xmrig | 6a95b6dca2e94e565466a4c45ab43c7d08f93b7d86b096c0160f5c50f064aaf6

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
03-06-2024 00:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

914539025dc43d076db91c4347629700_NeikiAnalytics.exe
Size

1.8MB
MD5

914539025dc43d076db91c4347629700
SHA1

943c50ccdbd909cda22f4b6ac38b178e01a0494d
SHA256

6a95b6dca2e94e565466a4c45ab43c7d08f93b7d86b096c0160f5c50f064aaf6
SHA512

bd393cf4367c80c6b4851d8320b395af7bdca3ae04652eecedfef0b29305c92763bb7c47292240070567725479ca796528920cec51e6d8bf078755ae95ebd997
SSDEEP

24576:zv3/fTLF671TilQFG4P5PMkibTJH+2Q/ynKeWYlZ3pBjqlx7TovQmVV4dThen9zT:Lz071uv4BPMkibTIA5lCx7kvRWa4pUF

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 41 IoCs

miner

resource	yara_rule
behavioral2/memory/1688-14-0x00007FF79A0E0000-0x00007FF79A4D2000-memory.dmp	xmrig
behavioral2/memory/2304-77-0x00007FF65F430000-0x00007FF65F822000-memory.dmp	xmrig
behavioral2/memory/1588-150-0x00007FF7E8CA0000-0x00007FF7E9092000-memory.dmp	xmrig
behavioral2/memory/1804-169-0x00007FF767FC0000-0x00007FF7683B2000-memory.dmp	xmrig
behavioral2/memory/3812-163-0x00007FF737AA0000-0x00007FF737E92000-memory.dmp	xmrig
behavioral2/memory/1408-157-0x00007FF777060000-0x00007FF777452000-memory.dmp	xmrig
behavioral2/memory/2344-151-0x00007FF7A3190000-0x00007FF7A3582000-memory.dmp	xmrig
behavioral2/memory/5008-87-0x00007FF6FDA70000-0x00007FF6FDE62000-memory.dmp	xmrig
behavioral2/memory/3656-83-0x00007FF7F90A0000-0x00007FF7F9492000-memory.dmp	xmrig
behavioral2/memory/1416-63-0x00007FF7E5290000-0x00007FF7E5682000-memory.dmp	xmrig
behavioral2/memory/1904-59-0x00007FF75ABB0000-0x00007FF75AFA2000-memory.dmp	xmrig
behavioral2/memory/2400-57-0x00007FF7E0740000-0x00007FF7E0B32000-memory.dmp	xmrig
behavioral2/memory/4168-1320-0x00007FF72A170000-0x00007FF72A562000-memory.dmp	xmrig
behavioral2/memory/3436-1344-0x00007FF7B0F50000-0x00007FF7B1342000-memory.dmp	xmrig
behavioral2/memory/640-2156-0x00007FF7509C0000-0x00007FF750DB2000-memory.dmp	xmrig
behavioral2/memory/2784-2161-0x00007FF6502F0000-0x00007FF6506E2000-memory.dmp	xmrig
behavioral2/memory/4644-4046-0x00007FF7B3840000-0x00007FF7B3C32000-memory.dmp	xmrig
behavioral2/memory/1688-4138-0x00007FF79A0E0000-0x00007FF79A4D2000-memory.dmp	xmrig
behavioral2/memory/4168-4146-0x00007FF72A170000-0x00007FF72A562000-memory.dmp	xmrig
behavioral2/memory/556-4154-0x00007FF768DB0000-0x00007FF7691A2000-memory.dmp	xmrig
behavioral2/memory/3436-4157-0x00007FF7B0F50000-0x00007FF7B1342000-memory.dmp	xmrig
behavioral2/memory/2304-4161-0x00007FF65F430000-0x00007FF65F822000-memory.dmp	xmrig
behavioral2/memory/640-4164-0x00007FF7509C0000-0x00007FF750DB2000-memory.dmp	xmrig
behavioral2/memory/1904-4172-0x00007FF75ABB0000-0x00007FF75AFA2000-memory.dmp	xmrig
behavioral2/memory/2400-4170-0x00007FF7E0740000-0x00007FF7E0B32000-memory.dmp	xmrig
behavioral2/memory/1416-4168-0x00007FF7E5290000-0x00007FF7E5682000-memory.dmp	xmrig
behavioral2/memory/3364-4178-0x00007FF71A340000-0x00007FF71A732000-memory.dmp	xmrig
behavioral2/memory/3656-4192-0x00007FF7F90A0000-0x00007FF7F9492000-memory.dmp	xmrig
behavioral2/memory/2876-4198-0x00007FF7EF640000-0x00007FF7EFA32000-memory.dmp	xmrig
behavioral2/memory/4064-4201-0x00007FF64DD50000-0x00007FF64E142000-memory.dmp	xmrig
behavioral2/memory/2112-4191-0x00007FF6B2A10000-0x00007FF6B2E02000-memory.dmp	xmrig
behavioral2/memory/2784-4189-0x00007FF6502F0000-0x00007FF6506E2000-memory.dmp	xmrig
behavioral2/memory/1260-4185-0x00007FF7A8150000-0x00007FF7A8542000-memory.dmp	xmrig
behavioral2/memory/1668-4181-0x00007FF639630000-0x00007FF639A22000-memory.dmp	xmrig
behavioral2/memory/5008-4187-0x00007FF6FDA70000-0x00007FF6FDE62000-memory.dmp	xmrig
behavioral2/memory/3812-4232-0x00007FF737AA0000-0x00007FF737E92000-memory.dmp	xmrig
behavioral2/memory/1588-4210-0x00007FF7E8CA0000-0x00007FF7E9092000-memory.dmp	xmrig
behavioral2/memory/2344-4235-0x00007FF7A3190000-0x00007FF7A3582000-memory.dmp	xmrig
behavioral2/memory/4644-4234-0x00007FF7B3840000-0x00007FF7B3C32000-memory.dmp	xmrig
behavioral2/memory/1804-4230-0x00007FF767FC0000-0x00007FF7683B2000-memory.dmp	xmrig
behavioral2/memory/2752-4847-0x00007FF6EFEC0000-0x00007FF6F02B2000-memory.dmp	xmrig

Blocklisted process makes network request 2 IoCs

flow	pid	Process
7	5112	powershell.exe
9	5112	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
5112	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
1688	ERkoWgn.exe
3436	MNDJtzU.exe
4168	JzaqRyH.exe
556	IMjOXny.exe
640	UkvtLkG.exe
2304	goObOEJ.exe
2400	sgbASyP.exe
1904	ETRUGYo.exe
1416	DjBaclT.exe
2752	hnXVoOk.exe
3656	hKGIaeg.exe
2784	dSceqhH.exe
5008	vCYysPO.exe
1260	iyNDxsy.exe
1668	bcHKkPZ.exe
3364	PNtGGAt.exe
2112	yobAJzi.exe
2876	gwascjR.exe
4064	RSGPUdQ.exe
1588	ALtSgIq.exe
2344	aElDmWo.exe
4644	mbeJEAs.exe
3812	RtOPNuW.exe
1804	IphyGIA.exe
4884	SNlywZM.exe
1080	hVPQTRh.exe
2924	dHCDGZp.exe
696	KSigKNY.exe
2644	xTHfAxe.exe
3824	THUboKS.exe
2368	HihnRDB.exe
1712	jtlhHQe.exe
3172	WvcFzWn.exe
1528	KxlxTXK.exe
1720	vlLLVna.exe
3508	MpjxKEB.exe
4800	rDiWqmE.exe
2084	CldVmXn.exe
3924	mEPjSbc.exe
4552	IHjtEnm.exe
2828	QpmGylj.exe
5128	DatUSJO.exe
5160	FVELvzG.exe
5184	goKDybB.exe
5224	uXkuyYa.exe
5252	PTwKpoI.exe
5276	qKDSTdM.exe
5308	GiesaVn.exe
5332	FBhqQtF.exe
5368	LayNzJb.exe
5400	SCOlSFn.exe
5424	TnrnxGj.exe
5452	pSBuplx.exe
5480	aGREpXp.exe
5508	yekMXCW.exe
5536	BeshhVe.exe
5564	XFScubN.exe
5592	ThNppDV.exe
5620	kHWZuii.exe
5648	qDOcVfO.exe
5680	stFJLAx.exe
5708	SuoWmZv.exe
5748	kSycYpq.exe
5776	eokvrdQ.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1408-0-0x00007FF777060000-0x00007FF777452000-memory.dmp	upx
behavioral2/files/0x00070000000235fc-9.dat	upx
behavioral2/memory/1688-14-0x00007FF79A0E0000-0x00007FF79A4D2000-memory.dmp	upx
behavioral2/memory/4168-15-0x00007FF72A170000-0x00007FF72A562000-memory.dmp	upx
behavioral2/memory/3436-24-0x00007FF7B0F50000-0x00007FF7B1342000-memory.dmp	upx
behavioral2/files/0x00070000000235fe-35.dat	upx
behavioral2/files/0x00070000000235ff-43.dat	upx
behavioral2/files/0x0007000000023602-45.dat	upx
behavioral2/files/0x0007000000023604-65.dat	upx
behavioral2/files/0x0007000000023605-70.dat	upx
behavioral2/memory/2304-77-0x00007FF65F430000-0x00007FF65F822000-memory.dmp	upx
behavioral2/memory/1260-93-0x00007FF7A8150000-0x00007FF7A8542000-memory.dmp	upx
behavioral2/files/0x0007000000023608-100.dat	upx
behavioral2/files/0x000700000002360b-108.dat	upx
behavioral2/files/0x000700000002360d-120.dat	upx
behavioral2/files/0x000700000002360e-136.dat	upx
behavioral2/memory/1588-150-0x00007FF7E8CA0000-0x00007FF7E9092000-memory.dmp	upx
behavioral2/files/0x0007000000023613-160.dat	upx
behavioral2/files/0x0007000000023618-190.dat	upx
behavioral2/files/0x0007000000023619-195.dat	upx
behavioral2/files/0x0007000000023617-193.dat	upx
behavioral2/files/0x0008000000023610-188.dat	upx
behavioral2/files/0x0007000000023616-183.dat	upx
behavioral2/files/0x0007000000023614-175.dat	upx
behavioral2/files/0x0007000000023615-172.dat	upx
behavioral2/memory/1804-169-0x00007FF767FC0000-0x00007FF7683B2000-memory.dmp	upx
behavioral2/files/0x0008000000023611-164.dat	upx
behavioral2/memory/3812-163-0x00007FF737AA0000-0x00007FF737E92000-memory.dmp	upx
behavioral2/files/0x0007000000023612-158.dat	upx
behavioral2/memory/1408-157-0x00007FF777060000-0x00007FF777452000-memory.dmp	upx
behavioral2/files/0x000700000002360f-152.dat	upx
behavioral2/memory/2344-151-0x00007FF7A3190000-0x00007FF7A3582000-memory.dmp	upx
behavioral2/memory/4644-139-0x00007FF7B3840000-0x00007FF7B3C32000-memory.dmp	upx
behavioral2/files/0x000700000002360c-134.dat	upx
behavioral2/memory/4064-123-0x00007FF64DD50000-0x00007FF64E142000-memory.dmp	upx
behavioral2/memory/2876-117-0x00007FF7EF640000-0x00007FF7EFA32000-memory.dmp	upx
behavioral2/files/0x000700000002360a-112.dat	upx
behavioral2/memory/2112-111-0x00007FF6B2A10000-0x00007FF6B2E02000-memory.dmp	upx
behavioral2/files/0x0007000000023609-106.dat	upx
behavioral2/memory/3364-105-0x00007FF71A340000-0x00007FF71A732000-memory.dmp	upx
behavioral2/memory/1668-99-0x00007FF639630000-0x00007FF639A22000-memory.dmp	upx
behavioral2/files/0x0007000000023607-94.dat	upx
behavioral2/files/0x0007000000023606-88.dat	upx
behavioral2/memory/5008-87-0x00007FF6FDA70000-0x00007FF6FDE62000-memory.dmp	upx
behavioral2/memory/3656-83-0x00007FF7F90A0000-0x00007FF7F9492000-memory.dmp	upx
behavioral2/files/0x00080000000235f8-79.dat	upx
behavioral2/memory/2784-74-0x00007FF6502F0000-0x00007FF6506E2000-memory.dmp	upx
behavioral2/memory/2752-68-0x00007FF6EFEC0000-0x00007FF6F02B2000-memory.dmp	upx
behavioral2/memory/1416-63-0x00007FF7E5290000-0x00007FF7E5682000-memory.dmp	upx
behavioral2/files/0x0007000000023603-62.dat	upx
behavioral2/memory/1904-59-0x00007FF75ABB0000-0x00007FF75AFA2000-memory.dmp	upx
behavioral2/memory/2400-57-0x00007FF7E0740000-0x00007FF7E0B32000-memory.dmp	upx
behavioral2/memory/640-52-0x00007FF7509C0000-0x00007FF750DB2000-memory.dmp	upx
behavioral2/files/0x0007000000023600-51.dat	upx
behavioral2/files/0x0007000000023601-40.dat	upx
behavioral2/memory/556-28-0x00007FF768DB0000-0x00007FF7691A2000-memory.dmp	upx
behavioral2/files/0x00070000000235fd-25.dat	upx
behavioral2/files/0x00070000000235fb-18.dat	upx
behavioral2/files/0x00090000000235f4-6.dat	upx
behavioral2/memory/4168-1320-0x00007FF72A170000-0x00007FF72A562000-memory.dmp	upx
behavioral2/memory/3436-1344-0x00007FF7B0F50000-0x00007FF7B1342000-memory.dmp	upx
behavioral2/memory/640-2156-0x00007FF7509C0000-0x00007FF750DB2000-memory.dmp	upx
behavioral2/memory/2784-2161-0x00007FF6502F0000-0x00007FF6506E2000-memory.dmp	upx
behavioral2/memory/4644-4046-0x00007FF7B3840000-0x00007FF7B3C32000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
7	raw.githubusercontent.com
6	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\RVQrcsk.exe	914539025dc43d076db91c4347629700_NeikiAnalytics.exe
File created	C:\Windows\System\zaQnrkG.exe	914539025dc43d076db91c4347629700_NeikiAnalytics.exe
File created	C:\Windows\System\YqAhpiE.exe	914539025dc43d076db91c4347629700_NeikiAnalytics.exe
File created	C:\Windows\System\GhHvdwp.exe	914539025dc43d076db91c4347629700_NeikiAnalytics.exe
File created	C:\Windows\System\xIYduWR.exe	914539025dc43d076db91c4347629700_NeikiAnalytics.exe
File created	C:\Windows\System\pirqlpM.exe	914539025dc43d076db91c4347629700_NeikiAnalytics.exe
File created	C:\Windows\System\cvgpXuR.exe	914539025dc43d076db91c4347629700_NeikiAnalytics.exe
File created	C:\Windows\System\KhSySgl.exe	914539025dc43d076db91c4347629700_NeikiAnalytics.exe
File created	C:\Windows\System\NnNfjQo.exe	914539025dc43d076db91c4347629700_NeikiAnalytics.exe
File created	C:\Windows\System\ShqMYWt.exe	914539025dc43d076db91c4347629700_NeikiAnalytics.exe
File created	C:\Windows\System\OePfgoG.exe	914539025dc43d076db91c4347629700_NeikiAnalytics.exe
File created	C:\Windows\System\sxtWXgZ.exe	914539025dc43d076db91c4347629700_NeikiAnalytics.exe
File created	C:\Windows\System\ujIIJfF.exe	914539025dc43d076db91c4347629700_NeikiAnalytics.exe
File created	C:\Windows\System\BgiULwQ.exe	914539025dc43d076db91c4347629700_NeikiAnalytics.exe
File created	C:\Windows\System\ACKsaMB.exe	914539025dc43d076db91c4347629700_NeikiAnalytics.exe
File created	C:\Windows\System\ApcuPpk.exe	914539025dc43d076db91c4347629700_NeikiAnalytics.exe
File created	C:\Windows\System\WldAYSr.exe	914539025dc43d076db91c4347629700_NeikiAnalytics.exe
File created	C:\Windows\System\QonEwQI.exe	914539025dc43d076db91c4347629700_NeikiAnalytics.exe
File created	C:\Windows\System\KvEKcfz.exe	914539025dc43d076db91c4347629700_NeikiAnalytics.exe
File created	C:\Windows\System\lnUeZHv.exe	914539025dc43d076db91c4347629700_NeikiAnalytics.exe
File created	C:\Windows\System\kAXCjAm.exe	914539025dc43d076db91c4347629700_NeikiAnalytics.exe
File created	C:\Windows\System\yZJhGaK.exe	914539025dc43d076db91c4347629700_NeikiAnalytics.exe
File created	C:\Windows\System\geakDGt.exe	914539025dc43d076db91c4347629700_NeikiAnalytics.exe
File created	C:\Windows\System\YDdvwFx.exe	914539025dc43d076db91c4347629700_NeikiAnalytics.exe
File created	C:\Windows\System\ESsMikx.exe	914539025dc43d076db91c4347629700_NeikiAnalytics.exe
File created	C:\Windows\System\vYPIaZu.exe	914539025dc43d076db91c4347629700_NeikiAnalytics.exe
File created	C:\Windows\System\ZZhucYI.exe	914539025dc43d076db91c4347629700_NeikiAnalytics.exe
File created	C:\Windows\System\qdohmhl.exe	914539025dc43d076db91c4347629700_NeikiAnalytics.exe
File created	C:\Windows\System\MvSZPLp.exe	914539025dc43d076db91c4347629700_NeikiAnalytics.exe
File created	C:\Windows\System\YEzfnxg.exe	914539025dc43d076db91c4347629700_NeikiAnalytics.exe
File created	C:\Windows\System\fuFHokk.exe	914539025dc43d076db91c4347629700_NeikiAnalytics.exe
File created	C:\Windows\System\atAugJE.exe	914539025dc43d076db91c4347629700_NeikiAnalytics.exe
File created	C:\Windows\System\IocNpVh.exe	914539025dc43d076db91c4347629700_NeikiAnalytics.exe
File created	C:\Windows\System\WwUzxMS.exe	914539025dc43d076db91c4347629700_NeikiAnalytics.exe
File created	C:\Windows\System\dvIewHz.exe	914539025dc43d076db91c4347629700_NeikiAnalytics.exe
File created	C:\Windows\System\HpDOdGY.exe	914539025dc43d076db91c4347629700_NeikiAnalytics.exe
File created	C:\Windows\System\IvqoQdY.exe	914539025dc43d076db91c4347629700_NeikiAnalytics.exe
File created	C:\Windows\System\ODoEUbf.exe	914539025dc43d076db91c4347629700_NeikiAnalytics.exe
File created	C:\Windows\System\CPuGLnJ.exe	914539025dc43d076db91c4347629700_NeikiAnalytics.exe
File created	C:\Windows\System\XupicxD.exe	914539025dc43d076db91c4347629700_NeikiAnalytics.exe
File created	C:\Windows\System\zPDvNqN.exe	914539025dc43d076db91c4347629700_NeikiAnalytics.exe
File created	C:\Windows\System\KdVPckE.exe	914539025dc43d076db91c4347629700_NeikiAnalytics.exe
File created	C:\Windows\System\SQhpNbJ.exe	914539025dc43d076db91c4347629700_NeikiAnalytics.exe
File created	C:\Windows\System\GsyVbiY.exe	914539025dc43d076db91c4347629700_NeikiAnalytics.exe
File created	C:\Windows\System\xakjcju.exe	914539025dc43d076db91c4347629700_NeikiAnalytics.exe
File created	C:\Windows\System\tBhAKnb.exe	914539025dc43d076db91c4347629700_NeikiAnalytics.exe
File created	C:\Windows\System\kqHmbxX.exe	914539025dc43d076db91c4347629700_NeikiAnalytics.exe
File created	C:\Windows\System\yITNTKg.exe	914539025dc43d076db91c4347629700_NeikiAnalytics.exe
File created	C:\Windows\System\xZPPfQn.exe	914539025dc43d076db91c4347629700_NeikiAnalytics.exe
File created	C:\Windows\System\AkUIsdl.exe	914539025dc43d076db91c4347629700_NeikiAnalytics.exe
File created	C:\Windows\System\QCisYZC.exe	914539025dc43d076db91c4347629700_NeikiAnalytics.exe
File created	C:\Windows\System\AiRaCCm.exe	914539025dc43d076db91c4347629700_NeikiAnalytics.exe
File created	C:\Windows\System\nANkVNA.exe	914539025dc43d076db91c4347629700_NeikiAnalytics.exe
File created	C:\Windows\System\CWFNnAu.exe	914539025dc43d076db91c4347629700_NeikiAnalytics.exe
File created	C:\Windows\System\jLsxEDT.exe	914539025dc43d076db91c4347629700_NeikiAnalytics.exe
File created	C:\Windows\System\IgEgCDO.exe	914539025dc43d076db91c4347629700_NeikiAnalytics.exe
File created	C:\Windows\System\kKAxirB.exe	914539025dc43d076db91c4347629700_NeikiAnalytics.exe
File created	C:\Windows\System\lgqQtwy.exe	914539025dc43d076db91c4347629700_NeikiAnalytics.exe
File created	C:\Windows\System\IQqVODU.exe	914539025dc43d076db91c4347629700_NeikiAnalytics.exe
File created	C:\Windows\System\JupkozA.exe	914539025dc43d076db91c4347629700_NeikiAnalytics.exe
File created	C:\Windows\System\XAYwGAW.exe	914539025dc43d076db91c4347629700_NeikiAnalytics.exe
File created	C:\Windows\System\zMvMJWv.exe	914539025dc43d076db91c4347629700_NeikiAnalytics.exe
File created	C:\Windows\System\jKoRYmO.exe	914539025dc43d076db91c4347629700_NeikiAnalytics.exe
File created	C:\Windows\System\hekEqbx.exe	914539025dc43d076db91c4347629700_NeikiAnalytics.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	wermgr.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	wermgr.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
5112	powershell.exe
5112	powershell.exe
5112	powershell.exe
5112	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	1408	914539025dc43d076db91c4347629700_NeikiAnalytics.exe
Token: SeLockMemoryPrivilege	1408	914539025dc43d076db91c4347629700_NeikiAnalytics.exe
Token: SeDebugPrivilege	5112	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1408 wrote to memory of 5112	1408	914539025dc43d076db91c4347629700_NeikiAnalytics.exe	93
PID 1408 wrote to memory of 5112	1408	914539025dc43d076db91c4347629700_NeikiAnalytics.exe	93
PID 1408 wrote to memory of 1688	1408	914539025dc43d076db91c4347629700_NeikiAnalytics.exe	94
PID 1408 wrote to memory of 1688	1408	914539025dc43d076db91c4347629700_NeikiAnalytics.exe	94
PID 1408 wrote to memory of 3436	1408	914539025dc43d076db91c4347629700_NeikiAnalytics.exe	95
PID 1408 wrote to memory of 3436	1408	914539025dc43d076db91c4347629700_NeikiAnalytics.exe	95
PID 1408 wrote to memory of 4168	1408	914539025dc43d076db91c4347629700_NeikiAnalytics.exe	96
PID 1408 wrote to memory of 4168	1408	914539025dc43d076db91c4347629700_NeikiAnalytics.exe	96
PID 1408 wrote to memory of 556	1408	914539025dc43d076db91c4347629700_NeikiAnalytics.exe	97
PID 1408 wrote to memory of 556	1408	914539025dc43d076db91c4347629700_NeikiAnalytics.exe	97
PID 1408 wrote to memory of 640	1408	914539025dc43d076db91c4347629700_NeikiAnalytics.exe	98
PID 1408 wrote to memory of 640	1408	914539025dc43d076db91c4347629700_NeikiAnalytics.exe	98
PID 1408 wrote to memory of 2304	1408	914539025dc43d076db91c4347629700_NeikiAnalytics.exe	99
PID 1408 wrote to memory of 2304	1408	914539025dc43d076db91c4347629700_NeikiAnalytics.exe	99
PID 1408 wrote to memory of 2400	1408	914539025dc43d076db91c4347629700_NeikiAnalytics.exe	100
PID 1408 wrote to memory of 2400	1408	914539025dc43d076db91c4347629700_NeikiAnalytics.exe	100
PID 1408 wrote to memory of 1904	1408	914539025dc43d076db91c4347629700_NeikiAnalytics.exe	101
PID 1408 wrote to memory of 1904	1408	914539025dc43d076db91c4347629700_NeikiAnalytics.exe	101
PID 1408 wrote to memory of 1416	1408	914539025dc43d076db91c4347629700_NeikiAnalytics.exe	102
PID 1408 wrote to memory of 1416	1408	914539025dc43d076db91c4347629700_NeikiAnalytics.exe	102
PID 1408 wrote to memory of 2752	1408	914539025dc43d076db91c4347629700_NeikiAnalytics.exe	103
PID 1408 wrote to memory of 2752	1408	914539025dc43d076db91c4347629700_NeikiAnalytics.exe	103
PID 1408 wrote to memory of 2784	1408	914539025dc43d076db91c4347629700_NeikiAnalytics.exe	104
PID 1408 wrote to memory of 2784	1408	914539025dc43d076db91c4347629700_NeikiAnalytics.exe	104
PID 1408 wrote to memory of 3656	1408	914539025dc43d076db91c4347629700_NeikiAnalytics.exe	105
PID 1408 wrote to memory of 3656	1408	914539025dc43d076db91c4347629700_NeikiAnalytics.exe	105
PID 1408 wrote to memory of 5008	1408	914539025dc43d076db91c4347629700_NeikiAnalytics.exe	106
PID 1408 wrote to memory of 5008	1408	914539025dc43d076db91c4347629700_NeikiAnalytics.exe	106
PID 1408 wrote to memory of 1260	1408	914539025dc43d076db91c4347629700_NeikiAnalytics.exe	107
PID 1408 wrote to memory of 1260	1408	914539025dc43d076db91c4347629700_NeikiAnalytics.exe	107
PID 1408 wrote to memory of 1668	1408	914539025dc43d076db91c4347629700_NeikiAnalytics.exe	108
PID 1408 wrote to memory of 1668	1408	914539025dc43d076db91c4347629700_NeikiAnalytics.exe	108
PID 1408 wrote to memory of 3364	1408	914539025dc43d076db91c4347629700_NeikiAnalytics.exe	109
PID 1408 wrote to memory of 3364	1408	914539025dc43d076db91c4347629700_NeikiAnalytics.exe	109
PID 1408 wrote to memory of 2112	1408	914539025dc43d076db91c4347629700_NeikiAnalytics.exe	110
PID 1408 wrote to memory of 2112	1408	914539025dc43d076db91c4347629700_NeikiAnalytics.exe	110
PID 1408 wrote to memory of 2876	1408	914539025dc43d076db91c4347629700_NeikiAnalytics.exe	111
PID 1408 wrote to memory of 2876	1408	914539025dc43d076db91c4347629700_NeikiAnalytics.exe	111
PID 1408 wrote to memory of 4064	1408	914539025dc43d076db91c4347629700_NeikiAnalytics.exe	112
PID 1408 wrote to memory of 4064	1408	914539025dc43d076db91c4347629700_NeikiAnalytics.exe	112
PID 1408 wrote to memory of 1588	1408	914539025dc43d076db91c4347629700_NeikiAnalytics.exe	113
PID 1408 wrote to memory of 1588	1408	914539025dc43d076db91c4347629700_NeikiAnalytics.exe	113
PID 1408 wrote to memory of 2344	1408	914539025dc43d076db91c4347629700_NeikiAnalytics.exe	114
PID 1408 wrote to memory of 2344	1408	914539025dc43d076db91c4347629700_NeikiAnalytics.exe	114
PID 1408 wrote to memory of 4644	1408	914539025dc43d076db91c4347629700_NeikiAnalytics.exe	115
PID 1408 wrote to memory of 4644	1408	914539025dc43d076db91c4347629700_NeikiAnalytics.exe	115
PID 1408 wrote to memory of 3812	1408	914539025dc43d076db91c4347629700_NeikiAnalytics.exe	116
PID 1408 wrote to memory of 3812	1408	914539025dc43d076db91c4347629700_NeikiAnalytics.exe	116
PID 1408 wrote to memory of 1804	1408	914539025dc43d076db91c4347629700_NeikiAnalytics.exe	117
PID 1408 wrote to memory of 1804	1408	914539025dc43d076db91c4347629700_NeikiAnalytics.exe	117
PID 1408 wrote to memory of 4884	1408	914539025dc43d076db91c4347629700_NeikiAnalytics.exe	118
PID 1408 wrote to memory of 4884	1408	914539025dc43d076db91c4347629700_NeikiAnalytics.exe	118
PID 1408 wrote to memory of 1080	1408	914539025dc43d076db91c4347629700_NeikiAnalytics.exe	119
PID 1408 wrote to memory of 1080	1408	914539025dc43d076db91c4347629700_NeikiAnalytics.exe	119
PID 1408 wrote to memory of 2924	1408	914539025dc43d076db91c4347629700_NeikiAnalytics.exe	120
PID 1408 wrote to memory of 2924	1408	914539025dc43d076db91c4347629700_NeikiAnalytics.exe	120
PID 1408 wrote to memory of 696	1408	914539025dc43d076db91c4347629700_NeikiAnalytics.exe	121
PID 1408 wrote to memory of 696	1408	914539025dc43d076db91c4347629700_NeikiAnalytics.exe	121
PID 1408 wrote to memory of 2644	1408	914539025dc43d076db91c4347629700_NeikiAnalytics.exe	122
PID 1408 wrote to memory of 2644	1408	914539025dc43d076db91c4347629700_NeikiAnalytics.exe	122
PID 1408 wrote to memory of 3824	1408	914539025dc43d076db91c4347629700_NeikiAnalytics.exe	123
PID 1408 wrote to memory of 3824	1408	914539025dc43d076db91c4347629700_NeikiAnalytics.exe	123
PID 1408 wrote to memory of 2368	1408	914539025dc43d076db91c4347629700_NeikiAnalytics.exe	124
PID 1408 wrote to memory of 2368	1408	914539025dc43d076db91c4347629700_NeikiAnalytics.exe	124

C:\Users\Admin\AppData\Local\Temp\914539025dc43d076db91c4347629700_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\914539025dc43d076db91c4347629700_NeikiAnalytics.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1408
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5112
- - C:\Windows\system32\wermgr.exe
    "C:\Windows\system32\wermgr.exe" "-outproc" "0" "5112" "2960" "2892" "2964" "0" "0" "2968" "0" "0" "0" "0" "0"
    3⤵
    - Checks processor information in registry
    - Enumerates system info in registry
    PID:2728
- C:\Windows\System\ERkoWgn.exe
  C:\Windows\System\ERkoWgn.exe
  2⤵
  - Executes dropped EXE
  PID:1688
- C:\Windows\System\MNDJtzU.exe
  C:\Windows\System\MNDJtzU.exe
  2⤵
  - Executes dropped EXE
  PID:3436
- C:\Windows\System\JzaqRyH.exe
  C:\Windows\System\JzaqRyH.exe
  2⤵
  - Executes dropped EXE
  PID:4168
- C:\Windows\System\IMjOXny.exe
  C:\Windows\System\IMjOXny.exe
  2⤵
  - Executes dropped EXE
  PID:556
- C:\Windows\System\UkvtLkG.exe
  C:\Windows\System\UkvtLkG.exe
  2⤵
  - Executes dropped EXE
  PID:640
- C:\Windows\System\goObOEJ.exe
  C:\Windows\System\goObOEJ.exe
  2⤵
  - Executes dropped EXE
  PID:2304
- C:\Windows\System\sgbASyP.exe
  C:\Windows\System\sgbASyP.exe
  2⤵
  - Executes dropped EXE
  PID:2400
- C:\Windows\System\ETRUGYo.exe
  C:\Windows\System\ETRUGYo.exe
  2⤵
  - Executes dropped EXE
  PID:1904
- C:\Windows\System\DjBaclT.exe
  C:\Windows\System\DjBaclT.exe
  2⤵
  - Executes dropped EXE
  PID:1416
- C:\Windows\System\hnXVoOk.exe
  C:\Windows\System\hnXVoOk.exe
  2⤵
  - Executes dropped EXE
  PID:2752
- C:\Windows\System\dSceqhH.exe
  C:\Windows\System\dSceqhH.exe
  2⤵
  - Executes dropped EXE
  PID:2784
- C:\Windows\System\hKGIaeg.exe
  C:\Windows\System\hKGIaeg.exe
  2⤵
  - Executes dropped EXE
  PID:3656
- C:\Windows\System\vCYysPO.exe
  C:\Windows\System\vCYysPO.exe
  2⤵
  - Executes dropped EXE
  PID:5008
- C:\Windows\System\iyNDxsy.exe
  C:\Windows\System\iyNDxsy.exe
  2⤵
  - Executes dropped EXE
  PID:1260
- C:\Windows\System\bcHKkPZ.exe
  C:\Windows\System\bcHKkPZ.exe
  2⤵
  - Executes dropped EXE
  PID:1668
- C:\Windows\System\PNtGGAt.exe
  C:\Windows\System\PNtGGAt.exe
  2⤵
  - Executes dropped EXE
  PID:3364
- C:\Windows\System\yobAJzi.exe
  C:\Windows\System\yobAJzi.exe
  2⤵
  - Executes dropped EXE
  PID:2112
- C:\Windows\System\gwascjR.exe
  C:\Windows\System\gwascjR.exe
  2⤵
  - Executes dropped EXE
  PID:2876
- C:\Windows\System\RSGPUdQ.exe
  C:\Windows\System\RSGPUdQ.exe
  2⤵
  - Executes dropped EXE
  PID:4064
- C:\Windows\System\ALtSgIq.exe
  C:\Windows\System\ALtSgIq.exe
  2⤵
  - Executes dropped EXE
  PID:1588
- C:\Windows\System\aElDmWo.exe
  C:\Windows\System\aElDmWo.exe
  2⤵
  - Executes dropped EXE
  PID:2344
- C:\Windows\System\mbeJEAs.exe
  C:\Windows\System\mbeJEAs.exe
  2⤵
  - Executes dropped EXE
  PID:4644
- C:\Windows\System\RtOPNuW.exe
  C:\Windows\System\RtOPNuW.exe
  2⤵
  - Executes dropped EXE
  PID:3812
- C:\Windows\System\IphyGIA.exe
  C:\Windows\System\IphyGIA.exe
  2⤵
  - Executes dropped EXE
  PID:1804
- C:\Windows\System\SNlywZM.exe
  C:\Windows\System\SNlywZM.exe
  2⤵
  - Executes dropped EXE
  PID:4884
- C:\Windows\System\hVPQTRh.exe
  C:\Windows\System\hVPQTRh.exe
  2⤵
  - Executes dropped EXE
  PID:1080
- C:\Windows\System\dHCDGZp.exe
  C:\Windows\System\dHCDGZp.exe
  2⤵
  - Executes dropped EXE
  PID:2924
- C:\Windows\System\KSigKNY.exe
  C:\Windows\System\KSigKNY.exe
  2⤵
  - Executes dropped EXE
  PID:696
- C:\Windows\System\xTHfAxe.exe
  C:\Windows\System\xTHfAxe.exe
  2⤵
  - Executes dropped EXE
  PID:2644
- C:\Windows\System\THUboKS.exe
  C:\Windows\System\THUboKS.exe
  2⤵
  - Executes dropped EXE
  PID:3824
- C:\Windows\System\HihnRDB.exe
  C:\Windows\System\HihnRDB.exe
  2⤵
  - Executes dropped EXE
  PID:2368
- C:\Windows\System\jtlhHQe.exe
  C:\Windows\System\jtlhHQe.exe
  2⤵
  - Executes dropped EXE
  PID:1712
- C:\Windows\System\WvcFzWn.exe
  C:\Windows\System\WvcFzWn.exe
  2⤵
  - Executes dropped EXE
  PID:3172
- C:\Windows\System\KxlxTXK.exe
  C:\Windows\System\KxlxTXK.exe
  2⤵
  - Executes dropped EXE
  PID:1528
- C:\Windows\System\vlLLVna.exe
  C:\Windows\System\vlLLVna.exe
  2⤵
  - Executes dropped EXE
  PID:1720
- C:\Windows\System\MpjxKEB.exe
  C:\Windows\System\MpjxKEB.exe
  2⤵
  - Executes dropped EXE
  PID:3508
- C:\Windows\System\rDiWqmE.exe
  C:\Windows\System\rDiWqmE.exe
  2⤵
  - Executes dropped EXE
  PID:4800
- C:\Windows\System\CldVmXn.exe
  C:\Windows\System\CldVmXn.exe
  2⤵
  - Executes dropped EXE
  PID:2084
- C:\Windows\System\mEPjSbc.exe
  C:\Windows\System\mEPjSbc.exe
  2⤵
  - Executes dropped EXE
  PID:3924
- C:\Windows\System\IHjtEnm.exe
  C:\Windows\System\IHjtEnm.exe
  2⤵
  - Executes dropped EXE
  PID:4552
- C:\Windows\System\QpmGylj.exe
  C:\Windows\System\QpmGylj.exe
  2⤵
  - Executes dropped EXE
  PID:2828
- C:\Windows\System\DatUSJO.exe
  C:\Windows\System\DatUSJO.exe
  2⤵
  - Executes dropped EXE
  PID:5128
- C:\Windows\System\FVELvzG.exe
  C:\Windows\System\FVELvzG.exe
  2⤵
  - Executes dropped EXE
  PID:5160
- C:\Windows\System\goKDybB.exe
  C:\Windows\System\goKDybB.exe
  2⤵
  - Executes dropped EXE
  PID:5184
- C:\Windows\System\uXkuyYa.exe
  C:\Windows\System\uXkuyYa.exe
  2⤵
  - Executes dropped EXE
  PID:5224
- C:\Windows\System\PTwKpoI.exe
  C:\Windows\System\PTwKpoI.exe
  2⤵
  - Executes dropped EXE
  PID:5252
- C:\Windows\System\qKDSTdM.exe
  C:\Windows\System\qKDSTdM.exe
  2⤵
  - Executes dropped EXE
  PID:5276
- C:\Windows\System\GiesaVn.exe
  C:\Windows\System\GiesaVn.exe
  2⤵
  - Executes dropped EXE
  PID:5308
- C:\Windows\System\FBhqQtF.exe
  C:\Windows\System\FBhqQtF.exe
  2⤵
  - Executes dropped EXE
  PID:5332
- C:\Windows\System\LayNzJb.exe
  C:\Windows\System\LayNzJb.exe
  2⤵
  - Executes dropped EXE
  PID:5368
- C:\Windows\System\SCOlSFn.exe
  C:\Windows\System\SCOlSFn.exe
  2⤵
  - Executes dropped EXE
  PID:5400
- C:\Windows\System\TnrnxGj.exe
  C:\Windows\System\TnrnxGj.exe
  2⤵
  - Executes dropped EXE
  PID:5424
- C:\Windows\System\pSBuplx.exe
  C:\Windows\System\pSBuplx.exe
  2⤵
  - Executes dropped EXE
  PID:5452
- C:\Windows\System\aGREpXp.exe
  C:\Windows\System\aGREpXp.exe
  2⤵
  - Executes dropped EXE
  PID:5480
- C:\Windows\System\yekMXCW.exe
  C:\Windows\System\yekMXCW.exe
  2⤵
  - Executes dropped EXE
  PID:5508
- C:\Windows\System\BeshhVe.exe
  C:\Windows\System\BeshhVe.exe
  2⤵
  - Executes dropped EXE
  PID:5536
- C:\Windows\System\XFScubN.exe
  C:\Windows\System\XFScubN.exe
  2⤵
  - Executes dropped EXE
  PID:5564
- C:\Windows\System\ThNppDV.exe
  C:\Windows\System\ThNppDV.exe
  2⤵
  - Executes dropped EXE
  PID:5592
- C:\Windows\System\kHWZuii.exe
  C:\Windows\System\kHWZuii.exe
  2⤵
  - Executes dropped EXE
  PID:5620
- C:\Windows\System\qDOcVfO.exe
  C:\Windows\System\qDOcVfO.exe
  2⤵
  - Executes dropped EXE
  PID:5648
- C:\Windows\System\stFJLAx.exe
  C:\Windows\System\stFJLAx.exe
  2⤵
  - Executes dropped EXE
  PID:5680
- C:\Windows\System\SuoWmZv.exe
  C:\Windows\System\SuoWmZv.exe
  2⤵
  - Executes dropped EXE
  PID:5708
- C:\Windows\System\kSycYpq.exe
  C:\Windows\System\kSycYpq.exe
  2⤵
  - Executes dropped EXE
  PID:5748
- C:\Windows\System\eokvrdQ.exe
  C:\Windows\System\eokvrdQ.exe
  2⤵
  - Executes dropped EXE
  PID:5776
- C:\Windows\System\krbIYXQ.exe
  C:\Windows\System\krbIYXQ.exe
  2⤵
  PID:5808
- C:\Windows\System\bIgcwgU.exe
  C:\Windows\System\bIgcwgU.exe
  2⤵
  PID:5832
- C:\Windows\System\FmpzMiC.exe
  C:\Windows\System\FmpzMiC.exe
  2⤵
  PID:5856
- C:\Windows\System\hnKHMwR.exe
  C:\Windows\System\hnKHMwR.exe
  2⤵
  PID:5888
- C:\Windows\System\gkxVijR.exe
  C:\Windows\System\gkxVijR.exe
  2⤵
  PID:5916
- C:\Windows\System\MfqelVn.exe
  C:\Windows\System\MfqelVn.exe
  2⤵
  PID:5944
- C:\Windows\System\HkiqRBO.exe
  C:\Windows\System\HkiqRBO.exe
  2⤵
  PID:5972
- C:\Windows\System\aUMxmWa.exe
  C:\Windows\System\aUMxmWa.exe
  2⤵
  PID:6000
- C:\Windows\System\WBgzxFF.exe
  C:\Windows\System\WBgzxFF.exe
  2⤵
  PID:6032
- C:\Windows\System\WRRdMsW.exe
  C:\Windows\System\WRRdMsW.exe
  2⤵
  PID:6060
- C:\Windows\System\fVshdXk.exe
  C:\Windows\System\fVshdXk.exe
  2⤵
  PID:6084
- C:\Windows\System\UvADoOr.exe
  C:\Windows\System\UvADoOr.exe
  2⤵
  PID:6116
- C:\Windows\System\vOOKerF.exe
  C:\Windows\System\vOOKerF.exe
  2⤵
  PID:3880
- C:\Windows\System\xDDyRSI.exe
  C:\Windows\System\xDDyRSI.exe
  2⤵
  PID:2100
- C:\Windows\System\bTXyzrg.exe
  C:\Windows\System\bTXyzrg.exe
  2⤵
  PID:3928
- C:\Windows\System\FHqHEiy.exe
  C:\Windows\System\FHqHEiy.exe
  2⤵
  PID:1740
- C:\Windows\System\QdjNcMH.exe
  C:\Windows\System\QdjNcMH.exe
  2⤵
  PID:5148
- C:\Windows\System\TTFsSAi.exe
  C:\Windows\System\TTFsSAi.exe
  2⤵
  PID:5216
- C:\Windows\System\LqeyzKh.exe
  C:\Windows\System\LqeyzKh.exe
  2⤵
  PID:5296
- C:\Windows\System\AuutfNc.exe
  C:\Windows\System\AuutfNc.exe
  2⤵
  PID:5356
- C:\Windows\System\tLdKGUq.exe
  C:\Windows\System\tLdKGUq.exe
  2⤵
  PID:5416
- C:\Windows\System\kYOELPN.exe
  C:\Windows\System\kYOELPN.exe
  2⤵
  PID:5472
- C:\Windows\System\UCKddNF.exe
  C:\Windows\System\UCKddNF.exe
  2⤵
  PID:5548
- C:\Windows\System\apWoddb.exe
  C:\Windows\System\apWoddb.exe
  2⤵
  PID:5612
- C:\Windows\System\AyBYWOG.exe
  C:\Windows\System\AyBYWOG.exe
  2⤵
  PID:4696
- C:\Windows\System\kLwlfHZ.exe
  C:\Windows\System\kLwlfHZ.exe
  2⤵
  PID:5728
- C:\Windows\System\oSRMlHT.exe
  C:\Windows\System\oSRMlHT.exe
  2⤵
  PID:5800
- C:\Windows\System\kixsRBD.exe
  C:\Windows\System\kixsRBD.exe
  2⤵
  PID:5872
- C:\Windows\System\dmrYtlK.exe
  C:\Windows\System\dmrYtlK.exe
  2⤵
  PID:5932
- C:\Windows\System\phvSyEs.exe
  C:\Windows\System\phvSyEs.exe
  2⤵
  PID:5988
- C:\Windows\System\Bfxozde.exe
  C:\Windows\System\Bfxozde.exe
  2⤵
  PID:6052
- C:\Windows\System\jtYabtk.exe
  C:\Windows\System\jtYabtk.exe
  2⤵
  PID:6128
- C:\Windows\System\kANvtBs.exe
  C:\Windows\System\kANvtBs.exe
  2⤵
  PID:1360
- C:\Windows\System\EhZHmRa.exe
  C:\Windows\System\EhZHmRa.exe
  2⤵
  PID:3300
- C:\Windows\System\BYlLPPl.exe
  C:\Windows\System\BYlLPPl.exe
  2⤵
  PID:5272
- C:\Windows\System\ffcsJxi.exe
  C:\Windows\System\ffcsJxi.exe
  2⤵
  PID:5444
- C:\Windows\System\Hihyexc.exe
  C:\Windows\System\Hihyexc.exe
  2⤵
  PID:5580
- C:\Windows\System\cDauYEs.exe
  C:\Windows\System\cDauYEs.exe
  2⤵
  PID:5720
- C:\Windows\System\YCmEFYF.exe
  C:\Windows\System\YCmEFYF.exe
  2⤵
  PID:5848
- C:\Windows\System\MwcBjOz.exe
  C:\Windows\System\MwcBjOz.exe
  2⤵
  PID:5984
- C:\Windows\System\eIFPQMT.exe
  C:\Windows\System\eIFPQMT.exe
  2⤵
  PID:6148
- C:\Windows\System\VagZQfu.exe
  C:\Windows\System\VagZQfu.exe
  2⤵
  PID:6176
- C:\Windows\System\fuFHokk.exe
  C:\Windows\System\fuFHokk.exe
  2⤵
  PID:6204
- C:\Windows\System\LOMGwyt.exe
  C:\Windows\System\LOMGwyt.exe
  2⤵
  PID:6232
- C:\Windows\System\wXlqjNl.exe
  C:\Windows\System\wXlqjNl.exe
  2⤵
  PID:6260
- C:\Windows\System\ROCZBgX.exe
  C:\Windows\System\ROCZBgX.exe
  2⤵
  PID:6284
- C:\Windows\System\LghsotW.exe
  C:\Windows\System\LghsotW.exe
  2⤵
  PID:6316
- C:\Windows\System\cKsHuGf.exe
  C:\Windows\System\cKsHuGf.exe
  2⤵
  PID:6340
- C:\Windows\System\tsyRKfc.exe
  C:\Windows\System\tsyRKfc.exe
  2⤵
  PID:6368
- C:\Windows\System\VZAQMTI.exe
  C:\Windows\System\VZAQMTI.exe
  2⤵
  PID:6396
- C:\Windows\System\OapngnF.exe
  C:\Windows\System\OapngnF.exe
  2⤵
  PID:6428
- C:\Windows\System\BSiUCcd.exe
  C:\Windows\System\BSiUCcd.exe
  2⤵
  PID:6456
- C:\Windows\System\czyerml.exe
  C:\Windows\System\czyerml.exe
  2⤵
  PID:6484
- C:\Windows\System\GGnBrTA.exe
  C:\Windows\System\GGnBrTA.exe
  2⤵
  PID:6512
- C:\Windows\System\vgIfTDG.exe
  C:\Windows\System\vgIfTDG.exe
  2⤵
  PID:6540
- C:\Windows\System\OphaLEo.exe
  C:\Windows\System\OphaLEo.exe
  2⤵
  PID:6568
- C:\Windows\System\YAqmJyI.exe
  C:\Windows\System\YAqmJyI.exe
  2⤵
  PID:6596
- C:\Windows\System\eqcPmxr.exe
  C:\Windows\System\eqcPmxr.exe
  2⤵
  PID:6624
- C:\Windows\System\zhTryHq.exe
  C:\Windows\System\zhTryHq.exe
  2⤵
  PID:6652
- C:\Windows\System\EYFsRWK.exe
  C:\Windows\System\EYFsRWK.exe
  2⤵
  PID:6680
- C:\Windows\System\PclJXCJ.exe
  C:\Windows\System\PclJXCJ.exe
  2⤵
  PID:6704
- C:\Windows\System\LUYFEFh.exe
  C:\Windows\System\LUYFEFh.exe
  2⤵
  PID:6732
- C:\Windows\System\DrsrtgP.exe
  C:\Windows\System\DrsrtgP.exe
  2⤵
  PID:6764
- C:\Windows\System\THwttJb.exe
  C:\Windows\System\THwttJb.exe
  2⤵
  PID:6792
- C:\Windows\System\ELGgUxM.exe
  C:\Windows\System\ELGgUxM.exe
  2⤵
  PID:6824
- C:\Windows\System\kgPJxsI.exe
  C:\Windows\System\kgPJxsI.exe
  2⤵
  PID:6856
- C:\Windows\System\tBSxxIA.exe
  C:\Windows\System\tBSxxIA.exe
  2⤵
  PID:6880
- C:\Windows\System\tgFjBlt.exe
  C:\Windows\System\tgFjBlt.exe
  2⤵
  PID:6912
- C:\Windows\System\kOiuLZX.exe
  C:\Windows\System\kOiuLZX.exe
  2⤵
  PID:6944
- C:\Windows\System\xwCceSf.exe
  C:\Windows\System\xwCceSf.exe
  2⤵
  PID:6972
- C:\Windows\System\KrZMoNE.exe
  C:\Windows\System\KrZMoNE.exe
  2⤵
  PID:7000
- C:\Windows\System\AExgBnD.exe
  C:\Windows\System\AExgBnD.exe
  2⤵
  PID:7028
- C:\Windows\System\cyHEnye.exe
  C:\Windows\System\cyHEnye.exe
  2⤵
  PID:7056
- C:\Windows\System\sHhendg.exe
  C:\Windows\System\sHhendg.exe
  2⤵
  PID:7084
- C:\Windows\System\VsyeLzY.exe
  C:\Windows\System\VsyeLzY.exe
  2⤵
  PID:7112
- C:\Windows\System\WSzuDLQ.exe
  C:\Windows\System\WSzuDLQ.exe
  2⤵
  PID:7136
- C:\Windows\System\EaKxzWF.exe
  C:\Windows\System\EaKxzWF.exe
  2⤵
  PID:3668
- C:\Windows\System\HYOcqVk.exe
  C:\Windows\System\HYOcqVk.exe
  2⤵
  PID:4560
- C:\Windows\System\mcczGLc.exe
  C:\Windows\System\mcczGLc.exe
  2⤵
  PID:2236
- C:\Windows\System\XdBniyI.exe
  C:\Windows\System\XdBniyI.exe
  2⤵
  PID:2144
- C:\Windows\System\dwiRtSp.exe
  C:\Windows\System\dwiRtSp.exe
  2⤵
  PID:6080
- C:\Windows\System\IiPxqzn.exe
  C:\Windows\System\IiPxqzn.exe
  2⤵
  PID:6188
- C:\Windows\System\eXwmpyL.exe
  C:\Windows\System\eXwmpyL.exe
  2⤵
  PID:6244
- C:\Windows\System\IpLQaHJ.exe
  C:\Windows\System\IpLQaHJ.exe
  2⤵
  PID:6300
- C:\Windows\System\ESzSGVl.exe
  C:\Windows\System\ESzSGVl.exe
  2⤵
  PID:6360
- C:\Windows\System\WMtCrMf.exe
  C:\Windows\System\WMtCrMf.exe
  2⤵
  PID:6420
- C:\Windows\System\BIyoKdG.exe
  C:\Windows\System\BIyoKdG.exe
  2⤵
  PID:6476
- C:\Windows\System\dFZvfiu.exe
  C:\Windows\System\dFZvfiu.exe
  2⤵
  PID:3020
- C:\Windows\System\xrBaJrv.exe
  C:\Windows\System\xrBaJrv.exe
  2⤵
  PID:6584
- C:\Windows\System\blcECsJ.exe
  C:\Windows\System\blcECsJ.exe
  2⤵
  PID:6644
- C:\Windows\System\HyrKbwa.exe
  C:\Windows\System\HyrKbwa.exe
  2⤵
  PID:6700
- C:\Windows\System\tBVENaf.exe
  C:\Windows\System\tBVENaf.exe
  2⤵
  PID:6756
- C:\Windows\System\OlCftTi.exe
  C:\Windows\System\OlCftTi.exe
  2⤵
  PID:6812
- C:\Windows\System\VxbJYPv.exe
  C:\Windows\System\VxbJYPv.exe
  2⤵
  PID:6852
- C:\Windows\System\yraonNd.exe
  C:\Windows\System\yraonNd.exe
  2⤵
  PID:664
- C:\Windows\System\NulVPwy.exe
  C:\Windows\System\NulVPwy.exe
  2⤵
  PID:6956
- C:\Windows\System\hYPxLcj.exe
  C:\Windows\System\hYPxLcj.exe
  2⤵
  PID:7012
- C:\Windows\System\bWHCHOO.exe
  C:\Windows\System\bWHCHOO.exe
  2⤵
  PID:7068
- C:\Windows\System\BQFgQTL.exe
  C:\Windows\System\BQFgQTL.exe
  2⤵
  PID:7124
- C:\Windows\System\AYFypmp.exe
  C:\Windows\System\AYFypmp.exe
  2⤵
  PID:4112
- C:\Windows\System\MarYVKJ.exe
  C:\Windows\System\MarYVKJ.exe
  2⤵
  PID:5388
- C:\Windows\System\efYObtc.exe
  C:\Windows\System\efYObtc.exe
  2⤵
  PID:5908
- C:\Windows\System\aSBueiz.exe
  C:\Windows\System\aSBueiz.exe
  2⤵
  PID:3768
- C:\Windows\System\SdUbaQV.exe
  C:\Windows\System\SdUbaQV.exe
  2⤵
  PID:6332
- C:\Windows\System\oSZoSIx.exe
  C:\Windows\System\oSZoSIx.exe
  2⤵
  PID:8
- C:\Windows\System\cDFHUqz.exe
  C:\Windows\System\cDFHUqz.exe
  2⤵
  PID:3128
- C:\Windows\System\yQMcwnL.exe
  C:\Windows\System\yQMcwnL.exe
  2⤵
  PID:1216
- C:\Windows\System\hbXhnJX.exe
  C:\Windows\System\hbXhnJX.exe
  2⤵
  PID:6752
- C:\Windows\System\zzIDgKN.exe
  C:\Windows\System\zzIDgKN.exe
  2⤵
  PID:6844
- C:\Windows\System\ygZrnNQ.exe
  C:\Windows\System\ygZrnNQ.exe
  2⤵
  PID:6928
- C:\Windows\System\wMEiWJe.exe
  C:\Windows\System\wMEiWJe.exe
  2⤵
  PID:3136
- C:\Windows\System\mDtrNOm.exe
  C:\Windows\System\mDtrNOm.exe
  2⤵
  PID:7048
- C:\Windows\System\gTAmttS.exe
  C:\Windows\System\gTAmttS.exe
  2⤵
  PID:7160
- C:\Windows\System\AkJfAAl.exe
  C:\Windows\System\AkJfAAl.exe
  2⤵
  PID:5380
- C:\Windows\System\UHKbOQq.exe
  C:\Windows\System\UHKbOQq.exe
  2⤵
  PID:6168
- C:\Windows\System\ejVwIDN.exe
  C:\Windows\System\ejVwIDN.exe
  2⤵
  PID:6504
- C:\Windows\System\phprPay.exe
  C:\Windows\System\phprPay.exe
  2⤵
  PID:6724
- C:\Windows\System\tWptCse.exe
  C:\Windows\System\tWptCse.exe
  2⤵
  PID:4576
- C:\Windows\System\gAMhlNB.exe
  C:\Windows\System\gAMhlNB.exe
  2⤵
  PID:1820
- C:\Windows\System\oqDQQWQ.exe
  C:\Windows\System\oqDQQWQ.exe
  2⤵
  PID:6616
- C:\Windows\System\tmWokOy.exe
  C:\Windows\System\tmWokOy.exe
  2⤵
  PID:2716
- C:\Windows\System\jzMfOJG.exe
  C:\Windows\System\jzMfOJG.exe
  2⤵
  PID:3304
- C:\Windows\System\HDpOGHu.exe
  C:\Windows\System\HDpOGHu.exe
  2⤵
  PID:6672
- C:\Windows\System\wMUflZD.exe
  C:\Windows\System\wMUflZD.exe
  2⤵
  PID:1852
- C:\Windows\System\Gjiyfum.exe
  C:\Windows\System\Gjiyfum.exe
  2⤵
  PID:2604
- C:\Windows\System\HavkiOi.exe
  C:\Windows\System\HavkiOi.exe
  2⤵
  PID:6416
- C:\Windows\System\iSXBsfd.exe
  C:\Windows\System\iSXBsfd.exe
  2⤵
  PID:1068
- C:\Windows\System\pmmceUT.exe
  C:\Windows\System\pmmceUT.exe
  2⤵
  PID:4388
- C:\Windows\System\aKCAFFz.exe
  C:\Windows\System\aKCAFFz.exe
  2⤵
  PID:880
- C:\Windows\System\pdgzuHg.exe
  C:\Windows\System\pdgzuHg.exe
  2⤵
  PID:7192
- C:\Windows\System\gqmxukL.exe
  C:\Windows\System\gqmxukL.exe
  2⤵
  PID:7220
- C:\Windows\System\EtYUgun.exe
  C:\Windows\System\EtYUgun.exe
  2⤵
  PID:7256
- C:\Windows\System\KTJUsNO.exe
  C:\Windows\System\KTJUsNO.exe
  2⤵
  PID:7300
- C:\Windows\System\EQNfrjO.exe
  C:\Windows\System\EQNfrjO.exe
  2⤵
  PID:7348
- C:\Windows\System\bZMBtJM.exe
  C:\Windows\System\bZMBtJM.exe
  2⤵
  PID:7376
- C:\Windows\System\IuAUXKK.exe
  C:\Windows\System\IuAUXKK.exe
  2⤵
  PID:7420
- C:\Windows\System\NFWMisu.exe
  C:\Windows\System\NFWMisu.exe
  2⤵
  PID:7440
- C:\Windows\System\EynhdwW.exe
  C:\Windows\System\EynhdwW.exe
  2⤵
  PID:7464
- C:\Windows\System\ogCtJNM.exe
  C:\Windows\System\ogCtJNM.exe
  2⤵
  PID:7508
- C:\Windows\System\LYptjMH.exe
  C:\Windows\System\LYptjMH.exe
  2⤵
  PID:7532
- C:\Windows\System\erQJrQk.exe
  C:\Windows\System\erQJrQk.exe
  2⤵
  PID:7548
- C:\Windows\System\jvAeggH.exe
  C:\Windows\System\jvAeggH.exe
  2⤵
  PID:7568
- C:\Windows\System\kQJzPLv.exe
  C:\Windows\System\kQJzPLv.exe
  2⤵
  PID:7596
- C:\Windows\System\OhHonFy.exe
  C:\Windows\System\OhHonFy.exe
  2⤵
  PID:7644
- C:\Windows\System\dVWlmZm.exe
  C:\Windows\System\dVWlmZm.exe
  2⤵
  PID:7660
- C:\Windows\System\KKKbiFk.exe
  C:\Windows\System\KKKbiFk.exe
  2⤵
  PID:7684
- C:\Windows\System\XccxrsM.exe
  C:\Windows\System\XccxrsM.exe
  2⤵
  PID:7708
- C:\Windows\System\vpAGPKQ.exe
  C:\Windows\System\vpAGPKQ.exe
  2⤵
  PID:7724
- C:\Windows\System\tufEEQM.exe
  C:\Windows\System\tufEEQM.exe
  2⤵
  PID:7760
- C:\Windows\System\brVUlkA.exe
  C:\Windows\System\brVUlkA.exe
  2⤵
  PID:7788
- C:\Windows\System\JiyOMdW.exe
  C:\Windows\System\JiyOMdW.exe
  2⤵
  PID:7808
- C:\Windows\System\BhLcLoJ.exe
  C:\Windows\System\BhLcLoJ.exe
  2⤵
  PID:7828
- C:\Windows\System\VFxUixd.exe
  C:\Windows\System\VFxUixd.exe
  2⤵
  PID:7852
- C:\Windows\System\EFVJwQZ.exe
  C:\Windows\System\EFVJwQZ.exe
  2⤵
  PID:7912
- C:\Windows\System\UaWmoPE.exe
  C:\Windows\System\UaWmoPE.exe
  2⤵
  PID:7928
- C:\Windows\System\VCIzCYi.exe
  C:\Windows\System\VCIzCYi.exe
  2⤵
  PID:7952
- C:\Windows\System\chHfgNH.exe
  C:\Windows\System\chHfgNH.exe
  2⤵
  PID:7972
- C:\Windows\System\xfqczCF.exe
  C:\Windows\System\xfqczCF.exe
  2⤵
  PID:7996
- C:\Windows\System\uuvoUYG.exe
  C:\Windows\System\uuvoUYG.exe
  2⤵
  PID:8028
- C:\Windows\System\wjkphCo.exe
  C:\Windows\System\wjkphCo.exe
  2⤵
  PID:8048
- C:\Windows\System\RCojzMo.exe
  C:\Windows\System\RCojzMo.exe
  2⤵
  PID:8064
- C:\Windows\System\bDbfoaa.exe
  C:\Windows\System\bDbfoaa.exe
  2⤵
  PID:8084
- C:\Windows\System\NBMbtVe.exe
  C:\Windows\System\NBMbtVe.exe
  2⤵
  PID:8104
- C:\Windows\System\FzCcKEH.exe
  C:\Windows\System\FzCcKEH.exe
  2⤵
  PID:8124
- C:\Windows\System\WSbzvKi.exe
  C:\Windows\System\WSbzvKi.exe
  2⤵
  PID:8152
- C:\Windows\System\fCaWiAR.exe
  C:\Windows\System\fCaWiAR.exe
  2⤵
  PID:7176
- C:\Windows\System\clEXHNM.exe
  C:\Windows\System\clEXHNM.exe
  2⤵
  PID:448
- C:\Windows\System\MXSOgdk.exe
  C:\Windows\System\MXSOgdk.exe
  2⤵
  PID:7408
- C:\Windows\System\MWMkNEp.exe
  C:\Windows\System\MWMkNEp.exe
  2⤵
  PID:7460
- C:\Windows\System\olwXgNz.exe
  C:\Windows\System\olwXgNz.exe
  2⤵
  PID:7520
- C:\Windows\System\yiVDbtV.exe
  C:\Windows\System\yiVDbtV.exe
  2⤵
  PID:7560
- C:\Windows\System\ZmFrkNH.exe
  C:\Windows\System\ZmFrkNH.exe
  2⤵
  PID:7608
- C:\Windows\System\gsBusxs.exe
  C:\Windows\System\gsBusxs.exe
  2⤵
  PID:7656
- C:\Windows\System\zUkoOuE.exe
  C:\Windows\System\zUkoOuE.exe
  2⤵
  PID:7676
- C:\Windows\System\cvLkxiY.exe
  C:\Windows\System\cvLkxiY.exe
  2⤵
  PID:7816
- C:\Windows\System\ONDpvla.exe
  C:\Windows\System\ONDpvla.exe
  2⤵
  PID:7784
- C:\Windows\System\lANQwAV.exe
  C:\Windows\System\lANQwAV.exe
  2⤵
  PID:7888
- C:\Windows\System\tNoVAvS.exe
  C:\Windows\System\tNoVAvS.exe
  2⤵
  PID:7968
- C:\Windows\System\XhtYjss.exe
  C:\Windows\System\XhtYjss.exe
  2⤵
  PID:8060
- C:\Windows\System\znEYMmD.exe
  C:\Windows\System\znEYMmD.exe
  2⤵
  PID:8096
- C:\Windows\System\WnHaHFj.exe
  C:\Windows\System\WnHaHFj.exe
  2⤵
  PID:8148
- C:\Windows\System\oQTgqhW.exe
  C:\Windows\System\oQTgqhW.exe
  2⤵
  PID:8176
- C:\Windows\System\AbIbDcp.exe
  C:\Windows\System\AbIbDcp.exe
  2⤵
  PID:7336
- C:\Windows\System\fDoPVCL.exe
  C:\Windows\System\fDoPVCL.exe
  2⤵
  PID:7448
- C:\Windows\System\kWbptGx.exe
  C:\Windows\System\kWbptGx.exe
  2⤵
  PID:7804
- C:\Windows\System\wEnoeYI.exe
  C:\Windows\System\wEnoeYI.exe
  2⤵
  PID:7992
- C:\Windows\System\lluKQqH.exe
  C:\Windows\System\lluKQqH.exe
  2⤵
  PID:8080
- C:\Windows\System\EHUSnpD.exe
  C:\Windows\System\EHUSnpD.exe
  2⤵
  PID:7624
- C:\Windows\System\bIGGlIm.exe
  C:\Windows\System\bIGGlIm.exe
  2⤵
  PID:7680
- C:\Windows\System\OmnGKrF.exe
  C:\Windows\System\OmnGKrF.exe
  2⤵
  PID:7268
- C:\Windows\System\PwWqPbp.exe
  C:\Windows\System\PwWqPbp.exe
  2⤵
  PID:7908
- C:\Windows\System\IOadOFX.exe
  C:\Windows\System\IOadOFX.exe
  2⤵
  PID:8200
- C:\Windows\System\sYVErpX.exe
  C:\Windows\System\sYVErpX.exe
  2⤵
  PID:8240
- C:\Windows\System\InoHXgs.exe
  C:\Windows\System\InoHXgs.exe
  2⤵
  PID:8264
- C:\Windows\System\frwPNbW.exe
  C:\Windows\System\frwPNbW.exe
  2⤵
  PID:8304
- C:\Windows\System\jzPMQxc.exe
  C:\Windows\System\jzPMQxc.exe
  2⤵
  PID:8320
- C:\Windows\System\MOxBbtl.exe
  C:\Windows\System\MOxBbtl.exe
  2⤵
  PID:8348
- C:\Windows\System\ivtEdOq.exe
  C:\Windows\System\ivtEdOq.exe
  2⤵
  PID:8376
- C:\Windows\System\UeTaDWS.exe
  C:\Windows\System\UeTaDWS.exe
  2⤵
  PID:8400
- C:\Windows\System\GkpOUEE.exe
  C:\Windows\System\GkpOUEE.exe
  2⤵
  PID:8420
- C:\Windows\System\NaWACeP.exe
  C:\Windows\System\NaWACeP.exe
  2⤵
  PID:8464
- C:\Windows\System\MeLiuBh.exe
  C:\Windows\System\MeLiuBh.exe
  2⤵
  PID:8500
- C:\Windows\System\hBMVBrZ.exe
  C:\Windows\System\hBMVBrZ.exe
  2⤵
  PID:8520
- C:\Windows\System\ooPXQaA.exe
  C:\Windows\System\ooPXQaA.exe
  2⤵
  PID:8548
- C:\Windows\System\pUsrPwU.exe
  C:\Windows\System\pUsrPwU.exe
  2⤵
  PID:8572
- C:\Windows\System\bozHAzr.exe
  C:\Windows\System\bozHAzr.exe
  2⤵
  PID:8588
- C:\Windows\System\eiqaFsA.exe
  C:\Windows\System\eiqaFsA.exe
  2⤵
  PID:8608
- C:\Windows\System\PpvKfnE.exe
  C:\Windows\System\PpvKfnE.exe
  2⤵
  PID:8632
- C:\Windows\System\huGUoUd.exe
  C:\Windows\System\huGUoUd.exe
  2⤵
  PID:8696
- C:\Windows\System\pTgDVaV.exe
  C:\Windows\System\pTgDVaV.exe
  2⤵
  PID:8712
- C:\Windows\System\sWadPBW.exe
  C:\Windows\System\sWadPBW.exe
  2⤵
  PID:8736
- C:\Windows\System\ltlktqh.exe
  C:\Windows\System\ltlktqh.exe
  2⤵
  PID:8756
- C:\Windows\System\fDJESKH.exe
  C:\Windows\System\fDJESKH.exe
  2⤵
  PID:8808
- C:\Windows\System\DIFWcmf.exe
  C:\Windows\System\DIFWcmf.exe
  2⤵
  PID:8828
- C:\Windows\System\NGGwTKn.exe
  C:\Windows\System\NGGwTKn.exe
  2⤵
  PID:8844
- C:\Windows\System\bWyicKA.exe
  C:\Windows\System\bWyicKA.exe
  2⤵
  PID:8892
- C:\Windows\System\QXyFHkC.exe
  C:\Windows\System\QXyFHkC.exe
  2⤵
  PID:8908
- C:\Windows\System\KtRrRCi.exe
  C:\Windows\System\KtRrRCi.exe
  2⤵
  PID:8932
- C:\Windows\System\yTkjEdj.exe
  C:\Windows\System\yTkjEdj.exe
  2⤵
  PID:8960
- C:\Windows\System\IyzqZyi.exe
  C:\Windows\System\IyzqZyi.exe
  2⤵
  PID:9004
- C:\Windows\System\vKtFyVY.exe
  C:\Windows\System\vKtFyVY.exe
  2⤵
  PID:9020
- C:\Windows\System\AdqeYGR.exe
  C:\Windows\System\AdqeYGR.exe
  2⤵
  PID:9048
- C:\Windows\System\dbYzOVa.exe
  C:\Windows\System\dbYzOVa.exe
  2⤵
  PID:9072
- C:\Windows\System\PthPPGq.exe
  C:\Windows\System\PthPPGq.exe
  2⤵
  PID:9092
- C:\Windows\System\czSYDsn.exe
  C:\Windows\System\czSYDsn.exe
  2⤵
  PID:9116
- C:\Windows\System\IIiCHVa.exe
  C:\Windows\System\IIiCHVa.exe
  2⤵
  PID:9132
- C:\Windows\System\PKFXUVp.exe
  C:\Windows\System\PKFXUVp.exe
  2⤵
  PID:9176
- C:\Windows\System\tlrCsLf.exe
  C:\Windows\System\tlrCsLf.exe
  2⤵
  PID:7540
- C:\Windows\System\BDAwxpr.exe
  C:\Windows\System\BDAwxpr.exe
  2⤵
  PID:8276
- C:\Windows\System\yIgBbic.exe
  C:\Windows\System\yIgBbic.exe
  2⤵
  PID:8296
- C:\Windows\System\EvwQZIL.exe
  C:\Windows\System\EvwQZIL.exe
  2⤵
  PID:8364
- C:\Windows\System\wBnrcoC.exe
  C:\Windows\System\wBnrcoC.exe
  2⤵
  PID:8432
- C:\Windows\System\ARbISUz.exe
  C:\Windows\System\ARbISUz.exe
  2⤵
  PID:8484
- C:\Windows\System\JPtRjqr.exe
  C:\Windows\System\JPtRjqr.exe
  2⤵
  PID:8540
- C:\Windows\System\nJYMwmU.exe
  C:\Windows\System\nJYMwmU.exe
  2⤵
  PID:8604
- C:\Windows\System\hPQtSVN.exe
  C:\Windows\System\hPQtSVN.exe
  2⤵
  PID:8688
- C:\Windows\System\dmhPzuk.exe
  C:\Windows\System\dmhPzuk.exe
  2⤵
  PID:8748
- C:\Windows\System\OLeSukN.exe
  C:\Windows\System\OLeSukN.exe
  2⤵
  PID:8784
- C:\Windows\System\PpyJFzw.exe
  C:\Windows\System\PpyJFzw.exe
  2⤵
  PID:8820
- C:\Windows\System\PjEgpSa.exe
  C:\Windows\System\PjEgpSa.exe
  2⤵
  PID:8900
- C:\Windows\System\qPThdgP.exe
  C:\Windows\System\qPThdgP.exe
  2⤵
  PID:8984
- C:\Windows\System\mSsEOmj.exe
  C:\Windows\System\mSsEOmj.exe
  2⤵
  PID:9016
- C:\Windows\System\PgbbDWq.exe
  C:\Windows\System\PgbbDWq.exe
  2⤵
  PID:9044
- C:\Windows\System\uuvQkWn.exe
  C:\Windows\System\uuvQkWn.exe
  2⤵
  PID:8228
- C:\Windows\System\cCmeveU.exe
  C:\Windows\System\cCmeveU.exe
  2⤵
  PID:8344
- C:\Windows\System\yIBgjrc.exe
  C:\Windows\System\yIBgjrc.exe
  2⤵
  PID:8456
- C:\Windows\System\PIVtLPk.exe
  C:\Windows\System\PIVtLPk.exe
  2⤵
  PID:8660
- C:\Windows\System\nkfJARG.exe
  C:\Windows\System\nkfJARG.exe
  2⤵
  PID:8780
- C:\Windows\System\LQvSvzr.exe
  C:\Windows\System\LQvSvzr.exe
  2⤵
  PID:8864
- C:\Windows\System\KmEHQKS.exe
  C:\Windows\System\KmEHQKS.exe
  2⤵
  PID:9172
- C:\Windows\System\rUFhqPL.exe
  C:\Windows\System\rUFhqPL.exe
  2⤵
  PID:8292
- C:\Windows\System\CcjVOiU.exe
  C:\Windows\System\CcjVOiU.exe
  2⤵
  PID:8652
- C:\Windows\System\FYEfzJD.exe
  C:\Windows\System\FYEfzJD.exe
  2⤵
  PID:9184
- C:\Windows\System\NojREWS.exe
  C:\Windows\System\NojREWS.exe
  2⤵
  PID:9000
- C:\Windows\System\QolgggE.exe
  C:\Windows\System\QolgggE.exe
  2⤵
  PID:8668
- C:\Windows\System\NiBsBpv.exe
  C:\Windows\System\NiBsBpv.exe
  2⤵
  PID:9248
- C:\Windows\System\FYpXTOh.exe
  C:\Windows\System\FYpXTOh.exe
  2⤵
  PID:9272
- C:\Windows\System\whBcyYc.exe
  C:\Windows\System\whBcyYc.exe
  2⤵
  PID:9296
- C:\Windows\System\rcvSUVs.exe
  C:\Windows\System\rcvSUVs.exe
  2⤵
  PID:9320
- C:\Windows\System\AhiPMbT.exe
  C:\Windows\System\AhiPMbT.exe
  2⤵
  PID:9344
- C:\Windows\System\EVsfiKM.exe
  C:\Windows\System\EVsfiKM.exe
  2⤵
  PID:9364
- C:\Windows\System\AgZutVk.exe
  C:\Windows\System\AgZutVk.exe
  2⤵
  PID:9388
- C:\Windows\System\wVePODO.exe
  C:\Windows\System\wVePODO.exe
  2⤵
  PID:9408
- C:\Windows\System\MrEKswO.exe
  C:\Windows\System\MrEKswO.exe
  2⤵
  PID:9452
- C:\Windows\System\FfZIrZS.exe
  C:\Windows\System\FfZIrZS.exe
  2⤵
  PID:9476
- C:\Windows\System\GuKYuiH.exe
  C:\Windows\System\GuKYuiH.exe
  2⤵
  PID:9496
- C:\Windows\System\TiJCFbm.exe
  C:\Windows\System\TiJCFbm.exe
  2⤵
  PID:9528
- C:\Windows\System\LrGxqJj.exe
  C:\Windows\System\LrGxqJj.exe
  2⤵
  PID:9560
- C:\Windows\System\lumyxXo.exe
  C:\Windows\System\lumyxXo.exe
  2⤵
  PID:9576
- C:\Windows\System\uVWswkq.exe
  C:\Windows\System\uVWswkq.exe
  2⤵
  PID:9636
- C:\Windows\System\aEzRnCT.exe
  C:\Windows\System\aEzRnCT.exe
  2⤵
  PID:9656
- C:\Windows\System\UBgiicm.exe
  C:\Windows\System\UBgiicm.exe
  2⤵
  PID:9684
- C:\Windows\System\PwhfIsK.exe
  C:\Windows\System\PwhfIsK.exe
  2⤵
  PID:9708
- C:\Windows\System\RoQRbaD.exe
  C:\Windows\System\RoQRbaD.exe
  2⤵
  PID:9744
- C:\Windows\System\nFGmrYM.exe
  C:\Windows\System\nFGmrYM.exe
  2⤵
  PID:9768
- C:\Windows\System\ebDdsiZ.exe
  C:\Windows\System\ebDdsiZ.exe
  2⤵
  PID:9812
- C:\Windows\System\yZJhGaK.exe
  C:\Windows\System\yZJhGaK.exe
  2⤵
  PID:9832
- C:\Windows\System\PwdHrwM.exe
  C:\Windows\System\PwdHrwM.exe
  2⤵
  PID:9856
- C:\Windows\System\fZfpfgr.exe
  C:\Windows\System\fZfpfgr.exe
  2⤵
  PID:9876
- C:\Windows\System\NYkKLaY.exe
  C:\Windows\System\NYkKLaY.exe
  2⤵
  PID:9904
- C:\Windows\System\mnytpHZ.exe
  C:\Windows\System\mnytpHZ.exe
  2⤵
  PID:9928
- C:\Windows\System\dlbaNfa.exe
  C:\Windows\System\dlbaNfa.exe
  2⤵
  PID:9972
- C:\Windows\System\RFYiPdx.exe
  C:\Windows\System\RFYiPdx.exe
  2⤵
  PID:9996
- C:\Windows\System\jBvdolJ.exe
  C:\Windows\System\jBvdolJ.exe
  2⤵
  PID:10016
- C:\Windows\System\cfSREnR.exe
  C:\Windows\System\cfSREnR.exe
  2⤵
  PID:10044
- C:\Windows\System\atKshev.exe
  C:\Windows\System\atKshev.exe
  2⤵
  PID:10088
- C:\Windows\System\rPdzxGv.exe
  C:\Windows\System\rPdzxGv.exe
  2⤵
  PID:10108
- C:\Windows\System\EsJPcRI.exe
  C:\Windows\System\EsJPcRI.exe
  2⤵
  PID:10136
- C:\Windows\System\abktVNt.exe
  C:\Windows\System\abktVNt.exe
  2⤵
  PID:10168
- C:\Windows\System\vDOiaCK.exe
  C:\Windows\System\vDOiaCK.exe
  2⤵
  PID:10184
- C:\Windows\System\WYHRCMs.exe
  C:\Windows\System\WYHRCMs.exe
  2⤵
  PID:10212
- C:\Windows\System\oukfoSk.exe
  C:\Windows\System\oukfoSk.exe
  2⤵
  PID:10232
- C:\Windows\System\lBQPhWU.exe
  C:\Windows\System\lBQPhWU.exe
  2⤵
  PID:8616
- C:\Windows\System\FRKhpti.exe
  C:\Windows\System\FRKhpti.exe
  2⤵
  PID:9316
- C:\Windows\System\fPLkhwl.exe
  C:\Windows\System\fPLkhwl.exe
  2⤵
  PID:9400
- C:\Windows\System\tQluwFc.exe
  C:\Windows\System\tQluwFc.exe
  2⤵
  PID:9524
- C:\Windows\System\HvXwESE.exe
  C:\Windows\System\HvXwESE.exe
  2⤵
  PID:9468
- C:\Windows\System\zZJcpdg.exe
  C:\Windows\System\zZJcpdg.exe
  2⤵
  PID:4640
- C:\Windows\System\lVxbOla.exe
  C:\Windows\System\lVxbOla.exe
  2⤵
  PID:9664
- C:\Windows\System\ELSWgKe.exe
  C:\Windows\System\ELSWgKe.exe
  2⤵
  PID:9592
- C:\Windows\System\cQqtpSE.exe
  C:\Windows\System\cQqtpSE.exe
  2⤵
  PID:9728
- C:\Windows\System\NFVCzfN.exe
  C:\Windows\System\NFVCzfN.exe
  2⤵
  PID:9808
- C:\Windows\System\tGZmPJK.exe
  C:\Windows\System\tGZmPJK.exe
  2⤵
  PID:9848
- C:\Windows\System\CGTpdFu.exe
  C:\Windows\System\CGTpdFu.exe
  2⤵
  PID:9924
- C:\Windows\System\yZleUwn.exe
  C:\Windows\System\yZleUwn.exe
  2⤵
  PID:9984
- C:\Windows\System\FnTMAyQ.exe
  C:\Windows\System\FnTMAyQ.exe
  2⤵
  PID:10084
- C:\Windows\System\QfOTerE.exe
  C:\Windows\System\QfOTerE.exe
  2⤵
  PID:10132
- C:\Windows\System\FrLXayS.exe
  C:\Windows\System\FrLXayS.exe
  2⤵
  PID:10192
- C:\Windows\System\YmLdZyh.exe
  C:\Windows\System\YmLdZyh.exe
  2⤵
  PID:8328
- C:\Windows\System\CPXzhlI.exe
  C:\Windows\System\CPXzhlI.exe
  2⤵
  PID:9372
- C:\Windows\System\ZcpycPQ.exe
  C:\Windows\System\ZcpycPQ.exe
  2⤵
  PID:9572
- C:\Windows\System\AzjYXax.exe
  C:\Windows\System\AzjYXax.exe
  2⤵
  PID:9624
- C:\Windows\System\JKgTCQn.exe
  C:\Windows\System\JKgTCQn.exe
  2⤵
  PID:9828
- C:\Windows\System\eVjwyCV.exe
  C:\Windows\System\eVjwyCV.exe
  2⤵
  PID:10080
- C:\Windows\System\bURxTnA.exe
  C:\Windows\System\bURxTnA.exe
  2⤵
  PID:10228
- C:\Windows\System\cAjEGzY.exe
  C:\Windows\System\cAjEGzY.exe
  2⤵
  PID:9616
- C:\Windows\System\AGclAJU.exe
  C:\Windows\System\AGclAJU.exe
  2⤵
  PID:9104
- C:\Windows\System\Gtnuesp.exe
  C:\Windows\System\Gtnuesp.exe
  2⤵
  PID:10164
- C:\Windows\System\QnIwqhB.exe
  C:\Windows\System\QnIwqhB.exe
  2⤵
  PID:10248
- C:\Windows\System\SLJgzfT.exe
  C:\Windows\System\SLJgzfT.exe
  2⤵
  PID:10264
- C:\Windows\System\ErBaXLK.exe
  C:\Windows\System\ErBaXLK.exe
  2⤵
  PID:10284
- C:\Windows\System\tjADwil.exe
  C:\Windows\System\tjADwil.exe
  2⤵
  PID:10308
- C:\Windows\System\ceZHiWf.exe
  C:\Windows\System\ceZHiWf.exe
  2⤵
  PID:10324
- C:\Windows\System\BdGSeLQ.exe
  C:\Windows\System\BdGSeLQ.exe
  2⤵
  PID:10356
- C:\Windows\System\dFJGgvn.exe
  C:\Windows\System\dFJGgvn.exe
  2⤵
  PID:10376
- C:\Windows\System\kfeTNgh.exe
  C:\Windows\System\kfeTNgh.exe
  2⤵
  PID:10396
- C:\Windows\System\fmWTmVU.exe
  C:\Windows\System\fmWTmVU.exe
  2⤵
  PID:10428
- C:\Windows\System\jyNnobs.exe
  C:\Windows\System\jyNnobs.exe
  2⤵
  PID:10456
- C:\Windows\System\HSdIVJo.exe
  C:\Windows\System\HSdIVJo.exe
  2⤵
  PID:10496
- C:\Windows\System\RDysWtS.exe
  C:\Windows\System\RDysWtS.exe
  2⤵
  PID:10536
- C:\Windows\System\isDunda.exe
  C:\Windows\System\isDunda.exe
  2⤵
  PID:10576
- C:\Windows\System\eFpmJQd.exe
  C:\Windows\System\eFpmJQd.exe
  2⤵
  PID:10600
- C:\Windows\System\WNnHLoc.exe
  C:\Windows\System\WNnHLoc.exe
  2⤵
  PID:10692
- C:\Windows\System\JzpRdVC.exe
  C:\Windows\System\JzpRdVC.exe
  2⤵
  PID:10756
- C:\Windows\System\eboUbRw.exe
  C:\Windows\System\eboUbRw.exe
  2⤵
  PID:10772
- C:\Windows\System\HOoEInI.exe
  C:\Windows\System\HOoEInI.exe
  2⤵
  PID:10788
- C:\Windows\System\lKBqAMh.exe
  C:\Windows\System\lKBqAMh.exe
  2⤵
  PID:10808
- C:\Windows\System\KiqhAoQ.exe
  C:\Windows\System\KiqhAoQ.exe
  2⤵
  PID:10828
- C:\Windows\System\zVNueuy.exe
  C:\Windows\System\zVNueuy.exe
  2⤵
  PID:10844
- C:\Windows\System\iggutKK.exe
  C:\Windows\System\iggutKK.exe
  2⤵
  PID:10860
- C:\Windows\System\mrUUWFt.exe
  C:\Windows\System\mrUUWFt.exe
  2⤵
  PID:10876
- C:\Windows\System\JupkozA.exe
  C:\Windows\System\JupkozA.exe
  2⤵
  PID:10892
- C:\Windows\System\NCvOVel.exe
  C:\Windows\System\NCvOVel.exe
  2⤵
  PID:10908
- C:\Windows\System\lTQMJFz.exe
  C:\Windows\System\lTQMJFz.exe
  2⤵
  PID:10956
- C:\Windows\System\fVbapPa.exe
  C:\Windows\System\fVbapPa.exe
  2⤵
  PID:10996
- C:\Windows\System\xCTwMLn.exe
  C:\Windows\System\xCTwMLn.exe
  2⤵
  PID:11072
- C:\Windows\System\BDebyZE.exe
  C:\Windows\System\BDebyZE.exe
  2⤵
  PID:11136
- C:\Windows\System\ICbLNca.exe
  C:\Windows\System\ICbLNca.exe
  2⤵
  PID:11160
- C:\Windows\System\xtRzQYe.exe
  C:\Windows\System\xtRzQYe.exe
  2⤵
  PID:11196
- C:\Windows\System\bXWCoYT.exe
  C:\Windows\System\bXWCoYT.exe
  2⤵
  PID:11236
- C:\Windows\System\NZGFVXj.exe
  C:\Windows\System\NZGFVXj.exe
  2⤵
  PID:9520
- C:\Windows\System\OjaIELS.exe
  C:\Windows\System\OjaIELS.exe
  2⤵
  PID:10292
- C:\Windows\System\khOtgPc.exe
  C:\Windows\System\khOtgPc.exe
  2⤵
  PID:10336
- C:\Windows\System\mSJsABb.exe
  C:\Windows\System\mSJsABb.exe
  2⤵
  PID:10388
- C:\Windows\System\SzQdMub.exe
  C:\Windows\System\SzQdMub.exe
  2⤵
  PID:10464
- C:\Windows\System\aZOYMiE.exe
  C:\Windows\System\aZOYMiE.exe
  2⤵
  PID:10572
- C:\Windows\System\zzOTVVl.exe
  C:\Windows\System\zzOTVVl.exe
  2⤵
  PID:10676
- C:\Windows\System\sAIfBVu.exe
  C:\Windows\System\sAIfBVu.exe
  2⤵
  PID:10624
- C:\Windows\System\OKvsCYk.exe
  C:\Windows\System\OKvsCYk.exe
  2⤵
  PID:10632
- C:\Windows\System\nsxmPWf.exe
  C:\Windows\System\nsxmPWf.exe
  2⤵
  PID:10924
- C:\Windows\System\BHPrHwS.exe
  C:\Windows\System\BHPrHwS.exe
  2⤵
  PID:10852
- C:\Windows\System\vdaBOQt.exe
  C:\Windows\System\vdaBOQt.exe
  2⤵
  PID:10748
- C:\Windows\System\wVRHSTh.exe
  C:\Windows\System\wVRHSTh.exe
  2⤵
  PID:10784
- C:\Windows\System\zGBwIgc.exe
  C:\Windows\System\zGBwIgc.exe
  2⤵
  PID:10820
- C:\Windows\System\kDGpWZI.exe
  C:\Windows\System\kDGpWZI.exe
  2⤵
  PID:10872
- C:\Windows\System\mZsfhOb.exe
  C:\Windows\System\mZsfhOb.exe
  2⤵
  PID:10952
- C:\Windows\System\OtwfBYu.exe
  C:\Windows\System\OtwfBYu.exe
  2⤵
  PID:11012
- C:\Windows\System\hOMcJkz.exe
  C:\Windows\System\hOMcJkz.exe
  2⤵
  PID:11152
- C:\Windows\System\qmXSTZJ.exe
  C:\Windows\System\qmXSTZJ.exe
  2⤵
  PID:11232
- C:\Windows\System\hVsXsGi.exe
  C:\Windows\System\hVsXsGi.exe
  2⤵
  PID:10280
- C:\Windows\System\OuPFNqi.exe
  C:\Windows\System\OuPFNqi.exe
  2⤵
  PID:10404
- C:\Windows\System\jTmqNrW.exe
  C:\Windows\System\jTmqNrW.exe
  2⤵
  PID:10660
- C:\Windows\System\dOnQGgG.exe
  C:\Windows\System\dOnQGgG.exe
  2⤵
  PID:10616
- C:\Windows\System\yhFWtMS.exe
  C:\Windows\System\yhFWtMS.exe
  2⤵
  PID:10704
- C:\Windows\System\eTljOgj.exe
  C:\Windows\System\eTljOgj.exe
  2⤵
  PID:11048
- C:\Windows\System\SZCohKJ.exe
  C:\Windows\System\SZCohKJ.exe
  2⤵
  PID:11032
- C:\Windows\System\SBBHKCF.exe
  C:\Windows\System\SBBHKCF.exe
  2⤵
  PID:11252
- C:\Windows\System\jdAiHFg.exe
  C:\Windows\System\jdAiHFg.exe
  2⤵
  PID:10276
- C:\Windows\System\HtIyzmx.exe
  C:\Windows\System\HtIyzmx.exe
  2⤵
  PID:10504
- C:\Windows\System\hTTukdS.exe
  C:\Windows\System\hTTukdS.exe
  2⤵
  PID:10740
- C:\Windows\System\cMKVoEF.exe
  C:\Windows\System\cMKVoEF.exe
  2⤵
  PID:10884
- C:\Windows\System\XlXQBoW.exe
  C:\Windows\System\XlXQBoW.exe
  2⤵
  PID:10452
- C:\Windows\System\ahgBJrf.exe
  C:\Windows\System\ahgBJrf.exe
  2⤵
  PID:11216
- C:\Windows\System\ppwmxZs.exe
  C:\Windows\System\ppwmxZs.exe
  2⤵
  PID:11280
- C:\Windows\System\cYBolxw.exe
  C:\Windows\System\cYBolxw.exe
  2⤵
  PID:11320
- C:\Windows\System\vDqIiDZ.exe
  C:\Windows\System\vDqIiDZ.exe
  2⤵
  PID:11356
- C:\Windows\System\DFdmfJb.exe
  C:\Windows\System\DFdmfJb.exe
  2⤵
  PID:11384
- C:\Windows\System\ojdVSrL.exe
  C:\Windows\System\ojdVSrL.exe
  2⤵
  PID:11412
- C:\Windows\System\feYvSqf.exe
  C:\Windows\System\feYvSqf.exe
  2⤵
  PID:11452
- C:\Windows\System\saSvfFk.exe
  C:\Windows\System\saSvfFk.exe
  2⤵
  PID:11484
- C:\Windows\System\BPJvHko.exe
  C:\Windows\System\BPJvHko.exe
  2⤵
  PID:11508
- C:\Windows\System\MCxiPZn.exe
  C:\Windows\System\MCxiPZn.exe
  2⤵
  PID:11524
- C:\Windows\System\pvBbstX.exe
  C:\Windows\System\pvBbstX.exe
  2⤵
  PID:11544
- C:\Windows\System\tlZiVWx.exe
  C:\Windows\System\tlZiVWx.exe
  2⤵
  PID:11572
- C:\Windows\System\pvPXFSj.exe
  C:\Windows\System\pvPXFSj.exe
  2⤵
  PID:11596
- C:\Windows\System\btnfqsU.exe
  C:\Windows\System\btnfqsU.exe
  2⤵
  PID:11640
- C:\Windows\System\pMiBktI.exe
  C:\Windows\System\pMiBktI.exe
  2⤵
  PID:11664
- C:\Windows\System\iVoBcGx.exe
  C:\Windows\System\iVoBcGx.exe
  2⤵
  PID:11692
- C:\Windows\System\kSiPVQI.exe
  C:\Windows\System\kSiPVQI.exe
  2⤵
  PID:11720
- C:\Windows\System\rQisNNm.exe
  C:\Windows\System\rQisNNm.exe
  2⤵
  PID:11748
- C:\Windows\System\NmlAqNq.exe
  C:\Windows\System\NmlAqNq.exe
  2⤵
  PID:11768
- C:\Windows\System\dgaeMQx.exe
  C:\Windows\System\dgaeMQx.exe
  2⤵
  PID:11796
- C:\Windows\System\vApPEzU.exe
  C:\Windows\System\vApPEzU.exe
  2⤵
  PID:11820
- C:\Windows\System\qHqjaEq.exe
  C:\Windows\System\qHqjaEq.exe
  2⤵
  PID:11840
- C:\Windows\System\QZhdRvp.exe
  C:\Windows\System\QZhdRvp.exe
  2⤵
  PID:11864
- C:\Windows\System\mfKoqSR.exe
  C:\Windows\System\mfKoqSR.exe
  2⤵
  PID:11912
- C:\Windows\System\iuQPTFY.exe
  C:\Windows\System\iuQPTFY.exe
  2⤵
  PID:11936
- C:\Windows\System\OuuHySL.exe
  C:\Windows\System\OuuHySL.exe
  2⤵
  PID:11976
- C:\Windows\System\kWciyzp.exe
  C:\Windows\System\kWciyzp.exe
  2⤵
  PID:12000
- C:\Windows\System\SclLLFs.exe
  C:\Windows\System\SclLLFs.exe
  2⤵
  PID:12016
- C:\Windows\System\ySiVjzr.exe
  C:\Windows\System\ySiVjzr.exe
  2⤵
  PID:12052
- C:\Windows\System\ACjBjgl.exe
  C:\Windows\System\ACjBjgl.exe
  2⤵
  PID:12072
- C:\Windows\System\szfusof.exe
  C:\Windows\System\szfusof.exe
  2⤵
  PID:12116
- C:\Windows\System\fEqTcpq.exe
  C:\Windows\System\fEqTcpq.exe
  2⤵
  PID:12132
- C:\Windows\System\VSYgPRJ.exe
  C:\Windows\System\VSYgPRJ.exe
  2⤵
  PID:12164
- C:\Windows\System\FzynLkQ.exe
  C:\Windows\System\FzynLkQ.exe
  2⤵
  PID:12192
- C:\Windows\System\sSYZQFm.exe
  C:\Windows\System\sSYZQFm.exe
  2⤵
  PID:12236
- C:\Windows\System\nJlXZgP.exe
  C:\Windows\System\nJlXZgP.exe
  2⤵
  PID:12264
- C:\Windows\System\fKbelnm.exe
  C:\Windows\System\fKbelnm.exe
  2⤵
  PID:10684
- C:\Windows\System\LrHNGyG.exe
  C:\Windows\System\LrHNGyG.exe
  2⤵
  PID:10612
- C:\Windows\System\BqfZTIT.exe
  C:\Windows\System\BqfZTIT.exe
  2⤵
  PID:11328
- C:\Windows\System\ZWjSRyI.exe
  C:\Windows\System\ZWjSRyI.exe
  2⤵
  PID:10596
- C:\Windows\System\XsGjfBl.exe
  C:\Windows\System\XsGjfBl.exe
  2⤵
  PID:11500
- C:\Windows\System\uEYkypp.exe
  C:\Windows\System\uEYkypp.exe
  2⤵
  PID:11580
- C:\Windows\System\KSbGjOL.exe
  C:\Windows\System\KSbGjOL.exe
  2⤵
  PID:11656
- C:\Windows\System\vBeviZd.exe
  C:\Windows\System\vBeviZd.exe
  2⤵
  PID:11680
- C:\Windows\System\lWDFBwo.exe
  C:\Windows\System\lWDFBwo.exe
  2⤵
  PID:11708
- C:\Windows\System\sYQYdGh.exe
  C:\Windows\System\sYQYdGh.exe
  2⤵
  PID:11852
- C:\Windows\System\dPbWrjw.exe
  C:\Windows\System\dPbWrjw.exe
  2⤵
  PID:11880
- C:\Windows\System\vwvTsim.exe
  C:\Windows\System\vwvTsim.exe
  2⤵
  PID:11952
- C:\Windows\System\yOwDJrJ.exe
  C:\Windows\System\yOwDJrJ.exe
  2⤵
  PID:11988
- C:\Windows\System\larUsRv.exe
  C:\Windows\System\larUsRv.exe
  2⤵
  PID:12032
- C:\Windows\System\oShebOC.exe
  C:\Windows\System\oShebOC.exe
  2⤵
  PID:12108
- C:\Windows\System\WEIywUL.exe
  C:\Windows\System\WEIywUL.exe
  2⤵
  PID:12152
- C:\Windows\System\KnjFyRM.exe
  C:\Windows\System\KnjFyRM.exe
  2⤵
  PID:12284
- C:\Windows\System\cuKBFFd.exe
  C:\Windows\System\cuKBFFd.exe
  2⤵
  PID:10304
- C:\Windows\System\jjpyPhE.exe
  C:\Windows\System\jjpyPhE.exe
  2⤵
  PID:11540
- C:\Windows\System\FZPgFcH.exe
  C:\Windows\System\FZPgFcH.exe
  2⤵
  PID:11676
- C:\Windows\System\DwqXVds.exe
  C:\Windows\System\DwqXVds.exe
  2⤵
  PID:11808
- C:\Windows\System\NdMeuxF.exe
  C:\Windows\System\NdMeuxF.exe
  2⤵
  PID:11900
- C:\Windows\System\acFaPVm.exe
  C:\Windows\System\acFaPVm.exe
  2⤵
  PID:12028
- C:\Windows\System\QhPWTXX.exe
  C:\Windows\System\QhPWTXX.exe
  2⤵
  PID:12124
- C:\Windows\System\JqOpKTy.exe
  C:\Windows\System\JqOpKTy.exe
  2⤵
  PID:11628
- C:\Windows\System\lwrYiLe.exe
  C:\Windows\System\lwrYiLe.exe
  2⤵
  PID:12260
- C:\Windows\System\NTenftC.exe
  C:\Windows\System\NTenftC.exe
  2⤵
  PID:11272
- C:\Windows\System\eMnlaUy.exe
  C:\Windows\System\eMnlaUy.exe
  2⤵
  PID:12224
- C:\Windows\System\QNHxBSE.exe
  C:\Windows\System\QNHxBSE.exe
  2⤵
  PID:12300
- C:\Windows\System\UXkKmYQ.exe
  C:\Windows\System\UXkKmYQ.exe
  2⤵
  PID:12320
- C:\Windows\System\ippWnnR.exe
  C:\Windows\System\ippWnnR.exe
  2⤵
  PID:12364
- C:\Windows\System\uCGaSjq.exe
  C:\Windows\System\uCGaSjq.exe
  2⤵
  PID:12384
- C:\Windows\System\TNjqUPC.exe
  C:\Windows\System\TNjqUPC.exe
  2⤵
  PID:12420
- C:\Windows\System\DlVkSsA.exe
  C:\Windows\System\DlVkSsA.exe
  2⤵
  PID:12448
- C:\Windows\System\CXmCaAC.exe
  C:\Windows\System\CXmCaAC.exe
  2⤵
  PID:12468
- C:\Windows\System\rHuvKBR.exe
  C:\Windows\System\rHuvKBR.exe
  2⤵
  PID:12484
- C:\Windows\System\OyJCaYX.exe
  C:\Windows\System\OyJCaYX.exe
  2⤵
  PID:12504
- C:\Windows\System\BjvXAZu.exe
  C:\Windows\System\BjvXAZu.exe
  2⤵
  PID:12552
- C:\Windows\System\qnBRpiV.exe
  C:\Windows\System\qnBRpiV.exe
  2⤵
  PID:12572
- C:\Windows\System\iziJWrD.exe
  C:\Windows\System\iziJWrD.exe
  2⤵
  PID:12600
- C:\Windows\System\raeZGGc.exe
  C:\Windows\System\raeZGGc.exe
  2⤵
  PID:12616
- C:\Windows\System\wMOkThG.exe
  C:\Windows\System\wMOkThG.exe
  2⤵
  PID:12636
- C:\Windows\System\cUCynTQ.exe
  C:\Windows\System\cUCynTQ.exe
  2⤵
  PID:12676
- C:\Windows\System\alfVoMi.exe
  C:\Windows\System\alfVoMi.exe
  2⤵
  PID:12704
- C:\Windows\System\evPhTbd.exe
  C:\Windows\System\evPhTbd.exe
  2⤵
  PID:12724
- C:\Windows\System\IHGZBhN.exe
  C:\Windows\System\IHGZBhN.exe
  2⤵
  PID:12760
- C:\Windows\System\ZFOeFvd.exe
  C:\Windows\System\ZFOeFvd.exe
  2⤵
  PID:12784
- C:\Windows\System\EQsJAAX.exe
  C:\Windows\System\EQsJAAX.exe
  2⤵
  PID:12804
- C:\Windows\System\ZxUlxXC.exe
  C:\Windows\System\ZxUlxXC.exe
  2⤵
  PID:12828
- C:\Windows\System\sBnzxCT.exe
  C:\Windows\System\sBnzxCT.exe
  2⤵
  PID:12852
- C:\Windows\System\WobTbrw.exe
  C:\Windows\System\WobTbrw.exe
  2⤵
  PID:12872
- C:\Windows\System\fTiwteE.exe
  C:\Windows\System\fTiwteE.exe
  2⤵
  PID:12900
- C:\Windows\System\Olxnfgi.exe
  C:\Windows\System\Olxnfgi.exe
  2⤵
  PID:12944
- C:\Windows\System\oWCwDuO.exe
  C:\Windows\System\oWCwDuO.exe
  2⤵
  PID:12996
- C:\Windows\System\XqVJPIq.exe
  C:\Windows\System\XqVJPIq.exe
  2⤵
  PID:13016
- C:\Windows\System\pzCgYaU.exe
  C:\Windows\System\pzCgYaU.exe
  2⤵
  PID:13036
- C:\Windows\System\Ytodgny.exe
  C:\Windows\System\Ytodgny.exe
  2⤵
  PID:13064
- C:\Windows\System\QhrOSli.exe
  C:\Windows\System\QhrOSli.exe
  2⤵
  PID:13080
- C:\Windows\System\QCmKemw.exe
  C:\Windows\System\QCmKemw.exe
  2⤵
  PID:13108
- C:\Windows\System\mMuUFgi.exe
  C:\Windows\System\mMuUFgi.exe
  2⤵
  PID:13132
- C:\Windows\System\huNeJIp.exe
  C:\Windows\System\huNeJIp.exe
  2⤵
  PID:13180
- C:\Windows\System\uYXTBLP.exe
  C:\Windows\System\uYXTBLP.exe
  2⤵
  PID:13208
- C:\Windows\System\QVexxYe.exe
  C:\Windows\System\QVexxYe.exe
  2⤵
  PID:13260
- C:\Windows\System\degktNM.exe
  C:\Windows\System\degktNM.exe
  2⤵
  PID:13280
- C:\Windows\System\hGphYam.exe
  C:\Windows\System\hGphYam.exe
  2⤵
  PID:13304
- C:\Windows\System\XchFxMz.exe
  C:\Windows\System\XchFxMz.exe
  2⤵
  PID:12296
- C:\Windows\System\JBNBZtU.exe
  C:\Windows\System\JBNBZtU.exe
  2⤵
  PID:12316
- C:\Windows\System\hedwKPg.exe
  C:\Windows\System\hedwKPg.exe
  2⤵
  PID:12380
- C:\Windows\System\EcuOeDd.exe
  C:\Windows\System\EcuOeDd.exe
  2⤵
  PID:12428
- C:\Windows\System\iJxHzKM.exe
  C:\Windows\System\iJxHzKM.exe
  2⤵
  PID:12476
- C:\Windows\System\PPPkUuy.exe
  C:\Windows\System\PPPkUuy.exe
  2⤵
  PID:12500
- C:\Windows\System\hFAHZsK.exe
  C:\Windows\System\hFAHZsK.exe
  2⤵
  PID:12592
- C:\Windows\System\eUKgEXT.exe
  C:\Windows\System\eUKgEXT.exe
  2⤵
  PID:7360
- C:\Windows\System\UQrFIRr.exe
  C:\Windows\System\UQrFIRr.exe
  2⤵
  PID:12048
- C:\Windows\System\PTPJiTM.exe
  C:\Windows\System\PTPJiTM.exe
  2⤵
  PID:12768
- C:\Windows\System\TtDXgOQ.exe
  C:\Windows\System\TtDXgOQ.exe
  2⤵
  PID:12864
- C:\Windows\System\NvTnaDN.exe
  C:\Windows\System\NvTnaDN.exe
  2⤵
  PID:12888
- C:\Windows\System\XXIKSxk.exe
  C:\Windows\System\XXIKSxk.exe
  2⤵
  PID:12972
- C:\Windows\System\SgXOlQM.exe
  C:\Windows\System\SgXOlQM.exe
  2⤵
  PID:13072
- C:\Windows\System\wDlwrEJ.exe
  C:\Windows\System\wDlwrEJ.exe
  2⤵
  PID:13144
- C:\Windows\System\eQRyLZX.exe
  C:\Windows\System\eQRyLZX.exe
  2⤵
  PID:13216
- C:\Windows\System\YTivSbR.exe
  C:\Windows\System\YTivSbR.exe
  2⤵
  PID:13256
- C:\Windows\System\mRRJSJt.exe
  C:\Windows\System\mRRJSJt.exe
  2⤵
  PID:764
- C:\Windows\System\IQOefVB.exe
  C:\Windows\System\IQOefVB.exe
  2⤵
  PID:12532
- C:\Windows\System\ygDrNTn.exe
  C:\Windows\System\ygDrNTn.exe
  2⤵
  PID:12840
- C:\Windows\System\WtfxBtG.exe
  C:\Windows\System\WtfxBtG.exe
  2⤵
  PID:13092
- C:\Windows\System\FfhWbMU.exe
  C:\Windows\System\FfhWbMU.exe
  2⤵
  PID:13236
- C:\Windows\System\InfHsVu.exe
  C:\Windows\System\InfHsVu.exe
  2⤵
  PID:13204
- C:\Windows\System\fNWkhHW.exe
  C:\Windows\System\fNWkhHW.exe
  2⤵
  PID:12988
- C:\Windows\System\MLlcctu.exe
  C:\Windows\System\MLlcctu.exe
  2⤵
  PID:488
- C:\Windows\System\GvxRyJn.exe
  C:\Windows\System\GvxRyJn.exe
  2⤵
  PID:12492
- C:\Windows\System\nTMHwac.exe
  C:\Windows\System\nTMHwac.exe
  2⤵
  PID:12440
- C:\Windows\System\hmvgtff.exe
  C:\Windows\System\hmvgtff.exe
  2⤵
  PID:12692
- C:\Windows\System\ZIoQqRU.exe
  C:\Windows\System\ZIoQqRU.exe
  2⤵
  PID:13124
- C:\Windows\System\EzbXlGw.exe
  C:\Windows\System\EzbXlGw.exe
  2⤵
  PID:700
- C:\Windows\System\iMkMAXg.exe
  C:\Windows\System\iMkMAXg.exe
  2⤵
  PID:12660
- C:\Windows\System\HtbMQkH.exe
  C:\Windows\System\HtbMQkH.exe
  2⤵
  PID:2220
- C:\Windows\System\daJkjxo.exe
  C:\Windows\System\daJkjxo.exe
  2⤵
  PID:5080
- C:\Windows\System\OYgNIYT.exe
  C:\Windows\System\OYgNIYT.exe
  2⤵
  PID:1060
- C:\Windows\System\vrpWJSC.exe
  C:\Windows\System\vrpWJSC.exe
  2⤵
  PID:2676
- C:\Windows\System\iNjZVyT.exe
  C:\Windows\System\iNjZVyT.exe
  2⤵
  PID:5064
- C:\Windows\System\IJYuvhR.exe
  C:\Windows\System\IJYuvhR.exe
  2⤵
  PID:13052
- C:\Windows\System\CctVmbN.exe
  C:\Windows\System\CctVmbN.exe
  2⤵
  PID:4336
- C:\Windows\System\bqgtDkW.exe
  C:\Windows\System\bqgtDkW.exe
  2⤵
  PID:4616
- C:\Windows\System\AwNChrg.exe
  C:\Windows\System\AwNChrg.exe
  2⤵
  PID:12672
- C:\Windows\System\NiOwyHr.exe
  C:\Windows\System\NiOwyHr.exe
  2⤵
  PID:13220
- C:\Windows\System\cfhvrzu.exe
  C:\Windows\System\cfhvrzu.exe
  2⤵
  PID:6008
- C:\Windows\System\WwpSOoQ.exe
  C:\Windows\System\WwpSOoQ.exe
  2⤵
  PID:2824
- C:\Windows\System\afZxaAD.exe
  C:\Windows\System\afZxaAD.exe
  2⤵
  PID:13324
- C:\Windows\System\GFqchVt.exe
  C:\Windows\System\GFqchVt.exe
  2⤵
  PID:13356
- C:\Windows\System\XRgXJTe.exe
  C:\Windows\System\XRgXJTe.exe
  2⤵
  PID:13380
- C:\Windows\System\gNPnQGK.exe
  C:\Windows\System\gNPnQGK.exe
  2⤵
  PID:13420
- C:\Windows\System\BmlQaFK.exe
  C:\Windows\System\BmlQaFK.exe
  2⤵
  PID:13436
- C:\Windows\System\fmzKJxu.exe
  C:\Windows\System\fmzKJxu.exe
  2⤵
  PID:13468
- C:\Windows\System\udnyoBW.exe
  C:\Windows\System\udnyoBW.exe
  2⤵
  PID:13516
- C:\Windows\System\oVnACit.exe
  C:\Windows\System\oVnACit.exe
  2⤵
  PID:13556
- C:\Windows\System\WPTIrpo.exe
  C:\Windows\System\WPTIrpo.exe
  2⤵
  PID:13584
- C:\Windows\System\aVqstsl.exe
  C:\Windows\System\aVqstsl.exe
  2⤵
  PID:13600
- C:\Windows\System\IOUisid.exe
  C:\Windows\System\IOUisid.exe
  2⤵
  PID:13616
- C:\Windows\System\quvYCrK.exe
  C:\Windows\System\quvYCrK.exe
  2⤵
  PID:13640
- C:\Windows\System\ZvtssCi.exe
  C:\Windows\System\ZvtssCi.exe
  2⤵
  PID:13660
- C:\Windows\System\pMnTLjR.exe
  C:\Windows\System\pMnTLjR.exe
  2⤵
  PID:13680
- C:\Windows\System\yzpKgmw.exe
  C:\Windows\System\yzpKgmw.exe
  2⤵
  PID:13696
- C:\Windows\System\bsTSVQc.exe
  C:\Windows\System\bsTSVQc.exe
  2⤵
  PID:13712
- C:\Windows\System\ZJFSRdB.exe
  C:\Windows\System\ZJFSRdB.exe
  2⤵
  PID:13728
- C:\Windows\System\RlEfSAF.exe
  C:\Windows\System\RlEfSAF.exe
  2⤵
  PID:13744
- C:\Windows\System\JXLpUnr.exe
  C:\Windows\System\JXLpUnr.exe
  2⤵
  PID:13764
- C:\Windows\System\sMmRwiZ.exe
  C:\Windows\System\sMmRwiZ.exe
  2⤵
  PID:13784
- C:\Windows\System\DuMRSrQ.exe
  C:\Windows\System\DuMRSrQ.exe
  2⤵
  PID:13820
- C:\Windows\System\HjOmPUZ.exe
  C:\Windows\System\HjOmPUZ.exe
  2⤵
  PID:13836
- C:\Windows\System\zisXPLh.exe
  C:\Windows\System\zisXPLh.exe
  2⤵
  PID:13852
- C:\Windows\System\vQhTMsy.exe
  C:\Windows\System\vQhTMsy.exe
  2⤵
  PID:13868
- C:\Windows\System\sQMjYcP.exe
  C:\Windows\System\sQMjYcP.exe
  2⤵
  PID:13884
- C:\Windows\System\dDEoCDD.exe
  C:\Windows\System\dDEoCDD.exe
  2⤵
  PID:13900
- C:\Windows\System\GNEyjxj.exe
  C:\Windows\System\GNEyjxj.exe
  2⤵
  PID:13916
- C:\Windows\System\fAWkpoi.exe
  C:\Windows\System\fAWkpoi.exe
  2⤵
  PID:13944
- C:\Windows\System\wrckNAw.exe
  C:\Windows\System\wrckNAw.exe
  2⤵
  PID:13960
- C:\Windows\System\ZKMOvPT.exe
  C:\Windows\System\ZKMOvPT.exe
  2⤵
  PID:13980
- C:\Windows\System\SpLsqLh.exe
  C:\Windows\System\SpLsqLh.exe
  2⤵
  PID:14000
- C:\Windows\System\TTfmEYC.exe
  C:\Windows\System\TTfmEYC.exe
  2⤵
  PID:14016
- C:\Windows\System\EejMaQu.exe
  C:\Windows\System\EejMaQu.exe
  2⤵
  PID:14040
- C:\Windows\System\tqjbJiv.exe
  C:\Windows\System\tqjbJiv.exe
  2⤵
  PID:14064
- C:\Windows\System\scIqnla.exe
  C:\Windows\System\scIqnla.exe
  2⤵
  PID:14092
- C:\Windows\System\MkyJvhC.exe
  C:\Windows\System\MkyJvhC.exe
  2⤵
  PID:14116
- C:\Windows\System\qRvnjLE.exe
  C:\Windows\System\qRvnjLE.exe
  2⤵
  PID:14156
- C:\Windows\System\gcwbMlb.exe
  C:\Windows\System\gcwbMlb.exe
  2⤵
  PID:14176
- C:\Windows\System\MDQIScx.exe
  C:\Windows\System\MDQIScx.exe
  2⤵
  PID:14216
- C:\Windows\System\lWjZWkh.exe
  C:\Windows\System\lWjZWkh.exe
  2⤵
  PID:14260
- C:\Windows\System\gniCYdW.exe
  C:\Windows\System\gniCYdW.exe
  2⤵
  PID:14280
- C:\Windows\System\rbLiKSi.exe
  C:\Windows\System\rbLiKSi.exe
  2⤵
  PID:14312
- C:\Windows\System\ezzBoXC.exe
  C:\Windows\System\ezzBoXC.exe
  2⤵
  PID:6100
- C:\Windows\System\JDuLZyn.exe
  C:\Windows\System\JDuLZyn.exe
  2⤵
  PID:13376
- C:\Windows\System\jUPoEuT.exe
  C:\Windows\System\jUPoEuT.exe
  2⤵
  PID:13488
- C:\Windows\System\ERFmpPR.exe
  C:\Windows\System\ERFmpPR.exe
  2⤵
  PID:13412
- C:\Windows\System\OcRYenF.exe
  C:\Windows\System\OcRYenF.exe
  2⤵
  PID:4188
- C:\Windows\System\UQEQgWh.exe
  C:\Windows\System\UQEQgWh.exe
  2⤵
  PID:5340
- C:\Windows\System\sItuLhO.exe
  C:\Windows\System\sItuLhO.exe
  2⤵
  PID:13532
- C:\Windows\System\mLMaOid.exe
  C:\Windows\System\mLMaOid.exe
  2⤵
  PID:2956
- C:\Windows\System\BvduTRQ.exe
  C:\Windows\System\BvduTRQ.exe
  2⤵
  PID:13548
- C:\Windows\System\xRkigEE.exe
  C:\Windows\System\xRkigEE.exe
  2⤵
  PID:13672
- C:\Windows\System\AWFhTnp.exe
  C:\Windows\System\AWFhTnp.exe
  2⤵
  PID:13720
- C:\Windows\System\PcEvGmi.exe
  C:\Windows\System\PcEvGmi.exe
  2⤵
  PID:13632
- C:\Windows\System\IIApdLl.exe
  C:\Windows\System\IIApdLl.exe
  2⤵
  PID:13500
- C:\Windows\System\fUUPtqg.exe
  C:\Windows\System\fUUPtqg.exe
  2⤵
  PID:13752
- C:\Windows\System\GsWPGMC.exe
  C:\Windows\System\GsWPGMC.exe
  2⤵
  PID:13540
- C:\Windows\System\TnyyaTc.exe
  C:\Windows\System\TnyyaTc.exe
  2⤵
  PID:1040
- C:\Windows\System\ZHzESoT.exe
  C:\Windows\System\ZHzESoT.exe
  2⤵
  PID:7200
- C:\Windows\System\xzyWbZb.exe
  C:\Windows\System\xzyWbZb.exe
  2⤵
  PID:10244
- C:\Windows\System\HcfQbpW.exe
  C:\Windows\System\HcfQbpW.exe
  2⤵
  PID:208
- C:\Windows\System\YPFzmQR.exe
  C:\Windows\System\YPFzmQR.exe
  2⤵
  PID:3196
- C:\Windows\System\WciwEUM.exe
  C:\Windows\System\WciwEUM.exe
  2⤵
  PID:3180
- C:\Windows\System\fMTIHnk.exe
  C:\Windows\System\fMTIHnk.exe
  2⤵
  PID:13832
- C:\Windows\System\yzhUdKm.exe
  C:\Windows\System\yzhUdKm.exe
  2⤵
  PID:13864
- C:\Windows\System\xNDgaVK.exe
  C:\Windows\System\xNDgaVK.exe
  2⤵
  PID:13896
- C:\Windows\System\VeZPhix.exe
  C:\Windows\System\VeZPhix.exe
  2⤵
  PID:3860
- C:\Windows\System\JyrpwnV.exe
  C:\Windows\System\JyrpwnV.exe
  2⤵
  PID:13968
- C:\Windows\System\FDfHnEP.exe
  C:\Windows\System\FDfHnEP.exe
  2⤵
  PID:13976
- C:\Windows\System\YgcVJnS.exe
  C:\Windows\System\YgcVJnS.exe
  2⤵
  PID:2776
- C:\Windows\System\lSILFts.exe
  C:\Windows\System\lSILFts.exe
  2⤵
  PID:14012
- C:\Windows\System\LgAeGEI.exe
  C:\Windows\System\LgAeGEI.exe
  2⤵
  PID:3412
- C:\Windows\System\hfVLuNV.exe
  C:\Windows\System\hfVLuNV.exe
  2⤵
  PID:14052
- C:\Windows\System\zZOuJUx.exe
  C:\Windows\System\zZOuJUx.exe
  2⤵
  PID:14056
- C:\Windows\System\ULLiPpj.exe
  C:\Windows\System\ULLiPpj.exe
  2⤵
  PID:14076
- C:\Windows\System\URtPdjS.exe
  C:\Windows\System\URtPdjS.exe
  2⤵
  PID:14148
- C:\Windows\System\imyXbHw.exe
  C:\Windows\System\imyXbHw.exe
  2⤵
  PID:14100
- C:\Windows\System\znRGeyt.exe
  C:\Windows\System\znRGeyt.exe
  2⤵
  PID:4528
- C:\Windows\System\Jjdsepr.exe
  C:\Windows\System\Jjdsepr.exe
  2⤵
  PID:6328
- C:\Windows\System\xNhRCsY.exe
  C:\Windows\System\xNhRCsY.exe
  2⤵
  PID:2108
- C:\Windows\System\USjBWxu.exe
  C:\Windows\System\USjBWxu.exe
  2⤵
  PID:14192
- C:\Windows\System\TMkZUzk.exe
  C:\Windows\System\TMkZUzk.exe
  2⤵
  PID:392
- C:\Windows\System\EfRkMVD.exe
  C:\Windows\System\EfRkMVD.exe
  2⤵
  PID:2284
- C:\Windows\System\MKiziqT.exe
  C:\Windows\System\MKiziqT.exe
  2⤵
  PID:14232
- C:\Windows\System\NDjVXXU.exe
  C:\Windows\System\NDjVXXU.exe
  2⤵
  PID:14252
- C:\Windows\System\JAQbaQk.exe
  C:\Windows\System\JAQbaQk.exe
  2⤵
  PID:14276
- C:\Windows\System\RGMCNKw.exe
  C:\Windows\System\RGMCNKw.exe
  2⤵
  PID:14212
- C:\Windows\System\WiuVXbr.exe
  C:\Windows\System\WiuVXbr.exe
  2⤵
  PID:4500
- C:\Windows\System\YcYFYPQ.exe
  C:\Windows\System\YcYFYPQ.exe
  2⤵
  PID:7436
- C:\Windows\System\WvpFAkd.exe
  C:\Windows\System\WvpFAkd.exe
  2⤵
  PID:7472
- C:\Windows\System\YDeqotK.exe
  C:\Windows\System\YDeqotK.exe
  2⤵
  PID:7488
- C:\Windows\System\IcnDOxg.exe
  C:\Windows\System\IcnDOxg.exe
  2⤵
  PID:7620
- C:\Windows\System\NdpGjBR.exe
  C:\Windows\System\NdpGjBR.exe
  2⤵
  PID:7668
- C:\Windows\System\RNoEeeE.exe
  C:\Windows\System\RNoEeeE.exe
  2⤵
  PID:7776
- C:\Windows\System\ixXtbyj.exe
  C:\Windows\System\ixXtbyj.exe
  2⤵
  PID:7860
- C:\Windows\System\oDJziEr.exe
  C:\Windows\System\oDJziEr.exe
  2⤵
  PID:7868
- C:\Windows\System\MBiweTp.exe
  C:\Windows\System\MBiweTp.exe
  2⤵
  PID:8012
- C:\Windows\System\UiBpXne.exe
  C:\Windows\System\UiBpXne.exe
  2⤵
  PID:8036
- C:\Windows\System\WKamNSA.exe
  C:\Windows\System\WKamNSA.exe
  2⤵
  PID:8092
- C:\Windows\System\CHUSBVE.exe
  C:\Windows\System\CHUSBVE.exe
  2⤵
  PID:7324
- C:\Windows\System\OWhRlzS.exe
  C:\Windows\System\OWhRlzS.exe
  2⤵
  PID:4260
- C:\Windows\System\IFpMgGr.exe
  C:\Windows\System\IFpMgGr.exe
  2⤵
  PID:1396
- C:\Windows\System\nzvjYwX.exe
  C:\Windows\System\nzvjYwX.exe
  2⤵
  PID:7368
- C:\Windows\System\aWPkZdn.exe
  C:\Windows\System\aWPkZdn.exe
  2⤵
  PID:7492
- C:\Windows\System\QQewtWd.exe
  C:\Windows\System\QQewtWd.exe
  2⤵
  PID:7844
- C:\Windows\System\idpMxFV.exe
  C:\Windows\System\idpMxFV.exe
  2⤵
  PID:7944
- C:\Windows\System\xvVezPc.exe
  C:\Windows\System\xvVezPc.exe
  2⤵
  PID:7276
- C:\Windows\System\XpEDgmY.exe
  C:\Windows\System\XpEDgmY.exe
  2⤵
  PID:7920
- C:\Windows\System\eEOLOdd.exe
  C:\Windows\System\eEOLOdd.exe
  2⤵
  PID:7496
- C:\Windows\System\bdxgark.exe
  C:\Windows\System\bdxgark.exe
  2⤵
  PID:8056
- C:\Windows\System\jiIeURj.exe
  C:\Windows\System\jiIeURj.exe
  2⤵
  PID:7872
- C:\Windows\System\iVblyvG.exe
  C:\Windows\System\iVblyvG.exe
  2⤵
  PID:8260
- C:\Windows\System\Snbeogm.exe
  C:\Windows\System\Snbeogm.exe
  2⤵
  PID:8288
- C:\Windows\System\NtNXhCx.exe
  C:\Windows\System\NtNXhCx.exe
  2⤵
  PID:8336
- C:\Windows\System\xMAoRKC.exe
  C:\Windows\System\xMAoRKC.exe
  2⤵
  PID:8444
- C:\Windows\System\mYGHVps.exe
  C:\Windows\System\mYGHVps.exe
  2⤵
  PID:8448
- C:\Windows\System\dQZzxke.exe
  C:\Windows\System\dQZzxke.exe
  2⤵
  PID:4660
- C:\Windows\System\kANhKOC.exe
  C:\Windows\System\kANhKOC.exe
  2⤵
  PID:2448
- C:\Windows\System\KDVjUSJ.exe
  C:\Windows\System\KDVjUSJ.exe
  2⤵
  PID:3964
- C:\Windows\System\skwGqDx.exe
  C:\Windows\System\skwGqDx.exe
  2⤵
  PID:836
- C:\Windows\System\LRIIcRi.exe
  C:\Windows\System\LRIIcRi.exe
  2⤵
  PID:4960
- C:\Windows\System\CRJzzmC.exe
  C:\Windows\System\CRJzzmC.exe
  2⤵
  PID:4992
- C:\Windows\System\TcFdbMG.exe
  C:\Windows\System\TcFdbMG.exe
  2⤵
  PID:13428
- C:\Windows\System\NpPCwBi.exe
  C:\Windows\System\NpPCwBi.exe
  2⤵
  PID:1800
- C:\Windows\System\CIjmAJe.exe
  C:\Windows\System\CIjmAJe.exe
  2⤵
  PID:6980
- C:\Windows\System\tTnoPcM.exe
  C:\Windows\System\tTnoPcM.exe
  2⤵
  PID:1176
- C:\Windows\System\HOhlQGy.exe
  C:\Windows\System\HOhlQGy.exe
  2⤵
  PID:13396
- C:\Windows\System\YDlXiQf.exe
  C:\Windows\System\YDlXiQf.exe
  2⤵
  PID:2728
- C:\Windows\System\ZAYxFBn.exe
  C:\Windows\System\ZAYxFBn.exe
  2⤵
  PID:4360
- C:\Windows\System\dFBAlrO.exe
  C:\Windows\System\dFBAlrO.exe
  2⤵
  PID:8792
- C:\Windows\System\ZUIOQYS.exe
  C:\Windows\System\ZUIOQYS.exe
  2⤵
  PID:4708
- C:\Windows\System\XdKZZBu.exe
  C:\Windows\System\XdKZZBu.exe
  2⤵
  PID:8968
- C:\Windows\System\hzenPQW.exe
  C:\Windows\System\hzenPQW.exe
  2⤵
  PID:14328
- C:\Windows\System\EcxvFgv.exe
  C:\Windows\System\EcxvFgv.exe
  2⤵
  PID:13332
- C:\Windows\System\gCLhkek.exe
  C:\Windows\System\gCLhkek.exe
  2⤵
  PID:13388
- C:\Windows\System\OyjWIzC.exe
  C:\Windows\System\OyjWIzC.exe
  2⤵
  PID:7092
- C:\Windows\System\ymuodoz.exe
  C:\Windows\System\ymuodoz.exe
  2⤵
  PID:5412
- C:\Windows\System\swsEuGr.exe
  C:\Windows\System\swsEuGr.exe
  2⤵
  PID:5448
- C:\Windows\System\LGRFXMJ.exe
  C:\Windows\System\LGRFXMJ.exe
  2⤵
  PID:4080
- C:\Windows\System\huXohWs.exe
  C:\Windows\System\huXohWs.exe
  2⤵
  PID:5240
- C:\Windows\System\fvQCYJF.exe
  C:\Windows\System\fvQCYJF.exe
  2⤵
  PID:5108
- C:\Windows\System\AATMUsC.exe
  C:\Windows\System\AATMUsC.exe
  2⤵
  PID:228
- C:\Windows\System\wHmuvdt.exe
  C:\Windows\System\wHmuvdt.exe
  2⤵
  PID:5208
- C:\Windows\System\nVBAkWC.exe
  C:\Windows\System\nVBAkWC.exe
  2⤵
  PID:8648
- C:\Windows\System\RgRWWAD.exe
  C:\Windows\System\RgRWWAD.exe
  2⤵
  PID:8868
- C:\Windows\System\SLxodEZ.exe
  C:\Windows\System\SLxodEZ.exe
  2⤵
  PID:8924
- C:\Windows\System\xVfdsHI.exe
  C:\Windows\System\xVfdsHI.exe
  2⤵
  PID:9168
- C:\Windows\System\ybtUcRi.exe
  C:\Windows\System\ybtUcRi.exe
  2⤵
  PID:9208
- C:\Windows\System\CAnBhRb.exe
  C:\Windows\System\CAnBhRb.exe
  2⤵
  PID:8580
- C:\Windows\System\NbVWCsw.exe
  C:\Windows\System\NbVWCsw.exe
  2⤵
  PID:9028
- C:\Windows\System\PliqOfC.exe
  C:\Windows\System\PliqOfC.exe
  2⤵
  PID:13568
- C:\Windows\System\NAZckCg.exe
  C:\Windows\System\NAZckCg.exe
  2⤵
  PID:5628
- C:\Windows\System\rdkNTab.exe
  C:\Windows\System\rdkNTab.exe
  2⤵
  PID:5572
- C:\Windows\System\vbqaIai.exe
  C:\Windows\System\vbqaIai.exe
  2⤵
  PID:5772
- C:\Windows\System\VGXkEJx.exe
  C:\Windows\System\VGXkEJx.exe
  2⤵
  PID:5736
- C:\Windows\System\HZkkSmb.exe
  C:\Windows\System\HZkkSmb.exe
  2⤵
  PID:13736
- C:\Windows\System\irUFSwx.exe
  C:\Windows\System\irUFSwx.exe
  2⤵
  PID:13508
- C:\Windows\System\DtwQREZ.exe
  C:\Windows\System\DtwQREZ.exe
  2⤵
  PID:5840
- C:\Windows\System\RQpmVXA.exe
  C:\Windows\System\RQpmVXA.exe
  2⤵
  PID:5884
- C:\Windows\System\JesULWP.exe
  C:\Windows\System\JesULWP.exe
  2⤵
  PID:13552
- C:\Windows\System\JllzKNe.exe
  C:\Windows\System\JllzKNe.exe
  2⤵
  PID:13564
- C:\Windows\System\QtLAvNP.exe
  C:\Windows\System\QtLAvNP.exe
  2⤵
  PID:13524
- C:\Windows\System\ThjUrqD.exe
  C:\Windows\System\ThjUrqD.exe
  2⤵
  PID:9692
- C:\Windows\System\FyRRrMT.exe
  C:\Windows\System\FyRRrMT.exe
  2⤵
  PID:6056
- C:\Windows\System\ruNPFbz.exe
  C:\Windows\System\ruNPFbz.exe
  2⤵
  PID:13456
- C:\Windows\System\bUFexnU.exe
  C:\Windows\System\bUFexnU.exe
  2⤵
  PID:2208
- C:\Windows\System\inmfkKB.exe
  C:\Windows\System\inmfkKB.exe
  2⤵
  PID:2592
- C:\Windows\System\LeMEjTt.exe
  C:\Windows\System\LeMEjTt.exe
  2⤵
  PID:9892
- C:\Windows\System\DzpJXjm.exe
  C:\Windows\System\DzpJXjm.exe
  2⤵
  PID:6140
- C:\Windows\System\BPJTtir.exe
  C:\Windows\System\BPJTtir.exe
  2⤵
  PID:9940
- C:\Windows\System\KNzOPBD.exe
  C:\Windows\System\KNzOPBD.exe
  2⤵
  PID:9980
- C:\Windows\System\iRBSopr.exe
  C:\Windows\System\iRBSopr.exe
  2⤵
  PID:13816
- C:\Windows\System\qYHeOyy.exe
  C:\Windows\System\qYHeOyy.exe
  2⤵
  PID:2720
- C:\Windows\System\hXAZaQU.exe
  C:\Windows\System\hXAZaQU.exe
  2⤵
  PID:13880
- C:\Windows\System\wbLBvwJ.exe
  C:\Windows\System\wbLBvwJ.exe
  2⤵
  PID:13936
- C:\Windows\System\EZTriOy.exe
  C:\Windows\System\EZTriOy.exe
  2⤵
  PID:13952
- C:\Windows\System\ewwcBvZ.exe
  C:\Windows\System\ewwcBvZ.exe
  2⤵
  PID:10220
- C:\Windows\System\DEusTvA.exe
  C:\Windows\System\DEusTvA.exe
  2⤵
  PID:9220
- C:\Windows\System\fPXJrmG.exe
  C:\Windows\System\fPXJrmG.exe
  2⤵
  PID:5292
- C:\Windows\System\VWjnpet.exe
  C:\Windows\System\VWjnpet.exe
  2⤵
  PID:2688
- C:\Windows\System\rhiiNKn.exe
  C:\Windows\System\rhiiNKn.exe
  2⤵
  PID:5320
- C:\Windows\System\fRuxduP.exe
  C:\Windows\System\fRuxduP.exe
  2⤵
  PID:728
- C:\Windows\System\kKAxirB.exe
  C:\Windows\System\kKAxirB.exe
  2⤵
  PID:10024
- C:\Windows\System\xYBMeKd.exe
  C:\Windows\System\xYBMeKd.exe
  2⤵
  PID:4724
- C:\Windows\System\HTUDRWH.exe
  C:\Windows\System\HTUDRWH.exe
  2⤵
  PID:14088
- C:\Windows\System\ZKBNeQj.exe
  C:\Windows\System\ZKBNeQj.exe
  2⤵
  PID:4244
- C:\Windows\System\eyCAXwr.exe
  C:\Windows\System\eyCAXwr.exe
  2⤵
  PID:5352
- C:\Windows\System\DBHNlyh.exe
  C:\Windows\System\DBHNlyh.exe
  2⤵
  PID:13988
- C:\Windows\System\FMINeyi.exe
  C:\Windows\System\FMINeyi.exe
  2⤵
  PID:4944
- C:\Windows\System\QonEwQI.exe
  C:\Windows\System\QonEwQI.exe
  2⤵
  PID:4892
- C:\Windows\System\gHRnKiC.exe
  C:\Windows\System\gHRnKiC.exe
  2⤵
  PID:2708
- C:\Windows\System\xidDXKo.exe
  C:\Windows\System\xidDXKo.exe
  2⤵
  PID:14200
- C:\Windows\System\eDVJxfw.exe
  C:\Windows\System\eDVJxfw.exe
  2⤵
  PID:14296
- C:\Windows\System\FsElWqJ.exe
  C:\Windows\System\FsElWqJ.exe
  2⤵
  PID:5528
- C:\Windows\System\KdjnMGw.exe
  C:\Windows\System\KdjnMGw.exe
  2⤵
  PID:14128
- C:\Windows\System\wuhPNyj.exe
  C:\Windows\System\wuhPNyj.exe
  2⤵
  PID:14184
- C:\Windows\System\WKyYsls.exe
  C:\Windows\System\WKyYsls.exe
  2⤵
  PID:14168
- C:\Windows\System\dmwSytx.exe
  C:\Windows\System\dmwSytx.exe
  2⤵
  PID:5824
- C:\Windows\System\TGTfpgz.exe
  C:\Windows\System\TGTfpgz.exe
  2⤵
  PID:10176
- C:\Windows\System\VEuqlZH.exe
  C:\Windows\System\VEuqlZH.exe
  2⤵
  PID:7340
- C:\Windows\System\ltToNrS.exe
  C:\Windows\System\ltToNrS.exe
  2⤵
  PID:9920
- C:\Windows\System\JUiHmqt.exe
  C:\Windows\System\JUiHmqt.exe
  2⤵
  PID:7524
- C:\Windows\System\vPfWPzZ.exe
  C:\Windows\System\vPfWPzZ.exe
  2⤵
  PID:5956
- C:\Windows\System\wFzphmv.exe
  C:\Windows\System\wFzphmv.exe
  2⤵
  PID:7556
- C:\Windows\System\dljLjZK.exe
  C:\Windows\System\dljLjZK.exe
  2⤵
  PID:6020
- C:\Windows\System\KLXxzSk.exe
  C:\Windows\System\KLXxzSk.exe
  2⤵
  PID:7732
- C:\Windows\System\gKkdFPi.exe
  C:\Windows\System\gKkdFPi.exe
  2⤵
  PID:7836
- C:\Windows\System\tZGMxOU.exe
  C:\Windows\System\tZGMxOU.exe
  2⤵
  PID:6132
- C:\Windows\System\RzSRTfW.exe
  C:\Windows\System\RzSRTfW.exe
  2⤵
  PID:7896
- C:\Windows\System\Jtcnszy.exe
  C:\Windows\System\Jtcnszy.exe
  2⤵
  PID:2320
- C:\Windows\System\gtfBHdy.exe
  C:\Windows\System\gtfBHdy.exe
  2⤵
  PID:5324
- C:\Windows\System\GhzzLAS.exe
  C:\Windows\System\GhzzLAS.exe
  2⤵
  PID:10444
- C:\Windows\System\gRpKWIu.exe
  C:\Windows\System\gRpKWIu.exe
  2⤵
  PID:8184
- C:\Windows\System\DrNnhUt.exe
  C:\Windows\System\DrNnhUt.exe
  2⤵
  PID:5660
- C:\Windows\System\Noxekhv.exe
  C:\Windows\System\Noxekhv.exe
  2⤵
  PID:5904
- C:\Windows\System\EydnHEQ.exe
  C:\Windows\System\EydnHEQ.exe
  2⤵
  PID:7516
- C:\Windows\System\YAiDThC.exe
  C:\Windows\System\YAiDThC.exe
  2⤵
  PID:6228
- C:\Windows\System\kuhsWaT.exe
  C:\Windows\System\kuhsWaT.exe
  2⤵
  PID:6240
- C:\Windows\System\wPIhBMG.exe
  C:\Windows\System\wPIhBMG.exe
  2⤵
  PID:8072
- C:\Windows\System\EwbkjWE.exe
  C:\Windows\System\EwbkjWE.exe
  2⤵
  PID:8112
- C:\Windows\System\UgnQAYB.exe
  C:\Windows\System\UgnQAYB.exe
  2⤵
  PID:6376
- C:\Windows\System\PLCUQeM.exe
  C:\Windows\System\PLCUQeM.exe
  2⤵
  PID:8116
- C:\Windows\System\lLfcqGo.exe
  C:\Windows\System\lLfcqGo.exe
  2⤵
  PID:8212
- C:\Windows\System\HBwSlhP.exe
  C:\Windows\System\HBwSlhP.exe
  2⤵
  PID:6408
- C:\Windows\System\hTagWTE.exe
  C:\Windows\System\hTagWTE.exe
  2⤵
  PID:6452
- C:\Windows\System\wYjIpZo.exe
  C:\Windows\System\wYjIpZo.exe
  2⤵
  PID:11144
- C:\Windows\System\qmsodFY.exe
  C:\Windows\System\qmsodFY.exe
  2⤵
  PID:6464
- C:\Windows\System\bEmTCan.exe
  C:\Windows\System\bEmTCan.exe
  2⤵
  PID:8496
- C:\Windows\System\rtuGPiz.exe
  C:\Windows\System\rtuGPiz.exe
  2⤵
  PID:14308
- C:\Windows\System\AZsPVYf.exe
  C:\Windows\System\AZsPVYf.exe
  2⤵
  PID:11260
- C:\Windows\System\CjecaJe.exe
  C:\Windows\System\CjecaJe.exe
  2⤵
  PID:6520
- C:\Windows\System\AWeMybV.exe
  C:\Windows\System\AWeMybV.exe
  2⤵
  PID:6548
- C:\Windows\System\DMHQcIQ.exe
  C:\Windows\System\DMHQcIQ.exe
  2⤵
  PID:12528
- C:\Windows\System\cIfqABk.exe
  C:\Windows\System\cIfqABk.exe
  2⤵
  PID:380
- C:\Windows\System\dpslyMz.exe
  C:\Windows\System\dpslyMz.exe
  2⤵
  PID:1964
- C:\Windows\System\oauEYYm.exe
  C:\Windows\System\oauEYYm.exe
  2⤵
  PID:5248
- C:\Windows\System\xHUHUBm.exe
  C:\Windows\System\xHUHUBm.exe
  2⤵
  PID:5304
- C:\Windows\System\BGbJbAZ.exe
  C:\Windows\System\BGbJbAZ.exe
  2⤵
  PID:4932
- C:\Windows\System\ykQwhZR.exe
  C:\Windows\System\ykQwhZR.exe
  2⤵
  PID:10652
- C:\Windows\System\DFVREiJ.exe
  C:\Windows\System\DFVREiJ.exe
  2⤵
  PID:8788
- C:\Windows\System\NiVNuuI.exe
  C:\Windows\System\NiVNuuI.exe
  2⤵
  PID:3564
- C:\Windows\System\eylhjrX.exe
  C:\Windows\System\eylhjrX.exe
  2⤵
  PID:5192
- C:\Windows\System\sXSYJBf.exe
  C:\Windows\System\sXSYJBf.exe
  2⤵
  PID:6748
- C:\Windows\System\KsbCarn.exe
  C:\Windows\System\KsbCarn.exe
  2⤵
  PID:5376
- C:\Windows\System\dpoxiaT.exe
  C:\Windows\System\dpoxiaT.exe
  2⤵
  PID:6776
- C:\Windows\System\loacNKU.exe
  C:\Windows\System\loacNKU.exe
  2⤵
  PID:10932
- C:\Windows\System\zlXrNOU.exe
  C:\Windows\System\zlXrNOU.exe
  2⤵
  PID:10836
- C:\Windows\System\yTwIUip.exe
  C:\Windows\System\yTwIUip.exe
  2⤵
  PID:5260
- C:\Windows\System\tTcdbXR.exe
  C:\Windows\System\tTcdbXR.exe
  2⤵
  PID:6836
- C:\Windows\System\QvDUrSH.exe
  C:\Windows\System\QvDUrSH.exe
  2⤵
  PID:4320
- C:\Windows\System\UmJnIfs.exe
  C:\Windows\System\UmJnIfs.exe
  2⤵
  PID:6868
- C:\Windows\System\zDeqiqm.exe
  C:\Windows\System\zDeqiqm.exe
  2⤵
  PID:3652
- C:\Windows\System\FDeNHBt.exe
  C:\Windows\System\FDeNHBt.exe
  2⤵
  PID:8460
- C:\Windows\System\JDzfNUx.exe
  C:\Windows\System\JDzfNUx.exe
  2⤵
  PID:8928
- C:\Windows\System\uECmqnx.exe
  C:\Windows\System\uECmqnx.exe
  2⤵
  PID:11568
- C:\Windows\System\SdiDvqS.exe
  C:\Windows\System\SdiDvqS.exe
  2⤵
  PID:8392
- C:\Windows\System\osWbxVC.exe
  C:\Windows\System\osWbxVC.exe
  2⤵
  PID:9124
- C:\Windows\System\ZvYLFTb.exe
  C:\Windows\System\ZvYLFTb.exe
  2⤵
  PID:8596
- C:\Windows\System\uWtrAMT.exe
  C:\Windows\System\uWtrAMT.exe
  2⤵
  PID:5504
- C:\Windows\System\jYnlKOe.exe
  C:\Windows\System\jYnlKOe.exe
  2⤵
  PID:13544
- C:\Windows\System\zyUtfpS.exe
  C:\Windows\System\zyUtfpS.exe
  2⤵
  PID:7960
- C:\Windows\System\FdvJXFI.exe
  C:\Windows\System\FdvJXFI.exe
  2⤵
  PID:8752
- C:\Windows\System\qKMikxW.exe
  C:\Windows\System\qKMikxW.exe
  2⤵
  PID:8992
- C:\Windows\System\YVrabnL.exe
  C:\Windows\System\YVrabnL.exe
  2⤵
  PID:3384
- C:\Windows\System\numbBNf.exe
  C:\Windows\System\numbBNf.exe
  2⤵
  PID:8620
- C:\Windows\System\yrefITK.exe
  C:\Windows\System\yrefITK.exe
  2⤵
  PID:13536
- C:\Windows\System\piDOGFa.exe
  C:\Windows\System\piDOGFa.exe
  2⤵
  PID:6136
- C:\Windows\System\EVfjhUX.exe
  C:\Windows\System\EVfjhUX.exe
  2⤵
  PID:5816
- C:\Windows\System\CmjjFGt.exe
  C:\Windows\System\CmjjFGt.exe
  2⤵
  PID:11884
- C:\Windows\System\PffIKoo.exe
  C:\Windows\System\PffIKoo.exe
  2⤵
  PID:5744
- C:\Windows\System\rJXZyDW.exe
  C:\Windows\System\rJXZyDW.exe
  2⤵
  PID:13580
- C:\Windows\System\QsIVBXV.exe
  C:\Windows\System\QsIVBXV.exe
  2⤵
  PID:11996
- C:\Windows\System\aYVvwRG.exe
  C:\Windows\System\aYVvwRG.exe
  2⤵
  PID:5912
- C:\Windows\System\cWHzIvu.exe
  C:\Windows\System\cWHzIvu.exe
  2⤵
  PID:12024
- C:\Windows\System\aWTLjDt.exe
  C:\Windows\System\aWTLjDt.exe
  2⤵
  PID:13628
- C:\Windows\System\UxtFOKr.exe
  C:\Windows\System\UxtFOKr.exe
  2⤵
  PID:13452
- C:\Windows\System\hBgEtMP.exe
  C:\Windows\System\hBgEtMP.exe
  2⤵
  PID:12200
- C:\Windows\System\YIpTxvI.exe
  C:\Windows\System\YIpTxvI.exe
  2⤵
  PID:12248
- C:\Windows\System\syefRQf.exe
  C:\Windows\System\syefRQf.exe
  2⤵
  PID:9672
- C:\Windows\System\zHWboTT.exe
  C:\Windows\System\zHWboTT.exe
  2⤵
  PID:9716
- C:\Windows\System\HpXdqfH.exe
  C:\Windows\System\HpXdqfH.exe
  2⤵
  PID:6068
- C:\Windows\System\hNFzHMS.exe
  C:\Windows\System\hNFzHMS.exe
  2⤵
  PID:2968
- C:\Windows\System\hKbpeMg.exe
  C:\Windows\System\hKbpeMg.exe
  2⤵
  PID:4752
- C:\Windows\System\zJyOIpR.exe
  C:\Windows\System\zJyOIpR.exe
  2⤵
  PID:6096
- C:\Windows\System\VFkUExv.exe
  C:\Windows\System\VFkUExv.exe
  2⤵
  PID:9952
- C:\Windows\System\ZvoVHrE.exe
  C:\Windows\System\ZvoVHrE.exe
  2⤵
  PID:3200
- C:\Windows\System\MSDfeWf.exe
  C:\Windows\System\MSDfeWf.exe
  2⤵
  PID:12012
- C:\Windows\System\cntBWdp.exe
  C:\Windows\System\cntBWdp.exe
  2⤵
  PID:13860
- C:\Windows\System\jbbICMr.exe
  C:\Windows\System\jbbICMr.exe
  2⤵
  PID:6992
- C:\Windows\System\wHQAFzj.exe
  C:\Windows\System\wHQAFzj.exe
  2⤵
  PID:3916
- C:\Windows\System\nVvLHZR.exe
  C:\Windows\System\nVvLHZR.exe
  2⤵
  PID:14028
- C:\Windows\System\LnlAhVQ.exe
  C:\Windows\System\LnlAhVQ.exe
  2⤵
  PID:12204
- C:\Windows\System\QkImUSS.exe
  C:\Windows\System\QkImUSS.exe
  2⤵
  PID:4956
- C:\Windows\System\WLyPawv.exe
  C:\Windows\System\WLyPawv.exe
  2⤵
  PID:14132
- C:\Windows\System\hKElKOS.exe
  C:\Windows\System\hKElKOS.exe
  2⤵
  PID:14144
- C:\Windows\System\VpdlMxZ.exe
  C:\Windows\System\VpdlMxZ.exe
  2⤵
  PID:6388
- C:\Windows\System\FOAWWgv.exe
  C:\Windows\System\FOAWWgv.exe
  2⤵
  PID:1052
- C:\Windows\System\ntxiNVt.exe
  C:\Windows\System\ntxiNVt.exe
  2⤵
  PID:4292
- C:\Windows\System\nmISSax.exe
  C:\Windows\System\nmISSax.exe
  2⤵
  PID:12348
- C:\Windows\System\cVtQEHT.exe
  C:\Windows\System\cVtQEHT.exe
  2⤵
  PID:6612
- C:\Windows\System\VWnUttd.exe
  C:\Windows\System\VWnUttd.exe
  2⤵
  PID:12444
- C:\Windows\System\ODoEUbf.exe
  C:\Windows\System\ODoEUbf.exe
  2⤵
  PID:4964
- C:\Windows\System\LoSoEod.exe
  C:\Windows\System\LoSoEod.exe
  2⤵
  PID:1920
- C:\Windows\System\ZwjkAwM.exe
  C:\Windows\System\ZwjkAwM.exe
  2⤵
  PID:12524
- C:\Windows\System\ZWMUzFA.exe
  C:\Windows\System\ZWMUzFA.exe
  2⤵
  PID:12644
- C:\Windows\System\pnNEIko.exe
  C:\Windows\System\pnNEIko.exe
  2⤵
  PID:12688
- C:\Windows\System\KlLmrNY.exe
  C:\Windows\System\KlLmrNY.exe
  2⤵
  PID:5724
- C:\Windows\System\xtaTaDr.exe
  C:\Windows\System\xtaTaDr.exe
  2⤵
  PID:3816
- C:\Windows\System\eNTRivK.exe
  C:\Windows\System\eNTRivK.exe
  2⤵
  PID:14248
- C:\Windows\System\cMNGpFX.exe
  C:\Windows\System\cMNGpFX.exe
  2⤵
  PID:12964
- C:\Windows\System\NXcPjPe.exe
  C:\Windows\System\NXcPjPe.exe
  2⤵
  PID:6012
- C:\Windows\System\HyPEtwD.exe
  C:\Windows\System\HyPEtwD.exe
  2⤵
  PID:7632
- C:\Windows\System\VZrWZfk.exe
  C:\Windows\System\VZrWZfk.exe
  2⤵
  PID:7744
- C:\Windows\System\DklnaTO.exe
  C:\Windows\System\DklnaTO.exe
  2⤵
  PID:13228
- C:\Windows\System\QvIgZGP.exe
  C:\Windows\System\QvIgZGP.exe
  2⤵
  PID:8132
- C:\Windows\System\FqwqrBk.exe
  C:\Windows\System\FqwqrBk.exe
  2⤵
  PID:6156
- C:\Windows\System\kKRFuFf.exe
  C:\Windows\System\kKRFuFf.exe
  2⤵
  PID:2872
- C:\Windows\System\AgTcOzD.exe
  C:\Windows\System\AgTcOzD.exe
  2⤵
  PID:12952
- C:\Windows\System\wJYFwmY.exe
  C:\Windows\System\wJYFwmY.exe
  2⤵
  PID:7652
- C:\Windows\System\UjfAFna.exe
  C:\Windows\System\UjfAFna.exe
  2⤵
  PID:7880
- C:\Windows\System\ZTjRxKi.exe
  C:\Windows\System\ZTjRxKi.exe
  2⤵
  PID:7948
- C:\Windows\System\lNxNelg.exe
  C:\Windows\System\lNxNelg.exe
  2⤵
  PID:7736
- C:\Windows\System\IaalERf.exe
  C:\Windows\System\IaalERf.exe
  2⤵
  PID:6256
- C:\Windows\System\nIUBLmO.exe
  C:\Windows\System\nIUBLmO.exe
  2⤵
  PID:8076
- C:\Windows\System\olyLBCq.exe
  C:\Windows\System\olyLBCq.exe
  2⤵
  PID:4308
- C:\Windows\System\ruRWvdY.exe
  C:\Windows\System\ruRWvdY.exe
  2⤵
  PID:8408
- C:\Windows\System\KdudNzo.exe
  C:\Windows\System\KdudNzo.exe
  2⤵
  PID:6492
- C:\Windows\System\jeNcMoL.exe
  C:\Windows\System\jeNcMoL.exe
  2⤵
  PID:4588
- C:\Windows\System\SxNkwHc.exe
  C:\Windows\System\SxNkwHc.exe
  2⤵
  PID:12800
- C:\Windows\System\PhnvTiG.exe
  C:\Windows\System\PhnvTiG.exe
  2⤵
  PID:5880
- C:\Windows\System\SBLEefU.exe
  C:\Windows\System\SBLEefU.exe
  2⤵
  PID:1464
- C:\Windows\System\fDGBhLA.exe
  C:\Windows\System\fDGBhLA.exe
  2⤵
  PID:5156
- C:\Windows\System\AbYFUJs.exe
  C:\Windows\System\AbYFUJs.exe
  2⤵
  PID:10620
- C:\Windows\System\aJWudtx.exe
  C:\Windows\System\aJWudtx.exe
  2⤵
  PID:2212
- C:\Windows\System\nvAdMgO.exe
  C:\Windows\System\nvAdMgO.exe
  2⤵
  PID:3116
- C:\Windows\System\eLDCCex.exe
  C:\Windows\System\eLDCCex.exe
  2⤵
  PID:8860
- C:\Windows\System\ezUcxQj.exe
  C:\Windows\System\ezUcxQj.exe
  2⤵
  PID:8988
- C:\Windows\System\DgQTTRt.exe
  C:\Windows\System\DgQTTRt.exe
  2⤵
  PID:5364
- C:\Windows\System\tpOAgMp.exe
  C:\Windows\System\tpOAgMp.exe
  2⤵
  PID:6804
- C:\Windows\System\ZmmJwdB.exe
  C:\Windows\System\ZmmJwdB.exe
  2⤵
  PID:7232
- C:\Windows\System\HhnWqvX.exe
  C:\Windows\System\HhnWqvX.exe
  2⤵
  PID:7316
- C:\Windows\System\qEjStWP.exe
  C:\Windows\System\qEjStWP.exe
  2⤵
  PID:10804
- C:\Windows\System\KQztPCb.exe
  C:\Windows\System\KQztPCb.exe
  2⤵
  PID:6864
- C:\Windows\System\mkAbjEV.exe
  C:\Windows\System\mkAbjEV.exe
  2⤵
  PID:1412
- C:\Windows\System\oPMVWpx.exe
  C:\Windows\System\oPMVWpx.exe
  2⤵
  PID:6920
- C:\Windows\System\HMKCRHJ.exe
  C:\Windows\System\HMKCRHJ.exe
  2⤵
  PID:11428
- C:\Windows\System\AaNzCaM.exe
  C:\Windows\System\AaNzCaM.exe
  2⤵
  PID:11532
- C:\Windows\System\JzwLJtP.exe
  C:\Windows\System\JzwLJtP.exe
  2⤵
  PID:9056
- C:\Windows\System\jSZMGxt.exe
  C:\Windows\System\jSZMGxt.exe
  2⤵
  PID:5460
- C:\Windows\System\ykQmqNt.exe
  C:\Windows\System\ykQmqNt.exe
  2⤵
  PID:6924
- C:\Windows\System\skPbDsd.exe
  C:\Windows\System\skPbDsd.exe
  2⤵
  PID:8680
- C:\Windows\System\CloYUvn.exe
  C:\Windows\System\CloYUvn.exe
  2⤵
  PID:7024
- C:\Windows\System\zgOOiBr.exe
  C:\Windows\System\zgOOiBr.exe
  2⤵
  PID:7064
- C:\Windows\System\QpSYwSW.exe
  C:\Windows\System\QpSYwSW.exe
  2⤵
  PID:7120
- C:\Windows\System\ORydVUc.exe
  C:\Windows\System\ORydVUc.exe
  2⤵
  PID:13676
- C:\Windows\System\dkzPvzr.exe
  C:\Windows\System\dkzPvzr.exe
  2⤵
  PID:13592
- C:\Windows\System\BPTaysw.exe
  C:\Windows\System\BPTaysw.exe
  2⤵
  PID:13636
- C:\Windows\System\HePajgM.exe
  C:\Windows\System\HePajgM.exe
  2⤵
  PID:5964
- C:\Windows\System\BZmHIBC.exe
  C:\Windows\System\BZmHIBC.exe
  2⤵
  PID:6196
- C:\Windows\System\KgZiTUI.exe
  C:\Windows\System\KgZiTUI.exe
  2⤵
  PID:6308
- C:\Windows\System\ORxaIsn.exe
  C:\Windows\System\ORxaIsn.exe
  2⤵
  PID:13528
- C:\Windows\System\qRIPYeg.exe
  C:\Windows\System\qRIPYeg.exe
  2⤵
  PID:2816
- C:\Windows\System\WNriSLX.exe
  C:\Windows\System\WNriSLX.exe
  2⤵
  PID:6588
- C:\Windows\System\aeMnghc.exe
  C:\Windows\System\aeMnghc.exe
  2⤵
  PID:11376
- C:\Windows\System\AsXRrmz.exe
  C:\Windows\System\AsXRrmz.exe
  2⤵
  PID:9820
- C:\Windows\System\eSkFxqq.exe
  C:\Windows\System\eSkFxqq.exe
  2⤵
  PID:11588
- C:\Windows\System\NtBdisM.exe
  C:\Windows\System\NtBdisM.exe
  2⤵
  PID:3144
- C:\Windows\System\bTDPWol.exe
  C:\Windows\System\bTDPWol.exe
  2⤵
  PID:9936
- C:\Windows\System\AAWCEjm.exe
  C:\Windows\System\AAWCEjm.exe
  2⤵
  PID:6936
- C:\Windows\System\ocDiESd.exe
  C:\Windows\System\ocDiESd.exe
  2⤵
  PID:12128
- C:\Windows\System\XBzuBzP.exe
  C:\Windows\System\XBzuBzP.exe
  2⤵
  PID:13956
- C:\Windows\System\jzMzHbY.exe
  C:\Windows\System\jzMzHbY.exe
  2⤵
  PID:7020
- C:\Windows\System\cRYmwzA.exe
  C:\Windows\System\cRYmwzA.exe
  2⤵
  PID:12228
- C:\Windows\System\ZfDWlIX.exe
  C:\Windows\System\ZfDWlIX.exe
  2⤵
  PID:6272
- C:\Windows\System\XxCTuJL.exe
  C:\Windows\System\XxCTuJL.exe
  2⤵
  PID:4492
- C:\Windows\System\YZIljXR.exe
  C:\Windows\System\YZIljXR.exe
  2⤵
  PID:11984
- C:\Windows\System\nQJhnyw.exe
  C:\Windows\System\nQJhnyw.exe
  2⤵
  PID:3024
- C:\Windows\System\bsNeIlY.exe
  C:\Windows\System\bsNeIlY.exe
  2⤵
  PID:4888
- C:\Windows\System\SbyPupH.exe
  C:\Windows\System\SbyPupH.exe
  2⤵
  PID:4856
- C:\Windows\System\GctAoAb.exe
  C:\Windows\System\GctAoAb.exe
  2⤵
  PID:4404
- C:\Windows\System\wcxybjo.exe
  C:\Windows\System\wcxybjo.exe
  2⤵
  PID:6984
- C:\Windows\System\CmdcXin.exe
  C:\Windows\System\CmdcXin.exe
  2⤵
  PID:8564
- C:\Windows\System\pJkUNna.exe
  C:\Windows\System\pJkUNna.exe
  2⤵
  PID:8664
- C:\Windows\System\xxaKZqF.exe
  C:\Windows\System\xxaKZqF.exe
  2⤵
  PID:2444
- C:\Windows\System\pvmwZDT.exe
  C:\Windows\System\pvmwZDT.exe
  2⤵
  PID:12392
- C:\Windows\System\dfwMKBF.exe
  C:\Windows\System\dfwMKBF.exe
  2⤵
  PID:8944
- C:\Windows\System\wzCatSw.exe
  C:\Windows\System\wzCatSw.exe
  2⤵
  PID:8940
- C:\Windows\System\SmoTzuH.exe
  C:\Windows\System\SmoTzuH.exe
  2⤵
  PID:8996
- C:\Windows\System\BfuuwkC.exe
  C:\Windows\System\BfuuwkC.exe
  2⤵
  PID:13756
- C:\Windows\System\fAeGUpN.exe
  C:\Windows\System\fAeGUpN.exe
  2⤵
  PID:9160
- C:\Windows\System\xEBBkKg.exe
  C:\Windows\System\xEBBkKg.exe
  2⤵
  PID:9156
- C:\Windows\System\auMaTOp.exe
  C:\Windows\System\auMaTOp.exe
  2⤵
  PID:8284
- C:\Windows\System\EiLEMVH.exe
  C:\Windows\System\EiLEMVH.exe
  2⤵
  PID:12912
- C:\Windows\System\lftcuuZ.exe
  C:\Windows\System\lftcuuZ.exe
  2⤵
  PID:5636
- C:\Windows\System\wvuKmUr.exe
  C:\Windows\System\wvuKmUr.exe
  2⤵
  PID:6280
- C:\Windows\System\wCUBhdP.exe
  C:\Windows\System\wCUBhdP.exe
  2⤵
  PID:6528
- C:\Windows\System\yXjaSZq.exe
  C:\Windows\System\yXjaSZq.exe
  2⤵
  PID:12980
- C:\Windows\System\LxYaxmq.exe
  C:\Windows\System\LxYaxmq.exe
  2⤵
  PID:13140
- C:\Windows\System\fNVGRfs.exe
  C:\Windows\System\fNVGRfs.exe
  2⤵
  PID:13244
- C:\Windows\System\RqzLtOc.exe
  C:\Windows\System\RqzLtOc.exe
  2⤵
  PID:8136
- C:\Windows\System\DQaHGWV.exe
  C:\Windows\System\DQaHGWV.exe
  2⤵
  PID:5640
- C:\Windows\System\OMexMwL.exe
  C:\Windows\System\OMexMwL.exe
  2⤵
  PID:7848
- C:\Windows\System\LWwcoQn.exe
  C:\Windows\System\LWwcoQn.exe
  2⤵
  PID:8004
- C:\Windows\System\jFRNvOw.exe
  C:\Windows\System\jFRNvOw.exe
  2⤵
  PID:7280
- C:\Windows\System\RpMJJbT.exe
  C:\Windows\System\RpMJJbT.exe
  2⤵
  PID:6312
- C:\Windows\System\iFNIdlY.exe
  C:\Windows\System\iFNIdlY.exe
  2⤵
  PID:6324
- C:\Windows\System\tKdHQBx.exe
  C:\Windows\System\tKdHQBx.exe
  2⤵
  PID:6380
- C:\Windows\System\uEbUQia.exe
  C:\Windows\System\uEbUQia.exe
  2⤵
  PID:9516
- C:\Windows\System\PvLLevU.exe
  C:\Windows\System\PvLLevU.exe
  2⤵
  PID:9548
- C:\Windows\System\AGgyCsb.exe
  C:\Windows\System\AGgyCsb.exe
  2⤵
  PID:8452
- C:\Windows\System\dUzEDxg.exe
  C:\Windows\System\dUzEDxg.exe
  2⤵
  PID:9512
- C:\Windows\System\MbtHecz.exe
  C:\Windows\System\MbtHecz.exe
  2⤵
  PID:9588
- C:\Windows\System\IGYFWap.exe
  C:\Windows\System\IGYFWap.exe
  2⤵
  PID:9668
- C:\Windows\System\IzINhpr.exe
  C:\Windows\System\IzINhpr.exe
  2⤵
  PID:3704
- C:\Windows\System\gONPuTu.exe
  C:\Windows\System\gONPuTu.exe
  2⤵
  PID:5232
- C:\Windows\System\zjzkZbw.exe
  C:\Windows\System\zjzkZbw.exe
  2⤵
  PID:5124
- C:\Windows\System\RzxTmmt.exe
  C:\Windows\System\RzxTmmt.exe
  2⤵
  PID:9780
- C:\Windows\System\gvdqMDU.exe
  C:\Windows\System\gvdqMDU.exe
  2⤵
  PID:4692
- C:\Windows\System\PXjxreI.exe
  C:\Windows\System\PXjxreI.exe
  2⤵
  PID:2940
- C:\Windows\System\tSZRSVG.exe
  C:\Windows\System\tSZRSVG.exe
  2⤵
  PID:6772
- C:\Windows\System\qWTrjDN.exe
  C:\Windows\System\qWTrjDN.exe
  2⤵
  PID:7236
- C:\Windows\System\qEgPkAu.exe
  C:\Windows\System\qEgPkAu.exe
  2⤵
  PID:7208
- C:\Windows\System\skyBRpg.exe
  C:\Windows\System\skyBRpg.exe
  2⤵
  PID:7264
- C:\Windows\System\sWLZBpO.exe
  C:\Windows\System\sWLZBpO.exe
  2⤵
  PID:10068
- C:\Windows\System\RHAlSLI.exe
  C:\Windows\System\RHAlSLI.exe
  2⤵
  PID:2260
- C:\Windows\System\yBtUNWr.exe
  C:\Windows\System\yBtUNWr.exe
  2⤵
  PID:10988
- C:\Windows\System\wlqwKdL.exe
  C:\Windows\System\wlqwKdL.exe
  2⤵
  PID:13476
- C:\Windows\System\igxQcTL.exe
  C:\Windows\System\igxQcTL.exe
  2⤵
  PID:11288
- C:\Windows\System\ATsYcmd.exe
  C:\Windows\System\ATsYcmd.exe
  2⤵
  PID:8356
- C:\Windows\System\UaYVnFy.exe
  C:\Windows\System\UaYVnFy.exe
  2⤵
  PID:11496

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4092,i,14221647728265121051,6840906015709541562,262144 --variations-seed-version --mojo-platform-channel-handle=3960 /prefetch:8
1⤵
PID:7104

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_j5t3uj42.cpx.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\ALtSgIq.exe

Filesize
1.8MB

MD5
6a80aa011e2157269ea217c2eefbd3ec

SHA1
2ef8257a09cbd1d64d9e30eb855e12bc571b23fc

SHA256
a7803d22b3269755c854f93a039a94a5fd1e62f2f0ddc24b82c12079c27e7bb1

SHA512
3e33f016675111e0c69af7d7df90285c414db885ff1c8fccd5e8ac92995d763290ff89c7dc07a0d55d76a7dc94fae7e2b9a9c7d1ff942465ef5c210949598924

Download Submit
C:\Windows\System\DjBaclT.exe

Filesize
1.8MB

MD5
24076e97dad1de4a228efd663dd5f085

SHA1
22fcce018de2125c46760e92bd3daec31bb5d389

SHA256
6fa9bc1576f91abce4ab3c0da30873fb18003e7647027af66c13937bf77278cb

SHA512
b2ebfbd36f8a12126eb112880c7f07661b5e2a20026665ad76ed0771757b53aa280450141b99db718cbb21e17c50a0270149542f8a824cc8c52d2ef17a48d4fb

Download Submit
C:\Windows\System\ERkoWgn.exe

Filesize
1.8MB

MD5
c4235d462af825748be2b805ef9eeb8c

SHA1
b14232913c2a5c17b33c0032c6f0f9367cf0a6a5

SHA256
9d359c21e77ca4cee2eb4b2ac83bf598b157a0aaa59aad95f7c9c8636bb417c6

SHA512
b835ce83c7ab84675af3006d6e08196897abaa528a9b4a1e9e88bb8a7b52b44fc7827c48da4b42de5f4372d34a60a462d8701d61f8000d33cd72a3c7fc35eb4d

Download Submit
C:\Windows\System\ETRUGYo.exe

Filesize
1.8MB

MD5
b6a5cf31a11491895f9ecaff8a8bb2e8

SHA1
585eef4bc952efb14b566c6a8d6e19204eee3d41

SHA256
e951ae83f01c0d92846462f279dcca57429e1644b52cbe73522a475ad491f344

SHA512
aab6bc8a3c30e238c6f4328dd8bd3fa05a082f2968de0c64828654b247e1143ee6ab882301a57e315c32b7112b6866551040b298458a2606736046b512344b3d

Download Submit
C:\Windows\System\HihnRDB.exe

Filesize
1.8MB

MD5
94cde26a51841b74b2dd708151494bf1

SHA1
e20a03f0b27394da6ee337c1ea3aeba28831025e

SHA256
16a06948e8bfd6e8d6d4ff29c151784c5d7a32593bd24c1679a3e773e884c13f

SHA512
87e1a87be2c3ff11fce33fd5da61f0222700a0134ec7fbd43531156417a059d615786d87faf753ba165d92c4ddcfa7e1e00f624dee447f06f8c9b80dffe235fd

Download Submit
C:\Windows\System\IMjOXny.exe

Filesize
1.8MB

MD5
68775143a86008e599bd79af38b0ea5b

SHA1
418b1ce3e63bbdc32ba53d25747dcaf87a1b34dd

SHA256
565ae3b7b8cce5f35856eb65442bd3f2fd51753551f3a49bb3ce40a377777b14

SHA512
ca03c8faea848ec62f711d5d316e4da4b31f8ec5247d5877d9e91e4582f7217878c8233b7522b3381aa904c802cca2fd51ed4e891f897f2f00d377caacecbd41

Download Submit
C:\Windows\System\IphyGIA.exe

Filesize
1.8MB

MD5
06c3db7ddfc0cc6df0828f9db4045938

SHA1
e0c95ab49e2bfe5663dc8f266733946f5bd124c8

SHA256
f75e880d2b8006e57698ea42bdcdbf6fcc19dcedc774de1595110b68ea4b7b1a

SHA512
084483d4442b6bb3509cfd5214182264e312c898a00349fad215d6505a1bb1777e693c690b6efab186af840fcb5057aa496d142ba2ffa3765c405d6c948090da

Download Submit
C:\Windows\System\JzaqRyH.exe

Filesize
1.8MB

MD5
f6db462f570bdb8c27aa1a90cea0c787

SHA1
d8e546c3313ed504c756dd486f83caf68d03b3de

SHA256
e6ac8f9b3972b7dcecf9592926fcad05b3e4daed520a5013c4021fa047aba298

SHA512
8a688118dfbf8563958b80808e79ec54f1ba27ef79cf432fc4f62166dde92cd4cb0254115ed8e2909135f2c67ed0c23b2a5e609c89a8bd9d059719c7a71bc415

Download Submit
C:\Windows\System\KSigKNY.exe

Filesize
1.8MB

MD5
991bdd9b38a6585647635360b1689210

SHA1
b5e6145aec54adb6dcf0a224f7805f962b85fe4a

SHA256
1133106f18a3d7f41a9e51a09acc9dafdef936ca6d72e7324c68a23f19ad9080

SHA512
150c05d1023043ed067b092e297ca747d7ed84dac63e1439a049ae53bcab8300d2ce1af3305328deac75984e2b6c5c941e6eedd5195d3bf2c1df56d9b9eac408

Download Submit
C:\Windows\System\MNDJtzU.exe

Filesize
1.8MB

MD5
5e5498ffd288a701a8708d3f1cadebfb

SHA1
778bcc7e820eee1cd75cc78bcebe8f03bd0ffe2c

SHA256
aba748ac03dd454b038a7a8e040001625c5a707ef4133465b63ac57dfeecdbd5

SHA512
37953de4310be045e3bfdd4893840ec02aa236b49ba0f8379d24ce8a18fc6dd7f4067b30c69acd57aacea13bf8792df8456238bb18e634c95b2e194ef42eb739

Download Submit
C:\Windows\System\PNtGGAt.exe

Filesize
1.8MB

MD5
95c4d229a729936937a1d066af16d174

SHA1
b1ea3312c5e801622b6971faf410b217a7b1d25e

SHA256
bdef63742c5385ca9f1489e41afffe06169d5f72fda6d204adb1bfc2f736daa3

SHA512
36186ea45cd5fdd245048c158d7066d5a92e7833e057e63065f2b24fb999fa48381cf933809494233b592fda766ebe3a6d94971c76d980d8477b2e6605c5121a

Download Submit
C:\Windows\System\RSGPUdQ.exe

Filesize
1.8MB

MD5
9a43f0ff0e899fa888cacf22f6405d6e

SHA1
55471d095c23dc190fdb3721ff126b20edd82445

SHA256
24fe5800274f48a66e1dc21b5c96358692f205b1edccb4afd86b2c01f2a147dc

SHA512
8d9c938f2b138b3c3cea532343ee7ef7a07f7ee0598fe92cf52053b30f5d680db37128acd70e6e9679ecac61cab20bac496f9e4ddb6c57e78777ec9bc04dd838

Download Submit
C:\Windows\System\RtOPNuW.exe

Filesize
1.8MB

MD5
86d60c29b67a46d226454b8d5ff7e34f

SHA1
4ee137352ebeaac3654f3b99e8dc005ea4ea1218

SHA256
7e9544c49ce0e6c7b72bcb33f42b1c220457d6e66e229ca7bad777f84dd0ce38

SHA512
3d4a7be8243e61d7aea4b61869f842c522bc9c5883afe65ee2fbab14dedeb7dfca2dbbe252f0070e786daae72d91098de60d6056a24195c817039f1c8152b768

Download Submit
C:\Windows\System\SNlywZM.exe

Filesize
1.8MB

MD5
f83b22bca04a3b1ec92e4960b1b4de4d

SHA1
be96c6f5a5fce757321438f7d40c2f1d1774f1c3

SHA256
621931e2c38358de4d413af920910c0c722b16344c2e1fd827c4fc28172abe7e

SHA512
64983e10f5ad1741271f070d1ec045fb0e63b345fc30afe6a62efae3d417d9c0a914f8c77c9d36d3bce859533a3a2c54374997594581a7e3ea4cf1634a4c2c7d

Download Submit
C:\Windows\System\THUboKS.exe

Filesize
1.8MB

MD5
81f4944c9b7b8bbed82a69358f1bbddd

SHA1
27fe2dc0d6495608d08f9e186e8a118490235e09

SHA256
4e0a73cd95130feb18d9280203ca17fff9e5a609f8cc642c686517e2b3e59545

SHA512
992ad9799dbb19b9ac9e3aa87edbbeccb363d5e7810fcb781363a3304bcc346afb21065b8bd339b0a5cc629fa5609280d647913514526b5102f8a6503581d45e

Download Submit
C:\Windows\System\UkvtLkG.exe

Filesize
1.8MB

MD5
ea1addc43e7a4b373f30831f0ab0cbc6

SHA1
f01bf6b3d2384482c4a1f516267a20746f48e9b9

SHA256
12b4c6cb08d21cbad7b707f51b4b26be0914e9fff8c55337d1bccd8036222f63

SHA512
42945f7eae0472ed923917bd5f059a179917ca660c07cd90c7fa29062cdd43e41552b895bb505ee867adc36becfeb716b75c20378c80ef08522ffa7c9ba745b7

Download Submit
C:\Windows\System\WvcFzWn.exe

Filesize
1.8MB

MD5
ce6c2e9ab4afd58eceb51b302147feea

SHA1
555031ed170c91184574e66ca61094a583aa5d25

SHA256
74b893a7e80c51b12e4ff656c7bd63e5a595b0247ee4fcfc19ca235011468921

SHA512
637768eaf7943ce6157366dc3e5121d21395e1a3e77f5efbf3b46fb287dd17c752c1db43b1a7dc8b9f58aa18631ef19780dea1c6cd340ee4055388b26d80971f

Download Submit
C:\Windows\System\aElDmWo.exe

Filesize
1.8MB

MD5
c0db562bc3e6716bb759d1da68ec2d77

SHA1
65430608dd1e24227c3cfd4cf33f620cacefa31d

SHA256
ea22e06f9d7ed5d6a9373342d83c76752d5cf0597be13fcaa6d5b94baad4ff32

SHA512
b44b5acdfba4ad7391b309003ddb54676194f21634b6f4f3cec314d7bf8f1c1ffd2f236786020d8da5133ec617b54e567674468ad99d94c64ce00b9c1b4aaf19

Download Submit
C:\Windows\System\bcHKkPZ.exe

Filesize
1.8MB

MD5
94791d5bdd9f61b5a1fab4b9db4e2d6b

SHA1
1393dc866368edbad69f3b2c345ff8edc0722a3e

SHA256
e653bb174fa899daf1a4c72e9ee07b1402eec18bdd90aed5a14b7dfee126814c

SHA512
31d446346ddc64959f9cedd5f495853adaa43527704f5b68500f0c862b983b00ac13f059ab9d96c9348d0512fe9bd05ec4d1b1fb0316eb8e95683646f4dbff1b

Download Submit
C:\Windows\System\dHCDGZp.exe

Filesize
1.8MB

MD5
bfa60820cbe100b6ce19a1b8668bdf28

SHA1
76dc6570f4636d8d3899bb30e227f6e50b2d7d39

SHA256
4474af373d68be98b00cadaa87be67644ad5949331b0a53cb0ac5b3ca2f706f5

SHA512
987b7d96cb0273bf372ff3251cebbbadfbca57d921e9ecdc832f789819dfeef46a0ea7f1697dd2aa1a4286e195a20a24c440543cd98e0a90e9c35fb1f492e928

Download Submit
C:\Windows\System\dSceqhH.exe

Filesize
1.8MB

MD5
02991ef823627c0eb06084eddcd870fe

SHA1
fdca3defa9bb75930ddeac3d2f47f320739f7242

SHA256
592d6e117180bfe3ddede03e9407853c43fad4ae199d3abc33fb3c9d45595791

SHA512
50e6b852979b12268af240d482e08da912fb4dfa8d7cb6b670b4f47856365fc203feafbca7f889f347eef3536cb52b514a1104b93960a5c4a50d74142b51f1c2

Download Submit
C:\Windows\System\goObOEJ.exe

Filesize
1.8MB

MD5
cb5e097cccd2ab226d285dd1ee72e379

SHA1
2ddc3389a7d678e68d1b9a66d54c82f9192a5826

SHA256
62362dcd82b654e8ca7f368bd871026c150e284374bcbcc405e63ceb47b63e2b

SHA512
36002d65223d7a1d4a8de0dc9e22babc894b872495e5060c134d61e69b49e16459bec02fe8f0d3a3b9f115fc72a8f8b8463ee183d4fba5eec5379a0b0d1e578b

Download Submit
C:\Windows\System\gwascjR.exe

Filesize
1.8MB

MD5
3e597b1266b29132fa184d12c88bf886

SHA1
f9319fba8ea8f89a889c1a54b025d2a1c39692ba

SHA256
50cc1225677269edd7bf0bc664291b3c651a56f7924b45e60f321fe5fe91d118

SHA512
5e43da0c9fcbf0c3033bd78bb9076b39e15b8537195ed1ea3dac1578fed8835a84ecc780cf6549508d4066500c7e542ebf9dc2f99d6d9e0d9914fdc1a1744ca8

Download Submit
C:\Windows\System\hKGIaeg.exe

Filesize
1.8MB

MD5
f6cfc4c9da041af2058fa95a96ab07fd

SHA1
14b4a7cec6ad6cbda759c8686fd85f49b170f560

SHA256
12bc40ac7a1f859fdb777610ef9b956a012d754cdcf6e6e583f983a8ee7d73ab

SHA512
e378e86b7274df3b8259148b4338e00b289f48b9e3d0a482b1a1410dff484cd40a55d4210ac2f1dc38ca4ec22959100fb5ed2720652a6995a70c363b362b2570

Download Submit
C:\Windows\System\hVPQTRh.exe

Filesize
1.8MB

MD5
55788f4ac7db2e46d92fec09c40f15ed

SHA1
914e6e541d71a7e282712c36e4ce8745f901d513

SHA256
39c47f4ed12ab92e5c11203f5ebe7c34f7a49c7b6938a9b2da2d5f95055b8ca0

SHA512
f425ca35d701cce8525a2cdb936103e8366fc7b23036b3e2350025df1831625dfe1f91178af207eb89fd05324c97d22c3849a268ab4afd9eef947ea9fe989e03

Download Submit
C:\Windows\System\hnXVoOk.exe

Filesize
1.8MB

MD5
845f7bf179beef69a0f809bccefa1952

SHA1
6ef1989deb6dc9d61d6bc6be4932cb56793cc89d

SHA256
e9232d2d1ea95ff88e46f747dd2288c33f646837df4d3869ff04c1db3f56810c

SHA512
c132122776378522533de8b952591385938524fa1b39bfe07b52957f2cfa42bf247f56f31d4a5244af02de0a096ff501230422e97a241330f86512ff7822585a

Download Submit
C:\Windows\System\iyNDxsy.exe

Filesize
1.8MB

MD5
285c32a1bb50afe0920f273c4bea0383

SHA1
fcb514de660dcc41253b83bdd7d18a463d7bd083

SHA256
c3f5e5d68d8a9284dcd9591b4047f571585221ab1eda19b48a485bc16ee8e0c1

SHA512
0dd58af4e3d7e988516bb2facb60d79cb301a4593e111d3319afd607fefa3a6b15d2c1f21467935b393cb5ead49e588b6650f9b6b33e8aff8b9c9aabaceb80c3

Download Submit
C:\Windows\System\jtlhHQe.exe

Filesize
1.8MB

MD5
a5e16034597a2d2773688231031bf869

SHA1
7b2981e11d6ac4bff40ae5608cd437640de3bf58

SHA256
f23c5bc6c66c7f49b1e4dcef15967adffd0e0e0c695891a7255a41dbc74b027d

SHA512
4aa1b6d89c020a6e8f36f530348b695fd76377bdbb645351b3b64e70a295fc99b5c172b887716206eebeaaca07715bd3350775a9c4909f3acaa693f79ee4fbfd

Download Submit
C:\Windows\System\mbeJEAs.exe

Filesize
1.8MB

MD5
04edb9f9ba4062615a4547c8cdc1f315

SHA1
b2d540fbd7557520755f637c0f16fda24801fb6e

SHA256
e065a71be27e003a7a3ae077cae65416297bec5716cb9dfe33c4709cecd72bad

SHA512
ea0ab1c982bf38b7df51846ad7b8f76427ce9094c3a12f44745065f73bcf7e6dfbbfc183f08c9ed28226733d4766315ca91be21dd099ae4d683201de23d19ad5

Download Submit
C:\Windows\System\nUyKLkC.exe

Filesize
8B

MD5
9e16362b7eef9ff59cf4576b688fec20

SHA1
58714a79316bdda8b345ca47c2a7e8087e024871

SHA256
cb157cd47cb9ddacb8fa194262e9cc1364ca68490d93ad041938e77ef90ead7c

SHA512
53056e2e9a952538e1c61538c2bad2166adaf2d4a03d0e97e211329cd7f80967988343aa21690b08c2f1ad6d3fabfdc6095392f57b127d575de79d724d1a09de

Download Submit
C:\Windows\System\sgbASyP.exe

Filesize
1.8MB

MD5
98d1adaa9559dddfd88b699b68b3b007

SHA1
512fc46e30ba6aa631f797523c070bf157659a8b

SHA256
9ef0ee72773f98c4213a21a2e7c78259e1265dedfb5edb515ea50ca9a33e90cf

SHA512
d0b2c602beec07f55f9ea1d156e97cd9d8da08654d22e21dfb9525c35392210a0fdd5431b814beae785de3c317e64389aec29f63072941a2fb1c27fa672319e3

Download Submit
C:\Windows\System\vCYysPO.exe

Filesize
1.8MB

MD5
f7b8f252a49cc7d90cb4ee8c9fa3c92f

SHA1
b407a28634a3a9c03711047f73068a258c8d385f

SHA256
4b6b2162761a2b103cfc5ed8dc970bde345b128a76b178c2ae6bf57d077edbc2

SHA512
6dfe880d175cb642fc04d044be67df3e466759781ad4d748c0e5e9430a1fd59190c35c4577658c258300457cc902f3e2ddab6eecaf27d7b535e26fedc153ed39

Download Submit
C:\Windows\System\xTHfAxe.exe

Filesize
1.8MB

MD5
239cd00a3b48ba2035c399fce60bda25

SHA1
ba1fad5ec19aca719b4555de715164ef2f6f065b

SHA256
3eb7cbbd81e0d57b469e6dc632afbe72790830b694b899c9be0c42f2c15c5592

SHA512
e4a826eee5026fb578df77be2b2852d3e3ae3df11fd2b9cdeda6f74f5c6a9f3f4f9a95bf9cc1a05b1ea952b2f2b712aa458b820c8840d126b852de120d0d8308

Download Submit
C:\Windows\System\yobAJzi.exe

Filesize
1.8MB

MD5
a4037abd9b60d00a94d270305bbd6644

SHA1
c747302b6372c84e5c2745a7afb0ff9768d914db

SHA256
adef968a44461f1a24ddfb9b5a7c87ceda7550e466d0e1b330a1e210a02a2a3c

SHA512
0e22c9c4f013188e6d108135c31353518f6435e42506c66515695d69ffecf3774a36d166947dd74dd972456360487ffc1fb4eaca3538efc6546c7366d6237a08

Download Submit
memory/556-28-0x00007FF768DB0000-0x00007FF7691A2000-memory.dmp

Filesize
3.9MB

Download
memory/556-4154-0x00007FF768DB0000-0x00007FF7691A2000-memory.dmp

Filesize
3.9MB

Download
memory/640-52-0x00007FF7509C0000-0x00007FF750DB2000-memory.dmp

Filesize
3.9MB

Download
memory/640-4164-0x00007FF7509C0000-0x00007FF750DB2000-memory.dmp

Filesize
3.9MB

Download
memory/640-2156-0x00007FF7509C0000-0x00007FF750DB2000-memory.dmp

Filesize
3.9MB

Download
memory/1260-4185-0x00007FF7A8150000-0x00007FF7A8542000-memory.dmp

Filesize
3.9MB

Download
memory/1260-93-0x00007FF7A8150000-0x00007FF7A8542000-memory.dmp

Filesize
3.9MB

Download
memory/1408-1-0x000001BE08BF0000-0x000001BE08C00000-memory.dmp

Filesize
64KB

Download
memory/1408-0-0x00007FF777060000-0x00007FF777452000-memory.dmp

Filesize
3.9MB

Download
memory/1408-157-0x00007FF777060000-0x00007FF777452000-memory.dmp

Filesize
3.9MB

Download
memory/1416-4168-0x00007FF7E5290000-0x00007FF7E5682000-memory.dmp

Filesize
3.9MB

Download
memory/1416-63-0x00007FF7E5290000-0x00007FF7E5682000-memory.dmp

Filesize
3.9MB

Download
memory/1588-150-0x00007FF7E8CA0000-0x00007FF7E9092000-memory.dmp

Filesize
3.9MB

Download
memory/1588-4210-0x00007FF7E8CA0000-0x00007FF7E9092000-memory.dmp

Filesize
3.9MB

Download
memory/1668-99-0x00007FF639630000-0x00007FF639A22000-memory.dmp

Filesize
3.9MB

Download
memory/1668-4181-0x00007FF639630000-0x00007FF639A22000-memory.dmp

Filesize
3.9MB

Download
memory/1688-14-0x00007FF79A0E0000-0x00007FF79A4D2000-memory.dmp

Filesize
3.9MB

Download
memory/1688-4138-0x00007FF79A0E0000-0x00007FF79A4D2000-memory.dmp

Filesize
3.9MB

Download
memory/1804-169-0x00007FF767FC0000-0x00007FF7683B2000-memory.dmp

Filesize
3.9MB

Download
memory/1804-4230-0x00007FF767FC0000-0x00007FF7683B2000-memory.dmp

Filesize
3.9MB

Download
memory/1904-59-0x00007FF75ABB0000-0x00007FF75AFA2000-memory.dmp

Filesize
3.9MB

Download
memory/1904-4172-0x00007FF75ABB0000-0x00007FF75AFA2000-memory.dmp

Filesize
3.9MB

Download
memory/2112-111-0x00007FF6B2A10000-0x00007FF6B2E02000-memory.dmp

Filesize
3.9MB

Download
memory/2112-4191-0x00007FF6B2A10000-0x00007FF6B2E02000-memory.dmp

Filesize
3.9MB

Download
memory/2304-4161-0x00007FF65F430000-0x00007FF65F822000-memory.dmp

Filesize
3.9MB

Download
memory/2304-77-0x00007FF65F430000-0x00007FF65F822000-memory.dmp

Filesize
3.9MB

Download
memory/2344-4235-0x00007FF7A3190000-0x00007FF7A3582000-memory.dmp

Filesize
3.9MB

Download
memory/2344-151-0x00007FF7A3190000-0x00007FF7A3582000-memory.dmp

Filesize
3.9MB

Download
memory/2400-57-0x00007FF7E0740000-0x00007FF7E0B32000-memory.dmp

Filesize
3.9MB

Download
memory/2400-4170-0x00007FF7E0740000-0x00007FF7E0B32000-memory.dmp

Filesize
3.9MB

Download
memory/2752-68-0x00007FF6EFEC0000-0x00007FF6F02B2000-memory.dmp

Filesize
3.9MB

Download
memory/2752-4847-0x00007FF6EFEC0000-0x00007FF6F02B2000-memory.dmp

Filesize
3.9MB

Download
memory/2784-2161-0x00007FF6502F0000-0x00007FF6506E2000-memory.dmp

Filesize
3.9MB

Download
memory/2784-4189-0x00007FF6502F0000-0x00007FF6506E2000-memory.dmp

Filesize
3.9MB

Download
memory/2784-74-0x00007FF6502F0000-0x00007FF6506E2000-memory.dmp

Filesize
3.9MB

Download
memory/2876-117-0x00007FF7EF640000-0x00007FF7EFA32000-memory.dmp

Filesize
3.9MB

Download
memory/2876-4198-0x00007FF7EF640000-0x00007FF7EFA32000-memory.dmp

Filesize
3.9MB

Download
memory/3364-105-0x00007FF71A340000-0x00007FF71A732000-memory.dmp

Filesize
3.9MB

Download
memory/3364-4178-0x00007FF71A340000-0x00007FF71A732000-memory.dmp

Filesize
3.9MB

Download
memory/3436-24-0x00007FF7B0F50000-0x00007FF7B1342000-memory.dmp

Filesize
3.9MB

Download
memory/3436-4157-0x00007FF7B0F50000-0x00007FF7B1342000-memory.dmp

Filesize
3.9MB

Download
memory/3436-1344-0x00007FF7B0F50000-0x00007FF7B1342000-memory.dmp

Filesize
3.9MB

Download
memory/3656-4192-0x00007FF7F90A0000-0x00007FF7F9492000-memory.dmp

Filesize
3.9MB

Download
memory/3656-83-0x00007FF7F90A0000-0x00007FF7F9492000-memory.dmp

Filesize
3.9MB

Download
memory/3812-163-0x00007FF737AA0000-0x00007FF737E92000-memory.dmp

Filesize
3.9MB

Download
memory/3812-4232-0x00007FF737AA0000-0x00007FF737E92000-memory.dmp

Filesize
3.9MB

Download
memory/4064-4201-0x00007FF64DD50000-0x00007FF64E142000-memory.dmp

Filesize
3.9MB

Download
memory/4064-123-0x00007FF64DD50000-0x00007FF64E142000-memory.dmp

Filesize
3.9MB

Download
memory/4168-1320-0x00007FF72A170000-0x00007FF72A562000-memory.dmp

Filesize
3.9MB

Download
memory/4168-15-0x00007FF72A170000-0x00007FF72A562000-memory.dmp

Filesize
3.9MB

Download
memory/4168-4146-0x00007FF72A170000-0x00007FF72A562000-memory.dmp

Filesize
3.9MB

Download
memory/4644-4234-0x00007FF7B3840000-0x00007FF7B3C32000-memory.dmp

Filesize
3.9MB

Download
memory/4644-139-0x00007FF7B3840000-0x00007FF7B3C32000-memory.dmp

Filesize
3.9MB

Download
memory/4644-4046-0x00007FF7B3840000-0x00007FF7B3C32000-memory.dmp

Filesize
3.9MB

Download
memory/5008-4187-0x00007FF6FDA70000-0x00007FF6FDE62000-memory.dmp

Filesize
3.9MB

Download
memory/5008-87-0x00007FF6FDA70000-0x00007FF6FDE62000-memory.dmp

Filesize
3.9MB

Download
memory/5112-472-0x000001D55F200000-0x000001D55F9A6000-memory.dmp

Filesize
7.6MB

Download
memory/5112-133-0x000001D55C2E0000-0x000001D55C302000-memory.dmp

Filesize
136KB

Download