xmrig | 3696aa021fea35d2f070c141da24c4b1b2bbe6f679a4eb26133d13745fe9ad0d

Analysis

max time kernel
133s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
01/07/2024, 04:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
3696aa021fea35d2f070c141da24c4b1b2bbe6f679a4eb26133d13745fe9ad0d_NeikiAnalytics.exe
Size 1.8MB
Sample240701-ffc61swhkf
SHA256 3696aa021fea35d2f070c141da24c4b1b2bbe6f679a4eb26133d13745fe9ad0d
MD5 252c22fb59b3a951ce7824d041685160
SHA1 2673f872fc31b35a7d45c001210b01792ac6b8bf
SHA512 5d04716c6e8542b245a1325cc5f67dc7ffde9d6be79bd8dba0b80c7d4c9de4e9b902005f17c6b5ed7d061f73729c9c25dab4fc5bdceebdfa3bbdfb0181ad331c
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkipfzaCtNcQcAupaXHeY5HmsoKTQXvaW9Rcps9kdie:Lz071uv4BPMki8CnfLv3zQXtTE3Z
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 47 IoCs

miner

resource	yara_rule
behavioral2/memory/208-48-0x00007FF7DFAA0000-0x00007FF7DFE92000-memory.dmp	xmrig
behavioral2/memory/4528-134-0x00007FF66C770000-0x00007FF66CB62000-memory.dmp	xmrig
behavioral2/memory/3156-139-0x00007FF72ACB0000-0x00007FF72B0A2000-memory.dmp	xmrig
behavioral2/memory/4436-144-0x00007FF7AD6E0000-0x00007FF7ADAD2000-memory.dmp	xmrig
behavioral2/memory/4416-146-0x00007FF6319F0000-0x00007FF631DE2000-memory.dmp	xmrig
behavioral2/memory/2860-145-0x00007FF7EFE80000-0x00007FF7F0272000-memory.dmp	xmrig
behavioral2/memory/1920-143-0x00007FF65DE80000-0x00007FF65E272000-memory.dmp	xmrig
behavioral2/memory/4352-142-0x00007FF628630000-0x00007FF628A22000-memory.dmp	xmrig
behavioral2/memory/1912-141-0x00007FF72F350000-0x00007FF72F742000-memory.dmp	xmrig
behavioral2/memory/3600-140-0x00007FF7F0A70000-0x00007FF7F0E62000-memory.dmp	xmrig
behavioral2/memory/3808-138-0x00007FF76C3D0000-0x00007FF76C7C2000-memory.dmp	xmrig
behavioral2/memory/4168-137-0x00007FF6ED260000-0x00007FF6ED652000-memory.dmp	xmrig
behavioral2/memory/2036-133-0x00007FF75E120000-0x00007FF75E512000-memory.dmp	xmrig
behavioral2/memory/532-132-0x00007FF735B80000-0x00007FF735F72000-memory.dmp	xmrig
behavioral2/memory/1540-126-0x00007FF60A200000-0x00007FF60A5F2000-memory.dmp	xmrig
behavioral2/memory/4556-125-0x00007FF65D5A0000-0x00007FF65D992000-memory.dmp	xmrig
behavioral2/memory/4088-119-0x00007FF600360000-0x00007FF600752000-memory.dmp	xmrig
behavioral2/memory/5112-110-0x00007FF753DC0000-0x00007FF7541B2000-memory.dmp	xmrig
behavioral2/memory/2044-109-0x00007FF6AEF30000-0x00007FF6AF322000-memory.dmp	xmrig
behavioral2/memory/3584-101-0x00007FF620B90000-0x00007FF620F82000-memory.dmp	xmrig
behavioral2/memory/3492-90-0x00007FF7F6400000-0x00007FF7F67F2000-memory.dmp	xmrig
behavioral2/memory/592-31-0x00007FF6A8D60000-0x00007FF6A9152000-memory.dmp	xmrig
behavioral2/memory/4868-5420-0x00007FF79E230000-0x00007FF79E622000-memory.dmp	xmrig
behavioral2/memory/2312-6084-0x00007FF6BCAE0000-0x00007FF6BCED2000-memory.dmp	xmrig
behavioral2/memory/208-6083-0x00007FF7DFAA0000-0x00007FF7DFE92000-memory.dmp	xmrig
behavioral2/memory/592-6073-0x00007FF6A8D60000-0x00007FF6A9152000-memory.dmp	xmrig
behavioral2/memory/4868-6087-0x00007FF79E230000-0x00007FF79E622000-memory.dmp	xmrig
behavioral2/memory/1912-6093-0x00007FF72F350000-0x00007FF72F742000-memory.dmp	xmrig
behavioral2/memory/3600-6090-0x00007FF7F0A70000-0x00007FF7F0E62000-memory.dmp	xmrig
behavioral2/memory/4352-6095-0x00007FF628630000-0x00007FF628A22000-memory.dmp	xmrig
behavioral2/memory/3584-6125-0x00007FF620B90000-0x00007FF620F82000-memory.dmp	xmrig
behavioral2/memory/2044-6123-0x00007FF6AEF30000-0x00007FF6AF322000-memory.dmp	xmrig
behavioral2/memory/2860-6129-0x00007FF7EFE80000-0x00007FF7F0272000-memory.dmp	xmrig
behavioral2/memory/4416-6131-0x00007FF6319F0000-0x00007FF631DE2000-memory.dmp	xmrig
behavioral2/memory/3808-6126-0x00007FF76C3D0000-0x00007FF76C7C2000-memory.dmp	xmrig
behavioral2/memory/3156-6119-0x00007FF72ACB0000-0x00007FF72B0A2000-memory.dmp	xmrig
behavioral2/memory/4168-6115-0x00007FF6ED260000-0x00007FF6ED652000-memory.dmp	xmrig
behavioral2/memory/3492-6113-0x00007FF7F6400000-0x00007FF7F67F2000-memory.dmp	xmrig
behavioral2/memory/1920-6111-0x00007FF65DE80000-0x00007FF65E272000-memory.dmp	xmrig
behavioral2/memory/4556-6105-0x00007FF65D5A0000-0x00007FF65D992000-memory.dmp	xmrig
behavioral2/memory/4436-6103-0x00007FF7AD6E0000-0x00007FF7ADAD2000-memory.dmp	xmrig
behavioral2/memory/4528-6101-0x00007FF66C770000-0x00007FF66CB62000-memory.dmp	xmrig
behavioral2/memory/532-6099-0x00007FF735B80000-0x00007FF735F72000-memory.dmp	xmrig
behavioral2/memory/2036-6121-0x00007FF75E120000-0x00007FF75E512000-memory.dmp	xmrig
behavioral2/memory/1540-6117-0x00007FF60A200000-0x00007FF60A5F2000-memory.dmp	xmrig
behavioral2/memory/5112-6109-0x00007FF753DC0000-0x00007FF7541B2000-memory.dmp	xmrig
behavioral2/memory/4088-6107-0x00007FF600360000-0x00007FF600752000-memory.dmp	xmrig

Blocklisted process makes network request 2 IoCs

flow	pid	Process
8	1568	powershell.exe
10	1568	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
1568	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
592	XvtrUzx.exe
2312	ZCsrJeY.exe
208	yEhbNQT.exe
3600	BOAxHzw.exe
1912	XIGWdeC.exe
4868	bBDZWXQ.exe
4352	LqDxzxt.exe
3492	eSLiLOE.exe
3584	HqOAoPw.exe
1920	UjxBKkF.exe
2044	KNOOqXE.exe
5112	hIZvvDE.exe
4088	HAPmGpP.exe
4556	JClIZTM.exe
1540	qyWtOVv.exe
532	FImpkkQ.exe
2036	nhEfCKF.exe
4528	wtxpXSs.exe
4436	iXelnue.exe
4168	iFpmkqW.exe
3808	WcXpylK.exe
3156	OdnvHIX.exe
2860	syDZZLk.exe
4416	ixsrkzc.exe
4900	euPdUWw.exe
3236	wCLhkVh.exe
4848	GjuhcTQ.exe
4940	nzKFpej.exe
2108	KLvhEvo.exe
1096	pvUJohh.exe
864	YwIVbeo.exe
4760	WTPruEy.exe
1708	VCKwJZO.exe
2716	hgqODkg.exe
1200	gbDgtSV.exe
3328	FjnRggU.exe
3172	EfJLnsc.exe
5104	XilKYdz.exe
4408	OEpqnsm.exe
1420	SmpIxwO.exe
4092	JZUPAmn.exe
1000	xizDkHH.exe
2668	rzfRaXb.exe
4076	lttvqHF.exe
3408	GaZdQbu.exe
4444	CZuuRRm.exe
4592	nyhrZcD.exe
4980	knRCWOX.exe
3592	IFDIewS.exe
3164	vcTCmMe.exe
3988	rvZwGdJ.exe
3200	apoeFjf.exe
3436	gEhYMWP.exe
2708	GSeSxjd.exe
1900	HRHVJWb.exe
1260	EliLuJD.exe
4656	BhVYlxI.exe
1736	gNoBXqq.exe
1344	oIRSAiG.exe
1988	konOhQv.exe
512	OrGbyJR.exe
1312	KZbUGqq.exe
2748	RCqzHnX.exe
3220	vyXMFoQ.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1100-0-0x00007FF6D9F20000-0x00007FF6DA312000-memory.dmp	upx
behavioral2/files/0x000700000002342d-6.dat	upx
behavioral2/files/0x000700000002342f-24.dat	upx
behavioral2/files/0x0007000000023433-38.dat	upx
behavioral2/memory/208-48-0x00007FF7DFAA0000-0x00007FF7DFE92000-memory.dmp	upx
behavioral2/files/0x0007000000023439-82.dat	upx
behavioral2/files/0x0007000000023436-95.dat	upx
behavioral2/files/0x000700000002343a-106.dat	upx
behavioral2/files/0x0007000000023440-122.dat	upx
behavioral2/memory/4528-134-0x00007FF66C770000-0x00007FF66CB62000-memory.dmp	upx
behavioral2/memory/3156-139-0x00007FF72ACB0000-0x00007FF72B0A2000-memory.dmp	upx
behavioral2/memory/4436-144-0x00007FF7AD6E0000-0x00007FF7ADAD2000-memory.dmp	upx
behavioral2/files/0x0008000000023445-172.dat	upx
behavioral2/files/0x0007000000023449-195.dat	upx
behavioral2/files/0x000700000002344f-201.dat	upx
behavioral2/files/0x000700000002344e-200.dat	upx
behavioral2/files/0x000700000002344d-199.dat	upx
behavioral2/files/0x000700000002344c-198.dat	upx
behavioral2/files/0x000700000002344b-197.dat	upx
behavioral2/files/0x000700000002344a-196.dat	upx
behavioral2/files/0x0007000000023448-194.dat	upx
behavioral2/files/0x0007000000023447-193.dat	upx
behavioral2/files/0x0007000000023446-186.dat	upx
behavioral2/files/0x0007000000023443-165.dat	upx
behavioral2/files/0x000800000002342a-150.dat	upx
behavioral2/memory/4416-146-0x00007FF6319F0000-0x00007FF631DE2000-memory.dmp	upx
behavioral2/memory/2860-145-0x00007FF7EFE80000-0x00007FF7F0272000-memory.dmp	upx
behavioral2/memory/1920-143-0x00007FF65DE80000-0x00007FF65E272000-memory.dmp	upx
behavioral2/memory/4352-142-0x00007FF628630000-0x00007FF628A22000-memory.dmp	upx
behavioral2/memory/1912-141-0x00007FF72F350000-0x00007FF72F742000-memory.dmp	upx
behavioral2/memory/3600-140-0x00007FF7F0A70000-0x00007FF7F0E62000-memory.dmp	upx
behavioral2/memory/3808-138-0x00007FF76C3D0000-0x00007FF76C7C2000-memory.dmp	upx
behavioral2/memory/4168-137-0x00007FF6ED260000-0x00007FF6ED652000-memory.dmp	upx
behavioral2/files/0x0007000000023442-135.dat	upx
behavioral2/memory/2036-133-0x00007FF75E120000-0x00007FF75E512000-memory.dmp	upx
behavioral2/memory/532-132-0x00007FF735B80000-0x00007FF735F72000-memory.dmp	upx
behavioral2/files/0x000700000002343d-129.dat	upx
behavioral2/memory/1540-126-0x00007FF60A200000-0x00007FF60A5F2000-memory.dmp	upx
behavioral2/memory/4556-125-0x00007FF65D5A0000-0x00007FF65D992000-memory.dmp	upx
behavioral2/memory/4088-119-0x00007FF600360000-0x00007FF600752000-memory.dmp	upx
behavioral2/files/0x0007000000023441-114.dat	upx
behavioral2/files/0x000700000002343e-112.dat	upx
behavioral2/memory/5112-110-0x00007FF753DC0000-0x00007FF7541B2000-memory.dmp	upx
behavioral2/memory/2044-109-0x00007FF6AEF30000-0x00007FF6AF322000-memory.dmp	upx
behavioral2/files/0x000700000002343f-120.dat	upx
behavioral2/files/0x000700000002343c-108.dat	upx
behavioral2/files/0x0007000000023438-103.dat	upx
behavioral2/memory/3584-101-0x00007FF620B90000-0x00007FF620F82000-memory.dmp	upx
behavioral2/files/0x0007000000023435-100.dat	upx
behavioral2/files/0x000700000002343b-97.dat	upx
behavioral2/files/0x0007000000023437-104.dat	upx
behavioral2/memory/3492-90-0x00007FF7F6400000-0x00007FF7F67F2000-memory.dmp	upx
behavioral2/files/0x0007000000023432-75.dat	upx
behavioral2/memory/4868-88-0x00007FF79E230000-0x00007FF79E622000-memory.dmp	upx
behavioral2/files/0x0007000000023431-60.dat	upx
behavioral2/files/0x0007000000023434-86.dat	upx
behavioral2/files/0x0007000000023430-52.dat	upx
behavioral2/files/0x000700000002342e-56.dat	upx
behavioral2/memory/2312-36-0x00007FF6BCAE0000-0x00007FF6BCED2000-memory.dmp	upx
behavioral2/memory/592-31-0x00007FF6A8D60000-0x00007FF6A9152000-memory.dmp	upx
behavioral2/files/0x000800000002342c-23.dat	upx
behavioral2/files/0x0008000000023426-9.dat	upx
behavioral2/memory/4868-5420-0x00007FF79E230000-0x00007FF79E622000-memory.dmp	upx
behavioral2/memory/2312-6084-0x00007FF6BCAE0000-0x00007FF6BCED2000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
7	raw.githubusercontent.com
8	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\TwxAfQu.exe	3696aa021fea35d2f070c141da24c4b1b2bbe6f679a4eb26133d13745fe9ad0d_NeikiAnalytics.exe
File created	C:\Windows\System\zTROWiF.exe	3696aa021fea35d2f070c141da24c4b1b2bbe6f679a4eb26133d13745fe9ad0d_NeikiAnalytics.exe
File created	C:\Windows\System\XvHUoBH.exe	3696aa021fea35d2f070c141da24c4b1b2bbe6f679a4eb26133d13745fe9ad0d_NeikiAnalytics.exe
File created	C:\Windows\System\Hgwsgof.exe	3696aa021fea35d2f070c141da24c4b1b2bbe6f679a4eb26133d13745fe9ad0d_NeikiAnalytics.exe
File created	C:\Windows\System\fLsFyIe.exe	3696aa021fea35d2f070c141da24c4b1b2bbe6f679a4eb26133d13745fe9ad0d_NeikiAnalytics.exe
File created	C:\Windows\System\PJSNQel.exe	3696aa021fea35d2f070c141da24c4b1b2bbe6f679a4eb26133d13745fe9ad0d_NeikiAnalytics.exe
File created	C:\Windows\System\OFPZLjp.exe	3696aa021fea35d2f070c141da24c4b1b2bbe6f679a4eb26133d13745fe9ad0d_NeikiAnalytics.exe
File created	C:\Windows\System\pKsajSD.exe	3696aa021fea35d2f070c141da24c4b1b2bbe6f679a4eb26133d13745fe9ad0d_NeikiAnalytics.exe
File created	C:\Windows\System\sYIEOss.exe	3696aa021fea35d2f070c141da24c4b1b2bbe6f679a4eb26133d13745fe9ad0d_NeikiAnalytics.exe
File created	C:\Windows\System\seBucTd.exe	3696aa021fea35d2f070c141da24c4b1b2bbe6f679a4eb26133d13745fe9ad0d_NeikiAnalytics.exe
File created	C:\Windows\System\EawzklT.exe	3696aa021fea35d2f070c141da24c4b1b2bbe6f679a4eb26133d13745fe9ad0d_NeikiAnalytics.exe
File created	C:\Windows\System\EGUffeB.exe	3696aa021fea35d2f070c141da24c4b1b2bbe6f679a4eb26133d13745fe9ad0d_NeikiAnalytics.exe
File created	C:\Windows\System\SoGXshp.exe	3696aa021fea35d2f070c141da24c4b1b2bbe6f679a4eb26133d13745fe9ad0d_NeikiAnalytics.exe
File created	C:\Windows\System\CLjALaH.exe	3696aa021fea35d2f070c141da24c4b1b2bbe6f679a4eb26133d13745fe9ad0d_NeikiAnalytics.exe
File created	C:\Windows\System\mghskDC.exe	3696aa021fea35d2f070c141da24c4b1b2bbe6f679a4eb26133d13745fe9ad0d_NeikiAnalytics.exe
File created	C:\Windows\System\QJnlWPn.exe	3696aa021fea35d2f070c141da24c4b1b2bbe6f679a4eb26133d13745fe9ad0d_NeikiAnalytics.exe
File created	C:\Windows\System\GBQPxnH.exe	3696aa021fea35d2f070c141da24c4b1b2bbe6f679a4eb26133d13745fe9ad0d_NeikiAnalytics.exe
File created	C:\Windows\System\PuDUpuM.exe	3696aa021fea35d2f070c141da24c4b1b2bbe6f679a4eb26133d13745fe9ad0d_NeikiAnalytics.exe
File created	C:\Windows\System\ZYjvCuY.exe	3696aa021fea35d2f070c141da24c4b1b2bbe6f679a4eb26133d13745fe9ad0d_NeikiAnalytics.exe
File created	C:\Windows\System\bbtXLyc.exe	3696aa021fea35d2f070c141da24c4b1b2bbe6f679a4eb26133d13745fe9ad0d_NeikiAnalytics.exe
File created	C:\Windows\System\uzoYkTY.exe	3696aa021fea35d2f070c141da24c4b1b2bbe6f679a4eb26133d13745fe9ad0d_NeikiAnalytics.exe
File created	C:\Windows\System\QBByvcL.exe	3696aa021fea35d2f070c141da24c4b1b2bbe6f679a4eb26133d13745fe9ad0d_NeikiAnalytics.exe
File created	C:\Windows\System\TmFTrbj.exe	3696aa021fea35d2f070c141da24c4b1b2bbe6f679a4eb26133d13745fe9ad0d_NeikiAnalytics.exe
File created	C:\Windows\System\vKXmrtE.exe	3696aa021fea35d2f070c141da24c4b1b2bbe6f679a4eb26133d13745fe9ad0d_NeikiAnalytics.exe
File created	C:\Windows\System\XVAsRVT.exe	3696aa021fea35d2f070c141da24c4b1b2bbe6f679a4eb26133d13745fe9ad0d_NeikiAnalytics.exe
File created	C:\Windows\System\gmIRTEh.exe	3696aa021fea35d2f070c141da24c4b1b2bbe6f679a4eb26133d13745fe9ad0d_NeikiAnalytics.exe
File created	C:\Windows\System\uRHxFMi.exe	3696aa021fea35d2f070c141da24c4b1b2bbe6f679a4eb26133d13745fe9ad0d_NeikiAnalytics.exe
File created	C:\Windows\System\QWEbrVL.exe	3696aa021fea35d2f070c141da24c4b1b2bbe6f679a4eb26133d13745fe9ad0d_NeikiAnalytics.exe
File created	C:\Windows\System\KOVAIAV.exe	3696aa021fea35d2f070c141da24c4b1b2bbe6f679a4eb26133d13745fe9ad0d_NeikiAnalytics.exe
File created	C:\Windows\System\kEgNWzG.exe	3696aa021fea35d2f070c141da24c4b1b2bbe6f679a4eb26133d13745fe9ad0d_NeikiAnalytics.exe
File created	C:\Windows\System\EecgVWK.exe	3696aa021fea35d2f070c141da24c4b1b2bbe6f679a4eb26133d13745fe9ad0d_NeikiAnalytics.exe
File created	C:\Windows\System\PwWyEDk.exe	3696aa021fea35d2f070c141da24c4b1b2bbe6f679a4eb26133d13745fe9ad0d_NeikiAnalytics.exe
File created	C:\Windows\System\WegmqyQ.exe	3696aa021fea35d2f070c141da24c4b1b2bbe6f679a4eb26133d13745fe9ad0d_NeikiAnalytics.exe
File created	C:\Windows\System\IJgLpdu.exe	3696aa021fea35d2f070c141da24c4b1b2bbe6f679a4eb26133d13745fe9ad0d_NeikiAnalytics.exe
File created	C:\Windows\System\qMmZsrs.exe	3696aa021fea35d2f070c141da24c4b1b2bbe6f679a4eb26133d13745fe9ad0d_NeikiAnalytics.exe
File created	C:\Windows\System\VUBCcKd.exe	3696aa021fea35d2f070c141da24c4b1b2bbe6f679a4eb26133d13745fe9ad0d_NeikiAnalytics.exe
File created	C:\Windows\System\MbpqezL.exe	3696aa021fea35d2f070c141da24c4b1b2bbe6f679a4eb26133d13745fe9ad0d_NeikiAnalytics.exe
File created	C:\Windows\System\qBrbVag.exe	3696aa021fea35d2f070c141da24c4b1b2bbe6f679a4eb26133d13745fe9ad0d_NeikiAnalytics.exe
File created	C:\Windows\System\jQacfrl.exe	3696aa021fea35d2f070c141da24c4b1b2bbe6f679a4eb26133d13745fe9ad0d_NeikiAnalytics.exe
File created	C:\Windows\System\uFZDLGq.exe	3696aa021fea35d2f070c141da24c4b1b2bbe6f679a4eb26133d13745fe9ad0d_NeikiAnalytics.exe
File created	C:\Windows\System\LNzNRal.exe	3696aa021fea35d2f070c141da24c4b1b2bbe6f679a4eb26133d13745fe9ad0d_NeikiAnalytics.exe
File created	C:\Windows\System\kSklmFc.exe	3696aa021fea35d2f070c141da24c4b1b2bbe6f679a4eb26133d13745fe9ad0d_NeikiAnalytics.exe
File created	C:\Windows\System\PPTqHSX.exe	3696aa021fea35d2f070c141da24c4b1b2bbe6f679a4eb26133d13745fe9ad0d_NeikiAnalytics.exe
File created	C:\Windows\System\qETYAyL.exe	3696aa021fea35d2f070c141da24c4b1b2bbe6f679a4eb26133d13745fe9ad0d_NeikiAnalytics.exe
File created	C:\Windows\System\WsqeOyF.exe	3696aa021fea35d2f070c141da24c4b1b2bbe6f679a4eb26133d13745fe9ad0d_NeikiAnalytics.exe
File created	C:\Windows\System\cOWOmlL.exe	3696aa021fea35d2f070c141da24c4b1b2bbe6f679a4eb26133d13745fe9ad0d_NeikiAnalytics.exe
File created	C:\Windows\System\MpjujeD.exe	3696aa021fea35d2f070c141da24c4b1b2bbe6f679a4eb26133d13745fe9ad0d_NeikiAnalytics.exe
File created	C:\Windows\System\TOLyRnk.exe	3696aa021fea35d2f070c141da24c4b1b2bbe6f679a4eb26133d13745fe9ad0d_NeikiAnalytics.exe
File created	C:\Windows\System\gLAjpum.exe	3696aa021fea35d2f070c141da24c4b1b2bbe6f679a4eb26133d13745fe9ad0d_NeikiAnalytics.exe
File created	C:\Windows\System\LzYpNRX.exe	3696aa021fea35d2f070c141da24c4b1b2bbe6f679a4eb26133d13745fe9ad0d_NeikiAnalytics.exe
File created	C:\Windows\System\xOYFfBf.exe	3696aa021fea35d2f070c141da24c4b1b2bbe6f679a4eb26133d13745fe9ad0d_NeikiAnalytics.exe
File created	C:\Windows\System\pbyQMAB.exe	3696aa021fea35d2f070c141da24c4b1b2bbe6f679a4eb26133d13745fe9ad0d_NeikiAnalytics.exe
File created	C:\Windows\System\uWidGvP.exe	3696aa021fea35d2f070c141da24c4b1b2bbe6f679a4eb26133d13745fe9ad0d_NeikiAnalytics.exe
File created	C:\Windows\System\zFQPbHk.exe	3696aa021fea35d2f070c141da24c4b1b2bbe6f679a4eb26133d13745fe9ad0d_NeikiAnalytics.exe
File created	C:\Windows\System\BbIvFma.exe	3696aa021fea35d2f070c141da24c4b1b2bbe6f679a4eb26133d13745fe9ad0d_NeikiAnalytics.exe
File created	C:\Windows\System\NIXEcHY.exe	3696aa021fea35d2f070c141da24c4b1b2bbe6f679a4eb26133d13745fe9ad0d_NeikiAnalytics.exe
File created	C:\Windows\System\zKcFxtV.exe	3696aa021fea35d2f070c141da24c4b1b2bbe6f679a4eb26133d13745fe9ad0d_NeikiAnalytics.exe
File created	C:\Windows\System\AEjGCSu.exe	3696aa021fea35d2f070c141da24c4b1b2bbe6f679a4eb26133d13745fe9ad0d_NeikiAnalytics.exe
File created	C:\Windows\System\lAmQYIU.exe	3696aa021fea35d2f070c141da24c4b1b2bbe6f679a4eb26133d13745fe9ad0d_NeikiAnalytics.exe
File created	C:\Windows\System\CmcQfHC.exe	3696aa021fea35d2f070c141da24c4b1b2bbe6f679a4eb26133d13745fe9ad0d_NeikiAnalytics.exe
File created	C:\Windows\System\LhKKZRG.exe	3696aa021fea35d2f070c141da24c4b1b2bbe6f679a4eb26133d13745fe9ad0d_NeikiAnalytics.exe
File created	C:\Windows\System\zJkDCLY.exe	3696aa021fea35d2f070c141da24c4b1b2bbe6f679a4eb26133d13745fe9ad0d_NeikiAnalytics.exe
File created	C:\Windows\System\ukfXjzj.exe	3696aa021fea35d2f070c141da24c4b1b2bbe6f679a4eb26133d13745fe9ad0d_NeikiAnalytics.exe
File created	C:\Windows\System\pbRlHDb.exe	3696aa021fea35d2f070c141da24c4b1b2bbe6f679a4eb26133d13745fe9ad0d_NeikiAnalytics.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1568	powershell.exe
1568	powershell.exe
1568	powershell.exe
1568	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	1100	3696aa021fea35d2f070c141da24c4b1b2bbe6f679a4eb26133d13745fe9ad0d_NeikiAnalytics.exe
Token: SeLockMemoryPrivilege	1100	3696aa021fea35d2f070c141da24c4b1b2bbe6f679a4eb26133d13745fe9ad0d_NeikiAnalytics.exe
Token: SeDebugPrivilege	1568	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1100 wrote to memory of 1568	1100	3696aa021fea35d2f070c141da24c4b1b2bbe6f679a4eb26133d13745fe9ad0d_NeikiAnalytics.exe	86
PID 1100 wrote to memory of 1568	1100	3696aa021fea35d2f070c141da24c4b1b2bbe6f679a4eb26133d13745fe9ad0d_NeikiAnalytics.exe	86
PID 1100 wrote to memory of 592	1100	3696aa021fea35d2f070c141da24c4b1b2bbe6f679a4eb26133d13745fe9ad0d_NeikiAnalytics.exe	87
PID 1100 wrote to memory of 592	1100	3696aa021fea35d2f070c141da24c4b1b2bbe6f679a4eb26133d13745fe9ad0d_NeikiAnalytics.exe	87
PID 1100 wrote to memory of 2312	1100	3696aa021fea35d2f070c141da24c4b1b2bbe6f679a4eb26133d13745fe9ad0d_NeikiAnalytics.exe	88
PID 1100 wrote to memory of 2312	1100	3696aa021fea35d2f070c141da24c4b1b2bbe6f679a4eb26133d13745fe9ad0d_NeikiAnalytics.exe	88
PID 1100 wrote to memory of 208	1100	3696aa021fea35d2f070c141da24c4b1b2bbe6f679a4eb26133d13745fe9ad0d_NeikiAnalytics.exe	89
PID 1100 wrote to memory of 208	1100	3696aa021fea35d2f070c141da24c4b1b2bbe6f679a4eb26133d13745fe9ad0d_NeikiAnalytics.exe	89
PID 1100 wrote to memory of 3600	1100	3696aa021fea35d2f070c141da24c4b1b2bbe6f679a4eb26133d13745fe9ad0d_NeikiAnalytics.exe	90
PID 1100 wrote to memory of 3600	1100	3696aa021fea35d2f070c141da24c4b1b2bbe6f679a4eb26133d13745fe9ad0d_NeikiAnalytics.exe	90
PID 1100 wrote to memory of 1912	1100	3696aa021fea35d2f070c141da24c4b1b2bbe6f679a4eb26133d13745fe9ad0d_NeikiAnalytics.exe	91
PID 1100 wrote to memory of 1912	1100	3696aa021fea35d2f070c141da24c4b1b2bbe6f679a4eb26133d13745fe9ad0d_NeikiAnalytics.exe	91
PID 1100 wrote to memory of 4868	1100	3696aa021fea35d2f070c141da24c4b1b2bbe6f679a4eb26133d13745fe9ad0d_NeikiAnalytics.exe	92
PID 1100 wrote to memory of 4868	1100	3696aa021fea35d2f070c141da24c4b1b2bbe6f679a4eb26133d13745fe9ad0d_NeikiAnalytics.exe	92
PID 1100 wrote to memory of 3584	1100	3696aa021fea35d2f070c141da24c4b1b2bbe6f679a4eb26133d13745fe9ad0d_NeikiAnalytics.exe	93
PID 1100 wrote to memory of 3584	1100	3696aa021fea35d2f070c141da24c4b1b2bbe6f679a4eb26133d13745fe9ad0d_NeikiAnalytics.exe	93
PID 1100 wrote to memory of 4352	1100	3696aa021fea35d2f070c141da24c4b1b2bbe6f679a4eb26133d13745fe9ad0d_NeikiAnalytics.exe	94
PID 1100 wrote to memory of 4352	1100	3696aa021fea35d2f070c141da24c4b1b2bbe6f679a4eb26133d13745fe9ad0d_NeikiAnalytics.exe	94
PID 1100 wrote to memory of 3492	1100	3696aa021fea35d2f070c141da24c4b1b2bbe6f679a4eb26133d13745fe9ad0d_NeikiAnalytics.exe	95
PID 1100 wrote to memory of 3492	1100	3696aa021fea35d2f070c141da24c4b1b2bbe6f679a4eb26133d13745fe9ad0d_NeikiAnalytics.exe	95
PID 1100 wrote to memory of 2044	1100	3696aa021fea35d2f070c141da24c4b1b2bbe6f679a4eb26133d13745fe9ad0d_NeikiAnalytics.exe	96
PID 1100 wrote to memory of 2044	1100	3696aa021fea35d2f070c141da24c4b1b2bbe6f679a4eb26133d13745fe9ad0d_NeikiAnalytics.exe	96
PID 1100 wrote to memory of 5112	1100	3696aa021fea35d2f070c141da24c4b1b2bbe6f679a4eb26133d13745fe9ad0d_NeikiAnalytics.exe	97
PID 1100 wrote to memory of 5112	1100	3696aa021fea35d2f070c141da24c4b1b2bbe6f679a4eb26133d13745fe9ad0d_NeikiAnalytics.exe	97
PID 1100 wrote to memory of 1920	1100	3696aa021fea35d2f070c141da24c4b1b2bbe6f679a4eb26133d13745fe9ad0d_NeikiAnalytics.exe	98
PID 1100 wrote to memory of 1920	1100	3696aa021fea35d2f070c141da24c4b1b2bbe6f679a4eb26133d13745fe9ad0d_NeikiAnalytics.exe	98
PID 1100 wrote to memory of 1540	1100	3696aa021fea35d2f070c141da24c4b1b2bbe6f679a4eb26133d13745fe9ad0d_NeikiAnalytics.exe	99
PID 1100 wrote to memory of 1540	1100	3696aa021fea35d2f070c141da24c4b1b2bbe6f679a4eb26133d13745fe9ad0d_NeikiAnalytics.exe	99
PID 1100 wrote to memory of 4088	1100	3696aa021fea35d2f070c141da24c4b1b2bbe6f679a4eb26133d13745fe9ad0d_NeikiAnalytics.exe	100
PID 1100 wrote to memory of 4088	1100	3696aa021fea35d2f070c141da24c4b1b2bbe6f679a4eb26133d13745fe9ad0d_NeikiAnalytics.exe	100
PID 1100 wrote to memory of 4556	1100	3696aa021fea35d2f070c141da24c4b1b2bbe6f679a4eb26133d13745fe9ad0d_NeikiAnalytics.exe	101
PID 1100 wrote to memory of 4556	1100	3696aa021fea35d2f070c141da24c4b1b2bbe6f679a4eb26133d13745fe9ad0d_NeikiAnalytics.exe	101
PID 1100 wrote to memory of 532	1100	3696aa021fea35d2f070c141da24c4b1b2bbe6f679a4eb26133d13745fe9ad0d_NeikiAnalytics.exe	102
PID 1100 wrote to memory of 532	1100	3696aa021fea35d2f070c141da24c4b1b2bbe6f679a4eb26133d13745fe9ad0d_NeikiAnalytics.exe	102
PID 1100 wrote to memory of 2036	1100	3696aa021fea35d2f070c141da24c4b1b2bbe6f679a4eb26133d13745fe9ad0d_NeikiAnalytics.exe	103
PID 1100 wrote to memory of 2036	1100	3696aa021fea35d2f070c141da24c4b1b2bbe6f679a4eb26133d13745fe9ad0d_NeikiAnalytics.exe	103
PID 1100 wrote to memory of 4528	1100	3696aa021fea35d2f070c141da24c4b1b2bbe6f679a4eb26133d13745fe9ad0d_NeikiAnalytics.exe	104
PID 1100 wrote to memory of 4528	1100	3696aa021fea35d2f070c141da24c4b1b2bbe6f679a4eb26133d13745fe9ad0d_NeikiAnalytics.exe	104
PID 1100 wrote to memory of 2860	1100	3696aa021fea35d2f070c141da24c4b1b2bbe6f679a4eb26133d13745fe9ad0d_NeikiAnalytics.exe	105
PID 1100 wrote to memory of 2860	1100	3696aa021fea35d2f070c141da24c4b1b2bbe6f679a4eb26133d13745fe9ad0d_NeikiAnalytics.exe	105
PID 1100 wrote to memory of 4436	1100	3696aa021fea35d2f070c141da24c4b1b2bbe6f679a4eb26133d13745fe9ad0d_NeikiAnalytics.exe	106
PID 1100 wrote to memory of 4436	1100	3696aa021fea35d2f070c141da24c4b1b2bbe6f679a4eb26133d13745fe9ad0d_NeikiAnalytics.exe	106
PID 1100 wrote to memory of 4168	1100	3696aa021fea35d2f070c141da24c4b1b2bbe6f679a4eb26133d13745fe9ad0d_NeikiAnalytics.exe	107
PID 1100 wrote to memory of 4168	1100	3696aa021fea35d2f070c141da24c4b1b2bbe6f679a4eb26133d13745fe9ad0d_NeikiAnalytics.exe	107
PID 1100 wrote to memory of 3808	1100	3696aa021fea35d2f070c141da24c4b1b2bbe6f679a4eb26133d13745fe9ad0d_NeikiAnalytics.exe	108
PID 1100 wrote to memory of 3808	1100	3696aa021fea35d2f070c141da24c4b1b2bbe6f679a4eb26133d13745fe9ad0d_NeikiAnalytics.exe	108
PID 1100 wrote to memory of 3156	1100	3696aa021fea35d2f070c141da24c4b1b2bbe6f679a4eb26133d13745fe9ad0d_NeikiAnalytics.exe	109
PID 1100 wrote to memory of 3156	1100	3696aa021fea35d2f070c141da24c4b1b2bbe6f679a4eb26133d13745fe9ad0d_NeikiAnalytics.exe	109
PID 1100 wrote to memory of 4416	1100	3696aa021fea35d2f070c141da24c4b1b2bbe6f679a4eb26133d13745fe9ad0d_NeikiAnalytics.exe	110
PID 1100 wrote to memory of 4416	1100	3696aa021fea35d2f070c141da24c4b1b2bbe6f679a4eb26133d13745fe9ad0d_NeikiAnalytics.exe	110
PID 1100 wrote to memory of 4900	1100	3696aa021fea35d2f070c141da24c4b1b2bbe6f679a4eb26133d13745fe9ad0d_NeikiAnalytics.exe	111
PID 1100 wrote to memory of 4900	1100	3696aa021fea35d2f070c141da24c4b1b2bbe6f679a4eb26133d13745fe9ad0d_NeikiAnalytics.exe	111
PID 1100 wrote to memory of 3236	1100	3696aa021fea35d2f070c141da24c4b1b2bbe6f679a4eb26133d13745fe9ad0d_NeikiAnalytics.exe	112
PID 1100 wrote to memory of 3236	1100	3696aa021fea35d2f070c141da24c4b1b2bbe6f679a4eb26133d13745fe9ad0d_NeikiAnalytics.exe	112
PID 1100 wrote to memory of 4848	1100	3696aa021fea35d2f070c141da24c4b1b2bbe6f679a4eb26133d13745fe9ad0d_NeikiAnalytics.exe	113
PID 1100 wrote to memory of 4848	1100	3696aa021fea35d2f070c141da24c4b1b2bbe6f679a4eb26133d13745fe9ad0d_NeikiAnalytics.exe	113
PID 1100 wrote to memory of 4940	1100	3696aa021fea35d2f070c141da24c4b1b2bbe6f679a4eb26133d13745fe9ad0d_NeikiAnalytics.exe	114
PID 1100 wrote to memory of 4940	1100	3696aa021fea35d2f070c141da24c4b1b2bbe6f679a4eb26133d13745fe9ad0d_NeikiAnalytics.exe	114
PID 1100 wrote to memory of 2108	1100	3696aa021fea35d2f070c141da24c4b1b2bbe6f679a4eb26133d13745fe9ad0d_NeikiAnalytics.exe	115
PID 1100 wrote to memory of 2108	1100	3696aa021fea35d2f070c141da24c4b1b2bbe6f679a4eb26133d13745fe9ad0d_NeikiAnalytics.exe	115
PID 1100 wrote to memory of 1096	1100	3696aa021fea35d2f070c141da24c4b1b2bbe6f679a4eb26133d13745fe9ad0d_NeikiAnalytics.exe	116
PID 1100 wrote to memory of 1096	1100	3696aa021fea35d2f070c141da24c4b1b2bbe6f679a4eb26133d13745fe9ad0d_NeikiAnalytics.exe	116
PID 1100 wrote to memory of 864	1100	3696aa021fea35d2f070c141da24c4b1b2bbe6f679a4eb26133d13745fe9ad0d_NeikiAnalytics.exe	117
PID 1100 wrote to memory of 864	1100	3696aa021fea35d2f070c141da24c4b1b2bbe6f679a4eb26133d13745fe9ad0d_NeikiAnalytics.exe	117

C:\Users\Admin\AppData\Local\Temp\3696aa021fea35d2f070c141da24c4b1b2bbe6f679a4eb26133d13745fe9ad0d_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\3696aa021fea35d2f070c141da24c4b1b2bbe6f679a4eb26133d13745fe9ad0d_NeikiAnalytics.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1100
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1568
- - C:\Windows\system32\wermgr.exe
    "C:\Windows\system32\wermgr.exe" "-outproc" "0" "1568" "2968" "2900" "2972" "0" "0" "2976" "0" "0" "0" "0" "0"
    3⤵
    PID:6440
- C:\Windows\System\XvtrUzx.exe
  C:\Windows\System\XvtrUzx.exe
  2⤵
  - Executes dropped EXE
  PID:592
- C:\Windows\System\ZCsrJeY.exe
  C:\Windows\System\ZCsrJeY.exe
  2⤵
  - Executes dropped EXE
  PID:2312
- C:\Windows\System\yEhbNQT.exe
  C:\Windows\System\yEhbNQT.exe
  2⤵
  - Executes dropped EXE
  PID:208
- C:\Windows\System\BOAxHzw.exe
  C:\Windows\System\BOAxHzw.exe
  2⤵
  - Executes dropped EXE
  PID:3600
- C:\Windows\System\XIGWdeC.exe
  C:\Windows\System\XIGWdeC.exe
  2⤵
  - Executes dropped EXE
  PID:1912
- C:\Windows\System\bBDZWXQ.exe
  C:\Windows\System\bBDZWXQ.exe
  2⤵
  - Executes dropped EXE
  PID:4868
- C:\Windows\System\HqOAoPw.exe
  C:\Windows\System\HqOAoPw.exe
  2⤵
  - Executes dropped EXE
  PID:3584
- C:\Windows\System\LqDxzxt.exe
  C:\Windows\System\LqDxzxt.exe
  2⤵
  - Executes dropped EXE
  PID:4352
- C:\Windows\System\eSLiLOE.exe
  C:\Windows\System\eSLiLOE.exe
  2⤵
  - Executes dropped EXE
  PID:3492
- C:\Windows\System\KNOOqXE.exe
  C:\Windows\System\KNOOqXE.exe
  2⤵
  - Executes dropped EXE
  PID:2044
- C:\Windows\System\hIZvvDE.exe
  C:\Windows\System\hIZvvDE.exe
  2⤵
  - Executes dropped EXE
  PID:5112
- C:\Windows\System\UjxBKkF.exe
  C:\Windows\System\UjxBKkF.exe
  2⤵
  - Executes dropped EXE
  PID:1920
- C:\Windows\System\qyWtOVv.exe
  C:\Windows\System\qyWtOVv.exe
  2⤵
  - Executes dropped EXE
  PID:1540
- C:\Windows\System\HAPmGpP.exe
  C:\Windows\System\HAPmGpP.exe
  2⤵
  - Executes dropped EXE
  PID:4088
- C:\Windows\System\JClIZTM.exe
  C:\Windows\System\JClIZTM.exe
  2⤵
  - Executes dropped EXE
  PID:4556
- C:\Windows\System\FImpkkQ.exe
  C:\Windows\System\FImpkkQ.exe
  2⤵
  - Executes dropped EXE
  PID:532
- C:\Windows\System\nhEfCKF.exe
  C:\Windows\System\nhEfCKF.exe
  2⤵
  - Executes dropped EXE
  PID:2036
- C:\Windows\System\wtxpXSs.exe
  C:\Windows\System\wtxpXSs.exe
  2⤵
  - Executes dropped EXE
  PID:4528
- C:\Windows\System\syDZZLk.exe
  C:\Windows\System\syDZZLk.exe
  2⤵
  - Executes dropped EXE
  PID:2860
- C:\Windows\System\iXelnue.exe
  C:\Windows\System\iXelnue.exe
  2⤵
  - Executes dropped EXE
  PID:4436
- C:\Windows\System\iFpmkqW.exe
  C:\Windows\System\iFpmkqW.exe
  2⤵
  - Executes dropped EXE
  PID:4168
- C:\Windows\System\WcXpylK.exe
  C:\Windows\System\WcXpylK.exe
  2⤵
  - Executes dropped EXE
  PID:3808
- C:\Windows\System\OdnvHIX.exe
  C:\Windows\System\OdnvHIX.exe
  2⤵
  - Executes dropped EXE
  PID:3156
- C:\Windows\System\ixsrkzc.exe
  C:\Windows\System\ixsrkzc.exe
  2⤵
  - Executes dropped EXE
  PID:4416
- C:\Windows\System\euPdUWw.exe
  C:\Windows\System\euPdUWw.exe
  2⤵
  - Executes dropped EXE
  PID:4900
- C:\Windows\System\wCLhkVh.exe
  C:\Windows\System\wCLhkVh.exe
  2⤵
  - Executes dropped EXE
  PID:3236
- C:\Windows\System\GjuhcTQ.exe
  C:\Windows\System\GjuhcTQ.exe
  2⤵
  - Executes dropped EXE
  PID:4848
- C:\Windows\System\nzKFpej.exe
  C:\Windows\System\nzKFpej.exe
  2⤵
  - Executes dropped EXE
  PID:4940
- C:\Windows\System\KLvhEvo.exe
  C:\Windows\System\KLvhEvo.exe
  2⤵
  - Executes dropped EXE
  PID:2108
- C:\Windows\System\pvUJohh.exe
  C:\Windows\System\pvUJohh.exe
  2⤵
  - Executes dropped EXE
  PID:1096
- C:\Windows\System\YwIVbeo.exe
  C:\Windows\System\YwIVbeo.exe
  2⤵
  - Executes dropped EXE
  PID:864
- C:\Windows\System\WTPruEy.exe
  C:\Windows\System\WTPruEy.exe
  2⤵
  - Executes dropped EXE
  PID:4760
- C:\Windows\System\VCKwJZO.exe
  C:\Windows\System\VCKwJZO.exe
  2⤵
  - Executes dropped EXE
  PID:1708
- C:\Windows\System\hgqODkg.exe
  C:\Windows\System\hgqODkg.exe
  2⤵
  - Executes dropped EXE
  PID:2716
- C:\Windows\System\gbDgtSV.exe
  C:\Windows\System\gbDgtSV.exe
  2⤵
  - Executes dropped EXE
  PID:1200
- C:\Windows\System\FjnRggU.exe
  C:\Windows\System\FjnRggU.exe
  2⤵
  - Executes dropped EXE
  PID:3328
- C:\Windows\System\EfJLnsc.exe
  C:\Windows\System\EfJLnsc.exe
  2⤵
  - Executes dropped EXE
  PID:3172
- C:\Windows\System\XilKYdz.exe
  C:\Windows\System\XilKYdz.exe
  2⤵
  - Executes dropped EXE
  PID:5104
- C:\Windows\System\OEpqnsm.exe
  C:\Windows\System\OEpqnsm.exe
  2⤵
  - Executes dropped EXE
  PID:4408
- C:\Windows\System\SmpIxwO.exe
  C:\Windows\System\SmpIxwO.exe
  2⤵
  - Executes dropped EXE
  PID:1420
- C:\Windows\System\JZUPAmn.exe
  C:\Windows\System\JZUPAmn.exe
  2⤵
  - Executes dropped EXE
  PID:4092
- C:\Windows\System\xizDkHH.exe
  C:\Windows\System\xizDkHH.exe
  2⤵
  - Executes dropped EXE
  PID:1000
- C:\Windows\System\rzfRaXb.exe
  C:\Windows\System\rzfRaXb.exe
  2⤵
  - Executes dropped EXE
  PID:2668
- C:\Windows\System\lttvqHF.exe
  C:\Windows\System\lttvqHF.exe
  2⤵
  - Executes dropped EXE
  PID:4076
- C:\Windows\System\GaZdQbu.exe
  C:\Windows\System\GaZdQbu.exe
  2⤵
  - Executes dropped EXE
  PID:3408
- C:\Windows\System\CZuuRRm.exe
  C:\Windows\System\CZuuRRm.exe
  2⤵
  - Executes dropped EXE
  PID:4444
- C:\Windows\System\nyhrZcD.exe
  C:\Windows\System\nyhrZcD.exe
  2⤵
  - Executes dropped EXE
  PID:4592
- C:\Windows\System\knRCWOX.exe
  C:\Windows\System\knRCWOX.exe
  2⤵
  - Executes dropped EXE
  PID:4980
- C:\Windows\System\IFDIewS.exe
  C:\Windows\System\IFDIewS.exe
  2⤵
  - Executes dropped EXE
  PID:3592
- C:\Windows\System\vcTCmMe.exe
  C:\Windows\System\vcTCmMe.exe
  2⤵
  - Executes dropped EXE
  PID:3164
- C:\Windows\System\rvZwGdJ.exe
  C:\Windows\System\rvZwGdJ.exe
  2⤵
  - Executes dropped EXE
  PID:3988
- C:\Windows\System\apoeFjf.exe
  C:\Windows\System\apoeFjf.exe
  2⤵
  - Executes dropped EXE
  PID:3200
- C:\Windows\System\gEhYMWP.exe
  C:\Windows\System\gEhYMWP.exe
  2⤵
  - Executes dropped EXE
  PID:3436
- C:\Windows\System\GSeSxjd.exe
  C:\Windows\System\GSeSxjd.exe
  2⤵
  - Executes dropped EXE
  PID:2708
- C:\Windows\System\HRHVJWb.exe
  C:\Windows\System\HRHVJWb.exe
  2⤵
  - Executes dropped EXE
  PID:1900
- C:\Windows\System\EliLuJD.exe
  C:\Windows\System\EliLuJD.exe
  2⤵
  - Executes dropped EXE
  PID:1260
- C:\Windows\System\BhVYlxI.exe
  C:\Windows\System\BhVYlxI.exe
  2⤵
  - Executes dropped EXE
  PID:4656
- C:\Windows\System\gNoBXqq.exe
  C:\Windows\System\gNoBXqq.exe
  2⤵
  - Executes dropped EXE
  PID:1736
- C:\Windows\System\oIRSAiG.exe
  C:\Windows\System\oIRSAiG.exe
  2⤵
  - Executes dropped EXE
  PID:1344
- C:\Windows\System\konOhQv.exe
  C:\Windows\System\konOhQv.exe
  2⤵
  - Executes dropped EXE
  PID:1988
- C:\Windows\System\OrGbyJR.exe
  C:\Windows\System\OrGbyJR.exe
  2⤵
  - Executes dropped EXE
  PID:512
- C:\Windows\System\KZbUGqq.exe
  C:\Windows\System\KZbUGqq.exe
  2⤵
  - Executes dropped EXE
  PID:1312
- C:\Windows\System\RCqzHnX.exe
  C:\Windows\System\RCqzHnX.exe
  2⤵
  - Executes dropped EXE
  PID:2748
- C:\Windows\System\vyXMFoQ.exe
  C:\Windows\System\vyXMFoQ.exe
  2⤵
  - Executes dropped EXE
  PID:3220
- C:\Windows\System\nYvnzkg.exe
  C:\Windows\System\nYvnzkg.exe
  2⤵
  PID:3416
- C:\Windows\System\ZcFlHGI.exe
  C:\Windows\System\ZcFlHGI.exe
  2⤵
  PID:996
- C:\Windows\System\DoioTAc.exe
  C:\Windows\System\DoioTAc.exe
  2⤵
  PID:3980
- C:\Windows\System\tqmbWJI.exe
  C:\Windows\System\tqmbWJI.exe
  2⤵
  PID:3968
- C:\Windows\System\EaYryYl.exe
  C:\Windows\System\EaYryYl.exe
  2⤵
  PID:1408
- C:\Windows\System\XSjkslL.exe
  C:\Windows\System\XSjkslL.exe
  2⤵
  PID:4240
- C:\Windows\System\AUXzKCc.exe
  C:\Windows\System\AUXzKCc.exe
  2⤵
  PID:3360
- C:\Windows\System\gEOlOEu.exe
  C:\Windows\System\gEOlOEu.exe
  2⤵
  PID:1264
- C:\Windows\System\dNVlyoI.exe
  C:\Windows\System\dNVlyoI.exe
  2⤵
  PID:4924
- C:\Windows\System\yNFMMAg.exe
  C:\Windows\System\yNFMMAg.exe
  2⤵
  PID:2848
- C:\Windows\System\AdJRyXy.exe
  C:\Windows\System\AdJRyXy.exe
  2⤵
  PID:2532
- C:\Windows\System\ZADhPag.exe
  C:\Windows\System\ZADhPag.exe
  2⤵
  PID:724
- C:\Windows\System\zTloLWW.exe
  C:\Windows\System\zTloLWW.exe
  2⤵
  PID:4860
- C:\Windows\System\ayiHrDu.exe
  C:\Windows\System\ayiHrDu.exe
  2⤵
  PID:2008
- C:\Windows\System\vvvgBkn.exe
  C:\Windows\System\vvvgBkn.exe
  2⤵
  PID:1288
- C:\Windows\System\VthTbYM.exe
  C:\Windows\System\VthTbYM.exe
  2⤵
  PID:4968
- C:\Windows\System\oKDRKeR.exe
  C:\Windows\System\oKDRKeR.exe
  2⤵
  PID:2352
- C:\Windows\System\meEEEAK.exe
  C:\Windows\System\meEEEAK.exe
  2⤵
  PID:1112
- C:\Windows\System\tPjpbiJ.exe
  C:\Windows\System\tPjpbiJ.exe
  2⤵
  PID:3244
- C:\Windows\System\JsPvyod.exe
  C:\Windows\System\JsPvyod.exe
  2⤵
  PID:2104
- C:\Windows\System\MMmOKgm.exe
  C:\Windows\System\MMmOKgm.exe
  2⤵
  PID:4960
- C:\Windows\System\URIeuRG.exe
  C:\Windows\System\URIeuRG.exe
  2⤵
  PID:4456
- C:\Windows\System\lwXxYeQ.exe
  C:\Windows\System\lwXxYeQ.exe
  2⤵
  PID:4328
- C:\Windows\System\QeMXxbm.exe
  C:\Windows\System\QeMXxbm.exe
  2⤵
  PID:1304
- C:\Windows\System\PGKzRMy.exe
  C:\Windows\System\PGKzRMy.exe
  2⤵
  PID:4276
- C:\Windows\System\HNMkWDD.exe
  C:\Windows\System\HNMkWDD.exe
  2⤵
  PID:4264
- C:\Windows\System\cvEouxt.exe
  C:\Windows\System\cvEouxt.exe
  2⤵
  PID:5148
- C:\Windows\System\ytKtckY.exe
  C:\Windows\System\ytKtckY.exe
  2⤵
  PID:5180
- C:\Windows\System\xLHFfoB.exe
  C:\Windows\System\xLHFfoB.exe
  2⤵
  PID:5200
- C:\Windows\System\mWAggLe.exe
  C:\Windows\System\mWAggLe.exe
  2⤵
  PID:5224
- C:\Windows\System\jpsiFZB.exe
  C:\Windows\System\jpsiFZB.exe
  2⤵
  PID:5240
- C:\Windows\System\fxanCoe.exe
  C:\Windows\System\fxanCoe.exe
  2⤵
  PID:5260
- C:\Windows\System\BlQmhdm.exe
  C:\Windows\System\BlQmhdm.exe
  2⤵
  PID:5288
- C:\Windows\System\PBMoQUh.exe
  C:\Windows\System\PBMoQUh.exe
  2⤵
  PID:5304
- C:\Windows\System\fGJFNmr.exe
  C:\Windows\System\fGJFNmr.exe
  2⤵
  PID:5324
- C:\Windows\System\xccBBAE.exe
  C:\Windows\System\xccBBAE.exe
  2⤵
  PID:5352
- C:\Windows\System\pxRFdIn.exe
  C:\Windows\System\pxRFdIn.exe
  2⤵
  PID:5372
- C:\Windows\System\IpVnkSi.exe
  C:\Windows\System\IpVnkSi.exe
  2⤵
  PID:5388
- C:\Windows\System\qJoURfc.exe
  C:\Windows\System\qJoURfc.exe
  2⤵
  PID:5408
- C:\Windows\System\gaUTOCQ.exe
  C:\Windows\System\gaUTOCQ.exe
  2⤵
  PID:5424
- C:\Windows\System\DQLROJe.exe
  C:\Windows\System\DQLROJe.exe
  2⤵
  PID:5444
- C:\Windows\System\VqkejFW.exe
  C:\Windows\System\VqkejFW.exe
  2⤵
  PID:5460
- C:\Windows\System\xYtjKNE.exe
  C:\Windows\System\xYtjKNE.exe
  2⤵
  PID:5484
- C:\Windows\System\AJQoPJK.exe
  C:\Windows\System\AJQoPJK.exe
  2⤵
  PID:5516
- C:\Windows\System\tFoDgkT.exe
  C:\Windows\System\tFoDgkT.exe
  2⤵
  PID:5544
- C:\Windows\System\UPyKekn.exe
  C:\Windows\System\UPyKekn.exe
  2⤵
  PID:5564
- C:\Windows\System\etPwnMi.exe
  C:\Windows\System\etPwnMi.exe
  2⤵
  PID:5580
- C:\Windows\System\gsfERkv.exe
  C:\Windows\System\gsfERkv.exe
  2⤵
  PID:5612
- C:\Windows\System\SfpwoSn.exe
  C:\Windows\System\SfpwoSn.exe
  2⤵
  PID:5628
- C:\Windows\System\HHOMCVt.exe
  C:\Windows\System\HHOMCVt.exe
  2⤵
  PID:5652
- C:\Windows\System\WaWffkz.exe
  C:\Windows\System\WaWffkz.exe
  2⤵
  PID:5672
- C:\Windows\System\eQYWaIy.exe
  C:\Windows\System\eQYWaIy.exe
  2⤵
  PID:5696
- C:\Windows\System\qDtlPyD.exe
  C:\Windows\System\qDtlPyD.exe
  2⤵
  PID:5716
- C:\Windows\System\VFXBCHJ.exe
  C:\Windows\System\VFXBCHJ.exe
  2⤵
  PID:5732
- C:\Windows\System\FTQDhor.exe
  C:\Windows\System\FTQDhor.exe
  2⤵
  PID:5756
- C:\Windows\System\dwKqicC.exe
  C:\Windows\System\dwKqicC.exe
  2⤵
  PID:5772
- C:\Windows\System\RkWSRDU.exe
  C:\Windows\System\RkWSRDU.exe
  2⤵
  PID:5796
- C:\Windows\System\qkAChin.exe
  C:\Windows\System\qkAChin.exe
  2⤵
  PID:5812
- C:\Windows\System\doVCbit.exe
  C:\Windows\System\doVCbit.exe
  2⤵
  PID:5840
- C:\Windows\System\yFpCsuq.exe
  C:\Windows\System\yFpCsuq.exe
  2⤵
  PID:5860
- C:\Windows\System\TFmtIKI.exe
  C:\Windows\System\TFmtIKI.exe
  2⤵
  PID:5884
- C:\Windows\System\aAMkFUG.exe
  C:\Windows\System\aAMkFUG.exe
  2⤵
  PID:5900
- C:\Windows\System\CoZzLxT.exe
  C:\Windows\System\CoZzLxT.exe
  2⤵
  PID:5924
- C:\Windows\System\rkBdeqM.exe
  C:\Windows\System\rkBdeqM.exe
  2⤵
  PID:5944
- C:\Windows\System\MFtbtfb.exe
  C:\Windows\System\MFtbtfb.exe
  2⤵
  PID:5960
- C:\Windows\System\VIIyzOb.exe
  C:\Windows\System\VIIyzOb.exe
  2⤵
  PID:5984
- C:\Windows\System\QGEUZkj.exe
  C:\Windows\System\QGEUZkj.exe
  2⤵
  PID:6004
- C:\Windows\System\WpWxVkJ.exe
  C:\Windows\System\WpWxVkJ.exe
  2⤵
  PID:6028
- C:\Windows\System\VBSRwez.exe
  C:\Windows\System\VBSRwez.exe
  2⤵
  PID:6048
- C:\Windows\System\SjSLtVe.exe
  C:\Windows\System\SjSLtVe.exe
  2⤵
  PID:6068
- C:\Windows\System\PxIOYRU.exe
  C:\Windows\System\PxIOYRU.exe
  2⤵
  PID:6088
- C:\Windows\System\kMZTCaR.exe
  C:\Windows\System\kMZTCaR.exe
  2⤵
  PID:6108
- C:\Windows\System\mvawXPp.exe
  C:\Windows\System\mvawXPp.exe
  2⤵
  PID:6132
- C:\Windows\System\ethNkjO.exe
  C:\Windows\System\ethNkjO.exe
  2⤵
  PID:4300
- C:\Windows\System\qjZUOue.exe
  C:\Windows\System\qjZUOue.exe
  2⤵
  PID:4580
- C:\Windows\System\DMESvFH.exe
  C:\Windows\System\DMESvFH.exe
  2⤵
  PID:3948
- C:\Windows\System\HpQSCOc.exe
  C:\Windows\System\HpQSCOc.exe
  2⤵
  PID:4708
- C:\Windows\System\nTrvTmK.exe
  C:\Windows\System\nTrvTmK.exe
  2⤵
  PID:5132
- C:\Windows\System\XoZgQPz.exe
  C:\Windows\System\XoZgQPz.exe
  2⤵
  PID:2400
- C:\Windows\System\EHdWbgn.exe
  C:\Windows\System\EHdWbgn.exe
  2⤵
  PID:5396
- C:\Windows\System\HGVHKGa.exe
  C:\Windows\System\HGVHKGa.exe
  2⤵
  PID:5416
- C:\Windows\System\UYHNaAu.exe
  C:\Windows\System\UYHNaAu.exe
  2⤵
  PID:5480
- C:\Windows\System\ylLfmcw.exe
  C:\Windows\System\ylLfmcw.exe
  2⤵
  PID:5248
- C:\Windows\System\WdCJVfV.exe
  C:\Windows\System\WdCJVfV.exe
  2⤵
  PID:5188
- C:\Windows\System\ihMYSNJ.exe
  C:\Windows\System\ihMYSNJ.exe
  2⤵
  PID:5368
- C:\Windows\System\ESfbVfi.exe
  C:\Windows\System\ESfbVfi.exe
  2⤵
  PID:5576
- C:\Windows\System\ehdXhIn.exe
  C:\Windows\System\ehdXhIn.exe
  2⤵
  PID:5436
- C:\Windows\System\WrIZkyH.exe
  C:\Windows\System\WrIZkyH.exe
  2⤵
  PID:3044
- C:\Windows\System\vQxZWmB.exe
  C:\Windows\System\vQxZWmB.exe
  2⤵
  PID:4872
- C:\Windows\System\eYifdtw.exe
  C:\Windows\System\eYifdtw.exe
  2⤵
  PID:5276
- C:\Windows\System\FUXZCfE.exe
  C:\Windows\System\FUXZCfE.exe
  2⤵
  PID:5684
- C:\Windows\System\HlEsTHi.exe
  C:\Windows\System\HlEsTHi.exe
  2⤵
  PID:5768
- C:\Windows\System\rvYfFZB.exe
  C:\Windows\System\rvYfFZB.exe
  2⤵
  PID:5792
- C:\Windows\System\NMnDjFc.exe
  C:\Windows\System\NMnDjFc.exe
  2⤵
  PID:5556
- C:\Windows\System\VSuMWqC.exe
  C:\Windows\System\VSuMWqC.exe
  2⤵
  PID:5620
- C:\Windows\System\rgHmDjG.exe
  C:\Windows\System\rgHmDjG.exe
  2⤵
  PID:5968
- C:\Windows\System\wfdZxWR.exe
  C:\Windows\System\wfdZxWR.exe
  2⤵
  PID:6036
- C:\Windows\System\RMrrTbl.exe
  C:\Windows\System\RMrrTbl.exe
  2⤵
  PID:3848
- C:\Windows\System\eTboHRH.exe
  C:\Windows\System\eTboHRH.exe
  2⤵
  PID:5868
- C:\Windows\System\fVwieCt.exe
  C:\Windows\System\fVwieCt.exe
  2⤵
  PID:5908
- C:\Windows\System\pxlpMLs.exe
  C:\Windows\System\pxlpMLs.exe
  2⤵
  PID:6168
- C:\Windows\System\HgrorEW.exe
  C:\Windows\System\HgrorEW.exe
  2⤵
  PID:6196
- C:\Windows\System\bKCLDfL.exe
  C:\Windows\System\bKCLDfL.exe
  2⤵
  PID:6220
- C:\Windows\System\KIEUKIR.exe
  C:\Windows\System\KIEUKIR.exe
  2⤵
  PID:6248
- C:\Windows\System\adlEjEJ.exe
  C:\Windows\System\adlEjEJ.exe
  2⤵
  PID:6268
- C:\Windows\System\gbmsYHn.exe
  C:\Windows\System\gbmsYHn.exe
  2⤵
  PID:6292
- C:\Windows\System\rbwbLKc.exe
  C:\Windows\System\rbwbLKc.exe
  2⤵
  PID:6316
- C:\Windows\System\qhLkLJY.exe
  C:\Windows\System\qhLkLJY.exe
  2⤵
  PID:6336
- C:\Windows\System\TeVsdPu.exe
  C:\Windows\System\TeVsdPu.exe
  2⤵
  PID:6364
- C:\Windows\System\PEYPpPN.exe
  C:\Windows\System\PEYPpPN.exe
  2⤵
  PID:6384
- C:\Windows\System\njMKIRq.exe
  C:\Windows\System\njMKIRq.exe
  2⤵
  PID:6408
- C:\Windows\System\jfdImhM.exe
  C:\Windows\System\jfdImhM.exe
  2⤵
  PID:6424
- C:\Windows\System\WlrVCtU.exe
  C:\Windows\System\WlrVCtU.exe
  2⤵
  PID:6460
- C:\Windows\System\LUqUjxy.exe
  C:\Windows\System\LUqUjxy.exe
  2⤵
  PID:6480
- C:\Windows\System\FzLNhWH.exe
  C:\Windows\System\FzLNhWH.exe
  2⤵
  PID:6504
- C:\Windows\System\YfCLiWO.exe
  C:\Windows\System\YfCLiWO.exe
  2⤵
  PID:6528
- C:\Windows\System\jUBsLNh.exe
  C:\Windows\System\jUBsLNh.exe
  2⤵
  PID:6548
- C:\Windows\System\dveQzHq.exe
  C:\Windows\System\dveQzHq.exe
  2⤵
  PID:6568
- C:\Windows\System\NorhSvU.exe
  C:\Windows\System\NorhSvU.exe
  2⤵
  PID:6588
- C:\Windows\System\UYXwXrl.exe
  C:\Windows\System\UYXwXrl.exe
  2⤵
  PID:6612
- C:\Windows\System\nOWcKei.exe
  C:\Windows\System\nOWcKei.exe
  2⤵
  PID:6636
- C:\Windows\System\JZARyyn.exe
  C:\Windows\System\JZARyyn.exe
  2⤵
  PID:6660
- C:\Windows\System\yCCUbsQ.exe
  C:\Windows\System\yCCUbsQ.exe
  2⤵
  PID:6676
- C:\Windows\System\JqpBfBS.exe
  C:\Windows\System\JqpBfBS.exe
  2⤵
  PID:6700
- C:\Windows\System\rRrikTd.exe
  C:\Windows\System\rRrikTd.exe
  2⤵
  PID:6716
- C:\Windows\System\kmkTcTG.exe
  C:\Windows\System\kmkTcTG.exe
  2⤵
  PID:6740
- C:\Windows\System\gqHTKsA.exe
  C:\Windows\System\gqHTKsA.exe
  2⤵
  PID:6764
- C:\Windows\System\jUUZAvD.exe
  C:\Windows\System\jUUZAvD.exe
  2⤵
  PID:6780
- C:\Windows\System\fEpnjur.exe
  C:\Windows\System\fEpnjur.exe
  2⤵
  PID:6804
- C:\Windows\System\BpXYUhk.exe
  C:\Windows\System\BpXYUhk.exe
  2⤵
  PID:6828
- C:\Windows\System\lJGqenB.exe
  C:\Windows\System\lJGqenB.exe
  2⤵
  PID:6856
- C:\Windows\System\tnFjMAm.exe
  C:\Windows\System\tnFjMAm.exe
  2⤵
  PID:6876
- C:\Windows\System\hloOIeI.exe
  C:\Windows\System\hloOIeI.exe
  2⤵
  PID:6900
- C:\Windows\System\NHYWOda.exe
  C:\Windows\System\NHYWOda.exe
  2⤵
  PID:6916
- C:\Windows\System\bYDJtyp.exe
  C:\Windows\System\bYDJtyp.exe
  2⤵
  PID:6944
- C:\Windows\System\UwJiArv.exe
  C:\Windows\System\UwJiArv.exe
  2⤵
  PID:6960
- C:\Windows\System\EctfdQy.exe
  C:\Windows\System\EctfdQy.exe
  2⤵
  PID:6984
- C:\Windows\System\ZbdrKeC.exe
  C:\Windows\System\ZbdrKeC.exe
  2⤵
  PID:7004
- C:\Windows\System\kiOpott.exe
  C:\Windows\System\kiOpott.exe
  2⤵
  PID:7020
- C:\Windows\System\XvQveWX.exe
  C:\Windows\System\XvQveWX.exe
  2⤵
  PID:7044
- C:\Windows\System\gVNVutV.exe
  C:\Windows\System\gVNVutV.exe
  2⤵
  PID:7060
- C:\Windows\System\RUaAiHK.exe
  C:\Windows\System\RUaAiHK.exe
  2⤵
  PID:7088
- C:\Windows\System\NjZjTqk.exe
  C:\Windows\System\NjZjTqk.exe
  2⤵
  PID:7104
- C:\Windows\System\rNOLQzs.exe
  C:\Windows\System\rNOLQzs.exe
  2⤵
  PID:7124
- C:\Windows\System\TdapxYP.exe
  C:\Windows\System\TdapxYP.exe
  2⤵
  PID:7148
- C:\Windows\System\NfndeMZ.exe
  C:\Windows\System\NfndeMZ.exe
  2⤵
  PID:2552
- C:\Windows\System\bEJorCd.exe
  C:\Windows\System\bEJorCd.exe
  2⤵
  PID:5128
- C:\Windows\System\BBMXnsZ.exe
  C:\Windows\System\BBMXnsZ.exe
  2⤵
  PID:5384
- C:\Windows\System\LCPFXeu.exe
  C:\Windows\System\LCPFXeu.exe
  2⤵
  PID:5940
- C:\Windows\System\RqNAwuL.exe
  C:\Windows\System\RqNAwuL.exe
  2⤵
  PID:5364
- C:\Windows\System\ZymBtoy.exe
  C:\Windows\System\ZymBtoy.exe
  2⤵
  PID:3392
- C:\Windows\System\EuiuggL.exe
  C:\Windows\System\EuiuggL.exe
  2⤵
  PID:5752
- C:\Windows\System\IaVPqaB.exe
  C:\Windows\System\IaVPqaB.exe
  2⤵
  PID:5808
- C:\Windows\System\oVxvWVT.exe
  C:\Windows\System\oVxvWVT.exe
  2⤵
  PID:5680
- C:\Windows\System\afCkbHp.exe
  C:\Windows\System\afCkbHp.exe
  2⤵
  PID:6120
- C:\Windows\System\ZKCMNuE.exe
  C:\Windows\System\ZKCMNuE.exe
  2⤵
  PID:6152
- C:\Windows\System\ahNzzJH.exe
  C:\Windows\System\ahNzzJH.exe
  2⤵
  PID:6180
- C:\Windows\System\qJknxJO.exe
  C:\Windows\System\qJknxJO.exe
  2⤵
  PID:6236
- C:\Windows\System\IdrazID.exe
  C:\Windows\System\IdrazID.exe
  2⤵
  PID:5524
- C:\Windows\System\vgMXuGL.exe
  C:\Windows\System\vgMXuGL.exe
  2⤵
  PID:5976
- C:\Windows\System\XYNLJIm.exe
  C:\Windows\System\XYNLJIm.exe
  2⤵
  PID:5896
- C:\Windows\System\yLedXWn.exe
  C:\Windows\System\yLedXWn.exe
  2⤵
  PID:6076
- C:\Windows\System\kotdGUr.exe
  C:\Windows\System\kotdGUr.exe
  2⤵
  PID:6456
- C:\Windows\System\ncWqesq.exe
  C:\Windows\System\ncWqesq.exe
  2⤵
  PID:6516
- C:\Windows\System\BtOGFFs.exe
  C:\Windows\System\BtOGFFs.exe
  2⤵
  PID:6596
- C:\Windows\System\chcVqje.exe
  C:\Windows\System\chcVqje.exe
  2⤵
  PID:6208
- C:\Windows\System\ypjzgMT.exe
  C:\Windows\System\ypjzgMT.exe
  2⤵
  PID:6800
- C:\Windows\System\kocfXZE.exe
  C:\Windows\System\kocfXZE.exe
  2⤵
  PID:6848
- C:\Windows\System\suGgEJw.exe
  C:\Windows\System\suGgEJw.exe
  2⤵
  PID:7176
- C:\Windows\System\HldIanP.exe
  C:\Windows\System\HldIanP.exe
  2⤵
  PID:7200
- C:\Windows\System\pajOSKy.exe
  C:\Windows\System\pajOSKy.exe
  2⤵
  PID:7224
- C:\Windows\System\BYQtiPu.exe
  C:\Windows\System\BYQtiPu.exe
  2⤵
  PID:7240
- C:\Windows\System\hQRytyU.exe
  C:\Windows\System\hQRytyU.exe
  2⤵
  PID:7264
- C:\Windows\System\cQZDJIc.exe
  C:\Windows\System\cQZDJIc.exe
  2⤵
  PID:7284
- C:\Windows\System\ZMsYByH.exe
  C:\Windows\System\ZMsYByH.exe
  2⤵
  PID:7308
- C:\Windows\System\heEadRh.exe
  C:\Windows\System\heEadRh.exe
  2⤵
  PID:7324
- C:\Windows\System\PinZEGF.exe
  C:\Windows\System\PinZEGF.exe
  2⤵
  PID:7348
- C:\Windows\System\WqvKJcq.exe
  C:\Windows\System\WqvKJcq.exe
  2⤵
  PID:7372
- C:\Windows\System\roZsxIC.exe
  C:\Windows\System\roZsxIC.exe
  2⤵
  PID:7388
- C:\Windows\System\HArHLNT.exe
  C:\Windows\System\HArHLNT.exe
  2⤵
  PID:7412
- C:\Windows\System\weWaZHV.exe
  C:\Windows\System\weWaZHV.exe
  2⤵
  PID:7436
- C:\Windows\System\zFfTIsv.exe
  C:\Windows\System\zFfTIsv.exe
  2⤵
  PID:7456
- C:\Windows\System\aEdfmfm.exe
  C:\Windows\System\aEdfmfm.exe
  2⤵
  PID:7476
- C:\Windows\System\IugTTwO.exe
  C:\Windows\System\IugTTwO.exe
  2⤵
  PID:7500
- C:\Windows\System\TcAqGqj.exe
  C:\Windows\System\TcAqGqj.exe
  2⤵
  PID:7520
- C:\Windows\System\fGQfHgy.exe
  C:\Windows\System\fGQfHgy.exe
  2⤵
  PID:7544
- C:\Windows\System\TxLUuSx.exe
  C:\Windows\System\TxLUuSx.exe
  2⤵
  PID:7564
- C:\Windows\System\DRnxein.exe
  C:\Windows\System\DRnxein.exe
  2⤵
  PID:7584
- C:\Windows\System\fBJheew.exe
  C:\Windows\System\fBJheew.exe
  2⤵
  PID:7608
- C:\Windows\System\gbDLajC.exe
  C:\Windows\System\gbDLajC.exe
  2⤵
  PID:7636
- C:\Windows\System\canqdEi.exe
  C:\Windows\System\canqdEi.exe
  2⤵
  PID:7656
- C:\Windows\System\HlvLgns.exe
  C:\Windows\System\HlvLgns.exe
  2⤵
  PID:7680
- C:\Windows\System\UXEsorQ.exe
  C:\Windows\System\UXEsorQ.exe
  2⤵
  PID:7700
- C:\Windows\System\YTGBITc.exe
  C:\Windows\System\YTGBITc.exe
  2⤵
  PID:7720
- C:\Windows\System\lNBaQFV.exe
  C:\Windows\System\lNBaQFV.exe
  2⤵
  PID:7748
- C:\Windows\System\ewTayGT.exe
  C:\Windows\System\ewTayGT.exe
  2⤵
  PID:7768
- C:\Windows\System\hSHRWOL.exe
  C:\Windows\System\hSHRWOL.exe
  2⤵
  PID:7788
- C:\Windows\System\XSYlrXi.exe
  C:\Windows\System\XSYlrXi.exe
  2⤵
  PID:7808
- C:\Windows\System\FbtkCbH.exe
  C:\Windows\System\FbtkCbH.exe
  2⤵
  PID:8028
- C:\Windows\System\nyBUQws.exe
  C:\Windows\System\nyBUQws.exe
  2⤵
  PID:8088
- C:\Windows\System\koLaaVg.exe
  C:\Windows\System\koLaaVg.exe
  2⤵
  PID:8104
- C:\Windows\System\YOGsJkq.exe
  C:\Windows\System\YOGsJkq.exe
  2⤵
  PID:8128
- C:\Windows\System\BnUtkmL.exe
  C:\Windows\System\BnUtkmL.exe
  2⤵
  PID:8152
- C:\Windows\System\RyijWMw.exe
  C:\Windows\System\RyijWMw.exe
  2⤵
  PID:8172
- C:\Windows\System\kxCqkfk.exe
  C:\Windows\System\kxCqkfk.exe
  2⤵
  PID:6356
- C:\Windows\System\BoZlqgj.exe
  C:\Windows\System\BoZlqgj.exe
  2⤵
  PID:6432
- C:\Windows\System\YuYPKOd.exe
  C:\Windows\System\YuYPKOd.exe
  2⤵
  PID:6488
- C:\Windows\System\OZTazZo.exe
  C:\Windows\System\OZTazZo.exe
  2⤵
  PID:7080
- C:\Windows\System\xjBExTB.exe
  C:\Windows\System\xjBExTB.exe
  2⤵
  PID:2776
- C:\Windows\System\GXsyMKG.exe
  C:\Windows\System\GXsyMKG.exe
  2⤵
  PID:5348
- C:\Windows\System\rgPuCDW.exe
  C:\Windows\System\rgPuCDW.exe
  2⤵
  PID:6576
- C:\Windows\System\FUEGFdq.exe
  C:\Windows\System\FUEGFdq.exe
  2⤵
  PID:6672
- C:\Windows\System\sIqHeZq.exe
  C:\Windows\System\sIqHeZq.exe
  2⤵
  PID:6788
- C:\Windows\System\gNCprKh.exe
  C:\Windows\System\gNCprKh.exe
  2⤵
  PID:6328
- C:\Windows\System\ZVBHlNG.exe
  C:\Windows\System\ZVBHlNG.exe
  2⤵
  PID:6840
- C:\Windows\System\FinECtp.exe
  C:\Windows\System\FinECtp.exe
  2⤵
  PID:7280
- C:\Windows\System\mHtlmDx.exe
  C:\Windows\System\mHtlmDx.exe
  2⤵
  PID:6468
- C:\Windows\System\CQUdldl.exe
  C:\Windows\System\CQUdldl.exe
  2⤵
  PID:7516
- C:\Windows\System\iSyhaGO.exe
  C:\Windows\System\iSyhaGO.exe
  2⤵
  PID:3868
- C:\Windows\System\ZlBgYza.exe
  C:\Windows\System\ZlBgYza.exe
  2⤵
  PID:5196
- C:\Windows\System\sYHNcxA.exe
  C:\Windows\System\sYHNcxA.exe
  2⤵
  PID:7688
- C:\Windows\System\EGUffeB.exe
  C:\Windows\System\EGUffeB.exe
  2⤵
  PID:6628
- C:\Windows\System\BvHwMGF.exe
  C:\Windows\System\BvHwMGF.exe
  2⤵
  PID:6668
- C:\Windows\System\KixWSIU.exe
  C:\Windows\System\KixWSIU.exe
  2⤵
  PID:6736
- C:\Windows\System\tcHFoHj.exe
  C:\Windows\System\tcHFoHj.exe
  2⤵
  PID:7796
- C:\Windows\System\TUGJtDd.exe
  C:\Windows\System\TUGJtDd.exe
  2⤵
  PID:7712
- C:\Windows\System\CPgUzRZ.exe
  C:\Windows\System\CPgUzRZ.exe
  2⤵
  PID:7192
- C:\Windows\System\xHPvSog.exe
  C:\Windows\System\xHPvSog.exe
  2⤵
  PID:7340
- C:\Windows\System\xzszfOW.exe
  C:\Windows\System\xzszfOW.exe
  2⤵
  PID:7512
- C:\Windows\System\SenacIb.exe
  C:\Windows\System\SenacIb.exe
  2⤵
  PID:7196
- C:\Windows\System\LHmiNqz.exe
  C:\Windows\System\LHmiNqz.exe
  2⤵
  PID:6912
- C:\Windows\System\ZoZklBy.exe
  C:\Windows\System\ZoZklBy.exe
  2⤵
  PID:7396
- C:\Windows\System\vSVjxrl.exe
  C:\Windows\System\vSVjxrl.exe
  2⤵
  PID:7140
- C:\Windows\System\WJQlmXW.exe
  C:\Windows\System\WJQlmXW.exe
  2⤵
  PID:7164
- C:\Windows\System\erDzWVH.exe
  C:\Windows\System\erDzWVH.exe
  2⤵
  PID:7972
- C:\Windows\System\pmbKltN.exe
  C:\Windows\System\pmbKltN.exe
  2⤵
  PID:8208
- C:\Windows\System\XXTuZsB.exe
  C:\Windows\System\XXTuZsB.exe
  2⤵
  PID:8228
- C:\Windows\System\XntccXH.exe
  C:\Windows\System\XntccXH.exe
  2⤵
  PID:8252
- C:\Windows\System\BYGGCSc.exe
  C:\Windows\System\BYGGCSc.exe
  2⤵
  PID:8272
- C:\Windows\System\MjwvtVk.exe
  C:\Windows\System\MjwvtVk.exe
  2⤵
  PID:8292
- C:\Windows\System\yiClNTj.exe
  C:\Windows\System\yiClNTj.exe
  2⤵
  PID:8316
- C:\Windows\System\dYQTuWR.exe
  C:\Windows\System\dYQTuWR.exe
  2⤵
  PID:8332
- C:\Windows\System\NnTKiwM.exe
  C:\Windows\System\NnTKiwM.exe
  2⤵
  PID:8360
- C:\Windows\System\YZXEiNM.exe
  C:\Windows\System\YZXEiNM.exe
  2⤵
  PID:8380
- C:\Windows\System\NZEpZgR.exe
  C:\Windows\System\NZEpZgR.exe
  2⤵
  PID:8404
- C:\Windows\System\XdLmwXB.exe
  C:\Windows\System\XdLmwXB.exe
  2⤵
  PID:8424
- C:\Windows\System\ZzOxGFI.exe
  C:\Windows\System\ZzOxGFI.exe
  2⤵
  PID:8444
- C:\Windows\System\jgylglZ.exe
  C:\Windows\System\jgylglZ.exe
  2⤵
  PID:8468
- C:\Windows\System\woBsKUG.exe
  C:\Windows\System\woBsKUG.exe
  2⤵
  PID:8500
- C:\Windows\System\olKOLVr.exe
  C:\Windows\System\olKOLVr.exe
  2⤵
  PID:8520
- C:\Windows\System\vBpqBzI.exe
  C:\Windows\System\vBpqBzI.exe
  2⤵
  PID:8544
- C:\Windows\System\yQYFArc.exe
  C:\Windows\System\yQYFArc.exe
  2⤵
  PID:8568
- C:\Windows\System\nyUGpNj.exe
  C:\Windows\System\nyUGpNj.exe
  2⤵
  PID:8584
- C:\Windows\System\djsjotg.exe
  C:\Windows\System\djsjotg.exe
  2⤵
  PID:8612
- C:\Windows\System\qWOmDOB.exe
  C:\Windows\System\qWOmDOB.exe
  2⤵
  PID:8636
- C:\Windows\System\yzrXNjn.exe
  C:\Windows\System\yzrXNjn.exe
  2⤵
  PID:8656
- C:\Windows\System\CRtMNIl.exe
  C:\Windows\System\CRtMNIl.exe
  2⤵
  PID:8692
- C:\Windows\System\LWaYgsu.exe
  C:\Windows\System\LWaYgsu.exe
  2⤵
  PID:8712
- C:\Windows\System\lCctIuF.exe
  C:\Windows\System\lCctIuF.exe
  2⤵
  PID:8744
- C:\Windows\System\gNjELYa.exe
  C:\Windows\System\gNjELYa.exe
  2⤵
  PID:8772
- C:\Windows\System\MoLKRJN.exe
  C:\Windows\System\MoLKRJN.exe
  2⤵
  PID:8792
- C:\Windows\System\qMXMfCs.exe
  C:\Windows\System\qMXMfCs.exe
  2⤵
  PID:8824
- C:\Windows\System\MlZEHWV.exe
  C:\Windows\System\MlZEHWV.exe
  2⤵
  PID:8848
- C:\Windows\System\KtXIWDP.exe
  C:\Windows\System\KtXIWDP.exe
  2⤵
  PID:8868
- C:\Windows\System\uDThmEL.exe
  C:\Windows\System\uDThmEL.exe
  2⤵
  PID:8888
- C:\Windows\System\iGbXSWE.exe
  C:\Windows\System\iGbXSWE.exe
  2⤵
  PID:8904
- C:\Windows\System\esqvRXT.exe
  C:\Windows\System\esqvRXT.exe
  2⤵
  PID:8932
- C:\Windows\System\YPLYlWl.exe
  C:\Windows\System\YPLYlWl.exe
  2⤵
  PID:8952
- C:\Windows\System\HPXOsha.exe
  C:\Windows\System\HPXOsha.exe
  2⤵
  PID:8984
- C:\Windows\System\yHytlnI.exe
  C:\Windows\System\yHytlnI.exe
  2⤵
  PID:9000
- C:\Windows\System\VTKfYQS.exe
  C:\Windows\System\VTKfYQS.exe
  2⤵
  PID:9024
- C:\Windows\System\krVMEyW.exe
  C:\Windows\System\krVMEyW.exe
  2⤵
  PID:9048
- C:\Windows\System\tZrOzHP.exe
  C:\Windows\System\tZrOzHP.exe
  2⤵
  PID:9068
- C:\Windows\System\LdtRXkS.exe
  C:\Windows\System\LdtRXkS.exe
  2⤵
  PID:9084
- C:\Windows\System\yZBXuTx.exe
  C:\Windows\System\yZBXuTx.exe
  2⤵
  PID:9104
- C:\Windows\System\mafwnMc.exe
  C:\Windows\System\mafwnMc.exe
  2⤵
  PID:7120
- C:\Windows\System\YYewHIl.exe
  C:\Windows\System\YYewHIl.exe
  2⤵
  PID:6924
- C:\Windows\System\wrqKJHj.exe
  C:\Windows\System\wrqKJHj.exe
  2⤵
  PID:7432
- C:\Windows\System\DAnKMDz.exe
  C:\Windows\System\DAnKMDz.exe
  2⤵
  PID:7496
- C:\Windows\System\izylWJW.exe
  C:\Windows\System\izylWJW.exe
  2⤵
  PID:7556
- C:\Windows\System\CLHrdpa.exe
  C:\Windows\System\CLHrdpa.exe
  2⤵
  PID:7468
- C:\Windows\System\XnPpVkO.exe
  C:\Windows\System\XnPpVkO.exe
  2⤵
  PID:7956
- C:\Windows\System\GfyADZR.exe
  C:\Windows\System\GfyADZR.exe
  2⤵
  PID:8244
- C:\Windows\System\HnQsBxm.exe
  C:\Windows\System\HnQsBxm.exe
  2⤵
  PID:8396
- C:\Windows\System\NMOhqDI.exe
  C:\Windows\System\NMOhqDI.exe
  2⤵
  PID:8464
- C:\Windows\System\EiWfJoN.exe
  C:\Windows\System\EiWfJoN.exe
  2⤵
  PID:8552
- C:\Windows\System\vIJSgiE.exe
  C:\Windows\System\vIJSgiE.exe
  2⤵
  PID:7552
- C:\Windows\System\dgjvZov.exe
  C:\Windows\System\dgjvZov.exe
  2⤵
  PID:6540
- C:\Windows\System\IEzgHHM.exe
  C:\Windows\System\IEzgHHM.exe
  2⤵
  PID:8884
- C:\Windows\System\wJHbNUA.exe
  C:\Windows\System\wJHbNUA.exe
  2⤵
  PID:8916
- C:\Windows\System\YSUZCCF.exe
  C:\Windows\System\YSUZCCF.exe
  2⤵
  PID:7880
- C:\Windows\System\wRbDyhz.exe
  C:\Windows\System\wRbDyhz.exe
  2⤵
  PID:6772
- C:\Windows\System\MmGBzbU.exe
  C:\Windows\System\MmGBzbU.exe
  2⤵
  PID:8996
- C:\Windows\System\mWlPiJU.exe
  C:\Windows\System\mWlPiJU.exe
  2⤵
  PID:9076
- C:\Windows\System\hBjBBib.exe
  C:\Windows\System\hBjBBib.exe
  2⤵
  PID:9232
- C:\Windows\System\OFiLNrT.exe
  C:\Windows\System\OFiLNrT.exe
  2⤵
  PID:9260
- C:\Windows\System\vFuSuPS.exe
  C:\Windows\System\vFuSuPS.exe
  2⤵
  PID:9280
- C:\Windows\System\sdghAhr.exe
  C:\Windows\System\sdghAhr.exe
  2⤵
  PID:9300
- C:\Windows\System\LZkiMkP.exe
  C:\Windows\System\LZkiMkP.exe
  2⤵
  PID:9324
- C:\Windows\System\PDFzEwg.exe
  C:\Windows\System\PDFzEwg.exe
  2⤵
  PID:9344
- C:\Windows\System\dTMNwdo.exe
  C:\Windows\System\dTMNwdo.exe
  2⤵
  PID:9360
- C:\Windows\System\PCjpnuD.exe
  C:\Windows\System\PCjpnuD.exe
  2⤵
  PID:9384
- C:\Windows\System\XHPEuua.exe
  C:\Windows\System\XHPEuua.exe
  2⤵
  PID:9400
- C:\Windows\System\GRkySoC.exe
  C:\Windows\System\GRkySoC.exe
  2⤵
  PID:9436
- C:\Windows\System\OZLmtWe.exe
  C:\Windows\System\OZLmtWe.exe
  2⤵
  PID:9460
- C:\Windows\System\YAZRswG.exe
  C:\Windows\System\YAZRswG.exe
  2⤵
  PID:9476
- C:\Windows\System\vziKJnw.exe
  C:\Windows\System\vziKJnw.exe
  2⤵
  PID:9500
- C:\Windows\System\TNFMWCS.exe
  C:\Windows\System\TNFMWCS.exe
  2⤵
  PID:9516
- C:\Windows\System\VJKnvEq.exe
  C:\Windows\System\VJKnvEq.exe
  2⤵
  PID:9540
- C:\Windows\System\IlmZEKY.exe
  C:\Windows\System\IlmZEKY.exe
  2⤵
  PID:9560
- C:\Windows\System\GZZwRDD.exe
  C:\Windows\System\GZZwRDD.exe
  2⤵
  PID:9588
- C:\Windows\System\VwRQSxU.exe
  C:\Windows\System\VwRQSxU.exe
  2⤵
  PID:9612
- C:\Windows\System\PAIHJOJ.exe
  C:\Windows\System\PAIHJOJ.exe
  2⤵
  PID:9628
- C:\Windows\System\KNsTgKL.exe
  C:\Windows\System\KNsTgKL.exe
  2⤵
  PID:9668
- C:\Windows\System\jnYXbPT.exe
  C:\Windows\System\jnYXbPT.exe
  2⤵
  PID:9696
- C:\Windows\System\KukVRmJ.exe
  C:\Windows\System\KukVRmJ.exe
  2⤵
  PID:9724
- C:\Windows\System\idPtqHU.exe
  C:\Windows\System\idPtqHU.exe
  2⤵
  PID:9740
- C:\Windows\System\viEfWfe.exe
  C:\Windows\System\viEfWfe.exe
  2⤵
  PID:9756
- C:\Windows\System\VtjndoU.exe
  C:\Windows\System\VtjndoU.exe
  2⤵
  PID:9772
- C:\Windows\System\FWHVERq.exe
  C:\Windows\System\FWHVERq.exe
  2⤵
  PID:9792
- C:\Windows\System\mlJBVHf.exe
  C:\Windows\System\mlJBVHf.exe
  2⤵
  PID:9808
- C:\Windows\System\pifRPsP.exe
  C:\Windows\System\pifRPsP.exe
  2⤵
  PID:9836
- C:\Windows\System\AgYVpiG.exe
  C:\Windows\System\AgYVpiG.exe
  2⤵
  PID:9860
- C:\Windows\System\YoOLBnN.exe
  C:\Windows\System\YoOLBnN.exe
  2⤵
  PID:9884
- C:\Windows\System\DoAWGDu.exe
  C:\Windows\System\DoAWGDu.exe
  2⤵
  PID:9908
- C:\Windows\System\PCUzvaN.exe
  C:\Windows\System\PCUzvaN.exe
  2⤵
  PID:9924
- C:\Windows\System\tjwnHKs.exe
  C:\Windows\System\tjwnHKs.exe
  2⤵
  PID:9948
- C:\Windows\System\kNszNqV.exe
  C:\Windows\System\kNszNqV.exe
  2⤵
  PID:9968
- C:\Windows\System\hKypPYO.exe
  C:\Windows\System\hKypPYO.exe
  2⤵
  PID:9988
- C:\Windows\System\lnKEsiM.exe
  C:\Windows\System\lnKEsiM.exe
  2⤵
  PID:10016
- C:\Windows\System\PzNHEnW.exe
  C:\Windows\System\PzNHEnW.exe
  2⤵
  PID:10032
- C:\Windows\System\hkaZXaj.exe
  C:\Windows\System\hkaZXaj.exe
  2⤵
  PID:10064
- C:\Windows\System\vBaAtKP.exe
  C:\Windows\System\vBaAtKP.exe
  2⤵
  PID:10088
- C:\Windows\System\ilNWrDO.exe
  C:\Windows\System\ilNWrDO.exe
  2⤵
  PID:10112
- C:\Windows\System\oQCAKbo.exe
  C:\Windows\System\oQCAKbo.exe
  2⤵
  PID:10136
- C:\Windows\System\KRgQHur.exe
  C:\Windows\System\KRgQHur.exe
  2⤵
  PID:10152
- C:\Windows\System\iqMJaMv.exe
  C:\Windows\System\iqMJaMv.exe
  2⤵
  PID:10172
- C:\Windows\System\rPfHctB.exe
  C:\Windows\System\rPfHctB.exe
  2⤵
  PID:10196
- C:\Windows\System\GAcqYiO.exe
  C:\Windows\System\GAcqYiO.exe
  2⤵
  PID:10216
- C:\Windows\System\ekwPsQO.exe
  C:\Windows\System\ekwPsQO.exe
  2⤵
  PID:10236
- C:\Windows\System\oAfXxtW.exe
  C:\Windows\System\oAfXxtW.exe
  2⤵
  PID:6024
- C:\Windows\System\yAYDSRS.exe
  C:\Windows\System\yAYDSRS.exe
  2⤵
  PID:7232
- C:\Windows\System\yCsUbiU.exe
  C:\Windows\System\yCsUbiU.exe
  2⤵
  PID:7356
- C:\Windows\System\uZEnAYe.exe
  C:\Windows\System\uZEnAYe.exe
  2⤵
  PID:7540
- C:\Windows\System\kvwKBoH.exe
  C:\Windows\System\kvwKBoH.exe
  2⤵
  PID:8200
- C:\Windows\System\AfkQfel.exe
  C:\Windows\System\AfkQfel.exe
  2⤵
  PID:8288
- C:\Windows\System\RpbqBSC.exe
  C:\Windows\System\RpbqBSC.exe
  2⤵
  PID:7672
- C:\Windows\System\ThhkrRy.exe
  C:\Windows\System\ThhkrRy.exe
  2⤵
  PID:7448
- C:\Windows\System\elSjiQy.exe
  C:\Windows\System\elSjiQy.exe
  2⤵
  PID:8632
- C:\Windows\System\ackzbjR.exe
  C:\Windows\System\ackzbjR.exe
  2⤵
  PID:8800
- C:\Windows\System\vtOAIPs.exe
  C:\Windows\System\vtOAIPs.exe
  2⤵
  PID:8700
- C:\Windows\System\AUiOdgA.exe
  C:\Windows\System\AUiOdgA.exe
  2⤵
  PID:8144
- C:\Windows\System\JaiXZxG.exe
  C:\Windows\System\JaiXZxG.exe
  2⤵
  PID:8864
- C:\Windows\System\gowXmsf.exe
  C:\Windows\System\gowXmsf.exe
  2⤵
  PID:6620
- C:\Windows\System\ljMcCCI.exe
  C:\Windows\System\ljMcCCI.exe
  2⤵
  PID:1160
- C:\Windows\System\VqdMBfC.exe
  C:\Windows\System\VqdMBfC.exe
  2⤵
  PID:9016
- C:\Windows\System\HulpRqz.exe
  C:\Windows\System\HulpRqz.exe
  2⤵
  PID:9080
- C:\Windows\System\UpKEgLy.exe
  C:\Windows\System\UpKEgLy.exe
  2⤵
  PID:6624
- C:\Windows\System\JKwVJik.exe
  C:\Windows\System\JKwVJik.exe
  2⤵
  PID:10244
- C:\Windows\System\CgVUTqm.exe
  C:\Windows\System\CgVUTqm.exe
  2⤵
  PID:10272
- C:\Windows\System\RvDyGnf.exe
  C:\Windows\System\RvDyGnf.exe
  2⤵
  PID:10288
- C:\Windows\System\mXIwTfD.exe
  C:\Windows\System\mXIwTfD.exe
  2⤵
  PID:10308
- C:\Windows\System\XgZGYFJ.exe
  C:\Windows\System\XgZGYFJ.exe
  2⤵
  PID:10328
- C:\Windows\System\HbmkeBM.exe
  C:\Windows\System\HbmkeBM.exe
  2⤵
  PID:10348
- C:\Windows\System\Kxraoye.exe
  C:\Windows\System\Kxraoye.exe
  2⤵
  PID:10372
- C:\Windows\System\VzgCRWv.exe
  C:\Windows\System\VzgCRWv.exe
  2⤵
  PID:10396
- C:\Windows\System\biSSdrh.exe
  C:\Windows\System\biSSdrh.exe
  2⤵
  PID:10416
- C:\Windows\System\XwFmuVa.exe
  C:\Windows\System\XwFmuVa.exe
  2⤵
  PID:10440
- C:\Windows\System\QDbnxWt.exe
  C:\Windows\System\QDbnxWt.exe
  2⤵
  PID:10456
- C:\Windows\System\uNweMsi.exe
  C:\Windows\System\uNweMsi.exe
  2⤵
  PID:10476
- C:\Windows\System\UMRwqiL.exe
  C:\Windows\System\UMRwqiL.exe
  2⤵
  PID:10500
- C:\Windows\System\HwuZppQ.exe
  C:\Windows\System\HwuZppQ.exe
  2⤵
  PID:10524
- C:\Windows\System\lKljWkP.exe
  C:\Windows\System\lKljWkP.exe
  2⤵
  PID:10548
- C:\Windows\System\fnLoITP.exe
  C:\Windows\System\fnLoITP.exe
  2⤵
  PID:10568
- C:\Windows\System\cTbGsLu.exe
  C:\Windows\System\cTbGsLu.exe
  2⤵
  PID:10588
- C:\Windows\System\kwUOOHB.exe
  C:\Windows\System\kwUOOHB.exe
  2⤵
  PID:10612
- C:\Windows\System\ADelEqV.exe
  C:\Windows\System\ADelEqV.exe
  2⤵
  PID:10632
- C:\Windows\System\SeSruhy.exe
  C:\Windows\System\SeSruhy.exe
  2⤵
  PID:10656
- C:\Windows\System\advRqaD.exe
  C:\Windows\System\advRqaD.exe
  2⤵
  PID:10688
- C:\Windows\System\wTrJOOr.exe
  C:\Windows\System\wTrJOOr.exe
  2⤵
  PID:10708
- C:\Windows\System\ZozTdYv.exe
  C:\Windows\System\ZozTdYv.exe
  2⤵
  PID:10736
- C:\Windows\System\cciDfvw.exe
  C:\Windows\System\cciDfvw.exe
  2⤵
  PID:10752
- C:\Windows\System\KAXbTIA.exe
  C:\Windows\System\KAXbTIA.exe
  2⤵
  PID:10772
- C:\Windows\System\nKUCtmD.exe
  C:\Windows\System\nKUCtmD.exe
  2⤵
  PID:10792
- C:\Windows\System\jJoSOTa.exe
  C:\Windows\System\jJoSOTa.exe
  2⤵
  PID:10816
- C:\Windows\System\rbVETbP.exe
  C:\Windows\System\rbVETbP.exe
  2⤵
  PID:10836
- C:\Windows\System\rPtrUZn.exe
  C:\Windows\System\rPtrUZn.exe
  2⤵
  PID:10864
- C:\Windows\System\qXkWuAw.exe
  C:\Windows\System\qXkWuAw.exe
  2⤵
  PID:10880
- C:\Windows\System\CcRjQsF.exe
  C:\Windows\System\CcRjQsF.exe
  2⤵
  PID:10896
- C:\Windows\System\pWUCSHc.exe
  C:\Windows\System\pWUCSHc.exe
  2⤵
  PID:10912
- C:\Windows\System\EfqCLHY.exe
  C:\Windows\System\EfqCLHY.exe
  2⤵
  PID:10928
- C:\Windows\System\GazXBPN.exe
  C:\Windows\System\GazXBPN.exe
  2⤵
  PID:10944
- C:\Windows\System\ugoITca.exe
  C:\Windows\System\ugoITca.exe
  2⤵
  PID:10964
- C:\Windows\System\ONArMVA.exe
  C:\Windows\System\ONArMVA.exe
  2⤵
  PID:10992
- C:\Windows\System\faMpoCr.exe
  C:\Windows\System\faMpoCr.exe
  2⤵
  PID:11012
- C:\Windows\System\MEUKlvd.exe
  C:\Windows\System\MEUKlvd.exe
  2⤵
  PID:11032
- C:\Windows\System\qVBUoVe.exe
  C:\Windows\System\qVBUoVe.exe
  2⤵
  PID:11056
- C:\Windows\System\CKfAFsV.exe
  C:\Windows\System\CKfAFsV.exe
  2⤵
  PID:11080
- C:\Windows\System\UIgUwHH.exe
  C:\Windows\System\UIgUwHH.exe
  2⤵
  PID:11100
- C:\Windows\System\HsPBfxb.exe
  C:\Windows\System\HsPBfxb.exe
  2⤵
  PID:11128
- C:\Windows\System\xZHgoiK.exe
  C:\Windows\System\xZHgoiK.exe
  2⤵
  PID:11144
- C:\Windows\System\LHKPLFS.exe
  C:\Windows\System\LHKPLFS.exe
  2⤵
  PID:11176
- C:\Windows\System\BLIDzQe.exe
  C:\Windows\System\BLIDzQe.exe
  2⤵
  PID:11196
- C:\Windows\System\DYdKRFE.exe
  C:\Windows\System\DYdKRFE.exe
  2⤵
  PID:11212
- C:\Windows\System\nOEsBSK.exe
  C:\Windows\System\nOEsBSK.exe
  2⤵
  PID:11240
- C:\Windows\System\WUlIIAO.exe
  C:\Windows\System\WUlIIAO.exe
  2⤵
  PID:11260
- C:\Windows\System\UHzviex.exe
  C:\Windows\System\UHzviex.exe
  2⤵
  PID:9336
- C:\Windows\System\mtkszvM.exe
  C:\Windows\System\mtkszvM.exe
  2⤵
  PID:7648
- C:\Windows\System\jlrALEh.exe
  C:\Windows\System\jlrALEh.exe
  2⤵
  PID:540
- C:\Windows\System\hVlxWDv.exe
  C:\Windows\System\hVlxWDv.exe
  2⤵
  PID:7736
- C:\Windows\System\sgNRJXa.exe
  C:\Windows\System\sgNRJXa.exe
  2⤵
  PID:9428
- C:\Windows\System\EZlUUpC.exe
  C:\Windows\System\EZlUUpC.exe
  2⤵
  PID:9508
- C:\Windows\System\jvOgvdL.exe
  C:\Windows\System\jvOgvdL.exe
  2⤵
  PID:8376
- C:\Windows\System\BCPjIjG.exe
  C:\Windows\System\BCPjIjG.exe
  2⤵
  PID:8324
- C:\Windows\System\hVZbzdA.exe
  C:\Windows\System\hVZbzdA.exe
  2⤵
  PID:9748
- C:\Windows\System\GMtQSjh.exe
  C:\Windows\System\GMtQSjh.exe
  2⤵
  PID:9804
- C:\Windows\System\HokKHXB.exe
  C:\Windows\System\HokKHXB.exe
  2⤵
  PID:9848
- C:\Windows\System\EMSVxOg.exe
  C:\Windows\System\EMSVxOg.exe
  2⤵
  PID:8672
- C:\Windows\System\aZZesha.exe
  C:\Windows\System\aZZesha.exe
  2⤵
  PID:9916
- C:\Windows\System\vWClrSW.exe
  C:\Windows\System\vWClrSW.exe
  2⤵
  PID:9996
- C:\Windows\System\xfEbgFG.exe
  C:\Windows\System\xfEbgFG.exe
  2⤵
  PID:8808
- C:\Windows\System\zfWlBDF.exe
  C:\Windows\System\zfWlBDF.exe
  2⤵
  PID:10072
- C:\Windows\System\fCXgRMi.exe
  C:\Windows\System\fCXgRMi.exe
  2⤵
  PID:8880
- C:\Windows\System\OLLPTTw.exe
  C:\Windows\System\OLLPTTw.exe
  2⤵
  PID:6820
- C:\Windows\System\tEGFtQx.exe
  C:\Windows\System\tEGFtQx.exe
  2⤵
  PID:5600
- C:\Windows\System\AOFcUUK.exe
  C:\Windows\System\AOFcUUK.exe
  2⤵
  PID:7784
- C:\Windows\System\rJnClyG.exe
  C:\Windows\System\rJnClyG.exe
  2⤵
  PID:8488
- C:\Windows\System\EemRAKp.exe
  C:\Windows\System\EemRAKp.exe
  2⤵
  PID:8648
- C:\Windows\System\SLKpOJD.exe
  C:\Windows\System\SLKpOJD.exe
  2⤵
  PID:11272
- C:\Windows\System\pQHHzYA.exe
  C:\Windows\System\pQHHzYA.exe
  2⤵
  PID:11292
- C:\Windows\System\ArEZRVE.exe
  C:\Windows\System\ArEZRVE.exe
  2⤵
  PID:11316
- C:\Windows\System\soSdCeR.exe
  C:\Windows\System\soSdCeR.exe
  2⤵
  PID:11340
- C:\Windows\System\cAxEtSV.exe
  C:\Windows\System\cAxEtSV.exe
  2⤵
  PID:11364
- C:\Windows\System\UYCJxQV.exe
  C:\Windows\System\UYCJxQV.exe
  2⤵
  PID:11400
- C:\Windows\System\xSdEIMQ.exe
  C:\Windows\System\xSdEIMQ.exe
  2⤵
  PID:11428
- C:\Windows\System\hWpOnwb.exe
  C:\Windows\System\hWpOnwb.exe
  2⤵
  PID:11448
- C:\Windows\System\cIQVaSq.exe
  C:\Windows\System\cIQVaSq.exe
  2⤵
  PID:11476
- C:\Windows\System\sBrYfBj.exe
  C:\Windows\System\sBrYfBj.exe
  2⤵
  PID:11500
- C:\Windows\System\UTwdKsW.exe
  C:\Windows\System\UTwdKsW.exe
  2⤵
  PID:11524
- C:\Windows\System\leMGQhY.exe
  C:\Windows\System\leMGQhY.exe
  2⤵
  PID:11544
- C:\Windows\System\iFDMzyp.exe
  C:\Windows\System\iFDMzyp.exe
  2⤵
  PID:11568
- C:\Windows\System\fgiBjUv.exe
  C:\Windows\System\fgiBjUv.exe
  2⤵
  PID:11588
- C:\Windows\System\ZlTCHZD.exe
  C:\Windows\System\ZlTCHZD.exe
  2⤵
  PID:11612
- C:\Windows\System\UvcRDfW.exe
  C:\Windows\System\UvcRDfW.exe
  2⤵
  PID:11640
- C:\Windows\System\UBLeVcZ.exe
  C:\Windows\System\UBLeVcZ.exe
  2⤵
  PID:11660
- C:\Windows\System\qmPbMMr.exe
  C:\Windows\System\qmPbMMr.exe
  2⤵
  PID:11680
- C:\Windows\System\slOfYMs.exe
  C:\Windows\System\slOfYMs.exe
  2⤵
  PID:11708
- C:\Windows\System\hTicTPy.exe
  C:\Windows\System\hTicTPy.exe
  2⤵
  PID:11728
- C:\Windows\System\zklHlQl.exe
  C:\Windows\System\zklHlQl.exe
  2⤵
  PID:11748
- C:\Windows\System\VSXSJVN.exe
  C:\Windows\System\VSXSJVN.exe
  2⤵
  PID:11772
- C:\Windows\System\KDuYRsC.exe
  C:\Windows\System\KDuYRsC.exe
  2⤵
  PID:11792
- C:\Windows\System\dtgBOuY.exe
  C:\Windows\System\dtgBOuY.exe
  2⤵
  PID:11816
- C:\Windows\System\EeiKwAX.exe
  C:\Windows\System\EeiKwAX.exe
  2⤵
  PID:11836
- C:\Windows\System\hePuVBD.exe
  C:\Windows\System\hePuVBD.exe
  2⤵
  PID:11860
- C:\Windows\System\ouaCKNs.exe
  C:\Windows\System\ouaCKNs.exe
  2⤵
  PID:11876
- C:\Windows\System\UgadPoR.exe
  C:\Windows\System\UgadPoR.exe
  2⤵
  PID:11892
- C:\Windows\System\VQAcmam.exe
  C:\Windows\System\VQAcmam.exe
  2⤵
  PID:11912
- C:\Windows\System\AoopScO.exe
  C:\Windows\System\AoopScO.exe
  2⤵
  PID:11928
- C:\Windows\System\XbIVjkc.exe
  C:\Windows\System\XbIVjkc.exe
  2⤵
  PID:11944
- C:\Windows\System\gnRkHNQ.exe
  C:\Windows\System\gnRkHNQ.exe
  2⤵
  PID:11960
- C:\Windows\System\cKgqlUg.exe
  C:\Windows\System\cKgqlUg.exe
  2⤵
  PID:11976
- C:\Windows\System\JWAVjmk.exe
  C:\Windows\System\JWAVjmk.exe
  2⤵
  PID:12000
- C:\Windows\System\GrCgtsj.exe
  C:\Windows\System\GrCgtsj.exe
  2⤵
  PID:12020
- C:\Windows\System\cBXJoYN.exe
  C:\Windows\System\cBXJoYN.exe
  2⤵
  PID:12040
- C:\Windows\System\tEZLyuD.exe
  C:\Windows\System\tEZLyuD.exe
  2⤵
  PID:12060
- C:\Windows\System\TwxAfQu.exe
  C:\Windows\System\TwxAfQu.exe
  2⤵
  PID:12092
- C:\Windows\System\bwlaENt.exe
  C:\Windows\System\bwlaENt.exe
  2⤵
  PID:12108
- C:\Windows\System\OkcBxvU.exe
  C:\Windows\System\OkcBxvU.exe
  2⤵
  PID:12124
- C:\Windows\System\fRyzGCo.exe
  C:\Windows\System\fRyzGCo.exe
  2⤵
  PID:12144
- C:\Windows\System\HLsyRVi.exe
  C:\Windows\System\HLsyRVi.exe
  2⤵
  PID:12164
- C:\Windows\System\ubNVdwU.exe
  C:\Windows\System\ubNVdwU.exe
  2⤵
  PID:12188
- C:\Windows\System\edErvEF.exe
  C:\Windows\System\edErvEF.exe
  2⤵
  PID:12212
- C:\Windows\System\krpjqpM.exe
  C:\Windows\System\krpjqpM.exe
  2⤵
  PID:12232
- C:\Windows\System\BfKQjcj.exe
  C:\Windows\System\BfKQjcj.exe
  2⤵
  PID:12252
- C:\Windows\System\rgfbLjF.exe
  C:\Windows\System\rgfbLjF.exe
  2⤵
  PID:12272
- C:\Windows\System\GZTcxOr.exe
  C:\Windows\System\GZTcxOr.exe
  2⤵
  PID:8840
- C:\Windows\System\QyCqKVn.exe
  C:\Windows\System\QyCqKVn.exe
  2⤵
  PID:9240
- C:\Windows\System\ujazhZs.exe
  C:\Windows\System\ujazhZs.exe
  2⤵
  PID:9248
- C:\Windows\System\sErJGxw.exe
  C:\Windows\System\sErJGxw.exe
  2⤵
  PID:9316
- C:\Windows\System\kmJLFeE.exe
  C:\Windows\System\kmJLFeE.exe
  2⤵
  PID:10368
- C:\Windows\System\TYdNFrV.exe
  C:\Windows\System\TYdNFrV.exe
  2⤵
  PID:10412
- C:\Windows\System\HpwSWEj.exe
  C:\Windows\System\HpwSWEj.exe
  2⤵
  PID:9448
- C:\Windows\System\HEnKEHH.exe
  C:\Windows\System\HEnKEHH.exe
  2⤵
  PID:9484
- C:\Windows\System\TCuGqfD.exe
  C:\Windows\System\TCuGqfD.exe
  2⤵
  PID:9576
- C:\Windows\System\zZYolnb.exe
  C:\Windows\System\zZYolnb.exe
  2⤵
  PID:9620
- C:\Windows\System\MwkfCgl.exe
  C:\Windows\System\MwkfCgl.exe
  2⤵
  PID:9648
- C:\Windows\System\qFIYkep.exe
  C:\Windows\System\qFIYkep.exe
  2⤵
  PID:10788
- C:\Windows\System\dgDJITI.exe
  C:\Windows\System\dgDJITI.exe
  2⤵
  PID:9820
- C:\Windows\System\CgHFZnw.exe
  C:\Windows\System\CgHFZnw.exe
  2⤵
  PID:9880
- C:\Windows\System\pSPyqQf.exe
  C:\Windows\System\pSPyqQf.exe
  2⤵
  PID:10844
- C:\Windows\System\rupHUNB.exe
  C:\Windows\System\rupHUNB.exe
  2⤵
  PID:9984
- C:\Windows\System\rtcSiJm.exe
  C:\Windows\System\rtcSiJm.exe
  2⤵
  PID:7076
- C:\Windows\System\vnGOFvm.exe
  C:\Windows\System\vnGOFvm.exe
  2⤵
  PID:6724
- C:\Windows\System\WAxoFiq.exe
  C:\Windows\System\WAxoFiq.exe
  2⤵
  PID:6656
- C:\Windows\System\acBLkRg.exe
  C:\Windows\System\acBLkRg.exe
  2⤵
  PID:9524
- C:\Windows\System\NFpmRyy.exe
  C:\Windows\System\NFpmRyy.exe
  2⤵
  PID:8340
- C:\Windows\System\pxypxUm.exe
  C:\Windows\System\pxypxUm.exe
  2⤵
  PID:9768
- C:\Windows\System\dDuisCq.exe
  C:\Windows\System\dDuisCq.exe
  2⤵
  PID:6888
- C:\Windows\System\tlKyUws.exe
  C:\Windows\System\tlKyUws.exe
  2⤵
  PID:8704
- C:\Windows\System\wTzPmhT.exe
  C:\Windows\System\wTzPmhT.exe
  2⤵
  PID:9208
- C:\Windows\System\PwdZFEk.exe
  C:\Windows\System\PwdZFEk.exe
  2⤵
  PID:7320
- C:\Windows\System\Ciifasj.exe
  C:\Windows\System\Ciifasj.exe
  2⤵
  PID:8620
- C:\Windows\System\qnrgNmz.exe
  C:\Windows\System\qnrgNmz.exe
  2⤵
  PID:8100
- C:\Windows\System\vtBYEje.exe
  C:\Windows\System\vtBYEje.exe
  2⤵
  PID:5748
- C:\Windows\System\OSSWpgi.exe
  C:\Windows\System\OSSWpgi.exe
  2⤵
  PID:12308
- C:\Windows\System\HraZAOn.exe
  C:\Windows\System\HraZAOn.exe
  2⤵
  PID:12332
- C:\Windows\System\INckRKd.exe
  C:\Windows\System\INckRKd.exe
  2⤵
  PID:12352
- C:\Windows\System\KSAdYBS.exe
  C:\Windows\System\KSAdYBS.exe
  2⤵
  PID:12372
- C:\Windows\System\GPsknPu.exe
  C:\Windows\System\GPsknPu.exe
  2⤵
  PID:12396
- C:\Windows\System\WCvrhiz.exe
  C:\Windows\System\WCvrhiz.exe
  2⤵
  PID:12420
- C:\Windows\System\wVfotit.exe
  C:\Windows\System\wVfotit.exe
  2⤵
  PID:12440
- C:\Windows\System\viUlzzd.exe
  C:\Windows\System\viUlzzd.exe
  2⤵
  PID:12468
- C:\Windows\System\XbNMNnd.exe
  C:\Windows\System\XbNMNnd.exe
  2⤵
  PID:12492
- C:\Windows\System\qJmBgXe.exe
  C:\Windows\System\qJmBgXe.exe
  2⤵
  PID:12512
- C:\Windows\System\IBQvXFo.exe
  C:\Windows\System\IBQvXFo.exe
  2⤵
  PID:12540
- C:\Windows\System\SiTUaFx.exe
  C:\Windows\System\SiTUaFx.exe
  2⤵
  PID:12564
- C:\Windows\System\CEhMGgT.exe
  C:\Windows\System\CEhMGgT.exe
  2⤵
  PID:12596
- C:\Windows\System\npchMUq.exe
  C:\Windows\System\npchMUq.exe
  2⤵
  PID:12620
- C:\Windows\System\edZiqgt.exe
  C:\Windows\System\edZiqgt.exe
  2⤵
  PID:12644
- C:\Windows\System\WzlKLEm.exe
  C:\Windows\System\WzlKLEm.exe
  2⤵
  PID:12668
- C:\Windows\System\JYLANCf.exe
  C:\Windows\System\JYLANCf.exe
  2⤵
  PID:12684
- C:\Windows\System\NRcgVqO.exe
  C:\Windows\System\NRcgVqO.exe
  2⤵
  PID:12700
- C:\Windows\System\jBNPOJa.exe
  C:\Windows\System\jBNPOJa.exe
  2⤵
  PID:12716
- C:\Windows\System\ORpxcVI.exe
  C:\Windows\System\ORpxcVI.exe
  2⤵
  PID:12732
- C:\Windows\System\OIwKfqI.exe
  C:\Windows\System\OIwKfqI.exe
  2⤵
  PID:12748
- C:\Windows\System\tBTmJpU.exe
  C:\Windows\System\tBTmJpU.exe
  2⤵
  PID:12764
- C:\Windows\System\Rledmaj.exe
  C:\Windows\System\Rledmaj.exe
  2⤵
  PID:12780
- C:\Windows\System\MjzvoZS.exe
  C:\Windows\System\MjzvoZS.exe
  2⤵
  PID:12800
- C:\Windows\System\sOyqXmQ.exe
  C:\Windows\System\sOyqXmQ.exe
  2⤵
  PID:12816
- C:\Windows\System\KBJsMyl.exe
  C:\Windows\System\KBJsMyl.exe
  2⤵
  PID:12832
- C:\Windows\System\OySHrJi.exe
  C:\Windows\System\OySHrJi.exe
  2⤵
  PID:12848
- C:\Windows\System\ymFgdmk.exe
  C:\Windows\System\ymFgdmk.exe
  2⤵
  PID:12868
- C:\Windows\System\BJMMBKJ.exe
  C:\Windows\System\BJMMBKJ.exe
  2⤵
  PID:12888
- C:\Windows\System\SKWQiaP.exe
  C:\Windows\System\SKWQiaP.exe
  2⤵
  PID:12912
- C:\Windows\System\bXKAjqr.exe
  C:\Windows\System\bXKAjqr.exe
  2⤵
  PID:12932
- C:\Windows\System\hrVkytg.exe
  C:\Windows\System\hrVkytg.exe
  2⤵
  PID:12952
- C:\Windows\System\LfdqckP.exe
  C:\Windows\System\LfdqckP.exe
  2⤵
  PID:12976
- C:\Windows\System\xbsACDm.exe
  C:\Windows\System\xbsACDm.exe
  2⤵
  PID:13000
- C:\Windows\System\axuWmaf.exe
  C:\Windows\System\axuWmaf.exe
  2⤵
  PID:13020
- C:\Windows\System\VXqbeGL.exe
  C:\Windows\System\VXqbeGL.exe
  2⤵
  PID:12656
- C:\Windows\System\SqJFFfu.exe
  C:\Windows\System\SqJFFfu.exe
  2⤵
  PID:12856
- C:\Windows\System\kVtFUwd.exe
  C:\Windows\System\kVtFUwd.exe
  2⤵
  PID:10560
- C:\Windows\System\MdAUiNI.exe
  C:\Windows\System\MdAUiNI.exe
  2⤵
  PID:12996
- C:\Windows\System\NwwBRrP.exe
  C:\Windows\System\NwwBRrP.exe
  2⤵
  PID:13052
- C:\Windows\System\rCpNqLv.exe
  C:\Windows\System\rCpNqLv.exe
  2⤵
  PID:13056
- C:\Windows\System\ioNmkan.exe
  C:\Windows\System\ioNmkan.exe
  2⤵
  PID:10892
- C:\Windows\System\mPbljHU.exe
  C:\Windows\System\mPbljHU.exe
  2⤵
  PID:9868
- C:\Windows\System\DWOszgV.exe
  C:\Windows\System\DWOszgV.exe
  2⤵
  PID:11284
- C:\Windows\System\txRLKNt.exe
  C:\Windows\System\txRLKNt.exe
  2⤵
  PID:7132
- C:\Windows\System\QHGRlvc.exe
  C:\Windows\System\QHGRlvc.exe
  2⤵
  PID:9784
- C:\Windows\System\MOuBSLJ.exe
  C:\Windows\System\MOuBSLJ.exe
  2⤵
  PID:2680
- C:\Windows\System\bQZgzdm.exe
  C:\Windows\System\bQZgzdm.exe
  2⤵
  PID:9904
- C:\Windows\System\tXgdxXz.exe
  C:\Windows\System\tXgdxXz.exe
  2⤵
  PID:10180
- C:\Windows\System\JVuVjrN.exe
  C:\Windows\System\JVuVjrN.exe
  2⤵
  PID:7276
- C:\Windows\System\pvhGjeL.exe
  C:\Windows\System\pvhGjeL.exe
  2⤵
  PID:6012
- C:\Windows\System\RnVmQKA.exe
  C:\Windows\System\RnVmQKA.exe
  2⤵
  PID:13280
- C:\Windows\System\yoPAUIg.exe
  C:\Windows\System\yoPAUIg.exe
  2⤵
  PID:13276
- C:\Windows\System\PRPtVQG.exe
  C:\Windows\System\PRPtVQG.exe
  2⤵
  PID:8860
- C:\Windows\System\yzCqwDQ.exe
  C:\Windows\System\yzCqwDQ.exe
  2⤵
  PID:13096
- C:\Windows\System\jKoflRC.exe
  C:\Windows\System\jKoflRC.exe
  2⤵
  PID:13112
- C:\Windows\System\RAqoZGo.exe
  C:\Windows\System\RAqoZGo.exe
  2⤵
  PID:13192
- C:\Windows\System\mYySjsK.exe
  C:\Windows\System\mYySjsK.exe
  2⤵
  PID:13224
- C:\Windows\System\uQyZGVv.exe
  C:\Windows\System\uQyZGVv.exe
  2⤵
  PID:10744
- C:\Windows\System\CGQxCfk.exe
  C:\Windows\System\CGQxCfk.exe
  2⤵
  PID:10164
- C:\Windows\System\ZNsnMuT.exe
  C:\Windows\System\ZNsnMuT.exe
  2⤵
  PID:11724
- C:\Windows\System\DKuoadn.exe
  C:\Windows\System\DKuoadn.exe
  2⤵
  PID:9452
- C:\Windows\System\HLSgHgG.exe
  C:\Windows\System\HLSgHgG.exe
  2⤵
  PID:5160
- C:\Windows\System\rtjQVwj.exe
  C:\Windows\System\rtjQVwj.exe
  2⤵
  PID:9964
- C:\Windows\System\RyNFawJ.exe
  C:\Windows\System\RyNFawJ.exe
  2⤵
  PID:10596
- C:\Windows\System\baqXRXa.exe
  C:\Windows\System\baqXRXa.exe
  2⤵
  PID:11508
- C:\Windows\System\xGgGkhq.exe
  C:\Windows\System\xGgGkhq.exe
  2⤵
  PID:12660
- C:\Windows\System\xMbcFSk.exe
  C:\Windows\System\xMbcFSk.exe
  2⤵
  PID:12896
- C:\Windows\System\qZxFyqi.exe
  C:\Windows\System\qZxFyqi.exe
  2⤵
  PID:10728
- C:\Windows\System\eksjelG.exe
  C:\Windows\System\eksjelG.exe
  2⤵
  PID:11044
- C:\Windows\System\ooERjFK.exe
  C:\Windows\System\ooERjFK.exe
  2⤵
  PID:11920
- C:\Windows\System\Mkavyfs.exe
  C:\Windows\System\Mkavyfs.exe
  2⤵
  PID:13092
- C:\Windows\System\jjkedCM.exe
  C:\Windows\System\jjkedCM.exe
  2⤵
  PID:8284
- C:\Windows\System\qOGjpfq.exe
  C:\Windows\System\qOGjpfq.exe
  2⤵
  PID:12452
- C:\Windows\System\QxzHqdq.exe
  C:\Windows\System\QxzHqdq.exe
  2⤵
  PID:8784
- C:\Windows\System\NWQdpqY.exe
  C:\Windows\System\NWQdpqY.exe
  2⤵
  PID:13040
- C:\Windows\System\ePEsqIT.exe
  C:\Windows\System\ePEsqIT.exe
  2⤵
  PID:10108
- C:\Windows\System\whMTSEe.exe
  C:\Windows\System\whMTSEe.exe
  2⤵
  PID:10192
- C:\Windows\System\SQHppVZ.exe
  C:\Windows\System\SQHppVZ.exe
  2⤵
  PID:8312
- C:\Windows\System\XWXRWQz.exe
  C:\Windows\System\XWXRWQz.exe
  2⤵
  PID:13316
- C:\Windows\System\eZyQdBT.exe
  C:\Windows\System\eZyQdBT.exe
  2⤵
  PID:13332
- C:\Windows\System\BNjNNkC.exe
  C:\Windows\System\BNjNNkC.exe
  2⤵
  PID:13356
- C:\Windows\System\XyhVBnX.exe
  C:\Windows\System\XyhVBnX.exe
  2⤵
  PID:13388
- C:\Windows\System\LBzkUYc.exe
  C:\Windows\System\LBzkUYc.exe
  2⤵
  PID:13416
- C:\Windows\System\rTiixES.exe
  C:\Windows\System\rTiixES.exe
  2⤵
  PID:13436
- C:\Windows\System\yTTBpBg.exe
  C:\Windows\System\yTTBpBg.exe
  2⤵
  PID:13460
- C:\Windows\System\lheLZGu.exe
  C:\Windows\System\lheLZGu.exe
  2⤵
  PID:13488
- C:\Windows\System\rEeCsrs.exe
  C:\Windows\System\rEeCsrs.exe
  2⤵
  PID:13508
- C:\Windows\System\EfzayQC.exe
  C:\Windows\System\EfzayQC.exe
  2⤵
  PID:13532
- C:\Windows\System\EeAmlwn.exe
  C:\Windows\System\EeAmlwn.exe
  2⤵
  PID:13552
- C:\Windows\System\VpHyteg.exe
  C:\Windows\System\VpHyteg.exe
  2⤵
  PID:13572
- C:\Windows\System\KXYNBEd.exe
  C:\Windows\System\KXYNBEd.exe
  2⤵
  PID:13720
- C:\Windows\System\ghyPFaU.exe
  C:\Windows\System\ghyPFaU.exe
  2⤵
  PID:13788
- C:\Windows\System\DAMsEuo.exe
  C:\Windows\System\DAMsEuo.exe
  2⤵
  PID:13812
- C:\Windows\System\gmXqSWl.exe
  C:\Windows\System\gmXqSWl.exe
  2⤵
  PID:10508
- C:\Windows\System\VlOfUOj.exe
  C:\Windows\System\VlOfUOj.exe
  2⤵
  PID:9580
- C:\Windows\System\MVgYhQo.exe
  C:\Windows\System\MVgYhQo.exe
  2⤵
  PID:11968
- C:\Windows\System\qcqHlIM.exe
  C:\Windows\System\qcqHlIM.exe
  2⤵
  PID:12160
- C:\Windows\System\dRGxkJo.exe
  C:\Windows\System\dRGxkJo.exe
  2⤵
  PID:8140
- C:\Windows\System\ThwcYRB.exe
  C:\Windows\System\ThwcYRB.exe
  2⤵
  PID:7404
- C:\Windows\System\lmggKxm.exe
  C:\Windows\System\lmggKxm.exe
  2⤵
  PID:13300
- C:\Windows\System\VRZVhqC.exe
  C:\Windows\System\VRZVhqC.exe
  2⤵
  PID:12152
- C:\Windows\System\zZrLTrz.exe
  C:\Windows\System\zZrLTrz.exe
  2⤵
  PID:13164
- C:\Windows\System\AswQUzb.exe
  C:\Windows\System\AswQUzb.exe
  2⤵
  PID:9980
- C:\Windows\System\ZiuTupt.exe
  C:\Windows\System\ZiuTupt.exe
  2⤵
  PID:13408
- C:\Windows\System\uvPSvBK.exe
  C:\Windows\System\uvPSvBK.exe
  2⤵
  PID:9676
- C:\Windows\System\ZQyAHwB.exe
  C:\Windows\System\ZQyAHwB.exe
  2⤵
  PID:13504
- C:\Windows\System\QcuLSJi.exe
  C:\Windows\System\QcuLSJi.exe
  2⤵
  PID:13548
- C:\Windows\System\RHkGbcR.exe
  C:\Windows\System\RHkGbcR.exe
  2⤵
  PID:11756
- C:\Windows\System\ixnaaFU.exe
  C:\Windows\System\ixnaaFU.exe
  2⤵
  PID:11536
- C:\Windows\System\jaxyKdW.exe
  C:\Windows\System\jaxyKdW.exe
  2⤵
  PID:9892
- C:\Windows\System\IthSatT.exe
  C:\Windows\System\IthSatT.exe
  2⤵
  PID:12344
- C:\Windows\System\JlDJvce.exe
  C:\Windows\System\JlDJvce.exe
  2⤵
  PID:14000
- C:\Windows\System\aqhOowD.exe
  C:\Windows\System\aqhOowD.exe
  2⤵
  PID:14028
- C:\Windows\System\ySwfGyb.exe
  C:\Windows\System\ySwfGyb.exe
  2⤵
  PID:132
- C:\Windows\System\NsPAnfj.exe
  C:\Windows\System\NsPAnfj.exe
  2⤵
  PID:14140
- C:\Windows\System\SLNGINP.exe
  C:\Windows\System\SLNGINP.exe
  2⤵
  PID:14184
- C:\Windows\System\sKtBTjQ.exe
  C:\Windows\System\sKtBTjQ.exe
  2⤵
  PID:10640
- C:\Windows\System\tkcRQAj.exe
  C:\Windows\System\tkcRQAj.exe
  2⤵
  PID:13324
- C:\Windows\System\whfYFdK.exe
  C:\Windows\System\whfYFdK.exe
  2⤵
  PID:8768
- C:\Windows\System\sVOUcZy.exe
  C:\Windows\System\sVOUcZy.exe
  2⤵
  PID:8348
- C:\Windows\System\mrPlCwY.exe
  C:\Windows\System\mrPlCwY.exe
  2⤵
  PID:3608
- C:\Windows\System\VCVDlVt.exe
  C:\Windows\System\VCVDlVt.exe
  2⤵
  PID:13344
- C:\Windows\System\ZBIcwhe.exe
  C:\Windows\System\ZBIcwhe.exe
  2⤵
  PID:8708
- C:\Windows\System\iuteUZF.exe
  C:\Windows\System\iuteUZF.exe
  2⤵
  PID:12280
- C:\Windows\System\kEevgHy.exe
  C:\Windows\System\kEevgHy.exe
  2⤵
  PID:13544
- C:\Windows\System\xBoYxWc.exe
  C:\Windows\System\xBoYxWc.exe
  2⤵
  PID:13444
- C:\Windows\System\fEBjVZX.exe
  C:\Windows\System\fEBjVZX.exe
  2⤵
  PID:13780
- C:\Windows\System\wBjbxLV.exe
  C:\Windows\System\wBjbxLV.exe
  2⤵
  PID:13620
- C:\Windows\System\pzeseqt.exe
  C:\Windows\System\pzeseqt.exe
  2⤵
  PID:13688
- C:\Windows\System\cHXfRHO.exe
  C:\Windows\System\cHXfRHO.exe
  2⤵
  PID:13972
- C:\Windows\System\XiJajDG.exe
  C:\Windows\System\XiJajDG.exe
  2⤵
  PID:10716
- C:\Windows\System\eODgSIU.exe
  C:\Windows\System\eODgSIU.exe
  2⤵
  PID:13652
- C:\Windows\System\JVvMMJB.exe
  C:\Windows\System\JVvMMJB.exe
  2⤵
  PID:13680
- C:\Windows\System\jWbWqLO.exe
  C:\Windows\System\jWbWqLO.exe
  2⤵
  PID:13876
- C:\Windows\System\seWYZFU.exe
  C:\Windows\System\seWYZFU.exe
  2⤵
  PID:13892
- C:\Windows\System\vHjBpAQ.exe
  C:\Windows\System\vHjBpAQ.exe
  2⤵
  PID:14012
- C:\Windows\System\iJgZcMh.exe
  C:\Windows\System\iJgZcMh.exe
  2⤵
  PID:7996
- C:\Windows\System\GoYABbw.exe
  C:\Windows\System\GoYABbw.exe
  2⤵
  PID:9096
- C:\Windows\System\tzfJKWT.exe
  C:\Windows\System\tzfJKWT.exe
  2⤵
  PID:13348
- C:\Windows\System\mWLAxHv.exe
  C:\Windows\System\mWLAxHv.exe
  2⤵
  PID:13836
- C:\Windows\System\pHQxyxj.exe
  C:\Windows\System\pHQxyxj.exe
  2⤵
  PID:13820
- C:\Windows\System\ARmczLX.exe
  C:\Windows\System\ARmczLX.exe
  2⤵
  PID:13980
- C:\Windows\System\nUdFbNs.exe
  C:\Windows\System\nUdFbNs.exe
  2⤵
  PID:14076
- C:\Windows\System\TVJEDpy.exe
  C:\Windows\System\TVJEDpy.exe
  2⤵
  PID:14056
- C:\Windows\System\aivzJnk.exe
  C:\Windows\System\aivzJnk.exe
  2⤵
  PID:14068
- C:\Windows\System\DyisFxh.exe
  C:\Windows\System\DyisFxh.exe
  2⤵
  PID:14044
- C:\Windows\System\neKrAYi.exe
  C:\Windows\System\neKrAYi.exe
  2⤵
  PID:14092
- C:\Windows\System\pPWpmpW.exe
  C:\Windows\System\pPWpmpW.exe
  2⤵
  PID:13624
- C:\Windows\System\OEBHhwG.exe
  C:\Windows\System\OEBHhwG.exe
  2⤵
  PID:14168
- C:\Windows\System\CHBNBmH.exe
  C:\Windows\System\CHBNBmH.exe
  2⤵
  PID:14116
- C:\Windows\System\eHFnOdC.exe
  C:\Windows\System\eHFnOdC.exe
  2⤵
  PID:14120
- C:\Windows\System\diNIJKs.exe
  C:\Windows\System\diNIJKs.exe
  2⤵
  PID:14172
- C:\Windows\System\McLaQIH.exe
  C:\Windows\System\McLaQIH.exe
  2⤵
  PID:14284
- C:\Windows\System\gUGAxtU.exe
  C:\Windows\System\gUGAxtU.exe
  2⤵
  PID:10564
- C:\Windows\System\NjCfCYa.exe
  C:\Windows\System\NjCfCYa.exe
  2⤵
  PID:528
- C:\Windows\System\SmXYKPu.exe
  C:\Windows\System\SmXYKPu.exe
  2⤵
  PID:14264
- C:\Windows\System\oPqdPEY.exe
  C:\Windows\System\oPqdPEY.exe
  2⤵
  PID:11420
- C:\Windows\System\XKVaNdW.exe
  C:\Windows\System\XKVaNdW.exe
  2⤵
  PID:12884
- C:\Windows\System\Jzgqslu.exe
  C:\Windows\System\Jzgqslu.exe
  2⤵
  PID:14268
- C:\Windows\System\BhOsmqT.exe
  C:\Windows\System\BhOsmqT.exe
  2⤵
  PID:10812
- C:\Windows\System\kLDvhwr.exe
  C:\Windows\System\kLDvhwr.exe
  2⤵
  PID:3180
- C:\Windows\System\QnyFVLz.exe
  C:\Windows\System\QnyFVLz.exe
  2⤵
  PID:12120
- C:\Windows\System\ANtcaHy.exe
  C:\Windows\System\ANtcaHy.exe
  2⤵
  PID:4360
- C:\Windows\System\fciPKzs.exe
  C:\Windows\System\fciPKzs.exe
  2⤵
  PID:13084
- C:\Windows\System\mIoKczB.exe
  C:\Windows\System\mIoKczB.exe
  2⤵
  PID:12244
- C:\Windows\System\mEyrZfA.exe
  C:\Windows\System\mEyrZfA.exe
  2⤵
  PID:10536
- C:\Windows\System\BnfhRTX.exe
  C:\Windows\System\BnfhRTX.exe
  2⤵
  PID:2836
- C:\Windows\System\YpUStcY.exe
  C:\Windows\System\YpUStcY.exe
  2⤵
  PID:5108
- C:\Windows\System\CapROWy.exe
  C:\Windows\System\CapROWy.exe
  2⤵
  PID:3540
- C:\Windows\System\XqSZHFM.exe
  C:\Windows\System\XqSZHFM.exe
  2⤵
  PID:3524
- C:\Windows\System\EkRaXmp.exe
  C:\Windows\System\EkRaXmp.exe
  2⤵
  PID:13340
- C:\Windows\System\UlSGdSO.exe
  C:\Windows\System\UlSGdSO.exe
  2⤵
  PID:2452
- C:\Windows\System\KbCARKZ.exe
  C:\Windows\System\KbCARKZ.exe
  2⤵
  PID:3908
- C:\Windows\System\zVnbebZ.exe
  C:\Windows\System\zVnbebZ.exe
  2⤵
  PID:2476
- C:\Windows\System\KeLRJjc.exe
  C:\Windows\System\KeLRJjc.exe
  2⤵
  PID:2128
- C:\Windows\System\KvnSBGk.exe
  C:\Windows\System\KvnSBGk.exe
  2⤵
  PID:368
- C:\Windows\System\CVBjFKR.exe
  C:\Windows\System\CVBjFKR.exe
  2⤵
  PID:11596
- C:\Windows\System\qxuVPpw.exe
  C:\Windows\System\qxuVPpw.exe
  2⤵
  PID:10356
- C:\Windows\System\qZDygXT.exe
  C:\Windows\System\qZDygXT.exe
  2⤵
  PID:12712
- C:\Windows\System\TBqFLqU.exe
  C:\Windows\System\TBqFLqU.exe
  2⤵
  PID:6472
- C:\Windows\System\rcnbYpX.exe
  C:\Windows\System\rcnbYpX.exe
  2⤵
  PID:13740
- C:\Windows\System\IQygezN.exe
  C:\Windows\System\IQygezN.exe
  2⤵
  PID:13936
- C:\Windows\System\hungDsv.exe
  C:\Windows\System\hungDsv.exe
  2⤵
  PID:13888
- C:\Windows\System\lcCKHpV.exe
  C:\Windows\System\lcCKHpV.exe
  2⤵
  PID:13432
- C:\Windows\System\iBFRrNL.exe
  C:\Windows\System\iBFRrNL.exe
  2⤵
  PID:13640
- C:\Windows\System\xvMzhTy.exe
  C:\Windows\System\xvMzhTy.exe
  2⤵
  PID:13852
- C:\Windows\System\OGXDQvU.exe
  C:\Windows\System\OGXDQvU.exe
  2⤵
  PID:4372
- C:\Windows\System\dSGLqIG.exe
  C:\Windows\System\dSGLqIG.exe
  2⤵
  PID:13968
- C:\Windows\System\TRwWEQq.exe
  C:\Windows\System\TRwWEQq.exe
  2⤵
  PID:13844
- C:\Windows\System\PVFUFvO.exe
  C:\Windows\System\PVFUFvO.exe
  2⤵
  PID:13964
- C:\Windows\System\PSwcCGj.exe
  C:\Windows\System\PSwcCGj.exe
  2⤵
  PID:13632
- C:\Windows\System\WKaThiT.exe
  C:\Windows\System\WKaThiT.exe
  2⤵
  PID:14204
- C:\Windows\System\ZBBAfsI.exe
  C:\Windows\System\ZBBAfsI.exe
  2⤵
  PID:10052
- C:\Windows\System\QxUweZH.exe
  C:\Windows\System\QxUweZH.exe
  2⤵
  PID:12140
- C:\Windows\System\yReconn.exe
  C:\Windows\System\yReconn.exe
  2⤵
  PID:3248
- C:\Windows\System\lLAkpik.exe
  C:\Windows\System\lLAkpik.exe
  2⤵
  PID:13600
- C:\Windows\System\ContxtN.exe
  C:\Windows\System\ContxtN.exe
  2⤵
  PID:2428
- C:\Windows\System\aXJRiLN.exe
  C:\Windows\System\aXJRiLN.exe
  2⤵
  PID:4648
- C:\Windows\System\ZtxQRvT.exe
  C:\Windows\System\ZtxQRvT.exe
  2⤵
  PID:12632
- C:\Windows\System\NNrtZxv.exe
  C:\Windows\System\NNrtZxv.exe
  2⤵
  PID:9268
- C:\Windows\System\bHuKhRp.exe
  C:\Windows\System\bHuKhRp.exe
  2⤵
  PID:10008
- C:\Windows\System\znwaAwa.exe
  C:\Windows\System\znwaAwa.exe
  2⤵
  PID:13840
- C:\Windows\System\ieADNCt.exe
  C:\Windows\System\ieADNCt.exe
  2⤵
  PID:2648
- C:\Windows\System\Epkspie.exe
  C:\Windows\System\Epkspie.exe
  2⤵
  PID:13668
- C:\Windows\System\lVXQvjQ.exe
  C:\Windows\System\lVXQvjQ.exe
  2⤵
  PID:13896
- C:\Windows\System\rNdvXKE.exe
  C:\Windows\System\rNdvXKE.exe
  2⤵
  PID:9412
- C:\Windows\System\hnplAAG.exe
  C:\Windows\System\hnplAAG.exe
  2⤵
  PID:4548
- C:\Windows\System\ifQByfv.exe
  C:\Windows\System\ifQByfv.exe
  2⤵
  PID:2728
- C:\Windows\System\KrINDRP.exe
  C:\Windows\System\KrINDRP.exe
  2⤵
  PID:1528
- C:\Windows\System\pMYpygw.exe
  C:\Windows\System\pMYpygw.exe
  2⤵
  PID:4084
- C:\Windows\System\JEPPKaP.exe
  C:\Windows\System\JEPPKaP.exe
  2⤵
  PID:2688
- C:\Windows\System\exjRfFm.exe
  C:\Windows\System\exjRfFm.exe
  2⤵
  PID:8220
- C:\Windows\System\PSbmxPq.exe
  C:\Windows\System\PSbmxPq.exe
  2⤵
  PID:14236
- C:\Windows\System\cEdxXpw.exe
  C:\Windows\System\cEdxXpw.exe
  2⤵
  PID:4620
- C:\Windows\System\nzUaIZP.exe
  C:\Windows\System\nzUaIZP.exe
  2⤵
  PID:2392
- C:\Windows\System\LbcXRXO.exe
  C:\Windows\System\LbcXRXO.exe
  2⤵
  PID:1772
- C:\Windows\System\FxLrmZY.exe
  C:\Windows\System\FxLrmZY.exe
  2⤵
  PID:14052
- C:\Windows\System\vOQmZYU.exe
  C:\Windows\System\vOQmZYU.exe
  2⤵
  PID:972
- C:\Windows\System\iaDKjYl.exe
  C:\Windows\System\iaDKjYl.exe
  2⤵
  PID:3884
- C:\Windows\System\zthcACc.exe
  C:\Windows\System\zthcACc.exe
  2⤵
  PID:14200
- C:\Windows\System\TUOldjC.exe
  C:\Windows\System\TUOldjC.exe
  2⤵
  PID:14240
- C:\Windows\System\TPuhRsk.exe
  C:\Windows\System\TPuhRsk.exe
  2⤵
  PID:3928
- C:\Windows\System\ApCnJMG.exe
  C:\Windows\System\ApCnJMG.exe
  2⤵
  PID:14328
- C:\Windows\System\ohabzAa.exe
  C:\Windows\System\ohabzAa.exe
  2⤵
  PID:2384
- C:\Windows\System\LpiMyyq.exe
  C:\Windows\System\LpiMyyq.exe
  2⤵
  PID:3136
- C:\Windows\System\TeQkdXr.exe
  C:\Windows\System\TeQkdXr.exe
  2⤵
  PID:3004
- C:\Windows\System\pQcNZIz.exe
  C:\Windows\System\pQcNZIz.exe
  2⤵
  PID:2756
- C:\Windows\System\erqFKlS.exe
  C:\Windows\System\erqFKlS.exe
  2⤵
  PID:4040
- C:\Windows\System\zGdUPZG.exe
  C:\Windows\System\zGdUPZG.exe
  2⤵
  PID:3704
- C:\Windows\System\cuMGZAh.exe
  C:\Windows\System\cuMGZAh.exe
  2⤵
  PID:1784
- C:\Windows\System\lvMtEQE.exe
  C:\Windows\System\lvMtEQE.exe
  2⤵
  PID:2612
- C:\Windows\System\kjsvQGh.exe
  C:\Windows\System\kjsvQGh.exe
  2⤵
  PID:4740
- C:\Windows\System\DurmMcd.exe
  C:\Windows\System\DurmMcd.exe
  2⤵
  PID:4552
- C:\Windows\System\GdJxbLu.exe
  C:\Windows\System\GdJxbLu.exe
  2⤵
  PID:1800
- C:\Windows\System\SobOqqD.exe
  C:\Windows\System\SobOqqD.exe
  2⤵
  PID:3624
- C:\Windows\System\WEGNVNf.exe
  C:\Windows\System\WEGNVNf.exe
  2⤵
  PID:3152
- C:\Windows\System\lIoqPgH.exe
  C:\Windows\System\lIoqPgH.exe
  2⤵
  PID:872
- C:\Windows\System\WfwuYms.exe
  C:\Windows\System\WfwuYms.exe
  2⤵
  PID:10888
- C:\Windows\System\xyJmVZy.exe
  C:\Windows\System\xyJmVZy.exe
  2⤵
  PID:4948
- C:\Windows\System\piTaQaT.exe
  C:\Windows\System\piTaQaT.exe
  2⤵
  PID:2568
- C:\Windows\System\LpDcQGl.exe
  C:\Windows\System\LpDcQGl.exe
  2⤵
  PID:14228
- C:\Windows\System\fosRFnm.exe
  C:\Windows\System\fosRFnm.exe
  2⤵
  PID:13860
- C:\Windows\System\BiPlCEQ.exe
  C:\Windows\System\BiPlCEQ.exe
  2⤵
  PID:3512
- C:\Windows\System\mwaIJpc.exe
  C:\Windows\System\mwaIJpc.exe
  2⤵
  PID:2084
- C:\Windows\System\bgqfkQM.exe
  C:\Windows\System\bgqfkQM.exe
  2⤵
  PID:2720
- C:\Windows\System\NourDeb.exe
  C:\Windows\System\NourDeb.exe
  2⤵
  PID:2088
- C:\Windows\System\ZPFMzHl.exe
  C:\Windows\System\ZPFMzHl.exe
  2⤵
  PID:3536
- C:\Windows\System\iZjQmPs.exe
  C:\Windows\System\iZjQmPs.exe
  2⤵
  PID:14248
- C:\Windows\System\imATqXw.exe
  C:\Windows\System\imATqXw.exe
  2⤵
  PID:1788
- C:\Windows\System\CqBfnVd.exe
  C:\Windows\System\CqBfnVd.exe
  2⤵
  PID:11436
- C:\Windows\System\riKLJKr.exe
  C:\Windows\System\riKLJKr.exe
  2⤵
  PID:4508
- C:\Windows\System\xYcsrzu.exe
  C:\Windows\System\xYcsrzu.exe
  2⤵
  PID:12200
- C:\Windows\System\PjhxHTQ.exe
  C:\Windows\System\PjhxHTQ.exe
  2⤵
  PID:11356
- C:\Windows\System\hKBaKLS.exe
  C:\Windows\System\hKBaKLS.exe
  2⤵
  PID:3984
- C:\Windows\System\pAxzdFm.exe
  C:\Windows\System\pAxzdFm.exe
  2⤵
  PID:3188
- C:\Windows\System\WglOZAR.exe
  C:\Windows\System\WglOZAR.exe
  2⤵
  PID:13684
- C:\Windows\System\TvzkDKF.exe
  C:\Windows\System\TvzkDKF.exe
  2⤵
  PID:2016
- C:\Windows\System\pcJwZnk.exe
  C:\Windows\System\pcJwZnk.exe
  2⤵
  PID:456
- C:\Windows\System\mQiIzSe.exe
  C:\Windows\System\mQiIzSe.exe
  2⤵
  PID:2408
- C:\Windows\System\WyDfCdR.exe
  C:\Windows\System\WyDfCdR.exe
  2⤵
  PID:11424
- C:\Windows\System\JcpmDKY.exe
  C:\Windows\System\JcpmDKY.exe
  2⤵
  PID:3504
- C:\Windows\System\giiloZE.exe
  C:\Windows\System\giiloZE.exe
  2⤵
  PID:2416
- C:\Windows\System\ZKOyKSn.exe
  C:\Windows\System\ZKOyKSn.exe
  2⤵
  PID:4356
- C:\Windows\System\nIpyDiB.exe
  C:\Windows\System\nIpyDiB.exe
  2⤵
  PID:2472
- C:\Windows\System\sgkvkfg.exe
  C:\Windows\System\sgkvkfg.exe
  2⤵
  PID:4424
- C:\Windows\System\wgUkBPO.exe
  C:\Windows\System\wgUkBPO.exe
  2⤵
  PID:3892
- C:\Windows\System\XIQqNxG.exe
  C:\Windows\System\XIQqNxG.exe
  2⤵
  PID:4776
- C:\Windows\System\IXsAaWE.exe
  C:\Windows\System\IXsAaWE.exe
  2⤵
  PID:4764
- C:\Windows\System\vzJDXkZ.exe
  C:\Windows\System\vzJDXkZ.exe
  2⤵
  PID:388
- C:\Windows\System\NCxMfcM.exe
  C:\Windows\System\NCxMfcM.exe
  2⤵
  PID:3732
- C:\Windows\System\tMDleho.exe
  C:\Windows\System\tMDleho.exe
  2⤵
  PID:11788
- C:\Windows\System\LTIAwQA.exe
  C:\Windows\System\LTIAwQA.exe
  2⤵
  PID:3788
- C:\Windows\System\roxDvbx.exe
  C:\Windows\System\roxDvbx.exe
  2⤵
  PID:4504
- C:\Windows\System\ImXVEUy.exe
  C:\Windows\System\ImXVEUy.exe
  2⤵
  PID:3604
- C:\Windows\System\BsSHwsw.exe
  C:\Windows\System\BsSHwsw.exe
  2⤵
  PID:4140
- C:\Windows\System\JTxOhmF.exe
  C:\Windows\System\JTxOhmF.exe
  2⤵
  PID:2056
- C:\Windows\System\FOUspaP.exe
  C:\Windows\System\FOUspaP.exe
  2⤵
  PID:4072
- C:\Windows\System\HLQaVaC.exe
  C:\Windows\System\HLQaVaC.exe
  2⤵
  PID:14100
- C:\Windows\System\FpMcavE.exe
  C:\Windows\System\FpMcavE.exe
  2⤵
  PID:4332
- C:\Windows\System\SaUNUkK.exe
  C:\Windows\System\SaUNUkK.exe
  2⤵
  PID:2792
- C:\Windows\System\cqlGUVn.exe
  C:\Windows\System\cqlGUVn.exe
  2⤵
  PID:4500
- C:\Windows\System\taigAMG.exe
  C:\Windows\System\taigAMG.exe
  2⤵
  PID:1796
- C:\Windows\System\LZPoDtq.exe
  C:\Windows\System\LZPoDtq.exe
  2⤵
  PID:2876
- C:\Windows\System\gAYgBhL.exe
  C:\Windows\System\gAYgBhL.exe
  2⤵
  PID:4224
- C:\Windows\System\UaHdLlS.exe
  C:\Windows\System\UaHdLlS.exe
  2⤵
  PID:2624
- C:\Windows\System\jgMLarv.exe
  C:\Windows\System\jgMLarv.exe
  2⤵
  PID:2732
- C:\Windows\System\UsNQdIF.exe
  C:\Windows\System\UsNQdIF.exe
  2⤵
  PID:4208
- C:\Windows\System\TnfQUWm.exe
  C:\Windows\System\TnfQUWm.exe
  2⤵
  PID:1876
- C:\Windows\System\tLavoIJ.exe
  C:\Windows\System\tLavoIJ.exe
  2⤵
  PID:1816
- C:\Windows\System\mKhDDEg.exe
  C:\Windows\System\mKhDDEg.exe
  2⤵
  PID:2696
- C:\Windows\System\EASltnZ.exe
  C:\Windows\System\EASltnZ.exe
  2⤵
  PID:2952
- C:\Windows\System\daZPnsJ.exe
  C:\Windows\System\daZPnsJ.exe
  2⤵
  PID:1760
- C:\Windows\System\YNaTtGF.exe
  C:\Windows\System\YNaTtGF.exe
  2⤵
  PID:4476
- C:\Windows\System\azDcFvl.exe
  C:\Windows\System\azDcFvl.exe
  2⤵
  PID:4388
- C:\Windows\System\pFtnuIt.exe
  C:\Windows\System\pFtnuIt.exe
  2⤵
  PID:4988
- C:\Windows\System\RGvxQRz.exe
  C:\Windows\System\RGvxQRz.exe
  2⤵
  PID:2092
- C:\Windows\System\HsXthtY.exe
  C:\Windows\System\HsXthtY.exe
  2⤵
  PID:4464
- C:\Windows\System\IFneNkQ.exe
  C:\Windows\System\IFneNkQ.exe
  2⤵
  PID:1192
- C:\Windows\System\ciZXOvs.exe
  C:\Windows\System\ciZXOvs.exe
  2⤵
  PID:948
- C:\Windows\System\NFCOzPf.exe
  C:\Windows\System\NFCOzPf.exe
  2⤵
  PID:5272
- C:\Windows\System\qhVHbgf.exe
  C:\Windows\System\qhVHbgf.exe
  2⤵
  PID:5168
- C:\Windows\System\BxEYmCQ.exe
  C:\Windows\System\BxEYmCQ.exe
  2⤵
  PID:5340
- C:\Windows\System\VdsGkZE.exe
  C:\Windows\System\VdsGkZE.exe
  2⤵
  PID:5608
- C:\Windows\System\zWbcXlV.exe
  C:\Windows\System\zWbcXlV.exe
  2⤵
  PID:3936
- C:\Windows\System\XqxMnzm.exe
  C:\Windows\System\XqxMnzm.exe
  2⤵
  PID:5528
- C:\Windows\System\qrBCIza.exe
  C:\Windows\System\qrBCIza.exe
  2⤵
  PID:2936
- C:\Windows\System\BwNeheP.exe
  C:\Windows\System\BwNeheP.exe
  2⤵
  PID:5872
- C:\Windows\System\UeInAwF.exe
  C:\Windows\System\UeInAwF.exe
  2⤵
  PID:1032
- C:\Windows\System\mtQVDBz.exe
  C:\Windows\System\mtQVDBz.exe
  2⤵
  PID:6164
- C:\Windows\System\FsnjnVo.exe
  C:\Windows\System\FsnjnVo.exe
  2⤵
  PID:3872
- C:\Windows\System\Ycxgqqj.exe
  C:\Windows\System\Ycxgqqj.exe
  2⤵
  PID:6300
- C:\Windows\System\jarDVtN.exe
  C:\Windows\System\jarDVtN.exe
  2⤵
  PID:5740
- C:\Windows\System\lmrMRAp.exe
  C:\Windows\System\lmrMRAp.exe
  2⤵
  PID:6436
- C:\Windows\System\uzdxZtP.exe
  C:\Windows\System\uzdxZtP.exe
  2⤵
  PID:5020
- C:\Windows\System\RtLNHQP.exe
  C:\Windows\System\RtLNHQP.exe
  2⤵
  PID:6632
- C:\Windows\System\IhhAXRM.exe
  C:\Windows\System\IhhAXRM.exe
  2⤵
  PID:6824
- C:\Windows\System\MEVtlgF.exe
  C:\Windows\System\MEVtlgF.exe
  2⤵
  PID:5172
- C:\Windows\System\BGmVAlW.exe
  C:\Windows\System\BGmVAlW.exe
  2⤵
  PID:6020
- C:\Windows\System\TdiJxAg.exe
  C:\Windows\System\TdiJxAg.exe
  2⤵
  PID:6584
- C:\Windows\System\yvfHvgE.exe
  C:\Windows\System\yvfHvgE.exe
  2⤵
  PID:13496
- C:\Windows\System\YgZbZsQ.exe
  C:\Windows\System\YgZbZsQ.exe
  2⤵
  PID:3700
- C:\Windows\System\IAOCwhz.exe
  C:\Windows\System\IAOCwhz.exe
  2⤵
  PID:5504
- C:\Windows\System\sUvZeZR.exe
  C:\Windows\System\sUvZeZR.exe
  2⤵
  PID:5708
- C:\Windows\System\CJCPkhS.exe
  C:\Windows\System\CJCPkhS.exe
  2⤵
  PID:14324
- C:\Windows\System\rnElbNG.exe
  C:\Windows\System\rnElbNG.exe
  2⤵
  PID:5992
- C:\Windows\System\bcTKGuq.exe
  C:\Windows\System\bcTKGuq.exe
  2⤵
  PID:5332
- C:\Windows\System\VMUixOa.exe
  C:\Windows\System\VMUixOa.exe
  2⤵
  PID:6836
- C:\Windows\System\Lioxvdn.exe
  C:\Windows\System\Lioxvdn.exe
  2⤵
  PID:5916
- C:\Windows\System\UZogeuc.exe
  C:\Windows\System\UZogeuc.exe
  2⤵
  PID:6992
- C:\Windows\System\IFBmeTj.exe
  C:\Windows\System\IFBmeTj.exe
  2⤵
  PID:7032
- C:\Windows\System\zGnyDwS.exe
  C:\Windows\System\zGnyDwS.exe
  2⤵
  PID:1520
- C:\Windows\System\WufiuHc.exe
  C:\Windows\System\WufiuHc.exe
  2⤵
  PID:5980
- C:\Windows\System\AyOKEAN.exe
  C:\Windows\System\AyOKEAN.exe
  2⤵
  PID:5268
- C:\Windows\System\DmJfpUt.exe
  C:\Windows\System\DmJfpUt.exe
  2⤵
  PID:5380
- C:\Windows\System\XhodcNG.exe
  C:\Windows\System\XhodcNG.exe
  2⤵
  PID:7844
- C:\Windows\System\jMeVctd.exe
  C:\Windows\System\jMeVctd.exe
  2⤵
  PID:6344
- C:\Windows\System\yiVsNfE.exe
  C:\Windows\System\yiVsNfE.exe
  2⤵
  PID:5296
- C:\Windows\System\yJkFIhq.exe
  C:\Windows\System\yJkFIhq.exe
  2⤵
  PID:832
- C:\Windows\System\wOUSvSX.exe
  C:\Windows\System\wOUSvSX.exe
  2⤵
  PID:7620
- C:\Windows\System\gRIgxSL.exe
  C:\Windows\System\gRIgxSL.exe
  2⤵
  PID:5536
- C:\Windows\System\xlwVOJp.exe
  C:\Windows\System\xlwVOJp.exe
  2⤵
  PID:7144
- C:\Windows\System\YsKSTPV.exe
  C:\Windows\System\YsKSTPV.exe
  2⤵
  PID:7928
- C:\Windows\System\sZteTLs.exe
  C:\Windows\System\sZteTLs.exe
  2⤵
  PID:7408
- C:\Windows\System\LKQBvRk.exe
  C:\Windows\System\LKQBvRk.exe
  2⤵
  PID:7424
- C:\Windows\System\bugGcfd.exe
  C:\Windows\System\bugGcfd.exe
  2⤵
  PID:14280
- C:\Windows\System\sVZGSjY.exe
  C:\Windows\System\sVZGSjY.exe
  2⤵
  PID:8004
- C:\Windows\System\WhSRAFt.exe
  C:\Windows\System\WhSRAFt.exe
  2⤵
  PID:8020
- C:\Windows\System\BXTtFuh.exe
  C:\Windows\System\BXTtFuh.exe
  2⤵
  PID:8760
- C:\Windows\System\zyvnYtf.exe
  C:\Windows\System\zyvnYtf.exe
  2⤵
  PID:6728
- C:\Windows\System\KKUkbav.exe
  C:\Windows\System\KKUkbav.exe
  2⤵
  PID:4644
- C:\Windows\System\LftywRD.exe
  C:\Windows\System\LftywRD.exe
  2⤵
  PID:3780
- C:\Windows\System\nsaEozb.exe
  C:\Windows\System\nsaEozb.exe
  2⤵
  PID:6128
- C:\Windows\System\vOeTlJs.exe
  C:\Windows\System\vOeTlJs.exe
  2⤵
  PID:5252
- C:\Windows\System\uuwPPzd.exe
  C:\Windows\System\uuwPPzd.exe
  2⤵
  PID:9144
- C:\Windows\System\ZDDUwOJ.exe
  C:\Windows\System\ZDDUwOJ.exe
  2⤵
  PID:9152
- C:\Windows\System\ZNmcqtL.exe
  C:\Windows\System\ZNmcqtL.exe
  2⤵
  PID:7840
- C:\Windows\System\vcuEwba.exe
  C:\Windows\System\vcuEwba.exe
  2⤵
  PID:7256
- C:\Windows\System\etdwFCC.exe
  C:\Windows\System\etdwFCC.exe
  2⤵
  PID:9180
- C:\Windows\System\dWLxXFV.exe
  C:\Windows\System\dWLxXFV.exe
  2⤵
  PID:4288
- C:\Windows\System\YfVlgyS.exe
  C:\Windows\System\YfVlgyS.exe
  2⤵
  PID:5824
- C:\Windows\System\rxfFMVF.exe
  C:\Windows\System\rxfFMVF.exe
  2⤵
  PID:6892
- C:\Windows\System\HoaLFqY.exe
  C:\Windows\System\HoaLFqY.exe
  2⤵
  PID:4460
- C:\Windows\System\xlBvjzf.exe
  C:\Windows\System\xlBvjzf.exe
  2⤵
  PID:8304
- C:\Windows\System\NGkILqC.exe
  C:\Windows\System\NGkILqC.exe
  2⤵
  PID:7616
- C:\Windows\System\eXKDwov.exe
  C:\Windows\System\eXKDwov.exe
  2⤵
  PID:7072
- C:\Windows\System\OokBZtZ.exe
  C:\Windows\System\OokBZtZ.exe
  2⤵
  PID:7532
- C:\Windows\System\gwALFUB.exe
  C:\Windows\System\gwALFUB.exe
  2⤵
  PID:7560
- C:\Windows\System\XYSVtcU.exe
  C:\Windows\System\XYSVtcU.exe
  2⤵
  PID:3148
- C:\Windows\System\LqAhoKN.exe
  C:\Windows\System\LqAhoKN.exe
  2⤵
  PID:8052
- C:\Windows\System\NdOhxNk.exe
  C:\Windows\System\NdOhxNk.exe
  2⤵
  PID:5360
- C:\Windows\System\alfDboe.exe
  C:\Windows\System\alfDboe.exe
  2⤵
  PID:9420
- C:\Windows\System\LoEXwsF.exe
  C:\Windows\System\LoEXwsF.exe
  2⤵
  PID:5212
- C:\Windows\System\OFmRSSI.exe
  C:\Windows\System\OFmRSSI.exe
  2⤵
  PID:7872
- C:\Windows\System\fdLKLPl.exe
  C:\Windows\System\fdLKLPl.exe
  2⤵
  PID:6260
- C:\Windows\System\DxrVEat.exe
  C:\Windows\System\DxrVEat.exe
  2⤵
  PID:6044
- C:\Windows\System\HxKtIFD.exe
  C:\Windows\System\HxKtIFD.exe
  2⤵
  PID:9856
- C:\Windows\System\VeHjmLw.exe
  C:\Windows\System\VeHjmLw.exe
  2⤵
  PID:7976
- C:\Windows\System\DIaMCep.exe
  C:\Windows\System\DIaMCep.exe
  2⤵
  PID:1676
- C:\Windows\System\pWbRZCM.exe
  C:\Windows\System\pWbRZCM.exe
  2⤵
  PID:7984
- C:\Windows\System\kGXNdli.exe
  C:\Windows\System\kGXNdli.exe
  2⤵
  PID:6376
- C:\Windows\System\aWYZCpL.exe
  C:\Windows\System\aWYZCpL.exe
  2⤵
  PID:9244
- C:\Windows\System\yEGUhUj.exe
  C:\Windows\System\yEGUhUj.exe
  2⤵
  PID:7876
- C:\Windows\System\dBZTSkq.exe
  C:\Windows\System\dBZTSkq.exe
  2⤵
  PID:10392
- C:\Windows\System\YQUOevb.exe
  C:\Windows\System\YQUOevb.exe
  2⤵
  PID:2040
- C:\Windows\System\scZjEHr.exe
  C:\Windows\System\scZjEHr.exe
  2⤵
  PID:6524
- C:\Windows\System\gLVUpIh.exe
  C:\Windows\System\gLVUpIh.exe
  2⤵
  PID:6212
- C:\Windows\System\kNoJaTO.exe
  C:\Windows\System\kNoJaTO.exe
  2⤵
  PID:5472
- C:\Windows\System\uHzrIrV.exe
  C:\Windows\System\uHzrIrV.exe
  2⤵
  PID:8480
- C:\Windows\System\jcFicYh.exe
  C:\Windows\System\jcFicYh.exe
  2⤵
  PID:11048
- C:\Windows\System\cXemUKi.exe
  C:\Windows\System\cXemUKi.exe
  2⤵
  PID:11108
- C:\Windows\System\VRDPGkv.exe
  C:\Windows\System\VRDPGkv.exe
  2⤵
  PID:11156
- C:\Windows\System\paqaPaG.exe
  C:\Windows\System\paqaPaG.exe
  2⤵
  PID:11168
- C:\Windows\System\tSNLXGn.exe
  C:\Windows\System\tSNLXGn.exe
  2⤵
  PID:6000
- C:\Windows\System\paejFNj.exe
  C:\Windows\System\paejFNj.exe
  2⤵
  PID:8236
- C:\Windows\System\kLpdFGM.exe
  C:\Windows\System\kLpdFGM.exe
  2⤵
  PID:6544
- C:\Windows\System\zdksFFK.exe
  C:\Windows\System\zdksFFK.exe
  2⤵
  PID:2984
- C:\Windows\System\qHrTIbm.exe
  C:\Windows\System\qHrTIbm.exe
  2⤵
  PID:11472
- C:\Windows\System\nocqQXn.exe
  C:\Windows\System\nocqQXn.exe
  2⤵
  PID:5780
- C:\Windows\System\RlHucyS.exe
  C:\Windows\System\RlHucyS.exe
  2⤵
  PID:2996
- C:\Windows\System\wSzNduC.exe
  C:\Windows\System\wSzNduC.exe
  2⤵
  PID:11812
- C:\Windows\System\QcexBkf.exe
  C:\Windows\System\QcexBkf.exe
  2⤵
  PID:9164
- C:\Windows\System\tneqnki.exe
  C:\Windows\System\tneqnki.exe
  2⤵
  PID:6056
- C:\Windows\System\JlWkazz.exe
  C:\Windows\System\JlWkazz.exe
  2⤵
  PID:6732
- C:\Windows\System\nuYeWnV.exe
  C:\Windows\System\nuYeWnV.exe
  2⤵
  PID:7000
- C:\Windows\System\vJzpzst.exe
  C:\Windows\System\vJzpzst.exe
  2⤵
  PID:12172
- C:\Windows\System\CaYIFLx.exe
  C:\Windows\System\CaYIFLx.exe
  2⤵
  PID:6452
- C:\Windows\System\LWTtKon.exe
  C:\Windows\System\LWTtKon.exe
  2⤵
  PID:6256
- C:\Windows\System\pIWAaWG.exe
  C:\Windows\System\pIWAaWG.exe
  2⤵
  PID:9716
- C:\Windows\System\mudyCru.exe
  C:\Windows\System\mudyCru.exe
  2⤵
  PID:6648
- C:\Windows\System\uMdhRCR.exe
  C:\Windows\System\uMdhRCR.exe
  2⤵
  PID:4488
- C:\Windows\System\vfsxExA.exe
  C:\Windows\System\vfsxExA.exe
  2⤵
  PID:11488
- C:\Windows\System\bazCCVu.exe
  C:\Windows\System\bazCCVu.exe
  2⤵
  PID:12608
- C:\Windows\System\woKjySF.exe
  C:\Windows\System\woKjySF.exe
  2⤵
  PID:11552
- C:\Windows\System\njgAJoB.exe
  C:\Windows\System\njgAJoB.exe
  2⤵
  PID:6352
- C:\Windows\System\nhSEJVF.exe
  C:\Windows\System\nhSEJVF.exe
  2⤵
  PID:8072
- C:\Windows\System\WSNnBQc.exe
  C:\Windows\System\WSNnBQc.exe
  2⤵
  PID:8856
- C:\Windows\System\aogHfHN.exe
  C:\Windows\System\aogHfHN.exe
  2⤵
  PID:1172
- C:\Windows\System\WpLoRvE.exe
  C:\Windows\System\WpLoRvE.exe
  2⤵
  PID:11668
- C:\Windows\System\BOTxgMn.exe
  C:\Windows\System\BOTxgMn.exe
  2⤵
  PID:11908
- C:\Windows\System\lffvXfc.exe
  C:\Windows\System\lffvXfc.exe
  2⤵
  PID:5828
- C:\Windows\System\AKFgjMv.exe
  C:\Windows\System\AKFgjMv.exe
  2⤵
  PID:7868
- C:\Windows\System\NByPBYM.exe
  C:\Windows\System\NByPBYM.exe
  2⤵
  PID:7924
- C:\Windows\System\ZkrwhMY.exe
  C:\Windows\System\ZkrwhMY.exe
  2⤵
  PID:13184
- C:\Windows\System\GOqEokR.exe
  C:\Windows\System\GOqEokR.exe
  2⤵
  PID:13204
- C:\Windows\System\kNtKeKi.exe
  C:\Windows\System\kNtKeKi.exe
  2⤵
  PID:13236
- C:\Windows\System\hzqezmg.exe
  C:\Windows\System\hzqezmg.exe
  2⤵
  PID:5852
- C:\Windows\System\gvxxvrH.exe
  C:\Windows\System\gvxxvrH.exe
  2⤵
  PID:12384
- C:\Windows\System\IHHOxrQ.exe
  C:\Windows\System\IHHOxrQ.exe
  2⤵
  PID:7452
- C:\Windows\System\QjRBZPF.exe
  C:\Windows\System\QjRBZPF.exe
  2⤵
  PID:12500
- C:\Windows\System\hQCZDtg.exe
  C:\Windows\System\hQCZDtg.exe
  2⤵
  PID:9132
- C:\Windows\System\kexUQjR.exe
  C:\Windows\System\kexUQjR.exe
  2⤵
  PID:8992
- C:\Windows\System\JzFQEHY.exe
  C:\Windows\System\JzFQEHY.exe
  2⤵
  PID:6156
- C:\Windows\System\QaYbzar.exe
  C:\Windows\System\QaYbzar.exe
  2⤵
  PID:8788
- C:\Windows\System\EfloJlZ.exe
  C:\Windows\System\EfloJlZ.exe
  2⤵
  PID:6100
- C:\Windows\System\mfgZGpK.exe
  C:\Windows\System\mfgZGpK.exe
  2⤵
  PID:5540
- C:\Windows\System\WdhsLmA.exe
  C:\Windows\System\WdhsLmA.exe
  2⤵
  PID:13072
- C:\Windows\System\RdTYhvi.exe
  C:\Windows\System\RdTYhvi.exe
  2⤵
  PID:9872
- C:\Windows\System\SNWwrmP.exe
  C:\Windows\System\SNWwrmP.exe
  2⤵
  PID:13108
- C:\Windows\System\mZmukxO.exe
  C:\Windows\System\mZmukxO.exe
  2⤵
  PID:13148
- C:\Windows\System\xWMWAWC.exe
  C:\Windows\System\xWMWAWC.exe
  2⤵
  PID:13160
- C:\Windows\System\gunVZrb.exe
  C:\Windows\System\gunVZrb.exe
  2⤵
  PID:10076
- C:\Windows\System\TFoLEMB.exe
  C:\Windows\System\TFoLEMB.exe
  2⤵
  PID:4044
- C:\Windows\System\cxfUQwy.exe
  C:\Windows\System\cxfUQwy.exe
  2⤵
  PID:10432
- C:\Windows\System\PHmSmmP.exe
  C:\Windows\System\PHmSmmP.exe
  2⤵
  PID:12220
- C:\Windows\System\CrfCcFm.exe
  C:\Windows\System\CrfCcFm.exe
  2⤵
  PID:4316
- C:\Windows\System\SrhVOeR.exe
  C:\Windows\System\SrhVOeR.exe
  2⤵
  PID:10468
- C:\Windows\System\nRJlOjz.exe
  C:\Windows\System\nRJlOjz.exe
  2⤵
  PID:10124
- C:\Windows\System\jHQkwtz.exe
  C:\Windows\System\jHQkwtz.exe
  2⤵
  PID:3760
- C:\Windows\System\RchoWsA.exe
  C:\Windows\System\RchoWsA.exe
  2⤵
  PID:11220
- C:\Windows\System\YmlXMie.exe
  C:\Windows\System\YmlXMie.exe
  2⤵
  PID:11252
- C:\Windows\System\bzDkalz.exe
  C:\Windows\System\bzDkalz.exe
  2⤵
  PID:9688
- C:\Windows\System\uNtgPWA.exe
  C:\Windows\System\uNtgPWA.exe
  2⤵
  PID:10732

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

__PSScriptPolicyTest_cqxab3dq.ozl.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_cqxab3dq.ozl.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

BOAxHzw.exe

Path C:\Windows\System\BOAxHzw.exe
Size 1.8MB
SHA256 84ce3495cd3100aa2d6835bc3fb989b9bbc58b1879c64e9c303b69eb277800ab
MD5 ef87f3344e1ff170753815c55602095d
SHA1 0b632d02a4177ffb024d1efb0d1422106bf4b75c
SHA512 7ce7be592555d236787cd12e728ae2934ac4ef58bae5734046efc6ff06a0ee16e36e300eedf98af50b883dde0e19c1819c78e0aa2b67d270d06a8cabf771c7f7
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkipfzaCtNcQcAupaXHeY5HmsoKTQXvaW9Rcps9kdiT:Lz071uv4BPMki8CnfLv3zQXtTE3S
MD5 SHA1 SHA512 SSDEEP

Submit Download

EfJLnsc.exe

Path C:\Windows\System\EfJLnsc.exe
Size 1.8MB
SHA256 d841f865f2b8e0438c8edaba018bf1a79e361ce4693353ba0aec5269fcbd54c1
MD5 2bf469de06a3694672d0159f5d4adb77
SHA1 94a04758f3e1a85e19f008dd01cc53acab55ca73
SHA512 c5c5ce992acf07409560c447dee8cedaeec0ab65374b24ff82975dbc8ef79f0e1329ad1e22fe968286f69a3d0ebece194c2de01417aebe2c2f1076dd0decb615
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkipfzaCtNcQcAupaXHeY5HmsoKTQXvaW9Rcps9kdiy:Lz071uv4BPMki8CnfLv3zQXtTE3V
MD5 SHA1 SHA512 SSDEEP

Submit Download

FImpkkQ.exe

Path C:\Windows\System\FImpkkQ.exe
Size 1.8MB
SHA256 51e157f06be64e7ab6cb4d80fd925a8d62eeae271f40ee54a23944f0d0e88c74
MD5 97ed3355597d673ef39a898fc20aa9e4
SHA1 638529492f977cbed82829cf08fdaa250ac6a2da
SHA512 387fdfa58ee89921e9b0dca70b564757ee054859b1228f4a6aed67365b9dcf8978582c5589cf32a73ac7549780e14a60302f989e1cf81a848dedb5f6e08dd3e5
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkipfzaCtNcQcAupaXHeY5HmsoKTQXvaW9Rcps9kdik:Lz071uv4BPMki8CnfLv3zQXtTE3d
MD5 SHA1 SHA512 SSDEEP

Submit Download

FjnRggU.exe

Path C:\Windows\System\FjnRggU.exe
Size 1.8MB
SHA256 33ac9894a2e578f5e05f01c3271875138fddea594486f3096e7f9ebcca856245
MD5 77a555493076479313465c11c38505ec
SHA1 bab3d40ee729fc0a6905138a17ab951f81f28ffd
SHA512 8bf9297ff7c42fdbdc868f009508a674a43033f1d6bd43bb0dd41f1f17dae5297324c6411bfa65e6845a71744f939378168ad3847e9f94c1946d21e180641ee5
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkipfzaCtNcQcAupaXHeY5HmsoKTQXvaW9Rcps9kdiz:Lz071uv4BPMki8CnfLv3zQXtTE3K
MD5 SHA1 SHA512 SSDEEP

Submit Download

GjuhcTQ.exe

Path C:\Windows\System\GjuhcTQ.exe
Size 1.8MB
SHA256 fcd946c0472f36536d80786abdf7d9370bfea76583e68db7e6b38af4b7039c63
MD5 24911c49bb911e787a98b6f149d47a88
SHA1 27660166dc199f79c27e5f2d6c0f966abea3507e
SHA512 1af101f24aa94463cda0e2193b19eb204e041aaf86e1e57f743dbcb4362cfa1c834d07f389c7ee962211f42bcdd2bdecd8333daafca133ae9ee133caa49020a0
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkipfzaCtNcQcAupaXHeY5HmsoKTQXvaW9Rcps9kdiz:Lz071uv4BPMki8CnfLv3zQXtTE3U
MD5 SHA1 SHA512 SSDEEP

Submit Download

HAPmGpP.exe

Path C:\Windows\System\HAPmGpP.exe
Size 1.8MB
SHA256 44de2e5cf5f7ffc611c6e0bad9c901d9d88f76f07d996e917cbb261b01fbda89
MD5 b9524c3b1c50721d127771e0b56fa03f
SHA1 179a782afdbcc5fbf7528d8d93cd598cdecb8926
SHA512 9c93c317ede228c7f0a59791634b4d7d581cea2f825b1c7a7fc39f525bced68a07374284a27cf79a87f6597b2d5a64887f5e0b9e5a07e91f1b0d1e689b59e41a
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkipfzaCtNcQcAupaXHeY5HmsoKTQXvaW9Rcps9kdi5:Lz071uv4BPMki8CnfLv3zQXtTE34
MD5 SHA1 SHA512 SSDEEP

Submit Download

HqOAoPw.exe

Path C:\Windows\System\HqOAoPw.exe
Size 1.8MB
SHA256 97ce518101f24fecbd4aedabdd06bf775b51298d46cb679cd6e036bf05544cad
MD5 cfc261a3d7c333e65e42c5fbcab507cd
SHA1 4e3c19e00ca25500d6bcfeeae32f06fdf9134b25
SHA512 00724046d6ab3db90a8a0206a3cb94ed9e9f809141cfacf8a7398dd228a04b5bb37dd39636c3bd900733192e6e6e69dee17796367db93e75c4d0fc334d291492
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkipfzaCtNcQcAupaXHeY5HmsoKTQXvaW9Rcps9kdiD:Lz071uv4BPMki8CnfLv3zQXtTE3g
MD5 SHA1 SHA512 SSDEEP

Submit Download

JClIZTM.exe

Path C:\Windows\System\JClIZTM.exe
Size 1.8MB
SHA256 dfd3c36427461e1fbbf8f56f1cbbadfd0241b80edaf51581e3ce3ef4b5440460
MD5 9baa6a6431442f8a1af7ba3345c949c5
SHA1 a4d21d565e5c833d414519c7404b4864bdf720a7
SHA512 a9e9fcf5d4d3cce2a9f6c266700e6fec7e71f61a9fb74262e8b5fbcdb6ed7bbad535e1b8ecb468b86efdc62fa7ac38a15b405cce860c90998e95da5f1f143d91
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkipfzaCtNcQcAupaXHeY5HmsoKTQXvaW9Rcps9kdiS:Lz071uv4BPMki8CnfLv3zQXtTE3p
MD5 SHA1 SHA512 SSDEEP

Submit Download

KLvhEvo.exe

Path C:\Windows\System\KLvhEvo.exe
Size 1.8MB
SHA256 fa995e549801e126d74e9e1ddc7a69fd46b9a6e48eb4e939bcc2bac7b3fa144e
MD5 5e5730d224bc24e2c10acfef4229b8a3
SHA1 81ba76a4fff1ba5be2292cd5c7104a5ed94ad1e7
SHA512 b037c5d35f883d364dd459aa90e9a980d15ce7136fe651e91e41ded150c17d2ffe985fe026e4c5c6d102a4824d4fb265aa53c07f27c5ba498522870f7139c3d8
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkipfzaCtNcQcAupaXHeY5HmsoKTQXvaW9Rcps9kdiP:Lz071uv4BPMki8CnfLv3zQXtTE30
MD5 SHA1 SHA512 SSDEEP

Submit Download

KNOOqXE.exe

Path C:\Windows\System\KNOOqXE.exe
Size 1.8MB
SHA256 8877cb7d58ec64be012ebc8134b6c1d7e2fa7e37a3406c8b37889e669c1b1204
MD5 ccb7b4801a4a05f8461e2557f7f78497
SHA1 8f5d6e68a5d935ebf60b608748d1d6bf61ace477
SHA512 ac9d4f4a1a4ef8ba3f1d994e0afb012b4b1d1cfcbb9f0d01840d6d6376e174ac8b28a4b491433dba4b9dcb45bf9fc2b70e0484168d41767686de4b8488a1381d
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkipfzaCtNcQcAupaXHeY5HmsoKTQXvaW9Rcps9kdi7:Lz071uv4BPMki8CnfLv3zQXtTE3a
MD5 SHA1 SHA512 SSDEEP

Submit Download

LqDxzxt.exe

Path C:\Windows\System\LqDxzxt.exe
Size 1.8MB
SHA256 cfabe305bb5cd8a2a57b4dc89e532a1fc2b320adc12bbc2d2861ac5a2548ac58
MD5 2b5b1183c7a606bf48db4ba4369570de
SHA1 21c10aca6a1d8b92d48f01e8804489afa51161bf
SHA512 46d26de525e0739551b91fab9c04a642adef02ad041b7055ed4c4fea8e46a3df044558e450518e6e5b0c1c5556b55259a58403c2923b2a9f76422edb2f1f9579
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkipfzaCtNcQcAupaXHeY5HmsoKTQXvaW9Rcps9kdit:Lz071uv4BPMki8CnfLv3zQXtTE3o
MD5 SHA1 SHA512 SSDEEP

Submit Download

MjjrSvu.exe

Path C:\Windows\System\MjjrSvu.exe
Size 8B
SHA256 a36bd8af622126db3772aa5f26c44677cc6d4725b09ba5540d0176a0abfd5c23
MD5 da845550a975937159e66fa37f10ff6c
SHA1 e5cb4ac51083947d2e1c0e8348ae113bcebb4831
SHA512 678a6b78d5e2d41a650bcfcd42a4eb6fe0bcbb968ffad649d881fc75a3b6d30d02a56ff281cc12259e0bb2d93dffb16f61a5d132288c4914dcfb86329aa4ae28
MD5 SHA1 SHA512

Submit Download

OdnvHIX.exe

Path C:\Windows\System\OdnvHIX.exe
Size 1.8MB
SHA256 2a95873f514ba16b6efe09dc124df1b141d8bbfeeddebdd5d3f94f88d4b69480
MD5 102b400a4134711bc47d5ef8d9410c78
SHA1 e6ca991ced9a1533975a2a7254dc884925a4ac7c
SHA512 80027e6077b71f6686409baee80eec1d045339ffefb3fa4d61d5ff8a3d644fa08798f89a861607f740cdda4038a40b7e166ea30d251cbfde37370b351864a2e8
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkipfzaCtNcQcAupaXHeY5HmsoKTQXvaW9Rcps9kdiX:Lz071uv4BPMki8CnfLv3zQXtTE3c
MD5 SHA1 SHA512 SSDEEP

Submit Download

UjxBKkF.exe

Path C:\Windows\System\UjxBKkF.exe
Size 1.8MB
SHA256 018ed909587183899c31ef0834ad022d3c2c35641c36692dccc5b7c9bc3b7f15
MD5 e5dd6cb8cae40b87932b030768b5a2a9
SHA1 03442784f1d2fa4d5a41a1b216565992ad5f81bb
SHA512 ac62b10ad11bd1839c3619aca8c0892896e0da2805ddbc172b3c29c26c33fe4bfb695cb25c531ae3142ce7272a7c79c9190d4dd31673a6501357f73ec8e8aaac
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkipfzaCtNcQcAupaXHeY5HmsoKTQXvaW9Rcps9kdiY:Lz071uv4BPMki8CnfLv3zQXtTE3t
MD5 SHA1 SHA512 SSDEEP

Submit Download

VCKwJZO.exe

Path C:\Windows\System\VCKwJZO.exe
Size 1.8MB
SHA256 8d9be9813b5dcca88dc0f34555a3c7ddb57ea781b56e2e5d38cb72b9bdc79f7d
MD5 1bf8b66c9b0067d5054a9e21db975e83
SHA1 719bba9700e865ee1bbc4a684c67952efcfcd940
SHA512 afdada0b22233595df34c6d3c20d984fd545c22b6c525049ac540d8366cab74e7217e986f8506e64e6f3e30e1ccfc6a64a277c3165ac12e528b3eac90f219bf4
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkipfzaCtNcQcAupaXHeY5HmsoKTQXvaW9Rcps9kdik:Lz071uv4BPMki8CnfLv3zQXtTE3T
MD5 SHA1 SHA512 SSDEEP

Submit Download

WTPruEy.exe

Path C:\Windows\System\WTPruEy.exe
Size 1.8MB
SHA256 a8b6329e4845ab6c4e9a9f789d0ddeb8d59709a4c54fc70ed9cc4fdf037ff6ae
MD5 64ae960e9bd48da8f5a3419a0d1a8e99
SHA1 18912fdc09d073405e1a90c6f8f309b2755fe8c0
SHA512 f4b174d0284753d150fd0f48b15690d1ac136ada9822e7b3a347e93c48987234c440893b5401b7afcce8061c567d7db9edc637c1af20cce8c94dff5f4cac0afa
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkipfzaCtNcQcAupaXHeY5HmsoKTQXvaW9Rcps9kdiX:Lz071uv4BPMki8CnfLv3zQXtTE3tk
MD5 SHA1 SHA512 SSDEEP

Submit Download

WcXpylK.exe

Path C:\Windows\System\WcXpylK.exe
Size 1.8MB
SHA256 63380221cba002df90fda158f8ce2fd700f02e0a5829b8883c1b791f4eda5dba
MD5 14c9804d1eef03b8c0f20a3e6d0787f7
SHA1 3521c5321c748af5b3e4e4bc05a016d180a9ba89
SHA512 30e54993ee6ee1e0942ca170b279c3b8b2d393a564d0906bdc14075695737d393fedd1b3c375d0254333102c898a8deb21e8ada45d93509b7a7fd5923de5e946
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkipfzaCtNcQcAupaXHeY5HmsoKTQXvaW9Rcps9kdiQ:Lz071uv4BPMki8CnfLv3zQXtTE3B
MD5 SHA1 SHA512 SSDEEP

Submit Download

XIGWdeC.exe

Path C:\Windows\System\XIGWdeC.exe
Size 1.8MB
SHA256 5987dbdb570cd7505dec9eb2a17b22548213ba534270ff72f2254e4bd9732e63
MD5 a1e8d963f911c97b0123bdda3290a2e0
SHA1 96bdafd6536ba72112aeed9ec8ca8cf0e35e4df4
SHA512 93a310861be289c655767fdfd3da845f1d9643902cd2a69d6d8c3811f4ad227e28f48af94536ecd7537dca6b026e58b4cccca11ce3a8762cca0f24594981bf7b
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkipfzaCtNcQcAupaXHeY5HmsoKTQXvaW9Rcps9kdi1:Lz071uv4BPMki8CnfLv3zQXtTE3+
MD5 SHA1 SHA512 SSDEEP

Submit Download

XvtrUzx.exe

Path C:\Windows\System\XvtrUzx.exe
Size 1.8MB
SHA256 a1fb4076e4b603ed699b456b8dda6a32bd541d6cd70fca6e5e66a5a4be6ed211
MD5 95d2aff29c08b6f31556b22a33f7cc64
SHA1 fd19e74680f17b83c0a8efa6a399a82e6adcffe1
SHA512 9bd79c10d507f2ab0fdc7a89477fe9a4306e80fb9434cb3653daff171a5b7f5d26bae5298433765b5902541269ccef28e37155bb269d8939f34593322cb3b1a3
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkipfzaCtNcQcAupaXHeY5HmsoKTQXvaW9Rcps9kdiK:Lz071uv4BPMki8CnfLv3zQXtTE3l
MD5 SHA1 SHA512 SSDEEP

Submit Download

YwIVbeo.exe

Path C:\Windows\System\YwIVbeo.exe
Size 1.8MB
SHA256 05b36e4f4be7189cd93155ed060e5b4dddcefe7688c555d3fd457ad750e90a73
MD5 0ecd52a67c0b229ab0a14924061f4513
SHA1 663798e612eedf18a2ee57d858741473383edfe6
SHA512 29d6afc79ac4ebf31b16d4f5277cfad9a7a982ba24e362d5f6bc40fa45ce3ee3f2b2fbc6550ef4104a3cb57201fa315f328d465f06b39dc1c2321b731ac071ed
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkipfzaCtNcQcAupaXHeY5HmsoKTQXvaW9Rcps9kdiw:Lz071uv4BPMki8CnfLv3zQXtTE3v
MD5 SHA1 SHA512 SSDEEP

Submit Download

ZCsrJeY.exe

Path C:\Windows\System\ZCsrJeY.exe
Size 1.8MB
SHA256 87df872f066e76d872455f3ab880a3d624212395d23d13ee2c8165823fd4f172
MD5 176b121657fa437b891e2df5e8771b1d
SHA1 85e55fb5eb7dc49f453f5d9bb126711510be6b96
SHA512 de2a4c6da446e14ba59864ab41d8a6147fde030311838ff233fabd8fd8c7d3cdc3c65def5a585fae9fdd8f526bfde7b88ee458e791cb2399da19159bebc82636
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkipfzaCtNcQcAupaXHeY5HmsoKTQXvaW9Rcps9kdiP:Lz071uv4BPMki8CnfLv3zQXtTE3K
MD5 SHA1 SHA512 SSDEEP

Submit Download

bBDZWXQ.exe

Path C:\Windows\System\bBDZWXQ.exe
Size 1.8MB
SHA256 4172a42c2130852928df8f3b95020503bb2c15c5d43795aaad355b1260977623
MD5 d3d9ead4f3894241566e421c18e7ab23
SHA1 4635327e54940ea71e8263ef26b02c9cfe077aaa
SHA512 ccbb2d11d0917821f72b43ff8676f029b3fc0aa9ec6930de40a8317e4c7aa07243eceeedeaaecdcdb1f4d8b6e5dd6f5992101f7089105aa618025c7f16ecd027
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkipfzaCtNcQcAupaXHeY5HmsoKTQXvaW9Rcps9kdif:Lz071uv4BPMki8CnfLv3zQXtTE3G
MD5 SHA1 SHA512 SSDEEP

Submit Download

eSLiLOE.exe

Path C:\Windows\System\eSLiLOE.exe
Size 1.8MB
SHA256 9721a5563dc797177be264041d084f81cb42d8ded15f558789a01fb2d03727a3
MD5 d07b954cb9a87f4aeefc825718baff7c
SHA1 f101ebb177717e830349292e7c2a1d27a44db2ec
SHA512 da6d412ea875628166e40947cf9cca77d741bf497e2c1762ca4c5562bebf183bdd1edd848633958fb763c30cb0203e69943dba665374a7da3797ed3daa6f2331
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkipfzaCtNcQcAupaXHeY5HmsoKTQXvaW9Rcps9kdik:Lz071uv4BPMki8CnfLv3zQXtTE3b
MD5 SHA1 SHA512 SSDEEP

Submit Download

euPdUWw.exe

Path C:\Windows\System\euPdUWw.exe
Size 1.8MB
SHA256 7400880a430c3b1c195c108935f11476ab078629ff756556acb14d44c6119d03
MD5 549cae9a6c9d24c86d2e555438cb8b43
SHA1 4bcd810412f3a40839739e3a01ae710039a7f9ea
SHA512 b2bc0e07ad067e91a02c760b7567d3cbab6c5c3752101edc207a2bed8123029c852586ca9e47b6b62cdcbade76cd6eda9ad768e2398922a8850fadba51a3381c
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkipfzaCtNcQcAupaXHeY5HmsoKTQXvaW9Rcps9kdiE:Lz071uv4BPMki8CnfLv3zQXtTE3X
MD5 SHA1 SHA512 SSDEEP

Submit Download

gbDgtSV.exe

Path C:\Windows\System\gbDgtSV.exe
Size 1.8MB
SHA256 675a3507ca759272b31bfc0a688e8d45b7e82dd291f04f754baec596feaafbc1
MD5 6a994011606d230d90d5446a78654594
SHA1 3f7554aed3b4bd73b6697557739f950f21278c6e
SHA512 91ca0c2e08998c2edeea266f52f979141fea8cedb8c177c607a3ba1561636526dcda149a9aacfc01e8ecb1cc89908a621ef5ba8f3b494bb965d5e9a74074f280
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkipfzaCtNcQcAupaXHeY5HmsoKTQXvaW9Rcps9kdiZ:Lz071uv4BPMki8CnfLv3zQXtTE36
MD5 SHA1 SHA512 SSDEEP

Submit Download

hIZvvDE.exe

Path C:\Windows\System\hIZvvDE.exe
Size 1.8MB
SHA256 6aa89e4eefc87985010787c74150999757e39beab432ae5c33cec7222bf9219d
MD5 470445285f81c09314e8a4801cf3b051
SHA1 abb29f41cc52c8aadf032aecfdfb84cacd712667
SHA512 0bd846e01dec7b745d3cc4225ef1a03ada5fead462abfc0e71e26f245d4cd85f6c11cb2a1371f77600c991e8411aed48694344ff999948fd13212572c83b1cb0
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkipfzaCtNcQcAupaXHeY5HmsoKTQXvaW9Rcps9kdiP:Lz071uv4BPMki8CnfLv3zQXtTE3Y
MD5 SHA1 SHA512 SSDEEP

Submit Download

hgqODkg.exe

Path C:\Windows\System\hgqODkg.exe
Size 1.8MB
SHA256 27f09d0a7b2c2bbb2220003253e0fccdabc30fe6593fd485b0444609dd332db4
MD5 873d49b37057566173a4abf562effc9d
SHA1 a2c24d0396c2b942bfe0190ba50ebff5e11b810d
SHA512 3aa6c6383ef98515694202051175df608827358562a820fbf1596e70b47829910603eeaebe6fb044cf4bfd79146eb104c59f07b53bdc17846e0af732e91c751a
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkipfzaCtNcQcAupaXHeY5HmsoKTQXvaW9Rcps9kdiW:Lz071uv4BPMki8CnfLv3zQXtTE3P
MD5 SHA1 SHA512 SSDEEP

Submit Download

iFpmkqW.exe

Path C:\Windows\System\iFpmkqW.exe
Size 1.8MB
SHA256 fe48bc3b9cbe5e0581bceddc08ed9c4ba33be48ed9471b95bd34f031735b89ee
MD5 81887739e447dea4290acc1e121d1ee5
SHA1 eaf617690d9bb5dec068078055203bb0a08c50e9
SHA512 c1e1782ebcb7523ecadf17e7b74d05548cf4f07cc2a296468fe58200dd5e34591de469b08d25ea6b16740f7272e35e7992ea0829d1cb2a523d8ed75dee5817c6
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkipfzaCtNcQcAupaXHeY5HmsoKTQXvaW9Rcps9kdiI:Lz071uv4BPMki8CnfLv3zQXtTE33
MD5 SHA1 SHA512 SSDEEP

Submit Download

iXelnue.exe

Path C:\Windows\System\iXelnue.exe
Size 1.8MB
SHA256 f5d29e816f636a0b4f811e177a75f33a26968b13c52637fec6720368af571764
MD5 90bc965e1239241e2618e721987705c2
SHA1 1859487b16e79f2ac2d00c31388300f88bbc2a4d
SHA512 fb4026f737d883835bd3f214eef68249907dc39a63fd508ded6a52d61c9195e321b5d658c7bdca9384e1118bc66534f1a4df60e410e70a62ae9fbacc88cb22ab
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkipfzaCtNcQcAupaXHeY5HmsoKTQXvaW9Rcps9kdiD:Lz071uv4BPMki8CnfLv3zQXtTE3K
MD5 SHA1 SHA512 SSDEEP

Submit Download

ixsrkzc.exe

Path C:\Windows\System\ixsrkzc.exe
Size 1.8MB
SHA256 b08486be331c9231b51f1baee55d0d3c50b0efe3c838abc6d6204e66eb7e3cbb
MD5 30f035f52106a69527cbca27e2dcc919
SHA1 db3d28732189ef52b21b7a88e8fac1cd0aa4b85b
SHA512 877156221891d91e90ad40ed7c95c6cc1e8b0b26c2cbba477814787592b590986f6b0be833b27f6779e76bd72a777324829a4c26bccd001da65721cb3f502827
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkipfzaCtNcQcAupaXHeY5HmsoKTQXvaW9Rcps9kdis:Lz071uv4BPMki8CnfLv3zQXtTE3V
MD5 SHA1 SHA512 SSDEEP

Submit Download

nhEfCKF.exe

Path C:\Windows\System\nhEfCKF.exe
Size 1.8MB
SHA256 d75260f591158a471477cbe0d65e8755200500843e28f05703e0c82909ecb287
MD5 60dad0214378fc9f381f6743f0dbe74a
SHA1 37af47b96c4b3cfa5b3ff8640dfbac9b5cca4f54
SHA512 a1374c7306da90f5b43ef3c07b2ff18f2213f14d6442e0c6136b7a78970d6d30061b1cf2c4d2dd6c2d2974d92ced905aafd1b2c06b2230a4f9dc3130ca71aaf3
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkipfzaCtNcQcAupaXHeY5HmsoKTQXvaW9Rcps9kdix:Lz071uv4BPMki8CnfLv3zQXtTE3W
MD5 SHA1 SHA512 SSDEEP

Submit Download

nzKFpej.exe

Path C:\Windows\System\nzKFpej.exe
Size 1.8MB
SHA256 df06921ae5be111a73ae6d80164781d1b07bf0a79370b79e8dc50a2b99bda8ff
MD5 fde72dd41923789cea504c843517132c
SHA1 525d866223097e50c480da55afc616ad86b61cbb
SHA512 ffe9bad8830545f86c145c8575449a05f5ee1fec72f571d6db1cb6d1481ffb28af5f33b0298462078dd726b9ca6316b350a67c5cd06d4d92da9041dabb51087c
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkipfzaCtNcQcAupaXHeY5HmsoKTQXvaW9Rcps9kdin:Lz071uv4BPMki8CnfLv3zQXtTE3C
MD5 SHA1 SHA512 SSDEEP

Submit Download

pvUJohh.exe

Path C:\Windows\System\pvUJohh.exe
Size 1.8MB
SHA256 facb58ad49f8ff5a4396090fc99df64cb0b78a975f4848a035adbf7ba2d7faad
MD5 d6aff1ce3b24f1c0dfa1bd24c5aefb27
SHA1 f8ac3cf92f4a3ab4e2bd1b949798daf020504dcd
SHA512 2980437e206fc06071ea5c6d986d73758499eb3c6042f62861474a110ae1be36279bdfaca328e7796b4c1b405f8b887bc5bf6c6aa675b69680c26a6d61d6fc8c
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkipfzaCtNcQcAupaXHeY5HmsoKTQXvaW9Rcps9kdiD:Lz071uv4BPMki8CnfLv3zQXtTE3K
MD5 SHA1 SHA512 SSDEEP

Submit Download

qyWtOVv.exe

Path C:\Windows\System\qyWtOVv.exe
Size 1.8MB
SHA256 344eb0669c052e684c4eed4d574d8222bca3d582209e581adb07fb0125174ba5
MD5 28c885cc8c44283f7ffb145facb5b046
SHA1 bcbb68b826855872549ba17a78f7a112ba4cdb4e
SHA512 8585330b4f8197fa00820b91400fe0467ba4821ec501663d3c0046b95f7cff9deb72c96df6860c7d9f5d5a28731272189fcb972ed1ea5262aba3e5530fa241ea
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkipfzaCtNcQcAupaXHeY5HmsoKTQXvaW9Rcps9kdiy:Lz071uv4BPMki8CnfLv3zQXtTE3SO
MD5 SHA1 SHA512 SSDEEP

Submit Download

syDZZLk.exe

Path C:\Windows\System\syDZZLk.exe
Size 1.8MB
SHA256 65bcc5254d670325a6d168616384c2ffa46892caee485e9d734a84647d6e263f
MD5 d0ad48066cff3c4feed4c460d4255d26
SHA1 b8c60757d281fef794e700de90c442d262962676
SHA512 e1c2b4c68617e5c0a523684f187a8eb0ca024b138e12215385f2dde404865f20c259215bfec5948ae3a19353dd6084f0670bab537cb184c055c73623f620d6c4
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkipfzaCtNcQcAupaXHeY5HmsoKTQXvaW9Rcps9kdio:Lz071uv4BPMki8CnfLv3zQXtTE3P
MD5 SHA1 SHA512 SSDEEP

Submit Download

wCLhkVh.exe

Path C:\Windows\System\wCLhkVh.exe
Size 1.8MB
SHA256 2a16c36d0f7a0302eabbe2ecf9f9aa14cf52b727bfd9ce22e3a3397f70acac84
MD5 d97544615a09077f656079cdfd186969
SHA1 96a15b9a5b01338f965a9fa835feaf1d1e762e7b
SHA512 a326895e6a90a46b2522808d7a2f7aae496bccb76604686c7dc78ffaea509d456bfe9f483ec9e19e25e6ef7aff4ebc642261d98bdd5a62ee8a264c121a099228
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkipfzaCtNcQcAupaXHeY5HmsoKTQXvaW9Rcps9kdid:Lz071uv4BPMki8CnfLv3zQXtTE34
MD5 SHA1 SHA512 SSDEEP

Submit Download

wtxpXSs.exe

Path C:\Windows\System\wtxpXSs.exe
Size 1.8MB
SHA256 187403e8000869973fe5b347bb1416302d9edfb71bd34061ce8dff05c3154d5d
MD5 2b593d66793efaec0fe08311708b659f
SHA1 05f1ab9d619453b9991c699caf6267903ba0b694
SHA512 0877df16958b8eb0f9a772286cf03da2d47f51f147736f548c9c8e46445160e806bc5340f468297b7b2b350e591be92ef58566e0861119aec3b1b2e4128f87ff
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkipfzaCtNcQcAupaXHeY5HmsoKTQXvaW9Rcps9kdiI:Lz071uv4BPMki8CnfLv3zQXtTE3l
MD5 SHA1 SHA512 SSDEEP

Submit Download

yEhbNQT.exe

Path C:\Windows\System\yEhbNQT.exe
Size 1.8MB
SHA256 2fec5bba55c24fd561a513453c14d4a7e616627c542ba1b59f6f162c9e1d0bb5
MD5 ac420c6c3439a78b8a977ec541961c91
SHA1 720ea6581415a4f3384b01c5620391ddb4336a3a
SHA512 e510dfecb7f19fad322f396c4324bbeef0e6bbe6ed7325918ca015948b542a6b893aa94bcfe519825e15c69a39fae7a54ae06c25cddd2e10b1ed6a8735b35bfd
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkipfzaCtNcQcAupaXHeY5HmsoKTQXvaW9Rcps9kdi9:Lz071uv4BPMki8CnfLv3zQXtTE3S
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/208-48-0x00007FF7DFAA0000-0x00007FF7DFE92000-memory.dmp

Download

memory/208-6083-0x00007FF7DFAA0000-0x00007FF7DFE92000-memory.dmp

Download

memory/532-6099-0x00007FF735B80000-0x00007FF735F72000-memory.dmp

Download

memory/532-132-0x00007FF735B80000-0x00007FF735F72000-memory.dmp

Download

memory/592-6073-0x00007FF6A8D60000-0x00007FF6A9152000-memory.dmp

Download

memory/592-31-0x00007FF6A8D60000-0x00007FF6A9152000-memory.dmp

Download

memory/1100-0-0x00007FF6D9F20000-0x00007FF6DA312000-memory.dmp

Download

memory/1100-1-0x000001EB758A0000-0x000001EB758B0000-memory.dmp

Download

memory/1540-126-0x00007FF60A200000-0x00007FF60A5F2000-memory.dmp

Download

memory/1540-6117-0x00007FF60A200000-0x00007FF60A5F2000-memory.dmp

Download

memory/1568-233-0x000001F8AE1E0000-0x000001F8AE986000-memory.dmp

Download

memory/1568-161-0x000001F8ACAC0000-0x000001F8ACAE2000-memory.dmp

Download

memory/1912-141-0x00007FF72F350000-0x00007FF72F742000-memory.dmp

Download

memory/1912-6093-0x00007FF72F350000-0x00007FF72F742000-memory.dmp

Download

memory/1920-6111-0x00007FF65DE80000-0x00007FF65E272000-memory.dmp

Download

memory/1920-143-0x00007FF65DE80000-0x00007FF65E272000-memory.dmp

Download

memory/2036-6121-0x00007FF75E120000-0x00007FF75E512000-memory.dmp

Download

memory/2036-133-0x00007FF75E120000-0x00007FF75E512000-memory.dmp

Download

memory/2044-6123-0x00007FF6AEF30000-0x00007FF6AF322000-memory.dmp

Download

memory/2044-109-0x00007FF6AEF30000-0x00007FF6AF322000-memory.dmp

Download

memory/2312-6084-0x00007FF6BCAE0000-0x00007FF6BCED2000-memory.dmp

Download

memory/2312-36-0x00007FF6BCAE0000-0x00007FF6BCED2000-memory.dmp

Download

memory/2860-6129-0x00007FF7EFE80000-0x00007FF7F0272000-memory.dmp

Download

memory/2860-145-0x00007FF7EFE80000-0x00007FF7F0272000-memory.dmp

Download

memory/3156-6119-0x00007FF72ACB0000-0x00007FF72B0A2000-memory.dmp

Download

memory/3156-139-0x00007FF72ACB0000-0x00007FF72B0A2000-memory.dmp

Download

memory/3492-90-0x00007FF7F6400000-0x00007FF7F67F2000-memory.dmp

Download

memory/3492-6113-0x00007FF7F6400000-0x00007FF7F67F2000-memory.dmp

Download

memory/3584-101-0x00007FF620B90000-0x00007FF620F82000-memory.dmp

Download

memory/3584-6125-0x00007FF620B90000-0x00007FF620F82000-memory.dmp

Download

memory/3600-140-0x00007FF7F0A70000-0x00007FF7F0E62000-memory.dmp

Download

memory/3600-6090-0x00007FF7F0A70000-0x00007FF7F0E62000-memory.dmp

Download

memory/3808-138-0x00007FF76C3D0000-0x00007FF76C7C2000-memory.dmp

Download

memory/3808-6126-0x00007FF76C3D0000-0x00007FF76C7C2000-memory.dmp

Download

memory/4088-6107-0x00007FF600360000-0x00007FF600752000-memory.dmp

Download

memory/4088-119-0x00007FF600360000-0x00007FF600752000-memory.dmp

Download

memory/4168-137-0x00007FF6ED260000-0x00007FF6ED652000-memory.dmp

Download

memory/4168-6115-0x00007FF6ED260000-0x00007FF6ED652000-memory.dmp

Download

memory/4352-142-0x00007FF628630000-0x00007FF628A22000-memory.dmp

Download

memory/4352-6095-0x00007FF628630000-0x00007FF628A22000-memory.dmp

Download

memory/4416-146-0x00007FF6319F0000-0x00007FF631DE2000-memory.dmp

Download

memory/4416-6131-0x00007FF6319F0000-0x00007FF631DE2000-memory.dmp

Download

memory/4436-6103-0x00007FF7AD6E0000-0x00007FF7ADAD2000-memory.dmp

Download

memory/4436-144-0x00007FF7AD6E0000-0x00007FF7ADAD2000-memory.dmp

Download

memory/4528-134-0x00007FF66C770000-0x00007FF66CB62000-memory.dmp

Download

memory/4528-6101-0x00007FF66C770000-0x00007FF66CB62000-memory.dmp

Download

memory/4556-6105-0x00007FF65D5A0000-0x00007FF65D992000-memory.dmp

Download

memory/4556-125-0x00007FF65D5A0000-0x00007FF65D992000-memory.dmp

Download

memory/4868-6087-0x00007FF79E230000-0x00007FF79E622000-memory.dmp

Download

memory/4868-88-0x00007FF79E230000-0x00007FF79E622000-memory.dmp

Download

memory/4868-5420-0x00007FF79E230000-0x00007FF79E622000-memory.dmp

Download

memory/5112-110-0x00007FF753DC0000-0x00007FF7541B2000-memory.dmp

Download

memory/5112-6109-0x00007FF753DC0000-0x00007FF7541B2000-memory.dmp

Download