xmrig | 9ff10226f6a2857c101b288c0064766b0804ce806e76dfe5c11ef4693c058120

Analysis

max time kernel
151s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
13/06/2024, 21:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

876413258b4a9d6a7d79513d28a5afb0_NeikiAnalytics.exe
Size

3.1MB
MD5

876413258b4a9d6a7d79513d28a5afb0
SHA1

8d39d9d631c7a9c4d36d55a376587014fa1ea28e
SHA256

9ff10226f6a2857c101b288c0064766b0804ce806e76dfe5c11ef4693c058120
SHA512

ade03804659cb0676f026566a7bb278467fdd243a614cf22983f0994b7d6ede1020885a20e1bbb072472d0dbd6f430ef8b5f17615353f63a3b4ef9079aa99bae
SSDEEP

98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWg:7bBeSFkE

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral2/memory/628-0-0x00007FF71F210000-0x00007FF71F606000-memory.dmp	xmrig
behavioral2/files/0x0008000000023268-7.dat	xmrig
behavioral2/files/0x000800000002326c-21.dat	xmrig
behavioral2/files/0x0007000000023271-17.dat	xmrig
behavioral2/files/0x000900000002326f-31.dat	xmrig
behavioral2/memory/2032-34-0x00007FF6A79B0000-0x00007FF6A7DA6000-memory.dmp	xmrig
behavioral2/memory/2204-35-0x00007FF64BEC0000-0x00007FF64C2B6000-memory.dmp	xmrig
behavioral2/memory/2972-36-0x00007FF7494B0000-0x00007FF7498A6000-memory.dmp	xmrig
behavioral2/memory/1620-37-0x00007FF77C3F0000-0x00007FF77C7E6000-memory.dmp	xmrig
behavioral2/files/0x000800000002326d-39.dat	xmrig
behavioral2/memory/2108-42-0x00007FF7FEC60000-0x00007FF7FF056000-memory.dmp	xmrig
behavioral2/files/0x0009000000023270-48.dat	xmrig
behavioral2/files/0x0007000000023272-53.dat	xmrig
behavioral2/memory/1212-56-0x00007FF67FA50000-0x00007FF67FE46000-memory.dmp	xmrig
behavioral2/files/0x0007000000023275-63.dat	xmrig
behavioral2/memory/1072-74-0x00007FF6584E0000-0x00007FF6588D6000-memory.dmp	xmrig
behavioral2/files/0x000700000002327d-106.dat	xmrig
behavioral2/files/0x000700000002327b-109.dat	xmrig
behavioral2/memory/4604-108-0x00007FF79A340000-0x00007FF79A736000-memory.dmp	xmrig
behavioral2/files/0x000700000002327c-105.dat	xmrig
behavioral2/files/0x000700000002327a-103.dat	xmrig
behavioral2/files/0x0007000000023277-98.dat	xmrig
behavioral2/memory/4476-97-0x00007FF706070000-0x00007FF706466000-memory.dmp	xmrig
behavioral2/files/0x0007000000023278-95.dat	xmrig
behavioral2/files/0x0007000000023279-90.dat	xmrig
behavioral2/memory/2672-87-0x00007FF64ED00000-0x00007FF64F0F6000-memory.dmp	xmrig
behavioral2/files/0x0007000000023276-80.dat	xmrig
behavioral2/memory/380-78-0x00007FF687420000-0x00007FF687816000-memory.dmp	xmrig
behavioral2/files/0x0007000000023274-71.dat	xmrig
behavioral2/memory/2268-61-0x00007FF7801E0000-0x00007FF7805D6000-memory.dmp	xmrig
behavioral2/files/0x000700000002327f-129.dat	xmrig
behavioral2/files/0x0007000000023281-141.dat	xmrig
behavioral2/files/0x0007000000023283-152.dat	xmrig
behavioral2/memory/1560-160-0x00007FF740000000-0x00007FF7403F6000-memory.dmp	xmrig
behavioral2/memory/3304-163-0x00007FF7D8140000-0x00007FF7D8536000-memory.dmp	xmrig
behavioral2/memory/2596-164-0x00007FF718A30000-0x00007FF718E26000-memory.dmp	xmrig
behavioral2/memory/2868-162-0x00007FF7F7500000-0x00007FF7F78F6000-memory.dmp	xmrig
behavioral2/memory/3328-161-0x00007FF7FD920000-0x00007FF7FDD16000-memory.dmp	xmrig
behavioral2/memory/2528-159-0x00007FF664900000-0x00007FF664CF6000-memory.dmp	xmrig
behavioral2/memory/4464-158-0x00007FF7A0170000-0x00007FF7A0566000-memory.dmp	xmrig
behavioral2/files/0x0007000000023285-156.dat	xmrig
behavioral2/files/0x0007000000023284-154.dat	xmrig
behavioral2/files/0x0007000000023282-150.dat	xmrig
behavioral2/memory/3804-149-0x00007FF7A1D90000-0x00007FF7A2186000-memory.dmp	xmrig
behavioral2/memory/700-147-0x00007FF6F37D0000-0x00007FF6F3BC6000-memory.dmp	xmrig
behavioral2/files/0x0007000000023280-139.dat	xmrig
behavioral2/memory/3024-128-0x00007FF72DA60000-0x00007FF72DE56000-memory.dmp	xmrig
behavioral2/files/0x000700000002327e-125.dat	xmrig
behavioral2/memory/4176-115-0x00007FF65BD90000-0x00007FF65C186000-memory.dmp	xmrig
behavioral2/memory/3540-110-0x00007FF7F12E0000-0x00007FF7F16D6000-memory.dmp	xmrig
behavioral2/files/0x0007000000023287-172.dat	xmrig
behavioral2/files/0x0007000000023286-175.dat	xmrig
behavioral2/files/0x0007000000023288-176.dat	xmrig
behavioral2/files/0x0007000000023289-189.dat	xmrig
behavioral2/files/0x000700000002328a-188.dat	xmrig
behavioral2/files/0x000a000000016fa5-199.dat	xmrig
behavioral2/files/0x000700000002328c-195.dat	xmrig
behavioral2/memory/628-376-0x00007FF71F210000-0x00007FF71F606000-memory.dmp	xmrig
behavioral2/memory/2972-651-0x00007FF7494B0000-0x00007FF7498A6000-memory.dmp	xmrig
behavioral2/memory/1620-1548-0x00007FF77C3F0000-0x00007FF77C7E6000-memory.dmp	xmrig
behavioral2/memory/2032-1562-0x00007FF6A79B0000-0x00007FF6A7DA6000-memory.dmp	xmrig
behavioral2/memory/2204-1587-0x00007FF64BEC0000-0x00007FF64C2B6000-memory.dmp	xmrig
behavioral2/memory/1072-1690-0x00007FF6584E0000-0x00007FF6588D6000-memory.dmp	xmrig
behavioral2/memory/4176-1695-0x00007FF65BD90000-0x00007FF65C186000-memory.dmp	xmrig

Blocklisted process makes network request 6 IoCs

flow	pid	Process
6	4480	powershell.exe
10	4480	powershell.exe
26	4480	powershell.exe
27	4480	powershell.exe
29	4480	powershell.exe
35	4480	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
4480	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
1620	IaBstFx.exe
2032	CFlbAWF.exe
2204	YJvnAgo.exe
2972	YbMnqdQ.exe
2108	qIcoTDn.exe
1212	kHygmEq.exe
2268	AxwQncM.exe
1072	WNoCNzA.exe
380	qZcixdH.exe
2672	FEIiPMy.exe
4476	hjZBwdK.exe
3024	XUsMwUP.exe
4604	UENtwTv.exe
700	PUnMEdk.exe
3804	hDegcGR.exe
3540	QewTAWg.exe
4176	SFuqhnf.exe
4464	oEFXDJG.exe
2528	zYyATSR.exe
3304	QZKZThu.exe
1560	TYMEley.exe
2596	qPTufqS.exe
3328	VhTYQCH.exe
2868	xnCEKdg.exe
2364	vQKvUeS.exe
640	qDTKpmk.exe
4136	gecySwh.exe
1612	RzpgWVl.exe
3212	kKKPhDk.exe
4848	nwrTezW.exe
1592	vVzHkwo.exe
2352	pobqwTS.exe
5104	HCvqjYS.exe
3868	EvnYbqc.exe
3792	UBdxhjl.exe
4940	GAfjyLw.exe
332	RFonnqP.exe
4908	CEbETef.exe
4028	opwYInZ.exe
3536	sgHyoSl.exe
2524	Efljsxo.exe
752	YfTxAtS.exe
1164	FaNgSiL.exe
2028	PopPRil.exe
564	EZWyfHO.exe
3940	YQegquC.exe
5028	DjxhssV.exe
1360	NVUitez.exe
436	Hsiiekj.exe
880	gTXGlIl.exe
3232	POwtuen.exe
4036	NOAsiWG.exe
1556	hkimWfq.exe
4996	nniELOX.exe
1256	YjpoIoM.exe
1088	dwZabEe.exe
1912	vWGmcIl.exe
1836	VcfMqrj.exe
5112	XOfZsvo.exe
3916	IXBtggS.exe
1112	iInTKnE.exe
4416	LdhlboL.exe
1800	PaJMnjH.exe
960	DyCFWIQ.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/628-0-0x00007FF71F210000-0x00007FF71F606000-memory.dmp	upx
behavioral2/files/0x0008000000023268-7.dat	upx
behavioral2/files/0x000800000002326c-21.dat	upx
behavioral2/files/0x0007000000023271-17.dat	upx
behavioral2/files/0x000900000002326f-31.dat	upx
behavioral2/memory/2032-34-0x00007FF6A79B0000-0x00007FF6A7DA6000-memory.dmp	upx
behavioral2/memory/2204-35-0x00007FF64BEC0000-0x00007FF64C2B6000-memory.dmp	upx
behavioral2/memory/2972-36-0x00007FF7494B0000-0x00007FF7498A6000-memory.dmp	upx
behavioral2/memory/1620-37-0x00007FF77C3F0000-0x00007FF77C7E6000-memory.dmp	upx
behavioral2/files/0x000800000002326d-39.dat	upx
behavioral2/memory/2108-42-0x00007FF7FEC60000-0x00007FF7FF056000-memory.dmp	upx
behavioral2/files/0x0009000000023270-48.dat	upx
behavioral2/files/0x0007000000023272-53.dat	upx
behavioral2/memory/1212-56-0x00007FF67FA50000-0x00007FF67FE46000-memory.dmp	upx
behavioral2/files/0x0007000000023275-63.dat	upx
behavioral2/memory/1072-74-0x00007FF6584E0000-0x00007FF6588D6000-memory.dmp	upx
behavioral2/files/0x000700000002327d-106.dat	upx
behavioral2/files/0x000700000002327b-109.dat	upx
behavioral2/memory/4604-108-0x00007FF79A340000-0x00007FF79A736000-memory.dmp	upx
behavioral2/files/0x000700000002327c-105.dat	upx
behavioral2/files/0x000700000002327a-103.dat	upx
behavioral2/files/0x0007000000023277-98.dat	upx
behavioral2/memory/4476-97-0x00007FF706070000-0x00007FF706466000-memory.dmp	upx
behavioral2/files/0x0007000000023278-95.dat	upx
behavioral2/files/0x0007000000023279-90.dat	upx
behavioral2/memory/2672-87-0x00007FF64ED00000-0x00007FF64F0F6000-memory.dmp	upx
behavioral2/files/0x0007000000023276-80.dat	upx
behavioral2/memory/380-78-0x00007FF687420000-0x00007FF687816000-memory.dmp	upx
behavioral2/files/0x0007000000023274-71.dat	upx
behavioral2/memory/2268-61-0x00007FF7801E0000-0x00007FF7805D6000-memory.dmp	upx
behavioral2/files/0x000700000002327f-129.dat	upx
behavioral2/files/0x0007000000023281-141.dat	upx
behavioral2/files/0x0007000000023283-152.dat	upx
behavioral2/memory/1560-160-0x00007FF740000000-0x00007FF7403F6000-memory.dmp	upx
behavioral2/memory/3304-163-0x00007FF7D8140000-0x00007FF7D8536000-memory.dmp	upx
behavioral2/memory/2596-164-0x00007FF718A30000-0x00007FF718E26000-memory.dmp	upx
behavioral2/memory/2868-162-0x00007FF7F7500000-0x00007FF7F78F6000-memory.dmp	upx
behavioral2/memory/3328-161-0x00007FF7FD920000-0x00007FF7FDD16000-memory.dmp	upx
behavioral2/memory/2528-159-0x00007FF664900000-0x00007FF664CF6000-memory.dmp	upx
behavioral2/memory/4464-158-0x00007FF7A0170000-0x00007FF7A0566000-memory.dmp	upx
behavioral2/files/0x0007000000023285-156.dat	upx
behavioral2/files/0x0007000000023284-154.dat	upx
behavioral2/files/0x0007000000023282-150.dat	upx
behavioral2/memory/3804-149-0x00007FF7A1D90000-0x00007FF7A2186000-memory.dmp	upx
behavioral2/memory/700-147-0x00007FF6F37D0000-0x00007FF6F3BC6000-memory.dmp	upx
behavioral2/files/0x0007000000023280-139.dat	upx
behavioral2/memory/3024-128-0x00007FF72DA60000-0x00007FF72DE56000-memory.dmp	upx
behavioral2/files/0x000700000002327e-125.dat	upx
behavioral2/memory/4176-115-0x00007FF65BD90000-0x00007FF65C186000-memory.dmp	upx
behavioral2/memory/3540-110-0x00007FF7F12E0000-0x00007FF7F16D6000-memory.dmp	upx
behavioral2/files/0x0007000000023287-172.dat	upx
behavioral2/files/0x0007000000023286-175.dat	upx
behavioral2/files/0x0007000000023288-176.dat	upx
behavioral2/files/0x0007000000023289-189.dat	upx
behavioral2/files/0x000700000002328a-188.dat	upx
behavioral2/files/0x000a000000016fa5-199.dat	upx
behavioral2/files/0x000700000002328c-195.dat	upx
behavioral2/memory/628-376-0x00007FF71F210000-0x00007FF71F606000-memory.dmp	upx
behavioral2/memory/2972-651-0x00007FF7494B0000-0x00007FF7498A6000-memory.dmp	upx
behavioral2/memory/1620-1548-0x00007FF77C3F0000-0x00007FF77C7E6000-memory.dmp	upx
behavioral2/memory/2032-1562-0x00007FF6A79B0000-0x00007FF6A7DA6000-memory.dmp	upx
behavioral2/memory/2204-1587-0x00007FF64BEC0000-0x00007FF64C2B6000-memory.dmp	upx
behavioral2/memory/1072-1690-0x00007FF6584E0000-0x00007FF6588D6000-memory.dmp	upx
behavioral2/memory/4176-1695-0x00007FF65BD90000-0x00007FF65C186000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
4	raw.githubusercontent.com
6	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\klCPphH.exe	876413258b4a9d6a7d79513d28a5afb0_NeikiAnalytics.exe
File created	C:\Windows\System\DFYQewi.exe	876413258b4a9d6a7d79513d28a5afb0_NeikiAnalytics.exe
File created	C:\Windows\System\gEDGVqU.exe	876413258b4a9d6a7d79513d28a5afb0_NeikiAnalytics.exe
File created	C:\Windows\System\yUYtIpp.exe	876413258b4a9d6a7d79513d28a5afb0_NeikiAnalytics.exe
File created	C:\Windows\System\JbYZxud.exe	876413258b4a9d6a7d79513d28a5afb0_NeikiAnalytics.exe
File created	C:\Windows\System\ADIvNgZ.exe	876413258b4a9d6a7d79513d28a5afb0_NeikiAnalytics.exe
File created	C:\Windows\System\jYevTED.exe	876413258b4a9d6a7d79513d28a5afb0_NeikiAnalytics.exe
File created	C:\Windows\System\xhGgljt.exe	876413258b4a9d6a7d79513d28a5afb0_NeikiAnalytics.exe
File created	C:\Windows\System\ipSpvlP.exe	876413258b4a9d6a7d79513d28a5afb0_NeikiAnalytics.exe
File created	C:\Windows\System\USbwFMC.exe	876413258b4a9d6a7d79513d28a5afb0_NeikiAnalytics.exe
File created	C:\Windows\System\gnIbPVs.exe	876413258b4a9d6a7d79513d28a5afb0_NeikiAnalytics.exe
File created	C:\Windows\System\qfhhoxA.exe	876413258b4a9d6a7d79513d28a5afb0_NeikiAnalytics.exe
File created	C:\Windows\System\rDObNTr.exe	876413258b4a9d6a7d79513d28a5afb0_NeikiAnalytics.exe
File created	C:\Windows\System\JybqjBR.exe	876413258b4a9d6a7d79513d28a5afb0_NeikiAnalytics.exe
File created	C:\Windows\System\sVaGogl.exe	876413258b4a9d6a7d79513d28a5afb0_NeikiAnalytics.exe
File created	C:\Windows\System\rPuQnHj.exe	876413258b4a9d6a7d79513d28a5afb0_NeikiAnalytics.exe
File created	C:\Windows\System\RJePemP.exe	876413258b4a9d6a7d79513d28a5afb0_NeikiAnalytics.exe
File created	C:\Windows\System\bWNViFG.exe	876413258b4a9d6a7d79513d28a5afb0_NeikiAnalytics.exe
File created	C:\Windows\System\vVzHkwo.exe	876413258b4a9d6a7d79513d28a5afb0_NeikiAnalytics.exe
File created	C:\Windows\System\LlgSLgj.exe	876413258b4a9d6a7d79513d28a5afb0_NeikiAnalytics.exe
File created	C:\Windows\System\PLdhWAE.exe	876413258b4a9d6a7d79513d28a5afb0_NeikiAnalytics.exe
File created	C:\Windows\System\ISbmsWI.exe	876413258b4a9d6a7d79513d28a5afb0_NeikiAnalytics.exe
File created	C:\Windows\System\AjjMNOc.exe	876413258b4a9d6a7d79513d28a5afb0_NeikiAnalytics.exe
File created	C:\Windows\System\UBdxhjl.exe	876413258b4a9d6a7d79513d28a5afb0_NeikiAnalytics.exe
File created	C:\Windows\System\PrENPku.exe	876413258b4a9d6a7d79513d28a5afb0_NeikiAnalytics.exe
File created	C:\Windows\System\JjnhUdw.exe	876413258b4a9d6a7d79513d28a5afb0_NeikiAnalytics.exe
File created	C:\Windows\System\YqhOtEI.exe	876413258b4a9d6a7d79513d28a5afb0_NeikiAnalytics.exe
File created	C:\Windows\System\eUwyTQy.exe	876413258b4a9d6a7d79513d28a5afb0_NeikiAnalytics.exe
File created	C:\Windows\System\GBSitXg.exe	876413258b4a9d6a7d79513d28a5afb0_NeikiAnalytics.exe
File created	C:\Windows\System\VHedNFL.exe	876413258b4a9d6a7d79513d28a5afb0_NeikiAnalytics.exe
File created	C:\Windows\System\iCjqqHG.exe	876413258b4a9d6a7d79513d28a5afb0_NeikiAnalytics.exe
File created	C:\Windows\System\nNoRewy.exe	876413258b4a9d6a7d79513d28a5afb0_NeikiAnalytics.exe
File created	C:\Windows\System\vmkwZEl.exe	876413258b4a9d6a7d79513d28a5afb0_NeikiAnalytics.exe
File created	C:\Windows\System\GXakHsB.exe	876413258b4a9d6a7d79513d28a5afb0_NeikiAnalytics.exe
File created	C:\Windows\System\mOZxEad.exe	876413258b4a9d6a7d79513d28a5afb0_NeikiAnalytics.exe
File created	C:\Windows\System\poDTDLz.exe	876413258b4a9d6a7d79513d28a5afb0_NeikiAnalytics.exe
File created	C:\Windows\System\yKRptCW.exe	876413258b4a9d6a7d79513d28a5afb0_NeikiAnalytics.exe
File created	C:\Windows\System\yIQOpde.exe	876413258b4a9d6a7d79513d28a5afb0_NeikiAnalytics.exe
File created	C:\Windows\System\sMOolTI.exe	876413258b4a9d6a7d79513d28a5afb0_NeikiAnalytics.exe
File created	C:\Windows\System\rFPjuAx.exe	876413258b4a9d6a7d79513d28a5afb0_NeikiAnalytics.exe
File created	C:\Windows\System\tyaBXZT.exe	876413258b4a9d6a7d79513d28a5afb0_NeikiAnalytics.exe
File created	C:\Windows\System\otsITnN.exe	876413258b4a9d6a7d79513d28a5afb0_NeikiAnalytics.exe
File created	C:\Windows\System\ttHFdsC.exe	876413258b4a9d6a7d79513d28a5afb0_NeikiAnalytics.exe
File created	C:\Windows\System\uImxrvt.exe	876413258b4a9d6a7d79513d28a5afb0_NeikiAnalytics.exe
File created	C:\Windows\System\hIbrrTY.exe	876413258b4a9d6a7d79513d28a5afb0_NeikiAnalytics.exe
File created	C:\Windows\System\iVcgeyx.exe	876413258b4a9d6a7d79513d28a5afb0_NeikiAnalytics.exe
File created	C:\Windows\System\hIZDPWS.exe	876413258b4a9d6a7d79513d28a5afb0_NeikiAnalytics.exe
File created	C:\Windows\System\hZyYuAZ.exe	876413258b4a9d6a7d79513d28a5afb0_NeikiAnalytics.exe
File created	C:\Windows\System\nwrTezW.exe	876413258b4a9d6a7d79513d28a5afb0_NeikiAnalytics.exe
File created	C:\Windows\System\nWNqhNj.exe	876413258b4a9d6a7d79513d28a5afb0_NeikiAnalytics.exe
File created	C:\Windows\System\IUukaCw.exe	876413258b4a9d6a7d79513d28a5afb0_NeikiAnalytics.exe
File created	C:\Windows\System\POEknQf.exe	876413258b4a9d6a7d79513d28a5afb0_NeikiAnalytics.exe
File created	C:\Windows\System\CAvQjRp.exe	876413258b4a9d6a7d79513d28a5afb0_NeikiAnalytics.exe
File created	C:\Windows\System\rpmTppP.exe	876413258b4a9d6a7d79513d28a5afb0_NeikiAnalytics.exe
File created	C:\Windows\System\QnwoDey.exe	876413258b4a9d6a7d79513d28a5afb0_NeikiAnalytics.exe
File created	C:\Windows\System\kZAnTFq.exe	876413258b4a9d6a7d79513d28a5afb0_NeikiAnalytics.exe
File created	C:\Windows\System\gNserFn.exe	876413258b4a9d6a7d79513d28a5afb0_NeikiAnalytics.exe
File created	C:\Windows\System\SSPXbMD.exe	876413258b4a9d6a7d79513d28a5afb0_NeikiAnalytics.exe
File created	C:\Windows\System\ZCqxpyg.exe	876413258b4a9d6a7d79513d28a5afb0_NeikiAnalytics.exe
File created	C:\Windows\System\rLBdGsF.exe	876413258b4a9d6a7d79513d28a5afb0_NeikiAnalytics.exe
File created	C:\Windows\System\mVtSOHT.exe	876413258b4a9d6a7d79513d28a5afb0_NeikiAnalytics.exe
File created	C:\Windows\System\NUahIlx.exe	876413258b4a9d6a7d79513d28a5afb0_NeikiAnalytics.exe
File created	C:\Windows\System\AuxubMD.exe	876413258b4a9d6a7d79513d28a5afb0_NeikiAnalytics.exe
File created	C:\Windows\System\UENtwTv.exe	876413258b4a9d6a7d79513d28a5afb0_NeikiAnalytics.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
4480	powershell.exe
4480	powershell.exe
4480	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	628	876413258b4a9d6a7d79513d28a5afb0_NeikiAnalytics.exe
Token: SeDebugPrivilege	4480	powershell.exe
Token: SeLockMemoryPrivilege	628	876413258b4a9d6a7d79513d28a5afb0_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 628 wrote to memory of 4480	628	876413258b4a9d6a7d79513d28a5afb0_NeikiAnalytics.exe	92
PID 628 wrote to memory of 4480	628	876413258b4a9d6a7d79513d28a5afb0_NeikiAnalytics.exe	92
PID 628 wrote to memory of 1620	628	876413258b4a9d6a7d79513d28a5afb0_NeikiAnalytics.exe	93
PID 628 wrote to memory of 1620	628	876413258b4a9d6a7d79513d28a5afb0_NeikiAnalytics.exe	93
PID 628 wrote to memory of 2032	628	876413258b4a9d6a7d79513d28a5afb0_NeikiAnalytics.exe	94
PID 628 wrote to memory of 2032	628	876413258b4a9d6a7d79513d28a5afb0_NeikiAnalytics.exe	94
PID 628 wrote to memory of 2204	628	876413258b4a9d6a7d79513d28a5afb0_NeikiAnalytics.exe	95
PID 628 wrote to memory of 2204	628	876413258b4a9d6a7d79513d28a5afb0_NeikiAnalytics.exe	95
PID 628 wrote to memory of 2972	628	876413258b4a9d6a7d79513d28a5afb0_NeikiAnalytics.exe	96
PID 628 wrote to memory of 2972	628	876413258b4a9d6a7d79513d28a5afb0_NeikiAnalytics.exe	96
PID 628 wrote to memory of 2108	628	876413258b4a9d6a7d79513d28a5afb0_NeikiAnalytics.exe	97
PID 628 wrote to memory of 2108	628	876413258b4a9d6a7d79513d28a5afb0_NeikiAnalytics.exe	97
PID 628 wrote to memory of 1212	628	876413258b4a9d6a7d79513d28a5afb0_NeikiAnalytics.exe	98
PID 628 wrote to memory of 1212	628	876413258b4a9d6a7d79513d28a5afb0_NeikiAnalytics.exe	98
PID 628 wrote to memory of 2268	628	876413258b4a9d6a7d79513d28a5afb0_NeikiAnalytics.exe	99
PID 628 wrote to memory of 2268	628	876413258b4a9d6a7d79513d28a5afb0_NeikiAnalytics.exe	99
PID 628 wrote to memory of 1072	628	876413258b4a9d6a7d79513d28a5afb0_NeikiAnalytics.exe	100
PID 628 wrote to memory of 1072	628	876413258b4a9d6a7d79513d28a5afb0_NeikiAnalytics.exe	100
PID 628 wrote to memory of 380	628	876413258b4a9d6a7d79513d28a5afb0_NeikiAnalytics.exe	101
PID 628 wrote to memory of 380	628	876413258b4a9d6a7d79513d28a5afb0_NeikiAnalytics.exe	101
PID 628 wrote to memory of 2672	628	876413258b4a9d6a7d79513d28a5afb0_NeikiAnalytics.exe	102
PID 628 wrote to memory of 2672	628	876413258b4a9d6a7d79513d28a5afb0_NeikiAnalytics.exe	102
PID 628 wrote to memory of 3024	628	876413258b4a9d6a7d79513d28a5afb0_NeikiAnalytics.exe	103
PID 628 wrote to memory of 3024	628	876413258b4a9d6a7d79513d28a5afb0_NeikiAnalytics.exe	103
PID 628 wrote to memory of 4476	628	876413258b4a9d6a7d79513d28a5afb0_NeikiAnalytics.exe	104
PID 628 wrote to memory of 4476	628	876413258b4a9d6a7d79513d28a5afb0_NeikiAnalytics.exe	104
PID 628 wrote to memory of 4604	628	876413258b4a9d6a7d79513d28a5afb0_NeikiAnalytics.exe	105
PID 628 wrote to memory of 4604	628	876413258b4a9d6a7d79513d28a5afb0_NeikiAnalytics.exe	105
PID 628 wrote to memory of 700	628	876413258b4a9d6a7d79513d28a5afb0_NeikiAnalytics.exe	106
PID 628 wrote to memory of 700	628	876413258b4a9d6a7d79513d28a5afb0_NeikiAnalytics.exe	106
PID 628 wrote to memory of 3804	628	876413258b4a9d6a7d79513d28a5afb0_NeikiAnalytics.exe	107
PID 628 wrote to memory of 3804	628	876413258b4a9d6a7d79513d28a5afb0_NeikiAnalytics.exe	107
PID 628 wrote to memory of 3540	628	876413258b4a9d6a7d79513d28a5afb0_NeikiAnalytics.exe	108
PID 628 wrote to memory of 3540	628	876413258b4a9d6a7d79513d28a5afb0_NeikiAnalytics.exe	108
PID 628 wrote to memory of 4176	628	876413258b4a9d6a7d79513d28a5afb0_NeikiAnalytics.exe	109
PID 628 wrote to memory of 4176	628	876413258b4a9d6a7d79513d28a5afb0_NeikiAnalytics.exe	109
PID 628 wrote to memory of 4464	628	876413258b4a9d6a7d79513d28a5afb0_NeikiAnalytics.exe	110
PID 628 wrote to memory of 4464	628	876413258b4a9d6a7d79513d28a5afb0_NeikiAnalytics.exe	110
PID 628 wrote to memory of 2528	628	876413258b4a9d6a7d79513d28a5afb0_NeikiAnalytics.exe	111
PID 628 wrote to memory of 2528	628	876413258b4a9d6a7d79513d28a5afb0_NeikiAnalytics.exe	111
PID 628 wrote to memory of 3304	628	876413258b4a9d6a7d79513d28a5afb0_NeikiAnalytics.exe	112
PID 628 wrote to memory of 3304	628	876413258b4a9d6a7d79513d28a5afb0_NeikiAnalytics.exe	112
PID 628 wrote to memory of 1560	628	876413258b4a9d6a7d79513d28a5afb0_NeikiAnalytics.exe	113
PID 628 wrote to memory of 1560	628	876413258b4a9d6a7d79513d28a5afb0_NeikiAnalytics.exe	113
PID 628 wrote to memory of 2596	628	876413258b4a9d6a7d79513d28a5afb0_NeikiAnalytics.exe	114
PID 628 wrote to memory of 2596	628	876413258b4a9d6a7d79513d28a5afb0_NeikiAnalytics.exe	114
PID 628 wrote to memory of 3328	628	876413258b4a9d6a7d79513d28a5afb0_NeikiAnalytics.exe	115
PID 628 wrote to memory of 3328	628	876413258b4a9d6a7d79513d28a5afb0_NeikiAnalytics.exe	115
PID 628 wrote to memory of 2868	628	876413258b4a9d6a7d79513d28a5afb0_NeikiAnalytics.exe	116
PID 628 wrote to memory of 2868	628	876413258b4a9d6a7d79513d28a5afb0_NeikiAnalytics.exe	116
PID 628 wrote to memory of 2364	628	876413258b4a9d6a7d79513d28a5afb0_NeikiAnalytics.exe	117
PID 628 wrote to memory of 2364	628	876413258b4a9d6a7d79513d28a5afb0_NeikiAnalytics.exe	117
PID 628 wrote to memory of 640	628	876413258b4a9d6a7d79513d28a5afb0_NeikiAnalytics.exe	118
PID 628 wrote to memory of 640	628	876413258b4a9d6a7d79513d28a5afb0_NeikiAnalytics.exe	118
PID 628 wrote to memory of 4136	628	876413258b4a9d6a7d79513d28a5afb0_NeikiAnalytics.exe	119
PID 628 wrote to memory of 4136	628	876413258b4a9d6a7d79513d28a5afb0_NeikiAnalytics.exe	119
PID 628 wrote to memory of 1612	628	876413258b4a9d6a7d79513d28a5afb0_NeikiAnalytics.exe	120
PID 628 wrote to memory of 1612	628	876413258b4a9d6a7d79513d28a5afb0_NeikiAnalytics.exe	120
PID 628 wrote to memory of 3212	628	876413258b4a9d6a7d79513d28a5afb0_NeikiAnalytics.exe	121
PID 628 wrote to memory of 3212	628	876413258b4a9d6a7d79513d28a5afb0_NeikiAnalytics.exe	121
PID 628 wrote to memory of 4848	628	876413258b4a9d6a7d79513d28a5afb0_NeikiAnalytics.exe	122
PID 628 wrote to memory of 4848	628	876413258b4a9d6a7d79513d28a5afb0_NeikiAnalytics.exe	122
PID 628 wrote to memory of 1592	628	876413258b4a9d6a7d79513d28a5afb0_NeikiAnalytics.exe	123
PID 628 wrote to memory of 1592	628	876413258b4a9d6a7d79513d28a5afb0_NeikiAnalytics.exe	123

C:\Users\Admin\AppData\Local\Temp\876413258b4a9d6a7d79513d28a5afb0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\876413258b4a9d6a7d79513d28a5afb0_NeikiAnalytics.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:628
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4480
- C:\Windows\System\IaBstFx.exe
  C:\Windows\System\IaBstFx.exe
  2⤵
  - Executes dropped EXE
  PID:1620
- C:\Windows\System\CFlbAWF.exe
  C:\Windows\System\CFlbAWF.exe
  2⤵
  - Executes dropped EXE
  PID:2032
- C:\Windows\System\YJvnAgo.exe
  C:\Windows\System\YJvnAgo.exe
  2⤵
  - Executes dropped EXE
  PID:2204
- C:\Windows\System\YbMnqdQ.exe
  C:\Windows\System\YbMnqdQ.exe
  2⤵
  - Executes dropped EXE
  PID:2972
- C:\Windows\System\qIcoTDn.exe
  C:\Windows\System\qIcoTDn.exe
  2⤵
  - Executes dropped EXE
  PID:2108
- C:\Windows\System\kHygmEq.exe
  C:\Windows\System\kHygmEq.exe
  2⤵
  - Executes dropped EXE
  PID:1212
- C:\Windows\System\AxwQncM.exe
  C:\Windows\System\AxwQncM.exe
  2⤵
  - Executes dropped EXE
  PID:2268
- C:\Windows\System\WNoCNzA.exe
  C:\Windows\System\WNoCNzA.exe
  2⤵
  - Executes dropped EXE
  PID:1072
- C:\Windows\System\qZcixdH.exe
  C:\Windows\System\qZcixdH.exe
  2⤵
  - Executes dropped EXE
  PID:380
- C:\Windows\System\FEIiPMy.exe
  C:\Windows\System\FEIiPMy.exe
  2⤵
  - Executes dropped EXE
  PID:2672
- C:\Windows\System\XUsMwUP.exe
  C:\Windows\System\XUsMwUP.exe
  2⤵
  - Executes dropped EXE
  PID:3024
- C:\Windows\System\hjZBwdK.exe
  C:\Windows\System\hjZBwdK.exe
  2⤵
  - Executes dropped EXE
  PID:4476
- C:\Windows\System\UENtwTv.exe
  C:\Windows\System\UENtwTv.exe
  2⤵
  - Executes dropped EXE
  PID:4604
- C:\Windows\System\PUnMEdk.exe
  C:\Windows\System\PUnMEdk.exe
  2⤵
  - Executes dropped EXE
  PID:700
- C:\Windows\System\hDegcGR.exe
  C:\Windows\System\hDegcGR.exe
  2⤵
  - Executes dropped EXE
  PID:3804
- C:\Windows\System\QewTAWg.exe
  C:\Windows\System\QewTAWg.exe
  2⤵
  - Executes dropped EXE
  PID:3540
- C:\Windows\System\SFuqhnf.exe
  C:\Windows\System\SFuqhnf.exe
  2⤵
  - Executes dropped EXE
  PID:4176
- C:\Windows\System\oEFXDJG.exe
  C:\Windows\System\oEFXDJG.exe
  2⤵
  - Executes dropped EXE
  PID:4464
- C:\Windows\System\zYyATSR.exe
  C:\Windows\System\zYyATSR.exe
  2⤵
  - Executes dropped EXE
  PID:2528
- C:\Windows\System\QZKZThu.exe
  C:\Windows\System\QZKZThu.exe
  2⤵
  - Executes dropped EXE
  PID:3304
- C:\Windows\System\TYMEley.exe
  C:\Windows\System\TYMEley.exe
  2⤵
  - Executes dropped EXE
  PID:1560
- C:\Windows\System\qPTufqS.exe
  C:\Windows\System\qPTufqS.exe
  2⤵
  - Executes dropped EXE
  PID:2596
- C:\Windows\System\VhTYQCH.exe
  C:\Windows\System\VhTYQCH.exe
  2⤵
  - Executes dropped EXE
  PID:3328
- C:\Windows\System\xnCEKdg.exe
  C:\Windows\System\xnCEKdg.exe
  2⤵
  - Executes dropped EXE
  PID:2868
- C:\Windows\System\vQKvUeS.exe
  C:\Windows\System\vQKvUeS.exe
  2⤵
  - Executes dropped EXE
  PID:2364
- C:\Windows\System\qDTKpmk.exe
  C:\Windows\System\qDTKpmk.exe
  2⤵
  - Executes dropped EXE
  PID:640
- C:\Windows\System\gecySwh.exe
  C:\Windows\System\gecySwh.exe
  2⤵
  - Executes dropped EXE
  PID:4136
- C:\Windows\System\RzpgWVl.exe
  C:\Windows\System\RzpgWVl.exe
  2⤵
  - Executes dropped EXE
  PID:1612
- C:\Windows\System\kKKPhDk.exe
  C:\Windows\System\kKKPhDk.exe
  2⤵
  - Executes dropped EXE
  PID:3212
- C:\Windows\System\nwrTezW.exe
  C:\Windows\System\nwrTezW.exe
  2⤵
  - Executes dropped EXE
  PID:4848
- C:\Windows\System\vVzHkwo.exe
  C:\Windows\System\vVzHkwo.exe
  2⤵
  - Executes dropped EXE
  PID:1592
- C:\Windows\System\pobqwTS.exe
  C:\Windows\System\pobqwTS.exe
  2⤵
  - Executes dropped EXE
  PID:2352
- C:\Windows\System\HCvqjYS.exe
  C:\Windows\System\HCvqjYS.exe
  2⤵
  - Executes dropped EXE
  PID:5104
- C:\Windows\System\EvnYbqc.exe
  C:\Windows\System\EvnYbqc.exe
  2⤵
  - Executes dropped EXE
  PID:3868
- C:\Windows\System\UBdxhjl.exe
  C:\Windows\System\UBdxhjl.exe
  2⤵
  - Executes dropped EXE
  PID:3792
- C:\Windows\System\GAfjyLw.exe
  C:\Windows\System\GAfjyLw.exe
  2⤵
  - Executes dropped EXE
  PID:4940
- C:\Windows\System\RFonnqP.exe
  C:\Windows\System\RFonnqP.exe
  2⤵
  - Executes dropped EXE
  PID:332
- C:\Windows\System\CEbETef.exe
  C:\Windows\System\CEbETef.exe
  2⤵
  - Executes dropped EXE
  PID:4908
- C:\Windows\System\opwYInZ.exe
  C:\Windows\System\opwYInZ.exe
  2⤵
  - Executes dropped EXE
  PID:4028
- C:\Windows\System\sgHyoSl.exe
  C:\Windows\System\sgHyoSl.exe
  2⤵
  - Executes dropped EXE
  PID:3536
- C:\Windows\System\Efljsxo.exe
  C:\Windows\System\Efljsxo.exe
  2⤵
  - Executes dropped EXE
  PID:2524
- C:\Windows\System\YfTxAtS.exe
  C:\Windows\System\YfTxAtS.exe
  2⤵
  - Executes dropped EXE
  PID:752
- C:\Windows\System\FaNgSiL.exe
  C:\Windows\System\FaNgSiL.exe
  2⤵
  - Executes dropped EXE
  PID:1164
- C:\Windows\System\PopPRil.exe
  C:\Windows\System\PopPRil.exe
  2⤵
  - Executes dropped EXE
  PID:2028
- C:\Windows\System\EZWyfHO.exe
  C:\Windows\System\EZWyfHO.exe
  2⤵
  - Executes dropped EXE
  PID:564
- C:\Windows\System\YQegquC.exe
  C:\Windows\System\YQegquC.exe
  2⤵
  - Executes dropped EXE
  PID:3940
- C:\Windows\System\DjxhssV.exe
  C:\Windows\System\DjxhssV.exe
  2⤵
  - Executes dropped EXE
  PID:5028
- C:\Windows\System\NVUitez.exe
  C:\Windows\System\NVUitez.exe
  2⤵
  - Executes dropped EXE
  PID:1360
- C:\Windows\System\Hsiiekj.exe
  C:\Windows\System\Hsiiekj.exe
  2⤵
  - Executes dropped EXE
  PID:436
- C:\Windows\System\gTXGlIl.exe
  C:\Windows\System\gTXGlIl.exe
  2⤵
  - Executes dropped EXE
  PID:880
- C:\Windows\System\POwtuen.exe
  C:\Windows\System\POwtuen.exe
  2⤵
  - Executes dropped EXE
  PID:3232
- C:\Windows\System\NOAsiWG.exe
  C:\Windows\System\NOAsiWG.exe
  2⤵
  - Executes dropped EXE
  PID:4036
- C:\Windows\System\hkimWfq.exe
  C:\Windows\System\hkimWfq.exe
  2⤵
  - Executes dropped EXE
  PID:1556
- C:\Windows\System\nniELOX.exe
  C:\Windows\System\nniELOX.exe
  2⤵
  - Executes dropped EXE
  PID:4996
- C:\Windows\System\YjpoIoM.exe
  C:\Windows\System\YjpoIoM.exe
  2⤵
  - Executes dropped EXE
  PID:1256
- C:\Windows\System\dwZabEe.exe
  C:\Windows\System\dwZabEe.exe
  2⤵
  - Executes dropped EXE
  PID:1088
- C:\Windows\System\vWGmcIl.exe
  C:\Windows\System\vWGmcIl.exe
  2⤵
  - Executes dropped EXE
  PID:1912
- C:\Windows\System\VcfMqrj.exe
  C:\Windows\System\VcfMqrj.exe
  2⤵
  - Executes dropped EXE
  PID:1836
- C:\Windows\System\XOfZsvo.exe
  C:\Windows\System\XOfZsvo.exe
  2⤵
  - Executes dropped EXE
  PID:5112
- C:\Windows\System\IXBtggS.exe
  C:\Windows\System\IXBtggS.exe
  2⤵
  - Executes dropped EXE
  PID:3916
- C:\Windows\System\iInTKnE.exe
  C:\Windows\System\iInTKnE.exe
  2⤵
  - Executes dropped EXE
  PID:1112
- C:\Windows\System\PaJMnjH.exe
  C:\Windows\System\PaJMnjH.exe
  2⤵
  - Executes dropped EXE
  PID:1800
- C:\Windows\System\LdhlboL.exe
  C:\Windows\System\LdhlboL.exe
  2⤵
  - Executes dropped EXE
  PID:4416
- C:\Windows\System\DyCFWIQ.exe
  C:\Windows\System\DyCFWIQ.exe
  2⤵
  - Executes dropped EXE
  PID:960
- C:\Windows\System\sCbkXAa.exe
  C:\Windows\System\sCbkXAa.exe
  2⤵
  PID:4640
- C:\Windows\System\PwimrlI.exe
  C:\Windows\System\PwimrlI.exe
  2⤵
  PID:3200
- C:\Windows\System\OczImiH.exe
  C:\Windows\System\OczImiH.exe
  2⤵
  PID:2216
- C:\Windows\System\SQAUmyb.exe
  C:\Windows\System\SQAUmyb.exe
  2⤵
  PID:1516
- C:\Windows\System\ZJGyihZ.exe
  C:\Windows\System\ZJGyihZ.exe
  2⤵
  PID:4828
- C:\Windows\System\rsedqQg.exe
  C:\Windows\System\rsedqQg.exe
  2⤵
  PID:5116
- C:\Windows\System\mQoYxQV.exe
  C:\Windows\System\mQoYxQV.exe
  2⤵
  PID:5136
- C:\Windows\System\BOUtCXz.exe
  C:\Windows\System\BOUtCXz.exe
  2⤵
  PID:5168
- C:\Windows\System\leDdKzq.exe
  C:\Windows\System\leDdKzq.exe
  2⤵
  PID:5196
- C:\Windows\System\pHbzdIB.exe
  C:\Windows\System\pHbzdIB.exe
  2⤵
  PID:5220
- C:\Windows\System\UkZRzFA.exe
  C:\Windows\System\UkZRzFA.exe
  2⤵
  PID:5256
- C:\Windows\System\arptTqn.exe
  C:\Windows\System\arptTqn.exe
  2⤵
  PID:5288
- C:\Windows\System\pdfFLgn.exe
  C:\Windows\System\pdfFLgn.exe
  2⤵
  PID:5324
- C:\Windows\System\hdrGuMb.exe
  C:\Windows\System\hdrGuMb.exe
  2⤵
  PID:5352
- C:\Windows\System\xtkYfTC.exe
  C:\Windows\System\xtkYfTC.exe
  2⤵
  PID:5380
- C:\Windows\System\MOEIcjE.exe
  C:\Windows\System\MOEIcjE.exe
  2⤵
  PID:5408
- C:\Windows\System\ZBywqPU.exe
  C:\Windows\System\ZBywqPU.exe
  2⤵
  PID:5436
- C:\Windows\System\XlbVkJt.exe
  C:\Windows\System\XlbVkJt.exe
  2⤵
  PID:5464
- C:\Windows\System\yOgmTYR.exe
  C:\Windows\System\yOgmTYR.exe
  2⤵
  PID:5492
- C:\Windows\System\fwCWkck.exe
  C:\Windows\System\fwCWkck.exe
  2⤵
  PID:5520
- C:\Windows\System\sNlLvxe.exe
  C:\Windows\System\sNlLvxe.exe
  2⤵
  PID:5548
- C:\Windows\System\FlZJODp.exe
  C:\Windows\System\FlZJODp.exe
  2⤵
  PID:5576
- C:\Windows\System\cylXaIR.exe
  C:\Windows\System\cylXaIR.exe
  2⤵
  PID:5604
- C:\Windows\System\yNjSfTi.exe
  C:\Windows\System\yNjSfTi.exe
  2⤵
  PID:5632
- C:\Windows\System\QqLpouf.exe
  C:\Windows\System\QqLpouf.exe
  2⤵
  PID:5660
- C:\Windows\System\NsniVte.exe
  C:\Windows\System\NsniVte.exe
  2⤵
  PID:5688
- C:\Windows\System\EICCfgq.exe
  C:\Windows\System\EICCfgq.exe
  2⤵
  PID:5704
- C:\Windows\System\jkwoFIX.exe
  C:\Windows\System\jkwoFIX.exe
  2⤵
  PID:5724
- C:\Windows\System\vsROdRz.exe
  C:\Windows\System\vsROdRz.exe
  2⤵
  PID:5752
- C:\Windows\System\BauwIgm.exe
  C:\Windows\System\BauwIgm.exe
  2⤵
  PID:5772
- C:\Windows\System\LYzxKTq.exe
  C:\Windows\System\LYzxKTq.exe
  2⤵
  PID:5800
- C:\Windows\System\loHAAgM.exe
  C:\Windows\System\loHAAgM.exe
  2⤵
  PID:5824
- C:\Windows\System\IlLgBHG.exe
  C:\Windows\System\IlLgBHG.exe
  2⤵
  PID:5852
- C:\Windows\System\XqPFDqD.exe
  C:\Windows\System\XqPFDqD.exe
  2⤵
  PID:5884
- C:\Windows\System\pYXYqSf.exe
  C:\Windows\System\pYXYqSf.exe
  2⤵
  PID:5920
- C:\Windows\System\pEeGpIm.exe
  C:\Windows\System\pEeGpIm.exe
  2⤵
  PID:5956
- C:\Windows\System\NcWOsww.exe
  C:\Windows\System\NcWOsww.exe
  2⤵
  PID:5976
- C:\Windows\System\HManizE.exe
  C:\Windows\System\HManizE.exe
  2⤵
  PID:6000
- C:\Windows\System\SpflnJP.exe
  C:\Windows\System\SpflnJP.exe
  2⤵
  PID:6056
- C:\Windows\System\NOfEBvA.exe
  C:\Windows\System\NOfEBvA.exe
  2⤵
  PID:6112
- C:\Windows\System\ydIVnho.exe
  C:\Windows\System\ydIVnho.exe
  2⤵
  PID:2264
- C:\Windows\System\cgHTjRv.exe
  C:\Windows\System\cgHTjRv.exe
  2⤵
  PID:1376
- C:\Windows\System\TIjOPPz.exe
  C:\Windows\System\TIjOPPz.exe
  2⤵
  PID:5152
- C:\Windows\System\rpmTppP.exe
  C:\Windows\System\rpmTppP.exe
  2⤵
  PID:5268
- C:\Windows\System\nyTdaBi.exe
  C:\Windows\System\nyTdaBi.exe
  2⤵
  PID:5344
- C:\Windows\System\RDiitrK.exe
  C:\Windows\System\RDiitrK.exe
  2⤵
  PID:5400
- C:\Windows\System\QNNvlpo.exe
  C:\Windows\System\QNNvlpo.exe
  2⤵
  PID:5460
- C:\Windows\System\VzJkbWl.exe
  C:\Windows\System\VzJkbWl.exe
  2⤵
  PID:5504
- C:\Windows\System\kIkSZUc.exe
  C:\Windows\System\kIkSZUc.exe
  2⤵
  PID:5540
- C:\Windows\System\dUEOApQ.exe
  C:\Windows\System\dUEOApQ.exe
  2⤵
  PID:5624
- C:\Windows\System\gEFBmZr.exe
  C:\Windows\System\gEFBmZr.exe
  2⤵
  PID:5676
- C:\Windows\System\GxGPxZz.exe
  C:\Windows\System\GxGPxZz.exe
  2⤵
  PID:5744
- C:\Windows\System\uXMfupd.exe
  C:\Windows\System\uXMfupd.exe
  2⤵
  PID:5784
- C:\Windows\System\zwPtcXI.exe
  C:\Windows\System\zwPtcXI.exe
  2⤵
  PID:5896
- C:\Windows\System\nBnUSJP.exe
  C:\Windows\System\nBnUSJP.exe
  2⤵
  PID:5988
- C:\Windows\System\setHrLU.exe
  C:\Windows\System\setHrLU.exe
  2⤵
  PID:6096
- C:\Windows\System\qxITRDn.exe
  C:\Windows\System\qxITRDn.exe
  2⤵
  PID:3864
- C:\Windows\System\YjxQbyj.exe
  C:\Windows\System\YjxQbyj.exe
  2⤵
  PID:6128
- C:\Windows\System\MfuKDSo.exe
  C:\Windows\System\MfuKDSo.exe
  2⤵
  PID:5428
- C:\Windows\System\tSZUHpF.exe
  C:\Windows\System\tSZUHpF.exe
  2⤵
  PID:5476
- C:\Windows\System\jmMcqOb.exe
  C:\Windows\System\jmMcqOb.exe
  2⤵
  PID:5740
- C:\Windows\System\NKUAxXs.exe
  C:\Windows\System\NKUAxXs.exe
  2⤵
  PID:5908
- C:\Windows\System\RjzimOH.exe
  C:\Windows\System\RjzimOH.exe
  2⤵
  PID:5992
- C:\Windows\System\AoXUItw.exe
  C:\Windows\System\AoXUItw.exe
  2⤵
  PID:5212
- C:\Windows\System\XkJBffl.exe
  C:\Windows\System\XkJBffl.exe
  2⤵
  PID:5512
- C:\Windows\System\ldJCKrs.exe
  C:\Windows\System\ldJCKrs.exe
  2⤵
  PID:5836
- C:\Windows\System\SsIinCi.exe
  C:\Windows\System\SsIinCi.exe
  2⤵
  PID:6076
- C:\Windows\System\CIgNwGZ.exe
  C:\Windows\System\CIgNwGZ.exe
  2⤵
  PID:5808
- C:\Windows\System\pfRikSX.exe
  C:\Windows\System\pfRikSX.exe
  2⤵
  PID:5600
- C:\Windows\System\VQauXaA.exe
  C:\Windows\System\VQauXaA.exe
  2⤵
  PID:6176
- C:\Windows\System\sBTtJBP.exe
  C:\Windows\System\sBTtJBP.exe
  2⤵
  PID:6216
- C:\Windows\System\tXTKdmq.exe
  C:\Windows\System\tXTKdmq.exe
  2⤵
  PID:6244
- C:\Windows\System\klCPphH.exe
  C:\Windows\System\klCPphH.exe
  2⤵
  PID:6264
- C:\Windows\System\arApyfw.exe
  C:\Windows\System\arApyfw.exe
  2⤵
  PID:6288
- C:\Windows\System\SQIvxwa.exe
  C:\Windows\System\SQIvxwa.exe
  2⤵
  PID:6328
- C:\Windows\System\eRWdzsO.exe
  C:\Windows\System\eRWdzsO.exe
  2⤵
  PID:6356
- C:\Windows\System\aejvSqr.exe
  C:\Windows\System\aejvSqr.exe
  2⤵
  PID:6408
- C:\Windows\System\xJbnifp.exe
  C:\Windows\System\xJbnifp.exe
  2⤵
  PID:6424
- C:\Windows\System\BOKgPFQ.exe
  C:\Windows\System\BOKgPFQ.exe
  2⤵
  PID:6452
- C:\Windows\System\QSqHTbs.exe
  C:\Windows\System\QSqHTbs.exe
  2⤵
  PID:6480
- C:\Windows\System\ksSuoHA.exe
  C:\Windows\System\ksSuoHA.exe
  2⤵
  PID:6508
- C:\Windows\System\XmennML.exe
  C:\Windows\System\XmennML.exe
  2⤵
  PID:6540
- C:\Windows\System\alExjYB.exe
  C:\Windows\System\alExjYB.exe
  2⤵
  PID:6572
- C:\Windows\System\ZnOWtYj.exe
  C:\Windows\System\ZnOWtYj.exe
  2⤵
  PID:6600
- C:\Windows\System\RbQQtHW.exe
  C:\Windows\System\RbQQtHW.exe
  2⤵
  PID:6616
- C:\Windows\System\KxTbGuF.exe
  C:\Windows\System\KxTbGuF.exe
  2⤵
  PID:6644
- C:\Windows\System\algbgKt.exe
  C:\Windows\System\algbgKt.exe
  2⤵
  PID:6668
- C:\Windows\System\cMiOrPs.exe
  C:\Windows\System\cMiOrPs.exe
  2⤵
  PID:6704
- C:\Windows\System\XnVSuzG.exe
  C:\Windows\System\XnVSuzG.exe
  2⤵
  PID:6724
- C:\Windows\System\gKuroyh.exe
  C:\Windows\System\gKuroyh.exe
  2⤵
  PID:6760
- C:\Windows\System\djTYzKE.exe
  C:\Windows\System\djTYzKE.exe
  2⤵
  PID:6788
- C:\Windows\System\bYgqwrQ.exe
  C:\Windows\System\bYgqwrQ.exe
  2⤵
  PID:6812
- C:\Windows\System\fbGusiq.exe
  C:\Windows\System\fbGusiq.exe
  2⤵
  PID:6836
- C:\Windows\System\CUVomtN.exe
  C:\Windows\System\CUVomtN.exe
  2⤵
  PID:6864
- C:\Windows\System\auMrMaR.exe
  C:\Windows\System\auMrMaR.exe
  2⤵
  PID:6888
- C:\Windows\System\DgxMrFS.exe
  C:\Windows\System\DgxMrFS.exe
  2⤵
  PID:6916
- C:\Windows\System\IbMqnLc.exe
  C:\Windows\System\IbMqnLc.exe
  2⤵
  PID:6936
- C:\Windows\System\wLpgJgW.exe
  C:\Windows\System\wLpgJgW.exe
  2⤵
  PID:6972
- C:\Windows\System\DoYunsC.exe
  C:\Windows\System\DoYunsC.exe
  2⤵
  PID:6992
- C:\Windows\System\nLINNlj.exe
  C:\Windows\System\nLINNlj.exe
  2⤵
  PID:7016
- C:\Windows\System\qQvuDcU.exe
  C:\Windows\System\qQvuDcU.exe
  2⤵
  PID:7060
- C:\Windows\System\KDUWWIb.exe
  C:\Windows\System\KDUWWIb.exe
  2⤵
  PID:7104
- C:\Windows\System\PoHlHAa.exe
  C:\Windows\System\PoHlHAa.exe
  2⤵
  PID:7140
- C:\Windows\System\YrRsEzg.exe
  C:\Windows\System\YrRsEzg.exe
  2⤵
  PID:5432
- C:\Windows\System\guLyman.exe
  C:\Windows\System\guLyman.exe
  2⤵
  PID:6240
- C:\Windows\System\dOaiNvk.exe
  C:\Windows\System\dOaiNvk.exe
  2⤵
  PID:6340
- C:\Windows\System\RnDVDZC.exe
  C:\Windows\System\RnDVDZC.exe
  2⤵
  PID:6380
- C:\Windows\System\aQCeVRv.exe
  C:\Windows\System\aQCeVRv.exe
  2⤵
  PID:6492
- C:\Windows\System\nPimIZL.exe
  C:\Windows\System\nPimIZL.exe
  2⤵
  PID:6564
- C:\Windows\System\RsmHZdg.exe
  C:\Windows\System\RsmHZdg.exe
  2⤵
  PID:6588
- C:\Windows\System\NNqRAQm.exe
  C:\Windows\System\NNqRAQm.exe
  2⤵
  PID:6664
- C:\Windows\System\yWYwEOT.exe
  C:\Windows\System\yWYwEOT.exe
  2⤵
  PID:6732
- C:\Windows\System\EuqyCIS.exe
  C:\Windows\System\EuqyCIS.exe
  2⤵
  PID:6800
- C:\Windows\System\MOmwAmO.exe
  C:\Windows\System\MOmwAmO.exe
  2⤵
  PID:6960
- C:\Windows\System\CcMjZmH.exe
  C:\Windows\System\CcMjZmH.exe
  2⤵
  PID:6952
- C:\Windows\System\yKRptCW.exe
  C:\Windows\System\yKRptCW.exe
  2⤵
  PID:6988
- C:\Windows\System\wIowBmf.exe
  C:\Windows\System\wIowBmf.exe
  2⤵
  PID:7084
- C:\Windows\System\fUDFjSE.exe
  C:\Windows\System\fUDFjSE.exe
  2⤵
  PID:6676
- C:\Windows\System\NeKjJuw.exe
  C:\Windows\System\NeKjJuw.exe
  2⤵
  PID:6228
- C:\Windows\System\hWHuLhu.exe
  C:\Windows\System\hWHuLhu.exe
  2⤵
  PID:6352
- C:\Windows\System\JfyUcmH.exe
  C:\Windows\System\JfyUcmH.exe
  2⤵
  PID:6420
- C:\Windows\System\FPtPrTs.exe
  C:\Windows\System\FPtPrTs.exe
  2⤵
  PID:6528
- C:\Windows\System\VUIssAA.exe
  C:\Windows\System\VUIssAA.exe
  2⤵
  PID:6780
- C:\Windows\System\JblbDPz.exe
  C:\Windows\System\JblbDPz.exe
  2⤵
  PID:6856
- C:\Windows\System\KdIQtUG.exe
  C:\Windows\System\KdIQtUG.exe
  2⤵
  PID:7000
- C:\Windows\System\JxHkkjQ.exe
  C:\Windows\System\JxHkkjQ.exe
  2⤵
  PID:6632
- C:\Windows\System\ZstpHCe.exe
  C:\Windows\System\ZstpHCe.exe
  2⤵
  PID:6684
- C:\Windows\System\qfhhoxA.exe
  C:\Windows\System\qfhhoxA.exe
  2⤵
  PID:6476
- C:\Windows\System\VNvAAPP.exe
  C:\Windows\System\VNvAAPP.exe
  2⤵
  PID:7012
- C:\Windows\System\cZScIzz.exe
  C:\Windows\System\cZScIzz.exe
  2⤵
  PID:6276
- C:\Windows\System\WFXbWGx.exe
  C:\Windows\System\WFXbWGx.exe
  2⤵
  PID:7032
- C:\Windows\System\qqFpjow.exe
  C:\Windows\System\qqFpjow.exe
  2⤵
  PID:7288
- C:\Windows\System\ilXztha.exe
  C:\Windows\System\ilXztha.exe
  2⤵
  PID:7320
- C:\Windows\System\iCjqqHG.exe
  C:\Windows\System\iCjqqHG.exe
  2⤵
  PID:7400
- C:\Windows\System\ZCqxpyg.exe
  C:\Windows\System\ZCqxpyg.exe
  2⤵
  PID:7428
- C:\Windows\System\mGElcTR.exe
  C:\Windows\System\mGElcTR.exe
  2⤵
  PID:7460
- C:\Windows\System\xrZopEr.exe
  C:\Windows\System\xrZopEr.exe
  2⤵
  PID:7504
- C:\Windows\System\vfHJeoX.exe
  C:\Windows\System\vfHJeoX.exe
  2⤵
  PID:7536
- C:\Windows\System\RKELruw.exe
  C:\Windows\System\RKELruw.exe
  2⤵
  PID:7580
- C:\Windows\System\wOHkUSD.exe
  C:\Windows\System\wOHkUSD.exe
  2⤵
  PID:7676
- C:\Windows\System\RZlfPYY.exe
  C:\Windows\System\RZlfPYY.exe
  2⤵
  PID:7740
- C:\Windows\System\pLzkKrs.exe
  C:\Windows\System\pLzkKrs.exe
  2⤵
  PID:7812
- C:\Windows\System\TmEUwMJ.exe
  C:\Windows\System\TmEUwMJ.exe
  2⤵
  PID:7860
- C:\Windows\System\hXrfNac.exe
  C:\Windows\System\hXrfNac.exe
  2⤵
  PID:7912
- C:\Windows\System\mCaAXwK.exe
  C:\Windows\System\mCaAXwK.exe
  2⤵
  PID:7964
- C:\Windows\System\AYsnWWa.exe
  C:\Windows\System\AYsnWWa.exe
  2⤵
  PID:8028
- C:\Windows\System\HBmVRnF.exe
  C:\Windows\System\HBmVRnF.exe
  2⤵
  PID:8068
- C:\Windows\System\PoTzclV.exe
  C:\Windows\System\PoTzclV.exe
  2⤵
  PID:8104
- C:\Windows\System\sVVXyPD.exe
  C:\Windows\System\sVVXyPD.exe
  2⤵
  PID:8136
- C:\Windows\System\vIyqfJg.exe
  C:\Windows\System\vIyqfJg.exe
  2⤵
  PID:8156
- C:\Windows\System\IDeJAGP.exe
  C:\Windows\System\IDeJAGP.exe
  2⤵
  PID:8184
- C:\Windows\System\QDcTjSP.exe
  C:\Windows\System\QDcTjSP.exe
  2⤵
  PID:7200
- C:\Windows\System\ZOPyeYb.exe
  C:\Windows\System\ZOPyeYb.exe
  2⤵
  PID:7308
- C:\Windows\System\GYiXZvE.exe
  C:\Windows\System\GYiXZvE.exe
  2⤵
  PID:7260
- C:\Windows\System\cqNDSHC.exe
  C:\Windows\System\cqNDSHC.exe
  2⤵
  PID:7216
- C:\Windows\System\LLrNoMS.exe
  C:\Windows\System\LLrNoMS.exe
  2⤵
  PID:7356
- C:\Windows\System\QeYMDNK.exe
  C:\Windows\System\QeYMDNK.exe
  2⤵
  PID:7388
- C:\Windows\System\foJMGTa.exe
  C:\Windows\System\foJMGTa.exe
  2⤵
  PID:7568
- C:\Windows\System\UusFwWO.exe
  C:\Windows\System\UusFwWO.exe
  2⤵
  PID:7664
- C:\Windows\System\axdmpcg.exe
  C:\Windows\System\axdmpcg.exe
  2⤵
  PID:7704
- C:\Windows\System\UHAkXLl.exe
  C:\Windows\System\UHAkXLl.exe
  2⤵
  PID:7756
- C:\Windows\System\hwiRiWC.exe
  C:\Windows\System\hwiRiWC.exe
  2⤵
  PID:7776
- C:\Windows\System\fxuNKUS.exe
  C:\Windows\System\fxuNKUS.exe
  2⤵
  PID:7808
- C:\Windows\System\sdqfCfR.exe
  C:\Windows\System\sdqfCfR.exe
  2⤵
  PID:7928
- C:\Windows\System\cRGEuyh.exe
  C:\Windows\System\cRGEuyh.exe
  2⤵
  PID:7948
- C:\Windows\System\dNuQPud.exe
  C:\Windows\System\dNuQPud.exe
  2⤵
  PID:8052
- C:\Windows\System\EuedwAY.exe
  C:\Windows\System\EuedwAY.exe
  2⤵
  PID:8088
- C:\Windows\System\fShuymL.exe
  C:\Windows\System\fShuymL.exe
  2⤵
  PID:8144
- C:\Windows\System\yhuIizj.exe
  C:\Windows\System\yhuIizj.exe
  2⤵
  PID:6808
- C:\Windows\System\wNKTnsZ.exe
  C:\Windows\System\wNKTnsZ.exe
  2⤵
  PID:7296
- C:\Windows\System\VHBtGXm.exe
  C:\Windows\System\VHBtGXm.exe
  2⤵
  PID:6188
- C:\Windows\System\MXfODKZ.exe
  C:\Windows\System\MXfODKZ.exe
  2⤵
  PID:7412
- C:\Windows\System\laAJmnj.exe
  C:\Windows\System\laAJmnj.exe
  2⤵
  PID:7372
- C:\Windows\System\BDaEuTh.exe
  C:\Windows\System\BDaEuTh.exe
  2⤵
  PID:7232
- C:\Windows\System\pQKeAbG.exe
  C:\Windows\System\pQKeAbG.exe
  2⤵
  PID:7352
- C:\Windows\System\gNxNcfh.exe
  C:\Windows\System\gNxNcfh.exe
  2⤵
  PID:7420
- C:\Windows\System\kXhNHOP.exe
  C:\Windows\System\kXhNHOP.exe
  2⤵
  PID:7560
- C:\Windows\System\XYzHaUJ.exe
  C:\Windows\System\XYzHaUJ.exe
  2⤵
  PID:7752
- C:\Windows\System\uQRHLin.exe
  C:\Windows\System\uQRHLin.exe
  2⤵
  PID:7896
- C:\Windows\System\lzjnviD.exe
  C:\Windows\System\lzjnviD.exe
  2⤵
  PID:7976
- C:\Windows\System\LUjkYpm.exe
  C:\Windows\System\LUjkYpm.exe
  2⤵
  PID:8000
- C:\Windows\System\NCLZqde.exe
  C:\Windows\System\NCLZqde.exe
  2⤵
  PID:8152
- C:\Windows\System\ytQiRPz.exe
  C:\Windows\System\ytQiRPz.exe
  2⤵
  PID:7316
- C:\Windows\System\DhwaaVR.exe
  C:\Windows\System\DhwaaVR.exe
  2⤵
  PID:7392
- C:\Windows\System\fcQIvBp.exe
  C:\Windows\System\fcQIvBp.exe
  2⤵
  PID:7468
- C:\Windows\System\zADHmml.exe
  C:\Windows\System\zADHmml.exe
  2⤵
  PID:7592
- C:\Windows\System\kdDMdAk.exe
  C:\Windows\System\kdDMdAk.exe
  2⤵
  PID:7848
- C:\Windows\System\kLoBsei.exe
  C:\Windows\System\kLoBsei.exe
  2⤵
  PID:7972
- C:\Windows\System\ptaIbwd.exe
  C:\Windows\System\ptaIbwd.exe
  2⤵
  PID:8124
- C:\Windows\System\RKmcQXi.exe
  C:\Windows\System\RKmcQXi.exe
  2⤵
  PID:1156
- C:\Windows\System\lnERqie.exe
  C:\Windows\System\lnERqie.exe
  2⤵
  PID:2568
- C:\Windows\System\ZjWMEfN.exe
  C:\Windows\System\ZjWMEfN.exe
  2⤵
  PID:7332
- C:\Windows\System\CIWwCva.exe
  C:\Windows\System\CIWwCva.exe
  2⤵
  PID:1692
- C:\Windows\System\cXVLldj.exe
  C:\Windows\System\cXVLldj.exe
  2⤵
  PID:8216
- C:\Windows\System\UyRZVHU.exe
  C:\Windows\System\UyRZVHU.exe
  2⤵
  PID:8244
- C:\Windows\System\dbBJzmC.exe
  C:\Windows\System\dbBJzmC.exe
  2⤵
  PID:8284
- C:\Windows\System\dETuJrR.exe
  C:\Windows\System\dETuJrR.exe
  2⤵
  PID:8344
- C:\Windows\System\erLeqyH.exe
  C:\Windows\System\erLeqyH.exe
  2⤵
  PID:8380
- C:\Windows\System\dtucLMH.exe
  C:\Windows\System\dtucLMH.exe
  2⤵
  PID:8404
- C:\Windows\System\AwDOyHF.exe
  C:\Windows\System\AwDOyHF.exe
  2⤵
  PID:8440
- C:\Windows\System\WbERqso.exe
  C:\Windows\System\WbERqso.exe
  2⤵
  PID:8468
- C:\Windows\System\GUFylpi.exe
  C:\Windows\System\GUFylpi.exe
  2⤵
  PID:8500
- C:\Windows\System\Vngczrm.exe
  C:\Windows\System\Vngczrm.exe
  2⤵
  PID:8532
- C:\Windows\System\KSHzKhi.exe
  C:\Windows\System\KSHzKhi.exe
  2⤵
  PID:8568
- C:\Windows\System\dDikkkw.exe
  C:\Windows\System\dDikkkw.exe
  2⤵
  PID:8608
- C:\Windows\System\kYDtIAi.exe
  C:\Windows\System\kYDtIAi.exe
  2⤵
  PID:8660
- C:\Windows\System\QwvIPzA.exe
  C:\Windows\System\QwvIPzA.exe
  2⤵
  PID:8716
- C:\Windows\System\wdxhvzx.exe
  C:\Windows\System\wdxhvzx.exe
  2⤵
  PID:8756
- C:\Windows\System\vSqGfZq.exe
  C:\Windows\System\vSqGfZq.exe
  2⤵
  PID:8784
- C:\Windows\System\mmYdTGQ.exe
  C:\Windows\System\mmYdTGQ.exe
  2⤵
  PID:8812
- C:\Windows\System\pdCAnkB.exe
  C:\Windows\System\pdCAnkB.exe
  2⤵
  PID:8848
- C:\Windows\System\cXzKtmt.exe
  C:\Windows\System\cXzKtmt.exe
  2⤵
  PID:8872
- C:\Windows\System\AYdbapY.exe
  C:\Windows\System\AYdbapY.exe
  2⤵
  PID:8916
- C:\Windows\System\zmMTVkF.exe
  C:\Windows\System\zmMTVkF.exe
  2⤵
  PID:8944
- C:\Windows\System\wMlMNmE.exe
  C:\Windows\System\wMlMNmE.exe
  2⤵
  PID:8972
- C:\Windows\System\MjrSeUB.exe
  C:\Windows\System\MjrSeUB.exe
  2⤵
  PID:9000
- C:\Windows\System\TBJeaOt.exe
  C:\Windows\System\TBJeaOt.exe
  2⤵
  PID:9028
- C:\Windows\System\wbJomlf.exe
  C:\Windows\System\wbJomlf.exe
  2⤵
  PID:9056
- C:\Windows\System\LGanEmo.exe
  C:\Windows\System\LGanEmo.exe
  2⤵
  PID:9084
- C:\Windows\System\KsDLCdv.exe
  C:\Windows\System\KsDLCdv.exe
  2⤵
  PID:9112
- C:\Windows\System\COZMgux.exe
  C:\Windows\System\COZMgux.exe
  2⤵
  PID:9140
- C:\Windows\System\CjIojOF.exe
  C:\Windows\System\CjIojOF.exe
  2⤵
  PID:9168
- C:\Windows\System\NwwupiV.exe
  C:\Windows\System\NwwupiV.exe
  2⤵
  PID:9200
- C:\Windows\System\pXHdWeS.exe
  C:\Windows\System\pXHdWeS.exe
  2⤵
  PID:4328
- C:\Windows\System\SVkhXPP.exe
  C:\Windows\System\SVkhXPP.exe
  2⤵
  PID:1204
- C:\Windows\System\ACMnLJe.exe
  C:\Windows\System\ACMnLJe.exe
  2⤵
  PID:8280
- C:\Windows\System\PiTOQLp.exe
  C:\Windows\System\PiTOQLp.exe
  2⤵
  PID:8392
- C:\Windows\System\MNhYQxO.exe
  C:\Windows\System\MNhYQxO.exe
  2⤵
  PID:4180
- C:\Windows\System\DKPgsEF.exe
  C:\Windows\System\DKPgsEF.exe
  2⤵
  PID:8416
- C:\Windows\System\WJFSRVk.exe
  C:\Windows\System\WJFSRVk.exe
  2⤵
  PID:3068
- C:\Windows\System\vayQukU.exe
  C:\Windows\System\vayQukU.exe
  2⤵
  PID:8540
- C:\Windows\System\QtHNfTL.exe
  C:\Windows\System\QtHNfTL.exe
  2⤵
  PID:8644
- C:\Windows\System\KWZxERy.exe
  C:\Windows\System\KWZxERy.exe
  2⤵
  PID:8752
- C:\Windows\System\bEghvva.exe
  C:\Windows\System\bEghvva.exe
  2⤵
  PID:8836
- C:\Windows\System\SzpHoji.exe
  C:\Windows\System\SzpHoji.exe
  2⤵
  PID:8928
- C:\Windows\System\yAYpynB.exe
  C:\Windows\System\yAYpynB.exe
  2⤵
  PID:8968
- C:\Windows\System\PxbZWRv.exe
  C:\Windows\System\PxbZWRv.exe
  2⤵
  PID:9040
- C:\Windows\System\buSogGD.exe
  C:\Windows\System\buSogGD.exe
  2⤵
  PID:9104
- C:\Windows\System\gteMxKs.exe
  C:\Windows\System\gteMxKs.exe
  2⤵
  PID:9136
- C:\Windows\System\jVRYzED.exe
  C:\Windows\System\jVRYzED.exe
  2⤵
  PID:9180
- C:\Windows\System\eyPBmTO.exe
  C:\Windows\System\eyPBmTO.exe
  2⤵
  PID:6316
- C:\Windows\System\wjGzvas.exe
  C:\Windows\System\wjGzvas.exe
  2⤵
  PID:8272
- C:\Windows\System\rQcgtdT.exe
  C:\Windows\System\rQcgtdT.exe
  2⤵
  PID:7472
- C:\Windows\System\PquhaAm.exe
  C:\Windows\System\PquhaAm.exe
  2⤵
  PID:8584
- C:\Windows\System\zaXdBLc.exe
  C:\Windows\System\zaXdBLc.exe
  2⤵
  PID:8780
- C:\Windows\System\GXsVLFe.exe
  C:\Windows\System\GXsVLFe.exe
  2⤵
  PID:8936
- C:\Windows\System\STnQjet.exe
  C:\Windows\System\STnQjet.exe
  2⤵
  PID:8040
- C:\Windows\System\iCSwtIQ.exe
  C:\Windows\System\iCSwtIQ.exe
  2⤵
  PID:9160
- C:\Windows\System\McDsExl.exe
  C:\Windows\System\McDsExl.exe
  2⤵
  PID:8624
- C:\Windows\System\JdyFlQG.exe
  C:\Windows\System\JdyFlQG.exe
  2⤵
  PID:8196
- C:\Windows\System\IYxlBzg.exe
  C:\Windows\System\IYxlBzg.exe
  2⤵
  PID:8996
- C:\Windows\System\XasXOhg.exe
  C:\Windows\System\XasXOhg.exe
  2⤵
  PID:9236
- C:\Windows\System\SlyvcXl.exe
  C:\Windows\System\SlyvcXl.exe
  2⤵
  PID:9264
- C:\Windows\System\NamXOEW.exe
  C:\Windows\System\NamXOEW.exe
  2⤵
  PID:9316
- C:\Windows\System\YBWcVLQ.exe
  C:\Windows\System\YBWcVLQ.exe
  2⤵
  PID:9352
- C:\Windows\System\GXakHsB.exe
  C:\Windows\System\GXakHsB.exe
  2⤵
  PID:9368
- C:\Windows\System\qqYfxow.exe
  C:\Windows\System\qqYfxow.exe
  2⤵
  PID:9396
- C:\Windows\System\JhLltST.exe
  C:\Windows\System\JhLltST.exe
  2⤵
  PID:9424
- C:\Windows\System\DHkgbQs.exe
  C:\Windows\System\DHkgbQs.exe
  2⤵
  PID:9468
- C:\Windows\System\LjyhcQV.exe
  C:\Windows\System\LjyhcQV.exe
  2⤵
  PID:9484
- C:\Windows\System\VvRONYX.exe
  C:\Windows\System\VvRONYX.exe
  2⤵
  PID:9500
- C:\Windows\System\aDsGLBN.exe
  C:\Windows\System\aDsGLBN.exe
  2⤵
  PID:9544
- C:\Windows\System\IeeAdbA.exe
  C:\Windows\System\IeeAdbA.exe
  2⤵
  PID:9572
- C:\Windows\System\AcUAbKR.exe
  C:\Windows\System\AcUAbKR.exe
  2⤵
  PID:9600
- C:\Windows\System\KSbqYMM.exe
  C:\Windows\System\KSbqYMM.exe
  2⤵
  PID:9628
- C:\Windows\System\uZQyLTh.exe
  C:\Windows\System\uZQyLTh.exe
  2⤵
  PID:9668
- C:\Windows\System\vqlHTXk.exe
  C:\Windows\System\vqlHTXk.exe
  2⤵
  PID:9684
- C:\Windows\System\PMwqCAb.exe
  C:\Windows\System\PMwqCAb.exe
  2⤵
  PID:9700
- C:\Windows\System\GHUXwWV.exe
  C:\Windows\System\GHUXwWV.exe
  2⤵
  PID:9716
- C:\Windows\System\ygcprxZ.exe
  C:\Windows\System\ygcprxZ.exe
  2⤵
  PID:9748
- C:\Windows\System\RANnurV.exe
  C:\Windows\System\RANnurV.exe
  2⤵
  PID:9776
- C:\Windows\System\UTmJgOh.exe
  C:\Windows\System\UTmJgOh.exe
  2⤵
  PID:9844
- C:\Windows\System\KAnzBbI.exe
  C:\Windows\System\KAnzBbI.exe
  2⤵
  PID:9868
- C:\Windows\System\qmWNcxf.exe
  C:\Windows\System\qmWNcxf.exe
  2⤵
  PID:9896
- C:\Windows\System\odIIoNd.exe
  C:\Windows\System\odIIoNd.exe
  2⤵
  PID:9924
- C:\Windows\System\TGIuWYz.exe
  C:\Windows\System\TGIuWYz.exe
  2⤵
  PID:9952
- C:\Windows\System\pQedVeA.exe
  C:\Windows\System\pQedVeA.exe
  2⤵
  PID:9996
- C:\Windows\System\aqvpoMZ.exe
  C:\Windows\System\aqvpoMZ.exe
  2⤵
  PID:10032
- C:\Windows\System\InPuXjK.exe
  C:\Windows\System\InPuXjK.exe
  2⤵
  PID:10064
- C:\Windows\System\iUhzHQs.exe
  C:\Windows\System\iUhzHQs.exe
  2⤵
  PID:10096
- C:\Windows\System\LlgSLgj.exe
  C:\Windows\System\LlgSLgj.exe
  2⤵
  PID:10124
- C:\Windows\System\zmyiKHK.exe
  C:\Windows\System\zmyiKHK.exe
  2⤵
  PID:10152
- C:\Windows\System\UXoeaRi.exe
  C:\Windows\System\UXoeaRi.exe
  2⤵
  PID:10184
- C:\Windows\System\YEzcUaB.exe
  C:\Windows\System\YEzcUaB.exe
  2⤵
  PID:10212
- C:\Windows\System\Suodpnh.exe
  C:\Windows\System\Suodpnh.exe
  2⤵
  PID:8896
- C:\Windows\System\xsfLVla.exe
  C:\Windows\System\xsfLVla.exe
  2⤵
  PID:9260
- C:\Windows\System\pGFLaHD.exe
  C:\Windows\System\pGFLaHD.exe
  2⤵
  PID:4540
- C:\Windows\System\iqbviCR.exe
  C:\Windows\System\iqbviCR.exe
  2⤵
  PID:9324
- C:\Windows\System\QzVulxE.exe
  C:\Windows\System\QzVulxE.exe
  2⤵
  PID:9388
- C:\Windows\System\vUdDSwK.exe
  C:\Windows\System\vUdDSwK.exe
  2⤵
  PID:9496
- C:\Windows\System\IYysyVQ.exe
  C:\Windows\System\IYysyVQ.exe
  2⤵
  PID:9556
- C:\Windows\System\YwYSwUY.exe
  C:\Windows\System\YwYSwUY.exe
  2⤵
  PID:9620
- C:\Windows\System\nQStMDW.exe
  C:\Windows\System\nQStMDW.exe
  2⤵
  PID:9680
- C:\Windows\System\DUQfRIm.exe
  C:\Windows\System\DUQfRIm.exe
  2⤵
  PID:9772
- C:\Windows\System\upOvFNC.exe
  C:\Windows\System\upOvFNC.exe
  2⤵
  PID:9832
- C:\Windows\System\mBrSkHr.exe
  C:\Windows\System\mBrSkHr.exe
  2⤵
  PID:9892
- C:\Windows\System\xPklioe.exe
  C:\Windows\System\xPklioe.exe
  2⤵
  PID:9820
- C:\Windows\System\cXRBDBX.exe
  C:\Windows\System\cXRBDBX.exe
  2⤵
  PID:10048
- C:\Windows\System\QknDVum.exe
  C:\Windows\System\QknDVum.exe
  2⤵
  PID:10144
- C:\Windows\System\PPBDqlH.exe
  C:\Windows\System\PPBDqlH.exe
  2⤵
  PID:10208
- C:\Windows\System\jMpyOJU.exe
  C:\Windows\System\jMpyOJU.exe
  2⤵
  PID:9300
- C:\Windows\System\sjnMTqc.exe
  C:\Windows\System\sjnMTqc.exe
  2⤵
  PID:2424
- C:\Windows\System\yVjoLaM.exe
  C:\Windows\System\yVjoLaM.exe
  2⤵
  PID:7708
- C:\Windows\System\bmPwdrK.exe
  C:\Windows\System\bmPwdrK.exe
  2⤵
  PID:9460
- C:\Windows\System\IEeneif.exe
  C:\Windows\System\IEeneif.exe
  2⤵
  PID:9648
- C:\Windows\System\GufWrKf.exe
  C:\Windows\System\GufWrKf.exe
  2⤵
  PID:9828
- C:\Windows\System\ghhHNPA.exe
  C:\Windows\System\ghhHNPA.exe
  2⤵
  PID:9360
- C:\Windows\System\YLdOpOn.exe
  C:\Windows\System\YLdOpOn.exe
  2⤵
  PID:9596
- C:\Windows\System\lAaDCfT.exe
  C:\Windows\System\lAaDCfT.exe
  2⤵
  PID:9304
- C:\Windows\System\jLpUsdc.exe
  C:\Windows\System\jLpUsdc.exe
  2⤵
  PID:10232
- C:\Windows\System\iYiqhpA.exe
  C:\Windows\System\iYiqhpA.exe
  2⤵
  PID:10256
- C:\Windows\System\GOXrGNu.exe
  C:\Windows\System\GOXrGNu.exe
  2⤵
  PID:10308
- C:\Windows\System\kixgaqb.exe
  C:\Windows\System\kixgaqb.exe
  2⤵
  PID:10324
- C:\Windows\System\RHVICRD.exe
  C:\Windows\System\RHVICRD.exe
  2⤵
  PID:10360
- C:\Windows\System\WjNQooo.exe
  C:\Windows\System\WjNQooo.exe
  2⤵
  PID:10408
- C:\Windows\System\cTsAZlb.exe
  C:\Windows\System\cTsAZlb.exe
  2⤵
  PID:10440
- C:\Windows\System\gqcHotE.exe
  C:\Windows\System\gqcHotE.exe
  2⤵
  PID:10468
- C:\Windows\System\nJBaYiV.exe
  C:\Windows\System\nJBaYiV.exe
  2⤵
  PID:10496
- C:\Windows\System\aKRPFkh.exe
  C:\Windows\System\aKRPFkh.exe
  2⤵
  PID:10524
- C:\Windows\System\zEzCFEC.exe
  C:\Windows\System\zEzCFEC.exe
  2⤵
  PID:10552
- C:\Windows\System\tfHuqaT.exe
  C:\Windows\System\tfHuqaT.exe
  2⤵
  PID:10580
- C:\Windows\System\rXurcOn.exe
  C:\Windows\System\rXurcOn.exe
  2⤵
  PID:10596
- C:\Windows\System\vRyVIXz.exe
  C:\Windows\System\vRyVIXz.exe
  2⤵
  PID:10612
- C:\Windows\System\UFLwCgv.exe
  C:\Windows\System\UFLwCgv.exe
  2⤵
  PID:10628
- C:\Windows\System\tUxcvHO.exe
  C:\Windows\System\tUxcvHO.exe
  2⤵
  PID:10644
- C:\Windows\System\kthJcAy.exe
  C:\Windows\System\kthJcAy.exe
  2⤵
  PID:10668
- C:\Windows\System\iPGrRCX.exe
  C:\Windows\System\iPGrRCX.exe
  2⤵
  PID:10692
- C:\Windows\System\EUHkDLU.exe
  C:\Windows\System\EUHkDLU.exe
  2⤵
  PID:10728
- C:\Windows\System\AsnXLlh.exe
  C:\Windows\System\AsnXLlh.exe
  2⤵
  PID:10768
- C:\Windows\System\obOqAZc.exe
  C:\Windows\System\obOqAZc.exe
  2⤵
  PID:10796
- C:\Windows\System\xpIjqVK.exe
  C:\Windows\System\xpIjqVK.exe
  2⤵
  PID:10832
- C:\Windows\System\cdVQCkm.exe
  C:\Windows\System\cdVQCkm.exe
  2⤵
  PID:10852
- C:\Windows\System\AWdjfYB.exe
  C:\Windows\System\AWdjfYB.exe
  2⤵
  PID:10880
- C:\Windows\System\nGsFeXD.exe
  C:\Windows\System\nGsFeXD.exe
  2⤵
  PID:10904
- C:\Windows\System\ZcQdzPc.exe
  C:\Windows\System\ZcQdzPc.exe
  2⤵
  PID:10932
- C:\Windows\System\VasuvNq.exe
  C:\Windows\System\VasuvNq.exe
  2⤵
  PID:10956
- C:\Windows\System\GmUbPKg.exe
  C:\Windows\System\GmUbPKg.exe
  2⤵
  PID:10984
- C:\Windows\System\WxqSUGu.exe
  C:\Windows\System\WxqSUGu.exe
  2⤵
  PID:11016
- C:\Windows\System\ozINcXq.exe
  C:\Windows\System\ozINcXq.exe
  2⤵
  PID:11048
- C:\Windows\System\KjNFMOw.exe
  C:\Windows\System\KjNFMOw.exe
  2⤵
  PID:11072
- C:\Windows\System\rUWcbqx.exe
  C:\Windows\System\rUWcbqx.exe
  2⤵
  PID:11104
- C:\Windows\System\ZZeWsxe.exe
  C:\Windows\System\ZZeWsxe.exe
  2⤵
  PID:11128
- C:\Windows\System\TlCoWYL.exe
  C:\Windows\System\TlCoWYL.exe
  2⤵
  PID:11148
- C:\Windows\System\ElBdkfj.exe
  C:\Windows\System\ElBdkfj.exe
  2⤵
  PID:11180
- C:\Windows\System\bpmZODG.exe
  C:\Windows\System\bpmZODG.exe
  2⤵
  PID:11196
- C:\Windows\System\gitGpDB.exe
  C:\Windows\System\gitGpDB.exe
  2⤵
  PID:11224
- C:\Windows\System\SApGvlk.exe
  C:\Windows\System\SApGvlk.exe
  2⤵
  PID:10340
- C:\Windows\System\RefuwNW.exe
  C:\Windows\System\RefuwNW.exe
  2⤵
  PID:10424
- C:\Windows\System\KHGMtSo.exe
  C:\Windows\System\KHGMtSo.exe
  2⤵
  PID:10508
- C:\Windows\System\nIHeYey.exe
  C:\Windows\System\nIHeYey.exe
  2⤵
  PID:10588
- C:\Windows\System\tGaDNNP.exe
  C:\Windows\System\tGaDNNP.exe
  2⤵
  PID:10624
- C:\Windows\System\VRtduBj.exe
  C:\Windows\System\VRtduBj.exe
  2⤵
  PID:2240
- C:\Windows\System\JPFWgnm.exe
  C:\Windows\System\JPFWgnm.exe
  2⤵
  PID:10816
- C:\Windows\System\knnRtZS.exe
  C:\Windows\System\knnRtZS.exe
  2⤵
  PID:10892
- C:\Windows\System\nDCkDlI.exe
  C:\Windows\System\nDCkDlI.exe
  2⤵
  PID:10928
- C:\Windows\System\TqKXNAJ.exe
  C:\Windows\System\TqKXNAJ.exe
  2⤵
  PID:10996
- C:\Windows\System\EmvcAWv.exe
  C:\Windows\System\EmvcAWv.exe
  2⤵
  PID:11068
- C:\Windows\System\PyDANUy.exe
  C:\Windows\System\PyDANUy.exe
  2⤵
  PID:11124
- C:\Windows\System\jbeWNKu.exe
  C:\Windows\System\jbeWNKu.exe
  2⤵
  PID:11212
- C:\Windows\System\JhtBkuW.exe
  C:\Windows\System\JhtBkuW.exe
  2⤵
  PID:11256
- C:\Windows\System\ImreyrJ.exe
  C:\Windows\System\ImreyrJ.exe
  2⤵
  PID:10448
- C:\Windows\System\aYQKSiA.exe
  C:\Windows\System\aYQKSiA.exe
  2⤵
  PID:10568
- C:\Windows\System\rhoopfj.exe
  C:\Windows\System\rhoopfj.exe
  2⤵
  PID:10848
- C:\Windows\System\aZKNrLb.exe
  C:\Windows\System\aZKNrLb.exe
  2⤵
  PID:11024
- C:\Windows\System\TdpuAjx.exe
  C:\Windows\System\TdpuAjx.exe
  2⤵
  PID:11120
- C:\Windows\System\pGAQoir.exe
  C:\Windows\System\pGAQoir.exe
  2⤵
  PID:9812
- C:\Windows\System\QgEpSvG.exe
  C:\Windows\System\QgEpSvG.exe
  2⤵
  PID:4252
- C:\Windows\System\JDDaukN.exe
  C:\Windows\System\JDDaukN.exe
  2⤵
  PID:11036
- C:\Windows\System\gNserFn.exe
  C:\Windows\System\gNserFn.exe
  2⤵
  PID:10292
- C:\Windows\System\JrSaPJm.exe
  C:\Windows\System\JrSaPJm.exe
  2⤵
  PID:8260
- C:\Windows\System\fbdPgrg.exe
  C:\Windows\System\fbdPgrg.exe
  2⤵
  PID:11280
- C:\Windows\System\ljcDGBa.exe
  C:\Windows\System\ljcDGBa.exe
  2⤵
  PID:11300
- C:\Windows\System\AqLktji.exe
  C:\Windows\System\AqLktji.exe
  2⤵
  PID:11340
- C:\Windows\System\jtCjnCt.exe
  C:\Windows\System\jtCjnCt.exe
  2⤵
  PID:11376
- C:\Windows\System\oPNclwm.exe
  C:\Windows\System\oPNclwm.exe
  2⤵
  PID:11416
- C:\Windows\System\UoiMOyt.exe
  C:\Windows\System\UoiMOyt.exe
  2⤵
  PID:11444
- C:\Windows\System\rOjTpcn.exe
  C:\Windows\System\rOjTpcn.exe
  2⤵
  PID:11472
- C:\Windows\System\WRNpfQR.exe
  C:\Windows\System\WRNpfQR.exe
  2⤵
  PID:11500
- C:\Windows\System\IiCNOcs.exe
  C:\Windows\System\IiCNOcs.exe
  2⤵
  PID:11528
- C:\Windows\System\JbYZxud.exe
  C:\Windows\System\JbYZxud.exe
  2⤵
  PID:11556
- C:\Windows\System\zrhxkJE.exe
  C:\Windows\System\zrhxkJE.exe
  2⤵
  PID:11584
- C:\Windows\System\AeFpgIt.exe
  C:\Windows\System\AeFpgIt.exe
  2⤵
  PID:11612
- C:\Windows\System\DlTlvKo.exe
  C:\Windows\System\DlTlvKo.exe
  2⤵
  PID:11640
- C:\Windows\System\mxuVCSK.exe
  C:\Windows\System\mxuVCSK.exe
  2⤵
  PID:11656
- C:\Windows\System\MaBsjAN.exe
  C:\Windows\System\MaBsjAN.exe
  2⤵
  PID:11676
- C:\Windows\System\XHowCNT.exe
  C:\Windows\System\XHowCNT.exe
  2⤵
  PID:11716
- C:\Windows\System\EoqgFce.exe
  C:\Windows\System\EoqgFce.exe
  2⤵
  PID:11736
- C:\Windows\System\cGHTZcH.exe
  C:\Windows\System\cGHTZcH.exe
  2⤵
  PID:11768
- C:\Windows\System\vQzkhRR.exe
  C:\Windows\System\vQzkhRR.exe
  2⤵
  PID:11788
- C:\Windows\System\FiBckkd.exe
  C:\Windows\System\FiBckkd.exe
  2⤵
  PID:11836
- C:\Windows\System\DlOBGKs.exe
  C:\Windows\System\DlOBGKs.exe
  2⤵
  PID:11864
- C:\Windows\System\OJdFiHc.exe
  C:\Windows\System\OJdFiHc.exe
  2⤵
  PID:11904
- C:\Windows\System\TAurTTd.exe
  C:\Windows\System\TAurTTd.exe
  2⤵
  PID:11932
- C:\Windows\System\GhaBdVL.exe
  C:\Windows\System\GhaBdVL.exe
  2⤵
  PID:11960
- C:\Windows\System\ZtJGsGY.exe
  C:\Windows\System\ZtJGsGY.exe
  2⤵
  PID:11988
- C:\Windows\System\jgmicxH.exe
  C:\Windows\System\jgmicxH.exe
  2⤵
  PID:12016
- C:\Windows\System\sbotNwi.exe
  C:\Windows\System\sbotNwi.exe
  2⤵
  PID:12044
- C:\Windows\System\PbdlrKX.exe
  C:\Windows\System\PbdlrKX.exe
  2⤵
  PID:12072
- C:\Windows\System\shmzddp.exe
  C:\Windows\System\shmzddp.exe
  2⤵
  PID:12100
- C:\Windows\System\nOdZyOu.exe
  C:\Windows\System\nOdZyOu.exe
  2⤵
  PID:12124
- C:\Windows\System\YakQDGi.exe
  C:\Windows\System\YakQDGi.exe
  2⤵
  PID:12160
- C:\Windows\System\UGcFnGJ.exe
  C:\Windows\System\UGcFnGJ.exe
  2⤵
  PID:12184
- C:\Windows\System\elHojFW.exe
  C:\Windows\System\elHojFW.exe
  2⤵
  PID:12212
- C:\Windows\System\siyUgJW.exe
  C:\Windows\System\siyUgJW.exe
  2⤵
  PID:12240
- C:\Windows\System\KNYhxty.exe
  C:\Windows\System\KNYhxty.exe
  2⤵
  PID:11400
- C:\Windows\System\melbFex.exe
  C:\Windows\System\melbFex.exe
  2⤵
  PID:11408
- C:\Windows\System\hZJhmeu.exe
  C:\Windows\System\hZJhmeu.exe
  2⤵
  PID:11464
- C:\Windows\System\snDRcFy.exe
  C:\Windows\System\snDRcFy.exe
  2⤵
  PID:868
- C:\Windows\System\yvRMBfD.exe
  C:\Windows\System\yvRMBfD.exe
  2⤵
  PID:11624
- C:\Windows\System\JTLkkuB.exe
  C:\Windows\System\JTLkkuB.exe
  2⤵
  PID:11684
- C:\Windows\System\hCcnSxv.exe
  C:\Windows\System\hCcnSxv.exe
  2⤵
  PID:11080
- C:\Windows\System\RsgaBEB.exe
  C:\Windows\System\RsgaBEB.exe
  2⤵
  PID:11920
- C:\Windows\System\cNFUoXo.exe
  C:\Windows\System\cNFUoXo.exe
  2⤵
  PID:11972
- C:\Windows\System\YTvcIGT.exe
  C:\Windows\System\YTvcIGT.exe
  2⤵
  PID:12092
- C:\Windows\System\EIaYZXI.exe
  C:\Windows\System\EIaYZXI.exe
  2⤵
  PID:12168
- C:\Windows\System\URCJlPm.exe
  C:\Windows\System\URCJlPm.exe
  2⤵
  PID:4872
- C:\Windows\System\JdOzwFv.exe
  C:\Windows\System\JdOzwFv.exe
  2⤵
  PID:3664
- C:\Windows\System\ujocflG.exe
  C:\Windows\System\ujocflG.exe
  2⤵
  PID:11456
- C:\Windows\System\rqhNDMr.exe
  C:\Windows\System\rqhNDMr.exe
  2⤵
  PID:11548
- C:\Windows\System\QOljGsU.exe
  C:\Windows\System\QOljGsU.exe
  2⤵
  PID:4560
- C:\Windows\System\zNuQYzA.exe
  C:\Windows\System\zNuQYzA.exe
  2⤵
  PID:11760
- C:\Windows\System\GOlsrFM.exe
  C:\Windows\System\GOlsrFM.exe
  2⤵
  PID:12008
- C:\Windows\System\YjCILcZ.exe
  C:\Windows\System\YjCILcZ.exe
  2⤵
  PID:12144
- C:\Windows\System\ZWGNOfy.exe
  C:\Windows\System\ZWGNOfy.exe
  2⤵
  PID:4396
- C:\Windows\System\FMPaDze.exe
  C:\Windows\System\FMPaDze.exe
  2⤵
  PID:11728
- C:\Windows\System\IQsdclh.exe
  C:\Windows\System\IQsdclh.exe
  2⤵
  PID:2816
- C:\Windows\System\rDObNTr.exe
  C:\Windows\System\rDObNTr.exe
  2⤵
  PID:3788
- C:\Windows\System\NaLvNmq.exe
  C:\Windows\System\NaLvNmq.exe
  2⤵
  PID:12140
- C:\Windows\System\demXihV.exe
  C:\Windows\System\demXihV.exe
  2⤵
  PID:4472
- C:\Windows\System\VJQzxzQ.exe
  C:\Windows\System\VJQzxzQ.exe
  2⤵
  PID:4596
- C:\Windows\System\wVEZrMm.exe
  C:\Windows\System\wVEZrMm.exe
  2⤵
  PID:3244
- C:\Windows\System\rBIKrRf.exe
  C:\Windows\System\rBIKrRf.exe
  2⤵
  PID:3164
- C:\Windows\System\gAnMOpk.exe
  C:\Windows\System\gAnMOpk.exe
  2⤵
  PID:1392
- C:\Windows\System\argTyHh.exe
  C:\Windows\System\argTyHh.exe
  2⤵
  PID:208
- C:\Windows\System\flqFDBR.exe
  C:\Windows\System\flqFDBR.exe
  2⤵
  PID:3016
- C:\Windows\System\oaHfQMQ.exe
  C:\Windows\System\oaHfQMQ.exe
  2⤵
  PID:4932
- C:\Windows\System\zFalswl.exe
  C:\Windows\System\zFalswl.exe
  2⤵
  PID:1236
- C:\Windows\System\auLZjIv.exe
  C:\Windows\System\auLZjIv.exe
  2⤵
  PID:4076
- C:\Windows\System\exYZyEW.exe
  C:\Windows\System\exYZyEW.exe
  2⤵
  PID:5108
- C:\Windows\System\GObHesU.exe
  C:\Windows\System\GObHesU.exe
  2⤵
  PID:1576
- C:\Windows\System\yWemxSu.exe
  C:\Windows\System\yWemxSu.exe
  2⤵
  PID:1792
- C:\Windows\System\kIDzHua.exe
  C:\Windows\System\kIDzHua.exe
  2⤵
  PID:4860
- C:\Windows\System\vWmcjzY.exe
  C:\Windows\System\vWmcjzY.exe
  2⤵
  PID:5252
- C:\Windows\System\AdZejjx.exe
  C:\Windows\System\AdZejjx.exe
  2⤵
  PID:2340
- C:\Windows\System\vVvAqwM.exe
  C:\Windows\System\vVvAqwM.exe
  2⤵
  PID:5424
- C:\Windows\System\pehvFLM.exe
  C:\Windows\System\pehvFLM.exe
  2⤵
  PID:5480
- C:\Windows\System\jrmLlcJ.exe
  C:\Windows\System\jrmLlcJ.exe
  2⤵
  PID:4556
- C:\Windows\System\Kjwmqrv.exe
  C:\Windows\System\Kjwmqrv.exe
  2⤵
  PID:11316
- C:\Windows\System\lkUqSjN.exe
  C:\Windows\System\lkUqSjN.exe
  2⤵
  PID:2992
- C:\Windows\System\XfwiMmT.exe
  C:\Windows\System\XfwiMmT.exe
  2⤵
  PID:5640
- C:\Windows\System\XIwkQRG.exe
  C:\Windows\System\XIwkQRG.exe
  2⤵
  PID:3252
- C:\Windows\System\XJxJxgZ.exe
  C:\Windows\System\XJxJxgZ.exe
  2⤵
  PID:5528
- C:\Windows\System\KyMdFVk.exe
  C:\Windows\System\KyMdFVk.exe
  2⤵
  PID:5592
- C:\Windows\System\OWnygZG.exe
  C:\Windows\System\OWnygZG.exe
  2⤵
  PID:2748
- C:\Windows\System\bHKPImM.exe
  C:\Windows\System\bHKPImM.exe
  2⤵
  PID:5500
- C:\Windows\System\gqUoQFk.exe
  C:\Windows\System\gqUoQFk.exe
  2⤵
  PID:5276
- C:\Windows\System\sXWiVNr.exe
  C:\Windows\System\sXWiVNr.exe
  2⤵
  PID:6092
- C:\Windows\System\lBTxsoP.exe
  C:\Windows\System\lBTxsoP.exe
  2⤵
  PID:6120
- C:\Windows\System\NJBGlxz.exe
  C:\Windows\System\NJBGlxz.exe
  2⤵
  PID:6100
- C:\Windows\System\uqsMiPz.exe
  C:\Windows\System\uqsMiPz.exe
  2⤵
  PID:5248
- C:\Windows\System\QghRnCP.exe
  C:\Windows\System\QghRnCP.exe
  2⤵
  PID:11744
- C:\Windows\System\izucNhN.exe
  C:\Windows\System\izucNhN.exe
  2⤵
  PID:5376
- C:\Windows\System\OGZFESx.exe
  C:\Windows\System\OGZFESx.exe
  2⤵
  PID:12300
- C:\Windows\System\qKwdAxv.exe
  C:\Windows\System\qKwdAxv.exe
  2⤵
  PID:12328
- C:\Windows\System\FopbYKT.exe
  C:\Windows\System\FopbYKT.exe
  2⤵
  PID:12356
- C:\Windows\System\HfJledR.exe
  C:\Windows\System\HfJledR.exe
  2⤵
  PID:12384
- C:\Windows\System\ojnpxoP.exe
  C:\Windows\System\ojnpxoP.exe
  2⤵
  PID:12412
- C:\Windows\System\doTWUBD.exe
  C:\Windows\System\doTWUBD.exe
  2⤵
  PID:12440
- C:\Windows\System\jrgoByr.exe
  C:\Windows\System\jrgoByr.exe
  2⤵
  PID:12468
- C:\Windows\System\euszAID.exe
  C:\Windows\System\euszAID.exe
  2⤵
  PID:12496
- C:\Windows\System\GltPbMD.exe
  C:\Windows\System\GltPbMD.exe
  2⤵
  PID:12524
- C:\Windows\System\JybqjBR.exe
  C:\Windows\System\JybqjBR.exe
  2⤵
  PID:12552
- C:\Windows\System\AvbfejP.exe
  C:\Windows\System\AvbfejP.exe
  2⤵
  PID:12580
- C:\Windows\System\oEeTlLE.exe
  C:\Windows\System\oEeTlLE.exe
  2⤵
  PID:12608
- C:\Windows\System\JwhGprl.exe
  C:\Windows\System\JwhGprl.exe
  2⤵
  PID:12636
- C:\Windows\System\gPkPffa.exe
  C:\Windows\System\gPkPffa.exe
  2⤵
  PID:12664
- C:\Windows\System\CrKraUA.exe
  C:\Windows\System\CrKraUA.exe
  2⤵
  PID:12696
- C:\Windows\System\QkOGmQL.exe
  C:\Windows\System\QkOGmQL.exe
  2⤵
  PID:12724
- C:\Windows\System\tpnvPqc.exe
  C:\Windows\System\tpnvPqc.exe
  2⤵
  PID:12752
- C:\Windows\System\gJkbSjh.exe
  C:\Windows\System\gJkbSjh.exe
  2⤵
  PID:12780
- C:\Windows\System\wCvmVMi.exe
  C:\Windows\System\wCvmVMi.exe
  2⤵
  PID:12808
- C:\Windows\System\lnbZUrm.exe
  C:\Windows\System\lnbZUrm.exe
  2⤵
  PID:12836
- C:\Windows\System\sqnFhWT.exe
  C:\Windows\System\sqnFhWT.exe
  2⤵
  PID:12864
- C:\Windows\System\tIZLxpB.exe
  C:\Windows\System\tIZLxpB.exe
  2⤵
  PID:12880
- C:\Windows\System\mVoqKHd.exe
  C:\Windows\System\mVoqKHd.exe
  2⤵
  PID:12904
- C:\Windows\System\RxhFaSg.exe
  C:\Windows\System\RxhFaSg.exe
  2⤵
  PID:12940
- C:\Windows\System\cCimVLt.exe
  C:\Windows\System\cCimVLt.exe
  2⤵
  PID:12976
- C:\Windows\System\HsUzYLi.exe
  C:\Windows\System\HsUzYLi.exe
  2⤵
  PID:13008
- C:\Windows\System\WEDRJMN.exe
  C:\Windows\System\WEDRJMN.exe
  2⤵
  PID:13048
- C:\Windows\System\IWnaVTz.exe
  C:\Windows\System\IWnaVTz.exe
  2⤵
  PID:13064
- C:\Windows\System\gKfgIWj.exe
  C:\Windows\System\gKfgIWj.exe
  2⤵
  PID:13092
- C:\Windows\System\jlcMAKC.exe
  C:\Windows\System\jlcMAKC.exe
  2⤵
  PID:13120
- C:\Windows\System\InCpbAi.exe
  C:\Windows\System\InCpbAi.exe
  2⤵
  PID:13148
- C:\Windows\System\MqZiYkT.exe
  C:\Windows\System\MqZiYkT.exe
  2⤵
  PID:13176
- C:\Windows\System\oBNFoyV.exe
  C:\Windows\System\oBNFoyV.exe
  2⤵
  PID:13204
- C:\Windows\System\TwVPqHC.exe
  C:\Windows\System\TwVPqHC.exe
  2⤵
  PID:13232
- C:\Windows\System\Deietxn.exe
  C:\Windows\System\Deietxn.exe
  2⤵
  PID:13260
- C:\Windows\System\HhDHQfc.exe
  C:\Windows\System\HhDHQfc.exe
  2⤵
  PID:13288
- C:\Windows\System\tAGINOC.exe
  C:\Windows\System\tAGINOC.exe
  2⤵
  PID:5452
- C:\Windows\System\jYevTED.exe
  C:\Windows\System\jYevTED.exe
  2⤵
  PID:12348
- C:\Windows\System\YlfVClc.exe
  C:\Windows\System\YlfVClc.exe
  2⤵
  PID:12396
- C:\Windows\System\cRogUyA.exe
  C:\Windows\System\cRogUyA.exe
  2⤵
  PID:12456
- C:\Windows\System\uVXCvhs.exe
  C:\Windows\System\uVXCvhs.exe
  2⤵
  PID:12516
- C:\Windows\System\OpuXJiT.exe
  C:\Windows\System\OpuXJiT.exe
  2⤵
  PID:12548
- C:\Windows\System\DMBsPgG.exe
  C:\Windows\System\DMBsPgG.exe
  2⤵
  PID:12572
- C:\Windows\System\ggcMGHH.exe
  C:\Windows\System\ggcMGHH.exe
  2⤵
  PID:12628
- C:\Windows\System\IHlEUEN.exe
  C:\Windows\System\IHlEUEN.exe
  2⤵
  PID:12656
- C:\Windows\System\nWNqhNj.exe
  C:\Windows\System\nWNqhNj.exe
  2⤵
  PID:1304
- C:\Windows\System\hAfBYCg.exe
  C:\Windows\System\hAfBYCg.exe
  2⤵
  PID:12716
- C:\Windows\System\AMkZLbk.exe
  C:\Windows\System\AMkZLbk.exe
  2⤵
  PID:12772
- C:\Windows\System\SzphhTc.exe
  C:\Windows\System\SzphhTc.exe
  2⤵
  PID:10024
- C:\Windows\System\rWnxRKM.exe
  C:\Windows\System\rWnxRKM.exe
  2⤵
  PID:9968
- C:\Windows\System\SpLQlKH.exe
  C:\Windows\System\SpLQlKH.exe
  2⤵
  PID:4924
- C:\Windows\System\VnOBQKD.exe
  C:\Windows\System\VnOBQKD.exe
  2⤵
  PID:5240
- C:\Windows\System\eUwyTQy.exe
  C:\Windows\System\eUwyTQy.exe
  2⤵
  PID:12920
- C:\Windows\System\ObqXzlF.exe
  C:\Windows\System\ObqXzlF.exe
  2⤵
  PID:4740
- C:\Windows\System\vgGEZYP.exe
  C:\Windows\System\vgGEZYP.exe
  2⤵
  PID:13020
- C:\Windows\System\uEIoxzd.exe
  C:\Windows\System\uEIoxzd.exe
  2⤵
  PID:13032
- C:\Windows\System\jbelzvF.exe
  C:\Windows\System\jbelzvF.exe
  2⤵
  PID:6296
- C:\Windows\System\soOViGp.exe
  C:\Windows\System\soOViGp.exe
  2⤵
  PID:6372
- C:\Windows\System\wFuaPEr.exe
  C:\Windows\System\wFuaPEr.exe
  2⤵
  PID:6396
- C:\Windows\System\OgnuzBa.exe
  C:\Windows\System\OgnuzBa.exe
  2⤵
  PID:13228
- C:\Windows\System\PCbPNHd.exe
  C:\Windows\System\PCbPNHd.exe
  2⤵
  PID:13284
- C:\Windows\System\PLdhWAE.exe
  C:\Windows\System\PLdhWAE.exe
  2⤵
  PID:13308
- C:\Windows\System\maIGPnQ.exe
  C:\Windows\System\maIGPnQ.exe
  2⤵
  PID:6556
- C:\Windows\System\dtPuJJB.exe
  C:\Windows\System\dtPuJJB.exe
  2⤵
  PID:12436
- C:\Windows\System\fFsHAtW.exe
  C:\Windows\System\fFsHAtW.exe
  2⤵
  PID:12544
- C:\Windows\System\KTJYBHs.exe
  C:\Windows\System\KTJYBHs.exe
  2⤵
  PID:12620
- C:\Windows\System\uBSziid.exe
  C:\Windows\System\uBSziid.exe
  2⤵
  PID:12692
- C:\Windows\System\DFLrXLE.exe
  C:\Windows\System\DFLrXLE.exe
  2⤵
  PID:12800
- C:\Windows\System\MbCXCPU.exe
  C:\Windows\System\MbCXCPU.exe
  2⤵
  PID:9816
- C:\Windows\System\eBIkWNN.exe
  C:\Windows\System\eBIkWNN.exe
  2⤵
  PID:5652
- C:\Windows\System\syhbxUn.exe
  C:\Windows\System\syhbxUn.exe
  2⤵
  PID:7076
- C:\Windows\System\BTHNDLz.exe
  C:\Windows\System\BTHNDLz.exe
  2⤵
  PID:13088
- C:\Windows\System\elROvTe.exe
  C:\Windows\System\elROvTe.exe
  2⤵
  PID:6164
- C:\Windows\System\fmPnYBQ.exe
  C:\Windows\System\fmPnYBQ.exe
  2⤵
  PID:6580
- C:\Windows\System\ejuePtz.exe
  C:\Windows\System\ejuePtz.exe
  2⤵
  PID:12492
- C:\Windows\System\CuHJFsr.exe
  C:\Windows\System\CuHJFsr.exe
  2⤵
  PID:6256
- C:\Windows\System\PrBaJqd.exe
  C:\Windows\System\PrBaJqd.exe
  2⤵
  PID:10004
- C:\Windows\System\AXIuWrj.exe
  C:\Windows\System\AXIuWrj.exe
  2⤵
  PID:7656
- C:\Windows\System\OYLMSzn.exe
  C:\Windows\System\OYLMSzn.exe
  2⤵
  PID:12632
- C:\Windows\System\IiPoXgd.exe
  C:\Windows\System\IiPoXgd.exe
  2⤵
  PID:7996
- C:\Windows\System\svcrhZQ.exe
  C:\Windows\System\svcrhZQ.exe
  2⤵
  PID:4748
- C:\Windows\System\cZWVmHJ.exe
  C:\Windows\System\cZWVmHJ.exe
  2⤵
  PID:13252
- C:\Windows\System\fyQHLAe.exe
  C:\Windows\System\fyQHLAe.exe
  2⤵
  PID:13280
- C:\Windows\System\IxMWfxT.exe
  C:\Windows\System\IxMWfxT.exe
  2⤵
  PID:12324
- C:\Windows\System\fWRjSWd.exe
  C:\Windows\System\fWRjSWd.exe
  2⤵
  PID:2492
- C:\Windows\System\WQnFnKK.exe
  C:\Windows\System\WQnFnKK.exe
  2⤵
  PID:7904
- C:\Windows\System\QnwoDey.exe
  C:\Windows\System\QnwoDey.exe
  2⤵
  PID:7940
- C:\Windows\System\HVhYKEM.exe
  C:\Windows\System\HVhYKEM.exe
  2⤵
  PID:3900
- C:\Windows\System\IwrRtjU.exe
  C:\Windows\System\IwrRtjU.exe
  2⤵
  PID:3888
- C:\Windows\System\snggLtY.exe
  C:\Windows\System\snggLtY.exe
  2⤵
  PID:8676
- C:\Windows\System\zVKeYYU.exe
  C:\Windows\System\zVKeYYU.exe
  2⤵
  PID:8988
- C:\Windows\System\VcdMMuw.exe
  C:\Windows\System\VcdMMuw.exe
  2⤵
  PID:9072
- C:\Windows\System\yaObZxa.exe
  C:\Windows\System\yaObZxa.exe
  2⤵
  PID:9148
- C:\Windows\System\lPLUuwz.exe
  C:\Windows\System\lPLUuwz.exe
  2⤵
  PID:6224
- C:\Windows\System\pARklgp.exe
  C:\Windows\System\pARklgp.exe
  2⤵
  PID:8308
- C:\Windows\System\kimtHrn.exe
  C:\Windows\System\kimtHrn.exe
  2⤵
  PID:8564
- C:\Windows\System\COjxCyI.exe
  C:\Windows\System\COjxCyI.exe
  2⤵
  PID:8864
- C:\Windows\System\mBuEjOS.exe
  C:\Windows\System\mBuEjOS.exe
  2⤵
  PID:5080
- C:\Windows\System\IEgnTrj.exe
  C:\Windows\System\IEgnTrj.exe
  2⤵
  PID:9012
- C:\Windows\System\ReHjxRU.exe
  C:\Windows\System\ReHjxRU.exe
  2⤵
  PID:8300
- C:\Windows\System\woSHZQH.exe
  C:\Windows\System\woSHZQH.exe
  2⤵
  PID:6392
- C:\Windows\System\lifNick.exe
  C:\Windows\System\lifNick.exe
  2⤵
  PID:6024
- C:\Windows\System\BCnnoXf.exe
  C:\Windows\System\BCnnoXf.exe
  2⤵
  PID:5764
- C:\Windows\System\fVdGQce.exe
  C:\Windows\System\fVdGQce.exe
  2⤵
  PID:5788
- C:\Windows\System\AjjmJrF.exe
  C:\Windows\System\AjjmJrF.exe
  2⤵
  PID:6048
- C:\Windows\System\iNJTdmD.exe
  C:\Windows\System\iNJTdmD.exe
  2⤵
  PID:5204
- C:\Windows\System\NtYydqe.exe
  C:\Windows\System\NtYydqe.exe
  2⤵
  PID:6036
- C:\Windows\System\cMFFmkl.exe
  C:\Windows\System\cMFFmkl.exe
  2⤵
  PID:2828
- C:\Windows\System\CgtuOkY.exe
  C:\Windows\System\CgtuOkY.exe
  2⤵
  PID:7920
- C:\Windows\System\yKmCoUb.exe
  C:\Windows\System\yKmCoUb.exe
  2⤵
  PID:8012
- C:\Windows\System\LpQIuZB.exe
  C:\Windows\System\LpQIuZB.exe
  2⤵
  PID:8952
- C:\Windows\System\mTMGptd.exe
  C:\Windows\System\mTMGptd.exe
  2⤵
  PID:9184
- C:\Windows\System\EhONIKt.exe
  C:\Windows\System\EhONIKt.exe
  2⤵
  PID:8372
- C:\Windows\System\muLzBrk.exe
  C:\Windows\System\muLzBrk.exe
  2⤵
  PID:8712
- C:\Windows\System\OTiOFvt.exe
  C:\Windows\System\OTiOFvt.exe
  2⤵
  PID:5696
- C:\Windows\System\UvEmomi.exe
  C:\Windows\System\UvEmomi.exe
  2⤵
  PID:9076
- C:\Windows\System\YnLhYal.exe
  C:\Windows\System\YnLhYal.exe
  2⤵
  PID:6040
- C:\Windows\System\VksvqPX.exe
  C:\Windows\System\VksvqPX.exe
  2⤵
  PID:5144
- C:\Windows\System\lXDQWba.exe
  C:\Windows\System\lXDQWba.exe
  2⤵
  PID:5832
- C:\Windows\System\EYShrib.exe
  C:\Windows\System\EYShrib.exe
  2⤵
  PID:12380
- C:\Windows\System\OcLHURD.exe
  C:\Windows\System\OcLHURD.exe
  2⤵
  PID:12856
- C:\Windows\System\uZKeaoF.exe
  C:\Windows\System\uZKeaoF.exe
  2⤵
  PID:8856
- C:\Windows\System\AwSlAmW.exe
  C:\Windows\System\AwSlAmW.exe
  2⤵
  PID:8200
- C:\Windows\System\ZlYPrVL.exe
  C:\Windows\System\ZlYPrVL.exe
  2⤵
  PID:8376
- C:\Windows\System\bLomGLF.exe
  C:\Windows\System\bLomGLF.exe
  2⤵
  PID:8800
- C:\Windows\System\yPvNuQF.exe
  C:\Windows\System\yPvNuQF.exe
  2⤵
  PID:8524
- C:\Windows\System\NwPCYEH.exe
  C:\Windows\System\NwPCYEH.exe
  2⤵
  PID:9412
- C:\Windows\System\KhKYXDy.exe
  C:\Windows\System\KhKYXDy.exe
  2⤵
  PID:9440
- C:\Windows\System\ZwxWkSg.exe
  C:\Windows\System\ZwxWkSg.exe
  2⤵
  PID:9508
- C:\Windows\System\uRRibUi.exe
  C:\Windows\System\uRRibUi.exe
  2⤵
  PID:8628
- C:\Windows\System\oMeyuEq.exe
  C:\Windows\System\oMeyuEq.exe
  2⤵
  PID:6160
- C:\Windows\System\PJJqsJx.exe
  C:\Windows\System\PJJqsJx.exe
  2⤵
  PID:6232
- C:\Windows\System\oocAmug.exe
  C:\Windows\System\oocAmug.exe
  2⤵
  PID:6680
- C:\Windows\System\kUwxZGq.exe
  C:\Windows\System\kUwxZGq.exe
  2⤵
  PID:5968
- C:\Windows\System\yTlCGlT.exe
  C:\Windows\System\yTlCGlT.exe
  2⤵
  PID:6848
- C:\Windows\System\MUdgWFG.exe
  C:\Windows\System\MUdgWFG.exe
  2⤵
  PID:9456
- C:\Windows\System\sAfnZsB.exe
  C:\Windows\System\sAfnZsB.exe
  2⤵
  PID:7072
- C:\Windows\System\YecuLKG.exe
  C:\Windows\System\YecuLKG.exe
  2⤵
  PID:6640
- C:\Windows\System\xKYjXlJ.exe
  C:\Windows\System\xKYjXlJ.exe
  2⤵
  PID:3744
- C:\Windows\System\UJXDlmV.exe
  C:\Windows\System\UJXDlmV.exe
  2⤵
  PID:9836
- C:\Windows\System\jarcLdt.exe
  C:\Windows\System\jarcLdt.exe
  2⤵
  PID:7100
- C:\Windows\System\EjunEsn.exe
  C:\Windows\System\EjunEsn.exe
  2⤵
  PID:9904
- C:\Windows\System\qUMLAgn.exe
  C:\Windows\System\qUMLAgn.exe
  2⤵
  PID:7164
- C:\Windows\System\iMrKToE.exe
  C:\Windows\System\iMrKToE.exe
  2⤵
  PID:7876
- C:\Windows\System\XZbyIZh.exe
  C:\Windows\System\XZbyIZh.exe
  2⤵
  PID:9156
- C:\Windows\System\cGmCArg.exe
  C:\Windows\System\cGmCArg.exe
  2⤵
  PID:6520
- C:\Windows\System\XxenQbr.exe
  C:\Windows\System\XxenQbr.exe
  2⤵
  PID:10168
- C:\Windows\System\TluHvAE.exe
  C:\Windows\System\TluHvAE.exe
  2⤵
  PID:9232
- C:\Windows\System\ISbmsWI.exe
  C:\Windows\System\ISbmsWI.exe
  2⤵
  PID:6772
- C:\Windows\System\FSxtKDf.exe
  C:\Windows\System\FSxtKDf.exe
  2⤵
  PID:7036
- C:\Windows\System\uImxrvt.exe
  C:\Windows\System\uImxrvt.exe
  2⤵
  PID:9364
- C:\Windows\System\nqRinUv.exe
  C:\Windows\System\nqRinUv.exe
  2⤵
  PID:7068
- C:\Windows\System\UvQZtSl.exe
  C:\Windows\System\UvQZtSl.exe
  2⤵
  PID:9884
- C:\Windows\System\NHoiMfM.exe
  C:\Windows\System\NHoiMfM.exe
  2⤵
  PID:9932
- C:\Windows\System\OyGAgJV.exe
  C:\Windows\System\OyGAgJV.exe
  2⤵
  PID:10056
- C:\Windows\System\UWUfXwj.exe
  C:\Windows\System\UWUfXwj.exe
  2⤵
  PID:6636
- C:\Windows\System\QkpSLNO.exe
  C:\Windows\System\QkpSLNO.exe
  2⤵
  PID:6804
- C:\Windows\System\GzsHmQI.exe
  C:\Windows\System\GzsHmQI.exe
  2⤵
  PID:6776
- C:\Windows\System\nohtfCT.exe
  C:\Windows\System\nohtfCT.exe
  2⤵
  PID:6200
- C:\Windows\System\nvEOhxt.exe
  C:\Windows\System\nvEOhxt.exe
  2⤵
  PID:6628
- C:\Windows\System\XLGdvSp.exe
  C:\Windows\System\XLGdvSp.exe
  2⤵
  PID:10220
- C:\Windows\System\cayawfU.exe
  C:\Windows\System\cayawfU.exe
  2⤵
  PID:7284
- C:\Windows\System\xjiUjcf.exe
  C:\Windows\System\xjiUjcf.exe
  2⤵
  PID:7424
- C:\Windows\System\TaWVfMA.exe
  C:\Windows\System\TaWVfMA.exe
  2⤵
  PID:7408
- C:\Windows\System\VcHfeQL.exe
  C:\Windows\System\VcHfeQL.exe
  2⤵
  PID:6324
- C:\Windows\System\GHiGeho.exe
  C:\Windows\System\GHiGeho.exe
  2⤵
  PID:6472
- C:\Windows\System\JtVYfuh.exe
  C:\Windows\System\JtVYfuh.exe
  2⤵
  PID:9568
- C:\Windows\System\zsCUmnJ.exe
  C:\Windows\System\zsCUmnJ.exe
  2⤵
  PID:7612
- C:\Windows\System\cWKoUPr.exe
  C:\Windows\System\cWKoUPr.exe
  2⤵
  PID:7652
- C:\Windows\System\ZuVsvli.exe
  C:\Windows\System\ZuVsvli.exe
  2⤵
  PID:7160
- C:\Windows\System\EWzQyTg.exe
  C:\Windows\System\EWzQyTg.exe
  2⤵
  PID:9916
- C:\Windows\System\gYvkyCn.exe
  C:\Windows\System\gYvkyCn.exe
  2⤵
  PID:10196
- C:\Windows\System\ZiznYYi.exe
  C:\Windows\System\ZiznYYi.exe
  2⤵
  PID:6196
- C:\Windows\System\butKnKh.exe
  C:\Windows\System\butKnKh.exe
  2⤵
  PID:7132
- C:\Windows\System\VXafspg.exe
  C:\Windows\System\VXafspg.exe
  2⤵
  PID:7520
- C:\Windows\System\HFCsUcK.exe
  C:\Windows\System\HFCsUcK.exe
  2⤵
  PID:8164
- C:\Windows\System\DMwIlQD.exe
  C:\Windows\System\DMwIlQD.exe
  2⤵
  PID:10284
- C:\Windows\System\SSkNdiB.exe
  C:\Windows\System\SSkNdiB.exe
  2⤵
  PID:7620
- C:\Windows\System\SzafQmR.exe
  C:\Windows\System\SzafQmR.exe
  2⤵
  PID:10104
- C:\Windows\System\PZJqhMI.exe
  C:\Windows\System\PZJqhMI.exe
  2⤵
  PID:7800
- C:\Windows\System\PcVDakI.exe
  C:\Windows\System\PcVDakI.exe
  2⤵
  PID:7028
- C:\Windows\System\nzWzevF.exe
  C:\Windows\System\nzWzevF.exe
  2⤵
  PID:7720
- C:\Windows\System\JYLaEDA.exe
  C:\Windows\System\JYLaEDA.exe
  2⤵
  PID:7672
- C:\Windows\System\tzDchCE.exe
  C:\Windows\System\tzDchCE.exe
  2⤵
  PID:10264
- C:\Windows\System\EGeFDYX.exe
  C:\Windows\System\EGeFDYX.exe
  2⤵
  PID:10396
- C:\Windows\System\tdVfbSh.exe
  C:\Windows\System\tdVfbSh.exe
  2⤵
  PID:7452
- C:\Windows\System\FdGtfdP.exe
  C:\Windows\System\FdGtfdP.exe
  2⤵
  PID:8004
- C:\Windows\System\xWssJwa.exe
  C:\Windows\System\xWssJwa.exe
  2⤵
  PID:9584
- C:\Windows\System\pgYvCfk.exe
  C:\Windows\System\pgYvCfk.exe
  2⤵
  PID:7748
- C:\Windows\System\MyqdIpG.exe
  C:\Windows\System\MyqdIpG.exe
  2⤵
  PID:8912
- C:\Windows\System\zCWLLAJ.exe
  C:\Windows\System\zCWLLAJ.exe
  2⤵
  PID:7224
- C:\Windows\System\bSnvhag.exe
  C:\Windows\System\bSnvhag.exe
  2⤵
  PID:7456
- C:\Windows\System\ubpFFEq.exe
  C:\Windows\System\ubpFFEq.exe
  2⤵
  PID:10504
- C:\Windows\System\UQaFuEp.exe
  C:\Windows\System\UQaFuEp.exe
  2⤵
  PID:10392
- C:\Windows\System\OQxMAbU.exe
  C:\Windows\System\OQxMAbU.exe
  2⤵
  PID:7892
- C:\Windows\System\tGfQmPq.exe
  C:\Windows\System\tGfQmPq.exe
  2⤵
  PID:8008
- C:\Windows\System\IQQTSHY.exe
  C:\Windows\System\IQQTSHY.exe
  2⤵
  PID:7044
- C:\Windows\System\RnfqGpz.exe
  C:\Windows\System\RnfqGpz.exe
  2⤵
  PID:7448
- C:\Windows\System\YCdMEBk.exe
  C:\Windows\System\YCdMEBk.exe
  2⤵
  PID:7444
- C:\Windows\System\EaYCODn.exe
  C:\Windows\System\EaYCODn.exe
  2⤵
  PID:7908
- C:\Windows\System\BjMLaEG.exe
  C:\Windows\System\BjMLaEG.exe
  2⤵
  PID:8128
- C:\Windows\System\pckpteW.exe
  C:\Windows\System\pckpteW.exe
  2⤵
  PID:6252
- C:\Windows\System\CXGIATb.exe
  C:\Windows\System\CXGIATb.exe
  2⤵
  PID:7780
- C:\Windows\System\uZzEfIO.exe
  C:\Windows\System\uZzEfIO.exe
  2⤵
  PID:13336
- C:\Windows\System\avmdOJB.exe
  C:\Windows\System\avmdOJB.exe
  2⤵
  PID:13364
- C:\Windows\System\SnLZdqk.exe
  C:\Windows\System\SnLZdqk.exe
  2⤵
  PID:13392
- C:\Windows\System\EvOiunj.exe
  C:\Windows\System\EvOiunj.exe
  2⤵
  PID:13420
- C:\Windows\System\WqMkSJO.exe
  C:\Windows\System\WqMkSJO.exe
  2⤵
  PID:13448
- C:\Windows\System\luhZRhk.exe
  C:\Windows\System\luhZRhk.exe
  2⤵
  PID:13476
- C:\Windows\System\BcZMlWM.exe
  C:\Windows\System\BcZMlWM.exe
  2⤵
  PID:13508
- C:\Windows\System\kDWhIit.exe
  C:\Windows\System\kDWhIit.exe
  2⤵
  PID:13536
- C:\Windows\System\ZxfspQQ.exe
  C:\Windows\System\ZxfspQQ.exe
  2⤵
  PID:13564
- C:\Windows\System\tUUrdFv.exe
  C:\Windows\System\tUUrdFv.exe
  2⤵
  PID:13596
- C:\Windows\System\PLjpCNh.exe
  C:\Windows\System\PLjpCNh.exe
  2⤵
  PID:13624
- C:\Windows\System\PrENPku.exe
  C:\Windows\System\PrENPku.exe
  2⤵
  PID:13652
- C:\Windows\System\EwfyCHG.exe
  C:\Windows\System\EwfyCHG.exe
  2⤵
  PID:13680
- C:\Windows\System\TUhBCdE.exe
  C:\Windows\System\TUhBCdE.exe
  2⤵
  PID:13708
- C:\Windows\System\eQmZpOA.exe
  C:\Windows\System\eQmZpOA.exe
  2⤵
  PID:13736
- C:\Windows\System\KRYQOJq.exe
  C:\Windows\System\KRYQOJq.exe
  2⤵
  PID:13764
- C:\Windows\System\FSihEEw.exe
  C:\Windows\System\FSihEEw.exe
  2⤵
  PID:13792
- C:\Windows\System\iTNbEcC.exe
  C:\Windows\System\iTNbEcC.exe
  2⤵
  PID:13820
- C:\Windows\System\WpFhoWT.exe
  C:\Windows\System\WpFhoWT.exe
  2⤵
  PID:13852
- C:\Windows\System\wDENjFK.exe
  C:\Windows\System\wDENjFK.exe
  2⤵
  PID:13880
- C:\Windows\System\zAzPfpw.exe
  C:\Windows\System\zAzPfpw.exe
  2⤵
  PID:13908
- C:\Windows\System\sMOolTI.exe
  C:\Windows\System\sMOolTI.exe
  2⤵
  PID:13936
- C:\Windows\System\eIkWlGN.exe
  C:\Windows\System\eIkWlGN.exe
  2⤵
  PID:13964
- C:\Windows\System\IBaXrSn.exe
  C:\Windows\System\IBaXrSn.exe
  2⤵
  PID:13996
- C:\Windows\System\wBJjStL.exe
  C:\Windows\System\wBJjStL.exe
  2⤵
  PID:14024
- C:\Windows\System\nESoqnX.exe
  C:\Windows\System\nESoqnX.exe
  2⤵
  PID:14056
- C:\Windows\System\vXVfkji.exe
  C:\Windows\System\vXVfkji.exe
  2⤵
  PID:14080
- C:\Windows\System\TcfIwXM.exe
  C:\Windows\System\TcfIwXM.exe
  2⤵
  PID:14108
- C:\Windows\System\vMZjvJg.exe
  C:\Windows\System\vMZjvJg.exe
  2⤵
  PID:14136
- C:\Windows\System\bolKrrS.exe
  C:\Windows\System\bolKrrS.exe
  2⤵
  PID:14164
- C:\Windows\System\JcUWMOt.exe
  C:\Windows\System\JcUWMOt.exe
  2⤵
  PID:14208
- C:\Windows\System\gPAArCy.exe
  C:\Windows\System\gPAArCy.exe
  2⤵
  PID:14224
- C:\Windows\System\MzqmTBb.exe
  C:\Windows\System\MzqmTBb.exe
  2⤵
  PID:14248
- C:\Windows\System\ZpHyhYs.exe
  C:\Windows\System\ZpHyhYs.exe
  2⤵
  PID:14280
- C:\Windows\System\KVMWjFp.exe
  C:\Windows\System\KVMWjFp.exe
  2⤵
  PID:14312
- C:\Windows\System\rEhqzCu.exe
  C:\Windows\System\rEhqzCu.exe
  2⤵
  PID:7728
- C:\Windows\System\ZreNDuD.exe
  C:\Windows\System\ZreNDuD.exe
  2⤵
  PID:13348
- C:\Windows\System\gCjqeyI.exe
  C:\Windows\System\gCjqeyI.exe
  2⤵
  PID:8336
- C:\Windows\System\EiYIbIj.exe
  C:\Windows\System\EiYIbIj.exe
  2⤵
  PID:8304
- C:\Windows\System\YIrhhnY.exe
  C:\Windows\System\YIrhhnY.exe
  2⤵
  PID:13440
- C:\Windows\System\wVnvrSc.exe
  C:\Windows\System\wVnvrSc.exe
  2⤵
  PID:13472
- C:\Windows\System\XegDDNH.exe
  C:\Windows\System\XegDDNH.exe
  2⤵
  PID:8496
- C:\Windows\System\MlMvaPk.exe
  C:\Windows\System\MlMvaPk.exe
  2⤵
  PID:8508
- C:\Windows\System\HmrETBc.exe
  C:\Windows\System\HmrETBc.exe
  2⤵
  PID:13556
- C:\Windows\System\rLBdGsF.exe
  C:\Windows\System\rLBdGsF.exe
  2⤵
  PID:13576
- C:\Windows\System\tuhTCfp.exe
  C:\Windows\System\tuhTCfp.exe
  2⤵
  PID:13636
- C:\Windows\System\BqCRLft.exe
  C:\Windows\System\BqCRLft.exe
  2⤵
  PID:13672
- C:\Windows\System\cILXRKk.exe
  C:\Windows\System\cILXRKk.exe
  2⤵
  PID:13720
- C:\Windows\System\ISJMAgy.exe
  C:\Windows\System\ISJMAgy.exe
  2⤵
  PID:13748
- C:\Windows\System\wVpVZte.exe
  C:\Windows\System\wVpVZte.exe
  2⤵
  PID:13760
- C:\Windows\System\WUJpArQ.exe
  C:\Windows\System\WUJpArQ.exe
  2⤵
  PID:8924
- C:\Windows\System\zaqrEeG.exe
  C:\Windows\System\zaqrEeG.exe
  2⤵
  PID:13844
- C:\Windows\System\CACQHvD.exe
  C:\Windows\System\CACQHvD.exe
  2⤵
  PID:13876
- C:\Windows\System\qpFtULi.exe
  C:\Windows\System\qpFtULi.exe
  2⤵
  PID:13920
- C:\Windows\System\PYdBAut.exe
  C:\Windows\System\PYdBAut.exe
  2⤵
  PID:13952
- C:\Windows\System\ZayPVdu.exe
  C:\Windows\System\ZayPVdu.exe
  2⤵
  PID:8256
- C:\Windows\System\FOKJOOe.exe
  C:\Windows\System\FOKJOOe.exe
  2⤵
  PID:14072
- C:\Windows\System\ktSfunc.exe
  C:\Windows\System\ktSfunc.exe
  2⤵
  PID:14120
- C:\Windows\System\RcaKoRa.exe
  C:\Windows\System\RcaKoRa.exe
  2⤵
  PID:14156
- C:\Windows\System\cTZeHqa.exe
  C:\Windows\System\cTZeHqa.exe
  2⤵
  PID:11488
- C:\Windows\System\lYcOZYY.exe
  C:\Windows\System\lYcOZYY.exe
  2⤵
  PID:11564
- C:\Windows\System\hcxLgwg.exe
  C:\Windows\System\hcxLgwg.exe
  2⤵
  PID:14188
- C:\Windows\System\AGpieVJ.exe
  C:\Windows\System\AGpieVJ.exe
  2⤵
  PID:8492
- C:\Windows\System\lpSPpMt.exe
  C:\Windows\System\lpSPpMt.exe
  2⤵
  PID:8396
- C:\Windows\System\vvXEDrd.exe
  C:\Windows\System\vvXEDrd.exe
  2⤵
  PID:11940
- C:\Windows\System\KMfxpcq.exe
  C:\Windows\System\KMfxpcq.exe
  2⤵
  PID:11976
- C:\Windows\System\jdFabhX.exe
  C:\Windows\System\jdFabhX.exe
  2⤵
  PID:14272
- C:\Windows\System\OFlliPp.exe
  C:\Windows\System\OFlliPp.exe
  2⤵
  PID:14304
- C:\Windows\System\PBoTIkD.exe
  C:\Windows\System\PBoTIkD.exe
  2⤵
  PID:12096
- C:\Windows\System\iBIXLmC.exe
  C:\Windows\System\iBIXLmC.exe
  2⤵
  PID:13412
- C:\Windows\System\wSpQFfP.exe
  C:\Windows\System\wSpQFfP.exe
  2⤵
  PID:13432
- C:\Windows\System\Lzxgjzf.exe
  C:\Windows\System\Lzxgjzf.exe
  2⤵
  PID:13468
- C:\Windows\System\HyNcExx.exe
  C:\Windows\System\HyNcExx.exe
  2⤵
  PID:8452
- C:\Windows\System\ASyqeLm.exe
  C:\Windows\System\ASyqeLm.exe
  2⤵
  PID:10700
- C:\Windows\System\fuBBPru.exe
  C:\Windows\System\fuBBPru.exe
  2⤵
  PID:13620
- C:\Windows\System\ftPNNOV.exe
  C:\Windows\System\ftPNNOV.exe
  2⤵
  PID:13704
- C:\Windows\System\KqrkpcN.exe
  C:\Windows\System\KqrkpcN.exe
  2⤵
  PID:13788
- C:\Windows\System\pQmxQpN.exe
  C:\Windows\System\pQmxQpN.exe
  2⤵
  PID:13872
- C:\Windows\System\hpyuJZp.exe
  C:\Windows\System\hpyuJZp.exe
  2⤵
  PID:14036
- C:\Windows\System\XThJLzT.exe
  C:\Windows\System\XThJLzT.exe
  2⤵
  PID:11328
- C:\Windows\System\WRNjSck.exe
  C:\Windows\System\WRNjSck.exe
  2⤵
  PID:11452
- C:\Windows\System\CmwKMeW.exe
  C:\Windows\System\CmwKMeW.exe
  2⤵
  PID:8480
- C:\Windows\System\hCyqScQ.exe
  C:\Windows\System\hCyqScQ.exe
  2⤵
  PID:6852
- C:\Windows\System\UZkxcFE.exe
  C:\Windows\System\UZkxcFE.exe
  2⤵
  PID:14236
- C:\Windows\System\IiNbIEO.exe
  C:\Windows\System\IiNbIEO.exe
  2⤵
  PID:14332
- C:\Windows\System\UCWjYAV.exe
  C:\Windows\System\UCWjYAV.exe
  2⤵
  PID:12200
- C:\Windows\System\yawvxYD.exe
  C:\Windows\System\yawvxYD.exe
  2⤵
  PID:13560
- C:\Windows\System\DFYQewi.exe
  C:\Windows\System\DFYQewi.exe
  2⤵
  PID:13616
- C:\Windows\System\QLfEySA.exe
  C:\Windows\System\QLfEySA.exe
  2⤵
  PID:11188
- C:\Windows\System\qZncppf.exe
  C:\Windows\System\qZncppf.exe
  2⤵
  PID:10540
- C:\Windows\System\KSUbaJe.exe
  C:\Windows\System\KSUbaJe.exe
  2⤵
  PID:11576
- C:\Windows\System\ZkyzqkS.exe
  C:\Windows\System\ZkyzqkS.exe
  2⤵
  PID:8620
- C:\Windows\System\FJXokVz.exe
  C:\Windows\System\FJXokVz.exe
  2⤵
  PID:13328
- C:\Windows\System\NlMzUcg.exe
  C:\Windows\System\NlMzUcg.exe
  2⤵
  PID:9152
- C:\Windows\System\GmMpxaF.exe
  C:\Windows\System\GmMpxaF.exe
  2⤵
  PID:13848
- C:\Windows\System\WJjBAdU.exe
  C:\Windows\System\WJjBAdU.exe
  2⤵
  PID:10656
- C:\Windows\System\ixQAtAx.exe
  C:\Windows\System\ixQAtAx.exe
  2⤵
  PID:8820
- C:\Windows\System\mYNmheW.exe
  C:\Windows\System\mYNmheW.exe
  2⤵
  PID:11388
- C:\Windows\System\BnYKnIO.exe
  C:\Windows\System\BnYKnIO.exe
  2⤵
  PID:9768
- C:\Windows\System\IfTBvUZ.exe
  C:\Windows\System\IfTBvUZ.exe
  2⤵
  PID:14360
- C:\Windows\System\pmlfdPB.exe
  C:\Windows\System\pmlfdPB.exe
  2⤵
  PID:14388
- C:\Windows\System\NHiUwar.exe
  C:\Windows\System\NHiUwar.exe
  2⤵
  PID:14416
- C:\Windows\System\rSBYpJN.exe
  C:\Windows\System\rSBYpJN.exe
  2⤵
  PID:14444
- C:\Windows\System\HWrtqXU.exe
  C:\Windows\System\HWrtqXU.exe
  2⤵
  PID:14472
- C:\Windows\System\FcRrzFL.exe
  C:\Windows\System\FcRrzFL.exe
  2⤵
  PID:14500
- C:\Windows\System\tEWliku.exe
  C:\Windows\System\tEWliku.exe
  2⤵
  PID:14528
- C:\Windows\System\wFCSIjG.exe
  C:\Windows\System\wFCSIjG.exe
  2⤵
  PID:14556
- C:\Windows\System\psfmwfK.exe
  C:\Windows\System\psfmwfK.exe
  2⤵
  PID:14584
- C:\Windows\System\aciHaAv.exe
  C:\Windows\System\aciHaAv.exe
  2⤵
  PID:14612
- C:\Windows\System\EJEkPrN.exe
  C:\Windows\System\EJEkPrN.exe
  2⤵
  PID:14640
- C:\Windows\System\molpKzK.exe
  C:\Windows\System\molpKzK.exe
  2⤵
  PID:14668
- C:\Windows\System\gHabRWZ.exe
  C:\Windows\System\gHabRWZ.exe
  2⤵
  PID:14700
- C:\Windows\System\TkeLtIt.exe
  C:\Windows\System\TkeLtIt.exe
  2⤵
  PID:14728
- C:\Windows\System\cuBUHKg.exe
  C:\Windows\System\cuBUHKg.exe
  2⤵
  PID:14756
- C:\Windows\System\usYdhxo.exe
  C:\Windows\System\usYdhxo.exe
  2⤵
  PID:14784
- C:\Windows\System\bRdSlbx.exe
  C:\Windows\System\bRdSlbx.exe
  2⤵
  PID:14800
- C:\Windows\System\uqvOjgh.exe
  C:\Windows\System\uqvOjgh.exe
  2⤵
  PID:14840
- C:\Windows\System\FpdwXao.exe
  C:\Windows\System\FpdwXao.exe
  2⤵
  PID:14876
- C:\Windows\System\rFPjuAx.exe
  C:\Windows\System\rFPjuAx.exe
  2⤵
  PID:14896
- C:\Windows\System\OnRtOqk.exe
  C:\Windows\System\OnRtOqk.exe
  2⤵
  PID:14912
- C:\Windows\System\ZdtmHhc.exe
  C:\Windows\System\ZdtmHhc.exe
  2⤵
  PID:14952
- C:\Windows\System\KCDZUCI.exe
  C:\Windows\System\KCDZUCI.exe
  2⤵
  PID:14980
- C:\Windows\System\YpVCTKT.exe
  C:\Windows\System\YpVCTKT.exe
  2⤵
  PID:15008
- C:\Windows\System\fTtTcvn.exe
  C:\Windows\System\fTtTcvn.exe
  2⤵
  PID:15036
- C:\Windows\System\XzjMPXV.exe
  C:\Windows\System\XzjMPXV.exe
  2⤵
  PID:15064
- C:\Windows\System\Fruqjil.exe
  C:\Windows\System\Fruqjil.exe
  2⤵
  PID:15092
- C:\Windows\System\DstsWSt.exe
  C:\Windows\System\DstsWSt.exe
  2⤵
  PID:15120
- C:\Windows\System\OfYPIwv.exe
  C:\Windows\System\OfYPIwv.exe
  2⤵
  PID:15148
- C:\Windows\System\TkkDzHW.exe
  C:\Windows\System\TkkDzHW.exe
  2⤵
  PID:15164
- C:\Windows\System\wuTRzNS.exe
  C:\Windows\System\wuTRzNS.exe
  2⤵
  PID:15204
- C:\Windows\System\zOKADxs.exe
  C:\Windows\System\zOKADxs.exe
  2⤵
  PID:15232
- C:\Windows\System\jGoTrrt.exe
  C:\Windows\System\jGoTrrt.exe
  2⤵
  PID:15248
- C:\Windows\System\ZctgJKZ.exe
  C:\Windows\System\ZctgJKZ.exe
  2⤵
  PID:15288
- C:\Windows\System\ePnJmAi.exe
  C:\Windows\System\ePnJmAi.exe
  2⤵
  PID:15320
- C:\Windows\System\zBwREDD.exe
  C:\Windows\System\zBwREDD.exe
  2⤵
  PID:15348
- C:\Windows\System\aTxMaaF.exe
  C:\Windows\System\aTxMaaF.exe
  2⤵
  PID:14356
- C:\Windows\System\DTfoYOt.exe
  C:\Windows\System\DTfoYOt.exe
  2⤵
  PID:9732
- C:\Windows\System\sQnidEt.exe
  C:\Windows\System\sQnidEt.exe
  2⤵
  PID:14468
- C:\Windows\System\PcfIBSN.exe
  C:\Windows\System\PcfIBSN.exe
  2⤵
  PID:14496
- C:\Windows\System\KOxoYcj.exe
  C:\Windows\System\KOxoYcj.exe
  2⤵
  PID:14592
- C:\Windows\System\GZNzfgV.exe
  C:\Windows\System\GZNzfgV.exe
  2⤵
  PID:14652
- C:\Windows\System\TCnEvxQ.exe
  C:\Windows\System\TCnEvxQ.exe
  2⤵
  PID:8400
- C:\Windows\System\deEpkCR.exe
  C:\Windows\System\deEpkCR.exe
  2⤵
  PID:14740
- C:\Windows\System\GnQTYYR.exe
  C:\Windows\System\GnQTYYR.exe
  2⤵
  PID:14776
- C:\Windows\System\KbDVpJV.exe
  C:\Windows\System\KbDVpJV.exe
  2⤵
  PID:14852
- C:\Windows\System\buRKMCf.exe
  C:\Windows\System\buRKMCf.exe
  2⤵
  PID:14908
- C:\Windows\System\DZLgKXU.exe
  C:\Windows\System\DZLgKXU.exe
  2⤵
  PID:14976
- C:\Windows\System\kVXQqFg.exe
  C:\Windows\System\kVXQqFg.exe
  2⤵
  PID:15028
- C:\Windows\System\rwyQUmh.exe
  C:\Windows\System\rwyQUmh.exe
  2⤵
  PID:15112
- C:\Windows\System\fQiKJOY.exe
  C:\Windows\System\fQiKJOY.exe
  2⤵
  PID:15184
- C:\Windows\System\DxiaUZR.exe
  C:\Windows\System\DxiaUZR.exe
  2⤵
  PID:15240
- C:\Windows\System\UVYSUIu.exe
  C:\Windows\System\UVYSUIu.exe
  2⤵
  PID:15276
- C:\Windows\System\rPuQnHj.exe
  C:\Windows\System\rPuQnHj.exe
  2⤵
  PID:14688
- C:\Windows\System\DLqkDRz.exe
  C:\Windows\System\DLqkDRz.exe
  2⤵
  PID:14384
- C:\Windows\System\FkTzugR.exe
  C:\Windows\System\FkTzugR.exe
  2⤵
  PID:3712
- C:\Windows\System\yIQOpde.exe
  C:\Windows\System\yIQOpde.exe
  2⤵
  PID:14684
- C:\Windows\System\PivnrjT.exe
  C:\Windows\System\PivnrjT.exe
  2⤵
  PID:9476
- C:\Windows\System\ikrcVxz.exe
  C:\Windows\System\ikrcVxz.exe
  2⤵
  PID:14836
- C:\Windows\System\MdXfIts.exe
  C:\Windows\System\MdXfIts.exe
  2⤵
  PID:10704
- C:\Windows\System\EzYZHVG.exe
  C:\Windows\System\EzYZHVG.exe
  2⤵
  PID:10676
- C:\Windows\System\YhTFVEt.exe
  C:\Windows\System\YhTFVEt.exe
  2⤵
  PID:10724
- C:\Windows\System\AUFExHp.exe
  C:\Windows\System\AUFExHp.exe
  2⤵
  PID:15156
- C:\Windows\System\fTLZxki.exe
  C:\Windows\System\fTLZxki.exe
  2⤵
  PID:10860
- C:\Windows\System\ldyAlei.exe
  C:\Windows\System\ldyAlei.exe
  2⤵
  PID:15304
- C:\Windows\System\yuNqtSD.exe
  C:\Windows\System\yuNqtSD.exe
  2⤵
  PID:10912
- C:\Windows\System\xKVSYCz.exe
  C:\Windows\System\xKVSYCz.exe
  2⤵
  PID:14492
- C:\Windows\System\XjtXKEH.exe
  C:\Windows\System\XjtXKEH.exe
  2⤵
  PID:5536
- C:\Windows\System\PUcGKOI.exe
  C:\Windows\System\PUcGKOI.exe
  2⤵
  PID:11008
- C:\Windows\System\VWLqcNP.exe
  C:\Windows\System\VWLqcNP.exe
  2⤵
  PID:11084
- C:\Windows\System\LrSwhGJ.exe
  C:\Windows\System\LrSwhGJ.exe
  2⤵
  PID:12040
- C:\Windows\System\MlAdbEK.exe
  C:\Windows\System\MlAdbEK.exe
  2⤵
  PID:10792
- C:\Windows\System\mEAHxev.exe
  C:\Windows\System\mEAHxev.exe
  2⤵
  PID:11208
- C:\Windows\System\CuuvqMQ.exe
  C:\Windows\System\CuuvqMQ.exe
  2⤵
  PID:15260
- C:\Windows\System\bHLdlwX.exe
  C:\Windows\System\bHLdlwX.exe
  2⤵
  PID:10276
- C:\Windows\System\xWiftdX.exe
  C:\Windows\System\xWiftdX.exe
  2⤵
  PID:9256
- C:\Windows\System\ROsVZkG.exe
  C:\Windows\System\ROsVZkG.exe
  2⤵
  PID:14400
- C:\Windows\System\AtWzGVB.exe
  C:\Windows\System\AtWzGVB.exe
  2⤵
  PID:10512
- C:\Windows\System\ChTBoNv.exe
  C:\Windows\System\ChTBoNv.exe
  2⤵
  PID:6104
- C:\Windows\System\KuMgEgn.exe
  C:\Windows\System\KuMgEgn.exe
  2⤵
  PID:3284
- C:\Windows\System\WfhaYWO.exe
  C:\Windows\System\WfhaYWO.exe
  2⤵
  PID:3872
- C:\Windows\System\PVKejrg.exe
  C:\Windows\System\PVKejrg.exe
  2⤵
  PID:6064
- C:\Windows\System\Qgpewqk.exe
  C:\Windows\System\Qgpewqk.exe
  2⤵
  PID:12316
- C:\Windows\System\hiuLmLA.exe
  C:\Windows\System\hiuLmLA.exe
  2⤵
  PID:12344
- C:\Windows\System\HOuESCG.exe
  C:\Windows\System\HOuESCG.exe
  2⤵
  PID:11012
- C:\Windows\System\rjsTkwh.exe
  C:\Windows\System\rjsTkwh.exe
  2⤵
  PID:14440
- C:\Windows\System\pAFVuIg.exe
  C:\Windows\System\pAFVuIg.exe
  2⤵
  PID:12448
- C:\Windows\System\azMSrrj.exe
  C:\Windows\System\azMSrrj.exe
  2⤵
  PID:10420
- C:\Windows\System\COSQxpW.exe
  C:\Windows\System\COSQxpW.exe
  2⤵
  PID:12536
- C:\Windows\System\KrTIsNn.exe
  C:\Windows\System\KrTIsNn.exe
  2⤵
  PID:12568
- C:\Windows\System\EOgBvDQ.exe
  C:\Windows\System\EOgBvDQ.exe
  2⤵
  PID:11232
- C:\Windows\System\AjjMNOc.exe
  C:\Windows\System\AjjMNOc.exe
  2⤵
  PID:11252
- C:\Windows\System\byxhTKV.exe
  C:\Windows\System\byxhTKV.exe
  2⤵
  PID:10780
- C:\Windows\System\uMpyZPN.exe
  C:\Windows\System\uMpyZPN.exe
  2⤵
  PID:12732
- C:\Windows\System\DAowABH.exe
  C:\Windows\System\DAowABH.exe
  2⤵
  PID:12816
- C:\Windows\System\PxrVjVH.exe
  C:\Windows\System\PxrVjVH.exe
  2⤵
  PID:12960
- C:\Windows\System\GBSitXg.exe
  C:\Windows\System\GBSitXg.exe
  2⤵
  PID:13036
- C:\Windows\System\gQZWdTT.exe
  C:\Windows\System\gQZWdTT.exe
  2⤵
  PID:13192
- C:\Windows\System\hcSSayw.exe
  C:\Windows\System\hcSSayw.exe
  2⤵
  PID:12028
- C:\Windows\System\EdNIiJf.exe
  C:\Windows\System\EdNIiJf.exe
  2⤵
  PID:11436
- C:\Windows\System\vbQbnkv.exe
  C:\Windows\System\vbQbnkv.exe
  2⤵
  PID:11272
- C:\Windows\System\KGZPBAi.exe
  C:\Windows\System\KGZPBAi.exe
  2⤵
  PID:10948
- C:\Windows\System\hnKkfTw.exe
  C:\Windows\System\hnKkfTw.exe
  2⤵
  PID:13296
- C:\Windows\System\usFbIOu.exe
  C:\Windows\System\usFbIOu.exe
  2⤵
  PID:12476
- C:\Windows\System\YpILXLy.exe
  C:\Windows\System\YpILXLy.exe
  2⤵
  PID:12368
- C:\Windows\System\WppEsLQ.exe
  C:\Windows\System\WppEsLQ.exe
  2⤵
  PID:11860
- C:\Windows\System\PPpSoOm.exe
  C:\Windows\System\PPpSoOm.exe
  2⤵
  PID:11216
- C:\Windows\System\uFoiepe.exe
  C:\Windows\System\uFoiepe.exe
  2⤵
  PID:12672
- C:\Windows\System\pKoIjAu.exe
  C:\Windows\System\pKoIjAu.exe
  2⤵
  PID:12760
- C:\Windows\System\VzqWpOh.exe
  C:\Windows\System\VzqWpOh.exe
  2⤵
  PID:12676
- C:\Windows\System\xHLYTIz.exe
  C:\Windows\System\xHLYTIz.exe
  2⤵
  PID:12932
- C:\Windows\System\YzZZfGB.exe
  C:\Windows\System\YzZZfGB.exe
  2⤵
  PID:10464
- C:\Windows\System\qIzzKWS.exe
  C:\Windows\System\qIzzKWS.exe
  2⤵
  PID:13136
- C:\Windows\System\ePcjzmE.exe
  C:\Windows\System\ePcjzmE.exe
  2⤵
  PID:12820
- C:\Windows\System\BkyQaMZ.exe
  C:\Windows\System\BkyQaMZ.exe
  2⤵
  PID:13248
- C:\Windows\System\tVSyCQv.exe
  C:\Windows\System\tVSyCQv.exe
  2⤵
  PID:11308
- C:\Windows\System\CeWiyrf.exe
  C:\Windows\System\CeWiyrf.exe
  2⤵
  PID:13028
- C:\Windows\System\ZyxpKJw.exe
  C:\Windows\System\ZyxpKJw.exe
  2⤵
  PID:11808
- C:\Windows\System\sFPDEzw.exe
  C:\Windows\System\sFPDEzw.exe
  2⤵
  PID:12376
- C:\Windows\System\TojTyMt.exe
  C:\Windows\System\TojTyMt.exe
  2⤵
  PID:12596
- C:\Windows\System\fWDttLQ.exe
  C:\Windows\System\fWDttLQ.exe
  2⤵
  PID:6132
- C:\Windows\System\vcwzCVi.exe
  C:\Windows\System\vcwzCVi.exe
  2⤵
  PID:12036
- C:\Windows\System\uSvEYwx.exe
  C:\Windows\System\uSvEYwx.exe
  2⤵
  PID:12284
- C:\Windows\System\zwwCnOY.exe
  C:\Windows\System\zwwCnOY.exe
  2⤵
  PID:10016
- C:\Windows\System\MyHlBJk.exe
  C:\Windows\System\MyHlBJk.exe
  2⤵
  PID:5656
- C:\Windows\System\hAumdMv.exe
  C:\Windows\System\hAumdMv.exe
  2⤵
  PID:12688
- C:\Windows\System\HhPHDaH.exe
  C:\Windows\System\HhPHDaH.exe
  2⤵
  PID:13276
- C:\Windows\System\kxvYMok.exe
  C:\Windows\System\kxvYMok.exe
  2⤵
  PID:15000
- C:\Windows\System\gWVqnZu.exe
  C:\Windows\System\gWVqnZu.exe
  2⤵
  PID:12740
- C:\Windows\System\bSoIREB.exe
  C:\Windows\System\bSoIREB.exe
  2⤵
  PID:12480
- C:\Windows\System\cMwDIiS.exe
  C:\Windows\System\cMwDIiS.exe
  2⤵
  PID:11364
- C:\Windows\System\FlPjSmd.exe
  C:\Windows\System\FlPjSmd.exe
  2⤵
  PID:1936
- C:\Windows\System\UXwmVwo.exe
  C:\Windows\System\UXwmVwo.exe
  2⤵
  PID:12872
- C:\Windows\System\gjZSpdK.exe
  C:\Windows\System\gjZSpdK.exe
  2⤵
  PID:11892
- C:\Windows\System\PGElLyE.exe
  C:\Windows\System\PGElLyE.exe
  2⤵
  PID:15368
- C:\Windows\System\jmiommk.exe
  C:\Windows\System\jmiommk.exe
  2⤵
  PID:15396
- C:\Windows\System\miYrHBZ.exe
  C:\Windows\System\miYrHBZ.exe
  2⤵
  PID:15416
- C:\Windows\System\rcnpwCS.exe
  C:\Windows\System\rcnpwCS.exe
  2⤵
  PID:15452
- C:\Windows\System\JjnhUdw.exe
  C:\Windows\System\JjnhUdw.exe
  2⤵
  PID:15480
- C:\Windows\System\oAGWeiv.exe
  C:\Windows\System\oAGWeiv.exe
  2⤵
  PID:15508
- C:\Windows\System\nLkkBhw.exe
  C:\Windows\System\nLkkBhw.exe
  2⤵
  PID:15536
- C:\Windows\System\JBnCtjc.exe
  C:\Windows\System\JBnCtjc.exe
  2⤵
  PID:15564
- C:\Windows\System\skDMMzh.exe
  C:\Windows\System\skDMMzh.exe
  2⤵
  PID:15596
- C:\Windows\System\JsjffoL.exe
  C:\Windows\System\JsjffoL.exe
  2⤵
  PID:15624
- C:\Windows\System\czFFgJt.exe
  C:\Windows\System\czFFgJt.exe
  2⤵
  PID:15652
- C:\Windows\System\xMXgdob.exe
  C:\Windows\System\xMXgdob.exe
  2⤵
  PID:15680
- C:\Windows\System\ypJkmrn.exe
  C:\Windows\System\ypJkmrn.exe
  2⤵
  PID:15708
- C:\Windows\System\jIDkSuE.exe
  C:\Windows\System\jIDkSuE.exe
  2⤵
  PID:15736
- C:\Windows\System\VBxIMkI.exe
  C:\Windows\System\VBxIMkI.exe
  2⤵
  PID:15764
- C:\Windows\System\ZPfzTBr.exe
  C:\Windows\System\ZPfzTBr.exe
  2⤵
  PID:15796
- C:\Windows\System\FPlCHIV.exe
  C:\Windows\System\FPlCHIV.exe
  2⤵
  PID:15820
- C:\Windows\System\stjOcFY.exe
  C:\Windows\System\stjOcFY.exe
  2⤵
  PID:15848
- C:\Windows\System\ALulkQv.exe
  C:\Windows\System\ALulkQv.exe
  2⤵
  PID:15876
- C:\Windows\System\zHCtciA.exe
  C:\Windows\System\zHCtciA.exe
  2⤵
  PID:15892
- C:\Windows\System\pjFbkuN.exe
  C:\Windows\System\pjFbkuN.exe
  2⤵
  PID:15932
- C:\Windows\System\mjPencQ.exe
  C:\Windows\System\mjPencQ.exe
  2⤵
  PID:15960
- C:\Windows\System\NxrNJKk.exe
  C:\Windows\System\NxrNJKk.exe
  2⤵
  PID:15984
- C:\Windows\System\MymNAfL.exe
  C:\Windows\System\MymNAfL.exe
  2⤵
  PID:16008
- C:\Windows\System\enPsgcH.exe
  C:\Windows\System\enPsgcH.exe
  2⤵
  PID:16044
- C:\Windows\System\NnBWNSo.exe
  C:\Windows\System\NnBWNSo.exe
  2⤵
  PID:16072
- C:\Windows\System\djZTMhN.exe
  C:\Windows\System\djZTMhN.exe
  2⤵
  PID:16088
- C:\Windows\System\gEDGVqU.exe
  C:\Windows\System\gEDGVqU.exe
  2⤵
  PID:16128
- C:\Windows\System\kfZTfhI.exe
  C:\Windows\System\kfZTfhI.exe
  2⤵
  PID:16156
- C:\Windows\System\eFQtcif.exe
  C:\Windows\System\eFQtcif.exe
  2⤵
  PID:16184
- C:\Windows\System\kQZDcNB.exe
  C:\Windows\System\kQZDcNB.exe
  2⤵
  PID:16216
- C:\Windows\System\tAbeQXS.exe
  C:\Windows\System\tAbeQXS.exe
  2⤵
  PID:16256
- C:\Windows\System\cbnkFQA.exe
  C:\Windows\System\cbnkFQA.exe
  2⤵
  PID:16272
- C:\Windows\System\NjwFVOZ.exe
  C:\Windows\System\NjwFVOZ.exe
  2⤵
  PID:16300
- C:\Windows\System\uPqFwLA.exe
  C:\Windows\System\uPqFwLA.exe
  2⤵
  PID:16328
- C:\Windows\System\spbCAME.exe
  C:\Windows\System\spbCAME.exe
  2⤵
  PID:16368
- C:\Windows\System\HviNhQN.exe
  C:\Windows\System\HviNhQN.exe
  2⤵
  PID:9444
- C:\Windows\System\MsXUvHD.exe
  C:\Windows\System\MsXUvHD.exe
  2⤵
  PID:15404
- C:\Windows\System\SDTNaGE.exe
  C:\Windows\System\SDTNaGE.exe
  2⤵
  PID:11580
- C:\Windows\System\PixDWYj.exe
  C:\Windows\System\PixDWYj.exe
  2⤵
  PID:15500
- C:\Windows\System\EIAgclY.exe
  C:\Windows\System\EIAgclY.exe
  2⤵
  PID:1452
- C:\Windows\System\oYftcSF.exe
  C:\Windows\System\oYftcSF.exe
  2⤵
  PID:11752
- C:\Windows\System\wxDmKzS.exe
  C:\Windows\System\wxDmKzS.exe
  2⤵
  PID:11872
- C:\Windows\System\rfgLJpq.exe
  C:\Windows\System\rfgLJpq.exe
  2⤵
  PID:11784
- C:\Windows\System\CnGWIjN.exe
  C:\Windows\System\CnGWIjN.exe
  2⤵
  PID:15700
- C:\Windows\System\MNpsPyN.exe
  C:\Windows\System\MNpsPyN.exe
  2⤵
  PID:15732
- C:\Windows\System\RbvnqET.exe
  C:\Windows\System\RbvnqET.exe
  2⤵
  PID:15784
- C:\Windows\System\PThxVUw.exe
  C:\Windows\System\PThxVUw.exe
  2⤵
  PID:15816
- C:\Windows\System\aMTTVhs.exe
  C:\Windows\System\aMTTVhs.exe
  2⤵
  PID:15864
- C:\Windows\System\sWqmcIo.exe
  C:\Windows\System\sWqmcIo.exe
  2⤵
  PID:15884
- C:\Windows\System\mqFgamw.exe
  C:\Windows\System\mqFgamw.exe
  2⤵
  PID:1736
- C:\Windows\System\UXUJoli.exe
  C:\Windows\System\UXUJoli.exe
  2⤵
  PID:16024
- C:\Windows\System\NuKZgel.exe
  C:\Windows\System\NuKZgel.exe
  2⤵
  PID:16068
- C:\Windows\System\wwnWxKE.exe
  C:\Windows\System\wwnWxKE.exe
  2⤵
  PID:16120
- C:\Windows\System\VuocrLz.exe
  C:\Windows\System\VuocrLz.exe
  2⤵
  PID:16176
- C:\Windows\System\dWZzOho.exe
  C:\Windows\System\dWZzOho.exe
  2⤵
  PID:16204
- C:\Windows\System\YiQURoe.exe
  C:\Windows\System\YiQURoe.exe
  2⤵
  PID:16228
- C:\Windows\System\UzOOQNl.exe
  C:\Windows\System\UzOOQNl.exe
  2⤵
  PID:3116
- C:\Windows\System\GtkDnBI.exe
  C:\Windows\System\GtkDnBI.exe
  2⤵
  PID:1264

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3816 --field-trial-handle=2248,i,10247514684337323751,15511974759131734137,262144 --variations-seed-version /prefetch:8
1⤵
PID:12284

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_mjhszvmv.b4v.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\AxwQncM.exe

Filesize
3.1MB

MD5
a0506e08c35bb35e8b37688da304395f

SHA1
ed91280c775158b1e8bf78d315cabe5b438b4971

SHA256
76615b307869185f5439ecb0d1f506a8fbfe983007a3e533fc7c5e5598aec22a

SHA512
4ceb25ccd3a2797f1308f4b5a280dfa43d646c6908f48074f7850f3ed3b3ceec8a5be598312119c01737a924c77d0548fdf6a02157c403a0a389bcd65e3b0535

Download Submit
C:\Windows\System\CFlbAWF.exe

Filesize
3.1MB

MD5
ecf25a1762d3de5e1c0be763e83e2b21

SHA1
10f75ac26070a468ed5047bc8d088bbbb2fab930

SHA256
58f9063d7af309732886b1fcfec288709ae971e60453ec7126abdfcf89290c14

SHA512
500d4d9cb73fbe4d2b773ea87686bf1e342d8362e8e7cfabab6ee16af1bf9f7539dc45141a88e78efaa623324e7ec7377f1844eca7075225d7560c133ce7cdc8

Download Submit
C:\Windows\System\FEIiPMy.exe

Filesize
3.1MB

MD5
f4ae1848e02e106aaa9aaac175cb6dce

SHA1
61849772b0aabd34caae217bf66d22137810434f

SHA256
f9e40c3b2485721c25e7d9bce7d282521f08a7d1240634816517cffa9ddfa9ef

SHA512
b39606257325d61c8e3cc22fd80645cbf4ce2f8d9b6dd4f2f00ee1972e3a98b2d9f87a6f3e2696d3d4f5181a6b48fc8b8320eea7821ab74da54409d77215273a

Download Submit
C:\Windows\System\IaBstFx.exe

Filesize
3.1MB

MD5
4774181df3f9962b4f56dd7ad7f632ea

SHA1
aa1e9dd458a748be0eee90808d58eb6efc50586f

SHA256
a9ce2346923f814cb63c3e2dcfc9aafea9045b214504d232c066b509cde59b91

SHA512
d8a25ca8d2fbaf5b3056cf5f4b13abebf23fcaf44e605d81f2122fd05d0e53037f5f0be9e5922afee1e3f703e50074203545a0f2bc5c21c4a23e1f55b0e70dd1

Download Submit
C:\Windows\System\PUnMEdk.exe

Filesize
3.1MB

MD5
200f3f2067731180381cd44061a1342c

SHA1
f25b483abb89ceb1def257d15ade8fb3960e64da

SHA256
261d5925025f1ac7993965001fc15135722568fe25f3f4a54546496003ec9ccc

SHA512
30594174ecab0e446086eccb3107edbe98b9a5024ad43c4dd9c32abf935e94d77b062dd54243de307c55cbba4a5ad3a0f961d50d19e5e8f82a7aafd99f481ec8

Download Submit
C:\Windows\System\QZKZThu.exe

Filesize
3.1MB

MD5
05b32f6aa6bc9eb58d4e9f003dc1279e

SHA1
4f30c2c52f27cacfd0c5c72c499ae6f021fdf99b

SHA256
c0588bb4d324c96de4ba905668bc2933e53657cc8a43d50b252b0e445ac4a9fb

SHA512
ac42795ffcedfdb9b77c3853f30da788652701ab0b960ba33e5152066719f51f23bc3095e62cb678fdd4312f9ea4f014d36bc7dffec9327edf65bf33d02d05d1

Download Submit
C:\Windows\System\QewTAWg.exe

Filesize
3.1MB

MD5
6fd7f96529878ecc053982832884125f

SHA1
c0d0cd994ae94b90886318e6d8f3df58334b4612

SHA256
8d5acac2d693bbefb86d848bea252c1adc53d2e930d195c433628401cb6bcddd

SHA512
d96e8f04ed17e4d6b42a6474eb60e853e461ae6b792da2f2a67ff967c67b8a84cb63031b60a01dc819054fd866e742c863d73e1627595c8508eceb1bba61ddeb

Download Submit
C:\Windows\System\RzpgWVl.exe

Filesize
3.1MB

MD5
516375d6235faaed9715737b13f62390

SHA1
c5859e28950804c2186b48bcb54f14e7d3b7a2ae

SHA256
0e27d77df6f9ad698c495d4d8bea3bbf7d4099353b313438346a24ddc5613f76

SHA512
357e7cd7f12759c3841cdd66d70af98639d0072e1bd4184fad35824777bb9da14d853a39c13b1600ad6850dce618e7fd4954f89fbb80827689fc44868ae0826e

Download Submit
C:\Windows\System\SFuqhnf.exe

Filesize
3.1MB

MD5
62a0f30e280cd375ca5ed8684e25e9a0

SHA1
e7d047be0b6fcd68df788e6872d4a659e64af348

SHA256
a7d9200a9ba7c8cd16073bb68807641b549d499d6bf8135e58b9d5c7c7fed4e5

SHA512
ece1482eeae5f97c18d20bf7f7b79de854cc7db73e52389c10ac4540b5e2943a3b5bce017633f089ec1c33460a6bc61e6f5172844dcfb7b95089c6e23e7174c5

Download Submit
C:\Windows\System\TYMEley.exe

Filesize
3.1MB

MD5
47f15fb3b5c00393738548651ae817c0

SHA1
39e86973e3e4380960bd023d4c588ae1bef6bae2

SHA256
0e71a13ce05f223a7b7884466786b9aed80877f02c1f2069b4d86cf22b5c3b81

SHA512
6de6988054375fb46243057a9e1ef7f26581ffa130acddd360965be28595cdf0a792c3019fbdcf96c6d485a0a48b8cb7cdeecc08d5318a02e3743a2b4365f9d1

Download Submit
C:\Windows\System\UENtwTv.exe

Filesize
3.1MB

MD5
79e9aad173619e2927d932e095833bd8

SHA1
950699d8e4181f6b3edfa44829ab17c1542f838f

SHA256
da2e53b67c54da751b4b0b4616c470e1de3ab291d8877c275daef3b98271f3a8

SHA512
5362a54e07cdb369eb61c9224c2bafbaa1ec0d8852fefbe2a13555484c04c4119da52a15aba7ccc892300a9cf01090b43879abb8820cf03bd087641adf39a53a

Download Submit
C:\Windows\System\VhTYQCH.exe

Filesize
3.1MB

MD5
456b900fdbe13d69efb7e53f427ae181

SHA1
6f1cf076da8730403726cd9644e3597486c1d074

SHA256
f6defe522911345a9528d992510d807a273c0334a3023b7f065333c55e1022e5

SHA512
d04357a139b1dc6cd789ae9880455d5e685adf43c2a6aaa3f899df5c89ff6db485138a4ac8265be1b07edd08bf18164654bde4d529da1a6db7b03c928080e70a

Download Submit
C:\Windows\System\WNoCNzA.exe

Filesize
3.1MB

MD5
e7e19c9afdb0fc31fe74c28d01126a13

SHA1
7b5c90cfee819b0b22d73b0618dd5dee7d21a81a

SHA256
c3fbac20971c54b27dd2ca1cc3989c93e45e4400560572de07689220f4e91c03

SHA512
f166386e79a662630b2b9828724154f00c253cb84f3a755d22f18835bdd7267420153e7baed614920a1cb2450abcb38912e04f8ad96ffd0995e126015a672553

Download Submit
C:\Windows\System\XUsMwUP.exe

Filesize
3.1MB

MD5
e4b54c0817b3976a34714faa6e545244

SHA1
33a016edcb15a3ca2bddde7e055837ad57846b71

SHA256
5ca1e20d9e2a7b689fbc248460b056a351bb1b44ad5556f468599b939e9bd3cb

SHA512
baa494d69e517be31949185b17b5756da1bdb1b9a59c4cab30cb7beb5f41b501113ba18f32bd924c61c34a043cc813036b0ab8d100fc5b6dbc95dbaa9490ea6b

Download Submit
C:\Windows\System\YJvnAgo.exe

Filesize
3.1MB

MD5
30bbaecff942a12d6ebacbec203a870e

SHA1
9c466440ea0c6ebe283b518506814043441524a7

SHA256
42187be20c531f94e014a666bfb09e47ae06fca793ebbfb8c5ff81ee255efee7

SHA512
670c76e10f5e85c8e3d445e79d88575dad064f34f8453bc2f83e897e2b881be877c6e814997ff50bb2abc3ca87c2386a1579c5f7191263bba60f759890e113b3

Download Submit
C:\Windows\System\YbMnqdQ.exe

Filesize
3.1MB

MD5
3722a0d5b492341151c09dcab0a4656a

SHA1
33651f03b4e3fcbf7836a60566e2999c18598381

SHA256
a560c41c94aae4de8e424e0d1a94eca93d53f45ff4a4e76985c778fcc0943ebb

SHA512
8d072ef9ae06530d612449fabca4fab59a2dc30671b7ac8a5bb24b6c06b69fc8c77e49cec7aab0ba7617cb4b542bfa170166db29c7d0fc94be77dbb31f7b387d

Download Submit
C:\Windows\System\gecySwh.exe

Filesize
3.1MB

MD5
94509371d1441b1bae1dcfd56012fff0

SHA1
b75bbf6edbcf14e1e9f21d1388b06e3705bc739d

SHA256
44122d00cb289a6612e1007c7bbee30e783aaad98b60bac1f04e4db80ef83661

SHA512
3884b812d147640eb3957059f76998850679b72b30f1e692588efd5355bfae7bc4d3257e4d236408d5330931212a03719d9d08681bf8200fd8bf1ce2a235ab78

Download Submit
C:\Windows\System\hDegcGR.exe

Filesize
3.1MB

MD5
821044b626c24074b03970a190ff8346

SHA1
11e5b0944e0cdd7853ef201c97c26b7c56942d2d

SHA256
0e241ea23cf29d113ea4f298d9476dd66540bea124fa4a72bec2ab67734f8fac

SHA512
df50c481f9cbf47daf015ac7a21bc83cfceb666c8688c658d6b8c085d58f63d1347ec1c98bfdadd809af8336c0534d16c8e41274c8a971363f0638a6e162ce35

Download Submit
C:\Windows\System\hjZBwdK.exe

Filesize
3.1MB

MD5
4427c9f72a2191f01828dd783f4c9433

SHA1
5b96a8222c2a59f2c957a75b1b4058cfc0a6949f

SHA256
d468661b0c501534b360b84ba940cf2335e1f72db928974520bb1009cca868e2

SHA512
58b20a9bf533c682e6fe4e44b68709fe3f1af975c8316f4c828a877371eeeb8da9ff4b05f95d3c9922a7c80f6d0df86852e2075a9146869b5d1f5df48dcdd210

Download Submit
C:\Windows\System\kHygmEq.exe

Filesize
3.1MB

MD5
406f71e21e1b043953e894ee4a7c6842

SHA1
cbb08540c12ef0dc1476e1e7b8955aceb5c4f4f4

SHA256
c17c3ba549899c515e99796496e42ffd5c2164aad28d181b5050cc282e3137c6

SHA512
429cb5adb22a4afe845b30d9ce4ab77b9a7c3fb71d71078941b79655b095183e421838049b9fb89e1ed68be2133302c63159515cb3a13a55c4353f6368e0b677

Download Submit
C:\Windows\System\kKKPhDk.exe

Filesize
3.1MB

MD5
64f040738bd7c191af485fed3cb7aa01

SHA1
dfc88015ab9ee35715b098d5a87a1726778b5d18

SHA256
0a56edbae0d63cdfcb77c7d83efc304a59ec9bed87b2d841f393de6cd1d5c272

SHA512
a321ffa3e4c5c140bf1f9dc82f2c98b9c6f46e49fd7b8f8ac0d6c3e3f046b3ab04c3bebeb81022aeb50ddf4d0fd4e8c05eae5dadfd36a39fb4206dafbdcb4fb2

Download Submit
C:\Windows\System\nwrTezW.exe

Filesize
3.1MB

MD5
01fdee58836c78fcd44f52d81a086c59

SHA1
778332de56ccb9f5f2f5b4a1567933444b5866f6

SHA256
fd17de3fb49f723ccb5097eaeedadfca65441cea89c983dd6c76fa67bc0ddd38

SHA512
d1dfc87c0d8453d4130f23bede6da0a5e80cb42b8328960122bc1bffbb1dd32d3e88a0b74ef19833ff4449f9faaae74d343cfb6a2458a2a5291de6995f53060f

Download Submit
C:\Windows\System\oEFXDJG.exe

Filesize
3.1MB

MD5
13cd8085ac365d7e733eb451962f16d0

SHA1
479d8967c703d0d3a3e5e3e4d8a7de62258c78fe

SHA256
b64ea252d2886c831cb0aaf9f057ca7f87b2fa579a928a4cd8e00b5bf30b9f54

SHA512
1bb83021d416cd3c9325550cae88813e5d21e3d67034dd00c770fc3477254fe96f7fff68b4e1604270449a11cd8809c7df8df92f8643a4a66def3b4cec152eb0

Download Submit
C:\Windows\System\pobqwTS.exe

Filesize
3.1MB

MD5
d19bda31e07aac776e3d04fb90d03340

SHA1
ef955f48d82f19a7808450cc2e83df18f08bdbe8

SHA256
8ed4fb03381f9d61e6d3b816c1e6993c3b7f189701cb4a48a3a20b8bc2282865

SHA512
d728d158557def7bc8fa0af5622d35a434198669f638b42009016359d8cc66b373365b743efa5f399f883d628be2771f9da36f08d335020f6dda9bdde0004f9d

Download Submit
C:\Windows\System\qDTKpmk.exe

Filesize
3.1MB

MD5
ce4228109c633487dbc50cab5cf090b9

SHA1
1a43058ed511a08ebcf307d7d4197f99d3074df5

SHA256
b2af831cc35a0e407ed21ac2f054be0f65b0f7c32bdea984827d416a669ec4dd

SHA512
6cac7fa913b634865ee5888299640c8f5e924b74266d4ba8980046a509ff9f388369434581bd06b0fa59df8d7e1140decfa19fad03eb108b1a21099be546b959

Download Submit
C:\Windows\System\qIcoTDn.exe

Filesize
3.1MB

MD5
9df2d3896916a4a1bb850146eeb65809

SHA1
442c21b0809b144cb9d7fc0c6ea830e7b64a2abe

SHA256
988ed15620b10896ca1295b373cfa25a95dec8d1ae5c97704d140e163eeb8c6a

SHA512
9c417e3059ae7a914440cd9c7a3a345836156307a984ae6175342fee3eaa736162bd364e3abe42b7a2ffa2173a29afe0d582c04bed7e7db2421db9ee4b49a31b

Download Submit
C:\Windows\System\qPTufqS.exe

Filesize
3.1MB

MD5
4d84909cd39c622bf76e693247cf7e66

SHA1
d29be3ecaae75609ce5df3e8bf58c0e69d278a0d

SHA256
b3cfbde758b5d389b4a1458de831991d2171f0e470356f95a65ba36daaad71d9

SHA512
3bd782598e7b1bb7e879bc28d3d5ac9fb29d6faee46216c14a092115acf0c8870c45da96e6fdf121adef8552503abd61699014dbdc9afdd671f91b6c5bb17a93

Download Submit
C:\Windows\System\qZcixdH.exe

Filesize
3.1MB

MD5
e9ac164d335b7318bf8cacdff0bf9b6c

SHA1
8827a0482d1dc2e797d33253e7000c8e06fc6151

SHA256
cbb84f91d015964e70bfcc56cd13eebd0bf89fa21c3e962bdff75d01263e9860

SHA512
228e58ee01941c9459bae41158eba5df2e973839ded0321a3aaf433b5c1f2ede0e79c798698a3600a4a4bbefef59cbc04464bd6f8fe65b9b6b503266d3a8bf39

Download Submit
C:\Windows\System\vQKvUeS.exe

Filesize
3.1MB

MD5
b7d3eda1dec25d37b7afb855fa1fd9f4

SHA1
bf649c7ca46ebc7d4b084c608120bfc9c972039c

SHA256
82cc9f9ceb4bab3c8cd08962bb89d661ec93e58b8ee08fb9983c0ce7a8cda695

SHA512
39913307643c8d2a86b10b0c7dadb6cc3baff128c5dc665518d112a2345280eb7230e2ee0f81bf49084f17c354a1542b9549e2771c8cc06a38edc61b8cfab031

Download Submit
C:\Windows\System\vVzHkwo.exe

Filesize
3.1MB

MD5
fd1cd04e8025738790baf8a3c64bb413

SHA1
88da99fd51e4f67b1f4ea05257eb8e7e70b3af8d

SHA256
3cb19b87f7f6ce5af9632ea08464a8825b110e8f079ca5de78df4002e4a1b807

SHA512
a94373d7368653e7904f2be3b3a4390304e20e842f32a6f881490818d0b228309a74c24a2b3daa2eacc4e57308d2fe7f1f14d843e451eee21534faf5be25d4ff

Download Submit
C:\Windows\System\xnCEKdg.exe

Filesize
3.1MB

MD5
f5869a31d37213a869c72d2fe6e19453

SHA1
49915c4fce3a836fa2b340aecae92f883fc9d10c

SHA256
fba24c023e4fa2b1a0f18d12c8c7afea026a1fd0dfcb27f09eb763c2a1fa24d8

SHA512
a36f2ece7b2a7f11def027255eb5962fd5f374c8bf3c1b76f3c8796c5032289725d7ceb72ec049d4e1e406342d9c074938424480f2a71ac2ff7a8e5f5715ab29

Download Submit
C:\Windows\System\zYyATSR.exe

Filesize
3.1MB

MD5
de9265de8106d278af38522b9f11bb39

SHA1
5e9ed7958b4b41e08f8624f5f9290fcdf64e44fd

SHA256
441e0a4f4445a4c2dc7dcca30162c3b19b2efea58d24151ed173e8141365d0cf

SHA512
d45702ed83574caa1015683593f1c03dbea8522fd00a479ee02a0bff1f6d9c8026bc9d43491c66ed26d8f6e32ae84cd686bb40a2d8d6ffb4111b754e5f2510bb

Download Submit
memory/380-78-0x00007FF687420000-0x00007FF687816000-memory.dmp

Filesize
4.0MB

Download
memory/380-1757-0x00007FF687420000-0x00007FF687816000-memory.dmp

Filesize
4.0MB

Download
memory/628-0-0x00007FF71F210000-0x00007FF71F606000-memory.dmp

Filesize
4.0MB

Download
memory/628-376-0x00007FF71F210000-0x00007FF71F606000-memory.dmp

Filesize
4.0MB

Download
memory/628-1-0x000001798FFF0000-0x0000017990000000-memory.dmp

Filesize
64KB

Download
memory/700-1786-0x00007FF6F37D0000-0x00007FF6F3BC6000-memory.dmp

Filesize
4.0MB

Download
memory/700-147-0x00007FF6F37D0000-0x00007FF6F3BC6000-memory.dmp

Filesize
4.0MB

Download
memory/1072-1773-0x00007FF6584E0000-0x00007FF6588D6000-memory.dmp

Filesize
4.0MB

Download
memory/1072-74-0x00007FF6584E0000-0x00007FF6588D6000-memory.dmp

Filesize
4.0MB

Download
memory/1072-1690-0x00007FF6584E0000-0x00007FF6588D6000-memory.dmp

Filesize
4.0MB

Download
memory/1212-56-0x00007FF67FA50000-0x00007FF67FE46000-memory.dmp

Filesize
4.0MB

Download
memory/1212-1755-0x00007FF67FA50000-0x00007FF67FE46000-memory.dmp

Filesize
4.0MB

Download
memory/1560-160-0x00007FF740000000-0x00007FF7403F6000-memory.dmp

Filesize
4.0MB

Download
memory/1560-1819-0x00007FF740000000-0x00007FF7403F6000-memory.dmp

Filesize
4.0MB

Download
memory/1620-37-0x00007FF77C3F0000-0x00007FF77C7E6000-memory.dmp

Filesize
4.0MB

Download
memory/1620-1548-0x00007FF77C3F0000-0x00007FF77C7E6000-memory.dmp

Filesize
4.0MB

Download
memory/2032-34-0x00007FF6A79B0000-0x00007FF6A7DA6000-memory.dmp

Filesize
4.0MB

Download
memory/2032-1562-0x00007FF6A79B0000-0x00007FF6A7DA6000-memory.dmp

Filesize
4.0MB

Download
memory/2108-42-0x00007FF7FEC60000-0x00007FF7FF056000-memory.dmp

Filesize
4.0MB

Download
memory/2108-1753-0x00007FF7FEC60000-0x00007FF7FF056000-memory.dmp

Filesize
4.0MB

Download
memory/2204-35-0x00007FF64BEC0000-0x00007FF64C2B6000-memory.dmp

Filesize
4.0MB

Download
memory/2204-1587-0x00007FF64BEC0000-0x00007FF64C2B6000-memory.dmp

Filesize
4.0MB

Download
memory/2268-61-0x00007FF7801E0000-0x00007FF7805D6000-memory.dmp

Filesize
4.0MB

Download
memory/2268-1754-0x00007FF7801E0000-0x00007FF7805D6000-memory.dmp

Filesize
4.0MB

Download
memory/2528-159-0x00007FF664900000-0x00007FF664CF6000-memory.dmp

Filesize
4.0MB

Download
memory/2528-1809-0x00007FF664900000-0x00007FF664CF6000-memory.dmp

Filesize
4.0MB

Download
memory/2596-1826-0x00007FF718A30000-0x00007FF718E26000-memory.dmp

Filesize
4.0MB

Download
memory/2596-164-0x00007FF718A30000-0x00007FF718E26000-memory.dmp

Filesize
4.0MB

Download
memory/2672-87-0x00007FF64ED00000-0x00007FF64F0F6000-memory.dmp

Filesize
4.0MB

Download
memory/2868-162-0x00007FF7F7500000-0x00007FF7F78F6000-memory.dmp

Filesize
4.0MB

Download
memory/2868-1833-0x00007FF7F7500000-0x00007FF7F78F6000-memory.dmp

Filesize
4.0MB

Download
memory/2972-36-0x00007FF7494B0000-0x00007FF7498A6000-memory.dmp

Filesize
4.0MB

Download
memory/2972-1756-0x00007FF7494B0000-0x00007FF7498A6000-memory.dmp

Filesize
4.0MB

Download
memory/2972-651-0x00007FF7494B0000-0x00007FF7498A6000-memory.dmp

Filesize
4.0MB

Download
memory/3024-128-0x00007FF72DA60000-0x00007FF72DE56000-memory.dmp

Filesize
4.0MB

Download
memory/3024-1785-0x00007FF72DA60000-0x00007FF72DE56000-memory.dmp

Filesize
4.0MB

Download
memory/3304-1818-0x00007FF7D8140000-0x00007FF7D8536000-memory.dmp

Filesize
4.0MB

Download
memory/3304-163-0x00007FF7D8140000-0x00007FF7D8536000-memory.dmp

Filesize
4.0MB

Download
memory/3328-1829-0x00007FF7FD920000-0x00007FF7FDD16000-memory.dmp

Filesize
4.0MB

Download
memory/3328-161-0x00007FF7FD920000-0x00007FF7FDD16000-memory.dmp

Filesize
4.0MB

Download
memory/3540-110-0x00007FF7F12E0000-0x00007FF7F16D6000-memory.dmp

Filesize
4.0MB

Download
memory/3540-1795-0x00007FF7F12E0000-0x00007FF7F16D6000-memory.dmp

Filesize
4.0MB

Download
memory/3804-1793-0x00007FF7A1D90000-0x00007FF7A2186000-memory.dmp

Filesize
4.0MB

Download
memory/3804-149-0x00007FF7A1D90000-0x00007FF7A2186000-memory.dmp

Filesize
4.0MB

Download
memory/4176-115-0x00007FF65BD90000-0x00007FF65C186000-memory.dmp

Filesize
4.0MB

Download
memory/4176-1695-0x00007FF65BD90000-0x00007FF65C186000-memory.dmp

Filesize
4.0MB

Download
memory/4176-1797-0x00007FF65BD90000-0x00007FF65C186000-memory.dmp

Filesize
4.0MB

Download
memory/4464-158-0x00007FF7A0170000-0x00007FF7A0566000-memory.dmp

Filesize
4.0MB

Download
memory/4464-1816-0x00007FF7A0170000-0x00007FF7A0566000-memory.dmp

Filesize
4.0MB

Download
memory/4476-97-0x00007FF706070000-0x00007FF706466000-memory.dmp

Filesize
4.0MB

Download
memory/4476-1779-0x00007FF706070000-0x00007FF706466000-memory.dmp

Filesize
4.0MB

Download
memory/4480-5-0x00007FF9D5CB3000-0x00007FF9D5CB5000-memory.dmp

Filesize
8KB

Download
memory/4480-165-0x000001C7A0380000-0x000001C7A0B26000-memory.dmp

Filesize
7.6MB

Download
memory/4480-33-0x00007FF9D5CB0000-0x00007FF9D6771000-memory.dmp

Filesize
10.8MB

Download
memory/4480-32-0x00007FF9D5CB0000-0x00007FF9D6771000-memory.dmp

Filesize
10.8MB

Download
memory/4480-25-0x000001C79D4B0000-0x000001C79D4D2000-memory.dmp

Filesize
136KB

Download
memory/4480-394-0x00007FF9D5CB0000-0x00007FF9D6771000-memory.dmp

Filesize
10.8MB

Download
memory/4604-1788-0x00007FF79A340000-0x00007FF79A736000-memory.dmp

Filesize
4.0MB

Download
memory/4604-1768-0x00007FF79A340000-0x00007FF79A736000-memory.dmp

Filesize
4.0MB

Download
memory/4604-108-0x00007FF79A340000-0x00007FF79A736000-memory.dmp

Filesize
4.0MB

Download