708
- C:\Windows\System\vGsxeiY.exe
  C:\Windows\System\vGsxeiY.exe
  2⤵
  PID:10820
- C:\Windows\System\whPPqCD.exe
  C:\Windows\System\whPPqCD.exe
  2⤵
  PID:10912
- C:\Windows\System\zpJlAyv.exe
  C:\Windows\System\zpJlAyv.exe
  2⤵
  PID:11012
- C:\Windows\System\nQrWIpe.exe
  C:\Windows\System\nQrWIpe.exe
  2⤵
  PID:11016
- C:\Windows\System\HCdUEUG.exe
  C:\Windows\System\HCdUEUG.exe
  2⤵
  PID:3600
- C:\Windows\System\EZxwwXf.exe
  C:\Windows\System\EZxwwXf.exe
  2⤵
  PID:11080
- C:\Windows\System\XnyJcGY.exe
  C:\Windows\System\XnyJcGY.exe
  2⤵
  PID:9580
- C:\Windows\System\jrKLlkS.exe
  C:\Windows\System\jrKLlkS.exe
  2⤵
  PID:11248
- C:\Windows\System\GhcXcML.exe
  C:\Windows\System\GhcXcML.exe
  2⤵
  PID:10256
- C:\Windows\System\TYDmKaE.exe
  C:\Windows\System\TYDmKaE.exe
  2⤵
  PID:10416
- C:\Windows\System\IuQLTZb.exe
  C:\Windows\System\IuQLTZb.exe
  2⤵
  PID:10364
- C:\Windows\System\HCcCBEv.exe
  C:\Windows\System\HCcCBEv.exe
  2⤵
  PID:10544
- C:\Windows\System\aEkTmeK.exe
  C:\Windows\System\aEkTmeK.exe
  2⤵
  PID:1504
- C:\Windows\System\GdMCRZN.exe
  C:\Windows\System\GdMCRZN.exe
  2⤵
  PID:10908
- C:\Windows\System\IrGuADr.exe
  C:\Windows\System\IrGuADr.exe
  2⤵
  PID:11028
- C:\Windows\System\RkADNFW.exe
  C:\Windows\System\RkADNFW.exe
  2⤵
  PID:11112
- C:\Windows\System\KxGwJoj.exe
  C:\Windows\System\KxGwJoj.exe
  2⤵
  PID:4348
- C:\Windows\System\bqlpBBZ.exe
  C:\Windows\System\bqlpBBZ.exe
  2⤵
  PID:11216
- C:\Windows\System\RgnUbIS.exe
  C:\Windows\System\RgnUbIS.exe
  2⤵
  PID:10360
- C:\Windows\System\FXZthni.exe
  C:\Windows\System\FXZthni.exe
  2⤵
  PID:2012
- C:\Windows\System\ZXPkFwc.exe
  C:\Windows\System\ZXPkFwc.exe
  2⤵
  PID:10872
- C:\Windows\System\lxBCjZL.exe
  C:\Windows\System\lxBCjZL.exe
  2⤵
  PID:11184
- C:\Windows\System\bSvqpLg.exe
  C:\Windows\System\bSvqpLg.exe
  2⤵
  PID:10384
- C:\Windows\System\ZkkHgka.exe
  C:\Windows\System\ZkkHgka.exe
  2⤵
  PID:11276
- C:\Windows\System\CfqXdlZ.exe
  C:\Windows\System\CfqXdlZ.exe
  2⤵
  PID:11296
- C:\Windows\System\swhELTf.exe
  C:\Windows\System\swhELTf.exe
  2⤵
  PID:11320
- C:\Windows\System\rHRBVBS.exe
  C:\Windows\System\rHRBVBS.exe
  2⤵
  PID:11364
- C:\Windows\System\FTNTwJP.exe
  C:\Windows\System\FTNTwJP.exe
  2⤵
  PID:11384
- C:\Windows\System\hOafGez.exe
  C:\Windows\System\hOafGez.exe
  2⤵
  PID:11404
- C:\Windows\System\NWNJTtr.exe
  C:\Windows\System\NWNJTtr.exe
  2⤵
  PID:11448
- C:\Windows\System\FMkICyd.exe
  C:\Windows\System\FMkICyd.exe
  2⤵
  PID:11472
- C:\Windows\System\zHjzKAF.exe
  C:\Windows\System\zHjzKAF.exe
  2⤵
  PID:11496
- C:\Windows\System\wfwDqoE.exe
  C:\Windows\System\wfwDqoE.exe
  2⤵
  PID:11532
- C:\Windows\System\DxgRbfE.exe
  C:\Windows\System\DxgRbfE.exe
  2⤵
  PID:11556
- C:\Windows\System\OVXFhUk.exe
  C:\Windows\System\OVXFhUk.exe
  2⤵
  PID:11576
- C:\Windows\System\SRYbxNN.exe
  C:\Windows\System\SRYbxNN.exe
  2⤵
  PID:11600
- C:\Windows\System\QnEmJJo.exe
  C:\Windows\System\QnEmJJo.exe
  2⤵
  PID:11616
- C:\Windows\System\PPqZOBV.exe
  C:\Windows\System\PPqZOBV.exe
  2⤵
  PID:11680
- C:\Windows\System\ZhwFrqQ.exe
  C:\Windows\System\ZhwFrqQ.exe
  2⤵
  PID:11716
- C:\Windows\System\HjAAthn.exe
  C:\Windows\System\HjAAthn.exe
  2⤵
  PID:11744
- C:\Windows\System\iwmHupu.exe
  C:\Windows\System\iwmHupu.exe
  2⤵
  PID:11764
- C:\Windows\System\hNaZaEE.exe
  C:\Windows\System\hNaZaEE.exe
  2⤵
  PID:11788
- C:\Windows\System\eMlVVCW.exe
  C:\Windows\System\eMlVVCW.exe
  2⤵
  PID:11804
- C:\Windows\System\PhbPalh.exe
  C:\Windows\System\PhbPalh.exe
  2⤵
  PID:11828
- C:\Windows\System\eJjzGbh.exe
  C:\Windows\System\eJjzGbh.exe
  2⤵
  PID:11852
- C:\Windows\System\qDLHmco.exe
  C:\Windows\System\qDLHmco.exe
  2⤵
  PID:11880
- C:\Windows\System\cNdtZax.exe
  C:\Windows\System\cNdtZax.exe
  2⤵
  PID:11908
- C:\Windows\System\WPTNBPf.exe
  C:\Windows\System\WPTNBPf.exe
  2⤵
  PID:11956
- C:\Windows\System\uTfqlOf.exe
  C:\Windows\System\uTfqlOf.exe
  2⤵
  PID:12000
- C:\Windows\System\BoJSqHA.exe
  C:\Windows\System\BoJSqHA.exe
  2⤵
  PID:12016
- C:\Windows\System\qTKGnAy.exe
  C:\Windows\System\qTKGnAy.exe
  2⤵
  PID:12068
- C:\Windows\System\xUzLwhl.exe
  C:\Windows\System\xUzLwhl.exe
  2⤵
  PID:12088
- C:\Windows\System\wjlOSYr.exe
  C:\Windows\System\wjlOSYr.exe
  2⤵
  PID:12136
- C:\Windows\System\tJMRCYS.exe
  C:\Windows\System\tJMRCYS.exe
  2⤵
  PID:12156
- C:\Windows\System\hERHEXS.exe
  C:\Windows\System\hERHEXS.exe
  2⤵
  PID:12184
- C:\Windows\System\AMHDJTX.exe
  C:\Windows\System\AMHDJTX.exe
  2⤵
  PID:12204
- C:\Windows\System\iPBZXLf.exe
  C:\Windows\System\iPBZXLf.exe
  2⤵
  PID:12232
- C:\Windows\System\FkHjuwh.exe
  C:\Windows\System\FkHjuwh.exe
  2⤵
  PID:12256
- C:\Windows\System\nkaFRFL.exe
  C:\Windows\System\nkaFRFL.exe
  2⤵
  PID:12284
- C:\Windows\System\AmbRyej.exe
  C:\Windows\System\AmbRyej.exe
  2⤵
  PID:4392
- C:\Windows\System\gWhGnsE.exe
  C:\Windows\System\gWhGnsE.exe
  2⤵
  PID:11336
- C:\Windows\System\QSgHLIs.exe
  C:\Windows\System\QSgHLIs.exe
  2⤵
  PID:11392
- C:\Windows\System\llKyPbV.exe
  C:\Windows\System\llKyPbV.exe
  2⤵
  PID:11444
- C:\Windows\System\ApUKTvD.exe
  C:\Windows\System\ApUKTvD.exe
  2⤵
  PID:11508
- C:\Windows\System\PUdBRFG.exe
  C:\Windows\System\PUdBRFG.exe
  2⤵
  PID:11572
- C:\Windows\System\XXOHSZT.exe
  C:\Windows\System\XXOHSZT.exe
  2⤵
  PID:11596
- C:\Windows\System\EHkJROA.exe
  C:\Windows\System\EHkJROA.exe
  2⤵
  PID:11664
- C:\Windows\System\xiobyfJ.exe
  C:\Windows\System\xiobyfJ.exe
  2⤵
  PID:11752
- C:\Windows\System\BJYbJKM.exe
  C:\Windows\System\BJYbJKM.exe
  2⤵
  PID:11836
- C:\Windows\System\zRTsJEk.exe
  C:\Windows\System\zRTsJEk.exe
  2⤵
  PID:11864
- C:\Windows\System\cMToTmh.exe
  C:\Windows\System\cMToTmh.exe
  2⤵
  PID:11900
- C:\Windows\System\nLjkLkx.exe
  C:\Windows\System\nLjkLkx.exe
  2⤵
  PID:12024
- C:\Windows\System\vSJClwe.exe
  C:\Windows\System\vSJClwe.exe
  2⤵
  PID:12076
- C:\Windows\System\wUaMgjV.exe
  C:\Windows\System\wUaMgjV.exe
  2⤵
  PID:12128
- C:\Windows\System\wtiUdpJ.exe
  C:\Windows\System\wtiUdpJ.exe
  2⤵
  PID:12180
- C:\Windows\System\rBVoRvE.exe
  C:\Windows\System\rBVoRvE.exe
  2⤵
  PID:12240
- C:\Windows\System\ReJNbiw.exe
  C:\Windows\System\ReJNbiw.exe
  2⤵
  PID:4012
- C:\Windows\System\uXEVMcG.exe
  C:\Windows\System\uXEVMcG.exe
  2⤵
  PID:11420
- C:\Windows\System\pNUMfak.exe
  C:\Windows\System\pNUMfak.exe
  2⤵
  PID:11484
- C:\Windows\System\FIEOjQT.exe
  C:\Windows\System\FIEOjQT.exe
  2⤵
  PID:11588
- C:\Windows\System\fPXWKJz.exe
  C:\Windows\System\fPXWKJz.exe
  2⤵
  PID:11784
- C:\Windows\System\HdJRToC.exe
  C:\Windows\System\HdJRToC.exe
  2⤵
  PID:3188
- C:\Windows\System\CdphJaL.exe
  C:\Windows\System\CdphJaL.exe
  2⤵
  PID:12060
- C:\Windows\System\wWuWtVh.exe
  C:\Windows\System\wWuWtVh.exe
  2⤵
  PID:4524
- C:\Windows\System\bexCmNB.exe
  C:\Windows\System\bexCmNB.exe
  2⤵
  PID:11288
- C:\Windows\System\HieHrGH.exe
  C:\Windows\System\HieHrGH.exe
  2⤵
  PID:11656
- C:\Windows\System\qxBZHHq.exe
  C:\Windows\System\qxBZHHq.exe
  2⤵
  PID:11672
- C:\Windows\System\zdiTKrf.exe
  C:\Windows\System\zdiTKrf.exe
  2⤵
  PID:3952
- C:\Windows\System\AeHjwuY.exe
  C:\Windows\System\AeHjwuY.exe
  2⤵
  PID:11464
- C:\Windows\System\QFbxNDt.exe
  C:\Windows\System\QFbxNDt.exe
  2⤵
  PID:11800
- C:\Windows\System\hVcVYUe.exe
  C:\Windows\System\hVcVYUe.exe
  2⤵
  PID:3652
- C:\Windows\System\LQzpjxO.exe
  C:\Windows\System\LQzpjxO.exe
  2⤵
  PID:12332
- C:\Windows\System\yDViLUD.exe
  C:\Windows\System\yDViLUD.exe
  2⤵
  PID:12356
- C:\Windows\System\YNbDdjT.exe
  C:\Windows\System\YNbDdjT.exe
  2⤵
  PID:12384
- C:\Windows\System\ANcUUvU.exe
  C:\Windows\System\ANcUUvU.exe
  2⤵
  PID:12404
- C:\Windows\System\KJSdFjR.exe
  C:\Windows\System\KJSdFjR.exe
  2⤵
  PID:12428
- C:\Windows\System\ITfhTxz.exe
  C:\Windows\System\ITfhTxz.exe
  2⤵
  PID:12444
- C:\Windows\System\GjKGoAk.exe
  C:\Windows\System\GjKGoAk.exe
  2⤵
  PID:12492
- C:\Windows\System\BPfhOxP.exe
  C:\Windows\System\BPfhOxP.exe
  2⤵
  PID:12520
- C:\Windows\System\wDXhwMH.exe
  C:\Windows\System\wDXhwMH.exe
  2⤵
  PID:12544
- C:\Windows\System\MQwsRCI.exe
  C:\Windows\System\MQwsRCI.exe
  2⤵
  PID:12564
- C:\Windows\System\DhskMBz.exe
  C:\Windows\System\DhskMBz.exe
  2⤵
  PID:12584
- C:\Windows\System\kgBSNhG.exe
  C:\Windows\System\kgBSNhG.exe
  2⤵
  PID:12608
- C:\Windows\System\BPPVAxk.exe
  C:\Windows\System\BPPVAxk.exe
  2⤵
  PID:12624
- C:\Windows\System\KTtmHtb.exe
  C:\Windows\System\KTtmHtb.exe
  2⤵
  PID:12648
- C:\Windows\System\gpmXLxr.exe
  C:\Windows\System\gpmXLxr.exe
  2⤵
  PID:12692
- C:\Windows\System\nALFZZd.exe
  C:\Windows\System\nALFZZd.exe
  2⤵
  PID:12712
- C:\Windows\System\JywYpIz.exe
  C:\Windows\System\JywYpIz.exe
  2⤵
  PID:12732
- C:\Windows\System\kHqWcVq.exe
  C:\Windows\System\kHqWcVq.exe
  2⤵
  PID:12756
- C:\Windows\System\KdYXVXP.exe
  C:\Windows\System\KdYXVXP.exe
  2⤵
  PID:12776
- C:\Windows\System\dDRpNjo.exe
  C:\Windows\System\dDRpNjo.exe
  2⤵
  PID:12792
- C:\Windows\System\aBPtJZE.exe
  C:\Windows\System\aBPtJZE.exe
  2⤵
  PID:12812
- C:\Windows\System\kuvqIxQ.exe
  C:\Windows\System\kuvqIxQ.exe
  2⤵
  PID:12836
- C:\Windows\System\dQErMgo.exe
  C:\Windows\System\dQErMgo.exe
  2⤵
  PID:12860
- C:\Windows\System\uUpXlCF.exe
  C:\Windows\System\uUpXlCF.exe
  2⤵
  PID:12912
- C:\Windows\System\svatYJH.exe
  C:\Windows\System\svatYJH.exe
  2⤵
  PID:12932
- C:\Windows\System\gEvzSQS.exe
  C:\Windows\System\gEvzSQS.exe
  2⤵
  PID:12960
- C:\Windows\System\cgJPoge.exe
  C:\Windows\System\cgJPoge.exe
  2⤵
  PID:13000
- C:\Windows\System\KRDVlCm.exe
  C:\Windows\System\KRDVlCm.exe
  2⤵
  PID:13028
- C:\Windows\System\hUfrHTL.exe
  C:\Windows\System\hUfrHTL.exe
  2⤵
  PID:13052
- C:\Windows\System\qygtxdw.exe
  C:\Windows\System\qygtxdw.exe
  2⤵
  PID:13080
- C:\Windows\System\vkKPAoH.exe
  C:\Windows\System\vkKPAoH.exe
  2⤵
  PID:13104
- C:\Windows\System\ygsvumX.exe
  C:\Windows\System\ygsvumX.exe
  2⤵
  PID:13120
- C:\Windows\System\IeJSLyH.exe
  C:\Windows\System\IeJSLyH.exe
  2⤵
  PID:13144
- C:\Windows\System\dHKWhUs.exe
  C:\Windows\System\dHKWhUs.exe
  2⤵
  PID:13172
- C:\Windows\System\CEbSgbO.exe
  C:\Windows\System\CEbSgbO.exe
  2⤵
  PID:13200
- C:\Windows\System\UiNkyer.exe
  C:\Windows\System\UiNkyer.exe
  2⤵
  PID:13220
- C:\Windows\System\QZLicRz.exe
  C:\Windows\System\QZLicRz.exe
  2⤵
  PID:13244
- C:\Windows\System\MCMlAwG.exe
  C:\Windows\System\MCMlAwG.exe
  2⤵
  PID:13260
- C:\Windows\System\WGnycvO.exe
  C:\Windows\System\WGnycvO.exe
  2⤵
  PID:13280
- C:\Windows\System\CZFhesR.exe
  C:\Windows\System\CZFhesR.exe
  2⤵
  PID:13300
- C:\Windows\System\PJtiidm.exe
  C:\Windows\System\PJtiidm.exe
  2⤵
  PID:12152
- C:\Windows\System\bIApPyQ.exe
  C:\Windows\System\bIApPyQ.exe
  2⤵
  PID:12324
- C:\Windows\System\nvwklPq.exe
  C:\Windows\System\nvwklPq.exe
  2⤵
  PID:12396
- C:\Windows\System\kgcNOah.exe
  C:\Windows\System\kgcNOah.exe
  2⤵
  PID:13188
- C:\Windows\System\OMmJtsd.exe
  C:\Windows\System\OMmJtsd.exe
  2⤵
  PID:13216
- C:\Windows\System\fKHmYfc.exe
  C:\Windows\System\fKHmYfc.exe
  2⤵
  PID:13292
- C:\Windows\System\VzXQwcP.exe
  C:\Windows\System\VzXQwcP.exe
  2⤵
  PID:12420
- C:\Windows\System\JXbdQDV.exe
  C:\Windows\System\JXbdQDV.exe
  2⤵
  PID:12488
- C:\Windows\System\qdvYAmb.exe
  C:\Windows\System\qdvYAmb.exe
  2⤵
  PID:12752
- C:\Windows\System\zbjeXbN.exe
  C:\Windows\System\zbjeXbN.exe
  2⤵
  PID:12948
- C:\Windows\System\ASOFqEm.exe
  C:\Windows\System\ASOFqEm.exe
  2⤵
  PID:12560
- C:\Windows\System\DDHyRxV.exe
  C:\Windows\System\DDHyRxV.exe
  2⤵
  PID:4788
- C:\Windows\System\wwHeoZc.exe
  C:\Windows\System\wwHeoZc.exe
  2⤵
  PID:12924
- C:\Windows\System\QOkgGWh.exe
  C:\Windows\System\QOkgGWh.exe
  2⤵
  PID:9140
- C:\Windows\System\wHGtsUU.exe
  C:\Windows\System\wHGtsUU.exe
  2⤵
  PID:12972
- C:\Windows\System\fIbUjQm.exe
  C:\Windows\System\fIbUjQm.exe
  2⤵
  PID:13100
- C:\Windows\System\xluVdNn.exe
  C:\Windows\System\xluVdNn.exe
  2⤵
  PID:13128
- C:\Windows\System\bMhZBXq.exe
  C:\Windows\System\bMhZBXq.exe
  2⤵
  PID:13132
- C:\Windows\System\hmxxetR.exe
  C:\Windows\System\hmxxetR.exe
  2⤵
  PID:1452
- C:\Windows\System\kyIasgN.exe
  C:\Windows\System\kyIasgN.exe
  2⤵
  PID:13308
- C:\Windows\System\nYiVSLr.exe
  C:\Windows\System\nYiVSLr.exe
  2⤵
  PID:12412
- C:\Windows\System\XizmgLw.exe
  C:\Windows\System\XizmgLw.exe
  2⤵
  PID:12516
- C:\Windows\System\DXBXWnd.exe
  C:\Windows\System\DXBXWnd.exe
  2⤵
  PID:12576
- C:\Windows\System\IMbAKAM.exe
  C:\Windows\System\IMbAKAM.exe
  2⤵
  PID:12504
- C:\Windows\System\cwOdYpq.exe
  C:\Windows\System\cwOdYpq.exe
  2⤵
  PID:12616
- C:\Windows\System\ARcnNVP.exe
  C:\Windows\System\ARcnNVP.exe
  2⤵
  PID:11612
- C:\Windows\System\HMqlgfj.exe
  C:\Windows\System\HMqlgfj.exe
  2⤵
  PID:12788
- C:\Windows\System\ElmqryF.exe
  C:\Windows\System\ElmqryF.exe
  2⤵
  PID:6892
- C:\Windows\System\VSBrDaU.exe
  C:\Windows\System\VSBrDaU.exe
  2⤵
  PID:4004
- C:\Windows\System\YULGwgH.exe
  C:\Windows\System\YULGwgH.exe
  2⤵
  PID:5084
- C:\Windows\System\IvFKFEL.exe
  C:\Windows\System\IvFKFEL.exe
  2⤵
  PID:860
- C:\Windows\System\mRpfUmL.exe
  C:\Windows\System\mRpfUmL.exe
  2⤵
  PID:2688
- C:\Windows\System\lrHjfAT.exe
  C:\Windows\System\lrHjfAT.exe
  2⤵
  PID:4388
- C:\Windows\System\dHOTkrY.exe
  C:\Windows\System\dHOTkrY.exe
  2⤵
  PID:12308
- C:\Windows\System\hODvdvn.exe
  C:\Windows\System\hODvdvn.exe
  2⤵
  PID:3312
- C:\Windows\System\rUHukVf.exe
  C:\Windows\System\rUHukVf.exe
  2⤵
  PID:3488
- C:\Windows\System\JHZwuJu.exe
  C:\Windows\System\JHZwuJu.exe
  2⤵
  PID:12920
- C:\Windows\System\kRXfPuW.exe
  C:\Windows\System\kRXfPuW.exe
  2⤵
  PID:12852
- C:\Windows\System\xSzNbwE.exe
  C:\Windows\System\xSzNbwE.exe
  2⤵
  PID:3216
- C:\Windows\System\wflaCAE.exe
  C:\Windows\System\wflaCAE.exe
  2⤵
  PID:13012
- C:\Windows\System\gViOAuc.exe
  C:\Windows\System\gViOAuc.exe
  2⤵
  PID:2924
- C:\Windows\System\meFdoet.exe
  C:\Windows\System\meFdoet.exe
  2⤵
  PID:12344
- C:\Windows\System\roebzeg.exe
  C:\Windows\System\roebzeg.exe
  2⤵
  PID:12704
- C:\Windows\System\lWQMbxk.exe
  C:\Windows\System\lWQMbxk.exe
  2⤵
  PID:12784
- C:\Windows\System\RNJUFVL.exe
  C:\Windows\System\RNJUFVL.exe
  2⤵
  PID:1828
- C:\Windows\System\oZIrHbG.exe
  C:\Windows\System\oZIrHbG.exe
  2⤵
  PID:2444
- C:\Windows\System\zgostNO.exe
  C:\Windows\System\zgostNO.exe
  2⤵
  PID:12096
- C:\Windows\System\BHmVIUR.exe
  C:\Windows\System\BHmVIUR.exe
  2⤵
  PID:12900
- C:\Windows\System\JxuHCiy.exe
  C:\Windows\System\JxuHCiy.exe
  2⤵
  PID:5044
- C:\Windows\System\ZDjXWUi.exe
  C:\Windows\System\ZDjXWUi.exe
  2⤵
  PID:13252
- C:\Windows\System\MTvgYll.exe
  C:\Windows\System\MTvgYll.exe
  2⤵
  PID:12508
- C:\Windows\System\yQFAWHM.exe
  C:\Windows\System\yQFAWHM.exe
  2⤵
  PID:3052
- C:\Windows\System\TuzstWj.exe
  C:\Windows\System\TuzstWj.exe
  2⤵
  PID:2260
- C:\Windows\System\IQnOrgO.exe
  C:\Windows\System\IQnOrgO.exe
  2⤵
  PID:12620
- C:\Windows\System\otzbein.exe
  C:\Windows\System\otzbein.exe
  2⤵
  PID:10672
- C:\Windows\System\aqYJWRj.exe
  C:\Windows\System\aqYJWRj.exe
  2⤵
  PID:4508
- C:\Windows\System\hxcpNmc.exe
  C:\Windows\System\hxcpNmc.exe
  2⤵
  PID:13068
- C:\Windows\System\ueQTQPT.exe
  C:\Windows\System\ueQTQPT.exe
  2⤵
  PID:13276
- C:\Windows\System\nrdbVhS.exe
  C:\Windows\System\nrdbVhS.exe
  2⤵
  PID:13324
- C:\Windows\System\elEaUFW.exe
  C:\Windows\System\elEaUFW.exe
  2⤵
  PID:13340
- C:\Windows\System\dcXMvsA.exe
  C:\Windows\System\dcXMvsA.exe
  2⤵
  PID:13356
- C:\Windows\System\DSjIUiZ.exe
  C:\Windows\System\DSjIUiZ.exe
  2⤵
  PID:13372
- C:\Windows\System\fHhdKPD.exe
  C:\Windows\System\fHhdKPD.exe
  2⤵
  PID:13388
- C:\Windows\System\hCwwKFj.exe
  C:\Windows\System\hCwwKFj.exe
  2⤵
  PID:13404
- C:\Windows\System\gbDiaPr.exe
  C:\Windows\System\gbDiaPr.exe
  2⤵
  PID:13424
- C:\Windows\System\YPubzCZ.exe
  C:\Windows\System\YPubzCZ.exe
  2⤵
  PID:13524
- C:\Windows\System\dwROgmw.exe
  C:\Windows\System\dwROgmw.exe
  2⤵
  PID:13540
- C:\Windows\System\ChTHBZH.exe
  C:\Windows\System\ChTHBZH.exe
  2⤵
  PID:13556
- C:\Windows\System\ioSTKVZ.exe
  C:\Windows\System\ioSTKVZ.exe
  2⤵
  PID:13576
- C:\Windows\System\vTkwjph.exe
  C:\Windows\System\vTkwjph.exe
  2⤵
  PID:13596
- C:\Windows\System\jaJvHXv.exe
  C:\Windows\System\jaJvHXv.exe
  2⤵
  PID:13616
- C:\Windows\System\wZCUnoB.exe
  C:\Windows\System\wZCUnoB.exe
  2⤵
  PID:13632
- C:\Windows\System\DZButvJ.exe
  C:\Windows\System\DZButvJ.exe
  2⤵
  PID:13648
- C:\Windows\System\kBgxHoZ.exe
  C:\Windows\System\kBgxHoZ.exe
  2⤵
  PID:13668
- C:\Windows\System\YeKGFKE.exe
  C:\Windows\System\YeKGFKE.exe
  2⤵
  PID:13684
- C:\Windows\System\RDzzTYU.exe
  C:\Windows\System\RDzzTYU.exe
  2⤵
  PID:13716
- C:\Windows\System\wtjEWzs.exe
  C:\Windows\System\wtjEWzs.exe
  2⤵
  PID:13732
- C:\Windows\System\AJLiGxE.exe
  C:\Windows\System\AJLiGxE.exe
  2⤵
  PID:13752
- C:\Windows\System\GurjMaG.exe
  C:\Windows\System\GurjMaG.exe
  2⤵
  PID:13780
- C:\Windows\System\MdDOWws.exe
  C:\Windows\System\MdDOWws.exe
  2⤵
  PID:13796
- C:\Windows\System\dYJvXZD.exe
  C:\Windows\System\dYJvXZD.exe
  2⤵
  PID:13812
- C:\Windows\System\bDFXpnU.exe
  C:\Windows\System\bDFXpnU.exe
  2⤵
  PID:13836
- C:\Windows\System\SBicxso.exe
  C:\Windows\System\SBicxso.exe
  2⤵
  PID:13852
- C:\Windows\System\NMMXrQG.exe
  C:\Windows\System\NMMXrQG.exe
  2⤵
  PID:13868
- C:\Windows\System\gaCrwcq.exe
  C:\Windows\System\gaCrwcq.exe
  2⤵
  PID:13884
- C:\Windows\System\iBAgGxa.exe
  C:\Windows\System\iBAgGxa.exe
  2⤵
  PID:13900
- C:\Windows\System\yaBykcd.exe
  C:\Windows\System\yaBykcd.exe
  2⤵
  PID:13920
- C:\Windows\System\LsBnfed.exe
  C:\Windows\System\LsBnfed.exe
  2⤵
  PID:13960
- C:\Windows\System\vrDOSet.exe
  C:\Windows\System\vrDOSet.exe
  2⤵
  PID:13980
- C:\Windows\System\fabDGEt.exe
  C:\Windows\System\fabDGEt.exe
  2⤵
  PID:13996
- C:\Windows\System\isWsYjZ.exe
  C:\Windows\System\isWsYjZ.exe
  2⤵
  PID:14020
- C:\Windows\System\voLRmXr.exe
  C:\Windows\System\voLRmXr.exe
  2⤵
  PID:14048
- C:\Windows\System\OuyIVcA.exe
  C:\Windows\System\OuyIVcA.exe
  2⤵
  PID:14072
- C:\Windows\System\shcXfZj.exe
  C:\Windows\System\shcXfZj.exe
  2⤵
  PID:14092
- C:\Windows\System\dUlPExf.exe
  C:\Windows\System\dUlPExf.exe
  2⤵
  PID:14108
- C:\Windows\System\KOTfnSY.exe
  C:\Windows\System\KOTfnSY.exe
  2⤵
  PID:14124
- C:\Windows\System\fRpOobb.exe
  C:\Windows\System\fRpOobb.exe
  2⤵
  PID:14140
- C:\Windows\System\lsdQeuC.exe
  C:\Windows\System\lsdQeuC.exe
  2⤵
  PID:14156
- C:\Windows\System\SHqnGQs.exe
  C:\Windows\System\SHqnGQs.exe
  2⤵
  PID:14172
- C:\Windows\System\gJOvDst.exe
  C:\Windows\System\gJOvDst.exe
  2⤵
  PID:14188
- C:\Windows\System\AEbMdfS.exe
  C:\Windows\System\AEbMdfS.exe
  2⤵
  PID:14208
- C:\Windows\System\yVusOAC.exe
  C:\Windows\System\yVusOAC.exe
  2⤵
  PID:14224
- C:\Windows\System\XDBazyY.exe
  C:\Windows\System\XDBazyY.exe
  2⤵
  PID:14240
- C:\Windows\System\ikFQQNd.exe
  C:\Windows\System\ikFQQNd.exe
  2⤵
  PID:14328
- C:\Windows\System\TzRWOsY.exe
  C:\Windows\System\TzRWOsY.exe
  2⤵
  PID:13332
- C:\Windows\System\VSUGUOW.exe
  C:\Windows\System\VSUGUOW.exe
  2⤵
  PID:13368
- C:\Windows\System\peEfHAx.exe
  C:\Windows\System\peEfHAx.exe
  2⤵
  PID:13448
- C:\Windows\System\hKTZJuz.exe
  C:\Windows\System\hKTZJuz.exe
  2⤵
  PID:13476
- C:\Windows\System\LBimqLH.exe
  C:\Windows\System\LBimqLH.exe
  2⤵
  PID:13444
- C:\Windows\System\xXWWbKD.exe
  C:\Windows\System\xXWWbKD.exe
  2⤵
  PID:13488
- C:\Windows\System\niLseuH.exe
  C:\Windows\System\niLseuH.exe
  2⤵
  PID:13564
- C:\Windows\System\LKPspFt.exe
  C:\Windows\System\LKPspFt.exe
  2⤵
  PID:13604
- C:\Windows\System\rEqaDSA.exe
  C:\Windows\System\rEqaDSA.exe
  2⤵
  PID:13664
- C:\Windows\System\KogQotS.exe
  C:\Windows\System\KogQotS.exe
  2⤵
  PID:13608
- C:\Windows\System\bEMrgPk.exe
  C:\Windows\System\bEMrgPk.exe
  2⤵
  PID:13724
- C:\Windows\System\NtpMzYL.exe
  C:\Windows\System\NtpMzYL.exe
  2⤵
  PID:13776
- C:\Windows\System\jeHXJBk.exe
  C:\Windows\System\jeHXJBk.exe
  2⤵
  PID:13808
- C:\Windows\System\bQkyrmm.exe
  C:\Windows\System\bQkyrmm.exe
  2⤵
  PID:13844
- C:\Windows\System\HOajzkA.exe
  C:\Windows\System\HOajzkA.exe
  2⤵
  PID:13876
- C:\Windows\System\bWsUNLI.exe
  C:\Windows\System\bWsUNLI.exe
  2⤵
  PID:13916
- C:\Windows\System\mGQELnQ.exe
  C:\Windows\System\mGQELnQ.exe
  2⤵
  PID:13992
- C:\Windows\System\jklSade.exe
  C:\Windows\System\jklSade.exe
  2⤵
  PID:14068
- C:\Windows\System\ZdmAxbd.exe
  C:\Windows\System\ZdmAxbd.exe
  2⤵
  PID:14232
- C:\Windows\System\ePXhgpg.exe
  C:\Windows\System\ePXhgpg.exe
  2⤵
  PID:14280
- C:\Windows\System\dkUOYcH.exe
  C:\Windows\System\dkUOYcH.exe
  2⤵
  PID:14296
- C:\Windows\System\zNOeIsS.exe
  C:\Windows\System\zNOeIsS.exe
  2⤵
  PID:14152
- C:\Windows\System\XiQlyuG.exe
  C:\Windows\System\XiQlyuG.exe
  2⤵
  PID:14304
- C:\Windows\System\wFzywkL.exe
  C:\Windows\System\wFzywkL.exe
  2⤵
  PID:14292
- C:\Windows\System\FeDSzGb.exe
  C:\Windows\System\FeDSzGb.exe
  2⤵
  PID:14272
- C:\Windows\System\FpWHGoy.exe
  C:\Windows\System\FpWHGoy.exe
  2⤵
  PID:14308
- C:\Windows\System\THwMuDZ.exe
  C:\Windows\System\THwMuDZ.exe
  2⤵
  PID:1500
- C:\Windows\System\ZFSDmWv.exe
  C:\Windows\System\ZFSDmWv.exe
  2⤵
  PID:13504
- C:\Windows\System\GhFBiHm.exe
  C:\Windows\System\GhFBiHm.exe
  2⤵
  PID:13492
- C:\Windows\System\hVEXIpX.exe
  C:\Windows\System\hVEXIpX.exe
  2⤵
  PID:13644
- C:\Windows\System\THwEPYX.exe
  C:\Windows\System\THwEPYX.exe
  2⤵
  PID:13592
- C:\Windows\System\DuoRrDx.exe
  C:\Windows\System\DuoRrDx.exe
  2⤵
  PID:4712
- C:\Windows\System\yHKqjLL.exe
  C:\Windows\System\yHKqjLL.exe
  2⤵
  PID:14060
- C:\Windows\System\ZvbZASE.exe
  C:\Windows\System\ZvbZASE.exe
  2⤵
  PID:14260
- C:\Windows\System\TAdhyaT.exe
  C:\Windows\System\TAdhyaT.exe
  2⤵
  PID:14300
- C:\Windows\System\SvUjseE.exe
  C:\Windows\System\SvUjseE.exe
  2⤵
  PID:14104
- C:\Windows\System\dalIaYA.exe
  C:\Windows\System\dalIaYA.exe
  2⤵
  PID:14288
- C:\Windows\System\EPPljFF.exe
  C:\Windows\System\EPPljFF.exe
  2⤵
  PID:13416
- C:\Windows\System\NWuYevv.exe
  C:\Windows\System\NWuYevv.exe
  2⤵
  PID:13640
- C:\Windows\System\AunRLbx.exe
  C:\Windows\System\AunRLbx.exe
  2⤵
  PID:13680
- C:\Windows\System\AUZazOz.exe
  C:\Windows\System\AUZazOz.exe
  2⤵
  PID:13848
- C:\Windows\System\TqqsNUe.exe
  C:\Windows\System\TqqsNUe.exe
  2⤵
  PID:13952
- C:\Windows\System\wOvLXDX.exe
  C:\Windows\System\wOvLXDX.exe
  2⤵
  PID:14120
- C:\Windows\System\tMhIOXQ.exe
  C:\Windows\System\tMhIOXQ.exe
  2⤵
  PID:14276
- C:\Windows\System\ikglrvf.exe
  C:\Windows\System\ikglrvf.exe
  2⤵
  PID:13352
- C:\Windows\System\ZxwJqNi.exe
  C:\Windows\System\ZxwJqNi.exe
  2⤵
  PID:13744
- C:\Windows\System\rtifFYh.exe
  C:\Windows\System\rtifFYh.exe
  2⤵
  PID:13896
- C:\Windows\System\pNvkFck.exe
  C:\Windows\System\pNvkFck.exe
  2⤵
  PID:14064
- C:\Windows\System\DdJfqRd.exe
  C:\Windows\System\DdJfqRd.exe
  2⤵
  PID:13740
- C:\Windows\System\vThzIOh.exe
  C:\Windows\System\vThzIOh.exe
  2⤵
  PID:14196
- C:\Windows\System\FOVPWEB.exe
  C:\Windows\System\FOVPWEB.exe
  2⤵
  PID:13412
- C:\Windows\System\lHBaBZv.exe
  C:\Windows\System\lHBaBZv.exe
  2⤵
  PID:14352
- C:\Windows\System\tkiLlmQ.exe
  C:\Windows\System\tkiLlmQ.exe
  2⤵
  PID:14384
- C:\Windows\System\GtXomNp.exe
  C:\Windows\System\GtXomNp.exe
  2⤵
  PID:14420
- C:\Windows\System\pCHNyna.exe
  C:\Windows\System\pCHNyna.exe
  2⤵
  PID:14448
- C:\Windows\System\QrVSnpp.exe
  C:\Windows\System\QrVSnpp.exe
  2⤵
  PID:14472
- C:\Windows\System\TShQPdk.exe
  C:\Windows\System\TShQPdk.exe
  2⤵
  PID:14492
- C:\Windows\System\drePptw.exe
  C:\Windows\System\drePptw.exe
  2⤵
  PID:15276
- C:\Windows\System\RhHctIu.exe
  C:\Windows\System\RhHctIu.exe
  2⤵
  PID:15292
- C:\Windows\System\falfuNF.exe
  C:\Windows\System\falfuNF.exe
  2⤵
  PID:15308
- C:\Windows\System\LBsseuk.exe
  C:\Windows\System\LBsseuk.exe
  2⤵
  PID:15324
- C:\Windows\System\nTpsogz.exe
  C:\Windows\System\nTpsogz.exe
  2⤵
  PID:15340
- C:\Windows\System\UyNYZFX.exe
  C:\Windows\System\UyNYZFX.exe
  2⤵
  PID:15356
- C:\Windows\System\gpHmbqB.exe
  C:\Windows\System\gpHmbqB.exe
  2⤵
  PID:14360
- C:\Windows\System\sJNgIfE.exe
  C:\Windows\System\sJNgIfE.exe
  2⤵
  PID:14372
- C:\Windows\System\OiyPaAK.exe
  C:\Windows\System\OiyPaAK.exe
  2⤵
  PID:14936
- C:\Windows\System\ovLGAgG.exe
  C:\Windows\System\ovLGAgG.exe
  2⤵
  PID:14952
- C:\Windows\System\lqMebDo.exe
  C:\Windows\System\lqMebDo.exe
  2⤵
  PID:14984
- C:\Windows\System\aTPVbOs.exe
  C:\Windows\System\aTPVbOs.exe
  2⤵
  PID:14976
- C:\Windows\System\ehShvqJ.exe
  C:\Windows\System\ehShvqJ.exe
  2⤵
  PID:15004
- C:\Windows\System\HUQVkUw.exe
  C:\Windows\System\HUQVkUw.exe
  2⤵
  PID:15020
- C:\Windows\System\UFkZuQZ.exe
  C:\Windows\System\UFkZuQZ.exe
  2⤵
  PID:15036
- C:\Windows\System\XYEcqku.exe
  C:\Windows\System\XYEcqku.exe
  2⤵
  PID:15056
- C:\Windows\System\OmMUKHh.exe
  C:\Windows\System\OmMUKHh.exe
  2⤵
  PID:15072
- C:\Windows\System\nWMNsoH.exe
  C:\Windows\System\nWMNsoH.exe
  2⤵
  PID:15092
- C:\Windows\System\JoFBcnj.exe
  C:\Windows\System\JoFBcnj.exe
  2⤵
  PID:15104
- C:\Windows\System\sKhdeVL.exe
  C:\Windows\System\sKhdeVL.exe
  2⤵
  PID:15120
- C:\Windows\System\bORAKZk.exe
  C:\Windows\System\bORAKZk.exe
  2⤵
  PID:15136
- C:\Windows\System\oLULkzk.exe
  C:\Windows\System\oLULkzk.exe
  2⤵
  PID:15152
- C:\Windows\System\UmLLHZE.exe
  C:\Windows\System\UmLLHZE.exe
  2⤵
  PID:15172
- C:\Windows\System\AXMjudI.exe
  C:\Windows\System\AXMjudI.exe
  2⤵
  PID:15196
- C:\Windows\System\JKPBulh.exe
  C:\Windows\System\JKPBulh.exe
  2⤵
  PID:15224
- C:\Windows\System\obzCeSw.exe
  C:\Windows\System\obzCeSw.exe
  2⤵
  PID:15240
- C:\Windows\System\LIYKIpj.exe
  C:\Windows\System\LIYKIpj.exe
  2⤵
  PID:14652
- C:\Windows\System\FLuzHkm.exe
  C:\Windows\System\FLuzHkm.exe
  2⤵
  PID:4308
- C:\Windows\System\SiQnCDi.exe
  C:\Windows\System\SiQnCDi.exe
  2⤵
  PID:14680
- C:\Windows\System\mFBujCG.exe
  C:\Windows\System\mFBujCG.exe
  2⤵
  PID:14700
- C:\Windows\System\kmyThoN.exe
  C:\Windows\System\kmyThoN.exe
  2⤵
  PID:14716
- C:\Windows\System\nOzIfRE.exe
  C:\Windows\System\nOzIfRE.exe
  2⤵
  PID:14740
- C:\Windows\System\fxgLPCe.exe
  C:\Windows\System\fxgLPCe.exe
  2⤵
  PID:14728
- C:\Windows\System\ZPrWAST.exe
  C:\Windows\System\ZPrWAST.exe
  2⤵
  PID:14756
- C:\Windows\System\cawHmOq.exe
  C:\Windows\System\cawHmOq.exe
  2⤵
  PID:14768
- C:\Windows\System\NfVMlyI.exe
  C:\Windows\System\NfVMlyI.exe
  2⤵
  PID:14780
- C:\Windows\System\Caaysbf.exe
  C:\Windows\System\Caaysbf.exe
  2⤵
  PID:14800
- C:\Windows\System\oRBRYEA.exe
  C:\Windows\System\oRBRYEA.exe
  2⤵
  PID:14812
- C:\Windows\System\dLBHuqG.exe
  C:\Windows\System\dLBHuqG.exe
  2⤵
  PID:13880
- C:\Windows\System\YPEDaxg.exe
  C:\Windows\System\YPEDaxg.exe
  2⤵
  PID:14828
- C:\Windows\System\qyEVTcz.exe
  C:\Windows\System\qyEVTcz.exe
  2⤵
  PID:14832
- C:\Windows\System\oxNUbLl.exe
  C:\Windows\System\oxNUbLl.exe
  2⤵
  PID:14840
- C:\Windows\System\AYucWsf.exe
  C:\Windows\System\AYucWsf.exe
  2⤵
  PID:14864
- C:\Windows\System\ctRaeuy.exe
  C:\Windows\System\ctRaeuy.exe
  2⤵
  PID:14892
- C:\Windows\System\mNFwCBk.exe
  C:\Windows\System\mNFwCBk.exe
  2⤵
  PID:4136
- C:\Windows\System\xbZFXLE.exe
  C:\Windows\System\xbZFXLE.exe
  2⤵
  PID:14912
- C:\Windows\System\xImahqV.exe
  C:\Windows\System\xImahqV.exe
  2⤵
  PID:14872
- C:\Windows\System\iaEQrSA.exe
  C:\Windows\System\iaEQrSA.exe
  2⤵
  PID:14972
- C:\Windows\System\FbvjDSj.exe
  C:\Windows\System\FbvjDSj.exe
  2⤵
  PID:14996
- C:\Windows\System\ahucESe.exe
  C:\Windows\System\ahucESe.exe
  2⤵
  PID:5752
- C:\Windows\System\cIQTMPO.exe
  C:\Windows\System\cIQTMPO.exe
  2⤵
  PID:3628
- C:\Windows\System\kAtYWux.exe
  C:\Windows\System\kAtYWux.exe
  2⤵
  PID:3424
- C:\Windows\System\TdOvMKz.exe
  C:\Windows\System\TdOvMKz.exe
  2⤵
  PID:2948
- C:\Windows\System\cSMVxPX.exe
  C:\Windows\System\cSMVxPX.exe
  2⤵
  PID:15160
- C:\Windows\System\tvpjXqL.exe
  C:\Windows\System\tvpjXqL.exe
  2⤵
  PID:6156
- C:\Windows\System\XZzCeuP.exe
  C:\Windows\System\XZzCeuP.exe
  2⤵
  PID:3260
- C:\Windows\System\PzdCZQI.exe
  C:\Windows\System\PzdCZQI.exe
  2⤵
  PID:1584
- C:\Windows\System\TRYSNTH.exe
  C:\Windows\System\TRYSNTH.exe
  2⤵
  PID:3764
- C:\Windows\System\epKsYQx.exe
  C:\Windows\System\epKsYQx.exe
  2⤵
  PID:12572
- C:\Windows\System\xuogRFz.exe
  C:\Windows\System\xuogRFz.exe
  2⤵
  PID:12456
- C:\Windows\System\hpajYPC.exe
  C:\Windows\System\hpajYPC.exe
  2⤵
  PID:6364
- C:\Windows\System\HlgBJJv.exe
  C:\Windows\System\HlgBJJv.exe
  2⤵
  PID:15320
- C:\Windows\System\diJXMRT.exe
  C:\Windows\System\diJXMRT.exe
  2⤵
  PID:15348
- C:\Windows\System\LTqoVqL.exe
  C:\Windows\System\LTqoVqL.exe
  2⤵
  PID:5356
- C:\Windows\System\cBidfag.exe
  C:\Windows\System\cBidfag.exe
  2⤵
  PID:14340
- C:\Windows\System\WkVZTdL.exe
  C:\Windows\System\WkVZTdL.exe
  2⤵
  PID:14364
- C:\Windows\System\jqPmylv.exe
  C:\Windows\System\jqPmylv.exe
  2⤵
  PID:14428
- C:\Windows\System\VLluWub.exe
  C:\Windows\System\VLluWub.exe
  2⤵
  PID:5448
- C:\Windows\System\aEIkWmg.exe
  C:\Windows\System\aEIkWmg.exe
  2⤵
  PID:14456
- C:\Windows\System\MeYvplZ.exe
  C:\Windows\System\MeYvplZ.exe
  2⤵
  PID:14500
- C:\Windows\System\GSLLpAH.exe
  C:\Windows\System\GSLLpAH.exe
  2⤵
  PID:5484
- C:\Windows\System\GJAKdtr.exe
  C:\Windows\System\GJAKdtr.exe
  2⤵
  PID:14524
- C:\Windows\System\xQWazvj.exe
  C:\Windows\System\xQWazvj.exe
  2⤵
  PID:14540
- C:\Windows\System\wfoFWZT.exe
  C:\Windows\System\wfoFWZT.exe
  2⤵
  PID:14560
- C:\Windows\System\QaKSQIE.exe
  C:\Windows\System\QaKSQIE.exe
  2⤵
  PID:14568
- C:\Windows\System\JBPttBd.exe
  C:\Windows\System\JBPttBd.exe
  2⤵
  PID:14584
- C:\Windows\System\ivhOJFe.exe
  C:\Windows\System\ivhOJFe.exe
  2⤵
  PID:14580
- C:\Windows\System\DGoUjYK.exe
  C:\Windows\System\DGoUjYK.exe
  2⤵
  PID:4488
- C:\Windows\System\VDznScq.exe
  C:\Windows\System\VDznScq.exe
  2⤵
  PID:14608
- C:\Windows\System\umWGcto.exe
  C:\Windows\System\umWGcto.exe
  2⤵
  PID:5584
- C:\Windows\System\eQnUVrz.exe
  C:\Windows\System\eQnUVrz.exe
  2⤵
  PID:3620
- C:\Windows\System\mgEcdDR.exe
  C:\Windows\System\mgEcdDR.exe
  2⤵
  PID:14116
- C:\Windows\System\FwKLnYI.exe
  C:\Windows\System\FwKLnYI.exe
  2⤵
  PID:14636
- C:\Windows\System\hzISwhl.exe
  C:\Windows\System\hzISwhl.exe
  2⤵
  PID:13628
- C:\Windows\System\ZAoLqiC.exe
  C:\Windows\System\ZAoLqiC.exe
  2⤵
  PID:5756
- C:\Windows\System\xDoYvDC.exe
  C:\Windows\System\xDoYvDC.exe
  2⤵
  PID:14644
- C:\Windows\System\awKlmCQ.exe
  C:\Windows\System\awKlmCQ.exe
  2⤵
  PID:14684
- C:\Windows\System\ASUNZvo.exe
  C:\Windows\System\ASUNZvo.exe
  2⤵
  PID:14696
- C:\Windows\System\byUTgFi.exe
  C:\Windows\System\byUTgFi.exe
  2⤵
  PID:14724
- C:\Windows\System\sUatyNt.exe
  C:\Windows\System\sUatyNt.exe
  2⤵
  PID:7052
- C:\Windows\System\aKTLmRR.exe
  C:\Windows\System\aKTLmRR.exe
  2⤵
  PID:14732
- C:\Windows\System\eMpkJnR.exe
  C:\Windows\System\eMpkJnR.exe
  2⤵
  PID:1180
- C:\Windows\System\CnVfCjk.exe
  C:\Windows\System\CnVfCjk.exe
  2⤵
  PID:14752
- C:\Windows\System\FTbKfBF.exe
  C:\Windows\System\FTbKfBF.exe
  2⤵
  PID:6044
- C:\Windows\System\EFIZPeV.exe
  C:\Windows\System\EFIZPeV.exe
  2⤵
  PID:7100
- C:\Windows\System\hWsFBGJ.exe
  C:\Windows\System\hWsFBGJ.exe
  2⤵
  PID:6116
- C:\Windows\System\ZZEUzGt.exe
  C:\Windows\System\ZZEUzGt.exe
  2⤵
  PID:14816
- C:\Windows\System\RMmuSOK.exe
  C:\Windows\System\RMmuSOK.exe
  2⤵
  PID:5252
- C:\Windows\System\XvNxGtZ.exe
  C:\Windows\System\XvNxGtZ.exe
  2⤵
  PID:13820
- C:\Windows\System\ANvWWWQ.exe
  C:\Windows\System\ANvWWWQ.exe
  2⤵
  PID:14880
- C:\Windows\System\zFMYCDG.exe
  C:\Windows\System\zFMYCDG.exe
  2⤵
  PID:14896
- C:\Windows\System\cFnXXuT.exe
  C:\Windows\System\cFnXXuT.exe
  2⤵
  PID:6372
- C:\Windows\System\QgllpPw.exe
  C:\Windows\System\QgllpPw.exe
  2⤵
  PID:3068
- C:\Windows\System\pRMRcDu.exe
  C:\Windows\System\pRMRcDu.exe
  2⤵
  PID:14932
- C:\Windows\System\JpUJaIQ.exe
  C:\Windows\System\JpUJaIQ.exe
  2⤵
  PID:2752
- C:\Windows\System\FHdntfV.exe
  C:\Windows\System\FHdntfV.exe
  2⤵
  PID:15016
- C:\Windows\System\XdNywRO.exe
  C:\Windows\System\XdNywRO.exe
  2⤵
  PID:6544
- C:\Windows\System\kvsjiqL.exe
  C:\Windows\System\kvsjiqL.exe
  2⤵
  PID:4552
- C:\Windows\System\ITehDnz.exe
  C:\Windows\System\ITehDnz.exe
  2⤵
  PID:1544
- C:\Windows\System\argfjxK.exe
  C:\Windows\System\argfjxK.exe
  2⤵
  PID:15088
- C:\Windows\System\utWrHQq.exe
  C:\Windows\System\utWrHQq.exe
  2⤵
  PID:5360
- C:\Windows\System\doMfLPO.exe
  C:\Windows\System\doMfLPO.exe
  2⤵
  PID:3272
- C:\Windows\System\HqaHgUG.exe
  C:\Windows\System\HqaHgUG.exe
  2⤵
  PID:6984
- C:\Windows\System\iwFhMRM.exe
  C:\Windows\System\iwFhMRM.exe
  2⤵
  PID:7000
- C:\Windows\System\OWTcpGx.exe
  C:\Windows\System\OWTcpGx.exe
  2⤵
  PID:3436
- C:\Windows\System\ctXcWqr.exe
  C:\Windows\System\ctXcWqr.exe
  2⤵
  PID:15128
- C:\Windows\System\CXtUYzO.exe
  C:\Windows\System\CXtUYzO.exe
  2⤵
  PID:6556
- C:\Windows\System\MvukJVu.exe
  C:\Windows\System\MvukJVu.exe
  2⤵
  PID:6792
- C:\Windows\System\UsOIfBH.exe
  C:\Windows\System\UsOIfBH.exe
  2⤵
  PID:4152
- C:\Windows\System\DeZVuvh.exe
  C:\Windows\System\DeZVuvh.exe
  2⤵
  PID:15236
- C:\Windows\System\PdXjZXz.exe
  C:\Windows\System\PdXjZXz.exe
  2⤵
  PID:544
- C:\Windows\System\nmaCOIA.exe
  C:\Windows\System\nmaCOIA.exe
  2⤵
  PID:960
- C:\Windows\System\hqSIyRJ.exe
  C:\Windows\System\hqSIyRJ.exe
  2⤵
  PID:15256
- C:\Windows\System\AAgCgtb.exe
  C:\Windows\System\AAgCgtb.exe
  2⤵
  PID:12540
- C:\Windows\System\BGqZyfC.exe
  C:\Windows\System\BGqZyfC.exe
  2⤵
  PID:1048
- C:\Windows\System\PhuMNyf.exe
  C:\Windows\System\PhuMNyf.exe
  2⤵
  PID:12536
- C:\Windows\System\YaSOIWE.exe
  C:\Windows\System\YaSOIWE.exe
  2⤵
  PID:1680
- C:\Windows\System\GtnsvQu.exe
  C:\Windows\System\GtnsvQu.exe
  2⤵
  PID:3548
- C:\Windows\System\urIjrrw.exe
  C:\Windows\System\urIjrrw.exe
  2⤵
  PID:13768
- C:\Windows\System\BLZBgHs.exe
  C:\Windows\System\BLZBgHs.exe
  2⤵
  PID:15300
- C:\Windows\System\nEvBvIj.exe
  C:\Windows\System\nEvBvIj.exe
  2⤵
  PID:15336
- C:\Windows\System\JUVqJLl.exe
  C:\Windows\System\JUVqJLl.exe
  2⤵
  PID:14344
- C:\Windows\System\qbYaZCw.exe
  C:\Windows\System\qbYaZCw.exe
  2⤵
  PID:6432
- C:\Windows\System\cMwaTFa.exe
  C:\Windows\System\cMwaTFa.exe
  2⤵
  PID:14392
- C:\Windows\System\PaKBXSq.exe
  C:\Windows\System\PaKBXSq.exe
  2⤵
  PID:4916
- C:\Windows\System\EvgSKlJ.exe
  C:\Windows\System\EvgSKlJ.exe
  2⤵
  PID:7912
- C:\Windows\System\jEjzYdi.exe
  C:\Windows\System\jEjzYdi.exe
  2⤵
  PID:14440
- C:\Windows\System\SXjcoZI.exe
  C:\Windows\System\SXjcoZI.exe
  2⤵
  PID:14480
- C:\Windows\System\dPAYSaC.exe
  C:\Windows\System\dPAYSaC.exe
  2⤵
  PID:8068
- C:\Windows\System\bpGYwkJ.exe
  C:\Windows\System\bpGYwkJ.exe
  2⤵
  PID:7328
- C:\Windows\System\eILTpoh.exe
  C:\Windows\System\eILTpoh.exe
  2⤵
  PID:6536
- C:\Windows\System\OaPkOOc.exe
  C:\Windows\System\OaPkOOc.exe
  2⤵
  PID:7988
- C:\Windows\System\mKyHsBN.exe
  C:\Windows\System\mKyHsBN.exe
  2⤵
  PID:7704
- C:\Windows\System\QAZrTdk.exe
  C:\Windows\System\QAZrTdk.exe
  2⤵
  PID:14556
- C:\Windows\System\AeMVEdF.exe
  C:\Windows\System\AeMVEdF.exe
  2⤵
  PID:8228
- C:\Windows\System\pGYIwYE.exe
  C:\Windows\System\pGYIwYE.exe
  2⤵
  PID:14592
- C:\Windows\System\HcDCQPw.exe
  C:\Windows\System\HcDCQPw.exe
  2⤵
  PID:14600
- C:\Windows\System\iVjgNmS.exe
  C:\Windows\System\iVjgNmS.exe
  2⤵
  PID:14616
- C:\Windows\System\JsogAkv.exe
  C:\Windows\System\JsogAkv.exe
  2⤵
  PID:5616
- C:\Windows\System\bQLjVHg.exe
  C:\Windows\System\bQLjVHg.exe
  2⤵
  PID:8472
- C:\Windows\System\aLIDYGf.exe
  C:\Windows\System\aLIDYGf.exe
  2⤵
  PID:1404
- C:\Windows\System\TJZHZWh.exe
  C:\Windows\System\TJZHZWh.exe
  2⤵
  PID:5968
- C:\Windows\System\acIYOPJ.exe
  C:\Windows\System\acIYOPJ.exe
  2⤵
  PID:13364
- C:\Windows\System\XxcDUsR.exe
  C:\Windows\System\XxcDUsR.exe
  2⤵
  PID:14764
- C:\Windows\System\STRAsuH.exe
  C:\Windows\System\STRAsuH.exe
  2⤵
  PID:14792
- C:\Windows\System\OnbIrzK.exe
  C:\Windows\System\OnbIrzK.exe
  2⤵
  PID:14036
- C:\Windows\System\iKqJDRc.exe
  C:\Windows\System\iKqJDRc.exe
  2⤵
  PID:3372
- C:\Windows\System\alvOztj.exe
  C:\Windows\System\alvOztj.exe
  2⤵
  PID:14948
- C:\Windows\System\eSfcFlA.exe
  C:\Windows\System\eSfcFlA.exe
  2⤵
  PID:15032
- C:\Windows\System\mCzXkvF.exe
  C:\Windows\System\mCzXkvF.exe
  2⤵
  PID:15068
- C:\Windows\System\zLqqhqr.exe
  C:\Windows\System\zLqqhqr.exe
  2⤵
  PID:916
- C:\Windows\System\CChaUwy.exe
  C:\Windows\System\CChaUwy.exe
  2⤵
  PID:3432
- C:\Windows\System\YZovbog.exe
  C:\Windows\System\YZovbog.exe
  2⤵
  PID:3404
- C:\Windows\System\VBlsXYu.exe
  C:\Windows\System\VBlsXYu.exe
  2⤵
  PID:8692
- C:\Windows\System\DEiGKfj.exe
  C:\Windows\System\DEiGKfj.exe
  2⤵
  PID:8780
- C:\Windows\System\kNQtBTz.exe
  C:\Windows\System\kNQtBTz.exe
  2⤵
  PID:7028
- C:\Windows\System\nFZCjRv.exe
  C:\Windows\System\nFZCjRv.exe
  2⤵
  PID:6208
- C:\Windows\System\jnlauia.exe
  C:\Windows\System\jnlauia.exe
  2⤵
  PID:3732
- C:\Windows\System\ovxFIGQ.exe
  C:\Windows\System\ovxFIGQ.exe
  2⤵
  PID:5056
- C:\Windows\System\AFRWThR.exe
  C:\Windows\System\AFRWThR.exe
  2⤵
  PID:7072
- C:\Windows\System\mwxCGAj.exe
  C:\Windows\System\mwxCGAj.exe
  2⤵
  PID:2036
- C:\Windows\System\YYarpnF.exe
  C:\Windows\System\YYarpnF.exe
  2⤵
  PID:4716
- C:\Windows\System\MCHwBSE.exe
  C:\Windows\System\MCHwBSE.exe
  2⤵
  PID:1704
- C:\Windows\System\KJueqZk.exe
  C:\Windows\System\KJueqZk.exe
  2⤵
  PID:15248
- C:\Windows\System\FMYtIYT.exe
  C:\Windows\System\FMYtIYT.exe
  2⤵
  PID:1056
- C:\Windows\System\mImOZht.exe
  C:\Windows\System\mImOZht.exe
  2⤵
  PID:13228
- C:\Windows\System\OodqVeT.exe
  C:\Windows\System\OodqVeT.exe
  2⤵
  PID:880
- C:\Windows\System\AeIEYPc.exe
  C:\Windows\System\AeIEYPc.exe
  2⤵
  PID:9260
- C:\Windows\System\DWNBlNC.exe
  C:\Windows\System\DWNBlNC.exe
  2⤵
  PID:1412
- C:\Windows\System\gfPoYND.exe
  C:\Windows\System\gfPoYND.exe
  2⤵
  PID:15284
- C:\Windows\System\nEJwifN.exe
  C:\Windows\System\nEJwifN.exe
  2⤵
  PID:2828
- C:\Windows\System\dTHKbZZ.exe
  C:\Windows\System\dTHKbZZ.exe
  2⤵
  PID:15304
- C:\Windows\System\nvVnYju.exe
  C:\Windows\System\nvVnYju.exe
  2⤵
  PID:9516
- C:\Windows\System\BvzFeDw.exe
  C:\Windows\System\BvzFeDw.exe
  2⤵
  PID:9464
- C:\Windows\System\yLFZwbW.exe
  C:\Windows\System\yLFZwbW.exe
  2⤵
  PID:9488
- C:\Windows\System\IQVZXUV.exe
  C:\Windows\System\IQVZXUV.exe
  2⤵
  PID:6180
- C:\Windows\System\RmRHnEA.exe
  C:\Windows\System\RmRHnEA.exe
  2⤵
  PID:224
- C:\Windows\System\MfwuIYH.exe
  C:\Windows\System\MfwuIYH.exe
  2⤵
  PID:4108
- C:\Windows\System\AlzZUJH.exe
  C:\Windows\System\AlzZUJH.exe
  2⤵
  PID:15352
- C:\Windows\System\JnExioh.exe
  C:\Windows\System\JnExioh.exe
  2⤵
  PID:7816
- C:\Windows\System\eAbswwA.exe
  C:\Windows\System\eAbswwA.exe
  2⤵
  PID:14748
- C:\Windows\System\MWbiVEB.exe
  C:\Windows\System\MWbiVEB.exe
  2⤵
  PID:3176
- C:\Windows\System\VaiVjFr.exe
  C:\Windows\System\VaiVjFr.exe
  2⤵
  PID:9724
- C:\Windows\System\jREoJMt.exe
  C:\Windows\System\jREoJMt.exe
  2⤵
  PID:3944
- C:\Windows\System\fKDYKSs.exe
  C:\Windows\System\fKDYKSs.exe
  2⤵
  PID:9792
- C:\Windows\System\KEgTsRI.exe
  C:\Windows\System\KEgTsRI.exe
  2⤵
  PID:2436
- C:\Windows\System\DZIUroz.exe
  C:\Windows\System\DZIUroz.exe
  2⤵
  PID:8108
- C:\Windows\System\nhcVHgg.exe
  C:\Windows\System\nhcVHgg.exe
  2⤵
  PID:7176
- C:\Windows\System\RjRaCgu.exe
  C:\Windows\System\RjRaCgu.exe
  2⤵
  PID:14520
- C:\Windows\System\ZgyvlfZ.exe
  C:\Windows\System\ZgyvlfZ.exe
  2⤵
  PID:9924
- C:\Windows\System\ErHwUaH.exe
  C:\Windows\System\ErHwUaH.exe
  2⤵
  PID:5524
- C:\Windows\System\upvXWXz.exe
  C:\Windows\System\upvXWXz.exe
  2⤵
  PID:7288
- C:\Windows\System\KCaXFuQ.exe
  C:\Windows\System\KCaXFuQ.exe
  2⤵
  PID:14484
- C:\Windows\System\dCqtyrB.exe
  C:\Windows\System\dCqtyrB.exe
  2⤵
  PID:7272
- C:\Windows\System\EynaTbw.exe
  C:\Windows\System\EynaTbw.exe
  2⤵
  PID:6476
- C:\Windows\System\PQUOtKj.exe
  C:\Windows\System\PQUOtKj.exe
  2⤵
  PID:4448
- C:\Windows\System\YirjVxT.exe
  C:\Windows\System\YirjVxT.exe
  2⤵
  PID:14620
- C:\Windows\System\CdMnVVd.exe
  C:\Windows\System\CdMnVVd.exe
  2⤵
  PID:4920
- C:\Windows\System\rSrYpvJ.exe
  C:\Windows\System\rSrYpvJ.exe
  2⤵
  PID:5656
- C:\Windows\System\yTbdgGp.exe
  C:\Windows\System\yTbdgGp.exe
  2⤵
  PID:1156
- C:\Windows\System\amwunvJ.exe
  C:\Windows\System\amwunvJ.exe
  2⤵
  PID:14692
- C:\Windows\System\yorgURu.exe
  C:\Windows\System\yorgURu.exe
  2⤵
  PID:14708
- C:\Windows\System\kQoFBqp.exe
  C:\Windows\System\kQoFBqp.exe
  2⤵
  PID:7152
- C:\Windows\System\ktOiDst.exe
  C:\Windows\System\ktOiDst.exe
  2⤵
  PID:10200
- C:\Windows\System\ZMZcAWI.exe
  C:\Windows\System\ZMZcAWI.exe
  2⤵
  PID:4860
- C:\Windows\System\poJWRRj.exe
  C:\Windows\System\poJWRRj.exe
  2⤵
  PID:3784
- C:\Windows\System\xgIBlCa.exe
  C:\Windows\System\xgIBlCa.exe
  2⤵
  PID:4896
- C:\Windows\System\yEcjkSA.exe
  C:\Windows\System\yEcjkSA.exe
  2⤵
  PID:1852
- C:\Windows\System\ArIAPCz.exe
  C:\Windows\System\ArIAPCz.exe
  2⤵
  PID:15052
- C:\Windows\System\oPowaAL.exe
  C:\Windows\System\oPowaAL.exe
  2⤵
  PID:6728
- C:\Windows\System\NQZguid.exe
  C:\Windows\System\NQZguid.exe
  2⤵
  PID:4052
- C:\Windows\System\vyeGQCl.exe
  C:\Windows\System\vyeGQCl.exe
  2⤵
  PID:1508
- C:\Windows\System\FTjBnbo.exe
  C:\Windows\System\FTjBnbo.exe
  2⤵
  PID:13824
- C:\Windows\System\xqGSFUO.exe
  C:\Windows\System\xqGSFUO.exe
  2⤵
  PID:32
- C:\Windows\System\QaUhkWq.exe
  C:\Windows\System\QaUhkWq.exe
  2⤵
  PID:9500
- C:\Windows\System\IArBOKm.exe
  C:\Windows\System\IArBOKm.exe
  2⤵
  PID:6320
- C:\Windows\System\ctOZLtv.exe
  C:\Windows\System\ctOZLtv.exe
  2⤵
  PID:9492
- C:\Windows\System\qRzYQCG.exe
  C:\Windows\System\qRzYQCG.exe
  2⤵
  PID:3408
- C:\Windows\System\WLPeEan.exe
  C:\Windows\System\WLPeEan.exe
  2⤵
  PID:3696
- C:\Windows\System\BeUxgHF.exe
  C:\Windows\System\BeUxgHF.exe
  2⤵
  PID:3244
- C:\Windows\System\TLWlxtF.exe
  C:\Windows\System\TLWlxtF.exe
  2⤵
  PID:15208
- C:\Windows\System\fCxhVsE.exe
  C:\Windows\System\fCxhVsE.exe
  2⤵
  PID:4356
- C:\Windows\System\TZOgwSc.exe
  C:\Windows\System\TZOgwSc.exe
  2⤵
  PID:6220
- C:\Windows\System\rMKuwmm.exe
  C:\Windows\System\rMKuwmm.exe
  2⤵
  PID:6908
- C:\Windows\System\VPXljVy.exe
  C:\Windows\System\VPXljVy.exe
  2⤵
  PID:10100
- C:\Windows\System\peCCjRe.exe
  C:\Windows\System\peCCjRe.exe
  2⤵
  PID:4476
- C:\Windows\System\rnvaskf.exe
  C:\Windows\System\rnvaskf.exe
  2⤵
  PID:8944
- C:\Windows\System\FKOKmxS.exe
  C:\Windows\System\FKOKmxS.exe
  2⤵
  PID:2568
- C:\Windows\System\DcwxSTI.exe
  C:\Windows\System\DcwxSTI.exe
  2⤵
  PID:13748
- C:\Windows\System\ZlJCOSb.exe
  C:\Windows\System\ZlJCOSb.exe
  2⤵
  PID:9324
- C:\Windows\System\SkgOgBY.exe
  C:\Windows\System\SkgOgBY.exe
  2⤵
  PID:1176
- C:\Windows\System\ViupyCi.exe
  C:\Windows\System\ViupyCi.exe
  2⤵
  PID:5268
- C:\Windows\System\KaDwQVu.exe
  C:\Windows\System\KaDwQVu.exe
  2⤵
  PID:60
- C:\Windows\System\QZNvkYH.exe
  C:\Windows\System\QZNvkYH.exe
  2⤵
  PID:4440
- C:\Windows\System\ZdtGuvB.exe
  C:\Windows\System\ZdtGuvB.exe
  2⤵
  PID:10328
- C:\Windows\System\sMGQoTX.exe
  C:\Windows\System\sMGQoTX.exe
  2⤵
  PID:14400
- C:\Windows\System\AJDZjVJ.exe
  C:\Windows\System\AJDZjVJ.exe
  2⤵
  PID:14444
- C:\Windows\System\WlBPXMd.exe
  C:\Windows\System\WlBPXMd.exe
  2⤵
  PID:8136
- C:\Windows\System\VEShYRK.exe
  C:\Windows\System\VEShYRK.exe
  2⤵
  PID:5492
- C:\Windows\System\tERLzwm.exe
  C:\Windows\System\tERLzwm.exe
  2⤵
  PID:10044
- C:\Windows\System\gKkfkwp.exe
  C:\Windows\System\gKkfkwp.exe
  2⤵
  PID:7364
- C:\Windows\System\tMikWrS.exe
  C:\Windows\System\tMikWrS.exe
  2⤵
  PID:7316
- C:\Windows\System\XrwUpCp.exe
  C:\Windows\System\XrwUpCp.exe
  2⤵
  PID:14624
- C:\Windows\System\NqqEvki.exe
  C:\Windows\System\NqqEvki.exe
  2⤵
  PID:13676
- C:\Windows\System\VYqJECY.exe
  C:\Windows\System\VYqJECY.exe
  2⤵
  PID:13384
- C:\Windows\System\ZPlFIjL.exe
  C:\Windows\System\ZPlFIjL.exe
  2⤵
  PID:10168
- C:\Windows\System\nxYotGM.exe
  C:\Windows\System\nxYotGM.exe
  2⤵
  PID:5948
- C:\Windows\System\uBUKUOe.exe
  C:\Windows\System\uBUKUOe.exe
  2⤵
  PID:8632
- C:\Windows\System\bkTNCuu.exe
  C:\Windows\System\bkTNCuu.exe
  2⤵
  PID:4664
- C:\Windows\System\wneLiPv.exe
  C:\Windows\System\wneLiPv.exe
  2⤵
  PID:15084
- C:\Windows\System\wFWaoVV.exe
  C:\Windows\System\wFWaoVV.exe
  2⤵
  PID:556
- C:\Windows\System\VPAhgsr.exe
  C:\Windows\System\VPAhgsr.exe
  2⤵
  PID:10844
- C:\Windows\System\dajqczV.exe
  C:\Windows\System\dajqczV.exe
  2⤵
  PID:1876
- C:\Windows\System\FJstFTy.exe
  C:\Windows\System\FJstFTy.exe
  2⤵
  PID:6172
- C:\Windows\System\fHumVxe.exe
  C:\Windows\System\fHumVxe.exe
  2⤵
  PID:2492
- C:\Windows\System\UBZkGNh.exe
  C:\Windows\System\UBZkGNh.exe
  2⤵
  PID:2084
- C:\Windows\System\zZsfQAN.exe
  C:\Windows\System\zZsfQAN.exe
  2⤵
  PID:11072
- C:\Windows\System\ABDtQbo.exe
  C:\Windows\System\ABDtQbo.exe
  2⤵
  PID:468
- C:\Windows\System\PWBEwue.exe
  C:\Windows\System\PWBEwue.exe
  2⤵
  PID:1836
- C:\Windows\System\efWOhZs.exe
  C:\Windows\System\efWOhZs.exe
  2⤵
  PID:3156
- C:\Windows\System\qJWvoQj.exe
  C:\Windows\System\qJWvoQj.exe
  2⤵
  PID:11236
- C:\Windows\System\SPgMcvA.exe
  C:\Windows\System\SPgMcvA.exe
  2⤵
  PID:10308

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_wn3hcet3.t2m.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\BidSvmZ.exe

Filesize
1.6MB

MD5
b6eb19f2ae39a905f14326e1567b5098

SHA1
2f562adcd7d9eaca490c628e88578cc8f0faf4dc

SHA256
3c2d02a9c1480ebcb04deb35ee21084a3ccb25ac51584c3e62eb86d0ae0023b1

SHA512
dd5834a4c5ca0f8eaf9b4e018996a8994febddaf6cf471f1f792f983fb98e554388a8650e8d3dcbf64fc3306239c1b7f2b804c95673d8bbdb947c36118fa9275

Download Submit
C:\Windows\System\DZGRihD.exe

Filesize
8B

MD5
b51f4f6ea566c7181d4d1f715615a414

SHA1
5f5d2057c3e793a449fbedd304d5084c92db621c

SHA256
efa8a7a6952ccabd712273da0ab5538682fcdaff585ff7604e7a4346286e9320

SHA512
cf70e5addae3f1995c350d8ead332088224d80c10cffe6e3f241ed79cc752dc79ee18c102b4cce11ffe47af43c22c4887cb7ff11f4d8c7bdc4456269c5638b1a

Download Submit
C:\Windows\System\DsDPVBH.exe

Filesize
1.6MB

MD5
e99a9f7056d9f7e476362cbed9322765

SHA1
2f8f5991aff764899550c3080cd0d0a7d1926bf4

SHA256
890758ae65edf88b3a0d65e73718dffe51941b22ea0e36e7c27f62983bb60a90

SHA512
af5e2800fb2141031b5fb6c5aaa9da5d7735a91ddacf5111adbc5c2ba91cdea5dccc7b345aacff4abe6ad7d96b129d256705f844796bf11111f342d350ca66c0

Download Submit
C:\Windows\System\EMRPVps.exe

Filesize
1.6MB

MD5
78b4ea822a427f5dfab0d047b3553bc0

SHA1
dc760b7ba347ca0325a75e21459605d238433529

SHA256
16972a57055138b6172877af2f645a455dcc1be5cc0cadde41154b3d2efb52d3

SHA512
736726fa7d34fa9eeb76551a1a8f3eb02e3ede2f6dde5a66e13da26b35316a10313d8da7ab9d7d87dc58984d85b9b6757abd48d3247965a542486d3c6f108546

Download Submit
C:\Windows\System\HnVBXig.exe

Filesize
1.6MB

MD5
47e5fb084456db30ff9cb66e5bc9b341

SHA1
cfbd6945844d1b22fe5b7c401a65ec97e34b3947

SHA256
2a0d0ac0a6d4b0858f96078aae07dd377a265f875b84e4472b93cd9c6d60cb73

SHA512
1c3dc6581b9e4fd3d0a7bff3ce9fc6985097c31eaaebf1a5badf4127aa8268dc3bb4a7b69e01737aac05ae604d077a9351855d603d2196e419e9eb8d689d0c0a

Download Submit
C:\Windows\System\HoikZra.exe

Filesize
1.6MB

MD5
cbba94546379a4e25bf5bea1338f4abd

SHA1
3e5e57774a557032287bd43a56d45f190a58d21c

SHA256
071fc54187923f56ea055ba4f2f18f4a213e16aafb4e6a769301d0ce29e61fc9

SHA512
2d119e8c950a5740960c861042c1aaa781447f1808716d808bfe46dfc3f13a3aa8527b2c33e987f003b8a91206d4a432d1efa74fa376be3c690ed770c8d26731

Download Submit
C:\Windows\System\HuYNhKa.exe

Filesize
1.6MB

MD5
c1d5f527e5f742c64ed8fdf2e7126f2b

SHA1
f5f522f0d8e9596740ec0b77b188135f6fd31754

SHA256
f633b23b3b249697ec0ecec0edba46d0ddadabfab6c4c8dca185642801c030be

SHA512
4e90e1df63917ae6c0256632c0cda19aa8c451a4afa7e6e747bba4b92b311d9ee7db9d346f63c00061feaf8f00d02dca8cc40d040c3daac40aa3e9802cb39073

Download Submit
C:\Windows\System\LfjXHUm.exe

Filesize
1.6MB

MD5
76cf63516277a864864222fda67780ef

SHA1
b750416a516f5dfa077554ebba5497ae195faa39

SHA256
53d2d78b7e846f8e3864951fe9439587a5c9b8645996828edd077aa9676ac202

SHA512
b6c53814301c62f7470bc3fd68ee466e23928dd3a8cd40aea98785292879586aa3608db3a1f3812909b28ceda0f470026abd699a11d31b329e701ec235239bdb

Download Submit
C:\Windows\System\OhAsUnA.exe

Filesize
1.6MB

MD5
a8e38faed46a92ec4e9bd3c66c688598

SHA1
c024e52e3a5eb3e768e217fb02ac17d4f10a4dec

SHA256
eb38924b8854f2b8b4b118a2c9c8c6c504db3cca2bceab0d28578a3f6ab6e947

SHA512
50dcc9b91bf0e10606b571acbfc8c9c2d978f897f78581b5f1e236b58562392cda22d83e027018554a7bde00a2ca311ce5583d1bb4963582ccee55dddb9eb9df

Download Submit
C:\Windows\System\QZbSMcL.exe

Filesize
1.6MB

MD5
fb195125e596d1c63b25c17bc59ee4b6

SHA1
f659e020a02e691bee82c731f0427c1858f6b521

SHA256
20cd12d430eb9aacfc5ba43c92dce910d584b1bfeaddb7c564321e6440543eb9

SHA512
8cf91c7269e4598db9bd30158f46f3c5a1951aec32270b25b14050d9ea7f1e9d6408355af4707d8b08e74738d8653df67663c5290f2e49a1464b52ed71470eba

Download Submit
C:\Windows\System\Vzskgeu.exe

Filesize
1.6MB

MD5
3785739e69521984baa23c7cc88d5e51

SHA1
83dc25e7e295a8f2a0b3e15a2501816beca6191c

SHA256
23c134d96dcde459b511d6a1b712c023acec3d07268cee572692681489164e9b

SHA512
c8576d0ac7cf3a6d496ae11f2fd68ac2f7195ae16f8b33bfb12033fe296609293ed37c4009b9336c27fc931199a775343b85d15c0aacd5af191a0ce55a1d90e8

Download Submit
C:\Windows\System\WLFblsw.exe

Filesize
1.6MB

MD5
541241a304d45a5204748f317806df1d

SHA1
5ba67d646010c87f200835fe513dc86223c36fdb

SHA256
e3bc53cca39c00cba15658ac8d381928fe86678b9de7c086fd4875ed97083935

SHA512
04d33082b26ce0d09a44495cd7e13a475d1d8326e54efb9106737604515af883f8ab7ee43c224d6df291d5beb90d4af72832e9586b7944881ef369fe996689ad

Download Submit
C:\Windows\System\XsCkuYf.exe

Filesize
1.6MB

MD5
7a8c95220995c0b00ca32b36ac5ecd33

SHA1
9b4a27198618e364e0388908ff80c60ca67356e4

SHA256
dde300edaa5cc1eebba07216fec35d504392fcbb1f7865c10208b0be9ac44b31

SHA512
db6db5ea38749d3436f37449ce6d1c8b26ea24407e4f37f943ebde32d5b6bdef63baa726659e32d9bcc2278600fabde0af571204005275f465d848887b31c947

Download Submit
C:\Windows\System\YTogQtY.exe

Filesize
1.6MB

MD5
22fea197639263a8f98962cf6b99913f

SHA1
f8894c6e1c42e299059102a8c7cb9f30ecff78e2

SHA256
31341e23e50a5d833f7bb6aed6639b82cb18462ab0b00c1bbb4382e79aa1f882

SHA512
1485db0fe277f27e39367cc54892f52fd23d692530b6d7717e251bb9a8de55ba7e647470df1c2bb1985cd1a088352edada0b1ebeadc447b2059c113ac69c1d41

Download Submit
C:\Windows\System\ZurkQoW.exe

Filesize
1.6MB

MD5
9af02043c7f94a58e7a66e49387e1625

SHA1
6004b32a4744ecd347dc10bfaf25d24a9b3b19c7

SHA256
a3a887d267543ce1cd8b45747fb2c37a84e6bfc345b9005767d665027cf2d353

SHA512
1f95c4ba5b92c0593310f855cccff4dc4de81d96878c2a14120ce66a1e264e8d8aa9102dd5f0ab63428868fcf45861c49224263c5e9db0435f636627f99ef757

Download Submit
C:\Windows\System\bUgoFps.exe

Filesize
1.6MB

MD5
ad1d9e6e64db72f15278328d1907ae62

SHA1
27bf0674e84cf548a968a189f5b450deedccaf76

SHA256
a849ef7d63022e5cadd9c2077a51573831640069eb7efe0729d3bce121f9e9fa

SHA512
bee272b3458643996bbcf113c681b30c9bbe23e246d2b97716365229a546989753dacf0d6a53b598c392229faa6b7f475a0ffef8163d9cc4b55024d7b916ad4e

Download Submit
C:\Windows\System\bxHQWls.exe

Filesize
1.6MB

MD5
89bdc371f6c9e04887a13e048b741159

SHA1
83a3ef1e918bd7793a8fe4f1765d03741385b932

SHA256
b6eee30726a72b78b1349fe65feca146203cbdeb2a955e88ee3b15e69387755a

SHA512
804ffa05e9cef37f273ec33e584967f00d86f7f035e7afbdd5ee31538812146a2cad10da7ba01dec3f715e3e6fee4aedb8d3f95c3418f02ae9aab1755ce0cfa0

Download Submit
C:\Windows\System\cfAOIUZ.exe

Filesize
1.6MB

MD5
9539cfbfa6cd63216cd06ddd0c5c26f2

SHA1
cc5e2c8f03a34c642e6022fa8c3040056350fda6

SHA256
63aa84192e07b9a4e9f80dff8778decc76a54f0056e1a097e6ba48820b645227

SHA512
ed6ff0095a082e356ea072260274dc1338aeb8c1496fc0fec8dd22695d52cd0415283a01d50535a0d13ef6f9aa781a962dc37dfed36defc405727949b80240aa

Download Submit
C:\Windows\System\cyTBExw.exe

Filesize
1.6MB

MD5
38b363941b9ac805e32e6ab10790053a

SHA1
ce3f33ddaf64aa09c3a4c46835fa37bbe316d716

SHA256
a275737f74af1e8c01d3d920c8679c02feba6fdb687efdaeb3a1185bdf4012e3

SHA512
1b6c3287daad9af6655e7a52c33e884212c76e301483d80ad05a3e05011643e367f06624a57a943f70002837205bc1fdee0e19c495483f2b17a3a87f35901547

Download Submit
C:\Windows\System\dpGbiEG.exe

Filesize
1.6MB

MD5
9ee4146982845f19c0524915672284e4

SHA1
06d071e468cdf3776b4e7e1baf28dc5556ffb539

SHA256
a1c31162fbcc412e3185273de114ce9752b2262e232f55a34b9c2445f9a0c55e

SHA512
ab3f7c3b5810503a89bfed487f7e5ae7fc10041629934434babd9ba558f1b7e33979597b26022b270fccbc24f122b16b2f1d3e00867c0753766220b0f408049b

Download Submit
C:\Windows\System\eEuLKtw.exe

Filesize
1.6MB

MD5
a1cbb27ac77fd39c327fbafbd29d9fd6

SHA1
ad873702638530636523f264bddea2310f0b51ef

SHA256
3de198a1d1f82905623cfe6cb3c23ef6ff3a4dd00d6b6606f38653af67419a80

SHA512
2a0993e68cab6247ca2557278dff60da271d122adf7f94447ed74ae5d6440387ea7321f27faf51507eee51e63e7c399171a5620e88a6b5cc5df2dba42784e6e0

Download Submit
C:\Windows\System\fNCAUHr.exe

Filesize
1.6MB

MD5
055d812356a591cb869d75e5063fd3c1

SHA1
2f89ba1302080f1494ad99cb04a068a8d20e50f3

SHA256
f6e5ea114d4430f6f6b28a8f092bf1286d8338afa8d11cf998b1edb05bae95ff

SHA512
7db5893510fad5d3aa9ee0b4e77bb13d50c495b01ec5bd30a514ae4e71cdb2024db3ed0dfec37516efe59c9c87e855115d6613ed932f099c35f208edeec03419

Download Submit
C:\Windows\System\futdxck.exe

Filesize
1.6MB

MD5
53e62d1df8d65dc560cc9a41f9d43dd4

SHA1
516578b6573d32fc6ec7c706a560432179eea73d

SHA256
bd6883e5a81bf29d297752a72f94067612eac24ce60d2060ac34cef3ea7104e2

SHA512
a5cf92cc8edde3f87ed6323ca3efa33113dcb25a22f5ec0457a92daec72a04ba556c8867e6330f6d24029d0b3608abb602fd1bbc31dd31c78bb133385b134586

Download Submit
C:\Windows\System\jBeNdjb.exe

Filesize
1.6MB

MD5
bc823e1cf51ab6d461c3db0912326595

SHA1
bb364902c6d86883bd1ada7f24c77cb64653ffc8

SHA256
fcb4f81d29be3247d4cd7da6f3d349f2c211bacc40732deef6c3fb24c8bee706

SHA512
da857a7173b080a141c95e276a4f3365413893f62d45abb32c5726cdacab8d3ff227da4c0f7755562fd0e4a40ed2a8f96b7cf12c6ffe976d7cc980345b0dd8a5

Download Submit
C:\Windows\System\jaDYwHA.exe

Filesize
1.6MB

MD5
1789edaf9cbea21070ca3183290ecd81

SHA1
0d7c404da16ec0946f299640d1ae01ccd8414874

SHA256
343e72659ee3726fd1cc1657cc849b5ab0f00c92a71cd3587b963e9fd1471fca

SHA512
58818435da4cafe3814590163deb6a0d2b59af076287bd9932d6d1c63f90d2d7a47a21bebd98598b04a4b8ad4b0528189c2cedab542e0063e24a3cf421bf8d49

Download Submit
C:\Windows\System\lCWCKMv.exe

Filesize
1.6MB

MD5
2c526a87f86f8c4cc4b1e3f8bda4447a

SHA1
0abd4f7d06c1927378c49d655aac0d74b4124653

SHA256
52d4613aa715cf79b01924aa61da5e247d0fc31a3094187233b58bc955ce462c

SHA512
484db071c2330362903c9ece732e84377864c87929386ab20aa1e3ca8d0da6ff219e25b71a12df99d18ad219a4c7cd8f1e7194db813471e5eed7591775b3ab98

Download Submit
C:\Windows\System\nMAFmpG.exe

Filesize
1.6MB

MD5
294da38093a397f4d9aa3a454cafe8a4

SHA1
e42f5d2b89d4b05f61f3dc755d8e700e03456c07

SHA256
b02e2964aba9c747e1856dad37c7daa2ec6cb16a9c8d0fb1af025c18853db2ca

SHA512
a2f1300acf33be232748d6e2d0cf4a5baccd676e4f51dfbbcc925da7f979596017c21b0911cb86c88e5b7987b8f8ed6da556327ed717bd57111542e0b041bba9

Download Submit
C:\Windows\System\rBAYwZX.exe

Filesize
1.6MB

MD5
857dd32b75a378cc2a9cc63b42178a06

SHA1
7d91ad9c244b2bb624cec67de0e4f6e070c7d21b

SHA256
ad2a1b3c8a40632ca8e79883999dc20b76f048fb6822c6a38b88309f21a85d36

SHA512
319976788a8ee37fcce69d3b8f8755c218d92311c10c909cd995c70952b249692a40ac2fa5c1d5a3e50efa048cdc35617ca2ef390fbd605257334e6197bab1c4

Download Submit
C:\Windows\System\rReHASK.exe

Filesize
1.6MB

MD5
ff758c208eb69634da3aa64668775f8a

SHA1
1aac56d5228cbb649db179785f67b7f339795d37

SHA256
2f6ede77050e108302baf238c7f766626bb9892e47f11c3e9439ae6146a8b1ce

SHA512
cf2f299c8eb6be875c8e05b815fada07656655395333e9fce5bf7bcf88d00f9fc5fd1abe97cca2bc6c416dc7c558b9ccbd64cdcab4ef3acb3abce7494bc8160f

Download Submit
C:\Windows\System\tItvRWw.exe

Filesize
1.6MB

MD5
82490735dd3389f95f12b2c309103a2f

SHA1
a68616b0c3148738021f2c0b7981cb7b61a8845e

SHA256
c87df346059ef9f5c1ff695dc88c15c675571482cc3f925d1c5fa7e1385073e6

SHA512
54955c530fe39d7d77c5f46221fd943f6d3c913eb86f5c5c95ebc1921ef579bee53da094cdce0304af9b89a4674136e50c66419a66a0c4f1eabc1c66ff34dd97

Download Submit
C:\Windows\System\wPTPJNa.exe

Filesize
1.6MB

MD5
c88fd8a8d51b4667412806755275ebcf

SHA1
b64819e3ba12556182f391edc5173902e07bca2f

SHA256
1a18a9d83e2e4c57fe17727ddea95cb56e3a352453a3a835cfa49452c40de3d6

SHA512
30e97049fd738fc94ec87ec4726b32e47be891bce75cf3bbe6f8603cb2391fd3d8c66a619fee309019e0b2b8384b5764e2fc8a66ec97f6ab13abafa8d80ae84d

Download Submit
C:\Windows\System\xnMtXwd.exe

Filesize
1.6MB

MD5
edc5069abad90c7ac816c6acbdb9381f

SHA1
59dc4582f11f404b56abe859cc5c680f788250f2

SHA256
a636dee2f89d7f4ada897f6fedbc78218f49ef9dcb539dd3413adbd2af5ee50e

SHA512
333785eef53f155c4f3b47bcd260d94aeb9f15e2c25222dbfb6ffae9ed2518e346ec481bb25be52e5079a442f73e71c2299bdde50423410514ca7f42bb3b3178

Download Submit
C:\Windows\System\ylroFNk.exe

Filesize
1.6MB

MD5
14f4055f0669ea65f2982a7defe80841

SHA1
d228f3a0536a35fc834c6332c066e935ac9b39cf

SHA256
341989f5d6636cecb8aad962af218454f33213b8228a6a576fa7c92bef475b12

SHA512
90b995335034fedf06b46bcd5f16bf60911b4f0019646864b04e5935901787e1dbb692a339782e4da07b32e6173526a177beefdf533730822cd7fdd486207d2c

Download Submit
C:\Windows\System\zveAWDO.exe

Filesize
1.6MB

MD5
91ed7334aadcde5106816d0d3d3b829e

SHA1
cb02bc1b6a3180d596a713f1ded9e253e4be6f6a

SHA256
e009385f23021b86af7db5f828621ec307e7617b1967890016f667204259a2c9

SHA512
e2d2c06233ce74733fee0bab22f758923ed2fde669a332c4f6293504c1f412957e140901201609f51ae334f176d5df3b4ab21c669b95b74118f5b45764d904c9

Download Submit
memory/528-4658-0x00007FF75E740000-0x00007FF75EB32000-memory.dmp

Filesize
3.9MB

Download
memory/528-302-0x00007FF75E740000-0x00007FF75EB32000-memory.dmp

Filesize
3.9MB

Download
memory/628-4650-0x00007FF688780000-0x00007FF688B72000-memory.dmp

Filesize
3.9MB

Download
memory/628-300-0x00007FF688780000-0x00007FF688B72000-memory.dmp

Filesize
3.9MB

Download
memory/732-82-0x00007FF6E8860000-0x00007FF6E8C52000-memory.dmp

Filesize
3.9MB

Download
memory/732-2667-0x00007FF6E8860000-0x00007FF6E8C52000-memory.dmp

Filesize
3.9MB

Download
memory/760-134-0x000001FF33450000-0x000001FF33BF6000-memory.dmp

Filesize
7.6MB

Download
memory/760-60-0x000001FF32800000-0x000001FF32822000-memory.dmp

Filesize
136KB

Download
memory/760-36-0x00007FFF45B03000-0x00007FFF45B05000-memory.dmp

Filesize
8KB

Download
memory/760-2033-0x000001FF1A490000-0x000001FF1A4A0000-memory.dmp

Filesize
64KB

Download
memory/760-20-0x000001FF1A490000-0x000001FF1A4A0000-memory.dmp

Filesize
64KB

Download
memory/772-4519-0x00007FF730790000-0x00007FF730B82000-memory.dmp

Filesize
3.9MB

Download
memory/772-127-0x00007FF730790000-0x00007FF730B82000-memory.dmp

Filesize
3.9MB

Download
memory/1000-2351-0x00007FF6CEA00000-0x00007FF6CEDF2000-memory.dmp

Filesize
3.9MB

Download
memory/1000-65-0x00007FF6CEA00000-0x00007FF6CEDF2000-memory.dmp

Filesize
3.9MB

Download
memory/2016-22-0x00007FF7D5510000-0x00007FF7D5902000-memory.dmp

Filesize
3.9MB

Download
memory/2016-1390-0x00007FF7D5510000-0x00007FF7D5902000-memory.dmp

Filesize
3.9MB

Download
memory/2196-4950-0x00007FF6D7DD0000-0x00007FF6D81C2000-memory.dmp

Filesize
3.9MB

Download
memory/2196-110-0x00007FF6D7DD0000-0x00007FF6D81C2000-memory.dmp

Filesize
3.9MB

Download
memory/2664-37-0x00007FF7FB950000-0x00007FF7FBD42000-memory.dmp

Filesize
3.9MB

Download
memory/2728-75-0x00007FF7E5A40000-0x00007FF7E5E32000-memory.dmp

Filesize
3.9MB

Download
memory/2728-2357-0x00007FF7E5A40000-0x00007FF7E5E32000-memory.dmp

Filesize
3.9MB

Download
memory/3076-47-0x00007FF7F24B0000-0x00007FF7F28A2000-memory.dmp

Filesize
3.9MB

Download
memory/3076-2349-0x00007FF7F24B0000-0x00007FF7F28A2000-memory.dmp

Filesize
3.9MB

Download
memory/3104-133-0x00007FF61A9F0000-0x00007FF61ADE2000-memory.dmp

Filesize
3.9MB

Download
memory/3104-4529-0x00007FF61A9F0000-0x00007FF61ADE2000-memory.dmp

Filesize
3.9MB

Download
memory/3256-0-0x00007FF7C5780000-0x00007FF7C5B72000-memory.dmp

Filesize
3.9MB

Download
memory/3256-1386-0x00007FF7C5780000-0x00007FF7C5B72000-memory.dmp

Filesize
3.9MB

Download
memory/3256-1-0x000001C17B4F0000-0x000001C17B500000-memory.dmp

Filesize
64KB

Download
memory/3712-103-0x00007FF6F99A0000-0x00007FF6F9D92000-memory.dmp

Filesize
3.9MB

Download
memory/3748-17-0x00007FF6B9CC0000-0x00007FF6BA0B2000-memory.dmp

Filesize
3.9MB

Download
memory/3748-1387-0x00007FF6B9CC0000-0x00007FF6BA0B2000-memory.dmp

Filesize
3.9MB

Download
memory/3936-2913-0x00007FF60F1C0000-0x00007FF60F5B2000-memory.dmp

Filesize
3.9MB

Download
memory/3936-87-0x00007FF60F1C0000-0x00007FF60F5B2000-memory.dmp

Filesize
3.9MB

Download
memory/4036-2345-0x00007FF77DD80000-0x00007FF77E172000-memory.dmp

Filesize
3.9MB

Download
memory/4036-41-0x00007FF77DD80000-0x00007FF77E172000-memory.dmp

Filesize
3.9MB

Download
memory/4048-299-0x00007FF7FCA60000-0x00007FF7FCE52000-memory.dmp

Filesize
3.9MB

Download
memory/4048-35-0x00007FF7FCA60000-0x00007FF7FCE52000-memory.dmp

Filesize
3.9MB

Download
memory/4088-4509-0x00007FF7FE670000-0x00007FF7FEA62000-memory.dmp

Filesize
3.9MB

Download
memory/4088-115-0x00007FF7FE670000-0x00007FF7FEA62000-memory.dmp

Filesize
3.9MB

Download
memory/4116-4066-0x00007FF64B9A0000-0x00007FF64BD92000-memory.dmp

Filesize
3.9MB

Download
memory/4116-4526-0x00007FF64B9A0000-0x00007FF64BD92000-memory.dmp

Filesize
3.9MB

Download
memory/4116-128-0x00007FF64B9A0000-0x00007FF64BD92000-memory.dmp

Filesize
3.9MB

Download
memory/4204-301-0x00007FF7A9BF0000-0x00007FF7A9FE2000-memory.dmp

Filesize
3.9MB

Download
memory/4204-4653-0x00007FF7A9BF0000-0x00007FF7A9FE2000-memory.dmp

Filesize
3.9MB

Download
memory/4280-4513-0x00007FF7F8490000-0x00007FF7F8882000-memory.dmp

Filesize
3.9MB

Download
memory/4280-122-0x00007FF7F8490000-0x00007FF7F8882000-memory.dmp

Filesize
3.9MB

Download
memory/4380-79-0x00007FF6EA430000-0x00007FF6EA822000-memory.dmp

Filesize
3.9MB

Download
memory/4728-303-0x00007FF6AE5E0000-0x00007FF6AE9D2000-memory.dmp

Filesize
3.9MB

Download
memory/4728-4660-0x00007FF6AE5E0000-0x00007FF6AE9D2000-memory.dmp

Filesize
3.9MB

Download
memory/4760-2915-0x00007FF6CED00000-0x00007FF6CF0F2000-memory.dmp

Filesize
3.9MB

Download
memory/4760-97-0x00007FF6CED00000-0x00007FF6CF0F2000-memory.dmp

Filesize
3.9MB

Download
memory/4904-28-0x00007FF7C4420000-0x00007FF7C4812000-memory.dmp

Filesize
3.9MB

Download