xmrig | 39fb045f6ea2a7398c55a3c1c9b230a5fb2a925735dceb5b887504e587c664f4

Analysis

max time kernel
150s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
01-07-2024 05:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

39fb045f6ea2a7398c55a3c1c9b230a5fb2a925735dceb5b887504e587c664f4_NeikiAnalytics.exe
Size

1.9MB
MD5

add1afc67903e7b5e9a1eae3126bd180
SHA1

28eae62ca982656c18c7cf8ceff4b3c37420e30b
SHA256

39fb045f6ea2a7398c55a3c1c9b230a5fb2a925735dceb5b887504e587c664f4
SHA512

76ff57205f38ef5dfe6f0fa70b970646eea93df94fe3300177d4e7c2f50a54a063a0510e7707c970031a6328ea6387978f1f840cdb78cff484d3b4a8ddb9bc1f
SSDEEP

24576:zv3/fTLF671TilQFG4P5PMkFfkeMlN675EgEPgsU5qTqOk0t2MPnt4Jh/eFVHf+M:Lz071uv4BPMkFfdg6NsTt2MPTHfbhZ

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 41 IoCs

miner

resource	yara_rule
behavioral2/memory/2356-25-0x00007FF764580000-0x00007FF764972000-memory.dmp	xmrig
behavioral2/memory/4152-13-0x00007FF7E87D0000-0x00007FF7E8BC2000-memory.dmp	xmrig
behavioral2/memory/3976-237-0x00007FF648B80000-0x00007FF648F72000-memory.dmp	xmrig
behavioral2/memory/4028-250-0x00007FF7BFBB0000-0x00007FF7BFFA2000-memory.dmp	xmrig
behavioral2/memory/3232-278-0x00007FF776890000-0x00007FF776C82000-memory.dmp	xmrig
behavioral2/memory/5088-308-0x00007FF74ACE0000-0x00007FF74B0D2000-memory.dmp	xmrig
behavioral2/memory/1844-323-0x00007FF794630000-0x00007FF794A22000-memory.dmp	xmrig
behavioral2/memory/4560-333-0x00007FF7B03F0000-0x00007FF7B07E2000-memory.dmp	xmrig
behavioral2/memory/744-336-0x00007FF678A50000-0x00007FF678E42000-memory.dmp	xmrig
behavioral2/memory/1876-335-0x00007FF70FF90000-0x00007FF710382000-memory.dmp	xmrig
behavioral2/memory/3308-332-0x00007FF6238D0000-0x00007FF623CC2000-memory.dmp	xmrig
behavioral2/memory/1100-322-0x00007FF71FF80000-0x00007FF720372000-memory.dmp	xmrig
behavioral2/memory/1108-312-0x00007FF6B21A0000-0x00007FF6B2592000-memory.dmp	xmrig
behavioral2/memory/236-311-0x00007FF6A8040000-0x00007FF6A8432000-memory.dmp	xmrig
behavioral2/memory/2876-277-0x00007FF790940000-0x00007FF790D32000-memory.dmp	xmrig
behavioral2/memory/1920-216-0x00007FF763960000-0x00007FF763D52000-memory.dmp	xmrig
behavioral2/memory/4076-159-0x00007FF747B20000-0x00007FF747F12000-memory.dmp	xmrig
behavioral2/memory/1720-154-0x00007FF78A8B0000-0x00007FF78ACA2000-memory.dmp	xmrig
behavioral2/memory/3460-138-0x00007FF6604F0000-0x00007FF6608E2000-memory.dmp	xmrig
behavioral2/memory/1008-119-0x00007FF6E6CD0000-0x00007FF6E70C2000-memory.dmp	xmrig
behavioral2/memory/4504-115-0x00007FF77FAE0000-0x00007FF77FED2000-memory.dmp	xmrig
behavioral2/memory/1568-3809-0x00007FF70C740000-0x00007FF70CB32000-memory.dmp	xmrig
behavioral2/memory/3308-3815-0x00007FF6238D0000-0x00007FF623CC2000-memory.dmp	xmrig
behavioral2/memory/1008-3823-0x00007FF6E6CD0000-0x00007FF6E70C2000-memory.dmp	xmrig
behavioral2/memory/4504-3819-0x00007FF77FAE0000-0x00007FF77FED2000-memory.dmp	xmrig
behavioral2/memory/1720-3872-0x00007FF78A8B0000-0x00007FF78ACA2000-memory.dmp	xmrig
behavioral2/memory/1108-3976-0x00007FF6B21A0000-0x00007FF6B2592000-memory.dmp	xmrig
behavioral2/memory/1100-3963-0x00007FF71FF80000-0x00007FF720372000-memory.dmp	xmrig
behavioral2/memory/236-3925-0x00007FF6A8040000-0x00007FF6A8432000-memory.dmp	xmrig
behavioral2/memory/5088-3920-0x00007FF74ACE0000-0x00007FF74B0D2000-memory.dmp	xmrig
behavioral2/memory/744-3918-0x00007FF678A50000-0x00007FF678E42000-memory.dmp	xmrig
behavioral2/memory/1876-3907-0x00007FF70FF90000-0x00007FF710382000-memory.dmp	xmrig
behavioral2/memory/3976-3892-0x00007FF648B80000-0x00007FF648F72000-memory.dmp	xmrig
behavioral2/memory/2876-3899-0x00007FF790940000-0x00007FF790D32000-memory.dmp	xmrig
behavioral2/memory/4028-3896-0x00007FF7BFBB0000-0x00007FF7BFFA2000-memory.dmp	xmrig
behavioral2/memory/4076-3884-0x00007FF747B20000-0x00007FF747F12000-memory.dmp	xmrig
behavioral2/memory/3232-3881-0x00007FF776890000-0x00007FF776C82000-memory.dmp	xmrig
behavioral2/memory/1920-3862-0x00007FF763960000-0x00007FF763D52000-memory.dmp	xmrig
behavioral2/memory/4560-3850-0x00007FF7B03F0000-0x00007FF7B07E2000-memory.dmp	xmrig
behavioral2/memory/1428-3835-0x00007FF7B7F90000-0x00007FF7B8382000-memory.dmp	xmrig
behavioral2/memory/3460-3833-0x00007FF6604F0000-0x00007FF6608E2000-memory.dmp	xmrig

Blocklisted process makes network request 11 IoCs

flow	pid	Process
10	2620	powershell.exe
12	2620	powershell.exe
14	2620	powershell.exe
15	2620	powershell.exe
17	2620	powershell.exe
21	2620	powershell.exe
22	2620	powershell.exe
23	2620	powershell.exe
24	2620	powershell.exe
25	2620	powershell.exe
26	2620	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
2620	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
4152	PSfWWxh.exe
2356	zHXEkDy.exe
1844	NAGJPRo.exe
4952	PgZMTsC.exe
1568	LjZxhih.exe
1428	ItdiEvO.exe
3308	AsVdkXA.exe
4504	bDyoUPO.exe
1008	RbjCvID.exe
3460	JTmSWYW.exe
4560	OwJfqHt.exe
1720	gEClFWq.exe
4076	dlzPeTr.exe
1920	qsANyIj.exe
3976	xqWKWhM.exe
1876	JsHbvLH.exe
4028	yJLyDnR.exe
2876	ELRRuMQ.exe
3232	grhfnBs.exe
744	aiNeCTP.exe
5088	iLvzsek.exe
236	eTOgKME.exe
1108	fRQhPPU.exe
1100	xJSRcXE.exe
3776	PybsEur.exe
4256	GCrybEG.exe
3368	pFUFrYn.exe
1412	qnYGCCM.exe
1160	NnTaoMZ.exe
4300	veWjQaK.exe
3184	UVSQEuy.exe
5040	XxCJoFS.exe
4404	pfHiQCx.exe
3352	GbYXlYd.exe
1776	cXyhZjr.exe
3564	DOpiBca.exe
5084	PLfpBrc.exe
2996	AwAqrcd.exe
1604	cllooUu.exe
4388	rHpnvJV.exe
1592	cSYyMXg.exe
1236	kiPExpu.exe
3108	NcIWTJA.exe
1952	yjcWGeZ.exe
3952	bEPanbK.exe
3984	tPUSoXO.exe
816	QNQoZEn.exe
5108	MOECOUz.exe
3220	TEAnzvp.exe
3944	PAtEjiN.exe
3544	fmFHmsz.exe
5136	sOuCdaZ.exe
5152	UzISoUE.exe
5168	jGmlIgi.exe
700	zibNZYe.exe
5192	UrlauHV.exe
5212	VGfEOIX.exe
5272	axFoINw.exe
5300	xmJNZQI.exe
5316	HwdnOrG.exe
5340	rYnDdJN.exe
5364	RvPHAtQ.exe
5388	jpNEDAy.exe
5544	xpaYWLq.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1928-0-0x00007FF7CF790000-0x00007FF7CFB82000-memory.dmp	upx
behavioral2/files/0x000700000002369a-8.dat	upx
behavioral2/memory/2356-25-0x00007FF764580000-0x00007FF764972000-memory.dmp	upx
behavioral2/files/0x000700000002369c-21.dat	upx
behavioral2/files/0x000700000002369b-20.dat	upx
behavioral2/memory/4152-13-0x00007FF7E87D0000-0x00007FF7E8BC2000-memory.dmp	upx
behavioral2/files/0x00070000000236a6-74.dat	upx
behavioral2/files/0x00070000000236a3-91.dat	upx
behavioral2/files/0x00070000000236ba-202.dat	upx
behavioral2/files/0x00070000000236bb-206.dat	upx
behavioral2/memory/3976-237-0x00007FF648B80000-0x00007FF648F72000-memory.dmp	upx
behavioral2/memory/4028-250-0x00007FF7BFBB0000-0x00007FF7BFFA2000-memory.dmp	upx
behavioral2/memory/3232-278-0x00007FF776890000-0x00007FF776C82000-memory.dmp	upx
behavioral2/memory/5088-308-0x00007FF74ACE0000-0x00007FF74B0D2000-memory.dmp	upx
behavioral2/memory/1844-323-0x00007FF794630000-0x00007FF794A22000-memory.dmp	upx
behavioral2/memory/4560-333-0x00007FF7B03F0000-0x00007FF7B07E2000-memory.dmp	upx
behavioral2/memory/744-336-0x00007FF678A50000-0x00007FF678E42000-memory.dmp	upx
behavioral2/memory/1876-335-0x00007FF70FF90000-0x00007FF710382000-memory.dmp	upx
behavioral2/memory/3308-332-0x00007FF6238D0000-0x00007FF623CC2000-memory.dmp	upx
behavioral2/memory/1100-322-0x00007FF71FF80000-0x00007FF720372000-memory.dmp	upx
behavioral2/memory/1108-312-0x00007FF6B21A0000-0x00007FF6B2592000-memory.dmp	upx
behavioral2/memory/236-311-0x00007FF6A8040000-0x00007FF6A8432000-memory.dmp	upx
behavioral2/memory/2876-277-0x00007FF790940000-0x00007FF790D32000-memory.dmp	upx
behavioral2/memory/1920-216-0x00007FF763960000-0x00007FF763D52000-memory.dmp	upx
behavioral2/files/0x00070000000236b4-196.dat	upx
behavioral2/files/0x00070000000236b3-188.dat	upx
behavioral2/files/0x00070000000236b1-185.dat	upx
behavioral2/files/0x00070000000236af-184.dat	upx
behavioral2/files/0x00070000000236ae-180.dat	upx
behavioral2/files/0x00070000000236ad-176.dat	upx
behavioral2/files/0x00070000000236ac-173.dat	upx
behavioral2/files/0x00070000000236ab-169.dat	upx
behavioral2/files/0x00070000000236b9-162.dat	upx
behavioral2/memory/4076-159-0x00007FF747B20000-0x00007FF747F12000-memory.dmp	upx
behavioral2/memory/1720-154-0x00007FF78A8B0000-0x00007FF78ACA2000-memory.dmp	upx
behavioral2/files/0x00070000000236b5-192.dat	upx
behavioral2/files/0x00070000000236a9-148.dat	upx
behavioral2/files/0x00070000000236b8-147.dat	upx
behavioral2/files/0x00070000000236b7-146.dat	upx
behavioral2/files/0x00070000000236a8-144.dat	upx
behavioral2/files/0x00070000000236b6-139.dat	upx
behavioral2/memory/3460-138-0x00007FF6604F0000-0x00007FF6608E2000-memory.dmp	upx
behavioral2/files/0x00070000000236b2-134.dat	upx
behavioral2/files/0x00070000000236b0-132.dat	upx
behavioral2/memory/1008-119-0x00007FF6E6CD0000-0x00007FF6E70C2000-memory.dmp	upx
behavioral2/files/0x00070000000236a5-118.dat	upx
behavioral2/memory/4504-115-0x00007FF77FAE0000-0x00007FF77FED2000-memory.dmp	upx
behavioral2/files/0x00070000000236a7-140.dat	upx
behavioral2/files/0x00070000000236a4-109.dat	upx
behavioral2/files/0x00070000000236aa-105.dat	upx
behavioral2/files/0x00070000000236a2-83.dat	upx
behavioral2/memory/1428-77-0x00007FF7B7F90000-0x00007FF7B8382000-memory.dmp	upx
behavioral2/files/0x00070000000236a1-68.dat	upx
behavioral2/files/0x00070000000236a0-65.dat	upx
behavioral2/files/0x000700000002369f-63.dat	upx
behavioral2/files/0x000700000002369d-60.dat	upx
behavioral2/memory/1568-55-0x00007FF70C740000-0x00007FF70CB32000-memory.dmp	upx
behavioral2/files/0x000700000002369e-58.dat	upx
behavioral2/memory/4952-36-0x00007FF6D0CE0000-0x00007FF6D10D2000-memory.dmp	upx
behavioral2/files/0x0007000000023699-12.dat	upx
behavioral2/files/0x0008000000023695-6.dat	upx
behavioral2/memory/1568-3809-0x00007FF70C740000-0x00007FF70CB32000-memory.dmp	upx
behavioral2/memory/3308-3815-0x00007FF6238D0000-0x00007FF623CC2000-memory.dmp	upx
behavioral2/memory/1008-3823-0x00007FF6E6CD0000-0x00007FF6E70C2000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
9	raw.githubusercontent.com
10	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\wLNWTyM.exe	39fb045f6ea2a7398c55a3c1c9b230a5fb2a925735dceb5b887504e587c664f4_NeikiAnalytics.exe
File created	C:\Windows\System\tvCkpFX.exe	39fb045f6ea2a7398c55a3c1c9b230a5fb2a925735dceb5b887504e587c664f4_NeikiAnalytics.exe
File created	C:\Windows\System\NDNOUJI.exe	39fb045f6ea2a7398c55a3c1c9b230a5fb2a925735dceb5b887504e587c664f4_NeikiAnalytics.exe
File created	C:\Windows\System\YOXISOc.exe	39fb045f6ea2a7398c55a3c1c9b230a5fb2a925735dceb5b887504e587c664f4_NeikiAnalytics.exe
File created	C:\Windows\System\TNeFPmA.exe	39fb045f6ea2a7398c55a3c1c9b230a5fb2a925735dceb5b887504e587c664f4_NeikiAnalytics.exe
File created	C:\Windows\System\tnfodDk.exe	39fb045f6ea2a7398c55a3c1c9b230a5fb2a925735dceb5b887504e587c664f4_NeikiAnalytics.exe
File created	C:\Windows\System\qXxiPwD.exe	39fb045f6ea2a7398c55a3c1c9b230a5fb2a925735dceb5b887504e587c664f4_NeikiAnalytics.exe
File created	C:\Windows\System\MVNZTlA.exe	39fb045f6ea2a7398c55a3c1c9b230a5fb2a925735dceb5b887504e587c664f4_NeikiAnalytics.exe
File created	C:\Windows\System\VgLfhzb.exe	39fb045f6ea2a7398c55a3c1c9b230a5fb2a925735dceb5b887504e587c664f4_NeikiAnalytics.exe
File created	C:\Windows\System\cIThiLe.exe	39fb045f6ea2a7398c55a3c1c9b230a5fb2a925735dceb5b887504e587c664f4_NeikiAnalytics.exe
File created	C:\Windows\System\cyegJoU.exe	39fb045f6ea2a7398c55a3c1c9b230a5fb2a925735dceb5b887504e587c664f4_NeikiAnalytics.exe
File created	C:\Windows\System\bCkInzI.exe	39fb045f6ea2a7398c55a3c1c9b230a5fb2a925735dceb5b887504e587c664f4_NeikiAnalytics.exe
File created	C:\Windows\System\MZpOWpF.exe	39fb045f6ea2a7398c55a3c1c9b230a5fb2a925735dceb5b887504e587c664f4_NeikiAnalytics.exe
File created	C:\Windows\System\NWJnAPl.exe	39fb045f6ea2a7398c55a3c1c9b230a5fb2a925735dceb5b887504e587c664f4_NeikiAnalytics.exe
File created	C:\Windows\System\heoUMir.exe	39fb045f6ea2a7398c55a3c1c9b230a5fb2a925735dceb5b887504e587c664f4_NeikiAnalytics.exe
File created	C:\Windows\System\hkuElpA.exe	39fb045f6ea2a7398c55a3c1c9b230a5fb2a925735dceb5b887504e587c664f4_NeikiAnalytics.exe
File created	C:\Windows\System\axRvJyF.exe	39fb045f6ea2a7398c55a3c1c9b230a5fb2a925735dceb5b887504e587c664f4_NeikiAnalytics.exe
File created	C:\Windows\System\KmbkhYu.exe	39fb045f6ea2a7398c55a3c1c9b230a5fb2a925735dceb5b887504e587c664f4_NeikiAnalytics.exe
File created	C:\Windows\System\MAzLAvH.exe	39fb045f6ea2a7398c55a3c1c9b230a5fb2a925735dceb5b887504e587c664f4_NeikiAnalytics.exe
File created	C:\Windows\System\vemIxnG.exe	39fb045f6ea2a7398c55a3c1c9b230a5fb2a925735dceb5b887504e587c664f4_NeikiAnalytics.exe
File created	C:\Windows\System\ZartMie.exe	39fb045f6ea2a7398c55a3c1c9b230a5fb2a925735dceb5b887504e587c664f4_NeikiAnalytics.exe
File created	C:\Windows\System\jIpnbbp.exe	39fb045f6ea2a7398c55a3c1c9b230a5fb2a925735dceb5b887504e587c664f4_NeikiAnalytics.exe
File created	C:\Windows\System\zHDXhZU.exe	39fb045f6ea2a7398c55a3c1c9b230a5fb2a925735dceb5b887504e587c664f4_NeikiAnalytics.exe
File created	C:\Windows\System\DqBheHD.exe	39fb045f6ea2a7398c55a3c1c9b230a5fb2a925735dceb5b887504e587c664f4_NeikiAnalytics.exe
File created	C:\Windows\System\cCbLHmq.exe	39fb045f6ea2a7398c55a3c1c9b230a5fb2a925735dceb5b887504e587c664f4_NeikiAnalytics.exe
File created	C:\Windows\System\IAJmELN.exe	39fb045f6ea2a7398c55a3c1c9b230a5fb2a925735dceb5b887504e587c664f4_NeikiAnalytics.exe
File created	C:\Windows\System\HMAzDgn.exe	39fb045f6ea2a7398c55a3c1c9b230a5fb2a925735dceb5b887504e587c664f4_NeikiAnalytics.exe
File created	C:\Windows\System\oeikSOF.exe	39fb045f6ea2a7398c55a3c1c9b230a5fb2a925735dceb5b887504e587c664f4_NeikiAnalytics.exe
File created	C:\Windows\System\STKSqUf.exe	39fb045f6ea2a7398c55a3c1c9b230a5fb2a925735dceb5b887504e587c664f4_NeikiAnalytics.exe
File created	C:\Windows\System\vtAXzJj.exe	39fb045f6ea2a7398c55a3c1c9b230a5fb2a925735dceb5b887504e587c664f4_NeikiAnalytics.exe
File created	C:\Windows\System\RFlhJgG.exe	39fb045f6ea2a7398c55a3c1c9b230a5fb2a925735dceb5b887504e587c664f4_NeikiAnalytics.exe
File created	C:\Windows\System\JNeNhOv.exe	39fb045f6ea2a7398c55a3c1c9b230a5fb2a925735dceb5b887504e587c664f4_NeikiAnalytics.exe
File created	C:\Windows\System\yreqIZF.exe	39fb045f6ea2a7398c55a3c1c9b230a5fb2a925735dceb5b887504e587c664f4_NeikiAnalytics.exe
File created	C:\Windows\System\ANyxOWM.exe	39fb045f6ea2a7398c55a3c1c9b230a5fb2a925735dceb5b887504e587c664f4_NeikiAnalytics.exe
File created	C:\Windows\System\NnlLZdd.exe	39fb045f6ea2a7398c55a3c1c9b230a5fb2a925735dceb5b887504e587c664f4_NeikiAnalytics.exe
File created	C:\Windows\System\dohKbby.exe	39fb045f6ea2a7398c55a3c1c9b230a5fb2a925735dceb5b887504e587c664f4_NeikiAnalytics.exe
File created	C:\Windows\System\ODpjYzp.exe	39fb045f6ea2a7398c55a3c1c9b230a5fb2a925735dceb5b887504e587c664f4_NeikiAnalytics.exe
File created	C:\Windows\System\hIXUEqP.exe	39fb045f6ea2a7398c55a3c1c9b230a5fb2a925735dceb5b887504e587c664f4_NeikiAnalytics.exe
File created	C:\Windows\System\NAjzMlr.exe	39fb045f6ea2a7398c55a3c1c9b230a5fb2a925735dceb5b887504e587c664f4_NeikiAnalytics.exe
File created	C:\Windows\System\kghcahy.exe	39fb045f6ea2a7398c55a3c1c9b230a5fb2a925735dceb5b887504e587c664f4_NeikiAnalytics.exe
File created	C:\Windows\System\Mftypfb.exe	39fb045f6ea2a7398c55a3c1c9b230a5fb2a925735dceb5b887504e587c664f4_NeikiAnalytics.exe
File created	C:\Windows\System\jFMHIKL.exe	39fb045f6ea2a7398c55a3c1c9b230a5fb2a925735dceb5b887504e587c664f4_NeikiAnalytics.exe
File created	C:\Windows\System\RFYdRuo.exe	39fb045f6ea2a7398c55a3c1c9b230a5fb2a925735dceb5b887504e587c664f4_NeikiAnalytics.exe
File created	C:\Windows\System\alwSJZz.exe	39fb045f6ea2a7398c55a3c1c9b230a5fb2a925735dceb5b887504e587c664f4_NeikiAnalytics.exe
File created	C:\Windows\System\cZLszmh.exe	39fb045f6ea2a7398c55a3c1c9b230a5fb2a925735dceb5b887504e587c664f4_NeikiAnalytics.exe
File created	C:\Windows\System\vnIzfSF.exe	39fb045f6ea2a7398c55a3c1c9b230a5fb2a925735dceb5b887504e587c664f4_NeikiAnalytics.exe
File created	C:\Windows\System\SiPqCjY.exe	39fb045f6ea2a7398c55a3c1c9b230a5fb2a925735dceb5b887504e587c664f4_NeikiAnalytics.exe
File created	C:\Windows\System\nYdoQGv.exe	39fb045f6ea2a7398c55a3c1c9b230a5fb2a925735dceb5b887504e587c664f4_NeikiAnalytics.exe
File created	C:\Windows\System\rustQcA.exe	39fb045f6ea2a7398c55a3c1c9b230a5fb2a925735dceb5b887504e587c664f4_NeikiAnalytics.exe
File created	C:\Windows\System\uqFVgJT.exe	39fb045f6ea2a7398c55a3c1c9b230a5fb2a925735dceb5b887504e587c664f4_NeikiAnalytics.exe
File created	C:\Windows\System\YyiMuaI.exe	39fb045f6ea2a7398c55a3c1c9b230a5fb2a925735dceb5b887504e587c664f4_NeikiAnalytics.exe
File created	C:\Windows\System\abLpcwB.exe	39fb045f6ea2a7398c55a3c1c9b230a5fb2a925735dceb5b887504e587c664f4_NeikiAnalytics.exe
File created	C:\Windows\System\vpYGSQb.exe	39fb045f6ea2a7398c55a3c1c9b230a5fb2a925735dceb5b887504e587c664f4_NeikiAnalytics.exe
File created	C:\Windows\System\nJUXqdP.exe	39fb045f6ea2a7398c55a3c1c9b230a5fb2a925735dceb5b887504e587c664f4_NeikiAnalytics.exe
File created	C:\Windows\System\pMFrBSA.exe	39fb045f6ea2a7398c55a3c1c9b230a5fb2a925735dceb5b887504e587c664f4_NeikiAnalytics.exe
File created	C:\Windows\System\vabgEVm.exe	39fb045f6ea2a7398c55a3c1c9b230a5fb2a925735dceb5b887504e587c664f4_NeikiAnalytics.exe
File created	C:\Windows\System\marnDOk.exe	39fb045f6ea2a7398c55a3c1c9b230a5fb2a925735dceb5b887504e587c664f4_NeikiAnalytics.exe
File created	C:\Windows\System\KTjHgQR.exe	39fb045f6ea2a7398c55a3c1c9b230a5fb2a925735dceb5b887504e587c664f4_NeikiAnalytics.exe
File created	C:\Windows\System\jmPsemU.exe	39fb045f6ea2a7398c55a3c1c9b230a5fb2a925735dceb5b887504e587c664f4_NeikiAnalytics.exe
File created	C:\Windows\System\BxpQpWo.exe	39fb045f6ea2a7398c55a3c1c9b230a5fb2a925735dceb5b887504e587c664f4_NeikiAnalytics.exe
File created	C:\Windows\System\QQnKstF.exe	39fb045f6ea2a7398c55a3c1c9b230a5fb2a925735dceb5b887504e587c664f4_NeikiAnalytics.exe
File created	C:\Windows\System\dKTMkWr.exe	39fb045f6ea2a7398c55a3c1c9b230a5fb2a925735dceb5b887504e587c664f4_NeikiAnalytics.exe
File created	C:\Windows\System\pSsIVDy.exe	39fb045f6ea2a7398c55a3c1c9b230a5fb2a925735dceb5b887504e587c664f4_NeikiAnalytics.exe
File created	C:\Windows\System\YioemqY.exe	39fb045f6ea2a7398c55a3c1c9b230a5fb2a925735dceb5b887504e587c664f4_NeikiAnalytics.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
2620	powershell.exe
2620	powershell.exe
2620	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	1928	39fb045f6ea2a7398c55a3c1c9b230a5fb2a925735dceb5b887504e587c664f4_NeikiAnalytics.exe
Token: SeLockMemoryPrivilege	1928	39fb045f6ea2a7398c55a3c1c9b230a5fb2a925735dceb5b887504e587c664f4_NeikiAnalytics.exe
Token: SeDebugPrivilege	2620	powershell.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
13236	sihost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1928 wrote to memory of 2620	1928	39fb045f6ea2a7398c55a3c1c9b230a5fb2a925735dceb5b887504e587c664f4_NeikiAnalytics.exe	91
PID 1928 wrote to memory of 2620	1928	39fb045f6ea2a7398c55a3c1c9b230a5fb2a925735dceb5b887504e587c664f4_NeikiAnalytics.exe	91
PID 1928 wrote to memory of 4152	1928	39fb045f6ea2a7398c55a3c1c9b230a5fb2a925735dceb5b887504e587c664f4_NeikiAnalytics.exe	92
PID 1928 wrote to memory of 4152	1928	39fb045f6ea2a7398c55a3c1c9b230a5fb2a925735dceb5b887504e587c664f4_NeikiAnalytics.exe	92
PID 1928 wrote to memory of 2356	1928	39fb045f6ea2a7398c55a3c1c9b230a5fb2a925735dceb5b887504e587c664f4_NeikiAnalytics.exe	93
PID 1928 wrote to memory of 2356	1928	39fb045f6ea2a7398c55a3c1c9b230a5fb2a925735dceb5b887504e587c664f4_NeikiAnalytics.exe	93
PID 1928 wrote to memory of 1844	1928	39fb045f6ea2a7398c55a3c1c9b230a5fb2a925735dceb5b887504e587c664f4_NeikiAnalytics.exe	94
PID 1928 wrote to memory of 1844	1928	39fb045f6ea2a7398c55a3c1c9b230a5fb2a925735dceb5b887504e587c664f4_NeikiAnalytics.exe	94
PID 1928 wrote to memory of 4952	1928	39fb045f6ea2a7398c55a3c1c9b230a5fb2a925735dceb5b887504e587c664f4_NeikiAnalytics.exe	95
PID 1928 wrote to memory of 4952	1928	39fb045f6ea2a7398c55a3c1c9b230a5fb2a925735dceb5b887504e587c664f4_NeikiAnalytics.exe	95
PID 1928 wrote to memory of 1568	1928	39fb045f6ea2a7398c55a3c1c9b230a5fb2a925735dceb5b887504e587c664f4_NeikiAnalytics.exe	96
PID 1928 wrote to memory of 1568	1928	39fb045f6ea2a7398c55a3c1c9b230a5fb2a925735dceb5b887504e587c664f4_NeikiAnalytics.exe	96
PID 1928 wrote to memory of 1428	1928	39fb045f6ea2a7398c55a3c1c9b230a5fb2a925735dceb5b887504e587c664f4_NeikiAnalytics.exe	97
PID 1928 wrote to memory of 1428	1928	39fb045f6ea2a7398c55a3c1c9b230a5fb2a925735dceb5b887504e587c664f4_NeikiAnalytics.exe	97
PID 1928 wrote to memory of 3308	1928	39fb045f6ea2a7398c55a3c1c9b230a5fb2a925735dceb5b887504e587c664f4_NeikiAnalytics.exe	98
PID 1928 wrote to memory of 3308	1928	39fb045f6ea2a7398c55a3c1c9b230a5fb2a925735dceb5b887504e587c664f4_NeikiAnalytics.exe	98
PID 1928 wrote to memory of 4504	1928	39fb045f6ea2a7398c55a3c1c9b230a5fb2a925735dceb5b887504e587c664f4_NeikiAnalytics.exe	99
PID 1928 wrote to memory of 4504	1928	39fb045f6ea2a7398c55a3c1c9b230a5fb2a925735dceb5b887504e587c664f4_NeikiAnalytics.exe	99
PID 1928 wrote to memory of 1008	1928	39fb045f6ea2a7398c55a3c1c9b230a5fb2a925735dceb5b887504e587c664f4_NeikiAnalytics.exe	100
PID 1928 wrote to memory of 1008	1928	39fb045f6ea2a7398c55a3c1c9b230a5fb2a925735dceb5b887504e587c664f4_NeikiAnalytics.exe	100
PID 1928 wrote to memory of 3460	1928	39fb045f6ea2a7398c55a3c1c9b230a5fb2a925735dceb5b887504e587c664f4_NeikiAnalytics.exe	101
PID 1928 wrote to memory of 3460	1928	39fb045f6ea2a7398c55a3c1c9b230a5fb2a925735dceb5b887504e587c664f4_NeikiAnalytics.exe	101
PID 1928 wrote to memory of 4560	1928	39fb045f6ea2a7398c55a3c1c9b230a5fb2a925735dceb5b887504e587c664f4_NeikiAnalytics.exe	102
PID 1928 wrote to memory of 4560	1928	39fb045f6ea2a7398c55a3c1c9b230a5fb2a925735dceb5b887504e587c664f4_NeikiAnalytics.exe	102
PID 1928 wrote to memory of 1920	1928	39fb045f6ea2a7398c55a3c1c9b230a5fb2a925735dceb5b887504e587c664f4_NeikiAnalytics.exe	103
PID 1928 wrote to memory of 1920	1928	39fb045f6ea2a7398c55a3c1c9b230a5fb2a925735dceb5b887504e587c664f4_NeikiAnalytics.exe	103
PID 1928 wrote to memory of 1720	1928	39fb045f6ea2a7398c55a3c1c9b230a5fb2a925735dceb5b887504e587c664f4_NeikiAnalytics.exe	104
PID 1928 wrote to memory of 1720	1928	39fb045f6ea2a7398c55a3c1c9b230a5fb2a925735dceb5b887504e587c664f4_NeikiAnalytics.exe	104
PID 1928 wrote to memory of 4076	1928	39fb045f6ea2a7398c55a3c1c9b230a5fb2a925735dceb5b887504e587c664f4_NeikiAnalytics.exe	105
PID 1928 wrote to memory of 4076	1928	39fb045f6ea2a7398c55a3c1c9b230a5fb2a925735dceb5b887504e587c664f4_NeikiAnalytics.exe	105
PID 1928 wrote to memory of 3976	1928	39fb045f6ea2a7398c55a3c1c9b230a5fb2a925735dceb5b887504e587c664f4_NeikiAnalytics.exe	106
PID 1928 wrote to memory of 3976	1928	39fb045f6ea2a7398c55a3c1c9b230a5fb2a925735dceb5b887504e587c664f4_NeikiAnalytics.exe	106
PID 1928 wrote to memory of 1876	1928	39fb045f6ea2a7398c55a3c1c9b230a5fb2a925735dceb5b887504e587c664f4_NeikiAnalytics.exe	107
PID 1928 wrote to memory of 1876	1928	39fb045f6ea2a7398c55a3c1c9b230a5fb2a925735dceb5b887504e587c664f4_NeikiAnalytics.exe	107
PID 1928 wrote to memory of 4028	1928	39fb045f6ea2a7398c55a3c1c9b230a5fb2a925735dceb5b887504e587c664f4_NeikiAnalytics.exe	108
PID 1928 wrote to memory of 4028	1928	39fb045f6ea2a7398c55a3c1c9b230a5fb2a925735dceb5b887504e587c664f4_NeikiAnalytics.exe	108
PID 1928 wrote to memory of 2876	1928	39fb045f6ea2a7398c55a3c1c9b230a5fb2a925735dceb5b887504e587c664f4_NeikiAnalytics.exe	109
PID 1928 wrote to memory of 2876	1928	39fb045f6ea2a7398c55a3c1c9b230a5fb2a925735dceb5b887504e587c664f4_NeikiAnalytics.exe	109
PID 1928 wrote to memory of 3232	1928	39fb045f6ea2a7398c55a3c1c9b230a5fb2a925735dceb5b887504e587c664f4_NeikiAnalytics.exe	110
PID 1928 wrote to memory of 3232	1928	39fb045f6ea2a7398c55a3c1c9b230a5fb2a925735dceb5b887504e587c664f4_NeikiAnalytics.exe	110
PID 1928 wrote to memory of 744	1928	39fb045f6ea2a7398c55a3c1c9b230a5fb2a925735dceb5b887504e587c664f4_NeikiAnalytics.exe	111
PID 1928 wrote to memory of 744	1928	39fb045f6ea2a7398c55a3c1c9b230a5fb2a925735dceb5b887504e587c664f4_NeikiAnalytics.exe	111
PID 1928 wrote to memory of 5088	1928	39fb045f6ea2a7398c55a3c1c9b230a5fb2a925735dceb5b887504e587c664f4_NeikiAnalytics.exe	112
PID 1928 wrote to memory of 5088	1928	39fb045f6ea2a7398c55a3c1c9b230a5fb2a925735dceb5b887504e587c664f4_NeikiAnalytics.exe	112
PID 1928 wrote to memory of 236	1928	39fb045f6ea2a7398c55a3c1c9b230a5fb2a925735dceb5b887504e587c664f4_NeikiAnalytics.exe	113
PID 1928 wrote to memory of 236	1928	39fb045f6ea2a7398c55a3c1c9b230a5fb2a925735dceb5b887504e587c664f4_NeikiAnalytics.exe	113
PID 1928 wrote to memory of 1108	1928	39fb045f6ea2a7398c55a3c1c9b230a5fb2a925735dceb5b887504e587c664f4_NeikiAnalytics.exe	114
PID 1928 wrote to memory of 1108	1928	39fb045f6ea2a7398c55a3c1c9b230a5fb2a925735dceb5b887504e587c664f4_NeikiAnalytics.exe	114
PID 1928 wrote to memory of 1100	1928	39fb045f6ea2a7398c55a3c1c9b230a5fb2a925735dceb5b887504e587c664f4_NeikiAnalytics.exe	115
PID 1928 wrote to memory of 1100	1928	39fb045f6ea2a7398c55a3c1c9b230a5fb2a925735dceb5b887504e587c664f4_NeikiAnalytics.exe	115
PID 1928 wrote to memory of 3776	1928	39fb045f6ea2a7398c55a3c1c9b230a5fb2a925735dceb5b887504e587c664f4_NeikiAnalytics.exe	116
PID 1928 wrote to memory of 3776	1928	39fb045f6ea2a7398c55a3c1c9b230a5fb2a925735dceb5b887504e587c664f4_NeikiAnalytics.exe	116
PID 1928 wrote to memory of 4256	1928	39fb045f6ea2a7398c55a3c1c9b230a5fb2a925735dceb5b887504e587c664f4_NeikiAnalytics.exe	117
PID 1928 wrote to memory of 4256	1928	39fb045f6ea2a7398c55a3c1c9b230a5fb2a925735dceb5b887504e587c664f4_NeikiAnalytics.exe	117
PID 1928 wrote to memory of 3368	1928	39fb045f6ea2a7398c55a3c1c9b230a5fb2a925735dceb5b887504e587c664f4_NeikiAnalytics.exe	118
PID 1928 wrote to memory of 3368	1928	39fb045f6ea2a7398c55a3c1c9b230a5fb2a925735dceb5b887504e587c664f4_NeikiAnalytics.exe	118
PID 1928 wrote to memory of 1412	1928	39fb045f6ea2a7398c55a3c1c9b230a5fb2a925735dceb5b887504e587c664f4_NeikiAnalytics.exe	119
PID 1928 wrote to memory of 1412	1928	39fb045f6ea2a7398c55a3c1c9b230a5fb2a925735dceb5b887504e587c664f4_NeikiAnalytics.exe	119
PID 1928 wrote to memory of 1160	1928	39fb045f6ea2a7398c55a3c1c9b230a5fb2a925735dceb5b887504e587c664f4_NeikiAnalytics.exe	120
PID 1928 wrote to memory of 1160	1928	39fb045f6ea2a7398c55a3c1c9b230a5fb2a925735dceb5b887504e587c664f4_NeikiAnalytics.exe	120
PID 1928 wrote to memory of 4300	1928	39fb045f6ea2a7398c55a3c1c9b230a5fb2a925735dceb5b887504e587c664f4_NeikiAnalytics.exe	121
PID 1928 wrote to memory of 4300	1928	39fb045f6ea2a7398c55a3c1c9b230a5fb2a925735dceb5b887504e587c664f4_NeikiAnalytics.exe	121
PID 1928 wrote to memory of 3184	1928	39fb045f6ea2a7398c55a3c1c9b230a5fb2a925735dceb5b887504e587c664f4_NeikiAnalytics.exe	122
PID 1928 wrote to memory of 3184	1928	39fb045f6ea2a7398c55a3c1c9b230a5fb2a925735dceb5b887504e587c664f4_NeikiAnalytics.exe	122

C:\Users\Admin\AppData\Local\Temp\39fb045f6ea2a7398c55a3c1c9b230a5fb2a925735dceb5b887504e587c664f4_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\39fb045f6ea2a7398c55a3c1c9b230a5fb2a925735dceb5b887504e587c664f4_NeikiAnalytics.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1928
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2620
- C:\Windows\System\PSfWWxh.exe
  C:\Windows\System\PSfWWxh.exe
  2⤵
  - Executes dropped EXE
  PID:4152
- C:\Windows\System\zHXEkDy.exe
  C:\Windows\System\zHXEkDy.exe
  2⤵
  - Executes dropped EXE
  PID:2356
- C:\Windows\System\NAGJPRo.exe
  C:\Windows\System\NAGJPRo.exe
  2⤵
  - Executes dropped EXE
  PID:1844
- C:\Windows\System\PgZMTsC.exe
  C:\Windows\System\PgZMTsC.exe
  2⤵
  - Executes dropped EXE
  PID:4952
- C:\Windows\System\LjZxhih.exe
  C:\Windows\System\LjZxhih.exe
  2⤵
  - Executes dropped EXE
  PID:1568
- C:\Windows\System\ItdiEvO.exe
  C:\Windows\System\ItdiEvO.exe
  2⤵
  - Executes dropped EXE
  PID:1428
- C:\Windows\System\AsVdkXA.exe
  C:\Windows\System\AsVdkXA.exe
  2⤵
  - Executes dropped EXE
  PID:3308
- C:\Windows\System\bDyoUPO.exe
  C:\Windows\System\bDyoUPO.exe
  2⤵
  - Executes dropped EXE
  PID:4504
- C:\Windows\System\RbjCvID.exe
  C:\Windows\System\RbjCvID.exe
  2⤵
  - Executes dropped EXE
  PID:1008
- C:\Windows\System\JTmSWYW.exe
  C:\Windows\System\JTmSWYW.exe
  2⤵
  - Executes dropped EXE
  PID:3460
- C:\Windows\System\OwJfqHt.exe
  C:\Windows\System\OwJfqHt.exe
  2⤵
  - Executes dropped EXE
  PID:4560
- C:\Windows\System\qsANyIj.exe
  C:\Windows\System\qsANyIj.exe
  2⤵
  - Executes dropped EXE
  PID:1920
- C:\Windows\System\gEClFWq.exe
  C:\Windows\System\gEClFWq.exe
  2⤵
  - Executes dropped EXE
  PID:1720
- C:\Windows\System\dlzPeTr.exe
  C:\Windows\System\dlzPeTr.exe
  2⤵
  - Executes dropped EXE
  PID:4076
- C:\Windows\System\xqWKWhM.exe
  C:\Windows\System\xqWKWhM.exe
  2⤵
  - Executes dropped EXE
  PID:3976
- C:\Windows\System\JsHbvLH.exe
  C:\Windows\System\JsHbvLH.exe
  2⤵
  - Executes dropped EXE
  PID:1876
- C:\Windows\System\yJLyDnR.exe
  C:\Windows\System\yJLyDnR.exe
  2⤵
  - Executes dropped EXE
  PID:4028
- C:\Windows\System\ELRRuMQ.exe
  C:\Windows\System\ELRRuMQ.exe
  2⤵
  - Executes dropped EXE
  PID:2876
- C:\Windows\System\grhfnBs.exe
  C:\Windows\System\grhfnBs.exe
  2⤵
  - Executes dropped EXE
  PID:3232
- C:\Windows\System\aiNeCTP.exe
  C:\Windows\System\aiNeCTP.exe
  2⤵
  - Executes dropped EXE
  PID:744
- C:\Windows\System\iLvzsek.exe
  C:\Windows\System\iLvzsek.exe
  2⤵
  - Executes dropped EXE
  PID:5088
- C:\Windows\System\eTOgKME.exe
  C:\Windows\System\eTOgKME.exe
  2⤵
  - Executes dropped EXE
  PID:236
- C:\Windows\System\fRQhPPU.exe
  C:\Windows\System\fRQhPPU.exe
  2⤵
  - Executes dropped EXE
  PID:1108
- C:\Windows\System\xJSRcXE.exe
  C:\Windows\System\xJSRcXE.exe
  2⤵
  - Executes dropped EXE
  PID:1100
- C:\Windows\System\PybsEur.exe
  C:\Windows\System\PybsEur.exe
  2⤵
  - Executes dropped EXE
  PID:3776
- C:\Windows\System\GCrybEG.exe
  C:\Windows\System\GCrybEG.exe
  2⤵
  - Executes dropped EXE
  PID:4256
- C:\Windows\System\pFUFrYn.exe
  C:\Windows\System\pFUFrYn.exe
  2⤵
  - Executes dropped EXE
  PID:3368
- C:\Windows\System\qnYGCCM.exe
  C:\Windows\System\qnYGCCM.exe
  2⤵
  - Executes dropped EXE
  PID:1412
- C:\Windows\System\NnTaoMZ.exe
  C:\Windows\System\NnTaoMZ.exe
  2⤵
  - Executes dropped EXE
  PID:1160
- C:\Windows\System\veWjQaK.exe
  C:\Windows\System\veWjQaK.exe
  2⤵
  - Executes dropped EXE
  PID:4300
- C:\Windows\System\UVSQEuy.exe
  C:\Windows\System\UVSQEuy.exe
  2⤵
  - Executes dropped EXE
  PID:3184
- C:\Windows\System\XxCJoFS.exe
  C:\Windows\System\XxCJoFS.exe
  2⤵
  - Executes dropped EXE
  PID:5040
- C:\Windows\System\pfHiQCx.exe
  C:\Windows\System\pfHiQCx.exe
  2⤵
  - Executes dropped EXE
  PID:4404
- C:\Windows\System\GbYXlYd.exe
  C:\Windows\System\GbYXlYd.exe
  2⤵
  - Executes dropped EXE
  PID:3352
- C:\Windows\System\bEPanbK.exe
  C:\Windows\System\bEPanbK.exe
  2⤵
  - Executes dropped EXE
  PID:3952
- C:\Windows\System\cXyhZjr.exe
  C:\Windows\System\cXyhZjr.exe
  2⤵
  - Executes dropped EXE
  PID:1776
- C:\Windows\System\DOpiBca.exe
  C:\Windows\System\DOpiBca.exe
  2⤵
  - Executes dropped EXE
  PID:3564
- C:\Windows\System\PLfpBrc.exe
  C:\Windows\System\PLfpBrc.exe
  2⤵
  - Executes dropped EXE
  PID:5084
- C:\Windows\System\zibNZYe.exe
  C:\Windows\System\zibNZYe.exe
  2⤵
  - Executes dropped EXE
  PID:700
- C:\Windows\System\AwAqrcd.exe
  C:\Windows\System\AwAqrcd.exe
  2⤵
  - Executes dropped EXE
  PID:2996
- C:\Windows\System\cllooUu.exe
  C:\Windows\System\cllooUu.exe
  2⤵
  - Executes dropped EXE
  PID:1604
- C:\Windows\System\rHpnvJV.exe
  C:\Windows\System\rHpnvJV.exe
  2⤵
  - Executes dropped EXE
  PID:4388
- C:\Windows\System\cSYyMXg.exe
  C:\Windows\System\cSYyMXg.exe
  2⤵
  - Executes dropped EXE
  PID:1592
- C:\Windows\System\kiPExpu.exe
  C:\Windows\System\kiPExpu.exe
  2⤵
  - Executes dropped EXE
  PID:1236
- C:\Windows\System\NcIWTJA.exe
  C:\Windows\System\NcIWTJA.exe
  2⤵
  - Executes dropped EXE
  PID:3108
- C:\Windows\System\yjcWGeZ.exe
  C:\Windows\System\yjcWGeZ.exe
  2⤵
  - Executes dropped EXE
  PID:1952
- C:\Windows\System\tPUSoXO.exe
  C:\Windows\System\tPUSoXO.exe
  2⤵
  - Executes dropped EXE
  PID:3984
- C:\Windows\System\QNQoZEn.exe
  C:\Windows\System\QNQoZEn.exe
  2⤵
  - Executes dropped EXE
  PID:816
- C:\Windows\System\MOECOUz.exe
  C:\Windows\System\MOECOUz.exe
  2⤵
  - Executes dropped EXE
  PID:5108
- C:\Windows\System\TEAnzvp.exe
  C:\Windows\System\TEAnzvp.exe
  2⤵
  - Executes dropped EXE
  PID:3220
- C:\Windows\System\PAtEjiN.exe
  C:\Windows\System\PAtEjiN.exe
  2⤵
  - Executes dropped EXE
  PID:3944
- C:\Windows\System\fmFHmsz.exe
  C:\Windows\System\fmFHmsz.exe
  2⤵
  - Executes dropped EXE
  PID:3544
- C:\Windows\System\sOuCdaZ.exe
  C:\Windows\System\sOuCdaZ.exe
  2⤵
  - Executes dropped EXE
  PID:5136
- C:\Windows\System\UzISoUE.exe
  C:\Windows\System\UzISoUE.exe
  2⤵
  - Executes dropped EXE
  PID:5152
- C:\Windows\System\jGmlIgi.exe
  C:\Windows\System\jGmlIgi.exe
  2⤵
  - Executes dropped EXE
  PID:5168
- C:\Windows\System\UrlauHV.exe
  C:\Windows\System\UrlauHV.exe
  2⤵
  - Executes dropped EXE
  PID:5192
- C:\Windows\System\VGfEOIX.exe
  C:\Windows\System\VGfEOIX.exe
  2⤵
  - Executes dropped EXE
  PID:5212
- C:\Windows\System\axFoINw.exe
  C:\Windows\System\axFoINw.exe
  2⤵
  - Executes dropped EXE
  PID:5272
- C:\Windows\System\xmJNZQI.exe
  C:\Windows\System\xmJNZQI.exe
  2⤵
  - Executes dropped EXE
  PID:5300
- C:\Windows\System\HwdnOrG.exe
  C:\Windows\System\HwdnOrG.exe
  2⤵
  - Executes dropped EXE
  PID:5316
- C:\Windows\System\rYnDdJN.exe
  C:\Windows\System\rYnDdJN.exe
  2⤵
  - Executes dropped EXE
  PID:5340
- C:\Windows\System\RvPHAtQ.exe
  C:\Windows\System\RvPHAtQ.exe
  2⤵
  - Executes dropped EXE
  PID:5364
- C:\Windows\System\jpNEDAy.exe
  C:\Windows\System\jpNEDAy.exe
  2⤵
  - Executes dropped EXE
  PID:5388
- C:\Windows\System\xpaYWLq.exe
  C:\Windows\System\xpaYWLq.exe
  2⤵
  - Executes dropped EXE
  PID:5544
- C:\Windows\System\zNnfNIF.exe
  C:\Windows\System\zNnfNIF.exe
  2⤵
  PID:5584
- C:\Windows\System\ntRFyRF.exe
  C:\Windows\System\ntRFyRF.exe
  2⤵
  PID:5600
- C:\Windows\System\jmwNeRq.exe
  C:\Windows\System\jmwNeRq.exe
  2⤵
  PID:5628
- C:\Windows\System\UaDeqMJ.exe
  C:\Windows\System\UaDeqMJ.exe
  2⤵
  PID:5648
- C:\Windows\System\tnMhgPz.exe
  C:\Windows\System\tnMhgPz.exe
  2⤵
  PID:5676
- C:\Windows\System\tEgrENn.exe
  C:\Windows\System\tEgrENn.exe
  2⤵
  PID:5692
- C:\Windows\System\mLcMFan.exe
  C:\Windows\System\mLcMFan.exe
  2⤵
  PID:5708
- C:\Windows\System\DblIokf.exe
  C:\Windows\System\DblIokf.exe
  2⤵
  PID:5736
- C:\Windows\System\ydwkdrR.exe
  C:\Windows\System\ydwkdrR.exe
  2⤵
  PID:5756
- C:\Windows\System\ltdTRPz.exe
  C:\Windows\System\ltdTRPz.exe
  2⤵
  PID:5884
- C:\Windows\System\lROCwzH.exe
  C:\Windows\System\lROCwzH.exe
  2⤵
  PID:5912
- C:\Windows\System\MAwWmkd.exe
  C:\Windows\System\MAwWmkd.exe
  2⤵
  PID:5932
- C:\Windows\System\tqTjpKj.exe
  C:\Windows\System\tqTjpKj.exe
  2⤵
  PID:5956
- C:\Windows\System\DVhjnrk.exe
  C:\Windows\System\DVhjnrk.exe
  2⤵
  PID:5976
- C:\Windows\System\xBgoYRO.exe
  C:\Windows\System\xBgoYRO.exe
  2⤵
  PID:6020
- C:\Windows\System\zROZvbV.exe
  C:\Windows\System\zROZvbV.exe
  2⤵
  PID:6036
- C:\Windows\System\uNjpGGL.exe
  C:\Windows\System\uNjpGGL.exe
  2⤵
  PID:6052
- C:\Windows\System\EdlidUZ.exe
  C:\Windows\System\EdlidUZ.exe
  2⤵
  PID:6068
- C:\Windows\System\oqShpFm.exe
  C:\Windows\System\oqShpFm.exe
  2⤵
  PID:6084
- C:\Windows\System\EEKLHKW.exe
  C:\Windows\System\EEKLHKW.exe
  2⤵
  PID:1688
- C:\Windows\System\yRitWVr.exe
  C:\Windows\System\yRitWVr.exe
  2⤵
  PID:456
- C:\Windows\System\ripSKVy.exe
  C:\Windows\System\ripSKVy.exe
  2⤵
  PID:2776
- C:\Windows\System\aZhPxKh.exe
  C:\Windows\System\aZhPxKh.exe
  2⤵
  PID:4324
- C:\Windows\System\NQpmkbX.exe
  C:\Windows\System\NQpmkbX.exe
  2⤵
  PID:1056
- C:\Windows\System\tmSgrBL.exe
  C:\Windows\System\tmSgrBL.exe
  2⤵
  PID:552
- C:\Windows\System\XFFMQaG.exe
  C:\Windows\System\XFFMQaG.exe
  2⤵
  PID:4612
- C:\Windows\System\NivVyLT.exe
  C:\Windows\System\NivVyLT.exe
  2⤵
  PID:5560
- C:\Windows\System\VKCyHzR.exe
  C:\Windows\System\VKCyHzR.exe
  2⤵
  PID:5616
- C:\Windows\System\ihNEImU.exe
  C:\Windows\System\ihNEImU.exe
  2⤵
  PID:5688
- C:\Windows\System\NjbhnuC.exe
  C:\Windows\System\NjbhnuC.exe
  2⤵
  PID:5728
- C:\Windows\System\ENhzpBi.exe
  C:\Windows\System\ENhzpBi.exe
  2⤵
  PID:5848
- C:\Windows\System\Jwelbqh.exe
  C:\Windows\System\Jwelbqh.exe
  2⤵
  PID:5920
- C:\Windows\System\rHLYJqi.exe
  C:\Windows\System\rHLYJqi.exe
  2⤵
  PID:5940
- C:\Windows\System\gqreCsG.exe
  C:\Windows\System\gqreCsG.exe
  2⤵
  PID:5972
- C:\Windows\System\XvpLtta.exe
  C:\Windows\System\XvpLtta.exe
  2⤵
  PID:6032
- C:\Windows\System\ClIgfUP.exe
  C:\Windows\System\ClIgfUP.exe
  2⤵
  PID:3796
- C:\Windows\System\lFSeRSN.exe
  C:\Windows\System\lFSeRSN.exe
  2⤵
  PID:768
- C:\Windows\System\iJtquSO.exe
  C:\Windows\System\iJtquSO.exe
  2⤵
  PID:2064
- C:\Windows\System\crIjaxQ.exe
  C:\Windows\System\crIjaxQ.exe
  2⤵
  PID:5420
- C:\Windows\System\zZHkacA.exe
  C:\Windows\System\zZHkacA.exe
  2⤵
  PID:448
- C:\Windows\System\ghzoSqG.exe
  C:\Windows\System\ghzoSqG.exe
  2⤵
  PID:3012
- C:\Windows\System\usLHnwu.exe
  C:\Windows\System\usLHnwu.exe
  2⤵
  PID:688
- C:\Windows\System\XNbQWPK.exe
  C:\Windows\System\XNbQWPK.exe
  2⤵
  PID:2004
- C:\Windows\System\uhNIqYD.exe
  C:\Windows\System\uhNIqYD.exe
  2⤵
  PID:5180
- C:\Windows\System\ADyWvAv.exe
  C:\Windows\System\ADyWvAv.exe
  2⤵
  PID:3188
- C:\Windows\System\jEshYVp.exe
  C:\Windows\System\jEshYVp.exe
  2⤵
  PID:5312
- C:\Windows\System\POaYQwB.exe
  C:\Windows\System\POaYQwB.exe
  2⤵
  PID:1156
- C:\Windows\System\GUqqCIN.exe
  C:\Windows\System\GUqqCIN.exe
  2⤵
  PID:4652
- C:\Windows\System\VTEZLAJ.exe
  C:\Windows\System\VTEZLAJ.exe
  2⤵
  PID:2872
- C:\Windows\System\SvQRQBg.exe
  C:\Windows\System\SvQRQBg.exe
  2⤵
  PID:3284
- C:\Windows\System\ecqbYwF.exe
  C:\Windows\System\ecqbYwF.exe
  2⤵
  PID:3372
- C:\Windows\System\ufZResr.exe
  C:\Windows\System\ufZResr.exe
  2⤵
  PID:2848
- C:\Windows\System\BkkFoZQ.exe
  C:\Windows\System\BkkFoZQ.exe
  2⤵
  PID:5032
- C:\Windows\System\brXFBKb.exe
  C:\Windows\System\brXFBKb.exe
  2⤵
  PID:5508
- C:\Windows\System\FhlSuzy.exe
  C:\Windows\System\FhlSuzy.exe
  2⤵
  PID:5596
- C:\Windows\System\KECoRAp.exe
  C:\Windows\System\KECoRAp.exe
  2⤵
  PID:5684
- C:\Windows\System\mkXSmnK.exe
  C:\Windows\System\mkXSmnK.exe
  2⤵
  PID:1500
- C:\Windows\System\CipByTH.exe
  C:\Windows\System\CipByTH.exe
  2⤵
  PID:2404
- C:\Windows\System\tWTUBoU.exe
  C:\Windows\System\tWTUBoU.exe
  2⤵
  PID:5820
- C:\Windows\System\WEZComZ.exe
  C:\Windows\System\WEZComZ.exe
  2⤵
  PID:5080
- C:\Windows\System\muKfVyR.exe
  C:\Windows\System\muKfVyR.exe
  2⤵
  PID:6048
- C:\Windows\System\uTtYTZm.exe
  C:\Windows\System\uTtYTZm.exe
  2⤵
  PID:1392
- C:\Windows\System\oJInrVr.exe
  C:\Windows\System\oJInrVr.exe
  2⤵
  PID:2388
- C:\Windows\System\TIhwboc.exe
  C:\Windows\System\TIhwboc.exe
  2⤵
  PID:2140
- C:\Windows\System\mNuZVOb.exe
  C:\Windows\System\mNuZVOb.exe
  2⤵
  PID:2892
- C:\Windows\System\gepdCfA.exe
  C:\Windows\System\gepdCfA.exe
  2⤵
  PID:5132
- C:\Windows\System\uiPYXto.exe
  C:\Windows\System\uiPYXto.exe
  2⤵
  PID:4164
- C:\Windows\System\qJsxvPO.exe
  C:\Windows\System\qJsxvPO.exe
  2⤵
  PID:6140
- C:\Windows\System\nZAsxUC.exe
  C:\Windows\System\nZAsxUC.exe
  2⤵
  PID:6168
- C:\Windows\System\WWKlkZJ.exe
  C:\Windows\System\WWKlkZJ.exe
  2⤵
  PID:6188
- C:\Windows\System\ruPJmCI.exe
  C:\Windows\System\ruPJmCI.exe
  2⤵
  PID:6212
- C:\Windows\System\sRUEeaL.exe
  C:\Windows\System\sRUEeaL.exe
  2⤵
  PID:6228
- C:\Windows\System\GnYicQt.exe
  C:\Windows\System\GnYicQt.exe
  2⤵
  PID:6252
- C:\Windows\System\cZKreOj.exe
  C:\Windows\System\cZKreOj.exe
  2⤵
  PID:6276
- C:\Windows\System\cQoMwUs.exe
  C:\Windows\System\cQoMwUs.exe
  2⤵
  PID:6292
- C:\Windows\System\pAslDZx.exe
  C:\Windows\System\pAslDZx.exe
  2⤵
  PID:6324
- C:\Windows\System\aWFsovv.exe
  C:\Windows\System\aWFsovv.exe
  2⤵
  PID:6356
- C:\Windows\System\DtngNOH.exe
  C:\Windows\System\DtngNOH.exe
  2⤵
  PID:6372
- C:\Windows\System\xEuCmrS.exe
  C:\Windows\System\xEuCmrS.exe
  2⤵
  PID:6396
- C:\Windows\System\KAXyxjz.exe
  C:\Windows\System\KAXyxjz.exe
  2⤵
  PID:6420
- C:\Windows\System\sWkMqfW.exe
  C:\Windows\System\sWkMqfW.exe
  2⤵
  PID:6436
- C:\Windows\System\BVuimES.exe
  C:\Windows\System\BVuimES.exe
  2⤵
  PID:6456
- C:\Windows\System\JjBKdtw.exe
  C:\Windows\System\JjBKdtw.exe
  2⤵
  PID:6480
- C:\Windows\System\xBjdKyy.exe
  C:\Windows\System\xBjdKyy.exe
  2⤵
  PID:6500
- C:\Windows\System\MenfDHO.exe
  C:\Windows\System\MenfDHO.exe
  2⤵
  PID:6620
- C:\Windows\System\TyYpugS.exe
  C:\Windows\System\TyYpugS.exe
  2⤵
  PID:6676
- C:\Windows\System\rymqoXF.exe
  C:\Windows\System\rymqoXF.exe
  2⤵
  PID:6700
- C:\Windows\System\qufaunN.exe
  C:\Windows\System\qufaunN.exe
  2⤵
  PID:6716
- C:\Windows\System\pGghTXt.exe
  C:\Windows\System\pGghTXt.exe
  2⤵
  PID:6740
- C:\Windows\System\IdFBTIl.exe
  C:\Windows\System\IdFBTIl.exe
  2⤵
  PID:6760
- C:\Windows\System\BpYkoqn.exe
  C:\Windows\System\BpYkoqn.exe
  2⤵
  PID:6780
- C:\Windows\System\icBjppv.exe
  C:\Windows\System\icBjppv.exe
  2⤵
  PID:6796
- C:\Windows\System\UsdhDhq.exe
  C:\Windows\System\UsdhDhq.exe
  2⤵
  PID:6820
- C:\Windows\System\FpDthdf.exe
  C:\Windows\System\FpDthdf.exe
  2⤵
  PID:6844
- C:\Windows\System\PRYTcjQ.exe
  C:\Windows\System\PRYTcjQ.exe
  2⤵
  PID:6860
- C:\Windows\System\fZDNVfA.exe
  C:\Windows\System\fZDNVfA.exe
  2⤵
  PID:6884
- C:\Windows\System\rTavPtJ.exe
  C:\Windows\System\rTavPtJ.exe
  2⤵
  PID:6912
- C:\Windows\System\jcnAysz.exe
  C:\Windows\System\jcnAysz.exe
  2⤵
  PID:6928
- C:\Windows\System\lEtMCzi.exe
  C:\Windows\System\lEtMCzi.exe
  2⤵
  PID:6956
- C:\Windows\System\CENDBUB.exe
  C:\Windows\System\CENDBUB.exe
  2⤵
  PID:6980
- C:\Windows\System\vWVdTLu.exe
  C:\Windows\System\vWVdTLu.exe
  2⤵
  PID:7020
- C:\Windows\System\EUKYIbl.exe
  C:\Windows\System\EUKYIbl.exe
  2⤵
  PID:7044
- C:\Windows\System\YfRqQFD.exe
  C:\Windows\System\YfRqQFD.exe
  2⤵
  PID:7068
- C:\Windows\System\aMYlTka.exe
  C:\Windows\System\aMYlTka.exe
  2⤵
  PID:7088
- C:\Windows\System\npCitOk.exe
  C:\Windows\System\npCitOk.exe
  2⤵
  PID:7108
- C:\Windows\System\zDvHefz.exe
  C:\Windows\System\zDvHefz.exe
  2⤵
  PID:7128
- C:\Windows\System\TPwaUMj.exe
  C:\Windows\System\TPwaUMj.exe
  2⤵
  PID:7148
- C:\Windows\System\aPnWiFm.exe
  C:\Windows\System\aPnWiFm.exe
  2⤵
  PID:7164
- C:\Windows\System\QURFpLt.exe
  C:\Windows\System\QURFpLt.exe
  2⤵
  PID:5900
- C:\Windows\System\KGAtSOu.exe
  C:\Windows\System\KGAtSOu.exe
  2⤵
  PID:1848
- C:\Windows\System\fBAvgbC.exe
  C:\Windows\System\fBAvgbC.exe
  2⤵
  PID:5176
- C:\Windows\System\FqRumUL.exe
  C:\Windows\System\FqRumUL.exe
  2⤵
  PID:2376
- C:\Windows\System\VzJmlDd.exe
  C:\Windows\System\VzJmlDd.exe
  2⤵
  PID:4424
- C:\Windows\System\icqDFXC.exe
  C:\Windows\System\icqDFXC.exe
  2⤵
  PID:4004
- C:\Windows\System\SvutnuZ.exe
  C:\Windows\System\SvutnuZ.exe
  2⤵
  PID:6364
- C:\Windows\System\QlqArto.exe
  C:\Windows\System\QlqArto.exe
  2⤵
  PID:6028
- C:\Windows\System\PLcyGfD.exe
  C:\Windows\System\PLcyGfD.exe
  2⤵
  PID:2940
- C:\Windows\System\oragsXT.exe
  C:\Windows\System\oragsXT.exe
  2⤵
  PID:6176
- C:\Windows\System\BwfrtTI.exe
  C:\Windows\System\BwfrtTI.exe
  2⤵
  PID:6632
- C:\Windows\System\VSIyHSZ.exe
  C:\Windows\System\VSIyHSZ.exe
  2⤵
  PID:6472
- C:\Windows\System\aWUqyUH.exe
  C:\Windows\System\aWUqyUH.exe
  2⤵
  PID:6160
- C:\Windows\System\Lmoiytv.exe
  C:\Windows\System\Lmoiytv.exe
  2⤵
  PID:6264
- C:\Windows\System\GomfMrA.exe
  C:\Windows\System\GomfMrA.exe
  2⤵
  PID:6756
- C:\Windows\System\rpJxiga.exe
  C:\Windows\System\rpJxiga.exe
  2⤵
  PID:6308
- C:\Windows\System\qjWpEPd.exe
  C:\Windows\System\qjWpEPd.exe
  2⤵
  PID:6352
- C:\Windows\System\CzjCyXW.exe
  C:\Windows\System\CzjCyXW.exe
  2⤵
  PID:6792
- C:\Windows\System\ohzoUkd.exe
  C:\Windows\System\ohzoUkd.exe
  2⤵
  PID:6840
- C:\Windows\System\NQhwaZv.exe
  C:\Windows\System\NQhwaZv.exe
  2⤵
  PID:6892
- C:\Windows\System\vhGRVGn.exe
  C:\Windows\System\vhGRVGn.exe
  2⤵
  PID:6556
- C:\Windows\System\WpmRpme.exe
  C:\Windows\System\WpmRpme.exe
  2⤵
  PID:7032
- C:\Windows\System\CYQyXKK.exe
  C:\Windows\System\CYQyXKK.exe
  2⤵
  PID:7172
- C:\Windows\System\QoOanAw.exe
  C:\Windows\System\QoOanAw.exe
  2⤵
  PID:7196
- C:\Windows\System\uFubQuv.exe
  C:\Windows\System\uFubQuv.exe
  2⤵
  PID:7216
- C:\Windows\System\ZlXwMPl.exe
  C:\Windows\System\ZlXwMPl.exe
  2⤵
  PID:7232
- C:\Windows\System\SkpCARi.exe
  C:\Windows\System\SkpCARi.exe
  2⤵
  PID:7248
- C:\Windows\System\ZZOvmMr.exe
  C:\Windows\System\ZZOvmMr.exe
  2⤵
  PID:7276
- C:\Windows\System\wlECbTS.exe
  C:\Windows\System\wlECbTS.exe
  2⤵
  PID:7308
- C:\Windows\System\hkhSaJM.exe
  C:\Windows\System\hkhSaJM.exe
  2⤵
  PID:7332
- C:\Windows\System\QUcdaUF.exe
  C:\Windows\System\QUcdaUF.exe
  2⤵
  PID:7360
- C:\Windows\System\xVYZcBW.exe
  C:\Windows\System\xVYZcBW.exe
  2⤵
  PID:7384
- C:\Windows\System\IQFlZUz.exe
  C:\Windows\System\IQFlZUz.exe
  2⤵
  PID:7400
- C:\Windows\System\tthvnOT.exe
  C:\Windows\System\tthvnOT.exe
  2⤵
  PID:7440
- C:\Windows\System\mLsGArA.exe
  C:\Windows\System\mLsGArA.exe
  2⤵
  PID:7464
- C:\Windows\System\hFtanfo.exe
  C:\Windows\System\hFtanfo.exe
  2⤵
  PID:7484
- C:\Windows\System\CnzZqaD.exe
  C:\Windows\System\CnzZqaD.exe
  2⤵
  PID:7508
- C:\Windows\System\bbZZpVG.exe
  C:\Windows\System\bbZZpVG.exe
  2⤵
  PID:7528
- C:\Windows\System\PfRqYuV.exe
  C:\Windows\System\PfRqYuV.exe
  2⤵
  PID:7544
- C:\Windows\System\cLzBVlU.exe
  C:\Windows\System\cLzBVlU.exe
  2⤵
  PID:7560
- C:\Windows\System\SdqwuKd.exe
  C:\Windows\System\SdqwuKd.exe
  2⤵
  PID:7580
- C:\Windows\System\upiWrWP.exe
  C:\Windows\System\upiWrWP.exe
  2⤵
  PID:7600
- C:\Windows\System\XXWtzul.exe
  C:\Windows\System\XXWtzul.exe
  2⤵
  PID:7620
- C:\Windows\System\bpSwozH.exe
  C:\Windows\System\bpSwozH.exe
  2⤵
  PID:7640
- C:\Windows\System\cCSPLmM.exe
  C:\Windows\System\cCSPLmM.exe
  2⤵
  PID:7656
- C:\Windows\System\JEaVVSY.exe
  C:\Windows\System\JEaVVSY.exe
  2⤵
  PID:7680
- C:\Windows\System\iLOGgmn.exe
  C:\Windows\System\iLOGgmn.exe
  2⤵
  PID:7700
- C:\Windows\System\PjypfGj.exe
  C:\Windows\System\PjypfGj.exe
  2⤵
  PID:7720
- C:\Windows\System\iuamZMs.exe
  C:\Windows\System\iuamZMs.exe
  2⤵
  PID:7740
- C:\Windows\System\MDSGdSp.exe
  C:\Windows\System\MDSGdSp.exe
  2⤵
  PID:7764
- C:\Windows\System\lpaFXHT.exe
  C:\Windows\System\lpaFXHT.exe
  2⤵
  PID:7780
- C:\Windows\System\ZFicWQu.exe
  C:\Windows\System\ZFicWQu.exe
  2⤵
  PID:7804
- C:\Windows\System\ODlriBt.exe
  C:\Windows\System\ODlriBt.exe
  2⤵
  PID:7824
- C:\Windows\System\jwJdUUn.exe
  C:\Windows\System\jwJdUUn.exe
  2⤵
  PID:7856
- C:\Windows\System\efXMBhi.exe
  C:\Windows\System\efXMBhi.exe
  2⤵
  PID:7876
- C:\Windows\System\ZPGQhiI.exe
  C:\Windows\System\ZPGQhiI.exe
  2⤵
  PID:7900
- C:\Windows\System\utCSkBs.exe
  C:\Windows\System\utCSkBs.exe
  2⤵
  PID:7928
- C:\Windows\System\kaQUTeF.exe
  C:\Windows\System\kaQUTeF.exe
  2⤵
  PID:7948
- C:\Windows\System\qMxWCXZ.exe
  C:\Windows\System\qMxWCXZ.exe
  2⤵
  PID:7972
- C:\Windows\System\JNmuHTM.exe
  C:\Windows\System\JNmuHTM.exe
  2⤵
  PID:7992
- C:\Windows\System\wlYUNQw.exe
  C:\Windows\System\wlYUNQw.exe
  2⤵
  PID:8016
- C:\Windows\System\DwtxrWD.exe
  C:\Windows\System\DwtxrWD.exe
  2⤵
  PID:8040
- C:\Windows\System\nLTbwYj.exe
  C:\Windows\System\nLTbwYj.exe
  2⤵
  PID:8056
- C:\Windows\System\RetkMoO.exe
  C:\Windows\System\RetkMoO.exe
  2⤵
  PID:8080
- C:\Windows\System\YzKrpar.exe
  C:\Windows\System\YzKrpar.exe
  2⤵
  PID:8104
- C:\Windows\System\cETGwmB.exe
  C:\Windows\System\cETGwmB.exe
  2⤵
  PID:8120
- C:\Windows\System\icBwuMZ.exe
  C:\Windows\System\icBwuMZ.exe
  2⤵
  PID:8140
- C:\Windows\System\VWziogE.exe
  C:\Windows\System\VWziogE.exe
  2⤵
  PID:8164
- C:\Windows\System\nksfYTL.exe
  C:\Windows\System\nksfYTL.exe
  2⤵
  PID:8180
- C:\Windows\System\uTaEQJw.exe
  C:\Windows\System\uTaEQJw.exe
  2⤵
  PID:4600
- C:\Windows\System\KjrLRAs.exe
  C:\Windows\System\KjrLRAs.exe
  2⤵
  PID:6692
- C:\Windows\System\UbFUIJf.exe
  C:\Windows\System\UbFUIJf.exe
  2⤵
  PID:6648
- C:\Windows\System\pBJjfit.exe
  C:\Windows\System\pBJjfit.exe
  2⤵
  PID:7120
- C:\Windows\System\sqklPZR.exe
  C:\Windows\System\sqklPZR.exe
  2⤵
  PID:6652
- C:\Windows\System\kmhxpVE.exe
  C:\Windows\System\kmhxpVE.exe
  2⤵
  PID:6132
- C:\Windows\System\ZzoqcIF.exe
  C:\Windows\System\ZzoqcIF.exe
  2⤵
  PID:4656
- C:\Windows\System\gYMnmGZ.exe
  C:\Windows\System\gYMnmGZ.exe
  2⤵
  PID:6236
- C:\Windows\System\BIQplEp.exe
  C:\Windows\System\BIQplEp.exe
  2⤵
  PID:7264
- C:\Windows\System\HdzgaHc.exe
  C:\Windows\System\HdzgaHc.exe
  2⤵
  PID:7448
- C:\Windows\System\mGUKoLR.exe
  C:\Windows\System\mGUKoLR.exe
  2⤵
  PID:7456
- C:\Windows\System\rJhTJQR.exe
  C:\Windows\System\rJhTJQR.exe
  2⤵
  PID:6304
- C:\Windows\System\wPEBiTs.exe
  C:\Windows\System\wPEBiTs.exe
  2⤵
  PID:7552
- C:\Windows\System\TFVCxlt.exe
  C:\Windows\System\TFVCxlt.exe
  2⤵
  PID:6920
- C:\Windows\System\sfXWoWN.exe
  C:\Windows\System\sfXWoWN.exe
  2⤵
  PID:6300
- C:\Windows\System\wpUpivc.exe
  C:\Windows\System\wpUpivc.exe
  2⤵
  PID:7064
- C:\Windows\System\UShnTsF.exe
  C:\Windows\System\UShnTsF.exe
  2⤵
  PID:7080
- C:\Windows\System\WAGIyyP.exe
  C:\Windows\System\WAGIyyP.exe
  2⤵
  PID:7004
- C:\Windows\System\YLCDdLl.exe
  C:\Windows\System\YLCDdLl.exe
  2⤵
  PID:7156
- C:\Windows\System\NbyMHwx.exe
  C:\Windows\System\NbyMHwx.exe
  2⤵
  PID:5812
- C:\Windows\System\qEokhzK.exe
  C:\Windows\System\qEokhzK.exe
  2⤵
  PID:7208
- C:\Windows\System\YLLVqyK.exe
  C:\Windows\System\YLLVqyK.exe
  2⤵
  PID:8216
- C:\Windows\System\OPRNVyD.exe
  C:\Windows\System\OPRNVyD.exe
  2⤵
  PID:8232
- C:\Windows\System\VjwTjBU.exe
  C:\Windows\System\VjwTjBU.exe
  2⤵
  PID:8252
- C:\Windows\System\CsagVMb.exe
  C:\Windows\System\CsagVMb.exe
  2⤵
  PID:8276
- C:\Windows\System\cYtyUdW.exe
  C:\Windows\System\cYtyUdW.exe
  2⤵
  PID:8300
- C:\Windows\System\LakjGkt.exe
  C:\Windows\System\LakjGkt.exe
  2⤵
  PID:8320
- C:\Windows\System\XsTwBBX.exe
  C:\Windows\System\XsTwBBX.exe
  2⤵
  PID:8340
- C:\Windows\System\KFeeuJx.exe
  C:\Windows\System\KFeeuJx.exe
  2⤵
  PID:8360
- C:\Windows\System\bCRjcKo.exe
  C:\Windows\System\bCRjcKo.exe
  2⤵
  PID:8384
- C:\Windows\System\NUZNSLZ.exe
  C:\Windows\System\NUZNSLZ.exe
  2⤵
  PID:8400
- C:\Windows\System\RMfTPEW.exe
  C:\Windows\System\RMfTPEW.exe
  2⤵
  PID:8420
- C:\Windows\System\ZolrcVO.exe
  C:\Windows\System\ZolrcVO.exe
  2⤵
  PID:8444
- C:\Windows\System\lAfVBia.exe
  C:\Windows\System\lAfVBia.exe
  2⤵
  PID:8460
- C:\Windows\System\KlaxYBI.exe
  C:\Windows\System\KlaxYBI.exe
  2⤵
  PID:8476
- C:\Windows\System\EdWFYEv.exe
  C:\Windows\System\EdWFYEv.exe
  2⤵
  PID:8496
- C:\Windows\System\bpQjQJe.exe
  C:\Windows\System\bpQjQJe.exe
  2⤵
  PID:8512
- C:\Windows\System\hLCKDvk.exe
  C:\Windows\System\hLCKDvk.exe
  2⤵
  PID:8544
- C:\Windows\System\lHiWgvJ.exe
  C:\Windows\System\lHiWgvJ.exe
  2⤵
  PID:8568
- C:\Windows\System\teUqkYt.exe
  C:\Windows\System\teUqkYt.exe
  2⤵
  PID:8584
- C:\Windows\System\YlhIFdL.exe
  C:\Windows\System\YlhIFdL.exe
  2⤵
  PID:8604
- C:\Windows\System\UuajPum.exe
  C:\Windows\System\UuajPum.exe
  2⤵
  PID:8628
- C:\Windows\System\qtcFakE.exe
  C:\Windows\System\qtcFakE.exe
  2⤵
  PID:8644
- C:\Windows\System\FmJJaTZ.exe
  C:\Windows\System\FmJJaTZ.exe
  2⤵
  PID:8688
- C:\Windows\System\SVdnxBF.exe
  C:\Windows\System\SVdnxBF.exe
  2⤵
  PID:8708
- C:\Windows\System\RJYLGVY.exe
  C:\Windows\System\RJYLGVY.exe
  2⤵
  PID:8724
- C:\Windows\System\lLeyFpo.exe
  C:\Windows\System\lLeyFpo.exe
  2⤵
  PID:8744
- C:\Windows\System\oDnYhgj.exe
  C:\Windows\System\oDnYhgj.exe
  2⤵
  PID:8764
- C:\Windows\System\IehRVBv.exe
  C:\Windows\System\IehRVBv.exe
  2⤵
  PID:8788
- C:\Windows\System\FgKerYt.exe
  C:\Windows\System\FgKerYt.exe
  2⤵
  PID:8804
- C:\Windows\System\CuGusHN.exe
  C:\Windows\System\CuGusHN.exe
  2⤵
  PID:8832
- C:\Windows\System\qbhzMrh.exe
  C:\Windows\System\qbhzMrh.exe
  2⤵
  PID:8856
- C:\Windows\System\nJBxPrE.exe
  C:\Windows\System\nJBxPrE.exe
  2⤵
  PID:8876
- C:\Windows\System\AxUXpTr.exe
  C:\Windows\System\AxUXpTr.exe
  2⤵
  PID:8896
- C:\Windows\System\dguGejp.exe
  C:\Windows\System\dguGejp.exe
  2⤵
  PID:8924
- C:\Windows\System\gSyXVxK.exe
  C:\Windows\System\gSyXVxK.exe
  2⤵
  PID:8940
- C:\Windows\System\JYgvrRG.exe
  C:\Windows\System\JYgvrRG.exe
  2⤵
  PID:8964
- C:\Windows\System\wpDDGlQ.exe
  C:\Windows\System\wpDDGlQ.exe
  2⤵
  PID:8984
- C:\Windows\System\LRaQiBI.exe
  C:\Windows\System\LRaQiBI.exe
  2⤵
  PID:9004
- C:\Windows\System\RIoQwVI.exe
  C:\Windows\System\RIoQwVI.exe
  2⤵
  PID:9024
- C:\Windows\System\YiKkIre.exe
  C:\Windows\System\YiKkIre.exe
  2⤵
  PID:9052
- C:\Windows\System\UDuJjIx.exe
  C:\Windows\System\UDuJjIx.exe
  2⤵
  PID:9072
- C:\Windows\System\CJNxpdQ.exe
  C:\Windows\System\CJNxpdQ.exe
  2⤵
  PID:9092
- C:\Windows\System\QxwFLVz.exe
  C:\Windows\System\QxwFLVz.exe
  2⤵
  PID:9112
- C:\Windows\System\yFHopkK.exe
  C:\Windows\System\yFHopkK.exe
  2⤵
  PID:9140
- C:\Windows\System\eSZQaTz.exe
  C:\Windows\System\eSZQaTz.exe
  2⤵
  PID:9160
- C:\Windows\System\UNdtWuz.exe
  C:\Windows\System\UNdtWuz.exe
  2⤵
  PID:9180
- C:\Windows\System\YlcGGFj.exe
  C:\Windows\System\YlcGGFj.exe
  2⤵
  PID:9204
- C:\Windows\System\jqyjCGN.exe
  C:\Windows\System\jqyjCGN.exe
  2⤵
  PID:7708
- C:\Windows\System\ilXpVNt.exe
  C:\Windows\System\ilXpVNt.exe
  2⤵
  PID:7256
- C:\Windows\System\VhBJXqt.exe
  C:\Windows\System\VhBJXqt.exe
  2⤵
  PID:7476
- C:\Windows\System\tfLQnrd.exe
  C:\Windows\System\tfLQnrd.exe
  2⤵
  PID:7920
- C:\Windows\System\QMBkLuM.exe
  C:\Windows\System\QMBkLuM.exe
  2⤵
  PID:8156
- C:\Windows\System\NsOxenf.exe
  C:\Windows\System\NsOxenf.exe
  2⤵
  PID:6788
- C:\Windows\System\JusxYFJ.exe
  C:\Windows\System\JusxYFJ.exe
  2⤵
  PID:7204
- C:\Windows\System\ESEwdBY.exe
  C:\Windows\System\ESEwdBY.exe
  2⤵
  PID:7272
- C:\Windows\System\ZDRtSpD.exe
  C:\Windows\System\ZDRtSpD.exe
  2⤵
  PID:7572
- C:\Windows\System\JlrErIH.exe
  C:\Windows\System\JlrErIH.exe
  2⤵
  PID:6380
- C:\Windows\System\ggyclMG.exe
  C:\Windows\System\ggyclMG.exe
  2⤵
  PID:7648
- C:\Windows\System\utWHQTb.exe
  C:\Windows\System\utWHQTb.exe
  2⤵
  PID:9220
- C:\Windows\System\nlehffO.exe
  C:\Windows\System\nlehffO.exe
  2⤵
  PID:9240
- C:\Windows\System\fmqwbTY.exe
  C:\Windows\System\fmqwbTY.exe
  2⤵
  PID:9528
- C:\Windows\System\nqTZnwG.exe
  C:\Windows\System\nqTZnwG.exe
  2⤵
  PID:9548
- C:\Windows\System\xUnEkGC.exe
  C:\Windows\System\xUnEkGC.exe
  2⤵
  PID:9572
- C:\Windows\System\ivBxvBZ.exe
  C:\Windows\System\ivBxvBZ.exe
  2⤵
  PID:9596
- C:\Windows\System\duVlFZw.exe
  C:\Windows\System\duVlFZw.exe
  2⤵
  PID:9620
- C:\Windows\System\RfmrXoa.exe
  C:\Windows\System\RfmrXoa.exe
  2⤵
  PID:9640
- C:\Windows\System\QhctPkQ.exe
  C:\Windows\System\QhctPkQ.exe
  2⤵
  PID:9668
- C:\Windows\System\cTQKekH.exe
  C:\Windows\System\cTQKekH.exe
  2⤵
  PID:9688
- C:\Windows\System\ZhAdoee.exe
  C:\Windows\System\ZhAdoee.exe
  2⤵
  PID:9708
- C:\Windows\System\ISrRswa.exe
  C:\Windows\System\ISrRswa.exe
  2⤵
  PID:9732
- C:\Windows\System\ePajXiS.exe
  C:\Windows\System\ePajXiS.exe
  2⤵
  PID:9752
- C:\Windows\System\uxvDCho.exe
  C:\Windows\System\uxvDCho.exe
  2⤵
  PID:9772
- C:\Windows\System\qliWwal.exe
  C:\Windows\System\qliWwal.exe
  2⤵
  PID:9792
- C:\Windows\System\ShzYFQy.exe
  C:\Windows\System\ShzYFQy.exe
  2⤵
  PID:9812
- C:\Windows\System\UhueBXK.exe
  C:\Windows\System\UhueBXK.exe
  2⤵
  PID:9832
- C:\Windows\System\kqDxlqm.exe
  C:\Windows\System\kqDxlqm.exe
  2⤵
  PID:9860
- C:\Windows\System\oAKHZjv.exe
  C:\Windows\System\oAKHZjv.exe
  2⤵
  PID:9876
- C:\Windows\System\SDRntIp.exe
  C:\Windows\System\SDRntIp.exe
  2⤵
  PID:9900
- C:\Windows\System\PEHcdTh.exe
  C:\Windows\System\PEHcdTh.exe
  2⤵
  PID:9924
- C:\Windows\System\jlqaeDy.exe
  C:\Windows\System\jlqaeDy.exe
  2⤵
  PID:9940
- C:\Windows\System\rYVEvHA.exe
  C:\Windows\System\rYVEvHA.exe
  2⤵
  PID:9964
- C:\Windows\System\EzMHqDW.exe
  C:\Windows\System\EzMHqDW.exe
  2⤵
  PID:9992
- C:\Windows\System\BSRWVwA.exe
  C:\Windows\System\BSRWVwA.exe
  2⤵
  PID:10020
- C:\Windows\System\uQdeYzl.exe
  C:\Windows\System\uQdeYzl.exe
  2⤵
  PID:10052
- C:\Windows\System\eALzlqV.exe
  C:\Windows\System\eALzlqV.exe
  2⤵
  PID:10080
- C:\Windows\System\bkNZulY.exe
  C:\Windows\System\bkNZulY.exe
  2⤵
  PID:10100
- C:\Windows\System\ksOTtKe.exe
  C:\Windows\System\ksOTtKe.exe
  2⤵
  PID:10124
- C:\Windows\System\mXsKuSP.exe
  C:\Windows\System\mXsKuSP.exe
  2⤵
  PID:10144
- C:\Windows\System\TFeGylu.exe
  C:\Windows\System\TFeGylu.exe
  2⤵
  PID:10164
- C:\Windows\System\RqprEmd.exe
  C:\Windows\System\RqprEmd.exe
  2⤵
  PID:10192
- C:\Windows\System\cjpCltX.exe
  C:\Windows\System\cjpCltX.exe
  2⤵
  PID:10208
- C:\Windows\System\tiegZOL.exe
  C:\Windows\System\tiegZOL.exe
  2⤵
  PID:8336
- C:\Windows\System\oXPoErX.exe
  C:\Windows\System\oXPoErX.exe
  2⤵
  PID:7292
- C:\Windows\System\eRDphJM.exe
  C:\Windows\System\eRDphJM.exe
  2⤵
  PID:7328
- C:\Windows\System\SGBnGBO.exe
  C:\Windows\System\SGBnGBO.exe
  2⤵
  PID:7352
- C:\Windows\System\xktSHGL.exe
  C:\Windows\System\xktSHGL.exe
  2⤵
  PID:7380
- C:\Windows\System\nuIVMRg.exe
  C:\Windows\System\nuIVMRg.exe
  2⤵
  PID:8552
- C:\Windows\System\myIkzcG.exe
  C:\Windows\System\myIkzcG.exe
  2⤵
  PID:7944
- C:\Windows\System\nKvkRLV.exe
  C:\Windows\System\nKvkRLV.exe
  2⤵
  PID:8684
- C:\Windows\System\zdtQWAl.exe
  C:\Windows\System\zdtQWAl.exe
  2⤵
  PID:8784
- C:\Windows\System\BeVmjik.exe
  C:\Windows\System\BeVmjik.exe
  2⤵
  PID:7596
- C:\Windows\System\bHTpVgU.exe
  C:\Windows\System\bHTpVgU.exe
  2⤵
  PID:7284
- C:\Windows\System\XoEguQd.exe
  C:\Windows\System\XoEguQd.exe
  2⤵
  PID:6868
- C:\Windows\System\jplTAnQ.exe
  C:\Windows\System\jplTAnQ.exe
  2⤵
  PID:8224
- C:\Windows\System\YKXsKtf.exe
  C:\Windows\System\YKXsKtf.exe
  2⤵
  PID:7736
- C:\Windows\System\vxmTFBJ.exe
  C:\Windows\System\vxmTFBJ.exe
  2⤵
  PID:8356
- C:\Windows\System\MzTpXCM.exe
  C:\Windows\System\MzTpXCM.exe
  2⤵
  PID:7540
- C:\Windows\System\csmDenE.exe
  C:\Windows\System\csmDenE.exe
  2⤵
  PID:9276
- C:\Windows\System\jHirNam.exe
  C:\Windows\System\jHirNam.exe
  2⤵
  PID:8484
- C:\Windows\System\VDcrFqR.exe
  C:\Windows\System\VDcrFqR.exe
  2⤵
  PID:7884
- C:\Windows\System\DHIRgEV.exe
  C:\Windows\System\DHIRgEV.exe
  2⤵
  PID:8528
- C:\Windows\System\omUCfYy.exe
  C:\Windows\System\omUCfYy.exe
  2⤵
  PID:7912
- C:\Windows\System\rUUtFIU.exe
  C:\Windows\System\rUUtFIU.exe
  2⤵
  PID:8000
- C:\Windows\System\eacctAQ.exe
  C:\Windows\System\eacctAQ.exe
  2⤵
  PID:8028
- C:\Windows\System\ohzrdGC.exe
  C:\Windows\System\ohzrdGC.exe
  2⤵
  PID:8072
- C:\Windows\System\nuhOzca.exe
  C:\Windows\System\nuhOzca.exe
  2⤵
  PID:8800
- C:\Windows\System\XIWNVbO.exe
  C:\Windows\System\XIWNVbO.exe
  2⤵
  PID:8852
- C:\Windows\System\lDSsIdH.exe
  C:\Windows\System\lDSsIdH.exe
  2⤵
  PID:5324
- C:\Windows\System\GdeAnOX.exe
  C:\Windows\System\GdeAnOX.exe
  2⤵
  PID:6576
- C:\Windows\System\lnaTQFL.exe
  C:\Windows\System\lnaTQFL.exe
  2⤵
  PID:9176
- C:\Windows\System\dtwQhFW.exe
  C:\Windows\System\dtwQhFW.exe
  2⤵
  PID:6152
- C:\Windows\System\cSXEhZs.exe
  C:\Windows\System\cSXEhZs.exe
  2⤵
  PID:7144
- C:\Windows\System\IpAeqNT.exe
  C:\Windows\System\IpAeqNT.exe
  2⤵
  PID:5164
- C:\Windows\System\eaUGCeM.exe
  C:\Windows\System\eaUGCeM.exe
  2⤵
  PID:8248
- C:\Windows\System\cGUnDzY.exe
  C:\Windows\System\cGUnDzY.exe
  2⤵
  PID:8328
- C:\Windows\System\MJPROUa.exe
  C:\Windows\System\MJPROUa.exe
  2⤵
  PID:8396
- C:\Windows\System\GeWEzge.exe
  C:\Windows\System\GeWEzge.exe
  2⤵
  PID:8756
- C:\Windows\System\hGNkGZO.exe
  C:\Windows\System\hGNkGZO.exe
  2⤵
  PID:10264
- C:\Windows\System\gtKWZWH.exe
  C:\Windows\System\gtKWZWH.exe
  2⤵
  PID:10284
- C:\Windows\System\UFongeN.exe
  C:\Windows\System\UFongeN.exe
  2⤵
  PID:10312
- C:\Windows\System\ekHYQyq.exe
  C:\Windows\System\ekHYQyq.exe
  2⤵
  PID:10332
- C:\Windows\System\uDbaubi.exe
  C:\Windows\System\uDbaubi.exe
  2⤵
  PID:10356
- C:\Windows\System\LkxoCXF.exe
  C:\Windows\System\LkxoCXF.exe
  2⤵
  PID:10376
- C:\Windows\System\oHdxXiE.exe
  C:\Windows\System\oHdxXiE.exe
  2⤵
  PID:10396
- C:\Windows\System\yTfhwTt.exe
  C:\Windows\System\yTfhwTt.exe
  2⤵
  PID:10420
- C:\Windows\System\YJYYioF.exe
  C:\Windows\System\YJYYioF.exe
  2⤵
  PID:10436
- C:\Windows\System\oRipMVT.exe
  C:\Windows\System\oRipMVT.exe
  2⤵
  PID:10460
- C:\Windows\System\vgSNyIS.exe
  C:\Windows\System\vgSNyIS.exe
  2⤵
  PID:10484
- C:\Windows\System\ByhyDVg.exe
  C:\Windows\System\ByhyDVg.exe
  2⤵
  PID:10504
- C:\Windows\System\gzfywnZ.exe
  C:\Windows\System\gzfywnZ.exe
  2⤵
  PID:10528
- C:\Windows\System\oiHcvTg.exe
  C:\Windows\System\oiHcvTg.exe
  2⤵
  PID:10552
- C:\Windows\System\dlgSmdM.exe
  C:\Windows\System\dlgSmdM.exe
  2⤵
  PID:10572
- C:\Windows\System\DxTigyf.exe
  C:\Windows\System\DxTigyf.exe
  2⤵
  PID:10592
- C:\Windows\System\RFfNovE.exe
  C:\Windows\System\RFfNovE.exe
  2⤵
  PID:10616
- C:\Windows\System\GeEYUlR.exe
  C:\Windows\System\GeEYUlR.exe
  2⤵
  PID:10632
- C:\Windows\System\jwYzHzn.exe
  C:\Windows\System\jwYzHzn.exe
  2⤵
  PID:10656
- C:\Windows\System\sfiEHSo.exe
  C:\Windows\System\sfiEHSo.exe
  2⤵
  PID:10672
- C:\Windows\System\GdvDmCr.exe
  C:\Windows\System\GdvDmCr.exe
  2⤵
  PID:10696
- C:\Windows\System\JYGrpKc.exe
  C:\Windows\System\JYGrpKc.exe
  2⤵
  PID:10740
- C:\Windows\System\LXJfWoI.exe
  C:\Windows\System\LXJfWoI.exe
  2⤵
  PID:10764
- C:\Windows\System\lwoJflv.exe
  C:\Windows\System\lwoJflv.exe
  2⤵
  PID:10780
- C:\Windows\System\iaTeTur.exe
  C:\Windows\System\iaTeTur.exe
  2⤵
  PID:10812
- C:\Windows\System\dujzfbi.exe
  C:\Windows\System\dujzfbi.exe
  2⤵
  PID:10832
- C:\Windows\System\FUojgsi.exe
  C:\Windows\System\FUojgsi.exe
  2⤵
  PID:10848
- C:\Windows\System\GfTpiEk.exe
  C:\Windows\System\GfTpiEk.exe
  2⤵
  PID:10872
- C:\Windows\System\LMlPTGK.exe
  C:\Windows\System\LMlPTGK.exe
  2⤵
  PID:10892
- C:\Windows\System\gANpXda.exe
  C:\Windows\System\gANpXda.exe
  2⤵
  PID:10916
- C:\Windows\System\NsCVmlU.exe
  C:\Windows\System\NsCVmlU.exe
  2⤵
  PID:10936
- C:\Windows\System\vITTvzC.exe
  C:\Windows\System\vITTvzC.exe
  2⤵
  PID:10964
- C:\Windows\System\RXphLTZ.exe
  C:\Windows\System\RXphLTZ.exe
  2⤵
  PID:10980
- C:\Windows\System\SDHBABO.exe
  C:\Windows\System\SDHBABO.exe
  2⤵
  PID:11008
- C:\Windows\System\zRbyKAP.exe
  C:\Windows\System\zRbyKAP.exe
  2⤵
  PID:11024
- C:\Windows\System\UnweDIt.exe
  C:\Windows\System\UnweDIt.exe
  2⤵
  PID:11048
- C:\Windows\System\RJjUnoU.exe
  C:\Windows\System\RJjUnoU.exe
  2⤵
  PID:11068
- C:\Windows\System\LUIIjvn.exe
  C:\Windows\System\LUIIjvn.exe
  2⤵
  PID:11096
- C:\Windows\System\eeHzMGZ.exe
  C:\Windows\System\eeHzMGZ.exe
  2⤵
  PID:11116
- C:\Windows\System\NxqQeXu.exe
  C:\Windows\System\NxqQeXu.exe
  2⤵
  PID:11140
- C:\Windows\System\hnkLMJY.exe
  C:\Windows\System\hnkLMJY.exe
  2⤵
  PID:11164
- C:\Windows\System\rNbMkVm.exe
  C:\Windows\System\rNbMkVm.exe
  2⤵
  PID:11184
- C:\Windows\System\YDsYDNJ.exe
  C:\Windows\System\YDsYDNJ.exe
  2⤵
  PID:11204
- C:\Windows\System\HElZkMC.exe
  C:\Windows\System\HElZkMC.exe
  2⤵
  PID:11228
- C:\Windows\System\KyeptmR.exe
  C:\Windows\System\KyeptmR.exe
  2⤵
  PID:11244
- C:\Windows\System\pVrSvwA.exe
  C:\Windows\System\pVrSvwA.exe
  2⤵
  PID:11260
- C:\Windows\System\qtXLwwN.exe
  C:\Windows\System\qtXLwwN.exe
  2⤵
  PID:8456
- C:\Windows\System\nnfnwvm.exe
  C:\Windows\System\nnfnwvm.exe
  2⤵
  PID:9744
- C:\Windows\System\wCtufxt.exe
  C:\Windows\System\wCtufxt.exe
  2⤵
  PID:9804
- C:\Windows\System\mAhvbtI.exe
  C:\Windows\System\mAhvbtI.exe
  2⤵
  PID:9844
- C:\Windows\System\wxpeZGO.exe
  C:\Windows\System\wxpeZGO.exe
  2⤵
  PID:9956
- C:\Windows\System\CMhHQjt.exe
  C:\Windows\System\CMhHQjt.exe
  2⤵
  PID:8660
- C:\Windows\System\LKCaWfA.exe
  C:\Windows\System\LKCaWfA.exe
  2⤵
  PID:9324
- C:\Windows\System\DbYgePA.exe
  C:\Windows\System\DbYgePA.exe
  2⤵
  PID:10064
- C:\Windows\System\tYNooHL.exe
  C:\Windows\System\tYNooHL.exe
  2⤵
  PID:9360
- C:\Windows\System\AWRDUwu.exe
  C:\Windows\System\AWRDUwu.exe
  2⤵
  PID:8960
- C:\Windows\System\ULadNgq.exe
  C:\Windows\System\ULadNgq.exe
  2⤵
  PID:9048
- C:\Windows\System\zayukcr.exe
  C:\Windows\System\zayukcr.exe
  2⤵
  PID:9120
- C:\Windows\System\BHtcbjB.exe
  C:\Windows\System\BHtcbjB.exe
  2⤵
  PID:9136
- C:\Windows\System\QVmCxFB.exe
  C:\Windows\System\QVmCxFB.exe
  2⤵
  PID:7760
- C:\Windows\System\qpAeUQN.exe
  C:\Windows\System\qpAeUQN.exe
  2⤵
  PID:8780
- C:\Windows\System\qdfKqYk.exe
  C:\Windows\System\qdfKqYk.exe
  2⤵
  PID:11292
- C:\Windows\System\ZIuWhdz.exe
  C:\Windows\System\ZIuWhdz.exe
  2⤵
  PID:11328
- C:\Windows\System\vXPHNeq.exe
  C:\Windows\System\vXPHNeq.exe
  2⤵
  PID:11348
- C:\Windows\System\zBJDpYo.exe
  C:\Windows\System\zBJDpYo.exe
  2⤵
  PID:11960
- C:\Windows\System\GkPgCFY.exe
  C:\Windows\System\GkPgCFY.exe
  2⤵
  PID:11984
- C:\Windows\System\gikGTYk.exe
  C:\Windows\System\gikGTYk.exe
  2⤵
  PID:12000
- C:\Windows\System\nqCFxxa.exe
  C:\Windows\System\nqCFxxa.exe
  2⤵
  PID:12020
- C:\Windows\System\lGdeZvh.exe
  C:\Windows\System\lGdeZvh.exe
  2⤵
  PID:12036
- C:\Windows\System\hlDqPwh.exe
  C:\Windows\System\hlDqPwh.exe
  2⤵
  PID:12068
- C:\Windows\System\SwQVDnY.exe
  C:\Windows\System\SwQVDnY.exe
  2⤵
  PID:12104
- C:\Windows\System\fSeaAcH.exe
  C:\Windows\System\fSeaAcH.exe
  2⤵
  PID:12124
- C:\Windows\System\haMrjlc.exe
  C:\Windows\System\haMrjlc.exe
  2⤵
  PID:12176
- C:\Windows\System\YoKNqNj.exe
  C:\Windows\System\YoKNqNj.exe
  2⤵
  PID:12196
- C:\Windows\System\lqvWBde.exe
  C:\Windows\System\lqvWBde.exe
  2⤵
  PID:12232
- C:\Windows\System\przviwz.exe
  C:\Windows\System\przviwz.exe
  2⤵
  PID:12252
- C:\Windows\System\kCgBzLo.exe
  C:\Windows\System\kCgBzLo.exe
  2⤵
  PID:12272
- C:\Windows\System\kyStVss.exe
  C:\Windows\System\kyStVss.exe
  2⤵
  PID:9168
- C:\Windows\System\DULyXgo.exe
  C:\Windows\System\DULyXgo.exe
  2⤵
  PID:7872
- C:\Windows\System\YRwgCFs.exe
  C:\Windows\System\YRwgCFs.exe
  2⤵
  PID:8932
- C:\Windows\System\WtwicFU.exe
  C:\Windows\System\WtwicFU.exe
  2⤵
  PID:9252
- C:\Windows\System\hPvElsU.exe
  C:\Windows\System\hPvElsU.exe
  2⤵
  PID:9580
- C:\Windows\System\zgZzDvH.exe
  C:\Windows\System\zgZzDvH.exe
  2⤵
  PID:10248
- C:\Windows\System\BPDiOeK.exe
  C:\Windows\System\BPDiOeK.exe
  2⤵
  PID:9828
- C:\Windows\System\mxXUWUR.exe
  C:\Windows\System\mxXUWUR.exe
  2⤵
  PID:9984
- C:\Windows\System\NCzlsCq.exe
  C:\Windows\System\NCzlsCq.exe
  2⤵
  PID:10776
- C:\Windows\System\aSxaHtH.exe
  C:\Windows\System\aSxaHtH.exe
  2⤵
  PID:7348
- C:\Windows\System\tGIaTRD.exe
  C:\Windows\System\tGIaTRD.exe
  2⤵
  PID:7492
- C:\Windows\System\bopMZHA.exe
  C:\Windows\System\bopMZHA.exe
  2⤵
  PID:7716
- C:\Windows\System\hKchUzo.exe
  C:\Windows\System\hKchUzo.exe
  2⤵
  PID:11300
- C:\Windows\System\uwujQJv.exe
  C:\Windows\System\uwujQJv.exe
  2⤵
  PID:7852
- C:\Windows\System\UzliDJT.exe
  C:\Windows\System\UzliDJT.exe
  2⤵
  PID:9720
- C:\Windows\System\FUCckTh.exe
  C:\Windows\System\FUCckTh.exe
  2⤵
  PID:11172
- C:\Windows\System\AkNCVUk.exe
  C:\Windows\System\AkNCVUk.exe
  2⤵
  PID:11016
- C:\Windows\System\jgaXrAW.exe
  C:\Windows\System\jgaXrAW.exe
  2⤵
  PID:10840
- C:\Windows\System\pLOxipC.exe
  C:\Windows\System\pLOxipC.exe
  2⤵
  PID:10748
- C:\Windows\System\PbZNpTI.exe
  C:\Windows\System\PbZNpTI.exe
  2⤵
  PID:10608
- C:\Windows\System\DdxNxzp.exe
  C:\Windows\System\DdxNxzp.exe
  2⤵
  PID:10428
- C:\Windows\System\RLAvRkQ.exe
  C:\Windows\System\RLAvRkQ.exe
  2⤵
  PID:10924
- C:\Windows\System\MLIZtSQ.exe
  C:\Windows\System\MLIZtSQ.exe
  2⤵
  PID:8008
- C:\Windows\System\YbnnjgL.exe
  C:\Windows\System\YbnnjgL.exe
  2⤵
  PID:8148
- C:\Windows\System\acllSEa.exe
  C:\Windows\System\acllSEa.exe
  2⤵
  PID:9536
- C:\Windows\System\zyfeMxw.exe
  C:\Windows\System\zyfeMxw.exe
  2⤵
  PID:9588
- C:\Windows\System\wVtyBLu.exe
  C:\Windows\System\wVtyBLu.exe
  2⤵
  PID:9636
- C:\Windows\System\tNChdRi.exe
  C:\Windows\System\tNChdRi.exe
  2⤵
  PID:10328
- C:\Windows\System\lRzNEzL.exe
  C:\Windows\System\lRzNEzL.exe
  2⤵
  PID:10392
- C:\Windows\System\nIocgyA.exe
  C:\Windows\System\nIocgyA.exe
  2⤵
  PID:9920
- C:\Windows\System\EBgXZdX.exe
  C:\Windows\System\EBgXZdX.exe
  2⤵
  PID:10012
- C:\Windows\System\MSciSsK.exe
  C:\Windows\System\MSciSsK.exe
  2⤵
  PID:10752
- C:\Windows\System\oKTQQrK.exe
  C:\Windows\System\oKTQQrK.exe
  2⤵
  PID:10824
- C:\Windows\System\JcFDAke.exe
  C:\Windows\System\JcFDAke.exe
  2⤵
  PID:7776
- C:\Windows\System\YFOwIeT.exe
  C:\Windows\System\YFOwIeT.exe
  2⤵
  PID:10976
- C:\Windows\System\SPlcdYZ.exe
  C:\Windows\System\SPlcdYZ.exe
  2⤵
  PID:11092
- C:\Windows\System\zrOSskK.exe
  C:\Windows\System\zrOSskK.exe
  2⤵
  PID:7260
- C:\Windows\System\WyPeEVx.exe
  C:\Windows\System\WyPeEVx.exe
  2⤵
  PID:8204
- C:\Windows\System\qCYwfHq.exe
  C:\Windows\System\qCYwfHq.exe
  2⤵
  PID:9908
- C:\Windows\System\vcYOwCd.exe
  C:\Windows\System\vcYOwCd.exe
  2⤵
  PID:8732
- C:\Windows\System\fMnieTu.exe
  C:\Windows\System\fMnieTu.exe
  2⤵
  PID:8452
- C:\Windows\System\rdzNdjo.exe
  C:\Windows\System\rdzNdjo.exe
  2⤵
  PID:8948
- C:\Windows\System\LCCRghk.exe
  C:\Windows\System\LCCRghk.exe
  2⤵
  PID:11316
- C:\Windows\System\BEGBgYO.exe
  C:\Windows\System\BEGBgYO.exe
  2⤵
  PID:9296
- C:\Windows\System\duyMgZd.exe
  C:\Windows\System\duyMgZd.exe
  2⤵
  PID:9868
- C:\Windows\System\SbNvPUd.exe
  C:\Windows\System\SbNvPUd.exe
  2⤵
  PID:8196
- C:\Windows\System\XqznokV.exe
  C:\Windows\System\XqznokV.exe
  2⤵
  PID:9340
- C:\Windows\System\byFpAbN.exe
  C:\Windows\System\byFpAbN.exe
  2⤵
  PID:9156
- C:\Windows\System\xFAQbJY.exe
  C:\Windows\System\xFAQbJY.exe
  2⤵
  PID:3264
- C:\Windows\System\zLRAVNy.exe
  C:\Windows\System\zLRAVNy.exe
  2⤵
  PID:10320
- C:\Windows\System\NVFxOAC.exe
  C:\Windows\System\NVFxOAC.exe
  2⤵
  PID:10480
- C:\Windows\System\jAlMcEk.exe
  C:\Windows\System\jAlMcEk.exe
  2⤵
  PID:10568
- C:\Windows\System\KILbfje.exe
  C:\Windows\System\KILbfje.exe
  2⤵
  PID:10680
- C:\Windows\System\coeNcvq.exe
  C:\Windows\System\coeNcvq.exe
  2⤵
  PID:11824
- C:\Windows\System\aZoioDz.exe
  C:\Windows\System\aZoioDz.exe
  2⤵
  PID:10932
- C:\Windows\System\QHUxuPD.exe
  C:\Windows\System\QHUxuPD.exe
  2⤵
  PID:11020
- C:\Windows\System\spvzfhM.exe
  C:\Windows\System\spvzfhM.exe
  2⤵
  PID:11108
- C:\Windows\System\bWKLrVK.exe
  C:\Windows\System\bWKLrVK.exe
  2⤵
  PID:11876
- C:\Windows\System\YjWaeOp.exe
  C:\Windows\System\YjWaeOp.exe
  2⤵
  PID:11904
- C:\Windows\System\ReEvcIA.exe
  C:\Windows\System\ReEvcIA.exe
  2⤵
  PID:11940
- C:\Windows\System\vEinUAd.exe
  C:\Windows\System\vEinUAd.exe
  2⤵
  PID:9044
- C:\Windows\System\kqWywhN.exe
  C:\Windows\System\kqWywhN.exe
  2⤵
  PID:9332
- C:\Windows\System\HRaxqqY.exe
  C:\Windows\System\HRaxqqY.exe
  2⤵
  PID:10300
- C:\Windows\System\VmnEzQy.exe
  C:\Windows\System\VmnEzQy.exe
  2⤵
  PID:9464
- C:\Windows\System\dgqUtRn.exe
  C:\Windows\System\dgqUtRn.exe
  2⤵
  PID:8176
- C:\Windows\System\rKBbxRy.exe
  C:\Windows\System\rKBbxRy.exe
  2⤵
  PID:12028
- C:\Windows\System\JKWJKtI.exe
  C:\Windows\System\JKWJKtI.exe
  2⤵
  PID:12304
- C:\Windows\System\yiFkzpJ.exe
  C:\Windows\System\yiFkzpJ.exe
  2⤵
  PID:12324
- C:\Windows\System\SwdZQit.exe
  C:\Windows\System\SwdZQit.exe
  2⤵
  PID:12344
- C:\Windows\System\rrYBpwv.exe
  C:\Windows\System\rrYBpwv.exe
  2⤵
  PID:12368
- C:\Windows\System\tcnyatR.exe
  C:\Windows\System\tcnyatR.exe
  2⤵
  PID:12388
- C:\Windows\System\LCAzpLe.exe
  C:\Windows\System\LCAzpLe.exe
  2⤵
  PID:12412
- C:\Windows\System\leZvpGs.exe
  C:\Windows\System\leZvpGs.exe
  2⤵
  PID:12436
- C:\Windows\System\wWNKgYb.exe
  C:\Windows\System\wWNKgYb.exe
  2⤵
  PID:12456
- C:\Windows\System\TyuKikP.exe
  C:\Windows\System\TyuKikP.exe
  2⤵
  PID:12476
- C:\Windows\System\YvzuwfH.exe
  C:\Windows\System\YvzuwfH.exe
  2⤵
  PID:12500
- C:\Windows\System\frkzbST.exe
  C:\Windows\System\frkzbST.exe
  2⤵
  PID:12524
- C:\Windows\System\MGxdlPH.exe
  C:\Windows\System\MGxdlPH.exe
  2⤵
  PID:12548
- C:\Windows\System\YUyUYJn.exe
  C:\Windows\System\YUyUYJn.exe
  2⤵
  PID:12572
- C:\Windows\System\AjolngD.exe
  C:\Windows\System\AjolngD.exe
  2⤵
  PID:12592
- C:\Windows\System\ZBbNRDx.exe
  C:\Windows\System\ZBbNRDx.exe
  2⤵
  PID:12616
- C:\Windows\System\njZFGQN.exe
  C:\Windows\System\njZFGQN.exe
  2⤵
  PID:12640
- C:\Windows\System\HhbucLK.exe
  C:\Windows\System\HhbucLK.exe
  2⤵
  PID:12668
- C:\Windows\System\pKtiroV.exe
  C:\Windows\System\pKtiroV.exe
  2⤵
  PID:12696
- C:\Windows\System\PiEvKkT.exe
  C:\Windows\System\PiEvKkT.exe
  2⤵
  PID:12712
- C:\Windows\System\kKKsiVs.exe
  C:\Windows\System\kKKsiVs.exe
  2⤵
  PID:12732
- C:\Windows\System\zoBVTjY.exe
  C:\Windows\System\zoBVTjY.exe
  2⤵
  PID:12752
- C:\Windows\System\wmdWCXB.exe
  C:\Windows\System\wmdWCXB.exe
  2⤵
  PID:12772
- C:\Windows\System\VTUSPFl.exe
  C:\Windows\System\VTUSPFl.exe
  2⤵
  PID:12804
- C:\Windows\System\cZnzNbs.exe
  C:\Windows\System\cZnzNbs.exe
  2⤵
  PID:12824
- C:\Windows\System\AzmALSS.exe
  C:\Windows\System\AzmALSS.exe
  2⤵
  PID:12844
- C:\Windows\System\kUbXPTp.exe
  C:\Windows\System\kUbXPTp.exe
  2⤵
  PID:12864
- C:\Windows\System\dZSzobu.exe
  C:\Windows\System\dZSzobu.exe
  2⤵
  PID:12880
- C:\Windows\System\ijtzELs.exe
  C:\Windows\System\ijtzELs.exe
  2⤵
  PID:12900
- C:\Windows\System\XHhKjAx.exe
  C:\Windows\System\XHhKjAx.exe
  2⤵
  PID:12920
- C:\Windows\System\rMgXWYq.exe
  C:\Windows\System\rMgXWYq.exe
  2⤵
  PID:12940
- C:\Windows\System\niotHyo.exe
  C:\Windows\System\niotHyo.exe
  2⤵
  PID:12960
- C:\Windows\System\myjJsil.exe
  C:\Windows\System\myjJsil.exe
  2⤵
  PID:12980
- C:\Windows\System\NacZRxY.exe
  C:\Windows\System\NacZRxY.exe
  2⤵
  PID:13008
- C:\Windows\System\TrCqTRv.exe
  C:\Windows\System\TrCqTRv.exe
  2⤵
  PID:13028
- C:\Windows\System\ImOaHtm.exe
  C:\Windows\System\ImOaHtm.exe
  2⤵
  PID:13044
- C:\Windows\System\ghXqGnv.exe
  C:\Windows\System\ghXqGnv.exe
  2⤵
  PID:13084
- C:\Windows\System\uNKDDsk.exe
  C:\Windows\System\uNKDDsk.exe
  2⤵
  PID:13100
- C:\Windows\System\UxMJkIO.exe
  C:\Windows\System\UxMJkIO.exe
  2⤵
  PID:13120
- C:\Windows\System\LnQDBLg.exe
  C:\Windows\System\LnQDBLg.exe
  2⤵
  PID:13136
- C:\Windows\System\QDEkLVD.exe
  C:\Windows\System\QDEkLVD.exe
  2⤵
  PID:13152
- C:\Windows\System\XrcHqze.exe
  C:\Windows\System\XrcHqze.exe
  2⤵
  PID:13168
- C:\Windows\System\MNGmbnn.exe
  C:\Windows\System\MNGmbnn.exe
  2⤵
  PID:13184
- C:\Windows\System\lfLzwtF.exe
  C:\Windows\System\lfLzwtF.exe
  2⤵
  PID:13200
- C:\Windows\System\xUyGEsP.exe
  C:\Windows\System\xUyGEsP.exe
  2⤵
  PID:11888
- C:\Windows\System\rqIsbmE.exe
  C:\Windows\System\rqIsbmE.exe
  2⤵
  PID:10864
- C:\Windows\System\YuJOSTp.exe
  C:\Windows\System\YuJOSTp.exe
  2⤵
  PID:9960
- C:\Windows\System\kbXnkLN.exe
  C:\Windows\System\kbXnkLN.exe
  2⤵
  PID:11576
- C:\Windows\System\rteuqZc.exe
  C:\Windows\System\rteuqZc.exe
  2⤵
  PID:12132
- C:\Windows\System\HQsDGIt.exe
  C:\Windows\System\HQsDGIt.exe
  2⤵
  PID:12420
- C:\Windows\System\TSSxPnd.exe
  C:\Windows\System\TSSxPnd.exe
  2⤵
  PID:12280
- C:\Windows\System\JopbTrm.exe
  C:\Windows\System\JopbTrm.exe
  2⤵
  PID:8820
- C:\Windows\System\QyFMsHS.exe
  C:\Windows\System\QyFMsHS.exe
  2⤵
  PID:9700
- C:\Windows\System\Hzpmpwa.exe
  C:\Windows\System\Hzpmpwa.exe
  2⤵
  PID:13024
- C:\Windows\System\dDVbTYV.exe
  C:\Windows\System\dDVbTYV.exe
  2⤵
  PID:10032
- C:\Windows\System\lEacSdo.exe
  C:\Windows\System\lEacSdo.exe
  2⤵
  PID:10364
- C:\Windows\System\PXbzafq.exe
  C:\Windows\System\PXbzafq.exe
  2⤵
  PID:10412
- C:\Windows\System\iQIRdxQ.exe
  C:\Windows\System\iQIRdxQ.exe
  2⤵
  PID:10172
- C:\Windows\System\RCNEbGN.exe
  C:\Windows\System\RCNEbGN.exe
  2⤵
  PID:8380
- C:\Windows\System\yUUDeYz.exe
  C:\Windows\System\yUUDeYz.exe
  2⤵
  PID:1360
- C:\Windows\System\pkdqkAL.exe
  C:\Windows\System\pkdqkAL.exe
  2⤵
  PID:9232
- C:\Windows\System\lTXOLxv.exe
  C:\Windows\System\lTXOLxv.exe
  2⤵
  PID:12164
- C:\Windows\System\gcMRfzD.exe
  C:\Windows\System\gcMRfzD.exe
  2⤵
  PID:12352
- C:\Windows\System\NmiFgZR.exe
  C:\Windows\System\NmiFgZR.exe
  2⤵
  PID:12284
- C:\Windows\System\SzbdObA.exe
  C:\Windows\System\SzbdObA.exe
  2⤵
  PID:12792
- C:\Windows\System\eAGsojx.exe
  C:\Windows\System\eAGsojx.exe
  2⤵
  PID:12312
- C:\Windows\System\EFViXMP.exe
  C:\Windows\System\EFViXMP.exe
  2⤵
  PID:12632
- C:\Windows\System\xSEPDDZ.exe
  C:\Windows\System\xSEPDDZ.exe
  2⤵
  PID:12704
- C:\Windows\System\mpHufaq.exe
  C:\Windows\System\mpHufaq.exe
  2⤵
  PID:13252
- C:\Windows\System\rQBwUja.exe
  C:\Windows\System\rQBwUja.exe
  2⤵
  PID:12076
- C:\Windows\System\VjKRgTt.exe
  C:\Windows\System\VjKRgTt.exe
  2⤵
  PID:13196
- C:\Windows\System\ilnZEpn.exe
  C:\Windows\System\ilnZEpn.exe
  2⤵
  PID:12852
- C:\Windows\System\SjWvKYO.exe
  C:\Windows\System\SjWvKYO.exe
  2⤵
  PID:13108
- C:\Windows\System\wRquozH.exe
  C:\Windows\System\wRquozH.exe
  2⤵
  PID:13640
- C:\Windows\System\NlfCLgy.exe
  C:\Windows\System\NlfCLgy.exe
  2⤵
  PID:13780
- C:\Windows\System\McFylCq.exe
  C:\Windows\System\McFylCq.exe
  2⤵
  PID:13900
- C:\Windows\System\uVkEOcF.exe
  C:\Windows\System\uVkEOcF.exe
  2⤵
  PID:13964
- C:\Windows\System\KEDyymd.exe
  C:\Windows\System\KEDyymd.exe
  2⤵
  PID:10772
- C:\Windows\System\mqonWFc.exe
  C:\Windows\System\mqonWFc.exe
  2⤵
  PID:9236
- C:\Windows\System\NFzyivG.exe
  C:\Windows\System\NFzyivG.exe
  2⤵
  PID:13396
- C:\Windows\System\KtjCPCb.exe
  C:\Windows\System\KtjCPCb.exe
  2⤵
  PID:12584
- C:\Windows\System\DoyAAbn.exe
  C:\Windows\System\DoyAAbn.exe
  2⤵
  PID:7568
- C:\Windows\System\RhTmUrE.exe
  C:\Windows\System\RhTmUrE.exe
  2⤵
  PID:13520
- C:\Windows\System\RtJyrdf.exe
  C:\Windows\System\RtJyrdf.exe
  2⤵
  PID:13096
- C:\Windows\System\twJbHUD.exe
  C:\Windows\System\twJbHUD.exe
  2⤵
  PID:12384
- C:\Windows\System\YIMxLyL.exe
  C:\Windows\System\YIMxLyL.exe
  2⤵
  PID:13500
- C:\Windows\System\ELdkejM.exe
  C:\Windows\System\ELdkejM.exe
  2⤵
  PID:14116
- C:\Windows\System\EMGUVXY.exe
  C:\Windows\System\EMGUVXY.exe
  2⤵
  PID:14008
- C:\Windows\System\QqxQEEt.exe
  C:\Windows\System\QqxQEEt.exe
  2⤵
  PID:13852
- C:\Windows\System\yUSQgvY.exe
  C:\Windows\System\yUSQgvY.exe
  2⤵
  PID:13876
- C:\Windows\System\exgCQkc.exe
  C:\Windows\System\exgCQkc.exe
  2⤵
  PID:13932
- C:\Windows\System\ZrVDljN.exe
  C:\Windows\System\ZrVDljN.exe
  2⤵
  PID:13952
- C:\Windows\System\NiuMIQt.exe
  C:\Windows\System\NiuMIQt.exe
  2⤵
  PID:14012
- C:\Windows\System\LSBcjPh.exe
  C:\Windows\System\LSBcjPh.exe
  2⤵
  PID:14144
- C:\Windows\System\tFgaeei.exe
  C:\Windows\System\tFgaeei.exe
  2⤵
  PID:13160
- C:\Windows\System\pOqtnfZ.exe
  C:\Windows\System\pOqtnfZ.exe
  2⤵
  PID:12948
- C:\Windows\System\IRmznWi.exe
  C:\Windows\System\IRmznWi.exe
  2⤵
  PID:12248
- C:\Windows\System\fgxmNii.exe
  C:\Windows\System\fgxmNii.exe
  2⤵
  PID:14328
- C:\Windows\System\llGgPks.exe
  C:\Windows\System\llGgPks.exe
  2⤵
  PID:13896
- C:\Windows\System\dJqahlZ.exe
  C:\Windows\System\dJqahlZ.exe
  2⤵
  PID:14252
- C:\Windows\System\qzLRFnS.exe
  C:\Windows\System\qzLRFnS.exe
  2⤵
  PID:13020
- C:\Windows\System\WVpeXZt.exe
  C:\Windows\System\WVpeXZt.exe
  2⤵
  PID:13836
- C:\Windows\System\LMKOgig.exe
  C:\Windows\System\LMKOgig.exe
  2⤵
  PID:13620
- C:\Windows\System\lMOyrhb.exe
  C:\Windows\System\lMOyrhb.exe
  2⤵
  PID:8316
- C:\Windows\System\HPdPppi.exe
  C:\Windows\System\HPdPppi.exe
  2⤵
  PID:3076
- C:\Windows\System\IRRTfPZ.exe
  C:\Windows\System\IRRTfPZ.exe
  2⤵
  PID:13672
- C:\Windows\System\oOmEzeq.exe
  C:\Windows\System\oOmEzeq.exe
  2⤵
  PID:4084
- C:\Windows\System\XFmnWGA.exe
  C:\Windows\System\XFmnWGA.exe
  2⤵
  PID:14104
- C:\Windows\System\oTHLypk.exe
  C:\Windows\System\oTHLypk.exe
  2⤵
  PID:1396
- C:\Windows\System\SkkERum.exe
  C:\Windows\System\SkkERum.exe
  2⤵
  PID:1240
- C:\Windows\System\bRXHWHO.exe
  C:\Windows\System\bRXHWHO.exe
  2⤵
  PID:3912
- C:\Windows\System\YiQkjpc.exe
  C:\Windows\System\YiQkjpc.exe
  2⤵
  PID:9632
- C:\Windows\System\TxQIfUR.exe
  C:\Windows\System\TxQIfUR.exe
  2⤵
  PID:13688
- C:\Windows\System\kscevbj.exe
  C:\Windows\System\kscevbj.exe
  2⤵
  PID:4412
- C:\Windows\System\ctojodk.exe
  C:\Windows\System\ctojodk.exe
  2⤵
  PID:4044
- C:\Windows\System\RAlLRqY.exe
  C:\Windows\System\RAlLRqY.exe
  2⤵
  PID:4240
- C:\Windows\System\nTebdpI.exe
  C:\Windows\System\nTebdpI.exe
  2⤵
  PID:4292
- C:\Windows\System\JlliVuN.exe
  C:\Windows\System\JlliVuN.exe
  2⤵
  PID:13016
- C:\Windows\System\EnWeZgG.exe
  C:\Windows\System\EnWeZgG.exe
  2⤵
  PID:4472
- C:\Windows\System\RXIYkQZ.exe
  C:\Windows\System\RXIYkQZ.exe
  2⤵
  PID:9272
- C:\Windows\System\NlOVbOw.exe
  C:\Windows\System\NlOVbOw.exe
  2⤵
  PID:4572
- C:\Windows\System\QUDMxkC.exe
  C:\Windows\System\QUDMxkC.exe
  2⤵
  PID:12664
- C:\Windows\System\AUHqawh.exe
  C:\Windows\System\AUHqawh.exe
  2⤵
  PID:12976
- C:\Windows\System\ZUMAcxG.exe
  C:\Windows\System\ZUMAcxG.exe
  2⤵
  PID:13556
- C:\Windows\System\QGkRdKS.exe
  C:\Windows\System\QGkRdKS.exe
  2⤵
  PID:3764
- C:\Windows\System\CFkNaZc.exe
  C:\Windows\System\CFkNaZc.exe
  2⤵
  PID:13232
- C:\Windows\System\vFWUyGU.exe
  C:\Windows\System\vFWUyGU.exe
  2⤵
  PID:1840
- C:\Windows\System\zTFiHox.exe
  C:\Windows\System\zTFiHox.exe
  2⤵
  PID:5060
- C:\Windows\System\sKTFMPt.exe
  C:\Windows\System\sKTFMPt.exe
  2⤵
  PID:2808
- C:\Windows\System\ctAUhUg.exe
  C:\Windows\System\ctAUhUg.exe
  2⤵
  PID:4484
- C:\Windows\System\lrBitVG.exe
  C:\Windows\System\lrBitVG.exe
  2⤵
  PID:10668
- C:\Windows\System\JFmrxOH.exe
  C:\Windows\System\JFmrxOH.exe
  2⤵
  PID:13536
- C:\Windows\System\XFcEQMI.exe
  C:\Windows\System\XFcEQMI.exe
  2⤵
  PID:3604
- C:\Windows\System\tFfdVgh.exe
  C:\Windows\System\tFfdVgh.exe
  2⤵
  PID:4248
- C:\Windows\System\LzSngLA.exe
  C:\Windows\System\LzSngLA.exe
  2⤵
  PID:13740
- C:\Windows\System\ufKThuW.exe
  C:\Windows\System\ufKThuW.exe
  2⤵
  PID:4496
- C:\Windows\System\mgCLZNK.exe
  C:\Windows\System\mgCLZNK.exe
  2⤵
  PID:13580
- C:\Windows\System\sJesdqW.exe
  C:\Windows\System\sJesdqW.exe
  2⤵
  PID:13092
- C:\Windows\System\hIMVPIh.exe
  C:\Windows\System\hIMVPIh.exe
  2⤵
  PID:13468
- C:\Windows\System\LstiaNI.exe
  C:\Windows\System\LstiaNI.exe
  2⤵
  PID:920
- C:\Windows\System\WRlYSig.exe
  C:\Windows\System\WRlYSig.exe
  2⤵
  PID:12996
- C:\Windows\System\mocwBCD.exe
  C:\Windows\System\mocwBCD.exe
  2⤵
  PID:13912
- C:\Windows\System\QztzyNG.exe
  C:\Windows\System\QztzyNG.exe
  2⤵
  PID:9948
- C:\Windows\System\sVlrINR.exe
  C:\Windows\System\sVlrINR.exe
  2⤵
  PID:4040
- C:\Windows\System\qTehXJN.exe
  C:\Windows\System\qTehXJN.exe
  2⤵
  PID:12496
- C:\Windows\System\JyuCDwC.exe
  C:\Windows\System\JyuCDwC.exe
  2⤵
  PID:13076
- C:\Windows\System\ZhlYtPJ.exe
  C:\Windows\System\ZhlYtPJ.exe
  2⤵
  PID:3864
- C:\Windows\System\QrKWsXy.exe
  C:\Windows\System\QrKWsXy.exe
  2⤵
  PID:4428
- C:\Windows\System\EaDhIkV.exe
  C:\Windows\System\EaDhIkV.exe
  2⤵
  PID:12612
- C:\Windows\System\BQuPqch.exe
  C:\Windows\System\BQuPqch.exe
  2⤵
  PID:4224
- C:\Windows\System\kOexWtK.exe
  C:\Windows\System\kOexWtK.exe
  2⤵
  PID:12588
- C:\Windows\System\VjbEJtD.exe
  C:\Windows\System\VjbEJtD.exe
  2⤵
  PID:1664
- C:\Windows\System\jRIpmpG.exe
  C:\Windows\System\jRIpmpG.exe
  2⤵
  PID:3132
- C:\Windows\System\dCLDneT.exe
  C:\Windows\System\dCLDneT.exe
  2⤵
  PID:13368
- C:\Windows\System\UcckiOF.exe
  C:\Windows\System\UcckiOF.exe
  2⤵
  PID:12520
- C:\Windows\System\zEgfxrv.exe
  C:\Windows\System\zEgfxrv.exe
  2⤵
  PID:8600
- C:\Windows\System\ztmuPVA.exe
  C:\Windows\System\ztmuPVA.exe
  2⤵
  PID:13344
- C:\Windows\System\guFVpqK.exe
  C:\Windows\System\guFVpqK.exe
  2⤵
  PID:1028
- C:\Windows\System\UDHDiEI.exe
  C:\Windows\System\UDHDiEI.exe
  2⤵
  PID:4980
- C:\Windows\System\qAIQNcn.exe
  C:\Windows\System\qAIQNcn.exe
  2⤵
  PID:3656
- C:\Windows\System\QxqDnXG.exe
  C:\Windows\System\QxqDnXG.exe
  2⤵
  PID:13340
- C:\Windows\System\SdExaBM.exe
  C:\Windows\System\SdExaBM.exe
  2⤵
  PID:820
- C:\Windows\System\soyVZhY.exe
  C:\Windows\System\soyVZhY.exe
  2⤵
  PID:4352
- C:\Windows\System\tAfBgtD.exe
  C:\Windows\System\tAfBgtD.exe
  2⤵
  PID:4676
- C:\Windows\System\BcOxFSN.exe
  C:\Windows\System\BcOxFSN.exe
  2⤵
  PID:2112
- C:\Windows\System\vzFQqWk.exe
  C:\Windows\System\vzFQqWk.exe
  2⤵
  PID:2752
- C:\Windows\System\WxmwBZY.exe
  C:\Windows\System\WxmwBZY.exe
  2⤵
  PID:9564
- C:\Windows\System\PsJGUui.exe
  C:\Windows\System\PsJGUui.exe
  2⤵
  PID:13348
- C:\Windows\System\DefePoH.exe
  C:\Windows\System\DefePoH.exe
  2⤵
  PID:5384
- C:\Windows\System\qxfeNsS.exe
  C:\Windows\System\qxfeNsS.exe
  2⤵
  PID:5572
- C:\Windows\System\JdwayhI.exe
  C:\Windows\System\JdwayhI.exe
  2⤵
  PID:9416
- C:\Windows\System\kioJUUO.exe
  C:\Windows\System\kioJUUO.exe
  2⤵
  PID:5292
- C:\Windows\System\JrmEjhx.exe
  C:\Windows\System\JrmEjhx.exe
  2⤵
  PID:13272
- C:\Windows\System\PKzORMw.exe
  C:\Windows\System\PKzORMw.exe
  2⤵
  PID:4276
- C:\Windows\System\QPkeThg.exe
  C:\Windows\System\QPkeThg.exe
  2⤵
  PID:5528
- C:\Windows\System\nndYGfU.exe
  C:\Windows\System\nndYGfU.exe
  2⤵
  PID:1416
- C:\Windows\System\KDrNaLG.exe
  C:\Windows\System\KDrNaLG.exe
  2⤵
  PID:4064
- C:\Windows\System\PZyTHdF.exe
  C:\Windows\System\PZyTHdF.exe
  2⤵
  PID:5576
- C:\Windows\System\bVNSjqb.exe
  C:\Windows\System\bVNSjqb.exe
  2⤵
  PID:5624
- C:\Windows\System\Eawhpml.exe
  C:\Windows\System\Eawhpml.exe
  2⤵
  PID:5808
- C:\Windows\System\dHdiUXZ.exe
  C:\Windows\System\dHdiUXZ.exe
  2⤵
  PID:5864
- C:\Windows\System\jZhHkUd.exe
  C:\Windows\System\jZhHkUd.exe
  2⤵
  PID:13424
- C:\Windows\System\hbRPhwc.exe
  C:\Windows\System\hbRPhwc.exe
  2⤵
  PID:4320
- C:\Windows\System\SVfXixn.exe
  C:\Windows\System\SVfXixn.exe
  2⤵
  PID:6124
- C:\Windows\System\UjDQDYH.exe
  C:\Windows\System\UjDQDYH.exe
  2⤵
  PID:2884
- C:\Windows\System\ObNspPM.exe
  C:\Windows\System\ObNspPM.exe
  2⤵
  PID:3760
- C:\Windows\System\MIHnbGX.exe
  C:\Windows\System\MIHnbGX.exe
  2⤵
  PID:13940
- C:\Windows\System\vlNPLdz.exe
  C:\Windows\System\vlNPLdz.exe
  2⤵
  PID:5356
- C:\Windows\System\NwmTDcG.exe
  C:\Windows\System\NwmTDcG.exe
  2⤵
  PID:384
- C:\Windows\System\vymNTGD.exe
  C:\Windows\System\vymNTGD.exe
  2⤵
  PID:5780
- C:\Windows\System\iRcyzvo.exe
  C:\Windows\System\iRcyzvo.exe
  2⤵
  PID:1020
- C:\Windows\System\MuzEyuV.exe
  C:\Windows\System\MuzEyuV.exe
  2⤵
  PID:13676
- C:\Windows\System\wSwZsQk.exe
  C:\Windows\System\wSwZsQk.exe
  2⤵
  PID:5504
- C:\Windows\System\AkITAIW.exe
  C:\Windows\System\AkITAIW.exe
  2⤵
  PID:13980
- C:\Windows\System\ZVRPIrs.exe
  C:\Windows\System\ZVRPIrs.exe
  2⤵
  PID:5248
- C:\Windows\System\pokwJLI.exe
  C:\Windows\System\pokwJLI.exe
  2⤵
  PID:3240
- C:\Windows\System\xuFffhQ.exe
  C:\Windows\System\xuFffhQ.exe
  2⤵
  PID:5424
- C:\Windows\System\BEnsLEG.exe
  C:\Windows\System\BEnsLEG.exe
  2⤵
  PID:14224
- C:\Windows\System\PTZBYoP.exe
  C:\Windows\System\PTZBYoP.exe
  2⤵
  PID:9912
- C:\Windows\System\rgFYfgR.exe
  C:\Windows\System\rgFYfgR.exe
  2⤵
  PID:3996
- C:\Windows\System\CrgGlnG.exe
  C:\Windows\System\CrgGlnG.exe
  2⤵
  PID:4244
- C:\Windows\System\liUTREG.exe
  C:\Windows\System\liUTREG.exe
  2⤵
  PID:5076
- C:\Windows\System\vYbWHYz.exe
  C:\Windows\System\vYbWHYz.exe
  2⤵
  PID:1828
- C:\Windows\System\aVPEjqr.exe
  C:\Windows\System\aVPEjqr.exe
  2⤵
  PID:3660
- C:\Windows\System\vluVRXu.exe
  C:\Windows\System\vluVRXu.exe
  2⤵
  PID:2372
- C:\Windows\System\rIGuCuW.exe
  C:\Windows\System\rIGuCuW.exe
  2⤵
  PID:12608
- C:\Windows\System\bWJRTVz.exe
  C:\Windows\System\bWJRTVz.exe
  2⤵
  PID:4968
- C:\Windows\System\rnJBQXY.exe
  C:\Windows\System\rnJBQXY.exe
  2⤵
  PID:524
- C:\Windows\System\wIviWHF.exe
  C:\Windows\System\wIviWHF.exe
  2⤵
  PID:11788
- C:\Windows\System\BApwzSJ.exe
  C:\Windows\System\BApwzSJ.exe
  2⤵
  PID:5772
- C:\Windows\System\HluOJhJ.exe
  C:\Windows\System\HluOJhJ.exe
  2⤵
  PID:472
- C:\Windows\System\sOlslFz.exe
  C:\Windows\System\sOlslFz.exe
  2⤵
  PID:5232
- C:\Windows\System\DpjHQJQ.exe
  C:\Windows\System\DpjHQJQ.exe
  2⤵
  PID:5236
- C:\Windows\System\oEzcbRJ.exe
  C:\Windows\System\oEzcbRJ.exe
  2⤵
  PID:420
- C:\Windows\System\JwRrQCY.exe
  C:\Windows\System\JwRrQCY.exe
  2⤵
  PID:4268
- C:\Windows\System\gghjmrE.exe
  C:\Windows\System\gghjmrE.exe
  2⤵
  PID:5360
- C:\Windows\System\qmiYpUi.exe
  C:\Windows\System\qmiYpUi.exe
  2⤵
  PID:912
- C:\Windows\System\aDSSOQG.exe
  C:\Windows\System\aDSSOQG.exe
  2⤵
  PID:3728
- C:\Windows\System\IFuGXhE.exe
  C:\Windows\System\IFuGXhE.exe
  2⤵
  PID:1120
- C:\Windows\System\wcOXiNy.exe
  C:\Windows\System\wcOXiNy.exe
  2⤵
  PID:4308
- C:\Windows\System\SZTVGWk.exe
  C:\Windows\System\SZTVGWk.exe
  2⤵
  PID:5836
- C:\Windows\System\TcILmhc.exe
  C:\Windows\System\TcILmhc.exe
  2⤵
  PID:14268
- C:\Windows\System\AyTecpY.exe
  C:\Windows\System\AyTecpY.exe
  2⤵
  PID:5892
- C:\Windows\System\QNPOfds.exe
  C:\Windows\System\QNPOfds.exe
  2⤵
  PID:5148
- C:\Windows\System\QgjkppT.exe
  C:\Windows\System\QgjkppT.exe
  2⤵
  PID:1572
- C:\Windows\System\aDhxmXy.exe
  C:\Windows\System\aDhxmXy.exe
  2⤵
  PID:2700
- C:\Windows\System\UNZOcsB.exe
  C:\Windows\System\UNZOcsB.exe
  2⤵
  PID:5024
- C:\Windows\System\pMIpiLG.exe
  C:\Windows\System\pMIpiLG.exe
  2⤵
  PID:5948
- C:\Windows\System\ILSmFTQ.exe
  C:\Windows\System\ILSmFTQ.exe
  2⤵
  PID:6108
- C:\Windows\System\sDWCbtR.exe
  C:\Windows\System\sDWCbtR.exe
  2⤵
  PID:6112
- C:\Windows\System\DnTpSrr.exe
  C:\Windows\System\DnTpSrr.exe
  2⤵
  PID:2980
- C:\Windows\System\CtEoomn.exe
  C:\Windows\System\CtEoomn.exe
  2⤵
  PID:4492
- C:\Windows\System\WnHhGfL.exe
  C:\Windows\System\WnHhGfL.exe
  2⤵
  PID:5400
- C:\Windows\System\PBgIebz.exe
  C:\Windows\System\PBgIebz.exe
  2⤵
  PID:6528
- C:\Windows\System\AjoLmbb.exe
  C:\Windows\System\AjoLmbb.exe
  2⤵
  PID:6520
- C:\Windows\System\XvoIgkV.exe
  C:\Windows\System\XvoIgkV.exe
  2⤵
  PID:4664
- C:\Windows\System\OvnGBmg.exe
  C:\Windows\System\OvnGBmg.exe
  2⤵
  PID:6524
- C:\Windows\System\uZNMHcJ.exe
  C:\Windows\System\uZNMHcJ.exe
  2⤵
  PID:6444
- C:\Windows\System\efNPWBi.exe
  C:\Windows\System\efNPWBi.exe
  2⤵
  PID:6896
- C:\Windows\System\KmAodZZ.exe
  C:\Windows\System\KmAodZZ.exe
  2⤵
  PID:5412
- C:\Windows\System\tVGbqID.exe
  C:\Windows\System\tVGbqID.exe
  2⤵
  PID:4864
- C:\Windows\System\sNVMPav.exe
  C:\Windows\System\sNVMPav.exe
  2⤵
  PID:6248
- C:\Windows\System\RwCCTCG.exe
  C:\Windows\System\RwCCTCG.exe
  2⤵
  PID:2084
- C:\Windows\System\wjOelfN.exe
  C:\Windows\System\wjOelfN.exe
  2⤵
  PID:6512
- C:\Windows\System\VCMoZaM.exe
  C:\Windows\System\VCMoZaM.exe
  2⤵
  PID:6008
- C:\Windows\System\hRybOCE.exe
  C:\Windows\System\hRybOCE.exe
  2⤵
  PID:5744
- C:\Windows\System\CBWrRaF.exe
  C:\Windows\System\CBWrRaF.exe
  2⤵
  PID:8412
- C:\Windows\System\ggmiQjU.exe
  C:\Windows\System\ggmiQjU.exe
  2⤵
  PID:5496
- C:\Windows\System\YkwxpSp.exe
  C:\Windows\System\YkwxpSp.exe
  2⤵
  PID:6948
- C:\Windows\System\BhDQveq.exe
  C:\Windows\System\BhDQveq.exe
  2⤵
  PID:6772
- C:\Windows\System\gexscjx.exe
  C:\Windows\System\gexscjx.exe
  2⤵
  PID:5492
- C:\Windows\System\WNrHcYQ.exe
  C:\Windows\System\WNrHcYQ.exe
  2⤵
  PID:7056
- C:\Windows\System\rAEomlR.exe
  C:\Windows\System\rAEomlR.exe
  2⤵
  PID:4984
- C:\Windows\System\VDvkpAl.exe
  C:\Windows\System\VDvkpAl.exe
  2⤵
  PID:6080
- C:\Windows\System\tBMOFoT.exe
  C:\Windows\System\tBMOFoT.exe
  2⤵
  PID:6544
- C:\Windows\System\gMaQNVl.exe
  C:\Windows\System\gMaQNVl.exe
  2⤵
  PID:5160
- C:\Windows\System\ARSZvMz.exe
  C:\Windows\System\ARSZvMz.exe
  2⤵
  PID:4512
- C:\Windows\System\vvNDewJ.exe
  C:\Windows\System\vvNDewJ.exe
  2⤵
  PID:5552
- C:\Windows\System\bepxhPY.exe
  C:\Windows\System\bepxhPY.exe
  2⤵
  PID:7016
- C:\Windows\System\MEjMHUH.exe
  C:\Windows\System\MEjMHUH.exe
  2⤵
  PID:7100
- C:\Windows\System\ETUlDEe.exe
  C:\Windows\System\ETUlDEe.exe
  2⤵
  PID:7320
- C:\Windows\System\ygMfLBs.exe
  C:\Windows\System\ygMfLBs.exe
  2⤵
  PID:6640
- C:\Windows\System\DOhkGTh.exe
  C:\Windows\System\DOhkGTh.exe
  2⤵
  PID:876
- C:\Windows\System\MpONKEm.exe
  C:\Windows\System\MpONKEm.exe
  2⤵
  PID:1364
- C:\Windows\System\SQQwuWa.exe
  C:\Windows\System\SQQwuWa.exe
  2⤵
  PID:5816
- C:\Windows\System\hYTpiaQ.exe
  C:\Windows\System\hYTpiaQ.exe
  2⤵
  PID:7688
- C:\Windows\System\MOubtbb.exe
  C:\Windows\System\MOubtbb.exe
  2⤵
  PID:7000
- C:\Windows\System\EtsQSyU.exe
  C:\Windows\System\EtsQSyU.exe
  2⤵
  PID:1636
- C:\Windows\System\NWVKsXH.exe
  C:\Windows\System\NWVKsXH.exe
  2⤵
  PID:6468
- C:\Windows\System\eQlZSbs.exe
  C:\Windows\System\eQlZSbs.exe
  2⤵
  PID:3008
- C:\Windows\System\nipHpuj.exe
  C:\Windows\System\nipHpuj.exe
  2⤵
  PID:6808
- C:\Windows\System\ZGIDdbi.exe
  C:\Windows\System\ZGIDdbi.exe
  2⤵
  PID:7892
- C:\Windows\System\JAlmqHV.exe
  C:\Windows\System\JAlmqHV.exe
  2⤵
  PID:6548
- C:\Windows\System\epDHsIm.exe
  C:\Windows\System\epDHsIm.exe
  2⤵
  PID:1948
- C:\Windows\System\pGJuZRN.exe
  C:\Windows\System\pGJuZRN.exe
  2⤵
  PID:9124
- C:\Windows\System\KamnmZS.exe
  C:\Windows\System\KamnmZS.exe
  2⤵
  PID:7592
- C:\Windows\System\FlwDWVk.exe
  C:\Windows\System\FlwDWVk.exe
  2⤵
  PID:4060
- C:\Windows\System\mEaydgf.exe
  C:\Windows\System\mEaydgf.exe
  2⤵
  PID:3748
- C:\Windows\System\dbIQzVN.exe
  C:\Windows\System\dbIQzVN.exe
  2⤵
  PID:6164
- C:\Windows\System\sleyWpN.exe
  C:\Windows\System\sleyWpN.exe
  2⤵
  PID:6724
- C:\Windows\System\MajSQYC.exe
  C:\Windows\System\MajSQYC.exe
  2⤵
  PID:8128
- C:\Windows\System\zeXrcdd.exe
  C:\Windows\System\zeXrcdd.exe
  2⤵
  PID:4088
- C:\Windows\System\gUilJnA.exe
  C:\Windows\System\gUilJnA.exe
  2⤵
  PID:14148
- C:\Windows\System\zjCrkNh.exe
  C:\Windows\System\zjCrkNh.exe
  2⤵
  PID:7612
- C:\Windows\System\oTOjnhr.exe
  C:\Windows\System\oTOjnhr.exe
  2⤵
  PID:7212
- C:\Windows\System\nCfhEzz.exe
  C:\Windows\System\nCfhEzz.exe
  2⤵
  PID:5480
- C:\Windows\System\SlROnbO.exe
  C:\Windows\System\SlROnbO.exe
  2⤵
  PID:9284
- C:\Windows\System\cWcAHfJ.exe
  C:\Windows\System\cWcAHfJ.exe
  2⤵
  PID:8376
- C:\Windows\System\jprxCNp.exe
  C:\Windows\System\jprxCNp.exe
  2⤵
  PID:8864
- C:\Windows\System\OATItGL.exe
  C:\Windows\System\OATItGL.exe
  2⤵
  PID:3048
- C:\Windows\System\QiqCnuf.exe
  C:\Windows\System\QiqCnuf.exe
  2⤵
  PID:9280
- C:\Windows\System\QSCXomX.exe
  C:\Windows\System\QSCXomX.exe
  2⤵
  PID:5188
- C:\Windows\System\OgoWQgl.exe
  C:\Windows\System\OgoWQgl.exe
  2⤵
  PID:8884
- C:\Windows\System\igfepMY.exe
  C:\Windows\System\igfepMY.exe
  2⤵
  PID:6384
- C:\Windows\System\oIhDAwc.exe
  C:\Windows\System\oIhDAwc.exe
  2⤵
  PID:6988
- C:\Windows\System\Tvqbxse.exe
  C:\Windows\System\Tvqbxse.exe
  2⤵
  PID:8556
- C:\Windows\System\tOjlgas.exe
  C:\Windows\System\tOjlgas.exe
  2⤵
  PID:9248
- C:\Windows\System\EdJtWOi.exe
  C:\Windows\System\EdJtWOi.exe
  2⤵
  PID:9376
- C:\Windows\System\ZLWALYE.exe
  C:\Windows\System\ZLWALYE.exe
  2⤵
  PID:8440
- C:\Windows\System\fSzVvnG.exe
  C:\Windows\System\fSzVvnG.exe
  2⤵
  PID:8348
- C:\Windows\System\TIiSlIb.exe
  C:\Windows\System\TIiSlIb.exe
  2⤵
  PID:9308
- C:\Windows\System\usEbiEg.exe
  C:\Windows\System\usEbiEg.exe
  2⤵
  PID:7420
- C:\Windows\System\kXHEOmj.exe
  C:\Windows\System\kXHEOmj.exe
  2⤵
  PID:3444
- C:\Windows\System\znCVVhj.exe
  C:\Windows\System\znCVVhj.exe
  2⤵
  PID:9520
- C:\Windows\System\fHkGaeg.exe
  C:\Windows\System\fHkGaeg.exe
  2⤵
  PID:6908
- C:\Windows\System\sWGwHht.exe
  C:\Windows\System\sWGwHht.exe
  2⤵
  PID:3320
- C:\Windows\System\eCGhjbo.exe
  C:\Windows\System\eCGhjbo.exe
  2⤵
  PID:6976
- C:\Windows\System\IxdcRfJ.exe
  C:\Windows\System\IxdcRfJ.exe
  2⤵
  PID:8288
- C:\Windows\System\Faixuio.exe
  C:\Windows\System\Faixuio.exe
  2⤵
  PID:10252
- C:\Windows\System\vneaCys.exe
  C:\Windows\System\vneaCys.exe
  2⤵
  PID:10352
- C:\Windows\System\kkCnHJW.exe
  C:\Windows\System\kkCnHJW.exe
  2⤵
  PID:13840
- C:\Windows\System\dOjESTJ.exe
  C:\Windows\System\dOjESTJ.exe
  2⤵
  PID:9348
- C:\Windows\System\tzaKoXE.exe
  C:\Windows\System\tzaKoXE.exe
  2⤵
  PID:3872
- C:\Windows\System\uDWCsYc.exe
  C:\Windows\System\uDWCsYc.exe
  2⤵
  PID:9420
- C:\Windows\System\iGCWqVu.exe
  C:\Windows\System\iGCWqVu.exe
  2⤵
  PID:10088
- C:\Windows\System\GjCGgYI.exe
  C:\Windows\System\GjCGgYI.exe
  2⤵
  PID:8676
- C:\Windows\System\sbelOLa.exe
  C:\Windows\System\sbelOLa.exe
  2⤵
  PID:9352
- C:\Windows\System\rOWsXeY.exe
  C:\Windows\System\rOWsXeY.exe
  2⤵
  PID:9988
- C:\Windows\System\OKhmzhU.exe
  C:\Windows\System\OKhmzhU.exe
  2⤵
  PID:7192
- C:\Windows\System\kMIgTvZ.exe
  C:\Windows\System\kMIgTvZ.exe
  2⤵
  PID:6768
- C:\Windows\System\vzMlrIg.exe
  C:\Windows\System\vzMlrIg.exe
  2⤵
  PID:9476
- C:\Windows\System\YUqdrsp.exe
  C:\Windows\System\YUqdrsp.exe
  2⤵
  PID:10800
- C:\Windows\System\nhlevht.exe
  C:\Windows\System\nhlevht.exe
  2⤵
  PID:9780
- C:\Windows\System\KZkZUsX.exe
  C:\Windows\System\KZkZUsX.exe
  2⤵
  PID:7964
- C:\Windows\System\qzCemRA.exe
  C:\Windows\System\qzCemRA.exe
  2⤵
  PID:10308
- C:\Windows\System\GUcEFBz.exe
  C:\Windows\System\GUcEFBz.exe
  2⤵
  PID:8816
- C:\Windows\System\CZvSqep.exe
  C:\Windows\System\CZvSqep.exe
  2⤵
  PID:14832
- C:\Windows\System\VFJZxjZ.exe
  C:\Windows\System\VFJZxjZ.exe
  2⤵
  PID:14936
- C:\Windows\System\tyCXTzN.exe
  C:\Windows\System\tyCXTzN.exe
  2⤵
  PID:14956
- C:\Windows\System\oYtOkiO.exe
  C:\Windows\System\oYtOkiO.exe
  2⤵
  PID:14976
- C:\Windows\System\QfdlGbt.exe
  C:\Windows\System\QfdlGbt.exe
  2⤵
  PID:14996
- C:\Windows\System\fsOUaKY.exe
  C:\Windows\System\fsOUaKY.exe
  2⤵
  PID:15016
- C:\Windows\System\aoGoMuI.exe
  C:\Windows\System\aoGoMuI.exe
  2⤵
  PID:15056
- C:\Windows\System\trYpKEU.exe
  C:\Windows\System\trYpKEU.exe
  2⤵
  PID:15088
- C:\Windows\System\iPmUdBM.exe
  C:\Windows\System\iPmUdBM.exe
  2⤵
  PID:15112
- C:\Windows\System\tKEcNrj.exe
  C:\Windows\System\tKEcNrj.exe
  2⤵
  PID:15128
- C:\Windows\System\iluJEHO.exe
  C:\Windows\System\iluJEHO.exe
  2⤵
  PID:15148
- C:\Windows\System\JPEcNjx.exe
  C:\Windows\System\JPEcNjx.exe
  2⤵
  PID:15180
- C:\Windows\System\oeAgtdc.exe
  C:\Windows\System\oeAgtdc.exe
  2⤵
  PID:15196
- C:\Windows\System\ifuocYb.exe
  C:\Windows\System\ifuocYb.exe
  2⤵
  PID:15216
- C:\Windows\System\SCbcfgc.exe
  C:\Windows\System\SCbcfgc.exe
  2⤵
  PID:15240
- C:\Windows\System\AifyhqQ.exe
  C:\Windows\System\AifyhqQ.exe
  2⤵
  PID:15260
- C:\Windows\System\MMkWpCt.exe
  C:\Windows\System\MMkWpCt.exe
  2⤵
  PID:15284
- C:\Windows\System\QbOqGAc.exe
  C:\Windows\System\QbOqGAc.exe
  2⤵
  PID:15304
- C:\Windows\System\HLmMFxq.exe
  C:\Windows\System\HLmMFxq.exe
  2⤵
  PID:15324
- C:\Windows\System\vpmxAbW.exe
  C:\Windows\System\vpmxAbW.exe
  2⤵
  PID:15348
- C:\Windows\System\BKFqxcZ.exe
  C:\Windows\System\BKFqxcZ.exe
  2⤵
  PID:11080
- C:\Windows\System\QRwUStp.exe
  C:\Windows\System\QRwUStp.exe
  2⤵
  PID:10828
- C:\Windows\System\CjUZlSW.exe
  C:\Windows\System\CjUZlSW.exe
  2⤵
  PID:9888
- C:\Windows\System\xgIHIYy.exe
  C:\Windows\System\xgIHIYy.exe
  2⤵
  PID:8700
- C:\Windows\System\EYZghro.exe
  C:\Windows\System\EYZghro.exe
  2⤵
  PID:10416
- C:\Windows\System\XtVZtZT.exe
  C:\Windows\System\XtVZtZT.exe
  2⤵
  PID:10112
- C:\Windows\System\fThCynW.exe
  C:\Windows\System\fThCynW.exe
  2⤵
  PID:4812
- C:\Windows\System\GJaFkwz.exe
  C:\Windows\System\GJaFkwz.exe
  2⤵
  PID:10588
- C:\Windows\System\PeEDyel.exe
  C:\Windows\System\PeEDyel.exe
  2⤵
  PID:8472
- C:\Windows\System\ScMtUcs.exe
  C:\Windows\System\ScMtUcs.exe
  2⤵
  PID:9448
- C:\Windows\System\hZPacVH.exe
  C:\Windows\System\hZPacVH.exe
  2⤵
  PID:14528
- C:\Windows\System\rlsYsEa.exe
  C:\Windows\System\rlsYsEa.exe
  2⤵
  PID:14540
- C:\Windows\System\JpaumUo.exe
  C:\Windows\System\JpaumUo.exe
  2⤵
  PID:14380
- C:\Windows\System\XYRQlCE.exe
  C:\Windows\System\XYRQlCE.exe
  2⤵
  PID:14564
- C:\Windows\System\GqOEwZk.exe
  C:\Windows\System\GqOEwZk.exe
  2⤵
  PID:8736
- C:\Windows\System\IyRWzqU.exe
  C:\Windows\System\IyRWzqU.exe
  2⤵
  PID:14432
- C:\Windows\System\OITmxLW.exe
  C:\Windows\System\OITmxLW.exe
  2⤵
  PID:6880
- C:\Windows\System\UFLQUkM.exe
  C:\Windows\System\UFLQUkM.exe
  2⤵
  PID:7840
- C:\Windows\System\BDUnkBk.exe
  C:\Windows\System\BDUnkBk.exe
  2⤵
  PID:10296
- C:\Windows\System\iFMRklC.exe
  C:\Windows\System\iFMRklC.exe
  2⤵
  PID:14676
- C:\Windows\System\fKXXhwl.exe
  C:\Windows\System\fKXXhwl.exe
  2⤵
  PID:8096
- C:\Windows\System\lSPUnUM.exe
  C:\Windows\System\lSPUnUM.exe
  2⤵
  PID:14576
- C:\Windows\System\dhUrZsa.exe
  C:\Windows\System\dhUrZsa.exe
  2⤵
  PID:14684
- C:\Windows\System\gGcFbmE.exe
  C:\Windows\System\gGcFbmE.exe
  2⤵
  PID:14928
- C:\Windows\System\hOJnlVc.exe
  C:\Windows\System\hOJnlVc.exe
  2⤵
  PID:14732
- C:\Windows\System\pswYBFX.exe
  C:\Windows\System\pswYBFX.exe
  2⤵
  PID:14804
- C:\Windows\System\lZtKwRF.exe
  C:\Windows\System\lZtKwRF.exe
  2⤵
  PID:8172
- C:\Windows\System\VDdGZAm.exe
  C:\Windows\System\VDdGZAm.exe
  2⤵
  PID:15144
- C:\Windows\System\nZCEUGY.exe
  C:\Windows\System\nZCEUGY.exe
  2⤵
  PID:15028
- C:\Windows\System\iMcfyne.exe
  C:\Windows\System\iMcfyne.exe
  2⤵
  PID:11480
- C:\Windows\System\hfdmqVu.exe
  C:\Windows\System\hfdmqVu.exe
  2⤵
  PID:15212
- C:\Windows\System\xTNBcBR.exe
  C:\Windows\System\xTNBcBR.exe
  2⤵
  PID:15108
- C:\Windows\System\YXUDLyY.exe
  C:\Windows\System\YXUDLyY.exe
  2⤵
  PID:15248
- C:\Windows\System\YUzDjIF.exe
  C:\Windows\System\YUzDjIF.exe
  2⤵
  PID:15156
- C:\Windows\System\pCggwPo.exe
  C:\Windows\System\pCggwPo.exe
  2⤵
  PID:15012
- C:\Windows\System\WQrnBdM.exe
  C:\Windows\System\WQrnBdM.exe
  2⤵
  PID:15300
- C:\Windows\System\DyuOFQe.exe
  C:\Windows\System\DyuOFQe.exe
  2⤵
  PID:15316
- C:\Windows\System\SKezJWl.exe
  C:\Windows\System\SKezJWl.exe
  2⤵
  PID:7316
- C:\Windows\System\idYFbnr.exe
  C:\Windows\System\idYFbnr.exe
  2⤵
  PID:11556
- C:\Windows\System\KzxDzyS.exe
  C:\Windows\System\KzxDzyS.exe
  2⤵
  PID:15256
- C:\Windows\System\bjSIudX.exe
  C:\Windows\System\bjSIudX.exe
  2⤵
  PID:11504
- C:\Windows\System\XRcoGkH.exe
  C:\Windows\System\XRcoGkH.exe
  2⤵
  PID:11948
- C:\Windows\System\vVyHLZx.exe
  C:\Windows\System\vVyHLZx.exe
  2⤵
  PID:11400
- C:\Windows\System\PUyixTa.exe
  C:\Windows\System\PUyixTa.exe
  2⤵
  PID:11712
- C:\Windows\System\CmJGblb.exe
  C:\Windows\System\CmJGblb.exe
  2⤵
  PID:11560
- C:\Windows\System\dCrHQpk.exe
  C:\Windows\System\dCrHQpk.exe
  2⤵
  PID:7296
- C:\Windows\System\FKiEyLq.exe
  C:\Windows\System\FKiEyLq.exe
  2⤵
  PID:10728
- C:\Windows\System\NgkqeGM.exe
  C:\Windows\System\NgkqeGM.exe
  2⤵
  PID:15296
- C:\Windows\System\lPGqOdL.exe
  C:\Windows\System\lPGqOdL.exe
  2⤵
  PID:4336
- C:\Windows\System\ibXvmwu.exe
  C:\Windows\System\ibXvmwu.exe
  2⤵
  PID:14608
- C:\Windows\System\VOGrnxi.exe
  C:\Windows\System\VOGrnxi.exe
  2⤵
  PID:14424
- C:\Windows\System\zALfIvZ.exe
  C:\Windows\System\zALfIvZ.exe
  2⤵
  PID:14508
- C:\Windows\System\GjBHldM.exe
  C:\Windows\System\GjBHldM.exe
  2⤵
  PID:11592
- C:\Windows\System\tEGMTgW.exe
  C:\Windows\System\tEGMTgW.exe
  2⤵
  PID:14496
- C:\Windows\System\uJXnnlF.exe
  C:\Windows\System\uJXnnlF.exe
  2⤵
  PID:14572
- C:\Windows\System\vqUqkux.exe
  C:\Windows\System\vqUqkux.exe
  2⤵
  PID:12156
- C:\Windows\System\cGLduLQ.exe
  C:\Windows\System\cGLduLQ.exe
  2⤵
  PID:11364
- C:\Windows\System\TyUZJYt.exe
  C:\Windows\System\TyUZJYt.exe
  2⤵
  PID:9132
- C:\Windows\System\YqBhxRl.exe
  C:\Windows\System\YqBhxRl.exe
  2⤵
  PID:8636
- C:\Windows\System\oFxKVgJ.exe
  C:\Windows\System\oFxKVgJ.exe
  2⤵
  PID:10584
- C:\Windows\System\OMPdWYh.exe
  C:\Windows\System\OMPdWYh.exe
  2⤵
  PID:11760
- C:\Windows\System\zPKzHdM.exe
  C:\Windows\System\zPKzHdM.exe
  2⤵
  PID:11388
- C:\Windows\System\iPTKSdi.exe
  C:\Windows\System\iPTKSdi.exe
  2⤵
  PID:11880
- C:\Windows\System\FGRuBcG.exe
  C:\Windows\System\FGRuBcG.exe
  2⤵
  PID:11036
- C:\Windows\System\hfHmKMG.exe
  C:\Windows\System\hfHmKMG.exe
  2⤵
  PID:11424
- C:\Windows\System\nHfyYfp.exe
  C:\Windows\System\nHfyYfp.exe
  2⤵
  PID:7432
- C:\Windows\System\vGEydLS.exe
  C:\Windows\System\vGEydLS.exe
  2⤵
  PID:11496
- C:\Windows\System\gfZTiZN.exe
  C:\Windows\System\gfZTiZN.exe
  2⤵
  PID:11136
- C:\Windows\System\VJiSsGZ.exe
  C:\Windows\System\VJiSsGZ.exe
  2⤵
  PID:11816
- C:\Windows\System\JknLZEi.exe
  C:\Windows\System\JknLZEi.exe
  2⤵
  PID:11928
- C:\Windows\System\agxiLOC.exe
  C:\Windows\System\agxiLOC.exe
  2⤵
  PID:15168
- C:\Windows\System\OWqVbci.exe
  C:\Windows\System\OWqVbci.exe
  2⤵
  PID:11800
- C:\Windows\System\snbpQwj.exe
  C:\Windows\System\snbpQwj.exe
  2⤵
  PID:8392
- C:\Windows\System\CWYfZUO.exe
  C:\Windows\System\CWYfZUO.exe
  2⤵
  PID:14872
- C:\Windows\System\OwnOwAv.exe
  C:\Windows\System\OwnOwAv.exe
  2⤵
  PID:11628
- C:\Windows\System\qWeEMie.exe
  C:\Windows\System\qWeEMie.exe
  2⤵
  PID:9608
- C:\Windows\System\bVWDZDW.exe
  C:\Windows\System\bVWDZDW.exe
  2⤵
  PID:12140
- C:\Windows\System\wwhiCQR.exe
  C:\Windows\System\wwhiCQR.exe
  2⤵
  PID:5268
- C:\Windows\System\xYilQUu.exe
  C:\Windows\System\xYilQUu.exe
  2⤵
  PID:14388
- C:\Windows\System\JdBOnqs.exe
  C:\Windows\System\JdBOnqs.exe
  2⤵
  PID:10048
- C:\Windows\System\CErmJGj.exe
  C:\Windows\System\CErmJGj.exe
  2⤵
  PID:9192
- C:\Windows\System\JeCeXeq.exe
  C:\Windows\System\JeCeXeq.exe
  2⤵
  PID:11776
- C:\Windows\System\DlrFvia.exe
  C:\Windows\System\DlrFvia.exe
  2⤵
  PID:11920
- C:\Windows\System\YsXjrpE.exe
  C:\Windows\System\YsXjrpE.exe
  2⤵
  PID:9344
- C:\Windows\System\vqSeZOG.exe
  C:\Windows\System\vqSeZOG.exe
  2⤵
  PID:12136
- C:\Windows\System\AwbTZPU.exe
  C:\Windows\System\AwbTZPU.exe
  2⤵
  PID:14300
- C:\Windows\System\OsznqOk.exe
  C:\Windows\System\OsznqOk.exe
  2⤵
  PID:11004
- C:\Windows\System\sLDdcyc.exe
  C:\Windows\System\sLDdcyc.exe
  2⤵
  PID:11044
- C:\Windows\System\VsBFcSO.exe
  C:\Windows\System\VsBFcSO.exe
  2⤵
  PID:11224
- C:\Windows\System\FZnhKwH.exe
  C:\Windows\System\FZnhKwH.exe
  2⤵
  PID:11084
- C:\Windows\System\sBIDfyw.exe
  C:\Windows\System\sBIDfyw.exe
  2⤵
  PID:7076
- C:\Windows\System\oJUgciu.exe
  C:\Windows\System\oJUgciu.exe
  2⤵
  PID:11780
- C:\Windows\System\fQimINs.exe
  C:\Windows\System\fQimINs.exe
  2⤵
  PID:11420
- C:\Windows\System\OKdhdEQ.exe
  C:\Windows\System\OKdhdEQ.exe
  2⤵
  PID:12568
- C:\Windows\System\uwbxwzD.exe
  C:\Windows\System\uwbxwzD.exe
  2⤵
  PID:12656
- C:\Windows\System\jptGTZb.exe
  C:\Windows\System\jptGTZb.exe
  2⤵
  PID:7788
- C:\Windows\System\WUheAPx.exe
  C:\Windows\System\WUheAPx.exe
  2⤵
  PID:11600
- C:\Windows\System\lmMabPM.exe
  C:\Windows\System\lmMabPM.exe
  2⤵
  PID:11064
- C:\Windows\System\xNLogCd.exe
  C:\Windows\System\xNLogCd.exe
  2⤵
  PID:12928
- C:\Windows\System\gxkcDQA.exe
  C:\Windows\System\gxkcDQA.exe
  2⤵
  PID:15236
- C:\Windows\System\HUoUIAd.exe
  C:\Windows\System\HUoUIAd.exe
  2⤵
  PID:14844
- C:\Windows\System\iibxUuw.exe
  C:\Windows\System\iibxUuw.exe
  2⤵
  PID:13060
- C:\Windows\System\bQlGbqa.exe
  C:\Windows\System\bQlGbqa.exe
  2⤵
  PID:6316
- C:\Windows\System\FYJKuwJ.exe
  C:\Windows\System\FYJKuwJ.exe
  2⤵
  PID:12660
- C:\Windows\System\QeaTBvE.exe
  C:\Windows\System\QeaTBvE.exe
  2⤵
  PID:14904
- C:\Windows\System\uJMOFLm.exe
  C:\Windows\System\uJMOFLm.exe
  2⤵
  PID:12096
- C:\Windows\System\ReCVswX.exe
  C:\Windows\System\ReCVswX.exe
  2⤵
  PID:11836
- C:\Windows\System\HJurwgR.exe
  C:\Windows\System\HJurwgR.exe
  2⤵
  PID:10904
- C:\Windows\System\eFcCBZo.exe
  C:\Windows\System\eFcCBZo.exe
  2⤵
  PID:212
- C:\Windows\System\CcYuXTH.exe
  C:\Windows\System\CcYuXTH.exe
  2⤵
  PID:10200
- C:\Windows\System\jUaaTYU.exe
  C:\Windows\System\jUaaTYU.exe
  2⤵
  PID:11236
- C:\Windows\System\KsZrKtC.exe
  C:\Windows\System\KsZrKtC.exe
  2⤵
  PID:15176
- C:\Windows\System\nTuhdaU.exe
  C:\Windows\System\nTuhdaU.exe
  2⤵
  PID:9288
- C:\Windows\System\ZAHHTWz.exe
  C:\Windows\System\ZAHHTWz.exe
  2⤵
  PID:5116
- C:\Windows\System\pYsEyow.exe
  C:\Windows\System\pYsEyow.exe
  2⤵
  PID:10820
- C:\Windows\System\RlOAglQ.exe
  C:\Windows\System\RlOAglQ.exe
  2⤵
  PID:12092
- C:\Windows\System\pFzJpWq.exe
  C:\Windows\System\pFzJpWq.exe
  2⤵
  PID:14624
- C:\Windows\System\SaeGFgW.exe
  C:\Windows\System\SaeGFgW.exe
  2⤵
  PID:10236
- C:\Windows\System\pPBYXby.exe
  C:\Windows\System\pPBYXby.exe
  2⤵
  PID:12316
- C:\Windows\System\qLaWpPh.exe
  C:\Windows\System\qLaWpPh.exe
  2⤵
  PID:10688
- C:\Windows\System\sIsXbfA.exe
  C:\Windows\System\sIsXbfA.exe
  2⤵
  PID:8524
- C:\Windows\System\zcfGydV.exe
  C:\Windows\System\zcfGydV.exe
  2⤵
  PID:10860
- C:\Windows\System\jExwWZC.exe
  C:\Windows\System\jExwWZC.exe
  2⤵
  PID:12260
- C:\Windows\System\ILftKrF.exe
  C:\Windows\System\ILftKrF.exe
  2⤵
  PID:12032
- C:\Windows\System\AKtFRXg.exe
  C:\Windows\System\AKtFRXg.exe
  2⤵
  PID:11892
- C:\Windows\System\HvBxwdv.exe
  C:\Windows\System\HvBxwdv.exe
  2⤵
  PID:11344
- C:\Windows\System\jlotseo.exe
  C:\Windows\System\jlotseo.exe
  2⤵
  PID:11128
- C:\Windows\System\AaaMuof.exe
  C:\Windows\System\AaaMuof.exe
  2⤵
  PID:11612
- C:\Windows\System\lornKXS.exe
  C:\Windows\System\lornKXS.exe
  2⤵
  PID:10548
- C:\Windows\System\WRSjoHq.exe
  C:\Windows\System\WRSjoHq.exe
  2⤵
  PID:9604
- C:\Windows\System\ZBDxdjL.exe
  C:\Windows\System\ZBDxdjL.exe
  2⤵
  PID:11568
- C:\Windows\System\fJfkNKF.exe
  C:\Windows\System\fJfkNKF.exe
  2⤵
  PID:8656
- C:\Windows\System\AhQkHtp.exe
  C:\Windows\System\AhQkHtp.exe
  2⤵
  PID:8536
- C:\Windows\System\hgvczNJ.exe
  C:\Windows\System\hgvczNJ.exe
  2⤵
  PID:12084
- C:\Windows\System\RjxKlFP.exe
  C:\Windows\System\RjxKlFP.exe
  2⤵
  PID:10292
- C:\Windows\System\vcRfSLB.exe
  C:\Windows\System\vcRfSLB.exe
  2⤵
  PID:11000
- C:\Windows\System\ikAdgZJ.exe
  C:\Windows\System\ikAdgZJ.exe
  2⤵
  PID:12600
- C:\Windows\System\wvsJchV.exe
  C:\Windows\System\wvsJchV.exe
  2⤵
  PID:13080

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=2900,i,17325488789339133686,9539570259395798500,262144 --variations-seed-version --mojo-platform-channel-handle=4448 /prefetch:8
1⤵
PID:3644

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
- Suspicious use of FindShellTrayWindow
PID:13236

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:13016

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:4472

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:14056

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:7396

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:12932

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_yp4rjj0i.pcn.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\AsVdkXA.exe

Filesize
1.9MB

MD5
d67d4baa504270b38e4237249c4679ff

SHA1
13fb950f8c178d965ed23e494a623e0907b7d5e5

SHA256
829c9c79b0fbd019b78bcdf8f21e725d62674f82643b5c04c4ba2e1cbb37489d

SHA512
1406d330cb3fd537c74a46f5afa3298ade0ad7cc1cf9d6eba368e17e19751b91f2a9760b67c52f42a2135016f6903c7b17827305dd4cb07535cb949929289d03

Download Submit
C:\Windows\System\BxPPYqw.exe

Filesize
8B

MD5
910de5e4823f1b594342aaa45a243c27

SHA1
e685fe344492ae089d7952151010d07f38420dbc

SHA256
35ac8b6a943f09a1cde24cd02afff8a0c7d652f165d54e16f6413276f4896cb0

SHA512
734b56228ae9283d7a41492191ea523ba29a1fabe1bd71428c57f89031a65c2affd92f940176ff946aa90efb62794a49b666566dba8320bb35feeeb83e9c2a4f

Download Submit
C:\Windows\System\DOpiBca.exe

Filesize
1.9MB

MD5
886011257f496c7c4eb74096dcd41c59

SHA1
072f68fd119cf372739b6397c10a3b55a3c92dfd

SHA256
15d4793421aafa7e5b5a927b7fb0f718459d1d5d58bcf92255d607758b3a4347

SHA512
e52ad0618f3b9692a9f8e2503e7f5ca8cfe39ef669fb38e581da920d3f9df3fb78031e96f6532c272bd03a820d60fc55612274cc2dcb0b4535545ba00461ae22

Download Submit
C:\Windows\System\EIgAgbV.exe

Filesize
18B

MD5
b02e9d05e686e129bef05d00ff5203c3

SHA1
e698aa4adc847d754b01445cc92d3a936eccd81f

SHA256
2919f5d8dd5986d9f526c9a7657a6044cc4722033b9b179436129a1b2c29a7ef

SHA512
497cfb1093b4d57bd1ca17f696a7734788d13484dbf26768c2397dc958c254adf1d920ff41694a8e8f487ef695df48cfa4dee2cc40c4be8b8dc4c01a0c0839c3

Download Submit
C:\Windows\System\ELRRuMQ.exe

Filesize
1.9MB

MD5
6464684538fdbeb3fc318262d3c8cfc4

SHA1
8fe2c3959904bf1a1de332ffa24160f5dfd5d039

SHA256
7be128f4559c790007564e658350e5f277176da3ab2d77af514654f11e6a858e

SHA512
0e41edb001748f3904995235e0846598ee9bf07a7fe69c0b744dac58ca22e363bc47a0c71240084e41e910c626e91fba8a2cddbaed5215dd5ba3d9b3c7700cac

Download Submit
C:\Windows\System\GCrybEG.exe

Filesize
1.9MB

MD5
a6a67f241b8294d68fcef254c3bd9274

SHA1
faf6c02b8654a080d1d6c52cf15af6788f97eb60

SHA256
7c446996a98e9a80163640fc219859ff2f1afe2d31cf42f5e8b5c07d8e8136c2

SHA512
241c45471bb4809bb22fc24ca8ac85019d50245465ff2c131566a9d461ceef0f69da13037fa7a0a53d442932761e9e08f64a2e9d6677de6391948bd127db3fde

Download Submit
C:\Windows\System\GbYXlYd.exe

Filesize
1.9MB

MD5
cabd040d045c0087e6d24d1c3b6ba527

SHA1
db99a8bb069d6207af604e55392372952c804451

SHA256
8c9f2a5c00633962fd9f2034035226e19540d4d2f99dacfc01f5bdb89dc6bcff

SHA512
8265032bcc1b2fd41b6ae52259f7098b1efe25bf6db75310e77dbf3ffe8e6e485cd35b9921f641a1160ea959fb727e185a98cfd2b14fae9571f30e26ae38e578

Download Submit
C:\Windows\System\ItdiEvO.exe

Filesize
1.9MB

MD5
f60845d683b23dfc62cfbde5b51e58c2

SHA1
165eb00ddf8d52f12c2da72dab2ed30f90b44856

SHA256
869e8bf1980150f0af5055c2847b788da58fa025145cbcb7d8667b62d62c719d

SHA512
b6030c1fba2952e93aefd77bc5fa6676d40430c738f08d536066241fc247205e16442aa16861646c827590f41472472cdc2cb1123c97a9293a5e3d46b9912cd6

Download Submit
C:\Windows\System\JTmSWYW.exe

Filesize
1.9MB

MD5
10f7e927918f8b5f0b1f199be4a4bbc9

SHA1
7bc5c45d5857f8d1bb1f69a1691e0adbfb44fc1a

SHA256
98f919f9034997f0566270252fa8b47d95ad3a91388ffa90f6e18afee059088b

SHA512
8988d95c80828f3cb30b3f9ddfd3d60ad5c992bff7f028f5fb9a36e3c8d6a334934cc3759026b212fc9d9e02b3eb290a6636c45dcc1c351aa6641f10b9fc8031

Download Submit
C:\Windows\System\JsHbvLH.exe

Filesize
1.9MB

MD5
0de92e8da1950bd763d2607035314bf4

SHA1
2f7592eab65f908e36cf9af93fc14c442571572d

SHA256
432e5a35360cd545cc459fe0c7e758801ff6c697c3b47df8182d62a89b5760c0

SHA512
d9c09a655247920db8d914edc021bd81da539b4db6b0e6d831790199d807d0063cf7564c0d6c9d45f1296a7110b75d33d08e77b7ebcec745592891a81e1d4c5d

Download Submit
C:\Windows\System\LjZxhih.exe

Filesize
1.9MB

MD5
1e04f9312438198133e20c7526339aa2

SHA1
9729d5759e2a06b586af826e799a084f2f620bc1

SHA256
e16cb9dbaafab0a5a7361746a44325520e11ce7977a1f2c6575fc9190e719de8

SHA512
a80fdff3945b150b789aedab931872c7920280690237e64e7d345180c3af5dc72582e25cdc8973f239903288d696b44790d412048132ec7c499970c12f179cc4

Download Submit
C:\Windows\System\NAGJPRo.exe

Filesize
1.9MB

MD5
508086205850efd31bf86b7b05d6fdf4

SHA1
e0e63ba9f7413ac46d10e4e3af2cd7fc2d799c60

SHA256
6b6108b423e84d055e1ad421938a1f63ccecffb0a6629685b300d607d80ca7cb

SHA512
e517b4bba0ee31dd5921df14cc20a2e61d9ec6f6192c2945386e79e685c663fc0ebc521e3e1b49dec5b9661db0efbffd1797832e21108531aeb373fccb3c6980

Download Submit
C:\Windows\System\NnTaoMZ.exe

Filesize
1.9MB

MD5
29a015d1acd84501e61e126d2a977b24

SHA1
a9f413cf37f84efccc5459c4571928ac53c144c7

SHA256
18712b526de7b092ca30b7b4ef5720d41c348f958769ba6d511fb923da576211

SHA512
ab0be65e1fae3bd1fa86d9a2d9e64f69379f18ac416d47dce3e02f181552770d9cdcf6b4d79e4fbbc7c1eaa8c4d9c7ad6ccab519fbf0c5b6f3e8fcf6638a7ca6

Download Submit
C:\Windows\System\OwJfqHt.exe

Filesize
1.9MB

MD5
9b0e4bf1f1814fa604a435b3a8d89eb3

SHA1
0daf6b77f779394deeef871cc33f0961cdd5645d

SHA256
abbde90a2a333e5dd24b2317e3f38e7bfdb3e4d6803fdae7b4ce72c385603f4e

SHA512
647c89d38ab3a5ee52ed24e0fbf8c0998c135079dd0fbe5b0c89716fbf6be9dfef1658c25ea11b62e80a5841a9a8ed59260514bf268a25d8b65a30c2995b3e59

Download Submit
C:\Windows\System\PSfWWxh.exe

Filesize
1.9MB

MD5
f35c05258f6f717d41d004314df53f74

SHA1
b31466061af81de23a94e5632e795a86822309dd

SHA256
2fa12b8d91392152036ceb03735d7da878080fbbe9aade3617a9dea5f8c3d15b

SHA512
b124f50173671716b7afa03ad355b9a78cf3c626e7a6fd12e45d4ebfa34dbce83d7fbe0800108c8d08c6a37c7a4b9bdc57031480e617693c617c98f5ed2e9afe

Download Submit
C:\Windows\System\PgZMTsC.exe

Filesize
1.9MB

MD5
446f68a40859a623300b3a8774057b4b

SHA1
87d3414a77afda3b5232c1ec2998743b77f2731e

SHA256
4f8f2cca91bb5a30e69d34680ba0082661f0dde31edb650a51bc4a57039b49f9

SHA512
6560e7c1f1f849de150c828bebc7d3bf564c1f838a18197605fca81e7ba150f354871b1c12d778fdcb376eed7e6a6a307a114c718eb814b811c01f939a61235f

Download Submit
C:\Windows\System\PybsEur.exe

Filesize
1.9MB

MD5
5925648e7571ab09ba3b83ea52c3ee52

SHA1
642d67033b21137a28e143a2b9df48f83f11bf45

SHA256
9f34018cb5445c8da18dcb215d2c32853773af4fe51e501f8c9b859ac8d81829

SHA512
ea0ad8615547e8688dd401a3a1f370a4535ce6b184c08c1a3484d044613eccaa12bd50836380b10523d5187b714b64f4b21d29fa417dd0fff34b3b90cbf0efdd

Download Submit
C:\Windows\System\RbjCvID.exe

Filesize
1.9MB

MD5
10d8c732da39f35a66d1dc519cf7ad89

SHA1
b68b03fc14cb9a82fa94317f9a119b49d8daeffc

SHA256
562c5661cc110cf91f4d15f16edb53385ae3c2f10bade638bd307b2bad1b6f21

SHA512
824775e80f35353e47a8e92f202b7405fafff7be1ede97f49bd2a164017444be9b4b8013cf2ccc8cb8290196f2ad3be2a4982b0e5b3077d74f7cf2f77d863bf8

Download Submit
C:\Windows\System\UVSQEuy.exe

Filesize
1.9MB

MD5
75baf4f5ea75fa59d3cfb3aadb9eb3a2

SHA1
a99ac80600aeb0e605d0805359cb7923775924a6

SHA256
622344083ebb67214c3681ae9721ed6f79df8f0afeb1f9a9677fe4cfec8cd1f8

SHA512
d508fbbc3fb8893680bd3f6940536cd39ec62b7e816c58be64fbde216752b501571a474d7d0129c108782f5d1296d15cf96aa828d5ed68bf6a52a85a2f668664

Download Submit
C:\Windows\System\XxCJoFS.exe

Filesize
1.9MB

MD5
78f25e84a07eba16467cfc20ed8f2089

SHA1
26527fbefd966b32002c9f8ea6dd82ae2cb7f34b

SHA256
4d2a694421eb10cb1044200a469aafb1d4a09d8ed341819e18b67421dd893671

SHA512
63798bf68e0b0303a4ff4b04c2e8a3455f2c24da1d8f9b92e990b23287fbb6b84887c046ca5aa67f7b659199e8c235fc7676615bf9ba75db022e8dfde5024f66

Download Submit
C:\Windows\System\aiNeCTP.exe

Filesize
1.9MB

MD5
62bda3da29b676bd31f76c6785721f3c

SHA1
cd575e0c97bb27c6343b2aebc84e03e661de3571

SHA256
96f533a82644b7df89457b638d8207bf6e2b56dedef243ebafbac79dce77d78e

SHA512
b6dfef40a33cb3ed706c32be0d2739a69534146ce4009b4e27d8905efeee7ee4b81a9623d0c2848ecfb469a3b8a37513060a29b11036c639c495149531dcf936

Download Submit
C:\Windows\System\bDyoUPO.exe

Filesize
1.9MB

MD5
29a57c25066e3428c17bba48c704edd1

SHA1
143a3fb5457c9462615b10a7cb8b5795fe0d5bee

SHA256
082215479a0dfe40049dd1f93bba6b73e2bfb0faa2d52af65bba6778ed6baa6f

SHA512
636e09a13a432d00e37d64b56ce1dfa7252b35c43fdb37f628ee1c959919ff259816cb4b455a1efc0952c74126034574e8733e416ee699ba9be64623ee8d6b8b

Download Submit
C:\Windows\System\cXyhZjr.exe

Filesize
1.9MB

MD5
ad304329b446ef9574c7fb3e4222ce69

SHA1
311352373463cda6c8d13635b2980424d8062b42

SHA256
128389e6bf944f9ddf8bdacf59723d6d72afd1ac11f66a346ec6f9367c1468cc

SHA512
7f422e9ed24817acaf5eded9e92643a6606f64c4f9bb8157fbf45fef05645e961d26fed8b2b808c49246702ef0610c9a6f40d078cdf5eed0e1167a206d4c4bbe

Download Submit
C:\Windows\System\dlzPeTr.exe

Filesize
1.9MB

MD5
205950b40f311b571ac4bb906991f29a

SHA1
8350e4421215b9ca46274ff867244483377c8174

SHA256
62a46d61901196192397a7c255f90af8b2b6c0312068cb0cb913dcf9f3ebb940

SHA512
de391f27b619615ce46ebb4fa557553531c396ba74d3a70ca7f70a4abcb3ebd44ce838db5305dfbca924ed70923caacc68a6ed4e5ec143b2fd5c1cd8e9db412d

Download Submit
C:\Windows\System\eTOgKME.exe

Filesize
1.9MB

MD5
2635a1622688991f08944c0c2b667c24

SHA1
f91e4f45d1b5612a62187780af0db341b86e7f25

SHA256
3b0f1d4f6805abcc7d8243fa5d0e15a3de296004219d1d755d542847910d07a7

SHA512
8ff30f5c3c756dfaec3502ecab2537466a8a7730a79d954b2695c9b990b6759737236c063814a1ace1f0d58460769bda8b96e2390f942d3ec5add01598d27cac

Download Submit
C:\Windows\System\fRQhPPU.exe

Filesize
1.9MB

MD5
f17d58df009e58934383e6ec85891043

SHA1
70b33abc58dcd461eb0f952dcaa359285c7ced4f

SHA256
0fa32d6619d41a04f2810e1885f0d743c013f6a07e7926fc3c26125c82f66ef9

SHA512
8c91e394a370cbee1da7610e1fee8ad2ebcc8ff0e27188a5e08b3cb8b417481cd8e713baaee80532e7fb0a86bc4fa6898f8aa1df2f943541a8309c37907d182e

Download Submit
C:\Windows\System\gEClFWq.exe

Filesize
1.9MB

MD5
3b1f5822a18f3c3ad575dd4962e100b0

SHA1
73fdfc1f155d30f50f61310adc9853713eac3e22

SHA256
f3880ea26ba04a7ab60426f616349b3dc345eebb6e4a40b6179d4b4e9ccbc001

SHA512
cf3fe65089946eea22f9598901a42f1bec22366a764e1fec82fa9939acc9a4fe78002fb8749f026406c1ff840514bbc2a6277b1ffbde7fd9f1cf1e25122c206c

Download Submit
C:\Windows\System\grhfnBs.exe

Filesize
1.9MB

MD5
912165cf76489dd8d65ea09fa9fbf064

SHA1
e0736769431776f4902e72db25671b9c10667a56

SHA256
63705128593a4a72bd55ef40059349ceea9e7be7aa9fe39b5b8296877f7809e8

SHA512
090ad6fad2f8cd2beb0973a772272c79b5c12433f06b179b3769c7bc22c4ad5c245f514e4b99cb9d39140c91ed1411da024901ff3e5055f5822a2f551d30a271

Download Submit
C:\Windows\System\iLvzsek.exe

Filesize
1.9MB

MD5
c64068eb29eb00fad6d3080fe5036590

SHA1
38c759ee18766f4b398fabe9221d2a3255031561

SHA256
b09780c6e8258ae76e9adcaab068d919d80587964a4ef010920c5b742ca6196b

SHA512
cc5fc885a92d8f984e1c478c52d0970ac438e9fcd48071b550df1e22a8b8e34313ff9f07373dd8d0411016fc9ec14a79b001c74e7869f818168679c5fe3bcdd6

Download Submit
C:\Windows\System\pFUFrYn.exe

Filesize
1.9MB

MD5
c89cb576c30783c5240d8d744ef6d845

SHA1
8d5161b0519e6e3d85a3dd5b69f92a0b8e142555

SHA256
550ee7f7b9776c72166f058bc084b37510b7c13a0eaf7a8c2a1008df9defba31

SHA512
2a4a2a032f3bc62990967cb9bfeb7c39306baff983cab7ee04427995b7e36a7ef85972c1350cec5811fa641800e0b1c2299dbc5c25d345291668359f6a49ebce

Download Submit
C:\Windows\System\pfHiQCx.exe

Filesize
1.9MB

MD5
8347979b82b3fc7f9b267bb552014587

SHA1
f850fd02553758b9b86eddbf0c6076b77dc0c065

SHA256
d8e7e3f94f81a0a6e09b003bd7dae09fee096cfee9ce44c5d93f40990fca3449

SHA512
69cbef829dce2d2aee8e9318b10dcf65a3506c9f806dffa8f188bf9ee40fd9726200964413e939494cb5a65254f9e1dacbfa1a408b3e19664eccdc44eb4f1b80

Download Submit
C:\Windows\System\qnYGCCM.exe

Filesize
1.9MB

MD5
546d18e69f1b4de3493cdfe0ffced51b

SHA1
a2b130678dc6e79154e931135e2a9dba48df8d4e

SHA256
967dcc718e3dbfe6ebbb2f772304250cce23f426067afd447fc0def11c5447ba

SHA512
3760ab60b8a3505ec4bff1030d2dfd64e91fbf522a169e6c4f0fc167ec0ed0043aa398e1063e99cea95315b4373f9716045648afe3d65d2dba97b364f2944536

Download Submit
C:\Windows\System\qsANyIj.exe

Filesize
1.9MB

MD5
2524dca8df35b0b7c51019a8059cad59

SHA1
d5fc5988a923b8e5b5089e06b04e3ecaad54fb61

SHA256
513451979368c97a31949f4ab9f417c37ef9f946b3938fe024de12927964395b

SHA512
2e781d0baa62fbd85987ae8bf1d588168334e1955b87926c7ae557bd1889cac05c79fe21fd5e86426f1dad2e991bcbfe75a154a9954ed75f693c4e61d45f89ed

Download Submit
C:\Windows\System\veWjQaK.exe

Filesize
1.9MB

MD5
36a6b35dd9ee5a1a3012c8100b073a43

SHA1
3d1df532e06522402f670ad50a176c587326948b

SHA256
72f96ab8e0749ef0c6a6d2bca376c0091e86456528cef7dd932c5c8106052147

SHA512
59b462242f70a4bcc07fb34c3aa1279dd3c6adf0e2d838630fd4e79a10aca04a7a9e100fccd0ab84885f1208b2d72a756249730f59a9a4669fcd0b57d2272ccf

Download Submit
C:\Windows\System\xJSRcXE.exe

Filesize
1.9MB

MD5
29a08c6b69602cd0cf2b366ba6368b8d

SHA1
80659ceb3d07ec7efe884dbfb7a9ac3b4058295c

SHA256
7419949a74738a53337f869bad53dd07dc9a662f5566a25fcf74045bdfbd2cd0

SHA512
9f5ce73d1b6c58703e32ee2b35494c2c62c9301e193f87b500b5a7096a3114f64c22b79f997c6ece82716352b32f028616d94d9046e6a9fe4e46765a3d55a55d

Download Submit
C:\Windows\System\xqWKWhM.exe

Filesize
1.9MB

MD5
1ed2ebc34226f4fa5069c6126ad6fa51

SHA1
02411e01faa7f8063ea3788499652c79e25e21bc

SHA256
e88b759619097678e6ea498a419d0de29d4e26080e70724753159c80fad7de0c

SHA512
04ad255a77875e0987d06e029416b35e61e69e6ad97d13dad7761e5f7aa1041744eb83a2d90f0d1d6142f0c29b1f01f6c422765a6e04539cd962027209f921a3

Download Submit
C:\Windows\System\yJLyDnR.exe

Filesize
1.9MB

MD5
8f7e74390af33d04b816073905621cc4

SHA1
bdf74fcc92cbd39116d9c185e2da48279845d84a

SHA256
039e39fd55fe78824d3b6a061e059886158fa2aa75b375fd4436c7bde12bdd85

SHA512
09c00eeb0768fc2a735e7cd242d2720d8046d16d6efe27a7f7ca4b5a7c786a27002c0cc7725501a992732e219dd57ae9b57b4fb1d2401bed61aa9ad80fd35e8d

Download Submit
C:\Windows\System\zHXEkDy.exe

Filesize
1.9MB

MD5
08e2219f1e1c7cd631638b93cd0bc038

SHA1
8462c655966662fa10ba2999de8e200e4c3cf939

SHA256
f055c7c0287f0d3eaa903e06f51d5f4d8a748218a49b9b3a64fb130673a891e5

SHA512
423991d5f280c9bd5ed3ee8daf9302721959dd4e7dbc2ac27502b142df679753fe3fde0a3a12fa9685a3fe96461191a92deff7f0533241a1be58334991ef2e88

Download Submit
memory/236-3925-0x00007FF6A8040000-0x00007FF6A8432000-memory.dmp

Filesize
3.9MB

Download
memory/236-311-0x00007FF6A8040000-0x00007FF6A8432000-memory.dmp

Filesize
3.9MB

Download
memory/744-336-0x00007FF678A50000-0x00007FF678E42000-memory.dmp

Filesize
3.9MB

Download
memory/744-3918-0x00007FF678A50000-0x00007FF678E42000-memory.dmp

Filesize
3.9MB

Download
memory/1008-119-0x00007FF6E6CD0000-0x00007FF6E70C2000-memory.dmp

Filesize
3.9MB

Download
memory/1008-3823-0x00007FF6E6CD0000-0x00007FF6E70C2000-memory.dmp

Filesize
3.9MB

Download
memory/1100-322-0x00007FF71FF80000-0x00007FF720372000-memory.dmp

Filesize
3.9MB

Download
memory/1100-3963-0x00007FF71FF80000-0x00007FF720372000-memory.dmp

Filesize
3.9MB

Download
memory/1108-312-0x00007FF6B21A0000-0x00007FF6B2592000-memory.dmp

Filesize
3.9MB

Download
memory/1108-3976-0x00007FF6B21A0000-0x00007FF6B2592000-memory.dmp

Filesize
3.9MB

Download
memory/1428-3835-0x00007FF7B7F90000-0x00007FF7B8382000-memory.dmp

Filesize
3.9MB

Download
memory/1428-77-0x00007FF7B7F90000-0x00007FF7B8382000-memory.dmp

Filesize
3.9MB

Download
memory/1568-3809-0x00007FF70C740000-0x00007FF70CB32000-memory.dmp

Filesize
3.9MB

Download
memory/1568-55-0x00007FF70C740000-0x00007FF70CB32000-memory.dmp

Filesize
3.9MB

Download
memory/1720-3872-0x00007FF78A8B0000-0x00007FF78ACA2000-memory.dmp

Filesize
3.9MB

Download
memory/1720-154-0x00007FF78A8B0000-0x00007FF78ACA2000-memory.dmp

Filesize
3.9MB

Download
memory/1844-323-0x00007FF794630000-0x00007FF794A22000-memory.dmp

Filesize
3.9MB

Download
memory/1876-335-0x00007FF70FF90000-0x00007FF710382000-memory.dmp

Filesize
3.9MB

Download
memory/1876-3907-0x00007FF70FF90000-0x00007FF710382000-memory.dmp

Filesize
3.9MB

Download
memory/1920-3862-0x00007FF763960000-0x00007FF763D52000-memory.dmp

Filesize
3.9MB

Download
memory/1920-216-0x00007FF763960000-0x00007FF763D52000-memory.dmp

Filesize
3.9MB

Download
memory/1928-0-0x00007FF7CF790000-0x00007FF7CFB82000-memory.dmp

Filesize
3.9MB

Download
memory/1928-1-0x000001EAC4160000-0x000001EAC4170000-memory.dmp

Filesize
64KB

Download
memory/2356-25-0x00007FF764580000-0x00007FF764972000-memory.dmp

Filesize
3.9MB

Download
memory/2620-346-0x000002D470720000-0x000002D470742000-memory.dmp

Filesize
136KB

Download
memory/2620-347-0x000002D471440000-0x000002D471BE6000-memory.dmp

Filesize
7.6MB

Download
memory/2876-3899-0x00007FF790940000-0x00007FF790D32000-memory.dmp

Filesize
3.9MB

Download
memory/2876-277-0x00007FF790940000-0x00007FF790D32000-memory.dmp

Filesize
3.9MB

Download
memory/3232-3881-0x00007FF776890000-0x00007FF776C82000-memory.dmp

Filesize
3.9MB

Download
memory/3232-278-0x00007FF776890000-0x00007FF776C82000-memory.dmp

Filesize
3.9MB

Download
memory/3308-3815-0x00007FF6238D0000-0x00007FF623CC2000-memory.dmp

Filesize
3.9MB

Download
memory/3308-332-0x00007FF6238D0000-0x00007FF623CC2000-memory.dmp

Filesize
3.9MB

Download
memory/3460-138-0x00007FF6604F0000-0x00007FF6608E2000-memory.dmp

Filesize
3.9MB

Download
memory/3460-3833-0x00007FF6604F0000-0x00007FF6608E2000-memory.dmp

Filesize
3.9MB

Download
memory/3976-3892-0x00007FF648B80000-0x00007FF648F72000-memory.dmp

Filesize
3.9MB

Download
memory/3976-237-0x00007FF648B80000-0x00007FF648F72000-memory.dmp

Filesize
3.9MB

Download
memory/4028-250-0x00007FF7BFBB0000-0x00007FF7BFFA2000-memory.dmp

Filesize
3.9MB

Download
memory/4028-3896-0x00007FF7BFBB0000-0x00007FF7BFFA2000-memory.dmp

Filesize
3.9MB

Download
memory/4076-3884-0x00007FF747B20000-0x00007FF747F12000-memory.dmp

Filesize
3.9MB

Download
memory/4076-159-0x00007FF747B20000-0x00007FF747F12000-memory.dmp

Filesize
3.9MB

Download
memory/4152-13-0x00007FF7E87D0000-0x00007FF7E8BC2000-memory.dmp

Filesize
3.9MB

Download
memory/4504-115-0x00007FF77FAE0000-0x00007FF77FED2000-memory.dmp

Filesize
3.9MB

Download
memory/4504-3819-0x00007FF77FAE0000-0x00007FF77FED2000-memory.dmp

Filesize
3.9MB

Download
memory/4560-333-0x00007FF7B03F0000-0x00007FF7B07E2000-memory.dmp

Filesize
3.9MB

Download
memory/4560-3850-0x00007FF7B03F0000-0x00007FF7B07E2000-memory.dmp

Filesize
3.9MB

Download
memory/4952-36-0x00007FF6D0CE0000-0x00007FF6D10D2000-memory.dmp

Filesize
3.9MB

Download
memory/5088-308-0x00007FF74ACE0000-0x00007FF74B0D2000-memory.dmp

Filesize
3.9MB

Download
memory/5088-3920-0x00007FF74ACE0000-0x00007FF74B0D2000-memory.dmp

Filesize
3.9MB

Download