xmrig | 5e246ab7a6a28dc90a0ebd0da598c21407e61d3f6bc437d85faed76c1edf6369

Analysis

max time kernel
150s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
20/06/2024, 11:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5e246ab7a6a28dc90a0ebd0da598c21407e61d3f6bc437d85faed76c1edf6369_NeikiAnalytics.exe
Size

1.4MB
MD5

ce9b07b3fc85208e5f4a1615f8520010
SHA1

fb1b59cb4e7b2119bd88deb1dc0b8726bba2ba89
SHA256

5e246ab7a6a28dc90a0ebd0da598c21407e61d3f6bc437d85faed76c1edf6369
SHA512

5824753ce5adae8438691f61b773b6762c89d940c8eeb140891caabb1fd43a88355fd409f58ba169f7032959ab1596a2b1bf25b6cc5a5b01a3b8528947a68a7a
SSDEEP

24576:zv3/fTLF671TilQFG4P5PMkibTJH+2Q/ynKeWYsfLGrAvWWXkCRgx6nU8UywjbwA:Lz071uv4BPMkibTIA5sf6r+W4AQaAhXe

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 28 IoCs

miner

resource	yara_rule
behavioral2/memory/1432-693-0x00007FF62A180000-0x00007FF62A572000-memory.dmp	xmrig
behavioral2/memory/1776-802-0x00007FF631ED0000-0x00007FF6322C2000-memory.dmp	xmrig
behavioral2/memory/2932-807-0x00007FF62C5A0000-0x00007FF62C992000-memory.dmp	xmrig
behavioral2/memory/3948-1128-0x00007FF7AA000000-0x00007FF7AA3F2000-memory.dmp	xmrig
behavioral2/memory/3352-1384-0x00007FF692580000-0x00007FF692972000-memory.dmp	xmrig
behavioral2/memory/2356-1542-0x00007FF629BC0000-0x00007FF629FB2000-memory.dmp	xmrig
behavioral2/memory/4928-1649-0x00007FF7CDC70000-0x00007FF7CE062000-memory.dmp	xmrig
behavioral2/memory/4416-1541-0x00007FF76AB20000-0x00007FF76AF12000-memory.dmp	xmrig
behavioral2/memory/1360-1540-0x00007FF7FCED0000-0x00007FF7FD2C2000-memory.dmp	xmrig
behavioral2/memory/1708-1383-0x00007FF7E8460000-0x00007FF7E8852000-memory.dmp	xmrig
behavioral2/memory/1628-1127-0x00007FF71C490000-0x00007FF71C882000-memory.dmp	xmrig
behavioral2/memory/3972-688-0x00007FF677000000-0x00007FF6773F2000-memory.dmp	xmrig
behavioral2/memory/1780-477-0x00007FF6B4E90000-0x00007FF6B5282000-memory.dmp	xmrig
behavioral2/memory/4060-461-0x00007FF7FD3D0000-0x00007FF7FD7C2000-memory.dmp	xmrig
behavioral2/memory/1980-445-0x00007FF7271C0000-0x00007FF7275B2000-memory.dmp	xmrig
behavioral2/memory/1080-321-0x00007FF7E3AB0000-0x00007FF7E3EA2000-memory.dmp	xmrig
behavioral2/memory/2744-56-0x00007FF614820000-0x00007FF614C12000-memory.dmp	xmrig
behavioral2/memory/2744-6050-0x00007FF614820000-0x00007FF614C12000-memory.dmp	xmrig
behavioral2/memory/2932-7280-0x00007FF62C5A0000-0x00007FF62C992000-memory.dmp	xmrig
behavioral2/memory/1776-7365-0x00007FF631ED0000-0x00007FF6322C2000-memory.dmp	xmrig
behavioral2/memory/3948-7322-0x00007FF7AA000000-0x00007FF7AA3F2000-memory.dmp	xmrig
behavioral2/memory/4928-7308-0x00007FF7CDC70000-0x00007FF7CE062000-memory.dmp	xmrig
behavioral2/memory/1432-7303-0x00007FF62A180000-0x00007FF62A572000-memory.dmp	xmrig
behavioral2/memory/1708-7306-0x00007FF7E8460000-0x00007FF7E8852000-memory.dmp	xmrig
behavioral2/memory/1360-7286-0x00007FF7FCED0000-0x00007FF7FD2C2000-memory.dmp	xmrig
behavioral2/memory/1780-7289-0x00007FF6B4E90000-0x00007FF6B5282000-memory.dmp	xmrig
behavioral2/memory/3972-7282-0x00007FF677000000-0x00007FF6773F2000-memory.dmp	xmrig
behavioral2/memory/4680-7083-0x00007FF717500000-0x00007FF7178F2000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
2952	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
4680	bYelxnc.exe
2744	IpIVhkm.exe
1080	iVnLdYP.exe
1980	punftdj.exe
4444	gTNXXXC.exe
3372	HZWAbIR.exe
4060	edlrxxt.exe
1780	evWGUsC.exe
3972	HxqYHoO.exe
1432	WdeVPMU.exe
1320	HaGWtHT.exe
1776	OTzgLwI.exe
2932	PdOcllc.exe
1628	DcYyjKW.exe
3948	ENoWATE.exe
1708	QnyVTAf.exe
3352	RYJilfJ.exe
1360	omEnEkD.exe
4416	AeupnRR.exe
2356	wmPoWgh.exe
4928	nIoXhEo.exe
3904	GrUPEpH.exe
772	hjSUtou.exe
2536	hCKwFaC.exe
4748	mnprLAP.exe
2000	HzqnttS.exe
1408	QkoGbBZ.exe
692	GpPVVst.exe
3768	KNBdbIP.exe
868	UbGZzGH.exe
1692	vxLVmpF.exe
1280	DouVDTu.exe
3104	bywLrZc.exe
4064	BUFtvuw.exe
3744	NVkILIe.exe
4048	ERXtaZU.exe
1468	VyCjTYw.exe
3564	mRVufNi.exe
3516	AvTzRts.exe
4736	AkZVGTs.exe
5028	vNNBGsA.exe
1492	RKCIvRW.exe
2840	itOISht.exe
3316	vUvVLWy.exe
4176	tdArneE.exe
3324	QrswMZV.exe
4908	bOistIh.exe
1388	oIUoBax.exe
3160	idCDInR.exe
2928	SbCLtTO.exe
3360	WaCkEGh.exe
1416	tmYhZCj.exe
400	tHpXATx.exe
1364	jFiZeiD.exe
208	CHqlsyA.exe
1216	DzNZRoV.exe
3684	UVBbDOw.exe
992	HgyWruI.exe
4224	hvxCyaB.exe
3212	KgfvbmL.exe
2664	wCQodEU.exe
2800	jsuClZJ.exe
824	aSagxFa.exe
4612	nCExEPa.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4808-0-0x00007FF7845C0000-0x00007FF7849B2000-memory.dmp	upx
behavioral2/files/0x000700000002354f-17.dat	upx
behavioral2/files/0x000700000002354d-22.dat	upx
behavioral2/files/0x0007000000023553-95.dat	upx
behavioral2/files/0x0007000000023568-155.dat	upx
behavioral2/memory/1432-693-0x00007FF62A180000-0x00007FF62A572000-memory.dmp	upx
behavioral2/memory/1776-802-0x00007FF631ED0000-0x00007FF6322C2000-memory.dmp	upx
behavioral2/memory/2932-807-0x00007FF62C5A0000-0x00007FF62C992000-memory.dmp	upx
behavioral2/memory/3948-1128-0x00007FF7AA000000-0x00007FF7AA3F2000-memory.dmp	upx
behavioral2/memory/3352-1384-0x00007FF692580000-0x00007FF692972000-memory.dmp	upx
behavioral2/memory/2356-1542-0x00007FF629BC0000-0x00007FF629FB2000-memory.dmp	upx
behavioral2/memory/4928-1649-0x00007FF7CDC70000-0x00007FF7CE062000-memory.dmp	upx
behavioral2/memory/4416-1541-0x00007FF76AB20000-0x00007FF76AF12000-memory.dmp	upx
behavioral2/memory/1360-1540-0x00007FF7FCED0000-0x00007FF7FD2C2000-memory.dmp	upx
behavioral2/memory/1708-1383-0x00007FF7E8460000-0x00007FF7E8852000-memory.dmp	upx
behavioral2/memory/1628-1127-0x00007FF71C490000-0x00007FF71C882000-memory.dmp	upx
behavioral2/memory/3972-688-0x00007FF677000000-0x00007FF6773F2000-memory.dmp	upx
behavioral2/memory/1780-477-0x00007FF6B4E90000-0x00007FF6B5282000-memory.dmp	upx
behavioral2/memory/4060-461-0x00007FF7FD3D0000-0x00007FF7FD7C2000-memory.dmp	upx
behavioral2/memory/1980-445-0x00007FF7271C0000-0x00007FF7275B2000-memory.dmp	upx
behavioral2/memory/1080-321-0x00007FF7E3AB0000-0x00007FF7E3EA2000-memory.dmp	upx
behavioral2/files/0x0007000000023578-209.dat	upx
behavioral2/files/0x0007000000023564-204.dat	upx
behavioral2/files/0x0007000000023577-197.dat	upx
behavioral2/files/0x0007000000023576-196.dat	upx
behavioral2/files/0x0007000000023574-193.dat	upx
behavioral2/files/0x0007000000023572-192.dat	upx
behavioral2/files/0x000700000002355d-191.dat	upx
behavioral2/files/0x000700000002355c-187.dat	upx
behavioral2/files/0x000700000002355b-180.dat	upx
behavioral2/files/0x0007000000023555-179.dat	upx
behavioral2/files/0x0007000000023571-175.dat	upx
behavioral2/files/0x0007000000023570-171.dat	upx
behavioral2/files/0x000700000002356f-167.dat	upx
behavioral2/files/0x000700000002356e-166.dat	upx
behavioral2/files/0x000700000002356d-165.dat	upx
behavioral2/files/0x0007000000023561-163.dat	upx
behavioral2/files/0x000700000002356c-162.dat	upx
behavioral2/files/0x000700000002356b-161.dat	upx
behavioral2/files/0x000700000002355f-160.dat	upx
behavioral2/files/0x000700000002356a-159.dat	upx
behavioral2/files/0x0007000000023556-151.dat	upx
behavioral2/files/0x0007000000023567-150.dat	upx
behavioral2/files/0x0007000000023566-147.dat	upx
behavioral2/files/0x0007000000023579-210.dat	upx
behavioral2/files/0x0007000000023565-146.dat	upx
behavioral2/files/0x0007000000023563-176.dat	upx
behavioral2/files/0x0007000000023562-121.dat	upx
behavioral2/files/0x000700000002355a-169.dat	upx
behavioral2/files/0x0007000000023554-104.dat	upx
behavioral2/files/0x0007000000023560-101.dat	upx
behavioral2/files/0x0007000000023569-156.dat	upx
behavioral2/files/0x000700000002355e-93.dat	upx
behavioral2/files/0x0007000000023551-74.dat	upx
behavioral2/files/0x0007000000023559-71.dat	upx
behavioral2/files/0x0007000000023558-69.dat	upx
behavioral2/files/0x0007000000023557-66.dat	upx
behavioral2/files/0x0007000000023552-82.dat	upx
behavioral2/memory/2744-56-0x00007FF614820000-0x00007FF614C12000-memory.dmp	upx
behavioral2/files/0x0007000000023550-27.dat	upx
behavioral2/files/0x000700000002354e-23.dat	upx
behavioral2/files/0x000a00000002336e-13.dat	upx
behavioral2/memory/4680-10-0x00007FF717500000-0x00007FF7178F2000-memory.dmp	upx
behavioral2/memory/2744-6050-0x00007FF614820000-0x00007FF614C12000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\nQgrUFo.exe	5e246ab7a6a28dc90a0ebd0da598c21407e61d3f6bc437d85faed76c1edf6369_NeikiAnalytics.exe
File created	C:\Windows\System\vIIynuu.exe	5e246ab7a6a28dc90a0ebd0da598c21407e61d3f6bc437d85faed76c1edf6369_NeikiAnalytics.exe
File created	C:\Windows\System\evTiYte.exe	5e246ab7a6a28dc90a0ebd0da598c21407e61d3f6bc437d85faed76c1edf6369_NeikiAnalytics.exe
File created	C:\Windows\System\SoLavxs.exe	5e246ab7a6a28dc90a0ebd0da598c21407e61d3f6bc437d85faed76c1edf6369_NeikiAnalytics.exe
File created	C:\Windows\System\BzDHKdl.exe	5e246ab7a6a28dc90a0ebd0da598c21407e61d3f6bc437d85faed76c1edf6369_NeikiAnalytics.exe
File created	C:\Windows\System\eNRhzCl.exe	5e246ab7a6a28dc90a0ebd0da598c21407e61d3f6bc437d85faed76c1edf6369_NeikiAnalytics.exe
File created	C:\Windows\System\RPSqWLV.exe	5e246ab7a6a28dc90a0ebd0da598c21407e61d3f6bc437d85faed76c1edf6369_NeikiAnalytics.exe
File created	C:\Windows\System\lYsCxdq.exe	5e246ab7a6a28dc90a0ebd0da598c21407e61d3f6bc437d85faed76c1edf6369_NeikiAnalytics.exe
File created	C:\Windows\System\rPNlZPD.exe	5e246ab7a6a28dc90a0ebd0da598c21407e61d3f6bc437d85faed76c1edf6369_NeikiAnalytics.exe
File created	C:\Windows\System\isJeDGC.exe	5e246ab7a6a28dc90a0ebd0da598c21407e61d3f6bc437d85faed76c1edf6369_NeikiAnalytics.exe
File created	C:\Windows\System\yyBJQGv.exe	5e246ab7a6a28dc90a0ebd0da598c21407e61d3f6bc437d85faed76c1edf6369_NeikiAnalytics.exe
File created	C:\Windows\System\BSpEJeZ.exe	5e246ab7a6a28dc90a0ebd0da598c21407e61d3f6bc437d85faed76c1edf6369_NeikiAnalytics.exe
File created	C:\Windows\System\EpqEqBt.exe	5e246ab7a6a28dc90a0ebd0da598c21407e61d3f6bc437d85faed76c1edf6369_NeikiAnalytics.exe
File created	C:\Windows\System\ZLVDkqe.exe	5e246ab7a6a28dc90a0ebd0da598c21407e61d3f6bc437d85faed76c1edf6369_NeikiAnalytics.exe
File created	C:\Windows\System\PYEpOTC.exe	5e246ab7a6a28dc90a0ebd0da598c21407e61d3f6bc437d85faed76c1edf6369_NeikiAnalytics.exe
File created	C:\Windows\System\UaIQKdN.exe	5e246ab7a6a28dc90a0ebd0da598c21407e61d3f6bc437d85faed76c1edf6369_NeikiAnalytics.exe
File created	C:\Windows\System\SfQXydG.exe	5e246ab7a6a28dc90a0ebd0da598c21407e61d3f6bc437d85faed76c1edf6369_NeikiAnalytics.exe
File created	C:\Windows\System\RirLmmc.exe	5e246ab7a6a28dc90a0ebd0da598c21407e61d3f6bc437d85faed76c1edf6369_NeikiAnalytics.exe
File created	C:\Windows\System\cuxYpow.exe	5e246ab7a6a28dc90a0ebd0da598c21407e61d3f6bc437d85faed76c1edf6369_NeikiAnalytics.exe
File created	C:\Windows\System\OqDUyHN.exe	5e246ab7a6a28dc90a0ebd0da598c21407e61d3f6bc437d85faed76c1edf6369_NeikiAnalytics.exe
File created	C:\Windows\System\kfRIIXi.exe	5e246ab7a6a28dc90a0ebd0da598c21407e61d3f6bc437d85faed76c1edf6369_NeikiAnalytics.exe
File created	C:\Windows\System\OrQvbjV.exe	5e246ab7a6a28dc90a0ebd0da598c21407e61d3f6bc437d85faed76c1edf6369_NeikiAnalytics.exe
File created	C:\Windows\System\xFnQCuQ.exe	5e246ab7a6a28dc90a0ebd0da598c21407e61d3f6bc437d85faed76c1edf6369_NeikiAnalytics.exe
File created	C:\Windows\System\KAaAExA.exe	5e246ab7a6a28dc90a0ebd0da598c21407e61d3f6bc437d85faed76c1edf6369_NeikiAnalytics.exe
File created	C:\Windows\System\mRIcvhK.exe	5e246ab7a6a28dc90a0ebd0da598c21407e61d3f6bc437d85faed76c1edf6369_NeikiAnalytics.exe
File created	C:\Windows\System\xPxCJJb.exe	5e246ab7a6a28dc90a0ebd0da598c21407e61d3f6bc437d85faed76c1edf6369_NeikiAnalytics.exe
File created	C:\Windows\System\dLifxUP.exe	5e246ab7a6a28dc90a0ebd0da598c21407e61d3f6bc437d85faed76c1edf6369_NeikiAnalytics.exe
File created	C:\Windows\System\DbILKIN.exe	5e246ab7a6a28dc90a0ebd0da598c21407e61d3f6bc437d85faed76c1edf6369_NeikiAnalytics.exe
File created	C:\Windows\System\ybNEajP.exe	5e246ab7a6a28dc90a0ebd0da598c21407e61d3f6bc437d85faed76c1edf6369_NeikiAnalytics.exe
File created	C:\Windows\System\apWaBXA.exe	5e246ab7a6a28dc90a0ebd0da598c21407e61d3f6bc437d85faed76c1edf6369_NeikiAnalytics.exe
File created	C:\Windows\System\sXwKvII.exe	5e246ab7a6a28dc90a0ebd0da598c21407e61d3f6bc437d85faed76c1edf6369_NeikiAnalytics.exe
File created	C:\Windows\System\FKeWniy.exe	5e246ab7a6a28dc90a0ebd0da598c21407e61d3f6bc437d85faed76c1edf6369_NeikiAnalytics.exe
File created	C:\Windows\System\efxzwuG.exe	5e246ab7a6a28dc90a0ebd0da598c21407e61d3f6bc437d85faed76c1edf6369_NeikiAnalytics.exe
File created	C:\Windows\System\CfqOTFD.exe	5e246ab7a6a28dc90a0ebd0da598c21407e61d3f6bc437d85faed76c1edf6369_NeikiAnalytics.exe
File created	C:\Windows\System\mfevLZF.exe	5e246ab7a6a28dc90a0ebd0da598c21407e61d3f6bc437d85faed76c1edf6369_NeikiAnalytics.exe
File created	C:\Windows\System\JWpUosr.exe	5e246ab7a6a28dc90a0ebd0da598c21407e61d3f6bc437d85faed76c1edf6369_NeikiAnalytics.exe
File created	C:\Windows\System\dkElofP.exe	5e246ab7a6a28dc90a0ebd0da598c21407e61d3f6bc437d85faed76c1edf6369_NeikiAnalytics.exe
File created	C:\Windows\System\dmxwBKb.exe	5e246ab7a6a28dc90a0ebd0da598c21407e61d3f6bc437d85faed76c1edf6369_NeikiAnalytics.exe
File created	C:\Windows\System\RJkoita.exe	5e246ab7a6a28dc90a0ebd0da598c21407e61d3f6bc437d85faed76c1edf6369_NeikiAnalytics.exe
File created	C:\Windows\System\WQIdCLy.exe	5e246ab7a6a28dc90a0ebd0da598c21407e61d3f6bc437d85faed76c1edf6369_NeikiAnalytics.exe
File created	C:\Windows\System\ldVOseD.exe	5e246ab7a6a28dc90a0ebd0da598c21407e61d3f6bc437d85faed76c1edf6369_NeikiAnalytics.exe
File created	C:\Windows\System\fbZIuwV.exe	5e246ab7a6a28dc90a0ebd0da598c21407e61d3f6bc437d85faed76c1edf6369_NeikiAnalytics.exe
File created	C:\Windows\System\iWQHFqW.exe	5e246ab7a6a28dc90a0ebd0da598c21407e61d3f6bc437d85faed76c1edf6369_NeikiAnalytics.exe
File created	C:\Windows\System\aEbDJXd.exe	5e246ab7a6a28dc90a0ebd0da598c21407e61d3f6bc437d85faed76c1edf6369_NeikiAnalytics.exe
File created	C:\Windows\System\ghxFQKx.exe	5e246ab7a6a28dc90a0ebd0da598c21407e61d3f6bc437d85faed76c1edf6369_NeikiAnalytics.exe
File created	C:\Windows\System\bOZvrzf.exe	5e246ab7a6a28dc90a0ebd0da598c21407e61d3f6bc437d85faed76c1edf6369_NeikiAnalytics.exe
File created	C:\Windows\System\ThJyVxY.exe	5e246ab7a6a28dc90a0ebd0da598c21407e61d3f6bc437d85faed76c1edf6369_NeikiAnalytics.exe
File created	C:\Windows\System\prregGZ.exe	5e246ab7a6a28dc90a0ebd0da598c21407e61d3f6bc437d85faed76c1edf6369_NeikiAnalytics.exe
File created	C:\Windows\System\zsdOdal.exe	5e246ab7a6a28dc90a0ebd0da598c21407e61d3f6bc437d85faed76c1edf6369_NeikiAnalytics.exe
File created	C:\Windows\System\wPIuStn.exe	5e246ab7a6a28dc90a0ebd0da598c21407e61d3f6bc437d85faed76c1edf6369_NeikiAnalytics.exe
File created	C:\Windows\System\oQqcCgx.exe	5e246ab7a6a28dc90a0ebd0da598c21407e61d3f6bc437d85faed76c1edf6369_NeikiAnalytics.exe
File created	C:\Windows\System\kxKeeQZ.exe	5e246ab7a6a28dc90a0ebd0da598c21407e61d3f6bc437d85faed76c1edf6369_NeikiAnalytics.exe
File created	C:\Windows\System\vxaAiiB.exe	5e246ab7a6a28dc90a0ebd0da598c21407e61d3f6bc437d85faed76c1edf6369_NeikiAnalytics.exe
File created	C:\Windows\System\gWednxx.exe	5e246ab7a6a28dc90a0ebd0da598c21407e61d3f6bc437d85faed76c1edf6369_NeikiAnalytics.exe
File created	C:\Windows\System\kwBxeBJ.exe	5e246ab7a6a28dc90a0ebd0da598c21407e61d3f6bc437d85faed76c1edf6369_NeikiAnalytics.exe
File created	C:\Windows\System\NMkZUMx.exe	5e246ab7a6a28dc90a0ebd0da598c21407e61d3f6bc437d85faed76c1edf6369_NeikiAnalytics.exe
File created	C:\Windows\System\GPyCbCW.exe	5e246ab7a6a28dc90a0ebd0da598c21407e61d3f6bc437d85faed76c1edf6369_NeikiAnalytics.exe
File created	C:\Windows\System\VzREjZI.exe	5e246ab7a6a28dc90a0ebd0da598c21407e61d3f6bc437d85faed76c1edf6369_NeikiAnalytics.exe
File created	C:\Windows\System\ZAazbJk.exe	5e246ab7a6a28dc90a0ebd0da598c21407e61d3f6bc437d85faed76c1edf6369_NeikiAnalytics.exe
File created	C:\Windows\System\FlLccFH.exe	5e246ab7a6a28dc90a0ebd0da598c21407e61d3f6bc437d85faed76c1edf6369_NeikiAnalytics.exe
File created	C:\Windows\System\nbzsUEU.exe	5e246ab7a6a28dc90a0ebd0da598c21407e61d3f6bc437d85faed76c1edf6369_NeikiAnalytics.exe
File created	C:\Windows\System\CSeenIf.exe	5e246ab7a6a28dc90a0ebd0da598c21407e61d3f6bc437d85faed76c1edf6369_NeikiAnalytics.exe
File created	C:\Windows\System\mUnnJAh.exe	5e246ab7a6a28dc90a0ebd0da598c21407e61d3f6bc437d85faed76c1edf6369_NeikiAnalytics.exe
File created	C:\Windows\System\wTbWVar.exe	5e246ab7a6a28dc90a0ebd0da598c21407e61d3f6bc437d85faed76c1edf6369_NeikiAnalytics.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2952	powershell.exe
2952	powershell.exe
2952	powershell.exe
2952	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	4808	5e246ab7a6a28dc90a0ebd0da598c21407e61d3f6bc437d85faed76c1edf6369_NeikiAnalytics.exe
Token: SeDebugPrivilege	2952	powershell.exe
Token: SeLockMemoryPrivilege	4808	5e246ab7a6a28dc90a0ebd0da598c21407e61d3f6bc437d85faed76c1edf6369_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4808 wrote to memory of 2952	4808	5e246ab7a6a28dc90a0ebd0da598c21407e61d3f6bc437d85faed76c1edf6369_NeikiAnalytics.exe	84
PID 4808 wrote to memory of 2952	4808	5e246ab7a6a28dc90a0ebd0da598c21407e61d3f6bc437d85faed76c1edf6369_NeikiAnalytics.exe	84
PID 4808 wrote to memory of 4680	4808	5e246ab7a6a28dc90a0ebd0da598c21407e61d3f6bc437d85faed76c1edf6369_NeikiAnalytics.exe	85
PID 4808 wrote to memory of 4680	4808	5e246ab7a6a28dc90a0ebd0da598c21407e61d3f6bc437d85faed76c1edf6369_NeikiAnalytics.exe	85
PID 4808 wrote to memory of 1980	4808	5e246ab7a6a28dc90a0ebd0da598c21407e61d3f6bc437d85faed76c1edf6369_NeikiAnalytics.exe	86
PID 4808 wrote to memory of 1980	4808	5e246ab7a6a28dc90a0ebd0da598c21407e61d3f6bc437d85faed76c1edf6369_NeikiAnalytics.exe	86
PID 4808 wrote to memory of 2744	4808	5e246ab7a6a28dc90a0ebd0da598c21407e61d3f6bc437d85faed76c1edf6369_NeikiAnalytics.exe	87
PID 4808 wrote to memory of 2744	4808	5e246ab7a6a28dc90a0ebd0da598c21407e61d3f6bc437d85faed76c1edf6369_NeikiAnalytics.exe	87
PID 4808 wrote to memory of 1080	4808	5e246ab7a6a28dc90a0ebd0da598c21407e61d3f6bc437d85faed76c1edf6369_NeikiAnalytics.exe	88
PID 4808 wrote to memory of 1080	4808	5e246ab7a6a28dc90a0ebd0da598c21407e61d3f6bc437d85faed76c1edf6369_NeikiAnalytics.exe	88
PID 4808 wrote to memory of 4444	4808	5e246ab7a6a28dc90a0ebd0da598c21407e61d3f6bc437d85faed76c1edf6369_NeikiAnalytics.exe	89
PID 4808 wrote to memory of 4444	4808	5e246ab7a6a28dc90a0ebd0da598c21407e61d3f6bc437d85faed76c1edf6369_NeikiAnalytics.exe	89
PID 4808 wrote to memory of 3972	4808	5e246ab7a6a28dc90a0ebd0da598c21407e61d3f6bc437d85faed76c1edf6369_NeikiAnalytics.exe	90
PID 4808 wrote to memory of 3972	4808	5e246ab7a6a28dc90a0ebd0da598c21407e61d3f6bc437d85faed76c1edf6369_NeikiAnalytics.exe	90
PID 4808 wrote to memory of 3372	4808	5e246ab7a6a28dc90a0ebd0da598c21407e61d3f6bc437d85faed76c1edf6369_NeikiAnalytics.exe	91
PID 4808 wrote to memory of 3372	4808	5e246ab7a6a28dc90a0ebd0da598c21407e61d3f6bc437d85faed76c1edf6369_NeikiAnalytics.exe	91
PID 4808 wrote to memory of 4060	4808	5e246ab7a6a28dc90a0ebd0da598c21407e61d3f6bc437d85faed76c1edf6369_NeikiAnalytics.exe	92
PID 4808 wrote to memory of 4060	4808	5e246ab7a6a28dc90a0ebd0da598c21407e61d3f6bc437d85faed76c1edf6369_NeikiAnalytics.exe	92
PID 4808 wrote to memory of 1780	4808	5e246ab7a6a28dc90a0ebd0da598c21407e61d3f6bc437d85faed76c1edf6369_NeikiAnalytics.exe	93
PID 4808 wrote to memory of 1780	4808	5e246ab7a6a28dc90a0ebd0da598c21407e61d3f6bc437d85faed76c1edf6369_NeikiAnalytics.exe	93
PID 4808 wrote to memory of 1432	4808	5e246ab7a6a28dc90a0ebd0da598c21407e61d3f6bc437d85faed76c1edf6369_NeikiAnalytics.exe	94
PID 4808 wrote to memory of 1432	4808	5e246ab7a6a28dc90a0ebd0da598c21407e61d3f6bc437d85faed76c1edf6369_NeikiAnalytics.exe	94
PID 4808 wrote to memory of 1320	4808	5e246ab7a6a28dc90a0ebd0da598c21407e61d3f6bc437d85faed76c1edf6369_NeikiAnalytics.exe	95
PID 4808 wrote to memory of 1320	4808	5e246ab7a6a28dc90a0ebd0da598c21407e61d3f6bc437d85faed76c1edf6369_NeikiAnalytics.exe	95
PID 4808 wrote to memory of 1776	4808	5e246ab7a6a28dc90a0ebd0da598c21407e61d3f6bc437d85faed76c1edf6369_NeikiAnalytics.exe	96
PID 4808 wrote to memory of 1776	4808	5e246ab7a6a28dc90a0ebd0da598c21407e61d3f6bc437d85faed76c1edf6369_NeikiAnalytics.exe	96
PID 4808 wrote to memory of 2932	4808	5e246ab7a6a28dc90a0ebd0da598c21407e61d3f6bc437d85faed76c1edf6369_NeikiAnalytics.exe	97
PID 4808 wrote to memory of 2932	4808	5e246ab7a6a28dc90a0ebd0da598c21407e61d3f6bc437d85faed76c1edf6369_NeikiAnalytics.exe	97
PID 4808 wrote to memory of 1628	4808	5e246ab7a6a28dc90a0ebd0da598c21407e61d3f6bc437d85faed76c1edf6369_NeikiAnalytics.exe	98
PID 4808 wrote to memory of 1628	4808	5e246ab7a6a28dc90a0ebd0da598c21407e61d3f6bc437d85faed76c1edf6369_NeikiAnalytics.exe	98
PID 4808 wrote to memory of 4928	4808	5e246ab7a6a28dc90a0ebd0da598c21407e61d3f6bc437d85faed76c1edf6369_NeikiAnalytics.exe	99
PID 4808 wrote to memory of 4928	4808	5e246ab7a6a28dc90a0ebd0da598c21407e61d3f6bc437d85faed76c1edf6369_NeikiAnalytics.exe	99
PID 4808 wrote to memory of 3948	4808	5e246ab7a6a28dc90a0ebd0da598c21407e61d3f6bc437d85faed76c1edf6369_NeikiAnalytics.exe	100
PID 4808 wrote to memory of 3948	4808	5e246ab7a6a28dc90a0ebd0da598c21407e61d3f6bc437d85faed76c1edf6369_NeikiAnalytics.exe	100
PID 4808 wrote to memory of 1708	4808	5e246ab7a6a28dc90a0ebd0da598c21407e61d3f6bc437d85faed76c1edf6369_NeikiAnalytics.exe	101
PID 4808 wrote to memory of 1708	4808	5e246ab7a6a28dc90a0ebd0da598c21407e61d3f6bc437d85faed76c1edf6369_NeikiAnalytics.exe	101
PID 4808 wrote to memory of 3352	4808	5e246ab7a6a28dc90a0ebd0da598c21407e61d3f6bc437d85faed76c1edf6369_NeikiAnalytics.exe	102
PID 4808 wrote to memory of 3352	4808	5e246ab7a6a28dc90a0ebd0da598c21407e61d3f6bc437d85faed76c1edf6369_NeikiAnalytics.exe	102
PID 4808 wrote to memory of 1360	4808	5e246ab7a6a28dc90a0ebd0da598c21407e61d3f6bc437d85faed76c1edf6369_NeikiAnalytics.exe	103
PID 4808 wrote to memory of 1360	4808	5e246ab7a6a28dc90a0ebd0da598c21407e61d3f6bc437d85faed76c1edf6369_NeikiAnalytics.exe	103
PID 4808 wrote to memory of 868	4808	5e246ab7a6a28dc90a0ebd0da598c21407e61d3f6bc437d85faed76c1edf6369_NeikiAnalytics.exe	104
PID 4808 wrote to memory of 868	4808	5e246ab7a6a28dc90a0ebd0da598c21407e61d3f6bc437d85faed76c1edf6369_NeikiAnalytics.exe	104
PID 4808 wrote to memory of 4416	4808	5e246ab7a6a28dc90a0ebd0da598c21407e61d3f6bc437d85faed76c1edf6369_NeikiAnalytics.exe	105
PID 4808 wrote to memory of 4416	4808	5e246ab7a6a28dc90a0ebd0da598c21407e61d3f6bc437d85faed76c1edf6369_NeikiAnalytics.exe	105
PID 4808 wrote to memory of 2356	4808	5e246ab7a6a28dc90a0ebd0da598c21407e61d3f6bc437d85faed76c1edf6369_NeikiAnalytics.exe	106
PID 4808 wrote to memory of 2356	4808	5e246ab7a6a28dc90a0ebd0da598c21407e61d3f6bc437d85faed76c1edf6369_NeikiAnalytics.exe	106
PID 4808 wrote to memory of 3904	4808	5e246ab7a6a28dc90a0ebd0da598c21407e61d3f6bc437d85faed76c1edf6369_NeikiAnalytics.exe	107
PID 4808 wrote to memory of 3904	4808	5e246ab7a6a28dc90a0ebd0da598c21407e61d3f6bc437d85faed76c1edf6369_NeikiAnalytics.exe	107
PID 4808 wrote to memory of 3564	4808	5e246ab7a6a28dc90a0ebd0da598c21407e61d3f6bc437d85faed76c1edf6369_NeikiAnalytics.exe	108
PID 4808 wrote to memory of 3564	4808	5e246ab7a6a28dc90a0ebd0da598c21407e61d3f6bc437d85faed76c1edf6369_NeikiAnalytics.exe	108
PID 4808 wrote to memory of 772	4808	5e246ab7a6a28dc90a0ebd0da598c21407e61d3f6bc437d85faed76c1edf6369_NeikiAnalytics.exe	109
PID 4808 wrote to memory of 772	4808	5e246ab7a6a28dc90a0ebd0da598c21407e61d3f6bc437d85faed76c1edf6369_NeikiAnalytics.exe	109
PID 4808 wrote to memory of 2536	4808	5e246ab7a6a28dc90a0ebd0da598c21407e61d3f6bc437d85faed76c1edf6369_NeikiAnalytics.exe	110
PID 4808 wrote to memory of 2536	4808	5e246ab7a6a28dc90a0ebd0da598c21407e61d3f6bc437d85faed76c1edf6369_NeikiAnalytics.exe	110
PID 4808 wrote to memory of 4748	4808	5e246ab7a6a28dc90a0ebd0da598c21407e61d3f6bc437d85faed76c1edf6369_NeikiAnalytics.exe	111
PID 4808 wrote to memory of 4748	4808	5e246ab7a6a28dc90a0ebd0da598c21407e61d3f6bc437d85faed76c1edf6369_NeikiAnalytics.exe	111
PID 4808 wrote to memory of 2000	4808	5e246ab7a6a28dc90a0ebd0da598c21407e61d3f6bc437d85faed76c1edf6369_NeikiAnalytics.exe	112
PID 4808 wrote to memory of 2000	4808	5e246ab7a6a28dc90a0ebd0da598c21407e61d3f6bc437d85faed76c1edf6369_NeikiAnalytics.exe	112
PID 4808 wrote to memory of 1408	4808	5e246ab7a6a28dc90a0ebd0da598c21407e61d3f6bc437d85faed76c1edf6369_NeikiAnalytics.exe	113
PID 4808 wrote to memory of 1408	4808	5e246ab7a6a28dc90a0ebd0da598c21407e61d3f6bc437d85faed76c1edf6369_NeikiAnalytics.exe	113
PID 4808 wrote to memory of 692	4808	5e246ab7a6a28dc90a0ebd0da598c21407e61d3f6bc437d85faed76c1edf6369_NeikiAnalytics.exe	114
PID 4808 wrote to memory of 692	4808	5e246ab7a6a28dc90a0ebd0da598c21407e61d3f6bc437d85faed76c1edf6369_NeikiAnalytics.exe	114
PID 4808 wrote to memory of 3768	4808	5e246ab7a6a28dc90a0ebd0da598c21407e61d3f6bc437d85faed76c1edf6369_NeikiAnalytics.exe	115
PID 4808 wrote to memory of 3768	4808	5e246ab7a6a28dc90a0ebd0da598c21407e61d3f6bc437d85faed76c1edf6369_NeikiAnalytics.exe	115

C:\Users\Admin\AppData\Local\Temp\5e246ab7a6a28dc90a0ebd0da598c21407e61d3f6bc437d85faed76c1edf6369_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\5e246ab7a6a28dc90a0ebd0da598c21407e61d3f6bc437d85faed76c1edf6369_NeikiAnalytics.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4808
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2952
- C:\Windows\System\bYelxnc.exe
  C:\Windows\System\bYelxnc.exe
  2⤵
  - Executes dropped EXE
  PID:4680
- C:\Windows\System\punftdj.exe
  C:\Windows\System\punftdj.exe
  2⤵
  - Executes dropped EXE
  PID:1980
- C:\Windows\System\IpIVhkm.exe
  C:\Windows\System\IpIVhkm.exe
  2⤵
  - Executes dropped EXE
  PID:2744
- C:\Windows\System\iVnLdYP.exe
  C:\Windows\System\iVnLdYP.exe
  2⤵
  - Executes dropped EXE
  PID:1080
- C:\Windows\System\gTNXXXC.exe
  C:\Windows\System\gTNXXXC.exe
  2⤵
  - Executes dropped EXE
  PID:4444
- C:\Windows\System\HxqYHoO.exe
  C:\Windows\System\HxqYHoO.exe
  2⤵
  - Executes dropped EXE
  PID:3972
- C:\Windows\System\HZWAbIR.exe
  C:\Windows\System\HZWAbIR.exe
  2⤵
  - Executes dropped EXE
  PID:3372
- C:\Windows\System\edlrxxt.exe
  C:\Windows\System\edlrxxt.exe
  2⤵
  - Executes dropped EXE
  PID:4060
- C:\Windows\System\evWGUsC.exe
  C:\Windows\System\evWGUsC.exe
  2⤵
  - Executes dropped EXE
  PID:1780
- C:\Windows\System\WdeVPMU.exe
  C:\Windows\System\WdeVPMU.exe
  2⤵
  - Executes dropped EXE
  PID:1432
- C:\Windows\System\HaGWtHT.exe
  C:\Windows\System\HaGWtHT.exe
  2⤵
  - Executes dropped EXE
  PID:1320
- C:\Windows\System\OTzgLwI.exe
  C:\Windows\System\OTzgLwI.exe
  2⤵
  - Executes dropped EXE
  PID:1776
- C:\Windows\System\PdOcllc.exe
  C:\Windows\System\PdOcllc.exe
  2⤵
  - Executes dropped EXE
  PID:2932
- C:\Windows\System\DcYyjKW.exe
  C:\Windows\System\DcYyjKW.exe
  2⤵
  - Executes dropped EXE
  PID:1628
- C:\Windows\System\nIoXhEo.exe
  C:\Windows\System\nIoXhEo.exe
  2⤵
  - Executes dropped EXE
  PID:4928
- C:\Windows\System\ENoWATE.exe
  C:\Windows\System\ENoWATE.exe
  2⤵
  - Executes dropped EXE
  PID:3948
- C:\Windows\System\QnyVTAf.exe
  C:\Windows\System\QnyVTAf.exe
  2⤵
  - Executes dropped EXE
  PID:1708
- C:\Windows\System\RYJilfJ.exe
  C:\Windows\System\RYJilfJ.exe
  2⤵
  - Executes dropped EXE
  PID:3352
- C:\Windows\System\omEnEkD.exe
  C:\Windows\System\omEnEkD.exe
  2⤵
  - Executes dropped EXE
  PID:1360
- C:\Windows\System\UbGZzGH.exe
  C:\Windows\System\UbGZzGH.exe
  2⤵
  - Executes dropped EXE
  PID:868
- C:\Windows\System\AeupnRR.exe
  C:\Windows\System\AeupnRR.exe
  2⤵
  - Executes dropped EXE
  PID:4416
- C:\Windows\System\wmPoWgh.exe
  C:\Windows\System\wmPoWgh.exe
  2⤵
  - Executes dropped EXE
  PID:2356
- C:\Windows\System\GrUPEpH.exe
  C:\Windows\System\GrUPEpH.exe
  2⤵
  - Executes dropped EXE
  PID:3904
- C:\Windows\System\mRVufNi.exe
  C:\Windows\System\mRVufNi.exe
  2⤵
  - Executes dropped EXE
  PID:3564
- C:\Windows\System\hjSUtou.exe
  C:\Windows\System\hjSUtou.exe
  2⤵
  - Executes dropped EXE
  PID:772
- C:\Windows\System\hCKwFaC.exe
  C:\Windows\System\hCKwFaC.exe
  2⤵
  - Executes dropped EXE
  PID:2536
- C:\Windows\System\mnprLAP.exe
  C:\Windows\System\mnprLAP.exe
  2⤵
  - Executes dropped EXE
  PID:4748
- C:\Windows\System\HzqnttS.exe
  C:\Windows\System\HzqnttS.exe
  2⤵
  - Executes dropped EXE
  PID:2000
- C:\Windows\System\QkoGbBZ.exe
  C:\Windows\System\QkoGbBZ.exe
  2⤵
  - Executes dropped EXE
  PID:1408
- C:\Windows\System\GpPVVst.exe
  C:\Windows\System\GpPVVst.exe
  2⤵
  - Executes dropped EXE
  PID:692
- C:\Windows\System\KNBdbIP.exe
  C:\Windows\System\KNBdbIP.exe
  2⤵
  - Executes dropped EXE
  PID:3768
- C:\Windows\System\vxLVmpF.exe
  C:\Windows\System\vxLVmpF.exe
  2⤵
  - Executes dropped EXE
  PID:1692
- C:\Windows\System\DouVDTu.exe
  C:\Windows\System\DouVDTu.exe
  2⤵
  - Executes dropped EXE
  PID:1280
- C:\Windows\System\bywLrZc.exe
  C:\Windows\System\bywLrZc.exe
  2⤵
  - Executes dropped EXE
  PID:3104
- C:\Windows\System\BUFtvuw.exe
  C:\Windows\System\BUFtvuw.exe
  2⤵
  - Executes dropped EXE
  PID:4064
- C:\Windows\System\NVkILIe.exe
  C:\Windows\System\NVkILIe.exe
  2⤵
  - Executes dropped EXE
  PID:3744
- C:\Windows\System\ERXtaZU.exe
  C:\Windows\System\ERXtaZU.exe
  2⤵
  - Executes dropped EXE
  PID:4048
- C:\Windows\System\VyCjTYw.exe
  C:\Windows\System\VyCjTYw.exe
  2⤵
  - Executes dropped EXE
  PID:1468
- C:\Windows\System\AvTzRts.exe
  C:\Windows\System\AvTzRts.exe
  2⤵
  - Executes dropped EXE
  PID:3516
- C:\Windows\System\AkZVGTs.exe
  C:\Windows\System\AkZVGTs.exe
  2⤵
  - Executes dropped EXE
  PID:4736
- C:\Windows\System\vNNBGsA.exe
  C:\Windows\System\vNNBGsA.exe
  2⤵
  - Executes dropped EXE
  PID:5028
- C:\Windows\System\RKCIvRW.exe
  C:\Windows\System\RKCIvRW.exe
  2⤵
  - Executes dropped EXE
  PID:1492
- C:\Windows\System\itOISht.exe
  C:\Windows\System\itOISht.exe
  2⤵
  - Executes dropped EXE
  PID:2840
- C:\Windows\System\vUvVLWy.exe
  C:\Windows\System\vUvVLWy.exe
  2⤵
  - Executes dropped EXE
  PID:3316
- C:\Windows\System\tdArneE.exe
  C:\Windows\System\tdArneE.exe
  2⤵
  - Executes dropped EXE
  PID:4176
- C:\Windows\System\QrswMZV.exe
  C:\Windows\System\QrswMZV.exe
  2⤵
  - Executes dropped EXE
  PID:3324
- C:\Windows\System\bOistIh.exe
  C:\Windows\System\bOistIh.exe
  2⤵
  - Executes dropped EXE
  PID:4908
- C:\Windows\System\oIUoBax.exe
  C:\Windows\System\oIUoBax.exe
  2⤵
  - Executes dropped EXE
  PID:1388
- C:\Windows\System\idCDInR.exe
  C:\Windows\System\idCDInR.exe
  2⤵
  - Executes dropped EXE
  PID:3160
- C:\Windows\System\SbCLtTO.exe
  C:\Windows\System\SbCLtTO.exe
  2⤵
  - Executes dropped EXE
  PID:2928
- C:\Windows\System\WaCkEGh.exe
  C:\Windows\System\WaCkEGh.exe
  2⤵
  - Executes dropped EXE
  PID:3360
- C:\Windows\System\tmYhZCj.exe
  C:\Windows\System\tmYhZCj.exe
  2⤵
  - Executes dropped EXE
  PID:1416
- C:\Windows\System\tHpXATx.exe
  C:\Windows\System\tHpXATx.exe
  2⤵
  - Executes dropped EXE
  PID:400
- C:\Windows\System\jFiZeiD.exe
  C:\Windows\System\jFiZeiD.exe
  2⤵
  - Executes dropped EXE
  PID:1364
- C:\Windows\System\CHqlsyA.exe
  C:\Windows\System\CHqlsyA.exe
  2⤵
  - Executes dropped EXE
  PID:208
- C:\Windows\System\DzNZRoV.exe
  C:\Windows\System\DzNZRoV.exe
  2⤵
  - Executes dropped EXE
  PID:1216
- C:\Windows\System\UVBbDOw.exe
  C:\Windows\System\UVBbDOw.exe
  2⤵
  - Executes dropped EXE
  PID:3684
- C:\Windows\System\HgyWruI.exe
  C:\Windows\System\HgyWruI.exe
  2⤵
  - Executes dropped EXE
  PID:992
- C:\Windows\System\BndlCES.exe
  C:\Windows\System\BndlCES.exe
  2⤵
  PID:3984
- C:\Windows\System\uApMIhA.exe
  C:\Windows\System\uApMIhA.exe
  2⤵
  PID:4988
- C:\Windows\System\hvxCyaB.exe
  C:\Windows\System\hvxCyaB.exe
  2⤵
  - Executes dropped EXE
  PID:4224
- C:\Windows\System\FSVlIru.exe
  C:\Windows\System\FSVlIru.exe
  2⤵
  PID:1620
- C:\Windows\System\KgfvbmL.exe
  C:\Windows\System\KgfvbmL.exe
  2⤵
  - Executes dropped EXE
  PID:3212
- C:\Windows\System\wCQodEU.exe
  C:\Windows\System\wCQodEU.exe
  2⤵
  - Executes dropped EXE
  PID:2664
- C:\Windows\System\jsuClZJ.exe
  C:\Windows\System\jsuClZJ.exe
  2⤵
  - Executes dropped EXE
  PID:2800
- C:\Windows\System\xtxyGiJ.exe
  C:\Windows\System\xtxyGiJ.exe
  2⤵
  PID:1228
- C:\Windows\System\aSagxFa.exe
  C:\Windows\System\aSagxFa.exe
  2⤵
  - Executes dropped EXE
  PID:824
- C:\Windows\System\nCExEPa.exe
  C:\Windows\System\nCExEPa.exe
  2⤵
  - Executes dropped EXE
  PID:4612
- C:\Windows\System\CNZkHPD.exe
  C:\Windows\System\CNZkHPD.exe
  2⤵
  PID:1852
- C:\Windows\System\RodHWiG.exe
  C:\Windows\System\RodHWiG.exe
  2⤵
  PID:3304
- C:\Windows\System\iMOutcn.exe
  C:\Windows\System\iMOutcn.exe
  2⤵
  PID:2760
- C:\Windows\System\nQMMQxW.exe
  C:\Windows\System\nQMMQxW.exe
  2⤵
  PID:4280
- C:\Windows\System\UApphrT.exe
  C:\Windows\System\UApphrT.exe
  2⤵
  PID:2876
- C:\Windows\System\TmLaHYp.exe
  C:\Windows\System\TmLaHYp.exe
  2⤵
  PID:4732
- C:\Windows\System\TJltRqA.exe
  C:\Windows\System\TJltRqA.exe
  2⤵
  PID:3536
- C:\Windows\System\vouERjH.exe
  C:\Windows\System\vouERjH.exe
  2⤵
  PID:1348
- C:\Windows\System\qMGNMjd.exe
  C:\Windows\System\qMGNMjd.exe
  2⤵
  PID:5132
- C:\Windows\System\DTljOEs.exe
  C:\Windows\System\DTljOEs.exe
  2⤵
  PID:5164
- C:\Windows\System\TNCKbcT.exe
  C:\Windows\System\TNCKbcT.exe
  2⤵
  PID:5184
- C:\Windows\System\VvOvacs.exe
  C:\Windows\System\VvOvacs.exe
  2⤵
  PID:5200
- C:\Windows\System\AlbXvFN.exe
  C:\Windows\System\AlbXvFN.exe
  2⤵
  PID:5224
- C:\Windows\System\VmcErWx.exe
  C:\Windows\System\VmcErWx.exe
  2⤵
  PID:5240
- C:\Windows\System\UpeHCof.exe
  C:\Windows\System\UpeHCof.exe
  2⤵
  PID:5260
- C:\Windows\System\SfjjcSR.exe
  C:\Windows\System\SfjjcSR.exe
  2⤵
  PID:5284
- C:\Windows\System\xHSceOO.exe
  C:\Windows\System\xHSceOO.exe
  2⤵
  PID:5304
- C:\Windows\System\WCngqhD.exe
  C:\Windows\System\WCngqhD.exe
  2⤵
  PID:5320
- C:\Windows\System\aAqYcKz.exe
  C:\Windows\System\aAqYcKz.exe
  2⤵
  PID:5336
- C:\Windows\System\IkKYngx.exe
  C:\Windows\System\IkKYngx.exe
  2⤵
  PID:5356
- C:\Windows\System\kerxjkt.exe
  C:\Windows\System\kerxjkt.exe
  2⤵
  PID:5372
- C:\Windows\System\AfFtvti.exe
  C:\Windows\System\AfFtvti.exe
  2⤵
  PID:5396
- C:\Windows\System\cqLzpCX.exe
  C:\Windows\System\cqLzpCX.exe
  2⤵
  PID:5412
- C:\Windows\System\UaGGfxk.exe
  C:\Windows\System\UaGGfxk.exe
  2⤵
  PID:5436
- C:\Windows\System\kmVGnJM.exe
  C:\Windows\System\kmVGnJM.exe
  2⤵
  PID:5452
- C:\Windows\System\zmqQtDW.exe
  C:\Windows\System\zmqQtDW.exe
  2⤵
  PID:5468
- C:\Windows\System\JPMuprs.exe
  C:\Windows\System\JPMuprs.exe
  2⤵
  PID:5500
- C:\Windows\System\oixhIvS.exe
  C:\Windows\System\oixhIvS.exe
  2⤵
  PID:5528
- C:\Windows\System\UVFfxpM.exe
  C:\Windows\System\UVFfxpM.exe
  2⤵
  PID:5544
- C:\Windows\System\yKSXnUv.exe
  C:\Windows\System\yKSXnUv.exe
  2⤵
  PID:5560
- C:\Windows\System\ybzFORd.exe
  C:\Windows\System\ybzFORd.exe
  2⤵
  PID:5576
- C:\Windows\System\LmFeQUh.exe
  C:\Windows\System\LmFeQUh.exe
  2⤵
  PID:5592
- C:\Windows\System\KPepfCd.exe
  C:\Windows\System\KPepfCd.exe
  2⤵
  PID:5608
- C:\Windows\System\lmUDRXx.exe
  C:\Windows\System\lmUDRXx.exe
  2⤵
  PID:5628
- C:\Windows\System\WFRgsRl.exe
  C:\Windows\System\WFRgsRl.exe
  2⤵
  PID:5648
- C:\Windows\System\klBxluO.exe
  C:\Windows\System\klBxluO.exe
  2⤵
  PID:5668
- C:\Windows\System\dMavnKf.exe
  C:\Windows\System\dMavnKf.exe
  2⤵
  PID:5696
- C:\Windows\System\eZCscZf.exe
  C:\Windows\System\eZCscZf.exe
  2⤵
  PID:5712
- C:\Windows\System\LCcfUwy.exe
  C:\Windows\System\LCcfUwy.exe
  2⤵
  PID:5732
- C:\Windows\System\AvzrlxM.exe
  C:\Windows\System\AvzrlxM.exe
  2⤵
  PID:5748
- C:\Windows\System\vREhOGK.exe
  C:\Windows\System\vREhOGK.exe
  2⤵
  PID:5772
- C:\Windows\System\PoPbrfG.exe
  C:\Windows\System\PoPbrfG.exe
  2⤵
  PID:5788
- C:\Windows\System\oXgjRlw.exe
  C:\Windows\System\oXgjRlw.exe
  2⤵
  PID:5808
- C:\Windows\System\WqVFgrZ.exe
  C:\Windows\System\WqVFgrZ.exe
  2⤵
  PID:5836
- C:\Windows\System\rjSemZc.exe
  C:\Windows\System\rjSemZc.exe
  2⤵
  PID:5860
- C:\Windows\System\dulTmYH.exe
  C:\Windows\System\dulTmYH.exe
  2⤵
  PID:5876
- C:\Windows\System\oyoaKxD.exe
  C:\Windows\System\oyoaKxD.exe
  2⤵
  PID:5900
- C:\Windows\System\EjAPwDF.exe
  C:\Windows\System\EjAPwDF.exe
  2⤵
  PID:5924
- C:\Windows\System\ePMqZUC.exe
  C:\Windows\System\ePMqZUC.exe
  2⤵
  PID:5944
- C:\Windows\System\uyOevhZ.exe
  C:\Windows\System\uyOevhZ.exe
  2⤵
  PID:5960
- C:\Windows\System\FTTcgyz.exe
  C:\Windows\System\FTTcgyz.exe
  2⤵
  PID:5976
- C:\Windows\System\vwCJJYK.exe
  C:\Windows\System\vwCJJYK.exe
  2⤵
  PID:5992
- C:\Windows\System\eTUXlAy.exe
  C:\Windows\System\eTUXlAy.exe
  2⤵
  PID:6008
- C:\Windows\System\WgUKZJA.exe
  C:\Windows\System\WgUKZJA.exe
  2⤵
  PID:6032
- C:\Windows\System\TFtRKvO.exe
  C:\Windows\System\TFtRKvO.exe
  2⤵
  PID:6048
- C:\Windows\System\aZgVnME.exe
  C:\Windows\System\aZgVnME.exe
  2⤵
  PID:6068
- C:\Windows\System\TargJUh.exe
  C:\Windows\System\TargJUh.exe
  2⤵
  PID:6084
- C:\Windows\System\BpabBVF.exe
  C:\Windows\System\BpabBVF.exe
  2⤵
  PID:6112
- C:\Windows\System\ejBoznF.exe
  C:\Windows\System\ejBoznF.exe
  2⤵
  PID:6128
- C:\Windows\System\lWqsxuw.exe
  C:\Windows\System\lWqsxuw.exe
  2⤵
  PID:2208
- C:\Windows\System\tJRIZNw.exe
  C:\Windows\System\tJRIZNw.exe
  2⤵
  PID:4984
- C:\Windows\System\iWAklDK.exe
  C:\Windows\System\iWAklDK.exe
  2⤵
  PID:4256
- C:\Windows\System\NiSZriG.exe
  C:\Windows\System\NiSZriG.exe
  2⤵
  PID:1260
- C:\Windows\System\SfOcbTF.exe
  C:\Windows\System\SfOcbTF.exe
  2⤵
  PID:4372
- C:\Windows\System\VpeguQv.exe
  C:\Windows\System\VpeguQv.exe
  2⤵
  PID:3168
- C:\Windows\System\XYPsOmc.exe
  C:\Windows\System\XYPsOmc.exe
  2⤵
  PID:4608
- C:\Windows\System\wMjiBXS.exe
  C:\Windows\System\wMjiBXS.exe
  2⤵
  PID:1656
- C:\Windows\System\tmxJPFm.exe
  C:\Windows\System\tmxJPFm.exe
  2⤵
  PID:1972
- C:\Windows\System\SWUuuwB.exe
  C:\Windows\System\SWUuuwB.exe
  2⤵
  PID:4976
- C:\Windows\System\NEqGKBe.exe
  C:\Windows\System\NEqGKBe.exe
  2⤵
  PID:1888
- C:\Windows\System\lNebduN.exe
  C:\Windows\System\lNebduN.exe
  2⤵
  PID:4568
- C:\Windows\System\qdYKvhU.exe
  C:\Windows\System\qdYKvhU.exe
  2⤵
  PID:5236
- C:\Windows\System\yQzxzZd.exe
  C:\Windows\System\yQzxzZd.exe
  2⤵
  PID:5296
- C:\Windows\System\iqWlhZk.exe
  C:\Windows\System\iqWlhZk.exe
  2⤵
  PID:5392
- C:\Windows\System\BLImRSs.exe
  C:\Windows\System\BLImRSs.exe
  2⤵
  PID:3568
- C:\Windows\System\kEiPjoQ.exe
  C:\Windows\System\kEiPjoQ.exe
  2⤵
  PID:1940
- C:\Windows\System\WfIvblC.exe
  C:\Windows\System\WfIvblC.exe
  2⤵
  PID:4836
- C:\Windows\System\KSZuHOU.exe
  C:\Windows\System\KSZuHOU.exe
  2⤵
  PID:3156
- C:\Windows\System\CrtuAxS.exe
  C:\Windows\System\CrtuAxS.exe
  2⤵
  PID:3976
- C:\Windows\System\PIDRCQI.exe
  C:\Windows\System\PIDRCQI.exe
  2⤵
  PID:6152
- C:\Windows\System\Dewvpks.exe
  C:\Windows\System\Dewvpks.exe
  2⤵
  PID:6168
- C:\Windows\System\Hrmqmle.exe
  C:\Windows\System\Hrmqmle.exe
  2⤵
  PID:6188
- C:\Windows\System\hysGtNt.exe
  C:\Windows\System\hysGtNt.exe
  2⤵
  PID:6204
- C:\Windows\System\yRMcqaX.exe
  C:\Windows\System\yRMcqaX.exe
  2⤵
  PID:6228
- C:\Windows\System\yqwENqC.exe
  C:\Windows\System\yqwENqC.exe
  2⤵
  PID:6244
- C:\Windows\System\qGeenBS.exe
  C:\Windows\System\qGeenBS.exe
  2⤵
  PID:6264
- C:\Windows\System\ubaWipP.exe
  C:\Windows\System\ubaWipP.exe
  2⤵
  PID:6284
- C:\Windows\System\UFWxSLH.exe
  C:\Windows\System\UFWxSLH.exe
  2⤵
  PID:6304
- C:\Windows\System\kGAuWtq.exe
  C:\Windows\System\kGAuWtq.exe
  2⤵
  PID:6452
- C:\Windows\System\qzUEewE.exe
  C:\Windows\System\qzUEewE.exe
  2⤵
  PID:6536
- C:\Windows\System\LiaTHlu.exe
  C:\Windows\System\LiaTHlu.exe
  2⤵
  PID:6552
- C:\Windows\System\RRGocRn.exe
  C:\Windows\System\RRGocRn.exe
  2⤵
  PID:6572
- C:\Windows\System\QqdOkKU.exe
  C:\Windows\System\QqdOkKU.exe
  2⤵
  PID:6592
- C:\Windows\System\BkqjmYu.exe
  C:\Windows\System\BkqjmYu.exe
  2⤵
  PID:6612
- C:\Windows\System\vHsswwz.exe
  C:\Windows\System\vHsswwz.exe
  2⤵
  PID:6628
- C:\Windows\System\oEmmqVu.exe
  C:\Windows\System\oEmmqVu.exe
  2⤵
  PID:6652
- C:\Windows\System\KSGNvXt.exe
  C:\Windows\System\KSGNvXt.exe
  2⤵
  PID:6668
- C:\Windows\System\XKboDIj.exe
  C:\Windows\System\XKboDIj.exe
  2⤵
  PID:6684
- C:\Windows\System\TaPjoOb.exe
  C:\Windows\System\TaPjoOb.exe
  2⤵
  PID:6708
- C:\Windows\System\UTHzGgp.exe
  C:\Windows\System\UTHzGgp.exe
  2⤵
  PID:6724
- C:\Windows\System\WYbqlCU.exe
  C:\Windows\System\WYbqlCU.exe
  2⤵
  PID:6744
- C:\Windows\System\YqLXAuk.exe
  C:\Windows\System\YqLXAuk.exe
  2⤵
  PID:6764
- C:\Windows\System\hufxAjL.exe
  C:\Windows\System\hufxAjL.exe
  2⤵
  PID:6784
- C:\Windows\System\yabXPur.exe
  C:\Windows\System\yabXPur.exe
  2⤵
  PID:6800
- C:\Windows\System\pOqzHih.exe
  C:\Windows\System\pOqzHih.exe
  2⤵
  PID:6824
- C:\Windows\System\dtusjOp.exe
  C:\Windows\System\dtusjOp.exe
  2⤵
  PID:6840
- C:\Windows\System\LhBwqYi.exe
  C:\Windows\System\LhBwqYi.exe
  2⤵
  PID:6864
- C:\Windows\System\ZGEtToZ.exe
  C:\Windows\System\ZGEtToZ.exe
  2⤵
  PID:6880
- C:\Windows\System\OWHyxdm.exe
  C:\Windows\System\OWHyxdm.exe
  2⤵
  PID:6904
- C:\Windows\System\xXbGZmY.exe
  C:\Windows\System\xXbGZmY.exe
  2⤵
  PID:6924
- C:\Windows\System\QEQvPYw.exe
  C:\Windows\System\QEQvPYw.exe
  2⤵
  PID:6944
- C:\Windows\System\DTwuJSB.exe
  C:\Windows\System\DTwuJSB.exe
  2⤵
  PID:6960
- C:\Windows\System\UwBgJSP.exe
  C:\Windows\System\UwBgJSP.exe
  2⤵
  PID:6984
- C:\Windows\System\YCdFyFR.exe
  C:\Windows\System\YCdFyFR.exe
  2⤵
  PID:7004
- C:\Windows\System\XqjhhQM.exe
  C:\Windows\System\XqjhhQM.exe
  2⤵
  PID:7020
- C:\Windows\System\ECGHrRe.exe
  C:\Windows\System\ECGHrRe.exe
  2⤵
  PID:7040
- C:\Windows\System\LYuErBC.exe
  C:\Windows\System\LYuErBC.exe
  2⤵
  PID:7056
- C:\Windows\System\NqAyPcg.exe
  C:\Windows\System\NqAyPcg.exe
  2⤵
  PID:7080
- C:\Windows\System\etzoolm.exe
  C:\Windows\System\etzoolm.exe
  2⤵
  PID:7136
- C:\Windows\System\KCJjapj.exe
  C:\Windows\System\KCJjapj.exe
  2⤵
  PID:7160
- C:\Windows\System\yHbVbGu.exe
  C:\Windows\System\yHbVbGu.exe
  2⤵
  PID:5568
- C:\Windows\System\MUCVOdO.exe
  C:\Windows\System\MUCVOdO.exe
  2⤵
  PID:3356
- C:\Windows\System\ixcurNI.exe
  C:\Windows\System\ixcurNI.exe
  2⤵
  PID:5676
- C:\Windows\System\TUViePp.exe
  C:\Windows\System\TUViePp.exe
  2⤵
  PID:4844
- C:\Windows\System\uLULKrJ.exe
  C:\Windows\System\uLULKrJ.exe
  2⤵
  PID:5216
- C:\Windows\System\zJJtTFD.exe
  C:\Windows\System\zJJtTFD.exe
  2⤵
  PID:5036
- C:\Windows\System\tILVRrl.exe
  C:\Windows\System\tILVRrl.exe
  2⤵
  PID:5408
- C:\Windows\System\gZrEwOL.exe
  C:\Windows\System\gZrEwOL.exe
  2⤵
  PID:3332
- C:\Windows\System\ggpXPFL.exe
  C:\Windows\System\ggpXPFL.exe
  2⤵
  PID:1220
- C:\Windows\System\DQplnMP.exe
  C:\Windows\System\DQplnMP.exe
  2⤵
  PID:3656
- C:\Windows\System\MPyzBLr.exe
  C:\Windows\System\MPyzBLr.exe
  2⤵
  PID:6276
- C:\Windows\System\oWvikOm.exe
  C:\Windows\System\oWvikOm.exe
  2⤵
  PID:6272
- C:\Windows\System\xLOTUUN.exe
  C:\Windows\System\xLOTUUN.exe
  2⤵
  PID:5704
- C:\Windows\System\ssmgHxX.exe
  C:\Windows\System\ssmgHxX.exe
  2⤵
  PID:5744
- C:\Windows\System\HcUBaZB.exe
  C:\Windows\System\HcUBaZB.exe
  2⤵
  PID:4248
- C:\Windows\System\UquMdYS.exe
  C:\Windows\System\UquMdYS.exe
  2⤵
  PID:5148
- C:\Windows\System\HuiwrTx.exe
  C:\Windows\System\HuiwrTx.exe
  2⤵
  PID:5312
- C:\Windows\System\EBqcGHy.exe
  C:\Windows\System\EBqcGHy.exe
  2⤵
  PID:5344
- C:\Windows\System\athXMiy.exe
  C:\Windows\System\athXMiy.exe
  2⤵
  PID:5420
- C:\Windows\System\zHLOXZX.exe
  C:\Windows\System\zHLOXZX.exe
  2⤵
  PID:5480
- C:\Windows\System\fOIjgCU.exe
  C:\Windows\System\fOIjgCU.exe
  2⤵
  PID:7172
- C:\Windows\System\YJnzdhP.exe
  C:\Windows\System\YJnzdhP.exe
  2⤵
  PID:7196
- C:\Windows\System\HKiEfzJ.exe
  C:\Windows\System\HKiEfzJ.exe
  2⤵
  PID:7212
- C:\Windows\System\TMXNAxN.exe
  C:\Windows\System\TMXNAxN.exe
  2⤵
  PID:7236
- C:\Windows\System\SLAReqs.exe
  C:\Windows\System\SLAReqs.exe
  2⤵
  PID:7252
- C:\Windows\System\TIdRKbu.exe
  C:\Windows\System\TIdRKbu.exe
  2⤵
  PID:7280
- C:\Windows\System\dDKxSGA.exe
  C:\Windows\System\dDKxSGA.exe
  2⤵
  PID:7304
- C:\Windows\System\gpMEoFB.exe
  C:\Windows\System\gpMEoFB.exe
  2⤵
  PID:7320
- C:\Windows\System\elYwAKV.exe
  C:\Windows\System\elYwAKV.exe
  2⤵
  PID:7344
- C:\Windows\System\uPBBisK.exe
  C:\Windows\System\uPBBisK.exe
  2⤵
  PID:7360
- C:\Windows\System\pymdCDG.exe
  C:\Windows\System\pymdCDG.exe
  2⤵
  PID:7376
- C:\Windows\System\rcOWmLc.exe
  C:\Windows\System\rcOWmLc.exe
  2⤵
  PID:7396
- C:\Windows\System\ZkURHFM.exe
  C:\Windows\System\ZkURHFM.exe
  2⤵
  PID:7416
- C:\Windows\System\swGibjc.exe
  C:\Windows\System\swGibjc.exe
  2⤵
  PID:7432
- C:\Windows\System\nxgFqcW.exe
  C:\Windows\System\nxgFqcW.exe
  2⤵
  PID:7456
- C:\Windows\System\PubCPKz.exe
  C:\Windows\System\PubCPKz.exe
  2⤵
  PID:7472
- C:\Windows\System\zbYdbJe.exe
  C:\Windows\System\zbYdbJe.exe
  2⤵
  PID:7492
- C:\Windows\System\hEwSTbF.exe
  C:\Windows\System\hEwSTbF.exe
  2⤵
  PID:7508
- C:\Windows\System\ZKeCxTw.exe
  C:\Windows\System\ZKeCxTw.exe
  2⤵
  PID:7528
- C:\Windows\System\nVvHAJY.exe
  C:\Windows\System\nVvHAJY.exe
  2⤵
  PID:7544
- C:\Windows\System\dzobNog.exe
  C:\Windows\System\dzobNog.exe
  2⤵
  PID:7572
- C:\Windows\System\teAfCbr.exe
  C:\Windows\System\teAfCbr.exe
  2⤵
  PID:7588
- C:\Windows\System\rAduImX.exe
  C:\Windows\System\rAduImX.exe
  2⤵
  PID:7612
- C:\Windows\System\ZMSBPzD.exe
  C:\Windows\System\ZMSBPzD.exe
  2⤵
  PID:7628
- C:\Windows\System\ZrvGndT.exe
  C:\Windows\System\ZrvGndT.exe
  2⤵
  PID:7652
- C:\Windows\System\jqOFyKo.exe
  C:\Windows\System\jqOFyKo.exe
  2⤵
  PID:7668
- C:\Windows\System\jMwWTLL.exe
  C:\Windows\System\jMwWTLL.exe
  2⤵
  PID:7692
- C:\Windows\System\ERvYaUA.exe
  C:\Windows\System\ERvYaUA.exe
  2⤵
  PID:7708
- C:\Windows\System\wVugDem.exe
  C:\Windows\System\wVugDem.exe
  2⤵
  PID:7732
- C:\Windows\System\uOvlswV.exe
  C:\Windows\System\uOvlswV.exe
  2⤵
  PID:7752
- C:\Windows\System\VzmOrNh.exe
  C:\Windows\System\VzmOrNh.exe
  2⤵
  PID:7768
- C:\Windows\System\QfcIAJQ.exe
  C:\Windows\System\QfcIAJQ.exe
  2⤵
  PID:7788
- C:\Windows\System\UUeHoQA.exe
  C:\Windows\System\UUeHoQA.exe
  2⤵
  PID:7836
- C:\Windows\System\xTGFzox.exe
  C:\Windows\System\xTGFzox.exe
  2⤵
  PID:7856
- C:\Windows\System\EUuCycd.exe
  C:\Windows\System\EUuCycd.exe
  2⤵
  PID:7872
- C:\Windows\System\IkAClbT.exe
  C:\Windows\System\IkAClbT.exe
  2⤵
  PID:7900
- C:\Windows\System\nVTlTUD.exe
  C:\Windows\System\nVTlTUD.exe
  2⤵
  PID:7916
- C:\Windows\System\ljjAUAC.exe
  C:\Windows\System\ljjAUAC.exe
  2⤵
  PID:7936
- C:\Windows\System\TWCTGUy.exe
  C:\Windows\System\TWCTGUy.exe
  2⤵
  PID:7956
- C:\Windows\System\VqapoRm.exe
  C:\Windows\System\VqapoRm.exe
  2⤵
  PID:7980
- C:\Windows\System\PZFjakv.exe
  C:\Windows\System\PZFjakv.exe
  2⤵
  PID:8000
- C:\Windows\System\ZWhivUQ.exe
  C:\Windows\System\ZWhivUQ.exe
  2⤵
  PID:8020
- C:\Windows\System\FDnKsrd.exe
  C:\Windows\System\FDnKsrd.exe
  2⤵
  PID:8040
- C:\Windows\System\oIXeGAu.exe
  C:\Windows\System\oIXeGAu.exe
  2⤵
  PID:8056
- C:\Windows\System\xuYyUMR.exe
  C:\Windows\System\xuYyUMR.exe
  2⤵
  PID:8084
- C:\Windows\System\iTCxLPx.exe
  C:\Windows\System\iTCxLPx.exe
  2⤵
  PID:8100
- C:\Windows\System\YslRdCI.exe
  C:\Windows\System\YslRdCI.exe
  2⤵
  PID:8124
- C:\Windows\System\RNVUPdd.exe
  C:\Windows\System\RNVUPdd.exe
  2⤵
  PID:8140
- C:\Windows\System\GMDUTDj.exe
  C:\Windows\System\GMDUTDj.exe
  2⤵
  PID:8160
- C:\Windows\System\CmPJwrA.exe
  C:\Windows\System\CmPJwrA.exe
  2⤵
  PID:8188
- C:\Windows\System\hTeREsc.exe
  C:\Windows\System\hTeREsc.exe
  2⤵
  PID:1264
- C:\Windows\System\RGbysni.exe
  C:\Windows\System\RGbysni.exe
  2⤵
  PID:1040
- C:\Windows\System\IhOBTiK.exe
  C:\Windows\System\IhOBTiK.exe
  2⤵
  PID:6312
- C:\Windows\System\VQLUkQA.exe
  C:\Windows\System\VQLUkQA.exe
  2⤵
  PID:6196
- C:\Windows\System\PHeldaR.exe
  C:\Windows\System\PHeldaR.exe
  2⤵
  PID:6040
- C:\Windows\System\bbvdTqW.exe
  C:\Windows\System\bbvdTqW.exe
  2⤵
  PID:6548
- C:\Windows\System\ENIOOpj.exe
  C:\Windows\System\ENIOOpj.exe
  2⤵
  PID:6660
- C:\Windows\System\uDYiWVr.exe
  C:\Windows\System\uDYiWVr.exe
  2⤵
  PID:6720
- C:\Windows\System\JFganUR.exe
  C:\Windows\System\JFganUR.exe
  2⤵
  PID:6796
- C:\Windows\System\lnTjVqS.exe
  C:\Windows\System\lnTjVqS.exe
  2⤵
  PID:4704
- C:\Windows\System\cDvWrul.exe
  C:\Windows\System\cDvWrul.exe
  2⤵
  PID:6940
- C:\Windows\System\YkqMCwh.exe
  C:\Windows\System\YkqMCwh.exe
  2⤵
  PID:7000
- C:\Windows\System\hjBKjga.exe
  C:\Windows\System\hjBKjga.exe
  2⤵
  PID:8196
- C:\Windows\System\OYWhFeS.exe
  C:\Windows\System\OYWhFeS.exe
  2⤵
  PID:8216
- C:\Windows\System\qYLVayf.exe
  C:\Windows\System\qYLVayf.exe
  2⤵
  PID:8236
- C:\Windows\System\qRPHnlF.exe
  C:\Windows\System\qRPHnlF.exe
  2⤵
  PID:8260
- C:\Windows\System\qnkVews.exe
  C:\Windows\System\qnkVews.exe
  2⤵
  PID:8276
- C:\Windows\System\RBjKnLb.exe
  C:\Windows\System\RBjKnLb.exe
  2⤵
  PID:8300
- C:\Windows\System\JKxKFAx.exe
  C:\Windows\System\JKxKFAx.exe
  2⤵
  PID:8316
- C:\Windows\System\BxEZQit.exe
  C:\Windows\System\BxEZQit.exe
  2⤵
  PID:8336
- C:\Windows\System\ldDxbZx.exe
  C:\Windows\System\ldDxbZx.exe
  2⤵
  PID:8352
- C:\Windows\System\kOZXALH.exe
  C:\Windows\System\kOZXALH.exe
  2⤵
  PID:8384
- C:\Windows\System\RhARDIh.exe
  C:\Windows\System\RhARDIh.exe
  2⤵
  PID:8404
- C:\Windows\System\qidgzvl.exe
  C:\Windows\System\qidgzvl.exe
  2⤵
  PID:8432
- C:\Windows\System\ZMdOAKR.exe
  C:\Windows\System\ZMdOAKR.exe
  2⤵
  PID:8456
- C:\Windows\System\ssxryNq.exe
  C:\Windows\System\ssxryNq.exe
  2⤵
  PID:8472
- C:\Windows\System\GgffvmF.exe
  C:\Windows\System\GgffvmF.exe
  2⤵
  PID:8496
- C:\Windows\System\lpEgGFC.exe
  C:\Windows\System\lpEgGFC.exe
  2⤵
  PID:8512
- C:\Windows\System\TsaRySz.exe
  C:\Windows\System\TsaRySz.exe
  2⤵
  PID:8536
- C:\Windows\System\uhTsBsn.exe
  C:\Windows\System\uhTsBsn.exe
  2⤵
  PID:8564
- C:\Windows\System\AseaHiN.exe
  C:\Windows\System\AseaHiN.exe
  2⤵
  PID:8604
- C:\Windows\System\BGDIXXb.exe
  C:\Windows\System\BGDIXXb.exe
  2⤵
  PID:8620
- C:\Windows\System\kDKXYqg.exe
  C:\Windows\System\kDKXYqg.exe
  2⤵
  PID:8636
- C:\Windows\System\dLYtcHU.exe
  C:\Windows\System\dLYtcHU.exe
  2⤵
  PID:8652
- C:\Windows\System\dHAZTVA.exe
  C:\Windows\System\dHAZTVA.exe
  2⤵
  PID:8672
- C:\Windows\System\giKORkF.exe
  C:\Windows\System\giKORkF.exe
  2⤵
  PID:8688
- C:\Windows\System\lpWjJDI.exe
  C:\Windows\System\lpWjJDI.exe
  2⤵
  PID:8872
- C:\Windows\System\ubPGaRo.exe
  C:\Windows\System\ubPGaRo.exe
  2⤵
  PID:8888
- C:\Windows\System\mfufpZo.exe
  C:\Windows\System\mfufpZo.exe
  2⤵
  PID:8904
- C:\Windows\System\ubXLnfk.exe
  C:\Windows\System\ubXLnfk.exe
  2⤵
  PID:8920
- C:\Windows\System\qLXrtWb.exe
  C:\Windows\System\qLXrtWb.exe
  2⤵
  PID:8936
- C:\Windows\System\IZKGFdr.exe
  C:\Windows\System\IZKGFdr.exe
  2⤵
  PID:8952
- C:\Windows\System\wvQMqOs.exe
  C:\Windows\System\wvQMqOs.exe
  2⤵
  PID:8968
- C:\Windows\System\pMVIBYr.exe
  C:\Windows\System\pMVIBYr.exe
  2⤵
  PID:8984
- C:\Windows\System\SJzcVge.exe
  C:\Windows\System\SJzcVge.exe
  2⤵
  PID:9000
- C:\Windows\System\ALWGTRG.exe
  C:\Windows\System\ALWGTRG.exe
  2⤵
  PID:9016
- C:\Windows\System\liCVUVd.exe
  C:\Windows\System\liCVUVd.exe
  2⤵
  PID:9032
- C:\Windows\System\RwOfgpB.exe
  C:\Windows\System\RwOfgpB.exe
  2⤵
  PID:9048
- C:\Windows\System\dvZpIXS.exe
  C:\Windows\System\dvZpIXS.exe
  2⤵
  PID:9064
- C:\Windows\System\LwrkLrG.exe
  C:\Windows\System\LwrkLrG.exe
  2⤵
  PID:9084
- C:\Windows\System\rjHuMio.exe
  C:\Windows\System\rjHuMio.exe
  2⤵
  PID:9108
- C:\Windows\System\hxKpcFV.exe
  C:\Windows\System\hxKpcFV.exe
  2⤵
  PID:9124
- C:\Windows\System\GxqqxCe.exe
  C:\Windows\System\GxqqxCe.exe
  2⤵
  PID:9148
- C:\Windows\System\yUYpISx.exe
  C:\Windows\System\yUYpISx.exe
  2⤵
  PID:9168
- C:\Windows\System\tPKOqGu.exe
  C:\Windows\System\tPKOqGu.exe
  2⤵
  PID:9188
- C:\Windows\System\ZMgMeLH.exe
  C:\Windows\System\ZMgMeLH.exe
  2⤵
  PID:9208
- C:\Windows\System\lAEHsWU.exe
  C:\Windows\System\lAEHsWU.exe
  2⤵
  PID:5872
- C:\Windows\System\dtsSDqX.exe
  C:\Windows\System\dtsSDqX.exe
  2⤵
  PID:5956
- C:\Windows\System\VjDWUeZ.exe
  C:\Windows\System\VjDWUeZ.exe
  2⤵
  PID:7144
- C:\Windows\System\qSZeeQa.exe
  C:\Windows\System\qSZeeQa.exe
  2⤵
  PID:5600
- C:\Windows\System\kbjpqgu.exe
  C:\Windows\System\kbjpqgu.exe
  2⤵
  PID:5404
- C:\Windows\System\YvsVqnI.exe
  C:\Windows\System\YvsVqnI.exe
  2⤵
  PID:4584
- C:\Windows\System\MJlxldn.exe
  C:\Windows\System\MJlxldn.exe
  2⤵
  PID:6080
- C:\Windows\System\ktXRDYI.exe
  C:\Windows\System\ktXRDYI.exe
  2⤵
  PID:2968
- C:\Windows\System\ediUbpG.exe
  C:\Windows\System\ediUbpG.exe
  2⤵
  PID:4856
- C:\Windows\System\MYsxyaz.exe
  C:\Windows\System\MYsxyaz.exe
  2⤵
  PID:4320
- C:\Windows\System\BHZXJPV.exe
  C:\Windows\System\BHZXJPV.exe
  2⤵
  PID:3920
- C:\Windows\System\ycAwdzO.exe
  C:\Windows\System\ycAwdzO.exe
  2⤵
  PID:6184
- C:\Windows\System\VrdYWPO.exe
  C:\Windows\System\VrdYWPO.exe
  2⤵
  PID:6260
- C:\Windows\System\vTZfGHZ.exe
  C:\Windows\System\vTZfGHZ.exe
  2⤵
  PID:1624
- C:\Windows\System\RWWmlVG.exe
  C:\Windows\System\RWWmlVG.exe
  2⤵
  PID:5252
- C:\Windows\System\urbDxWP.exe
  C:\Windows\System\urbDxWP.exe
  2⤵
  PID:2656
- C:\Windows\System\MYFKGcN.exe
  C:\Windows\System\MYFKGcN.exe
  2⤵
  PID:2976
- C:\Windows\System\EJUkwCo.exe
  C:\Windows\System\EJUkwCo.exe
  2⤵
  PID:5780
- C:\Windows\System\aeFYhMA.exe
  C:\Windows\System\aeFYhMA.exe
  2⤵
  PID:5888
- C:\Windows\System\nwRtoLm.exe
  C:\Windows\System\nwRtoLm.exe
  2⤵
  PID:5968
- C:\Windows\System\wFexTAw.exe
  C:\Windows\System\wFexTAw.exe
  2⤵
  PID:6320
- C:\Windows\System\erLmSrw.exe
  C:\Windows\System\erLmSrw.exe
  2⤵
  PID:6336
- C:\Windows\System\AmmjIUx.exe
  C:\Windows\System\AmmjIUx.exe
  2⤵
  PID:6956
- C:\Windows\System\VoMvHxX.exe
  C:\Windows\System\VoMvHxX.exe
  2⤵
  PID:6356
- C:\Windows\System\ZjUmPJu.exe
  C:\Windows\System\ZjUmPJu.exe
  2⤵
  PID:1520
- C:\Windows\System\yWqgPnb.exe
  C:\Windows\System\yWqgPnb.exe
  2⤵
  PID:6428
- C:\Windows\System\BbgSvKV.exe
  C:\Windows\System\BbgSvKV.exe
  2⤵
  PID:6520
- C:\Windows\System\NKquKQA.exe
  C:\Windows\System\NKquKQA.exe
  2⤵
  PID:6624
- C:\Windows\System\rfUDuHf.exe
  C:\Windows\System\rfUDuHf.exe
  2⤵
  PID:8148
- C:\Windows\System\otYOPmw.exe
  C:\Windows\System\otYOPmw.exe
  2⤵
  PID:5728
- C:\Windows\System\rYzXfwT.exe
  C:\Windows\System\rYzXfwT.exe
  2⤵
  PID:6180
- C:\Windows\System\TzPWHvs.exe
  C:\Windows\System\TzPWHvs.exe
  2⤵
  PID:5644
- C:\Windows\System\hrBDwoE.exe
  C:\Windows\System\hrBDwoE.exe
  2⤵
  PID:4536
- C:\Windows\System\oPYafWO.exe
  C:\Windows\System\oPYafWO.exe
  2⤵
  PID:3624
- C:\Windows\System\kmmZOeD.exe
  C:\Windows\System\kmmZOeD.exe
  2⤵
  PID:7032
- C:\Windows\System\QfJkAYF.exe
  C:\Windows\System\QfJkAYF.exe
  2⤵
  PID:6900
- C:\Windows\System\QHDCCqG.exe
  C:\Windows\System\QHDCCqG.exe
  2⤵
  PID:6792
- C:\Windows\System\lToMmyK.exe
  C:\Windows\System\lToMmyK.exe
  2⤵
  PID:5128
- C:\Windows\System\zSgMjqN.exe
  C:\Windows\System\zSgMjqN.exe
  2⤵
  PID:7260
- C:\Windows\System\GKcJezh.exe
  C:\Windows\System\GKcJezh.exe
  2⤵
  PID:7676
- C:\Windows\System\jePfVul.exe
  C:\Windows\System\jePfVul.exe
  2⤵
  PID:7924
- C:\Windows\System\ahQkPve.exe
  C:\Windows\System\ahQkPve.exe
  2⤵
  PID:6968
- C:\Windows\System\ixFGOOu.exe
  C:\Windows\System\ixFGOOu.exe
  2⤵
  PID:8252
- C:\Windows\System\TGTCFEk.exe
  C:\Windows\System\TGTCFEk.exe
  2⤵
  PID:8572
- C:\Windows\System\CbvcKDD.exe
  C:\Windows\System\CbvcKDD.exe
  2⤵
  PID:7228
- C:\Windows\System\xQOezwF.exe
  C:\Windows\System\xQOezwF.exe
  2⤵
  PID:7356
- C:\Windows\System\qDuCMkS.exe
  C:\Windows\System\qDuCMkS.exe
  2⤵
  PID:7412
- C:\Windows\System\iTFMDLU.exe
  C:\Windows\System\iTFMDLU.exe
  2⤵
  PID:7536
- C:\Windows\System\ZiHOJWO.exe
  C:\Windows\System\ZiHOJWO.exe
  2⤵
  PID:7608
- C:\Windows\System\uolhWMY.exe
  C:\Windows\System\uolhWMY.exe
  2⤵
  PID:7664
- C:\Windows\System\wfrXjrN.exe
  C:\Windows\System\wfrXjrN.exe
  2⤵
  PID:7864
- C:\Windows\System\nhCgjeD.exe
  C:\Windows\System\nhCgjeD.exe
  2⤵
  PID:7932
- C:\Windows\System\yzrEnZs.exe
  C:\Windows\System\yzrEnZs.exe
  2⤵
  PID:8032
- C:\Windows\System\ttxbBzN.exe
  C:\Windows\System\ttxbBzN.exe
  2⤵
  PID:8132
- C:\Windows\System\UFRcNrX.exe
  C:\Windows\System\UFRcNrX.exe
  2⤵
  PID:4100
- C:\Windows\System\GEcrLTx.exe
  C:\Windows\System\GEcrLTx.exe
  2⤵
  PID:8208
- C:\Windows\System\KDCbAqO.exe
  C:\Windows\System\KDCbAqO.exe
  2⤵
  PID:8332
- C:\Windows\System\ehOqFUr.exe
  C:\Windows\System\ehOqFUr.exe
  2⤵
  PID:9228
- C:\Windows\System\jnRizRD.exe
  C:\Windows\System\jnRizRD.exe
  2⤵
  PID:9248
- C:\Windows\System\LuwSwEm.exe
  C:\Windows\System\LuwSwEm.exe
  2⤵
  PID:9264
- C:\Windows\System\sVwpryz.exe
  C:\Windows\System\sVwpryz.exe
  2⤵
  PID:9284
- C:\Windows\System\dFkNSDA.exe
  C:\Windows\System\dFkNSDA.exe
  2⤵
  PID:9300
- C:\Windows\System\CBTbHRL.exe
  C:\Windows\System\CBTbHRL.exe
  2⤵
  PID:9320
- C:\Windows\System\GopVrLV.exe
  C:\Windows\System\GopVrLV.exe
  2⤵
  PID:9340
- C:\Windows\System\eWjjhVu.exe
  C:\Windows\System\eWjjhVu.exe
  2⤵
  PID:9360
- C:\Windows\System\IbpEMte.exe
  C:\Windows\System\IbpEMte.exe
  2⤵
  PID:9380
- C:\Windows\System\pWkZatM.exe
  C:\Windows\System\pWkZatM.exe
  2⤵
  PID:9400
- C:\Windows\System\gSMoZSI.exe
  C:\Windows\System\gSMoZSI.exe
  2⤵
  PID:9416
- C:\Windows\System\PyIrhNi.exe
  C:\Windows\System\PyIrhNi.exe
  2⤵
  PID:9436
- C:\Windows\System\AcPdcZA.exe
  C:\Windows\System\AcPdcZA.exe
  2⤵
  PID:9456
- C:\Windows\System\Vfrgclg.exe
  C:\Windows\System\Vfrgclg.exe
  2⤵
  PID:9476
- C:\Windows\System\EWBLBew.exe
  C:\Windows\System\EWBLBew.exe
  2⤵
  PID:9504
- C:\Windows\System\rCpqITc.exe
  C:\Windows\System\rCpqITc.exe
  2⤵
  PID:9520
- C:\Windows\System\eyYEYjx.exe
  C:\Windows\System\eyYEYjx.exe
  2⤵
  PID:9540
- C:\Windows\System\GoBTats.exe
  C:\Windows\System\GoBTats.exe
  2⤵
  PID:9564
- C:\Windows\System\aoRBMXO.exe
  C:\Windows\System\aoRBMXO.exe
  2⤵
  PID:9588
- C:\Windows\System\pTsIsOX.exe
  C:\Windows\System\pTsIsOX.exe
  2⤵
  PID:9608
- C:\Windows\System\vFYVDQM.exe
  C:\Windows\System\vFYVDQM.exe
  2⤵
  PID:9624
- C:\Windows\System\QgzXAjr.exe
  C:\Windows\System\QgzXAjr.exe
  2⤵
  PID:9648
- C:\Windows\System\WqxUSnG.exe
  C:\Windows\System\WqxUSnG.exe
  2⤵
  PID:9672
- C:\Windows\System\sZBBHQg.exe
  C:\Windows\System\sZBBHQg.exe
  2⤵
  PID:9688
- C:\Windows\System\SOpGJgj.exe
  C:\Windows\System\SOpGJgj.exe
  2⤵
  PID:9712
- C:\Windows\System\dTpURjX.exe
  C:\Windows\System\dTpURjX.exe
  2⤵
  PID:9732
- C:\Windows\System\wHQIKop.exe
  C:\Windows\System\wHQIKop.exe
  2⤵
  PID:9756
- C:\Windows\System\kraKwfr.exe
  C:\Windows\System\kraKwfr.exe
  2⤵
  PID:9776
- C:\Windows\System\jQZnFYv.exe
  C:\Windows\System\jQZnFYv.exe
  2⤵
  PID:9796
- C:\Windows\System\VtBzjAg.exe
  C:\Windows\System\VtBzjAg.exe
  2⤵
  PID:9820
- C:\Windows\System\tNThRhJ.exe
  C:\Windows\System\tNThRhJ.exe
  2⤵
  PID:9836
- C:\Windows\System\gUKpHnE.exe
  C:\Windows\System\gUKpHnE.exe
  2⤵
  PID:9860
- C:\Windows\System\yPhzrOR.exe
  C:\Windows\System\yPhzrOR.exe
  2⤵
  PID:9876
- C:\Windows\System\BCoBwhY.exe
  C:\Windows\System\BCoBwhY.exe
  2⤵
  PID:9900
- C:\Windows\System\tXnpQAW.exe
  C:\Windows\System\tXnpQAW.exe
  2⤵
  PID:9916
- C:\Windows\System\YddtZaU.exe
  C:\Windows\System\YddtZaU.exe
  2⤵
  PID:9940
- C:\Windows\System\hjxfZZh.exe
  C:\Windows\System\hjxfZZh.exe
  2⤵
  PID:9964
- C:\Windows\System\fUeqULm.exe
  C:\Windows\System\fUeqULm.exe
  2⤵
  PID:9980
- C:\Windows\System\kmKXZzq.exe
  C:\Windows\System\kmKXZzq.exe
  2⤵
  PID:10004
- C:\Windows\System\ixOPfnO.exe
  C:\Windows\System\ixOPfnO.exe
  2⤵
  PID:10028
- C:\Windows\System\jvKGpAg.exe
  C:\Windows\System\jvKGpAg.exe
  2⤵
  PID:10044
- C:\Windows\System\DnopzDP.exe
  C:\Windows\System\DnopzDP.exe
  2⤵
  PID:10068
- C:\Windows\System\yYKUIaq.exe
  C:\Windows\System\yYKUIaq.exe
  2⤵
  PID:10092
- C:\Windows\System\tegwDcT.exe
  C:\Windows\System\tegwDcT.exe
  2⤵
  PID:10112
- C:\Windows\System\RSrPxUF.exe
  C:\Windows\System\RSrPxUF.exe
  2⤵
  PID:10136
- C:\Windows\System\iIGfITk.exe
  C:\Windows\System\iIGfITk.exe
  2⤵
  PID:10156
- C:\Windows\System\cleJDnz.exe
  C:\Windows\System\cleJDnz.exe
  2⤵
  PID:10176
- C:\Windows\System\XnWvqZM.exe
  C:\Windows\System\XnWvqZM.exe
  2⤵
  PID:10196
- C:\Windows\System\BrnlsZp.exe
  C:\Windows\System\BrnlsZp.exe
  2⤵
  PID:10216
- C:\Windows\System\sBAiJPN.exe
  C:\Windows\System\sBAiJPN.exe
  2⤵
  PID:8448
- C:\Windows\System\gSbgedJ.exe
  C:\Windows\System\gSbgedJ.exe
  2⤵
  PID:8492
- C:\Windows\System\NRIbwBz.exe
  C:\Windows\System\NRIbwBz.exe
  2⤵
  PID:8644
- C:\Windows\System\XjaJHHS.exe
  C:\Windows\System\XjaJHHS.exe
  2⤵
  PID:10264
- C:\Windows\System\pWJZwxq.exe
  C:\Windows\System\pWJZwxq.exe
  2⤵
  PID:10280
- C:\Windows\System\TtRPlAj.exe
  C:\Windows\System\TtRPlAj.exe
  2⤵
  PID:10300
- C:\Windows\System\JepZACC.exe
  C:\Windows\System\JepZACC.exe
  2⤵
  PID:10348
- C:\Windows\System\EArxqRW.exe
  C:\Windows\System\EArxqRW.exe
  2⤵
  PID:10368
- C:\Windows\System\JtEhTXu.exe
  C:\Windows\System\JtEhTXu.exe
  2⤵
  PID:10384
- C:\Windows\System\ALjBhyg.exe
  C:\Windows\System\ALjBhyg.exe
  2⤵
  PID:10404
- C:\Windows\System\UtjieBA.exe
  C:\Windows\System\UtjieBA.exe
  2⤵
  PID:10432
- C:\Windows\System\ehTLWwG.exe
  C:\Windows\System\ehTLWwG.exe
  2⤵
  PID:10456
- C:\Windows\System\enslOAz.exe
  C:\Windows\System\enslOAz.exe
  2⤵
  PID:10476
- C:\Windows\System\wCwvlRs.exe
  C:\Windows\System\wCwvlRs.exe
  2⤵
  PID:10496
- C:\Windows\System\gackzmO.exe
  C:\Windows\System\gackzmO.exe
  2⤵
  PID:10520
- C:\Windows\System\qydCPIW.exe
  C:\Windows\System\qydCPIW.exe
  2⤵
  PID:10540
- C:\Windows\System\TZcZNTf.exe
  C:\Windows\System\TZcZNTf.exe
  2⤵
  PID:10560
- C:\Windows\System\ATdxlJQ.exe
  C:\Windows\System\ATdxlJQ.exe
  2⤵
  PID:10584
- C:\Windows\System\AJPbbVO.exe
  C:\Windows\System\AJPbbVO.exe
  2⤵
  PID:10604
- C:\Windows\System\IgasPQz.exe
  C:\Windows\System\IgasPQz.exe
  2⤵
  PID:10624
- C:\Windows\System\KTYRQyp.exe
  C:\Windows\System\KTYRQyp.exe
  2⤵
  PID:10640
- C:\Windows\System\gCPGnTv.exe
  C:\Windows\System\gCPGnTv.exe
  2⤵
  PID:10664
- C:\Windows\System\HnrGSzc.exe
  C:\Windows\System\HnrGSzc.exe
  2⤵
  PID:10684
- C:\Windows\System\isRambX.exe
  C:\Windows\System\isRambX.exe
  2⤵
  PID:10704
- C:\Windows\System\igiqeoO.exe
  C:\Windows\System\igiqeoO.exe
  2⤵
  PID:10720
- C:\Windows\System\iBrQYvA.exe
  C:\Windows\System\iBrQYvA.exe
  2⤵
  PID:10744
- C:\Windows\System\xGZBMcn.exe
  C:\Windows\System\xGZBMcn.exe
  2⤵
  PID:10764
- C:\Windows\System\UmtEckC.exe
  C:\Windows\System\UmtEckC.exe
  2⤵
  PID:10784
- C:\Windows\System\FMlTPAb.exe
  C:\Windows\System\FMlTPAb.exe
  2⤵
  PID:10800
- C:\Windows\System\gqoBJYr.exe
  C:\Windows\System\gqoBJYr.exe
  2⤵
  PID:10824
- C:\Windows\System\NotqLBi.exe
  C:\Windows\System\NotqLBi.exe
  2⤵
  PID:10840
- C:\Windows\System\DcPRLaB.exe
  C:\Windows\System\DcPRLaB.exe
  2⤵
  PID:10864
- C:\Windows\System\MjyXSSy.exe
  C:\Windows\System\MjyXSSy.exe
  2⤵
  PID:10884
- C:\Windows\System\YAJTHSg.exe
  C:\Windows\System\YAJTHSg.exe
  2⤵
  PID:10904
- C:\Windows\System\YniBPLP.exe
  C:\Windows\System\YniBPLP.exe
  2⤵
  PID:10920
- C:\Windows\System\pWBSCdf.exe
  C:\Windows\System\pWBSCdf.exe
  2⤵
  PID:10940
- C:\Windows\System\OekxUbm.exe
  C:\Windows\System\OekxUbm.exe
  2⤵
  PID:10960
- C:\Windows\System\rvvbRzO.exe
  C:\Windows\System\rvvbRzO.exe
  2⤵
  PID:10988
- C:\Windows\System\NQdXLcv.exe
  C:\Windows\System\NQdXLcv.exe
  2⤵
  PID:11008
- C:\Windows\System\XMNMOoM.exe
  C:\Windows\System\XMNMOoM.exe
  2⤵
  PID:11040
- C:\Windows\System\ECHwFxF.exe
  C:\Windows\System\ECHwFxF.exe
  2⤵
  PID:11056
- C:\Windows\System\gvTDZvZ.exe
  C:\Windows\System\gvTDZvZ.exe
  2⤵
  PID:11080
- C:\Windows\System\gZdAdLM.exe
  C:\Windows\System\gZdAdLM.exe
  2⤵
  PID:11096
- C:\Windows\System\JjNDzxw.exe
  C:\Windows\System\JjNDzxw.exe
  2⤵
  PID:11120
- C:\Windows\System\cwMQyWY.exe
  C:\Windows\System\cwMQyWY.exe
  2⤵
  PID:11140
- C:\Windows\System\RQkqSRC.exe
  C:\Windows\System\RQkqSRC.exe
  2⤵
  PID:11160
- C:\Windows\System\dAJoZgi.exe
  C:\Windows\System\dAJoZgi.exe
  2⤵
  PID:11180
- C:\Windows\System\sMjXQLt.exe
  C:\Windows\System\sMjXQLt.exe
  2⤵
  PID:11196
- C:\Windows\System\eomEnvj.exe
  C:\Windows\System\eomEnvj.exe
  2⤵
  PID:11220
- C:\Windows\System\bZJUjqZ.exe
  C:\Windows\System\bZJUjqZ.exe
  2⤵
  PID:11248
- C:\Windows\System\grJphIt.exe
  C:\Windows\System\grJphIt.exe
  2⤵
  PID:8840
- C:\Windows\System\ifPfNkR.exe
  C:\Windows\System\ifPfNkR.exe
  2⤵
  PID:7204
- C:\Windows\System\aARPRnX.exe
  C:\Windows\System\aARPRnX.exe
  2⤵
  PID:6404
- C:\Windows\System\OswbHnE.exe
  C:\Windows\System\OswbHnE.exe
  2⤵
  PID:3376
- C:\Windows\System\YddKNiw.exe
  C:\Windows\System\YddKNiw.exe
  2⤵
  PID:7328
- C:\Windows\System\QrwrrxL.exe
  C:\Windows\System\QrwrrxL.exe
  2⤵
  PID:6488
- C:\Windows\System\eZnBLrk.exe
  C:\Windows\System\eZnBLrk.exe
  2⤵
  PID:7372
- C:\Windows\System\XSfuMFV.exe
  C:\Windows\System\XSfuMFV.exe
  2⤵
  PID:7428
- C:\Windows\System\stFnYAp.exe
  C:\Windows\System\stFnYAp.exe
  2⤵
  PID:7488
- C:\Windows\System\OEfqPjc.exe
  C:\Windows\System\OEfqPjc.exe
  2⤵
  PID:7580
- C:\Windows\System\LRzYibQ.exe
  C:\Windows\System\LRzYibQ.exe
  2⤵
  PID:7648
- C:\Windows\System\LxKsDrA.exe
  C:\Windows\System\LxKsDrA.exe
  2⤵
  PID:6716
- C:\Windows\System\rDDxFtc.exe
  C:\Windows\System\rDDxFtc.exe
  2⤵
  PID:6860
- C:\Windows\System\vRbatZm.exe
  C:\Windows\System\vRbatZm.exe
  2⤵
  PID:7868
- C:\Windows\System\KjEVCdv.exe
  C:\Windows\System\KjEVCdv.exe
  2⤵
  PID:8016
- C:\Windows\System\AzszXRg.exe
  C:\Windows\System\AzszXRg.exe
  2⤵
  PID:4516
- C:\Windows\System\wPALPJR.exe
  C:\Windows\System\wPALPJR.exe
  2⤵
  PID:8048
- C:\Windows\System\DMTLqum.exe
  C:\Windows\System\DMTLqum.exe
  2⤵
  PID:8156
- C:\Windows\System\vufWJgr.exe
  C:\Windows\System\vufWJgr.exe
  2⤵
  PID:6120
- C:\Windows\System\MhLyOBK.exe
  C:\Windows\System\MhLyOBK.exe
  2⤵
  PID:7220
- C:\Windows\System\uUNCVOg.exe
  C:\Windows\System\uUNCVOg.exe
  2⤵
  PID:7276
- C:\Windows\System\Ykxrcdi.exe
  C:\Windows\System\Ykxrcdi.exe
  2⤵
  PID:6876
- C:\Windows\System\mlOOqwi.exe
  C:\Windows\System\mlOOqwi.exe
  2⤵
  PID:7504
- C:\Windows\System\joAXFML.exe
  C:\Windows\System\joAXFML.exe
  2⤵
  PID:7964
- C:\Windows\System\MbOQqnG.exe
  C:\Windows\System\MbOQqnG.exe
  2⤵
  PID:4148
- C:\Windows\System\MAhqBlI.exe
  C:\Windows\System\MAhqBlI.exe
  2⤵
  PID:8416
- C:\Windows\System\LaKKAnY.exe
  C:\Windows\System\LaKKAnY.exe
  2⤵
  PID:9372
- C:\Windows\System\nKGqhPH.exe
  C:\Windows\System\nKGqhPH.exe
  2⤵
  PID:8648
- C:\Windows\System\GPYJUeJ.exe
  C:\Windows\System\GPYJUeJ.exe
  2⤵
  PID:9512
- C:\Windows\System\mHHiLOC.exe
  C:\Windows\System\mHHiLOC.exe
  2⤵
  PID:11272
- C:\Windows\System\peteKRi.exe
  C:\Windows\System\peteKRi.exe
  2⤵
  PID:11292
- C:\Windows\System\zEaNGAY.exe
  C:\Windows\System\zEaNGAY.exe
  2⤵
  PID:11312
- C:\Windows\System\ntBVfaa.exe
  C:\Windows\System\ntBVfaa.exe
  2⤵
  PID:11328
- C:\Windows\System\HwJCyRN.exe
  C:\Windows\System\HwJCyRN.exe
  2⤵
  PID:11344
- C:\Windows\System\YhlAhOx.exe
  C:\Windows\System\YhlAhOx.exe
  2⤵
  PID:11360
- C:\Windows\System\CTTZdmh.exe
  C:\Windows\System\CTTZdmh.exe
  2⤵
  PID:11380
- C:\Windows\System\VSFRdme.exe
  C:\Windows\System\VSFRdme.exe
  2⤵
  PID:11400
- C:\Windows\System\OuxeFPt.exe
  C:\Windows\System\OuxeFPt.exe
  2⤵
  PID:11420
- C:\Windows\System\UrysNaQ.exe
  C:\Windows\System\UrysNaQ.exe
  2⤵
  PID:11448
- C:\Windows\System\CBxkVRN.exe
  C:\Windows\System\CBxkVRN.exe
  2⤵
  PID:11468
- C:\Windows\System\plNBgKi.exe
  C:\Windows\System\plNBgKi.exe
  2⤵
  PID:11492
- C:\Windows\System\hbEiXyR.exe
  C:\Windows\System\hbEiXyR.exe
  2⤵
  PID:11516
- C:\Windows\System\vimovog.exe
  C:\Windows\System\vimovog.exe
  2⤵
  PID:11536
- C:\Windows\System\MfFOwOy.exe
  C:\Windows\System\MfFOwOy.exe
  2⤵
  PID:11560
- C:\Windows\System\kkufyuf.exe
  C:\Windows\System\kkufyuf.exe
  2⤵
  PID:11596
- C:\Windows\System\yuGHuPX.exe
  C:\Windows\System\yuGHuPX.exe
  2⤵
  PID:11616
- C:\Windows\System\SItSEgM.exe
  C:\Windows\System\SItSEgM.exe
  2⤵
  PID:11640
- C:\Windows\System\RZePibH.exe
  C:\Windows\System\RZePibH.exe
  2⤵
  PID:11668
- C:\Windows\System\ZDgQGOA.exe
  C:\Windows\System\ZDgQGOA.exe
  2⤵
  PID:11688
- C:\Windows\System\GYolsqh.exe
  C:\Windows\System\GYolsqh.exe
  2⤵
  PID:11708
- C:\Windows\System\fUMEFxq.exe
  C:\Windows\System\fUMEFxq.exe
  2⤵
  PID:11728
- C:\Windows\System\VaIRfsI.exe
  C:\Windows\System\VaIRfsI.exe
  2⤵
  PID:11748
- C:\Windows\System\ilMcmUx.exe
  C:\Windows\System\ilMcmUx.exe
  2⤵
  PID:11768
- C:\Windows\System\yGVYsrH.exe
  C:\Windows\System\yGVYsrH.exe
  2⤵
  PID:11800
- C:\Windows\System\ULWjfAT.exe
  C:\Windows\System\ULWjfAT.exe
  2⤵
  PID:11820
- C:\Windows\System\SfpEUsT.exe
  C:\Windows\System\SfpEUsT.exe
  2⤵
  PID:11836
- C:\Windows\System\esBefye.exe
  C:\Windows\System\esBefye.exe
  2⤵
  PID:11860
- C:\Windows\System\fcLasvS.exe
  C:\Windows\System\fcLasvS.exe
  2⤵
  PID:11884
- C:\Windows\System\GSOGnCa.exe
  C:\Windows\System\GSOGnCa.exe
  2⤵
  PID:11904
- C:\Windows\System\ihyPiNX.exe
  C:\Windows\System\ihyPiNX.exe
  2⤵
  PID:11928
- C:\Windows\System\lmiSeWv.exe
  C:\Windows\System\lmiSeWv.exe
  2⤵
  PID:11944
- C:\Windows\System\pxhQWpq.exe
  C:\Windows\System\pxhQWpq.exe
  2⤵
  PID:11968
- C:\Windows\System\YwmFFqe.exe
  C:\Windows\System\YwmFFqe.exe
  2⤵
  PID:12032
- C:\Windows\System\AWednvW.exe
  C:\Windows\System\AWednvW.exe
  2⤵
  PID:12056
- C:\Windows\System\qlBaFPB.exe
  C:\Windows\System\qlBaFPB.exe
  2⤵
  PID:12072
- C:\Windows\System\EVLbbDt.exe
  C:\Windows\System\EVLbbDt.exe
  2⤵
  PID:12096
- C:\Windows\System\TQrMzeO.exe
  C:\Windows\System\TQrMzeO.exe
  2⤵
  PID:12116
- C:\Windows\System\NHGWHGC.exe
  C:\Windows\System\NHGWHGC.exe
  2⤵
  PID:12136
- C:\Windows\System\emWMKBh.exe
  C:\Windows\System\emWMKBh.exe
  2⤵
  PID:12160
- C:\Windows\System\cXiKKwM.exe
  C:\Windows\System\cXiKKwM.exe
  2⤵
  PID:12176
- C:\Windows\System\SKLbiIE.exe
  C:\Windows\System\SKLbiIE.exe
  2⤵
  PID:12200
- C:\Windows\System\mszpkfp.exe
  C:\Windows\System\mszpkfp.exe
  2⤵
  PID:12220
- C:\Windows\System\RNhXrep.exe
  C:\Windows\System\RNhXrep.exe
  2⤵
  PID:12244
- C:\Windows\System\zUpADhe.exe
  C:\Windows\System\zUpADhe.exe
  2⤵
  PID:12264
- C:\Windows\System\qnEJwcx.exe
  C:\Windows\System\qnEJwcx.exe
  2⤵
  PID:12284
- C:\Windows\System\VEIetLp.exe
  C:\Windows\System\VEIetLp.exe
  2⤵
  PID:9728
- C:\Windows\System\UclfWlb.exe
  C:\Windows\System\UclfWlb.exe
  2⤵
  PID:9856
- C:\Windows\System\TXqtbgo.exe
  C:\Windows\System\TXqtbgo.exe
  2⤵
  PID:9912
- C:\Windows\System\ZnCQpaV.exe
  C:\Windows\System\ZnCQpaV.exe
  2⤵
  PID:10052
- C:\Windows\System\mHzfhTE.exe
  C:\Windows\System\mHzfhTE.exe
  2⤵
  PID:10168
- C:\Windows\System\YZAEzoJ.exe
  C:\Windows\System\YZAEzoJ.exe
  2⤵
  PID:10224
- C:\Windows\System\jEXIIFS.exe
  C:\Windows\System\jEXIIFS.exe
  2⤵
  PID:8660
- C:\Windows\System\jKOQGRK.exe
  C:\Windows\System\jKOQGRK.exe
  2⤵
  PID:8868
- C:\Windows\System\araINqJ.exe
  C:\Windows\System\araINqJ.exe
  2⤵
  PID:5328
- C:\Windows\System\nwqXqGP.exe
  C:\Windows\System\nwqXqGP.exe
  2⤵
  PID:6392
- C:\Windows\System\yYTBWSf.exe
  C:\Windows\System\yYTBWSf.exe
  2⤵
  PID:10472
- C:\Windows\System\gTGffJe.exe
  C:\Windows\System\gTGffJe.exe
  2⤵
  PID:10508
- C:\Windows\System\BqMecsE.exe
  C:\Windows\System\BqMecsE.exe
  2⤵
  PID:10536
- C:\Windows\System\EmVXGmd.exe
  C:\Windows\System\EmVXGmd.exe
  2⤵
  PID:10632
- C:\Windows\System\WsilDCd.exe
  C:\Windows\System\WsilDCd.exe
  2⤵
  PID:4052
- C:\Windows\System\SxEBGIz.exe
  C:\Windows\System\SxEBGIz.exe
  2⤵
  PID:5816
- C:\Windows\System\esxcwei.exe
  C:\Windows\System\esxcwei.exe
  2⤵
  PID:10952
- C:\Windows\System\mySYFto.exe
  C:\Windows\System\mySYFto.exe
  2⤵
  PID:6384
- C:\Windows\System\kIJciKM.exe
  C:\Windows\System\kIJciKM.exe
  2⤵
  PID:7928
- C:\Windows\System\XlMQREQ.exe
  C:\Windows\System\XlMQREQ.exe
  2⤵
  PID:11036
- C:\Windows\System\VqzHBeC.exe
  C:\Windows\System\VqzHBeC.exe
  2⤵
  PID:11116
- C:\Windows\System\cajMPEJ.exe
  C:\Windows\System\cajMPEJ.exe
  2⤵
  PID:6676
- C:\Windows\System\PnaTEir.exe
  C:\Windows\System\PnaTEir.exe
  2⤵
  PID:8288
- C:\Windows\System\tndQwUK.exe
  C:\Windows\System\tndQwUK.exe
  2⤵
  PID:9224
- C:\Windows\System\pKRUKGL.exe
  C:\Windows\System\pKRUKGL.exe
  2⤵
  PID:9220
- C:\Windows\System\jDxSLiP.exe
  C:\Windows\System\jDxSLiP.exe
  2⤵
  PID:8108
- C:\Windows\System\tUQvIZN.exe
  C:\Windows\System\tUQvIZN.exe
  2⤵
  PID:9336
- C:\Windows\System\WlLUrRS.exe
  C:\Windows\System\WlLUrRS.exe
  2⤵
  PID:12292
- C:\Windows\System\IhzSauk.exe
  C:\Windows\System\IhzSauk.exe
  2⤵
  PID:12308
- C:\Windows\System\cRplklT.exe
  C:\Windows\System\cRplklT.exe
  2⤵
  PID:12332
- C:\Windows\System\zKZDFgP.exe
  C:\Windows\System\zKZDFgP.exe
  2⤵
  PID:12364
- C:\Windows\System\MIbigvX.exe
  C:\Windows\System\MIbigvX.exe
  2⤵
  PID:12388
- C:\Windows\System\GzYuCpt.exe
  C:\Windows\System\GzYuCpt.exe
  2⤵
  PID:12420
- C:\Windows\System\jnRqXwM.exe
  C:\Windows\System\jnRqXwM.exe
  2⤵
  PID:12440
- C:\Windows\System\QoRPqHe.exe
  C:\Windows\System\QoRPqHe.exe
  2⤵
  PID:12504
- C:\Windows\System\dDeThJu.exe
  C:\Windows\System\dDeThJu.exe
  2⤵
  PID:12684
- C:\Windows\System\NpRLqJI.exe
  C:\Windows\System\NpRLqJI.exe
  2⤵
  PID:12700
- C:\Windows\System\lXaPaHy.exe
  C:\Windows\System\lXaPaHy.exe
  2⤵
  PID:12716
- C:\Windows\System\VYgwFre.exe
  C:\Windows\System\VYgwFre.exe
  2⤵
  PID:12736
- C:\Windows\System\PqUxztg.exe
  C:\Windows\System\PqUxztg.exe
  2⤵
  PID:12752
- C:\Windows\System\zXubUlP.exe
  C:\Windows\System\zXubUlP.exe
  2⤵
  PID:12772
- C:\Windows\System\rpgkgQo.exe
  C:\Windows\System\rpgkgQo.exe
  2⤵
  PID:12788
- C:\Windows\System\YEUhqTP.exe
  C:\Windows\System\YEUhqTP.exe
  2⤵
  PID:12824
- C:\Windows\System\YCfZDnx.exe
  C:\Windows\System\YCfZDnx.exe
  2⤵
  PID:12856
- C:\Windows\System\obTyYcy.exe
  C:\Windows\System\obTyYcy.exe
  2⤵
  PID:12876
- C:\Windows\System\uWfSGnC.exe
  C:\Windows\System\uWfSGnC.exe
  2⤵
  PID:12896
- C:\Windows\System\JkqQfov.exe
  C:\Windows\System\JkqQfov.exe
  2⤵
  PID:12916
- C:\Windows\System\nxEWrIa.exe
  C:\Windows\System\nxEWrIa.exe
  2⤵
  PID:12932
- C:\Windows\System\HUenEdA.exe
  C:\Windows\System\HUenEdA.exe
  2⤵
  PID:12952
- C:\Windows\System\HGUfJME.exe
  C:\Windows\System\HGUfJME.exe
  2⤵
  PID:13040
- C:\Windows\System\UmzXASU.exe
  C:\Windows\System\UmzXASU.exe
  2⤵
  PID:13056
- C:\Windows\System\qRHqCEh.exe
  C:\Windows\System\qRHqCEh.exe
  2⤵
  PID:13076
- C:\Windows\System\bsKXDFA.exe
  C:\Windows\System\bsKXDFA.exe
  2⤵
  PID:13092
- C:\Windows\System\uvtAuVe.exe
  C:\Windows\System\uvtAuVe.exe
  2⤵
  PID:13108
- C:\Windows\System\KsdKRyV.exe
  C:\Windows\System\KsdKRyV.exe
  2⤵
  PID:13124
- C:\Windows\System\rgdDKza.exe
  C:\Windows\System\rgdDKza.exe
  2⤵
  PID:13144
- C:\Windows\System\gBfoNTj.exe
  C:\Windows\System\gBfoNTj.exe
  2⤵
  PID:13164
- C:\Windows\System\hWhxRIO.exe
  C:\Windows\System\hWhxRIO.exe
  2⤵
  PID:13180
- C:\Windows\System\TDoBWlj.exe
  C:\Windows\System\TDoBWlj.exe
  2⤵
  PID:13196
- C:\Windows\System\NFmNWxA.exe
  C:\Windows\System\NFmNWxA.exe
  2⤵
  PID:11112
- C:\Windows\System\JZWsNtu.exe
  C:\Windows\System\JZWsNtu.exe
  2⤵
  PID:4436
- C:\Windows\System\cXuVXui.exe
  C:\Windows\System\cXuVXui.exe
  2⤵
  PID:6636
- C:\Windows\System\CYuxEYL.exe
  C:\Windows\System\CYuxEYL.exe
  2⤵
  PID:6532
- C:\Windows\System\xbgsAbY.exe
  C:\Windows\System\xbgsAbY.exe
  2⤵
  PID:7760
- C:\Windows\System\gQsEqlg.exe
  C:\Windows\System\gQsEqlg.exe
  2⤵
  PID:7028
- C:\Windows\System\mdONLlt.exe
  C:\Windows\System\mdONLlt.exe
  2⤵
  PID:11300
- C:\Windows\System\GewHSwC.exe
  C:\Windows\System\GewHSwC.exe
  2⤵
  PID:11460
- C:\Windows\System\FwGRGmW.exe
  C:\Windows\System\FwGRGmW.exe
  2⤵
  PID:9100
- C:\Windows\System\sUsFEZB.exe
  C:\Windows\System\sUsFEZB.exe
  2⤵
  PID:11624
- C:\Windows\System\JpigmTb.exe
  C:\Windows\System\JpigmTb.exe
  2⤵
  PID:11700
- C:\Windows\System\VEVVArb.exe
  C:\Windows\System\VEVVArb.exe
  2⤵
  PID:11736
- C:\Windows\System\KtgYdEb.exe
  C:\Windows\System\KtgYdEb.exe
  2⤵
  PID:11852
- C:\Windows\System\vAcsXgr.exe
  C:\Windows\System\vAcsXgr.exe
  2⤵
  PID:12000
- C:\Windows\System\aVikHhx.exe
  C:\Windows\System\aVikHhx.exe
  2⤵
  PID:12068
- C:\Windows\System\SSMDDWh.exe
  C:\Windows\System\SSMDDWh.exe
  2⤵
  PID:12216
- C:\Windows\System\yhsCDFZ.exe
  C:\Windows\System\yhsCDFZ.exe
  2⤵
  PID:12260
- C:\Windows\System\EMkaifL.exe
  C:\Windows\System\EMkaifL.exe
  2⤵
  PID:9744
- C:\Windows\System\sBZymMy.exe
  C:\Windows\System\sBZymMy.exe
  2⤵
  PID:9908
- C:\Windows\System\SDWAdJq.exe
  C:\Windows\System\SDWAdJq.exe
  2⤵
  PID:8484
- C:\Windows\System\QsByaNO.exe
  C:\Windows\System\QsByaNO.exe
  2⤵
  PID:10276
- C:\Windows\System\MYFZsDz.exe
  C:\Windows\System\MYFZsDz.exe
  2⤵
  PID:6124
- C:\Windows\System\tIIrLaR.exe
  C:\Windows\System\tIIrLaR.exe
  2⤵
  PID:10976
- C:\Windows\System\OrwinKw.exe
  C:\Windows\System\OrwinKw.exe
  2⤵
  PID:9280
- C:\Windows\System\hBSKpMR.exe
  C:\Windows\System\hBSKpMR.exe
  2⤵
  PID:12324
- C:\Windows\System\HiCWlBS.exe
  C:\Windows\System\HiCWlBS.exe
  2⤵
  PID:12976
- C:\Windows\System\HctgDew.exe
  C:\Windows\System\HctgDew.exe
  2⤵
  PID:10848
- C:\Windows\System\cLABSqM.exe
  C:\Windows\System\cLABSqM.exe
  2⤵
  PID:13052
- C:\Windows\System\sNFrijb.exe
  C:\Windows\System\sNFrijb.exe
  2⤵
  PID:13100
- C:\Windows\System\bDETuIF.exe
  C:\Windows\System\bDETuIF.exe
  2⤵
  PID:13132
- C:\Windows\System\PQxtHnG.exe
  C:\Windows\System\PQxtHnG.exe
  2⤵
  PID:13172
- C:\Windows\System\sULfgIl.exe
  C:\Windows\System\sULfgIl.exe
  2⤵
  PID:13204
- C:\Windows\System\lBvynUA.exe
  C:\Windows\System\lBvynUA.exe
  2⤵
  PID:13224
- C:\Windows\System\wPmiMZT.exe
  C:\Windows\System\wPmiMZT.exe
  2⤵
  PID:13240
- C:\Windows\System\hbvqxXw.exe
  C:\Windows\System\hbvqxXw.exe
  2⤵
  PID:13256
- C:\Windows\System\OCCoFJV.exe
  C:\Windows\System\OCCoFJV.exe
  2⤵
  PID:13272
- C:\Windows\System\dZBrecK.exe
  C:\Windows\System\dZBrecK.exe
  2⤵
  PID:13288
- C:\Windows\System\zUbbuxE.exe
  C:\Windows\System\zUbbuxE.exe
  2⤵
  PID:13304
- C:\Windows\System\DLtDDFh.exe
  C:\Windows\System\DLtDDFh.exe
  2⤵
  PID:9392
- C:\Windows\System\jdsLZUT.exe
  C:\Windows\System\jdsLZUT.exe
  2⤵
  PID:9412
- C:\Windows\System\WnYfgHh.exe
  C:\Windows\System\WnYfgHh.exe
  2⤵
  PID:8684
- C:\Windows\System\smJLFoG.exe
  C:\Windows\System\smJLFoG.exe
  2⤵
  PID:9660
- C:\Windows\System\cQOBpdI.exe
  C:\Windows\System\cQOBpdI.exe
  2⤵
  PID:11524
- C:\Windows\System\ZuCaiXU.exe
  C:\Windows\System\ZuCaiXU.exe
  2⤵
  PID:10124
- C:\Windows\System\rZDEHXP.exe
  C:\Windows\System\rZDEHXP.exe
  2⤵
  PID:10192
- C:\Windows\System\ZAmELpE.exe
  C:\Windows\System\ZAmELpE.exe
  2⤵
  PID:11956
- C:\Windows\System\URsuxDt.exe
  C:\Windows\System\URsuxDt.exe
  2⤵
  PID:9044
- C:\Windows\System\kKxrmkR.exe
  C:\Windows\System\kKxrmkR.exe
  2⤵
  PID:9080
- C:\Windows\System\btSEKCe.exe
  C:\Windows\System\btSEKCe.exe
  2⤵
  PID:9200
- C:\Windows\System\KAPKJWf.exe
  C:\Windows\System\KAPKJWf.exe
  2⤵
  PID:10504
- C:\Windows\System\SkczMSz.exe
  C:\Windows\System\SkczMSz.exe
  2⤵
  PID:4496
- C:\Windows\System\NZKrVhg.exe
  C:\Windows\System\NZKrVhg.exe
  2⤵
  PID:4364
- C:\Windows\System\ZaEnhTs.exe
  C:\Windows\System\ZaEnhTs.exe
  2⤵
  PID:1696
- C:\Windows\System\fnHcMIK.exe
  C:\Windows\System\fnHcMIK.exe
  2⤵
  PID:10696
- C:\Windows\System\mhNlPDk.exe
  C:\Windows\System\mhNlPDk.exe
  2⤵
  PID:2884
- C:\Windows\System\kFShNzy.exe
  C:\Windows\System\kFShNzy.exe
  2⤵
  PID:10936
- C:\Windows\System\luBgvcm.exe
  C:\Windows\System\luBgvcm.exe
  2⤵
  PID:4344
- C:\Windows\System\cIafKVJ.exe
  C:\Windows\System\cIafKVJ.exe
  2⤵
  PID:11396
- C:\Windows\System\SMfWHLt.exe
  C:\Windows\System\SMfWHLt.exe
  2⤵
  PID:10892
- C:\Windows\System\uZwUeVl.exe
  C:\Windows\System\uZwUeVl.exe
  2⤵
  PID:7908
- C:\Windows\System\tVxSNnK.exe
  C:\Windows\System\tVxSNnK.exe
  2⤵
  PID:13000
- C:\Windows\System\lEyaOjT.exe
  C:\Windows\System\lEyaOjT.exe
  2⤵
  PID:8948
- C:\Windows\System\PrYBDgQ.exe
  C:\Windows\System\PrYBDgQ.exe
  2⤵
  PID:7244
- C:\Windows\System\DqqAxGI.exe
  C:\Windows\System\DqqAxGI.exe
  2⤵
  PID:8836
- C:\Windows\System\bFDUeDe.exe
  C:\Windows\System\bFDUeDe.exe
  2⤵
  PID:11228
- C:\Windows\System\WhTkOGI.exe
  C:\Windows\System\WhTkOGI.exe
  2⤵
  PID:10012
- C:\Windows\System\YhzPnYx.exe
  C:\Windows\System\YhzPnYx.exe
  2⤵
  PID:11652
- C:\Windows\System\KwrxoFg.exe
  C:\Windows\System\KwrxoFg.exe
  2⤵
  PID:11848
- C:\Windows\System\pHZXzmF.exe
  C:\Windows\System\pHZXzmF.exe
  2⤵
  PID:11788
- C:\Windows\System\pkAZYbu.exe
  C:\Windows\System\pkAZYbu.exe
  2⤵
  PID:10440
- C:\Windows\System\ILNRzUA.exe
  C:\Windows\System\ILNRzUA.exe
  2⤵
  PID:12208
- C:\Windows\System\JkeMadJ.exe
  C:\Windows\System\JkeMadJ.exe
  2⤵
  PID:9872
- C:\Windows\System\CnZOsIH.exe
  C:\Windows\System\CnZOsIH.exe
  2⤵
  PID:10184
- C:\Windows\System\nrBbFBC.exe
  C:\Windows\System\nrBbFBC.exe
  2⤵
  PID:10968
- C:\Windows\System\EJdfimX.exe
  C:\Windows\System\EJdfimX.exe
  2⤵
  PID:3696
- C:\Windows\System\zbZQYhx.exe
  C:\Windows\System\zbZQYhx.exe
  2⤵
  PID:13332
- C:\Windows\System\xjRaCFQ.exe
  C:\Windows\System\xjRaCFQ.exe
  2⤵
  PID:13544
- C:\Windows\System\IbaZOYe.exe
  C:\Windows\System\IbaZOYe.exe
  2⤵
  PID:13560
- C:\Windows\System\lFtfJcw.exe
  C:\Windows\System\lFtfJcw.exe
  2⤵
  PID:13576
- C:\Windows\System\vgZaTwb.exe
  C:\Windows\System\vgZaTwb.exe
  2⤵
  PID:13592
- C:\Windows\System\iSqMHBx.exe
  C:\Windows\System\iSqMHBx.exe
  2⤵
  PID:13788
- C:\Windows\System\CWiPMhX.exe
  C:\Windows\System\CWiPMhX.exe
  2⤵
  PID:13804
- C:\Windows\System\cMPZBBz.exe
  C:\Windows\System\cMPZBBz.exe
  2⤵
  PID:13820
- C:\Windows\System\RvkrluF.exe
  C:\Windows\System\RvkrluF.exe
  2⤵
  PID:13836
- C:\Windows\System\ibzZKUf.exe
  C:\Windows\System\ibzZKUf.exe
  2⤵
  PID:13852
- C:\Windows\System\muyqAvr.exe
  C:\Windows\System\muyqAvr.exe
  2⤵
  PID:13868
- C:\Windows\System\fkfbZFf.exe
  C:\Windows\System\fkfbZFf.exe
  2⤵
  PID:13884
- C:\Windows\System\szuotxv.exe
  C:\Windows\System\szuotxv.exe
  2⤵
  PID:13900
- C:\Windows\System\UUZnzKt.exe
  C:\Windows\System\UUZnzKt.exe
  2⤵
  PID:13916
- C:\Windows\System\FGLeoYj.exe
  C:\Windows\System\FGLeoYj.exe
  2⤵
  PID:13932
- C:\Windows\System\IGNtxzr.exe
  C:\Windows\System\IGNtxzr.exe
  2⤵
  PID:13948
- C:\Windows\System\oYlhSut.exe
  C:\Windows\System\oYlhSut.exe
  2⤵
  PID:13964
- C:\Windows\System\REVcUCB.exe
  C:\Windows\System\REVcUCB.exe
  2⤵
  PID:13980
- C:\Windows\System\xxjwHiu.exe
  C:\Windows\System\xxjwHiu.exe
  2⤵
  PID:13996
- C:\Windows\System\IaZygvA.exe
  C:\Windows\System\IaZygvA.exe
  2⤵
  PID:14012
- C:\Windows\System\DfFCxXb.exe
  C:\Windows\System\DfFCxXb.exe
  2⤵
  PID:14028
- C:\Windows\System\BoLWGRL.exe
  C:\Windows\System\BoLWGRL.exe
  2⤵
  PID:14044
- C:\Windows\System\zZYaqzX.exe
  C:\Windows\System\zZYaqzX.exe
  2⤵
  PID:14060
- C:\Windows\System\ZYzfgbB.exe
  C:\Windows\System\ZYzfgbB.exe
  2⤵
  PID:14076
- C:\Windows\System\jWyknxT.exe
  C:\Windows\System\jWyknxT.exe
  2⤵
  PID:14100
- C:\Windows\System\aPswKZu.exe
  C:\Windows\System\aPswKZu.exe
  2⤵
  PID:14124
- C:\Windows\System\uACewwI.exe
  C:\Windows\System\uACewwI.exe
  2⤵
  PID:14152
- C:\Windows\System\oKPpQaB.exe
  C:\Windows\System\oKPpQaB.exe
  2⤵
  PID:14172
- C:\Windows\System\lzMJibG.exe
  C:\Windows\System\lzMJibG.exe
  2⤵
  PID:14196
- C:\Windows\System\TmnFzjK.exe
  C:\Windows\System\TmnFzjK.exe
  2⤵
  PID:14220
- C:\Windows\System\bsUCgpA.exe
  C:\Windows\System\bsUCgpA.exe
  2⤵
  PID:14244
- C:\Windows\System\jwYLPaj.exe
  C:\Windows\System\jwYLPaj.exe
  2⤵
  PID:14268
- C:\Windows\System\DubwhOP.exe
  C:\Windows\System\DubwhOP.exe
  2⤵
  PID:14292
- C:\Windows\System\oQVkCRH.exe
  C:\Windows\System\oQVkCRH.exe
  2⤵
  PID:14312
- C:\Windows\System\vwbTavk.exe
  C:\Windows\System\vwbTavk.exe
  2⤵
  PID:14332
- C:\Windows\System\VLtBSgE.exe
  C:\Windows\System\VLtBSgE.exe
  2⤵
  PID:11548
- C:\Windows\System\jbarniV.exe
  C:\Windows\System\jbarniV.exe
  2⤵
  PID:12904
- C:\Windows\System\lCIcJEl.exe
  C:\Windows\System\lCIcJEl.exe
  2⤵
  PID:10396
- C:\Windows\System\IQmrqFK.exe
  C:\Windows\System\IQmrqFK.exe
  2⤵
  PID:10872
- C:\Windows\System\irjXsgp.exe
  C:\Windows\System\irjXsgp.exe
  2⤵
  PID:8
- C:\Windows\System\RzKUcIn.exe
  C:\Windows\System\RzKUcIn.exe
  2⤵
  PID:8880
- C:\Windows\System\jugkmJb.exe
  C:\Windows\System\jugkmJb.exe
  2⤵
  PID:8960
- C:\Windows\System\EiTwarn.exe
  C:\Windows\System\EiTwarn.exe
  2⤵
  PID:7316
- C:\Windows\System\FsfibCO.exe
  C:\Windows\System\FsfibCO.exe
  2⤵
  PID:12608
- C:\Windows\System\LlknWrW.exe
  C:\Windows\System\LlknWrW.exe
  2⤵
  PID:8992
- C:\Windows\System\eEiFKtF.exe
  C:\Windows\System\eEiFKtF.exe
  2⤵
  PID:12384
- C:\Windows\System\XSTgluP.exe
  C:\Windows\System\XSTgluP.exe
  2⤵
  PID:12480
- C:\Windows\System\ApHGRei.exe
  C:\Windows\System\ApHGRei.exe
  2⤵
  PID:11816
- C:\Windows\System\hLQbRQC.exe
  C:\Windows\System\hLQbRQC.exe
  2⤵
  PID:13388
- C:\Windows\System\AUnlnRI.exe
  C:\Windows\System\AUnlnRI.exe
  2⤵
  PID:13416
- C:\Windows\System\axYLUTh.exe
  C:\Windows\System\axYLUTh.exe
  2⤵
  PID:5764
- C:\Windows\System\TgnsvsP.exe
  C:\Windows\System\TgnsvsP.exe
  2⤵
  PID:11136
- C:\Windows\System\aKhHWqa.exe
  C:\Windows\System\aKhHWqa.exe
  2⤵
  PID:11208
- C:\Windows\System\sEWsqkk.exe
  C:\Windows\System\sEWsqkk.exe
  2⤵
  PID:13192
- C:\Windows\System\fcJfynQ.exe
  C:\Windows\System\fcJfynQ.exe
  2⤵
  PID:13296
- C:\Windows\System\wvJHnPn.exe
  C:\Windows\System\wvJHnPn.exe
  2⤵
  PID:4588
- C:\Windows\System\mdIEgwu.exe
  C:\Windows\System\mdIEgwu.exe
  2⤵
  PID:13512
- C:\Windows\System\PVRVhym.exe
  C:\Windows\System\PVRVhym.exe
  2⤵
  PID:11416
- C:\Windows\System\AFqOAVC.exe
  C:\Windows\System\AFqOAVC.exe
  2⤵
  PID:9096
- C:\Windows\System\VuLMyET.exe
  C:\Windows\System\VuLMyET.exe
  2⤵
  PID:9028
- C:\Windows\System\JSVleUG.exe
  C:\Windows\System\JSVleUG.exe
  2⤵
  PID:4756
- C:\Windows\System\npGlmIH.exe
  C:\Windows\System\npGlmIH.exe
  2⤵
  PID:4684
- C:\Windows\System\dNCdjfg.exe
  C:\Windows\System\dNCdjfg.exe
  2⤵
  PID:13536
- C:\Windows\System\rBcFmwk.exe
  C:\Windows\System\rBcFmwk.exe
  2⤵
  PID:13556
- C:\Windows\System\IsxKHMn.exe
  C:\Windows\System\IsxKHMn.exe
  2⤵
  PID:13600
- C:\Windows\System\GuMLgvM.exe
  C:\Windows\System\GuMLgvM.exe
  2⤵
  PID:10108
- C:\Windows\System\InTBdma.exe
  C:\Windows\System\InTBdma.exe
  2⤵
  PID:13832
- C:\Windows\System\NzvXMpR.exe
  C:\Windows\System\NzvXMpR.exe
  2⤵
  PID:13876
- C:\Windows\System\JrdxrlW.exe
  C:\Windows\System\JrdxrlW.exe
  2⤵
  PID:13908
- C:\Windows\System\GVXrOIz.exe
  C:\Windows\System\GVXrOIz.exe
  2⤵
  PID:7728
- C:\Windows\System\qSHAiNo.exe
  C:\Windows\System\qSHAiNo.exe
  2⤵
  PID:5844
- C:\Windows\System\VSHuGsP.exe
  C:\Windows\System\VSHuGsP.exe
  2⤵
  PID:12588
- C:\Windows\System\xJFnTeY.exe
  C:\Windows\System\xJFnTeY.exe
  2⤵
  PID:13472
- C:\Windows\System\WZDZpRe.exe
  C:\Windows\System\WZDZpRe.exe
  2⤵
  PID:13496
- C:\Windows\System\mxmUfWg.exe
  C:\Windows\System\mxmUfWg.exe
  2⤵
  PID:8680
- C:\Windows\System\txuNwFV.exe
  C:\Windows\System\txuNwFV.exe
  2⤵
  PID:11368
- C:\Windows\System\pnBrYNq.exe
  C:\Windows\System\pnBrYNq.exe
  2⤵
  PID:11720
- C:\Windows\System\ijviJED.exe
  C:\Windows\System\ijviJED.exe
  2⤵
  PID:10700
- C:\Windows\System\dTkkflp.exe
  C:\Windows\System\dTkkflp.exe
  2⤵
  PID:9008
- C:\Windows\System\iAPwUsJ.exe
  C:\Windows\System\iAPwUsJ.exe
  2⤵
  PID:12636
- C:\Windows\System\EqhClmO.exe
  C:\Windows\System\EqhClmO.exe
  2⤵
  PID:13024
- C:\Windows\System\jqqDCIU.exe
  C:\Windows\System\jqqDCIU.exe
  2⤵
  PID:12464
- C:\Windows\System\RtZkzzn.exe
  C:\Windows\System\RtZkzzn.exe
  2⤵
  PID:13320
- C:\Windows\System\bLSNZdg.exe
  C:\Windows\System\bLSNZdg.exe
  2⤵
  PID:11048
- C:\Windows\System\dJMwPhB.exe
  C:\Windows\System\dJMwPhB.exe
  2⤵
  PID:8584
- C:\Windows\System\bLhqGgY.exe
  C:\Windows\System\bLhqGgY.exe
  2⤵
  PID:8272
- C:\Windows\System\VIIMshy.exe
  C:\Windows\System\VIIMshy.exe
  2⤵
  PID:3096
- C:\Windows\System\KXmldkd.exe
  C:\Windows\System\KXmldkd.exe
  2⤵
  PID:13588
- C:\Windows\System\JoesdWI.exe
  C:\Windows\System\JoesdWI.exe
  2⤵
  PID:3348
- C:\Windows\System\xpzknQX.exe
  C:\Windows\System\xpzknQX.exe
  2⤵
  PID:11828
- C:\Windows\System\fRzGWmj.exe
  C:\Windows\System\fRzGWmj.exe
  2⤵
  PID:13156
- C:\Windows\System\MDDqojF.exe
  C:\Windows\System\MDDqojF.exe
  2⤵
  PID:12908
- C:\Windows\System\PZIPlVx.exe
  C:\Windows\System\PZIPlVx.exe
  2⤵
  PID:10420
- C:\Windows\System\CehZDhB.exe
  C:\Windows\System\CehZDhB.exe
  2⤵
  PID:13412
- C:\Windows\System\ogcumth.exe
  C:\Windows\System\ogcumth.exe
  2⤵
  PID:2644
- C:\Windows\System\aHjWOwQ.exe
  C:\Windows\System\aHjWOwQ.exe
  2⤵
  PID:3180
- C:\Windows\System\WqAKNcW.exe
  C:\Windows\System\WqAKNcW.exe
  2⤵
  PID:13776
- C:\Windows\System\QQHFNgQ.exe
  C:\Windows\System\QQHFNgQ.exe
  2⤵
  PID:6148
- C:\Windows\System\DjbfIuY.exe
  C:\Windows\System\DjbfIuY.exe
  2⤵
  PID:10576
- C:\Windows\System\lnBFGVI.exe
  C:\Windows\System\lnBFGVI.exe
  2⤵
  PID:14772
- C:\Windows\System\iImFCFn.exe
  C:\Windows\System\iImFCFn.exe
  2⤵
  PID:14788
- C:\Windows\System\kvkxhGn.exe
  C:\Windows\System\kvkxhGn.exe
  2⤵
  PID:14808
- C:\Windows\System\VwTlmTT.exe
  C:\Windows\System\VwTlmTT.exe
  2⤵
  PID:14832
- C:\Windows\System\WysDcki.exe
  C:\Windows\System\WysDcki.exe
  2⤵
  PID:14944
- C:\Windows\System\nrieJwd.exe
  C:\Windows\System\nrieJwd.exe
  2⤵
  PID:14976
- C:\Windows\System\EsObOWm.exe
  C:\Windows\System\EsObOWm.exe
  2⤵
  PID:15008
- C:\Windows\System\gczzNUO.exe
  C:\Windows\System\gczzNUO.exe
  2⤵
  PID:15076
- C:\Windows\System\BsEcnbt.exe
  C:\Windows\System\BsEcnbt.exe
  2⤵
  PID:15092
- C:\Windows\System\ziMJNip.exe
  C:\Windows\System\ziMJNip.exe
  2⤵
  PID:15112
- C:\Windows\System\fDsokLw.exe
  C:\Windows\System\fDsokLw.exe
  2⤵
  PID:15128
- C:\Windows\System\brISdfZ.exe
  C:\Windows\System\brISdfZ.exe
  2⤵
  PID:15144
- C:\Windows\System\RLGlFWG.exe
  C:\Windows\System\RLGlFWG.exe
  2⤵
  PID:15200
- C:\Windows\System\UqLlEHz.exe
  C:\Windows\System\UqLlEHz.exe
  2⤵
  PID:14108
- C:\Windows\System\DgpPZYw.exe
  C:\Windows\System\DgpPZYw.exe
  2⤵
  PID:14208
- C:\Windows\System\fMVikmh.exe
  C:\Windows\System\fMVikmh.exe
  2⤵
  PID:14488
- C:\Windows\System\CHhDfck.exe
  C:\Windows\System\CHhDfck.exe
  2⤵
  PID:4464
- C:\Windows\System\CLXSKyE.exe
  C:\Windows\System\CLXSKyE.exe
  2⤵
  PID:14140
- C:\Windows\System\nhmsLrP.exe
  C:\Windows\System\nhmsLrP.exe
  2⤵
  PID:14024
- C:\Windows\System\YwpubtY.exe
  C:\Windows\System\YwpubtY.exe
  2⤵
  PID:14040
- C:\Windows\System\EzJRFDv.exe
  C:\Windows\System\EzJRFDv.exe
  2⤵
  PID:14360
- C:\Windows\System\VIwjzyu.exe
  C:\Windows\System\VIwjzyu.exe
  2⤵
  PID:14420
- C:\Windows\System\oDqjnGb.exe
  C:\Windows\System\oDqjnGb.exe
  2⤵
  PID:13344
- C:\Windows\System\SgcLjZX.exe
  C:\Windows\System\SgcLjZX.exe
  2⤵
  PID:14544
- C:\Windows\System\XvERsqJ.exe
  C:\Windows\System\XvERsqJ.exe
  2⤵
  PID:14736
- C:\Windows\System\QYmWcWX.exe
  C:\Windows\System\QYmWcWX.exe
  2⤵
  PID:14816
- C:\Windows\System\XgUdAqM.exe
  C:\Windows\System\XgUdAqM.exe
  2⤵
  PID:14848
- C:\Windows\System\FUbUMyy.exe
  C:\Windows\System\FUbUMyy.exe
  2⤵
  PID:14916
- C:\Windows\System\bsBMucs.exe
  C:\Windows\System\bsBMucs.exe
  2⤵
  PID:15136
- C:\Windows\System\aGahSPV.exe
  C:\Windows\System\aGahSPV.exe
  2⤵
  PID:15184
- C:\Windows\System\DEXDQsg.exe
  C:\Windows\System\DEXDQsg.exe
  2⤵
  PID:14844
- C:\Windows\System\fqLckQj.exe
  C:\Windows\System\fqLckQj.exe
  2⤵
  PID:14888
- C:\Windows\System\SwxGlvB.exe
  C:\Windows\System\SwxGlvB.exe
  2⤵
  PID:14940
- C:\Windows\System\rEqsYhD.exe
  C:\Windows\System\rEqsYhD.exe
  2⤵
  PID:15268
- C:\Windows\System\AKAHQIU.exe
  C:\Windows\System\AKAHQIU.exe
  2⤵
  PID:5912
- C:\Windows\System\vfLahoz.exe
  C:\Windows\System\vfLahoz.exe
  2⤵
  PID:14456
- C:\Windows\System\bORyIEV.exe
  C:\Windows\System\bORyIEV.exe
  2⤵
  PID:3780
- C:\Windows\System\xXqqHRJ.exe
  C:\Windows\System\xXqqHRJ.exe
  2⤵
  PID:14416
- C:\Windows\System\LjfszDP.exe
  C:\Windows\System\LjfszDP.exe
  2⤵
  PID:14908
- C:\Windows\System\yigWmpi.exe
  C:\Windows\System\yigWmpi.exe
  2⤵
  PID:14828
- C:\Windows\System\mYIqNSf.exe
  C:\Windows\System\mYIqNSf.exe
  2⤵
  PID:14384
- C:\Windows\System\EZvKjOO.exe
  C:\Windows\System\EZvKjOO.exe
  2⤵
  PID:15220
- C:\Windows\System\Cihzytx.exe
  C:\Windows\System\Cihzytx.exe
  2⤵
  PID:14760
- C:\Windows\System\naluuRR.exe
  C:\Windows\System\naluuRR.exe
  2⤵
  PID:1460
- C:\Windows\System\bYuoduV.exe
  C:\Windows\System\bYuoduV.exe
  2⤵
  PID:9644
- C:\Windows\System\QCwuKze.exe
  C:\Windows\System\QCwuKze.exe
  2⤵
  PID:12252
- C:\Windows\System\sSTMPNP.exe
  C:\Windows\System\sSTMPNP.exe
  2⤵
  PID:6448
- C:\Windows\System\WEBKAIE.exe
  C:\Windows\System\WEBKAIE.exe
  2⤵
  PID:13352
- C:\Windows\System\AfRcUCt.exe
  C:\Windows\System\AfRcUCt.exe
  2⤵
  PID:13264
- C:\Windows\System\zVRdOlM.exe
  C:\Windows\System\zVRdOlM.exe
  2⤵
  PID:13628
- C:\Windows\System\xseBsqi.exe
  C:\Windows\System\xseBsqi.exe
  2⤵
  PID:4500
- C:\Windows\System\SPWoYlm.exe
  C:\Windows\System\SPWoYlm.exe
  2⤵
  PID:11916
- C:\Windows\System\THgFRft.exe
  C:\Windows\System\THgFRft.exe
  2⤵
  PID:2040
- C:\Windows\System\lKtlvaK.exe
  C:\Windows\System\lKtlvaK.exe
  2⤵
  PID:13676
- C:\Windows\System\AVLYuxS.exe
  C:\Windows\System\AVLYuxS.exe
  2⤵
  PID:732
- C:\Windows\System\WAuNlhE.exe
  C:\Windows\System\WAuNlhE.exe
  2⤵
  PID:10880
- C:\Windows\System\SGUNdTf.exe
  C:\Windows\System\SGUNdTf.exe
  2⤵
  PID:13880
- C:\Windows\System\HeqPNiB.exe
  C:\Windows\System\HeqPNiB.exe
  2⤵
  PID:11212
- C:\Windows\System\JwOlFJw.exe
  C:\Windows\System\JwOlFJw.exe
  2⤵
  PID:6780
- C:\Windows\System\wcwWrak.exe
  C:\Windows\System\wcwWrak.exe
  2⤵
  PID:4564
- C:\Windows\System\KdUebgo.exe
  C:\Windows\System\KdUebgo.exe
  2⤵
  PID:14756
- C:\Windows\System\VYIImNw.exe
  C:\Windows\System\VYIImNw.exe
  2⤵
  PID:15324
- C:\Windows\System\ZrxJPYP.exe
  C:\Windows\System\ZrxJPYP.exe
  2⤵
  PID:15192
- C:\Windows\System\wLauBNw.exe
  C:\Windows\System\wLauBNw.exe
  2⤵
  PID:9536
- C:\Windows\System\cSGINFv.exe
  C:\Windows\System\cSGINFv.exe
  2⤵
  PID:12696
- C:\Windows\System\gHKoOZF.exe
  C:\Windows\System\gHKoOZF.exe
  2⤵
  PID:12596
- C:\Windows\System\JXQPoJG.exe
  C:\Windows\System\JXQPoJG.exe
  2⤵
  PID:13084
- C:\Windows\System\yvzIuBW.exe
  C:\Windows\System\yvzIuBW.exe
  2⤵
  PID:1840
- C:\Windows\System\nsKXsNE.exe
  C:\Windows\System\nsKXsNE.exe
  2⤵
  PID:12992
- C:\Windows\System\ioqOftZ.exe
  C:\Windows\System\ioqOftZ.exe
  2⤵
  PID:13452
- C:\Windows\System\jxTpceA.exe
  C:\Windows\System\jxTpceA.exe
  2⤵
  PID:632
- C:\Windows\System\vMxsInj.exe
  C:\Windows\System\vMxsInj.exe
  2⤵
  PID:13484
- C:\Windows\System\fIkIVJc.exe
  C:\Windows\System\fIkIVJc.exe
  2⤵
  PID:372
- C:\Windows\System\joGRTdH.exe
  C:\Windows\System\joGRTdH.exe
  2⤵
  PID:7944
- C:\Windows\System\DAmBXdE.exe
  C:\Windows\System\DAmBXdE.exe
  2⤵
  PID:12196
- C:\Windows\System\IIkOWYc.exe
  C:\Windows\System\IIkOWYc.exe
  2⤵
  PID:14872
- C:\Windows\System\NtaYSgp.exe
  C:\Windows\System\NtaYSgp.exe
  2⤵
  PID:13720
- C:\Windows\System\atxLjfd.exe
  C:\Windows\System\atxLjfd.exe
  2⤵
  PID:4948
- C:\Windows\System\TdRRmgu.exe
  C:\Windows\System\TdRRmgu.exe
  2⤵
  PID:12280
- C:\Windows\System\CvLbKgd.exe
  C:\Windows\System\CvLbKgd.exe
  2⤵
  PID:3040
- C:\Windows\System\JVyQNVw.exe
  C:\Windows\System\JVyQNVw.exe
  2⤵
  PID:2564
- C:\Windows\System\gcQzSay.exe
  C:\Windows\System\gcQzSay.exe
  2⤵
  PID:15316
- C:\Windows\System\CjsisSi.exe
  C:\Windows\System\CjsisSi.exe
  2⤵
  PID:5068
- C:\Windows\System\Xnlonbl.exe
  C:\Windows\System\Xnlonbl.exe
  2⤵
  PID:8524
- C:\Windows\System\evPJkph.exe
  C:\Windows\System\evPJkph.exe
  2⤵
  PID:13608
- C:\Windows\System\KHkCcRY.exe
  C:\Windows\System\KHkCcRY.exe
  2⤵
  PID:3700
- C:\Windows\System\FYXxMnv.exe
  C:\Windows\System\FYXxMnv.exe
  2⤵
  PID:13480
- C:\Windows\System\kZrZnvU.exe
  C:\Windows\System\kZrZnvU.exe
  2⤵
  PID:9176
- C:\Windows\System\kptxWpd.exe
  C:\Windows\System\kptxWpd.exe
  2⤵
  PID:1372
- C:\Windows\System\JYHPuJJ.exe
  C:\Windows\System\JYHPuJJ.exe
  2⤵
  PID:4852
- C:\Windows\System\HwIxwOD.exe
  C:\Windows\System\HwIxwOD.exe
  2⤵
  PID:1584
- C:\Windows\System\VhwCVEY.exe
  C:\Windows\System\VhwCVEY.exe
  2⤵
  PID:3196
- C:\Windows\System\dNAvNhL.exe
  C:\Windows\System\dNAvNhL.exe
  2⤵
  PID:8860
- C:\Windows\System\rmiQozz.exe
  C:\Windows\System\rmiQozz.exe
  2⤵
  PID:10676
- C:\Windows\System\aSAXyGG.exe
  C:\Windows\System\aSAXyGG.exe
  2⤵
  PID:3280
- C:\Windows\System\iXZFObN.exe
  C:\Windows\System\iXZFObN.exe
  2⤵
  PID:13432
- C:\Windows\System\FSJmTDA.exe
  C:\Windows\System\FSJmTDA.exe
  2⤵
  PID:1680
- C:\Windows\System\WURfOJn.exe
  C:\Windows\System\WURfOJn.exe
  2⤵
  PID:2248
- C:\Windows\System\pffpSIi.exe
  C:\Windows\System\pffpSIi.exe
  2⤵
  PID:5152
- C:\Windows\System\VckDlEj.exe
  C:\Windows\System\VckDlEj.exe
  2⤵
  PID:5492
- C:\Windows\System\wdhzWoI.exe
  C:\Windows\System\wdhzWoI.exe
  2⤵
  PID:4240
- C:\Windows\System\iQSpacs.exe
  C:\Windows\System\iQSpacs.exe
  2⤵
  PID:1268
- C:\Windows\System\tXIeyJw.exe
  C:\Windows\System\tXIeyJw.exe
  2⤵
  PID:2004
- C:\Windows\System\fUUDGTv.exe
  C:\Windows\System\fUUDGTv.exe
  2⤵
  PID:3572
- C:\Windows\System\PKLlpLd.exe
  C:\Windows\System\PKLlpLd.exe
  2⤵
  PID:1916
- C:\Windows\System\OiFBvMF.exe
  C:\Windows\System\OiFBvMF.exe
  2⤵
  PID:14884
- C:\Windows\System\kMQFQom.exe
  C:\Windows\System\kMQFQom.exe
  2⤵
  PID:13468
- C:\Windows\System\DyxkZzA.exe
  C:\Windows\System\DyxkZzA.exe
  2⤵
  PID:15244
- C:\Windows\System\jPZyYOK.exe
  C:\Windows\System\jPZyYOK.exe
  2⤵
  PID:5180
- C:\Windows\System\JdBZgkf.exe
  C:\Windows\System\JdBZgkf.exe
  2⤵
  PID:13612
- C:\Windows\System\VOYaTML.exe
  C:\Windows\System\VOYaTML.exe
  2⤵
  PID:2784
- C:\Windows\System\xsYBtHS.exe
  C:\Windows\System\xsYBtHS.exe
  2⤵
  PID:5104
- C:\Windows\System\PeVvDkP.exe
  C:\Windows\System\PeVvDkP.exe
  2⤵
  PID:4044
- C:\Windows\System\axdTZam.exe
  C:\Windows\System\axdTZam.exe
  2⤵
  PID:13380
- C:\Windows\System\mYubTjV.exe
  C:\Windows\System\mYubTjV.exe
  2⤵
  PID:6412
- C:\Windows\System\qMmDsod.exe
  C:\Windows\System\qMmDsod.exe
  2⤵
  PID:4492
- C:\Windows\System\aCrBQdC.exe
  C:\Windows\System\aCrBQdC.exe
  2⤵
  PID:15004
- C:\Windows\System\gvsFnng.exe
  C:\Windows\System\gvsFnng.exe
  2⤵
  PID:2608
- C:\Windows\System\cVoztIC.exe
  C:\Windows\System\cVoztIC.exe
  2⤵
  PID:6016
- C:\Windows\System\ARSgJtR.exe
  C:\Windows\System\ARSgJtR.exe
  2⤵
  PID:5524
- C:\Windows\System\HiQFGxA.exe
  C:\Windows\System\HiQFGxA.exe
  2⤵
  PID:1452
- C:\Windows\System\cQVXhba.exe
  C:\Windows\System\cQVXhba.exe
  2⤵
  PID:10376
- C:\Windows\System\ppymLDi.exe
  C:\Windows\System\ppymLDi.exe
  2⤵
  PID:14880
- C:\Windows\System\VZpBdXu.exe
  C:\Windows\System\VZpBdXu.exe
  2⤵
  PID:6400
- C:\Windows\System\EWRJDuD.exe
  C:\Windows\System\EWRJDuD.exe
  2⤵
  PID:7104
- C:\Windows\System\uGVOMAS.exe
  C:\Windows\System\uGVOMAS.exe
  2⤵
  PID:7824
- C:\Windows\System\RWsqlis.exe
  C:\Windows\System\RWsqlis.exe
  2⤵
  PID:15336
- C:\Windows\System\lGBmmex.exe
  C:\Windows\System\lGBmmex.exe
  2⤵
  PID:8424
- C:\Windows\System\BJTgBkI.exe
  C:\Windows\System\BJTgBkI.exe
  2⤵
  PID:5156
- C:\Windows\System\mwuaZLm.exe
  C:\Windows\System\mwuaZLm.exe
  2⤵
  PID:6832
- C:\Windows\System\tizpzVr.exe
  C:\Windows\System\tizpzVr.exe
  2⤵
  PID:8700
- C:\Windows\System\NHrHJny.exe
  C:\Windows\System\NHrHJny.exe
  2⤵
  PID:8732
- C:\Windows\System\WmXQbmj.exe
  C:\Windows\System\WmXQbmj.exe
  2⤵
  PID:6436
- C:\Windows\System\LDibqRP.exe
  C:\Windows\System\LDibqRP.exe
  2⤵
  PID:3748
- C:\Windows\System\BiOyawT.exe
  C:\Windows\System\BiOyawT.exe
  2⤵
  PID:6344
- C:\Windows\System\gBisfvl.exe
  C:\Windows\System\gBisfvl.exe
  2⤵
  PID:8772
- C:\Windows\System\hTqaXYz.exe
  C:\Windows\System\hTqaXYz.exe
  2⤵
  PID:14800
- C:\Windows\System\lrsJQqK.exe
  C:\Windows\System\lrsJQqK.exe
  2⤵
  PID:14348
- C:\Windows\System\jusEaZQ.exe
  C:\Windows\System\jusEaZQ.exe
  2⤵
  PID:8808
- C:\Windows\System\YwOtiAi.exe
  C:\Windows\System\YwOtiAi.exe
  2⤵
  PID:14936
- C:\Windows\System\HBRvNKQ.exe
  C:\Windows\System\HBRvNKQ.exe
  2⤵
  PID:8580
- C:\Windows\System\TurEimL.exe
  C:\Windows\System\TurEimL.exe
  2⤵
  PID:9620
- C:\Windows\System\NtpfQzi.exe
  C:\Windows\System\NtpfQzi.exe
  2⤵
  PID:9156
- C:\Windows\System\hvsRSmp.exe
  C:\Windows\System\hvsRSmp.exe
  2⤵
  PID:8712
- C:\Windows\System\XjCOlDd.exe
  C:\Windows\System\XjCOlDd.exe
  2⤵
  PID:10652
- C:\Windows\System\HVqoLKp.exe
  C:\Windows\System\HVqoLKp.exe
  2⤵
  PID:6608
- C:\Windows\System\gssughZ.exe
  C:\Windows\System\gssughZ.exe
  2⤵
  PID:5588
- C:\Windows\System\rMsuaWN.exe
  C:\Windows\System\rMsuaWN.exe
  2⤵
  PID:8708
- C:\Windows\System\KDmmcsM.exe
  C:\Windows\System\KDmmcsM.exe
  2⤵
  PID:7516
- C:\Windows\System\FriVFtB.exe
  C:\Windows\System\FriVFtB.exe
  2⤵
  PID:4508
- C:\Windows\System\atQAFrz.exe
  C:\Windows\System\atQAFrz.exe
  2⤵
  PID:1580
- C:\Windows\System\EaDnmCm.exe
  C:\Windows\System\EaDnmCm.exe
  2⤵
  PID:6704
- C:\Windows\System\tjimDHF.exe
  C:\Windows\System\tjimDHF.exe
  2⤵
  PID:9584
- C:\Windows\System\ouJYyLT.exe
  C:\Windows\System\ouJYyLT.exe
  2⤵
  PID:9748
- C:\Windows\System\wSefKyl.exe
  C:\Windows\System\wSefKyl.exe
  2⤵
  PID:13268
- C:\Windows\System\dVXDFdX.exe
  C:\Windows\System\dVXDFdX.exe
  2⤵
  PID:7068
- C:\Windows\System\osKkkNZ.exe
  C:\Windows\System\osKkkNZ.exe
  2⤵
  PID:6896
- C:\Windows\System\SymiMqB.exe
  C:\Windows\System\SymiMqB.exe
  2⤵
  PID:11780
- C:\Windows\System\TnxUZVJ.exe
  C:\Windows\System\TnxUZVJ.exe
  2⤵
  PID:10484
- C:\Windows\System\DxozGQx.exe
  C:\Windows\System\DxozGQx.exe
  2⤵
  PID:10928
- C:\Windows\System\dVHBmzX.exe
  C:\Windows\System\dVHBmzX.exe
  2⤵
  PID:7408
- C:\Windows\System\InNIOcd.exe
  C:\Windows\System\InNIOcd.exe
  2⤵
  PID:8760
- C:\Windows\System\aLUdoCt.exe
  C:\Windows\System\aLUdoCt.exe
  2⤵
  PID:1616
- C:\Windows\System\YAfRRrs.exe
  C:\Windows\System\YAfRRrs.exe
  2⤵
  PID:8168
- C:\Windows\System\rBpvuEo.exe
  C:\Windows\System\rBpvuEo.exe
  2⤵
  PID:6528
- C:\Windows\System\URUcgty.exe
  C:\Windows\System\URUcgty.exe
  2⤵
  PID:10336
- C:\Windows\System\MGGEumm.exe
  C:\Windows\System\MGGEumm.exe
  2⤵
  PID:12864
- C:\Windows\System\QQlflba.exe
  C:\Windows\System\QQlflba.exe
  2⤵
  PID:12892
- C:\Windows\System\uhrXMMS.exe
  C:\Windows\System\uhrXMMS.exe
  2⤵
  PID:12004
- C:\Windows\System\ziVrYcP.exe
  C:\Windows\System\ziVrYcP.exe
  2⤵
  PID:8716
- C:\Windows\System\UGgNUPK.exe
  C:\Windows\System\UGgNUPK.exe
  2⤵
  PID:13008
- C:\Windows\System\WJxzUUL.exe
  C:\Windows\System\WJxzUUL.exe
  2⤵
  PID:1476
- C:\Windows\System\FcnRtmR.exe
  C:\Windows\System\FcnRtmR.exe
  2⤵
  PID:8428
- C:\Windows\System\vQpZTos.exe
  C:\Windows\System\vQpZTos.exe
  2⤵
  PID:7096
- C:\Windows\System\ShdTIFR.exe
  C:\Windows\System\ShdTIFR.exe
  2⤵
  PID:10980
- C:\Windows\System\nyFInUO.exe
  C:\Windows\System\nyFInUO.exe
  2⤵
  PID:5464
- C:\Windows\System\SnSpCkz.exe
  C:\Windows\System\SnSpCkz.exe
  2⤵
  PID:10736
- C:\Windows\System\pystuWD.exe
  C:\Windows\System\pystuWD.exe
  2⤵
  PID:12496
- C:\Windows\System\WxRMAKF.exe
  C:\Windows\System\WxRMAKF.exe
  2⤵
  PID:8552
- C:\Windows\System\yVfJDLW.exe
  C:\Windows\System\yVfJDLW.exe
  2⤵
  PID:7952
- C:\Windows\System\LXYlkIn.exe
  C:\Windows\System\LXYlkIn.exe
  2⤵
  PID:11684
- C:\Windows\System\PJcyFHA.exe
  C:\Windows\System\PJcyFHA.exe
  2⤵
  PID:6372
- C:\Windows\System\uHEUrDq.exe
  C:\Windows\System\uHEUrDq.exe
  2⤵
  PID:5932
- C:\Windows\System\vIUrBpk.exe
  C:\Windows\System\vIUrBpk.exe
  2⤵
  PID:15224
- C:\Windows\System\GqOMgdD.exe
  C:\Windows\System\GqOMgdD.exe
  2⤵
  PID:1976
- C:\Windows\System\SNDZyJb.exe
  C:\Windows\System\SNDZyJb.exe
  2⤵
  PID:8120
- C:\Windows\System\qQlMtCY.exe
  C:\Windows\System\qQlMtCY.exe
  2⤵
  PID:6140
- C:\Windows\System\VTAgOHy.exe
  C:\Windows\System\VTAgOHy.exe
  2⤵
  PID:8080
- C:\Windows\System\ppKRQDb.exe
  C:\Windows\System\ppKRQDb.exe
  2⤵
  PID:10912
- C:\Windows\System\uyWnfib.exe
  C:\Windows\System\uyWnfib.exe
  2⤵
  PID:11500
- C:\Windows\System\CBTyxYZ.exe
  C:\Windows\System\CBTyxYZ.exe
  2⤵
  PID:7636
- C:\Windows\System\JDluVcZ.exe
  C:\Windows\System\JDluVcZ.exe
  2⤵
  PID:11584
- C:\Windows\System\EQXkMsA.exe
  C:\Windows\System\EQXkMsA.exe
  2⤵
  PID:6108
- C:\Windows\System\NeXSJaW.exe
  C:\Windows\System\NeXSJaW.exe
  2⤵
  PID:10656
- C:\Windows\System\MHIMVaX.exe
  C:\Windows\System\MHIMVaX.exe
  2⤵
  PID:10424
- C:\Windows\System\fUWKILl.exe
  C:\Windows\System\fUWKILl.exe
  2⤵
  PID:7264
- C:\Windows\System\SzCKhnW.exe
  C:\Windows\System\SzCKhnW.exe
  2⤵
  PID:8824
- C:\Windows\System\ekKlKmq.exe
  C:\Windows\System\ekKlKmq.exe
  2⤵
  PID:8308
- C:\Windows\System\wGydJog.exe
  C:\Windows\System\wGydJog.exe
  2⤵
  PID:6504
- C:\Windows\System\xrpkiiX.exe
  C:\Windows\System\xrpkiiX.exe
  2⤵
  PID:5916
- C:\Windows\System\XfHkbsf.exe
  C:\Windows\System\XfHkbsf.exe
  2⤵
  PID:11476
- C:\Windows\System\LgljMVS.exe
  C:\Windows\System\LgljMVS.exe
  2⤵
  PID:8364
- C:\Windows\System\ChtoksC.exe
  C:\Windows\System\ChtoksC.exe
  2⤵
  PID:12852
- C:\Windows\System\IqRWpFg.exe
  C:\Windows\System\IqRWpFg.exe
  2⤵
  PID:6176
- C:\Windows\System\KcUyDUJ.exe
  C:\Windows\System\KcUyDUJ.exe
  2⤵
  PID:11920
- C:\Windows\System\VmGRJSh.exe
  C:\Windows\System\VmGRJSh.exe
  2⤵
  PID:10512
- C:\Windows\System\eYAiqFK.exe
  C:\Windows\System\eYAiqFK.exe
  2⤵
  PID:5848
- C:\Windows\System\YyFXZXg.exe
  C:\Windows\System\YyFXZXg.exe
  2⤵
  PID:960
- C:\Windows\System\uXPNbrd.exe
  C:\Windows\System\uXPNbrd.exe
  2⤵
  PID:12536
- C:\Windows\System\JNGrhUS.exe
  C:\Windows\System\JNGrhUS.exe
  2⤵
  PID:9352
- C:\Windows\System\HPCHNBU.exe
  C:\Windows\System\HPCHNBU.exe
  2⤵
  PID:7272
- C:\Windows\System\aREpdTM.exe
  C:\Windows\System\aREpdTM.exe
  2⤵
  PID:7684
- C:\Windows\System\VtGFoHV.exe
  C:\Windows\System\VtGFoHV.exe
  2⤵
  PID:7076
- C:\Windows\System\eIsNwxJ.exe
  C:\Windows\System\eIsNwxJ.exe
  2⤵
  PID:12476
- C:\Windows\System\RsHZOyq.exe
  C:\Windows\System\RsHZOyq.exe
  2⤵
  PID:13812
- C:\Windows\System\eIZzbeR.exe
  C:\Windows\System\eIZzbeR.exe
  2⤵
  PID:9328
- C:\Windows\System\EbtHesN.exe
  C:\Windows\System\EbtHesN.exe
  2⤵
  PID:2244
- C:\Windows\System\sQlDGcP.exe
  C:\Windows\System\sQlDGcP.exe
  2⤵
  PID:13440
- C:\Windows\System\uaSpOfV.exe
  C:\Windows\System\uaSpOfV.exe
  2⤵
  PID:14260
- C:\Windows\System\QMoWNYW.exe
  C:\Windows\System\QMoWNYW.exe
  2⤵
  PID:2084
- C:\Windows\System\ARbkZqO.exe
  C:\Windows\System\ARbkZqO.exe
  2⤵
  PID:13604
- C:\Windows\System\dBKQXkn.exe
  C:\Windows\System\dBKQXkn.exe
  2⤵
  PID:6224
- C:\Windows\System\msDUIdi.exe
  C:\Windows\System\msDUIdi.exe
  2⤵
  PID:6700
- C:\Windows\System\ACOenTj.exe
  C:\Windows\System\ACOenTj.exe
  2⤵
  PID:11152
- C:\Windows\System\KXSNIxf.exe
  C:\Windows\System\KXSNIxf.exe
  2⤵
  PID:7968
- C:\Windows\System\fQKfLoe.exe
  C:\Windows\System\fQKfLoe.exe
  2⤵
  PID:5656
- C:\Windows\System\seBaKfR.exe
  C:\Windows\System\seBaKfR.exe
  2⤵
  PID:11440
- C:\Windows\System\CUKCyDM.exe
  C:\Windows\System\CUKCyDM.exe
  2⤵
  PID:3660
- C:\Windows\System\ozrdVqx.exe
  C:\Windows\System\ozrdVqx.exe
  2⤵
  PID:12040
- C:\Windows\System\ArmJlXE.exe
  C:\Windows\System\ArmJlXE.exe
  2⤵
  PID:11504
- C:\Windows\System\geaZyOp.exe
  C:\Windows\System\geaZyOp.exe
  2⤵
  PID:8396
- C:\Windows\System\HlIIMiJ.exe
  C:\Windows\System\HlIIMiJ.exe
  2⤵
  PID:9484
- C:\Windows\System\EsxPEUE.exe
  C:\Windows\System\EsxPEUE.exe
  2⤵
  PID:10716
- C:\Windows\System\TNdViei.exe
  C:\Windows\System\TNdViei.exe
  2⤵
  PID:9260
- C:\Windows\System\oyCFkUT.exe
  C:\Windows\System\oyCFkUT.exe
  2⤵
  PID:7720
- C:\Windows\System\YwCJOcF.exe
  C:\Windows\System\YwCJOcF.exe
  2⤵
  PID:12652
- C:\Windows\System\vNOhnIb.exe
  C:\Windows\System\vNOhnIb.exe
  2⤵
  PID:14428
- C:\Windows\System\krsnLjv.exe
  C:\Windows\System\krsnLjv.exe
  2⤵
  PID:8204
- C:\Windows\System\VeXHuqR.exe
  C:\Windows\System\VeXHuqR.exe
  2⤵
  PID:9452
- C:\Windows\System\bfEqUkA.exe
  C:\Windows\System\bfEqUkA.exe
  2⤵
  PID:14484
- C:\Windows\System\bEtRrbK.exe
  C:\Windows\System\bEtRrbK.exe
  2⤵
  PID:8768
- C:\Windows\System\HKBmMpa.exe
  C:\Windows\System\HKBmMpa.exe
  2⤵
  PID:13400
- C:\Windows\System\MzOCQqR.exe
  C:\Windows\System\MzOCQqR.exe
  2⤵
  PID:748

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 732 -p 15092 -ip 15092
1⤵
PID:14760

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_bx05v5fq.t4l.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\AeupnRR.exe

Filesize
1.4MB

MD5
45238cdea59795bd64e7eb6a13013803

SHA1
c9a685f7729fa658c82140ba867d1ed06cb35402

SHA256
1a9163b5eb3b07baaede695e702be9cc2a9daf5e64b6c7dfd0689385d42fbb23

SHA512
876115e2834e81827f9abc623f423b8debb6334e70cd180764dc32234700f382411f544fce62d1f282339c3fc41fbae61ab31e25d07d06bd0c7acbc3009eeaf2

Download Submit
C:\Windows\System\AkZVGTs.exe

Filesize
1.4MB

MD5
23ca0cc2fd86b77c225711a93ebc729a

SHA1
1c2e3c7d1d63d778a88656731c1cb4ba9101f4e9

SHA256
5629dcba1b659a36ed216b7b591c80ddf37c9994ae192ece483e185555f78d84

SHA512
2aaa5d5139e3f5a2b8e23ba596386d66d20134e96a0c5525d106ec2672954c09b7e742ff07b58cd02d4c59cc059b4e53fb4d31cec54822fd14de2435b546397b

Download Submit
C:\Windows\System\AvTzRts.exe

Filesize
1.4MB

MD5
a8ecb119adf2c3b5b61dadf502efc289

SHA1
2fe4acf49c6dd109014fb72ed04f344a6a832a3d

SHA256
572846dd3f56a72dcd6bcbd290f1b6cee6c024452564dd92856a2e6c7b684fe1

SHA512
ce6d54fb5bd5810c9e1be2efe2551de9048abb5c0cdd90ea8d72644b2cfdb706226ae577bf9032da2573476e4a713f5576b0de009480937729529b58bc7a06e4

Download Submit
C:\Windows\System\BUFtvuw.exe

Filesize
1.4MB

MD5
5c9d1ffb37c368b632c2889041c67a04

SHA1
f74f9d3126154baa47ebf16ff5b7c3588806c79e

SHA256
1d00da36785dd15abd8dd66b5f93a05829127cbd00dfb8abe005072d4c2a83e5

SHA512
5be78fc5ae9c5302cde13d1e422a8a290cb6b4665ce98300e10c4880cdb5eb68f16a3a36be3b15235e084ceef57769b16299762ab2feff2044f9d4a2e6c8eb76

Download Submit
C:\Windows\System\DcYyjKW.exe

Filesize
1.4MB

MD5
9c0bb2bcb248b785a395c5270725bc68

SHA1
4869efac7c5f899cfea6771b5e177c9ef8ff5af7

SHA256
5281fa158013ef9e4bbd44c8e283cbb9f0c7adad482a40ebfe1ccf8c78dd2ac6

SHA512
402bbb5f7141971be1e96ee98898674747a8eff58dd0c2b2f3a464f55077d51a40aa17585b9e5dd1d1fdd11ae15edce0667721cb25f8826312223b00e6419ab1

Download Submit
C:\Windows\System\DouVDTu.exe

Filesize
1.4MB

MD5
ad73dbc202bf942b70209fc82fe62bb2

SHA1
d480ae5122c87c71f971fdfb7047d9236f8ef46c

SHA256
0fd3456cc9a916a192169e18ac2ed4d0197f27325a5732ae063a8ad57cf682cc

SHA512
2b509055bf336dcd6b1304a29df02597618a2e5973eb678a638112f9d01a5bf913eea2c988e7f29b61c4895ea7373d532334f3db59cb684c94dd9d3352402e8d

Download Submit
C:\Windows\System\ENoWATE.exe

Filesize
1.4MB

MD5
65ffa949e4ca7d4ada615e472e12d154

SHA1
204be743374e017426a9e84a15a0037db5aea211

SHA256
f71ece52adf0c04ec0e0b646ccff702ae9e549d38fdea39afb2d77c54a8fb98b

SHA512
983a9603a616b41b71a376603f1d4c7f1d88035ced002d43273849e4f6ee8cd32c39befa6672e728bb3f71d103652d73292e3cb0cc81ff77c64923bb92369d9f

Download Submit
C:\Windows\System\ERXtaZU.exe

Filesize
1.4MB

MD5
bda02342859f0f8e02b9becd5a235590

SHA1
9bcc552334fc487ad737a14343c051fc59109622

SHA256
afd01938a59688feb4cb138c146b4211cb5305f7c954f42e3b01b3506f389d25

SHA512
c806a26c80453ed28d368cdbed9ea009432f2dac14c138f59b4ad1d417cae9b5557c3b0e0820bbf2ae146159e3d0f8e6d659478db6d4485adcc34092a2655456

Download Submit
C:\Windows\System\GpPVVst.exe

Filesize
1.4MB

MD5
05eb5068b043acbac2e738a4a47362a9

SHA1
8d627da755b2c43d4fdf7b713c4101432bb98833

SHA256
0dc2b4a28f87a5f60d0417b5a37dbaed42e9b91c6933a68f26a781bc3f1d3d25

SHA512
668f61c17346098f52564c08b7cdec4e22a5d85b9870957e684d2d0633f31a7d6c8b169a31dc2f7c124398157de12510573d30325a418a148683678036289dd3

Download Submit
C:\Windows\System\GrUPEpH.exe

Filesize
1.4MB

MD5
b44420ff8ba58fef8c9c0ddef4b52426

SHA1
57a0aec7803a57fb4b420bd19b805b4398d2cb56

SHA256
2d3f944646b901825d1b58ce6c6ba103984344b5275046e095262c5cea620d78

SHA512
b89274b2de3acc2bd59183da1ada992d05e378c3486986a68837059b592ca46d8e32ec58029a7d15194d1ea4b8ba3947f5fb8ed0512a9c747227b219b9a55ba9

Download Submit
C:\Windows\System\HZWAbIR.exe

Filesize
1.4MB

MD5
0bf182db2f8a8e1f23012c8abe0f7baf

SHA1
fb30b7bb0c7abb76ce45a81131aaff10e8d55143

SHA256
20d923e3a20c3b6bd5fca00d595ea826df42fe2e5f96e76dba05b1d2f99561ce

SHA512
5f5487237e8ec3fed0b1d1cb4868e738a8de08fe04efa99cffff99f558cd585defe1e1de865cdd5d41c86e9bed8f6c103d022313849b00b9900349bf1c53bce9

Download Submit
C:\Windows\System\HaGWtHT.exe

Filesize
1.4MB

MD5
778c1b6d58e312d146d4d88945261542

SHA1
9f805aaa8bedf1969cc6b5b7791b2bf0de2496f2

SHA256
3d7d0fbe0f5dd93614facde2036e3e40c146a287a01ece034ad792f2182b98ee

SHA512
be48fd4cb065ea602aa09cea785a3e491fb6c7bd54c4d61bffabce5c55c5db7f4df935190da58e669f1d591c22617d645a57b02d18dbfc7a2c166a1b68aef140

Download Submit
C:\Windows\System\HxqYHoO.exe

Filesize
1.4MB

MD5
a38c61f6a5f6c16399e9f905d2d9d066

SHA1
578d503224af447eb932e2f436794b62a0e7741a

SHA256
f7013bb103d2e9cd4193c4e8e8df33344a5e3611617db8627bff234fe1840630

SHA512
6f04083dc655112d1ca1d589e7c3bb81ad6b6ce050177bf02e48c4642c7e4d14c744341f9bdd568f9e55e50774b49e6346bdba5961e0c6315eda96d155d28cc0

Download Submit
C:\Windows\System\HzqnttS.exe

Filesize
1.4MB

MD5
52ac332b7087b99912f151bdc940dc3c

SHA1
e0f7bbfa2f8153aee8854a1da0521ee0edad1f33

SHA256
badb813eb0cb0664064bf761b6ad152685d74a044edd47362509b7795dae52e9

SHA512
835814d0420c464d09e53784db8990c2abb0769675bc53656b642ca02252f2832d9d3edda899c6c735e15ed064c68c1a69a06919db0e1989be51a1cb8f51863a

Download Submit
C:\Windows\System\IpIVhkm.exe

Filesize
1.4MB

MD5
2fa958a4172ec3d6d8b4495f0745f277

SHA1
361c29fd01a99af1ebbc326b2801a419d7ef482f

SHA256
1f12b2da6472ef8d84a37dc85c55f53988d7febc6be35f303b4a2c798de1dff5

SHA512
1b789b9fa1598b48f52a96db59cc2210b083720619829a637fc6c0f67b9abbed6a569f0df0e2a439776dd008b9f44c2e3d40d6aeca3c7739487d146286e3538e

Download Submit
C:\Windows\System\KNBdbIP.exe

Filesize
1.4MB

MD5
381805b22c35d992c59212a0431ce53f

SHA1
a15267e5be513369285a069fd366b916942bd0a2

SHA256
ae04ec04e2ede84f6ac575d7414cff3f81455460c31b5d0e2dab77c109ce3b8f

SHA512
687e6b151c7d2f7d1fdc5236cc53448160b7dc399e6204d427ac5b5523f09c9e83840b7689c830afd3a622f7c9758a781baeb0cdd182ee1b6630e3f7574ccf8e

Download Submit
C:\Windows\System\NVkILIe.exe

Filesize
1.4MB

MD5
4949071a2506336ecaa3d8a2b0dfef45

SHA1
15766a8b72fa04d217e74899109241f9cfbd1dbf

SHA256
560cab3b2353de8953edc53a7f9cfe3651c8b3f8a58e476cc353a1c52e9c6aed

SHA512
caae3769788676755254de8edf473e1eb1f3befdc9d522019443db3c31674ebfc3b6466ebc035afac989f36c72f37f53f6b476dced997b7df8519451a8d07084

Download Submit
C:\Windows\System\OTzgLwI.exe

Filesize
1.4MB

MD5
ce7bf54b1a8941a47426a47cb614a3d4

SHA1
aab3cef97b1f831ead52f5e4b70a9452ae22d8d9

SHA256
498727e1b4745fe17db4b8ec2b0c328f7e0667d7c6e66e50a020111da92049d1

SHA512
4f995d18101ae704227aae4aaeea4c012cee78b335417cfa5458057a36c135cc4c9db4022740b80a8c1dfeefa664b65615cf64a13cfd9dad403065505b81aa9b

Download Submit
C:\Windows\System\PdOcllc.exe

Filesize
1.4MB

MD5
63d797c7b0af1b2bd345fe9a83a4f860

SHA1
63599527dce6558d72214fe3cf3ac44d616422fb

SHA256
bb0f0fdf1677cd86a0060bec878ebad5ccbf56888d1a4960a31d80f7e8b5eec8

SHA512
d227be067950529201b3d315088b895eee1d5bdc6ecd2f420221d3f9eb791fd82d99331fc933736978604d61599a2c44d21a46fa4c8bd00ebd2b5cc96569b5b6

Download Submit
C:\Windows\System\QkoGbBZ.exe

Filesize
1.4MB

MD5
420f9d49f55c4f716090b003a1650bd0

SHA1
1d66fda0d88407a97e3fdf6f3924fd778d56aafa

SHA256
ef52bc1c670e67bebe62ab24b1e80613f8ad2ccc89275f6eef0c61222d61342e

SHA512
88fb865f58e2cc977327894b3eb433b714282e895e6f9c89cae7bff67f0c4b25cd70c43e123ccb654696a49574fd14f66eb62b3e4c286ae6e60f7ae014e1f655

Download Submit
C:\Windows\System\QnyVTAf.exe

Filesize
1.4MB

MD5
681d2b7b2f2b9466fbcdec74df761e38

SHA1
9505c1340cf898a3a2295903b99edeebb74503fd

SHA256
7b4159f9de3177709e601f68d14b83378aebb21920b87557422bf9fd8476f80a

SHA512
87d0404465b00712f1e09dc554f3ae306a651860904719c919eeb72f63f23b47275d36f85a70b50bceb4869d6580d3e23443bf5d30534a08371e22ae00b40899

Download Submit
C:\Windows\System\RKCIvRW.exe

Filesize
1.4MB

MD5
461ead46759b40cd7bd126675217954c

SHA1
55cf8250b5ad571da6f47793effb2b21b44abe0b

SHA256
a97a22edef136dc6c0f33689c794c3207dea05e21e3fc1b2c57cb1b475836d00

SHA512
981e3921f5040a1baa4b6d293fe3fee557d458021e808e2aefa1cc7a2eee289eb9ef13bc8072e1bc88d479b036511b8d940f68ba29410f329a764c2f748ed3df

Download Submit
C:\Windows\System\RYJilfJ.exe

Filesize
1.4MB

MD5
f33dfcefd4ea524828bcf76e1983bdde

SHA1
f6262cfb812dfa6fe7650a011a20fededd6a4bbc

SHA256
b632e1ab0da3b703e2b844973da5044bf1281f5b362fcd7cd925dcc1b4ded476

SHA512
fac61f063c7f50f6326ca0edecdcbd0c7915b805ffcfa5d4fa922a9f59e0ccc11469c3ccb969a784a0cb44913f8df9e162b166aed1ded5996b963a4f6e233466

Download Submit
C:\Windows\System\UbGZzGH.exe

Filesize
1.4MB

MD5
efa722c52ea03132aa55e055362ad575

SHA1
023bfd8777251e47849b34405dc101bbc32b4af2

SHA256
08bdb4b611c468db0e8cade474b5310e4753f7013b07c9c942a24b159ef57757

SHA512
7717dc8b186f3bc6a3801e6aef92c2f2d959a558af5f8eefe1d0d68f8b6fcb52dd41071cd4d1761d735e01b10bda41c0edcd8e8aba3b03c778ed2d9fc022f433

Download Submit
C:\Windows\System\VyCjTYw.exe

Filesize
1.4MB

MD5
611284af369283b6928bdff476778a42

SHA1
b6fdab9a354e77802d4d847fd61baa49ff7fcdda

SHA256
edf9df966c5f88747966085a4157dbed3e1055abd32f573a50cd2f5ac58cd2a2

SHA512
d9a821d5cd420bedc5901df5755019e4c231f5c3bc375a9c4f7220625cc0392d6b5a53f78e2d2d18607127a4e2dd6d1ff7bbfd2bccc1f487bbaff09852e0d553

Download Submit
C:\Windows\System\WdeVPMU.exe

Filesize
1.4MB

MD5
590129f29e1e7b9cacc637bf4739601a

SHA1
5b64c6882f9d2addd4daf140684fbb177e4d103d

SHA256
11372254fabe81a57a72aacc398d0717135c258eb17b55611ffe1fbbe938906c

SHA512
e36764dcf20f374013e40fe08a17a284af03472ec9d0aed84b7f6d1a8dacaefa2d6f8cece2bee68e9caf5e3f2feff18298da54fd606192a6b30c72b750d275b3

Download Submit
C:\Windows\System\YLneuUl.exe

Filesize
18B

MD5
a308bab96af0d8b0405ced0df2e422de

SHA1
d1952ddc6ffadb32bc26dbd87f63673fe488019c

SHA256
8b1e86aaa211a5c5f8f89e89db4748f4041ce6a7eadabf706546f1da8a4c933b

SHA512
febe4ebe7f32e7b2ee0bea8360d9cfbd617f1e619f185f40ee924ced488e4b9c2a3a234ad49a740a246b10397b83d94709c1498bb18d2a41eaa09bad38561ccc

Download Submit
C:\Windows\System\bYelxnc.exe

Filesize
1.4MB

MD5
1b7ef9b58b57f64d29312f1823697685

SHA1
b06335d9d7e1233e98d9c821b429c37ab210fdaf

SHA256
af26e4bb25f86446e2d258761dd0ae6deff05a42158ec083a4aa2add1543bae1

SHA512
ce045687e1d4142215aa27758abccc99d99c0a77508cbacdf15fa65d62e4a6836c071a4c822450712e37e2ce6ab58c7fb1f3248b943417ff1143f5d455b8d500

Download Submit
C:\Windows\System\bywLrZc.exe

Filesize
1.4MB

MD5
6d991060dba4ea52250d3210800a6374

SHA1
d1caaecc97418abfded09538dce27998ac2b4180

SHA256
7c7bb9ab39116e8dec3262f344e76bc664e9411a66eacad3f9cf760fea850f1c

SHA512
f9faadee1350d677afd706eedd5b02b50301a7879f7d806734184392639c1839e370e44e69fab81c1b97a4895b577e9cc81b36e074b2551bd082e3980fbcd1a3

Download Submit
C:\Windows\System\edlrxxt.exe

Filesize
1.4MB

MD5
93c23b09f9f59067e22e95fbf7186d15

SHA1
53237cccd556775d0f0d8b37402cc3bc6c2c83fb

SHA256
26486b8228fdca4853b304bd239f8fbfa45c2fddcc3fc37ee9038edc00ba725e

SHA512
78d9d0ee63633151eb588287eca3ac3c48e8d401effa6d7c0aa82ad20eb396ed88b873e539a614376485ef4c7c4ee2f36b35f828ff03b25baf27212a04f189f9

Download Submit
C:\Windows\System\evWGUsC.exe

Filesize
1.4MB

MD5
8e515bae8e563109f6acb46d56282796

SHA1
7e12c839c660633fac39751a6d22d21234ca11f4

SHA256
5635fc73fe9e838e8b374256f2d2c03a6e989e5b47d17e09749dadadd148627e

SHA512
c36cd02edb4f7a68391c0ada918f6022542f0065ccdf7e6de97e997f99ac0992c25d2c6f01166a2d577536592ba942b8dd08318713b874e767a0673f86d55a1b

Download Submit
C:\Windows\System\gTNXXXC.exe

Filesize
1.4MB

MD5
c31f7195878d5c716ee1aeb82ff5f935

SHA1
4fb759fd8c04fa93017a55383895fc3a4899263a

SHA256
e444d75622eef672cd5ae76fe98841855abc96522a5179ef43e5d5ddbc454b5b

SHA512
3aafbee6228a65aa205874d6acfebf336ad1cbb660ad66a77a9dc9f7468f3daabfd78a5264f5df57e5d3176f0306102a0e2e42ae57969c81cef7af08fc0b6342

Download Submit
C:\Windows\System\hCKwFaC.exe

Filesize
1.4MB

MD5
d1b09878e820d21a2d0ee9e5c536ee48

SHA1
6d1130e4f28af08084990e589cd94e7571e38d12

SHA256
48199ac25b1dc50baa2916fdfa39c9fb8c5f2c883763505499fb25255cab9999

SHA512
df3a0bc0ebae0de8425f96dce12e277d6b7efc9c89e5769d3a9025f45ad0dc79ec6bad330810595240fb62238d2829ab0a0b1b03b79d92f5bfba211a20f16790

Download Submit
C:\Windows\System\hjSUtou.exe

Filesize
1.4MB

MD5
00ed253d14c2826b473480b144bb4f67

SHA1
fd9c198f18f502c96fc548b8108204d125b9b322

SHA256
5a7e0484fbf08be0fb5aae53565f6bdc6281aeda09c049c199c43065a257703a

SHA512
91053afa70c1b096a8f2adb2fa34f4b7bc3bfed84182f1d963f00b8e63d34c59dfc1df634b4417d4201b12efff0bb917f09c8b534c45dcb0820c3b7593dd43d2

Download Submit
C:\Windows\System\iVnLdYP.exe

Filesize
1.4MB

MD5
f2e17e19f7cf347f8793cc195fc869f5

SHA1
e64991d027cbf738b9de2824e6d9c1a4086bb3a7

SHA256
fcc4927fe0a0204e6fff4b14bd8e0d52ec8c520ce4bce9d044aa68895c21f4a9

SHA512
747e83cfcb878ac448dd8f7bbaa04b1dd21db29935a6eae9f39b78b2d7713c4402a7c59333b7f238fe01c875f019b1c379687b3e4d845b09a2cde75496ca8ff0

Download Submit
C:\Windows\System\itOISht.exe

Filesize
1.4MB

MD5
ae59ad9d798cfb78826f0d414fc3efc5

SHA1
fc098631b71e2dec29f41d846fceee53ed66cd06

SHA256
8eda6b7f34f883fbe38bae7a4b83a5eaf4aa853207743a2ebc5fbba2cf355b00

SHA512
76b8e3de3f363e69fbdd7c7c02b0aa8b34c1610205b9bf680a717e27065f8ee0f607b30398e88ff8446e88ada09c56869b0d394fd5352074043abfe5eff768a7

Download Submit
C:\Windows\System\mRVufNi.exe

Filesize
1.4MB

MD5
07b2da4441a1cff71467c4b158fbb161

SHA1
df07772e342dec7fad7376ea42bc4f53e68e76ae

SHA256
fe57c0e400c1d58442e406c475be489f75a6b613b421f19db23608cec272719b

SHA512
5fe211d3dc3cb9a61834df03095c07e57d6eecf69292584ae82735a135cda079bc1e6493dc194d58a00bced5aa7967a571454a09c5c8672f09a8920c3e03b0b0

Download Submit
C:\Windows\System\mnprLAP.exe

Filesize
1.4MB

MD5
914ee24614c2feee243de1b22d3e910f

SHA1
b756eec95938e2f1ce5aba7cec84b3f5aa526663

SHA256
02d1f87461626085ea2e47d8622c94d7de1d9fb3f563a7383adc0fa1899c68aa

SHA512
f4a054ea12ec398efac1b9d715806d7c4241e454455eb91c4ef031a041307ed6ef72e1415001642d0f203105f395814c94b4ef684444f051b25f36cce8c17497

Download Submit
C:\Windows\System\nIoXhEo.exe

Filesize
1.4MB

MD5
1722c83def6e1310361b07f89f7afe35

SHA1
7168619e16cdfbc0a38c1515f12b97e3a9eb66bc

SHA256
668b15bb4c0f5c169bd1f040b9e1a6ad2be912d0aaf4b4b93026fad7a069d89d

SHA512
c11c1abe5e491ce5e4c81da66b82c41ba5f0dd5f9761eea9060ca05eb50ec2304ff89f1d4e0431ef36ad411aef08e57f0fd09dd208149ce87a6c1363a19f79e3

Download Submit
C:\Windows\System\omEnEkD.exe

Filesize
1.4MB

MD5
2dba6d334833907e180a490ecee1345b

SHA1
244174411c95b2473ac65980b298109bcc4cf9f2

SHA256
6e356d3b9925c88d04fb44910b59f427149a489e0bef24c3559a10be74b513e1

SHA512
6b8c6d097007c31b75a8e0ff29a424411cfe654d80012de401e8b1339497a80cdbf1970d297a292445172dadf0246434b7cee2c4756f4764350ef0e80fb2cd62

Download Submit
C:\Windows\System\punftdj.exe

Filesize
1.4MB

MD5
94feeda02a465bdb61d8a17756c2e7ca

SHA1
c20c8590a67dc4120957aea0051fb846fe1c953e

SHA256
487e75670c9c0793aa695991e76296b71b0e7fb903388acfbc8415e445af24e3

SHA512
03b8361d41aa5edb62f1679cfa27dd3d0e967d79f529e9f7571f0b1908d0062b3f5bbd574cc6c7bc1780085b79a624de62c4a00124ab6478cc0a3e6d4cd9d364

Download Submit
C:\Windows\System\rhZFBYU.exe

Filesize
8B

MD5
8a9416a5ba3f4513ce86ee25fcd9ed2c

SHA1
a36f3dd1333c8cfee404b646d4c6809d7e653313

SHA256
fb7dd3a16f87fe8b7e98987069f2b605508df1550402bd2a9bfdec4856b1a59a

SHA512
c747d417c3e282ae9ec82b691c8fea9cb7d0729d1dda54d2144fa9c71dd39f2ab11cee5a6768a89cb91fd4a7ae6e579302cb4e4de8d6384014994320074580a4

Download Submit
C:\Windows\System\vNNBGsA.exe

Filesize
1.4MB

MD5
4751ca029e249ddf13e5a7ef21355fa9

SHA1
a1875af1f67262a8fb5faf87f3f8aff88602edc3

SHA256
9b3feaf1ce05ce684cde23a0b38530fb0754d5638602e6ea3b15d0a5ee460e84

SHA512
3b19fe6fbc4fb904b0e8fe3588b557b915380054d4f71a7d2e1356cb9c0bfe83a25c5e595da2b9b53297463fa1a7ffe564f6a2eef1724fe67d5883f51cbd3261

Download Submit
C:\Windows\System\vUvVLWy.exe

Filesize
1.4MB

MD5
d83f7d9704be93232d5cc2489aba2c55

SHA1
eb51115d234e73d834f69711e1f47b91598150f4

SHA256
c61077b2fb8ebe863ca100dc106f5c75fec507ce2b2fd04b5f07cfa5e7030f17

SHA512
cd89ac3cdd91e8e7d30132d261aa0f44c6531fced6bc18cb0a56c7dd850e8a6e3da57260d52a9d03179e86e621295553a5a3acf88a303cc82f1ca0df3556f007

Download Submit
C:\Windows\System\vxLVmpF.exe

Filesize
1.4MB

MD5
b680305f93a0419b8cb6651ce8c24d48

SHA1
59f0035909e4e24aa5f47eeb0078d0d2cb64689e

SHA256
dd00cb10870dbf9f3a4f61ef330e3bb571cc28df2c89710f0a9b1b84ad7a0940

SHA512
c2a97ab09e7885b64a8855b73e2a831e0bb70630ce677099653bd8f7a5c1d2a9bdce977a815219283b478b5f8b3beeb29f94b534f19c44eb5683b5132aadc6f1

Download Submit
C:\Windows\System\wmPoWgh.exe

Filesize
1.4MB

MD5
5634729b4c9d2fe7323d651b5f21e1e7

SHA1
ea4c7bf72e9bc4c0dfa910e31fcfa09ebd71f145

SHA256
ee84295c1c90c01463d644406be6846815755c9bf8d4d5f0e17be0762b10bbd7

SHA512
79987023e5e2b76138a0ef0fe10e7941ae1fc64fecec5bb2ffb65a9dc04ec49db8cc7dd0266a17701cc60a1978abafa76e8d94c0cb30709e31cff21412c2b8ac

Download Submit
memory/1080-321-0x00007FF7E3AB0000-0x00007FF7E3EA2000-memory.dmp

Filesize
3.9MB

Download
memory/1360-1540-0x00007FF7FCED0000-0x00007FF7FD2C2000-memory.dmp

Filesize
3.9MB

Download
memory/1360-7286-0x00007FF7FCED0000-0x00007FF7FD2C2000-memory.dmp

Filesize
3.9MB

Download
memory/1432-693-0x00007FF62A180000-0x00007FF62A572000-memory.dmp

Filesize
3.9MB

Download
memory/1432-7303-0x00007FF62A180000-0x00007FF62A572000-memory.dmp

Filesize
3.9MB

Download
memory/1628-1127-0x00007FF71C490000-0x00007FF71C882000-memory.dmp

Filesize
3.9MB

Download
memory/1708-7306-0x00007FF7E8460000-0x00007FF7E8852000-memory.dmp

Filesize
3.9MB

Download
memory/1708-1383-0x00007FF7E8460000-0x00007FF7E8852000-memory.dmp

Filesize
3.9MB

Download
memory/1776-7365-0x00007FF631ED0000-0x00007FF6322C2000-memory.dmp

Filesize
3.9MB

Download
memory/1776-802-0x00007FF631ED0000-0x00007FF6322C2000-memory.dmp

Filesize
3.9MB

Download
memory/1780-7289-0x00007FF6B4E90000-0x00007FF6B5282000-memory.dmp

Filesize
3.9MB

Download
memory/1780-477-0x00007FF6B4E90000-0x00007FF6B5282000-memory.dmp

Filesize
3.9MB

Download
memory/1980-445-0x00007FF7271C0000-0x00007FF7275B2000-memory.dmp

Filesize
3.9MB

Download
memory/2356-1542-0x00007FF629BC0000-0x00007FF629FB2000-memory.dmp

Filesize
3.9MB

Download
memory/2744-56-0x00007FF614820000-0x00007FF614C12000-memory.dmp

Filesize
3.9MB

Download
memory/2744-6050-0x00007FF614820000-0x00007FF614C12000-memory.dmp

Filesize
3.9MB

Download
memory/2932-807-0x00007FF62C5A0000-0x00007FF62C992000-memory.dmp

Filesize
3.9MB

Download
memory/2932-7280-0x00007FF62C5A0000-0x00007FF62C992000-memory.dmp

Filesize
3.9MB

Download
memory/2952-399-0x00000191C1F40000-0x00000191C1F62000-memory.dmp

Filesize
136KB

Download
memory/2952-2773-0x00007FFC9CC10000-0x00007FFC9D6D1000-memory.dmp

Filesize
10.8MB

Download
memory/2952-247-0x00007FFC9CC10000-0x00007FFC9D6D1000-memory.dmp

Filesize
10.8MB

Download
memory/2952-198-0x00007FFC9CC10000-0x00007FFC9D6D1000-memory.dmp

Filesize
10.8MB

Download
memory/2952-57-0x00007FFC9CC13000-0x00007FFC9CC15000-memory.dmp

Filesize
8KB

Download
memory/3352-1384-0x00007FF692580000-0x00007FF692972000-memory.dmp

Filesize
3.9MB

Download
memory/3948-1128-0x00007FF7AA000000-0x00007FF7AA3F2000-memory.dmp

Filesize
3.9MB

Download
memory/3948-7322-0x00007FF7AA000000-0x00007FF7AA3F2000-memory.dmp

Filesize
3.9MB

Download
memory/3972-688-0x00007FF677000000-0x00007FF6773F2000-memory.dmp

Filesize
3.9MB

Download
memory/3972-7282-0x00007FF677000000-0x00007FF6773F2000-memory.dmp

Filesize
3.9MB

Download
memory/4060-461-0x00007FF7FD3D0000-0x00007FF7FD7C2000-memory.dmp

Filesize
3.9MB

Download
memory/4416-1541-0x00007FF76AB20000-0x00007FF76AF12000-memory.dmp

Filesize
3.9MB

Download
memory/4680-10-0x00007FF717500000-0x00007FF7178F2000-memory.dmp

Filesize
3.9MB

Download
memory/4680-7083-0x00007FF717500000-0x00007FF7178F2000-memory.dmp

Filesize
3.9MB

Download
memory/4808-0-0x00007FF7845C0000-0x00007FF7849B2000-memory.dmp

Filesize
3.9MB

Download
memory/4808-1-0x000001ACC6DE0000-0x000001ACC6DF0000-memory.dmp

Filesize
64KB

Download
memory/4928-7308-0x00007FF7CDC70000-0x00007FF7CE062000-memory.dmp

Filesize
3.9MB

Download
memory/4928-1649-0x00007FF7CDC70000-0x00007FF7CE062000-memory.dmp

Filesize
3.9MB

Download