xmrig | 3c0333788346402a398dcd3f87af22f7770de59345551cc3f7dbfe754ee88ace

Analysis

max time kernel
149s
max time network
149s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
24/05/2024, 21:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6fe27815a3c5c75754ad401ce88d7b30_NeikiAnalytics.exe
Size

1.6MB
MD5

6fe27815a3c5c75754ad401ce88d7b30
SHA1

aeae9d35061b730c09ac3db342331588a57987ff
SHA256

3c0333788346402a398dcd3f87af22f7770de59345551cc3f7dbfe754ee88ace
SHA512

e61a98b5eac704d8f5e2d7f95f1dd0ea429d1cf8971e36bae5cdcdee230ba6023af64eac39f87a3570474cc8b3bdf02e3cb53db30353c894b543b9f17c7e2cbc
SSDEEP

24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjhnXwx8/2Pbx/mbqoBQ0i1DFK8s1:Lz071uv4BPMkHC0IlnASEx/mi1DI8U

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 22 IoCs

miner

resource	yara_rule
behavioral1/memory/1624-9-0x000000013F930000-0x000000013FD22000-memory.dmp	xmrig
behavioral1/memory/2856-86-0x000000013F6F0000-0x000000013FAE2000-memory.dmp	xmrig
behavioral1/memory/1564-93-0x000000013F280000-0x000000013F672000-memory.dmp	xmrig
behavioral1/memory/1260-97-0x000000013F320000-0x000000013F712000-memory.dmp	xmrig
behavioral1/memory/1716-91-0x000000013F840000-0x000000013FC32000-memory.dmp	xmrig
behavioral1/memory/2464-81-0x000000013FF30000-0x0000000140322000-memory.dmp	xmrig
behavioral1/memory/2400-79-0x000000013F340000-0x000000013F732000-memory.dmp	xmrig
behavioral1/memory/2652-77-0x000000013FBC0000-0x000000013FFB2000-memory.dmp	xmrig
behavioral1/memory/2576-75-0x000000013F510000-0x000000013F902000-memory.dmp	xmrig
behavioral1/memory/2568-73-0x000000013F970000-0x000000013FD62000-memory.dmp	xmrig
behavioral1/memory/1624-5140-0x000000013F930000-0x000000013FD22000-memory.dmp	xmrig
behavioral1/memory/2652-5139-0x000000013FBC0000-0x000000013FFB2000-memory.dmp	xmrig
behavioral1/memory/2856-5142-0x000000013F6F0000-0x000000013FAE2000-memory.dmp	xmrig
behavioral1/memory/2464-5141-0x000000013FF30000-0x0000000140322000-memory.dmp	xmrig
behavioral1/memory/2400-5143-0x000000013F340000-0x000000013F732000-memory.dmp	xmrig
behavioral1/memory/2576-5144-0x000000013F510000-0x000000013F902000-memory.dmp	xmrig
behavioral1/memory/1716-5154-0x000000013F840000-0x000000013FC32000-memory.dmp	xmrig
behavioral1/memory/1260-5156-0x000000013F320000-0x000000013F712000-memory.dmp	xmrig
behavioral1/memory/1564-5155-0x000000013F280000-0x000000013F672000-memory.dmp	xmrig
behavioral1/memory/2580-5158-0x000000013F5B0000-0x000000013F9A2000-memory.dmp	xmrig
behavioral1/memory/2568-5157-0x000000013F970000-0x000000013FD62000-memory.dmp	xmrig
behavioral1/memory/2512-5160-0x000000013F8C0000-0x000000013FCB2000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
2228	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
1624	jNeZTUh.exe
2580	xZCbpwi.exe
2512	TdagFAg.exe
2568	UIAtLwC.exe
2576	fnLghAS.exe
2652	LklkSwe.exe
2400	wcyqanS.exe
2464	zAyfXic.exe
2856	oVyLfWy.exe
1716	nqkKXMF.exe
1564	RNQjuFs.exe
1260	EdCLxyK.exe
2148	JxhnADH.exe
2064	CjbsZKN.exe
2704	ykDdbBc.exe
2028	KxWfZGI.exe
2152	VtlbtLv.exe
2280	uZyfZhf.exe
1132	eHwinBh.exe
2748	AmbegLx.exe
1924	NCMeFRT.exe
2004	cJAqEAm.exe
2428	SNbwUpg.exe
700	XgcrBoQ.exe
268	lXvfJOd.exe
1048	XopTOmK.exe
1780	CglJXlY.exe
2360	TRsUZzU.exe
1720	bVxDUlO.exe
992	XUBoArq.exe
1956	rtIWpkg.exe
1108	CckGqqR.exe
296	REyqUBv.exe
1480	lnWQGYl.exe
1212	ddpBeIu.exe
1284	QkDoZsP.exe
808	VHdPjGw.exe
276	dSkVOjp.exe
272	mKEsBAp.exe
780	sGQQqoJ.exe
884	BvtUjVP.exe
2216	fBTCdHE.exe
2244	AuqlCKe.exe
1864	SiDbkLy.exe
2236	hQFZdVW.exe
2804	AVcPCcq.exe
340	fKrFiPV.exe
900	ZMAJfZV.exe
1620	PPpOBkp.exe
1664	dmniQlf.exe
1524	mzJtoFp.exe
1636	mvtqxHa.exe
2088	mTSAJuF.exe
2592	mjhbqJs.exe
2644	bESDcdc.exe
2436	wqcsICN.exe
2384	JSefwzQ.exe
2096	WvPlBDp.exe
2860	XZBdnvi.exe
1256	SGpdeSh.exe
2276	degFPop.exe
1452	pjYMTmJ.exe
2656	ATnwHWR.exe
2024	hUivWhQ.exe

Loads dropped DLL 64 IoCs

pid	Process
1948	6fe27815a3c5c75754ad401ce88d7b30_NeikiAnalytics.exe
1948	6fe27815a3c5c75754ad401ce88d7b30_NeikiAnalytics.exe
1948	6fe27815a3c5c75754ad401ce88d7b30_NeikiAnalytics.exe
1948	6fe27815a3c5c75754ad401ce88d7b30_NeikiAnalytics.exe
1948	6fe27815a3c5c75754ad401ce88d7b30_NeikiAnalytics.exe
1948	6fe27815a3c5c75754ad401ce88d7b30_NeikiAnalytics.exe
1948	6fe27815a3c5c75754ad401ce88d7b30_NeikiAnalytics.exe
1948	6fe27815a3c5c75754ad401ce88d7b30_NeikiAnalytics.exe
1948	6fe27815a3c5c75754ad401ce88d7b30_NeikiAnalytics.exe
1948	6fe27815a3c5c75754ad401ce88d7b30_NeikiAnalytics.exe
1948	6fe27815a3c5c75754ad401ce88d7b30_NeikiAnalytics.exe
1948	6fe27815a3c5c75754ad401ce88d7b30_NeikiAnalytics.exe
1948	6fe27815a3c5c75754ad401ce88d7b30_NeikiAnalytics.exe
1948	6fe27815a3c5c75754ad401ce88d7b30_NeikiAnalytics.exe
1948	6fe27815a3c5c75754ad401ce88d7b30_NeikiAnalytics.exe
1948	6fe27815a3c5c75754ad401ce88d7b30_NeikiAnalytics.exe
1948	6fe27815a3c5c75754ad401ce88d7b30_NeikiAnalytics.exe
1948	6fe27815a3c5c75754ad401ce88d7b30_NeikiAnalytics.exe
1948	6fe27815a3c5c75754ad401ce88d7b30_NeikiAnalytics.exe
1948	6fe27815a3c5c75754ad401ce88d7b30_NeikiAnalytics.exe
1948	6fe27815a3c5c75754ad401ce88d7b30_NeikiAnalytics.exe
1948	6fe27815a3c5c75754ad401ce88d7b30_NeikiAnalytics.exe
1948	6fe27815a3c5c75754ad401ce88d7b30_NeikiAnalytics.exe
1948	6fe27815a3c5c75754ad401ce88d7b30_NeikiAnalytics.exe
1948	6fe27815a3c5c75754ad401ce88d7b30_NeikiAnalytics.exe
1948	6fe27815a3c5c75754ad401ce88d7b30_NeikiAnalytics.exe
1948	6fe27815a3c5c75754ad401ce88d7b30_NeikiAnalytics.exe
1948	6fe27815a3c5c75754ad401ce88d7b30_NeikiAnalytics.exe
1948	6fe27815a3c5c75754ad401ce88d7b30_NeikiAnalytics.exe
1948	6fe27815a3c5c75754ad401ce88d7b30_NeikiAnalytics.exe
1948	6fe27815a3c5c75754ad401ce88d7b30_NeikiAnalytics.exe
1948	6fe27815a3c5c75754ad401ce88d7b30_NeikiAnalytics.exe
1948	6fe27815a3c5c75754ad401ce88d7b30_NeikiAnalytics.exe
1948	6fe27815a3c5c75754ad401ce88d7b30_NeikiAnalytics.exe
1948	6fe27815a3c5c75754ad401ce88d7b30_NeikiAnalytics.exe
1948	6fe27815a3c5c75754ad401ce88d7b30_NeikiAnalytics.exe
1948	6fe27815a3c5c75754ad401ce88d7b30_NeikiAnalytics.exe
1948	6fe27815a3c5c75754ad401ce88d7b30_NeikiAnalytics.exe
1948	6fe27815a3c5c75754ad401ce88d7b30_NeikiAnalytics.exe
1948	6fe27815a3c5c75754ad401ce88d7b30_NeikiAnalytics.exe
1948	6fe27815a3c5c75754ad401ce88d7b30_NeikiAnalytics.exe
1948	6fe27815a3c5c75754ad401ce88d7b30_NeikiAnalytics.exe
1948	6fe27815a3c5c75754ad401ce88d7b30_NeikiAnalytics.exe
1948	6fe27815a3c5c75754ad401ce88d7b30_NeikiAnalytics.exe
1948	6fe27815a3c5c75754ad401ce88d7b30_NeikiAnalytics.exe
1948	6fe27815a3c5c75754ad401ce88d7b30_NeikiAnalytics.exe
1948	6fe27815a3c5c75754ad401ce88d7b30_NeikiAnalytics.exe
1948	6fe27815a3c5c75754ad401ce88d7b30_NeikiAnalytics.exe
1948	6fe27815a3c5c75754ad401ce88d7b30_NeikiAnalytics.exe
1948	6fe27815a3c5c75754ad401ce88d7b30_NeikiAnalytics.exe
1948	6fe27815a3c5c75754ad401ce88d7b30_NeikiAnalytics.exe
1948	6fe27815a3c5c75754ad401ce88d7b30_NeikiAnalytics.exe
1948	6fe27815a3c5c75754ad401ce88d7b30_NeikiAnalytics.exe
1948	6fe27815a3c5c75754ad401ce88d7b30_NeikiAnalytics.exe
1948	6fe27815a3c5c75754ad401ce88d7b30_NeikiAnalytics.exe
1948	6fe27815a3c5c75754ad401ce88d7b30_NeikiAnalytics.exe
1948	6fe27815a3c5c75754ad401ce88d7b30_NeikiAnalytics.exe
1948	6fe27815a3c5c75754ad401ce88d7b30_NeikiAnalytics.exe
1948	6fe27815a3c5c75754ad401ce88d7b30_NeikiAnalytics.exe
1948	6fe27815a3c5c75754ad401ce88d7b30_NeikiAnalytics.exe
1948	6fe27815a3c5c75754ad401ce88d7b30_NeikiAnalytics.exe
1948	6fe27815a3c5c75754ad401ce88d7b30_NeikiAnalytics.exe
1948	6fe27815a3c5c75754ad401ce88d7b30_NeikiAnalytics.exe
1948	6fe27815a3c5c75754ad401ce88d7b30_NeikiAnalytics.exe

UPX packed file 57 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1948-1-0x000000013F930000-0x000000013FD22000-memory.dmp	upx
behavioral1/files/0x000d000000013a06-3.dat	upx
behavioral1/memory/1624-9-0x000000013F930000-0x000000013FD22000-memory.dmp	upx
behavioral1/files/0x003500000001415f-14.dat	upx
behavioral1/files/0x0007000000014246-12.dat	upx
behavioral1/memory/2512-26-0x000000013F8C0000-0x000000013FCB2000-memory.dmp	upx
behavioral1/files/0x000e0000000054ab-36.dat	upx
behavioral1/files/0x0007000000014312-32.dat	upx
behavioral1/files/0x000900000001443b-47.dat	upx
behavioral1/files/0x0006000000014bbc-56.dat	upx
behavioral1/files/0x0006000000014fa2-67.dat	upx
behavioral1/files/0x0006000000014e71-63.dat	upx
behavioral1/files/0x000600000001535e-83.dat	upx
behavioral1/memory/2856-86-0x000000013F6F0000-0x000000013FAE2000-memory.dmp	upx
behavioral1/memory/1564-93-0x000000013F280000-0x000000013F672000-memory.dmp	upx
behavioral1/memory/1260-97-0x000000013F320000-0x000000013F712000-memory.dmp	upx
behavioral1/files/0x000600000001564f-98.dat	upx
behavioral1/memory/1716-91-0x000000013F840000-0x000000013FC32000-memory.dmp	upx
behavioral1/files/0x0006000000015677-112.dat	upx
behavioral1/files/0x0006000000015653-107.dat	upx
behavioral1/files/0x0006000000015c87-122.dat	upx
behavioral1/files/0x0035000000014175-125.dat	upx
behavioral1/files/0x0006000000015684-116.dat	upx
behavioral1/files/0x000600000001565d-109.dat	upx
behavioral1/files/0x0006000000015ce3-156.dat	upx
behavioral1/files/0x0006000000015d56-192.dat	upx
behavioral1/files/0x0006000000015d6b-196.dat	upx
behavioral1/files/0x0006000000015d42-185.dat	upx
behavioral1/files/0x0006000000015d20-172.dat	upx
behavioral1/files/0x0006000000015cff-167.dat	upx
behavioral1/files/0x0006000000015cd9-165.dat	upx
behavioral1/files/0x0006000000015d5f-189.dat	upx
behavioral1/files/0x0006000000015d4e-177.dat	upx
behavioral1/files/0x0006000000015cb6-146.dat	upx
behavioral1/files/0x0006000000015ccd-151.dat	upx
behavioral1/files/0x0006000000015cae-141.dat	upx
behavioral1/files/0x0006000000015c9e-128.dat	upx
behavioral1/memory/2464-81-0x000000013FF30000-0x0000000140322000-memory.dmp	upx
behavioral1/memory/2400-79-0x000000013F340000-0x000000013F732000-memory.dmp	upx
behavioral1/memory/2652-77-0x000000013FBC0000-0x000000013FFB2000-memory.dmp	upx
behavioral1/memory/2576-75-0x000000013F510000-0x000000013F902000-memory.dmp	upx
behavioral1/memory/2568-73-0x000000013F970000-0x000000013FD62000-memory.dmp	upx
behavioral1/files/0x00080000000144e8-51.dat	upx
behavioral1/files/0x0008000000014358-40.dat	upx
behavioral1/memory/2580-15-0x000000013F5B0000-0x000000013F9A2000-memory.dmp	upx
behavioral1/memory/1624-5140-0x000000013F930000-0x000000013FD22000-memory.dmp	upx
behavioral1/memory/2652-5139-0x000000013FBC0000-0x000000013FFB2000-memory.dmp	upx
behavioral1/memory/2856-5142-0x000000013F6F0000-0x000000013FAE2000-memory.dmp	upx
behavioral1/memory/2464-5141-0x000000013FF30000-0x0000000140322000-memory.dmp	upx
behavioral1/memory/2400-5143-0x000000013F340000-0x000000013F732000-memory.dmp	upx
behavioral1/memory/2576-5144-0x000000013F510000-0x000000013F902000-memory.dmp	upx
behavioral1/memory/1716-5154-0x000000013F840000-0x000000013FC32000-memory.dmp	upx
behavioral1/memory/1260-5156-0x000000013F320000-0x000000013F712000-memory.dmp	upx
behavioral1/memory/1564-5155-0x000000013F280000-0x000000013F672000-memory.dmp	upx
behavioral1/memory/2580-5158-0x000000013F5B0000-0x000000013F9A2000-memory.dmp	upx
behavioral1/memory/2568-5157-0x000000013F970000-0x000000013FD62000-memory.dmp	upx
behavioral1/memory/2512-5160-0x000000013F8C0000-0x000000013FCB2000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\igYbOqA.exe	6fe27815a3c5c75754ad401ce88d7b30_NeikiAnalytics.exe
File created	C:\Windows\System\bfrCDYU.exe	6fe27815a3c5c75754ad401ce88d7b30_NeikiAnalytics.exe
File created	C:\Windows\System\tBuxnXB.exe	6fe27815a3c5c75754ad401ce88d7b30_NeikiAnalytics.exe
File created	C:\Windows\System\hNcVNYC.exe	6fe27815a3c5c75754ad401ce88d7b30_NeikiAnalytics.exe
File created	C:\Windows\System\kwrZlgB.exe	6fe27815a3c5c75754ad401ce88d7b30_NeikiAnalytics.exe
File created	C:\Windows\System\DidCQgQ.exe	6fe27815a3c5c75754ad401ce88d7b30_NeikiAnalytics.exe
File created	C:\Windows\System\DzdgxNr.exe	6fe27815a3c5c75754ad401ce88d7b30_NeikiAnalytics.exe
File created	C:\Windows\System\QtBUaAg.exe	6fe27815a3c5c75754ad401ce88d7b30_NeikiAnalytics.exe
File created	C:\Windows\System\xrFxmQb.exe	6fe27815a3c5c75754ad401ce88d7b30_NeikiAnalytics.exe
File created	C:\Windows\System\jvnqIAH.exe	6fe27815a3c5c75754ad401ce88d7b30_NeikiAnalytics.exe
File created	C:\Windows\System\ctizagT.exe	6fe27815a3c5c75754ad401ce88d7b30_NeikiAnalytics.exe
File created	C:\Windows\System\VwdFLXg.exe	6fe27815a3c5c75754ad401ce88d7b30_NeikiAnalytics.exe
File created	C:\Windows\System\jkaLtmh.exe	6fe27815a3c5c75754ad401ce88d7b30_NeikiAnalytics.exe
File created	C:\Windows\System\RgVdSkl.exe	6fe27815a3c5c75754ad401ce88d7b30_NeikiAnalytics.exe
File created	C:\Windows\System\DxJeuiL.exe	6fe27815a3c5c75754ad401ce88d7b30_NeikiAnalytics.exe
File created	C:\Windows\System\iqJzJqL.exe	6fe27815a3c5c75754ad401ce88d7b30_NeikiAnalytics.exe
File created	C:\Windows\System\BuEByNr.exe	6fe27815a3c5c75754ad401ce88d7b30_NeikiAnalytics.exe
File created	C:\Windows\System\uTemXZJ.exe	6fe27815a3c5c75754ad401ce88d7b30_NeikiAnalytics.exe
File created	C:\Windows\System\xiMLwJq.exe	6fe27815a3c5c75754ad401ce88d7b30_NeikiAnalytics.exe
File created	C:\Windows\System\esAuSPd.exe	6fe27815a3c5c75754ad401ce88d7b30_NeikiAnalytics.exe
File created	C:\Windows\System\ZBZJjaF.exe	6fe27815a3c5c75754ad401ce88d7b30_NeikiAnalytics.exe
File created	C:\Windows\System\Xxuxzgu.exe	6fe27815a3c5c75754ad401ce88d7b30_NeikiAnalytics.exe
File created	C:\Windows\System\UWLClJT.exe	6fe27815a3c5c75754ad401ce88d7b30_NeikiAnalytics.exe
File created	C:\Windows\System\EbccNxF.exe	6fe27815a3c5c75754ad401ce88d7b30_NeikiAnalytics.exe
File created	C:\Windows\System\yyvClGj.exe	6fe27815a3c5c75754ad401ce88d7b30_NeikiAnalytics.exe
File created	C:\Windows\System\hbBwDtA.exe	6fe27815a3c5c75754ad401ce88d7b30_NeikiAnalytics.exe
File created	C:\Windows\System\lhhmRWS.exe	6fe27815a3c5c75754ad401ce88d7b30_NeikiAnalytics.exe
File created	C:\Windows\System\yTsVYOW.exe	6fe27815a3c5c75754ad401ce88d7b30_NeikiAnalytics.exe
File created	C:\Windows\System\vwKAkbO.exe	6fe27815a3c5c75754ad401ce88d7b30_NeikiAnalytics.exe
File created	C:\Windows\System\GHWNquW.exe	6fe27815a3c5c75754ad401ce88d7b30_NeikiAnalytics.exe
File created	C:\Windows\System\YfyZNWF.exe	6fe27815a3c5c75754ad401ce88d7b30_NeikiAnalytics.exe
File created	C:\Windows\System\qSRojmO.exe	6fe27815a3c5c75754ad401ce88d7b30_NeikiAnalytics.exe
File created	C:\Windows\System\EaFbxWO.exe	6fe27815a3c5c75754ad401ce88d7b30_NeikiAnalytics.exe
File created	C:\Windows\System\KPbcrNG.exe	6fe27815a3c5c75754ad401ce88d7b30_NeikiAnalytics.exe
File created	C:\Windows\System\JPpWXty.exe	6fe27815a3c5c75754ad401ce88d7b30_NeikiAnalytics.exe
File created	C:\Windows\System\EvuAngO.exe	6fe27815a3c5c75754ad401ce88d7b30_NeikiAnalytics.exe
File created	C:\Windows\System\sgaKiBu.exe	6fe27815a3c5c75754ad401ce88d7b30_NeikiAnalytics.exe
File created	C:\Windows\System\srEVblP.exe	6fe27815a3c5c75754ad401ce88d7b30_NeikiAnalytics.exe
File created	C:\Windows\System\lSNcgVC.exe	6fe27815a3c5c75754ad401ce88d7b30_NeikiAnalytics.exe
File created	C:\Windows\System\xqDMVnP.exe	6fe27815a3c5c75754ad401ce88d7b30_NeikiAnalytics.exe
File created	C:\Windows\System\juSPJdy.exe	6fe27815a3c5c75754ad401ce88d7b30_NeikiAnalytics.exe
File created	C:\Windows\System\xHRgaSS.exe	6fe27815a3c5c75754ad401ce88d7b30_NeikiAnalytics.exe
File created	C:\Windows\System\oNZVotQ.exe	6fe27815a3c5c75754ad401ce88d7b30_NeikiAnalytics.exe
File created	C:\Windows\System\bWjHTzY.exe	6fe27815a3c5c75754ad401ce88d7b30_NeikiAnalytics.exe
File created	C:\Windows\System\iWkTSyy.exe	6fe27815a3c5c75754ad401ce88d7b30_NeikiAnalytics.exe
File created	C:\Windows\System\aXauEvZ.exe	6fe27815a3c5c75754ad401ce88d7b30_NeikiAnalytics.exe
File created	C:\Windows\System\iHbYdQl.exe	6fe27815a3c5c75754ad401ce88d7b30_NeikiAnalytics.exe
File created	C:\Windows\System\wTCLXfr.exe	6fe27815a3c5c75754ad401ce88d7b30_NeikiAnalytics.exe
File created	C:\Windows\System\inqNSFa.exe	6fe27815a3c5c75754ad401ce88d7b30_NeikiAnalytics.exe
File created	C:\Windows\System\eocukBU.exe	6fe27815a3c5c75754ad401ce88d7b30_NeikiAnalytics.exe
File created	C:\Windows\System\rLxvumL.exe	6fe27815a3c5c75754ad401ce88d7b30_NeikiAnalytics.exe
File created	C:\Windows\System\RHJgOwE.exe	6fe27815a3c5c75754ad401ce88d7b30_NeikiAnalytics.exe
File created	C:\Windows\System\soFniSD.exe	6fe27815a3c5c75754ad401ce88d7b30_NeikiAnalytics.exe
File created	C:\Windows\System\vVuJaWF.exe	6fe27815a3c5c75754ad401ce88d7b30_NeikiAnalytics.exe
File created	C:\Windows\System\okaHZUP.exe	6fe27815a3c5c75754ad401ce88d7b30_NeikiAnalytics.exe
File created	C:\Windows\System\ZpCMtum.exe	6fe27815a3c5c75754ad401ce88d7b30_NeikiAnalytics.exe
File created	C:\Windows\System\GNVigUi.exe	6fe27815a3c5c75754ad401ce88d7b30_NeikiAnalytics.exe
File created	C:\Windows\System\HgdYwJN.exe	6fe27815a3c5c75754ad401ce88d7b30_NeikiAnalytics.exe
File created	C:\Windows\System\EQDHsml.exe	6fe27815a3c5c75754ad401ce88d7b30_NeikiAnalytics.exe
File created	C:\Windows\System\BWNFMgh.exe	6fe27815a3c5c75754ad401ce88d7b30_NeikiAnalytics.exe
File created	C:\Windows\System\IxtvTWH.exe	6fe27815a3c5c75754ad401ce88d7b30_NeikiAnalytics.exe
File created	C:\Windows\System\hBeJnNL.exe	6fe27815a3c5c75754ad401ce88d7b30_NeikiAnalytics.exe
File created	C:\Windows\System\sXrNAfn.exe	6fe27815a3c5c75754ad401ce88d7b30_NeikiAnalytics.exe
File created	C:\Windows\System\ibkynZT.exe	6fe27815a3c5c75754ad401ce88d7b30_NeikiAnalytics.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2228	powershell.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	1948	6fe27815a3c5c75754ad401ce88d7b30_NeikiAnalytics.exe
Token: SeLockMemoryPrivilege	1948	6fe27815a3c5c75754ad401ce88d7b30_NeikiAnalytics.exe
Token: SeDebugPrivilege	2228	powershell.exe
Token: SeLockMemoryPrivilege	10084	rdzBAmi.exe
Token: SeLockMemoryPrivilege	10084	rdzBAmi.exe
Token: SeLockMemoryPrivilege	9492	Process not Found
Token: SeLockMemoryPrivilege	9492	Process not Found

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1948 wrote to memory of 2228	1948	6fe27815a3c5c75754ad401ce88d7b30_NeikiAnalytics.exe	29
PID 1948 wrote to memory of 2228	1948	6fe27815a3c5c75754ad401ce88d7b30_NeikiAnalytics.exe	29
PID 1948 wrote to memory of 2228	1948	6fe27815a3c5c75754ad401ce88d7b30_NeikiAnalytics.exe	29
PID 1948 wrote to memory of 1624	1948	6fe27815a3c5c75754ad401ce88d7b30_NeikiAnalytics.exe	30
PID 1948 wrote to memory of 1624	1948	6fe27815a3c5c75754ad401ce88d7b30_NeikiAnalytics.exe	30
PID 1948 wrote to memory of 1624	1948	6fe27815a3c5c75754ad401ce88d7b30_NeikiAnalytics.exe	30
PID 1948 wrote to memory of 2580	1948	6fe27815a3c5c75754ad401ce88d7b30_NeikiAnalytics.exe	31
PID 1948 wrote to memory of 2580	1948	6fe27815a3c5c75754ad401ce88d7b30_NeikiAnalytics.exe	31
PID 1948 wrote to memory of 2580	1948	6fe27815a3c5c75754ad401ce88d7b30_NeikiAnalytics.exe	31
PID 1948 wrote to memory of 2512	1948	6fe27815a3c5c75754ad401ce88d7b30_NeikiAnalytics.exe	32
PID 1948 wrote to memory of 2512	1948	6fe27815a3c5c75754ad401ce88d7b30_NeikiAnalytics.exe	32
PID 1948 wrote to memory of 2512	1948	6fe27815a3c5c75754ad401ce88d7b30_NeikiAnalytics.exe	32
PID 1948 wrote to memory of 2568	1948	6fe27815a3c5c75754ad401ce88d7b30_NeikiAnalytics.exe	33
PID 1948 wrote to memory of 2568	1948	6fe27815a3c5c75754ad401ce88d7b30_NeikiAnalytics.exe	33
PID 1948 wrote to memory of 2568	1948	6fe27815a3c5c75754ad401ce88d7b30_NeikiAnalytics.exe	33
PID 1948 wrote to memory of 2576	1948	6fe27815a3c5c75754ad401ce88d7b30_NeikiAnalytics.exe	34
PID 1948 wrote to memory of 2576	1948	6fe27815a3c5c75754ad401ce88d7b30_NeikiAnalytics.exe	34
PID 1948 wrote to memory of 2576	1948	6fe27815a3c5c75754ad401ce88d7b30_NeikiAnalytics.exe	34
PID 1948 wrote to memory of 2652	1948	6fe27815a3c5c75754ad401ce88d7b30_NeikiAnalytics.exe	35
PID 1948 wrote to memory of 2652	1948	6fe27815a3c5c75754ad401ce88d7b30_NeikiAnalytics.exe	35
PID 1948 wrote to memory of 2652	1948	6fe27815a3c5c75754ad401ce88d7b30_NeikiAnalytics.exe	35
PID 1948 wrote to memory of 2400	1948	6fe27815a3c5c75754ad401ce88d7b30_NeikiAnalytics.exe	36
PID 1948 wrote to memory of 2400	1948	6fe27815a3c5c75754ad401ce88d7b30_NeikiAnalytics.exe	36
PID 1948 wrote to memory of 2400	1948	6fe27815a3c5c75754ad401ce88d7b30_NeikiAnalytics.exe	36
PID 1948 wrote to memory of 2464	1948	6fe27815a3c5c75754ad401ce88d7b30_NeikiAnalytics.exe	37
PID 1948 wrote to memory of 2464	1948	6fe27815a3c5c75754ad401ce88d7b30_NeikiAnalytics.exe	37
PID 1948 wrote to memory of 2464	1948	6fe27815a3c5c75754ad401ce88d7b30_NeikiAnalytics.exe	37
PID 1948 wrote to memory of 2856	1948	6fe27815a3c5c75754ad401ce88d7b30_NeikiAnalytics.exe	38
PID 1948 wrote to memory of 2856	1948	6fe27815a3c5c75754ad401ce88d7b30_NeikiAnalytics.exe	38
PID 1948 wrote to memory of 2856	1948	6fe27815a3c5c75754ad401ce88d7b30_NeikiAnalytics.exe	38
PID 1948 wrote to memory of 1716	1948	6fe27815a3c5c75754ad401ce88d7b30_NeikiAnalytics.exe	39
PID 1948 wrote to memory of 1716	1948	6fe27815a3c5c75754ad401ce88d7b30_NeikiAnalytics.exe	39
PID 1948 wrote to memory of 1716	1948	6fe27815a3c5c75754ad401ce88d7b30_NeikiAnalytics.exe	39
PID 1948 wrote to memory of 1564	1948	6fe27815a3c5c75754ad401ce88d7b30_NeikiAnalytics.exe	40
PID 1948 wrote to memory of 1564	1948	6fe27815a3c5c75754ad401ce88d7b30_NeikiAnalytics.exe	40
PID 1948 wrote to memory of 1564	1948	6fe27815a3c5c75754ad401ce88d7b30_NeikiAnalytics.exe	40
PID 1948 wrote to memory of 1260	1948	6fe27815a3c5c75754ad401ce88d7b30_NeikiAnalytics.exe	41
PID 1948 wrote to memory of 1260	1948	6fe27815a3c5c75754ad401ce88d7b30_NeikiAnalytics.exe	41
PID 1948 wrote to memory of 1260	1948	6fe27815a3c5c75754ad401ce88d7b30_NeikiAnalytics.exe	41
PID 1948 wrote to memory of 2148	1948	6fe27815a3c5c75754ad401ce88d7b30_NeikiAnalytics.exe	42
PID 1948 wrote to memory of 2148	1948	6fe27815a3c5c75754ad401ce88d7b30_NeikiAnalytics.exe	42
PID 1948 wrote to memory of 2148	1948	6fe27815a3c5c75754ad401ce88d7b30_NeikiAnalytics.exe	42
PID 1948 wrote to memory of 2152	1948	6fe27815a3c5c75754ad401ce88d7b30_NeikiAnalytics.exe	43
PID 1948 wrote to memory of 2152	1948	6fe27815a3c5c75754ad401ce88d7b30_NeikiAnalytics.exe	43
PID 1948 wrote to memory of 2152	1948	6fe27815a3c5c75754ad401ce88d7b30_NeikiAnalytics.exe	43
PID 1948 wrote to memory of 2064	1948	6fe27815a3c5c75754ad401ce88d7b30_NeikiAnalytics.exe	44
PID 1948 wrote to memory of 2064	1948	6fe27815a3c5c75754ad401ce88d7b30_NeikiAnalytics.exe	44
PID 1948 wrote to memory of 2064	1948	6fe27815a3c5c75754ad401ce88d7b30_NeikiAnalytics.exe	44
PID 1948 wrote to memory of 2280	1948	6fe27815a3c5c75754ad401ce88d7b30_NeikiAnalytics.exe	45
PID 1948 wrote to memory of 2280	1948	6fe27815a3c5c75754ad401ce88d7b30_NeikiAnalytics.exe	45
PID 1948 wrote to memory of 2280	1948	6fe27815a3c5c75754ad401ce88d7b30_NeikiAnalytics.exe	45
PID 1948 wrote to memory of 2704	1948	6fe27815a3c5c75754ad401ce88d7b30_NeikiAnalytics.exe	46
PID 1948 wrote to memory of 2704	1948	6fe27815a3c5c75754ad401ce88d7b30_NeikiAnalytics.exe	46
PID 1948 wrote to memory of 2704	1948	6fe27815a3c5c75754ad401ce88d7b30_NeikiAnalytics.exe	46
PID 1948 wrote to memory of 1132	1948	6fe27815a3c5c75754ad401ce88d7b30_NeikiAnalytics.exe	47
PID 1948 wrote to memory of 1132	1948	6fe27815a3c5c75754ad401ce88d7b30_NeikiAnalytics.exe	47
PID 1948 wrote to memory of 1132	1948	6fe27815a3c5c75754ad401ce88d7b30_NeikiAnalytics.exe	47
PID 1948 wrote to memory of 2028	1948	6fe27815a3c5c75754ad401ce88d7b30_NeikiAnalytics.exe	48
PID 1948 wrote to memory of 2028	1948	6fe27815a3c5c75754ad401ce88d7b30_NeikiAnalytics.exe	48
PID 1948 wrote to memory of 2028	1948	6fe27815a3c5c75754ad401ce88d7b30_NeikiAnalytics.exe	48
PID 1948 wrote to memory of 2748	1948	6fe27815a3c5c75754ad401ce88d7b30_NeikiAnalytics.exe	49
PID 1948 wrote to memory of 2748	1948	6fe27815a3c5c75754ad401ce88d7b30_NeikiAnalytics.exe	49
PID 1948 wrote to memory of 2748	1948	6fe27815a3c5c75754ad401ce88d7b30_NeikiAnalytics.exe	49
PID 1948 wrote to memory of 1924	1948	6fe27815a3c5c75754ad401ce88d7b30_NeikiAnalytics.exe	50

C:\Users\Admin\AppData\Local\Temp\6fe27815a3c5c75754ad401ce88d7b30_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\6fe27815a3c5c75754ad401ce88d7b30_NeikiAnalytics.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1948
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2228
- C:\Windows\System\jNeZTUh.exe
  C:\Windows\System\jNeZTUh.exe
  2⤵
  - Executes dropped EXE
  PID:1624
- C:\Windows\System\xZCbpwi.exe
  C:\Windows\System\xZCbpwi.exe
  2⤵
  - Executes dropped EXE
  PID:2580
- C:\Windows\System\TdagFAg.exe
  C:\Windows\System\TdagFAg.exe
  2⤵
  - Executes dropped EXE
  PID:2512
- C:\Windows\System\UIAtLwC.exe
  C:\Windows\System\UIAtLwC.exe
  2⤵
  - Executes dropped EXE
  PID:2568
- C:\Windows\System\fnLghAS.exe
  C:\Windows\System\fnLghAS.exe
  2⤵
  - Executes dropped EXE
  PID:2576
- C:\Windows\System\LklkSwe.exe
  C:\Windows\System\LklkSwe.exe
  2⤵
  - Executes dropped EXE
  PID:2652
- C:\Windows\System\wcyqanS.exe
  C:\Windows\System\wcyqanS.exe
  2⤵
  - Executes dropped EXE
  PID:2400
- C:\Windows\System\zAyfXic.exe
  C:\Windows\System\zAyfXic.exe
  2⤵
  - Executes dropped EXE
  PID:2464
- C:\Windows\System\oVyLfWy.exe
  C:\Windows\System\oVyLfWy.exe
  2⤵
  - Executes dropped EXE
  PID:2856
- C:\Windows\System\nqkKXMF.exe
  C:\Windows\System\nqkKXMF.exe
  2⤵
  - Executes dropped EXE
  PID:1716
- C:\Windows\System\RNQjuFs.exe
  C:\Windows\System\RNQjuFs.exe
  2⤵
  - Executes dropped EXE
  PID:1564
- C:\Windows\System\EdCLxyK.exe
  C:\Windows\System\EdCLxyK.exe
  2⤵
  - Executes dropped EXE
  PID:1260
- C:\Windows\System\JxhnADH.exe
  C:\Windows\System\JxhnADH.exe
  2⤵
  - Executes dropped EXE
  PID:2148
- C:\Windows\System\VtlbtLv.exe
  C:\Windows\System\VtlbtLv.exe
  2⤵
  - Executes dropped EXE
  PID:2152
- C:\Windows\System\CjbsZKN.exe
  C:\Windows\System\CjbsZKN.exe
  2⤵
  - Executes dropped EXE
  PID:2064
- C:\Windows\System\uZyfZhf.exe
  C:\Windows\System\uZyfZhf.exe
  2⤵
  - Executes dropped EXE
  PID:2280
- C:\Windows\System\ykDdbBc.exe
  C:\Windows\System\ykDdbBc.exe
  2⤵
  - Executes dropped EXE
  PID:2704
- C:\Windows\System\eHwinBh.exe
  C:\Windows\System\eHwinBh.exe
  2⤵
  - Executes dropped EXE
  PID:1132
- C:\Windows\System\KxWfZGI.exe
  C:\Windows\System\KxWfZGI.exe
  2⤵
  - Executes dropped EXE
  PID:2028
- C:\Windows\System\AmbegLx.exe
  C:\Windows\System\AmbegLx.exe
  2⤵
  - Executes dropped EXE
  PID:2748
- C:\Windows\System\NCMeFRT.exe
  C:\Windows\System\NCMeFRT.exe
  2⤵
  - Executes dropped EXE
  PID:1924
- C:\Windows\System\cJAqEAm.exe
  C:\Windows\System\cJAqEAm.exe
  2⤵
  - Executes dropped EXE
  PID:2004
- C:\Windows\System\SNbwUpg.exe
  C:\Windows\System\SNbwUpg.exe
  2⤵
  - Executes dropped EXE
  PID:2428
- C:\Windows\System\lXvfJOd.exe
  C:\Windows\System\lXvfJOd.exe
  2⤵
  - Executes dropped EXE
  PID:268
- C:\Windows\System\XgcrBoQ.exe
  C:\Windows\System\XgcrBoQ.exe
  2⤵
  - Executes dropped EXE
  PID:700
- C:\Windows\System\XopTOmK.exe
  C:\Windows\System\XopTOmK.exe
  2⤵
  - Executes dropped EXE
  PID:1048
- C:\Windows\System\CglJXlY.exe
  C:\Windows\System\CglJXlY.exe
  2⤵
  - Executes dropped EXE
  PID:1780
- C:\Windows\System\bVxDUlO.exe
  C:\Windows\System\bVxDUlO.exe
  2⤵
  - Executes dropped EXE
  PID:1720
- C:\Windows\System\TRsUZzU.exe
  C:\Windows\System\TRsUZzU.exe
  2⤵
  - Executes dropped EXE
  PID:2360
- C:\Windows\System\rtIWpkg.exe
  C:\Windows\System\rtIWpkg.exe
  2⤵
  - Executes dropped EXE
  PID:1956
- C:\Windows\System\XUBoArq.exe
  C:\Windows\System\XUBoArq.exe
  2⤵
  - Executes dropped EXE
  PID:992
- C:\Windows\System\CckGqqR.exe
  C:\Windows\System\CckGqqR.exe
  2⤵
  - Executes dropped EXE
  PID:1108
- C:\Windows\System\REyqUBv.exe
  C:\Windows\System\REyqUBv.exe
  2⤵
  - Executes dropped EXE
  PID:296
- C:\Windows\System\lnWQGYl.exe
  C:\Windows\System\lnWQGYl.exe
  2⤵
  - Executes dropped EXE
  PID:1480
- C:\Windows\System\ddpBeIu.exe
  C:\Windows\System\ddpBeIu.exe
  2⤵
  - Executes dropped EXE
  PID:1212
- C:\Windows\System\QkDoZsP.exe
  C:\Windows\System\QkDoZsP.exe
  2⤵
  - Executes dropped EXE
  PID:1284
- C:\Windows\System\VHdPjGw.exe
  C:\Windows\System\VHdPjGw.exe
  2⤵
  - Executes dropped EXE
  PID:808
- C:\Windows\System\dSkVOjp.exe
  C:\Windows\System\dSkVOjp.exe
  2⤵
  - Executes dropped EXE
  PID:276
- C:\Windows\System\mKEsBAp.exe
  C:\Windows\System\mKEsBAp.exe
  2⤵
  - Executes dropped EXE
  PID:272
- C:\Windows\System\sGQQqoJ.exe
  C:\Windows\System\sGQQqoJ.exe
  2⤵
  - Executes dropped EXE
  PID:780
- C:\Windows\System\BvtUjVP.exe
  C:\Windows\System\BvtUjVP.exe
  2⤵
  - Executes dropped EXE
  PID:884
- C:\Windows\System\fBTCdHE.exe
  C:\Windows\System\fBTCdHE.exe
  2⤵
  - Executes dropped EXE
  PID:2216
- C:\Windows\System\AuqlCKe.exe
  C:\Windows\System\AuqlCKe.exe
  2⤵
  - Executes dropped EXE
  PID:2244
- C:\Windows\System\SiDbkLy.exe
  C:\Windows\System\SiDbkLy.exe
  2⤵
  - Executes dropped EXE
  PID:1864
- C:\Windows\System\hQFZdVW.exe
  C:\Windows\System\hQFZdVW.exe
  2⤵
  - Executes dropped EXE
  PID:2236
- C:\Windows\System\AVcPCcq.exe
  C:\Windows\System\AVcPCcq.exe
  2⤵
  - Executes dropped EXE
  PID:2804
- C:\Windows\System\fKrFiPV.exe
  C:\Windows\System\fKrFiPV.exe
  2⤵
  - Executes dropped EXE
  PID:340
- C:\Windows\System\ZMAJfZV.exe
  C:\Windows\System\ZMAJfZV.exe
  2⤵
  - Executes dropped EXE
  PID:900
- C:\Windows\System\PPpOBkp.exe
  C:\Windows\System\PPpOBkp.exe
  2⤵
  - Executes dropped EXE
  PID:1620
- C:\Windows\System\dmniQlf.exe
  C:\Windows\System\dmniQlf.exe
  2⤵
  - Executes dropped EXE
  PID:1664
- C:\Windows\System\mzJtoFp.exe
  C:\Windows\System\mzJtoFp.exe
  2⤵
  - Executes dropped EXE
  PID:1524
- C:\Windows\System\mvtqxHa.exe
  C:\Windows\System\mvtqxHa.exe
  2⤵
  - Executes dropped EXE
  PID:1636
- C:\Windows\System\mTSAJuF.exe
  C:\Windows\System\mTSAJuF.exe
  2⤵
  - Executes dropped EXE
  PID:2088
- C:\Windows\System\mjhbqJs.exe
  C:\Windows\System\mjhbqJs.exe
  2⤵
  - Executes dropped EXE
  PID:2592
- C:\Windows\System\bESDcdc.exe
  C:\Windows\System\bESDcdc.exe
  2⤵
  - Executes dropped EXE
  PID:2644
- C:\Windows\System\wqcsICN.exe
  C:\Windows\System\wqcsICN.exe
  2⤵
  - Executes dropped EXE
  PID:2436
- C:\Windows\System\JSefwzQ.exe
  C:\Windows\System\JSefwzQ.exe
  2⤵
  - Executes dropped EXE
  PID:2384
- C:\Windows\System\WvPlBDp.exe
  C:\Windows\System\WvPlBDp.exe
  2⤵
  - Executes dropped EXE
  PID:2096
- C:\Windows\System\XZBdnvi.exe
  C:\Windows\System\XZBdnvi.exe
  2⤵
  - Executes dropped EXE
  PID:2860
- C:\Windows\System\SGpdeSh.exe
  C:\Windows\System\SGpdeSh.exe
  2⤵
  - Executes dropped EXE
  PID:1256
- C:\Windows\System\degFPop.exe
  C:\Windows\System\degFPop.exe
  2⤵
  - Executes dropped EXE
  PID:2276
- C:\Windows\System\pjYMTmJ.exe
  C:\Windows\System\pjYMTmJ.exe
  2⤵
  - Executes dropped EXE
  PID:1452
- C:\Windows\System\ATnwHWR.exe
  C:\Windows\System\ATnwHWR.exe
  2⤵
  - Executes dropped EXE
  PID:2656
- C:\Windows\System\hUivWhQ.exe
  C:\Windows\System\hUivWhQ.exe
  2⤵
  - Executes dropped EXE
  PID:2024
- C:\Windows\System\KhQNBHU.exe
  C:\Windows\System\KhQNBHU.exe
  2⤵
  PID:2832
- C:\Windows\System\rRdhAwS.exe
  C:\Windows\System\rRdhAwS.exe
  2⤵
  PID:2200
- C:\Windows\System\vGWvdeO.exe
  C:\Windows\System\vGWvdeO.exe
  2⤵
  PID:2524
- C:\Windows\System\SugAEhD.exe
  C:\Windows\System\SugAEhD.exe
  2⤵
  PID:2688
- C:\Windows\System\YKkujbg.exe
  C:\Windows\System\YKkujbg.exe
  2⤵
  PID:2936
- C:\Windows\System\wyNkoij.exe
  C:\Windows\System\wyNkoij.exe
  2⤵
  PID:2844
- C:\Windows\System\MscPdBp.exe
  C:\Windows\System\MscPdBp.exe
  2⤵
  PID:1976
- C:\Windows\System\hOfHYXz.exe
  C:\Windows\System\hOfHYXz.exe
  2⤵
  PID:1696
- C:\Windows\System\EAuBZyj.exe
  C:\Windows\System\EAuBZyj.exe
  2⤵
  PID:960
- C:\Windows\System\RWVdtmw.exe
  C:\Windows\System\RWVdtmw.exe
  2⤵
  PID:1932
- C:\Windows\System\rCtmbke.exe
  C:\Windows\System\rCtmbke.exe
  2⤵
  PID:1572
- C:\Windows\System\pRtfzzf.exe
  C:\Windows\System\pRtfzzf.exe
  2⤵
  PID:2356
- C:\Windows\System\dgZcUqj.exe
  C:\Windows\System\dgZcUqj.exe
  2⤵
  PID:1700
- C:\Windows\System\mdmnxWK.exe
  C:\Windows\System\mdmnxWK.exe
  2⤵
  PID:796
- C:\Windows\System\mtiBCnZ.exe
  C:\Windows\System\mtiBCnZ.exe
  2⤵
  PID:1468
- C:\Windows\System\rVNlExw.exe
  C:\Windows\System\rVNlExw.exe
  2⤵
  PID:948
- C:\Windows\System\KfcMXlC.exe
  C:\Windows\System\KfcMXlC.exe
  2⤵
  PID:2600
- C:\Windows\System\fYLKZCF.exe
  C:\Windows\System\fYLKZCF.exe
  2⤵
  PID:1940
- C:\Windows\System\yBUyTVf.exe
  C:\Windows\System\yBUyTVf.exe
  2⤵
  PID:2552
- C:\Windows\System\yhwOpIz.exe
  C:\Windows\System\yhwOpIz.exe
  2⤵
  PID:1868
- C:\Windows\System\KeMoMjD.exe
  C:\Windows\System\KeMoMjD.exe
  2⤵
  PID:2816
- C:\Windows\System\eeepoRz.exe
  C:\Windows\System\eeepoRz.exe
  2⤵
  PID:1640
- C:\Windows\System\dJFSzfz.exe
  C:\Windows\System\dJFSzfz.exe
  2⤵
  PID:1472
- C:\Windows\System\pKwlUCw.exe
  C:\Windows\System\pKwlUCw.exe
  2⤵
  PID:2320
- C:\Windows\System\yoMtiey.exe
  C:\Windows\System\yoMtiey.exe
  2⤵
  PID:1428
- C:\Windows\System\FuXQUmS.exe
  C:\Windows\System\FuXQUmS.exe
  2⤵
  PID:1536
- C:\Windows\System\HXVnPdX.exe
  C:\Windows\System\HXVnPdX.exe
  2⤵
  PID:2924
- C:\Windows\System\jNdzSRD.exe
  C:\Windows\System\jNdzSRD.exe
  2⤵
  PID:2396
- C:\Windows\System\SBMiMOg.exe
  C:\Windows\System\SBMiMOg.exe
  2⤵
  PID:1208
- C:\Windows\System\XRhjFMk.exe
  C:\Windows\System\XRhjFMk.exe
  2⤵
  PID:2476
- C:\Windows\System\NwrXPKF.exe
  C:\Windows\System\NwrXPKF.exe
  2⤵
  PID:2520
- C:\Windows\System\pItdGFB.exe
  C:\Windows\System\pItdGFB.exe
  2⤵
  PID:1436
- C:\Windows\System\xdvnAlz.exe
  C:\Windows\System\xdvnAlz.exe
  2⤵
  PID:1732
- C:\Windows\System\KzuAJTq.exe
  C:\Windows\System\KzuAJTq.exe
  2⤵
  PID:1552
- C:\Windows\System\DfalqDZ.exe
  C:\Windows\System\DfalqDZ.exe
  2⤵
  PID:1912
- C:\Windows\System\ninDwLN.exe
  C:\Windows\System\ninDwLN.exe
  2⤵
  PID:2452
- C:\Windows\System\WhFEuBd.exe
  C:\Windows\System\WhFEuBd.exe
  2⤵
  PID:2008
- C:\Windows\System\HIrZeCg.exe
  C:\Windows\System\HIrZeCg.exe
  2⤵
  PID:2076
- C:\Windows\System\FslMFKm.exe
  C:\Windows\System\FslMFKm.exe
  2⤵
  PID:2700
- C:\Windows\System\pUqGaje.exe
  C:\Windows\System\pUqGaje.exe
  2⤵
  PID:1416
- C:\Windows\System\FNiwZgv.exe
  C:\Windows\System\FNiwZgv.exe
  2⤵
  PID:1748
- C:\Windows\System\uAvBchP.exe
  C:\Windows\System\uAvBchP.exe
  2⤵
  PID:1092
- C:\Windows\System\tatosho.exe
  C:\Windows\System\tatosho.exe
  2⤵
  PID:2372
- C:\Windows\System\jFdlvDC.exe
  C:\Windows\System\jFdlvDC.exe
  2⤵
  PID:2196
- C:\Windows\System\AfWXdig.exe
  C:\Windows\System\AfWXdig.exe
  2⤵
  PID:612
- C:\Windows\System\lfvCzpQ.exe
  C:\Windows\System\lfvCzpQ.exe
  2⤵
  PID:1980
- C:\Windows\System\kntSdZJ.exe
  C:\Windows\System\kntSdZJ.exe
  2⤵
  PID:1484
- C:\Windows\System\TraPHRL.exe
  C:\Windows\System\TraPHRL.exe
  2⤵
  PID:1704
- C:\Windows\System\gDWScRk.exe
  C:\Windows\System\gDWScRk.exe
  2⤵
  PID:1460
- C:\Windows\System\kMnYqEE.exe
  C:\Windows\System\kMnYqEE.exe
  2⤵
  PID:2192
- C:\Windows\System\cRHBFHO.exe
  C:\Windows\System\cRHBFHO.exe
  2⤵
  PID:2288
- C:\Windows\System\AyCnAxt.exe
  C:\Windows\System\AyCnAxt.exe
  2⤵
  PID:1836
- C:\Windows\System\UeMWyUt.exe
  C:\Windows\System\UeMWyUt.exe
  2⤵
  PID:1656
- C:\Windows\System\egcTUaa.exe
  C:\Windows\System\egcTUaa.exe
  2⤵
  PID:1972
- C:\Windows\System\liLLDBy.exe
  C:\Windows\System\liLLDBy.exe
  2⤵
  PID:2776
- C:\Windows\System\zCafmhS.exe
  C:\Windows\System\zCafmhS.exe
  2⤵
  PID:1896
- C:\Windows\System\XDHoZcN.exe
  C:\Windows\System\XDHoZcN.exe
  2⤵
  PID:2872
- C:\Windows\System\UhsebSA.exe
  C:\Windows\System\UhsebSA.exe
  2⤵
  PID:2488
- C:\Windows\System\krdTJfZ.exe
  C:\Windows\System\krdTJfZ.exe
  2⤵
  PID:2876
- C:\Windows\System\JoLgPxV.exe
  C:\Windows\System\JoLgPxV.exe
  2⤵
  PID:2868
- C:\Windows\System\uSMaVBz.exe
  C:\Windows\System\uSMaVBz.exe
  2⤵
  PID:320
- C:\Windows\System\kReLHqQ.exe
  C:\Windows\System\kReLHqQ.exe
  2⤵
  PID:1900
- C:\Windows\System\qzVNsGM.exe
  C:\Windows\System\qzVNsGM.exe
  2⤵
  PID:616
- C:\Windows\System\ozqWHYo.exe
  C:\Windows\System\ozqWHYo.exe
  2⤵
  PID:540
- C:\Windows\System\sGNnMXU.exe
  C:\Windows\System\sGNnMXU.exe
  2⤵
  PID:2156
- C:\Windows\System\jKiazdy.exe
  C:\Windows\System\jKiazdy.exe
  2⤵
  PID:2296
- C:\Windows\System\ANQhxYo.exe
  C:\Windows\System\ANQhxYo.exe
  2⤵
  PID:1176
- C:\Windows\System\GswgBtW.exe
  C:\Windows\System\GswgBtW.exe
  2⤵
  PID:2316
- C:\Windows\System\pknXLes.exe
  C:\Windows\System\pknXLes.exe
  2⤵
  PID:2484
- C:\Windows\System\vUopSvD.exe
  C:\Windows\System\vUopSvD.exe
  2⤵
  PID:376
- C:\Windows\System\qwmWJWJ.exe
  C:\Windows\System\qwmWJWJ.exe
  2⤵
  PID:2908
- C:\Windows\System\PdSrgcy.exe
  C:\Windows\System\PdSrgcy.exe
  2⤵
  PID:3020
- C:\Windows\System\vopPQja.exe
  C:\Windows\System\vopPQja.exe
  2⤵
  PID:744
- C:\Windows\System\ZsxuBhC.exe
  C:\Windows\System\ZsxuBhC.exe
  2⤵
  PID:1888
- C:\Windows\System\AtftOzj.exe
  C:\Windows\System\AtftOzj.exe
  2⤵
  PID:2736
- C:\Windows\System\IKRgiLO.exe
  C:\Windows\System\IKRgiLO.exe
  2⤵
  PID:2348
- C:\Windows\System\fkSovij.exe
  C:\Windows\System\fkSovij.exe
  2⤵
  PID:1952
- C:\Windows\System\adnACKO.exe
  C:\Windows\System\adnACKO.exe
  2⤵
  PID:2648
- C:\Windows\System\wicXMqW.exe
  C:\Windows\System\wicXMqW.exe
  2⤵
  PID:2124
- C:\Windows\System\hySfddV.exe
  C:\Windows\System\hySfddV.exe
  2⤵
  PID:1184
- C:\Windows\System\Fmndrwe.exe
  C:\Windows\System\Fmndrwe.exe
  2⤵
  PID:2260
- C:\Windows\System\cfPgGHB.exe
  C:\Windows\System\cfPgGHB.exe
  2⤵
  PID:2336
- C:\Windows\System\SLHYThv.exe
  C:\Windows\System\SLHYThv.exe
  2⤵
  PID:1400
- C:\Windows\System\GokjqTk.exe
  C:\Windows\System\GokjqTk.exe
  2⤵
  PID:2796
- C:\Windows\System\MgdRmVT.exe
  C:\Windows\System\MgdRmVT.exe
  2⤵
  PID:2640
- C:\Windows\System\HbpZQbu.exe
  C:\Windows\System\HbpZQbu.exe
  2⤵
  PID:844
- C:\Windows\System\yNPYKCI.exe
  C:\Windows\System\yNPYKCI.exe
  2⤵
  PID:2012
- C:\Windows\System\STKSOrT.exe
  C:\Windows\System\STKSOrT.exe
  2⤵
  PID:572
- C:\Windows\System\gYvwICp.exe
  C:\Windows\System\gYvwICp.exe
  2⤵
  PID:1456
- C:\Windows\System\nTHFUhV.exe
  C:\Windows\System\nTHFUhV.exe
  2⤵
  PID:328
- C:\Windows\System\MBUYmda.exe
  C:\Windows\System\MBUYmda.exe
  2⤵
  PID:2584
- C:\Windows\System\BGEMDbO.exe
  C:\Windows\System\BGEMDbO.exe
  2⤵
  PID:576
- C:\Windows\System\STVcKGQ.exe
  C:\Windows\System\STVcKGQ.exe
  2⤵
  PID:848
- C:\Windows\System\tuRNZnh.exe
  C:\Windows\System\tuRNZnh.exe
  2⤵
  PID:2496
- C:\Windows\System\dlscnWW.exe
  C:\Windows\System\dlscnWW.exe
  2⤵
  PID:1360
- C:\Windows\System\QmFbBZB.exe
  C:\Windows\System\QmFbBZB.exe
  2⤵
  PID:708
- C:\Windows\System\vNIVhHo.exe
  C:\Windows\System\vNIVhHo.exe
  2⤵
  PID:916
- C:\Windows\System\AmIGumY.exe
  C:\Windows\System\AmIGumY.exe
  2⤵
  PID:2324
- C:\Windows\System\eLtRVPR.exe
  C:\Windows\System\eLtRVPR.exe
  2⤵
  PID:2308
- C:\Windows\System\tgqcoUF.exe
  C:\Windows\System\tgqcoUF.exe
  2⤵
  PID:3032
- C:\Windows\System\YqGxsNq.exe
  C:\Windows\System\YqGxsNq.exe
  2⤵
  PID:2532
- C:\Windows\System\PebLrss.exe
  C:\Windows\System\PebLrss.exe
  2⤵
  PID:680
- C:\Windows\System\TmFRFWC.exe
  C:\Windows\System\TmFRFWC.exe
  2⤵
  PID:2548
- C:\Windows\System\pBCXRmP.exe
  C:\Windows\System\pBCXRmP.exe
  2⤵
  PID:400
- C:\Windows\System\nmHqYMs.exe
  C:\Windows\System\nmHqYMs.exe
  2⤵
  PID:3076
- C:\Windows\System\BStKdUZ.exe
  C:\Windows\System\BStKdUZ.exe
  2⤵
  PID:3092
- C:\Windows\System\UfSKtYx.exe
  C:\Windows\System\UfSKtYx.exe
  2⤵
  PID:3108
- C:\Windows\System\KQCxZeQ.exe
  C:\Windows\System\KQCxZeQ.exe
  2⤵
  PID:3124
- C:\Windows\System\PBFpHIt.exe
  C:\Windows\System\PBFpHIt.exe
  2⤵
  PID:3140
- C:\Windows\System\YeamcUo.exe
  C:\Windows\System\YeamcUo.exe
  2⤵
  PID:3156
- C:\Windows\System\TlAYNVX.exe
  C:\Windows\System\TlAYNVX.exe
  2⤵
  PID:3172
- C:\Windows\System\ljVselH.exe
  C:\Windows\System\ljVselH.exe
  2⤵
  PID:3188
- C:\Windows\System\RqFvfBQ.exe
  C:\Windows\System\RqFvfBQ.exe
  2⤵
  PID:3204
- C:\Windows\System\gUgsSnu.exe
  C:\Windows\System\gUgsSnu.exe
  2⤵
  PID:3220
- C:\Windows\System\LQwhNhc.exe
  C:\Windows\System\LQwhNhc.exe
  2⤵
  PID:3236
- C:\Windows\System\ihTRcVS.exe
  C:\Windows\System\ihTRcVS.exe
  2⤵
  PID:3256
- C:\Windows\System\HPcDVvt.exe
  C:\Windows\System\HPcDVvt.exe
  2⤵
  PID:3348
- C:\Windows\System\gVSkXKu.exe
  C:\Windows\System\gVSkXKu.exe
  2⤵
  PID:3364
- C:\Windows\System\VMGgnIq.exe
  C:\Windows\System\VMGgnIq.exe
  2⤵
  PID:3384
- C:\Windows\System\CshWosW.exe
  C:\Windows\System\CshWosW.exe
  2⤵
  PID:3416
- C:\Windows\System\sVgVvfa.exe
  C:\Windows\System\sVgVvfa.exe
  2⤵
  PID:3432
- C:\Windows\System\edTWZmD.exe
  C:\Windows\System\edTWZmD.exe
  2⤵
  PID:3448
- C:\Windows\System\asukhPv.exe
  C:\Windows\System\asukhPv.exe
  2⤵
  PID:3464
- C:\Windows\System\rPssKKX.exe
  C:\Windows\System\rPssKKX.exe
  2⤵
  PID:3480
- C:\Windows\System\gJiVifF.exe
  C:\Windows\System\gJiVifF.exe
  2⤵
  PID:3496
- C:\Windows\System\mnxnEsc.exe
  C:\Windows\System\mnxnEsc.exe
  2⤵
  PID:3516
- C:\Windows\System\QgSGTou.exe
  C:\Windows\System\QgSGTou.exe
  2⤵
  PID:3532
- C:\Windows\System\wkwcDfM.exe
  C:\Windows\System\wkwcDfM.exe
  2⤵
  PID:3548
- C:\Windows\System\QClRrOe.exe
  C:\Windows\System\QClRrOe.exe
  2⤵
  PID:3564
- C:\Windows\System\HWUjQeJ.exe
  C:\Windows\System\HWUjQeJ.exe
  2⤵
  PID:3580
- C:\Windows\System\ZeQOXFl.exe
  C:\Windows\System\ZeQOXFl.exe
  2⤵
  PID:3596
- C:\Windows\System\xGvlvHS.exe
  C:\Windows\System\xGvlvHS.exe
  2⤵
  PID:3612
- C:\Windows\System\unvSqNt.exe
  C:\Windows\System\unvSqNt.exe
  2⤵
  PID:3632
- C:\Windows\System\tufrNSX.exe
  C:\Windows\System\tufrNSX.exe
  2⤵
  PID:3648
- C:\Windows\System\IVIpGZQ.exe
  C:\Windows\System\IVIpGZQ.exe
  2⤵
  PID:3664
- C:\Windows\System\jjuduxR.exe
  C:\Windows\System\jjuduxR.exe
  2⤵
  PID:3680
- C:\Windows\System\ZAwTPKy.exe
  C:\Windows\System\ZAwTPKy.exe
  2⤵
  PID:3696
- C:\Windows\System\YstPoTf.exe
  C:\Windows\System\YstPoTf.exe
  2⤵
  PID:3712
- C:\Windows\System\TGeKYSF.exe
  C:\Windows\System\TGeKYSF.exe
  2⤵
  PID:3728
- C:\Windows\System\fLgmtMr.exe
  C:\Windows\System\fLgmtMr.exe
  2⤵
  PID:3748
- C:\Windows\System\xGFShpn.exe
  C:\Windows\System\xGFShpn.exe
  2⤵
  PID:3768
- C:\Windows\System\gdDbgkl.exe
  C:\Windows\System\gdDbgkl.exe
  2⤵
  PID:3784
- C:\Windows\System\hsOhavJ.exe
  C:\Windows\System\hsOhavJ.exe
  2⤵
  PID:3800
- C:\Windows\System\HiMTZNS.exe
  C:\Windows\System\HiMTZNS.exe
  2⤵
  PID:3820
- C:\Windows\System\zynKBcn.exe
  C:\Windows\System\zynKBcn.exe
  2⤵
  PID:3836
- C:\Windows\System\ykJOSQQ.exe
  C:\Windows\System\ykJOSQQ.exe
  2⤵
  PID:3852
- C:\Windows\System\cwcpedq.exe
  C:\Windows\System\cwcpedq.exe
  2⤵
  PID:3868
- C:\Windows\System\BLhSohN.exe
  C:\Windows\System\BLhSohN.exe
  2⤵
  PID:3884
- C:\Windows\System\HoXmnMO.exe
  C:\Windows\System\HoXmnMO.exe
  2⤵
  PID:3900
- C:\Windows\System\nAvXpfW.exe
  C:\Windows\System\nAvXpfW.exe
  2⤵
  PID:3916
- C:\Windows\System\SqVMSXX.exe
  C:\Windows\System\SqVMSXX.exe
  2⤵
  PID:3932
- C:\Windows\System\LiaijoZ.exe
  C:\Windows\System\LiaijoZ.exe
  2⤵
  PID:3952
- C:\Windows\System\ksuImDd.exe
  C:\Windows\System\ksuImDd.exe
  2⤵
  PID:3968
- C:\Windows\System\uiskKhw.exe
  C:\Windows\System\uiskKhw.exe
  2⤵
  PID:3984
- C:\Windows\System\hAUlvZI.exe
  C:\Windows\System\hAUlvZI.exe
  2⤵
  PID:2040
- C:\Windows\System\mHPryvj.exe
  C:\Windows\System\mHPryvj.exe
  2⤵
  PID:1592
- C:\Windows\System\qvjkGBb.exe
  C:\Windows\System\qvjkGBb.exe
  2⤵
  PID:3136
- C:\Windows\System\imVDWYE.exe
  C:\Windows\System\imVDWYE.exe
  2⤵
  PID:3148
- C:\Windows\System\DVRWMlI.exe
  C:\Windows\System\DVRWMlI.exe
  2⤵
  PID:2060
- C:\Windows\System\wWJUigV.exe
  C:\Windows\System\wWJUigV.exe
  2⤵
  PID:3120
- C:\Windows\System\smZYyfK.exe
  C:\Windows\System\smZYyfK.exe
  2⤵
  PID:3216
- C:\Windows\System\qvTUqlN.exe
  C:\Windows\System\qvTUqlN.exe
  2⤵
  PID:2364
- C:\Windows\System\ptWcLLA.exe
  C:\Windows\System\ptWcLLA.exe
  2⤵
  PID:2880
- C:\Windows\System\WWKJseu.exe
  C:\Windows\System\WWKJseu.exe
  2⤵
  PID:3164
- C:\Windows\System\OQZAFwi.exe
  C:\Windows\System\OQZAFwi.exe
  2⤵
  PID:3288
- C:\Windows\System\DBZecYR.exe
  C:\Windows\System\DBZecYR.exe
  2⤵
  PID:3316
- C:\Windows\System\cAQPGQf.exe
  C:\Windows\System\cAQPGQf.exe
  2⤵
  PID:3328
- C:\Windows\System\HcXHTxn.exe
  C:\Windows\System\HcXHTxn.exe
  2⤵
  PID:3372
- C:\Windows\System\coMMvaX.exe
  C:\Windows\System\coMMvaX.exe
  2⤵
  PID:3264
- C:\Windows\System\ltBmira.exe
  C:\Windows\System\ltBmira.exe
  2⤵
  PID:3524
- C:\Windows\System\nrETUnG.exe
  C:\Windows\System\nrETUnG.exe
  2⤵
  PID:2728
- C:\Windows\System\fLHlhzz.exe
  C:\Windows\System\fLHlhzz.exe
  2⤵
  PID:3656
- C:\Windows\System\MUttsqH.exe
  C:\Windows\System\MUttsqH.exe
  2⤵
  PID:3460
- C:\Windows\System\CssjiWl.exe
  C:\Windows\System\CssjiWl.exe
  2⤵
  PID:3440
- C:\Windows\System\aeBfSoD.exe
  C:\Windows\System\aeBfSoD.exe
  2⤵
  PID:3492
- C:\Windows\System\QevUzBQ.exe
  C:\Windows\System\QevUzBQ.exe
  2⤵
  PID:3892
- C:\Windows\System\TChqqSG.exe
  C:\Windows\System\TChqqSG.exe
  2⤵
  PID:3964
- C:\Windows\System\causNiS.exe
  C:\Windows\System\causNiS.exe
  2⤵
  PID:3476
- C:\Windows\System\fiJUbXs.exe
  C:\Windows\System\fiJUbXs.exe
  2⤵
  PID:3512
- C:\Windows\System\uoTwYzl.exe
  C:\Windows\System\uoTwYzl.exe
  2⤵
  PID:3608
- C:\Windows\System\yGqPDZg.exe
  C:\Windows\System\yGqPDZg.exe
  2⤵
  PID:3708
- C:\Windows\System\kjEKeLD.exe
  C:\Windows\System\kjEKeLD.exe
  2⤵
  PID:3736
- C:\Windows\System\pKCvjQT.exe
  C:\Windows\System\pKCvjQT.exe
  2⤵
  PID:3812
- C:\Windows\System\qtRokzG.exe
  C:\Windows\System\qtRokzG.exe
  2⤵
  PID:3908
- C:\Windows\System\cbJgRwa.exe
  C:\Windows\System\cbJgRwa.exe
  2⤵
  PID:3976
- C:\Windows\System\OqPSwSu.exe
  C:\Windows\System\OqPSwSu.exe
  2⤵
  PID:4032
- C:\Windows\System\oelsAvt.exe
  C:\Windows\System\oelsAvt.exe
  2⤵
  PID:4052
- C:\Windows\System\XeRJcKH.exe
  C:\Windows\System\XeRJcKH.exe
  2⤵
  PID:4072
- C:\Windows\System\PyljGJa.exe
  C:\Windows\System\PyljGJa.exe
  2⤵
  PID:2964
- C:\Windows\System\GmfJFcZ.exe
  C:\Windows\System\GmfJFcZ.exe
  2⤵
  PID:2140
- C:\Windows\System\gUaNuTc.exe
  C:\Windows\System\gUaNuTc.exe
  2⤵
  PID:956
- C:\Windows\System\occlKbP.exe
  C:\Windows\System\occlKbP.exe
  2⤵
  PID:112
- C:\Windows\System\mfGNrXV.exe
  C:\Windows\System\mfGNrXV.exe
  2⤵
  PID:1364
- C:\Windows\System\vwIaznL.exe
  C:\Windows\System\vwIaznL.exe
  2⤵
  PID:2528
- C:\Windows\System\DJBLsPZ.exe
  C:\Windows\System\DJBLsPZ.exe
  2⤵
  PID:3252
- C:\Windows\System\zAqYWCQ.exe
  C:\Windows\System\zAqYWCQ.exe
  2⤵
  PID:2444
- C:\Windows\System\RhpBchB.exe
  C:\Windows\System\RhpBchB.exe
  2⤵
  PID:3304
- C:\Windows\System\VxiOkDi.exe
  C:\Windows\System\VxiOkDi.exe
  2⤵
  PID:3340
- C:\Windows\System\QNpNvWE.exe
  C:\Windows\System\QNpNvWE.exe
  2⤵
  PID:3428
- C:\Windows\System\rTwzTKj.exe
  C:\Windows\System\rTwzTKj.exe
  2⤵
  PID:2720
- C:\Windows\System\hwnMiUQ.exe
  C:\Windows\System\hwnMiUQ.exe
  2⤵
  PID:3688
- C:\Windows\System\hLsjiCt.exe
  C:\Windows\System\hLsjiCt.exe
  2⤵
  PID:3764
- C:\Windows\System\mFsDECC.exe
  C:\Windows\System\mFsDECC.exe
  2⤵
  PID:3864
- C:\Windows\System\fIbFJYR.exe
  C:\Windows\System\fIbFJYR.exe
  2⤵
  PID:3960
- C:\Windows\System\kbmJBty.exe
  C:\Windows\System\kbmJBty.exe
  2⤵
  PID:3844
- C:\Windows\System\lyzrChd.exe
  C:\Windows\System\lyzrChd.exe
  2⤵
  PID:3572
- C:\Windows\System\RlUxlXJ.exe
  C:\Windows\System\RlUxlXJ.exe
  2⤵
  PID:1588
- C:\Windows\System\XwczDSK.exe
  C:\Windows\System\XwczDSK.exe
  2⤵
  PID:4008
- C:\Windows\System\DSKBfnG.exe
  C:\Windows\System\DSKBfnG.exe
  2⤵
  PID:3808
- C:\Windows\System\pvgcMVa.exe
  C:\Windows\System\pvgcMVa.exe
  2⤵
  PID:4020
- C:\Windows\System\iizJEFE.exe
  C:\Windows\System\iizJEFE.exe
  2⤵
  PID:4088
- C:\Windows\System\iGByDYp.exe
  C:\Windows\System\iGByDYp.exe
  2⤵
  PID:3100
- C:\Windows\System\TGvWaON.exe
  C:\Windows\System\TGvWaON.exe
  2⤵
  PID:2132
- C:\Windows\System\lNwpTyA.exe
  C:\Windows\System\lNwpTyA.exe
  2⤵
  PID:1104
- C:\Windows\System\xmWRyyH.exe
  C:\Windows\System\xmWRyyH.exe
  2⤵
  PID:3184
- C:\Windows\System\xwDerZT.exe
  C:\Windows\System\xwDerZT.exe
  2⤵
  PID:3248
- C:\Windows\System\vYYlxgQ.exe
  C:\Windows\System\vYYlxgQ.exe
  2⤵
  PID:3292
- C:\Windows\System\FHbrLQS.exe
  C:\Windows\System\FHbrLQS.exe
  2⤵
  PID:3300
- C:\Windows\System\MeGULVK.exe
  C:\Windows\System\MeGULVK.exe
  2⤵
  PID:3320
- C:\Windows\System\GoCCVWm.exe
  C:\Windows\System\GoCCVWm.exe
  2⤵
  PID:2492
- C:\Windows\System\rRggRlq.exe
  C:\Windows\System\rRggRlq.exe
  2⤵
  PID:3692
- C:\Windows\System\OLBzIrg.exe
  C:\Windows\System\OLBzIrg.exe
  2⤵
  PID:3792
- C:\Windows\System\pGeppeH.exe
  C:\Windows\System\pGeppeH.exe
  2⤵
  PID:3676
- C:\Windows\System\gFsZmDA.exe
  C:\Windows\System\gFsZmDA.exe
  2⤵
  PID:3940
- C:\Windows\System\AnBsYZG.exe
  C:\Windows\System\AnBsYZG.exe
  2⤵
  PID:3508
- C:\Windows\System\ROglJQd.exe
  C:\Windows\System\ROglJQd.exe
  2⤵
  PID:4028
- C:\Windows\System\VFIuTHi.exe
  C:\Windows\System\VFIuTHi.exe
  2⤵
  PID:4084
- C:\Windows\System\RscsBrh.exe
  C:\Windows\System\RscsBrh.exe
  2⤵
  PID:1476
- C:\Windows\System\INaKMom.exe
  C:\Windows\System\INaKMom.exe
  2⤵
  PID:3740
- C:\Windows\System\QzUCKip.exe
  C:\Windows\System\QzUCKip.exe
  2⤵
  PID:3760
- C:\Windows\System\jTfmIbu.exe
  C:\Windows\System\jTfmIbu.exe
  2⤵
  PID:3880
- C:\Windows\System\doeifIX.exe
  C:\Windows\System\doeifIX.exe
  2⤵
  PID:3720
- C:\Windows\System\AGMYfPc.exe
  C:\Windows\System\AGMYfPc.exe
  2⤵
  PID:4048
- C:\Windows\System\uemKARr.exe
  C:\Windows\System\uemKARr.exe
  2⤵
  PID:3180
- C:\Windows\System\mmMveaL.exe
  C:\Windows\System\mmMveaL.exe
  2⤵
  PID:4092
- C:\Windows\System\nqYzxVE.exe
  C:\Windows\System\nqYzxVE.exe
  2⤵
  PID:3232
- C:\Windows\System\VGqBvbo.exe
  C:\Windows\System\VGqBvbo.exe
  2⤵
  PID:2128
- C:\Windows\System\GTChRJE.exe
  C:\Windows\System\GTChRJE.exe
  2⤵
  PID:4040
- C:\Windows\System\PInDfQM.exe
  C:\Windows\System\PInDfQM.exe
  2⤵
  PID:2892
- C:\Windows\System\rrVMeqs.exe
  C:\Windows\System\rrVMeqs.exe
  2⤵
  PID:3412
- C:\Windows\System\FGQlqCK.exe
  C:\Windows\System\FGQlqCK.exe
  2⤵
  PID:4068
- C:\Windows\System\dLfaiBT.exe
  C:\Windows\System\dLfaiBT.exe
  2⤵
  PID:3284
- C:\Windows\System\HJVeodN.exe
  C:\Windows\System\HJVeodN.exe
  2⤵
  PID:3672
- C:\Windows\System\pUjEpnl.exe
  C:\Windows\System\pUjEpnl.exe
  2⤵
  PID:3272
- C:\Windows\System\yjBeAgS.exe
  C:\Windows\System\yjBeAgS.exe
  2⤵
  PID:4112
- C:\Windows\System\QUlBqbR.exe
  C:\Windows\System\QUlBqbR.exe
  2⤵
  PID:4128
- C:\Windows\System\LhRaLqq.exe
  C:\Windows\System\LhRaLqq.exe
  2⤵
  PID:4160
- C:\Windows\System\arLsTTq.exe
  C:\Windows\System\arLsTTq.exe
  2⤵
  PID:4176
- C:\Windows\System\qBRQcbH.exe
  C:\Windows\System\qBRQcbH.exe
  2⤵
  PID:4192
- C:\Windows\System\hesgzFQ.exe
  C:\Windows\System\hesgzFQ.exe
  2⤵
  PID:4208
- C:\Windows\System\WXuLxsj.exe
  C:\Windows\System\WXuLxsj.exe
  2⤵
  PID:4224
- C:\Windows\System\aFCrQHk.exe
  C:\Windows\System\aFCrQHk.exe
  2⤵
  PID:4240
- C:\Windows\System\GJecIGD.exe
  C:\Windows\System\GJecIGD.exe
  2⤵
  PID:4280
- C:\Windows\System\dlZTfGw.exe
  C:\Windows\System\dlZTfGw.exe
  2⤵
  PID:4296
- C:\Windows\System\CJbQBBB.exe
  C:\Windows\System\CJbQBBB.exe
  2⤵
  PID:4312
- C:\Windows\System\gRFhXam.exe
  C:\Windows\System\gRFhXam.exe
  2⤵
  PID:4328
- C:\Windows\System\Psitbne.exe
  C:\Windows\System\Psitbne.exe
  2⤵
  PID:4344
- C:\Windows\System\soWYRgi.exe
  C:\Windows\System\soWYRgi.exe
  2⤵
  PID:4360
- C:\Windows\System\NeQjUNW.exe
  C:\Windows\System\NeQjUNW.exe
  2⤵
  PID:4380
- C:\Windows\System\bfVrlsA.exe
  C:\Windows\System\bfVrlsA.exe
  2⤵
  PID:4396
- C:\Windows\System\scUvAIA.exe
  C:\Windows\System\scUvAIA.exe
  2⤵
  PID:4412
- C:\Windows\System\gbEvNaW.exe
  C:\Windows\System\gbEvNaW.exe
  2⤵
  PID:4428
- C:\Windows\System\veqTRdx.exe
  C:\Windows\System\veqTRdx.exe
  2⤵
  PID:4444
- C:\Windows\System\TFErOPw.exe
  C:\Windows\System\TFErOPw.exe
  2⤵
  PID:4464
- C:\Windows\System\wMVKecP.exe
  C:\Windows\System\wMVKecP.exe
  2⤵
  PID:4484
- C:\Windows\System\WPAKSBq.exe
  C:\Windows\System\WPAKSBq.exe
  2⤵
  PID:4500
- C:\Windows\System\yyHbYBq.exe
  C:\Windows\System\yyHbYBq.exe
  2⤵
  PID:4520
- C:\Windows\System\rVtmeKA.exe
  C:\Windows\System\rVtmeKA.exe
  2⤵
  PID:4540
- C:\Windows\System\falGYNd.exe
  C:\Windows\System\falGYNd.exe
  2⤵
  PID:4600
- C:\Windows\System\lbTopnu.exe
  C:\Windows\System\lbTopnu.exe
  2⤵
  PID:4616
- C:\Windows\System\TrxqRkn.exe
  C:\Windows\System\TrxqRkn.exe
  2⤵
  PID:4644
- C:\Windows\System\ycuOwOK.exe
  C:\Windows\System\ycuOwOK.exe
  2⤵
  PID:4684
- C:\Windows\System\mWdlhfu.exe
  C:\Windows\System\mWdlhfu.exe
  2⤵
  PID:4700
- C:\Windows\System\VBJgJKM.exe
  C:\Windows\System\VBJgJKM.exe
  2⤵
  PID:4716
- C:\Windows\System\cfzpoRu.exe
  C:\Windows\System\cfzpoRu.exe
  2⤵
  PID:4732
- C:\Windows\System\SFMuaxW.exe
  C:\Windows\System\SFMuaxW.exe
  2⤵
  PID:4752
- C:\Windows\System\vypNwFM.exe
  C:\Windows\System\vypNwFM.exe
  2⤵
  PID:4768
- C:\Windows\System\yDmlVaX.exe
  C:\Windows\System\yDmlVaX.exe
  2⤵
  PID:4784
- C:\Windows\System\izTeDsF.exe
  C:\Windows\System\izTeDsF.exe
  2⤵
  PID:4800
- C:\Windows\System\QbGoRrV.exe
  C:\Windows\System\QbGoRrV.exe
  2⤵
  PID:4816
- C:\Windows\System\IguooGb.exe
  C:\Windows\System\IguooGb.exe
  2⤵
  PID:4836
- C:\Windows\System\OujVTgg.exe
  C:\Windows\System\OujVTgg.exe
  2⤵
  PID:4852
- C:\Windows\System\zKJbKmP.exe
  C:\Windows\System\zKJbKmP.exe
  2⤵
  PID:4868
- C:\Windows\System\EdknVSO.exe
  C:\Windows\System\EdknVSO.exe
  2⤵
  PID:4884
- C:\Windows\System\QJdzTVJ.exe
  C:\Windows\System\QJdzTVJ.exe
  2⤵
  PID:4904
- C:\Windows\System\EfJtacu.exe
  C:\Windows\System\EfJtacu.exe
  2⤵
  PID:4920
- C:\Windows\System\Nziqzpp.exe
  C:\Windows\System\Nziqzpp.exe
  2⤵
  PID:4936
- C:\Windows\System\FtcktDr.exe
  C:\Windows\System\FtcktDr.exe
  2⤵
  PID:4952
- C:\Windows\System\nrhxXpM.exe
  C:\Windows\System\nrhxXpM.exe
  2⤵
  PID:4968
- C:\Windows\System\FLfNvHl.exe
  C:\Windows\System\FLfNvHl.exe
  2⤵
  PID:4984
- C:\Windows\System\iPPseTE.exe
  C:\Windows\System\iPPseTE.exe
  2⤵
  PID:5000
- C:\Windows\System\PXfUuet.exe
  C:\Windows\System\PXfUuet.exe
  2⤵
  PID:5016
- C:\Windows\System\rjocdfp.exe
  C:\Windows\System\rjocdfp.exe
  2⤵
  PID:5036
- C:\Windows\System\xhKjIem.exe
  C:\Windows\System\xhKjIem.exe
  2⤵
  PID:5116
- C:\Windows\System\BluuWSi.exe
  C:\Windows\System\BluuWSi.exe
  2⤵
  PID:4136
- C:\Windows\System\MzakNne.exe
  C:\Windows\System\MzakNne.exe
  2⤵
  PID:4156
- C:\Windows\System\mJcMgii.exe
  C:\Windows\System\mJcMgii.exe
  2⤵
  PID:4004
- C:\Windows\System\wORYaQA.exe
  C:\Windows\System\wORYaQA.exe
  2⤵
  PID:4140
- C:\Windows\System\WaaqGen.exe
  C:\Windows\System\WaaqGen.exe
  2⤵
  PID:4216
- C:\Windows\System\OtciiSG.exe
  C:\Windows\System\OtciiSG.exe
  2⤵
  PID:4264
- C:\Windows\System\GuhYaNB.exe
  C:\Windows\System\GuhYaNB.exe
  2⤵
  PID:4252
- C:\Windows\System\JVrVILg.exe
  C:\Windows\System\JVrVILg.exe
  2⤵
  PID:4336
- C:\Windows\System\WukRJLa.exe
  C:\Windows\System\WukRJLa.exe
  2⤵
  PID:4404
- C:\Windows\System\UuumdGw.exe
  C:\Windows\System\UuumdGw.exe
  2⤵
  PID:4236
- C:\Windows\System\FKKSzUX.exe
  C:\Windows\System\FKKSzUX.exe
  2⤵
  PID:4288
- C:\Windows\System\nVwgucr.exe
  C:\Windows\System\nVwgucr.exe
  2⤵
  PID:4320
- C:\Windows\System\UvqjrfB.exe
  C:\Windows\System\UvqjrfB.exe
  2⤵
  PID:4388
- C:\Windows\System\urmRTmD.exe
  C:\Windows\System\urmRTmD.exe
  2⤵
  PID:4452
- C:\Windows\System\emRBjKV.exe
  C:\Windows\System\emRBjKV.exe
  2⤵
  PID:4516
- C:\Windows\System\OxypPda.exe
  C:\Windows\System\OxypPda.exe
  2⤵
  PID:4528
- C:\Windows\System\DroqZrH.exe
  C:\Windows\System\DroqZrH.exe
  2⤵
  PID:4548
- C:\Windows\System\XMfAQGC.exe
  C:\Windows\System\XMfAQGC.exe
  2⤵
  PID:4572
- C:\Windows\System\ffRlwsN.exe
  C:\Windows\System\ffRlwsN.exe
  2⤵
  PID:4612
- C:\Windows\System\qQExkxy.exe
  C:\Windows\System\qQExkxy.exe
  2⤵
  PID:4632
- C:\Windows\System\NqYllYM.exe
  C:\Windows\System\NqYllYM.exe
  2⤵
  PID:4656
- C:\Windows\System\LgCmUzX.exe
  C:\Windows\System\LgCmUzX.exe
  2⤵
  PID:4664
- C:\Windows\System\ePJthcg.exe
  C:\Windows\System\ePJthcg.exe
  2⤵
  PID:4708
- C:\Windows\System\zLqPRCR.exe
  C:\Windows\System\zLqPRCR.exe
  2⤵
  PID:4724
- C:\Windows\System\gCrhlKP.exe
  C:\Windows\System\gCrhlKP.exe
  2⤵
  PID:4780
- C:\Windows\System\yFwwnup.exe
  C:\Windows\System\yFwwnup.exe
  2⤵
  PID:4764
- C:\Windows\System\fZRzskR.exe
  C:\Windows\System\fZRzskR.exe
  2⤵
  PID:4744
- C:\Windows\System\KadmaBU.exe
  C:\Windows\System\KadmaBU.exe
  2⤵
  PID:4832
- C:\Windows\System\QZhFiku.exe
  C:\Windows\System\QZhFiku.exe
  2⤵
  PID:4864
- C:\Windows\System\KBjcVsp.exe
  C:\Windows\System\KBjcVsp.exe
  2⤵
  PID:4980
- C:\Windows\System\Deplnos.exe
  C:\Windows\System\Deplnos.exe
  2⤵
  PID:4916
- C:\Windows\System\GmKgxbM.exe
  C:\Windows\System\GmKgxbM.exe
  2⤵
  PID:5012
- C:\Windows\System\kGDeXmU.exe
  C:\Windows\System\kGDeXmU.exe
  2⤵
  PID:5024
- C:\Windows\System\sRhPQoC.exe
  C:\Windows\System\sRhPQoC.exe
  2⤵
  PID:5048
- C:\Windows\System\FQHyLto.exe
  C:\Windows\System\FQHyLto.exe
  2⤵
  PID:5064
- C:\Windows\System\jyGUNsb.exe
  C:\Windows\System\jyGUNsb.exe
  2⤵
  PID:5080
- C:\Windows\System\uZXaNgi.exe
  C:\Windows\System\uZXaNgi.exe
  2⤵
  PID:5096
- C:\Windows\System\dyDXTyB.exe
  C:\Windows\System\dyDXTyB.exe
  2⤵
  PID:1516
- C:\Windows\System\LKhmRNT.exe
  C:\Windows\System\LKhmRNT.exe
  2⤵
  PID:4184
- C:\Windows\System\fvKhxkR.exe
  C:\Windows\System\fvKhxkR.exe
  2⤵
  PID:4372
- C:\Windows\System\MVCIlsK.exe
  C:\Windows\System\MVCIlsK.exe
  2⤵
  PID:4168
- C:\Windows\System\vaJswDd.exe
  C:\Windows\System\vaJswDd.exe
  2⤵
  PID:4492
- C:\Windows\System\rqIqdyc.exe
  C:\Windows\System\rqIqdyc.exe
  2⤵
  PID:4592
- C:\Windows\System\lUgbwPu.exe
  C:\Windows\System\lUgbwPu.exe
  2⤵
  PID:4696
- C:\Windows\System\TCZPPFA.exe
  C:\Windows\System\TCZPPFA.exe
  2⤵
  PID:4472
- C:\Windows\System\BtMUWJk.exe
  C:\Windows\System\BtMUWJk.exe
  2⤵
  PID:4304
- C:\Windows\System\kEdzBMG.exe
  C:\Windows\System\kEdzBMG.exe
  2⤵
  PID:4420
- C:\Windows\System\ZcHqYNQ.exe
  C:\Windows\System\ZcHqYNQ.exe
  2⤵
  PID:4928
- C:\Windows\System\WTTZBsY.exe
  C:\Windows\System\WTTZBsY.exe
  2⤵
  PID:4996
- C:\Windows\System\ftTuJEe.exe
  C:\Windows\System\ftTuJEe.exe
  2⤵
  PID:5112
- C:\Windows\System\UEgzcat.exe
  C:\Windows\System\UEgzcat.exe
  2⤵
  PID:4680
- C:\Windows\System\aDyueoJ.exe
  C:\Windows\System\aDyueoJ.exe
  2⤵
  PID:4440
- C:\Windows\System\WoOhTWY.exe
  C:\Windows\System\WoOhTWY.exe
  2⤵
  PID:4912
- C:\Windows\System\dGuxVhD.exe
  C:\Windows\System\dGuxVhD.exe
  2⤵
  PID:4892
- C:\Windows\System\ejNFzRD.exe
  C:\Windows\System\ejNFzRD.exe
  2⤵
  PID:5060
- C:\Windows\System\FQsHcsC.exe
  C:\Windows\System\FQsHcsC.exe
  2⤵
  PID:2256
- C:\Windows\System\HQlvdiI.exe
  C:\Windows\System\HQlvdiI.exe
  2⤵
  PID:4564
- C:\Windows\System\jQtDajZ.exe
  C:\Windows\System\jQtDajZ.exe
  2⤵
  PID:4692
- C:\Windows\System\MIMkHnI.exe
  C:\Windows\System\MIMkHnI.exe
  2⤵
  PID:4860
- C:\Windows\System\heLkTOh.exe
  C:\Windows\System\heLkTOh.exe
  2⤵
  PID:5008
- C:\Windows\System\Eolkrjq.exe
  C:\Windows\System\Eolkrjq.exe
  2⤵
  PID:3928
- C:\Windows\System\HZppwrb.exe
  C:\Windows\System\HZppwrb.exe
  2⤵
  PID:4476
- C:\Windows\System\LcUFRzU.exe
  C:\Windows\System\LcUFRzU.exe
  2⤵
  PID:4204
- C:\Windows\System\kQclfpk.exe
  C:\Windows\System\kQclfpk.exe
  2⤵
  PID:4624
- C:\Windows\System\aUNzZKM.exe
  C:\Windows\System\aUNzZKM.exe
  2⤵
  PID:5076
- C:\Windows\System\kdUdXfe.exe
  C:\Windows\System\kdUdXfe.exe
  2⤵
  PID:4944
- C:\Windows\System\uLciJXG.exe
  C:\Windows\System\uLciJXG.exe
  2⤵
  PID:4276
- C:\Windows\System\dbKeanR.exe
  C:\Windows\System\dbKeanR.exe
  2⤵
  PID:4172
- C:\Windows\System\PQlZRdj.exe
  C:\Windows\System\PQlZRdj.exe
  2⤵
  PID:4964
- C:\Windows\System\wwQiIiK.exe
  C:\Windows\System\wwQiIiK.exe
  2⤵
  PID:4272
- C:\Windows\System\oEKJefB.exe
  C:\Windows\System\oEKJefB.exe
  2⤵
  PID:5124
- C:\Windows\System\msQpAnW.exe
  C:\Windows\System\msQpAnW.exe
  2⤵
  PID:5140
- C:\Windows\System\AYYoczH.exe
  C:\Windows\System\AYYoczH.exe
  2⤵
  PID:5156
- C:\Windows\System\kDkvNLr.exe
  C:\Windows\System\kDkvNLr.exe
  2⤵
  PID:5172
- C:\Windows\System\IKdDtgC.exe
  C:\Windows\System\IKdDtgC.exe
  2⤵
  PID:5188
- C:\Windows\System\taEBpLv.exe
  C:\Windows\System\taEBpLv.exe
  2⤵
  PID:5204
- C:\Windows\System\SndnNZc.exe
  C:\Windows\System\SndnNZc.exe
  2⤵
  PID:5224
- C:\Windows\System\KWFfZzG.exe
  C:\Windows\System\KWFfZzG.exe
  2⤵
  PID:5240
- C:\Windows\System\boceplD.exe
  C:\Windows\System\boceplD.exe
  2⤵
  PID:5256
- C:\Windows\System\uHjXcQA.exe
  C:\Windows\System\uHjXcQA.exe
  2⤵
  PID:5272
- C:\Windows\System\XaWEruJ.exe
  C:\Windows\System\XaWEruJ.exe
  2⤵
  PID:5288
- C:\Windows\System\pSdYANp.exe
  C:\Windows\System\pSdYANp.exe
  2⤵
  PID:5304
- C:\Windows\System\quQfcYe.exe
  C:\Windows\System\quQfcYe.exe
  2⤵
  PID:5320
- C:\Windows\System\zEtOsdT.exe
  C:\Windows\System\zEtOsdT.exe
  2⤵
  PID:5336
- C:\Windows\System\tzfSkxN.exe
  C:\Windows\System\tzfSkxN.exe
  2⤵
  PID:5352
- C:\Windows\System\zHpqgwT.exe
  C:\Windows\System\zHpqgwT.exe
  2⤵
  PID:5368
- C:\Windows\System\iWVVMrE.exe
  C:\Windows\System\iWVVMrE.exe
  2⤵
  PID:5384
- C:\Windows\System\vSDoURk.exe
  C:\Windows\System\vSDoURk.exe
  2⤵
  PID:5400
- C:\Windows\System\XnCzGsr.exe
  C:\Windows\System\XnCzGsr.exe
  2⤵
  PID:5416
- C:\Windows\System\saoiyqX.exe
  C:\Windows\System\saoiyqX.exe
  2⤵
  PID:5432
- C:\Windows\System\uWAquvN.exe
  C:\Windows\System\uWAquvN.exe
  2⤵
  PID:5456
- C:\Windows\System\ROubZyp.exe
  C:\Windows\System\ROubZyp.exe
  2⤵
  PID:5472
- C:\Windows\System\gLLDWWl.exe
  C:\Windows\System\gLLDWWl.exe
  2⤵
  PID:5488
- C:\Windows\System\wwBNdPI.exe
  C:\Windows\System\wwBNdPI.exe
  2⤵
  PID:5504
- C:\Windows\System\TaMdswH.exe
  C:\Windows\System\TaMdswH.exe
  2⤵
  PID:5520
- C:\Windows\System\qQYzDTT.exe
  C:\Windows\System\qQYzDTT.exe
  2⤵
  PID:5536
- C:\Windows\System\sDTJmRt.exe
  C:\Windows\System\sDTJmRt.exe
  2⤵
  PID:5552
- C:\Windows\System\qTAGRCz.exe
  C:\Windows\System\qTAGRCz.exe
  2⤵
  PID:5568
- C:\Windows\System\xVkSttz.exe
  C:\Windows\System\xVkSttz.exe
  2⤵
  PID:5584
- C:\Windows\System\WCBCmbb.exe
  C:\Windows\System\WCBCmbb.exe
  2⤵
  PID:5600
- C:\Windows\System\DvNsKYm.exe
  C:\Windows\System\DvNsKYm.exe
  2⤵
  PID:5616
- C:\Windows\System\CDtGsow.exe
  C:\Windows\System\CDtGsow.exe
  2⤵
  PID:5632
- C:\Windows\System\DFuiFhV.exe
  C:\Windows\System\DFuiFhV.exe
  2⤵
  PID:5648
- C:\Windows\System\QsJFpHq.exe
  C:\Windows\System\QsJFpHq.exe
  2⤵
  PID:5664
- C:\Windows\System\IXeLuyz.exe
  C:\Windows\System\IXeLuyz.exe
  2⤵
  PID:5680
- C:\Windows\System\QGGNesJ.exe
  C:\Windows\System\QGGNesJ.exe
  2⤵
  PID:5696
- C:\Windows\System\bCalAXw.exe
  C:\Windows\System\bCalAXw.exe
  2⤵
  PID:5712
- C:\Windows\System\JWQGmwg.exe
  C:\Windows\System\JWQGmwg.exe
  2⤵
  PID:5728
- C:\Windows\System\jDJxcee.exe
  C:\Windows\System\jDJxcee.exe
  2⤵
  PID:5744
- C:\Windows\System\mIWbHfV.exe
  C:\Windows\System\mIWbHfV.exe
  2⤵
  PID:5760
- C:\Windows\System\RhGsQTo.exe
  C:\Windows\System\RhGsQTo.exe
  2⤵
  PID:5776
- C:\Windows\System\LyrQnCj.exe
  C:\Windows\System\LyrQnCj.exe
  2⤵
  PID:5792
- C:\Windows\System\dYsZbpy.exe
  C:\Windows\System\dYsZbpy.exe
  2⤵
  PID:5808
- C:\Windows\System\TYFmhOv.exe
  C:\Windows\System\TYFmhOv.exe
  2⤵
  PID:5824
- C:\Windows\System\rQFUBhg.exe
  C:\Windows\System\rQFUBhg.exe
  2⤵
  PID:5840
- C:\Windows\System\AqlynYz.exe
  C:\Windows\System\AqlynYz.exe
  2⤵
  PID:5856
- C:\Windows\System\GUUhrrN.exe
  C:\Windows\System\GUUhrrN.exe
  2⤵
  PID:5872
- C:\Windows\System\cbwPCFD.exe
  C:\Windows\System\cbwPCFD.exe
  2⤵
  PID:5888
- C:\Windows\System\BUOLidF.exe
  C:\Windows\System\BUOLidF.exe
  2⤵
  PID:5904
- C:\Windows\System\lxneIhT.exe
  C:\Windows\System\lxneIhT.exe
  2⤵
  PID:5920
- C:\Windows\System\kBNBomY.exe
  C:\Windows\System\kBNBomY.exe
  2⤵
  PID:5936
- C:\Windows\System\pMwJKzn.exe
  C:\Windows\System\pMwJKzn.exe
  2⤵
  PID:5952
- C:\Windows\System\YyzznUJ.exe
  C:\Windows\System\YyzznUJ.exe
  2⤵
  PID:5968
- C:\Windows\System\JTIOCxY.exe
  C:\Windows\System\JTIOCxY.exe
  2⤵
  PID:5984
- C:\Windows\System\uiYsbIP.exe
  C:\Windows\System\uiYsbIP.exe
  2⤵
  PID:6004
- C:\Windows\System\CcPgbLv.exe
  C:\Windows\System\CcPgbLv.exe
  2⤵
  PID:6020
- C:\Windows\System\gDuNYHn.exe
  C:\Windows\System\gDuNYHn.exe
  2⤵
  PID:6036
- C:\Windows\System\FDNkPBw.exe
  C:\Windows\System\FDNkPBw.exe
  2⤵
  PID:6052
- C:\Windows\System\RLHlEwn.exe
  C:\Windows\System\RLHlEwn.exe
  2⤵
  PID:6068
- C:\Windows\System\AAMaHCw.exe
  C:\Windows\System\AAMaHCw.exe
  2⤵
  PID:6084
- C:\Windows\System\eZbRzGD.exe
  C:\Windows\System\eZbRzGD.exe
  2⤵
  PID:6100
- C:\Windows\System\EvYLxiB.exe
  C:\Windows\System\EvYLxiB.exe
  2⤵
  PID:6116
- C:\Windows\System\wRObXNL.exe
  C:\Windows\System\wRObXNL.exe
  2⤵
  PID:6132
- C:\Windows\System\gnTnOnY.exe
  C:\Windows\System\gnTnOnY.exe
  2⤵
  PID:4580
- C:\Windows\System\XgFGGCN.exe
  C:\Windows\System\XgFGGCN.exe
  2⤵
  PID:4368
- C:\Windows\System\PnETIFG.exe
  C:\Windows\System\PnETIFG.exe
  2⤵
  PID:4660
- C:\Windows\System\VqIXjmJ.exe
  C:\Windows\System\VqIXjmJ.exe
  2⤵
  PID:4608
- C:\Windows\System\ibbsFIq.exe
  C:\Windows\System\ibbsFIq.exe
  2⤵
  PID:5092
- C:\Windows\System\pGTOPCi.exe
  C:\Windows\System\pGTOPCi.exe
  2⤵
  PID:4376
- C:\Windows\System\sJhVTiC.exe
  C:\Windows\System\sJhVTiC.exe
  2⤵
  PID:5152
- C:\Windows\System\kRtuuPs.exe
  C:\Windows\System\kRtuuPs.exe
  2⤵
  PID:5216
- C:\Windows\System\tysHwJc.exe
  C:\Windows\System\tysHwJc.exe
  2⤵
  PID:5200
- C:\Windows\System\JvcTmYo.exe
  C:\Windows\System\JvcTmYo.exe
  2⤵
  PID:5248
- C:\Windows\System\WNTBuuH.exe
  C:\Windows\System\WNTBuuH.exe
  2⤵
  PID:5252
- C:\Windows\System\BtgWdfp.exe
  C:\Windows\System\BtgWdfp.exe
  2⤵
  PID:5300
- C:\Windows\System\XTQCnZT.exe
  C:\Windows\System\XTQCnZT.exe
  2⤵
  PID:5376
- C:\Windows\System\IUHelps.exe
  C:\Windows\System\IUHelps.exe
  2⤵
  PID:5444
- C:\Windows\System\pXTKLhQ.exe
  C:\Windows\System\pXTKLhQ.exe
  2⤵
  PID:5440
- C:\Windows\System\CGxHFth.exe
  C:\Windows\System\CGxHFth.exe
  2⤵
  PID:5328
- C:\Windows\System\SXBklQd.exe
  C:\Windows\System\SXBklQd.exe
  2⤵
  PID:5516
- C:\Windows\System\fErrDBM.exe
  C:\Windows\System\fErrDBM.exe
  2⤵
  PID:5428
- C:\Windows\System\qlHiMJQ.exe
  C:\Windows\System\qlHiMJQ.exe
  2⤵
  PID:5468
- C:\Windows\System\OsZOzMg.exe
  C:\Windows\System\OsZOzMg.exe
  2⤵
  PID:5608
- C:\Windows\System\KGKQPFV.exe
  C:\Windows\System\KGKQPFV.exe
  2⤵
  PID:5576
- C:\Windows\System\bTnyQpD.exe
  C:\Windows\System\bTnyQpD.exe
  2⤵
  PID:5676
- C:\Windows\System\gERnzEa.exe
  C:\Windows\System\gERnzEa.exe
  2⤵
  PID:5772
- C:\Windows\System\USboSwA.exe
  C:\Windows\System\USboSwA.exe
  2⤵
  PID:5832
- C:\Windows\System\UGTcOHM.exe
  C:\Windows\System\UGTcOHM.exe
  2⤵
  PID:5900
- C:\Windows\System\IMUcNwh.exe
  C:\Windows\System\IMUcNwh.exe
  2⤵
  PID:5964
- C:\Windows\System\lHdzJYQ.exe
  C:\Windows\System\lHdzJYQ.exe
  2⤵
  PID:6000
- C:\Windows\System\GoPWOzT.exe
  C:\Windows\System\GoPWOzT.exe
  2⤵
  PID:6092
- C:\Windows\System\kbUAwgP.exe
  C:\Windows\System\kbUAwgP.exe
  2⤵
  PID:6124
- C:\Windows\System\MdNLnYj.exe
  C:\Windows\System\MdNLnYj.exe
  2⤵
  PID:1268
- C:\Windows\System\hRKeuqn.exe
  C:\Windows\System\hRKeuqn.exe
  2⤵
  PID:5628
- C:\Windows\System\BWNFMgh.exe
  C:\Windows\System\BWNFMgh.exe
  2⤵
  PID:5884
- C:\Windows\System\RdWVPdx.exe
  C:\Windows\System\RdWVPdx.exe
  2⤵
  PID:6140
- C:\Windows\System\YSuwYBX.exe
  C:\Windows\System\YSuwYBX.exe
  2⤵
  PID:5916
- C:\Windows\System\bxHJGIx.exe
  C:\Windows\System\bxHJGIx.exe
  2⤵
  PID:5656
- C:\Windows\System\ypSUUhy.exe
  C:\Windows\System\ypSUUhy.exe
  2⤵
  PID:5756
- C:\Windows\System\yVcxLoz.exe
  C:\Windows\System\yVcxLoz.exe
  2⤵
  PID:5852
- C:\Windows\System\OmbgJmN.exe
  C:\Windows\System\OmbgJmN.exe
  2⤵
  PID:5980
- C:\Windows\System\CyWfDyp.exe
  C:\Windows\System\CyWfDyp.exe
  2⤵
  PID:6108
- C:\Windows\System\IWSKkCv.exe
  C:\Windows\System\IWSKkCv.exe
  2⤵
  PID:1660
- C:\Windows\System\CMVTsXH.exe
  C:\Windows\System\CMVTsXH.exe
  2⤵
  PID:5184
- C:\Windows\System\rLlgmmt.exe
  C:\Windows\System\rLlgmmt.exe
  2⤵
  PID:5168
- C:\Windows\System\rMLfkZE.exe
  C:\Windows\System\rMLfkZE.exe
  2⤵
  PID:5268
- C:\Windows\System\GtnjiVM.exe
  C:\Windows\System\GtnjiVM.exe
  2⤵
  PID:5412
- C:\Windows\System\UOpaXvr.exe
  C:\Windows\System\UOpaXvr.exe
  2⤵
  PID:5344
- C:\Windows\System\IpWRydJ.exe
  C:\Windows\System\IpWRydJ.exe
  2⤵
  PID:5532
- C:\Windows\System\OXPlLtr.exe
  C:\Windows\System\OXPlLtr.exe
  2⤵
  PID:5396
- C:\Windows\System\neFtiUp.exe
  C:\Windows\System\neFtiUp.exe
  2⤵
  PID:5932
- C:\Windows\System\eNBTTUn.exe
  C:\Windows\System\eNBTTUn.exe
  2⤵
  PID:6128
- C:\Windows\System\sKxXvBT.exe
  C:\Windows\System\sKxXvBT.exe
  2⤵
  PID:5660
- C:\Windows\System\nadHoZC.exe
  C:\Windows\System\nadHoZC.exe
  2⤵
  PID:5948
- C:\Windows\System\YmkNEDy.exe
  C:\Windows\System\YmkNEDy.exe
  2⤵
  PID:5236
- C:\Windows\System\svNuACt.exe
  C:\Windows\System\svNuACt.exe
  2⤵
  PID:5392
- C:\Windows\System\KTCYzGr.exe
  C:\Windows\System\KTCYzGr.exe
  2⤵
  PID:1964
- C:\Windows\System\rKwIzBH.exe
  C:\Windows\System\rKwIzBH.exe
  2⤵
  PID:4120
- C:\Windows\System\AvFKSYw.exe
  C:\Windows\System\AvFKSYw.exe
  2⤵
  PID:6156
- C:\Windows\System\gPoLDwk.exe
  C:\Windows\System\gPoLDwk.exe
  2⤵
  PID:6176
- C:\Windows\System\tcxwGnR.exe
  C:\Windows\System\tcxwGnR.exe
  2⤵
  PID:6192
- C:\Windows\System\hZaoToi.exe
  C:\Windows\System\hZaoToi.exe
  2⤵
  PID:6208
- C:\Windows\System\rOYVoFc.exe
  C:\Windows\System\rOYVoFc.exe
  2⤵
  PID:6224
- C:\Windows\System\QFxhBKH.exe
  C:\Windows\System\QFxhBKH.exe
  2⤵
  PID:6240
- C:\Windows\System\IASBZTu.exe
  C:\Windows\System\IASBZTu.exe
  2⤵
  PID:6256
- C:\Windows\System\LFEPSyV.exe
  C:\Windows\System\LFEPSyV.exe
  2⤵
  PID:6272
- C:\Windows\System\qPtTPBq.exe
  C:\Windows\System\qPtTPBq.exe
  2⤵
  PID:6288
- C:\Windows\System\KXWVISv.exe
  C:\Windows\System\KXWVISv.exe
  2⤵
  PID:6304
- C:\Windows\System\XmxPkIA.exe
  C:\Windows\System\XmxPkIA.exe
  2⤵
  PID:6320
- C:\Windows\System\dWpWSFH.exe
  C:\Windows\System\dWpWSFH.exe
  2⤵
  PID:6336
- C:\Windows\System\NUUcDns.exe
  C:\Windows\System\NUUcDns.exe
  2⤵
  PID:6352
- C:\Windows\System\gwNcDlF.exe
  C:\Windows\System\gwNcDlF.exe
  2⤵
  PID:6368
- C:\Windows\System\euQCeWM.exe
  C:\Windows\System\euQCeWM.exe
  2⤵
  PID:6384
- C:\Windows\System\QWYMHap.exe
  C:\Windows\System\QWYMHap.exe
  2⤵
  PID:6400
- C:\Windows\System\rJfxFuP.exe
  C:\Windows\System\rJfxFuP.exe
  2⤵
  PID:6416
- C:\Windows\System\yWysnGG.exe
  C:\Windows\System\yWysnGG.exe
  2⤵
  PID:6432
- C:\Windows\System\zZlDxDG.exe
  C:\Windows\System\zZlDxDG.exe
  2⤵
  PID:6448
- C:\Windows\System\IbfFMvw.exe
  C:\Windows\System\IbfFMvw.exe
  2⤵
  PID:6464
- C:\Windows\System\xMWmMyT.exe
  C:\Windows\System\xMWmMyT.exe
  2⤵
  PID:6480
- C:\Windows\System\SWsbgpm.exe
  C:\Windows\System\SWsbgpm.exe
  2⤵
  PID:6496
- C:\Windows\System\ZHCOPFT.exe
  C:\Windows\System\ZHCOPFT.exe
  2⤵
  PID:6512
- C:\Windows\System\HDEMUal.exe
  C:\Windows\System\HDEMUal.exe
  2⤵
  PID:6528
- C:\Windows\System\nHQitCp.exe
  C:\Windows\System\nHQitCp.exe
  2⤵
  PID:6544
- C:\Windows\System\XCoqHKR.exe
  C:\Windows\System\XCoqHKR.exe
  2⤵
  PID:6560
- C:\Windows\System\JDPhTnX.exe
  C:\Windows\System\JDPhTnX.exe
  2⤵
  PID:6576
- C:\Windows\System\LsjFwMJ.exe
  C:\Windows\System\LsjFwMJ.exe
  2⤵
  PID:6592
- C:\Windows\System\DtIuRPj.exe
  C:\Windows\System\DtIuRPj.exe
  2⤵
  PID:6608
- C:\Windows\System\RImwbpO.exe
  C:\Windows\System\RImwbpO.exe
  2⤵
  PID:6624
- C:\Windows\System\SpuLrRG.exe
  C:\Windows\System\SpuLrRG.exe
  2⤵
  PID:6648
- C:\Windows\System\HlBGkNn.exe
  C:\Windows\System\HlBGkNn.exe
  2⤵
  PID:6664
- C:\Windows\System\VkotcrP.exe
  C:\Windows\System\VkotcrP.exe
  2⤵
  PID:6680
- C:\Windows\System\HFsEUJG.exe
  C:\Windows\System\HFsEUJG.exe
  2⤵
  PID:6696
- C:\Windows\System\eUGrXEX.exe
  C:\Windows\System\eUGrXEX.exe
  2⤵
  PID:6764
- C:\Windows\System\ueigjAv.exe
  C:\Windows\System\ueigjAv.exe
  2⤵
  PID:6780
- C:\Windows\System\UJiUCSL.exe
  C:\Windows\System\UJiUCSL.exe
  2⤵
  PID:6796
- C:\Windows\System\bqqVeVf.exe
  C:\Windows\System\bqqVeVf.exe
  2⤵
  PID:6812
- C:\Windows\System\puSyOgB.exe
  C:\Windows\System\puSyOgB.exe
  2⤵
  PID:6828
- C:\Windows\System\sWBepJm.exe
  C:\Windows\System\sWBepJm.exe
  2⤵
  PID:6844
- C:\Windows\System\PMeBiPU.exe
  C:\Windows\System\PMeBiPU.exe
  2⤵
  PID:6860
- C:\Windows\System\XSHCCHL.exe
  C:\Windows\System\XSHCCHL.exe
  2⤵
  PID:6876
- C:\Windows\System\eyXKZmE.exe
  C:\Windows\System\eyXKZmE.exe
  2⤵
  PID:6892
- C:\Windows\System\taZGnTR.exe
  C:\Windows\System\taZGnTR.exe
  2⤵
  PID:6908
- C:\Windows\System\uryFmDH.exe
  C:\Windows\System\uryFmDH.exe
  2⤵
  PID:6924
- C:\Windows\System\kRgQOeq.exe
  C:\Windows\System\kRgQOeq.exe
  2⤵
  PID:6940
- C:\Windows\System\AiNwiII.exe
  C:\Windows\System\AiNwiII.exe
  2⤵
  PID:6956
- C:\Windows\System\YQSIqLO.exe
  C:\Windows\System\YQSIqLO.exe
  2⤵
  PID:6972
- C:\Windows\System\JzduTXj.exe
  C:\Windows\System\JzduTXj.exe
  2⤵
  PID:6988
- C:\Windows\System\pcDsatW.exe
  C:\Windows\System\pcDsatW.exe
  2⤵
  PID:7004
- C:\Windows\System\VklLWlu.exe
  C:\Windows\System\VklLWlu.exe
  2⤵
  PID:7020
- C:\Windows\System\zajbsue.exe
  C:\Windows\System\zajbsue.exe
  2⤵
  PID:7036
- C:\Windows\System\OujlFPt.exe
  C:\Windows\System\OujlFPt.exe
  2⤵
  PID:7052
- C:\Windows\System\NSKdntf.exe
  C:\Windows\System\NSKdntf.exe
  2⤵
  PID:7068
- C:\Windows\System\kSjcEsf.exe
  C:\Windows\System\kSjcEsf.exe
  2⤵
  PID:7084
- C:\Windows\System\BLmotFk.exe
  C:\Windows\System\BLmotFk.exe
  2⤵
  PID:7100
- C:\Windows\System\daSBvAJ.exe
  C:\Windows\System\daSBvAJ.exe
  2⤵
  PID:7116
- C:\Windows\System\PCyBFJW.exe
  C:\Windows\System\PCyBFJW.exe
  2⤵
  PID:7132
- C:\Windows\System\MDRfzac.exe
  C:\Windows\System\MDRfzac.exe
  2⤵
  PID:7148
- C:\Windows\System\ArjQMuC.exe
  C:\Windows\System\ArjQMuC.exe
  2⤵
  PID:7164
- C:\Windows\System\SPCGcrW.exe
  C:\Windows\System\SPCGcrW.exe
  2⤵
  PID:6188
- C:\Windows\System\nIkaWbS.exe
  C:\Windows\System\nIkaWbS.exe
  2⤵
  PID:6220
- C:\Windows\System\bQIBJzM.exe
  C:\Windows\System\bQIBJzM.exe
  2⤵
  PID:6060
- C:\Windows\System\hsBQjRK.exe
  C:\Windows\System\hsBQjRK.exe
  2⤵
  PID:6248
- C:\Windows\System\TWDoThB.exe
  C:\Windows\System\TWDoThB.exe
  2⤵
  PID:5196
- C:\Windows\System\oNBAjXr.exe
  C:\Windows\System\oNBAjXr.exe
  2⤵
  PID:5232
- C:\Windows\System\DomKGnP.exe
  C:\Windows\System\DomKGnP.exe
  2⤵
  PID:6284
- C:\Windows\System\coHWocG.exe
  C:\Windows\System\coHWocG.exe
  2⤵
  PID:5740
- C:\Windows\System\MJWZJzf.exe
  C:\Windows\System\MJWZJzf.exe
  2⤵
  PID:4740
- C:\Windows\System\KNQEDOZ.exe
  C:\Windows\System\KNQEDOZ.exe
  2⤵
  PID:6412
- C:\Windows\System\QjECAaT.exe
  C:\Windows\System\QjECAaT.exe
  2⤵
  PID:6476
- C:\Windows\System\PpBGSdM.exe
  C:\Windows\System\PpBGSdM.exe
  2⤵
  PID:6316
- C:\Windows\System\VQdPWEl.exe
  C:\Windows\System\VQdPWEl.exe
  2⤵
  PID:6380
- C:\Windows\System\cetVYYQ.exe
  C:\Windows\System\cetVYYQ.exe
  2⤵
  PID:5624
- C:\Windows\System\XajORGj.exe
  C:\Windows\System\XajORGj.exe
  2⤵
  PID:6600
- C:\Windows\System\DutebzG.exe
  C:\Windows\System\DutebzG.exe
  2⤵
  PID:4876
- C:\Windows\System\vCwCEmp.exe
  C:\Windows\System\vCwCEmp.exe
  2⤵
  PID:5784
- C:\Windows\System\KYXXIiL.exe
  C:\Windows\System\KYXXIiL.exe
  2⤵
  PID:6204
- C:\Windows\System\wvRnhww.exe
  C:\Windows\System\wvRnhww.exe
  2⤵
  PID:6164
- C:\Windows\System\ctIjpyv.exe
  C:\Windows\System\ctIjpyv.exe
  2⤵
  PID:6264
- C:\Windows\System\WHbuHNl.exe
  C:\Windows\System\WHbuHNl.exe
  2⤵
  PID:6428
- C:\Windows\System\GeYhcBX.exe
  C:\Windows\System\GeYhcBX.exe
  2⤵
  PID:6332
- C:\Windows\System\GZEWWSP.exe
  C:\Windows\System\GZEWWSP.exe
  2⤵
  PID:6396
- C:\Windows\System\sBXywZb.exe
  C:\Windows\System\sBXywZb.exe
  2⤵
  PID:6672
- C:\Windows\System\wfrvsre.exe
  C:\Windows\System\wfrvsre.exe
  2⤵
  PID:6488
- C:\Windows\System\RTvwcdw.exe
  C:\Windows\System\RTvwcdw.exe
  2⤵
  PID:6552
- C:\Windows\System\ERYIJTc.exe
  C:\Windows\System\ERYIJTc.exe
  2⤵
  PID:6588
- C:\Windows\System\iyiqrmB.exe
  C:\Windows\System\iyiqrmB.exe
  2⤵
  PID:6692
- C:\Windows\System\hOAVEbR.exe
  C:\Windows\System\hOAVEbR.exe
  2⤵
  PID:6736
- C:\Windows\System\DOqqSmy.exe
  C:\Windows\System\DOqqSmy.exe
  2⤵
  PID:6716
- C:\Windows\System\LVoaDyG.exe
  C:\Windows\System\LVoaDyG.exe
  2⤵
  PID:6760
- C:\Windows\System\XHztZYR.exe
  C:\Windows\System\XHztZYR.exe
  2⤵
  PID:6748
- C:\Windows\System\LPSsYjs.exe
  C:\Windows\System\LPSsYjs.exe
  2⤵
  PID:6824
- C:\Windows\System\hQLUher.exe
  C:\Windows\System\hQLUher.exe
  2⤵
  PID:6980
- C:\Windows\System\lCUKvuL.exe
  C:\Windows\System\lCUKvuL.exe
  2⤵
  PID:6916
- C:\Windows\System\sTnYPfc.exe
  C:\Windows\System\sTnYPfc.exe
  2⤵
  PID:7012
- C:\Windows\System\ngrIYSi.exe
  C:\Windows\System\ngrIYSi.exe
  2⤵
  PID:6804
- C:\Windows\System\ZkJpCGu.exe
  C:\Windows\System\ZkJpCGu.exe
  2⤵
  PID:6840
- C:\Windows\System\YeuJBUV.exe
  C:\Windows\System\YeuJBUV.exe
  2⤵
  PID:6996
- C:\Windows\System\vNWavCf.exe
  C:\Windows\System\vNWavCf.exe
  2⤵
  PID:7060
- C:\Windows\System\DOmEHIN.exe
  C:\Windows\System\DOmEHIN.exe
  2⤵
  PID:7108
- C:\Windows\System\jCOCjrb.exe
  C:\Windows\System\jCOCjrb.exe
  2⤵
  PID:7112
- C:\Windows\System\JHeGxWV.exe
  C:\Windows\System\JHeGxWV.exe
  2⤵
  PID:6152
- C:\Windows\System\otpESBh.exe
  C:\Windows\System\otpESBh.exe
  2⤵
  PID:6216
- C:\Windows\System\qYhxybn.exe
  C:\Windows\System\qYhxybn.exe
  2⤵
  PID:5736
- C:\Windows\System\MQwEqQm.exe
  C:\Windows\System\MQwEqQm.exe
  2⤵
  PID:4436
- C:\Windows\System\xnBbFut.exe
  C:\Windows\System\xnBbFut.exe
  2⤵
  PID:5640
- C:\Windows\System\mEfxaZO.exe
  C:\Windows\System\mEfxaZO.exe
  2⤵
  PID:6472
- C:\Windows\System\imJUJgR.exe
  C:\Windows\System\imJUJgR.exe
  2⤵
  PID:6312
- C:\Windows\System\DgybsnM.exe
  C:\Windows\System\DgybsnM.exe
  2⤵
  PID:6568
- C:\Windows\System\MPqeMLo.exe
  C:\Windows\System\MPqeMLo.exe
  2⤵
  PID:6296
- C:\Windows\System\DMDgYBy.exe
  C:\Windows\System\DMDgYBy.exe
  2⤵
  PID:5848
- C:\Windows\System\PWyVszM.exe
  C:\Windows\System\PWyVszM.exe
  2⤵
  PID:6460
- C:\Windows\System\GItvEpL.exe
  C:\Windows\System\GItvEpL.exe
  2⤵
  PID:6704
- C:\Windows\System\lDPyNEP.exe
  C:\Windows\System\lDPyNEP.exe
  2⤵
  PID:6524
- C:\Windows\System\AYeFqGF.exe
  C:\Windows\System\AYeFqGF.exe
  2⤵
  PID:6708
- C:\Windows\System\YDiARoT.exe
  C:\Windows\System\YDiARoT.exe
  2⤵
  PID:6660
- C:\Windows\System\bYtLGrP.exe
  C:\Windows\System\bYtLGrP.exe
  2⤵
  PID:6724
- C:\Windows\System\nezcLFL.exe
  C:\Windows\System\nezcLFL.exe
  2⤵
  PID:6856
- C:\Windows\System\wITpuFw.exe
  C:\Windows\System\wITpuFw.exe
  2⤵
  PID:6932
- C:\Windows\System\vQGPbVx.exe
  C:\Windows\System\vQGPbVx.exe
  2⤵
  PID:7156
- C:\Windows\System\GEKPowy.exe
  C:\Windows\System\GEKPowy.exe
  2⤵
  PID:6936
- C:\Windows\System\BCrpKuJ.exe
  C:\Windows\System\BCrpKuJ.exe
  2⤵
  PID:6508
- C:\Windows\System\HdYHmiE.exe
  C:\Windows\System\HdYHmiE.exe
  2⤵
  PID:5360
- C:\Windows\System\wVQoZAg.exe
  C:\Windows\System\wVQoZAg.exe
  2⤵
  PID:6808
- C:\Windows\System\bnMlFHT.exe
  C:\Windows\System\bnMlFHT.exe
  2⤵
  PID:6884
- C:\Windows\System\jiysWWh.exe
  C:\Windows\System\jiysWWh.exe
  2⤵
  PID:6364
- C:\Windows\System\bbXslYU.exe
  C:\Windows\System\bbXslYU.exe
  2⤵
  PID:7092
- C:\Windows\System\DvLNHih.exe
  C:\Windows\System\DvLNHih.exe
  2⤵
  PID:5548
- C:\Windows\System\DIKJLto.exe
  C:\Windows\System\DIKJLto.exe
  2⤵
  PID:6444
- C:\Windows\System\xJsrFMV.exe
  C:\Windows\System\xJsrFMV.exe
  2⤵
  PID:6392
- C:\Windows\System\GXrNmPL.exe
  C:\Windows\System\GXrNmPL.exe
  2⤵
  PID:6756
- C:\Windows\System\bgfvSwo.exe
  C:\Windows\System\bgfvSwo.exe
  2⤵
  PID:6688
- C:\Windows\System\AukiSSC.exe
  C:\Windows\System\AukiSSC.exe
  2⤵
  PID:7076
- C:\Windows\System\EZKkgvi.exe
  C:\Windows\System\EZKkgvi.exe
  2⤵
  PID:5868
- C:\Windows\System\MnwdBlT.exe
  C:\Windows\System\MnwdBlT.exe
  2⤵
  PID:6852
- C:\Windows\System\cnvSvoD.exe
  C:\Windows\System\cnvSvoD.exe
  2⤵
  PID:6200
- C:\Windows\System\nGrlwPO.exe
  C:\Windows\System\nGrlwPO.exe
  2⤵
  PID:7128
- C:\Windows\System\TcygENa.exe
  C:\Windows\System\TcygENa.exe
  2⤵
  PID:6572
- C:\Windows\System\TRonyTK.exe
  C:\Windows\System\TRonyTK.exe
  2⤵
  PID:6744
- C:\Windows\System\jtvdJno.exe
  C:\Windows\System\jtvdJno.exe
  2⤵
  PID:7080
- C:\Windows\System\mpwVPnZ.exe
  C:\Windows\System\mpwVPnZ.exe
  2⤵
  PID:6984
- C:\Windows\System\BDmJVId.exe
  C:\Windows\System\BDmJVId.exe
  2⤵
  PID:6772
- C:\Windows\System\RGWUmda.exe
  C:\Windows\System\RGWUmda.exe
  2⤵
  PID:6968
- C:\Windows\System\eEQTMbD.exe
  C:\Windows\System\eEQTMbD.exe
  2⤵
  PID:5364
- C:\Windows\System\IyVIEjN.exe
  C:\Windows\System\IyVIEjN.exe
  2⤵
  PID:7180
- C:\Windows\System\qDRsXaH.exe
  C:\Windows\System\qDRsXaH.exe
  2⤵
  PID:7196
- C:\Windows\System\jDWobto.exe
  C:\Windows\System\jDWobto.exe
  2⤵
  PID:7212
- C:\Windows\System\OCYtRir.exe
  C:\Windows\System\OCYtRir.exe
  2⤵
  PID:7228
- C:\Windows\System\pSTkihR.exe
  C:\Windows\System\pSTkihR.exe
  2⤵
  PID:7244
- C:\Windows\System\WIOaIjf.exe
  C:\Windows\System\WIOaIjf.exe
  2⤵
  PID:7260
- C:\Windows\System\imlbmHJ.exe
  C:\Windows\System\imlbmHJ.exe
  2⤵
  PID:7276
- C:\Windows\System\rofLhsY.exe
  C:\Windows\System\rofLhsY.exe
  2⤵
  PID:7292
- C:\Windows\System\qxtzVsd.exe
  C:\Windows\System\qxtzVsd.exe
  2⤵
  PID:7308
- C:\Windows\System\GxLXBUd.exe
  C:\Windows\System\GxLXBUd.exe
  2⤵
  PID:7324
- C:\Windows\System\eDTCiXd.exe
  C:\Windows\System\eDTCiXd.exe
  2⤵
  PID:7340
- C:\Windows\System\VMwGLGy.exe
  C:\Windows\System\VMwGLGy.exe
  2⤵
  PID:7356
- C:\Windows\System\KiGfSyI.exe
  C:\Windows\System\KiGfSyI.exe
  2⤵
  PID:7372
- C:\Windows\System\uQJRHSK.exe
  C:\Windows\System\uQJRHSK.exe
  2⤵
  PID:7388
- C:\Windows\System\ZICdJxM.exe
  C:\Windows\System\ZICdJxM.exe
  2⤵
  PID:7404
- C:\Windows\System\ByoCYsY.exe
  C:\Windows\System\ByoCYsY.exe
  2⤵
  PID:7420
- C:\Windows\System\tvxDdtM.exe
  C:\Windows\System\tvxDdtM.exe
  2⤵
  PID:7436
- C:\Windows\System\LHPddBK.exe
  C:\Windows\System\LHPddBK.exe
  2⤵
  PID:7452
- C:\Windows\System\RgelmSx.exe
  C:\Windows\System\RgelmSx.exe
  2⤵
  PID:7468
- C:\Windows\System\unsQxrI.exe
  C:\Windows\System\unsQxrI.exe
  2⤵
  PID:7488
- C:\Windows\System\vNLBeZH.exe
  C:\Windows\System\vNLBeZH.exe
  2⤵
  PID:7504
- C:\Windows\System\ATWmpOm.exe
  C:\Windows\System\ATWmpOm.exe
  2⤵
  PID:7520
- C:\Windows\System\xvDWakA.exe
  C:\Windows\System\xvDWakA.exe
  2⤵
  PID:7536
- C:\Windows\System\ymeTVYx.exe
  C:\Windows\System\ymeTVYx.exe
  2⤵
  PID:7552
- C:\Windows\System\HmwDmnY.exe
  C:\Windows\System\HmwDmnY.exe
  2⤵
  PID:7568
- C:\Windows\System\seNnIrK.exe
  C:\Windows\System\seNnIrK.exe
  2⤵
  PID:7584
- C:\Windows\System\lNAYsky.exe
  C:\Windows\System\lNAYsky.exe
  2⤵
  PID:7600
- C:\Windows\System\AYAHUuM.exe
  C:\Windows\System\AYAHUuM.exe
  2⤵
  PID:7616
- C:\Windows\System\rEZgBIh.exe
  C:\Windows\System\rEZgBIh.exe
  2⤵
  PID:7632
- C:\Windows\System\KcqROwS.exe
  C:\Windows\System\KcqROwS.exe
  2⤵
  PID:7648
- C:\Windows\System\GaaTYPm.exe
  C:\Windows\System\GaaTYPm.exe
  2⤵
  PID:7664
- C:\Windows\System\VUgLIEw.exe
  C:\Windows\System\VUgLIEw.exe
  2⤵
  PID:7680
- C:\Windows\System\yUqqXLO.exe
  C:\Windows\System\yUqqXLO.exe
  2⤵
  PID:7696
- C:\Windows\System\lQvfzLX.exe
  C:\Windows\System\lQvfzLX.exe
  2⤵
  PID:7712
- C:\Windows\System\VCJvsDX.exe
  C:\Windows\System\VCJvsDX.exe
  2⤵
  PID:7728
- C:\Windows\System\lIMJuaq.exe
  C:\Windows\System\lIMJuaq.exe
  2⤵
  PID:7744
- C:\Windows\System\NlSNQte.exe
  C:\Windows\System\NlSNQte.exe
  2⤵
  PID:7760
- C:\Windows\System\MvvNSsd.exe
  C:\Windows\System\MvvNSsd.exe
  2⤵
  PID:7776
- C:\Windows\System\cIpKeGQ.exe
  C:\Windows\System\cIpKeGQ.exe
  2⤵
  PID:7792
- C:\Windows\System\dpTkNzI.exe
  C:\Windows\System\dpTkNzI.exe
  2⤵
  PID:7808
- C:\Windows\System\QyGWsuE.exe
  C:\Windows\System\QyGWsuE.exe
  2⤵
  PID:7824
- C:\Windows\System\GnXbTjm.exe
  C:\Windows\System\GnXbTjm.exe
  2⤵
  PID:7840
- C:\Windows\System\xqSnfoA.exe
  C:\Windows\System\xqSnfoA.exe
  2⤵
  PID:7856
- C:\Windows\System\XSSbrkH.exe
  C:\Windows\System\XSSbrkH.exe
  2⤵
  PID:7872
- C:\Windows\System\ANhcQbL.exe
  C:\Windows\System\ANhcQbL.exe
  2⤵
  PID:7888
- C:\Windows\System\RAPUBzp.exe
  C:\Windows\System\RAPUBzp.exe
  2⤵
  PID:7904
- C:\Windows\System\XpgLXUO.exe
  C:\Windows\System\XpgLXUO.exe
  2⤵
  PID:7920
- C:\Windows\System\cKcleWx.exe
  C:\Windows\System\cKcleWx.exe
  2⤵
  PID:7936
- C:\Windows\System\InyIgZS.exe
  C:\Windows\System\InyIgZS.exe
  2⤵
  PID:7952
- C:\Windows\System\EMEoiMu.exe
  C:\Windows\System\EMEoiMu.exe
  2⤵
  PID:7968
- C:\Windows\System\OzHQIYd.exe
  C:\Windows\System\OzHQIYd.exe
  2⤵
  PID:7984
- C:\Windows\System\YzPuoHu.exe
  C:\Windows\System\YzPuoHu.exe
  2⤵
  PID:8000
- C:\Windows\System\uGrHxSw.exe
  C:\Windows\System\uGrHxSw.exe
  2⤵
  PID:8016
- C:\Windows\System\lwsYUnG.exe
  C:\Windows\System\lwsYUnG.exe
  2⤵
  PID:8032
- C:\Windows\System\BnZaGUl.exe
  C:\Windows\System\BnZaGUl.exe
  2⤵
  PID:8048
- C:\Windows\System\kQakPFh.exe
  C:\Windows\System\kQakPFh.exe
  2⤵
  PID:8064
- C:\Windows\System\aCZrEJj.exe
  C:\Windows\System\aCZrEJj.exe
  2⤵
  PID:8080
- C:\Windows\System\lpbqukZ.exe
  C:\Windows\System\lpbqukZ.exe
  2⤵
  PID:8096
- C:\Windows\System\aUbJhGl.exe
  C:\Windows\System\aUbJhGl.exe
  2⤵
  PID:8112
- C:\Windows\System\jXGKOHl.exe
  C:\Windows\System\jXGKOHl.exe
  2⤵
  PID:8128
- C:\Windows\System\WRmuNZK.exe
  C:\Windows\System\WRmuNZK.exe
  2⤵
  PID:8144
- C:\Windows\System\pgKMOrw.exe
  C:\Windows\System\pgKMOrw.exe
  2⤵
  PID:8160
- C:\Windows\System\adOIaRr.exe
  C:\Windows\System\adOIaRr.exe
  2⤵
  PID:8176
- C:\Windows\System\TefiXiB.exe
  C:\Windows\System\TefiXiB.exe
  2⤵
  PID:7032
- C:\Windows\System\qSPAeGc.exe
  C:\Windows\System\qSPAeGc.exe
  2⤵
  PID:6236
- C:\Windows\System\qnUFmZz.exe
  C:\Windows\System\qnUFmZz.exe
  2⤵
  PID:7188
- C:\Windows\System\NBZPwsi.exe
  C:\Windows\System\NBZPwsi.exe
  2⤵
  PID:7172
- C:\Windows\System\mKgsqvR.exe
  C:\Windows\System\mKgsqvR.exe
  2⤵
  PID:7256
- C:\Windows\System\iocSkFq.exe
  C:\Windows\System\iocSkFq.exe
  2⤵
  PID:7288
- C:\Windows\System\ubkioBj.exe
  C:\Windows\System\ubkioBj.exe
  2⤵
  PID:7304
- C:\Windows\System\mRSEbLI.exe
  C:\Windows\System\mRSEbLI.exe
  2⤵
  PID:7352
- C:\Windows\System\KnSHtBb.exe
  C:\Windows\System\KnSHtBb.exe
  2⤵
  PID:7368
- C:\Windows\System\vpORlFm.exe
  C:\Windows\System\vpORlFm.exe
  2⤵
  PID:7428
- C:\Windows\System\hLDiBbD.exe
  C:\Windows\System\hLDiBbD.exe
  2⤵
  PID:7496
- C:\Windows\System\YeGBJoQ.exe
  C:\Windows\System\YeGBJoQ.exe
  2⤵
  PID:7484
- C:\Windows\System\mGeKnTW.exe
  C:\Windows\System\mGeKnTW.exe
  2⤵
  PID:7512
- C:\Windows\System\PHSFWax.exe
  C:\Windows\System\PHSFWax.exe
  2⤵
  PID:5704
- C:\Windows\System\FxLqYge.exe
  C:\Windows\System\FxLqYge.exe
  2⤵
  PID:7608
- C:\Windows\System\yLrVePk.exe
  C:\Windows\System\yLrVePk.exe
  2⤵
  PID:7672
- C:\Windows\System\IePARTJ.exe
  C:\Windows\System\IePARTJ.exe
  2⤵
  PID:7708
- C:\Windows\System\Uypztiz.exe
  C:\Windows\System\Uypztiz.exe
  2⤵
  PID:7592
- C:\Windows\System\OZeRwxX.exe
  C:\Windows\System\OZeRwxX.exe
  2⤵
  PID:7768
- C:\Windows\System\vvqaLEo.exe
  C:\Windows\System\vvqaLEo.exe
  2⤵
  PID:7692
- C:\Windows\System\rVHdTdx.exe
  C:\Windows\System\rVHdTdx.exe
  2⤵
  PID:7756
- C:\Windows\System\EyuoYfq.exe
  C:\Windows\System\EyuoYfq.exe
  2⤵
  PID:7688
- C:\Windows\System\loVUexB.exe
  C:\Windows\System\loVUexB.exe
  2⤵
  PID:7816
- C:\Windows\System\WibPtcr.exe
  C:\Windows\System\WibPtcr.exe
  2⤵
  PID:7864
- C:\Windows\System\iGYNCUn.exe
  C:\Windows\System\iGYNCUn.exe
  2⤵
  PID:7896
- C:\Windows\System\NHzEPvz.exe
  C:\Windows\System\NHzEPvz.exe
  2⤵
  PID:7932
- C:\Windows\System\vIDylTC.exe
  C:\Windows\System\vIDylTC.exe
  2⤵
  PID:8024
- C:\Windows\System\vjhZYxb.exe
  C:\Windows\System\vjhZYxb.exe
  2⤵
  PID:7912
- C:\Windows\System\YPLYkKO.exe
  C:\Windows\System\YPLYkKO.exe
  2⤵
  PID:7944
- C:\Windows\System\zzeZpBn.exe
  C:\Windows\System\zzeZpBn.exe
  2⤵
  PID:8008
- C:\Windows\System\TEnFJUi.exe
  C:\Windows\System\TEnFJUi.exe
  2⤵
  PID:8072
- C:\Windows\System\pratAxK.exe
  C:\Windows\System\pratAxK.exe
  2⤵
  PID:8124
- C:\Windows\System\EHjROtv.exe
  C:\Windows\System\EHjROtv.exe
  2⤵
  PID:8108
- C:\Windows\System\MsrTDfH.exe
  C:\Windows\System\MsrTDfH.exe
  2⤵
  PID:8184
- C:\Windows\System\xPsQDnX.exe
  C:\Windows\System\xPsQDnX.exe
  2⤵
  PID:7028
- C:\Windows\System\UcMLCLZ.exe
  C:\Windows\System\UcMLCLZ.exe
  2⤵
  PID:7332
- C:\Windows\System\RibTLGo.exe
  C:\Windows\System\RibTLGo.exe
  2⤵
  PID:8168
- C:\Windows\System\wjhphjh.exe
  C:\Windows\System\wjhphjh.exe
  2⤵
  PID:6640
- C:\Windows\System\MoSEGNk.exe
  C:\Windows\System\MoSEGNk.exe
  2⤵
  PID:7348
- C:\Windows\System\wSBdEbD.exe
  C:\Windows\System\wSBdEbD.exe
  2⤵
  PID:7412
- C:\Windows\System\pHmVmAS.exe
  C:\Windows\System\pHmVmAS.exe
  2⤵
  PID:7704
- C:\Windows\System\McqroRH.exe
  C:\Windows\System\McqroRH.exe
  2⤵
  PID:7624
- C:\Windows\System\AqAgnYi.exe
  C:\Windows\System\AqAgnYi.exe
  2⤵
  PID:7848
- C:\Windows\System\igKoKgR.exe
  C:\Windows\System\igKoKgR.exe
  2⤵
  PID:7544
- C:\Windows\System\JYAzNKn.exe
  C:\Windows\System\JYAzNKn.exe
  2⤵
  PID:7528
- C:\Windows\System\OUlRZrc.exe
  C:\Windows\System\OUlRZrc.exe
  2⤵
  PID:7656
- C:\Windows\System\yJcFAim.exe
  C:\Windows\System\yJcFAim.exe
  2⤵
  PID:7928
- C:\Windows\System\rpaUPAI.exe
  C:\Windows\System\rpaUPAI.exe
  2⤵
  PID:7916
- C:\Windows\System\dfXYfvc.exe
  C:\Windows\System\dfXYfvc.exe
  2⤵
  PID:8152
- C:\Windows\System\Enecqva.exe
  C:\Windows\System\Enecqva.exe
  2⤵
  PID:8060
- C:\Windows\System\kyGHalH.exe
  C:\Windows\System\kyGHalH.exe
  2⤵
  PID:7980
- C:\Windows\System\BqnZPvG.exe
  C:\Windows\System\BqnZPvG.exe
  2⤵
  PID:8172
- C:\Windows\System\FvTyKcZ.exe
  C:\Windows\System\FvTyKcZ.exe
  2⤵
  PID:7580
- C:\Windows\System\lUyLmuo.exe
  C:\Windows\System\lUyLmuo.exe
  2⤵
  PID:7320
- C:\Windows\System\SjFQJxr.exe
  C:\Windows\System\SjFQJxr.exe
  2⤵
  PID:6584
- C:\Windows\System\WmPWGgk.exe
  C:\Windows\System\WmPWGgk.exe
  2⤵
  PID:7448
- C:\Windows\System\cPouaFf.exe
  C:\Windows\System\cPouaFf.exe
  2⤵
  PID:7884
- C:\Windows\System\zWLmZlk.exe
  C:\Windows\System\zWLmZlk.exe
  2⤵
  PID:7992
- C:\Windows\System\XrqCWGn.exe
  C:\Windows\System\XrqCWGn.exe
  2⤵
  PID:7476
- C:\Windows\System\DoWkYWo.exe
  C:\Windows\System\DoWkYWo.exe
  2⤵
  PID:7464
- C:\Windows\System\BqUrdsn.exe
  C:\Windows\System\BqUrdsn.exe
  2⤵
  PID:5316
- C:\Windows\System\SnWGeOP.exe
  C:\Windows\System\SnWGeOP.exe
  2⤵
  PID:7784
- C:\Windows\System\glzdDcx.exe
  C:\Windows\System\glzdDcx.exe
  2⤵
  PID:7976
- C:\Windows\System\cvLIJdB.exe
  C:\Windows\System\cvLIJdB.exe
  2⤵
  PID:7596
- C:\Windows\System\IfwhttC.exe
  C:\Windows\System\IfwhttC.exe
  2⤵
  PID:7752
- C:\Windows\System\JqvhojB.exe
  C:\Windows\System\JqvhojB.exe
  2⤵
  PID:7804
- C:\Windows\System\GdAFQtX.exe
  C:\Windows\System\GdAFQtX.exe
  2⤵
  PID:7640
- C:\Windows\System\NHbnlUu.exe
  C:\Windows\System\NHbnlUu.exe
  2⤵
  PID:8200
- C:\Windows\System\pBAtDPB.exe
  C:\Windows\System\pBAtDPB.exe
  2⤵
  PID:8216
- C:\Windows\System\vXHMTJj.exe
  C:\Windows\System\vXHMTJj.exe
  2⤵
  PID:8232
- C:\Windows\System\lyZnstp.exe
  C:\Windows\System\lyZnstp.exe
  2⤵
  PID:8248
- C:\Windows\System\vqBrKsv.exe
  C:\Windows\System\vqBrKsv.exe
  2⤵
  PID:8264
- C:\Windows\System\eVcbrSW.exe
  C:\Windows\System\eVcbrSW.exe
  2⤵
  PID:8280
- C:\Windows\System\LRcINLo.exe
  C:\Windows\System\LRcINLo.exe
  2⤵
  PID:8296
- C:\Windows\System\FDBQgiV.exe
  C:\Windows\System\FDBQgiV.exe
  2⤵
  PID:8312
- C:\Windows\System\PyMYnnU.exe
  C:\Windows\System\PyMYnnU.exe
  2⤵
  PID:8328
- C:\Windows\System\ucPGYWv.exe
  C:\Windows\System\ucPGYWv.exe
  2⤵
  PID:8344
- C:\Windows\System\QxBqsft.exe
  C:\Windows\System\QxBqsft.exe
  2⤵
  PID:8360
- C:\Windows\System\YrAvdNA.exe
  C:\Windows\System\YrAvdNA.exe
  2⤵
  PID:8376
- C:\Windows\System\okKttFb.exe
  C:\Windows\System\okKttFb.exe
  2⤵
  PID:8392
- C:\Windows\System\XEyBGvD.exe
  C:\Windows\System\XEyBGvD.exe
  2⤵
  PID:8408
- C:\Windows\System\FJVPJFf.exe
  C:\Windows\System\FJVPJFf.exe
  2⤵
  PID:8424
- C:\Windows\System\iaPQpmg.exe
  C:\Windows\System\iaPQpmg.exe
  2⤵
  PID:8440
- C:\Windows\System\vvRjMop.exe
  C:\Windows\System\vvRjMop.exe
  2⤵
  PID:8456
- C:\Windows\System\eqpoqtH.exe
  C:\Windows\System\eqpoqtH.exe
  2⤵
  PID:8472
- C:\Windows\System\ClbFAqk.exe
  C:\Windows\System\ClbFAqk.exe
  2⤵
  PID:8488
- C:\Windows\System\NNYrDyx.exe
  C:\Windows\System\NNYrDyx.exe
  2⤵
  PID:8504
- C:\Windows\System\oXMDCcR.exe
  C:\Windows\System\oXMDCcR.exe
  2⤵
  PID:8520
- C:\Windows\System\rkIuOUV.exe
  C:\Windows\System\rkIuOUV.exe
  2⤵
  PID:8536
- C:\Windows\System\hJnJUCH.exe
  C:\Windows\System\hJnJUCH.exe
  2⤵
  PID:8552
- C:\Windows\System\LsyktUu.exe
  C:\Windows\System\LsyktUu.exe
  2⤵
  PID:8568
- C:\Windows\System\YsWnTxF.exe
  C:\Windows\System\YsWnTxF.exe
  2⤵
  PID:8584
- C:\Windows\System\ciZuxxN.exe
  C:\Windows\System\ciZuxxN.exe
  2⤵
  PID:8600
- C:\Windows\System\UIFBqvT.exe
  C:\Windows\System\UIFBqvT.exe
  2⤵
  PID:8616
- C:\Windows\System\vBeaNms.exe
  C:\Windows\System\vBeaNms.exe
  2⤵
  PID:8636
- C:\Windows\System\OllGRbt.exe
  C:\Windows\System\OllGRbt.exe
  2⤵
  PID:8652
- C:\Windows\System\wpxNTaO.exe
  C:\Windows\System\wpxNTaO.exe
  2⤵
  PID:8668
- C:\Windows\System\JccArqB.exe
  C:\Windows\System\JccArqB.exe
  2⤵
  PID:8684
- C:\Windows\System\CcbcKXX.exe
  C:\Windows\System\CcbcKXX.exe
  2⤵
  PID:8700
- C:\Windows\System\yiqweUu.exe
  C:\Windows\System\yiqweUu.exe
  2⤵
  PID:8716
- C:\Windows\System\zDcidNq.exe
  C:\Windows\System\zDcidNq.exe
  2⤵
  PID:8732
- C:\Windows\System\UjBgYSo.exe
  C:\Windows\System\UjBgYSo.exe
  2⤵
  PID:8748
- C:\Windows\System\WVhveUF.exe
  C:\Windows\System\WVhveUF.exe
  2⤵
  PID:8764
- C:\Windows\System\SuiodYS.exe
  C:\Windows\System\SuiodYS.exe
  2⤵
  PID:8780
- C:\Windows\System\RguQOFJ.exe
  C:\Windows\System\RguQOFJ.exe
  2⤵
  PID:8796
- C:\Windows\System\fOdUgTE.exe
  C:\Windows\System\fOdUgTE.exe
  2⤵
  PID:8812
- C:\Windows\System\irzUpVu.exe
  C:\Windows\System\irzUpVu.exe
  2⤵
  PID:8828
- C:\Windows\System\ddPGdOg.exe
  C:\Windows\System\ddPGdOg.exe
  2⤵
  PID:8844
- C:\Windows\System\WypUkaq.exe
  C:\Windows\System\WypUkaq.exe
  2⤵
  PID:8860
- C:\Windows\System\QGqyYkb.exe
  C:\Windows\System\QGqyYkb.exe
  2⤵
  PID:8876
- C:\Windows\System\uTJAwrF.exe
  C:\Windows\System\uTJAwrF.exe
  2⤵
  PID:8892
- C:\Windows\System\XzthFIF.exe
  C:\Windows\System\XzthFIF.exe
  2⤵
  PID:8908
- C:\Windows\System\XmECPZY.exe
  C:\Windows\System\XmECPZY.exe
  2⤵
  PID:8924
- C:\Windows\System\XeBVRPH.exe
  C:\Windows\System\XeBVRPH.exe
  2⤵
  PID:8940
- C:\Windows\System\kqJukFP.exe
  C:\Windows\System\kqJukFP.exe
  2⤵
  PID:8956
- C:\Windows\System\OZuXWkQ.exe
  C:\Windows\System\OZuXWkQ.exe
  2⤵
  PID:8972
- C:\Windows\System\ASzPxHO.exe
  C:\Windows\System\ASzPxHO.exe
  2⤵
  PID:8988
- C:\Windows\System\dQgSKup.exe
  C:\Windows\System\dQgSKup.exe
  2⤵
  PID:9004
- C:\Windows\System\tLuWrgG.exe
  C:\Windows\System\tLuWrgG.exe
  2⤵
  PID:9020
- C:\Windows\System\JKnSpsu.exe
  C:\Windows\System\JKnSpsu.exe
  2⤵
  PID:9036
- C:\Windows\System\pQGGXlc.exe
  C:\Windows\System\pQGGXlc.exe
  2⤵
  PID:9052
- C:\Windows\System\XygVPvk.exe
  C:\Windows\System\XygVPvk.exe
  2⤵
  PID:9068
- C:\Windows\System\RAGqOVo.exe
  C:\Windows\System\RAGqOVo.exe
  2⤵
  PID:9084
- C:\Windows\System\fIQRRNG.exe
  C:\Windows\System\fIQRRNG.exe
  2⤵
  PID:9100
- C:\Windows\System\ZJKhEIb.exe
  C:\Windows\System\ZJKhEIb.exe
  2⤵
  PID:9116
- C:\Windows\System\bXzmhQA.exe
  C:\Windows\System\bXzmhQA.exe
  2⤵
  PID:9132
- C:\Windows\System\BuSuNaz.exe
  C:\Windows\System\BuSuNaz.exe
  2⤵
  PID:9148
- C:\Windows\System\PiODylC.exe
  C:\Windows\System\PiODylC.exe
  2⤵
  PID:9164
- C:\Windows\System\eSWTNdj.exe
  C:\Windows\System\eSWTNdj.exe
  2⤵
  PID:9180
- C:\Windows\System\wiUUePQ.exe
  C:\Windows\System\wiUUePQ.exe
  2⤵
  PID:9196
- C:\Windows\System\YtVQkoe.exe
  C:\Windows\System\YtVQkoe.exe
  2⤵
  PID:9212
- C:\Windows\System\YmZcWDj.exe
  C:\Windows\System\YmZcWDj.exe
  2⤵
  PID:8196
- C:\Windows\System\vFwmikH.exe
  C:\Windows\System\vFwmikH.exe
  2⤵
  PID:8228
- C:\Windows\System\xhUdCNj.exe
  C:\Windows\System\xhUdCNj.exe
  2⤵
  PID:8276
- C:\Windows\System\feiZMLl.exe
  C:\Windows\System\feiZMLl.exe
  2⤵
  PID:8292
- C:\Windows\System\gBpdgty.exe
  C:\Windows\System\gBpdgty.exe
  2⤵
  PID:8340
- C:\Windows\System\GZzTcYI.exe
  C:\Windows\System\GZzTcYI.exe
  2⤵
  PID:8400
- C:\Windows\System\eVpQCwo.exe
  C:\Windows\System\eVpQCwo.exe
  2⤵
  PID:8432
- C:\Windows\System\uepSKNr.exe
  C:\Windows\System\uepSKNr.exe
  2⤵
  PID:8420
- C:\Windows\System\iymtrpu.exe
  C:\Windows\System\iymtrpu.exe
  2⤵
  PID:8468
- C:\Windows\System\QqYIhzr.exe
  C:\Windows\System\QqYIhzr.exe
  2⤵
  PID:8500
- C:\Windows\System\jmYyZPU.exe
  C:\Windows\System\jmYyZPU.exe
  2⤵
  PID:8484
- C:\Windows\System\oBMqHHo.exe
  C:\Windows\System\oBMqHHo.exe
  2⤵
  PID:8592
- C:\Windows\System\bvurHre.exe
  C:\Windows\System\bvurHre.exe
  2⤵
  PID:8580
- C:\Windows\System\LEUohKL.exe
  C:\Windows\System\LEUohKL.exe
  2⤵
  PID:8612
- C:\Windows\System\tZcFuOm.exe
  C:\Windows\System\tZcFuOm.exe
  2⤵
  PID:8692
- C:\Windows\System\ehFjhDw.exe
  C:\Windows\System\ehFjhDw.exe
  2⤵
  PID:8756
- C:\Windows\System\eCcOiCk.exe
  C:\Windows\System\eCcOiCk.exe
  2⤵
  PID:8824
- C:\Windows\System\tUeAdbz.exe
  C:\Windows\System\tUeAdbz.exe
  2⤵
  PID:8648
- C:\Windows\System\UChGXcj.exe
  C:\Windows\System\UChGXcj.exe
  2⤵
  PID:8680
- C:\Windows\System\zrDARhf.exe
  C:\Windows\System\zrDARhf.exe
  2⤵
  PID:8916
- C:\Windows\System\vDCLSYS.exe
  C:\Windows\System\vDCLSYS.exe
  2⤵
  PID:8712
- C:\Windows\System\MYOydlu.exe
  C:\Windows\System\MYOydlu.exe
  2⤵
  PID:8740
- C:\Windows\System\AgqPOfS.exe
  C:\Windows\System\AgqPOfS.exe
  2⤵
  PID:8904
- C:\Windows\System\sRstYlh.exe
  C:\Windows\System\sRstYlh.exe
  2⤵
  PID:8984
- C:\Windows\System\PmeiwDW.exe
  C:\Windows\System\PmeiwDW.exe
  2⤵
  PID:8996
- C:\Windows\System\lsPFWJN.exe
  C:\Windows\System\lsPFWJN.exe
  2⤵
  PID:9016
- C:\Windows\System\hbBwDtA.exe
  C:\Windows\System\hbBwDtA.exe
  2⤵
  PID:9032
- C:\Windows\System\ueWIplP.exe
  C:\Windows\System\ueWIplP.exe
  2⤵
  PID:9064
- C:\Windows\System\bSgTiBM.exe
  C:\Windows\System\bSgTiBM.exe
  2⤵
  PID:1500
- C:\Windows\System\ABMZrol.exe
  C:\Windows\System\ABMZrol.exe
  2⤵
  PID:9144
- C:\Windows\System\hNonsGc.exe
  C:\Windows\System\hNonsGc.exe
  2⤵
  PID:9208
- C:\Windows\System\YYPHouO.exe
  C:\Windows\System\YYPHouO.exe
  2⤵
  PID:8288
- C:\Windows\System\KZctSkw.exe
  C:\Windows\System\KZctSkw.exe
  2⤵
  PID:9188
- C:\Windows\System\AZGWoNL.exe
  C:\Windows\System\AZGWoNL.exe
  2⤵
  PID:8256
- C:\Windows\System\kKWPBoC.exe
  C:\Windows\System\kKWPBoC.exe
  2⤵
  PID:8372
- C:\Windows\System\rzgjrlX.exe
  C:\Windows\System\rzgjrlX.exe
  2⤵
  PID:8496
- C:\Windows\System\rsNSsxc.exe
  C:\Windows\System\rsNSsxc.exe
  2⤵
  PID:8624
- C:\Windows\System\pLQDYvz.exe
  C:\Windows\System\pLQDYvz.exe
  2⤵
  PID:8448
- C:\Windows\System\lcwviyv.exe
  C:\Windows\System\lcwviyv.exe
  2⤵
  PID:8560
- C:\Windows\System\JGXLTqF.exe
  C:\Windows\System\JGXLTqF.exe
  2⤵
  PID:8532
- C:\Windows\System\LPTJVmF.exe
  C:\Windows\System\LPTJVmF.exe
  2⤵
  PID:8820
- C:\Windows\System\WDWGTsW.exe
  C:\Windows\System\WDWGTsW.exe
  2⤵
  PID:8888
- C:\Windows\System\ORoabFX.exe
  C:\Windows\System\ORoabFX.exe
  2⤵
  PID:8980
- C:\Windows\System\AFJDobV.exe
  C:\Windows\System\AFJDobV.exe
  2⤵
  PID:9080
- C:\Windows\System\grmmCle.exe
  C:\Windows\System\grmmCle.exe
  2⤵
  PID:8308
- C:\Windows\System\hTKjNyG.exe
  C:\Windows\System\hTKjNyG.exe
  2⤵
  PID:8356
- C:\Windows\System\AxRTkFq.exe
  C:\Windows\System\AxRTkFq.exe
  2⤵
  PID:8968
- C:\Windows\System\FQezmCT.exe
  C:\Windows\System\FQezmCT.exe
  2⤵
  PID:8788
- C:\Windows\System\eppaqQn.exe
  C:\Windows\System\eppaqQn.exe
  2⤵
  PID:8776
- C:\Windows\System\lmyJhoR.exe
  C:\Windows\System\lmyJhoR.exe
  2⤵
  PID:9204
- C:\Windows\System\KKbFIrN.exe
  C:\Windows\System\KKbFIrN.exe
  2⤵
  PID:8744
- C:\Windows\System\HmvRpOT.exe
  C:\Windows\System\HmvRpOT.exe
  2⤵
  PID:8900
- C:\Windows\System\cRtRGAb.exe
  C:\Windows\System\cRtRGAb.exe
  2⤵
  PID:8324
- C:\Windows\System\XQrdDSJ.exe
  C:\Windows\System\XQrdDSJ.exe
  2⤵
  PID:8548
- C:\Windows\System\lOduyTx.exe
  C:\Windows\System\lOduyTx.exe
  2⤵
  PID:8224
- C:\Windows\System\ZfktPUi.exe
  C:\Windows\System\ZfktPUi.exe
  2⤵
  PID:8952
- C:\Windows\System\dzKaqOl.exe
  C:\Windows\System\dzKaqOl.exe
  2⤵
  PID:9176
- C:\Windows\System\EIERbiI.exe
  C:\Windows\System\EIERbiI.exe
  2⤵
  PID:8644
- C:\Windows\System\hheQLlk.exe
  C:\Windows\System\hheQLlk.exe
  2⤵
  PID:8212
- C:\Windows\System\tzRlADX.exe
  C:\Windows\System\tzRlADX.exe
  2⤵
  PID:9160
- C:\Windows\System\mgbFqKi.exe
  C:\Windows\System\mgbFqKi.exe
  2⤵
  PID:8708
- C:\Windows\System\lLSAEcU.exe
  C:\Windows\System\lLSAEcU.exe
  2⤵
  PID:8660
- C:\Windows\System\FPYbWxt.exe
  C:\Windows\System\FPYbWxt.exe
  2⤵
  PID:8840
- C:\Windows\System\WERjjQh.exe
  C:\Windows\System\WERjjQh.exe
  2⤵
  PID:9156
- C:\Windows\System\ygzbcwm.exe
  C:\Windows\System\ygzbcwm.exe
  2⤵
  PID:9232
- C:\Windows\System\DkLwIgO.exe
  C:\Windows\System\DkLwIgO.exe
  2⤵
  PID:9248
- C:\Windows\System\AAfZLGf.exe
  C:\Windows\System\AAfZLGf.exe
  2⤵
  PID:9264
- C:\Windows\System\rVXseTK.exe
  C:\Windows\System\rVXseTK.exe
  2⤵
  PID:9292
- C:\Windows\System\eqbPpmF.exe
  C:\Windows\System\eqbPpmF.exe
  2⤵
  PID:9308
- C:\Windows\System\DvwtYdi.exe
  C:\Windows\System\DvwtYdi.exe
  2⤵
  PID:9324
- C:\Windows\System\XyWhcSx.exe
  C:\Windows\System\XyWhcSx.exe
  2⤵
  PID:9348
- C:\Windows\System\DOKXbIs.exe
  C:\Windows\System\DOKXbIs.exe
  2⤵
  PID:9364
- C:\Windows\System\PeQTrwZ.exe
  C:\Windows\System\PeQTrwZ.exe
  2⤵
  PID:9380
- C:\Windows\System\tPZrCyD.exe
  C:\Windows\System\tPZrCyD.exe
  2⤵
  PID:9396
- C:\Windows\System\qMeBFAH.exe
  C:\Windows\System\qMeBFAH.exe
  2⤵
  PID:9412
- C:\Windows\System\MDMSKjV.exe
  C:\Windows\System\MDMSKjV.exe
  2⤵
  PID:9428
- C:\Windows\System\TwkpHBQ.exe
  C:\Windows\System\TwkpHBQ.exe
  2⤵
  PID:9448
- C:\Windows\System\wHznXJw.exe
  C:\Windows\System\wHznXJw.exe
  2⤵
  PID:9464
- C:\Windows\System\kczrPRl.exe
  C:\Windows\System\kczrPRl.exe
  2⤵
  PID:9480
- C:\Windows\System\seYwvgg.exe
  C:\Windows\System\seYwvgg.exe
  2⤵
  PID:9496
- C:\Windows\System\DmjloCd.exe
  C:\Windows\System\DmjloCd.exe
  2⤵
  PID:9516
- C:\Windows\System\maYEJsJ.exe
  C:\Windows\System\maYEJsJ.exe
  2⤵
  PID:9536
- C:\Windows\System\XRNiVXZ.exe
  C:\Windows\System\XRNiVXZ.exe
  2⤵
  PID:9552
- C:\Windows\System\oMmxEBz.exe
  C:\Windows\System\oMmxEBz.exe
  2⤵
  PID:9568
- C:\Windows\System\mdndMUc.exe
  C:\Windows\System\mdndMUc.exe
  2⤵
  PID:9584
- C:\Windows\System\SfhdytO.exe
  C:\Windows\System\SfhdytO.exe
  2⤵
  PID:9600
- C:\Windows\System\KutDZjJ.exe
  C:\Windows\System\KutDZjJ.exe
  2⤵
  PID:9616
- C:\Windows\System\ydimBvN.exe
  C:\Windows\System\ydimBvN.exe
  2⤵
  PID:9632
- C:\Windows\System\VoueRLX.exe
  C:\Windows\System\VoueRLX.exe
  2⤵
  PID:9648
- C:\Windows\System\uAQlMwT.exe
  C:\Windows\System\uAQlMwT.exe
  2⤵
  PID:9664
- C:\Windows\System\DRrqiyc.exe
  C:\Windows\System\DRrqiyc.exe
  2⤵
  PID:9680
- C:\Windows\System\DbdTWvD.exe
  C:\Windows\System\DbdTWvD.exe
  2⤵
  PID:9700
- C:\Windows\System\MYuSZXS.exe
  C:\Windows\System\MYuSZXS.exe
  2⤵
  PID:9716
- C:\Windows\System\xTIPitI.exe
  C:\Windows\System\xTIPitI.exe
  2⤵
  PID:9732
- C:\Windows\System\vRwvaxm.exe
  C:\Windows\System\vRwvaxm.exe
  2⤵
  PID:9748
- C:\Windows\System\WdCdwel.exe
  C:\Windows\System\WdCdwel.exe
  2⤵
  PID:9764
- C:\Windows\System\xYKMKmE.exe
  C:\Windows\System\xYKMKmE.exe
  2⤵
  PID:9780
- C:\Windows\System\QTzLLct.exe
  C:\Windows\System\QTzLLct.exe
  2⤵
  PID:9796
- C:\Windows\System\hjFVaDU.exe
  C:\Windows\System\hjFVaDU.exe
  2⤵
  PID:9812
- C:\Windows\System\fMSRltH.exe
  C:\Windows\System\fMSRltH.exe
  2⤵
  PID:9828
- C:\Windows\System\SYGvjmj.exe
  C:\Windows\System\SYGvjmj.exe
  2⤵
  PID:9844
- C:\Windows\System\yELhZgp.exe
  C:\Windows\System\yELhZgp.exe
  2⤵
  PID:9860
- C:\Windows\System\KqHHkwz.exe
  C:\Windows\System\KqHHkwz.exe
  2⤵
  PID:9876
- C:\Windows\System\JshVyjc.exe
  C:\Windows\System\JshVyjc.exe
  2⤵
  PID:9892
- C:\Windows\System\XZLqhlH.exe
  C:\Windows\System\XZLqhlH.exe
  2⤵
  PID:9908
- C:\Windows\System\kiyCLlv.exe
  C:\Windows\System\kiyCLlv.exe
  2⤵
  PID:9924
- C:\Windows\System\FbhgcCe.exe
  C:\Windows\System\FbhgcCe.exe
  2⤵
  PID:9940
- C:\Windows\System\dTFItoL.exe
  C:\Windows\System\dTFItoL.exe
  2⤵
  PID:9956
- C:\Windows\System\iddZGxS.exe
  C:\Windows\System\iddZGxS.exe
  2⤵
  PID:9972
- C:\Windows\System\ILysGbF.exe
  C:\Windows\System\ILysGbF.exe
  2⤵
  PID:9988
- C:\Windows\System\AtbKMBD.exe
  C:\Windows\System\AtbKMBD.exe
  2⤵
  PID:10004
- C:\Windows\System\yooEWHH.exe
  C:\Windows\System\yooEWHH.exe
  2⤵
  PID:10020
- C:\Windows\System\cBbPXdg.exe
  C:\Windows\System\cBbPXdg.exe
  2⤵
  PID:10036
- C:\Windows\System\eiBdqvS.exe
  C:\Windows\System\eiBdqvS.exe
  2⤵
  PID:10052
- C:\Windows\System\PTwWlzx.exe
  C:\Windows\System\PTwWlzx.exe
  2⤵
  PID:10068
- C:\Windows\System\rdzBAmi.exe
  C:\Windows\System\rdzBAmi.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:10084
- C:\Windows\System\TWIHmQE.exe
  C:\Windows\System\TWIHmQE.exe
  2⤵
  PID:10100
- C:\Windows\System\BRtMGyq.exe
  C:\Windows\System\BRtMGyq.exe
  2⤵
  PID:10116
- C:\Windows\System\GvldFik.exe
  C:\Windows\System\GvldFik.exe
  2⤵
  PID:10132
- C:\Windows\System\MEfbUYe.exe
  C:\Windows\System\MEfbUYe.exe
  2⤵
  PID:10148
- C:\Windows\System\LXgJPRF.exe
  C:\Windows\System\LXgJPRF.exe
  2⤵
  PID:10164
- C:\Windows\System\GvRacBz.exe
  C:\Windows\System\GvRacBz.exe
  2⤵
  PID:10180
- C:\Windows\System\gNzSIbU.exe
  C:\Windows\System\gNzSIbU.exe
  2⤵
  PID:10196
- C:\Windows\System\foAJjWo.exe
  C:\Windows\System\foAJjWo.exe
  2⤵
  PID:10212
- C:\Windows\System\WMpOgKn.exe
  C:\Windows\System\WMpOgKn.exe
  2⤵
  PID:10228
- C:\Windows\System\ASrlOHU.exe
  C:\Windows\System\ASrlOHU.exe
  2⤵
  PID:9076
- C:\Windows\System\oTzEyUL.exe
  C:\Windows\System\oTzEyUL.exe
  2⤵
  PID:9244
- C:\Windows\System\ZkeRUAQ.exe
  C:\Windows\System\ZkeRUAQ.exe
  2⤵
  PID:8792
- C:\Windows\System\KvoyHrO.exe
  C:\Windows\System\KvoyHrO.exe
  2⤵
  PID:9304
- C:\Windows\System\uQOkAeb.exe
  C:\Windows\System\uQOkAeb.exe
  2⤵
  PID:9336
- C:\Windows\System\DanFOqz.exe
  C:\Windows\System\DanFOqz.exe
  2⤵
  PID:9360
- C:\Windows\System\mMnUomx.exe
  C:\Windows\System\mMnUomx.exe
  2⤵
  PID:9376
- C:\Windows\System\hiHcVbb.exe
  C:\Windows\System\hiHcVbb.exe
  2⤵
  PID:9424
- C:\Windows\System\MLuiunX.exe
  C:\Windows\System\MLuiunX.exe
  2⤵
  PID:9472
- C:\Windows\System\WaKsivA.exe
  C:\Windows\System\WaKsivA.exe
  2⤵
  PID:9488
- C:\Windows\System\hUlKOjR.exe
  C:\Windows\System\hUlKOjR.exe
  2⤵
  PID:9560
- C:\Windows\System\fSqKARy.exe
  C:\Windows\System\fSqKARy.exe
  2⤵
  PID:9512

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\CckGqqR.exe

Filesize
1.6MB

MD5
1be565c152c1fc490e9622d8530e8fd7

SHA1
5005bd40e75ecd2633a7072d30b918e339da92d3

SHA256
121a2a43f27a8b61cdca02c6980943b086969b2bb34e43faba8e7cc3b02f5606

SHA512
cb29721d68251215435aeb885b9a186a06302b3622c0d6a9f7b48b1a1cae49d29a4dfd14269d662aaada6ac22ee12524cec50c14f791f4d581f6a1f9c1d89e94

Download Submit
C:\Windows\system\CglJXlY.exe

Filesize
1.6MB

MD5
5d99fa9ca36165f45ee1a0b7311e82aa

SHA1
ddd3bd5fd7e02dc8d92ff6865091c756443cad7e

SHA256
82f086fb20aad4f959c191646f50bdfa7616e9099366266c83ba9b14c704b635

SHA512
5a370acb5affd9263faef5b05f359327a8ee578abb66b5b247905700aab585dd0520da00b76840e6fc4d2eafb06f6b913892299d350f82497d59a0a6dd20e2e6

Download Submit
C:\Windows\system\CjbsZKN.exe

Filesize
1.6MB

MD5
f25caa98f010477a395aedd1bd99bb72

SHA1
186f0c660c5e09e3199079a1718d41e237c14489

SHA256
325f5d8b7a931682a4e25fa1bbd1b6d4f37b1fc601118f3b3de5cbf61bf58fee

SHA512
df4262d3fc45ec41e803d653b644af6592b9e408abbc5b9bd0e620f45a6421507b63a5c4b015f7b43dd2f7939cb7d810573f02a1196982e9c29fb60495e86f50

Download Submit
C:\Windows\system\KxWfZGI.exe

Filesize
1.6MB

MD5
ea63aff8b3a25bb95e6cdda8e0a8fba0

SHA1
04f4cb0e26152bb50064655011c4265f289ee962

SHA256
47525cd2950a4bca9f93c400dc8d29f06404a40130e93e11820e2d9d38f50cff

SHA512
a28b8bee1434107f3c686e8db6a09703999040c99ecc9fc236fc923e9a7aef621eeee577678007d8d4cbd786d39905e72f910534ad5a3af1b4cf2d437804a88d

Download Submit
C:\Windows\system\LklkSwe.exe

Filesize
1.6MB

MD5
e72bad782f612831acff41fb0eaf1f7f

SHA1
10f00dde85fa169959aaf424a02e7c3b237be860

SHA256
70f835087a1d0dd420db304718c382a3b7bdcfe986fb42c85f512696c3bae52f

SHA512
4dcc653b9c097b0a21dc4838c7d857360e2d3d1d28de836086ad82577d798f73b374735b1ca145e30c7ec31c7ef458cf4e7359bcb248f5d9343288886148eedf

Download Submit
C:\Windows\system\NCMeFRT.exe

Filesize
1.6MB

MD5
f5e0c1e7e708b9efd60c191d0062b468

SHA1
010bea6b9855b576cd3938681ba74defb64756ec

SHA256
7d9d5e318a042d61da6b1cd63148a8580749229a16437fcad6a263bde88537de

SHA512
6e7e031e7363d82b7b124ccb8e8bd03977ecc20783e91276f579c4363dde48f1d0edad25ffdb68c26e2d8c9b16f1b3a7bd4b1304c358297b4ecd416b085fdd7e

Download Submit
C:\Windows\system\RNQjuFs.exe

Filesize
1.6MB

MD5
210e374865457298e233353608adc691

SHA1
ae2121347c99fc6597f7decc217260c181658a5c

SHA256
f57109eb34a34c239a3b8d1c985f1904b4f5e44012a35b99cb6e260f3d4f59f8

SHA512
2453e6239f0b43d68cee3d453dcba43306074da55be0ca3815ac438a3315c1494e32ca6bfdd0a115a3ddfb0d755e3ebb4f92d398734cf87a6ed90e11b00b3545

Download Submit
C:\Windows\system\SNbwUpg.exe

Filesize
1.6MB

MD5
b8cc50133faeb68302c635319d00d79e

SHA1
dcb41941dfb99dff850bdd5040eb63c6ed03fcd6

SHA256
19026577c4748d9085ec6d00838c9c11ddcb6a892b18b5d37428d0b42a66ef0e

SHA512
85b8b4ca2c632226f729127eba294ba3689273584b481a2293ee68262d43ad17e3f34d117d240558b06d3a8254f2755743a816f42b53c007e720aae1275d60c4

Download Submit
C:\Windows\system\TRsUZzU.exe

Filesize
1.6MB

MD5
1ff2158cf1b21caff07a0217d47d6bec

SHA1
cd22c28bca9d3618809b6a7f99516779192a8d9f

SHA256
15566b97d70efbe7c43fca0d9eda84ad5ec26d5a83e1436243cd27c4ba66513c

SHA512
e7d212ce4165220f0d1ac5714df06e77e4b7e1a681378b9c141c0149bc3424313d6561602feca045afaf9b20f7d1d2bb1dae5e62ab12b76d65b47ad922a2e325

Download Submit
C:\Windows\system\TdagFAg.exe

Filesize
1.6MB

MD5
ee7739fb06bfb1bb90581e6b1e68d583

SHA1
60414bab5c5e4416e4c0eed3f5ddad93c2b90bc0

SHA256
afebaf454ee80a08288de7c834db190f358a4c921ef6403860a96911f21733fe

SHA512
f2a8a6909219ae005888433db1a8af91f572f16da8b97846d40ff951fc259ab5e22686468873f21d961dbf0622e4158d4f9ae03be12ecdc50f00a02c95d67d1c

Download Submit
C:\Windows\system\UIAtLwC.exe

Filesize
1.6MB

MD5
c6b85fd78bbf1161ca8dc302dd17ae52

SHA1
3d9691f981692fce3a28001c72d1169f18e19bf4

SHA256
3a9909b4c0ed3758ee9865a15844c52651f5bd44eb775dc04917838bf7414476

SHA512
08b2a5bc022ff20ca93313f25d202a84340123a328d2cbda4c3d881f6e2d60b08da318aea49fe991a903f882b51654e4c531e579f9a16dda4eb705cd5f8397c1

Download Submit
C:\Windows\system\VtlbtLv.exe

Filesize
1.6MB

MD5
103219841081e357d05bad0e0b1c4d2e

SHA1
29aeca8c1e07da1f65a9cc9ea99f3c7964961564

SHA256
62eb7eebf7d4c8750ebbd6b0b7eba10b4cadcb0a18e0f8e441c946b43e52e20c

SHA512
4ff10f5699dc3d1ee80b4571f88b25f146c3794ae3c54cfc4d88b6dc9dee6c414152d8eb0be99f390f8672af57c3bf32f090d418f3b78a081eee5c1f9aa1ee7d

Download Submit
C:\Windows\system\XUBoArq.exe

Filesize
1.6MB

MD5
4bc1c55d82ed7806eeb1e0d4cb52a370

SHA1
088ac8b4bd89f5ac9a287b68feb000a204c545b0

SHA256
eb3395ddfa0ac053344fb77c0ad230d910f51f63b926198210dfbe716b5461d5

SHA512
e44bc9adae8b178f0872260b48ea1f5725db488235ecbeb9a58658924a70e572471bcc495e0cbf5d77f2570c6c64603107d1a6608251e302ac796664b712e78c

Download Submit
C:\Windows\system\XopTOmK.exe

Filesize
1.6MB

MD5
683f26a95c1758933687fc72ad399f93

SHA1
a50a5c3abc8caba6a06224614f2bc83a6e02f1b8

SHA256
d1e7a34e3d076f0f4dcec3064aa86ce0ef0cd268022377fb54c5922eaa15eef9

SHA512
e91b21354d1ace5ac61cb3d20cc97a6ff3a71e92bac74aca4e108ea126d840ba7a1478cffc98dce4d529bcd1f02fef14d6c6fd832c1621edfb517df874211aab

Download Submit
C:\Windows\system\aYgnacO.exe

Filesize
8B

MD5
4585af961e6be7f3b03d075298565b62

SHA1
8e84c60639225761f581ea4ec1ff9a2d8e5472c9

SHA256
b8920be4ca9181e84576dfb449141c7d9af40d7ddc5588ea3cac8c68ef3a0a88

SHA512
aca862ef42a6056537a17dcbf9d8778efa38fbecbcb6ce3dce02a2eb0f5b9ffb56a667b21c26a29159a0ebcd14d21a77c5b25a36880c46863acba28da90e75f0

Download Submit
C:\Windows\system\bVxDUlO.exe

Filesize
1.6MB

MD5
87f7f02cd008c9900c56c5e2aa300a47

SHA1
99d26630ba6da545784cdeebc25ebb911f059d63

SHA256
dfa651cdfad8671ace92906722e202fc8c7aa50aef02a2147fafb24f553e30e6

SHA512
a332db57c0fe256085396dfe4403971b09b2d48dab1d1ea8a1b4167bbd6f1d8d634492cb0481a89ab53fde060b4dcdf5bf3e2bc6f8ed32038c95a53d62d09e6e

Download Submit
C:\Windows\system\cJAqEAm.exe

Filesize
1.6MB

MD5
9cb293eb3f15451c0be0df26c1e04488

SHA1
9d10b68b1f6c28f7331eff438c3353c4a7485583

SHA256
a2036a4af26194ec90199a92fb348e449986d830949fe8eac7904681b47ba0cc

SHA512
33d52f3858fe6ed0996bc69a0eb1df228327a477b32d37a89485f87bc68cd070fb15e6fa8f36a38833f123de4d7325e5fd105c4a2421f8bb4658cbe4a61011d1

Download Submit
C:\Windows\system\fnLghAS.exe

Filesize
1.6MB

MD5
953889e4f61e3c0ae5e6c136124075ea

SHA1
c74ad984d0acf18a27450fcd40b9e3137db1bacc

SHA256
c9816b3d32a935079313475add6143fdc564bdc2cc2d952cf9d4dcc66000666e

SHA512
b7e02895244f047e5f478f07760231bba047159fffed3c7fb7120e67a7b678edc08ca5a85ee17a3fd06d0ad6d6d22973176aa288a6d7da61a92620d72c46f9cc

Download Submit
C:\Windows\system\lXvfJOd.exe

Filesize
1.6MB

MD5
7b575be54a43e803c2ef75df4877a296

SHA1
b469968ea4fcda0ce0e5a1011a9bf9f2795b1292

SHA256
c5b693909758660682dd72e39f4b308ae3292528a939d9572c113b0477029e78

SHA512
cc357f25418cf6e41e36c6ebc815b37321736657380c3762c23b57028422c85c843520d5943e2bb8c3c0c14aca8491583fb035027c650ff96ac3130cc2d7683c

Download Submit
C:\Windows\system\nqkKXMF.exe

Filesize
1.6MB

MD5
dcd848d395a73dd31c634c0978debfbc

SHA1
d052965e54fbcd458bd482157444cc1505104abf

SHA256
9bc83533e273557cb0fdb550ed868cb6a19a4ed938fad832257d37e26b01d272

SHA512
cf3c964f6ec411d7b33a3f56938df433e4473164e71b559dcab7a4bb2f6030681c6ca99f43f908a29d075ae54485d098e548e4a47eb9bc28e64d9e7d3b99f627

Download Submit
C:\Windows\system\oVyLfWy.exe

Filesize
1.6MB

MD5
c0fa653efdfde54555f1cc601eecb837

SHA1
1d3b79f695c5f8c70f8599e0e865637c996e07b0

SHA256
16909bd035bf03011a0b5d96fe656d91f01e197c2cf9398714f10b8f1593801f

SHA512
ac4f695d73efb58b543ac1d6eaf454998a85b5c97270398d248cc5bb246519e853aaadd99f14d6f8c50dd93e090949baf60db661b86358da40e8876ae7c247c1

Download Submit
C:\Windows\system\rtIWpkg.exe

Filesize
1.6MB

MD5
809000ed2b68dee88e381275b177744b

SHA1
f25800f018884cb6f4738db6fa2d38d20cc64f7f

SHA256
3a52cb109e7da82e763386f3644390273739a3a95c60ab1a1daf909dae06f694

SHA512
34216b36f46b1d094cecf1923df0b84a26087db42e936b85bc194b34c5fd35b5aba8acf77fed64aa2294349497fe3b6a238e6f86eb98cfa7ce723dbda166c816

Download Submit
C:\Windows\system\wcyqanS.exe

Filesize
1.6MB

MD5
4f1b0f46fda64396e47d0460f0f1f248

SHA1
aad0d1ed2771e1f987653a28dc950f0ee79b2a13

SHA256
907b39079a008b6c5738e7eb09ee9df7afaec2c6d9be900169a3f10e671df149

SHA512
3662f7dca6fe2898f76812f9927f5d8e5926d5c416e3e5f1f1d0dd5b3dfae6751623489258b5dd60cb21d573e53e9bbf4b78d8af177034fe65a36d0e5b8892ed

Download Submit
C:\Windows\system\xZCbpwi.exe

Filesize
1.6MB

MD5
02b089aa6bd572035aec52403c923e7a

SHA1
e6e5f2a19849530e80a5ed134a603bd709c4cb81

SHA256
935580bc741f97a29875b755b6acbd0a752a88b0648f6ca9e97d83d1caf958e7

SHA512
bdf6617fa370b8d951c89fda756400d4fc79fbf639747c1a362032a0ea928cf5dde5bbcd1c8865cba94c09a1dedb50d7edb4791231101c47ca14b15076b9311d

Download Submit
C:\Windows\system\zAyfXic.exe

Filesize
1.6MB

MD5
eb2780148c0bf6b306610460feae2253

SHA1
fab3917953723c6c9ea1c79e0c1f158e2a6ea6fb

SHA256
7704e1d5b2ad27d89df54c20fc73794674fa4e94a28e8d0f9d40ac54d680cc5a

SHA512
ba83cd14e95378fecd45908300209f23aa93c1222c08b1260f6db00e0374daaee990aefac38415117a642f6b26aa1c7d39c35ba5606e49ec6c45621092b5b614

Download Submit
\Windows\system\AmbegLx.exe

Filesize
1.6MB

MD5
8242a9d58f31d6d47ad33d37382ef080

SHA1
2ec09b95659a1fec306cd2765f8578620274ad3a

SHA256
a2f311372d0ab410576f7bcf9082f26079f9c412a681b5d67bfa67426af70936

SHA512
881ea0cb104979cc97919e9595df67ca339d53ca3ebf52f7a9170f99cf0a892c109a6294cd2ce220b3d448dfdd1b94721d854315a9b94ca43f15cf2d0f552933

Download Submit
\Windows\system\EdCLxyK.exe

Filesize
1.6MB

MD5
85c53535b45466ceeb5c337dd9848783

SHA1
3faf8ab176e7f7d137ab2b14a3d5611ca8efbab0

SHA256
1913afdaf1681ae010a7adf1b2d414e866cb83e0dd69d6cbeb3df61cd8ce276c

SHA512
db192052cf1f493ddaf463eb17fa6706af6615af8f0383ba23e155998a54c1543c1e89db18c6cb1938947c393e62266117cad55fffd62953061294e152678351

Download Submit
\Windows\system\JxhnADH.exe

Filesize
1.6MB

MD5
a3b44bbdc7e4d0778bccda3fd35e4d75

SHA1
a2861e46c3c7cdf098ec5b56c5df3f4dc5b82167

SHA256
44d775e1e06d5c56fae633e68306486c7bc2ebe1df692a6a85c20826b0e70eb7

SHA512
d6a3c4af517e67f597fea677bfe905c41a3d04d601088cc56006a5b6d3168771d10f519e839b4b9727d3f34e050fb083b7b151f00ace596d52bdb04b0395e451

Download Submit
\Windows\system\XgcrBoQ.exe

Filesize
1.6MB

MD5
a517d94866bb40279e355ca3e802b8d6

SHA1
2471b57484f9e20ec4ce8495ca9a32b096a271f9

SHA256
b6909e4fec401db503628c60aee04ad4e412577f54ee2408215a637337a26f04

SHA512
f15adc23d860d8cf62afc9b15a86e5b3245ab8e6ba8a090f34e31a490f96b3ffdba207f5a40324983f56f65de0d8d3314d646215e37cd14bfaee7582a56243a6

Download Submit
\Windows\system\eHwinBh.exe

Filesize
1.6MB

MD5
ebbdf84e1c122efd26c5ff830a674b71

SHA1
71462e8ed383e2e4958b250b2d451b36053b6e8e

SHA256
d6f3a16d04d8a99902ff7de2150a89695e2866c5261593611493f805eb464dfd

SHA512
3729f91d3728abf637d2f17cb9bdf5388b798aa6bc1f1e36da3f0e4907ca3959b33ac06203fc7c79d9eaf97c63f333b16090da561784efafa2b0ca8c60ad0437

Download Submit
\Windows\system\jNeZTUh.exe

Filesize
1.6MB

MD5
c8eb2c8d175eaf2e1fac356e2aa282c3

SHA1
df4d301fc4ff36783cb7c485e9e8b674b6e4ef7d

SHA256
3abcb74a8706b70d4c458dc2cfccc3dfdf6f11cb520047962cd44570047816b1

SHA512
6acdd2f3c38957007f997bec90852d929b38d6564f20687c722933acd76055b89767e422ecec388357a2c170abaa1662a69db709d203b13848607c6167f97737

Download Submit
\Windows\system\uZyfZhf.exe

Filesize
1.6MB

MD5
fc5b464bcbc2ece33b09cdfe4a85126e

SHA1
93978476ad128281704d430c0d8203e7e61b7ab6

SHA256
b639a016c1e299c000877c2fbbd935f0cdfd7095a93df979d2e5e7bd58d7a268

SHA512
3ce71a46e023fded92283c26736e1a5a04a50154b88d2c49f2f90ef352b26e9aa40256c8586a4153488f72c9a43428181d369c89404ef71339a19cdc335ebaf9

Download Submit
\Windows\system\ykDdbBc.exe

Filesize
1.6MB

MD5
65b177a6bddb4a12b6a77837bcfdfded

SHA1
a1f8858977cab3e12a255f91804c0fff52963a3c

SHA256
9f85140afc6d0bab1fcecd9fdd76614c3c97924e2c0ba581d3c862a3cc7177f6

SHA512
45e352625ca28260e5a0b89d42ba7028e3053e3bf9bb02e7d9732e5b97b331fcacb54636b519898af780c01952f568149551a7b9735bffbe19ea753eee9e48c7

Download Submit
memory/1260-5156-0x000000013F320000-0x000000013F712000-memory.dmp

Filesize
3.9MB

Download
memory/1260-97-0x000000013F320000-0x000000013F712000-memory.dmp

Filesize
3.9MB

Download
memory/1564-93-0x000000013F280000-0x000000013F672000-memory.dmp

Filesize
3.9MB

Download
memory/1564-5155-0x000000013F280000-0x000000013F672000-memory.dmp

Filesize
3.9MB

Download
memory/1624-5140-0x000000013F930000-0x000000013FD22000-memory.dmp

Filesize
3.9MB

Download
memory/1624-9-0x000000013F930000-0x000000013FD22000-memory.dmp

Filesize
3.9MB

Download
memory/1716-5154-0x000000013F840000-0x000000013FC32000-memory.dmp

Filesize
3.9MB

Download
memory/1716-91-0x000000013F840000-0x000000013FC32000-memory.dmp

Filesize
3.9MB

Download
memory/1948-80-0x000000013FF30000-0x0000000140322000-memory.dmp

Filesize
3.9MB

Download
memory/1948-74-0x000000013F510000-0x000000013F902000-memory.dmp

Filesize
3.9MB

Download
memory/1948-7582-0x00000000035F0000-0x00000000039E2000-memory.dmp

Filesize
3.9MB

Download
memory/1948-7420-0x00000000035F0000-0x00000000039E2000-memory.dmp

Filesize
3.9MB

Download
memory/1948-7098-0x00000000035F0000-0x00000000039E2000-memory.dmp

Filesize
3.9MB

Download
memory/1948-7058-0x000000013F510000-0x000000013F902000-memory.dmp

Filesize
3.9MB

Download
memory/1948-6499-0x00000000035F0000-0x00000000039E2000-memory.dmp

Filesize
3.9MB

Download
memory/1948-13-0x0000000003060000-0x0000000003452000-memory.dmp

Filesize
3.9MB

Download
memory/1948-92-0x000000013F280000-0x000000013F672000-memory.dmp

Filesize
3.9MB

Download
memory/1948-88-0x00000000035F0000-0x00000000039E2000-memory.dmp

Filesize
3.9MB

Download
memory/1948-8-0x0000000003060000-0x0000000003452000-memory.dmp

Filesize
3.9MB

Download
memory/1948-82-0x00000000035F0000-0x00000000039E2000-memory.dmp

Filesize
3.9MB

Download
memory/1948-0-0x00000000000F0000-0x0000000000100000-memory.dmp

Filesize
64KB

Download
memory/1948-96-0x000000013F320000-0x000000013F712000-memory.dmp

Filesize
3.9MB

Download
memory/1948-25-0x00000000035F0000-0x00000000039E2000-memory.dmp

Filesize
3.9MB

Download
memory/1948-78-0x000000013F340000-0x000000013F732000-memory.dmp

Filesize
3.9MB

Download
memory/1948-95-0x00000000035F0000-0x00000000039E2000-memory.dmp

Filesize
3.9MB

Download
memory/1948-76-0x00000000035F0000-0x00000000039E2000-memory.dmp

Filesize
3.9MB

Download
memory/1948-1-0x000000013F930000-0x000000013FD22000-memory.dmp

Filesize
3.9MB

Download
memory/2228-94-0x000007FEF5C10000-0x000007FEF65AD000-memory.dmp

Filesize
9.6MB

Download
memory/2228-64-0x0000000001FF0000-0x0000000001FF8000-memory.dmp

Filesize
32KB

Download
memory/2228-59-0x000000001B5D0000-0x000000001B8B2000-memory.dmp

Filesize
2.9MB

Download
memory/2228-27-0x0000000002CB0000-0x0000000002D30000-memory.dmp

Filesize
512KB

Download
memory/2228-28-0x000007FEF5ECE000-0x000007FEF5ECF000-memory.dmp

Filesize
4KB

Download
memory/2228-72-0x000007FEF5C10000-0x000007FEF65AD000-memory.dmp

Filesize
9.6MB

Download
memory/2228-136-0x000007FEF5C10000-0x000007FEF65AD000-memory.dmp

Filesize
9.6MB

Download
memory/2228-89-0x000007FEF5C10000-0x000007FEF65AD000-memory.dmp

Filesize
9.6MB

Download
memory/2400-5143-0x000000013F340000-0x000000013F732000-memory.dmp

Filesize
3.9MB

Download
memory/2400-79-0x000000013F340000-0x000000013F732000-memory.dmp

Filesize
3.9MB

Download
memory/2464-81-0x000000013FF30000-0x0000000140322000-memory.dmp

Filesize
3.9MB

Download
memory/2464-5141-0x000000013FF30000-0x0000000140322000-memory.dmp

Filesize
3.9MB

Download
memory/2512-5160-0x000000013F8C0000-0x000000013FCB2000-memory.dmp

Filesize
3.9MB

Download
memory/2512-26-0x000000013F8C0000-0x000000013FCB2000-memory.dmp

Filesize
3.9MB

Download
memory/2568-73-0x000000013F970000-0x000000013FD62000-memory.dmp

Filesize
3.9MB

Download
memory/2568-5157-0x000000013F970000-0x000000013FD62000-memory.dmp

Filesize
3.9MB

Download
memory/2576-5144-0x000000013F510000-0x000000013F902000-memory.dmp

Filesize
3.9MB

Download
memory/2576-75-0x000000013F510000-0x000000013F902000-memory.dmp

Filesize
3.9MB

Download
memory/2580-15-0x000000013F5B0000-0x000000013F9A2000-memory.dmp

Filesize
3.9MB

Download
memory/2580-5158-0x000000013F5B0000-0x000000013F9A2000-memory.dmp

Filesize
3.9MB

Download
memory/2652-5139-0x000000013FBC0000-0x000000013FFB2000-memory.dmp

Filesize
3.9MB

Download
memory/2652-77-0x000000013FBC0000-0x000000013FFB2000-memory.dmp

Filesize
3.9MB

Download
memory/2856-5142-0x000000013F6F0000-0x000000013FAE2000-memory.dmp

Filesize
3.9MB

Download
memory/2856-86-0x000000013F6F0000-0x000000013FAE2000-memory.dmp

Filesize
3.9MB

Download