xmrig | 82a04decb6fe60912a068928e1b943d9f89be653e408aa95f65be58c8559fdcb

Analysis

max time kernel
150s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
27/06/2024, 11:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

82a04decb6fe60912a068928e1b943d9f89be653e408aa95f65be58c8559fdcb_NeikiAnalytics.exe
Size

807KB
MD5

edd1a21770013b1540ed385847228d00
SHA1

5bfb208d89ffe36bc3d3e5a2954e5e0a80f9deba
SHA256

82a04decb6fe60912a068928e1b943d9f89be653e408aa95f65be58c8559fdcb
SHA512

252a9f28b58e65083c8cbef79e44988cafdf39f234f7d7b2982bb76f389bbc994308a6c17b445e175f1af96e1e3c91b6224b888c8bc28fe6e2a0bbef3fb0d0fe
SSDEEP

24576:zv3/fTLF671TilQFG4P5PmK/lzapp4p7e0IGI:Lz071uv4BPm6lu4pnm

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 39 IoCs

miner

resource	yara_rule
behavioral2/memory/3592-389-0x00007FF78BE80000-0x00007FF78C272000-memory.dmp	xmrig
behavioral2/memory/832-627-0x00007FF71EF00000-0x00007FF71F2F2000-memory.dmp	xmrig
behavioral2/memory/1696-623-0x00007FF7FD030000-0x00007FF7FD422000-memory.dmp	xmrig
behavioral2/memory/1584-694-0x00007FF73F070000-0x00007FF73F462000-memory.dmp	xmrig
behavioral2/memory/3712-762-0x00007FF63C510000-0x00007FF63C902000-memory.dmp	xmrig
behavioral2/memory/2112-1097-0x00007FF7D8EC0000-0x00007FF7D92B2000-memory.dmp	xmrig
behavioral2/memory/612-1512-0x00007FF620510000-0x00007FF620902000-memory.dmp	xmrig
behavioral2/memory/764-1733-0x00007FF715EC0000-0x00007FF7162B2000-memory.dmp	xmrig
behavioral2/memory/5036-1403-0x00007FF729FC0000-0x00007FF72A3B2000-memory.dmp	xmrig
behavioral2/memory/412-1244-0x00007FF7A1A20000-0x00007FF7A1E12000-memory.dmp	xmrig
behavioral2/memory/2588-1243-0x00007FF720FD0000-0x00007FF7213C2000-memory.dmp	xmrig
behavioral2/memory/4088-1093-0x00007FF691050000-0x00007FF691442000-memory.dmp	xmrig
behavioral2/memory/3448-1092-0x00007FF64EE50000-0x00007FF64F242000-memory.dmp	xmrig
behavioral2/memory/3772-1013-0x00007FF684130000-0x00007FF684522000-memory.dmp	xmrig
behavioral2/memory/1368-1012-0x00007FF78F7E0000-0x00007FF78FBD2000-memory.dmp	xmrig
behavioral2/memory/4692-767-0x00007FF791E50000-0x00007FF792242000-memory.dmp	xmrig
behavioral2/memory/2232-766-0x00007FF779A80000-0x00007FF779E72000-memory.dmp	xmrig
behavioral2/memory/4980-765-0x00007FF76B610000-0x00007FF76BA02000-memory.dmp	xmrig
behavioral2/memory/2740-764-0x00007FF78E9B0000-0x00007FF78EDA2000-memory.dmp	xmrig
behavioral2/memory/4336-763-0x00007FF6D7D20000-0x00007FF6D8112000-memory.dmp	xmrig
behavioral2/memory/2044-761-0x00007FF7CFEB0000-0x00007FF7D02A2000-memory.dmp	xmrig
behavioral2/memory/1712-760-0x00007FF694670000-0x00007FF694A62000-memory.dmp	xmrig
behavioral2/memory/1224-516-0x00007FF785D10000-0x00007FF786102000-memory.dmp	xmrig
behavioral2/memory/832-6082-0x00007FF71EF00000-0x00007FF71F2F2000-memory.dmp	xmrig
behavioral2/memory/764-6133-0x00007FF715EC0000-0x00007FF7162B2000-memory.dmp	xmrig
behavioral2/memory/516-6183-0x00007FF71D6A0000-0x00007FF71DA92000-memory.dmp	xmrig
behavioral2/memory/5036-6306-0x00007FF729FC0000-0x00007FF72A3B2000-memory.dmp	xmrig
behavioral2/memory/2232-6509-0x00007FF779A80000-0x00007FF779E72000-memory.dmp	xmrig
behavioral2/memory/2044-6544-0x00007FF7CFEB0000-0x00007FF7D02A2000-memory.dmp	xmrig
behavioral2/memory/2112-6543-0x00007FF7D8EC0000-0x00007FF7D92B2000-memory.dmp	xmrig
behavioral2/memory/2740-6564-0x00007FF78E9B0000-0x00007FF78EDA2000-memory.dmp	xmrig
behavioral2/memory/2588-6511-0x00007FF720FD0000-0x00007FF7213C2000-memory.dmp	xmrig
behavioral2/memory/4088-6502-0x00007FF691050000-0x00007FF691442000-memory.dmp	xmrig
behavioral2/memory/4692-6508-0x00007FF791E50000-0x00007FF792242000-memory.dmp	xmrig
behavioral2/memory/3712-6504-0x00007FF63C510000-0x00007FF63C902000-memory.dmp	xmrig
behavioral2/memory/4336-6503-0x00007FF6D7D20000-0x00007FF6D8112000-memory.dmp	xmrig
behavioral2/memory/1368-6457-0x00007FF78F7E0000-0x00007FF78FBD2000-memory.dmp	xmrig
behavioral2/memory/412-6499-0x00007FF7A1A20000-0x00007FF7A1E12000-memory.dmp	xmrig
behavioral2/memory/612-6239-0x00007FF620510000-0x00007FF620902000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
4852	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
3592	gAmKaHK.exe
1224	DhJSEDt.exe
764	Owopccl.exe
1696	taXrHtH.exe
832	dzVfAqK.exe
1584	DBOxNqr.exe
1712	UzmVAlm.exe
2044	WXVGTFG.exe
3712	MnlAFdN.exe
4336	HulXbBW.exe
2740	PgsSNpK.exe
4980	NCxVPBU.exe
2232	NaNAKDN.exe
4692	ZxwBNjS.exe
1368	logRqyJ.exe
3772	usCjpRb.exe
3448	TEzJdtD.exe
4088	yfwRfpa.exe
516	zoxoGjd.exe
2112	llxzrFv.exe
2588	rnLnQkT.exe
412	rjNxOwS.exe
5036	xuxHFuf.exe
612	lPKUNuA.exe
812	rxbOSEc.exe
1512	fCpWPfW.exe
2080	alvkeiR.exe
5056	BvEJEoI.exe
1764	QdYIuHk.exe
3036	LudgCVK.exe
4812	zobnbGl.exe
4908	JFYukFu.exe
2544	hgLXkfZ.exe
2168	AtNAAhn.exe
1784	nIvYWsX.exe
4880	TtyymdC.exe
1812	YxDFRpF.exe
1364	RjwdKQj.exe
2204	XKWDQbP.exe
3580	OxaBPnA.exe
2512	XvyAAQL.exe
3440	JODtCWD.exe
2920	SAhhENF.exe
1756	OxsQCFh.exe
1836	eqkEqgk.exe
396	oKSJVlb.exe
1660	cRtWjFq.exe
5016	oxNwpRn.exe
2688	IjsDRXd.exe
440	hagkMFb.exe
5088	KCsYxOz.exe
1952	RkNcOMI.exe
624	FCBAyBA.exe
4788	VqVXiKI.exe
4868	DLNeoZh.exe
3444	LNitJOH.exe
4936	FHWMzry.exe
3512	YbXAzjI.exe
3612	PRXXylx.exe
5072	KZjJayT.exe
1172	BYreOsB.exe
2480	uXMdHDX.exe
3716	CcKSRfE.exe
4532	jRqTypH.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1020-0-0x00007FF690770000-0x00007FF690B62000-memory.dmp	upx
behavioral2/files/0x0007000000023432-8.dat	upx
behavioral2/files/0x0007000000023433-17.dat	upx
behavioral2/files/0x000900000002342e-12.dat	upx
behavioral2/files/0x000500000002328d-9.dat	upx
behavioral2/files/0x0007000000023435-114.dat	upx
behavioral2/files/0x0007000000023453-176.dat	upx
behavioral2/memory/3592-389-0x00007FF78BE80000-0x00007FF78C272000-memory.dmp	upx
behavioral2/memory/832-627-0x00007FF71EF00000-0x00007FF71F2F2000-memory.dmp	upx
behavioral2/memory/1696-623-0x00007FF7FD030000-0x00007FF7FD422000-memory.dmp	upx
behavioral2/memory/1584-694-0x00007FF73F070000-0x00007FF73F462000-memory.dmp	upx
behavioral2/memory/3712-762-0x00007FF63C510000-0x00007FF63C902000-memory.dmp	upx
behavioral2/memory/2112-1097-0x00007FF7D8EC0000-0x00007FF7D92B2000-memory.dmp	upx
behavioral2/memory/612-1512-0x00007FF620510000-0x00007FF620902000-memory.dmp	upx
behavioral2/memory/764-1733-0x00007FF715EC0000-0x00007FF7162B2000-memory.dmp	upx
behavioral2/memory/5036-1403-0x00007FF729FC0000-0x00007FF72A3B2000-memory.dmp	upx
behavioral2/memory/412-1244-0x00007FF7A1A20000-0x00007FF7A1E12000-memory.dmp	upx
behavioral2/memory/2588-1243-0x00007FF720FD0000-0x00007FF7213C2000-memory.dmp	upx
behavioral2/memory/4088-1093-0x00007FF691050000-0x00007FF691442000-memory.dmp	upx
behavioral2/memory/3448-1092-0x00007FF64EE50000-0x00007FF64F242000-memory.dmp	upx
behavioral2/memory/3772-1013-0x00007FF684130000-0x00007FF684522000-memory.dmp	upx
behavioral2/memory/1368-1012-0x00007FF78F7E0000-0x00007FF78FBD2000-memory.dmp	upx
behavioral2/memory/4692-767-0x00007FF791E50000-0x00007FF792242000-memory.dmp	upx
behavioral2/memory/2232-766-0x00007FF779A80000-0x00007FF779E72000-memory.dmp	upx
behavioral2/memory/4980-765-0x00007FF76B610000-0x00007FF76BA02000-memory.dmp	upx
behavioral2/memory/2740-764-0x00007FF78E9B0000-0x00007FF78EDA2000-memory.dmp	upx
behavioral2/memory/4336-763-0x00007FF6D7D20000-0x00007FF6D8112000-memory.dmp	upx
behavioral2/memory/2044-761-0x00007FF7CFEB0000-0x00007FF7D02A2000-memory.dmp	upx
behavioral2/memory/1712-760-0x00007FF694670000-0x00007FF694A62000-memory.dmp	upx
behavioral2/memory/1224-516-0x00007FF785D10000-0x00007FF786102000-memory.dmp	upx
behavioral2/files/0x000700000002345e-204.dat	upx
behavioral2/files/0x000700000002345d-203.dat	upx
behavioral2/files/0x000700000002345c-202.dat	upx
behavioral2/files/0x000700000002345b-201.dat	upx
behavioral2/files/0x0007000000023449-195.dat	upx
behavioral2/files/0x000700000002343b-193.dat	upx
behavioral2/files/0x0007000000023448-191.dat	upx
behavioral2/files/0x000700000002343e-190.dat	upx
behavioral2/files/0x000700000002343f-189.dat	upx
behavioral2/files/0x000700000002345a-186.dat	upx
behavioral2/files/0x0007000000023459-185.dat	upx
behavioral2/files/0x0007000000023458-184.dat	upx
behavioral2/files/0x0007000000023457-183.dat	upx
behavioral2/files/0x0007000000023454-180.dat	upx
behavioral2/files/0x000700000002343a-171.dat	upx
behavioral2/files/0x0007000000023439-170.dat	upx
behavioral2/files/0x0007000000023452-169.dat	upx
behavioral2/files/0x0007000000023438-168.dat	upx
behavioral2/files/0x0007000000023451-167.dat	upx
behavioral2/files/0x0007000000023450-160.dat	upx
behavioral2/files/0x000700000002344e-155.dat	upx
behavioral2/files/0x000700000002344c-154.dat	upx
behavioral2/files/0x000700000002344d-148.dat	upx
behavioral2/files/0x000700000002344b-142.dat	upx
behavioral2/files/0x000700000002344a-140.dat	upx
behavioral2/files/0x0007000000023436-132.dat	upx
behavioral2/files/0x0007000000023447-130.dat	upx
behavioral2/files/0x0007000000023446-109.dat	upx
behavioral2/files/0x0007000000023445-105.dat	upx
behavioral2/files/0x0007000000023444-104.dat	upx
behavioral2/files/0x0007000000023443-103.dat	upx
behavioral2/files/0x0007000000023442-99.dat	upx
behavioral2/files/0x0007000000023441-158.dat	upx
behavioral2/files/0x0007000000023440-86.dat	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\fZroaxo.exe	82a04decb6fe60912a068928e1b943d9f89be653e408aa95f65be58c8559fdcb_NeikiAnalytics.exe
File created	C:\Windows\System\nOoSbAD.exe	82a04decb6fe60912a068928e1b943d9f89be653e408aa95f65be58c8559fdcb_NeikiAnalytics.exe
File created	C:\Windows\System\sIauVCM.exe	82a04decb6fe60912a068928e1b943d9f89be653e408aa95f65be58c8559fdcb_NeikiAnalytics.exe
File created	C:\Windows\System\NXweCVt.exe	82a04decb6fe60912a068928e1b943d9f89be653e408aa95f65be58c8559fdcb_NeikiAnalytics.exe
File created	C:\Windows\System\PPWFlYc.exe	82a04decb6fe60912a068928e1b943d9f89be653e408aa95f65be58c8559fdcb_NeikiAnalytics.exe
File created	C:\Windows\System\pnpVwcn.exe	82a04decb6fe60912a068928e1b943d9f89be653e408aa95f65be58c8559fdcb_NeikiAnalytics.exe
File created	C:\Windows\System\OmTlWYs.exe	82a04decb6fe60912a068928e1b943d9f89be653e408aa95f65be58c8559fdcb_NeikiAnalytics.exe
File created	C:\Windows\System\juLhSen.exe	82a04decb6fe60912a068928e1b943d9f89be653e408aa95f65be58c8559fdcb_NeikiAnalytics.exe
File created	C:\Windows\System\VdgQQap.exe	82a04decb6fe60912a068928e1b943d9f89be653e408aa95f65be58c8559fdcb_NeikiAnalytics.exe
File created	C:\Windows\System\MGnMMAm.exe	82a04decb6fe60912a068928e1b943d9f89be653e408aa95f65be58c8559fdcb_NeikiAnalytics.exe
File created	C:\Windows\System\jcAPPJQ.exe	82a04decb6fe60912a068928e1b943d9f89be653e408aa95f65be58c8559fdcb_NeikiAnalytics.exe
File created	C:\Windows\System\snMqljx.exe	82a04decb6fe60912a068928e1b943d9f89be653e408aa95f65be58c8559fdcb_NeikiAnalytics.exe
File created	C:\Windows\System\CVxjKFk.exe	82a04decb6fe60912a068928e1b943d9f89be653e408aa95f65be58c8559fdcb_NeikiAnalytics.exe
File created	C:\Windows\System\XzljVmY.exe	82a04decb6fe60912a068928e1b943d9f89be653e408aa95f65be58c8559fdcb_NeikiAnalytics.exe
File created	C:\Windows\System\hzinwVP.exe	82a04decb6fe60912a068928e1b943d9f89be653e408aa95f65be58c8559fdcb_NeikiAnalytics.exe
File created	C:\Windows\System\qrgPKFF.exe	82a04decb6fe60912a068928e1b943d9f89be653e408aa95f65be58c8559fdcb_NeikiAnalytics.exe
File created	C:\Windows\System\BdQrCnM.exe	82a04decb6fe60912a068928e1b943d9f89be653e408aa95f65be58c8559fdcb_NeikiAnalytics.exe
File created	C:\Windows\System\AXoMbgG.exe	82a04decb6fe60912a068928e1b943d9f89be653e408aa95f65be58c8559fdcb_NeikiAnalytics.exe
File created	C:\Windows\System\XbwTRNb.exe	82a04decb6fe60912a068928e1b943d9f89be653e408aa95f65be58c8559fdcb_NeikiAnalytics.exe
File created	C:\Windows\System\HkpaNkw.exe	82a04decb6fe60912a068928e1b943d9f89be653e408aa95f65be58c8559fdcb_NeikiAnalytics.exe
File created	C:\Windows\System\aTBtCTs.exe	82a04decb6fe60912a068928e1b943d9f89be653e408aa95f65be58c8559fdcb_NeikiAnalytics.exe
File created	C:\Windows\System\mFLegdX.exe	82a04decb6fe60912a068928e1b943d9f89be653e408aa95f65be58c8559fdcb_NeikiAnalytics.exe
File created	C:\Windows\System\eIHqMmS.exe	82a04decb6fe60912a068928e1b943d9f89be653e408aa95f65be58c8559fdcb_NeikiAnalytics.exe
File created	C:\Windows\System\FePfJcF.exe	82a04decb6fe60912a068928e1b943d9f89be653e408aa95f65be58c8559fdcb_NeikiAnalytics.exe
File created	C:\Windows\System\rePEKvc.exe	82a04decb6fe60912a068928e1b943d9f89be653e408aa95f65be58c8559fdcb_NeikiAnalytics.exe
File created	C:\Windows\System\UaHdgLi.exe	82a04decb6fe60912a068928e1b943d9f89be653e408aa95f65be58c8559fdcb_NeikiAnalytics.exe
File created	C:\Windows\System\RkaKGEb.exe	82a04decb6fe60912a068928e1b943d9f89be653e408aa95f65be58c8559fdcb_NeikiAnalytics.exe
File created	C:\Windows\System\rGfTqhh.exe	82a04decb6fe60912a068928e1b943d9f89be653e408aa95f65be58c8559fdcb_NeikiAnalytics.exe
File created	C:\Windows\System\oREweSr.exe	82a04decb6fe60912a068928e1b943d9f89be653e408aa95f65be58c8559fdcb_NeikiAnalytics.exe
File created	C:\Windows\System\aflcisn.exe	82a04decb6fe60912a068928e1b943d9f89be653e408aa95f65be58c8559fdcb_NeikiAnalytics.exe
File created	C:\Windows\System\sFjvzpW.exe	82a04decb6fe60912a068928e1b943d9f89be653e408aa95f65be58c8559fdcb_NeikiAnalytics.exe
File created	C:\Windows\System\APzANrt.exe	82a04decb6fe60912a068928e1b943d9f89be653e408aa95f65be58c8559fdcb_NeikiAnalytics.exe
File created	C:\Windows\System\UavGlNw.exe	82a04decb6fe60912a068928e1b943d9f89be653e408aa95f65be58c8559fdcb_NeikiAnalytics.exe
File created	C:\Windows\System\ZgjBAAP.exe	82a04decb6fe60912a068928e1b943d9f89be653e408aa95f65be58c8559fdcb_NeikiAnalytics.exe
File created	C:\Windows\System\DztIQFq.exe	82a04decb6fe60912a068928e1b943d9f89be653e408aa95f65be58c8559fdcb_NeikiAnalytics.exe
File created	C:\Windows\System\jcpgXng.exe	82a04decb6fe60912a068928e1b943d9f89be653e408aa95f65be58c8559fdcb_NeikiAnalytics.exe
File created	C:\Windows\System\axLixxP.exe	82a04decb6fe60912a068928e1b943d9f89be653e408aa95f65be58c8559fdcb_NeikiAnalytics.exe
File created	C:\Windows\System\yuqXpYU.exe	82a04decb6fe60912a068928e1b943d9f89be653e408aa95f65be58c8559fdcb_NeikiAnalytics.exe
File created	C:\Windows\System\ewgpILD.exe	82a04decb6fe60912a068928e1b943d9f89be653e408aa95f65be58c8559fdcb_NeikiAnalytics.exe
File created	C:\Windows\System\hertxlH.exe	82a04decb6fe60912a068928e1b943d9f89be653e408aa95f65be58c8559fdcb_NeikiAnalytics.exe
File created	C:\Windows\System\hHiZqsn.exe	82a04decb6fe60912a068928e1b943d9f89be653e408aa95f65be58c8559fdcb_NeikiAnalytics.exe
File created	C:\Windows\System\vFPmqWJ.exe	82a04decb6fe60912a068928e1b943d9f89be653e408aa95f65be58c8559fdcb_NeikiAnalytics.exe
File created	C:\Windows\System\hfugENn.exe	82a04decb6fe60912a068928e1b943d9f89be653e408aa95f65be58c8559fdcb_NeikiAnalytics.exe
File created	C:\Windows\System\SSTjdbE.exe	82a04decb6fe60912a068928e1b943d9f89be653e408aa95f65be58c8559fdcb_NeikiAnalytics.exe
File created	C:\Windows\System\lonYmZm.exe	82a04decb6fe60912a068928e1b943d9f89be653e408aa95f65be58c8559fdcb_NeikiAnalytics.exe
File created	C:\Windows\System\EKogqrU.exe	82a04decb6fe60912a068928e1b943d9f89be653e408aa95f65be58c8559fdcb_NeikiAnalytics.exe
File created	C:\Windows\System\nqNmzcW.exe	82a04decb6fe60912a068928e1b943d9f89be653e408aa95f65be58c8559fdcb_NeikiAnalytics.exe
File created	C:\Windows\System\SubIHHk.exe	82a04decb6fe60912a068928e1b943d9f89be653e408aa95f65be58c8559fdcb_NeikiAnalytics.exe
File created	C:\Windows\System\GvOBMUi.exe	82a04decb6fe60912a068928e1b943d9f89be653e408aa95f65be58c8559fdcb_NeikiAnalytics.exe
File created	C:\Windows\System\VBRdxbJ.exe	82a04decb6fe60912a068928e1b943d9f89be653e408aa95f65be58c8559fdcb_NeikiAnalytics.exe
File created	C:\Windows\System\vaJjxdI.exe	82a04decb6fe60912a068928e1b943d9f89be653e408aa95f65be58c8559fdcb_NeikiAnalytics.exe
File created	C:\Windows\System\fFekWkx.exe	82a04decb6fe60912a068928e1b943d9f89be653e408aa95f65be58c8559fdcb_NeikiAnalytics.exe
File created	C:\Windows\System\EcLWCfI.exe	82a04decb6fe60912a068928e1b943d9f89be653e408aa95f65be58c8559fdcb_NeikiAnalytics.exe
File created	C:\Windows\System\yUfFZjZ.exe	82a04decb6fe60912a068928e1b943d9f89be653e408aa95f65be58c8559fdcb_NeikiAnalytics.exe
File created	C:\Windows\System\FiVcWWS.exe	82a04decb6fe60912a068928e1b943d9f89be653e408aa95f65be58c8559fdcb_NeikiAnalytics.exe
File created	C:\Windows\System\CisUvHt.exe	82a04decb6fe60912a068928e1b943d9f89be653e408aa95f65be58c8559fdcb_NeikiAnalytics.exe
File created	C:\Windows\System\ZyidIgA.exe	82a04decb6fe60912a068928e1b943d9f89be653e408aa95f65be58c8559fdcb_NeikiAnalytics.exe
File created	C:\Windows\System\CsQFzeh.exe	82a04decb6fe60912a068928e1b943d9f89be653e408aa95f65be58c8559fdcb_NeikiAnalytics.exe
File created	C:\Windows\System\KBqEbOx.exe	82a04decb6fe60912a068928e1b943d9f89be653e408aa95f65be58c8559fdcb_NeikiAnalytics.exe
File created	C:\Windows\System\amPKAxR.exe	82a04decb6fe60912a068928e1b943d9f89be653e408aa95f65be58c8559fdcb_NeikiAnalytics.exe
File created	C:\Windows\System\aXysFZD.exe	82a04decb6fe60912a068928e1b943d9f89be653e408aa95f65be58c8559fdcb_NeikiAnalytics.exe
File created	C:\Windows\System\UMCCskS.exe	82a04decb6fe60912a068928e1b943d9f89be653e408aa95f65be58c8559fdcb_NeikiAnalytics.exe
File created	C:\Windows\System\BayVAmi.exe	82a04decb6fe60912a068928e1b943d9f89be653e408aa95f65be58c8559fdcb_NeikiAnalytics.exe
File created	C:\Windows\System\cbYLSQP.exe	82a04decb6fe60912a068928e1b943d9f89be653e408aa95f65be58c8559fdcb_NeikiAnalytics.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
4852	powershell.exe
4852	powershell.exe
4852	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4852	powershell.exe
Token: SeLockMemoryPrivilege	1020	82a04decb6fe60912a068928e1b943d9f89be653e408aa95f65be58c8559fdcb_NeikiAnalytics.exe
Token: SeLockMemoryPrivilege	1020	82a04decb6fe60912a068928e1b943d9f89be653e408aa95f65be58c8559fdcb_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1020 wrote to memory of 4852	1020	82a04decb6fe60912a068928e1b943d9f89be653e408aa95f65be58c8559fdcb_NeikiAnalytics.exe	81
PID 1020 wrote to memory of 4852	1020	82a04decb6fe60912a068928e1b943d9f89be653e408aa95f65be58c8559fdcb_NeikiAnalytics.exe	81
PID 1020 wrote to memory of 3592	1020	82a04decb6fe60912a068928e1b943d9f89be653e408aa95f65be58c8559fdcb_NeikiAnalytics.exe	82
PID 1020 wrote to memory of 3592	1020	82a04decb6fe60912a068928e1b943d9f89be653e408aa95f65be58c8559fdcb_NeikiAnalytics.exe	82
PID 1020 wrote to memory of 1224	1020	82a04decb6fe60912a068928e1b943d9f89be653e408aa95f65be58c8559fdcb_NeikiAnalytics.exe	83
PID 1020 wrote to memory of 1224	1020	82a04decb6fe60912a068928e1b943d9f89be653e408aa95f65be58c8559fdcb_NeikiAnalytics.exe	83
PID 1020 wrote to memory of 764	1020	82a04decb6fe60912a068928e1b943d9f89be653e408aa95f65be58c8559fdcb_NeikiAnalytics.exe	84
PID 1020 wrote to memory of 764	1020	82a04decb6fe60912a068928e1b943d9f89be653e408aa95f65be58c8559fdcb_NeikiAnalytics.exe	84
PID 1020 wrote to memory of 1696	1020	82a04decb6fe60912a068928e1b943d9f89be653e408aa95f65be58c8559fdcb_NeikiAnalytics.exe	85
PID 1020 wrote to memory of 1696	1020	82a04decb6fe60912a068928e1b943d9f89be653e408aa95f65be58c8559fdcb_NeikiAnalytics.exe	85
PID 1020 wrote to memory of 832	1020	82a04decb6fe60912a068928e1b943d9f89be653e408aa95f65be58c8559fdcb_NeikiAnalytics.exe	86
PID 1020 wrote to memory of 832	1020	82a04decb6fe60912a068928e1b943d9f89be653e408aa95f65be58c8559fdcb_NeikiAnalytics.exe	86
PID 1020 wrote to memory of 1584	1020	82a04decb6fe60912a068928e1b943d9f89be653e408aa95f65be58c8559fdcb_NeikiAnalytics.exe	87
PID 1020 wrote to memory of 1584	1020	82a04decb6fe60912a068928e1b943d9f89be653e408aa95f65be58c8559fdcb_NeikiAnalytics.exe	87
PID 1020 wrote to memory of 1712	1020	82a04decb6fe60912a068928e1b943d9f89be653e408aa95f65be58c8559fdcb_NeikiAnalytics.exe	88
PID 1020 wrote to memory of 1712	1020	82a04decb6fe60912a068928e1b943d9f89be653e408aa95f65be58c8559fdcb_NeikiAnalytics.exe	88
PID 1020 wrote to memory of 2044	1020	82a04decb6fe60912a068928e1b943d9f89be653e408aa95f65be58c8559fdcb_NeikiAnalytics.exe	89
PID 1020 wrote to memory of 2044	1020	82a04decb6fe60912a068928e1b943d9f89be653e408aa95f65be58c8559fdcb_NeikiAnalytics.exe	89
PID 1020 wrote to memory of 3712	1020	82a04decb6fe60912a068928e1b943d9f89be653e408aa95f65be58c8559fdcb_NeikiAnalytics.exe	90
PID 1020 wrote to memory of 3712	1020	82a04decb6fe60912a068928e1b943d9f89be653e408aa95f65be58c8559fdcb_NeikiAnalytics.exe	90
PID 1020 wrote to memory of 4336	1020	82a04decb6fe60912a068928e1b943d9f89be653e408aa95f65be58c8559fdcb_NeikiAnalytics.exe	91
PID 1020 wrote to memory of 4336	1020	82a04decb6fe60912a068928e1b943d9f89be653e408aa95f65be58c8559fdcb_NeikiAnalytics.exe	91
PID 1020 wrote to memory of 2740	1020	82a04decb6fe60912a068928e1b943d9f89be653e408aa95f65be58c8559fdcb_NeikiAnalytics.exe	92
PID 1020 wrote to memory of 2740	1020	82a04decb6fe60912a068928e1b943d9f89be653e408aa95f65be58c8559fdcb_NeikiAnalytics.exe	92
PID 1020 wrote to memory of 4980	1020	82a04decb6fe60912a068928e1b943d9f89be653e408aa95f65be58c8559fdcb_NeikiAnalytics.exe	93
PID 1020 wrote to memory of 4980	1020	82a04decb6fe60912a068928e1b943d9f89be653e408aa95f65be58c8559fdcb_NeikiAnalytics.exe	93
PID 1020 wrote to memory of 2232	1020	82a04decb6fe60912a068928e1b943d9f89be653e408aa95f65be58c8559fdcb_NeikiAnalytics.exe	94
PID 1020 wrote to memory of 2232	1020	82a04decb6fe60912a068928e1b943d9f89be653e408aa95f65be58c8559fdcb_NeikiAnalytics.exe	94
PID 1020 wrote to memory of 4692	1020	82a04decb6fe60912a068928e1b943d9f89be653e408aa95f65be58c8559fdcb_NeikiAnalytics.exe	95
PID 1020 wrote to memory of 4692	1020	82a04decb6fe60912a068928e1b943d9f89be653e408aa95f65be58c8559fdcb_NeikiAnalytics.exe	95
PID 1020 wrote to memory of 1368	1020	82a04decb6fe60912a068928e1b943d9f89be653e408aa95f65be58c8559fdcb_NeikiAnalytics.exe	96
PID 1020 wrote to memory of 1368	1020	82a04decb6fe60912a068928e1b943d9f89be653e408aa95f65be58c8559fdcb_NeikiAnalytics.exe	96
PID 1020 wrote to memory of 3772	1020	82a04decb6fe60912a068928e1b943d9f89be653e408aa95f65be58c8559fdcb_NeikiAnalytics.exe	97
PID 1020 wrote to memory of 3772	1020	82a04decb6fe60912a068928e1b943d9f89be653e408aa95f65be58c8559fdcb_NeikiAnalytics.exe	97
PID 1020 wrote to memory of 3448	1020	82a04decb6fe60912a068928e1b943d9f89be653e408aa95f65be58c8559fdcb_NeikiAnalytics.exe	98
PID 1020 wrote to memory of 3448	1020	82a04decb6fe60912a068928e1b943d9f89be653e408aa95f65be58c8559fdcb_NeikiAnalytics.exe	98
PID 1020 wrote to memory of 4088	1020	82a04decb6fe60912a068928e1b943d9f89be653e408aa95f65be58c8559fdcb_NeikiAnalytics.exe	99
PID 1020 wrote to memory of 4088	1020	82a04decb6fe60912a068928e1b943d9f89be653e408aa95f65be58c8559fdcb_NeikiAnalytics.exe	99
PID 1020 wrote to memory of 516	1020	82a04decb6fe60912a068928e1b943d9f89be653e408aa95f65be58c8559fdcb_NeikiAnalytics.exe	100
PID 1020 wrote to memory of 516	1020	82a04decb6fe60912a068928e1b943d9f89be653e408aa95f65be58c8559fdcb_NeikiAnalytics.exe	100
PID 1020 wrote to memory of 2112	1020	82a04decb6fe60912a068928e1b943d9f89be653e408aa95f65be58c8559fdcb_NeikiAnalytics.exe	101
PID 1020 wrote to memory of 2112	1020	82a04decb6fe60912a068928e1b943d9f89be653e408aa95f65be58c8559fdcb_NeikiAnalytics.exe	101
PID 1020 wrote to memory of 2588	1020	82a04decb6fe60912a068928e1b943d9f89be653e408aa95f65be58c8559fdcb_NeikiAnalytics.exe	102
PID 1020 wrote to memory of 2588	1020	82a04decb6fe60912a068928e1b943d9f89be653e408aa95f65be58c8559fdcb_NeikiAnalytics.exe	102
PID 1020 wrote to memory of 412	1020	82a04decb6fe60912a068928e1b943d9f89be653e408aa95f65be58c8559fdcb_NeikiAnalytics.exe	103
PID 1020 wrote to memory of 412	1020	82a04decb6fe60912a068928e1b943d9f89be653e408aa95f65be58c8559fdcb_NeikiAnalytics.exe	103
PID 1020 wrote to memory of 5036	1020	82a04decb6fe60912a068928e1b943d9f89be653e408aa95f65be58c8559fdcb_NeikiAnalytics.exe	104
PID 1020 wrote to memory of 5036	1020	82a04decb6fe60912a068928e1b943d9f89be653e408aa95f65be58c8559fdcb_NeikiAnalytics.exe	104
PID 1020 wrote to memory of 612	1020	82a04decb6fe60912a068928e1b943d9f89be653e408aa95f65be58c8559fdcb_NeikiAnalytics.exe	105
PID 1020 wrote to memory of 612	1020	82a04decb6fe60912a068928e1b943d9f89be653e408aa95f65be58c8559fdcb_NeikiAnalytics.exe	105
PID 1020 wrote to memory of 2204	1020	82a04decb6fe60912a068928e1b943d9f89be653e408aa95f65be58c8559fdcb_NeikiAnalytics.exe	106
PID 1020 wrote to memory of 2204	1020	82a04decb6fe60912a068928e1b943d9f89be653e408aa95f65be58c8559fdcb_NeikiAnalytics.exe	106
PID 1020 wrote to memory of 3580	1020	82a04decb6fe60912a068928e1b943d9f89be653e408aa95f65be58c8559fdcb_NeikiAnalytics.exe	107
PID 1020 wrote to memory of 3580	1020	82a04decb6fe60912a068928e1b943d9f89be653e408aa95f65be58c8559fdcb_NeikiAnalytics.exe	107
PID 1020 wrote to memory of 812	1020	82a04decb6fe60912a068928e1b943d9f89be653e408aa95f65be58c8559fdcb_NeikiAnalytics.exe	108
PID 1020 wrote to memory of 812	1020	82a04decb6fe60912a068928e1b943d9f89be653e408aa95f65be58c8559fdcb_NeikiAnalytics.exe	108
PID 1020 wrote to memory of 1512	1020	82a04decb6fe60912a068928e1b943d9f89be653e408aa95f65be58c8559fdcb_NeikiAnalytics.exe	109
PID 1020 wrote to memory of 1512	1020	82a04decb6fe60912a068928e1b943d9f89be653e408aa95f65be58c8559fdcb_NeikiAnalytics.exe	109
PID 1020 wrote to memory of 2080	1020	82a04decb6fe60912a068928e1b943d9f89be653e408aa95f65be58c8559fdcb_NeikiAnalytics.exe	110
PID 1020 wrote to memory of 2080	1020	82a04decb6fe60912a068928e1b943d9f89be653e408aa95f65be58c8559fdcb_NeikiAnalytics.exe	110
PID 1020 wrote to memory of 5056	1020	82a04decb6fe60912a068928e1b943d9f89be653e408aa95f65be58c8559fdcb_NeikiAnalytics.exe	111
PID 1020 wrote to memory of 5056	1020	82a04decb6fe60912a068928e1b943d9f89be653e408aa95f65be58c8559fdcb_NeikiAnalytics.exe	111
PID 1020 wrote to memory of 1764	1020	82a04decb6fe60912a068928e1b943d9f89be653e408aa95f65be58c8559fdcb_NeikiAnalytics.exe	112
PID 1020 wrote to memory of 1764	1020	82a04decb6fe60912a068928e1b943d9f89be653e408aa95f65be58c8559fdcb_NeikiAnalytics.exe	112

C:\Users\Admin\AppData\Local\Temp\82a04decb6fe60912a068928e1b943d9f89be653e408aa95f65be58c8559fdcb_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\82a04decb6fe60912a068928e1b943d9f89be653e408aa95f65be58c8559fdcb_NeikiAnalytics.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1020
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4852
- C:\Windows\System\gAmKaHK.exe
  C:\Windows\System\gAmKaHK.exe
  2⤵
  - Executes dropped EXE
  PID:3592
- C:\Windows\System\DhJSEDt.exe
  C:\Windows\System\DhJSEDt.exe
  2⤵
  - Executes dropped EXE
  PID:1224
- C:\Windows\System\Owopccl.exe
  C:\Windows\System\Owopccl.exe
  2⤵
  - Executes dropped EXE
  PID:764
- C:\Windows\System\taXrHtH.exe
  C:\Windows\System\taXrHtH.exe
  2⤵
  - Executes dropped EXE
  PID:1696
- C:\Windows\System\dzVfAqK.exe
  C:\Windows\System\dzVfAqK.exe
  2⤵
  - Executes dropped EXE
  PID:832
- C:\Windows\System\DBOxNqr.exe
  C:\Windows\System\DBOxNqr.exe
  2⤵
  - Executes dropped EXE
  PID:1584
- C:\Windows\System\UzmVAlm.exe
  C:\Windows\System\UzmVAlm.exe
  2⤵
  - Executes dropped EXE
  PID:1712
- C:\Windows\System\WXVGTFG.exe
  C:\Windows\System\WXVGTFG.exe
  2⤵
  - Executes dropped EXE
  PID:2044
- C:\Windows\System\MnlAFdN.exe
  C:\Windows\System\MnlAFdN.exe
  2⤵
  - Executes dropped EXE
  PID:3712
- C:\Windows\System\HulXbBW.exe
  C:\Windows\System\HulXbBW.exe
  2⤵
  - Executes dropped EXE
  PID:4336
- C:\Windows\System\PgsSNpK.exe
  C:\Windows\System\PgsSNpK.exe
  2⤵
  - Executes dropped EXE
  PID:2740
- C:\Windows\System\NCxVPBU.exe
  C:\Windows\System\NCxVPBU.exe
  2⤵
  - Executes dropped EXE
  PID:4980
- C:\Windows\System\NaNAKDN.exe
  C:\Windows\System\NaNAKDN.exe
  2⤵
  - Executes dropped EXE
  PID:2232
- C:\Windows\System\ZxwBNjS.exe
  C:\Windows\System\ZxwBNjS.exe
  2⤵
  - Executes dropped EXE
  PID:4692
- C:\Windows\System\logRqyJ.exe
  C:\Windows\System\logRqyJ.exe
  2⤵
  - Executes dropped EXE
  PID:1368
- C:\Windows\System\usCjpRb.exe
  C:\Windows\System\usCjpRb.exe
  2⤵
  - Executes dropped EXE
  PID:3772
- C:\Windows\System\TEzJdtD.exe
  C:\Windows\System\TEzJdtD.exe
  2⤵
  - Executes dropped EXE
  PID:3448
- C:\Windows\System\yfwRfpa.exe
  C:\Windows\System\yfwRfpa.exe
  2⤵
  - Executes dropped EXE
  PID:4088
- C:\Windows\System\zoxoGjd.exe
  C:\Windows\System\zoxoGjd.exe
  2⤵
  - Executes dropped EXE
  PID:516
- C:\Windows\System\llxzrFv.exe
  C:\Windows\System\llxzrFv.exe
  2⤵
  - Executes dropped EXE
  PID:2112
- C:\Windows\System\rnLnQkT.exe
  C:\Windows\System\rnLnQkT.exe
  2⤵
  - Executes dropped EXE
  PID:2588
- C:\Windows\System\rjNxOwS.exe
  C:\Windows\System\rjNxOwS.exe
  2⤵
  - Executes dropped EXE
  PID:412
- C:\Windows\System\xuxHFuf.exe
  C:\Windows\System\xuxHFuf.exe
  2⤵
  - Executes dropped EXE
  PID:5036
- C:\Windows\System\lPKUNuA.exe
  C:\Windows\System\lPKUNuA.exe
  2⤵
  - Executes dropped EXE
  PID:612
- C:\Windows\System\XKWDQbP.exe
  C:\Windows\System\XKWDQbP.exe
  2⤵
  - Executes dropped EXE
  PID:2204
- C:\Windows\System\OxaBPnA.exe
  C:\Windows\System\OxaBPnA.exe
  2⤵
  - Executes dropped EXE
  PID:3580
- C:\Windows\System\rxbOSEc.exe
  C:\Windows\System\rxbOSEc.exe
  2⤵
  - Executes dropped EXE
  PID:812
- C:\Windows\System\fCpWPfW.exe
  C:\Windows\System\fCpWPfW.exe
  2⤵
  - Executes dropped EXE
  PID:1512
- C:\Windows\System\alvkeiR.exe
  C:\Windows\System\alvkeiR.exe
  2⤵
  - Executes dropped EXE
  PID:2080
- C:\Windows\System\BvEJEoI.exe
  C:\Windows\System\BvEJEoI.exe
  2⤵
  - Executes dropped EXE
  PID:5056
- C:\Windows\System\QdYIuHk.exe
  C:\Windows\System\QdYIuHk.exe
  2⤵
  - Executes dropped EXE
  PID:1764
- C:\Windows\System\oKSJVlb.exe
  C:\Windows\System\oKSJVlb.exe
  2⤵
  - Executes dropped EXE
  PID:396
- C:\Windows\System\LudgCVK.exe
  C:\Windows\System\LudgCVK.exe
  2⤵
  - Executes dropped EXE
  PID:3036
- C:\Windows\System\zobnbGl.exe
  C:\Windows\System\zobnbGl.exe
  2⤵
  - Executes dropped EXE
  PID:4812
- C:\Windows\System\JFYukFu.exe
  C:\Windows\System\JFYukFu.exe
  2⤵
  - Executes dropped EXE
  PID:4908
- C:\Windows\System\hgLXkfZ.exe
  C:\Windows\System\hgLXkfZ.exe
  2⤵
  - Executes dropped EXE
  PID:2544
- C:\Windows\System\AtNAAhn.exe
  C:\Windows\System\AtNAAhn.exe
  2⤵
  - Executes dropped EXE
  PID:2168
- C:\Windows\System\nIvYWsX.exe
  C:\Windows\System\nIvYWsX.exe
  2⤵
  - Executes dropped EXE
  PID:1784
- C:\Windows\System\TtyymdC.exe
  C:\Windows\System\TtyymdC.exe
  2⤵
  - Executes dropped EXE
  PID:4880
- C:\Windows\System\YxDFRpF.exe
  C:\Windows\System\YxDFRpF.exe
  2⤵
  - Executes dropped EXE
  PID:1812
- C:\Windows\System\RjwdKQj.exe
  C:\Windows\System\RjwdKQj.exe
  2⤵
  - Executes dropped EXE
  PID:1364
- C:\Windows\System\XvyAAQL.exe
  C:\Windows\System\XvyAAQL.exe
  2⤵
  - Executes dropped EXE
  PID:2512
- C:\Windows\System\JODtCWD.exe
  C:\Windows\System\JODtCWD.exe
  2⤵
  - Executes dropped EXE
  PID:3440
- C:\Windows\System\SAhhENF.exe
  C:\Windows\System\SAhhENF.exe
  2⤵
  - Executes dropped EXE
  PID:2920
- C:\Windows\System\OxsQCFh.exe
  C:\Windows\System\OxsQCFh.exe
  2⤵
  - Executes dropped EXE
  PID:1756
- C:\Windows\System\eqkEqgk.exe
  C:\Windows\System\eqkEqgk.exe
  2⤵
  - Executes dropped EXE
  PID:1836
- C:\Windows\System\cRtWjFq.exe
  C:\Windows\System\cRtWjFq.exe
  2⤵
  - Executes dropped EXE
  PID:1660
- C:\Windows\System\oxNwpRn.exe
  C:\Windows\System\oxNwpRn.exe
  2⤵
  - Executes dropped EXE
  PID:5016
- C:\Windows\System\IjsDRXd.exe
  C:\Windows\System\IjsDRXd.exe
  2⤵
  - Executes dropped EXE
  PID:2688
- C:\Windows\System\hagkMFb.exe
  C:\Windows\System\hagkMFb.exe
  2⤵
  - Executes dropped EXE
  PID:440
- C:\Windows\System\KCsYxOz.exe
  C:\Windows\System\KCsYxOz.exe
  2⤵
  - Executes dropped EXE
  PID:5088
- C:\Windows\System\RkNcOMI.exe
  C:\Windows\System\RkNcOMI.exe
  2⤵
  - Executes dropped EXE
  PID:1952
- C:\Windows\System\FCBAyBA.exe
  C:\Windows\System\FCBAyBA.exe
  2⤵
  - Executes dropped EXE
  PID:624
- C:\Windows\System\VqVXiKI.exe
  C:\Windows\System\VqVXiKI.exe
  2⤵
  - Executes dropped EXE
  PID:4788
- C:\Windows\System\DLNeoZh.exe
  C:\Windows\System\DLNeoZh.exe
  2⤵
  - Executes dropped EXE
  PID:4868
- C:\Windows\System\LNitJOH.exe
  C:\Windows\System\LNitJOH.exe
  2⤵
  - Executes dropped EXE
  PID:3444
- C:\Windows\System\FHWMzry.exe
  C:\Windows\System\FHWMzry.exe
  2⤵
  - Executes dropped EXE
  PID:4936
- C:\Windows\System\YbXAzjI.exe
  C:\Windows\System\YbXAzjI.exe
  2⤵
  - Executes dropped EXE
  PID:3512
- C:\Windows\System\PRXXylx.exe
  C:\Windows\System\PRXXylx.exe
  2⤵
  - Executes dropped EXE
  PID:3612
- C:\Windows\System\NWfGGEA.exe
  C:\Windows\System\NWfGGEA.exe
  2⤵
  PID:2212
- C:\Windows\System\KZjJayT.exe
  C:\Windows\System\KZjJayT.exe
  2⤵
  - Executes dropped EXE
  PID:5072
- C:\Windows\System\BYreOsB.exe
  C:\Windows\System\BYreOsB.exe
  2⤵
  - Executes dropped EXE
  PID:1172
- C:\Windows\System\uXMdHDX.exe
  C:\Windows\System\uXMdHDX.exe
  2⤵
  - Executes dropped EXE
  PID:2480
- C:\Windows\System\CcKSRfE.exe
  C:\Windows\System\CcKSRfE.exe
  2⤵
  - Executes dropped EXE
  PID:3716
- C:\Windows\System\jRqTypH.exe
  C:\Windows\System\jRqTypH.exe
  2⤵
  - Executes dropped EXE
  PID:4532
- C:\Windows\System\nxFvtlY.exe
  C:\Windows\System\nxFvtlY.exe
  2⤵
  PID:3252
- C:\Windows\System\DghBQYB.exe
  C:\Windows\System\DghBQYB.exe
  2⤵
  PID:1628
- C:\Windows\System\ovRkrXw.exe
  C:\Windows\System\ovRkrXw.exe
  2⤵
  PID:2144
- C:\Windows\System\ufuDvFm.exe
  C:\Windows\System\ufuDvFm.exe
  2⤵
  PID:2128
- C:\Windows\System\cZjjMMH.exe
  C:\Windows\System\cZjjMMH.exe
  2⤵
  PID:4760
- C:\Windows\System\csfTAqe.exe
  C:\Windows\System\csfTAqe.exe
  2⤵
  PID:4600
- C:\Windows\System\EPcbFZo.exe
  C:\Windows\System\EPcbFZo.exe
  2⤵
  PID:1840
- C:\Windows\System\INNrALE.exe
  C:\Windows\System\INNrALE.exe
  2⤵
  PID:4748
- C:\Windows\System\FrMcArL.exe
  C:\Windows\System\FrMcArL.exe
  2⤵
  PID:4316
- C:\Windows\System\KKLAicH.exe
  C:\Windows\System\KKLAicH.exe
  2⤵
  PID:4624
- C:\Windows\System\IMueZtX.exe
  C:\Windows\System\IMueZtX.exe
  2⤵
  PID:5040
- C:\Windows\System\PHrZJHp.exe
  C:\Windows\System\PHrZJHp.exe
  2⤵
  PID:4300
- C:\Windows\System\eDsAZRA.exe
  C:\Windows\System\eDsAZRA.exe
  2⤵
  PID:4356
- C:\Windows\System\UTfCrpN.exe
  C:\Windows\System\UTfCrpN.exe
  2⤵
  PID:4432
- C:\Windows\System\jYZjkpQ.exe
  C:\Windows\System\jYZjkpQ.exe
  2⤵
  PID:232
- C:\Windows\System\pBOwTBZ.exe
  C:\Windows\System\pBOwTBZ.exe
  2⤵
  PID:2676
- C:\Windows\System\LqfMBed.exe
  C:\Windows\System\LqfMBed.exe
  2⤵
  PID:3660
- C:\Windows\System\wlisden.exe
  C:\Windows\System\wlisden.exe
  2⤵
  PID:4616
- C:\Windows\System\tuBkXIE.exe
  C:\Windows\System\tuBkXIE.exe
  2⤵
  PID:4080
- C:\Windows\System\AptdTCm.exe
  C:\Windows\System\AptdTCm.exe
  2⤵
  PID:4076
- C:\Windows\System\PtdkOBo.exe
  C:\Windows\System\PtdkOBo.exe
  2⤵
  PID:3536
- C:\Windows\System\czTzwDV.exe
  C:\Windows\System\czTzwDV.exe
  2⤵
  PID:3664
- C:\Windows\System\lCqPvpm.exe
  C:\Windows\System\lCqPvpm.exe
  2⤵
  PID:3584
- C:\Windows\System\YESVShF.exe
  C:\Windows\System\YESVShF.exe
  2⤵
  PID:4916
- C:\Windows\System\SCoBBqq.exe
  C:\Windows\System\SCoBBqq.exe
  2⤵
  PID:4244
- C:\Windows\System\tTBnrvX.exe
  C:\Windows\System\tTBnrvX.exe
  2⤵
  PID:1476
- C:\Windows\System\DkzVXwg.exe
  C:\Windows\System\DkzVXwg.exe
  2⤵
  PID:4376
- C:\Windows\System\NSSPMKh.exe
  C:\Windows\System\NSSPMKh.exe
  2⤵
  PID:2764
- C:\Windows\System\iFYrPWZ.exe
  C:\Windows\System\iFYrPWZ.exe
  2⤵
  PID:732
- C:\Windows\System\GnDflWW.exe
  C:\Windows\System\GnDflWW.exe
  2⤵
  PID:3472
- C:\Windows\System\jIZjjHD.exe
  C:\Windows\System\jIZjjHD.exe
  2⤵
  PID:5136
- C:\Windows\System\yDyQfDU.exe
  C:\Windows\System\yDyQfDU.exe
  2⤵
  PID:5160
- C:\Windows\System\zdJbbeH.exe
  C:\Windows\System\zdJbbeH.exe
  2⤵
  PID:5176
- C:\Windows\System\eCuhPLg.exe
  C:\Windows\System\eCuhPLg.exe
  2⤵
  PID:5200
- C:\Windows\System\MkSnVWv.exe
  C:\Windows\System\MkSnVWv.exe
  2⤵
  PID:5216
- C:\Windows\System\gryKsIb.exe
  C:\Windows\System\gryKsIb.exe
  2⤵
  PID:5276
- C:\Windows\System\rXtomTN.exe
  C:\Windows\System\rXtomTN.exe
  2⤵
  PID:5296
- C:\Windows\System\dsaomwB.exe
  C:\Windows\System\dsaomwB.exe
  2⤵
  PID:5312
- C:\Windows\System\fuvxNuh.exe
  C:\Windows\System\fuvxNuh.exe
  2⤵
  PID:5332
- C:\Windows\System\PmOcApW.exe
  C:\Windows\System\PmOcApW.exe
  2⤵
  PID:5348
- C:\Windows\System\cGIelGA.exe
  C:\Windows\System\cGIelGA.exe
  2⤵
  PID:5364
- C:\Windows\System\XvSIDMx.exe
  C:\Windows\System\XvSIDMx.exe
  2⤵
  PID:5388
- C:\Windows\System\YkFCBAk.exe
  C:\Windows\System\YkFCBAk.exe
  2⤵
  PID:5408
- C:\Windows\System\MnvcOHX.exe
  C:\Windows\System\MnvcOHX.exe
  2⤵
  PID:5428
- C:\Windows\System\pXzXptq.exe
  C:\Windows\System\pXzXptq.exe
  2⤵
  PID:5444
- C:\Windows\System\bkNlSFv.exe
  C:\Windows\System\bkNlSFv.exe
  2⤵
  PID:5460
- C:\Windows\System\JsMVEgR.exe
  C:\Windows\System\JsMVEgR.exe
  2⤵
  PID:5480
- C:\Windows\System\SPkBAoI.exe
  C:\Windows\System\SPkBAoI.exe
  2⤵
  PID:5496
- C:\Windows\System\vCIPrIN.exe
  C:\Windows\System\vCIPrIN.exe
  2⤵
  PID:5760
- C:\Windows\System\IYmgeOg.exe
  C:\Windows\System\IYmgeOg.exe
  2⤵
  PID:5784
- C:\Windows\System\ZtRYeVu.exe
  C:\Windows\System\ZtRYeVu.exe
  2⤵
  PID:5800
- C:\Windows\System\ZHmcJvv.exe
  C:\Windows\System\ZHmcJvv.exe
  2⤵
  PID:5820
- C:\Windows\System\RkClzdA.exe
  C:\Windows\System\RkClzdA.exe
  2⤵
  PID:5840
- C:\Windows\System\oahrqtb.exe
  C:\Windows\System\oahrqtb.exe
  2⤵
  PID:5856
- C:\Windows\System\jOonxPI.exe
  C:\Windows\System\jOonxPI.exe
  2⤵
  PID:5884
- C:\Windows\System\XmULEor.exe
  C:\Windows\System\XmULEor.exe
  2⤵
  PID:5900
- C:\Windows\System\viFKteX.exe
  C:\Windows\System\viFKteX.exe
  2⤵
  PID:5928
- C:\Windows\System\EmAWYsF.exe
  C:\Windows\System\EmAWYsF.exe
  2⤵
  PID:5964
- C:\Windows\System\fVfqGHq.exe
  C:\Windows\System\fVfqGHq.exe
  2⤵
  PID:5988
- C:\Windows\System\jyIgiYl.exe
  C:\Windows\System\jyIgiYl.exe
  2⤵
  PID:6016
- C:\Windows\System\AwCgjda.exe
  C:\Windows\System\AwCgjda.exe
  2⤵
  PID:6040
- C:\Windows\System\kxfnjOW.exe
  C:\Windows\System\kxfnjOW.exe
  2⤵
  PID:6072
- C:\Windows\System\Hexlcdd.exe
  C:\Windows\System\Hexlcdd.exe
  2⤵
  PID:6108
- C:\Windows\System\WODphAS.exe
  C:\Windows\System\WODphAS.exe
  2⤵
  PID:6128
- C:\Windows\System\wqJaPCV.exe
  C:\Windows\System\wqJaPCV.exe
  2⤵
  PID:3732
- C:\Windows\System\OyJzxci.exe
  C:\Windows\System\OyJzxci.exe
  2⤵
  PID:1900
- C:\Windows\System\vClmYLs.exe
  C:\Windows\System\vClmYLs.exe
  2⤵
  PID:3648
- C:\Windows\System\ZdyCzgm.exe
  C:\Windows\System\ZdyCzgm.exe
  2⤵
  PID:3888
- C:\Windows\System\pAutgow.exe
  C:\Windows\System\pAutgow.exe
  2⤵
  PID:2604
- C:\Windows\System\rxCFTos.exe
  C:\Windows\System\rxCFTos.exe
  2⤵
  PID:1920
- C:\Windows\System\UBymTQH.exe
  C:\Windows\System\UBymTQH.exe
  2⤵
  PID:4584
- C:\Windows\System\VmmzRKS.exe
  C:\Windows\System\VmmzRKS.exe
  2⤵
  PID:5004
- C:\Windows\System\BAObCxW.exe
  C:\Windows\System\BAObCxW.exe
  2⤵
  PID:1504
- C:\Windows\System\TdZoSSZ.exe
  C:\Windows\System\TdZoSSZ.exe
  2⤵
  PID:2724
- C:\Windows\System\YtxbRzZ.exe
  C:\Windows\System\YtxbRzZ.exe
  2⤵
  PID:4456
- C:\Windows\System\fpkQfXx.exe
  C:\Windows\System\fpkQfXx.exe
  2⤵
  PID:3420
- C:\Windows\System\PdlfrkG.exe
  C:\Windows\System\PdlfrkG.exe
  2⤵
  PID:5304
- C:\Windows\System\qZXPnFo.exe
  C:\Windows\System\qZXPnFo.exe
  2⤵
  PID:5328
- C:\Windows\System\fiwiscG.exe
  C:\Windows\System\fiwiscG.exe
  2⤵
  PID:5384
- C:\Windows\System\nlzoDMS.exe
  C:\Windows\System\nlzoDMS.exe
  2⤵
  PID:4724
- C:\Windows\System\aDEaSTW.exe
  C:\Windows\System\aDEaSTW.exe
  2⤵
  PID:1096
- C:\Windows\System\GMejsTK.exe
  C:\Windows\System\GMejsTK.exe
  2⤵
  PID:5556
- C:\Windows\System\ZjWKoxD.exe
  C:\Windows\System\ZjWKoxD.exe
  2⤵
  PID:4224
- C:\Windows\System\AtuNOEN.exe
  C:\Windows\System\AtuNOEN.exe
  2⤵
  PID:4816
- C:\Windows\System\rjrdUha.exe
  C:\Windows\System\rjrdUha.exe
  2⤵
  PID:2924
- C:\Windows\System\PvfsCii.exe
  C:\Windows\System\PvfsCii.exe
  2⤵
  PID:3860
- C:\Windows\System\CoGBBcp.exe
  C:\Windows\System\CoGBBcp.exe
  2⤵
  PID:6148
- C:\Windows\System\YBccpZe.exe
  C:\Windows\System\YBccpZe.exe
  2⤵
  PID:6176
- C:\Windows\System\IoFUHAC.exe
  C:\Windows\System\IoFUHAC.exe
  2⤵
  PID:6260
- C:\Windows\System\grOjoOG.exe
  C:\Windows\System\grOjoOG.exe
  2⤵
  PID:6284
- C:\Windows\System\rBmyWaB.exe
  C:\Windows\System\rBmyWaB.exe
  2⤵
  PID:6320
- C:\Windows\System\vbdBWGa.exe
  C:\Windows\System\vbdBWGa.exe
  2⤵
  PID:6336
- C:\Windows\System\bQpBfuO.exe
  C:\Windows\System\bQpBfuO.exe
  2⤵
  PID:6352
- C:\Windows\System\EZyDqin.exe
  C:\Windows\System\EZyDqin.exe
  2⤵
  PID:6376
- C:\Windows\System\TBtvGBh.exe
  C:\Windows\System\TBtvGBh.exe
  2⤵
  PID:6392
- C:\Windows\System\BEcYXvx.exe
  C:\Windows\System\BEcYXvx.exe
  2⤵
  PID:6408
- C:\Windows\System\tHhamgm.exe
  C:\Windows\System\tHhamgm.exe
  2⤵
  PID:6444
- C:\Windows\System\jkQLGdc.exe
  C:\Windows\System\jkQLGdc.exe
  2⤵
  PID:6464
- C:\Windows\System\UDzPoyF.exe
  C:\Windows\System\UDzPoyF.exe
  2⤵
  PID:6480
- C:\Windows\System\asBysWs.exe
  C:\Windows\System\asBysWs.exe
  2⤵
  PID:6516
- C:\Windows\System\EOAkonH.exe
  C:\Windows\System\EOAkonH.exe
  2⤵
  PID:6536
- C:\Windows\System\KiwGAJH.exe
  C:\Windows\System\KiwGAJH.exe
  2⤵
  PID:6552
- C:\Windows\System\cpbfeqq.exe
  C:\Windows\System\cpbfeqq.exe
  2⤵
  PID:6568
- C:\Windows\System\OlJEADX.exe
  C:\Windows\System\OlJEADX.exe
  2⤵
  PID:6616
- C:\Windows\System\jOujaPT.exe
  C:\Windows\System\jOujaPT.exe
  2⤵
  PID:6632
- C:\Windows\System\vprpDSI.exe
  C:\Windows\System\vprpDSI.exe
  2⤵
  PID:6656
- C:\Windows\System\OjeAksx.exe
  C:\Windows\System\OjeAksx.exe
  2⤵
  PID:6672
- C:\Windows\System\SGOvGtn.exe
  C:\Windows\System\SGOvGtn.exe
  2⤵
  PID:6692
- C:\Windows\System\UbCiqjU.exe
  C:\Windows\System\UbCiqjU.exe
  2⤵
  PID:6712
- C:\Windows\System\ifGhKek.exe
  C:\Windows\System\ifGhKek.exe
  2⤵
  PID:6728
- C:\Windows\System\kQtZgPQ.exe
  C:\Windows\System\kQtZgPQ.exe
  2⤵
  PID:6772
- C:\Windows\System\gGSvJIf.exe
  C:\Windows\System\gGSvJIf.exe
  2⤵
  PID:6792
- C:\Windows\System\rAuQDDI.exe
  C:\Windows\System\rAuQDDI.exe
  2⤵
  PID:6816
- C:\Windows\System\PQQPziC.exe
  C:\Windows\System\PQQPziC.exe
  2⤵
  PID:6836
- C:\Windows\System\uVzccXn.exe
  C:\Windows\System\uVzccXn.exe
  2⤵
  PID:6852
- C:\Windows\System\gGjhEAE.exe
  C:\Windows\System\gGjhEAE.exe
  2⤵
  PID:6868
- C:\Windows\System\tGkczxb.exe
  C:\Windows\System\tGkczxb.exe
  2⤵
  PID:6892
- C:\Windows\System\RcfszuU.exe
  C:\Windows\System\RcfszuU.exe
  2⤵
  PID:6908
- C:\Windows\System\iQJgpLt.exe
  C:\Windows\System\iQJgpLt.exe
  2⤵
  PID:6924
- C:\Windows\System\mVAiyjg.exe
  C:\Windows\System\mVAiyjg.exe
  2⤵
  PID:6948
- C:\Windows\System\pXlfHgD.exe
  C:\Windows\System\pXlfHgD.exe
  2⤵
  PID:6968
- C:\Windows\System\OgFrNzt.exe
  C:\Windows\System\OgFrNzt.exe
  2⤵
  PID:6988
- C:\Windows\System\NJdHXEm.exe
  C:\Windows\System\NJdHXEm.exe
  2⤵
  PID:7008
- C:\Windows\System\llFeHhx.exe
  C:\Windows\System\llFeHhx.exe
  2⤵
  PID:7028
- C:\Windows\System\nwqCDIe.exe
  C:\Windows\System\nwqCDIe.exe
  2⤵
  PID:7044
- C:\Windows\System\JzPthLA.exe
  C:\Windows\System\JzPthLA.exe
  2⤵
  PID:7068
- C:\Windows\System\HhcnuLX.exe
  C:\Windows\System\HhcnuLX.exe
  2⤵
  PID:7084
- C:\Windows\System\SXOAFtJ.exe
  C:\Windows\System\SXOAFtJ.exe
  2⤵
  PID:7100
- C:\Windows\System\ARXwQSu.exe
  C:\Windows\System\ARXwQSu.exe
  2⤵
  PID:7124
- C:\Windows\System\PJIgaMk.exe
  C:\Windows\System\PJIgaMk.exe
  2⤵
  PID:7140
- C:\Windows\System\yaaRMwX.exe
  C:\Windows\System\yaaRMwX.exe
  2⤵
  PID:7156
- C:\Windows\System\SwlfXig.exe
  C:\Windows\System\SwlfXig.exe
  2⤵
  PID:2368
- C:\Windows\System\uOBYfdj.exe
  C:\Windows\System\uOBYfdj.exe
  2⤵
  PID:4984
- C:\Windows\System\eZGHgQq.exe
  C:\Windows\System\eZGHgQq.exe
  2⤵
  PID:3720
- C:\Windows\System\yFvktSf.exe
  C:\Windows\System\yFvktSf.exe
  2⤵
  PID:5376
- C:\Windows\System\pnssEbv.exe
  C:\Windows\System\pnssEbv.exe
  2⤵
  PID:2536
- C:\Windows\System\vMPVnqB.exe
  C:\Windows\System\vMPVnqB.exe
  2⤵
  PID:5492
- C:\Windows\System\OySzCcJ.exe
  C:\Windows\System\OySzCcJ.exe
  2⤵
  PID:5748
- C:\Windows\System\YmBJvTi.exe
  C:\Windows\System\YmBJvTi.exe
  2⤵
  PID:1292
- C:\Windows\System\NFMytqD.exe
  C:\Windows\System\NFMytqD.exe
  2⤵
  PID:1564
- C:\Windows\System\xHCLXNP.exe
  C:\Windows\System\xHCLXNP.exe
  2⤵
  PID:4416
- C:\Windows\System\RAdqEfu.exe
  C:\Windows\System\RAdqEfu.exe
  2⤵
  PID:5912
- C:\Windows\System\VCRTrbt.exe
  C:\Windows\System\VCRTrbt.exe
  2⤵
  PID:5908
- C:\Windows\System\SgJtVEq.exe
  C:\Windows\System\SgJtVEq.exe
  2⤵
  PID:5972
- C:\Windows\System\LpwrsEA.exe
  C:\Windows\System\LpwrsEA.exe
  2⤵
  PID:4864
- C:\Windows\System\fIkRDFf.exe
  C:\Windows\System\fIkRDFf.exe
  2⤵
  PID:1876
- C:\Windows\System\WzoNUsC.exe
  C:\Windows\System\WzoNUsC.exe
  2⤵
  PID:5320
- C:\Windows\System\tfVMJZO.exe
  C:\Windows\System\tfVMJZO.exe
  2⤵
  PID:4628
- C:\Windows\System\vYuygpH.exe
  C:\Windows\System\vYuygpH.exe
  2⤵
  PID:5796
- C:\Windows\System\Dgbqtmz.exe
  C:\Windows\System\Dgbqtmz.exe
  2⤵
  PID:5604
- C:\Windows\System\eqNJwKl.exe
  C:\Windows\System\eqNJwKl.exe
  2⤵
  PID:6724
- C:\Windows\System\JqiALHG.exe
  C:\Windows\System\JqiALHG.exe
  2⤵
  PID:5632
- C:\Windows\System\lYByane.exe
  C:\Windows\System\lYByane.exe
  2⤵
  PID:4192
- C:\Windows\System\mxGeOcz.exe
  C:\Windows\System\mxGeOcz.exe
  2⤵
  PID:552
- C:\Windows\System\bLGrGqh.exe
  C:\Windows\System\bLGrGqh.exe
  2⤵
  PID:2744
- C:\Windows\System\WPLKAtd.exe
  C:\Windows\System\WPLKAtd.exe
  2⤵
  PID:6184
- C:\Windows\System\slvQOPp.exe
  C:\Windows\System\slvQOPp.exe
  2⤵
  PID:7208
- C:\Windows\System\lyfIJzX.exe
  C:\Windows\System\lyfIJzX.exe
  2⤵
  PID:7244
- C:\Windows\System\mCrqFbw.exe
  C:\Windows\System\mCrqFbw.exe
  2⤵
  PID:7264
- C:\Windows\System\YInFEsp.exe
  C:\Windows\System\YInFEsp.exe
  2⤵
  PID:7280
- C:\Windows\System\CreLODS.exe
  C:\Windows\System\CreLODS.exe
  2⤵
  PID:7300
- C:\Windows\System\xYpfJKg.exe
  C:\Windows\System\xYpfJKg.exe
  2⤵
  PID:7324
- C:\Windows\System\jDsXhsS.exe
  C:\Windows\System\jDsXhsS.exe
  2⤵
  PID:7340
- C:\Windows\System\ayoFAke.exe
  C:\Windows\System\ayoFAke.exe
  2⤵
  PID:7360
- C:\Windows\System\ZQwCnOk.exe
  C:\Windows\System\ZQwCnOk.exe
  2⤵
  PID:7396
- C:\Windows\System\YAKlAbY.exe
  C:\Windows\System\YAKlAbY.exe
  2⤵
  PID:7412
- C:\Windows\System\jtOIybV.exe
  C:\Windows\System\jtOIybV.exe
  2⤵
  PID:7436
- C:\Windows\System\ssGpqvg.exe
  C:\Windows\System\ssGpqvg.exe
  2⤵
  PID:7452
- C:\Windows\System\EZSOUlz.exe
  C:\Windows\System\EZSOUlz.exe
  2⤵
  PID:7484
- C:\Windows\System\NRcpTfY.exe
  C:\Windows\System\NRcpTfY.exe
  2⤵
  PID:7504
- C:\Windows\System\YepShXu.exe
  C:\Windows\System\YepShXu.exe
  2⤵
  PID:7520
- C:\Windows\System\dDgorOT.exe
  C:\Windows\System\dDgorOT.exe
  2⤵
  PID:7540
- C:\Windows\System\MbiuqTc.exe
  C:\Windows\System\MbiuqTc.exe
  2⤵
  PID:7556
- C:\Windows\System\YJAyZtE.exe
  C:\Windows\System\YJAyZtE.exe
  2⤵
  PID:7572
- C:\Windows\System\ZqOIfqD.exe
  C:\Windows\System\ZqOIfqD.exe
  2⤵
  PID:7588
- C:\Windows\System\bOIqslh.exe
  C:\Windows\System\bOIqslh.exe
  2⤵
  PID:7608
- C:\Windows\System\pvocSSp.exe
  C:\Windows\System\pvocSSp.exe
  2⤵
  PID:7624
- C:\Windows\System\pFsYQlt.exe
  C:\Windows\System\pFsYQlt.exe
  2⤵
  PID:7640
- C:\Windows\System\qdidNeY.exe
  C:\Windows\System\qdidNeY.exe
  2⤵
  PID:7656
- C:\Windows\System\kmaOnpx.exe
  C:\Windows\System\kmaOnpx.exe
  2⤵
  PID:7676
- C:\Windows\System\FHEfgiu.exe
  C:\Windows\System\FHEfgiu.exe
  2⤵
  PID:7692
- C:\Windows\System\rCyaZJf.exe
  C:\Windows\System\rCyaZJf.exe
  2⤵
  PID:7712
- C:\Windows\System\urukJgU.exe
  C:\Windows\System\urukJgU.exe
  2⤵
  PID:7732
- C:\Windows\System\RoNabLT.exe
  C:\Windows\System\RoNabLT.exe
  2⤵
  PID:7748
- C:\Windows\System\RaomKng.exe
  C:\Windows\System\RaomKng.exe
  2⤵
  PID:7768
- C:\Windows\System\PVRbSmS.exe
  C:\Windows\System\PVRbSmS.exe
  2⤵
  PID:7788
- C:\Windows\System\DrPMTPa.exe
  C:\Windows\System\DrPMTPa.exe
  2⤵
  PID:7804
- C:\Windows\System\WxwqvyS.exe
  C:\Windows\System\WxwqvyS.exe
  2⤵
  PID:7824
- C:\Windows\System\agmeVYV.exe
  C:\Windows\System\agmeVYV.exe
  2⤵
  PID:7844
- C:\Windows\System\TMtMVFS.exe
  C:\Windows\System\TMtMVFS.exe
  2⤵
  PID:7860
- C:\Windows\System\UJlDVwm.exe
  C:\Windows\System\UJlDVwm.exe
  2⤵
  PID:7880
- C:\Windows\System\xbuXQPe.exe
  C:\Windows\System\xbuXQPe.exe
  2⤵
  PID:7900
- C:\Windows\System\NKVgGmV.exe
  C:\Windows\System\NKVgGmV.exe
  2⤵
  PID:7916
- C:\Windows\System\HKKcjnn.exe
  C:\Windows\System\HKKcjnn.exe
  2⤵
  PID:7936
- C:\Windows\System\SZQsbDF.exe
  C:\Windows\System\SZQsbDF.exe
  2⤵
  PID:7952
- C:\Windows\System\uNHDcki.exe
  C:\Windows\System\uNHDcki.exe
  2⤵
  PID:7968
- C:\Windows\System\nJmEUgd.exe
  C:\Windows\System\nJmEUgd.exe
  2⤵
  PID:7984
- C:\Windows\System\qUvqbhy.exe
  C:\Windows\System\qUvqbhy.exe
  2⤵
  PID:8004
- C:\Windows\System\WGDcQkY.exe
  C:\Windows\System\WGDcQkY.exe
  2⤵
  PID:8020
- C:\Windows\System\iLzxuCP.exe
  C:\Windows\System\iLzxuCP.exe
  2⤵
  PID:8036
- C:\Windows\System\ndXSIzC.exe
  C:\Windows\System\ndXSIzC.exe
  2⤵
  PID:8056
- C:\Windows\System\jFOQSRZ.exe
  C:\Windows\System\jFOQSRZ.exe
  2⤵
  PID:8072
- C:\Windows\System\NHCfjUG.exe
  C:\Windows\System\NHCfjUG.exe
  2⤵
  PID:8088
- C:\Windows\System\JXYjMWS.exe
  C:\Windows\System\JXYjMWS.exe
  2⤵
  PID:8104
- C:\Windows\System\CBWvaYH.exe
  C:\Windows\System\CBWvaYH.exe
  2⤵
  PID:6012
- C:\Windows\System\MKntoLI.exe
  C:\Windows\System\MKntoLI.exe
  2⤵
  PID:6100
- C:\Windows\System\OzKjbNe.exe
  C:\Windows\System\OzKjbNe.exe
  2⤵
  PID:6136
- C:\Windows\System\sXwWhee.exe
  C:\Windows\System\sXwWhee.exe
  2⤵
  PID:1236
- C:\Windows\System\mxnmmkf.exe
  C:\Windows\System\mxnmmkf.exe
  2⤵
  PID:2504
- C:\Windows\System\iHCeKaQ.exe
  C:\Windows\System\iHCeKaQ.exe
  2⤵
  PID:1140
- C:\Windows\System\ObEEBRo.exe
  C:\Windows\System\ObEEBRo.exe
  2⤵
  PID:1596
- C:\Windows\System\lCsyNqc.exe
  C:\Windows\System\lCsyNqc.exe
  2⤵
  PID:6372
- C:\Windows\System\DquQqQv.exe
  C:\Windows\System\DquQqQv.exe
  2⤵
  PID:6864
- C:\Windows\System\mHUAzTe.exe
  C:\Windows\System\mHUAzTe.exe
  2⤵
  PID:4536
- C:\Windows\System\jLkYuwG.exe
  C:\Windows\System\jLkYuwG.exe
  2⤵
  PID:5324
- C:\Windows\System\JuFQTmp.exe
  C:\Windows\System\JuFQTmp.exe
  2⤵
  PID:7120
- C:\Windows\System\IBIqYEQ.exe
  C:\Windows\System\IBIqYEQ.exe
  2⤵
  PID:2516
- C:\Windows\System\GENjfDx.exe
  C:\Windows\System\GENjfDx.exe
  2⤵
  PID:4560
- C:\Windows\System\bvwclHk.exe
  C:\Windows\System\bvwclHk.exe
  2⤵
  PID:5588
- C:\Windows\System\kMMBjMQ.exe
  C:\Windows\System\kMMBjMQ.exe
  2⤵
  PID:4048
- C:\Windows\System\dDLIDKU.exe
  C:\Windows\System\dDLIDKU.exe
  2⤵
  PID:6220
- C:\Windows\System\rDRlume.exe
  C:\Windows\System\rDRlume.exe
  2⤵
  PID:6276
- C:\Windows\System\OKwUbEj.exe
  C:\Windows\System\OKwUbEj.exe
  2⤵
  PID:6564
- C:\Windows\System\AgDrAUs.exe
  C:\Windows\System\AgDrAUs.exe
  2⤵
  PID:6504
- C:\Windows\System\NsNLilL.exe
  C:\Windows\System\NsNLilL.exe
  2⤵
  PID:6688
- C:\Windows\System\VKIakTy.exe
  C:\Windows\System\VKIakTy.exe
  2⤵
  PID:6964
- C:\Windows\System\ThnFgox.exe
  C:\Windows\System\ThnFgox.exe
  2⤵
  PID:7060
- C:\Windows\System\tdlWZiZ.exe
  C:\Windows\System\tdlWZiZ.exe
  2⤵
  PID:2876
- C:\Windows\System\fPOPNiH.exe
  C:\Windows\System\fPOPNiH.exe
  2⤵
  PID:5032
- C:\Windows\System\duigGkI.exe
  C:\Windows\System\duigGkI.exe
  2⤵
  PID:5848
- C:\Windows\System\cPwkzTF.exe
  C:\Windows\System\cPwkzTF.exe
  2⤵
  PID:5292
- C:\Windows\System\LWUfTRQ.exe
  C:\Windows\System\LWUfTRQ.exe
  2⤵
  PID:3620
- C:\Windows\System\zNiMhxk.exe
  C:\Windows\System\zNiMhxk.exe
  2⤵
  PID:5832
- C:\Windows\System\JjkkYgJ.exe
  C:\Windows\System\JjkkYgJ.exe
  2⤵
  PID:5476
- C:\Windows\System\adcVomy.exe
  C:\Windows\System\adcVomy.exe
  2⤵
  PID:3280
- C:\Windows\System\eBkInjp.exe
  C:\Windows\System\eBkInjp.exe
  2⤵
  PID:7112
- C:\Windows\System\buYLjUk.exe
  C:\Windows\System\buYLjUk.exe
  2⤵
  PID:7020
- C:\Windows\System\XPTjpeO.exe
  C:\Windows\System\XPTjpeO.exe
  2⤵
  PID:6932
- C:\Windows\System\ACmFXgF.exe
  C:\Windows\System\ACmFXgF.exe
  2⤵
  PID:6860
- C:\Windows\System\hBwiZHa.exe
  C:\Windows\System\hBwiZHa.exe
  2⤵
  PID:6700
- C:\Windows\System\icVXuQC.exe
  C:\Windows\System\icVXuQC.exe
  2⤵
  PID:6624
- C:\Windows\System\dsgbpsN.exe
  C:\Windows\System\dsgbpsN.exe
  2⤵
  PID:6496
- C:\Windows\System\TFiDkso.exe
  C:\Windows\System\TFiDkso.exe
  2⤵
  PID:6364
- C:\Windows\System\rwslWKv.exe
  C:\Windows\System\rwslWKv.exe
  2⤵
  PID:6268
- C:\Windows\System\BAgHPew.exe
  C:\Windows\System\BAgHPew.exe
  2⤵
  PID:3744
- C:\Windows\System\BzaNqxW.exe
  C:\Windows\System\BzaNqxW.exe
  2⤵
  PID:5224
- C:\Windows\System\VhGWqPs.exe
  C:\Windows\System\VhGWqPs.exe
  2⤵
  PID:5896
- C:\Windows\System\vinjqZS.exe
  C:\Windows\System\vinjqZS.exe
  2⤵
  PID:6804
- C:\Windows\System\uKjzAMj.exe
  C:\Windows\System\uKjzAMj.exe
  2⤵
  PID:6032
- C:\Windows\System\OvPlgEI.exe
  C:\Windows\System\OvPlgEI.exe
  2⤵
  PID:5420
- C:\Windows\System\GijmhTg.exe
  C:\Windows\System\GijmhTg.exe
  2⤵
  PID:8200
- C:\Windows\System\VLvgkbk.exe
  C:\Windows\System\VLvgkbk.exe
  2⤵
  PID:8216
- C:\Windows\System\CfwOVSf.exe
  C:\Windows\System\CfwOVSf.exe
  2⤵
  PID:8240
- C:\Windows\System\FMrnDZf.exe
  C:\Windows\System\FMrnDZf.exe
  2⤵
  PID:8256
- C:\Windows\System\wQmiUNb.exe
  C:\Windows\System\wQmiUNb.exe
  2⤵
  PID:8276
- C:\Windows\System\VvTnFHX.exe
  C:\Windows\System\VvTnFHX.exe
  2⤵
  PID:8292
- C:\Windows\System\BItEYKZ.exe
  C:\Windows\System\BItEYKZ.exe
  2⤵
  PID:8308
- C:\Windows\System\oEAaZGk.exe
  C:\Windows\System\oEAaZGk.exe
  2⤵
  PID:8324
- C:\Windows\System\lIMPXAu.exe
  C:\Windows\System\lIMPXAu.exe
  2⤵
  PID:8340
- C:\Windows\System\fDAqQyy.exe
  C:\Windows\System\fDAqQyy.exe
  2⤵
  PID:8356
- C:\Windows\System\Uaognxf.exe
  C:\Windows\System\Uaognxf.exe
  2⤵
  PID:8372
- C:\Windows\System\GQyaMYS.exe
  C:\Windows\System\GQyaMYS.exe
  2⤵
  PID:8396
- C:\Windows\System\oIbjCKG.exe
  C:\Windows\System\oIbjCKG.exe
  2⤵
  PID:8412
- C:\Windows\System\DQTedDv.exe
  C:\Windows\System\DQTedDv.exe
  2⤵
  PID:8436
- C:\Windows\System\ZQzBmoT.exe
  C:\Windows\System\ZQzBmoT.exe
  2⤵
  PID:8452
- C:\Windows\System\bVeofmf.exe
  C:\Windows\System\bVeofmf.exe
  2⤵
  PID:8468
- C:\Windows\System\xooSliS.exe
  C:\Windows\System\xooSliS.exe
  2⤵
  PID:8488
- C:\Windows\System\AaOimIH.exe
  C:\Windows\System\AaOimIH.exe
  2⤵
  PID:8508
- C:\Windows\System\TeyMuYC.exe
  C:\Windows\System\TeyMuYC.exe
  2⤵
  PID:8524
- C:\Windows\System\fvTkxZQ.exe
  C:\Windows\System\fvTkxZQ.exe
  2⤵
  PID:8548
- C:\Windows\System\IdBqLfs.exe
  C:\Windows\System\IdBqLfs.exe
  2⤵
  PID:8568
- C:\Windows\System\LyIkwxw.exe
  C:\Windows\System\LyIkwxw.exe
  2⤵
  PID:8584
- C:\Windows\System\LTCwkAn.exe
  C:\Windows\System\LTCwkAn.exe
  2⤵
  PID:8604
- C:\Windows\System\Siktyer.exe
  C:\Windows\System\Siktyer.exe
  2⤵
  PID:8624
- C:\Windows\System\vjowpbx.exe
  C:\Windows\System\vjowpbx.exe
  2⤵
  PID:8640
- C:\Windows\System\XPCWguD.exe
  C:\Windows\System\XPCWguD.exe
  2⤵
  PID:8656
- C:\Windows\System\DWfCvMv.exe
  C:\Windows\System\DWfCvMv.exe
  2⤵
  PID:8676
- C:\Windows\System\qHvbfLJ.exe
  C:\Windows\System\qHvbfLJ.exe
  2⤵
  PID:8696
- C:\Windows\System\fpFWZmd.exe
  C:\Windows\System\fpFWZmd.exe
  2⤵
  PID:8712
- C:\Windows\System\CiypZzT.exe
  C:\Windows\System\CiypZzT.exe
  2⤵
  PID:8728
- C:\Windows\System\UQGRbOn.exe
  C:\Windows\System\UQGRbOn.exe
  2⤵
  PID:8752
- C:\Windows\System\ktXSpIQ.exe
  C:\Windows\System\ktXSpIQ.exe
  2⤵
  PID:8772
- C:\Windows\System\QMCjyCK.exe
  C:\Windows\System\QMCjyCK.exe
  2⤵
  PID:8788
- C:\Windows\System\UjQPFfo.exe
  C:\Windows\System\UjQPFfo.exe
  2⤵
  PID:8808
- C:\Windows\System\zUPoGfq.exe
  C:\Windows\System\zUPoGfq.exe
  2⤵
  PID:8824
- C:\Windows\System\dAsClDs.exe
  C:\Windows\System\dAsClDs.exe
  2⤵
  PID:8848
- C:\Windows\System\tLEYiZI.exe
  C:\Windows\System\tLEYiZI.exe
  2⤵
  PID:8864
- C:\Windows\System\TQFVmIL.exe
  C:\Windows\System\TQFVmIL.exe
  2⤵
  PID:8880
- C:\Windows\System\iTLCunp.exe
  C:\Windows\System\iTLCunp.exe
  2⤵
  PID:8896
- C:\Windows\System\jprggrt.exe
  C:\Windows\System\jprggrt.exe
  2⤵
  PID:8912
- C:\Windows\System\mwPLWOw.exe
  C:\Windows\System\mwPLWOw.exe
  2⤵
  PID:8936
- C:\Windows\System\xrCSNnx.exe
  C:\Windows\System\xrCSNnx.exe
  2⤵
  PID:8952
- C:\Windows\System\IsUOFzm.exe
  C:\Windows\System\IsUOFzm.exe
  2⤵
  PID:8972
- C:\Windows\System\HzvMGdM.exe
  C:\Windows\System\HzvMGdM.exe
  2⤵
  PID:8988
- C:\Windows\System\LKVSHCp.exe
  C:\Windows\System\LKVSHCp.exe
  2⤵
  PID:9004
- C:\Windows\System\yoXlFAD.exe
  C:\Windows\System\yoXlFAD.exe
  2⤵
  PID:9020
- C:\Windows\System\NSZVDCH.exe
  C:\Windows\System\NSZVDCH.exe
  2⤵
  PID:9036
- C:\Windows\System\ICDhwpr.exe
  C:\Windows\System\ICDhwpr.exe
  2⤵
  PID:9060
- C:\Windows\System\NzlMaIt.exe
  C:\Windows\System\NzlMaIt.exe
  2⤵
  PID:9604
- C:\Windows\System\FyofAAk.exe
  C:\Windows\System\FyofAAk.exe
  2⤵
  PID:9620
- C:\Windows\System\nhHoPnC.exe
  C:\Windows\System\nhHoPnC.exe
  2⤵
  PID:9636
- C:\Windows\System\moLVAct.exe
  C:\Windows\System\moLVAct.exe
  2⤵
  PID:9652
- C:\Windows\System\NUCNvaP.exe
  C:\Windows\System\NUCNvaP.exe
  2⤵
  PID:9668
- C:\Windows\System\ULdqpbq.exe
  C:\Windows\System\ULdqpbq.exe
  2⤵
  PID:9700
- C:\Windows\System\krhQCJN.exe
  C:\Windows\System\krhQCJN.exe
  2⤵
  PID:9720
- C:\Windows\System\LpSabSO.exe
  C:\Windows\System\LpSabSO.exe
  2⤵
  PID:9736
- C:\Windows\System\jlrlhnK.exe
  C:\Windows\System\jlrlhnK.exe
  2⤵
  PID:9764
- C:\Windows\System\gcyrCWP.exe
  C:\Windows\System\gcyrCWP.exe
  2⤵
  PID:9780
- C:\Windows\System\ZxOkpTc.exe
  C:\Windows\System\ZxOkpTc.exe
  2⤵
  PID:9796
- C:\Windows\System\Cxrohjd.exe
  C:\Windows\System\Cxrohjd.exe
  2⤵
  PID:9812
- C:\Windows\System\iUBzjvB.exe
  C:\Windows\System\iUBzjvB.exe
  2⤵
  PID:9832
- C:\Windows\System\mPacjhQ.exe
  C:\Windows\System\mPacjhQ.exe
  2⤵
  PID:9852
- C:\Windows\System\SIJXDCW.exe
  C:\Windows\System\SIJXDCW.exe
  2⤵
  PID:9868
- C:\Windows\System\juVahpA.exe
  C:\Windows\System\juVahpA.exe
  2⤵
  PID:9892
- C:\Windows\System\wUUVIpq.exe
  C:\Windows\System\wUUVIpq.exe
  2⤵
  PID:9928
- C:\Windows\System\ejJWssb.exe
  C:\Windows\System\ejJWssb.exe
  2⤵
  PID:9948
- C:\Windows\System\BunqbRV.exe
  C:\Windows\System\BunqbRV.exe
  2⤵
  PID:9976
- C:\Windows\System\HFKXnHa.exe
  C:\Windows\System\HFKXnHa.exe
  2⤵
  PID:9992
- C:\Windows\System\GDmnjSY.exe
  C:\Windows\System\GDmnjSY.exe
  2⤵
  PID:10032
- C:\Windows\System\oLBIkwX.exe
  C:\Windows\System\oLBIkwX.exe
  2⤵
  PID:10052
- C:\Windows\System\LwFlOyi.exe
  C:\Windows\System\LwFlOyi.exe
  2⤵
  PID:10072
- C:\Windows\System\sYoHSMV.exe
  C:\Windows\System\sYoHSMV.exe
  2⤵
  PID:10092
- C:\Windows\System\liUAxyD.exe
  C:\Windows\System\liUAxyD.exe
  2⤵
  PID:10204
- C:\Windows\System\njsLUjb.exe
  C:\Windows\System\njsLUjb.exe
  2⤵
  PID:10220
- C:\Windows\System\ZcqNcLj.exe
  C:\Windows\System\ZcqNcLj.exe
  2⤵
  PID:7420
- C:\Windows\System\NPFKYkV.exe
  C:\Windows\System\NPFKYkV.exe
  2⤵
  PID:7760
- C:\Windows\System\ZpqtZbe.exe
  C:\Windows\System\ZpqtZbe.exe
  2⤵
  PID:8044
- C:\Windows\System\IjNxvJV.exe
  C:\Windows\System\IjNxvJV.exe
  2⤵
  PID:2668
- C:\Windows\System\mUpHcEi.exe
  C:\Windows\System\mUpHcEi.exe
  2⤵
  PID:8404
- C:\Windows\System\gfYnzae.exe
  C:\Windows\System\gfYnzae.exe
  2⤵
  PID:8460
- C:\Windows\System\aAzmCDl.exe
  C:\Windows\System\aAzmCDl.exe
  2⤵
  PID:8520
- C:\Windows\System\YPsMZrI.exe
  C:\Windows\System\YPsMZrI.exe
  2⤵
  PID:7288
- C:\Windows\System\NvPadVk.exe
  C:\Windows\System\NvPadVk.exe
  2⤵
  PID:8796
- C:\Windows\System\SBzZRYA.exe
  C:\Windows\System\SBzZRYA.exe
  2⤵
  PID:7796
- C:\Windows\System\UxYbvUK.exe
  C:\Windows\System\UxYbvUK.exe
  2⤵
  PID:7836
- C:\Windows\System\NohDQGO.exe
  C:\Windows\System\NohDQGO.exe
  2⤵
  PID:7924
- C:\Windows\System\HGAQujk.exe
  C:\Windows\System\HGAQujk.exe
  2⤵
  PID:7980
- C:\Windows\System\hcEzFHO.exe
  C:\Windows\System\hcEzFHO.exe
  2⤵
  PID:8028
- C:\Windows\System\YCmFzTC.exe
  C:\Windows\System\YCmFzTC.exe
  2⤵
  PID:9144
- C:\Windows\System\jJvBraX.exe
  C:\Windows\System\jJvBraX.exe
  2⤵
  PID:1420
- C:\Windows\System\TfpNZKx.exe
  C:\Windows\System\TfpNZKx.exe
  2⤵
  PID:6876
- C:\Windows\System\ySKLAre.exe
  C:\Windows\System\ySKLAre.exe
  2⤵
  PID:6528
- C:\Windows\System\VJpqsDJ.exe
  C:\Windows\System\VJpqsDJ.exe
  2⤵
  PID:6388
- C:\Windows\System\vKYLJxE.exe
  C:\Windows\System\vKYLJxE.exe
  2⤵
  PID:10260
- C:\Windows\System\bVPnGvj.exe
  C:\Windows\System\bVPnGvj.exe
  2⤵
  PID:10280
- C:\Windows\System\ILRkeCQ.exe
  C:\Windows\System\ILRkeCQ.exe
  2⤵
  PID:10296
- C:\Windows\System\ogyZlHM.exe
  C:\Windows\System\ogyZlHM.exe
  2⤵
  PID:10316
- C:\Windows\System\KHMYkZa.exe
  C:\Windows\System\KHMYkZa.exe
  2⤵
  PID:10336
- C:\Windows\System\pwhYjBX.exe
  C:\Windows\System\pwhYjBX.exe
  2⤵
  PID:10352
- C:\Windows\System\fIYVaFy.exe
  C:\Windows\System\fIYVaFy.exe
  2⤵
  PID:10368
- C:\Windows\System\upszVFi.exe
  C:\Windows\System\upszVFi.exe
  2⤵
  PID:10384
- C:\Windows\System\HfrEmPQ.exe
  C:\Windows\System\HfrEmPQ.exe
  2⤵
  PID:10400
- C:\Windows\System\ZgNnycx.exe
  C:\Windows\System\ZgNnycx.exe
  2⤵
  PID:10420
- C:\Windows\System\MqBIfsR.exe
  C:\Windows\System\MqBIfsR.exe
  2⤵
  PID:10436
- C:\Windows\System\CKwWRpe.exe
  C:\Windows\System\CKwWRpe.exe
  2⤵
  PID:10452
- C:\Windows\System\IBqZKIf.exe
  C:\Windows\System\IBqZKIf.exe
  2⤵
  PID:10468
- C:\Windows\System\JebRfup.exe
  C:\Windows\System\JebRfup.exe
  2⤵
  PID:10484
- C:\Windows\System\ZAZZZdG.exe
  C:\Windows\System\ZAZZZdG.exe
  2⤵
  PID:10504
- C:\Windows\System\FLtjcBD.exe
  C:\Windows\System\FLtjcBD.exe
  2⤵
  PID:10544
- C:\Windows\System\hpGzylN.exe
  C:\Windows\System\hpGzylN.exe
  2⤵
  PID:10572
- C:\Windows\System\IRbItWW.exe
  C:\Windows\System\IRbItWW.exe
  2⤵
  PID:10604
- C:\Windows\System\wWptRdD.exe
  C:\Windows\System\wWptRdD.exe
  2⤵
  PID:10624
- C:\Windows\System\rpzENPf.exe
  C:\Windows\System\rpzENPf.exe
  2⤵
  PID:10656
- C:\Windows\System\zDHQRgb.exe
  C:\Windows\System\zDHQRgb.exe
  2⤵
  PID:10672
- C:\Windows\System\uLLSkfg.exe
  C:\Windows\System\uLLSkfg.exe
  2⤵
  PID:10700
- C:\Windows\System\lZgjhoq.exe
  C:\Windows\System\lZgjhoq.exe
  2⤵
  PID:10720
- C:\Windows\System\NzQLvHq.exe
  C:\Windows\System\NzQLvHq.exe
  2⤵
  PID:10736
- C:\Windows\System\DyqPaRR.exe
  C:\Windows\System\DyqPaRR.exe
  2⤵
  PID:10760
- C:\Windows\System\MbtQmGN.exe
  C:\Windows\System\MbtQmGN.exe
  2⤵
  PID:10780
- C:\Windows\System\PfUXAQk.exe
  C:\Windows\System\PfUXAQk.exe
  2⤵
  PID:10796
- C:\Windows\System\cEJkojc.exe
  C:\Windows\System\cEJkojc.exe
  2⤵
  PID:10812
- C:\Windows\System\rFHbJKY.exe
  C:\Windows\System\rFHbJKY.exe
  2⤵
  PID:10832
- C:\Windows\System\OtEtEtc.exe
  C:\Windows\System\OtEtEtc.exe
  2⤵
  PID:10848
- C:\Windows\System\YlZwuHG.exe
  C:\Windows\System\YlZwuHG.exe
  2⤵
  PID:10868
- C:\Windows\System\hYLvgKn.exe
  C:\Windows\System\hYLvgKn.exe
  2⤵
  PID:10888
- C:\Windows\System\RZqpCiA.exe
  C:\Windows\System\RZqpCiA.exe
  2⤵
  PID:10904
- C:\Windows\System\AXCSGyT.exe
  C:\Windows\System\AXCSGyT.exe
  2⤵
  PID:10924
- C:\Windows\System\GveqLPV.exe
  C:\Windows\System\GveqLPV.exe
  2⤵
  PID:10940
- C:\Windows\System\PSGgOEP.exe
  C:\Windows\System\PSGgOEP.exe
  2⤵
  PID:10960
- C:\Windows\System\NQpxxgv.exe
  C:\Windows\System\NQpxxgv.exe
  2⤵
  PID:10980
- C:\Windows\System\BYDjDGt.exe
  C:\Windows\System\BYDjDGt.exe
  2⤵
  PID:10996
- C:\Windows\System\hRfwKOB.exe
  C:\Windows\System\hRfwKOB.exe
  2⤵
  PID:11020
- C:\Windows\System\iBpHGaj.exe
  C:\Windows\System\iBpHGaj.exe
  2⤵
  PID:11040
- C:\Windows\System\MyIlhPW.exe
  C:\Windows\System\MyIlhPW.exe
  2⤵
  PID:11072
- C:\Windows\System\vqsewVM.exe
  C:\Windows\System\vqsewVM.exe
  2⤵
  PID:11088
- C:\Windows\System\VGAvoyc.exe
  C:\Windows\System\VGAvoyc.exe
  2⤵
  PID:11164
- C:\Windows\System\BEVluyS.exe
  C:\Windows\System\BEVluyS.exe
  2⤵
  PID:11188
- C:\Windows\System\cVIftUN.exe
  C:\Windows\System\cVIftUN.exe
  2⤵
  PID:11204
- C:\Windows\System\jxWeXHv.exe
  C:\Windows\System\jxWeXHv.exe
  2⤵
  PID:11220
- C:\Windows\System\FayzFWn.exe
  C:\Windows\System\FayzFWn.exe
  2⤵
  PID:11236
- C:\Windows\System\TiblAQm.exe
  C:\Windows\System\TiblAQm.exe
  2⤵
  PID:11252
- C:\Windows\System\JPbEGov.exe
  C:\Windows\System\JPbEGov.exe
  2⤵
  PID:8288
- C:\Windows\System\AyvUyMm.exe
  C:\Windows\System\AyvUyMm.exe
  2⤵
  PID:8480
- C:\Windows\System\UrmwwrK.exe
  C:\Windows\System\UrmwwrK.exe
  2⤵
  PID:8652
- C:\Windows\System\mzICUNa.exe
  C:\Windows\System\mzICUNa.exe
  2⤵
  PID:8708
- C:\Windows\System\LWoFUpO.exe
  C:\Windows\System\LWoFUpO.exe
  2⤵
  PID:8780
- C:\Windows\System\TLRERZx.exe
  C:\Windows\System\TLRERZx.exe
  2⤵
  PID:8816
- C:\Windows\System\hClFzoW.exe
  C:\Windows\System\hClFzoW.exe
  2⤵
  PID:7428
- C:\Windows\System\rHurPWO.exe
  C:\Windows\System\rHurPWO.exe
  2⤵
  PID:8872
- C:\Windows\System\gmIqrMP.exe
  C:\Windows\System\gmIqrMP.exe
  2⤵
  PID:8908
- C:\Windows\System\EfsHwKu.exe
  C:\Windows\System\EfsHwKu.exe
  2⤵
  PID:8944
- C:\Windows\System\LzvDVLD.exe
  C:\Windows\System\LzvDVLD.exe
  2⤵
  PID:8968
- C:\Windows\System\Qhxmjwl.exe
  C:\Windows\System\Qhxmjwl.exe
  2⤵
  PID:8984
- C:\Windows\System\JtIjnGV.exe
  C:\Windows\System\JtIjnGV.exe
  2⤵
  PID:9000
- C:\Windows\System\cLkFGpS.exe
  C:\Windows\System\cLkFGpS.exe
  2⤵
  PID:9032
- C:\Windows\System\WMnjECP.exe
  C:\Windows\System\WMnjECP.exe
  2⤵
  PID:7552
- C:\Windows\System\JWJhaAR.exe
  C:\Windows\System\JWJhaAR.exe
  2⤵
  PID:7584
- C:\Windows\System\IhiJTxc.exe
  C:\Windows\System\IhiJTxc.exe
  2⤵
  PID:7620
- C:\Windows\System\ojoHAwV.exe
  C:\Windows\System\ojoHAwV.exe
  2⤵
  PID:7652
- C:\Windows\System\aPVhwfR.exe
  C:\Windows\System\aPVhwfR.exe
  2⤵
  PID:9612
- C:\Windows\System\FDWZOtI.exe
  C:\Windows\System\FDWZOtI.exe
  2⤵
  PID:7784
- C:\Windows\System\iBSnrvZ.exe
  C:\Windows\System\iBSnrvZ.exe
  2⤵
  PID:7908
- C:\Windows\System\mhHKqtj.exe
  C:\Windows\System\mhHKqtj.exe
  2⤵
  PID:9684
- C:\Windows\System\uXxMilK.exe
  C:\Windows\System\uXxMilK.exe
  2⤵
  PID:11684
- C:\Windows\System\tazUURe.exe
  C:\Windows\System\tazUURe.exe
  2⤵
  PID:11700
- C:\Windows\System\nGXTwLp.exe
  C:\Windows\System\nGXTwLp.exe
  2⤵
  PID:11724
- C:\Windows\System\GGhfalm.exe
  C:\Windows\System\GGhfalm.exe
  2⤵
  PID:11740
- C:\Windows\System\PAXrbbW.exe
  C:\Windows\System\PAXrbbW.exe
  2⤵
  PID:11756
- C:\Windows\System\OYGhvan.exe
  C:\Windows\System\OYGhvan.exe
  2⤵
  PID:11812
- C:\Windows\System\UqtGyxh.exe
  C:\Windows\System\UqtGyxh.exe
  2⤵
  PID:11892
- C:\Windows\System\TrshUrG.exe
  C:\Windows\System\TrshUrG.exe
  2⤵
  PID:12052
- C:\Windows\System\HQgetmw.exe
  C:\Windows\System\HQgetmw.exe
  2⤵
  PID:12096
- C:\Windows\System\wWcWVYC.exe
  C:\Windows\System\wWcWVYC.exe
  2⤵
  PID:12120
- C:\Windows\System\kPgGwnG.exe
  C:\Windows\System\kPgGwnG.exe
  2⤵
  PID:12152
- C:\Windows\System\CaVSXpP.exe
  C:\Windows\System\CaVSXpP.exe
  2⤵
  PID:12232
- C:\Windows\System\PRfECJX.exe
  C:\Windows\System\PRfECJX.exe
  2⤵
  PID:12252
- C:\Windows\System\qzeJXQB.exe
  C:\Windows\System\qzeJXQB.exe
  2⤵
  PID:12268
- C:\Windows\System\XvKoaoc.exe
  C:\Windows\System\XvKoaoc.exe
  2⤵
  PID:10820
- C:\Windows\System\aKkpAyV.exe
  C:\Windows\System\aKkpAyV.exe
  2⤵
  PID:9632
- C:\Windows\System\RyjzINO.exe
  C:\Windows\System\RyjzINO.exe
  2⤵
  PID:10912
- C:\Windows\System\qPBdTwf.exe
  C:\Windows\System\qPBdTwf.exe
  2⤵
  PID:9792
- C:\Windows\System\CbJFuMj.exe
  C:\Windows\System\CbJFuMj.exe
  2⤵
  PID:9168
- C:\Windows\System\bMjeqvG.exe
  C:\Windows\System\bMjeqvG.exe
  2⤵
  PID:7312
- C:\Windows\System\hTNuWek.exe
  C:\Windows\System\hTNuWek.exe
  2⤵
  PID:7512
- C:\Windows\System\pikPVht.exe
  C:\Windows\System\pikPVht.exe
  2⤵
  PID:7740
- C:\Windows\System\EMvOZaG.exe
  C:\Windows\System\EMvOZaG.exe
  2⤵
  PID:9224
- C:\Windows\System\ydYLmZP.exe
  C:\Windows\System\ydYLmZP.exe
  2⤵
  PID:9256
- C:\Windows\System\uelMRwm.exe
  C:\Windows\System\uelMRwm.exe
  2⤵
  PID:4988
- C:\Windows\System\KScxIxr.exe
  C:\Windows\System\KScxIxr.exe
  2⤵
  PID:9340
- C:\Windows\System\gCcgXhU.exe
  C:\Windows\System\gCcgXhU.exe
  2⤵
  PID:9404
- C:\Windows\System\gFaYFbZ.exe
  C:\Windows\System\gFaYFbZ.exe
  2⤵
  PID:9520
- C:\Windows\System\jmWsVHq.exe
  C:\Windows\System\jmWsVHq.exe
  2⤵
  PID:2076
- C:\Windows\System\mvGEDtP.exe
  C:\Windows\System\mvGEDtP.exe
  2⤵
  PID:8980
- C:\Windows\System\CDhcKAw.exe
  C:\Windows\System\CDhcKAw.exe
  2⤵
  PID:9056
- C:\Windows\System\ZitVdNJ.exe
  C:\Windows\System\ZitVdNJ.exe
  2⤵
  PID:7616
- C:\Windows\System\QkhBWbr.exe
  C:\Windows\System\QkhBWbr.exe
  2⤵
  PID:9596
- C:\Windows\System\gYEylib.exe
  C:\Windows\System\gYEylib.exe
  2⤵
  PID:7896
- C:\Windows\System\ksgeUUw.exe
  C:\Windows\System\ksgeUUw.exe
  2⤵
  PID:9708
- C:\Windows\System\hJrxOgT.exe
  C:\Windows\System\hJrxOgT.exe
  2⤵
  PID:2284
- C:\Windows\System\dZaxpwL.exe
  C:\Windows\System\dZaxpwL.exe
  2⤵
  PID:6848
- C:\Windows\System\NugaIst.exe
  C:\Windows\System\NugaIst.exe
  2⤵
  PID:7136
- C:\Windows\System\oIeiCMs.exe
  C:\Windows\System\oIeiCMs.exe
  2⤵
  PID:9776
- C:\Windows\System\MGoQNFS.exe
  C:\Windows\System\MGoQNFS.exe
  2⤵
  PID:9940
- C:\Windows\System\dcHlhuY.exe
  C:\Windows\System\dcHlhuY.exe
  2⤵
  PID:10040
- C:\Windows\System\gGUYTBo.exe
  C:\Windows\System\gGUYTBo.exe
  2⤵
  PID:10080
- C:\Windows\System\qePLkxX.exe
  C:\Windows\System\qePLkxX.exe
  2⤵
  PID:10216
- C:\Windows\System\JqAzczj.exe
  C:\Windows\System\JqAzczj.exe
  2⤵
  PID:7932
- C:\Windows\System\WorkFyH.exe
  C:\Windows\System\WorkFyH.exe
  2⤵
  PID:7292
- C:\Windows\System\XvtvhkH.exe
  C:\Windows\System\XvtvhkH.exe
  2⤵
  PID:12320
- C:\Windows\System\bSoIDuW.exe
  C:\Windows\System\bSoIDuW.exe
  2⤵
  PID:12344
- C:\Windows\System\xPJHgSG.exe
  C:\Windows\System\xPJHgSG.exe
  2⤵
  PID:12360
- C:\Windows\System\saoXLiI.exe
  C:\Windows\System\saoXLiI.exe
  2⤵
  PID:12384
- C:\Windows\System\QDHFDPX.exe
  C:\Windows\System\QDHFDPX.exe
  2⤵
  PID:12400
- C:\Windows\System\HozGUlj.exe
  C:\Windows\System\HozGUlj.exe
  2⤵
  PID:12424
- C:\Windows\System\QeohWFu.exe
  C:\Windows\System\QeohWFu.exe
  2⤵
  PID:12440
- C:\Windows\System\uPmWwmx.exe
  C:\Windows\System\uPmWwmx.exe
  2⤵
  PID:12460
- C:\Windows\System\pAwYBDs.exe
  C:\Windows\System\pAwYBDs.exe
  2⤵
  PID:12480
- C:\Windows\System\drTTDNT.exe
  C:\Windows\System\drTTDNT.exe
  2⤵
  PID:12496
- C:\Windows\System\wDJZJif.exe
  C:\Windows\System\wDJZJif.exe
  2⤵
  PID:12520
- C:\Windows\System\iOBYDGv.exe
  C:\Windows\System\iOBYDGv.exe
  2⤵
  PID:12536
- C:\Windows\System\zhTeJwL.exe
  C:\Windows\System\zhTeJwL.exe
  2⤵
  PID:12576
- C:\Windows\System\ysaLTzM.exe
  C:\Windows\System\ysaLTzM.exe
  2⤵
  PID:12600
- C:\Windows\System\InrOnoX.exe
  C:\Windows\System\InrOnoX.exe
  2⤵
  PID:12620
- C:\Windows\System\CRZNCsU.exe
  C:\Windows\System\CRZNCsU.exe
  2⤵
  PID:12640
- C:\Windows\System\RigNRpM.exe
  C:\Windows\System\RigNRpM.exe
  2⤵
  PID:12656
- C:\Windows\System\JBANmRg.exe
  C:\Windows\System\JBANmRg.exe
  2⤵
  PID:12680
- C:\Windows\System\gNLwkia.exe
  C:\Windows\System\gNLwkia.exe
  2⤵
  PID:12696
- C:\Windows\System\czDXwnK.exe
  C:\Windows\System\czDXwnK.exe
  2⤵
  PID:12720
- C:\Windows\System\CwsdcRm.exe
  C:\Windows\System\CwsdcRm.exe
  2⤵
  PID:12740
- C:\Windows\System\ntEXhoM.exe
  C:\Windows\System\ntEXhoM.exe
  2⤵
  PID:12756
- C:\Windows\System\FGNZWCD.exe
  C:\Windows\System\FGNZWCD.exe
  2⤵
  PID:12776
- C:\Windows\System\UoDdjPE.exe
  C:\Windows\System\UoDdjPE.exe
  2⤵
  PID:12792
- C:\Windows\System\SFJxGoA.exe
  C:\Windows\System\SFJxGoA.exe
  2⤵
  PID:12816
- C:\Windows\System\nMPiHZV.exe
  C:\Windows\System\nMPiHZV.exe
  2⤵
  PID:12832
- C:\Windows\System\YraVSda.exe
  C:\Windows\System\YraVSda.exe
  2⤵
  PID:12856
- C:\Windows\System\tYIsMst.exe
  C:\Windows\System\tYIsMst.exe
  2⤵
  PID:12872
- C:\Windows\System\iuHNyfP.exe
  C:\Windows\System\iuHNyfP.exe
  2⤵
  PID:12900
- C:\Windows\System\TTeuhjf.exe
  C:\Windows\System\TTeuhjf.exe
  2⤵
  PID:12916
- C:\Windows\System\FEdCpRY.exe
  C:\Windows\System\FEdCpRY.exe
  2⤵
  PID:12940
- C:\Windows\System\otDZvpl.exe
  C:\Windows\System\otDZvpl.exe
  2⤵
  PID:12956
- C:\Windows\System\BEuiKeh.exe
  C:\Windows\System\BEuiKeh.exe
  2⤵
  PID:12976
- C:\Windows\System\tYvaXgu.exe
  C:\Windows\System\tYvaXgu.exe
  2⤵
  PID:12996
- C:\Windows\System\KjKkuhB.exe
  C:\Windows\System\KjKkuhB.exe
  2⤵
  PID:13016
- C:\Windows\System\cmCalkR.exe
  C:\Windows\System\cmCalkR.exe
  2⤵
  PID:13036
- C:\Windows\System\iGCQnJQ.exe
  C:\Windows\System\iGCQnJQ.exe
  2⤵
  PID:13052
- C:\Windows\System\BxVzEhJ.exe
  C:\Windows\System\BxVzEhJ.exe
  2⤵
  PID:13072
- C:\Windows\System\wYwPXcQ.exe
  C:\Windows\System\wYwPXcQ.exe
  2⤵
  PID:13092
- C:\Windows\System\xotFMLo.exe
  C:\Windows\System\xotFMLo.exe
  2⤵
  PID:13108
- C:\Windows\System\ChFfMhh.exe
  C:\Windows\System\ChFfMhh.exe
  2⤵
  PID:13124
- C:\Windows\System\kVqDtZR.exe
  C:\Windows\System\kVqDtZR.exe
  2⤵
  PID:13140
- C:\Windows\System\XoNKava.exe
  C:\Windows\System\XoNKava.exe
  2⤵
  PID:13156
- C:\Windows\System\gCpliLS.exe
  C:\Windows\System\gCpliLS.exe
  2⤵
  PID:13176
- C:\Windows\System\ZCYGuzX.exe
  C:\Windows\System\ZCYGuzX.exe
  2⤵
  PID:13192
- C:\Windows\System\sTaXTun.exe
  C:\Windows\System\sTaXTun.exe
  2⤵
  PID:13208
- C:\Windows\System\yHpscjA.exe
  C:\Windows\System\yHpscjA.exe
  2⤵
  PID:13224
- C:\Windows\System\yozhkLw.exe
  C:\Windows\System\yozhkLw.exe
  2⤵
  PID:6160
- C:\Windows\System\IJsitSs.exe
  C:\Windows\System\IJsitSs.exe
  2⤵
  PID:10332
- C:\Windows\System\JXWSLVP.exe
  C:\Windows\System\JXWSLVP.exe
  2⤵
  PID:10364
- C:\Windows\System\IkdOBBf.exe
  C:\Windows\System\IkdOBBf.exe
  2⤵
  PID:10396
- C:\Windows\System\BgZxgRI.exe
  C:\Windows\System\BgZxgRI.exe
  2⤵
  PID:10428
- C:\Windows\System\wQkaYiz.exe
  C:\Windows\System\wQkaYiz.exe
  2⤵
  PID:10492
- C:\Windows\System\cyTUzMv.exe
  C:\Windows\System\cyTUzMv.exe
  2⤵
  PID:10516
- C:\Windows\System\bvWLDbC.exe
  C:\Windows\System\bvWLDbC.exe
  2⤵
  PID:3920
- C:\Windows\System\CFSVpSJ.exe
  C:\Windows\System\CFSVpSJ.exe
  2⤵
  PID:11712
- C:\Windows\System\LtyggwN.exe
  C:\Windows\System\LtyggwN.exe
  2⤵
  PID:8228
- C:\Windows\System\RgJYvzA.exe
  C:\Windows\System\RgJYvzA.exe
  2⤵
  PID:12300
- C:\Windows\System\MaIFsFb.exe
  C:\Windows\System\MaIFsFb.exe
  2⤵
  PID:12336
- C:\Windows\System\vUZUYqQ.exe
  C:\Windows\System\vUZUYqQ.exe
  2⤵
  PID:12732
- C:\Windows\System\sJcqrNh.exe
  C:\Windows\System\sJcqrNh.exe
  2⤵
  PID:12688
- C:\Windows\System\wWKkMfY.exe
  C:\Windows\System\wWKkMfY.exe
  2⤵
  PID:12652
- C:\Windows\System\CWRXDhg.exe
  C:\Windows\System\CWRXDhg.exe
  2⤵
  PID:12596
- C:\Windows\System\iczkfUN.exe
  C:\Windows\System\iczkfUN.exe
  2⤵
  PID:12568
- C:\Windows\System\ZUCWxaA.exe
  C:\Windows\System\ZUCWxaA.exe
  2⤵
  PID:1508
- C:\Windows\System\sPYrMnH.exe
  C:\Windows\System\sPYrMnH.exe
  2⤵
  PID:11004
- C:\Windows\System\QsAKutQ.exe
  C:\Windows\System\QsAKutQ.exe
  2⤵
  PID:11368
- C:\Windows\System\cPWfnur.exe
  C:\Windows\System\cPWfnur.exe
  2⤵
  PID:10920
- C:\Windows\System\xBxiEEw.exe
  C:\Windows\System\xBxiEEw.exe
  2⤵
  PID:11424
- C:\Windows\System\YavoASJ.exe
  C:\Windows\System\YavoASJ.exe
  2⤵
  PID:11184
- C:\Windows\System\QlVUljF.exe
  C:\Windows\System\QlVUljF.exe
  2⤵
  PID:8856
- C:\Windows\System\amekMDi.exe
  C:\Windows\System\amekMDi.exe
  2⤵
  PID:11048
- C:\Windows\System\uAVjLoG.exe
  C:\Windows\System\uAVjLoG.exe
  2⤵
  PID:5096
- C:\Windows\System\ciUyczB.exe
  C:\Windows\System\ciUyczB.exe
  2⤵
  PID:4976
- C:\Windows\System\kHaIuKR.exe
  C:\Windows\System\kHaIuKR.exe
  2⤵
  PID:11080
- C:\Windows\System\kTZEyFO.exe
  C:\Windows\System\kTZEyFO.exe
  2⤵
  PID:11084
- C:\Windows\System\aaiBntW.exe
  C:\Windows\System\aaiBntW.exe
  2⤵
  PID:10236
- C:\Windows\System\ALRYcmD.exe
  C:\Windows\System\ALRYcmD.exe
  2⤵
  PID:11300
- C:\Windows\System\hlAbEDu.exe
  C:\Windows\System\hlAbEDu.exe
  2⤵
  PID:8768
- C:\Windows\System\CErtIwX.exe
  C:\Windows\System\CErtIwX.exe
  2⤵
  PID:1572
- C:\Windows\System\HzYiYmo.exe
  C:\Windows\System\HzYiYmo.exe
  2⤵
  PID:11608
- C:\Windows\System\xwcEBMf.exe
  C:\Windows\System\xwcEBMf.exe
  2⤵
  PID:3796
- C:\Windows\System\qYKGOcd.exe
  C:\Windows\System\qYKGOcd.exe
  2⤵
  PID:2644
- C:\Windows\System\JhAffZG.exe
  C:\Windows\System\JhAffZG.exe
  2⤵
  PID:12104
- C:\Windows\System\CwKvQPe.exe
  C:\Windows\System\CwKvQPe.exe
  2⤵
  PID:5100
- C:\Windows\System\KhAblGA.exe
  C:\Windows\System\KhAblGA.exe
  2⤵
  PID:11736
- C:\Windows\System\BgEPdnQ.exe
  C:\Windows\System\BgEPdnQ.exe
  2⤵
  PID:11652
- C:\Windows\System\yOshbCv.exe
  C:\Windows\System\yOshbCv.exe
  2⤵
  PID:8576
- C:\Windows\System\YetiPuv.exe
  C:\Windows\System\YetiPuv.exe
  2⤵
  PID:9212
- C:\Windows\System\dsIHTZB.exe
  C:\Windows\System\dsIHTZB.exe
  2⤵
  PID:11448
- C:\Windows\System\ACoqWnd.exe
  C:\Windows\System\ACoqWnd.exe
  2⤵
  PID:7892
- C:\Windows\System\oMnVkSm.exe
  C:\Windows\System\oMnVkSm.exe
  2⤵
  PID:9016
- C:\Windows\System\WgpXsGA.exe
  C:\Windows\System\WgpXsGA.exe
  2⤵
  PID:9272
- C:\Windows\System\vNPehni.exe
  C:\Windows\System\vNPehni.exe
  2⤵
  PID:9864
- C:\Windows\System\VqPFWKa.exe
  C:\Windows\System\VqPFWKa.exe
  2⤵
  PID:11588
- C:\Windows\System\ULpBBXA.exe
  C:\Windows\System\ULpBBXA.exe
  2⤵
  PID:6900
- C:\Windows\System\ySTfTXQ.exe
  C:\Windows\System\ySTfTXQ.exe
  2⤵
  PID:7964
- C:\Windows\System\SCiFhAS.exe
  C:\Windows\System\SCiFhAS.exe
  2⤵
  PID:11540
- C:\Windows\System\HwHBKnV.exe
  C:\Windows\System\HwHBKnV.exe
  2⤵
  PID:11692
- C:\Windows\System\CZtrSDK.exe
  C:\Windows\System\CZtrSDK.exe
  2⤵
  PID:11856
- C:\Windows\System\qBfwqzY.exe
  C:\Windows\System\qBfwqzY.exe
  2⤵
  PID:8000
- C:\Windows\System\BrhxgkH.exe
  C:\Windows\System\BrhxgkH.exe
  2⤵
  PID:11336
- C:\Windows\System\JSQUQVf.exe
  C:\Windows\System\JSQUQVf.exe
  2⤵
  PID:13184
- C:\Windows\System\lsqzKvp.exe
  C:\Windows\System\lsqzKvp.exe
  2⤵
  PID:6092
- C:\Windows\System\JtumAjR.exe
  C:\Windows\System\JtumAjR.exe
  2⤵
  PID:12380
- C:\Windows\System\CAHHBnX.exe
  C:\Windows\System\CAHHBnX.exe
  2⤵
  PID:12452
- C:\Windows\System\UwnECJH.exe
  C:\Windows\System\UwnECJH.exe
  2⤵
  PID:13064
- C:\Windows\System\TQhtbWD.exe
  C:\Windows\System\TQhtbWD.exe
  2⤵
  PID:12968
- C:\Windows\System\zrNQxmh.exe
  C:\Windows\System\zrNQxmh.exe
  2⤵
  PID:2492
- C:\Windows\System\YhvxBTb.exe
  C:\Windows\System\YhvxBTb.exe
  2⤵
  PID:12840
- C:\Windows\System\tMnDqMw.exe
  C:\Windows\System\tMnDqMw.exe
  2⤵
  PID:12692
- C:\Windows\System\ILmyVjQ.exe
  C:\Windows\System\ILmyVjQ.exe
  2⤵
  PID:12572
- C:\Windows\System\kmeectD.exe
  C:\Windows\System\kmeectD.exe
  2⤵
  PID:11408
- C:\Windows\System\iKHZeCS.exe
  C:\Windows\System\iKHZeCS.exe
  2⤵
  PID:1088
- C:\Windows\System\coRFQmj.exe
  C:\Windows\System\coRFQmj.exe
  2⤵
  PID:4856
- C:\Windows\System\pTfPLOf.exe
  C:\Windows\System\pTfPLOf.exe
  2⤵
  PID:10512
- C:\Windows\System\zKGwkrx.exe
  C:\Windows\System\zKGwkrx.exe
  2⤵
  PID:10692
- C:\Windows\System\ELYxjlE.exe
  C:\Windows\System\ELYxjlE.exe
  2⤵
  PID:2620
- C:\Windows\System\uFnBhcK.exe
  C:\Windows\System\uFnBhcK.exe
  2⤵
  PID:8080
- C:\Windows\System\NEgxPaJ.exe
  C:\Windows\System\NEgxPaJ.exe
  2⤵
  PID:10328
- C:\Windows\System\jyXDnGt.exe
  C:\Windows\System\jyXDnGt.exe
  2⤵
  PID:7216
- C:\Windows\System\uOnidEz.exe
  C:\Windows\System\uOnidEz.exe
  2⤵
  PID:8096
- C:\Windows\System\VhdjiFe.exe
  C:\Windows\System\VhdjiFe.exe
  2⤵
  PID:10272
- C:\Windows\System\NEGIrbZ.exe
  C:\Windows\System\NEGIrbZ.exe
  2⤵
  PID:3540
- C:\Windows\System\vgoCGVU.exe
  C:\Windows\System\vgoCGVU.exe
  2⤵
  PID:7496
- C:\Windows\System\nbEqWPE.exe
  C:\Windows\System\nbEqWPE.exe
  2⤵
  PID:12432
- C:\Windows\System\vMAUTYx.exe
  C:\Windows\System\vMAUTYx.exe
  2⤵
  PID:13024
- C:\Windows\System\zbWfyVK.exe
  C:\Windows\System\zbWfyVK.exe
  2⤵
  PID:12908
- C:\Windows\System\qOziDFR.exe
  C:\Windows\System\qOziDFR.exe
  2⤵
  PID:1308
- C:\Windows\System\xoCfEFn.exe
  C:\Windows\System\xoCfEFn.exe
  2⤵
  PID:12584
- C:\Windows\System\VEPAXsl.exe
  C:\Windows\System\VEPAXsl.exe
  2⤵
  PID:8692
- C:\Windows\System\Jneimof.exe
  C:\Windows\System\Jneimof.exe
  2⤵
  PID:7448
- C:\Windows\System\GFRzhcs.exe
  C:\Windows\System\GFRzhcs.exe
  2⤵
  PID:4268
- C:\Windows\System\cqvLNVF.exe
  C:\Windows\System\cqvLNVF.exe
  2⤵
  PID:12420
- C:\Windows\System\qnVIysK.exe
  C:\Windows\System\qnVIysK.exe
  2⤵
  PID:8748
- C:\Windows\System\WvGqDMa.exe
  C:\Windows\System\WvGqDMa.exe
  2⤵
  PID:1896
- C:\Windows\System\xXRQZRR.exe
  C:\Windows\System\xXRQZRR.exe
  2⤵
  PID:12240
- C:\Windows\System\KqtGYAM.exe
  C:\Windows\System\KqtGYAM.exe
  2⤵
  PID:13308
- C:\Windows\System\SqZeaPT.exe
  C:\Windows\System\SqZeaPT.exe
  2⤵
  PID:10312
- C:\Windows\System\MaMeBpT.exe
  C:\Windows\System\MaMeBpT.exe
  2⤵
  PID:12516
- C:\Windows\System\IENlUQv.exe
  C:\Windows\System\IENlUQv.exe
  2⤵
  PID:11212
- C:\Windows\System\HMYrkHl.exe
  C:\Windows\System\HMYrkHl.exe
  2⤵
  PID:9664
- C:\Windows\System\uwrSrjE.exe
  C:\Windows\System\uwrSrjE.exe
  2⤵
  PID:11804
- C:\Windows\System\JJGydjQ.exe
  C:\Windows\System\JJGydjQ.exe
  2⤵
  PID:6576
- C:\Windows\System\LceurKY.exe
  C:\Windows\System\LceurKY.exe
  2⤵
  PID:13152
- C:\Windows\System\LAZPVYZ.exe
  C:\Windows\System\LAZPVYZ.exe
  2⤵
  PID:1568
- C:\Windows\System\MueVxeS.exe
  C:\Windows\System\MueVxeS.exe
  2⤵
  PID:5064
- C:\Windows\System\buLgYbq.exe
  C:\Windows\System\buLgYbq.exe
  2⤵
  PID:10464
- C:\Windows\System\NCssrfm.exe
  C:\Windows\System\NCssrfm.exe
  2⤵
  PID:4332
- C:\Windows\System\PBTOPVQ.exe
  C:\Windows\System\PBTOPVQ.exe
  2⤵
  PID:10864
- C:\Windows\System\rLqFVez.exe
  C:\Windows\System\rLqFVez.exe
  2⤵
  PID:11504
- C:\Windows\System\dwTVJCl.exe
  C:\Windows\System\dwTVJCl.exe
  2⤵
  PID:9248
- C:\Windows\System\JBoSkAv.exe
  C:\Windows\System\JBoSkAv.exe
  2⤵
  PID:9504
- C:\Windows\System\HSRoeqd.exe
  C:\Windows\System\HSRoeqd.exe
  2⤵
  PID:1892
- C:\Windows\System\uhbLLuZ.exe
  C:\Windows\System\uhbLLuZ.exe
  2⤵
  PID:13032
- C:\Windows\System\CJnHgut.exe
  C:\Windows\System\CJnHgut.exe
  2⤵
  PID:5892
- C:\Windows\System\ZupKYOG.exe
  C:\Windows\System\ZupKYOG.exe
  2⤵
  PID:12864
- C:\Windows\System\Xozfaen.exe
  C:\Windows\System\Xozfaen.exe
  2⤵
  PID:10860
- C:\Windows\System\EjuAswn.exe
  C:\Windows\System\EjuAswn.exe
  2⤵
  PID:2000
- C:\Windows\System\LRYzSLa.exe
  C:\Windows\System\LRYzSLa.exe
  2⤵
  PID:3976
- C:\Windows\System\oGhFChs.exe
  C:\Windows\System\oGhFChs.exe
  2⤵
  PID:12088
- C:\Windows\System\JwtpQYG.exe
  C:\Windows\System\JwtpQYG.exe
  2⤵
  PID:4324
- C:\Windows\System\vrlrTPQ.exe
  C:\Windows\System\vrlrTPQ.exe
  2⤵
  PID:12736
- C:\Windows\System\lnSCQiK.exe
  C:\Windows\System\lnSCQiK.exe
  2⤵
  PID:8048
- C:\Windows\System\LnRWpzt.exe
  C:\Windows\System\LnRWpzt.exe
  2⤵
  PID:3336
- C:\Windows\System\HKcEdzr.exe
  C:\Windows\System\HKcEdzr.exe
  2⤵
  PID:1928
- C:\Windows\System\rsiGDKx.exe
  C:\Windows\System\rsiGDKx.exe
  2⤵
  PID:10228
- C:\Windows\System\sTaSHvt.exe
  C:\Windows\System\sTaSHvt.exe
  2⤵
  PID:13368
- C:\Windows\System\yDCGHxx.exe
  C:\Windows\System\yDCGHxx.exe
  2⤵
  PID:13508
- C:\Windows\System\SRzMmSk.exe
  C:\Windows\System\SRzMmSk.exe
  2⤵
  PID:13548
- C:\Windows\System\BplnJgX.exe
  C:\Windows\System\BplnJgX.exe
  2⤵
  PID:13720
- C:\Windows\System\VipOPrJ.exe
  C:\Windows\System\VipOPrJ.exe
  2⤵
  PID:13764
- C:\Windows\System\RtyaYOf.exe
  C:\Windows\System\RtyaYOf.exe
  2⤵
  PID:13800
- C:\Windows\System\FmrRCLU.exe
  C:\Windows\System\FmrRCLU.exe
  2⤵
  PID:13816
- C:\Windows\System\wNTkObD.exe
  C:\Windows\System\wNTkObD.exe
  2⤵
  PID:13988
- C:\Windows\System\Fqtazsb.exe
  C:\Windows\System\Fqtazsb.exe
  2⤵
  PID:14036
- C:\Windows\System\ZqTkqDm.exe
  C:\Windows\System\ZqTkqDm.exe
  2⤵
  PID:14128
- C:\Windows\System\FuxRlgo.exe
  C:\Windows\System\FuxRlgo.exe
  2⤵
  PID:14160
- C:\Windows\System\LGKXpet.exe
  C:\Windows\System\LGKXpet.exe
  2⤵
  PID:14176
- C:\Windows\System\KlPKeFq.exe
  C:\Windows\System\KlPKeFq.exe
  2⤵
  PID:14192
- C:\Windows\System\HkTkDeq.exe
  C:\Windows\System\HkTkDeq.exe
  2⤵
  PID:14332
- C:\Windows\System\qDcuWDg.exe
  C:\Windows\System\qDcuWDg.exe
  2⤵
  PID:13668
- C:\Windows\System\gYFqtWr.exe
  C:\Windows\System\gYFqtWr.exe
  2⤵
  PID:4696
- C:\Windows\System\UVGmORC.exe
  C:\Windows\System\UVGmORC.exe
  2⤵
  PID:14108
- C:\Windows\System\xPWxDyU.exe
  C:\Windows\System\xPWxDyU.exe
  2⤵
  PID:13884
- C:\Windows\System\zUBBxAG.exe
  C:\Windows\System\zUBBxAG.exe
  2⤵
  PID:13908
- C:\Windows\System\VSmvVAR.exe
  C:\Windows\System\VSmvVAR.exe
  2⤵
  PID:13936
- C:\Windows\System\HyhpWRG.exe
  C:\Windows\System\HyhpWRG.exe
  2⤵
  PID:1656
- C:\Windows\System\DkTWcQY.exe
  C:\Windows\System\DkTWcQY.exe
  2⤵
  PID:14264
- C:\Windows\System\YGkSYut.exe
  C:\Windows\System\YGkSYut.exe
  2⤵
  PID:13464
- C:\Windows\System\zddKfiL.exe
  C:\Windows\System\zddKfiL.exe
  2⤵
  PID:2908
- C:\Windows\System\DRsmVGs.exe
  C:\Windows\System\DRsmVGs.exe
  2⤵
  PID:13396
- C:\Windows\System\jXmQVEY.exe
  C:\Windows\System\jXmQVEY.exe
  2⤵
  PID:13556
- C:\Windows\System\iSEoRTp.exe
  C:\Windows\System\iSEoRTp.exe
  2⤵
  PID:4768
- C:\Windows\System\tWKsTZc.exe
  C:\Windows\System\tWKsTZc.exe
  2⤵
  PID:13728
- C:\Windows\System\gecszSr.exe
  C:\Windows\System\gecszSr.exe
  2⤵
  PID:5052
- C:\Windows\System\FflQOBa.exe
  C:\Windows\System\FflQOBa.exe
  2⤵
  PID:13904
- C:\Windows\System\jtEDAYF.exe
  C:\Windows\System\jtEDAYF.exe
  2⤵
  PID:13972
- C:\Windows\System\KFhlbTJ.exe
  C:\Windows\System\KFhlbTJ.exe
  2⤵
  PID:14028
- C:\Windows\System\hUbdFJC.exe
  C:\Windows\System\hUbdFJC.exe
  2⤵
  PID:14320
- C:\Windows\System\UwRlrLY.exe
  C:\Windows\System\UwRlrLY.exe
  2⤵
  PID:14124
- C:\Windows\System\PCOhthu.exe
  C:\Windows\System\PCOhthu.exe
  2⤵
  PID:4320
- C:\Windows\System\puoGqZk.exe
  C:\Windows\System\puoGqZk.exe
  2⤵
  PID:3348
- C:\Windows\System\luyWgXT.exe
  C:\Windows\System\luyWgXT.exe
  2⤵
  PID:14228
- C:\Windows\System\zaGkWzE.exe
  C:\Windows\System\zaGkWzE.exe
  2⤵
  PID:14232
- C:\Windows\System\nUieabO.exe
  C:\Windows\System\nUieabO.exe
  2⤵
  PID:14280
- C:\Windows\System\gfCpIYn.exe
  C:\Windows\System\gfCpIYn.exe
  2⤵
  PID:14304
- C:\Windows\System\WyScedH.exe
  C:\Windows\System\WyScedH.exe
  2⤵
  PID:6084
- C:\Windows\System\BnSRXkY.exe
  C:\Windows\System\BnSRXkY.exe
  2⤵
  PID:6024
- C:\Windows\System\uziehsy.exe
  C:\Windows\System\uziehsy.exe
  2⤵
  PID:13500
- C:\Windows\System\Dyvppal.exe
  C:\Windows\System\Dyvppal.exe
  2⤵
  PID:5672
- C:\Windows\System\UuXmBFn.exe
  C:\Windows\System\UuXmBFn.exe
  2⤵
  PID:1984
- C:\Windows\System\jcetGgu.exe
  C:\Windows\System\jcetGgu.exe
  2⤵
  PID:1648
- C:\Windows\System\HvKcdpA.exe
  C:\Windows\System\HvKcdpA.exe
  2⤵
  PID:6088
- C:\Windows\System\eiHfCkV.exe
  C:\Windows\System\eiHfCkV.exe
  2⤵
  PID:3392
- C:\Windows\System\KaRryyq.exe
  C:\Windows\System\KaRryyq.exe
  2⤵
  PID:1100
- C:\Windows\System\fqmSTHx.exe
  C:\Windows\System\fqmSTHx.exe
  2⤵
  PID:13648
- C:\Windows\System\jzLwznZ.exe
  C:\Windows\System\jzLwznZ.exe
  2⤵
  PID:5708
- C:\Windows\System\zZnkekJ.exe
  C:\Windows\System\zZnkekJ.exe
  2⤵
  PID:13600
- C:\Windows\System\EgdeqVG.exe
  C:\Windows\System\EgdeqVG.exe
  2⤵
  PID:13836
- C:\Windows\System\CHVLObD.exe
  C:\Windows\System\CHVLObD.exe
  2⤵
  PID:6500
- C:\Windows\System\UQpacXr.exe
  C:\Windows\System\UQpacXr.exe
  2⤵
  PID:6612
- C:\Windows\System\XzudplS.exe
  C:\Windows\System\XzudplS.exe
  2⤵
  PID:4044
- C:\Windows\System\fcotBdZ.exe
  C:\Windows\System\fcotBdZ.exe
  2⤵
  PID:13852
- C:\Windows\System\MGJZblZ.exe
  C:\Windows\System\MGJZblZ.exe
  2⤵
  PID:7224
- C:\Windows\System\rfaGhWR.exe
  C:\Windows\System\rfaGhWR.exe
  2⤵
  PID:6580
- C:\Windows\System\bMDwukz.exe
  C:\Windows\System\bMDwukz.exe
  2⤵
  PID:13732
- C:\Windows\System\gErWtlQ.exe
  C:\Windows\System\gErWtlQ.exe
  2⤵
  PID:6360
- C:\Windows\System\BikCXMw.exe
  C:\Windows\System\BikCXMw.exe
  2⤵
  PID:5532
- C:\Windows\System\dUSRliX.exe
  C:\Windows\System\dUSRliX.exe
  2⤵
  PID:6788
- C:\Windows\System\PQxsLYi.exe
  C:\Windows\System\PQxsLYi.exe
  2⤵
  PID:8164
- C:\Windows\System\jcoUtnh.exe
  C:\Windows\System\jcoUtnh.exe
  2⤵
  PID:13444
- C:\Windows\System\ZRlftRl.exe
  C:\Windows\System\ZRlftRl.exe
  2⤵
  PID:3012
- C:\Windows\System\RGkYKcN.exe
  C:\Windows\System\RGkYKcN.exe
  2⤵
  PID:1348
- C:\Windows\System\LdLsShr.exe
  C:\Windows\System\LdLsShr.exe
  2⤵
  PID:5548
- C:\Windows\System\KokOqzS.exe
  C:\Windows\System\KokOqzS.exe
  2⤵
  PID:8612
- C:\Windows\System\qygMNYA.exe
  C:\Windows\System\qygMNYA.exe
  2⤵
  PID:6000
- C:\Windows\System\NSHGWuY.exe
  C:\Windows\System\NSHGWuY.exe
  2⤵
  PID:7468
- C:\Windows\System\TuhHWON.exe
  C:\Windows\System\TuhHWON.exe
  2⤵
  PID:3508
- C:\Windows\System\xKCMLip.exe
  C:\Windows\System\xKCMLip.exe
  2⤵
  PID:13492
- C:\Windows\System\ENPSmSW.exe
  C:\Windows\System\ENPSmSW.exe
  2⤵
  PID:9600
- C:\Windows\System\elMqpNG.exe
  C:\Windows\System\elMqpNG.exe
  2⤵
  PID:1620
- C:\Windows\System\PsYYaam.exe
  C:\Windows\System\PsYYaam.exe
  2⤵
  PID:13476
- C:\Windows\System\iNTKuyK.exe
  C:\Windows\System\iNTKuyK.exe
  2⤵
  PID:10136
- C:\Windows\System\viswbPN.exe
  C:\Windows\System\viswbPN.exe
  2⤵
  PID:7472
- C:\Windows\System\WvLVlFB.exe
  C:\Windows\System\WvLVlFB.exe
  2⤵
  PID:10180
- C:\Windows\System\EnZCVRg.exe
  C:\Windows\System\EnZCVRg.exe
  2⤵
  PID:13580
- C:\Windows\System\QUlwOrc.exe
  C:\Windows\System\QUlwOrc.exe
  2⤵
  PID:10184
- C:\Windows\System\YOdMrNm.exe
  C:\Windows\System\YOdMrNm.exe
  2⤵
  PID:5272
- C:\Windows\System\hrhMnHF.exe
  C:\Windows\System\hrhMnHF.exe
  2⤵
  PID:5704
- C:\Windows\System\YSQIIPa.exe
  C:\Windows\System\YSQIIPa.exe
  2⤵
  PID:13480
- C:\Windows\System\yCFLkBE.exe
  C:\Windows\System\yCFLkBE.exe
  2⤵
  PID:13864
- C:\Windows\System\rrqCGxr.exe
  C:\Windows\System\rrqCGxr.exe
  2⤵
  PID:9356
- C:\Windows\System\adJGSvb.exe
  C:\Windows\System\adJGSvb.exe
  2⤵
  PID:13652
- C:\Windows\System\gZAllAc.exe
  C:\Windows\System\gZAllAc.exe
  2⤵
  PID:9460
- C:\Windows\System\ZuScEdJ.exe
  C:\Windows\System\ZuScEdJ.exe
  2⤵
  PID:10640
- C:\Windows\System\pveUzWI.exe
  C:\Windows\System\pveUzWI.exe
  2⤵
  PID:5520
- C:\Windows\System\FZSMRgY.exe
  C:\Windows\System\FZSMRgY.exe
  2⤵
  PID:13488
- C:\Windows\System\rmjMtSn.exe
  C:\Windows\System\rmjMtSn.exe
  2⤵
  PID:9756
- C:\Windows\System\UFWiKUX.exe
  C:\Windows\System\UFWiKUX.exe
  2⤵
  PID:5776
- C:\Windows\System\PBBONea.exe
  C:\Windows\System\PBBONea.exe
  2⤵
  PID:5188
- C:\Windows\System\kpumswM.exe
  C:\Windows\System\kpumswM.exe
  2⤵
  PID:7176
- C:\Windows\System\CEREOJj.exe
  C:\Windows\System\CEREOJj.exe
  2⤵
  PID:9468
- C:\Windows\System\uwkwxcE.exe
  C:\Windows\System\uwkwxcE.exe
  2⤵
  PID:10772
- C:\Windows\System\ZrCrIuh.exe
  C:\Windows\System\ZrCrIuh.exe
  2⤵
  PID:1052
- C:\Windows\System\CJuxTcU.exe
  C:\Windows\System\CJuxTcU.exe
  2⤵
  PID:10756
- C:\Windows\System\RxvwmQG.exe
  C:\Windows\System\RxvwmQG.exe
  2⤵
  PID:2808
- C:\Windows\System\uivCeUD.exe
  C:\Windows\System\uivCeUD.exe
  2⤵
  PID:11716
- C:\Windows\System\kCDheDe.exe
  C:\Windows\System\kCDheDe.exe
  2⤵
  PID:9824
- C:\Windows\System\yNJoONL.exe
  C:\Windows\System\yNJoONL.exe
  2⤵
  PID:8100
- C:\Windows\System\YMQNteI.exe
  C:\Windows\System\YMQNteI.exe
  2⤵
  PID:13892
- C:\Windows\System\bnICwux.exe
  C:\Windows\System\bnICwux.exe
  2⤵
  PID:11832
- C:\Windows\System\qDHHtCV.exe
  C:\Windows\System\qDHHtCV.exe
  2⤵
  PID:13924
- C:\Windows\System\scMUAtm.exe
  C:\Windows\System\scMUAtm.exe
  2⤵
  PID:11848
- C:\Windows\System\oTkWQKR.exe
  C:\Windows\System\oTkWQKR.exe
  2⤵
  PID:7108
- C:\Windows\System\RAqbBVV.exe
  C:\Windows\System\RAqbBVV.exe
  2⤵
  PID:6272
- C:\Windows\System\SSTjdbE.exe
  C:\Windows\System\SSTjdbE.exe
  2⤵
  PID:11912
- C:\Windows\System\owIVxAI.exe
  C:\Windows\System\owIVxAI.exe
  2⤵
  PID:10668
- C:\Windows\System\SUwkIYV.exe
  C:\Windows\System\SUwkIYV.exe
  2⤵
  PID:11972
- C:\Windows\System\jzLXnIV.exe
  C:\Windows\System\jzLXnIV.exe
  2⤵
  PID:11944
- C:\Windows\System\XtTBKlm.exe
  C:\Windows\System\XtTBKlm.exe
  2⤵
  PID:8316
- C:\Windows\System\kIeVUhT.exe
  C:\Windows\System\kIeVUhT.exe
  2⤵
  PID:8420
- C:\Windows\System\Lzwwvvi.exe
  C:\Windows\System\Lzwwvvi.exe
  2⤵
  PID:8580
- C:\Windows\System\aBxaKFJ.exe
  C:\Windows\System\aBxaKFJ.exe
  2⤵
  PID:12028
- C:\Windows\System\zKOjhcL.exe
  C:\Windows\System\zKOjhcL.exe
  2⤵
  PID:11308
- C:\Windows\System\JtQxqYz.exe
  C:\Windows\System\JtQxqYz.exe
  2⤵
  PID:2456
- C:\Windows\System\nkWGiJN.exe
  C:\Windows\System\nkWGiJN.exe
  2⤵
  PID:9316
- C:\Windows\System\ownilLB.exe
  C:\Windows\System\ownilLB.exe
  2⤵
  PID:10268
- C:\Windows\System\DNJmocB.exe
  C:\Windows\System\DNJmocB.exe
  2⤵
  PID:5240
- C:\Windows\System\WZPJCDU.exe
  C:\Windows\System\WZPJCDU.exe
  2⤵
  PID:9368
- C:\Windows\System\CkTwfPL.exe
  C:\Windows\System\CkTwfPL.exe
  2⤵
  PID:11376
- C:\Windows\System\PwOWzUj.exe
  C:\Windows\System\PwOWzUj.exe
  2⤵
  PID:12220
- C:\Windows\System\xRYnhre.exe
  C:\Windows\System\xRYnhre.exe
  2⤵
  PID:3320
- C:\Windows\System\gUjtXvz.exe
  C:\Windows\System\gUjtXvz.exe
  2⤵
  PID:8724
- C:\Windows\System\TmNZkrQ.exe
  C:\Windows\System\TmNZkrQ.exe
  2⤵
  PID:11444
- C:\Windows\System\xYNMALH.exe
  C:\Windows\System\xYNMALH.exe
  2⤵
  PID:11620
- C:\Windows\System\OiYjCjZ.exe
  C:\Windows\System\OiYjCjZ.exe
  2⤵
  PID:11604
- C:\Windows\System\Sahintd.exe
  C:\Windows\System\Sahintd.exe
  2⤵
  PID:8556
- C:\Windows\System\fjwdVqc.exe
  C:\Windows\System\fjwdVqc.exe
  2⤵
  PID:12084
- C:\Windows\System\vnUdqPm.exe
  C:\Windows\System\vnUdqPm.exe
  2⤵
  PID:8744
- C:\Windows\System\TycRLUy.exe
  C:\Windows\System\TycRLUy.exe
  2⤵
  PID:13460
- C:\Windows\System\assjWDX.exe
  C:\Windows\System\assjWDX.exe
  2⤵
  PID:10788
- C:\Windows\System\RNwSTaD.exe
  C:\Windows\System\RNwSTaD.exe
  2⤵
  PID:13576
- C:\Windows\System\lqmROea.exe
  C:\Windows\System\lqmROea.exe
  2⤵
  PID:10792
- C:\Windows\System\vCTEbBI.exe
  C:\Windows\System\vCTEbBI.exe
  2⤵
  PID:10808
- C:\Windows\System\UhwoWiK.exe
  C:\Windows\System\UhwoWiK.exe
  2⤵
  PID:13088
- C:\Windows\System\eMJibMW.exe
  C:\Windows\System\eMJibMW.exe
  2⤵
  PID:9972
- C:\Windows\System\Vwbilzb.exe
  C:\Windows\System\Vwbilzb.exe
  2⤵
  PID:13404
- C:\Windows\System\IxuQCkV.exe
  C:\Windows\System\IxuQCkV.exe
  2⤵
  PID:6200
- C:\Windows\System\IkRmMWu.exe
  C:\Windows\System\IkRmMWu.exe
  2⤵
  PID:13316
- C:\Windows\System\sckidhT.exe
  C:\Windows\System\sckidhT.exe
  2⤵
  PID:10028
- C:\Windows\System\KJHFdij.exe
  C:\Windows\System\KJHFdij.exe
  2⤵
  PID:9252
- C:\Windows\System\cjMdTuO.exe
  C:\Windows\System\cjMdTuO.exe
  2⤵
  PID:10160
- C:\Windows\System\wFxzKbU.exe
  C:\Windows\System\wFxzKbU.exe
  2⤵
  PID:9268
- C:\Windows\System\ACTUIZB.exe
  C:\Windows\System\ACTUIZB.exe
  2⤵
  PID:13880
- C:\Windows\System\oZkTOgT.exe
  C:\Windows\System\oZkTOgT.exe
  2⤵
  PID:7432
- C:\Windows\System\IBihzrG.exe
  C:\Windows\System\IBihzrG.exe
  2⤵
  PID:6244
- C:\Windows\System\KUWDNKD.exe
  C:\Windows\System\KUWDNKD.exe
  2⤵
  PID:11032
- C:\Windows\System\yfRXqCY.exe
  C:\Windows\System\yfRXqCY.exe
  2⤵
  PID:8516
- C:\Windows\System\hEMrzeA.exe
  C:\Windows\System\hEMrzeA.exe
  2⤵
  PID:7332
- C:\Windows\System\BumOuid.exe
  C:\Windows\System\BumOuid.exe
  2⤵
  PID:3812
- C:\Windows\System\QhxWTVT.exe
  C:\Windows\System\QhxWTVT.exe
  2⤵
  PID:13696
- C:\Windows\System\vReZgyb.exe
  C:\Windows\System\vReZgyb.exe
  2⤵
  PID:10152
- C:\Windows\System\BKREoaX.exe
  C:\Windows\System\BKREoaX.exe
  2⤵
  PID:7368
- C:\Windows\System\xOCUubh.exe
  C:\Windows\System\xOCUubh.exe
  2⤵
  PID:13164
- C:\Windows\System\AVLSUqg.exe
  C:\Windows\System\AVLSUqg.exe
  2⤵
  PID:11284
- C:\Windows\System\nZcRMsJ.exe
  C:\Windows\System\nZcRMsJ.exe
  2⤵
  PID:6460
- C:\Windows\System\SoKsOJn.exe
  C:\Windows\System\SoKsOJn.exe
  2⤵
  PID:3636
- C:\Windows\System\yKCOFkD.exe
  C:\Windows\System\yKCOFkD.exe
  2⤵
  PID:12108
- C:\Windows\System\BGURTDy.exe
  C:\Windows\System\BGURTDy.exe
  2⤵
  PID:13116
- C:\Windows\System\wZmwZZG.exe
  C:\Windows\System\wZmwZZG.exe
  2⤵
  PID:13104
- C:\Windows\System\IEuZngD.exe
  C:\Windows\System\IEuZngD.exe
  2⤵
  PID:11068
- C:\Windows\System\CZipoLQ.exe
  C:\Windows\System\CZipoLQ.exe
  2⤵
  PID:7444
- C:\Windows\System\vJcTSxh.exe
  C:\Windows\System\vJcTSxh.exe
  2⤵
  PID:8904
- C:\Windows\System\wslZoUE.exe
  C:\Windows\System\wslZoUE.exe
  2⤵
  PID:6780
- C:\Windows\System\GdVCHlQ.exe
  C:\Windows\System\GdVCHlQ.exe
  2⤵
  PID:4612
- C:\Windows\System\CIAlQeo.exe
  C:\Windows\System\CIAlQeo.exe
  2⤵
  PID:11132
- C:\Windows\System\aYcVmnm.exe
  C:\Windows\System\aYcVmnm.exe
  2⤵
  PID:4140
- C:\Windows\System\wvxFHBP.exe
  C:\Windows\System\wvxFHBP.exe
  2⤵
  PID:9788
- C:\Windows\System\GprgvdT.exe
  C:\Windows\System\GprgvdT.exe
  2⤵
  PID:12616
- C:\Windows\System\UWFBXFe.exe
  C:\Windows\System\UWFBXFe.exe
  2⤵
  PID:12848
- C:\Windows\System\ExizCqJ.exe
  C:\Windows\System\ExizCqJ.exe
  2⤵
  PID:12788
- C:\Windows\System\yMPQiYb.exe
  C:\Windows\System\yMPQiYb.exe
  2⤵
  PID:12964
- C:\Windows\System\KNVscdd.exe
  C:\Windows\System\KNVscdd.exe
  2⤵
  PID:9484
- C:\Windows\System\WUjwyVB.exe
  C:\Windows\System\WUjwyVB.exe
  2⤵
  PID:7960
- C:\Windows\System\Vrbiysk.exe
  C:\Windows\System\Vrbiysk.exe
  2⤵
  PID:11492
- C:\Windows\System\rhpWsdk.exe
  C:\Windows\System\rhpWsdk.exe
  2⤵
  PID:12888
- C:\Windows\System\ZEGmwYY.exe
  C:\Windows\System\ZEGmwYY.exe
  2⤵
  PID:9528
- C:\Windows\System\AbVOoRm.exe
  C:\Windows\System\AbVOoRm.exe
  2⤵
  PID:10612
- C:\Windows\System\JObspGG.exe
  C:\Windows\System\JObspGG.exe
  2⤵
  PID:7480
- C:\Windows\System\DWrpTSz.exe
  C:\Windows\System\DWrpTSz.exe
  2⤵
  PID:12948
- C:\Windows\System\IXroszT.exe
  C:\Windows\System\IXroszT.exe
  2⤵
  PID:12668
- C:\Windows\System\xlVEhNA.exe
  C:\Windows\System\xlVEhNA.exe
  2⤵
  PID:8448
- C:\Windows\System\yBwDZwb.exe
  C:\Windows\System\yBwDZwb.exe
  2⤵
  PID:9804
- C:\Windows\System\XbaulLA.exe
  C:\Windows\System\XbaulLA.exe
  2⤵
  PID:11244
- C:\Windows\System\uSSEVsN.exe
  C:\Windows\System\uSSEVsN.exe
  2⤵
  PID:13900
- C:\Windows\System\OXeGpqY.exe
  C:\Windows\System\OXeGpqY.exe
  2⤵
  PID:7240
- C:\Windows\System\ZUQyqdb.exe
  C:\Windows\System\ZUQyqdb.exe
  2⤵
  PID:8160
- C:\Windows\System\tKGfzeS.exe
  C:\Windows\System\tKGfzeS.exe
  2⤵
  PID:11852
- C:\Windows\System\KUacTtr.exe
  C:\Windows\System\KUacTtr.exe
  2⤵
  PID:5680
- C:\Windows\System\xneJPEa.exe
  C:\Windows\System\xneJPEa.exe
  2⤵
  PID:11884
- C:\Windows\System\UVzerBQ.exe
  C:\Windows\System\UVzerBQ.exe
  2⤵
  PID:7196
- C:\Windows\System\dlJrKmW.exe
  C:\Windows\System\dlJrKmW.exe
  2⤵
  PID:8172
- C:\Windows\System\FcWgYUy.exe
  C:\Windows\System\FcWgYUy.exe
  2⤵
  PID:7096
- C:\Windows\System\mfOEDgA.exe
  C:\Windows\System\mfOEDgA.exe
  2⤵
  PID:11908
- C:\Windows\System\WnJVquc.exe
  C:\Windows\System\WnJVquc.exe
  2⤵
  PID:7392
- C:\Windows\System\HZhfhWh.exe
  C:\Windows\System\HZhfhWh.exe
  2⤵
  PID:12396
- C:\Windows\System\oJpMhYo.exe
  C:\Windows\System\oJpMhYo.exe
  2⤵
  PID:2712
- C:\Windows\System\gWojMiw.exe
  C:\Windows\System\gWojMiw.exe
  2⤵
  PID:12408
- C:\Windows\System\fgqhhIG.exe
  C:\Windows\System\fgqhhIG.exe
  2⤵
  PID:3396
- C:\Windows\System\rdqNgYV.exe
  C:\Windows\System\rdqNgYV.exe
  2⤵
  PID:11036
- C:\Windows\System\gqBwjFW.exe
  C:\Windows\System\gqBwjFW.exe
  2⤵
  PID:11512
- C:\Windows\System\lupkbFk.exe
  C:\Windows\System\lupkbFk.exe
  2⤵
  PID:7816
- C:\Windows\System\pGnwDcM.exe
  C:\Windows\System\pGnwDcM.exe
  2⤵
  PID:10664
- C:\Windows\System\YDmKsBK.exe
  C:\Windows\System\YDmKsBK.exe
  2⤵
  PID:9984
- C:\Windows\System\TWBTsgF.exe
  C:\Windows\System\TWBTsgF.exe
  2⤵
  PID:10084
- C:\Windows\System\idiHYFD.exe
  C:\Windows\System\idiHYFD.exe
  2⤵
  PID:5872
- C:\Windows\System\MlfSccg.exe
  C:\Windows\System\MlfSccg.exe
  2⤵
  PID:11964
- C:\Windows\System\LquQGeS.exe
  C:\Windows\System\LquQGeS.exe
  2⤵
  PID:5752
- C:\Windows\System\UrUyqAB.exe
  C:\Windows\System\UrUyqAB.exe
  2⤵
  PID:6608
- C:\Windows\System\uaEcLYV.exe
  C:\Windows\System\uaEcLYV.exe
  2⤵
  PID:7812
- C:\Windows\System\RDXlEII.exe
  C:\Windows\System\RDXlEII.exe
  2⤵
  PID:5676
- C:\Windows\System\RXkMJAs.exe
  C:\Windows\System\RXkMJAs.exe
  2⤵
  PID:12024
- C:\Windows\System\dVpUMFl.exe
  C:\Windows\System\dVpUMFl.exe
  2⤵
  PID:12080
- C:\Windows\System\kiZsttM.exe
  C:\Windows\System\kiZsttM.exe
  2⤵
  PID:8664
- C:\Windows\System\YcNAkyp.exe
  C:\Windows\System\YcNAkyp.exe
  2⤵
  PID:2412
- C:\Windows\System\WRuLEPV.exe
  C:\Windows\System\WRuLEPV.exe
  2⤵
  PID:11312
- C:\Windows\System\mcXspQf.exe
  C:\Windows\System\mcXspQf.exe
  2⤵
  PID:11356
- C:\Windows\System\NQQFyIZ.exe
  C:\Windows\System\NQQFyIZ.exe
  2⤵
  PID:5260
- C:\Windows\System\ilUkBaN.exe
  C:\Windows\System\ilUkBaN.exe
  2⤵
  PID:1724
- C:\Windows\System\JVMixLL.exe
  C:\Windows\System\JVMixLL.exe
  2⤵
  PID:11144
- C:\Windows\System\FgeVjUb.exe
  C:\Windows\System\FgeVjUb.exe
  2⤵
  PID:11568
- C:\Windows\System\BeKuejP.exe
  C:\Windows\System\BeKuejP.exe
  2⤵
  PID:11296
- C:\Windows\System\hSTveNr.exe
  C:\Windows\System\hSTveNr.exe
  2⤵
  PID:12228
- C:\Windows\System\FdJUyQk.exe
  C:\Windows\System\FdJUyQk.exe
  2⤵
  PID:9860
- C:\Windows\System\egbbGha.exe
  C:\Windows\System\egbbGha.exe
  2⤵
  PID:7536
- C:\Windows\System\BhDkOXK.exe
  C:\Windows\System\BhDkOXK.exe
  2⤵
  PID:13080
- C:\Windows\System\KiSgCbc.exe
  C:\Windows\System\KiSgCbc.exe
  2⤵
  PID:6196
- C:\Windows\System\xJDcSag.exe
  C:\Windows\System\xJDcSag.exe
  2⤵
  PID:6644
- C:\Windows\System\wqyPqXF.exe
  C:\Windows\System\wqyPqXF.exe
  2⤵
  PID:12556
- C:\Windows\System\ZhERrQJ.exe
  C:\Windows\System\ZhERrQJ.exe
  2⤵
  PID:5828
- C:\Windows\System\KZJOWBl.exe
  C:\Windows\System\KZJOWBl.exe
  2⤵
  PID:4524
- C:\Windows\System\nAhUDqC.exe
  C:\Windows\System\nAhUDqC.exe
  2⤵
  PID:11732
- C:\Windows\System\YnJJQtx.exe
  C:\Windows\System\YnJJQtx.exe
  2⤵
  PID:9820
- C:\Windows\System\kolFvNr.exe
  C:\Windows\System\kolFvNr.exe
  2⤵
  PID:10804
- C:\Windows\System\uGMBjFc.exe
  C:\Windows\System\uGMBjFc.exe
  2⤵
  PID:3068
- C:\Windows\System\XmPMmkq.exe
  C:\Windows\System\XmPMmkq.exe
  2⤵
  PID:4440
- C:\Windows\System\kSjPqLP.exe
  C:\Windows\System\kSjPqLP.exe
  2⤵
  PID:6976
- C:\Windows\System\wcfRbPF.exe
  C:\Windows\System\wcfRbPF.exe
  2⤵
  PID:3752
- C:\Windows\System\jsuCgDy.exe
  C:\Windows\System\jsuCgDy.exe
  2⤵
  PID:8368
- C:\Windows\System\xThdpIw.exe
  C:\Windows\System\xThdpIw.exe
  2⤵
  PID:10840
- C:\Windows\System\cARVmAX.exe
  C:\Windows\System\cARVmAX.exe
  2⤵
  PID:13680
- C:\Windows\System\hSCsxjI.exe
  C:\Windows\System\hSCsxjI.exe
  2⤵
  PID:9388
- C:\Windows\System\LvBxtDW.exe
  C:\Windows\System\LvBxtDW.exe
  2⤵
  PID:6680
- C:\Windows\System\YQPAdSR.exe
  C:\Windows\System\YQPAdSR.exe
  2⤵
  PID:7064
- C:\Windows\System\LnGPphq.exe
  C:\Windows\System\LnGPphq.exe
  2⤵
  PID:8764
- C:\Windows\System\VNwbbNo.exe
  C:\Windows\System\VNwbbNo.exe
  2⤵
  PID:13672
- C:\Windows\System\PzgcTNZ.exe
  C:\Windows\System\PzgcTNZ.exe
  2⤵
  PID:10520
- C:\Windows\System\wTxJfOy.exe
  C:\Windows\System\wTxJfOy.exe
  2⤵
  PID:8844
- C:\Windows\System\WOkOgsq.exe
  C:\Windows\System\WOkOgsq.exe
  2⤵
  PID:9876
- C:\Windows\System\oSlckxl.exe
  C:\Windows\System\oSlckxl.exe
  2⤵
  PID:8392
- C:\Windows\System\kYNgeim.exe
  C:\Windows\System\kYNgeim.exe
  2⤵
  PID:9680
- C:\Windows\System\HlxvxFI.exe
  C:\Windows\System\HlxvxFI.exe
  2⤵
  PID:5284
- C:\Windows\System\eViavxY.exe
  C:\Windows\System\eViavxY.exe
  2⤵
  PID:9696
- C:\Windows\System\UhIgFWp.exe
  C:\Windows\System\UhIgFWp.exe
  2⤵
  PID:12032
- C:\Windows\System\yNrqpCH.exe
  C:\Windows\System\yNrqpCH.exe
  2⤵
  PID:6416
- C:\Windows\System\mvxLiMS.exe
  C:\Windows\System\mvxLiMS.exe
  2⤵
  PID:11116
- C:\Windows\System\IoVlNpx.exe
  C:\Windows\System\IoVlNpx.exe
  2⤵
  PID:4956
- C:\Windows\System\dDRfOFR.exe
  C:\Windows\System\dDRfOFR.exe
  2⤵
  PID:6432
- C:\Windows\System\tbZULTe.exe
  C:\Windows\System\tbZULTe.exe
  2⤵
  PID:8932
- C:\Windows\System\rUoDnXz.exe
  C:\Windows\System\rUoDnXz.exe
  2⤵
  PID:12748
- C:\Windows\System\NVorsxk.exe
  C:\Windows\System\NVorsxk.exe
  2⤵
  PID:11148
- C:\Windows\System\MnAzOtp.exe
  C:\Windows\System\MnAzOtp.exe
  2⤵
  PID:9644
- C:\Windows\System\TAWxjOF.exe
  C:\Windows\System\TAWxjOF.exe
  2⤵
  PID:9152
- C:\Windows\System\HmupaSB.exe
  C:\Windows\System\HmupaSB.exe
  2⤵
  PID:9092
- C:\Windows\System\YxQKbPa.exe
  C:\Windows\System\YxQKbPa.exe
  2⤵
  PID:7476
- C:\Windows\System\ilquPir.exe
  C:\Windows\System\ilquPir.exe
  2⤵
  PID:12852
- C:\Windows\System\ZrArHJY.exe
  C:\Windows\System\ZrArHJY.exe
  2⤵
  PID:9840
- C:\Windows\System\xwlldpM.exe
  C:\Windows\System\xwlldpM.exe
  2⤵
  PID:212
- C:\Windows\System\GwKKEbD.exe
  C:\Windows\System\GwKKEbD.exe
  2⤵
  PID:4328
- C:\Windows\System\bigahyb.exe
  C:\Windows\System\bigahyb.exe
  2⤵
  PID:4968
- C:\Windows\System\QrCDRxe.exe
  C:\Windows\System\QrCDRxe.exe
  2⤵
  PID:11876
- C:\Windows\System\tewCMgx.exe
  C:\Windows\System\tewCMgx.exe
  2⤵
  PID:6668
- C:\Windows\System\XzylEss.exe
  C:\Windows\System\XzylEss.exe
  2⤵
  PID:11484
- C:\Windows\System\eqqEGyC.exe
  C:\Windows\System\eqqEGyC.exe
  2⤵
  PID:3492
- C:\Windows\System\jcTeVOI.exe
  C:\Windows\System\jcTeVOI.exe
  2⤵
  PID:7720
- C:\Windows\System\OAAkdRl.exe
  C:\Windows\System\OAAkdRl.exe
  2⤵
  PID:13380
- C:\Windows\System\AvSwhCr.exe
  C:\Windows\System\AvSwhCr.exe
  2⤵
  PID:8636
- C:\Windows\System\qRAnoGl.exe
  C:\Windows\System\qRAnoGl.exe
  2⤵
  PID:2596
- C:\Windows\System\AtQotWR.exe
  C:\Windows\System\AtQotWR.exe
  2⤵
  PID:11676
- C:\Windows\System\DcHzZKe.exe
  C:\Windows\System\DcHzZKe.exe
  2⤵
  PID:9048
- C:\Windows\System\SUaUpRI.exe
  C:\Windows\System\SUaUpRI.exe
  2⤵
  PID:3844
- C:\Windows\System\URIdevd.exe
  C:\Windows\System\URIdevd.exe
  2⤵
  PID:13268
- C:\Windows\System\ZpZiKTv.exe
  C:\Windows\System\ZpZiKTv.exe
  2⤵
  PID:7596
- C:\Windows\System\IppQsrU.exe
  C:\Windows\System\IppQsrU.exe
  2⤵
  PID:9544
- C:\Windows\System\paHmrLJ.exe
  C:\Windows\System\paHmrLJ.exe
  2⤵
  PID:2096
- C:\Windows\System\JxyzfAY.exe
  C:\Windows\System\JxyzfAY.exe
  2⤵
  PID:10020
- C:\Windows\System\gIWcLrs.exe
  C:\Windows\System\gIWcLrs.exe
  2⤵
  PID:13876
- C:\Windows\System\ycfEWAR.exe
  C:\Windows\System\ycfEWAR.exe
  2⤵
  PID:4940
- C:\Windows\System\nkcpsfH.exe
  C:\Windows\System\nkcpsfH.exe
  2⤵
  PID:5744
- C:\Windows\System\ckEeURI.exe
  C:\Windows\System\ckEeURI.exe
  2⤵
  PID:9660
- C:\Windows\System\oosOlMS.exe
  C:\Windows\System\oosOlMS.exe
  2⤵
  PID:5960
- C:\Windows\System\pxGRPCA.exe
  C:\Windows\System\pxGRPCA.exe
  2⤵
  PID:2872
- C:\Windows\System\zHkLlMJ.exe
  C:\Windows\System\zHkLlMJ.exe
  2⤵
  PID:5256
- C:\Windows\System\cpMxjjU.exe
  C:\Windows\System\cpMxjjU.exe
  2⤵
  PID:10716
- C:\Windows\System\vCkOGLV.exe
  C:\Windows\System\vCkOGLV.exe
  2⤵
  PID:3256
- C:\Windows\System\JbJWXIG.exe
  C:\Windows\System\JbJWXIG.exe
  2⤵
  PID:13296
- C:\Windows\System\YiXWnEF.exe
  C:\Windows\System\YiXWnEF.exe
  2⤵
  PID:7352
- C:\Windows\System\xDJGxKB.exe
  C:\Windows\System\xDJGxKB.exe
  2⤵
  PID:3192
- C:\Windows\System\FdxYngM.exe
  C:\Windows\System\FdxYngM.exe
  2⤵
  PID:408
- C:\Windows\System\uHKaFxW.exe
  C:\Windows\System\uHKaFxW.exe
  2⤵
  PID:10620
- C:\Windows\System\LsLJknT.exe
  C:\Windows\System\LsLJknT.exe
  2⤵
  PID:7764
- C:\Windows\System\vICpsXF.exe
  C:\Windows\System\vICpsXF.exe
  2⤵
  PID:13772
- C:\Windows\System\gWfYzkz.exe
  C:\Windows\System\gWfYzkz.exe
  2⤵
  PID:8184
- C:\Windows\System\eDRayBm.exe
  C:\Windows\System\eDRayBm.exe
  2⤵
  PID:13416
- C:\Windows\System\TzcGBTD.exe
  C:\Windows\System\TzcGBTD.exe
  2⤵
  PID:13572
- C:\Windows\System\CsMdrQx.exe
  C:\Windows\System\CsMdrQx.exe
  2⤵
  PID:1124
- C:\Windows\System\NGthExU.exe
  C:\Windows\System\NGthExU.exe
  2⤵
  PID:10324
- C:\Windows\System\jvYSpvn.exe
  C:\Windows\System\jvYSpvn.exe
  2⤵
  PID:5952
- C:\Windows\System\shLXshE.exe
  C:\Windows\System\shLXshE.exe
  2⤵
  PID:4684
- C:\Windows\System\lnYxyko.exe
  C:\Windows\System\lnYxyko.exe
  2⤵
  PID:9192
- C:\Windows\System\XOXEbmQ.exe
  C:\Windows\System\XOXEbmQ.exe
  2⤵
  PID:1360
- C:\Windows\System\qYeDpjf.exe
  C:\Windows\System\qYeDpjf.exe
  2⤵
  PID:9880
- C:\Windows\System\AYgoaYd.exe
  C:\Windows\System\AYgoaYd.exe
  2⤵
  PID:13356
- C:\Windows\System\GNbcblH.exe
  C:\Windows\System\GNbcblH.exe
  2⤵
  PID:12188
- C:\Windows\System\YiHNAIn.exe
  C:\Windows\System\YiHNAIn.exe
  2⤵
  PID:10776
- C:\Windows\System\BqABSBu.exe
  C:\Windows\System\BqABSBu.exe
  2⤵
  PID:7664
- C:\Windows\System\JOwMsME.exe
  C:\Windows\System\JOwMsME.exe
  2⤵
  PID:6512
- C:\Windows\System\oOQxjxk.exe
  C:\Windows\System\oOQxjxk.exe
  2⤵
  PID:13544
- C:\Windows\System\VMBidqF.exe
  C:\Windows\System\VMBidqF.exe
  2⤵
  PID:11996
- C:\Windows\System\RmzjRYa.exe
  C:\Windows\System\RmzjRYa.exe
  2⤵
  PID:5792
- C:\Windows\System\gtUcWzo.exe
  C:\Windows\System\gtUcWzo.exe
  2⤵
  PID:9916
- C:\Windows\System\zgeVQYF.exe
  C:\Windows\System\zgeVQYF.exe
  2⤵
  PID:10680
- C:\Windows\System\OkDENtn.exe
  C:\Windows\System\OkDENtn.exe
  2⤵
  PID:3148
- C:\Windows\System\qUMpzZT.exe
  C:\Windows\System\qUMpzZT.exe
  2⤵
  PID:1588
- C:\Windows\System\NXLkNih.exe
  C:\Windows\System\NXLkNih.exe
  2⤵
  PID:11268
- C:\Windows\System\bvhlMYz.exe
  C:\Windows\System\bvhlMYz.exe
  2⤵
  PID:4608
- C:\Windows\System\hCFyMYD.exe
  C:\Windows\System\hCFyMYD.exe
  2⤵
  PID:10596

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k WerSvcGroup
1⤵
PID:11652

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_2oa2iaq2.ekc.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\AtNAAhn.exe

Filesize
816KB

MD5
56c07bbdff2e5b4a6d1279ccc6fcfbbe

SHA1
b9a2be99a184659029de2dd3daa4881c0bce0cbb

SHA256
4c9ae4b12b47e605236d29bbb423e29b17d147d4512bb68641b399eb7f7eae22

SHA512
01cd0185b1d4e2b680e2148183e4f9180e4bd10c03664a1a6133f0ec570cb029ace08992952bd43bcc9b8097310b56045d7ac9ada3dbfb573ffe75ee28bae782

Download Submit
C:\Windows\System\BvEJEoI.exe

Filesize
815KB

MD5
8746ba2049bc7f1c88a6fadc0a494da2

SHA1
9eff2a84244d450c67844fe75d435d1c51898bd2

SHA256
c8376f487a96442da6171f1c093b25719c0ad16589e4833c7caf409ecabb1113

SHA512
987f7ee40029016b6fe59b18203848473e7e9d8cafbefecd4711a861b28632d83b40883abd1a7cb8e5a85f7f713ee7d8b0cb1a194abc639de6a02bf62bfa7baf

Download Submit
C:\Windows\System\DBOxNqr.exe

Filesize
809KB

MD5
4759b664de893b0c492ba03b1e020417

SHA1
d6b6181d36a610a73c8d671b1da0b731bcc7faf6

SHA256
baf20934c7e1cd4caf8a52da2a72f7270fd919e5853886560da8556a8a292ab5

SHA512
52aebdae777be69c777c2f280a27f3bb25ec5673dd1292ab887f1fe7e63e5e072d8dda396c7146f0b0a1f9bb2a2a6b9609fec0400f6884c3176192d4e7eb2e42

Download Submit
C:\Windows\System\DhJSEDt.exe

Filesize
808KB

MD5
a1113f59535b708b6ff20098cae6af1a

SHA1
34415a8655ac2b66bbc70fbd1720b80cad447674

SHA256
494cf905d4bbd27e9c124ae9b22672379d9ac887d6951a523fcbf6f6dc17cc1a

SHA512
c6d674de646ef49e0f12d98160f49d07b7b89e8b9c83104b1cc1fa7ffdc2250134f2c24c74d71e62acaf17372b444123d61328520f36194e9c97be7dbdc39104

Download Submit
C:\Windows\System\EttGGrx.exe

Filesize
18B

MD5
1937db3c99f55ed08f9eb033d77912c7

SHA1
b5781fcae491a971c48898d783564f3e2b87037c

SHA256
38bfa8cede362b638fe25658835448d60095ded6279a02d5e9c58f24ffc71d0a

SHA512
4620592478b9628db637dad809d40a71091a69cea7a1c23c781e2d752b9555978826dfed078d7eec0ebae5e510b3561baff9fa7de081ea4c2e40859d6123b913

Download Submit
C:\Windows\System\HulXbBW.exe

Filesize
810KB

MD5
48f4d7ce9d1cad2c2530c0078846cad6

SHA1
7de954a551a3e655cdb22c1dbcce4af3b0fd49b6

SHA256
c72fb21c59a01ec68a65c90ed5598626573913363f8aea85f61708dc1822a15f

SHA512
f27670e4e883b2868e55df7f7a1dbf25cda07f5176b36549ac56ba2e21012e236a73db9d9d23b8a9fbbc37741137efdaa2f9212b7e701bbe00fd4cf7e440a2ab

Download Submit
C:\Windows\System\JFYukFu.exe

Filesize
816KB

MD5
696bcd0ad9c7e65ed173e174e7c299ca

SHA1
21628768e58069fbe447f83da0493d3d9f28aa9c

SHA256
469e99cde83acf05ffdcbcbce88102fcff7b772e1cef93c97785df11ed1d723b

SHA512
291ceaf34272e7d118f881f7575247660881369dbc9b4c5fcb777dfe5a6d59174480ea107b348a54b3c1b4b18c06f558e65fb168f03f354f1cf15289504cc682

Download Submit
C:\Windows\System\JODtCWD.exe

Filesize
818KB

MD5
2cd7dc2bb85900e5cc5b46701d396943

SHA1
5686bef4ea3469433a326accec5f7726d0a07b36

SHA256
30dbe5df69e89a452dfc9630814af14c76f4df08595e97dfb6a4782867ff90ca

SHA512
f554abbb496c4dee8ece426d135293536c11f1764d0c591f8caea301c12d36f629fa4c4690083b497020582de168e825507a4716c00df7faed7a1a1d2ab2e63d

Download Submit
C:\Windows\System\LudgCVK.exe

Filesize
815KB

MD5
68c0a99096a7bc9715ee3f70fe80c5c8

SHA1
cc15eebd946411d8a9bc91610592bd7aeb98bfcb

SHA256
bf1d2d7714055637a20a5a3eadb9a7801ce4968958b41da7740485abcc3e12cc

SHA512
ebec61dfd124fc62be636458bd9a4b450292c31fb259ebe26ad725e32f62e9704e27063cc3d5576ac484e482d0d222b3d1247a8ef605e5bee308436e1c0b753e

Download Submit
C:\Windows\System\MnlAFdN.exe

Filesize
809KB

MD5
2821a11cd3003dd83d2bd60e4530dc01

SHA1
473797ee21faa4dcb983bdfd1e09e1765d190d35

SHA256
7242fffa1b9a1d0541a87b52bc215c2d4ee42469015349d395a95dbd1f9b40ee

SHA512
37d6f110482f09fcfe0f86bde4ffe9ef51513c95d633453d7ccbf29b9418731496467f7eb6ea605f2e793f98688353bd78f5776f4d34b108cddd53caa081727b

Download Submit
C:\Windows\System\NCxVPBU.exe

Filesize
810KB

MD5
448e29d5f17c18882a03d48da0e36379

SHA1
ee452e8a9c5386bfddcd57fa7fbaf24865ab5298

SHA256
c399964a80d0547fc3c6726548269e2e9bb8ceb3983523879cc065ca56bfbba1

SHA512
c0018dac330d11043a3b9a0b13ba6a06e4440573d04f6e01f0ec21c1684c0af030852bca6c603a12ce5dc390eb1dcb80d616b28c478f0dceae915d6896abb2a0

Download Submit
C:\Windows\System\NaNAKDN.exe

Filesize
810KB

MD5
7062133619c38a8c48e18e1a5f2cb1e8

SHA1
26b53bb8aec3f0f95a05adf878d93bbdb065bece

SHA256
fe68180196ec527c571b997ee7d5c9d6c247cef9bfde0367a1ce729716f11e13

SHA512
b10e683ca40f51193fbc7497eb7e36bc3de713453a4b5f04aae47104a58a9caa395216ace329942e44d09a401ba31937a78d65c809dfa1b05b1932083d6c33a0

Download Submit
C:\Windows\System\Owopccl.exe

Filesize
808KB

MD5
5401ae209606c093bcfbeaebcccf2de7

SHA1
86c06f07c17594966d2c98d48ddcdc219cbc4679

SHA256
2cbf4b72a75bdeacd68cd3051972bcd79c0b7e64d63ca425d797be49bacefc43

SHA512
6d765e607c3a2507574f844400667b8b812494c7b2dd496f9761692abab2071710918ee6d9168ecc9077c2ad2013e39efc7809c03284e24a0820f57fe3ff5d54

Download Submit
C:\Windows\System\OxaBPnA.exe

Filesize
814KB

MD5
a5418c57952146e677044780945f650a

SHA1
f27e9bcb580166991bde8a7ce331832c10976656

SHA256
b9da8db3d966f304155d26dfe3b4e9ac943ea6c22814e63ada91c71165957edd

SHA512
c979825f790f851d95789cd7dd18bad1e4d8217ef056ce4f0f314926deb188c55bb295e26eaa9e6036af0e8a49996998c87e1420ec7a3b3808f8c8df6f2d91ac

Download Submit
C:\Windows\System\OxsQCFh.exe

Filesize
818KB

MD5
5bc98001bb30e029bcd26b5ac945c33d

SHA1
9dbebf28e5e6b0fde13fcf4144ceb39b95da3ffc

SHA256
747349968ef5ebe8a09249a1b2bbefe70a04e4abc011844ad26f000d324a6705

SHA512
5104a3c6c50ff9659398139e973c4d83a111bf1f89be86d6683f5453156c48d70210c9b681ce7f5154f601765928317530d18b9a79d4bd84dda6fcf2b8369910

Download Submit
C:\Windows\System\PgsSNpK.exe

Filesize
810KB

MD5
cd32262af819e6260bef90a272a6708f

SHA1
03582160e43ce7b859a50bb00ba3b84eeca72905

SHA256
e72dfaff15bf01bdd0df42b141b63bc07d99f4f35cf6e93dddda72ec259602f6

SHA512
f2f944c8b9582a013f6efaaac77c13742c7305bf96c141df9c668da01be0d0ce0d97039ecb79168b983c57bb5b94164c7636258f87d023ab3275e27ec23292ff

Download Submit
C:\Windows\System\QdYIuHk.exe

Filesize
815KB

MD5
d867e30c67144b095217829e856ac6d8

SHA1
1c540d42a174b566b27cfda9826fa168b13c35b4

SHA256
2bf1b727f59fcfafd43071b4589eaf98ae597194851c38103b9700caf62c6e7b

SHA512
9d5ef68b75fff9a4e5f8b5dd8a2e6b217a796999c04f2e460859d10481cc3a6888fec38bb9aa0065cf48348ea1ed655ba708c1ecb8b888b9e59ace06a01d90e2

Download Submit
C:\Windows\System\RjwdKQj.exe

Filesize
817KB

MD5
32510598d40c5eb4ac354fa1a35d2975

SHA1
35d882b8df5b324b4d7bac54df0925b21341a463

SHA256
56be6aa284caef46ef28675bbdde6eff54f690cadf3079bb4400b8cf575cca58

SHA512
9965a99a8e80aa6d38d9851d64bb53d108ef1e3b475fbb559a2e298adb533f1bc424e9a9b87d56af4afaa7393d36b4d9e5c4f34c36bfa5e09773cb633acebd7a

Download Submit
C:\Windows\System\SAhhENF.exe

Filesize
818KB

MD5
42350f2e5c33f927356d46c3e55e49ba

SHA1
d9d1a3f8029707e65908c04a95a3efd03f017a90

SHA256
2fd4d193b32b9de22f6d5ce697faa3dd355a3779c92ed19ef99537451f9f88fa

SHA512
433a80573bbe1579ab5759956d3818828a3f12575de8c8f02c5c83fa924ea7a8c58597288c807109d5501baa3340032b8a8224ae58a398c11e92b443c164d4b2

Download Submit
C:\Windows\System\TEzJdtD.exe

Filesize
811KB

MD5
e5d8caf2d30333f25e8118508b607004

SHA1
178127d553f6fbd0566d16a9797379510af03382

SHA256
06968567e1219c2fdc75f62adb6ba2f5f75d47d0c0da85b77ed14d7c1f876398

SHA512
8cc2537275f10f69a713b78d10276f39582877b993b1e4a0dbcce51369fddf29417972b7faca41f207b73bd4382c75236491e7194c7518ae6b5f7bf82b1caf0c

Download Submit
C:\Windows\System\TtyymdC.exe

Filesize
817KB

MD5
f16cacbf335b1828948096223a752cce

SHA1
caec674908c34abed75cd83bab01e9daffa4eb19

SHA256
d9a6e807c0488897f11c8c27358f12dd91b7dbf3721700653b68c42650d148a1

SHA512
4a54e0e573dc144e1b13e1f26a75df5003ebf7956f0877b9c2c228effbfaaaa2cf56d583f5508c0c16845223db097eb599deb88c1d276c2a9a1738ffb1d6920f

Download Submit
C:\Windows\System\UzmVAlm.exe

Filesize
809KB

MD5
de456e2f9bc05eccf45af5982cf23456

SHA1
842ae7ad8d6c9f7b75ff10422b5b8ba192b1777b

SHA256
cf09d19680517fe13f52e9fcc980a31854549c6cf1ceacad52aabd9b41fef3b6

SHA512
ddd4dda21f8445039e563a615caabd631fb61ac987d26c777879b7beee1580b43580f789c9d0e3895804fd9c228a5049be7f0abe9665871163dac5b0708c459f

Download Submit
C:\Windows\System\WXVGTFG.exe

Filesize
809KB

MD5
0aa7e226e90b8f46140cc1bed5a85e08

SHA1
c0201b02e103da7d5cbbc2080f3348859eab9bc5

SHA256
033f5f3f16b45425253303672437b2919f44ca968e68bf7f6c8dbb5e8124cae7

SHA512
b97412673fd9a717a72ca3e943ddda4824e82f0cdac43d537e16c12211b521120db4537ea3cd6c539a1dba1780dd66a9777789306280913d6073abe8ecb8672a

Download Submit
C:\Windows\System\XKWDQbP.exe

Filesize
813KB

MD5
4a41605b222513bc894ca95fd7495d0b

SHA1
4220247aeae883ae50b75588f2b0b9704612cc0c

SHA256
0a63291557b6b8f4cf8452b72c26c97468ecc4b4533733e7520c58565173a358

SHA512
91f6b0347072c53b867790ddd4a8a00d0693fa85b6ab4d9f1422e4cc3672b6ba73cc8e7fc17b72d270051c50ba061e75355dd23f3de5d12fe9fd01383707c021

Download Submit
C:\Windows\System\XvyAAQL.exe

Filesize
818KB

MD5
abd38cac04f33b5374e2c2b78a620dbd

SHA1
d5762d2db1369d951d13ae4e86827f448099b984

SHA256
96c1fabf55c8a2128b61637abc3bc5b178cf84ea0db7e8003cfa67d50ffad13c

SHA512
fcb358d32c0c44e372c0e2f344299eb38d2fba846516464394d0b7d7add4696d9e04ce95eb5f4d7703fcc1bd1e692484ed4cf7b79644a7cdf2ca628c3b28e949

Download Submit
C:\Windows\System\YxDFRpF.exe

Filesize
817KB

MD5
07211f1584a6d7863928ac5fc0e07df1

SHA1
78c651137cf27fdd5638a311f8c1ddd8adf3c389

SHA256
7183f293ed782fa36e5cbff62c887da6a74fa09b93236133549b49930249fcce

SHA512
5c435aff85ee4cb22f2641950c7c9fe12db8841b5fb9c08b8d711c21d0bce665ec2eaf3f5a6d5d0a2036f5c4e17f76423390d21732a1895a342b6f282055f3b2

Download Submit
C:\Windows\System\ZxwBNjS.exe

Filesize
811KB

MD5
8c6de7be12d9aba5d9400ec3311d7125

SHA1
ab90fd67a79f5eddc25fe01affec679a0fcf83c3

SHA256
52b600a205e940011574f0c2aeb60d20ded47a674d4f5b2b0d58bf1302d05da9

SHA512
9c49ad6d44cae2fff40569fd132cfa2c0a0be3d8bb3fcb68a2309f68e7fb36042927a2674f3d0a7f3a900296ddf116718ffc7fc778a89b91bb0a339ba07349fb

Download Submit
C:\Windows\System\alvkeiR.exe

Filesize
814KB

MD5
7e23de999bd8bf66d29d80d142042f90

SHA1
9f4021ddee067b284046d0708de83019cb454569

SHA256
ff922e06a246e4cf58a850767bd1af0f57de5a93935fcdd04031ee6d72a66b4f

SHA512
687d9c3ea92ded021237674d1251a58e19c3bec43ceec17aa8ccfac08578b8c329b616d3edaada72580c5fc2667bfbbebb4da367255ffa5c4322c2d255cec549

Download Submit
C:\Windows\System\dzVfAqK.exe

Filesize
808KB

MD5
56542467dc1026d5ac1f5b910c35a01f

SHA1
841f0d00a1a5e07d8eee2a13da2f1c614a2fee8f

SHA256
9d38ad3b2a2e92a8456059399c3f754b06f219530d9ecb30a67677871165f984

SHA512
4aacd12bd1d72452eb6434becd8f97a07a6c9a5e61aebd21fc6381d8d2032ac025cfc275aca8bd86173d2784cf1d1aa2f64c335825cb2f687fa2b97d976e805e

Download Submit
C:\Windows\System\fCpWPfW.exe

Filesize
814KB

MD5
e13ef134eb25d77bf3d9653bd0299d65

SHA1
aaae422a8b3c09d064347ae3a1945015b805db62

SHA256
50e4e632c22101cebdbf8e3b23c5cf48508bf5559caa52fc81e0080985b4ca20

SHA512
b8c8505a03d4c79670101564293cb233d4bf0bde6931e8803f82df4edeac2a058839d38ebf42efc0653f642084fcdb932b3c853f7b16ea5456eaf802424021f2

Download Submit
C:\Windows\System\gAmKaHK.exe

Filesize
807KB

MD5
a4c8d3a23705ecafb74b54dca31c7658

SHA1
4d99a9b2af9356f1eb1e92c4444b5aa94fac2e67

SHA256
deee4e084db99b0b843dcf89fafbbb172c4bde801d8e48639524b3480cfe8577

SHA512
706afae4764ec04559971cd53bd68fb2beb0f486b40fa1c11abe91cdaa93d8d04fb2f5e8633d4073c51ac1467aaa1f2e376f6b60717e056cb193cadca3b9d558

Download Submit
C:\Windows\System\hgLXkfZ.exe

Filesize
816KB

MD5
724178549b46b5411fa99805ec4f4a6b

SHA1
c7326e3863f2c6cac8960a3b9c1cf5f56c01a895

SHA256
53fbc12512eaa505be2a262a2f3cc40c69786318c5992fe79038932f68b3248f

SHA512
9c1735d82ccc04e39e818f9a6fc0cd8f5096d4f00089b669a884efeca86051bf50c23083300deddb0bd8f8dc44a47521fada29a5692a61405ed5f9547fcdffb6

Download Submit
C:\Windows\System\lPKUNuA.exe

Filesize
813KB

MD5
3ed268178ec32bddfa713e553045fbb0

SHA1
66c5ef0477eef1ba8f2f6e0cda6c252a42c2290b

SHA256
ce0d5a5bf0c23a336314738d0351327c54747273fdb2c5e26e556698bcda09f2

SHA512
e512c609b29e8f5de14d29fb78186db36f2b1f9852472bfdd2f6f3f4bb896c22bd2cdf7e8bb4ce4cf3bf27b40ff5295d519fc44ac4a04885f45fa08959991da1

Download Submit
C:\Windows\System\llxzrFv.exe

Filesize
812KB

MD5
f3677adac4ec740dba990bde7d17abf2

SHA1
244a3b51d3c9908f9f2a12d15b0c985d59ccb4ae

SHA256
95591db06f4d95c8909a03cec7784783283ee17f4e1ade77276386af8e96ed5f

SHA512
2d3bb80651d106a30bb6130514ceb354eeb5d986b7a98a007aed3bf3772709b61135f77d7613316816f96b0c5dc78265ea319f0cead4f99438e524a609a2380d

Download Submit
C:\Windows\System\logRqyJ.exe

Filesize
811KB

MD5
be5df71a309b4eb9279402ace84311cf

SHA1
7b47a077b3c206e9a34383be7004cc83e72c565b

SHA256
ea2bed7f0082977b83a359e2d9a84379f01fdb0dc21451760d3a31914bddfff7

SHA512
4e4adc942d4f18fbb2a6ab3101c7f00c448829d95ab9f62ca23e1615e885e67225b237d60af7e831e8381bd759e75ea426dc2e98c00b4a99834cf9e2eec14f2b

Download Submit
C:\Windows\System\nIvYWsX.exe

Filesize
817KB

MD5
ad3a042cba6358bb147ad48d012299ec

SHA1
499dc225718b90079e57fc769e5818e32bc35db4

SHA256
9b8552ecde5f91010b489b478cab2fea5a37dc35c3c63a39f7c4e5b0ea3fd4c8

SHA512
19c565d7920edcd17153af2a6341564326c4499df12d762622e57ce66cd64c4b2100ab391fe7aa37e1f7863f8e5ef49bbc9b00a6b6c81d9e1b5579c2f0f2578b

Download Submit
C:\Windows\System\rjNxOwS.exe

Filesize
813KB

MD5
459a721c925658283cd31b810c677597

SHA1
5eb197c7b9f61b0749a5ae3fb46a113bcb45e79f

SHA256
98dc4d860af1918e7d8cab4199a2595cc7803886870986a39c32194566209dd1

SHA512
8add15ead7f727d1ec2ecfdcd150c2a1c79dd124c2177dd5db6f8a378ce6c3ad60eba836a99ada523dfd7895e045ff305eb63c626e9418d794195634c34c852b

Download Submit
C:\Windows\System\rnLnQkT.exe

Filesize
812KB

MD5
898c74378a91aaeb28ffab9376ff6707

SHA1
799f38652bc011d4bd2963e7d33046c94a44b2e5

SHA256
b4c2e3d1178ac2e0f25791fb8127516d54cf06b51bef35c965737e609b0d1773

SHA512
f96d7fefa85ccf7e9ce327f3c773dd09780db18e52ed58c8d90771170b1a230081047485bfa5fa7793df780252a07ba4115c49ea0b65e73801a4432b6f83df28

Download Submit
C:\Windows\System\rxbOSEc.exe

Filesize
814KB

MD5
858f23a438f00c9aeb5d9b9d10af0992

SHA1
b39a55205dc34c4e1ece3736159445533e1d8728

SHA256
21fde5a66a7e12db4916872cb32e5c4df072bca94faba3bef05c86d0a5149229

SHA512
6e89ac58ee3c0a31f74da7d163baa523e432f8bb93c68d7a9d4d190a69e014268008048ef4109c32bca37c952cf454bd29380b1218d30ff7eece9df60863f88b

Download Submit
C:\Windows\System\taXrHtH.exe

Filesize
808KB

MD5
9f155edf383a68d9c425e262cfbab8a4

SHA1
ca5513cbbfe68752a9c30116369284373db76403

SHA256
b8cd551b2c4158865eab32bcd7649c6150f571cb1ada183190a26ca5a14d9abf

SHA512
1e022d686338d0fbbf749064ace67e7c54be21b9525bf4f76f024248506111ffe60ab82f6565621dedbf8c912de9ca832a61fe241bb006fbf206b7e9045069e2

Download Submit
C:\Windows\System\usCjpRb.exe

Filesize
811KB

MD5
744b10f9ecabdba0c544d03dcfc87a73

SHA1
e0e318b6af615d951a35b8d075559533ee687afe

SHA256
97e5c0a54152e37c2afdddcbbf35017e70bf78510de9805d781cc373fb8c2251

SHA512
c3355f8d53fd8c7822232fd0b71a1e5dc81d48126a9a3139f81415ec5afa08640ea106cf2ca5c61f5c015d1498f2fe70fbe7bd21319d8c68a88ba2d2161cff6c

Download Submit
C:\Windows\System\xuxHFuf.exe

Filesize
813KB

MD5
5bbc418ebb68d66893515ceac659322a

SHA1
12f02acee3769bcc105c9f2aa519fa53be22c6b1

SHA256
83c1e7fd7fffee24ed02f11d08bb4bfd3d1b29a39150a05ba916e4b93eb9aa22

SHA512
75356b65274147afd939fdf879023476c03a2b91b32331142f94e641e1afbf0fdd5d76d26b67f9ee0effdf11652d6f52cbe1d3acadfeea7c2246fe9353da2e27

Download Submit
C:\Windows\System\yfwRfpa.exe

Filesize
812KB

MD5
4f65bbba268f6f11a95d1df198545a6d

SHA1
dfa9127a01df973f6272257aa0f941c87489003b

SHA256
ce181ca60178557162f0bcef16b90b5d89f23c990d1a3cbf0e9e8ffd100aabe1

SHA512
969db372b5cb88929c4aaf91f5e4ebc7f878bd47f3b37b90bf69736895ebd32e02f7c7e091858c38f52dc7ff3c33380f4b9e000c701bd73a82e2a6d160e67607

Download Submit
C:\Windows\System\zobnbGl.exe

Filesize
816KB

MD5
2ebdf172813582e888b605ca505d8932

SHA1
a77d6d05103a42effe4cee29cc5ddb97aa042ef6

SHA256
d6253102f9bf34238af3af4abb1664c7f72d6a005db45ae7bfc0dfa65596e947

SHA512
ed4e5ebb56f4dda2b941b7380dae60b7fbf91826bfa720b52162aa148650eb10c0a242be7279063f9c04dfc233d3e5350fabbc6f03fd710466910d1ab2ca68c5

Download Submit
C:\Windows\System\zoxoGjd.exe

Filesize
812KB

MD5
6098189b0236fe45ad834d2e082086e2

SHA1
5a9e9bb416a4d48d8a17c1c56d6c32442199610f

SHA256
fc88ae339fe92fcaec94b08e15dfe092c3fc10509446a0905ab3c07c0e5cdc36

SHA512
ac6df510945408812b4f660cf9c66733fe497614e412e9a750d489d80d086e27c062cb386b8460032fb111cf3bb9554dd6f01d32c869419c5a363b97b82f03e8

Download Submit
memory/412-1244-0x00007FF7A1A20000-0x00007FF7A1E12000-memory.dmp

Filesize
3.9MB

Download
memory/412-6499-0x00007FF7A1A20000-0x00007FF7A1E12000-memory.dmp

Filesize
3.9MB

Download
memory/516-6183-0x00007FF71D6A0000-0x00007FF71DA92000-memory.dmp

Filesize
3.9MB

Download
memory/612-1512-0x00007FF620510000-0x00007FF620902000-memory.dmp

Filesize
3.9MB

Download
memory/612-6239-0x00007FF620510000-0x00007FF620902000-memory.dmp

Filesize
3.9MB

Download
memory/764-1733-0x00007FF715EC0000-0x00007FF7162B2000-memory.dmp

Filesize
3.9MB

Download
memory/764-6133-0x00007FF715EC0000-0x00007FF7162B2000-memory.dmp

Filesize
3.9MB

Download
memory/832-627-0x00007FF71EF00000-0x00007FF71F2F2000-memory.dmp

Filesize
3.9MB

Download
memory/832-6082-0x00007FF71EF00000-0x00007FF71F2F2000-memory.dmp

Filesize
3.9MB

Download
memory/1020-1-0x000002CBA80F0000-0x000002CBA8100000-memory.dmp

Filesize
64KB

Download
memory/1020-0-0x00007FF690770000-0x00007FF690B62000-memory.dmp

Filesize
3.9MB

Download
memory/1224-516-0x00007FF785D10000-0x00007FF786102000-memory.dmp

Filesize
3.9MB

Download
memory/1368-6457-0x00007FF78F7E0000-0x00007FF78FBD2000-memory.dmp

Filesize
3.9MB

Download
memory/1368-1012-0x00007FF78F7E0000-0x00007FF78FBD2000-memory.dmp

Filesize
3.9MB

Download
memory/1584-694-0x00007FF73F070000-0x00007FF73F462000-memory.dmp

Filesize
3.9MB

Download
memory/1696-623-0x00007FF7FD030000-0x00007FF7FD422000-memory.dmp

Filesize
3.9MB

Download
memory/1712-760-0x00007FF694670000-0x00007FF694A62000-memory.dmp

Filesize
3.9MB

Download
memory/2044-6544-0x00007FF7CFEB0000-0x00007FF7D02A2000-memory.dmp

Filesize
3.9MB

Download
memory/2044-761-0x00007FF7CFEB0000-0x00007FF7D02A2000-memory.dmp

Filesize
3.9MB

Download
memory/2112-6543-0x00007FF7D8EC0000-0x00007FF7D92B2000-memory.dmp

Filesize
3.9MB

Download
memory/2112-1097-0x00007FF7D8EC0000-0x00007FF7D92B2000-memory.dmp

Filesize
3.9MB

Download
memory/2232-766-0x00007FF779A80000-0x00007FF779E72000-memory.dmp

Filesize
3.9MB

Download
memory/2232-6509-0x00007FF779A80000-0x00007FF779E72000-memory.dmp

Filesize
3.9MB

Download
memory/2588-1243-0x00007FF720FD0000-0x00007FF7213C2000-memory.dmp

Filesize
3.9MB

Download
memory/2588-6511-0x00007FF720FD0000-0x00007FF7213C2000-memory.dmp

Filesize
3.9MB

Download
memory/2740-6564-0x00007FF78E9B0000-0x00007FF78EDA2000-memory.dmp

Filesize
3.9MB

Download
memory/2740-764-0x00007FF78E9B0000-0x00007FF78EDA2000-memory.dmp

Filesize
3.9MB

Download
memory/3448-1092-0x00007FF64EE50000-0x00007FF64F242000-memory.dmp

Filesize
3.9MB

Download
memory/3592-389-0x00007FF78BE80000-0x00007FF78C272000-memory.dmp

Filesize
3.9MB

Download
memory/3712-6504-0x00007FF63C510000-0x00007FF63C902000-memory.dmp

Filesize
3.9MB

Download
memory/3712-762-0x00007FF63C510000-0x00007FF63C902000-memory.dmp

Filesize
3.9MB

Download
memory/3772-1013-0x00007FF684130000-0x00007FF684522000-memory.dmp

Filesize
3.9MB

Download
memory/4088-6502-0x00007FF691050000-0x00007FF691442000-memory.dmp

Filesize
3.9MB

Download
memory/4088-1093-0x00007FF691050000-0x00007FF691442000-memory.dmp

Filesize
3.9MB

Download
memory/4336-6503-0x00007FF6D7D20000-0x00007FF6D8112000-memory.dmp

Filesize
3.9MB

Download
memory/4336-763-0x00007FF6D7D20000-0x00007FF6D8112000-memory.dmp

Filesize
3.9MB

Download
memory/4692-6508-0x00007FF791E50000-0x00007FF792242000-memory.dmp

Filesize
3.9MB

Download
memory/4692-767-0x00007FF791E50000-0x00007FF792242000-memory.dmp

Filesize
3.9MB

Download
memory/4852-124-0x000001BB1CCF0000-0x000001BB1CD12000-memory.dmp

Filesize
136KB

Download
memory/4852-257-0x00007FFF7CB10000-0x00007FFF7D5D1000-memory.dmp

Filesize
10.8MB

Download
memory/4852-5-0x00007FFF7CB13000-0x00007FFF7CB15000-memory.dmp

Filesize
8KB

Download
memory/4852-93-0x00007FFF7CB10000-0x00007FFF7D5D1000-memory.dmp

Filesize
10.8MB

Download
memory/4852-2294-0x00007FFF7CB10000-0x00007FFF7D5D1000-memory.dmp

Filesize
10.8MB

Download
memory/4980-765-0x00007FF76B610000-0x00007FF76BA02000-memory.dmp

Filesize
3.9MB

Download
memory/5036-6306-0x00007FF729FC0000-0x00007FF72A3B2000-memory.dmp

Filesize
3.9MB

Download
memory/5036-1403-0x00007FF729FC0000-0x00007FF72A3B2000-memory.dmp

Filesize
3.9MB

Download