xmrig | 4970a9cd7aa7623a0288159fe7977db62b0d74906dccd611d6e1a4d72b21a436

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
30/05/2024, 06:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6783db08b54cca5303164e90af8fefb0_NeikiAnalytics.exe
Size

3.0MB
MD5

6783db08b54cca5303164e90af8fefb0
SHA1

11fb0849a9bb7553b658ee51b0b7355db32612f7
SHA256

4970a9cd7aa7623a0288159fe7977db62b0d74906dccd611d6e1a4d72b21a436
SHA512

fccdf49788f5a01a25163d29efd4ef931024b8d4be5d6c0464f99604ae606619d022aaa5b4f20ed5ff44b75aa5884decf479a16eef1acc787c87ba7b0f6ee868
SSDEEP

49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkFfdk2a2yKmkUwV:71ONtyBeSFkXV1etEKLlWUTOfeiRA2Rs

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral2/memory/528-0-0x00007FF64B580000-0x00007FF64B976000-memory.dmp	xmrig
behavioral2/files/0x000600000002327c-5.dat	xmrig
behavioral2/files/0x000700000002340d-7.dat	xmrig
behavioral2/files/0x000700000002340c-10.dat	xmrig
behavioral2/memory/2524-17-0x00007FF7724E0000-0x00007FF7728D6000-memory.dmp	xmrig
behavioral2/files/0x000700000002340e-29.dat	xmrig
behavioral2/files/0x0007000000023411-41.dat	xmrig
behavioral2/files/0x0007000000023416-67.dat	xmrig
behavioral2/files/0x000700000002341c-94.dat	xmrig
behavioral2/files/0x000700000002341d-106.dat	xmrig
behavioral2/files/0x000800000002341a-140.dat	xmrig
behavioral2/files/0x0007000000023423-160.dat	xmrig
behavioral2/memory/4384-167-0x00007FF674710000-0x00007FF674B06000-memory.dmp	xmrig
behavioral2/memory/4348-170-0x00007FF614D30000-0x00007FF615126000-memory.dmp	xmrig
behavioral2/files/0x0007000000023429-193.dat	xmrig
behavioral2/files/0x000700000002342c-218.dat	xmrig
behavioral2/files/0x0007000000023426-210.dat	xmrig
behavioral2/files/0x000700000002342b-207.dat	xmrig
behavioral2/files/0x000700000002342a-202.dat	xmrig
behavioral2/files/0x0007000000023425-198.dat	xmrig
behavioral2/files/0x0007000000023428-191.dat	xmrig
behavioral2/files/0x0007000000023427-187.dat	xmrig
behavioral2/memory/4400-174-0x00007FF667900000-0x00007FF667CF6000-memory.dmp	xmrig
behavioral2/memory/3684-173-0x00007FF70ACC0000-0x00007FF70B0B6000-memory.dmp	xmrig
behavioral2/memory/4896-172-0x00007FF66F370000-0x00007FF66F766000-memory.dmp	xmrig
behavioral2/memory/5388-171-0x00007FF75FCC0000-0x00007FF7600B6000-memory.dmp	xmrig
behavioral2/memory/3404-169-0x00007FF790380000-0x00007FF790776000-memory.dmp	xmrig
behavioral2/memory/4876-168-0x00007FF7B51C0000-0x00007FF7B55B6000-memory.dmp	xmrig
behavioral2/memory/6108-166-0x00007FF726FF0000-0x00007FF7273E6000-memory.dmp	xmrig
behavioral2/memory/3164-165-0x00007FF645100000-0x00007FF6454F6000-memory.dmp	xmrig
behavioral2/files/0x0007000000023424-163.dat	xmrig
behavioral2/memory/688-162-0x00007FF619BE0000-0x00007FF619FD6000-memory.dmp	xmrig
behavioral2/files/0x0007000000023422-156.dat	xmrig
behavioral2/files/0x0007000000023421-154.dat	xmrig
behavioral2/memory/6024-153-0x00007FF723600000-0x00007FF7239F6000-memory.dmp	xmrig
behavioral2/memory/6112-152-0x00007FF6E5230000-0x00007FF6E5626000-memory.dmp	xmrig
behavioral2/files/0x0008000000023409-150.dat	xmrig
behavioral2/memory/4076-146-0x00007FF7F38B0000-0x00007FF7F3CA6000-memory.dmp	xmrig
behavioral2/files/0x0007000000023420-144.dat	xmrig
behavioral2/files/0x000700000002341f-142.dat	xmrig
behavioral2/files/0x000700000002341e-137.dat	xmrig
behavioral2/files/0x0007000000023417-132.dat	xmrig
behavioral2/memory/5160-128-0x00007FF719950000-0x00007FF719D46000-memory.dmp	xmrig
behavioral2/files/0x0007000000023419-127.dat	xmrig
behavioral2/files/0x000800000002341b-134.dat	xmrig
behavioral2/files/0x0007000000023418-110.dat	xmrig
behavioral2/memory/5564-91-0x00007FF699570000-0x00007FF699966000-memory.dmp	xmrig
behavioral2/files/0x0007000000023415-88.dat	xmrig
behavioral2/memory/3680-83-0x00007FF6B9860000-0x00007FF6B9C56000-memory.dmp	xmrig
behavioral2/memory/3908-70-0x00007FF785370000-0x00007FF785766000-memory.dmp	xmrig
behavioral2/files/0x0007000000023414-66.dat	xmrig
behavioral2/files/0x0007000000023413-65.dat	xmrig
behavioral2/memory/3460-61-0x00007FF71E160000-0x00007FF71E556000-memory.dmp	xmrig
behavioral2/files/0x0007000000023412-54.dat	xmrig
behavioral2/files/0x0007000000023410-50.dat	xmrig
behavioral2/memory/3560-48-0x00007FF611B70000-0x00007FF611F66000-memory.dmp	xmrig
behavioral2/memory/3968-57-0x00007FF63E7A0000-0x00007FF63EB96000-memory.dmp	xmrig
behavioral2/memory/2164-32-0x00007FF746CE0000-0x00007FF7470D6000-memory.dmp	xmrig
behavioral2/files/0x000700000002340f-36.dat	xmrig
behavioral2/memory/624-24-0x00007FF75C7B0000-0x00007FF75CBA6000-memory.dmp	xmrig
behavioral2/memory/2164-2463-0x00007FF746CE0000-0x00007FF7470D6000-memory.dmp	xmrig
behavioral2/memory/3680-2983-0x00007FF6B9860000-0x00007FF6B9C56000-memory.dmp	xmrig
behavioral2/memory/4076-2988-0x00007FF7F38B0000-0x00007FF7F3CA6000-memory.dmp	xmrig
behavioral2/memory/5160-2986-0x00007FF719950000-0x00007FF719D46000-memory.dmp	xmrig

Blocklisted process makes network request 6 IoCs

flow	pid	Process
9	3008	powershell.exe
11	3008	powershell.exe
15	3008	powershell.exe
16	3008	powershell.exe
18	3008	powershell.exe
26	3008	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
3008	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
2524	MduNXDp.exe
3560	dTOSkqF.exe
624	pKuFsds.exe
2164	tweYpLa.exe
3968	AGXTcpM.exe
3460	mCxDYym.exe
3404	yEWSibe.exe
3908	twMVFDd.exe
4348	soKRvpV.exe
3680	pALFnQn.exe
5388	AmLGwdp.exe
5564	EYAauhX.exe
4896	nGtcdmM.exe
5160	qohwkLc.exe
4076	kIAPkMv.exe
3684	QKimhCI.exe
6112	pVdAfHK.exe
6024	QUbiFlo.exe
688	PwrcdvE.exe
3164	HmdAapU.exe
6108	qoGWmYH.exe
4384	mJKGfAA.exe
4400	dTorOHo.exe
4876	hdNcQZr.exe
3288	FRqSNUn.exe
4192	gLcPzYg.exe
544	FgerKAI.exe
508	UWgZTjW.exe
4844	utwVKtX.exe
4904	DtlaLFx.exe
1452	MXmuwht.exe
5580	TWAfeSm.exe
5544	BDqwtHO.exe
1888	uUOxDxX.exe
2668	DWyxGUF.exe
1612	avpKVbj.exe
4572	oYMsgzd.exe
3480	QsUEALg.exe
5360	TzFfRQv.exe
2564	rzQaROH.exe
2000	bGQLdvc.exe
2448	PepKzqJ.exe
2956	NBxtMYb.exe
2396	QfybdkY.exe
4952	lWIaoCq.exe
2592	gnnPaJZ.exe
4072	MAvkFFn.exe
5260	uwYXVfm.exe
4168	VVDhtKg.exe
2932	yLouCYc.exe
4656	WFumWdO.exe
1168	YVLDYze.exe
724	oxWvmaw.exe
1764	zICcjvr.exe
5768	TQiRXXk.exe
1244	Qftinza.exe
3584	zTebdDg.exe
1092	vqULHQF.exe
5816	jQWRVMF.exe
752	vtnZPLc.exe
5668	FOVARTa.exe
3940	NTjCMTq.exe
5636	bQykuUX.exe
3972	XNtMiDQ.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/528-0-0x00007FF64B580000-0x00007FF64B976000-memory.dmp	upx
behavioral2/files/0x000600000002327c-5.dat	upx
behavioral2/files/0x000700000002340d-7.dat	upx
behavioral2/files/0x000700000002340c-10.dat	upx
behavioral2/memory/2524-17-0x00007FF7724E0000-0x00007FF7728D6000-memory.dmp	upx
behavioral2/files/0x000700000002340e-29.dat	upx
behavioral2/files/0x0007000000023411-41.dat	upx
behavioral2/files/0x0007000000023416-67.dat	upx
behavioral2/files/0x000700000002341c-94.dat	upx
behavioral2/files/0x000700000002341d-106.dat	upx
behavioral2/files/0x000800000002341a-140.dat	upx
behavioral2/files/0x0007000000023423-160.dat	upx
behavioral2/memory/4384-167-0x00007FF674710000-0x00007FF674B06000-memory.dmp	upx
behavioral2/memory/4348-170-0x00007FF614D30000-0x00007FF615126000-memory.dmp	upx
behavioral2/files/0x0007000000023429-193.dat	upx
behavioral2/files/0x000700000002342c-218.dat	upx
behavioral2/files/0x0007000000023426-210.dat	upx
behavioral2/files/0x000700000002342b-207.dat	upx
behavioral2/files/0x000700000002342a-202.dat	upx
behavioral2/files/0x0007000000023425-198.dat	upx
behavioral2/files/0x0007000000023428-191.dat	upx
behavioral2/files/0x0007000000023427-187.dat	upx
behavioral2/memory/4400-174-0x00007FF667900000-0x00007FF667CF6000-memory.dmp	upx
behavioral2/memory/3684-173-0x00007FF70ACC0000-0x00007FF70B0B6000-memory.dmp	upx
behavioral2/memory/4896-172-0x00007FF66F370000-0x00007FF66F766000-memory.dmp	upx
behavioral2/memory/5388-171-0x00007FF75FCC0000-0x00007FF7600B6000-memory.dmp	upx
behavioral2/memory/3404-169-0x00007FF790380000-0x00007FF790776000-memory.dmp	upx
behavioral2/memory/4876-168-0x00007FF7B51C0000-0x00007FF7B55B6000-memory.dmp	upx
behavioral2/memory/6108-166-0x00007FF726FF0000-0x00007FF7273E6000-memory.dmp	upx
behavioral2/memory/3164-165-0x00007FF645100000-0x00007FF6454F6000-memory.dmp	upx
behavioral2/files/0x0007000000023424-163.dat	upx
behavioral2/memory/688-162-0x00007FF619BE0000-0x00007FF619FD6000-memory.dmp	upx
behavioral2/files/0x0007000000023422-156.dat	upx
behavioral2/files/0x0007000000023421-154.dat	upx
behavioral2/memory/6024-153-0x00007FF723600000-0x00007FF7239F6000-memory.dmp	upx
behavioral2/memory/6112-152-0x00007FF6E5230000-0x00007FF6E5626000-memory.dmp	upx
behavioral2/files/0x0008000000023409-150.dat	upx
behavioral2/memory/4076-146-0x00007FF7F38B0000-0x00007FF7F3CA6000-memory.dmp	upx
behavioral2/files/0x0007000000023420-144.dat	upx
behavioral2/files/0x000700000002341f-142.dat	upx
behavioral2/files/0x000700000002341e-137.dat	upx
behavioral2/files/0x0007000000023417-132.dat	upx
behavioral2/memory/5160-128-0x00007FF719950000-0x00007FF719D46000-memory.dmp	upx
behavioral2/files/0x0007000000023419-127.dat	upx
behavioral2/files/0x000800000002341b-134.dat	upx
behavioral2/files/0x0007000000023418-110.dat	upx
behavioral2/memory/5564-91-0x00007FF699570000-0x00007FF699966000-memory.dmp	upx
behavioral2/files/0x0007000000023415-88.dat	upx
behavioral2/memory/3680-83-0x00007FF6B9860000-0x00007FF6B9C56000-memory.dmp	upx
behavioral2/memory/3908-70-0x00007FF785370000-0x00007FF785766000-memory.dmp	upx
behavioral2/files/0x0007000000023414-66.dat	upx
behavioral2/files/0x0007000000023413-65.dat	upx
behavioral2/memory/3460-61-0x00007FF71E160000-0x00007FF71E556000-memory.dmp	upx
behavioral2/files/0x0007000000023412-54.dat	upx
behavioral2/files/0x0007000000023410-50.dat	upx
behavioral2/memory/3560-48-0x00007FF611B70000-0x00007FF611F66000-memory.dmp	upx
behavioral2/memory/3968-57-0x00007FF63E7A0000-0x00007FF63EB96000-memory.dmp	upx
behavioral2/memory/2164-32-0x00007FF746CE0000-0x00007FF7470D6000-memory.dmp	upx
behavioral2/files/0x000700000002340f-36.dat	upx
behavioral2/memory/624-24-0x00007FF75C7B0000-0x00007FF75CBA6000-memory.dmp	upx
behavioral2/memory/2164-2463-0x00007FF746CE0000-0x00007FF7470D6000-memory.dmp	upx
behavioral2/memory/3680-2983-0x00007FF6B9860000-0x00007FF6B9C56000-memory.dmp	upx
behavioral2/memory/4076-2988-0x00007FF7F38B0000-0x00007FF7F3CA6000-memory.dmp	upx
behavioral2/memory/5160-2986-0x00007FF719950000-0x00007FF719D46000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
8	raw.githubusercontent.com
9	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\FSyRyRH.exe	6783db08b54cca5303164e90af8fefb0_NeikiAnalytics.exe
File created	C:\Windows\System\fRwLOGg.exe	6783db08b54cca5303164e90af8fefb0_NeikiAnalytics.exe
File created	C:\Windows\System\kZPFaJg.exe	6783db08b54cca5303164e90af8fefb0_NeikiAnalytics.exe
File created	C:\Windows\System\kyLeJqK.exe	6783db08b54cca5303164e90af8fefb0_NeikiAnalytics.exe
File created	C:\Windows\System\kvckQjK.exe	6783db08b54cca5303164e90af8fefb0_NeikiAnalytics.exe
File created	C:\Windows\System\DkOkViC.exe	6783db08b54cca5303164e90af8fefb0_NeikiAnalytics.exe
File created	C:\Windows\System\mVftIQG.exe	6783db08b54cca5303164e90af8fefb0_NeikiAnalytics.exe
File created	C:\Windows\System\BWzUSFp.exe	6783db08b54cca5303164e90af8fefb0_NeikiAnalytics.exe
File created	C:\Windows\System\bWUBvsx.exe	6783db08b54cca5303164e90af8fefb0_NeikiAnalytics.exe
File created	C:\Windows\System\sqoRKfZ.exe	6783db08b54cca5303164e90af8fefb0_NeikiAnalytics.exe
File created	C:\Windows\System\YQRSvUY.exe	6783db08b54cca5303164e90af8fefb0_NeikiAnalytics.exe
File created	C:\Windows\System\DsfIcrM.exe	6783db08b54cca5303164e90af8fefb0_NeikiAnalytics.exe
File created	C:\Windows\System\paGRnVr.exe	6783db08b54cca5303164e90af8fefb0_NeikiAnalytics.exe
File created	C:\Windows\System\JjhIIyl.exe	6783db08b54cca5303164e90af8fefb0_NeikiAnalytics.exe
File created	C:\Windows\System\Jvmggoa.exe	6783db08b54cca5303164e90af8fefb0_NeikiAnalytics.exe
File created	C:\Windows\System\GfiOLlF.exe	6783db08b54cca5303164e90af8fefb0_NeikiAnalytics.exe
File created	C:\Windows\System\jddYGmp.exe	6783db08b54cca5303164e90af8fefb0_NeikiAnalytics.exe
File created	C:\Windows\System\pVMHHlQ.exe	6783db08b54cca5303164e90af8fefb0_NeikiAnalytics.exe
File created	C:\Windows\System\oYMGSbA.exe	6783db08b54cca5303164e90af8fefb0_NeikiAnalytics.exe
File created	C:\Windows\System\mlNGAfs.exe	6783db08b54cca5303164e90af8fefb0_NeikiAnalytics.exe
File created	C:\Windows\System\QCgzZte.exe	6783db08b54cca5303164e90af8fefb0_NeikiAnalytics.exe
File created	C:\Windows\System\cagtcDJ.exe	6783db08b54cca5303164e90af8fefb0_NeikiAnalytics.exe
File created	C:\Windows\System\xTRpGNv.exe	6783db08b54cca5303164e90af8fefb0_NeikiAnalytics.exe
File created	C:\Windows\System\nxXHccA.exe	6783db08b54cca5303164e90af8fefb0_NeikiAnalytics.exe
File created	C:\Windows\System\wSNrggi.exe	6783db08b54cca5303164e90af8fefb0_NeikiAnalytics.exe
File created	C:\Windows\System\pHBdEdr.exe	6783db08b54cca5303164e90af8fefb0_NeikiAnalytics.exe
File created	C:\Windows\System\GkPYexq.exe	6783db08b54cca5303164e90af8fefb0_NeikiAnalytics.exe
File created	C:\Windows\System\PBrVKDm.exe	6783db08b54cca5303164e90af8fefb0_NeikiAnalytics.exe
File created	C:\Windows\System\RLziKwm.exe	6783db08b54cca5303164e90af8fefb0_NeikiAnalytics.exe
File created	C:\Windows\System\ZLqSNKL.exe	6783db08b54cca5303164e90af8fefb0_NeikiAnalytics.exe
File created	C:\Windows\System\wplghKO.exe	6783db08b54cca5303164e90af8fefb0_NeikiAnalytics.exe
File created	C:\Windows\System\tAipiuK.exe	6783db08b54cca5303164e90af8fefb0_NeikiAnalytics.exe
File created	C:\Windows\System\aJTLHsT.exe	6783db08b54cca5303164e90af8fefb0_NeikiAnalytics.exe
File created	C:\Windows\System\djvliqo.exe	6783db08b54cca5303164e90af8fefb0_NeikiAnalytics.exe
File created	C:\Windows\System\gWVBPfT.exe	6783db08b54cca5303164e90af8fefb0_NeikiAnalytics.exe
File created	C:\Windows\System\mdFYMRi.exe	6783db08b54cca5303164e90af8fefb0_NeikiAnalytics.exe
File created	C:\Windows\System\xZXoRAM.exe	6783db08b54cca5303164e90af8fefb0_NeikiAnalytics.exe
File created	C:\Windows\System\fcZBClt.exe	6783db08b54cca5303164e90af8fefb0_NeikiAnalytics.exe
File created	C:\Windows\System\envBJkI.exe	6783db08b54cca5303164e90af8fefb0_NeikiAnalytics.exe
File created	C:\Windows\System\GgerqSW.exe	6783db08b54cca5303164e90af8fefb0_NeikiAnalytics.exe
File created	C:\Windows\System\liaPxOP.exe	6783db08b54cca5303164e90af8fefb0_NeikiAnalytics.exe
File created	C:\Windows\System\SwvJZYW.exe	6783db08b54cca5303164e90af8fefb0_NeikiAnalytics.exe
File created	C:\Windows\System\SsabzRE.exe	6783db08b54cca5303164e90af8fefb0_NeikiAnalytics.exe
File created	C:\Windows\System\VZcmJdx.exe	6783db08b54cca5303164e90af8fefb0_NeikiAnalytics.exe
File created	C:\Windows\System\hdOYdrj.exe	6783db08b54cca5303164e90af8fefb0_NeikiAnalytics.exe
File created	C:\Windows\System\mAGhAwc.exe	6783db08b54cca5303164e90af8fefb0_NeikiAnalytics.exe
File created	C:\Windows\System\yOkfNKA.exe	6783db08b54cca5303164e90af8fefb0_NeikiAnalytics.exe
File created	C:\Windows\System\UTcqluN.exe	6783db08b54cca5303164e90af8fefb0_NeikiAnalytics.exe
File created	C:\Windows\System\sNGPRXB.exe	6783db08b54cca5303164e90af8fefb0_NeikiAnalytics.exe
File created	C:\Windows\System\YoynWED.exe	6783db08b54cca5303164e90af8fefb0_NeikiAnalytics.exe
File created	C:\Windows\System\KnQdUkh.exe	6783db08b54cca5303164e90af8fefb0_NeikiAnalytics.exe
File created	C:\Windows\System\UrVhzZI.exe	6783db08b54cca5303164e90af8fefb0_NeikiAnalytics.exe
File created	C:\Windows\System\EIOViTY.exe	6783db08b54cca5303164e90af8fefb0_NeikiAnalytics.exe
File created	C:\Windows\System\UhdpmEI.exe	6783db08b54cca5303164e90af8fefb0_NeikiAnalytics.exe
File created	C:\Windows\System\NGeKvSQ.exe	6783db08b54cca5303164e90af8fefb0_NeikiAnalytics.exe
File created	C:\Windows\System\qKinhLK.exe	6783db08b54cca5303164e90af8fefb0_NeikiAnalytics.exe
File created	C:\Windows\System\imdghCk.exe	6783db08b54cca5303164e90af8fefb0_NeikiAnalytics.exe
File created	C:\Windows\System\stIGqPm.exe	6783db08b54cca5303164e90af8fefb0_NeikiAnalytics.exe
File created	C:\Windows\System\hZZjzkI.exe	6783db08b54cca5303164e90af8fefb0_NeikiAnalytics.exe
File created	C:\Windows\System\VnKOMwg.exe	6783db08b54cca5303164e90af8fefb0_NeikiAnalytics.exe
File created	C:\Windows\System\uEMrAtm.exe	6783db08b54cca5303164e90af8fefb0_NeikiAnalytics.exe
File created	C:\Windows\System\jrDTGtf.exe	6783db08b54cca5303164e90af8fefb0_NeikiAnalytics.exe
File created	C:\Windows\System\QyUfUhF.exe	6783db08b54cca5303164e90af8fefb0_NeikiAnalytics.exe
File created	C:\Windows\System\KtjSPqt.exe	6783db08b54cca5303164e90af8fefb0_NeikiAnalytics.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
3008	powershell.exe
3008	powershell.exe
3008	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	528	6783db08b54cca5303164e90af8fefb0_NeikiAnalytics.exe
Token: SeDebugPrivilege	3008	powershell.exe
Token: SeLockMemoryPrivilege	528	6783db08b54cca5303164e90af8fefb0_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 528 wrote to memory of 3008	528	6783db08b54cca5303164e90af8fefb0_NeikiAnalytics.exe	82
PID 528 wrote to memory of 3008	528	6783db08b54cca5303164e90af8fefb0_NeikiAnalytics.exe	82
PID 528 wrote to memory of 2524	528	6783db08b54cca5303164e90af8fefb0_NeikiAnalytics.exe	83
PID 528 wrote to memory of 2524	528	6783db08b54cca5303164e90af8fefb0_NeikiAnalytics.exe	83
PID 528 wrote to memory of 3560	528	6783db08b54cca5303164e90af8fefb0_NeikiAnalytics.exe	84
PID 528 wrote to memory of 3560	528	6783db08b54cca5303164e90af8fefb0_NeikiAnalytics.exe	84
PID 528 wrote to memory of 2164	528	6783db08b54cca5303164e90af8fefb0_NeikiAnalytics.exe	85
PID 528 wrote to memory of 2164	528	6783db08b54cca5303164e90af8fefb0_NeikiAnalytics.exe	85
PID 528 wrote to memory of 624	528	6783db08b54cca5303164e90af8fefb0_NeikiAnalytics.exe	86
PID 528 wrote to memory of 624	528	6783db08b54cca5303164e90af8fefb0_NeikiAnalytics.exe	86
PID 528 wrote to memory of 3968	528	6783db08b54cca5303164e90af8fefb0_NeikiAnalytics.exe	87
PID 528 wrote to memory of 3968	528	6783db08b54cca5303164e90af8fefb0_NeikiAnalytics.exe	87
PID 528 wrote to memory of 3460	528	6783db08b54cca5303164e90af8fefb0_NeikiAnalytics.exe	88
PID 528 wrote to memory of 3460	528	6783db08b54cca5303164e90af8fefb0_NeikiAnalytics.exe	88
PID 528 wrote to memory of 3404	528	6783db08b54cca5303164e90af8fefb0_NeikiAnalytics.exe	89
PID 528 wrote to memory of 3404	528	6783db08b54cca5303164e90af8fefb0_NeikiAnalytics.exe	89
PID 528 wrote to memory of 3908	528	6783db08b54cca5303164e90af8fefb0_NeikiAnalytics.exe	90
PID 528 wrote to memory of 3908	528	6783db08b54cca5303164e90af8fefb0_NeikiAnalytics.exe	90
PID 528 wrote to memory of 4348	528	6783db08b54cca5303164e90af8fefb0_NeikiAnalytics.exe	91
PID 528 wrote to memory of 4348	528	6783db08b54cca5303164e90af8fefb0_NeikiAnalytics.exe	91
PID 528 wrote to memory of 3680	528	6783db08b54cca5303164e90af8fefb0_NeikiAnalytics.exe	92
PID 528 wrote to memory of 3680	528	6783db08b54cca5303164e90af8fefb0_NeikiAnalytics.exe	92
PID 528 wrote to memory of 5388	528	6783db08b54cca5303164e90af8fefb0_NeikiAnalytics.exe	93
PID 528 wrote to memory of 5388	528	6783db08b54cca5303164e90af8fefb0_NeikiAnalytics.exe	93
PID 528 wrote to memory of 5564	528	6783db08b54cca5303164e90af8fefb0_NeikiAnalytics.exe	94
PID 528 wrote to memory of 5564	528	6783db08b54cca5303164e90af8fefb0_NeikiAnalytics.exe	94
PID 528 wrote to memory of 5160	528	6783db08b54cca5303164e90af8fefb0_NeikiAnalytics.exe	95
PID 528 wrote to memory of 5160	528	6783db08b54cca5303164e90af8fefb0_NeikiAnalytics.exe	95
PID 528 wrote to memory of 4896	528	6783db08b54cca5303164e90af8fefb0_NeikiAnalytics.exe	96
PID 528 wrote to memory of 4896	528	6783db08b54cca5303164e90af8fefb0_NeikiAnalytics.exe	96
PID 528 wrote to memory of 4076	528	6783db08b54cca5303164e90af8fefb0_NeikiAnalytics.exe	97
PID 528 wrote to memory of 4076	528	6783db08b54cca5303164e90af8fefb0_NeikiAnalytics.exe	97
PID 528 wrote to memory of 3684	528	6783db08b54cca5303164e90af8fefb0_NeikiAnalytics.exe	98
PID 528 wrote to memory of 3684	528	6783db08b54cca5303164e90af8fefb0_NeikiAnalytics.exe	98
PID 528 wrote to memory of 6112	528	6783db08b54cca5303164e90af8fefb0_NeikiAnalytics.exe	99
PID 528 wrote to memory of 6112	528	6783db08b54cca5303164e90af8fefb0_NeikiAnalytics.exe	99
PID 528 wrote to memory of 6024	528	6783db08b54cca5303164e90af8fefb0_NeikiAnalytics.exe	100
PID 528 wrote to memory of 6024	528	6783db08b54cca5303164e90af8fefb0_NeikiAnalytics.exe	100
PID 528 wrote to memory of 688	528	6783db08b54cca5303164e90af8fefb0_NeikiAnalytics.exe	101
PID 528 wrote to memory of 688	528	6783db08b54cca5303164e90af8fefb0_NeikiAnalytics.exe	101
PID 528 wrote to memory of 3164	528	6783db08b54cca5303164e90af8fefb0_NeikiAnalytics.exe	102
PID 528 wrote to memory of 3164	528	6783db08b54cca5303164e90af8fefb0_NeikiAnalytics.exe	102
PID 528 wrote to memory of 6108	528	6783db08b54cca5303164e90af8fefb0_NeikiAnalytics.exe	103
PID 528 wrote to memory of 6108	528	6783db08b54cca5303164e90af8fefb0_NeikiAnalytics.exe	103
PID 528 wrote to memory of 4384	528	6783db08b54cca5303164e90af8fefb0_NeikiAnalytics.exe	104
PID 528 wrote to memory of 4384	528	6783db08b54cca5303164e90af8fefb0_NeikiAnalytics.exe	104
PID 528 wrote to memory of 4400	528	6783db08b54cca5303164e90af8fefb0_NeikiAnalytics.exe	105
PID 528 wrote to memory of 4400	528	6783db08b54cca5303164e90af8fefb0_NeikiAnalytics.exe	105
PID 528 wrote to memory of 4876	528	6783db08b54cca5303164e90af8fefb0_NeikiAnalytics.exe	106
PID 528 wrote to memory of 4876	528	6783db08b54cca5303164e90af8fefb0_NeikiAnalytics.exe	106
PID 528 wrote to memory of 3288	528	6783db08b54cca5303164e90af8fefb0_NeikiAnalytics.exe	107
PID 528 wrote to memory of 3288	528	6783db08b54cca5303164e90af8fefb0_NeikiAnalytics.exe	107
PID 528 wrote to memory of 4192	528	6783db08b54cca5303164e90af8fefb0_NeikiAnalytics.exe	108
PID 528 wrote to memory of 4192	528	6783db08b54cca5303164e90af8fefb0_NeikiAnalytics.exe	108
PID 528 wrote to memory of 544	528	6783db08b54cca5303164e90af8fefb0_NeikiAnalytics.exe	109
PID 528 wrote to memory of 544	528	6783db08b54cca5303164e90af8fefb0_NeikiAnalytics.exe	109
PID 528 wrote to memory of 508	528	6783db08b54cca5303164e90af8fefb0_NeikiAnalytics.exe	110
PID 528 wrote to memory of 508	528	6783db08b54cca5303164e90af8fefb0_NeikiAnalytics.exe	110
PID 528 wrote to memory of 4844	528	6783db08b54cca5303164e90af8fefb0_NeikiAnalytics.exe	111
PID 528 wrote to memory of 4844	528	6783db08b54cca5303164e90af8fefb0_NeikiAnalytics.exe	111
PID 528 wrote to memory of 4904	528	6783db08b54cca5303164e90af8fefb0_NeikiAnalytics.exe	112
PID 528 wrote to memory of 4904	528	6783db08b54cca5303164e90af8fefb0_NeikiAnalytics.exe	112
PID 528 wrote to memory of 1452	528	6783db08b54cca5303164e90af8fefb0_NeikiAnalytics.exe	113
PID 528 wrote to memory of 1452	528	6783db08b54cca5303164e90af8fefb0_NeikiAnalytics.exe	113

C:\Users\Admin\AppData\Local\Temp\6783db08b54cca5303164e90af8fefb0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\6783db08b54cca5303164e90af8fefb0_NeikiAnalytics.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:528
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3008
- C:\Windows\System\MduNXDp.exe
  C:\Windows\System\MduNXDp.exe
  2⤵
  - Executes dropped EXE
  PID:2524
- C:\Windows\System\dTOSkqF.exe
  C:\Windows\System\dTOSkqF.exe
  2⤵
  - Executes dropped EXE
  PID:3560
- C:\Windows\System\tweYpLa.exe
  C:\Windows\System\tweYpLa.exe
  2⤵
  - Executes dropped EXE
  PID:2164
- C:\Windows\System\pKuFsds.exe
  C:\Windows\System\pKuFsds.exe
  2⤵
  - Executes dropped EXE
  PID:624
- C:\Windows\System\AGXTcpM.exe
  C:\Windows\System\AGXTcpM.exe
  2⤵
  - Executes dropped EXE
  PID:3968
- C:\Windows\System\mCxDYym.exe
  C:\Windows\System\mCxDYym.exe
  2⤵
  - Executes dropped EXE
  PID:3460
- C:\Windows\System\yEWSibe.exe
  C:\Windows\System\yEWSibe.exe
  2⤵
  - Executes dropped EXE
  PID:3404
- C:\Windows\System\twMVFDd.exe
  C:\Windows\System\twMVFDd.exe
  2⤵
  - Executes dropped EXE
  PID:3908
- C:\Windows\System\soKRvpV.exe
  C:\Windows\System\soKRvpV.exe
  2⤵
  - Executes dropped EXE
  PID:4348
- C:\Windows\System\pALFnQn.exe
  C:\Windows\System\pALFnQn.exe
  2⤵
  - Executes dropped EXE
  PID:3680
- C:\Windows\System\AmLGwdp.exe
  C:\Windows\System\AmLGwdp.exe
  2⤵
  - Executes dropped EXE
  PID:5388
- C:\Windows\System\EYAauhX.exe
  C:\Windows\System\EYAauhX.exe
  2⤵
  - Executes dropped EXE
  PID:5564
- C:\Windows\System\qohwkLc.exe
  C:\Windows\System\qohwkLc.exe
  2⤵
  - Executes dropped EXE
  PID:5160
- C:\Windows\System\nGtcdmM.exe
  C:\Windows\System\nGtcdmM.exe
  2⤵
  - Executes dropped EXE
  PID:4896
- C:\Windows\System\kIAPkMv.exe
  C:\Windows\System\kIAPkMv.exe
  2⤵
  - Executes dropped EXE
  PID:4076
- C:\Windows\System\QKimhCI.exe
  C:\Windows\System\QKimhCI.exe
  2⤵
  - Executes dropped EXE
  PID:3684
- C:\Windows\System\pVdAfHK.exe
  C:\Windows\System\pVdAfHK.exe
  2⤵
  - Executes dropped EXE
  PID:6112
- C:\Windows\System\QUbiFlo.exe
  C:\Windows\System\QUbiFlo.exe
  2⤵
  - Executes dropped EXE
  PID:6024
- C:\Windows\System\PwrcdvE.exe
  C:\Windows\System\PwrcdvE.exe
  2⤵
  - Executes dropped EXE
  PID:688
- C:\Windows\System\HmdAapU.exe
  C:\Windows\System\HmdAapU.exe
  2⤵
  - Executes dropped EXE
  PID:3164
- C:\Windows\System\qoGWmYH.exe
  C:\Windows\System\qoGWmYH.exe
  2⤵
  - Executes dropped EXE
  PID:6108
- C:\Windows\System\mJKGfAA.exe
  C:\Windows\System\mJKGfAA.exe
  2⤵
  - Executes dropped EXE
  PID:4384
- C:\Windows\System\dTorOHo.exe
  C:\Windows\System\dTorOHo.exe
  2⤵
  - Executes dropped EXE
  PID:4400
- C:\Windows\System\hdNcQZr.exe
  C:\Windows\System\hdNcQZr.exe
  2⤵
  - Executes dropped EXE
  PID:4876
- C:\Windows\System\FRqSNUn.exe
  C:\Windows\System\FRqSNUn.exe
  2⤵
  - Executes dropped EXE
  PID:3288
- C:\Windows\System\gLcPzYg.exe
  C:\Windows\System\gLcPzYg.exe
  2⤵
  - Executes dropped EXE
  PID:4192
- C:\Windows\System\FgerKAI.exe
  C:\Windows\System\FgerKAI.exe
  2⤵
  - Executes dropped EXE
  PID:544
- C:\Windows\System\UWgZTjW.exe
  C:\Windows\System\UWgZTjW.exe
  2⤵
  - Executes dropped EXE
  PID:508
- C:\Windows\System\utwVKtX.exe
  C:\Windows\System\utwVKtX.exe
  2⤵
  - Executes dropped EXE
  PID:4844
- C:\Windows\System\DtlaLFx.exe
  C:\Windows\System\DtlaLFx.exe
  2⤵
  - Executes dropped EXE
  PID:4904
- C:\Windows\System\MXmuwht.exe
  C:\Windows\System\MXmuwht.exe
  2⤵
  - Executes dropped EXE
  PID:1452
- C:\Windows\System\TWAfeSm.exe
  C:\Windows\System\TWAfeSm.exe
  2⤵
  - Executes dropped EXE
  PID:5580
- C:\Windows\System\BDqwtHO.exe
  C:\Windows\System\BDqwtHO.exe
  2⤵
  - Executes dropped EXE
  PID:5544
- C:\Windows\System\uUOxDxX.exe
  C:\Windows\System\uUOxDxX.exe
  2⤵
  - Executes dropped EXE
  PID:1888
- C:\Windows\System\DWyxGUF.exe
  C:\Windows\System\DWyxGUF.exe
  2⤵
  - Executes dropped EXE
  PID:2668
- C:\Windows\System\avpKVbj.exe
  C:\Windows\System\avpKVbj.exe
  2⤵
  - Executes dropped EXE
  PID:1612
- C:\Windows\System\oYMsgzd.exe
  C:\Windows\System\oYMsgzd.exe
  2⤵
  - Executes dropped EXE
  PID:4572
- C:\Windows\System\QsUEALg.exe
  C:\Windows\System\QsUEALg.exe
  2⤵
  - Executes dropped EXE
  PID:3480
- C:\Windows\System\TzFfRQv.exe
  C:\Windows\System\TzFfRQv.exe
  2⤵
  - Executes dropped EXE
  PID:5360
- C:\Windows\System\rzQaROH.exe
  C:\Windows\System\rzQaROH.exe
  2⤵
  - Executes dropped EXE
  PID:2564
- C:\Windows\System\bGQLdvc.exe
  C:\Windows\System\bGQLdvc.exe
  2⤵
  - Executes dropped EXE
  PID:2000
- C:\Windows\System\PepKzqJ.exe
  C:\Windows\System\PepKzqJ.exe
  2⤵
  - Executes dropped EXE
  PID:2448
- C:\Windows\System\NBxtMYb.exe
  C:\Windows\System\NBxtMYb.exe
  2⤵
  - Executes dropped EXE
  PID:2956
- C:\Windows\System\QfybdkY.exe
  C:\Windows\System\QfybdkY.exe
  2⤵
  - Executes dropped EXE
  PID:2396
- C:\Windows\System\lWIaoCq.exe
  C:\Windows\System\lWIaoCq.exe
  2⤵
  - Executes dropped EXE
  PID:4952
- C:\Windows\System\gnnPaJZ.exe
  C:\Windows\System\gnnPaJZ.exe
  2⤵
  - Executes dropped EXE
  PID:2592
- C:\Windows\System\MAvkFFn.exe
  C:\Windows\System\MAvkFFn.exe
  2⤵
  - Executes dropped EXE
  PID:4072
- C:\Windows\System\uwYXVfm.exe
  C:\Windows\System\uwYXVfm.exe
  2⤵
  - Executes dropped EXE
  PID:5260
- C:\Windows\System\VVDhtKg.exe
  C:\Windows\System\VVDhtKg.exe
  2⤵
  - Executes dropped EXE
  PID:4168
- C:\Windows\System\yLouCYc.exe
  C:\Windows\System\yLouCYc.exe
  2⤵
  - Executes dropped EXE
  PID:2932
- C:\Windows\System\WFumWdO.exe
  C:\Windows\System\WFumWdO.exe
  2⤵
  - Executes dropped EXE
  PID:4656
- C:\Windows\System\YVLDYze.exe
  C:\Windows\System\YVLDYze.exe
  2⤵
  - Executes dropped EXE
  PID:1168
- C:\Windows\System\oxWvmaw.exe
  C:\Windows\System\oxWvmaw.exe
  2⤵
  - Executes dropped EXE
  PID:724
- C:\Windows\System\zICcjvr.exe
  C:\Windows\System\zICcjvr.exe
  2⤵
  - Executes dropped EXE
  PID:1764
- C:\Windows\System\TQiRXXk.exe
  C:\Windows\System\TQiRXXk.exe
  2⤵
  - Executes dropped EXE
  PID:5768
- C:\Windows\System\Qftinza.exe
  C:\Windows\System\Qftinza.exe
  2⤵
  - Executes dropped EXE
  PID:1244
- C:\Windows\System\zTebdDg.exe
  C:\Windows\System\zTebdDg.exe
  2⤵
  - Executes dropped EXE
  PID:3584
- C:\Windows\System\vqULHQF.exe
  C:\Windows\System\vqULHQF.exe
  2⤵
  - Executes dropped EXE
  PID:1092
- C:\Windows\System\jQWRVMF.exe
  C:\Windows\System\jQWRVMF.exe
  2⤵
  - Executes dropped EXE
  PID:5816
- C:\Windows\System\vtnZPLc.exe
  C:\Windows\System\vtnZPLc.exe
  2⤵
  - Executes dropped EXE
  PID:752
- C:\Windows\System\FOVARTa.exe
  C:\Windows\System\FOVARTa.exe
  2⤵
  - Executes dropped EXE
  PID:5668
- C:\Windows\System\NTjCMTq.exe
  C:\Windows\System\NTjCMTq.exe
  2⤵
  - Executes dropped EXE
  PID:3940
- C:\Windows\System\bQykuUX.exe
  C:\Windows\System\bQykuUX.exe
  2⤵
  - Executes dropped EXE
  PID:5636
- C:\Windows\System\XNtMiDQ.exe
  C:\Windows\System\XNtMiDQ.exe
  2⤵
  - Executes dropped EXE
  PID:3972
- C:\Windows\System\QphaSYD.exe
  C:\Windows\System\QphaSYD.exe
  2⤵
  PID:1068
- C:\Windows\System\pyJVBpt.exe
  C:\Windows\System\pyJVBpt.exe
  2⤵
  PID:5756
- C:\Windows\System\vaDeOec.exe
  C:\Windows\System\vaDeOec.exe
  2⤵
  PID:6116
- C:\Windows\System\xfwKYPy.exe
  C:\Windows\System\xfwKYPy.exe
  2⤵
  PID:2016
- C:\Windows\System\RIkGCxO.exe
  C:\Windows\System\RIkGCxO.exe
  2⤵
  PID:4440
- C:\Windows\System\fJlgJOx.exe
  C:\Windows\System\fJlgJOx.exe
  2⤵
  PID:5036
- C:\Windows\System\QcKjQiC.exe
  C:\Windows\System\QcKjQiC.exe
  2⤵
  PID:4960
- C:\Windows\System\evIoFDi.exe
  C:\Windows\System\evIoFDi.exe
  2⤵
  PID:1576
- C:\Windows\System\EIyUfcc.exe
  C:\Windows\System\EIyUfcc.exe
  2⤵
  PID:3944
- C:\Windows\System\QvjyvhZ.exe
  C:\Windows\System\QvjyvhZ.exe
  2⤵
  PID:4080
- C:\Windows\System\ysqQOyB.exe
  C:\Windows\System\ysqQOyB.exe
  2⤵
  PID:5220
- C:\Windows\System\OMVlaEf.exe
  C:\Windows\System\OMVlaEf.exe
  2⤵
  PID:4824
- C:\Windows\System\yCXqbEM.exe
  C:\Windows\System\yCXqbEM.exe
  2⤵
  PID:2472
- C:\Windows\System\AkWWvqr.exe
  C:\Windows\System\AkWWvqr.exe
  2⤵
  PID:3020
- C:\Windows\System\kNHDfRG.exe
  C:\Windows\System\kNHDfRG.exe
  2⤵
  PID:3292
- C:\Windows\System\ysHEBKq.exe
  C:\Windows\System\ysHEBKq.exe
  2⤵
  PID:2612
- C:\Windows\System\waxSIfo.exe
  C:\Windows\System\waxSIfo.exe
  2⤵
  PID:1228
- C:\Windows\System\spqkFxF.exe
  C:\Windows\System\spqkFxF.exe
  2⤵
  PID:2240
- C:\Windows\System\CuuLzlR.exe
  C:\Windows\System\CuuLzlR.exe
  2⤵
  PID:5312
- C:\Windows\System\oFxQPYc.exe
  C:\Windows\System\oFxQPYc.exe
  2⤵
  PID:5056
- C:\Windows\System\xsWrCkJ.exe
  C:\Windows\System\xsWrCkJ.exe
  2⤵
  PID:2864
- C:\Windows\System\rwPzrCH.exe
  C:\Windows\System\rwPzrCH.exe
  2⤵
  PID:5964
- C:\Windows\System\XoFgkZR.exe
  C:\Windows\System\XoFgkZR.exe
  2⤵
  PID:5500
- C:\Windows\System\gTBeMOB.exe
  C:\Windows\System\gTBeMOB.exe
  2⤵
  PID:872
- C:\Windows\System\NTnnCmz.exe
  C:\Windows\System\NTnnCmz.exe
  2⤵
  PID:5560
- C:\Windows\System\bitDgfE.exe
  C:\Windows\System\bitDgfE.exe
  2⤵
  PID:4256
- C:\Windows\System\kSfyluK.exe
  C:\Windows\System\kSfyluK.exe
  2⤵
  PID:1988
- C:\Windows\System\iQxyDiD.exe
  C:\Windows\System\iQxyDiD.exe
  2⤵
  PID:1752
- C:\Windows\System\QiWPpXP.exe
  C:\Windows\System\QiWPpXP.exe
  2⤵
  PID:1868
- C:\Windows\System\Yzvpiot.exe
  C:\Windows\System\Yzvpiot.exe
  2⤵
  PID:4248
- C:\Windows\System\DgNiWxs.exe
  C:\Windows\System\DgNiWxs.exe
  2⤵
  PID:1876
- C:\Windows\System\QdgLUeY.exe
  C:\Windows\System\QdgLUeY.exe
  2⤵
  PID:3964
- C:\Windows\System\ASPUQrn.exe
  C:\Windows\System\ASPUQrn.exe
  2⤵
  PID:620
- C:\Windows\System\zdovBIj.exe
  C:\Windows\System\zdovBIj.exe
  2⤵
  PID:5800
- C:\Windows\System\pTOSIva.exe
  C:\Windows\System\pTOSIva.exe
  2⤵
  PID:1776
- C:\Windows\System\eWluqNf.exe
  C:\Windows\System\eWluqNf.exe
  2⤵
  PID:5856
- C:\Windows\System\fvJZtuh.exe
  C:\Windows\System\fvJZtuh.exe
  2⤵
  PID:5724
- C:\Windows\System\hluUNyK.exe
  C:\Windows\System\hluUNyK.exe
  2⤵
  PID:4420
- C:\Windows\System\SSBgdjY.exe
  C:\Windows\System\SSBgdjY.exe
  2⤵
  PID:3844
- C:\Windows\System\gOOtOmU.exe
  C:\Windows\System\gOOtOmU.exe
  2⤵
  PID:1224
- C:\Windows\System\ULYaAzs.exe
  C:\Windows\System\ULYaAzs.exe
  2⤵
  PID:3980
- C:\Windows\System\obBoTOJ.exe
  C:\Windows\System\obBoTOJ.exe
  2⤵
  PID:5832
- C:\Windows\System\hwNVOGF.exe
  C:\Windows\System\hwNVOGF.exe
  2⤵
  PID:3764
- C:\Windows\System\QQGyAEZ.exe
  C:\Windows\System\QQGyAEZ.exe
  2⤵
  PID:3468
- C:\Windows\System\lfRUEbB.exe
  C:\Windows\System\lfRUEbB.exe
  2⤵
  PID:3852
- C:\Windows\System\agYOvhl.exe
  C:\Windows\System\agYOvhl.exe
  2⤵
  PID:400
- C:\Windows\System\PfHToBR.exe
  C:\Windows\System\PfHToBR.exe
  2⤵
  PID:672
- C:\Windows\System\iPyLIxu.exe
  C:\Windows\System\iPyLIxu.exe
  2⤵
  PID:5060
- C:\Windows\System\XUMFzJG.exe
  C:\Windows\System\XUMFzJG.exe
  2⤵
  PID:3892
- C:\Windows\System\mLmzrYB.exe
  C:\Windows\System\mLmzrYB.exe
  2⤵
  PID:3124
- C:\Windows\System\inMQGPK.exe
  C:\Windows\System\inMQGPK.exe
  2⤵
  PID:4452
- C:\Windows\System\JCkmWxI.exe
  C:\Windows\System\JCkmWxI.exe
  2⤵
  PID:6088
- C:\Windows\System\VtniyQr.exe
  C:\Windows\System\VtniyQr.exe
  2⤵
  PID:2508
- C:\Windows\System\GVwgwEV.exe
  C:\Windows\System\GVwgwEV.exe
  2⤵
  PID:2996
- C:\Windows\System\FsXXkeK.exe
  C:\Windows\System\FsXXkeK.exe
  2⤵
  PID:5588
- C:\Windows\System\vkkPnIn.exe
  C:\Windows\System\vkkPnIn.exe
  2⤵
  PID:4364
- C:\Windows\System\sBTgYyN.exe
  C:\Windows\System\sBTgYyN.exe
  2⤵
  PID:2944
- C:\Windows\System\ciCYHpS.exe
  C:\Windows\System\ciCYHpS.exe
  2⤵
  PID:1556
- C:\Windows\System\bfwZoVw.exe
  C:\Windows\System\bfwZoVw.exe
  2⤵
  PID:2928
- C:\Windows\System\bzXKyLX.exe
  C:\Windows\System\bzXKyLX.exe
  2⤵
  PID:1928
- C:\Windows\System\khChFdG.exe
  C:\Windows\System\khChFdG.exe
  2⤵
  PID:1320
- C:\Windows\System\riQzpjz.exe
  C:\Windows\System\riQzpjz.exe
  2⤵
  PID:628
- C:\Windows\System\NrKPszl.exe
  C:\Windows\System\NrKPszl.exe
  2⤵
  PID:3616
- C:\Windows\System\xiuqkJP.exe
  C:\Windows\System\xiuqkJP.exe
  2⤵
  PID:3956
- C:\Windows\System\ufZhZcr.exe
  C:\Windows\System\ufZhZcr.exe
  2⤵
  PID:5536
- C:\Windows\System\mmqLbkN.exe
  C:\Windows\System\mmqLbkN.exe
  2⤵
  PID:2488
- C:\Windows\System\uSdoNNR.exe
  C:\Windows\System\uSdoNNR.exe
  2⤵
  PID:6008
- C:\Windows\System\twddBIl.exe
  C:\Windows\System\twddBIl.exe
  2⤵
  PID:3280
- C:\Windows\System\XgeQihb.exe
  C:\Windows\System\XgeQihb.exe
  2⤵
  PID:1952
- C:\Windows\System\MgSPjjK.exe
  C:\Windows\System\MgSPjjK.exe
  2⤵
  PID:3172
- C:\Windows\System\wzqgTKE.exe
  C:\Windows\System\wzqgTKE.exe
  2⤵
  PID:1700
- C:\Windows\System\OUeqvbH.exe
  C:\Windows\System\OUeqvbH.exe
  2⤵
  PID:4036
- C:\Windows\System\utmZxAw.exe
  C:\Windows\System\utmZxAw.exe
  2⤵
  PID:1932
- C:\Windows\System\EMkhnPu.exe
  C:\Windows\System\EMkhnPu.exe
  2⤵
  PID:5656
- C:\Windows\System\llHusaZ.exe
  C:\Windows\System\llHusaZ.exe
  2⤵
  PID:3136
- C:\Windows\System\XNwWflN.exe
  C:\Windows\System\XNwWflN.exe
  2⤵
  PID:5032
- C:\Windows\System\mmSwQhf.exe
  C:\Windows\System\mmSwQhf.exe
  2⤵
  PID:772
- C:\Windows\System\TdGWTno.exe
  C:\Windows\System\TdGWTno.exe
  2⤵
  PID:5228
- C:\Windows\System\CmZgqMC.exe
  C:\Windows\System\CmZgqMC.exe
  2⤵
  PID:2460
- C:\Windows\System\tcddHSL.exe
  C:\Windows\System\tcddHSL.exe
  2⤵
  PID:4224
- C:\Windows\System\tXANeqo.exe
  C:\Windows\System\tXANeqo.exe
  2⤵
  PID:4124
- C:\Windows\System\YUbJfRW.exe
  C:\Windows\System\YUbJfRW.exe
  2⤵
  PID:3536
- C:\Windows\System\WjXBIXp.exe
  C:\Windows\System\WjXBIXp.exe
  2⤵
  PID:1076
- C:\Windows\System\NEZZdtW.exe
  C:\Windows\System\NEZZdtW.exe
  2⤵
  PID:4568
- C:\Windows\System\QtzHZRO.exe
  C:\Windows\System\QtzHZRO.exe
  2⤵
  PID:4580
- C:\Windows\System\FzPCAyB.exe
  C:\Windows\System\FzPCAyB.exe
  2⤵
  PID:5968
- C:\Windows\System\HRFHLpw.exe
  C:\Windows\System\HRFHLpw.exe
  2⤵
  PID:5488
- C:\Windows\System\cHDHujC.exe
  C:\Windows\System\cHDHujC.exe
  2⤵
  PID:5064
- C:\Windows\System\bFMcgOJ.exe
  C:\Windows\System\bFMcgOJ.exe
  2⤵
  PID:6164
- C:\Windows\System\yjgKcvL.exe
  C:\Windows\System\yjgKcvL.exe
  2⤵
  PID:6200
- C:\Windows\System\meJLHhA.exe
  C:\Windows\System\meJLHhA.exe
  2⤵
  PID:6236
- C:\Windows\System\aCuzcuO.exe
  C:\Windows\System\aCuzcuO.exe
  2⤵
  PID:6256
- C:\Windows\System\UUevlFP.exe
  C:\Windows\System\UUevlFP.exe
  2⤵
  PID:6292
- C:\Windows\System\fGASRWP.exe
  C:\Windows\System\fGASRWP.exe
  2⤵
  PID:6320
- C:\Windows\System\Umjvcnx.exe
  C:\Windows\System\Umjvcnx.exe
  2⤵
  PID:6360
- C:\Windows\System\QKeJRqp.exe
  C:\Windows\System\QKeJRqp.exe
  2⤵
  PID:6384
- C:\Windows\System\iatNnSh.exe
  C:\Windows\System\iatNnSh.exe
  2⤵
  PID:6432
- C:\Windows\System\QYXJZgL.exe
  C:\Windows\System\QYXJZgL.exe
  2⤵
  PID:6452
- C:\Windows\System\JejblCv.exe
  C:\Windows\System\JejblCv.exe
  2⤵
  PID:6488
- C:\Windows\System\VmEcfpS.exe
  C:\Windows\System\VmEcfpS.exe
  2⤵
  PID:6524
- C:\Windows\System\bIchEMp.exe
  C:\Windows\System\bIchEMp.exe
  2⤵
  PID:6556
- C:\Windows\System\AuklgyW.exe
  C:\Windows\System\AuklgyW.exe
  2⤵
  PID:6588
- C:\Windows\System\HCZyaRe.exe
  C:\Windows\System\HCZyaRe.exe
  2⤵
  PID:6632
- C:\Windows\System\pKvfeyU.exe
  C:\Windows\System\pKvfeyU.exe
  2⤵
  PID:6660
- C:\Windows\System\wosfckt.exe
  C:\Windows\System\wosfckt.exe
  2⤵
  PID:6680
- C:\Windows\System\SNkBixP.exe
  C:\Windows\System\SNkBixP.exe
  2⤵
  PID:6716
- C:\Windows\System\ayDEHlL.exe
  C:\Windows\System\ayDEHlL.exe
  2⤵
  PID:6756
- C:\Windows\System\ekNrfCA.exe
  C:\Windows\System\ekNrfCA.exe
  2⤵
  PID:6788
- C:\Windows\System\aKLuKks.exe
  C:\Windows\System\aKLuKks.exe
  2⤵
  PID:6804
- C:\Windows\System\GmHWNwv.exe
  C:\Windows\System\GmHWNwv.exe
  2⤵
  PID:6828
- C:\Windows\System\FHwjHTc.exe
  C:\Windows\System\FHwjHTc.exe
  2⤵
  PID:6864
- C:\Windows\System\rPhFakV.exe
  C:\Windows\System\rPhFakV.exe
  2⤵
  PID:6908
- C:\Windows\System\vHBeiyc.exe
  C:\Windows\System\vHBeiyc.exe
  2⤵
  PID:6952
- C:\Windows\System\idNYXsh.exe
  C:\Windows\System\idNYXsh.exe
  2⤵
  PID:6988
- C:\Windows\System\KOgNgqS.exe
  C:\Windows\System\KOgNgqS.exe
  2⤵
  PID:7008
- C:\Windows\System\UsaVspx.exe
  C:\Windows\System\UsaVspx.exe
  2⤵
  PID:7044
- C:\Windows\System\LwhzYyi.exe
  C:\Windows\System\LwhzYyi.exe
  2⤵
  PID:7080
- C:\Windows\System\sSadxbh.exe
  C:\Windows\System\sSadxbh.exe
  2⤵
  PID:7112
- C:\Windows\System\XhfjRrK.exe
  C:\Windows\System\XhfjRrK.exe
  2⤵
  PID:7144
- C:\Windows\System\Yfpknmh.exe
  C:\Windows\System\Yfpknmh.exe
  2⤵
  PID:6152
- C:\Windows\System\DXknwzY.exe
  C:\Windows\System\DXknwzY.exe
  2⤵
  PID:6192
- C:\Windows\System\uApVXDT.exe
  C:\Windows\System\uApVXDT.exe
  2⤵
  PID:6316
- C:\Windows\System\lofQNKQ.exe
  C:\Windows\System\lofQNKQ.exe
  2⤵
  PID:6376
- C:\Windows\System\BQUtVta.exe
  C:\Windows\System\BQUtVta.exe
  2⤵
  PID:6464
- C:\Windows\System\UaJhnPK.exe
  C:\Windows\System\UaJhnPK.exe
  2⤵
  PID:6544
- C:\Windows\System\zhlEXJm.exe
  C:\Windows\System\zhlEXJm.exe
  2⤵
  PID:3760
- C:\Windows\System\hLizTwQ.exe
  C:\Windows\System\hLizTwQ.exe
  2⤵
  PID:6652
- C:\Windows\System\QEAKADS.exe
  C:\Windows\System\QEAKADS.exe
  2⤵
  PID:6768
- C:\Windows\System\nkYdsys.exe
  C:\Windows\System\nkYdsys.exe
  2⤵
  PID:6820
- C:\Windows\System\IwohNrA.exe
  C:\Windows\System\IwohNrA.exe
  2⤵
  PID:6936
- C:\Windows\System\BoFQXsd.exe
  C:\Windows\System\BoFQXsd.exe
  2⤵
  PID:7020
- C:\Windows\System\zuuVfLa.exe
  C:\Windows\System\zuuVfLa.exe
  2⤵
  PID:7088
- C:\Windows\System\lSteMSZ.exe
  C:\Windows\System\lSteMSZ.exe
  2⤵
  PID:7156
- C:\Windows\System\SvCKyPw.exe
  C:\Windows\System\SvCKyPw.exe
  2⤵
  PID:6348
- C:\Windows\System\nHZGjQf.exe
  C:\Windows\System\nHZGjQf.exe
  2⤵
  PID:6448
- C:\Windows\System\cTpYwfz.exe
  C:\Windows\System\cTpYwfz.exe
  2⤵
  PID:6644
- C:\Windows\System\gmCybzr.exe
  C:\Windows\System\gmCybzr.exe
  2⤵
  PID:6888
- C:\Windows\System\MwzLBVe.exe
  C:\Windows\System\MwzLBVe.exe
  2⤵
  PID:7064
- C:\Windows\System\AfGjDHc.exe
  C:\Windows\System\AfGjDHc.exe
  2⤵
  PID:6440
- C:\Windows\System\yCQLQwE.exe
  C:\Windows\System\yCQLQwE.exe
  2⤵
  PID:6752
- C:\Windows\System\XfLBjei.exe
  C:\Windows\System\XfLBjei.exe
  2⤵
  PID:3608
- C:\Windows\System\tndWDjq.exe
  C:\Windows\System\tndWDjq.exe
  2⤵
  PID:7004
- C:\Windows\System\PsvmtCs.exe
  C:\Windows\System\PsvmtCs.exe
  2⤵
  PID:7184
- C:\Windows\System\kiNlgSY.exe
  C:\Windows\System\kiNlgSY.exe
  2⤵
  PID:7216
- C:\Windows\System\lsnltaG.exe
  C:\Windows\System\lsnltaG.exe
  2⤵
  PID:7256
- C:\Windows\System\FtlaAiS.exe
  C:\Windows\System\FtlaAiS.exe
  2⤵
  PID:7280
- C:\Windows\System\LptekGg.exe
  C:\Windows\System\LptekGg.exe
  2⤵
  PID:7308
- C:\Windows\System\nQovcFx.exe
  C:\Windows\System\nQovcFx.exe
  2⤵
  PID:7340
- C:\Windows\System\RRnWGhT.exe
  C:\Windows\System\RRnWGhT.exe
  2⤵
  PID:7368
- C:\Windows\System\XeTumwT.exe
  C:\Windows\System\XeTumwT.exe
  2⤵
  PID:7396
- C:\Windows\System\hBGCOvQ.exe
  C:\Windows\System\hBGCOvQ.exe
  2⤵
  PID:7424
- C:\Windows\System\FtzjWxX.exe
  C:\Windows\System\FtzjWxX.exe
  2⤵
  PID:7452
- C:\Windows\System\YXFXysN.exe
  C:\Windows\System\YXFXysN.exe
  2⤵
  PID:7480
- C:\Windows\System\ayNhryN.exe
  C:\Windows\System\ayNhryN.exe
  2⤵
  PID:7508
- C:\Windows\System\eklgLYx.exe
  C:\Windows\System\eklgLYx.exe
  2⤵
  PID:7532
- C:\Windows\System\uTOWRdX.exe
  C:\Windows\System\uTOWRdX.exe
  2⤵
  PID:7552
- C:\Windows\System\ocwfVcH.exe
  C:\Windows\System\ocwfVcH.exe
  2⤵
  PID:7576
- C:\Windows\System\cdEcBFP.exe
  C:\Windows\System\cdEcBFP.exe
  2⤵
  PID:7612
- C:\Windows\System\kzReHbz.exe
  C:\Windows\System\kzReHbz.exe
  2⤵
  PID:7648
- C:\Windows\System\GCZnlDe.exe
  C:\Windows\System\GCZnlDe.exe
  2⤵
  PID:7676
- C:\Windows\System\GBRzrfm.exe
  C:\Windows\System\GBRzrfm.exe
  2⤵
  PID:7692
- C:\Windows\System\CaIWDze.exe
  C:\Windows\System\CaIWDze.exe
  2⤵
  PID:7724
- C:\Windows\System\MTuXcGQ.exe
  C:\Windows\System\MTuXcGQ.exe
  2⤵
  PID:7760
- C:\Windows\System\KpfCJXx.exe
  C:\Windows\System\KpfCJXx.exe
  2⤵
  PID:7796
- C:\Windows\System\rwxPGXA.exe
  C:\Windows\System\rwxPGXA.exe
  2⤵
  PID:7824
- C:\Windows\System\qkKLfJr.exe
  C:\Windows\System\qkKLfJr.exe
  2⤵
  PID:7852
- C:\Windows\System\EWwZoAu.exe
  C:\Windows\System\EWwZoAu.exe
  2⤵
  PID:7880
- C:\Windows\System\vkJEMXQ.exe
  C:\Windows\System\vkJEMXQ.exe
  2⤵
  PID:7908
- C:\Windows\System\mdHqYIg.exe
  C:\Windows\System\mdHqYIg.exe
  2⤵
  PID:7936
- C:\Windows\System\caXhfBm.exe
  C:\Windows\System\caXhfBm.exe
  2⤵
  PID:7964
- C:\Windows\System\zimjWRY.exe
  C:\Windows\System\zimjWRY.exe
  2⤵
  PID:7984
- C:\Windows\System\rdwhung.exe
  C:\Windows\System\rdwhung.exe
  2⤵
  PID:8020
- C:\Windows\System\TLneLVP.exe
  C:\Windows\System\TLneLVP.exe
  2⤵
  PID:8036
- C:\Windows\System\uwjnPBC.exe
  C:\Windows\System\uwjnPBC.exe
  2⤵
  PID:8084
- C:\Windows\System\JWDjPMR.exe
  C:\Windows\System\JWDjPMR.exe
  2⤵
  PID:8108
- C:\Windows\System\sSpfuWL.exe
  C:\Windows\System\sSpfuWL.exe
  2⤵
  PID:8132
- C:\Windows\System\OWuVVlB.exe
  C:\Windows\System\OWuVVlB.exe
  2⤵
  PID:8160
- C:\Windows\System\TVqDxtZ.exe
  C:\Windows\System\TVqDxtZ.exe
  2⤵
  PID:8188
- C:\Windows\System\HsRCgsZ.exe
  C:\Windows\System\HsRCgsZ.exe
  2⤵
  PID:7232
- C:\Windows\System\utHinIL.exe
  C:\Windows\System\utHinIL.exe
  2⤵
  PID:7300
- C:\Windows\System\KdJUBlF.exe
  C:\Windows\System\KdJUBlF.exe
  2⤵
  PID:7364
- C:\Windows\System\BPQQvwL.exe
  C:\Windows\System\BPQQvwL.exe
  2⤵
  PID:7436
- C:\Windows\System\eScDPqn.exe
  C:\Windows\System\eScDPqn.exe
  2⤵
  PID:7060
- C:\Windows\System\swAgxvq.exe
  C:\Windows\System\swAgxvq.exe
  2⤵
  PID:7568
- C:\Windows\System\hpEqJyM.exe
  C:\Windows\System\hpEqJyM.exe
  2⤵
  PID:7596
- C:\Windows\System\MwWdMln.exe
  C:\Windows\System\MwWdMln.exe
  2⤵
  PID:7688
- C:\Windows\System\OnXzpHz.exe
  C:\Windows\System\OnXzpHz.exe
  2⤵
  PID:7752
- C:\Windows\System\FKEgFxw.exe
  C:\Windows\System\FKEgFxw.exe
  2⤵
  PID:7816
- C:\Windows\System\cdJZXyW.exe
  C:\Windows\System\cdJZXyW.exe
  2⤵
  PID:7896
- C:\Windows\System\KIJOdBr.exe
  C:\Windows\System\KIJOdBr.exe
  2⤵
  PID:7956
- C:\Windows\System\QOSIqbB.exe
  C:\Windows\System\QOSIqbB.exe
  2⤵
  PID:8016
- C:\Windows\System\cEQBXpc.exe
  C:\Windows\System\cEQBXpc.exe
  2⤵
  PID:8072
- C:\Windows\System\fNKdwKn.exe
  C:\Windows\System\fNKdwKn.exe
  2⤵
  PID:8152
- C:\Windows\System\uxXJlzP.exe
  C:\Windows\System\uxXJlzP.exe
  2⤵
  PID:7204
- C:\Windows\System\lwffTnm.exe
  C:\Windows\System\lwffTnm.exe
  2⤵
  PID:7392
- C:\Windows\System\gDDilIo.exe
  C:\Windows\System\gDDilIo.exe
  2⤵
  PID:7524
- C:\Windows\System\fuDeCKJ.exe
  C:\Windows\System\fuDeCKJ.exe
  2⤵
  PID:7668
- C:\Windows\System\AztTVtx.exe
  C:\Windows\System\AztTVtx.exe
  2⤵
  PID:7844
- C:\Windows\System\ZnIyOFE.exe
  C:\Windows\System\ZnIyOFE.exe
  2⤵
  PID:7992
- C:\Windows\System\CNmMwAT.exe
  C:\Windows\System\CNmMwAT.exe
  2⤵
  PID:8144
- C:\Windows\System\jfxRBIq.exe
  C:\Windows\System\jfxRBIq.exe
  2⤵
  PID:7708
- C:\Windows\System\EKABJqP.exe
  C:\Windows\System\EKABJqP.exe
  2⤵
  PID:7748
- C:\Windows\System\MQGDyND.exe
  C:\Windows\System\MQGDyND.exe
  2⤵
  PID:7920
- C:\Windows\System\BenNOuR.exe
  C:\Windows\System\BenNOuR.exe
  2⤵
  PID:7540
- C:\Windows\System\xPKJqMU.exe
  C:\Windows\System\xPKJqMU.exe
  2⤵
  PID:8208
- C:\Windows\System\VREUDRG.exe
  C:\Windows\System\VREUDRG.exe
  2⤵
  PID:8236
- C:\Windows\System\nZFiOhc.exe
  C:\Windows\System\nZFiOhc.exe
  2⤵
  PID:8264
- C:\Windows\System\UGyMgbs.exe
  C:\Windows\System\UGyMgbs.exe
  2⤵
  PID:8292
- C:\Windows\System\zNdCAMt.exe
  C:\Windows\System\zNdCAMt.exe
  2⤵
  PID:8320
- C:\Windows\System\KMNVQSe.exe
  C:\Windows\System\KMNVQSe.exe
  2⤵
  PID:8340
- C:\Windows\System\IOKmSkD.exe
  C:\Windows\System\IOKmSkD.exe
  2⤵
  PID:8364
- C:\Windows\System\AjyzbOa.exe
  C:\Windows\System\AjyzbOa.exe
  2⤵
  PID:8404
- C:\Windows\System\WLvUWyc.exe
  C:\Windows\System\WLvUWyc.exe
  2⤵
  PID:8432
- C:\Windows\System\zpKXVEU.exe
  C:\Windows\System\zpKXVEU.exe
  2⤵
  PID:8460
- C:\Windows\System\mOpbunv.exe
  C:\Windows\System\mOpbunv.exe
  2⤵
  PID:8488
- C:\Windows\System\mNkvOeE.exe
  C:\Windows\System\mNkvOeE.exe
  2⤵
  PID:8516
- C:\Windows\System\bplXkpi.exe
  C:\Windows\System\bplXkpi.exe
  2⤵
  PID:8544
- C:\Windows\System\TrricOf.exe
  C:\Windows\System\TrricOf.exe
  2⤵
  PID:8572
- C:\Windows\System\CtqMesK.exe
  C:\Windows\System\CtqMesK.exe
  2⤵
  PID:8600
- C:\Windows\System\ftqisep.exe
  C:\Windows\System\ftqisep.exe
  2⤵
  PID:8628
- C:\Windows\System\luDGnyT.exe
  C:\Windows\System\luDGnyT.exe
  2⤵
  PID:8656
- C:\Windows\System\gksbmWZ.exe
  C:\Windows\System\gksbmWZ.exe
  2⤵
  PID:8684
- C:\Windows\System\uBTqblz.exe
  C:\Windows\System\uBTqblz.exe
  2⤵
  PID:8712
- C:\Windows\System\YnmUfPq.exe
  C:\Windows\System\YnmUfPq.exe
  2⤵
  PID:8740
- C:\Windows\System\BwaLAez.exe
  C:\Windows\System\BwaLAez.exe
  2⤵
  PID:8756
- C:\Windows\System\JSOmdzF.exe
  C:\Windows\System\JSOmdzF.exe
  2⤵
  PID:8788
- C:\Windows\System\VavKNNw.exe
  C:\Windows\System\VavKNNw.exe
  2⤵
  PID:8824
- C:\Windows\System\alSSnnf.exe
  C:\Windows\System\alSSnnf.exe
  2⤵
  PID:8864
- C:\Windows\System\xtfdftW.exe
  C:\Windows\System\xtfdftW.exe
  2⤵
  PID:8900
- C:\Windows\System\Lpfaqmi.exe
  C:\Windows\System\Lpfaqmi.exe
  2⤵
  PID:8944
- C:\Windows\System\TOvRWOs.exe
  C:\Windows\System\TOvRWOs.exe
  2⤵
  PID:8964
- C:\Windows\System\RVpghbo.exe
  C:\Windows\System\RVpghbo.exe
  2⤵
  PID:8988
- C:\Windows\System\POiZNiR.exe
  C:\Windows\System\POiZNiR.exe
  2⤵
  PID:9020
- C:\Windows\System\HsdsrhU.exe
  C:\Windows\System\HsdsrhU.exe
  2⤵
  PID:9056
- C:\Windows\System\yzHsAoN.exe
  C:\Windows\System\yzHsAoN.exe
  2⤵
  PID:9084
- C:\Windows\System\veDoXhK.exe
  C:\Windows\System\veDoXhK.exe
  2⤵
  PID:9112
- C:\Windows\System\dBhavbp.exe
  C:\Windows\System\dBhavbp.exe
  2⤵
  PID:9140
- C:\Windows\System\TqyNmAn.exe
  C:\Windows\System\TqyNmAn.exe
  2⤵
  PID:9156
- C:\Windows\System\gCPpEvY.exe
  C:\Windows\System\gCPpEvY.exe
  2⤵
  PID:9184
- C:\Windows\System\HLbMBcW.exe
  C:\Windows\System\HLbMBcW.exe
  2⤵
  PID:9212
- C:\Windows\System\IOGUcbr.exe
  C:\Windows\System\IOGUcbr.exe
  2⤵
  PID:8228
- C:\Windows\System\ZnZeqxt.exe
  C:\Windows\System\ZnZeqxt.exe
  2⤵
  PID:8312
- C:\Windows\System\xQEKkyI.exe
  C:\Windows\System\xQEKkyI.exe
  2⤵
  PID:8376
- C:\Windows\System\HjTcHcT.exe
  C:\Windows\System\HjTcHcT.exe
  2⤵
  PID:8428
- C:\Windows\System\dgKwwvY.exe
  C:\Windows\System\dgKwwvY.exe
  2⤵
  PID:8472
- C:\Windows\System\UYJfWQS.exe
  C:\Windows\System\UYJfWQS.exe
  2⤵
  PID:8584
- C:\Windows\System\tDrAtvi.exe
  C:\Windows\System\tDrAtvi.exe
  2⤵
  PID:8648
- C:\Windows\System\eXITJFO.exe
  C:\Windows\System\eXITJFO.exe
  2⤵
  PID:8700
- C:\Windows\System\CrwemAi.exe
  C:\Windows\System\CrwemAi.exe
  2⤵
  PID:8772
- C:\Windows\System\fGZIZjn.exe
  C:\Windows\System\fGZIZjn.exe
  2⤵
  PID:8852
- C:\Windows\System\RYOQzVi.exe
  C:\Windows\System\RYOQzVi.exe
  2⤵
  PID:8940
- C:\Windows\System\AcwMpjT.exe
  C:\Windows\System\AcwMpjT.exe
  2⤵
  PID:9028
- C:\Windows\System\FDXbnwh.exe
  C:\Windows\System\FDXbnwh.exe
  2⤵
  PID:9076
- C:\Windows\System\HXJiQAB.exe
  C:\Windows\System\HXJiQAB.exe
  2⤵
  PID:9136
- C:\Windows\System\pWOiCgw.exe
  C:\Windows\System\pWOiCgw.exe
  2⤵
  PID:9200
- C:\Windows\System\QDKspYz.exe
  C:\Windows\System\QDKspYz.exe
  2⤵
  PID:8288
- C:\Windows\System\FmcPhoD.exe
  C:\Windows\System\FmcPhoD.exe
  2⤵
  PID:8424
- C:\Windows\System\NoZZnTe.exe
  C:\Windows\System\NoZZnTe.exe
  2⤵
  PID:8564
- C:\Windows\System\umuWeDS.exe
  C:\Windows\System\umuWeDS.exe
  2⤵
  PID:8736
- C:\Windows\System\jtExovU.exe
  C:\Windows\System\jtExovU.exe
  2⤵
  PID:8924
- C:\Windows\System\npayibK.exe
  C:\Windows\System\npayibK.exe
  2⤵
  PID:9068
- C:\Windows\System\gGNdJxS.exe
  C:\Windows\System\gGNdJxS.exe
  2⤵
  PID:9172
- C:\Windows\System\VXnavsq.exe
  C:\Windows\System\VXnavsq.exe
  2⤵
  PID:8556
- C:\Windows\System\cBRwmdK.exe
  C:\Windows\System\cBRwmdK.exe
  2⤵
  PID:8844
- C:\Windows\System\SAwhQXE.exe
  C:\Windows\System\SAwhQXE.exe
  2⤵
  PID:8360
- C:\Windows\System\FdyusAO.exe
  C:\Windows\System\FdyusAO.exe
  2⤵
  PID:8200
- C:\Windows\System\RLnizKy.exe
  C:\Windows\System\RLnizKy.exe
  2⤵
  PID:9224
- C:\Windows\System\ePlJVqI.exe
  C:\Windows\System\ePlJVqI.exe
  2⤵
  PID:9252
- C:\Windows\System\XFDkvFe.exe
  C:\Windows\System\XFDkvFe.exe
  2⤵
  PID:9280
- C:\Windows\System\swrTkds.exe
  C:\Windows\System\swrTkds.exe
  2⤵
  PID:9304
- C:\Windows\System\xjOCLDh.exe
  C:\Windows\System\xjOCLDh.exe
  2⤵
  PID:9336
- C:\Windows\System\MspKSbc.exe
  C:\Windows\System\MspKSbc.exe
  2⤵
  PID:9364
- C:\Windows\System\kHLoQxu.exe
  C:\Windows\System\kHLoQxu.exe
  2⤵
  PID:9392
- C:\Windows\System\cxXvCre.exe
  C:\Windows\System\cxXvCre.exe
  2⤵
  PID:9412
- C:\Windows\System\mdHdOzW.exe
  C:\Windows\System\mdHdOzW.exe
  2⤵
  PID:9436
- C:\Windows\System\kjxvrKp.exe
  C:\Windows\System\kjxvrKp.exe
  2⤵
  PID:9464
- C:\Windows\System\XraidWI.exe
  C:\Windows\System\XraidWI.exe
  2⤵
  PID:9496
- C:\Windows\System\GhRpIbS.exe
  C:\Windows\System\GhRpIbS.exe
  2⤵
  PID:9520
- C:\Windows\System\OjJBbhO.exe
  C:\Windows\System\OjJBbhO.exe
  2⤵
  PID:9556
- C:\Windows\System\orHFfsM.exe
  C:\Windows\System\orHFfsM.exe
  2⤵
  PID:9584
- C:\Windows\System\JXBUgfV.exe
  C:\Windows\System\JXBUgfV.exe
  2⤵
  PID:9604
- C:\Windows\System\gmiHwKR.exe
  C:\Windows\System\gmiHwKR.exe
  2⤵
  PID:9644
- C:\Windows\System\zTWbsfi.exe
  C:\Windows\System\zTWbsfi.exe
  2⤵
  PID:9672
- C:\Windows\System\MjVnSqR.exe
  C:\Windows\System\MjVnSqR.exe
  2⤵
  PID:9700
- C:\Windows\System\qngovwW.exe
  C:\Windows\System\qngovwW.exe
  2⤵
  PID:9728
- C:\Windows\System\vfUvLqg.exe
  C:\Windows\System\vfUvLqg.exe
  2⤵
  PID:9756
- C:\Windows\System\HqYebVh.exe
  C:\Windows\System\HqYebVh.exe
  2⤵
  PID:9780
- C:\Windows\System\ifsBoci.exe
  C:\Windows\System\ifsBoci.exe
  2⤵
  PID:9800
- C:\Windows\System\PgWDRDz.exe
  C:\Windows\System\PgWDRDz.exe
  2⤵
  PID:9828
- C:\Windows\System\kzKddCr.exe
  C:\Windows\System\kzKddCr.exe
  2⤵
  PID:9864
- C:\Windows\System\mgFEKNH.exe
  C:\Windows\System\mgFEKNH.exe
  2⤵
  PID:9896
- C:\Windows\System\pQgvidp.exe
  C:\Windows\System\pQgvidp.exe
  2⤵
  PID:9924
- C:\Windows\System\WdfOyYc.exe
  C:\Windows\System\WdfOyYc.exe
  2⤵
  PID:9952
- C:\Windows\System\yGsLqBO.exe
  C:\Windows\System\yGsLqBO.exe
  2⤵
  PID:9980
- C:\Windows\System\kWdyxSn.exe
  C:\Windows\System\kWdyxSn.exe
  2⤵
  PID:10008
- C:\Windows\System\MoCIcMT.exe
  C:\Windows\System\MoCIcMT.exe
  2⤵
  PID:10036
- C:\Windows\System\rbthHOn.exe
  C:\Windows\System\rbthHOn.exe
  2⤵
  PID:10068
- C:\Windows\System\jpsGqdW.exe
  C:\Windows\System\jpsGqdW.exe
  2⤵
  PID:10096
- C:\Windows\System\dXCtAnt.exe
  C:\Windows\System\dXCtAnt.exe
  2⤵
  PID:10124
- C:\Windows\System\VTigkWh.exe
  C:\Windows\System\VTigkWh.exe
  2⤵
  PID:10140
- C:\Windows\System\HvUMdsH.exe
  C:\Windows\System\HvUMdsH.exe
  2⤵
  PID:10172
- C:\Windows\System\ctVduZt.exe
  C:\Windows\System\ctVduZt.exe
  2⤵
  PID:10208
- C:\Windows\System\GCicFDk.exe
  C:\Windows\System\GCicFDk.exe
  2⤵
  PID:10236
- C:\Windows\System\lzvIzjc.exe
  C:\Windows\System\lzvIzjc.exe
  2⤵
  PID:9272
- C:\Windows\System\odqFBqj.exe
  C:\Windows\System\odqFBqj.exe
  2⤵
  PID:9320
- C:\Windows\System\PLWcayd.exe
  C:\Windows\System\PLWcayd.exe
  2⤵
  PID:9408
- C:\Windows\System\LOIICtH.exe
  C:\Windows\System\LOIICtH.exe
  2⤵
  PID:9476
- C:\Windows\System\KtbXnPY.exe
  C:\Windows\System\KtbXnPY.exe
  2⤵
  PID:9532
- C:\Windows\System\FVmnmai.exe
  C:\Windows\System\FVmnmai.exe
  2⤵
  PID:9580
- C:\Windows\System\yyiIRNf.exe
  C:\Windows\System\yyiIRNf.exe
  2⤵
  PID:9664
- C:\Windows\System\aEXDsSz.exe
  C:\Windows\System\aEXDsSz.exe
  2⤵
  PID:9724
- C:\Windows\System\QgmdIba.exe
  C:\Windows\System\QgmdIba.exe
  2⤵
  PID:9792
- C:\Windows\System\tlUcvvS.exe
  C:\Windows\System\tlUcvvS.exe
  2⤵
  PID:9856
- C:\Windows\System\PzeaMYS.exe
  C:\Windows\System\PzeaMYS.exe
  2⤵
  PID:9916
- C:\Windows\System\YYekQmw.exe
  C:\Windows\System\YYekQmw.exe
  2⤵
  PID:9972
- C:\Windows\System\KCTeubo.exe
  C:\Windows\System\KCTeubo.exe
  2⤵
  PID:10020
- C:\Windows\System\TbrUVPI.exe
  C:\Windows\System\TbrUVPI.exe
  2⤵
  PID:10084
- C:\Windows\System\PGluEcp.exe
  C:\Windows\System\PGluEcp.exe
  2⤵
  PID:10180
- C:\Windows\System\mWVyGQZ.exe
  C:\Windows\System\mWVyGQZ.exe
  2⤵
  PID:9268
- C:\Windows\System\VUZWZaR.exe
  C:\Windows\System\VUZWZaR.exe
  2⤵
  PID:9332
- C:\Windows\System\OseeLAt.exe
  C:\Windows\System\OseeLAt.exe
  2⤵
  PID:9492
- C:\Windows\System\xdEAhCk.exe
  C:\Windows\System\xdEAhCk.exe
  2⤵
  PID:9632
- C:\Windows\System\fPPLYLN.exe
  C:\Windows\System\fPPLYLN.exe
  2⤵
  PID:9788
- C:\Windows\System\NfskLAm.exe
  C:\Windows\System\NfskLAm.exe
  2⤵
  PID:9908
- C:\Windows\System\LtmowYC.exe
  C:\Windows\System\LtmowYC.exe
  2⤵
  PID:10116
- C:\Windows\System\WuvsuDS.exe
  C:\Windows\System\WuvsuDS.exe
  2⤵
  PID:10156
- C:\Windows\System\MnBoQsG.exe
  C:\Windows\System\MnBoQsG.exe
  2⤵
  PID:9388
- C:\Windows\System\MuFDvyN.exe
  C:\Windows\System\MuFDvyN.exe
  2⤵
  PID:9752
- C:\Windows\System\bqqKMUz.exe
  C:\Windows\System\bqqKMUz.exe
  2⤵
  PID:10224
- C:\Windows\System\znSKSCG.exe
  C:\Windows\System\znSKSCG.exe
  2⤵
  PID:5512
- C:\Windows\System\CcPQjXw.exe
  C:\Windows\System\CcPQjXw.exe
  2⤵
  PID:10220
- C:\Windows\System\dIMGwrc.exe
  C:\Windows\System\dIMGwrc.exe
  2⤵
  PID:10268
- C:\Windows\System\WhdquDA.exe
  C:\Windows\System\WhdquDA.exe
  2⤵
  PID:10296
- C:\Windows\System\iayTefH.exe
  C:\Windows\System\iayTefH.exe
  2⤵
  PID:10324
- C:\Windows\System\eFzoArA.exe
  C:\Windows\System\eFzoArA.exe
  2⤵
  PID:10352
- C:\Windows\System\xEqInMQ.exe
  C:\Windows\System\xEqInMQ.exe
  2⤵
  PID:10380
- C:\Windows\System\kldnlHl.exe
  C:\Windows\System\kldnlHl.exe
  2⤵
  PID:10408
- C:\Windows\System\Pxytnfd.exe
  C:\Windows\System\Pxytnfd.exe
  2⤵
  PID:10436
- C:\Windows\System\UOvkGBh.exe
  C:\Windows\System\UOvkGBh.exe
  2⤵
  PID:10464
- C:\Windows\System\XLfhEkF.exe
  C:\Windows\System\XLfhEkF.exe
  2⤵
  PID:10492
- C:\Windows\System\FBiCeLE.exe
  C:\Windows\System\FBiCeLE.exe
  2⤵
  PID:10528
- C:\Windows\System\rYIoDre.exe
  C:\Windows\System\rYIoDre.exe
  2⤵
  PID:10556
- C:\Windows\System\BcwYVeU.exe
  C:\Windows\System\BcwYVeU.exe
  2⤵
  PID:10600
- C:\Windows\System\ezITYyU.exe
  C:\Windows\System\ezITYyU.exe
  2⤵
  PID:10628
- C:\Windows\System\KxsawYl.exe
  C:\Windows\System\KxsawYl.exe
  2⤵
  PID:10684
- C:\Windows\System\TwkqWqz.exe
  C:\Windows\System\TwkqWqz.exe
  2⤵
  PID:10724
- C:\Windows\System\UciRgij.exe
  C:\Windows\System\UciRgij.exe
  2⤵
  PID:10796
- C:\Windows\System\LRFNCPv.exe
  C:\Windows\System\LRFNCPv.exe
  2⤵
  PID:10824
- C:\Windows\System\oWjBfTg.exe
  C:\Windows\System\oWjBfTg.exe
  2⤵
  PID:10876
- C:\Windows\System\EXgQBnB.exe
  C:\Windows\System\EXgQBnB.exe
  2⤵
  PID:10904
- C:\Windows\System\KohUXTY.exe
  C:\Windows\System\KohUXTY.exe
  2⤵
  PID:10944
- C:\Windows\System\xFAgMYK.exe
  C:\Windows\System\xFAgMYK.exe
  2⤵
  PID:10972
- C:\Windows\System\HDhtTCH.exe
  C:\Windows\System\HDhtTCH.exe
  2⤵
  PID:11000
- C:\Windows\System\gnAojqF.exe
  C:\Windows\System\gnAojqF.exe
  2⤵
  PID:11020
- C:\Windows\System\rLZNhJv.exe
  C:\Windows\System\rLZNhJv.exe
  2⤵
  PID:11036
- C:\Windows\System\CMOZCFi.exe
  C:\Windows\System\CMOZCFi.exe
  2⤵
  PID:11052
- C:\Windows\System\oToboXW.exe
  C:\Windows\System\oToboXW.exe
  2⤵
  PID:11068
- C:\Windows\System\MAtkvOw.exe
  C:\Windows\System\MAtkvOw.exe
  2⤵
  PID:11104
- C:\Windows\System\IWPYdAn.exe
  C:\Windows\System\IWPYdAn.exe
  2⤵
  PID:11136
- C:\Windows\System\nVliHxa.exe
  C:\Windows\System\nVliHxa.exe
  2⤵
  PID:11176
- C:\Windows\System\tszjJIv.exe
  C:\Windows\System\tszjJIv.exe
  2⤵
  PID:11204
- C:\Windows\System\nkpQjtX.exe
  C:\Windows\System\nkpQjtX.exe
  2⤵
  PID:11244
- C:\Windows\System\IhWpPfd.exe
  C:\Windows\System\IhWpPfd.exe
  2⤵
  PID:10264
- C:\Windows\System\OIcWpde.exe
  C:\Windows\System\OIcWpde.exe
  2⤵
  PID:10364
- C:\Windows\System\WKJKOyN.exe
  C:\Windows\System\WKJKOyN.exe
  2⤵
  PID:10424
- C:\Windows\System\rfDVOgd.exe
  C:\Windows\System\rfDVOgd.exe
  2⤵
  PID:10460
- C:\Windows\System\GVlVLGh.exe
  C:\Windows\System\GVlVLGh.exe
  2⤵
  PID:10552
- C:\Windows\System\FUZnDld.exe
  C:\Windows\System\FUZnDld.exe
  2⤵
  PID:10580
- C:\Windows\System\TJBTeMo.exe
  C:\Windows\System\TJBTeMo.exe
  2⤵
  PID:10712
- C:\Windows\System\OKUJoHE.exe
  C:\Windows\System\OKUJoHE.exe
  2⤵
  PID:10808
- C:\Windows\System\GiqeCAZ.exe
  C:\Windows\System\GiqeCAZ.exe
  2⤵
  PID:10900
- C:\Windows\System\wqPHUgr.exe
  C:\Windows\System\wqPHUgr.exe
  2⤵
  PID:10956
- C:\Windows\System\homwadQ.exe
  C:\Windows\System\homwadQ.exe
  2⤵
  PID:5052
- C:\Windows\System\DoziNNm.exe
  C:\Windows\System\DoziNNm.exe
  2⤵
  PID:11064
- C:\Windows\System\qNySUYR.exe
  C:\Windows\System\qNySUYR.exe
  2⤵
  PID:11028
- C:\Windows\System\foRuyFO.exe
  C:\Windows\System\foRuyFO.exe
  2⤵
  PID:11188
- C:\Windows\System\LEXXJRH.exe
  C:\Windows\System\LEXXJRH.exe
  2⤵
  PID:10252
- C:\Windows\System\zxMHyTi.exe
  C:\Windows\System\zxMHyTi.exe
  2⤵
  PID:10376
- C:\Windows\System\fWjYEgC.exe
  C:\Windows\System\fWjYEgC.exe
  2⤵
  PID:10608
- C:\Windows\System\zYeEodW.exe
  C:\Windows\System\zYeEodW.exe
  2⤵
  PID:684
- C:\Windows\System\dIYRBNu.exe
  C:\Windows\System\dIYRBNu.exe
  2⤵
  PID:5788
- C:\Windows\System\CRoAkjv.exe
  C:\Windows\System\CRoAkjv.exe
  2⤵
  PID:11032
- C:\Windows\System\RWXyvJP.exe
  C:\Windows\System\RWXyvJP.exe
  2⤵
  PID:11152
- C:\Windows\System\HXSHcte.exe
  C:\Windows\System\HXSHcte.exe
  2⤵
  PID:10452
- C:\Windows\System\mCECRGp.exe
  C:\Windows\System\mCECRGp.exe
  2⤵
  PID:10596
- C:\Windows\System\pwMGAKG.exe
  C:\Windows\System\pwMGAKG.exe
  2⤵
  PID:5364
- C:\Windows\System\hFaUMCA.exe
  C:\Windows\System\hFaUMCA.exe
  2⤵
  PID:2244
- C:\Windows\System\JRHlbgN.exe
  C:\Windows\System\JRHlbgN.exe
  2⤵
  PID:11172
- C:\Windows\System\DEpSNtB.exe
  C:\Windows\System\DEpSNtB.exe
  2⤵
  PID:10636
- C:\Windows\System\EZqgTjD.exe
  C:\Windows\System\EZqgTjD.exe
  2⤵
  PID:5384
- C:\Windows\System\xvfnKDH.exe
  C:\Windows\System\xvfnKDH.exe
  2⤵
  PID:3612
- C:\Windows\System\fWDxbnw.exe
  C:\Windows\System\fWDxbnw.exe
  2⤵
  PID:11280
- C:\Windows\System\DDtocHI.exe
  C:\Windows\System\DDtocHI.exe
  2⤵
  PID:11308
- C:\Windows\System\uLEdzIF.exe
  C:\Windows\System\uLEdzIF.exe
  2⤵
  PID:11336
- C:\Windows\System\zXseJRe.exe
  C:\Windows\System\zXseJRe.exe
  2⤵
  PID:11364
- C:\Windows\System\nGZEcvm.exe
  C:\Windows\System\nGZEcvm.exe
  2⤵
  PID:11384
- C:\Windows\System\twEExZC.exe
  C:\Windows\System\twEExZC.exe
  2⤵
  PID:11420
- C:\Windows\System\iQYUlLA.exe
  C:\Windows\System\iQYUlLA.exe
  2⤵
  PID:11436
- C:\Windows\System\KjQzmds.exe
  C:\Windows\System\KjQzmds.exe
  2⤵
  PID:11464
- C:\Windows\System\nGIBjQL.exe
  C:\Windows\System\nGIBjQL.exe
  2⤵
  PID:11492
- C:\Windows\System\CGPceIx.exe
  C:\Windows\System\CGPceIx.exe
  2⤵
  PID:11520
- C:\Windows\System\mOztqcs.exe
  C:\Windows\System\mOztqcs.exe
  2⤵
  PID:11548
- C:\Windows\System\YhoFAEL.exe
  C:\Windows\System\YhoFAEL.exe
  2⤵
  PID:11572
- C:\Windows\System\szEThcn.exe
  C:\Windows\System\szEThcn.exe
  2⤵
  PID:11600
- C:\Windows\System\shjmWAo.exe
  C:\Windows\System\shjmWAo.exe
  2⤵
  PID:11632
- C:\Windows\System\bUCFQKL.exe
  C:\Windows\System\bUCFQKL.exe
  2⤵
  PID:11672
- C:\Windows\System\KFfErQj.exe
  C:\Windows\System\KFfErQj.exe
  2⤵
  PID:11700
- C:\Windows\System\FGeAbko.exe
  C:\Windows\System\FGeAbko.exe
  2⤵
  PID:11720
- C:\Windows\System\FIDaQfD.exe
  C:\Windows\System\FIDaQfD.exe
  2⤵
  PID:11756
- C:\Windows\System\RnmZzOk.exe
  C:\Windows\System\RnmZzOk.exe
  2⤵
  PID:11776
- C:\Windows\System\imZuvyq.exe
  C:\Windows\System\imZuvyq.exe
  2⤵
  PID:11812
- C:\Windows\System\BjrwqOW.exe
  C:\Windows\System\BjrwqOW.exe
  2⤵
  PID:11840
- C:\Windows\System\qCfdtSv.exe
  C:\Windows\System\qCfdtSv.exe
  2⤵
  PID:11860
- C:\Windows\System\ECnygnP.exe
  C:\Windows\System\ECnygnP.exe
  2⤵
  PID:11896
- C:\Windows\System\EqdXlEB.exe
  C:\Windows\System\EqdXlEB.exe
  2⤵
  PID:11912
- C:\Windows\System\dRaGihZ.exe
  C:\Windows\System\dRaGihZ.exe
  2⤵
  PID:11944
- C:\Windows\System\eDlXhzy.exe
  C:\Windows\System\eDlXhzy.exe
  2⤵
  PID:11968
- C:\Windows\System\glMdwKr.exe
  C:\Windows\System\glMdwKr.exe
  2⤵
  PID:11996
- C:\Windows\System\atqxmcu.exe
  C:\Windows\System\atqxmcu.exe
  2⤵
  PID:12024
- C:\Windows\System\KIjUiEY.exe
  C:\Windows\System\KIjUiEY.exe
  2⤵
  PID:12060
- C:\Windows\System\bqPaFeY.exe
  C:\Windows\System\bqPaFeY.exe
  2⤵
  PID:12092
- C:\Windows\System\hGlbYhc.exe
  C:\Windows\System\hGlbYhc.exe
  2⤵
  PID:12120
- C:\Windows\System\XKxMxMK.exe
  C:\Windows\System\XKxMxMK.exe
  2⤵
  PID:12148
- C:\Windows\System\sYmEnSc.exe
  C:\Windows\System\sYmEnSc.exe
  2⤵
  PID:12164
- C:\Windows\System\OmFFDxR.exe
  C:\Windows\System\OmFFDxR.exe
  2⤵
  PID:12204
- C:\Windows\System\YpLomxI.exe
  C:\Windows\System\YpLomxI.exe
  2⤵
  PID:12220
- C:\Windows\System\oioYdCJ.exe
  C:\Windows\System\oioYdCJ.exe
  2⤵
  PID:12264
- C:\Windows\System\dlZEret.exe
  C:\Windows\System\dlZEret.exe
  2⤵
  PID:1524
- C:\Windows\System\qHfzGby.exe
  C:\Windows\System\qHfzGby.exe
  2⤵
  PID:11300
- C:\Windows\System\tGdLvZr.exe
  C:\Windows\System\tGdLvZr.exe
  2⤵
  PID:11380
- C:\Windows\System\RCbimbp.exe
  C:\Windows\System\RCbimbp.exe
  2⤵
  PID:11476
- C:\Windows\System\xDUtyAa.exe
  C:\Windows\System\xDUtyAa.exe
  2⤵
  PID:11532
- C:\Windows\System\plhmfof.exe
  C:\Windows\System\plhmfof.exe
  2⤵
  PID:11596
- C:\Windows\System\emMNhMa.exe
  C:\Windows\System\emMNhMa.exe
  2⤵
  PID:11668
- C:\Windows\System\FsKAxjr.exe
  C:\Windows\System\FsKAxjr.exe
  2⤵
  PID:11728
- C:\Windows\System\AsmlObI.exe
  C:\Windows\System\AsmlObI.exe
  2⤵
  PID:11796
- C:\Windows\System\uNJKdsN.exe
  C:\Windows\System\uNJKdsN.exe
  2⤵
  PID:11828
- C:\Windows\System\SdbVOry.exe
  C:\Windows\System\SdbVOry.exe
  2⤵
  PID:11904
- C:\Windows\System\UiALELB.exe
  C:\Windows\System\UiALELB.exe
  2⤵
  PID:11980
- C:\Windows\System\mZSrvvp.exe
  C:\Windows\System\mZSrvvp.exe
  2⤵
  PID:12044
- C:\Windows\System\gOKfApW.exe
  C:\Windows\System\gOKfApW.exe
  2⤵
  PID:12080
- C:\Windows\System\kigQmhh.exe
  C:\Windows\System\kigQmhh.exe
  2⤵
  PID:12132
- C:\Windows\System\UpPfmdQ.exe
  C:\Windows\System\UpPfmdQ.exe
  2⤵
  PID:12216
- C:\Windows\System\yTpYWGT.exe
  C:\Windows\System\yTpYWGT.exe
  2⤵
  PID:12252
- C:\Windows\System\EEPJJox.exe
  C:\Windows\System\EEPJJox.exe
  2⤵
  PID:11356
- C:\Windows\System\bRTPVgS.exe
  C:\Windows\System\bRTPVgS.exe
  2⤵
  PID:5168
- C:\Windows\System\miyYJpj.exe
  C:\Windows\System\miyYJpj.exe
  2⤵
  PID:4272
- C:\Windows\System\tYVHmAD.exe
  C:\Windows\System\tYVHmAD.exe
  2⤵
  PID:11568
- C:\Windows\System\McBMjyi.exe
  C:\Windows\System\McBMjyi.exe
  2⤵
  PID:11772
- C:\Windows\System\apKfHqE.exe
  C:\Windows\System\apKfHqE.exe
  2⤵
  PID:11988
- C:\Windows\System\gCqAHaX.exe
  C:\Windows\System\gCqAHaX.exe
  2⤵
  PID:12104
- C:\Windows\System\QLbOYVW.exe
  C:\Windows\System\QLbOYVW.exe
  2⤵
  PID:12284
- C:\Windows\System\ZFhndeh.exe
  C:\Windows\System\ZFhndeh.exe
  2⤵
  PID:5296
- C:\Windows\System\YVslcxR.exe
  C:\Windows\System\YVslcxR.exe
  2⤵
  PID:11808
- C:\Windows\System\FbpvtND.exe
  C:\Windows\System\FbpvtND.exe
  2⤵
  PID:12136
- C:\Windows\System\YASyVQK.exe
  C:\Windows\System\YASyVQK.exe
  2⤵
  PID:1468
- C:\Windows\System\FhSjCNu.exe
  C:\Windows\System\FhSjCNu.exe
  2⤵
  PID:11504
- C:\Windows\System\RdXjmuI.exe
  C:\Windows\System\RdXjmuI.exe
  2⤵
  PID:12300
- C:\Windows\System\qNjKKnP.exe
  C:\Windows\System\qNjKKnP.exe
  2⤵
  PID:12328
- C:\Windows\System\sjHLclS.exe
  C:\Windows\System\sjHLclS.exe
  2⤵
  PID:12344
- C:\Windows\System\JESkWCb.exe
  C:\Windows\System\JESkWCb.exe
  2⤵
  PID:12376
- C:\Windows\System\JPKmcdH.exe
  C:\Windows\System\JPKmcdH.exe
  2⤵
  PID:12400
- C:\Windows\System\QlgnNlv.exe
  C:\Windows\System\QlgnNlv.exe
  2⤵
  PID:12440
- C:\Windows\System\pvsApJi.exe
  C:\Windows\System\pvsApJi.exe
  2⤵
  PID:12456
- C:\Windows\System\TgIhIDD.exe
  C:\Windows\System\TgIhIDD.exe
  2⤵
  PID:12484
- C:\Windows\System\KiKNRxS.exe
  C:\Windows\System\KiKNRxS.exe
  2⤵
  PID:12504
- C:\Windows\System\DveCozN.exe
  C:\Windows\System\DveCozN.exe
  2⤵
  PID:12540
- C:\Windows\System\AvNnfGi.exe
  C:\Windows\System\AvNnfGi.exe
  2⤵
  PID:12596
- C:\Windows\System\zMbEwpj.exe
  C:\Windows\System\zMbEwpj.exe
  2⤵
  PID:12612
- C:\Windows\System\lcMaojy.exe
  C:\Windows\System\lcMaojy.exe
  2⤵
  PID:12652
- C:\Windows\System\VPlOJhn.exe
  C:\Windows\System\VPlOJhn.exe
  2⤵
  PID:12668
- C:\Windows\System\hemvtyn.exe
  C:\Windows\System\hemvtyn.exe
  2⤵
  PID:12696
- C:\Windows\System\PWWepsf.exe
  C:\Windows\System\PWWepsf.exe
  2⤵
  PID:12732
- C:\Windows\System\QpfbDmI.exe
  C:\Windows\System\QpfbDmI.exe
  2⤵
  PID:12760
- C:\Windows\System\gDdqBKi.exe
  C:\Windows\System\gDdqBKi.exe
  2⤵
  PID:12788
- C:\Windows\System\tyWsukb.exe
  C:\Windows\System\tyWsukb.exe
  2⤵
  PID:12816
- C:\Windows\System\upMItpg.exe
  C:\Windows\System\upMItpg.exe
  2⤵
  PID:12844
- C:\Windows\System\fSOWTZn.exe
  C:\Windows\System\fSOWTZn.exe
  2⤵
  PID:12872
- C:\Windows\System\xopcHvk.exe
  C:\Windows\System\xopcHvk.exe
  2⤵
  PID:12900
- C:\Windows\System\ibFMjeE.exe
  C:\Windows\System\ibFMjeE.exe
  2⤵
  PID:12924
- C:\Windows\System\QPEHgXq.exe
  C:\Windows\System\QPEHgXq.exe
  2⤵
  PID:12944
- C:\Windows\System\NqJeoed.exe
  C:\Windows\System\NqJeoed.exe
  2⤵
  PID:12984
- C:\Windows\System\htFpiEM.exe
  C:\Windows\System\htFpiEM.exe
  2⤵
  PID:13000
- C:\Windows\System\gURofUo.exe
  C:\Windows\System\gURofUo.exe
  2⤵
  PID:13028
- C:\Windows\System\XkgBchJ.exe
  C:\Windows\System\XkgBchJ.exe
  2⤵
  PID:13060
- C:\Windows\System\ssljSzu.exe
  C:\Windows\System\ssljSzu.exe
  2⤵
  PID:13096
- C:\Windows\System\AumoSOm.exe
  C:\Windows\System\AumoSOm.exe
  2⤵
  PID:13124
- C:\Windows\System\UNowbjq.exe
  C:\Windows\System\UNowbjq.exe
  2⤵
  PID:13152
- C:\Windows\System\SULBPXw.exe
  C:\Windows\System\SULBPXw.exe
  2⤵
  PID:13168
- C:\Windows\System\VwXIBZR.exe
  C:\Windows\System\VwXIBZR.exe
  2⤵
  PID:13208
- C:\Windows\System\hInOpuw.exe
  C:\Windows\System\hInOpuw.exe
  2⤵
  PID:13236
- C:\Windows\System\zzHUuht.exe
  C:\Windows\System\zzHUuht.exe
  2⤵
  PID:13264
- C:\Windows\System\cspFtLs.exe
  C:\Windows\System\cspFtLs.exe
  2⤵
  PID:12708
- C:\Windows\System\rpRraMe.exe
  C:\Windows\System\rpRraMe.exe
  2⤵
  PID:12756
- C:\Windows\System\kpvIAKU.exe
  C:\Windows\System\kpvIAKU.exe
  2⤵
  PID:12472
- C:\Windows\System\ppQjOzJ.exe
  C:\Windows\System\ppQjOzJ.exe
  2⤵
  PID:12492
- C:\Windows\System\JKasbQF.exe
  C:\Windows\System\JKasbQF.exe
  2⤵
  PID:12572
- C:\Windows\System\amTwNnP.exe
  C:\Windows\System\amTwNnP.exe
  2⤵
  PID:12688
- C:\Windows\System\SniOwFf.exe
  C:\Windows\System\SniOwFf.exe
  2⤵
  PID:12784
- C:\Windows\System\uywYEKm.exe
  C:\Windows\System\uywYEKm.exe
  2⤵
  PID:12812
- C:\Windows\System\DrEGSSK.exe
  C:\Windows\System\DrEGSSK.exe
  2⤵
  PID:12932
- C:\Windows\System\HhABUwa.exe
  C:\Windows\System\HhABUwa.exe
  2⤵
  PID:2660
- C:\Windows\System\fvKATCA.exe
  C:\Windows\System\fvKATCA.exe
  2⤵
  PID:5184
- C:\Windows\System\HdoOKqm.exe
  C:\Windows\System\HdoOKqm.exe
  2⤵
  PID:1004
- C:\Windows\System\gqdnUju.exe
  C:\Windows\System\gqdnUju.exe
  2⤵
  PID:6136
- C:\Windows\System\MiQyksw.exe
  C:\Windows\System\MiQyksw.exe
  2⤵
  PID:13012
- C:\Windows\System\yYNEZCd.exe
  C:\Windows\System\yYNEZCd.exe
  2⤵
  PID:13092
- C:\Windows\System\zcMzxzD.exe
  C:\Windows\System\zcMzxzD.exe
  2⤵
  PID:13136
- C:\Windows\System\zEZnNwP.exe
  C:\Windows\System\zEZnNwP.exe
  2⤵
  PID:13200
- C:\Windows\System\uTlayxi.exe
  C:\Windows\System\uTlayxi.exe
  2⤵
  PID:13256
- C:\Windows\System\ahXHswe.exe
  C:\Windows\System\ahXHswe.exe
  2⤵
  PID:11952
- C:\Windows\System\IYVcurQ.exe
  C:\Windows\System\IYVcurQ.exe
  2⤵
  PID:12396
- C:\Windows\System\srTljhx.exe
  C:\Windows\System\srTljhx.exe
  2⤵
  PID:12388
- C:\Windows\System\mztDLtf.exe
  C:\Windows\System\mztDLtf.exe
  2⤵
  PID:12520
- C:\Windows\System\DQPvLJx.exe
  C:\Windows\System\DQPvLJx.exe
  2⤵
  PID:4344
- C:\Windows\System\HEaWZbj.exe
  C:\Windows\System\HEaWZbj.exe
  2⤵
  PID:636
- C:\Windows\System\YdDvqSk.exe
  C:\Windows\System\YdDvqSk.exe
  2⤵
  PID:7128
- C:\Windows\System\PvVJpIS.exe
  C:\Windows\System\PvVJpIS.exe
  2⤵
  PID:12800
- C:\Windows\System\iKVbZVu.exe
  C:\Windows\System\iKVbZVu.exe
  2⤵
  PID:12860
- C:\Windows\System\ScaCxMh.exe
  C:\Windows\System\ScaCxMh.exe
  2⤵
  PID:12560
- C:\Windows\System\MTNVrpV.exe
  C:\Windows\System\MTNVrpV.exe
  2⤵
  PID:3712
- C:\Windows\System\DRsPjNL.exe
  C:\Windows\System\DRsPjNL.exe
  2⤵
  PID:12312
- C:\Windows\System\UdyLuMd.exe
  C:\Windows\System\UdyLuMd.exe
  2⤵
  PID:4832
- C:\Windows\System\SHxvIHi.exe
  C:\Windows\System\SHxvIHi.exe
  2⤵
  PID:2852
- C:\Windows\System\HFHdTyD.exe
  C:\Windows\System\HFHdTyD.exe
  2⤵
  PID:4456
- C:\Windows\System\kMZERVV.exe
  C:\Windows\System\kMZERVV.exe
  2⤵
  PID:10792
- C:\Windows\System\algTCnc.exe
  C:\Windows\System\algTCnc.exe
  2⤵
  PID:10884
- C:\Windows\System\DJVhXtr.exe
  C:\Windows\System\DJVhXtr.exe
  2⤵
  PID:5600
- C:\Windows\System\aOwXuLx.exe
  C:\Windows\System\aOwXuLx.exe
  2⤵
  PID:3592
- C:\Windows\System\rujlxQf.exe
  C:\Windows\System\rujlxQf.exe
  2⤵
  PID:3544
- C:\Windows\System\pBGDaAY.exe
  C:\Windows\System\pBGDaAY.exe
  2⤵
  PID:2672
- C:\Windows\System\wJzYYdT.exe
  C:\Windows\System\wJzYYdT.exe
  2⤵
  PID:5532
- C:\Windows\System\YIMUfyD.exe
  C:\Windows\System\YIMUfyD.exe
  2⤵
  PID:2780
- C:\Windows\System\lcDoBFy.exe
  C:\Windows\System\lcDoBFy.exe
  2⤵
  PID:2324
- C:\Windows\System\qGevFWA.exe
  C:\Windows\System\qGevFWA.exe
  2⤵
  PID:732
- C:\Windows\System\tztqyIh.exe
  C:\Windows\System\tztqyIh.exe
  2⤵
  PID:4796
- C:\Windows\System\YHJXCLg.exe
  C:\Windows\System\YHJXCLg.exe
  2⤵
  PID:5840
- C:\Windows\System\ckmCKXD.exe
  C:\Windows\System\ckmCKXD.exe
  2⤵
  PID:5576
- C:\Windows\System\rtRhAbN.exe
  C:\Windows\System\rtRhAbN.exe
  2⤵
  PID:2476
- C:\Windows\System\OUJlZij.exe
  C:\Windows\System\OUJlZij.exe
  2⤵
  PID:2032
- C:\Windows\System\SlzxuQg.exe
  C:\Windows\System\SlzxuQg.exe
  2⤵
  PID:5608
- C:\Windows\System\lFXibQc.exe
  C:\Windows\System\lFXibQc.exe
  2⤵
  PID:1940
- C:\Windows\System\ETHugFe.exe
  C:\Windows\System\ETHugFe.exe
  2⤵
  PID:4264
- C:\Windows\System\OTyyGgc.exe
  C:\Windows\System\OTyyGgc.exe
  2⤵
  PID:13308
- C:\Windows\System\kzwqVAa.exe
  C:\Windows\System\kzwqVAa.exe
  2⤵
  PID:3156
- C:\Windows\System\ruWhioR.exe
  C:\Windows\System\ruWhioR.exe
  2⤵
  PID:912
- C:\Windows\System\kcEamZy.exe
  C:\Windows\System\kcEamZy.exe
  2⤵
  PID:13048
- C:\Windows\System\ociIQHh.exe
  C:\Windows\System\ociIQHh.exe
  2⤵
  PID:2820
- C:\Windows\System\yCVwkDG.exe
  C:\Windows\System\yCVwkDG.exe
  2⤵
  PID:5728
- C:\Windows\System\kVKMXhi.exe
  C:\Windows\System\kVKMXhi.exe
  2⤵
  PID:5028
- C:\Windows\System\GuSdiIK.exe
  C:\Windows\System\GuSdiIK.exe
  2⤵
  PID:3400
- C:\Windows\System\zpqrVLy.exe
  C:\Windows\System\zpqrVLy.exe
  2⤵
  PID:5804
- C:\Windows\System\zKeMzEN.exe
  C:\Windows\System\zKeMzEN.exe
  2⤵
  PID:4532
- C:\Windows\System\vqgHslQ.exe
  C:\Windows\System\vqgHslQ.exe
  2⤵
  PID:4516
- C:\Windows\System\NAtgKIm.exe
  C:\Windows\System\NAtgKIm.exe
  2⤵
  PID:10844
- C:\Windows\System\eLEmZYB.exe
  C:\Windows\System\eLEmZYB.exe
  2⤵
  PID:6084
- C:\Windows\System\VjakHcN.exe
  C:\Windows\System\VjakHcN.exe
  2⤵
  PID:3928
- C:\Windows\System\YXfuyai.exe
  C:\Windows\System\YXfuyai.exe
  2⤵
  PID:6208
- C:\Windows\System\ZwUeLnj.exe
  C:\Windows\System\ZwUeLnj.exe
  2⤵
  PID:9380
- C:\Windows\System\prHxpkS.exe
  C:\Windows\System\prHxpkS.exe
  2⤵
  PID:9540
- C:\Windows\System\GYgVNRS.exe
  C:\Windows\System\GYgVNRS.exe
  2⤵
  PID:9568
- C:\Windows\System\GwcKBMM.exe
  C:\Windows\System\GwcKBMM.exe
  2⤵
  PID:9736
- C:\Windows\System\ignoPeV.exe
  C:\Windows\System\ignoPeV.exe
  2⤵
  PID:9844
- C:\Windows\System\LZSxAZK.exe
  C:\Windows\System\LZSxAZK.exe
  2⤵
  PID:9932
- C:\Windows\System\vRRNTif.exe
  C:\Windows\System\vRRNTif.exe
  2⤵
  PID:10024
- C:\Windows\System\BgndKqD.exe
  C:\Windows\System\BgndKqD.exe
  2⤵
  PID:10184
- C:\Windows\System\yKJXQeL.exe
  C:\Windows\System\yKJXQeL.exe
  2⤵
  PID:9220
- C:\Windows\System\QqBcMQY.exe
  C:\Windows\System\QqBcMQY.exe
  2⤵
  PID:9512
- C:\Windows\System\rSjKALn.exe
  C:\Windows\System\rSjKALn.exe
  2⤵
  PID:9616
- C:\Windows\System\mCJwruG.exe
  C:\Windows\System\mCJwruG.exe
  2⤵
  PID:9820
- C:\Windows\System\mqUtdFD.exe
  C:\Windows\System\mqUtdFD.exe
  2⤵
  PID:8008
- C:\Windows\System\jxnvUty.exe
  C:\Windows\System\jxnvUty.exe
  2⤵
  PID:6336
- C:\Windows\System\hLsGWol.exe
  C:\Windows\System\hLsGWol.exe
  2⤵
  PID:6408
- C:\Windows\System\KKPtVuF.exe
  C:\Windows\System\KKPtVuF.exe
  2⤵
  PID:6424
- C:\Windows\System\Ypwuylv.exe
  C:\Windows\System\Ypwuylv.exe
  2⤵
  PID:4776
- C:\Windows\System\DdsQzYB.exe
  C:\Windows\System\DdsQzYB.exe
  2⤵
  PID:8080
- C:\Windows\System\JMswTZM.exe
  C:\Windows\System\JMswTZM.exe
  2⤵
  PID:6520
- C:\Windows\System\AFMwgwp.exe
  C:\Windows\System\AFMwgwp.exe
  2⤵
  PID:6536
- C:\Windows\System\TtbqTDY.exe
  C:\Windows\System\TtbqTDY.exe
  2⤵
  PID:5448
- C:\Windows\System\eTfbOyn.exe
  C:\Windows\System\eTfbOyn.exe
  2⤵
  PID:9448
- C:\Windows\System\YDczQJZ.exe
  C:\Windows\System\YDczQJZ.exe
  2⤵
  PID:8616
- C:\Windows\System\ittqkCj.exe
  C:\Windows\System\ittqkCj.exe
  2⤵
  PID:5144
- C:\Windows\System\OXQSJzf.exe
  C:\Windows\System\OXQSJzf.exe
  2⤵
  PID:1472
- C:\Windows\System\qaliLCg.exe
  C:\Windows\System\qaliLCg.exe
  2⤵
  PID:1844
- C:\Windows\System\HbnNnlM.exe
  C:\Windows\System\HbnNnlM.exe
  2⤵
  PID:9840
- C:\Windows\System\bRjnYQr.exe
  C:\Windows\System\bRjnYQr.exe
  2⤵
  PID:12840
- C:\Windows\System\qmSUbwX.exe
  C:\Windows\System\qmSUbwX.exe
  2⤵
  PID:6668
- C:\Windows\System\BiGVJjo.exe
  C:\Windows\System\BiGVJjo.exe
  2⤵
  PID:6732
- C:\Windows\System\BTOxQAw.exe
  C:\Windows\System\BTOxQAw.exe
  2⤵
  PID:7176
- C:\Windows\System\Qifqrna.exe
  C:\Windows\System\Qifqrna.exe
  2⤵
  PID:10196
- C:\Windows\System\plKCDCU.exe
  C:\Windows\System\plKCDCU.exe
  2⤵
  PID:7244
- C:\Windows\System\cDUCVSC.exe
  C:\Windows\System\cDUCVSC.exe
  2⤵
  PID:4260
- C:\Windows\System\LuILIaZ.exe
  C:\Windows\System\LuILIaZ.exe
  2⤵
  PID:12972
- C:\Windows\System\XFljzFz.exe
  C:\Windows\System\XFljzFz.exe
  2⤵
  PID:7016
- C:\Windows\System\PUGMEeZ.exe
  C:\Windows\System\PUGMEeZ.exe
  2⤵
  PID:8776
- C:\Windows\System\yDsPjYO.exe
  C:\Windows\System\yDsPjYO.exe
  2⤵
  PID:8812
- C:\Windows\System\caYSFxa.exe
  C:\Windows\System\caYSFxa.exe
  2⤵
  PID:7072
- C:\Windows\System\LiJAeVF.exe
  C:\Windows\System\LiJAeVF.exe
  2⤵
  PID:10284
- C:\Windows\System\OioWxNw.exe
  C:\Windows\System\OioWxNw.exe
  2⤵
  PID:3448
- C:\Windows\System\XokYGTJ.exe
  C:\Windows\System\XokYGTJ.exe
  2⤵
  PID:8908
- C:\Windows\System\VTcqBMG.exe
  C:\Windows\System\VTcqBMG.exe
  2⤵
  PID:7444
- C:\Windows\System\BnzjQQg.exe
  C:\Windows\System\BnzjQQg.exe
  2⤵
  PID:4040
- C:\Windows\System\xcEcMVs.exe
  C:\Windows\System\xcEcMVs.exe
  2⤵
  PID:6476
- C:\Windows\System\ivjEvAW.exe
  C:\Windows\System\ivjEvAW.exe
  2⤵
  PID:6500
- C:\Windows\System\goqMtCr.exe
  C:\Windows\System\goqMtCr.exe
  2⤵
  PID:6616
- C:\Windows\System\tDyXljH.exe
  C:\Windows\System\tDyXljH.exe
  2⤵
  PID:10416
- C:\Windows\System\LMieLJU.exe
  C:\Windows\System\LMieLJU.exe
  2⤵
  PID:7660
- C:\Windows\System\UmFDrMR.exe
  C:\Windows\System\UmFDrMR.exe
  2⤵
  PID:9080
- C:\Windows\System\KuioBPS.exe
  C:\Windows\System\KuioBPS.exe
  2⤵
  PID:10500
- C:\Windows\System\fGbLbjz.exe
  C:\Windows\System\fGbLbjz.exe
  2⤵
  PID:12452
- C:\Windows\System\tqmDJBR.exe
  C:\Windows\System\tqmDJBR.exe
  2⤵
  PID:4808
- C:\Windows\System\RStAKUc.exe
  C:\Windows\System\RStAKUc.exe
  2⤵
  PID:6884
- C:\Windows\System\XywbvgB.exe
  C:\Windows\System\XywbvgB.exe
  2⤵
  PID:9164
- C:\Windows\System\GInXLUF.exe
  C:\Windows\System\GInXLUF.exe
  2⤵
  PID:4336
- C:\Windows\System\BfODuko.exe
  C:\Windows\System\BfODuko.exe
  2⤵
  PID:10720
- C:\Windows\System\YSeAXgs.exe
  C:\Windows\System\YSeAXgs.exe
  2⤵
  PID:4936
- C:\Windows\System\tKoTBon.exe
  C:\Windows\System\tKoTBon.exe
  2⤵
  PID:4332
- C:\Windows\System\aJFUPzi.exe
  C:\Windows\System\aJFUPzi.exe
  2⤵
  PID:5528
- C:\Windows\System\mpZogqj.exe
  C:\Windows\System\mpZogqj.exe
  2⤵
  PID:4892
- C:\Windows\System\gkjBbLd.exe
  C:\Windows\System\gkjBbLd.exe
  2⤵
  PID:6704
- C:\Windows\System\mIOYsEk.exe
  C:\Windows\System\mIOYsEk.exe
  2⤵
  PID:7120
- C:\Windows\System\aiBHNRg.exe
  C:\Windows\System\aiBHNRg.exe
  2⤵
  PID:8536
- C:\Windows\System\nSCJgsJ.exe
  C:\Windows\System\nSCJgsJ.exe
  2⤵
  PID:8568
- C:\Windows\System\ykVPweS.exe
  C:\Windows\System\ykVPweS.exe
  2⤵
  PID:8620
- C:\Windows\System\vSwTybC.exe
  C:\Windows\System\vSwTybC.exe
  2⤵
  PID:8172
- C:\Windows\System\chHUyZs.exe
  C:\Windows\System\chHUyZs.exe
  2⤵
  PID:10864
- C:\Windows\System\HBtKldO.exe
  C:\Windows\System\HBtKldO.exe
  2⤵
  PID:7332
- C:\Windows\System\xVosGdU.exe
  C:\Windows\System\xVosGdU.exe
  2⤵
  PID:2444
- C:\Windows\System\WIJtJtX.exe
  C:\Windows\System\WIJtJtX.exe
  2⤵
  PID:8796
- C:\Windows\System\iKptEAG.exe
  C:\Windows\System\iKptEAG.exe
  2⤵
  PID:7404
- C:\Windows\System\jZIgyab.exe
  C:\Windows\System\jZIgyab.exe
  2⤵
  PID:8980
- C:\Windows\System\RffFdFU.exe
  C:\Windows\System\RffFdFU.exe
  2⤵
  PID:7460
- C:\Windows\System\UIGBfvq.exe
  C:\Windows\System\UIGBfvq.exe
  2⤵
  PID:4872
- C:\Windows\System\jygAkjO.exe
  C:\Windows\System\jygAkjO.exe
  2⤵
  PID:5604
- C:\Windows\System\cOYQagO.exe
  C:\Windows\System\cOYQagO.exe
  2⤵
  PID:10924
- C:\Windows\System\yNpCtWd.exe
  C:\Windows\System\yNpCtWd.exe
  2⤵
  PID:9100
- C:\Windows\System\IAQmHyW.exe
  C:\Windows\System\IAQmHyW.exe
  2⤵
  PID:4328
- C:\Windows\System\DqmOZIs.exe
  C:\Windows\System\DqmOZIs.exe
  2⤵
  PID:3652
- C:\Windows\System\CCTcHpK.exe
  C:\Windows\System\CCTcHpK.exe
  2⤵
  PID:5420
- C:\Windows\System\NWrIfeP.exe
  C:\Windows\System\NWrIfeP.exe
  2⤵
  PID:4912
- C:\Windows\System\ptOycpC.exe
  C:\Windows\System\ptOycpC.exe
  2⤵
  PID:11132
- C:\Windows\System\hZqwwat.exe
  C:\Windows\System\hZqwwat.exe
  2⤵
  PID:8116
- C:\Windows\System\OiFQMIa.exe
  C:\Windows\System\OiFQMIa.exe
  2⤵
  PID:2620
- C:\Windows\System\RPfDpZF.exe
  C:\Windows\System\RPfDpZF.exe
  2⤵
  PID:7820
- C:\Windows\System\sRnbJZJ.exe
  C:\Windows\System\sRnbJZJ.exe
  2⤵
  PID:8624
- C:\Windows\System\DPBzSEz.exe
  C:\Windows\System\DPBzSEz.exe
  2⤵
  PID:11236
- C:\Windows\System\mxQajZs.exe
  C:\Windows\System\mxQajZs.exe
  2⤵
  PID:11240
- C:\Windows\System\TOhaJkP.exe
  C:\Windows\System\TOhaJkP.exe
  2⤵
  PID:10280
- C:\Windows\System\peMoLXK.exe
  C:\Windows\System\peMoLXK.exe
  2⤵
  PID:5116
- C:\Windows\System\uGpdopH.exe
  C:\Windows\System\uGpdopH.exe
  2⤵
  PID:7872
- C:\Windows\System\KZaaWdm.exe
  C:\Windows\System\KZaaWdm.exe
  2⤵
  PID:10392
- C:\Windows\System\SYUOEMH.exe
  C:\Windows\System\SYUOEMH.exe
  2⤵
  PID:8280
- C:\Windows\System\iDexwsa.exe
  C:\Windows\System\iDexwsa.exe
  2⤵
  PID:7888
- C:\Windows\System\XSBTlAp.exe
  C:\Windows\System\XSBTlAp.exe
  2⤵
  PID:9128
- C:\Windows\System\uboavBI.exe
  C:\Windows\System\uboavBI.exe
  2⤵
  PID:3720
- C:\Windows\System\HMepXtb.exe
  C:\Windows\System\HMepXtb.exe
  2⤵
  PID:7916
- C:\Windows\System\SdlaACL.exe
  C:\Windows\System\SdlaACL.exe
  2⤵
  PID:8308
- C:\Windows\System\apeZCGG.exe
  C:\Windows\System\apeZCGG.exe
  2⤵
  PID:10988
- C:\Windows\System\nrdAKYo.exe
  C:\Windows\System\nrdAKYo.exe
  2⤵
  PID:10932
- C:\Windows\System\kShaakF.exe
  C:\Windows\System\kShaakF.exe
  2⤵
  PID:1072
- C:\Windows\System\wJATTpT.exe
  C:\Windows\System\wJATTpT.exe
  2⤵
  PID:8332
- C:\Windows\System\iTERzYZ.exe
  C:\Windows\System\iTERzYZ.exe
  2⤵
  PID:9240
- C:\Windows\System\YMuGdeE.exe
  C:\Windows\System\YMuGdeE.exe
  2⤵
  PID:6196
- C:\Windows\System\ToUMEDB.exe
  C:\Windows\System\ToUMEDB.exe
  2⤵
  PID:10448
- C:\Windows\System\CsejdEh.exe
  C:\Windows\System\CsejdEh.exe
  2⤵
  PID:1740
- C:\Windows\System\vkaFgTV.exe
  C:\Windows\System\vkaFgTV.exe
  2⤵
  PID:10920
- C:\Windows\System\lEUUsKx.exe
  C:\Windows\System\lEUUsKx.exe
  2⤵
  PID:5568
- C:\Windows\System\LgdVInH.exe
  C:\Windows\System\LgdVInH.exe
  2⤵
  PID:9744
- C:\Windows\System\JPovWPD.exe
  C:\Windows\System\JPovWPD.exe
  2⤵
  PID:9836
- C:\Windows\System\oBaftRx.exe
  C:\Windows\System\oBaftRx.exe
  2⤵
  PID:5468
- C:\Windows\System\UaVePqV.exe
  C:\Windows\System\UaVePqV.exe
  2⤵
  PID:10336
- C:\Windows\System\KfwXtzX.exe
  C:\Windows\System\KfwXtzX.exe
  2⤵
  PID:10080
- C:\Windows\System\lIhHVpq.exe
  C:\Windows\System\lIhHVpq.exe
  2⤵
  PID:10232
- C:\Windows\System\pRBLlpf.exe
  C:\Windows\System\pRBLlpf.exe
  2⤵
  PID:9384
- C:\Windows\System\kJuQeVp.exe
  C:\Windows\System\kJuQeVp.exe
  2⤵
  PID:8380
- C:\Windows\System\TWsYuDe.exe
  C:\Windows\System\TWsYuDe.exe
  2⤵
  PID:11516
- C:\Windows\System\chyHKGd.exe
  C:\Windows\System\chyHKGd.exe
  2⤵
  PID:9812
- C:\Windows\System\sWLtMnS.exe
  C:\Windows\System\sWLtMnS.exe
  2⤵
  PID:8452
- C:\Windows\System\qgFGWhA.exe
  C:\Windows\System\qgFGWhA.exe
  2⤵
  PID:11680
- C:\Windows\System\dEAzWdp.exe
  C:\Windows\System\dEAzWdp.exe
  2⤵
  PID:11788
- C:\Windows\System\XrIabCU.exe
  C:\Windows\System\XrIabCU.exe
  2⤵
  PID:11820
- C:\Windows\System\vAPgWus.exe
  C:\Windows\System\vAPgWus.exe
  2⤵
  PID:9292
- C:\Windows\System\nMoumEH.exe
  C:\Windows\System\nMoumEH.exe
  2⤵
  PID:6468
- C:\Windows\System\vrNjqrV.exe
  C:\Windows\System\vrNjqrV.exe
  2⤵
  PID:12040
- C:\Windows\System\CPDIIPQ.exe
  C:\Windows\System\CPDIIPQ.exe
  2⤵
  PID:12072
- C:\Windows\System\FABDYxm.exe
  C:\Windows\System\FABDYxm.exe
  2⤵
  PID:10120
- C:\Windows\System\CpxPTyO.exe
  C:\Windows\System\CpxPTyO.exe
  2⤵
  PID:10136
- C:\Windows\System\GkfuIvU.exe
  C:\Windows\System\GkfuIvU.exe
  2⤵
  PID:12272
- C:\Windows\System\EyHIlpK.exe
  C:\Windows\System\EyHIlpK.exe
  2⤵
  PID:11428
- C:\Windows\System\PdLZiiz.exe
  C:\Windows\System\PdLZiiz.exe
  2⤵
  PID:11564
- C:\Windows\System\GSHUvak.exe
  C:\Windows\System\GSHUvak.exe
  2⤵
  PID:11764
- C:\Windows\System\HDnqiJb.exe
  C:\Windows\System\HDnqiJb.exe
  2⤵
  PID:11908
- C:\Windows\System\bMkgRKZ.exe
  C:\Windows\System\bMkgRKZ.exe
  2⤵
  PID:4444
- C:\Windows\System\CLknrRf.exe
  C:\Windows\System\CLknrRf.exe
  2⤵
  PID:12192
- C:\Windows\System\ZrRULfy.exe
  C:\Windows\System\ZrRULfy.exe
  2⤵
  PID:11508
- C:\Windows\System\tFVULQG.exe
  C:\Windows\System\tFVULQG.exe
  2⤵
  PID:11612
- C:\Windows\System\RcjGASR.exe
  C:\Windows\System\RcjGASR.exe
  2⤵
  PID:11884
- C:\Windows\System\TkcwUgu.exe
  C:\Windows\System\TkcwUgu.exe
  2⤵
  PID:12156
- C:\Windows\System\FrAQcyn.exe
  C:\Windows\System\FrAQcyn.exe
  2⤵
  PID:11688
- C:\Windows\System\VEYNQLk.exe
  C:\Windows\System\VEYNQLk.exe
  2⤵
  PID:4948
- C:\Windows\System\sFTfoWM.exe
  C:\Windows\System\sFTfoWM.exe
  2⤵
  PID:11556
- C:\Windows\System\tiMoFRc.exe
  C:\Windows\System\tiMoFRc.exe
  2⤵
  PID:12360
- C:\Windows\System\NtEKbkJ.exe
  C:\Windows\System\NtEKbkJ.exe
  2⤵
  PID:12436
- C:\Windows\System\QjCRvZa.exe
  C:\Windows\System\QjCRvZa.exe
  2⤵
  PID:12516
- C:\Windows\System\PUiGYEc.exe
  C:\Windows\System\PUiGYEc.exe
  2⤵
  PID:6564
- C:\Windows\System\PHHYkcJ.exe
  C:\Windows\System\PHHYkcJ.exe
  2⤵
  PID:9892
- C:\Windows\System\EnOLBUp.exe
  C:\Windows\System\EnOLBUp.exe
  2⤵
  PID:12644
- C:\Windows\System\oaxaXAy.exe
  C:\Windows\System\oaxaXAy.exe
  2⤵
  PID:7052
- C:\Windows\System\bAhYWgm.exe
  C:\Windows\System\bAhYWgm.exe
  2⤵
  PID:12804
- C:\Windows\System\HVoSFBN.exe
  C:\Windows\System\HVoSFBN.exe
  2⤵
  PID:12852
- C:\Windows\System\HlVVLaI.exe
  C:\Windows\System\HlVVLaI.exe
  2⤵
  PID:12908
- C:\Windows\System\LhlHUzr.exe
  C:\Windows\System\LhlHUzr.exe
  2⤵
  PID:8860
- C:\Windows\System\niXeSqH.exe
  C:\Windows\System\niXeSqH.exe
  2⤵
  PID:13072
- C:\Windows\System\dOJXqab.exe
  C:\Windows\System\dOJXqab.exe
  2⤵
  PID:13148
- C:\Windows\System\JJMZege.exe
  C:\Windows\System\JJMZege.exe
  2⤵
  PID:13184
- C:\Windows\System\osWSnWN.exe
  C:\Windows\System\osWSnWN.exe
  2⤵
  PID:4448
- C:\Windows\System\moFjUuQ.exe
  C:\Windows\System\moFjUuQ.exe
  2⤵
  PID:10368
- C:\Windows\System\IKcqAYG.exe
  C:\Windows\System\IKcqAYG.exe
  2⤵
  PID:6640
- C:\Windows\System\TMgappW.exe
  C:\Windows\System\TMgappW.exe
  2⤵
  PID:2680
- C:\Windows\System\EwQtNSR.exe
  C:\Windows\System\EwQtNSR.exe
  2⤵
  PID:6244
- C:\Windows\System\KVAQiWZ.exe
  C:\Windows\System\KVAQiWZ.exe
  2⤵
  PID:7704
- C:\Windows\System\pcZRnoR.exe
  C:\Windows\System\pcZRnoR.exe
  2⤵
  PID:7376
- C:\Windows\System\dWNhogm.exe
  C:\Windows\System\dWNhogm.exe
  2⤵
  PID:1904
- C:\Windows\System\mIvbjwr.exe
  C:\Windows\System\mIvbjwr.exe
  2⤵
  PID:8220
- C:\Windows\System\XVjSYoK.exe
  C:\Windows\System\XVjSYoK.exe
  2⤵
  PID:8260
- C:\Windows\System\jZybECX.exe
  C:\Windows\System\jZybECX.exe
  2⤵
  PID:7140
- C:\Windows\System\GdeSDTj.exe
  C:\Windows\System\GdeSDTj.exe
  2⤵
  PID:6280
- C:\Windows\System\OfYOGFx.exe
  C:\Windows\System\OfYOGFx.exe
  2⤵
  PID:7192
- C:\Windows\System\XUVEQzP.exe
  C:\Windows\System\XUVEQzP.exe
  2⤵
  PID:7304
- C:\Windows\System\vzLeQyH.exe
  C:\Windows\System\vzLeQyH.exe
  2⤵
  PID:7412
- C:\Windows\System\HJoYsoS.exe
  C:\Windows\System\HJoYsoS.exe
  2⤵
  PID:3064
- C:\Windows\System\FwmhDun.exe
  C:\Windows\System\FwmhDun.exe
  2⤵
  PID:8028
- C:\Windows\System\NiNnAqA.exe
  C:\Windows\System\NiNnAqA.exe
  2⤵
  PID:7624
- C:\Windows\System\esifZNt.exe
  C:\Windows\System\esifZNt.exe
  2⤵
  PID:7656
- C:\Windows\System\BGjFfoG.exe
  C:\Windows\System\BGjFfoG.exe
  2⤵
  PID:5216
- C:\Windows\System\vZuRDUr.exe
  C:\Windows\System\vZuRDUr.exe
  2⤵
  PID:5140
- C:\Windows\System\JRylszR.exe
  C:\Windows\System\JRylszR.exe
  2⤵
  PID:11164
- C:\Windows\System\sqYzqvX.exe
  C:\Windows\System\sqYzqvX.exe
  2⤵
  PID:8768
- C:\Windows\System\ylSRbof.exe
  C:\Windows\System\ylSRbof.exe
  2⤵
  PID:2740
- C:\Windows\System\nUtKOSv.exe
  C:\Windows\System\nUtKOSv.exe
  2⤵
  PID:8276
- C:\Windows\System\prsJCNT.exe
  C:\Windows\System\prsJCNT.exe
  2⤵
  PID:8420
- C:\Windows\System\glqYhQV.exe
  C:\Windows\System\glqYhQV.exe
  2⤵
  PID:2812
- C:\Windows\System\rfxpULI.exe
  C:\Windows\System\rfxpULI.exe
  2⤵
  PID:10544
- C:\Windows\System\AdVGdrx.exe
  C:\Windows\System\AdVGdrx.exe
  2⤵
  PID:11048
- C:\Windows\System\yfGADtq.exe
  C:\Windows\System\yfGADtq.exe
  2⤵
  PID:4308
- C:\Windows\System\MpAHUZl.exe
  C:\Windows\System\MpAHUZl.exe
  2⤵
  PID:9312
- C:\Windows\System\bQvyIEk.exe
  C:\Windows\System\bQvyIEk.exe
  2⤵
  PID:10736
- C:\Windows\System\voIpzGS.exe
  C:\Windows\System\voIpzGS.exe
  2⤵
  PID:2424
- C:\Windows\System\dKkkRFe.exe
  C:\Windows\System\dKkkRFe.exe
  2⤵
  PID:11224
- C:\Windows\System\NOlMHHK.exe
  C:\Windows\System\NOlMHHK.exe
  2⤵
  PID:4408
- C:\Windows\System\NzKptXO.exe
  C:\Windows\System\NzKptXO.exe
  2⤵
  PID:10044
- C:\Windows\System\NgEfFVP.exe
  C:\Windows\System\NgEfFVP.exe
  2⤵
  PID:9288
- C:\Windows\System\OgWgnXh.exe
  C:\Windows\System\OgWgnXh.exe
  2⤵
  PID:11488
- C:\Windows\System\zCYFcTJ.exe
  C:\Windows\System\zCYFcTJ.exe
  2⤵
  PID:5368
- C:\Windows\System\EoUgWVh.exe
  C:\Windows\System\EoUgWVh.exe
  2⤵
  PID:3100
- C:\Windows\System\lokkxdZ.exe
  C:\Windows\System\lokkxdZ.exe
  2⤵
  PID:8044
- C:\Windows\System\vnHTtaF.exe
  C:\Windows\System\vnHTtaF.exe
  2⤵
  PID:12012
- C:\Windows\System\YsKJyUJ.exe
  C:\Windows\System\YsKJyUJ.exe
  2⤵
  PID:4884
- C:\Windows\System\wiIMPgd.exe
  C:\Windows\System\wiIMPgd.exe
  2⤵
  PID:12260
- C:\Windows\System\PXrUBdS.exe
  C:\Windows\System\PXrUBdS.exe
  2⤵
  PID:5596
- C:\Windows\System\aPZXQur.exe
  C:\Windows\System\aPZXQur.exe
  2⤵
  PID:10612
- C:\Windows\System\xkSaPdV.exe
  C:\Windows\System\xkSaPdV.exe
  2⤵
  PID:11928
- C:\Windows\System\oDEpLZC.exe
  C:\Windows\System\oDEpLZC.exe
  2⤵
  PID:3884
- C:\Windows\System\pkpCfxu.exe
  C:\Windows\System\pkpCfxu.exe
  2⤵
  PID:9692
- C:\Windows\System\oRKOqnU.exe
  C:\Windows\System\oRKOqnU.exe
  2⤵
  PID:12084
- C:\Windows\System\TylchkC.exe
  C:\Windows\System\TylchkC.exe
  2⤵
  PID:1672
- C:\Windows\System\geyzaAc.exe
  C:\Windows\System\geyzaAc.exe
  2⤵
  PID:12808
- C:\Windows\System\vRUnsDm.exe
  C:\Windows\System\vRUnsDm.exe
  2⤵
  PID:11076
- C:\Windows\System\tFbaToN.exe
  C:\Windows\System\tFbaToN.exe
  2⤵
  PID:11196
- C:\Windows\System\ujIjCeg.exe
  C:\Windows\System\ujIjCeg.exe
  2⤵
  PID:5280
- C:\Windows\System\NBMmndh.exe
  C:\Windows\System\NBMmndh.exe
  2⤵
  PID:10748
- C:\Windows\System\YnMsrHT.exe
  C:\Windows\System\YnMsrHT.exe
  2⤵
  PID:7024
- C:\Windows\System\NuvPoRt.exe
  C:\Windows\System\NuvPoRt.exe
  2⤵
  PID:8808
- C:\Windows\System\ZcnaITx.exe
  C:\Windows\System\ZcnaITx.exe
  2⤵
  PID:12968
- C:\Windows\System\VPVPyQU.exe
  C:\Windows\System\VPVPyQU.exe
  2⤵
  PID:2216
- C:\Windows\System\KlMJURl.exe
  C:\Windows\System\KlMJURl.exe
  2⤵
  PID:13196
- C:\Windows\System\GdQbzxc.exe
  C:\Windows\System\GdQbzxc.exe
  2⤵
  PID:8976
- C:\Windows\System\YYSnTDi.exe
  C:\Windows\System\YYSnTDi.exe
  2⤵
  PID:4764
- C:\Windows\System\aNzVXZA.exe
  C:\Windows\System\aNzVXZA.exe
  2⤵
  PID:1088
- C:\Windows\System\CijuUHf.exe
  C:\Windows\System\CijuUHf.exe
  2⤵
  PID:6960
- C:\Windows\System\oBEixPV.exe
  C:\Windows\System\oBEixPV.exe
  2⤵
  PID:7900
- C:\Windows\System\UqxdQhN.exe
  C:\Windows\System\UqxdQhN.exe
  2⤵
  PID:8596
- C:\Windows\System\wyycqFx.exe
  C:\Windows\System\wyycqFx.exe
  2⤵
  PID:7348
- C:\Windows\System\sENiQaN.exe
  C:\Windows\System\sENiQaN.exe
  2⤵
  PID:7520
- C:\Windows\System\aUxWvaK.exe
  C:\Windows\System\aUxWvaK.exe
  2⤵
  PID:12324
- C:\Windows\System\hNRhKdX.exe
  C:\Windows\System\hNRhKdX.exe
  2⤵
  PID:12888
- C:\Windows\System\LGczbiV.exe
  C:\Windows\System\LGczbiV.exe
  2⤵
  PID:12956
- C:\Windows\System\ZHnIfcB.exe
  C:\Windows\System\ZHnIfcB.exe
  2⤵
  PID:13044
- C:\Windows\System\kQJqbse.exe
  C:\Windows\System\kQJqbse.exe
  2⤵
  PID:8800
- C:\Windows\System\qKMSlWW.exe
  C:\Windows\System\qKMSlWW.exe
  2⤵
  PID:12980
- C:\Windows\System\RoARosR.exe
  C:\Windows\System\RoARosR.exe
  2⤵
  PID:6148
- C:\Windows\System\njDAlNk.exe
  C:\Windows\System\njDAlNk.exe
  2⤵
  PID:9544
- C:\Windows\System\JxXAFvp.exe
  C:\Windows\System\JxXAFvp.exe
  2⤵
  PID:2924
- C:\Windows\System\qAGyVpQ.exe
  C:\Windows\System\qAGyVpQ.exe
  2⤵
  PID:10148
- C:\Windows\System\MyHFZJu.exe
  C:\Windows\System\MyHFZJu.exe
  2⤵
  PID:2368
- C:\Windows\System\HNgIoCb.exe
  C:\Windows\System\HNgIoCb.exe
  2⤵
  PID:8052
- C:\Windows\System\AsicqnT.exe
  C:\Windows\System\AsicqnT.exe
  2⤵
  PID:2516
- C:\Windows\System\rmeJKOa.exe
  C:\Windows\System\rmeJKOa.exe
  2⤵
  PID:12228
- C:\Windows\System\TsyQFhe.exe
  C:\Windows\System\TsyQFhe.exe
  2⤵
  PID:5416
- C:\Windows\System\DaEHCnY.exe
  C:\Windows\System\DaEHCnY.exe
  2⤵
  PID:452
- C:\Windows\System\OHIXGNk.exe
  C:\Windows\System\OHIXGNk.exe
  2⤵
  PID:7212
- C:\Windows\System\vthRVRe.exe
  C:\Windows\System\vthRVRe.exe
  2⤵
  PID:9716
- C:\Windows\System\CAhHZpT.exe
  C:\Windows\System\CAhHZpT.exe
  2⤵
  PID:1920
- C:\Windows\System\nobszZQ.exe
  C:\Windows\System\nobszZQ.exe
  2⤵
  PID:9132
- C:\Windows\System\cqlAWzb.exe
  C:\Windows\System\cqlAWzb.exe
  2⤵
  PID:8048
- C:\Windows\System\IjZwjwV.exe
  C:\Windows\System\IjZwjwV.exe
  2⤵
  PID:9052
- C:\Windows\System\REPSsFL.exe
  C:\Windows\System\REPSsFL.exe
  2⤵
  PID:4868
- C:\Windows\System\CziTJAN.exe
  C:\Windows\System\CziTJAN.exe
  2⤵
  PID:13140
- C:\Windows\System\BxhFysr.exe
  C:\Windows\System\BxhFysr.exe
  2⤵
  PID:7932
- C:\Windows\System\KzmpAYe.exe
  C:\Windows\System\KzmpAYe.exe
  2⤵
  PID:6800
- C:\Windows\System\uwlXrOX.exe
  C:\Windows\System\uwlXrOX.exe
  2⤵
  PID:4732
- C:\Windows\System\gryFQNC.exe
  C:\Windows\System\gryFQNC.exe
  2⤵
  PID:1180
- C:\Windows\System\jdNZSUx.exe
  C:\Windows\System\jdNZSUx.exe
  2⤵
  PID:5236
- C:\Windows\System\FdQqzIL.exe
  C:\Windows\System\FdQqzIL.exe
  2⤵
  PID:11536
- C:\Windows\System\ZigJCJu.exe
  C:\Windows\System\ZigJCJu.exe
  2⤵
  PID:12256
- C:\Windows\System\GVlJWWU.exe
  C:\Windows\System\GVlJWWU.exe
  2⤵
  PID:512
- C:\Windows\System\BsEjUlw.exe
  C:\Windows\System\BsEjUlw.exe
  2⤵
  PID:12532
- C:\Windows\System\fufAtxk.exe
  C:\Windows\System\fufAtxk.exe
  2⤵
  PID:12448
- C:\Windows\System\RxVglmf.exe
  C:\Windows\System\RxVglmf.exe
  2⤵
  PID:12936
- C:\Windows\System\debYuOC.exe
  C:\Windows\System\debYuOC.exe
  2⤵
  PID:13068
- C:\Windows\System\GzRXCbO.exe
  C:\Windows\System\GzRXCbO.exe
  2⤵
  PID:1692
- C:\Windows\System\NCzkigl.exe
  C:\Windows\System\NCzkigl.exe
  2⤵
  PID:8348
- C:\Windows\System\LEpGVNT.exe
  C:\Windows\System\LEpGVNT.exe
  2⤵
  PID:8512
- C:\Windows\System\MokZFoD.exe
  C:\Windows\System\MokZFoD.exe
  2⤵
  PID:13284
- C:\Windows\System\VLlKzmt.exe
  C:\Windows\System\VLlKzmt.exe
  2⤵
  PID:10856
- C:\Windows\System\THSsUuQ.exe
  C:\Windows\System\THSsUuQ.exe
  2⤵
  PID:11408
- C:\Windows\System\vIDXOPG.exe
  C:\Windows\System\vIDXOPG.exe
  2⤵
  PID:11252
- C:\Windows\System\KnYqMmM.exe
  C:\Windows\System\KnYqMmM.exe
  2⤵
  PID:7104
- C:\Windows\System\mKJKcbS.exe
  C:\Windows\System\mKJKcbS.exe
  2⤵
  PID:7620
- C:\Windows\System\vHfwGhW.exe
  C:\Windows\System\vHfwGhW.exe
  2⤵
  PID:13248
- C:\Windows\System\YtCnLsK.exe
  C:\Windows\System\YtCnLsK.exe
  2⤵
  PID:9516
- C:\Windows\System\syyWmsU.exe
  C:\Windows\System\syyWmsU.exe
  2⤵
  PID:10992
- C:\Windows\System\rFeJsxm.exe
  C:\Windows\System\rFeJsxm.exe
  2⤵
  PID:13280
- C:\Windows\System\lVQpndQ.exe
  C:\Windows\System\lVQpndQ.exe
  2⤵
  PID:11992
- C:\Windows\System\AWlLGVA.exe
  C:\Windows\System\AWlLGVA.exe
  2⤵
  PID:10952
- C:\Windows\System\AGZheXc.exe
  C:\Windows\System\AGZheXc.exe
  2⤵
  PID:12620
- C:\Windows\System\hhAOnku.exe
  C:\Windows\System\hhAOnku.exe
  2⤵
  PID:13340
- C:\Windows\System\NmunEne.exe
  C:\Windows\System\NmunEne.exe
  2⤵
  PID:13368
- C:\Windows\System\YPdMcKH.exe
  C:\Windows\System\YPdMcKH.exe
  2⤵
  PID:13396
- C:\Windows\System\EVPZwEF.exe
  C:\Windows\System\EVPZwEF.exe
  2⤵
  PID:13424
- C:\Windows\System\ueKwMEF.exe
  C:\Windows\System\ueKwMEF.exe
  2⤵
  PID:13452
- C:\Windows\System\BfdHjkp.exe
  C:\Windows\System\BfdHjkp.exe
  2⤵
  PID:13480
- C:\Windows\System\qgJHZUk.exe
  C:\Windows\System\qgJHZUk.exe
  2⤵
  PID:13508
- C:\Windows\System\NaNYjhN.exe
  C:\Windows\System\NaNYjhN.exe
  2⤵
  PID:13536
- C:\Windows\System\BqrqzBj.exe
  C:\Windows\System\BqrqzBj.exe
  2⤵
  PID:13564
- C:\Windows\System\LfCaVst.exe
  C:\Windows\System\LfCaVst.exe
  2⤵
  PID:13592
- C:\Windows\System\nrlSSRv.exe
  C:\Windows\System\nrlSSRv.exe
  2⤵
  PID:13620
- C:\Windows\System\zROQAsq.exe
  C:\Windows\System\zROQAsq.exe
  2⤵
  PID:13648
- C:\Windows\System\PxnOXKj.exe
  C:\Windows\System\PxnOXKj.exe
  2⤵
  PID:13676
- C:\Windows\System\NbXsFze.exe
  C:\Windows\System\NbXsFze.exe
  2⤵
  PID:13704
- C:\Windows\System\LpHGzeK.exe
  C:\Windows\System\LpHGzeK.exe
  2⤵
  PID:13732
- C:\Windows\System\FxZAWlK.exe
  C:\Windows\System\FxZAWlK.exe
  2⤵
  PID:13764
- C:\Windows\System\QcbieHc.exe
  C:\Windows\System\QcbieHc.exe
  2⤵
  PID:13792
- C:\Windows\System\RAlyXcG.exe
  C:\Windows\System\RAlyXcG.exe
  2⤵
  PID:13820
- C:\Windows\System\xYjXHBf.exe
  C:\Windows\System\xYjXHBf.exe
  2⤵
  PID:13848
- C:\Windows\System\InOskzU.exe
  C:\Windows\System\InOskzU.exe
  2⤵
  PID:13876
- C:\Windows\System\EdtodHT.exe
  C:\Windows\System\EdtodHT.exe
  2⤵
  PID:13904
- C:\Windows\System\jUmZioJ.exe
  C:\Windows\System\jUmZioJ.exe
  2⤵
  PID:13932
- C:\Windows\System\MeSMSAf.exe
  C:\Windows\System\MeSMSAf.exe
  2⤵
  PID:13960
- C:\Windows\System\albKBCb.exe
  C:\Windows\System\albKBCb.exe
  2⤵
  PID:13988
- C:\Windows\System\WLmmFOv.exe
  C:\Windows\System\WLmmFOv.exe
  2⤵
  PID:14016
- C:\Windows\System\uUBUveM.exe
  C:\Windows\System\uUBUveM.exe
  2⤵
  PID:14044
- C:\Windows\System\pUmChPe.exe
  C:\Windows\System\pUmChPe.exe
  2⤵
  PID:14072
- C:\Windows\System\FsuHisH.exe
  C:\Windows\System\FsuHisH.exe
  2⤵
  PID:14100
- C:\Windows\System\fgnrLvT.exe
  C:\Windows\System\fgnrLvT.exe
  2⤵
  PID:14128
- C:\Windows\System\iTHOfwx.exe
  C:\Windows\System\iTHOfwx.exe
  2⤵
  PID:14156
- C:\Windows\System\QAfTgXQ.exe
  C:\Windows\System\QAfTgXQ.exe
  2⤵
  PID:14184
- C:\Windows\System\kibJwQw.exe
  C:\Windows\System\kibJwQw.exe
  2⤵
  PID:14212
- C:\Windows\System\RNikvjB.exe
  C:\Windows\System\RNikvjB.exe
  2⤵
  PID:14244
- C:\Windows\System\ZavJVJz.exe
  C:\Windows\System\ZavJVJz.exe
  2⤵
  PID:14272
- C:\Windows\System\MnXjzTC.exe
  C:\Windows\System\MnXjzTC.exe
  2⤵
  PID:14300
- C:\Windows\System\PZXByqk.exe
  C:\Windows\System\PZXByqk.exe
  2⤵
  PID:14328
- C:\Windows\System\ttvRoHX.exe
  C:\Windows\System\ttvRoHX.exe
  2⤵
  PID:13364
- C:\Windows\System\YsWCTUv.exe
  C:\Windows\System\YsWCTUv.exe
  2⤵
  PID:13432
- C:\Windows\System\nTTtXrf.exe
  C:\Windows\System\nTTtXrf.exe
  2⤵
  PID:13496
- C:\Windows\System\JwBVXBl.exe
  C:\Windows\System\JwBVXBl.exe
  2⤵
  PID:13552
- C:\Windows\System\nUVIkmy.exe
  C:\Windows\System\nUVIkmy.exe
  2⤵
  PID:13608
- C:\Windows\System\bnHRkKq.exe
  C:\Windows\System\bnHRkKq.exe
  2⤵
  PID:13644
- C:\Windows\System\FUwslTm.exe
  C:\Windows\System\FUwslTm.exe
  2⤵
  PID:13692
- C:\Windows\System\aZSQUkO.exe
  C:\Windows\System\aZSQUkO.exe
  2⤵
  PID:4512
- C:\Windows\System\YmzFbjf.exe
  C:\Windows\System\YmzFbjf.exe
  2⤵
  PID:5348
- C:\Windows\System\YMInpmJ.exe
  C:\Windows\System\YMInpmJ.exe
  2⤵
  PID:10820
- C:\Windows\System\Mfyapiy.exe
  C:\Windows\System\Mfyapiy.exe
  2⤵
  PID:13872
- C:\Windows\System\ZLUUWCE.exe
  C:\Windows\System\ZLUUWCE.exe
  2⤵
  PID:13940
- C:\Windows\System\TnvUnDN.exe
  C:\Windows\System\TnvUnDN.exe
  2⤵
  PID:14004
- C:\Windows\System\BINxWHe.exe
  C:\Windows\System\BINxWHe.exe
  2⤵
  PID:14068
- C:\Windows\System\TkPMeyl.exe
  C:\Windows\System\TkPMeyl.exe
  2⤵
  PID:14136
- C:\Windows\System\bqlEsVG.exe
  C:\Windows\System\bqlEsVG.exe
  2⤵
  PID:3788
- C:\Windows\System\sWjNoya.exe
  C:\Windows\System\sWjNoya.exe
  2⤵
  PID:5736
- C:\Windows\System\WTndvwn.exe
  C:\Windows\System\WTndvwn.exe
  2⤵
  PID:14280
- C:\Windows\System\gFquCvY.exe
  C:\Windows\System\gFquCvY.exe
  2⤵
  PID:14324
- C:\Windows\System\HvUqrsh.exe
  C:\Windows\System\HvUqrsh.exe
  2⤵
  PID:2988
- C:\Windows\System\fQHCzxJ.exe
  C:\Windows\System\fQHCzxJ.exe
  2⤵
  PID:13420
- C:\Windows\System\BHImoMc.exe
  C:\Windows\System\BHImoMc.exe
  2⤵
  PID:6816
- C:\Windows\System\dmbibYI.exe
  C:\Windows\System\dmbibYI.exe
  2⤵
  PID:5252
- C:\Windows\System\jYnGoCs.exe
  C:\Windows\System\jYnGoCs.exe
  2⤵
  PID:6932
- C:\Windows\System\HfTqzVT.exe
  C:\Windows\System\HfTqzVT.exe
  2⤵
  PID:5860
- C:\Windows\System\NeVKyDG.exe
  C:\Windows\System\NeVKyDG.exe
  2⤵
  PID:13728
- C:\Windows\System\ycZmtXE.exe
  C:\Windows\System\ycZmtXE.exe
  2⤵
  PID:12316
- C:\Windows\System\toMmEKk.exe
  C:\Windows\System\toMmEKk.exe
  2⤵
  PID:13844
- C:\Windows\System\AshrDVQ.exe
  C:\Windows\System\AshrDVQ.exe
  2⤵
  PID:3932
- C:\Windows\System\oNYopSR.exe
  C:\Windows\System\oNYopSR.exe
  2⤵
  PID:14024
- C:\Windows\System\HFgQlku.exe
  C:\Windows\System\HFgQlku.exe
  2⤵
  PID:14088
- C:\Windows\System\YpiZRKu.exe
  C:\Windows\System\YpiZRKu.exe
  2⤵
  PID:5984
- C:\Windows\System\qWKjmzZ.exe
  C:\Windows\System\qWKjmzZ.exe
  2⤵
  PID:14268
- C:\Windows\System\FBtlJir.exe
  C:\Windows\System\FBtlJir.exe
  2⤵
  PID:13356
- C:\Windows\System\xgqdLeV.exe
  C:\Windows\System\xgqdLeV.exe
  2⤵
  PID:13220
- C:\Windows\System\EgJtKSO.exe
  C:\Windows\System\EgJtKSO.exe
  2⤵
  PID:2952
- C:\Windows\System\tHtPNKH.exe
  C:\Windows\System\tHtPNKH.exe
  2⤵
  PID:13800
- C:\Windows\System\knTsmmX.exe
  C:\Windows\System\knTsmmX.exe
  2⤵
  PID:13956
- C:\Windows\System\uiCzVMF.exe
  C:\Windows\System\uiCzVMF.exe
  2⤵
  PID:4524
- C:\Windows\System\sOinEvu.exe
  C:\Windows\System\sOinEvu.exe
  2⤵
  PID:6332
- C:\Windows\System\QhTWeGc.exe
  C:\Windows\System\QhTWeGc.exe
  2⤵
  PID:4600
- C:\Windows\System\aEeNCgT.exe
  C:\Windows\System\aEeNCgT.exe
  2⤵
  PID:13928
- C:\Windows\System\pFRnfdE.exe
  C:\Windows\System\pFRnfdE.exe
  2⤵
  PID:4164
- C:\Windows\System\VhwjXpr.exe
  C:\Windows\System\VhwjXpr.exe
  2⤵
  PID:1220
- C:\Windows\System\WAFUtjU.exe
  C:\Windows\System\WAFUtjU.exe
  2⤵
  PID:14180
- C:\Windows\System\WuSnOYJ.exe
  C:\Windows\System\WuSnOYJ.exe
  2⤵
  PID:14352
- C:\Windows\System\FTsYNql.exe
  C:\Windows\System\FTsYNql.exe
  2⤵
  PID:14380
- C:\Windows\System\XDINIvR.exe
  C:\Windows\System\XDINIvR.exe
  2⤵
  PID:14408
- C:\Windows\System\iRUVJSd.exe
  C:\Windows\System\iRUVJSd.exe
  2⤵
  PID:15128
- C:\Windows\System\HnRIPDw.exe
  C:\Windows\System\HnRIPDw.exe
  2⤵
  PID:15156
- C:\Windows\System\tcWHatr.exe
  C:\Windows\System\tcWHatr.exe
  2⤵
  PID:15184
- C:\Windows\System\PmxdjxX.exe
  C:\Windows\System\PmxdjxX.exe
  2⤵
  PID:15212
- C:\Windows\System\rmxnqaF.exe
  C:\Windows\System\rmxnqaF.exe
  2⤵
  PID:14988

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_wx01njbm.5la.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\AGXTcpM.exe

Filesize
3.0MB

MD5
a937f3e06c725183454170d435f44549

SHA1
6244890c00d333c7032eeb61a50dc99f4a0a9017

SHA256
e9988380af3fc69476e236193449e952b159d98fd822ab8572aa646a37e8df41

SHA512
6498765f16446bc0a969bdab51aa17b67dee0faddf2fb93a402c38c332b81bb9ec6901d8b7f8b228890748d173c1b506322c245890dc46e6f09e8dc5ad85c063

Download Submit
C:\Windows\System\AmLGwdp.exe

Filesize
3.0MB

MD5
41bbe16ab61e1b36199ac0a727845778

SHA1
1d44c9c6ff27b37bf64e407ecd42c3e724df4470

SHA256
2b0f422dff0369be13378cd86be0997a3d10cf5549d5eeab1e4a8c04ed8ee844

SHA512
aa87705f62c8c53f06bada96d37cbc8e013a79f4339067c6ed9d7f34d9cd8965a3f83c2f0e6ed0f3585d065deefed0bc8806dca0e08333b9b5e0dc0ba815d5f0

Download Submit
C:\Windows\System\BDqwtHO.exe

Filesize
3.0MB

MD5
599844df8dc7e6f2aefbe21fe5bb3f4b

SHA1
a1f3cce4d135f60df200aaf56cb5124243663aa1

SHA256
aa1b1fe536e28286e8c4a3645e9c3f63a59c8ffcfdda27df85033ec1d75e81e4

SHA512
cc617dad3c5d3557ab22ed8f94429517b300aa868a277e70f25893e9bb482d8c6df96aaba52be8fe6131c6f8c0e16cca932ec68586b46fea366c990e5ffdc2ba

Download Submit
C:\Windows\System\DWyxGUF.exe

Filesize
3.0MB

MD5
056ad4181289a2801ba2f1e73e46eea6

SHA1
863c15d160da0bfefb85ccf903612758a03108fb

SHA256
8d4348da4a4cbe2a449f631bce8e654426347ae2b1ae197150e6196bbaf90cab

SHA512
4e2bd263bd3c97a84474078aff971c0f5a5eaf6bf4a88eae7c9eb8925790ccc98abbb7cd6119772c48120ae52d5c8f2b857a79db495a85c4f0cda9db6ea737b8

Download Submit
C:\Windows\System\DtlaLFx.exe

Filesize
3.0MB

MD5
bf9867343ba36457ee0a50f927e1cce5

SHA1
a32e34709ae0c8e1871c7b9e080a5a34d924983a

SHA256
0aa6927acd6048d1035f22490e8dbcf4ca4aa60674a1ae71bf5c9a35831fdca1

SHA512
f0b7abaffbca80ce336acd866aacc57a3af09b308b4cde4065a40964b732c3a0fac32c56443a81296ecae8c0c645890c08beb44792854335a3205025215dc3f8

Download Submit
C:\Windows\System\EYAauhX.exe

Filesize
3.0MB

MD5
f89643d617073e2c80750a30123be794

SHA1
4a8936b12df5479992584db3826638b684212de7

SHA256
6d56af9cf17c42b3d9814102e11ce2652e1e1e6bf1d8e3e80fd83518c2c0b6e9

SHA512
54a8eec5e2060ed9c473f04c77820f64f571996e336119d64052e0dc6153b9de3698be2b4f7b57967c59c8074571dfed22fdbd4c2364801db9c17f8898ac5730

Download Submit
C:\Windows\System\FRqSNUn.exe

Filesize
3.0MB

MD5
e3896c7d0cd30fdc2b869ed691585155

SHA1
15b7d666a254763abef902a0a764828c37d0aaf4

SHA256
d342b5767b7dc3dcc7a54ee07a6a3c8f3dc6d5a734c583eea9200fb07cdbc9ae

SHA512
0a4067c8b6cb0e3ce15a1f20638f6a63a98bcc80b20def8cd5eabfb2a91fbe35c37e5a55caaefb73b9a0e4a838d4eee8181266b233751428e9494ee56d63ff6b

Download Submit
C:\Windows\System\FgerKAI.exe

Filesize
3.0MB

MD5
f000fba6fee68d8af8ae56f8b3961da1

SHA1
8ee5e0583e96ccb4cd76c6349d86e85da9fad468

SHA256
e1487b97db47de6ad737fb7dc98cf1db8f40e83f1367189c0d1948cb1e18946c

SHA512
32cbfbfafa8f5aa3033fccef710602fed21d66fa8e97a3d46dc74604f5568b134c0d1be193e289e25bc9cb8153242a91d841f38fdb0b1df1b3090dac33760625

Download Submit
C:\Windows\System\HmdAapU.exe

Filesize
3.0MB

MD5
11fbaef2d00a9b473b293e15ab605971

SHA1
a90b4f7a05b71316b9fdd2a64e1ef53a342b4c6d

SHA256
5d2990c97c0aab546f80e459066ab0fa6f45ff2dc189804b55fb4ca9a1094a85

SHA512
deeab2571008f7292c4bcd5ccb28731176a53744a8a64165ff80486a8b713482fcceb3ae5b0664ff713316ba67ebf256be4147bdd694f8e33007de7164178d06

Download Submit
C:\Windows\System\MXmuwht.exe

Filesize
3.0MB

MD5
db5ed1bed2e4354b756d221bae18f6d6

SHA1
ab35069cf2d05c91510f71500db2541bb7d439de

SHA256
3dd110c8aeaa6db1ddf15c90519532e482fda5ab6011e47a9f5259b67acc641d

SHA512
b0e6674857d10bf7c06e5081c998d63dc55ba79c040120ea5eac50aeea4cef6398359d7bd1331399941a0023a8a50d41f1542da6fdbb009bcafab36b5577935d

Download Submit
C:\Windows\System\MduNXDp.exe

Filesize
3.0MB

MD5
0d4d1ac27abe3c2436f532b1898b022b

SHA1
2e7af6a5ac273c5c797f81f1a387da1c8797f2aa

SHA256
2b92767f2f0dd81913538d8dedcc2c9a068eab972e7a42f9050669d408158748

SHA512
41eb51ebf3361b09531645cbec05f126914835c2fa0cb113e709c4dcf37e55f346206a4496c1630cc5b8e4794d4dfc5ce6ff42c1032551c80fa030e4e93cb7c5

Download Submit
C:\Windows\System\PwrcdvE.exe

Filesize
3.0MB

MD5
b1fc8e55776b4667b6fd2031026b320c

SHA1
fa6612aaaf4483c57ef49afbfc379a077a342302

SHA256
404e2aeb4cb2365a807941ecb80bb3c086da44d7903b5c87710326b387bdf4ae

SHA512
5960f966980f455f9048e14c5497a4e98d69c5c7874bedb438f82698f097e10a1f8a2fe20bdae38df04ccaba142ba4a5f6b678c0572caf8013c30841c156a706

Download Submit
C:\Windows\System\QKimhCI.exe

Filesize
3.0MB

MD5
3eb47fbb3df246b5dcdc72218ddb1f84

SHA1
abcfffb270bf48e19f03bf16edf40a8270bd8b47

SHA256
193ff1b3fd8adc9d4cd39947e435069364f73d32cc0ccdc7bc5e343cb535104d

SHA512
8bfa3c23f41ef7828aa84690679d75ff97b06c8f4e7ba91e768cfa2957846ca241012f31e4a2d7bc49b6eeb45b57b3e2ca499feb06ef54db0096504e7ccbc6bb

Download Submit
C:\Windows\System\QUbiFlo.exe

Filesize
3.0MB

MD5
361fa18d656749ba89d82dacbb0a5556

SHA1
ffa736dcfa7bcb2670e18b50ded29f6088f3dbbb

SHA256
91a96737684596fc986868995ef23a8d25e1219e54c7a03208b19c9c008b8cc9

SHA512
0ff5be0d4687d001cecee4d931e1d7391d3287ab4f127da7156d5ba0d32bc87f4ba7d11ca41100dc5b7a381b498740b993658e4d411e7cb80c8734895f281da1

Download Submit
C:\Windows\System\TWAfeSm.exe

Filesize
3.0MB

MD5
38be556137d35de48e582708eed0af25

SHA1
84464553eebbfc03c5889788958a6dd0eef9fedf

SHA256
d18dcf8d338c83bea6402b96223d1f8023aa0b470f086bc3b6017e52e7d61ee3

SHA512
eec94992914c38cf58b137cd9c34ce9a3027b3d82946a0f80b07c6a762e480188723cd4b9c65938829a364f17188f1b0c494af90ef4d093d929842c5f0c8d61e

Download Submit
C:\Windows\System\UWgZTjW.exe

Filesize
3.0MB

MD5
5d9f17e7f24732cbb586d7049ac51c62

SHA1
68daaaf199e34054dccee9e8186fb758bf19decc

SHA256
094cf42f91b6cb2e03a442bbb7ed3c00603135c6cf70b3b19664224f555c5e69

SHA512
829e054ec3e40d1869e94fa8b12939e9cfef6b904388d523291cb80333d5ac8d910351455d8f3789e77adeb6499c710580f8575920d8f6a24c385d8f079c4375

Download Submit
C:\Windows\System\dTOSkqF.exe

Filesize
3.0MB

MD5
e14016404c7af4511ffd701222908a13

SHA1
5cc5e80cd382ed5d59373cd13bc6514ef2681abe

SHA256
779620534b2df1d9b914d192a78f7f6e55c2a40fca3fc8832e8320597e0eeb1b

SHA512
3bf64f60ccc6a9fa3aded4bab5f39add1b3e12b46dc96ca42943a77ece5e94015906bb281331836adcab9cdddc4c5b871db5b6ef87f396a9dea97e02b372156b

Download Submit
C:\Windows\System\dTorOHo.exe

Filesize
3.0MB

MD5
00a83ed5333e1140109c7b88f9f1ff52

SHA1
c06525bc38284fab5830feb1f882449cffc08d20

SHA256
4b1781592c77c9d94c4f7afdb30dc28baea36fb1d23ed024cc59b0a7a648064f

SHA512
235226b49c0944c73a5f48131e9fe7bc850295b08ee0d0e7b44a11ab9b2059fe62e0ed77199e9d24f98a3b4322293f35f909fcf8b1c915b3a6e4fde8dd687053

Download Submit
C:\Windows\System\gLcPzYg.exe

Filesize
3.0MB

MD5
202ad4d0846e4d815293cd2fc708ec7c

SHA1
f5f8064bad7eecdf356d09d2d741fed0b9fb86dc

SHA256
847e9ec2e2347bc06fa8b03ac7c32d4b80849545345ad80b7ad41af85e9bbfb4

SHA512
cc18fda295acfc864bca60cffe0cde537da1b949d701a8936c726bcf4e8f95d1b45c4d0821bf338ea61ee53fbcc7aab7d71da03a0a91b6aa3a8a53a0bc7458ec

Download Submit
C:\Windows\System\gTnLOVp.exe

Filesize
18B

MD5
d4c53945d0b50cca8ee3c39950f75a96

SHA1
b80a0451cdd1f089663f9ee7b74d1e73ad057fdf

SHA256
c14bc0d583a2e28b394647d06f8fa7c0ff4cba50b7739e8641ff8669f7856a43

SHA512
298bc37c5e19145fc001cebfa843e38909335e86d2dcf1fd6f1a57c9dd72abb4d7c4e4ca9f9b743b79fd750b428a6154b00b7c45d2e633fde4a9fab32fec45b0

Download Submit
C:\Windows\System\hdNcQZr.exe

Filesize
3.0MB

MD5
989340c9f31f2f6dcec76704a8f729d1

SHA1
b1b23edff069dc23ac99c0669dfd2ea2b0e12a05

SHA256
2509563c014264296b7235429f6352bc4971609ef5ffadc7315ab93cddc533c6

SHA512
d519b37cc5a330d21c22e9d0764c85faccb1ba17d8ac479fccd6adca0dbb78351c0d25e9e63ef98962106489ca9c5a42b1e3cceab2dc4600b6e9299cdc5259c3

Download Submit
C:\Windows\System\kIAPkMv.exe

Filesize
3.0MB

MD5
240071f0d4b4585c3a482d94f7865ee9

SHA1
10d09316ba8b5625010a95cd6f9d80a4c026ef36

SHA256
5982f18c712c3d71d6ee8318c2706c767f7c4f730a46acc927242e5bb54eab62

SHA512
1ba61e52a3b253f9f7c0689819277bf4816fa2ecbbc6364e4250c9521a52705f834e4e568543c0d277f5e8c9237ce32d29c3f1b76289bddcb0ca2cdcb4c072d4

Download Submit
C:\Windows\System\kTuidkY.exe

Filesize
8B

MD5
69a2459cf267ca53a07e1000877ec5f5

SHA1
6180fdab39e41b082a5f032106ea0881035fc630

SHA256
ada8e0c66fd35906bd1beeda81d420b6e5f6b475841d10e62bd6374afbeacb69

SHA512
856cc19353d1aa3d8ce28f9d4a1fe10bf85ecb48b19883b3993f89b4192a7bd4dbaf2f158bd3e246dfcbb6a46252185b62c3e867aadc7a9e5bf0721b6b86c55b

Download Submit
C:\Windows\System\mCxDYym.exe

Filesize
3.0MB

MD5
f42deab2f765fdb9dae591bf3d7533d1

SHA1
ac9cea41bf8ef96630fc0b03da45cc7dfee43c78

SHA256
472fb645b0c93feee516fe4bece9da5c885e33aa3e67c6036757dba2a14eaa4e

SHA512
67b8190dc719568f2de078d81e4f9c07a79fb9e83d312c39335bb34aab54c656dddfcc8a3b5c22cd47363e012fa4f85d1bd7fec2d96baf0a98360398ede109dd

Download Submit
C:\Windows\System\mJKGfAA.exe

Filesize
3.0MB

MD5
c1557484f0968d515f0fca18ee4d9092

SHA1
c739d108ce4b7a7c823623428bf8260b80f5b69b

SHA256
18562cedecf0ff8e771aadf698dc3886679a31e8bdce6220cac371b83c6cc43c

SHA512
ebd7e5692368b830db4a4c3360ba244028e58442f89feb57b9b55d35b3851e3214404159d0dfc4eb35636a1d72db612ccdaa163ab85c8dab92c4da1b87116754

Download Submit
C:\Windows\System\nGtcdmM.exe

Filesize
3.0MB

MD5
9f4b416a7cabb1277073de0c1c876aeb

SHA1
6b608bd4a3aca0edd18dfea967032bb52f74feac

SHA256
31f39309a5e9c8b75dbf0c49f1484294a1d6bc27bdd64858f8d1448a04fa2e1c

SHA512
72c2c27431aceabb8d22a7f91f6d84ca9b366b8b677d5e2b22dca3c52cd25f9042e55f078ffb27aa40bb3ff121310fb6e8abc6800aa93bb3ca265a38a3c04a9e

Download Submit
C:\Windows\System\pALFnQn.exe

Filesize
3.0MB

MD5
e97d32a50c3a108bdbfe936a4ffe3752

SHA1
1f3c862a7aa518fb599713f1d6e1ee2859cd5da6

SHA256
4860aa3afa245ef29a0c50c396bb4017a2d86dc740119ee7804870cdb53e98b4

SHA512
fb6ee09875d27c83907d138135da93c498f14d357963c25cf7ce0b523530b02ff9db1e1d774c765808381a6f6e1ccfdd5be0765226a52fa0b51c96443fd2ed3d

Download Submit
C:\Windows\System\pKuFsds.exe

Filesize
3.0MB

MD5
2979b1ca1aae5e24fd9ea75a99738d9b

SHA1
de55c4df94b801b8330da9b5a74e47f7f1a3cda8

SHA256
81c9e4402d8ad4fa19ba548d7922dda1858ff125e79eb8941c121c1392d590d3

SHA512
5cc4cbe5b81688fa60d6201972c6373a2c980748ca41ff245feeaaa3225f4817e5511e5e2a33cee93f896d98a263a6df9d5dd58dc18a7f4d91f1c056ff97f189

Download Submit
C:\Windows\System\pVdAfHK.exe

Filesize
3.0MB

MD5
5cdbc2da8311ee2da12bd992cba9729f

SHA1
33c982e78ab99ee92a06a9d9f2c04a043b76af93

SHA256
bfd13f35231a5adebaf07553a3fbecad53ac4f74c5244ff96b2f5e48bbb05999

SHA512
308833f6ab7490225d575b3d934ced0218531c0f99c9ac718c7f4c49cef5606c57a0edc4bff7e0faff43aed0dbba76bbfb9789c2c62e6bdc4aaab9855b953ed7

Download Submit
C:\Windows\System\qoGWmYH.exe

Filesize
3.0MB

MD5
3d4eab18718a5b148bf6bb40028ccfe7

SHA1
ae5f96e5ef86cf425363ac0c991d9cbe5c87dd17

SHA256
cbba3ad0442baf489f16a3ab0cc317e25e959ff8f0b28acfd6c43fe1e71d624c

SHA512
c008266f661a308a219a4e69cea6c7f3d8d80d82ba9582a7673b766d4cc6810d94fb1c5b6137c03d6dce085155ee2e26a976db04e4158295f47fe5f52f75c9d7

Download Submit
C:\Windows\System\qohwkLc.exe

Filesize
3.0MB

MD5
45bbf2493616181f50f4b002c7d83e6c

SHA1
b7ea597b3d03ac755e9750c27950bf17eb85db73

SHA256
7faa246916b304bddde66aa8cf16906401840b75364b2032555de8e18d831f51

SHA512
7b968832a2e67e7b5b858e3313f0c28c35b6c472f1579e32d235db056839ed5ce1712c45f6f922be93be16a6df9fe6790a969e3aa693b1288117bc22b18836a2

Download Submit
C:\Windows\System\soKRvpV.exe

Filesize
3.0MB

MD5
5027989d3a25b5ed0337db3eb77f58f4

SHA1
3de7c02936478f9ec908bac509a22d7c54605f4a

SHA256
b0dd4b75b4c30fbadd3d023cbdbe21fb24d7bf81dab5c5447283cfcbadb9a8d8

SHA512
b5823203c2ba5df4d0bf3b6418cd1f15b8b8c7579523037552de87643fa483a895b6bb797a58169de38ef0f71f4c261dc156a88588347dc310733e62552ff311

Download Submit
C:\Windows\System\twMVFDd.exe

Filesize
3.0MB

MD5
c141b86934c11bc6188a84e703818a8f

SHA1
c744b080495f5ff49ef1b64c695837493448e063

SHA256
9ebcbe0bc4a92e2515ba5ad8c8f53013f0ff1ec375ca6214f97a2f6c6d927044

SHA512
f70479ecb51d5a2e74d731543fe618f8549d6cd0619830cf63ee1bd6013e74f7a0d19f3aea77c99d6839ad87a63345b0d3974329f42f3bc68e28672ce484cd63

Download Submit
C:\Windows\System\tweYpLa.exe

Filesize
3.0MB

MD5
a2624f1e3b6ae13a77beb7e2954b5d2b

SHA1
92f92db2409434102e545d14082c8882cd37ac34

SHA256
3205d0229b572f9a6cd5a2c9772385e36392b6a623e069abc359b046f62a3a7b

SHA512
2c47bd60851075ff1df3d710623f8de2ff17164c1ca48cda26542e38ecb43224688ba4bc63d8a3249a9e6cd083fa2bf69dc1e96f3d810d2e7be58b8e171d0676

Download Submit
C:\Windows\System\uUOxDxX.exe

Filesize
3.0MB

MD5
ebdeeeab3ee412d378ca7125d8dad5e3

SHA1
c675c79f95a98a556016c38982c284ef32de3419

SHA256
6bd2a4c63ad26f328577d72b4d07a4c7a5dd6063e8e98bda01895fb0f46b3fbb

SHA512
4d21e40c12f0b245b4c035e6e2b4fee2b7c741202dffc364f2d4f6d395476cd8401137c6d14cad12abf17c368fbe2b9d724395a5bed8d1205e9682278103e76b

Download Submit
C:\Windows\System\utwVKtX.exe

Filesize
3.0MB

MD5
bdfc7bcc1ea24b5a5690683f64fdb509

SHA1
da14f0feddb948b314f7f7b0e548d044902d9847

SHA256
554f0ae76148525fbd669b3e193bf02f5e8d283a1fe4329142e37e6182032781

SHA512
cf3bda8254964b931c6e31dceba1ffa48346e9de1b23a1cccd9a4ea1fe129da98a6d88747a0f4f064e2f585d7bd3416d8860380372d0d02d40de801a859eb7ab

Download Submit
C:\Windows\System\yEWSibe.exe

Filesize
3.0MB

MD5
29b9f4a436f067a13102396d4d3749e2

SHA1
0f5f1078e9cf47de9768afb7f5e7319d497e5744

SHA256
e86c822c4c50ba597151ba8de3f3388e055069cbcb34a9108e46d0e11fbfcc35

SHA512
6ea5fdfe6424b238aabf2c3ecc047e1c6c42c19d5e6d5f63749ce6e22e44d322e3c8b3493a16fc8ba1ebceeace537e940b74d9a168398df6d721503bad929497

Download Submit
memory/528-1-0x000001ECF0DF0000-0x000001ECF0E00000-memory.dmp

Filesize
64KB

Download
memory/528-0-0x00007FF64B580000-0x00007FF64B976000-memory.dmp

Filesize
4.0MB

Download
memory/624-5146-0x00007FF75C7B0000-0x00007FF75CBA6000-memory.dmp

Filesize
4.0MB

Download
memory/624-24-0x00007FF75C7B0000-0x00007FF75CBA6000-memory.dmp

Filesize
4.0MB

Download
memory/688-162-0x00007FF619BE0000-0x00007FF619FD6000-memory.dmp

Filesize
4.0MB

Download
memory/2164-2463-0x00007FF746CE0000-0x00007FF7470D6000-memory.dmp

Filesize
4.0MB

Download
memory/2164-32-0x00007FF746CE0000-0x00007FF7470D6000-memory.dmp

Filesize
4.0MB

Download
memory/2524-17-0x00007FF7724E0000-0x00007FF7728D6000-memory.dmp

Filesize
4.0MB

Download
memory/3008-3565-0x00007FFAD2F93000-0x00007FFAD2F95000-memory.dmp

Filesize
8KB

Download
memory/3008-235-0x0000026CF96F0000-0x0000026CF9E96000-memory.dmp

Filesize
7.6MB

Download
memory/3008-21-0x0000026CF8760000-0x0000026CF8770000-memory.dmp

Filesize
64KB

Download
memory/3008-80-0x0000026CF8730000-0x0000026CF8752000-memory.dmp

Filesize
136KB

Download
memory/3008-33-0x00007FFAD2F93000-0x00007FFAD2F95000-memory.dmp

Filesize
8KB

Download
memory/3008-20-0x0000026CF8760000-0x0000026CF8770000-memory.dmp

Filesize
64KB

Download
memory/3008-2968-0x0000026CF8760000-0x0000026CF8770000-memory.dmp

Filesize
64KB

Download
memory/3008-2969-0x0000026CF8760000-0x0000026CF8770000-memory.dmp

Filesize
64KB

Download
memory/3164-165-0x00007FF645100000-0x00007FF6454F6000-memory.dmp

Filesize
4.0MB

Download
memory/3404-169-0x00007FF790380000-0x00007FF790776000-memory.dmp

Filesize
4.0MB

Download
memory/3460-61-0x00007FF71E160000-0x00007FF71E556000-memory.dmp

Filesize
4.0MB

Download
memory/3560-48-0x00007FF611B70000-0x00007FF611F66000-memory.dmp

Filesize
4.0MB

Download
memory/3680-83-0x00007FF6B9860000-0x00007FF6B9C56000-memory.dmp

Filesize
4.0MB

Download
memory/3680-2983-0x00007FF6B9860000-0x00007FF6B9C56000-memory.dmp

Filesize
4.0MB

Download
memory/3684-5222-0x00007FF70ACC0000-0x00007FF70B0B6000-memory.dmp

Filesize
4.0MB

Download
memory/3684-173-0x00007FF70ACC0000-0x00007FF70B0B6000-memory.dmp

Filesize
4.0MB

Download
memory/3908-70-0x00007FF785370000-0x00007FF785766000-memory.dmp

Filesize
4.0MB

Download
memory/3968-57-0x00007FF63E7A0000-0x00007FF63EB96000-memory.dmp

Filesize
4.0MB

Download
memory/4076-146-0x00007FF7F38B0000-0x00007FF7F3CA6000-memory.dmp

Filesize
4.0MB

Download
memory/4076-2988-0x00007FF7F38B0000-0x00007FF7F3CA6000-memory.dmp

Filesize
4.0MB

Download
memory/4348-170-0x00007FF614D30000-0x00007FF615126000-memory.dmp

Filesize
4.0MB

Download
memory/4384-167-0x00007FF674710000-0x00007FF674B06000-memory.dmp

Filesize
4.0MB

Download
memory/4400-5206-0x00007FF667900000-0x00007FF667CF6000-memory.dmp

Filesize
4.0MB

Download
memory/4400-174-0x00007FF667900000-0x00007FF667CF6000-memory.dmp

Filesize
4.0MB

Download
memory/4876-168-0x00007FF7B51C0000-0x00007FF7B55B6000-memory.dmp

Filesize
4.0MB

Download
memory/4896-172-0x00007FF66F370000-0x00007FF66F766000-memory.dmp

Filesize
4.0MB

Download
memory/5160-128-0x00007FF719950000-0x00007FF719D46000-memory.dmp

Filesize
4.0MB

Download
memory/5160-2986-0x00007FF719950000-0x00007FF719D46000-memory.dmp

Filesize
4.0MB

Download
memory/5160-5205-0x00007FF719950000-0x00007FF719D46000-memory.dmp

Filesize
4.0MB

Download
memory/5388-171-0x00007FF75FCC0000-0x00007FF7600B6000-memory.dmp

Filesize
4.0MB

Download
memory/5564-91-0x00007FF699570000-0x00007FF699966000-memory.dmp

Filesize
4.0MB

Download
memory/6024-153-0x00007FF723600000-0x00007FF7239F6000-memory.dmp

Filesize
4.0MB

Download
memory/6108-5207-0x00007FF726FF0000-0x00007FF7273E6000-memory.dmp

Filesize
4.0MB

Download
memory/6108-166-0x00007FF726FF0000-0x00007FF7273E6000-memory.dmp

Filesize
4.0MB

Download
memory/6112-152-0x00007FF6E5230000-0x00007FF6E5626000-memory.dmp

Filesize
4.0MB

Download