xmrig | 9e09aa836532f20e16f2df3a66ca3f90b9ecad621081a70c8fe8efe7eaa1dff4

Analysis

max time kernel
150s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
29/06/2024, 10:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

9e09aa836532f20e16f2df3a66ca3f90b9ecad621081a70c8fe8efe7eaa1dff4_NeikiAnalytics.exe
Size

762KB
MD5

4f8650e77730d6234c74c1d649f39a90
SHA1

052f99a21e2aebb2f068f5f895f5e3012bdfbd42
SHA256

9e09aa836532f20e16f2df3a66ca3f90b9ecad621081a70c8fe8efe7eaa1dff4
SHA512

8edd38422f00207a24167fefeaf982425e02f2d0865f6afb3e4eff98c6ab5187bfed29b08735e8598b12351f3a7f87306444f63dff4ace3261a8db381bd5a1d4
SSDEEP

12288:UuqZ0GO3/fTn5rPtFDO5BTVo2hZiavoQFNc6E4PUwgsF+FCf9jGkxBi8TA:zv3/fTLF671TilQFG4P5PMCfZZds

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 42 IoCs

miner

resource	yara_rule
behavioral2/memory/4444-300-0x00007FF77DA00000-0x00007FF77DDF2000-memory.dmp	xmrig
behavioral2/memory/3732-647-0x00007FF6A3CF0000-0x00007FF6A40E2000-memory.dmp	xmrig
behavioral2/memory/2904-640-0x00007FF7A2FE0000-0x00007FF7A33D2000-memory.dmp	xmrig
behavioral2/memory/4040-792-0x00007FF759B90000-0x00007FF759F82000-memory.dmp	xmrig
behavioral2/memory/4540-798-0x00007FF6100D0000-0x00007FF6104C2000-memory.dmp	xmrig
behavioral2/memory/4372-805-0x00007FF6AA620000-0x00007FF6AAA12000-memory.dmp	xmrig
behavioral2/memory/2824-804-0x00007FF67BBE0000-0x00007FF67BFD2000-memory.dmp	xmrig
behavioral2/memory/384-803-0x00007FF616C90000-0x00007FF617082000-memory.dmp	xmrig
behavioral2/memory/1012-802-0x00007FF6AAB70000-0x00007FF6AAF62000-memory.dmp	xmrig
behavioral2/memory/4812-801-0x00007FF72EF80000-0x00007FF72F372000-memory.dmp	xmrig
behavioral2/memory/1300-800-0x00007FF6CE340000-0x00007FF6CE732000-memory.dmp	xmrig
behavioral2/memory/4868-799-0x00007FF6EE520000-0x00007FF6EE912000-memory.dmp	xmrig
behavioral2/memory/3220-797-0x00007FF715A30000-0x00007FF715E22000-memory.dmp	xmrig
behavioral2/memory/1524-796-0x00007FF7C43B0000-0x00007FF7C47A2000-memory.dmp	xmrig
behavioral2/memory/1724-795-0x00007FF7C8700000-0x00007FF7C8AF2000-memory.dmp	xmrig
behavioral2/memory/4020-794-0x00007FF6A6810000-0x00007FF6A6C02000-memory.dmp	xmrig
behavioral2/memory/2140-793-0x00007FF65A920000-0x00007FF65AD12000-memory.dmp	xmrig
behavioral2/memory/1700-791-0x00007FF65D520000-0x00007FF65D912000-memory.dmp	xmrig
behavioral2/memory/4136-547-0x00007FF705930000-0x00007FF705D22000-memory.dmp	xmrig
behavioral2/memory/4984-464-0x00007FF764090000-0x00007FF764482000-memory.dmp	xmrig
behavioral2/memory/1836-395-0x00007FF708430000-0x00007FF708822000-memory.dmp	xmrig
behavioral2/memory/1948-173-0x00007FF66D810000-0x00007FF66DC02000-memory.dmp	xmrig
behavioral2/memory/4444-6756-0x00007FF77DA00000-0x00007FF77DDF2000-memory.dmp	xmrig
behavioral2/memory/1836-6798-0x00007FF708430000-0x00007FF708822000-memory.dmp	xmrig
behavioral2/memory/4984-6781-0x00007FF764090000-0x00007FF764482000-memory.dmp	xmrig
behavioral2/memory/2140-6772-0x00007FF65A920000-0x00007FF65AD12000-memory.dmp	xmrig
behavioral2/memory/3732-6731-0x00007FF6A3CF0000-0x00007FF6A40E2000-memory.dmp	xmrig
behavioral2/memory/1948-6735-0x00007FF66D810000-0x00007FF66DC02000-memory.dmp	xmrig
behavioral2/memory/1724-6704-0x00007FF7C8700000-0x00007FF7C8AF2000-memory.dmp	xmrig
behavioral2/memory/4136-6848-0x00007FF705930000-0x00007FF705D22000-memory.dmp	xmrig
behavioral2/memory/3220-6870-0x00007FF715A30000-0x00007FF715E22000-memory.dmp	xmrig
behavioral2/memory/1524-6942-0x00007FF7C43B0000-0x00007FF7C47A2000-memory.dmp	xmrig
behavioral2/memory/1300-6953-0x00007FF6CE340000-0x00007FF6CE732000-memory.dmp	xmrig
behavioral2/memory/384-6959-0x00007FF616C90000-0x00007FF617082000-memory.dmp	xmrig
behavioral2/memory/2972-6949-0x00007FF6ABCE0000-0x00007FF6AC0D2000-memory.dmp	xmrig
behavioral2/memory/2904-6917-0x00007FF7A2FE0000-0x00007FF7A33D2000-memory.dmp	xmrig
behavioral2/memory/4868-6910-0x00007FF6EE520000-0x00007FF6EE912000-memory.dmp	xmrig
behavioral2/memory/4040-6844-0x00007FF759B90000-0x00007FF759F82000-memory.dmp	xmrig
behavioral2/memory/4020-6825-0x00007FF6A6810000-0x00007FF6A6C02000-memory.dmp	xmrig
behavioral2/memory/1012-7115-0x00007FF6AAB70000-0x00007FF6AAF62000-memory.dmp	xmrig
behavioral2/memory/2824-7064-0x00007FF67BBE0000-0x00007FF67BFD2000-memory.dmp	xmrig
behavioral2/memory/4812-6985-0x00007FF72EF80000-0x00007FF72F372000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
2556	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
2912	EETAfVW.exe
4372	GZqaJDZ.exe
1948	dyqxEyB.exe
2972	RSAlcTm.exe
4444	ZXEGKWM.exe
1836	pUqnOye.exe
4984	knamVxo.exe
4136	TUyEyPP.exe
2904	oztwRBW.exe
3732	ZYopXXz.exe
1700	PkNmlHI.exe
4040	iPZfgop.exe
2140	JqDaxFW.exe
4020	IuFmRkN.exe
1724	SkCXxyA.exe
1524	BNoOsXm.exe
3220	XByEBSq.exe
4540	mtqCDyt.exe
4868	uAdCEwW.exe
1300	hOZFppt.exe
4812	VREzGPp.exe
1012	kyFijIn.exe
384	NypyJNf.exe
2824	SIKlNcK.exe
5008	IgJpXBj.exe
1740	MLZZTaK.exe
4788	DDBUdiP.exe
4976	yOehabv.exe
2804	RLCEAeG.exe
2328	TwpwHUA.exe
3092	oHmsjIY.exe
824	KdJFtcj.exe
1044	uHRqnBQ.exe
116	gFKCzWm.exe
3748	PokDYfA.exe
2916	dkdODus.exe
2264	XQemeEg.exe
2212	PDKXikB.exe
2600	GTsGXQJ.exe
4896	lGGezxE.exe
3480	rpYUvNl.exe
4780	ohBULBS.exe
4960	IOxthay.exe
1052	uYqBhjw.exe
1320	EjzwNET.exe
1628	dVzQFrb.exe
4176	FTGpNIs.exe
1984	UmnKXIb.exe
424	aFUpbuH.exe
4720	hudBoSi.exe
4076	KaLCbTA.exe
2492	LrQqSve.exe
3112	nIORPfJ.exe
2324	AvgEOeO.exe
2024	cXZNhGP.exe
2588	nuMhFKI.exe
3724	GedXPqF.exe
1256	grLIdjj.exe
692	qSHlasX.exe
2068	fxoXbED.exe
3256	CzqYRzY.exe
4504	woJkTdu.exe
4080	QEitKko.exe
2924	mDnmWMf.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2680-0-0x00007FF7EC590000-0x00007FF7EC982000-memory.dmp	upx
behavioral2/files/0x00090000000233ed-5.dat	upx
behavioral2/files/0x00070000000233f2-113.dat	upx
behavioral2/files/0x0007000000023401-207.dat	upx
behavioral2/memory/4444-300-0x00007FF77DA00000-0x00007FF77DDF2000-memory.dmp	upx
behavioral2/memory/3732-647-0x00007FF6A3CF0000-0x00007FF6A40E2000-memory.dmp	upx
behavioral2/memory/2904-640-0x00007FF7A2FE0000-0x00007FF7A33D2000-memory.dmp	upx
behavioral2/memory/4040-792-0x00007FF759B90000-0x00007FF759F82000-memory.dmp	upx
behavioral2/memory/4540-798-0x00007FF6100D0000-0x00007FF6104C2000-memory.dmp	upx
behavioral2/memory/4372-805-0x00007FF6AA620000-0x00007FF6AAA12000-memory.dmp	upx
behavioral2/memory/2824-804-0x00007FF67BBE0000-0x00007FF67BFD2000-memory.dmp	upx
behavioral2/memory/384-803-0x00007FF616C90000-0x00007FF617082000-memory.dmp	upx
behavioral2/memory/1012-802-0x00007FF6AAB70000-0x00007FF6AAF62000-memory.dmp	upx
behavioral2/memory/4812-801-0x00007FF72EF80000-0x00007FF72F372000-memory.dmp	upx
behavioral2/memory/1300-800-0x00007FF6CE340000-0x00007FF6CE732000-memory.dmp	upx
behavioral2/memory/4868-799-0x00007FF6EE520000-0x00007FF6EE912000-memory.dmp	upx
behavioral2/memory/3220-797-0x00007FF715A30000-0x00007FF715E22000-memory.dmp	upx
behavioral2/memory/1524-796-0x00007FF7C43B0000-0x00007FF7C47A2000-memory.dmp	upx
behavioral2/memory/1724-795-0x00007FF7C8700000-0x00007FF7C8AF2000-memory.dmp	upx
behavioral2/memory/4020-794-0x00007FF6A6810000-0x00007FF6A6C02000-memory.dmp	upx
behavioral2/memory/2140-793-0x00007FF65A920000-0x00007FF65AD12000-memory.dmp	upx
behavioral2/memory/1700-791-0x00007FF65D520000-0x00007FF65D912000-memory.dmp	upx
behavioral2/memory/4136-547-0x00007FF705930000-0x00007FF705D22000-memory.dmp	upx
behavioral2/memory/4984-464-0x00007FF764090000-0x00007FF764482000-memory.dmp	upx
behavioral2/memory/1836-395-0x00007FF708430000-0x00007FF708822000-memory.dmp	upx
behavioral2/files/0x0007000000023407-236.dat	upx
behavioral2/files/0x000700000002341c-235.dat	upx
behavioral2/files/0x000700000002341b-234.dat	upx
behavioral2/files/0x0007000000023406-233.dat	upx
behavioral2/files/0x000700000002341a-230.dat	upx
behavioral2/files/0x0007000000023419-229.dat	upx
behavioral2/files/0x0007000000023404-226.dat	upx
behavioral2/files/0x0007000000023417-218.dat	upx
behavioral2/files/0x0007000000023402-210.dat	upx
behavioral2/files/0x0007000000023416-206.dat	upx
behavioral2/files/0x0007000000023415-201.dat	upx
behavioral2/files/0x0007000000023414-200.dat	upx
behavioral2/files/0x0007000000023413-198.dat	upx
behavioral2/files/0x0007000000023411-195.dat	upx
behavioral2/files/0x0007000000023410-184.dat	upx
behavioral2/files/0x000700000002340e-181.dat	upx
behavioral2/files/0x000700000002340d-179.dat	upx
behavioral2/files/0x00070000000233ff-178.dat	upx
behavioral2/memory/2972-253-0x00007FF6ABCE0000-0x00007FF6AC0D2000-memory.dmp	upx
behavioral2/files/0x000700000002340c-165.dat	upx
behavioral2/files/0x000700000002340b-163.dat	upx
behavioral2/files/0x000700000002340a-153.dat	upx
behavioral2/files/0x00070000000233f7-146.dat	upx
behavioral2/files/0x0007000000023409-145.dat	upx
behavioral2/files/0x00070000000233fc-129.dat	upx
behavioral2/files/0x00070000000233fa-228.dat	upx
behavioral2/files/0x0007000000023418-227.dat	upx
behavioral2/files/0x0007000000023405-121.dat	upx
behavioral2/files/0x00070000000233f5-105.dat	upx
behavioral2/files/0x0007000000023412-196.dat	upx
behavioral2/files/0x0007000000023400-189.dat	upx
behavioral2/files/0x00070000000233f9-90.dat	upx
behavioral2/files/0x000700000002340f-183.dat	upx
behavioral2/files/0x00070000000233fe-84.dat	upx
behavioral2/memory/1948-173-0x00007FF66D810000-0x00007FF66DC02000-memory.dmp	upx
behavioral2/files/0x00070000000233fd-77.dat	upx
behavioral2/files/0x00070000000233f6-136.dat	upx
behavioral2/files/0x00070000000233fb-128.dat	upx
behavioral2/files/0x0007000000023403-118.dat	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\AdMVbnl.exe	9e09aa836532f20e16f2df3a66ca3f90b9ecad621081a70c8fe8efe7eaa1dff4_NeikiAnalytics.exe
File created	C:\Windows\System\jlnGUvu.exe	9e09aa836532f20e16f2df3a66ca3f90b9ecad621081a70c8fe8efe7eaa1dff4_NeikiAnalytics.exe
File created	C:\Windows\System\OEYYJWU.exe	9e09aa836532f20e16f2df3a66ca3f90b9ecad621081a70c8fe8efe7eaa1dff4_NeikiAnalytics.exe
File created	C:\Windows\System\DlNwHsb.exe	9e09aa836532f20e16f2df3a66ca3f90b9ecad621081a70c8fe8efe7eaa1dff4_NeikiAnalytics.exe
File created	C:\Windows\System\KrzohhD.exe	9e09aa836532f20e16f2df3a66ca3f90b9ecad621081a70c8fe8efe7eaa1dff4_NeikiAnalytics.exe
File created	C:\Windows\System\HkAwNwC.exe	9e09aa836532f20e16f2df3a66ca3f90b9ecad621081a70c8fe8efe7eaa1dff4_NeikiAnalytics.exe
File created	C:\Windows\System\nVjTVzC.exe	9e09aa836532f20e16f2df3a66ca3f90b9ecad621081a70c8fe8efe7eaa1dff4_NeikiAnalytics.exe
File created	C:\Windows\System\McUUONY.exe	9e09aa836532f20e16f2df3a66ca3f90b9ecad621081a70c8fe8efe7eaa1dff4_NeikiAnalytics.exe
File created	C:\Windows\System\FjzwgpU.exe	9e09aa836532f20e16f2df3a66ca3f90b9ecad621081a70c8fe8efe7eaa1dff4_NeikiAnalytics.exe
File created	C:\Windows\System\QXVnhfB.exe	9e09aa836532f20e16f2df3a66ca3f90b9ecad621081a70c8fe8efe7eaa1dff4_NeikiAnalytics.exe
File created	C:\Windows\System\XwJtcYs.exe	9e09aa836532f20e16f2df3a66ca3f90b9ecad621081a70c8fe8efe7eaa1dff4_NeikiAnalytics.exe
File created	C:\Windows\System\giirUmN.exe	9e09aa836532f20e16f2df3a66ca3f90b9ecad621081a70c8fe8efe7eaa1dff4_NeikiAnalytics.exe
File created	C:\Windows\System\kORLGgL.exe	9e09aa836532f20e16f2df3a66ca3f90b9ecad621081a70c8fe8efe7eaa1dff4_NeikiAnalytics.exe
File created	C:\Windows\System\qdIJiiq.exe	9e09aa836532f20e16f2df3a66ca3f90b9ecad621081a70c8fe8efe7eaa1dff4_NeikiAnalytics.exe
File created	C:\Windows\System\USwOXye.exe	9e09aa836532f20e16f2df3a66ca3f90b9ecad621081a70c8fe8efe7eaa1dff4_NeikiAnalytics.exe
File created	C:\Windows\System\EaIBqkX.exe	9e09aa836532f20e16f2df3a66ca3f90b9ecad621081a70c8fe8efe7eaa1dff4_NeikiAnalytics.exe
File created	C:\Windows\System\kybjOCb.exe	9e09aa836532f20e16f2df3a66ca3f90b9ecad621081a70c8fe8efe7eaa1dff4_NeikiAnalytics.exe
File created	C:\Windows\System\hxTOxZI.exe	9e09aa836532f20e16f2df3a66ca3f90b9ecad621081a70c8fe8efe7eaa1dff4_NeikiAnalytics.exe
File created	C:\Windows\System\HFaFADy.exe	9e09aa836532f20e16f2df3a66ca3f90b9ecad621081a70c8fe8efe7eaa1dff4_NeikiAnalytics.exe
File created	C:\Windows\System\kbEIrNS.exe	9e09aa836532f20e16f2df3a66ca3f90b9ecad621081a70c8fe8efe7eaa1dff4_NeikiAnalytics.exe
File created	C:\Windows\System\GVxMMqg.exe	9e09aa836532f20e16f2df3a66ca3f90b9ecad621081a70c8fe8efe7eaa1dff4_NeikiAnalytics.exe
File created	C:\Windows\System\eUmJiUf.exe	9e09aa836532f20e16f2df3a66ca3f90b9ecad621081a70c8fe8efe7eaa1dff4_NeikiAnalytics.exe
File created	C:\Windows\System\bZnkcds.exe	9e09aa836532f20e16f2df3a66ca3f90b9ecad621081a70c8fe8efe7eaa1dff4_NeikiAnalytics.exe
File created	C:\Windows\System\clbHpFR.exe	9e09aa836532f20e16f2df3a66ca3f90b9ecad621081a70c8fe8efe7eaa1dff4_NeikiAnalytics.exe
File created	C:\Windows\System\cWgAwAq.exe	9e09aa836532f20e16f2df3a66ca3f90b9ecad621081a70c8fe8efe7eaa1dff4_NeikiAnalytics.exe
File created	C:\Windows\System\JCmPnTa.exe	9e09aa836532f20e16f2df3a66ca3f90b9ecad621081a70c8fe8efe7eaa1dff4_NeikiAnalytics.exe
File created	C:\Windows\System\AEqZydE.exe	9e09aa836532f20e16f2df3a66ca3f90b9ecad621081a70c8fe8efe7eaa1dff4_NeikiAnalytics.exe
File created	C:\Windows\System\HZlbgFF.exe	9e09aa836532f20e16f2df3a66ca3f90b9ecad621081a70c8fe8efe7eaa1dff4_NeikiAnalytics.exe
File created	C:\Windows\System\OHzxTft.exe	9e09aa836532f20e16f2df3a66ca3f90b9ecad621081a70c8fe8efe7eaa1dff4_NeikiAnalytics.exe
File created	C:\Windows\System\PBreJqA.exe	9e09aa836532f20e16f2df3a66ca3f90b9ecad621081a70c8fe8efe7eaa1dff4_NeikiAnalytics.exe
File created	C:\Windows\System\MgGLOZz.exe	9e09aa836532f20e16f2df3a66ca3f90b9ecad621081a70c8fe8efe7eaa1dff4_NeikiAnalytics.exe
File created	C:\Windows\System\xADNueU.exe	9e09aa836532f20e16f2df3a66ca3f90b9ecad621081a70c8fe8efe7eaa1dff4_NeikiAnalytics.exe
File created	C:\Windows\System\FUKqFdS.exe	9e09aa836532f20e16f2df3a66ca3f90b9ecad621081a70c8fe8efe7eaa1dff4_NeikiAnalytics.exe
File created	C:\Windows\System\XbYSWYf.exe	9e09aa836532f20e16f2df3a66ca3f90b9ecad621081a70c8fe8efe7eaa1dff4_NeikiAnalytics.exe
File created	C:\Windows\System\wejBkZt.exe	9e09aa836532f20e16f2df3a66ca3f90b9ecad621081a70c8fe8efe7eaa1dff4_NeikiAnalytics.exe
File created	C:\Windows\System\VrRMKge.exe	9e09aa836532f20e16f2df3a66ca3f90b9ecad621081a70c8fe8efe7eaa1dff4_NeikiAnalytics.exe
File created	C:\Windows\System\QKiJlhc.exe	9e09aa836532f20e16f2df3a66ca3f90b9ecad621081a70c8fe8efe7eaa1dff4_NeikiAnalytics.exe
File created	C:\Windows\System\ZyZHfgg.exe	9e09aa836532f20e16f2df3a66ca3f90b9ecad621081a70c8fe8efe7eaa1dff4_NeikiAnalytics.exe
File created	C:\Windows\System\OyCaUbx.exe	9e09aa836532f20e16f2df3a66ca3f90b9ecad621081a70c8fe8efe7eaa1dff4_NeikiAnalytics.exe
File created	C:\Windows\System\EzQxMtN.exe	9e09aa836532f20e16f2df3a66ca3f90b9ecad621081a70c8fe8efe7eaa1dff4_NeikiAnalytics.exe
File created	C:\Windows\System\xeLIDrE.exe	9e09aa836532f20e16f2df3a66ca3f90b9ecad621081a70c8fe8efe7eaa1dff4_NeikiAnalytics.exe
File created	C:\Windows\System\nwpDieg.exe	9e09aa836532f20e16f2df3a66ca3f90b9ecad621081a70c8fe8efe7eaa1dff4_NeikiAnalytics.exe
File created	C:\Windows\System\VMPMCVK.exe	9e09aa836532f20e16f2df3a66ca3f90b9ecad621081a70c8fe8efe7eaa1dff4_NeikiAnalytics.exe
File created	C:\Windows\System\ViwyJCD.exe	9e09aa836532f20e16f2df3a66ca3f90b9ecad621081a70c8fe8efe7eaa1dff4_NeikiAnalytics.exe
File created	C:\Windows\System\nHMJkSD.exe	9e09aa836532f20e16f2df3a66ca3f90b9ecad621081a70c8fe8efe7eaa1dff4_NeikiAnalytics.exe
File created	C:\Windows\System\xwbFXVx.exe	9e09aa836532f20e16f2df3a66ca3f90b9ecad621081a70c8fe8efe7eaa1dff4_NeikiAnalytics.exe
File created	C:\Windows\System\FKmYAeo.exe	9e09aa836532f20e16f2df3a66ca3f90b9ecad621081a70c8fe8efe7eaa1dff4_NeikiAnalytics.exe
File created	C:\Windows\System\cyUPCcY.exe	9e09aa836532f20e16f2df3a66ca3f90b9ecad621081a70c8fe8efe7eaa1dff4_NeikiAnalytics.exe
File created	C:\Windows\System\cmxAMJN.exe	9e09aa836532f20e16f2df3a66ca3f90b9ecad621081a70c8fe8efe7eaa1dff4_NeikiAnalytics.exe
File created	C:\Windows\System\ZoJVItT.exe	9e09aa836532f20e16f2df3a66ca3f90b9ecad621081a70c8fe8efe7eaa1dff4_NeikiAnalytics.exe
File created	C:\Windows\System\TaFLSUX.exe	9e09aa836532f20e16f2df3a66ca3f90b9ecad621081a70c8fe8efe7eaa1dff4_NeikiAnalytics.exe
File created	C:\Windows\System\EByeToz.exe	9e09aa836532f20e16f2df3a66ca3f90b9ecad621081a70c8fe8efe7eaa1dff4_NeikiAnalytics.exe
File created	C:\Windows\System\wEyqusI.exe	9e09aa836532f20e16f2df3a66ca3f90b9ecad621081a70c8fe8efe7eaa1dff4_NeikiAnalytics.exe
File created	C:\Windows\System\qBBWYSe.exe	9e09aa836532f20e16f2df3a66ca3f90b9ecad621081a70c8fe8efe7eaa1dff4_NeikiAnalytics.exe
File created	C:\Windows\System\ayaMnkm.exe	9e09aa836532f20e16f2df3a66ca3f90b9ecad621081a70c8fe8efe7eaa1dff4_NeikiAnalytics.exe
File created	C:\Windows\System\MdlzqBp.exe	9e09aa836532f20e16f2df3a66ca3f90b9ecad621081a70c8fe8efe7eaa1dff4_NeikiAnalytics.exe
File created	C:\Windows\System\capEBhu.exe	9e09aa836532f20e16f2df3a66ca3f90b9ecad621081a70c8fe8efe7eaa1dff4_NeikiAnalytics.exe
File created	C:\Windows\System\SQoWdLF.exe	9e09aa836532f20e16f2df3a66ca3f90b9ecad621081a70c8fe8efe7eaa1dff4_NeikiAnalytics.exe
File created	C:\Windows\System\pSMdblz.exe	9e09aa836532f20e16f2df3a66ca3f90b9ecad621081a70c8fe8efe7eaa1dff4_NeikiAnalytics.exe
File created	C:\Windows\System\kloJZXe.exe	9e09aa836532f20e16f2df3a66ca3f90b9ecad621081a70c8fe8efe7eaa1dff4_NeikiAnalytics.exe
File created	C:\Windows\System\VsXkqpP.exe	9e09aa836532f20e16f2df3a66ca3f90b9ecad621081a70c8fe8efe7eaa1dff4_NeikiAnalytics.exe
File created	C:\Windows\System\OkIyVPm.exe	9e09aa836532f20e16f2df3a66ca3f90b9ecad621081a70c8fe8efe7eaa1dff4_NeikiAnalytics.exe
File created	C:\Windows\System\feuyiIO.exe	9e09aa836532f20e16f2df3a66ca3f90b9ecad621081a70c8fe8efe7eaa1dff4_NeikiAnalytics.exe
File created	C:\Windows\System\KMvtnGk.exe	9e09aa836532f20e16f2df3a66ca3f90b9ecad621081a70c8fe8efe7eaa1dff4_NeikiAnalytics.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
2556	powershell.exe
2556	powershell.exe
2556	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2556	powershell.exe
Token: SeLockMemoryPrivilege	2680	9e09aa836532f20e16f2df3a66ca3f90b9ecad621081a70c8fe8efe7eaa1dff4_NeikiAnalytics.exe
Token: SeLockMemoryPrivilege	2680	9e09aa836532f20e16f2df3a66ca3f90b9ecad621081a70c8fe8efe7eaa1dff4_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2680 wrote to memory of 2556	2680	9e09aa836532f20e16f2df3a66ca3f90b9ecad621081a70c8fe8efe7eaa1dff4_NeikiAnalytics.exe	81
PID 2680 wrote to memory of 2556	2680	9e09aa836532f20e16f2df3a66ca3f90b9ecad621081a70c8fe8efe7eaa1dff4_NeikiAnalytics.exe	81
PID 2680 wrote to memory of 2912	2680	9e09aa836532f20e16f2df3a66ca3f90b9ecad621081a70c8fe8efe7eaa1dff4_NeikiAnalytics.exe	82
PID 2680 wrote to memory of 2912	2680	9e09aa836532f20e16f2df3a66ca3f90b9ecad621081a70c8fe8efe7eaa1dff4_NeikiAnalytics.exe	82
PID 2680 wrote to memory of 2972	2680	9e09aa836532f20e16f2df3a66ca3f90b9ecad621081a70c8fe8efe7eaa1dff4_NeikiAnalytics.exe	83
PID 2680 wrote to memory of 2972	2680	9e09aa836532f20e16f2df3a66ca3f90b9ecad621081a70c8fe8efe7eaa1dff4_NeikiAnalytics.exe	83
PID 2680 wrote to memory of 1836	2680	9e09aa836532f20e16f2df3a66ca3f90b9ecad621081a70c8fe8efe7eaa1dff4_NeikiAnalytics.exe	84
PID 2680 wrote to memory of 1836	2680	9e09aa836532f20e16f2df3a66ca3f90b9ecad621081a70c8fe8efe7eaa1dff4_NeikiAnalytics.exe	84
PID 2680 wrote to memory of 4372	2680	9e09aa836532f20e16f2df3a66ca3f90b9ecad621081a70c8fe8efe7eaa1dff4_NeikiAnalytics.exe	85
PID 2680 wrote to memory of 4372	2680	9e09aa836532f20e16f2df3a66ca3f90b9ecad621081a70c8fe8efe7eaa1dff4_NeikiAnalytics.exe	85
PID 2680 wrote to memory of 1948	2680	9e09aa836532f20e16f2df3a66ca3f90b9ecad621081a70c8fe8efe7eaa1dff4_NeikiAnalytics.exe	86
PID 2680 wrote to memory of 1948	2680	9e09aa836532f20e16f2df3a66ca3f90b9ecad621081a70c8fe8efe7eaa1dff4_NeikiAnalytics.exe	86
PID 2680 wrote to memory of 4444	2680	9e09aa836532f20e16f2df3a66ca3f90b9ecad621081a70c8fe8efe7eaa1dff4_NeikiAnalytics.exe	87
PID 2680 wrote to memory of 4444	2680	9e09aa836532f20e16f2df3a66ca3f90b9ecad621081a70c8fe8efe7eaa1dff4_NeikiAnalytics.exe	87
PID 2680 wrote to memory of 4984	2680	9e09aa836532f20e16f2df3a66ca3f90b9ecad621081a70c8fe8efe7eaa1dff4_NeikiAnalytics.exe	88
PID 2680 wrote to memory of 4984	2680	9e09aa836532f20e16f2df3a66ca3f90b9ecad621081a70c8fe8efe7eaa1dff4_NeikiAnalytics.exe	88
PID 2680 wrote to memory of 4136	2680	9e09aa836532f20e16f2df3a66ca3f90b9ecad621081a70c8fe8efe7eaa1dff4_NeikiAnalytics.exe	89
PID 2680 wrote to memory of 4136	2680	9e09aa836532f20e16f2df3a66ca3f90b9ecad621081a70c8fe8efe7eaa1dff4_NeikiAnalytics.exe	89
PID 2680 wrote to memory of 2904	2680	9e09aa836532f20e16f2df3a66ca3f90b9ecad621081a70c8fe8efe7eaa1dff4_NeikiAnalytics.exe	90
PID 2680 wrote to memory of 2904	2680	9e09aa836532f20e16f2df3a66ca3f90b9ecad621081a70c8fe8efe7eaa1dff4_NeikiAnalytics.exe	90
PID 2680 wrote to memory of 3732	2680	9e09aa836532f20e16f2df3a66ca3f90b9ecad621081a70c8fe8efe7eaa1dff4_NeikiAnalytics.exe	91
PID 2680 wrote to memory of 3732	2680	9e09aa836532f20e16f2df3a66ca3f90b9ecad621081a70c8fe8efe7eaa1dff4_NeikiAnalytics.exe	91
PID 2680 wrote to memory of 1700	2680	9e09aa836532f20e16f2df3a66ca3f90b9ecad621081a70c8fe8efe7eaa1dff4_NeikiAnalytics.exe	92
PID 2680 wrote to memory of 1700	2680	9e09aa836532f20e16f2df3a66ca3f90b9ecad621081a70c8fe8efe7eaa1dff4_NeikiAnalytics.exe	92
PID 2680 wrote to memory of 4040	2680	9e09aa836532f20e16f2df3a66ca3f90b9ecad621081a70c8fe8efe7eaa1dff4_NeikiAnalytics.exe	93
PID 2680 wrote to memory of 4040	2680	9e09aa836532f20e16f2df3a66ca3f90b9ecad621081a70c8fe8efe7eaa1dff4_NeikiAnalytics.exe	93
PID 2680 wrote to memory of 2140	2680	9e09aa836532f20e16f2df3a66ca3f90b9ecad621081a70c8fe8efe7eaa1dff4_NeikiAnalytics.exe	94
PID 2680 wrote to memory of 2140	2680	9e09aa836532f20e16f2df3a66ca3f90b9ecad621081a70c8fe8efe7eaa1dff4_NeikiAnalytics.exe	94
PID 2680 wrote to memory of 4020	2680	9e09aa836532f20e16f2df3a66ca3f90b9ecad621081a70c8fe8efe7eaa1dff4_NeikiAnalytics.exe	95
PID 2680 wrote to memory of 4020	2680	9e09aa836532f20e16f2df3a66ca3f90b9ecad621081a70c8fe8efe7eaa1dff4_NeikiAnalytics.exe	95
PID 2680 wrote to memory of 1724	2680	9e09aa836532f20e16f2df3a66ca3f90b9ecad621081a70c8fe8efe7eaa1dff4_NeikiAnalytics.exe	96
PID 2680 wrote to memory of 1724	2680	9e09aa836532f20e16f2df3a66ca3f90b9ecad621081a70c8fe8efe7eaa1dff4_NeikiAnalytics.exe	96
PID 2680 wrote to memory of 1524	2680	9e09aa836532f20e16f2df3a66ca3f90b9ecad621081a70c8fe8efe7eaa1dff4_NeikiAnalytics.exe	97
PID 2680 wrote to memory of 1524	2680	9e09aa836532f20e16f2df3a66ca3f90b9ecad621081a70c8fe8efe7eaa1dff4_NeikiAnalytics.exe	97
PID 2680 wrote to memory of 3220	2680	9e09aa836532f20e16f2df3a66ca3f90b9ecad621081a70c8fe8efe7eaa1dff4_NeikiAnalytics.exe	98
PID 2680 wrote to memory of 3220	2680	9e09aa836532f20e16f2df3a66ca3f90b9ecad621081a70c8fe8efe7eaa1dff4_NeikiAnalytics.exe	98
PID 2680 wrote to memory of 4540	2680	9e09aa836532f20e16f2df3a66ca3f90b9ecad621081a70c8fe8efe7eaa1dff4_NeikiAnalytics.exe	99
PID 2680 wrote to memory of 4540	2680	9e09aa836532f20e16f2df3a66ca3f90b9ecad621081a70c8fe8efe7eaa1dff4_NeikiAnalytics.exe	99
PID 2680 wrote to memory of 4868	2680	9e09aa836532f20e16f2df3a66ca3f90b9ecad621081a70c8fe8efe7eaa1dff4_NeikiAnalytics.exe	100
PID 2680 wrote to memory of 4868	2680	9e09aa836532f20e16f2df3a66ca3f90b9ecad621081a70c8fe8efe7eaa1dff4_NeikiAnalytics.exe	100
PID 2680 wrote to memory of 1300	2680	9e09aa836532f20e16f2df3a66ca3f90b9ecad621081a70c8fe8efe7eaa1dff4_NeikiAnalytics.exe	101
PID 2680 wrote to memory of 1300	2680	9e09aa836532f20e16f2df3a66ca3f90b9ecad621081a70c8fe8efe7eaa1dff4_NeikiAnalytics.exe	101
PID 2680 wrote to memory of 4812	2680	9e09aa836532f20e16f2df3a66ca3f90b9ecad621081a70c8fe8efe7eaa1dff4_NeikiAnalytics.exe	102
PID 2680 wrote to memory of 4812	2680	9e09aa836532f20e16f2df3a66ca3f90b9ecad621081a70c8fe8efe7eaa1dff4_NeikiAnalytics.exe	102
PID 2680 wrote to memory of 1012	2680	9e09aa836532f20e16f2df3a66ca3f90b9ecad621081a70c8fe8efe7eaa1dff4_NeikiAnalytics.exe	103
PID 2680 wrote to memory of 1012	2680	9e09aa836532f20e16f2df3a66ca3f90b9ecad621081a70c8fe8efe7eaa1dff4_NeikiAnalytics.exe	103
PID 2680 wrote to memory of 4780	2680	9e09aa836532f20e16f2df3a66ca3f90b9ecad621081a70c8fe8efe7eaa1dff4_NeikiAnalytics.exe	104
PID 2680 wrote to memory of 4780	2680	9e09aa836532f20e16f2df3a66ca3f90b9ecad621081a70c8fe8efe7eaa1dff4_NeikiAnalytics.exe	104
PID 2680 wrote to memory of 384	2680	9e09aa836532f20e16f2df3a66ca3f90b9ecad621081a70c8fe8efe7eaa1dff4_NeikiAnalytics.exe	105
PID 2680 wrote to memory of 384	2680	9e09aa836532f20e16f2df3a66ca3f90b9ecad621081a70c8fe8efe7eaa1dff4_NeikiAnalytics.exe	105
PID 2680 wrote to memory of 1984	2680	9e09aa836532f20e16f2df3a66ca3f90b9ecad621081a70c8fe8efe7eaa1dff4_NeikiAnalytics.exe	106
PID 2680 wrote to memory of 1984	2680	9e09aa836532f20e16f2df3a66ca3f90b9ecad621081a70c8fe8efe7eaa1dff4_NeikiAnalytics.exe	106
PID 2680 wrote to memory of 2824	2680	9e09aa836532f20e16f2df3a66ca3f90b9ecad621081a70c8fe8efe7eaa1dff4_NeikiAnalytics.exe	107
PID 2680 wrote to memory of 2824	2680	9e09aa836532f20e16f2df3a66ca3f90b9ecad621081a70c8fe8efe7eaa1dff4_NeikiAnalytics.exe	107
PID 2680 wrote to memory of 5008	2680	9e09aa836532f20e16f2df3a66ca3f90b9ecad621081a70c8fe8efe7eaa1dff4_NeikiAnalytics.exe	108
PID 2680 wrote to memory of 5008	2680	9e09aa836532f20e16f2df3a66ca3f90b9ecad621081a70c8fe8efe7eaa1dff4_NeikiAnalytics.exe	108
PID 2680 wrote to memory of 1740	2680	9e09aa836532f20e16f2df3a66ca3f90b9ecad621081a70c8fe8efe7eaa1dff4_NeikiAnalytics.exe	109
PID 2680 wrote to memory of 1740	2680	9e09aa836532f20e16f2df3a66ca3f90b9ecad621081a70c8fe8efe7eaa1dff4_NeikiAnalytics.exe	109
PID 2680 wrote to memory of 4788	2680	9e09aa836532f20e16f2df3a66ca3f90b9ecad621081a70c8fe8efe7eaa1dff4_NeikiAnalytics.exe	110
PID 2680 wrote to memory of 4788	2680	9e09aa836532f20e16f2df3a66ca3f90b9ecad621081a70c8fe8efe7eaa1dff4_NeikiAnalytics.exe	110
PID 2680 wrote to memory of 4976	2680	9e09aa836532f20e16f2df3a66ca3f90b9ecad621081a70c8fe8efe7eaa1dff4_NeikiAnalytics.exe	111
PID 2680 wrote to memory of 4976	2680	9e09aa836532f20e16f2df3a66ca3f90b9ecad621081a70c8fe8efe7eaa1dff4_NeikiAnalytics.exe	111
PID 2680 wrote to memory of 2804	2680	9e09aa836532f20e16f2df3a66ca3f90b9ecad621081a70c8fe8efe7eaa1dff4_NeikiAnalytics.exe	112
PID 2680 wrote to memory of 2804	2680	9e09aa836532f20e16f2df3a66ca3f90b9ecad621081a70c8fe8efe7eaa1dff4_NeikiAnalytics.exe	112

C:\Users\Admin\AppData\Local\Temp\9e09aa836532f20e16f2df3a66ca3f90b9ecad621081a70c8fe8efe7eaa1dff4_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\9e09aa836532f20e16f2df3a66ca3f90b9ecad621081a70c8fe8efe7eaa1dff4_NeikiAnalytics.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2680
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2556
- C:\Windows\System\EETAfVW.exe
  C:\Windows\System\EETAfVW.exe
  2⤵
  - Executes dropped EXE
  PID:2912
- C:\Windows\System\RSAlcTm.exe
  C:\Windows\System\RSAlcTm.exe
  2⤵
  - Executes dropped EXE
  PID:2972
- C:\Windows\System\pUqnOye.exe
  C:\Windows\System\pUqnOye.exe
  2⤵
  - Executes dropped EXE
  PID:1836
- C:\Windows\System\GZqaJDZ.exe
  C:\Windows\System\GZqaJDZ.exe
  2⤵
  - Executes dropped EXE
  PID:4372
- C:\Windows\System\dyqxEyB.exe
  C:\Windows\System\dyqxEyB.exe
  2⤵
  - Executes dropped EXE
  PID:1948
- C:\Windows\System\ZXEGKWM.exe
  C:\Windows\System\ZXEGKWM.exe
  2⤵
  - Executes dropped EXE
  PID:4444
- C:\Windows\System\knamVxo.exe
  C:\Windows\System\knamVxo.exe
  2⤵
  - Executes dropped EXE
  PID:4984
- C:\Windows\System\TUyEyPP.exe
  C:\Windows\System\TUyEyPP.exe
  2⤵
  - Executes dropped EXE
  PID:4136
- C:\Windows\System\oztwRBW.exe
  C:\Windows\System\oztwRBW.exe
  2⤵
  - Executes dropped EXE
  PID:2904
- C:\Windows\System\ZYopXXz.exe
  C:\Windows\System\ZYopXXz.exe
  2⤵
  - Executes dropped EXE
  PID:3732
- C:\Windows\System\PkNmlHI.exe
  C:\Windows\System\PkNmlHI.exe
  2⤵
  - Executes dropped EXE
  PID:1700
- C:\Windows\System\iPZfgop.exe
  C:\Windows\System\iPZfgop.exe
  2⤵
  - Executes dropped EXE
  PID:4040
- C:\Windows\System\JqDaxFW.exe
  C:\Windows\System\JqDaxFW.exe
  2⤵
  - Executes dropped EXE
  PID:2140
- C:\Windows\System\IuFmRkN.exe
  C:\Windows\System\IuFmRkN.exe
  2⤵
  - Executes dropped EXE
  PID:4020
- C:\Windows\System\SkCXxyA.exe
  C:\Windows\System\SkCXxyA.exe
  2⤵
  - Executes dropped EXE
  PID:1724
- C:\Windows\System\BNoOsXm.exe
  C:\Windows\System\BNoOsXm.exe
  2⤵
  - Executes dropped EXE
  PID:1524
- C:\Windows\System\XByEBSq.exe
  C:\Windows\System\XByEBSq.exe
  2⤵
  - Executes dropped EXE
  PID:3220
- C:\Windows\System\mtqCDyt.exe
  C:\Windows\System\mtqCDyt.exe
  2⤵
  - Executes dropped EXE
  PID:4540
- C:\Windows\System\uAdCEwW.exe
  C:\Windows\System\uAdCEwW.exe
  2⤵
  - Executes dropped EXE
  PID:4868
- C:\Windows\System\hOZFppt.exe
  C:\Windows\System\hOZFppt.exe
  2⤵
  - Executes dropped EXE
  PID:1300
- C:\Windows\System\VREzGPp.exe
  C:\Windows\System\VREzGPp.exe
  2⤵
  - Executes dropped EXE
  PID:4812
- C:\Windows\System\kyFijIn.exe
  C:\Windows\System\kyFijIn.exe
  2⤵
  - Executes dropped EXE
  PID:1012
- C:\Windows\System\ohBULBS.exe
  C:\Windows\System\ohBULBS.exe
  2⤵
  - Executes dropped EXE
  PID:4780
- C:\Windows\System\NypyJNf.exe
  C:\Windows\System\NypyJNf.exe
  2⤵
  - Executes dropped EXE
  PID:384
- C:\Windows\System\UmnKXIb.exe
  C:\Windows\System\UmnKXIb.exe
  2⤵
  - Executes dropped EXE
  PID:1984
- C:\Windows\System\SIKlNcK.exe
  C:\Windows\System\SIKlNcK.exe
  2⤵
  - Executes dropped EXE
  PID:2824
- C:\Windows\System\IgJpXBj.exe
  C:\Windows\System\IgJpXBj.exe
  2⤵
  - Executes dropped EXE
  PID:5008
- C:\Windows\System\MLZZTaK.exe
  C:\Windows\System\MLZZTaK.exe
  2⤵
  - Executes dropped EXE
  PID:1740
- C:\Windows\System\DDBUdiP.exe
  C:\Windows\System\DDBUdiP.exe
  2⤵
  - Executes dropped EXE
  PID:4788
- C:\Windows\System\yOehabv.exe
  C:\Windows\System\yOehabv.exe
  2⤵
  - Executes dropped EXE
  PID:4976
- C:\Windows\System\RLCEAeG.exe
  C:\Windows\System\RLCEAeG.exe
  2⤵
  - Executes dropped EXE
  PID:2804
- C:\Windows\System\TwpwHUA.exe
  C:\Windows\System\TwpwHUA.exe
  2⤵
  - Executes dropped EXE
  PID:2328
- C:\Windows\System\oHmsjIY.exe
  C:\Windows\System\oHmsjIY.exe
  2⤵
  - Executes dropped EXE
  PID:3092
- C:\Windows\System\KdJFtcj.exe
  C:\Windows\System\KdJFtcj.exe
  2⤵
  - Executes dropped EXE
  PID:824
- C:\Windows\System\uHRqnBQ.exe
  C:\Windows\System\uHRqnBQ.exe
  2⤵
  - Executes dropped EXE
  PID:1044
- C:\Windows\System\gFKCzWm.exe
  C:\Windows\System\gFKCzWm.exe
  2⤵
  - Executes dropped EXE
  PID:116
- C:\Windows\System\PokDYfA.exe
  C:\Windows\System\PokDYfA.exe
  2⤵
  - Executes dropped EXE
  PID:3748
- C:\Windows\System\dkdODus.exe
  C:\Windows\System\dkdODus.exe
  2⤵
  - Executes dropped EXE
  PID:2916
- C:\Windows\System\XQemeEg.exe
  C:\Windows\System\XQemeEg.exe
  2⤵
  - Executes dropped EXE
  PID:2264
- C:\Windows\System\PDKXikB.exe
  C:\Windows\System\PDKXikB.exe
  2⤵
  - Executes dropped EXE
  PID:2212
- C:\Windows\System\GTsGXQJ.exe
  C:\Windows\System\GTsGXQJ.exe
  2⤵
  - Executes dropped EXE
  PID:2600
- C:\Windows\System\lGGezxE.exe
  C:\Windows\System\lGGezxE.exe
  2⤵
  - Executes dropped EXE
  PID:4896
- C:\Windows\System\rpYUvNl.exe
  C:\Windows\System\rpYUvNl.exe
  2⤵
  - Executes dropped EXE
  PID:3480
- C:\Windows\System\IOxthay.exe
  C:\Windows\System\IOxthay.exe
  2⤵
  - Executes dropped EXE
  PID:4960
- C:\Windows\System\uYqBhjw.exe
  C:\Windows\System\uYqBhjw.exe
  2⤵
  - Executes dropped EXE
  PID:1052
- C:\Windows\System\EjzwNET.exe
  C:\Windows\System\EjzwNET.exe
  2⤵
  - Executes dropped EXE
  PID:1320
- C:\Windows\System\dVzQFrb.exe
  C:\Windows\System\dVzQFrb.exe
  2⤵
  - Executes dropped EXE
  PID:1628
- C:\Windows\System\FTGpNIs.exe
  C:\Windows\System\FTGpNIs.exe
  2⤵
  - Executes dropped EXE
  PID:4176
- C:\Windows\System\aFUpbuH.exe
  C:\Windows\System\aFUpbuH.exe
  2⤵
  - Executes dropped EXE
  PID:424
- C:\Windows\System\hudBoSi.exe
  C:\Windows\System\hudBoSi.exe
  2⤵
  - Executes dropped EXE
  PID:4720
- C:\Windows\System\KaLCbTA.exe
  C:\Windows\System\KaLCbTA.exe
  2⤵
  - Executes dropped EXE
  PID:4076
- C:\Windows\System\LrQqSve.exe
  C:\Windows\System\LrQqSve.exe
  2⤵
  - Executes dropped EXE
  PID:2492
- C:\Windows\System\nIORPfJ.exe
  C:\Windows\System\nIORPfJ.exe
  2⤵
  - Executes dropped EXE
  PID:3112
- C:\Windows\System\AvgEOeO.exe
  C:\Windows\System\AvgEOeO.exe
  2⤵
  - Executes dropped EXE
  PID:2324
- C:\Windows\System\cXZNhGP.exe
  C:\Windows\System\cXZNhGP.exe
  2⤵
  - Executes dropped EXE
  PID:2024
- C:\Windows\System\nuMhFKI.exe
  C:\Windows\System\nuMhFKI.exe
  2⤵
  - Executes dropped EXE
  PID:2588
- C:\Windows\System\GedXPqF.exe
  C:\Windows\System\GedXPqF.exe
  2⤵
  - Executes dropped EXE
  PID:3724
- C:\Windows\System\grLIdjj.exe
  C:\Windows\System\grLIdjj.exe
  2⤵
  - Executes dropped EXE
  PID:1256
- C:\Windows\System\qSHlasX.exe
  C:\Windows\System\qSHlasX.exe
  2⤵
  - Executes dropped EXE
  PID:692
- C:\Windows\System\fxoXbED.exe
  C:\Windows\System\fxoXbED.exe
  2⤵
  - Executes dropped EXE
  PID:2068
- C:\Windows\System\CzqYRzY.exe
  C:\Windows\System\CzqYRzY.exe
  2⤵
  - Executes dropped EXE
  PID:3256
- C:\Windows\System\woJkTdu.exe
  C:\Windows\System\woJkTdu.exe
  2⤵
  - Executes dropped EXE
  PID:4504
- C:\Windows\System\QEitKko.exe
  C:\Windows\System\QEitKko.exe
  2⤵
  - Executes dropped EXE
  PID:4080
- C:\Windows\System\mDnmWMf.exe
  C:\Windows\System\mDnmWMf.exe
  2⤵
  - Executes dropped EXE
  PID:2924
- C:\Windows\System\cRGqwPh.exe
  C:\Windows\System\cRGqwPh.exe
  2⤵
  PID:544
- C:\Windows\System\JQUxDMA.exe
  C:\Windows\System\JQUxDMA.exe
  2⤵
  PID:1348
- C:\Windows\System\zPSFHDF.exe
  C:\Windows\System\zPSFHDF.exe
  2⤵
  PID:4808
- C:\Windows\System\HagonKm.exe
  C:\Windows\System\HagonKm.exe
  2⤵
  PID:4144
- C:\Windows\System\twzivNo.exe
  C:\Windows\System\twzivNo.exe
  2⤵
  PID:4580
- C:\Windows\System\eiHhtjW.exe
  C:\Windows\System\eiHhtjW.exe
  2⤵
  PID:3580
- C:\Windows\System\VTWPPda.exe
  C:\Windows\System\VTWPPda.exe
  2⤵
  PID:2168
- C:\Windows\System\aDfwivQ.exe
  C:\Windows\System\aDfwivQ.exe
  2⤵
  PID:4516
- C:\Windows\System\NvjbajT.exe
  C:\Windows\System\NvjbajT.exe
  2⤵
  PID:1416
- C:\Windows\System\qGbpZet.exe
  C:\Windows\System\qGbpZet.exe
  2⤵
  PID:3852
- C:\Windows\System\LmkMqBw.exe
  C:\Windows\System\LmkMqBw.exe
  2⤵
  PID:3060
- C:\Windows\System\GzmpSbN.exe
  C:\Windows\System\GzmpSbN.exe
  2⤵
  PID:3012
- C:\Windows\System\NPXeSJp.exe
  C:\Windows\System\NPXeSJp.exe
  2⤵
  PID:2936
- C:\Windows\System\pTNtzRZ.exe
  C:\Windows\System\pTNtzRZ.exe
  2⤵
  PID:4340
- C:\Windows\System\KVFdMVr.exe
  C:\Windows\System\KVFdMVr.exe
  2⤵
  PID:3812
- C:\Windows\System\XGbtlWl.exe
  C:\Windows\System\XGbtlWl.exe
  2⤵
  PID:4604
- C:\Windows\System\YlJNZtw.exe
  C:\Windows\System\YlJNZtw.exe
  2⤵
  PID:780
- C:\Windows\System\ExpbprA.exe
  C:\Windows\System\ExpbprA.exe
  2⤵
  PID:4872
- C:\Windows\System\sKSwZbj.exe
  C:\Windows\System\sKSwZbj.exe
  2⤵
  PID:3208
- C:\Windows\System\ZsQXfLP.exe
  C:\Windows\System\ZsQXfLP.exe
  2⤵
  PID:1668
- C:\Windows\System\GgMZeSw.exe
  C:\Windows\System\GgMZeSw.exe
  2⤵
  PID:448
- C:\Windows\System\KnDVJbl.exe
  C:\Windows\System\KnDVJbl.exe
  2⤵
  PID:4620
- C:\Windows\System\bFYywUs.exe
  C:\Windows\System\bFYywUs.exe
  2⤵
  PID:3000
- C:\Windows\System\OHuUgZw.exe
  C:\Windows\System\OHuUgZw.exe
  2⤵
  PID:4692
- C:\Windows\System\IjoJPEs.exe
  C:\Windows\System\IjoJPEs.exe
  2⤵
  PID:1028
- C:\Windows\System\OFxQaEt.exe
  C:\Windows\System\OFxQaEt.exe
  2⤵
  PID:4772
- C:\Windows\System\GRJKkIL.exe
  C:\Windows\System\GRJKkIL.exe
  2⤵
  PID:4480
- C:\Windows\System\nuKslsH.exe
  C:\Windows\System\nuKslsH.exe
  2⤵
  PID:4448
- C:\Windows\System\lFQiZKy.exe
  C:\Windows\System\lFQiZKy.exe
  2⤵
  PID:1464
- C:\Windows\System\NPmlzCr.exe
  C:\Windows\System\NPmlzCr.exe
  2⤵
  PID:3116
- C:\Windows\System\PHMsGjA.exe
  C:\Windows\System\PHMsGjA.exe
  2⤵
  PID:5132
- C:\Windows\System\qZSQOHH.exe
  C:\Windows\System\qZSQOHH.exe
  2⤵
  PID:5148
- C:\Windows\System\xIJqfSg.exe
  C:\Windows\System\xIJqfSg.exe
  2⤵
  PID:5168
- C:\Windows\System\dwuGIfo.exe
  C:\Windows\System\dwuGIfo.exe
  2⤵
  PID:5184
- C:\Windows\System\aSRBcog.exe
  C:\Windows\System\aSRBcog.exe
  2⤵
  PID:5220
- C:\Windows\System\jmkkHWA.exe
  C:\Windows\System\jmkkHWA.exe
  2⤵
  PID:5400
- C:\Windows\System\PckoAGj.exe
  C:\Windows\System\PckoAGj.exe
  2⤵
  PID:5416
- C:\Windows\System\rCzKpMz.exe
  C:\Windows\System\rCzKpMz.exe
  2⤵
  PID:5436
- C:\Windows\System\qCPiAbl.exe
  C:\Windows\System\qCPiAbl.exe
  2⤵
  PID:5452
- C:\Windows\System\UKAtRGU.exe
  C:\Windows\System\UKAtRGU.exe
  2⤵
  PID:5468
- C:\Windows\System\aGQcEoh.exe
  C:\Windows\System\aGQcEoh.exe
  2⤵
  PID:5492
- C:\Windows\System\RTTRWQl.exe
  C:\Windows\System\RTTRWQl.exe
  2⤵
  PID:5516
- C:\Windows\System\rrOptUk.exe
  C:\Windows\System\rrOptUk.exe
  2⤵
  PID:5540
- C:\Windows\System\DUJiAPK.exe
  C:\Windows\System\DUJiAPK.exe
  2⤵
  PID:5560
- C:\Windows\System\oyuHZFA.exe
  C:\Windows\System\oyuHZFA.exe
  2⤵
  PID:5588
- C:\Windows\System\AStucja.exe
  C:\Windows\System\AStucja.exe
  2⤵
  PID:5604
- C:\Windows\System\OqXlzqv.exe
  C:\Windows\System\OqXlzqv.exe
  2⤵
  PID:5628
- C:\Windows\System\HvsfAAf.exe
  C:\Windows\System\HvsfAAf.exe
  2⤵
  PID:5648
- C:\Windows\System\xKWSFye.exe
  C:\Windows\System\xKWSFye.exe
  2⤵
  PID:5664
- C:\Windows\System\GCyoCRv.exe
  C:\Windows\System\GCyoCRv.exe
  2⤵
  PID:5688
- C:\Windows\System\qgBJgob.exe
  C:\Windows\System\qgBJgob.exe
  2⤵
  PID:5704
- C:\Windows\System\JlDtCOJ.exe
  C:\Windows\System\JlDtCOJ.exe
  2⤵
  PID:5732
- C:\Windows\System\EpQzthL.exe
  C:\Windows\System\EpQzthL.exe
  2⤵
  PID:5756
- C:\Windows\System\HgBXOWB.exe
  C:\Windows\System\HgBXOWB.exe
  2⤵
  PID:5776
- C:\Windows\System\btKKKrl.exe
  C:\Windows\System\btKKKrl.exe
  2⤵
  PID:5792
- C:\Windows\System\LUFADkL.exe
  C:\Windows\System\LUFADkL.exe
  2⤵
  PID:5812
- C:\Windows\System\KUItTVR.exe
  C:\Windows\System\KUItTVR.exe
  2⤵
  PID:5832
- C:\Windows\System\EKUzXfV.exe
  C:\Windows\System\EKUzXfV.exe
  2⤵
  PID:5852
- C:\Windows\System\RGqFgcb.exe
  C:\Windows\System\RGqFgcb.exe
  2⤵
  PID:5876
- C:\Windows\System\VrTYhJD.exe
  C:\Windows\System\VrTYhJD.exe
  2⤵
  PID:5892
- C:\Windows\System\HqKkotA.exe
  C:\Windows\System\HqKkotA.exe
  2⤵
  PID:5916
- C:\Windows\System\rHXjELx.exe
  C:\Windows\System\rHXjELx.exe
  2⤵
  PID:5932
- C:\Windows\System\vQFCSJG.exe
  C:\Windows\System\vQFCSJG.exe
  2⤵
  PID:5948
- C:\Windows\System\WrrNGzR.exe
  C:\Windows\System\WrrNGzR.exe
  2⤵
  PID:5984
- C:\Windows\System\HWmxquR.exe
  C:\Windows\System\HWmxquR.exe
  2⤵
  PID:6016
- C:\Windows\System\ecqzyJj.exe
  C:\Windows\System\ecqzyJj.exe
  2⤵
  PID:6040
- C:\Windows\System\mvLKXkH.exe
  C:\Windows\System\mvLKXkH.exe
  2⤵
  PID:6056
- C:\Windows\System\XISKZDg.exe
  C:\Windows\System\XISKZDg.exe
  2⤵
  PID:6072
- C:\Windows\System\BUiWxlr.exe
  C:\Windows\System\BUiWxlr.exe
  2⤵
  PID:6096
- C:\Windows\System\lAFdZOm.exe
  C:\Windows\System\lAFdZOm.exe
  2⤵
  PID:6124
- C:\Windows\System\bPRaFge.exe
  C:\Windows\System\bPRaFge.exe
  2⤵
  PID:6140
- C:\Windows\System\RUiYsjR.exe
  C:\Windows\System\RUiYsjR.exe
  2⤵
  PID:1284
- C:\Windows\System\VzgIkHG.exe
  C:\Windows\System\VzgIkHG.exe
  2⤵
  PID:4332
- C:\Windows\System\nSLgxtW.exe
  C:\Windows\System\nSLgxtW.exe
  2⤵
  PID:3688
- C:\Windows\System\bzVNlEq.exe
  C:\Windows\System\bzVNlEq.exe
  2⤵
  PID:3032
- C:\Windows\System\MzswqgU.exe
  C:\Windows\System\MzswqgU.exe
  2⤵
  PID:4888
- C:\Windows\System\BqgVqBT.exe
  C:\Windows\System\BqgVqBT.exe
  2⤵
  PID:4748
- C:\Windows\System\FcEGOkK.exe
  C:\Windows\System\FcEGOkK.exe
  2⤵
  PID:2224
- C:\Windows\System\tOhbYOH.exe
  C:\Windows\System\tOhbYOH.exe
  2⤵
  PID:4472
- C:\Windows\System\ilwztOE.exe
  C:\Windows\System\ilwztOE.exe
  2⤵
  PID:524
- C:\Windows\System\kObDMSM.exe
  C:\Windows\System\kObDMSM.exe
  2⤵
  PID:4316
- C:\Windows\System\YaqUCsO.exe
  C:\Windows\System\YaqUCsO.exe
  2⤵
  PID:2612
- C:\Windows\System\fSFlmHb.exe
  C:\Windows\System\fSFlmHb.exe
  2⤵
  PID:752
- C:\Windows\System\YmyzJkn.exe
  C:\Windows\System\YmyzJkn.exe
  2⤵
  PID:4356
- C:\Windows\System\LUFKhFd.exe
  C:\Windows\System\LUFKhFd.exe
  2⤵
  PID:4776
- C:\Windows\System\TFQVLgY.exe
  C:\Windows\System\TFQVLgY.exe
  2⤵
  PID:2400
- C:\Windows\System\IYTdBps.exe
  C:\Windows\System\IYTdBps.exe
  2⤵
  PID:4728
- C:\Windows\System\AdICpid.exe
  C:\Windows\System\AdICpid.exe
  2⤵
  PID:760
- C:\Windows\System\HTiuIGT.exe
  C:\Windows\System\HTiuIGT.exe
  2⤵
  PID:1844
- C:\Windows\System\KUlBGrb.exe
  C:\Windows\System\KUlBGrb.exe
  2⤵
  PID:2428
- C:\Windows\System\ekaCecX.exe
  C:\Windows\System\ekaCecX.exe
  2⤵
  PID:2656
- C:\Windows\System\kDMTIze.exe
  C:\Windows\System\kDMTIze.exe
  2⤵
  PID:4496
- C:\Windows\System\EBFsAuE.exe
  C:\Windows\System\EBFsAuE.exe
  2⤵
  PID:5408
- C:\Windows\System\UjBKifV.exe
  C:\Windows\System\UjBKifV.exe
  2⤵
  PID:5112
- C:\Windows\System\bjLmYtD.exe
  C:\Windows\System\bjLmYtD.exe
  2⤵
  PID:2360
- C:\Windows\System\OdhSIxA.exe
  C:\Windows\System\OdhSIxA.exe
  2⤵
  PID:2268
- C:\Windows\System\BhwKDLl.exe
  C:\Windows\System\BhwKDLl.exe
  2⤵
  PID:6464
- C:\Windows\System\tpVeNik.exe
  C:\Windows\System\tpVeNik.exe
  2⤵
  PID:6480
- C:\Windows\System\PcbMTXB.exe
  C:\Windows\System\PcbMTXB.exe
  2⤵
  PID:6496
- C:\Windows\System\fHOPwAn.exe
  C:\Windows\System\fHOPwAn.exe
  2⤵
  PID:6512
- C:\Windows\System\HHJsDWC.exe
  C:\Windows\System\HHJsDWC.exe
  2⤵
  PID:6528
- C:\Windows\System\vsxvrtQ.exe
  C:\Windows\System\vsxvrtQ.exe
  2⤵
  PID:6544
- C:\Windows\System\gkMniog.exe
  C:\Windows\System\gkMniog.exe
  2⤵
  PID:6560
- C:\Windows\System\SIvivtu.exe
  C:\Windows\System\SIvivtu.exe
  2⤵
  PID:6576
- C:\Windows\System\KQHfqDz.exe
  C:\Windows\System\KQHfqDz.exe
  2⤵
  PID:6592
- C:\Windows\System\nTeMXWO.exe
  C:\Windows\System\nTeMXWO.exe
  2⤵
  PID:6608
- C:\Windows\System\HCueKWX.exe
  C:\Windows\System\HCueKWX.exe
  2⤵
  PID:6624
- C:\Windows\System\ZCgIQPH.exe
  C:\Windows\System\ZCgIQPH.exe
  2⤵
  PID:6640
- C:\Windows\System\fmdgZPs.exe
  C:\Windows\System\fmdgZPs.exe
  2⤵
  PID:6656
- C:\Windows\System\HJmdjpu.exe
  C:\Windows\System\HJmdjpu.exe
  2⤵
  PID:6672
- C:\Windows\System\iHSwZEo.exe
  C:\Windows\System\iHSwZEo.exe
  2⤵
  PID:6688
- C:\Windows\System\qNnxNDp.exe
  C:\Windows\System\qNnxNDp.exe
  2⤵
  PID:6708
- C:\Windows\System\OyoBnYu.exe
  C:\Windows\System\OyoBnYu.exe
  2⤵
  PID:6724
- C:\Windows\System\ARHiiQb.exe
  C:\Windows\System\ARHiiQb.exe
  2⤵
  PID:6740
- C:\Windows\System\XZVvbGt.exe
  C:\Windows\System\XZVvbGt.exe
  2⤵
  PID:6760
- C:\Windows\System\CruFPYW.exe
  C:\Windows\System\CruFPYW.exe
  2⤵
  PID:6776
- C:\Windows\System\BhELxkA.exe
  C:\Windows\System\BhELxkA.exe
  2⤵
  PID:6792
- C:\Windows\System\NJibbYd.exe
  C:\Windows\System\NJibbYd.exe
  2⤵
  PID:6812
- C:\Windows\System\LLLzLvo.exe
  C:\Windows\System\LLLzLvo.exe
  2⤵
  PID:6832
- C:\Windows\System\PXsPouV.exe
  C:\Windows\System\PXsPouV.exe
  2⤵
  PID:6848
- C:\Windows\System\IzEUsXX.exe
  C:\Windows\System\IzEUsXX.exe
  2⤵
  PID:6864
- C:\Windows\System\QcMIFSu.exe
  C:\Windows\System\QcMIFSu.exe
  2⤵
  PID:6892
- C:\Windows\System\ksykQkz.exe
  C:\Windows\System\ksykQkz.exe
  2⤵
  PID:6908
- C:\Windows\System\VFvukLl.exe
  C:\Windows\System\VFvukLl.exe
  2⤵
  PID:6924
- C:\Windows\System\wvsOCbU.exe
  C:\Windows\System\wvsOCbU.exe
  2⤵
  PID:6948
- C:\Windows\System\YNYzzfq.exe
  C:\Windows\System\YNYzzfq.exe
  2⤵
  PID:6968
- C:\Windows\System\IEfofBf.exe
  C:\Windows\System\IEfofBf.exe
  2⤵
  PID:6992
- C:\Windows\System\ueRbVKC.exe
  C:\Windows\System\ueRbVKC.exe
  2⤵
  PID:7048
- C:\Windows\System\wrkRYkz.exe
  C:\Windows\System\wrkRYkz.exe
  2⤵
  PID:7080
- C:\Windows\System\MuVxuSN.exe
  C:\Windows\System\MuVxuSN.exe
  2⤵
  PID:7096
- C:\Windows\System\RaCilGp.exe
  C:\Windows\System\RaCilGp.exe
  2⤵
  PID:7112
- C:\Windows\System\RFvWcqt.exe
  C:\Windows\System\RFvWcqt.exe
  2⤵
  PID:7144
- C:\Windows\System\eOSmVpa.exe
  C:\Windows\System\eOSmVpa.exe
  2⤵
  PID:7160
- C:\Windows\System\yPPfmfo.exe
  C:\Windows\System\yPPfmfo.exe
  2⤵
  PID:6088
- C:\Windows\System\BeAuEEv.exe
  C:\Windows\System\BeAuEEv.exe
  2⤵
  PID:3312
- C:\Windows\System\KfyLBwp.exe
  C:\Windows\System\KfyLBwp.exe
  2⤵
  PID:3308
- C:\Windows\System\kEJhidK.exe
  C:\Windows\System\kEJhidK.exe
  2⤵
  PID:4988
- C:\Windows\System\JJVKMYS.exe
  C:\Windows\System\JJVKMYS.exe
  2⤵
  PID:2848
- C:\Windows\System\TdwCLzp.exe
  C:\Windows\System\TdwCLzp.exe
  2⤵
  PID:5128
- C:\Windows\System\uXppiPo.exe
  C:\Windows\System\uXppiPo.exe
  2⤵
  PID:1988
- C:\Windows\System\ubcYhVY.exe
  C:\Windows\System\ubcYhVY.exe
  2⤵
  PID:3136
- C:\Windows\System\zoPUKQK.exe
  C:\Windows\System\zoPUKQK.exe
  2⤵
  PID:5212
- C:\Windows\System\iTYSdBR.exe
  C:\Windows\System\iTYSdBR.exe
  2⤵
  PID:5292
- C:\Windows\System\peWUYRP.exe
  C:\Windows\System\peWUYRP.exe
  2⤵
  PID:5308
- C:\Windows\System\PadvJdd.exe
  C:\Windows\System\PadvJdd.exe
  2⤵
  PID:6208
- C:\Windows\System\QyNfdxs.exe
  C:\Windows\System\QyNfdxs.exe
  2⤵
  PID:1096
- C:\Windows\System\fYlkJyD.exe
  C:\Windows\System\fYlkJyD.exe
  2⤵
  PID:732
- C:\Windows\System\egBcUeN.exe
  C:\Windows\System\egBcUeN.exe
  2⤵
  PID:7184
- C:\Windows\System\hHfajwH.exe
  C:\Windows\System\hHfajwH.exe
  2⤵
  PID:7208
- C:\Windows\System\yidWCGm.exe
  C:\Windows\System\yidWCGm.exe
  2⤵
  PID:7224
- C:\Windows\System\wcSlXIO.exe
  C:\Windows\System\wcSlXIO.exe
  2⤵
  PID:7240
- C:\Windows\System\CWraAad.exe
  C:\Windows\System\CWraAad.exe
  2⤵
  PID:7264
- C:\Windows\System\kkafZzE.exe
  C:\Windows\System\kkafZzE.exe
  2⤵
  PID:7284
- C:\Windows\System\PJwekbM.exe
  C:\Windows\System\PJwekbM.exe
  2⤵
  PID:7304
- C:\Windows\System\FBmRgTS.exe
  C:\Windows\System\FBmRgTS.exe
  2⤵
  PID:7352
- C:\Windows\System\krokjVD.exe
  C:\Windows\System\krokjVD.exe
  2⤵
  PID:7372
- C:\Windows\System\jEkAxyd.exe
  C:\Windows\System\jEkAxyd.exe
  2⤵
  PID:7500
- C:\Windows\System\NwQcQrp.exe
  C:\Windows\System\NwQcQrp.exe
  2⤵
  PID:7516
- C:\Windows\System\KHRcLpZ.exe
  C:\Windows\System\KHRcLpZ.exe
  2⤵
  PID:7536
- C:\Windows\System\zmSoMsa.exe
  C:\Windows\System\zmSoMsa.exe
  2⤵
  PID:7552
- C:\Windows\System\HrfnXlo.exe
  C:\Windows\System\HrfnXlo.exe
  2⤵
  PID:7572
- C:\Windows\System\RYNlNpo.exe
  C:\Windows\System\RYNlNpo.exe
  2⤵
  PID:7588
- C:\Windows\System\VonJlDd.exe
  C:\Windows\System\VonJlDd.exe
  2⤵
  PID:7604
- C:\Windows\System\ThPXZUU.exe
  C:\Windows\System\ThPXZUU.exe
  2⤵
  PID:7620
- C:\Windows\System\YhMHUmg.exe
  C:\Windows\System\YhMHUmg.exe
  2⤵
  PID:7640
- C:\Windows\System\STfpeTK.exe
  C:\Windows\System\STfpeTK.exe
  2⤵
  PID:7656
- C:\Windows\System\RKNqVgc.exe
  C:\Windows\System\RKNqVgc.exe
  2⤵
  PID:7676
- C:\Windows\System\IlArnTQ.exe
  C:\Windows\System\IlArnTQ.exe
  2⤵
  PID:7692
- C:\Windows\System\MbqLYpC.exe
  C:\Windows\System\MbqLYpC.exe
  2⤵
  PID:7708
- C:\Windows\System\BZLyYZP.exe
  C:\Windows\System\BZLyYZP.exe
  2⤵
  PID:7732
- C:\Windows\System\IcgdZdN.exe
  C:\Windows\System\IcgdZdN.exe
  2⤵
  PID:7756
- C:\Windows\System\morDASL.exe
  C:\Windows\System\morDASL.exe
  2⤵
  PID:7788
- C:\Windows\System\XQxUjew.exe
  C:\Windows\System\XQxUjew.exe
  2⤵
  PID:7812
- C:\Windows\System\xnLyPlQ.exe
  C:\Windows\System\xnLyPlQ.exe
  2⤵
  PID:7832
- C:\Windows\System\oUVcEYO.exe
  C:\Windows\System\oUVcEYO.exe
  2⤵
  PID:7852
- C:\Windows\System\KxoxtjI.exe
  C:\Windows\System\KxoxtjI.exe
  2⤵
  PID:7876
- C:\Windows\System\uWdZicY.exe
  C:\Windows\System\uWdZicY.exe
  2⤵
  PID:7904
- C:\Windows\System\udLfJXW.exe
  C:\Windows\System\udLfJXW.exe
  2⤵
  PID:7928
- C:\Windows\System\tVSNmbr.exe
  C:\Windows\System\tVSNmbr.exe
  2⤵
  PID:7948
- C:\Windows\System\tCgTEUk.exe
  C:\Windows\System\tCgTEUk.exe
  2⤵
  PID:7964
- C:\Windows\System\zyazgTZ.exe
  C:\Windows\System\zyazgTZ.exe
  2⤵
  PID:7980
- C:\Windows\System\enDMQob.exe
  C:\Windows\System\enDMQob.exe
  2⤵
  PID:7996
- C:\Windows\System\PZompBw.exe
  C:\Windows\System\PZompBw.exe
  2⤵
  PID:8012
- C:\Windows\System\HRxeHtP.exe
  C:\Windows\System\HRxeHtP.exe
  2⤵
  PID:8028
- C:\Windows\System\UBWgmLS.exe
  C:\Windows\System\UBWgmLS.exe
  2⤵
  PID:8048
- C:\Windows\System\VddJMGg.exe
  C:\Windows\System\VddJMGg.exe
  2⤵
  PID:8064
- C:\Windows\System\pEQPXba.exe
  C:\Windows\System\pEQPXba.exe
  2⤵
  PID:8080
- C:\Windows\System\UHNxQYA.exe
  C:\Windows\System\UHNxQYA.exe
  2⤵
  PID:8100
- C:\Windows\System\ZXIoDub.exe
  C:\Windows\System\ZXIoDub.exe
  2⤵
  PID:8116
- C:\Windows\System\hgBPuyh.exe
  C:\Windows\System\hgBPuyh.exe
  2⤵
  PID:8136
- C:\Windows\System\kYVDgqN.exe
  C:\Windows\System\kYVDgqN.exe
  2⤵
  PID:8152
- C:\Windows\System\HechfYj.exe
  C:\Windows\System\HechfYj.exe
  2⤵
  PID:8168
- C:\Windows\System\XcHuXLX.exe
  C:\Windows\System\XcHuXLX.exe
  2⤵
  PID:8188
- C:\Windows\System\DqWtuLK.exe
  C:\Windows\System\DqWtuLK.exe
  2⤵
  PID:4712
- C:\Windows\System\xmmhabn.exe
  C:\Windows\System\xmmhabn.exe
  2⤵
  PID:5444
- C:\Windows\System\NPkuDLK.exe
  C:\Windows\System\NPkuDLK.exe
  2⤵
  PID:5484
- C:\Windows\System\fKYYwxs.exe
  C:\Windows\System\fKYYwxs.exe
  2⤵
  PID:5552
- C:\Windows\System\LZlWvPb.exe
  C:\Windows\System\LZlWvPb.exe
  2⤵
  PID:5660
- C:\Windows\System\duKfDju.exe
  C:\Windows\System\duKfDju.exe
  2⤵
  PID:5700
- C:\Windows\System\exAFtwh.exe
  C:\Windows\System\exAFtwh.exe
  2⤵
  PID:5728
- C:\Windows\System\ZhqcRRE.exe
  C:\Windows\System\ZhqcRRE.exe
  2⤵
  PID:5768
- C:\Windows\System\DCszWzH.exe
  C:\Windows\System\DCszWzH.exe
  2⤵
  PID:5804
- C:\Windows\System\dGttLCj.exe
  C:\Windows\System\dGttLCj.exe
  2⤵
  PID:5824
- C:\Windows\System\ZPSOvcW.exe
  C:\Windows\System\ZPSOvcW.exe
  2⤵
  PID:5864
- C:\Windows\System\YutOyZW.exe
  C:\Windows\System\YutOyZW.exe
  2⤵
  PID:5908
- C:\Windows\System\ItmfifC.exe
  C:\Windows\System\ItmfifC.exe
  2⤵
  PID:5944
- C:\Windows\System\ZZWrqKQ.exe
  C:\Windows\System\ZZWrqKQ.exe
  2⤵
  PID:5992
- C:\Windows\System\lZyYJdd.exe
  C:\Windows\System\lZyYJdd.exe
  2⤵
  PID:6024
- C:\Windows\System\keKzOCY.exe
  C:\Windows\System\keKzOCY.exe
  2⤵
  PID:6068
- C:\Windows\System\cHVxHGq.exe
  C:\Windows\System\cHVxHGq.exe
  2⤵
  PID:6716
- C:\Windows\System\fUXXiWz.exe
  C:\Windows\System\fUXXiWz.exe
  2⤵
  PID:6788
- C:\Windows\System\WHCWwLA.exe
  C:\Windows\System\WHCWwLA.exe
  2⤵
  PID:6876
- C:\Windows\System\wzIuwLg.exe
  C:\Windows\System\wzIuwLg.exe
  2⤵
  PID:2116
- C:\Windows\System\kEJItjk.exe
  C:\Windows\System\kEJItjk.exe
  2⤵
  PID:6276
- C:\Windows\System\rkQeCFd.exe
  C:\Windows\System\rkQeCFd.exe
  2⤵
  PID:6296
- C:\Windows\System\VtRKzzR.exe
  C:\Windows\System\VtRKzzR.exe
  2⤵
  PID:5024
- C:\Windows\System\UUnWbei.exe
  C:\Windows\System\UUnWbei.exe
  2⤵
  PID:3528
- C:\Windows\System\MEjLBIt.exe
  C:\Windows\System\MEjLBIt.exe
  2⤵
  PID:3160
- C:\Windows\System\KpqPoTR.exe
  C:\Windows\System\KpqPoTR.exe
  2⤵
  PID:4844
- C:\Windows\System\qfRWzNZ.exe
  C:\Windows\System\qfRWzNZ.exe
  2⤵
  PID:8204
- C:\Windows\System\fZkPZDb.exe
  C:\Windows\System\fZkPZDb.exe
  2⤵
  PID:8224
- C:\Windows\System\kZHsokO.exe
  C:\Windows\System\kZHsokO.exe
  2⤵
  PID:8240
- C:\Windows\System\LDqgCgT.exe
  C:\Windows\System\LDqgCgT.exe
  2⤵
  PID:8256
- C:\Windows\System\UiERrjv.exe
  C:\Windows\System\UiERrjv.exe
  2⤵
  PID:8272
- C:\Windows\System\EslEgaQ.exe
  C:\Windows\System\EslEgaQ.exe
  2⤵
  PID:8288
- C:\Windows\System\KVKbwBf.exe
  C:\Windows\System\KVKbwBf.exe
  2⤵
  PID:8308
- C:\Windows\System\HBweJSI.exe
  C:\Windows\System\HBweJSI.exe
  2⤵
  PID:8328
- C:\Windows\System\peEgXLb.exe
  C:\Windows\System\peEgXLb.exe
  2⤵
  PID:8344
- C:\Windows\System\iYlFQfm.exe
  C:\Windows\System\iYlFQfm.exe
  2⤵
  PID:8364
- C:\Windows\System\oSFJeTv.exe
  C:\Windows\System\oSFJeTv.exe
  2⤵
  PID:8676
- C:\Windows\System\JUlttRe.exe
  C:\Windows\System\JUlttRe.exe
  2⤵
  PID:8692
- C:\Windows\System\LbzuSyu.exe
  C:\Windows\System\LbzuSyu.exe
  2⤵
  PID:8708
- C:\Windows\System\sdQsLga.exe
  C:\Windows\System\sdQsLga.exe
  2⤵
  PID:8724
- C:\Windows\System\fEJPKNf.exe
  C:\Windows\System\fEJPKNf.exe
  2⤵
  PID:8740
- C:\Windows\System\WALsbor.exe
  C:\Windows\System\WALsbor.exe
  2⤵
  PID:8756
- C:\Windows\System\NDdvZuH.exe
  C:\Windows\System\NDdvZuH.exe
  2⤵
  PID:8772
- C:\Windows\System\XZzYcUr.exe
  C:\Windows\System\XZzYcUr.exe
  2⤵
  PID:8788
- C:\Windows\System\ZCgEnHU.exe
  C:\Windows\System\ZCgEnHU.exe
  2⤵
  PID:8804
- C:\Windows\System\tNYBfSO.exe
  C:\Windows\System\tNYBfSO.exe
  2⤵
  PID:8820
- C:\Windows\System\nnrVMTG.exe
  C:\Windows\System\nnrVMTG.exe
  2⤵
  PID:8836
- C:\Windows\System\ZSTipPc.exe
  C:\Windows\System\ZSTipPc.exe
  2⤵
  PID:8852
- C:\Windows\System\VocjWjK.exe
  C:\Windows\System\VocjWjK.exe
  2⤵
  PID:8868
- C:\Windows\System\UaoNzhk.exe
  C:\Windows\System\UaoNzhk.exe
  2⤵
  PID:8884
- C:\Windows\System\iMZxOdM.exe
  C:\Windows\System\iMZxOdM.exe
  2⤵
  PID:8900
- C:\Windows\System\OOFGirm.exe
  C:\Windows\System\OOFGirm.exe
  2⤵
  PID:8916
- C:\Windows\System\NdfXmyu.exe
  C:\Windows\System\NdfXmyu.exe
  2⤵
  PID:8936
- C:\Windows\System\FDsicVy.exe
  C:\Windows\System\FDsicVy.exe
  2⤵
  PID:8952
- C:\Windows\System\YFHboDN.exe
  C:\Windows\System\YFHboDN.exe
  2⤵
  PID:8972
- C:\Windows\System\wURSIoc.exe
  C:\Windows\System\wURSIoc.exe
  2⤵
  PID:8988
- C:\Windows\System\rvzkLDp.exe
  C:\Windows\System\rvzkLDp.exe
  2⤵
  PID:9004
- C:\Windows\System\pTgdQvc.exe
  C:\Windows\System\pTgdQvc.exe
  2⤵
  PID:9024
- C:\Windows\System\emgisDh.exe
  C:\Windows\System\emgisDh.exe
  2⤵
  PID:9040
- C:\Windows\System\YdNxXsj.exe
  C:\Windows\System\YdNxXsj.exe
  2⤵
  PID:9060
- C:\Windows\System\bDmNSCV.exe
  C:\Windows\System\bDmNSCV.exe
  2⤵
  PID:9076
- C:\Windows\System\fYmTRGA.exe
  C:\Windows\System\fYmTRGA.exe
  2⤵
  PID:9092
- C:\Windows\System\VhNtbDo.exe
  C:\Windows\System\VhNtbDo.exe
  2⤵
  PID:9112
- C:\Windows\System\OmZFXZM.exe
  C:\Windows\System\OmZFXZM.exe
  2⤵
  PID:9128
- C:\Windows\System\Wpthgtn.exe
  C:\Windows\System\Wpthgtn.exe
  2⤵
  PID:9148
- C:\Windows\System\WRosShM.exe
  C:\Windows\System\WRosShM.exe
  2⤵
  PID:9164
- C:\Windows\System\tMFMzXO.exe
  C:\Windows\System\tMFMzXO.exe
  2⤵
  PID:9196
- C:\Windows\System\lxIqRiy.exe
  C:\Windows\System\lxIqRiy.exe
  2⤵
  PID:6116
- C:\Windows\System\RsSKdIY.exe
  C:\Windows\System\RsSKdIY.exe
  2⤵
  PID:7200
- C:\Windows\System\wndpPPf.exe
  C:\Windows\System\wndpPPf.exe
  2⤵
  PID:4116
- C:\Windows\System\gYjavJU.exe
  C:\Windows\System\gYjavJU.exe
  2⤵
  PID:6768
- C:\Windows\System\JRmjwIE.exe
  C:\Windows\System\JRmjwIE.exe
  2⤵
  PID:2196
- C:\Windows\System\yAxUWCX.exe
  C:\Windows\System\yAxUWCX.exe
  2⤵
  PID:3772
- C:\Windows\System\bNXfDNU.exe
  C:\Windows\System\bNXfDNU.exe
  2⤵
  PID:3692
- C:\Windows\System\sbGlsPm.exe
  C:\Windows\System\sbGlsPm.exe
  2⤵
  PID:2004
- C:\Windows\System\egfHmuP.exe
  C:\Windows\System\egfHmuP.exe
  2⤵
  PID:6312
- C:\Windows\System\UyozbsN.exe
  C:\Windows\System\UyozbsN.exe
  2⤵
  PID:6380
- C:\Windows\System\cuNAQtB.exe
  C:\Windows\System\cuNAQtB.exe
  2⤵
  PID:2956
- C:\Windows\System\SafTFde.exe
  C:\Windows\System\SafTFde.exe
  2⤵
  PID:6220
- C:\Windows\System\svfVAOV.exe
  C:\Windows\System\svfVAOV.exe
  2⤵
  PID:8580
- C:\Windows\System\pbbDkEP.exe
  C:\Windows\System\pbbDkEP.exe
  2⤵
  PID:6268
- C:\Windows\System\DuueXJW.exe
  C:\Windows\System\DuueXJW.exe
  2⤵
  PID:5744
- C:\Windows\System\pSwRMap.exe
  C:\Windows\System\pSwRMap.exe
  2⤵
  PID:8128
- C:\Windows\System\XOycTKJ.exe
  C:\Windows\System\XOycTKJ.exe
  2⤵
  PID:7776
- C:\Windows\System\RqlHhuR.exe
  C:\Windows\System\RqlHhuR.exe
  2⤵
  PID:7176
- C:\Windows\System\xIeZlIi.exe
  C:\Windows\System\xIeZlIi.exe
  2⤵
  PID:5196
- C:\Windows\System\RufNobA.exe
  C:\Windows\System\RufNobA.exe
  2⤵
  PID:740
- C:\Windows\System\bhXSifC.exe
  C:\Windows\System\bhXSifC.exe
  2⤵
  PID:4024
- C:\Windows\System\eBVKlIS.exe
  C:\Windows\System\eBVKlIS.exe
  2⤵
  PID:7152
- C:\Windows\System\PCBcDbE.exe
  C:\Windows\System\PCBcDbE.exe
  2⤵
  PID:7108
- C:\Windows\System\zLdBzjt.exe
  C:\Windows\System\zLdBzjt.exe
  2⤵
  PID:7004
- C:\Windows\System\AACqMTP.exe
  C:\Windows\System\AACqMTP.exe
  2⤵
  PID:6960
- C:\Windows\System\qmBgUgd.exe
  C:\Windows\System\qmBgUgd.exe
  2⤵
  PID:6932
- C:\Windows\System\zcwdqVY.exe
  C:\Windows\System\zcwdqVY.exe
  2⤵
  PID:6856
- C:\Windows\System\SYgdAOs.exe
  C:\Windows\System\SYgdAOs.exe
  2⤵
  PID:6808
- C:\Windows\System\oabHeVe.exe
  C:\Windows\System\oabHeVe.exe
  2⤵
  PID:6736
- C:\Windows\System\TUSQtAC.exe
  C:\Windows\System\TUSQtAC.exe
  2⤵
  PID:6680
- C:\Windows\System\KZXaEOg.exe
  C:\Windows\System\KZXaEOg.exe
  2⤵
  PID:6636
- C:\Windows\System\lAYOdjP.exe
  C:\Windows\System\lAYOdjP.exe
  2⤵
  PID:6600
- C:\Windows\System\NdoPTLb.exe
  C:\Windows\System\NdoPTLb.exe
  2⤵
  PID:6568
- C:\Windows\System\UgyReOQ.exe
  C:\Windows\System\UgyReOQ.exe
  2⤵
  PID:6536
- C:\Windows\System\PyJiFpx.exe
  C:\Windows\System\PyJiFpx.exe
  2⤵
  PID:6492
- C:\Windows\System\HnrdkhA.exe
  C:\Windows\System\HnrdkhA.exe
  2⤵
  PID:4640
- C:\Windows\System\oknyTBB.exe
  C:\Windows\System\oknyTBB.exe
  2⤵
  PID:7272
- C:\Windows\System\WiJrEgO.exe
  C:\Windows\System\WiJrEgO.exe
  2⤵
  PID:7340
- C:\Windows\System\IekCfbA.exe
  C:\Windows\System\IekCfbA.exe
  2⤵
  PID:7600
- C:\Windows\System\yFHMXAp.exe
  C:\Windows\System\yFHMXAp.exe
  2⤵
  PID:7728
- C:\Windows\System\PXeeDLh.exe
  C:\Windows\System\PXeeDLh.exe
  2⤵
  PID:7848
- C:\Windows\System\wdsaMXV.exe
  C:\Windows\System\wdsaMXV.exe
  2⤵
  PID:9224
- C:\Windows\System\NTCvLao.exe
  C:\Windows\System\NTCvLao.exe
  2⤵
  PID:9244
- C:\Windows\System\sXXANHP.exe
  C:\Windows\System\sXXANHP.exe
  2⤵
  PID:9264
- C:\Windows\System\SPDwNby.exe
  C:\Windows\System\SPDwNby.exe
  2⤵
  PID:9280
- C:\Windows\System\JNDCyKV.exe
  C:\Windows\System\JNDCyKV.exe
  2⤵
  PID:9300
- C:\Windows\System\fVldObd.exe
  C:\Windows\System\fVldObd.exe
  2⤵
  PID:9320
- C:\Windows\System\OHeVhpa.exe
  C:\Windows\System\OHeVhpa.exe
  2⤵
  PID:9336
- C:\Windows\System\CUeEmSP.exe
  C:\Windows\System\CUeEmSP.exe
  2⤵
  PID:9356
- C:\Windows\System\TjjHwKk.exe
  C:\Windows\System\TjjHwKk.exe
  2⤵
  PID:9372
- C:\Windows\System\GBkHTUS.exe
  C:\Windows\System\GBkHTUS.exe
  2⤵
  PID:9388
- C:\Windows\System\arbvMeu.exe
  C:\Windows\System\arbvMeu.exe
  2⤵
  PID:9404
- C:\Windows\System\ufDsfgS.exe
  C:\Windows\System\ufDsfgS.exe
  2⤵
  PID:9420
- C:\Windows\System\RXMzgfm.exe
  C:\Windows\System\RXMzgfm.exe
  2⤵
  PID:9440
- C:\Windows\System\HHVBpHj.exe
  C:\Windows\System\HHVBpHj.exe
  2⤵
  PID:9456
- C:\Windows\System\KUSDBEc.exe
  C:\Windows\System\KUSDBEc.exe
  2⤵
  PID:9472
- C:\Windows\System\zFABdTh.exe
  C:\Windows\System\zFABdTh.exe
  2⤵
  PID:9492
- C:\Windows\System\ZauQClG.exe
  C:\Windows\System\ZauQClG.exe
  2⤵
  PID:9508
- C:\Windows\System\IFjRPAq.exe
  C:\Windows\System\IFjRPAq.exe
  2⤵
  PID:9528
- C:\Windows\System\HmMtGWB.exe
  C:\Windows\System\HmMtGWB.exe
  2⤵
  PID:9544
- C:\Windows\System\rDfsDlq.exe
  C:\Windows\System\rDfsDlq.exe
  2⤵
  PID:9564
- C:\Windows\System\NtRooSE.exe
  C:\Windows\System\NtRooSE.exe
  2⤵
  PID:9580
- C:\Windows\System\vuMJgni.exe
  C:\Windows\System\vuMJgni.exe
  2⤵
  PID:9600
- C:\Windows\System\aWlfEEn.exe
  C:\Windows\System\aWlfEEn.exe
  2⤵
  PID:9620
- C:\Windows\System\YFdbBeb.exe
  C:\Windows\System\YFdbBeb.exe
  2⤵
  PID:9636
- C:\Windows\System\LPvjsgX.exe
  C:\Windows\System\LPvjsgX.exe
  2⤵
  PID:9652
- C:\Windows\System\pbSFfWx.exe
  C:\Windows\System\pbSFfWx.exe
  2⤵
  PID:9668
- C:\Windows\System\eNECgZo.exe
  C:\Windows\System\eNECgZo.exe
  2⤵
  PID:9684
- C:\Windows\System\oSuQIEV.exe
  C:\Windows\System\oSuQIEV.exe
  2⤵
  PID:9700
- C:\Windows\System\VBsfYuu.exe
  C:\Windows\System\VBsfYuu.exe
  2⤵
  PID:9720
- C:\Windows\System\NayZQki.exe
  C:\Windows\System\NayZQki.exe
  2⤵
  PID:9736
- C:\Windows\System\BoGdWNX.exe
  C:\Windows\System\BoGdWNX.exe
  2⤵
  PID:9756
- C:\Windows\System\pjnzdmP.exe
  C:\Windows\System\pjnzdmP.exe
  2⤵
  PID:9772
- C:\Windows\System\uXrdUDF.exe
  C:\Windows\System\uXrdUDF.exe
  2⤵
  PID:9792
- C:\Windows\System\dAPHuSc.exe
  C:\Windows\System\dAPHuSc.exe
  2⤵
  PID:9808
- C:\Windows\System\HeKirNw.exe
  C:\Windows\System\HeKirNw.exe
  2⤵
  PID:9828
- C:\Windows\System\HXgUWfL.exe
  C:\Windows\System\HXgUWfL.exe
  2⤵
  PID:9848
- C:\Windows\System\TdXobNL.exe
  C:\Windows\System\TdXobNL.exe
  2⤵
  PID:9864
- C:\Windows\System\RvHjmlN.exe
  C:\Windows\System\RvHjmlN.exe
  2⤵
  PID:9884
- C:\Windows\System\LcJFxXY.exe
  C:\Windows\System\LcJFxXY.exe
  2⤵
  PID:9900
- C:\Windows\System\zrJisGl.exe
  C:\Windows\System\zrJisGl.exe
  2⤵
  PID:9916
- C:\Windows\System\MMVrmHj.exe
  C:\Windows\System\MMVrmHj.exe
  2⤵
  PID:9936
- C:\Windows\System\xloQAtl.exe
  C:\Windows\System\xloQAtl.exe
  2⤵
  PID:9952
- C:\Windows\System\dhALzEv.exe
  C:\Windows\System\dhALzEv.exe
  2⤵
  PID:9968
- C:\Windows\System\UefXlaU.exe
  C:\Windows\System\UefXlaU.exe
  2⤵
  PID:9988
- C:\Windows\System\JNEcwQT.exe
  C:\Windows\System\JNEcwQT.exe
  2⤵
  PID:10004
- C:\Windows\System\VCRERPq.exe
  C:\Windows\System\VCRERPq.exe
  2⤵
  PID:10024
- C:\Windows\System\TotxJbv.exe
  C:\Windows\System\TotxJbv.exe
  2⤵
  PID:10040
- C:\Windows\System\dlOUxco.exe
  C:\Windows\System\dlOUxco.exe
  2⤵
  PID:10060
- C:\Windows\System\HXTugJp.exe
  C:\Windows\System\HXTugJp.exe
  2⤵
  PID:10076
- C:\Windows\System\GkcHmLu.exe
  C:\Windows\System\GkcHmLu.exe
  2⤵
  PID:10096
- C:\Windows\System\EoJwsRE.exe
  C:\Windows\System\EoJwsRE.exe
  2⤵
  PID:10112
- C:\Windows\System\enQLpml.exe
  C:\Windows\System\enQLpml.exe
  2⤵
  PID:10132
- C:\Windows\System\FqPllct.exe
  C:\Windows\System\FqPllct.exe
  2⤵
  PID:10148
- C:\Windows\System\lXotluS.exe
  C:\Windows\System\lXotluS.exe
  2⤵
  PID:10168
- C:\Windows\System\giseMGp.exe
  C:\Windows\System\giseMGp.exe
  2⤵
  PID:10188
- C:\Windows\System\UFIzQbx.exe
  C:\Windows\System\UFIzQbx.exe
  2⤵
  PID:10204
- C:\Windows\System\bvKKfHc.exe
  C:\Windows\System\bvKKfHc.exe
  2⤵
  PID:10224
- C:\Windows\System\okJkunW.exe
  C:\Windows\System\okJkunW.exe
  2⤵
  PID:7912
- C:\Windows\System\nWBuATh.exe
  C:\Windows\System\nWBuATh.exe
  2⤵
  PID:8024
- C:\Windows\System\FXcCHFt.exe
  C:\Windows\System\FXcCHFt.exe
  2⤵
  PID:8096
- C:\Windows\System\qSOGszS.exe
  C:\Windows\System\qSOGszS.exe
  2⤵
  PID:10256
- C:\Windows\System\neazKCB.exe
  C:\Windows\System\neazKCB.exe
  2⤵
  PID:10272
- C:\Windows\System\HEFXdBl.exe
  C:\Windows\System\HEFXdBl.exe
  2⤵
  PID:10288
- C:\Windows\System\NAXAZBw.exe
  C:\Windows\System\NAXAZBw.exe
  2⤵
  PID:10304
- C:\Windows\System\BdwSGFA.exe
  C:\Windows\System\BdwSGFA.exe
  2⤵
  PID:10320
- C:\Windows\System\XkkXYFg.exe
  C:\Windows\System\XkkXYFg.exe
  2⤵
  PID:10336
- C:\Windows\System\lyJZpbo.exe
  C:\Windows\System\lyJZpbo.exe
  2⤵
  PID:10352
- C:\Windows\System\qsQDqCs.exe
  C:\Windows\System\qsQDqCs.exe
  2⤵
  PID:10376
- C:\Windows\System\ZwzwZWH.exe
  C:\Windows\System\ZwzwZWH.exe
  2⤵
  PID:10400
- C:\Windows\System\qberFdG.exe
  C:\Windows\System\qberFdG.exe
  2⤵
  PID:10416
- C:\Windows\System\RifloHt.exe
  C:\Windows\System\RifloHt.exe
  2⤵
  PID:10436
- C:\Windows\System\aIwlVxr.exe
  C:\Windows\System\aIwlVxr.exe
  2⤵
  PID:10452
- C:\Windows\System\oNbojcC.exe
  C:\Windows\System\oNbojcC.exe
  2⤵
  PID:10468
- C:\Windows\System\dTrRQwb.exe
  C:\Windows\System\dTrRQwb.exe
  2⤵
  PID:10484
- C:\Windows\System\NHQXnVT.exe
  C:\Windows\System\NHQXnVT.exe
  2⤵
  PID:10500
- C:\Windows\System\CaggXSv.exe
  C:\Windows\System\CaggXSv.exe
  2⤵
  PID:10516
- C:\Windows\System\cytZwra.exe
  C:\Windows\System\cytZwra.exe
  2⤵
  PID:10532
- C:\Windows\System\teIRbjJ.exe
  C:\Windows\System\teIRbjJ.exe
  2⤵
  PID:10548
- C:\Windows\System\VfbuqTt.exe
  C:\Windows\System\VfbuqTt.exe
  2⤵
  PID:10568
- C:\Windows\System\OvQZxCY.exe
  C:\Windows\System\OvQZxCY.exe
  2⤵
  PID:10592
- C:\Windows\System\dmxdvZa.exe
  C:\Windows\System\dmxdvZa.exe
  2⤵
  PID:10608
- C:\Windows\System\IyIPGwV.exe
  C:\Windows\System\IyIPGwV.exe
  2⤵
  PID:10624
- C:\Windows\System\KRIvrRd.exe
  C:\Windows\System\KRIvrRd.exe
  2⤵
  PID:10640
- C:\Windows\System\mlcJwvL.exe
  C:\Windows\System\mlcJwvL.exe
  2⤵
  PID:10660
- C:\Windows\System\KgrCYUV.exe
  C:\Windows\System\KgrCYUV.exe
  2⤵
  PID:10676
- C:\Windows\System\xthiNBe.exe
  C:\Windows\System\xthiNBe.exe
  2⤵
  PID:10696
- C:\Windows\System\XMNHtse.exe
  C:\Windows\System\XMNHtse.exe
  2⤵
  PID:10716
- C:\Windows\System\LAofQLM.exe
  C:\Windows\System\LAofQLM.exe
  2⤵
  PID:10732
- C:\Windows\System\XiEprWP.exe
  C:\Windows\System\XiEprWP.exe
  2⤵
  PID:10752
- C:\Windows\System\hjEtpfB.exe
  C:\Windows\System\hjEtpfB.exe
  2⤵
  PID:10772
- C:\Windows\System\IxvqACe.exe
  C:\Windows\System\IxvqACe.exe
  2⤵
  PID:10788
- C:\Windows\System\NLdqRjA.exe
  C:\Windows\System\NLdqRjA.exe
  2⤵
  PID:10804
- C:\Windows\System\FpEySBV.exe
  C:\Windows\System\FpEySBV.exe
  2⤵
  PID:10824
- C:\Windows\System\EVkyJPu.exe
  C:\Windows\System\EVkyJPu.exe
  2⤵
  PID:10844
- C:\Windows\System\MVVGdsl.exe
  C:\Windows\System\MVVGdsl.exe
  2⤵
  PID:10860
- C:\Windows\System\lxNyeTr.exe
  C:\Windows\System\lxNyeTr.exe
  2⤵
  PID:10880
- C:\Windows\System\OVMPyZD.exe
  C:\Windows\System\OVMPyZD.exe
  2⤵
  PID:10896
- C:\Windows\System\MdEDBSQ.exe
  C:\Windows\System\MdEDBSQ.exe
  2⤵
  PID:10920
- C:\Windows\System\hAXzoFJ.exe
  C:\Windows\System\hAXzoFJ.exe
  2⤵
  PID:10936
- C:\Windows\System\MQIjpDf.exe
  C:\Windows\System\MQIjpDf.exe
  2⤵
  PID:10956
- C:\Windows\System\mZUAFPI.exe
  C:\Windows\System\mZUAFPI.exe
  2⤵
  PID:10976
- C:\Windows\System\jhSznRY.exe
  C:\Windows\System\jhSznRY.exe
  2⤵
  PID:10992
- C:\Windows\System\vjmWGGk.exe
  C:\Windows\System\vjmWGGk.exe
  2⤵
  PID:11016
- C:\Windows\System\biPGJlJ.exe
  C:\Windows\System\biPGJlJ.exe
  2⤵
  PID:11032
- C:\Windows\System\eORcQba.exe
  C:\Windows\System\eORcQba.exe
  2⤵
  PID:11056
- C:\Windows\System\fJtRNdJ.exe
  C:\Windows\System\fJtRNdJ.exe
  2⤵
  PID:11072
- C:\Windows\System\OaGoJpa.exe
  C:\Windows\System\OaGoJpa.exe
  2⤵
  PID:11096
- C:\Windows\System\wvmGtzT.exe
  C:\Windows\System\wvmGtzT.exe
  2⤵
  PID:11112
- C:\Windows\System\MXgaxlD.exe
  C:\Windows\System\MXgaxlD.exe
  2⤵
  PID:11136
- C:\Windows\System\rfbgVIE.exe
  C:\Windows\System\rfbgVIE.exe
  2⤵
  PID:11152
- C:\Windows\System\hFcamxq.exe
  C:\Windows\System\hFcamxq.exe
  2⤵
  PID:11176
- C:\Windows\System\iUvhRBE.exe
  C:\Windows\System\iUvhRBE.exe
  2⤵
  PID:11196
- C:\Windows\System\Oxdptdb.exe
  C:\Windows\System\Oxdptdb.exe
  2⤵
  PID:11212
- C:\Windows\System\HNpCAwC.exe
  C:\Windows\System\HNpCAwC.exe
  2⤵
  PID:11232
- C:\Windows\System\LWYSLcQ.exe
  C:\Windows\System\LWYSLcQ.exe
  2⤵
  PID:11252
- C:\Windows\System\TNOoIJe.exe
  C:\Windows\System\TNOoIJe.exe
  2⤵
  PID:5464
- C:\Windows\System\sKFogUP.exe
  C:\Windows\System\sKFogUP.exe
  2⤵
  PID:5764
- C:\Windows\System\yrWLyuJ.exe
  C:\Windows\System\yrWLyuJ.exe
  2⤵
  PID:5928
- C:\Windows\System\GMsrIeN.exe
  C:\Windows\System\GMsrIeN.exe
  2⤵
  PID:8212
- C:\Windows\System\DihWwgt.exe
  C:\Windows\System\DihWwgt.exe
  2⤵
  PID:8268
- C:\Windows\System\wibdxVR.exe
  C:\Windows\System\wibdxVR.exe
  2⤵
  PID:11276
- C:\Windows\System\fDofHjp.exe
  C:\Windows\System\fDofHjp.exe
  2⤵
  PID:11296
- C:\Windows\System\oLJfDSF.exe
  C:\Windows\System\oLJfDSF.exe
  2⤵
  PID:11320
- C:\Windows\System\KemSgGO.exe
  C:\Windows\System\KemSgGO.exe
  2⤵
  PID:11336
- C:\Windows\System\TwtEGLN.exe
  C:\Windows\System\TwtEGLN.exe
  2⤵
  PID:11360
- C:\Windows\System\ywSwYVC.exe
  C:\Windows\System\ywSwYVC.exe
  2⤵
  PID:11376
- C:\Windows\System\ODKmQzz.exe
  C:\Windows\System\ODKmQzz.exe
  2⤵
  PID:11400
- C:\Windows\System\feGYVAK.exe
  C:\Windows\System\feGYVAK.exe
  2⤵
  PID:11416
- C:\Windows\System\hoPrNGB.exe
  C:\Windows\System\hoPrNGB.exe
  2⤵
  PID:11440
- C:\Windows\System\gOpvZRJ.exe
  C:\Windows\System\gOpvZRJ.exe
  2⤵
  PID:11456
- C:\Windows\System\zvYWTLx.exe
  C:\Windows\System\zvYWTLx.exe
  2⤵
  PID:11480
- C:\Windows\System\pdYAHaB.exe
  C:\Windows\System\pdYAHaB.exe
  2⤵
  PID:11500
- C:\Windows\System\iBxeCat.exe
  C:\Windows\System\iBxeCat.exe
  2⤵
  PID:11524
- - C:\Windows\system32\WerFault.exe
    C:\Windows\system32\WerFault.exe -u -p 11524 -s 28
    3⤵
    PID:14020
- C:\Windows\System\DCGpVXH.exe
  C:\Windows\System\DCGpVXH.exe
  2⤵
  PID:11540
- C:\Windows\System\fBMPEMu.exe
  C:\Windows\System\fBMPEMu.exe
  2⤵
  PID:11556
- C:\Windows\System\fmwRPhr.exe
  C:\Windows\System\fmwRPhr.exe
  2⤵
  PID:11576
- C:\Windows\System\THKpjwb.exe
  C:\Windows\System\THKpjwb.exe
  2⤵
  PID:11592
- C:\Windows\System\fqSkUXb.exe
  C:\Windows\System\fqSkUXb.exe
  2⤵
  PID:11608
- C:\Windows\System\spjexQg.exe
  C:\Windows\System\spjexQg.exe
  2⤵
  PID:11624
- C:\Windows\System\ZJVpvGZ.exe
  C:\Windows\System\ZJVpvGZ.exe
  2⤵
  PID:11640
- C:\Windows\System\oTBSGIy.exe
  C:\Windows\System\oTBSGIy.exe
  2⤵
  PID:11660
- C:\Windows\System\DuEodYO.exe
  C:\Windows\System\DuEodYO.exe
  2⤵
  PID:11680
- C:\Windows\System\LOICcsW.exe
  C:\Windows\System\LOICcsW.exe
  2⤵
  PID:11704
- C:\Windows\System\OrqLoIN.exe
  C:\Windows\System\OrqLoIN.exe
  2⤵
  PID:11720
- C:\Windows\System\wlFSoIL.exe
  C:\Windows\System\wlFSoIL.exe
  2⤵
  PID:11744
- C:\Windows\System\fiwbCeN.exe
  C:\Windows\System\fiwbCeN.exe
  2⤵
  PID:11760
- C:\Windows\System\FXWRjNB.exe
  C:\Windows\System\FXWRjNB.exe
  2⤵
  PID:11784
- C:\Windows\System\onxipzx.exe
  C:\Windows\System\onxipzx.exe
  2⤵
  PID:11800
- C:\Windows\System\PsivSyV.exe
  C:\Windows\System\PsivSyV.exe
  2⤵
  PID:11824
- C:\Windows\System\LSMFYje.exe
  C:\Windows\System\LSMFYje.exe
  2⤵
  PID:11840
- C:\Windows\System\yqMAbJK.exe
  C:\Windows\System\yqMAbJK.exe
  2⤵
  PID:11864
- C:\Windows\System\fwkihLl.exe
  C:\Windows\System\fwkihLl.exe
  2⤵
  PID:11880
- C:\Windows\System\WhUobWB.exe
  C:\Windows\System\WhUobWB.exe
  2⤵
  PID:11900
- C:\Windows\System\sMdTaCG.exe
  C:\Windows\System\sMdTaCG.exe
  2⤵
  PID:11916
- C:\Windows\System\gPzUejZ.exe
  C:\Windows\System\gPzUejZ.exe
  2⤵
  PID:11936
- C:\Windows\System\VoRNubI.exe
  C:\Windows\System\VoRNubI.exe
  2⤵
  PID:11952
- C:\Windows\System\OOaIaZY.exe
  C:\Windows\System\OOaIaZY.exe
  2⤵
  PID:11972
- C:\Windows\System\sqeJgmb.exe
  C:\Windows\System\sqeJgmb.exe
  2⤵
  PID:11996
- C:\Windows\System\iRgkoyG.exe
  C:\Windows\System\iRgkoyG.exe
  2⤵
  PID:12020
- C:\Windows\System\hwBAuYL.exe
  C:\Windows\System\hwBAuYL.exe
  2⤵
  PID:12040
- C:\Windows\System\iGNjlcG.exe
  C:\Windows\System\iGNjlcG.exe
  2⤵
  PID:12056
- C:\Windows\System\LvBolTy.exe
  C:\Windows\System\LvBolTy.exe
  2⤵
  PID:12072
- C:\Windows\System\MbxgYdh.exe
  C:\Windows\System\MbxgYdh.exe
  2⤵
  PID:12088
- C:\Windows\System\IJcEpAA.exe
  C:\Windows\System\IJcEpAA.exe
  2⤵
  PID:12104
- C:\Windows\System\BbvjudA.exe
  C:\Windows\System\BbvjudA.exe
  2⤵
  PID:12120
- C:\Windows\System\NqenXNW.exe
  C:\Windows\System\NqenXNW.exe
  2⤵
  PID:12136
- C:\Windows\System\KCWtIDO.exe
  C:\Windows\System\KCWtIDO.exe
  2⤵
  PID:12152
- C:\Windows\System\Rgmyoxw.exe
  C:\Windows\System\Rgmyoxw.exe
  2⤵
  PID:12176
- C:\Windows\System\CMcbmgo.exe
  C:\Windows\System\CMcbmgo.exe
  2⤵
  PID:12192
- C:\Windows\System\ZiKvyKD.exe
  C:\Windows\System\ZiKvyKD.exe
  2⤵
  PID:12216
- C:\Windows\System\jZuACGs.exe
  C:\Windows\System\jZuACGs.exe
  2⤵
  PID:12232
- C:\Windows\System\SwxdlCE.exe
  C:\Windows\System\SwxdlCE.exe
  2⤵
  PID:12248
- C:\Windows\System\QuniMBG.exe
  C:\Windows\System\QuniMBG.exe
  2⤵
  PID:12268
- C:\Windows\System\WnWfzYh.exe
  C:\Windows\System\WnWfzYh.exe
  2⤵
  PID:12284
- C:\Windows\System\WivtlBf.exe
  C:\Windows\System\WivtlBf.exe
  2⤵
  PID:7296
- C:\Windows\System\ZZONXNA.exe
  C:\Windows\System\ZZONXNA.exe
  2⤵
  PID:9208
- C:\Windows\System\guSoHPX.exe
  C:\Windows\System\guSoHPX.exe
  2⤵
  PID:7368
- C:\Windows\System\TWFiJDX.exe
  C:\Windows\System\TWFiJDX.exe
  2⤵
  PID:12304
- C:\Windows\System\neJYxzv.exe
  C:\Windows\System\neJYxzv.exe
  2⤵
  PID:12328
- C:\Windows\System\PjWzoCF.exe
  C:\Windows\System\PjWzoCF.exe
  2⤵
  PID:12344
- C:\Windows\System\bTqvBnx.exe
  C:\Windows\System\bTqvBnx.exe
  2⤵
  PID:12364
- C:\Windows\System\uKVMEWL.exe
  C:\Windows\System\uKVMEWL.exe
  2⤵
  PID:12380
- C:\Windows\System\XqPkAxa.exe
  C:\Windows\System\XqPkAxa.exe
  2⤵
  PID:12400
- C:\Windows\System\jWhhfFK.exe
  C:\Windows\System\jWhhfFK.exe
  2⤵
  PID:12416
- C:\Windows\System\wSHNzqY.exe
  C:\Windows\System\wSHNzqY.exe
  2⤵
  PID:12436
- C:\Windows\System\VVCzCdh.exe
  C:\Windows\System\VVCzCdh.exe
  2⤵
  PID:12452
- C:\Windows\System\yZSXBNB.exe
  C:\Windows\System\yZSXBNB.exe
  2⤵
  PID:12468
- C:\Windows\System\xhbwaCK.exe
  C:\Windows\System\xhbwaCK.exe
  2⤵
  PID:12484
- C:\Windows\System\MpeacWr.exe
  C:\Windows\System\MpeacWr.exe
  2⤵
  PID:12504
- C:\Windows\System\CskXchq.exe
  C:\Windows\System\CskXchq.exe
  2⤵
  PID:12524
- C:\Windows\System\jtnLIwW.exe
  C:\Windows\System\jtnLIwW.exe
  2⤵
  PID:12540
- C:\Windows\System\BHCMBzw.exe
  C:\Windows\System\BHCMBzw.exe
  2⤵
  PID:12560
- C:\Windows\System\kDrikcn.exe
  C:\Windows\System\kDrikcn.exe
  2⤵
  PID:12580
- C:\Windows\System\ccWYLIQ.exe
  C:\Windows\System\ccWYLIQ.exe
  2⤵
  PID:12596
- C:\Windows\System\SdhzwYq.exe
  C:\Windows\System\SdhzwYq.exe
  2⤵
  PID:12612
- C:\Windows\System\amvRpdD.exe
  C:\Windows\System\amvRpdD.exe
  2⤵
  PID:12636
- C:\Windows\System\rMByKeb.exe
  C:\Windows\System\rMByKeb.exe
  2⤵
  PID:12652
- C:\Windows\System\fAnmFRH.exe
  C:\Windows\System\fAnmFRH.exe
  2⤵
  PID:12676
- C:\Windows\System\PcMaEyl.exe
  C:\Windows\System\PcMaEyl.exe
  2⤵
  PID:12692
- C:\Windows\System\QaSRTFm.exe
  C:\Windows\System\QaSRTFm.exe
  2⤵
  PID:12712
- C:\Windows\System\kFZYjTx.exe
  C:\Windows\System\kFZYjTx.exe
  2⤵
  PID:12732
- C:\Windows\System\QMRlZTf.exe
  C:\Windows\System\QMRlZTf.exe
  2⤵
  PID:12748
- C:\Windows\System\ElfjhXs.exe
  C:\Windows\System\ElfjhXs.exe
  2⤵
  PID:12768
- C:\Windows\System\fIuablo.exe
  C:\Windows\System\fIuablo.exe
  2⤵
  PID:12792
- C:\Windows\System\AlyibNt.exe
  C:\Windows\System\AlyibNt.exe
  2⤵
  PID:12816
- C:\Windows\System\rRTnFsA.exe
  C:\Windows\System\rRTnFsA.exe
  2⤵
  PID:12832
- C:\Windows\System\TtNfHDS.exe
  C:\Windows\System\TtNfHDS.exe
  2⤵
  PID:12848
- C:\Windows\System\HFudCbH.exe
  C:\Windows\System\HFudCbH.exe
  2⤵
  PID:12864
- C:\Windows\System\RkQkGtp.exe
  C:\Windows\System\RkQkGtp.exe
  2⤵
  PID:12884
- C:\Windows\System\MDoQaKr.exe
  C:\Windows\System\MDoQaKr.exe
  2⤵
  PID:12900
- C:\Windows\System\ZuZymYI.exe
  C:\Windows\System\ZuZymYI.exe
  2⤵
  PID:12920
- C:\Windows\System\RRpZbag.exe
  C:\Windows\System\RRpZbag.exe
  2⤵
  PID:12936
- C:\Windows\System\sfbgakI.exe
  C:\Windows\System\sfbgakI.exe
  2⤵
  PID:12960
- C:\Windows\System\WCVgKhy.exe
  C:\Windows\System\WCVgKhy.exe
  2⤵
  PID:12976
- C:\Windows\System\MUXLmZg.exe
  C:\Windows\System\MUXLmZg.exe
  2⤵
  PID:12992
- C:\Windows\System\QLmENQd.exe
  C:\Windows\System\QLmENQd.exe
  2⤵
  PID:13012
- C:\Windows\System\nITQsIB.exe
  C:\Windows\System\nITQsIB.exe
  2⤵
  PID:13028
- C:\Windows\System\dUNVFLJ.exe
  C:\Windows\System\dUNVFLJ.exe
  2⤵
  PID:13048
- C:\Windows\System\LuZezxT.exe
  C:\Windows\System\LuZezxT.exe
  2⤵
  PID:13064
- C:\Windows\System\HOLlQSW.exe
  C:\Windows\System\HOLlQSW.exe
  2⤵
  PID:13080
- C:\Windows\System\HxJVkky.exe
  C:\Windows\System\HxJVkky.exe
  2⤵
  PID:13108
- C:\Windows\System\cJfMyuz.exe
  C:\Windows\System\cJfMyuz.exe
  2⤵
  PID:13128
- C:\Windows\System\XanzweU.exe
  C:\Windows\System\XanzweU.exe
  2⤵
  PID:13144
- C:\Windows\System\qSehNJn.exe
  C:\Windows\System\qSehNJn.exe
  2⤵
  PID:13164
- C:\Windows\System\QAiosWP.exe
  C:\Windows\System\QAiosWP.exe
  2⤵
  PID:13184
- C:\Windows\System\sdCCNXy.exe
  C:\Windows\System\sdCCNXy.exe
  2⤵
  PID:13208
- C:\Windows\System\ThRLTGm.exe
  C:\Windows\System\ThRLTGm.exe
  2⤵
  PID:13224
- C:\Windows\System\LynaFIn.exe
  C:\Windows\System\LynaFIn.exe
  2⤵
  PID:13244
- C:\Windows\System\NcvZtXP.exe
  C:\Windows\System\NcvZtXP.exe
  2⤵
  PID:13260
- C:\Windows\System\xVkNmes.exe
  C:\Windows\System\xVkNmes.exe
  2⤵
  PID:13276
- C:\Windows\System\TGygvvJ.exe
  C:\Windows\System\TGygvvJ.exe
  2⤵
  PID:13292
- C:\Windows\System\WDepRlA.exe
  C:\Windows\System\WDepRlA.exe
  2⤵
  PID:13308
- C:\Windows\System\JGyqsID.exe
  C:\Windows\System\JGyqsID.exe
  2⤵
  PID:7380
- C:\Windows\System\BunCPCj.exe
  C:\Windows\System\BunCPCj.exe
  2⤵
  PID:6236
- C:\Windows\System\lyrnmLi.exe
  C:\Windows\System\lyrnmLi.exe
  2⤵
  PID:5228
- C:\Windows\System\LtUlCLG.exe
  C:\Windows\System\LtUlCLG.exe
  2⤵
  PID:8588
- C:\Windows\System\QoLCaGm.exe
  C:\Windows\System\QoLCaGm.exe
  2⤵
  PID:7884
- C:\Windows\System\BxbQRYC.exe
  C:\Windows\System\BxbQRYC.exe
  2⤵
  PID:5312
- C:\Windows\System\aHCsgDN.exe
  C:\Windows\System\aHCsgDN.exe
  2⤵
  PID:7524
- C:\Windows\System\soqkxvP.exe
  C:\Windows\System\soqkxvP.exe
  2⤵
  PID:1640
- C:\Windows\System\ZAvMNvG.exe
  C:\Windows\System\ZAvMNvG.exe
  2⤵
  PID:9692
- C:\Windows\System\KCHPwAJ.exe
  C:\Windows\System\KCHPwAJ.exe
  2⤵
  PID:9716
- C:\Windows\System\hZuBJFw.exe
  C:\Windows\System\hZuBJFw.exe
  2⤵
  PID:9752
- C:\Windows\System\xhTWKGX.exe
  C:\Windows\System\xhTWKGX.exe
  2⤵
  PID:9960
- C:\Windows\System\xqhSptq.exe
  C:\Windows\System\xqhSptq.exe
  2⤵
  PID:10036
- C:\Windows\System\czqScEo.exe
  C:\Windows\System\czqScEo.exe
  2⤵
  PID:5048
- C:\Windows\System\uWPLkgQ.exe
  C:\Windows\System\uWPLkgQ.exe
  2⤵
  PID:4408
- C:\Windows\System\BIOYujU.exe
  C:\Windows\System\BIOYujU.exe
  2⤵
  PID:3188
- C:\Windows\System\WbGiGnO.exe
  C:\Windows\System\WbGiGnO.exe
  2⤵
  PID:2424
- C:\Windows\System\jNjxQIf.exe
  C:\Windows\System\jNjxQIf.exe
  2⤵
  PID:9036
- C:\Windows\System\UtDPvlK.exe
  C:\Windows\System\UtDPvlK.exe
  2⤵
  PID:9104
- C:\Windows\System\fJEhQqk.exe
  C:\Windows\System\fJEhQqk.exe
  2⤵
  PID:9052
- C:\Windows\System\EFkCVEd.exe
  C:\Windows\System\EFkCVEd.exe
  2⤵
  PID:9108
- C:\Windows\System\XUmlLLb.exe
  C:\Windows\System\XUmlLLb.exe
  2⤵
  PID:880
- C:\Windows\System\cmqkKku.exe
  C:\Windows\System\cmqkKku.exe
  2⤵
  PID:3856
- C:\Windows\System\WNuYlEP.exe
  C:\Windows\System\WNuYlEP.exe
  2⤵
  PID:1672
- C:\Windows\System\EfktiWt.exe
  C:\Windows\System\EfktiWt.exe
  2⤵
  PID:10072
- C:\Windows\System\qgltyMM.exe
  C:\Windows\System\qgltyMM.exe
  2⤵
  PID:12128
- C:\Windows\System\bMWTDCl.exe
  C:\Windows\System\bMWTDCl.exe
  2⤵
  PID:12352
- C:\Windows\System\NbrMchg.exe
  C:\Windows\System\NbrMchg.exe
  2⤵
  PID:12412
- C:\Windows\System\nDJdvdK.exe
  C:\Windows\System\nDJdvdK.exe
  2⤵
  PID:10584
- C:\Windows\System\jSwYgvw.exe
  C:\Windows\System\jSwYgvw.exe
  2⤵
  PID:12516
- C:\Windows\System\HbhVzRm.exe
  C:\Windows\System\HbhVzRm.exe
  2⤵
  PID:12604
- C:\Windows\System\eZqIOSM.exe
  C:\Windows\System\eZqIOSM.exe
  2⤵
  PID:12684
- C:\Windows\System\VWzmCEI.exe
  C:\Windows\System\VWzmCEI.exe
  2⤵
  PID:12916
- C:\Windows\System\JbipuGh.exe
  C:\Windows\System\JbipuGh.exe
  2⤵
  PID:12984
- C:\Windows\System\Hmfpajk.exe
  C:\Windows\System\Hmfpajk.exe
  2⤵
  PID:5156
- C:\Windows\System\vmOrSUv.exe
  C:\Windows\System\vmOrSUv.exe
  2⤵
  PID:5844
- C:\Windows\System\JAvTZoZ.exe
  C:\Windows\System\JAvTZoZ.exe
  2⤵
  PID:11876
- C:\Windows\System\zjzSsNS.exe
  C:\Windows\System\zjzSsNS.exe
  2⤵
  PID:11948
- C:\Windows\System\NVosqVs.exe
  C:\Windows\System\NVosqVs.exe
  2⤵
  PID:8732
- C:\Windows\System\OrthSrt.exe
  C:\Windows\System\OrthSrt.exe
  2⤵
  PID:12520
- C:\Windows\System\LdYCNCy.exe
  C:\Windows\System\LdYCNCy.exe
  2⤵
  PID:12536
- C:\Windows\System\zprJYUR.exe
  C:\Windows\System\zprJYUR.exe
  2⤵
  PID:7548
- C:\Windows\System\tlgtqoF.exe
  C:\Windows\System\tlgtqoF.exe
  2⤵
  PID:12740
- C:\Windows\System\WmtolNS.exe
  C:\Windows\System\WmtolNS.exe
  2⤵
  PID:12896
- C:\Windows\System\ENXqlfg.exe
  C:\Windows\System\ENXqlfg.exe
  2⤵
  PID:5428
- C:\Windows\System\ULGtrEJ.exe
  C:\Windows\System\ULGtrEJ.exe
  2⤵
  PID:5696
- C:\Windows\System\NpBvXph.exe
  C:\Windows\System\NpBvXph.exe
  2⤵
  PID:9500
- C:\Windows\System\rGvmutP.exe
  C:\Windows\System\rGvmutP.exe
  2⤵
  PID:7060
- C:\Windows\System\TyTABvL.exe
  C:\Windows\System\TyTABvL.exe
  2⤵
  PID:3584
- C:\Windows\System\ebuwODm.exe
  C:\Windows\System\ebuwODm.exe
  2⤵
  PID:11716
- C:\Windows\System\lQRpese.exe
  C:\Windows\System\lQRpese.exe
  2⤵
  PID:6984
- C:\Windows\System\ftLCeot.exe
  C:\Windows\System\ftLCeot.exe
  2⤵
  PID:6652
- C:\Windows\System\dzpqKDl.exe
  C:\Windows\System\dzpqKDl.exe
  2⤵
  PID:7672
- C:\Windows\System\BlPUvCY.exe
  C:\Windows\System\BlPUvCY.exe
  2⤵
  PID:9428
- C:\Windows\System\FPKjTqr.exe
  C:\Windows\System\FPKjTqr.exe
  2⤵
  PID:13120
- C:\Windows\System\dLCgnLv.exe
  C:\Windows\System\dLCgnLv.exe
  2⤵
  PID:7972
- C:\Windows\System\KqcmiKf.exe
  C:\Windows\System\KqcmiKf.exe
  2⤵
  PID:10636
- C:\Windows\System\ieYMuLp.exe
  C:\Windows\System\ieYMuLp.exe
  2⤵
  PID:6508
- C:\Windows\System\ktWrcWf.exe
  C:\Windows\System\ktWrcWf.exe
  2⤵
  PID:9316
- C:\Windows\System\nNhMMst.exe
  C:\Windows\System\nNhMMst.exe
  2⤵
  PID:1696
- C:\Windows\System\GeWBAvB.exe
  C:\Windows\System\GeWBAvB.exe
  2⤵
  PID:3888
- C:\Windows\System\kfXeBzK.exe
  C:\Windows\System\kfXeBzK.exe
  2⤵
  PID:11148
- C:\Windows\System\vYPIXaC.exe
  C:\Windows\System\vYPIXaC.exe
  2⤵
  PID:8848
- C:\Windows\System\ZBSryBQ.exe
  C:\Windows\System\ZBSryBQ.exe
  2⤵
  PID:8908
- C:\Windows\System\JVyoNHZ.exe
  C:\Windows\System\JVyoNHZ.exe
  2⤵
  PID:9144
- C:\Windows\System\YXmoJHz.exe
  C:\Windows\System\YXmoJHz.exe
  2⤵
  PID:11040
- C:\Windows\System\VlVBgzm.exe
  C:\Windows\System\VlVBgzm.exe
  2⤵
  PID:11080
- C:\Windows\System\sSKkmVo.exe
  C:\Windows\System\sSKkmVo.exe
  2⤵
  PID:9220
- C:\Windows\System\IlYBIse.exe
  C:\Windows\System\IlYBIse.exe
  2⤵
  PID:11144
- C:\Windows\System\liidNpv.exe
  C:\Windows\System\liidNpv.exe
  2⤵
  PID:9452
- C:\Windows\System\WZBDXlq.exe
  C:\Windows\System\WZBDXlq.exe
  2⤵
  PID:9504
- C:\Windows\System\TzVqUDQ.exe
  C:\Windows\System\TzVqUDQ.exe
  2⤵
  PID:8184
- C:\Windows\System\CcaUHxM.exe
  C:\Windows\System\CcaUHxM.exe
  2⤵
  PID:8200
- C:\Windows\System\BtIrWlO.exe
  C:\Windows\System\BtIrWlO.exe
  2⤵
  PID:8248
- C:\Windows\System\GrWBnoC.exe
  C:\Windows\System\GrWBnoC.exe
  2⤵
  PID:9840
- C:\Windows\System\KxgEAur.exe
  C:\Windows\System\KxgEAur.exe
  2⤵
  PID:10284
- C:\Windows\System\WRNqchh.exe
  C:\Windows\System\WRNqchh.exe
  2⤵
  PID:4460
- C:\Windows\System\gjPxIyr.exe
  C:\Windows\System\gjPxIyr.exe
  2⤵
  PID:10688
- C:\Windows\System\cyTrzcG.exe
  C:\Windows\System\cyTrzcG.exe
  2⤵
  PID:10748
- C:\Windows\System\gBnzcaD.exe
  C:\Windows\System\gBnzcaD.exe
  2⤵
  PID:10872
- C:\Windows\System\iZGcctb.exe
  C:\Windows\System\iZGcctb.exe
  2⤵
  PID:11352
- C:\Windows\System\BZEaxFu.exe
  C:\Windows\System\BZEaxFu.exe
  2⤵
  PID:11448
- C:\Windows\System\JHusFnV.exe
  C:\Windows\System\JHusFnV.exe
  2⤵
  PID:12004
- C:\Windows\System\jVFGkVO.exe
  C:\Windows\System\jVFGkVO.exe
  2⤵
  PID:4140
- C:\Windows\System\zwOLoug.exe
  C:\Windows\System\zwOLoug.exe
  2⤵
  PID:12260
- C:\Windows\System\HhbHYaI.exe
  C:\Windows\System\HhbHYaI.exe
  2⤵
  PID:10012
- C:\Windows\System\ScOdYyT.exe
  C:\Windows\System\ScOdYyT.exe
  2⤵
  PID:6840
- C:\Windows\System\aqQclSS.exe
  C:\Windows\System\aqQclSS.exe
  2⤵
  PID:12944
- C:\Windows\System\keIezxl.exe
  C:\Windows\System\keIezxl.exe
  2⤵
  PID:12952
- C:\Windows\System\NHKAFrs.exe
  C:\Windows\System\NHKAFrs.exe
  2⤵
  PID:12168
- C:\Windows\System\PMNzNNK.exe
  C:\Windows\System\PMNzNNK.exe
  2⤵
  PID:9192
- C:\Windows\System\uozsqLb.exe
  C:\Windows\System\uozsqLb.exe
  2⤵
  PID:4012
- C:\Windows\System\vRMHcqt.exe
  C:\Windows\System\vRMHcqt.exe
  2⤵
  PID:12840
- C:\Windows\System\AFNxCzH.exe
  C:\Windows\System\AFNxCzH.exe
  2⤵
  PID:9572
- C:\Windows\System\mMwsakE.exe
  C:\Windows\System\mMwsakE.exe
  2⤵
  PID:11028
- C:\Windows\System\cbBPcVH.exe
  C:\Windows\System\cbBPcVH.exe
  2⤵
  PID:12228
- C:\Windows\System\qlCaIWg.exe
  C:\Windows\System\qlCaIWg.exe
  2⤵
  PID:11048
- C:\Windows\System\xaOXWJu.exe
  C:\Windows\System\xaOXWJu.exe
  2⤵
  PID:8420
- C:\Windows\System\qQYqHZS.exe
  C:\Windows\System\qQYqHZS.exe
  2⤵
  PID:10968
- C:\Windows\System\owXbAWK.exe
  C:\Windows\System\owXbAWK.exe
  2⤵
  PID:12552
- C:\Windows\System\yDaiWQy.exe
  C:\Windows\System\yDaiWQy.exe
  2⤵
  PID:4792
- C:\Windows\System\ymTYsEN.exe
  C:\Windows\System\ymTYsEN.exe
  2⤵
  PID:12724
- C:\Windows\System\xMrzrtD.exe
  C:\Windows\System\xMrzrtD.exe
  2⤵
  PID:7092
- C:\Windows\System\mOKSXdU.exe
  C:\Windows\System\mOKSXdU.exe
  2⤵
  PID:13256
- C:\Windows\System\QNhTAUL.exe
  C:\Windows\System\QNhTAUL.exe
  2⤵
  PID:10312
- C:\Windows\System\UWhsekf.exe
  C:\Windows\System\UWhsekf.exe
  2⤵
  PID:7920
- C:\Windows\System\eAHrJtf.exe
  C:\Windows\System\eAHrJtf.exe
  2⤵
  PID:9732
- C:\Windows\System\itOByMH.exe
  C:\Windows\System\itOByMH.exe
  2⤵
  PID:9976
- C:\Windows\System\Hkcecnx.exe
  C:\Windows\System\Hkcecnx.exe
  2⤵
  PID:10108
- C:\Windows\System\XfZonbD.exe
  C:\Windows\System\XfZonbD.exe
  2⤵
  PID:5036
- C:\Windows\System\lUxSYgY.exe
  C:\Windows\System\lUxSYgY.exe
  2⤵
  PID:5004
- C:\Windows\System\SzEtNar.exe
  C:\Windows\System\SzEtNar.exe
  2⤵
  PID:13492
- C:\Windows\System\kIKWCNr.exe
  C:\Windows\System\kIKWCNr.exe
  2⤵
  PID:13516
- C:\Windows\System\GsavXkm.exe
  C:\Windows\System\GsavXkm.exe
  2⤵
  PID:13536
- C:\Windows\System\uXKEwOj.exe
  C:\Windows\System\uXKEwOj.exe
  2⤵
  PID:13556
- C:\Windows\System\vGgOFsX.exe
  C:\Windows\System\vGgOFsX.exe
  2⤵
  PID:14196
- C:\Windows\System\cixaqsb.exe
  C:\Windows\System\cixaqsb.exe
  2⤵
  PID:14228
- C:\Windows\System\eZJUfyf.exe
  C:\Windows\System\eZJUfyf.exe
  2⤵
  PID:13088
- C:\Windows\System\yIYULuu.exe
  C:\Windows\System\yIYULuu.exe
  2⤵
  PID:7612
- C:\Windows\System\uAAlLAy.exe
  C:\Windows\System\uAAlLAy.exe
  2⤵
  PID:2044
- C:\Windows\System\xvdrCNS.exe
  C:\Windows\System\xvdrCNS.exe
  2⤵
  PID:13232
- C:\Windows\System\OpVShrT.exe
  C:\Windows\System\OpVShrT.exe
  2⤵
  PID:11244
- C:\Windows\System\vCduscU.exe
  C:\Windows\System\vCduscU.exe
  2⤵
  PID:11304
- C:\Windows\System\CKngjrB.exe
  C:\Windows\System\CKngjrB.exe
  2⤵
  PID:13656
- C:\Windows\System\AmyzAfW.exe
  C:\Windows\System\AmyzAfW.exe
  2⤵
  PID:14068
- C:\Windows\System\IYZBlyl.exe
  C:\Windows\System\IYZBlyl.exe
  2⤵
  PID:14120
- C:\Windows\System\eBQWgYC.exe
  C:\Windows\System\eBQWgYC.exe
  2⤵
  PID:9680
- C:\Windows\System\bnDQJkM.exe
  C:\Windows\System\bnDQJkM.exe
  2⤵
  PID:9768
- C:\Windows\System\ThWXhQN.exe
  C:\Windows\System\ThWXhQN.exe
  2⤵
  PID:8876
- C:\Windows\System\KOcAuZp.exe
  C:\Windows\System\KOcAuZp.exe
  2⤵
  PID:9708
- C:\Windows\System\mjfHVIR.exe
  C:\Windows\System\mjfHVIR.exe
  2⤵
  PID:14024
- C:\Windows\System\LQChimB.exe
  C:\Windows\System\LQChimB.exe
  2⤵
  PID:13888
- C:\Windows\System\PxHISdA.exe
  C:\Windows\System\PxHISdA.exe
  2⤵
  PID:4344
- C:\Windows\System\ZGQZYuh.exe
  C:\Windows\System\ZGQZYuh.exe
  2⤵
  PID:13812
- C:\Windows\System\LgAMZII.exe
  C:\Windows\System\LgAMZII.exe
  2⤵
  PID:13744
- C:\Windows\System\wMhzmgl.exe
  C:\Windows\System\wMhzmgl.exe
  2⤵
  PID:11120
- C:\Windows\System\szdrOkZ.exe
  C:\Windows\System\szdrOkZ.exe
  2⤵
  PID:12756
- C:\Windows\System\PKAWeca.exe
  C:\Windows\System\PKAWeca.exe
  2⤵
  PID:13528
- C:\Windows\System\zBrtyxx.exe
  C:\Windows\System\zBrtyxx.exe
  2⤵
  PID:12048
- C:\Windows\System\wmUxjTE.exe
  C:\Windows\System\wmUxjTE.exe
  2⤵
  PID:13320
- C:\Windows\System\qCEuIhL.exe
  C:\Windows\System\qCEuIhL.exe
  2⤵
  PID:14276
- C:\Windows\System\ospZSPq.exe
  C:\Windows\System\ospZSPq.exe
  2⤵
  PID:2276
- C:\Windows\System\JOoKoLp.exe
  C:\Windows\System\JOoKoLp.exe
  2⤵
  PID:11892
- C:\Windows\System\lreaMiP.exe
  C:\Windows\System\lreaMiP.exe
  2⤵
  PID:9744
- C:\Windows\System\iUQXker.exe
  C:\Windows\System\iUQXker.exe
  2⤵
  PID:13760
- C:\Windows\System\OgrIOYA.exe
  C:\Windows\System\OgrIOYA.exe
  2⤵
  PID:4836
- C:\Windows\System\QRMCkPz.exe
  C:\Windows\System\QRMCkPz.exe
  2⤵
  PID:2660
- C:\Windows\System\kAXSjdz.exe
  C:\Windows\System\kAXSjdz.exe
  2⤵
  PID:14020
- C:\Windows\System\eFQFBtJ.exe
  C:\Windows\System\eFQFBtJ.exe
  2⤵
  PID:14236
- C:\Windows\System\EQpKMUV.exe
  C:\Windows\System\EQpKMUV.exe
  2⤵
  PID:12556
- C:\Windows\System\jLblogm.exe
  C:\Windows\System\jLblogm.exe
  2⤵
  PID:13624
- C:\Windows\System\TNqGErD.exe
  C:\Windows\System\TNqGErD.exe
  2⤵
  PID:10800
- C:\Windows\System\KiJzieP.exe
  C:\Windows\System\KiJzieP.exe
  2⤵
  PID:6304
- C:\Windows\System\CAltgNI.exe
  C:\Windows\System\CAltgNI.exe
  2⤵
  PID:9160
- C:\Windows\System\Rqsfyfy.exe
  C:\Windows\System\Rqsfyfy.exe
  2⤵
  PID:13436
- C:\Windows\System\stTXxwP.exe
  C:\Windows\System\stTXxwP.exe
  2⤵
  PID:13680
- C:\Windows\System\oTbOcZJ.exe
  C:\Windows\System\oTbOcZJ.exe
  2⤵
  PID:14052
- C:\Windows\System\mGooCif.exe
  C:\Windows\System\mGooCif.exe
  2⤵
  PID:10944
- C:\Windows\System\Vlipcav.exe
  C:\Windows\System\Vlipcav.exe
  2⤵
  PID:10632
- C:\Windows\System\XaAXRYB.exe
  C:\Windows\System\XaAXRYB.exe
  2⤵
  PID:7312
- C:\Windows\System\ujOuErq.exe
  C:\Windows\System\ujOuErq.exe
  2⤵
  PID:13984
- C:\Windows\System\QQaTlpE.exe
  C:\Windows\System\QQaTlpE.exe
  2⤵
  PID:14072
- C:\Windows\System\wxJOgaR.exe
  C:\Windows\System\wxJOgaR.exe
  2⤵
  PID:11756
- C:\Windows\System\GtKhOPw.exe
  C:\Windows\System\GtKhOPw.exe
  2⤵
  PID:9784
- C:\Windows\System\NQBjedA.exe
  C:\Windows\System\NQBjedA.exe
  2⤵
  PID:13332
- C:\Windows\System\iJNiiAn.exe
  C:\Windows\System\iJNiiAn.exe
  2⤵
  PID:13040
- C:\Windows\System\TwYkhWu.exe
  C:\Windows\System\TwYkhWu.exe
  2⤵
  PID:9924
- C:\Windows\System\jWmPqIH.exe
  C:\Windows\System\jWmPqIH.exe
  2⤵
  PID:14008
- C:\Windows\System\Rdgoqpb.exe
  C:\Windows\System\Rdgoqpb.exe
  2⤵
  PID:13772
- C:\Windows\System\jhFqbVw.exe
  C:\Windows\System\jhFqbVw.exe
  2⤵
  PID:2892
- C:\Windows\System\bqkuQWV.exe
  C:\Windows\System\bqkuQWV.exe
  2⤵
  PID:13840
- C:\Windows\System\vVSQOml.exe
  C:\Windows\System\vVSQOml.exe
  2⤵
  PID:13732
- C:\Windows\System\iDiLAYJ.exe
  C:\Windows\System\iDiLAYJ.exe
  2⤵
  PID:14256
- C:\Windows\System\vhxvBzL.exe
  C:\Windows\System\vhxvBzL.exe
  2⤵
  PID:13596
- C:\Windows\System\ubOymSr.exe
  C:\Windows\System\ubOymSr.exe
  2⤵
  PID:14260
- C:\Windows\System\qqeGYYa.exe
  C:\Windows\System\qqeGYYa.exe
  2⤵
  PID:13852
- C:\Windows\System\EcEcusQ.exe
  C:\Windows\System\EcEcusQ.exe
  2⤵
  PID:9084
- C:\Windows\System\IYBgrEo.exe
  C:\Windows\System\IYBgrEo.exe
  2⤵
  PID:14172
- C:\Windows\System\LGaBxna.exe
  C:\Windows\System\LGaBxna.exe
  2⤵
  PID:10948
- C:\Windows\System\LhgSXls.exe
  C:\Windows\System\LhgSXls.exe
  2⤵
  PID:13804
- C:\Windows\System\hWCKKJM.exe
  C:\Windows\System\hWCKKJM.exe
  2⤵
  PID:11676
- C:\Windows\System\epmGmSO.exe
  C:\Windows\System\epmGmSO.exe
  2⤵
  PID:14252
- C:\Windows\System\MMRErnU.exe
  C:\Windows\System\MMRErnU.exe
  2⤵
  PID:10540
- C:\Windows\System\KYQumgi.exe
  C:\Windows\System\KYQumgi.exe
  2⤵
  PID:9860
- C:\Windows\System\FpEldEu.exe
  C:\Windows\System\FpEldEu.exe
  2⤵
  PID:1728
- C:\Windows\System\SbzopRa.exe
  C:\Windows\System\SbzopRa.exe
  2⤵
  PID:8360
- C:\Windows\System\hViVeQI.exe
  C:\Windows\System\hViVeQI.exe
  2⤵
  PID:9464
- C:\Windows\System\gzrrxcu.exe
  C:\Windows\System\gzrrxcu.exe
  2⤵
  PID:13736
- C:\Windows\System\vmQrSMA.exe
  C:\Windows\System\vmQrSMA.exe
  2⤵
  PID:13372
- C:\Windows\System\QyWrdru.exe
  C:\Windows\System\QyWrdru.exe
  2⤵
  PID:13360
- C:\Windows\System\CYChlQB.exe
  C:\Windows\System\CYChlQB.exe
  2⤵
  PID:14144
- C:\Windows\System\McLtWUe.exe
  C:\Windows\System\McLtWUe.exe
  2⤵
  PID:8264
- C:\Windows\System\AeSPllW.exe
  C:\Windows\System\AeSPllW.exe
  2⤵
  PID:10668
- C:\Windows\System\uKcGYJk.exe
  C:\Windows\System\uKcGYJk.exe
  2⤵
  PID:12500
- C:\Windows\System\ZwFSdJJ.exe
  C:\Windows\System\ZwFSdJJ.exe
  2⤵
  PID:13328
- C:\Windows\System\SxvDwhq.exe
  C:\Windows\System\SxvDwhq.exe
  2⤵
  PID:13588
- C:\Windows\System\XJonooc.exe
  C:\Windows\System\XJonooc.exe
  2⤵
  PID:8336
- C:\Windows\System\IOxyQXK.exe
  C:\Windows\System\IOxyQXK.exe
  2⤵
  PID:12208
- C:\Windows\System\wWcwQgH.exe
  C:\Windows\System\wWcwQgH.exe
  2⤵
  PID:4320
- C:\Windows\System\bwlzSIn.exe
  C:\Windows\System\bwlzSIn.exe
  2⤵
  PID:3524
- C:\Windows\System\NIAMfNs.exe
  C:\Windows\System\NIAMfNs.exe
  2⤵
  PID:8764
- C:\Windows\System\LbBHnHr.exe
  C:\Windows\System\LbBHnHr.exe
  2⤵
  PID:8628
- C:\Windows\System\oPFjazt.exe
  C:\Windows\System\oPFjazt.exe
  2⤵
  PID:6828
- C:\Windows\System\zWeIvbS.exe
  C:\Windows\System\zWeIvbS.exe
  2⤵
  PID:1248
- C:\Windows\System\hjtyRUd.exe
  C:\Windows\System\hjtyRUd.exe
  2⤵
  PID:14240
- C:\Windows\System\thGwxfY.exe
  C:\Windows\System\thGwxfY.exe
  2⤵
  PID:13728
- C:\Windows\System\mUGymNC.exe
  C:\Windows\System\mUGymNC.exe
  2⤵
  PID:13124
- C:\Windows\System\LnjPqLk.exe
  C:\Windows\System\LnjPqLk.exe
  2⤵
  PID:8644
- C:\Windows\System\iTbjgJp.exe
  C:\Windows\System\iTbjgJp.exe
  2⤵
  PID:13104
- C:\Windows\System\yWUgdKu.exe
  C:\Windows\System\yWUgdKu.exe
  2⤵
  PID:8180
- C:\Windows\System\YJYCQJA.exe
  C:\Windows\System\YJYCQJA.exe
  2⤵
  PID:7716
- C:\Windows\System\orBfiJm.exe
  C:\Windows\System\orBfiJm.exe
  2⤵
  PID:4796
- C:\Windows\System\VzKXHfU.exe
  C:\Windows\System\VzKXHfU.exe
  2⤵
  PID:13692
- C:\Windows\System\oXOebJO.exe
  C:\Windows\System\oXOebJO.exe
  2⤵
  PID:8648
- C:\Windows\System\NadgmuS.exe
  C:\Windows\System\NadgmuS.exe
  2⤵
  PID:8656
- C:\Windows\System\EUdzdGa.exe
  C:\Windows\System\EUdzdGa.exe
  2⤵
  PID:3964
- C:\Windows\System\myqfjMP.exe
  C:\Windows\System\myqfjMP.exe
  2⤵
  PID:3388
- C:\Windows\System\wmzIByn.exe
  C:\Windows\System\wmzIByn.exe
  2⤵
  PID:4948
- C:\Windows\System\vjdjoqS.exe
  C:\Windows\System\vjdjoqS.exe
  2⤵
  PID:8616
- C:\Windows\System\yglWJlZ.exe
  C:\Windows\System\yglWJlZ.exe
  2⤵
  PID:2716
- C:\Windows\System\fyCffDp.exe
  C:\Windows\System\fyCffDp.exe
  2⤵
  PID:1656
- C:\Windows\System\xouDpYV.exe
  C:\Windows\System\xouDpYV.exe
  2⤵
  PID:560
- C:\Windows\System\SnVQjWc.exe
  C:\Windows\System\SnVQjWc.exe
  2⤵
  PID:8780
- C:\Windows\System\bpYjzCg.exe
  C:\Windows\System\bpYjzCg.exe
  2⤵
  PID:9816
- C:\Windows\System\MLAIGWs.exe
  C:\Windows\System\MLAIGWs.exe
  2⤵
  PID:4916
- C:\Windows\System\IiGNmKS.exe
  C:\Windows\System\IiGNmKS.exe
  2⤵
  PID:14412
- C:\Windows\System\xlyLrzB.exe
  C:\Windows\System\xlyLrzB.exe
  2⤵
  PID:14436
- C:\Windows\System\cAIksrc.exe
  C:\Windows\System\cAIksrc.exe
  2⤵
  PID:14472
- C:\Windows\System\iAdEflw.exe
  C:\Windows\System\iAdEflw.exe
  2⤵
  PID:14500
- C:\Windows\System\IEPOPBr.exe
  C:\Windows\System\IEPOPBr.exe
  2⤵
  PID:14572
- C:\Windows\System\hefvuPl.exe
  C:\Windows\System\hefvuPl.exe
  2⤵
  PID:14596
- C:\Windows\System\lYFWgxr.exe
  C:\Windows\System\lYFWgxr.exe
  2⤵
  PID:14752
- C:\Windows\System\PFOxZNe.exe
  C:\Windows\System\PFOxZNe.exe
  2⤵
  PID:14796
- C:\Windows\System\RIUAqqR.exe
  C:\Windows\System\RIUAqqR.exe
  2⤵
  PID:14936
- C:\Windows\System\VjQbdlV.exe
  C:\Windows\System\VjQbdlV.exe
  2⤵
  PID:14984
- C:\Windows\System\JgSZseA.exe
  C:\Windows\System\JgSZseA.exe
  2⤵
  PID:15044
- C:\Windows\System\SRUoqHj.exe
  C:\Windows\System\SRUoqHj.exe
  2⤵
  PID:15080
- C:\Windows\System\tJDRFGz.exe
  C:\Windows\System\tJDRFGz.exe
  2⤵
  PID:15104
- C:\Windows\System\EizlSVp.exe
  C:\Windows\System\EizlSVp.exe
  2⤵
  PID:15140
- C:\Windows\System\XoyuGbw.exe
  C:\Windows\System\XoyuGbw.exe
  2⤵
  PID:1484
- C:\Windows\System\qMgTVct.exe
  C:\Windows\System\qMgTVct.exe
  2⤵
  PID:5108
- C:\Windows\System\hSUGNKz.exe
  C:\Windows\System\hSUGNKz.exe
  2⤵
  PID:3596
- C:\Windows\System\oQgjuDj.exe
  C:\Windows\System\oQgjuDj.exe
  2⤵
  PID:14428
- C:\Windows\System\NPdxODd.exe
  C:\Windows\System\NPdxODd.exe
  2⤵
  PID:4324
- C:\Windows\System\UUQxQZZ.exe
  C:\Windows\System\UUQxQZZ.exe
  2⤵
  PID:5236
- C:\Windows\System\UGKDxUY.exe
  C:\Windows\System\UGKDxUY.exe
  2⤵
  PID:14672
- C:\Windows\System\lrpCxiM.exe
  C:\Windows\System\lrpCxiM.exe
  2⤵
  PID:14916
- C:\Windows\System\vxadsrm.exe
  C:\Windows\System\vxadsrm.exe
  2⤵
  PID:14884
- C:\Windows\System\IgnTlCG.exe
  C:\Windows\System\IgnTlCG.exe
  2⤵
  PID:14960
- C:\Windows\System\vvbbrYk.exe
  C:\Windows\System\vvbbrYk.exe
  2⤵
  PID:3084
- C:\Windows\System\YRQWGkh.exe
  C:\Windows\System\YRQWGkh.exe
  2⤵
  PID:6008
- C:\Windows\System\ywQArwq.exe
  C:\Windows\System\ywQArwq.exe
  2⤵
  PID:15096
- C:\Windows\System\OhdIXIV.exe
  C:\Windows\System\OhdIXIV.exe
  2⤵
  PID:15208
- C:\Windows\System\sXeCsBu.exe
  C:\Windows\System\sXeCsBu.exe
  2⤵
  PID:15076
- C:\Windows\System\tksPoQH.exe
  C:\Windows\System\tksPoQH.exe
  2⤵
  PID:5748
- C:\Windows\System\gjPMVUp.exe
  C:\Windows\System\gjPMVUp.exe
  2⤵
  PID:15304
- C:\Windows\System\fgSJPSH.exe
  C:\Windows\System\fgSJPSH.exe
  2⤵
  PID:15128
- C:\Windows\System\bCmUnIe.exe
  C:\Windows\System\bCmUnIe.exe
  2⤵
  PID:4804
- C:\Windows\System\VDvmEEt.exe
  C:\Windows\System\VDvmEEt.exe
  2⤵
  PID:5636
- C:\Windows\System\ymNFbgc.exe
  C:\Windows\System\ymNFbgc.exe
  2⤵
  PID:15152
- C:\Windows\System\cFghudH.exe
  C:\Windows\System\cFghudH.exe
  2⤵
  PID:5828
- C:\Windows\System\TRABWNz.exe
  C:\Windows\System\TRABWNz.exe
  2⤵
  PID:6336
- C:\Windows\System\cRQsiBF.exe
  C:\Windows\System\cRQsiBF.exe
  2⤵
  PID:14444
- C:\Windows\System\JykMbmq.exe
  C:\Windows\System\JykMbmq.exe
  2⤵
  PID:15324
- C:\Windows\System\Emoyhuf.exe
  C:\Windows\System\Emoyhuf.exe
  2⤵
  PID:3196
- C:\Windows\System\LxoeyFC.exe
  C:\Windows\System\LxoeyFC.exe
  2⤵
  PID:8636
- C:\Windows\System\AlCewAS.exe
  C:\Windows\System\AlCewAS.exe
  2⤵
  PID:3768
- C:\Windows\System\daPfDGM.exe
  C:\Windows\System\daPfDGM.exe
  2⤵
  PID:14380
- C:\Windows\System\kxejNwh.exe
  C:\Windows\System\kxejNwh.exe
  2⤵
  PID:14532
- C:\Windows\System\smjlxim.exe
  C:\Windows\System\smjlxim.exe
  2⤵
  PID:2020
- C:\Windows\System\TmByrfb.exe
  C:\Windows\System\TmByrfb.exe
  2⤵
  PID:14376
- C:\Windows\System\ifhruEV.exe
  C:\Windows\System\ifhruEV.exe
  2⤵
  PID:6172
- C:\Windows\System\oexWZfy.exe
  C:\Windows\System\oexWZfy.exe
  2⤵
  PID:4884
- C:\Windows\System\YOdaiaq.exe
  C:\Windows\System\YOdaiaq.exe
  2⤵
  PID:3296
- C:\Windows\System\HQFWvUt.exe
  C:\Windows\System\HQFWvUt.exe
  2⤵
  PID:5616
- C:\Windows\System\DMaElTR.exe
  C:\Windows\System\DMaElTR.exe
  2⤵
  PID:14760
- C:\Windows\System\cUXWGpv.exe
  C:\Windows\System\cUXWGpv.exe
  2⤵
  PID:14660
- C:\Windows\System\wiGMtdO.exe
  C:\Windows\System\wiGMtdO.exe
  2⤵
  PID:14720
- C:\Windows\System\IrEgbin.exe
  C:\Windows\System\IrEgbin.exe
  2⤵
  PID:14744
- C:\Windows\System\BgbceMp.exe
  C:\Windows\System\BgbceMp.exe
  2⤵
  PID:7020
- C:\Windows\System\uAGUSDw.exe
  C:\Windows\System\uAGUSDw.exe
  2⤵
  PID:6152
- C:\Windows\System\cosmkLl.exe
  C:\Windows\System\cosmkLl.exe
  2⤵
  PID:7012
- C:\Windows\System\LynJzvh.exe
  C:\Windows\System\LynJzvh.exe
  2⤵
  PID:6432
- C:\Windows\System\yOonidc.exe
  C:\Windows\System\yOonidc.exe
  2⤵
  PID:14780
- C:\Windows\System\eoGohJq.exe
  C:\Windows\System\eoGohJq.exe
  2⤵
  PID:7888
- C:\Windows\System\IeDHEsV.exe
  C:\Windows\System\IeDHEsV.exe
  2⤵
  PID:7840
- C:\Windows\System\bStbmWK.exe
  C:\Windows\System\bStbmWK.exe
  2⤵
  PID:14876
- C:\Windows\System\fYKlHAr.exe
  C:\Windows\System\fYKlHAr.exe
  2⤵
  PID:7140
- C:\Windows\System\YJhiyqH.exe
  C:\Windows\System\YJhiyqH.exe
  2⤵
  PID:14980
- C:\Windows\System\BARGSwi.exe
  C:\Windows\System\BARGSwi.exe
  2⤵
  PID:15020
- C:\Windows\System\UiFILZt.exe
  C:\Windows\System\UiFILZt.exe
  2⤵
  PID:15016
- C:\Windows\System\kmtXBzM.exe
  C:\Windows\System\kmtXBzM.exe
  2⤵
  PID:5016
- C:\Windows\System\FEJWSip.exe
  C:\Windows\System\FEJWSip.exe
  2⤵
  PID:13504
- C:\Windows\System\TYasQft.exe
  C:\Windows\System\TYasQft.exe
  2⤵
  PID:13364
- C:\Windows\System\fPuWmZo.exe
  C:\Windows\System\fPuWmZo.exe
  2⤵
  PID:13676
- C:\Windows\System\FXdpvvt.exe
  C:\Windows\System\FXdpvvt.exe
  2⤵
  PID:14112
- C:\Windows\System\KtDSeMD.exe
  C:\Windows\System\KtDSeMD.exe
  2⤵
  PID:15040
- C:\Windows\System\gAXwzoF.exe
  C:\Windows\System\gAXwzoF.exe
  2⤵
  PID:8516
- C:\Windows\System\vYyQlPt.exe
  C:\Windows\System\vYyQlPt.exe
  2⤵
  PID:8496
- C:\Windows\System\aYYdaGr.exe
  C:\Windows\System\aYYdaGr.exe
  2⤵
  PID:7388
- C:\Windows\System\OBeNRtm.exe
  C:\Windows\System\OBeNRtm.exe
  2⤵
  PID:8480
- C:\Windows\System\kXzWLtl.exe
  C:\Windows\System\kXzWLtl.exe
  2⤵
  PID:7316
- C:\Windows\System\toosUbe.exe
  C:\Windows\System\toosUbe.exe
  2⤵
  PID:15156
- C:\Windows\System\PznvyJz.exe
  C:\Windows\System\PznvyJz.exe
  2⤵
  PID:4120
- C:\Windows\System\JHvpOSv.exe
  C:\Windows\System\JHvpOSv.exe
  2⤵
  PID:5524
- C:\Windows\System\FeUAzTv.exe
  C:\Windows\System\FeUAzTv.exe
  2⤵
  PID:7484
- C:\Windows\System\HbSycFp.exe
  C:\Windows\System\HbSycFp.exe
  2⤵
  PID:5640
- C:\Windows\System\nThQZIl.exe
  C:\Windows\System\nThQZIl.exe
  2⤵
  PID:15168
- C:\Windows\System\AbRLrJG.exe
  C:\Windows\System\AbRLrJG.exe
  2⤵
  PID:14340
- C:\Windows\System\cxfquVl.exe
  C:\Windows\System\cxfquVl.exe
  2⤵
  PID:13660
- C:\Windows\System\BuYtIaY.exe
  C:\Windows\System\BuYtIaY.exe
  2⤵
  PID:5064
- C:\Windows\System\zBGTTYz.exe
  C:\Windows\System\zBGTTYz.exe
  2⤵
  PID:13204
- C:\Windows\System\OATPWoq.exe
  C:\Windows\System\OATPWoq.exe
  2⤵
  PID:8428
- C:\Windows\System\LGBrXPQ.exe
  C:\Windows\System\LGBrXPQ.exe
  2⤵
  PID:7420
- C:\Windows\System\OtgAyFu.exe
  C:\Windows\System\OtgAyFu.exe
  2⤵
  PID:8400
- C:\Windows\System\HDsOJqw.exe
  C:\Windows\System\HDsOJqw.exe
  2⤵
  PID:7364
- C:\Windows\System\jcaoXKI.exe
  C:\Windows\System\jcaoXKI.exe
  2⤵
  PID:7432
- C:\Windows\System\nuvZqZM.exe
  C:\Windows\System\nuvZqZM.exe
  2⤵
  PID:6444
- C:\Windows\System\OuhGAST.exe
  C:\Windows\System\OuhGAST.exe
  2⤵
  PID:7300
- C:\Windows\System\MSSLLKX.exe
  C:\Windows\System\MSSLLKX.exe
  2⤵
  PID:1744
- C:\Windows\System\GIjSDJV.exe
  C:\Windows\System\GIjSDJV.exe
  2⤵
  PID:7480
- C:\Windows\System\yrykCnq.exe
  C:\Windows\System\yrykCnq.exe
  2⤵
  PID:14492
- C:\Windows\System\FmASZJE.exe
  C:\Windows\System\FmASZJE.exe
  2⤵
  PID:9488
- C:\Windows\System\eQgUONn.exe
  C:\Windows\System\eQgUONn.exe
  2⤵
  PID:14856
- C:\Windows\System\VsDIapG.exe
  C:\Windows\System\VsDIapG.exe
  2⤵
  PID:10760
- C:\Windows\System\TlnKpHU.exe
  C:\Windows\System\TlnKpHU.exe
  2⤵
  PID:10868
- C:\Windows\System\pOqGUHO.exe
  C:\Windows\System\pOqGUHO.exe
  2⤵
  PID:10088
- C:\Windows\System\Xvdkjcp.exe
  C:\Windows\System\Xvdkjcp.exe
  2⤵
  PID:10140
- C:\Windows\System\LUGBkZV.exe
  C:\Windows\System\LUGBkZV.exe
  2⤵
  PID:5820
- C:\Windows\System\ZSYyPGZ.exe
  C:\Windows\System\ZSYyPGZ.exe
  2⤵
  PID:10200
- C:\Windows\System\VMXwHDP.exe
  C:\Windows\System\VMXwHDP.exe
  2⤵
  PID:14784
- C:\Windows\System\CGKAUSv.exe
  C:\Windows\System\CGKAUSv.exe
  2⤵
  PID:5360
- C:\Windows\System\QQgCiwz.exe
  C:\Windows\System\QQgCiwz.exe
  2⤵
  PID:8072
- C:\Windows\System\JnPTyrC.exe
  C:\Windows\System\JnPTyrC.exe
  2⤵
  PID:10248
- C:\Windows\System\wxEzSSc.exe
  C:\Windows\System\wxEzSSc.exe
  2⤵
  PID:7820
- C:\Windows\System\fmMTAzx.exe
  C:\Windows\System\fmMTAzx.exe
  2⤵
  PID:8548
- C:\Windows\System\kMCyRZX.exe
  C:\Windows\System\kMCyRZX.exe
  2⤵
  PID:14132
- C:\Windows\System\HekTPsa.exe
  C:\Windows\System\HekTPsa.exe
  2⤵
  PID:10332
- C:\Windows\System\ZLCgxPv.exe
  C:\Windows\System\ZLCgxPv.exe
  2⤵
  PID:15088
- C:\Windows\System\KnclCEZ.exe
  C:\Windows\System\KnclCEZ.exe
  2⤵
  PID:7924
- C:\Windows\System\stYwboy.exe
  C:\Windows\System\stYwboy.exe
  2⤵
  PID:15112
- C:\Windows\System\fgNggue.exe
  C:\Windows\System\fgNggue.exe
  2⤵
  PID:8384
- C:\Windows\System\UoTHLtQ.exe
  C:\Windows\System\UoTHLtQ.exe
  2⤵
  PID:8536
- C:\Windows\System\roiAhrR.exe
  C:\Windows\System\roiAhrR.exe
  2⤵
  PID:14352
- C:\Windows\System\DuxMPvE.exe
  C:\Windows\System\DuxMPvE.exe
  2⤵
  PID:12492
- C:\Windows\System\UKviyca.exe
  C:\Windows\System\UKviyca.exe
  2⤵
  PID:1336
- C:\Windows\System\pAsopDg.exe
  C:\Windows\System\pAsopDg.exe
  2⤵
  PID:7252
- C:\Windows\System\yusdcRv.exe
  C:\Windows\System\yusdcRv.exe
  2⤵
  PID:14516
- C:\Windows\System\KfCmFoB.exe
  C:\Windows\System\KfCmFoB.exe
  2⤵
  PID:672
- C:\Windows\System\CLcmfqE.exe
  C:\Windows\System\CLcmfqE.exe
  2⤵
  PID:7392
- C:\Windows\System\uMoUxgZ.exe
  C:\Windows\System\uMoUxgZ.exe
  2⤵
  PID:8416
- C:\Windows\System\fBjlDae.exe
  C:\Windows\System\fBjlDae.exe
  2⤵
  PID:8388
- C:\Windows\System\wYYwsSt.exe
  C:\Windows\System\wYYwsSt.exe
  2⤵
  PID:7428
- C:\Windows\System\ipFunwF.exe
  C:\Windows\System\ipFunwF.exe
  2⤵
  PID:7416
- C:\Windows\System\mYRPJEY.exe
  C:\Windows\System\mYRPJEY.exe
  2⤵
  PID:4404
- C:\Windows\System\RErMrge.exe
  C:\Windows\System\RErMrge.exe
  2⤵
  PID:5476
- C:\Windows\System\fhKemGa.exe
  C:\Windows\System\fhKemGa.exe
  2⤵
  PID:12240
- C:\Windows\System\lgfyxxp.exe
  C:\Windows\System\lgfyxxp.exe
  2⤵
  PID:10704
- C:\Windows\System\HVovtCy.exe
  C:\Windows\System\HVovtCy.exe
  2⤵
  PID:12632
- C:\Windows\System\JcEEamY.exe
  C:\Windows\System\JcEEamY.exe
  2⤵
  PID:12648
- C:\Windows\System\JFFdeqx.exe
  C:\Windows\System\JFFdeqx.exe
  2⤵
  PID:12760
- C:\Windows\System\bnDUmUT.exe
  C:\Windows\System\bnDUmUT.exe
  2⤵
  PID:10964
- C:\Windows\System\RcFHxeQ.exe
  C:\Windows\System\RcFHxeQ.exe
  2⤵
  PID:12880
- C:\Windows\System\HlCmEso.exe
  C:\Windows\System\HlCmEso.exe
  2⤵
  PID:14700
- C:\Windows\System\EJXuJSU.exe
  C:\Windows\System\EJXuJSU.exe
  2⤵
  PID:12928
- C:\Windows\System\rGHMBVB.exe
  C:\Windows\System\rGHMBVB.exe
  2⤵
  PID:1600
- C:\Windows\System\DeyLtet.exe
  C:\Windows\System\DeyLtet.exe
  2⤵
  PID:6584
- C:\Windows\System\QEfwKns.exe
  C:\Windows\System\QEfwKns.exe
  2⤵
  PID:13136
- C:\Windows\System\mdinBFD.exe
  C:\Windows\System\mdinBFD.exe
  2⤵
  PID:10176
- C:\Windows\System\XOODjqD.exe
  C:\Windows\System\XOODjqD.exe
  2⤵
  PID:14812
- C:\Windows\System\gPbjeCf.exe
  C:\Windows\System\gPbjeCf.exe
  2⤵
  PID:11468
- C:\Windows\System\AaAbhhI.exe
  C:\Windows\System\AaAbhhI.exe
  2⤵
  PID:5532
- C:\Windows\System\ZCziuXn.exe
  C:\Windows\System\ZCziuXn.exe
  2⤵
  PID:14844
- C:\Windows\System\YXcYfTU.exe
  C:\Windows\System\YXcYfTU.exe
  2⤵
  PID:8320
- C:\Windows\System\UYiIlTi.exe
  C:\Windows\System\UYiIlTi.exe
  2⤵
  PID:11668
- C:\Windows\System\TRYKtEY.exe
  C:\Windows\System\TRYKtEY.exe
  2⤵
  PID:8928
- C:\Windows\System\AzeHvaI.exe
  C:\Windows\System\AzeHvaI.exe
  2⤵
  PID:7744
- C:\Windows\System\LmtQpoA.exe
  C:\Windows\System\LmtQpoA.exe
  2⤵
  PID:9332
- C:\Windows\System\BuuVqlr.exe
  C:\Windows\System\BuuVqlr.exe
  2⤵
  PID:8148
- C:\Windows\System\DUIgjcZ.exe
  C:\Windows\System\DUIgjcZ.exe
  2⤵
  PID:11960
- C:\Windows\System\GzJyaGT.exe
  C:\Windows\System\GzJyaGT.exe
  2⤵
  PID:15132
- C:\Windows\System\qwzkBko.exe
  C:\Windows\System\qwzkBko.exe
  2⤵
  PID:12144
- C:\Windows\System\CvOIeYJ.exe
  C:\Windows\System\CvOIeYJ.exe
  2⤵
  PID:13420
- C:\Windows\System\cZgwFPI.exe
  C:\Windows\System\cZgwFPI.exe
  2⤵
  PID:8912
- C:\Windows\System\TyIasRC.exe
  C:\Windows\System\TyIasRC.exe
  2⤵
  PID:12576
- C:\Windows\System\yZFOLtN.exe
  C:\Windows\System\yZFOLtN.exe
  2⤵
  PID:8356
- C:\Windows\System\SBPreGU.exe
  C:\Windows\System\SBPreGU.exe
  2⤵
  PID:7336
- C:\Windows\System\pmQyblQ.exe
  C:\Windows\System\pmQyblQ.exe
  2⤵
  PID:15056
- C:\Windows\System\bUthIUt.exe
  C:\Windows\System\bUthIUt.exe
  2⤵
  PID:10344
- C:\Windows\System\vIqGUuY.exe
  C:\Windows\System\vIqGUuY.exe
  2⤵
  PID:7596
- C:\Windows\System\RxMzwam.exe
  C:\Windows\System\RxMzwam.exe
  2⤵
  PID:2124
- C:\Windows\System\NJrBRJd.exe
  C:\Windows\System\NJrBRJd.exe
  2⤵
  PID:8592
- C:\Windows\System\FAlEFuM.exe
  C:\Windows\System\FAlEFuM.exe
  2⤵
  PID:8196
- C:\Windows\System\RIRHkCB.exe
  C:\Windows\System\RIRHkCB.exe
  2⤵
  PID:10360
- C:\Windows\System\srDIkyA.exe
  C:\Windows\System\srDIkyA.exe
  2⤵
  PID:2344
- C:\Windows\System\bJVhpXB.exe
  C:\Windows\System\bJVhpXB.exe
  2⤵
  PID:7960
- C:\Windows\System\gJnqWyl.exe
  C:\Windows\System\gJnqWyl.exe
  2⤵
  PID:14312
- C:\Windows\System\sfbNlpE.exe
  C:\Windows\System\sfbNlpE.exe
  2⤵
  PID:368
- C:\Windows\System\NfsPBWi.exe
  C:\Windows\System\NfsPBWi.exe
  2⤵
  PID:15236
- C:\Windows\System\VRBFWEU.exe
  C:\Windows\System\VRBFWEU.exe
  2⤵
  PID:14192
- C:\Windows\System\rKjmaRG.exe
  C:\Windows\System\rKjmaRG.exe
  2⤵
  PID:8944
- C:\Windows\System\wThFbJC.exe
  C:\Windows\System\wThFbJC.exe
  2⤵
  PID:11912
- C:\Windows\System\YPCgbhZ.exe
  C:\Windows\System\YPCgbhZ.exe
  2⤵
  PID:6704
- C:\Windows\System\xhOFwCm.exe
  C:\Windows\System\xhOFwCm.exe
  2⤵
  PID:10836
- C:\Windows\System\SnUIbKN.exe
  C:\Windows\System\SnUIbKN.exe
  2⤵
  PID:15352
- C:\Windows\System\EiUUYYx.exe
  C:\Windows\System\EiUUYYx.exe
  2⤵
  PID:11344
- C:\Windows\System\qHFdUMf.exe
  C:\Windows\System\qHFdUMf.exe
  2⤵
  PID:15320
- C:\Windows\System\CBvWqbW.exe
  C:\Windows\System\CBvWqbW.exe
  2⤵
  PID:5504
- C:\Windows\System\MuJDtHL.exe
  C:\Windows\System\MuJDtHL.exe
  2⤵
  PID:3244
- C:\Windows\System\VkIhyVc.exe
  C:\Windows\System\VkIhyVc.exe
  2⤵
  PID:12296
- C:\Windows\System\xfDdGmH.exe
  C:\Windows\System\xfDdGmH.exe
  2⤵
  PID:12172
- C:\Windows\System\uBomrGQ.exe
  C:\Windows\System\uBomrGQ.exe
  2⤵
  PID:12548
- C:\Windows\System\vrkrkqQ.exe
  C:\Windows\System\vrkrkqQ.exe
  2⤵
  PID:12276
- C:\Windows\System\YKxkmYN.exe
  C:\Windows\System\YKxkmYN.exe
  2⤵
  PID:10544

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 740 -p 11576 -ip 11576
1⤵
PID:6304

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 672 -p 11592 -ip 11592
1⤵
PID:13232

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 684 -p 10896 -ip 10896
1⤵
PID:8764

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 552 -p 9720 -ip 9720
1⤵
PID:14260

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 832 -p 10060 -ip 10060
1⤵
PID:7312

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 968 -p 11176 -ip 11176
1⤵
PID:8360

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 1012 -p 7548 -ip 7548
1⤵
PID:14172

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 1044 -p 10584 -ip 10584
1⤵
PID:13332

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 1140 -p 11352 -ip 11352
1⤵
PID:14236

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 1152 -p 12552 -ip 12552
1⤵
PID:9924

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_1eizhjla.1d3.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\BNoOsXm.exe

Filesize
766KB

MD5
3ed6e13e0d6d2d8a0577040f2496a9cc

SHA1
8fcc751dc975ea2db9d79cdfb46246ffd0431928

SHA256
9c41dbc0f6d07020f6e7918a29c9f5b021ab1c060d808ef63dac26c93f89616a

SHA512
9c51b2260bb9a361e28e4f9bfaf26a649fb0c4b3e5fae3324c84d1bdf8b70132146b2d5a14e4b038e561256df103b24f6532bb68ccabd31bfb3aa10b23008518

Download Submit
C:\Windows\System\BPVOCQm.exe

Filesize
18B

MD5
00b0f39654ab5bf7c3f0227fdf1baad6

SHA1
554112c42855b7c59686e983abf4c82b54132afb

SHA256
40e8d7ea8f0d043860c46e9da59d168d5e685eb191d43b899ea7889e47237832

SHA512
9321beb9d195ad01fd3b8ac93ee0e1eaae6d34f8b55c63d7d6db58dfa0d2ca7275985a10d973f537e94d5c40e283e5ad772e4283b0ed246aa1f05e4567e6f193

Download Submit
C:\Windows\System\DDBUdiP.exe

Filesize
769KB

MD5
864ee7e41a8985178ea408e9ce192c72

SHA1
210e03ce9a378606f06a456094d055a8fe1c8b70

SHA256
a16bdcdbc314256d33c416cdd870525ba6e22b482dce55622f63f54defcb63a8

SHA512
82f0fa484dc599fc7888f5918ca0d6a362428d96048077621504279f8cb81005e67dabdcfbde21574b4e0ddf2f4be44f9c84c8c016523bf8aa3925cca360f73d

Download Submit
C:\Windows\System\EETAfVW.exe

Filesize
762KB

MD5
c9cae04677f1a5425265ed5a0f718f53

SHA1
676fe26a0e50cc4451f66e8ace2ea33c2a3a06ff

SHA256
5eca583ea9a7896ff2e77f825f108f98b9b3bf91dde4c7e01dccaf483b3e28cf

SHA512
ad2ffbe523b47fb3d2166711af48237e0ac3300f0b76b780759bd7ea565d4cd3351c8a18bf02960959bd91711673dda9fb68c23d5ebb095a448e27e57e7c4787

Download Submit
C:\Windows\System\GTsGXQJ.exe

Filesize
772KB

MD5
2232ac84045b7deadacab6eb867075a5

SHA1
3654d8299a119081afc89dc695ae702fa386c8de

SHA256
b454d4ec339bf9982a5d035b5fe899f5170fcefaac07080818e293ea7538d726

SHA512
10810e542ada5e08d07dc01cf2de793c379616b9a9ee088e839cb5c1f95e036e74ff7c7a87bfe03a9c398e82e4d410cab56dba354d2322f01e5d590069367901

Download Submit
C:\Windows\System\GZqaJDZ.exe

Filesize
763KB

MD5
21d6d62f6959ab4c0877da223aed6222

SHA1
8dc674c0fc9c8b00f2ca766dabfa5c2241188f7f

SHA256
73363718af0b55057111231475b174adfbb8e580ca3591117f94d1214200314f

SHA512
0fd7640e267b38a0df8c0a41fa7873f1c2bccb11ec142b06fe10561e10eb126b47df103bfd0fcf4c9ba6bcb512442512c104690273d3af909f5ea782c7f0831d

Download Submit
C:\Windows\System\IOxthay.exe

Filesize
773KB

MD5
39076b2d47cb7fbd25783a623956501c

SHA1
9fe364438accebd7f55e2973a72790ffe53b9935

SHA256
7c09eac1e9e00fce9c599a015b4d265f6290422d83fa2afa8ed2917e3d5cb37b

SHA512
d5e21a69dc22f8e8c732489ceb623a23420dfd358937428070bc78a95b0298e267a302da7cdcb2b3da33b904a495627deaa8b1a8b8092fc488039d32901252a3

Download Submit
C:\Windows\System\IgJpXBj.exe

Filesize
769KB

MD5
f4f15a8987af874ab9a49b918eb9336a

SHA1
1f1c4684449ad77eabc2b39be14b8b793cab4a52

SHA256
8bd0f8c9fda745b69d77ab10dd0e5db6f464aae768e5faf9a5f3452befd656b6

SHA512
4716e1db105c0cfed7cbb017f61af1548f4da563fa29f4e1773174f1fc003dd1e62f810a286a3a3cc5c4a20d500158d26680fe75c758915f221f746d99d4497f

Download Submit
C:\Windows\System\IuFmRkN.exe

Filesize
766KB

MD5
fb3ce0ea727e607d4509e5d9904df767

SHA1
d2a7158198e0944d80270da11a223f03070ded4e

SHA256
5cb2293b90bd189e4728bd561f3f2f8c4ee4b9f8eac3ec168fdd3ea0a85bc568

SHA512
10ca45c414e426dc7859c437147502a17d07fc0c3095ff5f897fb580ff8cc211397c02a03b1db5d0b6ab61d87c438a4e18c2b382d827e0c4f3d6dbfac51909c4

Download Submit
C:\Windows\System\JqDaxFW.exe

Filesize
765KB

MD5
bd0dcfcbea58c7f264b702a4e6665490

SHA1
275f047cdb11f74ac29b328ca5507bb0cec5e662

SHA256
aeccf3b7a7a3a9b31bd95baef97045217c1513bd34d979a86c494d33db1aee19

SHA512
453f414724b297d4c0598fdfa5a612d4cd405bb6b3156da6461b5cbb40c1b81dcb104740ae1911bee3347bae2dbef0770dbc48498c4bb22eea79c28dc62a80c2

Download Submit
C:\Windows\System\KdJFtcj.exe

Filesize
771KB

MD5
117aab1da304cd1dd48738b5e2f7271e

SHA1
f63ca53b3d482990ddbfee202a4a20db8883450a

SHA256
15297e2f1dfaaccd1e108b5c0e05f8903715ab0da031be54cc7454e05cbd88be

SHA512
6dc1b88ba08be1df8a0506860a9cac1db183df132fc799f0b34bb6f4edaae6e7ad2bed703b01b3b6f0fbfb6cafc8b63d83b7169071ea3b3f10f50527adda9739

Download Submit
C:\Windows\System\MLZZTaK.exe

Filesize
769KB

MD5
fbe70efb14346f594b1b1f548f48132e

SHA1
0439d3cc3a21677b69540e6ba70999a4819af673

SHA256
98a192f94f682bb5c8d23d8286ae908ab2cda680ea2f9b2cc01e7daf08949a2c

SHA512
d2f303db3253c5f37981998a1e43c875150cfb24e6fa26997d044e631e64d31ad44bd0b7cb109e38a4b57e42fa6ebb4ae88a273f5951b108bfd14bcfb2a409b8

Download Submit
C:\Windows\System\NypyJNf.exe

Filesize
768KB

MD5
ab7e511b3431834cfbc67a5c41ba7dbf

SHA1
a598cf9c81878291f1a52b8a83f856dac1cad4c3

SHA256
9cdd620539b1021204a7757a5ccb92a83dbe96a8560e7392a295801bc62a422e

SHA512
3e4fdbee44506ffd72feb97bcc00450c110b4c32180982453854829e472ddd050beb826dfe1be500d59e289768cbe6d992f458f85604201f4524686f9a572ec0

Download Submit
C:\Windows\System\PDKXikB.exe

Filesize
772KB

MD5
6266baddc4045c3f38adfcb95e8d7c6b

SHA1
cb242b9b8ed7b0ae7e2365b421abaa502307217b

SHA256
71a71799ba66c26439ee297d42846d149a3c3b63770c194607691149f5ad959c

SHA512
d46d575d9d558629e83e81708546a6294ee4ef0c914f14fbac99b9a56c983c6197917a664ab8f5cc5b4d84d4361de9fa67cef08b9b695617538557c5d32057ec

Download Submit
C:\Windows\System\PkNmlHI.exe

Filesize
765KB

MD5
87c01f7beb00056b736417fc70fbd25c

SHA1
976783f9ff2ff50f9260a00351d754883b7f95c2

SHA256
9faac43d0b4c7e8ab3c4c046d4568fd27393cce446ec70cfa2ea94ad136476c6

SHA512
7a7214285ba96828c9cabe600c50cc3e2e39347a381169ef6eacb47d0ed4e01f982b40185a112e6f7c2658be28cef4fa3acc0b9e0f8aaca0fd47d4ae903dd841

Download Submit
C:\Windows\System\PokDYfA.exe

Filesize
771KB

MD5
e930db88dabe137722f8500adbe15974

SHA1
18485d84f03cc32428b370d24d43ace6278d6e84

SHA256
614946f2204bba21c0cf9666a4df81885a8765d04bf759273caab30a698fea51

SHA512
58c575f46e607a64b90ab9c2ba936dd07859b4e09c982e0acb65625a0b76167fcef43d4e688132d497a02fc8d9d51a55b0711e22fc3d465508be9f5148832641

Download Submit
C:\Windows\System\RLCEAeG.exe

Filesize
770KB

MD5
ffed89a11b6e90475e59278c6f53f7e3

SHA1
6d0e4c8ab059b69477772422d5238852afde6433

SHA256
2e9a2790564d9e1b6884269df0cf1ffc8d84d67571906a87f44d8a23b0b7508a

SHA512
9526e59bbf3b769b40ba5cc8fa9bc323fe6e44b45116e8ea2012a9f893ba32f0e89ea4d41c95e64be99735902f0df752d124be168d3213b8a7df34ac4da462e0

Download Submit
C:\Windows\System\RSAlcTm.exe

Filesize
763KB

MD5
a23bcd18517791fdedd2402ee8908705

SHA1
a1d04439a2cd626d748aa9c9d6e2733e7dc29e3f

SHA256
a5bf3cd0f68fb419f6d1fad44758f7931137788208847338a7d08c4d4aaa5af1

SHA512
d4c73536eaf9ac35251c92425b3c56839692d471c0d6270ba34fc886ff39e162884b0129c292bee5204dd80fef93b78886546ab67eed9c33a6868e86016d3386

Download Submit
C:\Windows\System\SIKlNcK.exe

Filesize
769KB

MD5
63b7e5f1188c98bfe760deb7f6fb26b2

SHA1
f6ab718c52347af42d8937bafd72e93ba1daf888

SHA256
791ec4beefb4347a16e28b282a5628438630535dda7601f52f1de1f6c6d668f9

SHA512
da7ffeb650eb91d237b69618e7937bb01b724bd4420237d22d186b48d6371fb27c58b883471499955f63f45c82fb1b03e6cf8b21998806926a1462d3009b8b8e

Download Submit
C:\Windows\System\SkCXxyA.exe

Filesize
766KB

MD5
8b663aadf904db0a90b10bd2078a9230

SHA1
0474a8f9a2e45bce5e6f047964ff0f7a9b25b502

SHA256
812b613a0f5ef6fedb7e6f58e51644985497394356722ba736b7b2b25eeab1b6

SHA512
cff6196bd7ab8ac1679a6f6daa01b31d8dad22744a3a299513889bc093e8d7aca5aec526f8b00d1bbe41e77c1599a7d269a37a2d1822cb2b80753479f801ed3f

Download Submit
C:\Windows\System\TUyEyPP.exe

Filesize
764KB

MD5
9ca42611bdab3a37cbe0e347ae53eb14

SHA1
9171dc42a0724b93faafe089f8c4c900e3f59367

SHA256
72ddd9f5968f8637e2a0a933ab875d7ec659eccf398cd3e1df39b1858c5da839

SHA512
be652db9550f2cd21c03a667df5625e7d9635e399cd4f0c090634106510622da08fdc99699ad78c5620bd37214e20c17853880b96d64249ee2c2a306de6278e6

Download Submit
C:\Windows\System\TwpwHUA.exe

Filesize
770KB

MD5
5f5439b20d374cad7e9a0185a9fb4f21

SHA1
c02dbb541a07aee6d37ba0577acc4010c9955968

SHA256
687edf9767e00065e890ee6b71975d7cefa9b2dc59e7707646c931e987de46e4

SHA512
8fec30dff61eefe5835e9aa46fce8317055f173d54c9546134ccea69532c3a1f0d02a58f8a413f20f7dd86beb261f104453bede0324536b02fad3135d867422a

Download Submit
C:\Windows\System\VREzGPp.exe

Filesize
767KB

MD5
4bb3c260af49643da4774db2ad6d070f

SHA1
d6ed608a48b389cc75fe442f525d2ada6a04aa4a

SHA256
1eeacaae8c4acdae43eee2f575858a8072bfc3b1791368a7cf50198fdad8b1f0

SHA512
057aea5e9f85e9c5772c9f4f5d175cb2f5f01184314e553a676ef5c22c97a5cebddaf24a47254c05e063cf4766266bdcee52404d2f8ae91b8765cf70717cfa78

Download Submit
C:\Windows\System\XByEBSq.exe

Filesize
766KB

MD5
990d2736d00cde8203edf4c43ebb1f1f

SHA1
52248848530181afd5d9d59bde82b3fa48851f93

SHA256
363afcde9a194ce9fced1dbdab73532536734f515aeb9e8559b7e2d7eae0b8d1

SHA512
868531596f205128ce9cda2a0a5d784ef058138644de9e573cc13a962446cb895837b7e1c0046d827bf05ff7f4637450baa8a71fe05d99da3ff04f1063b2676f

Download Submit
C:\Windows\System\XQemeEg.exe

Filesize
772KB

MD5
0ade99d2b1b604c68f805d40daca2eff

SHA1
c204f5be81ccd2a72cd268da889e167af775817b

SHA256
ece89981be57ec272d1410d9894763884c2b873bc1782c12c5e7da9a55d79d39

SHA512
d3c3dca2a11a6595609254348746ad4e47b0244447a0fda375bd0fc4c01492f6512aa1980026a37a52f945adaa957e737bb01d193942687d6b4c2347fe8394fa

Download Submit
C:\Windows\System\ZXEGKWM.exe

Filesize
764KB

MD5
ac3ebad637736352ae2e3fd4765f7f32

SHA1
8579e27bfa93ed3cd62d016ed3874646d45de2c0

SHA256
e0f970504c704ef69a26711e8baa9bb70c2e51fe6feee72f7f60c92905deb286

SHA512
4e33d985608aa9e1432a641f777c0f145150aea4b1a183fc60e5030eb82c07c427127c641799ce1b0e88f04576bc082d021399acb3c2e8f949f82980d6cee1f6

Download Submit
C:\Windows\System\ZYopXXz.exe

Filesize
765KB

MD5
665eb6b30c5d0eb012290bf6d3710fe0

SHA1
43e055f909d30c88a8e42372b7b1e68d71ca857e

SHA256
7f79087d99721d0e73bcbb1e87c3db94b2d0bd35e0c65c23ce17031f35128527

SHA512
cdcde267ef00a65d637b3daa759259d73bc92fe1ad5d32ceeaafdaaba03ff1f4700b9e0805673ac6907ca3b0bc82a88aa8c86eb8799224d9fc3deef08f69cdde

Download Submit
C:\Windows\System\dkdODus.exe

Filesize
772KB

MD5
d0e42d3e3c0bbaacc861d6063d906496

SHA1
48a4fcbedd8cdcb79eaec3a373558ebc6485b115

SHA256
2b19859cae1bee41b17fa40af7932f8568862f743b35107cde63b2aff39bfc0b

SHA512
119a48b039c7ae69162107996693a5034a344ee5f47a3308486de9ad881370bdfb5dbe926f06ff5f18f9f98a83e514f2b7942fb85107ce8e67d8f03d5265bfe3

Download Submit
C:\Windows\System\dyqxEyB.exe

Filesize
763KB

MD5
6dde04f062bb7fd58b3e3dc7b724e4dd

SHA1
db079f323f714e9b520a00b8a8219c863f460e14

SHA256
07a584d178227d1a8eb548dcb373eaf67e9002fc6d13f09b1abd0253bce4ab07

SHA512
c01157d022b5f8f7133366340ae1e61e32a1ebc189c0fac6de52dd61e4960baeebb9f2f08d8c68470685fbf556a9337d7a5dfcfa865009530f5c3a620b1bba85

Download Submit
C:\Windows\System\gFKCzWm.exe

Filesize
771KB

MD5
be1b568d50947b5d158d562b1d34a48f

SHA1
e5b561a18396334c387f1af672272d8cc4d322eb

SHA256
e24bc702cbe55edb4599769494faab9cdd6c074032c54e1b0a9d90fd63b6c912

SHA512
446b446fabc58603d3dd003d40b945a56813323d705f138668ff5a2728a8f87e71c1d47ae7e947100338ca028a89b2d9cf4ed9adef47cced6808f83d09fc6053

Download Submit
C:\Windows\System\hOZFppt.exe

Filesize
767KB

MD5
113ece84b40f42e45d185f4f6a371b60

SHA1
98fc96445a23b6434b85521be76a1140e391fb0b

SHA256
699e66c74104fa5b1a787bd157f7952f69a1d2761eb0e2f7a19093ddbee380bd

SHA512
148167bb6580615cf7f4778b61f14b8454fc77c724b1a24c7bef2ad5bb3ea712a4c25edc1d9116eaeb866f1eb237fa62220a20a93955546ef81f8b349b905e16

Download Submit
C:\Windows\System\iPZfgop.exe

Filesize
765KB

MD5
8deb46a89211a8f39dd582ca1c761bb3

SHA1
270a0e54144dfb614efc12ffa12e25dac1cc5ba6

SHA256
e8f47d6b6405df01f6512e52ee8c1de26ec691cd1a4348627d45916195659ded

SHA512
b38f1a65c02f58975732ef4c6410c1752a05e9672be29d15d44b174561eb8f9145b55d01758e55cb393670bc15698bd6f487e941a590a673266b43a64f9ce9d9

Download Submit
C:\Windows\System\knamVxo.exe

Filesize
764KB

MD5
269b05e5c13b85837866f1c5d5484ca0

SHA1
4b5018582a1c77a14a63a4e1a3317d278b04770c

SHA256
21c07050c679fc6320532dd5cd1075da51a7f433d5c5da7b854a2aa8e66ecbd2

SHA512
ea74362fa000db214585d91f49082b5b396252649ad246624b37cbad5ca39e977a68d640a8165d334bf33b5c1b0e009a16607428cd6260a6a6c885033d621039

Download Submit
C:\Windows\System\kyFijIn.exe

Filesize
768KB

MD5
14209ac57b443445526b758ab138e272

SHA1
cace50501164f7c2223713c7a2a5493073719c1a

SHA256
9f45702f8968128ec21d4f65e12cb57fe028cf48741d60eed8edff9b85ec4f00

SHA512
d0b24af416305d969c9d96144fe9c2a25dcaef024869e41e38467ed20393d97f2cff17c561da2e663c03f4e1f2979e16a3d00056ccc05960fe509f68c5bf9490

Download Submit
C:\Windows\System\lGGezxE.exe

Filesize
773KB

MD5
2fcc7b9d90a3ddaeeae0b9b693c8aaa7

SHA1
b281ef8090dc8e7da02fb7f9f0f6fa107ec67218

SHA256
f3094d14cb91fcf20127808cbf6d4050467effd6edee8b472a37c2f46cee3bc6

SHA512
4a2119466207bce4e7ef854a3e7af40ab448428d59993e95d21a33fc04c41efd1e3932832c8e869ef41e88b74aad1740d5cf74a0de401d814e656aa86f75f3ba

Download Submit
C:\Windows\System\mtqCDyt.exe

Filesize
767KB

MD5
cf3fd75ede7d0312b4114d607edcf94a

SHA1
5282b8955ab1fe09b17c500076891d87c29236e1

SHA256
f10530aed820373280e6016b92708b060eccd472234e06e39ff362ec78e0d00e

SHA512
19cc8c02e6477736f9fad96da439af2e1b0ad0858d5823dfc8406ecd9512466e8efecd88d75be2b17cdb32340688ac8e07d94248c88a4d193c550f50c779bcc8

Download Submit
C:\Windows\System\oHmsjIY.exe

Filesize
770KB

MD5
f5d378932a7c7dd5c77069e4126c96fc

SHA1
16db1bd8fa577e8da5c5fad14950060855bf5073

SHA256
9ae4c34560dbba77aa48b39503c06bb7d3d91ac0d369233821565bf17e2f3225

SHA512
e9d525d7fa540aac459d8a38403c5ec9f1ac0ddbb741106cfdf990bd62104c320d528363ac61cd2cfb003c92d94c7df5bcc418583d1b8bc618e02eb2238aee14

Download Submit
C:\Windows\System\ohBULBS.exe

Filesize
768KB

MD5
18b83ff2567c3e0f033acd684752578c

SHA1
787d9e1253c9e88f6824b30ea28158c92efc4b02

SHA256
e75c1b153be3eeec9292b7242090c0666a64ffa02188e2de2ed53c35b4d6dd0e

SHA512
6827cc49d76300faf992b6634e274559b9d308eeb9fe73982d922c81dbe469448e959dfdaba732371d70dc1217c6bc6c279d5ed63cebcf4992e7920ba4dea9d8

Download Submit
C:\Windows\System\oztwRBW.exe

Filesize
764KB

MD5
0b2d0a492e982941aa3ef12e51ae8dbf

SHA1
8b4c5ec10325dc95f00b8fe01957b3401a458f44

SHA256
e5a31512793db5550095902400ac7ee0999376acf0db00eaf9546e400c15a50a

SHA512
1b3953edfba5bf9aacefd4011a6b82b20f1bdb3297cd4518b5551742496da96144a04fe584b7099656f3f1ee1ba5918ec4f3ad60b5799c98b1e7af7b32897832

Download Submit
C:\Windows\System\pUqnOye.exe

Filesize
763KB

MD5
d2fb6e4ba2b31f2325cb519fa83d085b

SHA1
41ac29e7e1f69222bd52f8f410b4993fc54d0352

SHA256
e4c66598f9f2253d3b3967a0a459ca7e642a9661b0e196d01be30178d0afa37c

SHA512
922776c9d229b1a1cb13428035263334af8d4a571cf43a1c713fe6e649601b11dcb406957f607a57a4f584909295fe185bda81b3d05b937a35efda395733dbd4

Download Submit
C:\Windows\System\rpYUvNl.exe

Filesize
773KB

MD5
84e5367b9f9eab77631358f2a3dc336c

SHA1
4bd890f134d2ac116073378ca76af945457f4a14

SHA256
4dffb51a6ca81342efdece8579319edac0d2cc2c1d8e97e0298d2dab3f844b07

SHA512
062d49232836a2c15344a70d319779c03ad7d8c0d6c18fc3e1ccb939407dbab496a9743b504cff6801b1bcce22a4cc9268b41cfaa1bc9ed19c6d38a9c0d46917

Download Submit
C:\Windows\System\uAdCEwW.exe

Filesize
767KB

MD5
4cbfae483e90e1df3af19118059fae14

SHA1
59b339f199db7eb44bc85b0612b6c1eaa0ba8606

SHA256
9ce0af091b8471ca59429ccb35a36a0da8abbece312e223b05cd1e7ecf8d9933

SHA512
9df084f4455c6960ec816d938af4013ebdf06abe4daf4f61c735dadc62de5f0650eb7c4d2447fe7a1258ee9c52e90ba5f8c4db1b068b7097ffd935497c33d16d

Download Submit
C:\Windows\System\uHRqnBQ.exe

Filesize
771KB

MD5
3f05c5bbdb2d59d58a568608abc279e7

SHA1
d441ad0d3ec6a7a2537ea7a771ef5132a9c634b5

SHA256
1c7cf0e822c94dab4ea977f9564f6f485be2a5fbe9523541444b3132fcd319b0

SHA512
32f463cf8ac1a35629fb267847fd857e653328649c013e484c2cfd75a7e0f3807437de3fd21e071120d4cfb76441ae84b1f307e3493a7bf475179ac6aaaa3274

Download Submit
C:\Windows\System\uYqBhjw.exe

Filesize
773KB

MD5
91082d2b8a05beeef2bbdb8df5998657

SHA1
6594e9c4a75083b6310044f41183c432a23f81e2

SHA256
d1cec53405acea03f22a676e3cb297578bc644f86efe7030c6e65aa668cd93c7

SHA512
b1f05d03141a6504a489f267d2767d73131d4c5194f57a6fb33c69f471d51c3eb129251225b9bc43e60341194c4e48ccdafe3fb1778d68cbbc9e1744fedc3bd4

Download Submit
C:\Windows\System\yOehabv.exe

Filesize
770KB

MD5
68cac67aa94755033e1ec8eb5d5dc40d

SHA1
efd2cd94f887e06455b0143f43c8f4c37dd50c35

SHA256
cec4f3da49e7a8929bf5addb16a8fab841f2ca3c985c0ab57860de6f587a2a2a

SHA512
275607777c221252cb3ab05977bf44c66abf6cc399cadad7bfddb5b02fae267c10f45a0417e59beae1dd2ea9667899b15e29b97c1feb896cf7ea8faff7bfaf00

Download Submit
C:\Windows\System\yzvEaav.exe

Filesize
8B

MD5
65ac1ec2fd4840d1c6eb2a8b887a487b

SHA1
b5d6c4ea65bd22a8728428b5f9a32114dc7babca

SHA256
c241010cf4f54b519f8794ec8170d98d304c28f4f5a0bcf0cfcb7fac46f54f49

SHA512
6eaa0421e703c6f64f45af7a0be47816e86199fc913d936c2af33e2442508ea1b8b30c7fbcffc4266d366fba5d4971cb1ec872985dd80e5655efed7e7bdb36f8

Download Submit
memory/384-6959-0x00007FF616C90000-0x00007FF617082000-memory.dmp

Filesize
3.9MB

Download
memory/384-803-0x00007FF616C90000-0x00007FF617082000-memory.dmp

Filesize
3.9MB

Download
memory/1012-7115-0x00007FF6AAB70000-0x00007FF6AAF62000-memory.dmp

Filesize
3.9MB

Download
memory/1012-802-0x00007FF6AAB70000-0x00007FF6AAF62000-memory.dmp

Filesize
3.9MB

Download
memory/1300-6953-0x00007FF6CE340000-0x00007FF6CE732000-memory.dmp

Filesize
3.9MB

Download
memory/1300-800-0x00007FF6CE340000-0x00007FF6CE732000-memory.dmp

Filesize
3.9MB

Download
memory/1524-6942-0x00007FF7C43B0000-0x00007FF7C47A2000-memory.dmp

Filesize
3.9MB

Download
memory/1524-796-0x00007FF7C43B0000-0x00007FF7C47A2000-memory.dmp

Filesize
3.9MB

Download
memory/1700-791-0x00007FF65D520000-0x00007FF65D912000-memory.dmp

Filesize
3.9MB

Download
memory/1724-795-0x00007FF7C8700000-0x00007FF7C8AF2000-memory.dmp

Filesize
3.9MB

Download
memory/1724-6704-0x00007FF7C8700000-0x00007FF7C8AF2000-memory.dmp

Filesize
3.9MB

Download
memory/1836-395-0x00007FF708430000-0x00007FF708822000-memory.dmp

Filesize
3.9MB

Download
memory/1836-6798-0x00007FF708430000-0x00007FF708822000-memory.dmp

Filesize
3.9MB

Download
memory/1948-6735-0x00007FF66D810000-0x00007FF66DC02000-memory.dmp

Filesize
3.9MB

Download
memory/1948-173-0x00007FF66D810000-0x00007FF66DC02000-memory.dmp

Filesize
3.9MB

Download
memory/2140-6772-0x00007FF65A920000-0x00007FF65AD12000-memory.dmp

Filesize
3.9MB

Download
memory/2140-793-0x00007FF65A920000-0x00007FF65AD12000-memory.dmp

Filesize
3.9MB

Download
memory/2556-483-0x000001CA27410000-0x000001CA27432000-memory.dmp

Filesize
136KB

Download
memory/2556-15-0x00007FFBF81B3000-0x00007FFBF81B5000-memory.dmp

Filesize
8KB

Download
memory/2556-790-0x00007FFBF81B0000-0x00007FFBF8C71000-memory.dmp

Filesize
10.8MB

Download
memory/2556-168-0x00007FFBF81B0000-0x00007FFBF8C71000-memory.dmp

Filesize
10.8MB

Download
memory/2680-1-0x000001EC7E730000-0x000001EC7E740000-memory.dmp

Filesize
64KB

Download
memory/2680-0-0x00007FF7EC590000-0x00007FF7EC982000-memory.dmp

Filesize
3.9MB

Download
memory/2824-804-0x00007FF67BBE0000-0x00007FF67BFD2000-memory.dmp

Filesize
3.9MB

Download
memory/2824-7064-0x00007FF67BBE0000-0x00007FF67BFD2000-memory.dmp

Filesize
3.9MB

Download
memory/2904-640-0x00007FF7A2FE0000-0x00007FF7A33D2000-memory.dmp

Filesize
3.9MB

Download
memory/2904-6917-0x00007FF7A2FE0000-0x00007FF7A33D2000-memory.dmp

Filesize
3.9MB

Download
memory/2912-14-0x00007FF713B00000-0x00007FF713EF2000-memory.dmp

Filesize
3.9MB

Download
memory/2972-6949-0x00007FF6ABCE0000-0x00007FF6AC0D2000-memory.dmp

Filesize
3.9MB

Download
memory/2972-253-0x00007FF6ABCE0000-0x00007FF6AC0D2000-memory.dmp

Filesize
3.9MB

Download
memory/3220-797-0x00007FF715A30000-0x00007FF715E22000-memory.dmp

Filesize
3.9MB

Download
memory/3220-6870-0x00007FF715A30000-0x00007FF715E22000-memory.dmp

Filesize
3.9MB

Download
memory/3732-647-0x00007FF6A3CF0000-0x00007FF6A40E2000-memory.dmp

Filesize
3.9MB

Download
memory/3732-6731-0x00007FF6A3CF0000-0x00007FF6A40E2000-memory.dmp

Filesize
3.9MB

Download
memory/4020-794-0x00007FF6A6810000-0x00007FF6A6C02000-memory.dmp

Filesize
3.9MB

Download
memory/4020-6825-0x00007FF6A6810000-0x00007FF6A6C02000-memory.dmp

Filesize
3.9MB

Download
memory/4040-792-0x00007FF759B90000-0x00007FF759F82000-memory.dmp

Filesize
3.9MB

Download
memory/4040-6844-0x00007FF759B90000-0x00007FF759F82000-memory.dmp

Filesize
3.9MB

Download
memory/4136-547-0x00007FF705930000-0x00007FF705D22000-memory.dmp

Filesize
3.9MB

Download
memory/4136-6848-0x00007FF705930000-0x00007FF705D22000-memory.dmp

Filesize
3.9MB

Download
memory/4372-805-0x00007FF6AA620000-0x00007FF6AAA12000-memory.dmp

Filesize
3.9MB

Download
memory/4444-6756-0x00007FF77DA00000-0x00007FF77DDF2000-memory.dmp

Filesize
3.9MB

Download
memory/4444-300-0x00007FF77DA00000-0x00007FF77DDF2000-memory.dmp

Filesize
3.9MB

Download
memory/4540-798-0x00007FF6100D0000-0x00007FF6104C2000-memory.dmp

Filesize
3.9MB

Download
memory/4812-6985-0x00007FF72EF80000-0x00007FF72F372000-memory.dmp

Filesize
3.9MB

Download
memory/4812-801-0x00007FF72EF80000-0x00007FF72F372000-memory.dmp

Filesize
3.9MB

Download
memory/4868-799-0x00007FF6EE520000-0x00007FF6EE912000-memory.dmp

Filesize
3.9MB

Download
memory/4868-6910-0x00007FF6EE520000-0x00007FF6EE912000-memory.dmp

Filesize
3.9MB

Download
memory/4984-464-0x00007FF764090000-0x00007FF764482000-memory.dmp

Filesize
3.9MB

Download
memory/4984-6781-0x00007FF764090000-0x00007FF764482000-memory.dmp

Filesize
3.9MB

Download