xmrig | 75e0454ce7ef697a917a4ea458571e6c2b58334cb515513f003cc6346ab48803

Analysis

max time kernel
132s
max time network
129s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
08/06/2024, 12:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a320612e071a70e3fac6dd58fead61e0_NeikiAnalytics.exe
Size

3.0MB
MD5

a320612e071a70e3fac6dd58fead61e0
SHA1

393bf63d6f6ad7bf041f79cabc5b82bb6d4234cf
SHA256

75e0454ce7ef697a917a4ea458571e6c2b58334cb515513f003cc6346ab48803
SHA512

5aa641489952accc2a56e398387b5744159ff7011ebeac13df7f5fdae2ea2565c9a5aec4b1808c7258ead23abc3574e1a779eb16e1235f941fd98786679c71d5
SSDEEP

98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWM:7bBeSFkg

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral2/memory/692-0-0x00007FF69F9B0000-0x00007FF69FDA6000-memory.dmp	xmrig
behavioral2/files/0x0009000000023428-6.dat	xmrig
behavioral2/files/0x0007000000023444-13.dat	xmrig
behavioral2/files/0x0007000000023445-15.dat	xmrig
behavioral2/files/0x0007000000023448-30.dat	xmrig
behavioral2/files/0x000700000002344a-40.dat	xmrig
behavioral2/files/0x000700000002344d-66.dat	xmrig
behavioral2/files/0x000700000002344e-97.dat	xmrig
behavioral2/files/0x0007000000023453-106.dat	xmrig
behavioral2/memory/4136-115-0x00007FF756FC0000-0x00007FF7573B6000-memory.dmp	xmrig
behavioral2/memory/3264-118-0x00007FF7D7060000-0x00007FF7D7456000-memory.dmp	xmrig
behavioral2/memory/4744-120-0x00007FF79EE30000-0x00007FF79F226000-memory.dmp	xmrig
behavioral2/memory/1924-123-0x00007FF7463D0000-0x00007FF7467C6000-memory.dmp	xmrig
behavioral2/memory/4392-127-0x00007FF6F3B40000-0x00007FF6F3F36000-memory.dmp	xmrig
behavioral2/memory/2512-128-0x00007FF757120000-0x00007FF757516000-memory.dmp	xmrig
behavioral2/memory/4864-126-0x00007FF7BCB30000-0x00007FF7BCF26000-memory.dmp	xmrig
behavioral2/memory/1580-125-0x00007FF649DB0000-0x00007FF64A1A6000-memory.dmp	xmrig
behavioral2/memory/3344-124-0x00007FF6905A0000-0x00007FF690996000-memory.dmp	xmrig
behavioral2/memory/4456-122-0x00007FF771320000-0x00007FF771716000-memory.dmp	xmrig
behavioral2/memory/4748-121-0x00007FF7C8EC0000-0x00007FF7C92B6000-memory.dmp	xmrig
behavioral2/memory/4248-119-0x00007FF789900000-0x00007FF789CF6000-memory.dmp	xmrig
behavioral2/memory/3372-117-0x00007FF70F790000-0x00007FF70FB86000-memory.dmp	xmrig
behavioral2/memory/4264-116-0x00007FF793170000-0x00007FF793566000-memory.dmp	xmrig
behavioral2/files/0x0007000000023456-113.dat	xmrig
behavioral2/files/0x0007000000023455-111.dat	xmrig
behavioral2/files/0x0007000000023454-109.dat	xmrig
behavioral2/memory/2832-108-0x00007FF7B6200000-0x00007FF7B65F6000-memory.dmp	xmrig
behavioral2/files/0x0007000000023452-104.dat	xmrig
behavioral2/files/0x0007000000023451-102.dat	xmrig
behavioral2/memory/2384-101-0x00007FF6416C0000-0x00007FF641AB6000-memory.dmp	xmrig
behavioral2/files/0x0008000000023450-93.dat	xmrig
behavioral2/memory/912-92-0x00007FF6DBC70000-0x00007FF6DC066000-memory.dmp	xmrig
behavioral2/files/0x000700000002344c-78.dat	xmrig
behavioral2/memory/2808-75-0x00007FF74F3A0000-0x00007FF74F796000-memory.dmp	xmrig
behavioral2/files/0x000700000002344b-70.dat	xmrig
behavioral2/memory/1076-47-0x00007FF66FD50000-0x00007FF670146000-memory.dmp	xmrig
behavioral2/files/0x0007000000023449-45.dat	xmrig
behavioral2/files/0x0007000000023446-33.dat	xmrig
behavioral2/files/0x0007000000023447-25.dat	xmrig
behavioral2/files/0x0007000000023457-353.dat	xmrig
behavioral2/files/0x00070000000234a7-363.dat	xmrig
behavioral2/files/0x00070000000234b2-376.dat	xmrig
behavioral2/files/0x00070000000234af-368.dat	xmrig
behavioral2/files/0x00070000000234b4-405.dat	xmrig
behavioral2/files/0x00070000000234ba-404.dat	xmrig
behavioral2/memory/4068-398-0x00007FF64ABD0000-0x00007FF64AFC6000-memory.dmp	xmrig
behavioral2/memory/3124-401-0x00007FF63A140000-0x00007FF63A536000-memory.dmp	xmrig
behavioral2/memory/1672-383-0x00007FF6A0230000-0x00007FF6A0626000-memory.dmp	xmrig
behavioral2/files/0x00070000000234b3-382.dat	xmrig
behavioral2/memory/3620-386-0x00007FF76EF90000-0x00007FF76F386000-memory.dmp	xmrig
behavioral2/files/0x00070000000234c8-434.dat	xmrig
behavioral2/files/0x00070000000234ca-442.dat	xmrig
behavioral2/files/0x00070000000234c9-439.dat	xmrig
behavioral2/files/0x00070000000234b6-437.dat	xmrig
behavioral2/memory/4928-433-0x00007FF64FCA0000-0x00007FF650096000-memory.dmp	xmrig
behavioral2/files/0x00070000000234c7-430.dat	xmrig
behavioral2/files/0x00070000000234c3-429.dat	xmrig
behavioral2/files/0x00070000000234c1-427.dat	xmrig
behavioral2/files/0x00070000000234be-415.dat	xmrig
behavioral2/files/0x00070000000234bc-412.dat	xmrig
behavioral2/memory/4068-3524-0x00007FF64ABD0000-0x00007FF64AFC6000-memory.dmp	xmrig
behavioral2/memory/1076-4505-0x00007FF66FD50000-0x00007FF670146000-memory.dmp	xmrig
behavioral2/memory/2384-4516-0x00007FF6416C0000-0x00007FF641AB6000-memory.dmp	xmrig
behavioral2/memory/2832-4542-0x00007FF7B6200000-0x00007FF7B65F6000-memory.dmp	xmrig

Blocklisted process makes network request 7 IoCs

flow	pid	Process
8	1556	powershell.exe
10	1556	powershell.exe
12	1556	powershell.exe
13	1556	powershell.exe
15	1556	powershell.exe
16	1556	powershell.exe
17	1556	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
1556	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
1924	yxlOYXp.exe
1076	INVrWOY.exe
2808	BXoJMLq.exe
912	nKMwVBC.exe
2384	vVEscbw.exe
3344	HXayGTb.exe
2832	bGdxZkx.exe
1580	NDHafLP.exe
4864	OAOulnA.exe
4136	zdbmjoz.exe
4264	bmYHcRd.exe
3372	fcJshmF.exe
4392	UqsDrlA.exe
3264	CDqOByA.exe
4248	bkkoxZe.exe
4744	eOIIyEh.exe
2512	tfekIvr.exe
4748	cmeuuBr.exe
4456	HWWVaxl.exe
1672	CFWnHvC.exe
3620	pbcHZBt.exe
4068	YVgalWz.exe
4928	CCmyiyn.exe
3124	NXVyUJh.exe
4692	ItdgbuW.exe
4024	FobGFxH.exe
4892	XjhQzVK.exe
4408	tSoYDZK.exe
3088	uozjSTQ.exe
4884	qNZxgdI.exe
2488	GhiwNxD.exe
4764	yFAwVgO.exe
3244	WRlTplW.exe
3456	hGGUypI.exe
3960	NEqQHan.exe
3000	qTxBRVo.exe
4428	ElIWbUR.exe
3972	WOWKeGS.exe
2888	fmfxWgf.exe
3172	XeFSDTF.exe
4148	jESlePi.exe
824	QYOrOMz.exe
3008	ZLCGXkl.exe
2668	bJRAHya.exe
4192	JCShjGS.exe
3868	JyeXJwg.exe
1272	KIZlIlj.exe
4832	rKXFGgL.exe
880	XQesygJ.exe
1336	OjIBaaZ.exe
572	iwpXHYh.exe
4284	LZnYCbd.exe
5068	TUYdUqD.exe
3476	wDTpyAn.exe
4440	IPgnYsq.exe
884	RWoENrh.exe
2520	NkrWYDD.exe
1832	DltMoXC.exe
4612	CNHoGLX.exe
3804	sGuuICe.exe
4220	IshkwLs.exe
552	sMJKpCZ.exe
928	bHiDRMg.exe
4280	nafhqPB.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/692-0-0x00007FF69F9B0000-0x00007FF69FDA6000-memory.dmp	upx
behavioral2/files/0x0009000000023428-6.dat	upx
behavioral2/files/0x0007000000023444-13.dat	upx
behavioral2/files/0x0007000000023445-15.dat	upx
behavioral2/files/0x0007000000023448-30.dat	upx
behavioral2/files/0x000700000002344a-40.dat	upx
behavioral2/files/0x000700000002344d-66.dat	upx
behavioral2/files/0x000700000002344e-97.dat	upx
behavioral2/files/0x0007000000023453-106.dat	upx
behavioral2/memory/4136-115-0x00007FF756FC0000-0x00007FF7573B6000-memory.dmp	upx
behavioral2/memory/3264-118-0x00007FF7D7060000-0x00007FF7D7456000-memory.dmp	upx
behavioral2/memory/4744-120-0x00007FF79EE30000-0x00007FF79F226000-memory.dmp	upx
behavioral2/memory/1924-123-0x00007FF7463D0000-0x00007FF7467C6000-memory.dmp	upx
behavioral2/memory/4392-127-0x00007FF6F3B40000-0x00007FF6F3F36000-memory.dmp	upx
behavioral2/memory/2512-128-0x00007FF757120000-0x00007FF757516000-memory.dmp	upx
behavioral2/memory/4864-126-0x00007FF7BCB30000-0x00007FF7BCF26000-memory.dmp	upx
behavioral2/memory/1580-125-0x00007FF649DB0000-0x00007FF64A1A6000-memory.dmp	upx
behavioral2/memory/3344-124-0x00007FF6905A0000-0x00007FF690996000-memory.dmp	upx
behavioral2/memory/4456-122-0x00007FF771320000-0x00007FF771716000-memory.dmp	upx
behavioral2/memory/4748-121-0x00007FF7C8EC0000-0x00007FF7C92B6000-memory.dmp	upx
behavioral2/memory/4248-119-0x00007FF789900000-0x00007FF789CF6000-memory.dmp	upx
behavioral2/memory/3372-117-0x00007FF70F790000-0x00007FF70FB86000-memory.dmp	upx
behavioral2/memory/4264-116-0x00007FF793170000-0x00007FF793566000-memory.dmp	upx
behavioral2/files/0x0007000000023456-113.dat	upx
behavioral2/files/0x0007000000023455-111.dat	upx
behavioral2/files/0x0007000000023454-109.dat	upx
behavioral2/memory/2832-108-0x00007FF7B6200000-0x00007FF7B65F6000-memory.dmp	upx
behavioral2/files/0x0007000000023452-104.dat	upx
behavioral2/files/0x0007000000023451-102.dat	upx
behavioral2/memory/2384-101-0x00007FF6416C0000-0x00007FF641AB6000-memory.dmp	upx
behavioral2/files/0x0008000000023450-93.dat	upx
behavioral2/memory/912-92-0x00007FF6DBC70000-0x00007FF6DC066000-memory.dmp	upx
behavioral2/files/0x000700000002344c-78.dat	upx
behavioral2/memory/2808-75-0x00007FF74F3A0000-0x00007FF74F796000-memory.dmp	upx
behavioral2/files/0x000700000002344b-70.dat	upx
behavioral2/memory/1076-47-0x00007FF66FD50000-0x00007FF670146000-memory.dmp	upx
behavioral2/files/0x0007000000023449-45.dat	upx
behavioral2/files/0x0007000000023446-33.dat	upx
behavioral2/files/0x0007000000023447-25.dat	upx
behavioral2/files/0x0007000000023457-353.dat	upx
behavioral2/files/0x00070000000234a7-363.dat	upx
behavioral2/files/0x00070000000234b2-376.dat	upx
behavioral2/files/0x00070000000234af-368.dat	upx
behavioral2/files/0x00070000000234b4-405.dat	upx
behavioral2/files/0x00070000000234ba-404.dat	upx
behavioral2/memory/4068-398-0x00007FF64ABD0000-0x00007FF64AFC6000-memory.dmp	upx
behavioral2/memory/3124-401-0x00007FF63A140000-0x00007FF63A536000-memory.dmp	upx
behavioral2/memory/1672-383-0x00007FF6A0230000-0x00007FF6A0626000-memory.dmp	upx
behavioral2/files/0x00070000000234b3-382.dat	upx
behavioral2/memory/3620-386-0x00007FF76EF90000-0x00007FF76F386000-memory.dmp	upx
behavioral2/files/0x00070000000234c8-434.dat	upx
behavioral2/files/0x00070000000234ca-442.dat	upx
behavioral2/files/0x00070000000234c9-439.dat	upx
behavioral2/files/0x00070000000234b6-437.dat	upx
behavioral2/memory/4928-433-0x00007FF64FCA0000-0x00007FF650096000-memory.dmp	upx
behavioral2/files/0x00070000000234c7-430.dat	upx
behavioral2/files/0x00070000000234c3-429.dat	upx
behavioral2/files/0x00070000000234c1-427.dat	upx
behavioral2/files/0x00070000000234be-415.dat	upx
behavioral2/files/0x00070000000234bc-412.dat	upx
behavioral2/memory/4068-3524-0x00007FF64ABD0000-0x00007FF64AFC6000-memory.dmp	upx
behavioral2/memory/1076-4505-0x00007FF66FD50000-0x00007FF670146000-memory.dmp	upx
behavioral2/memory/2384-4516-0x00007FF6416C0000-0x00007FF641AB6000-memory.dmp	upx
behavioral2/memory/2832-4542-0x00007FF7B6200000-0x00007FF7B65F6000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
7	raw.githubusercontent.com
8	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\gJOLEBO.exe	a320612e071a70e3fac6dd58fead61e0_NeikiAnalytics.exe
File created	C:\Windows\System\JFHKVRP.exe	a320612e071a70e3fac6dd58fead61e0_NeikiAnalytics.exe
File created	C:\Windows\System\LDLPqKx.exe	a320612e071a70e3fac6dd58fead61e0_NeikiAnalytics.exe
File created	C:\Windows\System\ZwWAWyc.exe	a320612e071a70e3fac6dd58fead61e0_NeikiAnalytics.exe
File created	C:\Windows\System\qPezXwL.exe	a320612e071a70e3fac6dd58fead61e0_NeikiAnalytics.exe
File created	C:\Windows\System\AyhPetq.exe	a320612e071a70e3fac6dd58fead61e0_NeikiAnalytics.exe
File created	C:\Windows\System\TLmVrcD.exe	a320612e071a70e3fac6dd58fead61e0_NeikiAnalytics.exe
File created	C:\Windows\System\SxBbpkZ.exe	a320612e071a70e3fac6dd58fead61e0_NeikiAnalytics.exe
File created	C:\Windows\System\XpHWQWK.exe	a320612e071a70e3fac6dd58fead61e0_NeikiAnalytics.exe
File created	C:\Windows\System\ZQxXGRs.exe	a320612e071a70e3fac6dd58fead61e0_NeikiAnalytics.exe
File created	C:\Windows\System\dLDfVTe.exe	a320612e071a70e3fac6dd58fead61e0_NeikiAnalytics.exe
File created	C:\Windows\System\yynRURO.exe	a320612e071a70e3fac6dd58fead61e0_NeikiAnalytics.exe
File created	C:\Windows\System\MBFyZBT.exe	a320612e071a70e3fac6dd58fead61e0_NeikiAnalytics.exe
File created	C:\Windows\System\nQXFejO.exe	a320612e071a70e3fac6dd58fead61e0_NeikiAnalytics.exe
File created	C:\Windows\System\gdHfVCb.exe	a320612e071a70e3fac6dd58fead61e0_NeikiAnalytics.exe
File created	C:\Windows\System\NFCcfYI.exe	a320612e071a70e3fac6dd58fead61e0_NeikiAnalytics.exe
File created	C:\Windows\System\VHdOSDp.exe	a320612e071a70e3fac6dd58fead61e0_NeikiAnalytics.exe
File created	C:\Windows\System\kfmEhXu.exe	a320612e071a70e3fac6dd58fead61e0_NeikiAnalytics.exe
File created	C:\Windows\System\neSHQPV.exe	a320612e071a70e3fac6dd58fead61e0_NeikiAnalytics.exe
File created	C:\Windows\System\suxdleg.exe	a320612e071a70e3fac6dd58fead61e0_NeikiAnalytics.exe
File created	C:\Windows\System\WWKKmpG.exe	a320612e071a70e3fac6dd58fead61e0_NeikiAnalytics.exe
File created	C:\Windows\System\ugqirTq.exe	a320612e071a70e3fac6dd58fead61e0_NeikiAnalytics.exe
File created	C:\Windows\System\OazoqMR.exe	a320612e071a70e3fac6dd58fead61e0_NeikiAnalytics.exe
File created	C:\Windows\System\uykQgqY.exe	a320612e071a70e3fac6dd58fead61e0_NeikiAnalytics.exe
File created	C:\Windows\System\PzGCagv.exe	a320612e071a70e3fac6dd58fead61e0_NeikiAnalytics.exe
File created	C:\Windows\System\EDAfbCI.exe	a320612e071a70e3fac6dd58fead61e0_NeikiAnalytics.exe
File created	C:\Windows\System\ZHrRcal.exe	a320612e071a70e3fac6dd58fead61e0_NeikiAnalytics.exe
File created	C:\Windows\System\kIiVKjd.exe	a320612e071a70e3fac6dd58fead61e0_NeikiAnalytics.exe
File created	C:\Windows\System\SOSLOSE.exe	a320612e071a70e3fac6dd58fead61e0_NeikiAnalytics.exe
File created	C:\Windows\System\kwEiViE.exe	a320612e071a70e3fac6dd58fead61e0_NeikiAnalytics.exe
File created	C:\Windows\System\WxpmHWg.exe	a320612e071a70e3fac6dd58fead61e0_NeikiAnalytics.exe
File created	C:\Windows\System\SFOwijJ.exe	a320612e071a70e3fac6dd58fead61e0_NeikiAnalytics.exe
File created	C:\Windows\System\Bqathsd.exe	a320612e071a70e3fac6dd58fead61e0_NeikiAnalytics.exe
File created	C:\Windows\System\FBeFXaZ.exe	a320612e071a70e3fac6dd58fead61e0_NeikiAnalytics.exe
File created	C:\Windows\System\KuQIOjd.exe	a320612e071a70e3fac6dd58fead61e0_NeikiAnalytics.exe
File created	C:\Windows\System\WAmTSar.exe	a320612e071a70e3fac6dd58fead61e0_NeikiAnalytics.exe
File created	C:\Windows\System\yeGRiCw.exe	a320612e071a70e3fac6dd58fead61e0_NeikiAnalytics.exe
File created	C:\Windows\System\IZEPywn.exe	a320612e071a70e3fac6dd58fead61e0_NeikiAnalytics.exe
File created	C:\Windows\System\GGnSFIs.exe	a320612e071a70e3fac6dd58fead61e0_NeikiAnalytics.exe
File created	C:\Windows\System\iqLijdf.exe	a320612e071a70e3fac6dd58fead61e0_NeikiAnalytics.exe
File created	C:\Windows\System\XozQyfS.exe	a320612e071a70e3fac6dd58fead61e0_NeikiAnalytics.exe
File created	C:\Windows\System\KkNJtMk.exe	a320612e071a70e3fac6dd58fead61e0_NeikiAnalytics.exe
File created	C:\Windows\System\ppwAdHk.exe	a320612e071a70e3fac6dd58fead61e0_NeikiAnalytics.exe
File created	C:\Windows\System\ufQiUaX.exe	a320612e071a70e3fac6dd58fead61e0_NeikiAnalytics.exe
File created	C:\Windows\System\moCHSAf.exe	a320612e071a70e3fac6dd58fead61e0_NeikiAnalytics.exe
File created	C:\Windows\System\oaZRgnP.exe	a320612e071a70e3fac6dd58fead61e0_NeikiAnalytics.exe
File created	C:\Windows\System\IYtItRv.exe	a320612e071a70e3fac6dd58fead61e0_NeikiAnalytics.exe
File created	C:\Windows\System\YMAxqcm.exe	a320612e071a70e3fac6dd58fead61e0_NeikiAnalytics.exe
File created	C:\Windows\System\otsOvPf.exe	a320612e071a70e3fac6dd58fead61e0_NeikiAnalytics.exe
File created	C:\Windows\System\CqVSfXJ.exe	a320612e071a70e3fac6dd58fead61e0_NeikiAnalytics.exe
File created	C:\Windows\System\CqtcLEe.exe	a320612e071a70e3fac6dd58fead61e0_NeikiAnalytics.exe
File created	C:\Windows\System\pSxVGOU.exe	a320612e071a70e3fac6dd58fead61e0_NeikiAnalytics.exe
File created	C:\Windows\System\VZkAtGA.exe	a320612e071a70e3fac6dd58fead61e0_NeikiAnalytics.exe
File created	C:\Windows\System\clXyDad.exe	a320612e071a70e3fac6dd58fead61e0_NeikiAnalytics.exe
File created	C:\Windows\System\CBWrFka.exe	a320612e071a70e3fac6dd58fead61e0_NeikiAnalytics.exe
File created	C:\Windows\System\yGspyfu.exe	a320612e071a70e3fac6dd58fead61e0_NeikiAnalytics.exe
File created	C:\Windows\System\AccNIZs.exe	a320612e071a70e3fac6dd58fead61e0_NeikiAnalytics.exe
File created	C:\Windows\System\tndKAvv.exe	a320612e071a70e3fac6dd58fead61e0_NeikiAnalytics.exe
File created	C:\Windows\System\TomKyoc.exe	a320612e071a70e3fac6dd58fead61e0_NeikiAnalytics.exe
File created	C:\Windows\System\paJwzUR.exe	a320612e071a70e3fac6dd58fead61e0_NeikiAnalytics.exe
File created	C:\Windows\System\RvQRbOx.exe	a320612e071a70e3fac6dd58fead61e0_NeikiAnalytics.exe
File created	C:\Windows\System\FlLcKOX.exe	a320612e071a70e3fac6dd58fead61e0_NeikiAnalytics.exe
File created	C:\Windows\System\SVudkpo.exe	a320612e071a70e3fac6dd58fead61e0_NeikiAnalytics.exe
File created	C:\Windows\System\BgeGjjg.exe	a320612e071a70e3fac6dd58fead61e0_NeikiAnalytics.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
1556	powershell.exe
1556	powershell.exe
1556	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	692	a320612e071a70e3fac6dd58fead61e0_NeikiAnalytics.exe
Token: SeLockMemoryPrivilege	692	a320612e071a70e3fac6dd58fead61e0_NeikiAnalytics.exe
Token: SeDebugPrivilege	1556	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 692 wrote to memory of 1556	692	a320612e071a70e3fac6dd58fead61e0_NeikiAnalytics.exe	83
PID 692 wrote to memory of 1556	692	a320612e071a70e3fac6dd58fead61e0_NeikiAnalytics.exe	83
PID 692 wrote to memory of 1924	692	a320612e071a70e3fac6dd58fead61e0_NeikiAnalytics.exe	84
PID 692 wrote to memory of 1924	692	a320612e071a70e3fac6dd58fead61e0_NeikiAnalytics.exe	84
PID 692 wrote to memory of 1076	692	a320612e071a70e3fac6dd58fead61e0_NeikiAnalytics.exe	86
PID 692 wrote to memory of 1076	692	a320612e071a70e3fac6dd58fead61e0_NeikiAnalytics.exe	86
PID 692 wrote to memory of 2808	692	a320612e071a70e3fac6dd58fead61e0_NeikiAnalytics.exe	87
PID 692 wrote to memory of 2808	692	a320612e071a70e3fac6dd58fead61e0_NeikiAnalytics.exe	87
PID 692 wrote to memory of 912	692	a320612e071a70e3fac6dd58fead61e0_NeikiAnalytics.exe	88
PID 692 wrote to memory of 912	692	a320612e071a70e3fac6dd58fead61e0_NeikiAnalytics.exe	88
PID 692 wrote to memory of 2384	692	a320612e071a70e3fac6dd58fead61e0_NeikiAnalytics.exe	89
PID 692 wrote to memory of 2384	692	a320612e071a70e3fac6dd58fead61e0_NeikiAnalytics.exe	89
PID 692 wrote to memory of 3344	692	a320612e071a70e3fac6dd58fead61e0_NeikiAnalytics.exe	90
PID 692 wrote to memory of 3344	692	a320612e071a70e3fac6dd58fead61e0_NeikiAnalytics.exe	90
PID 692 wrote to memory of 2832	692	a320612e071a70e3fac6dd58fead61e0_NeikiAnalytics.exe	91
PID 692 wrote to memory of 2832	692	a320612e071a70e3fac6dd58fead61e0_NeikiAnalytics.exe	91
PID 692 wrote to memory of 1580	692	a320612e071a70e3fac6dd58fead61e0_NeikiAnalytics.exe	92
PID 692 wrote to memory of 1580	692	a320612e071a70e3fac6dd58fead61e0_NeikiAnalytics.exe	92
PID 692 wrote to memory of 4864	692	a320612e071a70e3fac6dd58fead61e0_NeikiAnalytics.exe	93
PID 692 wrote to memory of 4864	692	a320612e071a70e3fac6dd58fead61e0_NeikiAnalytics.exe	93
PID 692 wrote to memory of 4136	692	a320612e071a70e3fac6dd58fead61e0_NeikiAnalytics.exe	94
PID 692 wrote to memory of 4136	692	a320612e071a70e3fac6dd58fead61e0_NeikiAnalytics.exe	94
PID 692 wrote to memory of 4264	692	a320612e071a70e3fac6dd58fead61e0_NeikiAnalytics.exe	95
PID 692 wrote to memory of 4264	692	a320612e071a70e3fac6dd58fead61e0_NeikiAnalytics.exe	95
PID 692 wrote to memory of 3372	692	a320612e071a70e3fac6dd58fead61e0_NeikiAnalytics.exe	96
PID 692 wrote to memory of 3372	692	a320612e071a70e3fac6dd58fead61e0_NeikiAnalytics.exe	96
PID 692 wrote to memory of 4392	692	a320612e071a70e3fac6dd58fead61e0_NeikiAnalytics.exe	97
PID 692 wrote to memory of 4392	692	a320612e071a70e3fac6dd58fead61e0_NeikiAnalytics.exe	97
PID 692 wrote to memory of 3264	692	a320612e071a70e3fac6dd58fead61e0_NeikiAnalytics.exe	98
PID 692 wrote to memory of 3264	692	a320612e071a70e3fac6dd58fead61e0_NeikiAnalytics.exe	98
PID 692 wrote to memory of 4248	692	a320612e071a70e3fac6dd58fead61e0_NeikiAnalytics.exe	99
PID 692 wrote to memory of 4248	692	a320612e071a70e3fac6dd58fead61e0_NeikiAnalytics.exe	99
PID 692 wrote to memory of 4744	692	a320612e071a70e3fac6dd58fead61e0_NeikiAnalytics.exe	100
PID 692 wrote to memory of 4744	692	a320612e071a70e3fac6dd58fead61e0_NeikiAnalytics.exe	100
PID 692 wrote to memory of 2512	692	a320612e071a70e3fac6dd58fead61e0_NeikiAnalytics.exe	101
PID 692 wrote to memory of 2512	692	a320612e071a70e3fac6dd58fead61e0_NeikiAnalytics.exe	101
PID 692 wrote to memory of 4748	692	a320612e071a70e3fac6dd58fead61e0_NeikiAnalytics.exe	102
PID 692 wrote to memory of 4748	692	a320612e071a70e3fac6dd58fead61e0_NeikiAnalytics.exe	102
PID 692 wrote to memory of 4456	692	a320612e071a70e3fac6dd58fead61e0_NeikiAnalytics.exe	103
PID 692 wrote to memory of 4456	692	a320612e071a70e3fac6dd58fead61e0_NeikiAnalytics.exe	103
PID 692 wrote to memory of 1672	692	a320612e071a70e3fac6dd58fead61e0_NeikiAnalytics.exe	105
PID 692 wrote to memory of 1672	692	a320612e071a70e3fac6dd58fead61e0_NeikiAnalytics.exe	105
PID 692 wrote to memory of 3620	692	a320612e071a70e3fac6dd58fead61e0_NeikiAnalytics.exe	106
PID 692 wrote to memory of 3620	692	a320612e071a70e3fac6dd58fead61e0_NeikiAnalytics.exe	106
PID 692 wrote to memory of 4068	692	a320612e071a70e3fac6dd58fead61e0_NeikiAnalytics.exe	108
PID 692 wrote to memory of 4068	692	a320612e071a70e3fac6dd58fead61e0_NeikiAnalytics.exe	108
PID 692 wrote to memory of 4928	692	a320612e071a70e3fac6dd58fead61e0_NeikiAnalytics.exe	109
PID 692 wrote to memory of 4928	692	a320612e071a70e3fac6dd58fead61e0_NeikiAnalytics.exe	109
PID 692 wrote to memory of 3124	692	a320612e071a70e3fac6dd58fead61e0_NeikiAnalytics.exe	110
PID 692 wrote to memory of 3124	692	a320612e071a70e3fac6dd58fead61e0_NeikiAnalytics.exe	110
PID 692 wrote to memory of 4692	692	a320612e071a70e3fac6dd58fead61e0_NeikiAnalytics.exe	111
PID 692 wrote to memory of 4692	692	a320612e071a70e3fac6dd58fead61e0_NeikiAnalytics.exe	111
PID 692 wrote to memory of 4408	692	a320612e071a70e3fac6dd58fead61e0_NeikiAnalytics.exe	112
PID 692 wrote to memory of 4408	692	a320612e071a70e3fac6dd58fead61e0_NeikiAnalytics.exe	112
PID 692 wrote to memory of 4024	692	a320612e071a70e3fac6dd58fead61e0_NeikiAnalytics.exe	113
PID 692 wrote to memory of 4024	692	a320612e071a70e3fac6dd58fead61e0_NeikiAnalytics.exe	113
PID 692 wrote to memory of 4892	692	a320612e071a70e3fac6dd58fead61e0_NeikiAnalytics.exe	114
PID 692 wrote to memory of 4892	692	a320612e071a70e3fac6dd58fead61e0_NeikiAnalytics.exe	114
PID 692 wrote to memory of 3088	692	a320612e071a70e3fac6dd58fead61e0_NeikiAnalytics.exe	115
PID 692 wrote to memory of 3088	692	a320612e071a70e3fac6dd58fead61e0_NeikiAnalytics.exe	115
PID 692 wrote to memory of 4884	692	a320612e071a70e3fac6dd58fead61e0_NeikiAnalytics.exe	116
PID 692 wrote to memory of 4884	692	a320612e071a70e3fac6dd58fead61e0_NeikiAnalytics.exe	116
PID 692 wrote to memory of 2488	692	a320612e071a70e3fac6dd58fead61e0_NeikiAnalytics.exe	117
PID 692 wrote to memory of 2488	692	a320612e071a70e3fac6dd58fead61e0_NeikiAnalytics.exe	117

C:\Users\Admin\AppData\Local\Temp\a320612e071a70e3fac6dd58fead61e0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\a320612e071a70e3fac6dd58fead61e0_NeikiAnalytics.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:692
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1556
- C:\Windows\System\yxlOYXp.exe
  C:\Windows\System\yxlOYXp.exe
  2⤵
  - Executes dropped EXE
  PID:1924
- C:\Windows\System\INVrWOY.exe
  C:\Windows\System\INVrWOY.exe
  2⤵
  - Executes dropped EXE
  PID:1076
- C:\Windows\System\BXoJMLq.exe
  C:\Windows\System\BXoJMLq.exe
  2⤵
  - Executes dropped EXE
  PID:2808
- C:\Windows\System\nKMwVBC.exe
  C:\Windows\System\nKMwVBC.exe
  2⤵
  - Executes dropped EXE
  PID:912
- C:\Windows\System\vVEscbw.exe
  C:\Windows\System\vVEscbw.exe
  2⤵
  - Executes dropped EXE
  PID:2384
- C:\Windows\System\HXayGTb.exe
  C:\Windows\System\HXayGTb.exe
  2⤵
  - Executes dropped EXE
  PID:3344
- C:\Windows\System\bGdxZkx.exe
  C:\Windows\System\bGdxZkx.exe
  2⤵
  - Executes dropped EXE
  PID:2832
- C:\Windows\System\NDHafLP.exe
  C:\Windows\System\NDHafLP.exe
  2⤵
  - Executes dropped EXE
  PID:1580
- C:\Windows\System\OAOulnA.exe
  C:\Windows\System\OAOulnA.exe
  2⤵
  - Executes dropped EXE
  PID:4864
- C:\Windows\System\zdbmjoz.exe
  C:\Windows\System\zdbmjoz.exe
  2⤵
  - Executes dropped EXE
  PID:4136
- C:\Windows\System\bmYHcRd.exe
  C:\Windows\System\bmYHcRd.exe
  2⤵
  - Executes dropped EXE
  PID:4264
- C:\Windows\System\fcJshmF.exe
  C:\Windows\System\fcJshmF.exe
  2⤵
  - Executes dropped EXE
  PID:3372
- C:\Windows\System\UqsDrlA.exe
  C:\Windows\System\UqsDrlA.exe
  2⤵
  - Executes dropped EXE
  PID:4392
- C:\Windows\System\CDqOByA.exe
  C:\Windows\System\CDqOByA.exe
  2⤵
  - Executes dropped EXE
  PID:3264
- C:\Windows\System\bkkoxZe.exe
  C:\Windows\System\bkkoxZe.exe
  2⤵
  - Executes dropped EXE
  PID:4248
- C:\Windows\System\eOIIyEh.exe
  C:\Windows\System\eOIIyEh.exe
  2⤵
  - Executes dropped EXE
  PID:4744
- C:\Windows\System\tfekIvr.exe
  C:\Windows\System\tfekIvr.exe
  2⤵
  - Executes dropped EXE
  PID:2512
- C:\Windows\System\cmeuuBr.exe
  C:\Windows\System\cmeuuBr.exe
  2⤵
  - Executes dropped EXE
  PID:4748
- C:\Windows\System\HWWVaxl.exe
  C:\Windows\System\HWWVaxl.exe
  2⤵
  - Executes dropped EXE
  PID:4456
- C:\Windows\System\CFWnHvC.exe
  C:\Windows\System\CFWnHvC.exe
  2⤵
  - Executes dropped EXE
  PID:1672
- C:\Windows\System\pbcHZBt.exe
  C:\Windows\System\pbcHZBt.exe
  2⤵
  - Executes dropped EXE
  PID:3620
- C:\Windows\System\YVgalWz.exe
  C:\Windows\System\YVgalWz.exe
  2⤵
  - Executes dropped EXE
  PID:4068
- C:\Windows\System\CCmyiyn.exe
  C:\Windows\System\CCmyiyn.exe
  2⤵
  - Executes dropped EXE
  PID:4928
- C:\Windows\System\NXVyUJh.exe
  C:\Windows\System\NXVyUJh.exe
  2⤵
  - Executes dropped EXE
  PID:3124
- C:\Windows\System\ItdgbuW.exe
  C:\Windows\System\ItdgbuW.exe
  2⤵
  - Executes dropped EXE
  PID:4692
- C:\Windows\System\tSoYDZK.exe
  C:\Windows\System\tSoYDZK.exe
  2⤵
  - Executes dropped EXE
  PID:4408
- C:\Windows\System\FobGFxH.exe
  C:\Windows\System\FobGFxH.exe
  2⤵
  - Executes dropped EXE
  PID:4024
- C:\Windows\System\XjhQzVK.exe
  C:\Windows\System\XjhQzVK.exe
  2⤵
  - Executes dropped EXE
  PID:4892
- C:\Windows\System\uozjSTQ.exe
  C:\Windows\System\uozjSTQ.exe
  2⤵
  - Executes dropped EXE
  PID:3088
- C:\Windows\System\qNZxgdI.exe
  C:\Windows\System\qNZxgdI.exe
  2⤵
  - Executes dropped EXE
  PID:4884
- C:\Windows\System\GhiwNxD.exe
  C:\Windows\System\GhiwNxD.exe
  2⤵
  - Executes dropped EXE
  PID:2488
- C:\Windows\System\yFAwVgO.exe
  C:\Windows\System\yFAwVgO.exe
  2⤵
  - Executes dropped EXE
  PID:4764
- C:\Windows\System\WRlTplW.exe
  C:\Windows\System\WRlTplW.exe
  2⤵
  - Executes dropped EXE
  PID:3244
- C:\Windows\System\hGGUypI.exe
  C:\Windows\System\hGGUypI.exe
  2⤵
  - Executes dropped EXE
  PID:3456
- C:\Windows\System\NEqQHan.exe
  C:\Windows\System\NEqQHan.exe
  2⤵
  - Executes dropped EXE
  PID:3960
- C:\Windows\System\qTxBRVo.exe
  C:\Windows\System\qTxBRVo.exe
  2⤵
  - Executes dropped EXE
  PID:3000
- C:\Windows\System\ElIWbUR.exe
  C:\Windows\System\ElIWbUR.exe
  2⤵
  - Executes dropped EXE
  PID:4428
- C:\Windows\System\WOWKeGS.exe
  C:\Windows\System\WOWKeGS.exe
  2⤵
  - Executes dropped EXE
  PID:3972
- C:\Windows\System\fmfxWgf.exe
  C:\Windows\System\fmfxWgf.exe
  2⤵
  - Executes dropped EXE
  PID:2888
- C:\Windows\System\XeFSDTF.exe
  C:\Windows\System\XeFSDTF.exe
  2⤵
  - Executes dropped EXE
  PID:3172
- C:\Windows\System\jESlePi.exe
  C:\Windows\System\jESlePi.exe
  2⤵
  - Executes dropped EXE
  PID:4148
- C:\Windows\System\QYOrOMz.exe
  C:\Windows\System\QYOrOMz.exe
  2⤵
  - Executes dropped EXE
  PID:824
- C:\Windows\System\ZLCGXkl.exe
  C:\Windows\System\ZLCGXkl.exe
  2⤵
  - Executes dropped EXE
  PID:3008
- C:\Windows\System\bJRAHya.exe
  C:\Windows\System\bJRAHya.exe
  2⤵
  - Executes dropped EXE
  PID:2668
- C:\Windows\System\JCShjGS.exe
  C:\Windows\System\JCShjGS.exe
  2⤵
  - Executes dropped EXE
  PID:4192
- C:\Windows\System\JyeXJwg.exe
  C:\Windows\System\JyeXJwg.exe
  2⤵
  - Executes dropped EXE
  PID:3868
- C:\Windows\System\KIZlIlj.exe
  C:\Windows\System\KIZlIlj.exe
  2⤵
  - Executes dropped EXE
  PID:1272
- C:\Windows\System\rKXFGgL.exe
  C:\Windows\System\rKXFGgL.exe
  2⤵
  - Executes dropped EXE
  PID:4832
- C:\Windows\System\XQesygJ.exe
  C:\Windows\System\XQesygJ.exe
  2⤵
  - Executes dropped EXE
  PID:880
- C:\Windows\System\OjIBaaZ.exe
  C:\Windows\System\OjIBaaZ.exe
  2⤵
  - Executes dropped EXE
  PID:1336
- C:\Windows\System\iwpXHYh.exe
  C:\Windows\System\iwpXHYh.exe
  2⤵
  - Executes dropped EXE
  PID:572
- C:\Windows\System\LZnYCbd.exe
  C:\Windows\System\LZnYCbd.exe
  2⤵
  - Executes dropped EXE
  PID:4284
- C:\Windows\System\TUYdUqD.exe
  C:\Windows\System\TUYdUqD.exe
  2⤵
  - Executes dropped EXE
  PID:5068
- C:\Windows\System\wDTpyAn.exe
  C:\Windows\System\wDTpyAn.exe
  2⤵
  - Executes dropped EXE
  PID:3476
- C:\Windows\System\IPgnYsq.exe
  C:\Windows\System\IPgnYsq.exe
  2⤵
  - Executes dropped EXE
  PID:4440
- C:\Windows\System\RWoENrh.exe
  C:\Windows\System\RWoENrh.exe
  2⤵
  - Executes dropped EXE
  PID:884
- C:\Windows\System\NkrWYDD.exe
  C:\Windows\System\NkrWYDD.exe
  2⤵
  - Executes dropped EXE
  PID:2520
- C:\Windows\System\DltMoXC.exe
  C:\Windows\System\DltMoXC.exe
  2⤵
  - Executes dropped EXE
  PID:1832
- C:\Windows\System\CNHoGLX.exe
  C:\Windows\System\CNHoGLX.exe
  2⤵
  - Executes dropped EXE
  PID:4612
- C:\Windows\System\sGuuICe.exe
  C:\Windows\System\sGuuICe.exe
  2⤵
  - Executes dropped EXE
  PID:3804
- C:\Windows\System\IshkwLs.exe
  C:\Windows\System\IshkwLs.exe
  2⤵
  - Executes dropped EXE
  PID:4220
- C:\Windows\System\sMJKpCZ.exe
  C:\Windows\System\sMJKpCZ.exe
  2⤵
  - Executes dropped EXE
  PID:552
- C:\Windows\System\bHiDRMg.exe
  C:\Windows\System\bHiDRMg.exe
  2⤵
  - Executes dropped EXE
  PID:928
- C:\Windows\System\nafhqPB.exe
  C:\Windows\System\nafhqPB.exe
  2⤵
  - Executes dropped EXE
  PID:4280
- C:\Windows\System\XMNZZvN.exe
  C:\Windows\System\XMNZZvN.exe
  2⤵
  PID:644
- C:\Windows\System\BLSzkUQ.exe
  C:\Windows\System\BLSzkUQ.exe
  2⤵
  PID:1896
- C:\Windows\System\dxyEprd.exe
  C:\Windows\System\dxyEprd.exe
  2⤵
  PID:2304
- C:\Windows\System\txRgdGg.exe
  C:\Windows\System\txRgdGg.exe
  2⤵
  PID:3192
- C:\Windows\System\AklkAul.exe
  C:\Windows\System\AklkAul.exe
  2⤵
  PID:516
- C:\Windows\System\BflwOVU.exe
  C:\Windows\System\BflwOVU.exe
  2⤵
  PID:1368
- C:\Windows\System\PeguBTq.exe
  C:\Windows\System\PeguBTq.exe
  2⤵
  PID:1412
- C:\Windows\System\LHbdcyu.exe
  C:\Windows\System\LHbdcyu.exe
  2⤵
  PID:4048
- C:\Windows\System\fOnIoUD.exe
  C:\Windows\System\fOnIoUD.exe
  2⤵
  PID:996
- C:\Windows\System\qYPvTSE.exe
  C:\Windows\System\qYPvTSE.exe
  2⤵
  PID:4680
- C:\Windows\System\RDgVWzc.exe
  C:\Windows\System\RDgVWzc.exe
  2⤵
  PID:3488
- C:\Windows\System\TpcvjyF.exe
  C:\Windows\System\TpcvjyF.exe
  2⤵
  PID:4548
- C:\Windows\System\KKXyCdQ.exe
  C:\Windows\System\KKXyCdQ.exe
  2⤵
  PID:2860
- C:\Windows\System\aZDqelv.exe
  C:\Windows\System\aZDqelv.exe
  2⤵
  PID:2052
- C:\Windows\System\ZqTGZHM.exe
  C:\Windows\System\ZqTGZHM.exe
  2⤵
  PID:2856
- C:\Windows\System\UrBdBCu.exe
  C:\Windows\System\UrBdBCu.exe
  2⤵
  PID:4620
- C:\Windows\System\UPqvilu.exe
  C:\Windows\System\UPqvilu.exe
  2⤵
  PID:1532
- C:\Windows\System\yOiwzCe.exe
  C:\Windows\System\yOiwzCe.exe
  2⤵
  PID:2676
- C:\Windows\System\yYsFsCo.exe
  C:\Windows\System\yYsFsCo.exe
  2⤵
  PID:2720
- C:\Windows\System\MgdfGPQ.exe
  C:\Windows\System\MgdfGPQ.exe
  2⤵
  PID:4776
- C:\Windows\System\ayvBnWu.exe
  C:\Windows\System\ayvBnWu.exe
  2⤵
  PID:2188
- C:\Windows\System\EmQbteX.exe
  C:\Windows\System\EmQbteX.exe
  2⤵
  PID:2948
- C:\Windows\System\OhrLjHs.exe
  C:\Windows\System\OhrLjHs.exe
  2⤵
  PID:2036
- C:\Windows\System\EFhQcqq.exe
  C:\Windows\System\EFhQcqq.exe
  2⤵
  PID:3548
- C:\Windows\System\DqYdMPC.exe
  C:\Windows\System\DqYdMPC.exe
  2⤵
  PID:868
- C:\Windows\System\qYUlbai.exe
  C:\Windows\System\qYUlbai.exe
  2⤵
  PID:3208
- C:\Windows\System\csjMCqp.exe
  C:\Windows\System\csjMCqp.exe
  2⤵
  PID:1040
- C:\Windows\System\eGkaXYi.exe
  C:\Windows\System\eGkaXYi.exe
  2⤵
  PID:5136
- C:\Windows\System\ZWsVtxq.exe
  C:\Windows\System\ZWsVtxq.exe
  2⤵
  PID:5172
- C:\Windows\System\teHUOub.exe
  C:\Windows\System\teHUOub.exe
  2⤵
  PID:5192
- C:\Windows\System\FgVMCRA.exe
  C:\Windows\System\FgVMCRA.exe
  2⤵
  PID:5232
- C:\Windows\System\XufTHHA.exe
  C:\Windows\System\XufTHHA.exe
  2⤵
  PID:5264
- C:\Windows\System\yQcaVeO.exe
  C:\Windows\System\yQcaVeO.exe
  2⤵
  PID:5292
- C:\Windows\System\FRnXtFJ.exe
  C:\Windows\System\FRnXtFJ.exe
  2⤵
  PID:5316
- C:\Windows\System\lHHGxBo.exe
  C:\Windows\System\lHHGxBo.exe
  2⤵
  PID:5332
- C:\Windows\System\qHMIZPO.exe
  C:\Windows\System\qHMIZPO.exe
  2⤵
  PID:5360
- C:\Windows\System\HjukVNt.exe
  C:\Windows\System\HjukVNt.exe
  2⤵
  PID:5388
- C:\Windows\System\OHsMuOP.exe
  C:\Windows\System\OHsMuOP.exe
  2⤵
  PID:5412
- C:\Windows\System\kxTEEmy.exe
  C:\Windows\System\kxTEEmy.exe
  2⤵
  PID:5436
- C:\Windows\System\tfOBcwq.exe
  C:\Windows\System\tfOBcwq.exe
  2⤵
  PID:5472
- C:\Windows\System\sxFESIz.exe
  C:\Windows\System\sxFESIz.exe
  2⤵
  PID:5512
- C:\Windows\System\Nzouoef.exe
  C:\Windows\System\Nzouoef.exe
  2⤵
  PID:5540
- C:\Windows\System\oDEOriH.exe
  C:\Windows\System\oDEOriH.exe
  2⤵
  PID:5556
- C:\Windows\System\IYcMmBx.exe
  C:\Windows\System\IYcMmBx.exe
  2⤵
  PID:5596
- C:\Windows\System\vIxozJT.exe
  C:\Windows\System\vIxozJT.exe
  2⤵
  PID:5616
- C:\Windows\System\FywbEeK.exe
  C:\Windows\System\FywbEeK.exe
  2⤵
  PID:5656
- C:\Windows\System\eGLOokZ.exe
  C:\Windows\System\eGLOokZ.exe
  2⤵
  PID:5684
- C:\Windows\System\WOaEgaL.exe
  C:\Windows\System\WOaEgaL.exe
  2⤵
  PID:5700
- C:\Windows\System\pptlPXg.exe
  C:\Windows\System\pptlPXg.exe
  2⤵
  PID:5740
- C:\Windows\System\EMvfxNw.exe
  C:\Windows\System\EMvfxNw.exe
  2⤵
  PID:5756
- C:\Windows\System\czHqunB.exe
  C:\Windows\System\czHqunB.exe
  2⤵
  PID:5784
- C:\Windows\System\YppOFdU.exe
  C:\Windows\System\YppOFdU.exe
  2⤵
  PID:5800
- C:\Windows\System\ButpVDY.exe
  C:\Windows\System\ButpVDY.exe
  2⤵
  PID:5848
- C:\Windows\System\jYulyKz.exe
  C:\Windows\System\jYulyKz.exe
  2⤵
  PID:5872
- C:\Windows\System\ZgilTxV.exe
  C:\Windows\System\ZgilTxV.exe
  2⤵
  PID:5896
- C:\Windows\System\DIULWSv.exe
  C:\Windows\System\DIULWSv.exe
  2⤵
  PID:5924
- C:\Windows\System\dLTUTCZ.exe
  C:\Windows\System\dLTUTCZ.exe
  2⤵
  PID:5968
- C:\Windows\System\VfQHPRJ.exe
  C:\Windows\System\VfQHPRJ.exe
  2⤵
  PID:5996
- C:\Windows\System\HAKsasI.exe
  C:\Windows\System\HAKsasI.exe
  2⤵
  PID:6024
- C:\Windows\System\EHDpCvp.exe
  C:\Windows\System\EHDpCvp.exe
  2⤵
  PID:6040
- C:\Windows\System\fnzqzHj.exe
  C:\Windows\System\fnzqzHj.exe
  2⤵
  PID:6080
- C:\Windows\System\Pnsqeia.exe
  C:\Windows\System\Pnsqeia.exe
  2⤵
  PID:6100
- C:\Windows\System\JmteWNm.exe
  C:\Windows\System\JmteWNm.exe
  2⤵
  PID:6136
- C:\Windows\System\CmQqSDy.exe
  C:\Windows\System\CmQqSDy.exe
  2⤵
  PID:1628
- C:\Windows\System\qgWnlmV.exe
  C:\Windows\System\qgWnlmV.exe
  2⤵
  PID:5212
- C:\Windows\System\hofFMHT.exe
  C:\Windows\System\hofFMHT.exe
  2⤵
  PID:5284
- C:\Windows\System\YWzaHMz.exe
  C:\Windows\System\YWzaHMz.exe
  2⤵
  PID:1516
- C:\Windows\System\clsBJBi.exe
  C:\Windows\System\clsBJBi.exe
  2⤵
  PID:5372
- C:\Windows\System\cxlwEnk.exe
  C:\Windows\System\cxlwEnk.exe
  2⤵
  PID:5424
- C:\Windows\System\kPPodWx.exe
  C:\Windows\System\kPPodWx.exe
  2⤵
  PID:5504
- C:\Windows\System\dvttRUv.exe
  C:\Windows\System\dvttRUv.exe
  2⤵
  PID:5592
- C:\Windows\System\kJQNeJk.exe
  C:\Windows\System\kJQNeJk.exe
  2⤵
  PID:5672
- C:\Windows\System\UxXTSRP.exe
  C:\Windows\System\UxXTSRP.exe
  2⤵
  PID:5752
- C:\Windows\System\kXoMoBT.exe
  C:\Windows\System\kXoMoBT.exe
  2⤵
  PID:5768
- C:\Windows\System\eTkPNZm.exe
  C:\Windows\System\eTkPNZm.exe
  2⤵
  PID:5884
- C:\Windows\System\hWsEYoa.exe
  C:\Windows\System\hWsEYoa.exe
  2⤵
  PID:5936
- C:\Windows\System\zGtAHiv.exe
  C:\Windows\System\zGtAHiv.exe
  2⤵
  PID:5980
- C:\Windows\System\voyXuyH.exe
  C:\Windows\System\voyXuyH.exe
  2⤵
  PID:5960
- C:\Windows\System\fQApVwW.exe
  C:\Windows\System\fQApVwW.exe
  2⤵
  PID:6068
- C:\Windows\System\ZWbKipa.exe
  C:\Windows\System\ZWbKipa.exe
  2⤵
  PID:5184
- C:\Windows\System\doNunxe.exe
  C:\Windows\System\doNunxe.exe
  2⤵
  PID:5352
- C:\Windows\System\XJetWra.exe
  C:\Windows\System\XJetWra.exe
  2⤵
  PID:5404
- C:\Windows\System\YhywnHp.exe
  C:\Windows\System\YhywnHp.exe
  2⤵
  PID:5496
- C:\Windows\System\vrTxlSQ.exe
  C:\Windows\System\vrTxlSQ.exe
  2⤵
  PID:5712
- C:\Windows\System\uoujSfG.exe
  C:\Windows\System\uoujSfG.exe
  2⤵
  PID:5956
- C:\Windows\System\RQSipwb.exe
  C:\Windows\System\RQSipwb.exe
  2⤵
  PID:6092
- C:\Windows\System\TUtlMTN.exe
  C:\Windows\System\TUtlMTN.exe
  2⤵
  PID:3552
- C:\Windows\System\aQlfCHF.exe
  C:\Windows\System\aQlfCHF.exe
  2⤵
  PID:5464
- C:\Windows\System\MDlUYKl.exe
  C:\Windows\System\MDlUYKl.exe
  2⤵
  PID:6036
- C:\Windows\System\rpMWYAr.exe
  C:\Windows\System\rpMWYAr.exe
  2⤵
  PID:5308
- C:\Windows\System\zObGiLZ.exe
  C:\Windows\System\zObGiLZ.exe
  2⤵
  PID:5024
- C:\Windows\System\rNSWtRn.exe
  C:\Windows\System\rNSWtRn.exe
  2⤵
  PID:6152
- C:\Windows\System\GTezRcO.exe
  C:\Windows\System\GTezRcO.exe
  2⤵
  PID:6172
- C:\Windows\System\CDDocKe.exe
  C:\Windows\System\CDDocKe.exe
  2⤵
  PID:6208
- C:\Windows\System\ysTFuTl.exe
  C:\Windows\System\ysTFuTl.exe
  2⤵
  PID:6236
- C:\Windows\System\YqbCCDc.exe
  C:\Windows\System\YqbCCDc.exe
  2⤵
  PID:6268
- C:\Windows\System\HIEyVGy.exe
  C:\Windows\System\HIEyVGy.exe
  2⤵
  PID:6292
- C:\Windows\System\RMsZprR.exe
  C:\Windows\System\RMsZprR.exe
  2⤵
  PID:6308
- C:\Windows\System\nCpkbEr.exe
  C:\Windows\System\nCpkbEr.exe
  2⤵
  PID:6336
- C:\Windows\System\UseowoA.exe
  C:\Windows\System\UseowoA.exe
  2⤵
  PID:6376
- C:\Windows\System\hDlSQVn.exe
  C:\Windows\System\hDlSQVn.exe
  2⤵
  PID:6404
- C:\Windows\System\EIVvskh.exe
  C:\Windows\System\EIVvskh.exe
  2⤵
  PID:6420
- C:\Windows\System\HVhgMqp.exe
  C:\Windows\System\HVhgMqp.exe
  2⤵
  PID:6436
- C:\Windows\System\pSDMPdh.exe
  C:\Windows\System\pSDMPdh.exe
  2⤵
  PID:6480
- C:\Windows\System\CCeYunR.exe
  C:\Windows\System\CCeYunR.exe
  2⤵
  PID:6516
- C:\Windows\System\FFyVXdF.exe
  C:\Windows\System\FFyVXdF.exe
  2⤵
  PID:6532
- C:\Windows\System\CfSWgsE.exe
  C:\Windows\System\CfSWgsE.exe
  2⤵
  PID:6572
- C:\Windows\System\ajuRhHQ.exe
  C:\Windows\System\ajuRhHQ.exe
  2⤵
  PID:6608
- C:\Windows\System\XYkKQMn.exe
  C:\Windows\System\XYkKQMn.exe
  2⤵
  PID:6628
- C:\Windows\System\bjQNtjv.exe
  C:\Windows\System\bjQNtjv.exe
  2⤵
  PID:6672
- C:\Windows\System\AhHzHGc.exe
  C:\Windows\System\AhHzHGc.exe
  2⤵
  PID:6712
- C:\Windows\System\ktCXYhy.exe
  C:\Windows\System\ktCXYhy.exe
  2⤵
  PID:6752
- C:\Windows\System\cCWMYxv.exe
  C:\Windows\System\cCWMYxv.exe
  2⤵
  PID:6784
- C:\Windows\System\wQMQQke.exe
  C:\Windows\System\wQMQQke.exe
  2⤵
  PID:6820
- C:\Windows\System\GtyNpun.exe
  C:\Windows\System\GtyNpun.exe
  2⤵
  PID:6844
- C:\Windows\System\CQqnCZr.exe
  C:\Windows\System\CQqnCZr.exe
  2⤵
  PID:6876
- C:\Windows\System\LPKEGBG.exe
  C:\Windows\System\LPKEGBG.exe
  2⤵
  PID:6904
- C:\Windows\System\uSrmhVb.exe
  C:\Windows\System\uSrmhVb.exe
  2⤵
  PID:6928
- C:\Windows\System\fNxAKUo.exe
  C:\Windows\System\fNxAKUo.exe
  2⤵
  PID:6956
- C:\Windows\System\IJYgAyE.exe
  C:\Windows\System\IJYgAyE.exe
  2⤵
  PID:6988
- C:\Windows\System\mOVAsxj.exe
  C:\Windows\System\mOVAsxj.exe
  2⤵
  PID:7016
- C:\Windows\System\vvCSrrZ.exe
  C:\Windows\System\vvCSrrZ.exe
  2⤵
  PID:7048
- C:\Windows\System\faIvEBj.exe
  C:\Windows\System\faIvEBj.exe
  2⤵
  PID:7076
- C:\Windows\System\dhCWGrs.exe
  C:\Windows\System\dhCWGrs.exe
  2⤵
  PID:7112
- C:\Windows\System\EOlDTQb.exe
  C:\Windows\System\EOlDTQb.exe
  2⤵
  PID:7144
- C:\Windows\System\wSlnlKQ.exe
  C:\Windows\System\wSlnlKQ.exe
  2⤵
  PID:5908
- C:\Windows\System\NCZuaFz.exe
  C:\Windows\System\NCZuaFz.exe
  2⤵
  PID:6204
- C:\Windows\System\ghaiAPq.exe
  C:\Windows\System\ghaiAPq.exe
  2⤵
  PID:6260
- C:\Windows\System\dgqOsLy.exe
  C:\Windows\System\dgqOsLy.exe
  2⤵
  PID:6320
- C:\Windows\System\pIQvsHM.exe
  C:\Windows\System\pIQvsHM.exe
  2⤵
  PID:6412
- C:\Windows\System\OahsOSL.exe
  C:\Windows\System\OahsOSL.exe
  2⤵
  PID:6472
- C:\Windows\System\pSAwfrE.exe
  C:\Windows\System\pSAwfrE.exe
  2⤵
  PID:6552
- C:\Windows\System\YxiAWkK.exe
  C:\Windows\System\YxiAWkK.exe
  2⤵
  PID:6624
- C:\Windows\System\QgbOPOm.exe
  C:\Windows\System\QgbOPOm.exe
  2⤵
  PID:6696
- C:\Windows\System\cpcejgc.exe
  C:\Windows\System\cpcejgc.exe
  2⤵
  PID:6792
- C:\Windows\System\wutfpVI.exe
  C:\Windows\System\wutfpVI.exe
  2⤵
  PID:5912
- C:\Windows\System\ONRAPMy.exe
  C:\Windows\System\ONRAPMy.exe
  2⤵
  PID:6940
- C:\Windows\System\mkMsmkx.exe
  C:\Windows\System\mkMsmkx.exe
  2⤵
  PID:6968
- C:\Windows\System\qqdRxUK.exe
  C:\Windows\System\qqdRxUK.exe
  2⤵
  PID:7036
- C:\Windows\System\IIezwFb.exe
  C:\Windows\System\IIezwFb.exe
  2⤵
  PID:7096
- C:\Windows\System\fYgrUXP.exe
  C:\Windows\System\fYgrUXP.exe
  2⤵
  PID:6160
- C:\Windows\System\xwbWVeG.exe
  C:\Windows\System\xwbWVeG.exe
  2⤵
  PID:6288
- C:\Windows\System\bznGLnh.exe
  C:\Windows\System\bznGLnh.exe
  2⤵
  PID:6456
- C:\Windows\System\RocnpcQ.exe
  C:\Windows\System\RocnpcQ.exe
  2⤵
  PID:6684
- C:\Windows\System\yWhEKcZ.exe
  C:\Windows\System\yWhEKcZ.exe
  2⤵
  PID:6836
- C:\Windows\System\Haiqyxo.exe
  C:\Windows\System\Haiqyxo.exe
  2⤵
  PID:2200
- C:\Windows\System\BQxmcws.exe
  C:\Windows\System\BQxmcws.exe
  2⤵
  PID:7072
- C:\Windows\System\kLCgOHP.exe
  C:\Windows\System\kLCgOHP.exe
  2⤵
  PID:6584
- C:\Windows\System\RwJVmWw.exe
  C:\Windows\System\RwJVmWw.exe
  2⤵
  PID:7000
- C:\Windows\System\HauKwRI.exe
  C:\Windows\System\HauKwRI.exe
  2⤵
  PID:6884
- C:\Windows\System\ZEWZcGS.exe
  C:\Windows\System\ZEWZcGS.exe
  2⤵
  PID:7180
- C:\Windows\System\nXtksBf.exe
  C:\Windows\System\nXtksBf.exe
  2⤵
  PID:7232
- C:\Windows\System\RVwkjTl.exe
  C:\Windows\System\RVwkjTl.exe
  2⤵
  PID:7268
- C:\Windows\System\adVmyez.exe
  C:\Windows\System\adVmyez.exe
  2⤵
  PID:7308
- C:\Windows\System\NccwueH.exe
  C:\Windows\System\NccwueH.exe
  2⤵
  PID:7344
- C:\Windows\System\BRGMjck.exe
  C:\Windows\System\BRGMjck.exe
  2⤵
  PID:7376
- C:\Windows\System\TzIUygA.exe
  C:\Windows\System\TzIUygA.exe
  2⤵
  PID:7404
- C:\Windows\System\jhyyBxS.exe
  C:\Windows\System\jhyyBxS.exe
  2⤵
  PID:7436
- C:\Windows\System\gEnVJQH.exe
  C:\Windows\System\gEnVJQH.exe
  2⤵
  PID:7472
- C:\Windows\System\fhaonLn.exe
  C:\Windows\System\fhaonLn.exe
  2⤵
  PID:7520
- C:\Windows\System\hMHkblj.exe
  C:\Windows\System\hMHkblj.exe
  2⤵
  PID:7544
- C:\Windows\System\ooxbKUb.exe
  C:\Windows\System\ooxbKUb.exe
  2⤵
  PID:7596
- C:\Windows\System\ZbuebUc.exe
  C:\Windows\System\ZbuebUc.exe
  2⤵
  PID:7632
- C:\Windows\System\jJeaWzK.exe
  C:\Windows\System\jJeaWzK.exe
  2⤵
  PID:7676
- C:\Windows\System\KaEvtzs.exe
  C:\Windows\System\KaEvtzs.exe
  2⤵
  PID:7708
- C:\Windows\System\GxUXCsa.exe
  C:\Windows\System\GxUXCsa.exe
  2⤵
  PID:7724
- C:\Windows\System\SddFcNo.exe
  C:\Windows\System\SddFcNo.exe
  2⤵
  PID:7748
- C:\Windows\System\NAALfbq.exe
  C:\Windows\System\NAALfbq.exe
  2⤵
  PID:7768
- C:\Windows\System\NAgGZqr.exe
  C:\Windows\System\NAgGZqr.exe
  2⤵
  PID:7820
- C:\Windows\System\cthncJq.exe
  C:\Windows\System\cthncJq.exe
  2⤵
  PID:7848
- C:\Windows\System\EpQxWEr.exe
  C:\Windows\System\EpQxWEr.exe
  2⤵
  PID:7868
- C:\Windows\System\NnNFnTb.exe
  C:\Windows\System\NnNFnTb.exe
  2⤵
  PID:7900
- C:\Windows\System\HUuBLPY.exe
  C:\Windows\System\HUuBLPY.exe
  2⤵
  PID:7936
- C:\Windows\System\ptutmmx.exe
  C:\Windows\System\ptutmmx.exe
  2⤵
  PID:7968
- C:\Windows\System\uchHJje.exe
  C:\Windows\System\uchHJje.exe
  2⤵
  PID:7992
- C:\Windows\System\yamxAlf.exe
  C:\Windows\System\yamxAlf.exe
  2⤵
  PID:8024
- C:\Windows\System\ofVoXVH.exe
  C:\Windows\System\ofVoXVH.exe
  2⤵
  PID:8064
- C:\Windows\System\ASwBYUJ.exe
  C:\Windows\System\ASwBYUJ.exe
  2⤵
  PID:8096
- C:\Windows\System\OeQEiWE.exe
  C:\Windows\System\OeQEiWE.exe
  2⤵
  PID:8132
- C:\Windows\System\NtcVroy.exe
  C:\Windows\System\NtcVroy.exe
  2⤵
  PID:8176
- C:\Windows\System\cXvQZkn.exe
  C:\Windows\System\cXvQZkn.exe
  2⤵
  PID:7216
- C:\Windows\System\rhvFsAg.exe
  C:\Windows\System\rhvFsAg.exe
  2⤵
  PID:7304
- C:\Windows\System\tnLhXlj.exe
  C:\Windows\System\tnLhXlj.exe
  2⤵
  PID:7396
- C:\Windows\System\tVMObuW.exe
  C:\Windows\System\tVMObuW.exe
  2⤵
  PID:7460
- C:\Windows\System\dWuRdBM.exe
  C:\Windows\System\dWuRdBM.exe
  2⤵
  PID:7540
- C:\Windows\System\MuYcHiI.exe
  C:\Windows\System\MuYcHiI.exe
  2⤵
  PID:7644
- C:\Windows\System\nviTrMJ.exe
  C:\Windows\System\nviTrMJ.exe
  2⤵
  PID:7720
- C:\Windows\System\DnTdqaj.exe
  C:\Windows\System\DnTdqaj.exe
  2⤵
  PID:7784
- C:\Windows\System\pjjEdCS.exe
  C:\Windows\System\pjjEdCS.exe
  2⤵
  PID:7856
- C:\Windows\System\eGZmAAV.exe
  C:\Windows\System\eGZmAAV.exe
  2⤵
  PID:7916
- C:\Windows\System\paYwYrw.exe
  C:\Windows\System\paYwYrw.exe
  2⤵
  PID:7976
- C:\Windows\System\xzkOPwv.exe
  C:\Windows\System\xzkOPwv.exe
  2⤵
  PID:8072
- C:\Windows\System\GpszCba.exe
  C:\Windows\System\GpszCba.exe
  2⤵
  PID:8160
- C:\Windows\System\vexNqbP.exe
  C:\Windows\System\vexNqbP.exe
  2⤵
  PID:7284
- C:\Windows\System\QIOFCcl.exe
  C:\Windows\System\QIOFCcl.exe
  2⤵
  PID:7064
- C:\Windows\System\ukbRVve.exe
  C:\Windows\System\ukbRVve.exe
  2⤵
  PID:7684
- C:\Windows\System\fjUrVmd.exe
  C:\Windows\System\fjUrVmd.exe
  2⤵
  PID:7836
- C:\Windows\System\pWdekAs.exe
  C:\Windows\System\pWdekAs.exe
  2⤵
  PID:7964
- C:\Windows\System\wnVdYGF.exe
  C:\Windows\System\wnVdYGF.exe
  2⤵
  PID:8188
- C:\Windows\System\cBuutpG.exe
  C:\Windows\System\cBuutpG.exe
  2⤵
  PID:7616
- C:\Windows\System\RRtDfNG.exe
  C:\Windows\System\RRtDfNG.exe
  2⤵
  PID:7984
- C:\Windows\System\CIosJAQ.exe
  C:\Windows\System\CIosJAQ.exe
  2⤵
  PID:7896
- C:\Windows\System\tTxWaLg.exe
  C:\Windows\System\tTxWaLg.exe
  2⤵
  PID:8200
- C:\Windows\System\jOXzIYs.exe
  C:\Windows\System\jOXzIYs.exe
  2⤵
  PID:8228
- C:\Windows\System\roHgPZN.exe
  C:\Windows\System\roHgPZN.exe
  2⤵
  PID:8256
- C:\Windows\System\MIaqQRu.exe
  C:\Windows\System\MIaqQRu.exe
  2⤵
  PID:8272
- C:\Windows\System\ALlwxxj.exe
  C:\Windows\System\ALlwxxj.exe
  2⤵
  PID:8292
- C:\Windows\System\oxuTEoY.exe
  C:\Windows\System\oxuTEoY.exe
  2⤵
  PID:8328
- C:\Windows\System\lgrjNKt.exe
  C:\Windows\System\lgrjNKt.exe
  2⤵
  PID:8388
- C:\Windows\System\eRafvTZ.exe
  C:\Windows\System\eRafvTZ.exe
  2⤵
  PID:8404
- C:\Windows\System\tCwZdzC.exe
  C:\Windows\System\tCwZdzC.exe
  2⤵
  PID:8432
- C:\Windows\System\tMERTLy.exe
  C:\Windows\System\tMERTLy.exe
  2⤵
  PID:8464
- C:\Windows\System\sAoWjok.exe
  C:\Windows\System\sAoWjok.exe
  2⤵
  PID:8492
- C:\Windows\System\vhtYadk.exe
  C:\Windows\System\vhtYadk.exe
  2⤵
  PID:8532
- C:\Windows\System\kcFrzPE.exe
  C:\Windows\System\kcFrzPE.exe
  2⤵
  PID:8560
- C:\Windows\System\zYBVwMa.exe
  C:\Windows\System\zYBVwMa.exe
  2⤵
  PID:8588
- C:\Windows\System\MfaSRHt.exe
  C:\Windows\System\MfaSRHt.exe
  2⤵
  PID:8616
- C:\Windows\System\IflDSKh.exe
  C:\Windows\System\IflDSKh.exe
  2⤵
  PID:8644
- C:\Windows\System\dwoNXUY.exe
  C:\Windows\System\dwoNXUY.exe
  2⤵
  PID:8672
- C:\Windows\System\kWAYFyx.exe
  C:\Windows\System\kWAYFyx.exe
  2⤵
  PID:8700
- C:\Windows\System\UlGVoQA.exe
  C:\Windows\System\UlGVoQA.exe
  2⤵
  PID:8728
- C:\Windows\System\tzOShum.exe
  C:\Windows\System\tzOShum.exe
  2⤵
  PID:8756
- C:\Windows\System\oJJFLss.exe
  C:\Windows\System\oJJFLss.exe
  2⤵
  PID:8784
- C:\Windows\System\uGKeoIz.exe
  C:\Windows\System\uGKeoIz.exe
  2⤵
  PID:8812
- C:\Windows\System\UukHlug.exe
  C:\Windows\System\UukHlug.exe
  2⤵
  PID:8840
- C:\Windows\System\eIvRErP.exe
  C:\Windows\System\eIvRErP.exe
  2⤵
  PID:8868
- C:\Windows\System\CGETTdT.exe
  C:\Windows\System\CGETTdT.exe
  2⤵
  PID:8896
- C:\Windows\System\iPYJQlJ.exe
  C:\Windows\System\iPYJQlJ.exe
  2⤵
  PID:8924
- C:\Windows\System\CUwculy.exe
  C:\Windows\System\CUwculy.exe
  2⤵
  PID:8952
- C:\Windows\System\SDJNeYf.exe
  C:\Windows\System\SDJNeYf.exe
  2⤵
  PID:8980
- C:\Windows\System\HxsMLTI.exe
  C:\Windows\System\HxsMLTI.exe
  2⤵
  PID:9008
- C:\Windows\System\AphhsqV.exe
  C:\Windows\System\AphhsqV.exe
  2⤵
  PID:9036
- C:\Windows\System\Bvpqzmd.exe
  C:\Windows\System\Bvpqzmd.exe
  2⤵
  PID:9064
- C:\Windows\System\aUHVyNY.exe
  C:\Windows\System\aUHVyNY.exe
  2⤵
  PID:9092
- C:\Windows\System\sSXsyfA.exe
  C:\Windows\System\sSXsyfA.exe
  2⤵
  PID:9120
- C:\Windows\System\qErxAWa.exe
  C:\Windows\System\qErxAWa.exe
  2⤵
  PID:9148
- C:\Windows\System\uRtWqoj.exe
  C:\Windows\System\uRtWqoj.exe
  2⤵
  PID:9176
- C:\Windows\System\Jwaeeoi.exe
  C:\Windows\System\Jwaeeoi.exe
  2⤵
  PID:9204
- C:\Windows\System\ZEyYyyV.exe
  C:\Windows\System\ZEyYyyV.exe
  2⤵
  PID:8224
- C:\Windows\System\yiyzWVG.exe
  C:\Windows\System\yiyzWVG.exe
  2⤵
  PID:8268
- C:\Windows\System\yCDyqYj.exe
  C:\Windows\System\yCDyqYj.exe
  2⤵
  PID:8360
- C:\Windows\System\bDUuuBj.exe
  C:\Windows\System\bDUuuBj.exe
  2⤵
  PID:8420
- C:\Windows\System\ydvaQDK.exe
  C:\Windows\System\ydvaQDK.exe
  2⤵
  PID:8488
- C:\Windows\System\tulhfty.exe
  C:\Windows\System\tulhfty.exe
  2⤵
  PID:8572
- C:\Windows\System\sWonlnO.exe
  C:\Windows\System\sWonlnO.exe
  2⤵
  PID:8636
- C:\Windows\System\uAtCBBk.exe
  C:\Windows\System\uAtCBBk.exe
  2⤵
  PID:8696
- C:\Windows\System\ROzwAmn.exe
  C:\Windows\System\ROzwAmn.exe
  2⤵
  PID:8768
- C:\Windows\System\FAQTfDz.exe
  C:\Windows\System\FAQTfDz.exe
  2⤵
  PID:8836
- C:\Windows\System\gjgAodO.exe
  C:\Windows\System\gjgAodO.exe
  2⤵
  PID:8892
- C:\Windows\System\sUXKNhF.exe
  C:\Windows\System\sUXKNhF.exe
  2⤵
  PID:8964
- C:\Windows\System\liVSink.exe
  C:\Windows\System\liVSink.exe
  2⤵
  PID:9028
- C:\Windows\System\DyiJIwq.exe
  C:\Windows\System\DyiJIwq.exe
  2⤵
  PID:9088
- C:\Windows\System\YSdhDJL.exe
  C:\Windows\System\YSdhDJL.exe
  2⤵
  PID:9160
- C:\Windows\System\JTqXhkX.exe
  C:\Windows\System\JTqXhkX.exe
  2⤵
  PID:8212
- C:\Windows\System\bENgewG.exe
  C:\Windows\System\bENgewG.exe
  2⤵
  PID:8340
- C:\Windows\System\eoeCvNr.exe
  C:\Windows\System\eoeCvNr.exe
  2⤵
  PID:8528
- C:\Windows\System\jeotkuf.exe
  C:\Windows\System\jeotkuf.exe
  2⤵
  PID:8684
- C:\Windows\System\dymblQU.exe
  C:\Windows\System\dymblQU.exe
  2⤵
  PID:8824
- C:\Windows\System\clYbDnl.exe
  C:\Windows\System\clYbDnl.exe
  2⤵
  PID:8992
- C:\Windows\System\UKQnGOh.exe
  C:\Windows\System\UKQnGOh.exe
  2⤵
  PID:9140
- C:\Windows\System\AtdiBcr.exe
  C:\Windows\System\AtdiBcr.exe
  2⤵
  PID:8300
- C:\Windows\System\wFhrAYd.exe
  C:\Windows\System\wFhrAYd.exe
  2⤵
  PID:8628
- C:\Windows\System\laxZpXT.exe
  C:\Windows\System\laxZpXT.exe
  2⤵
  PID:9056
- C:\Windows\System\effEXiC.exe
  C:\Windows\System\effEXiC.exe
  2⤵
  PID:8600
- C:\Windows\System\uCnDPBC.exe
  C:\Windows\System\uCnDPBC.exe
  2⤵
  PID:8476
- C:\Windows\System\ampoWtK.exe
  C:\Windows\System\ampoWtK.exe
  2⤵
  PID:9232
- C:\Windows\System\Lfazgcc.exe
  C:\Windows\System\Lfazgcc.exe
  2⤵
  PID:9260
- C:\Windows\System\cFdQmWd.exe
  C:\Windows\System\cFdQmWd.exe
  2⤵
  PID:9292
- C:\Windows\System\BfWqjkC.exe
  C:\Windows\System\BfWqjkC.exe
  2⤵
  PID:9320
- C:\Windows\System\cRLkZmK.exe
  C:\Windows\System\cRLkZmK.exe
  2⤵
  PID:9356
- C:\Windows\System\OfgMBWS.exe
  C:\Windows\System\OfgMBWS.exe
  2⤵
  PID:9396
- C:\Windows\System\OUsTQgq.exe
  C:\Windows\System\OUsTQgq.exe
  2⤵
  PID:9436
- C:\Windows\System\VCIIUeJ.exe
  C:\Windows\System\VCIIUeJ.exe
  2⤵
  PID:9468
- C:\Windows\System\BoKAhSz.exe
  C:\Windows\System\BoKAhSz.exe
  2⤵
  PID:9496
- C:\Windows\System\AXrznql.exe
  C:\Windows\System\AXrznql.exe
  2⤵
  PID:9524
- C:\Windows\System\EpLsaeZ.exe
  C:\Windows\System\EpLsaeZ.exe
  2⤵
  PID:9552
- C:\Windows\System\htvGCki.exe
  C:\Windows\System\htvGCki.exe
  2⤵
  PID:9580
- C:\Windows\System\rhKgDHd.exe
  C:\Windows\System\rhKgDHd.exe
  2⤵
  PID:9608
- C:\Windows\System\pdunumN.exe
  C:\Windows\System\pdunumN.exe
  2⤵
  PID:9636
- C:\Windows\System\OAFOUvo.exe
  C:\Windows\System\OAFOUvo.exe
  2⤵
  PID:9664
- C:\Windows\System\QCdmWmh.exe
  C:\Windows\System\QCdmWmh.exe
  2⤵
  PID:9692
- C:\Windows\System\KACSWlx.exe
  C:\Windows\System\KACSWlx.exe
  2⤵
  PID:9720
- C:\Windows\System\dmxFNDe.exe
  C:\Windows\System\dmxFNDe.exe
  2⤵
  PID:9748
- C:\Windows\System\MTwthnW.exe
  C:\Windows\System\MTwthnW.exe
  2⤵
  PID:9776
- C:\Windows\System\jCYFjtO.exe
  C:\Windows\System\jCYFjtO.exe
  2⤵
  PID:9804
- C:\Windows\System\pmZowmJ.exe
  C:\Windows\System\pmZowmJ.exe
  2⤵
  PID:9832
- C:\Windows\System\wmxMZeu.exe
  C:\Windows\System\wmxMZeu.exe
  2⤵
  PID:9860
- C:\Windows\System\wGuwXyq.exe
  C:\Windows\System\wGuwXyq.exe
  2⤵
  PID:9888
- C:\Windows\System\wLTBeqg.exe
  C:\Windows\System\wLTBeqg.exe
  2⤵
  PID:9916
- C:\Windows\System\zKcPAOh.exe
  C:\Windows\System\zKcPAOh.exe
  2⤵
  PID:9944
- C:\Windows\System\OwGYhqs.exe
  C:\Windows\System\OwGYhqs.exe
  2⤵
  PID:9972
- C:\Windows\System\vxsCstz.exe
  C:\Windows\System\vxsCstz.exe
  2⤵
  PID:10000
- C:\Windows\System\hNblBvb.exe
  C:\Windows\System\hNblBvb.exe
  2⤵
  PID:10028
- C:\Windows\System\zilVOaB.exe
  C:\Windows\System\zilVOaB.exe
  2⤵
  PID:10056
- C:\Windows\System\kvEVpTb.exe
  C:\Windows\System\kvEVpTb.exe
  2⤵
  PID:10084
- C:\Windows\System\exSTCOi.exe
  C:\Windows\System\exSTCOi.exe
  2⤵
  PID:10112
- C:\Windows\System\mqpbwKT.exe
  C:\Windows\System\mqpbwKT.exe
  2⤵
  PID:10140
- C:\Windows\System\XeCetSJ.exe
  C:\Windows\System\XeCetSJ.exe
  2⤵
  PID:10168
- C:\Windows\System\EpxvXEj.exe
  C:\Windows\System\EpxvXEj.exe
  2⤵
  PID:10208
- C:\Windows\System\rhCgsPt.exe
  C:\Windows\System\rhCgsPt.exe
  2⤵
  PID:10224
- C:\Windows\System\saoASFd.exe
  C:\Windows\System\saoASFd.exe
  2⤵
  PID:9244
- C:\Windows\System\iHwJJtA.exe
  C:\Windows\System\iHwJJtA.exe
  2⤵
  PID:9316
- C:\Windows\System\upUvKMb.exe
  C:\Windows\System\upUvKMb.exe
  2⤵
  PID:9376
- C:\Windows\System\uoeFxKL.exe
  C:\Windows\System\uoeFxKL.exe
  2⤵
  PID:9464
- C:\Windows\System\AJLyTKf.exe
  C:\Windows\System\AJLyTKf.exe
  2⤵
  PID:9536
- C:\Windows\System\FfUOtGe.exe
  C:\Windows\System\FfUOtGe.exe
  2⤵
  PID:9600
- C:\Windows\System\tbmkfIr.exe
  C:\Windows\System\tbmkfIr.exe
  2⤵
  PID:9660
- C:\Windows\System\unfvjJN.exe
  C:\Windows\System\unfvjJN.exe
  2⤵
  PID:9732
- C:\Windows\System\PrWlOPv.exe
  C:\Windows\System\PrWlOPv.exe
  2⤵
  PID:9796
- C:\Windows\System\lEAoigp.exe
  C:\Windows\System\lEAoigp.exe
  2⤵
  PID:9856
- C:\Windows\System\OulkApq.exe
  C:\Windows\System\OulkApq.exe
  2⤵
  PID:9928
- C:\Windows\System\LxoIYJl.exe
  C:\Windows\System\LxoIYJl.exe
  2⤵
  PID:9992
- C:\Windows\System\codlrXE.exe
  C:\Windows\System\codlrXE.exe
  2⤵
  PID:10052
- C:\Windows\System\TQyHlSV.exe
  C:\Windows\System\TQyHlSV.exe
  2⤵
  PID:10124
- C:\Windows\System\eogMbCK.exe
  C:\Windows\System\eogMbCK.exe
  2⤵
  PID:1020
- C:\Windows\System\sRXHmkm.exe
  C:\Windows\System\sRXHmkm.exe
  2⤵
  PID:3316
- C:\Windows\System\jwDxDgT.exe
  C:\Windows\System\jwDxDgT.exe
  2⤵
  PID:6976
- C:\Windows\System\hIaFKTl.exe
  C:\Windows\System\hIaFKTl.exe
  2⤵
  PID:3512
- C:\Windows\System\WJklTYI.exe
  C:\Windows\System\WJklTYI.exe
  2⤵
  PID:9284
- C:\Windows\System\Rrcqorw.exe
  C:\Windows\System\Rrcqorw.exe
  2⤵
  PID:9460
- C:\Windows\System\ahmZgLc.exe
  C:\Windows\System\ahmZgLc.exe
  2⤵
  PID:9628
- C:\Windows\System\hWocthb.exe
  C:\Windows\System\hWocthb.exe
  2⤵
  PID:9772
- C:\Windows\System\cASfFuH.exe
  C:\Windows\System\cASfFuH.exe
  2⤵
  PID:9912
- C:\Windows\System\IZEPywn.exe
  C:\Windows\System\IZEPywn.exe
  2⤵
  PID:10080
- C:\Windows\System\VMeISna.exe
  C:\Windows\System\VMeISna.exe
  2⤵
  PID:2312
- C:\Windows\System\DsLRwgf.exe
  C:\Windows\System\DsLRwgf.exe
  2⤵
  PID:10192
- C:\Windows\System\UqKmYLQ.exe
  C:\Windows\System\UqKmYLQ.exe
  2⤵
  PID:9520
- C:\Windows\System\MQlRJUg.exe
  C:\Windows\System\MQlRJUg.exe
  2⤵
  PID:9884
- C:\Windows\System\czPhtIO.exe
  C:\Windows\System\czPhtIO.exe
  2⤵
  PID:2880
- C:\Windows\System\JLGkXuJ.exe
  C:\Windows\System\JLGkXuJ.exe
  2⤵
  PID:9688
- C:\Windows\System\ICWPDMe.exe
  C:\Windows\System\ICWPDMe.exe
  2⤵
  PID:9420
- C:\Windows\System\KsKYQPK.exe
  C:\Windows\System\KsKYQPK.exe
  2⤵
  PID:10248
- C:\Windows\System\jdZDAbd.exe
  C:\Windows\System\jdZDAbd.exe
  2⤵
  PID:10276
- C:\Windows\System\hKKACOq.exe
  C:\Windows\System\hKKACOq.exe
  2⤵
  PID:10304
- C:\Windows\System\lMilNtV.exe
  C:\Windows\System\lMilNtV.exe
  2⤵
  PID:10332
- C:\Windows\System\DOCiuhS.exe
  C:\Windows\System\DOCiuhS.exe
  2⤵
  PID:10360
- C:\Windows\System\qBHSBRR.exe
  C:\Windows\System\qBHSBRR.exe
  2⤵
  PID:10388
- C:\Windows\System\elHAxmk.exe
  C:\Windows\System\elHAxmk.exe
  2⤵
  PID:10416
- C:\Windows\System\PmucHpD.exe
  C:\Windows\System\PmucHpD.exe
  2⤵
  PID:10444
- C:\Windows\System\QfRgxTN.exe
  C:\Windows\System\QfRgxTN.exe
  2⤵
  PID:10472
- C:\Windows\System\eePvtAW.exe
  C:\Windows\System\eePvtAW.exe
  2⤵
  PID:10496
- C:\Windows\System\VpcpXkR.exe
  C:\Windows\System\VpcpXkR.exe
  2⤵
  PID:10528
- C:\Windows\System\WbBwbVv.exe
  C:\Windows\System\WbBwbVv.exe
  2⤵
  PID:10556
- C:\Windows\System\QqtrCDf.exe
  C:\Windows\System\QqtrCDf.exe
  2⤵
  PID:10584
- C:\Windows\System\NFLHfkt.exe
  C:\Windows\System\NFLHfkt.exe
  2⤵
  PID:10612
- C:\Windows\System\qArlQSw.exe
  C:\Windows\System\qArlQSw.exe
  2⤵
  PID:10640
- C:\Windows\System\UAdqRrb.exe
  C:\Windows\System\UAdqRrb.exe
  2⤵
  PID:10668
- C:\Windows\System\BBuwEys.exe
  C:\Windows\System\BBuwEys.exe
  2⤵
  PID:10696
- C:\Windows\System\VRelUCy.exe
  C:\Windows\System\VRelUCy.exe
  2⤵
  PID:10724
- C:\Windows\System\VVyffUt.exe
  C:\Windows\System\VVyffUt.exe
  2⤵
  PID:10752
- C:\Windows\System\NRXQdDg.exe
  C:\Windows\System\NRXQdDg.exe
  2⤵
  PID:10780
- C:\Windows\System\VcKBzgP.exe
  C:\Windows\System\VcKBzgP.exe
  2⤵
  PID:10808
- C:\Windows\System\BSljmph.exe
  C:\Windows\System\BSljmph.exe
  2⤵
  PID:10836
- C:\Windows\System\nmirMmV.exe
  C:\Windows\System\nmirMmV.exe
  2⤵
  PID:10864
- C:\Windows\System\xdMIcnD.exe
  C:\Windows\System\xdMIcnD.exe
  2⤵
  PID:10892
- C:\Windows\System\WEbVTsa.exe
  C:\Windows\System\WEbVTsa.exe
  2⤵
  PID:10932
- C:\Windows\System\EUSJxzJ.exe
  C:\Windows\System\EUSJxzJ.exe
  2⤵
  PID:10948
- C:\Windows\System\dFeztSL.exe
  C:\Windows\System\dFeztSL.exe
  2⤵
  PID:10976
- C:\Windows\System\nxfIeGX.exe
  C:\Windows\System\nxfIeGX.exe
  2⤵
  PID:11004
- C:\Windows\System\vPDsFyR.exe
  C:\Windows\System\vPDsFyR.exe
  2⤵
  PID:11032
- C:\Windows\System\MmaqIMJ.exe
  C:\Windows\System\MmaqIMJ.exe
  2⤵
  PID:11060
- C:\Windows\System\MmBohII.exe
  C:\Windows\System\MmBohII.exe
  2⤵
  PID:11088
- C:\Windows\System\TrExhRM.exe
  C:\Windows\System\TrExhRM.exe
  2⤵
  PID:11116
- C:\Windows\System\VHoQDzl.exe
  C:\Windows\System\VHoQDzl.exe
  2⤵
  PID:11144
- C:\Windows\System\xxYtkWh.exe
  C:\Windows\System\xxYtkWh.exe
  2⤵
  PID:11172
- C:\Windows\System\bngtnsO.exe
  C:\Windows\System\bngtnsO.exe
  2⤵
  PID:11200
- C:\Windows\System\MehDlxK.exe
  C:\Windows\System\MehDlxK.exe
  2⤵
  PID:11228
- C:\Windows\System\RNaGVLn.exe
  C:\Windows\System\RNaGVLn.exe
  2⤵
  PID:11256
- C:\Windows\System\cooPcOP.exe
  C:\Windows\System\cooPcOP.exe
  2⤵
  PID:10288
- C:\Windows\System\upFKpMw.exe
  C:\Windows\System\upFKpMw.exe
  2⤵
  PID:10352
- C:\Windows\System\bgxtPGG.exe
  C:\Windows\System\bgxtPGG.exe
  2⤵
  PID:10412
- C:\Windows\System\hBgKRwd.exe
  C:\Windows\System\hBgKRwd.exe
  2⤵
  PID:10484
- C:\Windows\System\eazPUXX.exe
  C:\Windows\System\eazPUXX.exe
  2⤵
  PID:10544
- C:\Windows\System\hFKEqny.exe
  C:\Windows\System\hFKEqny.exe
  2⤵
  PID:10608
- C:\Windows\System\QemiDuO.exe
  C:\Windows\System\QemiDuO.exe
  2⤵
  PID:10680
- C:\Windows\System\NIMwPva.exe
  C:\Windows\System\NIMwPva.exe
  2⤵
  PID:10748
- C:\Windows\System\aKwzlkf.exe
  C:\Windows\System\aKwzlkf.exe
  2⤵
  PID:10820
- C:\Windows\System\RvgcVWe.exe
  C:\Windows\System\RvgcVWe.exe
  2⤵
  PID:10884
- C:\Windows\System\HNWCGPK.exe
  C:\Windows\System\HNWCGPK.exe
  2⤵
  PID:10944
- C:\Windows\System\mpCbPnp.exe
  C:\Windows\System\mpCbPnp.exe
  2⤵
  PID:11016
- C:\Windows\System\RlVlokE.exe
  C:\Windows\System\RlVlokE.exe
  2⤵
  PID:9576
- C:\Windows\System\KasVqJn.exe
  C:\Windows\System\KasVqJn.exe
  2⤵
  PID:11136
- C:\Windows\System\qgdArOC.exe
  C:\Windows\System\qgdArOC.exe
  2⤵
  PID:11196
- C:\Windows\System\YhqVXVY.exe
  C:\Windows\System\YhqVXVY.exe
  2⤵
  PID:10244
- C:\Windows\System\ijyXMLl.exe
  C:\Windows\System\ijyXMLl.exe
  2⤵
  PID:10400
- C:\Windows\System\pUBNKTI.exe
  C:\Windows\System\pUBNKTI.exe
  2⤵
  PID:10540
- C:\Windows\System\nDMYtmz.exe
  C:\Windows\System\nDMYtmz.exe
  2⤵
  PID:10716
- C:\Windows\System\BwVwBQW.exe
  C:\Windows\System\BwVwBQW.exe
  2⤵
  PID:10860
- C:\Windows\System\NzcSdik.exe
  C:\Windows\System\NzcSdik.exe
  2⤵
  PID:11000
- C:\Windows\System\UnYymyJ.exe
  C:\Windows\System\UnYymyJ.exe
  2⤵
  PID:11164
- C:\Windows\System\baeVzFq.exe
  C:\Windows\System\baeVzFq.exe
  2⤵
  PID:10328
- C:\Windows\System\cMqzVWk.exe
  C:\Windows\System\cMqzVWk.exe
  2⤵
  PID:10664
- C:\Windows\System\nFtFvSz.exe
  C:\Windows\System\nFtFvSz.exe
  2⤵
  PID:11072
- C:\Windows\System\bKvzZcX.exe
  C:\Windows\System\bKvzZcX.exe
  2⤵
  PID:10596
- C:\Windows\System\NLXfHmC.exe
  C:\Windows\System\NLXfHmC.exe
  2⤵
  PID:10464
- C:\Windows\System\ppRFYSU.exe
  C:\Windows\System\ppRFYSU.exe
  2⤵
  PID:11280
- C:\Windows\System\PaYsqbd.exe
  C:\Windows\System\PaYsqbd.exe
  2⤵
  PID:11308
- C:\Windows\System\MQjpZQe.exe
  C:\Windows\System\MQjpZQe.exe
  2⤵
  PID:11336
- C:\Windows\System\aWSFULk.exe
  C:\Windows\System\aWSFULk.exe
  2⤵
  PID:11364
- C:\Windows\System\XaYRMPh.exe
  C:\Windows\System\XaYRMPh.exe
  2⤵
  PID:11392
- C:\Windows\System\EBvTpCZ.exe
  C:\Windows\System\EBvTpCZ.exe
  2⤵
  PID:11420
- C:\Windows\System\PgHDFev.exe
  C:\Windows\System\PgHDFev.exe
  2⤵
  PID:11448
- C:\Windows\System\gkRuUKD.exe
  C:\Windows\System\gkRuUKD.exe
  2⤵
  PID:11484
- C:\Windows\System\lCZCnLF.exe
  C:\Windows\System\lCZCnLF.exe
  2⤵
  PID:11516
- C:\Windows\System\WpyLepN.exe
  C:\Windows\System\WpyLepN.exe
  2⤵
  PID:11552
- C:\Windows\System\gmZjigu.exe
  C:\Windows\System\gmZjigu.exe
  2⤵
  PID:11576
- C:\Windows\System\ZuOScGY.exe
  C:\Windows\System\ZuOScGY.exe
  2⤵
  PID:11608
- C:\Windows\System\CXybNgZ.exe
  C:\Windows\System\CXybNgZ.exe
  2⤵
  PID:11640
- C:\Windows\System\PqnfisB.exe
  C:\Windows\System\PqnfisB.exe
  2⤵
  PID:11664
- C:\Windows\System\CibsfrQ.exe
  C:\Windows\System\CibsfrQ.exe
  2⤵
  PID:11696
- C:\Windows\System\zcqCaoS.exe
  C:\Windows\System\zcqCaoS.exe
  2⤵
  PID:11724
- C:\Windows\System\QzjIjUV.exe
  C:\Windows\System\QzjIjUV.exe
  2⤵
  PID:11760
- C:\Windows\System\jLsVZkY.exe
  C:\Windows\System\jLsVZkY.exe
  2⤵
  PID:11796
- C:\Windows\System\LKpvoWl.exe
  C:\Windows\System\LKpvoWl.exe
  2⤵
  PID:11824
- C:\Windows\System\cTHBtmi.exe
  C:\Windows\System\cTHBtmi.exe
  2⤵
  PID:11860
- C:\Windows\System\xJGykzh.exe
  C:\Windows\System\xJGykzh.exe
  2⤵
  PID:11884
- C:\Windows\System\wJYQRWS.exe
  C:\Windows\System\wJYQRWS.exe
  2⤵
  PID:11912
- C:\Windows\System\DaHUOuk.exe
  C:\Windows\System\DaHUOuk.exe
  2⤵
  PID:11952
- C:\Windows\System\cFylUSQ.exe
  C:\Windows\System\cFylUSQ.exe
  2⤵
  PID:11996
- C:\Windows\System\dwflCRQ.exe
  C:\Windows\System\dwflCRQ.exe
  2⤵
  PID:12028
- C:\Windows\System\apmRqqK.exe
  C:\Windows\System\apmRqqK.exe
  2⤵
  PID:12064
- C:\Windows\System\EdRmnCs.exe
  C:\Windows\System\EdRmnCs.exe
  2⤵
  PID:12100
- C:\Windows\System\znwcekW.exe
  C:\Windows\System\znwcekW.exe
  2⤵
  PID:12140
- C:\Windows\System\LzRlBKC.exe
  C:\Windows\System\LzRlBKC.exe
  2⤵
  PID:12180
- C:\Windows\System\XihWLVj.exe
  C:\Windows\System\XihWLVj.exe
  2⤵
  PID:12200
- C:\Windows\System\nhjcKuM.exe
  C:\Windows\System\nhjcKuM.exe
  2⤵
  PID:12224
- C:\Windows\System\BrjnTbk.exe
  C:\Windows\System\BrjnTbk.exe
  2⤵
  PID:12260
- C:\Windows\System\haQiFOA.exe
  C:\Windows\System\haQiFOA.exe
  2⤵
  PID:12280
- C:\Windows\System\tXvRnRv.exe
  C:\Windows\System\tXvRnRv.exe
  2⤵
  PID:11292
- C:\Windows\System\XnPHQqk.exe
  C:\Windows\System\XnPHQqk.exe
  2⤵
  PID:11384
- C:\Windows\System\TQwdsAB.exe
  C:\Windows\System\TQwdsAB.exe
  2⤵
  PID:11440
- C:\Windows\System\PJOjuBU.exe
  C:\Windows\System\PJOjuBU.exe
  2⤵
  PID:11540
- C:\Windows\System\kRYusdL.exe
  C:\Windows\System\kRYusdL.exe
  2⤵
  PID:11572
- C:\Windows\System\WCmtmPk.exe
  C:\Windows\System\WCmtmPk.exe
  2⤵
  PID:11684
- C:\Windows\System\cbYmlsT.exe
  C:\Windows\System\cbYmlsT.exe
  2⤵
  PID:11812
- C:\Windows\System\wUDumxZ.exe
  C:\Windows\System\wUDumxZ.exe
  2⤵
  PID:11792
- C:\Windows\System\rlplDEw.exe
  C:\Windows\System\rlplDEw.exe
  2⤵
  PID:11908
- C:\Windows\System\OiSuAEy.exe
  C:\Windows\System\OiSuAEy.exe
  2⤵
  PID:11976
- C:\Windows\System\cHMZNPW.exe
  C:\Windows\System\cHMZNPW.exe
  2⤵
  PID:12056
- C:\Windows\System\ePRkOmt.exe
  C:\Windows\System\ePRkOmt.exe
  2⤵
  PID:10692
- C:\Windows\System\EJRXezp.exe
  C:\Windows\System\EJRXezp.exe
  2⤵
  PID:12236
- C:\Windows\System\iNbpaAR.exe
  C:\Windows\System\iNbpaAR.exe
  2⤵
  PID:11416
- C:\Windows\System\bEJUpXk.exe
  C:\Windows\System\bEJUpXk.exe
  2⤵
  PID:11480
- C:\Windows\System\sCkQnIQ.exe
  C:\Windows\System\sCkQnIQ.exe
  2⤵
  PID:11712
- C:\Windows\System\qMzxaMf.exe
  C:\Windows\System\qMzxaMf.exe
  2⤵
  PID:11752
- C:\Windows\System\kAMWZKZ.exe
  C:\Windows\System\kAMWZKZ.exe
  2⤵
  PID:12172
- C:\Windows\System\PThweXI.exe
  C:\Windows\System\PThweXI.exe
  2⤵
  PID:11272
- C:\Windows\System\pxoPiZS.exe
  C:\Windows\System\pxoPiZS.exe
  2⤵
  PID:11560
- C:\Windows\System\nXJKmmO.exe
  C:\Windows\System\nXJKmmO.exe
  2⤵
  PID:12048
- C:\Windows\System\soLZoCw.exe
  C:\Windows\System\soLZoCw.exe
  2⤵
  PID:11500
- C:\Windows\System\ZTCgFDO.exe
  C:\Windows\System\ZTCgFDO.exe
  2⤵
  PID:11744
- C:\Windows\System\KwkjTbt.exe
  C:\Windows\System\KwkjTbt.exe
  2⤵
  PID:12316
- C:\Windows\System\FgxcEjE.exe
  C:\Windows\System\FgxcEjE.exe
  2⤵
  PID:12344
- C:\Windows\System\eMmUwye.exe
  C:\Windows\System\eMmUwye.exe
  2⤵
  PID:12372
- C:\Windows\System\MLwuhGo.exe
  C:\Windows\System\MLwuhGo.exe
  2⤵
  PID:12400
- C:\Windows\System\caYwaFz.exe
  C:\Windows\System\caYwaFz.exe
  2⤵
  PID:12428
- C:\Windows\System\agaqEiL.exe
  C:\Windows\System\agaqEiL.exe
  2⤵
  PID:12456
- C:\Windows\System\MBXNtyL.exe
  C:\Windows\System\MBXNtyL.exe
  2⤵
  PID:12484
- C:\Windows\System\EbUDlwJ.exe
  C:\Windows\System\EbUDlwJ.exe
  2⤵
  PID:12512
- C:\Windows\System\RWunkUp.exe
  C:\Windows\System\RWunkUp.exe
  2⤵
  PID:12540
- C:\Windows\System\vxMYODk.exe
  C:\Windows\System\vxMYODk.exe
  2⤵
  PID:12568
- C:\Windows\System\zPHUsJu.exe
  C:\Windows\System\zPHUsJu.exe
  2⤵
  PID:12596
- C:\Windows\System\nMQlOrP.exe
  C:\Windows\System\nMQlOrP.exe
  2⤵
  PID:12624
- C:\Windows\System\jtXLoBJ.exe
  C:\Windows\System\jtXLoBJ.exe
  2⤵
  PID:12652
- C:\Windows\System\sGmoBaN.exe
  C:\Windows\System\sGmoBaN.exe
  2⤵
  PID:12680
- C:\Windows\System\DXcfjHg.exe
  C:\Windows\System\DXcfjHg.exe
  2⤵
  PID:12708
- C:\Windows\System\hEQOeuh.exe
  C:\Windows\System\hEQOeuh.exe
  2⤵
  PID:12736
- C:\Windows\System\PVLSsSE.exe
  C:\Windows\System\PVLSsSE.exe
  2⤵
  PID:12768
- C:\Windows\System\BOKanSl.exe
  C:\Windows\System\BOKanSl.exe
  2⤵
  PID:12796
- C:\Windows\System\cQgYZuf.exe
  C:\Windows\System\cQgYZuf.exe
  2⤵
  PID:12824
- C:\Windows\System\FByWPJW.exe
  C:\Windows\System\FByWPJW.exe
  2⤵
  PID:12848
- C:\Windows\System\rHqbhJJ.exe
  C:\Windows\System\rHqbhJJ.exe
  2⤵
  PID:12880
- C:\Windows\System\avhnZSK.exe
  C:\Windows\System\avhnZSK.exe
  2⤵
  PID:12908
- C:\Windows\System\lLcbzRS.exe
  C:\Windows\System\lLcbzRS.exe
  2⤵
  PID:12936
- C:\Windows\System\cSXpjpr.exe
  C:\Windows\System\cSXpjpr.exe
  2⤵
  PID:12956
- C:\Windows\System\HuxqIdb.exe
  C:\Windows\System\HuxqIdb.exe
  2⤵
  PID:12980
- C:\Windows\System\HQaAkjh.exe
  C:\Windows\System\HQaAkjh.exe
  2⤵
  PID:13012
- C:\Windows\System\GeqGFNi.exe
  C:\Windows\System\GeqGFNi.exe
  2⤵
  PID:13036
- C:\Windows\System\UzixwII.exe
  C:\Windows\System\UzixwII.exe
  2⤵
  PID:13076
- C:\Windows\System\gBzeayy.exe
  C:\Windows\System\gBzeayy.exe
  2⤵
  PID:13104
- C:\Windows\System\LVlKrGL.exe
  C:\Windows\System\LVlKrGL.exe
  2⤵
  PID:13132
- C:\Windows\System\NQFMJPE.exe
  C:\Windows\System\NQFMJPE.exe
  2⤵
  PID:13160
- C:\Windows\System\tzQMJJY.exe
  C:\Windows\System\tzQMJJY.exe
  2⤵
  PID:13188
- C:\Windows\System\tICvcaX.exe
  C:\Windows\System\tICvcaX.exe
  2⤵
  PID:13216
- C:\Windows\System\zbtUMZD.exe
  C:\Windows\System\zbtUMZD.exe
  2⤵
  PID:12700
- C:\Windows\System\lXyjQPP.exe
  C:\Windows\System\lXyjQPP.exe
  2⤵
  PID:12732
- C:\Windows\System\kArYBAz.exe
  C:\Windows\System\kArYBAz.exe
  2⤵
  PID:12744
- C:\Windows\System\NVomRxf.exe
  C:\Windows\System\NVomRxf.exe
  2⤵
  PID:12832
- C:\Windows\System\KtirKWg.exe
  C:\Windows\System\KtirKWg.exe
  2⤵
  PID:12868
- C:\Windows\System\qXlfEzn.exe
  C:\Windows\System\qXlfEzn.exe
  2⤵
  PID:12992
- C:\Windows\System\ZdLSwtP.exe
  C:\Windows\System\ZdLSwtP.exe
  2⤵
  PID:13064
- C:\Windows\System\ZcDZGTk.exe
  C:\Windows\System\ZcDZGTk.exe
  2⤵
  PID:13144
- C:\Windows\System\SVNWeoD.exe
  C:\Windows\System\SVNWeoD.exe
  2⤵
  PID:13200
- C:\Windows\System\ryjyVEM.exe
  C:\Windows\System\ryjyVEM.exe
  2⤵
  PID:13260
- C:\Windows\System\CWZgpuS.exe
  C:\Windows\System\CWZgpuS.exe
  2⤵
  PID:13288
- C:\Windows\System\RMHCVsF.exe
  C:\Windows\System\RMHCVsF.exe
  2⤵
  PID:12820
- C:\Windows\System\IbhVjjG.exe
  C:\Windows\System\IbhVjjG.exe
  2⤵
  PID:7464
- C:\Windows\System\YWpsUAY.exe
  C:\Windows\System\YWpsUAY.exe
  2⤵
  PID:12476
- C:\Windows\System\bHBLmFp.exe
  C:\Windows\System\bHBLmFp.exe
  2⤵
  PID:12532
- C:\Windows\System\VyOYuXf.exe
  C:\Windows\System\VyOYuXf.exe
  2⤵
  PID:12592
- C:\Windows\System\rEzPZfL.exe
  C:\Windows\System\rEzPZfL.exe
  2⤵
  PID:12672
- C:\Windows\System\tgFfiNn.exe
  C:\Windows\System\tgFfiNn.exe
  2⤵
  PID:12760
- C:\Windows\System\rSqjjkN.exe
  C:\Windows\System\rSqjjkN.exe
  2⤵
  PID:3240
- C:\Windows\System\fBVQSUz.exe
  C:\Windows\System\fBVQSUz.exe
  2⤵
  PID:13056
- C:\Windows\System\uXIjZLR.exe
  C:\Windows\System\uXIjZLR.exe
  2⤵
  PID:1984
- C:\Windows\System\UOfNgIr.exe
  C:\Windows\System\UOfNgIr.exe
  2⤵
  PID:1688
- C:\Windows\System\LFJEaQr.exe
  C:\Windows\System\LFJEaQr.exe
  2⤵
  PID:12356
- C:\Windows\System\qqaowdj.exe
  C:\Windows\System\qqaowdj.exe
  2⤵
  PID:6748
- C:\Windows\System\rdiGepx.exe
  C:\Windows\System\rdiGepx.exe
  2⤵
  PID:12384
- C:\Windows\System\LfNyzMP.exe
  C:\Windows\System\LfNyzMP.exe
  2⤵
  PID:13172
- C:\Windows\System\ijqiEtK.exe
  C:\Windows\System\ijqiEtK.exe
  2⤵
  PID:12552
- C:\Windows\System\ZOhAeqn.exe
  C:\Windows\System\ZOhAeqn.exe
  2⤵
  PID:12720
- C:\Windows\System\oqitoRa.exe
  C:\Windows\System\oqitoRa.exe
  2⤵
  PID:13248
- C:\Windows\System\PeAxjqt.exe
  C:\Windows\System\PeAxjqt.exe
  2⤵
  PID:6248
- C:\Windows\System\fNwvCEG.exe
  C:\Windows\System\fNwvCEG.exe
  2⤵
  PID:6660
- C:\Windows\System\MLpXomj.exe
  C:\Windows\System\MLpXomj.exe
  2⤵
  PID:12424
- C:\Windows\System\pJODZvm.exe
  C:\Windows\System\pJODZvm.exe
  2⤵
  PID:13308
- C:\Windows\System\gCfXKnH.exe
  C:\Windows\System\gCfXKnH.exe
  2⤵
  PID:12336
- C:\Windows\System\dSxmCQX.exe
  C:\Windows\System\dSxmCQX.exe
  2⤵
  PID:13268
- C:\Windows\System\vCepRCd.exe
  C:\Windows\System\vCepRCd.exe
  2⤵
  PID:13228
- C:\Windows\System\EUjHFSL.exe
  C:\Windows\System\EUjHFSL.exe
  2⤵
  PID:2852
- C:\Windows\System\sTbRoIR.exe
  C:\Windows\System\sTbRoIR.exe
  2⤵
  PID:2284
- C:\Windows\System\WCnRSHq.exe
  C:\Windows\System\WCnRSHq.exe
  2⤵
  PID:12816
- C:\Windows\System\JoivfUC.exe
  C:\Windows\System\JoivfUC.exe
  2⤵
  PID:13280
- C:\Windows\System\lDBacXa.exe
  C:\Windows\System\lDBacXa.exe
  2⤵
  PID:2268
- C:\Windows\System\oTCNsyk.exe
  C:\Windows\System\oTCNsyk.exe
  2⤵
  PID:2180
- C:\Windows\System\SsucXyn.exe
  C:\Windows\System\SsucXyn.exe
  2⤵
  PID:6736
- C:\Windows\System\AQAXYPr.exe
  C:\Windows\System\AQAXYPr.exe
  2⤵
  PID:12496
- C:\Windows\System\BQJBqNT.exe
  C:\Windows\System\BQJBqNT.exe
  2⤵
  PID:4012
- C:\Windows\System\sstbvHV.exe
  C:\Windows\System\sstbvHV.exe
  2⤵
  PID:12220
- C:\Windows\System\Wrqncqx.exe
  C:\Windows\System\Wrqncqx.exe
  2⤵
  PID:2124
- C:\Windows\System\aAHdgmO.exe
  C:\Windows\System\aAHdgmO.exe
  2⤵
  PID:3536
- C:\Windows\System\LtJvxMv.exe
  C:\Windows\System\LtJvxMv.exe
  2⤵
  PID:812
- C:\Windows\System\NwFwmqi.exe
  C:\Windows\System\NwFwmqi.exe
  2⤵
  PID:4720
- C:\Windows\System\gYRAxLW.exe
  C:\Windows\System\gYRAxLW.exe
  2⤵
  PID:3272
- C:\Windows\System\oghIgJS.exe
  C:\Windows\System\oghIgJS.exe
  2⤵
  PID:12088
- C:\Windows\System\uYENRdk.exe
  C:\Windows\System\uYENRdk.exe
  2⤵
  PID:6580
- C:\Windows\System\uwbuWzY.exe
  C:\Windows\System\uwbuWzY.exe
  2⤵
  PID:2076
- C:\Windows\System\Flkeeir.exe
  C:\Windows\System\Flkeeir.exe
  2⤵
  PID:5844
- C:\Windows\System\KopHuGY.exe
  C:\Windows\System\KopHuGY.exe
  2⤵
  PID:5640
- C:\Windows\System\voIAQHR.exe
  C:\Windows\System\voIAQHR.exe
  2⤵
  PID:7256
- C:\Windows\System\VSseBDc.exe
  C:\Windows\System\VSseBDc.exe
  2⤵
  PID:7800
- C:\Windows\System\qFHTLnu.exe
  C:\Windows\System\qFHTLnu.exe
  2⤵
  PID:7744
- C:\Windows\System\mQtvHpd.exe
  C:\Windows\System\mQtvHpd.exe
  2⤵
  PID:5144
- C:\Windows\System\FZHKKyL.exe
  C:\Windows\System\FZHKKyL.exe
  2⤵
  PID:6124
- C:\Windows\System\CzZpTbt.exe
  C:\Windows\System\CzZpTbt.exe
  2⤵
  PID:5208
- C:\Windows\System\bxiBHgC.exe
  C:\Windows\System\bxiBHgC.exe
  2⤵
  PID:2836
- C:\Windows\System\yKIGFvc.exe
  C:\Windows\System\yKIGFvc.exe
  2⤵
  PID:1512
- C:\Windows\System\GYMJTQF.exe
  C:\Windows\System\GYMJTQF.exe
  2⤵
  PID:5252
- C:\Windows\System\RuEqnUj.exe
  C:\Windows\System\RuEqnUj.exe
  2⤵
  PID:5776
- C:\Windows\System\onHRmsI.exe
  C:\Windows\System\onHRmsI.exe
  2⤵
  PID:5260
- C:\Windows\System\VkjuoSE.exe
  C:\Windows\System\VkjuoSE.exe
  2⤵
  PID:5444
- C:\Windows\System\enIseUU.exe
  C:\Windows\System\enIseUU.exe
  2⤵
  PID:8508
- C:\Windows\System\HYDyXyc.exe
  C:\Windows\System\HYDyXyc.exe
  2⤵
  PID:8848
- C:\Windows\System\EnKnyIw.exe
  C:\Windows\System\EnKnyIw.exe
  2⤵
  PID:5500
- C:\Windows\System\HehYiXV.exe
  C:\Windows\System\HehYiXV.exe
  2⤵
  PID:9272
- C:\Windows\System\yrBEyhi.exe
  C:\Windows\System\yrBEyhi.exe
  2⤵
  PID:8248
- C:\Windows\System\IrKzviu.exe
  C:\Windows\System\IrKzviu.exe
  2⤵
  PID:8312
- C:\Windows\System\QXtKYzo.exe
  C:\Windows\System\QXtKYzo.exe
  2⤵
  PID:10256
- C:\Windows\System\oBrmjAE.exe
  C:\Windows\System\oBrmjAE.exe
  2⤵
  PID:10284
- C:\Windows\System\oaEKmLD.exe
  C:\Windows\System\oaEKmLD.exe
  2⤵
  PID:6452
- C:\Windows\System\CRkbyTo.exe
  C:\Windows\System\CRkbyTo.exe
  2⤵
  PID:8544
- C:\Windows\System\ocvKgOD.exe
  C:\Windows\System\ocvKgOD.exe
  2⤵
  PID:5148
- C:\Windows\System\dglHzMa.exe
  C:\Windows\System\dglHzMa.exe
  2⤵
  PID:8608
- C:\Windows\System\nPszhZD.exe
  C:\Windows\System\nPszhZD.exe
  2⤵
  PID:1356
- C:\Windows\System\nahcQZL.exe
  C:\Windows\System\nahcQZL.exe
  2⤵
  PID:896
- C:\Windows\System\KAOJdHu.exe
  C:\Windows\System\KAOJdHu.exe
  2⤵
  PID:3304
- C:\Windows\System\MlEBZTi.exe
  C:\Windows\System\MlEBZTi.exe
  2⤵
  PID:3308
- C:\Windows\System\pLFHqsU.exe
  C:\Windows\System\pLFHqsU.exe
  2⤵
  PID:8796
- C:\Windows\System\yQsDuEQ.exe
  C:\Windows\System\yQsDuEQ.exe
  2⤵
  PID:10508
- C:\Windows\System\BukDgJO.exe
  C:\Windows\System\BukDgJO.exe
  2⤵
  PID:10536
- C:\Windows\System\eveirQQ.exe
  C:\Windows\System\eveirQQ.exe
  2⤵
  PID:6828
- C:\Windows\System\ApdXulM.exe
  C:\Windows\System\ApdXulM.exe
  2⤵
  PID:6188
- C:\Windows\System\jfuZBcv.exe
  C:\Windows\System\jfuZBcv.exe
  2⤵
  PID:9000
- C:\Windows\System\upvJifk.exe
  C:\Windows\System\upvJifk.exe
  2⤵
  PID:9048
- C:\Windows\System\QjagaXb.exe
  C:\Windows\System\QjagaXb.exe
  2⤵
  PID:7240
- C:\Windows\System\JANmqNT.exe
  C:\Windows\System\JANmqNT.exe
  2⤵
  PID:10676
- C:\Windows\System\HUOwHjA.exe
  C:\Windows\System\HUOwHjA.exe
  2⤵
  PID:9172
- C:\Windows\System\PIhkxMy.exe
  C:\Windows\System\PIhkxMy.exe
  2⤵
  PID:7452
- C:\Windows\System\KHsWNzM.exe
  C:\Windows\System\KHsWNzM.exe
  2⤵
  PID:7516
- C:\Windows\System\ATIFiZs.exe
  C:\Windows\System\ATIFiZs.exe
  2⤵
  PID:7620
- C:\Windows\System\ZITPRqD.exe
  C:\Windows\System\ZITPRqD.exe
  2⤵
  PID:7640
- C:\Windows\System\aAQFyBK.exe
  C:\Windows\System\aAQFyBK.exe
  2⤵
  PID:7832
- C:\Windows\System\lJLevDi.exe
  C:\Windows\System\lJLevDi.exe
  2⤵
  PID:10872
- C:\Windows\System\LkOVwQt.exe
  C:\Windows\System\LkOVwQt.exe
  2⤵
  PID:8752
- C:\Windows\System\OghqqQf.exe
  C:\Windows\System\OghqqQf.exe
  2⤵
  PID:9020
- C:\Windows\System\jZcBgim.exe
  C:\Windows\System\jZcBgim.exe
  2⤵
  PID:8076
- C:\Windows\System\KddnEGV.exe
  C:\Windows\System\KddnEGV.exe
  2⤵
  PID:9200
- C:\Windows\System\TKciTmR.exe
  C:\Windows\System\TKciTmR.exe
  2⤵
  PID:7328
- C:\Windows\System\GxGfsLS.exe
  C:\Windows\System\GxGfsLS.exe
  2⤵
  PID:7448
- C:\Windows\System\UQRBogZ.exe
  C:\Windows\System\UQRBogZ.exe
  2⤵
  PID:7740
- C:\Windows\System\xkuOcEl.exe
  C:\Windows\System\xkuOcEl.exe
  2⤵
  PID:7536
- C:\Windows\System\AfKDmgv.exe
  C:\Windows\System\AfKDmgv.exe
  2⤵
  PID:8052
- C:\Windows\System\jVwiRgA.exe
  C:\Windows\System\jVwiRgA.exe
  2⤵
  PID:11048
- C:\Windows\System\tQEBuph.exe
  C:\Windows\System\tQEBuph.exe
  2⤵
  PID:9240
- C:\Windows\System\zpnByNP.exe
  C:\Windows\System\zpnByNP.exe
  2⤵
  PID:7760
- C:\Windows\System\RDscBSq.exe
  C:\Windows\System\RDscBSq.exe
  2⤵
  PID:11132
- C:\Windows\System\nLuoPzU.exe
  C:\Windows\System\nLuoPzU.exe
  2⤵
  PID:7764
- C:\Windows\System\OHXgGcY.exe
  C:\Windows\System\OHXgGcY.exe
  2⤵
  PID:1608
- C:\Windows\System\XsNdzkr.exe
  C:\Windows\System\XsNdzkr.exe
  2⤵
  PID:5576
- C:\Windows\System\CKGJuJr.exe
  C:\Windows\System\CKGJuJr.exe
  2⤵
  PID:6112
- C:\Windows\System\EUspKgo.exe
  C:\Windows\System\EUspKgo.exe
  2⤵
  PID:8324
- C:\Windows\System\lLMayps.exe
  C:\Windows\System\lLMayps.exe
  2⤵
  PID:3424
- C:\Windows\System\fhkDntj.exe
  C:\Windows\System\fhkDntj.exe
  2⤵
  PID:2032
- C:\Windows\System\OuxOZry.exe
  C:\Windows\System\OuxOZry.exe
  2⤵
  PID:6644
- C:\Windows\System\gNptwDz.exe
  C:\Windows\System\gNptwDz.exe
  2⤵
  PID:9540
- C:\Windows\System\AXsfcCR.exe
  C:\Windows\System\AXsfcCR.exe
  2⤵
  PID:5040
- C:\Windows\System\RjaSiiW.exe
  C:\Windows\System\RjaSiiW.exe
  2⤵
  PID:1208
- C:\Windows\System\XfipXTk.exe
  C:\Windows\System\XfipXTk.exe
  2⤵
  PID:10632
- C:\Windows\System\euSziXC.exe
  C:\Windows\System\euSziXC.exe
  2⤵
  PID:9624
- C:\Windows\System\GmRUvSx.exe
  C:\Windows\System\GmRUvSx.exe
  2⤵
  PID:6760
- C:\Windows\System\WArKFKK.exe
  C:\Windows\System\WArKFKK.exe
  2⤵
  PID:2484
- C:\Windows\System\SVQGgeY.exe
  C:\Windows\System\SVQGgeY.exe
  2⤵
  PID:10928
- C:\Windows\System\xRFsDxX.exe
  C:\Windows\System\xRFsDxX.exe
  2⤵
  PID:10988
- C:\Windows\System\dqeGGQH.exe
  C:\Windows\System\dqeGGQH.exe
  2⤵
  PID:6060
- C:\Windows\System\gcGiYOh.exe
  C:\Windows\System\gcGiYOh.exe
  2⤵
  PID:9820
- C:\Windows\System\JFdnZek.exe
  C:\Windows\System\JFdnZek.exe
  2⤵
  PID:5552
- C:\Windows\System\MPtwiog.exe
  C:\Windows\System\MPtwiog.exe
  2⤵
  PID:6860
- C:\Windows\System\hPKMpyP.exe
  C:\Windows\System\hPKMpyP.exe
  2⤵
  PID:11220
- C:\Windows\System\bzDMYWx.exe
  C:\Windows\System\bzDMYWx.exe
  2⤵
  PID:10008
- C:\Windows\System\atAYSkc.exe
  C:\Windows\System\atAYSkc.exe
  2⤵
  PID:6916
- C:\Windows\System\MmAqonO.exe
  C:\Windows\System\MmAqonO.exe
  2⤵
  PID:3572
- C:\Windows\System\RnoIUXi.exe
  C:\Windows\System\RnoIUXi.exe
  2⤵
  PID:5724
- C:\Windows\System\GajDsPE.exe
  C:\Windows\System\GajDsPE.exe
  2⤵
  PID:4732
- C:\Windows\System\PamXvYb.exe
  C:\Windows\System\PamXvYb.exe
  2⤵
  PID:6944
- C:\Windows\System\VcXQHSK.exe
  C:\Windows\System\VcXQHSK.exe
  2⤵
  PID:1560
- C:\Windows\System\fRxUzEB.exe
  C:\Windows\System\fRxUzEB.exe
  2⤵
  PID:5468
- C:\Windows\System\BijFowQ.exe
  C:\Windows\System\BijFowQ.exe
  2⤵
  PID:10512
- C:\Windows\System\pCZYpXg.exe
  C:\Windows\System\pCZYpXg.exe
  2⤵
  PID:7104
- C:\Windows\System\hXMEzTZ.exe
  C:\Windows\System\hXMEzTZ.exe
  2⤵
  PID:8440
- C:\Windows\System\RCIUaCF.exe
  C:\Windows\System\RCIUaCF.exe
  2⤵
  PID:11128
- C:\Windows\System\TLaylmq.exe
  C:\Windows\System\TLaylmq.exe
  2⤵
  PID:10848
- C:\Windows\System\haqlbjZ.exe
  C:\Windows\System\haqlbjZ.exe
  2⤵
  PID:11224
- C:\Windows\System\NdXodEc.exe
  C:\Windows\System\NdXodEc.exe
  2⤵
  PID:6148
- C:\Windows\System\tVtELLC.exe
  C:\Windows\System\tVtELLC.exe
  2⤵
  PID:8288
- C:\Windows\System\mgFEHhI.exe
  C:\Windows\System\mgFEHhI.exe
  2⤵
  PID:9280
- C:\Windows\System\CldbGDZ.exe
  C:\Windows\System\CldbGDZ.exe
  2⤵
  PID:3936
- C:\Windows\System\LcNIUIG.exe
  C:\Windows\System\LcNIUIG.exe
  2⤵
  PID:8540
- C:\Windows\System\RlHDzTG.exe
  C:\Windows\System\RlHDzTG.exe
  2⤵
  PID:7084
- C:\Windows\System\EMWOLSJ.exe
  C:\Windows\System\EMWOLSJ.exe
  2⤵
  PID:5356
- C:\Windows\System\LZzpcUf.exe
  C:\Windows\System\LZzpcUf.exe
  2⤵
  PID:9548
- C:\Windows\System\rbrzyIL.exe
  C:\Windows\System\rbrzyIL.exe
  2⤵
  PID:7128
- C:\Windows\System\RObgcgI.exe
  C:\Windows\System\RObgcgI.exe
  2⤵
  PID:4968
- C:\Windows\System\LLBbZIz.exe
  C:\Windows\System\LLBbZIz.exe
  2⤵
  PID:11584
- C:\Windows\System\LvJNVZE.exe
  C:\Windows\System\LvJNVZE.exe
  2⤵
  PID:7156
- C:\Windows\System\eifmttA.exe
  C:\Windows\System\eifmttA.exe
  2⤵
  PID:8688
- C:\Windows\System\BOATpOt.exe
  C:\Windows\System\BOATpOt.exe
  2⤵
  PID:8764
- C:\Windows\System\mGqSTTs.exe
  C:\Windows\System\mGqSTTs.exe
  2⤵
  PID:12588
- C:\Windows\System\karRhXo.exe
  C:\Windows\System\karRhXo.exe
  2⤵
  PID:9964
- C:\Windows\System\kJOzOIK.exe
  C:\Windows\System\kJOzOIK.exe
  2⤵
  PID:8904
- C:\Windows\System\mhzflCB.exe
  C:\Windows\System\mhzflCB.exe
  2⤵
  PID:5868
- C:\Windows\System\MUxWZXQ.exe
  C:\Windows\System\MUxWZXQ.exe
  2⤵
  PID:10076
- C:\Windows\System\xfyoCqf.exe
  C:\Windows\System\xfyoCqf.exe
  2⤵
  PID:8968
- C:\Windows\System\faVLTbn.exe
  C:\Windows\System\faVLTbn.exe
  2⤵
  PID:6200
- C:\Windows\System\oGIWsBt.exe
  C:\Windows\System\oGIWsBt.exe
  2⤵
  PID:216
- C:\Windows\System\MLjoTur.exe
  C:\Windows\System\MLjoTur.exe
  2⤵
  PID:6720
- C:\Windows\System\WbHXbzg.exe
  C:\Windows\System\WbHXbzg.exe
  2⤵
  PID:11936
- C:\Windows\System\EgVZsHt.exe
  C:\Windows\System\EgVZsHt.exe
  2⤵
  PID:9016
- C:\Windows\System\DlpdQoI.exe
  C:\Windows\System\DlpdQoI.exe
  2⤵
  PID:1776
- C:\Windows\System\LgOvYXZ.exe
  C:\Windows\System\LgOvYXZ.exe
  2⤵
  PID:428
- C:\Windows\System\iXmlGHh.exe
  C:\Windows\System\iXmlGHh.exe
  2⤵
  PID:9080
- C:\Windows\System\glQvVmS.exe
  C:\Windows\System\glQvVmS.exe
  2⤵
  PID:12124
- C:\Windows\System\qIreKgO.exe
  C:\Windows\System\qIreKgO.exe
  2⤵
  PID:9656
- C:\Windows\System\cbzpmoj.exe
  C:\Windows\System\cbzpmoj.exe
  2⤵
  PID:5932
- C:\Windows\System\zzEMFqu.exe
  C:\Windows\System\zzEMFqu.exe
  2⤵
  PID:6400
- C:\Windows\System\SnbViCp.exe
  C:\Windows\System\SnbViCp.exe
  2⤵
  PID:12248
- C:\Windows\System\KYPliKC.exe
  C:\Windows\System\KYPliKC.exe
  2⤵
  PID:6344
- C:\Windows\System\NBmMWzS.exe
  C:\Windows\System\NBmMWzS.exe
  2⤵
  PID:11356
- C:\Windows\System\aqrobGG.exe
  C:\Windows\System\aqrobGG.exe
  2⤵
  PID:3464
- C:\Windows\System\BNitZaV.exe
  C:\Windows\System\BNitZaV.exe
  2⤵
  PID:6352
- C:\Windows\System\bokFBso.exe
  C:\Windows\System\bokFBso.exe
  2⤵
  PID:4540
- C:\Windows\System\pLuNVNO.exe
  C:\Windows\System\pLuNVNO.exe
  2⤵
  PID:6384
- C:\Windows\System\rgfDZXg.exe
  C:\Windows\System\rgfDZXg.exe
  2⤵
  PID:9212
- C:\Windows\System\bYlbrMv.exe
  C:\Windows\System\bYlbrMv.exe
  2⤵
  PID:11708
- C:\Windows\System\WxqbDIK.exe
  C:\Windows\System\WxqbDIK.exe
  2⤵
  PID:2308
- C:\Windows\System\iUgvViv.exe
  C:\Windows\System\iUgvViv.exe
  2⤵
  PID:12132
- C:\Windows\System\DWIqMZo.exe
  C:\Windows\System\DWIqMZo.exe
  2⤵
  PID:4468
- C:\Windows\System\VIYZuyk.exe
  C:\Windows\System\VIYZuyk.exe
  2⤵
  PID:2396
- C:\Windows\System\tUMWnZJ.exe
  C:\Windows\System\tUMWnZJ.exe
  2⤵
  PID:6732
- C:\Windows\System\LxUxUoY.exe
  C:\Windows\System\LxUxUoY.exe
  2⤵
  PID:6108
- C:\Windows\System\vOTAEUp.exe
  C:\Windows\System\vOTAEUp.exe
  2⤵
  PID:2776
- C:\Windows\System\RKOxTuQ.exe
  C:\Windows\System\RKOxTuQ.exe
  2⤵
  PID:6464
- C:\Windows\System\UKCezSZ.exe
  C:\Windows\System\UKCezSZ.exe
  2⤵
  PID:11376
- C:\Windows\System\HuEcrnH.exe
  C:\Windows\System\HuEcrnH.exe
  2⤵
  PID:12296
- C:\Windows\System\GpUILgd.exe
  C:\Windows\System\GpUILgd.exe
  2⤵
  PID:12352
- C:\Windows\System\WCAnpna.exe
  C:\Windows\System\WCAnpna.exe
  2⤵
  PID:12408
- C:\Windows\System\ZjzFZTW.exe
  C:\Windows\System\ZjzFZTW.exe
  2⤵
  PID:2264
- C:\Windows\System\usKZcgY.exe
  C:\Windows\System\usKZcgY.exe
  2⤵
  PID:12548
- C:\Windows\System\UiCOwck.exe
  C:\Windows\System\UiCOwck.exe
  2⤵
  PID:8656
- C:\Windows\System\ERGppma.exe
  C:\Windows\System\ERGppma.exe
  2⤵
  PID:5248
- C:\Windows\System\cCMYlpc.exe
  C:\Windows\System\cCMYlpc.exe
  2⤵
  PID:3468
- C:\Windows\System\cKuzurv.exe
  C:\Windows\System\cKuzurv.exe
  2⤵
  PID:1860
- C:\Windows\System\trPJbip.exe
  C:\Windows\System\trPJbip.exe
  2⤵
  PID:4016
- C:\Windows\System\ZxZuUDL.exe
  C:\Windows\System\ZxZuUDL.exe
  2⤵
  PID:8804
- C:\Windows\System\XvjYoWW.exe
  C:\Windows\System\XvjYoWW.exe
  2⤵
  PID:2472
- C:\Windows\System\ajLxAXa.exe
  C:\Windows\System\ajLxAXa.exe
  2⤵
  PID:4376
- C:\Windows\System\aJidQEm.exe
  C:\Windows\System\aJidQEm.exe
  2⤵
  PID:5132
- C:\Windows\System\vNGzRtq.exe
  C:\Windows\System\vNGzRtq.exe
  2⤵
  PID:6620
- C:\Windows\System\qAZEmXd.exe
  C:\Windows\System\qAZEmXd.exe
  2⤵
  PID:6900
- C:\Windows\System\BYRekPW.exe
  C:\Windows\System\BYRekPW.exe
  2⤵
  PID:13168
- C:\Windows\System\DMEXQjA.exe
  C:\Windows\System\DMEXQjA.exe
  2⤵
  PID:13232
- C:\Windows\System\wKfoifm.exe
  C:\Windows\System\wKfoifm.exe
  2⤵
  PID:10628
- C:\Windows\System\UIDhRPe.exe
  C:\Windows\System\UIDhRPe.exe
  2⤵
  PID:5456
- C:\Windows\System\FSYSDIj.exe
  C:\Windows\System\FSYSDIj.exe
  2⤵
  PID:10704
- C:\Windows\System\SKPGGuz.exe
  C:\Windows\System\SKPGGuz.exe
  2⤵
  PID:7532
- C:\Windows\System\pJUByBg.exe
  C:\Windows\System\pJUByBg.exe
  2⤵
  PID:5840
- C:\Windows\System\HdTCTGN.exe
  C:\Windows\System\HdTCTGN.exe
  2⤵
  PID:7888
- C:\Windows\System\vJPceaI.exe
  C:\Windows\System\vJPceaI.exe
  2⤵
  PID:7912
- C:\Windows\System\gaONJGp.exe
  C:\Windows\System\gaONJGp.exe
  2⤵
  PID:5124
- C:\Windows\System\NmgmLkh.exe
  C:\Windows\System\NmgmLkh.exe
  2⤵
  PID:6700
- C:\Windows\System\aMQYRHS.exe
  C:\Windows\System\aMQYRHS.exe
  2⤵
  PID:8156
- C:\Windows\System\fGbjbOX.exe
  C:\Windows\System\fGbjbOX.exe
  2⤵
  PID:7704
- C:\Windows\System\ipCbCtn.exe
  C:\Windows\System\ipCbCtn.exe
  2⤵
  PID:11012
- C:\Windows\System\oNCLAkM.exe
  C:\Windows\System\oNCLAkM.exe
  2⤵
  PID:9248
- C:\Windows\System\nesNVFF.exe
  C:\Windows\System\nesNVFF.exe
  2⤵
  PID:1724
- C:\Windows\System\IPNYmUp.exe
  C:\Windows\System\IPNYmUp.exe
  2⤵
  PID:1380
- C:\Windows\System\WrvCtCz.exe
  C:\Windows\System\WrvCtCz.exe
  2⤵
  PID:3276
- C:\Windows\System\SIOlRKV.exe
  C:\Windows\System\SIOlRKV.exe
  2⤵
  PID:9404
- C:\Windows\System\Hmjniwm.exe
  C:\Windows\System\Hmjniwm.exe
  2⤵
  PID:10384
- C:\Windows\System\lbrTkWh.exe
  C:\Windows\System\lbrTkWh.exe
  2⤵
  PID:7756
- C:\Windows\System\xXqQrEw.exe
  C:\Windows\System\xXqQrEw.exe
  2⤵
  PID:696
- C:\Windows\System\UIqzRvR.exe
  C:\Windows\System\UIqzRvR.exe
  2⤵
  PID:13088
- C:\Windows\System\eLEAZyC.exe
  C:\Windows\System\eLEAZyC.exe
  2⤵
  PID:13128
- C:\Windows\System\aeEBCVq.exe
  C:\Windows\System\aeEBCVq.exe
  2⤵
  PID:9588
- C:\Windows\System\mlQSAIm.exe
  C:\Windows\System\mlQSAIm.exe
  2⤵
  PID:13284
- C:\Windows\System\SDsQaAQ.exe
  C:\Windows\System\SDsQaAQ.exe
  2⤵
  PID:10792
- C:\Windows\System\CgrnTUF.exe
  C:\Windows\System\CgrnTUF.exe
  2⤵
  PID:6796
- C:\Windows\System\WvfXJrP.exe
  C:\Windows\System\WvfXJrP.exe
  2⤵
  PID:9784
- C:\Windows\System\ccxBPfG.exe
  C:\Windows\System\ccxBPfG.exe
  2⤵
  PID:11156
- C:\Windows\System\rkXIPRj.exe
  C:\Windows\System\rkXIPRj.exe
  2⤵
  PID:9988
- C:\Windows\System\MxEZaSM.exe
  C:\Windows\System\MxEZaSM.exe
  2⤵
  PID:9512
- C:\Windows\System\qtkQWxc.exe
  C:\Windows\System\qtkQWxc.exe
  2⤵
  PID:10272
- C:\Windows\System\ZwshbtU.exe
  C:\Windows\System\ZwshbtU.exe
  2⤵
  PID:3100
- C:\Windows\System\ihRChoq.exe
  C:\Windows\System\ihRChoq.exe
  2⤵
  PID:10940
- C:\Windows\System\txMrkvE.exe
  C:\Windows\System\txMrkvE.exe
  2⤵
  PID:11056
- C:\Windows\System\LvJBeWC.exe
  C:\Windows\System\LvJBeWC.exe
  2⤵
  PID:6372
- C:\Windows\System\FpnTaKL.exe
  C:\Windows\System\FpnTaKL.exe
  2⤵
  PID:11880
- C:\Windows\System\nacQaxX.exe
  C:\Windows\System\nacQaxX.exe
  2⤵
  PID:5568
- C:\Windows\System\bMiUhPw.exe
  C:\Windows\System\bMiUhPw.exe
  2⤵
  PID:11344
- C:\Windows\System\JwOQTSt.exe
  C:\Windows\System\JwOQTSt.exe
  2⤵
  PID:2792
- C:\Windows\System\wKNOJIn.exe
  C:\Windows\System\wKNOJIn.exe
  2⤵
  PID:6196
- C:\Windows\System\ZAoZkOx.exe
  C:\Windows\System\ZAoZkOx.exe
  2⤵
  PID:3120
- C:\Windows\System\stfNrHF.exe
  C:\Windows\System\stfNrHF.exe
  2⤵
  PID:8632
- C:\Windows\System\PKAxnUD.exe
  C:\Windows\System\PKAxnUD.exe
  2⤵
  PID:9768
- C:\Windows\System\eoviydr.exe
  C:\Windows\System\eoviydr.exe
  2⤵
  PID:9880
- C:\Windows\System\dvSRJqO.exe
  C:\Windows\System\dvSRJqO.exe
  2⤵
  PID:8828
- C:\Windows\System\FyBmhMq.exe
  C:\Windows\System\FyBmhMq.exe
  2⤵
  PID:10024
- C:\Windows\System\NwuAbYv.exe
  C:\Windows\System\NwuAbYv.exe
  2⤵
  PID:8932
- C:\Windows\System\cAQENxw.exe
  C:\Windows\System\cAQENxw.exe
  2⤵
  PID:5384
- C:\Windows\System\JOSWEOO.exe
  C:\Windows\System\JOSWEOO.exe
  2⤵
  PID:4216
- C:\Windows\System\TouqXII.exe
  C:\Windows\System\TouqXII.exe
  2⤵
  PID:404
- C:\Windows\System\fmiNHIY.exe
  C:\Windows\System\fmiNHIY.exe
  2⤵
  PID:12076
- C:\Windows\System\qDECEnx.exe
  C:\Windows\System\qDECEnx.exe
  2⤵
  PID:12136
- C:\Windows\System\qdpJgvV.exe
  C:\Windows\System\qdpJgvV.exe
  2⤵
  PID:9108
- C:\Windows\System\NVyViEC.exe
  C:\Windows\System\NVyViEC.exe
  2⤵
  PID:6488
- C:\Windows\System\bhYwRYZ.exe
  C:\Windows\System\bhYwRYZ.exe
  2⤵
  PID:4716
- C:\Windows\System\dWNKhVb.exe
  C:\Windows\System\dWNKhVb.exe
  2⤵
  PID:9384
- C:\Windows\System\eoZJtHJ.exe
  C:\Windows\System\eoZJtHJ.exe
  2⤵
  PID:5480
- C:\Windows\System\wmhPXjc.exe
  C:\Windows\System\wmhPXjc.exe
  2⤵
  PID:12080
- C:\Windows\System\inimBnq.exe
  C:\Windows\System\inimBnq.exe
  2⤵
  PID:6012
- C:\Windows\System\doATvXs.exe
  C:\Windows\System\doATvXs.exe
  2⤵
  PID:4004
- C:\Windows\System\sgdjzut.exe
  C:\Windows\System\sgdjzut.exe
  2⤵
  PID:11748
- C:\Windows\System\UDnxLOB.exe
  C:\Windows\System\UDnxLOB.exe
  2⤵
  PID:6688
- C:\Windows\System\HLJALRX.exe
  C:\Windows\System\HLJALRX.exe
  2⤵
  PID:3216
- C:\Windows\System\PKseyax.exe
  C:\Windows\System\PKseyax.exe
  2⤵
  PID:12416
- C:\Windows\System\DRbaUgG.exe
  C:\Windows\System\DRbaUgG.exe
  2⤵
  PID:12520
- C:\Windows\System\aiozxAM.exe
  C:\Windows\System\aiozxAM.exe
  2⤵
  PID:12660
- C:\Windows\System\UtIvedl.exe
  C:\Windows\System\UtIvedl.exe
  2⤵
  PID:6512
- C:\Windows\System\mAyNzKq.exe
  C:\Windows\System\mAyNzKq.exe
  2⤵
  PID:12932
- C:\Windows\System\DGBroOy.exe
  C:\Windows\System\DGBroOy.exe
  2⤵
  PID:6324
- C:\Windows\System\DwyhBLm.exe
  C:\Windows\System\DwyhBLm.exe
  2⤵
  PID:6448
- C:\Windows\System\ydNwghw.exe
  C:\Windows\System\ydNwghw.exe
  2⤵
  PID:11832
- C:\Windows\System\oTXZTUJ.exe
  C:\Windows\System\oTXZTUJ.exe
  2⤵
  PID:13196
- C:\Windows\System\AiAkJcT.exe
  C:\Windows\System\AiAkJcT.exe
  2⤵
  PID:6556
- C:\Windows\System\nEJJfBW.exe
  C:\Windows\System\nEJJfBW.exe
  2⤵
  PID:6764
- C:\Windows\System\GIzqqYe.exe
  C:\Windows\System\GIzqqYe.exe
  2⤵
  PID:5736
- C:\Windows\System\CFraRxr.exe
  C:\Windows\System\CFraRxr.exe
  2⤵
  PID:7652
- C:\Windows\System\EfSfqib.exe
  C:\Windows\System\EfSfqib.exe
  2⤵
  PID:8056
- C:\Windows\System\sgUCgTF.exe
  C:\Windows\System\sgUCgTF.exe
  2⤵
  PID:5204
- C:\Windows\System\RoRZVdw.exe
  C:\Windows\System\RoRZVdw.exe
  2⤵
  PID:7668
- C:\Windows\System\eBFrCHA.exe
  C:\Windows\System\eBFrCHA.exe
  2⤵
  PID:7948
- C:\Windows\System\FDVkaEH.exe
  C:\Windows\System\FDVkaEH.exe
  2⤵
  PID:3524
- C:\Windows\System\iJuQQnd.exe
  C:\Windows\System\iJuQQnd.exe
  2⤵
  PID:224
- C:\Windows\System\eAQglJz.exe
  C:\Windows\System\eAQglJz.exe
  2⤵
  PID:10516
- C:\Windows\System\mFLTjgZ.exe
  C:\Windows\System\mFLTjgZ.exe
  2⤵
  PID:12964
- C:\Windows\System\AkbBqAq.exe
  C:\Windows\System\AkbBqAq.exe
  2⤵
  PID:7876
- C:\Windows\System\eucgeTR.exe
  C:\Windows\System\eucgeTR.exe
  2⤵
  PID:7960
- C:\Windows\System\HCLuqkZ.exe
  C:\Windows\System\HCLuqkZ.exe
  2⤵
  PID:9672
- C:\Windows\System\uiOSDSa.exe
  C:\Windows\System\uiOSDSa.exe
  2⤵
  PID:12872
- C:\Windows\System\COvyegW.exe
  C:\Windows\System\COvyegW.exe
  2⤵
  PID:2128
- C:\Windows\System\hzAUhFL.exe
  C:\Windows\System\hzAUhFL.exe
  2⤵
  PID:5288
- C:\Windows\System\JIBOWYz.exe
  C:\Windows\System\JIBOWYz.exe
  2⤵
  PID:844
- C:\Windows\System\Dynfgap.exe
  C:\Windows\System\Dynfgap.exe
  2⤵
  PID:8500
- C:\Windows\System\UYKTdkE.exe
  C:\Windows\System\UYKTdkE.exe
  2⤵
  PID:5648
- C:\Windows\System\DbDXgcl.exe
  C:\Windows\System\DbDXgcl.exe
  2⤵
  PID:9704
- C:\Windows\System\yTWnbLr.exe
  C:\Windows\System\yTWnbLr.exe
  2⤵
  PID:12636
- C:\Windows\System\zZavgpE.exe
  C:\Windows\System\zZavgpE.exe
  2⤵
  PID:13116
- C:\Windows\System\pSyxsJE.exe
  C:\Windows\System\pSyxsJE.exe
  2⤵
  PID:4484
- C:\Windows\System\SPBVEWz.exe
  C:\Windows\System\SPBVEWz.exe
  2⤵
  PID:9344
- C:\Windows\System\WQuUzhK.exe
  C:\Windows\System\WQuUzhK.exe
  2⤵
  PID:5460
- C:\Windows\System\gPhcHnr.exe
  C:\Windows\System\gPhcHnr.exe
  2⤵
  PID:2116
- C:\Windows\System\uSwryHZ.exe
  C:\Windows\System\uSwryHZ.exe
  2⤵
  PID:13100
- C:\Windows\System\aLnWOWF.exe
  C:\Windows\System\aLnWOWF.exe
  2⤵
  PID:11848
- C:\Windows\System\AecMerJ.exe
  C:\Windows\System\AecMerJ.exe
  2⤵
  PID:12020
- C:\Windows\System\UoWVTco.exe
  C:\Windows\System\UoWVTco.exe
  2⤵
  PID:12436
- C:\Windows\System\TwDJhYq.exe
  C:\Windows\System\TwDJhYq.exe
  2⤵
  PID:12776
- C:\Windows\System\DMmkjRw.exe
  C:\Windows\System\DMmkjRw.exe
  2⤵
  PID:11660
- C:\Windows\System\Abnvufy.exe
  C:\Windows\System\Abnvufy.exe
  2⤵
  PID:11972
- C:\Windows\System\GyhKfpk.exe
  C:\Windows\System\GyhKfpk.exe
  2⤵
  PID:12216
- C:\Windows\System\VDmdkZj.exe
  C:\Windows\System\VDmdkZj.exe
  2⤵
  PID:7808
- C:\Windows\System\oKtTddo.exe
  C:\Windows\System\oKtTddo.exe
  2⤵
  PID:5152
- C:\Windows\System\vcssIiR.exe
  C:\Windows\System\vcssIiR.exe
  2⤵
  PID:11076
- C:\Windows\System\GebDMKQ.exe
  C:\Windows\System\GebDMKQ.exe
  2⤵
  PID:8208
- C:\Windows\System\ODfqDjJ.exe
  C:\Windows\System\ODfqDjJ.exe
  2⤵
  PID:13028
- C:\Windows\System\VZOSGRB.exe
  C:\Windows\System\VZOSGRB.exe
  2⤵
  PID:6008
- C:\Windows\System\iFxrSOE.exe
  C:\Windows\System\iFxrSOE.exe
  2⤵
  PID:9388
- C:\Windows\System\pkksbYW.exe
  C:\Windows\System\pkksbYW.exe
  2⤵
  PID:680
- C:\Windows\System\qoIhwoV.exe
  C:\Windows\System\qoIhwoV.exe
  2⤵
  PID:11372
- C:\Windows\System\srugyWF.exe
  C:\Windows\System\srugyWF.exe
  2⤵
  PID:8680
- C:\Windows\System\ITfBBlJ.exe
  C:\Windows\System\ITfBBlJ.exe
  2⤵
  PID:5796
- C:\Windows\System\UoDHlVX.exe
  C:\Windows\System\UoDHlVX.exe
  2⤵
  PID:9824
- C:\Windows\System\MnmvFkL.exe
  C:\Windows\System\MnmvFkL.exe
  2⤵
  PID:1464
- C:\Windows\System\owgWEkZ.exe
  C:\Windows\System\owgWEkZ.exe
  2⤵
  PID:11244
- C:\Windows\System\IMbEiZe.exe
  C:\Windows\System\IMbEiZe.exe
  2⤵
  PID:4352
- C:\Windows\System\UhnyWWO.exe
  C:\Windows\System\UhnyWWO.exe
  2⤵
  PID:12052
- C:\Windows\System\odRalAv.exe
  C:\Windows\System\odRalAv.exe
  2⤵
  PID:12808
- C:\Windows\System\svTQXMp.exe
  C:\Windows\System\svTQXMp.exe
  2⤵
  PID:1184
- C:\Windows\System\RAdduoF.exe
  C:\Windows\System\RAdduoF.exe
  2⤵
  PID:3516
- C:\Windows\System\bmcednB.exe
  C:\Windows\System\bmcednB.exe
  2⤵
  PID:4556
- C:\Windows\System\icVuUYu.exe
  C:\Windows\System\icVuUYu.exe
  2⤵
  PID:12468
- C:\Windows\System\SWAYxRL.exe
  C:\Windows\System\SWAYxRL.exe
  2⤵
  PID:9052
- C:\Windows\System\TAmnQoL.exe
  C:\Windows\System\TAmnQoL.exe
  2⤵
  PID:11892
- C:\Windows\System\rjzButi.exe
  C:\Windows\System\rjzButi.exe
  2⤵
  PID:1396
- C:\Windows\System\HyjNCsv.exe
  C:\Windows\System\HyjNCsv.exe
  2⤵
  PID:1728
- C:\Windows\System\EoyqyrY.exe
  C:\Windows\System\EoyqyrY.exe
  2⤵
  PID:3908
- C:\Windows\System\sUiwTIV.exe
  C:\Windows\System\sUiwTIV.exe
  2⤵
  PID:6872
- C:\Windows\System\onQkeyj.exe
  C:\Windows\System\onQkeyj.exe
  2⤵
  PID:3224
- C:\Windows\System\wuKwBEA.exe
  C:\Windows\System\wuKwBEA.exe
  2⤵
  PID:1768
- C:\Windows\System\nqxOSHH.exe
  C:\Windows\System\nqxOSHH.exe
  2⤵
  PID:7172
- C:\Windows\System\yWUzrgh.exe
  C:\Windows\System\yWUzrgh.exe
  2⤵
  PID:3148
- C:\Windows\System\nSCqgsr.exe
  C:\Windows\System\nSCqgsr.exe
  2⤵
  PID:8884
- C:\Windows\System\HUDzGYx.exe
  C:\Windows\System\HUDzGYx.exe
  2⤵
  PID:13324
- C:\Windows\System\nSloObh.exe
  C:\Windows\System\nSloObh.exe
  2⤵
  PID:13352
- C:\Windows\System\EMBTdvp.exe
  C:\Windows\System\EMBTdvp.exe
  2⤵
  PID:13380
- C:\Windows\System\VSbILJU.exe
  C:\Windows\System\VSbILJU.exe
  2⤵
  PID:13408
- C:\Windows\System\KaXtTpR.exe
  C:\Windows\System\KaXtTpR.exe
  2⤵
  PID:13436
- C:\Windows\System\DHiMQbr.exe
  C:\Windows\System\DHiMQbr.exe
  2⤵
  PID:13464
- C:\Windows\System\JpsbZri.exe
  C:\Windows\System\JpsbZri.exe
  2⤵
  PID:13492
- C:\Windows\System\TeqcaKG.exe
  C:\Windows\System\TeqcaKG.exe
  2⤵
  PID:13520
- C:\Windows\System\eiwfBtx.exe
  C:\Windows\System\eiwfBtx.exe
  2⤵
  PID:13548
- C:\Windows\System\LNftOOn.exe
  C:\Windows\System\LNftOOn.exe
  2⤵
  PID:13576
- C:\Windows\System\sVOrqzm.exe
  C:\Windows\System\sVOrqzm.exe
  2⤵
  PID:13604
- C:\Windows\System\wBgHjYX.exe
  C:\Windows\System\wBgHjYX.exe
  2⤵
  PID:13632
- C:\Windows\System\KyXOSvM.exe
  C:\Windows\System\KyXOSvM.exe
  2⤵
  PID:13660
- C:\Windows\System\uclIcDL.exe
  C:\Windows\System\uclIcDL.exe
  2⤵
  PID:13688
- C:\Windows\System\ZZtvbMX.exe
  C:\Windows\System\ZZtvbMX.exe
  2⤵
  PID:13716
- C:\Windows\System\HEIPdXJ.exe
  C:\Windows\System\HEIPdXJ.exe
  2⤵
  PID:13744
- C:\Windows\System\bTyyghP.exe
  C:\Windows\System\bTyyghP.exe
  2⤵
  PID:13772
- C:\Windows\System\vRQnWlL.exe
  C:\Windows\System\vRQnWlL.exe
  2⤵
  PID:13800
- C:\Windows\System\hnwGVHJ.exe
  C:\Windows\System\hnwGVHJ.exe
  2⤵
  PID:13828
- C:\Windows\System\gUsfCuL.exe
  C:\Windows\System\gUsfCuL.exe
  2⤵
  PID:13860
- C:\Windows\System\RHZFmsG.exe
  C:\Windows\System\RHZFmsG.exe
  2⤵
  PID:13888
- C:\Windows\System\KhJyZKo.exe
  C:\Windows\System\KhJyZKo.exe
  2⤵
  PID:13916
- C:\Windows\System\CtiAKYn.exe
  C:\Windows\System\CtiAKYn.exe
  2⤵
  PID:13944
- C:\Windows\System\oKAHWoj.exe
  C:\Windows\System\oKAHWoj.exe
  2⤵
  PID:13972
- C:\Windows\System\gNfrPeV.exe
  C:\Windows\System\gNfrPeV.exe
  2⤵
  PID:14000
- C:\Windows\System\VUPaPej.exe
  C:\Windows\System\VUPaPej.exe
  2⤵
  PID:14028
- C:\Windows\System\qmZQahc.exe
  C:\Windows\System\qmZQahc.exe
  2⤵
  PID:14056
- C:\Windows\System\HOvEPdr.exe
  C:\Windows\System\HOvEPdr.exe
  2⤵
  PID:14084
- C:\Windows\System\SpUIRQk.exe
  C:\Windows\System\SpUIRQk.exe
  2⤵
  PID:14112
- C:\Windows\System\wGUioPQ.exe
  C:\Windows\System\wGUioPQ.exe
  2⤵
  PID:14140
- C:\Windows\System\HiEubUN.exe
  C:\Windows\System\HiEubUN.exe
  2⤵
  PID:14168
- C:\Windows\System\ftGDPzm.exe
  C:\Windows\System\ftGDPzm.exe
  2⤵
  PID:14196
- C:\Windows\System\LhfNZiB.exe
  C:\Windows\System\LhfNZiB.exe
  2⤵
  PID:14224
- C:\Windows\System\vaHSRpm.exe
  C:\Windows\System\vaHSRpm.exe
  2⤵
  PID:14252
- C:\Windows\System\QnuDPxp.exe
  C:\Windows\System\QnuDPxp.exe
  2⤵
  PID:14280
- C:\Windows\System\jOPWYoX.exe
  C:\Windows\System\jOPWYoX.exe
  2⤵
  PID:14308
- C:\Windows\System\rtloFDi.exe
  C:\Windows\System\rtloFDi.exe
  2⤵
  PID:13140
- C:\Windows\System\vAtmCLf.exe
  C:\Windows\System\vAtmCLf.exe
  2⤵
  PID:13388
- C:\Windows\System\ZQGGrrQ.exe
  C:\Windows\System\ZQGGrrQ.exe
  2⤵
  PID:13452
- C:\Windows\System\RKmvmkH.exe
  C:\Windows\System\RKmvmkH.exe
  2⤵
  PID:13516
- C:\Windows\System\nBQIFZw.exe
  C:\Windows\System\nBQIFZw.exe
  2⤵
  PID:13584
- C:\Windows\System\bPsARHk.exe
  C:\Windows\System\bPsARHk.exe
  2⤵
  PID:13648
- C:\Windows\System\YPCqmfw.exe
  C:\Windows\System\YPCqmfw.exe
  2⤵
  PID:12120
- C:\Windows\System\SBtmZaJ.exe
  C:\Windows\System\SBtmZaJ.exe
  2⤵
  PID:13768
- C:\Windows\System\PPKmENF.exe
  C:\Windows\System\PPKmENF.exe
  2⤵
  PID:13836
- C:\Windows\System\TcrcVSw.exe
  C:\Windows\System\TcrcVSw.exe
  2⤵
  PID:2940
- C:\Windows\System\DpCQbea.exe
  C:\Windows\System\DpCQbea.exe
  2⤵
  PID:13932
- C:\Windows\System\pNFfUDH.exe
  C:\Windows\System\pNFfUDH.exe
  2⤵
  PID:13996
- C:\Windows\System\PNhQtWb.exe
  C:\Windows\System\PNhQtWb.exe
  2⤵
  PID:14064
- C:\Windows\System\csNsCgd.exe
  C:\Windows\System\csNsCgd.exe
  2⤵
  PID:14128
- C:\Windows\System\JIlybDK.exe
  C:\Windows\System\JIlybDK.exe
  2⤵
  PID:14192
- C:\Windows\System\lBQYOEG.exe
  C:\Windows\System\lBQYOEG.exe
  2⤵
  PID:14248
- C:\Windows\System\jElbEqq.exe
  C:\Windows\System\jElbEqq.exe
  2⤵
  PID:14316
- C:\Windows\System\mgchyrW.exe
  C:\Windows\System\mgchyrW.exe
  2⤵
  PID:13424
- C:\Windows\System\sYaXNaF.exe
  C:\Windows\System\sYaXNaF.exe
  2⤵
  PID:13572
- C:\Windows\System\eeCHNDC.exe
  C:\Windows\System\eeCHNDC.exe
  2⤵
  PID:13724
- C:\Windows\System\DUoqOTW.exe
  C:\Windows\System\DUoqOTW.exe
  2⤵
  PID:3968
- C:\Windows\System\aNlBSJe.exe
  C:\Windows\System\aNlBSJe.exe
  2⤵
  PID:14016
- C:\Windows\System\tKMMccl.exe
  C:\Windows\System\tKMMccl.exe
  2⤵
  PID:14164
- C:\Windows\System\ndhzqlT.exe
  C:\Windows\System\ndhzqlT.exe
  2⤵
  PID:14288
- C:\Windows\System\yLmdNSh.exe
  C:\Windows\System\yLmdNSh.exe
  2⤵
  PID:13472
- C:\Windows\System\WQGOuyH.exe
  C:\Windows\System\WQGOuyH.exe
  2⤵
  PID:13808
- C:\Windows\System\zcINUHk.exe
  C:\Windows\System\zcINUHk.exe
  2⤵
  PID:14100
- C:\Windows\System\QnUJdia.exe
  C:\Windows\System\QnUJdia.exe
  2⤵
  PID:13404
- C:\Windows\System\tIDLnGQ.exe
  C:\Windows\System\tIDLnGQ.exe
  2⤵
  PID:14204
- C:\Windows\System\zthsrel.exe
  C:\Windows\System\zthsrel.exe
  2⤵
  PID:7556
- C:\Windows\System\aeFTiaM.exe
  C:\Windows\System\aeFTiaM.exe
  2⤵
  PID:14360
- C:\Windows\System\HaZMCjG.exe
  C:\Windows\System\HaZMCjG.exe
  2⤵
  PID:14388
- C:\Windows\System\MeLgSwb.exe
  C:\Windows\System\MeLgSwb.exe
  2⤵
  PID:14416
- C:\Windows\System\EDxgQPy.exe
  C:\Windows\System\EDxgQPy.exe
  2⤵
  PID:14444
- C:\Windows\System\hzCfEzM.exe
  C:\Windows\System\hzCfEzM.exe
  2⤵
  PID:14472
- C:\Windows\System\iJUCLcj.exe
  C:\Windows\System\iJUCLcj.exe
  2⤵
  PID:14500
- C:\Windows\System\wfOAtjv.exe
  C:\Windows\System\wfOAtjv.exe
  2⤵
  PID:14528
- C:\Windows\System\hJUAVoK.exe
  C:\Windows\System\hJUAVoK.exe
  2⤵
  PID:14556
- C:\Windows\System\cWJDUUl.exe
  C:\Windows\System\cWJDUUl.exe
  2⤵
  PID:14584
- C:\Windows\System\iIKkEra.exe
  C:\Windows\System\iIKkEra.exe
  2⤵
  PID:14468

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_uzxmn0gx.cjn.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\BXoJMLq.exe

Filesize
3.0MB

MD5
e89d34bb7adf504f8102dbf92e82e62a

SHA1
f676e8907681d09dcb196b5cc57ac78dc875fc84

SHA256
0f2d265be0f76fd85697dd52a316dbfdc1eddd52771ff82e53742f7b8c9c21f2

SHA512
53100de638dd0f2aa393d0acc3212cedf766c93eaee4f879edf0072d0b1da5f1d02be72235e8750df4df5a7eba920db459bc29233262f2b0c245256896ef16a2

Download Submit
C:\Windows\System\CCmyiyn.exe

Filesize
3.0MB

MD5
165cda00d27b794e6fb161bd84626c21

SHA1
233fd97b4eec9b542e257a076233bc2f5f33ba23

SHA256
947e621f11e50d75aca3f5e698788abaaa28d03f79409301ccec868402373e9c

SHA512
a9f1eff9bce91b7d7956627d208b0b6f893650fd97089220034b6b3aba32f12701994ad5dba6b158c2bbdee396a99fbbf6df54670d5bb9a85aaac558d8445d7b

Download Submit
C:\Windows\System\CDqOByA.exe

Filesize
3.0MB

MD5
c524e1281305f6877af64abe33cbd823

SHA1
d51e47f71f4ca79a2d122a253210f053c4ba3a12

SHA256
e41ec802735adb02cea2c9e24a3b1409cc99000be8b5aace497e58b7fe796610

SHA512
06dc288efd01c872097e707a2c535f19cd3c3592f202c03e2efbf84c8acfecf43b17d04f4aaf302ab55cb7722af57834035c6f47de6ebbc991aef0781528282c

Download Submit
C:\Windows\System\CFWnHvC.exe

Filesize
3.0MB

MD5
2ecc59bc4e28d01a99b86a562c23bd05

SHA1
46fc03807fb103c7ae31a83fe88772dc224410f4

SHA256
bf56ba20ab820b778b65a8644eef4078d64e7d2992b49e61ced1d588dc7dbde8

SHA512
fc4589872728050305a7c7167017b4da191a4fc71eb5586f828e3af9615404cd10f13cc2706169976547d0d234a950b9c760a4725a11fa358923ae312a4475b2

Download Submit
C:\Windows\System\FobGFxH.exe

Filesize
3.0MB

MD5
57ba41d900775b13f038a0420c90fb30

SHA1
38d4227c2abfa4a5a25deb6bc518d995448ac21c

SHA256
a8259ec5c42da151ac028aa0f04539824fb585938179509177bc3a1b03081ab1

SHA512
3418c6a935fdf742bf2afc430f822c1e2c1ea7086b4803dcb7903ea69d3c5eb6ee7981972e70bbc21df67c4f27fcf00ed1b9e5b54c28748d01e23b130dbd962b

Download Submit
C:\Windows\System\GhiwNxD.exe

Filesize
3.0MB

MD5
c56932e498ae2f121b4a4d3114176483

SHA1
bbcf5d73cb18633fa4f1c90f5bc169e935fb0621

SHA256
3f54f69eb3969f0154fec27f7f45cc7e779d18375510818c29bb22477db50144

SHA512
48f4dbf92aa8ffad47a0af0cab30141ed6a2d48503cd3b3d425bda0d10e13e7e01b602f54419a38947543c83f899140d89a21e316fb87dec301e3db015fdb3ba

Download Submit
C:\Windows\System\HWWVaxl.exe

Filesize
3.0MB

MD5
3e9a8fbdf7fc930cfa8bed21f51d9e49

SHA1
5aabeac8a1155aa5ec2bc2a89b741aeae6fef2e5

SHA256
f3ea2de4d378961292c4b6da258a70bd884174b862b673ebbce297d82475584e

SHA512
3c489e1087987aa3da3bdfe0efff4811c535563befc424064c1ad86757f29e7776e4cba5ea030ef8cafcb0dadfaf2238c9be3a64767c4533487d02cdeff166c6

Download Submit
C:\Windows\System\HXayGTb.exe

Filesize
3.0MB

MD5
e289ffc2e9076043b8e3f4f07b768eb0

SHA1
9e61f116633544d3a96b0662e3f63f002a9e2629

SHA256
505e1a381670efe814876bf1d4dd4ef1650313dc898b1a13879df05560aada04

SHA512
2bc65c7cff75fe535d23814747734eae7288bafafa0d8a716ec057c24bb74b1261760067dbbad7e97e1b94ae1d98b79dd8b7398a4081cc35f4394791ee6cd689

Download Submit
C:\Windows\System\INVrWOY.exe

Filesize
3.0MB

MD5
e87cfbc4cee969dc16e1830a0b5fa3f4

SHA1
e49afb6e47ebd882ea11a3e5fc4b91f5d3f943f8

SHA256
ffac10ccd20f739ce612ce970113a8f2333304981f0abf439744accde3eac629

SHA512
8da0fb6f5e6741add9d31e112a45f5aac0d6722a0753d68b6c713fec9f8abd2db0ebb2def1bae803e4bd0eb74f1cc55616572abbed965e3ea5a0a21f339fdc9a

Download Submit
C:\Windows\System\ItdgbuW.exe

Filesize
3.0MB

MD5
ef7aa3ac64f86775f7b87492129a0ee3

SHA1
514ebc3c2bbae9b6eba93eec74bbf87a3f6afcff

SHA256
b3bbd22a2c8ad58507f8da0418643b59191a2b525a68f4ea6a9efd9faadc298f

SHA512
b1a8f6241498faca1ea92e30dc8f82669e610fbe542ef641b92771e573b93676b8c043786ea898bde0de0306f63da5e499f88e3e4cb15307555f5ddf5978c3b2

Download Submit
C:\Windows\System\NDHafLP.exe

Filesize
3.0MB

MD5
a4dfe589b9772bc6eeac297051926f2e

SHA1
894926851441b88eb41e9ed7aff44d42f16f687c

SHA256
a05d159dd42dde6969fd673ae843712fead2673a8c3eb94e0cf92bac7f858583

SHA512
47944243f725238b5c5c46d095bf66a397cbf5edae81073bd29f011765708d7a72f90f0a20461b6bcf4d8b9717dd40d66c247ab161ab064d8e5adffc2c04b446

Download Submit
C:\Windows\System\NEqQHan.exe

Filesize
3.0MB

MD5
1a134c25e4f3d9212fb116d579a22128

SHA1
ec0cce570f18f2535575aa1006bc964eaac0ec7c

SHA256
26ec8ce4e7c54aa51290dcdeb9c25c027f975c1736aabd4bfdfd25d372d739a2

SHA512
9e3d4ce8387f8b46782c902c8784e2b3aa46e77d08389cc29aef0f4a8ea2a91e507037113c39336c454b0043e9566e7a290a086e8d82c6392414cf99d424b7a4

Download Submit
C:\Windows\System\NXVyUJh.exe

Filesize
3.0MB

MD5
44b351d5d745e3c4234705c5d7d2e76a

SHA1
e1fd00c1c8b9f97064797d94e04e9a3d352bc5e1

SHA256
9a7e5ccab944b7e7177b73c5a98a1c743da0ca7dc568f078053330a9af1650b0

SHA512
c7c795126be0edcb26f86fb95a09f4f76eee1b5531e5207d468493f32e8fd67a7df8cc2c15e9ecd34677e4a6c54162335ace614798b93549d4addff5c855b634

Download Submit
C:\Windows\System\OAOulnA.exe

Filesize
3.0MB

MD5
af1e5b64ef489f8911e61793fd1b778b

SHA1
bf06827674db480b5504d808eb9b7130bbe33625

SHA256
462060c6de39248c5d28e30039e7351ef12c7b013a9ccc6cde99a3439290863e

SHA512
6d086331340058ec395922bc4419fd8c26e358902d96a778aa5b45f53406150b6045b3cd7fe33c284021dd156655a697c4f822108420617a603a658e02e8a9e0

Download Submit
C:\Windows\System\PNLNxkb.exe

Filesize
18B

MD5
d6bd6ca0c5d1525898ba25b0a43e9999

SHA1
ff1365016a76693cc2b66ba524de9655c1fc0f36

SHA256
0f8996699afea4c5fe8aad9de2f18c24a94508de02aa3a04f82c0b4c86fb557d

SHA512
82d0da5db1ecdb0ce533f39a24c98987ce3bd43f833406fef4929043a153e7dbafe3c7f2867fa4255e4a061009ca830b3c098ab710eb06e601073ee3c2592db9

Download Submit
C:\Windows\System\UqsDrlA.exe

Filesize
3.0MB

MD5
b8e5ede080148d86242129601f2fe7f8

SHA1
a63bd641201f74b1dc72c7bccbfbfc82269cb345

SHA256
172429d9b3248bb80a56420cfee3c3b920b117621c7d4c46107db9bfce0f0b6b

SHA512
36cf765eac7c68a975433213929029a72db501d16818f84890c104e9f63d321e5ba8b00e684fd52bcdef536ceb5b2faf4ad3da57645398680f93cf97393834d3

Download Submit
C:\Windows\System\WRlTplW.exe

Filesize
3.0MB

MD5
708dbec7d4e1b55381b35f133eb32ec6

SHA1
c8edcdee7340c052aefaab4e5ff8b4f98a825c00

SHA256
a08f5b2b02117f76cdf86b3b46ffe43bde09eb60b7da53f9ed91e891c1ab4566

SHA512
ef41113f39bda377fa742d9927383a38fd48594fe08fb30fe7db43b954fe5b49bf80b85687a732257634c3942b3f832515067d7aca41d3ccefbb448c04fd5ce5

Download Submit
C:\Windows\System\XjhQzVK.exe

Filesize
3.0MB

MD5
3edc2f5e7807949fe8bd7dd3bfe9abbf

SHA1
48d0ef1aa5c1144d3605ea95d0ce3b21f0278334

SHA256
8c6577578f338df9fab307292643f0212c1bc6c3a3c8541721d0d4f2bc6663bc

SHA512
84f5c2ae6e88872acd574d151ceed0edaecab60c06295409e71ce060baad7c84985b6ce7eb6614bb05dbb1663257aacd67f92a34088877da808e483b52aaf06d

Download Submit
C:\Windows\System\YVgalWz.exe

Filesize
3.0MB

MD5
61accd7449f89a0e52d3ab57271f4aff

SHA1
66bd484674b05daa7927e6a602b60ecac068b399

SHA256
0adbc02552d282e13d6e2c739d715b779ee75e7f786a57feed5c1efc38314777

SHA512
b43556d1c311c62bba4cb80d07526de5160b8e07f5be755c72daa62bb376d987c3f5ac98e86734ce192aa517666271aef6148cc09460f2b3415d66e04d08b3c2

Download Submit
C:\Windows\System\bGdxZkx.exe

Filesize
3.0MB

MD5
f91f5f53c6989e735614383b0f1f1b1b

SHA1
de0ee3101a26becc341484bc2b2bbd47f3b77b07

SHA256
e7cc19677fca0a9f279284216b5250f022ef51809ec7a9a61629c08ddd6dccd6

SHA512
d40db0565c5420f50b662428011237c7b89d7f19d54ea20e018a5095f4d0d2be4867462c1f89c138757f837e4c68c2d421a1143192c9e7b913a6ff37bbd51451

Download Submit
C:\Windows\System\bkkoxZe.exe

Filesize
3.0MB

MD5
74b818593e7f49e1c591be04f3776bb4

SHA1
5ae1364658aa509a0f77bac8f7144d8fcd99d2af

SHA256
103cba7d827b188d55347142e0197cf4e1b30904134ba96e89ceaedd346b9b52

SHA512
cfea8f2005008304bb5dfd86f98aa2120e971358c2855b6cfa4db0c263c2149883e4275c0fc05b39845e51ab537fa6b065ec96f648503606be4c6d39e5a6096f

Download Submit
C:\Windows\System\bmYHcRd.exe

Filesize
3.0MB

MD5
c95334221cc07c3c1615ae87d807d3f4

SHA1
6bc522e8ba5b77e91706733ce7cbb17178dd9606

SHA256
b177ccc44abb77ac0baa06bca21339451cd090ff2fa7b5f79eceabc46f001630

SHA512
8e6d612ec7b6ebf57d278d516fc5b8b1b928ae33599bd92c4526073bdb44a2b537a017db27d080679fb15e6fa3d2044a30640dc11858fc95a4eae4c73411622c

Download Submit
C:\Windows\System\cmeuuBr.exe

Filesize
3.0MB

MD5
094681fc4c37049948f31e8f9cc31f86

SHA1
6a390d1a13feb30feabef35bc35183d649c69454

SHA256
e58e8b93b6576f009ccbfe1ba70f845f8c0d36a8c9c979d59f932b149d9a7ef9

SHA512
fbdbe34b4f05a57517cc37332a75c52b43fcc253cd9d592f1f0be85f5c5f1a4860ea4fc1c09c5c13f2c8b4d2be10897887b177a096a646ddcf858a7641d1654f

Download Submit
C:\Windows\System\eOIIyEh.exe

Filesize
3.0MB

MD5
f4aba931f93fb65b97188c30890ce086

SHA1
b988a5be1ca9175d880486e7943c24baec966f03

SHA256
a411aa998225a86266503e5b20491b3dfb390d9c33283ca4e33e70383b55536e

SHA512
59ae7517e50ac23213f72d71419a0bcb9fb029f2e931cadc9e6434b3714f010bdf518207c19718c486cff4c2e0eabaaf26cf6bfaa7acb96101b4057e4254bc77

Download Submit
C:\Windows\System\fcJshmF.exe

Filesize
3.0MB

MD5
52e2dcbee98020d56113903a2b819ca0

SHA1
28fba3a82b19b2e9c6adb3b55912ccaee435d34a

SHA256
63384b420e44bc885ead211122a54a11066cfa852c8122bee31493b79db6cb30

SHA512
6fce59a519d3ada326f49e3be511bf3d0f907c6ad2af8b1d228c4d5094bcfb6304c3271b73de65a6c9f3716fcd489ba08fd3948b0952faf9c5e3b6f6f2c509c7

Download Submit
C:\Windows\System\hGGUypI.exe

Filesize
3.0MB

MD5
61da51e95cae0194bebbc9f0263856d4

SHA1
fccc6050e29da4146629d7e3f60da70ac778330c

SHA256
1bdebcfe77e4d9b812a81b31b7cb17f1ea74ff74fbfdb29fd4a9d4cecc43df5a

SHA512
81088536332eb9a0c0cbc40a84e86cf1565194bffade66ee8ae83388530c6ab0e8b8fafcbe899b354fc187dff3e0cf787467251f8c9e699c333f51234f0988b9

Download Submit
C:\Windows\System\hdSNYyY.exe

Filesize
8B

MD5
e216125f6ec8a71ed511fce858ed30eb

SHA1
050cc8d12c9a1af3716df8cd26567943726d3366

SHA256
2097394cabc160a9df2f746df2b02abe3caad35caebdb855f94e869ef6004673

SHA512
1ac9f8982e0ad73ffc5075b337a3e3f491f85f11a7d1a7e27a4798e5b39f52143905d90909f5a0732fa6e625f6b0719a56e5ded5ac563b3a5f32c20c4c30e446

Download Submit
C:\Windows\System\nKMwVBC.exe

Filesize
3.0MB

MD5
31d4105766efa177f54c1720cca0314b

SHA1
5fab8ece718396d66de0c35d54bb6c1fc08567af

SHA256
ac0032190b1c9ea41f10079f7ed9e3803cd675e6d2c72a7c6134bf3aab2d76af

SHA512
0b3a5b39c0476d21db1a4c6570f430065d771f150d9f41724e7b24ededb4a611545e3129348604336773ed1b755f028e8f5f1cd0dc216c744a8eeb4451128a65

Download Submit
C:\Windows\System\pbcHZBt.exe

Filesize
3.0MB

MD5
d47cd4f46066a6ebee96b32773f57ad6

SHA1
786fbbc30eb51edd9fa4318e1b7a89a496e0dbd6

SHA256
d435ce7943de321e849f0cc8ecaf92ea5c84c6dd011f43f57b6e4082851e27f9

SHA512
f8c798a1564cb48fdd5a4bdbdc866d02a9b06f60546aa40fe7448ddc8a5c9b0ce53a1902ce02c56a23626a3f4d16fe287d5e4182b34fd5b33a578d1b2f94fa5c

Download Submit
C:\Windows\System\qNZxgdI.exe

Filesize
3.0MB

MD5
ebb82d537631a7c582c76d0d224dfd9f

SHA1
e25265d04104ba36aa0b161c0359369985b0a481

SHA256
0f322be285641fa2265f03ee36e75202129c4f231acef53b40a2ebf4e196d151

SHA512
7994ff729ad2f3be2acb4ad54f035d4ff7eaf269decf0eefa414bd0036ea214d86f2a983befe40707c47466ee9d15bf8b13894f06f60678a9e71fe7c87e429ee

Download Submit
C:\Windows\System\tSoYDZK.exe

Filesize
3.0MB

MD5
90610031619026984e55cc558d2ce8b2

SHA1
7db3caedf262d412b55fdfb04ca8db61ce5c6ecc

SHA256
dd1b1f2a0e68c8c01f1f1275607f905e1827764133acd69d7a37392b3c028148

SHA512
037fda9c2c3b5c5ba2eedc59111df8971d78e2916ede6eee3fa056d85f96d9454334219173bdd84b836cc863745e65a40517604956cd1334673aa2f7d7a0930f

Download Submit
C:\Windows\System\tfekIvr.exe

Filesize
3.0MB

MD5
0cb9ad649a47c12d589885af8a52ff64

SHA1
caa278941e976a39c8fb995ce8e2e64382a9e679

SHA256
0a2f82f2f4a79b2a38b9c92ffe99f14b1c310e60835f899d1edee5df843cd256

SHA512
9a438a5b69c417aebb8c4878f7421220cc0e658e5fcd258c1005e59f249df195773ba7aa433b7c0b8321299c74ac76b9f44490f09b3236dd2741f9d763f02161

Download Submit
C:\Windows\System\uozjSTQ.exe

Filesize
3.0MB

MD5
709057496b16547dd1be7497d8cf5dca

SHA1
5ecfe5b5a8a9812d1dd16fb23327216a4a574662

SHA256
39240db7faca1d335f6337802a5d00bd3be4b420402f25457c5dc12b8ae49798

SHA512
81b8b09fd2c97e3d53db91e62f26804cde053dc2b47997a1376f40528c9b4c252b8c588deb83db82e118822cedc2b37eae684265b806f71c067d543b368cc3b0

Download Submit
C:\Windows\System\vVEscbw.exe

Filesize
3.0MB

MD5
340da11ab557f3a3ab0c0295d4ee113f

SHA1
47a8a70937dbd98ff99d9b1c12166d720580ed3a

SHA256
77662287a612b01091bcfd8ff3686d63d9383bab26f2ecd582d4286918ef478f

SHA512
4d258991a75b0204f0bfaa08b82c59de58d0b55015c0cd8dbf1873f581d4792bb4cba8c9c0fe040fd2b78ba4f2f53ceed01365cb5388cb6aae56dbe7269482f8

Download Submit
C:\Windows\System\yFAwVgO.exe

Filesize
3.0MB

MD5
f262ce447795791139d7c6885549a5fe

SHA1
2ad14d30113ef3f7810fa975f9c944c925c5564f

SHA256
163c52f295c13b743c8af6243932ae97afae106e860463834ee1c3e71abd85f2

SHA512
d27737cf064f0e9ede450bbee8dec4498369289e240f19ca17cf44a612f0b3d5f6391916a55841d687bf634547cbfb9c7799d544f162ce02489247e52ec55264

Download Submit
C:\Windows\System\yxlOYXp.exe

Filesize
3.0MB

MD5
2434ad4c99cff4b5128268a5b154035d

SHA1
c10a8811fb5f1613fb07697f1d30cf7765413821

SHA256
26f755368b18a0117aeb46d8eda8e8e1f0729544f2b4bd719c9001f65924b91d

SHA512
54e1951e01d0911abdf9c377248c1c35accb929be1e9cf6b5ecfc5f25031209dae454da7e1be2a646beb4ef22b13cc7f52025bd1dbe34ced6cd17470ce681c87

Download Submit
C:\Windows\System\zdbmjoz.exe

Filesize
3.0MB

MD5
900418142e0ed9232d72bc5badae6660

SHA1
ddccfa31941cba33003eb0aeb39e3a3d578ae6d7

SHA256
c38f1afd4a507efb68ff73479f3289169bf140db1189cb72a1bdc1fff42e9509

SHA512
bbe444e5e89aca5dd654321fd273b4d4737bca4c59e15744c9c329f48d4b3d5fd51714e0de42af7e186496c709f4b6811833ad1850721f49e4dbb3713f75210c

Download Submit
memory/692-1-0x00000145E5310000-0x00000145E5320000-memory.dmp

Filesize
64KB

Download
memory/692-0-0x00007FF69F9B0000-0x00007FF69FDA6000-memory.dmp

Filesize
4.0MB

Download
memory/912-92-0x00007FF6DBC70000-0x00007FF6DC066000-memory.dmp

Filesize
4.0MB

Download
memory/1076-4505-0x00007FF66FD50000-0x00007FF670146000-memory.dmp

Filesize
4.0MB

Download
memory/1076-47-0x00007FF66FD50000-0x00007FF670146000-memory.dmp

Filesize
4.0MB

Download
memory/1556-2548-0x00007FF96DF73000-0x00007FF96DF75000-memory.dmp

Filesize
8KB

Download
memory/1556-27-0x00007FF96DF70000-0x00007FF96EA31000-memory.dmp

Filesize
10.8MB

Download
memory/1556-129-0x0000023F7FF80000-0x0000023F80726000-memory.dmp

Filesize
7.6MB

Download
memory/1556-36-0x00007FF96DF70000-0x00007FF96EA31000-memory.dmp

Filesize
10.8MB

Download
memory/1556-67-0x0000023F650B0000-0x0000023F650D2000-memory.dmp

Filesize
136KB

Download
memory/1556-5-0x00007FF96DF73000-0x00007FF96DF75000-memory.dmp

Filesize
8KB

Download
memory/1580-125-0x00007FF649DB0000-0x00007FF64A1A6000-memory.dmp

Filesize
4.0MB

Download
memory/1672-383-0x00007FF6A0230000-0x00007FF6A0626000-memory.dmp

Filesize
4.0MB

Download
memory/1924-123-0x00007FF7463D0000-0x00007FF7467C6000-memory.dmp

Filesize
4.0MB

Download
memory/2384-4516-0x00007FF6416C0000-0x00007FF641AB6000-memory.dmp

Filesize
4.0MB

Download
memory/2384-101-0x00007FF6416C0000-0x00007FF641AB6000-memory.dmp

Filesize
4.0MB

Download
memory/2512-128-0x00007FF757120000-0x00007FF757516000-memory.dmp

Filesize
4.0MB

Download
memory/2808-75-0x00007FF74F3A0000-0x00007FF74F796000-memory.dmp

Filesize
4.0MB

Download
memory/2832-108-0x00007FF7B6200000-0x00007FF7B65F6000-memory.dmp

Filesize
4.0MB

Download
memory/2832-4542-0x00007FF7B6200000-0x00007FF7B65F6000-memory.dmp

Filesize
4.0MB

Download
memory/3124-401-0x00007FF63A140000-0x00007FF63A536000-memory.dmp

Filesize
4.0MB

Download
memory/3264-118-0x00007FF7D7060000-0x00007FF7D7456000-memory.dmp

Filesize
4.0MB

Download
memory/3344-4548-0x00007FF6905A0000-0x00007FF690996000-memory.dmp

Filesize
4.0MB

Download
memory/3344-124-0x00007FF6905A0000-0x00007FF690996000-memory.dmp

Filesize
4.0MB

Download
memory/3372-4557-0x00007FF70F790000-0x00007FF70FB86000-memory.dmp

Filesize
4.0MB

Download
memory/3372-117-0x00007FF70F790000-0x00007FF70FB86000-memory.dmp

Filesize
4.0MB

Download
memory/3620-386-0x00007FF76EF90000-0x00007FF76F386000-memory.dmp

Filesize
4.0MB

Download
memory/4068-3524-0x00007FF64ABD0000-0x00007FF64AFC6000-memory.dmp

Filesize
4.0MB

Download
memory/4068-398-0x00007FF64ABD0000-0x00007FF64AFC6000-memory.dmp

Filesize
4.0MB

Download
memory/4136-115-0x00007FF756FC0000-0x00007FF7573B6000-memory.dmp

Filesize
4.0MB

Download
memory/4248-119-0x00007FF789900000-0x00007FF789CF6000-memory.dmp

Filesize
4.0MB

Download
memory/4264-4550-0x00007FF793170000-0x00007FF793566000-memory.dmp

Filesize
4.0MB

Download
memory/4264-116-0x00007FF793170000-0x00007FF793566000-memory.dmp

Filesize
4.0MB

Download
memory/4392-127-0x00007FF6F3B40000-0x00007FF6F3F36000-memory.dmp

Filesize
4.0MB

Download
memory/4392-4588-0x00007FF6F3B40000-0x00007FF6F3F36000-memory.dmp

Filesize
4.0MB

Download
memory/4456-122-0x00007FF771320000-0x00007FF771716000-memory.dmp

Filesize
4.0MB

Download
memory/4744-120-0x00007FF79EE30000-0x00007FF79F226000-memory.dmp

Filesize
4.0MB

Download
memory/4744-4555-0x00007FF79EE30000-0x00007FF79F226000-memory.dmp

Filesize
4.0MB

Download
memory/4748-4567-0x00007FF7C8EC0000-0x00007FF7C92B6000-memory.dmp

Filesize
4.0MB

Download
memory/4748-121-0x00007FF7C8EC0000-0x00007FF7C92B6000-memory.dmp

Filesize
4.0MB

Download
memory/4864-126-0x00007FF7BCB30000-0x00007FF7BCF26000-memory.dmp

Filesize
4.0MB

Download
memory/4928-433-0x00007FF64FCA0000-0x00007FF650096000-memory.dmp

Filesize
4.0MB

Download