xmrig | b0f6195f115c9ba24f0d79572977e0f6891cdce184ba77e532258f8b7ced0f1c

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
05/06/2024, 07:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

47a59c59d3ae78287229e8f034e23e00_NeikiAnalytics.exe
Size

1.7MB
MD5

47a59c59d3ae78287229e8f034e23e00
SHA1

feaa9618116598b736100bce25852893db93f669
SHA256

b0f6195f115c9ba24f0d79572977e0f6891cdce184ba77e532258f8b7ced0f1c
SHA512

06f8e273a77e065ac6dc503b1fe563ac22a48f2e78a58181b68c15ae21f04aaea53b2abac407ce9284b67d878e288d1b6d6c0edc211b37d4f8abac28307cf3af
SSDEEP

24576:zv3/fTLF671TilQFG4P5PMkyW1HU/ek5Q1szp5NnNvZWNChZ7fI+7RrTFl6hvVjZ:Lz071uv4BPMkyW10/w16BvZX71Fq86P

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 41 IoCs

miner

resource	yara_rule
behavioral2/memory/5104-202-0x00007FF7E1440000-0x00007FF7E1832000-memory.dmp	xmrig
behavioral2/memory/4504-196-0x00007FF773FA0000-0x00007FF774392000-memory.dmp	xmrig
behavioral2/memory/4700-190-0x00007FF662050000-0x00007FF662442000-memory.dmp	xmrig
behavioral2/memory/4772-184-0x00007FF766C30000-0x00007FF767022000-memory.dmp	xmrig
behavioral2/memory/1060-178-0x00007FF6C27A0000-0x00007FF6C2B92000-memory.dmp	xmrig
behavioral2/memory/4752-172-0x00007FF640E20000-0x00007FF641212000-memory.dmp	xmrig
behavioral2/memory/1208-171-0x00007FF7DEE60000-0x00007FF7DF252000-memory.dmp	xmrig
behavioral2/memory/4804-165-0x00007FF6C9490000-0x00007FF6C9882000-memory.dmp	xmrig
behavioral2/memory/2136-159-0x00007FF6522E0000-0x00007FF6526D2000-memory.dmp	xmrig
behavioral2/memory/1620-153-0x00007FF6FCEB0000-0x00007FF6FD2A2000-memory.dmp	xmrig
behavioral2/memory/1688-147-0x00007FF7932F0000-0x00007FF7936E2000-memory.dmp	xmrig
behavioral2/memory/2320-141-0x00007FF648190000-0x00007FF648582000-memory.dmp	xmrig
behavioral2/memory/2156-124-0x00007FF758940000-0x00007FF758D32000-memory.dmp	xmrig
behavioral2/memory/4072-118-0x00007FF7E4F30000-0x00007FF7E5322000-memory.dmp	xmrig
behavioral2/memory/3168-112-0x00007FF713DB0000-0x00007FF7141A2000-memory.dmp	xmrig
behavioral2/memory/1896-111-0x00007FF7FF7D0000-0x00007FF7FFBC2000-memory.dmp	xmrig
behavioral2/memory/3908-105-0x00007FF6B0D80000-0x00007FF6B1172000-memory.dmp	xmrig
behavioral2/memory/1624-99-0x00007FF7367E0000-0x00007FF736BD2000-memory.dmp	xmrig
behavioral2/memory/3152-95-0x00007FF65FD60000-0x00007FF660152000-memory.dmp	xmrig
behavioral2/memory/884-94-0x00007FF701630000-0x00007FF701A22000-memory.dmp	xmrig
behavioral2/memory/4208-73-0x00007FF714080000-0x00007FF714472000-memory.dmp	xmrig
behavioral2/memory/1204-47-0x00007FF6E7740000-0x00007FF6E7B32000-memory.dmp	xmrig
behavioral2/memory/228-4103-0x00007FF749780000-0x00007FF749B72000-memory.dmp	xmrig
behavioral2/memory/2628-4107-0x00007FF7FC500000-0x00007FF7FC8F2000-memory.dmp	xmrig
behavioral2/memory/1204-4113-0x00007FF6E7740000-0x00007FF6E7B32000-memory.dmp	xmrig
behavioral2/memory/4208-4120-0x00007FF714080000-0x00007FF714472000-memory.dmp	xmrig
behavioral2/memory/1896-4141-0x00007FF7FF7D0000-0x00007FF7FFBC2000-memory.dmp	xmrig
behavioral2/memory/2320-4138-0x00007FF648190000-0x00007FF648582000-memory.dmp	xmrig
behavioral2/memory/3168-4155-0x00007FF713DB0000-0x00007FF7141A2000-memory.dmp	xmrig
behavioral2/memory/4072-4149-0x00007FF7E4F30000-0x00007FF7E5322000-memory.dmp	xmrig
behavioral2/memory/884-4134-0x00007FF701630000-0x00007FF701A22000-memory.dmp	xmrig
behavioral2/memory/4504-4165-0x00007FF773FA0000-0x00007FF774392000-memory.dmp	xmrig
behavioral2/memory/1620-4158-0x00007FF6FCEB0000-0x00007FF6FD2A2000-memory.dmp	xmrig
behavioral2/memory/5104-4200-0x00007FF7E1440000-0x00007FF7E1832000-memory.dmp	xmrig
behavioral2/memory/4804-4187-0x00007FF6C9490000-0x00007FF6C9882000-memory.dmp	xmrig
behavioral2/memory/4752-4184-0x00007FF640E20000-0x00007FF641212000-memory.dmp	xmrig
behavioral2/memory/4772-4178-0x00007FF766C30000-0x00007FF767022000-memory.dmp	xmrig
behavioral2/memory/1208-4174-0x00007FF7DEE60000-0x00007FF7DF252000-memory.dmp	xmrig
behavioral2/memory/1060-4172-0x00007FF6C27A0000-0x00007FF6C2B92000-memory.dmp	xmrig
behavioral2/memory/4700-4180-0x00007FF662050000-0x00007FF662442000-memory.dmp	xmrig
behavioral2/memory/2136-4168-0x00007FF6522E0000-0x00007FF6526D2000-memory.dmp	xmrig

Blocklisted process makes network request 2 IoCs

flow	pid	Process
3	2680	powershell.exe
5	2680	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
2680	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
228	vFIAYsM.exe
2628	QEsrvgA.exe
2156	AoplhzU.exe
1204	vhMJHyq.exe
4208	jeqLJfA.exe
884	AsYoWRy.exe
3152	fnQAMrx.exe
1624	NcMBVHW.exe
2320	mtvzbfW.exe
1688	nlvNetq.exe
3908	BEQLzVN.exe
1896	EtKEzhC.exe
3168	kTesPzp.exe
4072	zUnafQg.exe
1620	mrRZwaA.exe
2136	ZNTxZoY.exe
4804	KBPIYTr.exe
1208	thlFpRg.exe
4752	OWHWQCM.exe
4700	rhRnRBv.exe
4504	tIievhr.exe
1060	cuAIcJG.exe
4772	wgkdyBf.exe
5104	SZemFKH.exe
736	sCRgHCr.exe
4872	sprqrtl.exe
2260	LbeHsTh.exe
4704	illJmqr.exe
4064	LhPYKCw.exe
4988	ULtiqEh.exe
3080	KCLeLVP.exe
448	LQmJiZM.exe
3256	PHJhEov.exe
5036	grnHXPZ.exe
5044	CAuulSl.exe
1928	tKTwpwo.exe
3532	IkXQkug.exe
2380	uYfvwRK.exe
2056	rrNorUM.exe
840	MPLaleQ.exe
3104	zKOqyML.exe
1576	nBlpPsg.exe
632	TeasyOL.exe
4304	kyOOKyt.exe
4292	HAGiWzT.exe
3652	pJMZNGq.exe
1560	cYKJIOr.exe
4456	qsFwYBa.exe
1324	bRHjoEc.exe
1164	ocjTcrJ.exe
3680	FrwOJZy.exe
2068	gtbCYNh.exe
4924	dXOUEbX.exe
4436	TomhWVV.exe
3408	iQAadVi.exe
3012	llUCovt.exe
452	EhoHlvh.exe
1400	WuOiaru.exe
1540	kWmEwjV.exe
916	BqZqPEU.exe
1836	bhTuRAP.exe
1320	XcsZgwj.exe
2372	GdJhLdy.exe
224	XJqcter.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2100-0-0x00007FF681F50000-0x00007FF682342000-memory.dmp	upx
behavioral2/files/0x000700000002341d-7.dat	upx
behavioral2/files/0x000a00000002328e-5.dat	upx
behavioral2/memory/228-8-0x00007FF749780000-0x00007FF749B72000-memory.dmp	upx
behavioral2/files/0x000700000002341c-10.dat	upx
behavioral2/files/0x000700000002341e-29.dat	upx
behavioral2/files/0x0007000000023421-38.dat	upx
behavioral2/files/0x0007000000023423-48.dat	upx
behavioral2/files/0x0007000000023424-64.dat	upx
behavioral2/files/0x0007000000023426-71.dat	upx
behavioral2/files/0x0007000000023429-91.dat	upx
behavioral2/files/0x000700000002342c-96.dat	upx
behavioral2/files/0x0009000000023415-102.dat	upx
behavioral2/files/0x000800000002342b-119.dat	upx
behavioral2/files/0x000800000002342a-127.dat	upx
behavioral2/files/0x0007000000023431-144.dat	upx
behavioral2/files/0x0007000000023433-156.dat	upx
behavioral2/files/0x0007000000023435-168.dat	upx
behavioral2/files/0x0007000000023437-181.dat	upx
behavioral2/memory/5104-202-0x00007FF7E1440000-0x00007FF7E1832000-memory.dmp	upx
behavioral2/files/0x000700000002343a-199.dat	upx
behavioral2/files/0x0007000000023438-197.dat	upx
behavioral2/memory/4504-196-0x00007FF773FA0000-0x00007FF774392000-memory.dmp	upx
behavioral2/files/0x0007000000023439-193.dat	upx
behavioral2/memory/4700-190-0x00007FF662050000-0x00007FF662442000-memory.dmp	upx
behavioral2/files/0x0007000000023436-185.dat	upx
behavioral2/memory/4772-184-0x00007FF766C30000-0x00007FF767022000-memory.dmp	upx
behavioral2/memory/1060-178-0x00007FF6C27A0000-0x00007FF6C2B92000-memory.dmp	upx
behavioral2/files/0x0007000000023434-173.dat	upx
behavioral2/memory/4752-172-0x00007FF640E20000-0x00007FF641212000-memory.dmp	upx
behavioral2/memory/1208-171-0x00007FF7DEE60000-0x00007FF7DF252000-memory.dmp	upx
behavioral2/memory/4804-165-0x00007FF6C9490000-0x00007FF6C9882000-memory.dmp	upx
behavioral2/files/0x0007000000023432-160.dat	upx
behavioral2/memory/2136-159-0x00007FF6522E0000-0x00007FF6526D2000-memory.dmp	upx
behavioral2/memory/1620-153-0x00007FF6FCEB0000-0x00007FF6FD2A2000-memory.dmp	upx
behavioral2/files/0x0007000000023430-148.dat	upx
behavioral2/memory/1688-147-0x00007FF7932F0000-0x00007FF7936E2000-memory.dmp	upx
behavioral2/files/0x000700000002342f-142.dat	upx
behavioral2/memory/2320-141-0x00007FF648190000-0x00007FF648582000-memory.dmp	upx
behavioral2/files/0x000700000002342e-130.dat	upx
behavioral2/files/0x000700000002342d-125.dat	upx
behavioral2/memory/2156-124-0x00007FF758940000-0x00007FF758D32000-memory.dmp	upx
behavioral2/memory/4072-118-0x00007FF7E4F30000-0x00007FF7E5322000-memory.dmp	upx
behavioral2/memory/3168-112-0x00007FF713DB0000-0x00007FF7141A2000-memory.dmp	upx
behavioral2/memory/1896-111-0x00007FF7FF7D0000-0x00007FF7FFBC2000-memory.dmp	upx
behavioral2/memory/3908-105-0x00007FF6B0D80000-0x00007FF6B1172000-memory.dmp	upx
behavioral2/memory/1624-99-0x00007FF7367E0000-0x00007FF736BD2000-memory.dmp	upx
behavioral2/memory/3152-95-0x00007FF65FD60000-0x00007FF660152000-memory.dmp	upx
behavioral2/memory/884-94-0x00007FF701630000-0x00007FF701A22000-memory.dmp	upx
behavioral2/files/0x0007000000023427-89.dat	upx
behavioral2/files/0x0007000000023428-85.dat	upx
behavioral2/memory/4208-73-0x00007FF714080000-0x00007FF714472000-memory.dmp	upx
behavioral2/files/0x0007000000023425-69.dat	upx
behavioral2/memory/1204-47-0x00007FF6E7740000-0x00007FF6E7B32000-memory.dmp	upx
behavioral2/files/0x0007000000023420-45.dat	upx
behavioral2/files/0x0007000000023422-41.dat	upx
behavioral2/files/0x000700000002341f-31.dat	upx
behavioral2/memory/2628-18-0x00007FF7FC500000-0x00007FF7FC8F2000-memory.dmp	upx
behavioral2/memory/228-4103-0x00007FF749780000-0x00007FF749B72000-memory.dmp	upx
behavioral2/memory/2628-4107-0x00007FF7FC500000-0x00007FF7FC8F2000-memory.dmp	upx
behavioral2/memory/1204-4113-0x00007FF6E7740000-0x00007FF6E7B32000-memory.dmp	upx
behavioral2/memory/4208-4120-0x00007FF714080000-0x00007FF714472000-memory.dmp	upx
behavioral2/memory/1896-4141-0x00007FF7FF7D0000-0x00007FF7FFBC2000-memory.dmp	upx
behavioral2/memory/2320-4138-0x00007FF648190000-0x00007FF648582000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
2	raw.githubusercontent.com
3	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\QWRzosY.exe	47a59c59d3ae78287229e8f034e23e00_NeikiAnalytics.exe
File created	C:\Windows\System\YpySmcO.exe	47a59c59d3ae78287229e8f034e23e00_NeikiAnalytics.exe
File created	C:\Windows\System\uDZklyg.exe	47a59c59d3ae78287229e8f034e23e00_NeikiAnalytics.exe
File created	C:\Windows\System\Tkersae.exe	47a59c59d3ae78287229e8f034e23e00_NeikiAnalytics.exe
File created	C:\Windows\System\ReMYroR.exe	47a59c59d3ae78287229e8f034e23e00_NeikiAnalytics.exe
File created	C:\Windows\System\FzfWipS.exe	47a59c59d3ae78287229e8f034e23e00_NeikiAnalytics.exe
File created	C:\Windows\System\EUuCmRj.exe	47a59c59d3ae78287229e8f034e23e00_NeikiAnalytics.exe
File created	C:\Windows\System\VYDZoFM.exe	47a59c59d3ae78287229e8f034e23e00_NeikiAnalytics.exe
File created	C:\Windows\System\DgdPPDy.exe	47a59c59d3ae78287229e8f034e23e00_NeikiAnalytics.exe
File created	C:\Windows\System\afujYsC.exe	47a59c59d3ae78287229e8f034e23e00_NeikiAnalytics.exe
File created	C:\Windows\System\mHvMooh.exe	47a59c59d3ae78287229e8f034e23e00_NeikiAnalytics.exe
File created	C:\Windows\System\zTpArQP.exe	47a59c59d3ae78287229e8f034e23e00_NeikiAnalytics.exe
File created	C:\Windows\System\SjjQYdb.exe	47a59c59d3ae78287229e8f034e23e00_NeikiAnalytics.exe
File created	C:\Windows\System\crhRUxC.exe	47a59c59d3ae78287229e8f034e23e00_NeikiAnalytics.exe
File created	C:\Windows\System\AjcROVy.exe	47a59c59d3ae78287229e8f034e23e00_NeikiAnalytics.exe
File created	C:\Windows\System\huDWHOL.exe	47a59c59d3ae78287229e8f034e23e00_NeikiAnalytics.exe
File created	C:\Windows\System\gqphbIO.exe	47a59c59d3ae78287229e8f034e23e00_NeikiAnalytics.exe
File created	C:\Windows\System\waiggaX.exe	47a59c59d3ae78287229e8f034e23e00_NeikiAnalytics.exe
File created	C:\Windows\System\KYNvmpd.exe	47a59c59d3ae78287229e8f034e23e00_NeikiAnalytics.exe
File created	C:\Windows\System\UdtjWnb.exe	47a59c59d3ae78287229e8f034e23e00_NeikiAnalytics.exe
File created	C:\Windows\System\NbkpGjn.exe	47a59c59d3ae78287229e8f034e23e00_NeikiAnalytics.exe
File created	C:\Windows\System\dJUxrKS.exe	47a59c59d3ae78287229e8f034e23e00_NeikiAnalytics.exe
File created	C:\Windows\System\FESxFGg.exe	47a59c59d3ae78287229e8f034e23e00_NeikiAnalytics.exe
File created	C:\Windows\System\ltwErig.exe	47a59c59d3ae78287229e8f034e23e00_NeikiAnalytics.exe
File created	C:\Windows\System\YFgfpWP.exe	47a59c59d3ae78287229e8f034e23e00_NeikiAnalytics.exe
File created	C:\Windows\System\thtIckW.exe	47a59c59d3ae78287229e8f034e23e00_NeikiAnalytics.exe
File created	C:\Windows\System\IvhDJzo.exe	47a59c59d3ae78287229e8f034e23e00_NeikiAnalytics.exe
File created	C:\Windows\System\RpNWeMc.exe	47a59c59d3ae78287229e8f034e23e00_NeikiAnalytics.exe
File created	C:\Windows\System\nERKIet.exe	47a59c59d3ae78287229e8f034e23e00_NeikiAnalytics.exe
File created	C:\Windows\System\rVnVUFy.exe	47a59c59d3ae78287229e8f034e23e00_NeikiAnalytics.exe
File created	C:\Windows\System\epLvgzJ.exe	47a59c59d3ae78287229e8f034e23e00_NeikiAnalytics.exe
File created	C:\Windows\System\XZkeIDW.exe	47a59c59d3ae78287229e8f034e23e00_NeikiAnalytics.exe
File created	C:\Windows\System\YNvFkcL.exe	47a59c59d3ae78287229e8f034e23e00_NeikiAnalytics.exe
File created	C:\Windows\System\VBmHESB.exe	47a59c59d3ae78287229e8f034e23e00_NeikiAnalytics.exe
File created	C:\Windows\System\LSRRpZn.exe	47a59c59d3ae78287229e8f034e23e00_NeikiAnalytics.exe
File created	C:\Windows\System\sdEsLAN.exe	47a59c59d3ae78287229e8f034e23e00_NeikiAnalytics.exe
File created	C:\Windows\System\veVLMQW.exe	47a59c59d3ae78287229e8f034e23e00_NeikiAnalytics.exe
File created	C:\Windows\System\MGkEXeG.exe	47a59c59d3ae78287229e8f034e23e00_NeikiAnalytics.exe
File created	C:\Windows\System\aIfeNGP.exe	47a59c59d3ae78287229e8f034e23e00_NeikiAnalytics.exe
File created	C:\Windows\System\WmrPwPP.exe	47a59c59d3ae78287229e8f034e23e00_NeikiAnalytics.exe
File created	C:\Windows\System\iVbNNBu.exe	47a59c59d3ae78287229e8f034e23e00_NeikiAnalytics.exe
File created	C:\Windows\System\RiweZms.exe	47a59c59d3ae78287229e8f034e23e00_NeikiAnalytics.exe
File created	C:\Windows\System\wwfWdIH.exe	47a59c59d3ae78287229e8f034e23e00_NeikiAnalytics.exe
File created	C:\Windows\System\sWQKVeP.exe	47a59c59d3ae78287229e8f034e23e00_NeikiAnalytics.exe
File created	C:\Windows\System\VZylxRk.exe	47a59c59d3ae78287229e8f034e23e00_NeikiAnalytics.exe
File created	C:\Windows\System\aHvrGbP.exe	47a59c59d3ae78287229e8f034e23e00_NeikiAnalytics.exe
File created	C:\Windows\System\WbWIoeg.exe	47a59c59d3ae78287229e8f034e23e00_NeikiAnalytics.exe
File created	C:\Windows\System\NnlFiPG.exe	47a59c59d3ae78287229e8f034e23e00_NeikiAnalytics.exe
File created	C:\Windows\System\vDqUMaT.exe	47a59c59d3ae78287229e8f034e23e00_NeikiAnalytics.exe
File created	C:\Windows\System\boDAAFC.exe	47a59c59d3ae78287229e8f034e23e00_NeikiAnalytics.exe
File created	C:\Windows\System\HSoqNxy.exe	47a59c59d3ae78287229e8f034e23e00_NeikiAnalytics.exe
File created	C:\Windows\System\XLebJSc.exe	47a59c59d3ae78287229e8f034e23e00_NeikiAnalytics.exe
File created	C:\Windows\System\oJYMlCA.exe	47a59c59d3ae78287229e8f034e23e00_NeikiAnalytics.exe
File created	C:\Windows\System\ZKLhvIB.exe	47a59c59d3ae78287229e8f034e23e00_NeikiAnalytics.exe
File created	C:\Windows\System\biSYTzX.exe	47a59c59d3ae78287229e8f034e23e00_NeikiAnalytics.exe
File created	C:\Windows\System\hFUBVBs.exe	47a59c59d3ae78287229e8f034e23e00_NeikiAnalytics.exe
File created	C:\Windows\System\iVkWJSm.exe	47a59c59d3ae78287229e8f034e23e00_NeikiAnalytics.exe
File created	C:\Windows\System\bXBmEfi.exe	47a59c59d3ae78287229e8f034e23e00_NeikiAnalytics.exe
File created	C:\Windows\System\NapBCJP.exe	47a59c59d3ae78287229e8f034e23e00_NeikiAnalytics.exe
File created	C:\Windows\System\ygJGkQE.exe	47a59c59d3ae78287229e8f034e23e00_NeikiAnalytics.exe
File created	C:\Windows\System\uoWbMJQ.exe	47a59c59d3ae78287229e8f034e23e00_NeikiAnalytics.exe
File created	C:\Windows\System\aKorEEH.exe	47a59c59d3ae78287229e8f034e23e00_NeikiAnalytics.exe
File created	C:\Windows\System\jYjfsdH.exe	47a59c59d3ae78287229e8f034e23e00_NeikiAnalytics.exe
File created	C:\Windows\System\ehnzWPP.exe	47a59c59d3ae78287229e8f034e23e00_NeikiAnalytics.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	wermgr.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	wermgr.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
2680	powershell.exe
2680	powershell.exe
2680	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2100	47a59c59d3ae78287229e8f034e23e00_NeikiAnalytics.exe
Token: SeLockMemoryPrivilege	2100	47a59c59d3ae78287229e8f034e23e00_NeikiAnalytics.exe
Token: SeDebugPrivilege	2680	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2100 wrote to memory of 2680	2100	47a59c59d3ae78287229e8f034e23e00_NeikiAnalytics.exe	84
PID 2100 wrote to memory of 2680	2100	47a59c59d3ae78287229e8f034e23e00_NeikiAnalytics.exe	84
PID 2100 wrote to memory of 228	2100	47a59c59d3ae78287229e8f034e23e00_NeikiAnalytics.exe	85
PID 2100 wrote to memory of 228	2100	47a59c59d3ae78287229e8f034e23e00_NeikiAnalytics.exe	85
PID 2100 wrote to memory of 2628	2100	47a59c59d3ae78287229e8f034e23e00_NeikiAnalytics.exe	86
PID 2100 wrote to memory of 2628	2100	47a59c59d3ae78287229e8f034e23e00_NeikiAnalytics.exe	86
PID 2100 wrote to memory of 2156	2100	47a59c59d3ae78287229e8f034e23e00_NeikiAnalytics.exe	87
PID 2100 wrote to memory of 2156	2100	47a59c59d3ae78287229e8f034e23e00_NeikiAnalytics.exe	87
PID 2100 wrote to memory of 1204	2100	47a59c59d3ae78287229e8f034e23e00_NeikiAnalytics.exe	88
PID 2100 wrote to memory of 1204	2100	47a59c59d3ae78287229e8f034e23e00_NeikiAnalytics.exe	88
PID 2100 wrote to memory of 4208	2100	47a59c59d3ae78287229e8f034e23e00_NeikiAnalytics.exe	89
PID 2100 wrote to memory of 4208	2100	47a59c59d3ae78287229e8f034e23e00_NeikiAnalytics.exe	89
PID 2100 wrote to memory of 884	2100	47a59c59d3ae78287229e8f034e23e00_NeikiAnalytics.exe	90
PID 2100 wrote to memory of 884	2100	47a59c59d3ae78287229e8f034e23e00_NeikiAnalytics.exe	90
PID 2100 wrote to memory of 3152	2100	47a59c59d3ae78287229e8f034e23e00_NeikiAnalytics.exe	91
PID 2100 wrote to memory of 3152	2100	47a59c59d3ae78287229e8f034e23e00_NeikiAnalytics.exe	91
PID 2100 wrote to memory of 1624	2100	47a59c59d3ae78287229e8f034e23e00_NeikiAnalytics.exe	92
PID 2100 wrote to memory of 1624	2100	47a59c59d3ae78287229e8f034e23e00_NeikiAnalytics.exe	92
PID 2100 wrote to memory of 2320	2100	47a59c59d3ae78287229e8f034e23e00_NeikiAnalytics.exe	93
PID 2100 wrote to memory of 2320	2100	47a59c59d3ae78287229e8f034e23e00_NeikiAnalytics.exe	93
PID 2100 wrote to memory of 1688	2100	47a59c59d3ae78287229e8f034e23e00_NeikiAnalytics.exe	94
PID 2100 wrote to memory of 1688	2100	47a59c59d3ae78287229e8f034e23e00_NeikiAnalytics.exe	94
PID 2100 wrote to memory of 3908	2100	47a59c59d3ae78287229e8f034e23e00_NeikiAnalytics.exe	95
PID 2100 wrote to memory of 3908	2100	47a59c59d3ae78287229e8f034e23e00_NeikiAnalytics.exe	95
PID 2100 wrote to memory of 1896	2100	47a59c59d3ae78287229e8f034e23e00_NeikiAnalytics.exe	96
PID 2100 wrote to memory of 1896	2100	47a59c59d3ae78287229e8f034e23e00_NeikiAnalytics.exe	96
PID 2100 wrote to memory of 3168	2100	47a59c59d3ae78287229e8f034e23e00_NeikiAnalytics.exe	97
PID 2100 wrote to memory of 3168	2100	47a59c59d3ae78287229e8f034e23e00_NeikiAnalytics.exe	97
PID 2100 wrote to memory of 4072	2100	47a59c59d3ae78287229e8f034e23e00_NeikiAnalytics.exe	98
PID 2100 wrote to memory of 4072	2100	47a59c59d3ae78287229e8f034e23e00_NeikiAnalytics.exe	98
PID 2100 wrote to memory of 1620	2100	47a59c59d3ae78287229e8f034e23e00_NeikiAnalytics.exe	99
PID 2100 wrote to memory of 1620	2100	47a59c59d3ae78287229e8f034e23e00_NeikiAnalytics.exe	99
PID 2100 wrote to memory of 2136	2100	47a59c59d3ae78287229e8f034e23e00_NeikiAnalytics.exe	100
PID 2100 wrote to memory of 2136	2100	47a59c59d3ae78287229e8f034e23e00_NeikiAnalytics.exe	100
PID 2100 wrote to memory of 4804	2100	47a59c59d3ae78287229e8f034e23e00_NeikiAnalytics.exe	101
PID 2100 wrote to memory of 4804	2100	47a59c59d3ae78287229e8f034e23e00_NeikiAnalytics.exe	101
PID 2100 wrote to memory of 1208	2100	47a59c59d3ae78287229e8f034e23e00_NeikiAnalytics.exe	102
PID 2100 wrote to memory of 1208	2100	47a59c59d3ae78287229e8f034e23e00_NeikiAnalytics.exe	102
PID 2100 wrote to memory of 4752	2100	47a59c59d3ae78287229e8f034e23e00_NeikiAnalytics.exe	103
PID 2100 wrote to memory of 4752	2100	47a59c59d3ae78287229e8f034e23e00_NeikiAnalytics.exe	103
PID 2100 wrote to memory of 4700	2100	47a59c59d3ae78287229e8f034e23e00_NeikiAnalytics.exe	104
PID 2100 wrote to memory of 4700	2100	47a59c59d3ae78287229e8f034e23e00_NeikiAnalytics.exe	104
PID 2100 wrote to memory of 4504	2100	47a59c59d3ae78287229e8f034e23e00_NeikiAnalytics.exe	105
PID 2100 wrote to memory of 4504	2100	47a59c59d3ae78287229e8f034e23e00_NeikiAnalytics.exe	105
PID 2100 wrote to memory of 1060	2100	47a59c59d3ae78287229e8f034e23e00_NeikiAnalytics.exe	106
PID 2100 wrote to memory of 1060	2100	47a59c59d3ae78287229e8f034e23e00_NeikiAnalytics.exe	106
PID 2100 wrote to memory of 4772	2100	47a59c59d3ae78287229e8f034e23e00_NeikiAnalytics.exe	107
PID 2100 wrote to memory of 4772	2100	47a59c59d3ae78287229e8f034e23e00_NeikiAnalytics.exe	107
PID 2100 wrote to memory of 5104	2100	47a59c59d3ae78287229e8f034e23e00_NeikiAnalytics.exe	108
PID 2100 wrote to memory of 5104	2100	47a59c59d3ae78287229e8f034e23e00_NeikiAnalytics.exe	108
PID 2100 wrote to memory of 736	2100	47a59c59d3ae78287229e8f034e23e00_NeikiAnalytics.exe	109
PID 2100 wrote to memory of 736	2100	47a59c59d3ae78287229e8f034e23e00_NeikiAnalytics.exe	109
PID 2100 wrote to memory of 4872	2100	47a59c59d3ae78287229e8f034e23e00_NeikiAnalytics.exe	110
PID 2100 wrote to memory of 4872	2100	47a59c59d3ae78287229e8f034e23e00_NeikiAnalytics.exe	110
PID 2100 wrote to memory of 2260	2100	47a59c59d3ae78287229e8f034e23e00_NeikiAnalytics.exe	111
PID 2100 wrote to memory of 2260	2100	47a59c59d3ae78287229e8f034e23e00_NeikiAnalytics.exe	111
PID 2100 wrote to memory of 4704	2100	47a59c59d3ae78287229e8f034e23e00_NeikiAnalytics.exe	112
PID 2100 wrote to memory of 4704	2100	47a59c59d3ae78287229e8f034e23e00_NeikiAnalytics.exe	112
PID 2100 wrote to memory of 4064	2100	47a59c59d3ae78287229e8f034e23e00_NeikiAnalytics.exe	113
PID 2100 wrote to memory of 4064	2100	47a59c59d3ae78287229e8f034e23e00_NeikiAnalytics.exe	113
PID 2100 wrote to memory of 4988	2100	47a59c59d3ae78287229e8f034e23e00_NeikiAnalytics.exe	114
PID 2100 wrote to memory of 4988	2100	47a59c59d3ae78287229e8f034e23e00_NeikiAnalytics.exe	114
PID 2100 wrote to memory of 3080	2100	47a59c59d3ae78287229e8f034e23e00_NeikiAnalytics.exe	115
PID 2100 wrote to memory of 3080	2100	47a59c59d3ae78287229e8f034e23e00_NeikiAnalytics.exe	115

C:\Users\Admin\AppData\Local\Temp\47a59c59d3ae78287229e8f034e23e00_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\47a59c59d3ae78287229e8f034e23e00_NeikiAnalytics.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2100
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2680
- - C:\Windows\system32\wermgr.exe
    "C:\Windows\system32\wermgr.exe" "-outproc" "0" "2680" "2972" "2908" "2976" "0" "0" "2980" "0" "0" "0" "0" "0"
    3⤵
    - Checks processor information in registry
    - Enumerates system info in registry
    PID:12904
- C:\Windows\System\vFIAYsM.exe
  C:\Windows\System\vFIAYsM.exe
  2⤵
  - Executes dropped EXE
  PID:228
- C:\Windows\System\QEsrvgA.exe
  C:\Windows\System\QEsrvgA.exe
  2⤵
  - Executes dropped EXE
  PID:2628
- C:\Windows\System\AoplhzU.exe
  C:\Windows\System\AoplhzU.exe
  2⤵
  - Executes dropped EXE
  PID:2156
- C:\Windows\System\vhMJHyq.exe
  C:\Windows\System\vhMJHyq.exe
  2⤵
  - Executes dropped EXE
  PID:1204
- C:\Windows\System\jeqLJfA.exe
  C:\Windows\System\jeqLJfA.exe
  2⤵
  - Executes dropped EXE
  PID:4208
- C:\Windows\System\AsYoWRy.exe
  C:\Windows\System\AsYoWRy.exe
  2⤵
  - Executes dropped EXE
  PID:884
- C:\Windows\System\fnQAMrx.exe
  C:\Windows\System\fnQAMrx.exe
  2⤵
  - Executes dropped EXE
  PID:3152
- C:\Windows\System\NcMBVHW.exe
  C:\Windows\System\NcMBVHW.exe
  2⤵
  - Executes dropped EXE
  PID:1624
- C:\Windows\System\mtvzbfW.exe
  C:\Windows\System\mtvzbfW.exe
  2⤵
  - Executes dropped EXE
  PID:2320
- C:\Windows\System\nlvNetq.exe
  C:\Windows\System\nlvNetq.exe
  2⤵
  - Executes dropped EXE
  PID:1688
- C:\Windows\System\BEQLzVN.exe
  C:\Windows\System\BEQLzVN.exe
  2⤵
  - Executes dropped EXE
  PID:3908
- C:\Windows\System\EtKEzhC.exe
  C:\Windows\System\EtKEzhC.exe
  2⤵
  - Executes dropped EXE
  PID:1896
- C:\Windows\System\kTesPzp.exe
  C:\Windows\System\kTesPzp.exe
  2⤵
  - Executes dropped EXE
  PID:3168
- C:\Windows\System\zUnafQg.exe
  C:\Windows\System\zUnafQg.exe
  2⤵
  - Executes dropped EXE
  PID:4072
- C:\Windows\System\mrRZwaA.exe
  C:\Windows\System\mrRZwaA.exe
  2⤵
  - Executes dropped EXE
  PID:1620
- C:\Windows\System\ZNTxZoY.exe
  C:\Windows\System\ZNTxZoY.exe
  2⤵
  - Executes dropped EXE
  PID:2136
- C:\Windows\System\KBPIYTr.exe
  C:\Windows\System\KBPIYTr.exe
  2⤵
  - Executes dropped EXE
  PID:4804
- C:\Windows\System\thlFpRg.exe
  C:\Windows\System\thlFpRg.exe
  2⤵
  - Executes dropped EXE
  PID:1208
- C:\Windows\System\OWHWQCM.exe
  C:\Windows\System\OWHWQCM.exe
  2⤵
  - Executes dropped EXE
  PID:4752
- C:\Windows\System\rhRnRBv.exe
  C:\Windows\System\rhRnRBv.exe
  2⤵
  - Executes dropped EXE
  PID:4700
- C:\Windows\System\tIievhr.exe
  C:\Windows\System\tIievhr.exe
  2⤵
  - Executes dropped EXE
  PID:4504
- C:\Windows\System\cuAIcJG.exe
  C:\Windows\System\cuAIcJG.exe
  2⤵
  - Executes dropped EXE
  PID:1060
- C:\Windows\System\wgkdyBf.exe
  C:\Windows\System\wgkdyBf.exe
  2⤵
  - Executes dropped EXE
  PID:4772
- C:\Windows\System\SZemFKH.exe
  C:\Windows\System\SZemFKH.exe
  2⤵
  - Executes dropped EXE
  PID:5104
- C:\Windows\System\sCRgHCr.exe
  C:\Windows\System\sCRgHCr.exe
  2⤵
  - Executes dropped EXE
  PID:736
- C:\Windows\System\sprqrtl.exe
  C:\Windows\System\sprqrtl.exe
  2⤵
  - Executes dropped EXE
  PID:4872
- C:\Windows\System\LbeHsTh.exe
  C:\Windows\System\LbeHsTh.exe
  2⤵
  - Executes dropped EXE
  PID:2260
- C:\Windows\System\illJmqr.exe
  C:\Windows\System\illJmqr.exe
  2⤵
  - Executes dropped EXE
  PID:4704
- C:\Windows\System\LhPYKCw.exe
  C:\Windows\System\LhPYKCw.exe
  2⤵
  - Executes dropped EXE
  PID:4064
- C:\Windows\System\ULtiqEh.exe
  C:\Windows\System\ULtiqEh.exe
  2⤵
  - Executes dropped EXE
  PID:4988
- C:\Windows\System\KCLeLVP.exe
  C:\Windows\System\KCLeLVP.exe
  2⤵
  - Executes dropped EXE
  PID:3080
- C:\Windows\System\LQmJiZM.exe
  C:\Windows\System\LQmJiZM.exe
  2⤵
  - Executes dropped EXE
  PID:448
- C:\Windows\System\PHJhEov.exe
  C:\Windows\System\PHJhEov.exe
  2⤵
  - Executes dropped EXE
  PID:3256
- C:\Windows\System\grnHXPZ.exe
  C:\Windows\System\grnHXPZ.exe
  2⤵
  - Executes dropped EXE
  PID:5036
- C:\Windows\System\CAuulSl.exe
  C:\Windows\System\CAuulSl.exe
  2⤵
  - Executes dropped EXE
  PID:5044
- C:\Windows\System\tKTwpwo.exe
  C:\Windows\System\tKTwpwo.exe
  2⤵
  - Executes dropped EXE
  PID:1928
- C:\Windows\System\IkXQkug.exe
  C:\Windows\System\IkXQkug.exe
  2⤵
  - Executes dropped EXE
  PID:3532
- C:\Windows\System\uYfvwRK.exe
  C:\Windows\System\uYfvwRK.exe
  2⤵
  - Executes dropped EXE
  PID:2380
- C:\Windows\System\rrNorUM.exe
  C:\Windows\System\rrNorUM.exe
  2⤵
  - Executes dropped EXE
  PID:2056
- C:\Windows\System\MPLaleQ.exe
  C:\Windows\System\MPLaleQ.exe
  2⤵
  - Executes dropped EXE
  PID:840
- C:\Windows\System\zKOqyML.exe
  C:\Windows\System\zKOqyML.exe
  2⤵
  - Executes dropped EXE
  PID:3104
- C:\Windows\System\nBlpPsg.exe
  C:\Windows\System\nBlpPsg.exe
  2⤵
  - Executes dropped EXE
  PID:1576
- C:\Windows\System\TeasyOL.exe
  C:\Windows\System\TeasyOL.exe
  2⤵
  - Executes dropped EXE
  PID:632
- C:\Windows\System\kyOOKyt.exe
  C:\Windows\System\kyOOKyt.exe
  2⤵
  - Executes dropped EXE
  PID:4304
- C:\Windows\System\HAGiWzT.exe
  C:\Windows\System\HAGiWzT.exe
  2⤵
  - Executes dropped EXE
  PID:4292
- C:\Windows\System\pJMZNGq.exe
  C:\Windows\System\pJMZNGq.exe
  2⤵
  - Executes dropped EXE
  PID:3652
- C:\Windows\System\cYKJIOr.exe
  C:\Windows\System\cYKJIOr.exe
  2⤵
  - Executes dropped EXE
  PID:1560
- C:\Windows\System\qsFwYBa.exe
  C:\Windows\System\qsFwYBa.exe
  2⤵
  - Executes dropped EXE
  PID:4456
- C:\Windows\System\bRHjoEc.exe
  C:\Windows\System\bRHjoEc.exe
  2⤵
  - Executes dropped EXE
  PID:1324
- C:\Windows\System\ocjTcrJ.exe
  C:\Windows\System\ocjTcrJ.exe
  2⤵
  - Executes dropped EXE
  PID:1164
- C:\Windows\System\FrwOJZy.exe
  C:\Windows\System\FrwOJZy.exe
  2⤵
  - Executes dropped EXE
  PID:3680
- C:\Windows\System\gtbCYNh.exe
  C:\Windows\System\gtbCYNh.exe
  2⤵
  - Executes dropped EXE
  PID:2068
- C:\Windows\System\dXOUEbX.exe
  C:\Windows\System\dXOUEbX.exe
  2⤵
  - Executes dropped EXE
  PID:4924
- C:\Windows\System\TomhWVV.exe
  C:\Windows\System\TomhWVV.exe
  2⤵
  - Executes dropped EXE
  PID:4436
- C:\Windows\System\iQAadVi.exe
  C:\Windows\System\iQAadVi.exe
  2⤵
  - Executes dropped EXE
  PID:3408
- C:\Windows\System\llUCovt.exe
  C:\Windows\System\llUCovt.exe
  2⤵
  - Executes dropped EXE
  PID:3012
- C:\Windows\System\EhoHlvh.exe
  C:\Windows\System\EhoHlvh.exe
  2⤵
  - Executes dropped EXE
  PID:452
- C:\Windows\System\WuOiaru.exe
  C:\Windows\System\WuOiaru.exe
  2⤵
  - Executes dropped EXE
  PID:1400
- C:\Windows\System\kWmEwjV.exe
  C:\Windows\System\kWmEwjV.exe
  2⤵
  - Executes dropped EXE
  PID:1540
- C:\Windows\System\BqZqPEU.exe
  C:\Windows\System\BqZqPEU.exe
  2⤵
  - Executes dropped EXE
  PID:916
- C:\Windows\System\bhTuRAP.exe
  C:\Windows\System\bhTuRAP.exe
  2⤵
  - Executes dropped EXE
  PID:1836
- C:\Windows\System\XcsZgwj.exe
  C:\Windows\System\XcsZgwj.exe
  2⤵
  - Executes dropped EXE
  PID:1320
- C:\Windows\System\GdJhLdy.exe
  C:\Windows\System\GdJhLdy.exe
  2⤵
  - Executes dropped EXE
  PID:2372
- C:\Windows\System\XJqcter.exe
  C:\Windows\System\XJqcter.exe
  2⤵
  - Executes dropped EXE
  PID:224
- C:\Windows\System\CKIjAZY.exe
  C:\Windows\System\CKIjAZY.exe
  2⤵
  PID:4644
- C:\Windows\System\JPZJqhI.exe
  C:\Windows\System\JPZJqhI.exe
  2⤵
  PID:4308
- C:\Windows\System\hJWhJsI.exe
  C:\Windows\System\hJWhJsI.exe
  2⤵
  PID:3560
- C:\Windows\System\qgEdklN.exe
  C:\Windows\System\qgEdklN.exe
  2⤵
  PID:2940
- C:\Windows\System\AeSwaRo.exe
  C:\Windows\System\AeSwaRo.exe
  2⤵
  PID:856
- C:\Windows\System\zunsXzV.exe
  C:\Windows\System\zunsXzV.exe
  2⤵
  PID:1224
- C:\Windows\System\VrOqNGq.exe
  C:\Windows\System\VrOqNGq.exe
  2⤵
  PID:4068
- C:\Windows\System\aybgPht.exe
  C:\Windows\System\aybgPht.exe
  2⤵
  PID:1644
- C:\Windows\System\fhbAIXk.exe
  C:\Windows\System\fhbAIXk.exe
  2⤵
  PID:2732
- C:\Windows\System\FjqVUPl.exe
  C:\Windows\System\FjqVUPl.exe
  2⤵
  PID:440
- C:\Windows\System\VVSzvgE.exe
  C:\Windows\System\VVSzvgE.exe
  2⤵
  PID:5140
- C:\Windows\System\VoedoMq.exe
  C:\Windows\System\VoedoMq.exe
  2⤵
  PID:5172
- C:\Windows\System\siyQlum.exe
  C:\Windows\System\siyQlum.exe
  2⤵
  PID:5200
- C:\Windows\System\ihuHIjk.exe
  C:\Windows\System\ihuHIjk.exe
  2⤵
  PID:5232
- C:\Windows\System\XMeGvmY.exe
  C:\Windows\System\XMeGvmY.exe
  2⤵
  PID:5260
- C:\Windows\System\QJiyVlL.exe
  C:\Windows\System\QJiyVlL.exe
  2⤵
  PID:5284
- C:\Windows\System\BABvyIf.exe
  C:\Windows\System\BABvyIf.exe
  2⤵
  PID:5312
- C:\Windows\System\jvKusty.exe
  C:\Windows\System\jvKusty.exe
  2⤵
  PID:5340
- C:\Windows\System\qwqIfRl.exe
  C:\Windows\System\qwqIfRl.exe
  2⤵
  PID:5372
- C:\Windows\System\IYklipj.exe
  C:\Windows\System\IYklipj.exe
  2⤵
  PID:5400
- C:\Windows\System\bByiKwF.exe
  C:\Windows\System\bByiKwF.exe
  2⤵
  PID:5428
- C:\Windows\System\qtZXPRp.exe
  C:\Windows\System\qtZXPRp.exe
  2⤵
  PID:5456
- C:\Windows\System\OnZGqAZ.exe
  C:\Windows\System\OnZGqAZ.exe
  2⤵
  PID:5480
- C:\Windows\System\tSpUwSB.exe
  C:\Windows\System\tSpUwSB.exe
  2⤵
  PID:5508
- C:\Windows\System\VFkOnRS.exe
  C:\Windows\System\VFkOnRS.exe
  2⤵
  PID:5540
- C:\Windows\System\MyTYPCU.exe
  C:\Windows\System\MyTYPCU.exe
  2⤵
  PID:5568
- C:\Windows\System\KrBwtqg.exe
  C:\Windows\System\KrBwtqg.exe
  2⤵
  PID:5596
- C:\Windows\System\LQrSCck.exe
  C:\Windows\System\LQrSCck.exe
  2⤵
  PID:5624
- C:\Windows\System\NugFpHI.exe
  C:\Windows\System\NugFpHI.exe
  2⤵
  PID:5652
- C:\Windows\System\TOPDSuP.exe
  C:\Windows\System\TOPDSuP.exe
  2⤵
  PID:5680
- C:\Windows\System\PVQPUzI.exe
  C:\Windows\System\PVQPUzI.exe
  2⤵
  PID:5708
- C:\Windows\System\HWEdOly.exe
  C:\Windows\System\HWEdOly.exe
  2⤵
  PID:5736
- C:\Windows\System\LJewytc.exe
  C:\Windows\System\LJewytc.exe
  2⤵
  PID:5764
- C:\Windows\System\fibCwJY.exe
  C:\Windows\System\fibCwJY.exe
  2⤵
  PID:5792
- C:\Windows\System\oApAsow.exe
  C:\Windows\System\oApAsow.exe
  2⤵
  PID:5816
- C:\Windows\System\eLBSMbo.exe
  C:\Windows\System\eLBSMbo.exe
  2⤵
  PID:5848
- C:\Windows\System\olPGRlZ.exe
  C:\Windows\System\olPGRlZ.exe
  2⤵
  PID:5876
- C:\Windows\System\tgPTniX.exe
  C:\Windows\System\tgPTniX.exe
  2⤵
  PID:5904
- C:\Windows\System\ITmYbxh.exe
  C:\Windows\System\ITmYbxh.exe
  2⤵
  PID:5932
- C:\Windows\System\zFRTfgq.exe
  C:\Windows\System\zFRTfgq.exe
  2⤵
  PID:5960
- C:\Windows\System\GqiqXQM.exe
  C:\Windows\System\GqiqXQM.exe
  2⤵
  PID:5984
- C:\Windows\System\IbQNuAY.exe
  C:\Windows\System\IbQNuAY.exe
  2⤵
  PID:6016
- C:\Windows\System\XEcEKvP.exe
  C:\Windows\System\XEcEKvP.exe
  2⤵
  PID:6044
- C:\Windows\System\DydWmyx.exe
  C:\Windows\System\DydWmyx.exe
  2⤵
  PID:6072
- C:\Windows\System\xqBhEmb.exe
  C:\Windows\System\xqBhEmb.exe
  2⤵
  PID:6104
- C:\Windows\System\rSSVtCW.exe
  C:\Windows\System\rSSVtCW.exe
  2⤵
  PID:6128
- C:\Windows\System\PggYBNG.exe
  C:\Windows\System\PggYBNG.exe
  2⤵
  PID:1828
- C:\Windows\System\UmnYhID.exe
  C:\Windows\System\UmnYhID.exe
  2⤵
  PID:4992
- C:\Windows\System\mmdunLG.exe
  C:\Windows\System\mmdunLG.exe
  2⤵
  PID:2184
- C:\Windows\System\ERDWyzD.exe
  C:\Windows\System\ERDWyzD.exe
  2⤵
  PID:2296
- C:\Windows\System\XYpSWwu.exe
  C:\Windows\System\XYpSWwu.exe
  2⤵
  PID:1392
- C:\Windows\System\NSopyQP.exe
  C:\Windows\System\NSopyQP.exe
  2⤵
  PID:5184
- C:\Windows\System\GKRcBdB.exe
  C:\Windows\System\GKRcBdB.exe
  2⤵
  PID:5220
- C:\Windows\System\aysJvRy.exe
  C:\Windows\System\aysJvRy.exe
  2⤵
  PID:5300
- C:\Windows\System\LTPGsKs.exe
  C:\Windows\System\LTPGsKs.exe
  2⤵
  PID:5364
- C:\Windows\System\VaSiucG.exe
  C:\Windows\System\VaSiucG.exe
  2⤵
  PID:5440
- C:\Windows\System\nhSzYoI.exe
  C:\Windows\System\nhSzYoI.exe
  2⤵
  PID:5496
- C:\Windows\System\hUKPqPO.exe
  C:\Windows\System\hUKPqPO.exe
  2⤵
  PID:5552
- C:\Windows\System\XcplOhV.exe
  C:\Windows\System\XcplOhV.exe
  2⤵
  PID:5612
- C:\Windows\System\IJfGOTw.exe
  C:\Windows\System\IJfGOTw.exe
  2⤵
  PID:5672
- C:\Windows\System\yadljCy.exe
  C:\Windows\System\yadljCy.exe
  2⤵
  PID:5728
- C:\Windows\System\lYhOgsY.exe
  C:\Windows\System\lYhOgsY.exe
  2⤵
  PID:5784
- C:\Windows\System\rbQnKzJ.exe
  C:\Windows\System\rbQnKzJ.exe
  2⤵
  PID:5860
- C:\Windows\System\OYjIlId.exe
  C:\Windows\System\OYjIlId.exe
  2⤵
  PID:5896
- C:\Windows\System\DSWDsKM.exe
  C:\Windows\System\DSWDsKM.exe
  2⤵
  PID:5972
- C:\Windows\System\hhHeqPO.exe
  C:\Windows\System\hhHeqPO.exe
  2⤵
  PID:2412
- C:\Windows\System\AJftPyi.exe
  C:\Windows\System\AJftPyi.exe
  2⤵
  PID:6040
- C:\Windows\System\TLGEsmP.exe
  C:\Windows\System\TLGEsmP.exe
  2⤵
  PID:6096
- C:\Windows\System\AVyZzvC.exe
  C:\Windows\System\AVyZzvC.exe
  2⤵
  PID:3204
- C:\Windows\System\eIwJMLt.exe
  C:\Windows\System\eIwJMLt.exe
  2⤵
  PID:4940
- C:\Windows\System\EXCkhBX.exe
  C:\Windows\System\EXCkhBX.exe
  2⤵
  PID:3436
- C:\Windows\System\igHefre.exe
  C:\Windows\System\igHefre.exe
  2⤵
  PID:5192
- C:\Windows\System\xKGrgBh.exe
  C:\Windows\System\xKGrgBh.exe
  2⤵
  PID:5336
- C:\Windows\System\NDGVYtC.exe
  C:\Windows\System\NDGVYtC.exe
  2⤵
  PID:3488
- C:\Windows\System\hAgXost.exe
  C:\Windows\System\hAgXost.exe
  2⤵
  PID:5532
- C:\Windows\System\vRAocli.exe
  C:\Windows\System\vRAocli.exe
  2⤵
  PID:5644
- C:\Windows\System\vTHAldm.exe
  C:\Windows\System\vTHAldm.exe
  2⤵
  PID:544
- C:\Windows\System\fhHqYQU.exe
  C:\Windows\System\fhHqYQU.exe
  2⤵
  PID:3208
- C:\Windows\System\OWsCWhh.exe
  C:\Windows\System\OWsCWhh.exe
  2⤵
  PID:4052
- C:\Windows\System\eMFTaft.exe
  C:\Windows\System\eMFTaft.exe
  2⤵
  PID:6032
- C:\Windows\System\MrkyPKv.exe
  C:\Windows\System\MrkyPKv.exe
  2⤵
  PID:6124
- C:\Windows\System\ZYwHFOf.exe
  C:\Windows\System\ZYwHFOf.exe
  2⤵
  PID:1256
- C:\Windows\System\CUthiog.exe
  C:\Windows\System\CUthiog.exe
  2⤵
  PID:5164
- C:\Windows\System\ejeFxfQ.exe
  C:\Windows\System\ejeFxfQ.exe
  2⤵
  PID:5412
- C:\Windows\System\gSdyflU.exe
  C:\Windows\System\gSdyflU.exe
  2⤵
  PID:2368
- C:\Windows\System\SGoHtkJ.exe
  C:\Windows\System\SGoHtkJ.exe
  2⤵
  PID:2212
- C:\Windows\System\muvuESz.exe
  C:\Windows\System\muvuESz.exe
  2⤵
  PID:5812
- C:\Windows\System\PaBbAAQ.exe
  C:\Windows\System\PaBbAAQ.exe
  2⤵
  PID:4580
- C:\Windows\System\fdNxhHx.exe
  C:\Windows\System\fdNxhHx.exe
  2⤵
  PID:2764
- C:\Windows\System\DmfcIRM.exe
  C:\Windows\System\DmfcIRM.exe
  2⤵
  PID:5152
- C:\Windows\System\xaVxTic.exe
  C:\Windows\System\xaVxTic.exe
  2⤵
  PID:5640
- C:\Windows\System\VIoVgdF.exe
  C:\Windows\System\VIoVgdF.exe
  2⤵
  PID:5924
- C:\Windows\System\KGAdhZz.exe
  C:\Windows\System\KGAdhZz.exe
  2⤵
  PID:6164
- C:\Windows\System\QyKKFKs.exe
  C:\Windows\System\QyKKFKs.exe
  2⤵
  PID:6192
- C:\Windows\System\FSIacVd.exe
  C:\Windows\System\FSIacVd.exe
  2⤵
  PID:6220
- C:\Windows\System\eCZVqBJ.exe
  C:\Windows\System\eCZVqBJ.exe
  2⤵
  PID:6316
- C:\Windows\System\ktxNDwb.exe
  C:\Windows\System\ktxNDwb.exe
  2⤵
  PID:6336
- C:\Windows\System\kLiZbTF.exe
  C:\Windows\System\kLiZbTF.exe
  2⤵
  PID:6360
- C:\Windows\System\tTcxkSm.exe
  C:\Windows\System\tTcxkSm.exe
  2⤵
  PID:6408
- C:\Windows\System\vgwBBQx.exe
  C:\Windows\System\vgwBBQx.exe
  2⤵
  PID:6424
- C:\Windows\System\MJcmXOI.exe
  C:\Windows\System\MJcmXOI.exe
  2⤵
  PID:6448
- C:\Windows\System\mAKpZxZ.exe
  C:\Windows\System\mAKpZxZ.exe
  2⤵
  PID:6484
- C:\Windows\System\CPtOzZe.exe
  C:\Windows\System\CPtOzZe.exe
  2⤵
  PID:6516
- C:\Windows\System\oSKHJuC.exe
  C:\Windows\System\oSKHJuC.exe
  2⤵
  PID:6564
- C:\Windows\System\PHfcSom.exe
  C:\Windows\System\PHfcSom.exe
  2⤵
  PID:6580
- C:\Windows\System\YZbxilm.exe
  C:\Windows\System\YZbxilm.exe
  2⤵
  PID:6624
- C:\Windows\System\mVioklZ.exe
  C:\Windows\System\mVioklZ.exe
  2⤵
  PID:6644
- C:\Windows\System\PjPjCZA.exe
  C:\Windows\System\PjPjCZA.exe
  2⤵
  PID:6688
- C:\Windows\System\GmMHWde.exe
  C:\Windows\System\GmMHWde.exe
  2⤵
  PID:6724
- C:\Windows\System\OPCCNIX.exe
  C:\Windows\System\OPCCNIX.exe
  2⤵
  PID:6740
- C:\Windows\System\SQvMyfB.exe
  C:\Windows\System\SQvMyfB.exe
  2⤵
  PID:6772
- C:\Windows\System\WSylrZi.exe
  C:\Windows\System\WSylrZi.exe
  2⤵
  PID:6792
- C:\Windows\System\DXKzqBA.exe
  C:\Windows\System\DXKzqBA.exe
  2⤵
  PID:6812
- C:\Windows\System\QxWJhVq.exe
  C:\Windows\System\QxWJhVq.exe
  2⤵
  PID:6860
- C:\Windows\System\TUKGgwQ.exe
  C:\Windows\System\TUKGgwQ.exe
  2⤵
  PID:6884
- C:\Windows\System\UILtviC.exe
  C:\Windows\System\UILtviC.exe
  2⤵
  PID:6900
- C:\Windows\System\TwBESTO.exe
  C:\Windows\System\TwBESTO.exe
  2⤵
  PID:6924
- C:\Windows\System\tsECPnk.exe
  C:\Windows\System\tsECPnk.exe
  2⤵
  PID:6984
- C:\Windows\System\RXBIWpu.exe
  C:\Windows\System\RXBIWpu.exe
  2⤵
  PID:7000
- C:\Windows\System\tpcyZRx.exe
  C:\Windows\System\tpcyZRx.exe
  2⤵
  PID:7028
- C:\Windows\System\MVLdLvv.exe
  C:\Windows\System\MVLdLvv.exe
  2⤵
  PID:7056
- C:\Windows\System\IVacMMP.exe
  C:\Windows\System\IVacMMP.exe
  2⤵
  PID:7088
- C:\Windows\System\xgwVJPa.exe
  C:\Windows\System\xgwVJPa.exe
  2⤵
  PID:7108
- C:\Windows\System\VhDfluZ.exe
  C:\Windows\System\VhDfluZ.exe
  2⤵
  PID:7144
- C:\Windows\System\oZIiBFf.exe
  C:\Windows\System\oZIiBFf.exe
  2⤵
  PID:4424
- C:\Windows\System\koPjWGO.exe
  C:\Windows\System\koPjWGO.exe
  2⤵
  PID:1888
- C:\Windows\System\CFlbwIw.exe
  C:\Windows\System\CFlbwIw.exe
  2⤵
  PID:4892
- C:\Windows\System\BKBjSCl.exe
  C:\Windows\System\BKBjSCl.exe
  2⤵
  PID:3344
- C:\Windows\System\UMyZGMo.exe
  C:\Windows\System\UMyZGMo.exe
  2⤵
  PID:6260
- C:\Windows\System\oqQHzNe.exe
  C:\Windows\System\oqQHzNe.exe
  2⤵
  PID:4668
- C:\Windows\System\TncwZRP.exe
  C:\Windows\System\TncwZRP.exe
  2⤵
  PID:4848
- C:\Windows\System\hvHkfjS.exe
  C:\Windows\System\hvHkfjS.exe
  2⤵
  PID:4056
- C:\Windows\System\TSjuqCu.exe
  C:\Windows\System\TSjuqCu.exe
  2⤵
  PID:1420
- C:\Windows\System\vmYnUFE.exe
  C:\Windows\System\vmYnUFE.exe
  2⤵
  PID:1416
- C:\Windows\System\hYclAys.exe
  C:\Windows\System\hYclAys.exe
  2⤵
  PID:6344
- C:\Windows\System\trrJolC.exe
  C:\Windows\System\trrJolC.exe
  2⤵
  PID:6440
- C:\Windows\System\IjTcPez.exe
  C:\Windows\System\IjTcPez.exe
  2⤵
  PID:6492
- C:\Windows\System\dFZYpQl.exe
  C:\Windows\System\dFZYpQl.exe
  2⤵
  PID:6592
- C:\Windows\System\kOGrqog.exe
  C:\Windows\System\kOGrqog.exe
  2⤵
  PID:6604
- C:\Windows\System\haJoolZ.exe
  C:\Windows\System\haJoolZ.exe
  2⤵
  PID:6684
- C:\Windows\System\tTEYKgg.exe
  C:\Windows\System\tTEYKgg.exe
  2⤵
  PID:6736
- C:\Windows\System\oruifTN.exe
  C:\Windows\System\oruifTN.exe
  2⤵
  PID:6768
- C:\Windows\System\GppuEWi.exe
  C:\Windows\System\GppuEWi.exe
  2⤵
  PID:6876
- C:\Windows\System\MKwLoxd.exe
  C:\Windows\System\MKwLoxd.exe
  2⤵
  PID:7020
- C:\Windows\System\xWawQAb.exe
  C:\Windows\System\xWawQAb.exe
  2⤵
  PID:7068
- C:\Windows\System\JvZsqch.exe
  C:\Windows\System\JvZsqch.exe
  2⤵
  PID:6832
- C:\Windows\System\UrArjoJ.exe
  C:\Windows\System\UrArjoJ.exe
  2⤵
  PID:6856
- C:\Windows\System\ufSakgo.exe
  C:\Windows\System\ufSakgo.exe
  2⤵
  PID:6992
- C:\Windows\System\TBllBhW.exe
  C:\Windows\System\TBllBhW.exe
  2⤵
  PID:7136
- C:\Windows\System\mKOJrxB.exe
  C:\Windows\System\mKOJrxB.exe
  2⤵
  PID:6008
- C:\Windows\System\fGkTynl.exe
  C:\Windows\System\fGkTynl.exe
  2⤵
  PID:6148
- C:\Windows\System\UlxhNZa.exe
  C:\Windows\System\UlxhNZa.exe
  2⤵
  PID:4112
- C:\Windows\System\ylcKXLc.exe
  C:\Windows\System\ylcKXLc.exe
  2⤵
  PID:3964
- C:\Windows\System\dxwVCIX.exe
  C:\Windows\System\dxwVCIX.exe
  2⤵
  PID:6356
- C:\Windows\System\eIEpLjL.exe
  C:\Windows\System\eIEpLjL.exe
  2⤵
  PID:6432
- C:\Windows\System\YMDJatZ.exe
  C:\Windows\System\YMDJatZ.exe
  2⤵
  PID:6576
- C:\Windows\System\qQFJzMT.exe
  C:\Windows\System\qQFJzMT.exe
  2⤵
  PID:6764
- C:\Windows\System\ZrgWPWW.exe
  C:\Windows\System\ZrgWPWW.exe
  2⤵
  PID:6808
- C:\Windows\System\xuiqAhR.exe
  C:\Windows\System\xuiqAhR.exe
  2⤵
  PID:6212
- C:\Windows\System\kyYIERb.exe
  C:\Windows\System\kyYIERb.exe
  2⤵
  PID:5124
- C:\Windows\System\LUjIHSB.exe
  C:\Windows\System\LUjIHSB.exe
  2⤵
  PID:7216
- C:\Windows\System\dHGsWmw.exe
  C:\Windows\System\dHGsWmw.exe
  2⤵
  PID:7240
- C:\Windows\System\OBDmONq.exe
  C:\Windows\System\OBDmONq.exe
  2⤵
  PID:7256
- C:\Windows\System\FKGiqPF.exe
  C:\Windows\System\FKGiqPF.exe
  2⤵
  PID:7304
- C:\Windows\System\ecwfyjV.exe
  C:\Windows\System\ecwfyjV.exe
  2⤵
  PID:7328
- C:\Windows\System\LVfETnj.exe
  C:\Windows\System\LVfETnj.exe
  2⤵
  PID:7348
- C:\Windows\System\dpuBisv.exe
  C:\Windows\System\dpuBisv.exe
  2⤵
  PID:7376
- C:\Windows\System\FNoLoxd.exe
  C:\Windows\System\FNoLoxd.exe
  2⤵
  PID:7428
- C:\Windows\System\gFPbdOM.exe
  C:\Windows\System\gFPbdOM.exe
  2⤵
  PID:7448
- C:\Windows\System\fxTYoCu.exe
  C:\Windows\System\fxTYoCu.exe
  2⤵
  PID:7464
- C:\Windows\System\dwRrKYJ.exe
  C:\Windows\System\dwRrKYJ.exe
  2⤵
  PID:7492
- C:\Windows\System\lgOudGk.exe
  C:\Windows\System\lgOudGk.exe
  2⤵
  PID:7516
- C:\Windows\System\FVvBxFH.exe
  C:\Windows\System\FVvBxFH.exe
  2⤵
  PID:7540
- C:\Windows\System\iJIVotn.exe
  C:\Windows\System\iJIVotn.exe
  2⤵
  PID:7588
- C:\Windows\System\rxlyFYI.exe
  C:\Windows\System\rxlyFYI.exe
  2⤵
  PID:7608
- C:\Windows\System\TJKxihH.exe
  C:\Windows\System\TJKxihH.exe
  2⤵
  PID:7648
- C:\Windows\System\ElltkCe.exe
  C:\Windows\System\ElltkCe.exe
  2⤵
  PID:7668
- C:\Windows\System\awSMoLQ.exe
  C:\Windows\System\awSMoLQ.exe
  2⤵
  PID:7692
- C:\Windows\System\DinNUkp.exe
  C:\Windows\System\DinNUkp.exe
  2⤵
  PID:7716
- C:\Windows\System\guUQAig.exe
  C:\Windows\System\guUQAig.exe
  2⤵
  PID:7740
- C:\Windows\System\mURXYrJ.exe
  C:\Windows\System\mURXYrJ.exe
  2⤵
  PID:7784
- C:\Windows\System\ezupura.exe
  C:\Windows\System\ezupura.exe
  2⤵
  PID:7808
- C:\Windows\System\MTQAQXU.exe
  C:\Windows\System\MTQAQXU.exe
  2⤵
  PID:7828
- C:\Windows\System\XPZikMe.exe
  C:\Windows\System\XPZikMe.exe
  2⤵
  PID:7860
- C:\Windows\System\iKRJIVC.exe
  C:\Windows\System\iKRJIVC.exe
  2⤵
  PID:7880
- C:\Windows\System\GVXkLZL.exe
  C:\Windows\System\GVXkLZL.exe
  2⤵
  PID:7904
- C:\Windows\System\GnIhtSK.exe
  C:\Windows\System\GnIhtSK.exe
  2⤵
  PID:7936
- C:\Windows\System\DVtvWmm.exe
  C:\Windows\System\DVtvWmm.exe
  2⤵
  PID:7980
- C:\Windows\System\uTfwBkG.exe
  C:\Windows\System\uTfwBkG.exe
  2⤵
  PID:8000
- C:\Windows\System\wBgysiQ.exe
  C:\Windows\System\wBgysiQ.exe
  2⤵
  PID:8020
- C:\Windows\System\upQYxbP.exe
  C:\Windows\System\upQYxbP.exe
  2⤵
  PID:8048
- C:\Windows\System\DOciINg.exe
  C:\Windows\System\DOciINg.exe
  2⤵
  PID:8076
- C:\Windows\System\LukBcOM.exe
  C:\Windows\System\LukBcOM.exe
  2⤵
  PID:8100
- C:\Windows\System\eBujJEw.exe
  C:\Windows\System\eBujJEw.exe
  2⤵
  PID:8120
- C:\Windows\System\JEVzVwi.exe
  C:\Windows\System\JEVzVwi.exe
  2⤵
  PID:8148
- C:\Windows\System\snZqZmc.exe
  C:\Windows\System\snZqZmc.exe
  2⤵
  PID:8172
- C:\Windows\System\tuQOtxU.exe
  C:\Windows\System\tuQOtxU.exe
  2⤵
  PID:6640
- C:\Windows\System\RhiHSiM.exe
  C:\Windows\System\RhiHSiM.exe
  2⤵
  PID:7236
- C:\Windows\System\TZgbzKJ.exe
  C:\Windows\System\TZgbzKJ.exe
  2⤵
  PID:7296
- C:\Windows\System\cibuqVj.exe
  C:\Windows\System\cibuqVj.exe
  2⤵
  PID:7384
- C:\Windows\System\QVlGtFJ.exe
  C:\Windows\System\QVlGtFJ.exe
  2⤵
  PID:7476
- C:\Windows\System\zPoDLHO.exe
  C:\Windows\System\zPoDLHO.exe
  2⤵
  PID:7508
- C:\Windows\System\SPRmpNG.exe
  C:\Windows\System\SPRmpNG.exe
  2⤵
  PID:7576
- C:\Windows\System\BvbRucR.exe
  C:\Windows\System\BvbRucR.exe
  2⤵
  PID:7604
- C:\Windows\System\yCFAYET.exe
  C:\Windows\System\yCFAYET.exe
  2⤵
  PID:7684
- C:\Windows\System\ypfrGOV.exe
  C:\Windows\System\ypfrGOV.exe
  2⤵
  PID:7644
- C:\Windows\System\vUbVdGv.exe
  C:\Windows\System\vUbVdGv.exe
  2⤵
  PID:7800
- C:\Windows\System\MazTQFH.exe
  C:\Windows\System\MazTQFH.exe
  2⤵
  PID:7948
- C:\Windows\System\niabzAP.exe
  C:\Windows\System\niabzAP.exe
  2⤵
  PID:7956
- C:\Windows\System\dVHgQaO.exe
  C:\Windows\System\dVHgQaO.exe
  2⤵
  PID:8028
- C:\Windows\System\KVLIRAM.exe
  C:\Windows\System\KVLIRAM.exe
  2⤵
  PID:8060
- C:\Windows\System\SbwiiAB.exe
  C:\Windows\System\SbwiiAB.exe
  2⤵
  PID:8112
- C:\Windows\System\iasJIbe.exe
  C:\Windows\System\iasJIbe.exe
  2⤵
  PID:8184
- C:\Windows\System\nExRrtQ.exe
  C:\Windows\System\nExRrtQ.exe
  2⤵
  PID:7356
- C:\Windows\System\JDehLyj.exe
  C:\Windows\System\JDehLyj.exe
  2⤵
  PID:7336
- C:\Windows\System\IOZnjIT.exe
  C:\Windows\System\IOZnjIT.exe
  2⤵
  PID:7504
- C:\Windows\System\fCBNNHr.exe
  C:\Windows\System\fCBNNHr.exe
  2⤵
  PID:7564
- C:\Windows\System\TKsdhPf.exe
  C:\Windows\System\TKsdhPf.exe
  2⤵
  PID:7748
- C:\Windows\System\HdTRPwf.exe
  C:\Windows\System\HdTRPwf.exe
  2⤵
  PID:7932
- C:\Windows\System\oRkDkfy.exe
  C:\Windows\System\oRkDkfy.exe
  2⤵
  PID:8068
- C:\Windows\System\plScpoJ.exe
  C:\Windows\System\plScpoJ.exe
  2⤵
  PID:8136
- C:\Windows\System\ksEgssL.exe
  C:\Windows\System\ksEgssL.exe
  2⤵
  PID:7440
- C:\Windows\System\VofACfv.exe
  C:\Windows\System\VofACfv.exe
  2⤵
  PID:7600
- C:\Windows\System\lvefCXO.exe
  C:\Windows\System\lvefCXO.exe
  2⤵
  PID:7852
- C:\Windows\System\utCsyzr.exe
  C:\Windows\System\utCsyzr.exe
  2⤵
  PID:2904
- C:\Windows\System\ANpWnZi.exe
  C:\Windows\System\ANpWnZi.exe
  2⤵
  PID:7900
- C:\Windows\System\VByPoRX.exe
  C:\Windows\System\VByPoRX.exe
  2⤵
  PID:8216
- C:\Windows\System\NtRQKGu.exe
  C:\Windows\System\NtRQKGu.exe
  2⤵
  PID:8248
- C:\Windows\System\AhVvzhI.exe
  C:\Windows\System\AhVvzhI.exe
  2⤵
  PID:8268
- C:\Windows\System\KLZBbbF.exe
  C:\Windows\System\KLZBbbF.exe
  2⤵
  PID:8316
- C:\Windows\System\VutefxJ.exe
  C:\Windows\System\VutefxJ.exe
  2⤵
  PID:8336
- C:\Windows\System\xLiHZdt.exe
  C:\Windows\System\xLiHZdt.exe
  2⤵
  PID:8360
- C:\Windows\System\HjxcHbW.exe
  C:\Windows\System\HjxcHbW.exe
  2⤵
  PID:8400
- C:\Windows\System\JTibOAc.exe
  C:\Windows\System\JTibOAc.exe
  2⤵
  PID:8424
- C:\Windows\System\WuPGawL.exe
  C:\Windows\System\WuPGawL.exe
  2⤵
  PID:8440
- C:\Windows\System\XSYOfqk.exe
  C:\Windows\System\XSYOfqk.exe
  2⤵
  PID:8480
- C:\Windows\System\QruWKmG.exe
  C:\Windows\System\QruWKmG.exe
  2⤵
  PID:8500
- C:\Windows\System\bnMhOFc.exe
  C:\Windows\System\bnMhOFc.exe
  2⤵
  PID:8516
- C:\Windows\System\wbkNvzH.exe
  C:\Windows\System\wbkNvzH.exe
  2⤵
  PID:8536
- C:\Windows\System\nuBNqLS.exe
  C:\Windows\System\nuBNqLS.exe
  2⤵
  PID:8560
- C:\Windows\System\XbVBJNB.exe
  C:\Windows\System\XbVBJNB.exe
  2⤵
  PID:8580
- C:\Windows\System\jROKJxY.exe
  C:\Windows\System\jROKJxY.exe
  2⤵
  PID:8604
- C:\Windows\System\bTkLsoP.exe
  C:\Windows\System\bTkLsoP.exe
  2⤵
  PID:8676
- C:\Windows\System\VAPondP.exe
  C:\Windows\System\VAPondP.exe
  2⤵
  PID:8700
- C:\Windows\System\hfwOcvi.exe
  C:\Windows\System\hfwOcvi.exe
  2⤵
  PID:8716
- C:\Windows\System\cPmNEiY.exe
  C:\Windows\System\cPmNEiY.exe
  2⤵
  PID:8764
- C:\Windows\System\hwmlEQD.exe
  C:\Windows\System\hwmlEQD.exe
  2⤵
  PID:8792
- C:\Windows\System\ZfXKxSt.exe
  C:\Windows\System\ZfXKxSt.exe
  2⤵
  PID:8808
- C:\Windows\System\tzhapNF.exe
  C:\Windows\System\tzhapNF.exe
  2⤵
  PID:8828
- C:\Windows\System\XDzMyPd.exe
  C:\Windows\System\XDzMyPd.exe
  2⤵
  PID:8856
- C:\Windows\System\eFfROqE.exe
  C:\Windows\System\eFfROqE.exe
  2⤵
  PID:8880
- C:\Windows\System\xKZsHOP.exe
  C:\Windows\System\xKZsHOP.exe
  2⤵
  PID:8896
- C:\Windows\System\XASNSDA.exe
  C:\Windows\System\XASNSDA.exe
  2⤵
  PID:8928
- C:\Windows\System\NrnHdKB.exe
  C:\Windows\System\NrnHdKB.exe
  2⤵
  PID:8944
- C:\Windows\System\XoOHZJG.exe
  C:\Windows\System\XoOHZJG.exe
  2⤵
  PID:8984
- C:\Windows\System\PtexHBV.exe
  C:\Windows\System\PtexHBV.exe
  2⤵
  PID:9032
- C:\Windows\System\zlRehSV.exe
  C:\Windows\System\zlRehSV.exe
  2⤵
  PID:9048
- C:\Windows\System\nbYzMsZ.exe
  C:\Windows\System\nbYzMsZ.exe
  2⤵
  PID:9096
- C:\Windows\System\mAKeCgm.exe
  C:\Windows\System\mAKeCgm.exe
  2⤵
  PID:9124
- C:\Windows\System\osaZnfP.exe
  C:\Windows\System\osaZnfP.exe
  2⤵
  PID:9152
- C:\Windows\System\DFdOKhZ.exe
  C:\Windows\System\DFdOKhZ.exe
  2⤵
  PID:9172
- C:\Windows\System\dhmRUiA.exe
  C:\Windows\System\dhmRUiA.exe
  2⤵
  PID:9188
- C:\Windows\System\JvGjwQS.exe
  C:\Windows\System\JvGjwQS.exe
  2⤵
  PID:7704
- C:\Windows\System\pDzQtZH.exe
  C:\Windows\System\pDzQtZH.exe
  2⤵
  PID:8208
- C:\Windows\System\ZYeNXfn.exe
  C:\Windows\System\ZYeNXfn.exe
  2⤵
  PID:8244
- C:\Windows\System\ZTYGKnV.exe
  C:\Windows\System\ZTYGKnV.exe
  2⤵
  PID:8296
- C:\Windows\System\DyPctHx.exe
  C:\Windows\System\DyPctHx.exe
  2⤵
  PID:4356
- C:\Windows\System\yKQBDdN.exe
  C:\Windows\System\yKQBDdN.exe
  2⤵
  PID:8488
- C:\Windows\System\fzunHZd.exe
  C:\Windows\System\fzunHZd.exe
  2⤵
  PID:8496
- C:\Windows\System\qoXTHzm.exe
  C:\Windows\System\qoXTHzm.exe
  2⤵
  PID:8532
- C:\Windows\System\KYgxNog.exe
  C:\Windows\System\KYgxNog.exe
  2⤵
  PID:8588
- C:\Windows\System\UVSjMgH.exe
  C:\Windows\System\UVSjMgH.exe
  2⤵
  PID:8724
- C:\Windows\System\Pbkvmnz.exe
  C:\Windows\System\Pbkvmnz.exe
  2⤵
  PID:8712
- C:\Windows\System\YFNsstF.exe
  C:\Windows\System\YFNsstF.exe
  2⤵
  PID:8804
- C:\Windows\System\axjkcVp.exe
  C:\Windows\System\axjkcVp.exe
  2⤵
  PID:8836
- C:\Windows\System\nNBmPqC.exe
  C:\Windows\System\nNBmPqC.exe
  2⤵
  PID:8940
- C:\Windows\System\EiwPghE.exe
  C:\Windows\System\EiwPghE.exe
  2⤵
  PID:9024
- C:\Windows\System\qmqKDrY.exe
  C:\Windows\System\qmqKDrY.exe
  2⤵
  PID:9132
- C:\Windows\System\kwDpPUe.exe
  C:\Windows\System\kwDpPUe.exe
  2⤵
  PID:9136
- C:\Windows\System\TmJYfzB.exe
  C:\Windows\System\TmJYfzB.exe
  2⤵
  PID:2796
- C:\Windows\System\UYpVpUm.exe
  C:\Windows\System\UYpVpUm.exe
  2⤵
  PID:8232
- C:\Windows\System\XJFJSwa.exe
  C:\Windows\System\XJFJSwa.exe
  2⤵
  PID:8472
- C:\Windows\System\jzvtFCe.exe
  C:\Windows\System\jzvtFCe.exe
  2⤵
  PID:8616
- C:\Windows\System\OKwrsUr.exe
  C:\Windows\System\OKwrsUr.exe
  2⤵
  PID:8684
- C:\Windows\System\XZEXgsG.exe
  C:\Windows\System\XZEXgsG.exe
  2⤵
  PID:8852
- C:\Windows\System\cOSIRAN.exe
  C:\Windows\System\cOSIRAN.exe
  2⤵
  PID:9092
- C:\Windows\System\empUYsI.exe
  C:\Windows\System\empUYsI.exe
  2⤵
  PID:9164
- C:\Windows\System\hoIhSIg.exe
  C:\Windows\System\hoIhSIg.exe
  2⤵
  PID:8352
- C:\Windows\System\mqQiIyR.exe
  C:\Windows\System\mqQiIyR.exe
  2⤵
  PID:4856
- C:\Windows\System\XLdgZtl.exe
  C:\Windows\System\XLdgZtl.exe
  2⤵
  PID:8748
- C:\Windows\System\rQFPzNf.exe
  C:\Windows\System\rQFPzNf.exe
  2⤵
  PID:7204
- C:\Windows\System\yAnphTH.exe
  C:\Windows\System\yAnphTH.exe
  2⤵
  PID:9224
- C:\Windows\System\NderwTS.exe
  C:\Windows\System\NderwTS.exe
  2⤵
  PID:9280
- C:\Windows\System\adyEyTf.exe
  C:\Windows\System\adyEyTf.exe
  2⤵
  PID:9300
- C:\Windows\System\nhjBMQG.exe
  C:\Windows\System\nhjBMQG.exe
  2⤵
  PID:9376
- C:\Windows\System\YbguHJM.exe
  C:\Windows\System\YbguHJM.exe
  2⤵
  PID:9416
- C:\Windows\System\zeFmQGN.exe
  C:\Windows\System\zeFmQGN.exe
  2⤵
  PID:9472
- C:\Windows\System\DNClqKZ.exe
  C:\Windows\System\DNClqKZ.exe
  2⤵
  PID:9488
- C:\Windows\System\XDSdzsf.exe
  C:\Windows\System\XDSdzsf.exe
  2⤵
  PID:9504
- C:\Windows\System\btsZYgQ.exe
  C:\Windows\System\btsZYgQ.exe
  2⤵
  PID:9520
- C:\Windows\System\ukJzYrH.exe
  C:\Windows\System\ukJzYrH.exe
  2⤵
  PID:9536
- C:\Windows\System\tunwnLJ.exe
  C:\Windows\System\tunwnLJ.exe
  2⤵
  PID:9556
- C:\Windows\System\bxGeRBK.exe
  C:\Windows\System\bxGeRBK.exe
  2⤵
  PID:9672
- C:\Windows\System\mCYdXFz.exe
  C:\Windows\System\mCYdXFz.exe
  2⤵
  PID:9688
- C:\Windows\System\DKBOlzT.exe
  C:\Windows\System\DKBOlzT.exe
  2⤵
  PID:9704
- C:\Windows\System\sFpczYu.exe
  C:\Windows\System\sFpczYu.exe
  2⤵
  PID:9720
- C:\Windows\System\RzemuOr.exe
  C:\Windows\System\RzemuOr.exe
  2⤵
  PID:9736
- C:\Windows\System\DYttWbi.exe
  C:\Windows\System\DYttWbi.exe
  2⤵
  PID:9752
- C:\Windows\System\KFcRYDN.exe
  C:\Windows\System\KFcRYDN.exe
  2⤵
  PID:9828
- C:\Windows\System\XAlrpMO.exe
  C:\Windows\System\XAlrpMO.exe
  2⤵
  PID:9872
- C:\Windows\System\jyaUAHF.exe
  C:\Windows\System\jyaUAHF.exe
  2⤵
  PID:9892
- C:\Windows\System\KKSBTWm.exe
  C:\Windows\System\KKSBTWm.exe
  2⤵
  PID:9948
- C:\Windows\System\JhcpBAw.exe
  C:\Windows\System\JhcpBAw.exe
  2⤵
  PID:9972
- C:\Windows\System\LcsrnBh.exe
  C:\Windows\System\LcsrnBh.exe
  2⤵
  PID:9996
- C:\Windows\System\CdvRMuc.exe
  C:\Windows\System\CdvRMuc.exe
  2⤵
  PID:10012
- C:\Windows\System\NQfGrUs.exe
  C:\Windows\System\NQfGrUs.exe
  2⤵
  PID:10040
- C:\Windows\System\SXuugkH.exe
  C:\Windows\System\SXuugkH.exe
  2⤵
  PID:10064
- C:\Windows\System\stEOMfX.exe
  C:\Windows\System\stEOMfX.exe
  2⤵
  PID:10108
- C:\Windows\System\FVFDkVF.exe
  C:\Windows\System\FVFDkVF.exe
  2⤵
  PID:10156
- C:\Windows\System\zbUAkhc.exe
  C:\Windows\System\zbUAkhc.exe
  2⤵
  PID:10172
- C:\Windows\System\UcXRFkV.exe
  C:\Windows\System\UcXRFkV.exe
  2⤵
  PID:10196
- C:\Windows\System\Tcinxpb.exe
  C:\Windows\System\Tcinxpb.exe
  2⤵
  PID:10236
- C:\Windows\System\GKkAoEx.exe
  C:\Windows\System\GKkAoEx.exe
  2⤵
  PID:1544
- C:\Windows\System\KddmDIW.exe
  C:\Windows\System\KddmDIW.exe
  2⤵
  PID:9248
- C:\Windows\System\LuGNUOn.exe
  C:\Windows\System\LuGNUOn.exe
  2⤵
  PID:9408
- C:\Windows\System\lWoltpI.exe
  C:\Windows\System\lWoltpI.exe
  2⤵
  PID:5080
- C:\Windows\System\RSbkcFs.exe
  C:\Windows\System\RSbkcFs.exe
  2⤵
  PID:9440
- C:\Windows\System\OHrtahd.exe
  C:\Windows\System\OHrtahd.exe
  2⤵
  PID:9552
- C:\Windows\System\ondvLkK.exe
  C:\Windows\System\ondvLkK.exe
  2⤵
  PID:9412
- C:\Windows\System\iZIZKUP.exe
  C:\Windows\System\iZIZKUP.exe
  2⤵
  PID:9612
- C:\Windows\System\TcGPfpi.exe
  C:\Windows\System\TcGPfpi.exe
  2⤵
  PID:9652
- C:\Windows\System\Vtzaotx.exe
  C:\Windows\System\Vtzaotx.exe
  2⤵
  PID:9664
- C:\Windows\System\iSHawfm.exe
  C:\Windows\System\iSHawfm.exe
  2⤵
  PID:9764
- C:\Windows\System\bDYMAOf.exe
  C:\Windows\System\bDYMAOf.exe
  2⤵
  PID:9680
- C:\Windows\System\pRHnQVp.exe
  C:\Windows\System\pRHnQVp.exe
  2⤵
  PID:9748
- C:\Windows\System\SyOmSZe.exe
  C:\Windows\System\SyOmSZe.exe
  2⤵
  PID:9844
- C:\Windows\System\PRsaEQs.exe
  C:\Windows\System\PRsaEQs.exe
  2⤵
  PID:9860
- C:\Windows\System\OJjAQQa.exe
  C:\Windows\System\OJjAQQa.exe
  2⤵
  PID:9980
- C:\Windows\System\OQGARbZ.exe
  C:\Windows\System\OQGARbZ.exe
  2⤵
  PID:9964
- C:\Windows\System\GyDVfjf.exe
  C:\Windows\System\GyDVfjf.exe
  2⤵
  PID:10048
- C:\Windows\System\KNcGpUQ.exe
  C:\Windows\System\KNcGpUQ.exe
  2⤵
  PID:10140
- C:\Windows\System\dUGNGZV.exe
  C:\Windows\System\dUGNGZV.exe
  2⤵
  PID:10168
- C:\Windows\System\MuqnfRA.exe
  C:\Windows\System\MuqnfRA.exe
  2⤵
  PID:9240
- C:\Windows\System\tIxdzDh.exe
  C:\Windows\System\tIxdzDh.exe
  2⤵
  PID:4492
- C:\Windows\System\PSqikZh.exe
  C:\Windows\System\PSqikZh.exe
  2⤵
  PID:9600
- C:\Windows\System\DvFYXQT.exe
  C:\Windows\System\DvFYXQT.exe
  2⤵
  PID:9784
- C:\Windows\System\qxHwfRf.exe
  C:\Windows\System\qxHwfRf.exe
  2⤵
  PID:9588
- C:\Windows\System\kUlZjPs.exe
  C:\Windows\System\kUlZjPs.exe
  2⤵
  PID:10004
- C:\Windows\System\JwVWBYk.exe
  C:\Windows\System\JwVWBYk.exe
  2⤵
  PID:10104
- C:\Windows\System\domVsvD.exe
  C:\Windows\System\domVsvD.exe
  2⤵
  PID:10152
- C:\Windows\System\JZRFJIN.exe
  C:\Windows\System\JZRFJIN.exe
  2⤵
  PID:9500
- C:\Windows\System\VvCATfk.exe
  C:\Windows\System\VvCATfk.exe
  2⤵
  PID:9580
- C:\Windows\System\ELXWCwc.exe
  C:\Windows\System\ELXWCwc.exe
  2⤵
  PID:9712
- C:\Windows\System\ZiVdYyu.exe
  C:\Windows\System\ZiVdYyu.exe
  2⤵
  PID:10232
- C:\Windows\System\piBbMmR.exe
  C:\Windows\System\piBbMmR.exe
  2⤵
  PID:9368
- C:\Windows\System\IQreHOQ.exe
  C:\Windows\System\IQreHOQ.exe
  2⤵
  PID:10260
- C:\Windows\System\RfLaCSV.exe
  C:\Windows\System\RfLaCSV.exe
  2⤵
  PID:10288
- C:\Windows\System\PsZkhkB.exe
  C:\Windows\System\PsZkhkB.exe
  2⤵
  PID:10312
- C:\Windows\System\loyJUvw.exe
  C:\Windows\System\loyJUvw.exe
  2⤵
  PID:10348
- C:\Windows\System\KKGFaKB.exe
  C:\Windows\System\KKGFaKB.exe
  2⤵
  PID:10388
- C:\Windows\System\sWryIkj.exe
  C:\Windows\System\sWryIkj.exe
  2⤵
  PID:10408
- C:\Windows\System\HBWIDxD.exe
  C:\Windows\System\HBWIDxD.exe
  2⤵
  PID:10452
- C:\Windows\System\DSJjJUy.exe
  C:\Windows\System\DSJjJUy.exe
  2⤵
  PID:10484
- C:\Windows\System\ootYINZ.exe
  C:\Windows\System\ootYINZ.exe
  2⤵
  PID:10504
- C:\Windows\System\vPJXrli.exe
  C:\Windows\System\vPJXrli.exe
  2⤵
  PID:10528
- C:\Windows\System\QSzfzce.exe
  C:\Windows\System\QSzfzce.exe
  2⤵
  PID:10548
- C:\Windows\System\fwWEWle.exe
  C:\Windows\System\fwWEWle.exe
  2⤵
  PID:10584
- C:\Windows\System\cxscFIf.exe
  C:\Windows\System\cxscFIf.exe
  2⤵
  PID:10600
- C:\Windows\System\MCSlxkq.exe
  C:\Windows\System\MCSlxkq.exe
  2⤵
  PID:10620
- C:\Windows\System\ogBlXYq.exe
  C:\Windows\System\ogBlXYq.exe
  2⤵
  PID:10656
- C:\Windows\System\OdTDNMa.exe
  C:\Windows\System\OdTDNMa.exe
  2⤵
  PID:10684
- C:\Windows\System\ugUFUjZ.exe
  C:\Windows\System\ugUFUjZ.exe
  2⤵
  PID:10724
- C:\Windows\System\bZcPOwC.exe
  C:\Windows\System\bZcPOwC.exe
  2⤵
  PID:10744
- C:\Windows\System\zkBLBZo.exe
  C:\Windows\System\zkBLBZo.exe
  2⤵
  PID:10792
- C:\Windows\System\xgopPxA.exe
  C:\Windows\System\xgopPxA.exe
  2⤵
  PID:10812
- C:\Windows\System\mgUMDKW.exe
  C:\Windows\System\mgUMDKW.exe
  2⤵
  PID:10832
- C:\Windows\System\GvoRYOg.exe
  C:\Windows\System\GvoRYOg.exe
  2⤵
  PID:10852
- C:\Windows\System\PsxWdxf.exe
  C:\Windows\System\PsxWdxf.exe
  2⤵
  PID:10872
- C:\Windows\System\AAPkfHG.exe
  C:\Windows\System\AAPkfHG.exe
  2⤵
  PID:10908
- C:\Windows\System\qKUaBJl.exe
  C:\Windows\System\qKUaBJl.exe
  2⤵
  PID:10952
- C:\Windows\System\RQBSLNt.exe
  C:\Windows\System\RQBSLNt.exe
  2⤵
  PID:10972
- C:\Windows\System\HQbmvYh.exe
  C:\Windows\System\HQbmvYh.exe
  2⤵
  PID:10992
- C:\Windows\System\UWmJnYs.exe
  C:\Windows\System\UWmJnYs.exe
  2⤵
  PID:11016
- C:\Windows\System\WPvOpes.exe
  C:\Windows\System\WPvOpes.exe
  2⤵
  PID:11036
- C:\Windows\System\mcgqYKm.exe
  C:\Windows\System\mcgqYKm.exe
  2⤵
  PID:11096
- C:\Windows\System\frsmmyI.exe
  C:\Windows\System\frsmmyI.exe
  2⤵
  PID:11128
- C:\Windows\System\VbhCbuC.exe
  C:\Windows\System\VbhCbuC.exe
  2⤵
  PID:11156
- C:\Windows\System\AMqVTyB.exe
  C:\Windows\System\AMqVTyB.exe
  2⤵
  PID:11184
- C:\Windows\System\fejhHfk.exe
  C:\Windows\System\fejhHfk.exe
  2⤵
  PID:11212
- C:\Windows\System\OnwaZit.exe
  C:\Windows\System\OnwaZit.exe
  2⤵
  PID:11236
- C:\Windows\System\SuFzkBq.exe
  C:\Windows\System\SuFzkBq.exe
  2⤵
  PID:10056
- C:\Windows\System\FRTKrWF.exe
  C:\Windows\System\FRTKrWF.exe
  2⤵
  PID:10052
- C:\Windows\System\fGnSPQU.exe
  C:\Windows\System\fGnSPQU.exe
  2⤵
  PID:10280
- C:\Windows\System\SHwvwNS.exe
  C:\Windows\System\SHwvwNS.exe
  2⤵
  PID:2460
- C:\Windows\System\SYhBloy.exe
  C:\Windows\System\SYhBloy.exe
  2⤵
  PID:10436
- C:\Windows\System\EYgwAXC.exe
  C:\Windows\System\EYgwAXC.exe
  2⤵
  PID:10480
- C:\Windows\System\dldQddk.exe
  C:\Windows\System\dldQddk.exe
  2⤵
  PID:10512
- C:\Windows\System\FfoGYIg.exe
  C:\Windows\System\FfoGYIg.exe
  2⤵
  PID:10664
- C:\Windows\System\BSMKChH.exe
  C:\Windows\System\BSMKChH.exe
  2⤵
  PID:10676
- C:\Windows\System\gapJJua.exe
  C:\Windows\System\gapJJua.exe
  2⤵
  PID:10700
- C:\Windows\System\wriJckh.exe
  C:\Windows\System\wriJckh.exe
  2⤵
  PID:10800
- C:\Windows\System\gWtPuMt.exe
  C:\Windows\System\gWtPuMt.exe
  2⤵
  PID:10864
- C:\Windows\System\ZCqQiFu.exe
  C:\Windows\System\ZCqQiFu.exe
  2⤵
  PID:10988
- C:\Windows\System\eVPRLWM.exe
  C:\Windows\System\eVPRLWM.exe
  2⤵
  PID:11004
- C:\Windows\System\mLREAzK.exe
  C:\Windows\System\mLREAzK.exe
  2⤵
  PID:11088
- C:\Windows\System\KoHxosx.exe
  C:\Windows\System\KoHxosx.exe
  2⤵
  PID:11120
- C:\Windows\System\aknWhQX.exe
  C:\Windows\System\aknWhQX.exe
  2⤵
  PID:11172
- C:\Windows\System\zllyBPc.exe
  C:\Windows\System\zllyBPc.exe
  2⤵
  PID:2236
- C:\Windows\System\DVKqPss.exe
  C:\Windows\System\DVKqPss.exe
  2⤵
  PID:10256
- C:\Windows\System\GUiPOiC.exe
  C:\Windows\System\GUiPOiC.exe
  2⤵
  PID:10432
- C:\Windows\System\UlnjnUe.exe
  C:\Windows\System\UlnjnUe.exe
  2⤵
  PID:10652
- C:\Windows\System\sfkkmlK.exe
  C:\Windows\System\sfkkmlK.exe
  2⤵
  PID:10764
- C:\Windows\System\VNaIvZR.exe
  C:\Windows\System\VNaIvZR.exe
  2⤵
  PID:10904
- C:\Windows\System\fQognhd.exe
  C:\Windows\System\fQognhd.exe
  2⤵
  PID:11064
- C:\Windows\System\BQsgBCX.exe
  C:\Windows\System\BQsgBCX.exe
  2⤵
  PID:11200
- C:\Windows\System\kolRtqa.exe
  C:\Windows\System\kolRtqa.exe
  2⤵
  PID:2548
- C:\Windows\System\fWVbLxz.exe
  C:\Windows\System\fWVbLxz.exe
  2⤵
  PID:10612
- C:\Windows\System\GhRCgjy.exe
  C:\Windows\System\GhRCgjy.exe
  2⤵
  PID:10980
- C:\Windows\System\eisLuXl.exe
  C:\Windows\System\eisLuXl.exe
  2⤵
  PID:11116
- C:\Windows\System\PENWIUZ.exe
  C:\Windows\System\PENWIUZ.exe
  2⤵
  PID:10372
- C:\Windows\System\AoglSGP.exe
  C:\Windows\System\AoglSGP.exe
  2⤵
  PID:11288
- C:\Windows\System\ZvnKHJX.exe
  C:\Windows\System\ZvnKHJX.exe
  2⤵
  PID:11312
- C:\Windows\System\VrkyUEO.exe
  C:\Windows\System\VrkyUEO.exe
  2⤵
  PID:11332
- C:\Windows\System\XQhTWjA.exe
  C:\Windows\System\XQhTWjA.exe
  2⤵
  PID:11356
- C:\Windows\System\myrQnZB.exe
  C:\Windows\System\myrQnZB.exe
  2⤵
  PID:11396
- C:\Windows\System\TrJOdxI.exe
  C:\Windows\System\TrJOdxI.exe
  2⤵
  PID:11420
- C:\Windows\System\pUfpcSv.exe
  C:\Windows\System\pUfpcSv.exe
  2⤵
  PID:11440
- C:\Windows\System\usOSzdh.exe
  C:\Windows\System\usOSzdh.exe
  2⤵
  PID:11460
- C:\Windows\System\cMcTXTP.exe
  C:\Windows\System\cMcTXTP.exe
  2⤵
  PID:11476
- C:\Windows\System\hSKlePL.exe
  C:\Windows\System\hSKlePL.exe
  2⤵
  PID:11552
- C:\Windows\System\YLoxuQl.exe
  C:\Windows\System\YLoxuQl.exe
  2⤵
  PID:11576
- C:\Windows\System\CuHShLc.exe
  C:\Windows\System\CuHShLc.exe
  2⤵
  PID:11596
- C:\Windows\System\OPxyHfF.exe
  C:\Windows\System\OPxyHfF.exe
  2⤵
  PID:11616
- C:\Windows\System\mZSefJE.exe
  C:\Windows\System\mZSefJE.exe
  2⤵
  PID:11644
- C:\Windows\System\vexRVCv.exe
  C:\Windows\System\vexRVCv.exe
  2⤵
  PID:11668
- C:\Windows\System\mRJydiM.exe
  C:\Windows\System\mRJydiM.exe
  2⤵
  PID:11696
- C:\Windows\System\XDhddCx.exe
  C:\Windows\System\XDhddCx.exe
  2⤵
  PID:11716
- C:\Windows\System\ZikYpEf.exe
  C:\Windows\System\ZikYpEf.exe
  2⤵
  PID:11760
- C:\Windows\System\FnMbpSe.exe
  C:\Windows\System\FnMbpSe.exe
  2⤵
  PID:11820
- C:\Windows\System\JEaKjyz.exe
  C:\Windows\System\JEaKjyz.exe
  2⤵
  PID:11840
- C:\Windows\System\dXXHOaz.exe
  C:\Windows\System\dXXHOaz.exe
  2⤵
  PID:11864
- C:\Windows\System\BamNNwb.exe
  C:\Windows\System\BamNNwb.exe
  2⤵
  PID:11884
- C:\Windows\System\itPzzMq.exe
  C:\Windows\System\itPzzMq.exe
  2⤵
  PID:11912
- C:\Windows\System\JpSAIIO.exe
  C:\Windows\System\JpSAIIO.exe
  2⤵
  PID:11944
- C:\Windows\System\HpwjIyZ.exe
  C:\Windows\System\HpwjIyZ.exe
  2⤵
  PID:11968
- C:\Windows\System\MbkgRLL.exe
  C:\Windows\System\MbkgRLL.exe
  2⤵
  PID:12008
- C:\Windows\System\QzalUuc.exe
  C:\Windows\System\QzalUuc.exe
  2⤵
  PID:12040
- C:\Windows\System\BaRzMoM.exe
  C:\Windows\System\BaRzMoM.exe
  2⤵
  PID:12072
- C:\Windows\System\mAHwiGv.exe
  C:\Windows\System\mAHwiGv.exe
  2⤵
  PID:12100
- C:\Windows\System\OJOJJPW.exe
  C:\Windows\System\OJOJJPW.exe
  2⤵
  PID:12120
- C:\Windows\System\fTnrXTK.exe
  C:\Windows\System\fTnrXTK.exe
  2⤵
  PID:12148
- C:\Windows\System\cyJFlko.exe
  C:\Windows\System\cyJFlko.exe
  2⤵
  PID:12188
- C:\Windows\System\ZUQDDVD.exe
  C:\Windows\System\ZUQDDVD.exe
  2⤵
  PID:12208
- C:\Windows\System\tBeFdhF.exe
  C:\Windows\System\tBeFdhF.exe
  2⤵
  PID:12240
- C:\Windows\System\FhmXjjH.exe
  C:\Windows\System\FhmXjjH.exe
  2⤵
  PID:12260
- C:\Windows\System\oiLCGYf.exe
  C:\Windows\System\oiLCGYf.exe
  2⤵
  PID:12276
- C:\Windows\System\wXOOOqj.exe
  C:\Windows\System\wXOOOqj.exe
  2⤵
  PID:11304
- C:\Windows\System\pWHEGPk.exe
  C:\Windows\System\pWHEGPk.exe
  2⤵
  PID:11344
- C:\Windows\System\ZcsmVQs.exe
  C:\Windows\System\ZcsmVQs.exe
  2⤵
  PID:11412
- C:\Windows\System\oADpeQC.exe
  C:\Windows\System\oADpeQC.exe
  2⤵
  PID:11436
- C:\Windows\System\fqiugwU.exe
  C:\Windows\System\fqiugwU.exe
  2⤵
  PID:11496
- C:\Windows\System\McSmfFZ.exe
  C:\Windows\System\McSmfFZ.exe
  2⤵
  PID:11544
- C:\Windows\System\jcXLUPs.exe
  C:\Windows\System\jcXLUPs.exe
  2⤵
  PID:11612
- C:\Windows\System\tlBwhzZ.exe
  C:\Windows\System\tlBwhzZ.exe
  2⤵
  PID:11708
- C:\Windows\System\jOmPMKd.exe
  C:\Windows\System\jOmPMKd.exe
  2⤵
  PID:11816
- C:\Windows\System\YnHKxRm.exe
  C:\Windows\System\YnHKxRm.exe
  2⤵
  PID:11812
- C:\Windows\System\rixrRMe.exe
  C:\Windows\System\rixrRMe.exe
  2⤵
  PID:6288
- C:\Windows\System\PECLpgV.exe
  C:\Windows\System\PECLpgV.exe
  2⤵
  PID:11848
- C:\Windows\System\GLNVffj.exe
  C:\Windows\System\GLNVffj.exe
  2⤵
  PID:11900
- C:\Windows\System\AYDQdXh.exe
  C:\Windows\System\AYDQdXh.exe
  2⤵
  PID:12080
- C:\Windows\System\gLaPPKO.exe
  C:\Windows\System\gLaPPKO.exe
  2⤵
  PID:12112
- C:\Windows\System\TVWiMcU.exe
  C:\Windows\System\TVWiMcU.exe
  2⤵
  PID:12164
- C:\Windows\System\QhgnINo.exe
  C:\Windows\System\QhgnINo.exe
  2⤵
  PID:12252
- C:\Windows\System\gsblmwU.exe
  C:\Windows\System\gsblmwU.exe
  2⤵
  PID:11196
- C:\Windows\System\hYHSQTQ.exe
  C:\Windows\System\hYHSQTQ.exe
  2⤵
  PID:10848
- C:\Windows\System\ZimMTKP.exe
  C:\Windows\System\ZimMTKP.exe
  2⤵
  PID:11628
- C:\Windows\System\xwciybc.exe
  C:\Windows\System\xwciybc.exe
  2⤵
  PID:11772
- C:\Windows\System\iTUtYuD.exe
  C:\Windows\System\iTUtYuD.exe
  2⤵
  PID:10448
- C:\Windows\System\yYZokjo.exe
  C:\Windows\System\yYZokjo.exe
  2⤵
  PID:11852
- C:\Windows\System\NVszxie.exe
  C:\Windows\System\NVszxie.exe
  2⤵
  PID:12220
- C:\Windows\System\HQBWqES.exe
  C:\Windows\System\HQBWqES.exe
  2⤵
  PID:11468
- C:\Windows\System\uqWLVxg.exe
  C:\Windows\System\uqWLVxg.exe
  2⤵
  PID:12136
- C:\Windows\System\KhMykZE.exe
  C:\Windows\System\KhMykZE.exe
  2⤵
  PID:4560
- C:\Windows\System\HiRfkdG.exe
  C:\Windows\System\HiRfkdG.exe
  2⤵
  PID:11324
- C:\Windows\System\iQGMvCz.exe
  C:\Windows\System\iQGMvCz.exe
  2⤵
  PID:12300
- C:\Windows\System\kjWCHwC.exe
  C:\Windows\System\kjWCHwC.exe
  2⤵
  PID:12336
- C:\Windows\System\mozqazD.exe
  C:\Windows\System\mozqazD.exe
  2⤵
  PID:12356
- C:\Windows\System\QQXxLxN.exe
  C:\Windows\System\QQXxLxN.exe
  2⤵
  PID:12376
- C:\Windows\System\BWWwmAI.exe
  C:\Windows\System\BWWwmAI.exe
  2⤵
  PID:12396
- C:\Windows\System\eslHwhv.exe
  C:\Windows\System\eslHwhv.exe
  2⤵
  PID:12416
- C:\Windows\System\DwiWokx.exe
  C:\Windows\System\DwiWokx.exe
  2⤵
  PID:12448
- C:\Windows\System\VIQBhzV.exe
  C:\Windows\System\VIQBhzV.exe
  2⤵
  PID:12484
- C:\Windows\System\LhsPEuL.exe
  C:\Windows\System\LhsPEuL.exe
  2⤵
  PID:12500
- C:\Windows\System\ubPwNhY.exe
  C:\Windows\System\ubPwNhY.exe
  2⤵
  PID:12520
- C:\Windows\System\KTUHcqB.exe
  C:\Windows\System\KTUHcqB.exe
  2⤵
  PID:12568
- C:\Windows\System\OyLBVvE.exe
  C:\Windows\System\OyLBVvE.exe
  2⤵
  PID:12600
- C:\Windows\System\hIqARFv.exe
  C:\Windows\System\hIqARFv.exe
  2⤵
  PID:12656
- C:\Windows\System\oRmnhGc.exe
  C:\Windows\System\oRmnhGc.exe
  2⤵
  PID:12684
- C:\Windows\System\maTqCCt.exe
  C:\Windows\System\maTqCCt.exe
  2⤵
  PID:12708
- C:\Windows\System\veNcRTj.exe
  C:\Windows\System\veNcRTj.exe
  2⤵
  PID:12724
- C:\Windows\System\uVBWJYD.exe
  C:\Windows\System\uVBWJYD.exe
  2⤵
  PID:12788
- C:\Windows\System\bkVrbZt.exe
  C:\Windows\System\bkVrbZt.exe
  2⤵
  PID:12812
- C:\Windows\System\aSOTitN.exe
  C:\Windows\System\aSOTitN.exe
  2⤵
  PID:12832
- C:\Windows\System\LvJgIgb.exe
  C:\Windows\System\LvJgIgb.exe
  2⤵
  PID:12856
- C:\Windows\System\InAPvFj.exe
  C:\Windows\System\InAPvFj.exe
  2⤵
  PID:12916
- C:\Windows\System\TDnYlFh.exe
  C:\Windows\System\TDnYlFh.exe
  2⤵
  PID:12932
- C:\Windows\System\XKXhtyw.exe
  C:\Windows\System\XKXhtyw.exe
  2⤵
  PID:12964
- C:\Windows\System\XRsvQHv.exe
  C:\Windows\System\XRsvQHv.exe
  2⤵
  PID:12716
- C:\Windows\System\XMpMoiI.exe
  C:\Windows\System\XMpMoiI.exe
  2⤵
  PID:12784
- C:\Windows\System\ojXQtrG.exe
  C:\Windows\System\ojXQtrG.exe
  2⤵
  PID:12804
- C:\Windows\System\ilxicdX.exe
  C:\Windows\System\ilxicdX.exe
  2⤵
  PID:12868
- C:\Windows\System\jCOAFQy.exe
  C:\Windows\System\jCOAFQy.exe
  2⤵
  PID:12976
- C:\Windows\System\EXqNYKR.exe
  C:\Windows\System\EXqNYKR.exe
  2⤵
  PID:12944
- C:\Windows\System\kgdQMDv.exe
  C:\Windows\System\kgdQMDv.exe
  2⤵
  PID:12988
- C:\Windows\System\uiGVOCg.exe
  C:\Windows\System\uiGVOCg.exe
  2⤵
  PID:13004
- C:\Windows\System\GCVEYuP.exe
  C:\Windows\System\GCVEYuP.exe
  2⤵
  PID:12972
- C:\Windows\System\Jsrznet.exe
  C:\Windows\System\Jsrznet.exe
  2⤵
  PID:13072
- C:\Windows\System\GZLhrpB.exe
  C:\Windows\System\GZLhrpB.exe
  2⤵
  PID:13272
- C:\Windows\System\BYjcNha.exe
  C:\Windows\System\BYjcNha.exe
  2⤵
  PID:11940
- C:\Windows\System\TJMAjoP.exe
  C:\Windows\System\TJMAjoP.exe
  2⤵
  PID:11376
- C:\Windows\System\obDjIrn.exe
  C:\Windows\System\obDjIrn.exe
  2⤵
  PID:12388
- C:\Windows\System\XaBISCM.exe
  C:\Windows\System\XaBISCM.exe
  2⤵
  PID:12408
- C:\Windows\System\CRuEjcS.exe
  C:\Windows\System\CRuEjcS.exe
  2⤵
  PID:12492
- C:\Windows\System\gWKGjul.exe
  C:\Windows\System\gWKGjul.exe
  2⤵
  PID:2280
- C:\Windows\System\YPgRypq.exe
  C:\Windows\System\YPgRypq.exe
  2⤵
  PID:12496
- C:\Windows\System\zwirThF.exe
  C:\Windows\System\zwirThF.exe
  2⤵
  PID:12544
- C:\Windows\System\gJMnxRh.exe
  C:\Windows\System\gJMnxRh.exe
  2⤵
  PID:12556
- C:\Windows\System\xvwyfSv.exe
  C:\Windows\System\xvwyfSv.exe
  2⤵
  PID:12592
- C:\Windows\System\HLpMpXV.exe
  C:\Windows\System\HLpMpXV.exe
  2⤵
  PID:12640
- C:\Windows\System\tnmAJnq.exe
  C:\Windows\System\tnmAJnq.exe
  2⤵
  PID:12688
- C:\Windows\System\wkFoJul.exe
  C:\Windows\System\wkFoJul.exe
  2⤵
  PID:12756
- C:\Windows\System\PZCdzzd.exe
  C:\Windows\System\PZCdzzd.exe
  2⤵
  PID:12872
- C:\Windows\System\YqOCRHG.exe
  C:\Windows\System\YqOCRHG.exe
  2⤵
  PID:13036
- C:\Windows\System\AUexCjS.exe
  C:\Windows\System\AUexCjS.exe
  2⤵
  PID:12980
- C:\Windows\System\lQkywsb.exe
  C:\Windows\System\lQkywsb.exe
  2⤵
  PID:13012
- C:\Windows\System\NABgNZb.exe
  C:\Windows\System\NABgNZb.exe
  2⤵
  PID:13032
- C:\Windows\System\PRfaZqD.exe
  C:\Windows\System\PRfaZqD.exe
  2⤵
  PID:13100
- C:\Windows\System\UszFwwQ.exe
  C:\Windows\System\UszFwwQ.exe
  2⤵
  PID:13148
- C:\Windows\System\lUKofbg.exe
  C:\Windows\System\lUKofbg.exe
  2⤵
  PID:13120
- C:\Windows\System\SISWZMR.exe
  C:\Windows\System\SISWZMR.exe
  2⤵
  PID:13176
- C:\Windows\System\LFZMWEc.exe
  C:\Windows\System\LFZMWEc.exe
  2⤵
  PID:13188
- C:\Windows\System\uclxqBH.exe
  C:\Windows\System\uclxqBH.exe
  2⤵
  PID:13200
- C:\Windows\System\ypRFcwd.exe
  C:\Windows\System\ypRFcwd.exe
  2⤵
  PID:13212
- C:\Windows\System\CLzwMeD.exe
  C:\Windows\System\CLzwMeD.exe
  2⤵
  PID:13064
- C:\Windows\System\tlflRyf.exe
  C:\Windows\System\tlflRyf.exe
  2⤵
  PID:13028
- C:\Windows\System\cnCMudE.exe
  C:\Windows\System\cnCMudE.exe
  2⤵
  PID:13240
- C:\Windows\System\NdHiVOP.exe
  C:\Windows\System\NdHiVOP.exe
  2⤵
  PID:5156
- C:\Windows\System\NyTTHfI.exe
  C:\Windows\System\NyTTHfI.exe
  2⤵
  PID:13236
- C:\Windows\System\QzCgiXl.exe
  C:\Windows\System\QzCgiXl.exe
  2⤵
  PID:13284
- C:\Windows\System\mkyGOtq.exe
  C:\Windows\System\mkyGOtq.exe
  2⤵
  PID:13308
- C:\Windows\System\ZfmDaby.exe
  C:\Windows\System\ZfmDaby.exe
  2⤵
  PID:13296
- C:\Windows\System\QCRAjsr.exe
  C:\Windows\System\QCRAjsr.exe
  2⤵
  PID:12332
- C:\Windows\System\FGTzoUF.exe
  C:\Windows\System\FGTzoUF.exe
  2⤵
  PID:852
- C:\Windows\System\LALpvZV.exe
  C:\Windows\System\LALpvZV.exe
  2⤵
  PID:2800
- C:\Windows\System\NLMJlvr.exe
  C:\Windows\System\NLMJlvr.exe
  2⤵
  PID:4900
- C:\Windows\System\BEnFcYj.exe
  C:\Windows\System\BEnFcYj.exe
  2⤵
  PID:3948
- C:\Windows\System\wAUVxgt.exe
  C:\Windows\System\wAUVxgt.exe
  2⤵
  PID:5320
- C:\Windows\System\lmLBeJX.exe
  C:\Windows\System\lmLBeJX.exe
  2⤵
  PID:12476
- C:\Windows\System\JNEmnRj.exe
  C:\Windows\System\JNEmnRj.exe
  2⤵
  PID:2632
- C:\Windows\System\rWPNxNH.exe
  C:\Windows\System\rWPNxNH.exe
  2⤵
  PID:12512
- C:\Windows\System\BanTeid.exe
  C:\Windows\System\BanTeid.exe
  2⤵
  PID:12560
- C:\Windows\System\UDtjrhx.exe
  C:\Windows\System\UDtjrhx.exe
  2⤵
  PID:12664
- C:\Windows\System\SJQQuiE.exe
  C:\Windows\System\SJQQuiE.exe
  2⤵
  PID:12828
- C:\Windows\System\tyPoNaA.exe
  C:\Windows\System\tyPoNaA.exe
  2⤵
  PID:13040
- C:\Windows\System\mupRfGm.exe
  C:\Windows\System\mupRfGm.exe
  2⤵
  PID:13020
- C:\Windows\System\EioqYqq.exe
  C:\Windows\System\EioqYqq.exe
  2⤵
  PID:13140
- C:\Windows\System\KglQYDJ.exe
  C:\Windows\System\KglQYDJ.exe
  2⤵
  PID:13168
- C:\Windows\System\oDYkNAC.exe
  C:\Windows\System\oDYkNAC.exe
  2⤵
  PID:13128
- C:\Windows\System\nVhjkZI.exe
  C:\Windows\System\nVhjkZI.exe
  2⤵
  PID:13220
- C:\Windows\System\bLVkKAk.exe
  C:\Windows\System\bLVkKAk.exe
  2⤵
  PID:12848
- C:\Windows\System\PFZMizj.exe
  C:\Windows\System\PFZMizj.exe
  2⤵
  PID:13256
- C:\Windows\System\EGLtRjf.exe
  C:\Windows\System\EGLtRjf.exe
  2⤵
  PID:11592
- C:\Windows\System\VmeHBNJ.exe
  C:\Windows\System\VmeHBNJ.exe
  2⤵
  PID:12328
- C:\Windows\System\cTTpZkv.exe
  C:\Windows\System\cTTpZkv.exe
  2⤵
  PID:4996
- C:\Windows\System\JRTdmcq.exe
  C:\Windows\System\JRTdmcq.exe
  2⤵
  PID:4844
- C:\Windows\System\OVwkiBR.exe
  C:\Windows\System\OVwkiBR.exe
  2⤵
  PID:12436
- C:\Windows\System\OCTVzJx.exe
  C:\Windows\System\OCTVzJx.exe
  2⤵
  PID:12636
- C:\Windows\System\AZrqXRy.exe
  C:\Windows\System\AZrqXRy.exe
  2⤵
  PID:12924
- C:\Windows\System\USiygfe.exe
  C:\Windows\System\USiygfe.exe
  2⤵
  PID:13096
- C:\Windows\System\nyyFhzQ.exe
  C:\Windows\System\nyyFhzQ.exe
  2⤵
  PID:13192
- C:\Windows\System\ZrAWBvA.exe
  C:\Windows\System\ZrAWBvA.exe
  2⤵
  PID:12904
- C:\Windows\System\VnOdeeE.exe
  C:\Windows\System\VnOdeeE.exe
  2⤵
  PID:12316
- C:\Windows\System\UViBOCj.exe
  C:\Windows\System\UViBOCj.exe
  2⤵
  PID:12676
- C:\Windows\System\USiXbZv.exe
  C:\Windows\System\USiXbZv.exe
  2⤵
  PID:13184
- C:\Windows\System\caewrso.exe
  C:\Windows\System\caewrso.exe
  2⤵
  PID:13260
- C:\Windows\System\NApcvYS.exe
  C:\Windows\System\NApcvYS.exe
  2⤵
  PID:3076
- C:\Windows\System\bRWdGkA.exe
  C:\Windows\System\bRWdGkA.exe
  2⤵
  PID:13084
- C:\Windows\System\YVznXfR.exe
  C:\Windows\System\YVznXfR.exe
  2⤵
  PID:12464
- C:\Windows\System\BOCeTZn.exe
  C:\Windows\System\BOCeTZn.exe
  2⤵
  PID:13292
- C:\Windows\System\oUNbIYO.exe
  C:\Windows\System\oUNbIYO.exe
  2⤵
  PID:13324
- C:\Windows\System\nhxonjH.exe
  C:\Windows\System\nhxonjH.exe
  2⤵
  PID:13340
- C:\Windows\System\PDNVZfn.exe
  C:\Windows\System\PDNVZfn.exe
  2⤵
  PID:13356
- C:\Windows\System\RozFQTh.exe
  C:\Windows\System\RozFQTh.exe
  2⤵
  PID:13372
- C:\Windows\System\ubgJYQy.exe
  C:\Windows\System\ubgJYQy.exe
  2⤵
  PID:13388
- C:\Windows\System\gyIlSdP.exe
  C:\Windows\System\gyIlSdP.exe
  2⤵
  PID:13404
- C:\Windows\System\hRuoQWc.exe
  C:\Windows\System\hRuoQWc.exe
  2⤵
  PID:13420
- C:\Windows\System\gKxAvyA.exe
  C:\Windows\System\gKxAvyA.exe
  2⤵
  PID:13436
- C:\Windows\System\NigOcao.exe
  C:\Windows\System\NigOcao.exe
  2⤵
  PID:13452
- C:\Windows\System\NxUTymZ.exe
  C:\Windows\System\NxUTymZ.exe
  2⤵
  PID:13468
- C:\Windows\System\FaGVkCM.exe
  C:\Windows\System\FaGVkCM.exe
  2⤵
  PID:13484
- C:\Windows\System\ZvFCXdT.exe
  C:\Windows\System\ZvFCXdT.exe
  2⤵
  PID:13500
- C:\Windows\System\mBgjRSz.exe
  C:\Windows\System\mBgjRSz.exe
  2⤵
  PID:13520
- C:\Windows\System\phemKjQ.exe
  C:\Windows\System\phemKjQ.exe
  2⤵
  PID:13536
- C:\Windows\System\yBJlSBP.exe
  C:\Windows\System\yBJlSBP.exe
  2⤵
  PID:13552
- C:\Windows\System\pfsdXbv.exe
  C:\Windows\System\pfsdXbv.exe
  2⤵
  PID:13568
- C:\Windows\System\MaJAHtz.exe
  C:\Windows\System\MaJAHtz.exe
  2⤵
  PID:13584
- C:\Windows\System\qKofPUK.exe
  C:\Windows\System\qKofPUK.exe
  2⤵
  PID:13612
- C:\Windows\System\FLSrQWh.exe
  C:\Windows\System\FLSrQWh.exe
  2⤵
  PID:13628
- C:\Windows\System\fUTgmHB.exe
  C:\Windows\System\fUTgmHB.exe
  2⤵
  PID:13644
- C:\Windows\System\KzqRxYy.exe
  C:\Windows\System\KzqRxYy.exe
  2⤵
  PID:13660
- C:\Windows\System\GdMZONo.exe
  C:\Windows\System\GdMZONo.exe
  2⤵
  PID:13676
- C:\Windows\System\zOsXvxA.exe
  C:\Windows\System\zOsXvxA.exe
  2⤵
  PID:13692
- C:\Windows\System\gpetrvI.exe
  C:\Windows\System\gpetrvI.exe
  2⤵
  PID:13712
- C:\Windows\System\caHPCGj.exe
  C:\Windows\System\caHPCGj.exe
  2⤵
  PID:13728
- C:\Windows\System\fhyquJA.exe
  C:\Windows\System\fhyquJA.exe
  2⤵
  PID:13744
- C:\Windows\System\vEPxaXF.exe
  C:\Windows\System\vEPxaXF.exe
  2⤵
  PID:13760
- C:\Windows\System\ayqVpHT.exe
  C:\Windows\System\ayqVpHT.exe
  2⤵
  PID:13788
- C:\Windows\System\JBvMdqr.exe
  C:\Windows\System\JBvMdqr.exe
  2⤵
  PID:13812
- C:\Windows\System\vQjKSYG.exe
  C:\Windows\System\vQjKSYG.exe
  2⤵
  PID:13836
- C:\Windows\System\UhCgQQp.exe
  C:\Windows\System\UhCgQQp.exe
  2⤵
  PID:13852
- C:\Windows\System\EETwKGc.exe
  C:\Windows\System\EETwKGc.exe
  2⤵
  PID:13868
- C:\Windows\System\WEvgCzb.exe
  C:\Windows\System\WEvgCzb.exe
  2⤵
  PID:13892
- C:\Windows\System\QIfSDup.exe
  C:\Windows\System\QIfSDup.exe
  2⤵
  PID:13908
- C:\Windows\System\dNGXlaf.exe
  C:\Windows\System\dNGXlaf.exe
  2⤵
  PID:13924
- C:\Windows\System\fBbqyec.exe
  C:\Windows\System\fBbqyec.exe
  2⤵
  PID:13940
- C:\Windows\System\UoceoEs.exe
  C:\Windows\System\UoceoEs.exe
  2⤵
  PID:13956
- C:\Windows\System\qZuvujt.exe
  C:\Windows\System\qZuvujt.exe
  2⤵
  PID:13972
- C:\Windows\System\UlfLAyr.exe
  C:\Windows\System\UlfLAyr.exe
  2⤵
  PID:13996
- C:\Windows\System\PxaPyIo.exe
  C:\Windows\System\PxaPyIo.exe
  2⤵
  PID:14012
- C:\Windows\System\SVugEqk.exe
  C:\Windows\System\SVugEqk.exe
  2⤵
  PID:14028
- C:\Windows\System\QKCjVsF.exe
  C:\Windows\System\QKCjVsF.exe
  2⤵
  PID:14044
- C:\Windows\System\iqurLzY.exe
  C:\Windows\System\iqurLzY.exe
  2⤵
  PID:14060
- C:\Windows\System\WYXTvpJ.exe
  C:\Windows\System\WYXTvpJ.exe
  2⤵
  PID:14076
- C:\Windows\System\gSxJcGD.exe
  C:\Windows\System\gSxJcGD.exe
  2⤵
  PID:14092
- C:\Windows\System\RXZLvHP.exe
  C:\Windows\System\RXZLvHP.exe
  2⤵
  PID:14108
- C:\Windows\System\UBouXnQ.exe
  C:\Windows\System\UBouXnQ.exe
  2⤵
  PID:14124
- C:\Windows\System\dyzCqdZ.exe
  C:\Windows\System\dyzCqdZ.exe
  2⤵
  PID:14140
- C:\Windows\System\qvSDTbC.exe
  C:\Windows\System\qvSDTbC.exe
  2⤵
  PID:14156
- C:\Windows\System\BJVbDcj.exe
  C:\Windows\System\BJVbDcj.exe
  2⤵
  PID:14172
- C:\Windows\System\RouPDpc.exe
  C:\Windows\System\RouPDpc.exe
  2⤵
  PID:14192
- C:\Windows\System\EndbZZb.exe
  C:\Windows\System\EndbZZb.exe
  2⤵
  PID:14208
- C:\Windows\System\oaHMlOq.exe
  C:\Windows\System\oaHMlOq.exe
  2⤵
  PID:14224
- C:\Windows\System\hQpzGVd.exe
  C:\Windows\System\hQpzGVd.exe
  2⤵
  PID:14244
- C:\Windows\System\RnHGUWF.exe
  C:\Windows\System\RnHGUWF.exe
  2⤵
  PID:14260
- C:\Windows\System\QUbHgHH.exe
  C:\Windows\System\QUbHgHH.exe
  2⤵
  PID:14280
- C:\Windows\System\pNvmFoO.exe
  C:\Windows\System\pNvmFoO.exe
  2⤵
  PID:14300
- C:\Windows\System\IXnuCab.exe
  C:\Windows\System\IXnuCab.exe
  2⤵
  PID:14316
- C:\Windows\System\iwFmdmI.exe
  C:\Windows\System\iwFmdmI.exe
  2⤵
  PID:14332
- C:\Windows\System\LhKGrET.exe
  C:\Windows\System\LhKGrET.exe
  2⤵
  PID:13316
- C:\Windows\System\MUTiatQ.exe
  C:\Windows\System\MUTiatQ.exe
  2⤵
  PID:13364
- C:\Windows\System\GOJrpec.exe
  C:\Windows\System\GOJrpec.exe
  2⤵
  PID:13396
- C:\Windows\System\dgQlwql.exe
  C:\Windows\System\dgQlwql.exe
  2⤵
  PID:13428
- C:\Windows\System\YKeHGqP.exe
  C:\Windows\System\YKeHGqP.exe
  2⤵
  PID:13464
- C:\Windows\System\AcbhtdS.exe
  C:\Windows\System\AcbhtdS.exe
  2⤵
  PID:13492
- C:\Windows\System\mHvMooh.exe
  C:\Windows\System\mHvMooh.exe
  2⤵
  PID:968
- C:\Windows\System\Rgfrvsq.exe
  C:\Windows\System\Rgfrvsq.exe
  2⤵
  PID:13548
- C:\Windows\System\OBpityT.exe
  C:\Windows\System\OBpityT.exe
  2⤵
  PID:13580
- C:\Windows\System\IBUKZBq.exe
  C:\Windows\System\IBUKZBq.exe
  2⤵
  PID:13640
- C:\Windows\System\XIUOvhX.exe
  C:\Windows\System\XIUOvhX.exe
  2⤵
  PID:13672
- C:\Windows\System\ZkmdBuc.exe
  C:\Windows\System\ZkmdBuc.exe
  2⤵
  PID:13700
- C:\Windows\System\dEtyrlx.exe
  C:\Windows\System\dEtyrlx.exe
  2⤵
  PID:13740
- C:\Windows\System\AJmxOrT.exe
  C:\Windows\System\AJmxOrT.exe
  2⤵
  PID:13784
- C:\Windows\System\lrfLSFT.exe
  C:\Windows\System\lrfLSFT.exe
  2⤵
  PID:13828
- C:\Windows\System\NaRFVDU.exe
  C:\Windows\System\NaRFVDU.exe
  2⤵
  PID:13864
- C:\Windows\System\RqjzZyR.exe
  C:\Windows\System\RqjzZyR.exe
  2⤵
  PID:13916
- C:\Windows\System\QnDcERR.exe
  C:\Windows\System\QnDcERR.exe
  2⤵
  PID:13988
- C:\Windows\System\JnGKNQs.exe
  C:\Windows\System\JnGKNQs.exe
  2⤵
  PID:14020
- C:\Windows\System\NiUVfhW.exe
  C:\Windows\System\NiUVfhW.exe
  2⤵
  PID:14088
- C:\Windows\System\cHlpQpx.exe
  C:\Windows\System\cHlpQpx.exe
  2⤵
  PID:14132
- C:\Windows\System\pshkmHE.exe
  C:\Windows\System\pshkmHE.exe
  2⤵
  PID:14168
- C:\Windows\System\SxBcyxL.exe
  C:\Windows\System\SxBcyxL.exe
  2⤵
  PID:14204
- C:\Windows\System\BJTSjuM.exe
  C:\Windows\System\BJTSjuM.exe
  2⤵
  PID:14232
- C:\Windows\System\hXjgvzB.exe
  C:\Windows\System\hXjgvzB.exe
  2⤵
  PID:14324
- C:\Windows\System\QhDpTTU.exe
  C:\Windows\System\QhDpTTU.exe
  2⤵
  PID:13348
- C:\Windows\System\yRpEAym.exe
  C:\Windows\System\yRpEAym.exe
  2⤵
  PID:13444
- C:\Windows\System\rnFNNZu.exe
  C:\Windows\System\rnFNNZu.exe
  2⤵
  PID:13508
- C:\Windows\System\DdHWfDa.exe
  C:\Windows\System\DdHWfDa.exe
  2⤵
  PID:13560
- C:\Windows\System\ZMshLUR.exe
  C:\Windows\System\ZMshLUR.exe
  2⤵
  PID:13652
- C:\Windows\System\ppMEhsK.exe
  C:\Windows\System\ppMEhsK.exe
  2⤵
  PID:13704
- C:\Windows\System\cHLpAmH.exe
  C:\Windows\System\cHLpAmH.exe
  2⤵
  PID:13832
- C:\Windows\System\SpdrUzr.exe
  C:\Windows\System\SpdrUzr.exe
  2⤵
  PID:13904
- C:\Windows\System\MoXyect.exe
  C:\Windows\System\MoXyect.exe
  2⤵
  PID:14004
- C:\Windows\System\ghyBXDO.exe
  C:\Windows\System\ghyBXDO.exe
  2⤵
  PID:14120
- C:\Windows\System\BCBdFWp.exe
  C:\Windows\System\BCBdFWp.exe
  2⤵
  PID:14200
- C:\Windows\System\EVIStFK.exe
  C:\Windows\System\EVIStFK.exe
  2⤵
  PID:14288
- C:\Windows\System\KCfUYLl.exe
  C:\Windows\System\KCfUYLl.exe
  2⤵
  PID:13708
- C:\Windows\System\zyFChDL.exe
  C:\Windows\System\zyFChDL.exe
  2⤵
  PID:13668
- C:\Windows\System\wJXkvfa.exe
  C:\Windows\System\wJXkvfa.exe
  2⤵
  PID:13848
- C:\Windows\System\TEPGGPp.exe
  C:\Windows\System\TEPGGPp.exe
  2⤵
  PID:14084
- C:\Windows\System\oIlAtXB.exe
  C:\Windows\System\oIlAtXB.exe
  2⤵
  PID:14292
- C:\Windows\System\sNTPITP.exe
  C:\Windows\System\sNTPITP.exe
  2⤵
  PID:13820
- C:\Windows\System\WxjsjMk.exe
  C:\Windows\System\WxjsjMk.exe
  2⤵
  PID:13800
- C:\Windows\System\TqyEcHF.exe
  C:\Windows\System\TqyEcHF.exe
  2⤵
  PID:13984
- C:\Windows\System\qcssNwY.exe
  C:\Windows\System\qcssNwY.exe
  2⤵
  PID:13768
- C:\Windows\System\bFyRlEJ.exe
  C:\Windows\System\bFyRlEJ.exe
  2⤵
  PID:13780
- C:\Windows\System\FjqFQGW.exe
  C:\Windows\System\FjqFQGW.exe
  2⤵
  PID:14056
- C:\Windows\System\oGZFoXM.exe
  C:\Windows\System\oGZFoXM.exe
  2⤵
  PID:13808
- C:\Windows\System\zYGehRW.exe
  C:\Windows\System\zYGehRW.exe
  2⤵
  PID:14344
- C:\Windows\System\FFFvVis.exe
  C:\Windows\System\FFFvVis.exe
  2⤵
  PID:14360
- C:\Windows\System\RNJlEai.exe
  C:\Windows\System\RNJlEai.exe
  2⤵
  PID:14376
- C:\Windows\System\yjEYxKB.exe
  C:\Windows\System\yjEYxKB.exe
  2⤵
  PID:14392
- C:\Windows\System\agUJOwW.exe
  C:\Windows\System\agUJOwW.exe
  2⤵
  PID:14408
- C:\Windows\System\djFPvRP.exe
  C:\Windows\System\djFPvRP.exe
  2⤵
  PID:14424
- C:\Windows\System\FxVhoau.exe
  C:\Windows\System\FxVhoau.exe
  2⤵
  PID:14440
- C:\Windows\System\VMKSOfi.exe
  C:\Windows\System\VMKSOfi.exe
  2⤵
  PID:14456
- C:\Windows\System\FkWuDfi.exe
  C:\Windows\System\FkWuDfi.exe
  2⤵
  PID:14472
- C:\Windows\System\ISolhNL.exe
  C:\Windows\System\ISolhNL.exe
  2⤵
  PID:14488
- C:\Windows\System\ffAsMbr.exe
  C:\Windows\System\ffAsMbr.exe
  2⤵
  PID:14504
- C:\Windows\System\tfqTNvt.exe
  C:\Windows\System\tfqTNvt.exe
  2⤵
  PID:14520
- C:\Windows\System\fzoVIsl.exe
  C:\Windows\System\fzoVIsl.exe
  2⤵
  PID:14544
- C:\Windows\System\ZkWFUTG.exe
  C:\Windows\System\ZkWFUTG.exe
  2⤵
  PID:14568
- C:\Windows\System\ZVCbufH.exe
  C:\Windows\System\ZVCbufH.exe
  2⤵
  PID:14584
- C:\Windows\System\kthZzpf.exe
  C:\Windows\System\kthZzpf.exe
  2⤵
  PID:14600
- C:\Windows\System\nSbPlXt.exe
  C:\Windows\System\nSbPlXt.exe
  2⤵
  PID:14620
- C:\Windows\System\FDrPRqd.exe
  C:\Windows\System\FDrPRqd.exe
  2⤵
  PID:14640
- C:\Windows\System\urootPo.exe
  C:\Windows\System\urootPo.exe
  2⤵
  PID:14656
- C:\Windows\System\uRvjheL.exe
  C:\Windows\System\uRvjheL.exe
  2⤵
  PID:14680
- C:\Windows\System\PJhIfFq.exe
  C:\Windows\System\PJhIfFq.exe
  2⤵
  PID:14716
- C:\Windows\System\RMnAvFS.exe
  C:\Windows\System\RMnAvFS.exe
  2⤵
  PID:14744
- C:\Windows\System\kQLMiOx.exe
  C:\Windows\System\kQLMiOx.exe
  2⤵
  PID:14768
- C:\Windows\System\tSDZiWm.exe
  C:\Windows\System\tSDZiWm.exe
  2⤵
  PID:14784
- C:\Windows\System\QkGOvtW.exe
  C:\Windows\System\QkGOvtW.exe
  2⤵
  PID:14812
- C:\Windows\System\OUbxtOX.exe
  C:\Windows\System\OUbxtOX.exe
  2⤵
  PID:14840
- C:\Windows\System\QiRlxif.exe
  C:\Windows\System\QiRlxif.exe
  2⤵
  PID:14896
- C:\Windows\System\RStQpGG.exe
  C:\Windows\System\RStQpGG.exe
  2⤵
  PID:6348
- C:\Windows\System\CaJZvgg.exe
  C:\Windows\System\CaJZvgg.exe
  2⤵
  PID:6596
- C:\Windows\System\qqvHUjp.exe
  C:\Windows\System\qqvHUjp.exe
  2⤵
  PID:9372
- C:\Windows\System\Pgxcvoa.exe
  C:\Windows\System\Pgxcvoa.exe
  2⤵
  PID:12468
- C:\Windows\System\XRhMRtz.exe
  C:\Windows\System\XRhMRtz.exe
  2⤵
  PID:14420
- C:\Windows\System\MlPwRPs.exe
  C:\Windows\System\MlPwRPs.exe
  2⤵
  PID:14464
- C:\Windows\System\KwNczWC.exe
  C:\Windows\System\KwNczWC.exe
  2⤵
  PID:13900
- C:\Windows\System\dHeZNgh.exe
  C:\Windows\System\dHeZNgh.exe
  2⤵
  PID:14516
- C:\Windows\System\APNBLFk.exe
  C:\Windows\System\APNBLFk.exe
  2⤵
  PID:14564
- C:\Windows\System\KbGEgDZ.exe
  C:\Windows\System\KbGEgDZ.exe
  2⤵
  PID:14592
- C:\Windows\System\ccjEmUj.exe
  C:\Windows\System\ccjEmUj.exe
  2⤵
  PID:14632
- C:\Windows\System\VHbVCXY.exe
  C:\Windows\System\VHbVCXY.exe
  2⤵
  PID:14676
- C:\Windows\System\HQcSuuV.exe
  C:\Windows\System\HQcSuuV.exe
  2⤵
  PID:14740
- C:\Windows\System\rLeNXCr.exe
  C:\Windows\System\rLeNXCr.exe
  2⤵
  PID:14792
- C:\Windows\System\jVvDTpk.exe
  C:\Windows\System\jVvDTpk.exe
  2⤵
  PID:14796
- C:\Windows\System\WreKsHN.exe
  C:\Windows\System\WreKsHN.exe
  2⤵
  PID:14804
- C:\Windows\System\MopkiFW.exe
  C:\Windows\System\MopkiFW.exe
  2⤵
  PID:14848
- C:\Windows\System\kdWzTcm.exe
  C:\Windows\System\kdWzTcm.exe
  2⤵
  PID:14864
- C:\Windows\System\VQTBuqc.exe
  C:\Windows\System\VQTBuqc.exe
  2⤵
  PID:14888
- C:\Windows\System\rjxeWRI.exe
  C:\Windows\System\rjxeWRI.exe
  2⤵
  PID:14920
- C:\Windows\System\XaZpfBR.exe
  C:\Windows\System\XaZpfBR.exe
  2⤵
  PID:14940
- C:\Windows\System\gZXAxPY.exe
  C:\Windows\System\gZXAxPY.exe
  2⤵
  PID:14960
- C:\Windows\System\aUJQQAz.exe
  C:\Windows\System\aUJQQAz.exe
  2⤵
  PID:15004
- C:\Windows\System\SdlCexn.exe
  C:\Windows\System\SdlCexn.exe
  2⤵
  PID:15020
- C:\Windows\System\SbzmQGw.exe
  C:\Windows\System\SbzmQGw.exe
  2⤵
  PID:14988
- C:\Windows\System\BPzfAMw.exe
  C:\Windows\System\BPzfAMw.exe
  2⤵
  PID:14992
- C:\Windows\System\oSVbsHx.exe
  C:\Windows\System\oSVbsHx.exe
  2⤵
  PID:14996
- C:\Windows\System\KtHOQho.exe
  C:\Windows\System\KtHOQho.exe
  2⤵
  PID:14948
- C:\Windows\System\OTSNIjl.exe
  C:\Windows\System\OTSNIjl.exe
  2⤵
  PID:15068
- C:\Windows\System\tDeCHpX.exe
  C:\Windows\System\tDeCHpX.exe
  2⤵
  PID:15088
- C:\Windows\System\iyJRjrI.exe
  C:\Windows\System\iyJRjrI.exe
  2⤵
  PID:15108
- C:\Windows\System\kvBLHqb.exe
  C:\Windows\System\kvBLHqb.exe
  2⤵
  PID:15120
- C:\Windows\System\PMWnRRw.exe
  C:\Windows\System\PMWnRRw.exe
  2⤵
  PID:15104
- C:\Windows\System\wXJFiSv.exe
  C:\Windows\System\wXJFiSv.exe
  2⤵
  PID:15144
- C:\Windows\System\HDSveBQ.exe
  C:\Windows\System\HDSveBQ.exe
  2⤵
  PID:15160
- C:\Windows\System\UuLnpWI.exe
  C:\Windows\System\UuLnpWI.exe
  2⤵
  PID:15176
- C:\Windows\System\HsgxvJN.exe
  C:\Windows\System\HsgxvJN.exe
  2⤵
  PID:15192
- C:\Windows\System\LPfsTtL.exe
  C:\Windows\System\LPfsTtL.exe
  2⤵
  PID:15208
- C:\Windows\System\iNSaKcR.exe
  C:\Windows\System\iNSaKcR.exe
  2⤵
  PID:15228
- C:\Windows\System\qIJojbR.exe
  C:\Windows\System\qIJojbR.exe
  2⤵
  PID:15244
- C:\Windows\System\BrgmERi.exe
  C:\Windows\System\BrgmERi.exe
  2⤵
  PID:15260
- C:\Windows\System\NFjqTzx.exe
  C:\Windows\System\NFjqTzx.exe
  2⤵
  PID:15276
- C:\Windows\System\wZesDIc.exe
  C:\Windows\System\wZesDIc.exe
  2⤵
  PID:15292
- C:\Windows\System\HnkMIbr.exe
  C:\Windows\System\HnkMIbr.exe
  2⤵
  PID:15308
- C:\Windows\System\QfttIbi.exe
  C:\Windows\System\QfttIbi.exe
  2⤵
  PID:15320
- C:\Windows\System\dfUNNiO.exe
  C:\Windows\System\dfUNNiO.exe
  2⤵
  PID:15328
- C:\Windows\System\iIxsDQg.exe
  C:\Windows\System\iIxsDQg.exe
  2⤵
  PID:15344
- C:\Windows\System\IKfDemv.exe
  C:\Windows\System\IKfDemv.exe
  2⤵
  PID:14340
- C:\Windows\System\JJkdomP.exe
  C:\Windows\System\JJkdomP.exe
  2⤵
  PID:14368
- C:\Windows\System\AMylHdB.exe
  C:\Windows\System\AMylHdB.exe
  2⤵
  PID:14404
- C:\Windows\System\wUCMPNZ.exe
  C:\Windows\System\wUCMPNZ.exe
  2⤵
  PID:2648
- C:\Windows\System\IeDYLSC.exe
  C:\Windows\System\IeDYLSC.exe
  2⤵
  PID:4708
- C:\Windows\System\VpeFmSv.exe
  C:\Windows\System\VpeFmSv.exe
  2⤵
  PID:6720
- C:\Windows\System\rqCBNii.exe
  C:\Windows\System\rqCBNii.exe
  2⤵
  PID:12404
- C:\Windows\System\VvwLRVq.exe
  C:\Windows\System\VvwLRVq.exe
  2⤵
  PID:14468
- C:\Windows\System\RTvjFJb.exe
  C:\Windows\System\RTvjFJb.exe
  2⤵
  PID:14560
- C:\Windows\System\cSLeShT.exe
  C:\Windows\System\cSLeShT.exe
  2⤵
  PID:14628
- C:\Windows\System\gbiUrgM.exe
  C:\Windows\System\gbiUrgM.exe
  2⤵
  PID:14732
- C:\Windows\System\ZSymybg.exe
  C:\Windows\System\ZSymybg.exe
  2⤵
  PID:14808
- C:\Windows\System\XVkYWHt.exe
  C:\Windows\System\XVkYWHt.exe
  2⤵
  PID:14868
- C:\Windows\System\YIhWEnW.exe
  C:\Windows\System\YIhWEnW.exe
  2⤵
  PID:14892
- C:\Windows\System\mZiHoRe.exe
  C:\Windows\System\mZiHoRe.exe
  2⤵
  PID:14924
- C:\Windows\System\ksNghro.exe
  C:\Windows\System\ksNghro.exe
  2⤵
  PID:14984
- C:\Windows\System\LZRTuGy.exe
  C:\Windows\System\LZRTuGy.exe
  2⤵
  PID:15040
- C:\Windows\System\MdTKvkg.exe
  C:\Windows\System\MdTKvkg.exe
  2⤵
  PID:15000
- C:\Windows\System\rxVCpYF.exe
  C:\Windows\System\rxVCpYF.exe
  2⤵
  PID:15060
- C:\Windows\System\sQcgNTp.exe
  C:\Windows\System\sQcgNTp.exe
  2⤵
  PID:15100
- C:\Windows\System\fkfjstt.exe
  C:\Windows\System\fkfjstt.exe
  2⤵
  PID:15124
- C:\Windows\System\zXeiAJk.exe
  C:\Windows\System\zXeiAJk.exe
  2⤵
  PID:15156
- C:\Windows\System\hvFByre.exe
  C:\Windows\System\hvFByre.exe
  2⤵
  PID:15188
- C:\Windows\System\MxqxBAH.exe
  C:\Windows\System\MxqxBAH.exe
  2⤵
  PID:15220
- C:\Windows\System\CjRTvRw.exe
  C:\Windows\System\CjRTvRw.exe
  2⤵
  PID:15256
- C:\Windows\System\akwRbHE.exe
  C:\Windows\System\akwRbHE.exe
  2⤵
  PID:15288
- C:\Windows\System\mgczYcR.exe
  C:\Windows\System\mgczYcR.exe
  2⤵
  PID:15316
- C:\Windows\System\oWdBMIS.exe
  C:\Windows\System\oWdBMIS.exe
  2⤵
  PID:15348
- C:\Windows\System\oeCbaON.exe
  C:\Windows\System\oeCbaON.exe
  2⤵
  PID:14372
- C:\Windows\System\FqtuCcc.exe
  C:\Windows\System\FqtuCcc.exe
  2⤵
  PID:13516
- C:\Windows\System\rZEvOjt.exe
  C:\Windows\System\rZEvOjt.exe
  2⤵
  PID:13592
- C:\Windows\System\SJPEaEp.exe
  C:\Windows\System\SJPEaEp.exe
  2⤵
  PID:4824
- C:\Windows\System\gWsGhug.exe
  C:\Windows\System\gWsGhug.exe
  2⤵
  PID:14608
- C:\Windows\System\DkWFBll.exe
  C:\Windows\System\DkWFBll.exe
  2⤵
  PID:14800
- C:\Windows\System\PZfephN.exe
  C:\Windows\System\PZfephN.exe
  2⤵
  PID:14876
- C:\Windows\System\HVmyKSR.exe
  C:\Windows\System\HVmyKSR.exe
  2⤵
  PID:14972
- C:\Windows\System\VLbxQNx.exe
  C:\Windows\System\VLbxQNx.exe
  2⤵
  PID:14952
- C:\Windows\System\VpFonls.exe
  C:\Windows\System\VpFonls.exe
  2⤵
  PID:15096
- C:\Windows\System\tsLiUjS.exe
  C:\Windows\System\tsLiUjS.exe
  2⤵
  PID:15152
- C:\Windows\System\gPlUhcS.exe
  C:\Windows\System\gPlUhcS.exe
  2⤵
  PID:15224
- C:\Windows\System\muoaUNF.exe
  C:\Windows\System\muoaUNF.exe
  2⤵
  PID:15284
- C:\Windows\System\RxKlEGZ.exe
  C:\Windows\System\RxKlEGZ.exe
  2⤵
  PID:15340
- C:\Windows\System\kfvpCQY.exe
  C:\Windows\System\kfvpCQY.exe
  2⤵
  PID:6292
- C:\Windows\System\wPYzVgb.exe
  C:\Windows\System\wPYzVgb.exe
  2⤵
  PID:14452
- C:\Windows\System\HWQXPSa.exe
  C:\Windows\System\HWQXPSa.exe
  2⤵
  PID:14712
- C:\Windows\System\tjTrxmn.exe
  C:\Windows\System\tjTrxmn.exe
  2⤵
  PID:14968
- C:\Windows\System\dyGvhJf.exe
  C:\Windows\System\dyGvhJf.exe
  2⤵
  PID:15084
- C:\Windows\System\dDPrwnf.exe
  C:\Windows\System\dDPrwnf.exe
  2⤵
  PID:15184
- C:\Windows\System\ziXzAdt.exe
  C:\Windows\System\ziXzAdt.exe
  2⤵
  PID:15312
- C:\Windows\System\LCafdjo.exe
  C:\Windows\System\LCafdjo.exe
  2⤵
  PID:6552
- C:\Windows\System\cmNEEDc.exe
  C:\Windows\System\cmNEEDc.exe
  2⤵
  PID:14856
- C:\Windows\System\vpdXTyw.exe
  C:\Windows\System\vpdXTyw.exe
  2⤵
  PID:5912
- C:\Windows\System\yGzkNIy.exe
  C:\Windows\System\yGzkNIy.exe
  2⤵
  PID:14352
- C:\Windows\System\gyuzwkw.exe
  C:\Windows\System\gyuzwkw.exe
  2⤵
  PID:15048
- C:\Windows\System\CkDHSgc.exe
  C:\Windows\System\CkDHSgc.exe
  2⤵
  PID:3052
- C:\Windows\System\DoqbMso.exe
  C:\Windows\System\DoqbMso.exe
  2⤵
  PID:15252
- C:\Windows\System\uMuxIyg.exe
  C:\Windows\System\uMuxIyg.exe
  2⤵
  PID:15372
- C:\Windows\System\XpzeYNT.exe
  C:\Windows\System\XpzeYNT.exe
  2⤵
  PID:15388
- C:\Windows\System\KBKeBXf.exe
  C:\Windows\System\KBKeBXf.exe
  2⤵
  PID:15404
- C:\Windows\System\IKZmLnt.exe
  C:\Windows\System\IKZmLnt.exe
  2⤵
  PID:15420
- C:\Windows\System\WPTaocN.exe
  C:\Windows\System\WPTaocN.exe
  2⤵
  PID:15436
- C:\Windows\System\MJfPXsW.exe
  C:\Windows\System\MJfPXsW.exe
  2⤵
  PID:15508
- C:\Windows\System\VVPbQwh.exe
  C:\Windows\System\VVPbQwh.exe
  2⤵
  PID:15524
- C:\Windows\System\rbGpuas.exe
  C:\Windows\System\rbGpuas.exe
  2⤵
  PID:15540
- C:\Windows\System\KoucgUs.exe
  C:\Windows\System\KoucgUs.exe
  2⤵
  PID:15556
- C:\Windows\System\WWDLKPv.exe
  C:\Windows\System\WWDLKPv.exe
  2⤵
  PID:15572
- C:\Windows\System\RxRgMcN.exe
  C:\Windows\System\RxRgMcN.exe
  2⤵
  PID:15588
- C:\Windows\System\LTsxcNt.exe
  C:\Windows\System\LTsxcNt.exe
  2⤵
  PID:15604
- C:\Windows\System\ZDSEJfg.exe
  C:\Windows\System\ZDSEJfg.exe
  2⤵
  PID:15620
- C:\Windows\System\OQYAyid.exe
  C:\Windows\System\OQYAyid.exe
  2⤵
  PID:15636
- C:\Windows\System\vuyrlWN.exe
  C:\Windows\System\vuyrlWN.exe
  2⤵
  PID:15652
- C:\Windows\System\TIBuvDK.exe
  C:\Windows\System\TIBuvDK.exe
  2⤵
  PID:15668
- C:\Windows\System\MvkFXLZ.exe
  C:\Windows\System\MvkFXLZ.exe
  2⤵
  PID:15684
- C:\Windows\System\tUChDaZ.exe
  C:\Windows\System\tUChDaZ.exe
  2⤵
  PID:15700
- C:\Windows\System\FpvxTvj.exe
  C:\Windows\System\FpvxTvj.exe
  2⤵
  PID:15716
- C:\Windows\System\lUFLLxz.exe
  C:\Windows\System\lUFLLxz.exe
  2⤵
  PID:15732
- C:\Windows\System\AzcYMpq.exe
  C:\Windows\System\AzcYMpq.exe
  2⤵
  PID:15748
- C:\Windows\System\HTlLnst.exe
  C:\Windows\System\HTlLnst.exe
  2⤵
  PID:15764
- C:\Windows\System\VxVTKlZ.exe
  C:\Windows\System\VxVTKlZ.exe
  2⤵
  PID:15780
- C:\Windows\System\fzItrJD.exe
  C:\Windows\System\fzItrJD.exe
  2⤵
  PID:15796
- C:\Windows\System\jmwbxtT.exe
  C:\Windows\System\jmwbxtT.exe
  2⤵
  PID:15812
- C:\Windows\System\Zltstia.exe
  C:\Windows\System\Zltstia.exe
  2⤵
  PID:15828
- C:\Windows\System\IQGAZZF.exe
  C:\Windows\System\IQGAZZF.exe
  2⤵
  PID:15844
- C:\Windows\System\zVMPJDY.exe
  C:\Windows\System\zVMPJDY.exe
  2⤵
  PID:15860
- C:\Windows\System\wqewaVh.exe
  C:\Windows\System\wqewaVh.exe
  2⤵
  PID:15876
- C:\Windows\System\kVCDHVl.exe
  C:\Windows\System\kVCDHVl.exe
  2⤵
  PID:15892
- C:\Windows\System\SSLCphW.exe
  C:\Windows\System\SSLCphW.exe
  2⤵
  PID:15908
- C:\Windows\System\rshwGLh.exe
  C:\Windows\System\rshwGLh.exe
  2⤵
  PID:15924
- C:\Windows\System\ncXVdpP.exe
  C:\Windows\System\ncXVdpP.exe
  2⤵
  PID:15940
- C:\Windows\System\lFXhkYe.exe
  C:\Windows\System\lFXhkYe.exe
  2⤵
  PID:15956
- C:\Windows\System\OhhfHBM.exe
  C:\Windows\System\OhhfHBM.exe
  2⤵
  PID:15972
- C:\Windows\System\PkBMWWH.exe
  C:\Windows\System\PkBMWWH.exe
  2⤵
  PID:15988
- C:\Windows\System\CRUkgjJ.exe
  C:\Windows\System\CRUkgjJ.exe
  2⤵
  PID:16004
- C:\Windows\System\gXRVHPA.exe
  C:\Windows\System\gXRVHPA.exe
  2⤵
  PID:16020
- C:\Windows\System\wgapwpK.exe
  C:\Windows\System\wgapwpK.exe
  2⤵
  PID:16036
- C:\Windows\System\ChhJXjS.exe
  C:\Windows\System\ChhJXjS.exe
  2⤵
  PID:16060
- C:\Windows\System\SHWPFcN.exe
  C:\Windows\System\SHWPFcN.exe
  2⤵
  PID:16076
- C:\Windows\System\VdXDUFd.exe
  C:\Windows\System\VdXDUFd.exe
  2⤵
  PID:16092
- C:\Windows\System\rSEaRln.exe
  C:\Windows\System\rSEaRln.exe
  2⤵
  PID:16108
- C:\Windows\System\YOTKEDz.exe
  C:\Windows\System\YOTKEDz.exe
  2⤵
  PID:16124
- C:\Windows\System\iMvjGjH.exe
  C:\Windows\System\iMvjGjH.exe
  2⤵
  PID:16140
- C:\Windows\System\Fxqxxax.exe
  C:\Windows\System\Fxqxxax.exe
  2⤵
  PID:16156
- C:\Windows\System\ntnxavO.exe
  C:\Windows\System\ntnxavO.exe
  2⤵
  PID:16180
- C:\Windows\System\lfNfcKn.exe
  C:\Windows\System\lfNfcKn.exe
  2⤵
  PID:16196
- C:\Windows\System\UcTFmZK.exe
  C:\Windows\System\UcTFmZK.exe
  2⤵
  PID:16212
- C:\Windows\System\sdLMHid.exe
  C:\Windows\System\sdLMHid.exe
  2⤵
  PID:16228
- C:\Windows\System\vqGUYvn.exe
  C:\Windows\System\vqGUYvn.exe
  2⤵
  PID:16244
- C:\Windows\System\ohrBqqS.exe
  C:\Windows\System\ohrBqqS.exe
  2⤵
  PID:16260
- C:\Windows\System\reYWCOV.exe
  C:\Windows\System\reYWCOV.exe
  2⤵
  PID:16276
- C:\Windows\System\mbfFiMC.exe
  C:\Windows\System\mbfFiMC.exe
  2⤵
  PID:16296
- C:\Windows\System\DUoXndg.exe
  C:\Windows\System\DUoXndg.exe
  2⤵
  PID:15712
- C:\Windows\System\yBSrSEe.exe
  C:\Windows\System\yBSrSEe.exe
  2⤵
  PID:15756
- C:\Windows\System\jPWYIYs.exe
  C:\Windows\System\jPWYIYs.exe
  2⤵
  PID:15772
- C:\Windows\System\AHLQyUM.exe
  C:\Windows\System\AHLQyUM.exe
  2⤵
  PID:15808
- C:\Windows\System\WpHNSGA.exe
  C:\Windows\System\WpHNSGA.exe
  2⤵
  PID:15836
- C:\Windows\System\diKPhOL.exe
  C:\Windows\System\diKPhOL.exe
  2⤵
  PID:15872
- C:\Windows\System\JezglJK.exe
  C:\Windows\System\JezglJK.exe
  2⤵
  PID:15904
- C:\Windows\System\uJgUzhq.exe
  C:\Windows\System\uJgUzhq.exe
  2⤵
  PID:15936
- C:\Windows\System\BqIYyqN.exe
  C:\Windows\System\BqIYyqN.exe
  2⤵
  PID:15968
- C:\Windows\System\dPkxTfF.exe
  C:\Windows\System\dPkxTfF.exe
  2⤵
  PID:16000
- C:\Windows\System\VXlcQFg.exe
  C:\Windows\System\VXlcQFg.exe
  2⤵
  PID:16032
- C:\Windows\System\HWNSOzO.exe
  C:\Windows\System\HWNSOzO.exe
  2⤵
  PID:16068
- C:\Windows\System\EUuCmRj.exe
  C:\Windows\System\EUuCmRj.exe
  2⤵
  PID:16100
- C:\Windows\System\FUuqYwZ.exe
  C:\Windows\System\FUuqYwZ.exe
  2⤵
  PID:16120
- C:\Windows\System\tTxjwaY.exe
  C:\Windows\System\tTxjwaY.exe
  2⤵
  PID:16152
- C:\Windows\System\SLsWIAS.exe
  C:\Windows\System\SLsWIAS.exe
  2⤵
  PID:16176
- C:\Windows\System\ZjOmUnC.exe
  C:\Windows\System\ZjOmUnC.exe
  2⤵
  PID:16208
- C:\Windows\System\cHnJCvZ.exe
  C:\Windows\System\cHnJCvZ.exe
  2⤵
  PID:16240
- C:\Windows\System\SMwbAxx.exe
  C:\Windows\System\SMwbAxx.exe
  2⤵
  PID:16272
- C:\Windows\System\ZxBPGSU.exe
  C:\Windows\System\ZxBPGSU.exe
  2⤵
  PID:16288
- C:\Windows\System\dUrehiD.exe
  C:\Windows\System\dUrehiD.exe
  2⤵
  PID:16316
- C:\Windows\System\gVQCZbH.exe
  C:\Windows\System\gVQCZbH.exe
  2⤵
  PID:16332
- C:\Windows\System\bqmXmhs.exe
  C:\Windows\System\bqmXmhs.exe
  2⤵
  PID:16348
- C:\Windows\System\RqygKBH.exe
  C:\Windows\System\RqygKBH.exe
  2⤵
  PID:16364
- C:\Windows\System\smtHqOd.exe
  C:\Windows\System\smtHqOd.exe
  2⤵
  PID:16376
- C:\Windows\System\cGaJGPs.exe
  C:\Windows\System\cGaJGPs.exe
  2⤵
  PID:3584
- C:\Windows\System\eubTNqN.exe
  C:\Windows\System\eubTNqN.exe
  2⤵
  PID:3284
- C:\Windows\System\jqXGKAf.exe
  C:\Windows\System\jqXGKAf.exe
  2⤵
  PID:15364
- C:\Windows\System\bjNEBHd.exe
  C:\Windows\System\bjNEBHd.exe
  2⤵
  PID:15396
- C:\Windows\System\bSiYaRQ.exe
  C:\Windows\System\bSiYaRQ.exe
  2⤵
  PID:15428
- C:\Windows\System\hpssMts.exe
  C:\Windows\System\hpssMts.exe
  2⤵
  PID:15456
- C:\Windows\System\dQqpHWS.exe
  C:\Windows\System\dQqpHWS.exe
  2⤵
  PID:15468
- C:\Windows\System\pJglgCO.exe
  C:\Windows\System\pJglgCO.exe
  2⤵
  PID:15484
- C:\Windows\System\qnFhYRY.exe
  C:\Windows\System\qnFhYRY.exe
  2⤵
  PID:15500
- C:\Windows\System\WgEvnoG.exe
  C:\Windows\System\WgEvnoG.exe
  2⤵
  PID:15536
- C:\Windows\System\uqExEiO.exe
  C:\Windows\System\uqExEiO.exe
  2⤵
  PID:15568
- C:\Windows\System\wzinNhW.exe
  C:\Windows\System\wzinNhW.exe
  2⤵
  PID:15600
- C:\Windows\System\eDSIjqn.exe
  C:\Windows\System\eDSIjqn.exe
  2⤵
  PID:15632
- C:\Windows\System\omkXiBx.exe
  C:\Windows\System\omkXiBx.exe
  2⤵
  PID:15664
- C:\Windows\System\IyyMkaS.exe
  C:\Windows\System\IyyMkaS.exe
  2⤵
  PID:15696
- C:\Windows\System\pFgfNNb.exe
  C:\Windows\System\pFgfNNb.exe
  2⤵
  PID:15776
- C:\Windows\System\Oanpfuq.exe
  C:\Windows\System\Oanpfuq.exe
  2⤵
  PID:15820
- C:\Windows\System\CDGxcRa.exe
  C:\Windows\System\CDGxcRa.exe
  2⤵
  PID:15888
- C:\Windows\System\oIRQLKT.exe
  C:\Windows\System\oIRQLKT.exe
  2⤵
  PID:15952
- C:\Windows\System\jWdEYnv.exe
  C:\Windows\System\jWdEYnv.exe
  2⤵
  PID:16016
- C:\Windows\System\yZmgpxV.exe
  C:\Windows\System\yZmgpxV.exe
  2⤵
  PID:16084
- C:\Windows\System\qPFlpSo.exe
  C:\Windows\System\qPFlpSo.exe
  2⤵
  PID:16136
- C:\Windows\System\rPZIcTg.exe
  C:\Windows\System\rPZIcTg.exe
  2⤵
  PID:16192
- C:\Windows\System\FaoWtTG.exe
  C:\Windows\System\FaoWtTG.exe
  2⤵
  PID:16256
- C:\Windows\System\arLKuHF.exe
  C:\Windows\System\arLKuHF.exe
  2⤵
  PID:16312
- C:\Windows\System\vwhpMKb.exe
  C:\Windows\System\vwhpMKb.exe
  2⤵
  PID:16340
- C:\Windows\System\LkGyYbg.exe
  C:\Windows\System\LkGyYbg.exe
  2⤵
  PID:16372
- C:\Windows\System\velpgSx.exe
  C:\Windows\System\velpgSx.exe
  2⤵
  PID:3792
- C:\Windows\System\YoFCRXQ.exe
  C:\Windows\System\YoFCRXQ.exe
  2⤵
  PID:14936
- C:\Windows\System\SVuUCjP.exe
  C:\Windows\System\SVuUCjP.exe
  2⤵
  PID:15416
- C:\Windows\System\KZtuEXu.exe
  C:\Windows\System\KZtuEXu.exe
  2⤵
  PID:15464
- C:\Windows\System\tnXcNzG.exe
  C:\Windows\System\tnXcNzG.exe
  2⤵
  PID:15496
- C:\Windows\System\ulBJuyi.exe
  C:\Windows\System\ulBJuyi.exe
  2⤵
  PID:15564
- C:\Windows\System\cpiEwvi.exe
  C:\Windows\System\cpiEwvi.exe
  2⤵
  PID:15628
- C:\Windows\System\VoJljRs.exe
  C:\Windows\System\VoJljRs.exe
  2⤵
  PID:15692
- C:\Windows\System\gXNCgOH.exe
  C:\Windows\System\gXNCgOH.exe
  2⤵
  PID:15804
- C:\Windows\System\rYjYmpG.exe
  C:\Windows\System\rYjYmpG.exe
  2⤵
  PID:15932
- C:\Windows\System\ymsqtIO.exe
  C:\Windows\System\ymsqtIO.exe
  2⤵
  PID:16056
- C:\Windows\System\LkTFNfh.exe
  C:\Windows\System\LkTFNfh.exe
  2⤵
  PID:16172
- C:\Windows\System\NYEZlId.exe
  C:\Windows\System\NYEZlId.exe
  2⤵
  PID:16292
- C:\Windows\System\gUvfrQw.exe
  C:\Windows\System\gUvfrQw.exe
  2⤵
  PID:16360
- C:\Windows\System\mrVdsTZ.exe
  C:\Windows\System\mrVdsTZ.exe
  2⤵
  PID:16380
- C:\Windows\System\yKdhYyo.exe
  C:\Windows\System\yKdhYyo.exe
  2⤵
  PID:15460
- C:\Windows\System\SqAeGFX.exe
  C:\Windows\System\SqAeGFX.exe
  2⤵
  PID:15552
- C:\Windows\System\GaXxKAE.exe
  C:\Windows\System\GaXxKAE.exe
  2⤵
  PID:15680
- C:\Windows\System\MEcqHJd.exe
  C:\Windows\System\MEcqHJd.exe
  2⤵
  PID:15920
- C:\Windows\System\yaWZvEK.exe
  C:\Windows\System\yaWZvEK.exe
  2⤵
  PID:16168
- C:\Windows\System\GEbmvhC.exe
  C:\Windows\System\GEbmvhC.exe
  2⤵
  PID:16356
- C:\Windows\System\ZwvqcFj.exe
  C:\Windows\System\ZwvqcFj.exe
  2⤵
  PID:15452
- C:\Windows\System\wmfrcJa.exe
  C:\Windows\System\wmfrcJa.exe
  2⤵
  PID:15660
- C:\Windows\System\qhjbsBW.exe
  C:\Windows\System\qhjbsBW.exe
  2⤵
  PID:16116

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_lk2lqkpf.xte.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\AoplhzU.exe

Filesize
1.7MB

MD5
58dc47f3e1a27fe73f527144b8c3e282

SHA1
6dc9e9d91f3563bddd71041734db02595cb1126c

SHA256
3f545524e9f06d2b20b63da74f0ced99c529a9644ad8b4214c299b6ea95c4a58

SHA512
4c89f6bd6722e1d24e5bc2d4d4dda1fa5ef1687bd4dd2e2ab79787eaa44f93af2143c4b371ea00cc2b6d348b22d39fd4a0c9c0e2628d71bf0a68373a1bf9d5d2

Download Submit
C:\Windows\System\AsYoWRy.exe

Filesize
1.7MB

MD5
53f8c51581e324efa0db96bc09683180

SHA1
1590759e86f8b64118ac2ff5961df952fcc83e3d

SHA256
bc24e4da2ec31df921d0a62d02a40f2836e9006d2b5d95d7eed4c65ad065267a

SHA512
f8507b9e3def04f9d0e417619c44f0771ed8bd34c215a842ea8d4d4c538832405a76e10a93363a49714346ac5da690be74deef445d6fd01a2606b583559d5af4

Download Submit
C:\Windows\System\BEQLzVN.exe

Filesize
1.7MB

MD5
b00fcbb792866ef56bf5961cb419c65b

SHA1
d2d846a9bd6fde1cef1ab57ea653136e49122740

SHA256
1b41b26647ef00421149a7310b6f4fa71637183e2f9784d04cad4c6b667ac8de

SHA512
bca2a18df4986e81ad8bc2fcec127a786a76a4c0c79027cc340da0e02a9f65028c26e97213a55835c0264e1d515e63c1efc09fc3fefa4c5daeda5da26b5f9191

Download Submit
C:\Windows\System\EtKEzhC.exe

Filesize
1.7MB

MD5
c090e2cc2d895279b09c2861f3ecc3f7

SHA1
8eb33685b9b3ddc4b74eff92c31962471ac37e37

SHA256
2f765002eb2a5cf40152413fe6763adeb910ce4bdac81eedd7a0d95bb3412046

SHA512
d4e9a4f03bdf6a482283808164253217909ec731006b9fab0965cbc93e525c2d18e402261f14df9438d1520282929a6854b06b43d5001146601fded82bf17034

Download Submit
C:\Windows\System\KBPIYTr.exe

Filesize
1.7MB

MD5
d1519fc897f744cb52562528b6f42f70

SHA1
899048a5cedbdde4bf79b2c59df52338b58837e8

SHA256
f76e05d25be9e835f1ea791637f06e9f544a32e1bbd8a00ab60ce26ff5d61be0

SHA512
1c274c6ba85c49eae4b9054473e12b3c42fcb4b5608f6aa558aaecc507944ea00be765affedacfcf5f05d186fac2278e9346feab6f6bdfc03bcacfaab9f8747b

Download Submit
C:\Windows\System\KCLeLVP.exe

Filesize
1.7MB

MD5
3822082eafe627604ce39cb7c67042fb

SHA1
b7460b79f457a693034005e08c9fc40672927a58

SHA256
e4c450db5e5552e93739664c732c36a927689fcb9021c1871dcef9554bbd8aa5

SHA512
658a57a1845d8933206a755991088c26cce87394e5632f51556c95385c74507778c507ac90c962793fd9c5accb781a2f1cd1e0958459a4ab1e2025602bf0f65b

Download Submit
C:\Windows\System\LQmJiZM.exe

Filesize
1.7MB

MD5
c4c2463a52080ea23ff1c1de2060c1c2

SHA1
bd11cd4ac1c24afe484b1683388009cc26417191

SHA256
21afcd2090b3e11f11ce6b25109fd1c09f76be4007c3a380af6a77e66dacc9da

SHA512
0653492771265afb55556eb9b013c4143882158bdb95e81227f75c5b9cbc04fbfc7fb225a18a8c15b608f19c454429fb4a5ad81a518d09b8db8e90952977cded

Download Submit
C:\Windows\System\LbeHsTh.exe

Filesize
1.7MB

MD5
0163c6bde9e6508b108065c6bfdc8a43

SHA1
3b347d6ecbeb84182d173510a7911fbfb8f456f7

SHA256
1f2b7a21beade817b2e20b3d8091b89ed12e701142aa51e276a035b364d818c1

SHA512
501c54ea87859a2980edc3497dec0111ae6c500a11427073038355495dd5baa88a65b04bc4f8ba8ac6e53f84ae943e6a02fb652f230d726a32ff7d43f7fdaa20

Download Submit
C:\Windows\System\LhPYKCw.exe

Filesize
1.7MB

MD5
366fb77ef555d76684227ee53b588d78

SHA1
0ddc0af062986972e9a45c31b657a86b6136b6cc

SHA256
5abcf8015ac8abf535e9b317fff69a2beef5f87feb3c9c007e5a88ab1cab5c0e

SHA512
a71d5a89337b1cfaf5bfb8dd15a1a97def27ed8f83b967236a819a037de13c49fc5942a05c6b8fdaaf24199579b2eb13f321c32aad6a5963472e50af3a8c31ef

Download Submit
C:\Windows\System\NcMBVHW.exe

Filesize
1.7MB

MD5
6b878c50fccbc5f0726ab671c59b79cc

SHA1
9526c3e2b71cb51388c2e81b0399064d9e74a8e0

SHA256
5082e8e49e70fcc38ac361582f58543f27a14930549fe0a73a6e070b16539ec2

SHA512
cd21957c4099cd2a90cb7f49a7ae0d0646c1b1b0afa7055f5ee7dab93f681297a326b5211e9bb0df9ce7bc8269c15a9bcbe561459b9aa106d1ead0918a48b01c

Download Submit
C:\Windows\System\OWHWQCM.exe

Filesize
1.7MB

MD5
dc6cbe492e1702518ba67cc203b346b5

SHA1
90083af2c824364bcbc3cdfe1fe99b16da11685a

SHA256
9cae78b2fd23b15c4fa196ffa9c197b43dfd71eab36f12946500bad9e274769c

SHA512
c4936df7306520f1b3226dc836ec81c0dce979305498e9b22cbb6d04a98c5b8aa61be22702da1f3895ecf268b048696df60677df047b3c7c491f47d759564b6a

Download Submit
C:\Windows\System\PHJhEov.exe

Filesize
1.7MB

MD5
e14c355854a69e5f3373a2052d16279c

SHA1
8addeb41b9643b87626680b8413d1c5a9a7520cd

SHA256
4a7544b1e42d86120c8758ee59a955065531dc54419c91de253ada2efa72e0e7

SHA512
492e3403bf695f2d32fc037e5ec3a5830588e4591966dd5cee2b403813c856cf758e840d451e8f2b9acfd774da3ee4387ea63857ec4c348c8af708a21851dd7f

Download Submit
C:\Windows\System\QEsrvgA.exe

Filesize
1.7MB

MD5
c1c737f9ffafe2f90316de3c387506dd

SHA1
ca46fb815e52252fa854def009474c97f7054b41

SHA256
a7ead6abea6dd62027f11e182fd1baedd2e56b005a510ea50a66d452f7f44324

SHA512
271d457a9deda9b4d17888689be60fe812a3fd40c65467ed9da1de7b63225ae077f27b4b8e5571d0351db021b37ff127cbcaf8ea3de682ea3b43329f96a019d7

Download Submit
C:\Windows\System\SZemFKH.exe

Filesize
1.7MB

MD5
8f62bf3b1e3b76d57cdb61354c3148b0

SHA1
b46edde7fac5252446ac10e0f8f93bc1c6e92159

SHA256
d7adc6649f9369d27f4838611f6610aab733618449d498ee980834bee72424e6

SHA512
7aefa344a0049ad53a23a0ddc6d556e1b392a74eb84b9a8ed8cc23d7087224edef0e4105c03014db2da3eb08657728f7b0262e6ed92172e556c8b8577c5b1393

Download Submit
C:\Windows\System\ULtiqEh.exe

Filesize
1.7MB

MD5
823a97e5e060363f4432c9253cacb39f

SHA1
2cc9b829d3cf3b8ecf07e00bcc6253865c99d944

SHA256
62b66ba2d3c3e52d4cc920487fd84864ba7c48ad260ad42e953df560bae91688

SHA512
48c21d69fb4e01beb7f77e0b35ea20dab845f7df6d45909629dd220cd631eba4c93b208999b14ddc6a81bb5dec2e174167bbcec905c14d96456390dcf969c8db

Download Submit
C:\Windows\System\ZNTxZoY.exe

Filesize
1.7MB

MD5
ba730ebc291e211bf6cf7c82d815ccf9

SHA1
d3cb7a9305fe0db6d368aefea7b4b941de27252d

SHA256
3172056f2683240b673e6fb1bc40db4b4a6711cf74b66725c4cf433ec1baeb14

SHA512
82841eff7a9b8e19e4f89c9846cd0ca703dec9980dfc50c021a3789d75ed85a5721649938d1b40c144f1dd2f83a1787e422f4abdb7488db702a88b4fb263b47d

Download Submit
C:\Windows\System\cuAIcJG.exe

Filesize
1.7MB

MD5
358fdf644b764ddd1895f8a653376f1f

SHA1
f088d9a1582448068576deb78ba35428ceeffad9

SHA256
d14ed000921263980aa51ac011a2922eb5ead3b310567fff36df7a42aa876181

SHA512
02c2523760ea742d2a7a7bd7f9812585ecf36f26ab31ec74094e2df7e756b0e5a91a37f97732c94e6aa133e83fda3e5d7acf29d1616cd2b0113aa9c7c77959a7

Download Submit
C:\Windows\System\fnQAMrx.exe

Filesize
1.7MB

MD5
b1af288d21d0ff19101fab3bfd56dfab

SHA1
477232d2c32c6706fd655293b753805b0005ba30

SHA256
37a6a72e7cc6ba906955318b5e5438712b6c989dc0fbe6e38179fabb3311933e

SHA512
8094bb34ebb40af0515c34ad3a159d41db2cfb4857d54b961dbbc0bcb827be6b707f0ea637e5d1bc409a9a1deec5b87c2c7bf527ab1a7eabc2ffe5a249fd2ada

Download Submit
C:\Windows\System\illJmqr.exe

Filesize
1.7MB

MD5
390a51a1151fded859861eb1544a7063

SHA1
0b43dbb3be74426e3815cc83c8525016916aaa06

SHA256
60d3f7e686bde5ab1dfebf8f6629de839d38251f8c97dcc381743ded854d3b50

SHA512
7fa7e95d273c816138f1237febbcad32d27891320ae91a73eb886f794a1088152f541621c59251854a8f2a0fb822f9d323caffa03219aa1f81deb5b321452fd0

Download Submit
C:\Windows\System\jeqLJfA.exe

Filesize
1.7MB

MD5
0637b686cfd97bba41049960bdc84cff

SHA1
1ebdb1748770feba62eb031dc04c193d46a5da92

SHA256
b4cec9840c7a832bb1ba7cbdb84c7705287009fc1d21764edb70735fc4df9755

SHA512
647de13748168069a708853e6fa897a6b699c7d56eae48f6324b6a352c0fe7953ab3f7d79da0d44fd2101a154c6db69f3738840b415ec9859a54ceff76d6ee23

Download Submit
C:\Windows\System\kTesPzp.exe

Filesize
1.7MB

MD5
9ffc266c2c07e8051271f7945afd6fa9

SHA1
9bcc5a7683d475247f2f14ddb5f71df58e81f5a9

SHA256
04bf638addf39ad3968d04ecb07a4168388ea06386f63c9c9694cfde9e551b72

SHA512
3858e666adedb9d31f4b4b6cadf7775372050b3cc3b5c8c9675ed6676be1d7eb583cf88bb1a67343db580b4b7350eed11b6c9bbf9848f180643e90a14f21467e

Download Submit
C:\Windows\System\mrRZwaA.exe

Filesize
1.7MB

MD5
b5ae75d5560ba89e1f5a7ce7443a2145

SHA1
c8615058c81cf7c5853887e47cf0d2248fec64f8

SHA256
5e54c270c8ccccd585a8f8355eb97cc0c3b23eb0e219a09ea501919439265f38

SHA512
4d5e1eced7a015943df612c9b6e8fc6826957c31834635428aa6b9e0d4b34eea62a62aa6266a19279035d462590382ea66e1cede8273c795eeec92ed82143b7c

Download Submit
C:\Windows\System\mtvzbfW.exe

Filesize
1.7MB

MD5
a6c7352c83417d671a99f4f09a183cc7

SHA1
63c3992a7e5211c295b4b9ca96b93b7c9d9f6e6d

SHA256
53297ceef01ddc1ad92b7a06af03f3e479a68832dd52942fd4572586e92982f1

SHA512
a9fdda9b9ba83180aa4fac06ecd93fe62b098bbac31b61c3e467a5959df655ce9616092fc6f595f270663124f8727b66f669d05170d7aa9c51c10a478fd12bb9

Download Submit
C:\Windows\System\nlvNetq.exe

Filesize
1.7MB

MD5
32685eb68fac78a08a01138a4a49584e

SHA1
ea4f307fe2515e046351493a782d22243a68dcc5

SHA256
53d9142e5d90a9f01e3846ee5da8c216909d3c3482641d07f9d75ac9adfe70dc

SHA512
8047e940a5c0ac05af744ac8a21e52ee7ac8f603d16cd6aff446de6b936aa7ff7acd38af7c2d0c57aec3677562d23c6788b5f20c3bdaf408c7e8da730af2bf20

Download Submit
C:\Windows\System\oqSSbBx.exe

Filesize
8B

MD5
67d893d1a2095d39d451d08ee1cc05e9

SHA1
dad7ef4487e41ff3c3e600250e691ed16832dc94

SHA256
cc871666e89dd430f5e3dc9cc361cd1a4ecf7214b4b8daeb86cca2257079f3ce

SHA512
7799e4db272ac6c136cb55f2e50c1582a5027767dc6d148dbf159fdb6f776a047cf2ac573fbb2f2ca5a994173cf0465c93ef3f6e6c86e8981136e854def9801d

Download Submit
C:\Windows\System\rhRnRBv.exe

Filesize
1.7MB

MD5
b36197b759643eb3ad15e757a9bc1cbc

SHA1
1349a5a72db5d82291a9ba9f3784591f7d1416e2

SHA256
c21859f09114e314f0d05a3e531f5f1b7124d58d0634321d77732014b974a22a

SHA512
7193d76a3bf3dd910701863a4d74c336769338d0b862847f7d099c30d858f056d3787b9aef7fd12b8cdc5cfa3872ac2c9389d491d227e10f49930b821f4179ce

Download Submit
C:\Windows\System\sCRgHCr.exe

Filesize
1.7MB

MD5
505ccd04ae5127a502d21119284c3e4b

SHA1
45253e9ac1667a0a13cdbf144f10eb66d6850db2

SHA256
33e43ce9e23c5c7a71caa1c966e2af4783c7cdd1f2162524dc491f7338263e42

SHA512
5f0675172b2d29702e849033f3b0e2ab658d8e392f70862c435bba380a4f0496aa1a11b70568796346f26026ef24ad1667672ad44b5e85acea266d8fadb11950

Download Submit
C:\Windows\System\sprqrtl.exe

Filesize
1.7MB

MD5
b28e9bfe3c26b1cd7e98393eadc239f3

SHA1
6106d0d4904b0c2c0ad636870cbad7daa9614873

SHA256
9054550c35a349a4a7aad788558cfd444451d3d13964e34fc65624b639988f55

SHA512
3f3056bbfa9bbec589ea148ef753d69b9dd8bfb8a1602093ad1cd5c7e342d4a0ad60d468b5bea07a8dd7c6d6644760ab041612d56479e08a2a703b40cef9cd0c

Download Submit
C:\Windows\System\tIievhr.exe

Filesize
1.7MB

MD5
600ab1279755ae7c093a2222f1b9a166

SHA1
064963198c30ff21a948e995c399edf2b57446a5

SHA256
df0cf8463a0d8745e3318ea4ad891ea5af838069b6aba9a15cb33b4f20af78da

SHA512
ee775d28e965ea6a2f6b0212de310dd9d360da533ce5d15010896af22e48f0d44c917e65d7270ff18518f7302e2a45dced84a550ce5332136cc7115611b5fa86

Download Submit
C:\Windows\System\thlFpRg.exe

Filesize
1.7MB

MD5
321beba292e04318cccc7f61cd76e61c

SHA1
ebbc61a44106256790a6a3195d7e222d64f10628

SHA256
eff8804ea16a140bce821b7ebaf8ac1e5409b8b56ec98f1c63f36a23aad28ef0

SHA512
43705daa5e02c13a88d63b8fb63a6f17c984cc2f29949d90908d77d883bece41e27c7c9e221948dc83f1e700627550e748aa456cf864894cc1c19356766f44d5

Download Submit
C:\Windows\System\vFIAYsM.exe

Filesize
1.7MB

MD5
084f0660c2e9727b9fa876d0ffffeeaf

SHA1
6dc964c336dd4f0813b3522f72ffc768ea136ec1

SHA256
362264d3e93e5dc0c7c7908d6df4b6d1ab8fa8be96ae0ba75b108e3d099a17c2

SHA512
fd974f28f45024ba95da152b133aa763c5d5d0ea55cc03f5e27be98a678868018bcd86893c16899ba623b220bc9d80db941fe2bedf636fc7f71e2ff5a24bc71a

Download Submit
C:\Windows\System\vhMJHyq.exe

Filesize
1.7MB

MD5
c60de4c23cdb6214d4a79c3456c7c2e1

SHA1
5e0b7bb6797ce1e8cc23717527f27f4c5913dea0

SHA256
8a22fa84a1f68b58bfb60f02ee0a89ac0bb05ca616848259e5aa1751de6ef7db

SHA512
7cc12b5d6ed9581d95130112dea557bf599f72585b1099262f68d6376840a1a3766c29aea4481b7f27513b5bb380b0c5d050fecca95d5bbc0c2e1b39fcd4a15b

Download Submit
C:\Windows\System\wgkdyBf.exe

Filesize
1.7MB

MD5
420c60e4b64cfc6e7df0f4b717935028

SHA1
c1cb1e591d65b5736ea61756f9f1753899992e1e

SHA256
aa529c71171911488f5325cdd567c1a2a50d9c6b43492416a2fa908fd20f7a39

SHA512
810f6ed36e0a65583341d5c54dcf8a5403ad9c109a53066c261aa228bbee8137ab041cfff2e81c2b04147159917e312bd72c52c82b26537da8231c730df329a2

Download Submit
C:\Windows\System\zUnafQg.exe

Filesize
1.7MB

MD5
e2324c07dac8e840644075a02634c08f

SHA1
ff76cad655c82e41260771709aa3df3390945755

SHA256
e7cd8588ec7030cb29f71e6c6ed18d354586ebeb93752e4d05603d073c70c69b

SHA512
084c93424f797eb9a2bd3cc723bc665330457dead384650f99e1d7b3227770ff1f0324dbdb995b7b6f2ac944ffeb1e18b305b715c962d2dff9a9947d3a4caf02

Download Submit
memory/228-8-0x00007FF749780000-0x00007FF749B72000-memory.dmp

Filesize
3.9MB

Download
memory/228-4103-0x00007FF749780000-0x00007FF749B72000-memory.dmp

Filesize
3.9MB

Download
memory/884-94-0x00007FF701630000-0x00007FF701A22000-memory.dmp

Filesize
3.9MB

Download
memory/884-4134-0x00007FF701630000-0x00007FF701A22000-memory.dmp

Filesize
3.9MB

Download
memory/1060-4172-0x00007FF6C27A0000-0x00007FF6C2B92000-memory.dmp

Filesize
3.9MB

Download
memory/1060-178-0x00007FF6C27A0000-0x00007FF6C2B92000-memory.dmp

Filesize
3.9MB

Download
memory/1204-47-0x00007FF6E7740000-0x00007FF6E7B32000-memory.dmp

Filesize
3.9MB

Download
memory/1204-4113-0x00007FF6E7740000-0x00007FF6E7B32000-memory.dmp

Filesize
3.9MB

Download
memory/1208-4174-0x00007FF7DEE60000-0x00007FF7DF252000-memory.dmp

Filesize
3.9MB

Download
memory/1208-171-0x00007FF7DEE60000-0x00007FF7DF252000-memory.dmp

Filesize
3.9MB

Download
memory/1620-153-0x00007FF6FCEB0000-0x00007FF6FD2A2000-memory.dmp

Filesize
3.9MB

Download
memory/1620-4158-0x00007FF6FCEB0000-0x00007FF6FD2A2000-memory.dmp

Filesize
3.9MB

Download
memory/1624-99-0x00007FF7367E0000-0x00007FF736BD2000-memory.dmp

Filesize
3.9MB

Download
memory/1688-147-0x00007FF7932F0000-0x00007FF7936E2000-memory.dmp

Filesize
3.9MB

Download
memory/1896-4141-0x00007FF7FF7D0000-0x00007FF7FFBC2000-memory.dmp

Filesize
3.9MB

Download
memory/1896-111-0x00007FF7FF7D0000-0x00007FF7FFBC2000-memory.dmp

Filesize
3.9MB

Download
memory/2100-1-0x000001A684DA0000-0x000001A684DB0000-memory.dmp

Filesize
64KB

Download
memory/2100-0-0x00007FF681F50000-0x00007FF682342000-memory.dmp

Filesize
3.9MB

Download
memory/2136-159-0x00007FF6522E0000-0x00007FF6526D2000-memory.dmp

Filesize
3.9MB

Download
memory/2136-4168-0x00007FF6522E0000-0x00007FF6526D2000-memory.dmp

Filesize
3.9MB

Download
memory/2156-124-0x00007FF758940000-0x00007FF758D32000-memory.dmp

Filesize
3.9MB

Download
memory/2320-141-0x00007FF648190000-0x00007FF648582000-memory.dmp

Filesize
3.9MB

Download
memory/2320-4138-0x00007FF648190000-0x00007FF648582000-memory.dmp

Filesize
3.9MB

Download
memory/2628-18-0x00007FF7FC500000-0x00007FF7FC8F2000-memory.dmp

Filesize
3.9MB

Download
memory/2628-4107-0x00007FF7FC500000-0x00007FF7FC8F2000-memory.dmp

Filesize
3.9MB

Download
memory/2680-19-0x00007FFFBA453000-0x00007FFFBA455000-memory.dmp

Filesize
8KB

Download
memory/2680-135-0x00007FFFBA450000-0x00007FFFBAF11000-memory.dmp

Filesize
10.8MB

Download
memory/2680-443-0x000001F8FE280000-0x000001F8FEA26000-memory.dmp

Filesize
7.6MB

Download
memory/2680-84-0x000001F8FCBB0000-0x000001F8FCBD2000-memory.dmp

Filesize
136KB

Download
memory/2680-39-0x00007FFFBA450000-0x00007FFFBAF11000-memory.dmp

Filesize
10.8MB

Download
memory/3152-95-0x00007FF65FD60000-0x00007FF660152000-memory.dmp

Filesize
3.9MB

Download
memory/3168-112-0x00007FF713DB0000-0x00007FF7141A2000-memory.dmp

Filesize
3.9MB

Download
memory/3168-4155-0x00007FF713DB0000-0x00007FF7141A2000-memory.dmp

Filesize
3.9MB

Download
memory/3908-105-0x00007FF6B0D80000-0x00007FF6B1172000-memory.dmp

Filesize
3.9MB

Download
memory/4072-4149-0x00007FF7E4F30000-0x00007FF7E5322000-memory.dmp

Filesize
3.9MB

Download
memory/4072-118-0x00007FF7E4F30000-0x00007FF7E5322000-memory.dmp

Filesize
3.9MB

Download
memory/4208-4120-0x00007FF714080000-0x00007FF714472000-memory.dmp

Filesize
3.9MB

Download
memory/4208-73-0x00007FF714080000-0x00007FF714472000-memory.dmp

Filesize
3.9MB

Download
memory/4504-196-0x00007FF773FA0000-0x00007FF774392000-memory.dmp

Filesize
3.9MB

Download
memory/4504-4165-0x00007FF773FA0000-0x00007FF774392000-memory.dmp

Filesize
3.9MB

Download
memory/4700-4180-0x00007FF662050000-0x00007FF662442000-memory.dmp

Filesize
3.9MB

Download
memory/4700-190-0x00007FF662050000-0x00007FF662442000-memory.dmp

Filesize
3.9MB

Download
memory/4752-172-0x00007FF640E20000-0x00007FF641212000-memory.dmp

Filesize
3.9MB

Download
memory/4752-4184-0x00007FF640E20000-0x00007FF641212000-memory.dmp

Filesize
3.9MB

Download
memory/4772-4178-0x00007FF766C30000-0x00007FF767022000-memory.dmp

Filesize
3.9MB

Download
memory/4772-184-0x00007FF766C30000-0x00007FF767022000-memory.dmp

Filesize
3.9MB

Download
memory/4804-4187-0x00007FF6C9490000-0x00007FF6C9882000-memory.dmp

Filesize
3.9MB

Download
memory/4804-165-0x00007FF6C9490000-0x00007FF6C9882000-memory.dmp

Filesize
3.9MB

Download
memory/5104-4200-0x00007FF7E1440000-0x00007FF7E1832000-memory.dmp

Filesize
3.9MB

Download
memory/5104-202-0x00007FF7E1440000-0x00007FF7E1832000-memory.dmp

Filesize
3.9MB

Download